Correct the r242545 sync with head@242525.

43 files changed, 0 insertions, 44267 deletions

diff --git a/sys/contrib/pf/net/if_pflog.c b/sys/contrib/pf/net/if_pflog.c
deleted file mode 100644
index 349930ba1df0..000000000000
--- a/sys/contrib/pf/net/if_pflog.c
+++ /dev/null
@@ -1,435 +0,0 @@
-/*	$OpenBSD: if_pflog.c,v 1.26 2007/10/18 21:58:18 mpf Exp $	*/
-/*
- * The authors of this code are John Ioannidis (ji@tla.org),
- * Angelos D. Keromytis (kermit@csd.uch.gr) and 
- * Niels Provos (provos@physnet.uni-hamburg.de).
- *
- * This code was written by John Ioannidis for BSD/OS in Athens, Greece, 
- * in November 1995.
- *
- * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
- * by Angelos D. Keromytis.
- *
- * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
- * and Niels Provos.
- *
- * Copyright (C) 1995, 1996, 1997, 1998 by John Ioannidis, Angelos D. Keromytis
- * and Niels Provos.
- * Copyright (c) 2001, Angelos D. Keromytis, Niels Provos.
- *
- * Permission to use, copy, and modify this software with or without fee
- * is hereby granted, provided that this entire notice is included in
- * all copies of any software which is or includes a copy or
- * modification of this software. 
- * You may use this code under the GNU public license if you so wish. Please
- * contribute changes back to the authors under this freer than GPL license
- * so that we may further the use of strong encryption without limitations to
- * all.
- *
- * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
- * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
- * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
- * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
- * PURPOSE.
- */
-
-#ifdef __FreeBSD__
-#include "opt_inet.h"
-#include "opt_inet6.h"
-#include "opt_bpf.h"
-#include "opt_pf.h"
-
-#include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
-
-#ifdef DEV_BPF
-#define	NBPFILTER	DEV_BPF
-#else
-#define	NBPFILTER	0
-#endif
-
-#ifdef DEV_PFLOG
-#define	NPFLOG		DEV_PFLOG
-#else
-#define	NPFLOG		0
-#endif
-
-#else /* ! __FreeBSD__ */
-#include "bpfilter.h"
-#include "pflog.h"
-#endif /* __FreeBSD__ */
-
-#include <sys/param.h>
-#include <sys/systm.h>
-#include <sys/mbuf.h>
-#include <sys/proc.h>
-#include <sys/socket.h>
-#ifdef __FreeBSD__
-#include <sys/kernel.h>
-#include <sys/limits.h>
-#include <sys/malloc.h>
-#include <sys/module.h>
-#include <sys/sockio.h>
-#else
-#include <sys/ioctl.h>
-#endif
-
-#include <net/if.h>
-#ifdef __FreeBSD__
-#include <net/if_clone.h>
-#endif
-#include <net/if_types.h>
-#include <net/route.h>
-#include <net/bpf.h>
-
-#if defined(INET) || defined(INET6)
-#include <netinet/in.h>
-#endif
-#ifdef	INET
-#include <netinet/in_var.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#endif
-
-#ifdef INET6
-#include <netinet6/in6_var.h>
-#include <netinet6/nd6.h>
-#endif /* INET6 */
-
-#include <net/pfvar.h>
-#include <net/if_pflog.h>
-
-#ifdef __FreeBSD__
-#ifdef INET
-#include <machine/in_cksum.h>
-#endif /* INET */
-#endif /* __FreeBSD__ */
-
-#define PFLOGMTU	(32768 + MHLEN + MLEN)
-
-#ifdef PFLOGDEBUG
-#define DPRINTF(x)    do { if (pflogdebug) printf x ; } while (0)
-#else
-#define DPRINTF(x)
-#endif
-
-void	pflogattach(int);
-int	pflogoutput(struct ifnet *, struct mbuf *, struct sockaddr *,
-#ifdef __FreeBSD__
-	    struct route *);
-#else
-	    struct rtentry *);
-#endif
-int	pflogioctl(struct ifnet *, u_long, caddr_t);
-void	pflogstart(struct ifnet *);
-#ifdef __FreeBSD__
-static int pflog_clone_create(struct if_clone *, int, caddr_t);
-static void pflog_clone_destroy(struct ifnet *);
-#else
-int	pflog_clone_create(struct if_clone *, int);
-int	pflog_clone_destroy(struct ifnet *);
-#endif
-
-LIST_HEAD(, pflog_softc)	pflogif_list;
-#ifdef __FreeBSD__
-IFC_SIMPLE_DECLARE(pflog, 1);
-#else
-struct if_clone	pflog_cloner =
-    IF_CLONE_INITIALIZER("pflog", pflog_clone_create, pflog_clone_destroy);
-#endif
-
-struct ifnet	*pflogifs[PFLOGIFS_MAX];	/* for fast access */
-
-void
-pflogattach(int npflog)
-{
-	int	i;
-	LIST_INIT(&pflogif_list);
-	for (i = 0; i < PFLOGIFS_MAX; i++)
-		pflogifs[i] = NULL;
-	if_clone_attach(&pflog_cloner);
-}
-
-#ifdef __FreeBSD__
-static int
-pflog_clone_create(struct if_clone *ifc, int unit, caddr_t param)
-#else
-int
-pflog_clone_create(struct if_clone *ifc, int unit)
-#endif
-{
-	struct ifnet *ifp;
-	struct pflog_softc *pflogif;
-	int s;
-
-	if (unit >= PFLOGIFS_MAX)
-		return (EINVAL);
-
-	if ((pflogif = malloc(sizeof(*pflogif),
-	    M_DEVBUF, M_NOWAIT|M_ZERO)) == NULL)
-		return (ENOMEM);
-
-	pflogif->sc_unit = unit;
-#ifdef __FreeBSD__
-	ifp = pflogif->sc_ifp = if_alloc(IFT_PFLOG);
-	if (ifp == NULL) {
-		free(pflogif, M_DEVBUF);
-		return (ENOSPC);
-	}
-	if_initname(ifp, ifc->ifc_name, unit);
-#else
-	ifp = &pflogif->sc_if;
-	snprintf(ifp->if_xname, sizeof ifp->if_xname, "pflog%d", unit);
-#endif
-	ifp->if_softc = pflogif;
-	ifp->if_mtu = PFLOGMTU;
-	ifp->if_ioctl = pflogioctl;
-	ifp->if_output = pflogoutput;
-	ifp->if_start = pflogstart;
-#ifndef __FreeBSD__
-	ifp->if_type = IFT_PFLOG;
-#endif
-	ifp->if_snd.ifq_maxlen = ifqmaxlen;
-	ifp->if_hdrlen = PFLOG_HDRLEN;
-	if_attach(ifp);
-#ifndef __FreeBSD__
-	if_alloc_sadl(ifp);
-#endif
-
-#if NBPFILTER > 0
-#ifdef __FreeBSD__
-	bpfattach(ifp, DLT_PFLOG, PFLOG_HDRLEN);
-#else
-	bpfattach(&pflogif->sc_if.if_bpf, ifp, DLT_PFLOG, PFLOG_HDRLEN);
-#endif
-#endif
-
-	s = splnet();
-#ifdef __FreeBSD__
-	/* XXX: Why pf(4) lock?! Better add a pflog lock?! */
-	PF_LOCK();
-#endif
-	LIST_INSERT_HEAD(&pflogif_list, pflogif, sc_list);
-	pflogifs[unit] = ifp;
-#ifdef __FreeBSD__
-	PF_UNLOCK();
-#endif
-	splx(s);
-
-	return (0);
-}
-
-#ifdef __FreeBSD__
-static void
-pflog_clone_destroy(struct ifnet *ifp)
-#else
-int
-pflog_clone_destroy(struct ifnet *ifp)
-#endif
-{
-	struct pflog_softc	*pflogif = ifp->if_softc;
-	int			 s;
-
-	s = splnet();
-#ifdef __FreeBSD__
-	PF_LOCK();
-#endif
-	pflogifs[pflogif->sc_unit] = NULL;
-	LIST_REMOVE(pflogif, sc_list);
-#ifdef __FreeBSD__
-	PF_UNLOCK();
-#endif
-	splx(s);
-
-#if NBPFILTER > 0
-	bpfdetach(ifp);
-#endif
-	if_detach(ifp);
-#ifdef __FreeBSD__
-	if_free(ifp);
-#endif
-	free(pflogif, M_DEVBUF);
-#ifndef __FreeBSD__
-	return (0);
-#endif
-}
-
-/*
- * Start output on the pflog interface.
- */
-void
-pflogstart(struct ifnet *ifp)
-{
-	struct mbuf *m;
-#ifndef __FreeBSD__
-	int s;
-#endif
-
-	for (;;) {
-#ifdef __FreeBSD__
-		IF_LOCK(&ifp->if_snd);
-		_IF_DROP(&ifp->if_snd);
-		_IF_DEQUEUE(&ifp->if_snd, m);
-		IF_UNLOCK(&ifp->if_snd);
-#else
-		s = splnet();
-		IF_DROP(&ifp->if_snd);
-		IF_DEQUEUE(&ifp->if_snd, m);
-		splx(s);
-#endif
-
-		if (m == NULL)
-			return;
-		else
-			m_freem(m);
-	}
-}
-
-int
-pflogoutput(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
-#ifdef __FreeBSD__
-	struct route *rt)
-#else
-	struct rtentry *rt)
-#endif
-{
-	m_freem(m);
-	return (0);
-}
-
-/* ARGSUSED */
-int
-pflogioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
-{
-	switch (cmd) {
-	case SIOCSIFFLAGS:
-#ifdef __FreeBSD__
-		if (ifp->if_flags & IFF_UP)
-			ifp->if_drv_flags |= IFF_DRV_RUNNING;
-		else
-			ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
-#else
-		if (ifp->if_flags & IFF_UP)
-			ifp->if_flags |= IFF_RUNNING;
-		else
-			ifp->if_flags &= ~IFF_RUNNING;
-#endif
-		break;
-	default:
-		return (ENOTTY);
-	}
-
-	return (0);
-}
-
-int
-pflog_packet(struct pfi_kif *kif, struct mbuf *m, sa_family_t af, u_int8_t dir,
-    u_int8_t reason, struct pf_rule *rm, struct pf_rule *am,
-    struct pf_ruleset *ruleset, struct pf_pdesc *pd)
-{
-#if NBPFILTER > 0
-	struct ifnet *ifn;
-	struct pfloghdr hdr;
-
-	if (kif == NULL || m == NULL || rm == NULL || pd == NULL)
-		return ( 1);
-
-	if ((ifn = pflogifs[rm->logif]) == NULL || !ifn->if_bpf)
-		return (0);
-
-	bzero(&hdr, sizeof(hdr));
-	hdr.length = PFLOG_REAL_HDRLEN;
-	hdr.af = af;
-	hdr.action = rm->action;
-	hdr.reason = reason;
-	memcpy(hdr.ifname, kif->pfik_name, sizeof(hdr.ifname));
-
-	if (am == NULL) {
-		hdr.rulenr = htonl(rm->nr);
-		hdr.subrulenr =  1;
-	} else {
-		hdr.rulenr = htonl(am->nr);
-		hdr.subrulenr = htonl(rm->nr);
-		if (ruleset != NULL && ruleset->anchor != NULL)
-			strlcpy(hdr.ruleset, ruleset->anchor->name,
-			    sizeof(hdr.ruleset));
-	}
-	if (rm->log & PF_LOG_SOCKET_LOOKUP && !pd->lookup.done)
-#ifdef __FreeBSD__
-		/*
-		 * XXX: This should not happen as we force an early lookup
-		 * via debug.pfugidhack
-		 */
-		; /* empty */
-#else
-		pd->lookup.done = pf_socket_lookup(dir, pd);
-#endif
-	if (pd->lookup.done > 0) {
-		hdr.uid = pd->lookup.uid;
-		hdr.pid = pd->lookup.pid;
-	} else {
-		hdr.uid = UID_MAX;
-		hdr.pid = NO_PID;
-	}
-	hdr.rule_uid = rm->cuid;
-	hdr.rule_pid = rm->cpid;
-	hdr.dir = dir;
-
-#ifdef INET
-	if (af == AF_INET && dir == PF_OUT) {
-		struct ip *ip;
-
-		ip = mtod(m, struct ip *);
-		ip->ip_sum = 0;
-		ip->ip_sum = in_cksum(m, ip->ip_hl << 2);
-	}
-#endif /* INET */
-
-	ifn->if_opackets++;
-	ifn->if_obytes += m->m_pkthdr.len;
-#ifdef __FreeBSD__
-	BPF_MTAP2(ifn, &hdr, PFLOG_HDRLEN, m);
-#else
-	bpf_mtap_hdr(ifn->if_bpf, (char *)&hdr, PFLOG_HDRLEN, m,
-	    BPF_DIRECTION_OUT);
-#endif
-#endif
-
-	return (0);
-}
-
-#ifdef __FreeBSD__
-static int
-pflog_modevent(module_t mod, int type, void *data)
-{
-	int error = 0;
-
-	switch (type) {
-	case MOD_LOAD:
-		pflogattach(1);
-		PF_LOCK();
-		pflog_packet_ptr = pflog_packet;
-		PF_UNLOCK();
-		break;
-	case MOD_UNLOAD:
-		PF_LOCK();
-		pflog_packet_ptr = NULL;
-		PF_UNLOCK();
-		if_clone_detach(&pflog_cloner);
-		break;
-	default:
-		error = EINVAL;
-		break;
-	}
-
-	return error;
-}
-
-static moduledata_t pflog_mod = { "pflog", pflog_modevent, 0 };
-
-#define PFLOG_MODVER 1
-
-DECLARE_MODULE(pflog, pflog_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
-MODULE_VERSION(pflog, PFLOG_MODVER);
-MODULE_DEPEND(pflog, pf, PF_MODVER, PF_MODVER, PF_MODVER);
-#endif /* __FreeBSD__ */
diff --git a/sys/contrib/pf/net/if_pflog.h b/sys/contrib/pf/net/if_pflog.h
deleted file mode 100644
index 5f48f6c75246..000000000000
--- a/sys/contrib/pf/net/if_pflog.h
+++ /dev/null
@@ -1,101 +0,0 @@
-/* $OpenBSD: if_pflog.h,v 1.13 2006/10/23 12:46:09 henning Exp $ */
-/*
- * Copyright 2001 Niels Provos <provos@citi.umich.edu>
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef _NET_IF_PFLOG_H_
-#define	_NET_IF_PFLOG_H_
-
-#define	PFLOGIFS_MAX	16
-
-struct pflog_softc {
-#ifdef __FreeBSD__
-	struct ifnet		*sc_ifp;	/* the interface pointer */
-#else
-	struct ifnet		sc_if;		/* the interface */
-#endif
-	int			sc_unit;
-	LIST_ENTRY(pflog_softc)	sc_list;
-};
-
-#define	PFLOG_RULESET_NAME_SIZE	16
-
-struct pfloghdr {
-	u_int8_t	length;
-	sa_family_t	af;
-	u_int8_t	action;
-	u_int8_t	reason;
-	char		ifname[IFNAMSIZ];
-	char		ruleset[PFLOG_RULESET_NAME_SIZE];
-	u_int32_t	rulenr;
-	u_int32_t	subrulenr;
-	uid_t		uid;
-	pid_t		pid;
-	uid_t		rule_uid;
-	pid_t		rule_pid;
-	u_int8_t	dir;
-	u_int8_t	pad[3];
-};
-
-#define	PFLOG_HDRLEN		sizeof(struct pfloghdr)
-/* minus pad, also used as a signature */
-#define	PFLOG_REAL_HDRLEN	offsetof(struct pfloghdr, pad)
-
-/* XXX remove later when old format logs are no longer needed */
-struct old_pfloghdr {
-	u_int32_t af;
-	char ifname[IFNAMSIZ];
-	short rnr;
-	u_short reason;
-	u_short action;
-	u_short dir;
-};
-#define	OLD_PFLOG_HDRLEN	sizeof(struct old_pfloghdr)
-
-#ifdef _KERNEL
-#ifdef __FreeBSD__
-struct pf_rule;
-struct pf_ruleset;
-struct pfi_kif;
-struct pf_pdesc;
-
-#if 0
-typedef int pflog_packet_t(struct pfi_kif *, struct mbuf *, sa_family_t,
-    u_int8_t, u_int8_t, struct pf_rule *, struct pf_rule *,
-    struct pf_ruleset *, struct pf_pdesc *);
-extern pflog_packet_t *pflog_packet_ptr;
-#endif
-#define	PFLOG_PACKET(i,x,a,b,c,d,e,f,g,h) do {		\
-	if (pflog_packet_ptr != NULL)			\
-		pflog_packet_ptr(i,a,b,c,d,e,f,g,h);    \
-} while (0)
-#else /* ! __FreeBSD__ */
-#if NPFLOG > 0
-#define	PFLOG_PACKET(i,x,a,b,c,d,e,f,g,h) pflog_packet(i,a,b,c,d,e,f,g,h)
-#else
-#define	PFLOG_PACKET(i,x,a,b,c,d,e,f,g,h) ((void)0)
-#endif /* NPFLOG > 0 */
-#endif
-#endif /* _KERNEL */
-#endif /* _NET_IF_PFLOG_H_ */
diff --git a/sys/contrib/pf/net/if_pflow.h b/sys/contrib/pf/net/if_pflow.h
deleted file mode 100644
index 35ccbeb4fc3f..000000000000
--- a/sys/contrib/pf/net/if_pflow.h
+++ /dev/null
@@ -1,126 +0,0 @@
-/*	$OpenBSD: if_pflow.h,v 1.5 2009/02/27 11:09:36 gollo Exp $	*/
-
-/*
- * Copyright (c) 2008 Henning Brauer <henning@openbsd.org>
- * Copyright (c) 2008 Joerg Goltermann <jg@osn.de>
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF MIND, USE, DATA OR PROFITS, WHETHER IN
- * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT
- * OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- * $FreeBSD$
- */
-
-#ifndef _NET_IF_PFLOW_H_
-#define	_NET_IF_PFLOW_H_
-
-#define	PFLOW_ID_LEN	sizeof(u_int64_t)
-
-#define	PFLOW_MAXFLOWS 30
-#define	PFLOW_VERSION 5
-#define	PFLOW_ENGINE_TYPE 42
-#define	PFLOW_ENGINE_ID 42
-#define	PFLOW_MAXBYTES 0xffffffff
-#define	PFLOW_TIMEOUT 30
-
-struct pflow_flow {
-	u_int32_t	src_ip;
-	u_int32_t	dest_ip;
-	u_int32_t	nexthop_ip;
-	u_int16_t	if_index_in;
-	u_int16_t	if_index_out;
-	u_int32_t	flow_packets;
-	u_int32_t	flow_octets;
-	u_int32_t	flow_start;
-	u_int32_t	flow_finish;
-	u_int16_t	src_port;
-	u_int16_t	dest_port;
-	u_int8_t	pad1;
-	u_int8_t	tcp_flags;
-	u_int8_t	protocol;
-	u_int8_t	tos;
-	u_int16_t	src_as;
-	u_int16_t	dest_as;
-	u_int8_t	src_mask;
-	u_int8_t	dest_mask;
-	u_int16_t	pad2;
-} __packed;
-
-#ifdef _KERNEL
-
-extern int pflow_ok;
-
-struct pflow_softc {
-	struct ifnet		 sc_if;
-	struct ifnet		*sc_pflow_ifp;
-
-	unsigned int		 sc_count;
-	unsigned int		 sc_maxcount;
-	u_int64_t		 sc_gcounter;
-	struct ip_moptions	 sc_imo;
-#ifdef __FreeBSD__
-	struct callout		 sc_tmo;
-#else
-	struct timeout		 sc_tmo;
-#endif
-	struct in_addr		 sc_sender_ip;
-	u_int16_t		 sc_sender_port;
-	struct in_addr		 sc_receiver_ip;
-	u_int16_t		 sc_receiver_port;
-	struct mbuf		*sc_mbuf;	/* current cumulative mbuf */
-	SLIST_ENTRY(pflow_softc) sc_next;
-};
-
-extern struct pflow_softc	*pflowif;
-
-#endif /* _KERNEL */
-
-struct pflow_header {
-	u_int16_t	version;
-	u_int16_t	count;
-	u_int32_t	uptime_ms;
-	u_int32_t	time_sec;
-	u_int32_t	time_nanosec;
-	u_int32_t	flow_sequence;
-	u_int8_t	engine_type;
-	u_int8_t	engine_id;
-	u_int8_t	reserved1;
-	u_int8_t	reserved2;
-} __packed;
-
-#define	PFLOW_HDRLEN sizeof(struct pflow_header)
-
-struct pflowstats {
-	u_int64_t	pflow_flows;
-	u_int64_t	pflow_packets;
-	u_int64_t	pflow_onomem;
-	u_int64_t	pflow_oerrors;
-};
-
-/*
- * Configuration structure for SIOCSETPFLOW SIOCGETPFLOW
- */
-struct pflowreq {
-	struct in_addr		sender_ip;
-	struct in_addr		receiver_ip;
-	u_int16_t		receiver_port;
-	u_int16_t		addrmask;
-#define	PFLOW_MASK_SRCIP	0x01
-#define	PFLOW_MASK_DSTIP	0x02
-#define	PFLOW_MASK_DSTPRT	0x04
-};
-
-#ifdef _KERNEL
-int export_pflow(struct pf_state *);
-int pflow_sysctl(int *, u_int,  void *, size_t *, void *, size_t);
-#endif /* _KERNEL */
-
-#endif /* _NET_IF_PFLOW_H_ */
diff --git a/sys/contrib/pf/net/if_pfsync.c b/sys/contrib/pf/net/if_pfsync.c
deleted file mode 100644
index 7da6c2e9c2b8..000000000000
--- a/sys/contrib/pf/net/if_pfsync.c
+++ /dev/null
@@ -1,3474 +0,0 @@
-/*	$OpenBSD: if_pfsync.c,v 1.110 2009/02/24 05:39:19 dlg Exp $	*/
-
-/*
- * Copyright (c) 2002 Michael Shalayeff
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR OR HIS RELATIVES BE LIABLE FOR ANY DIRECT,
- * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
- * SERVICES; LOSS OF MIND, USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
- * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/*
- * Copyright (c) 2009 David Gwynne <dlg@openbsd.org>
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-/*
- * Revisions picked from OpenBSD after revision 1.110 import:
- * 1.118, 1.124, 1.148, 1.149, 1.151, 1.171 - fixes to bulk updates
- * 1.120, 1.175 - use monotonic time_uptime
- * 1.122 - reduce number of updates for non-TCP sessions
- * 1.128 - cleanups
- * 1.146 - bzero() mbuf before sparsely filling it with data
- * 1.170 - SIOCSIFMTU checks
- * 1.126, 1.142 - deferred packets processing
- * 1.173 - correct expire time processing
- */
-
-#ifdef __FreeBSD__
-#include "opt_inet.h"
-#include "opt_inet6.h"
-#include "opt_pf.h"
-
-#include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
-
-#define	NBPFILTER	1
-#endif /* __FreeBSD__ */
-
-#include <sys/param.h>
-#include <sys/kernel.h>
-#ifdef __FreeBSD__
-#include <sys/bus.h>
-#include <sys/interrupt.h>
-#include <sys/priv.h>
-#endif
-#include <sys/proc.h>
-#include <sys/systm.h>
-#include <sys/time.h>
-#include <sys/mbuf.h>
-#include <sys/socket.h>
-#ifdef __FreeBSD__
-#include <sys/endian.h>
-#include <sys/malloc.h>
-#include <sys/module.h>
-#include <sys/sockio.h>
-#include <sys/taskqueue.h>
-#include <sys/lock.h>
-#include <sys/mutex.h>
-#include <sys/protosw.h>
-#else
-#include <sys/ioctl.h>
-#include <sys/timeout.h>
-#endif
-#include <sys/sysctl.h>
-#ifndef __FreeBSD__
-#include <sys/pool.h>
-#endif
-
-#include <net/if.h>
-#ifdef __FreeBSD__
-#include <net/if_clone.h>
-#endif
-#include <net/if_types.h>
-#include <net/route.h>
-#include <net/bpf.h>
-#include <net/netisr.h>
-#ifdef __FreeBSD__
-#include <net/vnet.h>
-#endif
-
-#include <netinet/in.h>
-#include <netinet/if_ether.h>
-#include <netinet/tcp.h>
-#include <netinet/tcp_seq.h>
-
-#ifdef	INET
-#include <netinet/in_systm.h>
-#include <netinet/in_var.h>
-#include <netinet/ip.h>
-#include <netinet/ip_var.h>
-#endif
-
-#ifdef INET6
-#include <netinet6/nd6.h>
-#endif /* INET6 */
-
-#ifdef __FreeBSD__
-#include <netinet/ip_carp.h>
-#else
-#include "carp.h"
-#if NCARP > 0
-#include <netinet/ip_carp.h>
-#endif
-#endif
-
-#include <net/pfvar.h>
-#include <net/if_pfsync.h>
-
-#ifndef __FreeBSD__
-#include "bpfilter.h"
-#include "pfsync.h"
-#endif
-
-#define PFSYNC_MINPKT ( \
-	sizeof(struct ip) + \
-	sizeof(struct pfsync_header) + \
-	sizeof(struct pfsync_subheader) + \
-	sizeof(struct pfsync_eof))
-
-struct pfsync_pkt {
-	struct ip *ip;
-	struct in_addr src;
-	u_int8_t flags;
-};
-
-int	pfsync_input_hmac(struct mbuf *, int);
-
-int	pfsync_upd_tcp(struct pf_state *, struct pfsync_state_peer *,
-	    struct pfsync_state_peer *);
-
-int	pfsync_in_clr(struct pfsync_pkt *, struct mbuf *, int, int);
-int	pfsync_in_ins(struct pfsync_pkt *, struct mbuf *, int, int);
-int	pfsync_in_iack(struct pfsync_pkt *, struct mbuf *, int, int);
-int	pfsync_in_upd(struct pfsync_pkt *, struct mbuf *, int, int);
-int	pfsync_in_upd_c(struct pfsync_pkt *, struct mbuf *, int, int);
-int	pfsync_in_ureq(struct pfsync_pkt *, struct mbuf *, int, int);
-int	pfsync_in_del(struct pfsync_pkt *, struct mbuf *, int, int);
-int	pfsync_in_del_c(struct pfsync_pkt *, struct mbuf *, int, int);
-int	pfsync_in_bus(struct pfsync_pkt *, struct mbuf *, int, int);
-int	pfsync_in_tdb(struct pfsync_pkt *, struct mbuf *, int, int);
-int	pfsync_in_eof(struct pfsync_pkt *, struct mbuf *, int, int);
-
-int	pfsync_in_error(struct pfsync_pkt *, struct mbuf *, int, int);
-
-int	(*pfsync_acts[])(struct pfsync_pkt *, struct mbuf *, int, int) = {
-	pfsync_in_clr,			/* PFSYNC_ACT_CLR */
-	pfsync_in_ins,			/* PFSYNC_ACT_INS */
-	pfsync_in_iack,			/* PFSYNC_ACT_INS_ACK */
-	pfsync_in_upd,			/* PFSYNC_ACT_UPD */
-	pfsync_in_upd_c,		/* PFSYNC_ACT_UPD_C */
-	pfsync_in_ureq,			/* PFSYNC_ACT_UPD_REQ */
-	pfsync_in_del,			/* PFSYNC_ACT_DEL */
-	pfsync_in_del_c,		/* PFSYNC_ACT_DEL_C */
-	pfsync_in_error,		/* PFSYNC_ACT_INS_F */
-	pfsync_in_error,		/* PFSYNC_ACT_DEL_F */
-	pfsync_in_bus,			/* PFSYNC_ACT_BUS */
-	pfsync_in_tdb,			/* PFSYNC_ACT_TDB */
-	pfsync_in_eof			/* PFSYNC_ACT_EOF */
-};
-
-struct pfsync_q {
-	int		(*write)(struct pf_state *, struct mbuf *, int);
-	size_t		len;
-	u_int8_t	action;
-};
-
-/* we have one of these for every PFSYNC_S_ */
-int	pfsync_out_state(struct pf_state *, struct mbuf *, int);
-int	pfsync_out_iack(struct pf_state *, struct mbuf *, int);
-int	pfsync_out_upd_c(struct pf_state *, struct mbuf *, int);
-int	pfsync_out_del(struct pf_state *, struct mbuf *, int);
-
-struct pfsync_q pfsync_qs[] = {
-	{ pfsync_out_state, sizeof(struct pfsync_state),   PFSYNC_ACT_INS },
-	{ pfsync_out_iack,  sizeof(struct pfsync_ins_ack), PFSYNC_ACT_INS_ACK },
-	{ pfsync_out_state, sizeof(struct pfsync_state),   PFSYNC_ACT_UPD },
-	{ pfsync_out_upd_c, sizeof(struct pfsync_upd_c),   PFSYNC_ACT_UPD_C },
-	{ pfsync_out_del,   sizeof(struct pfsync_del_c),   PFSYNC_ACT_DEL_C }
-};
-
-void	pfsync_q_ins(struct pf_state *, int);
-void	pfsync_q_del(struct pf_state *);
-
-struct pfsync_upd_req_item {
-	TAILQ_ENTRY(pfsync_upd_req_item)	ur_entry;
-	struct pfsync_upd_req			ur_msg;
-};
-TAILQ_HEAD(pfsync_upd_reqs, pfsync_upd_req_item);
-
-struct pfsync_deferral {
-	TAILQ_ENTRY(pfsync_deferral)		 pd_entry;
-	struct pf_state				*pd_st;
-	struct mbuf				*pd_m;
-#ifdef __FreeBSD__
-	struct callout				 pd_tmo;
-#else
-	struct timeout				 pd_tmo;
-#endif
-};
-TAILQ_HEAD(pfsync_deferrals, pfsync_deferral);
-
-#define PFSYNC_PLSIZE	MAX(sizeof(struct pfsync_upd_req_item), \
-			    sizeof(struct pfsync_deferral))
-
-#ifdef notyet
-int	pfsync_out_tdb(struct tdb *, struct mbuf *, int);
-#endif
-
-struct pfsync_softc {
-#ifdef __FreeBSD__
-	struct ifnet		*sc_ifp;
-#else
-	struct ifnet		 sc_if;
-#endif
-	struct ifnet		*sc_sync_if;
-
-#ifdef __FreeBSD__
-	uma_zone_t		 sc_pool;
-#else
-	struct pool		 sc_pool;
-#endif
-
-	struct ip_moptions	 sc_imo;
-
-	struct in_addr		 sc_sync_peer;
-	u_int8_t		 sc_maxupdates;
-#ifdef __FreeBSD__
-	int			 pfsync_sync_ok;
-#endif
-
-	struct ip		 sc_template;
-
-	struct pf_state_queue	 sc_qs[PFSYNC_S_COUNT];
-	size_t			 sc_len;
-
-	struct pfsync_upd_reqs	 sc_upd_req_list;
-
-	int			 sc_defer;
-	struct pfsync_deferrals	 sc_deferrals;
-	u_int			 sc_deferred;
-
-	void			*sc_plus;
-	size_t			 sc_pluslen;
-
-	u_int32_t		 sc_ureq_sent;
-	int			 sc_bulk_tries;
-#ifdef __FreeBSD__
-	struct callout		 sc_bulkfail_tmo;
-#else
-	struct timeout		 sc_bulkfail_tmo;
-#endif
-
-	u_int32_t		 sc_ureq_received;
-	struct pf_state		*sc_bulk_next;
-	struct pf_state		*sc_bulk_last;
-#ifdef __FreeBSD__
-	struct callout		 sc_bulk_tmo;
-#else
-	struct timeout		 sc_bulk_tmo;
-#endif
-
-	TAILQ_HEAD(, tdb)	 sc_tdb_q;
-
-#ifdef __FreeBSD__
-	struct callout		 sc_tmo;
-#else
-	struct timeout		 sc_tmo;
-#endif
-};
-
-#ifdef __FreeBSD__
-static MALLOC_DEFINE(M_PFSYNC, "pfsync", "pfsync data");
-static VNET_DEFINE(struct pfsync_softc	*, pfsyncif) = NULL;
-#define	V_pfsyncif		VNET(pfsyncif)
-static VNET_DEFINE(void *, pfsync_swi_cookie) = NULL;
-#define	V_pfsync_swi_cookie	VNET(pfsync_swi_cookie)
-static VNET_DEFINE(struct pfsyncstats, pfsyncstats);
-#define	V_pfsyncstats		VNET(pfsyncstats)
-static VNET_DEFINE(int, pfsync_carp_adj) = CARP_MAXSKEW;
-#define	V_pfsync_carp_adj	VNET(pfsync_carp_adj)
-
-static void	pfsyncintr(void *);
-static int	pfsync_multicast_setup(struct pfsync_softc *);
-static void	pfsync_multicast_cleanup(struct pfsync_softc *);
-static int	pfsync_init(void);
-static void	pfsync_uninit(void);
-static void	pfsync_sendout1(int);
-
-#define	schednetisr(NETISR_PFSYNC)	swi_sched(V_pfsync_swi_cookie, 0)
-
-SYSCTL_NODE(_net, OID_AUTO, pfsync, CTLFLAG_RW, 0, "PFSYNC");
-SYSCTL_VNET_STRUCT(_net_pfsync, OID_AUTO, stats, CTLFLAG_RW,
-    &VNET_NAME(pfsyncstats), pfsyncstats,
-    "PFSYNC statistics (struct pfsyncstats, net/if_pfsync.h)");
-SYSCTL_INT(_net_pfsync, OID_AUTO, carp_demotion_factor, CTLFLAG_RW,
-    &VNET_NAME(pfsync_carp_adj), 0, "pfsync's CARP demotion factor adjustment");
-#else
-struct pfsync_softc	*pfsyncif = NULL;
-struct pfsyncstats	 pfsyncstats;
-#define	V_pfsyncstats	 pfsyncstats
-#endif
-
-void	pfsyncattach(int);
-#ifdef __FreeBSD__
-int	pfsync_clone_create(struct if_clone *, int, caddr_t);
-void	pfsync_clone_destroy(struct ifnet *);
-#else
-int	pfsync_clone_create(struct if_clone *, int);
-int	pfsync_clone_destroy(struct ifnet *);
-#endif
-int	pfsync_alloc_scrub_memory(struct pfsync_state_peer *,
-	    struct pf_state_peer *);
-void	pfsync_update_net_tdb(struct pfsync_tdb *);
-int	pfsyncoutput(struct ifnet *, struct mbuf *, struct sockaddr *,
-#ifdef __FreeBSD__
-	    struct route *);
-#else
-	    struct rtentry *);
-#endif
-int	pfsyncioctl(struct ifnet *, u_long, caddr_t);
-void	pfsyncstart(struct ifnet *);
-
-struct mbuf *pfsync_if_dequeue(struct ifnet *);
-
-void	pfsync_deferred(struct pf_state *, int);
-void	pfsync_undefer(struct pfsync_deferral *, int);
-void	pfsync_defer_tmo(void *);
-
-void	pfsync_request_update(u_int32_t, u_int64_t);
-void	pfsync_update_state_req(struct pf_state *);
-
-void	pfsync_drop(struct pfsync_softc *);
-void	pfsync_sendout(void);
-void	pfsync_send_plus(void *, size_t);
-void	pfsync_timeout(void *);
-void	pfsync_tdb_timeout(void *);
-
-void	pfsync_bulk_start(void);
-void	pfsync_bulk_status(u_int8_t);
-void	pfsync_bulk_update(void *);
-void	pfsync_bulk_fail(void *);
-
-#ifdef __FreeBSD__
-/* XXX: ugly */
-#define	betoh64		(unsigned long long)be64toh
-#define	timeout_del	callout_stop
-#endif
-
-#define PFSYNC_MAX_BULKTRIES	12
-#ifndef __FreeBSD__
-int	pfsync_sync_ok;
-#endif
-
-#ifdef __FreeBSD__
-VNET_DEFINE(struct ifc_simple_data, pfsync_cloner_data);
-VNET_DEFINE(struct if_clone, pfsync_cloner);
-#define	V_pfsync_cloner_data	VNET(pfsync_cloner_data)
-#define	V_pfsync_cloner		VNET(pfsync_cloner)
-IFC_SIMPLE_DECLARE(pfsync, 1);
-#else
-struct if_clone	pfsync_cloner =
-    IF_CLONE_INITIALIZER("pfsync", pfsync_clone_create, pfsync_clone_destroy);
-#endif
-
-void
-pfsyncattach(int npfsync)
-{
-	if_clone_attach(&pfsync_cloner);
-}
-int
-#ifdef __FreeBSD__
-pfsync_clone_create(struct if_clone *ifc, int unit, caddr_t param)
-#else
-pfsync_clone_create(struct if_clone *ifc, int unit)
-#endif
-{
-	struct pfsync_softc *sc;
-	struct ifnet *ifp;
-	int q;
-
-	if (unit != 0)
-		return (EINVAL);
-
-#ifdef __FreeBSD__
-	sc = malloc(sizeof(struct pfsync_softc), M_PFSYNC, M_WAITOK | M_ZERO);
-	sc->pfsync_sync_ok = 1;
-#else
-	pfsync_sync_ok = 1;
-	sc = malloc(sizeof(*pfsyncif), M_DEVBUF, M_NOWAIT | M_ZERO);
-#endif
-
-	for (q = 0; q < PFSYNC_S_COUNT; q++)
-		TAILQ_INIT(&sc->sc_qs[q]);
-
-#ifdef __FreeBSD__
-	sc->sc_pool = uma_zcreate("pfsync", PFSYNC_PLSIZE, NULL, NULL, NULL,
-	    NULL, UMA_ALIGN_PTR, 0);
-#else
-	pool_init(&sc->sc_pool, PFSYNC_PLSIZE, 0, 0, 0, "pfsync", NULL);
-#endif
-	TAILQ_INIT(&sc->sc_upd_req_list);
-	TAILQ_INIT(&sc->sc_deferrals);
-	sc->sc_deferred = 0;
-
-	TAILQ_INIT(&sc->sc_tdb_q);
-
-	sc->sc_len = PFSYNC_MINPKT;
-	sc->sc_maxupdates = 128;
-
-#ifndef __FreeBSD__
-	sc->sc_imo.imo_membership = (struct in_multi **)malloc(
-	    (sizeof(struct in_multi *) * IP_MIN_MEMBERSHIPS), M_IPMOPTS,
-	    M_WAITOK | M_ZERO);
-	sc->sc_imo.imo_max_memberships = IP_MIN_MEMBERSHIPS;
-#endif
-
-#ifdef __FreeBSD__
-	ifp = sc->sc_ifp = if_alloc(IFT_PFSYNC);
-	if (ifp == NULL) {
-		uma_zdestroy(sc->sc_pool);
-		free(sc, M_PFSYNC);
-		return (ENOSPC);
-	}
-	if_initname(ifp, ifc->ifc_name, unit);
-#else
-	ifp = &sc->sc_if;
-	snprintf(ifp->if_xname, sizeof ifp->if_xname, "pfsync%d", unit);
-#endif
-	ifp->if_softc = sc;
-	ifp->if_ioctl = pfsyncioctl;
-	ifp->if_output = pfsyncoutput;
-	ifp->if_start = pfsyncstart;
-	ifp->if_type = IFT_PFSYNC;
-	ifp->if_snd.ifq_maxlen = ifqmaxlen;
-	ifp->if_hdrlen = sizeof(struct pfsync_header);
-	ifp->if_mtu = ETHERMTU;
-#ifdef __FreeBSD__
-	callout_init(&sc->sc_tmo, CALLOUT_MPSAFE);
-	callout_init_mtx(&sc->sc_bulk_tmo, &pf_task_mtx, 0);
-	callout_init(&sc->sc_bulkfail_tmo, CALLOUT_MPSAFE);
-#else
-	timeout_set(&sc->sc_tmo, pfsync_timeout, sc);
-	timeout_set(&sc->sc_bulk_tmo, pfsync_bulk_update, sc);
-	timeout_set(&sc->sc_bulkfail_tmo, pfsync_bulk_fail, sc);
-#endif
-
-	if_attach(ifp);
-#ifndef __FreeBSD__
-	if_alloc_sadl(ifp);
-
-#if NCARP > 0
-	if_addgroup(ifp, "carp");
-#endif
-#endif
-
-#if NBPFILTER > 0
-#ifdef __FreeBSD__
-	bpfattach(ifp, DLT_PFSYNC, PFSYNC_HDRLEN);
-#else
-	bpfattach(&sc->sc_if.if_bpf, ifp, DLT_PFSYNC, PFSYNC_HDRLEN);
-#endif
-#endif
-
-#ifdef __FreeBSD__
-	V_pfsyncif = sc;
-#else
-	pfsyncif = sc;
-#endif
-
-	return (0);
-}
-
-#ifdef __FreeBSD__
-void
-#else
-int
-#endif
-pfsync_clone_destroy(struct ifnet *ifp)
-{
-	struct pfsync_softc *sc = ifp->if_softc;
-
-#ifdef __FreeBSD__
-	PF_LOCK();
-#endif
-	timeout_del(&sc->sc_bulkfail_tmo);
-	timeout_del(&sc->sc_bulk_tmo);
-	timeout_del(&sc->sc_tmo);
-#ifdef __FreeBSD__
-	PF_UNLOCK();
-	if (!sc->pfsync_sync_ok && carp_demote_adj_p)
-		(*carp_demote_adj_p)(-V_pfsync_carp_adj, "pfsync destroy");
-#else
-#if NCARP > 0
-	if (!pfsync_sync_ok)
-		carp_group_demote_adj(&sc->sc_if, -1);
-#endif
-#endif
-#if NBPFILTER > 0
-	bpfdetach(ifp);
-#endif
-	if_detach(ifp);
-
-	pfsync_drop(sc);
-
-	while (sc->sc_deferred > 0)
-		pfsync_undefer(TAILQ_FIRST(&sc->sc_deferrals), 0);
-
-#ifdef __FreeBSD__
-	UMA_DESTROY(sc->sc_pool);
-#else
-	pool_destroy(&sc->sc_pool);
-#endif
-#ifdef __FreeBSD__
-	if_free(ifp);
-	if (sc->sc_imo.imo_membership)
-		pfsync_multicast_cleanup(sc);
-	free(sc, M_PFSYNC);
-#else
-	free(sc->sc_imo.imo_membership, M_IPMOPTS);
-	free(sc, M_DEVBUF);
-#endif
-
-#ifdef __FreeBSD__
-	V_pfsyncif = NULL;
-#else
-	pfsyncif = NULL;
-#endif
-
-#ifndef __FreeBSD__
-	return (0);
-#endif
-}
-
-struct mbuf *
-pfsync_if_dequeue(struct ifnet *ifp)
-{
-	struct mbuf *m;
-#ifndef __FreeBSD__
-	int s;
-#endif
-
-#ifdef __FreeBSD__
-	IF_LOCK(&ifp->if_snd);
-	_IF_DROP(&ifp->if_snd);
-	_IF_DEQUEUE(&ifp->if_snd, m);
-	IF_UNLOCK(&ifp->if_snd);
-#else
-	s = splnet();
-	IF_DEQUEUE(&ifp->if_snd, m);
-	splx(s);
-#endif
-
-	return (m);
-}
-
-/*
- * Start output on the pfsync interface.
- */
-void
-pfsyncstart(struct ifnet *ifp)
-{
-	struct mbuf *m;
-
-	while ((m = pfsync_if_dequeue(ifp)) != NULL) {
-#ifndef __FreeBSD__
-		IF_DROP(&ifp->if_snd);
-#endif
-		m_freem(m);
-	}
-}
-
-int
-pfsync_alloc_scrub_memory(struct pfsync_state_peer *s,
-    struct pf_state_peer *d)
-{
-	if (s->scrub.scrub_flag && d->scrub == NULL) {
-#ifdef __FreeBSD__
-		d->scrub = pool_get(&V_pf_state_scrub_pl, PR_NOWAIT | PR_ZERO);
-#else
-		d->scrub = pool_get(&pf_state_scrub_pl, PR_NOWAIT | PR_ZERO);
-#endif
-		if (d->scrub == NULL)
-			return (ENOMEM);
-	}
-
-	return (0);
-}
-
-#ifndef __FreeBSD__
-void
-pfsync_state_export(struct pfsync_state *sp, struct pf_state *st)
-{
-	bzero(sp, sizeof(struct pfsync_state));
-
-	/* copy from state key */
-	sp->key[PF_SK_WIRE].addr[0] = st->key[PF_SK_WIRE]->addr[0];
-	sp->key[PF_SK_WIRE].addr[1] = st->key[PF_SK_WIRE]->addr[1];
-	sp->key[PF_SK_WIRE].port[0] = st->key[PF_SK_WIRE]->port[0];
-	sp->key[PF_SK_WIRE].port[1] = st->key[PF_SK_WIRE]->port[1];
-	sp->key[PF_SK_STACK].addr[0] = st->key[PF_SK_STACK]->addr[0];
-	sp->key[PF_SK_STACK].addr[1] = st->key[PF_SK_STACK]->addr[1];
-	sp->key[PF_SK_STACK].port[0] = st->key[PF_SK_STACK]->port[0];
-	sp->key[PF_SK_STACK].port[1] = st->key[PF_SK_STACK]->port[1];
-	sp->proto = st->key[PF_SK_WIRE]->proto;
-	sp->af = st->key[PF_SK_WIRE]->af;
-
-	/* copy from state */
-	strlcpy(sp->ifname, st->kif->pfik_name, sizeof(sp->ifname));
-	bcopy(&st->rt_addr, &sp->rt_addr, sizeof(sp->rt_addr));
-	sp->creation = htonl(time_uptime - st->creation);
-	sp->expire = pf_state_expires(st);
-	if (sp->expire <= time_second)
-		sp->expire = htonl(0);
-	else
-		sp->expire = htonl(sp->expire - time_second);
-
-	sp->direction = st->direction;
-	sp->log = st->log;
-	sp->timeout = st->timeout;
-	sp->state_flags = st->state_flags;
-	if (st->src_node)
-		sp->sync_flags |= PFSYNC_FLAG_SRCNODE;
-	if (st->nat_src_node)
-		sp->sync_flags |= PFSYNC_FLAG_NATSRCNODE;
-
-	bcopy(&st->id, &sp->id, sizeof(sp->id));
-	sp->creatorid = st->creatorid;
-	pf_state_peer_hton(&st->src, &sp->src);
-	pf_state_peer_hton(&st->dst, &sp->dst);
-
-	if (st->rule.ptr == NULL)
-		sp->rule = htonl(-1);
-	else
-		sp->rule = htonl(st->rule.ptr->nr);
-	if (st->anchor.ptr == NULL)
-		sp->anchor = htonl(-1);
-	else
-		sp->anchor = htonl(st->anchor.ptr->nr);
-	if (st->nat_rule.ptr == NULL)
-		sp->nat_rule = htonl(-1);
-	else
-		sp->nat_rule = htonl(st->nat_rule.ptr->nr);
-
-	pf_state_counter_hton(st->packets[0], sp->packets[0]);
-	pf_state_counter_hton(st->packets[1], sp->packets[1]);
-	pf_state_counter_hton(st->bytes[0], sp->bytes[0]);
-	pf_state_counter_hton(st->bytes[1], sp->bytes[1]);
-
-}
-#endif
-
-int
-pfsync_state_import(struct pfsync_state *sp, u_int8_t flags)
-{
-	struct pf_state	*st = NULL;
-	struct pf_state_key *skw = NULL, *sks = NULL;
-	struct pf_rule *r = NULL;
-	struct pfi_kif	*kif;
-	int pool_flags;
-	int error;
-
-#ifdef __FreeBSD__
-	PF_LOCK_ASSERT();
-
-	if (sp->creatorid == 0 && V_pf_status.debug >= PF_DEBUG_MISC) {
-#else
-	if (sp->creatorid == 0 && pf_status.debug >= PF_DEBUG_MISC) {
-#endif
-		printf("pfsync_state_import: invalid creator id:"
-		    " %08x\n", ntohl(sp->creatorid));
-		return (EINVAL);
-	}
-
-	if ((kif = pfi_kif_get(sp->ifname)) == NULL) {
-#ifdef __FreeBSD__
-		if (V_pf_status.debug >= PF_DEBUG_MISC)
-#else
-		if (pf_status.debug >= PF_DEBUG_MISC)
-#endif
-			printf("pfsync_state_import: "
-			    "unknown interface: %s\n", sp->ifname);
-		if (flags & PFSYNC_SI_IOCTL)
-			return (EINVAL);
-		return (0);	/* skip this state */
-	}
-
-	/*
-	 * If the ruleset checksums match or the state is coming from the ioctl,
-	 * it's safe to associate the state with the rule of that number.
-	 */
-	if (sp->rule != htonl(-1) && sp->anchor == htonl(-1) &&
-	    (flags & (PFSYNC_SI_IOCTL | PFSYNC_SI_CKSUM)) && ntohl(sp->rule) <
-	    pf_main_ruleset.rules[PF_RULESET_FILTER].active.rcount)
-		r = pf_main_ruleset.rules[
-		    PF_RULESET_FILTER].active.ptr_array[ntohl(sp->rule)];
-	else
-#ifdef __FreeBSD__
-		r = &V_pf_default_rule;
-#else
-		r = &pf_default_rule;
-#endif
-
-	if ((r->max_states && r->states_cur >= r->max_states))
-		goto cleanup;
-
-#ifdef __FreeBSD__
-	if (flags & PFSYNC_SI_IOCTL)
-		pool_flags = PR_WAITOK | PR_ZERO;
-	else
-		pool_flags = PR_NOWAIT | PR_ZERO;
-
-	if ((st = pool_get(&V_pf_state_pl, pool_flags)) == NULL)
-		goto cleanup;
-#else
-	if (flags & PFSYNC_SI_IOCTL)
-		pool_flags = PR_WAITOK | PR_LIMITFAIL | PR_ZERO;
-	else
-		pool_flags = PR_LIMITFAIL | PR_ZERO;
-
-	if ((st = pool_get(&pf_state_pl, pool_flags)) == NULL)
-		goto cleanup;
-#endif
-
-	if ((skw = pf_alloc_state_key(pool_flags)) == NULL)
-		goto cleanup;
-
-	if (PF_ANEQ(&sp->key[PF_SK_WIRE].addr[0],
-	    &sp->key[PF_SK_STACK].addr[0], sp->af) ||
-	    PF_ANEQ(&sp->key[PF_SK_WIRE].addr[1],
-	    &sp->key[PF_SK_STACK].addr[1], sp->af) ||
-	    sp->key[PF_SK_WIRE].port[0] != sp->key[PF_SK_STACK].port[0] ||
-	    sp->key[PF_SK_WIRE].port[1] != sp->key[PF_SK_STACK].port[1]) {
-		if ((sks = pf_alloc_state_key(pool_flags)) == NULL)
-			goto cleanup;
-	} else
-		sks = skw;
-
-	/* allocate memory for scrub info */
-	if (pfsync_alloc_scrub_memory(&sp->src, &st->src) ||
-	    pfsync_alloc_scrub_memory(&sp->dst, &st->dst))
-		goto cleanup;
-
-	/* copy to state key(s) */
-	skw->addr[0] = sp->key[PF_SK_WIRE].addr[0];
-	skw->addr[1] = sp->key[PF_SK_WIRE].addr[1];
-	skw->port[0] = sp->key[PF_SK_WIRE].port[0];
-	skw->port[1] = sp->key[PF_SK_WIRE].port[1];
-	skw->proto = sp->proto;
-	skw->af = sp->af;
-	if (sks != skw) {
-		sks->addr[0] = sp->key[PF_SK_STACK].addr[0];
-		sks->addr[1] = sp->key[PF_SK_STACK].addr[1];
-		sks->port[0] = sp->key[PF_SK_STACK].port[0];
-		sks->port[1] = sp->key[PF_SK_STACK].port[1];
-		sks->proto = sp->proto;
-		sks->af = sp->af;
-	}
-
-	/* copy to state */
-	bcopy(&sp->rt_addr, &st->rt_addr, sizeof(st->rt_addr));
-	st->creation = time_uptime - ntohl(sp->creation);
-	st->expire = time_second;
-	if (sp->expire) {
-		uint32_t timeout;
-
-		timeout = r->timeout[sp->timeout];
-		if (!timeout)
-#ifdef __FreeBSD__
-			timeout = V_pf_default_rule.timeout[sp->timeout];
-#else
-			timeout = pf_default_rule.timeout[sp->timeout];
-#endif
-
-		/* sp->expire may have been adaptively scaled by export. */
-		st->expire -= timeout - ntohl(sp->expire);
-	}
-
-	st->direction = sp->direction;
-	st->log = sp->log;
-	st->timeout = sp->timeout;
-	st->state_flags = sp->state_flags;
-
-	bcopy(sp->id, &st->id, sizeof(st->id));
-	st->creatorid = sp->creatorid;
-	pf_state_peer_ntoh(&sp->src, &st->src);
-	pf_state_peer_ntoh(&sp->dst, &st->dst);
-
-	st->rule.ptr = r;
-	st->nat_rule.ptr = NULL;
-	st->anchor.ptr = NULL;
-	st->rt_kif = NULL;
-
-	st->pfsync_time = time_uptime;
-	st->sync_state = PFSYNC_S_NONE;
-
-	/* XXX when we have nat_rule/anchors, use STATE_INC_COUNTERS */
-	r->states_cur++;
-	r->states_tot++;
-
-	if (!ISSET(flags, PFSYNC_SI_IOCTL))
-		SET(st->state_flags, PFSTATE_NOSYNC);
-
-	if ((error = pf_state_insert(kif, skw, sks, st)) != 0) {
-		/* XXX when we have nat_rule/anchors, use STATE_DEC_COUNTERS */
-		r->states_cur--;
-		goto cleanup_state;
-	}
-
-	if (!ISSET(flags, PFSYNC_SI_IOCTL)) {
-		CLR(st->state_flags, PFSTATE_NOSYNC);
-		if (ISSET(st->state_flags, PFSTATE_ACK)) {
-			pfsync_q_ins(st, PFSYNC_S_IACK);
-			schednetisr(NETISR_PFSYNC);
-		}
-	}
-	CLR(st->state_flags, PFSTATE_ACK);
-
-	return (0);
-
-cleanup:
-	error = ENOMEM;
-	if (skw == sks)
-		sks = NULL;
-#ifdef __FreeBSD__
-	if (skw != NULL)
-		pool_put(&V_pf_state_key_pl, skw);
-	if (sks != NULL)
-		pool_put(&V_pf_state_key_pl, sks);
-#else
-	if (skw != NULL)
-		pool_put(&pf_state_key_pl, skw);
-	if (sks != NULL)
-		pool_put(&pf_state_key_pl, sks);
-#endif
-
-cleanup_state:	/* pf_state_insert frees the state keys */
-	if (st) {
-#ifdef __FreeBSD__
-		if (st->dst.scrub)
-			pool_put(&V_pf_state_scrub_pl, st->dst.scrub);
-		if (st->src.scrub)
-			pool_put(&V_pf_state_scrub_pl, st->src.scrub);
-		pool_put(&V_pf_state_pl, st);
-#else
-		if (st->dst.scrub)
-			pool_put(&pf_state_scrub_pl, st->dst.scrub);
-		if (st->src.scrub)
-			pool_put(&pf_state_scrub_pl, st->src.scrub);
-		pool_put(&pf_state_pl, st);
-#endif
-	}
-	return (error);
-}
-
-void
-#ifdef __FreeBSD__
-pfsync_input(struct mbuf *m, __unused int off)
-#else
-pfsync_input(struct mbuf *m, ...)
-#endif
-{
-#ifdef __FreeBSD__
-	struct pfsync_softc *sc = V_pfsyncif;
-#else
-	struct pfsync_softc *sc = pfsyncif;
-#endif
-	struct pfsync_pkt pkt;
-	struct ip *ip = mtod(m, struct ip *);
-	struct pfsync_header *ph;
-	struct pfsync_subheader subh;
-
-	int offset;
-	int rv;
-
-	V_pfsyncstats.pfsyncs_ipackets++;
-
-	/* verify that we have a sync interface configured */
-#ifdef __FreeBSD__
-	if (!sc || !sc->sc_sync_if || !V_pf_status.running)
-#else
-	if (!sc || !sc->sc_sync_if || !pf_status.running)
-#endif
-		goto done;
-
-	/* verify that the packet came in on the right interface */
-	if (sc->sc_sync_if != m->m_pkthdr.rcvif) {
-		V_pfsyncstats.pfsyncs_badif++;
-		goto done;
-	}
-
-#ifdef __FreeBSD__
-	sc->sc_ifp->if_ipackets++;
-	sc->sc_ifp->if_ibytes += m->m_pkthdr.len;
-#else
-	sc->sc_if.if_ipackets++;
-	sc->sc_if.if_ibytes += m->m_pkthdr.len;
-#endif
-	/* verify that the IP TTL is 255. */
-	if (ip->ip_ttl != PFSYNC_DFLTTL) {
-		V_pfsyncstats.pfsyncs_badttl++;
-		goto done;
-	}
-
-	offset = ip->ip_hl << 2;
-	if (m->m_pkthdr.len < offset + sizeof(*ph)) {
-		V_pfsyncstats.pfsyncs_hdrops++;
-		goto done;
-	}
-
-	if (offset + sizeof(*ph) > m->m_len) {
-		if (m_pullup(m, offset + sizeof(*ph)) == NULL) {
-			V_pfsyncstats.pfsyncs_hdrops++;
-			return;
-		}
-		ip = mtod(m, struct ip *);
-	}
-	ph = (struct pfsync_header *)((char *)ip + offset);
-
-	/* verify the version */
-	if (ph->version != PFSYNC_VERSION) {
-		V_pfsyncstats.pfsyncs_badver++;
-		goto done;
-	}
-
-#if 0
-	if (pfsync_input_hmac(m, offset) != 0) {
-		/* XXX stats */
-		goto done;
-	}
-#endif
-
-	/* Cheaper to grab this now than having to mess with mbufs later */
-	pkt.ip = ip;
-	pkt.src = ip->ip_src;
-	pkt.flags = 0;
-
-#ifdef __FreeBSD__
-	if (!bcmp(&ph->pfcksum, &V_pf_status.pf_chksum, PF_MD5_DIGEST_LENGTH))
-#else
-	if (!bcmp(&ph->pfcksum, &pf_status.pf_chksum, PF_MD5_DIGEST_LENGTH))
-#endif
-		pkt.flags |= PFSYNC_SI_CKSUM;
-
-	offset += sizeof(*ph);
-	for (;;) {
-		m_copydata(m, offset, sizeof(subh), (caddr_t)&subh);
-		offset += sizeof(subh);
-
-		if (subh.action >= PFSYNC_ACT_MAX) {
-			V_pfsyncstats.pfsyncs_badact++;
-			goto done;
-		}
-
-		rv = (*pfsync_acts[subh.action])(&pkt, m, offset,
-		    ntohs(subh.count));
-		if (rv == -1)
-			return;
-
-		offset += rv;
-	}
-
-done:
-	m_freem(m);
-}
-
-int
-pfsync_in_clr(struct pfsync_pkt *pkt, struct mbuf *m, int offset, int count)
-{
-	struct pfsync_clr *clr;
-	struct mbuf *mp;
-	int len = sizeof(*clr) * count;
-	int i, offp;
-
-	struct pf_state *st, *nexts;
-	struct pf_state_key *sk, *nextsk;
-	struct pf_state_item *si;
-	u_int32_t creatorid;
-	int s;
-
-	mp = m_pulldown(m, offset, len, &offp);
-	if (mp == NULL) {
-		V_pfsyncstats.pfsyncs_badlen++;
-		return (-1);
-	}
-	clr = (struct pfsync_clr *)(mp->m_data + offp);
-
-	s = splsoftnet();
-#ifdef __FreeBSD__
-	PF_LOCK();
-#endif
-	for (i = 0; i < count; i++) {
-		creatorid = clr[i].creatorid;
-
-		if (clr[i].ifname[0] == '\0') {
-#ifdef __FreeBSD__
-			for (st = RB_MIN(pf_state_tree_id, &V_tree_id);
-			    st; st = nexts) {
-				nexts = RB_NEXT(pf_state_tree_id, &V_tree_id, st);
-#else
-			for (st = RB_MIN(pf_state_tree_id, &tree_id);
-			    st; st = nexts) {
-				nexts = RB_NEXT(pf_state_tree_id, &tree_id, st);
-#endif
-				if (st->creatorid == creatorid) {
-					SET(st->state_flags, PFSTATE_NOSYNC);
-					pf_unlink_state(st);
-				}
-			}
-		} else {
-			if (pfi_kif_get(clr[i].ifname) == NULL)
-				continue;
-
-			/* XXX correct? */
-#ifdef __FreeBSD__
-			for (sk = RB_MIN(pf_state_tree, &V_pf_statetbl);
-#else
-			for (sk = RB_MIN(pf_state_tree, &pf_statetbl);
-#endif
-			    sk; sk = nextsk) {
-				nextsk = RB_NEXT(pf_state_tree,
-#ifdef __FreeBSD__
-				    &V_pf_statetbl, sk);
-#else
-				    &pf_statetbl, sk);
-#endif
-				TAILQ_FOREACH(si, &sk->states, entry) {
-					if (si->s->creatorid == creatorid) {
-						SET(si->s->state_flags,
-						    PFSTATE_NOSYNC);
-						pf_unlink_state(si->s);
-					}
-				}
-			}
-		}
-	}
-#ifdef __FreeBSD__
-	PF_UNLOCK();
-#endif
-	splx(s);
-
-	return (len);
-}
-
-int
-pfsync_in_ins(struct pfsync_pkt *pkt, struct mbuf *m, int offset, int count)
-{
-	struct mbuf *mp;
-	struct pfsync_state *sa, *sp;
-	int len = sizeof(*sp) * count;
-	int i, offp;
-
-	int s;
-
-	mp = m_pulldown(m, offset, len, &offp);
-	if (mp == NULL) {
-		V_pfsyncstats.pfsyncs_badlen++;
-		return (-1);
-	}
-	sa = (struct pfsync_state *)(mp->m_data + offp);
-
-	s = splsoftnet();
-#ifdef __FreeBSD__
-	PF_LOCK();
-#endif
-	for (i = 0; i < count; i++) {
-		sp = &sa[i];
-
-		/* check for invalid values */
-		if (sp->timeout >= PFTM_MAX ||
-		    sp->src.state > PF_TCPS_PROXY_DST ||
-		    sp->dst.state > PF_TCPS_PROXY_DST ||
-		    sp->direction > PF_OUT ||
-		    (sp->af != AF_INET && sp->af != AF_INET6)) {
-#ifdef __FreeBSD__
-			if (V_pf_status.debug >= PF_DEBUG_MISC) {
-#else
-			if (pf_status.debug >= PF_DEBUG_MISC) {
-#endif
-				printf("pfsync_input: PFSYNC5_ACT_INS: "
-				    "invalid value\n");
-			}
-			V_pfsyncstats.pfsyncs_badval++;
-			continue;
-		}
-
-		if (pfsync_state_import(sp, pkt->flags) == ENOMEM) {
-			/* drop out, but process the rest of the actions */
-			break;
-		}
-	}
-#ifdef __FreeBSD__
-	PF_UNLOCK();
-#endif
-	splx(s);
-
-	return (len);
-}
-
-int
-pfsync_in_iack(struct pfsync_pkt *pkt, struct mbuf *m, int offset, int count)
-{
-	struct pfsync_ins_ack *ia, *iaa;
-	struct pf_state_cmp id_key;
-	struct pf_state *st;
-
-	struct mbuf *mp;
-	int len = count * sizeof(*ia);
-	int offp, i;
-	int s;
-
-	mp = m_pulldown(m, offset, len, &offp);
-	if (mp == NULL) {
-		V_pfsyncstats.pfsyncs_badlen++;
-		return (-1);
-	}
-	iaa = (struct pfsync_ins_ack *)(mp->m_data + offp);
-
-	s = splsoftnet();
-#ifdef __FreeBSD__
-	PF_LOCK();
-#endif
-	for (i = 0; i < count; i++) {
-		ia = &iaa[i];
-
-		bcopy(&ia->id, &id_key.id, sizeof(id_key.id));
-		id_key.creatorid = ia->creatorid;
-
-		st = pf_find_state_byid(&id_key);
-		if (st == NULL)
-			continue;
-
-		if (ISSET(st->state_flags, PFSTATE_ACK))
-			pfsync_deferred(st, 0);
-	}
-#ifdef __FreeBSD__
-	PF_UNLOCK();
-#endif
-	splx(s);
-	/*
-	 * XXX this is not yet implemented, but we know the size of the
-	 * message so we can skip it.
-	 */
-
-	return (count * sizeof(struct pfsync_ins_ack));
-}
-
-int
-pfsync_upd_tcp(struct pf_state *st, struct pfsync_state_peer *src,
-    struct pfsync_state_peer *dst)
-{
-	int sfail = 0;
-
-	/*
-	 * The state should never go backwards except
-	 * for syn-proxy states.  Neither should the
-	 * sequence window slide backwards.
-	 */
-	if (st->src.state > src->state &&
-	    (st->src.state < PF_TCPS_PROXY_SRC ||
-	    src->state >= PF_TCPS_PROXY_SRC))
-		sfail = 1;
-	else if (SEQ_GT(st->src.seqlo, ntohl(src->seqlo)))
-		sfail = 3;
-	else if (st->dst.state > dst->state) {
-		/* There might still be useful
-		 * information about the src state here,
-		 * so import that part of the update,
-		 * then "fail" so we send the updated
-		 * state back to the peer who is missing
-		 * our what we know. */
-		pf_state_peer_ntoh(src, &st->src);
-		/* XXX do anything with timeouts? */
-		sfail = 7;
-	} else if (st->dst.state >= TCPS_SYN_SENT &&
-	    SEQ_GT(st->dst.seqlo, ntohl(dst->seqlo)))
-		sfail = 4;
-
-	return (sfail);
-}
-
-int
-pfsync_in_upd(struct pfsync_pkt *pkt, struct mbuf *m, int offset, int count)
-{
-	struct pfsync_state *sa, *sp;
-	struct pf_state_cmp id_key;
-	struct pf_state_key *sk;
-	struct pf_state *st;
-	int sfail;
-
-	struct mbuf *mp;
-	int len = count * sizeof(*sp);
-	int offp, i;
-	int s;
-
-	mp = m_pulldown(m, offset, len, &offp);
-	if (mp == NULL) {
-		V_pfsyncstats.pfsyncs_badlen++;
-		return (-1);
-	}
-	sa = (struct pfsync_state *)(mp->m_data + offp);
-
-	s = splsoftnet();
-#ifdef __FreeBSD__
-	PF_LOCK();
-#endif
-	for (i = 0; i < count; i++) {
-		sp = &sa[i];
-
-		/* check for invalid values */
-		if (sp->timeout >= PFTM_MAX ||
-		    sp->src.state > PF_TCPS_PROXY_DST ||
-		    sp->dst.state > PF_TCPS_PROXY_DST) {
-#ifdef __FreeBSD__
-			if (V_pf_status.debug >= PF_DEBUG_MISC) {
-#else
-			if (pf_status.debug >= PF_DEBUG_MISC) {
-#endif
-				printf("pfsync_input: PFSYNC_ACT_UPD: "
-				    "invalid value\n");
-			}
-			V_pfsyncstats.pfsyncs_badval++;
-			continue;
-		}
-
-		bcopy(sp->id, &id_key.id, sizeof(id_key.id));
-		id_key.creatorid = sp->creatorid;
-
-		st = pf_find_state_byid(&id_key);
-		if (st == NULL) {
-			/* insert the update */
-			if (pfsync_state_import(sp, 0))
-				V_pfsyncstats.pfsyncs_badstate++;
-			continue;
-		}
-
-		if (ISSET(st->state_flags, PFSTATE_ACK))
-			pfsync_deferred(st, 1);
-
-		sk = st->key[PF_SK_WIRE];	/* XXX right one? */
-		sfail = 0;
-		if (sk->proto == IPPROTO_TCP)
-			sfail = pfsync_upd_tcp(st, &sp->src, &sp->dst);
-		else {
-			/*
-			 * Non-TCP protocol state machine always go
-			 * forwards
-			 */
-			if (st->src.state > sp->src.state)
-				sfail = 5;
-			else if (st->dst.state > sp->dst.state)
-				sfail = 6;
-		}
-
-		if (sfail) {
-#ifdef __FreeBSD__
-			if (V_pf_status.debug >= PF_DEBUG_MISC) {
-#else
-			if (pf_status.debug >= PF_DEBUG_MISC) {
-#endif
-				printf("pfsync: %s stale update (%d)"
-				    " id: %016llx creatorid: %08x\n",
-				    (sfail < 7 ?  "ignoring" : "partial"),
-				    sfail, betoh64(st->id),
-				    ntohl(st->creatorid));
-			}
-			V_pfsyncstats.pfsyncs_stale++;
-
-			pfsync_update_state(st);
-			schednetisr(NETISR_PFSYNC);
-			continue;
-		}
-		pfsync_alloc_scrub_memory(&sp->dst, &st->dst);
-		pf_state_peer_ntoh(&sp->src, &st->src);
-		pf_state_peer_ntoh(&sp->dst, &st->dst);
-		st->expire = time_second;
-		st->timeout = sp->timeout;
-		st->pfsync_time = time_uptime;
-	}
-#ifdef __FreeBSD__
-	PF_UNLOCK();
-#endif
-	splx(s);
-
-	return (len);
-}
-
-int
-pfsync_in_upd_c(struct pfsync_pkt *pkt, struct mbuf *m, int offset, int count)
-{
-	struct pfsync_upd_c *ua, *up;
-	struct pf_state_key *sk;
-	struct pf_state_cmp id_key;
-	struct pf_state *st;
-
-	int len = count * sizeof(*up);
-	int sfail;
-
-	struct mbuf *mp;
-	int offp, i;
-	int s;
-
-	mp = m_pulldown(m, offset, len, &offp);
-	if (mp == NULL) {
-		V_pfsyncstats.pfsyncs_badlen++;
-		return (-1);
-	}
-	ua = (struct pfsync_upd_c *)(mp->m_data + offp);
-
-	s = splsoftnet();
-#ifdef __FreeBSD__
-	PF_LOCK();
-#endif
-	for (i = 0; i < count; i++) {
-		up = &ua[i];
-
-		/* check for invalid values */
-		if (up->timeout >= PFTM_MAX ||
-		    up->src.state > PF_TCPS_PROXY_DST ||
-		    up->dst.state > PF_TCPS_PROXY_DST) {
-#ifdef __FreeBSD__
-			if (V_pf_status.debug >= PF_DEBUG_MISC) {
-#else
-			if (pf_status.debug >= PF_DEBUG_MISC) {
-#endif
-				printf("pfsync_input: "
-				    "PFSYNC_ACT_UPD_C: "
-				    "invalid value\n");
-			}
-			V_pfsyncstats.pfsyncs_badval++;
-			continue;
-		}
-
-		bcopy(&up->id, &id_key.id, sizeof(id_key.id));
-		id_key.creatorid = up->creatorid;
-
-		st = pf_find_state_byid(&id_key);
-		if (st == NULL) {
-			/* We don't have this state. Ask for it. */
-			pfsync_request_update(id_key.creatorid, id_key.id);
-			continue;
-		}
-
-		if (ISSET(st->state_flags, PFSTATE_ACK))
-			pfsync_deferred(st, 1);
-
-		sk = st->key[PF_SK_WIRE]; /* XXX right one? */
-		sfail = 0;
-		if (sk->proto == IPPROTO_TCP)
-			sfail = pfsync_upd_tcp(st, &up->src, &up->dst);
-		else {
-			/*
-			 * Non-TCP protocol state machine always go forwards
-			 */
-			if (st->src.state > up->src.state)
-				sfail = 5;
-			else if (st->dst.state > up->dst.state)
-				sfail = 6;
-		}
-
-		if (sfail) {
-#ifdef __FreeBSD__
-			if (V_pf_status.debug >= PF_DEBUG_MISC) {
-#else
-			if (pf_status.debug >= PF_DEBUG_MISC) {
-#endif
-				printf("pfsync: ignoring stale update "
-				    "(%d) id: %016llx "
-				    "creatorid: %08x\n", sfail,
-				    betoh64(st->id),
-				    ntohl(st->creatorid));
-			}
-			V_pfsyncstats.pfsyncs_stale++;
-
-			pfsync_update_state(st);
-			schednetisr(NETISR_PFSYNC);
-			continue;
-		}
-		pfsync_alloc_scrub_memory(&up->dst, &st->dst);
-		pf_state_peer_ntoh(&up->src, &st->src);
-		pf_state_peer_ntoh(&up->dst, &st->dst);
-		st->expire = time_second;
-		st->timeout = up->timeout;
-		st->pfsync_time = time_uptime;
-	}
-#ifdef __FreeBSD__
-	PF_UNLOCK();
-#endif
-	splx(s);
-
-	return (len);
-}
-
-int
-pfsync_in_ureq(struct pfsync_pkt *pkt, struct mbuf *m, int offset, int count)
-{
-	struct pfsync_upd_req *ur, *ura;
-	struct mbuf *mp;
-	int len = count * sizeof(*ur);
-	int i, offp;
-
-	struct pf_state_cmp id_key;
-	struct pf_state *st;
-
-	mp = m_pulldown(m, offset, len, &offp);
-	if (mp == NULL) {
-		V_pfsyncstats.pfsyncs_badlen++;
-		return (-1);
-	}
-	ura = (struct pfsync_upd_req *)(mp->m_data + offp);
-
-#ifdef __FreeBSD__
-	PF_LOCK();
-#endif
-	for (i = 0; i < count; i++) {
-		ur = &ura[i];
-
-		bcopy(&ur->id, &id_key.id, sizeof(id_key.id));
-		id_key.creatorid = ur->creatorid;
-
-		if (id_key.id == 0 && id_key.creatorid == 0)
-			pfsync_bulk_start();
-		else {
-			st = pf_find_state_byid(&id_key);
-			if (st == NULL) {
-				V_pfsyncstats.pfsyncs_badstate++;
-				continue;
-			}
-			if (ISSET(st->state_flags, PFSTATE_NOSYNC))
-				continue;
-
-			pfsync_update_state_req(st);
-		}
-	}
-#ifdef __FreeBSD__
-	PF_UNLOCK();
-#endif
-
-	return (len);
-}
-
-int
-pfsync_in_del(struct pfsync_pkt *pkt, struct mbuf *m, int offset, int count)
-{
-	struct mbuf *mp;
-	struct pfsync_state *sa, *sp;
-	struct pf_state_cmp id_key;
-	struct pf_state *st;
-	int len = count * sizeof(*sp);
-	int offp, i;
-	int s;
-
-	mp = m_pulldown(m, offset, len, &offp);
-	if (mp == NULL) {
-		V_pfsyncstats.pfsyncs_badlen++;
-		return (-1);
-	}
-	sa = (struct pfsync_state *)(mp->m_data + offp);
-
-	s = splsoftnet();
-#ifdef __FreeBSD__
-	PF_LOCK();
-#endif
-	for (i = 0; i < count; i++) {
-		sp = &sa[i];
-
-		bcopy(sp->id, &id_key.id, sizeof(id_key.id));
-		id_key.creatorid = sp->creatorid;
-
-		st = pf_find_state_byid(&id_key);
-		if (st == NULL) {
-			V_pfsyncstats.pfsyncs_badstate++;
-			continue;
-		}
-		SET(st->state_flags, PFSTATE_NOSYNC);
-		pf_unlink_state(st);
-	}
-#ifdef __FreeBSD__
-	PF_UNLOCK();
-#endif
-	splx(s);
-
-	return (len);
-}
-
-int
-pfsync_in_del_c(struct pfsync_pkt *pkt, struct mbuf *m, int offset, int count)
-{
-	struct mbuf *mp;
-	struct pfsync_del_c *sa, *sp;
-	struct pf_state_cmp id_key;
-	struct pf_state *st;
-	int len = count * sizeof(*sp);
-	int offp, i;
-	int s;
-
-	mp = m_pulldown(m, offset, len, &offp);
-	if (mp == NULL) {
-		V_pfsyncstats.pfsyncs_badlen++;
-		return (-1);
-	}
-	sa = (struct pfsync_del_c *)(mp->m_data + offp);
-
-	s = splsoftnet();
-#ifdef __FreeBSD__
-	PF_LOCK();
-#endif
-	for (i = 0; i < count; i++) {
-		sp = &sa[i];
-
-		bcopy(&sp->id, &id_key.id, sizeof(id_key.id));
-		id_key.creatorid = sp->creatorid;
-
-		st = pf_find_state_byid(&id_key);
-		if (st == NULL) {
-			V_pfsyncstats.pfsyncs_badstate++;
-			continue;
-		}
-
-		SET(st->state_flags, PFSTATE_NOSYNC);
-		pf_unlink_state(st);
-	}
-#ifdef __FreeBSD__
-	PF_UNLOCK();
-#endif
-	splx(s);
-
-	return (len);
-}
-
-int
-pfsync_in_bus(struct pfsync_pkt *pkt, struct mbuf *m, int offset, int count)
-{
-#ifdef __FreeBSD__
-	struct pfsync_softc *sc = V_pfsyncif;
-#else
-	struct pfsync_softc *sc = pfsyncif;
-#endif
-	struct pfsync_bus *bus;
-	struct mbuf *mp;
-	int len = count * sizeof(*bus);
-	int offp;
-
-	/* If we're not waiting for a bulk update, who cares. */
-	if (sc->sc_ureq_sent == 0)
-		return (len);
-
-	mp = m_pulldown(m, offset, len, &offp);
-	if (mp == NULL) {
-		V_pfsyncstats.pfsyncs_badlen++;
-		return (-1);
-	}
-	bus = (struct pfsync_bus *)(mp->m_data + offp);
-
-	switch (bus->status) {
-	case PFSYNC_BUS_START:
-#ifdef __FreeBSD__
-		callout_reset(&sc->sc_bulkfail_tmo, 4 * hz +
-		    V_pf_pool_limits[PF_LIMIT_STATES].limit /
-		    ((sc->sc_ifp->if_mtu - PFSYNC_MINPKT) /
-		    sizeof(struct pfsync_state)),
-		    pfsync_bulk_fail, V_pfsyncif);
-#else
-		timeout_add(&sc->sc_bulkfail_tmo, 4 * hz +
-		    pf_pool_limits[PF_LIMIT_STATES].limit /
-		    ((sc->sc_if.if_mtu - PFSYNC_MINPKT) /
-		    sizeof(struct pfsync_state)));
-#endif
-#ifdef __FreeBSD__
-		if (V_pf_status.debug >= PF_DEBUG_MISC)
-#else
-		if (pf_status.debug >= PF_DEBUG_MISC)
-#endif
-			printf("pfsync: received bulk update start\n");
-		break;
-
-	case PFSYNC_BUS_END:
-		if (time_uptime - ntohl(bus->endtime) >=
-		    sc->sc_ureq_sent) {
-			/* that's it, we're happy */
-			sc->sc_ureq_sent = 0;
-			sc->sc_bulk_tries = 0;
-			timeout_del(&sc->sc_bulkfail_tmo);
-#ifdef __FreeBSD__
-			if (!sc->pfsync_sync_ok && carp_demote_adj_p)
-				(*carp_demote_adj_p)(-V_pfsync_carp_adj,
-				    "pfsync bulk done");
-			sc->pfsync_sync_ok = 1;
-#else
-#if NCARP > 0
-			if (!pfsync_sync_ok)
-				carp_group_demote_adj(&sc->sc_if, -1);
-#endif
-			pfsync_sync_ok = 1;
-#endif
-#ifdef __FreeBSD__
-			if (V_pf_status.debug >= PF_DEBUG_MISC)
-#else
-			if (pf_status.debug >= PF_DEBUG_MISC)
-#endif
-				printf("pfsync: received valid "
-				    "bulk update end\n");
-		} else {
-#ifdef __FreeBSD__
-			if (V_pf_status.debug >= PF_DEBUG_MISC)
-#else
-			if (pf_status.debug >= PF_DEBUG_MISC)
-#endif
-				printf("pfsync: received invalid "
-				    "bulk update end: bad timestamp\n");
-		}
-		break;
-	}
-
-	return (len);
-}
-
-int
-pfsync_in_tdb(struct pfsync_pkt *pkt, struct mbuf *m, int offset, int count)
-{
-	int len = count * sizeof(struct pfsync_tdb);
-
-#if defined(IPSEC)
-	struct pfsync_tdb *tp;
-	struct mbuf *mp;
-	int offp;
-	int i;
-	int s;
-
-	mp = m_pulldown(m, offset, len, &offp);
-	if (mp == NULL) {
-		V_pfsyncstats.pfsyncs_badlen++;
-		return (-1);
-	}
-	tp = (struct pfsync_tdb *)(mp->m_data + offp);
-
-	s = splsoftnet();
-#ifdef __FreeBSD__
-	PF_LOCK();
-#endif
-	for (i = 0; i < count; i++)
-		pfsync_update_net_tdb(&tp[i]);
-#ifdef __FreeBSD__
-	PF_UNLOCK();
-#endif
-	splx(s);
-#endif
-
-	return (len);
-}
-
-#if defined(IPSEC)
-/* Update an in-kernel tdb. Silently fail if no tdb is found. */
-void
-pfsync_update_net_tdb(struct pfsync_tdb *pt)
-{
-	struct tdb		*tdb;
-	int			 s;
-
-	/* check for invalid values */
-	if (ntohl(pt->spi) <= SPI_RESERVED_MAX ||
-	    (pt->dst.sa.sa_family != AF_INET &&
-	     pt->dst.sa.sa_family != AF_INET6))
-		goto bad;
-
-	s = spltdb();
-	tdb = gettdb(pt->spi, &pt->dst, pt->sproto);
-	if (tdb) {
-		pt->rpl = ntohl(pt->rpl);
-		pt->cur_bytes = betoh64(pt->cur_bytes);
-
-		/* Neither replay nor byte counter should ever decrease. */
-		if (pt->rpl < tdb->tdb_rpl ||
-		    pt->cur_bytes < tdb->tdb_cur_bytes) {
-			splx(s);
-			goto bad;
-		}
-
-		tdb->tdb_rpl = pt->rpl;
-		tdb->tdb_cur_bytes = pt->cur_bytes;
-	}
-	splx(s);
-	return;
-
-bad:
-#ifdef __FreeBSD__
-	if (V_pf_status.debug >= PF_DEBUG_MISC)
-#else
-	if (pf_status.debug >= PF_DEBUG_MISC)
-#endif
-		printf("pfsync_insert: PFSYNC_ACT_TDB_UPD: "
-		    "invalid value\n");
-	V_pfsyncstats.pfsyncs_badstate++;
-	return;
-}
-#endif
-
-
-int
-pfsync_in_eof(struct pfsync_pkt *pkt, struct mbuf *m, int offset, int count)
-{
-	/* check if we are at the right place in the packet */
-	if (offset != m->m_pkthdr.len - sizeof(struct pfsync_eof))
-		V_pfsyncstats.pfsyncs_badact++;
-
-	/* we're done. free and let the caller return */
-	m_freem(m);
-	return (-1);
-}
-
-int
-pfsync_in_error(struct pfsync_pkt *pkt, struct mbuf *m, int offset, int count)
-{
-	V_pfsyncstats.pfsyncs_badact++;
-
-	m_freem(m);
-	return (-1);
-}
-
-int
-pfsyncoutput(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
-#ifdef __FreeBSD__
-	struct route *rt)
-#else
-	struct rtentry *rt)
-#endif
-{
-	m_freem(m);
-	return (0);
-}
-
-/* ARGSUSED */
-int
-pfsyncioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
-{
-#ifndef __FreeBSD__
-	struct proc *p = curproc;
-#endif
-	struct pfsync_softc *sc = ifp->if_softc;
-	struct ifreq *ifr = (struct ifreq *)data;
-	struct ip_moptions *imo = &sc->sc_imo;
-	struct pfsyncreq pfsyncr;
-	struct ifnet    *sifp;
-	struct ip *ip;
-	int s, error;
-
-	switch (cmd) {
-#if 0
-	case SIOCSIFADDR:
-	case SIOCAIFADDR:
-	case SIOCSIFDSTADDR:
-#endif
-	case SIOCSIFFLAGS:
-#ifdef __FreeBSD__
-		if (ifp->if_flags & IFF_UP)
-			ifp->if_drv_flags |= IFF_DRV_RUNNING;
-		else
-			ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
-#else
-		if (ifp->if_flags & IFF_UP)
-			ifp->if_flags |= IFF_RUNNING;
-		else
-			ifp->if_flags &= ~IFF_RUNNING;
-#endif
-		break;
-	case SIOCSIFMTU:
-		if (!sc->sc_sync_if ||
-		    ifr->ifr_mtu <= PFSYNC_MINPKT ||
-		    ifr->ifr_mtu > sc->sc_sync_if->if_mtu)
-			return (EINVAL);
-		if (ifr->ifr_mtu < ifp->if_mtu) {
-			s = splnet();
-#ifdef __FreeBSD__
-			PF_LOCK();
-#endif
-			pfsync_sendout();
-#ifdef __FreeBSD__
-			PF_UNLOCK();
-#endif
-			splx(s);
-		}
-		ifp->if_mtu = ifr->ifr_mtu;
-		break;
-	case SIOCGETPFSYNC:
-		bzero(&pfsyncr, sizeof(pfsyncr));
-		if (sc->sc_sync_if) {
-			strlcpy(pfsyncr.pfsyncr_syncdev,
-			    sc->sc_sync_if->if_xname, IFNAMSIZ);
-		}
-		pfsyncr.pfsyncr_syncpeer = sc->sc_sync_peer;
-		pfsyncr.pfsyncr_maxupdates = sc->sc_maxupdates;
-		pfsyncr.pfsyncr_defer = sc->sc_defer;
-		return (copyout(&pfsyncr, ifr->ifr_data, sizeof(pfsyncr)));
-
-	case SIOCSETPFSYNC:
-#ifdef __FreeBSD__
-		if ((error = priv_check(curthread, PRIV_NETINET_PF)) != 0)
-#else
-		if ((error = suser(p, p->p_acflag)) != 0)
-#endif
-			return (error);
-		if ((error = copyin(ifr->ifr_data, &pfsyncr, sizeof(pfsyncr))))
-			return (error);
-
-#ifdef __FreeBSD__
-		PF_LOCK();
-#endif
-		if (pfsyncr.pfsyncr_syncpeer.s_addr == 0)
-#ifdef __FreeBSD__
-			sc->sc_sync_peer.s_addr = htonl(INADDR_PFSYNC_GROUP);
-#else
-			sc->sc_sync_peer.s_addr = INADDR_PFSYNC_GROUP;
-#endif
-		else
-			sc->sc_sync_peer.s_addr =
-			    pfsyncr.pfsyncr_syncpeer.s_addr;
-
-		if (pfsyncr.pfsyncr_maxupdates > 255)
-#ifdef __FreeBSD__
-		{
-			PF_UNLOCK();
-#endif
-			return (EINVAL);
-#ifdef __FreeBSD__
-		}
-#endif
-		sc->sc_maxupdates = pfsyncr.pfsyncr_maxupdates;
-		sc->sc_defer = pfsyncr.pfsyncr_defer;
-
-		if (pfsyncr.pfsyncr_syncdev[0] == 0) {
-			sc->sc_sync_if = NULL;
-#ifdef __FreeBSD__
-			PF_UNLOCK();
-			if (imo->imo_membership)
-				pfsync_multicast_cleanup(sc);
-#else
-			if (imo->imo_num_memberships > 0) {
-				in_delmulti(imo->imo_membership[
-				    --imo->imo_num_memberships]);
-				imo->imo_multicast_ifp = NULL;
-			}
-#endif
-			break;
-		}
-
-#ifdef __FreeBSD__
-		PF_UNLOCK();
-#endif
-		if ((sifp = ifunit(pfsyncr.pfsyncr_syncdev)) == NULL)
-			return (EINVAL);
-
-#ifdef __FreeBSD__
-		PF_LOCK();
-#endif
-		s = splnet();
-#ifdef __FreeBSD__
-		if (sifp->if_mtu < sc->sc_ifp->if_mtu ||
-#else
-		if (sifp->if_mtu < sc->sc_if.if_mtu ||
-#endif
-		    (sc->sc_sync_if != NULL &&
-		    sifp->if_mtu < sc->sc_sync_if->if_mtu) ||
-		    sifp->if_mtu < MCLBYTES - sizeof(struct ip))
-			pfsync_sendout();
-		sc->sc_sync_if = sifp;
-
-#ifdef __FreeBSD__
-		if (imo->imo_membership) {
-			PF_UNLOCK();
-			pfsync_multicast_cleanup(sc);
-			PF_LOCK();
-		}
-#else
-		if (imo->imo_num_memberships > 0) {
-			in_delmulti(imo->imo_membership[--imo->imo_num_memberships]);
-			imo->imo_multicast_ifp = NULL;
-		}
-#endif
-
-#ifdef __FreeBSD__
-		if (sc->sc_sync_if &&
-		    sc->sc_sync_peer.s_addr == htonl(INADDR_PFSYNC_GROUP)) {
-			PF_UNLOCK();
-			error = pfsync_multicast_setup(sc);
-			if (error)
-				return (error);
-			PF_LOCK();
-		}
-#else
-		if (sc->sc_sync_if &&
-		    sc->sc_sync_peer.s_addr == INADDR_PFSYNC_GROUP) {
-			struct in_addr addr;
-
-			if (!(sc->sc_sync_if->if_flags & IFF_MULTICAST)) {
-				sc->sc_sync_if = NULL;
-				splx(s);
-				return (EADDRNOTAVAIL);
-			}
-
-			addr.s_addr = INADDR_PFSYNC_GROUP;
-
-			if ((imo->imo_membership[0] =
-			    in_addmulti(&addr, sc->sc_sync_if)) == NULL) {
-				sc->sc_sync_if = NULL;
-				splx(s);
-				return (ENOBUFS);
-			}
-			imo->imo_num_memberships++;
-			imo->imo_multicast_ifp = sc->sc_sync_if;
-			imo->imo_multicast_ttl = PFSYNC_DFLTTL;
-			imo->imo_multicast_loop = 0;
-		}
-#endif	/* !__FreeBSD__ */
-
-		ip = &sc->sc_template;
-		bzero(ip, sizeof(*ip));
-		ip->ip_v = IPVERSION;
-		ip->ip_hl = sizeof(sc->sc_template) >> 2;
-		ip->ip_tos = IPTOS_LOWDELAY;
-		/* len and id are set later */
-#ifdef __FreeBSD__
-		ip->ip_off = IP_DF;
-#else
-		ip->ip_off = htons(IP_DF);
-#endif
-		ip->ip_ttl = PFSYNC_DFLTTL;
-		ip->ip_p = IPPROTO_PFSYNC;
-		ip->ip_src.s_addr = INADDR_ANY;
-		ip->ip_dst.s_addr = sc->sc_sync_peer.s_addr;
-
-		if (sc->sc_sync_if) {
-			/* Request a full state table update. */
-			sc->sc_ureq_sent = time_uptime;
-#ifdef __FreeBSD__
-			if (sc->pfsync_sync_ok && carp_demote_adj_p)
-				(*carp_demote_adj_p)(V_pfsync_carp_adj,
-				    "pfsync bulk start");
-			sc->pfsync_sync_ok = 0;
-#else
-#if NCARP > 0
-			if (pfsync_sync_ok)
-				carp_group_demote_adj(&sc->sc_if, 1);
-#endif
-			pfsync_sync_ok = 0;
-#endif
-#ifdef __FreeBSD__
-			if (V_pf_status.debug >= PF_DEBUG_MISC)
-#else
-			if (pf_status.debug >= PF_DEBUG_MISC)
-#endif
-				printf("pfsync: requesting bulk update\n");
-#ifdef __FreeBSD__
-			callout_reset(&sc->sc_bulkfail_tmo, 5 * hz,
-			    pfsync_bulk_fail, V_pfsyncif);
-#else
-			timeout_add_sec(&sc->sc_bulkfail_tmo, 5);
-#endif
-			pfsync_request_update(0, 0);
-		}
-#ifdef __FreeBSD__
-		PF_UNLOCK();
-#endif
-		splx(s);
-
-		break;
-
-	default:
-		return (ENOTTY);
-	}
-
-	return (0);
-}
-
-int
-pfsync_out_state(struct pf_state *st, struct mbuf *m, int offset)
-{
-	struct pfsync_state *sp = (struct pfsync_state *)(m->m_data + offset);
-
-	pfsync_state_export(sp, st);
-
-	return (sizeof(*sp));
-}
-
-int
-pfsync_out_iack(struct pf_state *st, struct mbuf *m, int offset)
-{
-	struct pfsync_ins_ack *iack =
-	    (struct pfsync_ins_ack *)(m->m_data + offset);
-
-	iack->id = st->id;
-	iack->creatorid = st->creatorid;
-
-	return (sizeof(*iack));
-}
-
-int
-pfsync_out_upd_c(struct pf_state *st, struct mbuf *m, int offset)
-{
-	struct pfsync_upd_c *up = (struct pfsync_upd_c *)(m->m_data + offset);
-
-	bzero(up, sizeof(*up));
-	up->id = st->id;
-	pf_state_peer_hton(&st->src, &up->src);
-	pf_state_peer_hton(&st->dst, &up->dst);
-	up->creatorid = st->creatorid;
-	up->timeout = st->timeout;
-
-	return (sizeof(*up));
-}
-
-int
-pfsync_out_del(struct pf_state *st, struct mbuf *m, int offset)
-{
-	struct pfsync_del_c *dp = (struct pfsync_del_c *)(m->m_data + offset);
-
-	dp->id = st->id;
-	dp->creatorid = st->creatorid;
-
-	SET(st->state_flags, PFSTATE_NOSYNC);
-
-	return (sizeof(*dp));
-}
-
-void
-pfsync_drop(struct pfsync_softc *sc)
-{
-	struct pf_state *st;
-	struct pfsync_upd_req_item *ur;
-#ifdef notyet
-	struct tdb *t;
-#endif
-	int q;
-
-	for (q = 0; q < PFSYNC_S_COUNT; q++) {
-		if (TAILQ_EMPTY(&sc->sc_qs[q]))
-			continue;
-
-		TAILQ_FOREACH(st, &sc->sc_qs[q], sync_list) {
-#ifdef PFSYNC_DEBUG
-#ifdef __FreeBSD__
-			KASSERT(st->sync_state == q,
-				("%s: st->sync_state == q",
-					__FUNCTION__));
-#else
-			KASSERT(st->sync_state == q);
-#endif
-#endif
-			st->sync_state = PFSYNC_S_NONE;
-		}
-		TAILQ_INIT(&sc->sc_qs[q]);
-	}
-
-	while ((ur = TAILQ_FIRST(&sc->sc_upd_req_list)) != NULL) {
-		TAILQ_REMOVE(&sc->sc_upd_req_list, ur, ur_entry);
-		pool_put(&sc->sc_pool, ur);
-	}
-
-	sc->sc_plus = NULL;
-
-#ifdef notyet
-	if (!TAILQ_EMPTY(&sc->sc_tdb_q)) {
-		TAILQ_FOREACH(t, &sc->sc_tdb_q, tdb_sync_entry)
-			CLR(t->tdb_flags, TDBF_PFSYNC);
-
-		TAILQ_INIT(&sc->sc_tdb_q);
-	}
-#endif
-
-	sc->sc_len = PFSYNC_MINPKT;
-}
-
-#ifdef __FreeBSD__
-void pfsync_sendout()
-{
-	pfsync_sendout1(1);
-}
-
-static void
-pfsync_sendout1(int schedswi)
-{
-	struct pfsync_softc *sc = V_pfsyncif;
-#else
-void
-pfsync_sendout(void)
-{
-	struct pfsync_softc *sc = pfsyncif;
-#endif
-#if NBPFILTER > 0
-#ifdef __FreeBSD__
-	struct ifnet *ifp = sc->sc_ifp;
-#else
-	struct ifnet *ifp = &sc->sc_if;
-#endif
-#endif
-	struct mbuf *m;
-	struct ip *ip;
-	struct pfsync_header *ph;
-	struct pfsync_subheader *subh;
-	struct pf_state *st;
-	struct pfsync_upd_req_item *ur;
-#ifdef notyet
-	struct tdb *t;
-#endif
-	int offset;
-	int q, count = 0;
-
-#ifdef __FreeBSD__
-	PF_LOCK_ASSERT();
-#else
-	splassert(IPL_NET);
-#endif
-
-	if (sc == NULL || sc->sc_len == PFSYNC_MINPKT)
-		return;
-
-#if NBPFILTER > 0
-	if (ifp->if_bpf == NULL && sc->sc_sync_if == NULL) {
-#else
-	if (sc->sc_sync_if == NULL) {
-#endif
-		pfsync_drop(sc);
-		return;
-	}
-
-#ifdef __FreeBSD__
-	m = m_get2(M_NOWAIT, MT_DATA, M_PKTHDR, max_linkhdr + sc->sc_len);
-	if (m == NULL) {
-		sc->sc_ifp->if_oerrors++;
-		V_pfsyncstats.pfsyncs_onomem++;
-		return;
-	}
-#else
-	MGETHDR(m, M_DONTWAIT, MT_DATA);
-	if (m == NULL) {
-		sc->sc_if.if_oerrors++;
-		pfsyncstats.pfsyncs_onomem++;
-		pfsync_drop(sc);
-		return;
-	}
-
-	if (max_linkhdr + sc->sc_len > MHLEN) {
-		MCLGETI(m, M_DONTWAIT, NULL, max_linkhdr + sc->sc_len);
-		if (!ISSET(m->m_flags, M_EXT)) {
-			m_free(m);
-			sc->sc_if.if_oerrors++;
-			pfsyncstats.pfsyncs_onomem++;
-			pfsync_drop(sc);
-			return;
-		}
-	}
-#endif
-	m->m_data += max_linkhdr;
-	m->m_len = m->m_pkthdr.len = sc->sc_len;
-
-	/* build the ip header */
-	ip = (struct ip *)m->m_data;
-	bcopy(&sc->sc_template, ip, sizeof(*ip));
-	offset = sizeof(*ip);
-
-#ifdef __FreeBSD__
-	ip->ip_len = m->m_pkthdr.len;
-#else
-	ip->ip_len = htons(m->m_pkthdr.len);
-#endif
-	ip->ip_id = htons(ip_randomid());
-
-	/* build the pfsync header */
-	ph = (struct pfsync_header *)(m->m_data + offset);
-	bzero(ph, sizeof(*ph));
-	offset += sizeof(*ph);
-
-	ph->version = PFSYNC_VERSION;
-	ph->len = htons(sc->sc_len - sizeof(*ip));
-#ifdef __FreeBSD__
-	bcopy(V_pf_status.pf_chksum, ph->pfcksum, PF_MD5_DIGEST_LENGTH);
-#else
-	bcopy(pf_status.pf_chksum, ph->pfcksum, PF_MD5_DIGEST_LENGTH);
-#endif
-
-	/* walk the queues */
-	for (q = 0; q < PFSYNC_S_COUNT; q++) {
-		if (TAILQ_EMPTY(&sc->sc_qs[q]))
-			continue;
-
-		subh = (struct pfsync_subheader *)(m->m_data + offset);
-		offset += sizeof(*subh);
-
-		count = 0;
-		TAILQ_FOREACH(st, &sc->sc_qs[q], sync_list) {
-#ifdef PFSYNC_DEBUG
-#ifdef __FreeBSD__
-			KASSERT(st->sync_state == q,
-				("%s: st->sync_state == q",
-					__FUNCTION__));
-#else
-			KASSERT(st->sync_state == q);
-#endif
-#endif
-
-			offset += pfsync_qs[q].write(st, m, offset);
-			st->sync_state = PFSYNC_S_NONE;
-			count++;
-		}
-		TAILQ_INIT(&sc->sc_qs[q]);
-
-		bzero(subh, sizeof(*subh));
-		subh->action = pfsync_qs[q].action;
-		subh->count = htons(count);
-	}
-
-	if (!TAILQ_EMPTY(&sc->sc_upd_req_list)) {
-		subh = (struct pfsync_subheader *)(m->m_data + offset);
-		offset += sizeof(*subh);
-
-		count = 0;
-		while ((ur = TAILQ_FIRST(&sc->sc_upd_req_list)) != NULL) {
-			TAILQ_REMOVE(&sc->sc_upd_req_list, ur, ur_entry);
-
-			bcopy(&ur->ur_msg, m->m_data + offset,
-			    sizeof(ur->ur_msg));
-			offset += sizeof(ur->ur_msg);
-
-			pool_put(&sc->sc_pool, ur);
-
-			count++;
-		}
-
-		bzero(subh, sizeof(*subh));
-		subh->action = PFSYNC_ACT_UPD_REQ;
-		subh->count = htons(count);
-	}
-
-	/* has someone built a custom region for us to add? */
-	if (sc->sc_plus != NULL) {
-		bcopy(sc->sc_plus, m->m_data + offset, sc->sc_pluslen);
-		offset += sc->sc_pluslen;
-
-		sc->sc_plus = NULL;
-	}
-
-#ifdef notyet
-	if (!TAILQ_EMPTY(&sc->sc_tdb_q)) {
-		subh = (struct pfsync_subheader *)(m->m_data + offset);
-		offset += sizeof(*subh);
-
-		count = 0;
-		TAILQ_FOREACH(t, &sc->sc_tdb_q, tdb_sync_entry) {
-			offset += pfsync_out_tdb(t, m, offset);
-			CLR(t->tdb_flags, TDBF_PFSYNC);
-
-			count++;
-		}
-		TAILQ_INIT(&sc->sc_tdb_q);
-
-		bzero(subh, sizeof(*subh));
-		subh->action = PFSYNC_ACT_TDB;
-		subh->count = htons(count);
-	}
-#endif
-
-	subh = (struct pfsync_subheader *)(m->m_data + offset);
-	offset += sizeof(*subh);
-
-	bzero(subh, sizeof(*subh));
-	subh->action = PFSYNC_ACT_EOF;
-	subh->count = htons(1);
-
-	/* XXX write checksum in EOF here */
-
-	/* we're done, let's put it on the wire */
-#if NBPFILTER > 0
-	if (ifp->if_bpf) {
-		m->m_data += sizeof(*ip);
-		m->m_len = m->m_pkthdr.len = sc->sc_len - sizeof(*ip);
-#ifdef __FreeBSD__
-		BPF_MTAP(ifp, m);
-#else
-		bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT);
-#endif
-		m->m_data -= sizeof(*ip);
-		m->m_len = m->m_pkthdr.len = sc->sc_len;
-	}
-
-	if (sc->sc_sync_if == NULL) {
-		sc->sc_len = PFSYNC_MINPKT;
-		m_freem(m);
-		return;
-	}
-#endif
-
-#ifdef __FreeBSD__
-	sc->sc_ifp->if_opackets++;
-	sc->sc_ifp->if_obytes += m->m_pkthdr.len;
-	sc->sc_len = PFSYNC_MINPKT;
-
-	if (!_IF_QFULL(&sc->sc_ifp->if_snd))
-		_IF_ENQUEUE(&sc->sc_ifp->if_snd, m);
-	else {
-		m_freem(m);
-                sc->sc_ifp->if_snd.ifq_drops++;
-	}
-	if (schedswi)
-		swi_sched(V_pfsync_swi_cookie, 0);
-#else
-	sc->sc_if.if_opackets++;
-	sc->sc_if.if_obytes += m->m_pkthdr.len;
-
-	if (ip_output(m, NULL, NULL, IP_RAWOUTPUT, &sc->sc_imo, NULL) == 0)
-		pfsyncstats.pfsyncs_opackets++;
-	else
-		pfsyncstats.pfsyncs_oerrors++;
-
-	/* start again */
-	sc->sc_len = PFSYNC_MINPKT;
-#endif
-}
-
-void
-pfsync_insert_state(struct pf_state *st)
-{
-#ifdef __FreeBSD__
-	struct pfsync_softc *sc = V_pfsyncif;
-#else
-	struct pfsync_softc *sc = pfsyncif;
-#endif
-
-#ifdef __FreeBSD__
-	PF_LOCK_ASSERT();
-#else
-	splassert(IPL_SOFTNET);
-#endif
-
-	if (ISSET(st->rule.ptr->rule_flag, PFRULE_NOSYNC) ||
-	    st->key[PF_SK_WIRE]->proto == IPPROTO_PFSYNC) {
-		SET(st->state_flags, PFSTATE_NOSYNC);
-		return;
-	}
-
-	if (sc == NULL || ISSET(st->state_flags, PFSTATE_NOSYNC))
-		return;
-
-#ifdef PFSYNC_DEBUG
-#ifdef __FreeBSD__
-	KASSERT(st->sync_state == PFSYNC_S_NONE,
-		("%s: st->sync_state == PFSYNC_S_NONE", __FUNCTION__));
-#else
-	KASSERT(st->sync_state == PFSYNC_S_NONE);
-#endif
-#endif
-
-	if (sc->sc_len == PFSYNC_MINPKT)
-#ifdef __FreeBSD__
-		callout_reset(&sc->sc_tmo, 1 * hz, pfsync_timeout,
-		    V_pfsyncif);
-#else
-		timeout_add_sec(&sc->sc_tmo, 1);
-#endif
-
-	pfsync_q_ins(st, PFSYNC_S_INS);
-
-	st->sync_updates = 0;
-}
-
-int defer = 10;
-
-int
-pfsync_defer(struct pf_state *st, struct mbuf *m)
-{
-#ifdef __FreeBSD__
-	struct pfsync_softc *sc = V_pfsyncif;
-#else
-	struct pfsync_softc *sc = pfsyncif;
-#endif
-	struct pfsync_deferral *pd;
-
-#ifdef __FreeBSD__
-	PF_LOCK_ASSERT();
-#else
-	splassert(IPL_SOFTNET);
-#endif
-
-	if (!sc->sc_defer || m->m_flags & (M_BCAST|M_MCAST))
-		return (0);
-
-	if (sc->sc_deferred >= 128)
-		pfsync_undefer(TAILQ_FIRST(&sc->sc_deferrals), 0);
-
-	pd = pool_get(&sc->sc_pool, M_NOWAIT);
-	if (pd == NULL)
-		return (0);
-	sc->sc_deferred++;
-
-#ifdef __FreeBSD__
-	m->m_flags |= M_SKIP_FIREWALL;
-#else
-	m->m_pkthdr.pf.flags |= PF_TAG_GENERATED;
-#endif
-	SET(st->state_flags, PFSTATE_ACK);
-
-	pd->pd_st = st;
-	pd->pd_m = m;
-
-	TAILQ_INSERT_TAIL(&sc->sc_deferrals, pd, pd_entry);
-#ifdef __FreeBSD__
-	callout_init(&pd->pd_tmo, CALLOUT_MPSAFE);
-	callout_reset(&pd->pd_tmo, defer, pfsync_defer_tmo,
-		pd);
-#else
-	timeout_set(&pd->pd_tmo, pfsync_defer_tmo, pd);
-	timeout_add(&pd->pd_tmo, defer);
-#endif
-
-	swi_sched(V_pfsync_swi_cookie, 0);
-
-	return (1);
-}
-
-void
-pfsync_undefer(struct pfsync_deferral *pd, int drop)
-{
-#ifdef __FreeBSD__
-	struct pfsync_softc *sc = V_pfsyncif;
-#else
-	struct pfsync_softc *sc = pfsyncif;
-#endif
-	int s;
-
-#ifdef __FreeBSD__
-	PF_LOCK_ASSERT();
-#else
-	splassert(IPL_SOFTNET);
-#endif
-
-	TAILQ_REMOVE(&sc->sc_deferrals, pd, pd_entry);
-	sc->sc_deferred--;
-
-	CLR(pd->pd_st->state_flags, PFSTATE_ACK);
-	timeout_del(&pd->pd_tmo); /* bah */
-	if (drop)
-		m_freem(pd->pd_m);
-	else {
-		s = splnet();
-#ifdef __FreeBSD__
-		/* XXX: use pf_defered?! */
-		PF_UNLOCK();
-#endif
-		ip_output(pd->pd_m, (void *)NULL, (void *)NULL, 0,
-		    (void *)NULL, (void *)NULL);
-#ifdef __FreeBSD__
-		PF_LOCK();
-#endif
-		splx(s);
-	}
-
-	pool_put(&sc->sc_pool, pd);
-}
-
-void
-pfsync_defer_tmo(void *arg)
-{
-#if defined(__FreeBSD__) && defined(VIMAGE)
-	struct pfsync_deferral *pd = arg;
-#endif
-	int s;
-
-	s = splsoftnet();
-#ifdef __FreeBSD__
-	CURVNET_SET(pd->pd_m->m_pkthdr.rcvif->if_vnet); /* XXX */
-	PF_LOCK();
-#endif
-	pfsync_undefer(arg, 0);
-#ifdef __FreeBSD__
-	PF_UNLOCK();
-	CURVNET_RESTORE();
-#endif
-	splx(s);
-}
-
-void
-pfsync_deferred(struct pf_state *st, int drop)
-{
-#ifdef __FreeBSD__
-	struct pfsync_softc *sc = V_pfsyncif;
-#else
-	struct pfsync_softc *sc = pfsyncif;
-#endif
-	struct pfsync_deferral *pd;
-
-	TAILQ_FOREACH(pd, &sc->sc_deferrals, pd_entry) {
-		 if (pd->pd_st == st) {
-			pfsync_undefer(pd, drop);
-			return;
-		}
-	}
-
-	panic("pfsync_send_deferred: unable to find deferred state");
-}
-
-u_int pfsync_upds = 0;
-
-void
-pfsync_update_state(struct pf_state *st)
-{
-#ifdef __FreeBSD__
-	struct pfsync_softc *sc = V_pfsyncif;
-#else
-	struct pfsync_softc *sc = pfsyncif;
-#endif
-	int sync = 0;
-
-#ifdef __FreeBSD__
-	PF_LOCK_ASSERT();
-#else
-	splassert(IPL_SOFTNET);
-#endif
-
-	if (sc == NULL)
-		return;
-
-	if (ISSET(st->state_flags, PFSTATE_ACK))
-		pfsync_deferred(st, 0);
-	if (ISSET(st->state_flags, PFSTATE_NOSYNC)) {
-		if (st->sync_state != PFSYNC_S_NONE)
-			pfsync_q_del(st);
-		return;
-	}
-
-	if (sc->sc_len == PFSYNC_MINPKT)
-#ifdef __FreeBSD__
-		callout_reset(&sc->sc_tmo, 1 * hz, pfsync_timeout,
-		    V_pfsyncif);
-#else
-		timeout_add_sec(&sc->sc_tmo, 1);
-#endif
-
-	switch (st->sync_state) {
-	case PFSYNC_S_UPD_C:
-	case PFSYNC_S_UPD:
-	case PFSYNC_S_INS:
-		/* we're already handling it */
-
-		if (st->key[PF_SK_WIRE]->proto == IPPROTO_TCP) {
-			st->sync_updates++;
-			if (st->sync_updates >= sc->sc_maxupdates)
-				sync = 1;
-		}
-		break;
-
-	case PFSYNC_S_IACK:
-		pfsync_q_del(st);
-	case PFSYNC_S_NONE:
-		pfsync_q_ins(st, PFSYNC_S_UPD_C);
-		st->sync_updates = 0;
-		break;
-
-	default:
-		panic("pfsync_update_state: unexpected sync state %d",
-		    st->sync_state);
-	}
-
-	if (sync || (time_uptime - st->pfsync_time) < 2) {
-		pfsync_upds++;
-		schednetisr(NETISR_PFSYNC);
-	}
-}
-
-void
-pfsync_request_update(u_int32_t creatorid, u_int64_t id)
-{
-#ifdef __FreeBSD__
-	struct pfsync_softc *sc = V_pfsyncif;
-#else
-	struct pfsync_softc *sc = pfsyncif;
-#endif
-	struct pfsync_upd_req_item *item;
-	size_t nlen = sizeof(struct pfsync_upd_req);
-	int s;
-
-	PF_LOCK_ASSERT();
-
-	/*
-	 * this code does nothing to prevent multiple update requests for the
-	 * same state being generated.
-	 */
-
-	item = pool_get(&sc->sc_pool, PR_NOWAIT);
-	if (item == NULL) {
-		/* XXX stats */
-		return;
-	}
-
-	item->ur_msg.id = id;
-	item->ur_msg.creatorid = creatorid;
-
-	if (TAILQ_EMPTY(&sc->sc_upd_req_list))
-		nlen += sizeof(struct pfsync_subheader);
-
-#ifdef __FreeBSD__
-	if (sc->sc_len + nlen > sc->sc_ifp->if_mtu) {
-#else
-	if (sc->sc_len + nlen > sc->sc_if.if_mtu) {
-#endif
-		s = splnet();
-		pfsync_sendout();
-		splx(s);
-
-		nlen = sizeof(struct pfsync_subheader) +
-		    sizeof(struct pfsync_upd_req);
-	}
-
-	TAILQ_INSERT_TAIL(&sc->sc_upd_req_list, item, ur_entry);
-	sc->sc_len += nlen;
-
-	schednetisr(NETISR_PFSYNC);
-}
-
-void
-pfsync_update_state_req(struct pf_state *st)
-{
-#ifdef __FreeBSD__
-	struct pfsync_softc *sc = V_pfsyncif;
-#else
-	struct pfsync_softc *sc = pfsyncif;
-#endif
-
-	PF_LOCK_ASSERT();
-
-	if (sc == NULL)
-		panic("pfsync_update_state_req: nonexistant instance");
-
-	if (ISSET(st->state_flags, PFSTATE_NOSYNC)) {
-		if (st->sync_state != PFSYNC_S_NONE)
-			pfsync_q_del(st);
-		return;
-	}
-
-	switch (st->sync_state) {
-	case PFSYNC_S_UPD_C:
-	case PFSYNC_S_IACK:
-		pfsync_q_del(st);
-	case PFSYNC_S_NONE:
-		pfsync_q_ins(st, PFSYNC_S_UPD);
-		schednetisr(NETISR_PFSYNC);
-		return;
-
-	case PFSYNC_S_INS:
-	case PFSYNC_S_UPD:
-	case PFSYNC_S_DEL:
-		/* we're already handling it */
-		return;
-
-	default:
-		panic("pfsync_update_state_req: unexpected sync state %d",
-		    st->sync_state);
-	}
-}
-
-void
-pfsync_delete_state(struct pf_state *st)
-{
-#ifdef __FreeBSD__
-	struct pfsync_softc *sc = V_pfsyncif;
-#else
-	struct pfsync_softc *sc = pfsyncif;
-#endif
-
-#ifdef __FreeBSD__
-	PF_LOCK_ASSERT();
-#else
-	splassert(IPL_SOFTNET);
-#endif
-
-	if (sc == NULL)
-		return;
-
-	if (ISSET(st->state_flags, PFSTATE_ACK))
-		pfsync_deferred(st, 1);
-	if (ISSET(st->state_flags, PFSTATE_NOSYNC)) {
-		if (st->sync_state != PFSYNC_S_NONE)
-			pfsync_q_del(st);
-		return;
-	}
-
-	if (sc->sc_len == PFSYNC_MINPKT)
-#ifdef __FreeBSD__
-		callout_reset(&sc->sc_tmo, 1 * hz, pfsync_timeout,
-		    V_pfsyncif);
-#else
-		timeout_add_sec(&sc->sc_tmo, 1);
-#endif
-
-	switch (st->sync_state) {
-	case PFSYNC_S_INS:
-		/* we never got to tell the world so just forget about it */
-		pfsync_q_del(st);
-		return;
-
-	case PFSYNC_S_UPD_C:
-	case PFSYNC_S_UPD:
-	case PFSYNC_S_IACK:
-		pfsync_q_del(st);
-		/* FALLTHROUGH to putting it on the del list */
-
-	case PFSYNC_S_NONE:
-		pfsync_q_ins(st, PFSYNC_S_DEL);
-		return;
-
-	default:
-		panic("pfsync_delete_state: unexpected sync state %d",
-		    st->sync_state);
-	}
-}
-
-void
-pfsync_clear_states(u_int32_t creatorid, const char *ifname)
-{
-	struct {
-		struct pfsync_subheader subh;
-		struct pfsync_clr clr;
-	} __packed r;
-
-#ifdef __FreeBSD__
-	struct pfsync_softc *sc = V_pfsyncif;
-#else
-	struct pfsync_softc *sc = pfsyncif;
-#endif
-
-#ifdef __FreeBSD__
-	PF_LOCK_ASSERT();
-#else
-	splassert(IPL_SOFTNET);
-#endif
-
-	if (sc == NULL)
-		return;
-
-	bzero(&r, sizeof(r));
-
-	r.subh.action = PFSYNC_ACT_CLR;
-	r.subh.count = htons(1);
-
-	strlcpy(r.clr.ifname, ifname, sizeof(r.clr.ifname));
-	r.clr.creatorid = creatorid;
-
-	pfsync_send_plus(&r, sizeof(r));
-}
-
-void
-pfsync_q_ins(struct pf_state *st, int q)
-{
-#ifdef __FreeBSD__
-	struct pfsync_softc *sc = V_pfsyncif;
-#else
-	struct pfsync_softc *sc = pfsyncif;
-#endif
-	size_t nlen = pfsync_qs[q].len;
-	int s;
-
-	PF_LOCK_ASSERT();
-
-#ifdef __FreeBSD__
-	KASSERT(st->sync_state == PFSYNC_S_NONE,
-		("%s: st->sync_state == PFSYNC_S_NONE", __FUNCTION__));
-#else
-	KASSERT(st->sync_state == PFSYNC_S_NONE);
-#endif
-
-#if 1 || defined(PFSYNC_DEBUG)
-	if (sc->sc_len < PFSYNC_MINPKT)
-#ifdef __FreeBSD__
-		panic("pfsync pkt len is too low %zu", sc->sc_len);
-#else
-		panic("pfsync pkt len is too low %d", sc->sc_len);
-#endif
-#endif
-	if (TAILQ_EMPTY(&sc->sc_qs[q]))
-		nlen += sizeof(struct pfsync_subheader);
-
-#ifdef __FreeBSD__
-	if (sc->sc_len + nlen > sc->sc_ifp->if_mtu) {
-#else
-	if (sc->sc_len + nlen > sc->sc_if.if_mtu) {
-#endif
-		s = splnet();
-		pfsync_sendout();
-		splx(s);
-
-		nlen = sizeof(struct pfsync_subheader) + pfsync_qs[q].len;
-	}
-
-	sc->sc_len += nlen;
-	TAILQ_INSERT_TAIL(&sc->sc_qs[q], st, sync_list);
-	st->sync_state = q;
-}
-
-void
-pfsync_q_del(struct pf_state *st)
-{
-#ifdef __FreeBSD__
-	struct pfsync_softc *sc = V_pfsyncif;
-#else
-	struct pfsync_softc *sc = pfsyncif;
-#endif
-	int q = st->sync_state;
-
-#ifdef __FreeBSD__
-	KASSERT(st->sync_state != PFSYNC_S_NONE,
-		("%s: st->sync_state != PFSYNC_S_NONE", __FUNCTION__));
-#else
-	KASSERT(st->sync_state != PFSYNC_S_NONE);
-#endif
-
-	sc->sc_len -= pfsync_qs[q].len;
-	TAILQ_REMOVE(&sc->sc_qs[q], st, sync_list);
-	st->sync_state = PFSYNC_S_NONE;
-
-	if (TAILQ_EMPTY(&sc->sc_qs[q]))
-		sc->sc_len -= sizeof(struct pfsync_subheader);
-}
-
-#ifdef notyet
-void
-pfsync_update_tdb(struct tdb *t, int output)
-{
-#ifdef __FreeBSD__
-	struct pfsync_softc *sc = V_pfsyncif;
-#else
-	struct pfsync_softc *sc = pfsyncif;
-#endif
-	size_t nlen = sizeof(struct pfsync_tdb);
-	int s;
-
-	if (sc == NULL)
-		return;
-
-	if (!ISSET(t->tdb_flags, TDBF_PFSYNC)) {
-		if (TAILQ_EMPTY(&sc->sc_tdb_q))
-			nlen += sizeof(struct pfsync_subheader);
-
-		if (sc->sc_len + nlen > sc->sc_if.if_mtu) {
-			s = splnet();
-			PF_LOCK();
-			pfsync_sendout();
-			PF_UNLOCK();
-			splx(s);
-
-			nlen = sizeof(struct pfsync_subheader) +
-			    sizeof(struct pfsync_tdb);
-		}
-
-		sc->sc_len += nlen;
-		TAILQ_INSERT_TAIL(&sc->sc_tdb_q, t, tdb_sync_entry);
-		SET(t->tdb_flags, TDBF_PFSYNC);
-		t->tdb_updates = 0;
-	} else {
-		if (++t->tdb_updates >= sc->sc_maxupdates)
-			schednetisr(NETISR_PFSYNC);
-	}
-
-	if (output)
-		SET(t->tdb_flags, TDBF_PFSYNC_RPL);
-	else
-		CLR(t->tdb_flags, TDBF_PFSYNC_RPL);
-}
-
-void
-pfsync_delete_tdb(struct tdb *t)
-{
-#ifdef __FreeBSD__
-	struct pfsync_softc *sc = V_pfsyncif;
-#else
-	struct pfsync_softc *sc = pfsyncif;
-#endif
-
-	if (sc == NULL || !ISSET(t->tdb_flags, TDBF_PFSYNC))
-		return;
-
-	sc->sc_len -= sizeof(struct pfsync_tdb);
-	TAILQ_REMOVE(&sc->sc_tdb_q, t, tdb_sync_entry);
-	CLR(t->tdb_flags, TDBF_PFSYNC);
-
-	if (TAILQ_EMPTY(&sc->sc_tdb_q))
-		sc->sc_len -= sizeof(struct pfsync_subheader);
-}
-
-int
-pfsync_out_tdb(struct tdb *t, struct mbuf *m, int offset)
-{
-	struct pfsync_tdb *ut = (struct pfsync_tdb *)(m->m_data + offset);
-
-	bzero(ut, sizeof(*ut));
-	ut->spi = t->tdb_spi;
-	bcopy(&t->tdb_dst, &ut->dst, sizeof(ut->dst));
-	/*
-	 * When a failover happens, the master's rpl is probably above
-	 * what we see here (we may be up to a second late), so
-	 * increase it a bit for outbound tdbs to manage most such
-	 * situations.
-	 *
-	 * For now, just add an offset that is likely to be larger
-	 * than the number of packets we can see in one second. The RFC
-	 * just says the next packet must have a higher seq value.
-	 *
-	 * XXX What is a good algorithm for this? We could use
-	 * a rate-determined increase, but to know it, we would have
-	 * to extend struct tdb.
-	 * XXX pt->rpl can wrap over MAXINT, but if so the real tdb
-	 * will soon be replaced anyway. For now, just don't handle
-	 * this edge case.
-	 */
-#define RPL_INCR 16384
-	ut->rpl = htonl(t->tdb_rpl + (ISSET(t->tdb_flags, TDBF_PFSYNC_RPL) ?
-	    RPL_INCR : 0));
-	ut->cur_bytes = htobe64(t->tdb_cur_bytes);
-	ut->sproto = t->tdb_sproto;
-
-	return (sizeof(*ut));
-}
-#endif
-
-void
-pfsync_bulk_start(void)
-{
-#ifdef __FreeBSD__
-	struct pfsync_softc *sc = V_pfsyncif;
-#else
-	struct pfsync_softc *sc = pfsyncif;
-#endif
-
-#ifdef __FreeBSD__
-	if (V_pf_status.debug >= PF_DEBUG_MISC)
-#else
-	if (pf_status.debug >= PF_DEBUG_MISC)
-#endif
-		printf("pfsync: received bulk update request\n");
-
-#ifdef __FreeBSD__
-	PF_LOCK_ASSERT();
-	if (TAILQ_EMPTY(&V_state_list))
-#else
-	if (TAILQ_EMPTY(&state_list))
-#endif
-		pfsync_bulk_status(PFSYNC_BUS_END);
-	else {
-		sc->sc_ureq_received = time_uptime;
-		if (sc->sc_bulk_next == NULL)
-#ifdef __FreeBSD__
-			sc->sc_bulk_next = TAILQ_FIRST(&V_state_list);
-#else
-			sc->sc_bulk_next = TAILQ_FIRST(&state_list);
-#endif
-		sc->sc_bulk_last = sc->sc_bulk_next;
-
-		pfsync_bulk_status(PFSYNC_BUS_START);
-		callout_reset(&sc->sc_bulk_tmo, 1, pfsync_bulk_update, sc);
-	}
-}
-
-void
-pfsync_bulk_update(void *arg)
-{
-	struct pfsync_softc *sc = arg;
-	struct pf_state *st = sc->sc_bulk_next;
-	int i = 0;
-	int s;
-
-	PF_LOCK_ASSERT();
-
-	s = splsoftnet();
-#ifdef __FreeBSD__
-	CURVNET_SET(sc->sc_ifp->if_vnet);
-#endif
-	for (;;) {
-		if (st->sync_state == PFSYNC_S_NONE &&
-		    st->timeout < PFTM_MAX &&
-		    st->pfsync_time <= sc->sc_ureq_received) {
-			pfsync_update_state_req(st);
-			i++;
-		}
-
-		st = TAILQ_NEXT(st, entry_list);
-		if (st == NULL)
-#ifdef __FreeBSD__
-			st = TAILQ_FIRST(&V_state_list);
-#else
-			st = TAILQ_FIRST(&state_list);
-#endif
-
-		if (st == sc->sc_bulk_last) {
-			/* we're done */
-			sc->sc_bulk_next = NULL;
-			sc->sc_bulk_last = NULL;
-			pfsync_bulk_status(PFSYNC_BUS_END);
-			break;
-		}
-
-#ifdef __FreeBSD__
-		if (i > 1 && (sc->sc_ifp->if_mtu - sc->sc_len) <
-#else
-		if (i > 1 && (sc->sc_if.if_mtu - sc->sc_len) <
-#endif
-		    sizeof(struct pfsync_state)) {
-			/* we've filled a packet */
-			sc->sc_bulk_next = st;
-#ifdef __FreeBSD__
-			callout_reset(&sc->sc_bulk_tmo, 1,
-			    pfsync_bulk_update, sc);
-#else
-			timeout_add(&sc->sc_bulk_tmo, 1);
-#endif
-			break;
-		}
-	}
-
-#ifdef __FreeBSD__
-	CURVNET_RESTORE();
-#endif
-	splx(s);
-}
-
-void
-pfsync_bulk_status(u_int8_t status)
-{
-	struct {
-		struct pfsync_subheader subh;
-		struct pfsync_bus bus;
-	} __packed r;
-
-#ifdef __FreeBSD__
-	struct pfsync_softc *sc = V_pfsyncif;
-#else
-	struct pfsync_softc *sc = pfsyncif;
-#endif
-
-	PF_LOCK_ASSERT();
-
-	bzero(&r, sizeof(r));
-
-	r.subh.action = PFSYNC_ACT_BUS;
-	r.subh.count = htons(1);
-
-#ifdef __FreeBSD__
-	r.bus.creatorid = V_pf_status.hostid;
-#else
-	r.bus.creatorid = pf_status.hostid;
-#endif
-	r.bus.endtime = htonl(time_uptime - sc->sc_ureq_received);
-	r.bus.status = status;
-
-	pfsync_send_plus(&r, sizeof(r));
-}
-
-void
-pfsync_bulk_fail(void *arg)
-{
-	struct pfsync_softc *sc = arg;
-
-#ifdef __FreeBSD__
-	CURVNET_SET(sc->sc_ifp->if_vnet);
-#endif
-
-	if (sc->sc_bulk_tries++ < PFSYNC_MAX_BULKTRIES) {
-		/* Try again */
-#ifdef __FreeBSD__
-		callout_reset(&sc->sc_bulkfail_tmo, 5 * hz,
-		    pfsync_bulk_fail, V_pfsyncif);
-#else
-		timeout_add_sec(&sc->sc_bulkfail_tmo, 5);
-#endif
-		PF_LOCK();
-		pfsync_request_update(0, 0);
-		PF_UNLOCK();
-	} else {
-		/* Pretend like the transfer was ok */
-		sc->sc_ureq_sent = 0;
-		sc->sc_bulk_tries = 0;
-#ifdef __FreeBSD__
-		if (!sc->pfsync_sync_ok && carp_demote_adj_p)
-			(*carp_demote_adj_p)(-V_pfsync_carp_adj,
-			    "pfsync bulk fail");
-		sc->pfsync_sync_ok = 1;
-#else
-#if NCARP > 0
-		if (!pfsync_sync_ok)
-			carp_group_demote_adj(&sc->sc_if, -1);
-#endif
-		pfsync_sync_ok = 1;
-#endif
-#ifdef __FreeBSD__
-		if (V_pf_status.debug >= PF_DEBUG_MISC)
-#else
-		if (pf_status.debug >= PF_DEBUG_MISC)
-#endif
-			printf("pfsync: failed to receive bulk update\n");
-	}
-
-#ifdef __FreeBSD__
-	CURVNET_RESTORE();
-#endif
-}
-
-void
-pfsync_send_plus(void *plus, size_t pluslen)
-{
-#ifdef __FreeBSD__
-	struct pfsync_softc *sc = V_pfsyncif;
-#else
-	struct pfsync_softc *sc = pfsyncif;
-#endif
-	int s;
-
-	PF_LOCK_ASSERT();
-
-#ifdef __FreeBSD__
-	if (sc->sc_len + pluslen > sc->sc_ifp->if_mtu) {
-#else
-	if (sc->sc_len + pluslen > sc->sc_if.if_mtu) {
-#endif
-		s = splnet();
-		pfsync_sendout();
-		splx(s);
-	}
-
-	sc->sc_plus = plus;
-	sc->sc_len += (sc->sc_pluslen = pluslen);
-
-	s = splnet();
-	pfsync_sendout();
-	splx(s);
-}
-
-int
-pfsync_up(void)
-{
-#ifdef __FreeBSD__
-	struct pfsync_softc *sc = V_pfsyncif;
-#else
-	struct pfsync_softc *sc = pfsyncif;
-#endif
-
-#ifdef __FreeBSD__
-	if (sc == NULL || !ISSET(sc->sc_ifp->if_flags, IFF_DRV_RUNNING))
-#else
-	if (sc == NULL || !ISSET(sc->sc_if.if_flags, IFF_RUNNING))
-#endif
-		return (0);
-
-	return (1);
-}
-
-int
-pfsync_state_in_use(struct pf_state *st)
-{
-#ifdef __FreeBSD__
-	struct pfsync_softc *sc = V_pfsyncif;
-#else
-	struct pfsync_softc *sc = pfsyncif;
-#endif
-
-	if (sc == NULL)
-		return (0);
-
-	if (st->sync_state != PFSYNC_S_NONE ||
-	    st == sc->sc_bulk_next ||
-	    st == sc->sc_bulk_last)
-		return (1);
-
-	return (0);
-}
-
-u_int pfsync_ints;
-u_int pfsync_tmos;
-
-void
-pfsync_timeout(void *arg)
-{
-#if defined(__FreeBSD__) && defined(VIMAGE)
-	struct pfsync_softc *sc = arg;
-#endif
-	int s;
-
-#ifdef __FreeBSD__
-	CURVNET_SET(sc->sc_ifp->if_vnet);
-#endif
-
-	pfsync_tmos++;
-
-	s = splnet();
-#ifdef __FreeBSD__
-	PF_LOCK();
-#endif
-	pfsync_sendout();
-#ifdef __FreeBSD__
-	PF_UNLOCK();
-#endif
-	splx(s);
-
-#ifdef __FreeBSD__
-	CURVNET_RESTORE();
-#endif
-}
-
-/* this is a softnet/netisr handler */
-void
-#ifdef __FreeBSD__
-pfsyncintr(void *arg)
-{
-	struct pfsync_softc *sc = arg;
-	struct mbuf *m, *n;
-
-	CURVNET_SET(sc->sc_ifp->if_vnet);
-	pfsync_ints++;
-
-	PF_LOCK();
-	if (sc->sc_len > PFSYNC_MINPKT)
-		pfsync_sendout1(0);
-	_IF_DEQUEUE_ALL(&sc->sc_ifp->if_snd, m);
-	PF_UNLOCK();
-
-	for (; m != NULL; m = n) {
-
-		n = m->m_nextpkt;
-		m->m_nextpkt = NULL;
-		if (ip_output(m, NULL, NULL, IP_RAWOUTPUT, &sc->sc_imo, NULL)
-		    == 0)
-			V_pfsyncstats.pfsyncs_opackets++;
-		else
-			V_pfsyncstats.pfsyncs_oerrors++;
-	}
-	CURVNET_RESTORE();
-}
-#else
-pfsyncintr(void)
-{
-	int s;
-
-	pfsync_ints++;
-
-	s = splnet();
-	pfsync_sendout();
-	splx(s);
-}
-#endif
-
-int
-pfsync_sysctl(int *name, u_int namelen, void *oldp, size_t *oldlenp, void *newp,
-    size_t newlen)
-{
-
-#ifdef notyet
-	/* All sysctl names at this level are terminal. */
-	if (namelen != 1)
-		return (ENOTDIR);
-
-	switch (name[0]) {
-	case PFSYNCCTL_STATS:
-		if (newp != NULL)
-			return (EPERM);
-		return (sysctl_struct(oldp, oldlenp, newp, newlen,
-		    &V_pfsyncstats, sizeof(V_pfsyncstats)));
-	}
-#endif
-	return (ENOPROTOOPT);
-}
-
-#ifdef __FreeBSD__
-static int
-pfsync_multicast_setup(struct pfsync_softc *sc)
-{
-	struct ip_moptions *imo = &sc->sc_imo;
-	int error;
-
-	if (!(sc->sc_sync_if->if_flags & IFF_MULTICAST)) {
-		sc->sc_sync_if = NULL;
-		return (EADDRNOTAVAIL);
-	}
-
-	imo->imo_membership = (struct in_multi **)malloc(
-	    (sizeof(struct in_multi *) * IP_MIN_MEMBERSHIPS), M_PFSYNC,
-	    M_WAITOK | M_ZERO);
-	imo->imo_max_memberships = IP_MIN_MEMBERSHIPS;
-	imo->imo_multicast_vif = -1;
-
-	if ((error = in_joingroup(sc->sc_sync_if, &sc->sc_sync_peer, NULL,
-	    &imo->imo_membership[0])) != 0) {
-		free(imo->imo_membership, M_PFSYNC);
-		return (error);
-	}
-	imo->imo_num_memberships++;
-	imo->imo_multicast_ifp = sc->sc_sync_if;
-	imo->imo_multicast_ttl = PFSYNC_DFLTTL;
-	imo->imo_multicast_loop = 0;
-
-	return (0);
-}
-
-static void
-pfsync_multicast_cleanup(struct pfsync_softc *sc)
-{
-	struct ip_moptions *imo = &sc->sc_imo;
-
-	in_leavegroup(imo->imo_membership[0], NULL);
-	free(imo->imo_membership, M_PFSYNC);
-	imo->imo_membership = NULL;
-	imo->imo_multicast_ifp = NULL;
-}
-
-#ifdef INET
-extern  struct domain inetdomain;
-static struct protosw in_pfsync_protosw = {
-	.pr_type =		SOCK_RAW,
-	.pr_domain =		&inetdomain,
-	.pr_protocol =		IPPROTO_PFSYNC,
-	.pr_flags =		PR_ATOMIC|PR_ADDR,
-	.pr_input =		pfsync_input,
-	.pr_output =		(pr_output_t *)rip_output,
-	.pr_ctloutput =		rip_ctloutput,
-	.pr_usrreqs =		&rip_usrreqs
-};
-#endif
-
-static int
-pfsync_init()
-{
-	VNET_ITERATOR_DECL(vnet_iter);
-	int error = 0;
-
-	VNET_LIST_RLOCK();
-	VNET_FOREACH(vnet_iter) {
-		CURVNET_SET(vnet_iter);
-		V_pfsync_cloner = pfsync_cloner;
-		V_pfsync_cloner_data = pfsync_cloner_data;
-		V_pfsync_cloner.ifc_data = &V_pfsync_cloner_data;
-		if_clone_attach(&V_pfsync_cloner);
-		error = swi_add(NULL, "pfsync", pfsyncintr, V_pfsyncif,
-		    SWI_NET, INTR_MPSAFE, &V_pfsync_swi_cookie);
-		CURVNET_RESTORE();
-		if (error)
-			goto fail_locked;
-	}
-	VNET_LIST_RUNLOCK();
-#ifdef INET
-	error = pf_proto_register(PF_INET, &in_pfsync_protosw);
-	if (error)
-		goto fail;
-	error = ipproto_register(IPPROTO_PFSYNC);
-	if (error) {
-		pf_proto_unregister(PF_INET, IPPROTO_PFSYNC, SOCK_RAW);
-		goto fail;
-	}
-#endif
-	PF_LOCK();
-	pfsync_state_import_ptr = pfsync_state_import;
-	pfsync_up_ptr = pfsync_up;
-	pfsync_insert_state_ptr = pfsync_insert_state;
-	pfsync_update_state_ptr = pfsync_update_state;
-	pfsync_delete_state_ptr = pfsync_delete_state;
-	pfsync_clear_states_ptr = pfsync_clear_states;
-	pfsync_state_in_use_ptr = pfsync_state_in_use;
-	pfsync_defer_ptr = pfsync_defer;
-	PF_UNLOCK();
-
-	return (0);
-
-fail:
-	VNET_LIST_RLOCK();
-fail_locked:
-	VNET_FOREACH(vnet_iter) {
-		CURVNET_SET(vnet_iter);
-		if (V_pfsync_swi_cookie) {
-			swi_remove(V_pfsync_swi_cookie);
-			if_clone_detach(&V_pfsync_cloner);
-		}
-		CURVNET_RESTORE();
-	}
-	VNET_LIST_RUNLOCK();
-
-	return (error);
-}
-
-static void
-pfsync_uninit()
-{
-	VNET_ITERATOR_DECL(vnet_iter);
-
-	PF_LOCK();
-	pfsync_state_import_ptr = NULL;
-	pfsync_up_ptr = NULL;
-	pfsync_insert_state_ptr = NULL;
-	pfsync_update_state_ptr = NULL;
-	pfsync_delete_state_ptr = NULL;
-	pfsync_clear_states_ptr = NULL;
-	pfsync_state_in_use_ptr = NULL;
-	pfsync_defer_ptr = NULL;
-	PF_UNLOCK();
-
-	ipproto_unregister(IPPROTO_PFSYNC);
-	pf_proto_unregister(PF_INET, IPPROTO_PFSYNC, SOCK_RAW);
-	VNET_LIST_RLOCK();
-	VNET_FOREACH(vnet_iter) {
-		CURVNET_SET(vnet_iter);
-		swi_remove(V_pfsync_swi_cookie);
-		if_clone_detach(&V_pfsync_cloner);
-		CURVNET_RESTORE();
-	}
-	VNET_LIST_RUNLOCK();
-}
-
-static int
-pfsync_modevent(module_t mod, int type, void *data)
-{
-	int error = 0;
-
-	switch (type) {
-	case MOD_LOAD:
-		error = pfsync_init();
-		break;
-	case MOD_QUIESCE:
-		/*
-		 * Module should not be unloaded due to race conditions.
-		 */
-		error = EPERM;
-		break;
-	case MOD_UNLOAD:
-		pfsync_uninit();
-		break;
-	default:
-		error = EINVAL;
-		break;
-	}
-
-	return (error);
-}
-
-static moduledata_t pfsync_mod = {
-	"pfsync",
-	pfsync_modevent,
-	0
-};
-
-#define PFSYNC_MODVER 1
-
-DECLARE_MODULE(pfsync, pfsync_mod, SI_SUB_PROTO_DOMAIN, SI_ORDER_ANY);
-MODULE_VERSION(pfsync, PFSYNC_MODVER);
-MODULE_DEPEND(pfsync, pf, PF_MODVER, PF_MODVER, PF_MODVER);
-#endif /* __FreeBSD__ */
diff --git a/sys/contrib/pf/net/if_pfsync.h b/sys/contrib/pf/net/if_pfsync.h
deleted file mode 100644
index 3f340380181c..000000000000
--- a/sys/contrib/pf/net/if_pfsync.h
+++ /dev/null
@@ -1,324 +0,0 @@
-/*	$OpenBSD: if_pfsync.h,v 1.35 2008/06/29 08:42:15 mcbride Exp $	*/
-
-/*
- * Copyright (c) 2001 Michael Shalayeff
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR OR HIS RELATIVES BE LIABLE FOR ANY DIRECT,
- * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
- * SERVICES; LOSS OF MIND, USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
- * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
- * THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/*
- * Copyright (c) 2008 David Gwynne <dlg@openbsd.org>
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#ifndef _NET_IF_PFSYNC_H_
-#define	_NET_IF_PFSYNC_H_
-
-#define	PFSYNC_VERSION		5
-#define	PFSYNC_DFLTTL		255
-
-#define	PFSYNC_ACT_CLR		0	/* clear all states */
-#define	PFSYNC_ACT_INS		1	/* insert state */
-#define	PFSYNC_ACT_INS_ACK	2	/* ack of insterted state */
-#define	PFSYNC_ACT_UPD		3	/* update state */
-#define	PFSYNC_ACT_UPD_C	4	/* "compressed" update state */
-#define	PFSYNC_ACT_UPD_REQ	5	/* request "uncompressed" state */
-#define	PFSYNC_ACT_DEL		6	/* delete state */
-#define	PFSYNC_ACT_DEL_C	7	/* "compressed" delete state */
-#define	PFSYNC_ACT_INS_F	8	/* insert fragment */
-#define	PFSYNC_ACT_DEL_F	9	/* delete fragments */
-#define	PFSYNC_ACT_BUS		10	/* bulk update status */
-#define	PFSYNC_ACT_TDB		11	/* TDB replay counter update */
-#define	PFSYNC_ACT_EOF		12	/* end of frame */
-#define	PFSYNC_ACT_MAX		13
-
-#define	PFSYNC_ACTIONS		"CLR ST",		\
-				"INS ST",		\
-				"INS ST ACK",		\
-				"UPD ST",		\
-				"UPD ST COMP",		\
-				"UPD ST REQ",		\
-				"DEL ST",		\
-				"DEL ST COMP",		\
-				"INS FR",		\
-				"DEL FR",		\
-				"BULK UPD STAT",	\
-				"TDB UPD",		\
-				"EOF"
-
-#define	PFSYNC_HMAC_LEN	20
-
-/*
- * A pfsync frame is built from a header followed by several sections which
- * are all prefixed with their own subheaders. Frames must be terminated with
- * an EOF subheader.
- *
- * | ...			|
- * | IP header			|
- * +============================+
- * | pfsync_header		|
- * +----------------------------+
- * | pfsync_subheader		|
- * +----------------------------+
- * | first action fields	|
- * | ...			|
- * +----------------------------+
- * | pfsync_subheader		|
- * +----------------------------+
- * | second action fields	|
- * | ...			|
- * +----------------------------+
- * | EOF pfsync_subheader	|
- * +----------------------------+
- * | HMAC			|
- * +============================+
- */
-
-/*
- * Frame header
- */
-
-struct pfsync_header {
-	u_int8_t			version;
-	u_int8_t			_pad;
-	u_int16_t			len;
-	u_int8_t			pfcksum[PF_MD5_DIGEST_LENGTH];
-} __packed;
-
-/*
- * Frame region subheader
- */
-
-struct pfsync_subheader {
-	u_int8_t			action;
-	u_int8_t			_pad;
-	u_int16_t			count;
-} __packed;
-
-/*
- * CLR
- */
-
-struct pfsync_clr {
-	char				ifname[IFNAMSIZ];
-	u_int32_t			creatorid;
-} __packed;
-
-/*
- * INS, UPD, DEL
- */
-
-/* these use struct pfsync_state in pfvar.h */
-
-/*
- * INS_ACK
- */
-
-struct pfsync_ins_ack {
-	u_int64_t			id;
-	u_int32_t			creatorid;
-} __packed;
-
-/*
- * UPD_C
- */
-
-struct pfsync_upd_c {
-	u_int64_t			id;
-	struct pfsync_state_peer	src;
-	struct pfsync_state_peer	dst;
-	u_int32_t			creatorid;
-	u_int32_t			expire;
-	u_int8_t			timeout;
-	u_int8_t			_pad[3];
-} __packed;
-
-/*
- * UPD_REQ
- */
-
-struct pfsync_upd_req {
-	u_int64_t			id;
-	u_int32_t			creatorid;
-} __packed;
-
-/*
- * DEL_C
- */
-
-struct pfsync_del_c {
-	u_int64_t			id;
-	u_int32_t			creatorid;
-} __packed;
-
-/* 
- * INS_F, DEL_F
- */
-
-/* not implemented (yet) */
-
-/*
- * BUS
- */
-
-struct pfsync_bus {
-	u_int32_t			creatorid;
-	u_int32_t			endtime;
-	u_int8_t			status;
-#define	PFSYNC_BUS_START			1
-#define	PFSYNC_BUS_END				2
-	u_int8_t			_pad[3];
-} __packed;
-
-/*
- * TDB
- */
-
-struct pfsync_tdb {
-	u_int32_t			spi;
-	union sockaddr_union		dst;
-	u_int32_t			rpl;
-	u_int64_t			cur_bytes;
-	u_int8_t			sproto;
-	u_int8_t			updates;
-	u_int8_t			_pad[2];
-} __packed;
-
-/*
- * EOF
- */
-
-struct pfsync_eof {
-	u_int8_t			hmac[PFSYNC_HMAC_LEN];
-} __packed;
-
-#define	PFSYNC_HDRLEN		sizeof(struct pfsync_header)
-
-
-
-/*
- * Names for PFSYNC sysctl objects
- */
-#define	PFSYNCCTL_STATS		1	/* PFSYNC stats */
-#define	PFSYNCCTL_MAXID		2
-
-#define	PFSYNCCTL_NAMES { \
-	{ 0, 0 }, \
-	{ "stats", CTLTYPE_STRUCT }, \
-}
-
-struct pfsyncstats {
-	u_int64_t	pfsyncs_ipackets;	/* total input packets, IPv4 */
-	u_int64_t	pfsyncs_ipackets6;	/* total input packets, IPv6 */
-	u_int64_t	pfsyncs_badif;		/* not the right interface */
-	u_int64_t	pfsyncs_badttl;		/* TTL is not PFSYNC_DFLTTL */
-	u_int64_t	pfsyncs_hdrops;		/* packets shorter than hdr */
-	u_int64_t	pfsyncs_badver;		/* bad (incl unsupp) version */
-	u_int64_t	pfsyncs_badact;		/* bad action */
-	u_int64_t	pfsyncs_badlen;		/* data length does not match */
-	u_int64_t	pfsyncs_badauth;	/* bad authentication */
-	u_int64_t	pfsyncs_stale;		/* stale state */
-	u_int64_t	pfsyncs_badval;		/* bad values */
-	u_int64_t	pfsyncs_badstate;	/* insert/lookup failed */
-
-	u_int64_t	pfsyncs_opackets;	/* total output packets, IPv4 */
-	u_int64_t	pfsyncs_opackets6;	/* total output packets, IPv6 */
-	u_int64_t	pfsyncs_onomem;		/* no memory for an mbuf */
-	u_int64_t	pfsyncs_oerrors;	/* ip output error */
-};
-
-/*
- * Configuration structure for SIOCSETPFSYNC SIOCGETPFSYNC
- */
-struct pfsyncreq {
-	char		 pfsyncr_syncdev[IFNAMSIZ];
-	struct in_addr	 pfsyncr_syncpeer;
-	int		 pfsyncr_maxupdates;
-	int		 pfsyncr_defer;
-};
-
-#ifdef __FreeBSD__
-#define	SIOCSETPFSYNC   _IOW('i', 247, struct ifreq)
-#define	SIOCGETPFSYNC   _IOWR('i', 248, struct ifreq)
-#endif
-
-#ifdef _KERNEL
-
-/*
- * this shows where a pf state is with respect to the syncing.
- */
-#define	PFSYNC_S_INS	0x00
-#define	PFSYNC_S_IACK	0x01
-#define	PFSYNC_S_UPD	0x02
-#define	PFSYNC_S_UPD_C	0x03
-#define	PFSYNC_S_DEL	0x04
-#define	PFSYNC_S_COUNT	0x05
-
-#define	PFSYNC_S_DEFER	0xfe
-#define	PFSYNC_S_NONE	0xff
-
-#ifdef __FreeBSD__
-void			pfsync_input(struct mbuf *, __unused int);
-#else
-void			pfsync_input(struct mbuf *, ...);
-#endif
-int			pfsync_sysctl(int *, u_int,  void *, size_t *,
-			    void *, size_t);
-
-#define	PFSYNC_SI_IOCTL		0x01
-#define	PFSYNC_SI_CKSUM		0x02
-#define	PFSYNC_SI_ACK		0x04
-int			pfsync_state_import(struct pfsync_state *, u_int8_t);
-#ifndef __FreeBSD__
-void			pfsync_state_export(struct pfsync_state *,
-			    struct pf_state *);
-#endif
-
-void			pfsync_insert_state(struct pf_state *);
-void			pfsync_update_state(struct pf_state *);
-void			pfsync_delete_state(struct pf_state *);
-void			pfsync_clear_states(u_int32_t, const char *);
-
-#ifdef notyet
-void			pfsync_update_tdb(struct tdb *, int);
-void			pfsync_delete_tdb(struct tdb *);
-#endif
-
-int			pfsync_defer(struct pf_state *, struct mbuf *);
-
-int			pfsync_up(void);
-int			pfsync_state_in_use(struct pf_state *);
-#endif
-
-#endif /* _NET_IF_PFSYNC_H_ */
diff --git a/sys/contrib/pf/net/pf.c b/sys/contrib/pf/net/pf.c
deleted file mode 100644
index ac5128262697..000000000000
--- a/sys/contrib/pf/net/pf.c
+++ /dev/null
@@ -1,7620 +0,0 @@
-/*	$OpenBSD: pf.c,v 1.634 2009/02/27 12:37:45 henning Exp $ */
-
-/*
- * Copyright (c) 2001 Daniel Hartmeier
- * Copyright (c) 2002 - 2008 Henning Brauer
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *    - Redistributions of source code must retain the above copyright
- *      notice, this list of conditions and the following disclaimer.
- *    - Redistributions in binary form must reproduce the above
- *      copyright notice, this list of conditions and the following
- *      disclaimer in the documentation and/or other materials provided
- *      with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
- * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
- * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
- * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
- * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
- * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- *
- * Effort sponsored in part by the Defense Advanced Research Projects
- * Agency (DARPA) and Air Force Research Laboratory, Air Force
- * Materiel Command, USAF, under agreement number F30602-01-2-0537.
- *
- */
-
-#ifdef __FreeBSD__
-#include "opt_inet.h"
-#include "opt_inet6.h"
-
-#include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
-#endif
-
-#ifdef __FreeBSD__
-#include "opt_bpf.h"
-#include "opt_pf.h"
-
-#define	NPFSYNC		1
-
-#ifdef DEV_PFLOW
-#define	NPFLOW		DEV_PFLOW
-#else
-#define	NPFLOW		0
-#endif
-
-#else
-#include "bpfilter.h"
-#include "pflog.h"
-#include "pfsync.h"
-#include "pflow.h"
-#endif
-
-#include <sys/param.h>
-#include <sys/systm.h>
-#include <sys/mbuf.h>
-#include <sys/filio.h>
-#include <sys/socket.h>
-#include <sys/socketvar.h>
-#include <sys/kernel.h>
-#include <sys/time.h>
-#ifdef __FreeBSD__
-#include <sys/random.h>
-#include <sys/sysctl.h>
-#include <sys/endian.h>
-#define	betoh64		be64toh
-#else
-#include <sys/pool.h>
-#endif
-#include <sys/proc.h>
-#ifdef __FreeBSD__
-#include <sys/kthread.h>
-#include <sys/lock.h>
-#include <sys/sx.h>
-#else
-#include <sys/rwlock.h>
-#endif
-
-#ifdef __FreeBSD__
-#include <sys/md5.h>
-#else
-#include <crypto/md5.h>
-#endif
-
-#include <net/if.h>
-#include <net/if_types.h>
-#include <net/bpf.h>
-#include <net/route.h>
-#ifdef __FreeBSD__
-#ifdef RADIX_MPATH
-#include <net/radix_mpath.h>
-#endif
-#else
-#include <net/radix_mpath.h>
-#endif
-
-#include <netinet/in.h>
-#include <netinet/in_var.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#include <netinet/ip_var.h>
-#include <netinet/tcp.h>
-#include <netinet/tcp_seq.h>
-#include <netinet/udp.h>
-#include <netinet/ip_icmp.h>
-#include <netinet/in_pcb.h>
-#include <netinet/tcp_timer.h>
-#include <netinet/tcp_var.h>
-#include <netinet/udp_var.h>
-#include <netinet/icmp_var.h>
-#include <netinet/if_ether.h>
-#ifdef __FreeBSD__
-#include <netinet/ip_fw.h>
-#include <netinet/ipfw/ip_fw_private.h> /* XXX: only for DIR_IN/DIR_OUT */
-#endif
-
-#ifndef __FreeBSD__
-#include <dev/rndvar.h>
-#endif
-#include <net/pfvar.h>
-#include <net/if_pflog.h>
-#include <net/if_pflow.h>
-#include <net/if_pfsync.h>
-
-#ifdef INET6
-#include <netinet/ip6.h>
-#include <netinet/in_pcb.h>
-#include <netinet/icmp6.h>
-#include <netinet6/nd6.h>
-#ifdef __FreeBSD__
-#include <netinet6/ip6_var.h>
-#include <netinet6/in6_pcb.h>
-#endif
-#endif /* INET6 */
-
-#ifdef __FreeBSD__
-#include <machine/in_cksum.h>
-#include <sys/limits.h>
-#include <sys/ucred.h>
-#include <security/mac/mac_framework.h>
-
-extern int ip_optcopy(struct ip *, struct ip *);
-#endif
-
-#ifdef __FreeBSD__
-#define	DPFPRINTF(n, x)	if (V_pf_status.debug >= (n)) printf x
-#else
-#define	DPFPRINTF(n, x)	if (pf_status.debug >= (n)) printf x
-#endif
-
-/*
- * Global variables
- */
-
-/* state tables */
-#ifdef __FreeBSD__
-VNET_DEFINE(struct pf_state_tree,	 pf_statetbl);
-
-VNET_DEFINE(struct pf_altqqueue,	 pf_altqs[2]);
-VNET_DEFINE(struct pf_palist,		 pf_pabuf);
-VNET_DEFINE(struct pf_altqqueue *,	 pf_altqs_active);
-VNET_DEFINE(struct pf_altqqueue *,	 pf_altqs_inactive);
-VNET_DEFINE(struct pf_status,		 pf_status);
-
-VNET_DEFINE(u_int32_t,			 ticket_altqs_active);
-VNET_DEFINE(u_int32_t,			 ticket_altqs_inactive);
-VNET_DEFINE(int,			 altqs_inactive_open);
-VNET_DEFINE(u_int32_t,			 ticket_pabuf);
-
-VNET_DEFINE(MD5_CTX,			 pf_tcp_secret_ctx);
-#define	V_pf_tcp_secret_ctx		 VNET(pf_tcp_secret_ctx)
-VNET_DEFINE(u_char,			 pf_tcp_secret[16]);
-#define	V_pf_tcp_secret			 VNET(pf_tcp_secret)
-VNET_DEFINE(int,			 pf_tcp_secret_init);
-#define	V_pf_tcp_secret_init		 VNET(pf_tcp_secret_init)
-VNET_DEFINE(int,			 pf_tcp_iss_off);
-#define	V_pf_tcp_iss_off		 VNET(pf_tcp_iss_off)
-
-struct pf_anchor_stackframe {
-	struct pf_ruleset		*rs;
-	struct pf_rule			*r;
-	struct pf_anchor_node		*parent;
-	struct pf_anchor		*child;
-};
-VNET_DEFINE(struct pf_anchor_stackframe, pf_anchor_stack[64]);
-#define	V_pf_anchor_stack		 VNET(pf_anchor_stack)
-
-VNET_DEFINE(uma_zone_t,	 pf_src_tree_pl);
-VNET_DEFINE(uma_zone_t,	 pf_rule_pl);
-VNET_DEFINE(uma_zone_t,	 pf_pooladdr_pl);
-VNET_DEFINE(uma_zone_t,	 pf_state_pl);
-VNET_DEFINE(uma_zone_t,	 pf_state_key_pl);
-VNET_DEFINE(uma_zone_t,	 pf_state_item_pl);
-VNET_DEFINE(uma_zone_t,	 pf_altq_pl);
-#else
-struct pf_state_tree	 pf_statetbl;
-
-struct pf_altqqueue	 pf_altqs[2];
-struct pf_palist	 pf_pabuf;
-struct pf_altqqueue	*pf_altqs_active;
-struct pf_altqqueue	*pf_altqs_inactive;
-struct pf_status	 pf_status;
-
-u_int32_t		 ticket_altqs_active;
-u_int32_t		 ticket_altqs_inactive;
-int			 altqs_inactive_open;
-u_int32_t		 ticket_pabuf;
-
-MD5_CTX			 pf_tcp_secret_ctx;
-u_char			 pf_tcp_secret[16];
-int			 pf_tcp_secret_init;
-int			 pf_tcp_iss_off;
-
-struct pf_anchor_stackframe {
-	struct pf_ruleset			*rs;
-	struct pf_rule				*r;
-	struct pf_anchor_node			*parent;
-	struct pf_anchor			*child;
-} pf_anchor_stack[64];
-
-struct pool		 pf_src_tree_pl, pf_rule_pl, pf_pooladdr_pl;
-struct pool		 pf_state_pl, pf_state_key_pl, pf_state_item_pl;
-struct pool		 pf_altq_pl;
-#endif
-
-void			 pf_init_threshold(struct pf_threshold *, u_int32_t,
-			    u_int32_t);
-void			 pf_add_threshold(struct pf_threshold *);
-int			 pf_check_threshold(struct pf_threshold *);
-
-void			 pf_change_ap(struct pf_addr *, u_int16_t *,
-			    u_int16_t *, u_int16_t *, struct pf_addr *,
-			    u_int16_t, u_int8_t, sa_family_t);
-int			 pf_modulate_sack(struct mbuf *, int, struct pf_pdesc *,
-			    struct tcphdr *, struct pf_state_peer *);
-#ifdef INET6
-void			 pf_change_a6(struct pf_addr *, u_int16_t *,
-			    struct pf_addr *, u_int8_t);
-#endif /* INET6 */
-void			 pf_change_icmp(struct pf_addr *, u_int16_t *,
-			    struct pf_addr *, struct pf_addr *, u_int16_t,
-			    u_int16_t *, u_int16_t *, u_int16_t *,
-			    u_int16_t *, u_int8_t, sa_family_t);
-#ifdef __FreeBSD__
-void			 pf_send_tcp(struct mbuf *,
-			    const struct pf_rule *, sa_family_t,
-#else
-void			 pf_send_tcp(const struct pf_rule *, sa_family_t,
-#endif
-			    const struct pf_addr *, const struct pf_addr *,
-			    u_int16_t, u_int16_t, u_int32_t, u_int32_t,
-			    u_int8_t, u_int16_t, u_int16_t, u_int8_t, int,
-			    u_int16_t, struct ether_header *, struct ifnet *);
-static void		 pf_send_icmp(struct mbuf *, u_int8_t, u_int8_t,
-			    sa_family_t, struct pf_rule *);
-void			 pf_detach_state(struct pf_state *);
-void			 pf_state_key_detach(struct pf_state *, int);
-u_int32_t		 pf_tcp_iss(struct pf_pdesc *);
-int			 pf_test_rule(struct pf_rule **, struct pf_state **,
-			    int, struct pfi_kif *, struct mbuf *, int,
-			    void *, struct pf_pdesc *, struct pf_rule **,
-#ifdef __FreeBSD__
-			    struct pf_ruleset **, struct ifqueue *,
-			    struct inpcb *);
-#else
-			    struct pf_ruleset **, struct ifqueue *);
-#endif
-static __inline int	 pf_create_state(struct pf_rule *, struct pf_rule *,
-			    struct pf_rule *, struct pf_pdesc *,
-			    struct pf_src_node *, struct pf_state_key *,
-			    struct pf_state_key *, struct pf_state_key *,
-			    struct pf_state_key *, struct mbuf *, int,
-			    u_int16_t, u_int16_t, int *, struct pfi_kif *,
-			    struct pf_state **, int, u_int16_t, u_int16_t,
-			    int);
-int			 pf_test_fragment(struct pf_rule **, int,
-			    struct pfi_kif *, struct mbuf *, void *,
-			    struct pf_pdesc *, struct pf_rule **,
-			    struct pf_ruleset **);
-int			 pf_tcp_track_full(struct pf_state_peer *,
-			    struct pf_state_peer *, struct pf_state **,
-			    struct pfi_kif *, struct mbuf *, int,
-			    struct pf_pdesc *, u_short *, int *);
-int			pf_tcp_track_sloppy(struct pf_state_peer *,
-			    struct pf_state_peer *, struct pf_state **,
-			    struct pf_pdesc *, u_short *);
-int			 pf_test_state_tcp(struct pf_state **, int,
-			    struct pfi_kif *, struct mbuf *, int,
-			    void *, struct pf_pdesc *, u_short *);
-int			 pf_test_state_udp(struct pf_state **, int,
-			    struct pfi_kif *, struct mbuf *, int,
-			    void *, struct pf_pdesc *);
-int			 pf_test_state_icmp(struct pf_state **, int,
-			    struct pfi_kif *, struct mbuf *, int,
-			    void *, struct pf_pdesc *, u_short *);
-int			 pf_test_state_other(struct pf_state **, int,
-			    struct pfi_kif *, struct mbuf *, struct pf_pdesc *);
-void			 pf_route(struct mbuf **, struct pf_rule *, int,
-			    struct ifnet *, struct pf_state *,
-			    struct pf_pdesc *);
-void			 pf_route6(struct mbuf **, struct pf_rule *, int,
-			    struct ifnet *, struct pf_state *,
-			    struct pf_pdesc *);
-#ifndef __FreeBSD__
-int			 pf_socket_lookup(int, struct pf_pdesc *);
-#endif
-u_int8_t		 pf_get_wscale(struct mbuf *, int, u_int16_t,
-			    sa_family_t);
-u_int16_t		 pf_get_mss(struct mbuf *, int, u_int16_t,
-			    sa_family_t);
-u_int16_t		 pf_calc_mss(struct pf_addr *, sa_family_t,
-				int, u_int16_t);
-void			 pf_set_rt_ifp(struct pf_state *,
-			    struct pf_addr *);
-int			 pf_check_proto_cksum(struct mbuf *, int, int,
-			    u_int8_t, sa_family_t);
-#ifndef __FreeBSD__
-struct pf_divert	*pf_get_divert(struct mbuf *);
-#endif
-void			 pf_print_state_parts(struct pf_state *,
-			    struct pf_state_key *, struct pf_state_key *);
-int			 pf_addr_wrap_neq(struct pf_addr_wrap *,
-			    struct pf_addr_wrap *);
-int			 pf_compare_state_keys(struct pf_state_key *,
-			    struct pf_state_key *, struct pfi_kif *, u_int);
-#ifdef __FreeBSD__
-struct pf_state		*pf_find_state(struct pfi_kif *,
-			    struct pf_state_key_cmp *, u_int, struct mbuf *,
-			    struct pf_mtag *);
-#else
-struct pf_state		*pf_find_state(struct pfi_kif *,
-			    struct pf_state_key_cmp *, u_int, struct mbuf *);
-#endif
-int			 pf_src_connlimit(struct pf_state **);
-int			 pf_check_congestion(struct ifqueue *);
-
-#ifdef __FreeBSD__
-int in4_cksum(struct mbuf *m, u_int8_t nxt, int off, int len);
-
-VNET_DECLARE(int, pf_end_threads);
-
-VNET_DEFINE(struct pf_pool_limit, pf_pool_limits[PF_LIMIT_MAX]);
-#else
-extern struct pool pfr_ktable_pl;
-extern struct pool pfr_kentry_pl;
-
-struct pf_pool_limit pf_pool_limits[PF_LIMIT_MAX] = {
-	{ &pf_state_pl, PFSTATE_HIWAT },
-	{ &pf_src_tree_pl, PFSNODE_HIWAT },
-	{ &pf_frent_pl, PFFRAG_FRENT_HIWAT },
-	{ &pfr_ktable_pl, PFR_KTABLE_HIWAT },
-	{ &pfr_kentry_pl, PFR_KENTRY_HIWAT }
-};
-#endif
-
-#ifdef __FreeBSD__
-#define	PPACKET_LOOPED()						\
-	(pd->pf_mtag->flags & PF_PACKET_LOOPED)
-
-#define	PACKET_LOOPED()							\
-	(pd.pf_mtag->flags & PF_PACKET_LOOPED)
-
-#define	STATE_LOOKUP(i, k, d, s, m, pt)					\
-	do {								\
-		s = pf_find_state(i, k, d, m, pt);			\
-		if (s == NULL || (s)->timeout == PFTM_PURGE)		\
-			return (PF_DROP);				\
-		if (PPACKET_LOOPED())					\
-			return (PF_PASS);				\
-		if (d == PF_OUT &&					\
-		    (((s)->rule.ptr->rt == PF_ROUTETO &&		\
-		    (s)->rule.ptr->direction == PF_OUT) ||		\
-		    ((s)->rule.ptr->rt == PF_REPLYTO &&			\
-		    (s)->rule.ptr->direction == PF_IN)) &&		\
-		    (s)->rt_kif != NULL &&				\
-		    (s)->rt_kif != i)					\
-			return (PF_PASS);				\
-	} while (0)
-#else
-#define	STATE_LOOKUP(i, k, d, s, m)					\
-	do {								\
-		s = pf_find_state(i, k, d, m);				\
-		if (s == NULL || (s)->timeout == PFTM_PURGE)		\
-			return (PF_DROP);				\
-		if (d == PF_OUT &&					\
-		    (((s)->rule.ptr->rt == PF_ROUTETO &&		\
-		    (s)->rule.ptr->direction == PF_OUT) ||		\
-		    ((s)->rule.ptr->rt == PF_REPLYTO &&			\
-		    (s)->rule.ptr->direction == PF_IN)) &&		\
-		    (s)->rt_kif != NULL &&				\
-		    (s)->rt_kif != i)					\
-			return (PF_PASS);				\
-	} while (0)
-#endif
-
-#ifdef __FreeBSD__
-#define	BOUND_IFACE(r, k) \
-	((r)->rule_flag & PFRULE_IFBOUND) ? (k) : V_pfi_all
-#else
-#define	BOUND_IFACE(r, k) \
-	((r)->rule_flag & PFRULE_IFBOUND) ? (k) : pfi_all
-#endif
-
-#define	STATE_INC_COUNTERS(s)				\
-	do {						\
-		s->rule.ptr->states_cur++;		\
-		s->rule.ptr->states_tot++;		\
-		if (s->anchor.ptr != NULL) {		\
-			s->anchor.ptr->states_cur++;	\
-			s->anchor.ptr->states_tot++;	\
-		}					\
-		if (s->nat_rule.ptr != NULL) {		\
-			s->nat_rule.ptr->states_cur++;	\
-			s->nat_rule.ptr->states_tot++;	\
-		}					\
-	} while (0)
-
-#define	STATE_DEC_COUNTERS(s)				\
-	do {						\
-		if (s->nat_rule.ptr != NULL)		\
-			s->nat_rule.ptr->states_cur--;	\
-		if (s->anchor.ptr != NULL)		\
-			s->anchor.ptr->states_cur--;	\
-		s->rule.ptr->states_cur--;		\
-	} while (0)
-
-static __inline int pf_src_compare(struct pf_src_node *, struct pf_src_node *);
-static __inline int pf_state_compare_key(struct pf_state_key *,
-	struct pf_state_key *);
-static __inline int pf_state_compare_id(struct pf_state *,
-	struct pf_state *);
-
-#ifdef __FreeBSD__
-VNET_DEFINE(struct pf_src_tree,	 	 tree_src_tracking);
-
-VNET_DEFINE(struct pf_state_tree_id,	 tree_id);
-VNET_DEFINE(struct pf_state_queue,	 state_list);
-#else
-struct pf_src_tree tree_src_tracking;
-
-struct pf_state_tree_id tree_id;
-struct pf_state_queue state_list;
-#endif
-
-RB_GENERATE(pf_src_tree, pf_src_node, entry, pf_src_compare);
-RB_GENERATE(pf_state_tree, pf_state_key, entry, pf_state_compare_key);
-RB_GENERATE(pf_state_tree_id, pf_state,
-    entry_id, pf_state_compare_id);
-
-static __inline int
-pf_src_compare(struct pf_src_node *a, struct pf_src_node *b)
-{
-	int	diff;
-
-	if (a->rule.ptr > b->rule.ptr)
-		return (1);
-	if (a->rule.ptr < b->rule.ptr)
-		return (-1);
-	if ((diff = a->af - b->af) != 0)
-		return (diff);
-	switch (a->af) {
-#ifdef INET
-	case AF_INET:
-		if (a->addr.addr32[0] > b->addr.addr32[0])
-			return (1);
-		if (a->addr.addr32[0] < b->addr.addr32[0])
-			return (-1);
-		break;
-#endif /* INET */
-#ifdef INET6
-	case AF_INET6:
-		if (a->addr.addr32[3] > b->addr.addr32[3])
-			return (1);
-		if (a->addr.addr32[3] < b->addr.addr32[3])
-			return (-1);
-		if (a->addr.addr32[2] > b->addr.addr32[2])
-			return (1);
-		if (a->addr.addr32[2] < b->addr.addr32[2])
-			return (-1);
-		if (a->addr.addr32[1] > b->addr.addr32[1])
-			return (1);
-		if (a->addr.addr32[1] < b->addr.addr32[1])
-			return (-1);
-		if (a->addr.addr32[0] > b->addr.addr32[0])
-			return (1);
-		if (a->addr.addr32[0] < b->addr.addr32[0])
-			return (-1);
-		break;
-#endif /* INET6 */
-	}
-	return (0);
-}
-
-#ifdef INET6
-void
-pf_addrcpy(struct pf_addr *dst, struct pf_addr *src, sa_family_t af)
-{
-	switch (af) {
-#ifdef INET
-	case AF_INET:
-		dst->addr32[0] = src->addr32[0];
-		break;
-#endif /* INET */
-	case AF_INET6:
-		dst->addr32[0] = src->addr32[0];
-		dst->addr32[1] = src->addr32[1];
-		dst->addr32[2] = src->addr32[2];
-		dst->addr32[3] = src->addr32[3];
-		break;
-	}
-}
-#endif /* INET6 */
-
-void
-pf_init_threshold(struct pf_threshold *threshold,
-    u_int32_t limit, u_int32_t seconds)
-{
-	threshold->limit = limit * PF_THRESHOLD_MULT;
-	threshold->seconds = seconds;
-	threshold->count = 0;
-	threshold->last = time_second;
-}
-
-void
-pf_add_threshold(struct pf_threshold *threshold)
-{
-	u_int32_t t = time_second, diff = t - threshold->last;
-
-	if (diff >= threshold->seconds)
-		threshold->count = 0;
-	else
-		threshold->count -= threshold->count * diff /
-		    threshold->seconds;
-	threshold->count += PF_THRESHOLD_MULT;
-	threshold->last = t;
-}
-
-int
-pf_check_threshold(struct pf_threshold *threshold)
-{
-	return (threshold->count > threshold->limit);
-}
-
-int
-pf_src_connlimit(struct pf_state **state)
-{
-	int bad = 0;
-
-	(*state)->src_node->conn++;
-	(*state)->src.tcp_est = 1;
-	pf_add_threshold(&(*state)->src_node->conn_rate);
-
-	if ((*state)->rule.ptr->max_src_conn &&
-	    (*state)->rule.ptr->max_src_conn <
-	    (*state)->src_node->conn) {
-#ifdef __FreeBSD__
-		V_pf_status.lcounters[LCNT_SRCCONN]++;
-#else
-		pf_status.lcounters[LCNT_SRCCONN]++;
-#endif
-		bad++;
-	}
-
-	if ((*state)->rule.ptr->max_src_conn_rate.limit &&
-	    pf_check_threshold(&(*state)->src_node->conn_rate)) {
-#ifdef __FreeBSD__
-		V_pf_status.lcounters[LCNT_SRCCONNRATE]++;
-#else
-		pf_status.lcounters[LCNT_SRCCONNRATE]++;
-#endif
-		bad++;
-	}
-
-	if (!bad)
-		return (0);
-
-	if ((*state)->rule.ptr->overload_tbl) {
-		struct pfr_addr p;
-		u_int32_t	killed = 0;
-
-#ifdef __FreeBSD__
-		V_pf_status.lcounters[LCNT_OVERLOAD_TABLE]++;
-		if (V_pf_status.debug >= PF_DEBUG_MISC) {
-#else
-		pf_status.lcounters[LCNT_OVERLOAD_TABLE]++;
-		if (pf_status.debug >= PF_DEBUG_MISC) {
-#endif
-			printf("pf_src_connlimit: blocking address ");
-			pf_print_host(&(*state)->src_node->addr, 0,
-			    (*state)->key[PF_SK_WIRE]->af);
-		}
-
-		bzero(&p, sizeof(p));
-		p.pfra_af = (*state)->key[PF_SK_WIRE]->af;
-		switch ((*state)->key[PF_SK_WIRE]->af) {
-#ifdef INET
-		case AF_INET:
-			p.pfra_net = 32;
-			p.pfra_ip4addr = (*state)->src_node->addr.v4;
-			break;
-#endif /* INET */
-#ifdef INET6
-		case AF_INET6:
-			p.pfra_net = 128;
-			p.pfra_ip6addr = (*state)->src_node->addr.v6;
-			break;
-#endif /* INET6 */
-		}
-
-		pfr_insert_kentry((*state)->rule.ptr->overload_tbl,
-		    &p, time_second);
-
-		/* kill existing states if that's required. */
-		if ((*state)->rule.ptr->flush) {
-			struct pf_state_key *sk;
-			struct pf_state *st;
-
-#ifdef __FreeBSD__
-			V_pf_status.lcounters[LCNT_OVERLOAD_FLUSH]++;
-			RB_FOREACH(st, pf_state_tree_id, &V_tree_id) {
-#else
-			pf_status.lcounters[LCNT_OVERLOAD_FLUSH]++;
-			RB_FOREACH(st, pf_state_tree_id, &tree_id) {
-#endif
-				sk = st->key[PF_SK_WIRE];
-				/*
-				 * Kill states from this source.  (Only those
-				 * from the same rule if PF_FLUSH_GLOBAL is not
-				 * set)
-				 */
-				if (sk->af ==
-				    (*state)->key[PF_SK_WIRE]->af &&
-				    (((*state)->direction == PF_OUT &&
-				    PF_AEQ(&(*state)->src_node->addr,
-					&sk->addr[1], sk->af)) ||
-				    ((*state)->direction == PF_IN &&
-				    PF_AEQ(&(*state)->src_node->addr,
-					&sk->addr[0], sk->af))) &&
-				    ((*state)->rule.ptr->flush &
-				    PF_FLUSH_GLOBAL ||
-				    (*state)->rule.ptr == st->rule.ptr)) {
-					st->timeout = PFTM_PURGE;
-					st->src.state = st->dst.state =
-					    TCPS_CLOSED;
-					killed++;
-				}
-			}
-#ifdef __FreeBSD__
-			if (V_pf_status.debug >= PF_DEBUG_MISC)
-#else
-			if (pf_status.debug >= PF_DEBUG_MISC)
-#endif
-				printf(", %u states killed", killed);
-		}
-#ifdef __FreeBSD__
-		if (V_pf_status.debug >= PF_DEBUG_MISC)
-#else
-		if (pf_status.debug >= PF_DEBUG_MISC)
-#endif
-			printf("\n");
-	}
-
-	/* kill this state */
-	(*state)->timeout = PFTM_PURGE;
-	(*state)->src.state = (*state)->dst.state = TCPS_CLOSED;
-	return (1);
-}
-
-int
-pf_insert_src_node(struct pf_src_node **sn, struct pf_rule *rule,
-    struct pf_addr *src, sa_family_t af)
-{
-	struct pf_src_node	k;
-
-	if (*sn == NULL) {
-		k.af = af;
-		PF_ACPY(&k.addr, src, af);
-		if (rule->rule_flag & PFRULE_RULESRCTRACK ||
-		    rule->rpool.opts & PF_POOL_STICKYADDR)
-			k.rule.ptr = rule;
-		else
-			k.rule.ptr = NULL;
-#ifdef __FreeBSD__
-		V_pf_status.scounters[SCNT_SRC_NODE_SEARCH]++;
-		*sn = RB_FIND(pf_src_tree, &V_tree_src_tracking, &k);
-#else
-		pf_status.scounters[SCNT_SRC_NODE_SEARCH]++;
-		*sn = RB_FIND(pf_src_tree, &tree_src_tracking, &k);
-#endif
-	}
-	if (*sn == NULL) {
-		if (!rule->max_src_nodes ||
-		    rule->src_nodes < rule->max_src_nodes)
-#ifdef __FreeBSD__
-			(*sn) = pool_get(&V_pf_src_tree_pl, PR_NOWAIT | PR_ZERO);
-#else
-			(*sn) = pool_get(&pf_src_tree_pl, PR_NOWAIT | PR_ZERO);
-#endif
-		else
-#ifdef __FreeBSD__
-			V_pf_status.lcounters[LCNT_SRCNODES]++;
-#else
-			pf_status.lcounters[LCNT_SRCNODES]++;
-#endif
-		if ((*sn) == NULL)
-			return (-1);
-
-		pf_init_threshold(&(*sn)->conn_rate,
-		    rule->max_src_conn_rate.limit,
-		    rule->max_src_conn_rate.seconds);
-
-		(*sn)->af = af;
-		if (rule->rule_flag & PFRULE_RULESRCTRACK ||
-		    rule->rpool.opts & PF_POOL_STICKYADDR)
-			(*sn)->rule.ptr = rule;
-		else
-			(*sn)->rule.ptr = NULL;
-		PF_ACPY(&(*sn)->addr, src, af);
-		if (RB_INSERT(pf_src_tree,
-#ifdef __FreeBSD__
-		    &V_tree_src_tracking, *sn) != NULL) {
-			if (V_pf_status.debug >= PF_DEBUG_MISC) {
-#else
-		    &tree_src_tracking, *sn) != NULL) {
-			if (pf_status.debug >= PF_DEBUG_MISC) {
-#endif
-				printf("pf: src_tree insert failed: ");
-				pf_print_host(&(*sn)->addr, 0, af);
-				printf("\n");
-			}
-#ifdef __FreeBSD__
-			pool_put(&V_pf_src_tree_pl, *sn);
-#else
-			pool_put(&pf_src_tree_pl, *sn);
-#endif
-			return (-1);
-		}
-		(*sn)->creation = time_second;
-		(*sn)->ruletype = rule->action;
-		if ((*sn)->rule.ptr != NULL)
-			(*sn)->rule.ptr->src_nodes++;
-#ifdef __FreeBSD__
-		V_pf_status.scounters[SCNT_SRC_NODE_INSERT]++;
-		V_pf_status.src_nodes++;
-#else
-		pf_status.scounters[SCNT_SRC_NODE_INSERT]++;
-		pf_status.src_nodes++;
-#endif
-	} else {
-		if (rule->max_src_states &&
-		    (*sn)->states >= rule->max_src_states) {
-#ifdef __FreeBSD__
-			V_pf_status.lcounters[LCNT_SRCSTATES]++;
-#else
-			pf_status.lcounters[LCNT_SRCSTATES]++;
-#endif
-			return (-1);
-		}
-	}
-	return (0);
-}
-
-/* state table stuff */
-
-static __inline int
-pf_state_compare_key(struct pf_state_key *a, struct pf_state_key *b)
-{
-	int	diff;
-
-	if ((diff = a->proto - b->proto) != 0)
-		return (diff);
-	if ((diff = a->af - b->af) != 0)
-		return (diff);
-	switch (a->af) {
-#ifdef INET
-	case AF_INET:
-		if (a->addr[0].addr32[0] > b->addr[0].addr32[0])
-			return (1);
-		if (a->addr[0].addr32[0] < b->addr[0].addr32[0])
-			return (-1);
-		if (a->addr[1].addr32[0] > b->addr[1].addr32[0])
-			return (1);
-		if (a->addr[1].addr32[0] < b->addr[1].addr32[0])
-			return (-1);
-		break;
-#endif /* INET */
-#ifdef INET6
-	case AF_INET6:
-		if (a->addr[0].addr32[3] > b->addr[0].addr32[3])
-			return (1);
-		if (a->addr[0].addr32[3] < b->addr[0].addr32[3])
-			return (-1);
-		if (a->addr[1].addr32[3] > b->addr[1].addr32[3])
-			return (1);
-		if (a->addr[1].addr32[3] < b->addr[1].addr32[3])
-			return (-1);
-		if (a->addr[0].addr32[2] > b->addr[0].addr32[2])
-			return (1);
-		if (a->addr[0].addr32[2] < b->addr[0].addr32[2])
-			return (-1);
-		if (a->addr[1].addr32[2] > b->addr[1].addr32[2])
-			return (1);
-		if (a->addr[1].addr32[2] < b->addr[1].addr32[2])
-			return (-1);
-		if (a->addr[0].addr32[1] > b->addr[0].addr32[1])
-			return (1);
-		if (a->addr[0].addr32[1] < b->addr[0].addr32[1])
-			return (-1);
-		if (a->addr[1].addr32[1] > b->addr[1].addr32[1])
-			return (1);
-		if (a->addr[1].addr32[1] < b->addr[1].addr32[1])
-			return (-1);
-		if (a->addr[0].addr32[0] > b->addr[0].addr32[0])
-			return (1);
-		if (a->addr[0].addr32[0] < b->addr[0].addr32[0])
-			return (-1);
-		if (a->addr[1].addr32[0] > b->addr[1].addr32[0])
-			return (1);
-		if (a->addr[1].addr32[0] < b->addr[1].addr32[0])
-			return (-1);
-		break;
-#endif /* INET6 */
-	}
-
-	if ((diff = a->port[0] - b->port[0]) != 0)
-		return (diff);
-	if ((diff = a->port[1] - b->port[1]) != 0)
-		return (diff);
-
-	return (0);
-}
-
-static __inline int
-pf_state_compare_id(struct pf_state *a, struct pf_state *b)
-{
-	if (a->id > b->id)
-		return (1);
-	if (a->id < b->id)
-		return (-1);
-	if (a->creatorid > b->creatorid)
-		return (1);
-	if (a->creatorid < b->creatorid)
-		return (-1);
-
-	return (0);
-}
-
-int
-pf_state_key_attach(struct pf_state_key *sk, struct pf_state *s, int idx)
-{
-	struct pf_state_item	*si;
-	struct pf_state_key	*cur;
-	struct pf_state		*olds = NULL;
-
-#ifdef __FreeBSD__
-	KASSERT(s->key[idx] == NULL, ("%s: key is null!", __FUNCTION__));
-#else
-	KASSERT(s->key[idx] == NULL);	/* XXX handle this? */
-#endif
-
-#ifdef __FreeBSD__
-	if ((cur = RB_INSERT(pf_state_tree, &V_pf_statetbl, sk)) != NULL) {
-#else
-	if ((cur = RB_INSERT(pf_state_tree, &pf_statetbl, sk)) != NULL) {
-#endif
-		/* key exists. check for same kif, if none, add to key */
-		TAILQ_FOREACH(si, &cur->states, entry)
-			if (si->s->kif == s->kif &&
-			    si->s->direction == s->direction) {
-				if (sk->proto == IPPROTO_TCP &&
-				    si->s->src.state >= TCPS_FIN_WAIT_2 &&
-				    si->s->dst.state >= TCPS_FIN_WAIT_2) {
-					si->s->src.state = si->s->dst.state =
-					    TCPS_CLOSED;
-					/* unlink late or sks can go away */
-					olds = si->s;
-				} else {
-#ifdef __FreeBSD__
-					if (V_pf_status.debug >= PF_DEBUG_MISC) {
-#else
-					if (pf_status.debug >= PF_DEBUG_MISC) {
-#endif
-						printf("pf: %s key attach "
-						    "failed on %s: ",
-						    (idx == PF_SK_WIRE) ?
-						    "wire" : "stack",
-						    s->kif->pfik_name);
-						pf_print_state_parts(s,
-						    (idx == PF_SK_WIRE) ?
-						    sk : NULL,
-						    (idx == PF_SK_STACK) ?
-						    sk : NULL);
-						printf(", existing: ");
-						pf_print_state_parts(si->s,
-						    (idx == PF_SK_WIRE) ?
-						    sk : NULL,
-						    (idx == PF_SK_STACK) ?
-						    sk : NULL);
-						printf("\n");
-					}
-#ifdef __FreeBSD__
-					pool_put(&V_pf_state_key_pl, sk);
-#else
-					pool_put(&pf_state_key_pl, sk);
-#endif
-					return (-1);	/* collision! */
-				}
-			}
-#ifdef __FreeBSD__
-		pool_put(&V_pf_state_key_pl, sk);
-#else
-		pool_put(&pf_state_key_pl, sk);
-#endif
-		s->key[idx] = cur;
-	} else
-		s->key[idx] = sk;
-
-#ifdef __FreeBSD__
-	if ((si = pool_get(&V_pf_state_item_pl, PR_NOWAIT)) == NULL) {
-#else
-	if ((si = pool_get(&pf_state_item_pl, PR_NOWAIT)) == NULL) {
-#endif
-		pf_state_key_detach(s, idx);
-		return (-1);
-	}
-	si->s = s;
-
-	/* list is sorted, if-bound states before floating */
-#ifdef __FreeBSD__
-	if (s->kif == V_pfi_all)
-#else
-	if (s->kif == pfi_all)
-#endif
-		TAILQ_INSERT_TAIL(&s->key[idx]->states, si, entry);
-	else
-		TAILQ_INSERT_HEAD(&s->key[idx]->states, si, entry);
-
-	if (olds)
-		pf_unlink_state(olds);
-
-	return (0);
-}
-
-void
-pf_detach_state(struct pf_state *s)
-{
-	if (s->key[PF_SK_WIRE] == s->key[PF_SK_STACK])
-		s->key[PF_SK_WIRE] = NULL;
-
-	if (s->key[PF_SK_STACK] != NULL)
-		pf_state_key_detach(s, PF_SK_STACK);
-
-	if (s->key[PF_SK_WIRE] != NULL)
-		pf_state_key_detach(s, PF_SK_WIRE);
-}
-
-void
-pf_state_key_detach(struct pf_state *s, int idx)
-{
-	struct pf_state_item	*si;
-
-	si = TAILQ_FIRST(&s->key[idx]->states);
-	while (si && si->s != s)
-	    si = TAILQ_NEXT(si, entry);
-
-	if (si) {
-		TAILQ_REMOVE(&s->key[idx]->states, si, entry);
-#ifdef __FreeBSD__
-		pool_put(&V_pf_state_item_pl, si);
-#else
-		pool_put(&pf_state_item_pl, si);
-#endif
-	}
-
-	if (TAILQ_EMPTY(&s->key[idx]->states)) {
-#ifdef __FreeBSD__
-		RB_REMOVE(pf_state_tree, &V_pf_statetbl, s->key[idx]);
-#else
-		RB_REMOVE(pf_state_tree, &pf_statetbl, s->key[idx]);
-#endif
-		if (s->key[idx]->reverse)
-			s->key[idx]->reverse->reverse = NULL;
-#ifdef __FreeBSD__
-	/* XXX: implement this */
-#else
-		if (s->key[idx]->inp)
-			s->key[idx]->inp->inp_pf_sk = NULL;
-#endif
-#ifdef __FreeBSD__
-		pool_put(&V_pf_state_key_pl, s->key[idx]);
-#else
-		pool_put(&pf_state_key_pl, s->key[idx]);
-#endif
-	}
-	s->key[idx] = NULL;
-}
-
-struct pf_state_key *
-pf_alloc_state_key(int pool_flags)
-{
-	struct pf_state_key	*sk;
-
-#ifdef __FreeBSD__
-	if ((sk = pool_get(&V_pf_state_key_pl, pool_flags)) == NULL)
-#else
-	if ((sk = pool_get(&pf_state_key_pl, pool_flags)) == NULL)
-#endif
-		return (NULL);
-	TAILQ_INIT(&sk->states);
-
-	return (sk);
-}
-
-int
-pf_state_key_setup(struct pf_pdesc *pd, struct pf_rule *nr,
-	struct pf_state_key **skw, struct pf_state_key **sks,
-	struct pf_state_key **skp, struct pf_state_key **nkp,
-	struct pf_addr *saddr, struct pf_addr *daddr,
-	u_int16_t sport, u_int16_t dport)
-{
-#ifdef __FreeBSD__
-	KASSERT((*skp == NULL && *nkp == NULL),
-		("%s: skp == NULL && nkp == NULL", __FUNCTION__));
-#else
-	KASSERT((*skp == NULL && *nkp == NULL));
-#endif
-
-	if ((*skp = pf_alloc_state_key(PR_NOWAIT | PR_ZERO)) == NULL)
-		return (ENOMEM);
-
-	PF_ACPY(&(*skp)->addr[pd->sidx], saddr, pd->af);
-	PF_ACPY(&(*skp)->addr[pd->didx], daddr, pd->af);
-	(*skp)->port[pd->sidx] = sport;
-	(*skp)->port[pd->didx] = dport;
-	(*skp)->proto = pd->proto;
-	(*skp)->af = pd->af;
-
-	if (nr != NULL) {
-		if ((*nkp = pf_alloc_state_key(PR_NOWAIT | PR_ZERO)) == NULL)
-			return (ENOMEM); /* caller must handle cleanup */
-
-		/* XXX maybe just bcopy and TAILQ_INIT(&(*nkp)->states) */
-		PF_ACPY(&(*nkp)->addr[0], &(*skp)->addr[0], pd->af);
-		PF_ACPY(&(*nkp)->addr[1], &(*skp)->addr[1], pd->af);
-		(*nkp)->port[0] = (*skp)->port[0];
-		(*nkp)->port[1] = (*skp)->port[1];
-		(*nkp)->proto = pd->proto;
-		(*nkp)->af = pd->af;
-	} else
-		*nkp = *skp;
-
-	if (pd->dir == PF_IN) {
-		*skw = *skp;
-		*sks = *nkp;
-	} else {
-		*sks = *skp;
-		*skw = *nkp;
-	}
-	return (0);
-}
-
-
-int
-pf_state_insert(struct pfi_kif *kif, struct pf_state_key *skw,
-    struct pf_state_key *sks, struct pf_state *s)
-{
-#ifndef __FreeBSD__
-	splassert(IPL_SOFTNET);
-#endif
-
-	s->kif = kif;
-
-	if (skw == sks) {
-		if (pf_state_key_attach(skw, s, PF_SK_WIRE))
-			return (-1);
-		s->key[PF_SK_STACK] = s->key[PF_SK_WIRE];
-	} else {
-		if (pf_state_key_attach(skw, s, PF_SK_WIRE)) {
-#ifdef __FreeBSD__
-			pool_put(&V_pf_state_key_pl, sks);
-#else
-			pool_put(&pf_state_key_pl, sks);
-#endif
-			return (-1);
-		}
-		if (pf_state_key_attach(sks, s, PF_SK_STACK)) {
-			pf_state_key_detach(s, PF_SK_WIRE);
-			return (-1);
-		}
-	}
-
-	if (s->id == 0 && s->creatorid == 0) {
-#ifdef __FreeBSD__
-		s->id = htobe64(V_pf_status.stateid++);
-		s->creatorid = V_pf_status.hostid;
-#else
-		s->id = htobe64(pf_status.stateid++);
-		s->creatorid = pf_status.hostid;
-#endif
-	}
-#ifdef __FreeBSD__
-	if (RB_INSERT(pf_state_tree_id, &V_tree_id, s) != NULL) {
-		if (V_pf_status.debug >= PF_DEBUG_MISC) {
-#else
-	if (RB_INSERT(pf_state_tree_id, &tree_id, s) != NULL) {
-		if (pf_status.debug >= PF_DEBUG_MISC) {
-#endif
-			printf("pf: state insert failed: "
-			    "id: %016llx creatorid: %08x",
-#ifdef __FreeBSD__
-			    (unsigned long long)betoh64(s->id), ntohl(s->creatorid));
-#else
-			    betoh64(s->id), ntohl(s->creatorid));
-#endif
-			printf("\n");
-		}
-		pf_detach_state(s);
-		return (-1);
-	}
-#ifdef __FreeBSD__
-	TAILQ_INSERT_TAIL(&V_state_list, s, entry_list);
-	V_pf_status.fcounters[FCNT_STATE_INSERT]++;
-	V_pf_status.states++;
-#else
-	TAILQ_INSERT_TAIL(&state_list, s, entry_list);
-	pf_status.fcounters[FCNT_STATE_INSERT]++;
-	pf_status.states++;
-#endif
-	pfi_kif_ref(kif, PFI_KIF_REF_STATE);
-#if NPFSYNC > 0
-#ifdef __FreeBSD__
-	if (pfsync_insert_state_ptr != NULL)
-		pfsync_insert_state_ptr(s);
-#else
-	pfsync_insert_state(s);
-#endif
-#endif
-	return (0);
-}
-
-struct pf_state *
-pf_find_state_byid(struct pf_state_cmp *key)
-{
-#ifdef __FreeBSD__
-	V_pf_status.fcounters[FCNT_STATE_SEARCH]++;
-
-	return (RB_FIND(pf_state_tree_id, &V_tree_id, (struct pf_state *)key));
-#else
-	pf_status.fcounters[FCNT_STATE_SEARCH]++;
-
-	return (RB_FIND(pf_state_tree_id, &tree_id, (struct pf_state *)key));
-#endif
-}
-
-/* XXX debug function, intended to be removed one day */
-int
-pf_compare_state_keys(struct pf_state_key *a, struct pf_state_key *b,
-    struct pfi_kif *kif, u_int dir)
-{
-	/* a (from hdr) and b (new) must be exact opposites of each other */
-	if (a->af == b->af && a->proto == b->proto &&
-	    PF_AEQ(&a->addr[0], &b->addr[1], a->af) &&
-	    PF_AEQ(&a->addr[1], &b->addr[0], a->af) &&
-	    a->port[0] == b->port[1] &&
-	    a->port[1] == b->port[0])
-		return (0);
-	else {
-		/* mismatch. must not happen. */
-		printf("pf: state key linking mismatch! dir=%s, "
-		    "if=%s, stored af=%u, a0: ",
-		    dir == PF_OUT ? "OUT" : "IN", kif->pfik_name, a->af);
-		pf_print_host(&a->addr[0], a->port[0], a->af);
-		printf(", a1: ");
-		pf_print_host(&a->addr[1], a->port[1], a->af);
-		printf(", proto=%u", a->proto);
-		printf(", found af=%u, a0: ", b->af);
-		pf_print_host(&b->addr[0], b->port[0], b->af);
-		printf(", a1: ");
-		pf_print_host(&b->addr[1], b->port[1], b->af);
-		printf(", proto=%u", b->proto);
-		printf(".\n");
-		return (-1);
-	}
-}
-
-struct pf_state *
-#ifdef __FreeBSD__
-pf_find_state(struct pfi_kif *kif, struct pf_state_key_cmp *key, u_int dir,
-    struct mbuf *m, struct pf_mtag *pftag)
-#else
-pf_find_state(struct pfi_kif *kif, struct pf_state_key_cmp *key, u_int dir,
-    struct mbuf *m)
-#endif
-{
-	struct pf_state_key	*sk;
-	struct pf_state_item	*si;
-
-#ifdef __FreeBSD__
-	V_pf_status.fcounters[FCNT_STATE_SEARCH]++;
-#else
-	pf_status.fcounters[FCNT_STATE_SEARCH]++;
-#endif
-
-#ifdef __FreeBSD__
-	if (dir == PF_OUT && pftag->statekey &&
-	    ((struct pf_state_key *)pftag->statekey)->reverse)
-		sk = ((struct pf_state_key *)pftag->statekey)->reverse;
-	else {
-#ifdef __FreeBSD__
-		if ((sk = RB_FIND(pf_state_tree, &V_pf_statetbl,
-#else
-		if ((sk = RB_FIND(pf_state_tree, &pf_statetbl,
-#endif
-		    (struct pf_state_key *)key)) == NULL)
-			return (NULL);
-		if (dir == PF_OUT && pftag->statekey &&
-		    pf_compare_state_keys(pftag->statekey, sk,
-		    kif, dir) == 0) {
-			((struct pf_state_key *)
-			    pftag->statekey)->reverse = sk;
-			sk->reverse = pftag->statekey;
-		}
-	}
-#else
-	if (dir == PF_OUT && m->m_pkthdr.pf.statekey &&
-	    ((struct pf_state_key *)m->m_pkthdr.pf.statekey)->reverse)
-		sk = ((struct pf_state_key *)m->m_pkthdr.pf.statekey)->reverse;
-	else {
-#ifdef __FreeBSD__
-		if ((sk = RB_FIND(pf_state_tree, &V_pf_statetbl,
-#else
-		if ((sk = RB_FIND(pf_state_tree, &pf_statetbl,
-#endif
-		    (struct pf_state_key *)key)) == NULL)
-			return (NULL);
-		if (dir == PF_OUT && m->m_pkthdr.pf.statekey &&
-		    pf_compare_state_keys(m->m_pkthdr.pf.statekey, sk,
-		    kif, dir) == 0) {
-			((struct pf_state_key *)
-			    m->m_pkthdr.pf.statekey)->reverse = sk;
-			sk->reverse = m->m_pkthdr.pf.statekey;
-		}
-	}
-#endif
-
-	if (dir == PF_OUT)
-#ifdef __FreeBSD__
-		pftag->statekey = NULL;
-#else
-		m->m_pkthdr.pf.statekey = NULL;
-#endif
-
-	/* list is sorted, if-bound states before floating ones */
-	TAILQ_FOREACH(si, &sk->states, entry)
-#ifdef __FreeBSD__
-		if ((si->s->kif == V_pfi_all || si->s->kif == kif) &&
-#else
-		if ((si->s->kif == pfi_all || si->s->kif == kif) &&
-#endif
-		    sk == (dir == PF_IN ? si->s->key[PF_SK_WIRE] :
-		    si->s->key[PF_SK_STACK]))
-			return (si->s);
-
-	return (NULL);
-}
-
-struct pf_state *
-pf_find_state_all(struct pf_state_key_cmp *key, u_int dir, int *more)
-{
-	struct pf_state_key	*sk;
-	struct pf_state_item	*si, *ret = NULL;
-
-#ifdef __FreeBSD__
-	V_pf_status.fcounters[FCNT_STATE_SEARCH]++;
-#else
-	pf_status.fcounters[FCNT_STATE_SEARCH]++;
-#endif
-
-#ifdef __FreeBSD__
-	sk = RB_FIND(pf_state_tree, &V_pf_statetbl, (struct pf_state_key *)key);
-#else
-	sk = RB_FIND(pf_state_tree, &pf_statetbl, (struct pf_state_key *)key);
-#endif
-	if (sk != NULL) {
-		TAILQ_FOREACH(si, &sk->states, entry)
-			if (dir == PF_INOUT ||
-			    (sk == (dir == PF_IN ? si->s->key[PF_SK_WIRE] :
-			    si->s->key[PF_SK_STACK]))) {
-				if (more == NULL)
-					return (si->s);
-
-				if (ret)
-					(*more)++;
-				else
-					ret = si;
-			}
-	}
-	return (ret ? ret->s : NULL);
-}
-
-/* END state table stuff */
-
-
-void
-pf_purge_thread(void *v)
-{
-	int nloops = 0, s;
-#ifdef __FreeBSD__
-	int locked;
-#endif
-
-	CURVNET_SET((struct vnet *)v);
-
-	for (;;) {
-		tsleep(pf_purge_thread, PWAIT, "pftm", 1 * hz);
-
-#ifdef __FreeBSD__
-		sx_slock(&V_pf_consistency_lock);
-		PF_LOCK();
-		locked = 0;
-
-		if (V_pf_end_threads) {
-			PF_UNLOCK();
-			sx_sunlock(&V_pf_consistency_lock);
-			sx_xlock(&V_pf_consistency_lock);
-			PF_LOCK();
-
-			pf_purge_expired_states(V_pf_status.states, 1);
-			pf_purge_expired_fragments();
-			pf_purge_expired_src_nodes(1);
-			V_pf_end_threads++;
-
-			sx_xunlock(&V_pf_consistency_lock);
-			PF_UNLOCK();
-			wakeup(pf_purge_thread);
-			kproc_exit(0);
-		}
-#endif
-		s = splsoftnet();
-
-		/* process a fraction of the state table every second */
-#ifdef __FreeBSD__
-		if (!pf_purge_expired_states(1 + (V_pf_status.states /
-		    V_pf_default_rule.timeout[PFTM_INTERVAL]), 0)) {
-			PF_UNLOCK();
-			sx_sunlock(&V_pf_consistency_lock);
-			sx_xlock(&V_pf_consistency_lock);
-			PF_LOCK();
-			locked = 1;
-
-			pf_purge_expired_states(1 + (V_pf_status.states /
-			    V_pf_default_rule.timeout[PFTM_INTERVAL]), 1);
-		}
-#else
-		pf_purge_expired_states(1 + (pf_status.states
-		    / pf_default_rule.timeout[PFTM_INTERVAL]));
-#endif
-
-		/* purge other expired types every PFTM_INTERVAL seconds */
-#ifdef __FreeBSD__
-		if (++nloops >= V_pf_default_rule.timeout[PFTM_INTERVAL]) {
-#else
-		if (++nloops >= pf_default_rule.timeout[PFTM_INTERVAL]) {
-#endif
-			pf_purge_expired_fragments();
-			pf_purge_expired_src_nodes(0);
-			nloops = 0;
-		}
-
-		splx(s);
-#ifdef __FreeBSD__
-		PF_UNLOCK();
-		if (locked)
-			sx_xunlock(&V_pf_consistency_lock);
-		else
-			sx_sunlock(&V_pf_consistency_lock);
-#endif
-	}
-	CURVNET_RESTORE();
-}
-
-u_int32_t
-pf_state_expires(const struct pf_state *state)
-{
-	u_int32_t	timeout;
-	u_int32_t	start;
-	u_int32_t	end;
-	u_int32_t	states;
-
-	/* handle all PFTM_* > PFTM_MAX here */
-	if (state->timeout == PFTM_PURGE)
-		return (time_second);
-	if (state->timeout == PFTM_UNTIL_PACKET)
-		return (0);
-#ifdef __FreeBSD__
-	KASSERT(state->timeout != PFTM_UNLINKED,
-	    ("pf_state_expires: timeout == PFTM_UNLINKED"));
-	KASSERT((state->timeout < PFTM_MAX), 
-	    ("pf_state_expires: timeout > PFTM_MAX"));
-#else
-	KASSERT(state->timeout != PFTM_UNLINKED);
-	KASSERT(state->timeout < PFTM_MAX);
-#endif
-	timeout = state->rule.ptr->timeout[state->timeout];
-	if (!timeout)
-#ifdef __FreeBSD__
-		timeout = V_pf_default_rule.timeout[state->timeout];
-#else
-		timeout = pf_default_rule.timeout[state->timeout];
-#endif
-	start = state->rule.ptr->timeout[PFTM_ADAPTIVE_START];
-	if (start) {
-		end = state->rule.ptr->timeout[PFTM_ADAPTIVE_END];
-		states = state->rule.ptr->states_cur;
-	} else {
-#ifdef __FreeBSD__
-		start = V_pf_default_rule.timeout[PFTM_ADAPTIVE_START];
-		end = V_pf_default_rule.timeout[PFTM_ADAPTIVE_END];
-		states = V_pf_status.states;
-#else
-		start = pf_default_rule.timeout[PFTM_ADAPTIVE_START];
-		end = pf_default_rule.timeout[PFTM_ADAPTIVE_END];
-		states = pf_status.states;
-#endif
-	}
-	if (end && states > start && start < end) {
-		if (states < end)
-			return (state->expire + timeout * (end - states) /
-			    (end - start));
-		else
-			return (time_second);
-	}
-	return (state->expire + timeout);
-}
-
-#ifdef __FreeBSD__
-int
-pf_purge_expired_src_nodes(int waslocked)
-#else
-void
-pf_purge_expired_src_nodes(int waslocked)
-#endif
-{
-	struct pf_src_node		*cur, *next;
-	int				 locked = waslocked;
-
-#ifdef __FreeBSD__
-	for (cur = RB_MIN(pf_src_tree, &V_tree_src_tracking); cur; cur = next) {
-	next = RB_NEXT(pf_src_tree, &V_tree_src_tracking, cur);
-#else
-	for (cur = RB_MIN(pf_src_tree, &tree_src_tracking); cur; cur = next) {
-	next = RB_NEXT(pf_src_tree, &tree_src_tracking, cur);
-#endif
-
-		if (cur->states <= 0 && cur->expire <= time_second) {
-			if (! locked) {
-#ifdef __FreeBSD__
-				if (!sx_try_upgrade(&V_pf_consistency_lock))
-					return (0);
-#else
-				rw_enter_write(&pf_consistency_lock);
-#endif
-				next = RB_NEXT(pf_src_tree,
-#ifdef __FreeBSD__
-				    &V_tree_src_tracking, cur);
-#else
-				    &tree_src_tracking, cur);
-#endif
-				locked = 1;
-			}
-			if (cur->rule.ptr != NULL) {
-				cur->rule.ptr->src_nodes--;
-				if (cur->rule.ptr->states_cur <= 0 &&
-				    cur->rule.ptr->max_src_nodes <= 0)
-					pf_rm_rule(NULL, cur->rule.ptr);
-			}
-#ifdef __FreeBSD__
-			RB_REMOVE(pf_src_tree, &V_tree_src_tracking, cur);
-			V_pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
-			V_pf_status.src_nodes--;
-			pool_put(&V_pf_src_tree_pl, cur);
-#else
-			RB_REMOVE(pf_src_tree, &tree_src_tracking, cur);
-			pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
-			pf_status.src_nodes--;
-			pool_put(&pf_src_tree_pl, cur);
-#endif
-		}
-	}
-
-	if (locked && !waslocked)
-#ifdef __FreeBSD__
-	{
-		sx_downgrade(&V_pf_consistency_lock);
-	}
-	return (1);
-#else
-		rw_exit_write(&pf_consistency_lock);
-#endif
-}
-
-void
-pf_src_tree_remove_state(struct pf_state *s)
-{
-	u_int32_t timeout;
-
-	if (s->src_node != NULL) {
-		if (s->src.tcp_est)
-			--s->src_node->conn;
-		if (--s->src_node->states <= 0) {
-			timeout = s->rule.ptr->timeout[PFTM_SRC_NODE];
-			if (!timeout)
-				timeout =
-#ifdef __FreeBSD__
-				    V_pf_default_rule.timeout[PFTM_SRC_NODE];
-#else
-				    pf_default_rule.timeout[PFTM_SRC_NODE];
-#endif
-			s->src_node->expire = time_second + timeout;
-		}
-	}
-	if (s->nat_src_node != s->src_node && s->nat_src_node != NULL) {
-		if (--s->nat_src_node->states <= 0) {
-			timeout = s->rule.ptr->timeout[PFTM_SRC_NODE];
-			if (!timeout)
-				timeout =
-#ifdef __FreeBSD__
-				    V_pf_default_rule.timeout[PFTM_SRC_NODE];
-#else
-				    pf_default_rule.timeout[PFTM_SRC_NODE];
-#endif
-			s->nat_src_node->expire = time_second + timeout;
-		}
-	}
-	s->src_node = s->nat_src_node = NULL;
-}
-
-/* callers should be at splsoftnet */
-void
-pf_unlink_state(struct pf_state *cur)
-{
-#ifdef __FreeBSD__
-	if (cur->local_flags & PFSTATE_EXPIRING)
-		return;
-	cur->local_flags |= PFSTATE_EXPIRING;
-#else
-	splassert(IPL_SOFTNET);
-#endif
-
-	if (cur->src.state == PF_TCPS_PROXY_DST) {
-		/* XXX wire key the right one? */
-#ifdef __FreeBSD__
-		pf_send_tcp(NULL, cur->rule.ptr, cur->key[PF_SK_WIRE]->af,
-#else
-		pf_send_tcp(cur->rule.ptr, cur->key[PF_SK_WIRE]->af,
-#endif
-		    &cur->key[PF_SK_WIRE]->addr[1],
-		    &cur->key[PF_SK_WIRE]->addr[0],
-		    cur->key[PF_SK_WIRE]->port[1],
-		    cur->key[PF_SK_WIRE]->port[0],
-		    cur->src.seqhi, cur->src.seqlo + 1,
-		    TH_RST|TH_ACK, 0, 0, 0, 1, cur->tag, NULL, NULL);
-	}
-#ifdef __FreeBSD__
-	RB_REMOVE(pf_state_tree_id, &V_tree_id, cur);
-#else
-	RB_REMOVE(pf_state_tree_id, &tree_id, cur);
-#endif
-#if NPFLOW > 0
-	if (cur->state_flags & PFSTATE_PFLOW)
-#ifdef __FreeBSD__
-		if (export_pflow_ptr != NULL)
-			export_pflow_ptr(cur);
-#else
-		export_pflow(cur);
-#endif
-#endif
-#if NPFSYNC > 0
-#ifdef __FreeBSD__
-	if (pfsync_delete_state_ptr != NULL)
-		pfsync_delete_state_ptr(cur);
-#else
-	pfsync_delete_state(cur);
-#endif
-#endif
-	cur->timeout = PFTM_UNLINKED;
-	pf_src_tree_remove_state(cur);
-	pf_detach_state(cur);
-}
-
-/* callers should be at splsoftnet and hold the
- * write_lock on pf_consistency_lock */
-void
-pf_free_state(struct pf_state *cur)
-{
-#ifndef __FreeBSD__
-	splassert(IPL_SOFTNET);
-#endif
-
-#if NPFSYNC > 0
-#ifdef __FreeBSD__
-	if (pfsync_state_in_use_ptr != NULL &&
-		pfsync_state_in_use_ptr(cur))
-#else
-	if (pfsync_state_in_use(cur))
-#endif
-		return;
-#endif
-#ifdef __FreeBSD__
-	KASSERT(cur->timeout == PFTM_UNLINKED,
-	    ("pf_free_state: cur->timeout != PFTM_UNLINKED"));
-#else
-	KASSERT(cur->timeout == PFTM_UNLINKED);
-#endif
-	if (--cur->rule.ptr->states_cur <= 0 &&
-	    cur->rule.ptr->src_nodes <= 0)
-		pf_rm_rule(NULL, cur->rule.ptr);
-	if (cur->nat_rule.ptr != NULL)
-		if (--cur->nat_rule.ptr->states_cur <= 0 &&
-			cur->nat_rule.ptr->src_nodes <= 0)
-			pf_rm_rule(NULL, cur->nat_rule.ptr);
-	if (cur->anchor.ptr != NULL)
-		if (--cur->anchor.ptr->states_cur <= 0)
-			pf_rm_rule(NULL, cur->anchor.ptr);
-	pf_normalize_tcp_cleanup(cur);
-	pfi_kif_unref(cur->kif, PFI_KIF_REF_STATE);
-#ifdef __FreeBSD__
-	TAILQ_REMOVE(&V_state_list, cur, entry_list);
-#else
-	TAILQ_REMOVE(&state_list, cur, entry_list);
-#endif
-	if (cur->tag)
-		pf_tag_unref(cur->tag);
-#ifdef __FreeBSD__
-	pool_put(&V_pf_state_pl, cur);
-	V_pf_status.fcounters[FCNT_STATE_REMOVALS]++;
-	V_pf_status.states--;
-#else
-	pool_put(&pf_state_pl, cur);
-	pf_status.fcounters[FCNT_STATE_REMOVALS]++;
-	pf_status.states--;
-#endif
-}
-
-#ifdef __FreeBSD__
-int
-pf_purge_expired_states(u_int32_t maxcheck, int waslocked)
-#else
-void
-pf_purge_expired_states(u_int32_t maxcheck)
-#endif
-{
-	static struct pf_state	*cur = NULL;
-	struct pf_state		*next;
-#ifdef __FreeBSD__
-	int			 locked = waslocked;
-#else
-	int			 locked = 0;
-#endif
-
-	while (maxcheck--) {
-		/* wrap to start of list when we hit the end */
-		if (cur == NULL) {
-#ifdef __FreeBSD__
-			cur = TAILQ_FIRST(&V_state_list);
-#else
-			cur = TAILQ_FIRST(&state_list);
-#endif
-			if (cur == NULL)
-				break;	/* list empty */
-		}
-
-		/* get next state, as cur may get deleted */
-		next = TAILQ_NEXT(cur, entry_list);
-
-		if (cur->timeout == PFTM_UNLINKED) {
-			/* free unlinked state */
-			if (! locked) {
-#ifdef __FreeBSD__
-				if (!sx_try_upgrade(&V_pf_consistency_lock))
-					return (0);
-#else
-				rw_enter_write(&pf_consistency_lock);
-#endif
-				locked = 1;
-			}
-			pf_free_state(cur);
-		} else if (pf_state_expires(cur) <= time_second) {
-			/* unlink and free expired state */
-			pf_unlink_state(cur);
-			if (! locked) {
-#ifdef __FreeBSD__
-				if (!sx_try_upgrade(&V_pf_consistency_lock))
-					return (0);
-#else
-				rw_enter_write(&pf_consistency_lock);
-#endif
-				locked = 1;
-			}
-			pf_free_state(cur);
-		}
-		cur = next;
-	}
-
-#ifdef __FreeBSD__
-	if (!waslocked && locked)
-		sx_downgrade(&V_pf_consistency_lock);
-
-	return (1);
-#else
-	if (locked)
-		rw_exit_write(&pf_consistency_lock);
-#endif
-}
-
-int
-pf_tbladdr_setup(struct pf_ruleset *rs, struct pf_addr_wrap *aw)
-{
-	if (aw->type != PF_ADDR_TABLE)
-		return (0);
-	if ((aw->p.tbl = pfr_attach_table(rs, aw->v.tblname, 1)) == NULL)
-		return (1);
-	return (0);
-}
-
-void
-pf_tbladdr_remove(struct pf_addr_wrap *aw)
-{
-	if (aw->type != PF_ADDR_TABLE || aw->p.tbl == NULL)
-		return;
-	pfr_detach_table(aw->p.tbl);
-	aw->p.tbl = NULL;
-}
-
-void
-pf_tbladdr_copyout(struct pf_addr_wrap *aw)
-{
-	struct pfr_ktable *kt = aw->p.tbl;
-
-	if (aw->type != PF_ADDR_TABLE || kt == NULL)
-		return;
-	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
-		kt = kt->pfrkt_root;
-	aw->p.tbl = NULL;
-	aw->p.tblcnt = (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) ?
-		kt->pfrkt_cnt : -1;
-}
-
-void
-pf_print_host(struct pf_addr *addr, u_int16_t p, sa_family_t af)
-{
-	switch (af) {
-#ifdef INET
-	case AF_INET: {
-		u_int32_t a = ntohl(addr->addr32[0]);
-		printf("%u.%u.%u.%u", (a>>24)&255, (a>>16)&255,
-		    (a>>8)&255, a&255);
-		if (p) {
-			p = ntohs(p);
-			printf(":%u", p);
-		}
-		break;
-	}
-#endif /* INET */
-#ifdef INET6
-	case AF_INET6: {
-		u_int16_t b;
-		u_int8_t i, curstart, curend, maxstart, maxend;
-		curstart = curend = maxstart = maxend = 255;
-		for (i = 0; i < 8; i++) {
-			if (!addr->addr16[i]) {
-				if (curstart == 255)
-					curstart = i;
-				curend = i;
-			} else {
-				if ((curend - curstart) >
-				    (maxend - maxstart)) {
-					maxstart = curstart;
-					maxend = curend;
-				}
-				curstart = curend = 255;
-			}
-		}
-		if ((curend - curstart) >
-		    (maxend - maxstart)) {
-			maxstart = curstart;
-			maxend = curend;
-		}
-		for (i = 0; i < 8; i++) {
-			if (i >= maxstart && i <= maxend) {
-				if (i == 0)
-					printf(":");
-				if (i == maxend)
-					printf(":");
-			} else {
-				b = ntohs(addr->addr16[i]);
-				printf("%x", b);
-				if (i < 7)
-					printf(":");
-			}
-		}
-		if (p) {
-			p = ntohs(p);
-			printf("[%u]", p);
-		}
-		break;
-	}
-#endif /* INET6 */
-	}
-}
-
-void
-pf_print_state(struct pf_state *s)
-{
-	pf_print_state_parts(s, NULL, NULL);
-}
-
-void
-pf_print_state_parts(struct pf_state *s,
-    struct pf_state_key *skwp, struct pf_state_key *sksp)
-{
-	struct pf_state_key *skw, *sks;
-	u_int8_t proto, dir;
-
-	/* Do our best to fill these, but they're skipped if NULL */
-	skw = skwp ? skwp : (s ? s->key[PF_SK_WIRE] : NULL);
-	sks = sksp ? sksp : (s ? s->key[PF_SK_STACK] : NULL);
-	proto = skw ? skw->proto : (sks ? sks->proto : 0);
-	dir = s ? s->direction : 0;
-
-	switch (proto) {
-	case IPPROTO_IPV4:
-		printf("IPv4");
-		break;
-	case IPPROTO_IPV6:
-		printf("IPv6");
-		break;
-	case IPPROTO_TCP:
-		printf("TCP");
-		break;
-	case IPPROTO_UDP:
-		printf("UDP");
-		break;
-	case IPPROTO_ICMP:
-		printf("ICMP");
-		break;
-	case IPPROTO_ICMPV6:
-		printf("ICMPv6");
-		break;
-	default:
-		printf("%u", skw->proto);
-		break;
-	}
-	switch (dir) {
-	case PF_IN:
-		printf(" in");
-		break;
-	case PF_OUT:
-		printf(" out");
-		break;
-	}
-	if (skw) {
-		printf(" wire: ");
-		pf_print_host(&skw->addr[0], skw->port[0], skw->af);
-		printf(" ");
-		pf_print_host(&skw->addr[1], skw->port[1], skw->af);
-	}
-	if (sks) {
-		printf(" stack: ");
-		if (sks != skw) {
-			pf_print_host(&sks->addr[0], sks->port[0], sks->af);
-			printf(" ");
-			pf_print_host(&sks->addr[1], sks->port[1], sks->af);
-		} else
-			printf("-");
-	}
-	if (s) {
-		if (proto == IPPROTO_TCP) {
-			printf(" [lo=%u high=%u win=%u modulator=%u",
-			    s->src.seqlo, s->src.seqhi,
-			    s->src.max_win, s->src.seqdiff);
-			if (s->src.wscale && s->dst.wscale)
-				printf(" wscale=%u",
-				    s->src.wscale & PF_WSCALE_MASK);
-			printf("]");
-			printf(" [lo=%u high=%u win=%u modulator=%u",
-			    s->dst.seqlo, s->dst.seqhi,
-			    s->dst.max_win, s->dst.seqdiff);
-			if (s->src.wscale && s->dst.wscale)
-				printf(" wscale=%u",
-				s->dst.wscale & PF_WSCALE_MASK);
-			printf("]");
-		}
-		printf(" %u:%u", s->src.state, s->dst.state);
-	}
-}
-
-void
-pf_print_flags(u_int8_t f)
-{
-	if (f)
-		printf(" ");
-	if (f & TH_FIN)
-		printf("F");
-	if (f & TH_SYN)
-		printf("S");
-	if (f & TH_RST)
-		printf("R");
-	if (f & TH_PUSH)
-		printf("P");
-	if (f & TH_ACK)
-		printf("A");
-	if (f & TH_URG)
-		printf("U");
-	if (f & TH_ECE)
-		printf("E");
-	if (f & TH_CWR)
-		printf("W");
-}
-
-#define	PF_SET_SKIP_STEPS(i)					\
-	do {							\
-		while (head[i] != cur) {			\
-			head[i]->skip[i].ptr = cur;		\
-			head[i] = TAILQ_NEXT(head[i], entries);	\
-		}						\
-	} while (0)
-
-void
-pf_calc_skip_steps(struct pf_rulequeue *rules)
-{
-	struct pf_rule *cur, *prev, *head[PF_SKIP_COUNT];
-	int i;
-
-	cur = TAILQ_FIRST(rules);
-	prev = cur;
-	for (i = 0; i < PF_SKIP_COUNT; ++i)
-		head[i] = cur;
-	while (cur != NULL) {
-
-		if (cur->kif != prev->kif || cur->ifnot != prev->ifnot)
-			PF_SET_SKIP_STEPS(PF_SKIP_IFP);
-		if (cur->direction != prev->direction)
-			PF_SET_SKIP_STEPS(PF_SKIP_DIR);
-		if (cur->af != prev->af)
-			PF_SET_SKIP_STEPS(PF_SKIP_AF);
-		if (cur->proto != prev->proto)
-			PF_SET_SKIP_STEPS(PF_SKIP_PROTO);
-		if (cur->src.neg != prev->src.neg ||
-		    pf_addr_wrap_neq(&cur->src.addr, &prev->src.addr))
-			PF_SET_SKIP_STEPS(PF_SKIP_SRC_ADDR);
-		if (cur->src.port[0] != prev->src.port[0] ||
-		    cur->src.port[1] != prev->src.port[1] ||
-		    cur->src.port_op != prev->src.port_op)
-			PF_SET_SKIP_STEPS(PF_SKIP_SRC_PORT);
-		if (cur->dst.neg != prev->dst.neg ||
-		    pf_addr_wrap_neq(&cur->dst.addr, &prev->dst.addr))
-			PF_SET_SKIP_STEPS(PF_SKIP_DST_ADDR);
-		if (cur->dst.port[0] != prev->dst.port[0] ||
-		    cur->dst.port[1] != prev->dst.port[1] ||
-		    cur->dst.port_op != prev->dst.port_op)
-			PF_SET_SKIP_STEPS(PF_SKIP_DST_PORT);
-
-		prev = cur;
-		cur = TAILQ_NEXT(cur, entries);
-	}
-	for (i = 0; i < PF_SKIP_COUNT; ++i)
-		PF_SET_SKIP_STEPS(i);
-}
-
-int
-pf_addr_wrap_neq(struct pf_addr_wrap *aw1, struct pf_addr_wrap *aw2)
-{
-	if (aw1->type != aw2->type)
-		return (1);
-	switch (aw1->type) {
-	case PF_ADDR_ADDRMASK:
-	case PF_ADDR_RANGE:
-		if (PF_ANEQ(&aw1->v.a.addr, &aw2->v.a.addr, 0))
-			return (1);
-		if (PF_ANEQ(&aw1->v.a.mask, &aw2->v.a.mask, 0))
-			return (1);
-		return (0);
-	case PF_ADDR_DYNIFTL:
-		return (aw1->p.dyn->pfid_kt != aw2->p.dyn->pfid_kt);
-	case PF_ADDR_NOROUTE:
-	case PF_ADDR_URPFFAILED:
-		return (0);
-	case PF_ADDR_TABLE:
-		return (aw1->p.tbl != aw2->p.tbl);
-	case PF_ADDR_RTLABEL:
-		return (aw1->v.rtlabel != aw2->v.rtlabel);
-	default:
-		printf("invalid address type: %d\n", aw1->type);
-		return (1);
-	}
-}
-
-u_int16_t
-pf_cksum_fixup(u_int16_t cksum, u_int16_t old, u_int16_t new, u_int8_t udp)
-{
-	u_int32_t	l;
-
-	if (udp && !cksum)
-		return (0x0000);
-	l = cksum + old - new;
-	l = (l >> 16) + (l & 65535);
-	l = l & 65535;
-	if (udp && !l)
-		return (0xFFFF);
-	return (l);
-}
-
-void
-pf_change_ap(struct pf_addr *a, u_int16_t *p, u_int16_t *ic, u_int16_t *pc,
-    struct pf_addr *an, u_int16_t pn, u_int8_t u, sa_family_t af)
-{
-	struct pf_addr	ao;
-	u_int16_t	po = *p;
-
-	PF_ACPY(&ao, a, af);
-	PF_ACPY(a, an, af);
-
-	*p = pn;
-
-	switch (af) {
-#ifdef INET
-	case AF_INET:
-		*ic = pf_cksum_fixup(pf_cksum_fixup(*ic,
-		    ao.addr16[0], an->addr16[0], 0),
-		    ao.addr16[1], an->addr16[1], 0);
-		*p = pn;
-		*pc = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(*pc,
-		    ao.addr16[0], an->addr16[0], u),
-		    ao.addr16[1], an->addr16[1], u),
-		    po, pn, u);
-		break;
-#endif /* INET */
-#ifdef INET6
-	case AF_INET6:
-		*pc = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
-		    pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
-		    pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(*pc,
-		    ao.addr16[0], an->addr16[0], u),
-		    ao.addr16[1], an->addr16[1], u),
-		    ao.addr16[2], an->addr16[2], u),
-		    ao.addr16[3], an->addr16[3], u),
-		    ao.addr16[4], an->addr16[4], u),
-		    ao.addr16[5], an->addr16[5], u),
-		    ao.addr16[6], an->addr16[6], u),
-		    ao.addr16[7], an->addr16[7], u),
-		    po, pn, u);
-		break;
-#endif /* INET6 */
-	}
-}
-
-
-/* Changes a u_int32_t.  Uses a void * so there are no align restrictions */
-void
-pf_change_a(void *a, u_int16_t *c, u_int32_t an, u_int8_t u)
-{
-	u_int32_t	ao;
-
-	memcpy(&ao, a, sizeof(ao));
-	memcpy(a, &an, sizeof(u_int32_t));
-	*c = pf_cksum_fixup(pf_cksum_fixup(*c, ao / 65536, an / 65536, u),
-	    ao % 65536, an % 65536, u);
-}
-
-#ifdef INET6
-void
-pf_change_a6(struct pf_addr *a, u_int16_t *c, struct pf_addr *an, u_int8_t u)
-{
-	struct pf_addr	ao;
-
-	PF_ACPY(&ao, a, AF_INET6);
-	PF_ACPY(a, an, AF_INET6);
-
-	*c = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
-	    pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
-	    pf_cksum_fixup(pf_cksum_fixup(*c,
-	    ao.addr16[0], an->addr16[0], u),
-	    ao.addr16[1], an->addr16[1], u),
-	    ao.addr16[2], an->addr16[2], u),
-	    ao.addr16[3], an->addr16[3], u),
-	    ao.addr16[4], an->addr16[4], u),
-	    ao.addr16[5], an->addr16[5], u),
-	    ao.addr16[6], an->addr16[6], u),
-	    ao.addr16[7], an->addr16[7], u);
-}
-#endif /* INET6 */
-
-void
-pf_change_icmp(struct pf_addr *ia, u_int16_t *ip, struct pf_addr *oa,
-    struct pf_addr *na, u_int16_t np, u_int16_t *pc, u_int16_t *h2c,
-    u_int16_t *ic, u_int16_t *hc, u_int8_t u, sa_family_t af)
-{
-	struct pf_addr	oia, ooa;
-
-	PF_ACPY(&oia, ia, af);
-	if (oa)
-		PF_ACPY(&ooa, oa, af);
-
-	/* Change inner protocol port, fix inner protocol checksum. */
-	if (ip != NULL) {
-		u_int16_t	oip = *ip;
-		u_int32_t	opc;
-
-		if (pc != NULL)
-			opc = *pc;
-		*ip = np;
-		if (pc != NULL)
-			*pc = pf_cksum_fixup(*pc, oip, *ip, u);
-		*ic = pf_cksum_fixup(*ic, oip, *ip, 0);
-		if (pc != NULL)
-			*ic = pf_cksum_fixup(*ic, opc, *pc, 0);
-	}
-	/* Change inner ip address, fix inner ip and icmp checksums. */
-	PF_ACPY(ia, na, af);
-	switch (af) {
-#ifdef INET
-	case AF_INET: {
-		u_int32_t	 oh2c = *h2c;
-
-		*h2c = pf_cksum_fixup(pf_cksum_fixup(*h2c,
-		    oia.addr16[0], ia->addr16[0], 0),
-		    oia.addr16[1], ia->addr16[1], 0);
-		*ic = pf_cksum_fixup(pf_cksum_fixup(*ic,
-		    oia.addr16[0], ia->addr16[0], 0),
-		    oia.addr16[1], ia->addr16[1], 0);
-		*ic = pf_cksum_fixup(*ic, oh2c, *h2c, 0);
-		break;
-	}
-#endif /* INET */
-#ifdef INET6
-	case AF_INET6:
-		*ic = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
-		    pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
-		    pf_cksum_fixup(pf_cksum_fixup(*ic,
-		    oia.addr16[0], ia->addr16[0], u),
-		    oia.addr16[1], ia->addr16[1], u),
-		    oia.addr16[2], ia->addr16[2], u),
-		    oia.addr16[3], ia->addr16[3], u),
-		    oia.addr16[4], ia->addr16[4], u),
-		    oia.addr16[5], ia->addr16[5], u),
-		    oia.addr16[6], ia->addr16[6], u),
-		    oia.addr16[7], ia->addr16[7], u);
-		break;
-#endif /* INET6 */
-	}
-	/* Outer ip address, fix outer ip or icmpv6 checksum, if necessary. */
-	if (oa) {
-		PF_ACPY(oa, na, af);
-		switch (af) {
-#ifdef INET
-		case AF_INET:
-			*hc = pf_cksum_fixup(pf_cksum_fixup(*hc,
-			    ooa.addr16[0], oa->addr16[0], 0),
-			    ooa.addr16[1], oa->addr16[1], 0);
-			break;
-#endif /* INET */
-#ifdef INET6
-		case AF_INET6:
-			*ic = pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
-			    pf_cksum_fixup(pf_cksum_fixup(pf_cksum_fixup(
-			    pf_cksum_fixup(pf_cksum_fixup(*ic,
-			    ooa.addr16[0], oa->addr16[0], u),
-			    ooa.addr16[1], oa->addr16[1], u),
-			    ooa.addr16[2], oa->addr16[2], u),
-			    ooa.addr16[3], oa->addr16[3], u),
-			    ooa.addr16[4], oa->addr16[4], u),
-			    ooa.addr16[5], oa->addr16[5], u),
-			    ooa.addr16[6], oa->addr16[6], u),
-			    ooa.addr16[7], oa->addr16[7], u);
-			break;
-#endif /* INET6 */
-		}
-	}
-}
-
-
-/*
- * Need to modulate the sequence numbers in the TCP SACK option
- * (credits to Krzysztof Pfaff for report and patch)
- */
-int
-pf_modulate_sack(struct mbuf *m, int off, struct pf_pdesc *pd,
-    struct tcphdr *th, struct pf_state_peer *dst)
-{
-	int hlen = (th->th_off << 2) - sizeof(*th), thoptlen = hlen;
-#ifdef __FreeBSD__
-	u_int8_t opts[TCP_MAXOLEN], *opt = opts;
-#else
-	u_int8_t opts[MAX_TCPOPTLEN], *opt = opts;
-#endif
-	int copyback = 0, i, olen;
-	struct sackblk sack;
-
-#define	TCPOLEN_SACKLEN	(TCPOLEN_SACK + 2)
-	if (hlen < TCPOLEN_SACKLEN ||
-	    !pf_pull_hdr(m, off + sizeof(*th), opts, hlen, NULL, NULL, pd->af))
-		return 0;
-
-	while (hlen >= TCPOLEN_SACKLEN) {
-		olen = opt[1];
-		switch (*opt) {
-		case TCPOPT_EOL:	/* FALLTHROUGH */
-		case TCPOPT_NOP:
-			opt++;
-			hlen--;
-			break;
-		case TCPOPT_SACK:
-			if (olen > hlen)
-				olen = hlen;
-			if (olen >= TCPOLEN_SACKLEN) {
-				for (i = 2; i + TCPOLEN_SACK <= olen;
-				    i += TCPOLEN_SACK) {
-					memcpy(&sack, &opt[i], sizeof(sack));
-					pf_change_a(&sack.start, &th->th_sum,
-					    htonl(ntohl(sack.start) -
-					    dst->seqdiff), 0);
-					pf_change_a(&sack.end, &th->th_sum,
-					    htonl(ntohl(sack.end) -
-					    dst->seqdiff), 0);
-					memcpy(&opt[i], &sack, sizeof(sack));
-				}
-				copyback = 1;
-			}
-			/* FALLTHROUGH */
-		default:
-			if (olen < 2)
-				olen = 2;
-			hlen -= olen;
-			opt += olen;
-		}
-	}
-
-	if (copyback)
-#ifdef __FreeBSD__
-		m_copyback(m, off + sizeof(*th), thoptlen, (caddr_t)opts);
-#else
-		m_copyback(m, off + sizeof(*th), thoptlen, opts);
-#endif
-	return (copyback);
-}
-
-void
-#ifdef __FreeBSD__
-pf_send_tcp(struct mbuf *replyto, const struct pf_rule *r, sa_family_t af,
-#else
-pf_send_tcp(const struct pf_rule *r, sa_family_t af,
-#endif
-    const struct pf_addr *saddr, const struct pf_addr *daddr,
-    u_int16_t sport, u_int16_t dport, u_int32_t seq, u_int32_t ack,
-    u_int8_t flags, u_int16_t win, u_int16_t mss, u_int8_t ttl, int tag,
-    u_int16_t rtag, struct ether_header *eh, struct ifnet *ifp)
-{
-	struct mbuf	*m;
-	int		 len, tlen;
-#ifdef INET
-	struct ip	*h;
-#endif /* INET */
-#ifdef INET6
-	struct ip6_hdr	*h6;
-#endif /* INET6 */
-	struct tcphdr	*th;
-	char		*opt;
-#ifdef __FreeBSD__
-	struct pf_mtag  *pf_mtag;
-
-	KASSERT(
-#ifdef INET
-	    af == AF_INET
-#else
-	    0
-#endif
-	    ||
-#ifdef INET6
-	    af == AF_INET6
-#else
-	    0
-#endif
-	    , ("Unsupported AF %d", af));
-	len = 0;
-	th = NULL;
-#ifdef INET
-	h = NULL;
-#endif
-#ifdef INET6
-	h6 = NULL;
-#endif
-#endif /* __FreeBSD__ */
-
-	/* maximum segment size tcp option */
-	tlen = sizeof(struct tcphdr);
-	if (mss)
-		tlen += 4;
-
-	switch (af) {
-#ifdef INET
-	case AF_INET:
-		len = sizeof(struct ip) + tlen;
-		break;
-#endif /* INET */
-#ifdef INET6
-	case AF_INET6:
-		len = sizeof(struct ip6_hdr) + tlen;
-		break;
-#endif /* INET6 */
-	}
-
-	/* create outgoing mbuf */
-	m = m_gethdr(M_DONTWAIT, MT_HEADER);
-	if (m == NULL)
-		return;
-#ifdef __FreeBSD__
-#ifdef MAC
-	mac_netinet_firewall_send(m);
-#endif
-	if ((pf_mtag = pf_get_mtag(m)) == NULL) {
-		m_freem(m);
-		return;
-	}
-#endif
-	if (tag)
-#ifdef __FreeBSD__
-		m->m_flags |= M_SKIP_FIREWALL;
-	pf_mtag->tag = rtag;
-#else
-		m->m_pkthdr.pf.flags |= PF_TAG_GENERATED;
-	m->m_pkthdr.pf.tag = rtag;
-#endif
-
-	if (r != NULL && r->rtableid >= 0)
-#ifdef __FreeBSD__
-	{
-		M_SETFIB(m, r->rtableid);
-		pf_mtag->rtableid = r->rtableid;
-#else
-		m->m_pkthdr.pf.rtableid = r->rtableid;
-#endif
-#ifdef __FreeBSD__
-	}
-#endif
-
-#ifdef ALTQ
-	if (r != NULL && r->qid) {
-#ifdef __FreeBSD__
-		pf_mtag->qid = r->qid;
-
-		/* add hints for ecn */
-		pf_mtag->hdr = mtod(m, struct ip *);
-#else
-		m->m_pkthdr.pf.qid = r->qid;
-		/* add hints for ecn */
-		m->m_pkthdr.pf.hdr = mtod(m, struct ip *);
-#endif
-	}
-#endif /* ALTQ */
-	m->m_data += max_linkhdr;
-	m->m_pkthdr.len = m->m_len = len;
-	m->m_pkthdr.rcvif = NULL;
-	bzero(m->m_data, len);
-	switch (af) {
-#ifdef INET
-	case AF_INET:
-		h = mtod(m, struct ip *);
-
-		/* IP header fields included in the TCP checksum */
-		h->ip_p = IPPROTO_TCP;
-		h->ip_len = htons(tlen);
-		h->ip_src.s_addr = saddr->v4.s_addr;
-		h->ip_dst.s_addr = daddr->v4.s_addr;
-
-		th = (struct tcphdr *)((caddr_t)h + sizeof(struct ip));
-		break;
-#endif /* INET */
-#ifdef INET6
-	case AF_INET6:
-		h6 = mtod(m, struct ip6_hdr *);
-
-		/* IP header fields included in the TCP checksum */
-		h6->ip6_nxt = IPPROTO_TCP;
-		h6->ip6_plen = htons(tlen);
-		memcpy(&h6->ip6_src, &saddr->v6, sizeof(struct in6_addr));
-		memcpy(&h6->ip6_dst, &daddr->v6, sizeof(struct in6_addr));
-
-		th = (struct tcphdr *)((caddr_t)h6 + sizeof(struct ip6_hdr));
-		break;
-#endif /* INET6 */
-	}
-
-	/* TCP header */
-	th->th_sport = sport;
-	th->th_dport = dport;
-	th->th_seq = htonl(seq);
-	th->th_ack = htonl(ack);
-	th->th_off = tlen >> 2;
-	th->th_flags = flags;
-	th->th_win = htons(win);
-
-	if (mss) {
-		opt = (char *)(th + 1);
-		opt[0] = TCPOPT_MAXSEG;
-		opt[1] = 4;
-		HTONS(mss);
-		bcopy((caddr_t)&mss, (caddr_t)(opt + 2), 2);
-	}
-
-	switch (af) {
-#ifdef INET
-	case AF_INET:
-		/* TCP checksum */
-		th->th_sum = in_cksum(m, len);
-
-		/* Finish the IP header */
-		h->ip_v = 4;
-		h->ip_hl = sizeof(*h) >> 2;
-		h->ip_tos = IPTOS_LOWDELAY;
-#ifdef __FreeBSD__
-		h->ip_off = V_path_mtu_discovery ? IP_DF : 0;
-		h->ip_len = len;
-		h->ip_ttl = ttl ? ttl : V_ip_defttl;
-#else
-		h->ip_len = htons(len);
-		h->ip_off = htons(ip_mtudisc ? IP_DF : 0);
-		h->ip_ttl = ttl ? ttl : ip_defttl;
-#endif
-		h->ip_sum = 0;
-		if (eh == NULL) {
-#ifdef __FreeBSD__
-		PF_UNLOCK();
-		ip_output(m, (void *)NULL, (void *)NULL, 0,
-		    (void *)NULL, (void *)NULL);
-		PF_LOCK();
-#else /* ! __FreeBSD__ */
-			ip_output(m, (void *)NULL, (void *)NULL, 0,
-			    (void *)NULL, (void *)NULL);
-#endif
-		} else {
-			struct route		 ro;
-			struct rtentry		 rt;
-			struct ether_header	*e = (void *)ro.ro_dst.sa_data;
-
-			if (ifp == NULL) {
-				m_freem(m);
-				return;
-			}
-			rt.rt_ifp = ifp;
-			ro.ro_rt = &rt;
-			ro.ro_dst.sa_len = sizeof(ro.ro_dst);
-			ro.ro_dst.sa_family = pseudo_AF_HDRCMPLT;
-			bcopy(eh->ether_dhost, e->ether_shost, ETHER_ADDR_LEN);
-			bcopy(eh->ether_shost, e->ether_dhost, ETHER_ADDR_LEN);
-			e->ether_type = eh->ether_type;
-#ifdef __FreeBSD__
-			PF_UNLOCK();
-			/* XXX_IMPORT: later */
-			ip_output(m, (void *)NULL, &ro, 0,
-			    (void *)NULL, (void *)NULL);
-			PF_LOCK();
-#else /* ! __FreeBSD__ */
-			ip_output(m, (void *)NULL, &ro, IP_ROUTETOETHER,
-			    (void *)NULL, (void *)NULL);
-#endif
-		}
-		break;
-#endif /* INET */
-#ifdef INET6
-	case AF_INET6:
-		/* TCP checksum */
-		th->th_sum = in6_cksum(m, IPPROTO_TCP,
-		    sizeof(struct ip6_hdr), tlen);
-
-		h6->ip6_vfc |= IPV6_VERSION;
-		h6->ip6_hlim = IPV6_DEFHLIM;
-
-#ifdef __FreeBSD__
-		PF_UNLOCK();
-		ip6_output(m, NULL, NULL, 0, NULL, NULL, NULL);
-		PF_LOCK();
-#else
-		ip6_output(m, NULL, NULL, 0, NULL, NULL, NULL);
-#endif
-		break;
-#endif /* INET6 */
-	}
-}
-
-static void
-pf_send_icmp(struct mbuf *m, u_int8_t type, u_int8_t code, sa_family_t af,
-    struct pf_rule *r)
-{
-	struct mbuf	*m0;
-#ifdef __FreeBSD__
-#ifdef INET
-	struct ip *ip;
-#endif
-	struct pf_mtag *pf_mtag;
-#endif
-
-#ifdef __FreeBSD__
-	m0 = m_copypacket(m, M_DONTWAIT);
-	if (m0 == NULL)
-		return;
-#else
-	if ((m0 = m_copy(m, 0, M_COPYALL)) == NULL)
-		return;
-#endif
-
-#ifdef __FreeBSD__
-	if ((pf_mtag = pf_get_mtag(m0)) == NULL)
-		return;
-	/* XXX: revisit */
-	m0->m_flags |= M_SKIP_FIREWALL;
-#else
-	m0->m_pkthdr.pf.flags |= PF_TAG_GENERATED;
-#endif
-
-	if (r->rtableid >= 0)
-#ifdef __FreeBSD__
-	{
-		M_SETFIB(m0, r->rtableid);
-		pf_mtag->rtableid = r->rtableid;
-#else
-		m0->m_pkthdr.pf.rtableid = r->rtableid;
-#endif
-#ifdef __FreeBSD__
-	}
-#endif
-
-#ifdef ALTQ
-	if (r->qid) {
-#ifdef __FreeBSD__
-		pf_mtag->qid = r->qid;
-		/* add hints for ecn */
-		pf_mtag->hdr = mtod(m0, struct ip *);
-#else
-		m0->m_pkthdr.pf.qid = r->qid;
-		/* add hints for ecn */
-		m0->m_pkthdr.pf.hdr = mtod(m0, struct ip *);
-#endif
-	}
-#endif /* ALTQ */
-
-	switch (af) {
-#ifdef INET
-	case AF_INET:
-#ifdef __FreeBSD__
-		/* icmp_error() expects host byte ordering */
-		ip = mtod(m0, struct ip *);
-		NTOHS(ip->ip_len);
-		NTOHS(ip->ip_off);
-		PF_UNLOCK();
-		icmp_error(m0, type, code, 0, 0);
-		PF_LOCK();
-#else
-		icmp_error(m0, type, code, 0, 0);
-#endif
-		break;
-#endif /* INET */
-#ifdef INET6
-	case AF_INET6:
-#ifdef __FreeBSD__
-		PF_UNLOCK();
-#endif
-		icmp6_error(m0, type, code, 0);
-#ifdef __FreeBSD__
-		PF_LOCK();
-#endif
-		break;
-#endif /* INET6 */
-	}
-}
-
-/*
- * Return 1 if the addresses a and b match (with mask m), otherwise return 0.
- * If n is 0, they match if they are equal. If n is != 0, they match if they
- * are different.
- */
-int
-pf_match_addr(u_int8_t n, struct pf_addr *a, struct pf_addr *m,
-    struct pf_addr *b, sa_family_t af)
-{
-	int	match = 0;
-
-	switch (af) {
-#ifdef INET
-	case AF_INET:
-		if ((a->addr32[0] & m->addr32[0]) ==
-		    (b->addr32[0] & m->addr32[0]))
-			match++;
-		break;
-#endif /* INET */
-#ifdef INET6
-	case AF_INET6:
-		if (((a->addr32[0] & m->addr32[0]) ==
-		     (b->addr32[0] & m->addr32[0])) &&
-		    ((a->addr32[1] & m->addr32[1]) ==
-		     (b->addr32[1] & m->addr32[1])) &&
-		    ((a->addr32[2] & m->addr32[2]) ==
-		     (b->addr32[2] & m->addr32[2])) &&
-		    ((a->addr32[3] & m->addr32[3]) ==
-		     (b->addr32[3] & m->addr32[3])))
-			match++;
-		break;
-#endif /* INET6 */
-	}
-	if (match) {
-		if (n)
-			return (0);
-		else
-			return (1);
-	} else {
-		if (n)
-			return (1);
-		else
-			return (0);
-	}
-}
-
-/*
- * Return 1 if b <= a <= e, otherwise return 0.
- */
-int
-pf_match_addr_range(struct pf_addr *b, struct pf_addr *e,
-    struct pf_addr *a, sa_family_t af)
-{
-	switch (af) {
-#ifdef INET
-	case AF_INET:
-		if ((a->addr32[0] < b->addr32[0]) ||
-		    (a->addr32[0] > e->addr32[0]))
-			return (0);
-		break;
-#endif /* INET */
-#ifdef INET6
-	case AF_INET6: {
-		int	i;
-
-		/* check a >= b */
-		for (i = 0; i < 4; ++i)
-			if (a->addr32[i] > b->addr32[i])
-				break;
-			else if (a->addr32[i] < b->addr32[i])
-				return (0);
-		/* check a <= e */
-		for (i = 0; i < 4; ++i)
-			if (a->addr32[i] < e->addr32[i])
-				break;
-			else if (a->addr32[i] > e->addr32[i])
-				return (0);
-		break;
-	}
-#endif /* INET6 */
-	}
-	return (1);
-}
-
-int
-pf_match(u_int8_t op, u_int32_t a1, u_int32_t a2, u_int32_t p)
-{
-	switch (op) {
-	case PF_OP_IRG:
-		return ((p > a1) && (p < a2));
-	case PF_OP_XRG:
-		return ((p < a1) || (p > a2));
-	case PF_OP_RRG:
-		return ((p >= a1) && (p <= a2));
-	case PF_OP_EQ:
-		return (p == a1);
-	case PF_OP_NE:
-		return (p != a1);
-	case PF_OP_LT:
-		return (p < a1);
-	case PF_OP_LE:
-		return (p <= a1);
-	case PF_OP_GT:
-		return (p > a1);
-	case PF_OP_GE:
-		return (p >= a1);
-	}
-	return (0); /* never reached */
-}
-
-int
-pf_match_port(u_int8_t op, u_int16_t a1, u_int16_t a2, u_int16_t p)
-{
-	NTOHS(a1);
-	NTOHS(a2);
-	NTOHS(p);
-	return (pf_match(op, a1, a2, p));
-}
-
-int
-pf_match_uid(u_int8_t op, uid_t a1, uid_t a2, uid_t u)
-{
-	if (u == UID_MAX && op != PF_OP_EQ && op != PF_OP_NE)
-		return (0);
-	return (pf_match(op, a1, a2, u));
-}
-
-int
-pf_match_gid(u_int8_t op, gid_t a1, gid_t a2, gid_t g)
-{
-	if (g == GID_MAX && op != PF_OP_EQ && op != PF_OP_NE)
-		return (0);
-	return (pf_match(op, a1, a2, g));
-}
-
-int
-#ifdef __FreeBSD__
-pf_match_tag(struct mbuf *m, struct pf_rule *r, int *tag,
-    struct pf_mtag *pf_mtag)
-#else
-pf_match_tag(struct mbuf *m, struct pf_rule *r, int *tag)
-#endif
-{
-	if (*tag == -1)
-#ifdef __FreeBSD__
-		*tag = pf_mtag->tag;
-#else
-		*tag = m->m_pkthdr.pf.tag;
-#endif
-
-	return ((!r->match_tag_not && r->match_tag == *tag) ||
-	    (r->match_tag_not && r->match_tag != *tag));
-}
-
-int
-#ifdef __FreeBSD__
-pf_tag_packet(struct mbuf *m, int tag, int rtableid,
-    struct pf_mtag *pf_mtag)
-#else
-pf_tag_packet(struct mbuf *m, int tag, int rtableid)
-#endif
-{
-	if (tag <= 0 && rtableid < 0)
-		return (0);
-
-	if (tag > 0)
-#ifdef __FreeBSD__
-		pf_mtag->tag = tag;
-#else
-		m->m_pkthdr.pf.tag = tag;
-#endif
-	if (rtableid >= 0)
-#ifdef __FreeBSD__
-	{
-		M_SETFIB(m, rtableid);
-	}
-#else
-		m->m_pkthdr.pf.rtableid = rtableid;
-#endif
-
-	return (0);
-}
-
-void
-pf_step_into_anchor(int *depth, struct pf_ruleset **rs, int n,
-    struct pf_rule **r, struct pf_rule **a, int *match)
-{
-	struct pf_anchor_stackframe	*f;
-
-	(*r)->anchor->match = 0;
-	if (match)
-		*match = 0;
-#ifdef __FreeBSD__
-	if (*depth >= sizeof(V_pf_anchor_stack) /
-	    sizeof(V_pf_anchor_stack[0])) {
-#else
-	if (*depth >= sizeof(pf_anchor_stack) /
-	    sizeof(pf_anchor_stack[0])) {
-#endif
-		printf("pf_step_into_anchor: stack overflow\n");
-		*r = TAILQ_NEXT(*r, entries);
-		return;
-	} else if (*depth == 0 && a != NULL)
-		*a = *r;
-#ifdef __FreeBSD__
-	f = V_pf_anchor_stack + (*depth)++;
-#else
-	f = pf_anchor_stack + (*depth)++;
-#endif
-	f->rs = *rs;
-	f->r = *r;
-	if ((*r)->anchor_wildcard) {
-		f->parent = &(*r)->anchor->children;
-		if ((f->child = RB_MIN(pf_anchor_node, f->parent)) ==
-		    NULL) {
-			*r = NULL;
-			return;
-		}
-		*rs = &f->child->ruleset;
-	} else {
-		f->parent = NULL;
-		f->child = NULL;
-		*rs = &(*r)->anchor->ruleset;
-	}
-	*r = TAILQ_FIRST((*rs)->rules[n].active.ptr);
-}
-
-int
-pf_step_out_of_anchor(int *depth, struct pf_ruleset **rs, int n,
-    struct pf_rule **r, struct pf_rule **a, int *match)
-{
-	struct pf_anchor_stackframe	*f;
-	int quick = 0;
-
-	do {
-		if (*depth <= 0)
-			break;
-#ifdef __FreeBSD__
-		f = V_pf_anchor_stack + *depth - 1;
-#else
-		f = pf_anchor_stack + *depth - 1;
-#endif
-		if (f->parent != NULL && f->child != NULL) {
-			if (f->child->match ||
-			    (match != NULL && *match)) {
-				f->r->anchor->match = 1;
-				*match = 0;
-			}
-			f->child = RB_NEXT(pf_anchor_node, f->parent, f->child);
-			if (f->child != NULL) {
-				*rs = &f->child->ruleset;
-				*r = TAILQ_FIRST((*rs)->rules[n].active.ptr);
-				if (*r == NULL)
-					continue;
-				else
-					break;
-			}
-		}
-		(*depth)--;
-		if (*depth == 0 && a != NULL)
-			*a = NULL;
-		*rs = f->rs;
-		if (f->r->anchor->match || (match != NULL && *match))
-			quick = f->r->quick;
-		*r = TAILQ_NEXT(f->r, entries);
-	} while (*r == NULL);
-
-	return (quick);
-}
-
-#ifdef INET6
-void
-pf_poolmask(struct pf_addr *naddr, struct pf_addr *raddr,
-    struct pf_addr *rmask, struct pf_addr *saddr, sa_family_t af)
-{
-	switch (af) {
-#ifdef INET
-	case AF_INET:
-		naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) |
-		((rmask->addr32[0] ^ 0xffffffff ) & saddr->addr32[0]);
-		break;
-#endif /* INET */
-	case AF_INET6:
-		naddr->addr32[0] = (raddr->addr32[0] & rmask->addr32[0]) |
-		((rmask->addr32[0] ^ 0xffffffff ) & saddr->addr32[0]);
-		naddr->addr32[1] = (raddr->addr32[1] & rmask->addr32[1]) |
-		((rmask->addr32[1] ^ 0xffffffff ) & saddr->addr32[1]);
-		naddr->addr32[2] = (raddr->addr32[2] & rmask->addr32[2]) |
-		((rmask->addr32[2] ^ 0xffffffff ) & saddr->addr32[2]);
-		naddr->addr32[3] = (raddr->addr32[3] & rmask->addr32[3]) |
-		((rmask->addr32[3] ^ 0xffffffff ) & saddr->addr32[3]);
-		break;
-	}
-}
-
-void
-pf_addr_inc(struct pf_addr *addr, sa_family_t af)
-{
-	switch (af) {
-#ifdef INET
-	case AF_INET:
-		addr->addr32[0] = htonl(ntohl(addr->addr32[0]) + 1);
-		break;
-#endif /* INET */
-	case AF_INET6:
-		if (addr->addr32[3] == 0xffffffff) {
-			addr->addr32[3] = 0;
-			if (addr->addr32[2] == 0xffffffff) {
-				addr->addr32[2] = 0;
-				if (addr->addr32[1] == 0xffffffff) {
-					addr->addr32[1] = 0;
-					addr->addr32[0] =
-					    htonl(ntohl(addr->addr32[0]) + 1);
-				} else
-					addr->addr32[1] =
-					    htonl(ntohl(addr->addr32[1]) + 1);
-			} else
-				addr->addr32[2] =
-				    htonl(ntohl(addr->addr32[2]) + 1);
-		} else
-			addr->addr32[3] =
-			    htonl(ntohl(addr->addr32[3]) + 1);
-		break;
-	}
-}
-#endif /* INET6 */
-
-int
-#ifdef __FreeBSD__
-pf_socket_lookup(int direction, struct pf_pdesc *pd, struct inpcb *inp_arg)
-#else
-pf_socket_lookup(int direction, struct pf_pdesc *pd)
-#endif
-{
-	struct pf_addr		*saddr, *daddr;
-	u_int16_t		 sport, dport;
-#ifdef __FreeBSD__
-	struct inpcbinfo	*pi;
-#else
-	struct inpcbtable	*tb;
-#endif
-	struct inpcb		*inp;
-
-	if (pd == NULL)
-		return (-1);
-	pd->lookup.uid = UID_MAX;
-	pd->lookup.gid = GID_MAX;
-	pd->lookup.pid = NO_PID;
-
-#ifdef __FreeBSD__
-	if (inp_arg != NULL) {
-		INP_LOCK_ASSERT(inp_arg);
-		pd->lookup.uid = inp_arg->inp_cred->cr_uid;
-		pd->lookup.gid = inp_arg->inp_cred->cr_groups[0];
-		return (1);
-	}
-#endif
-
-	switch (pd->proto) {
-	case IPPROTO_TCP:
-		if (pd->hdr.tcp == NULL)
-			return (-1);
-		sport = pd->hdr.tcp->th_sport;
-		dport = pd->hdr.tcp->th_dport;
-#ifdef __FreeBSD__
-		pi = &V_tcbinfo;
-#else
-		tb = &tcbtable;
-#endif
-		break;
-	case IPPROTO_UDP:
-		if (pd->hdr.udp == NULL)
-			return (-1);
-		sport = pd->hdr.udp->uh_sport;
-		dport = pd->hdr.udp->uh_dport;
-#ifdef __FreeBSD__
-		pi = &V_udbinfo;
-#else
-		tb = &udbtable;
-#endif
-		break;
-	default:
-		return (-1);
-	}
-	if (direction == PF_IN) {
-		saddr = pd->src;
-		daddr = pd->dst;
-	} else {
-		u_int16_t	p;
-
-		p = sport;
-		sport = dport;
-		dport = p;
-		saddr = pd->dst;
-		daddr = pd->src;
-	}
-	switch (pd->af) {
-#ifdef INET
-	case AF_INET:
-#ifdef __FreeBSD__
-		/*
-		 * XXXRW: would be nice if we had an mbuf here so that we
-		 * could use in_pcblookup_mbuf().
-		 */
-		inp = in_pcblookup(pi, saddr->v4, sport, daddr->v4,
-			dport, INPLOOKUP_RLOCKPCB, NULL);
-		if (inp == NULL) {
-			inp = in_pcblookup(pi, saddr->v4, sport,
-			   daddr->v4, dport, INPLOOKUP_WILDCARD |
-			   INPLOOKUP_RLOCKPCB, NULL);
-			if (inp == NULL)
-				return (-1);
-		}
-#else
-		inp = in_pcbhashlookup(tb, saddr->v4, sport, daddr->v4, dport);
-		if (inp == NULL) {
-			inp = in_pcblookup_listen(tb, daddr->v4, dport, 0,
-			    NULL);
-			if (inp == NULL)
-				return (-1);
-		}
-#endif
-		break;
-#endif /* INET */
-#ifdef INET6
-	case AF_INET6:
-#ifdef __FreeBSD__
-		/*
-		 * XXXRW: would be nice if we had an mbuf here so that we
-		 * could use in6_pcblookup_mbuf().
-		 */
-		inp = in6_pcblookup(pi, &saddr->v6, sport,
-			&daddr->v6, dport, INPLOOKUP_RLOCKPCB, NULL);
-		if (inp == NULL) {
-			inp = in6_pcblookup(pi, &saddr->v6, sport,
-			    &daddr->v6, dport, INPLOOKUP_WILDCARD |
-			    INPLOOKUP_RLOCKPCB, NULL);
-			if (inp == NULL)
-				return (-1);
-		}
-#else
-		inp = in6_pcbhashlookup(tb, &saddr->v6, sport, &daddr->v6,
-		    dport);
-		if (inp == NULL) {
-			inp = in6_pcblookup_listen(tb, &daddr->v6, dport, 0,
-			    NULL);
-			if (inp == NULL)
-				return (-1);
-		}
-#endif
-		break;
-#endif /* INET6 */
-
-	default:
-		return (-1);
-	}
-#ifdef __FreeBSD__
-	INP_RLOCK_ASSERT(inp);
-	pd->lookup.uid = inp->inp_cred->cr_uid;
-	pd->lookup.gid = inp->inp_cred->cr_groups[0];
-	INP_RUNLOCK(inp);
-#else
-	pd->lookup.uid = inp->inp_socket->so_euid;
-	pd->lookup.gid = inp->inp_socket->so_egid;
-	pd->lookup.pid = inp->inp_socket->so_cpid;
-#endif
-	return (1);
-}
-
-u_int8_t
-pf_get_wscale(struct mbuf *m, int off, u_int16_t th_off, sa_family_t af)
-{
-	int		 hlen;
-	u_int8_t	 hdr[60];
-	u_int8_t	*opt, optlen;
-	u_int8_t	 wscale = 0;
-
-	hlen = th_off << 2;		/* hlen <= sizeof(hdr) */
-	if (hlen <= sizeof(struct tcphdr))
-		return (0);
-	if (!pf_pull_hdr(m, off, hdr, hlen, NULL, NULL, af))
-		return (0);
-	opt = hdr + sizeof(struct tcphdr);
-	hlen -= sizeof(struct tcphdr);
-	while (hlen >= 3) {
-		switch (*opt) {
-		case TCPOPT_EOL:
-		case TCPOPT_NOP:
-			++opt;
-			--hlen;
-			break;
-		case TCPOPT_WINDOW:
-			wscale = opt[2];
-			if (wscale > TCP_MAX_WINSHIFT)
-				wscale = TCP_MAX_WINSHIFT;
-			wscale |= PF_WSCALE_FLAG;
-			/* FALLTHROUGH */
-		default:
-			optlen = opt[1];
-			if (optlen < 2)
-				optlen = 2;
-			hlen -= optlen;
-			opt += optlen;
-			break;
-		}
-	}
-	return (wscale);
-}
-
-u_int16_t
-pf_get_mss(struct mbuf *m, int off, u_int16_t th_off, sa_family_t af)
-{
-	int		 hlen;
-	u_int8_t	 hdr[60];
-	u_int8_t	*opt, optlen;
-#ifdef __FreeBSD__
-	u_int16_t	 mss = V_tcp_mssdflt;
-#else
-	u_int16_t	 mss = tcp_mssdflt;
-#endif
-
-	hlen = th_off << 2;	/* hlen <= sizeof(hdr) */
-	if (hlen <= sizeof(struct tcphdr))
-		return (0);
-	if (!pf_pull_hdr(m, off, hdr, hlen, NULL, NULL, af))
-		return (0);
-	opt = hdr + sizeof(struct tcphdr);
-	hlen -= sizeof(struct tcphdr);
-	while (hlen >= TCPOLEN_MAXSEG) {
-		switch (*opt) {
-		case TCPOPT_EOL:
-		case TCPOPT_NOP:
-			++opt;
-			--hlen;
-			break;
-		case TCPOPT_MAXSEG:
-			bcopy((caddr_t)(opt + 2), (caddr_t)&mss, 2);
-			NTOHS(mss);
-			/* FALLTHROUGH */
-		default:
-			optlen = opt[1];
-			if (optlen < 2)
-				optlen = 2;
-			hlen -= optlen;
-			opt += optlen;
-			break;
-		}
-	}
-	return (mss);
-}
-
-u_int16_t
-pf_calc_mss(struct pf_addr *addr, sa_family_t af, int rtableid, u_int16_t offer)
-{
-#ifdef INET
-	struct sockaddr_in	*dst;
-	struct route		 ro;
-#endif /* INET */
-#ifdef INET6
-	struct sockaddr_in6	*dst6;
-	struct route_in6	 ro6;
-#endif /* INET6 */
-	struct rtentry		*rt = NULL;
-#ifdef __FreeBSD__
-	int			 hlen = 0;
-	u_int16_t		 mss = V_tcp_mssdflt;
-#else
-	int			 hlen;
-	u_int16_t		 mss = tcp_mssdflt;
-#endif
-
-	switch (af) {
-#ifdef INET
-	case AF_INET:
-		hlen = sizeof(struct ip);
-		bzero(&ro, sizeof(ro));
-		dst = (struct sockaddr_in *)&ro.ro_dst;
-		dst->sin_family = AF_INET;
-		dst->sin_len = sizeof(*dst);
-		dst->sin_addr = addr->v4;
-#ifdef __FreeBSD__
-		in_rtalloc_ign(&ro, 0, rtableid);
-#else /* ! __FreeBSD__ */
-		rtalloc_noclone(&ro, NO_CLONING);
-#endif
-		rt = ro.ro_rt;
-		break;
-#endif /* INET */
-#ifdef INET6
-	case AF_INET6:
-		hlen = sizeof(struct ip6_hdr);
-		bzero(&ro6, sizeof(ro6));
-		dst6 = (struct sockaddr_in6 *)&ro6.ro_dst;
-		dst6->sin6_family = AF_INET6;
-		dst6->sin6_len = sizeof(*dst6);
-		dst6->sin6_addr = addr->v6;
-#ifdef __FreeBSD__
-		in6_rtalloc_ign(&ro6, 0, rtableid);
-#else /* ! __FreeBSD__ */
-		rtalloc_noclone((struct route *)&ro6, NO_CLONING);
-#endif
-		rt = ro6.ro_rt;
-		break;
-#endif /* INET6 */
-	}
-
-	if (rt && rt->rt_ifp) {
-		mss = rt->rt_ifp->if_mtu - hlen - sizeof(struct tcphdr);
-#ifdef __FreeBSD__
-		mss = max(V_tcp_mssdflt, mss);
-#else
-		mss = max(tcp_mssdflt, mss);
-#endif
-		RTFREE(rt);
-	}
-	mss = min(mss, offer);
-	mss = max(mss, 64);		/* sanity - at least max opt space */
-	return (mss);
-}
-
-void
-pf_set_rt_ifp(struct pf_state *s, struct pf_addr *saddr)
-{
-	struct pf_rule *r = s->rule.ptr;
-	struct pf_src_node *sn = NULL;
-
-	s->rt_kif = NULL;
-	if (!r->rt || r->rt == PF_FASTROUTE)
-		return;
-	switch (s->key[PF_SK_WIRE]->af) {
-#ifdef INET
-	case AF_INET:
-		pf_map_addr(AF_INET, r, saddr, &s->rt_addr, NULL, &sn);
-		s->rt_kif = r->rpool.cur->kif;
-		break;
-#endif /* INET */
-#ifdef INET6
-	case AF_INET6:
-		pf_map_addr(AF_INET6, r, saddr, &s->rt_addr, NULL, &sn);
-		s->rt_kif = r->rpool.cur->kif;
-		break;
-#endif /* INET6 */
-	}
-}
-
-u_int32_t
-pf_tcp_iss(struct pf_pdesc *pd)
-{
-	MD5_CTX ctx;
-	u_int32_t digest[4];
-
-#ifdef __FreeBSD__
-	if (V_pf_tcp_secret_init == 0) {
-		read_random(&V_pf_tcp_secret, sizeof(V_pf_tcp_secret));
-		MD5Init(&V_pf_tcp_secret_ctx);
-		MD5Update(&V_pf_tcp_secret_ctx, V_pf_tcp_secret,
-		    sizeof(V_pf_tcp_secret));
-		V_pf_tcp_secret_init = 1;
-	}
-
-	ctx = V_pf_tcp_secret_ctx;
-#else
-	if (pf_tcp_secret_init == 0) {
-		arc4random_buf(pf_tcp_secret, sizeof(pf_tcp_secret));
-		MD5Init(&pf_tcp_secret_ctx);
-		MD5Update(&pf_tcp_secret_ctx, pf_tcp_secret,
-		    sizeof(pf_tcp_secret));
-		pf_tcp_secret_init = 1;
-	}
-
-	ctx = pf_tcp_secret_ctx;
-#endif
-
-	MD5Update(&ctx, (char *)&pd->hdr.tcp->th_sport, sizeof(u_short));
-	MD5Update(&ctx, (char *)&pd->hdr.tcp->th_dport, sizeof(u_short));
-	if (pd->af == AF_INET6) {
-		MD5Update(&ctx, (char *)&pd->src->v6, sizeof(struct in6_addr));
-		MD5Update(&ctx, (char *)&pd->dst->v6, sizeof(struct in6_addr));
-	} else {
-		MD5Update(&ctx, (char *)&pd->src->v4, sizeof(struct in_addr));
-		MD5Update(&ctx, (char *)&pd->dst->v4, sizeof(struct in_addr));
-	}
-	MD5Final((u_char *)digest, &ctx);
-#ifdef __FreeBSD__
-	V_pf_tcp_iss_off += 4096;
-#define	ISN_RANDOM_INCREMENT (4096 - 1)
-	return (digest[0] + (arc4random() & ISN_RANDOM_INCREMENT) +
-	    V_pf_tcp_iss_off);
-#undef	ISN_RANDOM_INCREMENT
-#else
-	pf_tcp_iss_off += 4096;
-	return (digest[0] + tcp_iss + pf_tcp_iss_off);
-#endif
-}
-
-int
-pf_test_rule(struct pf_rule **rm, struct pf_state **sm, int direction,
-    struct pfi_kif *kif, struct mbuf *m, int off, void *h,
-    struct pf_pdesc *pd, struct pf_rule **am, struct pf_ruleset **rsm,
-#ifdef __FreeBSD__
-    struct ifqueue *ifq, struct inpcb *inp)
-#else
-    struct ifqueue *ifq)
-#endif
-{
-	struct pf_rule		*nr = NULL;
-	struct pf_addr		*saddr = pd->src, *daddr = pd->dst;
-	sa_family_t		 af = pd->af;
-	struct pf_rule		*r, *a = NULL;
-	struct pf_ruleset	*ruleset = NULL;
-	struct pf_src_node	*nsn = NULL;
-	struct tcphdr		*th = pd->hdr.tcp;
-	struct pf_state_key	*skw = NULL, *sks = NULL;
-	struct pf_state_key	*sk = NULL, *nk = NULL;
-	u_short			 reason;
-	int			 rewrite = 0, hdrlen = 0;
-	int			 tag = -1, rtableid = -1;
-	int			 asd = 0;
-	int			 match = 0;
-	int			 state_icmp = 0;
-#ifdef __FreeBSD__
-	u_int16_t		 sport = 0, dport = 0;
-	u_int16_t		 bproto_sum = 0, bip_sum = 0;
-#else
-	u_int16_t		 sport, dport;
-	u_int16_t		 bproto_sum = 0, bip_sum;
-#endif
-	u_int8_t		 icmptype = 0, icmpcode = 0;
-
-
-	if (direction == PF_IN && pf_check_congestion(ifq)) {
-		REASON_SET(&reason, PFRES_CONGEST);
-		return (PF_DROP);
-	}
-
-#ifdef __FreeBSD__
-	if (inp != NULL)
-		pd->lookup.done = pf_socket_lookup(direction, pd, inp);
-	else if (V_debug_pfugidhack) {
-		PF_UNLOCK();
-		DPFPRINTF(PF_DEBUG_MISC, ("pf: unlocked lookup\n"));
-		    pd->lookup.done = pf_socket_lookup(direction, pd, inp);
-		PF_LOCK();
-	}
-#endif
-
-	switch (pd->proto) {
-	case IPPROTO_TCP:
-		sport = th->th_sport;
-		dport = th->th_dport;
-		hdrlen = sizeof(*th);
-		break;
-	case IPPROTO_UDP:
-		sport = pd->hdr.udp->uh_sport;
-		dport = pd->hdr.udp->uh_dport;
-		hdrlen = sizeof(*pd->hdr.udp);
-		break;
-#ifdef INET
-	case IPPROTO_ICMP:
-		if (pd->af != AF_INET)
-			break;
-		sport = dport = pd->hdr.icmp->icmp_id;
-		hdrlen = sizeof(*pd->hdr.icmp);
-		icmptype = pd->hdr.icmp->icmp_type;
-		icmpcode = pd->hdr.icmp->icmp_code;
-
-		if (icmptype == ICMP_UNREACH ||
-		    icmptype == ICMP_SOURCEQUENCH ||
-		    icmptype == ICMP_REDIRECT ||
-		    icmptype == ICMP_TIMXCEED ||
-		    icmptype == ICMP_PARAMPROB)
-			state_icmp++;
-		break;
-#endif /* INET */
-#ifdef INET6
-	case IPPROTO_ICMPV6:
-		if (af != AF_INET6)
-			break;
-		sport = dport = pd->hdr.icmp6->icmp6_id;
-		hdrlen = sizeof(*pd->hdr.icmp6);
-		icmptype = pd->hdr.icmp6->icmp6_type;
-		icmpcode = pd->hdr.icmp6->icmp6_code;
-
-		if (icmptype == ICMP6_DST_UNREACH ||
-		    icmptype == ICMP6_PACKET_TOO_BIG ||
-		    icmptype == ICMP6_TIME_EXCEEDED ||
-		    icmptype == ICMP6_PARAM_PROB)
-			state_icmp++;
-		break;
-#endif /* INET6 */
-	default:
-		sport = dport = hdrlen = 0;
-		break;
-	}
-
-	r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr);
-
-	/* check packet for BINAT/NAT/RDR */
-	if ((nr = pf_get_translation(pd, m, off, direction, kif, &nsn,
-	    &skw, &sks, &sk, &nk, saddr, daddr, sport, dport)) != NULL) {
-		if (nk == NULL || sk == NULL) {
-			REASON_SET(&reason, PFRES_MEMORY);
-			goto cleanup;
-		}
-
-		if (pd->ip_sum)
-			bip_sum = *pd->ip_sum;
-
-		switch (pd->proto) {
-		case IPPROTO_TCP:
-			bproto_sum = th->th_sum;
-			pd->proto_sum = &th->th_sum;
-
-			if (PF_ANEQ(saddr, &nk->addr[pd->sidx], af) ||
-			    nk->port[pd->sidx] != sport) {
-				pf_change_ap(saddr, &th->th_sport, pd->ip_sum,
-				    &th->th_sum, &nk->addr[pd->sidx],
-				    nk->port[pd->sidx], 0, af);
-				pd->sport = &th->th_sport;
-				sport = th->th_sport;
-			}
-
-			if (PF_ANEQ(daddr, &nk->addr[pd->didx], af) ||
-			    nk->port[pd->didx] != dport) {
-				pf_change_ap(daddr, &th->th_dport, pd->ip_sum,
-				    &th->th_sum, &nk->addr[pd->didx],
-				    nk->port[pd->didx], 0, af);
-				dport = th->th_dport;
-				pd->dport = &th->th_dport;
-			}
-			rewrite++;
-			break;
-		case IPPROTO_UDP:
-			bproto_sum = pd->hdr.udp->uh_sum;
-			pd->proto_sum = &pd->hdr.udp->uh_sum;
-
-			if (PF_ANEQ(saddr, &nk->addr[pd->sidx], af) ||
-			    nk->port[pd->sidx] != sport) {
-				pf_change_ap(saddr, &pd->hdr.udp->uh_sport,
-				    pd->ip_sum, &pd->hdr.udp->uh_sum,
-				    &nk->addr[pd->sidx],
-				    nk->port[pd->sidx], 1, af);
-				sport = pd->hdr.udp->uh_sport;
-				pd->sport = &pd->hdr.udp->uh_sport;
-			}
-
-			if (PF_ANEQ(daddr, &nk->addr[pd->didx], af) ||
-			    nk->port[pd->didx] != dport) {
-				pf_change_ap(daddr, &pd->hdr.udp->uh_dport,
-				    pd->ip_sum, &pd->hdr.udp->uh_sum,
-				    &nk->addr[pd->didx],
-				    nk->port[pd->didx], 1, af);
-				dport = pd->hdr.udp->uh_dport;
-				pd->dport = &pd->hdr.udp->uh_dport;
-			}
-			rewrite++;
-			break;
-#ifdef INET
-		case IPPROTO_ICMP:
-			nk->port[0] = nk->port[1];
-			if (PF_ANEQ(saddr, &nk->addr[pd->sidx], AF_INET))
-				pf_change_a(&saddr->v4.s_addr, pd->ip_sum,
-				    nk->addr[pd->sidx].v4.s_addr, 0);
-
-			if (PF_ANEQ(daddr, &nk->addr[pd->didx], AF_INET))
-				pf_change_a(&daddr->v4.s_addr, pd->ip_sum,
-				    nk->addr[pd->didx].v4.s_addr, 0);
-
-			if (nk->port[1] != pd->hdr.icmp->icmp_id) {
-				pd->hdr.icmp->icmp_cksum = pf_cksum_fixup(
-				    pd->hdr.icmp->icmp_cksum, sport,
-				    nk->port[1], 0);
-				pd->hdr.icmp->icmp_id = nk->port[1];
-				pd->sport = &pd->hdr.icmp->icmp_id;
-			}
-			m_copyback(m, off, ICMP_MINLEN, (caddr_t)pd->hdr.icmp);
-			break;
-#endif /* INET */
-#ifdef INET6
-		case IPPROTO_ICMPV6:
-			nk->port[0] = nk->port[1];
-			if (PF_ANEQ(saddr, &nk->addr[pd->sidx], AF_INET6))
-				pf_change_a6(saddr, &pd->hdr.icmp6->icmp6_cksum,
-				    &nk->addr[pd->sidx], 0);
-
-			if (PF_ANEQ(daddr, &nk->addr[pd->didx], AF_INET6))
-				pf_change_a6(daddr, &pd->hdr.icmp6->icmp6_cksum,
-				    &nk->addr[pd->didx], 0);
-			rewrite++;
-			break;
-#endif /* INET */
-		default:
-			switch (af) {
-#ifdef INET
-			case AF_INET:
-				if (PF_ANEQ(saddr,
-				    &nk->addr[pd->sidx], AF_INET))
-					pf_change_a(&saddr->v4.s_addr,
-					    pd->ip_sum,
-					    nk->addr[pd->sidx].v4.s_addr, 0);
-
-				if (PF_ANEQ(daddr,
-				    &nk->addr[pd->didx], AF_INET))
-					pf_change_a(&daddr->v4.s_addr,
-					    pd->ip_sum,
-					    nk->addr[pd->didx].v4.s_addr, 0);
-				break;
-#endif /* INET */
-#ifdef INET6
-			case AF_INET6:
-				if (PF_ANEQ(saddr,
-				    &nk->addr[pd->sidx], AF_INET6))
-					PF_ACPY(saddr, &nk->addr[pd->sidx], af);
-
-				if (PF_ANEQ(daddr,
-				    &nk->addr[pd->didx], AF_INET6))
-					PF_ACPY(saddr, &nk->addr[pd->didx], af);
-				break;
-#endif /* INET */
-			}
-			break;
-		}
-		if (nr->natpass)
-			r = NULL;
-		pd->nat_rule = nr;
-	}
-
-	while (r != NULL) {
-		r->evaluations++;
-		if (pfi_kif_match(r->kif, kif) == r->ifnot)
-			r = r->skip[PF_SKIP_IFP].ptr;
-		else if (r->direction && r->direction != direction)
-			r = r->skip[PF_SKIP_DIR].ptr;
-		else if (r->af && r->af != af)
-			r = r->skip[PF_SKIP_AF].ptr;
-		else if (r->proto && r->proto != pd->proto)
-			r = r->skip[PF_SKIP_PROTO].ptr;
-		else if (PF_MISMATCHAW(&r->src.addr, saddr, af,
-		    r->src.neg, kif, M_GETFIB(m)))
-			r = r->skip[PF_SKIP_SRC_ADDR].ptr;
-		/* tcp/udp only. port_op always 0 in other cases */
-		else if (r->src.port_op && !pf_match_port(r->src.port_op,
-		    r->src.port[0], r->src.port[1], sport))
-			r = r->skip[PF_SKIP_SRC_PORT].ptr;
-		else if (PF_MISMATCHAW(&r->dst.addr, daddr, af,
-		    r->dst.neg, NULL, M_GETFIB(m)))
-			r = r->skip[PF_SKIP_DST_ADDR].ptr;
-		/* tcp/udp only. port_op always 0 in other cases */
-		else if (r->dst.port_op && !pf_match_port(r->dst.port_op,
-		    r->dst.port[0], r->dst.port[1], dport))
-			r = r->skip[PF_SKIP_DST_PORT].ptr;
-		/* icmp only. type always 0 in other cases */
-		else if (r->type && r->type != icmptype + 1)
-			r = TAILQ_NEXT(r, entries);
-		/* icmp only. type always 0 in other cases */
-		else if (r->code && r->code != icmpcode + 1)
-			r = TAILQ_NEXT(r, entries);
-		else if (r->tos && !(r->tos == pd->tos))
-			r = TAILQ_NEXT(r, entries);
-		else if (r->rule_flag & PFRULE_FRAGMENT)
-			r = TAILQ_NEXT(r, entries);
-		else if (pd->proto == IPPROTO_TCP &&
-		    (r->flagset & th->th_flags) != r->flags)
-			r = TAILQ_NEXT(r, entries);
-		/* tcp/udp only. uid.op always 0 in other cases */
-		else if (r->uid.op && (pd->lookup.done || (pd->lookup.done =
-#ifdef __FreeBSD__
-		    pf_socket_lookup(direction, pd, inp), 1)) &&
-#else
-		    pf_socket_lookup(direction, pd), 1)) &&
-#endif
-		    !pf_match_uid(r->uid.op, r->uid.uid[0], r->uid.uid[1],
-		    pd->lookup.uid))
-			r = TAILQ_NEXT(r, entries);
-		/* tcp/udp only. gid.op always 0 in other cases */
-		else if (r->gid.op && (pd->lookup.done || (pd->lookup.done =
-#ifdef __FreeBSD__
-		    pf_socket_lookup(direction, pd, inp), 1)) &&
-#else
-		    pf_socket_lookup(direction, pd), 1)) &&
-#endif
-		    !pf_match_gid(r->gid.op, r->gid.gid[0], r->gid.gid[1],
-		    pd->lookup.gid))
-			r = TAILQ_NEXT(r, entries);
-		else if (r->prob &&
-#ifdef __FreeBSD__
-		    r->prob <= arc4random())
-#else
-		    r->prob <= arc4random_uniform(UINT_MAX - 1) + 1)
-#endif
-			r = TAILQ_NEXT(r, entries);
-#ifdef __FreeBSD__
-		else if (r->match_tag && !pf_match_tag(m, r, &tag, pd->pf_mtag))
-#else
-		else if (r->match_tag && !pf_match_tag(m, r, &tag))
-#endif
-			r = TAILQ_NEXT(r, entries);
-		else if (r->os_fingerprint != PF_OSFP_ANY &&
-		    (pd->proto != IPPROTO_TCP || !pf_osfp_match(
-		    pf_osfp_fingerprint(pd, m, off, th),
-		    r->os_fingerprint)))
-			r = TAILQ_NEXT(r, entries);
-		else {
-			if (r->tag)
-				tag = r->tag;
-			if (r->rtableid >= 0)
-				rtableid = r->rtableid;
-			if (r->anchor == NULL) {
-				match = 1;
-				*rm = r;
-				*am = a;
-				*rsm = ruleset;
-				if ((*rm)->quick)
-					break;
-				r = TAILQ_NEXT(r, entries);
-			} else
-				pf_step_into_anchor(&asd, &ruleset,
-				    PF_RULESET_FILTER, &r, &a, &match);
-		}
-		if (r == NULL && pf_step_out_of_anchor(&asd, &ruleset,
-		    PF_RULESET_FILTER, &r, &a, &match))
-			break;
-	}
-	r = *rm;
-	a = *am;
-	ruleset = *rsm;
-
-	REASON_SET(&reason, PFRES_MATCH);
-
-	if (r->log || (nr != NULL && nr->log)) {
-		if (rewrite)
-			m_copyback(m, off, hdrlen, pd->hdr.any);
-		PFLOG_PACKET(kif, h, m, af, direction, reason, r->log ? r : nr,
-		    a, ruleset, pd);
-	}
-
-	if ((r->action == PF_DROP) &&
-	    ((r->rule_flag & PFRULE_RETURNRST) ||
-	    (r->rule_flag & PFRULE_RETURNICMP) ||
-	    (r->rule_flag & PFRULE_RETURN))) {
-		/* undo NAT changes, if they have taken place */
-		if (nr != NULL) {
-			PF_ACPY(saddr, &sk->addr[pd->sidx], af);
-			PF_ACPY(daddr, &sk->addr[pd->didx], af);
-			if (pd->sport)
-				*pd->sport = sk->port[pd->sidx];
-			if (pd->dport)
-				*pd->dport = sk->port[pd->didx];
-			if (pd->proto_sum)
-				*pd->proto_sum = bproto_sum;
-			if (pd->ip_sum)
-				*pd->ip_sum = bip_sum;
-			m_copyback(m, off, hdrlen, pd->hdr.any);
-		}
-		if (pd->proto == IPPROTO_TCP &&
-		    ((r->rule_flag & PFRULE_RETURNRST) ||
-		    (r->rule_flag & PFRULE_RETURN)) &&
-		    !(th->th_flags & TH_RST)) {
-			u_int32_t	 ack = ntohl(th->th_seq) + pd->p_len;
-			int		 len = 0;
-#ifdef INET
-			struct ip	*h4;
-#endif
-#ifdef INET6
-			struct ip6_hdr	*h6;
-#endif
-
-			switch (af) {
-#ifdef INET
-			case AF_INET:
-				h4 = mtod(m, struct ip *);
-				len = ntohs(h4->ip_len) - off;
-				break;
-#endif
-#ifdef INET6
-			case AF_INET6:
-				h6 = mtod(m, struct ip6_hdr *);
-				len = ntohs(h6->ip6_plen) - (off - sizeof(*h6));
-				break;
-#endif
-			}
-
-			if (pf_check_proto_cksum(m, off, len, IPPROTO_TCP, af))
-				REASON_SET(&reason, PFRES_PROTCKSUM);
-			else {
-				if (th->th_flags & TH_SYN)
-					ack++;
-				if (th->th_flags & TH_FIN)
-					ack++;
-#ifdef __FreeBSD__
-				pf_send_tcp(m, r, af, pd->dst,
-#else
-				pf_send_tcp(r, af, pd->dst,
-#endif
-				    pd->src, th->th_dport, th->th_sport,
-				    ntohl(th->th_ack), ack, TH_RST|TH_ACK, 0, 0,
-				    r->return_ttl, 1, 0, pd->eh, kif->pfik_ifp);
-			}
-		} else if (pd->proto != IPPROTO_ICMP && af == AF_INET &&
-		    r->return_icmp)
-			pf_send_icmp(m, r->return_icmp >> 8,
-			    r->return_icmp & 255, af, r);
-		else if (pd->proto != IPPROTO_ICMPV6 && af == AF_INET6 &&
-		    r->return_icmp6)
-			pf_send_icmp(m, r->return_icmp6 >> 8,
-			    r->return_icmp6 & 255, af, r);
-	}
-
-	if (r->action == PF_DROP)
-		goto cleanup;
-
-#ifdef __FreeBSD__
-	if (pf_tag_packet(m, tag, rtableid, pd->pf_mtag)) {
-#else
-	if (pf_tag_packet(m, tag, rtableid)) {
-#endif
-		REASON_SET(&reason, PFRES_MEMORY);
-		goto cleanup;
-	}
-
-	if (!state_icmp && (r->keep_state || nr != NULL ||
-	    (pd->flags & PFDESC_TCP_NORM))) {
-		int action;
-		action = pf_create_state(r, nr, a, pd, nsn, skw, sks, nk, sk, m,
-		    off, sport, dport, &rewrite, kif, sm, tag, bproto_sum,
-		    bip_sum, hdrlen);
-		if (action != PF_PASS)
-			return (action);
-	} else {
-#ifdef __FreeBSD__
-		if (sk != NULL)
-			pool_put(&V_pf_state_key_pl, sk);
-		if (nk != NULL)
-			pool_put(&V_pf_state_key_pl, nk);
-#else
-		if (sk != NULL)
-			pool_put(&pf_state_key_pl, sk);
-		if (nk != NULL)
-			pool_put(&pf_state_key_pl, nk);
-#endif
-	}
-
-	/* copy back packet headers if we performed NAT operations */
-	if (rewrite)
-		m_copyback(m, off, hdrlen, pd->hdr.any);
-
-#if NPFSYNC > 0
-	if (*sm != NULL && !ISSET((*sm)->state_flags, PFSTATE_NOSYNC) &&
-#ifdef __FreeBSD__
-	    direction == PF_OUT && pfsync_up_ptr != NULL && pfsync_up_ptr()) {
-#else
-	    direction == PF_OUT && pfsync_up()) {
-#endif
-		/*
-		 * We want the state created, but we dont
-		 * want to send this in case a partner
-		 * firewall has to know about it to allow
-		 * replies through it.
-		 */
-#ifdef __FreeBSD__
-		if (pfsync_defer_ptr != NULL &&
-			pfsync_defer_ptr(*sm, m))
-#else
-		if (pfsync_defer(*sm, m))
-#endif
-			return (PF_DEFER);
-	}
-#endif
-
-	return (PF_PASS);
-
-cleanup:
-#ifdef __FreeBSD__
-	if (sk != NULL)
-		pool_put(&V_pf_state_key_pl, sk);
-	if (nk != NULL)
-		pool_put(&V_pf_state_key_pl, nk);
-#else
-	if (sk != NULL)
-		pool_put(&pf_state_key_pl, sk);
-	if (nk != NULL)
-		pool_put(&pf_state_key_pl, nk);
-#endif
-	return (PF_DROP);
-}
-
-static __inline int
-pf_create_state(struct pf_rule *r, struct pf_rule *nr, struct pf_rule *a,
-    struct pf_pdesc *pd, struct pf_src_node *nsn, struct pf_state_key *skw,
-    struct pf_state_key *sks, struct pf_state_key *nk, struct pf_state_key *sk,
-    struct mbuf *m, int off, u_int16_t sport, u_int16_t dport, int *rewrite,
-    struct pfi_kif *kif, struct pf_state **sm, int tag, u_int16_t bproto_sum,
-    u_int16_t bip_sum, int hdrlen)
-{
-	struct pf_state		*s = NULL;
-	struct pf_src_node	*sn = NULL;
-	struct tcphdr		*th = pd->hdr.tcp;
-#ifdef __FreeBSD__
-	u_int16_t		 mss = V_tcp_mssdflt;
-#else
-	u_int16_t		 mss = tcp_mssdflt;
-#endif
-	u_short			 reason;
-
-	/* check maximums */
-	if (r->max_states && (r->states_cur >= r->max_states)) {
-#ifdef __FreeBSD__
-		V_pf_status.lcounters[LCNT_STATES]++;
-#else
-		pf_status.lcounters[LCNT_STATES]++;
-#endif
-		REASON_SET(&reason, PFRES_MAXSTATES);
-		return (PF_DROP);
-	}
-	/* src node for filter rule */
-	if ((r->rule_flag & PFRULE_SRCTRACK ||
-	    r->rpool.opts & PF_POOL_STICKYADDR) &&
-	    pf_insert_src_node(&sn, r, pd->src, pd->af) != 0) {
-		REASON_SET(&reason, PFRES_SRCLIMIT);
-		goto csfailed;
-	}
-	/* src node for translation rule */
-	if (nr != NULL && (nr->rpool.opts & PF_POOL_STICKYADDR) &&
-	    pf_insert_src_node(&nsn, nr, &sk->addr[pd->sidx], pd->af)) {
-		REASON_SET(&reason, PFRES_SRCLIMIT);
-		goto csfailed;
-	}
-#ifdef __FreeBSD__
-	s = pool_get(&V_pf_state_pl, PR_NOWAIT | PR_ZERO);
-#else
-	s = pool_get(&pf_state_pl, PR_NOWAIT | PR_ZERO);
-#endif
-	if (s == NULL) {
-		REASON_SET(&reason, PFRES_MEMORY);
-		goto csfailed;
-	}
-	s->rule.ptr = r;
-	s->nat_rule.ptr = nr;
-	s->anchor.ptr = a;
-	STATE_INC_COUNTERS(s);
-	if (r->allow_opts)
-		s->state_flags |= PFSTATE_ALLOWOPTS;
-	if (r->rule_flag & PFRULE_STATESLOPPY)
-		s->state_flags |= PFSTATE_SLOPPY;
-	if (r->rule_flag & PFRULE_PFLOW)
-		s->state_flags |= PFSTATE_PFLOW;
-	s->log = r->log & PF_LOG_ALL;
-	s->sync_state = PFSYNC_S_NONE;
-	if (nr != NULL)
-		s->log |= nr->log & PF_LOG_ALL;
-	switch (pd->proto) {
-	case IPPROTO_TCP:
-		s->src.seqlo = ntohl(th->th_seq);
-		s->src.seqhi = s->src.seqlo + pd->p_len + 1;
-		if ((th->th_flags & (TH_SYN|TH_ACK)) == TH_SYN &&
-		    r->keep_state == PF_STATE_MODULATE) {
-			/* Generate sequence number modulator */
-			if ((s->src.seqdiff = pf_tcp_iss(pd) - s->src.seqlo) ==
-			    0)
-				s->src.seqdiff = 1;
-			pf_change_a(&th->th_seq, &th->th_sum,
-			    htonl(s->src.seqlo + s->src.seqdiff), 0);
-			*rewrite = 1;
-		} else
-			s->src.seqdiff = 0;
-		if (th->th_flags & TH_SYN) {
-			s->src.seqhi++;
-			s->src.wscale = pf_get_wscale(m, off,
-			    th->th_off, pd->af);
-		}
-		s->src.max_win = MAX(ntohs(th->th_win), 1);
-		if (s->src.wscale & PF_WSCALE_MASK) {
-			/* Remove scale factor from initial window */
-			int win = s->src.max_win;
-			win += 1 << (s->src.wscale & PF_WSCALE_MASK);
-			s->src.max_win = (win - 1) >>
-			    (s->src.wscale & PF_WSCALE_MASK);
-		}
-		if (th->th_flags & TH_FIN)
-			s->src.seqhi++;
-		s->dst.seqhi = 1;
-		s->dst.max_win = 1;
-		s->src.state = TCPS_SYN_SENT;
-		s->dst.state = TCPS_CLOSED;
-		s->timeout = PFTM_TCP_FIRST_PACKET;
-		break;
-	case IPPROTO_UDP:
-		s->src.state = PFUDPS_SINGLE;
-		s->dst.state = PFUDPS_NO_TRAFFIC;
-		s->timeout = PFTM_UDP_FIRST_PACKET;
-		break;
-	case IPPROTO_ICMP:
-#ifdef INET6
-	case IPPROTO_ICMPV6:
-#endif
-		s->timeout = PFTM_ICMP_FIRST_PACKET;
-		break;
-	default:
-		s->src.state = PFOTHERS_SINGLE;
-		s->dst.state = PFOTHERS_NO_TRAFFIC;
-		s->timeout = PFTM_OTHER_FIRST_PACKET;
-	}
-
-	s->creation = time_second;
-	s->expire = time_second;
-
-	if (sn != NULL) {
-		s->src_node = sn;
-		s->src_node->states++;
-	}
-	if (nsn != NULL) {
-		/* XXX We only modify one side for now. */
-		PF_ACPY(&nsn->raddr, &nk->addr[1], pd->af);
-		s->nat_src_node = nsn;
-		s->nat_src_node->states++;
-	}
-	if (pd->proto == IPPROTO_TCP) {
-		if ((pd->flags & PFDESC_TCP_NORM) && pf_normalize_tcp_init(m,
-		    off, pd, th, &s->src, &s->dst)) {
-			REASON_SET(&reason, PFRES_MEMORY);
-			pf_src_tree_remove_state(s);
-			STATE_DEC_COUNTERS(s);
-#ifdef __FreeBSD__
-			pool_put(&V_pf_state_pl, s);
-#else
-			pool_put(&pf_state_pl, s);
-#endif
-			return (PF_DROP);
-		}
-		if ((pd->flags & PFDESC_TCP_NORM) && s->src.scrub &&
-		    pf_normalize_tcp_stateful(m, off, pd, &reason, th, s,
-		    &s->src, &s->dst, rewrite)) {
-			/* This really shouldn't happen!!! */
-			DPFPRINTF(PF_DEBUG_URGENT,
-			    ("pf_normalize_tcp_stateful failed on first pkt"));
-			pf_normalize_tcp_cleanup(s);
-			pf_src_tree_remove_state(s);
-			STATE_DEC_COUNTERS(s);
-#ifdef __FreeBSD__
-			pool_put(&V_pf_state_pl, s);
-#else
-			pool_put(&pf_state_pl, s);
-#endif
-			return (PF_DROP);
-		}
-	}
-	s->direction = pd->dir;
-
-	if (sk == NULL && pf_state_key_setup(pd, nr, &skw, &sks, &sk, &nk,
-	    pd->src, pd->dst, sport, dport))
-		goto csfailed;
-
-	if (pf_state_insert(BOUND_IFACE(r, kif), skw, sks, s)) {
-		if (pd->proto == IPPROTO_TCP)
-			pf_normalize_tcp_cleanup(s);
-		REASON_SET(&reason, PFRES_STATEINS);
-		pf_src_tree_remove_state(s);
-		STATE_DEC_COUNTERS(s);
-#ifdef __FreeBSD__
-		pool_put(&V_pf_state_pl, s);
-#else
-		pool_put(&pf_state_pl, s);
-#endif
-		return (PF_DROP);
-	} else
-		*sm = s;
-
-	pf_set_rt_ifp(s, pd->src);	/* needs s->state_key set */
-	if (tag > 0) {
-		pf_tag_ref(tag);
-		s->tag = tag;
-	}
-	if (pd->proto == IPPROTO_TCP && (th->th_flags & (TH_SYN|TH_ACK)) ==
-	    TH_SYN && r->keep_state == PF_STATE_SYNPROXY) {
-		s->src.state = PF_TCPS_PROXY_SRC;
-		/* undo NAT changes, if they have taken place */
-		if (nr != NULL) {
-			struct pf_state_key *skt = s->key[PF_SK_WIRE];
-			if (pd->dir == PF_OUT)
-				skt = s->key[PF_SK_STACK];
-			PF_ACPY(pd->src, &skt->addr[pd->sidx], pd->af);
-			PF_ACPY(pd->dst, &skt->addr[pd->didx], pd->af);
-			if (pd->sport)
-				*pd->sport = skt->port[pd->sidx];
-			if (pd->dport)
-				*pd->dport = skt->port[pd->didx];
-			if (pd->proto_sum)
-				*pd->proto_sum = bproto_sum;
-			if (pd->ip_sum)
-				*pd->ip_sum = bip_sum;
-			m_copyback(m, off, hdrlen, pd->hdr.any);
-		}
-		s->src.seqhi = htonl(arc4random());
-		/* Find mss option */
-		int rtid = M_GETFIB(m);
-		mss = pf_get_mss(m, off, th->th_off, pd->af);
-		mss = pf_calc_mss(pd->src, pd->af, rtid, mss);
-		mss = pf_calc_mss(pd->dst, pd->af, rtid, mss);
-		s->src.mss = mss;
-#ifdef __FreeBSD__
-		pf_send_tcp(NULL, r, pd->af, pd->dst, pd->src, th->th_dport,
-#else
-		pf_send_tcp(r, pd->af, pd->dst, pd->src, th->th_dport,
-#endif
-		    th->th_sport, s->src.seqhi, ntohl(th->th_seq) + 1,
-		    TH_SYN|TH_ACK, 0, s->src.mss, 0, 1, 0, NULL, NULL);
-		REASON_SET(&reason, PFRES_SYNPROXY);
-		return (PF_SYNPROXY_DROP);
-	}
-
-	return (PF_PASS);
-
-csfailed:
-#ifdef __FreeBSD__
-	if (sk != NULL)
-		pool_put(&V_pf_state_key_pl, sk);
-	if (nk != NULL)
-		pool_put(&V_pf_state_key_pl, nk);
-#else
-	if (sk != NULL)
-		pool_put(&pf_state_key_pl, sk);
-	if (nk != NULL)
-		pool_put(&pf_state_key_pl, nk);
-#endif
-
-	if (sn != NULL && sn->states == 0 && sn->expire == 0) {
-#ifdef __FreeBSD__
-		RB_REMOVE(pf_src_tree, &V_tree_src_tracking, sn);
-		V_pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
-		V_pf_status.src_nodes--;
-		pool_put(&V_pf_src_tree_pl, sn);
-#else
-		RB_REMOVE(pf_src_tree, &tree_src_tracking, sn);
-		pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
-		pf_status.src_nodes--;
-		pool_put(&pf_src_tree_pl, sn);
-#endif
-	}
-	if (nsn != sn && nsn != NULL && nsn->states == 0 && nsn->expire == 0) {
-#ifdef __FreeBSD__
-		RB_REMOVE(pf_src_tree, &V_tree_src_tracking, nsn);
-		V_pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
-		V_pf_status.src_nodes--;
-		pool_put(&V_pf_src_tree_pl, nsn);
-#else
-		RB_REMOVE(pf_src_tree, &tree_src_tracking, nsn);
-		pf_status.scounters[SCNT_SRC_NODE_REMOVALS]++;
-		pf_status.src_nodes--;
-		pool_put(&pf_src_tree_pl, nsn);
-#endif
-	}
-	return (PF_DROP);
-}
-
-int
-pf_test_fragment(struct pf_rule **rm, int direction, struct pfi_kif *kif,
-    struct mbuf *m, void *h, struct pf_pdesc *pd, struct pf_rule **am,
-    struct pf_ruleset **rsm)
-{
-	struct pf_rule		*r, *a = NULL;
-	struct pf_ruleset	*ruleset = NULL;
-	sa_family_t		 af = pd->af;
-	u_short			 reason;
-	int			 tag = -1;
-	int			 asd = 0;
-	int			 match = 0;
-
-	r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_FILTER].active.ptr);
-	while (r != NULL) {
-		r->evaluations++;
-		if (pfi_kif_match(r->kif, kif) == r->ifnot)
-			r = r->skip[PF_SKIP_IFP].ptr;
-		else if (r->direction && r->direction != direction)
-			r = r->skip[PF_SKIP_DIR].ptr;
-		else if (r->af && r->af != af)
-			r = r->skip[PF_SKIP_AF].ptr;
-		else if (r->proto && r->proto != pd->proto)
-			r = r->skip[PF_SKIP_PROTO].ptr;
-		else if (PF_MISMATCHAW(&r->src.addr, pd->src, af,
-		    r->src.neg, kif, M_GETFIB(m)))
-			r = r->skip[PF_SKIP_SRC_ADDR].ptr;
-		else if (PF_MISMATCHAW(&r->dst.addr, pd->dst, af,
-		    r->dst.neg, NULL, M_GETFIB(m)))
-			r = r->skip[PF_SKIP_DST_ADDR].ptr;
-		else if (r->tos && !(r->tos == pd->tos))
-			r = TAILQ_NEXT(r, entries);
-		else if (r->os_fingerprint != PF_OSFP_ANY)
-			r = TAILQ_NEXT(r, entries);
-		else if (pd->proto == IPPROTO_UDP &&
-		    (r->src.port_op || r->dst.port_op))
-			r = TAILQ_NEXT(r, entries);
-		else if (pd->proto == IPPROTO_TCP &&
-		    (r->src.port_op || r->dst.port_op || r->flagset))
-			r = TAILQ_NEXT(r, entries);
-		else if ((pd->proto == IPPROTO_ICMP ||
-		    pd->proto == IPPROTO_ICMPV6) &&
-		    (r->type || r->code))
-			r = TAILQ_NEXT(r, entries);
-		else if (r->prob && r->prob <=
-		    (arc4random() % (UINT_MAX - 1) + 1))
-			r = TAILQ_NEXT(r, entries);
-#ifdef __FreeBSD__
-		else if (r->match_tag && !pf_match_tag(m, r, &tag, pd->pf_mtag))
-#else
-		else if (r->match_tag && !pf_match_tag(m, r, &tag))
-#endif
-			r = TAILQ_NEXT(r, entries);
-		else {
-			if (r->anchor == NULL) {
-				match = 1;
-				*rm = r;
-				*am = a;
-				*rsm = ruleset;
-				if ((*rm)->quick)
-					break;
-				r = TAILQ_NEXT(r, entries);
-			} else
-				pf_step_into_anchor(&asd, &ruleset,
-				    PF_RULESET_FILTER, &r, &a, &match);
-		}
-		if (r == NULL && pf_step_out_of_anchor(&asd, &ruleset,
-		    PF_RULESET_FILTER, &r, &a, &match))
-			break;
-	}
-	r = *rm;
-	a = *am;
-	ruleset = *rsm;
-
-	REASON_SET(&reason, PFRES_MATCH);
-
-	if (r->log)
-		PFLOG_PACKET(kif, h, m, af, direction, reason, r, a, ruleset,
-		    pd);
-
-	if (r->action != PF_PASS)
-		return (PF_DROP);
-
-#ifdef __FreeBSD__
-	if (pf_tag_packet(m, tag, -1, pd->pf_mtag)) {
-#else
-	if (pf_tag_packet(m, tag, -1)) {
-#endif
-		REASON_SET(&reason, PFRES_MEMORY);
-		return (PF_DROP);
-	}
-
-	return (PF_PASS);
-}
-
-int
-pf_tcp_track_full(struct pf_state_peer *src, struct pf_state_peer *dst,
-	struct pf_state **state, struct pfi_kif *kif, struct mbuf *m, int off,
-	struct pf_pdesc *pd, u_short *reason, int *copyback)
-{
-	struct tcphdr		*th = pd->hdr.tcp;
-	u_int16_t		 win = ntohs(th->th_win);
-	u_int32_t		 ack, end, seq, orig_seq;
-	u_int8_t		 sws, dws;
-	int			 ackskew;
-
-	if (src->wscale && dst->wscale && !(th->th_flags & TH_SYN)) {
-		sws = src->wscale & PF_WSCALE_MASK;
-		dws = dst->wscale & PF_WSCALE_MASK;
-	} else
-		sws = dws = 0;
-
-	/*
-	 * Sequence tracking algorithm from Guido van Rooij's paper:
-	 *   http://www.madison-gurkha.com/publications/tcp_filtering/
-	 *	tcp_filtering.ps
-	 */
-
-	orig_seq = seq = ntohl(th->th_seq);
-	if (src->seqlo == 0) {
-		/* First packet from this end. Set its state */
-
-		if ((pd->flags & PFDESC_TCP_NORM || dst->scrub) &&
-		    src->scrub == NULL) {
-			if (pf_normalize_tcp_init(m, off, pd, th, src, dst)) {
-				REASON_SET(reason, PFRES_MEMORY);
-				return (PF_DROP);
-			}
-		}
-
-		/* Deferred generation of sequence number modulator */
-		if (dst->seqdiff && !src->seqdiff) {
-			/* use random iss for the TCP server */
-			while ((src->seqdiff = arc4random() - seq) == 0)
-				;
-			ack = ntohl(th->th_ack) - dst->seqdiff;
-			pf_change_a(&th->th_seq, &th->th_sum, htonl(seq +
-			    src->seqdiff), 0);
-			pf_change_a(&th->th_ack, &th->th_sum, htonl(ack), 0);
-			*copyback = 1;
-		} else {
-			ack = ntohl(th->th_ack);
-		}
-
-		end = seq + pd->p_len;
-		if (th->th_flags & TH_SYN) {
-			end++;
-			if (dst->wscale & PF_WSCALE_FLAG) {
-				src->wscale = pf_get_wscale(m, off, th->th_off,
-				    pd->af);
-				if (src->wscale & PF_WSCALE_FLAG) {
-					/* Remove scale factor from initial
-					 * window */
-					sws = src->wscale & PF_WSCALE_MASK;
-					win = ((u_int32_t)win + (1 << sws) - 1)
-					    >> sws;
-					dws = dst->wscale & PF_WSCALE_MASK;
-				} else {
-					/* fixup other window */
-					dst->max_win <<= dst->wscale &
-					    PF_WSCALE_MASK;
-					/* in case of a retrans SYN|ACK */
-					dst->wscale = 0;
-				}
-			}
-		}
-		if (th->th_flags & TH_FIN)
-			end++;
-
-		src->seqlo = seq;
-		if (src->state < TCPS_SYN_SENT)
-			src->state = TCPS_SYN_SENT;
-
-		/*
-		 * May need to slide the window (seqhi may have been set by
-		 * the crappy stack check or if we picked up the connection
-		 * after establishment)
-		 */
-		if (src->seqhi == 1 ||
-		    SEQ_GEQ(end + MAX(1, dst->max_win << dws), src->seqhi))
-			src->seqhi = end + MAX(1, dst->max_win << dws);
-		if (win > src->max_win)
-			src->max_win = win;
-
-	} else {
-		ack = ntohl(th->th_ack) - dst->seqdiff;
-		if (src->seqdiff) {
-			/* Modulate sequence numbers */
-			pf_change_a(&th->th_seq, &th->th_sum, htonl(seq +
-			    src->seqdiff), 0);
-			pf_change_a(&th->th_ack, &th->th_sum, htonl(ack), 0);
-			*copyback = 1;
-		}
-		end = seq + pd->p_len;
-		if (th->th_flags & TH_SYN)
-			end++;
-		if (th->th_flags & TH_FIN)
-			end++;
-	}
-
-	if ((th->th_flags & TH_ACK) == 0) {
-		/* Let it pass through the ack skew check */
-		ack = dst->seqlo;
-	} else if ((ack == 0 &&
-	    (th->th_flags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)) ||
-	    /* broken tcp stacks do not set ack */
-	    (dst->state < TCPS_SYN_SENT)) {
-		/*
-		 * Many stacks (ours included) will set the ACK number in an
-		 * FIN|ACK if the SYN times out -- no sequence to ACK.
-		 */
-		ack = dst->seqlo;
-	}
-
-	if (seq == end) {
-		/* Ease sequencing restrictions on no data packets */
-		seq = src->seqlo;
-		end = seq;
-	}
-
-	ackskew = dst->seqlo - ack;
-
-
-	/*
-	 * Need to demodulate the sequence numbers in any TCP SACK options
-	 * (Selective ACK). We could optionally validate the SACK values
-	 * against the current ACK window, either forwards or backwards, but
-	 * I'm not confident that SACK has been implemented properly
-	 * everywhere. It wouldn't surprise me if several stacks accidently
-	 * SACK too far backwards of previously ACKed data. There really aren't
-	 * any security implications of bad SACKing unless the target stack
-	 * doesn't validate the option length correctly. Someone trying to
-	 * spoof into a TCP connection won't bother blindly sending SACK
-	 * options anyway.
-	 */
-	if (dst->seqdiff && (th->th_off << 2) > sizeof(struct tcphdr)) {
-		if (pf_modulate_sack(m, off, pd, th, dst))
-			*copyback = 1;
-	}
-
-
-#define	MAXACKWINDOW (0xffff + 1500)	/* 1500 is an arbitrary fudge factor */
-	if (SEQ_GEQ(src->seqhi, end) &&
-	    /* Last octet inside other's window space */
-	    SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws)) &&
-	    /* Retrans: not more than one window back */
-	    (ackskew >= -MAXACKWINDOW) &&
-	    /* Acking not more than one reassembled fragment backwards */
-	    (ackskew <= (MAXACKWINDOW << sws)) &&
-	    /* Acking not more than one window forward */
-	    ((th->th_flags & TH_RST) == 0 || orig_seq == src->seqlo ||
-	    (orig_seq == src->seqlo + 1) || (orig_seq + 1 == src->seqlo) ||
-	    (pd->flags & PFDESC_IP_REAS) == 0)) {
-	    /* Require an exact/+1 sequence match on resets when possible */
-
-		if (dst->scrub || src->scrub) {
-			if (pf_normalize_tcp_stateful(m, off, pd, reason, th,
-			    *state, src, dst, copyback))
-				return (PF_DROP);
-		}
-
-		/* update max window */
-		if (src->max_win < win)
-			src->max_win = win;
-		/* synchronize sequencing */
-		if (SEQ_GT(end, src->seqlo))
-			src->seqlo = end;
-		/* slide the window of what the other end can send */
-		if (SEQ_GEQ(ack + (win << sws), dst->seqhi))
-			dst->seqhi = ack + MAX((win << sws), 1);
-
-
-		/* update states */
-		if (th->th_flags & TH_SYN)
-			if (src->state < TCPS_SYN_SENT)
-				src->state = TCPS_SYN_SENT;
-		if (th->th_flags & TH_FIN)
-			if (src->state < TCPS_CLOSING)
-				src->state = TCPS_CLOSING;
-		if (th->th_flags & TH_ACK) {
-			if (dst->state == TCPS_SYN_SENT) {
-				dst->state = TCPS_ESTABLISHED;
-				if (src->state == TCPS_ESTABLISHED &&
-				    (*state)->src_node != NULL &&
-				    pf_src_connlimit(state)) {
-					REASON_SET(reason, PFRES_SRCLIMIT);
-					return (PF_DROP);
-				}
-			} else if (dst->state == TCPS_CLOSING)
-				dst->state = TCPS_FIN_WAIT_2;
-		}
-		if (th->th_flags & TH_RST)
-			src->state = dst->state = TCPS_TIME_WAIT;
-
-		/* update expire time */
-		(*state)->expire = time_second;
-		if (src->state >= TCPS_FIN_WAIT_2 &&
-		    dst->state >= TCPS_FIN_WAIT_2)
-			(*state)->timeout = PFTM_TCP_CLOSED;
-		else if (src->state >= TCPS_CLOSING &&
-		    dst->state >= TCPS_CLOSING)
-			(*state)->timeout = PFTM_TCP_FIN_WAIT;
-		else if (src->state < TCPS_ESTABLISHED ||
-		    dst->state < TCPS_ESTABLISHED)
-			(*state)->timeout = PFTM_TCP_OPENING;
-		else if (src->state >= TCPS_CLOSING ||
-		    dst->state >= TCPS_CLOSING)
-			(*state)->timeout = PFTM_TCP_CLOSING;
-		else
-			(*state)->timeout = PFTM_TCP_ESTABLISHED;
-
-		/* Fall through to PASS packet */
-
-	} else if ((dst->state < TCPS_SYN_SENT ||
-		dst->state >= TCPS_FIN_WAIT_2 ||
-		src->state >= TCPS_FIN_WAIT_2) &&
-	    SEQ_GEQ(src->seqhi + MAXACKWINDOW, end) &&
-	    /* Within a window forward of the originating packet */
-	    SEQ_GEQ(seq, src->seqlo - MAXACKWINDOW)) {
-	    /* Within a window backward of the originating packet */
-
-		/*
-		 * This currently handles three situations:
-		 *  1) Stupid stacks will shotgun SYNs before their peer
-		 *     replies.
-		 *  2) When PF catches an already established stream (the
-		 *     firewall rebooted, the state table was flushed, routes
-		 *     changed...)
-		 *  3) Packets get funky immediately after the connection
-		 *     closes (this should catch Solaris spurious ACK|FINs
-		 *     that web servers like to spew after a close)
-		 *
-		 * This must be a little more careful than the above code
-		 * since packet floods will also be caught here. We don't
-		 * update the TTL here to mitigate the damage of a packet
-		 * flood and so the same code can handle awkward establishment
-		 * and a loosened connection close.
-		 * In the establishment case, a correct peer response will
-		 * validate the connection, go through the normal state code
-		 * and keep updating the state TTL.
-		 */
-
-#ifdef __FreeBSD__
-		if (V_pf_status.debug >= PF_DEBUG_MISC) {
-#else
-		if (pf_status.debug >= PF_DEBUG_MISC) {
-#endif
-			printf("pf: loose state match: ");
-			pf_print_state(*state);
-			pf_print_flags(th->th_flags);
-			printf(" seq=%u (%u) ack=%u len=%u ackskew=%d "
-			    "pkts=%llu:%llu dir=%s,%s\n", seq, orig_seq, ack,
-#ifdef __FreeBSD__
-			    pd->p_len, ackskew, (unsigned long long)(*state)->packets[0],
-			    (unsigned long long)(*state)->packets[1],
-#else
-			    pd->p_len, ackskew, (*state)->packets[0],
-			    (*state)->packets[1],
-#endif
-			    pd->dir == PF_IN ? "in" : "out",
-			    pd->dir == (*state)->direction ? "fwd" : "rev");
-		}
-
-		if (dst->scrub || src->scrub) {
-			if (pf_normalize_tcp_stateful(m, off, pd, reason, th,
-			    *state, src, dst, copyback))
-				return (PF_DROP);
-		}
-
-		/* update max window */
-		if (src->max_win < win)
-			src->max_win = win;
-		/* synchronize sequencing */
-		if (SEQ_GT(end, src->seqlo))
-			src->seqlo = end;
-		/* slide the window of what the other end can send */
-		if (SEQ_GEQ(ack + (win << sws), dst->seqhi))
-			dst->seqhi = ack + MAX((win << sws), 1);
-
-		/*
-		 * Cannot set dst->seqhi here since this could be a shotgunned
-		 * SYN and not an already established connection.
-		 */
-
-		if (th->th_flags & TH_FIN)
-			if (src->state < TCPS_CLOSING)
-				src->state = TCPS_CLOSING;
-		if (th->th_flags & TH_RST)
-			src->state = dst->state = TCPS_TIME_WAIT;
-
-		/* Fall through to PASS packet */
-
-	} else {
-		if ((*state)->dst.state == TCPS_SYN_SENT &&
-		    (*state)->src.state == TCPS_SYN_SENT) {
-			/* Send RST for state mismatches during handshake */
-			if (!(th->th_flags & TH_RST))
-#ifdef __FreeBSD__
-				pf_send_tcp(NULL, (*state)->rule.ptr, pd->af,
-#else
-				pf_send_tcp((*state)->rule.ptr, pd->af,
-#endif
-				    pd->dst, pd->src, th->th_dport,
-				    th->th_sport, ntohl(th->th_ack), 0,
-				    TH_RST, 0, 0,
-				    (*state)->rule.ptr->return_ttl, 1, 0,
-				    pd->eh, kif->pfik_ifp);
-			src->seqlo = 0;
-			src->seqhi = 1;
-			src->max_win = 1;
-#ifdef __FreeBSD__
-		} else if (V_pf_status.debug >= PF_DEBUG_MISC) {
-#else
-		} else if (pf_status.debug >= PF_DEBUG_MISC) {
-#endif
-			printf("pf: BAD state: ");
-			pf_print_state(*state);
-			pf_print_flags(th->th_flags);
-			printf(" seq=%u (%u) ack=%u len=%u ackskew=%d "
-			    "pkts=%llu:%llu dir=%s,%s\n",
-			    seq, orig_seq, ack, pd->p_len, ackskew,
-#ifdef __FreeBSD__
-			    (unsigned long long)(*state)->packets[0],
-			    (unsigned long long)(*state)->packets[1],
-#else
-			    (*state)->packets[0], (*state)->packets[1],
-#endif
-			    pd->dir == PF_IN ? "in" : "out",
-			    pd->dir == (*state)->direction ? "fwd" : "rev");
-			printf("pf: State failure on: %c %c %c %c | %c %c\n",
-			    SEQ_GEQ(src->seqhi, end) ? ' ' : '1',
-			    SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws)) ?
-			    ' ': '2',
-			    (ackskew >= -MAXACKWINDOW) ? ' ' : '3',
-			    (ackskew <= (MAXACKWINDOW << sws)) ? ' ' : '4',
-			    SEQ_GEQ(src->seqhi + MAXACKWINDOW, end) ?' ' :'5',
-			    SEQ_GEQ(seq, src->seqlo - MAXACKWINDOW) ?' ' :'6');
-		}
-		REASON_SET(reason, PFRES_BADSTATE);
-		return (PF_DROP);
-	}
-
-	return (PF_PASS);
-}
-
-int
-pf_tcp_track_sloppy(struct pf_state_peer *src, struct pf_state_peer *dst,
-	struct pf_state **state, struct pf_pdesc *pd, u_short *reason)
-{
-	struct tcphdr		*th = pd->hdr.tcp;
-
-	if (th->th_flags & TH_SYN)
-		if (src->state < TCPS_SYN_SENT)
-			src->state = TCPS_SYN_SENT;
-	if (th->th_flags & TH_FIN)
-		if (src->state < TCPS_CLOSING)
-			src->state = TCPS_CLOSING;
-	if (th->th_flags & TH_ACK) {
-		if (dst->state == TCPS_SYN_SENT) {
-			dst->state = TCPS_ESTABLISHED;
-			if (src->state == TCPS_ESTABLISHED &&
-			    (*state)->src_node != NULL &&
-			    pf_src_connlimit(state)) {
-				REASON_SET(reason, PFRES_SRCLIMIT);
-				return (PF_DROP);
-			}
-		} else if (dst->state == TCPS_CLOSING) {
-			dst->state = TCPS_FIN_WAIT_2;
-		} else if (src->state == TCPS_SYN_SENT &&
-		    dst->state < TCPS_SYN_SENT) {
-			/*
-			 * Handle a special sloppy case where we only see one
-			 * half of the connection. If there is a ACK after
-			 * the initial SYN without ever seeing a packet from
-			 * the destination, set the connection to established.
-			 */
-			dst->state = src->state = TCPS_ESTABLISHED;
-			if ((*state)->src_node != NULL &&
-			    pf_src_connlimit(state)) {
-				REASON_SET(reason, PFRES_SRCLIMIT);
-				return (PF_DROP);
-			}
-		} else if (src->state == TCPS_CLOSING &&
-		    dst->state == TCPS_ESTABLISHED &&
-		    dst->seqlo == 0) {
-			/*
-			 * Handle the closing of half connections where we
-			 * don't see the full bidirectional FIN/ACK+ACK
-			 * handshake.
-			 */
-			dst->state = TCPS_CLOSING;
-		}
-	}
-	if (th->th_flags & TH_RST)
-		src->state = dst->state = TCPS_TIME_WAIT;
-
-	/* update expire time */
-	(*state)->expire = time_second;
-	if (src->state >= TCPS_FIN_WAIT_2 &&
-	    dst->state >= TCPS_FIN_WAIT_2)
-		(*state)->timeout = PFTM_TCP_CLOSED;
-	else if (src->state >= TCPS_CLOSING &&
-	    dst->state >= TCPS_CLOSING)
-		(*state)->timeout = PFTM_TCP_FIN_WAIT;
-	else if (src->state < TCPS_ESTABLISHED ||
-	    dst->state < TCPS_ESTABLISHED)
-		(*state)->timeout = PFTM_TCP_OPENING;
-	else if (src->state >= TCPS_CLOSING ||
-	    dst->state >= TCPS_CLOSING)
-		(*state)->timeout = PFTM_TCP_CLOSING;
-	else
-		(*state)->timeout = PFTM_TCP_ESTABLISHED;
-
-	return (PF_PASS);
-}
-
-int
-pf_test_state_tcp(struct pf_state **state, int direction, struct pfi_kif *kif,
-    struct mbuf *m, int off, void *h, struct pf_pdesc *pd,
-    u_short *reason)
-{
-	struct pf_state_key_cmp	 key;
-	struct tcphdr		*th = pd->hdr.tcp;
-	int			 copyback = 0;
-	struct pf_state_peer	*src, *dst;
-	struct pf_state_key	*sk;
-
-	key.af = pd->af;
-	key.proto = IPPROTO_TCP;
-	if (direction == PF_IN)	{	/* wire side, straight */
-		PF_ACPY(&key.addr[0], pd->src, key.af);
-		PF_ACPY(&key.addr[1], pd->dst, key.af);
-		key.port[0] = th->th_sport;
-		key.port[1] = th->th_dport;
-	} else {			/* stack side, reverse */
-		PF_ACPY(&key.addr[1], pd->src, key.af);
-		PF_ACPY(&key.addr[0], pd->dst, key.af);
-		key.port[1] = th->th_sport;
-		key.port[0] = th->th_dport;
-	}
-
-#ifdef __FreeBSD__
-	STATE_LOOKUP(kif, &key, direction, *state, m, pd->pf_mtag);
-#else
-	STATE_LOOKUP(kif, &key, direction, *state, m);
-#endif
-
-	if (direction == (*state)->direction) {
-		src = &(*state)->src;
-		dst = &(*state)->dst;
-	} else {
-		src = &(*state)->dst;
-		dst = &(*state)->src;
-	}
-
-	sk = (*state)->key[pd->didx];
-
-	if ((*state)->src.state == PF_TCPS_PROXY_SRC) {
-		if (direction != (*state)->direction) {
-			REASON_SET(reason, PFRES_SYNPROXY);
-			return (PF_SYNPROXY_DROP);
-		}
-		if (th->th_flags & TH_SYN) {
-			if (ntohl(th->th_seq) != (*state)->src.seqlo) {
-				REASON_SET(reason, PFRES_SYNPROXY);
-				return (PF_DROP);
-			}
-#ifdef __FreeBSD__
-			pf_send_tcp(NULL, (*state)->rule.ptr, pd->af, pd->dst,
-#else
-			pf_send_tcp((*state)->rule.ptr, pd->af, pd->dst,
-#endif
-			    pd->src, th->th_dport, th->th_sport,
-			    (*state)->src.seqhi, ntohl(th->th_seq) + 1,
-			    TH_SYN|TH_ACK, 0, (*state)->src.mss, 0, 1,
-			    0, NULL, NULL);
-			REASON_SET(reason, PFRES_SYNPROXY);
-			return (PF_SYNPROXY_DROP);
-		} else if (!(th->th_flags & TH_ACK) ||
-		    (ntohl(th->th_ack) != (*state)->src.seqhi + 1) ||
-		    (ntohl(th->th_seq) != (*state)->src.seqlo + 1)) {
-			REASON_SET(reason, PFRES_SYNPROXY);
-			return (PF_DROP);
-		} else if ((*state)->src_node != NULL &&
-		    pf_src_connlimit(state)) {
-			REASON_SET(reason, PFRES_SRCLIMIT);
-			return (PF_DROP);
-		} else
-			(*state)->src.state = PF_TCPS_PROXY_DST;
-	}
-	if ((*state)->src.state == PF_TCPS_PROXY_DST) {
-		if (direction == (*state)->direction) {
-			if (((th->th_flags & (TH_SYN|TH_ACK)) != TH_ACK) ||
-			    (ntohl(th->th_ack) != (*state)->src.seqhi + 1) ||
-			    (ntohl(th->th_seq) != (*state)->src.seqlo + 1)) {
-				REASON_SET(reason, PFRES_SYNPROXY);
-				return (PF_DROP);
-			}
-			(*state)->src.max_win = MAX(ntohs(th->th_win), 1);
-			if ((*state)->dst.seqhi == 1)
-				(*state)->dst.seqhi = htonl(arc4random());
-#ifdef __FreeBSD__
-			pf_send_tcp(NULL, (*state)->rule.ptr, pd->af,
-#else
-			pf_send_tcp((*state)->rule.ptr, pd->af,
-#endif
-			    &sk->addr[pd->sidx], &sk->addr[pd->didx],
-			    sk->port[pd->sidx], sk->port[pd->didx],
-			    (*state)->dst.seqhi, 0, TH_SYN, 0,
-			    (*state)->src.mss, 0, 0, (*state)->tag, NULL, NULL);
-			REASON_SET(reason, PFRES_SYNPROXY);
-			return (PF_SYNPROXY_DROP);
-		} else if (((th->th_flags & (TH_SYN|TH_ACK)) !=
-		    (TH_SYN|TH_ACK)) ||
-		    (ntohl(th->th_ack) != (*state)->dst.seqhi + 1)) {
-			REASON_SET(reason, PFRES_SYNPROXY);
-			return (PF_DROP);
-		} else {
-			(*state)->dst.max_win = MAX(ntohs(th->th_win), 1);
-			(*state)->dst.seqlo = ntohl(th->th_seq);
-#ifdef __FreeBSD__
-			pf_send_tcp(NULL, (*state)->rule.ptr, pd->af, pd->dst,
-#else
-			pf_send_tcp((*state)->rule.ptr, pd->af, pd->dst,
-#endif
-			    pd->src, th->th_dport, th->th_sport,
-			    ntohl(th->th_ack), ntohl(th->th_seq) + 1,
-			    TH_ACK, (*state)->src.max_win, 0, 0, 0,
-			    (*state)->tag, NULL, NULL);
-#ifdef __FreeBSD__
-			pf_send_tcp(NULL, (*state)->rule.ptr, pd->af,
-#else
-			pf_send_tcp((*state)->rule.ptr, pd->af,
-#endif
-			    &sk->addr[pd->sidx], &sk->addr[pd->didx],
-			    sk->port[pd->sidx], sk->port[pd->didx],
-			    (*state)->src.seqhi + 1, (*state)->src.seqlo + 1,
-			    TH_ACK, (*state)->dst.max_win, 0, 0, 1,
-			    0, NULL, NULL);
-			(*state)->src.seqdiff = (*state)->dst.seqhi -
-			    (*state)->src.seqlo;
-			(*state)->dst.seqdiff = (*state)->src.seqhi -
-			    (*state)->dst.seqlo;
-			(*state)->src.seqhi = (*state)->src.seqlo +
-			    (*state)->dst.max_win;
-			(*state)->dst.seqhi = (*state)->dst.seqlo +
-			    (*state)->src.max_win;
-			(*state)->src.wscale = (*state)->dst.wscale = 0;
-			(*state)->src.state = (*state)->dst.state =
-			    TCPS_ESTABLISHED;
-			REASON_SET(reason, PFRES_SYNPROXY);
-			return (PF_SYNPROXY_DROP);
-		}
-	}
-
-	if (((th->th_flags & (TH_SYN|TH_ACK)) == TH_SYN) &&
-	    dst->state >= TCPS_FIN_WAIT_2 &&
-	    src->state >= TCPS_FIN_WAIT_2) {
-#ifdef __FreeBSD__
-		if (V_pf_status.debug >= PF_DEBUG_MISC) {
-#else
-		if (pf_status.debug >= PF_DEBUG_MISC) {
-#endif
-			printf("pf: state reuse ");
-			pf_print_state(*state);
-			pf_print_flags(th->th_flags);
-			printf("\n");
-		}
-		/* XXX make sure it's the same direction ?? */
-		(*state)->src.state = (*state)->dst.state = TCPS_CLOSED;
-		pf_unlink_state(*state);
-		*state = NULL;
-		return (PF_DROP);
-	}
-
-	if ((*state)->state_flags & PFSTATE_SLOPPY) {
-		if (pf_tcp_track_sloppy(src, dst, state, pd, reason) == PF_DROP)
-			return (PF_DROP);
-	} else {
-		if (pf_tcp_track_full(src, dst, state, kif, m, off, pd, reason,
-		    &copyback) == PF_DROP)
-			return (PF_DROP);
-	}
-
-	/* translate source/destination address, if necessary */
-	if ((*state)->key[PF_SK_WIRE] != (*state)->key[PF_SK_STACK]) {
-		struct pf_state_key *nk = (*state)->key[pd->didx];
-
-		if (PF_ANEQ(pd->src, &nk->addr[pd->sidx], pd->af) ||
-		    nk->port[pd->sidx] != th->th_sport)
-			pf_change_ap(pd->src, &th->th_sport, pd->ip_sum,
-			    &th->th_sum, &nk->addr[pd->sidx],
-			    nk->port[pd->sidx], 0, pd->af);
-
-		if (PF_ANEQ(pd->dst, &nk->addr[pd->didx], pd->af) ||
-		    nk->port[pd->didx] != th->th_dport)
-			pf_change_ap(pd->dst, &th->th_dport, pd->ip_sum,
-			    &th->th_sum, &nk->addr[pd->didx],
-			    nk->port[pd->didx], 0, pd->af);
-		copyback = 1;
-	}
-
-	/* Copyback sequence modulation or stateful scrub changes if needed */
-	if (copyback)
-#ifdef __FreeBSD__
-		m_copyback(m, off, sizeof(*th), (caddr_t)th);
-#else
-		m_copyback(m, off, sizeof(*th), th);
-#endif
-
-	return (PF_PASS);
-}
-
-int
-pf_test_state_udp(struct pf_state **state, int direction, struct pfi_kif *kif,
-    struct mbuf *m, int off, void *h, struct pf_pdesc *pd)
-{
-	struct pf_state_peer	*src, *dst;
-	struct pf_state_key_cmp	 key;
-	struct udphdr		*uh = pd->hdr.udp;
-
-	key.af = pd->af;
-	key.proto = IPPROTO_UDP;
-	if (direction == PF_IN)	{	/* wire side, straight */
-		PF_ACPY(&key.addr[0], pd->src, key.af);
-		PF_ACPY(&key.addr[1], pd->dst, key.af);
-		key.port[0] = uh->uh_sport;
-		key.port[1] = uh->uh_dport;
-	} else {			/* stack side, reverse */
-		PF_ACPY(&key.addr[1], pd->src, key.af);
-		PF_ACPY(&key.addr[0], pd->dst, key.af);
-		key.port[1] = uh->uh_sport;
-		key.port[0] = uh->uh_dport;
-	}
-
-#ifdef __FreeBSD__
-	STATE_LOOKUP(kif, &key, direction, *state, m, pd->pf_mtag);
-#else
-	STATE_LOOKUP(kif, &key, direction, *state, m);
-#endif
-
-	if (direction == (*state)->direction) {
-		src = &(*state)->src;
-		dst = &(*state)->dst;
-	} else {
-		src = &(*state)->dst;
-		dst = &(*state)->src;
-	}
-
-	/* update states */
-	if (src->state < PFUDPS_SINGLE)
-		src->state = PFUDPS_SINGLE;
-	if (dst->state == PFUDPS_SINGLE)
-		dst->state = PFUDPS_MULTIPLE;
-
-	/* update expire time */
-	(*state)->expire = time_second;
-	if (src->state == PFUDPS_MULTIPLE && dst->state == PFUDPS_MULTIPLE)
-		(*state)->timeout = PFTM_UDP_MULTIPLE;
-	else
-		(*state)->timeout = PFTM_UDP_SINGLE;
-
-	/* translate source/destination address, if necessary */
-	if ((*state)->key[PF_SK_WIRE] != (*state)->key[PF_SK_STACK]) {
-		struct pf_state_key *nk = (*state)->key[pd->didx];
-
-		if (PF_ANEQ(pd->src, &nk->addr[pd->sidx], pd->af) ||
-		    nk->port[pd->sidx] != uh->uh_sport)
-			pf_change_ap(pd->src, &uh->uh_sport, pd->ip_sum,
-			    &uh->uh_sum, &nk->addr[pd->sidx],
-			    nk->port[pd->sidx], 1, pd->af);
-
-		if (PF_ANEQ(pd->dst, &nk->addr[pd->didx], pd->af) ||
-		    nk->port[pd->didx] != uh->uh_dport)
-			pf_change_ap(pd->dst, &uh->uh_dport, pd->ip_sum,
-			    &uh->uh_sum, &nk->addr[pd->didx],
-			    nk->port[pd->didx], 1, pd->af);
-#ifdef __FreeBSD__
-		m_copyback(m, off, sizeof(*uh), (caddr_t)uh);
-#else
-		m_copyback(m, off, sizeof(*uh), uh);
-#endif
-	}
-
-	return (PF_PASS);
-}
-
-int
-pf_test_state_icmp(struct pf_state **state, int direction, struct pfi_kif *kif,
-    struct mbuf *m, int off, void *h, struct pf_pdesc *pd, u_short *reason)
-{
-	struct pf_addr  *saddr = pd->src, *daddr = pd->dst;
-#ifdef __FreeBSD__
-	u_int16_t	 icmpid = 0, *icmpsum;
-#else
-	u_int16_t	 icmpid, *icmpsum;
-#endif
-	u_int8_t	 icmptype;
-	int		 state_icmp = 0;
-	struct pf_state_key_cmp key;
-
-	switch (pd->proto) {
-#ifdef INET
-	case IPPROTO_ICMP:
-		icmptype = pd->hdr.icmp->icmp_type;
-		icmpid = pd->hdr.icmp->icmp_id;
-		icmpsum = &pd->hdr.icmp->icmp_cksum;
-
-		if (icmptype == ICMP_UNREACH ||
-		    icmptype == ICMP_SOURCEQUENCH ||
-		    icmptype == ICMP_REDIRECT ||
-		    icmptype == ICMP_TIMXCEED ||
-		    icmptype == ICMP_PARAMPROB)
-			state_icmp++;
-		break;
-#endif /* INET */
-#ifdef INET6
-	case IPPROTO_ICMPV6:
-		icmptype = pd->hdr.icmp6->icmp6_type;
-		icmpid = pd->hdr.icmp6->icmp6_id;
-		icmpsum = &pd->hdr.icmp6->icmp6_cksum;
-
-		if (icmptype == ICMP6_DST_UNREACH ||
-		    icmptype == ICMP6_PACKET_TOO_BIG ||
-		    icmptype == ICMP6_TIME_EXCEEDED ||
-		    icmptype == ICMP6_PARAM_PROB)
-			state_icmp++;
-		break;
-#endif /* INET6 */
-	}
-
-	if (!state_icmp) {
-
-		/*
-		 * ICMP query/reply message not related to a TCP/UDP packet.
-		 * Search for an ICMP state.
-		 */
-		key.af = pd->af;
-		key.proto = pd->proto;
-		key.port[0] = key.port[1] = icmpid;
-		if (direction == PF_IN)	{	/* wire side, straight */
-			PF_ACPY(&key.addr[0], pd->src, key.af);
-			PF_ACPY(&key.addr[1], pd->dst, key.af);
-		} else {			/* stack side, reverse */
-			PF_ACPY(&key.addr[1], pd->src, key.af);
-			PF_ACPY(&key.addr[0], pd->dst, key.af);
-		}
-
-#ifdef __FreeBSD__
-		STATE_LOOKUP(kif, &key, direction, *state, m, pd->pf_mtag);
-#else
-		STATE_LOOKUP(kif, &key, direction, *state, m);
-#endif
-
-		(*state)->expire = time_second;
-		(*state)->timeout = PFTM_ICMP_ERROR_REPLY;
-
-		/* translate source/destination address, if necessary */
-		if ((*state)->key[PF_SK_WIRE] != (*state)->key[PF_SK_STACK]) {
-			struct pf_state_key *nk = (*state)->key[pd->didx];
-
-			switch (pd->af) {
-#ifdef INET
-			case AF_INET:
-				if (PF_ANEQ(pd->src,
-				    &nk->addr[pd->sidx], AF_INET))
-					pf_change_a(&saddr->v4.s_addr,
-					    pd->ip_sum,
-					    nk->addr[pd->sidx].v4.s_addr, 0);
-
-				if (PF_ANEQ(pd->dst, &nk->addr[pd->didx],
-				    AF_INET))
-					pf_change_a(&daddr->v4.s_addr,
-					    pd->ip_sum,
-					    nk->addr[pd->didx].v4.s_addr, 0);
-
-				if (nk->port[0] !=
-				    pd->hdr.icmp->icmp_id) {
-					pd->hdr.icmp->icmp_cksum =
-					    pf_cksum_fixup(
-					    pd->hdr.icmp->icmp_cksum, icmpid,
-					    nk->port[pd->sidx], 0);
-					pd->hdr.icmp->icmp_id =
-					    nk->port[pd->sidx];
-				}
-
-				m_copyback(m, off, ICMP_MINLEN,
-#ifdef __FreeBSD__
-				    (caddr_t)
-#endif
-				    pd->hdr.icmp);
-				break;
-#endif /* INET */
-#ifdef INET6
-			case AF_INET6:
-				if (PF_ANEQ(pd->src,
-				    &nk->addr[pd->sidx], AF_INET6))
-					pf_change_a6(saddr,
-					    &pd->hdr.icmp6->icmp6_cksum,
-					    &nk->addr[pd->sidx], 0);
-
-				if (PF_ANEQ(pd->dst,
-				    &nk->addr[pd->didx], AF_INET6))
-					pf_change_a6(daddr,
-					    &pd->hdr.icmp6->icmp6_cksum,
-					    &nk->addr[pd->didx], 0);
-
-				m_copyback(m, off,
-				    sizeof(struct icmp6_hdr),
-#ifdef __FreeBSD__
-				    (caddr_t)
-#endif
-				    pd->hdr.icmp6);
-				break;
-#endif /* INET6 */
-			}
-		}
-		return (PF_PASS);
-
-	} else {
-		/*
-		 * ICMP error message in response to a TCP/UDP packet.
-		 * Extract the inner TCP/UDP header and search for that state.
-		 */
-
-		struct pf_pdesc	pd2;
-#ifdef __FreeBSD__
-		bzero(&pd2, sizeof pd2);
-#endif
-#ifdef INET
-		struct ip	h2;
-#endif /* INET */
-#ifdef INET6
-		struct ip6_hdr	h2_6;
-		int		terminal = 0;
-#endif /* INET6 */
-#ifdef __FreeBSD__
-		int		ipoff2 = 0;
-		int		off2 = 0;
-#else
-		int		ipoff2;
-		int		off2;
-#endif
-
-		pd2.af = pd->af;
-		/* Payload packet is from the opposite direction. */
-		pd2.sidx = (direction == PF_IN) ? 1 : 0;
-		pd2.didx = (direction == PF_IN) ? 0 : 1;
-		switch (pd->af) {
-#ifdef INET
-		case AF_INET:
-			/* offset of h2 in mbuf chain */
-			ipoff2 = off + ICMP_MINLEN;
-
-			if (!pf_pull_hdr(m, ipoff2, &h2, sizeof(h2),
-			    NULL, reason, pd2.af)) {
-				DPFPRINTF(PF_DEBUG_MISC,
-				    ("pf: ICMP error message too short "
-				    "(ip)\n"));
-				return (PF_DROP);
-			}
-			/*
-			 * ICMP error messages don't refer to non-first
-			 * fragments
-			 */
-			if (h2.ip_off & htons(IP_OFFMASK)) {
-				REASON_SET(reason, PFRES_FRAG);
-				return (PF_DROP);
-			}
-
-			/* offset of protocol header that follows h2 */
-			off2 = ipoff2 + (h2.ip_hl << 2);
-
-			pd2.proto = h2.ip_p;
-			pd2.src = (struct pf_addr *)&h2.ip_src;
-			pd2.dst = (struct pf_addr *)&h2.ip_dst;
-			pd2.ip_sum = &h2.ip_sum;
-			break;
-#endif /* INET */
-#ifdef INET6
-		case AF_INET6:
-			ipoff2 = off + sizeof(struct icmp6_hdr);
-
-			if (!pf_pull_hdr(m, ipoff2, &h2_6, sizeof(h2_6),
-			    NULL, reason, pd2.af)) {
-				DPFPRINTF(PF_DEBUG_MISC,
-				    ("pf: ICMP error message too short "
-				    "(ip6)\n"));
-				return (PF_DROP);
-			}
-			pd2.proto = h2_6.ip6_nxt;
-			pd2.src = (struct pf_addr *)&h2_6.ip6_src;
-			pd2.dst = (struct pf_addr *)&h2_6.ip6_dst;
-			pd2.ip_sum = NULL;
-			off2 = ipoff2 + sizeof(h2_6);
-			do {
-				switch (pd2.proto) {
-				case IPPROTO_FRAGMENT:
-					/*
-					 * ICMPv6 error messages for
-					 * non-first fragments
-					 */
-					REASON_SET(reason, PFRES_FRAG);
-					return (PF_DROP);
-				case IPPROTO_AH:
-				case IPPROTO_HOPOPTS:
-				case IPPROTO_ROUTING:
-				case IPPROTO_DSTOPTS: {
-					/* get next header and header length */
-					struct ip6_ext opt6;
-
-					if (!pf_pull_hdr(m, off2, &opt6,
-					    sizeof(opt6), NULL, reason,
-					    pd2.af)) {
-						DPFPRINTF(PF_DEBUG_MISC,
-						    ("pf: ICMPv6 short opt\n"));
-						return (PF_DROP);
-					}
-					if (pd2.proto == IPPROTO_AH)
-						off2 += (opt6.ip6e_len + 2) * 4;
-					else
-						off2 += (opt6.ip6e_len + 1) * 8;
-					pd2.proto = opt6.ip6e_nxt;
-					/* goto the next header */
-					break;
-				}
-				default:
-					terminal++;
-					break;
-				}
-			} while (!terminal);
-			break;
-#endif /* INET6 */
-		}
-
-		switch (pd2.proto) {
-		case IPPROTO_TCP: {
-			struct tcphdr		 th;
-			u_int32_t		 seq;
-			struct pf_state_peer	*src, *dst;
-			u_int8_t		 dws;
-			int			 copyback = 0;
-
-			/*
-			 * Only the first 8 bytes of the TCP header can be
-			 * expected. Don't access any TCP header fields after
-			 * th_seq, an ackskew test is not possible.
-			 */
-			if (!pf_pull_hdr(m, off2, &th, 8, NULL, reason,
-			    pd2.af)) {
-				DPFPRINTF(PF_DEBUG_MISC,
-				    ("pf: ICMP error message too short "
-				    "(tcp)\n"));
-				return (PF_DROP);
-			}
-
-			key.af = pd2.af;
-			key.proto = IPPROTO_TCP;
-			PF_ACPY(&key.addr[pd2.sidx], pd2.src, key.af);
-			PF_ACPY(&key.addr[pd2.didx], pd2.dst, key.af);
-			key.port[pd2.sidx] = th.th_sport;
-			key.port[pd2.didx] = th.th_dport;
-
-#ifdef __FreeBSD__
-			STATE_LOOKUP(kif, &key, direction, *state, m, pd->pf_mtag);
-#else
-			STATE_LOOKUP(kif, &key, direction, *state, m);
-#endif
-
-			if (direction == (*state)->direction) {
-				src = &(*state)->dst;
-				dst = &(*state)->src;
-			} else {
-				src = &(*state)->src;
-				dst = &(*state)->dst;
-			}
-
-			if (src->wscale && dst->wscale)
-				dws = dst->wscale & PF_WSCALE_MASK;
-			else
-				dws = 0;
-
-			/* Demodulate sequence number */
-			seq = ntohl(th.th_seq) - src->seqdiff;
-			if (src->seqdiff) {
-				pf_change_a(&th.th_seq, icmpsum,
-				    htonl(seq), 0);
-				copyback = 1;
-			}
-
-			if (!((*state)->state_flags & PFSTATE_SLOPPY) &&
-			    (!SEQ_GEQ(src->seqhi, seq) ||
-			    !SEQ_GEQ(seq, src->seqlo - (dst->max_win << dws)))) {
-#ifdef __FreeBSD__
-				if (V_pf_status.debug >= PF_DEBUG_MISC) {
-#else
-				if (pf_status.debug >= PF_DEBUG_MISC) {
-#endif
-					printf("pf: BAD ICMP %d:%d ",
-					    icmptype, pd->hdr.icmp->icmp_code);
-					pf_print_host(pd->src, 0, pd->af);
-					printf(" -> ");
-					pf_print_host(pd->dst, 0, pd->af);
-					printf(" state: ");
-					pf_print_state(*state);
-					printf(" seq=%u\n", seq);
-				}
-				REASON_SET(reason, PFRES_BADSTATE);
-				return (PF_DROP);
-			} else {
-#ifdef __FreeBSD__
-				if (V_pf_status.debug >= PF_DEBUG_MISC) {
-#else
-				if (pf_status.debug >= PF_DEBUG_MISC) {
-#endif
-					printf("pf: OK ICMP %d:%d ",
-					    icmptype, pd->hdr.icmp->icmp_code);
-					pf_print_host(pd->src, 0, pd->af);
-					printf(" -> ");
-					pf_print_host(pd->dst, 0, pd->af);
-					printf(" state: ");
-					pf_print_state(*state);
-					printf(" seq=%u\n", seq);
-				}
-			}
-
-			/* translate source/destination address, if necessary */
-			if ((*state)->key[PF_SK_WIRE] !=
-			    (*state)->key[PF_SK_STACK]) {
-				struct pf_state_key *nk =
-				    (*state)->key[pd->didx];
-
-				if (PF_ANEQ(pd2.src,
-				    &nk->addr[pd2.sidx], pd2.af) ||
-				    nk->port[pd2.sidx] != th.th_sport)
-					pf_change_icmp(pd2.src, &th.th_sport,
-					    daddr, &nk->addr[pd2.sidx],
-					    nk->port[pd2.sidx], NULL,
-					    pd2.ip_sum, icmpsum,
-					    pd->ip_sum, 0, pd2.af);
-
-				if (PF_ANEQ(pd2.dst,
-				    &nk->addr[pd2.didx], pd2.af) ||
-				    nk->port[pd2.didx] != th.th_dport)
-					pf_change_icmp(pd2.dst, &th.th_dport,
-					    NULL, /* XXX Inbound NAT? */
-					    &nk->addr[pd2.didx],
-					    nk->port[pd2.didx], NULL,
-					    pd2.ip_sum, icmpsum,
-					    pd->ip_sum, 0, pd2.af);
-				copyback = 1;
-			}
-
-			if (copyback) {
-				switch (pd2.af) {
-#ifdef INET
-				case AF_INET:
-					m_copyback(m, off, ICMP_MINLEN,
-#ifdef __FreeBSD__
-					    (caddr_t)
-#endif
-					    pd->hdr.icmp);
-					m_copyback(m, ipoff2, sizeof(h2),
-#ifdef __FreeBSD__
-					    (caddr_t)
-#endif
-					    &h2);
-					break;
-#endif /* INET */
-#ifdef INET6
-				case AF_INET6:
-					m_copyback(m, off,
-					    sizeof(struct icmp6_hdr),
-#ifdef __FreeBSD__
-					    (caddr_t)
-#endif
-					    pd->hdr.icmp6);
-					m_copyback(m, ipoff2, sizeof(h2_6),
-#ifdef __FreeBSD__
-					    (caddr_t)
-#endif
-					    &h2_6);
-					break;
-#endif /* INET6 */
-				}
-#ifdef __FreeBSD__
-				m_copyback(m, off2, 8, (caddr_t)&th);
-#else
-				m_copyback(m, off2, 8, &th);
-#endif
-			}
-
-			return (PF_PASS);
-			break;
-		}
-		case IPPROTO_UDP: {
-			struct udphdr		uh;
-
-			if (!pf_pull_hdr(m, off2, &uh, sizeof(uh),
-			    NULL, reason, pd2.af)) {
-				DPFPRINTF(PF_DEBUG_MISC,
-				    ("pf: ICMP error message too short "
-				    "(udp)\n"));
-				return (PF_DROP);
-			}
-
-			key.af = pd2.af;
-			key.proto = IPPROTO_UDP;
-			PF_ACPY(&key.addr[pd2.sidx], pd2.src, key.af);
-			PF_ACPY(&key.addr[pd2.didx], pd2.dst, key.af);
-			key.port[pd2.sidx] = uh.uh_sport;
-			key.port[pd2.didx] = uh.uh_dport;
-
-#ifdef __FreeBSD__
-			STATE_LOOKUP(kif, &key, direction, *state, m, pd->pf_mtag);
-#else
-			STATE_LOOKUP(kif, &key, direction, *state, m);
-#endif
-
-			/* translate source/destination address, if necessary */
-			if ((*state)->key[PF_SK_WIRE] !=
-			    (*state)->key[PF_SK_STACK]) {
-				struct pf_state_key *nk =
-				    (*state)->key[pd->didx];
-
-				if (PF_ANEQ(pd2.src,
-				    &nk->addr[pd2.sidx], pd2.af) ||
-				    nk->port[pd2.sidx] != uh.uh_sport)
-					pf_change_icmp(pd2.src, &uh.uh_sport,
-					    daddr, &nk->addr[pd2.sidx],
-					    nk->port[pd2.sidx], &uh.uh_sum,
-					    pd2.ip_sum, icmpsum,
-					    pd->ip_sum, 1, pd2.af);
-
-				if (PF_ANEQ(pd2.dst,
-				    &nk->addr[pd2.didx], pd2.af) ||
-				    nk->port[pd2.didx] != uh.uh_dport)
-					pf_change_icmp(pd2.dst, &uh.uh_dport,
-					    NULL, /* XXX Inbound NAT? */
-					    &nk->addr[pd2.didx],
-					    nk->port[pd2.didx], &uh.uh_sum,
-					    pd2.ip_sum, icmpsum,
-					    pd->ip_sum, 1, pd2.af);
-
-				switch (pd2.af) {
-#ifdef INET
-				case AF_INET:
-					m_copyback(m, off, ICMP_MINLEN,
-#ifdef __FreeBSD__
-					    (caddr_t)
-#endif
-					    pd->hdr.icmp);
-#ifdef __FreeBSD__
-					m_copyback(m, ipoff2, sizeof(h2), (caddr_t)&h2);
-#else
-					m_copyback(m, ipoff2, sizeof(h2), &h2);
-#endif
-					break;
-#endif /* INET */
-#ifdef INET6
-				case AF_INET6:
-					m_copyback(m, off,
-					    sizeof(struct icmp6_hdr),
-#ifdef __FreeBSD__
-					    (caddr_t)
-#endif
-					    pd->hdr.icmp6);
-					m_copyback(m, ipoff2, sizeof(h2_6),
-#ifdef __FreeBSD__
-					    (caddr_t)
-#endif
-					    &h2_6);
-					break;
-#endif /* INET6 */
-				}
-#ifdef __FreeBSD__
-				m_copyback(m, off2, sizeof(uh), (caddr_t)&uh);
-#else
-				m_copyback(m, off2, sizeof(uh), &uh);
-#endif
-			}
-			return (PF_PASS);
-			break;
-		}
-#ifdef INET
-		case IPPROTO_ICMP: {
-			struct icmp		iih;
-
-			if (!pf_pull_hdr(m, off2, &iih, ICMP_MINLEN,
-			    NULL, reason, pd2.af)) {
-				DPFPRINTF(PF_DEBUG_MISC,
-				    ("pf: ICMP error message too short i"
-				    "(icmp)\n"));
-				return (PF_DROP);
-			}
-
-			key.af = pd2.af;
-			key.proto = IPPROTO_ICMP;
-			PF_ACPY(&key.addr[pd2.sidx], pd2.src, key.af);
-			PF_ACPY(&key.addr[pd2.didx], pd2.dst, key.af);
-			key.port[0] = key.port[1] = iih.icmp_id;
-
-#ifdef __FreeBSD__
-			STATE_LOOKUP(kif, &key, direction, *state, m, pd->pf_mtag);
-#else
-			STATE_LOOKUP(kif, &key, direction, *state, m);
-#endif
-
-			/* translate source/destination address, if necessary */
-			if ((*state)->key[PF_SK_WIRE] !=
-			    (*state)->key[PF_SK_STACK]) {
-				struct pf_state_key *nk =
-				    (*state)->key[pd->didx];
-
-				if (PF_ANEQ(pd2.src,
-				    &nk->addr[pd2.sidx], pd2.af) ||
-				    nk->port[pd2.sidx] != iih.icmp_id)
-					pf_change_icmp(pd2.src, &iih.icmp_id,
-					    daddr, &nk->addr[pd2.sidx],
-					    nk->port[pd2.sidx], NULL,
-					    pd2.ip_sum, icmpsum,
-					    pd->ip_sum, 0, AF_INET);
-
-				if (PF_ANEQ(pd2.dst,
-				    &nk->addr[pd2.didx], pd2.af) ||
-				    nk->port[pd2.didx] != iih.icmp_id)
-					pf_change_icmp(pd2.dst, &iih.icmp_id,
-					    NULL, /* XXX Inbound NAT? */
-					    &nk->addr[pd2.didx],
-					    nk->port[pd2.didx], NULL,
-					    pd2.ip_sum, icmpsum,
-					    pd->ip_sum, 0, AF_INET);
-
-#ifdef __FreeBSD__
-				m_copyback(m, off, ICMP_MINLEN, (caddr_t)pd->hdr.icmp);
-				m_copyback(m, ipoff2, sizeof(h2), (caddr_t)&h2);
-				m_copyback(m, off2, ICMP_MINLEN, (caddr_t)&iih);
-#else
-				m_copyback(m, off, ICMP_MINLEN, pd->hdr.icmp);
-				m_copyback(m, ipoff2, sizeof(h2), &h2);
-				m_copyback(m, off2, ICMP_MINLEN, &iih);
-#endif
-			}
-			return (PF_PASS);
-			break;
-		}
-#endif /* INET */
-#ifdef INET6
-		case IPPROTO_ICMPV6: {
-			struct icmp6_hdr	iih;
-
-			if (!pf_pull_hdr(m, off2, &iih,
-			    sizeof(struct icmp6_hdr), NULL, reason, pd2.af)) {
-				DPFPRINTF(PF_DEBUG_MISC,
-				    ("pf: ICMP error message too short "
-				    "(icmp6)\n"));
-				return (PF_DROP);
-			}
-
-			key.af = pd2.af;
-			key.proto = IPPROTO_ICMPV6;
-			PF_ACPY(&key.addr[pd2.sidx], pd2.src, key.af);
-			PF_ACPY(&key.addr[pd2.didx], pd2.dst, key.af);
-			key.port[0] = key.port[1] = iih.icmp6_id;
-
-#ifdef __FreeBSD__
-			STATE_LOOKUP(kif, &key, direction, *state, m, pd->pf_mtag);
-#else
-			STATE_LOOKUP(kif, &key, direction, *state, m);
-#endif
-
-			/* translate source/destination address, if necessary */
-			if ((*state)->key[PF_SK_WIRE] !=
-			    (*state)->key[PF_SK_STACK]) {
-				struct pf_state_key *nk =
-				    (*state)->key[pd->didx];
-
-				if (PF_ANEQ(pd2.src,
-				    &nk->addr[pd2.sidx], pd2.af) ||
-				    nk->port[pd2.sidx] != iih.icmp6_id)
-					pf_change_icmp(pd2.src, &iih.icmp6_id,
-					    daddr, &nk->addr[pd2.sidx],
-					    nk->port[pd2.sidx], NULL,
-					    pd2.ip_sum, icmpsum,
-					    pd->ip_sum, 0, AF_INET6);
-
-				if (PF_ANEQ(pd2.dst,
-				    &nk->addr[pd2.didx], pd2.af) ||
-				    nk->port[pd2.didx] != iih.icmp6_id)
-					pf_change_icmp(pd2.dst, &iih.icmp6_id,
-					    NULL, /* XXX Inbound NAT? */
-					    &nk->addr[pd2.didx],
-					    nk->port[pd2.didx], NULL,
-					    pd2.ip_sum, icmpsum,
-					    pd->ip_sum, 0, AF_INET6);
-
-#ifdef __FreeBSD__
-				m_copyback(m, off, sizeof(struct icmp6_hdr),
-				    (caddr_t)pd->hdr.icmp6);
-				m_copyback(m, ipoff2, sizeof(h2_6), (caddr_t)&h2_6);
-				m_copyback(m, off2, sizeof(struct icmp6_hdr),
-				    (caddr_t)&iih);
-#else
-				m_copyback(m, off, sizeof(struct icmp6_hdr),
-				    pd->hdr.icmp6);
-				m_copyback(m, ipoff2, sizeof(h2_6), &h2_6);
-				m_copyback(m, off2, sizeof(struct icmp6_hdr),
-				    &iih);
-#endif
-			}
-			return (PF_PASS);
-			break;
-		}
-#endif /* INET6 */
-		default: {
-			key.af = pd2.af;
-			key.proto = pd2.proto;
-			PF_ACPY(&key.addr[pd2.sidx], pd2.src, key.af);
-			PF_ACPY(&key.addr[pd2.didx], pd2.dst, key.af);
-			key.port[0] = key.port[1] = 0;
-
-#ifdef __FreeBSD__
-			STATE_LOOKUP(kif, &key, direction, *state, m, pd->pf_mtag);
-#else
-			STATE_LOOKUP(kif, &key, direction, *state, m);
-#endif
-
-			/* translate source/destination address, if necessary */
-			if ((*state)->key[PF_SK_WIRE] !=
-			    (*state)->key[PF_SK_STACK]) {
-				struct pf_state_key *nk =
-				    (*state)->key[pd->didx];
-
-				if (PF_ANEQ(pd2.src,
-				    &nk->addr[pd2.sidx], pd2.af))
-					pf_change_icmp(pd2.src, NULL, daddr,
-					    &nk->addr[pd2.sidx], 0, NULL,
-					    pd2.ip_sum, icmpsum,
-					    pd->ip_sum, 0, pd2.af);
-
-				if (PF_ANEQ(pd2.dst,
-				    &nk->addr[pd2.didx], pd2.af))
-					pf_change_icmp(pd2.src, NULL,
-					    NULL, /* XXX Inbound NAT? */
-					    &nk->addr[pd2.didx], 0, NULL,
-					    pd2.ip_sum, icmpsum,
-					    pd->ip_sum, 0, pd2.af);
-
-				switch (pd2.af) {
-#ifdef INET
-				case AF_INET:
-#ifdef __FreeBSD__
-					m_copyback(m, off, ICMP_MINLEN,
-					    (caddr_t)pd->hdr.icmp);
-					m_copyback(m, ipoff2, sizeof(h2), (caddr_t)&h2);
-#else
-					m_copyback(m, off, ICMP_MINLEN,
-					    pd->hdr.icmp);
-					m_copyback(m, ipoff2, sizeof(h2), &h2);
-#endif
-					break;
-#endif /* INET */
-#ifdef INET6
-				case AF_INET6:
-					m_copyback(m, off,
-					    sizeof(struct icmp6_hdr),
-#ifdef __FreeBSD__
-					    (caddr_t)
-#endif
-					    pd->hdr.icmp6);
-					m_copyback(m, ipoff2, sizeof(h2_6),
-#ifdef __FreeBSD__
-					    (caddr_t)
-#endif
-					    &h2_6);
-					break;
-#endif /* INET6 */
-				}
-			}
-			return (PF_PASS);
-			break;
-		}
-		}
-	}
-}
-
-int
-pf_test_state_other(struct pf_state **state, int direction, struct pfi_kif *kif,
-    struct mbuf *m, struct pf_pdesc *pd)
-{
-	struct pf_state_peer	*src, *dst;
-	struct pf_state_key_cmp	 key;
-
-	key.af = pd->af;
-	key.proto = pd->proto;
-	if (direction == PF_IN)	{
-		PF_ACPY(&key.addr[0], pd->src, key.af);
-		PF_ACPY(&key.addr[1], pd->dst, key.af);
-		key.port[0] = key.port[1] = 0;
-	} else {
-		PF_ACPY(&key.addr[1], pd->src, key.af);
-		PF_ACPY(&key.addr[0], pd->dst, key.af);
-		key.port[1] = key.port[0] = 0;
-	}
-
-#ifdef __FreeBSD__
-	STATE_LOOKUP(kif, &key, direction, *state, m, pd->pf_mtag);
-#else
-	STATE_LOOKUP(kif, &key, direction, *state, m);
-#endif
-
-	if (direction == (*state)->direction) {
-		src = &(*state)->src;
-		dst = &(*state)->dst;
-	} else {
-		src = &(*state)->dst;
-		dst = &(*state)->src;
-	}
-
-	/* update states */
-	if (src->state < PFOTHERS_SINGLE)
-		src->state = PFOTHERS_SINGLE;
-	if (dst->state == PFOTHERS_SINGLE)
-		dst->state = PFOTHERS_MULTIPLE;
-
-	/* update expire time */
-	(*state)->expire = time_second;
-	if (src->state == PFOTHERS_MULTIPLE && dst->state == PFOTHERS_MULTIPLE)
-		(*state)->timeout = PFTM_OTHER_MULTIPLE;
-	else
-		(*state)->timeout = PFTM_OTHER_SINGLE;
-
-	/* translate source/destination address, if necessary */
-	if ((*state)->key[PF_SK_WIRE] != (*state)->key[PF_SK_STACK]) {
-		struct pf_state_key *nk = (*state)->key[pd->didx];
-
-#ifdef __FreeBSD__
-		KASSERT(nk, ("%s: nk is null", __FUNCTION__));
-		KASSERT(pd, ("%s: pd is null", __FUNCTION__));
-		KASSERT(pd->src, ("%s: pd->src is null", __FUNCTION__));
-		KASSERT(pd->dst, ("%s: pd->dst is null", __FUNCTION__));
-#else
-		KASSERT(nk);
-		KASSERT(pd);
-		KASSERT(pd->src);
-		KASSERT(pd->dst);
-#endif
-		switch (pd->af) {
-#ifdef INET
-		case AF_INET:
-			if (PF_ANEQ(pd->src, &nk->addr[pd->sidx], AF_INET))
-				pf_change_a(&pd->src->v4.s_addr,
-				    pd->ip_sum,
-				    nk->addr[pd->sidx].v4.s_addr,
-				    0);
-
-
-			if (PF_ANEQ(pd->dst, &nk->addr[pd->didx], AF_INET))
-				pf_change_a(&pd->dst->v4.s_addr,
-				    pd->ip_sum,
-				    nk->addr[pd->didx].v4.s_addr,
-				    0);
-
-				break;
-#endif /* INET */
-#ifdef INET6
-		case AF_INET6:
-			if (PF_ANEQ(pd->src, &nk->addr[pd->sidx], AF_INET))
-				PF_ACPY(pd->src, &nk->addr[pd->sidx], pd->af);
-
-			if (PF_ANEQ(pd->dst, &nk->addr[pd->didx], AF_INET))
-				PF_ACPY(pd->dst, &nk->addr[pd->didx], pd->af);
-#endif /* INET6 */
-		}
-	}
-	return (PF_PASS);
-}
-
-/*
- * ipoff and off are measured from the start of the mbuf chain.
- * h must be at "ipoff" on the mbuf chain.
- */
-void *
-pf_pull_hdr(struct mbuf *m, int off, void *p, int len,
-    u_short *actionp, u_short *reasonp, sa_family_t af)
-{
-	switch (af) {
-#ifdef INET
-	case AF_INET: {
-		struct ip	*h = mtod(m, struct ip *);
-		u_int16_t	 fragoff = (ntohs(h->ip_off) & IP_OFFMASK) << 3;
-
-		if (fragoff) {
-			if (fragoff >= len)
-				ACTION_SET(actionp, PF_PASS);
-			else {
-				ACTION_SET(actionp, PF_DROP);
-				REASON_SET(reasonp, PFRES_FRAG);
-			}
-			return (NULL);
-		}
-		if (m->m_pkthdr.len < off + len ||
-		    ntohs(h->ip_len) < off + len) {
-			ACTION_SET(actionp, PF_DROP);
-			REASON_SET(reasonp, PFRES_SHORT);
-			return (NULL);
-		}
-		break;
-	}
-#endif /* INET */
-#ifdef INET6
-	case AF_INET6: {
-		struct ip6_hdr	*h = mtod(m, struct ip6_hdr *);
-
-		if (m->m_pkthdr.len < off + len ||
-		    (ntohs(h->ip6_plen) + sizeof(struct ip6_hdr)) <
-		    (unsigned)(off + len)) {
-			ACTION_SET(actionp, PF_DROP);
-			REASON_SET(reasonp, PFRES_SHORT);
-			return (NULL);
-		}
-		break;
-	}
-#endif /* INET6 */
-	}
-	m_copydata(m, off, len, p);
-	return (p);
-}
-
-int
-pf_routable(struct pf_addr *addr, sa_family_t af, struct pfi_kif *kif,
-    int rtableid)
-{
-#ifdef __FreeBSD__
-#ifdef RADIX_MPATH
-	struct radix_node_head	*rnh;
-#endif
-#endif
-	struct sockaddr_in	*dst;
-	int			 ret = 1;
-	int			 check_mpath;
-#ifndef __FreeBSD__
-	extern int		 ipmultipath;
-#endif
-#ifdef INET6
-#ifndef __FreeBSD__
-	extern int		 ip6_multipath;
-#endif
-	struct sockaddr_in6	*dst6;
-	struct route_in6	 ro;
-#else
-	struct route		 ro;
-#endif
-	struct radix_node	*rn;
-	struct rtentry		*rt;
-	struct ifnet		*ifp;
-
-	check_mpath = 0;
-#ifdef __FreeBSD__
-#ifdef RADIX_MPATH
-	/* XXX: stick to table 0 for now */
-	rnh = rt_tables_get_rnh(0, af);
-	if (rnh != NULL && rn_mpath_capable(rnh))
-		check_mpath = 1;
-#endif
-#endif
-	bzero(&ro, sizeof(ro));
-	switch (af) {
-	case AF_INET:
-		dst = satosin(&ro.ro_dst);
-		dst->sin_family = AF_INET;
-		dst->sin_len = sizeof(*dst);
-		dst->sin_addr = addr->v4;
-#ifndef __FreeBSD__
-		if (ipmultipath)
-			check_mpath = 1;
-#endif
-		break;
-#ifdef INET6
-	case AF_INET6:
-		/*
-		 * Skip check for addresses with embedded interface scope,
-		 * as they would always match anyway.
-		 */
-		if (IN6_IS_SCOPE_EMBED(&addr->v6))
-			goto out;
-		dst6 = (struct sockaddr_in6 *)&ro.ro_dst;
-		dst6->sin6_family = AF_INET6;
-		dst6->sin6_len = sizeof(*dst6);
-		dst6->sin6_addr = addr->v6;
-#ifndef __FreeBSD__
-		if (ip6_multipath)
-			check_mpath = 1;
-#endif
-		break;
-#endif /* INET6 */
-	default:
-		return (0);
-	}
-
-	/* Skip checks for ipsec interfaces */
-	if (kif != NULL && kif->pfik_ifp->if_type == IFT_ENC)
-		goto out;
-
-#ifdef __FreeBSD__
-	switch (af) {
-#ifdef INET6
-	case AF_INET6:
-		in6_rtalloc_ign(&ro, 0, rtableid);
-		break;
-#endif
-#ifdef INET
-	case AF_INET:
-		in_rtalloc_ign((struct route *)&ro, 0, rtableid);
-		break;
-#endif
-	default:
-		rtalloc_ign((struct route *)&ro, 0);	/* No/default FIB. */
-		break;
-	}
-#else /* ! __FreeBSD__ */
-	rtalloc_noclone((struct route *)&ro, NO_CLONING);
-#endif
-
-	if (ro.ro_rt != NULL) {
-		/* No interface given, this is a no-route check */
-		if (kif == NULL)
-			goto out;
-
-		if (kif->pfik_ifp == NULL) {
-			ret = 0;
-			goto out;
-		}
-
-		/* Perform uRPF check if passed input interface */
-		ret = 0;
-		rn = (struct radix_node *)ro.ro_rt;
-		do {
-			rt = (struct rtentry *)rn;
-#ifndef __FreeBSD__ /* CARPDEV */
-			if (rt->rt_ifp->if_type == IFT_CARP)
-				ifp = rt->rt_ifp->if_carpdev;
-			else
-#endif
-				ifp = rt->rt_ifp;
-
-			if (kif->pfik_ifp == ifp)
-				ret = 1;
-#ifdef __FreeBSD__
-#ifdef RADIX_MPATH
-			rn = rn_mpath_next(rn);
-#endif
-#else
-			rn = rn_mpath_next(rn, 0);
-#endif
-		} while (check_mpath == 1 && rn != NULL && ret == 0);
-	} else
-		ret = 0;
-out:
-	if (ro.ro_rt != NULL)
-		RTFREE(ro.ro_rt);
-	return (ret);
-}
-
-int
-pf_rtlabel_match(struct pf_addr *addr, sa_family_t af, struct pf_addr_wrap *aw,
-    int rtableid)
-{
-	struct sockaddr_in	*dst;
-#ifdef INET6
-	struct sockaddr_in6	*dst6;
-	struct route_in6	 ro;
-#else
-	struct route		 ro;
-#endif
-	int			 ret = 0;
-
-	bzero(&ro, sizeof(ro));
-	switch (af) {
-	case AF_INET:
-		dst = satosin(&ro.ro_dst);
-		dst->sin_family = AF_INET;
-		dst->sin_len = sizeof(*dst);
-		dst->sin_addr = addr->v4;
-		break;
-#ifdef INET6
-	case AF_INET6:
-		dst6 = (struct sockaddr_in6 *)&ro.ro_dst;
-		dst6->sin6_family = AF_INET6;
-		dst6->sin6_len = sizeof(*dst6);
-		dst6->sin6_addr = addr->v6;
-		break;
-#endif /* INET6 */
-	default:
-		return (0);
-	}
-
-#ifdef __FreeBSD__
-	switch (af) {
-#ifdef INET6
-	case AF_INET6:
-		in6_rtalloc_ign(&ro, 0, rtableid);
-		break;
-#endif
-#ifdef INET
-	case AF_INET:
-		in_rtalloc_ign((struct route *)&ro, 0, rtableid);
-		break;
-#endif
-	default:
-		rtalloc_ign((struct route *)&ro, 0);
-		break;
-	}
-#else /* ! __FreeBSD__ */
-	rtalloc_noclone((struct route *)&ro, NO_CLONING);
-#endif
-
-	if (ro.ro_rt != NULL) {
-#ifdef __FreeBSD__
-		/* XXX_IMPORT: later */
-#else
-		if (ro.ro_rt->rt_labelid == aw->v.rtlabel)
-			ret = 1;
-#endif
-		RTFREE(ro.ro_rt);
-	}
-
-	return (ret);
-}
-
-#ifdef INET
-void
-pf_route(struct mbuf **m, struct pf_rule *r, int dir, struct ifnet *oifp,
-    struct pf_state *s, struct pf_pdesc *pd)
-{
-	struct mbuf		*m0, *m1;
-	struct route		 iproute;
-	struct route		*ro = NULL;
-	struct sockaddr_in	*dst;
-	struct ip		*ip;
-	struct ifnet		*ifp = NULL;
-	struct pf_addr		 naddr;
-	struct pf_src_node	*sn = NULL;
-	int			 error = 0;
-#ifdef __FreeBSD__
-	int sw_csum;
-#endif
-#ifdef IPSEC
-	struct m_tag		*mtag;
-#endif /* IPSEC */
-
-	if (m == NULL || *m == NULL || r == NULL ||
-	    (dir != PF_IN && dir != PF_OUT) || oifp == NULL)
-		panic("pf_route: invalid parameters");
-
-#ifdef __FreeBSD__
-	if (pd->pf_mtag->routed++ > 3) {
-#else
-	if ((*m)->m_pkthdr.pf.routed++ > 3) {
-#endif
-		m0 = *m;
-		*m = NULL;
-		goto bad;
-	}
-
-	if (r->rt == PF_DUPTO) {
-#ifdef __FreeBSD__
-		if ((m0 = m_dup(*m, M_DONTWAIT)) == NULL)
-#else
-		if ((m0 = m_copym2(*m, 0, M_COPYALL, M_NOWAIT)) == NULL)
-#endif
-			return;
-	} else {
-		if ((r->rt == PF_REPLYTO) == (r->direction == dir))
-			return;
-		m0 = *m;
-	}
-
-	if (m0->m_len < sizeof(struct ip)) {
-		DPFPRINTF(PF_DEBUG_URGENT,
-		    ("pf_route: m0->m_len < sizeof(struct ip)\n"));
-		goto bad;
-	}
-
-	ip = mtod(m0, struct ip *);
-
-	ro = &iproute;
-	bzero((caddr_t)ro, sizeof(*ro));
-	dst = satosin(&ro->ro_dst);
-	dst->sin_family = AF_INET;
-	dst->sin_len = sizeof(*dst);
-	dst->sin_addr = ip->ip_dst;
-
-	if (r->rt == PF_FASTROUTE) {
-#ifdef __FreeBSD__
-		in_rtalloc_ign(ro, 0, M_GETFIB(m0));
-#else
-		rtalloc(ro);
-#endif
-		if (ro->ro_rt == 0) {
-#ifdef __FreeBSD__
-			KMOD_IPSTAT_INC(ips_noroute);
-#else
-			ipstat.ips_noroute++;
-#endif
-			goto bad;
-		}
-
-		ifp = ro->ro_rt->rt_ifp;
-		ro->ro_rt->rt_use++;
-
-		if (ro->ro_rt->rt_flags & RTF_GATEWAY)
-			dst = satosin(ro->ro_rt->rt_gateway);
-	} else {
-		if (TAILQ_EMPTY(&r->rpool.list)) {
-			DPFPRINTF(PF_DEBUG_URGENT,
-			    ("pf_route: TAILQ_EMPTY(&r->rpool.list)\n"));
-			goto bad;
-		}
-		if (s == NULL) {
-			pf_map_addr(AF_INET, r, (struct pf_addr *)&ip->ip_src,
-			    &naddr, NULL, &sn);
-			if (!PF_AZERO(&naddr, AF_INET))
-				dst->sin_addr.s_addr = naddr.v4.s_addr;
-			ifp = r->rpool.cur->kif ?
-			    r->rpool.cur->kif->pfik_ifp : NULL;
-		} else {
-			if (!PF_AZERO(&s->rt_addr, AF_INET))
-				dst->sin_addr.s_addr =
-				    s->rt_addr.v4.s_addr;
-			ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL;
-		}
-	}
-	if (ifp == NULL)
-		goto bad;
-
-	if (oifp != ifp) {
-#ifdef __FreeBSD__
-		PF_UNLOCK();
-		if (pf_test(PF_OUT, ifp, &m0, NULL, NULL) != PF_PASS) {
-			PF_LOCK();
-			goto bad;
-		} else if (m0 == NULL) {
-			PF_LOCK();
-			goto done;
-		}
-		PF_LOCK();
-#else
-		if (pf_test(PF_OUT, ifp, &m0, NULL) != PF_PASS)
-			goto bad;
-		else if (m0 == NULL)
-			goto done;
-#endif
-		if (m0->m_len < sizeof(struct ip)) {
-			DPFPRINTF(PF_DEBUG_URGENT,
-			    ("pf_route: m0->m_len < sizeof(struct ip)\n"));
-			goto bad;
-		}
-		ip = mtod(m0, struct ip *);
-	}
-
-#ifdef __FreeBSD__
-	/* Copied from FreeBSD 5.1-CURRENT ip_output. */
-	m0->m_pkthdr.csum_flags |= CSUM_IP;
-	sw_csum = m0->m_pkthdr.csum_flags & ~ifp->if_hwassist;
-	if (sw_csum & CSUM_DELAY_DATA) {
-		/*
-		 * XXX: in_delayed_cksum assumes HBO for ip->ip_len (at least)
-		 */
-		NTOHS(ip->ip_len);
-		NTOHS(ip->ip_off);	/* XXX: needed? */
-		in_delayed_cksum(m0);
-		HTONS(ip->ip_len);
-		HTONS(ip->ip_off);
-		sw_csum &= ~CSUM_DELAY_DATA;
-	}
-	m0->m_pkthdr.csum_flags &= ifp->if_hwassist;
-
-	if (ntohs(ip->ip_len) <= ifp->if_mtu ||
-	    (ifp->if_hwassist & CSUM_FRAGMENT &&
-	    ((ip->ip_off & htons(IP_DF)) == 0))) {
-		/*
-		 * ip->ip_len = htons(ip->ip_len);
-		 * ip->ip_off = htons(ip->ip_off);
-		 */
-		ip->ip_sum = 0;
-		if (sw_csum & CSUM_DELAY_IP) {
-			/* From KAME */
-			if (ip->ip_v == IPVERSION &&
-			    (ip->ip_hl << 2) == sizeof(*ip)) {
-				ip->ip_sum = in_cksum_hdr(ip);
-			} else {
-				ip->ip_sum = in_cksum(m0, ip->ip_hl << 2);
-			}
-		}
-		PF_UNLOCK();
-		error = (*ifp->if_output)(ifp, m0, sintosa(dst), ro);
-		PF_LOCK();
-		goto done;
-	}
-#else
-	/* Copied from ip_output. */
-#ifdef IPSEC
-	/*
-	 * If deferred crypto processing is needed, check that the
-	 * interface supports it.
-	 */
-	if ((mtag = m_tag_find(m0, PACKET_TAG_IPSEC_OUT_CRYPTO_NEEDED, NULL))
-	    != NULL && (ifp->if_capabilities & IFCAP_IPSEC) == 0) {
-		/* Notify IPsec to do its own crypto. */
-		ipsp_skipcrypto_unmark((struct tdb_ident *)(mtag + 1));
-		goto bad;
-	}
-#endif /* IPSEC */
-
-	/* Catch routing changes wrt. hardware checksumming for TCP or UDP. */
-	if (m0->m_pkthdr.csum_flags & M_TCPV4_CSUM_OUT) {
-		if (!(ifp->if_capabilities & IFCAP_CSUM_TCPv4) ||
-		    ifp->if_bridge != NULL) {
-			in_delayed_cksum(m0);
-			m0->m_pkthdr.csum_flags &= ~M_TCPV4_CSUM_OUT; /* Clr */
-		}
-	} else if (m0->m_pkthdr.csum_flags & M_UDPV4_CSUM_OUT) {
-		if (!(ifp->if_capabilities & IFCAP_CSUM_UDPv4) ||
-		    ifp->if_bridge != NULL) {
-			in_delayed_cksum(m0);
-			m0->m_pkthdr.csum_flags &= ~M_UDPV4_CSUM_OUT; /* Clr */
-		}
-	}
-
-	if (ntohs(ip->ip_len) <= ifp->if_mtu) {
-		ip->ip_sum = 0;
-		if ((ifp->if_capabilities & IFCAP_CSUM_IPv4) &&
-		    ifp->if_bridge == NULL) {
-			m0->m_pkthdr.csum_flags |= M_IPV4_CSUM_OUT;
-#ifdef __FreeBSD__
-			KMOD_IPSTAT_INC(ips_outhwcsum);
-#else
-			ipstat.ips_outhwcsum++;
-#endif
-		} else
-			ip->ip_sum = in_cksum(m0, ip->ip_hl << 2);
-		/* Update relevant hardware checksum stats for TCP/UDP */
-		if (m0->m_pkthdr.csum_flags & M_TCPV4_CSUM_OUT)
-			KMOD_TCPSTAT_INC(tcps_outhwcsum);
-		else if (m0->m_pkthdr.csum_flags & M_UDPV4_CSUM_OUT)
-			KMOD_UDPSTAT_INC(udps_outhwcsum);
-		error = (*ifp->if_output)(ifp, m0, sintosa(dst), NULL);
-		goto done;
-	}
-#endif
-
-	/*
-	 * Too large for interface; fragment if possible.
-	 * Must be able to put at least 8 bytes per fragment.
-	 */
-	if (ip->ip_off & htons(IP_DF)) {
-#ifdef __FreeBSD__
-		KMOD_IPSTAT_INC(ips_cantfrag);
-#else
-		ipstat.ips_cantfrag++;
-#endif
-		if (r->rt != PF_DUPTO) {
-#ifdef __FreeBSD__
-			/* icmp_error() expects host byte ordering */
-			NTOHS(ip->ip_len);
-			NTOHS(ip->ip_off);
-			PF_UNLOCK();
-			icmp_error(m0, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG, 0,
-			    ifp->if_mtu);
-			PF_LOCK();
-#else
-			icmp_error(m0, ICMP_UNREACH, ICMP_UNREACH_NEEDFRAG, 0,
-			    ifp->if_mtu);
-#endif
-			goto done;
-		} else
-			goto bad;
-	}
-
-	m1 = m0;
-#ifdef __FreeBSD__
-	/*
-	 * XXX: is cheaper + less error prone than own function
-	 */
-	NTOHS(ip->ip_len);
-	NTOHS(ip->ip_off);
-	error = ip_fragment(ip, &m0, ifp->if_mtu, ifp->if_hwassist, sw_csum);
-#else
-	error = ip_fragment(m0, ifp, ifp->if_mtu);
-#endif
-	if (error) {
-#ifndef __FreeBSD__    /* ip_fragment does not do m_freem() on FreeBSD */
-		m0 = NULL;
-#endif
-		goto bad;
-	}
-
-	for (m0 = m1; m0; m0 = m1) {
-		m1 = m0->m_nextpkt;
-		m0->m_nextpkt = 0;
-#ifdef __FreeBSD__
-		if (error == 0) {
-			PF_UNLOCK();
-			error = (*ifp->if_output)(ifp, m0, sintosa(dst),
-			    NULL);
-			PF_LOCK();
-		} else
-#else
-		if (error == 0)
-			error = (*ifp->if_output)(ifp, m0, sintosa(dst),
-			    NULL);
-		else
-#endif
-			m_freem(m0);
-	}
-
-	if (error == 0)
-#ifdef __FreeBSD__
-		KMOD_IPSTAT_INC(ips_fragmented);
-#else
-		ipstat.ips_fragmented++;
-#endif
-
-done:
-	if (r->rt != PF_DUPTO)
-		*m = NULL;
-	if (ro == &iproute && ro->ro_rt)
-		RTFREE(ro->ro_rt);
-	return;
-
-bad:
-	m_freem(m0);
-	goto done;
-}
-#endif /* INET */
-
-#ifdef INET6
-void
-pf_route6(struct mbuf **m, struct pf_rule *r, int dir, struct ifnet *oifp,
-    struct pf_state *s, struct pf_pdesc *pd)
-{
-	struct mbuf		*m0;
-	struct route_in6	 ip6route;
-	struct route_in6	*ro;
-	struct sockaddr_in6	*dst;
-	struct ip6_hdr		*ip6;
-	struct ifnet		*ifp = NULL;
-	struct pf_addr		 naddr;
-	struct pf_src_node	*sn = NULL;
-
-	if (m == NULL || *m == NULL || r == NULL ||
-	    (dir != PF_IN && dir != PF_OUT) || oifp == NULL)
-		panic("pf_route6: invalid parameters");
-
-#ifdef __FreeBSD__
-	if (pd->pf_mtag->routed++ > 3) {
-#else
-	if ((*m)->m_pkthdr.pf.routed++ > 3) {
-#endif
-		m0 = *m;
-		*m = NULL;
-		goto bad;
-	}
-
-	if (r->rt == PF_DUPTO) {
-#ifdef __FreeBSD__
-		if ((m0 = m_dup(*m, M_DONTWAIT)) == NULL)
-#else
-		if ((m0 = m_copym2(*m, 0, M_COPYALL, M_NOWAIT)) == NULL)
-#endif
-			return;
-	} else {
-		if ((r->rt == PF_REPLYTO) == (r->direction == dir))
-			return;
-		m0 = *m;
-	}
-
-	if (m0->m_len < sizeof(struct ip6_hdr)) {
-		DPFPRINTF(PF_DEBUG_URGENT,
-		    ("pf_route6: m0->m_len < sizeof(struct ip6_hdr)\n"));
-		goto bad;
-	}
-	ip6 = mtod(m0, struct ip6_hdr *);
-
-	ro = &ip6route;
-	bzero((caddr_t)ro, sizeof(*ro));
-	dst = (struct sockaddr_in6 *)&ro->ro_dst;
-	dst->sin6_family = AF_INET6;
-	dst->sin6_len = sizeof(*dst);
-	dst->sin6_addr = ip6->ip6_dst;
-
-	/* Cheat. XXX why only in the v6 case??? */
-	if (r->rt == PF_FASTROUTE) {
-#ifdef __FreeBSD__
-		m0->m_flags |= M_SKIP_FIREWALL;
-		PF_UNLOCK();
-		ip6_output(m0, NULL, NULL, 0, NULL, NULL, NULL);
-#else
-		m0->m_pkthdr.pf.flags |= PF_TAG_GENERATED;
-		ip6_output(m0, NULL, NULL, 0, NULL, NULL, NULL);
-#endif
-		return;
-	}
-
-	if (TAILQ_EMPTY(&r->rpool.list)) {
-		DPFPRINTF(PF_DEBUG_URGENT,
-		    ("pf_route6: TAILQ_EMPTY(&r->rpool.list)\n"));
-		goto bad;
-	}
-	if (s == NULL) {
-		pf_map_addr(AF_INET6, r, (struct pf_addr *)&ip6->ip6_src,
-		    &naddr, NULL, &sn);
-		if (!PF_AZERO(&naddr, AF_INET6))
-			PF_ACPY((struct pf_addr *)&dst->sin6_addr,
-			    &naddr, AF_INET6);
-		ifp = r->rpool.cur->kif ? r->rpool.cur->kif->pfik_ifp : NULL;
-	} else {
-		if (!PF_AZERO(&s->rt_addr, AF_INET6))
-			PF_ACPY((struct pf_addr *)&dst->sin6_addr,
-			    &s->rt_addr, AF_INET6);
-		ifp = s->rt_kif ? s->rt_kif->pfik_ifp : NULL;
-	}
-	if (ifp == NULL)
-		goto bad;
-
-	if (oifp != ifp) {
-#ifdef __FreeBSD__
-		PF_UNLOCK();
-		if (pf_test6(PF_OUT, ifp, &m0, NULL, NULL) != PF_PASS) {
-			PF_LOCK();
-			goto bad;
-		} else if (m0 == NULL) {
-			PF_LOCK();
-			goto done;
-		}
-		PF_LOCK();
-#else
-		if (pf_test6(PF_OUT, ifp, &m0, NULL) != PF_PASS)
-			goto bad;
-		else if (m0 == NULL)
-			goto done;
-#endif
-		if (m0->m_len < sizeof(struct ip6_hdr)) {
-			DPFPRINTF(PF_DEBUG_URGENT,
-			    ("pf_route6: m0->m_len < sizeof(struct ip6_hdr)\n"));
-			goto bad;
-		}
-		ip6 = mtod(m0, struct ip6_hdr *);
-	}
-
-	/*
-	 * If the packet is too large for the outgoing interface,
-	 * send back an icmp6 error.
-	 */
-	if (IN6_IS_SCOPE_EMBED(&dst->sin6_addr))
-		dst->sin6_addr.s6_addr16[1] = htons(ifp->if_index);
-	if ((u_long)m0->m_pkthdr.len <= ifp->if_mtu) {
-#ifdef __FreeBSD__
-		PF_UNLOCK();
-#endif
-		nd6_output(ifp, ifp, m0, dst, NULL);
-#ifdef __FreeBSD__
-		PF_LOCK();
-#endif
-	} else {
-		in6_ifstat_inc(ifp, ifs6_in_toobig);
-#ifdef __FreeBSD__
-		if (r->rt != PF_DUPTO) {
-			PF_UNLOCK();
-			icmp6_error(m0, ICMP6_PACKET_TOO_BIG, 0, ifp->if_mtu);
-			PF_LOCK();
-		} else
-#else
-		if (r->rt != PF_DUPTO)
-			icmp6_error(m0, ICMP6_PACKET_TOO_BIG, 0, ifp->if_mtu);
-		else
-#endif
-			goto bad;
-	}
-
-done:
-	if (r->rt != PF_DUPTO)
-		*m = NULL;
-	return;
-
-bad:
-	m_freem(m0);
-	goto done;
-}
-#endif /* INET6 */
-
-#ifdef __FreeBSD__
-/*
- * FreeBSD supports cksum offloads for the following drivers.
- *  em(4), fxp(4), ixgb(4), lge(4), ndis(4), nge(4), re(4),
- *   ti(4), txp(4), xl(4)
- *
- * CSUM_DATA_VALID | CSUM_PSEUDO_HDR :
- *  network driver performed cksum including pseudo header, need to verify
- *   csum_data
- * CSUM_DATA_VALID :
- *  network driver performed cksum, needs to additional pseudo header
- *  cksum computation with partial csum_data(i.e. lack of H/W support for
- *  pseudo header, for instance hme(4), sk(4) and possibly gem(4))
- *
- * After validating the cksum of packet, set both flag CSUM_DATA_VALID and
- * CSUM_PSEUDO_HDR in order to avoid recomputation of the cksum in upper
- * TCP/UDP layer.
- * Also, set csum_data to 0xffff to force cksum validation.
- */
-int
-pf_check_proto_cksum(struct mbuf *m, int off, int len, u_int8_t p, sa_family_t af)
-{
-	u_int16_t sum = 0;
-	int hw_assist = 0;
-	struct ip *ip;
-
-	if (off < sizeof(struct ip) || len < sizeof(struct udphdr))
-		return (1);
-	if (m->m_pkthdr.len < off + len)
-		return (1);
-
-	switch (p) {
-	case IPPROTO_TCP:
-		if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) {
-			if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR) {
-				sum = m->m_pkthdr.csum_data;
-			} else {
-				ip = mtod(m, struct ip *);
-				sum = in_pseudo(ip->ip_src.s_addr,
-				ip->ip_dst.s_addr, htonl((u_short)len + 
-				m->m_pkthdr.csum_data + IPPROTO_TCP));
-			}
-			sum ^= 0xffff;
-			++hw_assist;
-		}
-		break;
-	case IPPROTO_UDP:
-		if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) {
-			if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR) {
-				sum = m->m_pkthdr.csum_data;
-			} else {
-				ip = mtod(m, struct ip *);
-				sum = in_pseudo(ip->ip_src.s_addr,
-				ip->ip_dst.s_addr, htonl((u_short)len +
-				m->m_pkthdr.csum_data + IPPROTO_UDP));
-			}
-			sum ^= 0xffff;
-			++hw_assist;
-		}
-		break;
-	case IPPROTO_ICMP:
-#ifdef INET6
-	case IPPROTO_ICMPV6:
-#endif /* INET6 */
-		break;
-	default:
-		return (1);
-	}
-
-	if (!hw_assist) {
-		switch (af) {
-		case AF_INET:
-			if (p == IPPROTO_ICMP) {
-				if (m->m_len < off)
-					return (1);
-				m->m_data += off;
-				m->m_len -= off;
-				sum = in_cksum(m, len);
-				m->m_data -= off;
-				m->m_len += off;
-			} else {
-				if (m->m_len < sizeof(struct ip))
-					return (1);
-				sum = in4_cksum(m, p, off, len);
-			}
-			break;
-#ifdef INET6
-		case AF_INET6:
-			if (m->m_len < sizeof(struct ip6_hdr))
-				return (1);
-			sum = in6_cksum(m, p, off, len);
-			break;
-#endif /* INET6 */
-		default:
-			return (1);
-		}
-	}
-	if (sum) {
-		switch (p) {
-		case IPPROTO_TCP:
-		    {
-			KMOD_TCPSTAT_INC(tcps_rcvbadsum);
-			break;
-		    }
-		case IPPROTO_UDP:
-		    {
-			KMOD_UDPSTAT_INC(udps_badsum);
-			break;
-		    }
-#ifdef INET
-		case IPPROTO_ICMP:
-		    {
-			KMOD_ICMPSTAT_INC(icps_checksum);
-			break;
-		    }
-#endif
-#ifdef INET6
-		case IPPROTO_ICMPV6:
-		    {
-			KMOD_ICMP6STAT_INC(icp6s_checksum);
-			break;
-		    }
-#endif /* INET6 */
-		}
-		return (1);
-	} else {
-		if (p == IPPROTO_TCP || p == IPPROTO_UDP) {
-			m->m_pkthdr.csum_flags |=
-			    (CSUM_DATA_VALID | CSUM_PSEUDO_HDR);
-			m->m_pkthdr.csum_data = 0xffff;
-		}
-	}
-	return (0);
-}
-#else /* !__FreeBSD__ */
-
-/*
- * check protocol (tcp/udp/icmp/icmp6) checksum and set mbuf flag
- *   off is the offset where the protocol header starts
- *   len is the total length of protocol header plus payload
- * returns 0 when the checksum is valid, otherwise returns 1.
- */
-int
-pf_check_proto_cksum(struct mbuf *m, int off, int len, u_int8_t p,
-    sa_family_t af)
-{
-	u_int16_t flag_ok, flag_bad;
-	u_int16_t sum;
-
-	switch (p) {
-	case IPPROTO_TCP:
-		flag_ok = M_TCP_CSUM_IN_OK;
-		flag_bad = M_TCP_CSUM_IN_BAD;
-		break;
-	case IPPROTO_UDP:
-		flag_ok = M_UDP_CSUM_IN_OK;
-		flag_bad = M_UDP_CSUM_IN_BAD;
-		break;
-	case IPPROTO_ICMP:
-#ifdef INET6
-	case IPPROTO_ICMPV6:
-#endif /* INET6 */
-		flag_ok = flag_bad = 0;
-		break;
-	default:
-		return (1);
-	}
-	if (m->m_pkthdr.csum_flags & flag_ok)
-		return (0);
-	if (m->m_pkthdr.csum_flags & flag_bad)
-		return (1);
-	if (off < sizeof(struct ip) || len < sizeof(struct udphdr))
-		return (1);
-	if (m->m_pkthdr.len < off + len)
-		return (1);
-	switch (af) {
-#ifdef INET
-	case AF_INET:
-		if (p == IPPROTO_ICMP) {
-			if (m->m_len < off)
-				return (1);
-			m->m_data += off;
-			m->m_len -= off;
-			sum = in_cksum(m, len);
-			m->m_data -= off;
-			m->m_len += off;
-		} else {
-			if (m->m_len < sizeof(struct ip))
-				return (1);
-			sum = in4_cksum(m, p, off, len);
-		}
-		break;
-#endif /* INET */
-#ifdef INET6
-	case AF_INET6:
-		if (m->m_len < sizeof(struct ip6_hdr))
-			return (1);
-		sum = in6_cksum(m, p, off, len);
-		break;
-#endif /* INET6 */
-	default:
-		return (1);
-	}
-	if (sum) {
-		m->m_pkthdr.csum_flags |= flag_bad;
-		switch (p) {
-		case IPPROTO_TCP:
-			KMOD_TCPSTAT_INC(tcps_rcvbadsum);
-			break;
-		case IPPROTO_UDP:
-			KMOD_UDPSTAT_INC(udps_badsum);
-			break;
-#ifdef INET
-		case IPPROTO_ICMP:
-			KMOD_ICMPSTAT_INC(icps_checksum);
-			break;
-#endif
-#ifdef INET6
-		case IPPROTO_ICMPV6:
-			KMOD_ICMP6STAT_INC(icp6s_checksum);
-			break;
-#endif /* INET6 */
-		}
-		return (1);
-	}
-	m->m_pkthdr.csum_flags |= flag_ok;
-	return (0);
-}
-#endif
-
-#ifndef __FreeBSD__
-struct pf_divert *
-pf_find_divert(struct mbuf *m)
-{
-	struct m_tag    *mtag;
-
-	if ((mtag = m_tag_find(m, PACKET_TAG_PF_DIVERT, NULL)) == NULL)
-		return (NULL);
-
-	return ((struct pf_divert *)(mtag + 1));
-}
-
-struct pf_divert *
-pf_get_divert(struct mbuf *m)
-{
-	struct m_tag    *mtag;
-
-	if ((mtag = m_tag_find(m, PACKET_TAG_PF_DIVERT, NULL)) == NULL) {
-		mtag = m_tag_get(PACKET_TAG_PF_DIVERT, sizeof(struct pf_divert),
-		    M_NOWAIT);
-		if (mtag == NULL)
-			return (NULL);
-		bzero(mtag + 1, sizeof(struct pf_divert));
-		m_tag_prepend(m, mtag);
-	}
-
-	return ((struct pf_divert *)(mtag + 1));
-}
-#endif
-
-#ifdef INET
-int
-#ifdef __FreeBSD__
-pf_test(int dir, struct ifnet *ifp, struct mbuf **m0,
-    struct ether_header *eh, struct inpcb *inp)
-#else
-pf_test(int dir, struct ifnet *ifp, struct mbuf **m0,
-    struct ether_header *eh)
-#endif
-{
-	struct pfi_kif		*kif;
-	u_short			 action, reason = 0, log = 0;
-	struct mbuf		*m = *m0;
-#ifdef __FreeBSD__
-	struct ip		*h = NULL;
-	struct m_tag		*ipfwtag;
-	struct pf_rule		*a = NULL, *r = &V_pf_default_rule, *tr, *nr;
-#else
-	struct ip		*h;
-	struct pf_rule		*a = NULL, *r = &pf_default_rule, *tr, *nr;
-#endif
-	struct pf_state		*s = NULL;
-	struct pf_ruleset	*ruleset = NULL;
-	struct pf_pdesc		 pd;
-	int			 off, dirndx, pqid = 0;
-
-#ifdef __FreeBSD__
-	PF_LOCK();
-	if (!V_pf_status.running)
-	{
-		PF_UNLOCK();
-		return (PF_PASS);
-	}
-#else
-	if (!pf_status.running)
-		return (PF_PASS);
-#endif
-
-	memset(&pd, 0, sizeof(pd));
-#ifdef __FreeBSD__
-	if ((pd.pf_mtag = pf_get_mtag(m)) == NULL) {
-		PF_UNLOCK();
-		DPFPRINTF(PF_DEBUG_URGENT,
-		    ("pf_test: pf_get_mtag returned NULL\n"));
-		return (PF_DROP);
-	}
-#endif
-#ifndef __FreeBSD__
-	if (ifp->if_type == IFT_CARP && ifp->if_carpdev)
-		kif = (struct pfi_kif *)ifp->if_carpdev->if_pf_kif;
-	else
-#endif
-		kif = (struct pfi_kif *)ifp->if_pf_kif;
-
-	if (kif == NULL) {
-#ifdef __FreeBSD__
-		PF_UNLOCK();
-#endif
-		DPFPRINTF(PF_DEBUG_URGENT,
-		    ("pf_test: kif == NULL, if_xname %s\n", ifp->if_xname));
-		return (PF_DROP);
-	}
-	if (kif->pfik_flags & PFI_IFLAG_SKIP)
-#ifdef __FreeBSD__
-	{
-		PF_UNLOCK();
-#endif
-		return (PF_PASS);
-#ifdef __FreeBSD__
-	}
-#endif
-
-#ifdef __FreeBSD__
-	M_ASSERTPKTHDR(m);
-#else
-#ifdef DIAGNOSTIC
-	if ((m->m_flags & M_PKTHDR) == 0)
-		panic("non-M_PKTHDR is passed to pf_test");
-#endif /* DIAGNOSTIC */
-#endif
-
-	if (m->m_pkthdr.len < (int)sizeof(*h)) {
-		action = PF_DROP;
-		REASON_SET(&reason, PFRES_SHORT);
-		log = 1;
-		goto done;
-	}
-
-#ifdef __FreeBSD__
-	if (m->m_flags & M_SKIP_FIREWALL) {
-		PF_UNLOCK();
-		return (PF_PASS);
-	}
-#else
-	if (m->m_pkthdr.pf.flags & PF_TAG_GENERATED)
-		return (PF_PASS);
-#endif
-	
-#ifdef __FreeBSD__
-	if (ip_divert_ptr != NULL &&
-	    ((ipfwtag = m_tag_locate(m, MTAG_IPFW_RULE, 0, NULL)) != NULL)) {
-		struct ipfw_rule_ref *rr = (struct ipfw_rule_ref *)(ipfwtag+1);
-		if (rr->info & IPFW_IS_DIVERT && rr->rulenum == 0) {
-			pd.pf_mtag->flags |= PF_PACKET_LOOPED;
-			m_tag_delete(m, ipfwtag);
-		}
-		if (pd.pf_mtag->flags & PF_FASTFWD_OURS_PRESENT) {
-			m->m_flags |= M_FASTFWD_OURS;
-			pd.pf_mtag->flags &= ~PF_FASTFWD_OURS_PRESENT;
-		}
-	} else
-#endif
-	/* We do IP header normalization and packet reassembly here */
-	if (pf_normalize_ip(m0, dir, kif, &reason, &pd) != PF_PASS) {
-		action = PF_DROP;
-		goto done;
-	}
-	m = *m0;	/* pf_normalize messes with m0 */
-	h = mtod(m, struct ip *);
-
-	off = h->ip_hl << 2;
-	if (off < (int)sizeof(*h)) {
-		action = PF_DROP;
-		REASON_SET(&reason, PFRES_SHORT);
-		log = 1;
-		goto done;
-	}
-
-	pd.src = (struct pf_addr *)&h->ip_src;
-	pd.dst = (struct pf_addr *)&h->ip_dst;
-	pd.sport = pd.dport = NULL;
-	pd.ip_sum = &h->ip_sum;
-	pd.proto_sum = NULL;
-	pd.proto = h->ip_p;
-	pd.dir = dir;
-	pd.sidx = (dir == PF_IN) ? 0 : 1;
-	pd.didx = (dir == PF_IN) ? 1 : 0;
-	pd.af = AF_INET;
-	pd.tos = h->ip_tos;
-	pd.tot_len = ntohs(h->ip_len);
-	pd.eh = eh;
-
-	/* handle fragments that didn't get reassembled by normalization */
-	if (h->ip_off & htons(IP_MF | IP_OFFMASK)) {
-		action = pf_test_fragment(&r, dir, kif, m, h,
-		    &pd, &a, &ruleset);
-		goto done;
-	}
-
-	switch (h->ip_p) {
-
-	case IPPROTO_TCP: {
-		struct tcphdr	th;
-
-		pd.hdr.tcp = &th;
-		if (!pf_pull_hdr(m, off, &th, sizeof(th),
-		    &action, &reason, AF_INET)) {
-			log = action != PF_PASS;
-			goto done;
-		}
-		pd.p_len = pd.tot_len - off - (th.th_off << 2);
-		if ((th.th_flags & TH_ACK) && pd.p_len == 0)
-			pqid = 1;
-		action = pf_normalize_tcp(dir, kif, m, 0, off, h, &pd);
-		if (action == PF_DROP)
-			goto done;
-		action = pf_test_state_tcp(&s, dir, kif, m, off, h, &pd,
-		    &reason);
-		if (action == PF_PASS) {
-#if NPFSYNC > 0
-#ifdef __FreeBSD__
-			if (pfsync_update_state_ptr != NULL)
-				pfsync_update_state_ptr(s);
-#else
-			pfsync_update_state(s);
-#endif
-#endif /* NPFSYNC */
-			r = s->rule.ptr;
-			a = s->anchor.ptr;
-			log = s->log;
-		} else if (s == NULL)
-#ifdef __FreeBSD__
-			action = pf_test_rule(&r, &s, dir, kif,
-			    m, off, h, &pd, &a, &ruleset, NULL, inp);
-#else
-			action = pf_test_rule(&r, &s, dir, kif,
-			    m, off, h, &pd, &a, &ruleset, &ipintrq);
-#endif
-		break;
-	}
-
-	case IPPROTO_UDP: {
-		struct udphdr	uh;
-
-		pd.hdr.udp = &uh;
-		if (!pf_pull_hdr(m, off, &uh, sizeof(uh),
-		    &action, &reason, AF_INET)) {
-			log = action != PF_PASS;
-			goto done;
-		}
-		if (uh.uh_dport == 0 ||
-		    ntohs(uh.uh_ulen) > m->m_pkthdr.len - off ||
-		    ntohs(uh.uh_ulen) < sizeof(struct udphdr)) {
-			action = PF_DROP;
-			REASON_SET(&reason, PFRES_SHORT);
-			goto done;
-		}
-		action = pf_test_state_udp(&s, dir, kif, m, off, h, &pd);
-		if (action == PF_PASS) {
-#if NPFSYNC > 0
-#ifdef __FreeBSD__
-			if (pfsync_update_state_ptr != NULL)
-				pfsync_update_state_ptr(s);
-#else
-			pfsync_update_state(s);
-#endif
-#endif /* NPFSYNC */
-			r = s->rule.ptr;
-			a = s->anchor.ptr;
-			log = s->log;
-		} else if (s == NULL)
-#ifdef __FreeBSD__
-			action = pf_test_rule(&r, &s, dir, kif,
-			    m, off, h, &pd, &a, &ruleset, NULL, inp);
-#else
-			action = pf_test_rule(&r, &s, dir, kif,
-			    m, off, h, &pd, &a, &ruleset, &ipintrq);
-#endif
-		break;
-	}
-
-	case IPPROTO_ICMP: {
-		struct icmp	ih;
-
-		pd.hdr.icmp = &ih;
-		if (!pf_pull_hdr(m, off, &ih, ICMP_MINLEN,
-		    &action, &reason, AF_INET)) {
-			log = action != PF_PASS;
-			goto done;
-		}
-		action = pf_test_state_icmp(&s, dir, kif, m, off, h, &pd,
-		    &reason);
-		if (action == PF_PASS) {
-#if NPFSYNC > 0
-#ifdef __FreeBSD__
-			if (pfsync_update_state_ptr != NULL)
-				pfsync_update_state_ptr(s);
-#else
-			pfsync_update_state(s);
-#endif
-#endif /* NPFSYNC */
-			r = s->rule.ptr;
-			a = s->anchor.ptr;
-			log = s->log;
-		} else if (s == NULL)
-#ifdef __FreeBSD__
-			action = pf_test_rule(&r, &s, dir, kif,
-			    m, off, h, &pd, &a, &ruleset, NULL, inp);
-#else
-			action = pf_test_rule(&r, &s, dir, kif,
-			    m, off, h, &pd, &a, &ruleset, &ipintrq);
-#endif
-		break;
-	}
-
-#ifdef INET6
-	case IPPROTO_ICMPV6: {
-		action = PF_DROP;
-		DPFPRINTF(PF_DEBUG_MISC,
-		    ("pf: dropping IPv4 packet with ICMPv6 payload\n"));
-		goto done;
-	}
-#endif
-
-	default:
-		action = pf_test_state_other(&s, dir, kif, m, &pd);
-		if (action == PF_PASS) {
-#if NPFSYNC > 0
-#ifdef __FreeBSD__
-			if (pfsync_update_state_ptr != NULL)
-				pfsync_update_state_ptr(s);
-#else
-			pfsync_update_state(s);
-#endif
-#endif /* NPFSYNC */
-			r = s->rule.ptr;
-			a = s->anchor.ptr;
-			log = s->log;
-		} else if (s == NULL)
-#ifdef __FreeBSD__
-			action = pf_test_rule(&r, &s, dir, kif, m, off, h,
-			    &pd, &a, &ruleset, NULL, inp);
-#else
-			action = pf_test_rule(&r, &s, dir, kif, m, off, h,
-			    &pd, &a, &ruleset, &ipintrq);
-#endif
-		break;
-	}
-
-done:
-	if (action == PF_PASS && h->ip_hl > 5 &&
-	    !((s && s->state_flags & PFSTATE_ALLOWOPTS) || r->allow_opts)) {
-		action = PF_DROP;
-		REASON_SET(&reason, PFRES_IPOPTIONS);
-		log = 1;
-		DPFPRINTF(PF_DEBUG_MISC,
-		    ("pf: dropping packet with ip options\n"));
-	}
-
-	if ((s && s->tag) || r->rtableid >= 0)
-#ifdef __FreeBSD__
-		pf_tag_packet(m, s ? s->tag : 0, r->rtableid, pd.pf_mtag);
-#else
-		pf_tag_packet(m, s ? s->tag : 0, r->rtableid);
-#endif
-
-	if (dir == PF_IN && s && s->key[PF_SK_STACK])
-#ifdef __FreeBSD__
-		pd.pf_mtag->statekey = s->key[PF_SK_STACK];
-#else
-		m->m_pkthdr.pf.statekey = s->key[PF_SK_STACK];
-#endif
-
-#ifdef ALTQ
-	if (action == PF_PASS && r->qid) {
-#ifdef __FreeBSD__
-		if (pqid || (pd.tos & IPTOS_LOWDELAY))
-			pd.pf_mtag->qid = r->pqid;
-		else
-			pd.pf_mtag->qid = r->qid;
-		/* add hints for ecn */
-		pd.pf_mtag->hdr = h;
-
-#else
-		if (pqid || (pd.tos & IPTOS_LOWDELAY))
-			m->m_pkthdr.pf.qid = r->pqid;
-		else
-			m->m_pkthdr.pf.qid = r->qid;
-		/* add hints for ecn */
-		m->m_pkthdr.pf.hdr = h;
-#endif
-	}
-#endif /* ALTQ */
-
-	/*
-	 * connections redirected to loopback should not match sockets
-	 * bound specifically to loopback due to security implications,
-	 * see tcp_input() and in_pcblookup_listen().
-	 */
-	if (dir == PF_IN && action == PF_PASS && (pd.proto == IPPROTO_TCP ||
-	    pd.proto == IPPROTO_UDP) && s != NULL && s->nat_rule.ptr != NULL &&
-	    (s->nat_rule.ptr->action == PF_RDR ||
-	    s->nat_rule.ptr->action == PF_BINAT) &&
-	    (ntohl(pd.dst->v4.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET)
-#ifdef __FreeBSD__
-		m->m_flags |= M_SKIP_FIREWALL;
-#else
-		m->m_pkthdr.pf.flags |= PF_TAG_TRANSLATE_LOCALHOST;
-#endif
-
-#ifdef __FreeBSD__
-	if (action == PF_PASS && r->divert.port &&
-	    ip_divert_ptr != NULL && !PACKET_LOOPED()) {
-
-		ipfwtag = m_tag_alloc(MTAG_IPFW_RULE, 0,
-				sizeof(struct ipfw_rule_ref), M_NOWAIT | M_ZERO);
-		if (ipfwtag != NULL) {
-			((struct ipfw_rule_ref *)(ipfwtag+1))->info =
-			    ntohs(r->divert.port);
-			((struct ipfw_rule_ref *)(ipfwtag+1))->rulenum = dir;
-
-			m_tag_prepend(m, ipfwtag);
-
-			PF_UNLOCK();
-
-			if (m->m_flags & M_FASTFWD_OURS) {
-				pd.pf_mtag->flags |= PF_FASTFWD_OURS_PRESENT;
-				m->m_flags &= ~M_FASTFWD_OURS;
-			}
-
-			ip_divert_ptr(*m0,
-				dir ==  PF_IN ? DIR_IN : DIR_OUT);
-			*m0 = NULL;
-			return (action);
-		} else {
-			/* XXX: ipfw has the same behaviour! */
-			action = PF_DROP;
-			REASON_SET(&reason, PFRES_MEMORY);
-			log = 1;
-			DPFPRINTF(PF_DEBUG_MISC,
-			    ("pf: failed to allocate divert tag\n"));
-		}
-	}
-#else
-	if (dir == PF_IN && action == PF_PASS && r->divert.port) {
-		struct pf_divert *divert;
-
-		if ((divert = pf_get_divert(m))) {
-			m->m_pkthdr.pf.flags |= PF_TAG_DIVERTED;
-			divert->port = r->divert.port;
-			divert->addr.ipv4 = r->divert.addr.v4;
-		}
-	}
-#endif
-
-	if (log) {
-		struct pf_rule *lr;
-
-		if (s != NULL && s->nat_rule.ptr != NULL &&
-		    s->nat_rule.ptr->log & PF_LOG_ALL)
-			lr = s->nat_rule.ptr;
-		else
-			lr = r;
-		PFLOG_PACKET(kif, h, m, AF_INET, dir, reason, lr, a, ruleset,
-		    &pd);
-	}
-
-	kif->pfik_bytes[0][dir == PF_OUT][action != PF_PASS] += pd.tot_len;
-	kif->pfik_packets[0][dir == PF_OUT][action != PF_PASS]++;
-
-	if (action == PF_PASS || r->action == PF_DROP) {
-		dirndx = (dir == PF_OUT);
-		r->packets[dirndx]++;
-		r->bytes[dirndx] += pd.tot_len;
-		if (a != NULL) {
-			a->packets[dirndx]++;
-			a->bytes[dirndx] += pd.tot_len;
-		}
-		if (s != NULL) {
-			if (s->nat_rule.ptr != NULL) {
-				s->nat_rule.ptr->packets[dirndx]++;
-				s->nat_rule.ptr->bytes[dirndx] += pd.tot_len;
-			}
-			if (s->src_node != NULL) {
-				s->src_node->packets[dirndx]++;
-				s->src_node->bytes[dirndx] += pd.tot_len;
-			}
-			if (s->nat_src_node != NULL) {
-				s->nat_src_node->packets[dirndx]++;
-				s->nat_src_node->bytes[dirndx] += pd.tot_len;
-			}
-			dirndx = (dir == s->direction) ? 0 : 1;
-			s->packets[dirndx]++;
-			s->bytes[dirndx] += pd.tot_len;
-		}
-		tr = r;
-		nr = (s != NULL) ? s->nat_rule.ptr : pd.nat_rule;
-#ifdef __FreeBSD__
-		if (nr != NULL && r == &V_pf_default_rule)
-#else
-		if (nr != NULL && r == &pf_default_rule)
-#endif
-			tr = nr;
-		if (tr->src.addr.type == PF_ADDR_TABLE)
-			pfr_update_stats(tr->src.addr.p.tbl,
-			    (s == NULL) ? pd.src :
-			    &s->key[(s->direction == PF_IN)]->
-				addr[(s->direction == PF_OUT)],
-			    pd.af, pd.tot_len, dir == PF_OUT,
-			    r->action == PF_PASS, tr->src.neg);
-		if (tr->dst.addr.type == PF_ADDR_TABLE)
-			pfr_update_stats(tr->dst.addr.p.tbl,
-			    (s == NULL) ? pd.dst :
-			    &s->key[(s->direction == PF_IN)]->
-				addr[(s->direction == PF_IN)],
-			    pd.af, pd.tot_len, dir == PF_OUT,
-			    r->action == PF_PASS, tr->dst.neg);
-	}
-
-	switch (action) {
-	case PF_SYNPROXY_DROP:
-		m_freem(*m0);
-	case PF_DEFER:
-		*m0 = NULL;
-		action = PF_PASS;
-		break;
-	default:
-		/* pf_route can free the mbuf causing *m0 to become NULL */
-		if (r->rt)
-			pf_route(m0, r, dir, kif->pfik_ifp, s, &pd);
-		break;
-	}
-#ifdef __FreeBSD__
-	PF_UNLOCK();
-#endif
-	return (action);
-}
-#endif /* INET */
-
-#ifdef INET6
-int
-#ifdef __FreeBSD__
-pf_test6(int dir, struct ifnet *ifp, struct mbuf **m0,
-    struct ether_header *eh, struct inpcb *inp)
-#else
-pf_test6(int dir, struct ifnet *ifp, struct mbuf **m0,
-    struct ether_header *eh)
-#endif
-{
-	struct pfi_kif		*kif;
-	u_short			 action, reason = 0, log = 0;
-	struct mbuf		*m = *m0, *n = NULL;
-#ifdef __FreeBSD__
-	struct ip6_hdr		*h = NULL;
-	struct pf_rule		*a = NULL, *r = &V_pf_default_rule, *tr, *nr;
-#else
-	struct ip6_hdr		*h;
-	struct pf_rule		*a = NULL, *r = &pf_default_rule, *tr, *nr;
-#endif
-	struct pf_state		*s = NULL;
-	struct pf_ruleset	*ruleset = NULL;
-	struct pf_pdesc		 pd;
-	int			 off, terminal = 0, dirndx, rh_cnt = 0;
-
-#ifdef __FreeBSD__
-	PF_LOCK();
-	if (!V_pf_status.running) {
-		PF_UNLOCK();
-		return (PF_PASS);
-	}
-#else
-	if (!pf_status.running)
-		return (PF_PASS);
-#endif
-
-	memset(&pd, 0, sizeof(pd));
-#ifdef __FreeBSD__
-	if ((pd.pf_mtag = pf_get_mtag(m)) == NULL) {
-		PF_UNLOCK();
-		DPFPRINTF(PF_DEBUG_URGENT,
-		    ("pf_test: pf_get_mtag returned NULL\n"));
-		return (PF_DROP);
-	}
-#endif
-#ifndef __FreeBSD__
-	if (ifp->if_type == IFT_CARP && ifp->if_carpdev)
-		kif = (struct pfi_kif *)ifp->if_carpdev->if_pf_kif;
-	else
-#endif
-		kif = (struct pfi_kif *)ifp->if_pf_kif;
-
-	if (kif == NULL) {
-#ifdef __FreeBSD__
-		PF_UNLOCK();
-#endif
-		DPFPRINTF(PF_DEBUG_URGENT,
-		    ("pf_test6: kif == NULL, if_xname %s\n", ifp->if_xname));
-		return (PF_DROP);
-	}
-	if (kif->pfik_flags & PFI_IFLAG_SKIP)
-#ifdef __FreeBSD__
-	{
-		PF_UNLOCK();
-#endif
-		return (PF_PASS);
-#ifdef __FreeBSD__
-	}
-#endif
-
-#ifdef __FreeBSD__
-	M_ASSERTPKTHDR(m);
-#else
-#ifdef DIAGNOSTIC
-	if ((m->m_flags & M_PKTHDR) == 0)
-		panic("non-M_PKTHDR is passed to pf_test6");
-#endif /* DIAGNOSTIC */
-#endif
-
-	if (m->m_pkthdr.len < (int)sizeof(*h)) {
-		action = PF_DROP;
-		REASON_SET(&reason, PFRES_SHORT);
-		log = 1;
-		goto done;
-	}
-
-#ifdef __FreeBSD__
-	if (pd.pf_mtag->flags & PF_TAG_GENERATED) {
-		PF_UNLOCK();
-#else
-	if (m->m_pkthdr.pf.flags & PF_TAG_GENERATED)
-#endif
-		return (PF_PASS);
-#ifdef __FreeBSD__
-	}
-#endif
-
-	/* We do IP header normalization and packet reassembly here */
-	if (pf_normalize_ip6(m0, dir, kif, &reason, &pd) != PF_PASS) {
-		action = PF_DROP;
-		goto done;
-	}
-	m = *m0;	/* pf_normalize messes with m0 */
-	h = mtod(m, struct ip6_hdr *);
-
-#if 1
-	/*
-	 * we do not support jumbogram yet.  if we keep going, zero ip6_plen
-	 * will do something bad, so drop the packet for now.
-	 */
-	if (htons(h->ip6_plen) == 0) {
-		action = PF_DROP;
-		REASON_SET(&reason, PFRES_NORM);	/*XXX*/
-		goto done;
-	}
-#endif
-
-	pd.src = (struct pf_addr *)&h->ip6_src;
-	pd.dst = (struct pf_addr *)&h->ip6_dst;
-	pd.sport = pd.dport = NULL;
-	pd.ip_sum = NULL;
-	pd.proto_sum = NULL;
-	pd.dir = dir;
-	pd.sidx = (dir == PF_IN) ? 0 : 1;
-	pd.didx = (dir == PF_IN) ? 1 : 0;
-	pd.af = AF_INET6;
-	pd.tos = 0;
-	pd.tot_len = ntohs(h->ip6_plen) + sizeof(struct ip6_hdr);
-	pd.eh = eh;
-
-	off = ((caddr_t)h - m->m_data) + sizeof(struct ip6_hdr);
-	pd.proto = h->ip6_nxt;
-	do {
-		switch (pd.proto) {
-		case IPPROTO_FRAGMENT:
-			action = pf_test_fragment(&r, dir, kif, m, h,
-			    &pd, &a, &ruleset);
-			if (action == PF_DROP)
-				REASON_SET(&reason, PFRES_FRAG);
-			goto done;
-		case IPPROTO_ROUTING: {
-			struct ip6_rthdr rthdr;
-
-			if (rh_cnt++) {
-				DPFPRINTF(PF_DEBUG_MISC,
-				    ("pf: IPv6 more than one rthdr\n"));
-				action = PF_DROP;
-				REASON_SET(&reason, PFRES_IPOPTIONS);
-				log = 1;
-				goto done;
-			}
-			if (!pf_pull_hdr(m, off, &rthdr, sizeof(rthdr), NULL,
-			    &reason, pd.af)) {
-				DPFPRINTF(PF_DEBUG_MISC,
-				    ("pf: IPv6 short rthdr\n"));
-				action = PF_DROP;
-				REASON_SET(&reason, PFRES_SHORT);
-				log = 1;
-				goto done;
-			}
-			if (rthdr.ip6r_type == IPV6_RTHDR_TYPE_0) {
-				DPFPRINTF(PF_DEBUG_MISC,
-				    ("pf: IPv6 rthdr0\n"));
-				action = PF_DROP;
-				REASON_SET(&reason, PFRES_IPOPTIONS);
-				log = 1;
-				goto done;
-			}
-			/* FALLTHROUGH */
-		}
-		case IPPROTO_AH:
-		case IPPROTO_HOPOPTS:
-		case IPPROTO_DSTOPTS: {
-			/* get next header and header length */
-			struct ip6_ext	opt6;
-
-			if (!pf_pull_hdr(m, off, &opt6, sizeof(opt6),
-			    NULL, &reason, pd.af)) {
-				DPFPRINTF(PF_DEBUG_MISC,
-				    ("pf: IPv6 short opt\n"));
-				action = PF_DROP;
-				log = 1;
-				goto done;
-			}
-			if (pd.proto == IPPROTO_AH)
-				off += (opt6.ip6e_len + 2) * 4;
-			else
-				off += (opt6.ip6e_len + 1) * 8;
-			pd.proto = opt6.ip6e_nxt;
-			/* goto the next header */
-			break;
-		}
-		default:
-			terminal++;
-			break;
-		}
-	} while (!terminal);
-
-	/* if there's no routing header, use unmodified mbuf for checksumming */
-	if (!n)
-		n = m;
-
-	switch (pd.proto) {
-
-	case IPPROTO_TCP: {
-		struct tcphdr	th;
-
-		pd.hdr.tcp = &th;
-		if (!pf_pull_hdr(m, off, &th, sizeof(th),
-		    &action, &reason, AF_INET6)) {
-			log = action != PF_PASS;
-			goto done;
-		}
-		pd.p_len = pd.tot_len - off - (th.th_off << 2);
-		action = pf_normalize_tcp(dir, kif, m, 0, off, h, &pd);
-		if (action == PF_DROP)
-			goto done;
-		action = pf_test_state_tcp(&s, dir, kif, m, off, h, &pd,
-		    &reason);
-		if (action == PF_PASS) {
-#if NPFSYNC > 0
-#ifdef __FreeBSD__
-			if (pfsync_update_state_ptr != NULL)
-				pfsync_update_state_ptr(s);
-#else
-			pfsync_update_state(s);
-#endif
-#endif /* NPFSYNC */
-			r = s->rule.ptr;
-			a = s->anchor.ptr;
-			log = s->log;
-		} else if (s == NULL)
-#ifdef __FreeBSD__
-			action = pf_test_rule(&r, &s, dir, kif,
-			    m, off, h, &pd, &a, &ruleset, NULL, inp);
-#else
-			action = pf_test_rule(&r, &s, dir, kif,
-			    m, off, h, &pd, &a, &ruleset, &ip6intrq);
-#endif
-		break;
-	}
-
-	case IPPROTO_UDP: {
-		struct udphdr	uh;
-
-		pd.hdr.udp = &uh;
-		if (!pf_pull_hdr(m, off, &uh, sizeof(uh),
-		    &action, &reason, AF_INET6)) {
-			log = action != PF_PASS;
-			goto done;
-		}
-		if (uh.uh_dport == 0 ||
-		    ntohs(uh.uh_ulen) > m->m_pkthdr.len - off ||
-		    ntohs(uh.uh_ulen) < sizeof(struct udphdr)) {
-			action = PF_DROP;
-			REASON_SET(&reason, PFRES_SHORT);
-			goto done;
-		}
-		action = pf_test_state_udp(&s, dir, kif, m, off, h, &pd);
-		if (action == PF_PASS) {
-#if NPFSYNC > 0
-#ifdef __FreeBSD__
-			if (pfsync_update_state_ptr != NULL)
-				pfsync_update_state_ptr(s);
-#else
-			pfsync_update_state(s);
-#endif
-#endif /* NPFSYNC */
-			r = s->rule.ptr;
-			a = s->anchor.ptr;
-			log = s->log;
-		} else if (s == NULL)
-#ifdef __FreeBSD__
-			action = pf_test_rule(&r, &s, dir, kif,
-			    m, off, h, &pd, &a, &ruleset, NULL, inp);
-#else
-			action = pf_test_rule(&r, &s, dir, kif,
-			    m, off, h, &pd, &a, &ruleset, &ip6intrq);
-#endif
-		break;
-	}
-
-	case IPPROTO_ICMP: {
-		action = PF_DROP;
-		DPFPRINTF(PF_DEBUG_MISC,
-		    ("pf: dropping IPv6 packet with ICMPv4 payload\n"));
-		goto done;
-	}
-
-	case IPPROTO_ICMPV6: {
-		struct icmp6_hdr	ih;
-
-		pd.hdr.icmp6 = &ih;
-		if (!pf_pull_hdr(m, off, &ih, sizeof(ih),
-		    &action, &reason, AF_INET6)) {
-			log = action != PF_PASS;
-			goto done;
-		}
-		action = pf_test_state_icmp(&s, dir, kif,
-		    m, off, h, &pd, &reason);
-		if (action == PF_PASS) {
-#if NPFSYNC > 0
-#ifdef __FreeBSD__
-			if (pfsync_update_state_ptr != NULL)
-				pfsync_update_state_ptr(s);
-#else
-			pfsync_update_state(s);
-#endif
-#endif /* NPFSYNC */
-			r = s->rule.ptr;
-			a = s->anchor.ptr;
-			log = s->log;
-		} else if (s == NULL)
-#ifdef __FreeBSD__
-			action = pf_test_rule(&r, &s, dir, kif,
-			    m, off, h, &pd, &a, &ruleset, NULL, inp);
-#else
-			action = pf_test_rule(&r, &s, dir, kif,
-			    m, off, h, &pd, &a, &ruleset, &ip6intrq);
-#endif
-		break;
-	}
-
-	default:
-		action = pf_test_state_other(&s, dir, kif, m, &pd);
-		if (action == PF_PASS) {
-#if NPFSYNC > 0
-#ifdef __FreeBSD__
-			if (pfsync_update_state_ptr != NULL)
-				pfsync_update_state_ptr(s);
-#else
-			pfsync_update_state(s);
-#endif
-#endif /* NPFSYNC */
-			r = s->rule.ptr;
-			a = s->anchor.ptr;
-			log = s->log;
-		} else if (s == NULL)
-#ifdef __FreeBSD__
-			action = pf_test_rule(&r, &s, dir, kif, m, off, h,
-			    &pd, &a, &ruleset, NULL, inp);
-#else
-			action = pf_test_rule(&r, &s, dir, kif, m, off, h,
-			    &pd, &a, &ruleset, &ip6intrq);
-#endif
-		break;
-	}
-
-done:
-	if (n != m) {
-		m_freem(n);
-		n = NULL;
-	}
-
-	/* handle dangerous IPv6 extension headers. */
-	if (action == PF_PASS && rh_cnt &&
-	    !((s && s->state_flags & PFSTATE_ALLOWOPTS) || r->allow_opts)) {
-		action = PF_DROP;
-		REASON_SET(&reason, PFRES_IPOPTIONS);
-		log = 1;
-		DPFPRINTF(PF_DEBUG_MISC,
-		    ("pf: dropping packet with dangerous v6 headers\n"));
-	}
-
-	if ((s && s->tag) || r->rtableid >= 0)
-#ifdef __FreeBSD__
-		pf_tag_packet(m, s ? s->tag : 0, r->rtableid, pd.pf_mtag);
-#else
-		pf_tag_packet(m, s ? s->tag : 0, r->rtableid);
-#endif
-
-	if (dir == PF_IN && s && s->key[PF_SK_STACK])
-#ifdef __FreeBSD__
-		pd.pf_mtag->statekey = s->key[PF_SK_STACK];
-#else
-		m->m_pkthdr.pf.statekey = s->key[PF_SK_STACK];
-#endif
-
-#ifdef ALTQ
-	if (action == PF_PASS && r->qid) {
-#ifdef __FreeBSD__
-		if (pd.tos & IPTOS_LOWDELAY)
-			pd.pf_mtag->qid = r->pqid;
-		else
-			pd.pf_mtag->qid = r->qid;
-		/* add hints for ecn */
-		pd.pf_mtag->hdr = h;
-#else
-		if (pd.tos & IPTOS_LOWDELAY)
-			m->m_pkthdr.pf.qid = r->pqid;
-		else
-			m->m_pkthdr.pf.qid = r->qid;
-		/* add hints for ecn */
-		m->m_pkthdr.pf.hdr = h;
-#endif
-	}
-#endif /* ALTQ */
-
-	if (dir == PF_IN && action == PF_PASS && (pd.proto == IPPROTO_TCP ||
-	    pd.proto == IPPROTO_UDP) && s != NULL && s->nat_rule.ptr != NULL &&
-	    (s->nat_rule.ptr->action == PF_RDR ||
-	    s->nat_rule.ptr->action == PF_BINAT) &&
-	    IN6_IS_ADDR_LOOPBACK(&pd.dst->v6))
-#ifdef __FreeBSD__
-		m->m_flags |= M_SKIP_FIREWALL;
-#else
-		m->m_pkthdr.pf.flags |= PF_TAG_TRANSLATE_LOCALHOST;
-#endif
-
-#ifdef __FreeBSD__
-	/* XXX: Anybody working on it?! */
-	if (r->divert.port)
-		printf("pf: divert(9) is not supported for IPv6\n");
-#else
-	if (dir == PF_IN && action == PF_PASS && r->divert.port) {
-		struct pf_divert *divert;
-
-		if ((divert = pf_get_divert(m))) {
-			m->m_pkthdr.pf.flags |= PF_TAG_DIVERTED;
-			divert->port = r->divert.port;
-			divert->addr.ipv6 = r->divert.addr.v6;
-		}
-	}
-#endif
-
-	if (log) {
-		struct pf_rule *lr;
-
-		if (s != NULL && s->nat_rule.ptr != NULL &&
-		    s->nat_rule.ptr->log & PF_LOG_ALL)
-			lr = s->nat_rule.ptr;
-		else
-			lr = r;
-		PFLOG_PACKET(kif, h, m, AF_INET6, dir, reason, lr, a, ruleset,
-		    &pd);
-	}
-
-	kif->pfik_bytes[1][dir == PF_OUT][action != PF_PASS] += pd.tot_len;
-	kif->pfik_packets[1][dir == PF_OUT][action != PF_PASS]++;
-
-	if (action == PF_PASS || r->action == PF_DROP) {
-		dirndx = (dir == PF_OUT);
-		r->packets[dirndx]++;
-		r->bytes[dirndx] += pd.tot_len;
-		if (a != NULL) {
-			a->packets[dirndx]++;
-			a->bytes[dirndx] += pd.tot_len;
-		}
-		if (s != NULL) {
-			if (s->nat_rule.ptr != NULL) {
-				s->nat_rule.ptr->packets[dirndx]++;
-				s->nat_rule.ptr->bytes[dirndx] += pd.tot_len;
-			}
-			if (s->src_node != NULL) {
-				s->src_node->packets[dirndx]++;
-				s->src_node->bytes[dirndx] += pd.tot_len;
-			}
-			if (s->nat_src_node != NULL) {
-				s->nat_src_node->packets[dirndx]++;
-				s->nat_src_node->bytes[dirndx] += pd.tot_len;
-			}
-			dirndx = (dir == s->direction) ? 0 : 1;
-			s->packets[dirndx]++;
-			s->bytes[dirndx] += pd.tot_len;
-		}
-		tr = r;
-		nr = (s != NULL) ? s->nat_rule.ptr : pd.nat_rule;
-#ifdef __FreeBSD__
-		if (nr != NULL && r == &V_pf_default_rule)
-#else
-		if (nr != NULL && r == &pf_default_rule)
-#endif
-			tr = nr;
-		if (tr->src.addr.type == PF_ADDR_TABLE)
-			pfr_update_stats(tr->src.addr.p.tbl,
-			    (s == NULL) ? pd.src :
-			    &s->key[(s->direction == PF_IN)]->addr[0],
-			    pd.af, pd.tot_len, dir == PF_OUT,
-			    r->action == PF_PASS, tr->src.neg);
-		if (tr->dst.addr.type == PF_ADDR_TABLE)
-			pfr_update_stats(tr->dst.addr.p.tbl,
-			    (s == NULL) ? pd.dst :
-			    &s->key[(s->direction == PF_IN)]->addr[1],
-			    pd.af, pd.tot_len, dir == PF_OUT,
-			    r->action == PF_PASS, tr->dst.neg);
-	}
-
-	switch (action) {
-	case PF_SYNPROXY_DROP:
-		m_freem(*m0);
-	case PF_DEFER:
-		*m0 = NULL;
-		action = PF_PASS;
-		break;
-	default:
-		/* pf_route6 can free the mbuf causing *m0 to become NULL */
-		if (r->rt)
-			pf_route6(m0, r, dir, kif->pfik_ifp, s, &pd);
-		break;
-	}
-
-#ifdef __FreeBSD__
-	PF_UNLOCK();
-#endif
-	return (action);
-}
-#endif /* INET6 */
-
-int
-pf_check_congestion(struct ifqueue *ifq)
-{
-#ifdef __FreeBSD__
-	/* XXX_IMPORT: later */
-	return (0);
-#else
-	if (ifq->ifq_congestion)
-		return (1);
-	else
-		return (0);
-#endif
-}
-
-/*
- * must be called whenever any addressing information such as
- * address, port, protocol has changed
- */
-void
-pf_pkt_addr_changed(struct mbuf *m)
-{
-#ifdef __FreeBSD__
-	struct pf_mtag	*pf_tag;
-
-	if ((pf_tag = pf_find_mtag(m)) != NULL)
-		pf_tag->statekey = NULL;
-#else
-	m->m_pkthdr.pf.statekey = NULL;
-#endif
-}
diff --git a/sys/contrib/pf/net/pf_if.c b/sys/contrib/pf/net/pf_if.c
deleted file mode 100644
index 6336c793183f..000000000000
--- a/sys/contrib/pf/net/pf_if.c
+++ /dev/null
@@ -1,1111 +0,0 @@
-/*	$OpenBSD: pf_if.c,v 1.54 2008/06/14 16:55:28 mk Exp $ */
-
-/*
- * Copyright 2005 Henning Brauer <henning@openbsd.org>
- * Copyright 2005 Ryan McBride <mcbride@openbsd.org>
- * Copyright (c) 2001 Daniel Hartmeier
- * Copyright (c) 2003 Cedric Berger
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *    - Redistributions of source code must retain the above copyright
- *      notice, this list of conditions and the following disclaimer.
- *    - Redistributions in binary form must reproduce the above
- *      copyright notice, this list of conditions and the following
- *      disclaimer in the documentation and/or other materials provided
- *      with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
- * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
- * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
- * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
- * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
- * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-#if defined(__FreeBSD__)
-#include "opt_inet.h"
-#include "opt_inet6.h"
-
-#include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
-#endif
-
-#include <sys/param.h>
-#include <sys/systm.h>
-#ifdef __FreeBSD__
-#include <sys/malloc.h>
-#endif
-#include <sys/mbuf.h>
-#include <sys/filio.h>
-#include <sys/socket.h>
-#include <sys/socketvar.h>
-#include <sys/kernel.h>
-#ifndef __FreeBSD__
-#include <sys/device.h>
-#endif
-#include <sys/time.h>
-#ifndef __FreeBSD__
-#include <sys/pool.h>
-#endif
-
-#include <net/if.h>
-#include <net/if_types.h>
-#ifdef __FreeBSD__
-#include <net/vnet.h>
-#endif
-
-#include <netinet/in.h>
-#include <netinet/in_var.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#include <netinet/ip_var.h>
-
-#include <net/pfvar.h>
-
-#ifdef INET6
-#include <netinet/ip6.h>
-#endif /* INET6 */
-
-#ifdef __FreeBSD__
-VNET_DEFINE(struct pfi_kif *,	 pfi_all);
-VNET_DEFINE(uma_zone_t,		 pfi_addr_pl);
-VNET_DEFINE(struct pfi_ifhead,	 pfi_ifs);
-#define	V_pfi_ifs		 VNET(pfi_ifs)
-VNET_DEFINE(long,		 pfi_update);
-#define	V_pfi_update		 VNET(pfi_update)
-VNET_DEFINE(struct pfr_addr *,	 pfi_buffer);
-#define	V_pfi_buffer		 VNET(pfi_buffer)
-VNET_DEFINE(int,		 pfi_buffer_cnt);
-#define	V_pfi_buffer_cnt	 VNET(pfi_buffer_cnt)
-VNET_DEFINE(int,		 pfi_buffer_max);
-#define	V_pfi_buffer_max	 VNET(pfi_buffer_max)
-#else
-struct pfi_kif		 *pfi_all = NULL;
-struct pool		  pfi_addr_pl;
-struct pfi_ifhead	  pfi_ifs;
-long			  pfi_update = 1;
-struct pfr_addr		 *pfi_buffer;
-int			  pfi_buffer_cnt;
-int			  pfi_buffer_max;
-#endif
-#ifdef __FreeBSD__
-eventhandler_tag	 pfi_attach_cookie;
-eventhandler_tag	 pfi_detach_cookie;
-eventhandler_tag	 pfi_attach_group_cookie;
-eventhandler_tag	 pfi_change_group_cookie;
-eventhandler_tag	 pfi_detach_group_cookie;
-eventhandler_tag	 pfi_ifaddr_event_cookie;
-#endif
-
-void		 pfi_kif_update(struct pfi_kif *);
-void		 pfi_dynaddr_update(struct pfi_dynaddr *dyn);
-void		 pfi_table_update(struct pfr_ktable *, struct pfi_kif *,
-		    int, int);
-void		 pfi_kifaddr_update(void *);
-void		 pfi_instance_add(struct ifnet *, int, int);
-void		 pfi_address_add(struct sockaddr *, int, int);
-int		 pfi_if_compare(struct pfi_kif *, struct pfi_kif *);
-int		 pfi_skip_if(const char *, struct pfi_kif *);
-int		 pfi_unmask(void *);
-#ifdef __FreeBSD__
-void		 pfi_attach_ifnet_event(void * __unused, struct ifnet *);
-void		 pfi_detach_ifnet_event(void * __unused, struct ifnet *);
-void		 pfi_attach_group_event(void *, struct ifg_group *);
-void		 pfi_change_group_event(void *, char *);
-void		 pfi_detach_group_event(void *, struct ifg_group *);
-void		 pfi_ifaddr_event(void * __unused, struct ifnet *);
-#endif
-
-RB_PROTOTYPE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare);
-RB_GENERATE(pfi_ifhead, pfi_kif, pfik_tree, pfi_if_compare);
-
-#define PFI_BUFFER_MAX		0x10000
-#define PFI_MTYPE		M_IFADDR
-
-void
-pfi_initialize(void)
-{
-#ifdef __FreeBSD__
-	if (V_pfi_all != NULL)	/* already initialized */
-#else
-	if (pfi_all != NULL)	/* already initialized */
-#endif
-		return;
-
-#ifndef __FreeBSD__
-	pool_init(&V_pfi_addr_pl, sizeof(struct pfi_dynaddr), 0, 0, 0,
-	    "pfiaddrpl", &pool_allocator_nointr);
-#endif
-#ifdef __FreeBSD__
-	V_pfi_buffer_max = 64;
-	V_pfi_buffer = malloc(V_pfi_buffer_max * sizeof(*V_pfi_buffer),
-	    PFI_MTYPE, M_WAITOK);
-
-	if ((V_pfi_all = pfi_kif_get(IFG_ALL)) == NULL)
-#else
-	pfi_buffer_max = 64;
-	pfi_buffer = malloc(pfi_buffer_max * sizeof(*pfi_buffer),
-	    PFI_MTYPE, M_WAITOK);
-
-	if ((pfi_all = pfi_kif_get(IFG_ALL)) == NULL)
-#endif
-		panic("pfi_kif_get for pfi_all failed");
-#ifdef __FreeBSD__
-	struct ifg_group *ifg;
-	struct ifnet *ifp;
-
-	IFNET_RLOCK();
-	TAILQ_FOREACH(ifg, &V_ifg_head, ifg_next)
-		pfi_attach_ifgroup(ifg);
-	TAILQ_FOREACH(ifp, &V_ifnet, if_link)
-		pfi_attach_ifnet(ifp);
-	IFNET_RUNLOCK();
-
-	pfi_attach_cookie = EVENTHANDLER_REGISTER(ifnet_arrival_event,
-	    pfi_attach_ifnet_event, NULL, EVENTHANDLER_PRI_ANY);
-	pfi_detach_cookie = EVENTHANDLER_REGISTER(ifnet_departure_event,
-	    pfi_detach_ifnet_event, NULL, EVENTHANDLER_PRI_ANY);
-	pfi_attach_group_cookie = EVENTHANDLER_REGISTER(group_attach_event,
-	    pfi_attach_group_event, curvnet, EVENTHANDLER_PRI_ANY);
-	pfi_change_group_cookie = EVENTHANDLER_REGISTER(group_change_event,
-	    pfi_change_group_event, curvnet, EVENTHANDLER_PRI_ANY);
-	pfi_detach_group_cookie = EVENTHANDLER_REGISTER(group_detach_event,
-	    pfi_detach_group_event, curvnet, EVENTHANDLER_PRI_ANY);
-	pfi_ifaddr_event_cookie = EVENTHANDLER_REGISTER(ifaddr_event,
-	    pfi_ifaddr_event, NULL, EVENTHANDLER_PRI_ANY);
-#endif
-}
-
-#ifdef __FreeBSD__
-void
-pfi_cleanup(void)
-{
-	struct pfi_kif *p;
-
-	PF_UNLOCK();
-	EVENTHANDLER_DEREGISTER(ifnet_arrival_event, pfi_attach_cookie);
-	EVENTHANDLER_DEREGISTER(ifnet_departure_event, pfi_detach_cookie);
-	EVENTHANDLER_DEREGISTER(group_attach_event, pfi_attach_group_cookie);
-	EVENTHANDLER_DEREGISTER(group_change_event, pfi_change_group_cookie);
-	EVENTHANDLER_DEREGISTER(group_detach_event, pfi_detach_group_cookie);
-	EVENTHANDLER_DEREGISTER(ifaddr_event, pfi_ifaddr_event_cookie);
-	PF_LOCK();
-
-	V_pfi_all = NULL;
-	while ((p = RB_MIN(pfi_ifhead, &V_pfi_ifs))) {
-		if (p->pfik_rules || p->pfik_states) {
-			printf("pfi_cleanup: dangling refs for %s\n",
-			    p->pfik_name);
-		}
-
-		RB_REMOVE(pfi_ifhead, &V_pfi_ifs, p);
-		free(p, PFI_MTYPE);
-	}
-
-	free(V_pfi_buffer, PFI_MTYPE);
-}
-#endif
-
-struct pfi_kif *
-pfi_kif_get(const char *kif_name)
-{
-	struct pfi_kif		*kif;
-	struct pfi_kif_cmp	 s;
-
-	bzero(&s, sizeof(s));
-	strlcpy(s.pfik_name, kif_name, sizeof(s.pfik_name));
-#ifdef __FreeBSD__
-	if ((kif = RB_FIND(pfi_ifhead, &V_pfi_ifs, (struct pfi_kif *)&s)) != NULL)
-#else
-	if ((kif = RB_FIND(pfi_ifhead, &pfi_ifs, (struct pfi_kif *)&s)) != NULL)
-#endif
-		return (kif);
-
-	/* create new one */
-#ifdef __FreeBSD__
-	if ((kif = malloc(sizeof(*kif), PFI_MTYPE, M_NOWAIT | M_ZERO)) == NULL)
-#else
-	if ((kif = malloc(sizeof(*kif), PFI_MTYPE, M_DONTWAIT|M_ZERO)) == NULL)
-#endif
-		return (NULL);
-
-	strlcpy(kif->pfik_name, kif_name, sizeof(kif->pfik_name));
-#ifdef __FreeBSD__
-	/*
-	 * It seems that the value of time_second is in unintialzied state
-	 * when pf sets interface statistics clear time in boot phase if pf
-	 * was statically linked to kernel. Instead of setting the bogus
-	 * time value have pfi_get_ifaces handle this case. In
-	 * pfi_get_ifaces it uses boottime.tv_sec if it sees the time is 0.
-	 */
-	kif->pfik_tzero = time_second > 1 ? time_second : 0;
-#else
-	kif->pfik_tzero = time_second;
-#endif
-	TAILQ_INIT(&kif->pfik_dynaddrs);
-
-#ifdef __FreeBSD__
-	RB_INSERT(pfi_ifhead, &V_pfi_ifs, kif);
-#else
-	RB_INSERT(pfi_ifhead, &pfi_ifs, kif);
-#endif
-
-	return (kif);
-}
-
-void
-pfi_kif_ref(struct pfi_kif *kif, enum pfi_kif_refs what)
-{
-	switch (what) {
-	case PFI_KIF_REF_RULE:
-		kif->pfik_rules++;
-		break;
-	case PFI_KIF_REF_STATE:
-		kif->pfik_states++;
-		break;
-	default:
-		panic("pfi_kif_ref with unknown type");
-	}
-}
-
-void
-pfi_kif_unref(struct pfi_kif *kif, enum pfi_kif_refs what)
-{
-	if (kif == NULL)
-		return;
-
-	switch (what) {
-	case PFI_KIF_REF_NONE:
-		break;
-	case PFI_KIF_REF_RULE:
-		if (kif->pfik_rules <= 0) {
-			printf("pfi_kif_unref: rules refcount <= 0\n");
-			return;
-		}
-		kif->pfik_rules--;
-		break;
-	case PFI_KIF_REF_STATE:
-		if (kif->pfik_states <= 0) {
-			printf("pfi_kif_unref: state refcount <= 0\n");
-			return;
-		}
-		kif->pfik_states--;
-		break;
-	default:
-		panic("pfi_kif_unref with unknown type");
-	}
-
-#ifdef __FreeBSD__
-	if (kif->pfik_ifp != NULL || kif->pfik_group != NULL || kif == V_pfi_all)
-#else
-	if (kif->pfik_ifp != NULL || kif->pfik_group != NULL || kif == pfi_all)
-#endif
-		return;
-
-	if (kif->pfik_rules || kif->pfik_states)
-		return;
-
-#ifdef __FreeBSD__
-	RB_REMOVE(pfi_ifhead, &V_pfi_ifs, kif);
-#else
-	RB_REMOVE(pfi_ifhead, &pfi_ifs, kif);
-#endif
-	free(kif, PFI_MTYPE);
-}
-
-int
-pfi_kif_match(struct pfi_kif *rule_kif, struct pfi_kif *packet_kif)
-{
-	struct ifg_list	*p;
-
-	if (rule_kif == NULL || rule_kif == packet_kif)
-		return (1);
-
-	if (rule_kif->pfik_group != NULL)
-		TAILQ_FOREACH(p, &packet_kif->pfik_ifp->if_groups, ifgl_next)
-			if (p->ifgl_group == rule_kif->pfik_group)
-				return (1);
-
-	return (0);
-}
-
-void
-pfi_attach_ifnet(struct ifnet *ifp)
-{
-	struct pfi_kif		*kif;
-	int			 s;
-
-	pfi_initialize();
-	s = splsoftnet();
-#ifdef __FreeBSD__
-	V_pfi_update++;
-#else
-	pfi_update++;
-#endif
-	if ((kif = pfi_kif_get(ifp->if_xname)) == NULL)
-		panic("pfi_kif_get failed");
-
-	kif->pfik_ifp = ifp;
-	ifp->if_pf_kif = (caddr_t)kif;
-
-#ifndef __FreeBSD__
-	if ((kif->pfik_ah_cookie = hook_establish(ifp->if_addrhooks, 1,
-	    pfi_kifaddr_update, kif)) == NULL)
-		panic("pfi_attach_ifnet: cannot allocate '%s' address hook",
-		    ifp->if_xname);
-#endif
-
-	pfi_kif_update(kif);
-
-	splx(s);
-}
-
-void
-pfi_detach_ifnet(struct ifnet *ifp)
-{
-	int			 s;
-	struct pfi_kif		*kif;
-
-	if ((kif = (struct pfi_kif *)ifp->if_pf_kif) == NULL)
-		return;
-
-	s = splsoftnet();
-#ifdef __FreeBSD__
-	V_pfi_update++;
-#else
-	pfi_update++;
-#endif
-#ifndef __FreeBSD__
-	hook_disestablish(ifp->if_addrhooks, kif->pfik_ah_cookie);
-#endif
-	pfi_kif_update(kif);
-
-	kif->pfik_ifp = NULL;
-	ifp->if_pf_kif = NULL;
-	pfi_kif_unref(kif, PFI_KIF_REF_NONE);
-	splx(s);
-}
-
-void
-pfi_attach_ifgroup(struct ifg_group *ifg)
-{
-	struct pfi_kif	*kif;
-	int		 s;
-
-	pfi_initialize();
-	s = splsoftnet();
-#ifdef __FreeBSD__
-	V_pfi_update++;
-#else
-	pfi_update++;
-#endif
-	if ((kif = pfi_kif_get(ifg->ifg_group)) == NULL)
-		panic("pfi_kif_get failed");
-
-	kif->pfik_group = ifg;
-	ifg->ifg_pf_kif = (caddr_t)kif;
-
-	splx(s);
-}
-
-void
-pfi_detach_ifgroup(struct ifg_group *ifg)
-{
-	int		 s;
-	struct pfi_kif	*kif;
-
-	if ((kif = (struct pfi_kif *)ifg->ifg_pf_kif) == NULL)
-		return;
-
-	s = splsoftnet();
-#ifdef __FreeBSD__
-	V_pfi_update++;
-#else
-	pfi_update++;
-#endif
-
-	kif->pfik_group = NULL;
-	ifg->ifg_pf_kif = NULL;
-	pfi_kif_unref(kif, PFI_KIF_REF_NONE);
-	splx(s);
-}
-
-void
-pfi_group_change(const char *group)
-{
-	struct pfi_kif		*kif;
-	int			 s;
-
-	s = splsoftnet();
-#ifdef __FreeBSD__
-	V_pfi_update++;
-#else
-	pfi_update++;
-#endif
-	if ((kif = pfi_kif_get(group)) == NULL)
-		panic("pfi_kif_get failed");
-
-	pfi_kif_update(kif);
-
-	splx(s);
-}
-
-int
-pfi_match_addr(struct pfi_dynaddr *dyn, struct pf_addr *a, sa_family_t af)
-{
-	switch (af) {
-#ifdef INET
-	case AF_INET:
-		switch (dyn->pfid_acnt4) {
-		case 0:
-			return (0);
-		case 1:
-			return (PF_MATCHA(0, &dyn->pfid_addr4,
-			    &dyn->pfid_mask4, a, AF_INET));
-		default:
-			return (pfr_match_addr(dyn->pfid_kt, a, AF_INET));
-		}
-		break;
-#endif /* INET */
-#ifdef INET6
-	case AF_INET6:
-		switch (dyn->pfid_acnt6) {
-		case 0:
-			return (0);
-		case 1:
-			return (PF_MATCHA(0, &dyn->pfid_addr6,
-			    &dyn->pfid_mask6, a, AF_INET6));
-		default:
-			return (pfr_match_addr(dyn->pfid_kt, a, AF_INET6));
-		}
-		break;
-#endif /* INET6 */
-	default:
-		return (0);
-	}
-}
-
-int
-pfi_dynaddr_setup(struct pf_addr_wrap *aw, sa_family_t af)
-{
-	struct pfi_dynaddr	*dyn;
-	char			 tblname[PF_TABLE_NAME_SIZE];
-	struct pf_ruleset	*ruleset = NULL;
-	int			 s, rv = 0;
-
-	if (aw->type != PF_ADDR_DYNIFTL)
-		return (0);
-#ifdef __FreeBSD__
-	/* XXX: revisit! */
-	if ((dyn = pool_get(&V_pfi_addr_pl, PR_WAITOK | PR_ZERO))
-#else
-	if ((dyn = pool_get(&pfi_addr_pl, PR_WAITOK | PR_LIMITFAIL | PR_ZERO))
-#endif
-	    == NULL)
-		return (1);
-
-	s = splsoftnet();
-	if (!strcmp(aw->v.ifname, "self"))
-		dyn->pfid_kif = pfi_kif_get(IFG_ALL);
-	else
-		dyn->pfid_kif = pfi_kif_get(aw->v.ifname);
-	if (dyn->pfid_kif == NULL) {
-		rv = 1;
-		goto _bad;
-	}
-	pfi_kif_ref(dyn->pfid_kif, PFI_KIF_REF_RULE);
-
-	dyn->pfid_net = pfi_unmask(&aw->v.a.mask);
-	if (af == AF_INET && dyn->pfid_net == 32)
-		dyn->pfid_net = 128;
-	strlcpy(tblname, aw->v.ifname, sizeof(tblname));
-	if (aw->iflags & PFI_AFLAG_NETWORK)
-		strlcat(tblname, ":network", sizeof(tblname));
-	if (aw->iflags & PFI_AFLAG_BROADCAST)
-		strlcat(tblname, ":broadcast", sizeof(tblname));
-	if (aw->iflags & PFI_AFLAG_PEER)
-		strlcat(tblname, ":peer", sizeof(tblname));
-	if (aw->iflags & PFI_AFLAG_NOALIAS)
-		strlcat(tblname, ":0", sizeof(tblname));
-	if (dyn->pfid_net != 128)
-		snprintf(tblname + strlen(tblname),
-		    sizeof(tblname) - strlen(tblname), "/%d", dyn->pfid_net);
-	if ((ruleset = pf_find_or_create_ruleset(PF_RESERVED_ANCHOR)) == NULL) {
-		rv = 1;
-		goto _bad;
-	}
-
-	if ((dyn->pfid_kt = pfr_attach_table(ruleset, tblname, 1)) == NULL) {
-		rv = 1;
-		goto _bad;
-	}
-
-	dyn->pfid_kt->pfrkt_flags |= PFR_TFLAG_ACTIVE;
-	dyn->pfid_iflags = aw->iflags;
-	dyn->pfid_af = af;
-
-	TAILQ_INSERT_TAIL(&dyn->pfid_kif->pfik_dynaddrs, dyn, entry);
-	aw->p.dyn = dyn;
-	pfi_kif_update(dyn->pfid_kif);
-	splx(s);
-	return (0);
-
-_bad:
-	if (dyn->pfid_kt != NULL)
-		pfr_detach_table(dyn->pfid_kt);
-	if (ruleset != NULL)
-		pf_remove_if_empty_ruleset(ruleset);
-	if (dyn->pfid_kif != NULL)
-		pfi_kif_unref(dyn->pfid_kif, PFI_KIF_REF_RULE);
-#ifdef __FreeBSD__
-	pool_put(&V_pfi_addr_pl, dyn);
-#else
-	pool_put(&pfi_addr_pl, dyn);
-#endif
-	splx(s);
-	return (rv);
-}
-
-void
-pfi_kif_update(struct pfi_kif *kif)
-{
-	struct ifg_list		*ifgl;
-	struct pfi_dynaddr	*p;
-
-	/* update all dynaddr */
-	TAILQ_FOREACH(p, &kif->pfik_dynaddrs, entry)
-		pfi_dynaddr_update(p);
-
-	/* again for all groups kif is member of */
-	if (kif->pfik_ifp != NULL)
-		TAILQ_FOREACH(ifgl, &kif->pfik_ifp->if_groups, ifgl_next)
-			pfi_kif_update((struct pfi_kif *)
-			    ifgl->ifgl_group->ifg_pf_kif);
-}
-
-void
-pfi_dynaddr_update(struct pfi_dynaddr *dyn)
-{
-	struct pfi_kif		*kif;
-	struct pfr_ktable	*kt;
-
-	if (dyn == NULL || dyn->pfid_kif == NULL || dyn->pfid_kt == NULL)
-		panic("pfi_dynaddr_update");
-
-	kif = dyn->pfid_kif;
-	kt = dyn->pfid_kt;
-
-#ifdef __FreeBSD__
-	if (kt->pfrkt_larg != V_pfi_update) {
-#else
-	if (kt->pfrkt_larg != pfi_update) {
-#endif
-		/* this table needs to be brought up-to-date */
-		pfi_table_update(kt, kif, dyn->pfid_net, dyn->pfid_iflags);
-#ifdef __FreeBSD__
-		kt->pfrkt_larg = V_pfi_update;
-#else
-		kt->pfrkt_larg = pfi_update;
-#endif
-	}
-	pfr_dynaddr_update(kt, dyn);
-}
-
-void
-pfi_table_update(struct pfr_ktable *kt, struct pfi_kif *kif, int net, int flags)
-{
-	int			 e, size2 = 0;
-	struct ifg_member	*ifgm;
-
-#ifdef __FreeBSD__
-	V_pfi_buffer_cnt = 0;
-#else
-	pfi_buffer_cnt = 0;
-#endif
-
-	if (kif->pfik_ifp != NULL)
-		pfi_instance_add(kif->pfik_ifp, net, flags);
-	else if (kif->pfik_group != NULL)
-		TAILQ_FOREACH(ifgm, &kif->pfik_group->ifg_members, ifgm_next)
-			pfi_instance_add(ifgm->ifgm_ifp, net, flags);
-
-#ifdef __FreeBSD__
-	if ((e = pfr_set_addrs(&kt->pfrkt_t, V_pfi_buffer, V_pfi_buffer_cnt, &size2,
-	    NULL, NULL, NULL, 0, PFR_TFLAG_ALLMASK)))
-		printf("pfi_table_update: cannot set %d new addresses "
-		    "into table %s: %d\n", V_pfi_buffer_cnt, kt->pfrkt_name, e);
-#else
-	if ((e = pfr_set_addrs(&kt->pfrkt_t, pfi_buffer, pfi_buffer_cnt, &size2,
-	    NULL, NULL, NULL, 0, PFR_TFLAG_ALLMASK)))
-		printf("pfi_table_update: cannot set %d new addresses "
-		    "into table %s: %d\n", pfi_buffer_cnt, kt->pfrkt_name, e);
-#endif
-}
-
-void
-pfi_instance_add(struct ifnet *ifp, int net, int flags)
-{
-	struct ifaddr	*ia;
-	int		 got4 = 0, got6 = 0;
-	int		 net2, af;
-
-	if (ifp == NULL)
-		return;
-	TAILQ_FOREACH(ia, &ifp->if_addrlist, ifa_list) {
-		if (ia->ifa_addr == NULL)
-			continue;
-		af = ia->ifa_addr->sa_family;
-		if (af != AF_INET && af != AF_INET6)
-			continue;
-#ifdef __FreeBSD__
-		/*
-		 * XXX: For point-to-point interfaces, (ifname:0) and IPv4,
-		 *      jump over addresses without a proper route to work
-		 *      around a problem with ppp not fully removing the
-		 *      address used during IPCP.
-		 */
-		if ((ifp->if_flags & IFF_POINTOPOINT) &&
-		    !(ia->ifa_flags & IFA_ROUTE) &&
-		    (flags & PFI_AFLAG_NOALIAS) && (af == AF_INET))
-			continue;
-#endif
-		if ((flags & PFI_AFLAG_BROADCAST) && af == AF_INET6)
-			continue;
-		if ((flags & PFI_AFLAG_BROADCAST) &&
-		    !(ifp->if_flags & IFF_BROADCAST))
-			continue;
-		if ((flags & PFI_AFLAG_PEER) &&
-		    !(ifp->if_flags & IFF_POINTOPOINT))
-			continue;
-		if ((flags & PFI_AFLAG_NETWORK) && af == AF_INET6 &&
-		    IN6_IS_ADDR_LINKLOCAL(
-		    &((struct sockaddr_in6 *)ia->ifa_addr)->sin6_addr))
-			continue;
-		if (flags & PFI_AFLAG_NOALIAS) {
-			if (af == AF_INET && got4)
-				continue;
-			if (af == AF_INET6 && got6)
-				continue;
-		}
-		if (af == AF_INET)
-			got4 = 1;
-		else if (af == AF_INET6)
-			got6 = 1;
-		net2 = net;
-		if (net2 == 128 && (flags & PFI_AFLAG_NETWORK)) {
-			if (af == AF_INET)
-				net2 = pfi_unmask(&((struct sockaddr_in *)
-				    ia->ifa_netmask)->sin_addr);
-			else if (af == AF_INET6)
-				net2 = pfi_unmask(&((struct sockaddr_in6 *)
-				    ia->ifa_netmask)->sin6_addr);
-		}
-		if (af == AF_INET && net2 > 32)
-			net2 = 32;
-		if (flags & PFI_AFLAG_BROADCAST)
-			pfi_address_add(ia->ifa_broadaddr, af, net2);
-		else if (flags & PFI_AFLAG_PEER)
-			pfi_address_add(ia->ifa_dstaddr, af, net2);
-		else
-			pfi_address_add(ia->ifa_addr, af, net2);
-	}
-}
-
-void
-pfi_address_add(struct sockaddr *sa, int af, int net)
-{
-	struct pfr_addr	*p;
-	int		 i;
-
-#ifdef __FreeBSD__
-	if (V_pfi_buffer_cnt >= V_pfi_buffer_max) {
-		int		 new_max = V_pfi_buffer_max * 2;
-#else
-	if (pfi_buffer_cnt >= pfi_buffer_max) {
-		int		 new_max = pfi_buffer_max * 2;
-#endif
-
-		if (new_max > PFI_BUFFER_MAX) {
-			printf("pfi_address_add: address buffer full (%d/%d)\n",
-#ifdef __FreeBSD__
-			    V_pfi_buffer_cnt, PFI_BUFFER_MAX);
-#else
-			    pfi_buffer_cnt, PFI_BUFFER_MAX);
-#endif
-			return;
-		}
-		p = malloc(new_max * sizeof(*V_pfi_buffer), PFI_MTYPE,
-#ifdef __FreeBSD__
-		    M_NOWAIT);
-#else
-		    M_DONTWAIT);
-#endif
-		if (p == NULL) {
-			printf("pfi_address_add: no memory to grow buffer "
-#ifdef __FreeBSD__
-			    "(%d/%d)\n", V_pfi_buffer_cnt, PFI_BUFFER_MAX);
-#else
-			    "(%d/%d)\n", pfi_buffer_cnt, PFI_BUFFER_MAX);
-#endif
-			return;
-		}
-#ifdef __FreeBSD__
-		memcpy(V_pfi_buffer, p, V_pfi_buffer_cnt * sizeof(*V_pfi_buffer));
-		/* no need to zero buffer */
-		free(V_pfi_buffer, PFI_MTYPE);
-		V_pfi_buffer = p;
-		V_pfi_buffer_max = new_max;
-#else
-		memcpy(pfi_buffer, p, pfi_buffer_cnt * sizeof(*pfi_buffer));
-		/* no need to zero buffer */
-		free(pfi_buffer, PFI_MTYPE);
-		pfi_buffer = p;
-		pfi_buffer_max = new_max;
-#endif
-	}
-	if (af == AF_INET && net > 32)
-		net = 128;
-#ifdef __FreeBSD__
-	p = V_pfi_buffer + V_pfi_buffer_cnt++;
-#else
-	p = pfi_buffer + pfi_buffer_cnt++;
-#endif
-	bzero(p, sizeof(*p));
-	p->pfra_af = af;
-	p->pfra_net = net;
-	if (af == AF_INET)
-		p->pfra_ip4addr = ((struct sockaddr_in *)sa)->sin_addr;
-	else if (af == AF_INET6) {
-		p->pfra_ip6addr = ((struct sockaddr_in6 *)sa)->sin6_addr;
-		if (IN6_IS_SCOPE_EMBED(&p->pfra_ip6addr))
-			p->pfra_ip6addr.s6_addr16[1] = 0;
-	}
-	/* mask network address bits */
-	if (net < 128)
-		((caddr_t)p)[p->pfra_net/8] &= ~(0xFF >> (p->pfra_net%8));
-	for (i = (p->pfra_net+7)/8; i < sizeof(p->pfra_u); i++)
-		((caddr_t)p)[i] = 0;
-}
-
-void
-pfi_dynaddr_remove(struct pf_addr_wrap *aw)
-{
-	int	s;
-
-	if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL ||
-	    aw->p.dyn->pfid_kif == NULL || aw->p.dyn->pfid_kt == NULL)
-		return;
-
-	s = splsoftnet();
-	TAILQ_REMOVE(&aw->p.dyn->pfid_kif->pfik_dynaddrs, aw->p.dyn, entry);
-	pfi_kif_unref(aw->p.dyn->pfid_kif, PFI_KIF_REF_RULE);
-	aw->p.dyn->pfid_kif = NULL;
-	pfr_detach_table(aw->p.dyn->pfid_kt);
-	aw->p.dyn->pfid_kt = NULL;
-#ifdef __FreeBSD__
-	pool_put(&V_pfi_addr_pl, aw->p.dyn);
-#else
-	pool_put(&pfi_addr_pl, aw->p.dyn);
-#endif
-	aw->p.dyn = NULL;
-	splx(s);
-}
-
-void
-pfi_dynaddr_copyout(struct pf_addr_wrap *aw)
-{
-	if (aw->type != PF_ADDR_DYNIFTL || aw->p.dyn == NULL ||
-	    aw->p.dyn->pfid_kif == NULL)
-		return;
-	aw->p.dyncnt = aw->p.dyn->pfid_acnt4 + aw->p.dyn->pfid_acnt6;
-}
-
-void
-pfi_kifaddr_update(void *v)
-{
-	int			 s;
-	struct pfi_kif		*kif = (struct pfi_kif *)v;
-
-	s = splsoftnet();
-#ifdef __FreeBSD__
-	V_pfi_update++;
-#else
-	pfi_update++;
-#endif
-	pfi_kif_update(kif);
-	splx(s);
-}
-
-int
-pfi_if_compare(struct pfi_kif *p, struct pfi_kif *q)
-{
-	return (strncmp(p->pfik_name, q->pfik_name, IFNAMSIZ));
-}
-
-void
-pfi_update_status(const char *name, struct pf_status *pfs)
-{
-	struct pfi_kif		*p;
-	struct pfi_kif_cmp	 key;
-	struct ifg_member	 p_member, *ifgm;
-	TAILQ_HEAD(, ifg_member) ifg_members;
-	int			 i, j, k, s;
-
-	strlcpy(key.pfik_name, name, sizeof(key.pfik_name));
-	s = splsoftnet();
-#ifdef __FreeBSD__
-	p = RB_FIND(pfi_ifhead, &V_pfi_ifs, (struct pfi_kif *)&key);
-#else
-	p = RB_FIND(pfi_ifhead, &pfi_ifs, (struct pfi_kif *)&key);
-#endif
-	if (p == NULL) {
-		splx(s);
-		return;
-	}
-	if (p->pfik_group != NULL) {
-		bcopy(&p->pfik_group->ifg_members, &ifg_members,
-		    sizeof(ifg_members));
-	} else {
-		/* build a temporary list for p only */
-		bzero(&p_member, sizeof(p_member));
-		p_member.ifgm_ifp = p->pfik_ifp;
-		TAILQ_INIT(&ifg_members);
-		TAILQ_INSERT_TAIL(&ifg_members, &p_member, ifgm_next);
-	}
-	if (pfs) {
-		bzero(pfs->pcounters, sizeof(pfs->pcounters));
-		bzero(pfs->bcounters, sizeof(pfs->bcounters));
-	}
-	TAILQ_FOREACH(ifgm, &ifg_members, ifgm_next) {
-		if (ifgm->ifgm_ifp == NULL)
-			continue;
-		p = (struct pfi_kif *)ifgm->ifgm_ifp->if_pf_kif;
-
-		/* just clear statistics */
-		if (pfs == NULL) {
-			bzero(p->pfik_packets, sizeof(p->pfik_packets));
-			bzero(p->pfik_bytes, sizeof(p->pfik_bytes));
-			p->pfik_tzero = time_second;
-			continue;
-		}
-		for (i = 0; i < 2; i++)
-			for (j = 0; j < 2; j++)
-				for (k = 0; k < 2; k++) {
-					pfs->pcounters[i][j][k] +=
-						p->pfik_packets[i][j][k];
-					pfs->bcounters[i][j] +=
-						p->pfik_bytes[i][j][k];
-				}
-	}
-	splx(s);
-}
-
-int
-pfi_get_ifaces(const char *name, struct pfi_kif *buf, int *size)
-{
-	struct pfi_kif	*p, *nextp;
-	int		 s, n = 0;
-#ifdef __FreeBSD__
-	int		 error;
-#endif
-
-	s = splsoftnet();
-#ifdef __FreeBSD__
-	for (p = RB_MIN(pfi_ifhead, &V_pfi_ifs); p; p = nextp) {
-		nextp = RB_NEXT(pfi_ifhead, &V_pfi_ifs, p);
-#else
-	for (p = RB_MIN(pfi_ifhead, &pfi_ifs); p; p = nextp) {
-		nextp = RB_NEXT(pfi_ifhead, &pfi_ifs, p);
-#endif
-		if (pfi_skip_if(name, p))
-			continue;
-		if (*size > n++) {
-			if (!p->pfik_tzero)
-				p->pfik_tzero = time_second;
-			pfi_kif_ref(p, PFI_KIF_REF_RULE);
-#ifdef __FreeBSD__
-			PF_COPYOUT(p, buf++, sizeof(*buf), error);
-			if (error) {
-#else
-			if (copyout(p, buf++, sizeof(*buf))) {
-#endif
-				pfi_kif_unref(p, PFI_KIF_REF_RULE);
-				splx(s);
-				return (EFAULT);
-			}
-#ifdef __FreeBSD__
-			nextp = RB_NEXT(pfi_ifhead, &V_pfi_ifs, p);
-#else
-			nextp = RB_NEXT(pfi_ifhead, &pfi_ifs, p);
-#endif
-			pfi_kif_unref(p, PFI_KIF_REF_RULE);
-		}
-	}
-	splx(s);
-	*size = n;
-	return (0);
-}
-
-int
-pfi_skip_if(const char *filter, struct pfi_kif *p)
-{
-	int	n;
-
-	if (filter == NULL || !*filter)
-		return (0);
-	if (!strcmp(p->pfik_name, filter))
-		return (0);	/* exact match */
-	n = strlen(filter);
-	if (n < 1 || n >= IFNAMSIZ)
-		return (1);	/* sanity check */
-	if (filter[n-1] >= '0' && filter[n-1] <= '9')
-		return (1);	/* only do exact match in that case */
-	if (strncmp(p->pfik_name, filter, n))
-		return (1);	/* prefix doesn't match */
-	return (p->pfik_name[n] < '0' || p->pfik_name[n] > '9');
-}
-
-int
-pfi_set_flags(const char *name, int flags)
-{
-	struct pfi_kif	*p;
-	int		 s;
-
-	s = splsoftnet();
-#ifdef __FreeBSD__
-	RB_FOREACH(p, pfi_ifhead, &V_pfi_ifs) {
-#else
-	RB_FOREACH(p, pfi_ifhead, &pfi_ifs) {
-#endif
-		if (pfi_skip_if(name, p))
-			continue;
-		p->pfik_flags |= flags;
-	}
-	splx(s);
-	return (0);
-}
-
-int
-pfi_clear_flags(const char *name, int flags)
-{
-	struct pfi_kif	*p;
-	int		 s;
-
-	s = splsoftnet();
-#ifdef __FreeBSD__
-	RB_FOREACH(p, pfi_ifhead, &V_pfi_ifs) {
-#else
-	RB_FOREACH(p, pfi_ifhead, &pfi_ifs) {
-#endif
-		if (pfi_skip_if(name, p))
-			continue;
-		p->pfik_flags &= ~flags;
-	}
-	splx(s);
-	return (0);
-}
-
-/* from pf_print_state.c */
-int
-pfi_unmask(void *addr)
-{
-	struct pf_addr *m = addr;
-	int i = 31, j = 0, b = 0;
-	u_int32_t tmp;
-
-	while (j < 4 && m->addr32[j] == 0xffffffff) {
-		b += 32;
-		j++;
-	}
-	if (j < 4) {
-		tmp = ntohl(m->addr32[j]);
-		for (i = 31; tmp & (1 << i); --i)
-			b++;
-	}
-	return (b);
-}
-
-#ifdef __FreeBSD__
-void
-pfi_attach_ifnet_event(void *arg __unused, struct ifnet *ifp)
-{
-
-	CURVNET_SET(ifp->if_vnet);
-	PF_LOCK();
-	pfi_attach_ifnet(ifp);
-#ifdef ALTQ
-	pf_altq_ifnet_event(ifp, 0);
-#endif
-	PF_UNLOCK();
-	CURVNET_RESTORE();
-}
-
-void
-pfi_detach_ifnet_event(void *arg __unused, struct ifnet *ifp)
-{
-
-	CURVNET_SET(ifp->if_vnet);
-	PF_LOCK();
-	pfi_detach_ifnet(ifp);
-#ifdef ALTQ
-	pf_altq_ifnet_event(ifp, 1);
-#endif
-	PF_UNLOCK();
-	CURVNET_RESTORE();
-}
-
-void
-pfi_attach_group_event(void *arg , struct ifg_group *ifg)
-{
-
-	CURVNET_SET((struct vnet *)arg);
-	PF_LOCK();
-	pfi_attach_ifgroup(ifg);
-	PF_UNLOCK();
-	CURVNET_RESTORE();
-}
-
-void
-pfi_change_group_event(void *arg, char *gname)
-{
-
-	CURVNET_SET((struct vnet *)arg);
-	PF_LOCK();
-	pfi_group_change(gname);
-	PF_UNLOCK();
-	CURVNET_RESTORE();
-}
-
-void
-pfi_detach_group_event(void *arg, struct ifg_group *ifg)
-{
-
-	CURVNET_SET((struct vnet *)arg);
-	PF_LOCK();
-	pfi_detach_ifgroup(ifg);
-	PF_UNLOCK();
-	CURVNET_RESTORE();
-}
-
-void
-pfi_ifaddr_event(void *arg __unused, struct ifnet *ifp)
-{
-
-	CURVNET_SET(ifp->if_vnet);
-	PF_LOCK();
-	if (ifp && ifp->if_pf_kif)
-		pfi_kifaddr_update(ifp->if_pf_kif);
-	PF_UNLOCK();
-	CURVNET_RESTORE();
-}
-#endif /* __FreeBSD__ */
diff --git a/sys/contrib/pf/net/pf_ioctl.c b/sys/contrib/pf/net/pf_ioctl.c
deleted file mode 100644
index 6b5d8f548bbf..000000000000
--- a/sys/contrib/pf/net/pf_ioctl.c
+++ /dev/null
@@ -1,4420 +0,0 @@
-/*	$OpenBSD: pf_ioctl.c,v 1.213 2009/02/15 21:46:12 mbalmer Exp $ */
-
-/*
- * Copyright (c) 2001 Daniel Hartmeier
- * Copyright (c) 2002,2003 Henning Brauer
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *    - Redistributions of source code must retain the above copyright
- *      notice, this list of conditions and the following disclaimer.
- *    - Redistributions in binary form must reproduce the above
- *      copyright notice, this list of conditions and the following
- *      disclaimer in the documentation and/or other materials provided
- *      with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
- * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
- * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
- * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
- * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
- * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- *
- * Effort sponsored in part by the Defense Advanced Research Projects
- * Agency (DARPA) and Air Force Research Laboratory, Air Force
- * Materiel Command, USAF, under agreement number F30602-01-2-0537.
- *
- */
-
-#ifdef __FreeBSD__
-#include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
-
-#include "opt_inet.h"
-#include "opt_inet6.h"
-#include "opt_bpf.h"
-#include "opt_pf.h"
-
-#define		NPFSYNC		1
-
-#ifdef DEV_PFLOG
-#define		NPFLOG		DEV_PFLOG
-#else
-#define		NPFLOG		0
-#endif
-
-#else /* !__FreeBSD__ */
-#include "pfsync.h"
-#include "pflog.h"
-#endif /* __FreeBSD__ */
-
-#include <sys/param.h>
-#include <sys/systm.h>
-#include <sys/mbuf.h>
-#include <sys/filio.h>
-#include <sys/fcntl.h>
-#include <sys/socket.h>
-#include <sys/socketvar.h>
-#include <sys/kernel.h>
-#include <sys/time.h>
-#ifdef __FreeBSD__
-#include <sys/ucred.h>
-#include <sys/jail.h>
-#include <sys/module.h>
-#include <sys/conf.h>
-#include <sys/proc.h>
-#include <sys/sysctl.h>
-#else
-#include <sys/timeout.h>
-#include <sys/pool.h>
-#endif
-#include <sys/proc.h>
-#include <sys/malloc.h>
-#include <sys/kthread.h>
-#ifndef __FreeBSD__
-#include <sys/rwlock.h>
-#include <uvm/uvm_extern.h>
-#endif
-
-#include <net/if.h>
-#include <net/if_types.h>
-#ifdef __FreeBSD__
-#include <net/vnet.h>
-#endif
-#include <net/route.h>
-
-#include <netinet/in.h>
-#include <netinet/in_var.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#include <netinet/ip_var.h>
-#include <netinet/ip_icmp.h>
-
-#ifdef __FreeBSD__
-#include <sys/md5.h>
-#else
-#include <dev/rndvar.h>
-#include <crypto/md5.h>
-#endif
-#include <net/pfvar.h>
-
-#include <net/if_pfsync.h>
-
-#if NPFLOG > 0
-#include <net/if_pflog.h>
-#endif /* NPFLOG > 0 */
-
-#ifdef INET6
-#include <netinet/ip6.h>
-#include <netinet/in_pcb.h>
-#endif /* INET6 */
-
-#ifdef ALTQ
-#include <altq/altq.h>
-#endif
-
-#ifdef __FreeBSD__
-#include <sys/limits.h>
-#include <sys/lock.h>
-#include <sys/mutex.h>
-#include <net/pfil.h>
-#endif /* __FreeBSD__ */
-
-#ifdef __FreeBSD__
-void			 init_zone_var(void);
-void			 cleanup_pf_zone(void);
-int			 pfattach(void);
-#else
-void			 pfattach(int);
-void			 pf_thread_create(void *);
-int			 pfopen(dev_t, int, int, struct proc *);
-int			 pfclose(dev_t, int, int, struct proc *);
-#endif
-struct pf_pool		*pf_get_pool(char *, u_int32_t, u_int8_t, u_int32_t,
-			    u_int8_t, u_int8_t, u_int8_t);
-
-void			 pf_mv_pool(struct pf_palist *, struct pf_palist *);
-void			 pf_empty_pool(struct pf_palist *);
-#ifdef __FreeBSD__
-int			 pfioctl(struct cdev *, u_long, caddr_t, int, struct thread *);
-#else
-int			 pfioctl(dev_t, u_long, caddr_t, int, struct proc *);
-#endif
-#ifdef ALTQ
-int			 pf_begin_altq(u_int32_t *);
-int			 pf_rollback_altq(u_int32_t);
-int			 pf_commit_altq(u_int32_t);
-int			 pf_enable_altq(struct pf_altq *);
-int			 pf_disable_altq(struct pf_altq *);
-#endif /* ALTQ */
-int			 pf_begin_rules(u_int32_t *, int, const char *);
-int			 pf_rollback_rules(u_int32_t, int, char *);
-int			 pf_setup_pfsync_matching(struct pf_ruleset *);
-void			 pf_hash_rule(MD5_CTX *, struct pf_rule *);
-void			 pf_hash_rule_addr(MD5_CTX *, struct pf_rule_addr *);
-int			 pf_commit_rules(u_int32_t, int, char *);
-int			 pf_addr_setup(struct pf_ruleset *,
-			    struct pf_addr_wrap *, sa_family_t);
-void			 pf_addr_copyout(struct pf_addr_wrap *);
-
-#define	TAGID_MAX	 50000
-
-#ifdef __FreeBSD__
-VNET_DEFINE(struct pf_rule,	 pf_default_rule);
-VNET_DEFINE(struct sx,		 pf_consistency_lock);
-
-#ifdef ALTQ
-static VNET_DEFINE(int,		pf_altq_running);
-#define	V_pf_altq_running	VNET(pf_altq_running)
-#endif
-
-TAILQ_HEAD(pf_tags, pf_tagname);
-
-#define	V_pf_tags		VNET(pf_tags)
-VNET_DEFINE(struct pf_tags, pf_tags);
-#define	V_pf_qids		VNET(pf_qids)
-VNET_DEFINE(struct pf_tags, pf_qids);
-
-#else /* !__FreeBSD__ */
-struct pf_rule		 pf_default_rule;
-struct rwlock		 pf_consistency_lock = RWLOCK_INITIALIZER("pfcnslk");
-#ifdef ALTQ
-static int		 pf_altq_running;
-#endif
-
-TAILQ_HEAD(pf_tags, pf_tagname)	pf_tags = TAILQ_HEAD_INITIALIZER(pf_tags),
-				pf_qids = TAILQ_HEAD_INITIALIZER(pf_qids);
-#endif /* __FreeBSD__ */
-
-#if (PF_QNAME_SIZE != PF_TAG_NAME_SIZE)
-#error PF_QNAME_SIZE must be equal to PF_TAG_NAME_SIZE
-#endif
-
-u_int16_t		 tagname2tag(struct pf_tags *, char *);
-void			 tag2tagname(struct pf_tags *, u_int16_t, char *);
-void			 tag_unref(struct pf_tags *, u_int16_t);
-int			 pf_rtlabel_add(struct pf_addr_wrap *);
-void			 pf_rtlabel_remove(struct pf_addr_wrap *);
-void			 pf_rtlabel_copyout(struct pf_addr_wrap *);
-
-#ifdef __FreeBSD__
-#define DPFPRINTF(n, x) if (V_pf_status.debug >= (n)) printf x
-#else
-#define DPFPRINTF(n, x) if (pf_status.debug >= (n)) printf x
-#endif
-
-#ifdef __FreeBSD__
-struct cdev *pf_dev;
- 
-/*
- * XXX - These are new and need to be checked when moveing to a new version
- */
-static void		 pf_clear_states(void);
-static int		 pf_clear_tables(void);
-static void		 pf_clear_srcnodes(void);
-/*
- * XXX - These are new and need to be checked when moveing to a new version
- */
- 
-/*
- * Wrapper functions for pfil(9) hooks
- */
-#ifdef INET
-static int pf_check_in(void *arg, struct mbuf **m, struct ifnet *ifp,
-    int dir, struct inpcb *inp);
-static int pf_check_out(void *arg, struct mbuf **m, struct ifnet *ifp,
-    int dir, struct inpcb *inp);
-#endif
-#ifdef INET6
-static int pf_check6_in(void *arg, struct mbuf **m, struct ifnet *ifp,
-    int dir, struct inpcb *inp);
-static int pf_check6_out(void *arg, struct mbuf **m, struct ifnet *ifp,
-    int dir, struct inpcb *inp);
-#endif
- 
-static int		hook_pf(void);
-static int		dehook_pf(void);
-static int		shutdown_pf(void);
-static int		pf_load(void);
-static int		pf_unload(void);
-
-static struct cdevsw pf_cdevsw = {
-	.d_ioctl =	pfioctl,
-	.d_name =	PF_NAME,
-	.d_version =	D_VERSION,
-};
-
-static volatile VNET_DEFINE(int, pf_pfil_hooked);
-#define V_pf_pfil_hooked	VNET(pf_pfil_hooked)
-VNET_DEFINE(int,		pf_end_threads);
-struct mtx			pf_task_mtx;
-
-/* pfsync */
-pfsync_state_import_t 		*pfsync_state_import_ptr = NULL;
-pfsync_insert_state_t		*pfsync_insert_state_ptr = NULL;
-pfsync_update_state_t		*pfsync_update_state_ptr = NULL;
-pfsync_delete_state_t		*pfsync_delete_state_ptr = NULL;
-pfsync_clear_states_t		*pfsync_clear_states_ptr = NULL;
-pfsync_state_in_use_t		*pfsync_state_in_use_ptr = NULL;
-pfsync_defer_t			*pfsync_defer_ptr = NULL;
-pfsync_up_t			*pfsync_up_ptr = NULL;
-/* pflow */
-export_pflow_t			*export_pflow_ptr = NULL;
-/* pflog */
-pflog_packet_t			*pflog_packet_ptr = NULL;
-
-VNET_DEFINE(int, debug_pfugidhack);
-SYSCTL_VNET_INT(_debug, OID_AUTO, pfugidhack, CTLFLAG_RW,
-	&VNET_NAME(debug_pfugidhack), 0,
-	"Enable/disable pf user/group rules mpsafe hack");
-
-static void
-init_pf_mutex(void)
-{
-
-	mtx_init(&pf_task_mtx, "pf task mtx", NULL, MTX_DEF);
-}
-
-static void
-destroy_pf_mutex(void)
-{
-
-	mtx_destroy(&pf_task_mtx);
-}
-void
-init_zone_var(void)
-{
-	V_pf_src_tree_pl = V_pf_rule_pl = NULL;
-	V_pf_state_pl = V_pf_state_key_pl = V_pf_state_item_pl = NULL;
-	V_pf_altq_pl = V_pf_pooladdr_pl = NULL;
-	V_pf_frent_pl = V_pf_frag_pl = V_pf_cache_pl = V_pf_cent_pl = NULL;
-	V_pf_state_scrub_pl = NULL;
-	V_pfr_ktable_pl = V_pfr_kentry_pl = V_pfr_kcounters_pl = NULL;
-}
-
-void
-cleanup_pf_zone(void)
-{
-	UMA_DESTROY(V_pf_src_tree_pl);
-	UMA_DESTROY(V_pf_rule_pl);
-	UMA_DESTROY(V_pf_state_pl);
-	UMA_DESTROY(V_pf_state_key_pl);
-	UMA_DESTROY(V_pf_state_item_pl);
-	UMA_DESTROY(V_pf_altq_pl);
-	UMA_DESTROY(V_pf_pooladdr_pl);
-	UMA_DESTROY(V_pf_frent_pl);
-	UMA_DESTROY(V_pf_frag_pl);
-	UMA_DESTROY(V_pf_cache_pl);
-	UMA_DESTROY(V_pf_cent_pl);
-	UMA_DESTROY(V_pfr_ktable_pl);
-	UMA_DESTROY(V_pfr_kentry_pl);
-	UMA_DESTROY(V_pfr_kcounters_pl);
-	UMA_DESTROY(V_pf_state_scrub_pl);
-	UMA_DESTROY(V_pfi_addr_pl);
-}
-
-int
-pfattach(void)
-{
-	u_int32_t *my_timeout = V_pf_default_rule.timeout;
-	int error = 1;
-
-	do {
-		UMA_CREATE(V_pf_src_tree_pl,	struct pf_src_node, "pfsrctrpl");
-		UMA_CREATE(V_pf_rule_pl,	struct pf_rule, "pfrulepl");
-		UMA_CREATE(V_pf_state_pl,	struct pf_state, "pfstatepl");
-		UMA_CREATE(V_pf_state_key_pl,	struct pf_state, "pfstatekeypl");
-		UMA_CREATE(V_pf_state_item_pl,	struct pf_state, "pfstateitempl");
-		UMA_CREATE(V_pf_altq_pl,	struct pf_altq, "pfaltqpl");
-		UMA_CREATE(V_pf_pooladdr_pl,	struct pf_pooladdr, "pfpooladdrpl");
-		UMA_CREATE(V_pfr_ktable_pl,	struct pfr_ktable, "pfrktable");
-		UMA_CREATE(V_pfr_kentry_pl,	struct pfr_kentry, "pfrkentry");
-		UMA_CREATE(V_pfr_kcounters_pl,	struct pfr_kcounters, "pfrkcounters");
-		UMA_CREATE(V_pf_frent_pl,	struct pf_frent, "pffrent");
-		UMA_CREATE(V_pf_frag_pl,	struct pf_fragment, "pffrag");
-		UMA_CREATE(V_pf_cache_pl,	struct pf_fragment, "pffrcache");
-		UMA_CREATE(V_pf_cent_pl,	struct pf_frcache, "pffrcent");
-		UMA_CREATE(V_pf_state_scrub_pl,	struct pf_state_scrub, 
-		    "pfstatescrub");
-		UMA_CREATE(V_pfi_addr_pl,	struct pfi_dynaddr, "pfiaddrpl");
-		error = 0;
-	} while(0);
-	if (error) {
-		cleanup_pf_zone();
-		return (error);
-	}
-	pfr_initialize();
-	pfi_initialize();
-	if ( (error = pf_osfp_initialize()) ) {
-		cleanup_pf_zone();
-		pf_osfp_cleanup();
-		return (error);
-	}
-
-	V_pf_pool_limits[PF_LIMIT_STATES].pp = V_pf_state_pl;
-	V_pf_pool_limits[PF_LIMIT_STATES].limit = PFSTATE_HIWAT;
-	V_pf_pool_limits[PF_LIMIT_SRC_NODES].pp = V_pf_src_tree_pl;
-	V_pf_pool_limits[PF_LIMIT_SRC_NODES].limit = PFSNODE_HIWAT;
-	V_pf_pool_limits[PF_LIMIT_FRAGS].pp = V_pf_frent_pl;
-	V_pf_pool_limits[PF_LIMIT_FRAGS].limit = PFFRAG_FRENT_HIWAT;
-	V_pf_pool_limits[PF_LIMIT_TABLES].pp = V_pfr_ktable_pl;
-	V_pf_pool_limits[PF_LIMIT_TABLES].limit = PFR_KTABLE_HIWAT;
-	V_pf_pool_limits[PF_LIMIT_TABLE_ENTRIES].pp = V_pfr_kentry_pl;
-	V_pf_pool_limits[PF_LIMIT_TABLE_ENTRIES].limit = PFR_KENTRY_HIWAT;
-	uma_zone_set_max(V_pf_pool_limits[PF_LIMIT_STATES].pp,
-	    V_pf_pool_limits[PF_LIMIT_STATES].limit);
-
-	RB_INIT(&V_tree_src_tracking);
-	RB_INIT(&V_pf_anchors);
-	pf_init_ruleset(&pf_main_ruleset);
-
-	TAILQ_INIT(&V_pf_altqs[0]);
-	TAILQ_INIT(&V_pf_altqs[1]);
-	TAILQ_INIT(&V_pf_pabuf);
-	V_pf_altqs_active = &V_pf_altqs[0];
-	V_pf_altqs_inactive = &V_pf_altqs[1];
-	TAILQ_INIT(&V_state_list);
-
-	/* default rule should never be garbage collected */
-	V_pf_default_rule.entries.tqe_prev = &V_pf_default_rule.entries.tqe_next;
-	V_pf_default_rule.action = PF_PASS;
-	V_pf_default_rule.nr = -1;
-	V_pf_default_rule.rtableid = -1;
-
-	/* initialize default timeouts */
-	my_timeout[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL;
-	my_timeout[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL;
-	my_timeout[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL;
-	my_timeout[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL;
-	my_timeout[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL;
-	my_timeout[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL;
-	my_timeout[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL;
-	my_timeout[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL;
-	my_timeout[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL;
-	my_timeout[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL;
-	my_timeout[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL;
-	my_timeout[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL;
-	my_timeout[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL;
-	my_timeout[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL;
-	my_timeout[PFTM_FRAG] = PFTM_FRAG_VAL;
-	my_timeout[PFTM_INTERVAL] = PFTM_INTERVAL_VAL;
-	my_timeout[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL;
-	my_timeout[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL;
-	my_timeout[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START;
-	my_timeout[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END;
-
-	pf_normalize_init();
-
-	bzero(&V_pf_status, sizeof(V_pf_status));
-	V_pf_status.debug = PF_DEBUG_URGENT;
-
-	V_pf_pfil_hooked = 0;
-
-	/* XXX do our best to avoid a conflict */
-	V_pf_status.hostid = arc4random();
-
-	if (kproc_create(pf_purge_thread, curvnet, NULL, 0, 0, "pfpurge"))
-		return (ENXIO);
-
-	m_addr_chg_pf_p = pf_pkt_addr_changed;
-
-	return (error);
-}
-#else /* !__FreeBSD__ */
-
-void
-pfattach(int num)
-{
-	u_int32_t *timeout = pf_default_rule.timeout;
-
-	pool_init(&pf_rule_pl, sizeof(struct pf_rule), 0, 0, 0, "pfrulepl",
-	    &pool_allocator_nointr);
-	pool_init(&pf_src_tree_pl, sizeof(struct pf_src_node), 0, 0, 0,
-	    "pfsrctrpl", NULL);
-	pool_init(&pf_state_pl, sizeof(struct pf_state), 0, 0, 0, "pfstatepl",
-	    NULL);
-	pool_init(&pf_state_key_pl, sizeof(struct pf_state_key), 0, 0, 0,
-	    "pfstatekeypl", NULL);
-	pool_init(&pf_state_item_pl, sizeof(struct pf_state_item), 0, 0, 0,
-	    "pfstateitempl", NULL);
-	pool_init(&pf_altq_pl, sizeof(struct pf_altq), 0, 0, 0, "pfaltqpl",
-	    &pool_allocator_nointr);
-	pool_init(&pf_pooladdr_pl, sizeof(struct pf_pooladdr), 0, 0, 0,
-	    "pfpooladdrpl", &pool_allocator_nointr);
-	pfr_initialize();
-	pfi_initialize();
-	pf_osfp_initialize();
-
-	pool_sethardlimit(pf_pool_limits[PF_LIMIT_STATES].pp,
-	    pf_pool_limits[PF_LIMIT_STATES].limit, NULL, 0);
-
-	if (physmem <= atop(100*1024*1024))
-		pf_pool_limits[PF_LIMIT_TABLE_ENTRIES].limit =
-		    PFR_KENTRY_HIWAT_SMALL;
-
-	RB_INIT(&tree_src_tracking);
-	RB_INIT(&pf_anchors);
-	pf_init_ruleset(&pf_main_ruleset);
-	TAILQ_INIT(&pf_altqs[0]);
-	TAILQ_INIT(&pf_altqs[1]);
-	TAILQ_INIT(&pf_pabuf);
-	pf_altqs_active = &pf_altqs[0];
-	pf_altqs_inactive = &pf_altqs[1];
-	TAILQ_INIT(&state_list);
-
-	/* default rule should never be garbage collected */
-	pf_default_rule.entries.tqe_prev = &pf_default_rule.entries.tqe_next;
-	pf_default_rule.action = PF_PASS;
-	pf_default_rule.nr = -1;
-	pf_default_rule.rtableid = -1;
-
-	/* initialize default timeouts */
-	timeout[PFTM_TCP_FIRST_PACKET] = PFTM_TCP_FIRST_PACKET_VAL;
-	timeout[PFTM_TCP_OPENING] = PFTM_TCP_OPENING_VAL;
-	timeout[PFTM_TCP_ESTABLISHED] = PFTM_TCP_ESTABLISHED_VAL;
-	timeout[PFTM_TCP_CLOSING] = PFTM_TCP_CLOSING_VAL;
-	timeout[PFTM_TCP_FIN_WAIT] = PFTM_TCP_FIN_WAIT_VAL;
-	timeout[PFTM_TCP_CLOSED] = PFTM_TCP_CLOSED_VAL;
-	timeout[PFTM_UDP_FIRST_PACKET] = PFTM_UDP_FIRST_PACKET_VAL;
-	timeout[PFTM_UDP_SINGLE] = PFTM_UDP_SINGLE_VAL;
-	timeout[PFTM_UDP_MULTIPLE] = PFTM_UDP_MULTIPLE_VAL;
-	timeout[PFTM_ICMP_FIRST_PACKET] = PFTM_ICMP_FIRST_PACKET_VAL;
-	timeout[PFTM_ICMP_ERROR_REPLY] = PFTM_ICMP_ERROR_REPLY_VAL;
-	timeout[PFTM_OTHER_FIRST_PACKET] = PFTM_OTHER_FIRST_PACKET_VAL;
-	timeout[PFTM_OTHER_SINGLE] = PFTM_OTHER_SINGLE_VAL;
-	timeout[PFTM_OTHER_MULTIPLE] = PFTM_OTHER_MULTIPLE_VAL;
-	timeout[PFTM_FRAG] = PFTM_FRAG_VAL;
-	timeout[PFTM_INTERVAL] = PFTM_INTERVAL_VAL;
-	timeout[PFTM_SRC_NODE] = PFTM_SRC_NODE_VAL;
-	timeout[PFTM_TS_DIFF] = PFTM_TS_DIFF_VAL;
-	timeout[PFTM_ADAPTIVE_START] = PFSTATE_ADAPT_START;
-	timeout[PFTM_ADAPTIVE_END] = PFSTATE_ADAPT_END;
-
-	pf_normalize_init();
-	bzero(&pf_status, sizeof(pf_status));
-	pf_status.debug = PF_DEBUG_URGENT;
-
-	/* XXX do our best to avoid a conflict */
-	pf_status.hostid = arc4random();
-
-	/* require process context to purge states, so perform in a thread */
-	kthread_create_deferred(pf_thread_create, NULL);
-}
-
-void
-pf_thread_create(void *v)
-{
-	if (kthread_create(pf_purge_thread, NULL, NULL, "pfpurge"))
-		panic("pfpurge thread");
-}
-
-int
-pfopen(dev_t dev, int flags, int fmt, struct proc *p)
-{
-	if (minor(dev) >= 1)
-		return (ENXIO);
-	return (0);
-}
-
-int
-pfclose(dev_t dev, int flags, int fmt, struct proc *p)
-{
-	if (minor(dev) >= 1)
-		return (ENXIO);
-	return (0);
-}
-#endif
-
-struct pf_pool *
-pf_get_pool(char *anchor, u_int32_t ticket, u_int8_t rule_action,
-    u_int32_t rule_number, u_int8_t r_last, u_int8_t active,
-    u_int8_t check_ticket)
-{
-	struct pf_ruleset	*ruleset;
-	struct pf_rule		*rule;
-	int			 rs_num;
-
-	ruleset = pf_find_ruleset(anchor);
-	if (ruleset == NULL)
-		return (NULL);
-	rs_num = pf_get_ruleset_number(rule_action);
-	if (rs_num >= PF_RULESET_MAX)
-		return (NULL);
-	if (active) {
-		if (check_ticket && ticket !=
-		    ruleset->rules[rs_num].active.ticket)
-			return (NULL);
-		if (r_last)
-			rule = TAILQ_LAST(ruleset->rules[rs_num].active.ptr,
-			    pf_rulequeue);
-		else
-			rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr);
-	} else {
-		if (check_ticket && ticket !=
-		    ruleset->rules[rs_num].inactive.ticket)
-			return (NULL);
-		if (r_last)
-			rule = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr,
-			    pf_rulequeue);
-		else
-			rule = TAILQ_FIRST(ruleset->rules[rs_num].inactive.ptr);
-	}
-	if (!r_last) {
-		while ((rule != NULL) && (rule->nr != rule_number))
-			rule = TAILQ_NEXT(rule, entries);
-	}
-	if (rule == NULL)
-		return (NULL);
-
-	return (&rule->rpool);
-}
-
-void
-pf_mv_pool(struct pf_palist *poola, struct pf_palist *poolb)
-{
-	struct pf_pooladdr	*mv_pool_pa;
-
-	while ((mv_pool_pa = TAILQ_FIRST(poola)) != NULL) {
-		TAILQ_REMOVE(poola, mv_pool_pa, entries);
-		TAILQ_INSERT_TAIL(poolb, mv_pool_pa, entries);
-	}
-}
-
-void
-pf_empty_pool(struct pf_palist *poola)
-{
-	struct pf_pooladdr	*empty_pool_pa;
-
-	while ((empty_pool_pa = TAILQ_FIRST(poola)) != NULL) {
-		pfi_dynaddr_remove(&empty_pool_pa->addr);
-		pf_tbladdr_remove(&empty_pool_pa->addr);
-		pfi_kif_unref(empty_pool_pa->kif, PFI_KIF_REF_RULE);
-		TAILQ_REMOVE(poola, empty_pool_pa, entries);
-#ifdef __FreeBSD__
-		pool_put(&V_pf_pooladdr_pl, empty_pool_pa);
-#else
-		pool_put(&pf_pooladdr_pl, empty_pool_pa);
-#endif
-	}
-}
-
-void
-pf_rm_rule(struct pf_rulequeue *rulequeue, struct pf_rule *rule)
-{
-	if (rulequeue != NULL) {
-		if (rule->states_cur <= 0) {
-			/*
-			 * XXX - we need to remove the table *before* detaching
-			 * the rule to make sure the table code does not delete
-			 * the anchor under our feet.
-			 */
-			pf_tbladdr_remove(&rule->src.addr);
-			pf_tbladdr_remove(&rule->dst.addr);
-			if (rule->overload_tbl)
-				pfr_detach_table(rule->overload_tbl);
-		}
-		TAILQ_REMOVE(rulequeue, rule, entries);
-		rule->entries.tqe_prev = NULL;
-		rule->nr = -1;
-	}
-
-	if (rule->states_cur > 0 || rule->src_nodes > 0 ||
-	    rule->entries.tqe_prev != NULL)
-		return;
-	pf_tag_unref(rule->tag);
-	pf_tag_unref(rule->match_tag);
-#ifdef ALTQ
-	if (rule->pqid != rule->qid)
-		pf_qid_unref(rule->pqid);
-	pf_qid_unref(rule->qid);
-#endif
-	pf_rtlabel_remove(&rule->src.addr);
-	pf_rtlabel_remove(&rule->dst.addr);
-	pfi_dynaddr_remove(&rule->src.addr);
-	pfi_dynaddr_remove(&rule->dst.addr);
-	if (rulequeue == NULL) {
-		pf_tbladdr_remove(&rule->src.addr);
-		pf_tbladdr_remove(&rule->dst.addr);
-		if (rule->overload_tbl)
-			pfr_detach_table(rule->overload_tbl);
-	}
-	pfi_kif_unref(rule->kif, PFI_KIF_REF_RULE);
-	pf_anchor_remove(rule);
-	pf_empty_pool(&rule->rpool.list);
-#ifdef __FreeBSD__
-	pool_put(&V_pf_rule_pl, rule);
-#else
-	pool_put(&pf_rule_pl, rule);
-#endif
-}
-
-u_int16_t
-tagname2tag(struct pf_tags *head, char *tagname)
-{
-	struct pf_tagname	*tag, *p = NULL;
-	u_int16_t		 new_tagid = 1;
-
-	TAILQ_FOREACH(tag, head, entries)
-		if (strcmp(tagname, tag->name) == 0) {
-			tag->ref++;
-			return (tag->tag);
-		}
-
-	/*
-	 * to avoid fragmentation, we do a linear search from the beginning
-	 * and take the first free slot we find. if there is none or the list
-	 * is empty, append a new entry at the end.
-	 */
-
-	/* new entry */
-	if (!TAILQ_EMPTY(head))
-		for (p = TAILQ_FIRST(head); p != NULL &&
-		    p->tag == new_tagid; p = TAILQ_NEXT(p, entries))
-			new_tagid = p->tag + 1;
-
-	if (new_tagid > TAGID_MAX)
-		return (0);
-
-	/* allocate and fill new struct pf_tagname */
-	tag = malloc(sizeof(*tag), M_TEMP, M_NOWAIT|M_ZERO);
-	if (tag == NULL)
-		return (0);
-	strlcpy(tag->name, tagname, sizeof(tag->name));
-	tag->tag = new_tagid;
-	tag->ref++;
-
-	if (p != NULL)	/* insert new entry before p */
-		TAILQ_INSERT_BEFORE(p, tag, entries);
-	else	/* either list empty or no free slot in between */
-		TAILQ_INSERT_TAIL(head, tag, entries);
-
-	return (tag->tag);
-}
-
-void
-tag2tagname(struct pf_tags *head, u_int16_t tagid, char *p)
-{
-	struct pf_tagname	*tag;
-
-	TAILQ_FOREACH(tag, head, entries)
-		if (tag->tag == tagid) {
-			strlcpy(p, tag->name, PF_TAG_NAME_SIZE);
-			return;
-		}
-}
-
-void
-tag_unref(struct pf_tags *head, u_int16_t tag)
-{
-	struct pf_tagname	*p, *next;
-
-	if (tag == 0)
-		return;
-
-	for (p = TAILQ_FIRST(head); p != NULL; p = next) {
-		next = TAILQ_NEXT(p, entries);
-		if (tag == p->tag) {
-			if (--p->ref == 0) {
-				TAILQ_REMOVE(head, p, entries);
-				free(p, M_TEMP);
-			}
-			break;
-		}
-	}
-}
-
-u_int16_t
-pf_tagname2tag(char *tagname)
-{
-#ifdef __FreeBSD__
-	return (tagname2tag(&V_pf_tags, tagname));
-#else
-	return (tagname2tag(&pf_tags, tagname));
-#endif
-}
-
-void
-pf_tag2tagname(u_int16_t tagid, char *p)
-{
-#ifdef __FreeBSD__
-	tag2tagname(&V_pf_tags, tagid, p);
-#else
-	tag2tagname(&pf_tags, tagid, p);
-#endif
-}
-
-void
-pf_tag_ref(u_int16_t tag)
-{
-	struct pf_tagname *t;
-
-#ifdef __FreeBSD__
-	TAILQ_FOREACH(t, &V_pf_tags, entries)
-#else
-	TAILQ_FOREACH(t, &pf_tags, entries)
-#endif
-		if (t->tag == tag)
-			break;
-	if (t != NULL)
-		t->ref++;
-}
-
-void
-pf_tag_unref(u_int16_t tag)
-{
-#ifdef __FreeBSD__
-	tag_unref(&V_pf_tags, tag);
-#else
-	tag_unref(&pf_tags, tag);
-#endif
-}
-
-int
-pf_rtlabel_add(struct pf_addr_wrap *a)
-{
-#ifdef __FreeBSD__
-	/* XXX_IMPORT: later */
-	return (0);
-#else
-	if (a->type == PF_ADDR_RTLABEL &&
-	    (a->v.rtlabel = rtlabel_name2id(a->v.rtlabelname)) == 0)
-		return (-1);
-	return (0);
-#endif
-}
-
-void
-pf_rtlabel_remove(struct pf_addr_wrap *a)
-{
-#ifdef __FreeBSD__
-	/* XXX_IMPORT: later */
-#else
-	if (a->type == PF_ADDR_RTLABEL)
-		rtlabel_unref(a->v.rtlabel);
-#endif
-}
-
-void
-pf_rtlabel_copyout(struct pf_addr_wrap *a)
-{
-#ifdef __FreeBSD__
-	/* XXX_IMPORT: later */
-	if (a->type == PF_ADDR_RTLABEL && a->v.rtlabel)
-		strlcpy(a->v.rtlabelname, "?", sizeof(a->v.rtlabelname));
-#else
-	const char	*name;
-
-	if (a->type == PF_ADDR_RTLABEL && a->v.rtlabel) {
-		if ((name = rtlabel_id2name(a->v.rtlabel)) == NULL)
-			strlcpy(a->v.rtlabelname, "?",
-			    sizeof(a->v.rtlabelname));
-		else
-			strlcpy(a->v.rtlabelname, name,
-			    sizeof(a->v.rtlabelname));
-	}
-#endif
-}
-
-#ifdef ALTQ
-u_int32_t
-pf_qname2qid(char *qname)
-{
-#ifdef __FreeBSD__
-	return ((u_int32_t)tagname2tag(&V_pf_qids, qname));
-#else
-	return ((u_int32_t)tagname2tag(&pf_qids, qname));
-#endif
-}
-
-void
-pf_qid2qname(u_int32_t qid, char *p)
-{
-#ifdef __FreeBSD__
-	tag2tagname(&V_pf_qids, (u_int16_t)qid, p);
-#else
-	tag2tagname(&pf_qids, (u_int16_t)qid, p);
-#endif
-}
-
-void
-pf_qid_unref(u_int32_t qid)
-{
-#ifdef __FreeBSD__
-	tag_unref(&V_pf_qids, (u_int16_t)qid);
-#else
-	tag_unref(&pf_qids, (u_int16_t)qid);
-#endif
-}
-
-int
-pf_begin_altq(u_int32_t *ticket)
-{
-	struct pf_altq	*altq;
-	int		 error = 0;
-
-	/* Purge the old altq list */
-#ifdef __FreeBSD__
-	while ((altq = TAILQ_FIRST(V_pf_altqs_inactive)) != NULL) {
-		TAILQ_REMOVE(V_pf_altqs_inactive, altq, entries);
-		if (altq->qname[0] == 0 &&
-		    (altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) {
-#else
-	while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) {
-		TAILQ_REMOVE(pf_altqs_inactive, altq, entries);
-		if (altq->qname[0] == 0) {
-#endif
-			/* detach and destroy the discipline */
-			error = altq_remove(altq);
-		} else
-			pf_qid_unref(altq->qid);
-#ifdef __FreeBSD__
-		pool_put(&V_pf_altq_pl, altq);
-#else
-		pool_put(&pf_altq_pl, altq);
-#endif
-	}
-	if (error)
-		return (error);
-#ifdef __FreeBSD__
-	*ticket = ++V_ticket_altqs_inactive;
-	V_altqs_inactive_open = 1;
-#else
-	*ticket = ++ticket_altqs_inactive;
-	altqs_inactive_open = 1;
-#endif
-	return (0);
-}
-
-int
-pf_rollback_altq(u_int32_t ticket)
-{
-	struct pf_altq	*altq;
-	int		 error = 0;
-
-#ifdef __FreeBSD__
-	if (!V_altqs_inactive_open || ticket != V_ticket_altqs_inactive)
-		return (0);
-	/* Purge the old altq list */
-	while ((altq = TAILQ_FIRST(V_pf_altqs_inactive)) != NULL) {
-		TAILQ_REMOVE(V_pf_altqs_inactive, altq, entries);
-		if (altq->qname[0] == 0 &&
-		   (altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) {
-#else
-	if (!altqs_inactive_open || ticket != ticket_altqs_inactive)
-		return (0);
-	/* Purge the old altq list */
-	while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) {
-		TAILQ_REMOVE(pf_altqs_inactive, altq, entries);
-		if (altq->qname[0] == 0) {
-#endif
-			/* detach and destroy the discipline */
-			error = altq_remove(altq);
-		} else
-			pf_qid_unref(altq->qid);
-#ifdef __FreeBSD__
-		pool_put(&V_pf_altq_pl, altq);
-#else
-		pool_put(&pf_altq_pl, altq);
-#endif
-	}
-#ifdef __FreeBSD__
-	V_altqs_inactive_open = 0;
-#else
-	altqs_inactive_open = 0;
-#endif
-	return (error);
-}
-
-int
-pf_commit_altq(u_int32_t ticket)
-{
-	struct pf_altqqueue	*old_altqs;
-	struct pf_altq		*altq;
-	int			 s, err, error = 0;
-
-#ifdef __FreeBSD__
-	if (!V_altqs_inactive_open || ticket != V_ticket_altqs_inactive)
-#else
-	if (!altqs_inactive_open || ticket != ticket_altqs_inactive)
-#endif
-		return (EBUSY);
-
-	/* swap altqs, keep the old. */
-	s = splsoftnet();
-#ifdef __FreeBSD__
-	old_altqs = V_pf_altqs_active;
-	V_pf_altqs_active = V_pf_altqs_inactive;
-	V_pf_altqs_inactive = old_altqs;
-	V_ticket_altqs_active = V_ticket_altqs_inactive;
-#else
-	old_altqs = pf_altqs_active;
-	pf_altqs_active = pf_altqs_inactive;
-	pf_altqs_inactive = old_altqs;
-	ticket_altqs_active = ticket_altqs_inactive;
-#endif
-
-	/* Attach new disciplines */
-#ifdef __FreeBSD__
-	TAILQ_FOREACH(altq, V_pf_altqs_active, entries) {
-	if (altq->qname[0] == 0 &&
-	   (altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) {
-#else
-	TAILQ_FOREACH(altq, pf_altqs_active, entries) {
-		if (altq->qname[0] == 0) {
-#endif
-			/* attach the discipline */
-			error = altq_pfattach(altq);
-#ifdef __FreeBSD__
-			if (error == 0 && V_pf_altq_running)
-#else
-			if (error == 0 && pf_altq_running)
-#endif
-				error = pf_enable_altq(altq);
-			if (error != 0) {
-				splx(s);
-				return (error);
-			}
-		}
-	}
-
-	/* Purge the old altq list */
-#ifdef __FreeBSD__
-	while ((altq = TAILQ_FIRST(V_pf_altqs_inactive)) != NULL) {
-		TAILQ_REMOVE(V_pf_altqs_inactive, altq, entries);
-		if (altq->qname[0] == 0 &&
-		    (altq->local_flags & PFALTQ_FLAG_IF_REMOVED) == 0) {
-#else
-	while ((altq = TAILQ_FIRST(pf_altqs_inactive)) != NULL) {
-		TAILQ_REMOVE(pf_altqs_inactive, altq, entries);
-		if (altq->qname[0] == 0) {
-#endif
-			/* detach and destroy the discipline */
-#ifdef __FreeBSD__
-			if (V_pf_altq_running)
-#else
-			if (pf_altq_running)
-#endif
-				error = pf_disable_altq(altq);
-			err = altq_pfdetach(altq);
-			if (err != 0 && error == 0)
-				error = err;
-			err = altq_remove(altq);
-			if (err != 0 && error == 0)
-				error = err;
-		} else
-			pf_qid_unref(altq->qid);
-#ifdef __FreeBSD__
-		pool_put(&V_pf_altq_pl, altq);
-#else
-		pool_put(&pf_altq_pl, altq);
-#endif
-	}
-	splx(s);
-
-#ifdef __FreeBSD__
-	V_altqs_inactive_open = 0;
-#else
-	altqs_inactive_open = 0;
-#endif
-	return (error);
-}
-
-int
-pf_enable_altq(struct pf_altq *altq)
-{
-	struct ifnet		*ifp;
-	struct tb_profile	 tb;
-	int			 s, error = 0;
-
-	if ((ifp = ifunit(altq->ifname)) == NULL)
-		return (EINVAL);
-
-	if (ifp->if_snd.altq_type != ALTQT_NONE)
-		error = altq_enable(&ifp->if_snd);
-
-	/* set tokenbucket regulator */
-	if (error == 0 && ifp != NULL && ALTQ_IS_ENABLED(&ifp->if_snd)) {
-		tb.rate = altq->ifbandwidth;
-		tb.depth = altq->tbrsize;
-		s = splnet();
-#ifdef __FreeBSD__
-		PF_UNLOCK();
-#endif
-		error = tbr_set(&ifp->if_snd, &tb);
-#ifdef __FreeBSD__
-		PF_LOCK();
-#endif
-		splx(s);
-	}
-
-	return (error);
-}
-
-int
-pf_disable_altq(struct pf_altq *altq)
-{
-	struct ifnet		*ifp;
-	struct tb_profile	 tb;
-	int			 s, error;
-
-	if ((ifp = ifunit(altq->ifname)) == NULL)
-		return (EINVAL);
-
-	/*
-	 * when the discipline is no longer referenced, it was overridden
-	 * by a new one.  if so, just return.
-	 */
-	if (altq->altq_disc != ifp->if_snd.altq_disc)
-		return (0);
-
-	error = altq_disable(&ifp->if_snd);
-
-	if (error == 0) {
-		/* clear tokenbucket regulator */
-		tb.rate = 0;
-		s = splnet();
-#ifdef __FreeBSD__
-		PF_UNLOCK();
-#endif
-		error = tbr_set(&ifp->if_snd, &tb);
-#ifdef __FreeBSD__
-		PF_LOCK();
-#endif
-		splx(s);
-	}
-
-	return (error);
-}
-
-#ifdef __FreeBSD__
-void
-pf_altq_ifnet_event(struct ifnet *ifp, int remove)
-{
-	struct ifnet	*ifp1;
-	struct pf_altq	*a1, *a2, *a3;
-	u_int32_t	 ticket;
-	int		 error = 0;
-
-	/* Interrupt userland queue modifications */
-#ifdef __FreeBSD__
-	if (V_altqs_inactive_open)
-		pf_rollback_altq(V_ticket_altqs_inactive);
-#else
-	if (altqs_inactive_open)
-		pf_rollback_altq(ticket_altqs_inactive);
-#endif
-
-	/* Start new altq ruleset */
-	if (pf_begin_altq(&ticket))
-		return;
-
-	/* Copy the current active set */
-#ifdef __FreeBSD__
-	TAILQ_FOREACH(a1, V_pf_altqs_active, entries) {
-		a2 = pool_get(&V_pf_altq_pl, PR_NOWAIT);
-#else
-	TAILQ_FOREACH(a1, pf_altqs_active, entries) {
-		a2 = pool_get(&pf_altq_pl, PR_NOWAIT);
-#endif
-		if (a2 == NULL) {
-			error = ENOMEM;
-			break;
-		}
-		bcopy(a1, a2, sizeof(struct pf_altq));
-
-		if (a2->qname[0] != 0) {
-			if ((a2->qid = pf_qname2qid(a2->qname)) == 0) {
-				error = EBUSY;
-#ifdef __FreeBSD__
-				pool_put(&V_pf_altq_pl, a2);
-#else
-				pool_put(&pf_altq_pl, a2);
-#endif
-				break;
-			}
-			a2->altq_disc = NULL;
-#ifdef __FreeBSD__
-			TAILQ_FOREACH(a3, V_pf_altqs_inactive, entries) {
-#else
-			TAILQ_FOREACH(a3, pf_altqs_inactive, entries) {
-#endif
-				if (strncmp(a3->ifname, a2->ifname,
-				    IFNAMSIZ) == 0 && a3->qname[0] == 0) {
-					a2->altq_disc = a3->altq_disc;
-					break;
-				}
-			}
-		}
-		/* Deactivate the interface in question */
-		a2->local_flags &= ~PFALTQ_FLAG_IF_REMOVED;
-		if ((ifp1 = ifunit(a2->ifname)) == NULL ||
-		    (remove && ifp1 == ifp)) {
-			a2->local_flags |= PFALTQ_FLAG_IF_REMOVED;
-		} else {
-			PF_UNLOCK();
-			error = altq_add(a2);
-			PF_LOCK();
-
-#ifdef __FreeBSD__
-			if (ticket != V_ticket_altqs_inactive)
-#else
-			if (ticket != ticket_altqs_inactive)
-#endif
-				error = EBUSY;
-
-			if (error) {
-#ifdef __FreeBSD__
-				pool_put(&V_pf_altq_pl, a2);
-#else
-				pool_put(&pf_altq_pl, a2);
-#endif
-				break;
-			}
-		}
-
-#ifdef __FreeBSD__
-		TAILQ_INSERT_TAIL(V_pf_altqs_inactive, a2, entries);
-#else
-		TAILQ_INSERT_TAIL(pf_altqs_inactive, a2, entries);
-#endif
-	}
-
-	if (error != 0)
-		pf_rollback_altq(ticket);
-	else
-		pf_commit_altq(ticket);
-	}
-#endif
-#endif /* ALTQ */
-
-int
-pf_begin_rules(u_int32_t *ticket, int rs_num, const char *anchor)
-{
-	struct pf_ruleset	*rs;
-	struct pf_rule		*rule;
-
-	if (rs_num < 0 || rs_num >= PF_RULESET_MAX)
-		return (EINVAL);
-	rs = pf_find_or_create_ruleset(anchor);
-	if (rs == NULL)
-		return (EINVAL);
-	while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) {
-		pf_rm_rule(rs->rules[rs_num].inactive.ptr, rule);
-		rs->rules[rs_num].inactive.rcount--;
-	}
-	*ticket = ++rs->rules[rs_num].inactive.ticket;
-	rs->rules[rs_num].inactive.open = 1;
-	return (0);
-}
-
-int
-pf_rollback_rules(u_int32_t ticket, int rs_num, char *anchor)
-{
-	struct pf_ruleset	*rs;
-	struct pf_rule		*rule;
-
-	if (rs_num < 0 || rs_num >= PF_RULESET_MAX)
-		return (EINVAL);
-	rs = pf_find_ruleset(anchor);
-	if (rs == NULL || !rs->rules[rs_num].inactive.open ||
-	    rs->rules[rs_num].inactive.ticket != ticket)
-		return (0);
-	while ((rule = TAILQ_FIRST(rs->rules[rs_num].inactive.ptr)) != NULL) {
-		pf_rm_rule(rs->rules[rs_num].inactive.ptr, rule);
-		rs->rules[rs_num].inactive.rcount--;
-	}
-	rs->rules[rs_num].inactive.open = 0;
-	return (0);
-}
-
-#define PF_MD5_UPD(st, elm)						\
-		MD5Update(ctx, (u_int8_t *) &(st)->elm, sizeof((st)->elm))
-
-#define PF_MD5_UPD_STR(st, elm)						\
-		MD5Update(ctx, (u_int8_t *) (st)->elm, strlen((st)->elm))
-
-#define PF_MD5_UPD_HTONL(st, elm, stor) do {				\
-		(stor) = htonl((st)->elm);				\
-		MD5Update(ctx, (u_int8_t *) &(stor), sizeof(u_int32_t));\
-} while (0)
-
-#define PF_MD5_UPD_HTONS(st, elm, stor) do {				\
-		(stor) = htons((st)->elm);				\
-		MD5Update(ctx, (u_int8_t *) &(stor), sizeof(u_int16_t));\
-} while (0)
-
-void
-pf_hash_rule_addr(MD5_CTX *ctx, struct pf_rule_addr *pfr)
-{
-	PF_MD5_UPD(pfr, addr.type);
-	switch (pfr->addr.type) {
-		case PF_ADDR_DYNIFTL:
-			PF_MD5_UPD(pfr, addr.v.ifname);
-			PF_MD5_UPD(pfr, addr.iflags);
-			break;
-		case PF_ADDR_TABLE:
-			PF_MD5_UPD(pfr, addr.v.tblname);
-			break;
-		case PF_ADDR_ADDRMASK:
-			/* XXX ignore af? */
-			PF_MD5_UPD(pfr, addr.v.a.addr.addr32);
-			PF_MD5_UPD(pfr, addr.v.a.mask.addr32);
-			break;
-		case PF_ADDR_RTLABEL:
-			PF_MD5_UPD(pfr, addr.v.rtlabelname);
-			break;
-	}
-
-	PF_MD5_UPD(pfr, port[0]);
-	PF_MD5_UPD(pfr, port[1]);
-	PF_MD5_UPD(pfr, neg);
-	PF_MD5_UPD(pfr, port_op);
-}
-
-void
-pf_hash_rule(MD5_CTX *ctx, struct pf_rule *rule)
-{
-	u_int16_t x;
-	u_int32_t y;
-
-	pf_hash_rule_addr(ctx, &rule->src);
-	pf_hash_rule_addr(ctx, &rule->dst);
-	PF_MD5_UPD_STR(rule, label);
-	PF_MD5_UPD_STR(rule, ifname);
-	PF_MD5_UPD_STR(rule, match_tagname);
-	PF_MD5_UPD_HTONS(rule, match_tag, x); /* dup? */
-	PF_MD5_UPD_HTONL(rule, os_fingerprint, y);
-	PF_MD5_UPD_HTONL(rule, prob, y);
-	PF_MD5_UPD_HTONL(rule, uid.uid[0], y);
-	PF_MD5_UPD_HTONL(rule, uid.uid[1], y);
-	PF_MD5_UPD(rule, uid.op);
-	PF_MD5_UPD_HTONL(rule, gid.gid[0], y);
-	PF_MD5_UPD_HTONL(rule, gid.gid[1], y);
-	PF_MD5_UPD(rule, gid.op);
-	PF_MD5_UPD_HTONL(rule, rule_flag, y);
-	PF_MD5_UPD(rule, action);
-	PF_MD5_UPD(rule, direction);
-	PF_MD5_UPD(rule, af);
-	PF_MD5_UPD(rule, quick);
-	PF_MD5_UPD(rule, ifnot);
-	PF_MD5_UPD(rule, match_tag_not);
-	PF_MD5_UPD(rule, natpass);
-	PF_MD5_UPD(rule, keep_state);
-	PF_MD5_UPD(rule, proto);
-	PF_MD5_UPD(rule, type);
-	PF_MD5_UPD(rule, code);
-	PF_MD5_UPD(rule, flags);
-	PF_MD5_UPD(rule, flagset);
-	PF_MD5_UPD(rule, allow_opts);
-	PF_MD5_UPD(rule, rt);
-	PF_MD5_UPD(rule, tos);
-}
-
-int
-pf_commit_rules(u_int32_t ticket, int rs_num, char *anchor)
-{
-	struct pf_ruleset	*rs;
-	struct pf_rule		*rule, **old_array;
-	struct pf_rulequeue	*old_rules;
-	int			 s, error;
-	u_int32_t		 old_rcount;
-
-	if (rs_num < 0 || rs_num >= PF_RULESET_MAX)
-		return (EINVAL);
-	rs = pf_find_ruleset(anchor);
-	if (rs == NULL || !rs->rules[rs_num].inactive.open ||
-	    ticket != rs->rules[rs_num].inactive.ticket)
-		return (EBUSY);
-
-	/* Calculate checksum for the main ruleset */
-	if (rs == &pf_main_ruleset) {
-		error = pf_setup_pfsync_matching(rs);
-		if (error != 0)
-			return (error);
-	}
-
-	/* Swap rules, keep the old. */
-	s = splsoftnet();
-	old_rules = rs->rules[rs_num].active.ptr;
-	old_rcount = rs->rules[rs_num].active.rcount;
-	old_array = rs->rules[rs_num].active.ptr_array;
-
-	rs->rules[rs_num].active.ptr =
-	    rs->rules[rs_num].inactive.ptr;
-	rs->rules[rs_num].active.ptr_array =
-	    rs->rules[rs_num].inactive.ptr_array;
-	rs->rules[rs_num].active.rcount =
-	    rs->rules[rs_num].inactive.rcount;
-	rs->rules[rs_num].inactive.ptr = old_rules;
-	rs->rules[rs_num].inactive.ptr_array = old_array;
-	rs->rules[rs_num].inactive.rcount = old_rcount;
-
-	rs->rules[rs_num].active.ticket =
-	    rs->rules[rs_num].inactive.ticket;
-	pf_calc_skip_steps(rs->rules[rs_num].active.ptr);
-
-
-	/* Purge the old rule list. */
-	while ((rule = TAILQ_FIRST(old_rules)) != NULL)
-		pf_rm_rule(old_rules, rule);
-	if (rs->rules[rs_num].inactive.ptr_array)
-		free(rs->rules[rs_num].inactive.ptr_array, M_TEMP);
-	rs->rules[rs_num].inactive.ptr_array = NULL;
-	rs->rules[rs_num].inactive.rcount = 0;
-	rs->rules[rs_num].inactive.open = 0;
-	pf_remove_if_empty_ruleset(rs);
-	splx(s);
-	return (0);
-}
-
-int
-pf_setup_pfsync_matching(struct pf_ruleset *rs)
-{
-	MD5_CTX			 ctx;
-	struct pf_rule		*rule;
-	int			 rs_cnt;
-	u_int8_t		 digest[PF_MD5_DIGEST_LENGTH];
-
-	MD5Init(&ctx);
-	for (rs_cnt = 0; rs_cnt < PF_RULESET_MAX; rs_cnt++) {
-		/* XXX PF_RULESET_SCRUB as well? */
-		if (rs_cnt == PF_RULESET_SCRUB)
-			continue;
-
-		if (rs->rules[rs_cnt].inactive.ptr_array)
-			free(rs->rules[rs_cnt].inactive.ptr_array, M_TEMP);
-		rs->rules[rs_cnt].inactive.ptr_array = NULL;
-
-		if (rs->rules[rs_cnt].inactive.rcount) {
-			rs->rules[rs_cnt].inactive.ptr_array =
-			    malloc(sizeof(caddr_t) *
-			    rs->rules[rs_cnt].inactive.rcount,
-			    M_TEMP, M_NOWAIT);
-
-			if (!rs->rules[rs_cnt].inactive.ptr_array)
-				return (ENOMEM);
-		}
-
-		TAILQ_FOREACH(rule, rs->rules[rs_cnt].inactive.ptr,
-		    entries) {
-			pf_hash_rule(&ctx, rule);
-			(rs->rules[rs_cnt].inactive.ptr_array)[rule->nr] = rule;
-		}
-	}
-
-	MD5Final(digest, &ctx);
-#ifdef __FreeBSD__
-	memcpy(V_pf_status.pf_chksum, digest, sizeof(V_pf_status.pf_chksum));
-#else
-	memcpy(pf_status.pf_chksum, digest, sizeof(pf_status.pf_chksum));
-#endif
-	return (0);
-}
-
-int
-pf_addr_setup(struct pf_ruleset *ruleset, struct pf_addr_wrap *addr,
-    sa_family_t af)
-{
-	if (pfi_dynaddr_setup(addr, af) ||
-	    pf_tbladdr_setup(ruleset, addr))
-		return (EINVAL);
-
-	return (0);
-}
-
-void
-pf_addr_copyout(struct pf_addr_wrap *addr)
-{
-	pfi_dynaddr_copyout(addr);
-	pf_tbladdr_copyout(addr);
-	pf_rtlabel_copyout(addr);
-}
-
-int
-#ifdef __FreeBSD__
-pfioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flags, struct thread *td)
-#else
-pfioctl(dev_t dev, u_long cmd, caddr_t addr, int flags, struct proc *p)
-#endif
-{
-	struct pf_pooladdr	*pa = NULL;
-	struct pf_pool		*pool = NULL;
-#ifndef __FreeBSD__
-	int			 s;
-#endif
-	int			 error = 0;
-
-	CURVNET_SET(TD_TO_VNET(td));
-
-	/* XXX keep in sync with switch() below */
-#ifdef __FreeBSD__
-	if (securelevel_gt(td->td_ucred, 2))
-#else
-	if (securelevel > 1)
-#endif
-		switch (cmd) {
-		case DIOCGETRULES:
-		case DIOCGETRULE:
-		case DIOCGETADDRS:
-		case DIOCGETADDR:
-		case DIOCGETSTATE:
-		case DIOCSETSTATUSIF:
-		case DIOCGETSTATUS:
-		case DIOCCLRSTATUS:
-		case DIOCNATLOOK:
-		case DIOCSETDEBUG:
-		case DIOCGETSTATES:
-		case DIOCGETTIMEOUT:
-		case DIOCCLRRULECTRS:
-		case DIOCGETLIMIT:
-		case DIOCGETALTQS:
-		case DIOCGETALTQ:
-		case DIOCGETQSTATS:
-		case DIOCGETRULESETS:
-		case DIOCGETRULESET:
-		case DIOCRGETTABLES:
-		case DIOCRGETTSTATS:
-		case DIOCRCLRTSTATS:
-		case DIOCRCLRADDRS:
-		case DIOCRADDADDRS:
-		case DIOCRDELADDRS:
-		case DIOCRSETADDRS:
-		case DIOCRGETADDRS:
-		case DIOCRGETASTATS:
-		case DIOCRCLRASTATS:
-		case DIOCRTSTADDRS:
-		case DIOCOSFPGET:
-		case DIOCGETSRCNODES:
-		case DIOCCLRSRCNODES:
-		case DIOCIGETIFACES:
-#ifdef __FreeBSD__
-		case DIOCGIFSPEED:
-#endif
-		case DIOCSETIFFLAG:
-		case DIOCCLRIFFLAG:
-			break;
-		case DIOCRCLRTABLES:
-		case DIOCRADDTABLES:
-		case DIOCRDELTABLES:
-		case DIOCRSETTFLAGS:
-			if (((struct pfioc_table *)addr)->pfrio_flags &
-			    PFR_FLAG_DUMMY)
-				break; /* dummy operation ok */
-			return (EPERM);
-		default:
-			return (EPERM);
-		}
-
-	if (!(flags & FWRITE))
-		switch (cmd) {
-		case DIOCGETRULES:
-		case DIOCGETADDRS:
-		case DIOCGETADDR:
-		case DIOCGETSTATE:
-		case DIOCGETSTATUS:
-		case DIOCGETSTATES:
-		case DIOCGETTIMEOUT:
-		case DIOCGETLIMIT:
-		case DIOCGETALTQS:
-		case DIOCGETALTQ:
-		case DIOCGETQSTATS:
-		case DIOCGETRULESETS:
-		case DIOCGETRULESET:
-		case DIOCNATLOOK:
-		case DIOCRGETTABLES:
-		case DIOCRGETTSTATS:
-		case DIOCRGETADDRS:
-		case DIOCRGETASTATS:
-		case DIOCRTSTADDRS:
-		case DIOCOSFPGET:
-		case DIOCGETSRCNODES:
-		case DIOCIGETIFACES:
-#ifdef __FreeBSD__
-		case DIOCGIFSPEED:
-#endif
-			break;
-		case DIOCRCLRTABLES:
-		case DIOCRADDTABLES:
-		case DIOCRDELTABLES:
-		case DIOCRCLRTSTATS:
-		case DIOCRCLRADDRS:
-		case DIOCRADDADDRS:
-		case DIOCRDELADDRS:
-		case DIOCRSETADDRS:
-		case DIOCRSETTFLAGS:
-			if (((struct pfioc_table *)addr)->pfrio_flags &
-			    PFR_FLAG_DUMMY) {
-				flags |= FWRITE; /* need write lock for dummy */
-				break; /* dummy operation ok */
-			}
-			return (EACCES);
-		case DIOCGETRULE:
-			if (((struct pfioc_rule *)addr)->action ==
-			    PF_GET_CLR_CNTR)
-				return (EACCES);
-			break;
-		default:
-			return (EACCES);
-		}
-
-	if (flags & FWRITE)
-#ifdef __FreeBSD__
-		sx_xlock(&V_pf_consistency_lock);
-	else
-		sx_slock(&V_pf_consistency_lock);
-#else
-		rw_enter_write(&pf_consistency_lock);
-	else
-		rw_enter_read(&pf_consistency_lock);
-#endif
-
-#ifdef __FreeBSD__
-	PF_LOCK();
-#else
-	s = splsoftnet();
-#endif
-	switch (cmd) {
-
-	case DIOCSTART:
-#ifdef __FreeBSD__
-		if (V_pf_status.running)
-#else
-		if (pf_status.running)
-#endif
-			error = EEXIST;
-		else {
-#ifdef __FreeBSD__
-			PF_UNLOCK();
-			error = hook_pf();
-			PF_LOCK();
-			if (error) {
-				DPFPRINTF(PF_DEBUG_MISC,
-				    ("pf: pfil registeration fail\n"));
-				break;
-			}
-			V_pf_status.running = 1;
-			V_pf_status.since = time_second;
-
-			if (V_pf_status.stateid == 0) {
-				V_pf_status.stateid = time_second;
-				V_pf_status.stateid = V_pf_status.stateid << 32;
-			}
-#else
-			pf_status.running = 1;
-			pf_status.since = time_second;
-
-			if (pf_status.stateid == 0) {
-				pf_status.stateid = time_second;
-				pf_status.stateid = pf_status.stateid << 32;
-			}
-#endif
-			DPFPRINTF(PF_DEBUG_MISC, ("pf: started\n"));
-		}
-		break;
-
-	case DIOCSTOP:
-#ifdef __FreeBSD__
-		if (!V_pf_status.running)
-			error = ENOENT;
-		else {
-			V_pf_status.running = 0;
-			PF_UNLOCK();
-			error = dehook_pf();
-			PF_LOCK();
-			if (error) {
-				V_pf_status.running = 1;
-				DPFPRINTF(PF_DEBUG_MISC,
-				    ("pf: pfil unregisteration failed\n"));
-			}
-			V_pf_status.since = time_second;
-#else
-		if (!pf_status.running)
-			error = ENOENT;
-		else {
-			pf_status.running = 0;
-			pf_status.since = time_second;
-#endif
-			DPFPRINTF(PF_DEBUG_MISC, ("pf: stopped\n"));
-		}
-		break;
-
-	case DIOCADDRULE: {
-		struct pfioc_rule	*pr = (struct pfioc_rule *)addr;
-		struct pf_ruleset	*ruleset;
-		struct pf_rule		*rule, *tail;
-		struct pf_pooladdr	*pa;
-		int			 rs_num;
-
-		pr->anchor[sizeof(pr->anchor) - 1] = 0;
-		ruleset = pf_find_ruleset(pr->anchor);
-		if (ruleset == NULL) {
-			error = EINVAL;
-			break;
-		}
-		rs_num = pf_get_ruleset_number(pr->rule.action);
-		if (rs_num >= PF_RULESET_MAX) {
-			error = EINVAL;
-			break;
-		}
-		if (pr->rule.return_icmp >> 8 > ICMP_MAXTYPE) {
-			error = EINVAL;
-			break;
-		}
-		if (pr->ticket != ruleset->rules[rs_num].inactive.ticket) {
-#ifdef __FreeBSD__
-			DPFPRINTF(PF_DEBUG_MISC,
-			    ("ticket: %d != [%d]%d\n", pr->ticket, rs_num,
-			    ruleset->rules[rs_num].inactive.ticket));
-#endif
-			error = EBUSY;
-			break;
-		}
-#ifdef __FreeBSD__
-		if (pr->pool_ticket != V_ticket_pabuf) {
-			DPFPRINTF(PF_DEBUG_MISC,
-			    ("pool_ticket: %d != %d\n", pr->pool_ticket,
-			    V_ticket_pabuf));
-#else
-		if (pr->pool_ticket != ticket_pabuf) {
-#endif
-			error = EBUSY;
-			break;
-		}
-#ifdef __FreeBSD__
-		rule = pool_get(&V_pf_rule_pl, PR_NOWAIT);
-#else
-		rule = pool_get(&pf_rule_pl, PR_WAITOK|PR_LIMITFAIL);
-#endif
-		if (rule == NULL) {
-			error = ENOMEM;
-			break;
-		}
-		bcopy(&pr->rule, rule, sizeof(struct pf_rule));
-#ifdef __FreeBSD__
-		rule->cuid = td->td_ucred->cr_ruid;
-		rule->cpid = td->td_proc ? td->td_proc->p_pid : 0;
-#else
-		rule->cuid = p->p_cred->p_ruid;
-		rule->cpid = p->p_pid;
-#endif
-		rule->anchor = NULL;
-		rule->kif = NULL;
-		TAILQ_INIT(&rule->rpool.list);
-		/* initialize refcounting */
-		rule->states_cur = 0;
-		rule->src_nodes = 0;
-		rule->entries.tqe_prev = NULL;
-#ifndef INET
-		if (rule->af == AF_INET) {
-#ifdef __FreeBSD__
-			pool_put(&V_pf_rule_pl, rule);
-#else
-			pool_put(&pf_rule_pl, rule);
-#endif
-			error = EAFNOSUPPORT;
-			break;
-		}
-#endif /* INET */
-#ifndef INET6
-		if (rule->af == AF_INET6) {
-#ifdef __FreeBSD__
-			pool_put(&V_pf_rule_pl, rule);
-#else
-			pool_put(&pf_rule_pl, rule);
-#endif
-			error = EAFNOSUPPORT;
-			break;
-		}
-#endif /* INET6 */
-		tail = TAILQ_LAST(ruleset->rules[rs_num].inactive.ptr,
-		    pf_rulequeue);
-		if (tail)
-			rule->nr = tail->nr + 1;
-		else
-			rule->nr = 0;
-		if (rule->ifname[0]) {
-			rule->kif = pfi_kif_get(rule->ifname);
-			if (rule->kif == NULL) {
-#ifdef __FreeBSD__
-				pool_put(&V_pf_rule_pl, rule);
-#else
-				pool_put(&pf_rule_pl, rule);
-#endif
-				error = EINVAL;
-				break;
-			}
-			pfi_kif_ref(rule->kif, PFI_KIF_REF_RULE);
-		}
-
-#ifdef __FreeBSD__ /* ROUTING */
-		if (rule->rtableid > 0 && rule->rtableid >= rt_numfibs)
-#else
-		if (rule->rtableid > 0 && !rtable_exists(rule->rtableid))
-#endif
-			error = EBUSY;
-
-#ifdef ALTQ
-		/* set queue IDs */
-		if (rule->qname[0] != 0) {
-			if ((rule->qid = pf_qname2qid(rule->qname)) == 0)
-				error = EBUSY;
-			else if (rule->pqname[0] != 0) {
-				if ((rule->pqid =
-				    pf_qname2qid(rule->pqname)) == 0)
-					error = EBUSY;
-			} else
-				rule->pqid = rule->qid;
-		}
-#endif
-		if (rule->tagname[0])
-			if ((rule->tag = pf_tagname2tag(rule->tagname)) == 0)
-				error = EBUSY;
-		if (rule->match_tagname[0])
-			if ((rule->match_tag =
-			    pf_tagname2tag(rule->match_tagname)) == 0)
-				error = EBUSY;
-		if (rule->rt && !rule->direction)
-			error = EINVAL;
-#if NPFLOG > 0
-		if (!rule->log)
-			rule->logif = 0;
-		if (rule->logif >= PFLOGIFS_MAX)
-			error = EINVAL;
-#endif
-		if (pf_rtlabel_add(&rule->src.addr) ||
-		    pf_rtlabel_add(&rule->dst.addr))
-			error = EBUSY;
-		if (pf_addr_setup(ruleset, &rule->src.addr, rule->af))
-			error = EINVAL;
-		if (pf_addr_setup(ruleset, &rule->dst.addr, rule->af))
-			error = EINVAL;
-		if (pf_anchor_setup(rule, ruleset, pr->anchor_call))
-			error = EINVAL;
-#ifdef __FreeBSD__
-		TAILQ_FOREACH(pa, &V_pf_pabuf, entries)
-#else
-		TAILQ_FOREACH(pa, &pf_pabuf, entries)
-#endif
-			if (pf_tbladdr_setup(ruleset, &pa->addr))
-				error = EINVAL;
-
-		if (rule->overload_tblname[0]) {
-			if ((rule->overload_tbl = pfr_attach_table(ruleset,
-			    rule->overload_tblname, 0)) == NULL)
-				error = EINVAL;
-			else
-				rule->overload_tbl->pfrkt_flags |=
-				    PFR_TFLAG_ACTIVE;
-		}
-
-#ifdef __FreeBSD__
-		pf_mv_pool(&V_pf_pabuf, &rule->rpool.list);
-#else
-		pf_mv_pool(&pf_pabuf, &rule->rpool.list);
-#endif
-		if (((((rule->action == PF_NAT) || (rule->action == PF_RDR) ||
-		    (rule->action == PF_BINAT)) && rule->anchor == NULL) ||
-		    (rule->rt > PF_FASTROUTE)) &&
-		    (TAILQ_FIRST(&rule->rpool.list) == NULL))
-			error = EINVAL;
-
-		if (error) {
-			pf_rm_rule(NULL, rule);
-			break;
-		}
-
-#ifdef __FreeBSD__
-		if (!V_debug_pfugidhack && (rule->uid.op || rule->gid.op ||
-		    rule->log & PF_LOG_SOCKET_LOOKUP)) {
-			DPFPRINTF(PF_DEBUG_MISC,
-			    ("pf: debug.pfugidhack enabled\n"));
-			V_debug_pfugidhack = 1;
-		}
-#endif
-		rule->rpool.cur = TAILQ_FIRST(&rule->rpool.list);
-		rule->evaluations = rule->packets[0] = rule->packets[1] =
-		    rule->bytes[0] = rule->bytes[1] = 0;
-		TAILQ_INSERT_TAIL(ruleset->rules[rs_num].inactive.ptr,
-		    rule, entries);
-		ruleset->rules[rs_num].inactive.rcount++;
-		break;
-	}
-
-	case DIOCGETRULES: {
-		struct pfioc_rule	*pr = (struct pfioc_rule *)addr;
-		struct pf_ruleset	*ruleset;
-		struct pf_rule		*tail;
-		int			 rs_num;
-
-		pr->anchor[sizeof(pr->anchor) - 1] = 0;
-		ruleset = pf_find_ruleset(pr->anchor);
-		if (ruleset == NULL) {
-			error = EINVAL;
-			break;
-		}
-		rs_num = pf_get_ruleset_number(pr->rule.action);
-		if (rs_num >= PF_RULESET_MAX) {
-			error = EINVAL;
-			break;
-		}
-		tail = TAILQ_LAST(ruleset->rules[rs_num].active.ptr,
-		    pf_rulequeue);
-		if (tail)
-			pr->nr = tail->nr + 1;
-		else
-			pr->nr = 0;
-		pr->ticket = ruleset->rules[rs_num].active.ticket;
-		break;
-	}
-
-	case DIOCGETRULE: {
-		struct pfioc_rule	*pr = (struct pfioc_rule *)addr;
-		struct pf_ruleset	*ruleset;
-		struct pf_rule		*rule;
-		int			 rs_num, i;
-
-		pr->anchor[sizeof(pr->anchor) - 1] = 0;
-		ruleset = pf_find_ruleset(pr->anchor);
-		if (ruleset == NULL) {
-			error = EINVAL;
-			break;
-		}
-		rs_num = pf_get_ruleset_number(pr->rule.action);
-		if (rs_num >= PF_RULESET_MAX) {
-			error = EINVAL;
-			break;
-		}
-		if (pr->ticket != ruleset->rules[rs_num].active.ticket) {
-			error = EBUSY;
-			break;
-		}
-		rule = TAILQ_FIRST(ruleset->rules[rs_num].active.ptr);
-		while ((rule != NULL) && (rule->nr != pr->nr))
-			rule = TAILQ_NEXT(rule, entries);
-		if (rule == NULL) {
-			error = EBUSY;
-			break;
-		}
-		bcopy(rule, &pr->rule, sizeof(struct pf_rule));
-		if (pf_anchor_copyout(ruleset, rule, pr)) {
-			error = EBUSY;
-			break;
-		}
-		pf_addr_copyout(&pr->rule.src.addr);
-		pf_addr_copyout(&pr->rule.dst.addr);
-		for (i = 0; i < PF_SKIP_COUNT; ++i)
-			if (rule->skip[i].ptr == NULL)
-				pr->rule.skip[i].nr = -1;
-			else
-				pr->rule.skip[i].nr =
-				    rule->skip[i].ptr->nr;
-
-		if (pr->action == PF_GET_CLR_CNTR) {
-			rule->evaluations = 0;
-			rule->packets[0] = rule->packets[1] = 0;
-			rule->bytes[0] = rule->bytes[1] = 0;
-			rule->states_tot = 0;
-		}
-		break;
-	}
-
-	case DIOCCHANGERULE: {
-		struct pfioc_rule	*pcr = (struct pfioc_rule *)addr;
-		struct pf_ruleset	*ruleset;
-		struct pf_rule		*oldrule = NULL, *newrule = NULL;
-		u_int32_t		 nr = 0;
-		int			 rs_num;
-
-		if (!(pcr->action == PF_CHANGE_REMOVE ||
-		    pcr->action == PF_CHANGE_GET_TICKET) &&
-#ifdef __FreeBSD__
-		    pcr->pool_ticket != V_ticket_pabuf) {
-#else
-		    pcr->pool_ticket != ticket_pabuf) {
-#endif
-			error = EBUSY;
-			break;
-		}
-
-		if (pcr->action < PF_CHANGE_ADD_HEAD ||
-		    pcr->action > PF_CHANGE_GET_TICKET) {
-			error = EINVAL;
-			break;
-		}
-		ruleset = pf_find_ruleset(pcr->anchor);
-		if (ruleset == NULL) {
-			error = EINVAL;
-			break;
-		}
-		rs_num = pf_get_ruleset_number(pcr->rule.action);
-		if (rs_num >= PF_RULESET_MAX) {
-			error = EINVAL;
-			break;
-		}
-
-		if (pcr->action == PF_CHANGE_GET_TICKET) {
-			pcr->ticket = ++ruleset->rules[rs_num].active.ticket;
-			break;
-		} else {
-			if (pcr->ticket !=
-			    ruleset->rules[rs_num].active.ticket) {
-				error = EINVAL;
-				break;
-			}
-			if (pcr->rule.return_icmp >> 8 > ICMP_MAXTYPE) {
-				error = EINVAL;
-				break;
-			}
-		}
-
-		if (pcr->action != PF_CHANGE_REMOVE) {
-#ifdef __FreeBSD__
-			newrule = pool_get(&V_pf_rule_pl, PR_NOWAIT);
-#else
-			newrule = pool_get(&pf_rule_pl, PR_WAITOK|PR_LIMITFAIL);
-#endif
-			if (newrule == NULL) {
-				error = ENOMEM;
-				break;
-			}
-			bcopy(&pcr->rule, newrule, sizeof(struct pf_rule));
-#ifdef __FreeBSD__
-			newrule->cuid = td->td_ucred->cr_ruid;
-			newrule->cpid = td->td_proc ? td->td_proc->p_pid : 0;
-#else
-			newrule->cuid = p->p_cred->p_ruid;
-			newrule->cpid = p->p_pid;
-#endif
-			TAILQ_INIT(&newrule->rpool.list);
-			/* initialize refcounting */
-			newrule->states_cur = 0;
-			newrule->entries.tqe_prev = NULL;
-#ifndef INET
-			if (newrule->af == AF_INET) {
-#ifdef __FreeBSD__
-				pool_put(&V_pf_rule_pl, newrule);
-#else
-				pool_put(&pf_rule_pl, newrule);
-#endif
-				error = EAFNOSUPPORT;
-				break;
-			}
-#endif /* INET */
-#ifndef INET6
-			if (newrule->af == AF_INET6) {
-#ifdef __FreeBSD__
-				pool_put(&V_pf_rule_pl, newrule);
-#else
-				pool_put(&pf_rule_pl, newrule);
-#endif
-				error = EAFNOSUPPORT;
-				break;
-			}
-#endif /* INET6 */
-			if (newrule->ifname[0]) {
-				newrule->kif = pfi_kif_get(newrule->ifname);
-				if (newrule->kif == NULL) {
-#ifdef __FreeBSD__
-					pool_put(&V_pf_rule_pl, newrule);
-#else
-					pool_put(&pf_rule_pl, newrule);
-#endif
-					error = EINVAL;
-					break;
-				}
-				pfi_kif_ref(newrule->kif, PFI_KIF_REF_RULE);
-			} else
-				newrule->kif = NULL;
-
-			if (newrule->rtableid > 0 &&
-#ifdef __FreeBSD__ /* ROUTING */
-			    newrule->rtableid >= rt_numfibs)
-#else
-			    !rtable_exists(newrule->rtableid))
-#endif
-				error = EBUSY;
-
-#ifdef ALTQ
-			/* set queue IDs */
-			if (newrule->qname[0] != 0) {
-				if ((newrule->qid =
-				    pf_qname2qid(newrule->qname)) == 0)
-					error = EBUSY;
-				else if (newrule->pqname[0] != 0) {
-					if ((newrule->pqid =
-					    pf_qname2qid(newrule->pqname)) == 0)
-						error = EBUSY;
-				} else
-					newrule->pqid = newrule->qid;
-			}
-#endif /* ALTQ */
-			if (newrule->tagname[0])
-				if ((newrule->tag =
-				    pf_tagname2tag(newrule->tagname)) == 0)
-					error = EBUSY;
-			if (newrule->match_tagname[0])
-				if ((newrule->match_tag = pf_tagname2tag(
-				    newrule->match_tagname)) == 0)
-					error = EBUSY;
-			if (newrule->rt && !newrule->direction)
-				error = EINVAL;
-#if NPFLOG > 0
-			if (!newrule->log)
-				newrule->logif = 0;
-			if (newrule->logif >= PFLOGIFS_MAX)
-				error = EINVAL;
-#endif
-			if (pf_rtlabel_add(&newrule->src.addr) ||
-			    pf_rtlabel_add(&newrule->dst.addr))
-				error = EBUSY;
-			if (pf_addr_setup(ruleset, &newrule->src.addr, newrule->af))
-				error = EINVAL;
-			if (pf_addr_setup(ruleset, &newrule->dst.addr, newrule->af))
-				error = EINVAL;
-			if (pf_anchor_setup(newrule, ruleset, pcr->anchor_call))
-				error = EINVAL;
-#ifdef __FreeBSD__
-			TAILQ_FOREACH(pa, &V_pf_pabuf, entries)
-#else
-			TAILQ_FOREACH(pa, &pf_pabuf, entries)
-#endif
-				if (pf_tbladdr_setup(ruleset, &pa->addr))
-					error = EINVAL;
-
-			if (newrule->overload_tblname[0]) {
-				if ((newrule->overload_tbl = pfr_attach_table(
-				    ruleset, newrule->overload_tblname, 0)) ==
-				    NULL)
-					error = EINVAL;
-				else
-					newrule->overload_tbl->pfrkt_flags |=
-					    PFR_TFLAG_ACTIVE;
-			}
-
-#ifdef __FreeBSD__
-			pf_mv_pool(&V_pf_pabuf, &newrule->rpool.list);
-#else
-			pf_mv_pool(&pf_pabuf, &newrule->rpool.list);
-#endif
-			if (((((newrule->action == PF_NAT) ||
-			    (newrule->action == PF_RDR) ||
-			    (newrule->action == PF_BINAT) ||
-			    (newrule->rt > PF_FASTROUTE)) &&
-			    !newrule->anchor)) &&
-			    (TAILQ_FIRST(&newrule->rpool.list) == NULL))
-				error = EINVAL;
-
-			if (error) {
-				pf_rm_rule(NULL, newrule);
-				break;
-			}
-
-#ifdef __FreeBSD__
-			if (!V_debug_pfugidhack && (newrule->uid.op ||
-			    newrule->gid.op ||
-			    newrule->log & PF_LOG_SOCKET_LOOKUP)) {
-				DPFPRINTF(PF_DEBUG_MISC,
-				    ("pf: debug.pfugidhack enabled\n"));
-				V_debug_pfugidhack = 1;
-			}
-#endif
-
-			newrule->rpool.cur = TAILQ_FIRST(&newrule->rpool.list);
-			newrule->evaluations = 0;
-			newrule->packets[0] = newrule->packets[1] = 0;
-			newrule->bytes[0] = newrule->bytes[1] = 0;
-		}
-#ifdef __FreeBSD__
-		pf_empty_pool(&V_pf_pabuf);
-#else
-		pf_empty_pool(&pf_pabuf);
-#endif
-
-		if (pcr->action == PF_CHANGE_ADD_HEAD)
-			oldrule = TAILQ_FIRST(
-			    ruleset->rules[rs_num].active.ptr);
-		else if (pcr->action == PF_CHANGE_ADD_TAIL)
-			oldrule = TAILQ_LAST(
-			    ruleset->rules[rs_num].active.ptr, pf_rulequeue);
-		else {
-			oldrule = TAILQ_FIRST(
-			    ruleset->rules[rs_num].active.ptr);
-			while ((oldrule != NULL) && (oldrule->nr != pcr->nr))
-				oldrule = TAILQ_NEXT(oldrule, entries);
-			if (oldrule == NULL) {
-				if (newrule != NULL)
-					pf_rm_rule(NULL, newrule);
-				error = EINVAL;
-				break;
-			}
-		}
-
-		if (pcr->action == PF_CHANGE_REMOVE) {
-			pf_rm_rule(ruleset->rules[rs_num].active.ptr, oldrule);
-			ruleset->rules[rs_num].active.rcount--;
-		} else {
-			if (oldrule == NULL)
-				TAILQ_INSERT_TAIL(
-				    ruleset->rules[rs_num].active.ptr,
-				    newrule, entries);
-			else if (pcr->action == PF_CHANGE_ADD_HEAD ||
-			    pcr->action == PF_CHANGE_ADD_BEFORE)
-				TAILQ_INSERT_BEFORE(oldrule, newrule, entries);
-			else
-				TAILQ_INSERT_AFTER(
-				    ruleset->rules[rs_num].active.ptr,
-				    oldrule, newrule, entries);
-			ruleset->rules[rs_num].active.rcount++;
-		}
-
-		nr = 0;
-		TAILQ_FOREACH(oldrule,
-		    ruleset->rules[rs_num].active.ptr, entries)
-			oldrule->nr = nr++;
-
-		ruleset->rules[rs_num].active.ticket++;
-
-		pf_calc_skip_steps(ruleset->rules[rs_num].active.ptr);
-		pf_remove_if_empty_ruleset(ruleset);
-
-		break;
-	}
-
-	case DIOCCLRSTATES: {
-		struct pf_state		*s, *nexts;
-		struct pfioc_state_kill *psk = (struct pfioc_state_kill *)addr;
-		u_int			 killed = 0;
-
-#ifdef __FreeBSD__
-		for (s = RB_MIN(pf_state_tree_id, &V_tree_id); s; s = nexts) {
-			nexts = RB_NEXT(pf_state_tree_id, &V_tree_id, s);
-#else
-		for (s = RB_MIN(pf_state_tree_id, &tree_id); s; s = nexts) {
-			nexts = RB_NEXT(pf_state_tree_id, &tree_id, s);
-#endif
-
-			if (!psk->psk_ifname[0] || !strcmp(psk->psk_ifname,
-			    s->kif->pfik_name)) {
-#if NPFSYNC > 0
-				/* don't send out individual delete messages */
-				SET(s->state_flags, PFSTATE_NOSYNC);
-#endif
-				pf_unlink_state(s);
-				killed++;
-			}
-		}
-		psk->psk_killed = killed;
-#if NPFSYNC > 0
-#ifdef __FreeBSD__
-		if (pfsync_clear_states_ptr != NULL)
-			pfsync_clear_states_ptr(V_pf_status.hostid, psk->psk_ifname);
-#else
-		pfsync_clear_states(pf_status.hostid, psk->psk_ifname);
-#endif
-#endif
-		break;
-	}
-
-	case DIOCKILLSTATES: {
-		struct pf_state		*s, *nexts;
-		struct pf_state_key	*sk;
-		struct pf_addr		*srcaddr, *dstaddr;
-		u_int16_t		 srcport, dstport;
-		struct pfioc_state_kill	*psk = (struct pfioc_state_kill *)addr;
-		u_int			 killed = 0;
-
-		if (psk->psk_pfcmp.id) {
-			if (psk->psk_pfcmp.creatorid == 0)
-#ifdef __FreeBSD__
-				psk->psk_pfcmp.creatorid = V_pf_status.hostid;
-#else
-				psk->psk_pfcmp.creatorid = pf_status.hostid;
-#endif
-			if ((s = pf_find_state_byid(&psk->psk_pfcmp))) {
-				pf_unlink_state(s);
-				psk->psk_killed = 1;
-			}
-			break;
-		}
-
-#ifdef __FreeBSD__
-		for (s = RB_MIN(pf_state_tree_id, &V_tree_id); s;
-		    s = nexts) {
-			nexts = RB_NEXT(pf_state_tree_id, &V_tree_id, s);
-#else
-		for (s = RB_MIN(pf_state_tree_id, &tree_id); s;
-		    s = nexts) {
-			nexts = RB_NEXT(pf_state_tree_id, &tree_id, s);
-#endif
-			sk = s->key[PF_SK_WIRE];
-
-			if (s->direction == PF_OUT) {
-				srcaddr = &sk->addr[1];
-				dstaddr = &sk->addr[0];
-				srcport = sk->port[0];
-				dstport = sk->port[0];
-			} else {
-				srcaddr = &sk->addr[0];
-				dstaddr = &sk->addr[1];
-				srcport = sk->port[0];
-				dstport = sk->port[0];
-			}
-			if ((!psk->psk_af || sk->af == psk->psk_af)
-			    && (!psk->psk_proto || psk->psk_proto ==
-			    sk->proto) &&
-			    PF_MATCHA(psk->psk_src.neg,
-			    &psk->psk_src.addr.v.a.addr,
-			    &psk->psk_src.addr.v.a.mask,
-			    srcaddr, sk->af) &&
-			    PF_MATCHA(psk->psk_dst.neg,
-			    &psk->psk_dst.addr.v.a.addr,
-			    &psk->psk_dst.addr.v.a.mask,
-			    dstaddr, sk->af) &&
-			    (psk->psk_src.port_op == 0 ||
-			    pf_match_port(psk->psk_src.port_op,
-			    psk->psk_src.port[0], psk->psk_src.port[1],
-			    srcport)) &&
-			    (psk->psk_dst.port_op == 0 ||
-			    pf_match_port(psk->psk_dst.port_op,
-			    psk->psk_dst.port[0], psk->psk_dst.port[1],
-			    dstport)) &&
-			    (!psk->psk_label[0] || (s->rule.ptr->label[0] &&
-			    !strcmp(psk->psk_label, s->rule.ptr->label))) &&
-			    (!psk->psk_ifname[0] || !strcmp(psk->psk_ifname,
-			    s->kif->pfik_name))) {
-				pf_unlink_state(s);
-				killed++;
-			}
-		}
-		psk->psk_killed = killed;
-		break;
-	}
-
-	case DIOCADDSTATE: {
-		struct pfioc_state	*ps = (struct pfioc_state *)addr;
-		struct pfsync_state	*sp = &ps->state;
-
-		if (sp->timeout >= PFTM_MAX &&
-		    sp->timeout != PFTM_UNTIL_PACKET) {
-			error = EINVAL;
-			break;
-		}
-#ifdef __FreeBSD__
-		if (pfsync_state_import_ptr != NULL)
-			error = pfsync_state_import_ptr(sp, PFSYNC_SI_IOCTL);
-#else
-		error = pfsync_state_import(sp, PFSYNC_SI_IOCTL);
-#endif
-		break;
-	}
-
-	case DIOCGETSTATE: {
-		struct pfioc_state	*ps = (struct pfioc_state *)addr;
-		struct pf_state		*s;
-		struct pf_state_cmp	 id_key;
-
-		bcopy(ps->state.id, &id_key.id, sizeof(id_key.id));
-		id_key.creatorid = ps->state.creatorid;
-
-		s = pf_find_state_byid(&id_key);
-		if (s == NULL) {
-			error = ENOENT;
-			break;
-		}
-
-		pfsync_state_export(&ps->state, s);
-		break;
-	}
-
-	case DIOCGETSTATES: {
-		struct pfioc_states	*ps = (struct pfioc_states *)addr;
-		struct pf_state		*state;
-		struct pfsync_state	*p, *pstore;
-		u_int32_t		 nr = 0;
-
-		if (ps->ps_len == 0) {
-#ifdef __FreeBSD__
-			nr = V_pf_status.states;
-#else
-			nr = pf_status.states;
-#endif
-			ps->ps_len = sizeof(struct pfsync_state) * nr;
-			break;
-		}
-
-#ifdef __FreeBSD__
-		PF_UNLOCK();
-#endif
-		pstore = malloc(sizeof(*pstore), M_TEMP, M_WAITOK);
-#ifdef __FreeBSD__
-		PF_LOCK();
-#endif
-
-		p = ps->ps_states;
-
-#ifdef __FreeBSD__
-		state = TAILQ_FIRST(&V_state_list);
-#else
-		state = TAILQ_FIRST(&state_list);
-#endif
-		while (state) {
-			if (state->timeout != PFTM_UNLINKED) {
-				if ((nr+1) * sizeof(*p) > (unsigned)ps->ps_len)
-					break;
-				pfsync_state_export(pstore, state);
-#ifdef __FreeBSD__
-				PF_COPYOUT(pstore, p, sizeof(*p), error);
-#else
-				error = copyout(pstore, p, sizeof(*p));
-#endif
-				if (error) {
-					free(pstore, M_TEMP);
-					goto fail;
-				}
-				p++;
-				nr++;
-			}
-			state = TAILQ_NEXT(state, entry_list);
-		}
-
-		ps->ps_len = sizeof(struct pfsync_state) * nr;
-
-		free(pstore, M_TEMP);
-		break;
-	}
-
-	case DIOCGETSTATUS: {
-		struct pf_status *s = (struct pf_status *)addr;
-#ifdef __FreeBSD__
-		bcopy(&V_pf_status, s, sizeof(struct pf_status));
-#else
-		bcopy(&pf_status, s, sizeof(struct pf_status));
-#endif
-		pfi_update_status(s->ifname, s);
-		break;
-	}
-
-	case DIOCSETSTATUSIF: {
-		struct pfioc_if	*pi = (struct pfioc_if *)addr;
-
-		if (pi->ifname[0] == 0) {
-#ifdef __FreeBSD__
-			bzero(V_pf_status.ifname, IFNAMSIZ);
-#else
-			bzero(pf_status.ifname, IFNAMSIZ);
-#endif
-			break;
-		}
-#ifdef __FreeBSD__
-		strlcpy(V_pf_status.ifname, pi->ifname, IFNAMSIZ);
-#else
-		strlcpy(pf_status.ifname, pi->ifname, IFNAMSIZ);
-#endif
-		break;
-	}
-
-	case DIOCCLRSTATUS: {
-#ifdef __FreeBSD__
-		bzero(V_pf_status.counters, sizeof(V_pf_status.counters));
-		bzero(V_pf_status.fcounters, sizeof(V_pf_status.fcounters));
-		bzero(V_pf_status.scounters, sizeof(V_pf_status.scounters));
-		V_pf_status.since = time_second;
-		if (*V_pf_status.ifname)
-			pfi_update_status(V_pf_status.ifname, NULL);
-#else
-		bzero(pf_status.counters, sizeof(pf_status.counters));
-		bzero(pf_status.fcounters, sizeof(pf_status.fcounters));
-		bzero(pf_status.scounters, sizeof(pf_status.scounters));
-		pf_status.since = time_second;
-		if (*pf_status.ifname)
-			pfi_update_status(pf_status.ifname, NULL);
-#endif
-		break;
-	}
-
-	case DIOCNATLOOK: {
-		struct pfioc_natlook	*pnl = (struct pfioc_natlook *)addr;
-		struct pf_state_key	*sk;
-		struct pf_state		*state;
-		struct pf_state_key_cmp	 key;
-		int			 m = 0, direction = pnl->direction;
-		int			 sidx, didx;
-
-		/* NATLOOK src and dst are reversed, so reverse sidx/didx */
-		sidx = (direction == PF_IN) ? 1 : 0;
-		didx = (direction == PF_IN) ? 0 : 1;
-
-		if (!pnl->proto ||
-		    PF_AZERO(&pnl->saddr, pnl->af) ||
-		    PF_AZERO(&pnl->daddr, pnl->af) ||
-		    ((pnl->proto == IPPROTO_TCP ||
-		    pnl->proto == IPPROTO_UDP) &&
-		    (!pnl->dport || !pnl->sport)))
-			error = EINVAL;
-		else {
-			key.af = pnl->af;
-			key.proto = pnl->proto;
-			PF_ACPY(&key.addr[sidx], &pnl->saddr, pnl->af);
-			key.port[sidx] = pnl->sport;
-			PF_ACPY(&key.addr[didx], &pnl->daddr, pnl->af);
-			key.port[didx] = pnl->dport;
-
-			state = pf_find_state_all(&key, direction, &m);
-
-			if (m > 1)
-				error = E2BIG;	/* more than one state */
-			else if (state != NULL) {
-				sk = state->key[sidx];
-				PF_ACPY(&pnl->rsaddr, &sk->addr[sidx], sk->af);
-				pnl->rsport = sk->port[sidx];
-				PF_ACPY(&pnl->rdaddr, &sk->addr[didx], sk->af);
-				pnl->rdport = sk->port[didx];
-			} else
-				error = ENOENT;
-		}
-		break;
-	}
-
-	case DIOCSETTIMEOUT: {
-		struct pfioc_tm	*pt = (struct pfioc_tm *)addr;
-		int		 old;
-
-		if (pt->timeout < 0 || pt->timeout >= PFTM_MAX ||
-		    pt->seconds < 0) {
-			error = EINVAL;
-			goto fail;
-		}
-#ifdef __FreeBSD__
-		old = V_pf_default_rule.timeout[pt->timeout];
-#else
-		old = pf_default_rule.timeout[pt->timeout];
-#endif
-		if (pt->timeout == PFTM_INTERVAL && pt->seconds == 0)
-			pt->seconds = 1;
-#ifdef __FreeBSD__
-		V_pf_default_rule.timeout[pt->timeout] = pt->seconds;
-#else
-		pf_default_rule.timeout[pt->timeout] = pt->seconds;
-#endif
-		if (pt->timeout == PFTM_INTERVAL && pt->seconds < old)
-			wakeup(pf_purge_thread);
-		pt->seconds = old;
-		break;
-	}
-
-	case DIOCGETTIMEOUT: {
-		struct pfioc_tm	*pt = (struct pfioc_tm *)addr;
-
-		if (pt->timeout < 0 || pt->timeout >= PFTM_MAX) {
-			error = EINVAL;
-			goto fail;
-		}
-#ifdef __FreeBSD__
-		pt->seconds = V_pf_default_rule.timeout[pt->timeout];
-#else
-		pt->seconds = pf_default_rule.timeout[pt->timeout];
-#endif
-		break;
-	}
-
-	case DIOCGETLIMIT: {
-		struct pfioc_limit	*pl = (struct pfioc_limit *)addr;
-
-		if (pl->index < 0 || pl->index >= PF_LIMIT_MAX) {
-			error = EINVAL;
-			goto fail;
-		}
-#ifdef __FreeBSD__
-		pl->limit = V_pf_pool_limits[pl->index].limit;
-#else
-		pl->limit = pf_pool_limits[pl->index].limit;
-#endif
-		break;
-	}
-
-	case DIOCSETLIMIT: {
-		struct pfioc_limit	*pl = (struct pfioc_limit *)addr;
-		int			 old_limit;
-
-		if (pl->index < 0 || pl->index >= PF_LIMIT_MAX ||
-#ifdef __FreeBSD__
-		    V_pf_pool_limits[pl->index].pp == NULL) {
-#else
-		    pf_pool_limits[pl->index].pp == NULL) {
-#endif
-			error = EINVAL;
-			goto fail;
-		}
-#ifdef __FreeBSD__
-		uma_zone_set_max(V_pf_pool_limits[pl->index].pp, pl->limit);
-		old_limit = V_pf_pool_limits[pl->index].limit;
-		V_pf_pool_limits[pl->index].limit = pl->limit;
-		pl->limit = old_limit;
-#else
-		if (pool_sethardlimit(pf_pool_limits[pl->index].pp,
-		    pl->limit, NULL, 0) != 0) {
-			error = EBUSY;
-			goto fail;
-		}
-		old_limit = pf_pool_limits[pl->index].limit;
-		pf_pool_limits[pl->index].limit = pl->limit;
-		pl->limit = old_limit;
-#endif
-		break;
-	}
-
-	case DIOCSETDEBUG: {
-		u_int32_t	*level = (u_int32_t *)addr;
-
-#ifdef __FreeBSD__
-		V_pf_status.debug = *level;
-#else
-		pf_status.debug = *level;
-#endif
-		break;
-	}
-
-	case DIOCCLRRULECTRS: {
-		/* obsoleted by DIOCGETRULE with action=PF_GET_CLR_CNTR */
-		struct pf_ruleset	*ruleset = &pf_main_ruleset;
-		struct pf_rule		*rule;
-
-		TAILQ_FOREACH(rule,
-		    ruleset->rules[PF_RULESET_FILTER].active.ptr, entries) {
-			rule->evaluations = 0;
-			rule->packets[0] = rule->packets[1] = 0;
-			rule->bytes[0] = rule->bytes[1] = 0;
-		}
-		break;
-	}
-
-#ifdef __FreeBSD__
-	case DIOCGIFSPEED: {
-		struct pf_ifspeed	*psp = (struct pf_ifspeed *)addr;
-		struct pf_ifspeed	ps;
-		struct ifnet		*ifp;
-
-		if (psp->ifname[0] != 0) {
-			/* Can we completely trust user-land? */
-			strlcpy(ps.ifname, psp->ifname, IFNAMSIZ);
-			ifp = ifunit(ps.ifname);
-			if (ifp != NULL)
-				psp->baudrate = ifp->if_baudrate;
-			else
-				error = EINVAL;
-		} else
-			error = EINVAL;
-		break;
-	}
-#endif /* __FreeBSD__ */
-
-#ifdef ALTQ
-	case DIOCSTARTALTQ: {
-		struct pf_altq		*altq;
-
-		/* enable all altq interfaces on active list */
-#ifdef __FreeBSD__
-		TAILQ_FOREACH(altq, V_pf_altqs_active, entries) {
-			if (altq->qname[0] == 0 && (altq->local_flags &
-			    PFALTQ_FLAG_IF_REMOVED) == 0) {
-#else
-		TAILQ_FOREACH(altq, pf_altqs_active, entries) {
-			if (altq->qname[0] == 0) {
-#endif
-				error = pf_enable_altq(altq);
-				if (error != 0)
-					break;
-			}
-		}
-		if (error == 0)
-#ifdef __FreeBSD__
-			V_pf_altq_running = 1;
-#else
-			pf_altq_running = 1;
-#endif
-		DPFPRINTF(PF_DEBUG_MISC, ("altq: started\n"));
-		break;
-	}
-
-	case DIOCSTOPALTQ: {
-		struct pf_altq		*altq;
-
-		/* disable all altq interfaces on active list */
-#ifdef __FreeBSD__
-		TAILQ_FOREACH(altq, V_pf_altqs_active, entries) {
-			if (altq->qname[0] == 0 && (altq->local_flags &
-			    PFALTQ_FLAG_IF_REMOVED) == 0) {
-#else
-		TAILQ_FOREACH(altq, pf_altqs_active, entries) {
-			if (altq->qname[0] == 0) {
-#endif
-				error = pf_disable_altq(altq);
-				if (error != 0)
-					break;
-			}
-		}
-		if (error == 0)
-#ifdef __FreeBSD__
-			V_pf_altq_running = 0;
-#else
-			pf_altq_running = 0;
-#endif
-		DPFPRINTF(PF_DEBUG_MISC, ("altq: stopped\n"));
-		break;
-	}
-
-	case DIOCADDALTQ: {
-		struct pfioc_altq	*pa = (struct pfioc_altq *)addr;
-		struct pf_altq		*altq, *a;
-
-#ifdef __FreeBSD__
-		if (pa->ticket != V_ticket_altqs_inactive) {
-#else
-		if (pa->ticket != ticket_altqs_inactive) {
-#endif
-			error = EBUSY;
-			break;
-		}
-#ifdef __FreeBSD__
-		altq = pool_get(&V_pf_altq_pl, PR_NOWAIT);
-#else
-		altq = pool_get(&pf_altq_pl, PR_WAITOK|PR_LIMITFAIL);
-#endif
-		if (altq == NULL) {
-			error = ENOMEM;
-			break;
-		}
-		bcopy(&pa->altq, altq, sizeof(struct pf_altq));
-#ifdef __FreeBSD__
-		altq->local_flags = 0;
-#endif
-
-		/*
-		 * if this is for a queue, find the discipline and
-		 * copy the necessary fields
-		 */
-		if (altq->qname[0] != 0) {
-			if ((altq->qid = pf_qname2qid(altq->qname)) == 0) {
-				error = EBUSY;
-#ifdef __FreeBSD__
-				pool_put(&V_pf_altq_pl, altq);
-#else
-				pool_put(&pf_altq_pl, altq);
-#endif
-				break;
-			}
-			altq->altq_disc = NULL;
-#ifdef __FreeBSD__
-			TAILQ_FOREACH(a, V_pf_altqs_inactive, entries) {
-#else
-			TAILQ_FOREACH(a, pf_altqs_inactive, entries) {
-#endif
-				if (strncmp(a->ifname, altq->ifname,
-				    IFNAMSIZ) == 0 && a->qname[0] == 0) {
-					altq->altq_disc = a->altq_disc;
-					break;
-				}
-			}
-		}
-
-#ifdef __FreeBSD__
-		struct ifnet *ifp;
-
-		if ((ifp = ifunit(altq->ifname)) == NULL) {
-			altq->local_flags |= PFALTQ_FLAG_IF_REMOVED;
-		} else {
-			PF_UNLOCK();
-#endif
-		error = altq_add(altq);
-#ifdef __FreeBSD__
-			PF_LOCK();
-		}
-#endif
-		if (error) {
-#ifdef __FreeBSD__
-			pool_put(&V_pf_altq_pl, altq);
-#else
-			pool_put(&pf_altq_pl, altq);
-#endif
-			break;
-		}
-
-#ifdef __FreeBSD__
-		TAILQ_INSERT_TAIL(V_pf_altqs_inactive, altq, entries);
-#else
-		TAILQ_INSERT_TAIL(pf_altqs_inactive, altq, entries);
-#endif
-		bcopy(altq, &pa->altq, sizeof(struct pf_altq));
-		break;
-	}
-
-	case DIOCGETALTQS: {
-		struct pfioc_altq	*pa = (struct pfioc_altq *)addr;
-		struct pf_altq		*altq;
-
-		pa->nr = 0;
-#ifdef __FreeBSD__
-		TAILQ_FOREACH(altq, V_pf_altqs_active, entries)
-			pa->nr++;
-		pa->ticket = V_ticket_altqs_active;
-#else
-		TAILQ_FOREACH(altq, pf_altqs_active, entries)
-			pa->nr++;
-		pa->ticket = ticket_altqs_active;
-#endif
-		break;
-	}
-
-	case DIOCGETALTQ: {
-		struct pfioc_altq	*pa = (struct pfioc_altq *)addr;
-		struct pf_altq		*altq;
-		u_int32_t		 nr;
-
-#ifdef __FreeBSD__
-		if (pa->ticket != V_ticket_altqs_active) {
-#else
-		if (pa->ticket != ticket_altqs_active) {
-#endif
-			error = EBUSY;
-			break;
-		}
-		nr = 0;
-#ifdef __FreeBSD__
-		altq = TAILQ_FIRST(V_pf_altqs_active);
-#else
-		altq = TAILQ_FIRST(pf_altqs_active);
-#endif
-		while ((altq != NULL) && (nr < pa->nr)) {
-			altq = TAILQ_NEXT(altq, entries);
-			nr++;
-		}
-		if (altq == NULL) {
-			error = EBUSY;
-			break;
-		}
-		bcopy(altq, &pa->altq, sizeof(struct pf_altq));
-		break;
-	}
-
-	case DIOCCHANGEALTQ:
-		/* CHANGEALTQ not supported yet! */
-		error = ENODEV;
-		break;
-
-	case DIOCGETQSTATS: {
-		struct pfioc_qstats	*pq = (struct pfioc_qstats *)addr;
-		struct pf_altq		*altq;
-		u_int32_t		 nr;
-		int			 nbytes;
-
-#ifdef __FreeBSD__
-		if (pq->ticket != V_ticket_altqs_active) {
-#else
-		if (pq->ticket != ticket_altqs_active) {
-#endif
-			error = EBUSY;
-			break;
-		}
-		nbytes = pq->nbytes;
-		nr = 0;
-#ifdef __FreeBSD__
-		altq = TAILQ_FIRST(V_pf_altqs_active);
-#else
-		altq = TAILQ_FIRST(pf_altqs_active);
-#endif
-		while ((altq != NULL) && (nr < pq->nr)) {
-			altq = TAILQ_NEXT(altq, entries);
-			nr++;
-		}
-		if (altq == NULL) {
-			error = EBUSY;
-			break;
-		}
-
-#ifdef __FreeBSD__
-		if ((altq->local_flags & PFALTQ_FLAG_IF_REMOVED) != 0) {
-			error = ENXIO;
-			break;
-		}
-		PF_UNLOCK();
-#endif
-		error = altq_getqstats(altq, pq->buf, &nbytes);
-#ifdef __FreeBSD__
-		PF_LOCK();
-#endif
-		if (error == 0) {
-			pq->scheduler = altq->scheduler;
-			pq->nbytes = nbytes;
-		}
-		break;
-	}
-#endif /* ALTQ */
-
-	case DIOCBEGINADDRS: {
-		struct pfioc_pooladdr	*pp = (struct pfioc_pooladdr *)addr;
-
-#ifdef __FreeBSD__
-		pf_empty_pool(&V_pf_pabuf);
-		pp->ticket = ++V_ticket_pabuf;
-#else
-		pf_empty_pool(&pf_pabuf);
-		pp->ticket = ++ticket_pabuf;
-#endif
-		break;
-	}
-
-	case DIOCADDADDR: {
-		struct pfioc_pooladdr	*pp = (struct pfioc_pooladdr *)addr;
-
-#ifdef __FreeBSD__
-		if (pp->ticket != V_ticket_pabuf) {
-#else
-		if (pp->ticket != ticket_pabuf) {
-#endif
-			error = EBUSY;
-			break;
-		}
-#ifndef INET
-		if (pp->af == AF_INET) {
-			error = EAFNOSUPPORT;
-			break;
-		}
-#endif /* INET */
-#ifndef INET6
-		if (pp->af == AF_INET6) {
-			error = EAFNOSUPPORT;
-			break;
-		}
-#endif /* INET6 */
-		if (pp->addr.addr.type != PF_ADDR_ADDRMASK &&
-		    pp->addr.addr.type != PF_ADDR_DYNIFTL &&
-		    pp->addr.addr.type != PF_ADDR_TABLE) {
-			error = EINVAL;
-			break;
-		}
-#ifdef __FreeBSD__
-		pa = pool_get(&V_pf_pooladdr_pl, PR_NOWAIT);
-#else
-		pa = pool_get(&pf_pooladdr_pl, PR_WAITOK|PR_LIMITFAIL);
-#endif
-		if (pa == NULL) {
-			error = ENOMEM;
-			break;
-		}
-		bcopy(&pp->addr, pa, sizeof(struct pf_pooladdr));
-		if (pa->ifname[0]) {
-			pa->kif = pfi_kif_get(pa->ifname);
-			if (pa->kif == NULL) {
-#ifdef __FreeBSD__
-				pool_put(&V_pf_pooladdr_pl, pa);
-#else
-				pool_put(&pf_pooladdr_pl, pa);
-#endif
-				error = EINVAL;
-				break;
-			}
-			pfi_kif_ref(pa->kif, PFI_KIF_REF_RULE);
-		}
-		if (pfi_dynaddr_setup(&pa->addr, pp->af)) {
-			pfi_dynaddr_remove(&pa->addr);
-			pfi_kif_unref(pa->kif, PFI_KIF_REF_RULE);
-#ifdef __FreeBSD__
-			pool_put(&V_pf_pooladdr_pl, pa);
-#else
-			pool_put(&pf_pooladdr_pl, pa);
-#endif
-			error = EINVAL;
-			break;
-		}
-#ifdef __FreeBSD__
-		TAILQ_INSERT_TAIL(&V_pf_pabuf, pa, entries);
-#else
-		TAILQ_INSERT_TAIL(&pf_pabuf, pa, entries);
-#endif
-		break;
-	}
-
-	case DIOCGETADDRS: {
-		struct pfioc_pooladdr	*pp = (struct pfioc_pooladdr *)addr;
-
-		pp->nr = 0;
-		pool = pf_get_pool(pp->anchor, pp->ticket, pp->r_action,
-		    pp->r_num, 0, 1, 0);
-		if (pool == NULL) {
-			error = EBUSY;
-			break;
-		}
-		TAILQ_FOREACH(pa, &pool->list, entries)
-			pp->nr++;
-		break;
-	}
-
-	case DIOCGETADDR: {
-		struct pfioc_pooladdr	*pp = (struct pfioc_pooladdr *)addr;
-		u_int32_t		 nr = 0;
-
-		pool = pf_get_pool(pp->anchor, pp->ticket, pp->r_action,
-		    pp->r_num, 0, 1, 1);
-		if (pool == NULL) {
-			error = EBUSY;
-			break;
-		}
-		pa = TAILQ_FIRST(&pool->list);
-		while ((pa != NULL) && (nr < pp->nr)) {
-			pa = TAILQ_NEXT(pa, entries);
-			nr++;
-		}
-		if (pa == NULL) {
-			error = EBUSY;
-			break;
-		}
-		bcopy(pa, &pp->addr, sizeof(struct pf_pooladdr));
-		pf_addr_copyout(&pp->addr.addr);
-		break;
-	}
-
-	case DIOCCHANGEADDR: {
-		struct pfioc_pooladdr	*pca = (struct pfioc_pooladdr *)addr;
-		struct pf_pooladdr	*oldpa = NULL, *newpa = NULL;
-		struct pf_ruleset	*ruleset;
-
-		if (pca->action < PF_CHANGE_ADD_HEAD ||
-		    pca->action > PF_CHANGE_REMOVE) {
-			error = EINVAL;
-			break;
-		}
-		if (pca->addr.addr.type != PF_ADDR_ADDRMASK &&
-		    pca->addr.addr.type != PF_ADDR_DYNIFTL &&
-		    pca->addr.addr.type != PF_ADDR_TABLE) {
-			error = EINVAL;
-			break;
-		}
-
-		ruleset = pf_find_ruleset(pca->anchor);
-		if (ruleset == NULL) {
-			error = EBUSY;
-			break;
-		}
-		pool = pf_get_pool(pca->anchor, pca->ticket, pca->r_action,
-		    pca->r_num, pca->r_last, 1, 1);
-		if (pool == NULL) {
-			error = EBUSY;
-			break;
-		}
-		if (pca->action != PF_CHANGE_REMOVE) {
-#ifdef __FreeBSD__
-			newpa = pool_get(&V_pf_pooladdr_pl,
-			    PR_NOWAIT);
-#else
-			newpa = pool_get(&pf_pooladdr_pl,
-			    PR_WAITOK|PR_LIMITFAIL);
-#endif
-			if (newpa == NULL) {
-				error = ENOMEM;
-				break;
-			}
-			bcopy(&pca->addr, newpa, sizeof(struct pf_pooladdr));
-#ifndef INET
-			if (pca->af == AF_INET) {
-#ifdef __FreeBSD__
-				pool_put(&V_pf_pooladdr_pl, newpa);
-#else
-				pool_put(&pf_pooladdr_pl, newpa);
-#endif
-				error = EAFNOSUPPORT;
-				break;
-			}
-#endif /* INET */
-#ifndef INET6
-			if (pca->af == AF_INET6) {
-#ifdef __FreeBSD__
-				pool_put(&V_pf_pooladdr_pl, newpa);
-#else
-				pool_put(&pf_pooladdr_pl, newpa);
-#endif
-				error = EAFNOSUPPORT;
-				break;
-			}
-#endif /* INET6 */
-			if (newpa->ifname[0]) {
-				newpa->kif = pfi_kif_get(newpa->ifname);
-				if (newpa->kif == NULL) {
-#ifdef __FreeBSD__
-					pool_put(&V_pf_pooladdr_pl, newpa);
-#else
-					pool_put(&pf_pooladdr_pl, newpa);
-#endif
-					error = EINVAL;
-					break;
-				}
-				pfi_kif_ref(newpa->kif, PFI_KIF_REF_RULE);
-			} else
-				newpa->kif = NULL;
-			if (pfi_dynaddr_setup(&newpa->addr, pca->af) ||
-			    pf_tbladdr_setup(ruleset, &newpa->addr)) {
-				pfi_dynaddr_remove(&newpa->addr);
-				pfi_kif_unref(newpa->kif, PFI_KIF_REF_RULE);
-#ifdef __FreeBSD__
-				pool_put(&V_pf_pooladdr_pl, newpa);
-#else
-				pool_put(&pf_pooladdr_pl, newpa);
-#endif
-				error = EINVAL;
-				break;
-			}
-		}
-
-		if (pca->action == PF_CHANGE_ADD_HEAD)
-			oldpa = TAILQ_FIRST(&pool->list);
-		else if (pca->action == PF_CHANGE_ADD_TAIL)
-			oldpa = TAILQ_LAST(&pool->list, pf_palist);
-		else {
-			int	i = 0;
-
-			oldpa = TAILQ_FIRST(&pool->list);
-			while ((oldpa != NULL) && (i < pca->nr)) {
-				oldpa = TAILQ_NEXT(oldpa, entries);
-				i++;
-			}
-			if (oldpa == NULL) {
-				error = EINVAL;
-				break;
-			}
-		}
-
-		if (pca->action == PF_CHANGE_REMOVE) {
-			TAILQ_REMOVE(&pool->list, oldpa, entries);
-			pfi_dynaddr_remove(&oldpa->addr);
-			pf_tbladdr_remove(&oldpa->addr);
-			pfi_kif_unref(oldpa->kif, PFI_KIF_REF_RULE);
-#ifdef __FreeBSD__
-			pool_put(&V_pf_pooladdr_pl, oldpa);
-#else
-			pool_put(&pf_pooladdr_pl, oldpa);
-#endif
-		} else {
-			if (oldpa == NULL)
-				TAILQ_INSERT_TAIL(&pool->list, newpa, entries);
-			else if (pca->action == PF_CHANGE_ADD_HEAD ||
-			    pca->action == PF_CHANGE_ADD_BEFORE)
-				TAILQ_INSERT_BEFORE(oldpa, newpa, entries);
-			else
-				TAILQ_INSERT_AFTER(&pool->list, oldpa,
-				    newpa, entries);
-		}
-
-		pool->cur = TAILQ_FIRST(&pool->list);
-		PF_ACPY(&pool->counter, &pool->cur->addr.v.a.addr,
-		    pca->af);
-		break;
-	}
-
-	case DIOCGETRULESETS: {
-		struct pfioc_ruleset	*pr = (struct pfioc_ruleset *)addr;
-		struct pf_ruleset	*ruleset;
-		struct pf_anchor	*anchor;
-
-		pr->path[sizeof(pr->path) - 1] = 0;
-		if ((ruleset = pf_find_ruleset(pr->path)) == NULL) {
-			error = EINVAL;
-			break;
-		}
-		pr->nr = 0;
-		if (ruleset->anchor == NULL) {
-			/* XXX kludge for pf_main_ruleset */
-#ifdef __FreeBSD__
-			RB_FOREACH(anchor, pf_anchor_global, &V_pf_anchors)
-#else
-			RB_FOREACH(anchor, pf_anchor_global, &pf_anchors)
-#endif
-				if (anchor->parent == NULL)
-					pr->nr++;
-		} else {
-			RB_FOREACH(anchor, pf_anchor_node,
-			    &ruleset->anchor->children)
-				pr->nr++;
-		}
-		break;
-	}
-
-	case DIOCGETRULESET: {
-		struct pfioc_ruleset	*pr = (struct pfioc_ruleset *)addr;
-		struct pf_ruleset	*ruleset;
-		struct pf_anchor	*anchor;
-		u_int32_t		 nr = 0;
-
-		pr->path[sizeof(pr->path) - 1] = 0;
-		if ((ruleset = pf_find_ruleset(pr->path)) == NULL) {
-			error = EINVAL;
-			break;
-		}
-		pr->name[0] = 0;
-		if (ruleset->anchor == NULL) {
-			/* XXX kludge for pf_main_ruleset */
-#ifdef __FreeBSD__
-			RB_FOREACH(anchor, pf_anchor_global, &V_pf_anchors)
-#else
-			RB_FOREACH(anchor, pf_anchor_global, &pf_anchors)
-#endif
-				if (anchor->parent == NULL && nr++ == pr->nr) {
-					strlcpy(pr->name, anchor->name,
-					    sizeof(pr->name));
-					break;
-				}
-		} else {
-			RB_FOREACH(anchor, pf_anchor_node,
-			    &ruleset->anchor->children)
-				if (nr++ == pr->nr) {
-					strlcpy(pr->name, anchor->name,
-					    sizeof(pr->name));
-					break;
-				}
-		}
-		if (!pr->name[0])
-			error = EBUSY;
-		break;
-	}
-
-	case DIOCRCLRTABLES: {
-		struct pfioc_table *io = (struct pfioc_table *)addr;
-
-		if (io->pfrio_esize != 0) {
-			error = ENODEV;
-			break;
-		}
-		error = pfr_clr_tables(&io->pfrio_table, &io->pfrio_ndel,
-		    io->pfrio_flags | PFR_FLAG_USERIOCTL);
-		break;
-	}
-
-	case DIOCRADDTABLES: {
-		struct pfioc_table *io = (struct pfioc_table *)addr;
-
-		if (io->pfrio_esize != sizeof(struct pfr_table)) {
-			error = ENODEV;
-			break;
-		}
-		error = pfr_add_tables(io->pfrio_buffer, io->pfrio_size,
-		    &io->pfrio_nadd, io->pfrio_flags | PFR_FLAG_USERIOCTL);
-		break;
-	}
-
-	case DIOCRDELTABLES: {
-		struct pfioc_table *io = (struct pfioc_table *)addr;
-
-		if (io->pfrio_esize != sizeof(struct pfr_table)) {
-			error = ENODEV;
-			break;
-		}
-		error = pfr_del_tables(io->pfrio_buffer, io->pfrio_size,
-		    &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL);
-		break;
-	}
-
-	case DIOCRGETTABLES: {
-		struct pfioc_table *io = (struct pfioc_table *)addr;
-
-		if (io->pfrio_esize != sizeof(struct pfr_table)) {
-			error = ENODEV;
-			break;
-		}
-		error = pfr_get_tables(&io->pfrio_table, io->pfrio_buffer,
-		    &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL);
-		break;
-	}
-
-	case DIOCRGETTSTATS: {
-		struct pfioc_table *io = (struct pfioc_table *)addr;
-
-		if (io->pfrio_esize != sizeof(struct pfr_tstats)) {
-			error = ENODEV;
-			break;
-		}
-		error = pfr_get_tstats(&io->pfrio_table, io->pfrio_buffer,
-		    &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL);
-		break;
-	}
-
-	case DIOCRCLRTSTATS: {
-		struct pfioc_table *io = (struct pfioc_table *)addr;
-
-		if (io->pfrio_esize != sizeof(struct pfr_table)) {
-			error = ENODEV;
-			break;
-		}
-		error = pfr_clr_tstats(io->pfrio_buffer, io->pfrio_size,
-		    &io->pfrio_nzero, io->pfrio_flags | PFR_FLAG_USERIOCTL);
-		break;
-	}
-
-	case DIOCRSETTFLAGS: {
-		struct pfioc_table *io = (struct pfioc_table *)addr;
-
-		if (io->pfrio_esize != sizeof(struct pfr_table)) {
-			error = ENODEV;
-			break;
-		}
-		error = pfr_set_tflags(io->pfrio_buffer, io->pfrio_size,
-		    io->pfrio_setflag, io->pfrio_clrflag, &io->pfrio_nchange,
-		    &io->pfrio_ndel, io->pfrio_flags | PFR_FLAG_USERIOCTL);
-		break;
-	}
-
-	case DIOCRCLRADDRS: {
-		struct pfioc_table *io = (struct pfioc_table *)addr;
-
-		if (io->pfrio_esize != 0) {
-			error = ENODEV;
-			break;
-		}
-		error = pfr_clr_addrs(&io->pfrio_table, &io->pfrio_ndel,
-		    io->pfrio_flags | PFR_FLAG_USERIOCTL);
-		break;
-	}
-
-	case DIOCRADDADDRS: {
-		struct pfioc_table *io = (struct pfioc_table *)addr;
-
-		if (io->pfrio_esize != sizeof(struct pfr_addr)) {
-			error = ENODEV;
-			break;
-		}
-		error = pfr_add_addrs(&io->pfrio_table, io->pfrio_buffer,
-		    io->pfrio_size, &io->pfrio_nadd, io->pfrio_flags |
-		    PFR_FLAG_USERIOCTL);
-		break;
-	}
-
-	case DIOCRDELADDRS: {
-		struct pfioc_table *io = (struct pfioc_table *)addr;
-
-		if (io->pfrio_esize != sizeof(struct pfr_addr)) {
-			error = ENODEV;
-			break;
-		}
-		error = pfr_del_addrs(&io->pfrio_table, io->pfrio_buffer,
-		    io->pfrio_size, &io->pfrio_ndel, io->pfrio_flags |
-		    PFR_FLAG_USERIOCTL);
-		break;
-	}
-
-	case DIOCRSETADDRS: {
-		struct pfioc_table *io = (struct pfioc_table *)addr;
-
-		if (io->pfrio_esize != sizeof(struct pfr_addr)) {
-			error = ENODEV;
-			break;
-		}
-		error = pfr_set_addrs(&io->pfrio_table, io->pfrio_buffer,
-		    io->pfrio_size, &io->pfrio_size2, &io->pfrio_nadd,
-		    &io->pfrio_ndel, &io->pfrio_nchange, io->pfrio_flags |
-		    PFR_FLAG_USERIOCTL, 0);
-		break;
-	}
-
-	case DIOCRGETADDRS: {
-		struct pfioc_table *io = (struct pfioc_table *)addr;
-
-		if (io->pfrio_esize != sizeof(struct pfr_addr)) {
-			error = ENODEV;
-			break;
-		}
-		error = pfr_get_addrs(&io->pfrio_table, io->pfrio_buffer,
-		    &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL);
-		break;
-	}
-
-	case DIOCRGETASTATS: {
-		struct pfioc_table *io = (struct pfioc_table *)addr;
-
-		if (io->pfrio_esize != sizeof(struct pfr_astats)) {
-			error = ENODEV;
-			break;
-		}
-		error = pfr_get_astats(&io->pfrio_table, io->pfrio_buffer,
-		    &io->pfrio_size, io->pfrio_flags | PFR_FLAG_USERIOCTL);
-		break;
-	}
-
-	case DIOCRCLRASTATS: {
-		struct pfioc_table *io = (struct pfioc_table *)addr;
-
-		if (io->pfrio_esize != sizeof(struct pfr_addr)) {
-			error = ENODEV;
-			break;
-		}
-		error = pfr_clr_astats(&io->pfrio_table, io->pfrio_buffer,
-		    io->pfrio_size, &io->pfrio_nzero, io->pfrio_flags |
-		    PFR_FLAG_USERIOCTL);
-		break;
-	}
-
-	case DIOCRTSTADDRS: {
-		struct pfioc_table *io = (struct pfioc_table *)addr;
-
-		if (io->pfrio_esize != sizeof(struct pfr_addr)) {
-			error = ENODEV;
-			break;
-		}
-		error = pfr_tst_addrs(&io->pfrio_table, io->pfrio_buffer,
-		    io->pfrio_size, &io->pfrio_nmatch, io->pfrio_flags |
-		    PFR_FLAG_USERIOCTL);
-		break;
-	}
-
-	case DIOCRINADEFINE: {
-		struct pfioc_table *io = (struct pfioc_table *)addr;
-
-		if (io->pfrio_esize != sizeof(struct pfr_addr)) {
-			error = ENODEV;
-			break;
-		}
-		error = pfr_ina_define(&io->pfrio_table, io->pfrio_buffer,
-		    io->pfrio_size, &io->pfrio_nadd, &io->pfrio_naddr,
-		    io->pfrio_ticket, io->pfrio_flags | PFR_FLAG_USERIOCTL);
-		break;
-	}
-
-	case DIOCOSFPADD: {
-		struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr;
-		error = pf_osfp_add(io);
-		break;
-	}
-
-	case DIOCOSFPGET: {
-		struct pf_osfp_ioctl *io = (struct pf_osfp_ioctl *)addr;
-		error = pf_osfp_get(io);
-		break;
-	}
-
-	case DIOCXBEGIN: {
-		struct pfioc_trans	*io = (struct pfioc_trans *)addr;
-		struct pfioc_trans_e	*ioe;
-		struct pfr_table	*table;
-		int			 i;
-
-		if (io->esize != sizeof(*ioe)) {
-			error = ENODEV;
-			goto fail;
-		}
-#ifdef __FreeBSD__
-		PF_UNLOCK();
-#endif
-		ioe = malloc(sizeof(*ioe), M_TEMP, M_WAITOK);
-		table = malloc(sizeof(*table), M_TEMP, M_WAITOK);
-#ifdef __FreeBSD__
-		PF_LOCK();
-#endif
-		for (i = 0; i < io->size; i++) {
-#ifdef __FreeBSD__
-		PF_COPYIN(io->array+i, ioe, sizeof(*ioe), error);
-		if (error) {
-#else
-			if (copyin(io->array+i, ioe, sizeof(*ioe))) {
-#endif
-				free(table, M_TEMP);
-				free(ioe, M_TEMP);
-				error = EFAULT;
-				goto fail;
-			}
-			switch (ioe->rs_num) {
-#ifdef ALTQ
-			case PF_RULESET_ALTQ:
-				if (ioe->anchor[0]) {
-					free(table, M_TEMP);
-					free(ioe, M_TEMP);
-					error = EINVAL;
-					goto fail;
-				}
-				if ((error = pf_begin_altq(&ioe->ticket))) {
-					free(table, M_TEMP);
-					free(ioe, M_TEMP);
-					goto fail;
-				}
-				break;
-#endif /* ALTQ */
-			case PF_RULESET_TABLE:
-				bzero(table, sizeof(*table));
-				strlcpy(table->pfrt_anchor, ioe->anchor,
-				    sizeof(table->pfrt_anchor));
-				if ((error = pfr_ina_begin(table,
-				    &ioe->ticket, NULL, 0))) {
-					free(table, M_TEMP);
-					free(ioe, M_TEMP);
-					goto fail;
-				}
-				break;
-			default:
-				if ((error = pf_begin_rules(&ioe->ticket,
-				    ioe->rs_num, ioe->anchor))) {
-					free(table, M_TEMP);
-					free(ioe, M_TEMP);
-					goto fail;
-				}
-				break;
-			}
-#ifdef __FreeBSD__
-			PF_COPYOUT(ioe, io->array+i, sizeof(io->array[i]),
-			    error);
-			if (error) {
-#else
-			if (copyout(ioe, io->array+i, sizeof(io->array[i]))) {
-#endif
-				free(table, M_TEMP);
-				free(ioe, M_TEMP);
-				error = EFAULT;
-				goto fail;
-			}
-		}
-		free(table, M_TEMP);
-		free(ioe, M_TEMP);
-		break;
-	}
-
-	case DIOCXROLLBACK: {
-		struct pfioc_trans	*io = (struct pfioc_trans *)addr;
-		struct pfioc_trans_e	*ioe;
-		struct pfr_table	*table;
-		int			 i;
-
-		if (io->esize != sizeof(*ioe)) {
-			error = ENODEV;
-			goto fail;
-		}
-#ifdef __FreeBSD__
-		PF_UNLOCK();
-#endif
-		ioe = malloc(sizeof(*ioe), M_TEMP, M_WAITOK);
-		table = malloc(sizeof(*table), M_TEMP, M_WAITOK);
-#ifdef __FreeBSD__
-		PF_LOCK();
-#endif
-		for (i = 0; i < io->size; i++) {
-#ifdef __FreeBSD__
-			PF_COPYIN(io->array+i, ioe, sizeof(*ioe), error);
-			if (error) {
-#else
-			if (copyin(io->array+i, ioe, sizeof(*ioe))) {
-#endif
-				free(table, M_TEMP);
-				free(ioe, M_TEMP);
-				error = EFAULT;
-				goto fail;
-			}
-			switch (ioe->rs_num) {
-#ifdef ALTQ
-			case PF_RULESET_ALTQ:
-				if (ioe->anchor[0]) {
-					free(table, M_TEMP);
-					free(ioe, M_TEMP);
-					error = EINVAL;
-					goto fail;
-				}
-				if ((error = pf_rollback_altq(ioe->ticket))) {
-					free(table, M_TEMP);
-					free(ioe, M_TEMP);
-					goto fail; /* really bad */
-				}
-				break;
-#endif /* ALTQ */
-			case PF_RULESET_TABLE:
-				bzero(table, sizeof(*table));
-				strlcpy(table->pfrt_anchor, ioe->anchor,
-				    sizeof(table->pfrt_anchor));
-				if ((error = pfr_ina_rollback(table,
-				    ioe->ticket, NULL, 0))) {
-					free(table, M_TEMP);
-					free(ioe, M_TEMP);
-					goto fail; /* really bad */
-				}
-				break;
-			default:
-				if ((error = pf_rollback_rules(ioe->ticket,
-				    ioe->rs_num, ioe->anchor))) {
-					free(table, M_TEMP);
-					free(ioe, M_TEMP);
-					goto fail; /* really bad */
-				}
-				break;
-			}
-		}
-		free(table, M_TEMP);
-		free(ioe, M_TEMP);
-		break;
-	}
-
-	case DIOCXCOMMIT: {
-		struct pfioc_trans	*io = (struct pfioc_trans *)addr;
-		struct pfioc_trans_e	*ioe;
-		struct pfr_table	*table;
-		struct pf_ruleset	*rs;
-		int			 i;
-
-		if (io->esize != sizeof(*ioe)) {
-			error = ENODEV;
-			goto fail;
-		}
-#ifdef __FreeBSD__
-		PF_UNLOCK();
-#endif
-		ioe = malloc(sizeof(*ioe), M_TEMP, M_WAITOK);
-		table = malloc(sizeof(*table), M_TEMP, M_WAITOK);
-#ifdef __FreeBSD__
-		PF_LOCK();
-#endif
-		/* first makes sure everything will succeed */
-		for (i = 0; i < io->size; i++) {
-#ifdef __FreeBSD__
-			PF_COPYIN(io->array+i, ioe, sizeof(*ioe), error);
-			if (error) {
-#else
-			if (copyin(io->array+i, ioe, sizeof(*ioe))) {
-#endif
-				free(table, M_TEMP);
-				free(ioe, M_TEMP);
-				error = EFAULT;
-				goto fail;
-			}
-			switch (ioe->rs_num) {
-#ifdef ALTQ
-			case PF_RULESET_ALTQ:
-				if (ioe->anchor[0]) {
-					free(table, M_TEMP);
-					free(ioe, M_TEMP);
-					error = EINVAL;
-					goto fail;
-				}
-#ifdef __FreeBSD__
-				if (!V_altqs_inactive_open || ioe->ticket !=
-				    V_ticket_altqs_inactive) {
-#else
-				if (!altqs_inactive_open || ioe->ticket !=
-				    ticket_altqs_inactive) {
-#endif
-					free(table, M_TEMP);
-					free(ioe, M_TEMP);
-					error = EBUSY;
-					goto fail;
-				}
-				break;
-#endif /* ALTQ */
-			case PF_RULESET_TABLE:
-				rs = pf_find_ruleset(ioe->anchor);
-				if (rs == NULL || !rs->topen || ioe->ticket !=
-				    rs->tticket) {
-					free(table, M_TEMP);
-					free(ioe, M_TEMP);
-					error = EBUSY;
-					goto fail;
-				}
-				break;
-			default:
-				if (ioe->rs_num < 0 || ioe->rs_num >=
-				    PF_RULESET_MAX) {
-					free(table, M_TEMP);
-					free(ioe, M_TEMP);
-					error = EINVAL;
-					goto fail;
-				}
-				rs = pf_find_ruleset(ioe->anchor);
-				if (rs == NULL ||
-				    !rs->rules[ioe->rs_num].inactive.open ||
-				    rs->rules[ioe->rs_num].inactive.ticket !=
-				    ioe->ticket) {
-					free(table, M_TEMP);
-					free(ioe, M_TEMP);
-					error = EBUSY;
-					goto fail;
-				}
-				break;
-			}
-		}
-		/* now do the commit - no errors should happen here */
-		for (i = 0; i < io->size; i++) {
-#ifdef __FreeBSD__
-			PF_COPYIN(io->array+i, ioe, sizeof(*ioe), error);
-			if (error) {
-#else
-			if (copyin(io->array+i, ioe, sizeof(*ioe))) {
-#endif
-				free(table, M_TEMP);
-				free(ioe, M_TEMP);
-				error = EFAULT;
-				goto fail;
-			}
-			switch (ioe->rs_num) {
-#ifdef ALTQ
-			case PF_RULESET_ALTQ:
-				if ((error = pf_commit_altq(ioe->ticket))) {
-					free(table, M_TEMP);
-					free(ioe, M_TEMP);
-					goto fail; /* really bad */
-				}
-				break;
-#endif /* ALTQ */
-			case PF_RULESET_TABLE:
-				bzero(table, sizeof(*table));
-				strlcpy(table->pfrt_anchor, ioe->anchor,
-				    sizeof(table->pfrt_anchor));
-				if ((error = pfr_ina_commit(table, ioe->ticket,
-				    NULL, NULL, 0))) {
-					free(table, M_TEMP);
-					free(ioe, M_TEMP);
-					goto fail; /* really bad */
-				}
-				break;
-			default:
-				if ((error = pf_commit_rules(ioe->ticket,
-				    ioe->rs_num, ioe->anchor))) {
-					free(table, M_TEMP);
-					free(ioe, M_TEMP);
-					goto fail; /* really bad */
-				}
-				break;
-			}
-		}
-		free(table, M_TEMP);
-		free(ioe, M_TEMP);
-		break;
-	}
-
-	case DIOCGETSRCNODES: {
-		struct pfioc_src_nodes	*psn = (struct pfioc_src_nodes *)addr;
-		struct pf_src_node	*n, *p, *pstore;
-		u_int32_t		 nr = 0;
-		int			 space = psn->psn_len;
-
-		if (space == 0) {
-#ifdef __FreeBSD__
-			RB_FOREACH(n, pf_src_tree, &V_tree_src_tracking)
-#else
-			RB_FOREACH(n, pf_src_tree, &tree_src_tracking)
-#endif
-				nr++;
-			psn->psn_len = sizeof(struct pf_src_node) * nr;
-			break;
-		}
-
-#ifdef __FreeBSD__
-		PF_UNLOCK();
-#endif
-		pstore = malloc(sizeof(*pstore), M_TEMP, M_WAITOK);
-#ifdef __FreeBSD__
-		PF_LOCK();
-#endif
-		p = psn->psn_src_nodes;
-#ifdef __FreeBSD__
-		RB_FOREACH(n, pf_src_tree, &V_tree_src_tracking) {
-#else
-		RB_FOREACH(n, pf_src_tree, &tree_src_tracking) {
-#endif
-			int	secs = time_second, diff;
-
-			if ((nr + 1) * sizeof(*p) > (unsigned)psn->psn_len)
-				break;
-
-			bcopy(n, pstore, sizeof(*pstore));
-			if (n->rule.ptr != NULL)
-				pstore->rule.nr = n->rule.ptr->nr;
-			pstore->creation = secs - pstore->creation;
-			if (pstore->expire > secs)
-				pstore->expire -= secs;
-			else
-				pstore->expire = 0;
-
-			/* adjust the connection rate estimate */
-			diff = secs - n->conn_rate.last;
-			if (diff >= n->conn_rate.seconds)
-				pstore->conn_rate.count = 0;
-			else
-				pstore->conn_rate.count -=
-				    n->conn_rate.count * diff /
-				    n->conn_rate.seconds;
-
-#ifdef __FreeBSD__
-			PF_COPYOUT(pstore, p, sizeof(*p), error);
-#else
-			error = copyout(pstore, p, sizeof(*p));
-#endif
-			if (error) {
-				free(pstore, M_TEMP);
-				goto fail;
-			}
-			p++;
-			nr++;
-		}
-		psn->psn_len = sizeof(struct pf_src_node) * nr;
-
-		free(pstore, M_TEMP);
-		break;
-	}
-
-	case DIOCCLRSRCNODES: {
-		struct pf_src_node	*n;
-		struct pf_state		*state;
-
-#ifdef __FreeBSD__
-		RB_FOREACH(state, pf_state_tree_id, &V_tree_id) {
-#else
-		RB_FOREACH(state, pf_state_tree_id, &tree_id) {
-#endif
-			state->src_node = NULL;
-			state->nat_src_node = NULL;
-		}
-#ifdef __FreeBSD__
-		RB_FOREACH(n, pf_src_tree, &V_tree_src_tracking) {
-#else
-		RB_FOREACH(n, pf_src_tree, &tree_src_tracking) {
-#endif
-			n->expire = 1;
-			n->states = 0;
-		}
-		pf_purge_expired_src_nodes(1);
-#ifdef __FreeBSD__
-		V_pf_status.src_nodes = 0;
-#else
-		pf_status.src_nodes = 0;
-#endif
-		break;
-	}
-
-	case DIOCKILLSRCNODES: {
-		struct pf_src_node	*sn;
-		struct pf_state		*s;
-		struct pfioc_src_node_kill *psnk =
-		    (struct pfioc_src_node_kill *)addr;
-		u_int			killed = 0;
-
-#ifdef __FreeBSD__
-		RB_FOREACH(sn, pf_src_tree, &V_tree_src_tracking) {
-#else
-		RB_FOREACH(sn, pf_src_tree, &tree_src_tracking) {
-#endif
-			if (PF_MATCHA(psnk->psnk_src.neg,
-				&psnk->psnk_src.addr.v.a.addr,
-				&psnk->psnk_src.addr.v.a.mask,
-				&sn->addr, sn->af) &&
-			    PF_MATCHA(psnk->psnk_dst.neg,
-				&psnk->psnk_dst.addr.v.a.addr,
-				&psnk->psnk_dst.addr.v.a.mask,
-				&sn->raddr, sn->af)) {
-				/* Handle state to src_node linkage */
-				if (sn->states != 0) {
-					RB_FOREACH(s, pf_state_tree_id,
-#ifdef __FreeBSD__
-					    &V_tree_id) {
-#else
-					    &tree_id) {
-#endif
-						if (s->src_node == sn)
-							s->src_node = NULL;
-						if (s->nat_src_node == sn)
-							s->nat_src_node = NULL;
-					}
-					sn->states = 0;
-				}
-				sn->expire = 1;
-				killed++;
-			}
-		}
-
-		if (killed > 0)
-			pf_purge_expired_src_nodes(1);
-
-		psnk->psnk_killed = killed;
-		break;
-	}
-
-	case DIOCSETHOSTID: {
-		u_int32_t	*hostid = (u_int32_t *)addr;
-
-#ifdef __FreeBSD__
-		if (*hostid == 0)
-			V_pf_status.hostid = arc4random();
-		else
-			V_pf_status.hostid = *hostid;
-#else
-		if (*hostid == 0)
-			pf_status.hostid = arc4random();
-		else
-			pf_status.hostid = *hostid;
-#endif
-		break;
-	}
-
-	case DIOCOSFPFLUSH:
-		pf_osfp_flush();
-		break;
-
-	case DIOCIGETIFACES: {
-		struct pfioc_iface *io = (struct pfioc_iface *)addr;
-
-		if (io->pfiio_esize != sizeof(struct pfi_kif)) {
-			error = ENODEV;
-			break;
-		}
-		error = pfi_get_ifaces(io->pfiio_name, io->pfiio_buffer,
-		    &io->pfiio_size);
-		break;
-	}
-
-	case DIOCSETIFFLAG: {
-		struct pfioc_iface *io = (struct pfioc_iface *)addr;
-
-		error = pfi_set_flags(io->pfiio_name, io->pfiio_flags);
-		break;
-	}
-
-	case DIOCCLRIFFLAG: {
-		struct pfioc_iface *io = (struct pfioc_iface *)addr;
-
-		error = pfi_clear_flags(io->pfiio_name, io->pfiio_flags);
-		break;
-	}
-
-	default:
-		error = ENODEV;
-		break;
-	}
-fail:
-#ifdef __FreeBSD__
-	PF_UNLOCK();
-
-	if (flags & FWRITE)
-		sx_xunlock(&V_pf_consistency_lock);
-	else
-		sx_sunlock(&V_pf_consistency_lock);
-#else
-	splx(s);
-	if (flags & FWRITE)
-		rw_exit_write(&pf_consistency_lock);
-	else
-		rw_exit_read(&pf_consistency_lock);
-#endif
-
-	CURVNET_RESTORE();
-
-	return (error);
-}
-
-#ifdef __FreeBSD__
-void
-pfsync_state_export(struct pfsync_state *sp, struct pf_state *st)
-{
-	bzero(sp, sizeof(struct pfsync_state));
-
-	/* copy from state key */
-	sp->key[PF_SK_WIRE].addr[0] = st->key[PF_SK_WIRE]->addr[0];
-	sp->key[PF_SK_WIRE].addr[1] = st->key[PF_SK_WIRE]->addr[1];
-	sp->key[PF_SK_WIRE].port[0] = st->key[PF_SK_WIRE]->port[0];
-	sp->key[PF_SK_WIRE].port[1] = st->key[PF_SK_WIRE]->port[1];
-	sp->key[PF_SK_STACK].addr[0] = st->key[PF_SK_STACK]->addr[0];
-	sp->key[PF_SK_STACK].addr[1] = st->key[PF_SK_STACK]->addr[1];
-	sp->key[PF_SK_STACK].port[0] = st->key[PF_SK_STACK]->port[0];
-	sp->key[PF_SK_STACK].port[1] = st->key[PF_SK_STACK]->port[1];
-	sp->proto = st->key[PF_SK_WIRE]->proto;
-	sp->af = st->key[PF_SK_WIRE]->af;
-
-	/* copy from state */
-	strlcpy(sp->ifname, st->kif->pfik_name, sizeof(sp->ifname));
-	bcopy(&st->rt_addr, &sp->rt_addr, sizeof(sp->rt_addr));
-	sp->creation = htonl(time_second - st->creation);
-	sp->expire = pf_state_expires(st);
-	if (sp->expire <= time_second)
-		sp->expire = htonl(0);
-	else
-		sp->expire = htonl(sp->expire - time_second);
-
-	sp->direction = st->direction;
-	sp->log = st->log;
-	sp->timeout = st->timeout;
-	sp->state_flags = st->state_flags;
-	if (st->src_node)
-		sp->sync_flags |= PFSYNC_FLAG_SRCNODE;
-	if (st->nat_src_node)
-		sp->sync_flags |= PFSYNC_FLAG_NATSRCNODE;
-
-	bcopy(&st->id, &sp->id, sizeof(sp->id));
-	sp->creatorid = st->creatorid;
-	pf_state_peer_hton(&st->src, &sp->src);
-	pf_state_peer_hton(&st->dst, &sp->dst);
-
-	if (st->rule.ptr == NULL)
-		sp->rule = htonl(-1);
-	else
-		sp->rule = htonl(st->rule.ptr->nr);
-	if (st->anchor.ptr == NULL)
-		sp->anchor = htonl(-1);
-	else
-		sp->anchor = htonl(st->anchor.ptr->nr);
-	if (st->nat_rule.ptr == NULL)
-		sp->nat_rule = htonl(-1);
-	else
-		sp->nat_rule = htonl(st->nat_rule.ptr->nr);
-
-	pf_state_counter_hton(st->packets[0], sp->packets[0]);
-	pf_state_counter_hton(st->packets[1], sp->packets[1]);
-	pf_state_counter_hton(st->bytes[0], sp->bytes[0]);
-	pf_state_counter_hton(st->bytes[1], sp->bytes[1]);
-
-}
-
-/*
- * XXX - Check for version missmatch!!!
- */
-static void
-pf_clear_states(void)
-{
-	struct pf_state	*state;
- 
-#ifdef __FreeBSD__
-	RB_FOREACH(state, pf_state_tree_id, &V_tree_id) {
-#else
-	RB_FOREACH(state, pf_state_tree_id, &tree_id) {
-#endif
-		state->timeout = PFTM_PURGE;
-#if NPFSYNC
-		/* don't send out individual delete messages */
-		state->sync_state = PFSTATE_NOSYNC;
-#endif
-		pf_unlink_state(state);
-	}
- 
-#if 0 /* NPFSYNC */
-/*
- * XXX This is called on module unload, we do not want to sync that over? */
- */
-	pfsync_clear_states(V_pf_status.hostid, psk->psk_ifname);
-#endif
-}
-
-static int
-pf_clear_tables(void)
-{
-	struct pfioc_table io;
-	int error;
-
-	bzero(&io, sizeof(io));
-
-	error = pfr_clr_tables(&io.pfrio_table, &io.pfrio_ndel,
-	    io.pfrio_flags);
-
-	return (error);
-}
-
-static void
-pf_clear_srcnodes(void)
-{
-	struct pf_src_node	*n;
-	struct pf_state		*state;
-
-#ifdef __FreeBSD__
-	RB_FOREACH(state, pf_state_tree_id, &V_tree_id) {
-#else
-	RB_FOREACH(state, pf_state_tree_id, &tree_id) {
-#endif
-		state->src_node = NULL;
-		state->nat_src_node = NULL;
-	}
-#ifdef __FreeBSD__
-	RB_FOREACH(n, pf_src_tree, &V_tree_src_tracking) {
-#else
-	RB_FOREACH(n, pf_src_tree, &tree_src_tracking) {
-#endif
-		n->expire = 1;
-		n->states = 0;
-	}
-}
-/*
- * XXX - Check for version missmatch!!!
- */
-
-/*
- * Duplicate pfctl -Fa operation to get rid of as much as we can.
- */
-static int
-shutdown_pf(void)
-{
-	int error = 0;
-	u_int32_t t[5];
-	char nn = '\0';
- 
-	V_pf_status.running = 0;
-	do {
-		if ((error = pf_begin_rules(&t[0], PF_RULESET_SCRUB, &nn))
-		    != 0) {
-			DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: SCRUB\n"));
-			break;
-		}
-		if ((error = pf_begin_rules(&t[1], PF_RULESET_FILTER, &nn))
-		    != 0) {
-			DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: FILTER\n"));
-			break;          /* XXX: rollback? */
-		}
-		if ((error = pf_begin_rules(&t[2], PF_RULESET_NAT, &nn))
-		    != 0) {
-			DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: NAT\n"));
-			break;          /* XXX: rollback? */
-		}
-		if ((error = pf_begin_rules(&t[3], PF_RULESET_BINAT, &nn))
-		    != 0) {
-			DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: BINAT\n"));
-			break;          /* XXX: rollback? */
-		}
-		if ((error = pf_begin_rules(&t[4], PF_RULESET_RDR, &nn))
-		    != 0) {
-			DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: RDR\n"));
-			break;          /* XXX: rollback? */
-		}
-
-		/* XXX: these should always succeed here */
-		pf_commit_rules(t[0], PF_RULESET_SCRUB, &nn);
-		pf_commit_rules(t[1], PF_RULESET_FILTER, &nn);
-		pf_commit_rules(t[2], PF_RULESET_NAT, &nn);
-		pf_commit_rules(t[3], PF_RULESET_BINAT, &nn);
-		pf_commit_rules(t[4], PF_RULESET_RDR, &nn);
-
-		if ((error = pf_clear_tables()) != 0)
-			break;
-
-	#ifdef ALTQ
-		if ((error = pf_begin_altq(&t[0])) != 0) {
-			DPFPRINTF(PF_DEBUG_MISC, ("shutdown_pf: ALTQ\n"));
-			break;
-		}
-		pf_commit_altq(t[0]);
-	#endif
-
-		pf_clear_states();
-
-		pf_clear_srcnodes();
-
-		/* status does not use malloced mem so no need to cleanup */
-		/* fingerprints and interfaces have thier own cleanup code */
-	} while(0);
-
-	return (error);
-}
-
-#ifdef INET
-static int
-pf_check_in(void *arg, struct mbuf **m, struct ifnet *ifp, int dir,
-    struct inpcb *inp)
-{
-	/*
-	 * XXX Wed Jul 9 22:03:16 2003 UTC
-	 * OpenBSD has changed its byte ordering convention on ip_len/ip_off
-	 * in network stack. OpenBSD's network stack have converted
-	 * ip_len/ip_off to host byte order frist as FreeBSD.
-	 * Now this is not true anymore , so we should convert back to network
-	 * byte order. 
-	 */
-	struct ip *h = NULL;
-	int chk;
-
-	if ((*m)->m_pkthdr.len >= (int)sizeof(struct ip)) {
-		/* if m_pkthdr.len is less than ip header, pf will handle. */
-		h = mtod(*m, struct ip *);
-		HTONS(h->ip_len);
-		HTONS(h->ip_off);
-	}
-	CURVNET_SET(ifp->if_vnet);
-	chk = pf_test(PF_IN, ifp, m, NULL, inp);
-	CURVNET_RESTORE();
-	if (chk && *m) {
-		m_freem(*m);
-		*m = NULL;
-	}
-	if (*m != NULL) {
-		/* pf_test can change ip header location */
-		h = mtod(*m, struct ip *);
-		NTOHS(h->ip_len);
-		NTOHS(h->ip_off);
-	}
-	return chk;
-}
-
-static int
-pf_check_out(void *arg, struct mbuf **m, struct ifnet *ifp, int dir,
-    struct inpcb *inp)
-{
-	/*
-	 * XXX Wed Jul 9 22:03:16 2003 UTC
-	 * OpenBSD has changed its byte ordering convention on ip_len/ip_off
-	 * in network stack. OpenBSD's network stack have converted
-	 * ip_len/ip_off to host byte order frist as FreeBSD.
-	 * Now this is not true anymore , so we should convert back to network
-	 * byte order. 
-	 */
-	struct ip *h = NULL;
-	int chk;
-
-	/* We need a proper CSUM befor we start (s. OpenBSD ip_output) */
-	if ((*m)->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
-		in_delayed_cksum(*m);
-		(*m)->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
-	}
-	if ((*m)->m_pkthdr.len >= (int)sizeof(*h)) {
-		/* if m_pkthdr.len is less than ip header, pf will handle. */
-		h = mtod(*m, struct ip *);
-		HTONS(h->ip_len);
-		HTONS(h->ip_off);
-	}
-	CURVNET_SET(ifp->if_vnet);
-	chk = pf_test(PF_OUT, ifp, m, NULL, inp);
-	CURVNET_RESTORE();
-	if (chk && *m) {
-		m_freem(*m);
-		*m = NULL;
-	}
-	if (*m != NULL) {
-		/* pf_test can change ip header location */
-		h = mtod(*m, struct ip *);
-		NTOHS(h->ip_len);
-		NTOHS(h->ip_off);
-	}
-	return chk;
-}
-#endif
-
-#ifdef INET6
-static int
-pf_check6_in(void *arg, struct mbuf **m, struct ifnet *ifp, int dir,
-    struct inpcb *inp)
-{
-
-	/*
-	 * IPv6 is not affected by ip_len/ip_off byte order changes.
-	 */
-	int chk;
-
-	/*
-	 * In case of loopback traffic IPv6 uses the real interface in
-	 * order to support scoped addresses. In order to support stateful
-	 * filtering we have change this to lo0 as it is the case in IPv4.
-	 */
-	CURVNET_SET(ifp->if_vnet);
-	chk = pf_test6(PF_IN, (*m)->m_flags & M_LOOP ? V_loif : ifp, m,
-	    NULL, inp);
-	CURVNET_RESTORE();
-	if (chk && *m) {
-		m_freem(*m);
-		*m = NULL;
-	}
-	return chk;
-}
-
-static int
-pf_check6_out(void *arg, struct mbuf **m, struct ifnet *ifp, int dir,
-    struct inpcb *inp)
-{
-	/*
-	 * IPv6 does not affected ip_len/ip_off byte order changes.
-	 */
-	int chk;
-
-	/* We need a proper CSUM before we start (s. OpenBSD ip_output) */
-	if ((*m)->m_pkthdr.csum_flags & CSUM_DELAY_DATA) {
-#ifdef INET
-		/* XXX-BZ copy&paste error from r126261? */
-		in_delayed_cksum(*m);
-#endif
-		(*m)->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
-	}
-	CURVNET_SET(ifp->if_vnet);
-	chk = pf_test6(PF_OUT, ifp, m, NULL, inp);
-	CURVNET_RESTORE();
-	if (chk && *m) {
-		m_freem(*m);
-		*m = NULL;
-	}
-	return chk;
-}
-#endif /* INET6 */
-
-static int
-hook_pf(void)
-{
-#ifdef INET
-	struct pfil_head *pfh_inet;
-#endif
-#ifdef INET6
-	struct pfil_head *pfh_inet6;
-#endif
-
-	PF_UNLOCK_ASSERT();
-
-	if (V_pf_pfil_hooked)
-		return (0); 
-
-#ifdef INET
-	pfh_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET);
-	if (pfh_inet == NULL)
-		return (ESRCH); /* XXX */
-	pfil_add_hook(pf_check_in, NULL, PFIL_IN | PFIL_WAITOK, pfh_inet);
-	pfil_add_hook(pf_check_out, NULL, PFIL_OUT | PFIL_WAITOK, pfh_inet);
-#endif
-#ifdef INET6
-	pfh_inet6 = pfil_head_get(PFIL_TYPE_AF, AF_INET6);
-	if (pfh_inet6 == NULL) {
-#ifdef INET
-		pfil_remove_hook(pf_check_in, NULL, PFIL_IN | PFIL_WAITOK,
-		    pfh_inet);
-		pfil_remove_hook(pf_check_out, NULL, PFIL_OUT | PFIL_WAITOK,
-		    pfh_inet);
-#endif
-		return (ESRCH); /* XXX */
-	}
-	pfil_add_hook(pf_check6_in, NULL, PFIL_IN | PFIL_WAITOK, pfh_inet6);
-	pfil_add_hook(pf_check6_out, NULL, PFIL_OUT | PFIL_WAITOK, pfh_inet6);
-#endif
-
-	V_pf_pfil_hooked = 1;
-	return (0);
-}
-
-static int
-dehook_pf(void)
-{
-#ifdef INET
-	struct pfil_head *pfh_inet;
-#endif
-#ifdef INET6
-	struct pfil_head *pfh_inet6;
-#endif
-
-	PF_UNLOCK_ASSERT();
-
-	if (V_pf_pfil_hooked == 0)
-		return (0);
-
-#ifdef INET
-	pfh_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET);
-	if (pfh_inet == NULL)
-		return (ESRCH); /* XXX */
-	pfil_remove_hook(pf_check_in, NULL, PFIL_IN | PFIL_WAITOK,
-	    pfh_inet);
-	pfil_remove_hook(pf_check_out, NULL, PFIL_OUT | PFIL_WAITOK,
-	    pfh_inet);
-#endif
-#ifdef INET6
-	pfh_inet6 = pfil_head_get(PFIL_TYPE_AF, AF_INET6);
-	if (pfh_inet6 == NULL)
-		return (ESRCH); /* XXX */
-	pfil_remove_hook(pf_check6_in, NULL, PFIL_IN | PFIL_WAITOK,
-	    pfh_inet6);
-	pfil_remove_hook(pf_check6_out, NULL, PFIL_OUT | PFIL_WAITOK,
-	    pfh_inet6);
-#endif
-
-	V_pf_pfil_hooked = 0;
-	return (0);
-}
-
-static int
-pf_load(void)
-{
-	VNET_ITERATOR_DECL(vnet_iter);
-
-	VNET_LIST_RLOCK();
-	VNET_FOREACH(vnet_iter) {
-		CURVNET_SET(vnet_iter);
-		V_pf_pfil_hooked = 0;
-		V_pf_end_threads = 0;
-		V_debug_pfugidhack = 0;
-		TAILQ_INIT(&V_pf_tags);
-		TAILQ_INIT(&V_pf_qids);
-		CURVNET_RESTORE();
-	}
-	VNET_LIST_RUNLOCK();
-
-	init_pf_mutex();
-	pf_dev = make_dev(&pf_cdevsw, 0, 0, 0, 0600, PF_NAME);
-	init_zone_var();
-	sx_init(&V_pf_consistency_lock, "pf_statetbl_lock");
-	if (pfattach() < 0)
-		return (ENOMEM);
-
-	return (0);
-}
-
-static int
-pf_unload(void)
-{
-	int error = 0;
-
-	PF_LOCK();
-	V_pf_status.running = 0;
-	PF_UNLOCK();
-	m_addr_chg_pf_p = NULL;
-	error = dehook_pf();
-	if (error) {
-		/*
-		 * Should not happen!
-		 * XXX Due to error code ESRCH, kldunload will show
-		 * a message like 'No such process'.
-		 */
-		printf("%s : pfil unregisteration fail\n", __FUNCTION__);
-		return error;
-	}
-	PF_LOCK();
-	shutdown_pf();
-	V_pf_end_threads = 1;
-	while (V_pf_end_threads < 2) {
-		wakeup_one(pf_purge_thread);
-		msleep(pf_purge_thread, &pf_task_mtx, 0, "pftmo", hz);
-	}
-	pfi_cleanup();
-	pf_osfp_flush();
-	pf_osfp_cleanup();
-	cleanup_pf_zone();
-	PF_UNLOCK();
-	destroy_dev(pf_dev);
-	destroy_pf_mutex();
-	sx_destroy(&V_pf_consistency_lock);
-	return error;
-}
-
-static int
-pf_modevent(module_t mod, int type, void *data)
-{
-	int error = 0;
-
-	switch(type) {
-	case MOD_LOAD:
-		error = pf_load();
-		break;
-	case MOD_QUIESCE:
-		/*
-		 * Module should not be unloaded due to race conditions.
-		 */
-		error = EPERM;
-		break;
-	case MOD_UNLOAD:
-		error = pf_unload();
-		break;
-	default:
-		error = EINVAL;
-		break;
-	}
-	return error;
-}
- 
-static moduledata_t pf_mod = {
-	"pf",
-	pf_modevent,
-	0
-};
-
-DECLARE_MODULE(pf, pf_mod, SI_SUB_PSEUDO, SI_ORDER_FIRST);
-MODULE_VERSION(pf, PF_MODVER);
-#endif /* __FreeBSD__ */
diff --git a/sys/contrib/pf/net/pf_lb.c b/sys/contrib/pf/net/pf_lb.c
deleted file mode 100644
index 4adc6f00e8db..000000000000
--- a/sys/contrib/pf/net/pf_lb.c
+++ /dev/null
@@ -1,793 +0,0 @@
-/*	$OpenBSD: pf_lb.c,v 1.2 2009/02/12 02:13:15 sthen Exp $ */
-
-/*
- * Copyright (c) 2001 Daniel Hartmeier
- * Copyright (c) 2002 - 2008 Henning Brauer
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *    - Redistributions of source code must retain the above copyright
- *      notice, this list of conditions and the following disclaimer.
- *    - Redistributions in binary form must reproduce the above
- *      copyright notice, this list of conditions and the following
- *      disclaimer in the documentation and/or other materials provided
- *      with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
- * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
- * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
- * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
- * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
- * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- *
- * Effort sponsored in part by the Defense Advanced Research Projects
- * Agency (DARPA) and Air Force Research Laboratory, Air Force
- * Materiel Command, USAF, under agreement number F30602-01-2-0537.
- *
- */
-
-#ifdef __FreeBSD__
-#include "opt_inet.h"
-#include "opt_inet6.h"
-
-#include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
-#endif
-
-#ifdef __FreeBSD__
-#include "opt_bpf.h"
-#include "opt_pf.h"
-
-#ifdef DEV_BPF
-#define	NBPFILTER	DEV_BPF
-#else
-#define	NBPFILTER	0
-#endif
-
-#ifdef DEV_PFLOG
-#define	NPFLOG		DEV_PFLOG
-#else
-#define	NPFLOG		0
-#endif
-
-#ifdef DEV_PFSYNC
-#define	NPFSYNC		DEV_PFSYNC
-#else
-#define	NPFSYNC		0
-#endif
-
-#ifdef DEV_PFLOW
-#define	NPFLOW	DEV_PFLOW
-#else
-#define	NPFLOW	0
-#endif
-
-#else
-#include "bpfilter.h"
-#include "pflog.h"
-#include "pfsync.h"
-#include "pflow.h"
-#endif
-
-#include <sys/param.h>
-#include <sys/systm.h>
-#include <sys/mbuf.h>
-#include <sys/filio.h>
-#include <sys/socket.h>
-#include <sys/socketvar.h>
-#include <sys/kernel.h>
-#include <sys/time.h>
-#ifdef  __FreeBSD__
-#include <sys/sysctl.h>
-#endif
-#ifndef __FreeBSD__
-#include <sys/pool.h>
-#endif
-#include <sys/proc.h>
-#ifdef __FreeBSD__
-#include <sys/kthread.h>
-#include <sys/lock.h>
-#include <sys/sx.h>
-#else
-#include <sys/rwlock.h>
-#endif
-
-#ifdef __FreeBSD__
-#include <sys/md5.h>
-#else
-#include <crypto/md5.h>
-#endif
-
-#include <net/if.h>
-#include <net/if_types.h>
-#include <net/bpf.h>
-#include <net/route.h>
-#include <net/radix_mpath.h>
-
-#include <netinet/in.h>
-#include <netinet/in_var.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#include <netinet/ip_var.h>
-#include <netinet/tcp.h>
-#include <netinet/tcp_seq.h>
-#include <netinet/udp.h>
-#include <netinet/ip_icmp.h>
-#include <netinet/in_pcb.h>
-#include <netinet/tcp_timer.h>
-#include <netinet/tcp_var.h>
-#include <netinet/udp_var.h>
-#include <netinet/icmp_var.h>
-#include <netinet/if_ether.h>
-
-#ifndef __FreeBSD__
-#include <dev/rndvar.h>
-#endif
-#include <net/pfvar.h>
-#include <net/if_pflog.h>
-#include <net/if_pflow.h>
-
-#if NPFSYNC > 0
-#include <net/if_pfsync.h>
-#endif /* NPFSYNC > 0 */
-
-#ifdef INET6
-#include <netinet/ip6.h>
-#include <netinet/in_pcb.h>
-#include <netinet/icmp6.h>
-#include <netinet6/nd6.h>
-#endif /* INET6 */
-
-
-#ifdef __FreeBSD__
-#define DPFPRINTF(n, x)	if (V_pf_status.debug >= (n)) printf x
-#else
-#define DPFPRINTF(n, x)	if (pf_status.debug >= (n)) printf x
-#endif
-
-/*
- * Global variables
- */
-
-void			 pf_hash(struct pf_addr *, struct pf_addr *,
-			    struct pf_poolhashkey *, sa_family_t);
-struct pf_rule		*pf_match_translation(struct pf_pdesc *, struct mbuf *,
-			    int, int, struct pfi_kif *,
-			    struct pf_addr *, u_int16_t, struct pf_addr *,
-			    u_int16_t, int);
-int			 pf_get_sport(sa_family_t, u_int8_t, struct pf_rule *,
-			    struct pf_addr *, struct pf_addr *, u_int16_t,
-			    struct pf_addr *, u_int16_t*, u_int16_t, u_int16_t,
-			    struct pf_src_node **);
-
-#define mix(a,b,c) \
-	do {					\
-		a -= b; a -= c; a ^= (c >> 13);	\
-		b -= c; b -= a; b ^= (a << 8);	\
-		c -= a; c -= b; c ^= (b >> 13);	\
-		a -= b; a -= c; a ^= (c >> 12);	\
-		b -= c; b -= a; b ^= (a << 16);	\
-		c -= a; c -= b; c ^= (b >> 5);	\
-		a -= b; a -= c; a ^= (c >> 3);	\
-		b -= c; b -= a; b ^= (a << 10);	\
-		c -= a; c -= b; c ^= (b >> 15);	\
-	} while (0)
-
-/*
- * hash function based on bridge_hash in if_bridge.c
- */
-void
-pf_hash(struct pf_addr *inaddr, struct pf_addr *hash,
-    struct pf_poolhashkey *key, sa_family_t af)
-{
-	u_int32_t	a = 0x9e3779b9, b = 0x9e3779b9, c = key->key32[0];
-
-	switch (af) {
-#ifdef INET
-	case AF_INET:
-		a += inaddr->addr32[0];
-		b += key->key32[1];
-		mix(a, b, c);
-		hash->addr32[0] = c + key->key32[2];
-		break;
-#endif /* INET */
-#ifdef INET6
-	case AF_INET6:
-		a += inaddr->addr32[0];
-		b += inaddr->addr32[2];
-		mix(a, b, c);
-		hash->addr32[0] = c;
-		a += inaddr->addr32[1];
-		b += inaddr->addr32[3];
-		c += key->key32[1];
-		mix(a, b, c);
-		hash->addr32[1] = c;
-		a += inaddr->addr32[2];
-		b += inaddr->addr32[1];
-		c += key->key32[2];
-		mix(a, b, c);
-		hash->addr32[2] = c;
-		a += inaddr->addr32[3];
-		b += inaddr->addr32[0];
-		c += key->key32[3];
-		mix(a, b, c);
-		hash->addr32[3] = c;
-		break;
-#endif /* INET6 */
-	}
-}
-
-struct pf_rule *
-pf_match_translation(struct pf_pdesc *pd, struct mbuf *m, int off,
-    int direction, struct pfi_kif *kif, struct pf_addr *saddr, u_int16_t sport,
-    struct pf_addr *daddr, u_int16_t dport, int rs_num)
-{
-	struct pf_rule		*r, *rm = NULL;
-	struct pf_ruleset	*ruleset = NULL;
-	int			 tag = -1;
-	int			 rtableid = -1;
-	int			 asd = 0;
-
-	r = TAILQ_FIRST(pf_main_ruleset.rules[rs_num].active.ptr);
-	while (r && rm == NULL) {
-		struct pf_rule_addr	*src = NULL, *dst = NULL;
-		struct pf_addr_wrap	*xdst = NULL;
-
-		if (r->action == PF_BINAT && direction == PF_IN) {
-			src = &r->dst;
-			if (r->rpool.cur != NULL)
-				xdst = &r->rpool.cur->addr;
-		} else {
-			src = &r->src;
-			dst = &r->dst;
-		}
-
-		r->evaluations++;
-		if (pfi_kif_match(r->kif, kif) == r->ifnot)
-			r = r->skip[PF_SKIP_IFP].ptr;
-		else if (r->direction && r->direction != direction)
-			r = r->skip[PF_SKIP_DIR].ptr;
-		else if (r->af && r->af != pd->af)
-			r = r->skip[PF_SKIP_AF].ptr;
-		else if (r->proto && r->proto != pd->proto)
-			r = r->skip[PF_SKIP_PROTO].ptr;
-		else if (PF_MISMATCHAW(&src->addr, saddr, pd->af,
-		    src->neg, kif, M_GETFIB(m)))
-			r = r->skip[src == &r->src ? PF_SKIP_SRC_ADDR :
-			    PF_SKIP_DST_ADDR].ptr;
-		else if (src->port_op && !pf_match_port(src->port_op,
-		    src->port[0], src->port[1], sport))
-			r = r->skip[src == &r->src ? PF_SKIP_SRC_PORT :
-			    PF_SKIP_DST_PORT].ptr;
-		else if (dst != NULL &&
-		    PF_MISMATCHAW(&dst->addr, daddr, pd->af, dst->neg, NULL,
-		    M_GETFIB(m)))
-			r = r->skip[PF_SKIP_DST_ADDR].ptr;
-		else if (xdst != NULL && PF_MISMATCHAW(xdst, daddr, pd->af,
-		    0, NULL, M_GETFIB(m)))
-			r = TAILQ_NEXT(r, entries);
-		else if (dst != NULL && dst->port_op &&
-		    !pf_match_port(dst->port_op, dst->port[0],
-		    dst->port[1], dport))
-			r = r->skip[PF_SKIP_DST_PORT].ptr;
-#ifdef __FreeBSD__
-		else if (r->match_tag && !pf_match_tag(m, r, &tag, pd->pf_mtag))
-#else
-		else if (r->match_tag && !pf_match_tag(m, r, &tag))
-#endif
-			r = TAILQ_NEXT(r, entries);
-		else if (r->os_fingerprint != PF_OSFP_ANY && (pd->proto !=
-		    IPPROTO_TCP || !pf_osfp_match(pf_osfp_fingerprint(pd, m,
-		    off, pd->hdr.tcp), r->os_fingerprint)))
-			r = TAILQ_NEXT(r, entries);
-		else {
-			if (r->tag)
-				tag = r->tag;
-			if (r->rtableid >= 0)
-				rtableid = r->rtableid;
-			if (r->anchor == NULL) {
-				rm = r;
-			} else
-				pf_step_into_anchor(&asd, &ruleset, rs_num,
-				    &r, NULL, NULL);
-		}
-		if (r == NULL)
-			pf_step_out_of_anchor(&asd, &ruleset, rs_num, &r,
-			    NULL, NULL);
-	}
-#ifdef __FreeBSD__
-	if (pf_tag_packet(m, tag, rtableid, pd->pf_mtag))
-#else
-	if (pf_tag_packet(m, tag, rtableid))
-#endif
-		return (NULL);
-	if (rm != NULL && (rm->action == PF_NONAT ||
-	    rm->action == PF_NORDR || rm->action == PF_NOBINAT))
-		return (NULL);
-	return (rm);
-}
-
-int
-pf_get_sport(sa_family_t af, u_int8_t proto, struct pf_rule *r,
-    struct pf_addr *saddr, struct pf_addr *daddr, u_int16_t dport,
-    struct pf_addr *naddr, u_int16_t *nport, u_int16_t low, u_int16_t high,
-    struct pf_src_node **sn)
-{
-	struct pf_state_key_cmp	key;
-	struct pf_addr		init_addr;
-	u_int16_t		cut;
-
-	bzero(&init_addr, sizeof(init_addr));
-	if (pf_map_addr(af, r, saddr, naddr, &init_addr, sn))
-		return (1);
-
-	if (proto == IPPROTO_ICMP) {
-		low = 1;
-		high = 65535;
-	}
-
-	do {
-		key.af = af;
-		key.proto = proto;
-		PF_ACPY(&key.addr[1], daddr, key.af);
-		PF_ACPY(&key.addr[0], naddr, key.af);
-		key.port[1] = dport;
-
-		/*
-		 * port search; start random, step;
-		 * similar 2 portloop in in_pcbbind
-		 */
-		if (!(proto == IPPROTO_TCP || proto == IPPROTO_UDP ||
-		    proto == IPPROTO_ICMP)) {
-			key.port[0] = dport;
-			if (pf_find_state_all(&key, PF_IN, NULL) == NULL)
-				return (0);
-		} else if (low == 0 && high == 0) {
-			key.port[0] = *nport;
-			if (pf_find_state_all(&key, PF_IN, NULL) == NULL)
-				return (0);
-		} else if (low == high) {
-			key.port[0] = htons(low);
-			if (pf_find_state_all(&key, PF_IN, NULL) == NULL) {
-				*nport = htons(low);
-				return (0);
-			}
-		} else {
-			u_int16_t tmp;
-
-			if (low > high) {
-				tmp = low;
-				low = high;
-				high = tmp;
-			}
-			/* low < high */
-#ifdef __FreeBSD__
-			cut = htonl(arc4random()) % (1 + high - low) + low;
-#else
-			cut = arc4random_uniform(1 + high - low) + low;
-#endif
-			/* low <= cut <= high */
-			for (tmp = cut; tmp <= high; ++(tmp)) {
-				key.port[0] = htons(tmp);
-				if (pf_find_state_all(&key, PF_IN, NULL) ==
-#ifdef __FreeBSD__
-				    NULL) {
-#else
-				    NULL && !in_baddynamic(tmp, proto)) {
-#endif
-					*nport = htons(tmp);
-					return (0);
-				}
-			}
-			for (tmp = cut - 1; tmp >= low; --(tmp)) {
-				key.port[0] = htons(tmp);
-				if (pf_find_state_all(&key, PF_IN, NULL) ==
-#ifdef __FreeBSD__
-				    NULL) {
-#else
-				    NULL && !in_baddynamic(tmp, proto)) {
-#endif
-					*nport = htons(tmp);
-					return (0);
-				}
-			}
-		}
-
-		switch (r->rpool.opts & PF_POOL_TYPEMASK) {
-		case PF_POOL_RANDOM:
-		case PF_POOL_ROUNDROBIN:
-			if (pf_map_addr(af, r, saddr, naddr, &init_addr, sn))
-				return (1);
-			break;
-		case PF_POOL_NONE:
-		case PF_POOL_SRCHASH:
-		case PF_POOL_BITMASK:
-		default:
-			return (1);
-		}
-	} while (! PF_AEQ(&init_addr, naddr, af) );
-	return (1);					/* none available */
-}
-
-int
-pf_map_addr(sa_family_t af, struct pf_rule *r, struct pf_addr *saddr,
-    struct pf_addr *naddr, struct pf_addr *init_addr, struct pf_src_node **sn)
-{
-	unsigned char		 hash[16];
-	struct pf_pool		*rpool = &r->rpool;
-	struct pf_addr		*raddr = &rpool->cur->addr.v.a.addr;
-	struct pf_addr		*rmask = &rpool->cur->addr.v.a.mask;
-	struct pf_pooladdr	*acur = rpool->cur;
-	struct pf_src_node	 k;
-
-	if (*sn == NULL && r->rpool.opts & PF_POOL_STICKYADDR &&
-	    (r->rpool.opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) {
-		k.af = af;
-		PF_ACPY(&k.addr, saddr, af);
-		if (r->rule_flag & PFRULE_RULESRCTRACK ||
-		    r->rpool.opts & PF_POOL_STICKYADDR)
-			k.rule.ptr = r;
-		else
-			k.rule.ptr = NULL;
-#ifdef __FreeBSD__
-		V_pf_status.scounters[SCNT_SRC_NODE_SEARCH]++;
-		*sn = RB_FIND(pf_src_tree, &V_tree_src_tracking, &k);
-#else
-		pf_status.scounters[SCNT_SRC_NODE_SEARCH]++;
-		*sn = RB_FIND(pf_src_tree, &tree_src_tracking, &k);
-#endif
-		if (*sn != NULL && !PF_AZERO(&(*sn)->raddr, af)) {
-			PF_ACPY(naddr, &(*sn)->raddr, af);
-#ifdef __FreeBSD__
-			if (V_pf_status.debug >= PF_DEBUG_MISC) {
-#else
-			if (pf_status.debug >= PF_DEBUG_MISC) {
-#endif
-				printf("pf_map_addr: src tracking maps ");
-				pf_print_host(&k.addr, 0, af);
-				printf(" to ");
-				pf_print_host(naddr, 0, af);
-				printf("\n");
-			}
-			return (0);
-		}
-	}
-
-	if (rpool->cur->addr.type == PF_ADDR_NOROUTE)
-		return (1);
-	if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
-		switch (af) {
-#ifdef INET
-		case AF_INET:
-			if (rpool->cur->addr.p.dyn->pfid_acnt4 < 1 &&
-			    (rpool->opts & PF_POOL_TYPEMASK) !=
-			    PF_POOL_ROUNDROBIN)
-				return (1);
-			 raddr = &rpool->cur->addr.p.dyn->pfid_addr4;
-			 rmask = &rpool->cur->addr.p.dyn->pfid_mask4;
-			break;
-#endif /* INET */
-#ifdef INET6
-		case AF_INET6:
-			if (rpool->cur->addr.p.dyn->pfid_acnt6 < 1 &&
-			    (rpool->opts & PF_POOL_TYPEMASK) !=
-			    PF_POOL_ROUNDROBIN)
-				return (1);
-			raddr = &rpool->cur->addr.p.dyn->pfid_addr6;
-			rmask = &rpool->cur->addr.p.dyn->pfid_mask6;
-			break;
-#endif /* INET6 */
-		}
-	} else if (rpool->cur->addr.type == PF_ADDR_TABLE) {
-		if ((rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_ROUNDROBIN)
-			return (1); /* unsupported */
-	} else {
-		raddr = &rpool->cur->addr.v.a.addr;
-		rmask = &rpool->cur->addr.v.a.mask;
-	}
-
-	switch (rpool->opts & PF_POOL_TYPEMASK) {
-	case PF_POOL_NONE:
-		PF_ACPY(naddr, raddr, af);
-		break;
-	case PF_POOL_BITMASK:
-		PF_POOLMASK(naddr, raddr, rmask, saddr, af);
-		break;
-	case PF_POOL_RANDOM:
-		if (init_addr != NULL && PF_AZERO(init_addr, af)) {
-			switch (af) {
-#ifdef INET
-			case AF_INET:
-				rpool->counter.addr32[0] = htonl(arc4random());
-				break;
-#endif /* INET */
-#ifdef INET6
-			case AF_INET6:
-				if (rmask->addr32[3] != 0xffffffff)
-					rpool->counter.addr32[3] =
-					    htonl(arc4random());
-				else
-					break;
-				if (rmask->addr32[2] != 0xffffffff)
-					rpool->counter.addr32[2] =
-					    htonl(arc4random());
-				else
-					break;
-				if (rmask->addr32[1] != 0xffffffff)
-					rpool->counter.addr32[1] =
-					    htonl(arc4random());
-				else
-					break;
-				if (rmask->addr32[0] != 0xffffffff)
-					rpool->counter.addr32[0] =
-					    htonl(arc4random());
-				break;
-#endif /* INET6 */
-			}
-			PF_POOLMASK(naddr, raddr, rmask, &rpool->counter, af);
-			PF_ACPY(init_addr, naddr, af);
-
-		} else {
-			PF_AINC(&rpool->counter, af);
-			PF_POOLMASK(naddr, raddr, rmask, &rpool->counter, af);
-		}
-		break;
-	case PF_POOL_SRCHASH:
-		pf_hash(saddr, (struct pf_addr *)&hash, &rpool->key, af);
-		PF_POOLMASK(naddr, raddr, rmask, (struct pf_addr *)&hash, af);
-		break;
-	case PF_POOL_ROUNDROBIN:
-		if (rpool->cur->addr.type == PF_ADDR_TABLE) {
-			if (!pfr_pool_get(rpool->cur->addr.p.tbl,
-			    &rpool->tblidx, &rpool->counter,
-			    &raddr, &rmask, af))
-				goto get_addr;
-		} else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
-			if (!pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt,
-			    &rpool->tblidx, &rpool->counter,
-			    &raddr, &rmask, af))
-				goto get_addr;
-		} else if (pf_match_addr(0, raddr, rmask, &rpool->counter, af))
-			goto get_addr;
-
-	try_next:
-		if ((rpool->cur = TAILQ_NEXT(rpool->cur, entries)) == NULL)
-			rpool->cur = TAILQ_FIRST(&rpool->list);
-		if (rpool->cur->addr.type == PF_ADDR_TABLE) {
-			rpool->tblidx = -1;
-			if (pfr_pool_get(rpool->cur->addr.p.tbl,
-			    &rpool->tblidx, &rpool->counter,
-			    &raddr, &rmask, af)) {
-				/* table contains no address of type 'af' */
-				if (rpool->cur != acur)
-					goto try_next;
-				return (1);
-			}
-		} else if (rpool->cur->addr.type == PF_ADDR_DYNIFTL) {
-			rpool->tblidx = -1;
-			if (pfr_pool_get(rpool->cur->addr.p.dyn->pfid_kt,
-			    &rpool->tblidx, &rpool->counter,
-			    &raddr, &rmask, af)) {
-				/* table contains no address of type 'af' */
-				if (rpool->cur != acur)
-					goto try_next;
-				return (1);
-			}
-		} else {
-			raddr = &rpool->cur->addr.v.a.addr;
-			rmask = &rpool->cur->addr.v.a.mask;
-			PF_ACPY(&rpool->counter, raddr, af);
-		}
-
-	get_addr:
-		PF_ACPY(naddr, &rpool->counter, af);
-		if (init_addr != NULL && PF_AZERO(init_addr, af))
-			PF_ACPY(init_addr, naddr, af);
-		PF_AINC(&rpool->counter, af);
-		break;
-	}
-	if (*sn != NULL)
-		PF_ACPY(&(*sn)->raddr, naddr, af);
-
-#ifdef __FreeBSD__
-	if (V_pf_status.debug >= PF_DEBUG_MISC &&
-#else
-	if (pf_status.debug >= PF_DEBUG_MISC &&
-#endif
-	    (rpool->opts & PF_POOL_TYPEMASK) != PF_POOL_NONE) {
-		printf("pf_map_addr: selected address ");
-		pf_print_host(naddr, 0, af);
-		printf("\n");
-	}
-
-	return (0);
-}
-
-struct pf_rule *
-pf_get_translation(struct pf_pdesc *pd, struct mbuf *m, int off, int direction,
-    struct pfi_kif *kif, struct pf_src_node **sn,
-    struct pf_state_key **skw, struct pf_state_key **sks,
-    struct pf_state_key **skp, struct pf_state_key **nkp,
-    struct pf_addr *saddr, struct pf_addr *daddr,
-    u_int16_t sport, u_int16_t dport)
-{
-	struct pf_rule	*r = NULL;
-
-
-	if (direction == PF_OUT) {
-		r = pf_match_translation(pd, m, off, direction, kif, saddr,
-		    sport, daddr, dport, PF_RULESET_BINAT);
-		if (r == NULL)
-			r = pf_match_translation(pd, m, off, direction, kif,
-			    saddr, sport, daddr, dport, PF_RULESET_NAT);
-	} else {
-		r = pf_match_translation(pd, m, off, direction, kif, saddr,
-		    sport, daddr, dport, PF_RULESET_RDR);
-		if (r == NULL)
-			r = pf_match_translation(pd, m, off, direction, kif,
-			    saddr, sport, daddr, dport, PF_RULESET_BINAT);
-	}
-
-	if (r != NULL) {
-		struct pf_addr	*naddr;
-		u_int16_t	*nport;
-
-		if (pf_state_key_setup(pd, r, skw, sks, skp, nkp,
-		    saddr, daddr, sport, dport))
-			return r;
-
-		/* XXX We only modify one side for now. */
-		naddr = &(*nkp)->addr[1];
-		nport = &(*nkp)->port[1];
-
-		switch (r->action) {
-		case PF_NONAT:
-		case PF_NOBINAT:
-		case PF_NORDR:
-			return (NULL);
-		case PF_NAT:
-			if (pf_get_sport(pd->af, pd->proto, r, saddr,
-			    daddr, dport, naddr, nport, r->rpool.proxy_port[0],
-			    r->rpool.proxy_port[1], sn)) {
-				DPFPRINTF(PF_DEBUG_MISC,
-				    ("pf: NAT proxy port allocation "
-				    "(%u-%u) failed\n",
-				    r->rpool.proxy_port[0],
-				    r->rpool.proxy_port[1]));
-				return (NULL);
-			}
-			break;
-		case PF_BINAT:
-			switch (direction) {
-			case PF_OUT:
-				if (r->rpool.cur->addr.type == PF_ADDR_DYNIFTL){
-					switch (pd->af) {
-#ifdef INET
-					case AF_INET:
-						if (r->rpool.cur->addr.p.dyn->
-						    pfid_acnt4 < 1)
-							return (NULL);
-						PF_POOLMASK(naddr,
-						    &r->rpool.cur->addr.p.dyn->
-						    pfid_addr4,
-						    &r->rpool.cur->addr.p.dyn->
-						    pfid_mask4,
-						    saddr, AF_INET);
-						break;
-#endif /* INET */
-#ifdef INET6
-					case AF_INET6:
-						if (r->rpool.cur->addr.p.dyn->
-						    pfid_acnt6 < 1)
-							return (NULL);
-						PF_POOLMASK(naddr,
-						    &r->rpool.cur->addr.p.dyn->
-						    pfid_addr6,
-						    &r->rpool.cur->addr.p.dyn->
-						    pfid_mask6,
-						    saddr, AF_INET6);
-						break;
-#endif /* INET6 */
-					}
-				} else
-					PF_POOLMASK(naddr,
-					    &r->rpool.cur->addr.v.a.addr,
-					    &r->rpool.cur->addr.v.a.mask,
-					    saddr, pd->af);
-				break;
-			case PF_IN:
-				if (r->src.addr.type == PF_ADDR_DYNIFTL) {
-					switch (pd->af) {
-#ifdef INET
-					case AF_INET:
-						if (r->src.addr.p.dyn->
-						    pfid_acnt4 < 1)
-							return (NULL);
-						PF_POOLMASK(naddr,
-						    &r->src.addr.p.dyn->
-						    pfid_addr4,
-						    &r->src.addr.p.dyn->
-						    pfid_mask4,
-						    daddr, AF_INET);
-						break;
-#endif /* INET */
-#ifdef INET6
-					case AF_INET6:
-						if (r->src.addr.p.dyn->
-						    pfid_acnt6 < 1)
-							return (NULL);
-						PF_POOLMASK(naddr,
-						    &r->src.addr.p.dyn->
-						    pfid_addr6,
-						    &r->src.addr.p.dyn->
-						    pfid_mask6,
-						    daddr, AF_INET6);
-						break;
-#endif /* INET6 */
-					}
-				} else
-					PF_POOLMASK(naddr,
-					    &r->src.addr.v.a.addr,
-					    &r->src.addr.v.a.mask, daddr,
-					    pd->af);
-				break;
-			}
-			break;
-		case PF_RDR: {
-			if (pf_map_addr(pd->af, r, saddr, naddr, NULL, sn))
-				return (NULL);
-			if ((r->rpool.opts & PF_POOL_TYPEMASK) ==
-			    PF_POOL_BITMASK)
-				PF_POOLMASK(naddr, naddr,
-				    &r->rpool.cur->addr.v.a.mask, daddr,
-				    pd->af);
-
-			if (r->rpool.proxy_port[1]) {
-				u_int32_t	tmp_nport;
-
-				tmp_nport = ((ntohs(dport) -
-				    ntohs(r->dst.port[0])) %
-				    (r->rpool.proxy_port[1] -
-				    r->rpool.proxy_port[0] + 1)) +
-				    r->rpool.proxy_port[0];
-
-				/* wrap around if necessary */
-				if (tmp_nport > 65535)
-					tmp_nport -= 65535;
-				*nport = htons((u_int16_t)tmp_nport);
-			} else if (r->rpool.proxy_port[0])
-				*nport = htons(r->rpool.proxy_port[0]);
-			break;
-		}
-		default:
-			return (NULL);
-		}
-		/* 
-		 * Translation was a NOP.
-		 * Pretend there was no match.
-		 */
-		if (!bcmp(*skp, *nkp, sizeof(struct pf_state_key_cmp))) {
-#ifdef __FreeBSD__
-			pool_put(&V_pf_state_key_pl, *nkp);
-			pool_put(&V_pf_state_key_pl, *skp);
-#else
-			pool_put(&pf_state_key_pl, *nkp);
-			pool_put(&pf_state_key_pl, *skp);
-#endif
-			*skw = *sks = *nkp = *skp = NULL;
-			return (NULL);
-		}
-	}
-
-	return (r);
-}
-
diff --git a/sys/contrib/pf/net/pf_mtag.h b/sys/contrib/pf/net/pf_mtag.h
deleted file mode 100644
index 141a867998dc..000000000000
--- a/sys/contrib/pf/net/pf_mtag.h
+++ /dev/null
@@ -1,84 +0,0 @@
-/*	$FreeBSD$	*/
-/*
- * Copyright (c) 2001 Daniel Hartmeier
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *    - Redistributions of source code must retain the above copyright
- *      notice, this list of conditions and the following disclaimer.
- *    - Redistributions in binary form must reproduce the above
- *      copyright notice, this list of conditions and the following
- *      disclaimer in the documentation and/or other materials provided
- *      with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
- * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
- * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
- * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
- * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
- * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- *
- */
-
-#ifndef _NET_PF_MTAG_H_
-#define _NET_PF_MTAG_H_
-
-#ifdef _KERNEL
-
-#define	PF_TAG_GENERATED		0x01
-#define	PF_TAG_FRAGCACHE		0x02
-#define	PF_TAG_TRANSLATE_LOCALHOST	0x04
-#define	PF_PACKET_LOOPED		0x08
-#define	PF_FASTFWD_OURS_PRESENT		0x10
-
-struct pf_mtag {
-	void		*hdr;		/* saved hdr pos in mbuf, for ECN */
-	void		*statekey;	/* pf stackside statekey */
-	u_int32_t	 qid;		/* queue id */
-	u_int		 rtableid;	/* alternate routing table id */
-	u_int16_t	 tag;		/* tag id */
-	u_int8_t	 flags;
-	u_int8_t	 routed;
-};
-
-static __inline struct pf_mtag *pf_find_mtag(struct mbuf *);
-static __inline struct pf_mtag *pf_get_mtag(struct mbuf *);
-
-static __inline struct pf_mtag *
-pf_find_mtag(struct mbuf *m)
-{
-	struct m_tag	*mtag;
-
-	if ((mtag = m_tag_find(m, PACKET_TAG_PF, NULL)) == NULL)
-		return (NULL);
-
-	return ((struct pf_mtag *)(mtag + 1));
-}
-
-static __inline struct pf_mtag *
-pf_get_mtag(struct mbuf *m)
-{
-	struct m_tag	*mtag;
-
-	if ((mtag = m_tag_find(m, PACKET_TAG_PF, NULL)) == NULL) {
-		mtag = m_tag_get(PACKET_TAG_PF, sizeof(struct pf_mtag),
-		    M_NOWAIT);
-		if (mtag == NULL)
-			return (NULL);
-		bzero(mtag + 1, sizeof(struct pf_mtag));
-		m_tag_prepend(m, mtag);
-	}
-
-	return ((struct pf_mtag *)(mtag + 1));
-}
-#endif /* _KERNEL */
-#endif /* _NET_PF_MTAG_H_ */
diff --git a/sys/contrib/pf/net/pf_norm.c b/sys/contrib/pf/net/pf_norm.c
deleted file mode 100644
index 2b20c85b2464..000000000000
--- a/sys/contrib/pf/net/pf_norm.c
+++ /dev/null
@@ -1,2359 +0,0 @@
-/*	$OpenBSD: pf_norm.c,v 1.114 2009/01/29 14:11:45 henning Exp $ */
-
-/*
- * Copyright 2001 Niels Provos <provos@citi.umich.edu>
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifdef __FreeBSD__
-#include "opt_inet.h"
-#include "opt_inet6.h"
-#include "opt_pf.h"
-
-#include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
-
-#ifdef DEV_PFLOG
-#define	NPFLOG	DEV_PFLOG
-#else
-#define	NPFLOG	0
-#endif
-#else
-#include "pflog.h"
-#endif
-
-#include <sys/param.h>
-#include <sys/systm.h>
-#include <sys/mbuf.h>
-#include <sys/filio.h>
-#include <sys/fcntl.h>
-#include <sys/socket.h>
-#include <sys/kernel.h>
-#include <sys/time.h>
-#ifndef __FreeBSD__
-#include <sys/pool.h>
-
-#include <dev/rndvar.h>
-#endif
-#include <net/if.h>
-#include <net/if_types.h>
-#include <net/bpf.h>
-#include <net/route.h>
-#include <net/if_pflog.h>
-
-#include <netinet/in.h>
-#include <netinet/in_var.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#include <netinet/ip_var.h>
-#include <netinet/tcp.h>
-#include <netinet/tcp_seq.h>
-#include <netinet/udp.h>
-#include <netinet/ip_icmp.h>
-
-#ifdef INET6
-#include <netinet/ip6.h>
-#endif /* INET6 */
-
-#include <net/pfvar.h>
-
-#ifndef __FreeBSD__
-struct pf_frent {
-	LIST_ENTRY(pf_frent) fr_next;
-	struct ip *fr_ip;
-	struct mbuf *fr_m;
-};
-
-struct pf_frcache {
-	LIST_ENTRY(pf_frcache) fr_next;
-	uint16_t	fr_off;
-	uint16_t	fr_end;
-};
-#endif
-
-#define PFFRAG_SEENLAST	0x0001		/* Seen the last fragment for this */
-#define PFFRAG_NOBUFFER	0x0002		/* Non-buffering fragment cache */
-#define PFFRAG_DROP	0x0004		/* Drop all fragments */
-#define BUFFER_FRAGMENTS(fr)	(!((fr)->fr_flags & PFFRAG_NOBUFFER))
-
-#ifndef __FreeBSD__
-struct pf_fragment {
-	RB_ENTRY(pf_fragment) fr_entry;
-	TAILQ_ENTRY(pf_fragment) frag_next;
-	struct in_addr	fr_src;
-	struct in_addr	fr_dst;
-	u_int8_t	fr_p;		/* protocol of this fragment */
-	u_int8_t	fr_flags;	/* status flags */
-	u_int16_t	fr_id;		/* fragment id for reassemble */
-	u_int16_t	fr_max;		/* fragment data max */
-	u_int32_t	fr_timeout;
-#define fr_queue	fr_u.fru_queue
-#define fr_cache	fr_u.fru_cache
-	union {
-		LIST_HEAD(pf_fragq, pf_frent) fru_queue;	/* buffering */
-		LIST_HEAD(pf_cacheq, pf_frcache) fru_cache;	/* non-buf */
-	} fr_u;
-};
-#endif
-
-#ifdef __FreeBSD__
-TAILQ_HEAD(pf_fragqueue, pf_fragment);
-TAILQ_HEAD(pf_cachequeue, pf_fragment);
-VNET_DEFINE(struct pf_fragqueue,	pf_fragqueue);
-#define	V_pf_fragqueue			VNET(pf_fragqueue)
-VNET_DEFINE(struct pf_cachequeue,	pf_cachequeue);
-#define	V_pf_cachequeue			VNET(pf_cachequeue)
-#else
-TAILQ_HEAD(pf_fragqueue, pf_fragment)	pf_fragqueue;
-TAILQ_HEAD(pf_cachequeue, pf_fragment)	pf_cachequeue;
-#endif
-
-#ifndef __FreeBSD__
-static __inline int	 pf_frag_compare(struct pf_fragment *,
-			    struct pf_fragment *);
-#else
-static int		 pf_frag_compare(struct pf_fragment *,
-			    struct pf_fragment *);
-#endif
-
-#ifdef __FreeBSD__
-RB_HEAD(pf_frag_tree, pf_fragment);
-VNET_DEFINE(struct pf_frag_tree,	pf_frag_tree);
-#define	V_pf_frag_tree			VNET(pf_frag_tree)
-VNET_DEFINE(struct pf_frag_tree,	pf_cache_tree);
-#define	V_pf_cache_tree			VNET(pf_cache_tree)
-#else
-RB_HEAD(pf_frag_tree, pf_fragment)	pf_frag_tree, pf_cache_tree;
-#endif
-RB_PROTOTYPE(pf_frag_tree, pf_fragment, fr_entry, pf_frag_compare);
-RB_GENERATE(pf_frag_tree, pf_fragment, fr_entry, pf_frag_compare);
-
-/* Private prototypes */
-void			 pf_ip2key(struct pf_fragment *, struct ip *);
-void			 pf_remove_fragment(struct pf_fragment *);
-void			 pf_flush_fragments(void);
-void			 pf_free_fragment(struct pf_fragment *);
-struct pf_fragment	*pf_find_fragment(struct ip *, struct pf_frag_tree *);
-struct mbuf		*pf_reassemble(struct mbuf **, struct pf_fragment **,
-			    struct pf_frent *, int);
-struct mbuf		*pf_fragcache(struct mbuf **, struct ip*,
-			    struct pf_fragment **, int, int, int *);
-int			 pf_normalize_tcpopt(struct pf_rule *, struct mbuf *,
-			    struct tcphdr *, int, sa_family_t);
-void			 pf_scrub_ip(struct mbuf **, u_int32_t, u_int8_t,
-			    u_int8_t);
-#ifdef INET6
-void			 pf_scrub_ip6(struct mbuf **, u_int8_t);
-#endif
-#ifdef __FreeBSD__
-#define	DPFPRINTF(x) do {				\
-	if (V_pf_status.debug >= PF_DEBUG_MISC) {	\
-		printf("%s: ", __func__);		\
-		printf x ;				\
-	}						\
-} while(0)
-#else
-#define	DPFPRINTF(x) do {				\
-	if (pf_status.debug >= PF_DEBUG_MISC) {		\
-		printf("%s: ", __func__);		\
-		printf x ;				\
-	}						\
-} while(0)
-#endif
-
-/* Globals */
-#ifdef __FreeBSD__
-VNET_DEFINE(uma_zone_t,		pf_frent_pl);
-VNET_DEFINE(uma_zone_t,		pf_frag_pl);
-VNET_DEFINE(uma_zone_t,		pf_cache_pl);
-VNET_DEFINE(uma_zone_t,		pf_cent_pl);
-VNET_DEFINE(uma_zone_t,		pf_state_scrub_pl);
-
-VNET_DEFINE(int,		pf_nfrents);
-#define	V_pf_nfrents		VNET(pf_nfrents)
-VNET_DEFINE(int,		pf_ncache);
-#define	V_pf_ncache		VNET(pf_ncache)
-#else
-struct pool		 pf_frent_pl, pf_frag_pl, pf_cache_pl, pf_cent_pl;
-struct pool		 pf_state_scrub_pl;
-int			 pf_nfrents, pf_ncache;
-#endif
-
-void
-pf_normalize_init(void)
-{
-#ifdef __FreeBSD__
-	/*
-	 * XXX
-	 * No high water mark support(It's hint not hard limit).
-	 * uma_zone_set_max(pf_frag_pl, PFFRAG_FRAG_HIWAT);
-	 */
-	uma_zone_set_max(V_pf_frent_pl, PFFRAG_FRENT_HIWAT);
-	uma_zone_set_max(V_pf_cache_pl, PFFRAG_FRCACHE_HIWAT);
-	uma_zone_set_max(V_pf_cent_pl, PFFRAG_FRCENT_HIWAT);
-#else
-	pool_init(&pf_frent_pl, sizeof(struct pf_frent), 0, 0, 0, "pffrent",
-	    NULL);
-	pool_init(&pf_frag_pl, sizeof(struct pf_fragment), 0, 0, 0, "pffrag",
-	    NULL);
-	pool_init(&pf_cache_pl, sizeof(struct pf_fragment), 0, 0, 0,
-	    "pffrcache", NULL);
-	pool_init(&pf_cent_pl, sizeof(struct pf_frcache), 0, 0, 0, "pffrcent",
-	    NULL);
-	pool_init(&pf_state_scrub_pl, sizeof(struct pf_state_scrub), 0, 0, 0,
-	    "pfstscr", NULL);
-
-	pool_sethiwat(&pf_frag_pl, PFFRAG_FRAG_HIWAT);
-	pool_sethardlimit(&pf_frent_pl, PFFRAG_FRENT_HIWAT, NULL, 0);
-	pool_sethardlimit(&pf_cache_pl, PFFRAG_FRCACHE_HIWAT, NULL, 0);
-	pool_sethardlimit(&pf_cent_pl, PFFRAG_FRCENT_HIWAT, NULL, 0);
-#endif
-
-#ifdef __FreeBSD__
-	TAILQ_INIT(&V_pf_fragqueue);
-	TAILQ_INIT(&V_pf_cachequeue);
-#else
-	TAILQ_INIT(&pf_fragqueue);
-	TAILQ_INIT(&pf_cachequeue);
-#endif
-}
-
-#ifdef __FreeBSD__
-static int
-#else
-static __inline int
-#endif
-pf_frag_compare(struct pf_fragment *a, struct pf_fragment *b)
-{
-	int	diff;
-
-	if ((diff = a->fr_id - b->fr_id))
-		return (diff);
-	else if ((diff = a->fr_p - b->fr_p))
-		return (diff);
-	else if (a->fr_src.s_addr < b->fr_src.s_addr)
-		return (-1);
-	else if (a->fr_src.s_addr > b->fr_src.s_addr)
-		return (1);
-	else if (a->fr_dst.s_addr < b->fr_dst.s_addr)
-		return (-1);
-	else if (a->fr_dst.s_addr > b->fr_dst.s_addr)
-		return (1);
-	return (0);
-}
-
-void
-pf_purge_expired_fragments(void)
-{
-	struct pf_fragment	*frag;
-#ifdef __FreeBSD__
-	u_int32_t		 expire = time_second -
-				    V_pf_default_rule.timeout[PFTM_FRAG];
-#else
-	u_int32_t		 expire = time_second -
-				    pf_default_rule.timeout[PFTM_FRAG];
-#endif
-
-#ifdef __FreeBSD__
-	while ((frag = TAILQ_LAST(&V_pf_fragqueue, pf_fragqueue)) != NULL) {
-		KASSERT((BUFFER_FRAGMENTS(frag)),
-		    ("BUFFER_FRAGMENTS(frag) == 0: %s", __FUNCTION__));
-#else
-	while ((frag = TAILQ_LAST(&pf_fragqueue, pf_fragqueue)) != NULL) {
-		KASSERT(BUFFER_FRAGMENTS(frag));
-#endif
-		if (frag->fr_timeout > expire)
-			break;
-
-		DPFPRINTF(("expiring %d(%p)\n", frag->fr_id, frag));
-		pf_free_fragment(frag);
-	}
-
-#ifdef __FreeBSD__
-	while ((frag = TAILQ_LAST(&V_pf_cachequeue, pf_cachequeue)) != NULL) {
-		KASSERT((!BUFFER_FRAGMENTS(frag)),
-		    ("BUFFER_FRAGMENTS(frag) != 0: %s", __FUNCTION__));
-#else
-	while ((frag = TAILQ_LAST(&pf_cachequeue, pf_cachequeue)) != NULL) {
-		KASSERT(!BUFFER_FRAGMENTS(frag));
-#endif
-		if (frag->fr_timeout > expire)
-			break;
-
-		DPFPRINTF(("expiring %d(%p)\n", frag->fr_id, frag));
-		pf_free_fragment(frag);
-#ifdef __FreeBSD__
-		KASSERT((TAILQ_EMPTY(&V_pf_cachequeue) ||
-		    TAILQ_LAST(&V_pf_cachequeue, pf_cachequeue) != frag),
-		    ("!(TAILQ_EMPTY() || TAILQ_LAST() == farg): %s",
-		    __FUNCTION__));
-#else
-		KASSERT(TAILQ_EMPTY(&pf_cachequeue) ||
-		    TAILQ_LAST(&pf_cachequeue, pf_cachequeue) != frag);
-#endif
-	}
-}
-
-/*
- * Try to flush old fragments to make space for new ones
- */
-
-void
-pf_flush_fragments(void)
-{
-	struct pf_fragment	*frag;
-	int			 goal;
-
-#ifdef __FreeBSD__
-	goal = V_pf_nfrents * 9 / 10;
-	DPFPRINTF(("trying to free > %d frents\n",
-	    V_pf_nfrents - goal));
-	while (goal < V_pf_nfrents) {
-#else
-	goal = pf_nfrents * 9 / 10;
-	DPFPRINTF(("trying to free > %d frents\n",
-	    pf_nfrents - goal));
-	while (goal < pf_nfrents) {
-#endif
-#ifdef __FreeBSD__
-		frag = TAILQ_LAST(&V_pf_fragqueue, pf_fragqueue);
-#else
-		frag = TAILQ_LAST(&pf_fragqueue, pf_fragqueue);
-#endif
-		if (frag == NULL)
-			break;
-		pf_free_fragment(frag);
-	}
-
-
-#ifdef __FreeBSD__
-	goal = V_pf_ncache * 9 / 10;
-	DPFPRINTF(("trying to free > %d cache entries\n",
-	    V_pf_ncache - goal));
-	while (goal < V_pf_ncache) {
-#else
-	goal = pf_ncache * 9 / 10;
-	DPFPRINTF(("trying to free > %d cache entries\n",
-	    pf_ncache - goal));
-	while (goal < pf_ncache) {
-#endif
-#ifdef __FreeBSD__
-		frag = TAILQ_LAST(&V_pf_cachequeue, pf_cachequeue);
-#else
-		frag = TAILQ_LAST(&pf_cachequeue, pf_cachequeue);
-#endif
-		if (frag == NULL)
-			break;
-		pf_free_fragment(frag);
-	}
-}
-
-/* Frees the fragments and all associated entries */
-
-void
-pf_free_fragment(struct pf_fragment *frag)
-{
-	struct pf_frent		*frent;
-	struct pf_frcache	*frcache;
-
-	/* Free all fragments */
-	if (BUFFER_FRAGMENTS(frag)) {
-		for (frent = LIST_FIRST(&frag->fr_queue); frent;
-		    frent = LIST_FIRST(&frag->fr_queue)) {
-			LIST_REMOVE(frent, fr_next);
-
-			m_freem(frent->fr_m);
-#ifdef __FreeBSD__
-			pool_put(&V_pf_frent_pl, frent);
-			V_pf_nfrents--;
-#else
-			pool_put(&pf_frent_pl, frent);
-			pf_nfrents--;
-#endif
-		}
-	} else {
-		for (frcache = LIST_FIRST(&frag->fr_cache); frcache;
-		    frcache = LIST_FIRST(&frag->fr_cache)) {
-			LIST_REMOVE(frcache, fr_next);
-
-#ifdef __FreeBSD__
-			KASSERT((LIST_EMPTY(&frag->fr_cache) ||
-			    LIST_FIRST(&frag->fr_cache)->fr_off >
-			    frcache->fr_end),
-			    ("! (LIST_EMPTY() || LIST_FIRST()->fr_off >"
-			      " frcache->fr_end): %s", __FUNCTION__));
-
-			pool_put(&V_pf_cent_pl, frcache);
-			V_pf_ncache--;
-#else
-			KASSERT(LIST_EMPTY(&frag->fr_cache) ||
-			    LIST_FIRST(&frag->fr_cache)->fr_off >
-			    frcache->fr_end);
-
-			pool_put(&pf_cent_pl, frcache);
-			pf_ncache--;
-#endif
-		}
-	}
-
-	pf_remove_fragment(frag);
-}
-
-void
-pf_ip2key(struct pf_fragment *key, struct ip *ip)
-{
-	key->fr_p = ip->ip_p;
-	key->fr_id = ip->ip_id;
-	key->fr_src.s_addr = ip->ip_src.s_addr;
-	key->fr_dst.s_addr = ip->ip_dst.s_addr;
-}
-
-struct pf_fragment *
-pf_find_fragment(struct ip *ip, struct pf_frag_tree *tree)
-{
-	struct pf_fragment	 key;
-	struct pf_fragment	*frag;
-
-	pf_ip2key(&key, ip);
-
-	frag = RB_FIND(pf_frag_tree, tree, &key);
-	if (frag != NULL) {
-		/* XXX Are we sure we want to update the timeout? */
-		frag->fr_timeout = time_second;
-		if (BUFFER_FRAGMENTS(frag)) {
-#ifdef __FreeBSD__
-			TAILQ_REMOVE(&V_pf_fragqueue, frag, frag_next);
-			TAILQ_INSERT_HEAD(&V_pf_fragqueue, frag, frag_next);
-#else
-			TAILQ_REMOVE(&pf_fragqueue, frag, frag_next);
-			TAILQ_INSERT_HEAD(&pf_fragqueue, frag, frag_next);
-#endif
-		} else {
-#ifdef __FreeBSD__
-			TAILQ_REMOVE(&V_pf_cachequeue, frag, frag_next);
-			TAILQ_INSERT_HEAD(&V_pf_cachequeue, frag, frag_next);
-#else
-			TAILQ_REMOVE(&pf_cachequeue, frag, frag_next);
-			TAILQ_INSERT_HEAD(&pf_cachequeue, frag, frag_next);
-#endif
-		}
-	}
-
-	return (frag);
-}
-
-/* Removes a fragment from the fragment queue and frees the fragment */
-
-void
-pf_remove_fragment(struct pf_fragment *frag)
-{
-	if (BUFFER_FRAGMENTS(frag)) {
-#ifdef __FreeBSD__
-		RB_REMOVE(pf_frag_tree, &V_pf_frag_tree, frag);
-		TAILQ_REMOVE(&V_pf_fragqueue, frag, frag_next);
-		pool_put(&V_pf_frag_pl, frag);
-#else
-		RB_REMOVE(pf_frag_tree, &pf_frag_tree, frag);
-		TAILQ_REMOVE(&pf_fragqueue, frag, frag_next);
-		pool_put(&pf_frag_pl, frag);
-#endif
-	} else {
-#ifdef __FreeBSD__
-		RB_REMOVE(pf_frag_tree, &V_pf_cache_tree, frag);
-		TAILQ_REMOVE(&V_pf_cachequeue, frag, frag_next);
-		pool_put(&V_pf_cache_pl, frag);
-#else
-		RB_REMOVE(pf_frag_tree, &pf_cache_tree, frag);
-		TAILQ_REMOVE(&pf_cachequeue, frag, frag_next);
-		pool_put(&pf_cache_pl, frag);
-#endif
-	}
-}
-
-#define FR_IP_OFF(fr)	((ntohs((fr)->fr_ip->ip_off) & IP_OFFMASK) << 3)
-struct mbuf *
-pf_reassemble(struct mbuf **m0, struct pf_fragment **frag,
-    struct pf_frent *frent, int mff)
-{
-	struct mbuf	*m = *m0, *m2;
-	struct pf_frent	*frea, *next;
-	struct pf_frent	*frep = NULL;
-	struct ip	*ip = frent->fr_ip;
-	int		 hlen = ip->ip_hl << 2;
-	u_int16_t	 off = (ntohs(ip->ip_off) & IP_OFFMASK) << 3;
-	u_int16_t	 ip_len = ntohs(ip->ip_len) - ip->ip_hl * 4;
-	u_int16_t	 max = ip_len + off;
-
-#ifdef __FreeBSD__
-	KASSERT((*frag == NULL || BUFFER_FRAGMENTS(*frag)),
-	    ("! (*frag == NULL || BUFFER_FRAGMENTS(*frag)): %s", __FUNCTION__));
-#else
-	KASSERT(*frag == NULL || BUFFER_FRAGMENTS(*frag));
-#endif
-
-	/* Strip off ip header */
-	m->m_data += hlen;
-	m->m_len -= hlen;
-
-	/* Create a new reassembly queue for this packet */
-	if (*frag == NULL) {
-#ifdef __FreeBSD__
-		*frag = pool_get(&V_pf_frag_pl, PR_NOWAIT);
-#else
-		*frag = pool_get(&pf_frag_pl, PR_NOWAIT);
-#endif
-		if (*frag == NULL) {
-			pf_flush_fragments();
-#ifdef __FreeBSD__
-			*frag = pool_get(&V_pf_frag_pl, PR_NOWAIT);
-#else
-			*frag = pool_get(&pf_frag_pl, PR_NOWAIT);
-#endif
-			if (*frag == NULL)
-				goto drop_fragment;
-		}
-
-		(*frag)->fr_flags = 0;
-		(*frag)->fr_max = 0;
-		(*frag)->fr_src = frent->fr_ip->ip_src;
-		(*frag)->fr_dst = frent->fr_ip->ip_dst;
-		(*frag)->fr_p = frent->fr_ip->ip_p;
-		(*frag)->fr_id = frent->fr_ip->ip_id;
-		(*frag)->fr_timeout = time_second;
-		LIST_INIT(&(*frag)->fr_queue);
-
-#ifdef __FreeBSD__
-		RB_INSERT(pf_frag_tree, &V_pf_frag_tree, *frag);
-		TAILQ_INSERT_HEAD(&V_pf_fragqueue, *frag, frag_next);
-#else
-		RB_INSERT(pf_frag_tree, &pf_frag_tree, *frag);
-		TAILQ_INSERT_HEAD(&pf_fragqueue, *frag, frag_next);
-#endif
-
-		/* We do not have a previous fragment */
-		frep = NULL;
-		goto insert;
-	}
-
-	/*
-	 * Find a fragment after the current one:
-	 *  - off contains the real shifted offset.
-	 */
-	LIST_FOREACH(frea, &(*frag)->fr_queue, fr_next) {
-		if (FR_IP_OFF(frea) > off)
-			break;
-		frep = frea;
-	}
-
-#ifdef __FreeBSD__
-	KASSERT((frep != NULL || frea != NULL),
-	    ("!(frep != NULL || frea != NULL): %s", __FUNCTION__));;
-#else
-	KASSERT(frep != NULL || frea != NULL);
-#endif
-
-	if (frep != NULL &&
-	    FR_IP_OFF(frep) + ntohs(frep->fr_ip->ip_len) - frep->fr_ip->ip_hl *
-	    4 > off)
-	{
-		u_int16_t	precut;
-
-		precut = FR_IP_OFF(frep) + ntohs(frep->fr_ip->ip_len) -
-		    frep->fr_ip->ip_hl * 4 - off;
-		if (precut >= ip_len)
-			goto drop_fragment;
-		m_adj(frent->fr_m, precut);
-		DPFPRINTF(("overlap -%d\n", precut));
-		/* Enforce 8 byte boundaries */
-		ip->ip_off = htons(ntohs(ip->ip_off) + (precut >> 3));
-		off = (ntohs(ip->ip_off) & IP_OFFMASK) << 3;
-		ip_len -= precut;
-		ip->ip_len = htons(ip_len);
-	}
-
-	for (; frea != NULL && ip_len + off > FR_IP_OFF(frea);
-	    frea = next)
-	{
-		u_int16_t	aftercut;
-
-		aftercut = ip_len + off - FR_IP_OFF(frea);
-		DPFPRINTF(("adjust overlap %d\n", aftercut));
-		if (aftercut < ntohs(frea->fr_ip->ip_len) - frea->fr_ip->ip_hl
-		    * 4)
-		{
-			frea->fr_ip->ip_len =
-			    htons(ntohs(frea->fr_ip->ip_len) - aftercut);
-			frea->fr_ip->ip_off = htons(ntohs(frea->fr_ip->ip_off) +
-			    (aftercut >> 3));
-			m_adj(frea->fr_m, aftercut);
-			break;
-		}
-
-		/* This fragment is completely overlapped, lose it */
-		next = LIST_NEXT(frea, fr_next);
-		m_freem(frea->fr_m);
-		LIST_REMOVE(frea, fr_next);
-#ifdef __FreeBSD__
-		pool_put(&V_pf_frent_pl, frea);
-		V_pf_nfrents--;
-#else
-		pool_put(&pf_frent_pl, frea);
-		pf_nfrents--;
-#endif
-	}
-
- insert:
-	/* Update maximum data size */
-	if ((*frag)->fr_max < max)
-		(*frag)->fr_max = max;
-	/* This is the last segment */
-	if (!mff)
-		(*frag)->fr_flags |= PFFRAG_SEENLAST;
-
-	if (frep == NULL)
-		LIST_INSERT_HEAD(&(*frag)->fr_queue, frent, fr_next);
-	else
-		LIST_INSERT_AFTER(frep, frent, fr_next);
-
-	/* Check if we are completely reassembled */
-	if (!((*frag)->fr_flags & PFFRAG_SEENLAST))
-		return (NULL);
-
-	/* Check if we have all the data */
-	off = 0;
-	for (frep = LIST_FIRST(&(*frag)->fr_queue); frep; frep = next) {
-		next = LIST_NEXT(frep, fr_next);
-
-		off += ntohs(frep->fr_ip->ip_len) - frep->fr_ip->ip_hl * 4;
-		if (off < (*frag)->fr_max &&
-		    (next == NULL || FR_IP_OFF(next) != off))
-		{
-			DPFPRINTF(("missing fragment at %d, next %d, max %d\n",
-			    off, next == NULL ? -1 : FR_IP_OFF(next),
-			    (*frag)->fr_max));
-			return (NULL);
-		}
-	}
-	DPFPRINTF(("%d < %d?\n", off, (*frag)->fr_max));
-	if (off < (*frag)->fr_max)
-		return (NULL);
-
-	/* We have all the data */
-	frent = LIST_FIRST(&(*frag)->fr_queue);
-#ifdef __FreeBSD__
-	KASSERT((frent != NULL), ("frent == NULL: %s", __FUNCTION__));
-#else
-	KASSERT(frent != NULL);
-#endif
-	if ((frent->fr_ip->ip_hl << 2) + off > IP_MAXPACKET) {
-		DPFPRINTF(("drop: too big: %d\n", off));
-		pf_free_fragment(*frag);
-		*frag = NULL;
-		return (NULL);
-	}
-	next = LIST_NEXT(frent, fr_next);
-
-	/* Magic from ip_input */
-	ip = frent->fr_ip;
-	m = frent->fr_m;
-	m2 = m->m_next;
-	m->m_next = NULL;
-	m_cat(m, m2);
-#ifdef __FreeBSD__
-	pool_put(&V_pf_frent_pl, frent);
-	V_pf_nfrents--;
-#else
-	pool_put(&pf_frent_pl, frent);
-	pf_nfrents--;
-#endif
-	for (frent = next; frent != NULL; frent = next) {
-		next = LIST_NEXT(frent, fr_next);
-
-		m2 = frent->fr_m;
-#ifdef __FreeBSD__
-		pool_put(&V_pf_frent_pl, frent);
-		V_pf_nfrents--;
-#else
-		pool_put(&pf_frent_pl, frent);
-		pf_nfrents--;
-#endif
-#ifdef __FreeBSD__
-		m->m_pkthdr.csum_flags &= m2->m_pkthdr.csum_flags;
-		m->m_pkthdr.csum_data += m2->m_pkthdr.csum_data;
-#endif
-		m_cat(m, m2);
-	}
-
-#ifdef __FreeBSD__
-	while (m->m_pkthdr.csum_data & 0xffff0000)
-		m->m_pkthdr.csum_data = (m->m_pkthdr.csum_data & 0xffff) +
-		    (m->m_pkthdr.csum_data >> 16);
-#endif
-	ip->ip_src = (*frag)->fr_src;
-	ip->ip_dst = (*frag)->fr_dst;
-
-	/* Remove from fragment queue */
-	pf_remove_fragment(*frag);
-	*frag = NULL;
-
-	hlen = ip->ip_hl << 2;
-	ip->ip_len = htons(off + hlen);
-	m->m_len += hlen;
-	m->m_data -= hlen;
-
-	/* some debugging cruft by sklower, below, will go away soon */
-	/* XXX this should be done elsewhere */
-	if (m->m_flags & M_PKTHDR) {
-		int plen = 0;
-		for (m2 = m; m2; m2 = m2->m_next)
-			plen += m2->m_len;
-		m->m_pkthdr.len = plen;
-	}
-
-	DPFPRINTF(("complete: %p(%d)\n", m, ntohs(ip->ip_len)));
-	return (m);
-
- drop_fragment:
-	/* Oops - fail safe - drop packet */
-#ifdef __FreeBSD__
-	pool_put(&V_pf_frent_pl, frent);
-	V_pf_nfrents--;
-#else
-	pool_put(&pf_frent_pl, frent);
-	pf_nfrents--;
-#endif
-	m_freem(m);
-	return (NULL);
-}
-
-struct mbuf *
-pf_fragcache(struct mbuf **m0, struct ip *h, struct pf_fragment **frag, int mff,
-    int drop, int *nomem)
-{
-	struct mbuf		*m = *m0;
-	struct pf_frcache	*frp, *fra, *cur = NULL;
-	int			 ip_len = ntohs(h->ip_len) - (h->ip_hl << 2);
-	u_int16_t		 off = ntohs(h->ip_off) << 3;
-	u_int16_t		 max = ip_len + off;
-	int			 hosed = 0;
-
-#ifdef __FreeBSD__
-	KASSERT((*frag == NULL || !BUFFER_FRAGMENTS(*frag)),
-	    ("!(*frag == NULL || !BUFFER_FRAGMENTS(*frag)): %s", __FUNCTION__));
-#else
-	KASSERT(*frag == NULL || !BUFFER_FRAGMENTS(*frag));
-#endif
-
-	/* Create a new range queue for this packet */
-	if (*frag == NULL) {
-#ifdef __FreeBSD__
-		*frag = pool_get(&V_pf_cache_pl, PR_NOWAIT);
-#else
-		*frag = pool_get(&pf_cache_pl, PR_NOWAIT);
-#endif
-		if (*frag == NULL) {
-			pf_flush_fragments();
-#ifdef __FreeBSD__
-			*frag = pool_get(&V_pf_cache_pl, PR_NOWAIT);
-#else
-			*frag = pool_get(&pf_cache_pl, PR_NOWAIT);
-#endif
-			if (*frag == NULL)
-				goto no_mem;
-		}
-
-		/* Get an entry for the queue */
-#ifdef __FreeBSD__
-		cur = pool_get(&V_pf_cent_pl, PR_NOWAIT);
-		if (cur == NULL) {
-			pool_put(&V_pf_cache_pl, *frag);
-#else
-		cur = pool_get(&pf_cent_pl, PR_NOWAIT);
-		if (cur == NULL) {
-			pool_put(&pf_cache_pl, *frag);
-#endif
-			*frag = NULL;
-			goto no_mem;
-		}
-#ifdef __FreeBSD__
-		V_pf_ncache++;
-#else
-		pf_ncache++;
-#endif
-
-		(*frag)->fr_flags = PFFRAG_NOBUFFER;
-		(*frag)->fr_max = 0;
-		(*frag)->fr_src = h->ip_src;
-		(*frag)->fr_dst = h->ip_dst;
-		(*frag)->fr_p = h->ip_p;
-		(*frag)->fr_id = h->ip_id;
-		(*frag)->fr_timeout = time_second;
-
-		cur->fr_off = off;
-		cur->fr_end = max;
-		LIST_INIT(&(*frag)->fr_cache);
-		LIST_INSERT_HEAD(&(*frag)->fr_cache, cur, fr_next);
-
-#ifdef __FreeBSD__
-		RB_INSERT(pf_frag_tree, &V_pf_cache_tree, *frag);
-		TAILQ_INSERT_HEAD(&V_pf_cachequeue, *frag, frag_next);
-#else
-		RB_INSERT(pf_frag_tree, &pf_cache_tree, *frag);
-		TAILQ_INSERT_HEAD(&pf_cachequeue, *frag, frag_next);
-#endif
-
-		DPFPRINTF(("fragcache[%d]: new %d-%d\n", h->ip_id, off, max));
-
-		goto pass;
-	}
-
-	/*
-	 * Find a fragment after the current one:
-	 *  - off contains the real shifted offset.
-	 */
-	frp = NULL;
-	LIST_FOREACH(fra, &(*frag)->fr_cache, fr_next) {
-		if (fra->fr_off > off)
-			break;
-		frp = fra;
-	}
-
-#ifdef __FreeBSD__
-	KASSERT((frp != NULL || fra != NULL),
-	    ("!(frp != NULL || fra != NULL): %s", __FUNCTION__));
-#else
-	KASSERT(frp != NULL || fra != NULL);
-#endif
-
-	if (frp != NULL) {
-		int	precut;
-
-		precut = frp->fr_end - off;
-		if (precut >= ip_len) {
-			/* Fragment is entirely a duplicate */
-			DPFPRINTF(("fragcache[%d]: dead (%d-%d) %d-%d\n",
-			    h->ip_id, frp->fr_off, frp->fr_end, off, max));
-			goto drop_fragment;
-		}
-		if (precut == 0) {
-			/* They are adjacent.  Fixup cache entry */
-			DPFPRINTF(("fragcache[%d]: adjacent (%d-%d) %d-%d\n",
-			    h->ip_id, frp->fr_off, frp->fr_end, off, max));
-			frp->fr_end = max;
-		} else if (precut > 0) {
-			/* The first part of this payload overlaps with a
-			 * fragment that has already been passed.
-			 * Need to trim off the first part of the payload.
-			 * But to do so easily, we need to create another
-			 * mbuf to throw the original header into.
-			 */
-
-			DPFPRINTF(("fragcache[%d]: chop %d (%d-%d) %d-%d\n",
-			    h->ip_id, precut, frp->fr_off, frp->fr_end, off,
-			    max));
-
-			off += precut;
-			max -= precut;
-			/* Update the previous frag to encompass this one */
-			frp->fr_end = max;
-
-			if (!drop) {
-				/* XXX Optimization opportunity
-				 * This is a very heavy way to trim the payload.
-				 * we could do it much faster by diddling mbuf
-				 * internals but that would be even less legible
-				 * than this mbuf magic.  For my next trick,
-				 * I'll pull a rabbit out of my laptop.
-				 */
-#ifdef __FreeBSD__
-				*m0 = m_dup(m, M_DONTWAIT);
-#else
-				*m0 = m_copym2(m, 0, h->ip_hl << 2, M_NOWAIT);
-#endif
-				if (*m0 == NULL)
-					goto no_mem;
-#ifdef __FreeBSD__
-				/* From KAME Project : We have missed this! */
-				m_adj(*m0, (h->ip_hl << 2) -
-				    (*m0)->m_pkthdr.len);
-
-				KASSERT(((*m0)->m_next == NULL), 
-				    ("(*m0)->m_next != NULL: %s", 
-				    __FUNCTION__));
-#else
-				KASSERT((*m0)->m_next == NULL);
-#endif
-				m_adj(m, precut + (h->ip_hl << 2));
-				m_cat(*m0, m);
-				m = *m0;
-				if (m->m_flags & M_PKTHDR) {
-					int plen = 0;
-					struct mbuf *t;
-					for (t = m; t; t = t->m_next)
-						plen += t->m_len;
-					m->m_pkthdr.len = plen;
-				}
-
-
-				h = mtod(m, struct ip *);
-
-#ifdef __FreeBSD__
-				KASSERT(((int)m->m_len ==
-				    ntohs(h->ip_len) - precut),
-				    ("m->m_len != ntohs(h->ip_len) - precut: %s",
-				    __FUNCTION__));
-#else
-				KASSERT((int)m->m_len ==
-				    ntohs(h->ip_len) - precut);
-#endif
-				h->ip_off = htons(ntohs(h->ip_off) +
-				    (precut >> 3));
-				h->ip_len = htons(ntohs(h->ip_len) - precut);
-			} else {
-				hosed++;
-			}
-		} else {
-			/* There is a gap between fragments */
-
-			DPFPRINTF(("fragcache[%d]: gap %d (%d-%d) %d-%d\n",
-			    h->ip_id, -precut, frp->fr_off, frp->fr_end, off,
-			    max));
-
-#ifdef __FreeBSD__
-			cur = pool_get(&V_pf_cent_pl, PR_NOWAIT);
-#else
-			cur = pool_get(&pf_cent_pl, PR_NOWAIT);
-#endif
-			if (cur == NULL)
-				goto no_mem;
-#ifdef __FreeBSD__
-			V_pf_ncache++;
-#else
-			pf_ncache++;
-#endif
-
-			cur->fr_off = off;
-			cur->fr_end = max;
-			LIST_INSERT_AFTER(frp, cur, fr_next);
-		}
-	}
-
-	if (fra != NULL) {
-		int	aftercut;
-		int	merge = 0;
-
-		aftercut = max - fra->fr_off;
-		if (aftercut == 0) {
-			/* Adjacent fragments */
-			DPFPRINTF(("fragcache[%d]: adjacent %d-%d (%d-%d)\n",
-			    h->ip_id, off, max, fra->fr_off, fra->fr_end));
-			fra->fr_off = off;
-			merge = 1;
-		} else if (aftercut > 0) {
-			/* Need to chop off the tail of this fragment */
-			DPFPRINTF(("fragcache[%d]: chop %d %d-%d (%d-%d)\n",
-			    h->ip_id, aftercut, off, max, fra->fr_off,
-			    fra->fr_end));
-			fra->fr_off = off;
-			max -= aftercut;
-
-			merge = 1;
-
-			if (!drop) {
-				m_adj(m, -aftercut);
-				if (m->m_flags & M_PKTHDR) {
-					int plen = 0;
-					struct mbuf *t;
-					for (t = m; t; t = t->m_next)
-						plen += t->m_len;
-					m->m_pkthdr.len = plen;
-				}
-				h = mtod(m, struct ip *);
-#ifdef __FreeBSD__
-				KASSERT(((int)m->m_len == ntohs(h->ip_len) - aftercut),
-				    ("m->m_len != ntohs(h->ip_len) - aftercut: %s",
-				    __FUNCTION__));
-#else
-				KASSERT((int)m->m_len ==
-				    ntohs(h->ip_len) - aftercut);
-#endif
-				h->ip_len = htons(ntohs(h->ip_len) - aftercut);
-			} else {
-				hosed++;
-			}
-		} else if (frp == NULL) {
-			/* There is a gap between fragments */
-			DPFPRINTF(("fragcache[%d]: gap %d %d-%d (%d-%d)\n",
-			    h->ip_id, -aftercut, off, max, fra->fr_off,
-			    fra->fr_end));
-
-#ifdef __FreeBSD__
-			cur = pool_get(&V_pf_cent_pl, PR_NOWAIT);
-#else
-			cur = pool_get(&pf_cent_pl, PR_NOWAIT);
-#endif
-			if (cur == NULL)
-				goto no_mem;
-#ifdef __FreeBSD__
-			V_pf_ncache++;
-#else
-			pf_ncache++;
-#endif
-
-			cur->fr_off = off;
-			cur->fr_end = max;
-			LIST_INSERT_BEFORE(fra, cur, fr_next);
-		}
-
-
-		/* Need to glue together two separate fragment descriptors */
-		if (merge) {
-			if (cur && fra->fr_off <= cur->fr_end) {
-				/* Need to merge in a previous 'cur' */
-				DPFPRINTF(("fragcache[%d]: adjacent(merge "
-				    "%d-%d) %d-%d (%d-%d)\n",
-				    h->ip_id, cur->fr_off, cur->fr_end, off,
-				    max, fra->fr_off, fra->fr_end));
-				fra->fr_off = cur->fr_off;
-				LIST_REMOVE(cur, fr_next);
-#ifdef __FreeBSD__
-				pool_put(&V_pf_cent_pl, cur);
-				V_pf_ncache--;
-#else
-				pool_put(&pf_cent_pl, cur);
-				pf_ncache--;
-#endif
-				cur = NULL;
-
-			} else if (frp && fra->fr_off <= frp->fr_end) {
-				/* Need to merge in a modified 'frp' */
-#ifdef __FreeBSD__
-				KASSERT((cur == NULL), ("cur != NULL: %s",
-				    __FUNCTION__));
-#else
-				KASSERT(cur == NULL);
-#endif
-				DPFPRINTF(("fragcache[%d]: adjacent(merge "
-				    "%d-%d) %d-%d (%d-%d)\n",
-				    h->ip_id, frp->fr_off, frp->fr_end, off,
-				    max, fra->fr_off, fra->fr_end));
-				fra->fr_off = frp->fr_off;
-				LIST_REMOVE(frp, fr_next);
-#ifdef __FreeBSD__
-				pool_put(&V_pf_cent_pl, frp);
-				V_pf_ncache--;
-#else
-				pool_put(&pf_cent_pl, frp);
-				pf_ncache--;
-#endif
-				frp = NULL;
-
-			}
-		}
-	}
-
-	if (hosed) {
-		/*
-		 * We must keep tracking the overall fragment even when
-		 * we're going to drop it anyway so that we know when to
-		 * free the overall descriptor.  Thus we drop the frag late.
-		 */
-		goto drop_fragment;
-	}
-
-
- pass:
-	/* Update maximum data size */
-	if ((*frag)->fr_max < max)
-		(*frag)->fr_max = max;
-
-	/* This is the last segment */
-	if (!mff)
-		(*frag)->fr_flags |= PFFRAG_SEENLAST;
-
-	/* Check if we are completely reassembled */
-	if (((*frag)->fr_flags & PFFRAG_SEENLAST) &&
-	    LIST_FIRST(&(*frag)->fr_cache)->fr_off == 0 &&
-	    LIST_FIRST(&(*frag)->fr_cache)->fr_end == (*frag)->fr_max) {
-		/* Remove from fragment queue */
-		DPFPRINTF(("fragcache[%d]: done 0-%d\n", h->ip_id,
-		    (*frag)->fr_max));
-		pf_free_fragment(*frag);
-		*frag = NULL;
-	}
-
-	return (m);
-
- no_mem:
-	*nomem = 1;
-
-	/* Still need to pay attention to !IP_MF */
-	if (!mff && *frag != NULL)
-		(*frag)->fr_flags |= PFFRAG_SEENLAST;
-
-	m_freem(m);
-	return (NULL);
-
- drop_fragment:
-
-	/* Still need to pay attention to !IP_MF */
-	if (!mff && *frag != NULL)
-		(*frag)->fr_flags |= PFFRAG_SEENLAST;
-
-	if (drop) {
-		/* This fragment has been deemed bad.  Don't reass */
-		if (((*frag)->fr_flags & PFFRAG_DROP) == 0)
-			DPFPRINTF(("fragcache[%d]: dropping overall fragment\n",
-			    h->ip_id));
-		(*frag)->fr_flags |= PFFRAG_DROP;
-	}
-
-	m_freem(m);
-	return (NULL);
-}
-
-#ifdef INET
-int
-pf_normalize_ip(struct mbuf **m0, int dir, struct pfi_kif *kif, u_short *reason,
-    struct pf_pdesc *pd)
-{
-	struct mbuf		*m = *m0;
-	struct pf_rule		*r;
-	struct pf_frent		*frent;
-	struct pf_fragment	*frag = NULL;
-	struct ip		*h = mtod(m, struct ip *);
-	int			 mff = (ntohs(h->ip_off) & IP_MF);
-	int			 hlen = h->ip_hl << 2;
-	u_int16_t		 fragoff = (ntohs(h->ip_off) & IP_OFFMASK) << 3;
-	u_int16_t		 max;
-	int			 ip_len;
-	int			 ip_off;
-	int			 tag = -1;
-
-	r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_SCRUB].active.ptr);
-	while (r != NULL) {
-		r->evaluations++;
-		if (pfi_kif_match(r->kif, kif) == r->ifnot)
-			r = r->skip[PF_SKIP_IFP].ptr;
-		else if (r->direction && r->direction != dir)
-			r = r->skip[PF_SKIP_DIR].ptr;
-		else if (r->af && r->af != AF_INET)
-			r = r->skip[PF_SKIP_AF].ptr;
-		else if (r->proto && r->proto != h->ip_p)
-			r = r->skip[PF_SKIP_PROTO].ptr;
-		else if (PF_MISMATCHAW(&r->src.addr,
-		    (struct pf_addr *)&h->ip_src.s_addr, AF_INET,
-		    r->src.neg, kif, M_GETFIB(m)))
-			r = r->skip[PF_SKIP_SRC_ADDR].ptr;
-		else if (PF_MISMATCHAW(&r->dst.addr,
-		    (struct pf_addr *)&h->ip_dst.s_addr, AF_INET,
-		    r->dst.neg, NULL, M_GETFIB(m)))
-			r = r->skip[PF_SKIP_DST_ADDR].ptr;
-#ifdef __FreeBSD__
-		else if (r->match_tag && !pf_match_tag(m, r, &tag, pd->pf_mtag))
-#else
-		else if (r->match_tag && !pf_match_tag(m, r, &tag))
-#endif
-			r = TAILQ_NEXT(r, entries);
-		else
-			break;
-	}
-
-	if (r == NULL || r->action == PF_NOSCRUB)
-		return (PF_PASS);
-	else {
-		r->packets[dir == PF_OUT]++;
-		r->bytes[dir == PF_OUT] += pd->tot_len;
-	}
-
-	/* Check for illegal packets */
-	if (hlen < (int)sizeof(struct ip))
-		goto drop;
-
-	if (hlen > ntohs(h->ip_len))
-		goto drop;
-
-	/* Clear IP_DF if the rule uses the no-df option */
-	if (r->rule_flag & PFRULE_NODF && h->ip_off & htons(IP_DF)) {
-		u_int16_t ip_off = h->ip_off;
-
-		h->ip_off &= htons(~IP_DF);
-		h->ip_sum = pf_cksum_fixup(h->ip_sum, ip_off, h->ip_off, 0);
-	}
-
-	/* We will need other tests here */
-	if (!fragoff && !mff)
-		goto no_fragment;
-
-	/* We're dealing with a fragment now. Don't allow fragments
-	 * with IP_DF to enter the cache. If the flag was cleared by
-	 * no-df above, fine. Otherwise drop it.
-	 */
-	if (h->ip_off & htons(IP_DF)) {
-		DPFPRINTF(("IP_DF\n"));
-		goto bad;
-	}
-
-	ip_len = ntohs(h->ip_len) - hlen;
-	ip_off = (ntohs(h->ip_off) & IP_OFFMASK) << 3;
-
-	/* All fragments are 8 byte aligned */
-	if (mff && (ip_len & 0x7)) {
-		DPFPRINTF(("mff and %d\n", ip_len));
-		goto bad;
-	}
-
-	/* Respect maximum length */
-	if (fragoff + ip_len > IP_MAXPACKET) {
-		DPFPRINTF(("max packet %d\n", fragoff + ip_len));
-		goto bad;
-	}
-	max = fragoff + ip_len;
-
-	if ((r->rule_flag & (PFRULE_FRAGCROP|PFRULE_FRAGDROP)) == 0) {
-		/* Fully buffer all of the fragments */
-
-#ifdef __FreeBSD__
-		frag = pf_find_fragment(h, &V_pf_frag_tree);
-#else
-		frag = pf_find_fragment(h, &pf_frag_tree);
-#endif
-
-		/* Check if we saw the last fragment already */
-		if (frag != NULL && (frag->fr_flags & PFFRAG_SEENLAST) &&
-		    max > frag->fr_max)
-			goto bad;
-
-		/* Get an entry for the fragment queue */
-#ifdef __FreeBSD__
-		frent = pool_get(&V_pf_frent_pl, PR_NOWAIT);
-#else
-		frent = pool_get(&pf_frent_pl, PR_NOWAIT);
-#endif
-		if (frent == NULL) {
-			REASON_SET(reason, PFRES_MEMORY);
-			return (PF_DROP);
-		}
-#ifdef __FreeBSD__
-		V_pf_nfrents++;
-#else
-		pf_nfrents++;
-#endif
-		frent->fr_ip = h;
-		frent->fr_m = m;
-
-		/* Might return a completely reassembled mbuf, or NULL */
-		DPFPRINTF(("reass frag %d @ %d-%d\n", h->ip_id, fragoff, max));
-		*m0 = m = pf_reassemble(m0, &frag, frent, mff);
-
-		if (m == NULL)
-			return (PF_DROP);
-
-		/* use mtag from concatenated mbuf chain */
-		pd->pf_mtag = pf_find_mtag(m);
-#ifdef DIAGNOSTIC
-		if (pd->pf_mtag == NULL) {
-			printf("%s: pf_find_mtag returned NULL(1)\n", __func__);
-			if ((pd->pf_mtag = pf_get_mtag(m)) == NULL) {
-				m_freem(m);
-				*m0 = NULL;
-				goto no_mem;
-			}
-		}
-#endif
-		if (frag != NULL && (frag->fr_flags & PFFRAG_DROP))
-			goto drop;
-
-		h = mtod(m, struct ip *);
-	} else {
-		/* non-buffering fragment cache (drops or masks overlaps) */
-		int	nomem = 0;
-
-#ifdef __FreeBSD__
-		if (dir == PF_OUT && pd->pf_mtag->flags & PF_TAG_FRAGCACHE) {
-#else
-		if (dir == PF_OUT && m->m_pkthdr.pf.flags & PF_TAG_FRAGCACHE) {
-#endif
-			/*
-			 * Already passed the fragment cache in the
-			 * input direction.  If we continued, it would
-			 * appear to be a dup and would be dropped.
-			 */
-			goto fragment_pass;
-		}
-
-#ifdef __FreeBSD__
-		frag = pf_find_fragment(h, &V_pf_cache_tree);
-#else
-		frag = pf_find_fragment(h, &pf_cache_tree);
-#endif
-
-		/* Check if we saw the last fragment already */
-		if (frag != NULL && (frag->fr_flags & PFFRAG_SEENLAST) &&
-		    max > frag->fr_max) {
-			if (r->rule_flag & PFRULE_FRAGDROP)
-				frag->fr_flags |= PFFRAG_DROP;
-			goto bad;
-		}
-
-		*m0 = m = pf_fragcache(m0, h, &frag, mff,
-		    (r->rule_flag & PFRULE_FRAGDROP) ? 1 : 0, &nomem);
-		if (m == NULL) {
-			if (nomem)
-				goto no_mem;
-			goto drop;
-		}
-
-		/* use mtag from copied and trimmed mbuf chain */
-		pd->pf_mtag = pf_find_mtag(m);
-#ifdef DIAGNOSTIC
-		if (pd->pf_mtag == NULL) {
-			printf("%s: pf_find_mtag returned NULL(2)\n", __func__);
-			if ((pd->pf_mtag = pf_get_mtag(m)) == NULL) {
-				m_freem(m);
-				*m0 = NULL;
-				goto no_mem;
-			}
-		}
-#endif
-		if (dir == PF_IN)
-#ifdef __FreeBSD__
-			pd->pf_mtag->flags |= PF_TAG_FRAGCACHE;
-#else
-			m->m_pkthdr.pf.flags |= PF_TAG_FRAGCACHE;
-#endif
-
-		if (frag != NULL && (frag->fr_flags & PFFRAG_DROP))
-			goto drop;
-		goto fragment_pass;
-	}
-
- no_fragment:
-	/* At this point, only IP_DF is allowed in ip_off */
-	if (h->ip_off & ~htons(IP_DF)) {
-		u_int16_t ip_off = h->ip_off;
-
-		h->ip_off &= htons(IP_DF);
-		h->ip_sum = pf_cksum_fixup(h->ip_sum, ip_off, h->ip_off, 0);
-	}
-
-	/* not missing a return here */
-
- fragment_pass:
-	pf_scrub_ip(&m, r->rule_flag, r->min_ttl, r->set_tos);
-
-	if ((r->rule_flag & (PFRULE_FRAGCROP|PFRULE_FRAGDROP)) == 0)
-		pd->flags |= PFDESC_IP_REAS;
-	return (PF_PASS);
-
- no_mem:
-	REASON_SET(reason, PFRES_MEMORY);
-	if (r != NULL && r->log)
-		PFLOG_PACKET(kif, h, m, AF_INET, dir, *reason, r, NULL, NULL, pd);
-	return (PF_DROP);
-
- drop:
-	REASON_SET(reason, PFRES_NORM);
-	if (r != NULL && r->log)
-		PFLOG_PACKET(kif, h, m, AF_INET, dir, *reason, r, NULL, NULL, pd);
-	return (PF_DROP);
-
- bad:
-	DPFPRINTF(("dropping bad fragment\n"));
-
-	/* Free associated fragments */
-	if (frag != NULL)
-		pf_free_fragment(frag);
-
-	REASON_SET(reason, PFRES_FRAG);
-	if (r != NULL && r->log)
-		PFLOG_PACKET(kif, h, m, AF_INET, dir, *reason, r, NULL, NULL, pd);
-
-	return (PF_DROP);
-}
-#endif
-
-#ifdef INET6
-int
-pf_normalize_ip6(struct mbuf **m0, int dir, struct pfi_kif *kif,
-    u_short *reason, struct pf_pdesc *pd)
-{
-	struct mbuf		*m = *m0;
-	struct pf_rule		*r;
-	struct ip6_hdr		*h = mtod(m, struct ip6_hdr *);
-	int			 off;
-	struct ip6_ext		 ext;
-	struct ip6_opt		 opt;
-	struct ip6_opt_jumbo	 jumbo;
-	struct ip6_frag		 frag;
-	u_int32_t		 jumbolen = 0, plen;
-	u_int16_t		 fragoff = 0;
-	int			 optend;
-	int			 ooff;
-	u_int8_t		 proto;
-	int			 terminal;
-
-	r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_SCRUB].active.ptr);
-	while (r != NULL) {
-		r->evaluations++;
-		if (pfi_kif_match(r->kif, kif) == r->ifnot)
-			r = r->skip[PF_SKIP_IFP].ptr;
-		else if (r->direction && r->direction != dir)
-			r = r->skip[PF_SKIP_DIR].ptr;
-		else if (r->af && r->af != AF_INET6)
-			r = r->skip[PF_SKIP_AF].ptr;
-#if 0 /* header chain! */
-		else if (r->proto && r->proto != h->ip6_nxt)
-			r = r->skip[PF_SKIP_PROTO].ptr;
-#endif
-		else if (PF_MISMATCHAW(&r->src.addr,
-		    (struct pf_addr *)&h->ip6_src, AF_INET6,
-		    r->src.neg, kif, M_GETFIB(m)))
-			r = r->skip[PF_SKIP_SRC_ADDR].ptr;
-		else if (PF_MISMATCHAW(&r->dst.addr,
-		    (struct pf_addr *)&h->ip6_dst, AF_INET6,
-		    r->dst.neg, NULL, M_GETFIB(m)))
-			r = r->skip[PF_SKIP_DST_ADDR].ptr;
-		else
-			break;
-	}
-
-	if (r == NULL || r->action == PF_NOSCRUB)
-		return (PF_PASS);
-	else {
-		r->packets[dir == PF_OUT]++;
-		r->bytes[dir == PF_OUT] += pd->tot_len;
-	}
-
-	/* Check for illegal packets */
-	if (sizeof(struct ip6_hdr) + IPV6_MAXPACKET < m->m_pkthdr.len)
-		goto drop;
-
-	off = sizeof(struct ip6_hdr);
-	proto = h->ip6_nxt;
-	terminal = 0;
-	do {
-		switch (proto) {
-		case IPPROTO_FRAGMENT:
-			goto fragment;
-			break;
-		case IPPROTO_AH:
-		case IPPROTO_ROUTING:
-		case IPPROTO_DSTOPTS:
-			if (!pf_pull_hdr(m, off, &ext, sizeof(ext), NULL,
-			    NULL, AF_INET6))
-				goto shortpkt;
-			if (proto == IPPROTO_AH)
-				off += (ext.ip6e_len + 2) * 4;
-			else
-				off += (ext.ip6e_len + 1) * 8;
-			proto = ext.ip6e_nxt;
-			break;
-		case IPPROTO_HOPOPTS:
-			if (!pf_pull_hdr(m, off, &ext, sizeof(ext), NULL,
-			    NULL, AF_INET6))
-				goto shortpkt;
-			optend = off + (ext.ip6e_len + 1) * 8;
-			ooff = off + sizeof(ext);
-			do {
-				if (!pf_pull_hdr(m, ooff, &opt.ip6o_type,
-				    sizeof(opt.ip6o_type), NULL, NULL,
-				    AF_INET6))
-					goto shortpkt;
-				if (opt.ip6o_type == IP6OPT_PAD1) {
-					ooff++;
-					continue;
-				}
-				if (!pf_pull_hdr(m, ooff, &opt, sizeof(opt),
-				    NULL, NULL, AF_INET6))
-					goto shortpkt;
-				if (ooff + sizeof(opt) + opt.ip6o_len > optend)
-					goto drop;
-				switch (opt.ip6o_type) {
-				case IP6OPT_JUMBO:
-					if (h->ip6_plen != 0)
-						goto drop;
-					if (!pf_pull_hdr(m, ooff, &jumbo,
-					    sizeof(jumbo), NULL, NULL,
-					    AF_INET6))
-						goto shortpkt;
-					memcpy(&jumbolen, jumbo.ip6oj_jumbo_len,
-					    sizeof(jumbolen));
-					jumbolen = ntohl(jumbolen);
-					if (jumbolen <= IPV6_MAXPACKET)
-						goto drop;
-					if (sizeof(struct ip6_hdr) + jumbolen !=
-					    m->m_pkthdr.len)
-						goto drop;
-					break;
-				default:
-					break;
-				}
-				ooff += sizeof(opt) + opt.ip6o_len;
-			} while (ooff < optend);
-
-			off = optend;
-			proto = ext.ip6e_nxt;
-			break;
-		default:
-			terminal = 1;
-			break;
-		}
-	} while (!terminal);
-
-	/* jumbo payload option must be present, or plen > 0 */
-	if (ntohs(h->ip6_plen) == 0)
-		plen = jumbolen;
-	else
-		plen = ntohs(h->ip6_plen);
-	if (plen == 0)
-		goto drop;
-	if (sizeof(struct ip6_hdr) + plen > m->m_pkthdr.len)
-		goto shortpkt;
-
-	pf_scrub_ip6(&m, r->min_ttl);
-
-	return (PF_PASS);
-
- fragment:
-	if (ntohs(h->ip6_plen) == 0 || jumbolen)
-		goto drop;
-	plen = ntohs(h->ip6_plen);
-
-	if (!pf_pull_hdr(m, off, &frag, sizeof(frag), NULL, NULL, AF_INET6))
-		goto shortpkt;
-	fragoff = ntohs(frag.ip6f_offlg & IP6F_OFF_MASK);
-	if (fragoff + (plen - off - sizeof(frag)) > IPV6_MAXPACKET)
-		goto badfrag;
-
-	/* do something about it */
-	/* remember to set pd->flags |= PFDESC_IP_REAS */
-	return (PF_PASS);
-
- shortpkt:
-	REASON_SET(reason, PFRES_SHORT);
-	if (r != NULL && r->log)
-		PFLOG_PACKET(kif, h, m, AF_INET6, dir, *reason, r, NULL, NULL, pd);
-	return (PF_DROP);
-
- drop:
-	REASON_SET(reason, PFRES_NORM);
-	if (r != NULL && r->log)
-		PFLOG_PACKET(kif, h, m, AF_INET6, dir, *reason, r, NULL, NULL, pd);
-	return (PF_DROP);
-
- badfrag:
-	REASON_SET(reason, PFRES_FRAG);
-	if (r != NULL && r->log)
-		PFLOG_PACKET(kif, h, m, AF_INET6, dir, *reason, r, NULL, NULL, pd);
-	return (PF_DROP);
-}
-#endif /* INET6 */
-
-int
-pf_normalize_tcp(int dir, struct pfi_kif *kif, struct mbuf *m, int ipoff,
-    int off, void *h, struct pf_pdesc *pd)
-{
-	struct pf_rule	*r, *rm = NULL;
-	struct tcphdr	*th = pd->hdr.tcp;
-	int		 rewrite = 0;
-	u_short		 reason;
-	u_int8_t	 flags;
-	sa_family_t	 af = pd->af;
-
-	r = TAILQ_FIRST(pf_main_ruleset.rules[PF_RULESET_SCRUB].active.ptr);
-	while (r != NULL) {
-		r->evaluations++;
-		if (pfi_kif_match(r->kif, kif) == r->ifnot)
-			r = r->skip[PF_SKIP_IFP].ptr;
-		else if (r->direction && r->direction != dir)
-			r = r->skip[PF_SKIP_DIR].ptr;
-		else if (r->af && r->af != af)
-			r = r->skip[PF_SKIP_AF].ptr;
-		else if (r->proto && r->proto != pd->proto)
-			r = r->skip[PF_SKIP_PROTO].ptr;
-		else if (PF_MISMATCHAW(&r->src.addr, pd->src, af,
-		    r->src.neg, kif, M_GETFIB(m)))
-			r = r->skip[PF_SKIP_SRC_ADDR].ptr;
-		else if (r->src.port_op && !pf_match_port(r->src.port_op,
-			    r->src.port[0], r->src.port[1], th->th_sport))
-			r = r->skip[PF_SKIP_SRC_PORT].ptr;
-		else if (PF_MISMATCHAW(&r->dst.addr, pd->dst, af,
-		    r->dst.neg, NULL, M_GETFIB(m)))
-			r = r->skip[PF_SKIP_DST_ADDR].ptr;
-		else if (r->dst.port_op && !pf_match_port(r->dst.port_op,
-			    r->dst.port[0], r->dst.port[1], th->th_dport))
-			r = r->skip[PF_SKIP_DST_PORT].ptr;
-		else if (r->os_fingerprint != PF_OSFP_ANY && !pf_osfp_match(
-			    pf_osfp_fingerprint(pd, m, off, th),
-			    r->os_fingerprint))
-			r = TAILQ_NEXT(r, entries);
-		else {
-			rm = r;
-			break;
-		}
-	}
-
-	if (rm == NULL || rm->action == PF_NOSCRUB)
-		return (PF_PASS);
-	else {
-		r->packets[dir == PF_OUT]++;
-		r->bytes[dir == PF_OUT] += pd->tot_len;
-	}
-
-	if (rm->rule_flag & PFRULE_REASSEMBLE_TCP)
-		pd->flags |= PFDESC_TCP_NORM;
-
-	flags = th->th_flags;
-	if (flags & TH_SYN) {
-		/* Illegal packet */
-		if (flags & TH_RST)
-			goto tcp_drop;
-
-		if (flags & TH_FIN)
-			flags &= ~TH_FIN;
-	} else {
-		/* Illegal packet */
-		if (!(flags & (TH_ACK|TH_RST)))
-			goto tcp_drop;
-	}
-
-	if (!(flags & TH_ACK)) {
-		/* These flags are only valid if ACK is set */
-		if ((flags & TH_FIN) || (flags & TH_PUSH) || (flags & TH_URG))
-			goto tcp_drop;
-	}
-
-	/* Check for illegal header length */
-	if (th->th_off < (sizeof(struct tcphdr) >> 2))
-		goto tcp_drop;
-
-	/* If flags changed, or reserved data set, then adjust */
-	if (flags != th->th_flags || th->th_x2 != 0) {
-		u_int16_t	ov, nv;
-
-		ov = *(u_int16_t *)(&th->th_ack + 1);
-		th->th_flags = flags;
-		th->th_x2 = 0;
-		nv = *(u_int16_t *)(&th->th_ack + 1);
-
-		th->th_sum = pf_cksum_fixup(th->th_sum, ov, nv, 0);
-		rewrite = 1;
-	}
-
-	/* Remove urgent pointer, if TH_URG is not set */
-	if (!(flags & TH_URG) && th->th_urp) {
-		th->th_sum = pf_cksum_fixup(th->th_sum, th->th_urp, 0, 0);
-		th->th_urp = 0;
-		rewrite = 1;
-	}
-
-	/* Process options */
-	if (r->max_mss && pf_normalize_tcpopt(r, m, th, off, pd->af))
-		rewrite = 1;
-
-	/* copy back packet headers if we sanitized */
-	if (rewrite)
-#ifdef __FreeBSD__
-		m_copyback(m, off, sizeof(*th), (caddr_t)th);
-#else
-		m_copyback(m, off, sizeof(*th), th);
-#endif
-
-	return (PF_PASS);
-
- tcp_drop:
-	REASON_SET(&reason, PFRES_NORM);
-	if (rm != NULL && r->log)
-		PFLOG_PACKET(kif, h, m, AF_INET, dir, reason, r, NULL, NULL, pd);
-	return (PF_DROP);
-}
-
-int
-pf_normalize_tcp_init(struct mbuf *m, int off, struct pf_pdesc *pd,
-    struct tcphdr *th, struct pf_state_peer *src, struct pf_state_peer *dst)
-{
-	u_int32_t tsval, tsecr;
-	u_int8_t hdr[60];
-	u_int8_t *opt;
-
-#ifdef __FreeBSD__
-	KASSERT((src->scrub == NULL), 
-	    ("pf_normalize_tcp_init: src->scrub != NULL"));
-
-	src->scrub = pool_get(&V_pf_state_scrub_pl, PR_NOWAIT);
-#else
-	KASSERT(src->scrub == NULL);
-
-	src->scrub = pool_get(&pf_state_scrub_pl, PR_NOWAIT);
-#endif
-	if (src->scrub == NULL)
-		return (1);
-	bzero(src->scrub, sizeof(*src->scrub));
-
-	switch (pd->af) {
-#ifdef INET
-	case AF_INET: {
-		struct ip *h = mtod(m, struct ip *);
-		src->scrub->pfss_ttl = h->ip_ttl;
-		break;
-	}
-#endif /* INET */
-#ifdef INET6
-	case AF_INET6: {
-		struct ip6_hdr *h = mtod(m, struct ip6_hdr *);
-		src->scrub->pfss_ttl = h->ip6_hlim;
-		break;
-	}
-#endif /* INET6 */
-	}
-
-
-	/*
-	 * All normalizations below are only begun if we see the start of
-	 * the connections.  They must all set an enabled bit in pfss_flags
-	 */
-	if ((th->th_flags & TH_SYN) == 0)
-		return (0);
-
-
-	if (th->th_off > (sizeof(struct tcphdr) >> 2) && src->scrub &&
-	    pf_pull_hdr(m, off, hdr, th->th_off << 2, NULL, NULL, pd->af)) {
-		/* Diddle with TCP options */
-		int hlen;
-		opt = hdr + sizeof(struct tcphdr);
-		hlen = (th->th_off << 2) - sizeof(struct tcphdr);
-		while (hlen >= TCPOLEN_TIMESTAMP) {
-			switch (*opt) {
-			case TCPOPT_EOL:	/* FALLTHROUGH */
-			case TCPOPT_NOP:
-				opt++;
-				hlen--;
-				break;
-			case TCPOPT_TIMESTAMP:
-				if (opt[1] >= TCPOLEN_TIMESTAMP) {
-					src->scrub->pfss_flags |=
-					    PFSS_TIMESTAMP;
-					src->scrub->pfss_ts_mod =
-					    htonl(arc4random());
-
-					/* note PFSS_PAWS not set yet */
-					memcpy(&tsval, &opt[2],
-					    sizeof(u_int32_t));
-					memcpy(&tsecr, &opt[6],
-					    sizeof(u_int32_t));
-					src->scrub->pfss_tsval0 = ntohl(tsval);
-					src->scrub->pfss_tsval = ntohl(tsval);
-					src->scrub->pfss_tsecr = ntohl(tsecr);
-					getmicrouptime(&src->scrub->pfss_last);
-				}
-				/* FALLTHROUGH */
-			default:
-				hlen -= MAX(opt[1], 2);
-				opt += MAX(opt[1], 2);
-				break;
-			}
-		}
-	}
-
-	return (0);
-}
-
-void
-pf_normalize_tcp_cleanup(struct pf_state *state)
-{
-#ifdef __FreeBSD__
-	if (state->src.scrub)
-		pool_put(&V_pf_state_scrub_pl, state->src.scrub);
-	if (state->dst.scrub)
-		pool_put(&V_pf_state_scrub_pl, state->dst.scrub);
-#else
-	if (state->src.scrub)
-		pool_put(&pf_state_scrub_pl, state->src.scrub);
-	if (state->dst.scrub)
-		pool_put(&pf_state_scrub_pl, state->dst.scrub);
-#endif
-
-	/* Someday... flush the TCP segment reassembly descriptors. */
-}
-
-int
-pf_normalize_tcp_stateful(struct mbuf *m, int off, struct pf_pdesc *pd,
-    u_short *reason, struct tcphdr *th, struct pf_state *state,
-    struct pf_state_peer *src, struct pf_state_peer *dst, int *writeback)
-{
-	struct timeval uptime;
-	u_int32_t tsval, tsecr;
-	u_int tsval_from_last;
-	u_int8_t hdr[60];
-	u_int8_t *opt;
-	int copyback = 0;
-	int got_ts = 0;
-
-#ifdef __FreeBSD__
-	KASSERT((src->scrub || dst->scrub), 
-	    ("pf_normalize_tcp_statefull: src->scrub && dst->scrub!"));
-#else
-	KASSERT(src->scrub || dst->scrub);
-#endif
-
-	/*
-	 * Enforce the minimum TTL seen for this connection.  Negate a common
-	 * technique to evade an intrusion detection system and confuse
-	 * firewall state code.
-	 */
-	switch (pd->af) {
-#ifdef INET
-	case AF_INET: {
-		if (src->scrub) {
-			struct ip *h = mtod(m, struct ip *);
-			if (h->ip_ttl > src->scrub->pfss_ttl)
-				src->scrub->pfss_ttl = h->ip_ttl;
-			h->ip_ttl = src->scrub->pfss_ttl;
-		}
-		break;
-	}
-#endif /* INET */
-#ifdef INET6
-	case AF_INET6: {
-		if (src->scrub) {
-			struct ip6_hdr *h = mtod(m, struct ip6_hdr *);
-			if (h->ip6_hlim > src->scrub->pfss_ttl)
-				src->scrub->pfss_ttl = h->ip6_hlim;
-			h->ip6_hlim = src->scrub->pfss_ttl;
-		}
-		break;
-	}
-#endif /* INET6 */
-	}
-
-	if (th->th_off > (sizeof(struct tcphdr) >> 2) &&
-	    ((src->scrub && (src->scrub->pfss_flags & PFSS_TIMESTAMP)) ||
-	    (dst->scrub && (dst->scrub->pfss_flags & PFSS_TIMESTAMP))) &&
-	    pf_pull_hdr(m, off, hdr, th->th_off << 2, NULL, NULL, pd->af)) {
-		/* Diddle with TCP options */
-		int hlen;
-		opt = hdr + sizeof(struct tcphdr);
-		hlen = (th->th_off << 2) - sizeof(struct tcphdr);
-		while (hlen >= TCPOLEN_TIMESTAMP) {
-			switch (*opt) {
-			case TCPOPT_EOL:	/* FALLTHROUGH */
-			case TCPOPT_NOP:
-				opt++;
-				hlen--;
-				break;
-			case TCPOPT_TIMESTAMP:
-				/* Modulate the timestamps.  Can be used for
-				 * NAT detection, OS uptime determination or
-				 * reboot detection.
-				 */
-
-				if (got_ts) {
-					/* Huh?  Multiple timestamps!? */
-#ifdef __FreeBSD__
-					if (V_pf_status.debug >= PF_DEBUG_MISC) {
-#else
-					if (pf_status.debug >= PF_DEBUG_MISC) {
-#endif
-						DPFPRINTF(("multiple TS??"));
-						pf_print_state(state);
-						printf("\n");
-					}
-					REASON_SET(reason, PFRES_TS);
-					return (PF_DROP);
-				}
-				if (opt[1] >= TCPOLEN_TIMESTAMP) {
-					memcpy(&tsval, &opt[2],
-					    sizeof(u_int32_t));
-					if (tsval && src->scrub &&
-					    (src->scrub->pfss_flags &
-					    PFSS_TIMESTAMP)) {
-						tsval = ntohl(tsval);
-						pf_change_a(&opt[2],
-						    &th->th_sum,
-						    htonl(tsval +
-						    src->scrub->pfss_ts_mod),
-						    0);
-						copyback = 1;
-					}
-
-					/* Modulate TS reply iff valid (!0) */
-					memcpy(&tsecr, &opt[6],
-					    sizeof(u_int32_t));
-					if (tsecr && dst->scrub &&
-					    (dst->scrub->pfss_flags &
-					    PFSS_TIMESTAMP)) {
-						tsecr = ntohl(tsecr)
-						    - dst->scrub->pfss_ts_mod;
-						pf_change_a(&opt[6],
-						    &th->th_sum, htonl(tsecr),
-						    0);
-						copyback = 1;
-					}
-					got_ts = 1;
-				}
-				/* FALLTHROUGH */
-			default:
-				hlen -= MAX(opt[1], 2);
-				opt += MAX(opt[1], 2);
-				break;
-			}
-		}
-		if (copyback) {
-			/* Copyback the options, caller copys back header */
-			*writeback = 1;
-			m_copyback(m, off + sizeof(struct tcphdr),
-			    (th->th_off << 2) - sizeof(struct tcphdr), hdr +
-			    sizeof(struct tcphdr));
-		}
-	}
-
-
-	/*
-	 * Must invalidate PAWS checks on connections idle for too long.
-	 * The fastest allowed timestamp clock is 1ms.  That turns out to
-	 * be about 24 days before it wraps.  XXX Right now our lowerbound
-	 * TS echo check only works for the first 12 days of a connection
-	 * when the TS has exhausted half its 32bit space
-	 */
-#define TS_MAX_IDLE	(24*24*60*60)
-#define TS_MAX_CONN	(12*24*60*60)	/* XXX remove when better tsecr check */
-
-	getmicrouptime(&uptime);
-	if (src->scrub && (src->scrub->pfss_flags & PFSS_PAWS) &&
-	    (uptime.tv_sec - src->scrub->pfss_last.tv_sec > TS_MAX_IDLE ||
-	    time_second - state->creation > TS_MAX_CONN))  {
-#ifdef __FreeBSD__
-		if (V_pf_status.debug >= PF_DEBUG_MISC) {
-#else
-		if (pf_status.debug >= PF_DEBUG_MISC) {
-#endif
-			DPFPRINTF(("src idled out of PAWS\n"));
-			pf_print_state(state);
-			printf("\n");
-		}
-		src->scrub->pfss_flags = (src->scrub->pfss_flags & ~PFSS_PAWS)
-		    | PFSS_PAWS_IDLED;
-	}
-	if (dst->scrub && (dst->scrub->pfss_flags & PFSS_PAWS) &&
-	    uptime.tv_sec - dst->scrub->pfss_last.tv_sec > TS_MAX_IDLE) {
-#ifdef __FreeBSD__
-		if (V_pf_status.debug >= PF_DEBUG_MISC) {
-#else
-		if (pf_status.debug >= PF_DEBUG_MISC) {
-#endif
-			DPFPRINTF(("dst idled out of PAWS\n"));
-			pf_print_state(state);
-			printf("\n");
-		}
-		dst->scrub->pfss_flags = (dst->scrub->pfss_flags & ~PFSS_PAWS)
-		    | PFSS_PAWS_IDLED;
-	}
-
-	if (got_ts && src->scrub && dst->scrub &&
-	    (src->scrub->pfss_flags & PFSS_PAWS) &&
-	    (dst->scrub->pfss_flags & PFSS_PAWS)) {
-		/* Validate that the timestamps are "in-window".
-		 * RFC1323 describes TCP Timestamp options that allow
-		 * measurement of RTT (round trip time) and PAWS
-		 * (protection against wrapped sequence numbers).  PAWS
-		 * gives us a set of rules for rejecting packets on
-		 * long fat pipes (packets that were somehow delayed 
-		 * in transit longer than the time it took to send the
-		 * full TCP sequence space of 4Gb).  We can use these
-		 * rules and infer a few others that will let us treat
-		 * the 32bit timestamp and the 32bit echoed timestamp
-		 * as sequence numbers to prevent a blind attacker from
-		 * inserting packets into a connection.
-		 *
-		 * RFC1323 tells us:
-		 *  - The timestamp on this packet must be greater than
-		 *    or equal to the last value echoed by the other
-		 *    endpoint.  The RFC says those will be discarded
-		 *    since it is a dup that has already been acked.
-		 *    This gives us a lowerbound on the timestamp.
-		 *        timestamp >= other last echoed timestamp
-		 *  - The timestamp will be less than or equal to
-		 *    the last timestamp plus the time between the
-		 *    last packet and now.  The RFC defines the max
-		 *    clock rate as 1ms.  We will allow clocks to be
-		 *    up to 10% fast and will allow a total difference
-		 *    or 30 seconds due to a route change.  And this
-		 *    gives us an upperbound on the timestamp.
-		 *        timestamp <= last timestamp + max ticks
-		 *    We have to be careful here.  Windows will send an
-		 *    initial timestamp of zero and then initialize it
-		 *    to a random value after the 3whs; presumably to
-		 *    avoid a DoS by having to call an expensive RNG
-		 *    during a SYN flood.  Proof MS has at least one
-		 *    good security geek.
-		 *
-		 *  - The TCP timestamp option must also echo the other
-		 *    endpoints timestamp.  The timestamp echoed is the
-		 *    one carried on the earliest unacknowledged segment
-		 *    on the left edge of the sequence window.  The RFC
-		 *    states that the host will reject any echoed
-		 *    timestamps that were larger than any ever sent.
-		 *    This gives us an upperbound on the TS echo.
-		 *        tescr <= largest_tsval
-		 *  - The lowerbound on the TS echo is a little more
-		 *    tricky to determine.  The other endpoint's echoed
-		 *    values will not decrease.  But there may be
-		 *    network conditions that re-order packets and
-		 *    cause our view of them to decrease.  For now the
-		 *    only lowerbound we can safely determine is that
-		 *    the TS echo will never be less than the original
-		 *    TS.  XXX There is probably a better lowerbound.
-		 *    Remove TS_MAX_CONN with better lowerbound check.
-		 *        tescr >= other original TS
-		 *
-		 * It is also important to note that the fastest
-		 * timestamp clock of 1ms will wrap its 32bit space in
-		 * 24 days.  So we just disable TS checking after 24
-		 * days of idle time.  We actually must use a 12d
-		 * connection limit until we can come up with a better
-		 * lowerbound to the TS echo check.
-		 */
-		struct timeval delta_ts;
-		int ts_fudge;
-
-
-		/*
-		 * PFTM_TS_DIFF is how many seconds of leeway to allow
-		 * a host's timestamp.  This can happen if the previous
-		 * packet got delayed in transit for much longer than
-		 * this packet.
-		 */
-		if ((ts_fudge = state->rule.ptr->timeout[PFTM_TS_DIFF]) == 0)
-#ifdef __FreeBSD__
-			ts_fudge = V_pf_default_rule.timeout[PFTM_TS_DIFF];
-#else
-			ts_fudge = pf_default_rule.timeout[PFTM_TS_DIFF];
-#endif
-
-
-		/* Calculate max ticks since the last timestamp */
-#define TS_MAXFREQ	1100		/* RFC max TS freq of 1Khz + 10% skew */
-#define TS_MICROSECS	1000000		/* microseconds per second */
-#ifdef __FreeBSD__
-#ifndef timersub
-#define	timersub(tvp, uvp, vvp)						\
-	do {								\
-		(vvp)->tv_sec = (tvp)->tv_sec - (uvp)->tv_sec;		\
-		(vvp)->tv_usec = (tvp)->tv_usec - (uvp)->tv_usec;	\
-		if ((vvp)->tv_usec < 0) {				\
-			(vvp)->tv_sec--;				\
-			(vvp)->tv_usec += 1000000;			\
-		}							\
-	} while (0)
-#endif
-#endif
-		timersub(&uptime, &src->scrub->pfss_last, &delta_ts);
-		tsval_from_last = (delta_ts.tv_sec + ts_fudge) * TS_MAXFREQ;
-		tsval_from_last += delta_ts.tv_usec / (TS_MICROSECS/TS_MAXFREQ);
-
-
-		if ((src->state >= TCPS_ESTABLISHED &&
-		    dst->state >= TCPS_ESTABLISHED) &&
-		    (SEQ_LT(tsval, dst->scrub->pfss_tsecr) ||
-		    SEQ_GT(tsval, src->scrub->pfss_tsval + tsval_from_last) ||
-		    (tsecr && (SEQ_GT(tsecr, dst->scrub->pfss_tsval) ||
-		    SEQ_LT(tsecr, dst->scrub->pfss_tsval0))))) {
-			/* Bad RFC1323 implementation or an insertion attack.
-			 *
-			 * - Solaris 2.6 and 2.7 are known to send another ACK
-			 *   after the FIN,FIN|ACK,ACK closing that carries
-			 *   an old timestamp.
-			 */
-
-			DPFPRINTF(("Timestamp failed %c%c%c%c\n",
-			    SEQ_LT(tsval, dst->scrub->pfss_tsecr) ? '0' : ' ',
-			    SEQ_GT(tsval, src->scrub->pfss_tsval +
-			    tsval_from_last) ? '1' : ' ',
-			    SEQ_GT(tsecr, dst->scrub->pfss_tsval) ? '2' : ' ',
-			    SEQ_LT(tsecr, dst->scrub->pfss_tsval0)? '3' : ' '));
-#ifdef __FreeBSD__
-			DPFPRINTF((" tsval: %u  tsecr: %u  +ticks: %u  "
-			    "idle: %jus %lums\n",
-			    tsval, tsecr, tsval_from_last,
-			    (uintmax_t)delta_ts.tv_sec,
-			    delta_ts.tv_usec / 1000));
-			DPFPRINTF((" src->tsval: %u  tsecr: %u\n",
-			    src->scrub->pfss_tsval, src->scrub->pfss_tsecr));
-			DPFPRINTF((" dst->tsval: %u  tsecr: %u  tsval0: %u"
-			    "\n", dst->scrub->pfss_tsval,
-			    dst->scrub->pfss_tsecr, dst->scrub->pfss_tsval0));
-#else
-			DPFPRINTF((" tsval: %lu  tsecr: %lu  +ticks: %lu  "
-			    "idle: %lus %lums\n",
-			    tsval, tsecr, tsval_from_last, delta_ts.tv_sec,
-			    delta_ts.tv_usec / 1000));
-			DPFPRINTF((" src->tsval: %lu  tsecr: %lu\n",
-			    src->scrub->pfss_tsval, src->scrub->pfss_tsecr));
-			DPFPRINTF((" dst->tsval: %lu  tsecr: %lu  tsval0: %lu"
-			    "\n", dst->scrub->pfss_tsval,
-			    dst->scrub->pfss_tsecr, dst->scrub->pfss_tsval0));
-#endif
-#ifdef __FreeBSD__
-			if (V_pf_status.debug >= PF_DEBUG_MISC) {
-#else
-			if (pf_status.debug >= PF_DEBUG_MISC) {
-#endif
-				pf_print_state(state);
-				pf_print_flags(th->th_flags);
-				printf("\n");
-			}
-			REASON_SET(reason, PFRES_TS);
-			return (PF_DROP);
-		}
-
-		/* XXX I'd really like to require tsecr but it's optional */
-
-	} else if (!got_ts && (th->th_flags & TH_RST) == 0 &&
-	    ((src->state == TCPS_ESTABLISHED && dst->state == TCPS_ESTABLISHED)
-	    || pd->p_len > 0 || (th->th_flags & TH_SYN)) &&
-	    src->scrub && dst->scrub &&
-	    (src->scrub->pfss_flags & PFSS_PAWS) &&
-	    (dst->scrub->pfss_flags & PFSS_PAWS)) {
-		/* Didn't send a timestamp.  Timestamps aren't really useful
-		 * when:
-		 *  - connection opening or closing (often not even sent).
-		 *    but we must not let an attacker to put a FIN on a
-		 *    data packet to sneak it through our ESTABLISHED check.
-		 *  - on a TCP reset.  RFC suggests not even looking at TS.
-		 *  - on an empty ACK.  The TS will not be echoed so it will
-		 *    probably not help keep the RTT calculation in sync and
-		 *    there isn't as much danger when the sequence numbers
-		 *    got wrapped.  So some stacks don't include TS on empty
-		 *    ACKs :-(
-		 *
-		 * To minimize the disruption to mostly RFC1323 conformant
-		 * stacks, we will only require timestamps on data packets.
-		 *
-		 * And what do ya know, we cannot require timestamps on data
-		 * packets.  There appear to be devices that do legitimate
-		 * TCP connection hijacking.  There are HTTP devices that allow
-		 * a 3whs (with timestamps) and then buffer the HTTP request.
-		 * If the intermediate device has the HTTP response cache, it
-		 * will spoof the response but not bother timestamping its
-		 * packets.  So we can look for the presence of a timestamp in
-		 * the first data packet and if there, require it in all future
-		 * packets.
-		 */
-
-		if (pd->p_len > 0 && (src->scrub->pfss_flags & PFSS_DATA_TS)) {
-			/*
-			 * Hey!  Someone tried to sneak a packet in.  Or the
-			 * stack changed its RFC1323 behavior?!?!
-			 */
-#ifdef __FreeBSD__
-			if (V_pf_status.debug >= PF_DEBUG_MISC) {
-#else
-			if (pf_status.debug >= PF_DEBUG_MISC) {
-#endif
-				DPFPRINTF(("Did not receive expected RFC1323 "
-				    "timestamp\n"));
-				pf_print_state(state);
-				pf_print_flags(th->th_flags);
-				printf("\n");
-			}
-			REASON_SET(reason, PFRES_TS);
-			return (PF_DROP);
-		}
-	}
-
-
-	/*
-	 * We will note if a host sends his data packets with or without
-	 * timestamps.  And require all data packets to contain a timestamp
-	 * if the first does.  PAWS implicitly requires that all data packets be
-	 * timestamped.  But I think there are middle-man devices that hijack
-	 * TCP streams immediately after the 3whs and don't timestamp their
-	 * packets (seen in a WWW accelerator or cache).
-	 */
-	if (pd->p_len > 0 && src->scrub && (src->scrub->pfss_flags &
-	    (PFSS_TIMESTAMP|PFSS_DATA_TS|PFSS_DATA_NOTS)) == PFSS_TIMESTAMP) {
-		if (got_ts)
-			src->scrub->pfss_flags |= PFSS_DATA_TS;
-		else {
-			src->scrub->pfss_flags |= PFSS_DATA_NOTS;
-#ifdef __FreeBSD__
-			if (V_pf_status.debug >= PF_DEBUG_MISC && dst->scrub &&
-#else
-			if (pf_status.debug >= PF_DEBUG_MISC && dst->scrub &&
-#endif
-			    (dst->scrub->pfss_flags & PFSS_TIMESTAMP)) {
-				/* Don't warn if other host rejected RFC1323 */
-				DPFPRINTF(("Broken RFC1323 stack did not "
-				    "timestamp data packet. Disabled PAWS "
-				    "security.\n"));
-				pf_print_state(state);
-				pf_print_flags(th->th_flags);
-				printf("\n");
-			}
-		}
-	}
-
-
-	/*
-	 * Update PAWS values
-	 */
-	if (got_ts && src->scrub && PFSS_TIMESTAMP == (src->scrub->pfss_flags &
-	    (PFSS_PAWS_IDLED|PFSS_TIMESTAMP))) {
-		getmicrouptime(&src->scrub->pfss_last);
-		if (SEQ_GEQ(tsval, src->scrub->pfss_tsval) ||
-		    (src->scrub->pfss_flags & PFSS_PAWS) == 0)
-			src->scrub->pfss_tsval = tsval;
-
-		if (tsecr) {
-			if (SEQ_GEQ(tsecr, src->scrub->pfss_tsecr) ||
-			    (src->scrub->pfss_flags & PFSS_PAWS) == 0)
-				src->scrub->pfss_tsecr = tsecr;
-
-			if ((src->scrub->pfss_flags & PFSS_PAWS) == 0 &&
-			    (SEQ_LT(tsval, src->scrub->pfss_tsval0) ||
-			    src->scrub->pfss_tsval0 == 0)) {
-				/* tsval0 MUST be the lowest timestamp */
-				src->scrub->pfss_tsval0 = tsval;
-			}
-
-			/* Only fully initialized after a TS gets echoed */
-			if ((src->scrub->pfss_flags & PFSS_PAWS) == 0)
-				src->scrub->pfss_flags |= PFSS_PAWS;
-		}
-	}
-
-	/* I have a dream....  TCP segment reassembly.... */
-	return (0);
-}
-
-int
-pf_normalize_tcpopt(struct pf_rule *r, struct mbuf *m, struct tcphdr *th,
-    int off, sa_family_t af)
-{
-	u_int16_t	*mss;
-	int		 thoff;
-	int		 opt, cnt, optlen = 0;
-	int		 rewrite = 0;
-#ifdef __FreeBSD__
-	u_char		 opts[TCP_MAXOLEN];
-#else
-	u_char		 opts[MAX_TCPOPTLEN];
-#endif
-	u_char		*optp = opts;
-
-	thoff = th->th_off << 2;
-	cnt = thoff - sizeof(struct tcphdr);
-
-	if (cnt > 0 && !pf_pull_hdr(m, off + sizeof(*th), opts, cnt,
-	    NULL, NULL, af))
-		return (rewrite);
-
-	for (; cnt > 0; cnt -= optlen, optp += optlen) {
-		opt = optp[0];
-		if (opt == TCPOPT_EOL)
-			break;
-		if (opt == TCPOPT_NOP)
-			optlen = 1;
-		else {
-			if (cnt < 2)
-				break;
-			optlen = optp[1];
-			if (optlen < 2 || optlen > cnt)
-				break;
-		}
-		switch (opt) {
-		case TCPOPT_MAXSEG:
-			mss = (u_int16_t *)(optp + 2);
-			if ((ntohs(*mss)) > r->max_mss) {
-				th->th_sum = pf_cksum_fixup(th->th_sum,
-				    *mss, htons(r->max_mss), 0);
-				*mss = htons(r->max_mss);
-				rewrite = 1;
-			}
-			break;
-		default:
-			break;
-		}
-	}
-
-	if (rewrite)
-		m_copyback(m, off + sizeof(*th), thoff - sizeof(*th), opts);
-
-	return (rewrite);
-}
-
-void
-pf_scrub_ip(struct mbuf **m0, u_int32_t flags, u_int8_t min_ttl, u_int8_t tos)
-{
-	struct mbuf		*m = *m0;
-	struct ip		*h = mtod(m, struct ip *);
-
-	/* Clear IP_DF if no-df was requested */
-	if (flags & PFRULE_NODF && h->ip_off & htons(IP_DF)) {
-		u_int16_t ip_off = h->ip_off;
-
-		h->ip_off &= htons(~IP_DF);
-		h->ip_sum = pf_cksum_fixup(h->ip_sum, ip_off, h->ip_off, 0);
-	}
-
-	/* Enforce a minimum ttl, may cause endless packet loops */
-	if (min_ttl && h->ip_ttl < min_ttl) {
-		u_int16_t ip_ttl = h->ip_ttl;
-
-		h->ip_ttl = min_ttl;
-		h->ip_sum = pf_cksum_fixup(h->ip_sum, ip_ttl, h->ip_ttl, 0);
-	}
-
-	/* Enforce tos */
-	if (flags & PFRULE_SET_TOS) {
-		u_int16_t	ov, nv;
-
-		ov = *(u_int16_t *)h;
-		h->ip_tos = tos;
-		nv = *(u_int16_t *)h;
-
-		h->ip_sum = pf_cksum_fixup(h->ip_sum, ov, nv, 0);
-	}
-
-	/* random-id, but not for fragments */
-	if (flags & PFRULE_RANDOMID && !(h->ip_off & ~htons(IP_DF))) {
-		u_int16_t ip_id = h->ip_id;
-
-		h->ip_id = ip_randomid();
-		h->ip_sum = pf_cksum_fixup(h->ip_sum, ip_id, h->ip_id, 0);
-	}
-}
-
-#ifdef INET6
-void
-pf_scrub_ip6(struct mbuf **m0, u_int8_t min_ttl)
-{
-	struct mbuf		*m = *m0;
-	struct ip6_hdr		*h = mtod(m, struct ip6_hdr *);
-
-	/* Enforce a minimum ttl, may cause endless packet loops */
-	if (min_ttl && h->ip6_hlim < min_ttl)
-		h->ip6_hlim = min_ttl;
-}
-#endif
diff --git a/sys/contrib/pf/net/pf_osfp.c b/sys/contrib/pf/net/pf_osfp.c
deleted file mode 100644
index dcd8af7fb54d..000000000000
--- a/sys/contrib/pf/net/pf_osfp.c
+++ /dev/null
@@ -1,698 +0,0 @@
-/*	$OpenBSD: pf_osfp.c,v 1.14 2008/06/12 18:17:01 henning Exp $ */
-
-/*
- * Copyright (c) 2003 Mike Frantzen <frantzen@w4g.org>
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- */
-
-#ifdef __FreeBSD__
-#include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
-#endif
-
-#include <sys/param.h>
-#include <sys/socket.h>
-#ifdef _KERNEL
-#include <sys/systm.h>
-#ifndef __FreeBSD__
-#include <sys/pool.h>
-#endif
-#endif /* _KERNEL */
-#include <sys/mbuf.h>
-
-#include <netinet/in.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#include <netinet/tcp.h>
-
-#include <net/if.h>
-#include <net/pfvar.h>
-
-#include <netinet/ip6.h>
-#ifdef _KERNEL
-#include <netinet6/in6_var.h>
-#endif
-
-
-#ifdef _KERNEL
-#ifdef __FreeBSD__
-#define	DPFPRINTF(format, x...)		\
-	if (V_pf_status.debug >= PF_DEBUG_NOISY)	\
-		printf(format , ##x)
-#else
-#define	DPFPRINTF(format, x...)		\
-	if (pf_status.debug >= PF_DEBUG_NOISY)	\
-		printf(format , ##x)
-#endif
-#ifdef __FreeBSD__
-typedef uma_zone_t pool_t;
-#else
-typedef struct pool pool_t;
-#endif
-
-#else
-/* Userland equivalents so we can lend code to tcpdump et al. */
-
-#include <arpa/inet.h>
-#include <errno.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <netdb.h>
-#define	pool_t			int
-#define	pool_get(pool, flags)	malloc(*(pool))
-#define	pool_put(pool, item)	free(item)
-#define	pool_init(pool, size, a, ao, f, m, p)	(*(pool)) = (size)
-
-#ifdef __FreeBSD__
-#define	NTOHS(x) (x) = ntohs((u_int16_t)(x))
-#endif
-
-#ifdef PFDEBUG
-#include <sys/stdarg.h>
-#define	DPFPRINTF(format, x...)	fprintf(stderr, format , ##x)
-#else
-#define	DPFPRINTF(format, x...)	((void)0)
-#endif /* PFDEBUG */
-#endif /* _KERNEL */
-
-
-#ifdef __FreeBSD__
-SLIST_HEAD(pf_osfp_list, pf_os_fingerprint);
-VNET_DEFINE(struct pf_osfp_list,	pf_osfp_list);
-#define	V_pf_osfp_list			VNET(pf_osfp_list)
-VNET_DEFINE(pool_t,			pf_osfp_entry_pl);
-#define	pf_osfp_entry_pl		VNET(pf_osfp_entry_pl)
-VNET_DEFINE(pool_t,			pf_osfp_pl);
-#define	pf_osfp_pl			VNET(pf_osfp_pl)
-#else
-SLIST_HEAD(pf_osfp_list, pf_os_fingerprint) pf_osfp_list;
-pool_t pf_osfp_entry_pl;
-pool_t pf_osfp_pl;
-#endif
-
-struct pf_os_fingerprint	*pf_osfp_find(struct pf_osfp_list *,
-				    struct pf_os_fingerprint *, u_int8_t);
-struct pf_os_fingerprint	*pf_osfp_find_exact(struct pf_osfp_list *,
-				    struct pf_os_fingerprint *);
-void				 pf_osfp_insert(struct pf_osfp_list *,
-				    struct pf_os_fingerprint *);
-
-
-#ifdef _KERNEL
-/*
- * Passively fingerprint the OS of the host (IPv4 TCP SYN packets only)
- * Returns the list of possible OSes.
- */
-struct pf_osfp_enlist *
-pf_osfp_fingerprint(struct pf_pdesc *pd, struct mbuf *m, int off,
-    const struct tcphdr *tcp)
-{
-	struct ip *ip;
-	struct ip6_hdr *ip6;
-	char hdr[60];
-
-	if ((pd->af != PF_INET && pd->af != PF_INET6) ||
-	    pd->proto != IPPROTO_TCP || (tcp->th_off << 2) < sizeof(*tcp))
-		return (NULL);
-
-	if (pd->af == PF_INET) {
-		ip = mtod(m, struct ip *);
-		ip6 = (struct ip6_hdr *)NULL;
-	} else {
-		ip = (struct ip *)NULL;
-		ip6 = mtod(m, struct ip6_hdr *);
-	}
-	if (!pf_pull_hdr(m, off, hdr, tcp->th_off << 2, NULL, NULL,
-	    pd->af)) return (NULL);
-
-	return (pf_osfp_fingerprint_hdr(ip, ip6, (struct tcphdr *)hdr));
-}
-#endif /* _KERNEL */
-
-struct pf_osfp_enlist *
-pf_osfp_fingerprint_hdr(const struct ip *ip, const struct ip6_hdr *ip6, const struct tcphdr *tcp)
-{
-	struct pf_os_fingerprint fp, *fpresult;
-	int cnt, optlen = 0;
-	const u_int8_t *optp;
-#ifdef _KERNEL
-	char srcname[128];
-#else
-	char srcname[NI_MAXHOST];
-#endif
-
-	if ((tcp->th_flags & (TH_SYN|TH_ACK)) != TH_SYN)
-		return (NULL);
-	if (ip) {
-		if ((ip->ip_off & htons(IP_OFFMASK)) != 0)
-			return (NULL);
-	}
-
-	memset(&fp, 0, sizeof(fp));
-
-	if (ip) {
-#ifndef _KERNEL
-		struct sockaddr_in sin;
-#endif
-
-		fp.fp_psize = ntohs(ip->ip_len);
-		fp.fp_ttl = ip->ip_ttl;
-		if (ip->ip_off & htons(IP_DF))
-			fp.fp_flags |= PF_OSFP_DF;
-#ifdef _KERNEL
-		strlcpy(srcname, inet_ntoa(ip->ip_src), sizeof(srcname));
-#else
-		memset(&sin, 0, sizeof(sin));
-		sin.sin_family = AF_INET;
-		sin.sin_len = sizeof(struct sockaddr_in);
-		sin.sin_addr = ip->ip_src;
-		(void)getnameinfo((struct sockaddr *)&sin,
-		    sizeof(struct sockaddr_in), srcname, sizeof(srcname),
-		    NULL, 0, NI_NUMERICHOST);
-#endif
-	}
-#ifdef INET6
-	else if (ip6) {
-#ifndef _KERNEL
-		struct sockaddr_in6 sin6;
-#endif
-
-		/* jumbo payload? */
-		fp.fp_psize = sizeof(struct ip6_hdr) + ntohs(ip6->ip6_plen);
-		fp.fp_ttl = ip6->ip6_hlim;
-		fp.fp_flags |= PF_OSFP_DF;
-		fp.fp_flags |= PF_OSFP_INET6;
-#ifdef _KERNEL
-		strlcpy(srcname, ip6_sprintf((struct in6_addr *)&ip6->ip6_src),
-		    sizeof(srcname));
-#else
-		memset(&sin6, 0, sizeof(sin6));
-		sin6.sin6_family = AF_INET6;
-		sin6.sin6_len = sizeof(struct sockaddr_in6);
-		sin6.sin6_addr = ip6->ip6_src;
-		(void)getnameinfo((struct sockaddr *)&sin6,
-		    sizeof(struct sockaddr_in6), srcname, sizeof(srcname),
-		    NULL, 0, NI_NUMERICHOST);
-#endif
-	}
-#endif
-	else
-		return (NULL);
-	fp.fp_wsize = ntohs(tcp->th_win);
-
-
-	cnt = (tcp->th_off << 2) - sizeof(*tcp);
-	optp = (const u_int8_t *)((const char *)tcp + sizeof(*tcp));
-	for (; cnt > 0; cnt -= optlen, optp += optlen) {
-		if (*optp == TCPOPT_EOL)
-			break;
-
-		fp.fp_optcnt++;
-		if (*optp == TCPOPT_NOP) {
-			fp.fp_tcpopts = (fp.fp_tcpopts << PF_OSFP_TCPOPT_BITS) |
-			    PF_OSFP_TCPOPT_NOP;
-			optlen = 1;
-		} else {
-			if (cnt < 2)
-				return (NULL);
-			optlen = optp[1];
-			if (optlen > cnt || optlen < 2)
-				return (NULL);
-			switch (*optp) {
-			case TCPOPT_MAXSEG:
-				if (optlen >= TCPOLEN_MAXSEG)
-					memcpy(&fp.fp_mss, &optp[2],
-					    sizeof(fp.fp_mss));
-				fp.fp_tcpopts = (fp.fp_tcpopts <<
-				    PF_OSFP_TCPOPT_BITS) | PF_OSFP_TCPOPT_MSS;
-				NTOHS(fp.fp_mss);
-				break;
-			case TCPOPT_WINDOW:
-				if (optlen >= TCPOLEN_WINDOW)
-					memcpy(&fp.fp_wscale, &optp[2],
-					    sizeof(fp.fp_wscale));
-				NTOHS(fp.fp_wscale);
-				fp.fp_tcpopts = (fp.fp_tcpopts <<
-				    PF_OSFP_TCPOPT_BITS) |
-				    PF_OSFP_TCPOPT_WSCALE;
-				break;
-			case TCPOPT_SACK_PERMITTED:
-				fp.fp_tcpopts = (fp.fp_tcpopts <<
-				    PF_OSFP_TCPOPT_BITS) | PF_OSFP_TCPOPT_SACK;
-				break;
-			case TCPOPT_TIMESTAMP:
-				if (optlen >= TCPOLEN_TIMESTAMP) {
-					u_int32_t ts;
-					memcpy(&ts, &optp[2], sizeof(ts));
-					if (ts == 0)
-						fp.fp_flags |= PF_OSFP_TS0;
-
-				}
-				fp.fp_tcpopts = (fp.fp_tcpopts <<
-				    PF_OSFP_TCPOPT_BITS) | PF_OSFP_TCPOPT_TS;
-				break;
-			default:
-				return (NULL);
-			}
-		}
-		optlen = MAX(optlen, 1);	/* paranoia */
-	}
-
-	DPFPRINTF("fingerprinted %s:%d  %d:%d:%d:%d:%llx (%d) "
-	    "(TS=%s,M=%s%d,W=%s%d)\n",
-	    srcname, ntohs(tcp->th_sport),
-	    fp.fp_wsize, fp.fp_ttl, (fp.fp_flags & PF_OSFP_DF) != 0,
-	    fp.fp_psize, (long long int)fp.fp_tcpopts, fp.fp_optcnt,
-	    (fp.fp_flags & PF_OSFP_TS0) ? "0" : "",
-	    (fp.fp_flags & PF_OSFP_MSS_MOD) ? "%" :
-	    (fp.fp_flags & PF_OSFP_MSS_DC) ? "*" : "",
-	    fp.fp_mss,
-	    (fp.fp_flags & PF_OSFP_WSCALE_MOD) ? "%" :
-	    (fp.fp_flags & PF_OSFP_WSCALE_DC) ? "*" : "",
-	    fp.fp_wscale);
-
-#ifdef __FreeBSD__
-	if ((fpresult = pf_osfp_find(&V_pf_osfp_list, &fp,
-#else
-	if ((fpresult = pf_osfp_find(&pf_osfp_list, &fp,
-#endif
-	    PF_OSFP_MAXTTL_OFFSET)))
-		return (&fpresult->fp_oses);
-	return (NULL);
-}
-
-/* Match a fingerprint ID against a list of OSes */
-int
-pf_osfp_match(struct pf_osfp_enlist *list, pf_osfp_t os)
-{
-	struct pf_osfp_entry *entry;
-	int os_class, os_version, os_subtype;
-	int en_class, en_version, en_subtype;
-
-	if (os == PF_OSFP_ANY)
-		return (1);
-	if (list == NULL) {
-		DPFPRINTF("osfp no match against %x\n", os);
-		return (os == PF_OSFP_UNKNOWN);
-	}
-	PF_OSFP_UNPACK(os, os_class, os_version, os_subtype);
-	SLIST_FOREACH(entry, list, fp_entry) {
-		PF_OSFP_UNPACK(entry->fp_os, en_class, en_version, en_subtype);
-		if ((os_class == PF_OSFP_ANY || en_class == os_class) &&
-		    (os_version == PF_OSFP_ANY || en_version == os_version) &&
-		    (os_subtype == PF_OSFP_ANY || en_subtype == os_subtype)) {
-			DPFPRINTF("osfp matched %s %s %s  %x==%x\n",
-			    entry->fp_class_nm, entry->fp_version_nm,
-			    entry->fp_subtype_nm, os, entry->fp_os);
-			return (1);
-		}
-	}
-	DPFPRINTF("fingerprint 0x%x didn't match\n", os);
-	return (0);
-}
-
-/* Initialize the OS fingerprint system */
-#ifdef __FreeBSD__
-int
-#else
-void
-#endif
-pf_osfp_initialize(void)
-{
-#if defined(__FreeBSD__) && defined(_KERNEL)
-	int error = ENOMEM;
-
-	do {
-		pf_osfp_entry_pl = pf_osfp_pl = NULL;
-		UMA_CREATE(pf_osfp_entry_pl, struct pf_osfp_entry, "pfospfen");
-		UMA_CREATE(pf_osfp_pl, struct pf_os_fingerprint, "pfosfp");
-		error = 0;
-	} while(0);
-
-	SLIST_INIT(&V_pf_osfp_list);
-#else
-	pool_init(&pf_osfp_entry_pl, sizeof(struct pf_osfp_entry), 0, 0, 0,
-	    "pfosfpen", &pool_allocator_nointr);
-	pool_init(&pf_osfp_pl, sizeof(struct pf_os_fingerprint), 0, 0, 0,
-	    "pfosfp", &pool_allocator_nointr);
-	SLIST_INIT(&pf_osfp_list);
-#endif
-
-#ifdef __FreeBSD__
-#ifdef _KERNEL
-	return (error);
-#else
-	return (0);
-#endif
-#endif
-}
-
-#if defined(__FreeBSD__) && (_KERNEL)
-void
-pf_osfp_cleanup(void)
-{
-
-	UMA_DESTROY(pf_osfp_entry_pl);
-	UMA_DESTROY(pf_osfp_pl);
-}
-#endif
-
-/* Flush the fingerprint list */
-void
-pf_osfp_flush(void)
-{
-	struct pf_os_fingerprint *fp;
-	struct pf_osfp_entry *entry;
-
-#ifdef __FreeBSD__
-	while ((fp = SLIST_FIRST(&V_pf_osfp_list))) {
-		SLIST_REMOVE_HEAD(&V_pf_osfp_list, fp_next);
-#else
-	while ((fp = SLIST_FIRST(&pf_osfp_list))) {
-		SLIST_REMOVE_HEAD(&pf_osfp_list, fp_next);
-#endif
-		while ((entry = SLIST_FIRST(&fp->fp_oses))) {
-			SLIST_REMOVE_HEAD(&fp->fp_oses, fp_entry);
-			pool_put(&pf_osfp_entry_pl, entry);
-		}
-		pool_put(&pf_osfp_pl, fp);
-	}
-}
-
-
-/* Add a fingerprint */
-int
-pf_osfp_add(struct pf_osfp_ioctl *fpioc)
-{
-	struct pf_os_fingerprint *fp, fpadd;
-	struct pf_osfp_entry *entry;
-
-	memset(&fpadd, 0, sizeof(fpadd));
-	fpadd.fp_tcpopts = fpioc->fp_tcpopts;
-	fpadd.fp_wsize = fpioc->fp_wsize;
-	fpadd.fp_psize = fpioc->fp_psize;
-	fpadd.fp_mss = fpioc->fp_mss;
-	fpadd.fp_flags = fpioc->fp_flags;
-	fpadd.fp_optcnt = fpioc->fp_optcnt;
-	fpadd.fp_wscale = fpioc->fp_wscale;
-	fpadd.fp_ttl = fpioc->fp_ttl;
-
-#if 0	/* XXX RYAN wants to fix logging */
-	DPFPRINTF("adding osfp %s %s %s = %s%d:%d:%d:%s%d:0x%llx %d "
-	    "(TS=%s,M=%s%d,W=%s%d) %x\n",
-	    fpioc->fp_os.fp_class_nm, fpioc->fp_os.fp_version_nm,
-	    fpioc->fp_os.fp_subtype_nm,
-	    (fpadd.fp_flags & PF_OSFP_WSIZE_MOD) ? "%" :
-	    (fpadd.fp_flags & PF_OSFP_WSIZE_MSS) ? "S" :
-	    (fpadd.fp_flags & PF_OSFP_WSIZE_MTU) ? "T" :
-	    (fpadd.fp_flags & PF_OSFP_WSIZE_DC) ? "*" : "",
-	    fpadd.fp_wsize,
-	    fpadd.fp_ttl,
-	    (fpadd.fp_flags & PF_OSFP_DF) ? 1 : 0,
-	    (fpadd.fp_flags & PF_OSFP_PSIZE_MOD) ? "%" :
-	    (fpadd.fp_flags & PF_OSFP_PSIZE_DC) ? "*" : "",
-	    fpadd.fp_psize,
-	    (long long int)fpadd.fp_tcpopts, fpadd.fp_optcnt,
-	    (fpadd.fp_flags & PF_OSFP_TS0) ? "0" : "",
-	    (fpadd.fp_flags & PF_OSFP_MSS_MOD) ? "%" :
-	    (fpadd.fp_flags & PF_OSFP_MSS_DC) ? "*" : "",
-	    fpadd.fp_mss,
-	    (fpadd.fp_flags & PF_OSFP_WSCALE_MOD) ? "%" :
-	    (fpadd.fp_flags & PF_OSFP_WSCALE_DC) ? "*" : "",
-	    fpadd.fp_wscale,
-	    fpioc->fp_os.fp_os);
-#endif
-
-#ifdef __FreeBSD__
-	if ((fp = pf_osfp_find_exact(&V_pf_osfp_list, &fpadd))) {
-#else
-	if ((fp = pf_osfp_find_exact(&pf_osfp_list, &fpadd))) {
-#endif
-		 SLIST_FOREACH(entry, &fp->fp_oses, fp_entry) {
-			if (PF_OSFP_ENTRY_EQ(entry, &fpioc->fp_os))
-				return (EEXIST);
-		}
-		if ((entry = pool_get(&pf_osfp_entry_pl,
-#ifdef __FreeBSD__
-		    PR_NOWAIT)) == NULL)
-#else
-		    PR_WAITOK|PR_LIMITFAIL)) == NULL)
-#endif
-			return (ENOMEM);
-	} else {
-		if ((fp = pool_get(&pf_osfp_pl,
-#ifdef __FreeBSD__
-		    PR_NOWAIT)) == NULL)
-#else
-		    PR_WAITOK|PR_LIMITFAIL)) == NULL)
-#endif
-			return (ENOMEM);
-		memset(fp, 0, sizeof(*fp));
-		fp->fp_tcpopts = fpioc->fp_tcpopts;
-		fp->fp_wsize = fpioc->fp_wsize;
-		fp->fp_psize = fpioc->fp_psize;
-		fp->fp_mss = fpioc->fp_mss;
-		fp->fp_flags = fpioc->fp_flags;
-		fp->fp_optcnt = fpioc->fp_optcnt;
-		fp->fp_wscale = fpioc->fp_wscale;
-		fp->fp_ttl = fpioc->fp_ttl;
-		SLIST_INIT(&fp->fp_oses);
-		if ((entry = pool_get(&pf_osfp_entry_pl,
-#ifdef __FreeBSD__
-		    PR_NOWAIT)) == NULL) {
-#else
-		    PR_WAITOK|PR_LIMITFAIL)) == NULL) {
-#endif
-			pool_put(&pf_osfp_pl, fp);
-			return (ENOMEM);
-		}
-#ifdef __FreeBSD__
-		pf_osfp_insert(&V_pf_osfp_list, fp);
-#else
-		pf_osfp_insert(&pf_osfp_list, fp);
-#endif
-	}
-	memcpy(entry, &fpioc->fp_os, sizeof(*entry));
-
-	/* Make sure the strings are NUL terminated */
-	entry->fp_class_nm[sizeof(entry->fp_class_nm)-1] = '\0';
-	entry->fp_version_nm[sizeof(entry->fp_version_nm)-1] = '\0';
-	entry->fp_subtype_nm[sizeof(entry->fp_subtype_nm)-1] = '\0';
-
-	SLIST_INSERT_HEAD(&fp->fp_oses, entry, fp_entry);
-
-#ifdef PFDEBUG
-	if ((fp = pf_osfp_validate()))
-		printf("Invalid fingerprint list\n");
-#endif /* PFDEBUG */
-	return (0);
-}
-
-
-/* Find a fingerprint in the list */
-struct pf_os_fingerprint *
-pf_osfp_find(struct pf_osfp_list *list, struct pf_os_fingerprint *find,
-    u_int8_t ttldiff)
-{
-	struct pf_os_fingerprint *f;
-
-#define	MATCH_INT(_MOD, _DC, _field)					\
-	if ((f->fp_flags & _DC) == 0) {					\
-		if ((f->fp_flags & _MOD) == 0) {			\
-			if (f->_field != find->_field)			\
-				continue;				\
-		} else {						\
-			if (f->_field == 0 || find->_field % f->_field)	\
-				continue;				\
-		}							\
-	}
-
-	SLIST_FOREACH(f, list, fp_next) {
-		if (f->fp_tcpopts != find->fp_tcpopts ||
-		    f->fp_optcnt != find->fp_optcnt ||
-		    f->fp_ttl < find->fp_ttl ||
-		    f->fp_ttl - find->fp_ttl > ttldiff ||
-		    (f->fp_flags & (PF_OSFP_DF|PF_OSFP_TS0)) !=
-		    (find->fp_flags & (PF_OSFP_DF|PF_OSFP_TS0)))
-			continue;
-
-		MATCH_INT(PF_OSFP_PSIZE_MOD, PF_OSFP_PSIZE_DC, fp_psize)
-		MATCH_INT(PF_OSFP_MSS_MOD, PF_OSFP_MSS_DC, fp_mss)
-		MATCH_INT(PF_OSFP_WSCALE_MOD, PF_OSFP_WSCALE_DC, fp_wscale)
-		if ((f->fp_flags & PF_OSFP_WSIZE_DC) == 0) {
-			if (f->fp_flags & PF_OSFP_WSIZE_MSS) {
-				if (find->fp_mss == 0)
-					continue;
-
-/*
- * Some "smart" NAT devices and DSL routers will tweak the MSS size and
- * will set it to whatever is suitable for the link type.
- */
-#define	SMART_MSS	1460
-				if ((find->fp_wsize % find->fp_mss ||
-				    find->fp_wsize / find->fp_mss !=
-				    f->fp_wsize) &&
-				    (find->fp_wsize % SMART_MSS ||
-				    find->fp_wsize / SMART_MSS !=
-				    f->fp_wsize))
-					continue;
-			} else if (f->fp_flags & PF_OSFP_WSIZE_MTU) {
-				if (find->fp_mss == 0)
-					continue;
-
-#define	MTUOFF		(sizeof(struct ip) + sizeof(struct tcphdr))
-#define	SMART_MTU	(SMART_MSS + MTUOFF)
-				if ((find->fp_wsize % (find->fp_mss + MTUOFF) ||
-				    find->fp_wsize / (find->fp_mss + MTUOFF) !=
-				    f->fp_wsize) &&
-				    (find->fp_wsize % SMART_MTU ||
-				    find->fp_wsize / SMART_MTU !=
-				    f->fp_wsize))
-					continue;
-			} else if (f->fp_flags & PF_OSFP_WSIZE_MOD) {
-				if (f->fp_wsize == 0 || find->fp_wsize %
-				    f->fp_wsize)
-					continue;
-			} else {
-				if (f->fp_wsize != find->fp_wsize)
-					continue;
-			}
-		}
-		return (f);
-	}
-
-	return (NULL);
-}
-
-/* Find an exact fingerprint in the list */
-struct pf_os_fingerprint *
-pf_osfp_find_exact(struct pf_osfp_list *list, struct pf_os_fingerprint *find)
-{
-	struct pf_os_fingerprint *f;
-
-	SLIST_FOREACH(f, list, fp_next) {
-		if (f->fp_tcpopts == find->fp_tcpopts &&
-		    f->fp_wsize == find->fp_wsize &&
-		    f->fp_psize == find->fp_psize &&
-		    f->fp_mss == find->fp_mss &&
-		    f->fp_flags == find->fp_flags &&
-		    f->fp_optcnt == find->fp_optcnt &&
-		    f->fp_wscale == find->fp_wscale &&
-		    f->fp_ttl == find->fp_ttl)
-			return (f);
-	}
-
-	return (NULL);
-}
-
-/* Insert a fingerprint into the list */
-void
-pf_osfp_insert(struct pf_osfp_list *list, struct pf_os_fingerprint *ins)
-{
-	struct pf_os_fingerprint *f, *prev = NULL;
-
-	/* XXX need to go semi tree based.  can key on tcp options */
-
-	SLIST_FOREACH(f, list, fp_next)
-		prev = f;
-	if (prev)
-		SLIST_INSERT_AFTER(prev, ins, fp_next);
-	else
-		SLIST_INSERT_HEAD(list, ins, fp_next);
-}
-
-/* Fill a fingerprint by its number (from an ioctl) */
-int
-pf_osfp_get(struct pf_osfp_ioctl *fpioc)
-{
-	struct pf_os_fingerprint *fp;
-	struct pf_osfp_entry *entry;
-	int num = fpioc->fp_getnum;
-	int i = 0;
-
-
-	memset(fpioc, 0, sizeof(*fpioc));
-#ifdef __FreeBSD__
-	SLIST_FOREACH(fp, &V_pf_osfp_list, fp_next) {
-#else
-	SLIST_FOREACH(fp, &pf_osfp_list, fp_next) {
-#endif
-		SLIST_FOREACH(entry, &fp->fp_oses, fp_entry) {
-			if (i++ == num) {
-				fpioc->fp_mss = fp->fp_mss;
-				fpioc->fp_wsize = fp->fp_wsize;
-				fpioc->fp_flags = fp->fp_flags;
-				fpioc->fp_psize = fp->fp_psize;
-				fpioc->fp_ttl = fp->fp_ttl;
-				fpioc->fp_wscale = fp->fp_wscale;
-				fpioc->fp_getnum = num;
-				memcpy(&fpioc->fp_os, entry,
-				    sizeof(fpioc->fp_os));
-				return (0);
-			}
-		}
-	}
-
-	return (EBUSY);
-}
-
-
-/* Validate that each signature is reachable */
-struct pf_os_fingerprint *
-pf_osfp_validate(void)
-{
-	struct pf_os_fingerprint *f, *f2, find;
-
-#ifdef __FreeBSD__
-	SLIST_FOREACH(f, &V_pf_osfp_list, fp_next) {
-#else
-	SLIST_FOREACH(f, &pf_osfp_list, fp_next) {
-#endif
-		memcpy(&find, f, sizeof(find));
-
-		/* We do a few MSS/th_win percolations to make things unique */
-		if (find.fp_mss == 0)
-			find.fp_mss = 128;
-		if (f->fp_flags & PF_OSFP_WSIZE_MSS)
-			find.fp_wsize *= find.fp_mss;
-		else if (f->fp_flags & PF_OSFP_WSIZE_MTU)
-			find.fp_wsize *= (find.fp_mss + 40);
-		else if (f->fp_flags & PF_OSFP_WSIZE_MOD)
-			find.fp_wsize *= 2;
-#ifdef __FreeBSD__
-		if (f != (f2 = pf_osfp_find(&V_pf_osfp_list, &find, 0))) {
-#else
-		if (f != (f2 = pf_osfp_find(&pf_osfp_list, &find, 0))) {
-#endif
-			if (f2)
-				printf("Found \"%s %s %s\" instead of "
-				    "\"%s %s %s\"\n",
-				    SLIST_FIRST(&f2->fp_oses)->fp_class_nm,
-				    SLIST_FIRST(&f2->fp_oses)->fp_version_nm,
-				    SLIST_FIRST(&f2->fp_oses)->fp_subtype_nm,
-				    SLIST_FIRST(&f->fp_oses)->fp_class_nm,
-				    SLIST_FIRST(&f->fp_oses)->fp_version_nm,
-				    SLIST_FIRST(&f->fp_oses)->fp_subtype_nm);
-			else
-				printf("Couldn't find \"%s %s %s\"\n",
-				    SLIST_FIRST(&f->fp_oses)->fp_class_nm,
-				    SLIST_FIRST(&f->fp_oses)->fp_version_nm,
-				    SLIST_FIRST(&f->fp_oses)->fp_subtype_nm);
-			return (f);
-		}
-	}
-	return (NULL);
-}
diff --git a/sys/contrib/pf/net/pf_ruleset.c b/sys/contrib/pf/net/pf_ruleset.c
deleted file mode 100644
index ca8667c571e5..000000000000
--- a/sys/contrib/pf/net/pf_ruleset.c
+++ /dev/null
@@ -1,457 +0,0 @@
-/*	$OpenBSD: pf_ruleset.c,v 1.2 2008/12/18 15:31:37 dhill Exp $ */
-
-/*
- * Copyright (c) 2001 Daniel Hartmeier
- * Copyright (c) 2002,2003 Henning Brauer
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *    - Redistributions of source code must retain the above copyright
- *      notice, this list of conditions and the following disclaimer.
- *    - Redistributions in binary form must reproduce the above
- *      copyright notice, this list of conditions and the following
- *      disclaimer in the documentation and/or other materials provided
- *      with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
- * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
- * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
- * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
- * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
- * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- *
- * Effort sponsored in part by the Defense Advanced Research Projects
- * Agency (DARPA) and Air Force Research Laboratory, Air Force
- * Materiel Command, USAF, under agreement number F30602-01-2-0537.
- *
- */
-
-#ifdef __FreeBSD__
-#include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
-#endif
-
-#include <sys/param.h>
-#include <sys/socket.h>
-#ifdef _KERNEL
-# include <sys/systm.h>
-#endif /* _KERNEL */
-#include <sys/mbuf.h>
-
-#include <netinet/in.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#include <netinet/tcp.h>
-
-#include <net/if.h>
-#include <net/pfvar.h>
-
-#ifdef INET6
-#include <netinet/ip6.h>
-#endif /* INET6 */
-
-
-#ifdef _KERNEL
-#ifdef __FreeBSD__
-#define DPFPRINTF(format, x...)				\
-	if (V_pf_status.debug >= PF_DEBUG_NOISY)	\
-		printf(format , ##x)
-#else
-#define DPFPRINTF(format, x...)				\
-	if (pf_status.debug >= PF_DEBUG_NOISY)		\
-		printf(format , ##x)
-#endif
-#ifdef __FreeBSD__
-#define rs_malloc(x)		malloc(x, M_TEMP, M_NOWAIT|M_ZERO)
-#else
-#define rs_malloc(x)		malloc(x, M_TEMP, M_WAITOK|M_CANFAIL|M_ZERO)
-#endif
-#define rs_free(x)		free(x, M_TEMP)
-
-#else
-/* Userland equivalents so we can lend code to pfctl et al. */
-
-#include <arpa/inet.h>
-#include <errno.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#define rs_malloc(x)		 calloc(1, x)
-#define rs_free(x)		 free(x)
-
-#ifdef PFDEBUG
-#include <sys/stdarg.h>
-#define DPFPRINTF(format, x...)	fprintf(stderr, format , ##x)
-#else
-#define DPFPRINTF(format, x...)	((void)0)
-#endif /* PFDEBUG */
-#endif /* _KERNEL */
-
-#if defined(__FreeBSD__) && !defined(_KERNEL)
-#undef V_pf_anchors
-#define V_pf_anchors		 pf_anchors
-
-#undef pf_main_ruleset
-#define pf_main_ruleset		 pf_main_anchor.ruleset
-#endif
-
-#if defined(__FreeBSD__) && defined(_KERNEL)
-VNET_DEFINE(struct pf_anchor_global,	pf_anchors);
-VNET_DEFINE(struct pf_anchor,		pf_main_anchor);
-#else
-struct pf_anchor_global	 pf_anchors;
-struct pf_anchor	 pf_main_anchor;
-#endif
-
-static __inline int pf_anchor_compare(struct pf_anchor *, struct pf_anchor *);
-
-RB_GENERATE(pf_anchor_global, pf_anchor, entry_global, pf_anchor_compare);
-RB_GENERATE(pf_anchor_node, pf_anchor, entry_node, pf_anchor_compare);
-
-static __inline int
-pf_anchor_compare(struct pf_anchor *a, struct pf_anchor *b)
-{
-	int c = strcmp(a->path, b->path);
-
-	return (c ? (c < 0 ? -1 : 1) : 0);
-}
-
-int
-pf_get_ruleset_number(u_int8_t action)
-{
-	switch (action) {
-	case PF_SCRUB:
-	case PF_NOSCRUB:
-		return (PF_RULESET_SCRUB);
-		break;
-	case PF_PASS:
-	case PF_DROP:
-		return (PF_RULESET_FILTER);
-		break;
-	case PF_NAT:
-	case PF_NONAT:
-		return (PF_RULESET_NAT);
-		break;
-	case PF_BINAT:
-	case PF_NOBINAT:
-		return (PF_RULESET_BINAT);
-		break;
-	case PF_RDR:
-	case PF_NORDR:
-		return (PF_RULESET_RDR);
-		break;
-	default:
-		return (PF_RULESET_MAX);
-		break;
-	}
-}
-
-void
-pf_init_ruleset(struct pf_ruleset *ruleset)
-{
-	int	i;
-
-	memset(ruleset, 0, sizeof(struct pf_ruleset));
-	for (i = 0; i < PF_RULESET_MAX; i++) {
-		TAILQ_INIT(&ruleset->rules[i].queues[0]);
-		TAILQ_INIT(&ruleset->rules[i].queues[1]);
-		ruleset->rules[i].active.ptr = &ruleset->rules[i].queues[0];
-		ruleset->rules[i].inactive.ptr = &ruleset->rules[i].queues[1];
-	}
-}
-
-struct pf_anchor *
-pf_find_anchor(const char *path)
-{
-	struct pf_anchor	*key, *found;
-
-	key = (struct pf_anchor *)rs_malloc(sizeof(*key));
-	if (key == NULL)
-		return (NULL);
-	strlcpy(key->path, path, sizeof(key->path));
-#ifdef __FreeBSD__
-	found = RB_FIND(pf_anchor_global, &V_pf_anchors, key);
-#else
-	found = RB_FIND(pf_anchor_global, &pf_anchors, key);
-#endif
-	rs_free(key);
-	return (found);
-}
-
-struct pf_ruleset *
-pf_find_ruleset(const char *path)
-{
-	struct pf_anchor	*anchor;
-
-	while (*path == '/')
-		path++;
-	if (!*path)
-		return (&pf_main_ruleset);
-	anchor = pf_find_anchor(path);
-	if (anchor == NULL)
-		return (NULL);
-	else
-		return (&anchor->ruleset);
-}
-
-struct pf_ruleset *
-pf_find_or_create_ruleset(const char *path)
-{
-	char			*p, *q, *r;
-	struct pf_ruleset	*ruleset;
-#ifdef __FreeBSD__
-	struct pf_anchor	*anchor = NULL, *dup, *parent = NULL;
-#else
-	struct pf_anchor	*anchor, *dup, *parent = NULL;
-#endif
-
-	if (path[0] == 0)
-		return (&pf_main_ruleset);
-	while (*path == '/')
-		path++;
-	ruleset = pf_find_ruleset(path);
-	if (ruleset != NULL)
-		return (ruleset);
-	p = (char *)rs_malloc(MAXPATHLEN);
-	if (p == NULL)
-		return (NULL);
-	strlcpy(p, path, MAXPATHLEN);
-	while (parent == NULL && (q = strrchr(p, '/')) != NULL) {
-		*q = 0;
-		if ((ruleset = pf_find_ruleset(p)) != NULL) {
-			parent = ruleset->anchor;
-			break;
-		}
-	}
-	if (q == NULL)
-		q = p;
-	else
-		q++;
-	strlcpy(p, path, MAXPATHLEN);
-	if (!*q) {
-		rs_free(p);
-		return (NULL);
-	}
-	while ((r = strchr(q, '/')) != NULL || *q) {
-		if (r != NULL)
-			*r = 0;
-		if (!*q || strlen(q) >= PF_ANCHOR_NAME_SIZE ||
-		    (parent != NULL && strlen(parent->path) >=
-		    MAXPATHLEN - PF_ANCHOR_NAME_SIZE - 1)) {
-			rs_free(p);
-			return (NULL);
-		}
-		anchor = (struct pf_anchor *)rs_malloc(sizeof(*anchor));
-		if (anchor == NULL) {
-			rs_free(p);
-			return (NULL);
-		}
-		RB_INIT(&anchor->children);
-		strlcpy(anchor->name, q, sizeof(anchor->name));
-		if (parent != NULL) {
-			strlcpy(anchor->path, parent->path,
-			    sizeof(anchor->path));
-			strlcat(anchor->path, "/", sizeof(anchor->path));
-		}
-		strlcat(anchor->path, anchor->name, sizeof(anchor->path));
-#ifdef __FreeBSD__
-		if ((dup = RB_INSERT(pf_anchor_global, &V_pf_anchors, anchor)) !=
-#else
-		if ((dup = RB_INSERT(pf_anchor_global, &pf_anchors, anchor)) !=
-#endif
-		    NULL) {
-			printf("pf_find_or_create_ruleset: RB_INSERT1 "
-			    "'%s' '%s' collides with '%s' '%s'\n",
-			    anchor->path, anchor->name, dup->path, dup->name);
-			rs_free(anchor);
-			rs_free(p);
-			return (NULL);
-		}
-		if (parent != NULL) {
-			anchor->parent = parent;
-			if ((dup = RB_INSERT(pf_anchor_node, &parent->children,
-			    anchor)) != NULL) {
-				printf("pf_find_or_create_ruleset: "
-				    "RB_INSERT2 '%s' '%s' collides with "
-				    "'%s' '%s'\n", anchor->path, anchor->name,
-				    dup->path, dup->name);
-#ifdef __FreeBSD__
-				RB_REMOVE(pf_anchor_global, &V_pf_anchors,
-#else
-				RB_REMOVE(pf_anchor_global, &pf_anchors,
-#endif
-				    anchor);
-				rs_free(anchor);
-				rs_free(p);
-				return (NULL);
-			}
-		}
-		pf_init_ruleset(&anchor->ruleset);
-		anchor->ruleset.anchor = anchor;
-		parent = anchor;
-		if (r != NULL)
-			q = r + 1;
-		else
-			*q = 0;
-	}
-	rs_free(p);
-	return (&anchor->ruleset);
-}
-
-void
-pf_remove_if_empty_ruleset(struct pf_ruleset *ruleset)
-{
-	struct pf_anchor	*parent;
-	int			 i;
-
-	while (ruleset != NULL) {
-		if (ruleset == &pf_main_ruleset || ruleset->anchor == NULL ||
-		    !RB_EMPTY(&ruleset->anchor->children) ||
-		    ruleset->anchor->refcnt > 0 || ruleset->tables > 0 ||
-		    ruleset->topen)
-			return;
-		for (i = 0; i < PF_RULESET_MAX; ++i)
-			if (!TAILQ_EMPTY(ruleset->rules[i].active.ptr) ||
-			    !TAILQ_EMPTY(ruleset->rules[i].inactive.ptr) ||
-			    ruleset->rules[i].inactive.open)
-				return;
-#ifdef __FreeBSD__
-		RB_REMOVE(pf_anchor_global, &V_pf_anchors, ruleset->anchor);
-#else
-		RB_REMOVE(pf_anchor_global, &pf_anchors, ruleset->anchor);
-#endif
-		if ((parent = ruleset->anchor->parent) != NULL)
-			RB_REMOVE(pf_anchor_node, &parent->children,
-			    ruleset->anchor);
-		rs_free(ruleset->anchor);
-		if (parent == NULL)
-			return;
-		ruleset = &parent->ruleset;
-	}
-}
-
-int
-pf_anchor_setup(struct pf_rule *r, const struct pf_ruleset *s,
-    const char *name)
-{
-	char			*p, *path;
-	struct pf_ruleset	*ruleset;
-
-	r->anchor = NULL;
-	r->anchor_relative = 0;
-	r->anchor_wildcard = 0;
-	if (!name[0])
-		return (0);
-	path = (char *)rs_malloc(MAXPATHLEN);
-	if (path == NULL)
-		return (1);
-	if (name[0] == '/')
-		strlcpy(path, name + 1, MAXPATHLEN);
-	else {
-		/* relative path */
-		r->anchor_relative = 1;
-		if (s->anchor == NULL || !s->anchor->path[0])
-			path[0] = 0;
-		else
-			strlcpy(path, s->anchor->path, MAXPATHLEN);
-		while (name[0] == '.' && name[1] == '.' && name[2] == '/') {
-			if (!path[0]) {
-				printf("pf_anchor_setup: .. beyond root\n");
-				rs_free(path);
-				return (1);
-			}
-			if ((p = strrchr(path, '/')) != NULL)
-				*p = 0;
-			else
-				path[0] = 0;
-			r->anchor_relative++;
-			name += 3;
-		}
-		if (path[0])
-			strlcat(path, "/", MAXPATHLEN);
-		strlcat(path, name, MAXPATHLEN);
-	}
-	if ((p = strrchr(path, '/')) != NULL && !strcmp(p, "/*")) {
-		r->anchor_wildcard = 1;
-		*p = 0;
-	}
-	ruleset = pf_find_or_create_ruleset(path);
-	rs_free(path);
-	if (ruleset == NULL || ruleset->anchor == NULL) {
-		printf("pf_anchor_setup: ruleset\n");
-		return (1);
-	}
-	r->anchor = ruleset->anchor;
-	r->anchor->refcnt++;
-	return (0);
-}
-
-int
-pf_anchor_copyout(const struct pf_ruleset *rs, const struct pf_rule *r,
-    struct pfioc_rule *pr)
-{
-	pr->anchor_call[0] = 0;
-	if (r->anchor == NULL)
-		return (0);
-	if (!r->anchor_relative) {
-		strlcpy(pr->anchor_call, "/", sizeof(pr->anchor_call));
-		strlcat(pr->anchor_call, r->anchor->path,
-		    sizeof(pr->anchor_call));
-	} else {
-		char	*a, *p;
-		int	 i;
-
-		a = (char *)rs_malloc(MAXPATHLEN);
-		if (a == NULL)
-			return (1);
-		if (rs->anchor == NULL)
-			a[0] = 0;
-		else
-			strlcpy(a, rs->anchor->path, MAXPATHLEN);
-		for (i = 1; i < r->anchor_relative; ++i) {
-			if ((p = strrchr(a, '/')) == NULL)
-				p = a;
-			*p = 0;
-			strlcat(pr->anchor_call, "../",
-			    sizeof(pr->anchor_call));
-		}
-		if (strncmp(a, r->anchor->path, strlen(a))) {
-			printf("pf_anchor_copyout: '%s' '%s'\n", a,
-			    r->anchor->path);
-			rs_free(a);
-			return (1);
-		}
-		if (strlen(r->anchor->path) > strlen(a))
-			strlcat(pr->anchor_call, r->anchor->path + (a[0] ?
-			    strlen(a) + 1 : 0), sizeof(pr->anchor_call));
-		rs_free(a);
-	}
-	if (r->anchor_wildcard)
-		strlcat(pr->anchor_call, pr->anchor_call[0] ? "/*" : "*",
-		    sizeof(pr->anchor_call));
-	return (0);
-}
-
-void
-pf_anchor_remove(struct pf_rule *r)
-{
-	if (r->anchor == NULL)
-		return;
-	if (r->anchor->refcnt <= 0) {
-		printf("pf_anchor_remove: broken refcount\n");
-		r->anchor = NULL;
-		return;
-	}
-	if (!--r->anchor->refcnt)
-		pf_remove_if_empty_ruleset(&r->anchor->ruleset);
-	r->anchor = NULL;
-}
diff --git a/sys/contrib/pf/net/pf_table.c b/sys/contrib/pf/net/pf_table.c
deleted file mode 100644
index ea77e31375ce..000000000000
--- a/sys/contrib/pf/net/pf_table.c
+++ /dev/null
@@ -1,2516 +0,0 @@
-/*	$OpenBSD: pf_table.c,v 1.79 2008/10/08 06:24:50 mcbride Exp $	*/
-
-/*
- * Copyright (c) 2002 Cedric Berger
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *    - Redistributions of source code must retain the above copyright
- *      notice, this list of conditions and the following disclaimer.
- *    - Redistributions in binary form must reproduce the above
- *      copyright notice, this list of conditions and the following
- *      disclaimer in the documentation and/or other materials provided
- *      with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
- * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
- * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
- * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
- * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
- * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- *
- */
-
-#ifdef __FreeBSD__
-#include "opt_inet.h"
-#include "opt_inet6.h"
-
-#include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
-#endif
-
-#include <sys/param.h>
-#include <sys/systm.h>
-#include <sys/socket.h>
-#include <sys/mbuf.h>
-#include <sys/kernel.h>
-#ifdef __FreeBSD__
-#include <sys/malloc.h>
-#else
-#include <sys/pool.h>
-#endif
-
-#include <net/if.h>
-#include <net/route.h>
-#include <netinet/in.h>
-#ifndef __FreeBSD__
-#include <netinet/ip_ipsp.h>
-#endif
-#include <net/pfvar.h>
-
-#define	ACCEPT_FLAGS(flags, oklist)		\
-	do {					\
-		if ((flags & ~(oklist)) &	\
-		    PFR_FLAG_ALLMASK)		\
-			return (EINVAL);	\
-	} while (0)
-
-#ifdef __FreeBSD__
-static inline int
-_copyin(const void *uaddr, void *kaddr, size_t len)
-{
-	int r;
-
-	PF_UNLOCK();
-	r = copyin(uaddr, kaddr, len);
-	PF_LOCK();
-
-	return (r);
-}
-
-static inline int
-_copyout(const void *uaddr, void *kaddr, size_t len)
-{
-	int r;
-
-	PF_UNLOCK();
-	r = copyout(uaddr, kaddr, len);
-	PF_LOCK();
-
-	return (r);
-}
-
-#define	COPYIN(from, to, size, flags)		\
-	((flags & PFR_FLAG_USERIOCTL) ?		\
-	_copyin((from), (to), (size)) :		\
-	(bcopy((from), (to), (size)), 0))
-
-#define	COPYOUT(from, to, size, flags)		\
-	((flags & PFR_FLAG_USERIOCTL) ?		\
-	_copyout((from), (to), (size)) :	\
-	(bcopy((from), (to), (size)), 0))
-
-#else
-#define	COPYIN(from, to, size, flags)		\
-	((flags & PFR_FLAG_USERIOCTL) ?		\
-	copyin((from), (to), (size)) :		\
-	(bcopy((from), (to), (size)), 0))
-
-#define	COPYOUT(from, to, size, flags)		\
-	((flags & PFR_FLAG_USERIOCTL) ?		\
-	copyout((from), (to), (size)) :		\
-	(bcopy((from), (to), (size)), 0))
-#endif
-
-#define	FILLIN_SIN(sin, addr)			\
-	do {					\
-		(sin).sin_len = sizeof(sin);	\
-		(sin).sin_family = AF_INET;	\
-		(sin).sin_addr = (addr);	\
-	} while (0)
-
-#define	FILLIN_SIN6(sin6, addr)			\
-	do {					\
-		(sin6).sin6_len = sizeof(sin6);	\
-		(sin6).sin6_family = AF_INET6;	\
-		(sin6).sin6_addr = (addr);	\
-	} while (0)
-
-#define	SWAP(type, a1, a2)			\
-	do {					\
-		type tmp = a1;			\
-		a1 = a2;			\
-		a2 = tmp;			\
-	} while (0)
-
-#define	SUNION2PF(su, af) (((af)==AF_INET) ?	\
-    (struct pf_addr *)&(su)->sin.sin_addr :	\
-    (struct pf_addr *)&(su)->sin6.sin6_addr)
-
-#define	AF_BITS(af)		(((af)==AF_INET)?32:128)
-#define	ADDR_NETWORK(ad)	((ad)->pfra_net < AF_BITS((ad)->pfra_af))
-#define	KENTRY_NETWORK(ke)	((ke)->pfrke_net < AF_BITS((ke)->pfrke_af))
-#define	KENTRY_RNF_ROOT(ke) \
-		((((struct radix_node *)(ke))->rn_flags & RNF_ROOT) != 0)
-
-#define	NO_ADDRESSES		(-1)
-#define	ENQUEUE_UNMARKED_ONLY	(1)
-#define	INVERT_NEG_FLAG		(1)
-
-struct pfr_walktree {
-	enum pfrw_op {
-		PFRW_MARK,
-		PFRW_SWEEP,
-		PFRW_ENQUEUE,
-		PFRW_GET_ADDRS,
-		PFRW_GET_ASTATS,
-		PFRW_POOL_GET,
-		PFRW_DYNADDR_UPDATE
-	}	 pfrw_op;
-	union {
-		struct pfr_addr		*pfrw1_addr;
-		struct pfr_astats	*pfrw1_astats;
-		struct pfr_kentryworkq	*pfrw1_workq;
-		struct pfr_kentry	*pfrw1_kentry;
-		struct pfi_dynaddr	*pfrw1_dyn;
-	}	 pfrw_1;
-	int	 pfrw_free;
-	int	 pfrw_flags;
-};
-#define	pfrw_addr	pfrw_1.pfrw1_addr
-#define	pfrw_astats	pfrw_1.pfrw1_astats
-#define	pfrw_workq	pfrw_1.pfrw1_workq
-#define	pfrw_kentry	pfrw_1.pfrw1_kentry
-#define	pfrw_dyn	pfrw_1.pfrw1_dyn
-#define	pfrw_cnt	pfrw_free
-
-#define	senderr(e)	do { rv = (e); goto _bad; } while (0)
-
-#ifdef __FreeBSD__
-VNET_DEFINE(uma_zone_t,			pfr_ktable_pl);
-VNET_DEFINE(uma_zone_t,			pfr_kentry_pl);
-VNET_DEFINE(uma_zone_t,			pfr_kcounters_pl);
-VNET_DEFINE(struct sockaddr_in,		pfr_sin);
-#define	V_pfr_sin			VNET(pfr_sin)
-VNET_DEFINE(struct sockaddr_in6,	pfr_sin6);
-#define	V_pfr_sin6			VNET(pfr_sin6)
-VNET_DEFINE(union sockaddr_union,	pfr_mask);
-#define	V_pfr_mask			VNET(pfr_mask)
-VNET_DEFINE(struct pf_addr,		pfr_ffaddr);
-#define	V_pfr_ffaddr			VNET(pfr_ffaddr)
-#else
-struct pool		 pfr_ktable_pl;
-struct pool		 pfr_kentry_pl;
-struct pool		 pfr_kcounters_pl;
-struct sockaddr_in	 pfr_sin;
-struct sockaddr_in6	 pfr_sin6;
-union sockaddr_union	 pfr_mask;
-struct pf_addr		 pfr_ffaddr;
-#endif
-
-void			 pfr_copyout_addr(struct pfr_addr *,
-			    struct pfr_kentry *ke);
-int			 pfr_validate_addr(struct pfr_addr *);
-void			 pfr_enqueue_addrs(struct pfr_ktable *,
-			    struct pfr_kentryworkq *, int *, int);
-void			 pfr_mark_addrs(struct pfr_ktable *);
-struct pfr_kentry	*pfr_lookup_addr(struct pfr_ktable *,
-			    struct pfr_addr *, int);
-struct pfr_kentry	*pfr_create_kentry(struct pfr_addr *, int);
-void			 pfr_destroy_kentries(struct pfr_kentryworkq *);
-void			 pfr_destroy_kentry(struct pfr_kentry *);
-void			 pfr_insert_kentries(struct pfr_ktable *,
-			    struct pfr_kentryworkq *, long);
-void			 pfr_remove_kentries(struct pfr_ktable *,
-			    struct pfr_kentryworkq *);
-void			 pfr_clstats_kentries(struct pfr_kentryworkq *, long,
-			    int);
-void			 pfr_reset_feedback(struct pfr_addr *, int, int);
-void			 pfr_prepare_network(union sockaddr_union *, int, int);
-int			 pfr_route_kentry(struct pfr_ktable *,
-			    struct pfr_kentry *);
-int			 pfr_unroute_kentry(struct pfr_ktable *,
-			    struct pfr_kentry *);
-int			 pfr_walktree(struct radix_node *, void *);
-int			 pfr_validate_table(struct pfr_table *, int, int);
-int			 pfr_fix_anchor(char *);
-void			 pfr_commit_ktable(struct pfr_ktable *, long);
-void			 pfr_insert_ktables(struct pfr_ktableworkq *);
-void			 pfr_insert_ktable(struct pfr_ktable *);
-void			 pfr_setflags_ktables(struct pfr_ktableworkq *);
-void			 pfr_setflags_ktable(struct pfr_ktable *, int);
-void			 pfr_clstats_ktables(struct pfr_ktableworkq *, long,
-			    int);
-void			 pfr_clstats_ktable(struct pfr_ktable *, long, int);
-struct pfr_ktable	*pfr_create_ktable(struct pfr_table *, long, int, int);
-void			 pfr_destroy_ktables(struct pfr_ktableworkq *, int);
-void			 pfr_destroy_ktable(struct pfr_ktable *, int);
-int			 pfr_ktable_compare(struct pfr_ktable *,
-			    struct pfr_ktable *);
-struct pfr_ktable	*pfr_lookup_table(struct pfr_table *);
-void			 pfr_clean_node_mask(struct pfr_ktable *,
-			    struct pfr_kentryworkq *);
-int			 pfr_table_count(struct pfr_table *, int);
-int			 pfr_skip_table(struct pfr_table *,
-			    struct pfr_ktable *, int);
-struct pfr_kentry	*pfr_kentry_byidx(struct pfr_ktable *, int, int);
-
-RB_PROTOTYPE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
-RB_GENERATE(pfr_ktablehead, pfr_ktable, pfrkt_tree, pfr_ktable_compare);
-
-struct pfr_ktablehead	 pfr_ktables;
-struct pfr_table	 pfr_nulltable;
-int			 pfr_ktable_cnt;
-
-void
-pfr_initialize(void)
-{
-#ifndef __FreeBSD__
-	pool_init(&pfr_ktable_pl, sizeof(struct pfr_ktable), 0, 0, 0,
-	    "pfrktable", NULL);
-	pool_init(&pfr_kentry_pl, sizeof(struct pfr_kentry), 0, 0, 0,
-	    "pfrkentry", NULL);
-	pool_init(&pfr_kcounters_pl, sizeof(struct pfr_kcounters), 0, 0, 0,
-	    "pfrkcounters", NULL);
-
-	pfr_sin.sin_len = sizeof(pfr_sin);
-	pfr_sin.sin_family = AF_INET;
-	pfr_sin6.sin6_len = sizeof(pfr_sin6);
-	pfr_sin6.sin6_family = AF_INET6;
-
-	memset(&pfr_ffaddr, 0xff, sizeof(pfr_ffaddr));
-#else
-	V_pfr_sin.sin_len = sizeof(V_pfr_sin);
-	V_pfr_sin.sin_family = AF_INET;
-	V_pfr_sin6.sin6_len = sizeof(V_pfr_sin6);
-	V_pfr_sin6.sin6_family = AF_INET6;
-
-	memset(&V_pfr_ffaddr, 0xff, sizeof(V_pfr_ffaddr));
-#endif
-}
-
-int
-pfr_clr_addrs(struct pfr_table *tbl, int *ndel, int flags)
-{
-	struct pfr_ktable	*kt;
-	struct pfr_kentryworkq	 workq;
-	int			 s;
-
-	ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY);
-	if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
-		return (EINVAL);
-	kt = pfr_lookup_table(tbl);
-	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
-		return (ESRCH);
-	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
-		return (EPERM);
-	pfr_enqueue_addrs(kt, &workq, ndel, 0);
-
-	if (!(flags & PFR_FLAG_DUMMY)) {
-		if (flags & PFR_FLAG_ATOMIC)
-			s = splsoftnet();
-		pfr_remove_kentries(kt, &workq);
-		if (flags & PFR_FLAG_ATOMIC)
-			splx(s);
-		if (kt->pfrkt_cnt) {
-			printf("pfr_clr_addrs: corruption detected (%d).\n",
-			    kt->pfrkt_cnt);
-			kt->pfrkt_cnt = 0;
-		}
-	}
-	return (0);
-}
-
-int
-pfr_add_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
-    int *nadd, int flags)
-{
-	struct pfr_ktable	*kt, *tmpkt;
-	struct pfr_kentryworkq	 workq;
-	struct pfr_kentry	*p, *q;
-	struct pfr_addr		 ad;
-	int			 i, rv, s, xadd = 0;
-	long			 tzero = time_second;
-
-	ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
-	    PFR_FLAG_FEEDBACK);
-	if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
-		return (EINVAL);
-	kt = pfr_lookup_table(tbl);
-	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
-		return (ESRCH);
-	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
-		return (EPERM);
-	tmpkt = pfr_create_ktable(&pfr_nulltable, 0, 0,
-	    !(flags & PFR_FLAG_USERIOCTL));
-	if (tmpkt == NULL)
-		return (ENOMEM);
-	SLIST_INIT(&workq);
-	for (i = 0; i < size; i++) {
-		if (COPYIN(addr+i, &ad, sizeof(ad), flags))
-			senderr(EFAULT);
-		if (pfr_validate_addr(&ad))
-			senderr(EINVAL);
-		p = pfr_lookup_addr(kt, &ad, 1);
-		q = pfr_lookup_addr(tmpkt, &ad, 1);
-		if (flags & PFR_FLAG_FEEDBACK) {
-			if (q != NULL)
-				ad.pfra_fback = PFR_FB_DUPLICATE;
-			else if (p == NULL)
-				ad.pfra_fback = PFR_FB_ADDED;
-			else if (p->pfrke_not != ad.pfra_not)
-				ad.pfra_fback = PFR_FB_CONFLICT;
-			else
-				ad.pfra_fback = PFR_FB_NONE;
-		}
-		if (p == NULL && q == NULL) {
-			p = pfr_create_kentry(&ad,
-			    !(flags & PFR_FLAG_USERIOCTL));
-			if (p == NULL)
-				senderr(ENOMEM);
-			if (pfr_route_kentry(tmpkt, p)) {
-				pfr_destroy_kentry(p);
-				ad.pfra_fback = PFR_FB_NONE;
-			} else {
-				SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
-				xadd++;
-			}
-		}
-		if (flags & PFR_FLAG_FEEDBACK)
-			if (COPYOUT(&ad, addr+i, sizeof(ad), flags))
-				senderr(EFAULT);
-	}
-	pfr_clean_node_mask(tmpkt, &workq);
-	if (!(flags & PFR_FLAG_DUMMY)) {
-		if (flags & PFR_FLAG_ATOMIC)
-			s = splsoftnet();
-		pfr_insert_kentries(kt, &workq, tzero);
-		if (flags & PFR_FLAG_ATOMIC)
-			splx(s);
-	} else
-		pfr_destroy_kentries(&workq);
-	if (nadd != NULL)
-		*nadd = xadd;
-	pfr_destroy_ktable(tmpkt, 0);
-	return (0);
-_bad:
-	pfr_clean_node_mask(tmpkt, &workq);
-	pfr_destroy_kentries(&workq);
-	if (flags & PFR_FLAG_FEEDBACK)
-		pfr_reset_feedback(addr, size, flags);
-	pfr_destroy_ktable(tmpkt, 0);
-	return (rv);
-}
-
-int
-pfr_del_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
-    int *ndel, int flags)
-{
-	struct pfr_ktable	*kt;
-	struct pfr_kentryworkq	 workq;
-	struct pfr_kentry	*p;
-	struct pfr_addr		 ad;
-	int			 i, rv, s, xdel = 0, log = 1;
-
-	ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
-	    PFR_FLAG_FEEDBACK);
-	if (pfr_validate_table(tbl, 0, flags & PFR_FLAG_USERIOCTL))
-		return (EINVAL);
-	kt = pfr_lookup_table(tbl);
-	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
-		return (ESRCH);
-	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
-		return (EPERM);
-	/*
-	 * there are two algorithms to choose from here.
-	 * with:
-	 *   n: number of addresses to delete
-	 *   N: number of addresses in the table
-	 *
-	 * one is O(N) and is better for large 'n'
-	 * one is O(n*LOG(N)) and is better for small 'n'
-	 * 
-	 * following code try to decide which one is best.
-	 */
-	for (i = kt->pfrkt_cnt; i > 0; i >>= 1)
-		log++;
-	if (size > kt->pfrkt_cnt/log) {
-		/* full table scan */
-		pfr_mark_addrs(kt);
-	} else {
-		/* iterate over addresses to delete */
-		for (i = 0; i < size; i++) {
-			if (COPYIN(addr+i, &ad, sizeof(ad), flags))
-				return (EFAULT);
-			if (pfr_validate_addr(&ad))
-				return (EINVAL);
-			p = pfr_lookup_addr(kt, &ad, 1);
-			if (p != NULL)
-				p->pfrke_mark = 0;
-		}
-	}
-	SLIST_INIT(&workq);
-	for (i = 0; i < size; i++) {
-		if (COPYIN(addr+i, &ad, sizeof(ad), flags))
-			senderr(EFAULT);
-		if (pfr_validate_addr(&ad))
-			senderr(EINVAL);
-		p = pfr_lookup_addr(kt, &ad, 1);
-		if (flags & PFR_FLAG_FEEDBACK) {
-			if (p == NULL)
-				ad.pfra_fback = PFR_FB_NONE;
-			else if (p->pfrke_not != ad.pfra_not)
-				ad.pfra_fback = PFR_FB_CONFLICT;
-			else if (p->pfrke_mark)
-				ad.pfra_fback = PFR_FB_DUPLICATE;
-			else
-				ad.pfra_fback = PFR_FB_DELETED;
-		}
-		if (p != NULL && p->pfrke_not == ad.pfra_not &&
-		    !p->pfrke_mark) {
-			p->pfrke_mark = 1;
-			SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
-			xdel++;
-		}
-		if (flags & PFR_FLAG_FEEDBACK)
-			if (COPYOUT(&ad, addr+i, sizeof(ad), flags))
-				senderr(EFAULT);
-	}
-	if (!(flags & PFR_FLAG_DUMMY)) {
-		if (flags & PFR_FLAG_ATOMIC)
-			s = splsoftnet();
-		pfr_remove_kentries(kt, &workq);
-		if (flags & PFR_FLAG_ATOMIC)
-			splx(s);
-	}
-	if (ndel != NULL)
-		*ndel = xdel;
-	return (0);
-_bad:
-	if (flags & PFR_FLAG_FEEDBACK)
-		pfr_reset_feedback(addr, size, flags);
-	return (rv);
-}
-
-int
-pfr_set_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
-    int *size2, int *nadd, int *ndel, int *nchange, int flags,
-    u_int32_t ignore_pfrt_flags)
-{
-	struct pfr_ktable	*kt, *tmpkt;
-	struct pfr_kentryworkq	 addq, delq, changeq;
-	struct pfr_kentry	*p, *q;
-	struct pfr_addr		 ad;
-	int			 i, rv, s, xadd = 0, xdel = 0, xchange = 0;
-	long			 tzero = time_second;
-
-	ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
-	    PFR_FLAG_FEEDBACK);
-	if (pfr_validate_table(tbl, ignore_pfrt_flags, flags &
-	    PFR_FLAG_USERIOCTL))
-		return (EINVAL);
-	kt = pfr_lookup_table(tbl);
-	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
-		return (ESRCH);
-	if (kt->pfrkt_flags & PFR_TFLAG_CONST)
-		return (EPERM);
-	tmpkt = pfr_create_ktable(&pfr_nulltable, 0, 0,
-	    !(flags & PFR_FLAG_USERIOCTL));
-	if (tmpkt == NULL)
-		return (ENOMEM);
-	pfr_mark_addrs(kt);
-	SLIST_INIT(&addq);
-	SLIST_INIT(&delq);
-	SLIST_INIT(&changeq);
-	for (i = 0; i < size; i++) {
-		if (COPYIN(addr+i, &ad, sizeof(ad), flags))
-			senderr(EFAULT);
-		if (pfr_validate_addr(&ad))
-			senderr(EINVAL);
-		ad.pfra_fback = PFR_FB_NONE;
-		p = pfr_lookup_addr(kt, &ad, 1);
-		if (p != NULL) {
-			if (p->pfrke_mark) {
-				ad.pfra_fback = PFR_FB_DUPLICATE;
-				goto _skip;
-			}
-			p->pfrke_mark = 1;
-			if (p->pfrke_not != ad.pfra_not) {
-				SLIST_INSERT_HEAD(&changeq, p, pfrke_workq);
-				ad.pfra_fback = PFR_FB_CHANGED;
-				xchange++;
-			}
-		} else {
-			q = pfr_lookup_addr(tmpkt, &ad, 1);
-			if (q != NULL) {
-				ad.pfra_fback = PFR_FB_DUPLICATE;
-				goto _skip;
-			}
-			p = pfr_create_kentry(&ad,
-			    !(flags & PFR_FLAG_USERIOCTL));
-			if (p == NULL)
-				senderr(ENOMEM);
-			if (pfr_route_kentry(tmpkt, p)) {
-				pfr_destroy_kentry(p);
-				ad.pfra_fback = PFR_FB_NONE;
-			} else {
-				SLIST_INSERT_HEAD(&addq, p, pfrke_workq);
-				ad.pfra_fback = PFR_FB_ADDED;
-				xadd++;
-			}
-		}
-_skip:
-		if (flags & PFR_FLAG_FEEDBACK)
-			if (COPYOUT(&ad, addr+i, sizeof(ad), flags))
-				senderr(EFAULT);
-	}
-	pfr_enqueue_addrs(kt, &delq, &xdel, ENQUEUE_UNMARKED_ONLY);
-	if ((flags & PFR_FLAG_FEEDBACK) && *size2) {
-		if (*size2 < size+xdel) {
-			*size2 = size+xdel;
-			senderr(0);
-		}
-		i = 0;
-		SLIST_FOREACH(p, &delq, pfrke_workq) {
-			pfr_copyout_addr(&ad, p);
-			ad.pfra_fback = PFR_FB_DELETED;
-			if (COPYOUT(&ad, addr+size+i, sizeof(ad), flags))
-				senderr(EFAULT);
-			i++;
-		}
-	}
-	pfr_clean_node_mask(tmpkt, &addq);
-	if (!(flags & PFR_FLAG_DUMMY)) {
-		if (flags & PFR_FLAG_ATOMIC)
-			s = splsoftnet();
-		pfr_insert_kentries(kt, &addq, tzero);
-		pfr_remove_kentries(kt, &delq);
-		pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG);
-		if (flags & PFR_FLAG_ATOMIC)
-			splx(s);
-	} else
-		pfr_destroy_kentries(&addq);
-	if (nadd != NULL)
-		*nadd = xadd;
-	if (ndel != NULL)
-		*ndel = xdel;
-	if (nchange != NULL)
-		*nchange = xchange;
-	if ((flags & PFR_FLAG_FEEDBACK) && size2)
-		*size2 = size+xdel;
-	pfr_destroy_ktable(tmpkt, 0);
-	return (0);
-_bad:
-	pfr_clean_node_mask(tmpkt, &addq);
-	pfr_destroy_kentries(&addq);
-	if (flags & PFR_FLAG_FEEDBACK)
-		pfr_reset_feedback(addr, size, flags);
-	pfr_destroy_ktable(tmpkt, 0);
-	return (rv);
-}
-
-int
-pfr_tst_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int size,
-	int *nmatch, int flags)
-{
-	struct pfr_ktable	*kt;
-	struct pfr_kentry	*p;
-	struct pfr_addr		 ad;
-	int			 i, xmatch = 0;
-
-	ACCEPT_FLAGS(flags, PFR_FLAG_REPLACE);
-	if (pfr_validate_table(tbl, 0, 0))
-		return (EINVAL);
-	kt = pfr_lookup_table(tbl);
-	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
-		return (ESRCH);
-
-	for (i = 0; i < size; i++) {
-		if (COPYIN(addr+i, &ad, sizeof(ad), flags))
-			return (EFAULT);
-		if (pfr_validate_addr(&ad))
-			return (EINVAL);
-		if (ADDR_NETWORK(&ad))
-			return (EINVAL);
-		p = pfr_lookup_addr(kt, &ad, 0);
-		if (flags & PFR_FLAG_REPLACE)
-			pfr_copyout_addr(&ad, p);
-		ad.pfra_fback = (p == NULL) ? PFR_FB_NONE :
-		    (p->pfrke_not ? PFR_FB_NOTMATCH : PFR_FB_MATCH);
-		if (p != NULL && !p->pfrke_not)
-			xmatch++;
-		if (COPYOUT(&ad, addr+i, sizeof(ad), flags))
-			return (EFAULT);
-	}
-	if (nmatch != NULL)
-		*nmatch = xmatch;
-	return (0);
-}
-
-int
-pfr_get_addrs(struct pfr_table *tbl, struct pfr_addr *addr, int *size,
-	int flags)
-{
-	struct pfr_ktable	*kt;
-	struct pfr_walktree	 w;
-	int			 rv;
-
-	ACCEPT_FLAGS(flags, 0);
-	if (pfr_validate_table(tbl, 0, 0))
-		return (EINVAL);
-	kt = pfr_lookup_table(tbl);
-	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
-		return (ESRCH);
-	if (kt->pfrkt_cnt > *size) {
-		*size = kt->pfrkt_cnt;
-		return (0);
-	}
-
-	bzero(&w, sizeof(w));
-	w.pfrw_op = PFRW_GET_ADDRS;
-	w.pfrw_addr = addr;
-	w.pfrw_free = kt->pfrkt_cnt;
-	w.pfrw_flags = flags;
-#ifdef __FreeBSD__
-	rv = kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
-#else
-	rv = rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
-#endif
-	if (!rv)
-#ifdef __FreeBSD__
-		rv = kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree,
-		    &w);
-#else
-		rv = rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
-#endif
-	if (rv)
-		return (rv);
-
-	if (w.pfrw_free) {
-		printf("pfr_get_addrs: corruption detected (%d).\n",
-		    w.pfrw_free);
-		return (ENOTTY);
-	}
-	*size = kt->pfrkt_cnt;
-	return (0);
-}
-
-int
-pfr_get_astats(struct pfr_table *tbl, struct pfr_astats *addr, int *size,
-	int flags)
-{
-	struct pfr_ktable	*kt;
-	struct pfr_walktree	 w;
-	struct pfr_kentryworkq	 workq;
-	int			 rv, s;
-	long			 tzero = time_second;
-
-	/* XXX PFR_FLAG_CLSTATS disabled */
-	ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC);
-	if (pfr_validate_table(tbl, 0, 0))
-		return (EINVAL);
-	kt = pfr_lookup_table(tbl);
-	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
-		return (ESRCH);
-	if (kt->pfrkt_cnt > *size) {
-		*size = kt->pfrkt_cnt;
-		return (0);
-	}
-
-	bzero(&w, sizeof(w));
-	w.pfrw_op = PFRW_GET_ASTATS;
-	w.pfrw_astats = addr;
-	w.pfrw_free = kt->pfrkt_cnt;
-	w.pfrw_flags = flags;
-	if (flags & PFR_FLAG_ATOMIC)
-		s = splsoftnet();
-#ifdef __FreeBSD__
-	rv = kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
-#else
-	rv = rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
-#endif
-	if (!rv)
-#ifdef __FreeBSD__
-		rv = kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, 
-		    &w);
-#else
-		rv = rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
-#endif
-	if (!rv && (flags & PFR_FLAG_CLSTATS)) {
-		pfr_enqueue_addrs(kt, &workq, NULL, 0);
-		pfr_clstats_kentries(&workq, tzero, 0);
-	}
-	if (flags & PFR_FLAG_ATOMIC)
-		splx(s);
-	if (rv)
-		return (rv);
-
-	if (w.pfrw_free) {
-		printf("pfr_get_astats: corruption detected (%d).\n",
-		    w.pfrw_free);
-		return (ENOTTY);
-	}
-	*size = kt->pfrkt_cnt;
-	return (0);
-}
-
-int
-pfr_clr_astats(struct pfr_table *tbl, struct pfr_addr *addr, int size,
-    int *nzero, int flags)
-{
-	struct pfr_ktable	*kt;
-	struct pfr_kentryworkq	 workq;
-	struct pfr_kentry	*p;
-	struct pfr_addr		 ad;
-	int			 i, rv, s, xzero = 0;
-
-	ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
-	    PFR_FLAG_FEEDBACK);
-	if (pfr_validate_table(tbl, 0, 0))
-		return (EINVAL);
-	kt = pfr_lookup_table(tbl);
-	if (kt == NULL || !(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
-		return (ESRCH);
-	SLIST_INIT(&workq);
-	for (i = 0; i < size; i++) {
-		if (COPYIN(addr+i, &ad, sizeof(ad), flags))
-			senderr(EFAULT);
-		if (pfr_validate_addr(&ad))
-			senderr(EINVAL);
-		p = pfr_lookup_addr(kt, &ad, 1);
-		if (flags & PFR_FLAG_FEEDBACK) {
-			ad.pfra_fback = (p != NULL) ?
-			    PFR_FB_CLEARED : PFR_FB_NONE;
-			if (COPYOUT(&ad, addr+i, sizeof(ad), flags))
-				senderr(EFAULT);
-		}
-		if (p != NULL) {
-			SLIST_INSERT_HEAD(&workq, p, pfrke_workq);
-			xzero++;
-		}
-	}
-
-	if (!(flags & PFR_FLAG_DUMMY)) {
-		if (flags & PFR_FLAG_ATOMIC)
-			s = splsoftnet();
-		pfr_clstats_kentries(&workq, 0, 0);
-		if (flags & PFR_FLAG_ATOMIC)
-			splx(s);
-	}
-	if (nzero != NULL)
-		*nzero = xzero;
-	return (0);
-_bad:
-	if (flags & PFR_FLAG_FEEDBACK)
-		pfr_reset_feedback(addr, size, flags);
-	return (rv);
-}
-
-int
-pfr_validate_addr(struct pfr_addr *ad)
-{
-	int i;
-
-	switch (ad->pfra_af) {
-#ifdef INET
-	case AF_INET:
-		if (ad->pfra_net > 32)
-			return (-1);
-		break;
-#endif /* INET */
-#ifdef INET6
-	case AF_INET6:
-		if (ad->pfra_net > 128)
-			return (-1);
-		break;
-#endif /* INET6 */
-	default:
-		return (-1);
-	}
-	if (ad->pfra_net < 128 &&
-		(((caddr_t)ad)[ad->pfra_net/8] & (0xFF >> (ad->pfra_net%8))))
-			return (-1);
-	for (i = (ad->pfra_net+7)/8; i < sizeof(ad->pfra_u); i++)
-		if (((caddr_t)ad)[i])
-			return (-1);
-	if (ad->pfra_not && ad->pfra_not != 1)
-		return (-1);
-	if (ad->pfra_fback)
-		return (-1);
-	return (0);
-}
-
-void
-pfr_enqueue_addrs(struct pfr_ktable *kt, struct pfr_kentryworkq *workq,
-	int *naddr, int sweep)
-{
-	struct pfr_walktree	w;
-
-	SLIST_INIT(workq);
-	bzero(&w, sizeof(w));
-	w.pfrw_op = sweep ? PFRW_SWEEP : PFRW_ENQUEUE;
-	w.pfrw_workq = workq;
-	if (kt->pfrkt_ip4 != NULL)
-#ifdef __FreeBSD__
-		if (kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, 
-		    &w))
-#else
-		if (rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w))
-#endif
-			printf("pfr_enqueue_addrs: IPv4 walktree failed.\n");
-	if (kt->pfrkt_ip6 != NULL)
-#ifdef __FreeBSD__
-		if (kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, 
-		    &w))
-#else
-		if (rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w))
-#endif
-			printf("pfr_enqueue_addrs: IPv6 walktree failed.\n");
-	if (naddr != NULL)
-		*naddr = w.pfrw_cnt;
-}
-
-void
-pfr_mark_addrs(struct pfr_ktable *kt)
-{
-	struct pfr_walktree	w;
-
-	bzero(&w, sizeof(w));
-	w.pfrw_op = PFRW_MARK;
-#ifdef __FreeBSD__
-	if (kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w))
-#else
-	if (rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w))
-#endif
-		printf("pfr_mark_addrs: IPv4 walktree failed.\n");
-#ifdef __FreeBSD__
-	if (kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w))
-#else
-	if (rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w))
-#endif
-		printf("pfr_mark_addrs: IPv6 walktree failed.\n");
-}
-
-
-struct pfr_kentry *
-pfr_lookup_addr(struct pfr_ktable *kt, struct pfr_addr *ad, int exact)
-{
-	union sockaddr_union	 sa, mask;
-#ifdef __FreeBSD__
-	struct radix_node_head	*head = NULL;
-#else
-	struct radix_node_head	*head;
-#endif
-	struct pfr_kentry	*ke;
-	int			 s;
-
-	bzero(&sa, sizeof(sa));
-	if (ad->pfra_af == AF_INET) {
-		FILLIN_SIN(sa.sin, ad->pfra_ip4addr);
-		head = kt->pfrkt_ip4;
-	} else if ( ad->pfra_af == AF_INET6 ) {
-		FILLIN_SIN6(sa.sin6, ad->pfra_ip6addr);
-		head = kt->pfrkt_ip6;
-	}
-	if (ADDR_NETWORK(ad)) {
-		pfr_prepare_network(&mask, ad->pfra_af, ad->pfra_net);
-		s = splsoftnet(); /* rn_lookup makes use of globals */
-#ifdef __FreeBSD__
-		PF_LOCK_ASSERT();
-#endif
-		ke = (struct pfr_kentry *)rn_lookup(&sa, &mask, head);
-		splx(s);
-		if (ke && KENTRY_RNF_ROOT(ke))
-			ke = NULL;
-	} else {
-		ke = (struct pfr_kentry *)rn_match(&sa, head);
-		if (ke && KENTRY_RNF_ROOT(ke))
-			ke = NULL;
-		if (exact && ke && KENTRY_NETWORK(ke))
-			ke = NULL;
-	}
-	return (ke);
-}
-
-struct pfr_kentry *
-pfr_create_kentry(struct pfr_addr *ad, int intr)
-{
-	struct pfr_kentry	*ke;
-
-#ifdef __FreeBSD__
-	ke =  pool_get(&V_pfr_kentry_pl, PR_NOWAIT | PR_ZERO);
-#else
-	if (intr)
-		ke = pool_get(&pfr_kentry_pl, PR_NOWAIT | PR_ZERO);
-	else
-		ke = pool_get(&pfr_kentry_pl, PR_WAITOK|PR_ZERO|PR_LIMITFAIL);
-#endif
-	if (ke == NULL)
-		return (NULL);
-
-	if (ad->pfra_af == AF_INET)
-		FILLIN_SIN(ke->pfrke_sa.sin, ad->pfra_ip4addr);
-	else if (ad->pfra_af == AF_INET6)
-		FILLIN_SIN6(ke->pfrke_sa.sin6, ad->pfra_ip6addr);
-	ke->pfrke_af = ad->pfra_af;
-	ke->pfrke_net = ad->pfra_net;
-	ke->pfrke_not = ad->pfra_not;
-	return (ke);
-}
-
-void
-pfr_destroy_kentries(struct pfr_kentryworkq *workq)
-{
-	struct pfr_kentry	*p, *q;
-
-	for (p = SLIST_FIRST(workq); p != NULL; p = q) {
-		q = SLIST_NEXT(p, pfrke_workq);
-		pfr_destroy_kentry(p);
-	}
-}
-
-void
-pfr_destroy_kentry(struct pfr_kentry *ke)
-{
-	if (ke->pfrke_counters)
-#ifdef __FreeBSD__
-		pool_put(&V_pfr_kcounters_pl, ke->pfrke_counters);
-	pool_put(&V_pfr_kentry_pl, ke);
-#else
-		pool_put(&pfr_kcounters_pl, ke->pfrke_counters);
-	pool_put(&pfr_kentry_pl, ke);
-#endif
-}
-
-void
-pfr_insert_kentries(struct pfr_ktable *kt,
-    struct pfr_kentryworkq *workq, long tzero)
-{
-	struct pfr_kentry	*p;
-	int			 rv, n = 0;
-
-	SLIST_FOREACH(p, workq, pfrke_workq) {
-		rv = pfr_route_kentry(kt, p);
-		if (rv) {
-			printf("pfr_insert_kentries: cannot route entry "
-			    "(code=%d).\n", rv);
-			break;
-		}
-		p->pfrke_tzero = tzero;
-		n++;
-	}
-	kt->pfrkt_cnt += n;
-}
-
-int
-pfr_insert_kentry(struct pfr_ktable *kt, struct pfr_addr *ad, long tzero)
-{
-	struct pfr_kentry	*p;
-	int			 rv;
-
-	p = pfr_lookup_addr(kt, ad, 1);
-	if (p != NULL)
-		return (0);
-	p = pfr_create_kentry(ad, 1);
-	if (p == NULL)
-		return (EINVAL);
-
-	rv = pfr_route_kentry(kt, p);
-	if (rv)
-		return (rv);
-
-	p->pfrke_tzero = tzero;
-	kt->pfrkt_cnt++;
-
-	return (0);
-}
-
-void
-pfr_remove_kentries(struct pfr_ktable *kt,
-    struct pfr_kentryworkq *workq)
-{
-	struct pfr_kentry	*p;
-	int			 n = 0;
-
-	SLIST_FOREACH(p, workq, pfrke_workq) {
-		pfr_unroute_kentry(kt, p);
-		n++;
-	}
-	kt->pfrkt_cnt -= n;
-	pfr_destroy_kentries(workq);
-}
-
-void
-pfr_clean_node_mask(struct pfr_ktable *kt,
-    struct pfr_kentryworkq *workq)
-{
-	struct pfr_kentry	*p;
-
-	SLIST_FOREACH(p, workq, pfrke_workq)
-		pfr_unroute_kentry(kt, p);
-}
-
-void
-pfr_clstats_kentries(struct pfr_kentryworkq *workq, long tzero, int negchange)
-{
-	struct pfr_kentry	*p;
-	int			 s;
-
-	SLIST_FOREACH(p, workq, pfrke_workq) {
-		s = splsoftnet();
-		if (negchange)
-			p->pfrke_not = !p->pfrke_not;
-		if (p->pfrke_counters) {
-#ifdef __FreeBSD__
-			pool_put(&V_pfr_kcounters_pl, p->pfrke_counters);
-#else
-			pool_put(&pfr_kcounters_pl, p->pfrke_counters);
-#endif
-			p->pfrke_counters = NULL;
-		}
-		splx(s);
-		p->pfrke_tzero = tzero;
-	}
-}
-
-void
-pfr_reset_feedback(struct pfr_addr *addr, int size, int flags)
-{
-	struct pfr_addr	ad;
-	int		i;
-
-	for (i = 0; i < size; i++) {
-		if (COPYIN(addr+i, &ad, sizeof(ad), flags))
-			break;
-		ad.pfra_fback = PFR_FB_NONE;
-		if (COPYOUT(&ad, addr+i, sizeof(ad), flags))
-			break;
-	}
-}
-
-void
-pfr_prepare_network(union sockaddr_union *sa, int af, int net)
-{
-	int	i;
-
-	bzero(sa, sizeof(*sa));
-	if (af == AF_INET) {
-		sa->sin.sin_len = sizeof(sa->sin);
-		sa->sin.sin_family = AF_INET;
-		sa->sin.sin_addr.s_addr = net ? htonl(-1 << (32-net)) : 0;
-	} else if (af == AF_INET6) {
-		sa->sin6.sin6_len = sizeof(sa->sin6);
-		sa->sin6.sin6_family = AF_INET6;
-		for (i = 0; i < 4; i++) {
-			if (net <= 32) {
-				sa->sin6.sin6_addr.s6_addr32[i] =
-				    net ? htonl(-1 << (32-net)) : 0;
-				break;
-			}
-			sa->sin6.sin6_addr.s6_addr32[i] = 0xFFFFFFFF;
-			net -= 32;
-		}
-	}
-}
-
-int
-pfr_route_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
-{
-	union sockaddr_union	 mask;
-	struct radix_node	*rn;
-#ifdef __FreeBSD__
-	struct radix_node_head	*head = NULL;
-#else
-	struct radix_node_head	*head;
-#endif
-	int			 s;
-
-	bzero(ke->pfrke_node, sizeof(ke->pfrke_node));
-	if (ke->pfrke_af == AF_INET)
-		head = kt->pfrkt_ip4;
-	else if (ke->pfrke_af == AF_INET6)
-		head = kt->pfrkt_ip6;
-
-	s = splsoftnet();
-#ifdef __FreeBSD__
-	PF_LOCK_ASSERT();
-#endif
-	if (KENTRY_NETWORK(ke)) {
-		pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
-#ifdef __FreeBSD__
-		rn = rn_addroute(&ke->pfrke_sa, &mask, head, ke->pfrke_node);
-#else
-		rn = rn_addroute(&ke->pfrke_sa, &mask, head, ke->pfrke_node, 0);
-#endif
-	} else
-#ifdef __FreeBSD__
-		rn = rn_addroute(&ke->pfrke_sa, NULL, head, ke->pfrke_node);
-#else
-		rn = rn_addroute(&ke->pfrke_sa, NULL, head, ke->pfrke_node, 0);
-#endif
-	splx(s);
-
-	return (rn == NULL ? -1 : 0);
-}
-
-int
-pfr_unroute_kentry(struct pfr_ktable *kt, struct pfr_kentry *ke)
-{
-	union sockaddr_union	 mask;
-	struct radix_node	*rn;
-#ifdef __FreeBSD__
-	struct radix_node_head	*head = NULL;
-#else
-	struct radix_node_head	*head;
-#endif
-	int			 s;
-
-	if (ke->pfrke_af == AF_INET)
-		head = kt->pfrkt_ip4;
-	else if (ke->pfrke_af == AF_INET6)
-		head = kt->pfrkt_ip6;
-
-	s = splsoftnet();
-#ifdef __FreeBSD__
-	PF_LOCK_ASSERT();
-#endif
-	if (KENTRY_NETWORK(ke)) {
-		pfr_prepare_network(&mask, ke->pfrke_af, ke->pfrke_net);
-#ifdef __FreeBSD__
-		rn = rn_delete(&ke->pfrke_sa, &mask, head);
-#else
-		rn = rn_delete(&ke->pfrke_sa, &mask, head, NULL);
-#endif
-	} else
-#ifdef __FreeBSD__
-		rn = rn_delete(&ke->pfrke_sa, NULL, head);
-#else
-		rn = rn_delete(&ke->pfrke_sa, NULL, head, NULL);
-#endif
-	splx(s);
-
-	if (rn == NULL) {
-		printf("pfr_unroute_kentry: delete failed.\n");
-		return (-1);
-	}
-	return (0);
-}
-
-void
-pfr_copyout_addr(struct pfr_addr *ad, struct pfr_kentry *ke)
-{
-	bzero(ad, sizeof(*ad));
-	if (ke == NULL)
-		return;
-	ad->pfra_af = ke->pfrke_af;
-	ad->pfra_net = ke->pfrke_net;
-	ad->pfra_not = ke->pfrke_not;
-	if (ad->pfra_af == AF_INET)
-		ad->pfra_ip4addr = ke->pfrke_sa.sin.sin_addr;
-	else if (ad->pfra_af == AF_INET6)
-		ad->pfra_ip6addr = ke->pfrke_sa.sin6.sin6_addr;
-}
-
-int
-pfr_walktree(struct radix_node *rn, void *arg)
-{
-	struct pfr_kentry	*ke = (struct pfr_kentry *)rn;
-	struct pfr_walktree	*w = arg;
-	int			 s, flags = w->pfrw_flags;
-
-	switch (w->pfrw_op) {
-	case PFRW_MARK:
-		ke->pfrke_mark = 0;
-		break;
-	case PFRW_SWEEP:
-		if (ke->pfrke_mark)
-			break;
-		/* FALLTHROUGH */
-	case PFRW_ENQUEUE:
-		SLIST_INSERT_HEAD(w->pfrw_workq, ke, pfrke_workq);
-		w->pfrw_cnt++;
-		break;
-	case PFRW_GET_ADDRS:
-		if (w->pfrw_free-- > 0) {
-			struct pfr_addr ad;
-
-			pfr_copyout_addr(&ad, ke);
-			if (copyout(&ad, w->pfrw_addr, sizeof(ad)))
-				return (EFAULT);
-			w->pfrw_addr++;
-		}
-		break;
-	case PFRW_GET_ASTATS:
-		if (w->pfrw_free-- > 0) {
-			struct pfr_astats as;
-
-			pfr_copyout_addr(&as.pfras_a, ke);
-
-			s = splsoftnet();
-			if (ke->pfrke_counters) {
-				bcopy(ke->pfrke_counters->pfrkc_packets,
-				    as.pfras_packets, sizeof(as.pfras_packets));
-				bcopy(ke->pfrke_counters->pfrkc_bytes,
-				    as.pfras_bytes, sizeof(as.pfras_bytes));
-			} else {
-				bzero(as.pfras_packets, sizeof(as.pfras_packets));
-				bzero(as.pfras_bytes, sizeof(as.pfras_bytes));
-				as.pfras_a.pfra_fback = PFR_FB_NOCOUNT;
-			}
-			splx(s);
-			as.pfras_tzero = ke->pfrke_tzero;
-
-			if (COPYOUT(&as, w->pfrw_astats, sizeof(as), flags))
-				return (EFAULT);
-			w->pfrw_astats++;
-		}
-		break;
-	case PFRW_POOL_GET:
-		if (ke->pfrke_not)
-			break; /* negative entries are ignored */
-		if (!w->pfrw_cnt--) {
-			w->pfrw_kentry = ke;
-			return (1); /* finish search */
-		}
-		break;
-	case PFRW_DYNADDR_UPDATE:
-		if (ke->pfrke_af == AF_INET) {
-			if (w->pfrw_dyn->pfid_acnt4++ > 0)
-				break;
-#ifdef __FreeBSD__
-			pfr_prepare_network(&V_pfr_mask, AF_INET, ke->pfrke_net);
-#else
-			pfr_prepare_network(&pfr_mask, AF_INET, ke->pfrke_net);
-#endif
-			w->pfrw_dyn->pfid_addr4 = *SUNION2PF(
-			    &ke->pfrke_sa, AF_INET);
-			w->pfrw_dyn->pfid_mask4 = *SUNION2PF(
-#ifdef __FreeBSD__
-			    &V_pfr_mask, AF_INET);
-#else
-			    &pfr_mask, AF_INET);
-#endif
-		} else if (ke->pfrke_af == AF_INET6){
-			if (w->pfrw_dyn->pfid_acnt6++ > 0)
-				break;
-#ifdef __FreeBSD__
-			pfr_prepare_network(&V_pfr_mask, AF_INET6, ke->pfrke_net);
-#else
-			pfr_prepare_network(&pfr_mask, AF_INET6, ke->pfrke_net);
-#endif
-			w->pfrw_dyn->pfid_addr6 = *SUNION2PF(
-			    &ke->pfrke_sa, AF_INET6);
-			w->pfrw_dyn->pfid_mask6 = *SUNION2PF(
-#ifdef __FreeBSD__
-			    &V_pfr_mask, AF_INET6);
-#else
-			    &pfr_mask, AF_INET6);
-#endif
-		}
-		break;
-	}
-	return (0);
-}
-
-int
-pfr_clr_tables(struct pfr_table *filter, int *ndel, int flags)
-{
-	struct pfr_ktableworkq	 workq;
-	struct pfr_ktable	*p;
-	int			 s, xdel = 0;
-
-	ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
-	    PFR_FLAG_ALLRSETS);
-	if (pfr_fix_anchor(filter->pfrt_anchor))
-		return (EINVAL);
-	if (pfr_table_count(filter, flags) < 0)
-		return (ENOENT);
-
-	SLIST_INIT(&workq);
-	RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
-		if (pfr_skip_table(filter, p, flags))
-			continue;
-		if (!strcmp(p->pfrkt_anchor, PF_RESERVED_ANCHOR))
-			continue;
-		if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE))
-			continue;
-		p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
-		SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
-		xdel++;
-	}
-	if (!(flags & PFR_FLAG_DUMMY)) {
-		if (flags & PFR_FLAG_ATOMIC)
-			s = splsoftnet();
-		pfr_setflags_ktables(&workq);
-		if (flags & PFR_FLAG_ATOMIC)
-			splx(s);
-	}
-	if (ndel != NULL)
-		*ndel = xdel;
-	return (0);
-}
-
-int
-pfr_add_tables(struct pfr_table *tbl, int size, int *nadd, int flags)
-{
-	struct pfr_ktableworkq	 addq, changeq;
-	struct pfr_ktable	*p, *q, *r, key;
-	int			 i, rv, s, xadd = 0;
-	long			 tzero = time_second;
-
-	ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY);
-	SLIST_INIT(&addq);
-	SLIST_INIT(&changeq);
-	for (i = 0; i < size; i++) {
-		if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t), flags))
-			senderr(EFAULT);
-		if (pfr_validate_table(&key.pfrkt_t, PFR_TFLAG_USRMASK,
-		    flags & PFR_FLAG_USERIOCTL))
-			senderr(EINVAL);
-		key.pfrkt_flags |= PFR_TFLAG_ACTIVE;
-		p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
-		if (p == NULL) {
-			p = pfr_create_ktable(&key.pfrkt_t, tzero, 1,
-			    !(flags & PFR_FLAG_USERIOCTL));
-			if (p == NULL)
-				senderr(ENOMEM);
-			SLIST_FOREACH(q, &addq, pfrkt_workq) {
-				if (!pfr_ktable_compare(p, q))
-					goto _skip;
-			}
-			SLIST_INSERT_HEAD(&addq, p, pfrkt_workq);
-			xadd++;
-			if (!key.pfrkt_anchor[0])
-				goto _skip;
-
-			/* find or create root table */
-			bzero(key.pfrkt_anchor, sizeof(key.pfrkt_anchor));
-			r = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
-			if (r != NULL) {
-				p->pfrkt_root = r;
-				goto _skip;
-			}
-			SLIST_FOREACH(q, &addq, pfrkt_workq) {
-				if (!pfr_ktable_compare(&key, q)) {
-					p->pfrkt_root = q;
-					goto _skip;
-				}
-			}
-			key.pfrkt_flags = 0;
-			r = pfr_create_ktable(&key.pfrkt_t, 0, 1,
-			    !(flags & PFR_FLAG_USERIOCTL));
-			if (r == NULL)
-				senderr(ENOMEM);
-			SLIST_INSERT_HEAD(&addq, r, pfrkt_workq);
-			p->pfrkt_root = r;
-		} else if (!(p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
-			SLIST_FOREACH(q, &changeq, pfrkt_workq)
-				if (!pfr_ktable_compare(&key, q))
-					goto _skip;
-			p->pfrkt_nflags = (p->pfrkt_flags &
-			    ~PFR_TFLAG_USRMASK) | key.pfrkt_flags;
-			SLIST_INSERT_HEAD(&changeq, p, pfrkt_workq);
-			xadd++;
-		}
-_skip:
-	;
-	}
-	if (!(flags & PFR_FLAG_DUMMY)) {
-		if (flags & PFR_FLAG_ATOMIC)
-			s = splsoftnet();
-		pfr_insert_ktables(&addq);
-		pfr_setflags_ktables(&changeq);
-		if (flags & PFR_FLAG_ATOMIC)
-			splx(s);
-	} else
-		 pfr_destroy_ktables(&addq, 0);
-	if (nadd != NULL)
-		*nadd = xadd;
-	return (0);
-_bad:
-	pfr_destroy_ktables(&addq, 0);
-	return (rv);
-}
-
-int
-pfr_del_tables(struct pfr_table *tbl, int size, int *ndel, int flags)
-{
-	struct pfr_ktableworkq	 workq;
-	struct pfr_ktable	*p, *q, key;
-	int			 i, s, xdel = 0;
-
-	ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY);
-	SLIST_INIT(&workq);
-	for (i = 0; i < size; i++) {
-		if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t), flags))
-			return (EFAULT);
-		if (pfr_validate_table(&key.pfrkt_t, 0,
-		    flags & PFR_FLAG_USERIOCTL))
-			return (EINVAL);
-		p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
-		if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
-			SLIST_FOREACH(q, &workq, pfrkt_workq)
-				if (!pfr_ktable_compare(p, q))
-					goto _skip;
-			p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_ACTIVE;
-			SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
-			xdel++;
-		}
-_skip:
-	;
-	}
-
-	if (!(flags & PFR_FLAG_DUMMY)) {
-		if (flags & PFR_FLAG_ATOMIC)
-			s = splsoftnet();
-		pfr_setflags_ktables(&workq);
-		if (flags & PFR_FLAG_ATOMIC)
-			splx(s);
-	}
-	if (ndel != NULL)
-		*ndel = xdel;
-	return (0);
-}
-
-int
-pfr_get_tables(struct pfr_table *filter, struct pfr_table *tbl, int *size,
-	int flags)
-{
-	struct pfr_ktable	*p;
-	int			 n, nn;
-
-	ACCEPT_FLAGS(flags, PFR_FLAG_ALLRSETS);
-	if (pfr_fix_anchor(filter->pfrt_anchor))
-		return (EINVAL);
-	n = nn = pfr_table_count(filter, flags);
-	if (n < 0)
-		return (ENOENT);
-	if (n > *size) {
-		*size = n;
-		return (0);
-	}
-	RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
-		if (pfr_skip_table(filter, p, flags))
-			continue;
-		if (n-- <= 0)
-			continue;
-		if (COPYOUT(&p->pfrkt_t, tbl++, sizeof(*tbl), flags))
-			return (EFAULT);
-	}
-	if (n) {
-		printf("pfr_get_tables: corruption detected (%d).\n", n);
-		return (ENOTTY);
-	}
-	*size = nn;
-	return (0);
-}
-
-int
-pfr_get_tstats(struct pfr_table *filter, struct pfr_tstats *tbl, int *size,
-	int flags)
-{
-	struct pfr_ktable	*p;
-	struct pfr_ktableworkq	 workq;
-	int			 s, n, nn;
-	long			 tzero = time_second;
-
-	/* XXX PFR_FLAG_CLSTATS disabled */
-	ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_ALLRSETS);
-	if (pfr_fix_anchor(filter->pfrt_anchor))
-		return (EINVAL);
-	n = nn = pfr_table_count(filter, flags);
-	if (n < 0)
-		return (ENOENT);
-	if (n > *size) {
-		*size = n;
-		return (0);
-	}
-	SLIST_INIT(&workq);
-	if (flags & PFR_FLAG_ATOMIC)
-		s = splsoftnet();
-	RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
-		if (pfr_skip_table(filter, p, flags))
-			continue;
-		if (n-- <= 0)
-			continue;
-		if (!(flags & PFR_FLAG_ATOMIC))
-			s = splsoftnet();
-		if (COPYOUT(&p->pfrkt_ts, tbl++, sizeof(*tbl), flags)) {
-			splx(s);
-			return (EFAULT);
-		}
-		if (!(flags & PFR_FLAG_ATOMIC))
-			splx(s);
-		SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
-	}
-	if (flags & PFR_FLAG_CLSTATS)
-		pfr_clstats_ktables(&workq, tzero,
-		    flags & PFR_FLAG_ADDRSTOO);
-	if (flags & PFR_FLAG_ATOMIC)
-		splx(s);
-	if (n) {
-		printf("pfr_get_tstats: corruption detected (%d).\n", n);
-		return (ENOTTY);
-	}
-	*size = nn;
-	return (0);
-}
-
-int
-pfr_clr_tstats(struct pfr_table *tbl, int size, int *nzero, int flags)
-{
-	struct pfr_ktableworkq	 workq;
-	struct pfr_ktable	*p, key;
-	int			 i, s, xzero = 0;
-	long			 tzero = time_second;
-
-	ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY |
-	    PFR_FLAG_ADDRSTOO);
-	SLIST_INIT(&workq);
-	for (i = 0; i < size; i++) {
-		if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t), flags))
-			return (EFAULT);
-		if (pfr_validate_table(&key.pfrkt_t, 0, 0))
-			return (EINVAL);
-		p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
-		if (p != NULL) {
-			SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
-			xzero++;
-		}
-	}
-	if (!(flags & PFR_FLAG_DUMMY)) {
-		if (flags & PFR_FLAG_ATOMIC)
-			s = splsoftnet();
-		pfr_clstats_ktables(&workq, tzero, flags & PFR_FLAG_ADDRSTOO);
-		if (flags & PFR_FLAG_ATOMIC)
-			splx(s);
-	}
-	if (nzero != NULL)
-		*nzero = xzero;
-	return (0);
-}
-
-int
-pfr_set_tflags(struct pfr_table *tbl, int size, int setflag, int clrflag,
-	int *nchange, int *ndel, int flags)
-{
-	struct pfr_ktableworkq	 workq;
-	struct pfr_ktable	*p, *q, key;
-	int			 i, s, xchange = 0, xdel = 0;
-
-	ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY);
-	if ((setflag & ~PFR_TFLAG_USRMASK) ||
-	    (clrflag & ~PFR_TFLAG_USRMASK) ||
-	    (setflag & clrflag))
-		return (EINVAL);
-	SLIST_INIT(&workq);
-	for (i = 0; i < size; i++) {
-		if (COPYIN(tbl+i, &key.pfrkt_t, sizeof(key.pfrkt_t), flags))
-			return (EFAULT);
-		if (pfr_validate_table(&key.pfrkt_t, 0,
-		    flags & PFR_FLAG_USERIOCTL))
-			return (EINVAL);
-		p = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
-		if (p != NULL && (p->pfrkt_flags & PFR_TFLAG_ACTIVE)) {
-			p->pfrkt_nflags = (p->pfrkt_flags | setflag) &
-			    ~clrflag;
-			if (p->pfrkt_nflags == p->pfrkt_flags)
-				goto _skip;
-			SLIST_FOREACH(q, &workq, pfrkt_workq)
-				if (!pfr_ktable_compare(p, q))
-					goto _skip;
-			SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
-			if ((p->pfrkt_flags & PFR_TFLAG_PERSIST) &&
-			    (clrflag & PFR_TFLAG_PERSIST) &&
-			    !(p->pfrkt_flags & PFR_TFLAG_REFERENCED))
-				xdel++;
-			else
-				xchange++;
-		}
-_skip:
-	;
-	}
-	if (!(flags & PFR_FLAG_DUMMY)) {
-		if (flags & PFR_FLAG_ATOMIC)
-			s = splsoftnet();
-		pfr_setflags_ktables(&workq);
-		if (flags & PFR_FLAG_ATOMIC)
-			splx(s);
-	}
-	if (nchange != NULL)
-		*nchange = xchange;
-	if (ndel != NULL)
-		*ndel = xdel;
-	return (0);
-}
-
-int
-pfr_ina_begin(struct pfr_table *trs, u_int32_t *ticket, int *ndel, int flags)
-{
-	struct pfr_ktableworkq	 workq;
-	struct pfr_ktable	*p;
-	struct pf_ruleset	*rs;
-	int			 xdel = 0;
-
-	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
-	rs = pf_find_or_create_ruleset(trs->pfrt_anchor);
-	if (rs == NULL)
-		return (ENOMEM);
-	SLIST_INIT(&workq);
-	RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
-		if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
-		    pfr_skip_table(trs, p, 0))
-			continue;
-		p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
-		SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
-		xdel++;
-	}
-	if (!(flags & PFR_FLAG_DUMMY)) {
-		pfr_setflags_ktables(&workq);
-		if (ticket != NULL)
-			*ticket = ++rs->tticket;
-		rs->topen = 1;
-	} else
-		pf_remove_if_empty_ruleset(rs);
-	if (ndel != NULL)
-		*ndel = xdel;
-	return (0);
-}
-
-int
-pfr_ina_define(struct pfr_table *tbl, struct pfr_addr *addr, int size,
-    int *nadd, int *naddr, u_int32_t ticket, int flags)
-{
-	struct pfr_ktableworkq	 tableq;
-	struct pfr_kentryworkq	 addrq;
-	struct pfr_ktable	*kt, *rt, *shadow, key;
-	struct pfr_kentry	*p;
-	struct pfr_addr		 ad;
-	struct pf_ruleset	*rs;
-	int			 i, rv, xadd = 0, xaddr = 0;
-
-	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY | PFR_FLAG_ADDRSTOO);
-	if (size && !(flags & PFR_FLAG_ADDRSTOO))
-		return (EINVAL);
-	if (pfr_validate_table(tbl, PFR_TFLAG_USRMASK,
-	    flags & PFR_FLAG_USERIOCTL))
-		return (EINVAL);
-	rs = pf_find_ruleset(tbl->pfrt_anchor);
-	if (rs == NULL || !rs->topen || ticket != rs->tticket)
-		return (EBUSY);
-	tbl->pfrt_flags |= PFR_TFLAG_INACTIVE;
-	SLIST_INIT(&tableq);
-	kt = RB_FIND(pfr_ktablehead, &pfr_ktables, (struct pfr_ktable *)tbl);
-	if (kt == NULL) {
-		kt = pfr_create_ktable(tbl, 0, 1,
-		    !(flags & PFR_FLAG_USERIOCTL));
-		if (kt == NULL)
-			return (ENOMEM);
-		SLIST_INSERT_HEAD(&tableq, kt, pfrkt_workq);
-		xadd++;
-		if (!tbl->pfrt_anchor[0])
-			goto _skip;
-
-		/* find or create root table */
-		bzero(&key, sizeof(key));
-		strlcpy(key.pfrkt_name, tbl->pfrt_name, sizeof(key.pfrkt_name));
-		rt = RB_FIND(pfr_ktablehead, &pfr_ktables, &key);
-		if (rt != NULL) {
-			kt->pfrkt_root = rt;
-			goto _skip;
-		}
-		rt = pfr_create_ktable(&key.pfrkt_t, 0, 1,
-		    !(flags & PFR_FLAG_USERIOCTL));
-		if (rt == NULL) {
-			pfr_destroy_ktables(&tableq, 0);
-			return (ENOMEM);
-		}
-		SLIST_INSERT_HEAD(&tableq, rt, pfrkt_workq);
-		kt->pfrkt_root = rt;
-	} else if (!(kt->pfrkt_flags & PFR_TFLAG_INACTIVE))
-		xadd++;
-_skip:
-	shadow = pfr_create_ktable(tbl, 0, 0, !(flags & PFR_FLAG_USERIOCTL));
-	if (shadow == NULL) {
-		pfr_destroy_ktables(&tableq, 0);
-		return (ENOMEM);
-	}
-	SLIST_INIT(&addrq);
-	for (i = 0; i < size; i++) {
-		if (COPYIN(addr+i, &ad, sizeof(ad), flags))
-			senderr(EFAULT);
-		if (pfr_validate_addr(&ad))
-			senderr(EINVAL);
-		if (pfr_lookup_addr(shadow, &ad, 1) != NULL)
-			continue;
-		p = pfr_create_kentry(&ad, 0);
-		if (p == NULL)
-			senderr(ENOMEM);
-		if (pfr_route_kentry(shadow, p)) {
-			pfr_destroy_kentry(p);
-			continue;
-		}
-		SLIST_INSERT_HEAD(&addrq, p, pfrke_workq);
-		xaddr++;
-	}
-	if (!(flags & PFR_FLAG_DUMMY)) {
-		if (kt->pfrkt_shadow != NULL)
-			pfr_destroy_ktable(kt->pfrkt_shadow, 1);
-		kt->pfrkt_flags |= PFR_TFLAG_INACTIVE;
-		pfr_insert_ktables(&tableq);
-		shadow->pfrkt_cnt = (flags & PFR_FLAG_ADDRSTOO) ?
-		    xaddr : NO_ADDRESSES;
-		kt->pfrkt_shadow = shadow;
-	} else {
-		pfr_clean_node_mask(shadow, &addrq);
-		pfr_destroy_ktable(shadow, 0);
-		pfr_destroy_ktables(&tableq, 0);
-		pfr_destroy_kentries(&addrq);
-	}
-	if (nadd != NULL)
-		*nadd = xadd;
-	if (naddr != NULL)
-		*naddr = xaddr;
-	return (0);
-_bad:
-	pfr_destroy_ktable(shadow, 0);
-	pfr_destroy_ktables(&tableq, 0);
-	pfr_destroy_kentries(&addrq);
-	return (rv);
-}
-
-int
-pfr_ina_rollback(struct pfr_table *trs, u_int32_t ticket, int *ndel, int flags)
-{
-	struct pfr_ktableworkq	 workq;
-	struct pfr_ktable	*p;
-	struct pf_ruleset	*rs;
-	int			 xdel = 0;
-
-	ACCEPT_FLAGS(flags, PFR_FLAG_DUMMY);
-	rs = pf_find_ruleset(trs->pfrt_anchor);
-	if (rs == NULL || !rs->topen || ticket != rs->tticket)
-		return (0);
-	SLIST_INIT(&workq);
-	RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
-		if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
-		    pfr_skip_table(trs, p, 0))
-			continue;
-		p->pfrkt_nflags = p->pfrkt_flags & ~PFR_TFLAG_INACTIVE;
-		SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
-		xdel++;
-	}
-	if (!(flags & PFR_FLAG_DUMMY)) {
-		pfr_setflags_ktables(&workq);
-		rs->topen = 0;
-		pf_remove_if_empty_ruleset(rs);
-	}
-	if (ndel != NULL)
-		*ndel = xdel;
-	return (0);
-}
-
-int
-pfr_ina_commit(struct pfr_table *trs, u_int32_t ticket, int *nadd,
-    int *nchange, int flags)
-{
-	struct pfr_ktable	*p, *q;
-	struct pfr_ktableworkq	 workq;
-	struct pf_ruleset	*rs;
-	int			 s, xadd = 0, xchange = 0;
-	long			 tzero = time_second;
-
-	ACCEPT_FLAGS(flags, PFR_FLAG_ATOMIC | PFR_FLAG_DUMMY);
-	rs = pf_find_ruleset(trs->pfrt_anchor);
-	if (rs == NULL || !rs->topen || ticket != rs->tticket)
-		return (EBUSY);
-
-	SLIST_INIT(&workq);
-	RB_FOREACH(p, pfr_ktablehead, &pfr_ktables) {
-		if (!(p->pfrkt_flags & PFR_TFLAG_INACTIVE) ||
-		    pfr_skip_table(trs, p, 0))
-			continue;
-		SLIST_INSERT_HEAD(&workq, p, pfrkt_workq);
-		if (p->pfrkt_flags & PFR_TFLAG_ACTIVE)
-			xchange++;
-		else
-			xadd++;
-	}
-
-	if (!(flags & PFR_FLAG_DUMMY)) {
-		if (flags & PFR_FLAG_ATOMIC)
-			s = splsoftnet();
-		for (p = SLIST_FIRST(&workq); p != NULL; p = q) {
-			q = SLIST_NEXT(p, pfrkt_workq);
-			pfr_commit_ktable(p, tzero);
-		}
-		if (flags & PFR_FLAG_ATOMIC)
-			splx(s);
-		rs->topen = 0;
-		pf_remove_if_empty_ruleset(rs);
-	}
-	if (nadd != NULL)
-		*nadd = xadd;
-	if (nchange != NULL)
-		*nchange = xchange;
-
-	return (0);
-}
-
-void
-pfr_commit_ktable(struct pfr_ktable *kt, long tzero)
-{
-	struct pfr_ktable	*shadow = kt->pfrkt_shadow;
-	int			 nflags;
-
-	if (shadow->pfrkt_cnt == NO_ADDRESSES) {
-		if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
-			pfr_clstats_ktable(kt, tzero, 1);
-	} else if (kt->pfrkt_flags & PFR_TFLAG_ACTIVE) {
-		/* kt might contain addresses */
-		struct pfr_kentryworkq	 addrq, addq, changeq, delq, garbageq;
-		struct pfr_kentry	*p, *q, *next;
-		struct pfr_addr		 ad;
-
-		pfr_enqueue_addrs(shadow, &addrq, NULL, 0);
-		pfr_mark_addrs(kt);
-		SLIST_INIT(&addq);
-		SLIST_INIT(&changeq);
-		SLIST_INIT(&delq);
-		SLIST_INIT(&garbageq);
-		pfr_clean_node_mask(shadow, &addrq);
-		for (p = SLIST_FIRST(&addrq); p != NULL; p = next) {
-			next = SLIST_NEXT(p, pfrke_workq);	/* XXX */
-			pfr_copyout_addr(&ad, p);
-			q = pfr_lookup_addr(kt, &ad, 1);
-			if (q != NULL) {
-				if (q->pfrke_not != p->pfrke_not)
-					SLIST_INSERT_HEAD(&changeq, q,
-					    pfrke_workq);
-				q->pfrke_mark = 1;
-				SLIST_INSERT_HEAD(&garbageq, p, pfrke_workq);
-			} else {
-				p->pfrke_tzero = tzero;
-				SLIST_INSERT_HEAD(&addq, p, pfrke_workq);
-			}
-		}
-		pfr_enqueue_addrs(kt, &delq, NULL, ENQUEUE_UNMARKED_ONLY);
-		pfr_insert_kentries(kt, &addq, tzero);
-		pfr_remove_kentries(kt, &delq);
-		pfr_clstats_kentries(&changeq, tzero, INVERT_NEG_FLAG);
-		pfr_destroy_kentries(&garbageq);
-	} else {
-		/* kt cannot contain addresses */
-		SWAP(struct radix_node_head *, kt->pfrkt_ip4,
-		    shadow->pfrkt_ip4);
-		SWAP(struct radix_node_head *, kt->pfrkt_ip6,
-		    shadow->pfrkt_ip6);
-		SWAP(int, kt->pfrkt_cnt, shadow->pfrkt_cnt);
-		pfr_clstats_ktable(kt, tzero, 1);
-	}
-	nflags = ((shadow->pfrkt_flags & PFR_TFLAG_USRMASK) |
-	    (kt->pfrkt_flags & PFR_TFLAG_SETMASK) | PFR_TFLAG_ACTIVE)
-		& ~PFR_TFLAG_INACTIVE;
-	pfr_destroy_ktable(shadow, 0);
-	kt->pfrkt_shadow = NULL;
-	pfr_setflags_ktable(kt, nflags);
-}
-
-int
-pfr_validate_table(struct pfr_table *tbl, int allowedflags, int no_reserved)
-{
-	int i;
-
-	if (!tbl->pfrt_name[0])
-		return (-1);
-	if (no_reserved && !strcmp(tbl->pfrt_anchor, PF_RESERVED_ANCHOR))
-		 return (-1);
-	if (tbl->pfrt_name[PF_TABLE_NAME_SIZE-1])
-		return (-1);
-	for (i = strlen(tbl->pfrt_name); i < PF_TABLE_NAME_SIZE; i++)
-		if (tbl->pfrt_name[i])
-			return (-1);
-	if (pfr_fix_anchor(tbl->pfrt_anchor))
-		return (-1);
-	if (tbl->pfrt_flags & ~allowedflags)
-		return (-1);
-	return (0);
-}
-
-/*
- * Rewrite anchors referenced by tables to remove slashes
- * and check for validity.
- */
-int
-pfr_fix_anchor(char *anchor)
-{
-	size_t siz = MAXPATHLEN;
-	int i;
-
-	if (anchor[0] == '/') {
-		char *path;
-		int off;
-
-		path = anchor;
-		off = 1;
-		while (*++path == '/')
-			off++;
-		bcopy(path, anchor, siz - off);
-		memset(anchor + siz - off, 0, off);
-	}
-	if (anchor[siz - 1])
-		return (-1);
-	for (i = strlen(anchor); i < siz; i++)
-		if (anchor[i])
-			return (-1);
-	return (0);
-}
-
-int
-pfr_table_count(struct pfr_table *filter, int flags)
-{
-	struct pf_ruleset *rs;
-
-	if (flags & PFR_FLAG_ALLRSETS)
-		return (pfr_ktable_cnt);
-	if (filter->pfrt_anchor[0]) {
-		rs = pf_find_ruleset(filter->pfrt_anchor);
-		return ((rs != NULL) ? rs->tables : -1);
-	}
-	return (pf_main_ruleset.tables);
-}
-
-int
-pfr_skip_table(struct pfr_table *filter, struct pfr_ktable *kt, int flags)
-{
-	if (flags & PFR_FLAG_ALLRSETS)
-		return (0);
-	if (strcmp(filter->pfrt_anchor, kt->pfrkt_anchor))
-		return (1);
-	return (0);
-}
-
-void
-pfr_insert_ktables(struct pfr_ktableworkq *workq)
-{
-	struct pfr_ktable	*p;
-
-	SLIST_FOREACH(p, workq, pfrkt_workq)
-		pfr_insert_ktable(p);
-}
-
-void
-pfr_insert_ktable(struct pfr_ktable *kt)
-{
-	RB_INSERT(pfr_ktablehead, &pfr_ktables, kt);
-	pfr_ktable_cnt++;
-	if (kt->pfrkt_root != NULL)
-		if (!kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR]++)
-			pfr_setflags_ktable(kt->pfrkt_root,
-			    kt->pfrkt_root->pfrkt_flags|PFR_TFLAG_REFDANCHOR);
-}
-
-void
-pfr_setflags_ktables(struct pfr_ktableworkq *workq)
-{
-	struct pfr_ktable	*p, *q;
-
-	for (p = SLIST_FIRST(workq); p; p = q) {
-		q = SLIST_NEXT(p, pfrkt_workq);
-		pfr_setflags_ktable(p, p->pfrkt_nflags);
-	}
-}
-
-void
-pfr_setflags_ktable(struct pfr_ktable *kt, int newf)
-{
-	struct pfr_kentryworkq	addrq;
-
-	if (!(newf & PFR_TFLAG_REFERENCED) &&
-	    !(newf & PFR_TFLAG_PERSIST))
-		newf &= ~PFR_TFLAG_ACTIVE;
-	if (!(newf & PFR_TFLAG_ACTIVE))
-		newf &= ~PFR_TFLAG_USRMASK;
-	if (!(newf & PFR_TFLAG_SETMASK)) {
-		RB_REMOVE(pfr_ktablehead, &pfr_ktables, kt);
-		if (kt->pfrkt_root != NULL)
-			if (!--kt->pfrkt_root->pfrkt_refcnt[PFR_REFCNT_ANCHOR])
-				pfr_setflags_ktable(kt->pfrkt_root,
-				    kt->pfrkt_root->pfrkt_flags &
-					~PFR_TFLAG_REFDANCHOR);
-		pfr_destroy_ktable(kt, 1);
-		pfr_ktable_cnt--;
-		return;
-	}
-	if (!(newf & PFR_TFLAG_ACTIVE) && kt->pfrkt_cnt) {
-		pfr_enqueue_addrs(kt, &addrq, NULL, 0);
-		pfr_remove_kentries(kt, &addrq);
-	}
-	if (!(newf & PFR_TFLAG_INACTIVE) && kt->pfrkt_shadow != NULL) {
-		pfr_destroy_ktable(kt->pfrkt_shadow, 1);
-		kt->pfrkt_shadow = NULL;
-	}
-	kt->pfrkt_flags = newf;
-}
-
-void
-pfr_clstats_ktables(struct pfr_ktableworkq *workq, long tzero, int recurse)
-{
-	struct pfr_ktable	*p;
-
-	SLIST_FOREACH(p, workq, pfrkt_workq)
-		pfr_clstats_ktable(p, tzero, recurse);
-}
-
-void
-pfr_clstats_ktable(struct pfr_ktable *kt, long tzero, int recurse)
-{
-	struct pfr_kentryworkq	 addrq;
-	int			 s;
-
-	if (recurse) {
-		pfr_enqueue_addrs(kt, &addrq, NULL, 0);
-		pfr_clstats_kentries(&addrq, tzero, 0);
-	}
-	s = splsoftnet();
-	bzero(kt->pfrkt_packets, sizeof(kt->pfrkt_packets));
-	bzero(kt->pfrkt_bytes, sizeof(kt->pfrkt_bytes));
-	kt->pfrkt_match = kt->pfrkt_nomatch = 0;
-	splx(s);
-	kt->pfrkt_tzero = tzero;
-}
-
-struct pfr_ktable *
-pfr_create_ktable(struct pfr_table *tbl, long tzero, int attachruleset,
-    int intr)
-{
-	struct pfr_ktable	*kt;
-	struct pf_ruleset	*rs;
-
-#ifdef __FreeBSD__
-	kt = pool_get(&V_pfr_ktable_pl, PR_NOWAIT|PR_ZERO);
-#else
-	if (intr)
-		kt = pool_get(&pfr_ktable_pl, PR_NOWAIT|PR_ZERO|PR_LIMITFAIL);
-	else
-		kt = pool_get(&pfr_ktable_pl, PR_WAITOK|PR_ZERO|PR_LIMITFAIL);
-#endif
-	if (kt == NULL)
-		return (NULL);
-	kt->pfrkt_t = *tbl;
-
-	if (attachruleset) {
-		rs = pf_find_or_create_ruleset(tbl->pfrt_anchor);
-		if (!rs) {
-			pfr_destroy_ktable(kt, 0);
-			return (NULL);
-		}
-		kt->pfrkt_rs = rs;
-		rs->tables++;
-	}
-
-	if (!rn_inithead((void **)&kt->pfrkt_ip4,
-	    offsetof(struct sockaddr_in, sin_addr) * 8) ||
-	    !rn_inithead((void **)&kt->pfrkt_ip6,
-	    offsetof(struct sockaddr_in6, sin6_addr) * 8)) {
-		pfr_destroy_ktable(kt, 0);
-		return (NULL);
-	}
-	kt->pfrkt_tzero = tzero;
-
-	return (kt);
-}
-
-void
-pfr_destroy_ktables(struct pfr_ktableworkq *workq, int flushaddr)
-{
-	struct pfr_ktable	*p, *q;
-
-	for (p = SLIST_FIRST(workq); p; p = q) {
-		q = SLIST_NEXT(p, pfrkt_workq);
-		pfr_destroy_ktable(p, flushaddr);
-	}
-}
-
-void
-pfr_destroy_ktable(struct pfr_ktable *kt, int flushaddr)
-{
-	struct pfr_kentryworkq	 addrq;
-
-	if (flushaddr) {
-		pfr_enqueue_addrs(kt, &addrq, NULL, 0);
-		pfr_clean_node_mask(kt, &addrq);
-		pfr_destroy_kentries(&addrq);
-	}
-#if defined(__FreeBSD__) && (__FreeBSD_version >= 500100)
-	if (kt->pfrkt_ip4 != NULL) {
-		RADIX_NODE_HEAD_DESTROY(kt->pfrkt_ip4);
-		free((caddr_t)kt->pfrkt_ip4, M_RTABLE);
-	}
-	if (kt->pfrkt_ip6 != NULL) {
-		RADIX_NODE_HEAD_DESTROY(kt->pfrkt_ip6);
-		free((caddr_t)kt->pfrkt_ip6, M_RTABLE);
-	}
-#else
-	if (kt->pfrkt_ip4 != NULL)
-		free((caddr_t)kt->pfrkt_ip4, M_RTABLE);
-	if (kt->pfrkt_ip6 != NULL)
-		free((caddr_t)kt->pfrkt_ip6, M_RTABLE);
-#endif
-	if (kt->pfrkt_shadow != NULL)
-		pfr_destroy_ktable(kt->pfrkt_shadow, flushaddr);
-	if (kt->pfrkt_rs != NULL) {
-		kt->pfrkt_rs->tables--;
-		pf_remove_if_empty_ruleset(kt->pfrkt_rs);
-	}
-#ifdef __FreeBSD__
-	pool_put(&V_pfr_ktable_pl, kt);
-#else
-	pool_put(&pfr_ktable_pl, kt);
-#endif
-}
-
-int
-pfr_ktable_compare(struct pfr_ktable *p, struct pfr_ktable *q)
-{
-	int d;
-
-	if ((d = strncmp(p->pfrkt_name, q->pfrkt_name, PF_TABLE_NAME_SIZE)))
-		return (d);
-	return (strcmp(p->pfrkt_anchor, q->pfrkt_anchor));
-}
-
-struct pfr_ktable *
-pfr_lookup_table(struct pfr_table *tbl)
-{
-	/* struct pfr_ktable start like a struct pfr_table */
-	return (RB_FIND(pfr_ktablehead, &pfr_ktables,
-	    (struct pfr_ktable *)tbl));
-}
-
-int
-pfr_match_addr(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af)
-{
-	struct pfr_kentry	*ke = NULL;
-	int			 match;
-
-	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
-		kt = kt->pfrkt_root;
-	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
-		return (0);
-
-	switch (af) {
-#ifdef INET
-	case AF_INET:
-#ifdef __FreeBSD__
-		V_pfr_sin.sin_addr.s_addr = a->addr32[0];
-		ke = (struct pfr_kentry *)rn_match(&V_pfr_sin, kt->pfrkt_ip4);
-#else
-		pfr_sin.sin_addr.s_addr = a->addr32[0];
-		ke = (struct pfr_kentry *)rn_match(&pfr_sin, kt->pfrkt_ip4);
-#endif
-		if (ke && KENTRY_RNF_ROOT(ke))
-			ke = NULL;
-		break;
-#endif /* INET */
-#ifdef INET6
-	case AF_INET6:
-#ifdef __FreeBSD__
-		bcopy(a, &V_pfr_sin6.sin6_addr, sizeof(V_pfr_sin6.sin6_addr));
-		ke = (struct pfr_kentry *)rn_match(&V_pfr_sin6, kt->pfrkt_ip6);
-#else
-		bcopy(a, &pfr_sin6.sin6_addr, sizeof(pfr_sin6.sin6_addr));
-		ke = (struct pfr_kentry *)rn_match(&pfr_sin6, kt->pfrkt_ip6);
-#endif
-		if (ke && KENTRY_RNF_ROOT(ke))
-			ke = NULL;
-		break;
-#endif /* INET6 */
-	}
-	match = (ke && !ke->pfrke_not);
-	if (match)
-		kt->pfrkt_match++;
-	else
-		kt->pfrkt_nomatch++;
-	return (match);
-}
-
-void
-pfr_update_stats(struct pfr_ktable *kt, struct pf_addr *a, sa_family_t af,
-    u_int64_t len, int dir_out, int op_pass, int notrule)
-{
-	struct pfr_kentry	*ke = NULL;
-
-	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
-		kt = kt->pfrkt_root;
-	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
-		return;
-
-	switch (af) {
-#ifdef INET
-	case AF_INET:
-#ifdef __FreeBSD__
-		V_pfr_sin.sin_addr.s_addr = a->addr32[0];
-		ke = (struct pfr_kentry *)rn_match(&V_pfr_sin, kt->pfrkt_ip4);
-#else
-		pfr_sin.sin_addr.s_addr = a->addr32[0];
-		ke = (struct pfr_kentry *)rn_match(&pfr_sin, kt->pfrkt_ip4);
-#endif
-		if (ke && KENTRY_RNF_ROOT(ke))
-			ke = NULL;
-		break;
-#endif /* INET */
-#ifdef INET6
-	case AF_INET6:
-#ifdef __FreeBSD__
-		bcopy(a, &V_pfr_sin6.sin6_addr, sizeof(V_pfr_sin6.sin6_addr));
-		ke = (struct pfr_kentry *)rn_match(&V_pfr_sin6, kt->pfrkt_ip6);
-#else
-		bcopy(a, &pfr_sin6.sin6_addr, sizeof(pfr_sin6.sin6_addr));
-		ke = (struct pfr_kentry *)rn_match(&pfr_sin6, kt->pfrkt_ip6);
-#endif
-		if (ke && KENTRY_RNF_ROOT(ke))
-			ke = NULL;
-		break;
-#endif /* INET6 */
-	default:
-		;
-	}
-	if ((ke == NULL || ke->pfrke_not) != notrule) {
-		if (op_pass != PFR_OP_PASS)
-			printf("pfr_update_stats: assertion failed.\n");
-		op_pass = PFR_OP_XPASS;
-	}
-	kt->pfrkt_packets[dir_out][op_pass]++;
-	kt->pfrkt_bytes[dir_out][op_pass] += len;
-	if (ke != NULL && op_pass != PFR_OP_XPASS &&
-	    (kt->pfrkt_flags & PFR_TFLAG_COUNTERS)) {
-		if (ke->pfrke_counters == NULL)
-#ifdef __FreeBSD__
-			ke->pfrke_counters = pool_get(&V_pfr_kcounters_pl,
-#else
-			ke->pfrke_counters = pool_get(&pfr_kcounters_pl,
-#endif
-			    PR_NOWAIT | PR_ZERO);
-		if (ke->pfrke_counters != NULL) {
-			ke->pfrke_counters->pfrkc_packets[dir_out][op_pass]++;
-			ke->pfrke_counters->pfrkc_bytes[dir_out][op_pass] += len;
-		}
-	}
-}
-
-struct pfr_ktable *
-pfr_attach_table(struct pf_ruleset *rs, char *name, int intr)
-{
-	struct pfr_ktable	*kt, *rt;
-	struct pfr_table	 tbl;
-	struct pf_anchor	*ac = rs->anchor;
-
-	bzero(&tbl, sizeof(tbl));
-	strlcpy(tbl.pfrt_name, name, sizeof(tbl.pfrt_name));
-	if (ac != NULL)
-		strlcpy(tbl.pfrt_anchor, ac->path, sizeof(tbl.pfrt_anchor));
-	kt = pfr_lookup_table(&tbl);
-	if (kt == NULL) {
-		kt = pfr_create_ktable(&tbl, time_second, 1, intr);
-		if (kt == NULL)
-			return (NULL);
-		if (ac != NULL) {
-			bzero(tbl.pfrt_anchor, sizeof(tbl.pfrt_anchor));
-			rt = pfr_lookup_table(&tbl);
-			if (rt == NULL) {
-				rt = pfr_create_ktable(&tbl, 0, 1, intr);
-				if (rt == NULL) {
-					pfr_destroy_ktable(kt, 0);
-					return (NULL);
-				}
-				pfr_insert_ktable(rt);
-			}
-			kt->pfrkt_root = rt;
-		}
-		pfr_insert_ktable(kt);
-	}
-	if (!kt->pfrkt_refcnt[PFR_REFCNT_RULE]++)
-		pfr_setflags_ktable(kt, kt->pfrkt_flags|PFR_TFLAG_REFERENCED);
-	return (kt);
-}
-
-void
-pfr_detach_table(struct pfr_ktable *kt)
-{
-	if (kt->pfrkt_refcnt[PFR_REFCNT_RULE] <= 0)
-		printf("pfr_detach_table: refcount = %d.\n",
-		    kt->pfrkt_refcnt[PFR_REFCNT_RULE]);
-	else if (!--kt->pfrkt_refcnt[PFR_REFCNT_RULE])
-		pfr_setflags_ktable(kt, kt->pfrkt_flags&~PFR_TFLAG_REFERENCED);
-}
-
-int
-pfr_pool_get(struct pfr_ktable *kt, int *pidx, struct pf_addr *counter,
-    struct pf_addr **raddr, struct pf_addr **rmask, sa_family_t af)
-{
-#ifdef __FreeBSD__
-	struct pfr_kentry	*ke, *ke2 = NULL;
-	struct pf_addr		*addr = NULL;
-#else
-	struct pfr_kentry	*ke, *ke2;
-	struct pf_addr		*addr;
-#endif
-	union sockaddr_union	 mask;
-	int			 idx = -1, use_counter = 0;
-
-#ifdef __FreeBSD__
-	if (af == AF_INET)
-		addr = (struct pf_addr *)&V_pfr_sin.sin_addr;
-	else if (af == AF_INET6)
-		addr = (struct pf_addr *)&V_pfr_sin6.sin6_addr;
-#else
-	if (af == AF_INET)
-		addr = (struct pf_addr *)&pfr_sin.sin_addr;
-	else if (af == AF_INET6)
-		addr = (struct pf_addr *)&pfr_sin6.sin6_addr;
-#endif
-	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE) && kt->pfrkt_root != NULL)
-		kt = kt->pfrkt_root;
-	if (!(kt->pfrkt_flags & PFR_TFLAG_ACTIVE))
-		return (-1);
-
-	if (pidx != NULL)
-		idx = *pidx;
-	if (counter != NULL && idx >= 0)
-		use_counter = 1;
-	if (idx < 0)
-		idx = 0;
-
-_next_block:
-	ke = pfr_kentry_byidx(kt, idx, af);
-	if (ke == NULL) {
-		kt->pfrkt_nomatch++;
-		return (1);
-	}
-#ifdef __FreeBSD__
-	pfr_prepare_network(&V_pfr_mask, af, ke->pfrke_net);
-#else
-	pfr_prepare_network(&pfr_mask, af, ke->pfrke_net);
-#endif
-	*raddr = SUNION2PF(&ke->pfrke_sa, af);
-#ifdef __FreeBSD__
-	*rmask = SUNION2PF(&V_pfr_mask, af);
-#else
-	*rmask = SUNION2PF(&pfr_mask, af);
-#endif
-
-	if (use_counter) {
-		/* is supplied address within block? */
-		if (!PF_MATCHA(0, *raddr, *rmask, counter, af)) {
-			/* no, go to next block in table */
-			idx++;
-			use_counter = 0;
-			goto _next_block;
-		}
-		PF_ACPY(addr, counter, af);
-	} else {
-		/* use first address of block */
-		PF_ACPY(addr, *raddr, af);
-	}
-
-	if (!KENTRY_NETWORK(ke)) {
-		/* this is a single IP address - no possible nested block */
-		PF_ACPY(counter, addr, af);
-		*pidx = idx;
-		kt->pfrkt_match++;
-		return (0);
-	}
-	for (;;) {
-		/* we don't want to use a nested block */
-#ifdef __FreeBSD__
-		if (af == AF_INET)
-			ke2 = (struct pfr_kentry *)rn_match(&V_pfr_sin,
-			    kt->pfrkt_ip4);
-		else if (af == AF_INET6)
-			ke2 = (struct pfr_kentry *)rn_match(&V_pfr_sin6,
-			    kt->pfrkt_ip6);
-#else
-		if (af == AF_INET)
-			ke2 = (struct pfr_kentry *)rn_match(&pfr_sin,
-			    kt->pfrkt_ip4);
-		else if (af == AF_INET6)
-			ke2 = (struct pfr_kentry *)rn_match(&pfr_sin6,
-			    kt->pfrkt_ip6);
-#endif
-		/* no need to check KENTRY_RNF_ROOT() here */
-		if (ke2 == ke) {
-			/* lookup return the same block - perfect */
-			PF_ACPY(counter, addr, af);
-			*pidx = idx;
-			kt->pfrkt_match++;
-			return (0);
-		}
-
-		/* we need to increase the counter past the nested block */
-		pfr_prepare_network(&mask, AF_INET, ke2->pfrke_net);
-#ifdef __FreeBSD__
-		PF_POOLMASK(addr, addr, SUNION2PF(&mask, af), &V_pfr_ffaddr, af);
-#else
-		PF_POOLMASK(addr, addr, SUNION2PF(&mask, af), &pfr_ffaddr, af);
-#endif
-		PF_AINC(addr, af);
-		if (!PF_MATCHA(0, *raddr, *rmask, addr, af)) {
-			/* ok, we reached the end of our main block */
-			/* go to next block in table */
-			idx++;
-			use_counter = 0;
-			goto _next_block;
-		}
-	}
-}
-
-struct pfr_kentry *
-pfr_kentry_byidx(struct pfr_ktable *kt, int idx, int af)
-{
-	struct pfr_walktree	w;
-
-	bzero(&w, sizeof(w));
-	w.pfrw_op = PFRW_POOL_GET;
-	w.pfrw_cnt = idx;
-
-	switch (af) {
-#ifdef INET
-	case AF_INET:
-#ifdef __FreeBSD__
-		kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
-#else
-		rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
-#endif
-		return (w.pfrw_kentry);
-#endif /* INET */
-#ifdef INET6
-	case AF_INET6:
-#ifdef __FreeBSD__
-		kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
-#else
-		rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
-#endif
-		return (w.pfrw_kentry);
-#endif /* INET6 */
-	default:
-		return (NULL);
-	}
-}
-
-void
-pfr_dynaddr_update(struct pfr_ktable *kt, struct pfi_dynaddr *dyn)
-{
-	struct pfr_walktree	w;
-	int			s;
-
-	bzero(&w, sizeof(w));
-	w.pfrw_op = PFRW_DYNADDR_UPDATE;
-	w.pfrw_dyn = dyn;
-
-	s = splsoftnet();
-	dyn->pfid_acnt4 = 0;
-	dyn->pfid_acnt6 = 0;
-	if (!dyn->pfid_af || dyn->pfid_af == AF_INET)
-#ifdef __FreeBSD__
-		kt->pfrkt_ip4->rnh_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
-#else
-		rn_walktree(kt->pfrkt_ip4, pfr_walktree, &w);
-#endif
-	if (!dyn->pfid_af || dyn->pfid_af == AF_INET6)
-#ifdef __FreeBSD__
-		kt->pfrkt_ip6->rnh_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
-#else
-		rn_walktree(kt->pfrkt_ip6, pfr_walktree, &w);
-#endif
-	splx(s);
-}
diff --git a/sys/contrib/pf/net/pfvar.h b/sys/contrib/pf/net/pfvar.h
deleted file mode 100644
index dab70c597a60..000000000000
--- a/sys/contrib/pf/net/pfvar.h
+++ /dev/null
@@ -1,2234 +0,0 @@
-/*	$OpenBSD: pfvar.h,v 1.282 2009/01/29 15:12:28 pyr Exp $ */
-
-/*
- * Copyright (c) 2001 Daniel Hartmeier
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- *    - Redistributions of source code must retain the above copyright
- *      notice, this list of conditions and the following disclaimer.
- *    - Redistributions in binary form must reproduce the above
- *      copyright notice, this list of conditions and the following
- *      disclaimer in the documentation and/or other materials provided
- *      with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
- * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
- * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
- * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
- * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
- * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- *
- */
-
-#ifndef _NET_PFVAR_H_
-#define _NET_PFVAR_H_
-
-#include <sys/param.h>
-#include <sys/types.h>
-#include <sys/queue.h>
-#include <sys/tree.h>
-#ifdef __FreeBSD__
-#include <sys/lock.h>
-#include <sys/sx.h>
-#else
-#include <sys/rwlock.h>
-#endif
-
-#include <net/radix.h>
-#include <net/route.h>
-#ifdef __FreeBSD__
-#include <net/if_clone.h>
-#include <net/pf_mtag.h>
-#include <vm/uma.h>
-#else
-#include <netinet/ip_ipsp.h>
-#endif
-
-#ifdef __FreeBSD__
-#include <netinet/in.h>
-#endif
-
-#include <netinet/tcp_fsm.h>
-
-struct ip;
-struct ip6_hdr;
-#ifdef __FreeBSD__
-struct inpcb;
-#endif
-
-#define	PF_TCPS_PROXY_SRC	((TCP_NSTATES)+0)
-#define	PF_TCPS_PROXY_DST	((TCP_NSTATES)+1)
-
-#define	PF_MD5_DIGEST_LENGTH	16
-#ifdef MD5_DIGEST_LENGTH
-#if PF_MD5_DIGEST_LENGTH != MD5_DIGEST_LENGTH
-#error
-#endif
-#endif
-
-enum	{ PF_INOUT, PF_IN, PF_OUT };
-enum	{ PF_PASS, PF_DROP, PF_SCRUB, PF_NOSCRUB, PF_NAT, PF_NONAT,
-	  PF_BINAT, PF_NOBINAT, PF_RDR, PF_NORDR, PF_SYNPROXY_DROP, PF_DEFER };
-enum	{ PF_RULESET_SCRUB, PF_RULESET_FILTER, PF_RULESET_NAT,
-	  PF_RULESET_BINAT, PF_RULESET_RDR, PF_RULESET_MAX };
-enum	{ PF_OP_NONE, PF_OP_IRG, PF_OP_EQ, PF_OP_NE, PF_OP_LT,
-	  PF_OP_LE, PF_OP_GT, PF_OP_GE, PF_OP_XRG, PF_OP_RRG };
-enum	{ PF_DEBUG_NONE, PF_DEBUG_URGENT, PF_DEBUG_MISC, PF_DEBUG_NOISY };
-enum	{ PF_CHANGE_NONE, PF_CHANGE_ADD_HEAD, PF_CHANGE_ADD_TAIL,
-	  PF_CHANGE_ADD_BEFORE, PF_CHANGE_ADD_AFTER,
-	  PF_CHANGE_REMOVE, PF_CHANGE_GET_TICKET };
-enum	{ PF_GET_NONE, PF_GET_CLR_CNTR };
-enum	{ PF_SK_WIRE, PF_SK_STACK, PF_SK_BOTH };
-
-/*
- * Note about PFTM_*: real indices into pf_rule.timeout[] come before
- * PFTM_MAX, special cases afterwards. See pf_state_expires().
- */
-enum	{ PFTM_TCP_FIRST_PACKET, PFTM_TCP_OPENING, PFTM_TCP_ESTABLISHED,
-	  PFTM_TCP_CLOSING, PFTM_TCP_FIN_WAIT, PFTM_TCP_CLOSED,
-	  PFTM_UDP_FIRST_PACKET, PFTM_UDP_SINGLE, PFTM_UDP_MULTIPLE,
-	  PFTM_ICMP_FIRST_PACKET, PFTM_ICMP_ERROR_REPLY,
-	  PFTM_OTHER_FIRST_PACKET, PFTM_OTHER_SINGLE,
-	  PFTM_OTHER_MULTIPLE, PFTM_FRAG, PFTM_INTERVAL,
-	  PFTM_ADAPTIVE_START, PFTM_ADAPTIVE_END, PFTM_SRC_NODE,
-	  PFTM_TS_DIFF, PFTM_MAX, PFTM_PURGE, PFTM_UNLINKED,
-	  PFTM_UNTIL_PACKET };
-
-/* PFTM default values */
-#define PFTM_TCP_FIRST_PACKET_VAL	120	/* First TCP packet */
-#define PFTM_TCP_OPENING_VAL		30	/* No response yet */
-#define PFTM_TCP_ESTABLISHED_VAL	24*60*60/* Established */
-#define PFTM_TCP_CLOSING_VAL		15 * 60	/* Half closed */
-#define PFTM_TCP_FIN_WAIT_VAL		45	/* Got both FINs */
-#define PFTM_TCP_CLOSED_VAL		90	/* Got a RST */
-#define PFTM_UDP_FIRST_PACKET_VAL	60	/* First UDP packet */
-#define PFTM_UDP_SINGLE_VAL		30	/* Unidirectional */
-#define PFTM_UDP_MULTIPLE_VAL		60	/* Bidirectional */
-#define PFTM_ICMP_FIRST_PACKET_VAL	20	/* First ICMP packet */
-#define PFTM_ICMP_ERROR_REPLY_VAL	10	/* Got error response */
-#define PFTM_OTHER_FIRST_PACKET_VAL	60	/* First packet */
-#define PFTM_OTHER_SINGLE_VAL		30	/* Unidirectional */
-#define PFTM_OTHER_MULTIPLE_VAL		60	/* Bidirectional */
-#define PFTM_FRAG_VAL			30	/* Fragment expire */
-#define PFTM_INTERVAL_VAL		10	/* Expire interval */
-#define PFTM_SRC_NODE_VAL		0	/* Source tracking */
-#define PFTM_TS_DIFF_VAL		30	/* Allowed TS diff */
-
-enum	{ PF_NOPFROUTE, PF_FASTROUTE, PF_ROUTETO, PF_DUPTO, PF_REPLYTO };
-enum	{ PF_LIMIT_STATES, PF_LIMIT_SRC_NODES, PF_LIMIT_FRAGS,
-	  PF_LIMIT_TABLES, PF_LIMIT_TABLE_ENTRIES, PF_LIMIT_MAX };
-#define PF_POOL_IDMASK		0x0f
-enum	{ PF_POOL_NONE, PF_POOL_BITMASK, PF_POOL_RANDOM,
-	  PF_POOL_SRCHASH, PF_POOL_ROUNDROBIN };
-enum	{ PF_ADDR_ADDRMASK, PF_ADDR_NOROUTE, PF_ADDR_DYNIFTL,
-	  PF_ADDR_TABLE, PF_ADDR_RTLABEL, PF_ADDR_URPFFAILED,
-	  PF_ADDR_RANGE };
-#define PF_POOL_TYPEMASK	0x0f
-#define PF_POOL_STICKYADDR	0x20
-#define	PF_WSCALE_FLAG		0x80
-#define	PF_WSCALE_MASK		0x0f
-
-#define	PF_LOG			0x01
-#define	PF_LOG_ALL		0x02
-#define	PF_LOG_SOCKET_LOOKUP	0x04
-
-struct pf_addr {
-	union {
-		struct in_addr		v4;
-		struct in6_addr		v6;
-		u_int8_t		addr8[16];
-		u_int16_t		addr16[8];
-		u_int32_t		addr32[4];
-	} pfa;		    /* 128-bit address */
-#define v4	pfa.v4
-#define v6	pfa.v6
-#define addr8	pfa.addr8
-#define addr16	pfa.addr16
-#define addr32	pfa.addr32
-};
-
-#define	PF_TABLE_NAME_SIZE	 32
-
-#define PFI_AFLAG_NETWORK	0x01
-#define PFI_AFLAG_BROADCAST	0x02
-#define PFI_AFLAG_PEER		0x04
-#define PFI_AFLAG_MODEMASK	0x07
-#define PFI_AFLAG_NOALIAS	0x08
-
-struct pf_addr_wrap {
-	union {
-		struct {
-			struct pf_addr		 addr;
-			struct pf_addr		 mask;
-		}			 a;
-		char			 ifname[IFNAMSIZ];
-		char			 tblname[PF_TABLE_NAME_SIZE];
-#ifdef __FreeBSD__
-#define	RTLABEL_LEN	32
-#endif
-		char			 rtlabelname[RTLABEL_LEN];
-		u_int32_t		 rtlabel;
-	}			 v;
-	union {
-		struct pfi_dynaddr	*dyn;
-		struct pfr_ktable	*tbl;
-		int			 dyncnt;
-		int			 tblcnt;
-	}			 p;
-	u_int8_t		 type;		/* PF_ADDR_* */
-	u_int8_t		 iflags;	/* PFI_AFLAG_* */
-};
-
-#ifdef _KERNEL
-
-struct pfi_dynaddr {
-	TAILQ_ENTRY(pfi_dynaddr)	 entry;
-	struct pf_addr			 pfid_addr4;
-	struct pf_addr			 pfid_mask4;
-	struct pf_addr			 pfid_addr6;
-	struct pf_addr			 pfid_mask6;
-	struct pfr_ktable		*pfid_kt;
-	struct pfi_kif			*pfid_kif;
-	void				*pfid_hook_cookie;
-	int				 pfid_net;	/* mask or 128 */
-	int				 pfid_acnt4;	/* address count IPv4 */
-	int				 pfid_acnt6;	/* address count IPv6 */
-	sa_family_t			 pfid_af;	/* rule af */
-	u_int8_t			 pfid_iflags;	/* PFI_AFLAG_* */
-};
-
-/*
- * Address manipulation macros
- */
-
-#ifdef __FreeBSD__
-#define	splsoftnet()	splnet()
-
-#define	HTONL(x)	(x) = htonl((__uint32_t)(x))
-#define	HTONS(x)	(x) = htons((__uint16_t)(x))
-#define	NTOHL(x)	(x) = ntohl((__uint32_t)(x))
-#define	NTOHS(x)	(x) = ntohs((__uint16_t)(x))
-
-#define	PF_NAME		"pf"
-
-#define	PR_NOWAIT	M_NOWAIT
-#define	PR_WAITOK	M_WAITOK
-#define	PR_ZERO		M_ZERO
-#define	pool_get(p, f)	uma_zalloc(*(p), (f))
-#define	pool_put(p, o)	uma_zfree(*(p), (o))
-
-#define	UMA_CREATE(var, type, desc)			\
-	var = uma_zcreate(desc, sizeof(type),		\
-	NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, 0);	\
-	if (var == NULL)				\
-		break
-#define	UMA_DESTROY(var)				\
-	if (var)					\
-		uma_zdestroy(var)
-
-#ifdef __FreeBSD__
-extern struct mtx pf_task_mtx;
-
-#define	PF_LOCK_ASSERT()	mtx_assert(&pf_task_mtx, MA_OWNED)
-#define	PF_UNLOCK_ASSERT()	mtx_assert(&pf_task_mtx, MA_NOTOWNED)
-#define	PF_LOCK()		mtx_lock(&pf_task_mtx)
-#define	PF_UNLOCK()		mtx_unlock(&pf_task_mtx)
-#else
-#define	PF_LOCK_ASSERT()
-#define	PF_UNLOCK_ASSERT()
-#define	PF_LOCK()
-#define	PF_UNLOCK()
-#endif /* __FreeBSD__ */
-
-#define	PF_COPYIN(uaddr, kaddr, len, r)		do {	\
-	PF_UNLOCK();					\
-	r = copyin((uaddr), (kaddr), (len));		\
-	PF_LOCK();					\
-} while(0)
-
-#define	PF_COPYOUT(kaddr, uaddr, len, r)	do {	\
-	PF_UNLOCK();					\
-	r = copyout((kaddr), (uaddr), (len));		\
-	PF_LOCK();					\
-} while(0)
-
-#define	PF_MODVER	1
-#define	PFLOG_MODVER	1
-#define	PFSYNC_MODVER	1
-
-#define	PFLOG_MINVER	1
-#define	PFLOG_PREFVER	PFLOG_MODVER
-#define	PFLOG_MAXVER	1
-#define	PFSYNC_MINVER	1
-#define	PFSYNC_PREFVER	PFSYNC_MODVER
-#define	PFSYNC_MAXVER	1
-#endif /* __FreeBSD__ */
-#ifdef INET
-#ifndef INET6
-#define	PF_INET_ONLY
-#endif /* ! INET6 */
-#endif /* INET */
-
-#ifdef INET6
-#ifndef INET
-#define	PF_INET6_ONLY
-#endif /* ! INET */
-#endif /* INET6 */
-
-#ifdef INET
-#ifdef INET6
-#define	PF_INET_INET6
-#endif /* INET6 */
-#endif /* INET */
-
-#else
-
-#define	PF_INET_INET6
-
-#endif /* _KERNEL */
-
-/* Both IPv4 and IPv6 */
-#ifdef PF_INET_INET6
-
-#define PF_AEQ(a, b, c) \
-	((c == AF_INET && (a)->addr32[0] == (b)->addr32[0]) || \
-	((a)->addr32[3] == (b)->addr32[3] && \
-	(a)->addr32[2] == (b)->addr32[2] && \
-	(a)->addr32[1] == (b)->addr32[1] && \
-	(a)->addr32[0] == (b)->addr32[0])) \
-
-#define PF_ANEQ(a, b, c) \
-	((c == AF_INET && (a)->addr32[0] != (b)->addr32[0]) || \
-	((a)->addr32[3] != (b)->addr32[3] || \
-	(a)->addr32[2] != (b)->addr32[2] || \
-	(a)->addr32[1] != (b)->addr32[1] || \
-	(a)->addr32[0] != (b)->addr32[0])) \
-
-#define PF_AZERO(a, c) \
-	((c == AF_INET && !(a)->addr32[0]) || \
-	(!(a)->addr32[0] && !(a)->addr32[1] && \
-	!(a)->addr32[2] && !(a)->addr32[3] )) \
-
-#define PF_MATCHA(n, a, m, b, f) \
-	pf_match_addr(n, a, m, b, f)
-
-#define PF_ACPY(a, b, f) \
-	pf_addrcpy(a, b, f)
-
-#define PF_AINC(a, f) \
-	pf_addr_inc(a, f)
-
-#define PF_POOLMASK(a, b, c, d, f) \
-	pf_poolmask(a, b, c, d, f)
-
-#else
-
-/* Just IPv6 */
-
-#ifdef PF_INET6_ONLY
-
-#define PF_AEQ(a, b, c) \
-	((a)->addr32[3] == (b)->addr32[3] && \
-	(a)->addr32[2] == (b)->addr32[2] && \
-	(a)->addr32[1] == (b)->addr32[1] && \
-	(a)->addr32[0] == (b)->addr32[0]) \
-
-#define PF_ANEQ(a, b, c) \
-	((a)->addr32[3] != (b)->addr32[3] || \
-	(a)->addr32[2] != (b)->addr32[2] || \
-	(a)->addr32[1] != (b)->addr32[1] || \
-	(a)->addr32[0] != (b)->addr32[0]) \
-
-#define PF_AZERO(a, c) \
-	(!(a)->addr32[0] && \
-	!(a)->addr32[1] && \
-	!(a)->addr32[2] && \
-	!(a)->addr32[3] ) \
-
-#define PF_MATCHA(n, a, m, b, f) \
-	pf_match_addr(n, a, m, b, f)
-
-#define PF_ACPY(a, b, f) \
-	pf_addrcpy(a, b, f)
-
-#define PF_AINC(a, f) \
-	pf_addr_inc(a, f)
-
-#define PF_POOLMASK(a, b, c, d, f) \
-	pf_poolmask(a, b, c, d, f)
-
-#else
-
-/* Just IPv4 */
-#ifdef PF_INET_ONLY
-
-#define PF_AEQ(a, b, c) \
-	((a)->addr32[0] == (b)->addr32[0])
-
-#define PF_ANEQ(a, b, c) \
-	((a)->addr32[0] != (b)->addr32[0])
-
-#define PF_AZERO(a, c) \
-	(!(a)->addr32[0])
-
-#define PF_MATCHA(n, a, m, b, f) \
-	pf_match_addr(n, a, m, b, f)
-
-#define PF_ACPY(a, b, f) \
-	(a)->v4.s_addr = (b)->v4.s_addr
-
-#define PF_AINC(a, f) \
-	do { \
-		(a)->addr32[0] = htonl(ntohl((a)->addr32[0]) + 1); \
-	} while (0)
-
-#define PF_POOLMASK(a, b, c, d, f) \
-	do { \
-		(a)->addr32[0] = ((b)->addr32[0] & (c)->addr32[0]) | \
-		(((c)->addr32[0] ^ 0xffffffff ) & (d)->addr32[0]); \
-	} while (0)
-
-#endif /* PF_INET_ONLY */
-#endif /* PF_INET6_ONLY */
-#endif /* PF_INET_INET6 */
-
-/*
- * XXX callers not FIB-aware in our version of pf yet.
- * OpenBSD fixed it later it seems, 2010/05/07 13:33:16 claudio.
- */
-#define	PF_MISMATCHAW(aw, x, af, neg, ifp, rtid)			\
-	(								\
-		(((aw)->type == PF_ADDR_NOROUTE &&			\
-		    pf_routable((x), (af), NULL, (rtid))) ||		\
-		(((aw)->type == PF_ADDR_URPFFAILED && (ifp) != NULL &&	\
-		    pf_routable((x), (af), (ifp), (rtid))) ||		\
-		((aw)->type == PF_ADDR_RTLABEL &&			\
-		    !pf_rtlabel_match((x), (af), (aw), (rtid))) ||	\
-		((aw)->type == PF_ADDR_TABLE &&				\
-		    !pfr_match_addr((aw)->p.tbl, (x), (af))) ||		\
-		((aw)->type == PF_ADDR_DYNIFTL &&			\
-		    !pfi_match_addr((aw)->p.dyn, (x), (af))) ||		\
-		((aw)->type == PF_ADDR_RANGE &&				\
-		    !pf_match_addr_range(&(aw)->v.a.addr,		\
-		    &(aw)->v.a.mask, (x), (af))) ||			\
-		((aw)->type == PF_ADDR_ADDRMASK &&			\
-		    !PF_AZERO(&(aw)->v.a.mask, (af)) &&			\
-		    !PF_MATCHA(0, &(aw)->v.a.addr,			\
-		    &(aw)->v.a.mask, (x), (af))))) !=			\
-		(neg)							\
-	)
-
-
-struct pf_rule_uid {
-	uid_t		 uid[2];
-	u_int8_t	 op;
-};
-
-struct pf_rule_gid {
-	uid_t		 gid[2];
-	u_int8_t	 op;
-};
-
-struct pf_rule_addr {
-	struct pf_addr_wrap	 addr;
-	u_int16_t		 port[2];
-	u_int8_t		 neg;
-	u_int8_t		 port_op;
-};
-
-struct pf_pooladdr {
-	struct pf_addr_wrap		 addr;
-	TAILQ_ENTRY(pf_pooladdr)	 entries;
-	char				 ifname[IFNAMSIZ];
-	struct pfi_kif			*kif;
-};
-
-TAILQ_HEAD(pf_palist, pf_pooladdr);
-
-struct pf_poolhashkey {
-	union {
-		u_int8_t		key8[16];
-		u_int16_t		key16[8];
-		u_int32_t		key32[4];
-	} pfk;		    /* 128-bit hash key */
-#define key8	pfk.key8
-#define key16	pfk.key16
-#define key32	pfk.key32
-};
-
-struct pf_pool {
-	struct pf_palist	 list;
-	struct pf_pooladdr	*cur;
-	struct pf_poolhashkey	 key;
-	struct pf_addr		 counter;
-	int			 tblidx;
-	u_int16_t		 proxy_port[2];
-	u_int8_t		 port_op;
-	u_int8_t		 opts;
-};
-
-
-/* A packed Operating System description for fingerprinting */
-typedef u_int32_t pf_osfp_t;
-#define PF_OSFP_ANY	((pf_osfp_t)0)
-#define PF_OSFP_UNKNOWN	((pf_osfp_t)-1)
-#define PF_OSFP_NOMATCH	((pf_osfp_t)-2)
-
-struct pf_osfp_entry {
-	SLIST_ENTRY(pf_osfp_entry) fp_entry;
-	pf_osfp_t		fp_os;
-	int			fp_enflags;
-#define PF_OSFP_EXPANDED	0x001		/* expanded entry */
-#define PF_OSFP_GENERIC		0x002		/* generic signature */
-#define PF_OSFP_NODETAIL	0x004		/* no p0f details */
-#define PF_OSFP_LEN	32
-	char			fp_class_nm[PF_OSFP_LEN];
-	char			fp_version_nm[PF_OSFP_LEN];
-	char			fp_subtype_nm[PF_OSFP_LEN];
-};
-#define PF_OSFP_ENTRY_EQ(a, b) \
-    ((a)->fp_os == (b)->fp_os && \
-    memcmp((a)->fp_class_nm, (b)->fp_class_nm, PF_OSFP_LEN) == 0 && \
-    memcmp((a)->fp_version_nm, (b)->fp_version_nm, PF_OSFP_LEN) == 0 && \
-    memcmp((a)->fp_subtype_nm, (b)->fp_subtype_nm, PF_OSFP_LEN) == 0)
-
-/* handle pf_osfp_t packing */
-#define _FP_RESERVED_BIT	1  /* For the special negative #defines */
-#define _FP_UNUSED_BITS		1
-#define _FP_CLASS_BITS		10 /* OS Class (Windows, Linux) */
-#define _FP_VERSION_BITS	10 /* OS version (95, 98, NT, 2.4.54, 3.2) */
-#define _FP_SUBTYPE_BITS	10 /* patch level (NT SP4, SP3, ECN patch) */
-#define PF_OSFP_UNPACK(osfp, class, version, subtype) do { \
-	(class) = ((osfp) >> (_FP_VERSION_BITS+_FP_SUBTYPE_BITS)) & \
-	    ((1 << _FP_CLASS_BITS) - 1); \
-	(version) = ((osfp) >> _FP_SUBTYPE_BITS) & \
-	    ((1 << _FP_VERSION_BITS) - 1);\
-	(subtype) = (osfp) & ((1 << _FP_SUBTYPE_BITS) - 1); \
-} while(0)
-#define PF_OSFP_PACK(osfp, class, version, subtype) do { \
-	(osfp) = ((class) & ((1 << _FP_CLASS_BITS) - 1)) << (_FP_VERSION_BITS \
-	    + _FP_SUBTYPE_BITS); \
-	(osfp) |= ((version) & ((1 << _FP_VERSION_BITS) - 1)) << \
-	    _FP_SUBTYPE_BITS; \
-	(osfp) |= (subtype) & ((1 << _FP_SUBTYPE_BITS) - 1); \
-} while(0)
-
-/* the fingerprint of an OSes TCP SYN packet */
-typedef u_int64_t	pf_tcpopts_t;
-struct pf_os_fingerprint {
-	SLIST_HEAD(pf_osfp_enlist, pf_osfp_entry) fp_oses; /* list of matches */
-	pf_tcpopts_t		fp_tcpopts;	/* packed TCP options */
-	u_int16_t		fp_wsize;	/* TCP window size */
-	u_int16_t		fp_psize;	/* ip->ip_len */
-	u_int16_t		fp_mss;		/* TCP MSS */
-	u_int16_t		fp_flags;
-#define PF_OSFP_WSIZE_MOD	0x0001		/* Window modulus */
-#define PF_OSFP_WSIZE_DC	0x0002		/* Window don't care */
-#define PF_OSFP_WSIZE_MSS	0x0004		/* Window multiple of MSS */
-#define PF_OSFP_WSIZE_MTU	0x0008		/* Window multiple of MTU */
-#define PF_OSFP_PSIZE_MOD	0x0010		/* packet size modulus */
-#define PF_OSFP_PSIZE_DC	0x0020		/* packet size don't care */
-#define PF_OSFP_WSCALE		0x0040		/* TCP window scaling */
-#define PF_OSFP_WSCALE_MOD	0x0080		/* TCP window scale modulus */
-#define PF_OSFP_WSCALE_DC	0x0100		/* TCP window scale dont-care */
-#define PF_OSFP_MSS		0x0200		/* TCP MSS */
-#define PF_OSFP_MSS_MOD		0x0400		/* TCP MSS modulus */
-#define PF_OSFP_MSS_DC		0x0800		/* TCP MSS dont-care */
-#define PF_OSFP_DF		0x1000		/* IPv4 don't fragment bit */
-#define PF_OSFP_TS0		0x2000		/* Zero timestamp */
-#define PF_OSFP_INET6		0x4000		/* IPv6 */
-	u_int8_t		fp_optcnt;	/* TCP option count */
-	u_int8_t		fp_wscale;	/* TCP window scaling */
-	u_int8_t		fp_ttl;		/* IPv4 TTL */
-#define PF_OSFP_MAXTTL_OFFSET	40
-/* TCP options packing */
-#define PF_OSFP_TCPOPT_NOP	0x0		/* TCP NOP option */
-#define PF_OSFP_TCPOPT_WSCALE	0x1		/* TCP window scaling option */
-#define PF_OSFP_TCPOPT_MSS	0x2		/* TCP max segment size opt */
-#define PF_OSFP_TCPOPT_SACK	0x3		/* TCP SACK OK option */
-#define PF_OSFP_TCPOPT_TS	0x4		/* TCP timestamp option */
-#define PF_OSFP_TCPOPT_BITS	3		/* bits used by each option */
-#define PF_OSFP_MAX_OPTS \
-    (sizeof(((struct pf_os_fingerprint *)0)->fp_tcpopts) * 8) \
-    / PF_OSFP_TCPOPT_BITS
-
-	SLIST_ENTRY(pf_os_fingerprint)	fp_next;
-};
-
-struct pf_osfp_ioctl {
-	struct pf_osfp_entry	fp_os;
-	pf_tcpopts_t		fp_tcpopts;	/* packed TCP options */
-	u_int16_t		fp_wsize;	/* TCP window size */
-	u_int16_t		fp_psize;	/* ip->ip_len */
-	u_int16_t		fp_mss;		/* TCP MSS */
-	u_int16_t		fp_flags;
-	u_int8_t		fp_optcnt;	/* TCP option count */
-	u_int8_t		fp_wscale;	/* TCP window scaling */
-	u_int8_t		fp_ttl;		/* IPv4 TTL */
-
-	int			fp_getnum;	/* DIOCOSFPGET number */
-};
-
-
-union pf_rule_ptr {
-	struct pf_rule		*ptr;
-	u_int32_t		 nr;
-};
-
-#define	PF_ANCHOR_NAME_SIZE	 64
-
-struct pf_rule {
-	struct pf_rule_addr	 src;
-	struct pf_rule_addr	 dst;
-#define PF_SKIP_IFP		0
-#define PF_SKIP_DIR		1
-#define PF_SKIP_AF		2
-#define PF_SKIP_PROTO		3
-#define PF_SKIP_SRC_ADDR	4
-#define PF_SKIP_SRC_PORT	5
-#define PF_SKIP_DST_ADDR	6
-#define PF_SKIP_DST_PORT	7
-#define PF_SKIP_COUNT		8
-	union pf_rule_ptr	 skip[PF_SKIP_COUNT];
-#define PF_RULE_LABEL_SIZE	 64
-	char			 label[PF_RULE_LABEL_SIZE];
-#define PF_QNAME_SIZE		 64
-	char			 ifname[IFNAMSIZ];
-	char			 qname[PF_QNAME_SIZE];
-	char			 pqname[PF_QNAME_SIZE];
-#define	PF_TAG_NAME_SIZE	 64
-	char			 tagname[PF_TAG_NAME_SIZE];
-	char			 match_tagname[PF_TAG_NAME_SIZE];
-
-	char			 overload_tblname[PF_TABLE_NAME_SIZE];
-
-	TAILQ_ENTRY(pf_rule)	 entries;
-	struct pf_pool		 rpool;
-
-	u_int64_t		 evaluations;
-	u_int64_t		 packets[2];
-	u_int64_t		 bytes[2];
-
-	struct pfi_kif		*kif;
-	struct pf_anchor	*anchor;
-	struct pfr_ktable	*overload_tbl;
-
-	pf_osfp_t		 os_fingerprint;
-
-	int			 rtableid;
-	u_int32_t		 timeout[PFTM_MAX];
-	u_int32_t		 states_cur;
-	u_int32_t		 states_tot;
-	u_int32_t		 max_states;
-	u_int32_t		 src_nodes;
-	u_int32_t		 max_src_nodes;
-	u_int32_t		 max_src_states;
-	u_int32_t		 spare1;			/* netgraph */
-	u_int32_t		 max_src_conn;
-	struct {
-		u_int32_t		limit;
-		u_int32_t		seconds;
-	}			 max_src_conn_rate;
-	u_int32_t		 qid;
-	u_int32_t		 pqid;
-	u_int32_t		 rt_listid;
-	u_int32_t		 nr;
-	u_int32_t		 prob;
-	uid_t			 cuid;
-	pid_t			 cpid;
-
-	u_int16_t		 return_icmp;
-	u_int16_t		 return_icmp6;
-	u_int16_t		 max_mss;
-	u_int16_t		 tag;
-	u_int16_t		 match_tag;
-	u_int16_t		 spare2;			/* netgraph */
-
-	struct pf_rule_uid	 uid;
-	struct pf_rule_gid	 gid;
-
-	u_int32_t		 rule_flag;
-	u_int8_t		 action;
-	u_int8_t		 direction;
-	u_int8_t		 log;
-	u_int8_t		 logif;
-	u_int8_t		 quick;
-	u_int8_t		 ifnot;
-	u_int8_t		 match_tag_not;
-	u_int8_t		 natpass;
-
-#define PF_STATE_NORMAL		0x1
-#define PF_STATE_MODULATE	0x2
-#define PF_STATE_SYNPROXY	0x3
-	u_int8_t		 keep_state;
-	sa_family_t		 af;
-	u_int8_t		 proto;
-	u_int8_t		 type;
-	u_int8_t		 code;
-	u_int8_t		 flags;
-	u_int8_t		 flagset;
-	u_int8_t		 min_ttl;
-	u_int8_t		 allow_opts;
-	u_int8_t		 rt;
-	u_int8_t		 return_ttl;
-	u_int8_t		 tos;
-	u_int8_t		 set_tos;
-	u_int8_t		 anchor_relative;
-	u_int8_t		 anchor_wildcard;
-
-#define PF_FLUSH		0x01
-#define PF_FLUSH_GLOBAL		0x02
-	u_int8_t		 flush;
-
-	struct {
-		struct pf_addr		addr;
-		u_int16_t		port;
-	}			divert;
-};
-
-/* rule flags */
-#define	PFRULE_DROP		0x0000
-#define	PFRULE_RETURNRST	0x0001
-#define	PFRULE_FRAGMENT		0x0002
-#define	PFRULE_RETURNICMP	0x0004
-#define	PFRULE_RETURN		0x0008
-#define	PFRULE_NOSYNC		0x0010
-#define PFRULE_SRCTRACK		0x0020  /* track source states */
-#define PFRULE_RULESRCTRACK	0x0040  /* per rule */
-
-/* scrub flags */
-#define	PFRULE_NODF		0x0100
-#define	PFRULE_FRAGCROP		0x0200	/* non-buffering frag cache */
-#define	PFRULE_FRAGDROP		0x0400	/* drop funny fragments */
-#define PFRULE_RANDOMID		0x0800
-#define PFRULE_REASSEMBLE_TCP	0x1000
-#define PFRULE_SET_TOS		0x2000
-
-/* rule flags again */
-#define PFRULE_IFBOUND		0x00010000	/* if-bound */
-#define PFRULE_STATESLOPPY	0x00020000	/* sloppy state tracking */
-#define PFRULE_PFLOW		0x00040000
-
-#define PFSTATE_HIWAT		10000	/* default state table size */
-#define PFSTATE_ADAPT_START	6000	/* default adaptive timeout start */
-#define PFSTATE_ADAPT_END	12000	/* default adaptive timeout end */
-
-
-struct pf_threshold {
-	u_int32_t	limit;
-#define	PF_THRESHOLD_MULT	1000
-#define PF_THRESHOLD_MAX	0xffffffff / PF_THRESHOLD_MULT
-	u_int32_t	seconds;
-	u_int32_t	count;
-	u_int32_t	last;
-};
-
-struct pf_src_node {
-	RB_ENTRY(pf_src_node) entry;
-	struct pf_addr	 addr;
-	struct pf_addr	 raddr;
-	union pf_rule_ptr rule;
-	struct pfi_kif	*kif;
-	u_int64_t	 bytes[2];
-	u_int64_t	 packets[2];
-	u_int32_t	 states;
-	u_int32_t	 conn;
-	struct pf_threshold	conn_rate;
-	u_int32_t	 creation;
-	u_int32_t	 expire;
-	sa_family_t	 af;
-	u_int8_t	 ruletype;
-};
-
-#define PFSNODE_HIWAT		10000	/* default source node table size */
-
-struct pf_state_scrub {
-	struct timeval	pfss_last;	/* time received last packet	*/
-	u_int32_t	pfss_tsecr;	/* last echoed timestamp	*/
-	u_int32_t	pfss_tsval;	/* largest timestamp		*/
-	u_int32_t	pfss_tsval0;	/* original timestamp		*/
-	u_int16_t	pfss_flags;
-#define PFSS_TIMESTAMP	0x0001		/* modulate timestamp		*/
-#define PFSS_PAWS	0x0010		/* stricter PAWS checks		*/
-#define PFSS_PAWS_IDLED	0x0020		/* was idle too long.  no PAWS	*/
-#define PFSS_DATA_TS	0x0040		/* timestamp on data packets	*/
-#define PFSS_DATA_NOTS	0x0080		/* no timestamp on data packets	*/
-	u_int8_t	pfss_ttl;	/* stashed TTL			*/
-	u_int8_t	pad;
-	u_int32_t	pfss_ts_mod;	/* timestamp modulation		*/
-};
-
-struct pf_state_host {
-	struct pf_addr	addr;
-	u_int16_t	port;
-	u_int16_t	pad;
-};
-
-struct pf_state_peer {
-	struct pf_state_scrub	*scrub;	/* state is scrubbed		*/
-	u_int32_t	seqlo;		/* Max sequence number sent	*/
-	u_int32_t	seqhi;		/* Max the other end ACKd + win	*/
-	u_int32_t	seqdiff;	/* Sequence number modulator	*/
-	u_int16_t	max_win;	/* largest window (pre scaling)	*/
-	u_int16_t	mss;		/* Maximum segment size option	*/
-	u_int8_t	state;		/* active state level		*/
-	u_int8_t	wscale;		/* window scaling factor	*/
-	u_int8_t	tcp_est;	/* Did we reach TCPS_ESTABLISHED */
-	u_int8_t	pad[1];
-};
-
-TAILQ_HEAD(pf_state_queue, pf_state);
-
-/* keep synced with struct pf_state_key, used in RB_FIND */
-struct pf_state_key_cmp {
-	struct pf_addr	 addr[2];
-	u_int16_t	 port[2];
-	sa_family_t	 af;
-	u_int8_t	 proto;
-	u_int8_t	 pad[2];
-};
-
-struct pf_state_item {
-	TAILQ_ENTRY(pf_state_item)	 entry;
-	struct pf_state			*s;
-};
-
-TAILQ_HEAD(pf_statelisthead, pf_state_item);
-
-struct pf_state_key {
-	struct pf_addr	 addr[2];
-	u_int16_t	 port[2];
-	sa_family_t	 af;
-	u_int8_t	 proto;
-	u_int8_t	 pad[2];
-
-	RB_ENTRY(pf_state_key)	 entry;
-	struct pf_statelisthead	 states;
-	struct pf_state_key	*reverse;
-	struct inpcb		*inp;
-};
-
-/* keep synced with struct pf_state, used in RB_FIND */
-struct pf_state_cmp {
-	u_int64_t		 id;
-	u_int32_t		 creatorid;
-	u_int8_t		 direction;
-	u_int8_t		 pad[3];
-};
-
-struct pf_state {
-	u_int64_t		 id;
-	u_int32_t		 creatorid;
-	u_int8_t		 direction;
-#ifdef __FreeBSD__
-	u_int8_t		 pad[2];
-	u_int8_t		 local_flags;
-#define	PFSTATE_EXPIRING 0x01
-#else
-	u_int8_t		 pad[3];
-#endif
-
-	TAILQ_ENTRY(pf_state)	 sync_list;
-	TAILQ_ENTRY(pf_state)	 entry_list;
-	RB_ENTRY(pf_state)	 entry_id;
-	struct pf_state_peer	 src;
-	struct pf_state_peer	 dst;
-	union pf_rule_ptr	 rule;
-	union pf_rule_ptr	 anchor;
-	union pf_rule_ptr	 nat_rule;
-	struct pf_addr		 rt_addr;
-	struct pf_state_key	*key[2];	/* addresses stack and wire  */
-	struct pfi_kif		*kif;
-	struct pfi_kif		*rt_kif;
-	struct pf_src_node	*src_node;
-	struct pf_src_node	*nat_src_node;
-	u_int64_t		 packets[2];
-	u_int64_t		 bytes[2];
-	u_int32_t		 creation;
-	u_int32_t	 	 expire;
-	u_int32_t		 pfsync_time;
-	u_int16_t		 tag;
-	u_int8_t		 log;
-	u_int8_t		 state_flags;
-#define	PFSTATE_ALLOWOPTS	0x01
-#define	PFSTATE_SLOPPY		0x02
-#define	PFSTATE_PFLOW		0x04
-#define	PFSTATE_NOSYNC		0x08
-#define	PFSTATE_ACK		0x10
-	u_int8_t		 timeout;
-	u_int8_t		 sync_state; /* PFSYNC_S_x */
-
-	/* XXX */
-	u_int8_t		 sync_updates;
-	u_int8_t		_tail[3];
-};
-
-/*
- * Unified state structures for pulling states out of the kernel
- * used by pfsync(4) and the pf(4) ioctl.
- */
-struct pfsync_state_scrub {
-	u_int16_t	pfss_flags;
-	u_int8_t	pfss_ttl;	/* stashed TTL		*/
-#define PFSYNC_SCRUB_FLAG_VALID		0x01
-	u_int8_t	scrub_flag;
-	u_int32_t	pfss_ts_mod;	/* timestamp modulation	*/
-} __packed;
-
-struct pfsync_state_peer {
-	struct pfsync_state_scrub scrub;	/* state is scrubbed	*/
-	u_int32_t	seqlo;		/* Max sequence number sent	*/
-	u_int32_t	seqhi;		/* Max the other end ACKd + win	*/
-	u_int32_t	seqdiff;	/* Sequence number modulator	*/
-	u_int16_t	max_win;	/* largest window (pre scaling)	*/
-	u_int16_t	mss;		/* Maximum segment size option	*/
-	u_int8_t	state;		/* active state level		*/
-	u_int8_t	wscale;		/* window scaling factor	*/
-	u_int8_t	pad[6];
-} __packed;
-
-struct pfsync_state_key {
-	struct pf_addr	 addr[2];
-	u_int16_t	 port[2];
-};
-
-struct pfsync_state {
-	u_int32_t	 id[2];
-	char		 ifname[IFNAMSIZ];
-	struct pfsync_state_key	key[2];
-	struct pfsync_state_peer src;
-	struct pfsync_state_peer dst;
-	struct pf_addr	 rt_addr;
-	u_int32_t	 rule;
-	u_int32_t	 anchor;
-	u_int32_t	 nat_rule;
-	u_int32_t	 creation;
-	u_int32_t	 expire;
-	u_int32_t	 packets[2][2];
-	u_int32_t	 bytes[2][2];
-	u_int32_t	 creatorid;
-	sa_family_t	 af;
-	u_int8_t	 proto;
-	u_int8_t	 direction;
-#ifdef __FreeBSD__
-	u_int8_t	 local_flags;
-#define	PFSTATE_EXPIRING		0x01
-	u_int8_t	 pad;
-#endif
-	u_int8_t	 log;
-	u_int8_t	 state_flags;
-	u_int8_t	 timeout;
-	u_int8_t	 sync_flags;
-	u_int8_t	 updates;
-} __packed;
-
-#ifdef __FreeBSD__
-#ifdef _KERNEL
-/* pfsync */
-typedef int		pfsync_state_import_t(struct pfsync_state *, u_int8_t);
-typedef	void		pfsync_insert_state_t(struct pf_state *);
-typedef	void		pfsync_update_state_t(struct pf_state *);
-typedef	void		pfsync_delete_state_t(struct pf_state *);
-typedef void		pfsync_clear_states_t(u_int32_t, const char *);
-typedef int		pfsync_state_in_use_t(struct pf_state *);
-typedef int		pfsync_defer_t(struct pf_state *, struct mbuf *);
-typedef	int		pfsync_up_t(void);
-
-extern pfsync_state_import_t	*pfsync_state_import_ptr;
-extern pfsync_insert_state_t	*pfsync_insert_state_ptr;
-extern pfsync_update_state_t	*pfsync_update_state_ptr;
-extern pfsync_delete_state_t	*pfsync_delete_state_ptr;
-extern pfsync_clear_states_t	*pfsync_clear_states_ptr;
-extern pfsync_state_in_use_t	*pfsync_state_in_use_ptr;
-extern pfsync_defer_t		*pfsync_defer_ptr;
-extern pfsync_up_t		*pfsync_up_ptr;
-
-void			pfsync_state_export(struct pfsync_state *,
-			    struct pf_state *);
-
-/* pflow */
-typedef int		export_pflow_t(struct pf_state *);
-
-extern export_pflow_t		*export_pflow_ptr;
-
-/* pflog */
-struct pf_ruleset;
-struct pf_pdesc;
-typedef int pflog_packet_t(struct pfi_kif *, struct mbuf *, sa_family_t,
-    u_int8_t, u_int8_t, struct pf_rule *, struct pf_rule *,
-    struct pf_ruleset *, struct pf_pdesc *);
-
-extern pflog_packet_t		*pflog_packet_ptr;
-
-/* pf uid hack */
-VNET_DECLARE(int, debug_pfugidhack);
-#define	V_debug_pfugidhack	VNET(debug_pfugidhack)
-
-#define	V_pf_end_threads	VNET(pf_end_threads)
-#endif
-
-/* Macros to set/clear/test flags. */
-#ifdef _KERNEL
-#define	SET(t, f)	((t) |= (f))
-#define	CLR(t, f)	((t) &= ~(f))
-#define	ISSET(t, f)	((t) & (f))
-#endif
-#endif
-
-#define	PFSYNC_FLAG_SRCNODE	0x04
-#define	PFSYNC_FLAG_NATSRCNODE	0x08
-
-/* for copies to/from network byte order */
-/* ioctl interface also uses network byte order */
-#define pf_state_peer_hton(s,d) do {		\
-	(d)->seqlo = htonl((s)->seqlo);		\
-	(d)->seqhi = htonl((s)->seqhi);		\
-	(d)->seqdiff = htonl((s)->seqdiff);	\
-	(d)->max_win = htons((s)->max_win);	\
-	(d)->mss = htons((s)->mss);		\
-	(d)->state = (s)->state;		\
-	(d)->wscale = (s)->wscale;		\
-	if ((s)->scrub) {						\
-		(d)->scrub.pfss_flags = 				\
-		    htons((s)->scrub->pfss_flags & PFSS_TIMESTAMP);	\
-		(d)->scrub.pfss_ttl = (s)->scrub->pfss_ttl;		\
-		(d)->scrub.pfss_ts_mod = htonl((s)->scrub->pfss_ts_mod);\
-		(d)->scrub.scrub_flag = PFSYNC_SCRUB_FLAG_VALID;	\
-	}								\
-} while (0)
-
-#define pf_state_peer_ntoh(s,d) do {		\
-	(d)->seqlo = ntohl((s)->seqlo);		\
-	(d)->seqhi = ntohl((s)->seqhi);		\
-	(d)->seqdiff = ntohl((s)->seqdiff);	\
-	(d)->max_win = ntohs((s)->max_win);	\
-	(d)->mss = ntohs((s)->mss);		\
-	(d)->state = (s)->state;		\
-	(d)->wscale = (s)->wscale;		\
-	if ((s)->scrub.scrub_flag == PFSYNC_SCRUB_FLAG_VALID && 	\
-	    (d)->scrub != NULL) {					\
-		(d)->scrub->pfss_flags =				\
-		    ntohs((s)->scrub.pfss_flags) & PFSS_TIMESTAMP;	\
-		(d)->scrub->pfss_ttl = (s)->scrub.pfss_ttl;		\
-		(d)->scrub->pfss_ts_mod = ntohl((s)->scrub.pfss_ts_mod);\
-	}								\
-} while (0)
-
-#define pf_state_counter_hton(s,d) do {				\
-	d[0] = htonl((s>>32)&0xffffffff);			\
-	d[1] = htonl(s&0xffffffff);				\
-} while (0)
-
-#define pf_state_counter_from_pfsync(s)				\
-	(((u_int64_t)(s[0])<<32) | (u_int64_t)(s[1]))
-
-#define pf_state_counter_ntoh(s,d) do {				\
-	d = ntohl(s[0]);					\
-	d = d<<32;						\
-	d += ntohl(s[1]);					\
-} while (0)
-
-TAILQ_HEAD(pf_rulequeue, pf_rule);
-
-struct pf_anchor;
-
-struct pf_ruleset {
-	struct {
-		struct pf_rulequeue	 queues[2];
-		struct {
-			struct pf_rulequeue	*ptr;
-			struct pf_rule		**ptr_array;
-			u_int32_t		 rcount;
-			u_int32_t		 ticket;
-			int			 open;
-		}			 active, inactive;
-	}			 rules[PF_RULESET_MAX];
-	struct pf_anchor	*anchor;
-	u_int32_t		 tticket;
-	int			 tables;
-	int			 topen;
-};
-
-RB_HEAD(pf_anchor_global, pf_anchor);
-RB_HEAD(pf_anchor_node, pf_anchor);
-struct pf_anchor {
-	RB_ENTRY(pf_anchor)	 entry_global;
-	RB_ENTRY(pf_anchor)	 entry_node;
-	struct pf_anchor	*parent;
-	struct pf_anchor_node	 children;
-	char			 name[PF_ANCHOR_NAME_SIZE];
-	char			 path[MAXPATHLEN];
-	struct pf_ruleset	 ruleset;
-	int			 refcnt;	/* anchor rules */
-	int			 match;
-};
-RB_PROTOTYPE(pf_anchor_global, pf_anchor, entry_global, pf_anchor_compare);
-RB_PROTOTYPE(pf_anchor_node, pf_anchor, entry_node, pf_anchor_compare);
-
-#define PF_RESERVED_ANCHOR	"_pf"
-
-#define PFR_TFLAG_PERSIST	0x00000001
-#define PFR_TFLAG_CONST		0x00000002
-#define PFR_TFLAG_ACTIVE	0x00000004
-#define PFR_TFLAG_INACTIVE	0x00000008
-#define PFR_TFLAG_REFERENCED	0x00000010
-#define PFR_TFLAG_REFDANCHOR	0x00000020
-#define PFR_TFLAG_COUNTERS	0x00000040
-/* Adjust masks below when adding flags. */
-#define PFR_TFLAG_USRMASK	0x00000043
-#define PFR_TFLAG_SETMASK	0x0000003C
-#define PFR_TFLAG_ALLMASK	0x0000007F
-
-struct pfr_table {
-	char			 pfrt_anchor[MAXPATHLEN];
-	char			 pfrt_name[PF_TABLE_NAME_SIZE];
-	u_int32_t		 pfrt_flags;
-	u_int8_t		 pfrt_fback;
-};
-
-enum { PFR_FB_NONE, PFR_FB_MATCH, PFR_FB_ADDED, PFR_FB_DELETED,
-	PFR_FB_CHANGED, PFR_FB_CLEARED, PFR_FB_DUPLICATE,
-	PFR_FB_NOTMATCH, PFR_FB_CONFLICT, PFR_FB_NOCOUNT, PFR_FB_MAX };
-
-struct pfr_addr {
-	union {
-		struct in_addr	 _pfra_ip4addr;
-		struct in6_addr	 _pfra_ip6addr;
-	}		 pfra_u;
-	u_int8_t	 pfra_af;
-	u_int8_t	 pfra_net;
-	u_int8_t	 pfra_not;
-	u_int8_t	 pfra_fback;
-};
-#define	pfra_ip4addr	pfra_u._pfra_ip4addr
-#define	pfra_ip6addr	pfra_u._pfra_ip6addr
-
-enum { PFR_DIR_IN, PFR_DIR_OUT, PFR_DIR_MAX };
-enum { PFR_OP_BLOCK, PFR_OP_PASS, PFR_OP_ADDR_MAX, PFR_OP_TABLE_MAX };
-#define PFR_OP_XPASS	PFR_OP_ADDR_MAX
-
-struct pfr_astats {
-	struct pfr_addr	 pfras_a;
-	u_int64_t	 pfras_packets[PFR_DIR_MAX][PFR_OP_ADDR_MAX];
-	u_int64_t	 pfras_bytes[PFR_DIR_MAX][PFR_OP_ADDR_MAX];
-	long		 pfras_tzero;
-};
-
-enum { PFR_REFCNT_RULE, PFR_REFCNT_ANCHOR, PFR_REFCNT_MAX };
-
-struct pfr_tstats {
-	struct pfr_table pfrts_t;
-	u_int64_t	 pfrts_packets[PFR_DIR_MAX][PFR_OP_TABLE_MAX];
-	u_int64_t	 pfrts_bytes[PFR_DIR_MAX][PFR_OP_TABLE_MAX];
-	u_int64_t	 pfrts_match;
-	u_int64_t	 pfrts_nomatch;
-	long		 pfrts_tzero;
-	int		 pfrts_cnt;
-	int		 pfrts_refcnt[PFR_REFCNT_MAX];
-};
-#define	pfrts_name	pfrts_t.pfrt_name
-#define pfrts_flags	pfrts_t.pfrt_flags
-
-#ifndef _SOCKADDR_UNION_DEFINED
-#define	_SOCKADDR_UNION_DEFINED
-union sockaddr_union {
-	struct sockaddr		sa;
-	struct sockaddr_in	sin;
-	struct sockaddr_in6	sin6;
-};
-#endif /* _SOCKADDR_UNION_DEFINED */
-
-struct pfr_kcounters {
-	u_int64_t		 pfrkc_packets[PFR_DIR_MAX][PFR_OP_ADDR_MAX];
-	u_int64_t		 pfrkc_bytes[PFR_DIR_MAX][PFR_OP_ADDR_MAX];
-};
-
-SLIST_HEAD(pfr_kentryworkq, pfr_kentry);
-struct pfr_kentry {
-	struct radix_node	 pfrke_node[2];
-	union sockaddr_union	 pfrke_sa;
-	SLIST_ENTRY(pfr_kentry)	 pfrke_workq;
-	union {
-		
-		struct pfr_kcounters		*pfrke_counters;
-#if 0
-		struct pfr_kroute		*pfrke_route;
-#endif
-	} u;
-	long			 pfrke_tzero;
-	u_int8_t		 pfrke_af;
-	u_int8_t		 pfrke_net;
-	u_int8_t		 pfrke_not;
-	u_int8_t		 pfrke_mark;
-};
-#define pfrke_counters	u.pfrke_counters
-#define pfrke_route	u.pfrke_route
-
-
-SLIST_HEAD(pfr_ktableworkq, pfr_ktable);
-RB_HEAD(pfr_ktablehead, pfr_ktable);
-struct pfr_ktable {
-	struct pfr_tstats	 pfrkt_ts;
-	RB_ENTRY(pfr_ktable)	 pfrkt_tree;
-	SLIST_ENTRY(pfr_ktable)	 pfrkt_workq;
-	struct radix_node_head	*pfrkt_ip4;
-	struct radix_node_head	*pfrkt_ip6;
-	struct pfr_ktable	*pfrkt_shadow;
-	struct pfr_ktable	*pfrkt_root;
-	struct pf_ruleset	*pfrkt_rs;
-	long			 pfrkt_larg;
-	int			 pfrkt_nflags;
-};
-#define pfrkt_t		pfrkt_ts.pfrts_t
-#define pfrkt_name	pfrkt_t.pfrt_name
-#define pfrkt_anchor	pfrkt_t.pfrt_anchor
-#define pfrkt_ruleset	pfrkt_t.pfrt_ruleset
-#define pfrkt_flags	pfrkt_t.pfrt_flags
-#define pfrkt_cnt	pfrkt_ts.pfrts_cnt
-#define pfrkt_refcnt	pfrkt_ts.pfrts_refcnt
-#define pfrkt_packets	pfrkt_ts.pfrts_packets
-#define pfrkt_bytes	pfrkt_ts.pfrts_bytes
-#define pfrkt_match	pfrkt_ts.pfrts_match
-#define pfrkt_nomatch	pfrkt_ts.pfrts_nomatch
-#define pfrkt_tzero	pfrkt_ts.pfrts_tzero
-
-RB_HEAD(pf_state_tree, pf_state_key);
-RB_PROTOTYPE(pf_state_tree, pf_state_key, entry, pf_state_compare_key);
-
-RB_HEAD(pf_state_tree_ext_gwy, pf_state_key);
-RB_PROTOTYPE(pf_state_tree_ext_gwy, pf_state_key,
-    entry_ext_gwy, pf_state_compare_ext_gwy);
-
-RB_HEAD(pfi_ifhead, pfi_kif);
-
-/* state tables */
-#ifdef __FreeBSD__
-#ifdef _KERNEL
-VNET_DECLARE(struct pf_state_tree,	 pf_statetbl);
-#define	V_pf_statetbl			 VNET(pf_statetbl)
-#endif
-#else
-extern struct pf_state_tree	 pf_statetbl;
-#endif
-
-/* keep synced with pfi_kif, used in RB_FIND */
-struct pfi_kif_cmp {
-	char				 pfik_name[IFNAMSIZ];
-};
-
-struct pfi_kif {
-	char				 pfik_name[IFNAMSIZ];
-	RB_ENTRY(pfi_kif)		 pfik_tree;
-	u_int64_t			 pfik_packets[2][2][2];
-	u_int64_t			 pfik_bytes[2][2][2];
-	u_int32_t			 pfik_tzero;
-	int				 pfik_flags;
-	void				*pfik_ah_cookie;
-	struct ifnet			*pfik_ifp;
-	struct ifg_group		*pfik_group;
-	int				 pfik_states;
-	int				 pfik_rules;
-	TAILQ_HEAD(, pfi_dynaddr)	 pfik_dynaddrs;
-};
-
-enum pfi_kif_refs {
-	PFI_KIF_REF_NONE,
-	PFI_KIF_REF_STATE,
-	PFI_KIF_REF_RULE
-};
-
-#define PFI_IFLAG_SKIP		0x0100	/* skip filtering on interface */
-
-struct pf_pdesc {
-	struct {
-		int	 done;
-		uid_t	 uid;
-		gid_t	 gid;
-		pid_t	 pid;
-	}		 lookup;
-	u_int64_t	 tot_len;	/* Make Mickey money */
-	union {
-		struct tcphdr		*tcp;
-		struct udphdr		*udp;
-		struct icmp		*icmp;
-#ifdef INET6
-		struct icmp6_hdr	*icmp6;
-#endif /* INET6 */
-		void			*any;
-	} hdr;
-
-	struct pf_rule	*nat_rule;	/* nat/rdr rule applied to packet */
-	struct ether_header
-			*eh;
-	struct pf_addr	*src;		/* src address */
-	struct pf_addr	*dst;		/* dst address */
-	u_int16_t *sport;
-	u_int16_t *dport;
-#ifdef __FreeBSD__
-	struct pf_mtag	*pf_mtag;
-#endif
-
-	u_int32_t	 p_len;		/* total length of payload */
-
-	u_int16_t	*ip_sum;
-	u_int16_t	*proto_sum;
-	u_int16_t	 flags;		/* Let SCRUB trigger behavior in
-					 * state code. Easier than tags */
-#define PFDESC_TCP_NORM	0x0001		/* TCP shall be statefully scrubbed */
-#define PFDESC_IP_REAS	0x0002		/* IP frags would've been reassembled */
-	sa_family_t	 af;
-	u_int8_t	 proto;
-	u_int8_t	 tos;
-	u_int8_t	 dir;		/* direction */
-	u_int8_t	 sidx;		/* key index for source */
-	u_int8_t	 didx;		/* key index for destination */
-};
-
-/* flags for RDR options */
-#define PF_DPORT_RANGE	0x01		/* Dest port uses range */
-#define PF_RPORT_RANGE	0x02		/* RDR'ed port uses range */
-
-/* Reasons code for passing/dropping a packet */
-#define PFRES_MATCH	0		/* Explicit match of a rule */
-#define PFRES_BADOFF	1		/* Bad offset for pull_hdr */
-#define PFRES_FRAG	2		/* Dropping following fragment */
-#define PFRES_SHORT	3		/* Dropping short packet */
-#define PFRES_NORM	4		/* Dropping by normalizer */
-#define PFRES_MEMORY	5		/* Dropped due to lacking mem */
-#define PFRES_TS	6		/* Bad TCP Timestamp (RFC1323) */
-#define PFRES_CONGEST	7		/* Congestion (of ipintrq) */
-#define PFRES_IPOPTIONS 8		/* IP option */
-#define PFRES_PROTCKSUM 9		/* Protocol checksum invalid */
-#define PFRES_BADSTATE	10		/* State mismatch */
-#define PFRES_STATEINS	11		/* State insertion failure */
-#define PFRES_MAXSTATES	12		/* State limit */
-#define PFRES_SRCLIMIT	13		/* Source node/conn limit */
-#define PFRES_SYNPROXY	14		/* SYN proxy */
-#define PFRES_MAX	15		/* total+1 */
-
-#define PFRES_NAMES { \
-	"match", \
-	"bad-offset", \
-	"fragment", \
-	"short", \
-	"normalize", \
-	"memory", \
-	"bad-timestamp", \
-	"congestion", \
-	"ip-option", \
-	"proto-cksum", \
-	"state-mismatch", \
-	"state-insert", \
-	"state-limit", \
-	"src-limit", \
-	"synproxy", \
-	NULL \
-}
-
-/* Counters for other things we want to keep track of */
-#define LCNT_STATES		0	/* states */
-#define LCNT_SRCSTATES		1	/* max-src-states */
-#define LCNT_SRCNODES		2	/* max-src-nodes */
-#define LCNT_SRCCONN		3	/* max-src-conn */
-#define LCNT_SRCCONNRATE	4	/* max-src-conn-rate */
-#define LCNT_OVERLOAD_TABLE	5	/* entry added to overload table */
-#define LCNT_OVERLOAD_FLUSH	6	/* state entries flushed */
-#define LCNT_MAX		7	/* total+1 */
-
-#define LCNT_NAMES { \
-	"max states per rule", \
-	"max-src-states", \
-	"max-src-nodes", \
-	"max-src-conn", \
-	"max-src-conn-rate", \
-	"overload table insertion", \
-	"overload flush states", \
-	NULL \
-}
-
-/* UDP state enumeration */
-#define PFUDPS_NO_TRAFFIC	0
-#define PFUDPS_SINGLE		1
-#define PFUDPS_MULTIPLE		2
-
-#define PFUDPS_NSTATES		3	/* number of state levels */
-
-#define PFUDPS_NAMES { \
-	"NO_TRAFFIC", \
-	"SINGLE", \
-	"MULTIPLE", \
-	NULL \
-}
-
-/* Other protocol state enumeration */
-#define PFOTHERS_NO_TRAFFIC	0
-#define PFOTHERS_SINGLE		1
-#define PFOTHERS_MULTIPLE	2
-
-#define PFOTHERS_NSTATES	3	/* number of state levels */
-
-#define PFOTHERS_NAMES { \
-	"NO_TRAFFIC", \
-	"SINGLE", \
-	"MULTIPLE", \
-	NULL \
-}
-
-#define FCNT_STATE_SEARCH	0
-#define FCNT_STATE_INSERT	1
-#define FCNT_STATE_REMOVALS	2
-#define FCNT_MAX		3
-
-#define SCNT_SRC_NODE_SEARCH	0
-#define SCNT_SRC_NODE_INSERT	1
-#define SCNT_SRC_NODE_REMOVALS	2
-#define SCNT_MAX		3
-
-#define ACTION_SET(a, x) \
-	do { \
-		if ((a) != NULL) \
-			*(a) = (x); \
-	} while (0)
-
-#ifdef __FreeBSD__
-#define REASON_SET(a, x) \
-	do { \
-		if ((a) != NULL) \
-			*(a) = (x); \
-		if (x < PFRES_MAX) \
-			V_pf_status.counters[x]++; \
-	} while (0)
-#else
-#define REASON_SET(a, x) \
-	do { \
-		if ((a) != NULL) \
-			*(a) = (x); \
-		if (x < PFRES_MAX) \
-			pf_status.counters[x]++; \
-	} while (0)
-#endif
-
-struct pf_status {
-	u_int64_t	counters[PFRES_MAX];
-	u_int64_t	lcounters[LCNT_MAX];	/* limit counters */
-	u_int64_t	fcounters[FCNT_MAX];
-	u_int64_t	scounters[SCNT_MAX];
-	u_int64_t	pcounters[2][2][3];
-	u_int64_t	bcounters[2][2];
-	u_int64_t	stateid;
-	u_int32_t	running;
-	u_int32_t	states;
-	u_int32_t	src_nodes;
-	u_int32_t	since;
-	u_int32_t	debug;
-	u_int32_t	hostid;
-	char		ifname[IFNAMSIZ];
-	u_int8_t	pf_chksum[PF_MD5_DIGEST_LENGTH];
-};
-
-struct cbq_opts {
-	u_int		minburst;
-	u_int		maxburst;
-	u_int		pktsize;
-	u_int		maxpktsize;
-	u_int		ns_per_byte;
-	u_int		maxidle;
-	int		minidle;
-	u_int		offtime;
-	int		flags;
-};
-
-struct priq_opts {
-	int		flags;
-};
-
-struct hfsc_opts {
-	/* real-time service curve */
-	u_int		rtsc_m1;	/* slope of the 1st segment in bps */
-	u_int		rtsc_d;		/* the x-projection of m1 in msec */
-	u_int		rtsc_m2;	/* slope of the 2nd segment in bps */
-	/* link-sharing service curve */
-	u_int		lssc_m1;
-	u_int		lssc_d;
-	u_int		lssc_m2;
-	/* upper-limit service curve */
-	u_int		ulsc_m1;
-	u_int		ulsc_d;
-	u_int		ulsc_m2;
-	int		flags;
-};
-
-struct pf_altq {
-	char			 ifname[IFNAMSIZ];
-
-	void			*altq_disc;	/* discipline-specific state */
-	TAILQ_ENTRY(pf_altq)	 entries;
-
-	/* scheduler spec */
-	u_int8_t		 scheduler;	/* scheduler type */
-	u_int16_t		 tbrsize;	/* tokenbucket regulator size */
-	u_int32_t		 ifbandwidth;	/* interface bandwidth */
-
-	/* queue spec */
-	char			 qname[PF_QNAME_SIZE];	/* queue name */
-	char			 parent[PF_QNAME_SIZE];	/* parent name */
-	u_int32_t		 parent_qid;	/* parent queue id */
-	u_int32_t		 bandwidth;	/* queue bandwidth */
-	u_int8_t		 priority;	/* priority */
-#ifdef __FreeBSD__
-	u_int8_t		 local_flags;	/* dynamic interface */
-#define	PFALTQ_FLAG_IF_REMOVED		0x01
-#endif
-	u_int16_t		 qlimit;	/* queue size limit */
-	u_int16_t		 flags;		/* misc flags */
-	union {
-		struct cbq_opts		 cbq_opts;
-		struct priq_opts	 priq_opts;
-		struct hfsc_opts	 hfsc_opts;
-	} pq_u;
-
-	u_int32_t		 qid;		/* return value */
-};
-
-struct pf_tagname {
-	TAILQ_ENTRY(pf_tagname)	entries;
-	char			name[PF_TAG_NAME_SIZE];
-	u_int16_t		tag;
-	int			ref;
-};
-
-struct pf_divert {
-	union {
-		struct in_addr	ipv4;
-		struct in6_addr	ipv6;
-	}		addr;
-	u_int16_t	port;
-};
-
-#define PFFRAG_FRENT_HIWAT	5000	/* Number of fragment entries */
-#define PFFRAG_FRAG_HIWAT	1000	/* Number of fragmented packets */
-#define PFFRAG_FRCENT_HIWAT	50000	/* Number of fragment cache entries */
-#define PFFRAG_FRCACHE_HIWAT	10000	/* Number of fragment descriptors */
-
-#define PFR_KTABLE_HIWAT	1000	/* Number of tables */
-#define PFR_KENTRY_HIWAT	200000	/* Number of table entries */
-#define PFR_KENTRY_HIWAT_SMALL	100000	/* Number of table entries (tiny hosts) */
-
-/*
- * ioctl parameter structures
- */
-
-struct pfioc_pooladdr {
-	u_int32_t		 action;
-	u_int32_t		 ticket;
-	u_int32_t		 nr;
-	u_int32_t		 r_num;
-	u_int8_t		 r_action;
-	u_int8_t		 r_last;
-	u_int8_t		 af;
-	char			 anchor[MAXPATHLEN];
-	struct pf_pooladdr	 addr;
-};
-
-struct pfioc_rule {
-	u_int32_t	 action;
-	u_int32_t	 ticket;
-	u_int32_t	 pool_ticket;
-	u_int32_t	 nr;
-	char		 anchor[MAXPATHLEN];
-	char		 anchor_call[MAXPATHLEN];
-	struct pf_rule	 rule;
-};
-
-struct pfioc_natlook {
-	struct pf_addr	 saddr;
-	struct pf_addr	 daddr;
-	struct pf_addr	 rsaddr;
-	struct pf_addr	 rdaddr;
-	u_int16_t	 sport;
-	u_int16_t	 dport;
-	u_int16_t	 rsport;
-	u_int16_t	 rdport;
-	sa_family_t	 af;
-	u_int8_t	 proto;
-	u_int8_t	 direction;
-};
-
-struct pfioc_state {
-	struct pfsync_state	state;
-};
-
-struct pfioc_src_node_kill {
-	sa_family_t psnk_af;
-	struct pf_rule_addr psnk_src;
-	struct pf_rule_addr psnk_dst;
-	u_int		    psnk_killed;
-};
-
-struct pfioc_state_kill {
-	struct pf_state_cmp	psk_pfcmp;
-	sa_family_t		psk_af;
-	int			psk_proto;
-	struct pf_rule_addr	psk_src;
-	struct pf_rule_addr	psk_dst;
-	char			psk_ifname[IFNAMSIZ];
-	char			psk_label[PF_RULE_LABEL_SIZE];
-	u_int			psk_killed;
-};
-
-struct pfioc_states {
-	int	ps_len;
-	union {
-		caddr_t			 psu_buf;
-		struct pfsync_state	*psu_states;
-	} ps_u;
-#define ps_buf		ps_u.psu_buf
-#define ps_states	ps_u.psu_states
-};
-
-struct pfioc_src_nodes {
-	int	psn_len;
-	union {
-		caddr_t		 psu_buf;
-		struct pf_src_node	*psu_src_nodes;
-	} psn_u;
-#define psn_buf		psn_u.psu_buf
-#define psn_src_nodes	psn_u.psu_src_nodes
-};
-
-struct pfioc_if {
-	char		 ifname[IFNAMSIZ];
-};
-
-struct pfioc_tm {
-	int		 timeout;
-	int		 seconds;
-};
-
-struct pfioc_limit {
-	int		 index;
-	unsigned	 limit;
-};
-
-struct pfioc_altq {
-	u_int32_t	 action;
-	u_int32_t	 ticket;
-	u_int32_t	 nr;
-	struct pf_altq	 altq;
-};
-
-struct pfioc_qstats {
-	u_int32_t	 ticket;
-	u_int32_t	 nr;
-	void		*buf;
-	int		 nbytes;
-	u_int8_t	 scheduler;
-};
-
-struct pfioc_ruleset {
-	u_int32_t	 nr;
-	char		 path[MAXPATHLEN];
-	char		 name[PF_ANCHOR_NAME_SIZE];
-};
-
-#define PF_RULESET_ALTQ		(PF_RULESET_MAX)
-#define PF_RULESET_TABLE	(PF_RULESET_MAX+1)
-struct pfioc_trans {
-	int		 size;	/* number of elements */
-	int		 esize; /* size of each element in bytes */
-	struct pfioc_trans_e {
-		int		rs_num;
-		char		anchor[MAXPATHLEN];
-		u_int32_t	ticket;
-	}		*array;
-};
-
-#define PFR_FLAG_ATOMIC		0x00000001
-#define PFR_FLAG_DUMMY		0x00000002
-#define PFR_FLAG_FEEDBACK	0x00000004
-#define PFR_FLAG_CLSTATS	0x00000008
-#define PFR_FLAG_ADDRSTOO	0x00000010
-#define PFR_FLAG_REPLACE	0x00000020
-#define PFR_FLAG_ALLRSETS	0x00000040
-#define PFR_FLAG_ALLMASK	0x0000007F
-#ifdef _KERNEL
-#define PFR_FLAG_USERIOCTL	0x10000000
-#endif
-
-struct pfioc_table {
-	struct pfr_table	 pfrio_table;
-	void			*pfrio_buffer;
-	int			 pfrio_esize;
-	int			 pfrio_size;
-	int			 pfrio_size2;
-	int			 pfrio_nadd;
-	int			 pfrio_ndel;
-	int			 pfrio_nchange;
-	int			 pfrio_flags;
-	u_int32_t		 pfrio_ticket;
-};
-#define	pfrio_exists	pfrio_nadd
-#define	pfrio_nzero	pfrio_nadd
-#define	pfrio_nmatch	pfrio_nadd
-#define pfrio_naddr	pfrio_size2
-#define pfrio_setflag	pfrio_size2
-#define pfrio_clrflag	pfrio_nadd
-
-struct pfioc_iface {
-	char	 pfiio_name[IFNAMSIZ];
-	void	*pfiio_buffer;
-	int	 pfiio_esize;
-	int	 pfiio_size;
-	int	 pfiio_nzero;
-	int	 pfiio_flags;
-};
-
-
-/*
- * ioctl operations
- */
-
-#define DIOCSTART	_IO  ('D',  1)
-#define DIOCSTOP	_IO  ('D',  2)
-#define DIOCADDRULE	_IOWR('D',  4, struct pfioc_rule)
-#define DIOCGETRULES	_IOWR('D',  6, struct pfioc_rule)
-#define DIOCGETRULE	_IOWR('D',  7, struct pfioc_rule)
-/* XXX cut 8 - 17 */
-#define DIOCCLRSTATES	_IOWR('D', 18, struct pfioc_state_kill)
-#define DIOCGETSTATE	_IOWR('D', 19, struct pfioc_state)
-#define DIOCSETSTATUSIF _IOWR('D', 20, struct pfioc_if)
-#define DIOCGETSTATUS	_IOWR('D', 21, struct pf_status)
-#define DIOCCLRSTATUS	_IO  ('D', 22)
-#define DIOCNATLOOK	_IOWR('D', 23, struct pfioc_natlook)
-#define DIOCSETDEBUG	_IOWR('D', 24, u_int32_t)
-#define DIOCGETSTATES	_IOWR('D', 25, struct pfioc_states)
-#define DIOCCHANGERULE	_IOWR('D', 26, struct pfioc_rule)
-/* XXX cut 26 - 28 */
-#define DIOCSETTIMEOUT	_IOWR('D', 29, struct pfioc_tm)
-#define DIOCGETTIMEOUT	_IOWR('D', 30, struct pfioc_tm)
-#define DIOCADDSTATE	_IOWR('D', 37, struct pfioc_state)
-#define DIOCCLRRULECTRS	_IO  ('D', 38)
-#define DIOCGETLIMIT	_IOWR('D', 39, struct pfioc_limit)
-#define DIOCSETLIMIT	_IOWR('D', 40, struct pfioc_limit)
-#define DIOCKILLSTATES	_IOWR('D', 41, struct pfioc_state_kill)
-#define DIOCSTARTALTQ	_IO  ('D', 42)
-#define DIOCSTOPALTQ	_IO  ('D', 43)
-#define DIOCADDALTQ	_IOWR('D', 45, struct pfioc_altq)
-#define DIOCGETALTQS	_IOWR('D', 47, struct pfioc_altq)
-#define DIOCGETALTQ	_IOWR('D', 48, struct pfioc_altq)
-#define DIOCCHANGEALTQ	_IOWR('D', 49, struct pfioc_altq)
-#define DIOCGETQSTATS	_IOWR('D', 50, struct pfioc_qstats)
-#define DIOCBEGINADDRS	_IOWR('D', 51, struct pfioc_pooladdr)
-#define DIOCADDADDR	_IOWR('D', 52, struct pfioc_pooladdr)
-#define DIOCGETADDRS	_IOWR('D', 53, struct pfioc_pooladdr)
-#define DIOCGETADDR	_IOWR('D', 54, struct pfioc_pooladdr)
-#define DIOCCHANGEADDR	_IOWR('D', 55, struct pfioc_pooladdr)
-/* XXX cut 55 - 57 */
-#define	DIOCGETRULESETS	_IOWR('D', 58, struct pfioc_ruleset)
-#define	DIOCGETRULESET	_IOWR('D', 59, struct pfioc_ruleset)
-#define	DIOCRCLRTABLES	_IOWR('D', 60, struct pfioc_table)
-#define	DIOCRADDTABLES	_IOWR('D', 61, struct pfioc_table)
-#define	DIOCRDELTABLES	_IOWR('D', 62, struct pfioc_table)
-#define	DIOCRGETTABLES	_IOWR('D', 63, struct pfioc_table)
-#define	DIOCRGETTSTATS	_IOWR('D', 64, struct pfioc_table)
-#define DIOCRCLRTSTATS	_IOWR('D', 65, struct pfioc_table)
-#define	DIOCRCLRADDRS	_IOWR('D', 66, struct pfioc_table)
-#define	DIOCRADDADDRS	_IOWR('D', 67, struct pfioc_table)
-#define	DIOCRDELADDRS	_IOWR('D', 68, struct pfioc_table)
-#define	DIOCRSETADDRS	_IOWR('D', 69, struct pfioc_table)
-#define	DIOCRGETADDRS	_IOWR('D', 70, struct pfioc_table)
-#define	DIOCRGETASTATS	_IOWR('D', 71, struct pfioc_table)
-#define	DIOCRCLRASTATS	_IOWR('D', 72, struct pfioc_table)
-#define	DIOCRTSTADDRS	_IOWR('D', 73, struct pfioc_table)
-#define	DIOCRSETTFLAGS	_IOWR('D', 74, struct pfioc_table)
-#define	DIOCRINADEFINE	_IOWR('D', 77, struct pfioc_table)
-#define	DIOCOSFPFLUSH	_IO('D', 78)
-#define	DIOCOSFPADD	_IOWR('D', 79, struct pf_osfp_ioctl)
-#define	DIOCOSFPGET	_IOWR('D', 80, struct pf_osfp_ioctl)
-#define	DIOCXBEGIN	_IOWR('D', 81, struct pfioc_trans)
-#define	DIOCXCOMMIT	_IOWR('D', 82, struct pfioc_trans)
-#define	DIOCXROLLBACK	_IOWR('D', 83, struct pfioc_trans)
-#define	DIOCGETSRCNODES	_IOWR('D', 84, struct pfioc_src_nodes)
-#define	DIOCCLRSRCNODES	_IO('D', 85)
-#define	DIOCSETHOSTID	_IOWR('D', 86, u_int32_t)
-#define	DIOCIGETIFACES	_IOWR('D', 87, struct pfioc_iface)
-#define	DIOCSETIFFLAG	_IOWR('D', 89, struct pfioc_iface)
-#define	DIOCCLRIFFLAG	_IOWR('D', 90, struct pfioc_iface)
-#define	DIOCKILLSRCNODES	_IOWR('D', 91, struct pfioc_src_node_kill)
-#ifdef __FreeBSD__
-struct pf_ifspeed {
-	char			ifname[IFNAMSIZ];
-	u_int32_t		baudrate;
-};
-#define	DIOCGIFSPEED	_IOWR('D', 92, struct pf_ifspeed)
-#endif
-
-#ifdef _KERNEL
-RB_HEAD(pf_src_tree, pf_src_node);
-RB_PROTOTYPE(pf_src_tree, pf_src_node, entry, pf_src_compare);
-#ifdef __FreeBSD__
-VNET_DECLARE(struct pf_src_tree,	 tree_src_tracking);
-#define	V_tree_src_tracking		 VNET(tree_src_tracking)
-#else
-extern struct pf_src_tree tree_src_tracking;
-#endif
-
-RB_HEAD(pf_state_tree_id, pf_state);
-RB_PROTOTYPE(pf_state_tree_id, pf_state,
-    entry_id, pf_state_compare_id);
-#ifdef __FreeBSD__
-VNET_DECLARE(struct pf_state_tree_id,	 tree_id);
-#define	V_tree_id			 VNET(tree_id)
-VNET_DECLARE(struct pf_state_queue,	 state_list);
-#define	V_state_list			 VNET(state_list)
-#else
-extern struct pf_state_tree_id tree_id;
-extern struct pf_state_queue state_list;
-#endif
-
-TAILQ_HEAD(pf_poolqueue, pf_pool);
-#ifdef __FreeBSD__
-VNET_DECLARE(struct pf_poolqueue,	 pf_pools[2]);
-#define	V_pf_pools			 VNET(pf_pools)
-#else
-extern struct pf_poolqueue		  pf_pools[2];
-#endif
-TAILQ_HEAD(pf_altqqueue, pf_altq);
-#ifdef __FreeBSD__
-VNET_DECLARE(struct pf_altqqueue,	 pf_altqs[2]);
-#define	V_pf_altqs			 VNET(pf_altqs)
-VNET_DECLARE(struct pf_palist,		 pf_pabuf);
-#define	V_pf_pabuf			 VNET(pf_pabuf)
-#else
-extern struct pf_altqqueue		  pf_altqs[2];
-extern struct pf_palist			  pf_pabuf;
-#endif
-
-#ifdef __FreeBSD__
-VNET_DECLARE(u_int32_t,			 ticket_altqs_active);
-#define	V_ticket_altqs_active		 VNET(ticket_altqs_active)
-VNET_DECLARE(u_int32_t,			 ticket_altqs_inactive);
-#define	V_ticket_altqs_inactive		 VNET(ticket_altqs_inactive)
-VNET_DECLARE(int,			 altqs_inactive_open);
-#define	V_altqs_inactive_open		 VNET(altqs_inactive_open)
-VNET_DECLARE(u_int32_t,			 ticket_pabuf);
-#define	V_ticket_pabuf			 VNET(ticket_pabuf)
-VNET_DECLARE(struct pf_altqqueue *,	 pf_altqs_active);
-#define	V_pf_altqs_active		 VNET(pf_altqs_active)
-VNET_DECLARE(struct pf_altqqueue *,	 pf_altqs_inactive);
-#define	V_pf_altqs_inactive		 VNET(pf_altqs_inactive)
-VNET_DECLARE(struct pf_poolqueue *,	 pf_pools_active);
-#define	V_pf_pools_active		 VNET(pf_pools_active)
-VNET_DECLARE(struct pf_poolqueue *,	 pf_pools_inactive);
-#define	V_pf_pools_inactive		 VNET(pf_pools_inactive)
-#else
-extern u_int32_t		 ticket_altqs_active;
-extern u_int32_t		 ticket_altqs_inactive;
-extern int			 altqs_inactive_open;
-extern u_int32_t		 ticket_pabuf;
-extern struct pf_altqqueue	*pf_altqs_active;
-extern struct pf_altqqueue	*pf_altqs_inactive;
-extern struct pf_poolqueue	*pf_pools_active;
-extern struct pf_poolqueue	*pf_pools_inactive;
-#endif
-extern int			 pf_tbladdr_setup(struct pf_ruleset *,
-				    struct pf_addr_wrap *);
-extern void			 pf_tbladdr_remove(struct pf_addr_wrap *);
-extern void			 pf_tbladdr_copyout(struct pf_addr_wrap *);
-extern void			 pf_calc_skip_steps(struct pf_rulequeue *);
-#ifdef __FreeBSD__
-#ifdef ALTQ
-extern	void			 pf_altq_ifnet_event(struct ifnet *, int);
-#endif
-VNET_DECLARE(uma_zone_t,		 pf_src_tree_pl);
-#define	V_pf_src_tree_pl		 VNET(pf_src_tree_pl)
-VNET_DECLARE(uma_zone_t,		 pf_rule_pl);
-#define	V_pf_rule_pl			 VNET(pf_rule_pl)
-VNET_DECLARE(uma_zone_t,		 pf_state_pl);
-#define	V_pf_state_pl			 VNET(pf_state_pl)
-VNET_DECLARE(uma_zone_t,		 pf_state_key_pl);
-#define	V_pf_state_key_pl		 VNET(pf_state_key_pl)
-VNET_DECLARE(uma_zone_t,		 pf_state_item_pl);
-#define	V_pf_state_item_pl		 VNET(pf_state_item_pl)
-VNET_DECLARE(uma_zone_t,		 pf_altq_pl);
-#define	V_pf_altq_pl			 VNET(pf_altq_pl)
-VNET_DECLARE(uma_zone_t,		 pf_pooladdr_pl);
-#define	V_pf_pooladdr_pl		 VNET(pf_pooladdr_pl)
-VNET_DECLARE(uma_zone_t,		 pfr_ktable_pl);
-#define	V_pfr_ktable_pl			 VNET(pfr_ktable_pl)
-VNET_DECLARE(uma_zone_t,		 pfr_kentry_pl);
-#define	V_pfr_kentry_pl			 VNET(pfr_kentry_pl)
-VNET_DECLARE(uma_zone_t,		 pfr_kcounters_pl);
-#define	V_pfr_kcounters_pl		 VNET(pfr_kcounters_pl)
-VNET_DECLARE(uma_zone_t,		 pf_cache_pl);
-#define	V_pf_cache_pl			 VNET(pf_cache_pl)
-VNET_DECLARE(uma_zone_t,		 pf_cent_pl);
-#define	V_pf_cent_pl			 VNET(pf_cent_pl)
-VNET_DECLARE(uma_zone_t,		 pf_state_scrub_pl);
-#define	V_pf_state_scrub_pl		 VNET(pf_state_scrub_pl)
-VNET_DECLARE(uma_zone_t,		 pfi_addr_pl);
-#define	V_pfi_addr_pl			 VNET(pfi_addr_pl)
-#else
-extern struct pool		 pf_src_tree_pl, pf_rule_pl;
-extern struct pool		 pf_state_pl, pf_state_key_pl, pf_state_item_pl,
-				    pf_altq_pl, pf_pooladdr_pl;
-extern struct pool		 pf_state_scrub_pl;
-#endif
-extern void			 pf_purge_thread(void *);
-#ifdef __FreeBSD__
-extern int			 pf_purge_expired_src_nodes(int);
-extern int			 pf_purge_expired_states(u_int32_t , int);
-#else
-extern void			 pf_purge_expired_src_nodes(int);
-extern void			 pf_purge_expired_states(u_int32_t);
-#endif
-extern void			 pf_unlink_state(struct pf_state *);
-extern void			 pf_free_state(struct pf_state *);
-extern int			 pf_state_insert(struct pfi_kif *,
-				    struct pf_state_key *,
-				    struct pf_state_key *,
-				    struct pf_state *);
-extern int			 pf_insert_src_node(struct pf_src_node **,
-				    struct pf_rule *, struct pf_addr *,
-				    sa_family_t);
-void				 pf_src_tree_remove_state(struct pf_state *);
-extern struct pf_state		*pf_find_state_byid(struct pf_state_cmp *);
-extern struct pf_state		*pf_find_state_all(struct pf_state_key_cmp *,
-				    u_int, int *);
-extern void			 pf_print_state(struct pf_state *);
-extern void			 pf_print_flags(u_int8_t);
-extern u_int16_t		 pf_cksum_fixup(u_int16_t, u_int16_t, u_int16_t,
-				    u_int8_t);
-
-#ifdef __FreeBSD__
-VNET_DECLARE(struct ifnet *,		 sync_ifp);
-#define	V_sync_ifp		 	 VNET(sync_ifp);
-VNET_DECLARE(struct pf_rule,		 pf_default_rule);
-#define	V_pf_default_rule		  VNET(pf_default_rule)
-#else
-extern struct ifnet		*sync_ifp;
-extern struct pf_rule		 pf_default_rule;
-#endif
-extern void			 pf_addrcpy(struct pf_addr *, struct pf_addr *,
-				    u_int8_t);
-void				 pf_rm_rule(struct pf_rulequeue *,
-				    struct pf_rule *);
-#ifndef __FreeBSD__
-struct pf_divert		*pf_find_divert(struct mbuf *);
-#endif
-
-#ifdef INET
-#ifdef __FreeBSD__
-int	pf_test(int, struct ifnet *, struct mbuf **, struct ether_header *,
-    struct inpcb *);
-#else
-int	pf_test(int, struct ifnet *, struct mbuf **, struct ether_header *);
-#endif
-#endif /* INET */
-
-#ifdef INET6
-#ifdef __FreeBSD__
-int	pf_test6(int, struct ifnet *, struct mbuf **, struct ether_header *,
-    struct inpcb *);
-#else
-int	pf_test6(int, struct ifnet *, struct mbuf **, struct ether_header *);
-#endif
-void	pf_poolmask(struct pf_addr *, struct pf_addr*,
-	    struct pf_addr *, struct pf_addr *, u_int8_t);
-void	pf_addr_inc(struct pf_addr *, sa_family_t);
-#endif /* INET6 */
-
-#ifdef __FreeBSD__
-u_int32_t	pf_new_isn(struct pf_state *);
-#endif
-void   *pf_pull_hdr(struct mbuf *, int, void *, int, u_short *, u_short *,
-	    sa_family_t);
-void	pf_change_a(void *, u_int16_t *, u_int32_t, u_int8_t);
-int	pflog_packet(struct pfi_kif *, struct mbuf *, sa_family_t, u_int8_t,
-	    u_int8_t, struct pf_rule *, struct pf_rule *, struct pf_ruleset *,
-	    struct pf_pdesc *);
-void	pf_send_deferred_syn(struct pf_state *);
-int	pf_match_addr(u_int8_t, struct pf_addr *, struct pf_addr *,
-	    struct pf_addr *, sa_family_t);
-int	pf_match_addr_range(struct pf_addr *, struct pf_addr *,
-	    struct pf_addr *, sa_family_t);
-int	pf_match(u_int8_t, u_int32_t, u_int32_t, u_int32_t);
-int	pf_match_port(u_int8_t, u_int16_t, u_int16_t, u_int16_t);
-int	pf_match_uid(u_int8_t, uid_t, uid_t, uid_t);
-int	pf_match_gid(u_int8_t, gid_t, gid_t, gid_t);
-
-void	pf_normalize_init(void);
-int	pf_normalize_ip(struct mbuf **, int, struct pfi_kif *, u_short *,
-	    struct pf_pdesc *);
-int	pf_normalize_ip6(struct mbuf **, int, struct pfi_kif *, u_short *,
-	    struct pf_pdesc *);
-int	pf_normalize_tcp(int, struct pfi_kif *, struct mbuf *, int, int, void *,
-	    struct pf_pdesc *);
-void	pf_normalize_tcp_cleanup(struct pf_state *);
-int	pf_normalize_tcp_init(struct mbuf *, int, struct pf_pdesc *,
-	    struct tcphdr *, struct pf_state_peer *, struct pf_state_peer *);
-int	pf_normalize_tcp_stateful(struct mbuf *, int, struct pf_pdesc *,
-	    u_short *, struct tcphdr *, struct pf_state *,
-	    struct pf_state_peer *, struct pf_state_peer *, int *);
-u_int32_t
-	pf_state_expires(const struct pf_state *);
-void	pf_purge_expired_fragments(void);
-int	pf_routable(struct pf_addr *addr, sa_family_t af, struct pfi_kif *,
-	    int);
-int	pf_rtlabel_match(struct pf_addr *, sa_family_t, struct pf_addr_wrap *,
-	    int);
-#ifdef __FreeBSD__
-int	pf_socket_lookup(int, struct pf_pdesc *,  struct inpcb *);
-#else
-int	pf_socket_lookup(int, struct pf_pdesc *);
-#endif
-struct pf_state_key *pf_alloc_state_key(int);
-void	pf_pkt_addr_changed(struct mbuf *);
-int	pf_state_key_attach(struct pf_state_key *, struct pf_state *, int);
-void	pfr_initialize(void);
-int	pfr_match_addr(struct pfr_ktable *, struct pf_addr *, sa_family_t);
-void	pfr_update_stats(struct pfr_ktable *, struct pf_addr *, sa_family_t,
-	    u_int64_t, int, int, int);
-int	pfr_pool_get(struct pfr_ktable *, int *, struct pf_addr *,
-	    struct pf_addr **, struct pf_addr **, sa_family_t);
-void	pfr_dynaddr_update(struct pfr_ktable *, struct pfi_dynaddr *);
-struct pfr_ktable *
-	pfr_attach_table(struct pf_ruleset *, char *, int);
-void	pfr_detach_table(struct pfr_ktable *);
-int	pfr_clr_tables(struct pfr_table *, int *, int);
-int	pfr_add_tables(struct pfr_table *, int, int *, int);
-int	pfr_del_tables(struct pfr_table *, int, int *, int);
-int	pfr_get_tables(struct pfr_table *, struct pfr_table *, int *, int);
-int	pfr_get_tstats(struct pfr_table *, struct pfr_tstats *, int *, int);
-int	pfr_clr_tstats(struct pfr_table *, int, int *, int);
-int	pfr_set_tflags(struct pfr_table *, int, int, int, int *, int *, int);
-int	pfr_clr_addrs(struct pfr_table *, int *, int);
-int	pfr_insert_kentry(struct pfr_ktable *, struct pfr_addr *, long);
-int	pfr_add_addrs(struct pfr_table *, struct pfr_addr *, int, int *,
-	    int);
-int	pfr_del_addrs(struct pfr_table *, struct pfr_addr *, int, int *,
-	    int);
-int	pfr_set_addrs(struct pfr_table *, struct pfr_addr *, int, int *,
-	    int *, int *, int *, int, u_int32_t);
-int	pfr_get_addrs(struct pfr_table *, struct pfr_addr *, int *, int);
-int	pfr_get_astats(struct pfr_table *, struct pfr_astats *, int *, int);
-int	pfr_clr_astats(struct pfr_table *, struct pfr_addr *, int, int *,
-	    int);
-int	pfr_tst_addrs(struct pfr_table *, struct pfr_addr *, int, int *,
-	    int);
-int	pfr_ina_begin(struct pfr_table *, u_int32_t *, int *, int);
-int	pfr_ina_rollback(struct pfr_table *, u_int32_t, int *, int);
-int	pfr_ina_commit(struct pfr_table *, u_int32_t, int *, int *, int);
-int	pfr_ina_define(struct pfr_table *, struct pfr_addr *, int, int *,
-	    int *, u_int32_t, int);
-
-#ifdef __FreeBSD__
-VNET_DECLARE(struct pfi_kif *,		 pfi_all);
-#define	V_pfi_all	 		 VNET(pfi_all)
-#else
-extern struct pfi_kif		*pfi_all;
-#endif
-
-void		 pfi_initialize(void);
-#ifdef __FreeBSD__
-void		 pfi_cleanup(void);
-#endif
-struct pfi_kif	*pfi_kif_get(const char *);
-void		 pfi_kif_ref(struct pfi_kif *, enum pfi_kif_refs);
-void		 pfi_kif_unref(struct pfi_kif *, enum pfi_kif_refs);
-int		 pfi_kif_match(struct pfi_kif *, struct pfi_kif *);
-void		 pfi_attach_ifnet(struct ifnet *);
-void		 pfi_detach_ifnet(struct ifnet *);
-void		 pfi_attach_ifgroup(struct ifg_group *);
-void		 pfi_detach_ifgroup(struct ifg_group *);
-void		 pfi_group_change(const char *);
-int		 pfi_match_addr(struct pfi_dynaddr *, struct pf_addr *,
-		    sa_family_t);
-int		 pfi_dynaddr_setup(struct pf_addr_wrap *, sa_family_t);
-void		 pfi_dynaddr_remove(struct pf_addr_wrap *);
-void		 pfi_dynaddr_copyout(struct pf_addr_wrap *);
-void		 pfi_update_status(const char *, struct pf_status *);
-int		 pfi_get_ifaces(const char *, struct pfi_kif *, int *);
-int		 pfi_set_flags(const char *, int);
-int		 pfi_clear_flags(const char *, int);
-
-#ifdef __FreeBSD__
-int		 pf_match_tag(struct mbuf *, struct pf_rule *, int *,
-		    struct pf_mtag *);
-#else
-int		 pf_match_tag(struct mbuf *, struct pf_rule *, int *);
-#endif
-u_int16_t	 pf_tagname2tag(char *);
-void		 pf_tag2tagname(u_int16_t, char *);
-void		 pf_tag_ref(u_int16_t);
-void		 pf_tag_unref(u_int16_t);
-#ifdef __FreeBSD__
-int		 pf_tag_packet(struct mbuf *, int, int, struct pf_mtag *);
-#else
-int		 pf_tag_packet(struct mbuf *, int, int);
-#endif
-u_int32_t	 pf_qname2qid(char *);
-void		 pf_qid2qname(u_int32_t, char *);
-void		 pf_qid_unref(u_int32_t);
-
-#ifdef __FreeBSD__
-VNET_DECLARE(struct pf_status,		 pf_status);
-#define	V_pf_status			 VNET(pf_status)
-#else
-extern struct pf_status	pf_status;
-#endif
-
-#ifdef __FreeBSD__
-VNET_DECLARE(uma_zone_t,		 pf_frent_pl);
-#define	V_pf_frent_pl			 VNET(pf_frent_pl)
-VNET_DECLARE(uma_zone_t,		 pf_frag_pl);
-#define	V_pf_frag_pl			 VNET(pf_frag_pl)
-VNET_DECLARE(struct sx,			 pf_consistency_lock);
-#define	V_pf_consistency_lock		 VNET(pf_consistency_lock)
-#else
-extern struct pool	pf_frent_pl, pf_frag_pl;
-extern struct rwlock	pf_consistency_lock;
-#endif
-
-struct pf_pool_limit {
-	void		*pp;
-	unsigned	 limit;
-};
-#ifdef __FreeBSD__
-VNET_DECLARE(struct pf_pool_limit,		 pf_pool_limits[PF_LIMIT_MAX]);
-#define	V_pf_pool_limits			 VNET(pf_pool_limits)
-#else
-extern struct pf_pool_limit	pf_pool_limits[PF_LIMIT_MAX];
-#endif
-
-#ifdef __FreeBSD__
-struct pf_frent {
-	LIST_ENTRY(pf_frent) fr_next;
-	struct ip *fr_ip;
-	struct mbuf *fr_m;
-};
-
-struct pf_frcache {
-	LIST_ENTRY(pf_frcache) fr_next;
-	uint16_t		fr_off;
-	uint16_t		fr_end;
-};
-
-struct pf_fragment {
-	RB_ENTRY(pf_fragment) fr_entry;
-	TAILQ_ENTRY(pf_fragment) frag_next;
-	struct in_addr	fr_src;
-	struct in_addr	fr_dst;
-	u_int8_t	fr_p;		/* protocol of this fragment */
-	u_int8_t	fr_flags;	/* status flags */
-	u_int16_t	fr_id;		/* fragment id for reassemble */
-	u_int16_t	fr_max;		/* fragment data max */
-	u_int32_t	fr_timeout;
-#define	fr_queue	fr_u.fru_queue
-#define	fr_cache	fr_u.fru_cache
-	union {
-		LIST_HEAD(pf_fragq, pf_frent) fru_queue;	/* buffering */
-		LIST_HEAD(pf_cacheq, pf_frcache) fru_cache;	/* non-buf */
-	} fr_u;
-};
-#endif /* (__FreeBSD__) */
-
-#endif /* _KERNEL */
-
-#ifdef __FreeBSD__
-#ifdef _KERNEL
-VNET_DECLARE(struct pf_anchor_global,		 pf_anchors);
-#define	V_pf_anchors				 VNET(pf_anchors)
-VNET_DECLARE(struct pf_anchor,			 pf_main_anchor);
-#define	V_pf_main_anchor			 VNET(pf_main_anchor)
-#define pf_main_ruleset	V_pf_main_anchor.ruleset
-#endif
-#else
-extern struct pf_anchor_global	pf_anchors;
-extern struct pf_anchor		pf_main_anchor;
-#define pf_main_ruleset	pf_main_anchor.ruleset
-#endif
-
-/* these ruleset functions can be linked into userland programs (pfctl) */
-int			 pf_get_ruleset_number(u_int8_t);
-void			 pf_init_ruleset(struct pf_ruleset *);
-int			 pf_anchor_setup(struct pf_rule *,
-			    const struct pf_ruleset *, const char *);
-int			 pf_anchor_copyout(const struct pf_ruleset *,
-			    const struct pf_rule *, struct pfioc_rule *);
-void			 pf_anchor_remove(struct pf_rule *);
-void			 pf_remove_if_empty_ruleset(struct pf_ruleset *);
-struct pf_anchor	*pf_find_anchor(const char *);
-struct pf_ruleset	*pf_find_ruleset(const char *);
-struct pf_ruleset	*pf_find_or_create_ruleset(const char *);
-void			 pf_rs_initialize(void);
-
-#ifndef __FreeBSD__
-#ifdef _KERNEL
-int			 pf_anchor_copyout(const struct pf_ruleset *,
-			    const struct pf_rule *, struct pfioc_rule *);
-void			 pf_anchor_remove(struct pf_rule *);
-
-#endif /* _KERNEL */
-#endif
-
-/* The fingerprint functions can be linked into userland programs (tcpdump) */
-int	pf_osfp_add(struct pf_osfp_ioctl *);
-#ifdef _KERNEL
-struct pf_osfp_enlist *
-	pf_osfp_fingerprint(struct pf_pdesc *, struct mbuf *, int,
-	    const struct tcphdr *);
-#endif /* _KERNEL */
-struct pf_osfp_enlist *
-	pf_osfp_fingerprint_hdr(const struct ip *, const struct ip6_hdr *,
-	    const struct tcphdr *);
-void	pf_osfp_flush(void);
-int	pf_osfp_get(struct pf_osfp_ioctl *);
-#ifdef __FreeBSD__
-int	pf_osfp_initialize(void);
-void	pf_osfp_cleanup(void);
-#else
-void	pf_osfp_initialize(void);
-#endif
-int	pf_osfp_match(struct pf_osfp_enlist *, pf_osfp_t);
-struct pf_os_fingerprint *
-	pf_osfp_validate(void);
-
-#ifdef _KERNEL
-void			 pf_print_host(struct pf_addr *, u_int16_t, u_int8_t);
-
-void			 pf_step_into_anchor(int *, struct pf_ruleset **, int,
-			    struct pf_rule **, struct pf_rule **, int *);
-int			 pf_step_out_of_anchor(int *, struct pf_ruleset **,
-			    int, struct pf_rule **, struct pf_rule **,
-			    int *);
-
-int			 pf_map_addr(u_int8_t, struct pf_rule *,
-			    struct pf_addr *, struct pf_addr *,
-			    struct pf_addr *, struct pf_src_node **);
-struct pf_rule		*pf_get_translation(struct pf_pdesc *, struct mbuf *,
-			    int, int, struct pfi_kif *, struct pf_src_node **,
-			    struct pf_state_key **, struct pf_state_key **,
-			    struct pf_state_key **, struct pf_state_key **,
-			    struct pf_addr *, struct pf_addr *,
-			    u_int16_t, u_int16_t);
-
-int			 pf_state_key_setup(struct pf_pdesc *, struct pf_rule *,
-			    struct pf_state_key **, struct pf_state_key **,
-			    struct pf_state_key **, struct pf_state_key **,
-			    struct pf_addr *, struct pf_addr *,
-			    u_int16_t, u_int16_t);
-#endif /* _KERNEL */
-
-
-#endif /* _NET_PFVAR_H_ */
diff --git a/sys/contrib/pf/netinet/in4_cksum.c b/sys/contrib/pf/netinet/in4_cksum.c
deleted file mode 100644
index bf25baf97a0a..000000000000
--- a/sys/contrib/pf/netinet/in4_cksum.c
+++ /dev/null
@@ -1,120 +0,0 @@
-/*	$FreeBSD$	*/
-/*	$OpenBSD: in4_cksum.c,v 1.7 2003/06/02 23:28:13 millert Exp $	*/
-/*	$KAME: in4_cksum.c,v 1.10 2001/11/30 10:06:15 itojun Exp $	*/
-/*	$NetBSD: in_cksum.c,v 1.13 1996/10/13 02:03:03 christos Exp $	*/
-
-/*
- * Copyright (C) 1999 WIDE Project.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-/*
- * Copyright (c) 1988, 1992, 1993
- *	The Regents of the University of California.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- *	@(#)in_cksum.c	8.1 (Berkeley) 6/10/93
- */
-
-#include <sys/param.h>
-#include <sys/systm.h>
-#include <sys/mbuf.h>
-
-#include <netinet/in.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#include <netinet/ip_var.h>
-
-#include <machine/in_cksum.h>
-
-#define ADDCARRY(x)  (x > 65535 ? x -= 65535 : x)
-#define REDUCE {l_util.l = sum; sum = l_util.s[0] + l_util.s[1]; (void)ADDCARRY(sum);}
-
-int in4_cksum(struct mbuf *, u_int8_t, int, int);
-
-int
-in4_cksum(struct mbuf *m, u_int8_t nxt, int off, int len)
-{
-	union {
-		struct ipovly ipov;
-		u_int16_t w[10];
-	} u;
-	union {
-		u_int16_t s[2];
-		u_int32_t l;
-	} l_util;
-
-	u_int16_t *w;
-	int psum;
-	int sum = 0;
-
-	if (nxt != 0) {
-		/* pseudo header */
-		if (off < sizeof(struct ipovly))
-			panic("in4_cksum: offset too short");
-		if (m->m_len < sizeof(struct ip))
-			panic("in4_cksum: bad mbuf chain");
-		bzero(&u.ipov, sizeof(u.ipov));
-		u.ipov.ih_len = htons(len);
-		u.ipov.ih_pr = nxt;
-		u.ipov.ih_src = mtod(m, struct ip *)->ip_src;
-		u.ipov.ih_dst = mtod(m, struct ip *)->ip_dst;
-		w = u.w;
-		/* assumes sizeof(ipov) == 20 */
-		sum += w[0]; sum += w[1]; sum += w[2]; sum += w[3]; sum += w[4];
-		sum += w[5]; sum += w[6]; sum += w[7]; sum += w[8]; sum += w[9];
-	}
-
-	psum = in_cksum_skip(m, len + off, off);
-	psum = ~psum & 0xffff;
-	sum += psum;
-	REDUCE;
-	return (~sum & 0xffff);
-}
diff --git a/sys/netinet/ipfw/dn_heap.c b/sys/netinet/ipfw/dn_heap.c
deleted file mode 100644
index 3bdfd9def288..000000000000
--- a/sys/netinet/ipfw/dn_heap.c
+++ /dev/null
@@ -1,552 +0,0 @@
-/*-
- * Copyright (c) 1998-2002,2010 Luigi Rizzo, Universita` di Pisa
- * All rights reserved
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-/*
- * Binary heap and hash tables, used in dummynet
- *
- * $FreeBSD$
- */
-
-#include <sys/cdefs.h>
-#include <sys/param.h>
-#ifdef _KERNEL
-__FBSDID("$FreeBSD$");
-#include <sys/systm.h>
-#include <sys/malloc.h>
-#include <sys/kernel.h>
-#include <netinet/ipfw/dn_heap.h>
-#ifndef log
-#define log(x, arg...)
-#endif
-
-#else /* !_KERNEL */
-
-#include <stdio.h>
-#include <dn_test.h>
-#include <strings.h>
-#include <stdlib.h>
-
-#include  "dn_heap.h"
-#define log(x, arg...)	fprintf(stderr, ## arg)
-#define panic(x...)	fprintf(stderr, ## x), exit(1)
-#define MALLOC_DEFINE(a, b, c)
-static void *my_malloc(int s) {	return malloc(s); }
-static void my_free(void *p) {	free(p); }
-#define malloc(s, t, w)	my_malloc(s)
-#define free(p, t)	my_free(p)
-#endif /* !_KERNEL */
-
-static MALLOC_DEFINE(M_DN_HEAP, "dummynet", "dummynet heap");
-
-/*
- * Heap management functions.
- *
- * In the heap, first node is element 0. Children of i are 2i+1 and 2i+2.
- * Some macros help finding parent/children so we can optimize them.
- *
- * heap_init() is called to expand the heap when needed.
- * Increment size in blocks of 16 entries.
- * Returns 1 on error, 0 on success
- */
-#define HEAP_FATHER(x) ( ( (x) - 1 ) / 2 )
-#define HEAP_LEFT(x) ( (x)+(x) + 1 )
-#define	HEAP_SWAP(a, b, buffer) { buffer = a ; a = b ; b = buffer ; }
-#define HEAP_INCREMENT	15
-
-static int
-heap_resize(struct dn_heap *h, unsigned int new_size)
-{
-	struct dn_heap_entry *p;
-
-	if (h->size >= new_size )	/* have enough room */
-		return 0;
-#if 1  /* round to the next power of 2 */
-	new_size |= new_size >> 1;
-	new_size |= new_size >> 2;
-	new_size |= new_size >> 4;
-	new_size |= new_size >> 8;
-	new_size |= new_size >> 16;
-#else
-	new_size = (new_size + HEAP_INCREMENT ) & ~HEAP_INCREMENT;
-#endif
-	p = malloc(new_size * sizeof(*p), M_DN_HEAP, M_NOWAIT);
-	if (p == NULL) {
-		printf("--- %s, resize %d failed\n", __func__, new_size );
-		return 1; /* error */
-	}
-	if (h->size > 0) {
-		bcopy(h->p, p, h->size * sizeof(*p) );
-		free(h->p, M_DN_HEAP);
-	}
-	h->p = p;
-	h->size = new_size;
-	return 0;
-}
-
-int
-heap_init(struct dn_heap *h, int size, int ofs)
-{
-	if (heap_resize(h, size))
-		return 1;
-	h->elements = 0;
-	h->ofs = ofs;
-	return 0;
-}
-
-/*
- * Insert element in heap. Normally, p != NULL, we insert p in
- * a new position and bubble up. If p == NULL, then the element is
- * already in place, and key is the position where to start the
- * bubble-up.
- * Returns 1 on failure (cannot allocate new heap entry)
- *
- * If ofs > 0 the position (index, int) of the element in the heap is
- * also stored in the element itself at the given offset in bytes.
- */
-#define SET_OFFSET(h, i) do {					\
-	if (h->ofs > 0)						\
-	    *((int32_t *)((char *)(h->p[i].object) + h->ofs)) = i;	\
-	} while (0)
-/*
- * RESET_OFFSET is used for sanity checks. It sets ofs
- * to an invalid value.
- */
-#define RESET_OFFSET(h, i) do {					\
-	if (h->ofs > 0)						\
-	    *((int32_t *)((char *)(h->p[i].object) + h->ofs)) = -16;	\
-	} while (0)
-
-int
-heap_insert(struct dn_heap *h, uint64_t key1, void *p)
-{
-	int son = h->elements;
-
-	//log("%s key %llu p %p\n", __FUNCTION__, key1, p);
-	if (p == NULL) { /* data already there, set starting point */
-		son = key1;
-	} else { /* insert new element at the end, possibly resize */
-		son = h->elements;
-		if (son == h->size) /* need resize... */
-			// XXX expand by 16 or so
-			if (heap_resize(h, h->elements+16) )
-				return 1; /* failure... */
-		h->p[son].object = p;
-		h->p[son].key = key1;
-		h->elements++;
-	}
-	/* make sure that son >= father along the path */
-	while (son > 0) {
-		int father = HEAP_FATHER(son);
-		struct dn_heap_entry tmp;
-
-		if (DN_KEY_LT( h->p[father].key, h->p[son].key ) )
-			break; /* found right position */
-		/* son smaller than father, swap and repeat */
-		HEAP_SWAP(h->p[son], h->p[father], tmp);
-		SET_OFFSET(h, son);
-		son = father;
-	}
-	SET_OFFSET(h, son);
-	return 0;
-}
-
-/*
- * remove top element from heap, or obj if obj != NULL
- */
-void
-heap_extract(struct dn_heap *h, void *obj)
-{
-	int child, father, max = h->elements - 1;
-
-	if (max < 0) {
-		printf("--- %s: empty heap 0x%p\n", __FUNCTION__, h);
-		return;
-	}
-	if (obj == NULL)
-		father = 0; /* default: move up smallest child */
-	else { /* extract specific element, index is at offset */
-		if (h->ofs <= 0)
-			panic("%s: extract from middle not set on %p\n",
-				__FUNCTION__, h);
-		father = *((int *)((char *)obj + h->ofs));
-		if (father < 0 || father >= h->elements) {
-			panic("%s: father %d out of bound 0..%d\n",
-				__FUNCTION__, father, h->elements);
-		}
-	}
-	/*
-	 * below, father is the index of the empty element, which
-	 * we replace at each step with the smallest child until we
-	 * reach the bottom level.
-	 */
-	// XXX why removing RESET_OFFSET increases runtime by 10% ?
-	RESET_OFFSET(h, father);
-	while ( (child = HEAP_LEFT(father)) <= max ) {
-		if (child != max &&
-		    DN_KEY_LT(h->p[child+1].key, h->p[child].key) )
-			child++; /* take right child, otherwise left */
-		h->p[father] = h->p[child];
-		SET_OFFSET(h, father);
-		father = child;
-	}
-	h->elements--;
-	if (father != max) {
-		/*
-		 * Fill hole with last entry and bubble up,
-		 * reusing the insert code
-		 */
-		h->p[father] = h->p[max];
-		heap_insert(h, father, NULL);
-	}
-}
-
-#if 0
-/*
- * change object position and update references
- * XXX this one is never used!
- */
-static void
-heap_move(struct dn_heap *h, uint64_t new_key, void *object)
-{
-	int temp, i, max = h->elements-1;
-	struct dn_heap_entry *p, buf;
-
-	if (h->ofs <= 0)
-		panic("cannot move items on this heap");
-	p = h->p;	/* shortcut */
-
-	i = *((int *)((char *)object + h->ofs));
-	if (DN_KEY_LT(new_key, p[i].key) ) { /* must move up */
-		p[i].key = new_key;
-		for (; i>0 &&
-		    DN_KEY_LT(new_key, p[(temp = HEAP_FATHER(i))].key);
-		    i = temp ) { /* bubble up */
-			HEAP_SWAP(p[i], p[temp], buf);
-			SET_OFFSET(h, i);
-		}
-	} else {		/* must move down */
-		p[i].key = new_key;
-		while ( (temp = HEAP_LEFT(i)) <= max ) {
-			/* found left child */
-			if (temp != max &&
-			    DN_KEY_LT(p[temp+1].key, p[temp].key))
-				temp++; /* select child with min key */
-			if (DN_KEY_LT(>p[temp].key, new_key)) {
-				/* go down */
-				HEAP_SWAP(p[i], p[temp], buf);
-				SET_OFFSET(h, i);
-			} else
-				break;
-			i = temp;
-		}
-	}
-	SET_OFFSET(h, i);
-}
-#endif /* heap_move, unused */
-
-/*
- * heapify() will reorganize data inside an array to maintain the
- * heap property. It is needed when we delete a bunch of entries.
- */
-static void
-heapify(struct dn_heap *h)
-{
-	int i;
-
-	for (i = 0; i < h->elements; i++ )
-		heap_insert(h, i , NULL);
-}
-
-int
-heap_scan(struct dn_heap *h, int (*fn)(void *, uintptr_t),
-	uintptr_t arg)
-{
-	int i, ret, found;
-
-	for (i = found = 0 ; i < h->elements ;) {
-		ret = fn(h->p[i].object, arg);
-		if (ret & HEAP_SCAN_DEL) {
-			h->elements-- ;
-			h->p[i] = h->p[h->elements] ;
-			found++ ;
-		} else
-			i++ ;
-		if (ret & HEAP_SCAN_END)
-			break;
-	}
-	if (found)
-		heapify(h);
-	return found;
-}
-
-/*
- * cleanup the heap and free data structure
- */
-void
-heap_free(struct dn_heap *h)
-{
-	if (h->size >0 )
-		free(h->p, M_DN_HEAP);
-	bzero(h, sizeof(*h) );
-}
-
-/*
- * hash table support.
- */
-
-struct dn_ht {
-        int buckets;            /* how many buckets, really buckets - 1*/
-        int entries;            /* how many entries */
-        int ofs;	        /* offset of link field */
-        uint32_t (*hash)(uintptr_t, int, void *arg);
-        int (*match)(void *_el, uintptr_t key, int, void *);
-        void *(*newh)(uintptr_t, int, void *);
-        void **ht;              /* bucket heads */
-};
-/*
- * Initialize, allocating bucket pointers inline.
- * Recycle previous record if possible.
- * If the 'newh' function is not supplied, we assume that the
- * key passed to ht_find is the same object to be stored in.
- */
-struct dn_ht *
-dn_ht_init(struct dn_ht *ht, int buckets, int ofs,
-        uint32_t (*h)(uintptr_t, int, void *),
-        int (*match)(void *, uintptr_t, int, void *),
-	void *(*newh)(uintptr_t, int, void *))
-{
-	int l;
-
-	/*
-	 * Notes about rounding bucket size to a power of two.
-	 * Given the original bucket size, we compute the nearest lower and
-	 * higher power of two, minus 1  (respectively b_min and b_max) because
-	 * this value will be used to do an AND with the index returned
-	 * by hash function.
-	 * To choice between these two values, the original bucket size is
-	 * compared with b_min. If the original size is greater than 4/3 b_min,
-	 * we round the bucket size to b_max, else to b_min.
-	 * This ratio try to round to the nearest power of two, advantaging
-	 * the greater size if the different between two power is relatively
-	 * big.
-	 * Rounding the bucket size to a power of two avoid the use of
-	 * module when calculating the correct bucket.
-	 * The ht->buckets variable store the bucket size - 1 to simply
-	 * do an AND between the index returned by hash function and ht->bucket
-	 * instead of a module.
-	 */
-	int b_min; /* min buckets */
-	int b_max; /* max buckets */
-	int b_ori; /* original buckets */
-
-	if (h == NULL || match == NULL) {
-		printf("--- missing hash or match function");
-		return NULL;
-	}
-	if (buckets < 1 || buckets > 65536)
-		return NULL;
-
-	b_ori = buckets;
-	/* calculate next power of 2, - 1*/
-	buckets |= buckets >> 1;
-	buckets |= buckets >> 2;
-	buckets |= buckets >> 4;
-	buckets |= buckets >> 8;
-	buckets |= buckets >> 16;
-
-	b_max = buckets; /* Next power */
-	b_min = buckets >> 1; /* Previous power */
-
-	/* Calculate the 'nearest' bucket size */
-	if (b_min * 4000 / 3000 < b_ori)
-		buckets = b_max;
-	else
-		buckets = b_min;
-
-	if (ht) {	/* see if we can reuse */
-		if (buckets <= ht->buckets) {
-			ht->buckets = buckets;
-		} else {
-			/* free pointers if not allocated inline */
-			if (ht->ht != (void *)(ht + 1))
-				free(ht->ht, M_DN_HEAP);
-			free(ht, M_DN_HEAP);
-			ht = NULL;
-		}
-	}
-	if (ht == NULL) {
-		/* Allocate buckets + 1 entries because buckets is use to
-		 * do the AND with the index returned by hash function
-		 */
-		l = sizeof(*ht) + (buckets + 1) * sizeof(void **);
-		ht = malloc(l, M_DN_HEAP, M_NOWAIT | M_ZERO);
-	}
-	if (ht) {
-		ht->ht = (void **)(ht + 1);
-		ht->buckets = buckets;
-		ht->ofs = ofs;
-		ht->hash = h;
-		ht->match = match;
-		ht->newh = newh;
-	}
-	return ht;
-}
-
-/* dummy callback for dn_ht_free to unlink all */
-static int
-do_del(void *obj, void *arg)
-{
-	return DNHT_SCAN_DEL;
-}
-
-void
-dn_ht_free(struct dn_ht *ht, int flags)
-{
-	if (ht == NULL)
-		return;
-	if (flags & DNHT_REMOVE) {
-		(void)dn_ht_scan(ht, do_del, NULL);
-	} else {
-		if (ht->ht && ht->ht != (void *)(ht + 1))
-			free(ht->ht, M_DN_HEAP);
-		free(ht, M_DN_HEAP);
-	}
-}
-
-int
-dn_ht_entries(struct dn_ht *ht)
-{
-	return ht ? ht->entries : 0;
-}
-
-/* lookup and optionally create or delete element */
-void *
-dn_ht_find(struct dn_ht *ht, uintptr_t key, int flags, void *arg)
-{
-	int i;
-	void **pp, *p;
-
-	if (ht == NULL)	/* easy on an empty hash */
-		return NULL;
-	i = (ht->buckets == 1) ? 0 :
-		(ht->hash(key, flags, arg) & ht->buckets);
-
-	for (pp = &ht->ht[i]; (p = *pp); pp = (void **)((char *)p + ht->ofs)) {
-		if (flags & DNHT_MATCH_PTR) {
-			if (key == (uintptr_t)p)
-				break;
-		} else if (ht->match(p, key, flags, arg)) /* found match */
-			break;
-	}
-	if (p) {
-		if (flags & DNHT_REMOVE) {
-			/* link in the next element */
-			*pp = *(void **)((char *)p + ht->ofs);
-			*(void **)((char *)p + ht->ofs) = NULL;
-			ht->entries--;
-		}
-	} else if (flags & DNHT_INSERT) {
-		// printf("%s before calling new, bucket %d ofs %d\n",
-		//	__FUNCTION__, i, ht->ofs);
-		p = ht->newh ? ht->newh(key, flags, arg) : (void *)key;
-		// printf("%s newh returns %p\n", __FUNCTION__, p);
-		if (p) {
-			ht->entries++;
-			*(void **)((char *)p + ht->ofs) = ht->ht[i];
-			ht->ht[i] = p;
-		}
-	}
-	return p;
-}
-
-/*
- * do a scan with the option to delete the object. Extract next before
- * running the callback because the element may be destroyed there.
- */
-int
-dn_ht_scan(struct dn_ht *ht, int (*fn)(void *, void *), void *arg)
-{
-	int i, ret, found = 0;
-	void **curp, *cur, *next;
-
-	if (ht == NULL || fn == NULL)
-		return 0;
-	for (i = 0; i <= ht->buckets; i++) {
-		curp = &ht->ht[i];
-		while ( (cur = *curp) != NULL) {
-			next = *(void **)((char *)cur + ht->ofs);
-			ret = fn(cur, arg);
-			if (ret & DNHT_SCAN_DEL) {
-				found++;
-				ht->entries--;
-				*curp = next;
-			} else {
-				curp = (void **)((char *)cur + ht->ofs);
-			}
-			if (ret & DNHT_SCAN_END)
-				return found;
-		}
-	}
-	return found;
-}
-
-/*
- * Similar to dn_ht_scan(), except that the scan is performed only
- * in the bucket 'bucket'. The function returns a correct bucket number if
- * the original is invalid.
- * If the callback returns DNHT_SCAN_END, the function move the ht->ht[i]
- * pointer to the last entry processed. Moreover, the bucket number passed
- * by caller is decremented, because usually the caller increment it.
- */
-int
-dn_ht_scan_bucket(struct dn_ht *ht, int *bucket, int (*fn)(void *, void *),
-		 void *arg)
-{
-	int i, ret, found = 0;
-	void **curp, *cur, *next;
-
-	if (ht == NULL || fn == NULL)
-		return 0;
-	if (*bucket > ht->buckets)
-		*bucket = 0;
-	i = *bucket;
-
-	curp = &ht->ht[i];
-	while ( (cur = *curp) != NULL) {
-		next = *(void **)((char *)cur + ht->ofs);
-		ret = fn(cur, arg);
-		if (ret & DNHT_SCAN_DEL) {
-			found++;
-			ht->entries--;
-			*curp = next;
-		} else {
-			curp = (void **)((char *)cur + ht->ofs);
-		}
-		if (ret & DNHT_SCAN_END)
-			return found;
-	}
-	return found;
-}
diff --git a/sys/netinet/ipfw/dn_heap.h b/sys/netinet/ipfw/dn_heap.h
deleted file mode 100644
index c95473ade392..000000000000
--- a/sys/netinet/ipfw/dn_heap.h
+++ /dev/null
@@ -1,191 +0,0 @@
-/*-
- * Copyright (c) 1998-2010 Luigi Rizzo, Universita` di Pisa
- * All rights reserved
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-/*
- * Binary heap and hash tables, header file
- *
- * $FreeBSD$
- */
-
-#ifndef _IP_DN_HEAP_H
-#define _IP_DN_HEAP_H
-
-#define DN_KEY_LT(a,b)     ((int64_t)((a)-(b)) < 0)
-#define DN_KEY_LEQ(a,b)    ((int64_t)((a)-(b)) <= 0)
-
-/*
- * This module implements a binary heap supporting random extraction.
- *
- * A heap entry contains an uint64_t key and a pointer to object.
- * DN_KEY_LT(a,b) returns true if key 'a' is smaller than 'b'
- *
- * The heap is a struct dn_heap plus a dynamically allocated
- * array of dn_heap_entry entries. 'size' represents the size of
- * the array, 'elements' count entries in use. The topmost
- * element has the smallest key.
- * The heap supports ordered insert, and extract from the top.
- * To extract an object from the middle of the heap, we the object
- * must reserve an 'int32_t' to store the position of the object
- * in the heap itself, and the location of this field must be
- * passed as an argument to heap_init() -- use -1 if the feature
- * is not used.
- */
-struct dn_heap_entry {
-	uint64_t key;	/* sorting key, smallest comes first */
-	void *object;	/* object pointer */
-};
-
-struct dn_heap {
-	int size;	/* the size of the array */
-	int elements;	/* elements in use */
-	int ofs;	/* offset in the object of heap index */
-	struct dn_heap_entry *p;	/* array of "size" entries */
-};
-
-enum {
-	HEAP_SCAN_DEL = 1,
-	HEAP_SCAN_END = 2,
-};
-
-/*
- * heap_init() reinitializes the heap setting the size and the offset
- *	of the index for random extraction (use -1 if not used).
- *	The 'elements' counter is set to 0.
- *
- * SET_HEAP_OFS() indicates where, in the object, is stored the index
- *	for random extractions from the heap.
- *
- * heap_free() frees the memory associated to a heap.
- *
- * heap_insert() adds a key-pointer pair to the heap
- *
- * HEAP_TOP() returns a pointer to the top element of the heap,
- *	but makes no checks on its existance (XXX should we change ?)
- *
- * heap_extract() removes the entry at the top, returing the pointer.
- *	(the key should have been read before).
- *
- * heap_scan() invokes a callback on each entry of the heap.
- *	The callback can return a combination of HEAP_SCAN_DEL and
- *	HEAP_SCAN_END. HEAP_SCAN_DEL means the current element must
- *	be removed, and HEAP_SCAN_END means to terminate the scan.
- *	heap_scan() returns the number of elements removed.
- *	Because the order is not guaranteed, we should use heap_scan()
- *	only as a last resort mechanism.
- */
-#define HEAP_TOP(h)	((h)->p)
-#define SET_HEAP_OFS(h, n)	do { (h)->ofs = n; } while (0)
-int     heap_init(struct dn_heap *h, int size, int ofs);
-int     heap_insert(struct dn_heap *h, uint64_t key1, void *p);
-void    heap_extract(struct dn_heap *h, void *obj);
-void heap_free(struct dn_heap *h);
-int heap_scan(struct dn_heap *, int (*)(void *, uintptr_t), uintptr_t);
-
-/*------------------------------------------------------
- * This module implements a generic hash table with support for
- * running callbacks on the entire table. To avoid allocating
- * memory during hash table operations, objects must reserve
- * space for a link field. XXX if the heap is moderately full,
- * an SLIST suffices, and we can tolerate the cost of a hash
- * computation on each removal.
- *
- * dn_ht_init() initializes the table, setting the number of
- *	buckets, the offset of the link field, the main callbacks.
- *	Callbacks are:
- * 
- *	hash(key, flags, arg) called to return a bucket index.
- *	match(obj, key, flags, arg) called to determine if key
- *		matches the current 'obj' in the heap
- *	newh(key, flags, arg) optional, used to allocate a new
- *		object during insertions.
- *
- * dn_ht_free() frees the heap or unlink elements.
- *	DNHT_REMOVE unlink elements, 0 frees the heap.
- *	You need two calls to do both.
- *
- * dn_ht_find() is the main lookup function, which can also be
- *	used to insert or delete elements in the hash table.
- *	The final 'arg' is passed to all callbacks.
- *
- * dn_ht_scan() is used to invoke a callback on all entries of
- *	the heap, or possibly on just one bucket. The callback
- *	is invoked with a pointer to the object, and must return
- *	one of DNHT_SCAN_DEL or DNHT_SCAN_END to request the
- *	removal of the object from the heap and the end of the
- *	scan, respectively.
- *
- * dn_ht_scan_bucket() is similar to dn_ht_scan(), except that it scans
- *	only the specific bucket of the table. The bucket is a in-out
- *	parameter and return a valid bucket number if the original
- *	is invalid.
- *
- * A combination of flags can be used to modify the operation
- * of the dn_ht_find(), and of the callbacks:
- *
- * DNHT_KEY_IS_OBJ	means the key is the object pointer.
- *	It is usally of interest for the hash and match functions.
- *
- * DNHT_MATCH_PTR	during a lookup, match pointers instead
- *	of calling match(). Normally used when removing specific
- *	entries. Does not imply KEY_IS_OBJ as the latter _is_ used
- *	by the match function.
- *
- * DNHT_INSERT		insert the element if not found.
- *	Calls new() to allocates a new object unless
- *	DNHT_KEY_IS_OBJ is set.
- *
- * DNHT_UNIQUE		only insert if object not found.
- *	XXX should it imply DNHT_INSERT ?
- *
- * DNHT_REMOVE		remove objects if we find them.
- */
-struct dn_ht;	/* should be opaque */
-
-struct dn_ht *dn_ht_init(struct dn_ht *, int buckets, int ofs, 
-        uint32_t (*hash)(uintptr_t, int, void *),
-        int (*match)(void *, uintptr_t, int, void *),
-        void *(*newh)(uintptr_t, int, void *));
-void dn_ht_free(struct dn_ht *, int flags);
-
-void *dn_ht_find(struct dn_ht *, uintptr_t, int, void *);
-int dn_ht_scan(struct dn_ht *, int (*)(void *, void *), void *);
-int dn_ht_scan_bucket(struct dn_ht *, int * , int (*)(void *, void *), void *);
-int dn_ht_entries(struct dn_ht *);
-
-enum {  /* flags values.
-	 * first two are returned by the scan callback to indicate
-	 * to delete the matching element or to end the scan
-	 */
-        DNHT_SCAN_DEL	= 0x0001,
-        DNHT_SCAN_END	= 0x0002,
-        DNHT_KEY_IS_OBJ	= 0x0004,	/* key is the obj pointer */
-        DNHT_MATCH_PTR	= 0x0008,	/* match by pointer, not match() */
-        DNHT_INSERT	= 0x0010,	/* insert if not found */
-        DNHT_UNIQUE	= 0x0020,	/* report error if already there */
-        DNHT_REMOVE	= 0x0040,	/* remove on find or dn_ht_free */
-}; 
-
-#endif /* _IP_DN_HEAP_H */
diff --git a/sys/netinet/ipfw/dn_sched.h b/sys/netinet/ipfw/dn_sched.h
deleted file mode 100644
index ab823fe7c806..000000000000
--- a/sys/netinet/ipfw/dn_sched.h
+++ /dev/null
@@ -1,191 +0,0 @@
-/*
- * Copyright (c) 2010 Riccardo Panicucci, Luigi Rizzo, Universita` di Pisa
- * All rights reserved
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-/*
- * The API to write a packet scheduling algorithm for dummynet.
- *
- * $FreeBSD$
- */
-
-#ifndef _DN_SCHED_H
-#define _DN_SCHED_H
-
-#define	DN_MULTIQUEUE	0x01
-/*
- * Descriptor for a scheduling algorithm.
- * Contains all function pointers for a given scheduler
- * This is typically created when a module is loaded, and stored
- * in a global list of schedulers.
- */
-struct dn_alg {
-	uint32_t type;           /* the scheduler type */
-	const char *name;   /* scheduler name */
-	uint32_t flags;	/* DN_MULTIQUEUE if supports multiple queues */
-
-	/*
-	 * The following define the size of 3 optional data structures
-	 * that may need to be allocated at runtime, and are appended
-	 * to each of the base data structures: scheduler, sched.inst,
-	 * and queue. We don't have a per-flowset structure.
-	 */
-	/*    + parameters attached to the template, e.g.
-	 *	default queue sizes, weights, quantum size, and so on;
-	 */
-	size_t schk_datalen;
-
-	/*    + per-instance parameters, such as timestamps,
-	 *	containers for queues, etc;
-	 */
-	size_t si_datalen;
-
-	size_t q_datalen;	/* per-queue parameters (e.g. S,F) */
-
-	/*
-	 * Methods implemented by the scheduler:
-	 * enqueue	enqueue packet 'm' on scheduler 's', queue 'q'.
-	 *	q is NULL for !MULTIQUEUE.
-	 *	Return 0 on success, 1 on drop (packet consumed anyways).
-	 *	Note that q should be interpreted only as a hint
-	 *	on the flow that the mbuf belongs to: while a
-	 *	scheduler will normally enqueue m into q, it is ok
-	 *	to leave q alone and put the mbuf elsewhere.
-	 *	This function is called in two cases:
-	 *	 - when a new packet arrives to the scheduler;
-	 *	 - when a scheduler is reconfigured. In this case the
-	 *	   call is issued by the new_queue callback, with a 
-	 *	   non empty queue (q) and m pointing to the first
-	 *	   mbuf in the queue. For this reason, the function
-	 *	   should internally check for (m != q->mq.head)
-	 *	   before calling dn_enqueue().
-	 *
-	 * dequeue	Called when scheduler instance 's' can
-	 *	dequeue a packet. Return NULL if none are available.
-	 *	XXX what about non work-conserving ?
-	 *
-	 * config	called on 'sched X config ...', normally writes
-	 *	in the area of size sch_arg
-	 *
-	 * destroy	called on 'sched delete', frees everything
-	 *	in sch_arg (other parts are handled by more specific
-	 *	functions)
-	 *
-	 * new_sched    called when a new instance is created, e.g.
-	 *	to create the local queue for !MULTIQUEUE, set V or
-	 *	copy parameters for WFQ, and so on.
-	 *
-	 * free_sched	called when deleting an instance, cleans
-	 *	extra data in the per-instance area.
-	 *
-	 * new_fsk	called when a flowset is linked to a scheduler,
-	 *	e.g. to validate parameters such as weights etc.
-	 * free_fsk	when a flowset is unlinked from a scheduler.
-	 *	(probably unnecessary)
-	 *
-	 * new_queue	called to set the per-queue parameters,
-	 *	e.g. S and F, adjust sum of weights in the parent, etc.
-	 *
-	 *	The new_queue callback is normally called from when
-	 *	creating a new queue. In some cases (such as a
-	 *	scheduler change or reconfiguration) it can be called
-	 *	with a non empty queue. In this case, the queue
-	 *	In case of non empty queue, the new_queue callback could
-	 *	need to call the enqueue function. In this case,
-	 *	the callback should eventually call enqueue() passing
-	 *	as m the first element in the queue.
-	 *
-	 * free_queue	actions related to a queue removal, e.g. undo
-	 *	all the above. If the queue has data in it, also remove
-	 *	from the scheduler. This can e.g. happen during a reconfigure.
-	 */
-	int (*enqueue)(struct dn_sch_inst *, struct dn_queue *,
-		struct mbuf *);
-	struct mbuf * (*dequeue)(struct dn_sch_inst *);
-
-	int (*config)(struct dn_schk *);
-	int (*destroy)(struct dn_schk*);
-	int (*new_sched)(struct dn_sch_inst *);
-	int (*free_sched)(struct dn_sch_inst *);
-	int (*new_fsk)(struct dn_fsk *f);
-	int (*free_fsk)(struct dn_fsk *f);
-	int (*new_queue)(struct dn_queue *q);
-	int (*free_queue)(struct dn_queue *q);
-
-	/* run-time fields */
-	int ref_count;      /* XXX number of instances in the system */
-	SLIST_ENTRY(dn_alg) next; /* Next scheduler in the list */
-};
-
-/* MSVC does not support initializers so we need this ugly macro */
-#ifdef _WIN32
-#define _SI(fld)
-#else
-#define _SI(fld)	fld
-#endif
-
-/*
- * Additionally, dummynet exports some functions and macros
- * to be used by schedulers:
- */
-
-void dn_free_pkts(struct mbuf *mnext);
-int dn_enqueue(struct dn_queue *q, struct mbuf* m, int drop);
-/* bound a variable between min and max */
-int ipdn_bound_var(int *v, int dflt, int lo, int hi, const char *msg);
-
-/*
- * Extract the head of a queue, update stats. Must be the very last
- * thing done on a dequeue as the queue itself may go away.
- */
-static __inline struct mbuf*
-dn_dequeue(struct dn_queue *q)
-{
-	struct mbuf *m = q->mq.head;
-	if (m == NULL)
-		return NULL;
-	q->mq.head = m->m_nextpkt;
-
-	/* Update stats for the queue */
-	q->ni.length--;
-	q->ni.len_bytes -= m->m_pkthdr.len;
-	if (q->_si) {
-		q->_si->ni.length--;
-		q->_si->ni.len_bytes -= m->m_pkthdr.len;
-	}
-	if (q->ni.length == 0) /* queue is now idle */
-		q->q_time = dn_cfg.curr_time;
-	return m;
-}
-
-int dn_sched_modevent(module_t mod, int cmd, void *arg);
-
-#define DECLARE_DNSCHED_MODULE(name, dnsched)			\
-	static moduledata_t name##_mod = {			\
-		#name, dn_sched_modevent, dnsched		\
-	};							\
-	DECLARE_MODULE(name, name##_mod, 			\
-		SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY); 	\
-        MODULE_DEPEND(name, dummynet, 3, 3, 3);
-#endif /* _DN_SCHED_H */
diff --git a/sys/netinet/ipfw/dn_sched_fifo.c b/sys/netinet/ipfw/dn_sched_fifo.c
deleted file mode 100644
index 0bb3800a9c2a..000000000000
--- a/sys/netinet/ipfw/dn_sched_fifo.c
+++ /dev/null
@@ -1,120 +0,0 @@
-/*
- * Copyright (c) 2010 Riccardo Panicucci, Universita` di Pisa
- * All rights reserved
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-/*
- * $FreeBSD$
- */
-
-#ifdef _KERNEL
-#include <sys/malloc.h>
-#include <sys/socket.h>
-#include <sys/socketvar.h>
-#include <sys/kernel.h>
-#include <sys/mbuf.h>
-#include <sys/module.h>
-#include <net/if.h>	/* IFNAMSIZ */
-#include <netinet/in.h>
-#include <netinet/ip_var.h>		/* ipfw_rule_ref */
-#include <netinet/ip_fw.h>	/* flow_id */
-#include <netinet/ip_dummynet.h>
-#include <netinet/ipfw/dn_heap.h>
-#include <netinet/ipfw/ip_dn_private.h>
-#include <netinet/ipfw/dn_sched.h>
-#else
-#include <dn_test.h>
-#endif
-
-/*
- * This file implements a FIFO scheduler for a single queue.
- * The queue is allocated as part of the scheduler instance,
- * and there is a single flowset is in the template which stores
- * queue size and policy.
- * Enqueue and dequeue use the default library functions.
- */
-static int 
-fifo_enqueue(struct dn_sch_inst *si, struct dn_queue *q, struct mbuf *m)
-{
-	/* XXX if called with q != NULL and m=NULL, this is a
-	 * re-enqueue from an existing scheduler, which we should
-	 * handle.
-	 */
-	return dn_enqueue((struct dn_queue *)(si+1), m, 0);
-}
-
-static struct mbuf *
-fifo_dequeue(struct dn_sch_inst *si)
-{
-	return dn_dequeue((struct dn_queue *)(si + 1));
-}
-
-static int
-fifo_new_sched(struct dn_sch_inst *si)
-{
-	/* This scheduler instance contains the queue */
-	struct dn_queue *q = (struct dn_queue *)(si + 1);
-
-        set_oid(&q->ni.oid, DN_QUEUE, sizeof(*q));
-	q->_si = si;
-	q->fs = si->sched->fs;
-	return 0;
-}
-
-static int
-fifo_free_sched(struct dn_sch_inst *si)
-{
-	struct dn_queue *q = (struct dn_queue *)(si + 1);
-	dn_free_pkts(q->mq.head);
-	bzero(q, sizeof(*q));
-	return 0;
-}
-
-/*
- * FIFO scheduler descriptor
- * contains the type of the scheduler, the name, the size of extra
- * data structures, and function pointers.
- */
-static struct dn_alg fifo_desc = {
-	_SI( .type = )  DN_SCHED_FIFO,
-	_SI( .name = )  "FIFO",
-	_SI( .flags = ) 0,
-
-	_SI( .schk_datalen = ) 0,
-	_SI( .si_datalen = )  sizeof(struct dn_queue),
-	_SI( .q_datalen = )  0,
-
-	_SI( .enqueue = )  fifo_enqueue,
-	_SI( .dequeue = )  fifo_dequeue,
-	_SI( .config = )  NULL,
-	_SI( .destroy = )  NULL,
-	_SI( .new_sched = )  fifo_new_sched,
-	_SI( .free_sched = )  fifo_free_sched,
-	_SI( .new_fsk = )  NULL,
-	_SI( .free_fsk = )  NULL,
-	_SI( .new_queue = )  NULL,
-	_SI( .free_queue = )  NULL,
-};
-
-DECLARE_DNSCHED_MODULE(dn_fifo, &fifo_desc);
diff --git a/sys/netinet/ipfw/dn_sched_prio.c b/sys/netinet/ipfw/dn_sched_prio.c
deleted file mode 100644
index 28f60062cfc5..000000000000
--- a/sys/netinet/ipfw/dn_sched_prio.c
+++ /dev/null
@@ -1,229 +0,0 @@
-/*
- * Copyright (c) 2010 Riccardo Panicucci, Universita` di Pisa
- * All rights reserved
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-/*
- * $FreeBSD$
- */
-#ifdef _KERNEL
-#include <sys/malloc.h>
-#include <sys/socket.h>
-#include <sys/socketvar.h>
-#include <sys/kernel.h>
-#include <sys/mbuf.h>
-#include <sys/module.h>
-#include <net/if.h>	/* IFNAMSIZ */
-#include <netinet/in.h>
-#include <netinet/ip_var.h>		/* ipfw_rule_ref */
-#include <netinet/ip_fw.h>	/* flow_id */
-#include <netinet/ip_dummynet.h>
-#include <netinet/ipfw/dn_heap.h>
-#include <netinet/ipfw/ip_dn_private.h>
-#include <netinet/ipfw/dn_sched.h>
-#else
-#include <dn_test.h>
-#endif
-
-#define DN_SCHED_PRIO	5 //XXX
-
-#if !defined(_KERNEL) || !defined(__linux__)
-#define test_bit(ix, pData)	((*pData) & (1<<(ix)))
-#define __set_bit(ix, pData)	(*pData) |= (1<<(ix))
-#define __clear_bit(ix, pData)	(*pData) &= ~(1<<(ix))
-#endif
-
-#ifdef __MIPSEL__
-#define __clear_bit(ix, pData)	(*pData) &= ~(1<<(ix))
-#endif
-
-/* Size of the array of queues pointers. */
-#define BITMAP_T	unsigned long
-#define MAXPRIO		(sizeof(BITMAP_T) * 8)
-
-/*
- * The scheduler instance contains an array of pointers to queues,
- * one for each priority, and a bitmap listing backlogged queues.
- */
-struct prio_si {
-	BITMAP_T bitmap;			/* array bitmap */
-	struct dn_queue *q_array[MAXPRIO];	/* Array of queues pointers */
-};
-
-/*
- * If a queue with the same priority is already backlogged, use
- * that one instead of the queue passed as argument.
- */
-static int 
-prio_enqueue(struct dn_sch_inst *_si, struct dn_queue *q, struct mbuf *m)
-{
-	struct prio_si *si = (struct prio_si *)(_si + 1);
-	int prio = q->fs->fs.par[0];
-
-	if (test_bit(prio, &si->bitmap) == 0) {
-		/* No queue with this priority, insert */
-		__set_bit(prio, &si->bitmap);
-		si->q_array[prio] = q;
-	} else { /* use the existing queue */
-		q = si->q_array[prio];
-	}
-	if (dn_enqueue(q, m, 0))
-		return 1;
-	return 0;
-}
-
-/*
- * Packets are dequeued only from the highest priority queue.
- * The function ffs() return the lowest bit in the bitmap that rapresent
- * the array index (-1) which contains the pointer to the highest priority
- * queue.
- * After the dequeue, if this queue become empty, it is index is removed
- * from the bitmap.
- * Scheduler is idle if the bitmap is empty
- *
- * NOTE: highest priority is 0, lowest is sched->max_prio_q
- */
-static struct mbuf *
-prio_dequeue(struct dn_sch_inst *_si)
-{
-	struct prio_si *si = (struct prio_si *)(_si + 1);
-	struct mbuf *m;
-	struct dn_queue *q;
-	int prio;
-
-	if (si->bitmap == 0) /* scheduler idle */
-		return NULL;
-
-	prio = ffs(si->bitmap) - 1;
-
-	/* Take the highest priority queue in the scheduler */
-	q = si->q_array[prio];
-	// assert(q)
-
-	m = dn_dequeue(q);
-	if (q->mq.head == NULL) {
-		/* Queue is now empty, remove from scheduler
-		 * and mark it
-		 */
-		si->q_array[prio] = NULL;
-		__clear_bit(prio, &si->bitmap);
-	}
-	return m;
-}
-
-static int
-prio_new_sched(struct dn_sch_inst *_si)
-{
-	struct prio_si *si = (struct prio_si *)(_si + 1);
-
-	bzero(si->q_array, sizeof(si->q_array));
-	si->bitmap = 0;
-
-	return 0;
-}
-
-static int
-prio_new_fsk(struct dn_fsk *fs)
-{
-	/* Check if the prioritiy is between 0 and MAXPRIO-1 */
-	ipdn_bound_var(&fs->fs.par[0], 0, 0, MAXPRIO - 1, "PRIO priority");
-	return 0;
-}
-
-static int
-prio_new_queue(struct dn_queue *q)
-{
-	struct prio_si *si = (struct prio_si *)(q->_si + 1);
-	int prio = q->fs->fs.par[0];
-	struct dn_queue *oldq;
-
-	q->ni.oid.subtype = DN_SCHED_PRIO;
-
-	if (q->mq.head == NULL)
-		return 0;
-
-	/* Queue already full, must insert in the scheduler or append
-	 * mbufs to existing queue. This partly duplicates prio_enqueue
-	 */
-	if (test_bit(prio, &si->bitmap) == 0) {
-		/* No queue with this priority, insert */
-		__set_bit(prio, &si->bitmap);
-		si->q_array[prio] = q;
-	} else if ( (oldq = si->q_array[prio]) != q) {
-		/* must append to the existing queue.
-		 * can simply append q->mq.head to q2->...
-		 * and add the counters to those of q2
-		 */
-		oldq->mq.tail->m_nextpkt = q->mq.head;
-		oldq->mq.tail = q->mq.tail;
-		oldq->ni.length += q->ni.length;
-		q->ni.length = 0;
-		oldq->ni.len_bytes += q->ni.len_bytes;
-		q->ni.len_bytes = 0;
-		q->mq.tail = q->mq.head = NULL;
-	}
-	return 0;
-}
-
-static int
-prio_free_queue(struct dn_queue *q)
-{
-	int prio = q->fs->fs.par[0];
-	struct prio_si *si = (struct prio_si *)(q->_si + 1);
-
-	if (si->q_array[prio] == q) {
-		si->q_array[prio] = NULL;
-		__clear_bit(prio, &si->bitmap);
-	}
-	return 0;
-}
-
-
-static struct dn_alg prio_desc = {
-	_SI( .type = ) DN_SCHED_PRIO,
-	_SI( .name = ) "PRIO",
-	_SI( .flags = ) DN_MULTIQUEUE,
-
-	/* we need extra space in the si and the queue */
-	_SI( .schk_datalen = ) 0,
-	_SI( .si_datalen = ) sizeof(struct prio_si),
-	_SI( .q_datalen = ) 0,
-
-	_SI( .enqueue = ) prio_enqueue,
-	_SI( .dequeue = ) prio_dequeue,
-
-	_SI( .config = )  NULL,
-	_SI( .destroy = )  NULL,
-	_SI( .new_sched = ) prio_new_sched,
-	_SI( .free_sched = ) NULL,
-
-	_SI( .new_fsk = ) prio_new_fsk,
-	_SI( .free_fsk = )  NULL,
-
-	_SI( .new_queue = ) prio_new_queue,
-	_SI( .free_queue = ) prio_free_queue,
-};
-
-
-DECLARE_DNSCHED_MODULE(dn_prio, &prio_desc);
diff --git a/sys/netinet/ipfw/dn_sched_qfq.c b/sys/netinet/ipfw/dn_sched_qfq.c
deleted file mode 100644
index be7fba31564e..000000000000
--- a/sys/netinet/ipfw/dn_sched_qfq.c
+++ /dev/null
@@ -1,864 +0,0 @@
-/*
- * Copyright (c) 2010 Fabio Checconi, Luigi Rizzo, Paolo Valente
- * All rights reserved
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-/*
- * $FreeBSD$
- */
-
-#ifdef _KERNEL
-#include <sys/malloc.h>
-#include <sys/socket.h>
-#include <sys/socketvar.h>
-#include <sys/kernel.h>
-#include <sys/mbuf.h>
-#include <sys/module.h>
-#include <net/if.h>	/* IFNAMSIZ */
-#include <netinet/in.h>
-#include <netinet/ip_var.h>		/* ipfw_rule_ref */
-#include <netinet/ip_fw.h>	/* flow_id */
-#include <netinet/ip_dummynet.h>
-#include <netinet/ipfw/dn_heap.h>
-#include <netinet/ipfw/ip_dn_private.h>
-#include <netinet/ipfw/dn_sched.h>
-#else
-#include <dn_test.h>
-#endif
-
-#ifdef QFQ_DEBUG
-struct qfq_sched;
-static void dump_sched(struct qfq_sched *q, const char *msg);
-#define	NO(x)	x
-#else
-#define NO(x)
-#endif
-#define DN_SCHED_QFQ	4 // XXX Where?
-typedef	unsigned long	bitmap;
-
-/*
- * bitmaps ops are critical. Some linux versions have __fls
- * and the bitmap ops. Some machines have ffs
- */
-#if defined(_WIN32) || (defined(__MIPSEL__) && defined(LINUX_24))
-int fls(unsigned int n)
-{
-	int i = 0;
-	for (i = 0; n > 0; n >>= 1, i++)
-		;
-	return i;
-}
-#endif
-
-#if !defined(_KERNEL) || defined( __FreeBSD__ ) || defined(_WIN32) || (defined(__MIPSEL__) && defined(LINUX_24))
-static inline unsigned long __fls(unsigned long word)
-{
-	return fls(word) - 1;
-}
-#endif
-
-#if !defined(_KERNEL) || !defined(__linux__)
-#ifdef QFQ_DEBUG
-int test_bit(int ix, bitmap *p)
-{
-	if (ix < 0 || ix > 31)
-		D("bad index %d", ix);
-	return *p & (1<<ix);
-}
-void __set_bit(int ix, bitmap *p)
-{
-	if (ix < 0 || ix > 31)
-		D("bad index %d", ix);
-	*p |= (1<<ix);
-}
-void __clear_bit(int ix, bitmap *p)
-{
-	if (ix < 0 || ix > 31)
-		D("bad index %d", ix);
-	*p &= ~(1<<ix);
-}
-#else /* !QFQ_DEBUG */
-/* XXX do we have fast version, or leave it to the compiler ? */
-#define test_bit(ix, pData)	((*pData) & (1<<(ix)))
-#define __set_bit(ix, pData)	(*pData) |= (1<<(ix))
-#define __clear_bit(ix, pData)	(*pData) &= ~(1<<(ix))
-#endif /* !QFQ_DEBUG */
-#endif /* !__linux__ */
-
-#ifdef __MIPSEL__
-#define __clear_bit(ix, pData)	(*pData) &= ~(1<<(ix))
-#endif
-
-/*-------------------------------------------*/
-/*
-
-Virtual time computations.
-
-S, F and V are all computed in fixed point arithmetic with
-FRAC_BITS decimal bits.
-
-   QFQ_MAX_INDEX is the maximum index allowed for a group. We need
-  	one bit per index.
-   QFQ_MAX_WSHIFT is the maximum power of two supported as a weight.
-   The layout of the bits is as below:
-  
-                   [ MTU_SHIFT ][      FRAC_BITS    ]
-                   [ MAX_INDEX    ][ MIN_SLOT_SHIFT ]
-  				 ^.__grp->index = 0
-  				 *.__grp->slot_shift
-  
-   where MIN_SLOT_SHIFT is derived by difference from the others.
-
-The max group index corresponds to Lmax/w_min, where
-Lmax=1<<MTU_SHIFT, w_min = 1 .
-From this, and knowing how many groups (MAX_INDEX) we want,
-we can derive the shift corresponding to each group.
-
-Because we often need to compute
-	F = S + len/w_i  and V = V + len/wsum
-instead of storing w_i store the value
-	inv_w = (1<<FRAC_BITS)/w_i
-so we can do F = S + len * inv_w * wsum.
-We use W_TOT in the formulas so we can easily move between
-static and adaptive weight sum.
-
-The per-scheduler-instance data contain all the data structures
-for the scheduler: bitmaps and bucket lists.
-
- */
-/*
- * Maximum number of consecutive slots occupied by backlogged classes
- * inside a group. This is approx lmax/lmin + 5.
- * XXX check because it poses constraints on MAX_INDEX
- */
-#define QFQ_MAX_SLOTS	32
-/*
- * Shifts used for class<->group mapping. Class weights are
- * in the range [1, QFQ_MAX_WEIGHT], we to map each class i to the
- * group with the smallest index that can support the L_i / r_i
- * configured for the class.
- *
- * grp->index is the index of the group; and grp->slot_shift
- * is the shift for the corresponding (scaled) sigma_i.
- *
- * When computing the group index, we do (len<<FP_SHIFT)/weight,
- * then compute an FLS (which is like a log2()), and if the result
- * is below the MAX_INDEX region we use 0 (which is the same as
- * using a larger len).
- */
-#define QFQ_MAX_INDEX		19
-#define QFQ_MAX_WSHIFT		16	/* log2(max_weight) */
-
-#define	QFQ_MAX_WEIGHT		(1<<QFQ_MAX_WSHIFT)
-#define QFQ_MAX_WSUM		(2*QFQ_MAX_WEIGHT)
-//#define IWSUM	(q->i_wsum)
-#define IWSUM	((1<<FRAC_BITS)/QFQ_MAX_WSUM)
-
-#define FRAC_BITS		30	/* fixed point arithmetic */
-#define ONE_FP			(1UL << FRAC_BITS)
-
-#define QFQ_MTU_SHIFT		11	/* log2(max_len) */
-#define QFQ_MIN_SLOT_SHIFT	(FRAC_BITS + QFQ_MTU_SHIFT - QFQ_MAX_INDEX)
-
-/*
- * Possible group states, also indexes for the bitmaps array in
- * struct qfq_queue. We rely on ER, IR, EB, IB being numbered 0..3
- */
-enum qfq_state { ER, IR, EB, IB, QFQ_MAX_STATE };
-
-struct qfq_group;
-/*
- * additional queue info. Some of this info should come from
- * the flowset, we copy them here for faster processing.
- * This is an overlay of the struct dn_queue
- */
-struct qfq_class {
-	struct dn_queue _q;
-	uint64_t S, F;		/* flow timestamps (exact) */
-	struct qfq_class *next; /* Link for the slot list. */
-
-	/* group we belong to. In principle we would need the index,
-	 * which is log_2(lmax/weight), but we never reference it
-	 * directly, only the group.
-	 */
-	struct qfq_group *grp;
-
-	/* these are copied from the flowset. */
-	uint32_t	inv_w;	/* ONE_FP/weight */
-	uint32_t 	lmax;	/* Max packet size for this flow. */
-};
-
-/* Group descriptor, see the paper for details.
- * Basically this contains the bucket lists
- */
-struct qfq_group {
-	uint64_t S, F;			/* group timestamps (approx). */
-	unsigned int slot_shift;	/* Slot shift. */
-	unsigned int index;		/* Group index. */
-	unsigned int front;		/* Index of the front slot. */
-	bitmap full_slots;		/* non-empty slots */
-
-	/* Array of lists of active classes. */
-	struct qfq_class *slots[QFQ_MAX_SLOTS];
-};
-
-/* scheduler instance descriptor. */
-struct qfq_sched {
-	uint64_t	V;		/* Precise virtual time. */
-	uint32_t	wsum;		/* weight sum */
-	NO(uint32_t	i_wsum;		/* ONE_FP/w_sum */
-	uint32_t	_queued;	/* debugging */
-	uint32_t	loops;	/* debugging */)
-	bitmap bitmaps[QFQ_MAX_STATE];	/* Group bitmaps. */
-	struct qfq_group groups[QFQ_MAX_INDEX + 1]; /* The groups. */
-};
-
-/*---- support functions ----------------------------*/
-
-/* Generic comparison function, handling wraparound. */
-static inline int qfq_gt(uint64_t a, uint64_t b)
-{
-	return (int64_t)(a - b) > 0;
-}
-
-/* Round a precise timestamp to its slotted value. */
-static inline uint64_t qfq_round_down(uint64_t ts, unsigned int shift)
-{
-	return ts & ~((1ULL << shift) - 1);
-}
-
-/* return the pointer to the group with lowest index in the bitmap */
-static inline struct qfq_group *qfq_ffs(struct qfq_sched *q,
-					unsigned long bitmap)
-{
-	int index = ffs(bitmap) - 1; // zero-based
-	return &q->groups[index];
-}
-
-/*
- * Calculate a flow index, given its weight and maximum packet length.
- * index = log_2(maxlen/weight) but we need to apply the scaling.
- * This is used only once at flow creation.
- */
-static int qfq_calc_index(uint32_t inv_w, unsigned int maxlen)
-{
-	uint64_t slot_size = (uint64_t)maxlen *inv_w;
-	unsigned long size_map;
-	int index = 0;
-
-	size_map = (unsigned long)(slot_size >> QFQ_MIN_SLOT_SHIFT);
-	if (!size_map)
-		goto out;
-
-	index = __fls(size_map) + 1;	// basically a log_2()
-	index -= !(slot_size - (1ULL << (index + QFQ_MIN_SLOT_SHIFT - 1)));
-
-	if (index < 0)
-		index = 0;
-
-out:
-	ND("W = %d, L = %d, I = %d\n", ONE_FP/inv_w, maxlen, index);
-	return index;
-}
-/*---- end support functions ----*/
-
-/*-------- API calls --------------------------------*/
-/*
- * Validate and copy parameters from flowset.
- */
-static int
-qfq_new_queue(struct dn_queue *_q)
-{
-	struct qfq_sched *q = (struct qfq_sched *)(_q->_si + 1);
-	struct qfq_class *cl = (struct qfq_class *)_q;
-	int i;
-	uint32_t w;	/* approximated weight */
-
-	/* import parameters from the flowset. They should be correct
-	 * already.
-	 */
-	w = _q->fs->fs.par[0];
-	cl->lmax = _q->fs->fs.par[1];
-	if (!w || w > QFQ_MAX_WEIGHT) {
-		w = 1;
-		D("rounding weight to 1");
-	}
-	cl->inv_w = ONE_FP/w;
-	w = ONE_FP/cl->inv_w;	
-	if (q->wsum + w > QFQ_MAX_WSUM)
-		return EINVAL;
-
-	i = qfq_calc_index(cl->inv_w, cl->lmax);
-	cl->grp = &q->groups[i];
-	q->wsum += w;
-	// XXX cl->S = q->V; ?
-	// XXX compute q->i_wsum
-	return 0;
-}
-
-/* remove an empty queue */
-static int
-qfq_free_queue(struct dn_queue *_q)
-{
-	struct qfq_sched *q = (struct qfq_sched *)(_q->_si + 1);
-	struct qfq_class *cl = (struct qfq_class *)_q;
-	if (cl->inv_w) {
-		q->wsum -= ONE_FP/cl->inv_w;
-		cl->inv_w = 0; /* reset weight to avoid run twice */
-	}
-	return 0;
-}
-
-/* Calculate a mask to mimic what would be ffs_from(). */
-static inline unsigned long
-mask_from(unsigned long bitmap, int from)
-{
-	return bitmap & ~((1UL << from) - 1);
-}
-
-/*
- * The state computation relies on ER=0, IR=1, EB=2, IB=3
- * First compute eligibility comparing grp->S, q->V,
- * then check if someone is blocking us and possibly add EB
- */
-static inline unsigned int
-qfq_calc_state(struct qfq_sched *q, struct qfq_group *grp)
-{
-	/* if S > V we are not eligible */
-	unsigned int state = qfq_gt(grp->S, q->V);
-	unsigned long mask = mask_from(q->bitmaps[ER], grp->index);
-	struct qfq_group *next;
-
-	if (mask) {
-		next = qfq_ffs(q, mask);
-		if (qfq_gt(grp->F, next->F))
-			state |= EB;
-	}
-
-	return state;
-}
-
-/*
- * In principle
- *	q->bitmaps[dst] |= q->bitmaps[src] & mask;
- *	q->bitmaps[src] &= ~mask;
- * but we should make sure that src != dst
- */
-static inline void
-qfq_move_groups(struct qfq_sched *q, unsigned long mask, int src, int dst)
-{
-	q->bitmaps[dst] |= q->bitmaps[src] & mask;
-	q->bitmaps[src] &= ~mask;
-}
-
-static inline void
-qfq_unblock_groups(struct qfq_sched *q, int index, uint64_t old_finish)
-{
-	unsigned long mask = mask_from(q->bitmaps[ER], index + 1);
-	struct qfq_group *next;
-
-	if (mask) {
-		next = qfq_ffs(q, mask);
-		if (!qfq_gt(next->F, old_finish))
-			return;
-	}
-
-	mask = (1UL << index) - 1;
-	qfq_move_groups(q, mask, EB, ER);
-	qfq_move_groups(q, mask, IB, IR);
-}
-
-/*
- * perhaps
- *
-	old_V ^= q->V;
-	old_V >>= QFQ_MIN_SLOT_SHIFT;
-	if (old_V) {
-		...
-	}
- *
- */
-static inline void
-qfq_make_eligible(struct qfq_sched *q, uint64_t old_V)
-{
-	unsigned long mask, vslot, old_vslot;
-
-	vslot = q->V >> QFQ_MIN_SLOT_SHIFT;
-	old_vslot = old_V >> QFQ_MIN_SLOT_SHIFT;
-
-	if (vslot != old_vslot) {
-		mask = (2UL << (__fls(vslot ^ old_vslot))) - 1;
-		qfq_move_groups(q, mask, IR, ER);
-		qfq_move_groups(q, mask, IB, EB);
-	}
-}
-
-/*
- * XXX we should make sure that slot becomes less than 32.
- * This is guaranteed by the input values.
- * roundedS is always cl->S rounded on grp->slot_shift bits.
- */
-static inline void
-qfq_slot_insert(struct qfq_group *grp, struct qfq_class *cl, uint64_t roundedS)
-{
-	uint64_t slot = (roundedS - grp->S) >> grp->slot_shift;
-	unsigned int i = (grp->front + slot) % QFQ_MAX_SLOTS;
-
-	cl->next = grp->slots[i];
-	grp->slots[i] = cl;
-	__set_bit(slot, &grp->full_slots);
-}
-
-/*
- * remove the entry from the slot
- */
-static inline void
-qfq_front_slot_remove(struct qfq_group *grp)
-{
-	struct qfq_class **h = &grp->slots[grp->front];
-
-	*h = (*h)->next;
-	if (!*h)
-		__clear_bit(0, &grp->full_slots);
-}
-
-/*
- * Returns the first full queue in a group. As a side effect,
- * adjust the bucket list so the first non-empty bucket is at
- * position 0 in full_slots.
- */
-static inline struct qfq_class *
-qfq_slot_scan(struct qfq_group *grp)
-{
-	int i;
-
-	ND("grp %d full %x", grp->index, grp->full_slots);
-	if (!grp->full_slots)
-		return NULL;
-
-	i = ffs(grp->full_slots) - 1; // zero-based
-	if (i > 0) {
-		grp->front = (grp->front + i) % QFQ_MAX_SLOTS;
-		grp->full_slots >>= i;
-	}
-
-	return grp->slots[grp->front];
-}
-
-/*
- * adjust the bucket list. When the start time of a group decreases,
- * we move the index down (modulo QFQ_MAX_SLOTS) so we don't need to
- * move the objects. The mask of occupied slots must be shifted
- * because we use ffs() to find the first non-empty slot.
- * This covers decreases in the group's start time, but what about
- * increases of the start time ?
- * Here too we should make sure that i is less than 32
- */
-static inline void
-qfq_slot_rotate(struct qfq_sched *q, struct qfq_group *grp, uint64_t roundedS)
-{
-	unsigned int i = (grp->S - roundedS) >> grp->slot_shift;
-
-	grp->full_slots <<= i;
-	grp->front = (grp->front - i) % QFQ_MAX_SLOTS;
-}
-
-
-static inline void
-qfq_update_eligible(struct qfq_sched *q, uint64_t old_V)
-{
-	bitmap ineligible;
-
-	ineligible = q->bitmaps[IR] | q->bitmaps[IB];
-	if (ineligible) {
-		if (!q->bitmaps[ER]) {
-			struct qfq_group *grp;
-			grp = qfq_ffs(q, ineligible);
-			if (qfq_gt(grp->S, q->V))
-				q->V = grp->S;
-		}
-		qfq_make_eligible(q, old_V);
-	}
-}
-
-/*
- * Updates the class, returns true if also the group needs to be updated.
- */
-static inline int
-qfq_update_class(struct qfq_sched *q, struct qfq_group *grp,
-	    struct qfq_class *cl)
-{
-
-	cl->S = cl->F;
-	if (cl->_q.mq.head == NULL)  {
-		qfq_front_slot_remove(grp);
-	} else {
-		unsigned int len;
-		uint64_t roundedS;
-
-		len = cl->_q.mq.head->m_pkthdr.len;
-		cl->F = cl->S + (uint64_t)len * cl->inv_w;
-		roundedS = qfq_round_down(cl->S, grp->slot_shift);
-		if (roundedS == grp->S)
-			return 0;
-
-		qfq_front_slot_remove(grp);
-		qfq_slot_insert(grp, cl, roundedS);
-	}
-	return 1;
-}
-
-static struct mbuf *
-qfq_dequeue(struct dn_sch_inst *si)
-{
-	struct qfq_sched *q = (struct qfq_sched *)(si + 1);
-	struct qfq_group *grp;
-	struct qfq_class *cl;
-	struct mbuf *m;
-	uint64_t old_V;
-
-	NO(q->loops++;)
-	if (!q->bitmaps[ER]) {
-		NO(if (q->queued)
-			dump_sched(q, "start dequeue");)
-		return NULL;
-	}
-
-	grp = qfq_ffs(q, q->bitmaps[ER]);
-
-	cl = grp->slots[grp->front];
-	/* extract from the first bucket in the bucket list */
-	m = dn_dequeue(&cl->_q);
-
-	if (!m) {
-		D("BUG/* non-workconserving leaf */");
-		return NULL;
-	}
-	NO(q->queued--;)
-	old_V = q->V;
-	q->V += (uint64_t)m->m_pkthdr.len * IWSUM;
-	ND("m is %p F 0x%llx V now 0x%llx", m, cl->F, q->V);
-
-	if (qfq_update_class(q, grp, cl)) {
-		uint64_t old_F = grp->F;
-		cl = qfq_slot_scan(grp);
-		if (!cl) { /* group gone, remove from ER */
-			__clear_bit(grp->index, &q->bitmaps[ER]);
-			// grp->S = grp->F + 1; // XXX debugging only
-		} else {
-			uint64_t roundedS = qfq_round_down(cl->S, grp->slot_shift);
-			unsigned int s;
-
-			if (grp->S == roundedS)
-				goto skip_unblock;
-			grp->S = roundedS;
-			grp->F = roundedS + (2ULL << grp->slot_shift);
-			/* remove from ER and put in the new set */
-			__clear_bit(grp->index, &q->bitmaps[ER]);
-			s = qfq_calc_state(q, grp);
-			__set_bit(grp->index, &q->bitmaps[s]);
-		}
-		/* we need to unblock even if the group has gone away */
-		qfq_unblock_groups(q, grp->index, old_F);
-	}
-
-skip_unblock:
-	qfq_update_eligible(q, old_V);
-	NO(if (!q->bitmaps[ER] && q->queued)
-		dump_sched(q, "end dequeue");)
-
-	return m;
-}
-
-/*
- * Assign a reasonable start time for a new flow k in group i.
- * Admissible values for \hat(F) are multiples of \sigma_i
- * no greater than V+\sigma_i . Larger values mean that
- * we had a wraparound so we consider the timestamp to be stale.
- *
- * If F is not stale and F >= V then we set S = F.
- * Otherwise we should assign S = V, but this may violate
- * the ordering in ER. So, if we have groups in ER, set S to
- * the F_j of the first group j which would be blocking us.
- * We are guaranteed not to move S backward because
- * otherwise our group i would still be blocked.
- */
-static inline void
-qfq_update_start(struct qfq_sched *q, struct qfq_class *cl)
-{
-	unsigned long mask;
-	uint64_t limit, roundedF;
-	int slot_shift = cl->grp->slot_shift;
-
-	roundedF = qfq_round_down(cl->F, slot_shift);
-	limit = qfq_round_down(q->V, slot_shift) + (1UL << slot_shift);
-
-	if (!qfq_gt(cl->F, q->V) || qfq_gt(roundedF, limit)) {
-		/* timestamp was stale */
-		mask = mask_from(q->bitmaps[ER], cl->grp->index);
-		if (mask) {
-			struct qfq_group *next = qfq_ffs(q, mask);
-			if (qfq_gt(roundedF, next->F)) {
-				cl->S = next->F;
-				return;
-			}
-		}
-		cl->S = q->V;
-	} else { /* timestamp is not stale */
-		cl->S = cl->F;
-	}
-}
-
-static int
-qfq_enqueue(struct dn_sch_inst *si, struct dn_queue *_q, struct mbuf *m)
-{
-	struct qfq_sched *q = (struct qfq_sched *)(si + 1);
-	struct qfq_group *grp;
-	struct qfq_class *cl = (struct qfq_class *)_q;
-	uint64_t roundedS;
-	int s;
-
-	NO(q->loops++;)
-	DX(4, "len %d flow %p inv_w 0x%x grp %d", m->m_pkthdr.len,
-		_q, cl->inv_w, cl->grp->index);
-	/* XXX verify that the packet obeys the parameters */
-	if (m != _q->mq.head) {
-		if (dn_enqueue(_q, m, 0)) /* packet was dropped */
-			return 1;
-		NO(q->queued++;)
-		if (m != _q->mq.head)
-			return 0;
-	}
-	/* If reach this point, queue q was idle */
-	grp = cl->grp;
-	qfq_update_start(q, cl); /* adjust start time */
-	/* compute new finish time and rounded start. */
-	cl->F = cl->S + (uint64_t)(m->m_pkthdr.len) * cl->inv_w;
-	roundedS = qfq_round_down(cl->S, grp->slot_shift);
-
-	/*
-	 * insert cl in the correct bucket.
-	 * If cl->S >= grp->S we don't need to adjust the
-	 * bucket list and simply go to the insertion phase.
-	 * Otherwise grp->S is decreasing, we must make room
-	 * in the bucket list, and also recompute the group state.
-	 * Finally, if there were no flows in this group and nobody
-	 * was in ER make sure to adjust V.
-	 */
-	if (grp->full_slots) {
-		if (!qfq_gt(grp->S, cl->S))
-			goto skip_update;
-		/* create a slot for this cl->S */
-		qfq_slot_rotate(q, grp, roundedS);
-		/* group was surely ineligible, remove */
-		__clear_bit(grp->index, &q->bitmaps[IR]);
-		__clear_bit(grp->index, &q->bitmaps[IB]);
-	} else if (!q->bitmaps[ER] && qfq_gt(roundedS, q->V))
-		q->V = roundedS;
-
-	grp->S = roundedS;
-	grp->F = roundedS + (2ULL << grp->slot_shift); // i.e. 2\sigma_i
-	s = qfq_calc_state(q, grp);
-	__set_bit(grp->index, &q->bitmaps[s]);
-	ND("new state %d 0x%x", s, q->bitmaps[s]);
-	ND("S %llx F %llx V %llx", cl->S, cl->F, q->V);
-skip_update:
-	qfq_slot_insert(grp, cl, roundedS);
-
-	return 0;
-}
-
-
-#if 0
-static inline void
-qfq_slot_remove(struct qfq_sched *q, struct qfq_group *grp,
-	struct qfq_class *cl, struct qfq_class **pprev)
-{
-	unsigned int i, offset;
-	uint64_t roundedS;
-
-	roundedS = qfq_round_down(cl->S, grp->slot_shift);
-	offset = (roundedS - grp->S) >> grp->slot_shift;
-	i = (grp->front + offset) % QFQ_MAX_SLOTS;
-
-#ifdef notyet
-	if (!pprev) {
-		pprev = &grp->slots[i];
-		while (*pprev && *pprev != cl)
-			pprev = &(*pprev)->next;
-	}
-#endif
-
-	*pprev = cl->next;
-	if (!grp->slots[i])
-		__clear_bit(offset, &grp->full_slots);
-}
-
-/*
- * called to forcibly destroy a queue.
- * If the queue is not in the front bucket, or if it has
- * other queues in the front bucket, we can simply remove
- * the queue with no other side effects.
- * Otherwise we must propagate the event up.
- * XXX description to be completed.
- */
-static void
-qfq_deactivate_class(struct qfq_sched *q, struct qfq_class *cl,
-				 struct qfq_class **pprev)
-{
-	struct qfq_group *grp = &q->groups[cl->index];
-	unsigned long mask;
-	uint64_t roundedS;
-	int s;
-
-	cl->F = cl->S;	// not needed if the class goes away.
-	qfq_slot_remove(q, grp, cl, pprev);
-
-	if (!grp->full_slots) {
-		/* nothing left in the group, remove from all sets.
-		 * Do ER last because if we were blocking other groups
-		 * we must unblock them.
-		 */
-		__clear_bit(grp->index, &q->bitmaps[IR]);
-		__clear_bit(grp->index, &q->bitmaps[EB]);
-		__clear_bit(grp->index, &q->bitmaps[IB]);
-
-		if (test_bit(grp->index, &q->bitmaps[ER]) &&
-		    !(q->bitmaps[ER] & ~((1UL << grp->index) - 1))) {
-			mask = q->bitmaps[ER] & ((1UL << grp->index) - 1);
-			if (mask)
-				mask = ~((1UL << __fls(mask)) - 1);
-			else
-				mask = ~0UL;
-			qfq_move_groups(q, mask, EB, ER);
-			qfq_move_groups(q, mask, IB, IR);
-		}
-		__clear_bit(grp->index, &q->bitmaps[ER]);
-	} else if (!grp->slots[grp->front]) {
-		cl = qfq_slot_scan(grp);
-		roundedS = qfq_round_down(cl->S, grp->slot_shift);
-		if (grp->S != roundedS) {
-			__clear_bit(grp->index, &q->bitmaps[ER]);
-			__clear_bit(grp->index, &q->bitmaps[IR]);
-			__clear_bit(grp->index, &q->bitmaps[EB]);
-			__clear_bit(grp->index, &q->bitmaps[IB]);
-			grp->S = roundedS;
-			grp->F = roundedS + (2ULL << grp->slot_shift);
-			s = qfq_calc_state(q, grp);
-			__set_bit(grp->index, &q->bitmaps[s]);
-		}
-	}
-	qfq_update_eligible(q, q->V);
-}
-#endif
-
-static int
-qfq_new_fsk(struct dn_fsk *f)
-{
-	ipdn_bound_var(&f->fs.par[0], 1, 1, QFQ_MAX_WEIGHT, "qfq weight");
-	ipdn_bound_var(&f->fs.par[1], 1500, 1, 2000, "qfq maxlen");
-	ND("weight %d len %d\n", f->fs.par[0], f->fs.par[1]);
-	return 0;
-}
-
-/*
- * initialize a new scheduler instance
- */
-static int
-qfq_new_sched(struct dn_sch_inst *si)
-{
-	struct qfq_sched *q = (struct qfq_sched *)(si + 1);
-	struct qfq_group *grp;
-	int i;
-
-	for (i = 0; i <= QFQ_MAX_INDEX; i++) {
-		grp = &q->groups[i];
-		grp->index = i;
-		grp->slot_shift = QFQ_MTU_SHIFT + FRAC_BITS -
-					(QFQ_MAX_INDEX - i);
-	}
-	return 0;
-}
-
-/*
- * QFQ scheduler descriptor
- */
-static struct dn_alg qfq_desc = {
-	_SI( .type = ) DN_SCHED_QFQ,
-	_SI( .name = ) "QFQ",
-	_SI( .flags = ) DN_MULTIQUEUE,
-
-	_SI( .schk_datalen = ) 0,
-	_SI( .si_datalen = ) sizeof(struct qfq_sched),
-	_SI( .q_datalen = ) sizeof(struct qfq_class) - sizeof(struct dn_queue),
-
-	_SI( .enqueue = ) qfq_enqueue,
-	_SI( .dequeue = ) qfq_dequeue,
-
-	_SI( .config = )  NULL,
-	_SI( .destroy = )  NULL,
-	_SI( .new_sched = ) qfq_new_sched,
-	_SI( .free_sched = )  NULL,
-	_SI( .new_fsk = ) qfq_new_fsk,
-	_SI( .free_fsk = )  NULL,
-	_SI( .new_queue = ) qfq_new_queue,
-	_SI( .free_queue = ) qfq_free_queue,
-};
-
-DECLARE_DNSCHED_MODULE(dn_qfq, &qfq_desc);
-
-#ifdef QFQ_DEBUG
-static void
-dump_groups(struct qfq_sched *q, uint32_t mask)
-{
-	int i, j;
-
-	for (i = 0; i < QFQ_MAX_INDEX + 1; i++) {
-		struct qfq_group *g = &q->groups[i];
-
-		if (0 == (mask & (1<<i)))
-			continue;
-		for (j = 0; j < QFQ_MAX_SLOTS; j++) {
-			if (g->slots[j])
-				D("    bucket %d %p", j, g->slots[j]);
-		}
-		D("full_slots 0x%x", g->full_slots);
-		D("        %2d S 0x%20llx F 0x%llx %c", i,
-			g->S, g->F,
-			mask & (1<<i) ? '1' : '0');
-	}
-}
-
-static void
-dump_sched(struct qfq_sched *q, const char *msg)
-{
-	D("--- in %s: ---", msg);
-	ND("loops %d queued %d V 0x%llx", q->loops, q->queued, q->V);
-	D("    ER 0x%08x", q->bitmaps[ER]);
-	D("    EB 0x%08x", q->bitmaps[EB]);
-	D("    IR 0x%08x", q->bitmaps[IR]);
-	D("    IB 0x%08x", q->bitmaps[IB]);
-	dump_groups(q, 0xffffffff);
-};
-#endif /* QFQ_DEBUG */
diff --git a/sys/netinet/ipfw/dn_sched_rr.c b/sys/netinet/ipfw/dn_sched_rr.c
deleted file mode 100644
index 1bbd80057c3f..000000000000
--- a/sys/netinet/ipfw/dn_sched_rr.c
+++ /dev/null
@@ -1,307 +0,0 @@
-/*
- * Copyright (c) 2010 Riccardo Panicucci, Universita` di Pisa
- * All rights reserved
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-/*
- * $FreeBSD$
- */
-
-#ifdef _KERNEL
-#include <sys/malloc.h>
-#include <sys/socket.h>
-#include <sys/socketvar.h>
-#include <sys/kernel.h>
-#include <sys/mbuf.h>
-#include <sys/module.h>
-#include <net/if.h>	/* IFNAMSIZ */
-#include <netinet/in.h>
-#include <netinet/ip_var.h>		/* ipfw_rule_ref */
-#include <netinet/ip_fw.h>	/* flow_id */
-#include <netinet/ip_dummynet.h>
-#include <netinet/ipfw/dn_heap.h>
-#include <netinet/ipfw/ip_dn_private.h>
-#include <netinet/ipfw/dn_sched.h>
-#else
-#include <dn_test.h>
-#endif
-
-#define DN_SCHED_RR	3 // XXX Where?
-
-struct rr_queue {
-	struct dn_queue q;		/* Standard queue */
-	int status;			/* 1: queue is in the list */
-	int credit;			/* Number of bytes to transmit */
-	int quantum;			/* quantum * C */
-	struct rr_queue *qnext;		/* */
-};
-
-/* struct rr_schk contains global config parameters
- * and is right after dn_schk
- */
-struct rr_schk {
-	int min_q;		/* Min quantum */
-	int max_q;		/* Max quantum */
-	int q_bytes;		/* Bytes per quantum */
-};
-
-/* per-instance round robin list, right after dn_sch_inst */
-struct rr_si {
-	struct rr_queue *head, *tail;	/* Pointer to current queue */
-};
-
-/* Append a queue to the rr list */
-static inline void
-rr_append(struct rr_queue *q, struct rr_si *si)
-{
-	q->status = 1;		/* mark as in-rr_list */
-	q->credit = q->quantum;	/* initialize credit */
-
-	/* append to the tail */
-	if (si->head == NULL)
-		si->head = q;
-	else
-		si->tail->qnext = q;
-	si->tail = q;		/* advance the tail pointer */
-	q->qnext = si->head;	/* make it circular */
-}
-
-/* Remove the head queue from circular list. */
-static inline void
-rr_remove_head(struct rr_si *si)
-{
-	if (si->head == NULL)
-		return; /* empty queue */
-	si->head->status = 0;
-
-	if (si->head == si->tail) {
-		si->head = si->tail = NULL;
-		return;
-	}
-
-	si->head = si->head->qnext;
-	si->tail->qnext = si->head;
-}
-
-/* Remove a queue from circular list.
- * XXX see if ti can be merge with remove_queue()
- */
-static inline void
-remove_queue_q(struct rr_queue *q, struct rr_si *si)
-{
-	struct rr_queue *prev;
-
-	if (q->status != 1)
-		return;
-	if (q == si->head) {
-		rr_remove_head(si);
-		return;
-	}
-
-	for (prev = si->head; prev; prev = prev->qnext) {
-		if (prev->qnext != q)
-			continue;
-		prev->qnext = q->qnext;
-		if (q == si->tail)
-			si->tail = prev;
-		q->status = 0;
-		break;
-	}
-}
-
-
-static inline void
-next_pointer(struct rr_si *si)
-{
-	if (si->head == NULL)
-		return; /* empty queue */
-
-	si->head = si->head->qnext;
-	si->tail = si->tail->qnext;
-}
-
-static int
-rr_enqueue(struct dn_sch_inst *_si, struct dn_queue *q, struct mbuf *m)
-{
-	struct rr_si *si;
-	struct rr_queue *rrq;
-
-	if (m != q->mq.head) {
-		if (dn_enqueue(q, m, 0)) /* packet was dropped */
-			return 1;
-		if (m != q->mq.head)
-			return 0;
-	}
-
-	/* If reach this point, queue q was idle */
-	si = (struct rr_si *)(_si + 1);
-	rrq = (struct rr_queue *)q;
-
-	if (rrq->status == 1) /* Queue is already in the queue list */
-		return 0;
-
-	/* Insert the queue in the queue list */
-	rr_append(rrq, si);
-
-	return 0;
-}
-
-static struct mbuf *
-rr_dequeue(struct dn_sch_inst *_si)
-{
-	/* Access scheduler instance private data */
-	struct rr_si *si = (struct rr_si *)(_si + 1);
-	struct rr_queue *rrq;
-	uint64_t len;
-
-	while ( (rrq = si->head) ) {
-		struct mbuf *m = rrq->q.mq.head;
-		if ( m == NULL) {
-			/* empty queue, remove from list */
-			rr_remove_head(si);
-			continue;
-		}
-		len = m->m_pkthdr.len;
-
-		if (len > rrq->credit) {
-			/* Packet too big */
-			rrq->credit += rrq->quantum;
-			/* Try next queue */
-			next_pointer(si);
-		} else {
-			rrq->credit -= len;
-			return dn_dequeue(&rrq->q);
-		}
-	}
-
-	/* no packet to dequeue*/
-	return NULL;
-}
-
-static int
-rr_config(struct dn_schk *_schk)
-{
-	struct rr_schk *schk = (struct rr_schk *)(_schk + 1);
-	ND("called");
-
-	/* use reasonable quantums (64..2k bytes, default 1500) */
-	schk->min_q = 64;
-	schk->max_q = 2048;
-	schk->q_bytes = 1500;	/* quantum */
-
-	return 0;
-}
-
-static int
-rr_new_sched(struct dn_sch_inst *_si)
-{
-	struct rr_si *si = (struct rr_si *)(_si + 1);
-
-	ND("called");
-	si->head = si->tail = NULL;
-
-	return 0;
-}
-
-static int
-rr_free_sched(struct dn_sch_inst *_si)
-{
-	ND("called");
-	/* Nothing to do? */
-	return 0;
-}
-
-static int
-rr_new_fsk(struct dn_fsk *fs)
-{
-	struct rr_schk *schk = (struct rr_schk *)(fs->sched + 1);
-	/* par[0] is the weight, par[1] is the quantum step */
-	ipdn_bound_var(&fs->fs.par[0], 1,
-		1, 65536, "RR weight");
-	ipdn_bound_var(&fs->fs.par[1], schk->q_bytes,
-		schk->min_q, schk->max_q, "RR quantum");
-	return 0;
-}
-
-static int
-rr_new_queue(struct dn_queue *_q)
-{
-	struct rr_queue *q = (struct rr_queue *)_q;
-
-	_q->ni.oid.subtype = DN_SCHED_RR;
-
-	q->quantum = _q->fs->fs.par[0] * _q->fs->fs.par[1];
-	ND("called, q->quantum %d", q->quantum);
-	q->credit = q->quantum;
-	q->status = 0;
-
-	if (_q->mq.head != NULL) {
-		/* Queue NOT empty, insert in the queue list */
-		rr_append(q, (struct rr_si *)(_q->_si + 1));
-	}
-	return 0;
-}
-
-static int
-rr_free_queue(struct dn_queue *_q)
-{
-	struct rr_queue *q = (struct rr_queue *)_q;
-
-	ND("called");
-	if (q->status == 1) {
-		struct rr_si *si = (struct rr_si *)(_q->_si + 1);
-		remove_queue_q(q, si);
-	}
-	return 0;
-}
-
-/*
- * RR scheduler descriptor
- * contains the type of the scheduler, the name, the size of the
- * structures and function pointers.
- */
-static struct dn_alg rr_desc = {
-	_SI( .type = ) DN_SCHED_RR,
-	_SI( .name = ) "RR",
-	_SI( .flags = ) DN_MULTIQUEUE,
-
-	_SI( .schk_datalen = ) 0,
-	_SI( .si_datalen = ) sizeof(struct rr_si),
-	_SI( .q_datalen = ) sizeof(struct rr_queue) - sizeof(struct dn_queue),
-
-	_SI( .enqueue = ) rr_enqueue,
-	_SI( .dequeue = ) rr_dequeue,
-
-	_SI( .config = ) rr_config,
-	_SI( .destroy = ) NULL,
-	_SI( .new_sched = ) rr_new_sched,
-	_SI( .free_sched = ) rr_free_sched,
-	_SI( .new_fsk = ) rr_new_fsk,
-	_SI( .free_fsk = ) NULL,
-	_SI( .new_queue = ) rr_new_queue,
-	_SI( .free_queue = ) rr_free_queue,
-};
-
-
-DECLARE_DNSCHED_MODULE(dn_rr, &rr_desc);
diff --git a/sys/netinet/ipfw/dn_sched_wf2q.c b/sys/netinet/ipfw/dn_sched_wf2q.c
deleted file mode 100644
index 7f16719d3788..000000000000
--- a/sys/netinet/ipfw/dn_sched_wf2q.c
+++ /dev/null
@@ -1,373 +0,0 @@
-/*
- * Copyright (c) 2010 Riccardo Panicucci, Universita` di Pisa
- * Copyright (c) 2000-2002 Luigi Rizzo, Universita` di Pisa
- * All rights reserved
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-/*
- * $FreeBSD$
- */
-
-#ifdef _KERNEL
-#include <sys/malloc.h>
-#include <sys/socket.h>
-#include <sys/socketvar.h>
-#include <sys/kernel.h>
-#include <sys/mbuf.h>
-#include <sys/module.h>
-#include <net/if.h>	/* IFNAMSIZ */
-#include <netinet/in.h>
-#include <netinet/ip_var.h>		/* ipfw_rule_ref */
-#include <netinet/ip_fw.h>	/* flow_id */
-#include <netinet/ip_dummynet.h>
-#include <netinet/ipfw/dn_heap.h>
-#include <netinet/ipfw/ip_dn_private.h>
-#include <netinet/ipfw/dn_sched.h>
-#else
-#include <dn_test.h>
-#endif
-
-#ifndef MAX64
-#define MAX64(x,y)  (( (int64_t) ( (y)-(x) )) > 0 ) ? (y) : (x)
-#endif
-
-/*
- * timestamps are computed on 64 bit using fixed point arithmetic.
- * LMAX_BITS, WMAX_BITS are the max number of bits for the packet len
- * and sum of weights, respectively. FRAC_BITS is the number of
- * fractional bits. We want FRAC_BITS >> WMAX_BITS to avoid too large
- * errors when computing the inverse, FRAC_BITS < 32 so we can do 1/w
- * using an unsigned 32-bit division, and to avoid wraparounds we need
- * LMAX_BITS + WMAX_BITS + FRAC_BITS << 64
- * As an example
- * FRAC_BITS = 26, LMAX_BITS=14, WMAX_BITS = 19
- */
-#ifndef FRAC_BITS
-#define FRAC_BITS    28 /* shift for fixed point arithmetic */
-#define	ONE_FP	(1UL << FRAC_BITS)
-#endif
-
-/*
- * Private information for the scheduler instance:
- * sch_heap (key is Finish time) returns the next queue to serve
- * ne_heap (key is Start time) stores not-eligible queues
- * idle_heap (key=start/finish time) stores idle flows. It must
- *	support extract-from-middle.
- * A flow is only in 1 of the three heaps.
- * XXX todo: use a more efficient data structure, e.g. a tree sorted
- * by F with min_subtree(S) in each node
- */
-struct wf2qp_si {
-    struct dn_heap sch_heap;	/* top extract - key Finish  time */
-    struct dn_heap ne_heap;	/* top extract - key Start   time */
-    struct dn_heap idle_heap;	/* random extract - key Start=Finish time */
-    uint64_t V;			/* virtual time */
-    uint32_t inv_wsum;		/* inverse of sum of weights */
-    uint32_t wsum;		/* sum of weights */
-};
-
-struct wf2qp_queue {
-    struct dn_queue _q;
-    uint64_t S, F;		/* start time, finish time */
-    uint32_t inv_w;		/* ONE_FP / weight */
-    int32_t heap_pos;		/* position (index) of struct in heap */
-};
-
-/*
- * This file implements a WF2Q+ scheduler as it has been in dummynet
- * since 2000.
- * The scheduler supports per-flow queues and has O(log N) complexity.
- *
- * WF2Q+ needs to drain entries from the idle heap so that we
- * can keep the sum of weights up to date. We can do it whenever
- * we get a chance, or periodically, or following some other
- * strategy. The function idle_check() drains at most N elements
- * from the idle heap.
- */
-static void
-idle_check(struct wf2qp_si *si, int n, int force)
-{
-    struct dn_heap *h = &si->idle_heap;
-    while (n-- > 0 && h->elements > 0 &&
-		(force || DN_KEY_LT(HEAP_TOP(h)->key, si->V))) {
-	struct dn_queue *q = HEAP_TOP(h)->object;
-        struct wf2qp_queue *alg_fq = (struct wf2qp_queue *)q;
-
-        heap_extract(h, NULL);
-        /* XXX to let the flowset delete the queue we should
-	 * mark it as 'unused' by the scheduler.
-	 */
-        alg_fq->S = alg_fq->F + 1; /* Mark timestamp as invalid. */
-        si->wsum -= q->fs->fs.par[0];	/* adjust sum of weights */
-	if (si->wsum > 0)
-		si->inv_wsum = ONE_FP/si->wsum;
-    }
-}
-
-static int
-wf2qp_enqueue(struct dn_sch_inst *_si, struct dn_queue *q, struct mbuf *m)
-{
-    struct dn_fsk *fs = q->fs;
-    struct wf2qp_si *si = (struct wf2qp_si *)(_si + 1);
-    struct wf2qp_queue *alg_fq;
-    uint64_t len = m->m_pkthdr.len;
-
-    if (m != q->mq.head) {
-	if (dn_enqueue(q, m, 0)) /* packet was dropped */
-	    return 1;
-	if (m != q->mq.head)	/* queue was already busy */
-	    return 0;
-    }
-
-    /* If reach this point, queue q was idle */
-    alg_fq = (struct wf2qp_queue *)q;
-
-    if (DN_KEY_LT(alg_fq->F, alg_fq->S)) {
-        /* F<S means timestamps are invalid ->brand new queue. */
-        alg_fq->S = si->V;		/* init start time */
-        si->wsum += fs->fs.par[0];	/* add weight of new queue. */
-	si->inv_wsum = ONE_FP/si->wsum;
-    } else { /* if it was idle then it was in the idle heap */
-        heap_extract(&si->idle_heap, q);
-        alg_fq->S = MAX64(alg_fq->F, si->V);	/* compute new S */
-    }
-    alg_fq->F = alg_fq->S + len * alg_fq->inv_w;
-
-    /* if nothing is backlogged, make sure this flow is eligible */
-    if (si->ne_heap.elements == 0 && si->sch_heap.elements == 0)
-        si->V = MAX64(alg_fq->S, si->V);
-
-    /*
-     * Look at eligibility. A flow is not eligibile if S>V (when
-     * this happens, it means that there is some other flow already
-     * scheduled for the same pipe, so the sch_heap cannot be
-     * empty). If the flow is not eligible we just store it in the
-     * ne_heap. Otherwise, we store in the sch_heap.
-     * Note that for all flows in sch_heap (SCH), S_i <= V,
-     * and for all flows in ne_heap (NEH), S_i > V.
-     * So when we need to compute max(V, min(S_i)) forall i in
-     * SCH+NEH, we only need to look into NEH.
-     */
-    if (DN_KEY_LT(si->V, alg_fq->S)) {
-        /* S>V means flow Not eligible. */
-        if (si->sch_heap.elements == 0)
-            D("++ ouch! not eligible but empty scheduler!");
-        heap_insert(&si->ne_heap, alg_fq->S, q);
-    } else {
-        heap_insert(&si->sch_heap, alg_fq->F, q);
-    }
-    return 0;
-}
-
-/* XXX invariant: sch > 0 || V >= min(S in neh) */
-static struct mbuf *
-wf2qp_dequeue(struct dn_sch_inst *_si)
-{
-	/* Access scheduler instance private data */
-	struct wf2qp_si *si = (struct wf2qp_si *)(_si + 1);
-	struct mbuf *m;
-	struct dn_queue *q;
-	struct dn_heap *sch = &si->sch_heap;
-	struct dn_heap *neh = &si->ne_heap;
-	struct wf2qp_queue *alg_fq;
-
-	if (sch->elements == 0 && neh->elements == 0) {
-		/* we have nothing to do. We could kill the idle heap
-		 * altogether and reset V
-		 */
-		idle_check(si, 0x7fffffff, 1);
-		si->V = 0;
-		si->wsum = 0;	/* should be set already */
-		return NULL;	/* quick return if nothing to do */
-	}
-	idle_check(si, 1, 0);	/* drain something from the idle heap */
-
-	/* make sure at least one element is eligible, bumping V
-	 * and moving entries that have become eligible.
-	 * We need to repeat the first part twice, before and
-	 * after extracting the candidate, or enqueue() will
-	 * find the data structure in a wrong state.
-	 */
-  m = NULL;
-  for(;;) {
-	/*
-	 * Compute V = max(V, min(S_i)). Remember that all elements
-	 * in sch have by definition S_i <= V so if sch is not empty,
-	 * V is surely the max and we must not update it. Conversely,
-	 * if sch is empty we only need to look at neh.
-	 * We don't need to move the queues, as it will be done at the
-	 * next enqueue
-	 */
-	if (sch->elements == 0 && neh->elements > 0) {
-		si->V = MAX64(si->V, HEAP_TOP(neh)->key);
-	}
-	while (neh->elements > 0 &&
-		    DN_KEY_LEQ(HEAP_TOP(neh)->key, si->V)) {
-		q = HEAP_TOP(neh)->object;
-		alg_fq = (struct wf2qp_queue *)q;
-		heap_extract(neh, NULL);
-		heap_insert(sch, alg_fq->F, q);
-	}
-	if (m) /* pkt found in previous iteration */
-		break;
-	/* ok we have at least one eligible pkt */
-	q = HEAP_TOP(sch)->object;
-	alg_fq = (struct wf2qp_queue *)q;
-	m = dn_dequeue(q);
-	heap_extract(sch, NULL); /* Remove queue from heap. */
-	si->V += (uint64_t)(m->m_pkthdr.len) * si->inv_wsum;
-	alg_fq->S = alg_fq->F;  /* Update start time. */
-	if (q->mq.head == 0) {	/* not backlogged any more. */
-		heap_insert(&si->idle_heap, alg_fq->F, q);
-	} else {			/* Still backlogged. */
-		/* Update F, store in neh or sch */
-		uint64_t len = q->mq.head->m_pkthdr.len;
-		alg_fq->F += len * alg_fq->inv_w;
-		if (DN_KEY_LEQ(alg_fq->S, si->V)) {
-			heap_insert(sch, alg_fq->F, q);
-		} else {
-			heap_insert(neh, alg_fq->S, q);
-		}
-	}
-    }
-	return m;
-}
-
-static int
-wf2qp_new_sched(struct dn_sch_inst *_si)
-{
-	struct wf2qp_si *si = (struct wf2qp_si *)(_si + 1);
-	int ofs = offsetof(struct wf2qp_queue, heap_pos);
-
-	/* all heaps support extract from middle */
-	if (heap_init(&si->idle_heap, 16, ofs) ||
-	    heap_init(&si->sch_heap, 16, ofs) ||
-	    heap_init(&si->ne_heap, 16, ofs)) {
-		heap_free(&si->ne_heap);
-		heap_free(&si->sch_heap);
-		heap_free(&si->idle_heap);
-		return ENOMEM;
-	}
-	return 0;
-}
-
-static int
-wf2qp_free_sched(struct dn_sch_inst *_si)
-{
-	struct wf2qp_si *si = (struct wf2qp_si *)(_si + 1);
-
-	heap_free(&si->sch_heap);
-	heap_free(&si->ne_heap);
-	heap_free(&si->idle_heap);
-
-	return 0;
-}
-
-static int
-wf2qp_new_fsk(struct dn_fsk *fs)
-{
-	ipdn_bound_var(&fs->fs.par[0], 1,
-		1, 100, "WF2Q+ weight");
-	return 0;
-}
-
-static int
-wf2qp_new_queue(struct dn_queue *_q)
-{
-	struct wf2qp_queue *q = (struct wf2qp_queue *)_q;
-
-	_q->ni.oid.subtype = DN_SCHED_WF2QP;
-	q->F = 0;	/* not strictly necessary */
-	q->S = q->F + 1;    /* mark timestamp as invalid. */
-        q->inv_w = ONE_FP / _q->fs->fs.par[0];
-	if (_q->mq.head != NULL) {
-		wf2qp_enqueue(_q->_si, _q, _q->mq.head);
-	}
-	return 0;
-}
-
-/*
- * Called when the infrastructure removes a queue (e.g. flowset
- * is reconfigured). Nothing to do if we did not 'own' the queue,
- * otherwise remove it from the right heap and adjust the sum
- * of weights.
- */
-static int
-wf2qp_free_queue(struct dn_queue *q)
-{
-	struct wf2qp_queue *alg_fq = (struct wf2qp_queue *)q;
-	struct wf2qp_si *si = (struct wf2qp_si *)(q->_si + 1);
-
-	if (alg_fq->S >= alg_fq->F + 1)
-		return 0;	/* nothing to do, not in any heap */
-	si->wsum -= q->fs->fs.par[0];
-	if (si->wsum > 0)
-		si->inv_wsum = ONE_FP/si->wsum;
-
-	/* extract from the heap. XXX TODO we may need to adjust V
-	 * to make sure the invariants hold.
-	 */
-	if (q->mq.head == NULL) {
-		heap_extract(&si->idle_heap, q);
-	} else if (DN_KEY_LT(si->V, alg_fq->S)) {
-		heap_extract(&si->ne_heap, q);
-	} else {
-		heap_extract(&si->sch_heap, q);
-	}
-	return 0;
-}
-
-/*
- * WF2Q+ scheduler descriptor
- * contains the type of the scheduler, the name, the size of the
- * structures and function pointers.
- */
-static struct dn_alg wf2qp_desc = {
-	_SI( .type = ) DN_SCHED_WF2QP,
-	_SI( .name = ) "WF2Q+",
-	_SI( .flags = ) DN_MULTIQUEUE,
-
-	/* we need extra space in the si and the queue */
-	_SI( .schk_datalen = ) 0,
-	_SI( .si_datalen = ) sizeof(struct wf2qp_si),
-	_SI( .q_datalen = ) sizeof(struct wf2qp_queue) -
-				sizeof(struct dn_queue),
-
-	_SI( .enqueue = ) wf2qp_enqueue,
-	_SI( .dequeue = ) wf2qp_dequeue,
-
-	_SI( .config = )  NULL,
-	_SI( .destroy = )  NULL,
-	_SI( .new_sched = ) wf2qp_new_sched,
-	_SI( .free_sched = ) wf2qp_free_sched,
-
-	_SI( .new_fsk = ) wf2qp_new_fsk,
-	_SI( .free_fsk = )  NULL,
-
-	_SI( .new_queue = ) wf2qp_new_queue,
-	_SI( .free_queue = ) wf2qp_free_queue,
-};
-
-
-DECLARE_DNSCHED_MODULE(dn_wf2qp, &wf2qp_desc);
diff --git a/sys/netinet/ipfw/dummynet.txt b/sys/netinet/ipfw/dummynet.txt
deleted file mode 100644
index e4f30751b916..000000000000
--- a/sys/netinet/ipfw/dummynet.txt
+++ /dev/null
@@ -1,860 +0,0 @@
-#
-# $FreeBSD$
-#
-
-Notes on the internal structure of dummynet (2010 version)
-by Riccardo Panicucci and Luigi Rizzo
-Work supported by the EC project ONELAB2
-
-
-*********
-* INDEX *
-*********
-Implementation of new dummynet
-    Internal structure
-    Files
-Packet arrival
-    The reconfiguration routine
-dummynet_task()
-Configuration
-    Add a pipe
-    Add a scheduler
-    Add a flowset
-Listing object
-Delete of object
-    Delete a pipe
-    Delete a flowset
-    Delete a scheduler
-Compatibility with FreeBSD7.2 and FreeBSD 8 ipfw binary
-    ip_dummynet_glue.c
-    ip_fw_glue.c
-How to configure dummynet
-How to implement a new scheduler
-
-
-
-OPEN ISSUES
-------------------------------
-20100131 deleting RR causes infinite loop
-	presumably in the rr_free_queue() call -- seems to hang
-	forever when deleting a live flow
-------------------------------
-
-Dummynet is a traffic shaper and network emulator. Packets are
-selected by an external filter such as ipfw, and passed to the emulator
-with a tag such as "pipe 10" or "queue 5" which tells what to
-do with the packet. As an example
-
-	ipfw add queue 5 icmp from 10.0.0.2 to all
-
-All packets with the same tag belong to a "flowset", or a set
-of flows which can be further partitioned according to a mask.
-Flowsets are then passed to a scheduler for processing. The
-association of flowsets and schedulers is configurable e.g.
-
-	ipfw queue 5 config sched 10 weight 3 flow_mask xxxx
-	ipfw queue 8 config sched 10 weight 1 ...
-	ipfw queue 3 config sched 20 weight 1 ...
-
-"sched 10" represents one or more scheduler instances,
-selected through a mask on the 5-tuple itself.
-
-	ipfw sched 20 config type FIFO sched_mask yyy ...
-
-There are in fact two masks applied to each packet:
-+ the "sched_mask" sends packets arriving to a scheduler_id to
-  one of many instances.
-+ the "flow_mask" together with the flowset_id is used to
-  collect packets into independent flows on each scheduler.
-
-As an example, we can have
-	ipfw queue 5 config sched 10 flow_mask src-ip 0x000000ff
-	ipfw sched 10 config type WF2Q+ sched_mask src-ip 0xffffff00
-
-means that sched 10 will have one instance per /24 source subnet,
-and within that, each individual source will be a flow.
-	
-Internal structure
------------------
-Dummynet-related data is split into several data structures,
-part of them constituting the userland-kernel API, and others
-specific to the kernel.
-NOTE: for up-to-date details please look at the relevant source
-	headers (ip_dummynet.h, ip_dn_private.h, dn_sched.h)
-
-USERLAND-KERNEL API	(ip_dummynet.h)
-
-    struct dn_link:
-	contains data about the physical link such as
-	bandwith, delay, burst size;
-
-    struct dn_fs:
-	describes a flowset, i.e. a template for queues.
-	Main parameters are the scheduler we attach to, a flow_mask,
-	buckets, queue size, plr, weight, and other scheduler-specific
-	parameters.
-
-    struct dn_flow
-	contains information on a flow, including masks and
-	statistics
-
-    struct dn_sch:
-	defines a scheduler (and a link attached to it).
-	Parameters include scheduler type, sched_mask, number of
-	buckets, and possibly other scheduler-specific parameters,
-
-    struct dn_profile:
-	fields to simulate a delay profile
-
-
-KERNEL REPRESENTATION	(ip_dn_private.h)
-
-    struct mq
-	a queue of mbufs with head and tail.
-
-    struct dn_queue
-	individual queue of packets, created by a flowset using
-	flow_mask and attached to a scheduler instance selected
-	through sched_mask.
-	A dn_queue has a pointer to the dn_fsk (which in turn counts
-	how many queues point to it), a pointer to the
-	dn_sch_inst it attaches to, and is in a hash table in the
-	flowset. scheduler instances also should store queues in
-	their own containers used for scheduling (lists, trees, etc.)
-	CREATE: done on packet arrivals when a flow matches a flowset.
-	DELETE: done only when deleting the parent dn_sch_inst
-		or draining memory.
-
-    struct dn_fsk
-	includes a dn_fs; a pointer to the dn_schk; a link field
-	for the list of dn_fsk attached to the same scheduler,
-	or for the unlinked list;
-	a refcount for the number of queues pointing to it;
-	The dn_fsk is in a hash table, fshash.
-	CREATE: done on configuration commands.
-	DELETE: on configuration commands.
-
-    struct dn_sch_inst
-	a scheduler instance, created from a dn_schk applying sched_mask.
-	Contains a delay line, a reference to the parent, and scheduler-
-	specific info.  Both dn_sch_inst and its delay line can be in the
-	evheap if they have events to be processed.
-	CREATE: created from a dn_schk applying sched_mask
-	DELETE: configuration command delete a scheduler which in turn
-		sweeps the hash table of instances deleting them
-
-    struct dn_schk
-	includes dn_sch, dn_link, a pointer to dn_profile,
-	a hash table of dn_sch_inst, a list of dn_fsk
-	attached to it.
-	CREATE: configuration command. If there are flowsets that
-		refer to this number, they are attached and moved
-		to the hash table
-	DELETE: manual, see dn_sch_inst
-
-
-	fshash                            schedhash
-      +---------------+   sched        +--------------+
-      |      sched-------------------->|      NEW_SCHK|
-  -<----*sch_chain    |<-----------------*fsk_list    |
-      |NEW_FSK        |<----.          | [dn_link]    |
-      +---------------+     |          +--------------+
-      |qht (hash)     |     |          |  siht(hash)  |
-      |   [dn_queue]  |     |          |  [dn_si]     |
-      |   [dn_queue]  |     |          |  [dn_si]     |
-      |     ...       |     |          |   ...        |
-      |   +--------+  |     |          | +---------+  |
-      |   |dn_queue|  |     |          | |dn_si    |  |
-      |  |    fs *----------'          | |         |  |
-      |  |    si *---------------------->|         |  |
-      |  +---------+  |                | +---------+  |
-      +---------------+                +--------------+
-
-The following global data structures contain all
-schedulers and flowsets.
-
-- schedhash[x]: contains all scheduler templates in the system.
-	Looked up only on manual configurations, where flowsets
-	are attached to matching schedulers.
-	We have one entry per 'sched X config' command
-	(plus one for each 'pipe X config').
-
-- fshash[x]: contains all flowsets.
-	We do a lookup on this for each packet.
-	We have one entry for each 'queue X config'
-	(plus one for each 'pipe X config').
-
-Additionally, a list that contains all unlinked flowset:
-- fsu:  contains flowset that are not linked with any scheduler.
-	Flowset are put in this list when they refer to a non
-	existing scheduler.
-	We don't need an efficient data structure as we never search
-	here on a packet arrivals.
-
-Scheduler instances and the delay lines associated with each scheduler
-instance need to be woken up at certain times. Because we have many
-such objects, we keep them in a priority heap (system_heap).
-
-Almost all objects in this implementation are preceded by a structure
-(struct dn_id) which makes it easier to identify them.
-
-
-Files
------
-The dummynet code is split in several files.
-All kernel code is in sys/netinet/ipfw except ip_dummynet.h
-All userland code is in sbin/ipfw.
-Files are
-- sys/netinet/ip_dummynet.h defines the kernel-userland API
-- ip_dn_private.h contains the kernel-specific APIs
-  and data structures
-- dn_sched.h defines the scheduler API
-- ip_dummynet.c cointains module glue and sockopt handlers, with all
-  functions to configure and list objects.
-- ip_dn_io.c contains the functions directly related to packet processing,
-  and run in the critical path. It also contains some functions
-  exported to the schedulers.
-- dn_heap.[ch] implement a binary heap and a generic hash table
-- dn_sched_* implement the various scheduler modules
-  
-- dummynet.c is the file used to implement the user side of dummynet.
-  It contains the function to parsing command line, and functions to
-  show the output of dummynet objects.
-Moreover, there are two new file (ip_dummynet_glue.c and ip_fw_glue.c) that
-are used to allow compatibility with the "ipfw" binary from FreeBSD 7.2 and
-FreeBSD 8.
-
-LOCKING
-=======
-At the moment the entire processing occurs under a single lock
-which is expected to be acquired in exclusive mode
-DN_BH_WLOCK() / DN_BH_WUNLOCK().
-
-In perspective we aim at the following:
-- the 'busy' flag, 'pending' list and all structures modified by packet
-  arrivals and departures are protected by the BH_WLOCK.
-  This is normally acquired in exclusive mode by the packet processing
-  functions for short sections of code (exception -- the timer).
-  If 'busy' is not set, we can do regular packet processing.
-  If 'busy' is set, no pieces can be accessed.
-  We must enqueue the packet on 'pending' and return immediately.
-
-- the 'busy' flag is set/cleared by long sections of code as follows:
-	UH_WLOCK(); KASSERT(busy == 0);
-	BH_WLOCK(); busy=1; BH_WUNLOCK();
-	... do processing ...
-	BH_WLOCK(); busy=0; drain_queue(pending); BH_WUNLOCK();
-	UH_WUNLOCK();
-  this normally happens when the upper half has something heavy
-  to do. The prologue and epilogue are not in the critical path.
-
-- the main containers (fshash, schedhash, ...) are protected by
-  UH_WLOCK.
-  
-Packet processing
-=================
-A packet enters dummynet through dummynet_io(). We first lookup
-the flowset number in fshash using dn_ht_find(), then find the scheduler
-instance using ipdn_si_find(), then possibly identify the correct
-queue with ipdn_q_find().
-If successful, we call the scheduler's enqueue function(), and
-if needed start I/O on the link calling serve_sched().
-If the packet can be returned immediately, this is done by
-leaving *m0 set. Otherwise, the packet is absorbed by dummynet
-and we simply return, possibly with some appropriate error code.
-
-Reconfiguration
----------------
-Reconfiguration is the complex part of the system because we need to
-keep track of the various objects and containers.
-At the moment we do not use reference counts for objects so all
-processing must be done under a lock.
-
-The main entry points for configuration is the ip_dn_ctl() handler
-for the IP_DUMMYNET3 sockopt (others are provided only for backward
-compatibility). Modifications to the configuration call do_config().
-The argument is a sequence of blocks each starting with a  struct dn_id
-which specifies its content.
-The first dn_id must contain as obj.id the DN_API_VERSION
-The obj.type is DN_CMD_CONFIG (followed by actual objects),
-DN_CMD_DELETE (with the correct subtype and list of objects), or
-DN_CMD_FLUSH.
-
-DN_CMD_CONFIG is followed by objects to add/reconfigure. In general,
-if an object already exists it is reconfigured, otherwise it is
-created in a way that keeps the structure consistent.
-We have the following objects in the system, normally numbered with
-an identifier N between 1 and 65535. For certain objects we have
-"shadow" copies numbered I+NMAX and I+ 2*NMAX which are used to
-implement certain backward compatibility features.
-
-In general we have the following linking
-
-  TRADITIONAL DUMMYNET QUEUES "queue N config ... pipe M ..."
-	corresponds to a dn_fs object numbered N
-
-  TRADITIONAL DUMMYNET PIPES "pipe N config ..."
-	dn_fs N+2*NMAX --> dn_sch N+NMAX type FIFO --> dn_link N+NMAX
-
-  GENERIC SCHEDULER "sched N config ... "
-	[dn_fs N+NMAX] --> dn_sch N --> dn_link N
-	The flowset N+NMAX is created only if the scheduler is not
-	of type MULTIQUEUE.
-
-  DELAY PROFILE	"pipe N config profile ..."
-	it is always attached to an existing dn_link N
-
-Because traditional dummynet pipes actually configure both a
-'standalone' instance and one that can be used by queues,
-we do the following:
-
-    "pipe N config ..." configures:
-	dn_sched N type WF2Q+
-	dn_sched N+NMAX type FIFO
-	dn_fs N+2NMAX attached to dn_sched N+NMAX
-	dn_pipe N
-	dn_pipe N+NMAX
-
-    "queue N config" configures
-	dn_fs N
-
-    "sched N config" configures
-	dn_sched N type as desired
-	dn_fs N+NMAX attached to dn_sched N
-
-
-dummynet_task()
-===============
-The dummynet_task() function is the main dummynet processing function and is
-called every tick. This function first calculate the new current time, then
-it checks if it is the time to wake up object from the system_heap comparing
-the current time and the key of the heap. Two types of object (really the
-heap contains pointer to objects) are in the
-system_heap:
-
-- scheduler instance: if a scheduler instance is waked up, the dequeue()
-  function is called until it has credit. If the dequeue() returns packets,
-  the scheduler instance is inserted in the heap with a new key depending of
-  the data that will be send out. If the scheduler instance remains with
-  some credit, it means that is hasn't other packet to send and so the
-  instance is no longer inserted in the heap.
-
-  If the scheduler instance extracted from the heap has the DELETE flag set,
-  the dequeue() is not called and the instance is destroyed now.
-
-- delay line: when extracting a delay line, the function transmit_event() is
-  called to send out packet from delay line.
-
-  If the scheduler instance associated with this delay line doesn't exists,
-  the delay line will be delete now.
-
-Configuration
-=============
-To create a pipe, queue or scheduler, the user should type commands like:
-"ipfw pipe x config"
-"ipfw queue y config pipe x"
-"ipfw pipe x config sched <type>"
-
-The userland side of dummynet will prepare a buffer contains data to pass to
-kernel side.
-The buffer contains all struct needed to configure an object. In more detail,
-to configure a pipe all three structs (dn_link, dn_sch, dn_fs) are needed,
-plus the delay profile struct if the pipe has a delay profile.
-
-If configuring a scheduler only the struct dn_sch is wrote in the buffer,
-while if configuring a flowset only the dn_fs struct is wrote.
-
-The first struct in the buffer contains the type of command request, that is
-if it is configuring a pipe, a queue, or a scheduler. Then there are structs
-need to configure the object, and finally there is the struct that mark
-the end of the buffer.
-
-To support the insertion of pipe and queue using the old syntax, when adding
-a pipe it's necessary to create a FIFO flowset and a FIFO scheduler, which
-have a number x + DN_PIPEOFFSET.
-
-Add a pipe
-----------
-A pipe is only a template for a link.
-If the pipe already exists, parameters are updated. If a delay profile exists
-it is deleted and a new one is created.
-If the pipe doesn't exist a new one is created. After the creation, the
-flowset unlinked list is scanned to see if there are some flowset that would
-be linked with this pipe. If so, these flowset will be of wf2q+ type (for
-compatibility) and a new wf2q+ scheduler is created now.
-
-Add a scheduler
----------------
-If the scheduler already exists, and the type and the mask are the same, the
-scheduler is simply reconfigured calling the config_scheduler() scheduler
-function with the RECONFIGURE flag active.
-If the type or the mask differ, it is necessary to delete the old scheduler
-and create a new one.
-If the scheduler doesn't exists, a new one is created. If the scheduler has
-a mask, the hash table is created to store pointers to scheduler instances.
-When a new scheduler is created, it is necessary to scan the unlinked
-flowset list to search eventually flowset that would be linked with this
-scheduler number. If some are found, flowsets became of the type of this
-scheduler and they are configured properly.
-
-Add a flowset
--------------
-Flowset pointers are store in the system in two list. The unlinked flowset list
-contains all flowset that aren't linked with a scheduler, the flowset list
-contains flowset linked to a scheduler, and so they have a type.
-When adding a new flowset, first it is checked if the flowset exists (that is,
-it is in the flowset list) and if it doesn't exists a new flowset is created
-and added to unlinked flowset list if the scheduler which the flowset would be
-linked doesn't exists, or added in the flowset list and configured properly if
-the scheduler exists. If the flowset (before to be created) was in the
-unlinked flowset list, it is removed and deleted, and then recreated.
-If the flowset exists, to allow reconfiguration of this flowset, the
-scheduler number and types must match with the one in memory. If this isn't
-so, the flowset is deleted and a new one will be created. Really, the flowset
-it isn't deleted now, but it is removed from flowset list and it will be
-deleted later because there could be some queues that are using it.
-
-Listing of object
-=================
-The user can request a list of object present in dummynet through the command
-"ipfw [-v] pipe|queue [x] list|show"
-The kernel side of dummynet send a buffer to user side that contains all
-pipe, all scheduler, all flowset, plus all scheduler instances and all queues.
-The dummynet user land will format the output and show only the relevant
-information.
-The buffer sent start with all pipe from the system. The entire struct dn_link
-is passed, except the delay_profile struct that is useless in user space.
-After pipes, all flowset are wrote in the buffer. The struct contains
-scheduler flowset specific data is linked with the flowset writing the
-'obj' id of the extension into the 'alg_fs' pointer.
-Then schedulers are wrote. If a scheduler has one or more scheduler instance,
-these are linked to the parent scheduler writing the id of the parent in the
-'ptr_sched' pointer. If a scheduler instance has queues, there are wrote in
-the buffer and linked thorugh the 'obj' and 'sched_inst' pointer.
-Finally, flowsets in the unlinked flowset list  are write in the buffer, and
-then a struct gen in saved in the buffer to mark the last struct in the buffer.
-
-
-Delete of object
-================
-An object is usually removed by user through a command like
-"ipfw pipe|queue x delete". XXX sched?
-ipfw pass to the kernel a struct gen that contains the type and the number
-of the object to remove
-
-Delete of pipe x
-----------------
-A pipe can be deleted by the user throught the command 'ipfw pipe x delete'.
-To delete a pipe, the pipe is removed from the pipe list, and then deleted.
-Also the scheduler associated with this pipe should be deleted.
-For compatibility with old dummynet syntax, the associated FIFO scheduler and
-FIFO flowset must be deleted.
-
-Delete of flowset x
--------------------
-To remove a flowset, we must be sure that is no loger referenced by any object.
-If the flowset to remove is in the unlinked flowset list, there is not any
-issue, the flowset can be safely removed calling a free() (the flowset
-extension is not yet created if the flowset is in this list).
-If the flowset is in the flowset list, first we remove from it so new packet
-are discarded when arrive. Next, the flowset is marked as delete.
-Now we must check if some queue is using this flowset.
-To do this, a counter (active_f) is provided. This counter indicate how many
-queues exist using this flowset.
-The active_f counter is automatically incremented when a queue is created
-and decremented when a queue is deleted.
-If the counter is 0, the flowset can be safely deleted, and the delete_alg_fs()
-scheduler function is called before deallocate memory.
-If the counter is not 0, the flowset remain in memory until the counter become
-zero. When a queue is delete (by dn_delete_queue() function) it is checked if
-the linked flowset is deleting and if so the counter is decrementing. If the
-counter reaches 0, the flowset is deleted.
-The deletion of a queue can be done only by the scheduler, or when the scheduler
-is destroyed.
-
-Delete of scheduler x
----------------------
-To delete a scheduler we must be sure that any scheduler instance of this type
-are in the system_heap. To do so, a counter (inst_counter) is provided.
-This counter is managed by the system: it is incremented every time it is
-inserted in the system_heap, and decremented every time it is extracted from it.
-To delete the scheduler, first we remove it from the scheduler list, so new
-packet are discarded when they arrive, and mark the scheduler as deleting.
-
-If the counter is 0, we can remove the scheduler safely calling the
-really_deletescheduler() function. This function will scan all scheduler
-instances and call the delete_scheduler_instance() function that will delete
-the instance. When all instance are deleted, the scheduler template is
-deleted calling the delete_scheduler_template(). If the delay line associate
-with the scheduler is empty, it is deleted now, else it will be deleted when
-it will became empy.
-If the counter was not 0, we wait for it. Every time the dummynet_task()
-function extract a scheduler from the system_heap, the counter is decremented.
-If the scheduler has the delete flag enabled the dequeue() is not called and
-delete_scheduler_instance() is called to delete the instance.
-Obviously this scheduler instance is no loger inserted in the system_heap.
-If the counter reaches 0, the delete_scheduler_template() function is called
-all memory is released.
-NOTE: Flowsets that belong to this scheduler are not deleted, so if a new
-      scheduler with the same number is inserted will use these flowsets.
-      To do so, the best approach would be insert these flowset in the
-      unlinked flowset list, but doing this now will be very expensive.
-      So flowsets will remain in memory and linked with a scheduler that no
-      longer exists until a packet belonging to this flowset arrives. When
-      this packet arrives, the reconfigure() function is called because the
-      generation number mismatch with one contains in the flowset and so
-      the flowset will be moved into the flowset unlinked list, or will be
-      linked with the new scheduler if a new one was created.
-
-
-COMPATIBILITY WITH FREEBSD 7.2 AND FREEBSD 8 'IPFW' BINARY
-==========================================================
-Dummynet is not compatible with old ipfw binary because internal structs are
-changed. Moreover, the old ipfw binary is not compatible with new kernels
-because the struct that represents a firewall rule has changed. So, if a user
-install a new kernel on a FreeBSD 7.2, the ipfw (and possibly many other
-commands) will not work.
-New dummynet uses a new socket option: IP_DUMMYNET3, used for both set and get.
-The old option can be used to allow compatibility with the 'ipfw' binary of
-older version (tested with 7.2 and 8.0) of FreeBSD.
-Two file are provided for this purpose:
-- ip_dummynet_glue.c translates old dummynet requests to the new ones,
-- ip_fw_glue.c converts the rule format between 7.2 and 8 versions.
-Let see in detail these two files.
-
-IP_DUMMYNET_GLUE.C
-------------------
-The internal structs of new dummynet are very different from the original.
-Because of there are some difference from between dummynet in FreeBSD 7.2 and
-dummynet in FreeBSD 8 (the FreeBSD 8 version includes support to pipe delay
-profile and burst option), I have to include both header files. I copied
-the revision 191715 (for version 7.2) and the revision 196045 (for version 8)
-and I appended a number to each struct to mark them.
-
-The main function of this file is ip_dummynet_compat() that is called by
-ip_dn_ctl() when it receive a request of old socket option.
-
-A global variabile ('is7') store the version of 'ipfw' that FreeBSD is using.
-This variable is set every time a request of configuration is done, because
-with this request we receive a buffer of which size depending of ipfw version.
-Because of in general the first action is a configuration, this variable is
-usually set accordly. If the first action is a request of listing of pipes
-or queues, the system cannot know the version of ipfw, and we suppose that
-version 7.2 is used. If version is wrong, the output can be senseless, but
-the application should not crash.
-
-There are four request for old dummynet:
-- IP_DUMMYNET_FLUSH: the flush options have no parameter, so simply the
-  dummynet_flush() function is called;
-- IP_DUMMYNET_DEL: the delete option need to be translate.
-  It is only necessary to extract the number and the type of the object
-  (pipe or queue) to delete from the buffer received and build a new struct
-  gen contains the right parameters, then call the delete_object() function;
-- IP_DUMMYNET_CONFIGURE: the configure command receive a buffer depending of
-  the ipfw version. After the properly extraction of all data, that depends
-  by the ipfw version used, new structures are filled and then the dummynet
-  config_link() function is properly called. Note that the 7.2 version does
-  not support some parameter as burst or delay profile.
-- IP_DUMMYNET_GET: The get command should send to the ipfw the correct buffer
-  depending of its version. There are two function that build the
-  corrected buffer, ip_dummynet_get7() and ip_dummynet_get8(). These
-  functions reproduce the buffer exactly as 'ipfw' expect. The only difference
-  is that the weight parameter for a queue is no loger sent by dummynet and so
-  it is set to 0.
-  Moreover, because of the internal structure has changed, the bucket size
-  of a queue could not be correct, because now all flowset share the hash
-  table.
-  If the version of ipfw is wrong, the output could be senseless or truncated,
-  but the application should not crash.
-
-IP_FW_GLUE.C
-------------
-The ipfw binary also is used to add rules to FreeBSD firewall. Because of the
-struct ip_fw is changed from FreeBsd 7.2 to FreeBSD 8, it is necessary
-to write some glue code to allow use ipfw from FreeBSD 7.2 with the kernel
-provided with FreeBSD 8.
-This file contains two functions to convert a rule from FreeBSD 7.2 format to
-FreeBSD 8 format, and viceversa.
-The conversion should be done when a rule passes from userspace to kernel space
-and viceversa.
-I have to modify the ip_fw2.c file to manage these two case, and added a
-variable (is7) to store the ipfw version used, using an approach like the
-previous file:
-- when a new rule is added (option IP_FW_ADD) the is7 variable is set if the
-  size of the rule received corrispond to FreeBSD 7.2 ipfw version. If so, the
-  rule is converted to version 8 calling the function convert_rule_to_8().
-  Moreover, after the insertion of the rule, the rule is now reconverted to
-  version 7 because the ipfw binary will print it.
-- when the user request a list of rules (option IP_FW_GET) the is7 variable
-  should be set correctly because we suppose that a configure command was done,
-  else we suppose that the FreeBSD version is 8. The function ipfw_getrules()
-  in ip_fw2.c file return all rules, eventually converted to version 7 (if
-  the is7 is set) to the ipfw binary.
-The conversion of a rule is quite simple. The only difference between the
-two structures (struct ip_fw) is that in the new there is a new field
-(uint32_t id). So, I copy the entire rule in a buffer and the copy the rule in
-the right position in the new (or old) struct. The size of commands are not
-changed, and the copy is done into a cicle.
-
-How to configure dummynet
-=========================
-It is possible to configure dummynet through two main commands:
-'ipfw pipe' and 'ipfw queue'.
-To allow compatibility with old version, it is possible configure dummynet
-using the old command syntax. Doing so, obviously, it is only possible to
-configure a FIFO scheduler or a wf2q+ scheduler.
-A new command, 'ipfw pipe x config sched <type>' is supported to add a new
-scheduler to the system.
-
-- ipfw pipe x config ...
-  create a new pipe with the link parameters
-  create a new scheduler fifo (x + offset)
-  create a new flowset fifo (x + offset)
-  the mask is eventually stored in the FIFO scheduler
-
-- ipfw queue y config pipe x ...
-  create a new flowset y linked to sched x.
-    The type of flowset depends by the specified scheduler.
-    If the scheduler does not exist, this flowset is inserted in a special
-    list and will be not active.
-    If pipe x exists and sched does not exist, a new wf2q+ scheduler is
-    created and the flowset will be linked to this new scheduler (this is
-    done for compatibility with old syntax).
-
-- ipfw pipe x config sched <type> ...
-  create a new scheduler x of type <type>.
-  Search into the flowset unlinked list if there are some flowset that
-  should be linked with this new scheduler.
-
-- ipfw pipe x delete
-  delete the pipe x
-  delete the scheduler fifo (x + offset)
-  delete the scheduler x
-  delete the flowset fifo (x + offset)
-
-- ipfw queue x delete
-  delete the flowset x
-
-- ipfw sched x delete ///XXX
-  delete the scheduler x
-
-Follow now some examples to how configure dummynet:
-- Ex1:
-  ipfw pipe 10 config bw 1M delay 15 // create a pipe with band and delay
-                                        A FIFO flowset and scheduler is
-                                        also created
-  ipfw queue 5 config pipe 10 weight 56 // create a flowset. This flowset
-                                           will be of wf2q+ because a pipe 10
-                                           exists. Moreover, the wf2q+
-                                           scheduler is created now.
-- Ex2:
-  ipfw queue 5 config pipe 10 weight 56 // Create a flowset. Scheduler 10
-                                           does not exist, so this flowset
-                                           is inserted in the unlinked
-                                           flowset list.
-  ipfw pipe 10 config bw... // Create a pipe, a FIFO flowset and scheduler.
-                               Because of a flowset with 'pipe 10' exists,
-                               a wf2q+ scheduler is created now and that
-                               flowset is linked with this sceduler.
-
-- Ex3:
-  ipfw pipe 10 config bw...    // Create a pipe, a FIFO flowset and scheduler.
-  ipfw pipe 10 config sched rr // Create a scheduler of type RR, linked to
-                                  pipe 10
-  ipfw queue 5 config pipe 10 weight 56 // Create a flowset 5. This flowset
-                                           will belong to scheduler 10 and
-                                           it is of type RR
-
-- Ex4:
-  ipfw pipe 10 config sched rr // Create a scheduler of type RR, linked to
-                                  pipe 10 (not exist yet)
-  ipfw pipe 10 config bw... // Create a pipe, a FIFO flowset and scheduler.
-  ipfw queue 5 config pipe 10 weight 56 // Create a flowset 5.This flowset
-                                           will belong to scheduler 10 and
-                                           it is of type RR
-  ipfw pipe 10 config sched wf2q+ // Modify the type of scheduler 10. It
-                                     becomes a wf2q+ scheduler.
-                                     When a new packet of flowset 5 arrives,
-                                     the flowset 5 becomes to wf2q+ type.
-
-How to implement a new scheduler
-================================
-In dummynet, a scheduler algorithm is represented by two main structs, some
-functions and other minor structs.
-- A struct dn_sch_xyz (where xyz is the 'type' of scheduler algorithm
-  implemented) contains data relative to scheduler, as global parameter that
-  are common to all instances of the scheduler
-- A struct dn_sch_inst_xyz contains data relative to a single scheduler
-  instance, as local status variable depending for example by flows that
-  are linked with the scheduler, and so on.
-To add a scheduler to dummynet, the user should type a command like:
-'ipfw pipe x config sched <type> [mask ... ...]'
-This command creates a new struct dn_sch_xyz of type <type>, and
-store the optional parameter in that struct.
-
-The parameter mask determines how many scheduler instance of this
-scheduler may exist. For example, it is possible to divide traffic
-depending on the source port (or destination, or ip address...),
-so that every scheduler instance act as an independent scheduler.
-If the mask is not set, all traffic goes to the same instance.
-
-When a packet arrives to a scheduler, the system search the corrected
-scheduler instance, and if it does not exist it is created now (the
-struct dn_sch_inst_xyz is allocated by the system, and the scheduler
-fills the field correctly). It is a task of the scheduler to create
-the struct that contains all queues for a scheduler instance.
-Dummynet provides some function to create an hash table to store
-queues, but the schedule algorithm can choice the own struct.
-
-To link a flow to a scheduler, the user should type a command like:
-'ipfw queue z config pipe x [mask... ...]'
-
-This command creates a new 'dn_fs' struct that will be inserted
-in the system.  If the scheduler x exists, this flowset will be
-linked to that scheduler and the flowset type become the same as
-the scheduler type. At this point, the function create_alg_fs_xyz()
-is called to allow store eventually parameter for the flowset that
-depend by scheduler (for example the 'weight' parameter for a wf2q+
-scheduler, or some priority...). A parameter mask can be used for
-a flowset. If the mask parameter is set, the scheduler instance can
-separate packet according to its flow id (src and dst ip, ports...)
-and assign it to a separate queue. This is done by the scheduler,
-so it can ignore the mask if it wants.
-
-See now the two main structs:
-struct dn_sch_xyz {
-    struct gen g; /* important the name g */
-    /* global params */
-};
-struct dn_sch_inst_xyz {
-    struct gen g; /* important the name g */
-    /* params of the instance */
-};
-It is important to embed the struct gen as first parameter. The struct gen
-contains some values that the scheduler instance must fill (the 'type' of
-scheduler, the 'len' of the struct...)
-The function create_scheduler_xyz() should be implemented to initialize global
-parameters in the first struct, and if memory allocation is done it is
-mandatory to implement the delete_scheduler_template() function to free that
-memory.
-The function create_scheduler_instance_xyz() must be implemented even if the
-scheduler instance does not use extra parameters. In this function the struct
-gen fields must be filled with corrected infos. The
-delete_scheduler_instance_xyz() function must bu implemented if the instance
-has allocated some memory in the previous function.
-
-To store data belonging to a flowset the follow struct is used:
-struct alg_fs_xyz {
-    struct gen g;
-    /* fill correctly the gen struct
-     g.subtype = DN_XYZ;
-     g.len = sizeof(struct alg_fs_xyz)
-     ...
-     */
-    /* params for the flow */
-};
-The create_alg_fs_xyz() function is mandatory, because it must fill the struct
-gen, but the delete_alg_fs_xyz() is mandatory only if the previous function
-has allocated some memory.
-
-A struct dn_queue contains packets belonging to a queue and some statistical
-data. The scheduler could have to store data in this struct, so it must define
-a dn_queue_xyz struct:
-struct dn_queue_xyz {
-    struct dn_queue q;
-    /* parameter for a queue */
-}
-
-All structures are allocated by the system. To do so, the scheduler must
-set the size of its structs in the scheduler descriptor:
-scheduler_size:     sizeof(dn_sch_xyz)
-scheduler_i_size:   sizeof(dn_sch_inst_xyz)
-flowset_size:       sizeof(alg_fs_xyz)
-queue_size:         sizeof(dn_queue_xyz);
-The scheduler_size could be 0, but other struct must have at least a struct gen.
-
-
-After the definition of structs, it is necessary to implement the
-scheduler functions.
-
-- int (*config_scheduler)(char *command, void *sch, int reconfigure);
-    Configure a scheduler, or reconfigure if 'reconfigure' == 1.
-    This function performs additional allocation and initialization of global
-    parameter for this scheduler.
-    If memory is allocated here, the delete_scheduler_template() function
-    should be implemented to remove this memory.
-- int (*delete_scheduler_template)(void* sch);
-    Delete a scheduler template. This function is mandatory if the scheduler
-    uses extra data respect the struct dn_sch.
-- int (*create_scheduler_instance)(void *s);
-    Create a new scheduler instance. The system allocate the necessary memory
-    and the schedulet can access it using the 's' pointer.
-    The scheduler instance stores all queues, and to do this can use the
-    hash table provided by the system.
-- int (*delete_scheduler_instance)(void *s);
-    Delete a scheduler instance. It is important to free memory allocated
-    by create_scheduler_instance() function. The memory allocated by system
-    is freed by the system itself. The struct contains all queue also has
-    to be deleted.
-- int (*enqueue)(void *s, struct gen *f, struct mbuf *m,
-                 struct ipfw_flow_id *id);
-    Called when a packet arrives. The packet 'm' belongs to the scheduler
-    instance 's', has a flowset 'f' and the flowid 'id' has already been
-    masked. The enqueue() must call dn_queue_packet(q, m) function to really
-    enqueue packet in the queue q. The queue 'q' is chosen by the scheduler
-    and if it does not exist should be created calling the dn_create_queue()
-    function. If the schedule want to drop the packet, it must call the
-    dn_drop_packet() function and then return 1.
-- struct mbuf * (*dequeue)(void *s);
-    Called when the timer expires (or when a packet arrives and the scheduler
-    instance is idle).
-    This function is called when at least a packet can be send out. The
-    scheduler choices the packet and returns it; if no packet are in the
-    schedulerinstance, the function must return NULL.
-    Before return a packet, it is important to call the function
-    dn_return_packet() to update some statistic of the queue and update the
-    queue counters.
-- int (*drain_queue)(void *s, int flag);
-    The system request to scheduler to delete all queues that is not using
-    to free memory. The flag parameter indicate if a queue must be deleted
-    even if it is active.
-
-- int (*create_alg_fs)(char *command, struct gen *g, int reconfigure);
-    It is called when a flowset is linked with a scheduler. This is done
-    when the scheduler is defined, so we can know the type of flowset.
-    The function initialize the flowset paramenter parsing the command
-    line. The parameter will be stored in the g struct that have the right
-    size allocated by the system. If the reconfigure flag is set, it means
-    that the flowset is reconfiguring
-- int (*delete_alg_fs)(struct gen *f);
-    It is called when a flowset is deleting. Must remove the memory allocate
-    by the create_alg_fs() function.
-
-- int (*create_queue_alg)(struct dn_queue *q, struct gen *f);
-    Called when a queue is created. The function should link the queue
-    to the struct used by the scheduler instance to store all queues.
-- int (*delete_queue_alg)(struct dn_queue *q);
-    Called when a queue is deleting. The function should remove extra data
-    and update the struct contains all queues in the scheduler instance.
-
-The struct scheduler represent the scheduler descriptor that is passed to
-dummynet when a scheduler module is loaded.
-This struct contains the type of scheduler, the lenght of all structs and
-all function pointers.
-If a function is not implemented should be initialize to NULL. Some functions
-are mandatory, other are mandatory if some memory should be freed.
-Mandatory functions:
-- create_scheduler_instance()
-- enqueue()
-- dequeue()
-- create_alg_fs()
-- drain_queue()
-Optional functions:
-- config_scheduler()
-- create_queue_alg()
-Mandatory functions if the corresponding create...() has allocated memory:
-- delete_scheduler_template()
-- delete_scheduler_instance()
-- delete_alg_fs()
-- delete_queue_alg()
-
diff --git a/sys/netinet/ipfw/ip_dn_glue.c b/sys/netinet/ipfw/ip_dn_glue.c
deleted file mode 100644
index 9fc6b23f662e..000000000000
--- a/sys/netinet/ipfw/ip_dn_glue.c
+++ /dev/null
@@ -1,845 +0,0 @@
-/*-
- * Copyright (c) 2010 Riccardo Panicucci, Universita` di Pisa
- * All rights reserved
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-/*
- * $FreeBSD$
- *
- * Binary compatibility support for /sbin/ipfw RELENG_7 and RELENG_8
- */
-
-#include "opt_inet6.h"
-
-#include <sys/param.h>
-#include <sys/systm.h>
-#include <sys/malloc.h>
-#include <sys/mbuf.h>
-#include <sys/kernel.h>
-#include <sys/lock.h>
-#include <sys/module.h>
-#include <sys/priv.h>
-#include <sys/proc.h>
-#include <sys/rwlock.h>
-#include <sys/socket.h>
-#include <sys/socketvar.h>
-#include <sys/time.h>
-#include <sys/taskqueue.h>
-#include <net/if.h>	/* IFNAMSIZ, struct ifaddr, ifq head, lock.h mutex.h */
-#include <netinet/in.h>
-#include <netinet/ip_var.h>	/* ip_output(), IP_FORWARDING */
-#include <netinet/ip_fw.h>
-#include <netinet/ipfw/ip_fw_private.h>
-#include <netinet/ipfw/dn_heap.h>
-#include <netinet/ip_dummynet.h>
-#include <netinet/ipfw/ip_dn_private.h>
-#include <netinet/ipfw/dn_sched.h>
-
-/* FREEBSD7.2 ip_dummynet.h r191715*/
-
-struct dn_heap_entry7 {
-	int64_t key;        /* sorting key. Topmost element is smallest one */
-	void *object;      /* object pointer */
-};
-
-struct dn_heap7 {
-	int size;
-	int elements;
-	int offset; /* XXX if > 0 this is the offset of direct ptr to obj */
-	struct dn_heap_entry7 *p;   /* really an array of "size" entries */
-};
-
-/* Common to 7.2 and 8 */
-struct dn_flow_set {
-	SLIST_ENTRY(dn_flow_set)    next;   /* linked list in a hash slot */
-
-	u_short fs_nr ;             /* flow_set number       */
-	u_short flags_fs;
-#define DNOLD_HAVE_FLOW_MASK   0x0001
-#define DNOLD_IS_RED       0x0002
-#define DNOLD_IS_GENTLE_RED    0x0004
-#define DNOLD_QSIZE_IS_BYTES   0x0008  /* queue size is measured in bytes */
-#define DNOLD_NOERROR      0x0010  /* do not report ENOBUFS on drops  */
-#define DNOLD_HAS_PROFILE      0x0020  /* the pipe has a delay profile. */
-#define DNOLD_IS_PIPE      0x4000
-#define DNOLD_IS_QUEUE     0x8000
-
-	struct dn_pipe7 *pipe ;  /* pointer to parent pipe */
-	u_short parent_nr ;     /* parent pipe#, 0 if local to a pipe */
-
-	int weight ;        /* WFQ queue weight */
-	int qsize ;         /* queue size in slots or bytes */
-	int plr ;           /* pkt loss rate (2^31-1 means 100%) */
-
-	struct ipfw_flow_id flow_mask ;
-
-	/* hash table of queues onto this flow_set */
-	int rq_size ;       /* number of slots */
-	int rq_elements ;       /* active elements */
-	struct dn_flow_queue7 **rq;  /* array of rq_size entries */
-
-	u_int32_t last_expired ;    /* do not expire too frequently */
-	int backlogged ;        /* #active queues for this flowset */
-
-        /* RED parameters */
-#define SCALE_RED               16
-#define SCALE(x)                ( (x) << SCALE_RED )
-#define SCALE_VAL(x)            ( (x) >> SCALE_RED )
-#define SCALE_MUL(x,y)          ( ( (x) * (y) ) >> SCALE_RED )
-	int w_q ;           /* queue weight (scaled) */
-	int max_th ;        /* maximum threshold for queue (scaled) */
-	int min_th ;        /* minimum threshold for queue (scaled) */
-	int max_p ;         /* maximum value for p_b (scaled) */
-	u_int c_1 ;         /* max_p/(max_th-min_th) (scaled) */
-	u_int c_2 ;         /* max_p*min_th/(max_th-min_th) (scaled) */
-	u_int c_3 ;         /* for GRED, (1-max_p)/max_th (scaled) */
-	u_int c_4 ;         /* for GRED, 1 - 2*max_p (scaled) */
-	u_int * w_q_lookup ;    /* lookup table for computing (1-w_q)^t */
-	u_int lookup_depth ;    /* depth of lookup table */
-	int lookup_step ;       /* granularity inside the lookup table */
-	int lookup_weight ;     /* equal to (1-w_q)^t / (1-w_q)^(t+1) */
-	int avg_pkt_size ;      /* medium packet size */
-	int max_pkt_size ;      /* max packet size */
-};
-SLIST_HEAD(dn_flow_set_head, dn_flow_set);
-
-#define DN_IS_PIPE		0x4000
-#define DN_IS_QUEUE		0x8000
-struct dn_flow_queue7 {
-	struct dn_flow_queue7 *next ;
-	struct ipfw_flow_id id ;
-
-	struct mbuf *head, *tail ;  /* queue of packets */
-	u_int len ;
-	u_int len_bytes ;
-
-	u_long numbytes;
-
-	u_int64_t tot_pkts ;    /* statistics counters  */
-	u_int64_t tot_bytes ;
-	u_int32_t drops ;
-
-	int hash_slot ;     /* debugging/diagnostic */
-
-	/* RED parameters */
-	int avg ;                   /* average queue length est. (scaled) */
-	int count ;                 /* arrivals since last RED drop */
-	int random ;                /* random value (scaled) */
-	u_int32_t q_time;      /* start of queue idle time */
-
-	/* WF2Q+ support */
-	struct dn_flow_set *fs ;    /* parent flow set */
-	int heap_pos ;      /* position (index) of struct in heap */
-	int64_t sched_time ;     /* current time when queue enters ready_heap */
-
-	int64_t S,F ;        /* start time, finish time */
-};
-
-struct dn_pipe7 {        /* a pipe */
-	SLIST_ENTRY(dn_pipe7)    next;   /* linked list in a hash slot */
-
-	int pipe_nr ;       /* number   */
-	int bandwidth;      /* really, bytes/tick.  */
-	int delay ;         /* really, ticks    */
-
-	struct  mbuf *head, *tail ; /* packets in delay line */
-
-	/* WF2Q+ */
-	struct dn_heap7 scheduler_heap ; /* top extract - key Finish time*/
-	struct dn_heap7 not_eligible_heap; /* top extract- key Start time */
-	struct dn_heap7 idle_heap ; /* random extract - key Start=Finish time */
-
-	int64_t V ;          /* virtual time */
-	int sum;            /* sum of weights of all active sessions */
-
-	int numbytes;
-
-	int64_t sched_time ;     /* time pipe was scheduled in ready_heap */
-
-	/*
-	* When the tx clock come from an interface (if_name[0] != '\0'), its name
-	* is stored below, whereas the ifp is filled when the rule is configured.
-	*/
-	char if_name[IFNAMSIZ];
-	struct ifnet *ifp ;
-	int ready ; /* set if ifp != NULL and we got a signal from it */
-
-	struct dn_flow_set fs ; /* used with fixed-rate flows */
-};
-SLIST_HEAD(dn_pipe_head7, dn_pipe7);
-
-
-/* FREEBSD8 ip_dummynet.h r196045 */
-struct dn_flow_queue8 {
-	struct dn_flow_queue8 *next ;
-	struct ipfw_flow_id id ;
-
-	struct mbuf *head, *tail ;  /* queue of packets */
-	u_int len ;
-	u_int len_bytes ;
-
-	uint64_t numbytes ;     /* credit for transmission (dynamic queues) */
-	int64_t extra_bits;     /* extra bits simulating unavailable channel */
-
-	u_int64_t tot_pkts ;    /* statistics counters  */
-	u_int64_t tot_bytes ;
-	u_int32_t drops ;
-
-	int hash_slot ;     /* debugging/diagnostic */
-
-	/* RED parameters */
-	int avg ;                   /* average queue length est. (scaled) */
-	int count ;                 /* arrivals since last RED drop */
-	int random ;                /* random value (scaled) */
-	int64_t idle_time;       /* start of queue idle time */
-
-	/* WF2Q+ support */
-	struct dn_flow_set *fs ;    /* parent flow set */
-	int heap_pos ;      /* position (index) of struct in heap */
-	int64_t sched_time ;     /* current time when queue enters ready_heap */
-
-	int64_t S,F ;        /* start time, finish time */
-};
-
-struct dn_pipe8 {        /* a pipe */
-	SLIST_ENTRY(dn_pipe8)    next;   /* linked list in a hash slot */
-
-	int pipe_nr ;       /* number   */
-	int bandwidth;      /* really, bytes/tick.  */
-	int delay ;         /* really, ticks    */
-
-	struct  mbuf *head, *tail ; /* packets in delay line */
-
-	/* WF2Q+ */
-	struct dn_heap7 scheduler_heap ; /* top extract - key Finish time*/
-	struct dn_heap7 not_eligible_heap; /* top extract- key Start time */
-	struct dn_heap7 idle_heap ; /* random extract - key Start=Finish time */
-
-	int64_t V ;          /* virtual time */
-	int sum;            /* sum of weights of all active sessions */
-
-	/* Same as in dn_flow_queue, numbytes can become large */
-	int64_t numbytes;       /* bits I can transmit (more or less). */
-	uint64_t burst;     /* burst size, scaled: bits * hz */
-
-	int64_t sched_time ;     /* time pipe was scheduled in ready_heap */
-	int64_t idle_time;       /* start of pipe idle time */
-
-	char if_name[IFNAMSIZ];
-	struct ifnet *ifp ;
-	int ready ; /* set if ifp != NULL and we got a signal from it */
-
-	struct dn_flow_set fs ; /* used with fixed-rate flows */
-
-    /* fields to simulate a delay profile */
-#define ED_MAX_NAME_LEN     32
-	char name[ED_MAX_NAME_LEN];
-	int loss_level;
-	int samples_no;
-	int *samples;
-};
-
-#define ED_MAX_SAMPLES_NO   1024
-struct dn_pipe_max8 {
-	struct dn_pipe8 pipe;
-	int samples[ED_MAX_SAMPLES_NO];
-};
-SLIST_HEAD(dn_pipe_head8, dn_pipe8);
-
-/*
- * Changes from 7.2 to 8:
- * dn_pipe:
- *      numbytes from int to int64_t
- *      add burst (int64_t)
- *      add idle_time (int64_t)
- *      add profile
- *      add struct dn_pipe_max
- *      add flag DN_HAS_PROFILE
- *
- * dn_flow_queue
- *      numbytes from u_long to int64_t
- *      add extra_bits (int64_t)
- *      q_time from u_int32_t to int64_t and name idle_time
- *
- * dn_flow_set unchanged
- *
- */
-
-/* NOTE:XXX copied from dummynet.c */
-#define O_NEXT(p, len) ((void *)((char *)p + len))
-static void
-oid_fill(struct dn_id *oid, int len, int type, uintptr_t id)
-{
-	oid->len = len;
-	oid->type = type;
-	oid->subtype = 0;
-	oid->id = id;
-}
-/* make room in the buffer and move the pointer forward */
-static void *
-o_next(struct dn_id **o, int len, int type)
-{
-	struct dn_id *ret = *o;
-	oid_fill(ret, len, type, 0);
-	*o = O_NEXT(*o, len);
-	return ret;
-}
-
-
-static size_t pipesize7 = sizeof(struct dn_pipe7);
-static size_t pipesize8 = sizeof(struct dn_pipe8);
-static size_t pipesizemax8 = sizeof(struct dn_pipe_max8);
-
-/* Indicate 'ipfw' version
- * 1: from FreeBSD 7.2
- * 0: from FreeBSD 8
- * -1: unknow (for now is unused)
- *
- * It is update when a IP_DUMMYNET_DEL or IP_DUMMYNET_CONFIGURE request arrives
- * NOTE: if a IP_DUMMYNET_GET arrives and the 'ipfw' version is unknow,
- *       it is suppose to be the FreeBSD 8 version.
- */
-static int is7 = 0;
-
-static int
-convertflags2new(int src)
-{
-	int dst = 0;
-
-	if (src & DNOLD_HAVE_FLOW_MASK)
-		dst |= DN_HAVE_MASK;
-	if (src & DNOLD_QSIZE_IS_BYTES)
-		dst |= DN_QSIZE_BYTES;
-	if (src & DNOLD_NOERROR)
-		dst |= DN_NOERROR;
-	if (src & DNOLD_IS_RED)
-		dst |= DN_IS_RED;
-	if (src & DNOLD_IS_GENTLE_RED)
-		dst |= DN_IS_GENTLE_RED;
-	if (src & DNOLD_HAS_PROFILE)
-		dst |= DN_HAS_PROFILE;
-
-	return dst;
-}
-
-static int
-convertflags2old(int src)
-{
-	int dst = 0;
-
-	if (src & DN_HAVE_MASK)
-		dst |= DNOLD_HAVE_FLOW_MASK;
-	if (src & DN_IS_RED)
-		dst |= DNOLD_IS_RED;
-	if (src & DN_IS_GENTLE_RED)
-		dst |= DNOLD_IS_GENTLE_RED;
-	if (src & DN_NOERROR)
-		dst |= DNOLD_NOERROR;
-	if (src & DN_HAS_PROFILE)
-		dst |= DNOLD_HAS_PROFILE;
-	if (src & DN_QSIZE_BYTES)
-		dst |= DNOLD_QSIZE_IS_BYTES;
-
-	return dst;
-}
-
-static int
-dn_compat_del(void *v)
-{
-	struct dn_pipe7 *p = (struct dn_pipe7 *) v;
-	struct dn_pipe8 *p8 = (struct dn_pipe8 *) v;
-	struct {
-		struct dn_id oid;
-		uintptr_t a[1];	/* add more if we want a list */
-	} cmd;
-
-	/* XXX DN_API_VERSION ??? */
-	oid_fill((void *)&cmd, sizeof(cmd), DN_CMD_DELETE, DN_API_VERSION);
-
-	if (is7) {
-		if (p->pipe_nr == 0 && p->fs.fs_nr == 0)
-			return EINVAL;
-		if (p->pipe_nr != 0 && p->fs.fs_nr != 0)
-			return EINVAL;
-	} else {
-		if (p8->pipe_nr == 0 && p8->fs.fs_nr == 0)
-			return EINVAL;
-		if (p8->pipe_nr != 0 && p8->fs.fs_nr != 0)
-			return EINVAL;
-	}
-
-	if (p->pipe_nr != 0) { /* pipe x delete */
-		cmd.a[0] = p->pipe_nr;
-		cmd.oid.subtype = DN_LINK;
-	} else { /* queue x delete */
-		cmd.oid.subtype = DN_FS;
-		cmd.a[0] = (is7) ? p->fs.fs_nr : p8->fs.fs_nr;
-	}
-
-	return do_config(&cmd, cmd.oid.len);
-}
-
-static int
-dn_compat_config_queue(struct dn_fs *fs, void* v)
-{
-	struct dn_pipe7 *p7 = (struct dn_pipe7 *)v;
-	struct dn_pipe8 *p8 = (struct dn_pipe8 *)v;
-	struct dn_flow_set *f;
-
-	if (is7)
-		f = &p7->fs;
-	else
-		f = &p8->fs;
-
-	fs->fs_nr = f->fs_nr;
-	fs->sched_nr = f->parent_nr;
-	fs->flow_mask = f->flow_mask;
-	fs->buckets = f->rq_size;
-	fs->qsize = f->qsize;
-	fs->plr = f->plr;
-	fs->par[0] = f->weight;
-	fs->flags = convertflags2new(f->flags_fs);
-	if (fs->flags & DN_IS_GENTLE_RED || fs->flags & DN_IS_RED) {
-		fs->w_q = f->w_q;
-		fs->max_th = f->max_th;
-		fs->min_th = f->min_th;
-		fs->max_p = f->max_p;
-	}
-
-	return 0;
-}
-
-static int
-dn_compat_config_pipe(struct dn_sch *sch, struct dn_link *p, 
-		      struct dn_fs *fs, void* v)
-{
-	struct dn_pipe7 *p7 = (struct dn_pipe7 *)v;
-	struct dn_pipe8 *p8 = (struct dn_pipe8 *)v;
-	int i = p7->pipe_nr;
-
-	sch->sched_nr = i;
-	sch->oid.subtype = 0;
-	p->link_nr = i;
-	fs->fs_nr = i + 2*DN_MAX_ID;
-	fs->sched_nr = i + DN_MAX_ID;
-
-	/* Common to 7 and 8 */
-	p->bandwidth = p7->bandwidth;
-	p->delay = p7->delay;
-	if (!is7) {
-		/* FreeBSD 8 has burst  */
-		p->burst = p8->burst;
-	}
-
-	/* fill the fifo flowset */
-	dn_compat_config_queue(fs, v);
-	fs->fs_nr = i + 2*DN_MAX_ID;
-	fs->sched_nr = i + DN_MAX_ID;
-
-	/* Move scheduler related parameter from fs to sch */
-	sch->buckets = fs->buckets; /*XXX*/
-	fs->buckets = 0;
-	if (fs->flags & DN_HAVE_MASK) {
-		sch->flags |= DN_HAVE_MASK;
-		fs->flags &= ~DN_HAVE_MASK;
-		sch->sched_mask = fs->flow_mask;
-		bzero(&fs->flow_mask, sizeof(struct ipfw_flow_id));
-	}
-
-	return 0;
-}
-
-static int
-dn_compat_config_profile(struct dn_profile *pf, struct dn_link *p,
-			 void *v)
-{
-	struct dn_pipe8 *p8 = (struct dn_pipe8 *)v;
-
-	p8->samples = &(((struct dn_pipe_max8 *)p8)->samples[0]);
-	
-	pf->link_nr = p->link_nr;
-	pf->loss_level = p8->loss_level;
-// 	pf->bandwidth = p->bandwidth; //XXX bandwidth redundant?
-	pf->samples_no = p8->samples_no;
-	strncpy(pf->name, p8->name,sizeof(pf->name));
-	bcopy(p8->samples, pf->samples, sizeof(pf->samples));
-
-	return 0;
-}
-
-/*
- * If p->pipe_nr != 0 the command is 'pipe x config', so need to create
- * the three main struct, else only a flowset is created
- */
-static int
-dn_compat_configure(void *v)
-{
-	struct dn_id *buf = NULL, *base;
-	struct dn_sch *sch = NULL;
-	struct dn_link *p = NULL;
-	struct dn_fs *fs = NULL;
-	struct dn_profile *pf = NULL;
-	int lmax;
-	int error;
-
-	struct dn_pipe7 *p7 = (struct dn_pipe7 *)v;
-	struct dn_pipe8 *p8 = (struct dn_pipe8 *)v;
-
-	int i; /* number of object to configure */
-
-	lmax = sizeof(struct dn_id);	/* command header */
-	lmax += sizeof(struct dn_sch) + sizeof(struct dn_link) +
-		sizeof(struct dn_fs) + sizeof(struct dn_profile);
-
-	base = buf = malloc(lmax, M_DUMMYNET, M_WAIT|M_ZERO);
-	o_next(&buf, sizeof(struct dn_id), DN_CMD_CONFIG);
-	base->id = DN_API_VERSION;
-
-	/* pipe_nr is the same in p7 and p8 */
-	i = p7->pipe_nr;
-	if (i != 0) { /* pipe config */
-		sch = o_next(&buf, sizeof(*sch), DN_SCH);
-		p = o_next(&buf, sizeof(*p), DN_LINK);
-		fs = o_next(&buf, sizeof(*fs), DN_FS);
-
-		error = dn_compat_config_pipe(sch, p, fs, v);
-		if (error) {
-			free(buf, M_DUMMYNET);
-			return error;
-		}
-		if (!is7 && p8->samples_no > 0) {
-			/* Add profiles*/
-			pf = o_next(&buf, sizeof(*pf), DN_PROFILE);
-			error = dn_compat_config_profile(pf, p, v);
-			if (error) {
-				free(buf, M_DUMMYNET);
-				return error;
-			}
-		}
-	} else { /* queue config */
-		fs = o_next(&buf, sizeof(*fs), DN_FS);
-		error = dn_compat_config_queue(fs, v);
-		if (error) {
-			free(buf, M_DUMMYNET);
-			return error;
-		}
-	}
-	error = do_config(base, (char *)buf - (char *)base);
-
-	if (buf)
-		free(buf, M_DUMMYNET);
-	return error;
-}
-
-int
-dn_compat_calc_size(void)
-{
-	int need = 0;
-	/* XXX use FreeBSD 8 struct size */
-	/* NOTE:
-	 * - half scheduler: 		schk_count/2
-	 * - all flowset:		fsk_count
-	 * - all flowset queues:	queue_count
-	 * - all pipe queue:		si_count
-	 */
-	need += dn_cfg.schk_count * sizeof(struct dn_pipe8) / 2;
-	need += dn_cfg.fsk_count * sizeof(struct dn_flow_set);
-	need += dn_cfg.si_count * sizeof(struct dn_flow_queue8);
-	need += dn_cfg.queue_count * sizeof(struct dn_flow_queue8);
-
-	return need;
-}
-
-int
-dn_c_copy_q (void *_ni, void *arg)
-{
-	struct copy_args *a = arg;
-	struct dn_flow_queue7 *fq7 = (struct dn_flow_queue7 *)*a->start;
-	struct dn_flow_queue8 *fq8 = (struct dn_flow_queue8 *)*a->start;
-	struct dn_flow *ni = (struct dn_flow *)_ni;
-	int size = 0;
-
-	/* XXX hash slot not set */
-	/* No difference between 7.2/8 */
-	fq7->len = ni->length;
-	fq7->len_bytes = ni->len_bytes;
-	fq7->id = ni->fid;
-
-	if (is7) {
-		size = sizeof(struct dn_flow_queue7);
-		fq7->tot_pkts = ni->tot_pkts;
-		fq7->tot_bytes = ni->tot_bytes;
-		fq7->drops = ni->drops;
-	} else {
-		size = sizeof(struct dn_flow_queue8);
-		fq8->tot_pkts = ni->tot_pkts;
-		fq8->tot_bytes = ni->tot_bytes;
-		fq8->drops = ni->drops;
-	}
-
-	*a->start += size;
-	return 0;
-}
-
-int
-dn_c_copy_pipe(struct dn_schk *s, struct copy_args *a, int nq)
-{
-	struct dn_link *l = &s->link;
-	struct dn_fsk *f = s->fs;
-
-	struct dn_pipe7 *pipe7 = (struct dn_pipe7 *)*a->start;
-	struct dn_pipe8 *pipe8 = (struct dn_pipe8 *)*a->start;
-	struct dn_flow_set *fs;
-	int size = 0;
-
-	if (is7) {
-		fs = &pipe7->fs;
-		size = sizeof(struct dn_pipe7);
-	} else {
-		fs = &pipe8->fs;
-		size = sizeof(struct dn_pipe8);
-	}
-
-	/* These 4 field are the same in pipe7 and pipe8 */
-	pipe7->next.sle_next = (struct dn_pipe7 *)DN_IS_PIPE;
-	pipe7->bandwidth = l->bandwidth;
-	pipe7->delay = l->delay * 1000 / hz;
-	pipe7->pipe_nr = l->link_nr - DN_MAX_ID;
-
-	if (!is7) {
-		if (s->profile) {
-			struct dn_profile *pf = s->profile;
-			strncpy(pipe8->name, pf->name, sizeof(pf->name));
-			pipe8->loss_level = pf->loss_level;
-			pipe8->samples_no = pf->samples_no;
-		}
-		pipe8->burst = div64(l->burst , 8 * hz);
-	}
-
-	fs->flow_mask = s->sch.sched_mask;
-	fs->rq_size = s->sch.buckets ? s->sch.buckets : 1;
-
-	fs->parent_nr = l->link_nr - DN_MAX_ID;
-	fs->qsize = f->fs.qsize;
-	fs->plr = f->fs.plr;
-	fs->w_q = f->fs.w_q;
-	fs->max_th = f->max_th;
-	fs->min_th = f->min_th;
-	fs->max_p = f->fs.max_p;
-	fs->rq_elements = nq;
-
-	fs->flags_fs = convertflags2old(f->fs.flags);
-
-	*a->start += size;
-	return 0;
-}
-
-
-int
-dn_compat_copy_pipe(struct copy_args *a, void *_o)
-{
-	int have = a->end - *a->start;
-	int need = 0;
-	int pipe_size = sizeof(struct dn_pipe8);
-	int queue_size = sizeof(struct dn_flow_queue8);
-	int n_queue = 0; /* number of queues */
-
-	struct dn_schk *s = (struct dn_schk *)_o;
-	/* calculate needed space:
-	 * - struct dn_pipe
-	 * - if there are instances, dn_queue * n_instances
-	 */
-	n_queue = (s->sch.flags & DN_HAVE_MASK ? dn_ht_entries(s->siht) :
-						(s->siht ? 1 : 0));
-	need = pipe_size + queue_size * n_queue;
-	if (have < need) {
-		D("have %d < need %d", have, need);
-		return 1;
-	}
-	/* copy pipe */
-	dn_c_copy_pipe(s, a, n_queue);
-
-	/* copy queues */
-	if (s->sch.flags & DN_HAVE_MASK)
-		dn_ht_scan(s->siht, dn_c_copy_q, a);
-	else if (s->siht)
-		dn_c_copy_q(s->siht, a);
-	return 0;
-}
-
-int
-dn_c_copy_fs(struct dn_fsk *f, struct copy_args *a, int nq)
-{
-	struct dn_flow_set *fs = (struct dn_flow_set *)*a->start;
-
-	fs->next.sle_next = (struct dn_flow_set *)DN_IS_QUEUE;
-	fs->fs_nr = f->fs.fs_nr;
-	fs->qsize = f->fs.qsize;
-	fs->plr = f->fs.plr;
-	fs->w_q = f->fs.w_q;
-	fs->max_th = f->max_th;
-	fs->min_th = f->min_th;
-	fs->max_p = f->fs.max_p;
-	fs->flow_mask = f->fs.flow_mask;
-	fs->rq_elements = nq;
-	fs->rq_size = (f->fs.buckets ? f->fs.buckets : 1);
-	fs->parent_nr = f->fs.sched_nr;
-	fs->weight = f->fs.par[0];
-
-	fs->flags_fs = convertflags2old(f->fs.flags);
-	*a->start += sizeof(struct dn_flow_set);
-	return 0;
-}
-
-int
-dn_compat_copy_queue(struct copy_args *a, void *_o)
-{
-	int have = a->end - *a->start;
-	int need = 0;
-	int fs_size = sizeof(struct dn_flow_set);
-	int queue_size = sizeof(struct dn_flow_queue8);
-
-	struct dn_fsk *fs = (struct dn_fsk *)_o;
-	int n_queue = 0; /* number of queues */
-
-	n_queue = (fs->fs.flags & DN_HAVE_MASK ? dn_ht_entries(fs->qht) :
-						(fs->qht ? 1 : 0));
-
-	need = fs_size + queue_size * n_queue;
-	if (have < need) {
-		D("have < need");
-		return 1;
-	}
-
-	/* copy flowset */
-	dn_c_copy_fs(fs, a, n_queue);
-
-	/* copy queues */
-	if (fs->fs.flags & DN_HAVE_MASK)
-		dn_ht_scan(fs->qht, dn_c_copy_q, a);
-	else if (fs->qht)
-		dn_c_copy_q(fs->qht, a);
-
-	return 0;
-}
-
-int
-copy_data_helper_compat(void *_o, void *_arg)
-{
-	struct copy_args *a = _arg;
-
-	if (a->type == DN_COMPAT_PIPE) {
-		struct dn_schk *s = _o;
-		if (s->sch.oid.subtype != 1 || s->sch.sched_nr <= DN_MAX_ID) {
-			return 0;	/* not old type */
-		}
-		/* copy pipe parameters, and if instance exists, copy
-		 * other parameters and eventually queues.
-		 */
-		if(dn_compat_copy_pipe(a, _o))
-			return DNHT_SCAN_END;
-	} else if (a->type == DN_COMPAT_QUEUE) {
-		struct dn_fsk *fs = _o;
-		if (fs->fs.fs_nr >= DN_MAX_ID)
-			return 0;
-		if (dn_compat_copy_queue(a, _o))
-			return DNHT_SCAN_END;
-	}
-	return 0;
-}
-
-/* Main function to manage old requests */
-int
-ip_dummynet_compat(struct sockopt *sopt)
-{
-	int error=0;
-	void *v = NULL;
-	struct dn_id oid;
-
-	/* Lenght of data, used to found ipfw version... */
-	int len = sopt->sopt_valsize;
-
-	/* len can be 0 if command was dummynet_flush */
-	if (len == pipesize7) {
-		D("setting compatibility with FreeBSD 7.2");
-		is7 = 1;
-	}
-	else if (len == pipesize8 || len == pipesizemax8) {
-		D("setting compatibility with FreeBSD 8");
-		is7 = 0;
-	}
-
-	switch (sopt->sopt_name) {
-	default:
-		printf("dummynet: -- unknown option %d", sopt->sopt_name);
-		error = EINVAL;
-		break;
-
-	case IP_DUMMYNET_FLUSH:
-		oid_fill(&oid, sizeof(oid), DN_CMD_FLUSH, DN_API_VERSION);
-		do_config(&oid, oid.len);
-		break;
-
-	case IP_DUMMYNET_DEL:
-		v = malloc(len, M_TEMP, M_WAITOK);
-		error = sooptcopyin(sopt, v, len, len);
-		if (error)
-			break;
-		error = dn_compat_del(v);
-		free(v, M_TEMP);
-		break;
-
-	case IP_DUMMYNET_CONFIGURE:
-		v = malloc(len, M_TEMP, M_WAITOK);
-		error = sooptcopyin(sopt, v, len, len);
-		if (error)
-			break;
-		error = dn_compat_configure(v);
-		free(v, M_TEMP);
-		break;
-
-	case IP_DUMMYNET_GET: {
-		void *buf;
-		int ret;
-		int original_size = sopt->sopt_valsize;
-		int size;
-
-		ret = dummynet_get(sopt, &buf);
-		if (ret)
-			return 0;//XXX ?
-		size = sopt->sopt_valsize;
-		sopt->sopt_valsize = original_size;
-		D("size=%d, buf=%p", size, buf);
-		ret = sooptcopyout(sopt, buf, size);
-		if (ret)
-			printf("  %s ERROR sooptcopyout\n", __FUNCTION__);
-		if (buf)
-			free(buf, M_DUMMYNET);
-	    }
-	}
-
-	return error;
-}
-
-
diff --git a/sys/netinet/ipfw/ip_dn_io.c b/sys/netinet/ipfw/ip_dn_io.c
deleted file mode 100644
index a39f1695de26..000000000000
--- a/sys/netinet/ipfw/ip_dn_io.c
+++ /dev/null
@@ -1,851 +0,0 @@
-/*-
- * Copyright (c) 2010 Luigi Rizzo, Riccardo Panicucci, Universita` di Pisa
- * All rights reserved
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-/*
- * Dummynet portions related to packet handling.
- */
-#include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
-
-#include "opt_inet6.h"
-
-#include <sys/param.h>
-#include <sys/systm.h>
-#include <sys/malloc.h>
-#include <sys/mbuf.h>
-#include <sys/kernel.h>
-#include <sys/lock.h>
-#include <sys/module.h>
-#include <sys/priv.h>
-#include <sys/proc.h>
-#include <sys/rwlock.h>
-#include <sys/socket.h>
-#include <sys/time.h>
-#include <sys/sysctl.h>
-
-#include <net/if.h>	/* IFNAMSIZ, struct ifaddr, ifq head, lock.h mutex.h */
-#include <net/netisr.h>
-#include <net/vnet.h>
-
-#include <netinet/in.h>
-#include <netinet/ip.h>		/* ip_len, ip_off */
-#include <netinet/ip_var.h>	/* ip_output(), IP_FORWARDING */
-#include <netinet/ip_fw.h>
-#include <netinet/ipfw/ip_fw_private.h>
-#include <netinet/ipfw/dn_heap.h>
-#include <netinet/ip_dummynet.h>
-#include <netinet/ipfw/ip_dn_private.h>
-#include <netinet/ipfw/dn_sched.h>
-
-#include <netinet/if_ether.h> /* various ether_* routines */
-
-#include <netinet/ip6.h>       /* for ip6_input, ip6_output prototypes */
-#include <netinet6/ip6_var.h>
-
-/*
- * We keep a private variable for the simulation time, but we could
- * probably use an existing one ("softticks" in sys/kern/kern_timeout.c)
- * instead of dn_cfg.curr_time
- */
-
-struct dn_parms dn_cfg;
-//VNET_DEFINE(struct dn_parms, _base_dn_cfg);
-
-static long tick_last;		/* Last tick duration (usec). */
-static long tick_delta;		/* Last vs standard tick diff (usec). */
-static long tick_delta_sum;	/* Accumulated tick difference (usec).*/
-static long tick_adjustment;	/* Tick adjustments done. */
-static long tick_lost;		/* Lost(coalesced) ticks number. */
-/* Adjusted vs non-adjusted curr_time difference (ticks). */
-static long tick_diff;
-
-static unsigned long	io_pkt;
-static unsigned long	io_pkt_fast;
-static unsigned long	io_pkt_drop;
-
-/*
- * We use a heap to store entities for which we have pending timer events.
- * The heap is checked at every tick and all entities with expired events
- * are extracted.
- */
-  
-MALLOC_DEFINE(M_DUMMYNET, "dummynet", "dummynet heap");
-
-extern	void (*bridge_dn_p)(struct mbuf *, struct ifnet *);
-
-#ifdef SYSCTL_NODE
-
-SYSBEGIN(f4)
-
-SYSCTL_DECL(_net_inet);
-SYSCTL_DECL(_net_inet_ip);
-static SYSCTL_NODE(_net_inet_ip, OID_AUTO, dummynet, CTLFLAG_RW, 0, "Dummynet");
-
-/* wrapper to pass dn_cfg fields to SYSCTL_* */
-//#define DC(x)	(&(VNET_NAME(_base_dn_cfg).x))
-#define DC(x)	(&(dn_cfg.x))
-/* parameters */
-
-static int
-sysctl_hash_size(SYSCTL_HANDLER_ARGS)
-{
-	int error, value;
-
-	value = dn_cfg.hash_size;
-	error = sysctl_handle_int(oidp, &value, 0, req);
-	if (error != 0 || req->newptr == NULL)
-		return (error);
-	if (value < 16 || value > 65536)
-		return (EINVAL);
-	dn_cfg.hash_size = value;
-	return (0);
-}
-
-SYSCTL_PROC(_net_inet_ip_dummynet, OID_AUTO, hash_size,
-    CTLTYPE_INT | CTLFLAG_RW, 0, 0, sysctl_hash_size,
-    "I", "Default hash table size");
-
-static int
-sysctl_limits(SYSCTL_HANDLER_ARGS)
-{
-	int error;
-	long value;
-
-	if (arg2 != 0)
-		value = dn_cfg.slot_limit;
-	else
-		value = dn_cfg.byte_limit;
-	error = sysctl_handle_long(oidp, &value, 0, req);
-
-	if (error != 0 || req->newptr == NULL)
-		return (error);
-	if (arg2 != 0) {
-		if (value < 1)
-			return (EINVAL);
-		dn_cfg.slot_limit = value;
-	} else {
-		if (value < 1500)
-			return (EINVAL);
-		dn_cfg.byte_limit = value;
-	}
-	return (0);
-}
-
-SYSCTL_PROC(_net_inet_ip_dummynet, OID_AUTO, pipe_slot_limit,
-    CTLTYPE_LONG | CTLFLAG_RW, 0, 1, sysctl_limits,
-    "L", "Upper limit in slots for pipe queue.");
-SYSCTL_PROC(_net_inet_ip_dummynet, OID_AUTO, pipe_byte_limit,
-    CTLTYPE_LONG | CTLFLAG_RW, 0, 0, sysctl_limits,
-    "L", "Upper limit in bytes for pipe queue.");
-SYSCTL_INT(_net_inet_ip_dummynet, OID_AUTO, io_fast,
-    CTLFLAG_RW, DC(io_fast), 0, "Enable fast dummynet io.");
-SYSCTL_INT(_net_inet_ip_dummynet, OID_AUTO, debug,
-    CTLFLAG_RW, DC(debug), 0, "Dummynet debug level");
-
-/* RED parameters */
-SYSCTL_INT(_net_inet_ip_dummynet, OID_AUTO, red_lookup_depth,
-    CTLFLAG_RD, DC(red_lookup_depth), 0, "Depth of RED lookup table");
-SYSCTL_INT(_net_inet_ip_dummynet, OID_AUTO, red_avg_pkt_size,
-    CTLFLAG_RD, DC(red_avg_pkt_size), 0, "RED Medium packet size");
-SYSCTL_INT(_net_inet_ip_dummynet, OID_AUTO, red_max_pkt_size,
-    CTLFLAG_RD, DC(red_max_pkt_size), 0, "RED Max packet size");
-
-/* time adjustment */
-SYSCTL_LONG(_net_inet_ip_dummynet, OID_AUTO, tick_delta,
-    CTLFLAG_RD, &tick_delta, 0, "Last vs standard tick difference (usec).");
-SYSCTL_LONG(_net_inet_ip_dummynet, OID_AUTO, tick_delta_sum,
-    CTLFLAG_RD, &tick_delta_sum, 0, "Accumulated tick difference (usec).");
-SYSCTL_LONG(_net_inet_ip_dummynet, OID_AUTO, tick_adjustment,
-    CTLFLAG_RD, &tick_adjustment, 0, "Tick adjustments done.");
-SYSCTL_LONG(_net_inet_ip_dummynet, OID_AUTO, tick_diff,
-    CTLFLAG_RD, &tick_diff, 0,
-    "Adjusted vs non-adjusted curr_time difference (ticks).");
-SYSCTL_LONG(_net_inet_ip_dummynet, OID_AUTO, tick_lost,
-    CTLFLAG_RD, &tick_lost, 0,
-    "Number of ticks coalesced by dummynet taskqueue.");
-
-/* Drain parameters */
-SYSCTL_UINT(_net_inet_ip_dummynet, OID_AUTO, expire,
-    CTLFLAG_RW, DC(expire), 0, "Expire empty queues/pipes");
-SYSCTL_UINT(_net_inet_ip_dummynet, OID_AUTO, expire_cycle,
-    CTLFLAG_RD, DC(expire_cycle), 0, "Expire cycle for queues/pipes");
-
-/* statistics */
-SYSCTL_INT(_net_inet_ip_dummynet, OID_AUTO, schk_count,
-    CTLFLAG_RD, DC(schk_count), 0, "Number of schedulers");
-SYSCTL_INT(_net_inet_ip_dummynet, OID_AUTO, si_count,
-    CTLFLAG_RD, DC(si_count), 0, "Number of scheduler instances");
-SYSCTL_INT(_net_inet_ip_dummynet, OID_AUTO, fsk_count,
-    CTLFLAG_RD, DC(fsk_count), 0, "Number of flowsets");
-SYSCTL_INT(_net_inet_ip_dummynet, OID_AUTO, queue_count,
-    CTLFLAG_RD, DC(queue_count), 0, "Number of queues");
-SYSCTL_ULONG(_net_inet_ip_dummynet, OID_AUTO, io_pkt,
-    CTLFLAG_RD, &io_pkt, 0,
-    "Number of packets passed to dummynet.");
-SYSCTL_ULONG(_net_inet_ip_dummynet, OID_AUTO, io_pkt_fast,
-    CTLFLAG_RD, &io_pkt_fast, 0,
-    "Number of packets bypassed dummynet scheduler.");
-SYSCTL_ULONG(_net_inet_ip_dummynet, OID_AUTO, io_pkt_drop,
-    CTLFLAG_RD, &io_pkt_drop, 0,
-    "Number of packets dropped by dummynet.");
-#undef DC
-SYSEND
-
-#endif
-
-static void	dummynet_send(struct mbuf *);
-
-/*
- * Packets processed by dummynet have an mbuf tag associated with
- * them that carries their dummynet state.
- * Outside dummynet, only the 'rule' field is relevant, and it must
- * be at the beginning of the structure.
- */
-struct dn_pkt_tag {
-	struct ipfw_rule_ref rule;	/* matching rule	*/
-
-	/* second part, dummynet specific */
-	int dn_dir;		/* action when packet comes out.*/
-				/* see ip_fw_private.h		*/
-	uint64_t output_time;	/* when the pkt is due for delivery*/
-	struct ifnet *ifp;	/* interface, for ip_output	*/
-	struct _ip6dn_args ip6opt;	/* XXX ipv6 options	*/
-};
-
-/*
- * Return the mbuf tag holding the dummynet state (it should
- * be the first one on the list).
- */
-static struct dn_pkt_tag *
-dn_tag_get(struct mbuf *m)
-{
-	struct m_tag *mtag = m_tag_first(m);
-	KASSERT(mtag != NULL &&
-	    mtag->m_tag_cookie == MTAG_ABI_COMPAT &&
-	    mtag->m_tag_id == PACKET_TAG_DUMMYNET,
-	    ("packet on dummynet queue w/o dummynet tag!"));
-	return (struct dn_pkt_tag *)(mtag+1);
-}
-
-static inline void
-mq_append(struct mq *q, struct mbuf *m)
-{
-	if (q->head == NULL)
-		q->head = m;
-	else
-		q->tail->m_nextpkt = m;
-	q->tail = m;
-	m->m_nextpkt = NULL;
-}
-
-/*
- * Dispose a list of packet. Use a functions so if we need to do
- * more work, this is a central point to do it.
- */
-void dn_free_pkts(struct mbuf *mnext)
-{
-        struct mbuf *m;
-    
-        while ((m = mnext) != NULL) {
-                mnext = m->m_nextpkt;
-                FREE_PKT(m);
-        }
-}
-
-static int
-red_drops (struct dn_queue *q, int len)
-{
-	/*
-	 * RED algorithm
-	 *
-	 * RED calculates the average queue size (avg) using a low-pass filter
-	 * with an exponential weighted (w_q) moving average:
-	 * 	avg  <-  (1-w_q) * avg + w_q * q_size
-	 * where q_size is the queue length (measured in bytes or * packets).
-	 *
-	 * If q_size == 0, we compute the idle time for the link, and set
-	 *	avg = (1 - w_q)^(idle/s)
-	 * where s is the time needed for transmitting a medium-sized packet.
-	 *
-	 * Now, if avg < min_th the packet is enqueued.
-	 * If avg > max_th the packet is dropped. Otherwise, the packet is
-	 * dropped with probability P function of avg.
-	 */
-
-	struct dn_fsk *fs = q->fs;
-	int64_t p_b = 0;
-
-	/* Queue in bytes or packets? */
-	uint32_t q_size = (fs->fs.flags & DN_QSIZE_BYTES) ?
-	    q->ni.len_bytes : q->ni.length;
-
-	/* Average queue size estimation. */
-	if (q_size != 0) {
-		/* Queue is not empty, avg <- avg + (q_size - avg) * w_q */
-		int diff = SCALE(q_size) - q->avg;
-		int64_t v = SCALE_MUL((int64_t)diff, (int64_t)fs->w_q);
-
-		q->avg += (int)v;
-	} else {
-		/*
-		 * Queue is empty, find for how long the queue has been
-		 * empty and use a lookup table for computing
-		 * (1 - * w_q)^(idle_time/s) where s is the time to send a
-		 * (small) packet.
-		 * XXX check wraps...
-		 */
-		if (q->avg) {
-			u_int t = div64((dn_cfg.curr_time - q->q_time), fs->lookup_step);
-
-			q->avg = (t < fs->lookup_depth) ?
-			    SCALE_MUL(q->avg, fs->w_q_lookup[t]) : 0;
-		}
-	}
-
-	/* Should i drop? */
-	if (q->avg < fs->min_th) {
-		q->count = -1;
-		return (0);	/* accept packet */
-	}
-	if (q->avg >= fs->max_th) {	/* average queue >=  max threshold */
-		if (fs->fs.flags & DN_IS_GENTLE_RED) {
-			/*
-			 * According to Gentle-RED, if avg is greater than
-			 * max_th the packet is dropped with a probability
-			 *	 p_b = c_3 * avg - c_4
-			 * where c_3 = (1 - max_p) / max_th
-			 *       c_4 = 1 - 2 * max_p
-			 */
-			p_b = SCALE_MUL((int64_t)fs->c_3, (int64_t)q->avg) -
-			    fs->c_4;
-		} else {
-			q->count = -1;
-			return (1);
-		}
-	} else if (q->avg > fs->min_th) {
-		/*
-		 * We compute p_b using the linear dropping function
-		 *	 p_b = c_1 * avg - c_2
-		 * where c_1 = max_p / (max_th - min_th)
-		 * 	 c_2 = max_p * min_th / (max_th - min_th)
-		 */
-		p_b = SCALE_MUL((int64_t)fs->c_1, (int64_t)q->avg) - fs->c_2;
-	}
-
-	if (fs->fs.flags & DN_QSIZE_BYTES)
-		p_b = div64((p_b * len) , fs->max_pkt_size);
-	if (++q->count == 0)
-		q->random = random() & 0xffff;
-	else {
-		/*
-		 * q->count counts packets arrived since last drop, so a greater
-		 * value of q->count means a greater packet drop probability.
-		 */
-		if (SCALE_MUL(p_b, SCALE((int64_t)q->count)) > q->random) {
-			q->count = 0;
-			/* After a drop we calculate a new random value. */
-			q->random = random() & 0xffff;
-			return (1);	/* drop */
-		}
-	}
-	/* End of RED algorithm. */
-
-	return (0);	/* accept */
-
-}
-
-/*
- * Enqueue a packet in q, subject to space and queue management policy
- * (whose parameters are in q->fs).
- * Update stats for the queue and the scheduler.
- * Return 0 on success, 1 on drop. The packet is consumed anyways.
- */
-int
-dn_enqueue(struct dn_queue *q, struct mbuf* m, int drop)
-{   
-	struct dn_fs *f;
-	struct dn_flow *ni;	/* stats for scheduler instance */
-	uint64_t len;
-
-	if (q->fs == NULL || q->_si == NULL) {
-		printf("%s fs %p si %p, dropping\n",
-			__FUNCTION__, q->fs, q->_si);
-		FREE_PKT(m);
-		return 1;
-	}
-	f = &(q->fs->fs);
-	ni = &q->_si->ni;
-	len = m->m_pkthdr.len;
-	/* Update statistics, then check reasons to drop pkt. */
-	q->ni.tot_bytes += len;
-	q->ni.tot_pkts++;
-	ni->tot_bytes += len;
-	ni->tot_pkts++;
-	if (drop)
-		goto drop;
-	if (f->plr && random() < f->plr)
-		goto drop;
-	if (f->flags & DN_IS_RED && red_drops(q, m->m_pkthdr.len))
-		goto drop;
-	if (f->flags & DN_QSIZE_BYTES) {
-		if (q->ni.len_bytes > f->qsize)
-			goto drop;
-	} else if (q->ni.length >= f->qsize) {
-		goto drop;
-	}
-	mq_append(&q->mq, m);
-	q->ni.length++;
-	q->ni.len_bytes += len;
-	ni->length++;
-	ni->len_bytes += len;
-	return 0;
-
-drop:
-	io_pkt_drop++;
-	q->ni.drops++;
-	ni->drops++;
-	FREE_PKT(m);
-	return 1;
-}
-
-/*
- * Fetch packets from the delay line which are due now. If there are
- * leftover packets, reinsert the delay line in the heap.
- * Runs under scheduler lock.
- */
-static void
-transmit_event(struct mq *q, struct delay_line *dline, uint64_t now)
-{
-	struct mbuf *m;
-	struct dn_pkt_tag *pkt = NULL;
-
-	dline->oid.subtype = 0; /* not in heap */
-	while ((m = dline->mq.head) != NULL) {
-		pkt = dn_tag_get(m);
-		if (!DN_KEY_LEQ(pkt->output_time, now))
-			break;
-		dline->mq.head = m->m_nextpkt;
-		mq_append(q, m);
-	}
-	if (m != NULL) {
-		dline->oid.subtype = 1; /* in heap */
-		heap_insert(&dn_cfg.evheap, pkt->output_time, dline);
-	}
-}
-
-/*
- * Convert the additional MAC overheads/delays into an equivalent
- * number of bits for the given data rate. The samples are
- * in milliseconds so we need to divide by 1000.
- */
-static uint64_t
-extra_bits(struct mbuf *m, struct dn_schk *s)
-{
-	int index;
-	uint64_t bits;
-	struct dn_profile *pf = s->profile;
-
-	if (!pf || pf->samples_no == 0)
-		return 0;
-	index  = random() % pf->samples_no;
-	bits = div64((uint64_t)pf->samples[index] * s->link.bandwidth, 1000);
-	if (index >= pf->loss_level) {
-		struct dn_pkt_tag *dt = dn_tag_get(m);
-		if (dt)
-			dt->dn_dir = DIR_DROP;
-	}
-	return bits;
-}
-
-/*
- * Send traffic from a scheduler instance due by 'now'.
- * Return a pointer to the head of the queue.
- */
-static struct mbuf *
-serve_sched(struct mq *q, struct dn_sch_inst *si, uint64_t now)
-{
-	struct mq def_q;
-	struct dn_schk *s = si->sched;
-	struct mbuf *m = NULL;
-	int delay_line_idle = (si->dline.mq.head == NULL);
-	int done, bw;
-
-	if (q == NULL) {
-		q = &def_q;
-		q->head = NULL;
-	}
-
-	bw = s->link.bandwidth;
-	si->kflags &= ~DN_ACTIVE;
-
-	if (bw > 0)
-		si->credit += (now - si->sched_time) * bw;
-	else
-		si->credit = 0;
-	si->sched_time = now;
-	done = 0;
-	while (si->credit >= 0 && (m = s->fp->dequeue(si)) != NULL) {
-		uint64_t len_scaled;
-
-		done++;
-		len_scaled = (bw == 0) ? 0 : hz *
-			(m->m_pkthdr.len * 8 + extra_bits(m, s));
-		si->credit -= len_scaled;
-		/* Move packet in the delay line */
-		dn_tag_get(m)->output_time = dn_cfg.curr_time + s->link.delay ;
-		mq_append(&si->dline.mq, m);
-	}
-
-	/*
-	 * If credit >= 0 the instance is idle, mark time.
-	 * Otherwise put back in the heap, and adjust the output
-	 * time of the last inserted packet, m, which was too early.
-	 */
-	if (si->credit >= 0) {
-		si->idle_time = now;
-	} else {
-		uint64_t t;
-		KASSERT (bw > 0, ("bw=0 and credit<0 ?"));
-		t = div64(bw - 1 - si->credit, bw);
-		if (m)
-			dn_tag_get(m)->output_time += t;
-		si->kflags |= DN_ACTIVE;
-		heap_insert(&dn_cfg.evheap, now + t, si);
-	}
-	if (delay_line_idle && done)
-		transmit_event(q, &si->dline, now);
-	return q->head;
-}
-
-/*
- * The timer handler for dummynet. Time is computed in ticks, but
- * but the code is tolerant to the actual rate at which this is called.
- * Once complete, the function reschedules itself for the next tick.
- */
-void
-dummynet_task(void *context, int pending)
-{
-	struct timeval t;
-	struct mq q = { NULL, NULL }; /* queue to accumulate results */
-
-	CURVNET_SET((struct vnet *)context);
-
-	DN_BH_WLOCK();
-
-	/* Update number of lost(coalesced) ticks. */
-	tick_lost += pending - 1;
-
-	getmicrouptime(&t);
-	/* Last tick duration (usec). */
-	tick_last = (t.tv_sec - dn_cfg.prev_t.tv_sec) * 1000000 +
-	(t.tv_usec - dn_cfg.prev_t.tv_usec);
-	/* Last tick vs standard tick difference (usec). */
-	tick_delta = (tick_last * hz - 1000000) / hz;
-	/* Accumulated tick difference (usec). */
-	tick_delta_sum += tick_delta;
-
-	dn_cfg.prev_t = t;
-
-	/*
-	* Adjust curr_time if the accumulated tick difference is
-	* greater than the 'standard' tick. Since curr_time should
-	* be monotonically increasing, we do positive adjustments
-	* as required, and throttle curr_time in case of negative
-	* adjustment.
-	*/
-	dn_cfg.curr_time++;
-	if (tick_delta_sum - tick >= 0) {
-		int diff = tick_delta_sum / tick;
-
-		dn_cfg.curr_time += diff;
-		tick_diff += diff;
-		tick_delta_sum %= tick;
-		tick_adjustment++;
-	} else if (tick_delta_sum + tick <= 0) {
-		dn_cfg.curr_time--;
-		tick_diff--;
-		tick_delta_sum += tick;
-		tick_adjustment++;
-	}
-
-	/* serve pending events, accumulate in q */
-	for (;;) {
-		struct dn_id *p;    /* generic parameter to handler */
-
-		if (dn_cfg.evheap.elements == 0 ||
-		    DN_KEY_LT(dn_cfg.curr_time, HEAP_TOP(&dn_cfg.evheap)->key))
-			break;
-		p = HEAP_TOP(&dn_cfg.evheap)->object;
-		heap_extract(&dn_cfg.evheap, NULL);
-
-		if (p->type == DN_SCH_I) {
-			serve_sched(&q, (struct dn_sch_inst *)p, dn_cfg.curr_time);
-		} else { /* extracted a delay line */
-			transmit_event(&q, (struct delay_line *)p, dn_cfg.curr_time);
-		}
-	}
-	if (dn_cfg.expire && ++dn_cfg.expire_cycle >= dn_cfg.expire) {
-		dn_cfg.expire_cycle = 0;
-		dn_drain_scheduler();
-		dn_drain_queue();
-	}
-
-	DN_BH_WUNLOCK();
-	dn_reschedule();
-	if (q.head != NULL)
-		dummynet_send(q.head);
-	CURVNET_RESTORE();
-}
-
-/*
- * forward a chain of packets to the proper destination.
- * This runs outside the dummynet lock.
- */
-static void
-dummynet_send(struct mbuf *m)
-{
-	struct mbuf *n;
-
-	for (; m != NULL; m = n) {
-		struct ifnet *ifp = NULL;	/* gcc 3.4.6 complains */
-        	struct m_tag *tag;
-		int dst;
-
-		n = m->m_nextpkt;
-		m->m_nextpkt = NULL;
-		tag = m_tag_first(m);
-		if (tag == NULL) { /* should not happen */
-			dst = DIR_DROP;
-		} else {
-			struct dn_pkt_tag *pkt = dn_tag_get(m);
-			/* extract the dummynet info, rename the tag
-			 * to carry reinject info.
-			 */
-			dst = pkt->dn_dir;
-			ifp = pkt->ifp;
-			tag->m_tag_cookie = MTAG_IPFW_RULE;
-			tag->m_tag_id = 0;
-		}
-
-		switch (dst) {
-		case DIR_OUT:
-			SET_HOST_IPLEN(mtod(m, struct ip *));
-			ip_output(m, NULL, NULL, IP_FORWARDING, NULL, NULL);
-			break ;
-
-		case DIR_IN :
-			/* put header in network format for ip_input() */
-			//SET_NET_IPLEN(mtod(m, struct ip *));
-			netisr_dispatch(NETISR_IP, m);
-			break;
-
-#ifdef INET6
-		case DIR_IN | PROTO_IPV6:
-			netisr_dispatch(NETISR_IPV6, m);
-			break;
-
-		case DIR_OUT | PROTO_IPV6:
-			ip6_output(m, NULL, NULL, IPV6_FORWARDING, NULL, NULL, NULL);
-			break;
-#endif
-
-		case DIR_FWD | PROTO_IFB: /* DN_TO_IFB_FWD: */
-			if (bridge_dn_p != NULL)
-				((*bridge_dn_p)(m, ifp));
-			else
-				printf("dummynet: if_bridge not loaded\n");
-
-			break;
-
-		case DIR_IN | PROTO_LAYER2: /* DN_TO_ETH_DEMUX: */
-			/*
-			 * The Ethernet code assumes the Ethernet header is
-			 * contiguous in the first mbuf header.
-			 * Insure this is true.
-			 */
-			if (m->m_len < ETHER_HDR_LEN &&
-			    (m = m_pullup(m, ETHER_HDR_LEN)) == NULL) {
-				printf("dummynet/ether: pullup failed, "
-				    "dropping packet\n");
-				break;
-			}
-			ether_demux(m->m_pkthdr.rcvif, m);
-			break;
-
-		case DIR_OUT | PROTO_LAYER2: /* N_TO_ETH_OUT: */
-			ether_output_frame(ifp, m);
-			break;
-
-		case DIR_DROP:
-			/* drop the packet after some time */
-			FREE_PKT(m);
-			break;
-
-		default:
-			printf("dummynet: bad switch %d!\n", dst);
-			FREE_PKT(m);
-			break;
-		}
-	}
-}
-
-static inline int
-tag_mbuf(struct mbuf *m, int dir, struct ip_fw_args *fwa)
-{
-	struct dn_pkt_tag *dt;
-	struct m_tag *mtag;
-
-	mtag = m_tag_get(PACKET_TAG_DUMMYNET,
-		    sizeof(*dt), M_NOWAIT | M_ZERO);
-	if (mtag == NULL)
-		return 1;		/* Cannot allocate packet header. */
-	m_tag_prepend(m, mtag);		/* Attach to mbuf chain. */
-	dt = (struct dn_pkt_tag *)(mtag + 1);
-	dt->rule = fwa->rule;
-	dt->rule.info &= IPFW_ONEPASS;	/* only keep this info */
-	dt->dn_dir = dir;
-	dt->ifp = fwa->oif;
-	/* dt->output tame is updated as we move through */
-	dt->output_time = dn_cfg.curr_time;
-	return 0;
-}
-
-
-/*
- * dummynet hook for packets.
- * We use the argument to locate the flowset fs and the sched_set sch
- * associated to it. The we apply flow_mask and sched_mask to
- * determine the queue and scheduler instances.
- *
- * dir		where shall we send the packet after dummynet.
- * *m0		the mbuf with the packet
- * ifp		the 'ifp' parameter from the caller.
- *		NULL in ip_input, destination interface in ip_output,
- */
-int
-dummynet_io(struct mbuf **m0, int dir, struct ip_fw_args *fwa)
-{
-	struct mbuf *m = *m0;
-	struct dn_fsk *fs = NULL;
-	struct dn_sch_inst *si;
-	struct dn_queue *q = NULL;	/* default */
-
-	int fs_id = (fwa->rule.info & IPFW_INFO_MASK) +
-		((fwa->rule.info & IPFW_IS_PIPE) ? 2*DN_MAX_ID : 0);
-	DN_BH_WLOCK();
-	io_pkt++;
-	/* we could actually tag outside the lock, but who cares... */
-	if (tag_mbuf(m, dir, fwa))
-		goto dropit;
-	if (dn_cfg.busy) {
-		/* if the upper half is busy doing something expensive,
-		 * lets queue the packet and move forward
-		 */
-		mq_append(&dn_cfg.pending, m);
-		m = *m0 = NULL; /* consumed */
-		goto done; /* already active, nothing to do */
-	}
-	/* XXX locate_flowset could be optimised with a direct ref. */
-	fs = dn_ht_find(dn_cfg.fshash, fs_id, 0, NULL);
-	if (fs == NULL)
-		goto dropit;	/* This queue/pipe does not exist! */
-	if (fs->sched == NULL)	/* should not happen */
-		goto dropit;
-	/* find scheduler instance, possibly applying sched_mask */
-	si = ipdn_si_find(fs->sched, &(fwa->f_id));
-	if (si == NULL)
-		goto dropit;
-	/*
-	 * If the scheduler supports multiple queues, find the right one
-	 * (otherwise it will be ignored by enqueue).
-	 */
-	if (fs->sched->fp->flags & DN_MULTIQUEUE) {
-		q = ipdn_q_find(fs, si, &(fwa->f_id));
-		if (q == NULL)
-			goto dropit;
-	}
-	if (fs->sched->fp->enqueue(si, q, m)) {
-		/* packet was dropped by enqueue() */
-		m = *m0 = NULL;
-		goto dropit;
-	}
-
-	if (si->kflags & DN_ACTIVE) {
-		m = *m0 = NULL; /* consumed */
-		goto done; /* already active, nothing to do */
-	}
-
-	/* compute the initial allowance */
-	if (si->idle_time < dn_cfg.curr_time) {
-	    /* Do this only on the first packet on an idle pipe */
-	    struct dn_link *p = &fs->sched->link;
-
-	    si->sched_time = dn_cfg.curr_time;
-	    si->credit = dn_cfg.io_fast ? p->bandwidth : 0;
-	    if (p->burst) {
-		uint64_t burst = (dn_cfg.curr_time - si->idle_time) * p->bandwidth;
-		if (burst > p->burst)
-			burst = p->burst;
-		si->credit += burst;
-	    }
-	}
-	/* pass through scheduler and delay line */
-	m = serve_sched(NULL, si, dn_cfg.curr_time);
-
-	/* optimization -- pass it back to ipfw for immediate send */
-	/* XXX Don't call dummynet_send() if scheduler return the packet
-	 *     just enqueued. This avoid a lock order reversal.
-	 *     
-	 */
-	if (/*dn_cfg.io_fast &&*/ m == *m0 && (dir & PROTO_LAYER2) == 0 ) {
-		/* fast io, rename the tag * to carry reinject info. */
-		struct m_tag *tag = m_tag_first(m);
-
-		tag->m_tag_cookie = MTAG_IPFW_RULE;
-		tag->m_tag_id = 0;
-		io_pkt_fast++;
-		if (m->m_nextpkt != NULL) {
-			printf("dummynet: fast io: pkt chain detected!\n");
-			m->m_nextpkt = NULL;
-		}
-		m = NULL;
-	} else {
-		*m0 = NULL;
-	}
-done:
-	DN_BH_WUNLOCK();
-	if (m)
-		dummynet_send(m);
-	return 0;
-
-dropit:
-	io_pkt_drop++;
-	DN_BH_WUNLOCK();
-	if (m)
-		FREE_PKT(m);
-	*m0 = NULL;
-	return (fs && (fs->fs.flags & DN_NOERROR)) ? 0 : ENOBUFS;
-}
diff --git a/sys/netinet/ipfw/ip_dn_private.h b/sys/netinet/ipfw/ip_dn_private.h
deleted file mode 100644
index 159ddc9ab8b2..000000000000
--- a/sys/netinet/ipfw/ip_dn_private.h
+++ /dev/null
@@ -1,403 +0,0 @@
-/*-
- * Copyright (c) 2010 Luigi Rizzo, Riccardo Panicucci, Universita` di Pisa
- * All rights reserved
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-/*
- * internal dummynet APIs.
- *
- * $FreeBSD$
- */
-
-#ifndef _IP_DN_PRIVATE_H
-#define _IP_DN_PRIVATE_H
-
-/* debugging support
- * use ND() to remove debugging, D() to print a line,
- * DX(level, ...) to print above a certain level
- * If you redefine D() you are expected to redefine all.
- */
-#ifndef D
-#define ND(fmt, ...) do {} while (0)
-#define D1(fmt, ...) do {} while (0)
-#define D(fmt, ...) printf("%-10s " fmt "\n",      \
-        __FUNCTION__, ## __VA_ARGS__)
-#define DX(lev, fmt, ...) do {              \
-        if (dn_cfg.debug > lev) D(fmt, ## __VA_ARGS__); } while (0)
-#endif
-
-MALLOC_DECLARE(M_DUMMYNET);
-
-#ifndef __linux__
-#define div64(a, b)  ((int64_t)(a) / (int64_t)(b))
-#endif
-
-#define DN_LOCK_INIT() do {				\
-	mtx_init(&dn_cfg.uh_mtx, "dn_uh", NULL, MTX_DEF);	\
-	mtx_init(&dn_cfg.bh_mtx, "dn_bh", NULL, MTX_DEF);	\
-	} while (0)
-#define DN_LOCK_DESTROY() do {				\
-	mtx_destroy(&dn_cfg.uh_mtx);			\
-	mtx_destroy(&dn_cfg.bh_mtx);			\
-	} while (0)
-#if 0 /* not used yet */
-#define DN_UH_RLOCK()		mtx_lock(&dn_cfg.uh_mtx)
-#define DN_UH_RUNLOCK()		mtx_unlock(&dn_cfg.uh_mtx)
-#define DN_UH_WLOCK()		mtx_lock(&dn_cfg.uh_mtx)
-#define DN_UH_WUNLOCK()		mtx_unlock(&dn_cfg.uh_mtx)
-#define DN_UH_LOCK_ASSERT()	mtx_assert(&dn_cfg.uh_mtx, MA_OWNED)
-#endif
-
-#define DN_BH_RLOCK()		mtx_lock(&dn_cfg.uh_mtx)
-#define DN_BH_RUNLOCK()		mtx_unlock(&dn_cfg.uh_mtx)
-#define DN_BH_WLOCK()		mtx_lock(&dn_cfg.uh_mtx)
-#define DN_BH_WUNLOCK()		mtx_unlock(&dn_cfg.uh_mtx)
-#define DN_BH_LOCK_ASSERT()	mtx_assert(&dn_cfg.uh_mtx, MA_OWNED)
-
-SLIST_HEAD(dn_schk_head, dn_schk);
-SLIST_HEAD(dn_sch_inst_head, dn_sch_inst);
-SLIST_HEAD(dn_fsk_head, dn_fsk);
-SLIST_HEAD(dn_queue_head, dn_queue);
-SLIST_HEAD(dn_alg_head, dn_alg);
-
-struct mq {	/* a basic queue of packets*/
-        struct mbuf *head, *tail;
-};
-
-static inline void
-set_oid(struct dn_id *o, int type, int len)
-{
-        o->type = type;
-        o->len = len;
-        o->subtype = 0;
-};
-
-/*
- * configuration and global data for a dummynet instance
- *
- * When a configuration is modified from userland, 'id' is incremented
- * so we can use the value to check for stale pointers.
- */
-struct dn_parms {
-	uint32_t	id;		/* configuration version */
-
-	/* defaults (sysctl-accessible) */
-	int	red_lookup_depth;
-	int	red_avg_pkt_size;
-	int	red_max_pkt_size;
-	int	hash_size;
-	int	max_hash_size;
-	long	byte_limit;		/* max queue sizes */
-	long	slot_limit;
-
-	int	io_fast;
-	int	debug;
-
-	/* timekeeping */
-	struct timeval prev_t;		/* last time dummynet_tick ran */
-	struct dn_heap	evheap;		/* scheduled events */
-
-	/* counters of objects -- used for reporting space */
-	int	schk_count;
-	int	si_count;
-	int	fsk_count;
-	int	queue_count;
-
-	/* ticks and other stuff */
-	uint64_t	curr_time;
-	/* flowsets and schedulers are in hash tables, with 'hash_size'
-	 * buckets. fshash is looked up at every packet arrival
-	 * so better be generous if we expect many entries.
-	 */
-	struct dn_ht	*fshash;
-	struct dn_ht	*schedhash;
-	/* list of flowsets without a scheduler -- use sch_chain */
-	struct dn_fsk_head	fsu;	/* list of unlinked flowsets */
-	struct dn_alg_head	schedlist;	/* list of algorithms */
-
-	/* Store the fs/sch to scan when draining. The value is the
-	 * bucket number of the hash table. Expire can be disabled
-	 * with net.inet.ip.dummynet.expire=0, or it happens every
-	 * expire ticks.
-	 **/
-	int drain_fs;
-	int drain_sch;
-	uint32_t expire;
-	uint32_t expire_cycle;	/* tick count */
-
-	int init_done;
-
-	/* if the upper half is busy doing something long,
-	 * can set the busy flag and we will enqueue packets in
-	 * a queue for later processing.
-	 */
-	int	busy;
-	struct	mq	pending;
-
-#ifdef _KERNEL
-	/*
-	 * This file is normally used in the kernel, unless we do
-	 * some userland tests, in which case we do not need a mtx.
-	 * uh_mtx arbitrates between system calls and also
-	 * protects fshash, schedhash and fsunlinked.
-	 * These structures are readonly for the lower half.
-	 * bh_mtx protects all other structures which may be
-	 * modified upon packet arrivals
-	 */
-#if defined( __linux__ ) || defined( _WIN32 )
-	spinlock_t uh_mtx;
-	spinlock_t bh_mtx;
-#else
-	struct mtx uh_mtx;
-	struct mtx bh_mtx;
-#endif
-
-#endif /* _KERNEL */
-};
-
-/*
- * Delay line, contains all packets on output from a link.
- * Every scheduler instance has one.
- */
-struct delay_line {
-	struct dn_id oid;
-	struct dn_sch_inst *si;
-	struct mq mq;
-};
-
-/*
- * The kernel side of a flowset. It is linked in a hash table
- * of flowsets, and in a list of children of their parent scheduler.
- * qht is either the queue or (if HAVE_MASK) a hash table queues.
- * Note that the mask to use is the (flow_mask|sched_mask), which
- * changes as we attach/detach schedulers. So we store it here.
- *
- * XXX If we want to add scheduler-specific parameters, we need to
- * put them in external storage because the scheduler may not be
- * available when the fsk is created.
- */
-struct dn_fsk { /* kernel side of a flowset */
-	struct dn_fs fs;
-	SLIST_ENTRY(dn_fsk) fsk_next;	/* hash chain for fshash */
-
-	struct ipfw_flow_id fsk_mask;
-
-	/* qht is a hash table of queues, or just a single queue
-	 * a bit in fs.flags tells us which one
-	 */
-	struct dn_ht	*qht;
-	struct dn_schk *sched;		/* Sched we are linked to */
-	SLIST_ENTRY(dn_fsk) sch_chain;	/* list of fsk attached to sched */
-
-	/* bucket index used by drain routine to drain queues for this
-	 * flowset
-	 */
-	int drain_bucket;
-	/* Parameter realted to RED / GRED */
-	/* original values are in dn_fs*/
-	int w_q ;		/* queue weight (scaled) */
-	int max_th ;		/* maximum threshold for queue (scaled) */
-	int min_th ;		/* minimum threshold for queue (scaled) */
-	int max_p ;		/* maximum value for p_b (scaled) */
-
-	u_int c_1 ;		/* max_p/(max_th-min_th) (scaled) */
-	u_int c_2 ;		/* max_p*min_th/(max_th-min_th) (scaled) */
-	u_int c_3 ;		/* for GRED, (1-max_p)/max_th (scaled) */
-	u_int c_4 ;		/* for GRED, 1 - 2*max_p (scaled) */
-	u_int * w_q_lookup ;	/* lookup table for computing (1-w_q)^t */
-	u_int lookup_depth ;	/* depth of lookup table */
-	int lookup_step ;	/* granularity inside the lookup table */
-	int lookup_weight ;	/* equal to (1-w_q)^t / (1-w_q)^(t+1) */
-	int avg_pkt_size ;	/* medium packet size */
-	int max_pkt_size ;	/* max packet size */
-};
-
-/*
- * A queue is created as a child of a flowset unless it belongs to
- * a !MULTIQUEUE scheduler. It is normally in a hash table in the
- * flowset. fs always points to the parent flowset.
- * si normally points to the sch_inst, unless the flowset has been
- * detached from the scheduler -- in this case si == NULL and we
- * should not enqueue.
- */
-struct dn_queue {
-	struct dn_flow ni;	/* oid, flow_id, stats */
-	struct mq mq;	/* packets queue */
-	struct dn_sch_inst *_si;	/* owner scheduler instance */
-	SLIST_ENTRY(dn_queue) q_next; /* hash chain list for qht */
-	struct dn_fsk *fs;		/* parent flowset. */
-
-	/* RED parameters */
-	int avg;		/* average queue length est. (scaled) */
-	int count;		/* arrivals since last RED drop */
-	int random;		/* random value (scaled) */
-	uint64_t q_time;	/* start of queue idle time */
-
-};
-
-/*
- * The kernel side of a scheduler. Contains the userland config,
- * a link, pointer to extra config arguments from command line,
- * kernel flags, and a pointer to the scheduler methods.
- * It is stored in a hash table, and holds a list of all
- * flowsets and scheduler instances.
- * XXX sch must be at the beginning, see schk_hash().
- */
-struct dn_schk {
-	struct dn_sch sch;
-	struct dn_alg *fp;	/* Pointer to scheduler functions */
-	struct dn_link link;	/* The link, embedded */
-	struct dn_profile *profile; /* delay profile, if any */
-	struct dn_id *cfg;	/* extra config arguments */
-
-	SLIST_ENTRY(dn_schk) schk_next;  /* hash chain for schedhash */
-
-	struct dn_fsk_head fsk_list;  /* all fsk linked to me */
-	struct dn_fsk *fs;	/* Flowset for !MULTIQUEUE */
-
-	/* bucket index used by the drain routine to drain the scheduler
-	 * instance for this flowset.
-	 */
-	int drain_bucket;
-
-	/* Hash table of all instances (through sch.sched_mask)
-	 * or single instance if no mask. Always valid.
-	 */
-	struct dn_ht	*siht;
-};
-
-
-/*
- * Scheduler instance.
- * Contains variables and all queues relative to a this instance.
- * This struct is created a runtime.
- */
-struct dn_sch_inst {
-	struct dn_flow	ni;	/* oid, flowid and stats */
-	SLIST_ENTRY(dn_sch_inst) si_next; /* hash chain for siht */
-	struct delay_line dline;
-	struct dn_schk *sched;	/* the template */
-	int		kflags;	/* DN_ACTIVE */
-
-	int64_t	credit;		/* bits I can transmit (more or less). */
-	uint64_t sched_time;	/* time link was scheduled in ready_heap */
-	uint64_t idle_time;	/* start of scheduler instance idle time */
-
-	/* q_count is the number of queues that this instance is using.
-	 * The counter is incremented or decremented when
-	 * a reference from the queue is created or deleted.
-	 * It is used to make sure that a scheduler instance can be safely
-	 * deleted by the drain routine. See notes below.
-	 */
-	int q_count;
-
-};
-
-/*
- * NOTE about object drain.
- * The system will automatically (XXX check when) drain queues and
- * scheduler instances when they are idle.
- * A queue is idle when it has no packets; an instance is idle when
- * it is not in the evheap heap, and the corresponding delay line is empty.
- * A queue can be safely deleted when it is idle because of the scheduler
- * function xxx_free_queue() will remove any references to it.
- * An instance can be only deleted when no queues reference it. To be sure
- * of that, a counter (q_count) stores the number of queues that are pointing
- * to the instance.
- *
- * XXX
- * Order of scan:
- * - take all flowset in a bucket for the flowset hash table
- * - take all queues in a bucket for the flowset
- * - increment the queue bucket
- * - scan next flowset bucket
- * Nothing is done if a bucket contains no entries.
- *
- * The same schema is used for sceduler instances
- */
-
-
-/* kernel-side flags. Linux has DN_DELETE in fcntl.h
- */
-enum {
-	/* 1 and 2 are reserved for the SCAN flags */
-	DN_DESTROY	= 0x0004, /* destroy */
-	DN_DELETE_FS	= 0x0008, /* destroy flowset */
-	DN_DETACH	= 0x0010,
-	DN_ACTIVE	= 0x0020, /* object is in evheap */
-	DN_F_DLINE	= 0x0040, /* object is a delay line */
-	DN_DEL_SAFE	= 0x0080, /* delete a queue only if no longer needed
-				   * by scheduler */
-	DN_QHT_IS_Q	= 0x0100, /* in flowset, qht is a single queue */
-};
-
-extern struct dn_parms dn_cfg;
-//VNET_DECLARE(struct dn_parms, _base_dn_cfg);
-//#define dn_cfg	VNET(_base_dn_cfg)
-
-int dummynet_io(struct mbuf **, int , struct ip_fw_args *);
-void dummynet_task(void *context, int pending);
-void dn_reschedule(void);
-
-struct dn_queue *ipdn_q_find(struct dn_fsk *, struct dn_sch_inst *,
-        struct ipfw_flow_id *);
-struct dn_sch_inst *ipdn_si_find(struct dn_schk *, struct ipfw_flow_id *);
-
-/*
- * copy_range is a template for requests for ranges of pipes/queues/scheds.
- * The number of ranges is variable and can be derived by o.len.
- * As a default, we use a small number of entries so that the struct
- * fits easily on the stack and is sufficient for most common requests.
- */
-#define DEFAULT_RANGES	5
-struct copy_range {
-        struct dn_id o;
-        uint32_t	r[ 2 * DEFAULT_RANGES ];
-};
-
-struct copy_args {
-	char **start;
-	char *end;
-	int flags;
-	int type;
-	struct copy_range *extra;	/* extra filtering */
-};
-
-struct sockopt;
-int ip_dummynet_compat(struct sockopt *sopt);
-int dummynet_get(struct sockopt *sopt, void **compat);
-int dn_c_copy_q (void *_ni, void *arg);
-int dn_c_copy_pipe(struct dn_schk *s, struct copy_args *a, int nq);
-int dn_c_copy_fs(struct dn_fsk *f, struct copy_args *a, int nq);
-int dn_compat_copy_queue(struct copy_args *a, void *_o);
-int dn_compat_copy_pipe(struct copy_args *a, void *_o);
-int copy_data_helper_compat(void *_o, void *_arg);
-int dn_compat_calc_size(void);
-int do_config(void *p, int l);
-
-/* function to drain idle object */
-void dn_drain_scheduler(void);
-void dn_drain_queue(void);
-
-#endif /* _IP_DN_PRIVATE_H */
diff --git a/sys/netinet/ipfw/ip_dummynet.c b/sys/netinet/ipfw/ip_dummynet.c
deleted file mode 100644
index 928176e24f7a..000000000000
--- a/sys/netinet/ipfw/ip_dummynet.c
+++ /dev/null
@@ -1,2313 +0,0 @@
-/*-
- * Copyright (c) 1998-2002,2010 Luigi Rizzo, Universita` di Pisa
- * Portions Copyright (c) 2000 Akamba Corp.
- * All rights reserved
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
-
-/*
- * Configuration and internal object management for dummynet.
- */
-
-#include "opt_inet6.h"
-
-#include <sys/param.h>
-#include <sys/systm.h>
-#include <sys/malloc.h>
-#include <sys/mbuf.h>
-#include <sys/kernel.h>
-#include <sys/lock.h>
-#include <sys/module.h>
-#include <sys/priv.h>
-#include <sys/proc.h>
-#include <sys/rwlock.h>
-#include <sys/socket.h>
-#include <sys/socketvar.h>
-#include <sys/time.h>
-#include <sys/taskqueue.h>
-#include <net/if.h>	/* IFNAMSIZ, struct ifaddr, ifq head, lock.h mutex.h */
-#include <netinet/in.h>
-#include <netinet/ip_var.h>	/* ip_output(), IP_FORWARDING */
-#include <netinet/ip_fw.h>
-#include <netinet/ipfw/ip_fw_private.h>
-#include <netinet/ipfw/dn_heap.h>
-#include <netinet/ip_dummynet.h>
-#include <netinet/ipfw/ip_dn_private.h>
-#include <netinet/ipfw/dn_sched.h>
-
-/* which objects to copy */
-#define DN_C_LINK 	0x01
-#define DN_C_SCH	0x02
-#define DN_C_FLOW	0x04
-#define DN_C_FS		0x08
-#define DN_C_QUEUE	0x10
-
-/* we use this argument in case of a schk_new */
-struct schk_new_arg {
-	struct dn_alg *fp;
-	struct dn_sch *sch;
-};
-
-/*---- callout hooks. ----*/
-static struct callout dn_timeout;
-static struct task	dn_task;
-static struct taskqueue	*dn_tq = NULL;
-
-static void
-dummynet(void * __unused unused)
-{
-
-	taskqueue_enqueue(dn_tq, &dn_task);
-}
-
-void
-dn_reschedule(void)
-{
-	callout_reset(&dn_timeout, 1, dummynet, NULL);
-}
-/*----- end of callout hooks -----*/
-
-/* Return a scheduler descriptor given the type or name. */
-static struct dn_alg *
-find_sched_type(int type, char *name)
-{
-	struct dn_alg *d;
-
-	SLIST_FOREACH(d, &dn_cfg.schedlist, next) {
-		if (d->type == type || (name && !strcasecmp(d->name, name)))
-			return d;
-	}
-	return NULL; /* not found */
-}
-
-int
-ipdn_bound_var(int *v, int dflt, int lo, int hi, const char *msg)
-{
-	int oldv = *v;
-	const char *op = NULL;
-	if (dflt < lo)
-		dflt = lo;
-	if (dflt > hi)
-		dflt = hi;
-	if (oldv < lo) {
-		*v = dflt;
-		op = "Bump";
-	} else if (oldv > hi) {
-		*v = hi;
-		op = "Clamp";
-	} else
-		return *v;
-	if (op && msg)
-		printf("%s %s to %d (was %d)\n", op, msg, *v, oldv);
-	return *v;
-}
-
-/*---- flow_id mask, hash and compare functions ---*/
-/*
- * The flow_id includes the 5-tuple, the queue/pipe number
- * which we store in the extra area in host order,
- * and for ipv6 also the flow_id6.
- * XXX see if we want the tos byte (can store in 'flags')
- */
-static struct ipfw_flow_id *
-flow_id_mask(struct ipfw_flow_id *mask, struct ipfw_flow_id *id)
-{
-	int is_v6 = IS_IP6_FLOW_ID(id);
-
-	id->dst_port &= mask->dst_port;
-	id->src_port &= mask->src_port;
-	id->proto &= mask->proto;
-	id->extra &= mask->extra;
-	if (is_v6) {
-		APPLY_MASK(&id->dst_ip6, &mask->dst_ip6);
-		APPLY_MASK(&id->src_ip6, &mask->src_ip6);
-		id->flow_id6 &= mask->flow_id6;
-	} else {
-		id->dst_ip &= mask->dst_ip;
-		id->src_ip &= mask->src_ip;
-	}
-	return id;
-}
-
-/* computes an OR of two masks, result in dst and also returned */
-static struct ipfw_flow_id *
-flow_id_or(struct ipfw_flow_id *src, struct ipfw_flow_id *dst)
-{
-	int is_v6 = IS_IP6_FLOW_ID(dst);
-
-	dst->dst_port |= src->dst_port;
-	dst->src_port |= src->src_port;
-	dst->proto |= src->proto;
-	dst->extra |= src->extra;
-	if (is_v6) {
-#define OR_MASK(_d, _s)                          \
-    (_d)->__u6_addr.__u6_addr32[0] |= (_s)->__u6_addr.__u6_addr32[0]; \
-    (_d)->__u6_addr.__u6_addr32[1] |= (_s)->__u6_addr.__u6_addr32[1]; \
-    (_d)->__u6_addr.__u6_addr32[2] |= (_s)->__u6_addr.__u6_addr32[2]; \
-    (_d)->__u6_addr.__u6_addr32[3] |= (_s)->__u6_addr.__u6_addr32[3];
-		OR_MASK(&dst->dst_ip6, &src->dst_ip6);
-		OR_MASK(&dst->src_ip6, &src->src_ip6);
-#undef OR_MASK
-		dst->flow_id6 |= src->flow_id6;
-	} else {
-		dst->dst_ip |= src->dst_ip;
-		dst->src_ip |= src->src_ip;
-	}
-	return dst;
-}
-
-static int
-nonzero_mask(struct ipfw_flow_id *m)
-{
-	if (m->dst_port || m->src_port || m->proto || m->extra)
-		return 1;
-	if (IS_IP6_FLOW_ID(m)) {
-		return
-			m->dst_ip6.__u6_addr.__u6_addr32[0] ||
-			m->dst_ip6.__u6_addr.__u6_addr32[1] ||
-			m->dst_ip6.__u6_addr.__u6_addr32[2] ||
-			m->dst_ip6.__u6_addr.__u6_addr32[3] ||
-			m->src_ip6.__u6_addr.__u6_addr32[0] ||
-			m->src_ip6.__u6_addr.__u6_addr32[1] ||
-			m->src_ip6.__u6_addr.__u6_addr32[2] ||
-			m->src_ip6.__u6_addr.__u6_addr32[3] ||
-			m->flow_id6;
-	} else {
-		return m->dst_ip || m->src_ip;
-	}
-}
-
-/* XXX we may want a better hash function */
-static uint32_t
-flow_id_hash(struct ipfw_flow_id *id)
-{
-    uint32_t i;
-
-    if (IS_IP6_FLOW_ID(id)) {
-	uint32_t *d = (uint32_t *)&id->dst_ip6;
-	uint32_t *s = (uint32_t *)&id->src_ip6;
-        i = (d[0]      ) ^ (d[1])       ^
-            (d[2]      ) ^ (d[3])       ^
-            (d[0] >> 15) ^ (d[1] >> 15) ^
-            (d[2] >> 15) ^ (d[3] >> 15) ^
-            (s[0] <<  1) ^ (s[1] <<  1) ^
-            (s[2] <<  1) ^ (s[3] <<  1) ^
-            (s[0] << 16) ^ (s[1] << 16) ^
-            (s[2] << 16) ^ (s[3] << 16) ^
-            (id->dst_port << 1) ^ (id->src_port) ^
-	    (id->extra) ^
-            (id->proto ) ^ (id->flow_id6);
-    } else {
-        i = (id->dst_ip)        ^ (id->dst_ip >> 15) ^
-            (id->src_ip << 1)   ^ (id->src_ip >> 16) ^
-	    (id->extra) ^
-            (id->dst_port << 1) ^ (id->src_port)     ^ (id->proto);
-    }
-    return i;
-}
-
-/* Like bcmp, returns 0 if ids match, 1 otherwise. */
-static int
-flow_id_cmp(struct ipfw_flow_id *id1, struct ipfw_flow_id *id2)
-{
-	int is_v6 = IS_IP6_FLOW_ID(id1);
-
-	if (!is_v6) {
-	    if (IS_IP6_FLOW_ID(id2))
-		return 1; /* different address families */
-
-	    return (id1->dst_ip == id2->dst_ip &&
-		    id1->src_ip == id2->src_ip &&
-		    id1->dst_port == id2->dst_port &&
-		    id1->src_port == id2->src_port &&
-		    id1->proto == id2->proto &&
-		    id1->extra == id2->extra) ? 0 : 1;
-	}
-	/* the ipv6 case */
-	return (
-	    !bcmp(&id1->dst_ip6,&id2->dst_ip6, sizeof(id1->dst_ip6)) &&
-	    !bcmp(&id1->src_ip6,&id2->src_ip6, sizeof(id1->src_ip6)) &&
-	    id1->dst_port == id2->dst_port &&
-	    id1->src_port == id2->src_port &&
-	    id1->proto == id2->proto &&
-	    id1->extra == id2->extra &&
-	    id1->flow_id6 == id2->flow_id6) ? 0 : 1;
-}
-/*--------- end of flow-id mask, hash and compare ---------*/
-
-/*--- support functions for the qht hashtable ----
- * Entries are hashed by flow-id
- */
-static uint32_t
-q_hash(uintptr_t key, int flags, void *arg)
-{
-	/* compute the hash slot from the flow id */
-	struct ipfw_flow_id *id = (flags & DNHT_KEY_IS_OBJ) ?
-		&((struct dn_queue *)key)->ni.fid :
-		(struct ipfw_flow_id *)key;
-
-	return flow_id_hash(id);
-}
-
-static int
-q_match(void *obj, uintptr_t key, int flags, void *arg)
-{
-	struct dn_queue *o = (struct dn_queue *)obj;
-	struct ipfw_flow_id *id2;
-
-	if (flags & DNHT_KEY_IS_OBJ) {
-		/* compare pointers */
-		id2 = &((struct dn_queue *)key)->ni.fid;
-	} else {
-		id2 = (struct ipfw_flow_id *)key;
-	}
-	return (0 == flow_id_cmp(&o->ni.fid,  id2));
-}
-
-/*
- * create a new queue instance for the given 'key'.
- */
-static void *
-q_new(uintptr_t key, int flags, void *arg)
-{   
-	struct dn_queue *q, *template = arg;
-	struct dn_fsk *fs = template->fs;
-	int size = sizeof(*q) + fs->sched->fp->q_datalen;
-
-	q = malloc(size, M_DUMMYNET, M_NOWAIT | M_ZERO);
-	if (q == NULL) {
-		D("no memory for new queue");
-		return NULL;
-	}
-
-	set_oid(&q->ni.oid, DN_QUEUE, size);
-	if (fs->fs.flags & DN_QHT_HASH)
-		q->ni.fid = *(struct ipfw_flow_id *)key;
-	q->fs = fs;
-	q->_si = template->_si;
-	q->_si->q_count++;
-
-	if (fs->sched->fp->new_queue)
-		fs->sched->fp->new_queue(q);
-	dn_cfg.queue_count++;
-	return q;
-}
-
-/*
- * Notify schedulers that a queue is going away.
- * If (flags & DN_DESTROY), also free the packets.
- * The version for callbacks is called q_delete_cb().
- */
-static void
-dn_delete_queue(struct dn_queue *q, int flags)
-{
-	struct dn_fsk *fs = q->fs;
-
-	// D("fs %p si %p\n", fs, q->_si);
-	/* notify the parent scheduler that the queue is going away */
-	if (fs && fs->sched->fp->free_queue)
-		fs->sched->fp->free_queue(q);
-	q->_si->q_count--;
-	q->_si = NULL;
-	if (flags & DN_DESTROY) {
-		if (q->mq.head)
-			dn_free_pkts(q->mq.head);
-		bzero(q, sizeof(*q));	// safety
-		free(q, M_DUMMYNET);
-		dn_cfg.queue_count--;
-	}
-}
-
-static int
-q_delete_cb(void *q, void *arg)
-{
-	int flags = (int)(uintptr_t)arg;
-	dn_delete_queue(q, flags);
-	return (flags & DN_DESTROY) ? DNHT_SCAN_DEL : 0;
-}
-
-/*
- * calls dn_delete_queue/q_delete_cb on all queues,
- * which notifies the parent scheduler and possibly drains packets.
- * flags & DN_DESTROY: drains queues and destroy qht;
- */
-static void
-qht_delete(struct dn_fsk *fs, int flags)
-{
-	ND("fs %d start flags %d qht %p",
-		fs->fs.fs_nr, flags, fs->qht);
-	if (!fs->qht)
-		return;
-	if (fs->fs.flags & DN_QHT_HASH) {
-		dn_ht_scan(fs->qht, q_delete_cb, (void *)(uintptr_t)flags);
-		if (flags & DN_DESTROY) {
-			dn_ht_free(fs->qht, 0);
-			fs->qht = NULL;
-		}
-	} else {
-		dn_delete_queue((struct dn_queue *)(fs->qht), flags);
-		if (flags & DN_DESTROY)
-			fs->qht = NULL;
-	}
-}
-
-/*
- * Find and possibly create the queue for a MULTIQUEUE scheduler.
- * We never call it for !MULTIQUEUE (the queue is in the sch_inst).
- */
-struct dn_queue *
-ipdn_q_find(struct dn_fsk *fs, struct dn_sch_inst *si,
-	struct ipfw_flow_id *id)
-{
-	struct dn_queue template;
-
-	template._si = si;
-	template.fs = fs;
-
-	if (fs->fs.flags & DN_QHT_HASH) {
-		struct ipfw_flow_id masked_id;
-		if (fs->qht == NULL) {
-			fs->qht = dn_ht_init(NULL, fs->fs.buckets,
-				offsetof(struct dn_queue, q_next),
-				q_hash, q_match, q_new);
-			if (fs->qht == NULL)
-				return NULL;
-		}
-		masked_id = *id;
-		flow_id_mask(&fs->fsk_mask, &masked_id);
-		return dn_ht_find(fs->qht, (uintptr_t)&masked_id,
-			DNHT_INSERT, &template);
-	} else {
-		if (fs->qht == NULL)
-			fs->qht = q_new(0, 0, &template);
-		return (struct dn_queue *)fs->qht;
-	}
-}
-/*--- end of queue hash table ---*/
-
-/*--- support functions for the sch_inst hashtable ----
- *
- * These are hashed by flow-id
- */
-static uint32_t
-si_hash(uintptr_t key, int flags, void *arg)
-{
-	/* compute the hash slot from the flow id */
-	struct ipfw_flow_id *id = (flags & DNHT_KEY_IS_OBJ) ?
-		&((struct dn_sch_inst *)key)->ni.fid :
-		(struct ipfw_flow_id *)key;
-
-	return flow_id_hash(id);
-}
-
-static int
-si_match(void *obj, uintptr_t key, int flags, void *arg)
-{
-	struct dn_sch_inst *o = obj;
-	struct ipfw_flow_id *id2;
-
-	id2 = (flags & DNHT_KEY_IS_OBJ) ?
-		&((struct dn_sch_inst *)key)->ni.fid :
-		(struct ipfw_flow_id *)key;
-	return flow_id_cmp(&o->ni.fid,  id2) == 0;
-}
-
-/*
- * create a new instance for the given 'key'
- * Allocate memory for instance, delay line and scheduler private data.
- */
-static void *
-si_new(uintptr_t key, int flags, void *arg)
-{
-	struct dn_schk *s = arg;
-	struct dn_sch_inst *si;
-	int l = sizeof(*si) + s->fp->si_datalen;
-
-	si = malloc(l, M_DUMMYNET, M_NOWAIT | M_ZERO);
-	if (si == NULL)
-		goto error;
-
-	/* Set length only for the part passed up to userland. */
-	set_oid(&si->ni.oid, DN_SCH_I, sizeof(struct dn_flow));
-	set_oid(&(si->dline.oid), DN_DELAY_LINE,
-		sizeof(struct delay_line));
-	/* mark si and dline as outside the event queue */
-	si->ni.oid.id = si->dline.oid.id = -1;
-
-	si->sched = s;
-	si->dline.si = si;
-
-	if (s->fp->new_sched && s->fp->new_sched(si)) {
-		D("new_sched error");
-		goto error;
-	}
-	if (s->sch.flags & DN_HAVE_MASK)
-		si->ni.fid = *(struct ipfw_flow_id *)key;
-
-	dn_cfg.si_count++;
-	return si;
-
-error:
-	if (si) {
-		bzero(si, sizeof(*si)); // safety
-		free(si, M_DUMMYNET);
-	}
-        return NULL;
-}
-
-/*
- * Callback from siht to delete all scheduler instances. Remove
- * si and delay line from the system heap, destroy all queues.
- * We assume that all flowset have been notified and do not
- * point to us anymore.
- */
-static int
-si_destroy(void *_si, void *arg)
-{
-	struct dn_sch_inst *si = _si;
-	struct dn_schk *s = si->sched;
-	struct delay_line *dl = &si->dline;
-
-	if (dl->oid.subtype) /* remove delay line from event heap */
-		heap_extract(&dn_cfg.evheap, dl);
-	dn_free_pkts(dl->mq.head);	/* drain delay line */
-	if (si->kflags & DN_ACTIVE) /* remove si from event heap */
-		heap_extract(&dn_cfg.evheap, si);
-	if (s->fp->free_sched)
-		s->fp->free_sched(si);
-	bzero(si, sizeof(*si));	/* safety */
-	free(si, M_DUMMYNET);
-	dn_cfg.si_count--;
-	return DNHT_SCAN_DEL;
-}
-
-/*
- * Find the scheduler instance for this packet. If we need to apply
- * a mask, do on a local copy of the flow_id to preserve the original.
- * Assume siht is always initialized if we have a mask.
- */
-struct dn_sch_inst *
-ipdn_si_find(struct dn_schk *s, struct ipfw_flow_id *id)
-{
-
-	if (s->sch.flags & DN_HAVE_MASK) {
-		struct ipfw_flow_id id_t = *id;
-		flow_id_mask(&s->sch.sched_mask, &id_t);
-		return dn_ht_find(s->siht, (uintptr_t)&id_t,
-			DNHT_INSERT, s);
-	}
-	if (!s->siht)
-		s->siht = si_new(0, 0, s);
-	return (struct dn_sch_inst *)s->siht;
-}
-
-/* callback to flush credit for the scheduler instance */
-static int
-si_reset_credit(void *_si, void *arg)
-{
-	struct dn_sch_inst *si = _si;
-	struct dn_link *p = &si->sched->link;
-
-	si->credit = p->burst + (dn_cfg.io_fast ?  p->bandwidth : 0);
-	return 0;
-}
-
-static void
-schk_reset_credit(struct dn_schk *s)
-{
-	if (s->sch.flags & DN_HAVE_MASK)
-		dn_ht_scan(s->siht, si_reset_credit, NULL);
-	else if (s->siht)
-		si_reset_credit(s->siht, NULL);
-}
-/*---- end of sch_inst hashtable ---------------------*/
-
-/*-------------------------------------------------------
- * flowset hash (fshash) support. Entries are hashed by fs_nr.
- * New allocations are put in the fsunlinked list, from which
- * they are removed when they point to a specific scheduler.
- */
-static uint32_t
-fsk_hash(uintptr_t key, int flags, void *arg)
-{
-	uint32_t i = !(flags & DNHT_KEY_IS_OBJ) ? key :
-		((struct dn_fsk *)key)->fs.fs_nr;
-
-	return ( (i>>8)^(i>>4)^i );
-}
-
-static int
-fsk_match(void *obj, uintptr_t key, int flags, void *arg)
-{
-	struct dn_fsk *fs = obj;
-	int i = !(flags & DNHT_KEY_IS_OBJ) ? key :
-		((struct dn_fsk *)key)->fs.fs_nr;
-
-	return (fs->fs.fs_nr == i);
-}
-
-static void *
-fsk_new(uintptr_t key, int flags, void *arg)
-{
-	struct dn_fsk *fs;
-
-	fs = malloc(sizeof(*fs), M_DUMMYNET, M_NOWAIT | M_ZERO);
-	if (fs) {
-		set_oid(&fs->fs.oid, DN_FS, sizeof(fs->fs));
-		dn_cfg.fsk_count++;
-		fs->drain_bucket = 0;
-		SLIST_INSERT_HEAD(&dn_cfg.fsu, fs, sch_chain);
-	}
-	return fs;
-}
-
-/*
- * detach flowset from its current scheduler. Flags as follows:
- * DN_DETACH removes from the fsk_list
- * DN_DESTROY deletes individual queues
- * DN_DELETE_FS destroys the flowset (otherwise goes in unlinked).
- */
-static void
-fsk_detach(struct dn_fsk *fs, int flags)
-{
-	if (flags & DN_DELETE_FS)
-		flags |= DN_DESTROY;
-	ND("fs %d from sched %d flags %s %s %s",
-		fs->fs.fs_nr, fs->fs.sched_nr,
-		(flags & DN_DELETE_FS) ? "DEL_FS":"",
-		(flags & DN_DESTROY) ? "DEL":"",
-		(flags & DN_DETACH) ? "DET":"");
-	if (flags & DN_DETACH) { /* detach from the list */
-		struct dn_fsk_head *h;
-		h = fs->sched ? &fs->sched->fsk_list : &dn_cfg.fsu;
-		SLIST_REMOVE(h, fs, dn_fsk, sch_chain);
-	}
-	/* Free the RED parameters, they will be recomputed on
-	 * subsequent attach if needed.
-	 */
-	if (fs->w_q_lookup)
-		free(fs->w_q_lookup, M_DUMMYNET);
-	fs->w_q_lookup = NULL;
-	qht_delete(fs, flags);
-	if (fs->sched && fs->sched->fp->free_fsk)
-		fs->sched->fp->free_fsk(fs);
-	fs->sched = NULL;
-	if (flags & DN_DELETE_FS) {
-		bzero(fs, sizeof(fs));	/* safety */
-		free(fs, M_DUMMYNET);
-		dn_cfg.fsk_count--;
-	} else {
-		SLIST_INSERT_HEAD(&dn_cfg.fsu, fs, sch_chain);
-	}
-}
-
-/*
- * Detach or destroy all flowsets in a list.
- * flags specifies what to do:
- * DN_DESTROY:	flush all queues
- * DN_DELETE_FS:	DN_DESTROY + destroy flowset
- *	DN_DELETE_FS implies DN_DESTROY
- */
-static void
-fsk_detach_list(struct dn_fsk_head *h, int flags)
-{
-	struct dn_fsk *fs;
-	int n = 0; /* only for stats */
-
-	ND("head %p flags %x", h, flags);
-	while ((fs = SLIST_FIRST(h))) {
-		SLIST_REMOVE_HEAD(h, sch_chain);
-		n++;
-		fsk_detach(fs, flags);
-	}
-	ND("done %d flowsets", n);
-}
-
-/*
- * called on 'queue X delete' -- removes the flowset from fshash,
- * deletes all queues for the flowset, and removes the flowset.
- */
-static int
-delete_fs(int i, int locked)
-{
-	struct dn_fsk *fs;
-	int err = 0;
-
-	if (!locked)
-		DN_BH_WLOCK();
-	fs = dn_ht_find(dn_cfg.fshash, i, DNHT_REMOVE, NULL);
-	ND("fs %d found %p", i, fs);
-	if (fs) {
-		fsk_detach(fs, DN_DETACH | DN_DELETE_FS);
-		err = 0;
-	} else
-		err = EINVAL;
-	if (!locked)
-		DN_BH_WUNLOCK();
-	return err;
-}
-
-/*----- end of flowset hashtable support -------------*/
-
-/*------------------------------------------------------------
- * Scheduler hash. When searching by index we pass sched_nr,
- * otherwise we pass struct dn_sch * which is the first field in
- * struct dn_schk so we can cast between the two. We use this trick
- * because in the create phase (but it should be fixed).
- */
-static uint32_t
-schk_hash(uintptr_t key, int flags, void *_arg)
-{
-	uint32_t i = !(flags & DNHT_KEY_IS_OBJ) ? key :
-		((struct dn_schk *)key)->sch.sched_nr;
-	return ( (i>>8)^(i>>4)^i );
-}
-
-static int
-schk_match(void *obj, uintptr_t key, int flags, void *_arg)
-{
-	struct dn_schk *s = (struct dn_schk *)obj;
-	int i = !(flags & DNHT_KEY_IS_OBJ) ? key :
-		((struct dn_schk *)key)->sch.sched_nr;
-	return (s->sch.sched_nr == i);
-}
-
-/*
- * Create the entry and intialize with the sched hash if needed.
- * Leave s->fp unset so we can tell whether a dn_ht_find() returns
- * a new object or a previously existing one.
- */
-static void *
-schk_new(uintptr_t key, int flags, void *arg)
-{
-	struct schk_new_arg *a = arg;
-	struct dn_schk *s;
-	int l = sizeof(*s) +a->fp->schk_datalen;
-
-	s = malloc(l, M_DUMMYNET, M_NOWAIT | M_ZERO);
-	if (s == NULL)
-		return NULL;
-	set_oid(&s->link.oid, DN_LINK, sizeof(s->link));
-	s->sch = *a->sch; // copy initial values
-	s->link.link_nr = s->sch.sched_nr;
-	SLIST_INIT(&s->fsk_list);
-	/* initialize the hash table or create the single instance */
-	s->fp = a->fp;	/* si_new needs this */
-	s->drain_bucket = 0;
-	if (s->sch.flags & DN_HAVE_MASK) {
-		s->siht = dn_ht_init(NULL, s->sch.buckets,
-			offsetof(struct dn_sch_inst, si_next),
-			si_hash, si_match, si_new);
-		if (s->siht == NULL) {
-			free(s, M_DUMMYNET);
-			return NULL;
-		}
-	}
-	s->fp = NULL;	/* mark as a new scheduler */
-	dn_cfg.schk_count++;
-	return s;
-}
-
-/*
- * Callback for sched delete. Notify all attached flowsets to
- * detach from the scheduler, destroy the internal flowset, and
- * all instances. The scheduler goes away too.
- * arg is 0 (only detach flowsets and destroy instances)
- * DN_DESTROY (detach & delete queues, delete schk)
- * or DN_DELETE_FS (delete queues and flowsets, delete schk)
- */
-static int
-schk_delete_cb(void *obj, void *arg)
-{
-	struct dn_schk *s = obj;
-#if 0
-	int a = (int)arg;
-	ND("sched %d arg %s%s",
-		s->sch.sched_nr,
-		a&DN_DESTROY ? "DEL ":"",
-		a&DN_DELETE_FS ? "DEL_FS":"");
-#endif
-	fsk_detach_list(&s->fsk_list, arg ? DN_DESTROY : 0);
-	/* no more flowset pointing to us now */
-	if (s->sch.flags & DN_HAVE_MASK) {
-		dn_ht_scan(s->siht, si_destroy, NULL);
-		dn_ht_free(s->siht, 0);
-	} else if (s->siht)
-		si_destroy(s->siht, NULL);
-	if (s->profile) {
-		free(s->profile, M_DUMMYNET);
-		s->profile = NULL;
-	}
-	s->siht = NULL;
-	if (s->fp->destroy)
-		s->fp->destroy(s);
-	bzero(s, sizeof(*s));	// safety
-	free(obj, M_DUMMYNET);
-	dn_cfg.schk_count--;
-	return DNHT_SCAN_DEL;
-}
-
-/*
- * called on a 'sched X delete' command. Deletes a single scheduler.
- * This is done by removing from the schedhash, unlinking all
- * flowsets and deleting their traffic.
- */
-static int
-delete_schk(int i)
-{
-	struct dn_schk *s;
-
-	s = dn_ht_find(dn_cfg.schedhash, i, DNHT_REMOVE, NULL);
-	ND("%d %p", i, s);
-	if (!s)
-		return EINVAL;
-	delete_fs(i + DN_MAX_ID, 1); /* first delete internal fs */
-	/* then detach flowsets, delete traffic */
-	schk_delete_cb(s, (void*)(uintptr_t)DN_DESTROY);
-	return 0;
-}
-/*--- end of schk hashtable support ---*/
-
-static int
-copy_obj(char **start, char *end, void *_o, const char *msg, int i)
-{
-	struct dn_id *o = _o;
-	int have = end - *start;
-
-	if (have < o->len || o->len == 0 || o->type == 0) {
-		D("(WARN) type %d %s %d have %d need %d",
-			o->type, msg, i, have, o->len);
-		return 1;
-	}
-	ND("type %d %s %d len %d", o->type, msg, i, o->len);
-	bcopy(_o, *start, o->len);
-	if (o->type == DN_LINK) {
-		/* Adjust burst parameter for link */
-		struct dn_link *l = (struct dn_link *)*start;
-		l->burst =  div64(l->burst, 8 * hz);
-		l->delay = l->delay * 1000 / hz;
-	} else if (o->type == DN_SCH) {
-		/* Set id->id to the number of instances */
-		struct dn_schk *s = _o;
-		struct dn_id *id = (struct dn_id *)(*start);
-		id->id = (s->sch.flags & DN_HAVE_MASK) ?
-			dn_ht_entries(s->siht) : (s->siht ? 1 : 0);
-	}
-	*start += o->len;
-	return 0;
-}
-
-/* Specific function to copy a queue.
- * Copies only the user-visible part of a queue (which is in
- * a struct dn_flow), and sets len accordingly.
- */
-static int
-copy_obj_q(char **start, char *end, void *_o, const char *msg, int i)
-{
-	struct dn_id *o = _o;
-	int have = end - *start;
-	int len = sizeof(struct dn_flow); /* see above comment */
-
-	if (have < len || o->len == 0 || o->type != DN_QUEUE) {
-		D("ERROR type %d %s %d have %d need %d",
-			o->type, msg, i, have, len);
-		return 1;
-	}
-	ND("type %d %s %d len %d", o->type, msg, i, len);
-	bcopy(_o, *start, len);
-	((struct dn_id*)(*start))->len = len;
-	*start += len;
-	return 0;
-}
-
-static int
-copy_q_cb(void *obj, void *arg)
-{
-	struct dn_queue *q = obj;
-	struct copy_args *a = arg;
-	struct dn_flow *ni = (struct dn_flow *)(*a->start);
-        if (copy_obj_q(a->start, a->end, &q->ni, "queue", -1))
-                return DNHT_SCAN_END;
-        ni->oid.type = DN_FLOW; /* override the DN_QUEUE */
-        ni->oid.id = si_hash((uintptr_t)&ni->fid, 0, NULL);
-        return 0;
-}
-
-static int
-copy_q(struct copy_args *a, struct dn_fsk *fs, int flags)
-{
-	if (!fs->qht)
-		return 0;
-	if (fs->fs.flags & DN_QHT_HASH)
-		dn_ht_scan(fs->qht, copy_q_cb, a);
-	else
-		copy_q_cb(fs->qht, a);
-	return 0;
-}
-
-/*
- * This routine only copies the initial part of a profile ? XXX
- */
-static int
-copy_profile(struct copy_args *a, struct dn_profile *p)
-{
-	int have = a->end - *a->start;
-	/* XXX here we check for max length */
-	int profile_len = sizeof(struct dn_profile) - 
-		ED_MAX_SAMPLES_NO*sizeof(int);
-
-	if (p == NULL)
-		return 0;
-	if (have < profile_len) {
-		D("error have %d need %d", have, profile_len);
-		return 1;
-	}
-	bcopy(p, *a->start, profile_len);
-	((struct dn_id *)(*a->start))->len = profile_len;
-	*a->start += profile_len;
-	return 0;
-}
-
-static int
-copy_flowset(struct copy_args *a, struct dn_fsk *fs, int flags)
-{
-	struct dn_fs *ufs = (struct dn_fs *)(*a->start);
-	if (!fs)
-		return 0;
-	ND("flowset %d", fs->fs.fs_nr);
-	if (copy_obj(a->start, a->end, &fs->fs, "flowset", fs->fs.fs_nr))
-		return DNHT_SCAN_END;
-	ufs->oid.id = (fs->fs.flags & DN_QHT_HASH) ?
-		dn_ht_entries(fs->qht) : (fs->qht ? 1 : 0);
-	if (flags) {	/* copy queues */
-		copy_q(a, fs, 0);
-	}
-	return 0;
-}
-
-static int
-copy_si_cb(void *obj, void *arg)
-{
-	struct dn_sch_inst *si = obj;
-	struct copy_args *a = arg;
-	struct dn_flow *ni = (struct dn_flow *)(*a->start);
-	if (copy_obj(a->start, a->end, &si->ni, "inst",
-			si->sched->sch.sched_nr))
-		return DNHT_SCAN_END;
-	ni->oid.type = DN_FLOW; /* override the DN_SCH_I */
-	ni->oid.id = si_hash((uintptr_t)si, DNHT_KEY_IS_OBJ, NULL);
-	return 0;
-}
-
-static int
-copy_si(struct copy_args *a, struct dn_schk *s, int flags)
-{
-	if (s->sch.flags & DN_HAVE_MASK)
-		dn_ht_scan(s->siht, copy_si_cb, a);
-	else if (s->siht)
-		copy_si_cb(s->siht, a);
-	return 0;
-}
-
-/*
- * compute a list of children of a scheduler and copy up
- */
-static int
-copy_fsk_list(struct copy_args *a, struct dn_schk *s, int flags)
-{
-	struct dn_fsk *fs;
-	struct dn_id *o;
-	uint32_t *p;
-
-	int n = 0, space = sizeof(*o);
-	SLIST_FOREACH(fs, &s->fsk_list, sch_chain) {
-		if (fs->fs.fs_nr < DN_MAX_ID)
-			n++;
-	}
-	space += n * sizeof(uint32_t);
-	DX(3, "sched %d has %d flowsets", s->sch.sched_nr, n);
-	if (a->end - *(a->start) < space)
-		return DNHT_SCAN_END;
-	o = (struct dn_id *)(*(a->start));
-	o->len = space;
-	*a->start += o->len;
-	o->type = DN_TEXT;
-	p = (uint32_t *)(o+1);
-	SLIST_FOREACH(fs, &s->fsk_list, sch_chain)
-		if (fs->fs.fs_nr < DN_MAX_ID)
-			*p++ = fs->fs.fs_nr;
-	return 0;
-}
-
-static int
-copy_data_helper(void *_o, void *_arg)
-{
-	struct copy_args *a = _arg;
-	uint32_t *r = a->extra->r; /* start of first range */
-	uint32_t *lim;	/* first invalid pointer */
-	int n;
-
-	lim = (uint32_t *)((char *)(a->extra) + a->extra->o.len);
-
-	if (a->type == DN_LINK || a->type == DN_SCH) {
-		/* pipe|sched show, we receive a dn_schk */
-		struct dn_schk *s = _o;
-
-		n = s->sch.sched_nr;
-		if (a->type == DN_SCH && n >= DN_MAX_ID)
-			return 0;	/* not a scheduler */
-		if (a->type == DN_LINK && n <= DN_MAX_ID)
-		    return 0;	/* not a pipe */
-
-		/* see if the object is within one of our ranges */
-		for (;r < lim; r += 2) {
-			if (n < r[0] || n > r[1])
-				continue;
-			/* Found a valid entry, copy and we are done */
-			if (a->flags & DN_C_LINK) {
-				if (copy_obj(a->start, a->end,
-				    &s->link, "link", n))
-					return DNHT_SCAN_END;
-				if (copy_profile(a, s->profile))
-					return DNHT_SCAN_END;
-				if (copy_flowset(a, s->fs, 0))
-					return DNHT_SCAN_END;
-			}
-			if (a->flags & DN_C_SCH) {
-				if (copy_obj(a->start, a->end,
-				    &s->sch, "sched", n))
-					return DNHT_SCAN_END;
-				/* list all attached flowsets */
-				if (copy_fsk_list(a, s, 0))
-					return DNHT_SCAN_END;
-			}
-			if (a->flags & DN_C_FLOW)
-				copy_si(a, s, 0);
-			break;
-		}
-	} else if (a->type == DN_FS) {
-		/* queue show, skip internal flowsets */
-		struct dn_fsk *fs = _o;
-
-		n = fs->fs.fs_nr;
-		if (n >= DN_MAX_ID)
-			return 0;
-		/* see if the object is within one of our ranges */
-		for (;r < lim; r += 2) {
-			if (n < r[0] || n > r[1])
-				continue;
-			if (copy_flowset(a, fs, 0))
-				return DNHT_SCAN_END;
-			copy_q(a, fs, 0);
-			break; /* we are done */
-		}
-	}
-	return 0;
-}
-
-static inline struct dn_schk *
-locate_scheduler(int i)
-{
-	return dn_ht_find(dn_cfg.schedhash, i, 0, NULL);
-}
-
-/*
- * red parameters are in fixed point arithmetic.
- */
-static int
-config_red(struct dn_fsk *fs)
-{
-	int64_t s, idle, weight, w0;
-	int t, i;
-
-	fs->w_q = fs->fs.w_q;
-	fs->max_p = fs->fs.max_p;
-	ND("called");
-	/* Doing stuff that was in userland */
-	i = fs->sched->link.bandwidth;
-	s = (i <= 0) ? 0 :
-		hz * dn_cfg.red_avg_pkt_size * 8 * SCALE(1) / i;
-
-	idle = div64((s * 3) , fs->w_q); /* s, fs->w_q scaled; idle not scaled */
-	fs->lookup_step = div64(idle , dn_cfg.red_lookup_depth);
-	/* fs->lookup_step not scaled, */
-	if (!fs->lookup_step)
-		fs->lookup_step = 1;
-	w0 = weight = SCALE(1) - fs->w_q; //fs->w_q scaled
-
-	for (t = fs->lookup_step; t > 1; --t)
-		weight = SCALE_MUL(weight, w0);
-	fs->lookup_weight = (int)(weight); // scaled
-
-	/* Now doing stuff that was in kerneland */
-	fs->min_th = SCALE(fs->fs.min_th);
-	fs->max_th = SCALE(fs->fs.max_th);
-
-	fs->c_1 = fs->max_p / (fs->fs.max_th - fs->fs.min_th);
-	fs->c_2 = SCALE_MUL(fs->c_1, SCALE(fs->fs.min_th));
-
-	if (fs->fs.flags & DN_IS_GENTLE_RED) {
-		fs->c_3 = (SCALE(1) - fs->max_p) / fs->fs.max_th;
-		fs->c_4 = SCALE(1) - 2 * fs->max_p;
-	}
-
-	/* If the lookup table already exist, free and create it again. */
-	if (fs->w_q_lookup) {
-		free(fs->w_q_lookup, M_DUMMYNET);
-		fs->w_q_lookup = NULL;
-	}
-	if (dn_cfg.red_lookup_depth == 0) {
-		printf("\ndummynet: net.inet.ip.dummynet.red_lookup_depth"
-		    "must be > 0\n");
-		fs->fs.flags &= ~DN_IS_RED;
-		fs->fs.flags &= ~DN_IS_GENTLE_RED;
-		return (EINVAL);
-	}
-	fs->lookup_depth = dn_cfg.red_lookup_depth;
-	fs->w_q_lookup = (u_int *)malloc(fs->lookup_depth * sizeof(int),
-	    M_DUMMYNET, M_NOWAIT);
-	if (fs->w_q_lookup == NULL) {
-		printf("dummynet: sorry, cannot allocate red lookup table\n");
-		fs->fs.flags &= ~DN_IS_RED;
-		fs->fs.flags &= ~DN_IS_GENTLE_RED;
-		return(ENOSPC);
-	}
-
-	/* Fill the lookup table with (1 - w_q)^x */
-	fs->w_q_lookup[0] = SCALE(1) - fs->w_q;
-
-	for (i = 1; i < fs->lookup_depth; i++)
-		fs->w_q_lookup[i] =
-		    SCALE_MUL(fs->w_q_lookup[i - 1], fs->lookup_weight);
-
-	if (dn_cfg.red_avg_pkt_size < 1)
-		dn_cfg.red_avg_pkt_size = 512;
-	fs->avg_pkt_size = dn_cfg.red_avg_pkt_size;
-	if (dn_cfg.red_max_pkt_size < 1)
-		dn_cfg.red_max_pkt_size = 1500;
-	fs->max_pkt_size = dn_cfg.red_max_pkt_size;
-	ND("exit");
-	return 0;
-}
-
-/* Scan all flowset attached to this scheduler and update red */
-static void
-update_red(struct dn_schk *s)
-{
-	struct dn_fsk *fs;
-	SLIST_FOREACH(fs, &s->fsk_list, sch_chain) {
-		if (fs && (fs->fs.flags & DN_IS_RED))
-			config_red(fs);
-	}
-}
-
-/* attach flowset to scheduler s, possibly requeue */
-static void
-fsk_attach(struct dn_fsk *fs, struct dn_schk *s)
-{
-	ND("remove fs %d from fsunlinked, link to sched %d",
-		fs->fs.fs_nr, s->sch.sched_nr);
-	SLIST_REMOVE(&dn_cfg.fsu, fs, dn_fsk, sch_chain);
-	fs->sched = s;
-	SLIST_INSERT_HEAD(&s->fsk_list, fs, sch_chain);
-	if (s->fp->new_fsk)
-		s->fp->new_fsk(fs);
-	/* XXX compute fsk_mask */
-	fs->fsk_mask = fs->fs.flow_mask;
-	if (fs->sched->sch.flags & DN_HAVE_MASK)
-		flow_id_or(&fs->sched->sch.sched_mask, &fs->fsk_mask);
-	if (fs->qht) {
-		/*
-		 * we must drain qht according to the old
-		 * type, and reinsert according to the new one.
-		 * The requeue is complex -- in general we need to
-		 * reclassify every single packet.
-		 * For the time being, let's hope qht is never set
-		 * when we reach this point.
-		 */
-		D("XXX TODO requeue from fs %d to sch %d",
-			fs->fs.fs_nr, s->sch.sched_nr);
-		fs->qht = NULL;
-	}
-	/* set the new type for qht */
-	if (nonzero_mask(&fs->fsk_mask))
-		fs->fs.flags |= DN_QHT_HASH;
-	else
-		fs->fs.flags &= ~DN_QHT_HASH;
-
-	/* XXX config_red() can fail... */
-	if (fs->fs.flags & DN_IS_RED)
-		config_red(fs);
-}
-
-/* update all flowsets which may refer to this scheduler */
-static void
-update_fs(struct dn_schk *s)
-{
-	struct dn_fsk *fs, *tmp;
-
-	SLIST_FOREACH_SAFE(fs, &dn_cfg.fsu, sch_chain, tmp) {
-		if (s->sch.sched_nr != fs->fs.sched_nr) {
-			D("fs %d for sch %d not %d still unlinked",
-				fs->fs.fs_nr, fs->fs.sched_nr,
-				s->sch.sched_nr);
-			continue;
-		}
-		fsk_attach(fs, s);
-	}
-}
-
-/*
- * Configuration -- to preserve backward compatibility we use
- * the following scheme (N is 65536)
- *	NUMBER		SCHED	LINK	FLOWSET
- *	   1 ..  N-1	(1)WFQ	(2)WFQ	(3)queue
- *	 N+1 .. 2N-1	(4)FIFO (5)FIFO	(6)FIFO for sched 1..N-1
- *	2N+1 .. 3N-1	--	--	(7)FIFO for sched N+1..2N-1
- *
- * "pipe i config" configures #1, #2 and #3
- * "sched i config" configures #1 and possibly #6
- * "queue i config" configures #3
- * #1 is configured with 'pipe i config' or 'sched i config'
- * #2 is configured with 'pipe i config', and created if not
- *	existing with 'sched i config'
- * #3 is configured with 'queue i config'
- * #4 is automatically configured after #1, can only be FIFO
- * #5 is automatically configured after #2
- * #6 is automatically created when #1 is !MULTIQUEUE,
- *	and can be updated.
- * #7 is automatically configured after #2
- */
-
-/*
- * configure a link (and its FIFO instance)
- */
-static int
-config_link(struct dn_link *p, struct dn_id *arg)
-{
-	int i;
-
-	if (p->oid.len != sizeof(*p)) {
-		D("invalid pipe len %d", p->oid.len);
-		return EINVAL;
-	}
-	i = p->link_nr;
-	if (i <= 0 || i >= DN_MAX_ID)
-		return EINVAL;
-	/*
-	 * The config program passes parameters as follows:
-	 * bw = bits/second (0 means no limits),
-	 * delay = ms, must be translated into ticks.
-	 * qsize = slots/bytes
-	 * burst ???
-	 */
-	p->delay = (p->delay * hz) / 1000;
-	/* Scale burst size: bytes -> bits * hz */
-	p->burst *= 8 * hz;
-
-	DN_BH_WLOCK();
-	/* do it twice, base link and FIFO link */
-	for (; i < 2*DN_MAX_ID; i += DN_MAX_ID) {
-	    struct dn_schk *s = locate_scheduler(i);
-	    if (s == NULL) {
-		DN_BH_WUNLOCK();
-		D("sched %d not found", i);
-		return EINVAL;
-	    }
-	    /* remove profile if exists */
-	    if (s->profile) {
-		free(s->profile, M_DUMMYNET);
-		s->profile = NULL;
-	    }
-	    /* copy all parameters */
-	    s->link.oid = p->oid;
-	    s->link.link_nr = i;
-	    s->link.delay = p->delay;
-	    if (s->link.bandwidth != p->bandwidth) {
-		/* XXX bandwidth changes, need to update red params */
-	    s->link.bandwidth = p->bandwidth;
-		update_red(s);
-	    }
-	    s->link.burst = p->burst;
-	    schk_reset_credit(s);
-	}
-	dn_cfg.id++;
-	DN_BH_WUNLOCK();
-	return 0;
-}
-
-/*
- * configure a flowset. Can be called from inside with locked=1,
- */
-static struct dn_fsk *
-config_fs(struct dn_fs *nfs, struct dn_id *arg, int locked)
-{
-	int i;
-	struct dn_fsk *fs;
-
-	if (nfs->oid.len != sizeof(*nfs)) {
-		D("invalid flowset len %d", nfs->oid.len);
-		return NULL;
-	}
-	i = nfs->fs_nr;
-	if (i <= 0 || i >= 3*DN_MAX_ID)
-		return NULL;
-	ND("flowset %d", i);
-	/* XXX other sanity checks */
-        if (nfs->flags & DN_QSIZE_BYTES) {
-		ipdn_bound_var(&nfs->qsize, 16384,
-		    1500, dn_cfg.byte_limit, NULL); // "queue byte size");
-        } else {
-		ipdn_bound_var(&nfs->qsize, 50,
-		    1, dn_cfg.slot_limit, NULL); // "queue slot size");
-        }
-	if (nfs->flags & DN_HAVE_MASK) {
-		/* make sure we have some buckets */
-		ipdn_bound_var(&nfs->buckets, dn_cfg.hash_size,
-			1, dn_cfg.max_hash_size, "flowset buckets");
-	} else {
-		nfs->buckets = 1;	/* we only need 1 */
-	}
-	if (!locked)
-		DN_BH_WLOCK();
-	do { /* exit with break when done */
-	    struct dn_schk *s;
-	    int flags = nfs->sched_nr ? DNHT_INSERT : 0;
-	    int j;
-	    int oldc = dn_cfg.fsk_count;
-	    fs = dn_ht_find(dn_cfg.fshash, i, flags, NULL);
-	    if (fs == NULL) {
-		D("missing sched for flowset %d", i);
-	        break;
-	    }
-	    /* grab some defaults from the existing one */
-	    if (nfs->sched_nr == 0) /* reuse */
-		nfs->sched_nr = fs->fs.sched_nr;
-	    for (j = 0; j < sizeof(nfs->par)/sizeof(nfs->par[0]); j++) {
-		if (nfs->par[j] == -1) /* reuse */
-		    nfs->par[j] = fs->fs.par[j];
-	    }
-	    if (bcmp(&fs->fs, nfs, sizeof(*nfs)) == 0) {
-		ND("flowset %d unchanged", i);
-		break; /* no change, nothing to do */
-	    }
-	    if (oldc != dn_cfg.fsk_count)	/* new item */
-		dn_cfg.id++;
-	    s = locate_scheduler(nfs->sched_nr);
-	    /* detach from old scheduler if needed, preserving
-	     * queues if we need to reattach. Then update the
-	     * configuration, and possibly attach to the new sched.
-	     */
-	    DX(2, "fs %d changed sched %d@%p to %d@%p",
-		fs->fs.fs_nr,
-		fs->fs.sched_nr, fs->sched, nfs->sched_nr, s);
-	    if (fs->sched) {
-		int flags = s ? DN_DETACH : (DN_DETACH | DN_DESTROY);
-		flags |= DN_DESTROY; /* XXX temporary */
-		fsk_detach(fs, flags);
-	    }
-	    fs->fs = *nfs; /* copy configuration */
-	    if (s != NULL)
-		fsk_attach(fs, s);
-	} while (0);
-	if (!locked)
-		DN_BH_WUNLOCK();
-	return fs;
-}
-
-/*
- * config/reconfig a scheduler and its FIFO variant.
- * For !MULTIQUEUE schedulers, also set up the flowset.
- *
- * On reconfigurations (detected because s->fp is set),
- * detach existing flowsets preserving traffic, preserve link,
- * and delete the old scheduler creating a new one.
- */
-static int
-config_sched(struct dn_sch *_nsch, struct dn_id *arg)
-{
-	struct dn_schk *s;
-	struct schk_new_arg a; /* argument for schk_new */
-	int i;
-	struct dn_link p;	/* copy of oldlink */
-	struct dn_profile *pf = NULL;	/* copy of old link profile */
-	/* Used to preserv mask parameter */
-	struct ipfw_flow_id new_mask;
-	int new_buckets = 0;
-	int new_flags = 0;
-	int pipe_cmd;
-	int err = ENOMEM;
-
-	a.sch = _nsch;
-	if (a.sch->oid.len != sizeof(*a.sch)) {
-		D("bad sched len %d", a.sch->oid.len);
-		return EINVAL;
-	}
-	i = a.sch->sched_nr;
-	if (i <= 0 || i >= DN_MAX_ID)
-		return EINVAL;
-	/* make sure we have some buckets */
-	if (a.sch->flags & DN_HAVE_MASK)
-		ipdn_bound_var(&a.sch->buckets, dn_cfg.hash_size,
-			1, dn_cfg.max_hash_size, "sched buckets");
-	/* XXX other sanity checks */
-	bzero(&p, sizeof(p));
-
-	pipe_cmd = a.sch->flags & DN_PIPE_CMD;
-	a.sch->flags &= ~DN_PIPE_CMD; //XXX do it even if is not set?
-	if (pipe_cmd) {
-		/* Copy mask parameter */
-		new_mask = a.sch->sched_mask;
-		new_buckets = a.sch->buckets;
-		new_flags = a.sch->flags;
-	}
-	DN_BH_WLOCK();
-again: /* run twice, for wfq and fifo */
-	/*
-	 * lookup the type. If not supplied, use the previous one
-	 * or default to WF2Q+. Otherwise, return an error.
-	 */
-	dn_cfg.id++;
-	a.fp = find_sched_type(a.sch->oid.subtype, a.sch->name);
-	if (a.fp != NULL) {
-		/* found. Lookup or create entry */
-		s = dn_ht_find(dn_cfg.schedhash, i, DNHT_INSERT, &a);
-	} else if (a.sch->oid.subtype == 0 && !a.sch->name[0]) {
-		/* No type. search existing s* or retry with WF2Q+ */
-		s = dn_ht_find(dn_cfg.schedhash, i, 0, &a);
-		if (s != NULL) {
-			a.fp = s->fp;
-			/* Scheduler exists, skip to FIFO scheduler 
-			 * if command was pipe config...
-			 */
-			if (pipe_cmd)
-				goto next;
-		} else {
-			/* New scheduler, create a wf2q+ with no mask
-			 * if command was pipe config...
-			 */
-			if (pipe_cmd) {
-				/* clear mask parameter */
-				bzero(&a.sch->sched_mask, sizeof(new_mask));
-				a.sch->buckets = 0;
-				a.sch->flags &= ~DN_HAVE_MASK;
-			}
-			a.sch->oid.subtype = DN_SCHED_WF2QP;
-			goto again;
-		}
-	} else {
-		D("invalid scheduler type %d %s",
-			a.sch->oid.subtype, a.sch->name);
-		err = EINVAL;
-		goto error;
-	}
-	/* normalize name and subtype */
-	a.sch->oid.subtype = a.fp->type;
-	bzero(a.sch->name, sizeof(a.sch->name));
-	strlcpy(a.sch->name, a.fp->name, sizeof(a.sch->name));
-	if (s == NULL) {
-		D("cannot allocate scheduler %d", i);
-		goto error;
-	}
-	/* restore existing link if any */
-	if (p.link_nr) {
-		s->link = p;
-		if (!pf || pf->link_nr != p.link_nr) { /* no saved value */
-			s->profile = NULL; /* XXX maybe not needed */
-		} else {
-			s->profile = malloc(sizeof(struct dn_profile),
-					     M_DUMMYNET, M_NOWAIT | M_ZERO);
-			if (s->profile == NULL) {
-				D("cannot allocate profile");
-				goto error; //XXX
-			}
-			bcopy(pf, s->profile, sizeof(*pf));
-		}
-	}
-	p.link_nr = 0;
-	if (s->fp == NULL) {
-		DX(2, "sched %d new type %s", i, a.fp->name);
-	} else if (s->fp != a.fp ||
-			bcmp(a.sch, &s->sch, sizeof(*a.sch)) ) {
-		/* already existing. */
-		DX(2, "sched %d type changed from %s to %s",
-			i, s->fp->name, a.fp->name);
-		DX(4, "   type/sub %d/%d -> %d/%d",
-			s->sch.oid.type, s->sch.oid.subtype, 
-			a.sch->oid.type, a.sch->oid.subtype);
-		if (s->link.link_nr == 0)
-			D("XXX WARNING link 0 for sched %d", i);
-		p = s->link;	/* preserve link */
-		if (s->profile) {/* preserve profile */
-			if (!pf)
-				pf = malloc(sizeof(*pf),
-				    M_DUMMYNET, M_NOWAIT | M_ZERO);
-			if (pf)	/* XXX should issue a warning otherwise */
-				bcopy(s->profile, pf, sizeof(*pf));
-		}
-		/* remove from the hash */
-		dn_ht_find(dn_cfg.schedhash, i, DNHT_REMOVE, NULL);
-		/* Detach flowsets, preserve queues. */
-		// schk_delete_cb(s, NULL);
-		// XXX temporarily, kill queues
-		schk_delete_cb(s, (void *)DN_DESTROY);
-		goto again;
-	} else {
-		DX(4, "sched %d unchanged type %s", i, a.fp->name);
-	}
-	/* complete initialization */
-	s->sch = *a.sch;
-	s->fp = a.fp;
-	s->cfg = arg;
-	// XXX schk_reset_credit(s);
-	/* create the internal flowset if needed,
-	 * trying to reuse existing ones if available
-	 */
-	if (!(s->fp->flags & DN_MULTIQUEUE) && !s->fs) {
-	        s->fs = dn_ht_find(dn_cfg.fshash, i, 0, NULL);
-		if (!s->fs) {
-			struct dn_fs fs;
-			bzero(&fs, sizeof(fs));
-			set_oid(&fs.oid, DN_FS, sizeof(fs));
-			fs.fs_nr = i + DN_MAX_ID;
-			fs.sched_nr = i;
-			s->fs = config_fs(&fs, NULL, 1 /* locked */);
-		}
-		if (!s->fs) {
-			schk_delete_cb(s, (void *)DN_DESTROY);
-			D("error creating internal fs for %d", i);
-			goto error;
-		}
-	}
-	/* call init function after the flowset is created */
-	if (s->fp->config)
-		s->fp->config(s);
-	update_fs(s);
-next:
-	if (i < DN_MAX_ID) { /* now configure the FIFO instance */
-		i += DN_MAX_ID;
-		if (pipe_cmd) {
-			/* Restore mask parameter for FIFO */
-			a.sch->sched_mask = new_mask;
-			a.sch->buckets = new_buckets;
-			a.sch->flags = new_flags;
-		} else {
-			/* sched config shouldn't modify the FIFO scheduler */
-			if (dn_ht_find(dn_cfg.schedhash, i, 0, &a) != NULL) {
-				/* FIFO already exist, don't touch it */
-				err = 0; /* and this is not an error */
-				goto error;
-			}
-		}
-		a.sch->sched_nr = i;
-		a.sch->oid.subtype = DN_SCHED_FIFO;
-		bzero(a.sch->name, sizeof(a.sch->name));
-		goto again;
-	}
-	err = 0;
-error:
-	DN_BH_WUNLOCK();
-	if (pf)
-		free(pf, M_DUMMYNET);
-	return err;
-}
-
-/*
- * attach a profile to a link
- */
-static int
-config_profile(struct dn_profile *pf, struct dn_id *arg)
-{
-	struct dn_schk *s;
-	int i, olen, err = 0;
-
-	if (pf->oid.len < sizeof(*pf)) {
-		D("short profile len %d", pf->oid.len);
-		return EINVAL;
-	}
-	i = pf->link_nr;
-	if (i <= 0 || i >= DN_MAX_ID)
-		return EINVAL;
-	/* XXX other sanity checks */
-	DN_BH_WLOCK();
-	for (; i < 2*DN_MAX_ID; i += DN_MAX_ID) {
-		s = locate_scheduler(i);
-
-		if (s == NULL) {
-			err = EINVAL;
-			break;
-		}
-		dn_cfg.id++;
-		/*
-		 * If we had a profile and the new one does not fit,
-		 * or it is deleted, then we need to free memory.
-		 */
-		if (s->profile && (pf->samples_no == 0 ||
-		    s->profile->oid.len < pf->oid.len)) {
-			free(s->profile, M_DUMMYNET);
-			s->profile = NULL;
-		}
-		if (pf->samples_no == 0)
-			continue;
-		/*
-		 * new profile, possibly allocate memory
-		 * and copy data.
-		 */
-		if (s->profile == NULL)
-			s->profile = malloc(pf->oid.len,
-				    M_DUMMYNET, M_NOWAIT | M_ZERO);
-		if (s->profile == NULL) {
-			D("no memory for profile %d", i);
-			err = ENOMEM;
-			break;
-		}
-		/* preserve larger length XXX double check */
-		olen = s->profile->oid.len;
-		if (olen < pf->oid.len)
-			olen = pf->oid.len;
-		bcopy(pf, s->profile, pf->oid.len);
-		s->profile->oid.len = olen;
-	}
-	DN_BH_WUNLOCK();
-	return err;
-}
-
-/*
- * Delete all objects:
- */
-static void
-dummynet_flush(void)
-{
-
-	/* delete all schedulers and related links/queues/flowsets */
-	dn_ht_scan(dn_cfg.schedhash, schk_delete_cb,
-		(void *)(uintptr_t)DN_DELETE_FS);
-	/* delete all remaining (unlinked) flowsets */
-	DX(4, "still %d unlinked fs", dn_cfg.fsk_count);
-	dn_ht_free(dn_cfg.fshash, DNHT_REMOVE);
-	fsk_detach_list(&dn_cfg.fsu, DN_DELETE_FS);
-	/* Reinitialize system heap... */
-	heap_init(&dn_cfg.evheap, 16, offsetof(struct dn_id, id));
-}
-
-/*
- * Main handler for configuration. We are guaranteed to be called
- * with an oid which is at least a dn_id.
- * - the first object is the command (config, delete, flush, ...)
- * - config_link must be issued after the corresponding config_sched
- * - parameters (DN_TXT) for an object must preceed the object
- *   processed on a config_sched.
- */
-int
-do_config(void *p, int l)
-{
-	struct dn_id *next, *o;
-	int err = 0, err2 = 0;
-	struct dn_id *arg = NULL;
-	uintptr_t *a;
-
-	o = p;
-	if (o->id != DN_API_VERSION) {
-		D("invalid api version got %d need %d",
-			o->id, DN_API_VERSION);
-		return EINVAL;
-	}
-	for (; l >= sizeof(*o); o = next) {
-		struct dn_id *prev = arg;
-		if (o->len < sizeof(*o) || l < o->len) {
-			D("bad len o->len %d len %d", o->len, l);
-			err = EINVAL;
-			break;
-		}
-		l -= o->len;
-		next = (struct dn_id *)((char *)o + o->len);
-		err = 0;
-		switch (o->type) {
-		default:
-			D("cmd %d not implemented", o->type);
-			break;
-
-#ifdef EMULATE_SYSCTL
-		/* sysctl emulation.
-		 * if we recognize the command, jump to the correct
-		 * handler and return
-		 */
-		case DN_SYSCTL_SET:
-			err = kesysctl_emu_set(p, l);
-			return err;
-#endif
-
-		case DN_CMD_CONFIG: /* simply a header */
-			break;
-
-		case DN_CMD_DELETE:
-			/* the argument is in the first uintptr_t after o */
-			a = (uintptr_t *)(o+1);
-			if (o->len < sizeof(*o) + sizeof(*a)) {
-				err = EINVAL;
-				break;
-			}
-			switch (o->subtype) {
-			case DN_LINK:
-				/* delete base and derived schedulers */
-				DN_BH_WLOCK();
-				err = delete_schk(*a);
-				err2 = delete_schk(*a + DN_MAX_ID);
-				DN_BH_WUNLOCK();
-				if (!err)
-					err = err2;
-				break;
-
-			default:
-				D("invalid delete type %d",
-					o->subtype);
-				err = EINVAL;
-				break;
-
-			case DN_FS:
-				err = (*a <1 || *a >= DN_MAX_ID) ?
-					EINVAL : delete_fs(*a, 0) ;
-				break;
-			}
-			break;
-
-		case DN_CMD_FLUSH:
-			DN_BH_WLOCK();
-			dummynet_flush();
-			DN_BH_WUNLOCK();
-			break;
-		case DN_TEXT:	/* store argument the next block */
-			prev = NULL;
-			arg = o;
-			break;
-		case DN_LINK:
-			err = config_link((struct dn_link *)o, arg);
-			break;
-		case DN_PROFILE:
-			err = config_profile((struct dn_profile *)o, arg);
-			break;
-		case DN_SCH:
-			err = config_sched((struct dn_sch *)o, arg);
-			break;
-		case DN_FS:
-			err = (NULL==config_fs((struct dn_fs *)o, arg, 0));
-			break;
-		}
-		if (prev)
-			arg = NULL;
-		if (err != 0)
-			break;
-	}
-	return err;
-}
-
-static int
-compute_space(struct dn_id *cmd, struct copy_args *a)
-{
-	int x = 0, need = 0;
-	int profile_size = sizeof(struct dn_profile) - 
-		ED_MAX_SAMPLES_NO*sizeof(int);
-
-	/* NOTE about compute space:
-	 * NP 	= dn_cfg.schk_count
-	 * NSI 	= dn_cfg.si_count
-	 * NF 	= dn_cfg.fsk_count
-	 * NQ 	= dn_cfg.queue_count
-	 * - ipfw pipe show
-	 *   (NP/2)*(dn_link + dn_sch + dn_id + dn_fs) only half scheduler
-	 *                             link, scheduler template, flowset
-	 *                             integrated in scheduler and header
-	 *                             for flowset list
-	 *   (NSI)*(dn_flow) all scheduler instance (includes
-	 *                              the queue instance)
-	 * - ipfw sched show
-	 *   (NP/2)*(dn_link + dn_sch + dn_id + dn_fs) only half scheduler
-	 *                             link, scheduler template, flowset
-	 *                             integrated in scheduler and header
-	 *                             for flowset list
-	 *   (NSI * dn_flow) all scheduler instances
-	 *   (NF * sizeof(uint_32)) space for flowset list linked to scheduler
-	 *   (NQ * dn_queue) all queue [XXXfor now not listed]
-	 * - ipfw queue show
-	 *   (NF * dn_fs) all flowset
-	 *   (NQ * dn_queue) all queues
-	 */
-	switch (cmd->subtype) {
-	default:
-		return -1;
-	/* XXX where do LINK and SCH differ ? */
-	/* 'ipfw sched show' could list all queues associated to
-	 * a scheduler. This feature for now is disabled
-	 */
-	case DN_LINK:	/* pipe show */
-		x = DN_C_LINK | DN_C_SCH | DN_C_FLOW;
-		need += dn_cfg.schk_count *
-			(sizeof(struct dn_fs) + profile_size) / 2;
-		need += dn_cfg.fsk_count * sizeof(uint32_t);
-		break;
-	case DN_SCH:	/* sched show */
-		need += dn_cfg.schk_count *
-			(sizeof(struct dn_fs) + profile_size) / 2;
-		need += dn_cfg.fsk_count * sizeof(uint32_t);
-		x = DN_C_SCH | DN_C_LINK | DN_C_FLOW;
-		break;
-	case DN_FS:	/* queue show */
-		x = DN_C_FS | DN_C_QUEUE;
-		break;
-	case DN_GET_COMPAT:	/* compatibility mode */
-		need =  dn_compat_calc_size(); 
-		break;
-	}
-	a->flags = x;
-	if (x & DN_C_SCH) {
-		need += dn_cfg.schk_count * sizeof(struct dn_sch) / 2;
-		/* NOT also, each fs might be attached to a sched */
-		need += dn_cfg.schk_count * sizeof(struct dn_id) / 2;
-	}
-	if (x & DN_C_FS)
-		need += dn_cfg.fsk_count * sizeof(struct dn_fs);
-	if (x & DN_C_LINK) {
-		need += dn_cfg.schk_count * sizeof(struct dn_link) / 2;
-	}
-	/*
-	 * When exporting a queue to userland, only pass up the
-	 * struct dn_flow, which is the only visible part.
-	 */
-
-	if (x & DN_C_QUEUE)
-		need += dn_cfg.queue_count * sizeof(struct dn_flow);
-	if (x & DN_C_FLOW)
-		need += dn_cfg.si_count * (sizeof(struct dn_flow));
-	return need;
-}
-
-/*
- * If compat != NULL dummynet_get is called in compatibility mode.
- * *compat will be the pointer to the buffer to pass to ipfw
- */
-int
-dummynet_get(struct sockopt *sopt, void **compat)
-{
-	int have, i, need, error;
-	char *start = NULL, *buf;
-	size_t sopt_valsize;
-	struct dn_id *cmd;
-	struct copy_args a;
-	struct copy_range r;
-	int l = sizeof(struct dn_id);
-
-	bzero(&a, sizeof(a));
-	bzero(&r, sizeof(r));
-
-	/* save and restore original sopt_valsize around copyin */
-	sopt_valsize = sopt->sopt_valsize;
-
-	cmd = &r.o;
-
-	if (!compat) {
-		/* copy at least an oid, and possibly a full object */
-		error = sooptcopyin(sopt, cmd, sizeof(r), sizeof(*cmd));
-		sopt->sopt_valsize = sopt_valsize;
-		if (error)
-			goto done;
-		l = cmd->len;
-#ifdef EMULATE_SYSCTL
-		/* sysctl emulation. */
-		if (cmd->type == DN_SYSCTL_GET)
-			return kesysctl_emu_get(sopt);
-#endif
-		if (l > sizeof(r)) {
-			/* request larger than default, allocate buffer */
-			cmd = malloc(l,  M_DUMMYNET, M_WAITOK);
-			error = sooptcopyin(sopt, cmd, l, l);
-			sopt->sopt_valsize = sopt_valsize;
-			if (error)
-				goto done;
-		}
-	} else { /* compatibility */
-		error = 0;
-		cmd->type = DN_CMD_GET;
-		cmd->len = sizeof(struct dn_id);
-		cmd->subtype = DN_GET_COMPAT;
-		// cmd->id = sopt_valsize;
-		D("compatibility mode");
-	}
-	a.extra = (struct copy_range *)cmd;
-	if (cmd->len == sizeof(*cmd)) { /* no range, create a default */
-		uint32_t *rp = (uint32_t *)(cmd + 1);
-		cmd->len += 2* sizeof(uint32_t);
-		rp[0] = 1;
-		rp[1] = DN_MAX_ID - 1;
-		if (cmd->subtype == DN_LINK) {
-			rp[0] += DN_MAX_ID;
-			rp[1] += DN_MAX_ID;
-		}
-	}
-	/* Count space (under lock) and allocate (outside lock).
-	 * Exit with lock held if we manage to get enough buffer.
-	 * Try a few times then give up.
-	 */
-	for (have = 0, i = 0; i < 10; i++) {
-		DN_BH_WLOCK();
-		need = compute_space(cmd, &a);
-
-		/* if there is a range, ignore value from compute_space() */
-		if (l > sizeof(*cmd))
-			need = sopt_valsize - sizeof(*cmd);
-
-		if (need < 0) {
-			DN_BH_WUNLOCK();
-			error = EINVAL;
-			goto done;
-		}
-		need += sizeof(*cmd);
-		cmd->id = need;
-		if (have >= need)
-			break;
-
-		DN_BH_WUNLOCK();
-		if (start)
-			free(start, M_DUMMYNET);
-		start = NULL;
-		if (need > sopt_valsize)
-			break;
-
-		have = need;
-		start = malloc(have, M_DUMMYNET, M_WAITOK | M_ZERO);
-	}
-
-	if (start == NULL) {
-		if (compat) {
-			*compat = NULL;
-			error =  1; // XXX
-		} else {
-			error = sooptcopyout(sopt, cmd, sizeof(*cmd));
-		}
-		goto done;
-	}
-	ND("have %d:%d sched %d, %d:%d links %d, %d:%d flowsets %d, "
-		"%d:%d si %d, %d:%d queues %d",
-		dn_cfg.schk_count, sizeof(struct dn_sch), DN_SCH,
-		dn_cfg.schk_count, sizeof(struct dn_link), DN_LINK,
-		dn_cfg.fsk_count, sizeof(struct dn_fs), DN_FS,
-		dn_cfg.si_count, sizeof(struct dn_flow), DN_SCH_I,
-		dn_cfg.queue_count, sizeof(struct dn_queue), DN_QUEUE);
-	sopt->sopt_valsize = sopt_valsize;
-	a.type = cmd->subtype;
-
-	if (compat == NULL) {
-		bcopy(cmd, start, sizeof(*cmd));
-		((struct dn_id*)(start))->len = sizeof(struct dn_id);
-		buf = start + sizeof(*cmd);
-	} else
-		buf = start;
-	a.start = &buf;
-	a.end = start + have;
-	/* start copying other objects */
-	if (compat) {
-		a.type = DN_COMPAT_PIPE;
-		dn_ht_scan(dn_cfg.schedhash, copy_data_helper_compat, &a);
-		a.type = DN_COMPAT_QUEUE;
-		dn_ht_scan(dn_cfg.fshash, copy_data_helper_compat, &a);
-	} else if (a.type == DN_FS) {
-		dn_ht_scan(dn_cfg.fshash, copy_data_helper, &a);
-	} else {
-		dn_ht_scan(dn_cfg.schedhash, copy_data_helper, &a);
-	}
-	DN_BH_WUNLOCK();
-
-	if (compat) {
-		*compat = start;
-		sopt->sopt_valsize = buf - start;
-		/* free() is done by ip_dummynet_compat() */
-		start = NULL; //XXX hack
-	} else {
-		error = sooptcopyout(sopt, start, buf - start);
-	}
-done:
-	if (cmd && cmd != &r.o)
-		free(cmd, M_DUMMYNET);
-	if (start)
-		free(start, M_DUMMYNET);
-	return error;
-}
-
-/* Callback called on scheduler instance to delete it if idle */
-static int
-drain_scheduler_cb(void *_si, void *arg)
-{
-	struct dn_sch_inst *si = _si;
-
-	if ((si->kflags & DN_ACTIVE) || si->dline.mq.head != NULL)
-		return 0;
-
-	if (si->sched->fp->flags & DN_MULTIQUEUE) {
-		if (si->q_count == 0)
-			return si_destroy(si, NULL);
-		else
-			return 0;
-	} else { /* !DN_MULTIQUEUE */
-		if ((si+1)->ni.length == 0)
-			return si_destroy(si, NULL);
-		else
-			return 0;
-	}
-	return 0; /* unreachable */
-}
-
-/* Callback called on scheduler to check if it has instances */
-static int
-drain_scheduler_sch_cb(void *_s, void *arg)
-{
-	struct dn_schk *s = _s;
-
-	if (s->sch.flags & DN_HAVE_MASK) {
-		dn_ht_scan_bucket(s->siht, &s->drain_bucket,
-				drain_scheduler_cb, NULL);
-		s->drain_bucket++;
-	} else {
-		if (s->siht) {
-			if (drain_scheduler_cb(s->siht, NULL) == DNHT_SCAN_DEL)
-				s->siht = NULL;
-		}
-	}
-	return 0;
-}
-
-/* Called every tick, try to delete a 'bucket' of scheduler */
-void
-dn_drain_scheduler(void)
-{
-	dn_ht_scan_bucket(dn_cfg.schedhash, &dn_cfg.drain_sch,
-			   drain_scheduler_sch_cb, NULL);
-	dn_cfg.drain_sch++;
-}
-
-/* Callback called on queue to delete if it is idle */
-static int
-drain_queue_cb(void *_q, void *arg)
-{
-	struct dn_queue *q = _q;
-
-	if (q->ni.length == 0) {
-		dn_delete_queue(q, DN_DESTROY);
-		return DNHT_SCAN_DEL; /* queue is deleted */
-	}
-
-	return 0; /* queue isn't deleted */
-}
-
-/* Callback called on flowset used to check if it has queues */
-static int
-drain_queue_fs_cb(void *_fs, void *arg)
-{
-	struct dn_fsk *fs = _fs;
-
-	if (fs->fs.flags & DN_QHT_HASH) {
-		/* Flowset has a hash table for queues */
-		dn_ht_scan_bucket(fs->qht, &fs->drain_bucket,
-				drain_queue_cb, NULL);
-		fs->drain_bucket++;
-	} else {
-		/* No hash table for this flowset, null the pointer 
-		 * if the queue is deleted
-		 */
-		if (fs->qht) {
-			if (drain_queue_cb(fs->qht, NULL) == DNHT_SCAN_DEL)
-				fs->qht = NULL;
-		}
-	}
-	return 0;
-}
-
-/* Called every tick, try to delete a 'bucket' of queue */
-void
-dn_drain_queue(void)
-{
-	/* scan a bucket of flowset */
-	dn_ht_scan_bucket(dn_cfg.fshash, &dn_cfg.drain_fs,
-                               drain_queue_fs_cb, NULL);
-	dn_cfg.drain_fs++;
-}
-
-/*
- * Handler for the various dummynet socket options
- */
-static int
-ip_dn_ctl(struct sockopt *sopt)
-{
-	void *p = NULL;
-	int error, l;
-
-	error = priv_check(sopt->sopt_td, PRIV_NETINET_DUMMYNET);
-	if (error)
-		return (error);
-
-	/* Disallow sets in really-really secure mode. */
-	if (sopt->sopt_dir == SOPT_SET) {
-		error =  securelevel_ge(sopt->sopt_td->td_ucred, 3);
-		if (error)
-			return (error);
-	}
-
-	switch (sopt->sopt_name) {
-	default :
-		D("dummynet: unknown option %d", sopt->sopt_name);
-		error = EINVAL;
-		break;
-
-	case IP_DUMMYNET_FLUSH:
-	case IP_DUMMYNET_CONFIGURE:
-	case IP_DUMMYNET_DEL:	/* remove a pipe or queue */
-	case IP_DUMMYNET_GET:
-		D("dummynet: compat option %d", sopt->sopt_name);
-		error = ip_dummynet_compat(sopt);
-		break;
-
-	case IP_DUMMYNET3 :
-		if (sopt->sopt_dir == SOPT_GET) {
-			error = dummynet_get(sopt, NULL);
-			break;
-		}
-		l = sopt->sopt_valsize;
-		if (l < sizeof(struct dn_id) || l > 12000) {
-			D("argument len %d invalid", l);
-			break;
-		}
-		p = malloc(l, M_TEMP, M_WAITOK); // XXX can it fail ?
-		error = sooptcopyin(sopt, p, l, l);
-		if (error)
-			break ;
-		error = do_config(p, l);
-		break;
-	}
-
-	if (p != NULL)
-		free(p, M_TEMP);
-
-	return error ;
-}
-
-
-static void
-ip_dn_init(void)
-{
-	if (dn_cfg.init_done)
-		return;
-	printf("DUMMYNET %p with IPv6 initialized (100409)\n", curvnet);
-	dn_cfg.init_done = 1;
-	/* Set defaults here. MSVC does not accept initializers,
-	 * and this is also useful for vimages
-	 */
-	/* queue limits */
-	dn_cfg.slot_limit = 100; /* Foot shooting limit for queues. */
-	dn_cfg.byte_limit = 1024 * 1024;
-	dn_cfg.expire = 1;
-
-	/* RED parameters */
-	dn_cfg.red_lookup_depth = 256;	/* default lookup table depth */
-	dn_cfg.red_avg_pkt_size = 512;	/* default medium packet size */
-	dn_cfg.red_max_pkt_size = 1500;	/* default max packet size */
-
-	/* hash tables */
-	dn_cfg.max_hash_size = 65536;	/* max in the hash tables */
-	dn_cfg.hash_size = 64;		/* default hash size */
-
-	/* create hash tables for schedulers and flowsets.
-	 * In both we search by key and by pointer.
-	 */
-	dn_cfg.schedhash = dn_ht_init(NULL, dn_cfg.hash_size,
-		offsetof(struct dn_schk, schk_next),
-		schk_hash, schk_match, schk_new);
-	dn_cfg.fshash = dn_ht_init(NULL, dn_cfg.hash_size,
-		offsetof(struct dn_fsk, fsk_next),
-		fsk_hash, fsk_match, fsk_new);
-
-	/* bucket index to drain object */
-	dn_cfg.drain_fs = 0;
-	dn_cfg.drain_sch = 0;
-
-	heap_init(&dn_cfg.evheap, 16, offsetof(struct dn_id, id));
-	SLIST_INIT(&dn_cfg.fsu);
-	SLIST_INIT(&dn_cfg.schedlist);
-
-	DN_LOCK_INIT();
-
-	TASK_INIT(&dn_task, 0, dummynet_task, curvnet);
-	dn_tq = taskqueue_create("dummynet", M_WAITOK,
-	    taskqueue_thread_enqueue, &dn_tq);
-	taskqueue_start_threads(&dn_tq, 1, PI_NET, "dummynet");
-
-	callout_init(&dn_timeout, CALLOUT_MPSAFE);
-	callout_reset(&dn_timeout, 1, dummynet, NULL);
-
-	/* Initialize curr_time adjustment mechanics. */
-	getmicrouptime(&dn_cfg.prev_t);
-}
-
-#ifdef KLD_MODULE
-static void
-ip_dn_destroy(int last)
-{
-	callout_drain(&dn_timeout);
-
-	DN_BH_WLOCK();
-	if (last) {
-		ND("removing last instance\n");
-		ip_dn_ctl_ptr = NULL;
-		ip_dn_io_ptr = NULL;
-	}
-
-	dummynet_flush();
-	DN_BH_WUNLOCK();
-	taskqueue_drain(dn_tq, &dn_task);
-	taskqueue_free(dn_tq);
-
-	dn_ht_free(dn_cfg.schedhash, 0);
-	dn_ht_free(dn_cfg.fshash, 0);
-	heap_free(&dn_cfg.evheap);
-
-	DN_LOCK_DESTROY();
-}
-#endif /* KLD_MODULE */
-
-static int
-dummynet_modevent(module_t mod, int type, void *data)
-{
-
-	if (type == MOD_LOAD) {
-		if (ip_dn_io_ptr) {
-			printf("DUMMYNET already loaded\n");
-			return EEXIST ;
-		}
-		ip_dn_init();
-		ip_dn_ctl_ptr = ip_dn_ctl;
-		ip_dn_io_ptr = dummynet_io;
-		return 0;
-	} else if (type == MOD_UNLOAD) {
-#if !defined(KLD_MODULE)
-		printf("dummynet statically compiled, cannot unload\n");
-		return EINVAL ;
-#else
-		ip_dn_destroy(1 /* last */);
-		return 0;
-#endif
-	} else
-		return EOPNOTSUPP;
-}
-
-/* modevent helpers for the modules */
-static int
-load_dn_sched(struct dn_alg *d)
-{
-	struct dn_alg *s;
-
-	if (d == NULL)
-		return 1; /* error */
-	ip_dn_init();	/* just in case, we need the lock */
-
-	/* Check that mandatory funcs exists */
-	if (d->enqueue == NULL || d->dequeue == NULL) {
-		D("missing enqueue or dequeue for %s", d->name);
-		return 1;
-	}
-
-	/* Search if scheduler already exists */
-	DN_BH_WLOCK();
-	SLIST_FOREACH(s, &dn_cfg.schedlist, next) {
-		if (strcmp(s->name, d->name) == 0) {
-			D("%s already loaded", d->name);
-			break; /* scheduler already exists */
-		}
-	}
-	if (s == NULL)
-		SLIST_INSERT_HEAD(&dn_cfg.schedlist, d, next);
-	DN_BH_WUNLOCK();
-	D("dn_sched %s %sloaded", d->name, s ? "not ":"");
-	return s ? 1 : 0;
-}
-
-static int
-unload_dn_sched(struct dn_alg *s)
-{
-	struct dn_alg *tmp, *r;
-	int err = EINVAL;
-
-	ND("called for %s", s->name);
-
-	DN_BH_WLOCK();
-	SLIST_FOREACH_SAFE(r, &dn_cfg.schedlist, next, tmp) {
-		if (strcmp(s->name, r->name) != 0)
-			continue;
-		ND("ref_count = %d", r->ref_count);
-		err = (r->ref_count != 0) ? EBUSY : 0;
-		if (err == 0)
-			SLIST_REMOVE(&dn_cfg.schedlist, r, dn_alg, next);
-		break;
-	}
-	DN_BH_WUNLOCK();
-	D("dn_sched %s %sunloaded", s->name, err ? "not ":"");
-	return err;
-}
-
-int
-dn_sched_modevent(module_t mod, int cmd, void *arg)
-{
-	struct dn_alg *sch = arg;
-
-	if (cmd == MOD_LOAD)
-		return load_dn_sched(sch);
-	else if (cmd == MOD_UNLOAD)
-		return unload_dn_sched(sch);
-	else
-		return EINVAL;
-}
-
-static moduledata_t dummynet_mod = {
-	"dummynet", dummynet_modevent, NULL
-};
-
-#define	DN_SI_SUB	SI_SUB_PROTO_IFATTACHDOMAIN
-#define	DN_MODEV_ORD	(SI_ORDER_ANY - 128) /* after ipfw */
-DECLARE_MODULE(dummynet, dummynet_mod, DN_SI_SUB, DN_MODEV_ORD);
-MODULE_DEPEND(dummynet, ipfw, 2, 2, 2);
-MODULE_VERSION(dummynet, 3);
-
-/*
- * Starting up. Done in order after dummynet_modevent() has been called.
- * VNET_SYSINIT is also called for each existing vnet and each new vnet.
- */
-//VNET_SYSINIT(vnet_dn_init, DN_SI_SUB, DN_MODEV_ORD+2, ip_dn_init, NULL);
-
-/*
- * Shutdown handlers up shop. These are done in REVERSE ORDER, but still
- * after dummynet_modevent() has been called. Not called on reboot.
- * VNET_SYSUNINIT is also called for each exiting vnet as it exits.
- * or when the module is unloaded.
- */
-//VNET_SYSUNINIT(vnet_dn_uninit, DN_SI_SUB, DN_MODEV_ORD+2, ip_dn_destroy, NULL);
-
-/* end of file */
diff --git a/sys/netinet/ipfw/ip_fw2.c b/sys/netinet/ipfw/ip_fw2.c
deleted file mode 100644
index 21a00bb8ee7b..000000000000
--- a/sys/netinet/ipfw/ip_fw2.c
+++ /dev/null
@@ -1,2783 +0,0 @@
-/*-
- * Copyright (c) 2002-2009 Luigi Rizzo, Universita` di Pisa
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
-
-/*
- * The FreeBSD IP packet firewall, main file
- */
-
-#include "opt_ipfw.h"
-#include "opt_ipdivert.h"
-#include "opt_inet.h"
-#ifndef INET
-#error "IPFIREWALL requires INET"
-#endif /* INET */
-#include "opt_inet6.h"
-#include "opt_ipsec.h"
-
-#include <sys/param.h>
-#include <sys/systm.h>
-#include <sys/condvar.h>
-#include <sys/eventhandler.h>
-#include <sys/malloc.h>
-#include <sys/mbuf.h>
-#include <sys/kernel.h>
-#include <sys/lock.h>
-#include <sys/jail.h>
-#include <sys/module.h>
-#include <sys/priv.h>
-#include <sys/proc.h>
-#include <sys/rwlock.h>
-#include <sys/socket.h>
-#include <sys/socketvar.h>
-#include <sys/sysctl.h>
-#include <sys/syslog.h>
-#include <sys/ucred.h>
-#include <net/ethernet.h> /* for ETHERTYPE_IP */
-#include <net/if.h>
-#include <net/route.h>
-#include <net/pf_mtag.h>
-#include <net/vnet.h>
-
-#include <netinet/in.h>
-#include <netinet/in_var.h>
-#include <netinet/in_pcb.h>
-#include <netinet/ip.h>
-#include <netinet/ip_var.h>
-#include <netinet/ip_icmp.h>
-#include <netinet/ip_fw.h>
-#include <netinet/ipfw/ip_fw_private.h>
-#include <netinet/ip_carp.h>
-#include <netinet/pim.h>
-#include <netinet/tcp_var.h>
-#include <netinet/udp.h>
-#include <netinet/udp_var.h>
-#include <netinet/sctp.h>
-
-#include <netinet/ip6.h>
-#include <netinet/icmp6.h>
-#ifdef INET6
-#include <netinet6/in6_pcb.h>
-#include <netinet6/scope6_var.h>
-#include <netinet6/ip6_var.h>
-#endif
-
-#include <machine/in_cksum.h>	/* XXX for in_cksum */
-
-#ifdef MAC
-#include <security/mac/mac_framework.h>
-#endif
-
-/*
- * static variables followed by global ones.
- * All ipfw global variables are here.
- */
-
-/* ipfw_vnet_ready controls when we are open for business */
-static VNET_DEFINE(int, ipfw_vnet_ready) = 0;
-#define	V_ipfw_vnet_ready	VNET(ipfw_vnet_ready)
-
-static VNET_DEFINE(int, fw_deny_unknown_exthdrs);
-#define	V_fw_deny_unknown_exthdrs	VNET(fw_deny_unknown_exthdrs)
-
-static VNET_DEFINE(int, fw_permit_single_frag6) = 1;
-#define	V_fw_permit_single_frag6	VNET(fw_permit_single_frag6)
-
-#ifdef IPFIREWALL_DEFAULT_TO_ACCEPT
-static int default_to_accept = 1;
-#else
-static int default_to_accept;
-#endif
-
-VNET_DEFINE(int, autoinc_step);
-VNET_DEFINE(int, fw_one_pass) = 1;
-
-VNET_DEFINE(unsigned int, fw_tables_max);
-/* Use 128 tables by default */
-static unsigned int default_fw_tables = IPFW_TABLES_DEFAULT;
-
-/*
- * Each rule belongs to one of 32 different sets (0..31).
- * The variable set_disable contains one bit per set.
- * If the bit is set, all rules in the corresponding set
- * are disabled. Set RESVD_SET(31) is reserved for the default rule
- * and rules that are not deleted by the flush command,
- * and CANNOT be disabled.
- * Rules in set RESVD_SET can only be deleted individually.
- */
-VNET_DEFINE(u_int32_t, set_disable);
-#define	V_set_disable			VNET(set_disable)
-
-VNET_DEFINE(int, fw_verbose);
-/* counter for ipfw_log(NULL...) */
-VNET_DEFINE(u_int64_t, norule_counter);
-VNET_DEFINE(int, verbose_limit);
-
-/* layer3_chain contains the list of rules for layer 3 */
-VNET_DEFINE(struct ip_fw_chain, layer3_chain);
-
-ipfw_nat_t *ipfw_nat_ptr = NULL;
-struct cfg_nat *(*lookup_nat_ptr)(struct nat_list *, int);
-ipfw_nat_cfg_t *ipfw_nat_cfg_ptr;
-ipfw_nat_cfg_t *ipfw_nat_del_ptr;
-ipfw_nat_cfg_t *ipfw_nat_get_cfg_ptr;
-ipfw_nat_cfg_t *ipfw_nat_get_log_ptr;
-
-#ifdef SYSCTL_NODE
-uint32_t dummy_def = IPFW_DEFAULT_RULE;
-static int sysctl_ipfw_table_num(SYSCTL_HANDLER_ARGS);
-
-SYSBEGIN(f3)
-
-SYSCTL_NODE(_net_inet_ip, OID_AUTO, fw, CTLFLAG_RW, 0, "Firewall");
-SYSCTL_VNET_INT(_net_inet_ip_fw, OID_AUTO, one_pass,
-    CTLFLAG_RW | CTLFLAG_SECURE3, &VNET_NAME(fw_one_pass), 0,
-    "Only do a single pass through ipfw when using dummynet(4)");
-SYSCTL_VNET_INT(_net_inet_ip_fw, OID_AUTO, autoinc_step,
-    CTLFLAG_RW, &VNET_NAME(autoinc_step), 0,
-    "Rule number auto-increment step");
-SYSCTL_VNET_INT(_net_inet_ip_fw, OID_AUTO, verbose,
-    CTLFLAG_RW | CTLFLAG_SECURE3, &VNET_NAME(fw_verbose), 0,
-    "Log matches to ipfw rules");
-SYSCTL_VNET_INT(_net_inet_ip_fw, OID_AUTO, verbose_limit,
-    CTLFLAG_RW, &VNET_NAME(verbose_limit), 0,
-    "Set upper limit of matches of ipfw rules logged");
-SYSCTL_UINT(_net_inet_ip_fw, OID_AUTO, default_rule, CTLFLAG_RD,
-    &dummy_def, 0,
-    "The default/max possible rule number.");
-SYSCTL_VNET_PROC(_net_inet_ip_fw, OID_AUTO, tables_max,
-    CTLTYPE_UINT|CTLFLAG_RW, 0, 0, sysctl_ipfw_table_num, "IU",
-    "Maximum number of tables");
-SYSCTL_INT(_net_inet_ip_fw, OID_AUTO, default_to_accept, CTLFLAG_RDTUN,
-    &default_to_accept, 0,
-    "Make the default rule accept all packets.");
-TUNABLE_INT("net.inet.ip.fw.default_to_accept", &default_to_accept);
-TUNABLE_INT("net.inet.ip.fw.tables_max", &default_fw_tables);
-SYSCTL_VNET_INT(_net_inet_ip_fw, OID_AUTO, static_count,
-    CTLFLAG_RD, &VNET_NAME(layer3_chain.n_rules), 0,
-    "Number of static rules");
-
-#ifdef INET6
-SYSCTL_DECL(_net_inet6_ip6);
-SYSCTL_NODE(_net_inet6_ip6, OID_AUTO, fw, CTLFLAG_RW, 0, "Firewall");
-SYSCTL_VNET_INT(_net_inet6_ip6_fw, OID_AUTO, deny_unknown_exthdrs,
-    CTLFLAG_RW | CTLFLAG_SECURE, &VNET_NAME(fw_deny_unknown_exthdrs), 0,
-    "Deny packets with unknown IPv6 Extension Headers");
-SYSCTL_VNET_INT(_net_inet6_ip6_fw, OID_AUTO, permit_single_frag6,
-    CTLFLAG_RW | CTLFLAG_SECURE, &VNET_NAME(fw_permit_single_frag6), 0,
-    "Permit single packet IPv6 fragments");
-#endif /* INET6 */
-
-SYSEND
-
-#endif /* SYSCTL_NODE */
-
-
-/*
- * Some macros used in the various matching options.
- * L3HDR maps an ipv4 pointer into a layer3 header pointer of type T
- * Other macros just cast void * into the appropriate type
- */
-#define	L3HDR(T, ip)	((T *)((u_int32_t *)(ip) + (ip)->ip_hl))
-#define	TCP(p)		((struct tcphdr *)(p))
-#define	SCTP(p)		((struct sctphdr *)(p))
-#define	UDP(p)		((struct udphdr *)(p))
-#define	ICMP(p)		((struct icmphdr *)(p))
-#define	ICMP6(p)	((struct icmp6_hdr *)(p))
-
-static __inline int
-icmptype_match(struct icmphdr *icmp, ipfw_insn_u32 *cmd)
-{
-	int type = icmp->icmp_type;
-
-	return (type <= ICMP_MAXTYPE && (cmd->d[0] & (1<<type)) );
-}
-
-#define TT	( (1 << ICMP_ECHO) | (1 << ICMP_ROUTERSOLICIT) | \
-    (1 << ICMP_TSTAMP) | (1 << ICMP_IREQ) | (1 << ICMP_MASKREQ) )
-
-static int
-is_icmp_query(struct icmphdr *icmp)
-{
-	int type = icmp->icmp_type;
-
-	return (type <= ICMP_MAXTYPE && (TT & (1<<type)) );
-}
-#undef TT
-
-/*
- * The following checks use two arrays of 8 or 16 bits to store the
- * bits that we want set or clear, respectively. They are in the
- * low and high half of cmd->arg1 or cmd->d[0].
- *
- * We scan options and store the bits we find set. We succeed if
- *
- *	(want_set & ~bits) == 0 && (want_clear & ~bits) == want_clear
- *
- * The code is sometimes optimized not to store additional variables.
- */
-
-static int
-flags_match(ipfw_insn *cmd, u_int8_t bits)
-{
-	u_char want_clear;
-	bits = ~bits;
-
-	if ( ((cmd->arg1 & 0xff) & bits) != 0)
-		return 0; /* some bits we want set were clear */
-	want_clear = (cmd->arg1 >> 8) & 0xff;
-	if ( (want_clear & bits) != want_clear)
-		return 0; /* some bits we want clear were set */
-	return 1;
-}
-
-static int
-ipopts_match(struct ip *ip, ipfw_insn *cmd)
-{
-	int optlen, bits = 0;
-	u_char *cp = (u_char *)(ip + 1);
-	int x = (ip->ip_hl << 2) - sizeof (struct ip);
-
-	for (; x > 0; x -= optlen, cp += optlen) {
-		int opt = cp[IPOPT_OPTVAL];
-
-		if (opt == IPOPT_EOL)
-			break;
-		if (opt == IPOPT_NOP)
-			optlen = 1;
-		else {
-			optlen = cp[IPOPT_OLEN];
-			if (optlen <= 0 || optlen > x)
-				return 0; /* invalid or truncated */
-		}
-		switch (opt) {
-
-		default:
-			break;
-
-		case IPOPT_LSRR:
-			bits |= IP_FW_IPOPT_LSRR;
-			break;
-
-		case IPOPT_SSRR:
-			bits |= IP_FW_IPOPT_SSRR;
-			break;
-
-		case IPOPT_RR:
-			bits |= IP_FW_IPOPT_RR;
-			break;
-
-		case IPOPT_TS:
-			bits |= IP_FW_IPOPT_TS;
-			break;
-		}
-	}
-	return (flags_match(cmd, bits));
-}
-
-static int
-tcpopts_match(struct tcphdr *tcp, ipfw_insn *cmd)
-{
-	int optlen, bits = 0;
-	u_char *cp = (u_char *)(tcp + 1);
-	int x = (tcp->th_off << 2) - sizeof(struct tcphdr);
-
-	for (; x > 0; x -= optlen, cp += optlen) {
-		int opt = cp[0];
-		if (opt == TCPOPT_EOL)
-			break;
-		if (opt == TCPOPT_NOP)
-			optlen = 1;
-		else {
-			optlen = cp[1];
-			if (optlen <= 0)
-				break;
-		}
-
-		switch (opt) {
-
-		default:
-			break;
-
-		case TCPOPT_MAXSEG:
-			bits |= IP_FW_TCPOPT_MSS;
-			break;
-
-		case TCPOPT_WINDOW:
-			bits |= IP_FW_TCPOPT_WINDOW;
-			break;
-
-		case TCPOPT_SACK_PERMITTED:
-		case TCPOPT_SACK:
-			bits |= IP_FW_TCPOPT_SACK;
-			break;
-
-		case TCPOPT_TIMESTAMP:
-			bits |= IP_FW_TCPOPT_TS;
-			break;
-
-		}
-	}
-	return (flags_match(cmd, bits));
-}
-
-static int
-iface_match(struct ifnet *ifp, ipfw_insn_if *cmd, struct ip_fw_chain *chain, uint32_t *tablearg)
-{
-	if (ifp == NULL)	/* no iface with this packet, match fails */
-		return 0;
-	/* Check by name or by IP address */
-	if (cmd->name[0] != '\0') { /* match by name */
-		if (cmd->name[0] == '\1') /* use tablearg to match */
-			return ipfw_lookup_table_extended(chain, cmd->p.glob,
-				ifp->if_xname, tablearg, IPFW_TABLE_INTERFACE);
-		/* Check name */
-		if (cmd->p.glob) {
-			if (fnmatch(cmd->name, ifp->if_xname, 0) == 0)
-				return(1);
-		} else {
-			if (strncmp(ifp->if_xname, cmd->name, IFNAMSIZ) == 0)
-				return(1);
-		}
-	} else {
-#ifdef __FreeBSD__	/* and OSX too ? */
-		struct ifaddr *ia;
-
-		if_addr_rlock(ifp);
-		TAILQ_FOREACH(ia, &ifp->if_addrhead, ifa_link) {
-			if (ia->ifa_addr->sa_family != AF_INET)
-				continue;
-			if (cmd->p.ip.s_addr == ((struct sockaddr_in *)
-			    (ia->ifa_addr))->sin_addr.s_addr) {
-				if_addr_runlock(ifp);
-				return(1);	/* match */
-			}
-		}
-		if_addr_runlock(ifp);
-#endif /* __FreeBSD__ */
-	}
-	return(0);	/* no match, fail ... */
-}
-
-/*
- * The verify_path function checks if a route to the src exists and
- * if it is reachable via ifp (when provided).
- * 
- * The 'verrevpath' option checks that the interface that an IP packet
- * arrives on is the same interface that traffic destined for the
- * packet's source address would be routed out of.
- * The 'versrcreach' option just checks that the source address is
- * reachable via any route (except default) in the routing table.
- * These two are a measure to block forged packets. This is also
- * commonly known as "anti-spoofing" or Unicast Reverse Path
- * Forwarding (Unicast RFP) in Cisco-ese. The name of the knobs
- * is purposely reminiscent of the Cisco IOS command,
- *
- *   ip verify unicast reverse-path
- *   ip verify unicast source reachable-via any
- *
- * which implements the same functionality. But note that the syntax
- * is misleading, and the check may be performed on all IP packets
- * whether unicast, multicast, or broadcast.
- */
-static int
-verify_path(struct in_addr src, struct ifnet *ifp, u_int fib)
-{
-#ifndef __FreeBSD__
-	return 0;
-#else
-	struct route ro;
-	struct sockaddr_in *dst;
-
-	bzero(&ro, sizeof(ro));
-
-	dst = (struct sockaddr_in *)&(ro.ro_dst);
-	dst->sin_family = AF_INET;
-	dst->sin_len = sizeof(*dst);
-	dst->sin_addr = src;
-	in_rtalloc_ign(&ro, 0, fib);
-
-	if (ro.ro_rt == NULL)
-		return 0;
-
-	/*
-	 * If ifp is provided, check for equality with rtentry.
-	 * We should use rt->rt_ifa->ifa_ifp, instead of rt->rt_ifp,
-	 * in order to pass packets injected back by if_simloop():
-	 * if useloopback == 1 routing entry (via lo0) for our own address
-	 * may exist, so we need to handle routing assymetry.
-	 */
-	if (ifp != NULL && ro.ro_rt->rt_ifa->ifa_ifp != ifp) {
-		RTFREE(ro.ro_rt);
-		return 0;
-	}
-
-	/* if no ifp provided, check if rtentry is not default route */
-	if (ifp == NULL &&
-	     satosin(rt_key(ro.ro_rt))->sin_addr.s_addr == INADDR_ANY) {
-		RTFREE(ro.ro_rt);
-		return 0;
-	}
-
-	/* or if this is a blackhole/reject route */
-	if (ifp == NULL && ro.ro_rt->rt_flags & (RTF_REJECT|RTF_BLACKHOLE)) {
-		RTFREE(ro.ro_rt);
-		return 0;
-	}
-
-	/* found valid route */
-	RTFREE(ro.ro_rt);
-	return 1;
-#endif /* __FreeBSD__ */
-}
-
-#ifdef INET6
-/*
- * ipv6 specific rules here...
- */
-static __inline int
-icmp6type_match (int type, ipfw_insn_u32 *cmd)
-{
-	return (type <= ICMP6_MAXTYPE && (cmd->d[type/32] & (1<<(type%32)) ) );
-}
-
-static int
-flow6id_match( int curr_flow, ipfw_insn_u32 *cmd )
-{
-	int i;
-	for (i=0; i <= cmd->o.arg1; ++i )
-		if (curr_flow == cmd->d[i] )
-			return 1;
-	return 0;
-}
-
-/* support for IP6_*_ME opcodes */
-static int
-search_ip6_addr_net (struct in6_addr * ip6_addr)
-{
-	struct ifnet *mdc;
-	struct ifaddr *mdc2;
-	struct in6_ifaddr *fdm;
-	struct in6_addr copia;
-
-	TAILQ_FOREACH(mdc, &V_ifnet, if_link) {
-		if_addr_rlock(mdc);
-		TAILQ_FOREACH(mdc2, &mdc->if_addrhead, ifa_link) {
-			if (mdc2->ifa_addr->sa_family == AF_INET6) {
-				fdm = (struct in6_ifaddr *)mdc2;
-				copia = fdm->ia_addr.sin6_addr;
-				/* need for leaving scope_id in the sock_addr */
-				in6_clearscope(&copia);
-				if (IN6_ARE_ADDR_EQUAL(ip6_addr, &copia)) {
-					if_addr_runlock(mdc);
-					return 1;
-				}
-			}
-		}
-		if_addr_runlock(mdc);
-	}
-	return 0;
-}
-
-static int
-verify_path6(struct in6_addr *src, struct ifnet *ifp, u_int fib)
-{
-	struct route_in6 ro;
-	struct sockaddr_in6 *dst;
-
-	bzero(&ro, sizeof(ro));
-
-	dst = (struct sockaddr_in6 * )&(ro.ro_dst);
-	dst->sin6_family = AF_INET6;
-	dst->sin6_len = sizeof(*dst);
-	dst->sin6_addr = *src;
-
-	in6_rtalloc_ign(&ro, 0, fib);
-	if (ro.ro_rt == NULL)
-		return 0;
-
-	/* 
-	 * if ifp is provided, check for equality with rtentry
-	 * We should use rt->rt_ifa->ifa_ifp, instead of rt->rt_ifp,
-	 * to support the case of sending packets to an address of our own.
-	 * (where the former interface is the first argument of if_simloop()
-	 *  (=ifp), the latter is lo0)
-	 */
-	if (ifp != NULL && ro.ro_rt->rt_ifa->ifa_ifp != ifp) {
-		RTFREE(ro.ro_rt);
-		return 0;
-	}
-
-	/* if no ifp provided, check if rtentry is not default route */
-	if (ifp == NULL &&
-	    IN6_IS_ADDR_UNSPECIFIED(&satosin6(rt_key(ro.ro_rt))->sin6_addr)) {
-		RTFREE(ro.ro_rt);
-		return 0;
-	}
-
-	/* or if this is a blackhole/reject route */
-	if (ifp == NULL && ro.ro_rt->rt_flags & (RTF_REJECT|RTF_BLACKHOLE)) {
-		RTFREE(ro.ro_rt);
-		return 0;
-	}
-
-	/* found valid route */
-	RTFREE(ro.ro_rt);
-	return 1;
-
-}
-
-static int
-is_icmp6_query(int icmp6_type)
-{
-	if ((icmp6_type <= ICMP6_MAXTYPE) &&
-	    (icmp6_type == ICMP6_ECHO_REQUEST ||
-	    icmp6_type == ICMP6_MEMBERSHIP_QUERY ||
-	    icmp6_type == ICMP6_WRUREQUEST ||
-	    icmp6_type == ICMP6_FQDN_QUERY ||
-	    icmp6_type == ICMP6_NI_QUERY))
-		return (1);
-
-	return (0);
-}
-
-static void
-send_reject6(struct ip_fw_args *args, int code, u_int hlen, struct ip6_hdr *ip6)
-{
-	struct mbuf *m;
-
-	m = args->m;
-	if (code == ICMP6_UNREACH_RST && args->f_id.proto == IPPROTO_TCP) {
-		struct tcphdr *tcp;
-		tcp = (struct tcphdr *)((char *)ip6 + hlen);
-
-		if ((tcp->th_flags & TH_RST) == 0) {
-			struct mbuf *m0;
-			m0 = ipfw_send_pkt(args->m, &(args->f_id),
-			    ntohl(tcp->th_seq), ntohl(tcp->th_ack),
-			    tcp->th_flags | TH_RST);
-			if (m0 != NULL)
-				ip6_output(m0, NULL, NULL, 0, NULL, NULL,
-				    NULL);
-		}
-		FREE_PKT(m);
-	} else if (code != ICMP6_UNREACH_RST) { /* Send an ICMPv6 unreach. */
-#if 0
-		/*
-		 * Unlike above, the mbufs need to line up with the ip6 hdr,
-		 * as the contents are read. We need to m_adj() the
-		 * needed amount.
-		 * The mbuf will however be thrown away so we can adjust it.
-		 * Remember we did an m_pullup on it already so we
-		 * can make some assumptions about contiguousness.
-		 */
-		if (args->L3offset)
-			m_adj(m, args->L3offset);
-#endif
-		icmp6_error(m, ICMP6_DST_UNREACH, code, 0);
-	} else
-		FREE_PKT(m);
-
-	args->m = NULL;
-}
-
-#endif /* INET6 */
-
-
-/*
- * sends a reject message, consuming the mbuf passed as an argument.
- */
-static void
-send_reject(struct ip_fw_args *args, int code, int iplen, struct ip *ip)
-{
-
-#if 0
-	/* XXX When ip is not guaranteed to be at mtod() we will
-	 * need to account for this */
-	 * The mbuf will however be thrown away so we can adjust it.
-	 * Remember we did an m_pullup on it already so we
-	 * can make some assumptions about contiguousness.
-	 */
-	if (args->L3offset)
-		m_adj(m, args->L3offset);
-#endif
-	if (code != ICMP_REJECT_RST) { /* Send an ICMP unreach */
-		/* We need the IP header in host order for icmp_error(). */
-		SET_HOST_IPLEN(ip);
-		icmp_error(args->m, ICMP_UNREACH, code, 0L, 0);
-	} else if (args->f_id.proto == IPPROTO_TCP) {
-		struct tcphdr *const tcp =
-		    L3HDR(struct tcphdr, mtod(args->m, struct ip *));
-		if ( (tcp->th_flags & TH_RST) == 0) {
-			struct mbuf *m;
-			m = ipfw_send_pkt(args->m, &(args->f_id),
-				ntohl(tcp->th_seq), ntohl(tcp->th_ack),
-				tcp->th_flags | TH_RST);
-			if (m != NULL)
-				ip_output(m, NULL, NULL, 0, NULL, NULL);
-		}
-		FREE_PKT(args->m);
-	} else
-		FREE_PKT(args->m);
-	args->m = NULL;
-}
-
-/*
- * Support for uid/gid/jail lookup. These tests are expensive
- * (because we may need to look into the list of active sockets)
- * so we cache the results. ugid_lookupp is 0 if we have not
- * yet done a lookup, 1 if we succeeded, and -1 if we tried
- * and failed. The function always returns the match value.
- * We could actually spare the variable and use *uc, setting
- * it to '(void *)check_uidgid if we have no info, NULL if
- * we tried and failed, or any other value if successful.
- */
-static int
-check_uidgid(ipfw_insn_u32 *insn, struct ip_fw_args *args, int *ugid_lookupp,
-    struct ucred **uc)
-{
-#ifndef __FreeBSD__
-	/* XXX */
-	return cred_check(insn, proto, oif,
-	    dst_ip, dst_port, src_ip, src_port,
-	    (struct bsd_ucred *)uc, ugid_lookupp, ((struct mbuf *)inp)->m_skb);
-#else  /* FreeBSD */
-	struct in_addr src_ip, dst_ip;
-	struct inpcbinfo *pi;
-	struct ipfw_flow_id *id;
-	struct inpcb *pcb, *inp;
-	struct ifnet *oif;
-	int lookupflags;
-	int match;
-
-	id = &args->f_id;
-	inp = args->inp;
-	oif = args->oif;
-
-	/*
-	 * Check to see if the UDP or TCP stack supplied us with
-	 * the PCB. If so, rather then holding a lock and looking
-	 * up the PCB, we can use the one that was supplied.
-	 */
-	if (inp && *ugid_lookupp == 0) {
-		INP_LOCK_ASSERT(inp);
-		if (inp->inp_socket != NULL) {
-			*uc = crhold(inp->inp_cred);
-			*ugid_lookupp = 1;
-		} else
-			*ugid_lookupp = -1;
-	}
-	/*
-	 * If we have already been here and the packet has no
-	 * PCB entry associated with it, then we can safely
-	 * assume that this is a no match.
-	 */
-	if (*ugid_lookupp == -1)
-		return (0);
-	if (id->proto == IPPROTO_TCP) {
-		lookupflags = 0;
-		pi = &V_tcbinfo;
-	} else if (id->proto == IPPROTO_UDP) {
-		lookupflags = INPLOOKUP_WILDCARD;
-		pi = &V_udbinfo;
-	} else
-		return 0;
-	lookupflags |= INPLOOKUP_RLOCKPCB;
-	match = 0;
-	if (*ugid_lookupp == 0) {
-		if (id->addr_type == 6) {
-#ifdef INET6
-			if (oif == NULL)
-				pcb = in6_pcblookup_mbuf(pi,
-				    &id->src_ip6, htons(id->src_port),
-				    &id->dst_ip6, htons(id->dst_port),
-				    lookupflags, oif, args->m);
-			else
-				pcb = in6_pcblookup_mbuf(pi,
-				    &id->dst_ip6, htons(id->dst_port),
-				    &id->src_ip6, htons(id->src_port),
-				    lookupflags, oif, args->m);
-#else
-			*ugid_lookupp = -1;
-			return (0);
-#endif
-		} else {
-			src_ip.s_addr = htonl(id->src_ip);
-			dst_ip.s_addr = htonl(id->dst_ip);
-			if (oif == NULL)
-				pcb = in_pcblookup_mbuf(pi,
-				    src_ip, htons(id->src_port),
-				    dst_ip, htons(id->dst_port),
-				    lookupflags, oif, args->m);
-			else
-				pcb = in_pcblookup_mbuf(pi,
-				    dst_ip, htons(id->dst_port),
-				    src_ip, htons(id->src_port),
-				    lookupflags, oif, args->m);
-		}
-		if (pcb != NULL) {
-			INP_RLOCK_ASSERT(pcb);
-			*uc = crhold(pcb->inp_cred);
-			*ugid_lookupp = 1;
-			INP_RUNLOCK(pcb);
-		}
-		if (*ugid_lookupp == 0) {
-			/*
-			 * We tried and failed, set the variable to -1
-			 * so we will not try again on this packet.
-			 */
-			*ugid_lookupp = -1;
-			return (0);
-		}
-	}
-	if (insn->o.opcode == O_UID)
-		match = ((*uc)->cr_uid == (uid_t)insn->d[0]);
-	else if (insn->o.opcode == O_GID)
-		match = groupmember((gid_t)insn->d[0], *uc);
-	else if (insn->o.opcode == O_JAIL)
-		match = ((*uc)->cr_prison->pr_id == (int)insn->d[0]);
-	return (match);
-#endif /* __FreeBSD__ */
-}
-
-/*
- * Helper function to set args with info on the rule after the matching
- * one. slot is precise, whereas we guess rule_id as they are
- * assigned sequentially.
- */
-static inline void
-set_match(struct ip_fw_args *args, int slot,
-	struct ip_fw_chain *chain)
-{
-	args->rule.chain_id = chain->id;
-	args->rule.slot = slot + 1; /* we use 0 as a marker */
-	args->rule.rule_id = 1 + chain->map[slot]->id;
-	args->rule.rulenum = chain->map[slot]->rulenum;
-}
-
-/*
- * The main check routine for the firewall.
- *
- * All arguments are in args so we can modify them and return them
- * back to the caller.
- *
- * Parameters:
- *
- *	args->m	(in/out) The packet; we set to NULL when/if we nuke it.
- *		Starts with the IP header.
- *	args->eh (in)	Mac header if present, NULL for layer3 packet.
- *	args->L3offset	Number of bytes bypassed if we came from L2.
- *			e.g. often sizeof(eh)  ** NOTYET **
- *	args->oif	Outgoing interface, NULL if packet is incoming.
- *		The incoming interface is in the mbuf. (in)
- *	args->divert_rule (in/out)
- *		Skip up to the first rule past this rule number;
- *		upon return, non-zero port number for divert or tee.
- *
- *	args->rule	Pointer to the last matching rule (in/out)
- *	args->next_hop	Socket we are forwarding to (out).
- *	args->next_hop6	IPv6 next hop we are forwarding to (out).
- *	args->f_id	Addresses grabbed from the packet (out)
- * 	args->rule.info	a cookie depending on rule action
- *
- * Return value:
- *
- *	IP_FW_PASS	the packet must be accepted
- *	IP_FW_DENY	the packet must be dropped
- *	IP_FW_DIVERT	divert packet, port in m_tag
- *	IP_FW_TEE	tee packet, port in m_tag
- *	IP_FW_DUMMYNET	to dummynet, pipe in args->cookie
- *	IP_FW_NETGRAPH	into netgraph, cookie args->cookie
- *		args->rule contains the matching rule,
- *		args->rule.info has additional information.
- *
- */
-int
-ipfw_chk(struct ip_fw_args *args)
-{
-
-	/*
-	 * Local variables holding state while processing a packet:
-	 *
-	 * IMPORTANT NOTE: to speed up the processing of rules, there
-	 * are some assumption on the values of the variables, which
-	 * are documented here. Should you change them, please check
-	 * the implementation of the various instructions to make sure
-	 * that they still work.
-	 *
-	 * args->eh	The MAC header. It is non-null for a layer2
-	 *	packet, it is NULL for a layer-3 packet.
-	 * **notyet**
-	 * args->L3offset Offset in the packet to the L3 (IP or equiv.) header.
-	 *
-	 * m | args->m	Pointer to the mbuf, as received from the caller.
-	 *	It may change if ipfw_chk() does an m_pullup, or if it
-	 *	consumes the packet because it calls send_reject().
-	 *	XXX This has to change, so that ipfw_chk() never modifies
-	 *	or consumes the buffer.
-	 * ip	is the beginning of the ip(4 or 6) header.
-	 *	Calculated by adding the L3offset to the start of data.
-	 *	(Until we start using L3offset, the packet is
-	 *	supposed to start with the ip header).
-	 */
-	struct mbuf *m = args->m;
-	struct ip *ip = mtod(m, struct ip *);
-
-	/*
-	 * For rules which contain uid/gid or jail constraints, cache
-	 * a copy of the users credentials after the pcb lookup has been
-	 * executed. This will speed up the processing of rules with
-	 * these types of constraints, as well as decrease contention
-	 * on pcb related locks.
-	 */
-#ifndef __FreeBSD__
-	struct bsd_ucred ucred_cache;
-#else
-	struct ucred *ucred_cache = NULL;
-#endif
-	int ucred_lookup = 0;
-
-	/*
-	 * oif | args->oif	If NULL, ipfw_chk has been called on the
-	 *	inbound path (ether_input, ip_input).
-	 *	If non-NULL, ipfw_chk has been called on the outbound path
-	 *	(ether_output, ip_output).
-	 */
-	struct ifnet *oif = args->oif;
-
-	int f_pos = 0;		/* index of current rule in the array */
-	int retval = 0;
-
-	/*
-	 * hlen	The length of the IP header.
-	 */
-	u_int hlen = 0;		/* hlen >0 means we have an IP pkt */
-
-	/*
-	 * offset	The offset of a fragment. offset != 0 means that
-	 *	we have a fragment at this offset of an IPv4 packet.
-	 *	offset == 0 means that (if this is an IPv4 packet)
-	 *	this is the first or only fragment.
-	 *	For IPv6 offset|ip6f_mf == 0 means there is no Fragment Header
-	 *	or there is a single packet fragement (fragement header added
-	 *	without needed).  We will treat a single packet fragment as if
-	 *	there was no fragment header (or log/block depending on the
-	 *	V_fw_permit_single_frag6 sysctl setting).
-	 */
-	u_short offset = 0;
-	u_short ip6f_mf = 0;
-
-	/*
-	 * Local copies of addresses. They are only valid if we have
-	 * an IP packet.
-	 *
-	 * proto	The protocol. Set to 0 for non-ip packets,
-	 *	or to the protocol read from the packet otherwise.
-	 *	proto != 0 means that we have an IPv4 packet.
-	 *
-	 * src_port, dst_port	port numbers, in HOST format. Only
-	 *	valid for TCP and UDP packets.
-	 *
-	 * src_ip, dst_ip	ip addresses, in NETWORK format.
-	 *	Only valid for IPv4 packets.
-	 */
-	uint8_t proto;
-	uint16_t src_port = 0, dst_port = 0;	/* NOTE: host format	*/
-	struct in_addr src_ip, dst_ip;		/* NOTE: network format	*/
-	uint16_t iplen=0;
-	int pktlen;
-	uint16_t	etype = 0;	/* Host order stored ether type */
-
-	/*
-	 * dyn_dir = MATCH_UNKNOWN when rules unchecked,
-	 * 	MATCH_NONE when checked and not matched (q = NULL),
-	 *	MATCH_FORWARD or MATCH_REVERSE otherwise (q != NULL)
-	 */
-	int dyn_dir = MATCH_UNKNOWN;
-	ipfw_dyn_rule *q = NULL;
-	struct ip_fw_chain *chain = &V_layer3_chain;
-
-	/*
-	 * We store in ulp a pointer to the upper layer protocol header.
-	 * In the ipv4 case this is easy to determine from the header,
-	 * but for ipv6 we might have some additional headers in the middle.
-	 * ulp is NULL if not found.
-	 */
-	void *ulp = NULL;		/* upper layer protocol pointer. */
-
-	/* XXX ipv6 variables */
-	int is_ipv6 = 0;
-	uint8_t	icmp6_type = 0;
-	uint16_t ext_hd = 0;	/* bits vector for extension header filtering */
-	/* end of ipv6 variables */
-
-	int is_ipv4 = 0;
-
-	int done = 0;		/* flag to exit the outer loop */
-
-	if (m->m_flags & M_SKIP_FIREWALL || (! V_ipfw_vnet_ready))
-		return (IP_FW_PASS);	/* accept */
-
-	dst_ip.s_addr = 0;		/* make sure it is initialized */
-	src_ip.s_addr = 0;		/* make sure it is initialized */
-	pktlen = m->m_pkthdr.len;
-	args->f_id.fib = M_GETFIB(m); /* note mbuf not altered) */
-	proto = args->f_id.proto = 0;	/* mark f_id invalid */
-		/* XXX 0 is a valid proto: IP/IPv6 Hop-by-Hop Option */
-
-/*
- * PULLUP_TO(len, p, T) makes sure that len + sizeof(T) is contiguous,
- * then it sets p to point at the offset "len" in the mbuf. WARNING: the
- * pointer might become stale after other pullups (but we never use it
- * this way).
- */
-#define PULLUP_TO(_len, p, T)	PULLUP_LEN(_len, p, sizeof(T))
-#define PULLUP_LEN(_len, p, T)					\
-do {								\
-	int x = (_len) + T;					\
-	if ((m)->m_len < x) {					\
-		args->m = m = m_pullup(m, x);			\
-		if (m == NULL)					\
-			goto pullup_failed;			\
-	}							\
-	p = (mtod(m, char *) + (_len));				\
-} while (0)
-
-	/*
-	 * if we have an ether header,
-	 */
-	if (args->eh)
-		etype = ntohs(args->eh->ether_type);
-
-	/* Identify IP packets and fill up variables. */
-	if (pktlen >= sizeof(struct ip6_hdr) &&
-	    (args->eh == NULL || etype == ETHERTYPE_IPV6) && ip->ip_v == 6) {
-		struct ip6_hdr *ip6 = (struct ip6_hdr *)ip;
-		is_ipv6 = 1;
-		args->f_id.addr_type = 6;
-		hlen = sizeof(struct ip6_hdr);
-		proto = ip6->ip6_nxt;
-
-		/* Search extension headers to find upper layer protocols */
-		while (ulp == NULL && offset == 0) {
-			switch (proto) {
-			case IPPROTO_ICMPV6:
-				PULLUP_TO(hlen, ulp, struct icmp6_hdr);
-				icmp6_type = ICMP6(ulp)->icmp6_type;
-				break;
-
-			case IPPROTO_TCP:
-				PULLUP_TO(hlen, ulp, struct tcphdr);
-				dst_port = TCP(ulp)->th_dport;
-				src_port = TCP(ulp)->th_sport;
-				/* save flags for dynamic rules */
-				args->f_id._flags = TCP(ulp)->th_flags;
-				break;
-
-			case IPPROTO_SCTP:
-				PULLUP_TO(hlen, ulp, struct sctphdr);
-				src_port = SCTP(ulp)->src_port;
-				dst_port = SCTP(ulp)->dest_port;
-				break;
-
-			case IPPROTO_UDP:
-				PULLUP_TO(hlen, ulp, struct udphdr);
-				dst_port = UDP(ulp)->uh_dport;
-				src_port = UDP(ulp)->uh_sport;
-				break;
-
-			case IPPROTO_HOPOPTS:	/* RFC 2460 */
-				PULLUP_TO(hlen, ulp, struct ip6_hbh);
-				ext_hd |= EXT_HOPOPTS;
-				hlen += (((struct ip6_hbh *)ulp)->ip6h_len + 1) << 3;
-				proto = ((struct ip6_hbh *)ulp)->ip6h_nxt;
-				ulp = NULL;
-				break;
-
-			case IPPROTO_ROUTING:	/* RFC 2460 */
-				PULLUP_TO(hlen, ulp, struct ip6_rthdr);
-				switch (((struct ip6_rthdr *)ulp)->ip6r_type) {
-				case 0:
-					ext_hd |= EXT_RTHDR0;
-					break;
-				case 2:
-					ext_hd |= EXT_RTHDR2;
-					break;
-				default:
-					if (V_fw_verbose)
-						printf("IPFW2: IPV6 - Unknown "
-						    "Routing Header type(%d)\n",
-						    ((struct ip6_rthdr *)
-						    ulp)->ip6r_type);
-					if (V_fw_deny_unknown_exthdrs)
-					    return (IP_FW_DENY);
-					break;
-				}
-				ext_hd |= EXT_ROUTING;
-				hlen += (((struct ip6_rthdr *)ulp)->ip6r_len + 1) << 3;
-				proto = ((struct ip6_rthdr *)ulp)->ip6r_nxt;
-				ulp = NULL;
-				break;
-
-			case IPPROTO_FRAGMENT:	/* RFC 2460 */
-				PULLUP_TO(hlen, ulp, struct ip6_frag);
-				ext_hd |= EXT_FRAGMENT;
-				hlen += sizeof (struct ip6_frag);
-				proto = ((struct ip6_frag *)ulp)->ip6f_nxt;
-				offset = ((struct ip6_frag *)ulp)->ip6f_offlg &
-					IP6F_OFF_MASK;
-				ip6f_mf = ((struct ip6_frag *)ulp)->ip6f_offlg &
-					IP6F_MORE_FRAG;
-				if (V_fw_permit_single_frag6 == 0 &&
-				    offset == 0 && ip6f_mf == 0) {
-					if (V_fw_verbose)
-						printf("IPFW2: IPV6 - Invalid "
-						    "Fragment Header\n");
-					if (V_fw_deny_unknown_exthdrs)
-					    return (IP_FW_DENY);
-					break;
-				}
-				args->f_id.extra =
-				    ntohl(((struct ip6_frag *)ulp)->ip6f_ident);
-				ulp = NULL;
-				break;
-
-			case IPPROTO_DSTOPTS:	/* RFC 2460 */
-				PULLUP_TO(hlen, ulp, struct ip6_hbh);
-				ext_hd |= EXT_DSTOPTS;
-				hlen += (((struct ip6_hbh *)ulp)->ip6h_len + 1) << 3;
-				proto = ((struct ip6_hbh *)ulp)->ip6h_nxt;
-				ulp = NULL;
-				break;
-
-			case IPPROTO_AH:	/* RFC 2402 */
-				PULLUP_TO(hlen, ulp, struct ip6_ext);
-				ext_hd |= EXT_AH;
-				hlen += (((struct ip6_ext *)ulp)->ip6e_len + 2) << 2;
-				proto = ((struct ip6_ext *)ulp)->ip6e_nxt;
-				ulp = NULL;
-				break;
-
-			case IPPROTO_ESP:	/* RFC 2406 */
-				PULLUP_TO(hlen, ulp, uint32_t);	/* SPI, Seq# */
-				/* Anything past Seq# is variable length and
-				 * data past this ext. header is encrypted. */
-				ext_hd |= EXT_ESP;
-				break;
-
-			case IPPROTO_NONE:	/* RFC 2460 */
-				/*
-				 * Packet ends here, and IPv6 header has
-				 * already been pulled up. If ip6e_len!=0
-				 * then octets must be ignored.
-				 */
-				ulp = ip; /* non-NULL to get out of loop. */
-				break;
-
-			case IPPROTO_OSPFIGP:
-				/* XXX OSPF header check? */
-				PULLUP_TO(hlen, ulp, struct ip6_ext);
-				break;
-
-			case IPPROTO_PIM:
-				/* XXX PIM header check? */
-				PULLUP_TO(hlen, ulp, struct pim);
-				break;
-
-			case IPPROTO_CARP:
-				PULLUP_TO(hlen, ulp, struct carp_header);
-				if (((struct carp_header *)ulp)->carp_version !=
-				    CARP_VERSION) 
-					return (IP_FW_DENY);
-				if (((struct carp_header *)ulp)->carp_type !=
-				    CARP_ADVERTISEMENT) 
-					return (IP_FW_DENY);
-				break;
-
-			case IPPROTO_IPV6:	/* RFC 2893 */
-				PULLUP_TO(hlen, ulp, struct ip6_hdr);
-				break;
-
-			case IPPROTO_IPV4:	/* RFC 2893 */
-				PULLUP_TO(hlen, ulp, struct ip);
-				break;
-
-			default:
-				if (V_fw_verbose)
-					printf("IPFW2: IPV6 - Unknown "
-					    "Extension Header(%d), ext_hd=%x\n",
-					     proto, ext_hd);
-				if (V_fw_deny_unknown_exthdrs)
-				    return (IP_FW_DENY);
-				PULLUP_TO(hlen, ulp, struct ip6_ext);
-				break;
-			} /*switch */
-		}
-		ip = mtod(m, struct ip *);
-		ip6 = (struct ip6_hdr *)ip;
-		args->f_id.src_ip6 = ip6->ip6_src;
-		args->f_id.dst_ip6 = ip6->ip6_dst;
-		args->f_id.src_ip = 0;
-		args->f_id.dst_ip = 0;
-		args->f_id.flow_id6 = ntohl(ip6->ip6_flow);
-	} else if (pktlen >= sizeof(struct ip) &&
-	    (args->eh == NULL || etype == ETHERTYPE_IP) && ip->ip_v == 4) {
-	    	is_ipv4 = 1;
-		hlen = ip->ip_hl << 2;
-		args->f_id.addr_type = 4;
-
-		/*
-		 * Collect parameters into local variables for faster matching.
-		 */
-		proto = ip->ip_p;
-		src_ip = ip->ip_src;
-		dst_ip = ip->ip_dst;
-		offset = ntohs(ip->ip_off) & IP_OFFMASK;
-		iplen = ntohs(ip->ip_len);
-		pktlen = iplen < pktlen ? iplen : pktlen;
-
-		if (offset == 0) {
-			switch (proto) {
-			case IPPROTO_TCP:
-				PULLUP_TO(hlen, ulp, struct tcphdr);
-				dst_port = TCP(ulp)->th_dport;
-				src_port = TCP(ulp)->th_sport;
-				/* save flags for dynamic rules */
-				args->f_id._flags = TCP(ulp)->th_flags;
-				break;
-
-			case IPPROTO_SCTP:
-				PULLUP_TO(hlen, ulp, struct sctphdr);
-				src_port = SCTP(ulp)->src_port;
-				dst_port = SCTP(ulp)->dest_port;
-				break;
-
-			case IPPROTO_UDP:
-				PULLUP_TO(hlen, ulp, struct udphdr);
-				dst_port = UDP(ulp)->uh_dport;
-				src_port = UDP(ulp)->uh_sport;
-				break;
-
-			case IPPROTO_ICMP:
-				PULLUP_TO(hlen, ulp, struct icmphdr);
-				//args->f_id.flags = ICMP(ulp)->icmp_type;
-				break;
-
-			default:
-				break;
-			}
-		}
-
-		ip = mtod(m, struct ip *);
-		args->f_id.src_ip = ntohl(src_ip.s_addr);
-		args->f_id.dst_ip = ntohl(dst_ip.s_addr);
-	}
-#undef PULLUP_TO
-	if (proto) { /* we may have port numbers, store them */
-		args->f_id.proto = proto;
-		args->f_id.src_port = src_port = ntohs(src_port);
-		args->f_id.dst_port = dst_port = ntohs(dst_port);
-	}
-
-	IPFW_RLOCK(chain);
-	if (! V_ipfw_vnet_ready) { /* shutting down, leave NOW. */
-		IPFW_RUNLOCK(chain);
-		return (IP_FW_PASS);	/* accept */
-	}
-	if (args->rule.slot) {
-		/*
-		 * Packet has already been tagged as a result of a previous
-		 * match on rule args->rule aka args->rule_id (PIPE, QUEUE,
-		 * REASS, NETGRAPH, DIVERT/TEE...)
-		 * Validate the slot and continue from the next one
-		 * if still present, otherwise do a lookup.
-		 */
-		f_pos = (args->rule.chain_id == chain->id) ?
-		    args->rule.slot :
-		    ipfw_find_rule(chain, args->rule.rulenum,
-			args->rule.rule_id);
-	} else {
-		f_pos = 0;
-	}
-
-	/*
-	 * Now scan the rules, and parse microinstructions for each rule.
-	 * We have two nested loops and an inner switch. Sometimes we
-	 * need to break out of one or both loops, or re-enter one of
-	 * the loops with updated variables. Loop variables are:
-	 *
-	 *	f_pos (outer loop) points to the current rule.
-	 *		On output it points to the matching rule.
-	 *	done (outer loop) is used as a flag to break the loop.
-	 *	l (inner loop)	residual length of current rule.
-	 *		cmd points to the current microinstruction.
-	 *
-	 * We break the inner loop by setting l=0 and possibly
-	 * cmdlen=0 if we don't want to advance cmd.
-	 * We break the outer loop by setting done=1
-	 * We can restart the inner loop by setting l>0 and f_pos, f, cmd
-	 * as needed.
-	 */
-	for (; f_pos < chain->n_rules; f_pos++) {
-		ipfw_insn *cmd;
-		uint32_t tablearg = 0;
-		int l, cmdlen, skip_or; /* skip rest of OR block */
-		struct ip_fw *f;
-
-		f = chain->map[f_pos];
-		if (V_set_disable & (1 << f->set) )
-			continue;
-
-		skip_or = 0;
-		for (l = f->cmd_len, cmd = f->cmd ; l > 0 ;
-		    l -= cmdlen, cmd += cmdlen) {
-			int match;
-
-			/*
-			 * check_body is a jump target used when we find a
-			 * CHECK_STATE, and need to jump to the body of
-			 * the target rule.
-			 */
-
-/* check_body: */
-			cmdlen = F_LEN(cmd);
-			/*
-			 * An OR block (insn_1 || .. || insn_n) has the
-			 * F_OR bit set in all but the last instruction.
-			 * The first match will set "skip_or", and cause
-			 * the following instructions to be skipped until
-			 * past the one with the F_OR bit clear.
-			 */
-			if (skip_or) {		/* skip this instruction */
-				if ((cmd->len & F_OR) == 0)
-					skip_or = 0;	/* next one is good */
-				continue;
-			}
-			match = 0; /* set to 1 if we succeed */
-
-			switch (cmd->opcode) {
-			/*
-			 * The first set of opcodes compares the packet's
-			 * fields with some pattern, setting 'match' if a
-			 * match is found. At the end of the loop there is
-			 * logic to deal with F_NOT and F_OR flags associated
-			 * with the opcode.
-			 */
-			case O_NOP:
-				match = 1;
-				break;
-
-			case O_FORWARD_MAC:
-				printf("ipfw: opcode %d unimplemented\n",
-				    cmd->opcode);
-				break;
-
-			case O_GID:
-			case O_UID:
-			case O_JAIL:
-				/*
-				 * We only check offset == 0 && proto != 0,
-				 * as this ensures that we have a
-				 * packet with the ports info.
-				 */
-				if (offset != 0)
-					break;
-				if (proto == IPPROTO_TCP ||
-				    proto == IPPROTO_UDP)
-					match = check_uidgid(
-						    (ipfw_insn_u32 *)cmd,
-						    args, &ucred_lookup,
-#ifdef __FreeBSD__
-						    &ucred_cache);
-#else
-						    (void *)&ucred_cache);
-#endif
-				break;
-
-			case O_RECV:
-				match = iface_match(m->m_pkthdr.rcvif,
-				    (ipfw_insn_if *)cmd, chain, &tablearg);
-				break;
-
-			case O_XMIT:
-				match = iface_match(oif, (ipfw_insn_if *)cmd,
-				    chain, &tablearg);
-				break;
-
-			case O_VIA:
-				match = iface_match(oif ? oif :
-				    m->m_pkthdr.rcvif, (ipfw_insn_if *)cmd,
-				    chain, &tablearg);
-				break;
-
-			case O_MACADDR2:
-				if (args->eh != NULL) {	/* have MAC header */
-					u_int32_t *want = (u_int32_t *)
-						((ipfw_insn_mac *)cmd)->addr;
-					u_int32_t *mask = (u_int32_t *)
-						((ipfw_insn_mac *)cmd)->mask;
-					u_int32_t *hdr = (u_int32_t *)args->eh;
-
-					match =
-					    ( want[0] == (hdr[0] & mask[0]) &&
-					      want[1] == (hdr[1] & mask[1]) &&
-					      want[2] == (hdr[2] & mask[2]) );
-				}
-				break;
-
-			case O_MAC_TYPE:
-				if (args->eh != NULL) {
-					u_int16_t *p =
-					    ((ipfw_insn_u16 *)cmd)->ports;
-					int i;
-
-					for (i = cmdlen - 1; !match && i>0;
-					    i--, p += 2)
-						match = (etype >= p[0] &&
-						    etype <= p[1]);
-				}
-				break;
-
-			case O_FRAG:
-				match = (offset != 0);
-				break;
-
-			case O_IN:	/* "out" is "not in" */
-				match = (oif == NULL);
-				break;
-
-			case O_LAYER2:
-				match = (args->eh != NULL);
-				break;
-
-			case O_DIVERTED:
-			    {
-				/* For diverted packets, args->rule.info
-				 * contains the divert port (in host format)
-				 * reason and direction.
-				 */
-				uint32_t i = args->rule.info;
-				match = (i&IPFW_IS_MASK) == IPFW_IS_DIVERT &&
-				    cmd->arg1 & ((i & IPFW_INFO_IN) ? 1 : 2);
-			    }
-				break;
-
-			case O_PROTO:
-				/*
-				 * We do not allow an arg of 0 so the
-				 * check of "proto" only suffices.
-				 */
-				match = (proto == cmd->arg1);
-				break;
-
-			case O_IP_SRC:
-				match = is_ipv4 &&
-				    (((ipfw_insn_ip *)cmd)->addr.s_addr ==
-				    src_ip.s_addr);
-				break;
-
-			case O_IP_SRC_LOOKUP:
-			case O_IP_DST_LOOKUP:
-				if (is_ipv4) {
-				    uint32_t key =
-					(cmd->opcode == O_IP_DST_LOOKUP) ?
-					    dst_ip.s_addr : src_ip.s_addr;
-				    uint32_t v = 0;
-
-				    if (cmdlen > F_INSN_SIZE(ipfw_insn_u32)) {
-					/* generic lookup. The key must be
-					 * in 32bit big-endian format.
-					 */
-					v = ((ipfw_insn_u32 *)cmd)->d[1];
-					if (v == 0)
-					    key = dst_ip.s_addr;
-					else if (v == 1)
-					    key = src_ip.s_addr;
-					else if (v == 6) /* dscp */
-					    key = (ip->ip_tos >> 2) & 0x3f;
-					else if (offset != 0)
-					    break;
-					else if (proto != IPPROTO_TCP &&
-						proto != IPPROTO_UDP)
-					    break;
-					else if (v == 2)
-					    key = htonl(dst_port);
-					else if (v == 3)
-					    key = htonl(src_port);
-					else if (v == 4 || v == 5) {
-					    check_uidgid(
-						(ipfw_insn_u32 *)cmd,
-						args, &ucred_lookup,
-#ifdef __FreeBSD__
-						&ucred_cache);
-					    if (v == 4 /* O_UID */)
-						key = ucred_cache->cr_uid;
-					    else if (v == 5 /* O_JAIL */)
-						key = ucred_cache->cr_prison->pr_id;
-#else /* !__FreeBSD__ */
-						(void *)&ucred_cache);
-					    if (v ==4 /* O_UID */)
-						key = ucred_cache.uid;
-					    else if (v == 5 /* O_JAIL */)
-						key = ucred_cache.xid;
-#endif /* !__FreeBSD__ */
-					    key = htonl(key);
-					} else
-					    break;
-				    }
-				    match = ipfw_lookup_table(chain,
-					cmd->arg1, key, &v);
-				    if (!match)
-					break;
-				    if (cmdlen == F_INSN_SIZE(ipfw_insn_u32))
-					match =
-					    ((ipfw_insn_u32 *)cmd)->d[0] == v;
-				    else
-					tablearg = v;
-				} else if (is_ipv6) {
-					uint32_t v = 0;
-					void *pkey = (cmd->opcode == O_IP_DST_LOOKUP) ?
-						&args->f_id.dst_ip6: &args->f_id.src_ip6;
-					match = ipfw_lookup_table_extended(chain,
-							cmd->arg1, pkey, &v,
-							IPFW_TABLE_CIDR);
-					if (cmdlen == F_INSN_SIZE(ipfw_insn_u32))
-						match = ((ipfw_insn_u32 *)cmd)->d[0] == v;
-					if (match)
-						tablearg = v;
-				}
-				break;
-
-			case O_IP_SRC_MASK:
-			case O_IP_DST_MASK:
-				if (is_ipv4) {
-				    uint32_t a =
-					(cmd->opcode == O_IP_DST_MASK) ?
-					    dst_ip.s_addr : src_ip.s_addr;
-				    uint32_t *p = ((ipfw_insn_u32 *)cmd)->d;
-				    int i = cmdlen-1;
-
-				    for (; !match && i>0; i-= 2, p+= 2)
-					match = (p[0] == (a & p[1]));
-				}
-				break;
-
-			case O_IP_SRC_ME:
-				if (is_ipv4) {
-					struct ifnet *tif;
-
-					INADDR_TO_IFP(src_ip, tif);
-					match = (tif != NULL);
-					break;
-				}
-#ifdef INET6
-				/* FALLTHROUGH */
-			case O_IP6_SRC_ME:
-				match= is_ipv6 && search_ip6_addr_net(&args->f_id.src_ip6);
-#endif
-				break;
-
-			case O_IP_DST_SET:
-			case O_IP_SRC_SET:
-				if (is_ipv4) {
-					u_int32_t *d = (u_int32_t *)(cmd+1);
-					u_int32_t addr =
-					    cmd->opcode == O_IP_DST_SET ?
-						args->f_id.dst_ip :
-						args->f_id.src_ip;
-
-					    if (addr < d[0])
-						    break;
-					    addr -= d[0]; /* subtract base */
-					    match = (addr < cmd->arg1) &&
-						( d[ 1 + (addr>>5)] &
-						  (1<<(addr & 0x1f)) );
-				}
-				break;
-
-			case O_IP_DST:
-				match = is_ipv4 &&
-				    (((ipfw_insn_ip *)cmd)->addr.s_addr ==
-				    dst_ip.s_addr);
-				break;
-
-			case O_IP_DST_ME:
-				if (is_ipv4) {
-					struct ifnet *tif;
-
-					INADDR_TO_IFP(dst_ip, tif);
-					match = (tif != NULL);
-					break;
-				}
-#ifdef INET6
-				/* FALLTHROUGH */
-			case O_IP6_DST_ME:
-				match= is_ipv6 && search_ip6_addr_net(&args->f_id.dst_ip6);
-#endif
-				break;
-
-
-			case O_IP_SRCPORT:
-			case O_IP_DSTPORT:
-				/*
-				 * offset == 0 && proto != 0 is enough
-				 * to guarantee that we have a
-				 * packet with port info.
-				 */
-				if ((proto==IPPROTO_UDP || proto==IPPROTO_TCP)
-				    && offset == 0) {
-					u_int16_t x =
-					    (cmd->opcode == O_IP_SRCPORT) ?
-						src_port : dst_port ;
-					u_int16_t *p =
-					    ((ipfw_insn_u16 *)cmd)->ports;
-					int i;
-
-					for (i = cmdlen - 1; !match && i>0;
-					    i--, p += 2)
-						match = (x>=p[0] && x<=p[1]);
-				}
-				break;
-
-			case O_ICMPTYPE:
-				match = (offset == 0 && proto==IPPROTO_ICMP &&
-				    icmptype_match(ICMP(ulp), (ipfw_insn_u32 *)cmd) );
-				break;
-
-#ifdef INET6
-			case O_ICMP6TYPE:
-				match = is_ipv6 && offset == 0 &&
-				    proto==IPPROTO_ICMPV6 &&
-				    icmp6type_match(
-					ICMP6(ulp)->icmp6_type,
-					(ipfw_insn_u32 *)cmd);
-				break;
-#endif /* INET6 */
-
-			case O_IPOPT:
-				match = (is_ipv4 &&
-				    ipopts_match(ip, cmd) );
-				break;
-
-			case O_IPVER:
-				match = (is_ipv4 &&
-				    cmd->arg1 == ip->ip_v);
-				break;
-
-			case O_IPID:
-			case O_IPLEN:
-			case O_IPTTL:
-				if (is_ipv4) {	/* only for IP packets */
-				    uint16_t x;
-				    uint16_t *p;
-				    int i;
-
-				    if (cmd->opcode == O_IPLEN)
-					x = iplen;
-				    else if (cmd->opcode == O_IPTTL)
-					x = ip->ip_ttl;
-				    else /* must be IPID */
-					x = ntohs(ip->ip_id);
-				    if (cmdlen == 1) {
-					match = (cmd->arg1 == x);
-					break;
-				    }
-				    /* otherwise we have ranges */
-				    p = ((ipfw_insn_u16 *)cmd)->ports;
-				    i = cmdlen - 1;
-				    for (; !match && i>0; i--, p += 2)
-					match = (x >= p[0] && x <= p[1]);
-				}
-				break;
-
-			case O_IPPRECEDENCE:
-				match = (is_ipv4 &&
-				    (cmd->arg1 == (ip->ip_tos & 0xe0)) );
-				break;
-
-			case O_IPTOS:
-				match = (is_ipv4 &&
-				    flags_match(cmd, ip->ip_tos));
-				break;
-
-			case O_TCPDATALEN:
-				if (proto == IPPROTO_TCP && offset == 0) {
-				    struct tcphdr *tcp;
-				    uint16_t x;
-				    uint16_t *p;
-				    int i;
-
-				    tcp = TCP(ulp);
-				    x = iplen -
-					((ip->ip_hl + tcp->th_off) << 2);
-				    if (cmdlen == 1) {
-					match = (cmd->arg1 == x);
-					break;
-				    }
-				    /* otherwise we have ranges */
-				    p = ((ipfw_insn_u16 *)cmd)->ports;
-				    i = cmdlen - 1;
-				    for (; !match && i>0; i--, p += 2)
-					match = (x >= p[0] && x <= p[1]);
-				}
-				break;
-
-			case O_TCPFLAGS:
-				match = (proto == IPPROTO_TCP && offset == 0 &&
-				    flags_match(cmd, TCP(ulp)->th_flags));
-				break;
-
-			case O_TCPOPTS:
-				PULLUP_LEN(hlen, ulp, (TCP(ulp)->th_off << 2));
-				match = (proto == IPPROTO_TCP && offset == 0 &&
-				    tcpopts_match(TCP(ulp), cmd));
-				break;
-
-			case O_TCPSEQ:
-				match = (proto == IPPROTO_TCP && offset == 0 &&
-				    ((ipfw_insn_u32 *)cmd)->d[0] ==
-					TCP(ulp)->th_seq);
-				break;
-
-			case O_TCPACK:
-				match = (proto == IPPROTO_TCP && offset == 0 &&
-				    ((ipfw_insn_u32 *)cmd)->d[0] ==
-					TCP(ulp)->th_ack);
-				break;
-
-			case O_TCPWIN:
-				if (proto == IPPROTO_TCP && offset == 0) {
-				    uint16_t x;
-				    uint16_t *p;
-				    int i;
-
-				    x = ntohs(TCP(ulp)->th_win);
-				    if (cmdlen == 1) {
-					match = (cmd->arg1 == x);
-					break;
-				    }
-				    /* Otherwise we have ranges. */
-				    p = ((ipfw_insn_u16 *)cmd)->ports;
-				    i = cmdlen - 1;
-				    for (; !match && i > 0; i--, p += 2)
-					match = (x >= p[0] && x <= p[1]);
-				}
-				break;
-
-			case O_ESTAB:
-				/* reject packets which have SYN only */
-				/* XXX should i also check for TH_ACK ? */
-				match = (proto == IPPROTO_TCP && offset == 0 &&
-				    (TCP(ulp)->th_flags &
-				     (TH_RST | TH_ACK | TH_SYN)) != TH_SYN);
-				break;
-
-			case O_ALTQ: {
-				struct pf_mtag *at;
-				ipfw_insn_altq *altq = (ipfw_insn_altq *)cmd;
-
-				match = 1;
-				at = pf_find_mtag(m);
-				if (at != NULL && at->qid != 0)
-					break;
-				at = pf_get_mtag(m);
-				if (at == NULL) {
-					/*
-					 * Let the packet fall back to the
-					 * default ALTQ.
-					 */
-					break;
-				}
-				at->qid = altq->qid;
-				at->hdr = ip;
-				break;
-			}
-
-			case O_LOG:
-				ipfw_log(f, hlen, args, m,
-				    oif, offset | ip6f_mf, tablearg, ip);
-				match = 1;
-				break;
-
-			case O_PROB:
-				match = (random()<((ipfw_insn_u32 *)cmd)->d[0]);
-				break;
-
-			case O_VERREVPATH:
-				/* Outgoing packets automatically pass/match */
-				match = ((oif != NULL) ||
-				    (m->m_pkthdr.rcvif == NULL) ||
-				    (
-#ifdef INET6
-				    is_ipv6 ?
-					verify_path6(&(args->f_id.src_ip6),
-					    m->m_pkthdr.rcvif, args->f_id.fib) :
-#endif
-				    verify_path(src_ip, m->m_pkthdr.rcvif,
-				        args->f_id.fib)));
-				break;
-
-			case O_VERSRCREACH:
-				/* Outgoing packets automatically pass/match */
-				match = (hlen > 0 && ((oif != NULL) ||
-#ifdef INET6
-				    is_ipv6 ?
-				        verify_path6(&(args->f_id.src_ip6),
-				            NULL, args->f_id.fib) :
-#endif
-				    verify_path(src_ip, NULL, args->f_id.fib)));
-				break;
-
-			case O_ANTISPOOF:
-				/* Outgoing packets automatically pass/match */
-				if (oif == NULL && hlen > 0 &&
-				    (  (is_ipv4 && in_localaddr(src_ip))
-#ifdef INET6
-				    || (is_ipv6 &&
-				        in6_localaddr(&(args->f_id.src_ip6)))
-#endif
-				    ))
-					match =
-#ifdef INET6
-					    is_ipv6 ? verify_path6(
-					        &(args->f_id.src_ip6),
-					        m->m_pkthdr.rcvif,
-						args->f_id.fib) :
-#endif
-					    verify_path(src_ip,
-					    	m->m_pkthdr.rcvif,
-					        args->f_id.fib);
-				else
-					match = 1;
-				break;
-
-			case O_IPSEC:
-#ifdef IPSEC
-				match = (m_tag_find(m,
-				    PACKET_TAG_IPSEC_IN_DONE, NULL) != NULL);
-#endif
-				/* otherwise no match */
-				break;
-
-#ifdef INET6
-			case O_IP6_SRC:
-				match = is_ipv6 &&
-				    IN6_ARE_ADDR_EQUAL(&args->f_id.src_ip6,
-				    &((ipfw_insn_ip6 *)cmd)->addr6);
-				break;
-
-			case O_IP6_DST:
-				match = is_ipv6 &&
-				IN6_ARE_ADDR_EQUAL(&args->f_id.dst_ip6,
-				    &((ipfw_insn_ip6 *)cmd)->addr6);
-				break;
-			case O_IP6_SRC_MASK:
-			case O_IP6_DST_MASK:
-				if (is_ipv6) {
-					int i = cmdlen - 1;
-					struct in6_addr p;
-					struct in6_addr *d =
-					    &((ipfw_insn_ip6 *)cmd)->addr6;
-
-					for (; !match && i > 0; d += 2,
-					    i -= F_INSN_SIZE(struct in6_addr)
-					    * 2) {
-						p = (cmd->opcode ==
-						    O_IP6_SRC_MASK) ?
-						    args->f_id.src_ip6:
-						    args->f_id.dst_ip6;
-						APPLY_MASK(&p, &d[1]);
-						match =
-						    IN6_ARE_ADDR_EQUAL(&d[0],
-						    &p);
-					}
-				}
-				break;
-
-			case O_FLOW6ID:
-				match = is_ipv6 &&
-				    flow6id_match(args->f_id.flow_id6,
-				    (ipfw_insn_u32 *) cmd);
-				break;
-
-			case O_EXT_HDR:
-				match = is_ipv6 &&
-				    (ext_hd & ((ipfw_insn *) cmd)->arg1);
-				break;
-
-			case O_IP6:
-				match = is_ipv6;
-				break;
-#endif
-
-			case O_IP4:
-				match = is_ipv4;
-				break;
-
-			case O_TAG: {
-				struct m_tag *mtag;
-				uint32_t tag = (cmd->arg1 == IP_FW_TABLEARG) ?
-				    tablearg : cmd->arg1;
-
-				/* Packet is already tagged with this tag? */
-				mtag = m_tag_locate(m, MTAG_IPFW, tag, NULL);
-
-				/* We have `untag' action when F_NOT flag is
-				 * present. And we must remove this mtag from
-				 * mbuf and reset `match' to zero (`match' will
-				 * be inversed later).
-				 * Otherwise we should allocate new mtag and
-				 * push it into mbuf.
-				 */
-				if (cmd->len & F_NOT) { /* `untag' action */
-					if (mtag != NULL)
-						m_tag_delete(m, mtag);
-					match = 0;
-				} else {
-					if (mtag == NULL) {
-						mtag = m_tag_alloc( MTAG_IPFW,
-						    tag, 0, M_NOWAIT);
-						if (mtag != NULL)
-							m_tag_prepend(m, mtag);
-					}
-					match = 1;
-				}
-				break;
-			}
-
-			case O_FIB: /* try match the specified fib */
-				if (args->f_id.fib == cmd->arg1)
-					match = 1;
-				break;
-
-			case O_SOCKARG:	{
-				struct inpcb *inp = args->inp;
-				struct inpcbinfo *pi;
-				
-				if (is_ipv6) /* XXX can we remove this ? */
-					break;
-
-				if (proto == IPPROTO_TCP)
-					pi = &V_tcbinfo;
-				else if (proto == IPPROTO_UDP)
-					pi = &V_udbinfo;
-				else
-					break;
-
-				/*
-				 * XXXRW: so_user_cookie should almost
-				 * certainly be inp_user_cookie?
-				 */
-
-				/* For incomming packet, lookup up the 
-				inpcb using the src/dest ip/port tuple */
-				if (inp == NULL) {
-					inp = in_pcblookup(pi, 
-						src_ip, htons(src_port),
-						dst_ip, htons(dst_port),
-						INPLOOKUP_RLOCKPCB, NULL);
-					if (inp != NULL) {
-						tablearg =
-						    inp->inp_socket->so_user_cookie;
-						if (tablearg)
-							match = 1;
-						INP_RUNLOCK(inp);
-					}
-				} else {
-					if (inp->inp_socket) {
-						tablearg =
-						    inp->inp_socket->so_user_cookie;
-						if (tablearg)
-							match = 1;
-					}
-				}
-				break;
-			}
-
-			case O_TAGGED: {
-				struct m_tag *mtag;
-				uint32_t tag = (cmd->arg1 == IP_FW_TABLEARG) ?
-				    tablearg : cmd->arg1;
-
-				if (cmdlen == 1) {
-					match = m_tag_locate(m, MTAG_IPFW,
-					    tag, NULL) != NULL;
-					break;
-				}
-
-				/* we have ranges */
-				for (mtag = m_tag_first(m);
-				    mtag != NULL && !match;
-				    mtag = m_tag_next(m, mtag)) {
-					uint16_t *p;
-					int i;
-
-					if (mtag->m_tag_cookie != MTAG_IPFW)
-						continue;
-
-					p = ((ipfw_insn_u16 *)cmd)->ports;
-					i = cmdlen - 1;
-					for(; !match && i > 0; i--, p += 2)
-						match =
-						    mtag->m_tag_id >= p[0] &&
-						    mtag->m_tag_id <= p[1];
-				}
-				break;
-			}
-				
-			/*
-			 * The second set of opcodes represents 'actions',
-			 * i.e. the terminal part of a rule once the packet
-			 * matches all previous patterns.
-			 * Typically there is only one action for each rule,
-			 * and the opcode is stored at the end of the rule
-			 * (but there are exceptions -- see below).
-			 *
-			 * In general, here we set retval and terminate the
-			 * outer loop (would be a 'break 3' in some language,
-			 * but we need to set l=0, done=1)
-			 *
-			 * Exceptions:
-			 * O_COUNT and O_SKIPTO actions:
-			 *   instead of terminating, we jump to the next rule
-			 *   (setting l=0), or to the SKIPTO target (setting
-			 *   f/f_len, cmd and l as needed), respectively.
-			 *
-			 * O_TAG, O_LOG and O_ALTQ action parameters:
-			 *   perform some action and set match = 1;
-			 *
-			 * O_LIMIT and O_KEEP_STATE: these opcodes are
-			 *   not real 'actions', and are stored right
-			 *   before the 'action' part of the rule.
-			 *   These opcodes try to install an entry in the
-			 *   state tables; if successful, we continue with
-			 *   the next opcode (match=1; break;), otherwise
-			 *   the packet must be dropped (set retval,
-			 *   break loops with l=0, done=1)
-			 *
-			 * O_PROBE_STATE and O_CHECK_STATE: these opcodes
-			 *   cause a lookup of the state table, and a jump
-			 *   to the 'action' part of the parent rule
-			 *   if an entry is found, or
-			 *   (CHECK_STATE only) a jump to the next rule if
-			 *   the entry is not found.
-			 *   The result of the lookup is cached so that
-			 *   further instances of these opcodes become NOPs.
-			 *   The jump to the next rule is done by setting
-			 *   l=0, cmdlen=0.
-			 */
-			case O_LIMIT:
-			case O_KEEP_STATE:
-				if (ipfw_install_state(f,
-				    (ipfw_insn_limit *)cmd, args, tablearg)) {
-					/* error or limit violation */
-					retval = IP_FW_DENY;
-					l = 0;	/* exit inner loop */
-					done = 1; /* exit outer loop */
-				}
-				match = 1;
-				break;
-
-			case O_PROBE_STATE:
-			case O_CHECK_STATE:
-				/*
-				 * dynamic rules are checked at the first
-				 * keep-state or check-state occurrence,
-				 * with the result being stored in dyn_dir.
-				 * The compiler introduces a PROBE_STATE
-				 * instruction for us when we have a
-				 * KEEP_STATE (because PROBE_STATE needs
-				 * to be run first).
-				 */
-				if (dyn_dir == MATCH_UNKNOWN &&
-				    (q = ipfw_lookup_dyn_rule(&args->f_id,
-				     &dyn_dir, proto == IPPROTO_TCP ?
-					TCP(ulp) : NULL))
-					!= NULL) {
-					/*
-					 * Found dynamic entry, update stats
-					 * and jump to the 'action' part of
-					 * the parent rule by setting
-					 * f, cmd, l and clearing cmdlen.
-					 */
-					q->pcnt++;
-					q->bcnt += pktlen;
-					/* XXX we would like to have f_pos
-					 * readily accessible in the dynamic
-				         * rule, instead of having to
-					 * lookup q->rule.
-					 */
-					f = q->rule;
-					f_pos = ipfw_find_rule(chain,
-						f->rulenum, f->id);
-					cmd = ACTION_PTR(f);
-					l = f->cmd_len - f->act_ofs;
-					ipfw_dyn_unlock();
-					cmdlen = 0;
-					match = 1;
-					break;
-				}
-				/*
-				 * Dynamic entry not found. If CHECK_STATE,
-				 * skip to next rule, if PROBE_STATE just
-				 * ignore and continue with next opcode.
-				 */
-				if (cmd->opcode == O_CHECK_STATE)
-					l = 0;	/* exit inner loop */
-				match = 1;
-				break;
-
-			case O_ACCEPT:
-				retval = 0;	/* accept */
-				l = 0;		/* exit inner loop */
-				done = 1;	/* exit outer loop */
-				break;
-
-			case O_PIPE:
-			case O_QUEUE:
-				set_match(args, f_pos, chain);
-				args->rule.info = (cmd->arg1 == IP_FW_TABLEARG) ?
-					tablearg : cmd->arg1;
-				if (cmd->opcode == O_PIPE)
-					args->rule.info |= IPFW_IS_PIPE;
-				if (V_fw_one_pass)
-					args->rule.info |= IPFW_ONEPASS;
-				retval = IP_FW_DUMMYNET;
-				l = 0;          /* exit inner loop */
-				done = 1;       /* exit outer loop */
-				break;
-
-			case O_DIVERT:
-			case O_TEE:
-				if (args->eh) /* not on layer 2 */
-				    break;
-				/* otherwise this is terminal */
-				l = 0;		/* exit inner loop */
-				done = 1;	/* exit outer loop */
-				retval = (cmd->opcode == O_DIVERT) ?
-					IP_FW_DIVERT : IP_FW_TEE;
-				set_match(args, f_pos, chain);
-				args->rule.info = (cmd->arg1 == IP_FW_TABLEARG) ?
-				    tablearg : cmd->arg1;
-				break;
-
-			case O_COUNT:
-				f->pcnt++;	/* update stats */
-				f->bcnt += pktlen;
-				f->timestamp = time_uptime;
-				l = 0;		/* exit inner loop */
-				break;
-
-			case O_SKIPTO:
-			    f->pcnt++;	/* update stats */
-			    f->bcnt += pktlen;
-			    f->timestamp = time_uptime;
-			    /* If possible use cached f_pos (in f->next_rule),
-			     * whose version is written in f->next_rule
-			     * (horrible hacks to avoid changing the ABI).
-			     */
-			    if (cmd->arg1 != IP_FW_TABLEARG &&
-				    (uintptr_t)f->x_next == chain->id) {
-				f_pos = (uintptr_t)f->next_rule;
-			    } else {
-				int i = (cmd->arg1 == IP_FW_TABLEARG) ?
-					tablearg : cmd->arg1;
-				/* make sure we do not jump backward */
-				if (i <= f->rulenum)
-				    i = f->rulenum + 1;
-				f_pos = ipfw_find_rule(chain, i, 0);
-				/* update the cache */
-				if (cmd->arg1 != IP_FW_TABLEARG) {
-				    f->next_rule =
-					(void *)(uintptr_t)f_pos;
-				    f->x_next =
-					(void *)(uintptr_t)chain->id;
-				}
-			    }
-			    /*
-			     * Skip disabled rules, and re-enter
-			     * the inner loop with the correct
-			     * f_pos, f, l and cmd.
-			     * Also clear cmdlen and skip_or
-			     */
-			    for (; f_pos < chain->n_rules - 1 &&
-				    (V_set_disable &
-				     (1 << chain->map[f_pos]->set));
-				    f_pos++)
-				;
-			    /* Re-enter the inner loop at the skipto rule. */
-			    f = chain->map[f_pos];
-			    l = f->cmd_len;
-			    cmd = f->cmd;
-			    match = 1;
-			    cmdlen = 0;
-			    skip_or = 0;
-			    continue;
-			    break;	/* not reached */
-
-			case O_CALLRETURN: {
-				/*
-				 * Implementation of `subroutine' call/return,
-				 * in the stack carried in an mbuf tag. This
-				 * is different from `skipto' in that any call
-				 * address is possible (`skipto' must prevent
-				 * backward jumps to avoid endless loops).
-				 * We have `return' action when F_NOT flag is
-				 * present. The `m_tag_id' field is used as
-				 * stack pointer.
-				 */
-				struct m_tag *mtag;
-				uint16_t jmpto, *stack;
-
-#define	IS_CALL		((cmd->len & F_NOT) == 0)
-#define	IS_RETURN	((cmd->len & F_NOT) != 0)
-				/*
-				 * Hand-rolled version of m_tag_locate() with
-				 * wildcard `type'.
-				 * If not already tagged, allocate new tag.
-				 */
-				mtag = m_tag_first(m);
-				while (mtag != NULL) {
-					if (mtag->m_tag_cookie ==
-					    MTAG_IPFW_CALL)
-						break;
-					mtag = m_tag_next(m, mtag);
-				}
-				if (mtag == NULL && IS_CALL) {
-					mtag = m_tag_alloc(MTAG_IPFW_CALL, 0,
-					    IPFW_CALLSTACK_SIZE *
-					    sizeof(uint16_t), M_NOWAIT);
-					if (mtag != NULL)
-						m_tag_prepend(m, mtag);
-				}
-
-				/*
-				 * On error both `call' and `return' just
-				 * continue with next rule.
-				 */
-				if (IS_RETURN && (mtag == NULL ||
-				    mtag->m_tag_id == 0)) {
-					l = 0;		/* exit inner loop */
-					break;
-				}
-				if (IS_CALL && (mtag == NULL ||
-				    mtag->m_tag_id >= IPFW_CALLSTACK_SIZE)) {
-					printf("ipfw: call stack error, "
-					    "go to next rule\n");
-					l = 0;		/* exit inner loop */
-					break;
-				}
-
-				f->pcnt++;	/* update stats */
-				f->bcnt += pktlen;
-				f->timestamp = time_uptime;
-				stack = (uint16_t *)(mtag + 1);
-
-				/*
-				 * The `call' action may use cached f_pos
-				 * (in f->next_rule), whose version is written
-				 * in f->next_rule.
-				 * The `return' action, however, doesn't have
-				 * fixed jump address in cmd->arg1 and can't use
-				 * cache.
-				 */
-				if (IS_CALL) {
-					stack[mtag->m_tag_id] = f->rulenum;
-					mtag->m_tag_id++;
-					if (cmd->arg1 != IP_FW_TABLEARG &&
-					    (uintptr_t)f->x_next == chain->id) {
-						f_pos = (uintptr_t)f->next_rule;
-					} else {
-						jmpto = (cmd->arg1 ==
-						    IP_FW_TABLEARG) ? tablearg:
-						    cmd->arg1;
-						f_pos = ipfw_find_rule(chain,
-						    jmpto, 0);
-						/* update the cache */
-						if (cmd->arg1 !=
-						    IP_FW_TABLEARG) {
-							f->next_rule =
-							    (void *)(uintptr_t)
-							    f_pos;
-							f->x_next =
-							    (void *)(uintptr_t)
-							    chain->id;
-						}
-					}
-				} else {	/* `return' action */
-					mtag->m_tag_id--;
-					jmpto = stack[mtag->m_tag_id] + 1;
-					f_pos = ipfw_find_rule(chain, jmpto, 0);
-				}
-
-				/*
-				 * Skip disabled rules, and re-enter
-				 * the inner loop with the correct
-				 * f_pos, f, l and cmd.
-				 * Also clear cmdlen and skip_or
-				 */
-				for (; f_pos < chain->n_rules - 1 &&
-				    (V_set_disable &
-				    (1 << chain->map[f_pos]->set)); f_pos++)
-					;
-				/* Re-enter the inner loop at the dest rule. */
-				f = chain->map[f_pos];
-				l = f->cmd_len;
-				cmd = f->cmd;
-				cmdlen = 0;
-				skip_or = 0;
-				continue;
-				break;	/* NOTREACHED */
-			}
-#undef IS_CALL
-#undef IS_RETURN
-
-			case O_REJECT:
-				/*
-				 * Drop the packet and send a reject notice
-				 * if the packet is not ICMP (or is an ICMP
-				 * query), and it is not multicast/broadcast.
-				 */
-				if (hlen > 0 && is_ipv4 && offset == 0 &&
-				    (proto != IPPROTO_ICMP ||
-				     is_icmp_query(ICMP(ulp))) &&
-				    !(m->m_flags & (M_BCAST|M_MCAST)) &&
-				    !IN_MULTICAST(ntohl(dst_ip.s_addr))) {
-					send_reject(args, cmd->arg1, iplen, ip);
-					m = args->m;
-				}
-				/* FALLTHROUGH */
-#ifdef INET6
-			case O_UNREACH6:
-				if (hlen > 0 && is_ipv6 &&
-				    ((offset & IP6F_OFF_MASK) == 0) &&
-				    (proto != IPPROTO_ICMPV6 ||
-				     (is_icmp6_query(icmp6_type) == 1)) &&
-				    !(m->m_flags & (M_BCAST|M_MCAST)) &&
-				    !IN6_IS_ADDR_MULTICAST(&args->f_id.dst_ip6)) {
-					send_reject6(
-					    args, cmd->arg1, hlen,
-					    (struct ip6_hdr *)ip);
-					m = args->m;
-				}
-				/* FALLTHROUGH */
-#endif
-			case O_DENY:
-				retval = IP_FW_DENY;
-				l = 0;		/* exit inner loop */
-				done = 1;	/* exit outer loop */
-				break;
-
-			case O_FORWARD_IP:
-				if (args->eh)	/* not valid on layer2 pkts */
-					break;
-				if (q == NULL || q->rule != f ||
-				    dyn_dir == MATCH_FORWARD) {
-				    struct sockaddr_in *sa;
-				    sa = &(((ipfw_insn_sa *)cmd)->sa);
-				    if (sa->sin_addr.s_addr == INADDR_ANY) {
-					bcopy(sa, &args->hopstore,
-							sizeof(*sa));
-					args->hopstore.sin_addr.s_addr =
-						    htonl(tablearg);
-					args->next_hop = &args->hopstore;
-				    } else {
-					args->next_hop = sa;
-				    }
-				}
-				retval = IP_FW_PASS;
-				l = 0;          /* exit inner loop */
-				done = 1;       /* exit outer loop */
-				break;
-
-#ifdef INET6
-			case O_FORWARD_IP6:
-				if (args->eh)	/* not valid on layer2 pkts */
-					break;
-				if (q == NULL || q->rule != f ||
-				    dyn_dir == MATCH_FORWARD) {
-					struct sockaddr_in6 *sin6;
-
-					sin6 = &(((ipfw_insn_sa6 *)cmd)->sa);
-					args->next_hop6 = sin6;
-				}
-				retval = IP_FW_PASS;
-				l = 0;		/* exit inner loop */
-				done = 1;	/* exit outer loop */
-				break;
-#endif
-
-			case O_NETGRAPH:
-			case O_NGTEE:
-				set_match(args, f_pos, chain);
-				args->rule.info = (cmd->arg1 == IP_FW_TABLEARG) ?
-					tablearg : cmd->arg1;
-				if (V_fw_one_pass)
-					args->rule.info |= IPFW_ONEPASS;
-				retval = (cmd->opcode == O_NETGRAPH) ?
-				    IP_FW_NETGRAPH : IP_FW_NGTEE;
-				l = 0;          /* exit inner loop */
-				done = 1;       /* exit outer loop */
-				break;
-
-			case O_SETFIB: {
-				uint32_t fib;
-
-				f->pcnt++;	/* update stats */
-				f->bcnt += pktlen;
-				f->timestamp = time_uptime;
-				fib = (cmd->arg1 == IP_FW_TABLEARG) ? tablearg:
-				    cmd->arg1;
-				if (fib >= rt_numfibs)
-					fib = 0;
-				M_SETFIB(m, fib);
-				args->f_id.fib = fib;
-				l = 0;		/* exit inner loop */
-				break;
-		        }
-
-			case O_NAT:
- 				if (!IPFW_NAT_LOADED) {
-				    retval = IP_FW_DENY;
-				} else {
-				    struct cfg_nat *t;
-				    int nat_id;
-
-				    set_match(args, f_pos, chain);
-				    /* Check if this is 'global' nat rule */
-				    if (cmd->arg1 == 0) {
-					    retval = ipfw_nat_ptr(args, NULL, m);
-					    l = 0;
-					    done = 1;
-					    break;
-				    }
-				    t = ((ipfw_insn_nat *)cmd)->nat;
-				    if (t == NULL) {
-					nat_id = (cmd->arg1 == IP_FW_TABLEARG) ?
-						tablearg : cmd->arg1;
-					t = (*lookup_nat_ptr)(&chain->nat, nat_id);
-
-					if (t == NULL) {
-					    retval = IP_FW_DENY;
-					    l = 0;	/* exit inner loop */
-					    done = 1;	/* exit outer loop */
-					    break;
-					}
-					if (cmd->arg1 != IP_FW_TABLEARG)
-					    ((ipfw_insn_nat *)cmd)->nat = t;
-				    }
-				    retval = ipfw_nat_ptr(args, t, m);
-				}
-				l = 0;          /* exit inner loop */
-				done = 1;       /* exit outer loop */
-				break;
-
-			case O_REASS: {
-				int ip_off;
-
-				f->pcnt++;
-				f->bcnt += pktlen;
-				l = 0;	/* in any case exit inner loop */
-				ip_off = ntohs(ip->ip_off);
-
-				/* if not fragmented, go to next rule */
-				if ((ip_off & (IP_MF | IP_OFFMASK)) == 0)
-				    break;
-				/* 
-				 * ip_reass() expects len & off in host
-				 * byte order.
-				 */
-				SET_HOST_IPLEN(ip);
-
-				args->m = m = ip_reass(m);
-
-				/*
-				 * do IP header checksum fixup.
-				 */
-				if (m == NULL) { /* fragment got swallowed */
-				    retval = IP_FW_DENY;
-				} else { /* good, packet complete */
-				    int hlen;
-
-				    ip = mtod(m, struct ip *);
-				    hlen = ip->ip_hl << 2;
-				    SET_NET_IPLEN(ip);
-				    ip->ip_sum = 0;
-				    if (hlen == sizeof(struct ip))
-					ip->ip_sum = in_cksum_hdr(ip);
-				    else
-					ip->ip_sum = in_cksum(m, hlen);
-				    retval = IP_FW_REASS;
-				    set_match(args, f_pos, chain);
-				}
-				done = 1;	/* exit outer loop */
-				break;
-			}
-
-			default:
-				panic("-- unknown opcode %d\n", cmd->opcode);
-			} /* end of switch() on opcodes */
-			/*
-			 * if we get here with l=0, then match is irrelevant.
-			 */
-
-			if (cmd->len & F_NOT)
-				match = !match;
-
-			if (match) {
-				if (cmd->len & F_OR)
-					skip_or = 1;
-			} else {
-				if (!(cmd->len & F_OR)) /* not an OR block, */
-					break;		/* try next rule    */
-			}
-
-		}	/* end of inner loop, scan opcodes */
-#undef PULLUP_LEN
-
-		if (done)
-			break;
-
-/* next_rule:; */	/* try next rule		*/
-
-	}		/* end of outer for, scan rules */
-
-	if (done) {
-		struct ip_fw *rule = chain->map[f_pos];
-		/* Update statistics */
-		rule->pcnt++;
-		rule->bcnt += pktlen;
-		rule->timestamp = time_uptime;
-	} else {
-		retval = IP_FW_DENY;
-		printf("ipfw: ouch!, skip past end of rules, denying packet\n");
-	}
-	IPFW_RUNLOCK(chain);
-#ifdef __FreeBSD__
-	if (ucred_cache != NULL)
-		crfree(ucred_cache);
-#endif
-	return (retval);
-
-pullup_failed:
-	if (V_fw_verbose)
-		printf("ipfw: pullup failed\n");
-	return (IP_FW_DENY);
-}
-
-/*
- * Set maximum number of tables that can be used in given VNET ipfw instance.
- */
-#ifdef SYSCTL_NODE
-static int
-sysctl_ipfw_table_num(SYSCTL_HANDLER_ARGS)
-{
-	int error;
-	unsigned int ntables;
-
-	ntables = V_fw_tables_max;
-
-	error = sysctl_handle_int(oidp, &ntables, 0, req);
-	/* Read operation or some error */
-	if ((error != 0) || (req->newptr == NULL))
-		return (error);
-
-	return (ipfw_resize_tables(&V_layer3_chain, ntables));
-}
-#endif
-/*
- * Module and VNET glue
- */
-
-/*
- * Stuff that must be initialised only on boot or module load
- */
-static int
-ipfw_init(void)
-{
-	int error = 0;
-
-	ipfw_dyn_attach();
-	/*
- 	 * Only print out this stuff the first time around,
-	 * when called from the sysinit code.
-	 */
-	printf("ipfw2 "
-#ifdef INET6
-		"(+ipv6) "
-#endif
-		"initialized, divert %s, nat %s, "
-		"rule-based forwarding "
-#ifdef IPFIREWALL_FORWARD
-		"enabled, "
-#else
-		"disabled, "
-#endif
-		"default to %s, logging ",
-#ifdef IPDIVERT
-		"enabled",
-#else
-		"loadable",
-#endif
-#ifdef IPFIREWALL_NAT
-		"enabled",
-#else
-		"loadable",
-#endif
-		default_to_accept ? "accept" : "deny");
-
-	/*
-	 * Note: V_xxx variables can be accessed here but the vnet specific
-	 * initializer may not have been called yet for the VIMAGE case.
-	 * Tuneables will have been processed. We will print out values for
-	 * the default vnet. 
-	 * XXX This should all be rationalized AFTER 8.0
-	 */
-	if (V_fw_verbose == 0)
-		printf("disabled\n");
-	else if (V_verbose_limit == 0)
-		printf("unlimited\n");
-	else
-		printf("limited to %d packets/entry by default\n",
-		    V_verbose_limit);
-
-	/* Check user-supplied table count for validness */
-	if (default_fw_tables > IPFW_TABLES_MAX)
-	  default_fw_tables = IPFW_TABLES_MAX;
-
-	ipfw_log_bpf(1); /* init */
-	return (error);
-}
-
-/*
- * Called for the removal of the last instance only on module unload.
- */
-static void
-ipfw_destroy(void)
-{
-
-	ipfw_log_bpf(0); /* uninit */
-	ipfw_dyn_detach();
-	printf("IP firewall unloaded\n");
-}
-
-/*
- * Stuff that must be initialized for every instance
- * (including the first of course).
- */
-static int
-vnet_ipfw_init(const void *unused)
-{
-	int error;
-	struct ip_fw *rule = NULL;
-	struct ip_fw_chain *chain;
-
-	chain = &V_layer3_chain;
-
-	/* First set up some values that are compile time options */
-	V_autoinc_step = 100;	/* bounded to 1..1000 in add_rule() */
-	V_fw_deny_unknown_exthdrs = 1;
-#ifdef IPFIREWALL_VERBOSE
-	V_fw_verbose = 1;
-#endif
-#ifdef IPFIREWALL_VERBOSE_LIMIT
-	V_verbose_limit = IPFIREWALL_VERBOSE_LIMIT;
-#endif
-#ifdef IPFIREWALL_NAT
-	LIST_INIT(&chain->nat);
-#endif
-
-	/* insert the default rule and create the initial map */
-	chain->n_rules = 1;
-	chain->static_len = sizeof(struct ip_fw);
-	chain->map = malloc(sizeof(struct ip_fw *), M_IPFW, M_WAITOK | M_ZERO);
-	if (chain->map)
-		rule = malloc(chain->static_len, M_IPFW, M_WAITOK | M_ZERO);
-
-	/* Set initial number of tables */
-	V_fw_tables_max = default_fw_tables;
-	error = ipfw_init_tables(chain);
-	if (error) {
-		printf("ipfw2: setting up tables failed\n");
-		free(chain->map, M_IPFW);
-		free(rule, M_IPFW);
-		return (ENOSPC);
-	}
-
-	/* fill and insert the default rule */
-	rule->act_ofs = 0;
-	rule->rulenum = IPFW_DEFAULT_RULE;
-	rule->cmd_len = 1;
-	rule->set = RESVD_SET;
-	rule->cmd[0].len = 1;
-	rule->cmd[0].opcode = default_to_accept ? O_ACCEPT : O_DENY;
-	chain->rules = chain->default_rule = chain->map[0] = rule;
-	chain->id = rule->id = 1;
-
-	IPFW_LOCK_INIT(chain);
-	ipfw_dyn_init();
-
-	/* First set up some values that are compile time options */
-	V_ipfw_vnet_ready = 1;		/* Open for business */
-
-	/*
-	 * Hook the sockopt handler, and the layer2 (V_ip_fw_chk_ptr)
-	 * and pfil hooks for ipv4 and ipv6. Even if the latter two fail
-	 * we still keep the module alive because the sockopt and
-	 * layer2 paths are still useful.
-	 * ipfw[6]_hook return 0 on success, ENOENT on failure,
-	 * so we can ignore the exact return value and just set a flag.
-	 *
-	 * Note that V_fw[6]_enable are manipulated by a SYSCTL_PROC so
-	 * changes in the underlying (per-vnet) variables trigger
-	 * immediate hook()/unhook() calls.
-	 * In layer2 we have the same behaviour, except that V_ether_ipfw
-	 * is checked on each packet because there are no pfil hooks.
-	 */
-	V_ip_fw_ctl_ptr = ipfw_ctl;
-	V_ip_fw_chk_ptr = ipfw_chk;
-	error = ipfw_attach_hooks(1);
-	return (error);
-}
-
-/*
- * Called for the removal of each instance.
- */
-static int
-vnet_ipfw_uninit(const void *unused)
-{
-	struct ip_fw *reap, *rule;
-	struct ip_fw_chain *chain = &V_layer3_chain;
-	int i;
-
-	V_ipfw_vnet_ready = 0; /* tell new callers to go away */
-	/*
-	 * disconnect from ipv4, ipv6, layer2 and sockopt.
-	 * Then grab, release and grab again the WLOCK so we make
-	 * sure the update is propagated and nobody will be in.
-	 */
-	(void)ipfw_attach_hooks(0 /* detach */);
-	V_ip_fw_chk_ptr = NULL;
-	V_ip_fw_ctl_ptr = NULL;
-	IPFW_UH_WLOCK(chain);
-	IPFW_UH_WUNLOCK(chain);
-	IPFW_UH_WLOCK(chain);
-
-	IPFW_WLOCK(chain);
-	ipfw_dyn_uninit(0);	/* run the callout_drain */
-	IPFW_WUNLOCK(chain);
-
-	ipfw_destroy_tables(chain);
-	reap = NULL;
-	IPFW_WLOCK(chain);
-	for (i = 0; i < chain->n_rules; i++) {
-		rule = chain->map[i];
-		rule->x_next = reap;
-		reap = rule;
-	}
-	if (chain->map)
-		free(chain->map, M_IPFW);
-	IPFW_WUNLOCK(chain);
-	IPFW_UH_WUNLOCK(chain);
-	if (reap != NULL)
-		ipfw_reap_rules(reap);
-	IPFW_LOCK_DESTROY(chain);
-	ipfw_dyn_uninit(1);	/* free the remaining parts */
-	return 0;
-}
-
-/*
- * Module event handler.
- * In general we have the choice of handling most of these events by the
- * event handler or by the (VNET_)SYS(UN)INIT handlers. I have chosen to
- * use the SYSINIT handlers as they are more capable of expressing the
- * flow of control during module and vnet operations, so this is just
- * a skeleton. Note there is no SYSINIT equivalent of the module
- * SHUTDOWN handler, but we don't have anything to do in that case anyhow.
- */
-static int
-ipfw_modevent(module_t mod, int type, void *unused)
-{
-	int err = 0;
-
-	switch (type) {
-	case MOD_LOAD:
-		/* Called once at module load or
-	 	 * system boot if compiled in. */
-		break;
-	case MOD_QUIESCE:
-		/* Called before unload. May veto unloading. */
-		break;
-	case MOD_UNLOAD:
-		/* Called during unload. */
-		break;
-	case MOD_SHUTDOWN:
-		/* Called during system shutdown. */
-		break;
-	default:
-		err = EOPNOTSUPP;
-		break;
-	}
-	return err;
-}
-
-static moduledata_t ipfwmod = {
-	"ipfw",
-	ipfw_modevent,
-	0
-};
-
-/* Define startup order. */
-#define	IPFW_SI_SUB_FIREWALL	SI_SUB_PROTO_IFATTACHDOMAIN
-#define	IPFW_MODEVENT_ORDER	(SI_ORDER_ANY - 255) /* On boot slot in here. */
-#define	IPFW_MODULE_ORDER	(IPFW_MODEVENT_ORDER + 1) /* A little later. */
-#define	IPFW_VNET_ORDER		(IPFW_MODEVENT_ORDER + 2) /* Later still. */
-
-DECLARE_MODULE(ipfw, ipfwmod, IPFW_SI_SUB_FIREWALL, IPFW_MODEVENT_ORDER);
-MODULE_VERSION(ipfw, 2);
-/* should declare some dependencies here */
-
-/*
- * Starting up. Done in order after ipfwmod() has been called.
- * VNET_SYSINIT is also called for each existing vnet and each new vnet.
- */
-SYSINIT(ipfw_init, IPFW_SI_SUB_FIREWALL, IPFW_MODULE_ORDER,
-	    ipfw_init, NULL);
-VNET_SYSINIT(vnet_ipfw_init, IPFW_SI_SUB_FIREWALL, IPFW_VNET_ORDER,
-	    vnet_ipfw_init, NULL);
- 
-/*
- * Closing up shop. These are done in REVERSE ORDER, but still
- * after ipfwmod() has been called. Not called on reboot.
- * VNET_SYSUNINIT is also called for each exiting vnet as it exits.
- * or when the module is unloaded.
- */
-SYSUNINIT(ipfw_destroy, IPFW_SI_SUB_FIREWALL, IPFW_MODULE_ORDER,
-	    ipfw_destroy, NULL);
-VNET_SYSUNINIT(vnet_ipfw_uninit, IPFW_SI_SUB_FIREWALL, IPFW_VNET_ORDER,
-	    vnet_ipfw_uninit, NULL);
-/* end of file */
diff --git a/sys/netinet/ipfw/ip_fw_dynamic.c b/sys/netinet/ipfw/ip_fw_dynamic.c
deleted file mode 100644
index 7cff94fbc9aa..000000000000
--- a/sys/netinet/ipfw/ip_fw_dynamic.c
+++ /dev/null
@@ -1,1242 +0,0 @@
-/*-
- * Copyright (c) 2002 Luigi Rizzo, Universita` di Pisa
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
-
-#define        DEB(x)
-#define        DDB(x) x
-
-/*
- * Dynamic rule support for ipfw
- */
-
-#include "opt_ipfw.h"
-#include "opt_inet.h"
-#ifndef INET
-#error IPFIREWALL requires INET.
-#endif /* INET */
-#include "opt_inet6.h"
-
-#include <sys/param.h>
-#include <sys/systm.h>
-#include <sys/malloc.h>
-#include <sys/mbuf.h>
-#include <sys/kernel.h>
-#include <sys/lock.h>
-#include <sys/socket.h>
-#include <sys/sysctl.h>
-#include <sys/syslog.h>
-#include <net/ethernet.h> /* for ETHERTYPE_IP */
-#include <net/if.h>
-#include <net/vnet.h>
-
-#include <netinet/in.h>
-#include <netinet/ip.h>
-#include <netinet/ip_var.h>	/* ip_defttl */
-#include <netinet/ip_fw.h>
-#include <netinet/ipfw/ip_fw_private.h>
-#include <netinet/tcp_var.h>
-#include <netinet/udp.h>
-
-#include <netinet/ip6.h>	/* IN6_ARE_ADDR_EQUAL */
-#ifdef INET6
-#include <netinet6/in6_var.h>
-#include <netinet6/ip6_var.h>
-#endif
-
-#include <machine/in_cksum.h>	/* XXX for in_cksum */
-
-#ifdef MAC
-#include <security/mac/mac_framework.h>
-#endif
-
-/*
- * Description of dynamic rules.
- *
- * Dynamic rules are stored in lists accessed through a hash table
- * (ipfw_dyn_v) whose size is curr_dyn_buckets. This value can
- * be modified through the sysctl variable dyn_buckets which is
- * updated when the table becomes empty.
- *
- * XXX currently there is only one list, ipfw_dyn.
- *
- * When a packet is received, its address fields are first masked
- * with the mask defined for the rule, then hashed, then matched
- * against the entries in the corresponding list.
- * Dynamic rules can be used for different purposes:
- *  + stateful rules;
- *  + enforcing limits on the number of sessions;
- *  + in-kernel NAT (not implemented yet)
- *
- * The lifetime of dynamic rules is regulated by dyn_*_lifetime,
- * measured in seconds and depending on the flags.
- *
- * The total number of dynamic rules is stored in dyn_count.
- * The max number of dynamic rules is dyn_max. When we reach
- * the maximum number of rules we do not create anymore. This is
- * done to avoid consuming too much memory, but also too much
- * time when searching on each packet (ideally, we should try instead
- * to put a limit on the length of the list on each bucket...).
- *
- * Each dynamic rule holds a pointer to the parent ipfw rule so
- * we know what action to perform. Dynamic rules are removed when
- * the parent rule is deleted. XXX we should make them survive.
- *
- * There are some limitations with dynamic rules -- we do not
- * obey the 'randomized match', and we do not do multiple
- * passes through the firewall. XXX check the latter!!!
- */
-
-/*
- * Static variables followed by global ones
- */
-static VNET_DEFINE(ipfw_dyn_rule **, ipfw_dyn_v);
-static VNET_DEFINE(u_int32_t, dyn_buckets);
-static VNET_DEFINE(u_int32_t, curr_dyn_buckets);
-static VNET_DEFINE(struct callout, ipfw_timeout);
-#define	V_ipfw_dyn_v			VNET(ipfw_dyn_v)
-#define	V_dyn_buckets			VNET(dyn_buckets)
-#define	V_curr_dyn_buckets		VNET(curr_dyn_buckets)
-#define V_ipfw_timeout                  VNET(ipfw_timeout)
-
-static uma_zone_t ipfw_dyn_rule_zone;
-#ifndef __FreeBSD__
-DEFINE_SPINLOCK(ipfw_dyn_mtx);
-#else
-static struct mtx ipfw_dyn_mtx;		/* mutex guarding dynamic rules */
-#endif
-
-#define	IPFW_DYN_LOCK_INIT() \
-	mtx_init(&ipfw_dyn_mtx, "IPFW dynamic rules", NULL, MTX_DEF)
-#define	IPFW_DYN_LOCK_DESTROY()	mtx_destroy(&ipfw_dyn_mtx)
-#define	IPFW_DYN_LOCK()		mtx_lock(&ipfw_dyn_mtx)
-#define	IPFW_DYN_UNLOCK()	mtx_unlock(&ipfw_dyn_mtx)
-#define	IPFW_DYN_LOCK_ASSERT()	mtx_assert(&ipfw_dyn_mtx, MA_OWNED)
-
-void
-ipfw_dyn_unlock(void)
-{
-	IPFW_DYN_UNLOCK();
-}
-
-/*
- * Timeouts for various events in handing dynamic rules.
- */
-static VNET_DEFINE(u_int32_t, dyn_ack_lifetime);
-static VNET_DEFINE(u_int32_t, dyn_syn_lifetime);
-static VNET_DEFINE(u_int32_t, dyn_fin_lifetime);
-static VNET_DEFINE(u_int32_t, dyn_rst_lifetime);
-static VNET_DEFINE(u_int32_t, dyn_udp_lifetime);
-static VNET_DEFINE(u_int32_t, dyn_short_lifetime);
-
-#define	V_dyn_ack_lifetime		VNET(dyn_ack_lifetime)
-#define	V_dyn_syn_lifetime		VNET(dyn_syn_lifetime)
-#define	V_dyn_fin_lifetime		VNET(dyn_fin_lifetime)
-#define	V_dyn_rst_lifetime		VNET(dyn_rst_lifetime)
-#define	V_dyn_udp_lifetime		VNET(dyn_udp_lifetime)
-#define	V_dyn_short_lifetime		VNET(dyn_short_lifetime)
-
-/*
- * Keepalives are sent if dyn_keepalive is set. They are sent every
- * dyn_keepalive_period seconds, in the last dyn_keepalive_interval
- * seconds of lifetime of a rule.
- * dyn_rst_lifetime and dyn_fin_lifetime should be strictly lower
- * than dyn_keepalive_period.
- */
-
-static VNET_DEFINE(u_int32_t, dyn_keepalive_interval);
-static VNET_DEFINE(u_int32_t, dyn_keepalive_period);
-static VNET_DEFINE(u_int32_t, dyn_keepalive);
-
-#define	V_dyn_keepalive_interval	VNET(dyn_keepalive_interval)
-#define	V_dyn_keepalive_period		VNET(dyn_keepalive_period)
-#define	V_dyn_keepalive			VNET(dyn_keepalive)
-
-static VNET_DEFINE(u_int32_t, dyn_count);	/* # of dynamic rules */
-static VNET_DEFINE(u_int32_t, dyn_max);		/* max # of dynamic rules */
-
-#define	V_dyn_count			VNET(dyn_count)
-#define	V_dyn_max			VNET(dyn_max)
-
-#ifdef SYSCTL_NODE
-
-SYSBEGIN(f2)
-
-SYSCTL_DECL(_net_inet_ip_fw);
-SYSCTL_VNET_UINT(_net_inet_ip_fw, OID_AUTO, dyn_buckets,
-    CTLFLAG_RW, &VNET_NAME(dyn_buckets), 0,
-    "Number of dyn. buckets");
-SYSCTL_VNET_UINT(_net_inet_ip_fw, OID_AUTO, curr_dyn_buckets,
-    CTLFLAG_RD, &VNET_NAME(curr_dyn_buckets), 0,
-    "Current Number of dyn. buckets");
-SYSCTL_VNET_UINT(_net_inet_ip_fw, OID_AUTO, dyn_count,
-    CTLFLAG_RD, &VNET_NAME(dyn_count), 0,
-    "Number of dyn. rules");
-SYSCTL_VNET_UINT(_net_inet_ip_fw, OID_AUTO, dyn_max,
-    CTLFLAG_RW, &VNET_NAME(dyn_max), 0,
-    "Max number of dyn. rules");
-SYSCTL_VNET_UINT(_net_inet_ip_fw, OID_AUTO, dyn_ack_lifetime,
-    CTLFLAG_RW, &VNET_NAME(dyn_ack_lifetime), 0,
-    "Lifetime of dyn. rules for acks");
-SYSCTL_VNET_UINT(_net_inet_ip_fw, OID_AUTO, dyn_syn_lifetime,
-    CTLFLAG_RW, &VNET_NAME(dyn_syn_lifetime), 0,
-    "Lifetime of dyn. rules for syn");
-SYSCTL_VNET_UINT(_net_inet_ip_fw, OID_AUTO, dyn_fin_lifetime,
-    CTLFLAG_RW, &VNET_NAME(dyn_fin_lifetime), 0,
-    "Lifetime of dyn. rules for fin");
-SYSCTL_VNET_UINT(_net_inet_ip_fw, OID_AUTO, dyn_rst_lifetime,
-    CTLFLAG_RW, &VNET_NAME(dyn_rst_lifetime), 0,
-    "Lifetime of dyn. rules for rst");
-SYSCTL_VNET_UINT(_net_inet_ip_fw, OID_AUTO, dyn_udp_lifetime,
-    CTLFLAG_RW, &VNET_NAME(dyn_udp_lifetime), 0,
-    "Lifetime of dyn. rules for UDP");
-SYSCTL_VNET_UINT(_net_inet_ip_fw, OID_AUTO, dyn_short_lifetime,
-    CTLFLAG_RW, &VNET_NAME(dyn_short_lifetime), 0,
-    "Lifetime of dyn. rules for other situations");
-SYSCTL_VNET_UINT(_net_inet_ip_fw, OID_AUTO, dyn_keepalive,
-    CTLFLAG_RW, &VNET_NAME(dyn_keepalive), 0,
-    "Enable keepalives for dyn. rules");
-
-SYSEND
-
-#endif /* SYSCTL_NODE */
-
-
-static __inline int
-hash_packet6(struct ipfw_flow_id *id)
-{
-	u_int32_t i;
-	i = (id->dst_ip6.__u6_addr.__u6_addr32[2]) ^
-	    (id->dst_ip6.__u6_addr.__u6_addr32[3]) ^
-	    (id->src_ip6.__u6_addr.__u6_addr32[2]) ^
-	    (id->src_ip6.__u6_addr.__u6_addr32[3]) ^
-	    (id->dst_port) ^ (id->src_port);
-	return i;
-}
-
-/*
- * IMPORTANT: the hash function for dynamic rules must be commutative
- * in source and destination (ip,port), because rules are bidirectional
- * and we want to find both in the same bucket.
- */
-static __inline int
-hash_packet(struct ipfw_flow_id *id)
-{
-	u_int32_t i;
-
-#ifdef INET6
-	if (IS_IP6_FLOW_ID(id)) 
-		i = hash_packet6(id);
-	else
-#endif /* INET6 */
-	i = (id->dst_ip) ^ (id->src_ip) ^ (id->dst_port) ^ (id->src_port);
-	i &= (V_curr_dyn_buckets - 1);
-	return i;
-}
-
-static __inline void
-unlink_dyn_rule_print(struct ipfw_flow_id *id)
-{
-	struct in_addr da;
-#ifdef INET6
-	char src[INET6_ADDRSTRLEN], dst[INET6_ADDRSTRLEN];
-#else
-	char src[INET_ADDRSTRLEN], dst[INET_ADDRSTRLEN];
-#endif
-
-#ifdef INET6
-	if (IS_IP6_FLOW_ID(id)) {
-		ip6_sprintf(src, &id->src_ip6);
-		ip6_sprintf(dst, &id->dst_ip6);
-	} else
-#endif
-	{
-		da.s_addr = htonl(id->src_ip);
-		inet_ntoa_r(da, src);
-		da.s_addr = htonl(id->dst_ip);
-		inet_ntoa_r(da, dst);
-	}
-	printf("ipfw: unlink entry %s %d -> %s %d, %d left\n",
-	    src, id->src_port, dst, id->dst_port, V_dyn_count - 1);
-}
-
-/**
- * unlink a dynamic rule from a chain. prev is a pointer to
- * the previous one, q is a pointer to the rule to delete,
- * head is a pointer to the head of the queue.
- * Modifies q and potentially also head.
- */
-#define UNLINK_DYN_RULE(prev, head, q) {				\
-	ipfw_dyn_rule *old_q = q;					\
-									\
-	/* remove a refcount to the parent */				\
-	if (q->dyn_type == O_LIMIT)					\
-		q->parent->count--;					\
-	DEB(unlink_dyn_rule_print(&q->id);)				\
-	if (prev != NULL)						\
-		prev->next = q = q->next;				\
-	else								\
-		head = q = q->next;					\
-	V_dyn_count--;							\
-	uma_zfree(ipfw_dyn_rule_zone, old_q); }
-
-#define TIME_LEQ(a,b)       ((int)((a)-(b)) <= 0)
-
-/**
- * Remove dynamic rules pointing to "rule", or all of them if rule == NULL.
- *
- * If keep_me == NULL, rules are deleted even if not expired,
- * otherwise only expired rules are removed.
- *
- * The value of the second parameter is also used to point to identify
- * a rule we absolutely do not want to remove (e.g. because we are
- * holding a reference to it -- this is the case with O_LIMIT_PARENT
- * rules). The pointer is only used for comparison, so any non-null
- * value will do.
- */
-static void
-remove_dyn_rule(struct ip_fw *rule, ipfw_dyn_rule *keep_me)
-{
-	static u_int32_t last_remove = 0;
-
-#define FORCE (keep_me == NULL)
-
-	ipfw_dyn_rule *prev, *q;
-	int i, pass = 0, max_pass = 0;
-
-	IPFW_DYN_LOCK_ASSERT();
-
-	if (V_ipfw_dyn_v == NULL || V_dyn_count == 0)
-		return;
-	/* do not expire more than once per second, it is useless */
-	if (!FORCE && last_remove == time_uptime)
-		return;
-	last_remove = time_uptime;
-
-	/*
-	 * because O_LIMIT refer to parent rules, during the first pass only
-	 * remove child and mark any pending LIMIT_PARENT, and remove
-	 * them in a second pass.
-	 */
-next_pass:
-	for (i = 0 ; i < V_curr_dyn_buckets ; i++) {
-		for (prev=NULL, q = V_ipfw_dyn_v[i] ; q ; ) {
-			/*
-			 * Logic can become complex here, so we split tests.
-			 */
-			if (q == keep_me)
-				goto next;
-			if (rule != NULL && rule != q->rule)
-				goto next; /* not the one we are looking for */
-			if (q->dyn_type == O_LIMIT_PARENT) {
-				/*
-				 * handle parent in the second pass,
-				 * record we need one.
-				 */
-				max_pass = 1;
-				if (pass == 0)
-					goto next;
-				if (FORCE && q->count != 0 ) {
-					/* XXX should not happen! */
-					printf("ipfw: OUCH! cannot remove rule,"
-					     " count %d\n", q->count);
-				}
-			} else {
-				if (!FORCE &&
-				    !TIME_LEQ( q->expire, time_uptime ))
-					goto next;
-			}
-             if (q->dyn_type != O_LIMIT_PARENT || !q->count) {
-                     UNLINK_DYN_RULE(prev, V_ipfw_dyn_v[i], q);
-                     continue;
-             }
-next:
-			prev=q;
-			q=q->next;
-		}
-	}
-	if (pass++ < max_pass)
-		goto next_pass;
-}
-
-void
-ipfw_remove_dyn_children(struct ip_fw *rule)
-{
-	IPFW_DYN_LOCK();
-	remove_dyn_rule(rule, NULL /* force removal */);
-	IPFW_DYN_UNLOCK();
-}
-
-/*
- * Lookup a dynamic rule, locked version.
- */
-static ipfw_dyn_rule *
-lookup_dyn_rule_locked(struct ipfw_flow_id *pkt, int *match_direction,
-    struct tcphdr *tcp)
-{
-	/*
-	 * Stateful ipfw extensions.
-	 * Lookup into dynamic session queue.
-	 */
-#define MATCH_REVERSE	0
-#define MATCH_FORWARD	1
-#define MATCH_NONE	2
-#define MATCH_UNKNOWN	3
-	int i, dir = MATCH_NONE;
-	ipfw_dyn_rule *prev, *q = NULL;
-
-	IPFW_DYN_LOCK_ASSERT();
-
-	if (V_ipfw_dyn_v == NULL)
-		goto done;				/* not found */
-	i = hash_packet(pkt);
-	for (prev = NULL, q = V_ipfw_dyn_v[i]; q != NULL;) {
-		if (q->dyn_type == O_LIMIT_PARENT && q->count)
-			goto next;
-		if (TIME_LEQ(q->expire, time_uptime)) {	/* expire entry */
-			UNLINK_DYN_RULE(prev, V_ipfw_dyn_v[i], q);
-			continue;
-		}
-		if (pkt->proto != q->id.proto || q->dyn_type == O_LIMIT_PARENT)
-			goto next;
-
-		if (IS_IP6_FLOW_ID(pkt)) {
-			if (IN6_ARE_ADDR_EQUAL(&pkt->src_ip6, &q->id.src_ip6) &&
-			    IN6_ARE_ADDR_EQUAL(&pkt->dst_ip6, &q->id.dst_ip6) &&
-			    pkt->src_port == q->id.src_port &&
-			    pkt->dst_port == q->id.dst_port) {
-				dir = MATCH_FORWARD;
-				break;
-			}
-			if (IN6_ARE_ADDR_EQUAL(&pkt->src_ip6, &q->id.dst_ip6) &&
-			    IN6_ARE_ADDR_EQUAL(&pkt->dst_ip6, &q->id.src_ip6) &&
-			    pkt->src_port == q->id.dst_port &&
-			    pkt->dst_port == q->id.src_port) {
-				dir = MATCH_REVERSE;
-				break;
-			}
-		} else {
-			if (pkt->src_ip == q->id.src_ip &&
-			    pkt->dst_ip == q->id.dst_ip &&
-			    pkt->src_port == q->id.src_port &&
-			    pkt->dst_port == q->id.dst_port) {
-				dir = MATCH_FORWARD;
-				break;
-			}
-			if (pkt->src_ip == q->id.dst_ip &&
-			    pkt->dst_ip == q->id.src_ip &&
-			    pkt->src_port == q->id.dst_port &&
-			    pkt->dst_port == q->id.src_port) {
-				dir = MATCH_REVERSE;
-				break;
-			}
-		}
-next:
-		prev = q;
-		q = q->next;
-	}
-	if (q == NULL)
-		goto done;	/* q = NULL, not found */
-
-	if (prev != NULL) {	/* found and not in front */
-		prev->next = q->next;
-		q->next = V_ipfw_dyn_v[i];
-		V_ipfw_dyn_v[i] = q;
-	}
-	if (pkt->proto == IPPROTO_TCP) { /* update state according to flags */
-		uint32_t ack;
-		u_char flags = pkt->_flags & (TH_FIN | TH_SYN | TH_RST);
-
-#define BOTH_SYN	(TH_SYN | (TH_SYN << 8))
-#define BOTH_FIN	(TH_FIN | (TH_FIN << 8))
-#define	TCP_FLAGS	(TH_FLAGS | (TH_FLAGS << 8))
-#define	ACK_FWD		0x10000			/* fwd ack seen */
-#define	ACK_REV		0x20000			/* rev ack seen */
-
-		q->state |= (dir == MATCH_FORWARD) ? flags : (flags << 8);
-		switch (q->state & TCP_FLAGS) {
-		case TH_SYN:			/* opening */
-			q->expire = time_uptime + V_dyn_syn_lifetime;
-			break;
-
-		case BOTH_SYN:			/* move to established */
-		case BOTH_SYN | TH_FIN:		/* one side tries to close */
-		case BOTH_SYN | (TH_FIN << 8):
-#define _SEQ_GE(a,b) ((int)(a) - (int)(b) >= 0)
-			if (tcp == NULL)
-				break;
-
-			ack = ntohl(tcp->th_ack);
-			if (dir == MATCH_FORWARD) {
-				if (q->ack_fwd == 0 ||
-				    _SEQ_GE(ack, q->ack_fwd)) {
-					q->ack_fwd = ack;
-					q->state |= ACK_FWD;
-				}
-			} else {
-				if (q->ack_rev == 0 ||
-				    _SEQ_GE(ack, q->ack_rev)) {
-					q->ack_rev = ack;
-					q->state |= ACK_REV;
-				}
-			}
-			if ((q->state & (ACK_FWD | ACK_REV)) ==
-			    (ACK_FWD | ACK_REV)) {
-				q->expire = time_uptime + V_dyn_ack_lifetime;
-				q->state &= ~(ACK_FWD | ACK_REV);
-			}
-			break;
-
-		case BOTH_SYN | BOTH_FIN:	/* both sides closed */
-			if (V_dyn_fin_lifetime >= V_dyn_keepalive_period)
-				V_dyn_fin_lifetime = V_dyn_keepalive_period - 1;
-			q->expire = time_uptime + V_dyn_fin_lifetime;
-			break;
-
-		default:
-#if 0
-			/*
-			 * reset or some invalid combination, but can also
-			 * occur if we use keep-state the wrong way.
-			 */
-			if ( (q->state & ((TH_RST << 8)|TH_RST)) == 0)
-				printf("invalid state: 0x%x\n", q->state);
-#endif
-			if (V_dyn_rst_lifetime >= V_dyn_keepalive_period)
-				V_dyn_rst_lifetime = V_dyn_keepalive_period - 1;
-			q->expire = time_uptime + V_dyn_rst_lifetime;
-			break;
-		}
-	} else if (pkt->proto == IPPROTO_UDP) {
-		q->expire = time_uptime + V_dyn_udp_lifetime;
-	} else {
-		/* other protocols */
-		q->expire = time_uptime + V_dyn_short_lifetime;
-	}
-done:
-	if (match_direction != NULL)
-		*match_direction = dir;
-	return (q);
-}
-
-ipfw_dyn_rule *
-ipfw_lookup_dyn_rule(struct ipfw_flow_id *pkt, int *match_direction,
-    struct tcphdr *tcp)
-{
-	ipfw_dyn_rule *q;
-
-	IPFW_DYN_LOCK();
-	q = lookup_dyn_rule_locked(pkt, match_direction, tcp);
-	if (q == NULL)
-		IPFW_DYN_UNLOCK();
-	/* NB: return table locked when q is not NULL */
-	return q;
-}
-
-static void
-realloc_dynamic_table(void)
-{
-	IPFW_DYN_LOCK_ASSERT();
-
-	/*
-	 * Try reallocation, make sure we have a power of 2 and do
-	 * not allow more than 64k entries. In case of overflow,
-	 * default to 1024.
-	 */
-
-	if (V_dyn_buckets > 65536)
-		V_dyn_buckets = 1024;
-	if ((V_dyn_buckets & (V_dyn_buckets-1)) != 0) { /* not a power of 2 */
-		V_dyn_buckets = V_curr_dyn_buckets; /* reset */
-		return;
-	}
-	V_curr_dyn_buckets = V_dyn_buckets;
-	if (V_ipfw_dyn_v != NULL)
-		free(V_ipfw_dyn_v, M_IPFW);
-	for (;;) {
-		V_ipfw_dyn_v = malloc(V_curr_dyn_buckets * sizeof(ipfw_dyn_rule *),
-		       M_IPFW, M_NOWAIT | M_ZERO);
-		if (V_ipfw_dyn_v != NULL || V_curr_dyn_buckets <= 2)
-			break;
-		V_curr_dyn_buckets /= 2;
-	}
-}
-
-/**
- * Install state of type 'type' for a dynamic session.
- * The hash table contains two type of rules:
- * - regular rules (O_KEEP_STATE)
- * - rules for sessions with limited number of sess per user
- *   (O_LIMIT). When they are created, the parent is
- *   increased by 1, and decreased on delete. In this case,
- *   the third parameter is the parent rule and not the chain.
- * - "parent" rules for the above (O_LIMIT_PARENT).
- */
-static ipfw_dyn_rule *
-add_dyn_rule(struct ipfw_flow_id *id, u_int8_t dyn_type, struct ip_fw *rule)
-{
-	ipfw_dyn_rule *r;
-	int i;
-
-	IPFW_DYN_LOCK_ASSERT();
-
-	if (V_ipfw_dyn_v == NULL ||
-	    (V_dyn_count == 0 && V_dyn_buckets != V_curr_dyn_buckets)) {
-		realloc_dynamic_table();
-		if (V_ipfw_dyn_v == NULL)
-			return NULL; /* failed ! */
-	}
-	i = hash_packet(id);
-
-	r = uma_zalloc(ipfw_dyn_rule_zone, M_NOWAIT | M_ZERO);
-	if (r == NULL) {
-		printf ("ipfw: sorry cannot allocate state\n");
-		return NULL;
-	}
-
-	/* increase refcount on parent, and set pointer */
-	if (dyn_type == O_LIMIT) {
-		ipfw_dyn_rule *parent = (ipfw_dyn_rule *)rule;
-		if ( parent->dyn_type != O_LIMIT_PARENT)
-			panic("invalid parent");
-		parent->count++;
-		r->parent = parent;
-		rule = parent->rule;
-	}
-
-	r->id = *id;
-	r->expire = time_uptime + V_dyn_syn_lifetime;
-	r->rule = rule;
-	r->dyn_type = dyn_type;
-	r->pcnt = r->bcnt = 0;
-	r->count = 0;
-
-	r->bucket = i;
-	r->next = V_ipfw_dyn_v[i];
-	V_ipfw_dyn_v[i] = r;
-	V_dyn_count++;
-	DEB({
-		struct in_addr da;
-#ifdef INET6
-		char src[INET6_ADDRSTRLEN];
-		char dst[INET6_ADDRSTRLEN];
-#else
-		char src[INET_ADDRSTRLEN];
-		char dst[INET_ADDRSTRLEN];
-#endif
-
-#ifdef INET6
-		if (IS_IP6_FLOW_ID(&(r->id))) {
-			ip6_sprintf(src, &r->id.src_ip6);
-			ip6_sprintf(dst, &r->id.dst_ip6);
-		} else
-#endif
-		{
-			da.s_addr = htonl(r->id.src_ip);
-			inet_ntoa_r(da, src);
-			da.s_addr = htonl(r->id.dst_ip);
-			inet_ntoa_r(da, dst);
-		}
-		printf("ipfw: add dyn entry ty %d %s %d -> %s %d, total %d\n",
-		    dyn_type, src, r->id.src_port, dst, r->id.dst_port,
-		    V_dyn_count);
-	})
-	return r;
-}
-
-/**
- * lookup dynamic parent rule using pkt and rule as search keys.
- * If the lookup fails, then install one.
- */
-static ipfw_dyn_rule *
-lookup_dyn_parent(struct ipfw_flow_id *pkt, struct ip_fw *rule)
-{
-	ipfw_dyn_rule *q;
-	int i;
-
-	IPFW_DYN_LOCK_ASSERT();
-
-	if (V_ipfw_dyn_v) {
-		int is_v6 = IS_IP6_FLOW_ID(pkt);
-		i = hash_packet( pkt );
-		for (q = V_ipfw_dyn_v[i] ; q != NULL ; q=q->next)
-			if (q->dyn_type == O_LIMIT_PARENT &&
-			    rule== q->rule &&
-			    pkt->proto == q->id.proto &&
-			    pkt->src_port == q->id.src_port &&
-			    pkt->dst_port == q->id.dst_port &&
-			    (
-				(is_v6 &&
-				 IN6_ARE_ADDR_EQUAL(&(pkt->src_ip6),
-					&(q->id.src_ip6)) &&
-				 IN6_ARE_ADDR_EQUAL(&(pkt->dst_ip6),
-					&(q->id.dst_ip6))) ||
-				(!is_v6 &&
-				 pkt->src_ip == q->id.src_ip &&
-				 pkt->dst_ip == q->id.dst_ip)
-			    )
-			) {
-				q->expire = time_uptime + V_dyn_short_lifetime;
-				DEB(printf("ipfw: lookup_dyn_parent found 0x%p\n",q);)
-				return q;
-			}
-	}
-	return add_dyn_rule(pkt, O_LIMIT_PARENT, rule);
-}
-
-/**
- * Install dynamic state for rule type cmd->o.opcode
- *
- * Returns 1 (failure) if state is not installed because of errors or because
- * session limitations are enforced.
- */
-int
-ipfw_install_state(struct ip_fw *rule, ipfw_insn_limit *cmd,
-    struct ip_fw_args *args, uint32_t tablearg)
-{
-	static int last_log;
-	ipfw_dyn_rule *q;
-	struct in_addr da;
-#ifdef INET6
-	char src[INET6_ADDRSTRLEN + 2], dst[INET6_ADDRSTRLEN + 2];
-#else
-	char src[INET_ADDRSTRLEN], dst[INET_ADDRSTRLEN];
-#endif
-
-	src[0] = '\0';
-	dst[0] = '\0';
-
-	IPFW_DYN_LOCK();
-
-	DEB(
-#ifdef INET6
-	if (IS_IP6_FLOW_ID(&(args->f_id))) {
-		ip6_sprintf(src, &args->f_id.src_ip6);
-		ip6_sprintf(dst, &args->f_id.dst_ip6);
-	} else
-#endif
-	{
-		da.s_addr = htonl(args->f_id.src_ip);
-		inet_ntoa_r(da, src);
-		da.s_addr = htonl(args->f_id.dst_ip);
-		inet_ntoa_r(da, dst);
-	}
-	printf("ipfw: %s: type %d %s %u -> %s %u\n",
-	    __func__, cmd->o.opcode, src, args->f_id.src_port,
-	    dst, args->f_id.dst_port);
-	src[0] = '\0';
-	dst[0] = '\0';
-	)
-
-	q = lookup_dyn_rule_locked(&args->f_id, NULL, NULL);
-
-	if (q != NULL) {	/* should never occur */
-		DEB(
-		if (last_log != time_uptime) {
-			last_log = time_uptime;
-			printf("ipfw: %s: entry already present, done\n",
-			    __func__);
-		})
-		IPFW_DYN_UNLOCK();
-		return (0);
-	}
-
-	if (V_dyn_count >= V_dyn_max)
-		/* Run out of slots, try to remove any expired rule. */
-		remove_dyn_rule(NULL, (ipfw_dyn_rule *)1);
-
-	if (V_dyn_count >= V_dyn_max) {
-		if (last_log != time_uptime) {
-			last_log = time_uptime;
-			printf("ipfw: %s: Too many dynamic rules\n", __func__);
-		}
-		IPFW_DYN_UNLOCK();
-		return (1);	/* cannot install, notify caller */
-	}
-
-	switch (cmd->o.opcode) {
-	case O_KEEP_STATE:	/* bidir rule */
-		add_dyn_rule(&args->f_id, O_KEEP_STATE, rule);
-		break;
-
-	case O_LIMIT: {		/* limit number of sessions */
-		struct ipfw_flow_id id;
-		ipfw_dyn_rule *parent;
-		uint32_t conn_limit;
-		uint16_t limit_mask = cmd->limit_mask;
-
-		conn_limit = (cmd->conn_limit == IP_FW_TABLEARG) ?
-		    tablearg : cmd->conn_limit;
-		  
-		DEB(
-		if (cmd->conn_limit == IP_FW_TABLEARG)
-			printf("ipfw: %s: O_LIMIT rule, conn_limit: %u "
-			    "(tablearg)\n", __func__, conn_limit);
-		else
-			printf("ipfw: %s: O_LIMIT rule, conn_limit: %u\n",
-			    __func__, conn_limit);
-		)
-
-		id.dst_ip = id.src_ip = id.dst_port = id.src_port = 0;
-		id.proto = args->f_id.proto;
-		id.addr_type = args->f_id.addr_type;
-		id.fib = M_GETFIB(args->m);
-
-		if (IS_IP6_FLOW_ID (&(args->f_id))) {
-			if (limit_mask & DYN_SRC_ADDR)
-				id.src_ip6 = args->f_id.src_ip6;
-			if (limit_mask & DYN_DST_ADDR)
-				id.dst_ip6 = args->f_id.dst_ip6;
-		} else {
-			if (limit_mask & DYN_SRC_ADDR)
-				id.src_ip = args->f_id.src_ip;
-			if (limit_mask & DYN_DST_ADDR)
-				id.dst_ip = args->f_id.dst_ip;
-		}
-		if (limit_mask & DYN_SRC_PORT)
-			id.src_port = args->f_id.src_port;
-		if (limit_mask & DYN_DST_PORT)
-			id.dst_port = args->f_id.dst_port;
-		if ((parent = lookup_dyn_parent(&id, rule)) == NULL) {
-			printf("ipfw: %s: add parent failed\n", __func__);
-			IPFW_DYN_UNLOCK();
-			return (1);
-		}
-
-		if (parent->count >= conn_limit) {
-			/* See if we can remove some expired rule. */
-			remove_dyn_rule(rule, parent);
-			if (parent->count >= conn_limit) {
-				if (V_fw_verbose && last_log != time_uptime) {
-					last_log = time_uptime;
-#ifdef INET6
-					/*
-					 * XXX IPv6 flows are not
-					 * supported yet.
-					 */
-					if (IS_IP6_FLOW_ID(&(args->f_id))) {
-						char ip6buf[INET6_ADDRSTRLEN];
-						snprintf(src, sizeof(src),
-						    "[%s]", ip6_sprintf(ip6buf,
-							&args->f_id.src_ip6));
-						snprintf(dst, sizeof(dst),
-						    "[%s]", ip6_sprintf(ip6buf,
-							&args->f_id.dst_ip6));
-					} else
-#endif
-					{
-						da.s_addr =
-						    htonl(args->f_id.src_ip);
-						inet_ntoa_r(da, src);
-						da.s_addr =
-						    htonl(args->f_id.dst_ip);
-						inet_ntoa_r(da, dst);
-					}
-					log(LOG_SECURITY | LOG_DEBUG,
-					    "ipfw: %d %s %s:%u -> %s:%u, %s\n",
-					    parent->rule->rulenum,
-					    "drop session",
-					    src, (args->f_id.src_port),
-					    dst, (args->f_id.dst_port),
-					    "too many entries");
-				}
-				IPFW_DYN_UNLOCK();
-				return (1);
-			}
-		}
-		add_dyn_rule(&args->f_id, O_LIMIT, (struct ip_fw *)parent);
-		break;
-	}
-	default:
-		printf("ipfw: %s: unknown dynamic rule type %u\n",
-		    __func__, cmd->o.opcode);
-		IPFW_DYN_UNLOCK();
-		return (1);
-	}
-
-	/* XXX just set lifetime */
-	lookup_dyn_rule_locked(&args->f_id, NULL, NULL);
-
-	IPFW_DYN_UNLOCK();
-	return (0);
-}
-
-/*
- * Generate a TCP packet, containing either a RST or a keepalive.
- * When flags & TH_RST, we are sending a RST packet, because of a
- * "reset" action matched the packet.
- * Otherwise we are sending a keepalive, and flags & TH_
- * The 'replyto' mbuf is the mbuf being replied to, if any, and is required
- * so that MAC can label the reply appropriately.
- */
-struct mbuf *
-ipfw_send_pkt(struct mbuf *replyto, struct ipfw_flow_id *id, u_int32_t seq,
-    u_int32_t ack, int flags)
-{
-	struct mbuf *m = NULL;		/* stupid compiler */
-	int len, dir;
-	struct ip *h = NULL;		/* stupid compiler */
-#ifdef INET6
-	struct ip6_hdr *h6 = NULL;
-#endif
-	struct tcphdr *th = NULL;
-
-	MGETHDR(m, M_DONTWAIT, MT_DATA);
-	if (m == NULL)
-		return (NULL);
-
-	M_SETFIB(m, id->fib);
-#ifdef MAC
-	if (replyto != NULL)
-		mac_netinet_firewall_reply(replyto, m);
-	else
-		mac_netinet_firewall_send(m);
-#else
-	(void)replyto;		/* don't warn about unused arg */
-#endif
-
-	switch (id->addr_type) {
-	case 4:
-		len = sizeof(struct ip) + sizeof(struct tcphdr);
-		break;
-#ifdef INET6
-	case 6:
-		len = sizeof(struct ip6_hdr) + sizeof(struct tcphdr);
-		break;
-#endif
-	default:
-		/* XXX: log me?!? */
-		FREE_PKT(m);
-		return (NULL);
-	}
-	dir = ((flags & (TH_SYN | TH_RST)) == TH_SYN);
-
-	m->m_data += max_linkhdr;
-	m->m_flags |= M_SKIP_FIREWALL;
-	m->m_pkthdr.len = m->m_len = len;
-	m->m_pkthdr.rcvif = NULL;
-	bzero(m->m_data, len);
-
-	switch (id->addr_type) {
-	case 4:
-		h = mtod(m, struct ip *);
-
-		/* prepare for checksum */
-		h->ip_p = IPPROTO_TCP;
-		h->ip_len = htons(sizeof(struct tcphdr));
-		if (dir) {
-			h->ip_src.s_addr = htonl(id->src_ip);
-			h->ip_dst.s_addr = htonl(id->dst_ip);
-		} else {
-			h->ip_src.s_addr = htonl(id->dst_ip);
-			h->ip_dst.s_addr = htonl(id->src_ip);
-		}
-
-		th = (struct tcphdr *)(h + 1);
-		break;
-#ifdef INET6
-	case 6:
-		h6 = mtod(m, struct ip6_hdr *);
-
-		/* prepare for checksum */
-		h6->ip6_nxt = IPPROTO_TCP;
-		h6->ip6_plen = htons(sizeof(struct tcphdr));
-		if (dir) {
-			h6->ip6_src = id->src_ip6;
-			h6->ip6_dst = id->dst_ip6;
-		} else {
-			h6->ip6_src = id->dst_ip6;
-			h6->ip6_dst = id->src_ip6;
-		}
-
-		th = (struct tcphdr *)(h6 + 1);
-		break;
-#endif
-	}
-
-	if (dir) {
-		th->th_sport = htons(id->src_port);
-		th->th_dport = htons(id->dst_port);
-	} else {
-		th->th_sport = htons(id->dst_port);
-		th->th_dport = htons(id->src_port);
-	}
-	th->th_off = sizeof(struct tcphdr) >> 2;
-
-	if (flags & TH_RST) {
-		if (flags & TH_ACK) {
-			th->th_seq = htonl(ack);
-			th->th_flags = TH_RST;
-		} else {
-			if (flags & TH_SYN)
-				seq++;
-			th->th_ack = htonl(seq);
-			th->th_flags = TH_RST | TH_ACK;
-		}
-	} else {
-		/*
-		 * Keepalive - use caller provided sequence numbers
-		 */
-		th->th_seq = htonl(seq);
-		th->th_ack = htonl(ack);
-		th->th_flags = TH_ACK;
-	}
-
-	switch (id->addr_type) {
-	case 4:
-		th->th_sum = in_cksum(m, len);
-
-		/* finish the ip header */
-		h->ip_v = 4;
-		h->ip_hl = sizeof(*h) >> 2;
-		h->ip_tos = IPTOS_LOWDELAY;
-		h->ip_off = 0;
-		/* ip_len must be in host format for ip_output */
-		h->ip_len = len;
-		h->ip_ttl = V_ip_defttl;
-		h->ip_sum = 0;
-		break;
-#ifdef INET6
-	case 6:
-		th->th_sum = in6_cksum(m, IPPROTO_TCP, sizeof(*h6),
-		    sizeof(struct tcphdr));
-
-		/* finish the ip6 header */
-		h6->ip6_vfc |= IPV6_VERSION;
-		h6->ip6_hlim = IPV6_DEFHLIM;
-		break;
-#endif
-	}
-
-	return (m);
-}
-
-/*
- * This procedure is only used to handle keepalives. It is invoked
- * every dyn_keepalive_period
- */
-static void
-ipfw_tick(void * vnetx) 
-{
-	struct mbuf *m0, *m, *mnext, **mtailp;
-#ifdef INET6
-	struct mbuf *m6, **m6_tailp;
-#endif
-	int i;
-	ipfw_dyn_rule *q;
-#ifdef VIMAGE
-	struct vnet *vp = vnetx;
-#endif
-
-	CURVNET_SET(vp);
-	if (V_dyn_keepalive == 0 || V_ipfw_dyn_v == NULL || V_dyn_count == 0)
-		goto done;
-
-	/*
-	 * We make a chain of packets to go out here -- not deferring
-	 * until after we drop the IPFW dynamic rule lock would result
-	 * in a lock order reversal with the normal packet input -> ipfw
-	 * call stack.
-	 */
-	m0 = NULL;
-	mtailp = &m0;
-#ifdef INET6
-	m6 = NULL;
-	m6_tailp = &m6;
-#endif
-	IPFW_DYN_LOCK();
-	for (i = 0 ; i < V_curr_dyn_buckets ; i++) {
-		for (q = V_ipfw_dyn_v[i] ; q ; q = q->next ) {
-			if (q->dyn_type == O_LIMIT_PARENT)
-				continue;
-			if (q->id.proto != IPPROTO_TCP)
-				continue;
-			if ( (q->state & BOTH_SYN) != BOTH_SYN)
-				continue;
-			if (TIME_LEQ(time_uptime + V_dyn_keepalive_interval,
-			    q->expire))
-				continue;	/* too early */
-			if (TIME_LEQ(q->expire, time_uptime))
-				continue;	/* too late, rule expired */
-
-			m = (q->state & ACK_REV) ? NULL :
-			    ipfw_send_pkt(NULL, &(q->id), q->ack_rev - 1,
-			    q->ack_fwd, TH_SYN);
-			mnext = (q->state & ACK_FWD) ? NULL :
-			    ipfw_send_pkt(NULL, &(q->id), q->ack_fwd - 1,
-			    q->ack_rev, 0);
-
-			switch (q->id.addr_type) {
-			case 4:
-				if (m != NULL) {
-					*mtailp = m;
-					mtailp = &(*mtailp)->m_nextpkt;
-				}
-				if (mnext != NULL) {
-					*mtailp = mnext;
-					mtailp = &(*mtailp)->m_nextpkt;
-				}
-				break;
-#ifdef INET6
-			case 6:
-				if (m != NULL) {
-					*m6_tailp = m;
-					m6_tailp = &(*m6_tailp)->m_nextpkt;
-				}
-				if (mnext != NULL) {
-					*m6_tailp = mnext;
-					m6_tailp = &(*m6_tailp)->m_nextpkt;
-				}
-				break;
-#endif
-			}
-		}
-	}
-	IPFW_DYN_UNLOCK();
-	for (m = m0; m != NULL; m = mnext) {
-		mnext = m->m_nextpkt;
-		m->m_nextpkt = NULL;
-		ip_output(m, NULL, NULL, 0, NULL, NULL);
-	}
-#ifdef INET6
-	for (m = m6; m != NULL; m = mnext) {
-		mnext = m->m_nextpkt;
-		m->m_nextpkt = NULL;
-		ip6_output(m, NULL, NULL, 0, NULL, NULL, NULL);
-	}
-#endif
-done:
-	callout_reset_on(&V_ipfw_timeout, V_dyn_keepalive_period * hz,
-		      ipfw_tick, vnetx, 0);
-	CURVNET_RESTORE();
-}
-
-void
-ipfw_dyn_attach(void)
-{
-        ipfw_dyn_rule_zone = uma_zcreate("IPFW dynamic rule",
-            sizeof(ipfw_dyn_rule), NULL, NULL, NULL, NULL,
-            UMA_ALIGN_PTR, 0);
-
-        IPFW_DYN_LOCK_INIT();
-}
-
-void
-ipfw_dyn_detach(void)
-{
-        uma_zdestroy(ipfw_dyn_rule_zone);
-        IPFW_DYN_LOCK_DESTROY();
-}
-
-void
-ipfw_dyn_init(void)
-{
-        V_ipfw_dyn_v = NULL;
-        V_dyn_buckets = 256;    /* must be power of 2 */
-        V_curr_dyn_buckets = 256; /* must be power of 2 */
- 
-        V_dyn_ack_lifetime = 300;
-        V_dyn_syn_lifetime = 20;
-        V_dyn_fin_lifetime = 1;
-        V_dyn_rst_lifetime = 1;
-        V_dyn_udp_lifetime = 10;
-        V_dyn_short_lifetime = 5;
-
-        V_dyn_keepalive_interval = 20;
-        V_dyn_keepalive_period = 5;
-        V_dyn_keepalive = 1;    /* do send keepalives */
-        
-        V_dyn_max = 4096;       /* max # of dynamic rules */
-        callout_init(&V_ipfw_timeout, CALLOUT_MPSAFE);
-        callout_reset_on(&V_ipfw_timeout, hz, ipfw_tick, curvnet, 0);
-}
-
-void
-ipfw_dyn_uninit(int pass)
-{
-	if (pass == 0)
-		callout_drain(&V_ipfw_timeout);
-	else {
-		if (V_ipfw_dyn_v != NULL)
-			free(V_ipfw_dyn_v, M_IPFW);
-	}
-}
-
-int
-ipfw_dyn_len(void)
-{
-	return (V_ipfw_dyn_v == NULL) ? 0 :
-		(V_dyn_count * sizeof(ipfw_dyn_rule));
-}
-
-void
-ipfw_get_dynamic(char **pbp, const char *ep)
-{
-	ipfw_dyn_rule *p, *last = NULL;
-	char *bp;
-	int i;
-
-	if (V_ipfw_dyn_v == NULL)
-		return;
-	bp = *pbp;
-
-	IPFW_DYN_LOCK();
-	for (i = 0 ; i < V_curr_dyn_buckets; i++)
-		for (p = V_ipfw_dyn_v[i] ; p != NULL; p = p->next) {
-			if (bp + sizeof *p <= ep) {
-				ipfw_dyn_rule *dst =
-					(ipfw_dyn_rule *)bp;
-				bcopy(p, dst, sizeof *p);
-				bcopy(&(p->rule->rulenum), &(dst->rule),
-				    sizeof(p->rule->rulenum));
-				/*
-				 * store set number into high word of
-				 * dst->rule pointer.
-				 */
-				bcopy(&(p->rule->set),
-				    (char *)&dst->rule +
-				    sizeof(p->rule->rulenum),
-				    sizeof(p->rule->set));
-				/*
-				 * store a non-null value in "next".
-				 * The userland code will interpret a
-				 * NULL here as a marker
-				 * for the last dynamic rule.
-				 */
-				bcopy(&dst, &dst->next, sizeof(dst));
-				last = dst;
-				dst->expire =
-				    TIME_LEQ(dst->expire, time_uptime) ?
-					0 : dst->expire - time_uptime ;
-				bp += sizeof(ipfw_dyn_rule);
-			}
-		}
-	IPFW_DYN_UNLOCK();
-	if (last != NULL) /* mark last dynamic rule */
-		bzero(&last->next, sizeof(last));
-	*pbp = bp;
-}
-/* end of file */
diff --git a/sys/netinet/ipfw/ip_fw_log.c b/sys/netinet/ipfw/ip_fw_log.c
deleted file mode 100644
index b9ed6b36da15..000000000000
--- a/sys/netinet/ipfw/ip_fw_log.c
+++ /dev/null
@@ -1,469 +0,0 @@
-/*-
- * Copyright (c) 2002-2009 Luigi Rizzo, Universita` di Pisa
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
-
-/*
- * Logging support for ipfw
- */
-
-#include "opt_ipfw.h"
-#include "opt_inet.h"
-#ifndef INET
-#error IPFIREWALL requires INET.
-#endif /* INET */
-#include "opt_inet6.h"
-
-#include <sys/param.h>
-#include <sys/systm.h>
-#include <sys/mbuf.h>
-#include <sys/kernel.h>
-#include <sys/socket.h>
-#include <sys/sysctl.h>
-#include <sys/syslog.h>
-#include <net/ethernet.h> /* for ETHERTYPE_IP */
-#include <net/if.h>
-#include <net/vnet.h>
-#include <net/if_types.h>	/* for IFT_ETHER */
-#include <net/bpf.h>		/* for BPF */
-
-#include <netinet/in.h>
-#include <netinet/ip.h>
-#include <netinet/ip_icmp.h>
-#include <netinet/ip_var.h>
-#include <netinet/ip_fw.h>
-#include <netinet/ipfw/ip_fw_private.h>
-#include <netinet/tcp_var.h>
-#include <netinet/udp.h>
-
-#include <netinet/ip6.h>
-#include <netinet/icmp6.h>
-#ifdef INET6
-#include <netinet6/in6_var.h>	/* ip6_sprintf() */
-#endif
-
-#ifdef MAC
-#include <security/mac/mac_framework.h>
-#endif
-
-/*
- * L3HDR maps an ipv4 pointer into a layer3 header pointer of type T
- * Other macros just cast void * into the appropriate type
- */
-#define	L3HDR(T, ip)	((T *)((u_int32_t *)(ip) + (ip)->ip_hl))
-#define	TCP(p)		((struct tcphdr *)(p))
-#define	SCTP(p)		((struct sctphdr *)(p))
-#define	UDP(p)		((struct udphdr *)(p))
-#define	ICMP(p)		((struct icmphdr *)(p))
-#define	ICMP6(p)	((struct icmp6_hdr *)(p))
-
-#define SNPARGS(buf, len) buf + len, sizeof(buf) > len ? sizeof(buf) - len : 0
-#define SNP(buf) buf, sizeof(buf)
-
-#ifdef WITHOUT_BPF
-void
-ipfw_log_bpf(int onoff)
-{
-}
-#else /* !WITHOUT_BPF */
-static struct ifnet *log_if;	/* hook to attach to bpf */
-
-/* we use this dummy function for all ifnet callbacks */
-static int
-log_dummy(struct ifnet *ifp, u_long cmd, caddr_t addr)
-{
-	return EINVAL;
-}
-
-static int
-ipfw_log_output(struct ifnet *ifp, struct mbuf *m,
-	struct sockaddr *dst, struct route *ro)
-{
-	if (m != NULL)
-		m_freem(m);
-	return EINVAL;
-}
-
-static void
-ipfw_log_start(struct ifnet* ifp)
-{
-	panic("ipfw_log_start() must not be called");
-}
-
-static const u_char ipfwbroadcastaddr[6] =
-	{ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
-
-void
-ipfw_log_bpf(int onoff)
-{
-	struct ifnet *ifp;
-
-	if (onoff) {
-		if (log_if)
-			return;
-		ifp = if_alloc(IFT_ETHER);
-		if (ifp == NULL)
-			return;
-		if_initname(ifp, "ipfw", 0);
-		ifp->if_mtu = 65536;
-		ifp->if_flags = IFF_UP | IFF_SIMPLEX | IFF_MULTICAST;
-		ifp->if_init = (void *)log_dummy;
-		ifp->if_ioctl = log_dummy;
-		ifp->if_start = ipfw_log_start;
-		ifp->if_output = ipfw_log_output;
-		ifp->if_addrlen = 6;
-		ifp->if_hdrlen = 14;
-		if_attach(ifp);
-		ifp->if_broadcastaddr = ipfwbroadcastaddr;
-		ifp->if_baudrate = IF_Mbps(10);
-		bpfattach(ifp, DLT_EN10MB, 14);
-		log_if = ifp;
-	} else {
-		if (log_if) {
-			ether_ifdetach(log_if);
-			if_free(log_if);
-		}
-		log_if = NULL;
-	}
-}
-#endif /* !WITHOUT_BPF */
-
-/*
- * We enter here when we have a rule with O_LOG.
- * XXX this function alone takes about 2Kbytes of code!
- */
-void
-ipfw_log(struct ip_fw *f, u_int hlen, struct ip_fw_args *args,
-    struct mbuf *m, struct ifnet *oif, u_short offset, uint32_t tablearg,
-    struct ip *ip)
-{
-	char *action;
-	int limit_reached = 0;
-	char action2[92], proto[128], fragment[32];
-
-	if (V_fw_verbose == 0) {
-#ifndef WITHOUT_BPF
-
-		if (log_if == NULL || log_if->if_bpf == NULL)
-			return;
-
-		if (args->eh) /* layer2, use orig hdr */
-			BPF_MTAP2(log_if, args->eh, ETHER_HDR_LEN, m);
-		else
-			/* Add fake header. Later we will store
-			 * more info in the header.
-			 */
-			BPF_MTAP2(log_if, "DDDDDDSSSSSS\x08\x00", ETHER_HDR_LEN, m);
-#endif /* !WITHOUT_BPF */
-		return;
-	}
-	/* the old 'log' function */
-	fragment[0] = '\0';
-	proto[0] = '\0';
-
-	if (f == NULL) {	/* bogus pkt */
-		if (V_verbose_limit != 0 && V_norule_counter >= V_verbose_limit)
-			return;
-		V_norule_counter++;
-		if (V_norule_counter == V_verbose_limit)
-			limit_reached = V_verbose_limit;
-		action = "Refuse";
-	} else {	/* O_LOG is the first action, find the real one */
-		ipfw_insn *cmd = ACTION_PTR(f);
-		ipfw_insn_log *l = (ipfw_insn_log *)cmd;
-
-		if (l->max_log != 0 && l->log_left == 0)
-			return;
-		l->log_left--;
-		if (l->log_left == 0)
-			limit_reached = l->max_log;
-		cmd += F_LEN(cmd);	/* point to first action */
-		if (cmd->opcode == O_ALTQ) {
-			ipfw_insn_altq *altq = (ipfw_insn_altq *)cmd;
-
-			snprintf(SNPARGS(action2, 0), "Altq %d",
-				altq->qid);
-			cmd += F_LEN(cmd);
-		}
-		if (cmd->opcode == O_PROB)
-			cmd += F_LEN(cmd);
-
-		if (cmd->opcode == O_TAG)
-			cmd += F_LEN(cmd);
-
-		action = action2;
-		switch (cmd->opcode) {
-		case O_DENY:
-			action = "Deny";
-			break;
-
-		case O_REJECT:
-			if (cmd->arg1==ICMP_REJECT_RST)
-				action = "Reset";
-			else if (cmd->arg1==ICMP_UNREACH_HOST)
-				action = "Reject";
-			else
-				snprintf(SNPARGS(action2, 0), "Unreach %d",
-					cmd->arg1);
-			break;
-
-		case O_UNREACH6:
-			if (cmd->arg1==ICMP6_UNREACH_RST)
-				action = "Reset";
-			else
-				snprintf(SNPARGS(action2, 0), "Unreach %d",
-					cmd->arg1);
-			break;
-
-		case O_ACCEPT:
-			action = "Accept";
-			break;
-		case O_COUNT:
-			action = "Count";
-			break;
-		case O_DIVERT:
-			snprintf(SNPARGS(action2, 0), "Divert %d",
-				cmd->arg1);
-			break;
-		case O_TEE:
-			snprintf(SNPARGS(action2, 0), "Tee %d",
-				cmd->arg1);
-			break;
-		case O_SETFIB:
-			snprintf(SNPARGS(action2, 0), "SetFib %d",
-				cmd->arg1);
-			break;
-		case O_SKIPTO:
-			snprintf(SNPARGS(action2, 0), "SkipTo %d",
-				cmd->arg1);
-			break;
-		case O_PIPE:
-			snprintf(SNPARGS(action2, 0), "Pipe %d",
-				cmd->arg1);
-			break;
-		case O_QUEUE:
-			snprintf(SNPARGS(action2, 0), "Queue %d",
-				cmd->arg1);
-			break;
-		case O_FORWARD_IP: {
-			ipfw_insn_sa *sa = (ipfw_insn_sa *)cmd;
-			int len;
-			struct in_addr dummyaddr;
-			if (sa->sa.sin_addr.s_addr == INADDR_ANY)
-				dummyaddr.s_addr = htonl(tablearg);
-			else
-				dummyaddr.s_addr = sa->sa.sin_addr.s_addr;
-
-			len = snprintf(SNPARGS(action2, 0), "Forward to %s",
-				inet_ntoa(dummyaddr));
-
-			if (sa->sa.sin_port)
-				snprintf(SNPARGS(action2, len), ":%d",
-				    sa->sa.sin_port);
-			}
-			break;
-#ifdef INET6
-		case O_FORWARD_IP6: {
-			char buf[INET6_ADDRSTRLEN];
-			ipfw_insn_sa6 *sa = (ipfw_insn_sa6 *)cmd;
-			int len;
-
-			len = snprintf(SNPARGS(action2, 0), "Forward to [%s]",
-			    ip6_sprintf(buf, &sa->sa.sin6_addr));
-
-			if (sa->sa.sin6_port)
-				snprintf(SNPARGS(action2, len), ":%u",
-				    sa->sa.sin6_port);
-			}
-			break;
-#endif
-		case O_NETGRAPH:
-			snprintf(SNPARGS(action2, 0), "Netgraph %d",
-				cmd->arg1);
-			break;
-		case O_NGTEE:
-			snprintf(SNPARGS(action2, 0), "Ngtee %d",
-				cmd->arg1);
-			break;
-		case O_NAT:
-			action = "Nat";
- 			break;
-		case O_REASS:
-			action = "Reass";
-			break;
-		case O_CALLRETURN:
-			if (cmd->len & F_NOT)
-				action = "Return";
-			else
-				snprintf(SNPARGS(action2, 0), "Call %d",
-				    cmd->arg1);
-			break;
-		default:
-			action = "UNKNOWN";
-			break;
-		}
-	}
-
-	if (hlen == 0) {	/* non-ip */
-		snprintf(SNPARGS(proto, 0), "MAC");
-
-	} else {
-		int len;
-#ifdef INET6
-		char src[INET6_ADDRSTRLEN + 2], dst[INET6_ADDRSTRLEN + 2];
-#else
-		char src[INET_ADDRSTRLEN], dst[INET_ADDRSTRLEN];
-#endif
-		struct icmphdr *icmp;
-		struct tcphdr *tcp;
-		struct udphdr *udp;
-#ifdef INET6
-		struct ip6_hdr *ip6 = NULL;
-		struct icmp6_hdr *icmp6;
-		u_short ip6f_mf;
-#endif
-		src[0] = '\0';
-		dst[0] = '\0';
-#ifdef INET6
-		ip6f_mf = offset & IP6F_MORE_FRAG;
-		offset &= IP6F_OFF_MASK;
-
-		if (IS_IP6_FLOW_ID(&(args->f_id))) {
-			char ip6buf[INET6_ADDRSTRLEN];
-			snprintf(src, sizeof(src), "[%s]",
-			    ip6_sprintf(ip6buf, &args->f_id.src_ip6));
-			snprintf(dst, sizeof(dst), "[%s]",
-			    ip6_sprintf(ip6buf, &args->f_id.dst_ip6));
-
-			ip6 = (struct ip6_hdr *)ip;
-			tcp = (struct tcphdr *)(((char *)ip) + hlen);
-			udp = (struct udphdr *)(((char *)ip) + hlen);
-		} else
-#endif
-		{
-			tcp = L3HDR(struct tcphdr, ip);
-			udp = L3HDR(struct udphdr, ip);
-
-			inet_ntoa_r(ip->ip_src, src);
-			inet_ntoa_r(ip->ip_dst, dst);
-		}
-
-		switch (args->f_id.proto) {
-		case IPPROTO_TCP:
-			len = snprintf(SNPARGS(proto, 0), "TCP %s", src);
-			if (offset == 0)
-				snprintf(SNPARGS(proto, len), ":%d %s:%d",
-				    ntohs(tcp->th_sport),
-				    dst,
-				    ntohs(tcp->th_dport));
-			else
-				snprintf(SNPARGS(proto, len), " %s", dst);
-			break;
-
-		case IPPROTO_UDP:
-			len = snprintf(SNPARGS(proto, 0), "UDP %s", src);
-			if (offset == 0)
-				snprintf(SNPARGS(proto, len), ":%d %s:%d",
-				    ntohs(udp->uh_sport),
-				    dst,
-				    ntohs(udp->uh_dport));
-			else
-				snprintf(SNPARGS(proto, len), " %s", dst);
-			break;
-
-		case IPPROTO_ICMP:
-			icmp = L3HDR(struct icmphdr, ip);
-			if (offset == 0)
-				len = snprintf(SNPARGS(proto, 0),
-				    "ICMP:%u.%u ",
-				    icmp->icmp_type, icmp->icmp_code);
-			else
-				len = snprintf(SNPARGS(proto, 0), "ICMP ");
-			len += snprintf(SNPARGS(proto, len), "%s", src);
-			snprintf(SNPARGS(proto, len), " %s", dst);
-			break;
-#ifdef INET6
-		case IPPROTO_ICMPV6:
-			icmp6 = (struct icmp6_hdr *)(((char *)ip) + hlen);
-			if (offset == 0)
-				len = snprintf(SNPARGS(proto, 0),
-				    "ICMPv6:%u.%u ",
-				    icmp6->icmp6_type, icmp6->icmp6_code);
-			else
-				len = snprintf(SNPARGS(proto, 0), "ICMPv6 ");
-			len += snprintf(SNPARGS(proto, len), "%s", src);
-			snprintf(SNPARGS(proto, len), " %s", dst);
-			break;
-#endif
-		default:
-			len = snprintf(SNPARGS(proto, 0), "P:%d %s",
-			    args->f_id.proto, src);
-			snprintf(SNPARGS(proto, len), " %s", dst);
-			break;
-		}
-
-#ifdef INET6
-		if (IS_IP6_FLOW_ID(&(args->f_id))) {
-			if (offset & (IP6F_OFF_MASK | IP6F_MORE_FRAG))
-				snprintf(SNPARGS(fragment, 0),
-				    " (frag %08x:%d@%d%s)",
-				    args->f_id.extra,
-				    ntohs(ip6->ip6_plen) - hlen,
-				    ntohs(offset) << 3, ip6f_mf ? "+" : "");
-		} else
-#endif
-		{
-			int ipoff, iplen;
-			ipoff = ntohs(ip->ip_off);
-			iplen = ntohs(ip->ip_len);
-			if (ipoff & (IP_MF | IP_OFFMASK))
-				snprintf(SNPARGS(fragment, 0),
-				    " (frag %d:%d@%d%s)",
-				    ntohs(ip->ip_id), iplen - (ip->ip_hl << 2),
-				    offset << 3,
-				    (ipoff & IP_MF) ? "+" : "");
-		}
-	}
-#ifdef __FreeBSD__
-	if (oif || m->m_pkthdr.rcvif)
-		log(LOG_SECURITY | LOG_INFO,
-		    "ipfw: %d %s %s %s via %s%s\n",
-		    f ? f->rulenum : -1,
-		    action, proto, oif ? "out" : "in",
-		    oif ? oif->if_xname : m->m_pkthdr.rcvif->if_xname,
-		    fragment);
-	else
-#endif
-		log(LOG_SECURITY | LOG_INFO,
-		    "ipfw: %d %s %s [no if info]%s\n",
-		    f ? f->rulenum : -1,
-		    action, proto, fragment);
-	if (limit_reached)
-		log(LOG_SECURITY | LOG_NOTICE,
-		    "ipfw: limit %d reached on entry %d\n",
-		    limit_reached, f ? f->rulenum : -1);
-}
-/* end of file */
diff --git a/sys/netinet/ipfw/ip_fw_nat.c b/sys/netinet/ipfw/ip_fw_nat.c
deleted file mode 100644
index dbeb254cbe7b..000000000000
--- a/sys/netinet/ipfw/ip_fw_nat.c
+++ /dev/null
@@ -1,661 +0,0 @@
-/*-
- * Copyright (c) 2008 Paolo Pisati
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
-
-#include <sys/param.h>
-#include <sys/systm.h>
-#include <sys/eventhandler.h>
-#include <sys/malloc.h>
-#include <sys/kernel.h>
-#include <sys/lock.h>
-#include <sys/module.h>
-#include <sys/rwlock.h>
-
-#define        IPFW_INTERNAL   /* Access to protected data structures in ip_fw.h. */
-
-#include <netinet/libalias/alias.h>
-#include <netinet/libalias/alias_local.h>
-
-#include <net/if.h>
-#include <netinet/in.h>
-#include <netinet/ip.h>
-#include <netinet/ip_var.h>
-#include <netinet/ip_fw.h>
-#include <netinet/ipfw/ip_fw_private.h>
-#include <netinet/tcp.h>
-#include <netinet/udp.h>
-
-#include <machine/in_cksum.h>	/* XXX for in_cksum */
-
-static VNET_DEFINE(eventhandler_tag, ifaddr_event_tag);
-#define	V_ifaddr_event_tag	VNET(ifaddr_event_tag)
-
-static void
-ifaddr_change(void *arg __unused, struct ifnet *ifp)
-{
-	struct cfg_nat *ptr;
-	struct ifaddr *ifa;
-	struct ip_fw_chain *chain;
-
-	chain = &V_layer3_chain;
-	IPFW_WLOCK(chain);
-	/* Check every nat entry... */
-	LIST_FOREACH(ptr, &chain->nat, _next) {
-		/* ...using nic 'ifp->if_xname' as dynamic alias address. */
-		if (strncmp(ptr->if_name, ifp->if_xname, IF_NAMESIZE) != 0)
-			continue;
-		if_addr_rlock(ifp);
-		TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
-			if (ifa->ifa_addr == NULL)
-				continue;
-			if (ifa->ifa_addr->sa_family != AF_INET)
-				continue;
-			ptr->ip = ((struct sockaddr_in *)
-			    (ifa->ifa_addr))->sin_addr;
-			LibAliasSetAddress(ptr->lib, ptr->ip);
-		}
-		if_addr_runlock(ifp);
-	}
-	IPFW_WUNLOCK(chain);
-}
-
-/*
- * delete the pointers for nat entry ix, or all of them if ix < 0
- */
-static void
-flush_nat_ptrs(struct ip_fw_chain *chain, const int ix)
-{
-	int i;
-	ipfw_insn_nat *cmd;
-
-	IPFW_WLOCK_ASSERT(chain);
-	for (i = 0; i < chain->n_rules; i++) {
-		cmd = (ipfw_insn_nat *)ACTION_PTR(chain->map[i]);
-		/* XXX skip log and the like ? */
-		if (cmd->o.opcode == O_NAT && cmd->nat != NULL &&
-			    (ix < 0 || cmd->nat->id == ix))
-			cmd->nat = NULL;
-	}
-}
-
-static void
-del_redir_spool_cfg(struct cfg_nat *n, struct redir_chain *head)
-{
-	struct cfg_redir *r, *tmp_r;
-	struct cfg_spool *s, *tmp_s;
-	int i, num;
-
-	LIST_FOREACH_SAFE(r, head, _next, tmp_r) {
-		num = 1; /* Number of alias_link to delete. */
-		switch (r->mode) {
-		case REDIR_PORT:
-			num = r->pport_cnt;
-			/* FALLTHROUGH */
-		case REDIR_ADDR:
-		case REDIR_PROTO:
-			/* Delete all libalias redirect entry. */
-			for (i = 0; i < num; i++)
-				LibAliasRedirectDelete(n->lib, r->alink[i]);
-			/* Del spool cfg if any. */
-			LIST_FOREACH_SAFE(s, &r->spool_chain, _next, tmp_s) {
-				LIST_REMOVE(s, _next);
-				free(s, M_IPFW);
-			}
-			free(r->alink, M_IPFW);
-			LIST_REMOVE(r, _next);
-			free(r, M_IPFW);
-			break;
-		default:
-			printf("unknown redirect mode: %u\n", r->mode);
-			/* XXX - panic?!?!? */
-			break;
-		}
-	}
-}
-
-static void
-add_redir_spool_cfg(char *buf, struct cfg_nat *ptr)
-{
-	struct cfg_redir *r, *ser_r;
-	struct cfg_spool *s, *ser_s;
-	int cnt, off, i;
-
-	for (cnt = 0, off = 0; cnt < ptr->redir_cnt; cnt++) {
-		ser_r = (struct cfg_redir *)&buf[off];
-		r = malloc(SOF_REDIR, M_IPFW, M_WAITOK | M_ZERO);
-		memcpy(r, ser_r, SOF_REDIR);
-		LIST_INIT(&r->spool_chain);
-		off += SOF_REDIR;
-		r->alink = malloc(sizeof(struct alias_link *) * r->pport_cnt,
-		    M_IPFW, M_WAITOK | M_ZERO);
-		switch (r->mode) {
-		case REDIR_ADDR:
-			r->alink[0] = LibAliasRedirectAddr(ptr->lib, r->laddr,
-			    r->paddr);
-			break;
-		case REDIR_PORT:
-			for (i = 0 ; i < r->pport_cnt; i++) {
-				/* If remotePort is all ports, set it to 0. */
-				u_short remotePortCopy = r->rport + i;
-				if (r->rport_cnt == 1 && r->rport == 0)
-					remotePortCopy = 0;
-				r->alink[i] = LibAliasRedirectPort(ptr->lib,
-				    r->laddr, htons(r->lport + i), r->raddr,
-				    htons(remotePortCopy), r->paddr,
-				    htons(r->pport + i), r->proto);
-				if (r->alink[i] == NULL) {
-					r->alink[0] = NULL;
-					break;
-				}
-			}
-			break;
-		case REDIR_PROTO:
-			r->alink[0] = LibAliasRedirectProto(ptr->lib ,r->laddr,
-			    r->raddr, r->paddr, r->proto);
-			break;
-		default:
-			printf("unknown redirect mode: %u\n", r->mode);
-			break;
-		}
-		/* XXX perhaps return an error instead of panic ? */
-		if (r->alink[0] == NULL)
-			panic("LibAliasRedirect* returned NULL");
-		/* LSNAT handling. */
-		for (i = 0; i < r->spool_cnt; i++) {
-			ser_s = (struct cfg_spool *)&buf[off];
-			s = malloc(SOF_REDIR, M_IPFW, M_WAITOK | M_ZERO);
-			memcpy(s, ser_s, SOF_SPOOL);
-			LibAliasAddServer(ptr->lib, r->alink[0],
-			    s->addr, htons(s->port));
-			off += SOF_SPOOL;
-			/* Hook spool entry. */
-			LIST_INSERT_HEAD(&r->spool_chain, s, _next);
-		}
-		/* And finally hook this redir entry. */
-		LIST_INSERT_HEAD(&ptr->redir_chain, r, _next);
-	}
-}
-
-static int
-ipfw_nat(struct ip_fw_args *args, struct cfg_nat *t, struct mbuf *m)
-{
-	struct mbuf *mcl;
-	struct ip *ip;
-	/* XXX - libalias duct tape */
-	int ldt, retval, found;
-	struct ip_fw_chain *chain;
-	char *c;
-
-	ldt = 0;
-	retval = 0;
-	mcl = m_megapullup(m, m->m_pkthdr.len);
-	if (mcl == NULL) {
-		args->m = NULL;
-		return (IP_FW_DENY);
-	}
-	ip = mtod(mcl, struct ip *);
-
-	/*
-	 * XXX - Libalias checksum offload 'duct tape':
-	 *
-	 * locally generated packets have only pseudo-header checksum
-	 * calculated and libalias will break it[1], so mark them for
-	 * later fix.  Moreover there are cases when libalias modifies
-	 * tcp packet data[2], mark them for later fix too.
-	 *
-	 * [1] libalias was never meant to run in kernel, so it does
-	 * not have any knowledge about checksum offloading, and
-	 * expects a packet with a full internet checksum.
-	 * Unfortunately, packets generated locally will have just the
-	 * pseudo header calculated, and when libalias tries to adjust
-	 * the checksum it will actually compute a wrong value.
-	 *
-	 * [2] when libalias modifies tcp's data content, full TCP
-	 * checksum has to be recomputed: the problem is that
-	 * libalias does not have any idea about checksum offloading.
-	 * To work around this, we do not do checksumming in LibAlias,
-	 * but only mark the packets in th_x2 field. If we receive a
-	 * marked packet, we calculate correct checksum for it
-	 * aware of offloading.  Why such a terrible hack instead of
-	 * recalculating checksum for each packet?
-	 * Because the previous checksum was not checked!
-	 * Recalculating checksums for EVERY packet will hide ALL
-	 * transmission errors. Yes, marked packets still suffer from
-	 * this problem. But, sigh, natd(8) has this problem, too.
-	 *
-	 * TODO: -make libalias mbuf aware (so
-	 * it can handle delayed checksum and tso)
-	 */
-
-	if (mcl->m_pkthdr.rcvif == NULL &&
-	    mcl->m_pkthdr.csum_flags & CSUM_DELAY_DATA)
-		ldt = 1;
-
-	c = mtod(mcl, char *);
-
-	/* Check if this is 'global' instance */
-	if (t == NULL) {
-		if (args->oif == NULL) {
-			/* Wrong direction, skip processing */
-			args->m = mcl;
-			return (IP_FW_NAT);
-		}
-
-		found = 0;
-		chain = &V_layer3_chain;
-		IPFW_RLOCK(chain);
-		/* Check every nat entry... */
-		LIST_FOREACH(t, &chain->nat, _next) {
-			if ((t->mode & PKT_ALIAS_SKIP_GLOBAL) != 0)
-				continue;
-			retval = LibAliasOutTry(t->lib, c,
-			    mcl->m_len + M_TRAILINGSPACE(mcl), 0);
-			if (retval == PKT_ALIAS_OK) {
-				/* Nat instance recognises state */
-				found = 1;
-				break;
-			}
-		}
-		IPFW_RUNLOCK(chain);
-		if (found != 1) {
-			/* No instance found, return ignore */
-			args->m = mcl;
-			return (IP_FW_NAT);
-		}
-	} else {
-		if (args->oif == NULL)
-			retval = LibAliasIn(t->lib, c,
-				mcl->m_len + M_TRAILINGSPACE(mcl));
-		else
-			retval = LibAliasOut(t->lib, c,
-				mcl->m_len + M_TRAILINGSPACE(mcl));
-	}
-
-	/*
-	 * We drop packet when:
-	 * 1. libalias returns PKT_ALIAS_ERROR;
-	 * 2. For incoming packets:
-	 *	a) for unresolved fragments;
-	 *	b) libalias returns PKT_ALIAS_IGNORED and
-	 *		PKT_ALIAS_DENY_INCOMING flag is set.
-	 */
-	if (retval == PKT_ALIAS_ERROR ||
-	    (args->oif == NULL && (retval == PKT_ALIAS_UNRESOLVED_FRAGMENT ||
-	    (retval == PKT_ALIAS_IGNORED &&
-	    (t->mode & PKT_ALIAS_DENY_INCOMING) != 0)))) {
-		/* XXX - should i add some logging? */
-		m_free(mcl);
-		args->m = NULL;
-		return (IP_FW_DENY);
-	}
-
-	if (retval == PKT_ALIAS_RESPOND)
-		mcl->m_flags |= M_SKIP_FIREWALL;
-	mcl->m_pkthdr.len = mcl->m_len = ntohs(ip->ip_len);
-
-	/*
-	 * XXX - libalias checksum offload
-	 * 'duct tape' (see above)
-	 */
-
-	if ((ip->ip_off & htons(IP_OFFMASK)) == 0 &&
-	    ip->ip_p == IPPROTO_TCP) {
-		struct tcphdr 	*th;
-
-		th = (struct tcphdr *)(ip + 1);
-		if (th->th_x2)
-			ldt = 1;
-	}
-
-	if (ldt) {
-		struct tcphdr 	*th;
-		struct udphdr 	*uh;
-		u_short cksum;
-
-		ip->ip_len = ntohs(ip->ip_len);
-		cksum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr,
-		    htons(ip->ip_p + ip->ip_len - (ip->ip_hl << 2)));
-
-		switch (ip->ip_p) {
-		case IPPROTO_TCP:
-			th = (struct tcphdr *)(ip + 1);
-			/*
-			 * Maybe it was set in
-			 * libalias...
-			 */
-			th->th_x2 = 0;
-			th->th_sum = cksum;
-			mcl->m_pkthdr.csum_data =
-			    offsetof(struct tcphdr, th_sum);
-			break;
-		case IPPROTO_UDP:
-			uh = (struct udphdr *)(ip + 1);
-			uh->uh_sum = cksum;
-			mcl->m_pkthdr.csum_data =
-			    offsetof(struct udphdr, uh_sum);
-			break;
-		}
-		/* No hw checksum offloading: do it ourselves */
-		if ((mcl->m_pkthdr.csum_flags & CSUM_DELAY_DATA) == 0) {
-			in_delayed_cksum(mcl);
-			mcl->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
-		}
-		ip->ip_len = htons(ip->ip_len);
-	}
-	args->m = mcl;
-	return (IP_FW_NAT);
-}
-
-static struct cfg_nat *
-lookup_nat(struct nat_list *l, int nat_id)
-{
-	struct cfg_nat *res;
-
-	LIST_FOREACH(res, l, _next) {
-		if (res->id == nat_id)
-			break;
-	}
-	return res;
-}
-
-static int
-ipfw_nat_cfg(struct sockopt *sopt)
-{
-	struct cfg_nat *cfg, *ptr;
-	char *buf;
-	struct ip_fw_chain *chain = &V_layer3_chain;
-	size_t len;
-	int gencnt, error = 0;
-
-	len = sopt->sopt_valsize;
-	buf = malloc(len, M_TEMP, M_WAITOK | M_ZERO);
-	if ((error = sooptcopyin(sopt, buf, len, sizeof(struct cfg_nat))) != 0)
-		goto out;
-
-	cfg = (struct cfg_nat *)buf;
-	if (cfg->id < 0) {
-		error = EINVAL;
-		goto out;
-	}
-
-	/*
-	 * Find/create nat rule.
-	 */
-	IPFW_WLOCK(chain);
-	gencnt = chain->gencnt;
-	ptr = lookup_nat(&chain->nat, cfg->id);
-	if (ptr == NULL) {
-		IPFW_WUNLOCK(chain);
-		/* New rule: allocate and init new instance. */
-		ptr = malloc(sizeof(struct cfg_nat), M_IPFW, M_WAITOK | M_ZERO);
-		ptr->lib = LibAliasInit(NULL);
-		LIST_INIT(&ptr->redir_chain);
-	} else {
-		/* Entry already present: temporarily unhook it. */
-		LIST_REMOVE(ptr, _next);
-		flush_nat_ptrs(chain, cfg->id);
-		IPFW_WUNLOCK(chain);
-	}
-
-	/*
-	 * Basic nat configuration.
-	 */
-	ptr->id = cfg->id;
-	/*
-	 * XXX - what if this rule doesn't nat any ip and just
-	 * redirect?
-	 * do we set aliasaddress to 0.0.0.0?
-	 */
-	ptr->ip = cfg->ip;
-	ptr->redir_cnt = cfg->redir_cnt;
-	ptr->mode = cfg->mode;
-	LibAliasSetMode(ptr->lib, cfg->mode, cfg->mode);
-	LibAliasSetAddress(ptr->lib, ptr->ip);
-	memcpy(ptr->if_name, cfg->if_name, IF_NAMESIZE);
-
-	/*
-	 * Redir and LSNAT configuration.
-	 */
-	/* Delete old cfgs. */
-	del_redir_spool_cfg(ptr, &ptr->redir_chain);
-	/* Add new entries. */
-	add_redir_spool_cfg(&buf[(sizeof(struct cfg_nat))], ptr);
-
-	IPFW_WLOCK(chain);
-	/* Extra check to avoid race with another ipfw_nat_cfg() */
-	if (gencnt != chain->gencnt &&
-	    ((cfg = lookup_nat(&chain->nat, ptr->id)) != NULL))
-		LIST_REMOVE(cfg, _next);
-	LIST_INSERT_HEAD(&chain->nat, ptr, _next);
-	chain->gencnt++;
-	IPFW_WUNLOCK(chain);
-
-out:
-	free(buf, M_TEMP);
-	return (error);
-}
-
-static int
-ipfw_nat_del(struct sockopt *sopt)
-{
-	struct cfg_nat *ptr;
-	struct ip_fw_chain *chain = &V_layer3_chain;
-	int i;
-
-	sooptcopyin(sopt, &i, sizeof i, sizeof i);
-	/* XXX validate i */
-	IPFW_WLOCK(chain);
-	ptr = lookup_nat(&chain->nat, i);
-	if (ptr == NULL) {
-		IPFW_WUNLOCK(chain);
-		return (EINVAL);
-	}
-	LIST_REMOVE(ptr, _next);
-	flush_nat_ptrs(chain, i);
-	IPFW_WUNLOCK(chain);
-	del_redir_spool_cfg(ptr, &ptr->redir_chain);
-	LibAliasUninit(ptr->lib);
-	free(ptr, M_IPFW);
-	return (0);
-}
-
-static int
-ipfw_nat_get_cfg(struct sockopt *sopt)
-{
-	struct ip_fw_chain *chain = &V_layer3_chain;
-	struct cfg_nat *n;
-	struct cfg_redir *r;
-	struct cfg_spool *s;
-	char *data;
-	int gencnt, nat_cnt, len, error;
-
-	nat_cnt = 0;
-	len = sizeof(nat_cnt);
-
-	IPFW_RLOCK(chain);
-retry:
-	gencnt = chain->gencnt;
-	/* Estimate memory amount */
-	LIST_FOREACH(n, &chain->nat, _next) {
-		nat_cnt++;
-		len += sizeof(struct cfg_nat);
-		LIST_FOREACH(r, &n->redir_chain, _next) {
-			len += sizeof(struct cfg_redir);
-			LIST_FOREACH(s, &r->spool_chain, _next)
-				len += sizeof(struct cfg_spool);
-		}
-	}
-	IPFW_RUNLOCK(chain);
-
-	data = malloc(len, M_TEMP, M_WAITOK | M_ZERO);
-	bcopy(&nat_cnt, data, sizeof(nat_cnt));
-
-	nat_cnt = 0;
-	len = sizeof(nat_cnt);
-
-	IPFW_RLOCK(chain);
-	if (gencnt != chain->gencnt) {
-		free(data, M_TEMP);
-		goto retry;
-	}
-	/* Serialize all the data. */
-	LIST_FOREACH(n, &chain->nat, _next) {
-		bcopy(n, &data[len], sizeof(struct cfg_nat));
-		len += sizeof(struct cfg_nat);
-		LIST_FOREACH(r, &n->redir_chain, _next) {
-			bcopy(r, &data[len], sizeof(struct cfg_redir));
-			len += sizeof(struct cfg_redir);
-			LIST_FOREACH(s, &r->spool_chain, _next) {
-				bcopy(s, &data[len], sizeof(struct cfg_spool));
-				len += sizeof(struct cfg_spool);
-			}
-		}
-	}
-	IPFW_RUNLOCK(chain);
-
-	error = sooptcopyout(sopt, data, len);
-	free(data, M_TEMP);
-
-	return (error);
-}
-
-static int
-ipfw_nat_get_log(struct sockopt *sopt)
-{
-	uint8_t *data;
-	struct cfg_nat *ptr;
-	int i, size;
-	struct ip_fw_chain *chain;
-
-	chain = &V_layer3_chain;
-
-	IPFW_RLOCK(chain);
-	/* one pass to count, one to copy the data */
-	i = 0;
-	LIST_FOREACH(ptr, &chain->nat, _next) {
-		if (ptr->lib->logDesc == NULL)
-			continue;
-		i++;
-	}
-	size = i * (LIBALIAS_BUF_SIZE + sizeof(int));
-	data = malloc(size, M_IPFW, M_NOWAIT | M_ZERO);
-	if (data == NULL) {
-		IPFW_RUNLOCK(chain);
-		return (ENOSPC);
-	}
-	i = 0;
-	LIST_FOREACH(ptr, &chain->nat, _next) {
-		if (ptr->lib->logDesc == NULL)
-			continue;
-		bcopy(&ptr->id, &data[i], sizeof(int));
-		i += sizeof(int);
-		bcopy(ptr->lib->logDesc, &data[i], LIBALIAS_BUF_SIZE);
-		i += LIBALIAS_BUF_SIZE;
-	}
-	IPFW_RUNLOCK(chain);
-	sooptcopyout(sopt, data, size);
-	free(data, M_IPFW);
-	return(0);
-}
-
-static void
-ipfw_nat_init(void)
-{
-
-	IPFW_WLOCK(&V_layer3_chain);
-	/* init ipfw hooks */
-	ipfw_nat_ptr = ipfw_nat;
-	lookup_nat_ptr = lookup_nat;
-	ipfw_nat_cfg_ptr = ipfw_nat_cfg;
-	ipfw_nat_del_ptr = ipfw_nat_del;
-	ipfw_nat_get_cfg_ptr = ipfw_nat_get_cfg;
-	ipfw_nat_get_log_ptr = ipfw_nat_get_log;
-	IPFW_WUNLOCK(&V_layer3_chain);
-	V_ifaddr_event_tag = EVENTHANDLER_REGISTER(
-	    ifaddr_event, ifaddr_change,
-	    NULL, EVENTHANDLER_PRI_ANY);
-}
-
-static void
-ipfw_nat_destroy(void)
-{
-	struct cfg_nat *ptr, *ptr_temp;
-	struct ip_fw_chain *chain;
-
-	chain = &V_layer3_chain;
-	IPFW_WLOCK(chain);
-	LIST_FOREACH_SAFE(ptr, &chain->nat, _next, ptr_temp) {
-		LIST_REMOVE(ptr, _next);
-		del_redir_spool_cfg(ptr, &ptr->redir_chain);
-		LibAliasUninit(ptr->lib);
-		free(ptr, M_IPFW);
-	}
-	EVENTHANDLER_DEREGISTER(ifaddr_event, V_ifaddr_event_tag);
-	flush_nat_ptrs(chain, -1 /* flush all */);
-	/* deregister ipfw_nat */
-	ipfw_nat_ptr = NULL;
-	lookup_nat_ptr = NULL;
-	ipfw_nat_cfg_ptr = NULL;
-	ipfw_nat_del_ptr = NULL;
-	ipfw_nat_get_cfg_ptr = NULL;
-	ipfw_nat_get_log_ptr = NULL;
-	IPFW_WUNLOCK(chain);
-}
-
-static int
-ipfw_nat_modevent(module_t mod, int type, void *unused)
-{
-	int err = 0;
-
-	switch (type) {
-	case MOD_LOAD:
-		ipfw_nat_init();
-		break;
-
-	case MOD_UNLOAD:
-		ipfw_nat_destroy();
-		break;
-
-	default:
-		return EOPNOTSUPP;
-		break;
-	}
-	return err;
-}
-
-static moduledata_t ipfw_nat_mod = {
-	"ipfw_nat",
-	ipfw_nat_modevent,
-	0
-};
-
-DECLARE_MODULE(ipfw_nat, ipfw_nat_mod, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY);
-MODULE_DEPEND(ipfw_nat, libalias, 1, 1, 1);
-MODULE_DEPEND(ipfw_nat, ipfw, 2, 2, 2);
-MODULE_VERSION(ipfw_nat, 1);
-/* end of file */
diff --git a/sys/netinet/ipfw/ip_fw_pfil.c b/sys/netinet/ipfw/ip_fw_pfil.c
deleted file mode 100644
index 695613d43e18..000000000000
--- a/sys/netinet/ipfw/ip_fw_pfil.c
+++ /dev/null
@@ -1,460 +0,0 @@
-/*-
- * Copyright (c) 2004 Andre Oppermann, Internet Business Solutions AG
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
-
-#include "opt_ipfw.h"
-#include "opt_inet.h"
-#include "opt_inet6.h"
-#ifndef INET
-#error IPFIREWALL requires INET.
-#endif /* INET */
-
-#include <sys/param.h>
-#include <sys/systm.h>
-#include <sys/malloc.h>
-#include <sys/mbuf.h>
-#include <sys/module.h>
-#include <sys/kernel.h>
-#include <sys/lock.h>
-#include <sys/rwlock.h>
-#include <sys/socket.h>
-#include <sys/sysctl.h>
-
-#include <net/if.h>
-#include <net/route.h>
-#include <net/pfil.h>
-#include <net/vnet.h>
-
-#include <netinet/in.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#include <netinet/ip_var.h>
-#include <netinet/ip_fw.h>
-#ifdef INET6
-#include <netinet/ip6.h>
-#include <netinet6/ip6_var.h>
-#endif
-#include <netinet/ipfw/ip_fw_private.h>
-#include <netgraph/ng_ipfw.h>
-
-#include <machine/in_cksum.h>
-
-static VNET_DEFINE(int, fw_enable) = 1;
-#define V_fw_enable	VNET(fw_enable)
-
-#ifdef INET6
-static VNET_DEFINE(int, fw6_enable) = 1;
-#define V_fw6_enable	VNET(fw6_enable)
-#endif
-
-int ipfw_chg_hook(SYSCTL_HANDLER_ARGS);
-
-/* Forward declarations. */
-static int ipfw_divert(struct mbuf **, int, struct ipfw_rule_ref *, int);
-
-#ifdef SYSCTL_NODE
-
-SYSBEGIN(f1)
-
-SYSCTL_DECL(_net_inet_ip_fw);
-SYSCTL_VNET_PROC(_net_inet_ip_fw, OID_AUTO, enable,
-    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_SECURE3, &VNET_NAME(fw_enable), 0,
-    ipfw_chg_hook, "I", "Enable ipfw");
-#ifdef INET6
-SYSCTL_DECL(_net_inet6_ip6_fw);
-SYSCTL_VNET_PROC(_net_inet6_ip6_fw, OID_AUTO, enable,
-    CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_SECURE3, &VNET_NAME(fw6_enable), 0,
-    ipfw_chg_hook, "I", "Enable ipfw+6");
-#endif /* INET6 */
-
-SYSEND
-
-#endif /* SYSCTL_NODE */
-
-/*
- * The pfilter hook to pass packets to ipfw_chk and then to
- * dummynet, divert, netgraph or other modules.
- * The packet may be consumed.
- */
-int
-ipfw_check_hook(void *arg, struct mbuf **m0, struct ifnet *ifp, int dir,
-    struct inpcb *inp)
-{
-	struct ip_fw_args args;
-	struct m_tag *tag;
-	int ipfw;
-	int ret;
-
-	/* all the processing now uses ip_len in net format */
-	if (mtod(*m0, struct ip *)->ip_v == 4)
-		SET_NET_IPLEN(mtod(*m0, struct ip *));
-
-	/* convert dir to IPFW values */
-	dir = (dir == PFIL_IN) ? DIR_IN : DIR_OUT;
-	bzero(&args, sizeof(args));
-
-again:
-	/*
-	 * extract and remove the tag if present. If we are left
-	 * with onepass, optimize the outgoing path.
-	 */
-	tag = m_tag_locate(*m0, MTAG_IPFW_RULE, 0, NULL);
-	if (tag != NULL) {
-		args.rule = *((struct ipfw_rule_ref *)(tag+1));
-		m_tag_delete(*m0, tag);
-		if (args.rule.info & IPFW_ONEPASS) {
-			if (mtod(*m0, struct ip *)->ip_v == 4)
-				SET_HOST_IPLEN(mtod(*m0, struct ip *));
-			return (0);
-		}
-	}
-
-	args.m = *m0;
-	args.oif = dir == DIR_OUT ? ifp : NULL;
-	args.inp = inp;
-
-	ipfw = ipfw_chk(&args);
-	*m0 = args.m;
-
-	KASSERT(*m0 != NULL || ipfw == IP_FW_DENY, ("%s: m0 is NULL",
-	    __func__));
-
-	/* breaking out of the switch means drop */
-	ret = 0;	/* default return value for pass */
-	switch (ipfw) {
-	case IP_FW_PASS:
-		/* next_hop may be set by ipfw_chk */
-		if (args.next_hop == NULL && args.next_hop6 == NULL)
-			break; /* pass */
-#if !defined(IPFIREWALL_FORWARD) || (!defined(INET6) && !defined(INET))
-		ret = EACCES;
-#else
-	    {
-		struct m_tag *fwd_tag;
-		size_t len;
-
-		KASSERT(args.next_hop == NULL || args.next_hop6 == NULL,
-		    ("%s: both next_hop=%p and next_hop6=%p not NULL", __func__,
-		     args.next_hop, args.next_hop6));
-#ifdef INET6
-		if (args.next_hop6 != NULL)
-			len = sizeof(struct sockaddr_in6);
-#endif
-#ifdef INET
-		if (args.next_hop != NULL)
-			len = sizeof(struct sockaddr_in);
-#endif
-
-		/* Incoming packets should not be tagged so we do not
-		 * m_tag_find. Outgoing packets may be tagged, so we
-		 * reuse the tag if present.
-		 */
-		fwd_tag = (dir == DIR_IN) ? NULL :
-			m_tag_find(*m0, PACKET_TAG_IPFORWARD, NULL);
-		if (fwd_tag != NULL) {
-			m_tag_unlink(*m0, fwd_tag);
-		} else {
-			fwd_tag = m_tag_get(PACKET_TAG_IPFORWARD, len,
-			    M_NOWAIT);
-			if (fwd_tag == NULL) {
-				ret = EACCES;
-				break; /* i.e. drop */
-			}
-		}
-#ifdef INET6
-		if (args.next_hop6 != NULL) {
-			bcopy(args.next_hop6, (fwd_tag+1), len);
-			if (in6_localip(&args.next_hop6->sin6_addr))
-				(*m0)->m_flags |= M_FASTFWD_OURS;
-		}
-#endif
-#ifdef INET
-		if (args.next_hop != NULL) {
-			bcopy(args.next_hop, (fwd_tag+1), len);
-			if (in_localip(args.next_hop->sin_addr))
-				(*m0)->m_flags |= M_FASTFWD_OURS;
-		}
-#endif
-		m_tag_prepend(*m0, fwd_tag);
-	    }
-#endif /* IPFIREWALL_FORWARD */
-		break;
-
-	case IP_FW_DENY:
-		ret = EACCES;
-		break; /* i.e. drop */
-
-	case IP_FW_DUMMYNET:
-		ret = EACCES;
-		if (ip_dn_io_ptr == NULL)
-			break; /* i.e. drop */
-		if (mtod(*m0, struct ip *)->ip_v == 4)
-			ret = ip_dn_io_ptr(m0, dir, &args);
-		else if (mtod(*m0, struct ip *)->ip_v == 6)
-			ret = ip_dn_io_ptr(m0, dir | PROTO_IPV6, &args);
-		else
-			break; /* drop it */
-		/*
-		 * XXX should read the return value.
-		 * dummynet normally eats the packet and sets *m0=NULL
-		 * unless the packet can be sent immediately. In this
-		 * case args is updated and we should re-run the
-		 * check without clearing args.
-		 */
-		if (*m0 != NULL)
-			goto again;
-		break;
-
-	case IP_FW_TEE:
-	case IP_FW_DIVERT:
-		if (ip_divert_ptr == NULL) {
-			ret = EACCES;
-			break; /* i.e. drop */
-		}
-		ret = ipfw_divert(m0, dir, &args.rule,
-			(ipfw == IP_FW_TEE) ? 1 : 0);
-		/* continue processing for the original packet (tee). */
-		if (*m0)
-			goto again;
-		break;
-
-	case IP_FW_NGTEE:
-	case IP_FW_NETGRAPH:
-		if (ng_ipfw_input_p == NULL) {
-			ret = EACCES;
-			break; /* i.e. drop */
-		}
-		ret = ng_ipfw_input_p(m0, dir, &args,
-			(ipfw == IP_FW_NGTEE) ? 1 : 0);
-		if (ipfw == IP_FW_NGTEE) /* ignore errors for NGTEE */
-			goto again;	/* continue with packet */
-		break;
-
-	case IP_FW_NAT:
-		/* honor one-pass in case of successful nat */
-		if (V_fw_one_pass)
-			break; /* ret is already 0 */
-		goto again;
-
-	case IP_FW_REASS:
-		goto again;		/* continue with packet */
-	
-	default:
-		KASSERT(0, ("%s: unknown retval", __func__));
-	}
-
-	if (ret != 0) {
-		if (*m0)
-			FREE_PKT(*m0);
-		*m0 = NULL;
-	}
-	if (*m0 && mtod(*m0, struct ip *)->ip_v == 4)
-		SET_HOST_IPLEN(mtod(*m0, struct ip *));
-	return ret;
-}
-
-/* do the divert, return 1 on error 0 on success */
-static int
-ipfw_divert(struct mbuf **m0, int incoming, struct ipfw_rule_ref *rule,
-	int tee)
-{
-	/*
-	 * ipfw_chk() has already tagged the packet with the divert tag.
-	 * If tee is set, copy packet and return original.
-	 * If not tee, consume packet and send it to divert socket.
-	 */
-	struct mbuf *clone;
-	struct ip *ip = mtod(*m0, struct ip *);
-	struct m_tag *tag;
-
-	/* Cloning needed for tee? */
-	if (tee == 0) {
-		clone = *m0;	/* use the original mbuf */
-		*m0 = NULL;
-	} else {
-		clone = m_dup(*m0, M_DONTWAIT);
-		/* If we cannot duplicate the mbuf, we sacrifice the divert
-		 * chain and continue with the tee-ed packet.
-		 */
-		if (clone == NULL)
-			return 1;
-	}
-
-	/*
-	 * Divert listeners can normally handle non-fragmented packets,
-	 * but we can only reass in the non-tee case.
-	 * This means that listeners on a tee rule may get fragments,
-	 * and have to live with that.
-	 * Note that we now have the 'reass' ipfw option so if we care
-	 * we can do it before a 'tee'.
-	 */
-	if (!tee) switch (ip->ip_v) {
-	case IPVERSION:
-	    if (ntohs(ip->ip_off) & (IP_MF | IP_OFFMASK)) {
-		int hlen;
-		struct mbuf *reass;
-
-		SET_HOST_IPLEN(ip); /* ip_reass wants host order */
-		reass = ip_reass(clone); /* Reassemble packet. */
-		if (reass == NULL)
-			return 0; /* not an error */
-		/* if reass = NULL then it was consumed by ip_reass */
-		/*
-		 * IP header checksum fixup after reassembly and leave header
-		 * in network byte order.
-		 */
-		ip = mtod(reass, struct ip *);
-		hlen = ip->ip_hl << 2;
-		SET_NET_IPLEN(ip);
-		ip->ip_sum = 0;
-		if (hlen == sizeof(struct ip))
-			ip->ip_sum = in_cksum_hdr(ip);
-		else
-			ip->ip_sum = in_cksum(reass, hlen);
-		clone = reass;
-	    }
-	    break;
-#ifdef INET6
-	case IPV6_VERSION >> 4:
-	    {
-	    struct ip6_hdr *const ip6 = mtod(clone, struct ip6_hdr *);
-
-		if (ip6->ip6_nxt == IPPROTO_FRAGMENT) {
-			int nxt, off;
-
-			off = sizeof(struct ip6_hdr);
-			nxt = frag6_input(&clone, &off, 0);
-			if (nxt == IPPROTO_DONE)
-				return (0);
-		}
-		break;
-	    }
-#endif
-	}
-
-	/* attach a tag to the packet with the reinject info */
-	tag = m_tag_alloc(MTAG_IPFW_RULE, 0,
-		    sizeof(struct ipfw_rule_ref), M_NOWAIT);
-	if (tag == NULL) {
-		FREE_PKT(clone);
-		return 1;
-	}
-	*((struct ipfw_rule_ref *)(tag+1)) = *rule;
-	m_tag_prepend(clone, tag);
-
-	/* Do the dirty job... */
-	ip_divert_ptr(clone, incoming);
-	return 0;
-}
-
-/*
- * attach or detach hooks for a given protocol family
- */
-static int
-ipfw_hook(int onoff, int pf)
-{
-	struct pfil_head *pfh;
-
-	pfh = pfil_head_get(PFIL_TYPE_AF, pf);
-	if (pfh == NULL)
-		return ENOENT;
-
-	(void) (onoff ? pfil_add_hook : pfil_remove_hook)
-	    (ipfw_check_hook, NULL, PFIL_IN | PFIL_OUT | PFIL_WAITOK, pfh);
-
-	return 0;
-}
-
-int
-ipfw_attach_hooks(int arg)
-{
-	int error = 0;
-
-	if (arg == 0) /* detach */
-		ipfw_hook(0, AF_INET);
-	else if (V_fw_enable && ipfw_hook(1, AF_INET) != 0) {
-                error = ENOENT; /* see ip_fw_pfil.c::ipfw_hook() */
-                printf("ipfw_hook() error\n");
-        }
-#ifdef INET6
-	if (arg == 0) /* detach */
-		ipfw_hook(0, AF_INET6);
-	else if (V_fw6_enable && ipfw_hook(1, AF_INET6) != 0) {
-                error = ENOENT;
-                printf("ipfw6_hook() error\n");
-        }
-#endif
-	return error;
-}
-
-int
-ipfw_chg_hook(SYSCTL_HANDLER_ARGS)
-{
-	int enable;
-	int oldenable;
-	int error;
-	int af;
-
-	if (arg1 == &VNET_NAME(fw_enable)) {
-		enable = V_fw_enable;
-		af = AF_INET;
-	}
-#ifdef INET6
-	else if (arg1 == &VNET_NAME(fw6_enable)) {
-		enable = V_fw6_enable;
-		af = AF_INET6;
-	}
-#endif
-	else 
-		return (EINVAL);
-
-	oldenable = enable;
-
-	error = sysctl_handle_int(oidp, &enable, 0, req);
-
-	if (error)
-		return (error);
-
-	enable = (enable) ? 1 : 0;
-
-	if (enable == oldenable)
-		return (0);
-
-	error = ipfw_hook(enable, af);
-	if (error)
-		return (error);
-	if (af == AF_INET)
-		V_fw_enable = enable;
-#ifdef INET6
-	else if (af == AF_INET6)
-		V_fw6_enable = enable;
-#endif
-
-	return (0);
-}
-/* end of file */
diff --git a/sys/netinet/ipfw/ip_fw_private.h b/sys/netinet/ipfw/ip_fw_private.h
deleted file mode 100644
index 7f65c4128987..000000000000
--- a/sys/netinet/ipfw/ip_fw_private.h
+++ /dev/null
@@ -1,313 +0,0 @@
-/*-
- * Copyright (c) 2002-2009 Luigi Rizzo, Universita` di Pisa
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- * $FreeBSD$
- */
-
-#ifndef _IPFW2_PRIVATE_H
-#define _IPFW2_PRIVATE_H
-
-/*
- * Internal constants and data structures used by ipfw components
- * and not meant to be exported outside the kernel.
- */
-
-#ifdef _KERNEL
-
-/*
- * For platforms that do not have SYSCTL support, we wrap the
- * SYSCTL_* into a function (one per file) to collect the values
- * into an array at module initialization. The wrapping macros,
- * SYSBEGIN() and SYSEND, are empty in the default case.
- */
-#ifndef SYSBEGIN
-#define SYSBEGIN(x)
-#endif
-#ifndef SYSEND
-#define SYSEND
-#endif
-
-/* Return values from ipfw_chk() */
-enum {
-	IP_FW_PASS = 0,
-	IP_FW_DENY,
-	IP_FW_DIVERT,
-	IP_FW_TEE,
-	IP_FW_DUMMYNET,
-	IP_FW_NETGRAPH,
-	IP_FW_NGTEE,
-	IP_FW_NAT,
-	IP_FW_REASS,
-};
-
-/*
- * Structure for collecting parameters to dummynet for ip6_output forwarding
- */
-struct _ip6dn_args {
-       struct ip6_pktopts *opt_or;
-       struct route_in6 ro_or;
-       int flags_or;
-       struct ip6_moptions *im6o_or;
-       struct ifnet *origifp_or;
-       struct ifnet *ifp_or;
-       struct sockaddr_in6 dst_or;
-       u_long mtu_or;
-       struct route_in6 ro_pmtu_or;
-};
-
-
-/*
- * Arguments for calling ipfw_chk() and dummynet_io(). We put them
- * all into a structure because this way it is easier and more
- * efficient to pass variables around and extend the interface.
- */
-struct ip_fw_args {
-	struct mbuf	*m;		/* the mbuf chain		*/
-	struct ifnet	*oif;		/* output interface		*/
-	struct sockaddr_in *next_hop;	/* forward address		*/
-	struct sockaddr_in6 *next_hop6; /* ipv6 forward address		*/
-
-	/*
-	 * On return, it points to the matching rule.
-	 * On entry, rule.slot > 0 means the info is valid and
-	 * contains the starting rule for an ipfw search.
-	 * If chain_id == chain->id && slot >0 then jump to that slot.
-	 * Otherwise, we locate the first rule >= rulenum:rule_id
-	 */
-	struct ipfw_rule_ref rule;	/* match/restart info		*/
-
-	struct ether_header *eh;	/* for bridged packets		*/
-
-	struct ipfw_flow_id f_id;	/* grabbed from IP header	*/
-	//uint32_t	cookie;		/* a cookie depending on rule action */
-	struct inpcb	*inp;
-
-	struct _ip6dn_args	dummypar; /* dummynet->ip6_output */
-	struct sockaddr_in hopstore;	/* store here if cannot use a pointer */
-};
-
-MALLOC_DECLARE(M_IPFW);
-
-/*
- * Hooks sometime need to know the direction of the packet
- * (divert, dummynet, netgraph, ...)
- * We use a generic definition here, with bit0-1 indicating the
- * direction, bit 2 indicating layer2 or 3, bit 3-4 indicating the
- * specific protocol
- * indicating the protocol (if necessary)
- */
-enum {
-	DIR_MASK =	0x3,
-	DIR_OUT =	0,
-	DIR_IN =	1,
-	DIR_FWD =	2,
-	DIR_DROP =	3,
-	PROTO_LAYER2 =	0x4, /* set for layer 2 */
-	/* PROTO_DEFAULT = 0, */
-	PROTO_IPV4 =	0x08,
-	PROTO_IPV6 =	0x10,
-	PROTO_IFB =	0x0c, /* layer2 + ifbridge */
-   /*	PROTO_OLDBDG =	0x14, unused, old bridge */
-};
-
-/* wrapper for freeing a packet, in case we need to do more work */
-#ifndef FREE_PKT
-#if defined(__linux__) || defined(_WIN32)
-#define FREE_PKT(m)	netisr_dispatch(-1, m)
-#else
-#define FREE_PKT(m)	m_freem(m)
-#endif
-#endif /* !FREE_PKT */
-
-/*
- * Function definitions.
- */
-
-/* attach (arg = 1) or detach (arg = 0) hooks */
-int ipfw_attach_hooks(int);
-#ifdef NOTYET
-void ipfw_nat_destroy(void);
-#endif
-
-/* In ip_fw_log.c */
-struct ip;
-void ipfw_log_bpf(int);
-void ipfw_log(struct ip_fw *f, u_int hlen, struct ip_fw_args *args,
-	struct mbuf *m, struct ifnet *oif, u_short offset, uint32_t tablearg,
-	struct ip *ip);
-VNET_DECLARE(u_int64_t, norule_counter);
-#define	V_norule_counter	VNET(norule_counter)
-VNET_DECLARE(int, verbose_limit);
-#define	V_verbose_limit		VNET(verbose_limit)
-
-/* In ip_fw_dynamic.c */
-
-enum { /* result for matching dynamic rules */
-	MATCH_REVERSE = 0,
-	MATCH_FORWARD,
-	MATCH_NONE,
-	MATCH_UNKNOWN,
-};
-
-/*
- * The lock for dynamic rules is only used once outside the file,
- * and only to release the result of lookup_dyn_rule().
- * Eventually we may implement it with a callback on the function.
- */
-void ipfw_dyn_unlock(void);
-
-struct tcphdr;
-struct mbuf *ipfw_send_pkt(struct mbuf *, struct ipfw_flow_id *,
-    u_int32_t, u_int32_t, int);
-int ipfw_install_state(struct ip_fw *rule, ipfw_insn_limit *cmd,
-    struct ip_fw_args *args, uint32_t tablearg);
-ipfw_dyn_rule *ipfw_lookup_dyn_rule(struct ipfw_flow_id *pkt,
-	int *match_direction, struct tcphdr *tcp);
-void ipfw_remove_dyn_children(struct ip_fw *rule);
-void ipfw_get_dynamic(char **bp, const char *ep);
-
-void ipfw_dyn_attach(void);	/* uma_zcreate .... */
-void ipfw_dyn_detach(void);	/* uma_zdestroy ... */
-void ipfw_dyn_init(void);	/* per-vnet initialization */
-void ipfw_dyn_uninit(int);	/* per-vnet deinitialization */
-int ipfw_dyn_len(void);
-
-/* common variables */
-VNET_DECLARE(int, fw_one_pass);
-#define	V_fw_one_pass		VNET(fw_one_pass)
-
-VNET_DECLARE(int, fw_verbose);
-#define	V_fw_verbose		VNET(fw_verbose)
-
-VNET_DECLARE(struct ip_fw_chain, layer3_chain);
-#define	V_layer3_chain		VNET(layer3_chain)
-
-VNET_DECLARE(u_int32_t, set_disable);
-#define	V_set_disable		VNET(set_disable)
-
-VNET_DECLARE(int, autoinc_step);
-#define V_autoinc_step		VNET(autoinc_step)
-
-VNET_DECLARE(unsigned int, fw_tables_max);
-#define V_fw_tables_max		VNET(fw_tables_max)
-
-struct ip_fw_chain {
-	struct ip_fw	*rules;		/* list of rules */
-	struct ip_fw	*reap;		/* list of rules to reap */
-	struct ip_fw	*default_rule;
-	int		n_rules;	/* number of static rules */
-	int		static_len;	/* total len of static rules */
-	struct ip_fw	**map;		/* array of rule ptrs to ease lookup */
-	LIST_HEAD(nat_list, cfg_nat) nat;       /* list of nat entries */
-	struct radix_node_head **tables;	/* IPv4 tables */
-	struct radix_node_head **xtables;	/* extended tables */
-	uint8_t		*tabletype;	/* Array of table types */
-#if defined( __linux__ ) || defined( _WIN32 )
-	spinlock_t rwmtx;
-	spinlock_t uh_lock;
-#else
-	struct rwlock	rwmtx;
-	struct rwlock	uh_lock;	/* lock for upper half */
-#endif
-	uint32_t	id;		/* ruleset id */
-	uint32_t	gencnt;		/* generation count */
-};
-
-struct sockopt;	/* used by tcp_var.h */
-
-/*
- * The lock is heavily used by ip_fw2.c (the main file) and ip_fw_nat.c
- * so the variable and the macros must be here.
- */
-
-#define	IPFW_LOCK_INIT(_chain) do {			\
-	rw_init(&(_chain)->rwmtx, "IPFW static rules");	\
-	rw_init(&(_chain)->uh_lock, "IPFW UH lock");	\
-	} while (0)
-
-#define	IPFW_LOCK_DESTROY(_chain) do {			\
-	rw_destroy(&(_chain)->rwmtx);			\
-	rw_destroy(&(_chain)->uh_lock);			\
-	} while (0)
-
-#define	IPFW_WLOCK_ASSERT(_chain)	rw_assert(&(_chain)->rwmtx, RA_WLOCKED)
-
-#define IPFW_RLOCK(p) rw_rlock(&(p)->rwmtx)
-#define IPFW_RUNLOCK(p) rw_runlock(&(p)->rwmtx)
-#define IPFW_WLOCK(p) rw_wlock(&(p)->rwmtx)
-#define IPFW_WUNLOCK(p) rw_wunlock(&(p)->rwmtx)
-
-#define IPFW_UH_RLOCK(p) rw_rlock(&(p)->uh_lock)
-#define IPFW_UH_RUNLOCK(p) rw_runlock(&(p)->uh_lock)
-#define IPFW_UH_WLOCK(p) rw_wlock(&(p)->uh_lock)
-#define IPFW_UH_WUNLOCK(p) rw_wunlock(&(p)->uh_lock)
-
-/* In ip_fw_sockopt.c */
-int ipfw_find_rule(struct ip_fw_chain *chain, uint32_t key, uint32_t id);
-int ipfw_add_rule(struct ip_fw_chain *chain, struct ip_fw *input_rule);
-int ipfw_ctl(struct sockopt *sopt);
-int ipfw_chk(struct ip_fw_args *args);
-void ipfw_reap_rules(struct ip_fw *head);
-
-/* In ip_fw_pfil */
-int ipfw_check_hook(void *arg, struct mbuf **m0, struct ifnet *ifp, int dir,
-     struct inpcb *inp);
-
-/* In ip_fw_table.c */
-struct radix_node;
-int ipfw_lookup_table(struct ip_fw_chain *ch, uint16_t tbl, in_addr_t addr,
-    uint32_t *val);
-int ipfw_lookup_table_extended(struct ip_fw_chain *ch, uint16_t tbl, void *paddr,
-    uint32_t *val, int type);
-int ipfw_init_tables(struct ip_fw_chain *ch);
-void ipfw_destroy_tables(struct ip_fw_chain *ch);
-int ipfw_flush_table(struct ip_fw_chain *ch, uint16_t tbl);
-int ipfw_add_table_entry(struct ip_fw_chain *ch, uint16_t tbl, void *paddr,
-    uint8_t plen, uint8_t mlen, uint8_t type, uint32_t value);
-int ipfw_del_table_entry(struct ip_fw_chain *ch, uint16_t tbl, void *paddr,
-    uint8_t plen, uint8_t mlen, uint8_t type);
-int ipfw_count_table(struct ip_fw_chain *ch, uint32_t tbl, uint32_t *cnt);
-int ipfw_dump_table_entry(struct radix_node *rn, void *arg);
-int ipfw_dump_table(struct ip_fw_chain *ch, ipfw_table *tbl);
-int ipfw_count_xtable(struct ip_fw_chain *ch, uint32_t tbl, uint32_t *cnt);
-int ipfw_dump_xtable(struct ip_fw_chain *ch, ipfw_xtable *tbl);
-int ipfw_resize_tables(struct ip_fw_chain *ch, unsigned int ntables);
-
-/* In ip_fw_nat.c -- XXX to be moved to ip_var.h */
-
-extern struct cfg_nat *(*lookup_nat_ptr)(struct nat_list *, int);
-
-typedef int ipfw_nat_t(struct ip_fw_args *, struct cfg_nat *, struct mbuf *);
-typedef int ipfw_nat_cfg_t(struct sockopt *);
-
-extern ipfw_nat_t *ipfw_nat_ptr;
-#define IPFW_NAT_LOADED (ipfw_nat_ptr != NULL)
-
-extern ipfw_nat_cfg_t *ipfw_nat_cfg_ptr;
-extern ipfw_nat_cfg_t *ipfw_nat_del_ptr;
-extern ipfw_nat_cfg_t *ipfw_nat_get_cfg_ptr;
-extern ipfw_nat_cfg_t *ipfw_nat_get_log_ptr;
-
-#endif /* _KERNEL */
-#endif /* _IPFW2_PRIVATE_H */
diff --git a/sys/netinet/ipfw/ip_fw_sockopt.c b/sys/netinet/ipfw/ip_fw_sockopt.c
deleted file mode 100644
index 2a5f4e7c93fd..000000000000
--- a/sys/netinet/ipfw/ip_fw_sockopt.c
+++ /dev/null
@@ -1,1448 +0,0 @@
-/*-
- * Copyright (c) 2002-2009 Luigi Rizzo, Universita` di Pisa
- *
- * Supported by: Valeria Paoli
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
-
-/*
- * Sockopt support for ipfw. The routines here implement
- * the upper half of the ipfw code.
- */
-
-#include "opt_ipfw.h"
-#include "opt_inet.h"
-#ifndef INET
-#error IPFIREWALL requires INET.
-#endif /* INET */
-#include "opt_inet6.h"
-
-#include <sys/param.h>
-#include <sys/systm.h>
-#include <sys/malloc.h>
-#include <sys/mbuf.h>	/* struct m_tag used by nested headers */
-#include <sys/kernel.h>
-#include <sys/lock.h>
-#include <sys/priv.h>
-#include <sys/proc.h>
-#include <sys/rwlock.h>
-#include <sys/socket.h>
-#include <sys/socketvar.h>
-#include <sys/sysctl.h>
-#include <sys/syslog.h>
-#include <net/if.h>
-#include <net/route.h>
-#include <net/vnet.h>
-
-#include <netinet/in.h>
-#include <netinet/ip_var.h> /* hooks */
-#include <netinet/ip_fw.h>
-#include <netinet/ipfw/ip_fw_private.h>
-
-#ifdef MAC
-#include <security/mac/mac_framework.h>
-#endif
-
-MALLOC_DEFINE(M_IPFW, "IpFw/IpAcct", "IpFw/IpAcct chain's");
-
-/*
- * static variables followed by global ones (none in this file)
- */
-
-/*
- * Find the smallest rule >= key, id.
- * We could use bsearch but it is so simple that we code it directly
- */
-int
-ipfw_find_rule(struct ip_fw_chain *chain, uint32_t key, uint32_t id)
-{
-	int i, lo, hi;
-	struct ip_fw *r;
-
-  	for (lo = 0, hi = chain->n_rules - 1; lo < hi;) {
-		i = (lo + hi) / 2;
-		r = chain->map[i];
-		if (r->rulenum < key)
-			lo = i + 1;	/* continue from the next one */
-		else if (r->rulenum > key)
-			hi = i;		/* this might be good */
-		else if (r->id < id)
-			lo = i + 1;	/* continue from the next one */
-		else /* r->id >= id */
-			hi = i;		/* this might be good */
-	};
-	return hi;
-}
-
-/*
- * allocate a new map, returns the chain locked. extra is the number
- * of entries to add or delete.
- */
-static struct ip_fw **
-get_map(struct ip_fw_chain *chain, int extra, int locked)
-{
-
-	for (;;) {
-		struct ip_fw **map;
-		int i;
-
-		i = chain->n_rules + extra;
-		map = malloc(i * sizeof(struct ip_fw *), M_IPFW,
-			locked ? M_NOWAIT : M_WAITOK);
-		if (map == NULL) {
-			printf("%s: cannot allocate map\n", __FUNCTION__);
-			return NULL;
-		}
-		if (!locked)
-			IPFW_UH_WLOCK(chain);
-		if (i >= chain->n_rules + extra) /* good */
-			return map;
-		/* otherwise we lost the race, free and retry */
-		if (!locked)
-			IPFW_UH_WUNLOCK(chain);
-		free(map, M_IPFW);
-	}
-}
-
-/*
- * swap the maps. It is supposed to be called with IPFW_UH_WLOCK
- */
-static struct ip_fw **
-swap_map(struct ip_fw_chain *chain, struct ip_fw **new_map, int new_len)
-{
-	struct ip_fw **old_map;
-
-	IPFW_WLOCK(chain);
-	chain->id++;
-	chain->n_rules = new_len;
-	old_map = chain->map;
-	chain->map = new_map;
-	IPFW_WUNLOCK(chain);
-	return old_map;
-}
-
-/*
- * Add a new rule to the list. Copy the rule into a malloc'ed area, then
- * possibly create a rule number and add the rule to the list.
- * Update the rule_number in the input struct so the caller knows it as well.
- * XXX DO NOT USE FOR THE DEFAULT RULE.
- * Must be called without IPFW_UH held
- */
-int
-ipfw_add_rule(struct ip_fw_chain *chain, struct ip_fw *input_rule)
-{
-	struct ip_fw *rule;
-	int i, l, insert_before;
-	struct ip_fw **map;	/* the new array of pointers */
-
-	if (chain->rules == NULL || input_rule->rulenum > IPFW_DEFAULT_RULE-1)
-		return (EINVAL);
-
-	l = RULESIZE(input_rule);
-	rule = malloc(l, M_IPFW, M_WAITOK | M_ZERO);
-	/* get_map returns with IPFW_UH_WLOCK if successful */
-	map = get_map(chain, 1, 0 /* not locked */);
-	if (map == NULL) {
-		free(rule, M_IPFW);
-		return ENOSPC;
-	}
-
-	bcopy(input_rule, rule, l);
-	/* clear fields not settable from userland */
-	rule->x_next = NULL;
-	rule->next_rule = NULL;
-	rule->pcnt = 0;
-	rule->bcnt = 0;
-	rule->timestamp = 0;
-
-	if (V_autoinc_step < 1)
-		V_autoinc_step = 1;
-	else if (V_autoinc_step > 1000)
-		V_autoinc_step = 1000;
-	/* find the insertion point, we will insert before */
-	insert_before = rule->rulenum ? rule->rulenum + 1 : IPFW_DEFAULT_RULE;
-	i = ipfw_find_rule(chain, insert_before, 0);
-	/* duplicate first part */
-	if (i > 0)
-		bcopy(chain->map, map, i * sizeof(struct ip_fw *));
-	map[i] = rule;
-	/* duplicate remaining part, we always have the default rule */
-	bcopy(chain->map + i, map + i + 1,
-		sizeof(struct ip_fw *) *(chain->n_rules - i));
-	if (rule->rulenum == 0) {
-		/* write back the number */
-		rule->rulenum = i > 0 ? map[i-1]->rulenum : 0;
-		if (rule->rulenum < IPFW_DEFAULT_RULE - V_autoinc_step)
-			rule->rulenum += V_autoinc_step;
-		input_rule->rulenum = rule->rulenum;
-	}
-
-	rule->id = chain->id + 1;
-	map = swap_map(chain, map, chain->n_rules + 1);
-	chain->static_len += l;
-	IPFW_UH_WUNLOCK(chain);
-	if (map)
-		free(map, M_IPFW);
-	return (0);
-}
-
-/*
- * Reclaim storage associated with a list of rules.  This is
- * typically the list created using remove_rule.
- * A NULL pointer on input is handled correctly.
- */
-void
-ipfw_reap_rules(struct ip_fw *head)
-{
-	struct ip_fw *rule;
-
-	while ((rule = head) != NULL) {
-		head = head->x_next;
-		free(rule, M_IPFW);
-	}
-}
-
-/*
- * Used by del_entry() to check if a rule should be kept.
- * Returns 1 if the rule must be kept, 0 otherwise.
- *
- * Called with cmd = {0,1,5}.
- * cmd == 0 matches on rule numbers, excludes rules in RESVD_SET if n == 0 ;
- * cmd == 1 matches on set numbers only, rule numbers are ignored;
- * cmd == 5 matches on rule and set numbers.
- *
- * n == 0 is a wildcard for rule numbers, there is no wildcard for sets.
- *
- * Rules to keep are
- *	(default || reserved || !match_set || !match_number)
- * where
- *   default ::= (rule->rulenum == IPFW_DEFAULT_RULE)
- *	// the default rule is always protected
- *
- *   reserved ::= (cmd == 0 && n == 0 && rule->set == RESVD_SET)
- *	// RESVD_SET is protected only if cmd == 0 and n == 0 ("ipfw flush")
- *
- *   match_set ::= (cmd == 0 || rule->set == set)
- *	// set number is ignored for cmd == 0
- *
- *   match_number ::= (cmd == 1 || n == 0 || n == rule->rulenum)
- *	// number is ignored for cmd == 1 or n == 0
- *
- */
-static int
-keep_rule(struct ip_fw *rule, uint8_t cmd, uint8_t set, uint32_t n)
-{
-	return
-		 (rule->rulenum == IPFW_DEFAULT_RULE)		||
-		 (cmd == 0 && n == 0 && rule->set == RESVD_SET)	||
-		!(cmd == 0 || rule->set == set)			||
-		!(cmd == 1 || n == 0 || n == rule->rulenum);
-}
-
-/**
- * Remove all rules with given number, or do set manipulation.
- * Assumes chain != NULL && *chain != NULL.
- *
- * The argument is an uint32_t. The low 16 bit are the rule or set number;
- * the next 8 bits are the new set; the top 8 bits indicate the command:
- *
- *	0	delete rules numbered "rulenum"
- *	1	delete rules in set "rulenum"
- *	2	move rules "rulenum" to set "new_set"
- *	3	move rules from set "rulenum" to set "new_set"
- *	4	swap sets "rulenum" and "new_set"
- *	5	delete rules "rulenum" and set "new_set"
- */
-static int
-del_entry(struct ip_fw_chain *chain, uint32_t arg)
-{
-	struct ip_fw *rule;
-	uint32_t num;	/* rule number or old_set */
-	uint8_t cmd, new_set;
-	int start, end, i, ofs, n;
-	struct ip_fw **map = NULL;
-	int error = 0;
-
-	num = arg & 0xffff;
-	cmd = (arg >> 24) & 0xff;
-	new_set = (arg >> 16) & 0xff;
-
-	if (cmd > 5 || new_set > RESVD_SET)
-		return EINVAL;
-	if (cmd == 0 || cmd == 2 || cmd == 5) {
-		if (num >= IPFW_DEFAULT_RULE)
-			return EINVAL;
-	} else {
-		if (num > RESVD_SET)	/* old_set */
-			return EINVAL;
-	}
-
-	IPFW_UH_WLOCK(chain);	/* arbitrate writers */
-	chain->reap = NULL;	/* prepare for deletions */
-
-	switch (cmd) {
-	case 0:	/* delete rules "num" (num == 0 matches all) */
-	case 1:	/* delete all rules in set N */
-	case 5: /* delete rules with number N and set "new_set". */
-
-		/*
-		 * Locate first rule to delete (start), the rule after
-		 * the last one to delete (end), and count how many
-		 * rules to delete (n). Always use keep_rule() to
-		 * determine which rules to keep.
-		 */
-		n = 0;
-		if (cmd == 1) {
-			/* look for a specific set including RESVD_SET.
-			 * Must scan the entire range, ignore num.
-			 */
-			new_set = num;
-			for (start = -1, end = i = 0; i < chain->n_rules; i++) {
-				if (keep_rule(chain->map[i], cmd, new_set, 0))
-					continue;
-				if (start < 0)
-					start = i;
-				end = i;
-				n++;
-			}
-			end++;	/* first non-matching */
-		} else {
-			/* Optimized search on rule numbers */
-			start = ipfw_find_rule(chain, num, 0);
-			for (end = start; end < chain->n_rules; end++) {
-				rule = chain->map[end];
-				if (num > 0 && rule->rulenum != num)
-					break;
-				if (!keep_rule(rule, cmd, new_set, num))
-					n++;
-			}
-		}
-
-		if (n == 0) {
-			/* A flush request (arg == 0 or cmd == 1) on empty
-			 * ruleset returns with no error. On the contrary,
-			 * if there is no match on a specific request,
-			 * we return EINVAL.
-			 */
-			if (arg != 0 && cmd != 1)
-				error = EINVAL;
-			break;
-		}
-
-		/* We have something to delete. Allocate the new map */
-		map = get_map(chain, -n, 1 /* locked */);
-		if (map == NULL) {
-			error = EINVAL;
-			break;
-		}
-
-		/* 1. bcopy the initial part of the map */
-		if (start > 0)
-			bcopy(chain->map, map, start * sizeof(struct ip_fw *));
-		/* 2. copy active rules between start and end */
-		for (i = ofs = start; i < end; i++) {
-			rule = chain->map[i];
-			if (keep_rule(rule, cmd, new_set, num))
-				map[ofs++] = rule;
-		}
-		/* 3. copy the final part of the map */
-		bcopy(chain->map + end, map + ofs,
-			(chain->n_rules - end) * sizeof(struct ip_fw *));
-		/* 4. swap the maps (under BH_LOCK) */
-		map = swap_map(chain, map, chain->n_rules - n);
-		/* 5. now remove the rules deleted from the old map */
-		for (i = start; i < end; i++) {
-			int l;
-			rule = map[i];
-			if (keep_rule(rule, cmd, new_set, num))
-				continue;
-			l = RULESIZE(rule);
-			chain->static_len -= l;
-			ipfw_remove_dyn_children(rule);
-			rule->x_next = chain->reap;
-			chain->reap = rule;
-		}
-		break;
-
-	/*
-	 * In the next 3 cases the loop stops at (n_rules - 1)
-	 * because the default rule is never eligible..
-	 */
-
-	case 2:	/* move rules with given RULE number to new set */
-		for (i = 0; i < chain->n_rules - 1; i++) {
-			rule = chain->map[i];
-			if (rule->rulenum == num)
-				rule->set = new_set;
-		}
-		break;
-
-	case 3: /* move rules with given SET number to new set */
-		for (i = 0; i < chain->n_rules - 1; i++) {
-			rule = chain->map[i];
-			if (rule->set == num)
-				rule->set = new_set;
-		}
-		break;
-
-	case 4: /* swap two sets */
-		for (i = 0; i < chain->n_rules - 1; i++) {
-			rule = chain->map[i];
-			if (rule->set == num)
-				rule->set = new_set;
-			else if (rule->set == new_set)
-				rule->set = num;
-		}
-		break;
-	}
-
-	rule = chain->reap;
-	chain->reap = NULL;
-	IPFW_UH_WUNLOCK(chain);
-	ipfw_reap_rules(rule);
-	if (map)
-		free(map, M_IPFW);
-	return error;
-}
-
-/*
- * Clear counters for a specific rule.
- * Normally run under IPFW_UH_RLOCK, but these are idempotent ops
- * so we only care that rules do not disappear.
- */
-static void
-clear_counters(struct ip_fw *rule, int log_only)
-{
-	ipfw_insn_log *l = (ipfw_insn_log *)ACTION_PTR(rule);
-
-	if (log_only == 0) {
-		rule->bcnt = rule->pcnt = 0;
-		rule->timestamp = 0;
-	}
-	if (l->o.opcode == O_LOG)
-		l->log_left = l->max_log;
-}
-
-/**
- * Reset some or all counters on firewall rules.
- * The argument `arg' is an u_int32_t. The low 16 bit are the rule number,
- * the next 8 bits are the set number, the top 8 bits are the command:
- *	0	work with rules from all set's;
- *	1	work with rules only from specified set.
- * Specified rule number is zero if we want to clear all entries.
- * log_only is 1 if we only want to reset logs, zero otherwise.
- */
-static int
-zero_entry(struct ip_fw_chain *chain, u_int32_t arg, int log_only)
-{
-	struct ip_fw *rule;
-	char *msg;
-	int i;
-
-	uint16_t rulenum = arg & 0xffff;
-	uint8_t set = (arg >> 16) & 0xff;
-	uint8_t cmd = (arg >> 24) & 0xff;
-
-	if (cmd > 1)
-		return (EINVAL);
-	if (cmd == 1 && set > RESVD_SET)
-		return (EINVAL);
-
-	IPFW_UH_RLOCK(chain);
-	if (rulenum == 0) {
-		V_norule_counter = 0;
-		for (i = 0; i < chain->n_rules; i++) {
-			rule = chain->map[i];
-			/* Skip rules not in our set. */
-			if (cmd == 1 && rule->set != set)
-				continue;
-			clear_counters(rule, log_only);
-		}
-		msg = log_only ? "All logging counts reset" :
-		    "Accounting cleared";
-	} else {
-		int cleared = 0;
-		for (i = 0; i < chain->n_rules; i++) {
-			rule = chain->map[i];
-			if (rule->rulenum == rulenum) {
-				if (cmd == 0 || rule->set == set)
-					clear_counters(rule, log_only);
-				cleared = 1;
-			}
-			if (rule->rulenum > rulenum)
-				break;
-		}
-		if (!cleared) {	/* we did not find any matching rules */
-			IPFW_UH_RUNLOCK(chain);
-			return (EINVAL);
-		}
-		msg = log_only ? "logging count reset" : "cleared";
-	}
-	IPFW_UH_RUNLOCK(chain);
-
-	if (V_fw_verbose) {
-		int lev = LOG_SECURITY | LOG_NOTICE;
-
-		if (rulenum)
-			log(lev, "ipfw: Entry %d %s.\n", rulenum, msg);
-		else
-			log(lev, "ipfw: %s.\n", msg);
-	}
-	return (0);
-}
-
-/*
- * Check validity of the structure before insert.
- * Rules are simple, so this mostly need to check rule sizes.
- */
-static int
-check_ipfw_struct(struct ip_fw *rule, int size)
-{
-	int l, cmdlen = 0;
-	int have_action=0;
-	ipfw_insn *cmd;
-
-	if (size < sizeof(*rule)) {
-		printf("ipfw: rule too short\n");
-		return (EINVAL);
-	}
-	/* first, check for valid size */
-	l = RULESIZE(rule);
-	if (l != size) {
-		printf("ipfw: size mismatch (have %d want %d)\n", size, l);
-		return (EINVAL);
-	}
-	if (rule->act_ofs >= rule->cmd_len) {
-		printf("ipfw: bogus action offset (%u > %u)\n",
-		    rule->act_ofs, rule->cmd_len - 1);
-		return (EINVAL);
-	}
-	/*
-	 * Now go for the individual checks. Very simple ones, basically only
-	 * instruction sizes.
-	 */
-	for (l = rule->cmd_len, cmd = rule->cmd ;
-			l > 0 ; l -= cmdlen, cmd += cmdlen) {
-		cmdlen = F_LEN(cmd);
-		if (cmdlen > l) {
-			printf("ipfw: opcode %d size truncated\n",
-			    cmd->opcode);
-			return EINVAL;
-		}
-		switch (cmd->opcode) {
-		case O_PROBE_STATE:
-		case O_KEEP_STATE:
-		case O_PROTO:
-		case O_IP_SRC_ME:
-		case O_IP_DST_ME:
-		case O_LAYER2:
-		case O_IN:
-		case O_FRAG:
-		case O_DIVERTED:
-		case O_IPOPT:
-		case O_IPTOS:
-		case O_IPPRECEDENCE:
-		case O_IPVER:
-		case O_SOCKARG:
-		case O_TCPFLAGS:
-		case O_TCPOPTS:
-		case O_ESTAB:
-		case O_VERREVPATH:
-		case O_VERSRCREACH:
-		case O_ANTISPOOF:
-		case O_IPSEC:
-#ifdef INET6
-		case O_IP6_SRC_ME:
-		case O_IP6_DST_ME:
-		case O_EXT_HDR:
-		case O_IP6:
-#endif
-		case O_IP4:
-		case O_TAG:
-			if (cmdlen != F_INSN_SIZE(ipfw_insn))
-				goto bad_size;
-			break;
-
-		case O_FIB:
-			if (cmdlen != F_INSN_SIZE(ipfw_insn))
-				goto bad_size;
-			if (cmd->arg1 >= rt_numfibs) {
-				printf("ipfw: invalid fib number %d\n",
-					cmd->arg1);
-				return EINVAL;
-			}
-			break;
-
-		case O_SETFIB:
-			if (cmdlen != F_INSN_SIZE(ipfw_insn))
-				goto bad_size;
-			if ((cmd->arg1 != IP_FW_TABLEARG) &&
-			    (cmd->arg1 >= rt_numfibs)) {
-				printf("ipfw: invalid fib number %d\n",
-					cmd->arg1);
-				return EINVAL;
-			}
-			goto check_action;
-
-		case O_UID:
-		case O_GID:
-		case O_JAIL:
-		case O_IP_SRC:
-		case O_IP_DST:
-		case O_TCPSEQ:
-		case O_TCPACK:
-		case O_PROB:
-		case O_ICMPTYPE:
-			if (cmdlen != F_INSN_SIZE(ipfw_insn_u32))
-				goto bad_size;
-			break;
-
-		case O_LIMIT:
-			if (cmdlen != F_INSN_SIZE(ipfw_insn_limit))
-				goto bad_size;
-			break;
-
-		case O_LOG:
-			if (cmdlen != F_INSN_SIZE(ipfw_insn_log))
-				goto bad_size;
-
-			((ipfw_insn_log *)cmd)->log_left =
-			    ((ipfw_insn_log *)cmd)->max_log;
-
-			break;
-
-		case O_IP_SRC_MASK:
-		case O_IP_DST_MASK:
-			/* only odd command lengths */
-			if ( !(cmdlen & 1) || cmdlen > 31)
-				goto bad_size;
-			break;
-
-		case O_IP_SRC_SET:
-		case O_IP_DST_SET:
-			if (cmd->arg1 == 0 || cmd->arg1 > 256) {
-				printf("ipfw: invalid set size %d\n",
-					cmd->arg1);
-				return EINVAL;
-			}
-			if (cmdlen != F_INSN_SIZE(ipfw_insn_u32) +
-			    (cmd->arg1+31)/32 )
-				goto bad_size;
-			break;
-
-		case O_IP_SRC_LOOKUP:
-		case O_IP_DST_LOOKUP:
-			if (cmd->arg1 >= IPFW_TABLES_MAX) {
-				printf("ipfw: invalid table number %d\n",
-				    cmd->arg1);
-				return (EINVAL);
-			}
-			if (cmdlen != F_INSN_SIZE(ipfw_insn) &&
-			    cmdlen != F_INSN_SIZE(ipfw_insn_u32) + 1 &&
-			    cmdlen != F_INSN_SIZE(ipfw_insn_u32))
-				goto bad_size;
-			break;
-		case O_MACADDR2:
-			if (cmdlen != F_INSN_SIZE(ipfw_insn_mac))
-				goto bad_size;
-			break;
-
-		case O_NOP:
-		case O_IPID:
-		case O_IPTTL:
-		case O_IPLEN:
-		case O_TCPDATALEN:
-		case O_TCPWIN:
-		case O_TAGGED:
-			if (cmdlen < 1 || cmdlen > 31)
-				goto bad_size;
-			break;
-
-		case O_MAC_TYPE:
-		case O_IP_SRCPORT:
-		case O_IP_DSTPORT: /* XXX artificial limit, 30 port pairs */
-			if (cmdlen < 2 || cmdlen > 31)
-				goto bad_size;
-			break;
-
-		case O_RECV:
-		case O_XMIT:
-		case O_VIA:
-			if (cmdlen != F_INSN_SIZE(ipfw_insn_if))
-				goto bad_size;
-			break;
-
-		case O_ALTQ:
-			if (cmdlen != F_INSN_SIZE(ipfw_insn_altq))
-				goto bad_size;
-			break;
-
-		case O_PIPE:
-		case O_QUEUE:
-			if (cmdlen != F_INSN_SIZE(ipfw_insn))
-				goto bad_size;
-			goto check_action;
-
-		case O_FORWARD_IP:
-#ifdef	IPFIREWALL_FORWARD
-			if (cmdlen != F_INSN_SIZE(ipfw_insn_sa))
-				goto bad_size;
-			goto check_action;
-#else
-			return EINVAL;
-#endif
-
-#ifdef INET6
-		case O_FORWARD_IP6:
-#ifdef IPFIREWALL_FORWARD
-			if (cmdlen != F_INSN_SIZE(ipfw_insn_sa6))
-				goto bad_size;
-			goto check_action;
-#else
-			return (EINVAL);
-#endif
-#endif /* INET6 */
-
-		case O_DIVERT:
-		case O_TEE:
-			if (ip_divert_ptr == NULL)
-				return EINVAL;
-			else
-				goto check_size;
-		case O_NETGRAPH:
-		case O_NGTEE:
-			if (ng_ipfw_input_p == NULL)
-				return EINVAL;
-			else
-				goto check_size;
-		case O_NAT:
-			if (!IPFW_NAT_LOADED)
-				return EINVAL;
-			if (cmdlen != F_INSN_SIZE(ipfw_insn_nat))
- 				goto bad_size;		
- 			goto check_action;
-		case O_FORWARD_MAC: /* XXX not implemented yet */
-		case O_CHECK_STATE:
-		case O_COUNT:
-		case O_ACCEPT:
-		case O_DENY:
-		case O_REJECT:
-#ifdef INET6
-		case O_UNREACH6:
-#endif
-		case O_SKIPTO:
-		case O_REASS:
-		case O_CALLRETURN:
-check_size:
-			if (cmdlen != F_INSN_SIZE(ipfw_insn))
-				goto bad_size;
-check_action:
-			if (have_action) {
-				printf("ipfw: opcode %d, multiple actions"
-					" not allowed\n",
-					cmd->opcode);
-				return EINVAL;
-			}
-			have_action = 1;
-			if (l != cmdlen) {
-				printf("ipfw: opcode %d, action must be"
-					" last opcode\n",
-					cmd->opcode);
-				return EINVAL;
-			}
-			break;
-#ifdef INET6
-		case O_IP6_SRC:
-		case O_IP6_DST:
-			if (cmdlen != F_INSN_SIZE(struct in6_addr) +
-			    F_INSN_SIZE(ipfw_insn))
-				goto bad_size;
-			break;
-
-		case O_FLOW6ID:
-			if (cmdlen != F_INSN_SIZE(ipfw_insn_u32) +
-			    ((ipfw_insn_u32 *)cmd)->o.arg1)
-				goto bad_size;
-			break;
-
-		case O_IP6_SRC_MASK:
-		case O_IP6_DST_MASK:
-			if ( !(cmdlen & 1) || cmdlen > 127)
-				goto bad_size;
-			break;
-		case O_ICMP6TYPE:
-			if( cmdlen != F_INSN_SIZE( ipfw_insn_icmp6 ) )
-				goto bad_size;
-			break;
-#endif
-
-		default:
-			switch (cmd->opcode) {
-#ifndef INET6
-			case O_IP6_SRC_ME:
-			case O_IP6_DST_ME:
-			case O_EXT_HDR:
-			case O_IP6:
-			case O_UNREACH6:
-			case O_IP6_SRC:
-			case O_IP6_DST:
-			case O_FLOW6ID:
-			case O_IP6_SRC_MASK:
-			case O_IP6_DST_MASK:
-			case O_ICMP6TYPE:
-				printf("ipfw: no IPv6 support in kernel\n");
-				return EPROTONOSUPPORT;
-#endif
-			default:
-				printf("ipfw: opcode %d, unknown opcode\n",
-					cmd->opcode);
-				return EINVAL;
-			}
-		}
-	}
-	if (have_action == 0) {
-		printf("ipfw: missing action\n");
-		return EINVAL;
-	}
-	return 0;
-
-bad_size:
-	printf("ipfw: opcode %d size %d wrong\n",
-		cmd->opcode, cmdlen);
-	return EINVAL;
-}
-
-
-/*
- * Translation of requests for compatibility with FreeBSD 7.2/8.
- * a static variable tells us if we have an old client from userland,
- * and if necessary we translate requests and responses between the
- * two formats.
- */
-static int is7 = 0;
-
-struct ip_fw7 {
-	struct ip_fw7	*next;		/* linked list of rules     */
-	struct ip_fw7	*next_rule;	/* ptr to next [skipto] rule    */
-	/* 'next_rule' is used to pass up 'set_disable' status      */
-
-	uint16_t	act_ofs;	/* offset of action in 32-bit units */
-	uint16_t	cmd_len;	/* # of 32-bit words in cmd */
-	uint16_t	rulenum;	/* rule number          */
-	uint8_t		set;		/* rule set (0..31)     */
-	// #define RESVD_SET   31  /* set for default and persistent rules */
-	uint8_t		_pad;		/* padding          */
-	// uint32_t        id;             /* rule id, only in v.8 */
-	/* These fields are present in all rules.           */
-	uint64_t	pcnt;		/* Packet counter       */
-	uint64_t	bcnt;		/* Byte counter         */
-	uint32_t	timestamp;	/* tv_sec of last match     */
-
-	ipfw_insn	cmd[1];		/* storage for commands     */
-};
-
-	int convert_rule_to_7(struct ip_fw *rule);
-int convert_rule_to_8(struct ip_fw *rule);
-
-#ifndef RULESIZE7
-#define RULESIZE7(rule)  (sizeof(struct ip_fw7) + \
-	((struct ip_fw7 *)(rule))->cmd_len * 4 - 4)
-#endif
-
-
-/*
- * Copy the static and dynamic rules to the supplied buffer
- * and return the amount of space actually used.
- * Must be run under IPFW_UH_RLOCK
- */
-static size_t
-ipfw_getrules(struct ip_fw_chain *chain, void *buf, size_t space)
-{
-	char *bp = buf;
-	char *ep = bp + space;
-	struct ip_fw *rule, *dst;
-	int l, i;
-	time_t	boot_seconds;
-
-        boot_seconds = boottime.tv_sec;
-	for (i = 0; i < chain->n_rules; i++) {
-		rule = chain->map[i];
-
-		if (is7) {
-		    /* Convert rule to FreeBSd 7.2 format */
-		    l = RULESIZE7(rule);
-		    if (bp + l + sizeof(uint32_t) <= ep) {
-			int error;
-			bcopy(rule, bp, l + sizeof(uint32_t));
-			error = convert_rule_to_7((struct ip_fw *) bp);
-			if (error)
-				return 0; /*XXX correct? */
-			/*
-			 * XXX HACK. Store the disable mask in the "next"
-			 * pointer in a wild attempt to keep the ABI the same.
-			 * Why do we do this on EVERY rule?
-			 */
-			bcopy(&V_set_disable,
-				&(((struct ip_fw7 *)bp)->next_rule),
-				sizeof(V_set_disable));
-			if (((struct ip_fw7 *)bp)->timestamp)
-			    ((struct ip_fw7 *)bp)->timestamp += boot_seconds;
-			bp += l;
-		    }
-		    continue; /* go to next rule */
-		}
-
-		/* normal mode, don't touch rules */
-		l = RULESIZE(rule);
-		if (bp + l > ep) { /* should not happen */
-			printf("overflow dumping static rules\n");
-			break;
-		}
-		dst = (struct ip_fw *)bp;
-		bcopy(rule, dst, l);
-		/*
-		 * XXX HACK. Store the disable mask in the "next"
-		 * pointer in a wild attempt to keep the ABI the same.
-		 * Why do we do this on EVERY rule?
-		 */
-		bcopy(&V_set_disable, &dst->next_rule, sizeof(V_set_disable));
-		if (dst->timestamp)
-			dst->timestamp += boot_seconds;
-		bp += l;
-	}
-	ipfw_get_dynamic(&bp, ep); /* protected by the dynamic lock */
-	return (bp - (char *)buf);
-}
-
-
-#define IP_FW3_OPLENGTH(x)	((x)->sopt_valsize - sizeof(ip_fw3_opheader))
-/**
- * {set|get}sockopt parser.
- */
-int
-ipfw_ctl(struct sockopt *sopt)
-{
-#define	RULE_MAXSIZE	(256*sizeof(u_int32_t))
-	int error;
-	size_t size, len, valsize;
-	struct ip_fw *buf, *rule;
-	struct ip_fw_chain *chain;
-	u_int32_t rulenum[2];
-	uint32_t opt;
-	char xbuf[128];
-	ip_fw3_opheader *op3 = NULL;
-
-	error = priv_check(sopt->sopt_td, PRIV_NETINET_IPFW);
-	if (error)
-		return (error);
-
-	/*
-	 * Disallow modifications in really-really secure mode, but still allow
-	 * the logging counters to be reset.
-	 */
-	if (sopt->sopt_name == IP_FW_ADD ||
-	    (sopt->sopt_dir == SOPT_SET && sopt->sopt_name != IP_FW_RESETLOG)) {
-		error = securelevel_ge(sopt->sopt_td->td_ucred, 3);
-		if (error)
-			return (error);
-	}
-
-	chain = &V_layer3_chain;
-	error = 0;
-
-	/* Save original valsize before it is altered via sooptcopyin() */
-	valsize = sopt->sopt_valsize;
-	if ((opt = sopt->sopt_name) == IP_FW3) {
-		/* 
-		 * Copy not less than sizeof(ip_fw3_opheader).
-		 * We hope any IP_FW3 command will fit into 128-byte buffer.
-		 */
-		if ((error = sooptcopyin(sopt, xbuf, sizeof(xbuf),
-			sizeof(ip_fw3_opheader))) != 0)
-			return (error);
-		op3 = (ip_fw3_opheader *)xbuf;
-		opt = op3->opcode;
-	}
-
-	switch (opt) {
-	case IP_FW_GET:
-		/*
-		 * pass up a copy of the current rules. Static rules
-		 * come first (the last of which has number IPFW_DEFAULT_RULE),
-		 * followed by a possibly empty list of dynamic rule.
-		 * The last dynamic rule has NULL in the "next" field.
-		 *
-		 * Note that the calculated size is used to bound the
-		 * amount of data returned to the user.  The rule set may
-		 * change between calculating the size and returning the
-		 * data in which case we'll just return what fits.
-		 */
-		for (;;) {
-			int len = 0, want;
-
-			size = chain->static_len;
-			size += ipfw_dyn_len();
-			if (size >= sopt->sopt_valsize)
-				break;
-			buf = malloc(size, M_TEMP, M_WAITOK);
-			IPFW_UH_RLOCK(chain);
-			/* check again how much space we need */
-			want = chain->static_len + ipfw_dyn_len();
-			if (size >= want)
-				len = ipfw_getrules(chain, buf, size);
-			IPFW_UH_RUNLOCK(chain);
-			if (size >= want)
-				error = sooptcopyout(sopt, buf, len);
-			free(buf, M_TEMP);
-			if (size >= want)
-				break;
-		}
-		break;
-
-	case IP_FW_FLUSH:
-		/* locking is done within del_entry() */
-		error = del_entry(chain, 0); /* special case, rule=0, cmd=0 means all */
-		break;
-
-	case IP_FW_ADD:
-		rule = malloc(RULE_MAXSIZE, M_TEMP, M_WAITOK);
-		error = sooptcopyin(sopt, rule, RULE_MAXSIZE,
-			sizeof(struct ip_fw7) );
-
-		/*
-		 * If the size of commands equals RULESIZE7 then we assume
-		 * a FreeBSD7.2 binary is talking to us (set is7=1).
-		 * is7 is persistent so the next 'ipfw list' command
-		 * will use this format.
-		 * NOTE: If wrong version is guessed (this can happen if
-		 *       the first ipfw command is 'ipfw [pipe] list')
-		 *       the ipfw binary may crash or loop infinitly...
-		 */
-		if (sopt->sopt_valsize == RULESIZE7(rule)) {
-		    is7 = 1;
-		    error = convert_rule_to_8(rule);
-		    if (error)
-			return error;
-		    if (error == 0)
-			error = check_ipfw_struct(rule, RULESIZE(rule));
-		} else {
-		    is7 = 0;
-		if (error == 0)
-			error = check_ipfw_struct(rule, sopt->sopt_valsize);
-		}
-		if (error == 0) {
-			/* locking is done within ipfw_add_rule() */
-			error = ipfw_add_rule(chain, rule);
-			size = RULESIZE(rule);
-			if (!error && sopt->sopt_dir == SOPT_GET) {
-				if (is7) {
-					error = convert_rule_to_7(rule);
-					size = RULESIZE7(rule);
-					if (error)
-						return error;
-				}
-				error = sooptcopyout(sopt, rule, size);
-		}
-		}
-		free(rule, M_TEMP);
-		break;
-
-	case IP_FW_DEL:
-		/*
-		 * IP_FW_DEL is used for deleting single rules or sets,
-		 * and (ab)used to atomically manipulate sets. Argument size
-		 * is used to distinguish between the two:
-		 *    sizeof(u_int32_t)
-		 *	delete single rule or set of rules,
-		 *	or reassign rules (or sets) to a different set.
-		 *    2*sizeof(u_int32_t)
-		 *	atomic disable/enable sets.
-		 *	first u_int32_t contains sets to be disabled,
-		 *	second u_int32_t contains sets to be enabled.
-		 */
-		error = sooptcopyin(sopt, rulenum,
-			2*sizeof(u_int32_t), sizeof(u_int32_t));
-		if (error)
-			break;
-		size = sopt->sopt_valsize;
-		if (size == sizeof(u_int32_t) && rulenum[0] != 0) {
-			/* delete or reassign, locking done in del_entry() */
-			error = del_entry(chain, rulenum[0]);
-		} else if (size == 2*sizeof(u_int32_t)) { /* set enable/disable */
-			IPFW_UH_WLOCK(chain);
-			V_set_disable =
-			    (V_set_disable | rulenum[0]) & ~rulenum[1] &
-			    ~(1<<RESVD_SET); /* set RESVD_SET always enabled */
-			IPFW_UH_WUNLOCK(chain);
-		} else
-			error = EINVAL;
-		break;
-
-	case IP_FW_ZERO:
-	case IP_FW_RESETLOG: /* argument is an u_int_32, the rule number */
-		rulenum[0] = 0;
-		if (sopt->sopt_val != 0) {
-		    error = sooptcopyin(sopt, rulenum,
-			    sizeof(u_int32_t), sizeof(u_int32_t));
-		    if (error)
-			break;
-		}
-		error = zero_entry(chain, rulenum[0],
-			sopt->sopt_name == IP_FW_RESETLOG);
-		break;
-
-	/*--- TABLE manipulations are protected by the IPFW_LOCK ---*/
-	case IP_FW_TABLE_ADD:
-		{
-			ipfw_table_entry ent;
-
-			error = sooptcopyin(sopt, &ent,
-			    sizeof(ent), sizeof(ent));
-			if (error)
-				break;
-			error = ipfw_add_table_entry(chain, ent.tbl,
-			    &ent.addr, sizeof(ent.addr), ent.masklen, 
-			    IPFW_TABLE_CIDR, ent.value);
-		}
-		break;
-
-	case IP_FW_TABLE_DEL:
-		{
-			ipfw_table_entry ent;
-
-			error = sooptcopyin(sopt, &ent,
-			    sizeof(ent), sizeof(ent));
-			if (error)
-				break;
-			error = ipfw_del_table_entry(chain, ent.tbl,
-			    &ent.addr, sizeof(ent.addr), ent.masklen, IPFW_TABLE_CIDR);
-		}
-		break;
-
-	case IP_FW_TABLE_XADD: /* IP_FW3 */
-	case IP_FW_TABLE_XDEL: /* IP_FW3 */
-		{
-			ipfw_table_xentry *xent = (ipfw_table_xentry *)(op3 + 1);
-
-			/* Check minimum header size */
-			if (IP_FW3_OPLENGTH(sopt) < offsetof(ipfw_table_xentry, k)) {
-				error = EINVAL;
-				break;
-			}
-
-			/* Check if len field is valid */
-			if (xent->len > sizeof(ipfw_table_xentry)) {
-				error = EINVAL;
-				break;
-			}
-			
-			len = xent->len - offsetof(ipfw_table_xentry, k);
-
-			error = (opt == IP_FW_TABLE_XADD) ?
-				ipfw_add_table_entry(chain, xent->tbl, &xent->k, 
-					len, xent->masklen, xent->type, xent->value) :
-				ipfw_del_table_entry(chain, xent->tbl, &xent->k,
-					len, xent->masklen, xent->type);
-		}
-		break;
-
-	case IP_FW_TABLE_FLUSH:
-		{
-			u_int16_t tbl;
-
-			error = sooptcopyin(sopt, &tbl,
-			    sizeof(tbl), sizeof(tbl));
-			if (error)
-				break;
-			error = ipfw_flush_table(chain, tbl);
-		}
-		break;
-
-	case IP_FW_TABLE_GETSIZE:
-		{
-			u_int32_t tbl, cnt;
-
-			if ((error = sooptcopyin(sopt, &tbl, sizeof(tbl),
-			    sizeof(tbl))))
-				break;
-			IPFW_RLOCK(chain);
-			error = ipfw_count_table(chain, tbl, &cnt);
-			IPFW_RUNLOCK(chain);
-			if (error)
-				break;
-			error = sooptcopyout(sopt, &cnt, sizeof(cnt));
-		}
-		break;
-
-	case IP_FW_TABLE_LIST:
-		{
-			ipfw_table *tbl;
-
-			if (sopt->sopt_valsize < sizeof(*tbl)) {
-				error = EINVAL;
-				break;
-			}
-			size = sopt->sopt_valsize;
-			tbl = malloc(size, M_TEMP, M_WAITOK);
-			error = sooptcopyin(sopt, tbl, size, sizeof(*tbl));
-			if (error) {
-				free(tbl, M_TEMP);
-				break;
-			}
-			tbl->size = (size - sizeof(*tbl)) /
-			    sizeof(ipfw_table_entry);
-			IPFW_RLOCK(chain);
-			error = ipfw_dump_table(chain, tbl);
-			IPFW_RUNLOCK(chain);
-			if (error) {
-				free(tbl, M_TEMP);
-				break;
-			}
-			error = sooptcopyout(sopt, tbl, size);
-			free(tbl, M_TEMP);
-		}
-		break;
-
-	case IP_FW_TABLE_XGETSIZE: /* IP_FW3 */
-		{
-			uint32_t *tbl;
-
-			if (IP_FW3_OPLENGTH(sopt) < sizeof(uint32_t)) {
-				error = EINVAL;
-				break;
-			}
-
-			tbl = (uint32_t *)(op3 + 1);
-
-			IPFW_RLOCK(chain);
-			error = ipfw_count_xtable(chain, *tbl, tbl);
-			IPFW_RUNLOCK(chain);
-			if (error)
-				break;
-			error = sooptcopyout(sopt, op3, sopt->sopt_valsize);
-		}
-		break;
-
-	case IP_FW_TABLE_XLIST: /* IP_FW3 */
-		{
-			ipfw_xtable *tbl;
-
-			if ((size = valsize) < sizeof(ipfw_xtable)) {
-				error = EINVAL;
-				break;
-			}
-
-			tbl = malloc(size, M_TEMP, M_ZERO | M_WAITOK);
-			memcpy(tbl, op3, sizeof(ipfw_xtable));
-
-			/* Get maximum number of entries we can store */
-			tbl->size = (size - sizeof(ipfw_xtable)) /
-			    sizeof(ipfw_table_xentry);
-			IPFW_RLOCK(chain);
-			error = ipfw_dump_xtable(chain, tbl);
-			IPFW_RUNLOCK(chain);
-			if (error) {
-				free(tbl, M_TEMP);
-				break;
-			}
-
-			/* Revert size field back to bytes */
-			tbl->size = tbl->size * sizeof(ipfw_table_xentry) +
-				sizeof(ipfw_table);
-			/* 
-			 * Since we call sooptcopyin() with small buffer, sopt_valsize is
-			 * decreased to reflect supplied buffer size. Set it back to original value
-			 */
-			sopt->sopt_valsize = valsize;
-			error = sooptcopyout(sopt, tbl, size);
-			free(tbl, M_TEMP);
-		}
-		break;
-
-	/*--- NAT operations are protected by the IPFW_LOCK ---*/
-	case IP_FW_NAT_CFG:
-		if (IPFW_NAT_LOADED)
-			error = ipfw_nat_cfg_ptr(sopt);
-		else {
-			printf("IP_FW_NAT_CFG: %s\n",
-			    "ipfw_nat not present, please load it");
-			error = EINVAL;
-		}
-		break;
-
-	case IP_FW_NAT_DEL:
-		if (IPFW_NAT_LOADED)
-			error = ipfw_nat_del_ptr(sopt);
-		else {
-			printf("IP_FW_NAT_DEL: %s\n",
-			    "ipfw_nat not present, please load it");
-			error = EINVAL;
-		}
-		break;
-
-	case IP_FW_NAT_GET_CONFIG:
-		if (IPFW_NAT_LOADED)
-			error = ipfw_nat_get_cfg_ptr(sopt);
-		else {
-			printf("IP_FW_NAT_GET_CFG: %s\n",
-			    "ipfw_nat not present, please load it");
-			error = EINVAL;
-		}
-		break;
-
-	case IP_FW_NAT_GET_LOG:
-		if (IPFW_NAT_LOADED)
-			error = ipfw_nat_get_log_ptr(sopt);
-		else {
-			printf("IP_FW_NAT_GET_LOG: %s\n",
-			    "ipfw_nat not present, please load it");
-			error = EINVAL;
-		}
-		break;
-
-	default:
-		printf("ipfw: ipfw_ctl invalid option %d\n", sopt->sopt_name);
-		error = EINVAL;
-	}
-
-	return (error);
-#undef RULE_MAXSIZE
-}
-
-
-#define	RULE_MAXSIZE	(256*sizeof(u_int32_t))
-
-/* Functions to convert rules 7.2 <==> 8.0 */
-int
-convert_rule_to_7(struct ip_fw *rule)
-{
-	/* Used to modify original rule */
-	struct ip_fw7 *rule7 = (struct ip_fw7 *)rule;
-	/* copy of original rule, version 8 */
-	struct ip_fw *tmp;
-
-	/* Used to copy commands */
-	ipfw_insn *ccmd, *dst;
-	int ll = 0, ccmdlen = 0;
-
-	tmp = malloc(RULE_MAXSIZE, M_TEMP, M_NOWAIT | M_ZERO);
-	if (tmp == NULL) {
-		return 1; //XXX error
-	}
-	bcopy(rule, tmp, RULE_MAXSIZE);
-
-	/* Copy fields */
-	rule7->_pad = tmp->_pad;
-	rule7->set = tmp->set;
-	rule7->rulenum = tmp->rulenum;
-	rule7->cmd_len = tmp->cmd_len;
-	rule7->act_ofs = tmp->act_ofs;
-	rule7->next_rule = (struct ip_fw7 *)tmp->next_rule;
-	rule7->next = (struct ip_fw7 *)tmp->x_next;
-	rule7->cmd_len = tmp->cmd_len;
-	rule7->pcnt = tmp->pcnt;
-	rule7->bcnt = tmp->bcnt;
-	rule7->timestamp = tmp->timestamp;
-
-	/* Copy commands */
-	for (ll = tmp->cmd_len, ccmd = tmp->cmd, dst = rule7->cmd ;
-			ll > 0 ; ll -= ccmdlen, ccmd += ccmdlen, dst += ccmdlen) {
-		ccmdlen = F_LEN(ccmd);
-
-		bcopy(ccmd, dst, F_LEN(ccmd)*sizeof(uint32_t));
-
-		if (dst->opcode > O_NAT)
-			/* O_REASS doesn't exists in 7.2 version, so
-			 * decrement opcode if it is after O_REASS
-			 */
-			dst->opcode--;
-
-		if (ccmdlen > ll) {
-			printf("ipfw: opcode %d size truncated\n",
-				ccmd->opcode);
-			return EINVAL;
-		}
-	}
-	free(tmp, M_TEMP);
-
-	return 0;
-}
-
-int
-convert_rule_to_8(struct ip_fw *rule)
-{
-	/* Used to modify original rule */
-	struct ip_fw7 *rule7 = (struct ip_fw7 *) rule;
-
-	/* Used to copy commands */
-	ipfw_insn *ccmd, *dst;
-	int ll = 0, ccmdlen = 0;
-
-	/* Copy of original rule */
-	struct ip_fw7 *tmp = malloc(RULE_MAXSIZE, M_TEMP, M_NOWAIT | M_ZERO);
-	if (tmp == NULL) {
-		return 1; //XXX error
-	}
-
-	bcopy(rule7, tmp, RULE_MAXSIZE);
-
-	for (ll = tmp->cmd_len, ccmd = tmp->cmd, dst = rule->cmd ;
-			ll > 0 ; ll -= ccmdlen, ccmd += ccmdlen, dst += ccmdlen) {
-		ccmdlen = F_LEN(ccmd);
-		
-		bcopy(ccmd, dst, F_LEN(ccmd)*sizeof(uint32_t));
-
-		if (dst->opcode > O_NAT)
-			/* O_REASS doesn't exists in 7.2 version, so
-			 * increment opcode if it is after O_REASS
-			 */
-			dst->opcode++;
-
-		if (ccmdlen > ll) {
-			printf("ipfw: opcode %d size truncated\n",
-			    ccmd->opcode);
-			return EINVAL;
-		}
-	}
-
-	rule->_pad = tmp->_pad;
-	rule->set = tmp->set;
-	rule->rulenum = tmp->rulenum;
-	rule->cmd_len = tmp->cmd_len;
-	rule->act_ofs = tmp->act_ofs;
-	rule->next_rule = (struct ip_fw *)tmp->next_rule;
-	rule->x_next = (struct ip_fw *)tmp->next;
-	rule->cmd_len = tmp->cmd_len;
-	rule->id = 0; /* XXX see if is ok = 0 */
-	rule->pcnt = tmp->pcnt;
-	rule->bcnt = tmp->bcnt;
-	rule->timestamp = tmp->timestamp;
-
-	free (tmp, M_TEMP);
-	return 0;
-}
-
-/* end of file */
diff --git a/sys/netinet/ipfw/ip_fw_table.c b/sys/netinet/ipfw/ip_fw_table.c
deleted file mode 100644
index 597817b7b66e..000000000000
--- a/sys/netinet/ipfw/ip_fw_table.c
+++ /dev/null
@@ -1,758 +0,0 @@
-/*-
- * Copyright (c) 2004 Ruslan Ermilov and Vsevolod Lobko.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include <sys/cdefs.h>
-__FBSDID("$FreeBSD$");
-
-/*
- * Lookup table support for ipfw
- *
- * Lookup tables are implemented (at the moment) using the radix
- * tree used for routing tables. Tables store key-value entries, where
- * keys are network prefixes (addr/masklen), and values are integers.
- * As a degenerate case we can interpret keys as 32-bit integers
- * (with a /32 mask).
- *
- * The table is protected by the IPFW lock even for manipulation coming
- * from userland, because operations are typically fast.
- */
-
-#include "opt_ipfw.h"
-#include "opt_inet.h"
-#ifndef INET
-#error IPFIREWALL requires INET.
-#endif /* INET */
-#include "opt_inet6.h"
-
-#include <sys/param.h>
-#include <sys/systm.h>
-#include <sys/malloc.h>
-#include <sys/kernel.h>
-#include <sys/lock.h>
-#include <sys/rwlock.h>
-#include <sys/socket.h>
-#include <net/if.h>	/* ip_fw.h requires IFNAMSIZ */
-#include <net/radix.h>
-#include <net/route.h>
-#include <net/vnet.h>
-
-#include <netinet/in.h>
-#include <netinet/ip_var.h>	/* struct ipfw_rule_ref */
-#include <netinet/ip_fw.h>
-#include <sys/queue.h> /* LIST_HEAD */
-#include <netinet/ipfw/ip_fw_private.h>
-
-#ifdef MAC
-#include <security/mac/mac_framework.h>
-#endif
-
-static MALLOC_DEFINE(M_IPFW_TBL, "ipfw_tbl", "IpFw tables");
-
-struct table_entry {
-	struct radix_node	rn[2];
-	struct sockaddr_in	addr, mask;
-	u_int32_t		value;
-};
-
-struct xaddr_iface {
-	uint8_t		if_len;		/* length of this struct */
-	uint8_t		pad[7];		/* Align name */
-	char 		ifname[IF_NAMESIZE];	/* Interface name */
-};
-
-struct table_xentry {
-	struct radix_node	rn[2];
-	union {
-#ifdef INET6
-		struct sockaddr_in6	addr6;
-#endif
-		struct xaddr_iface	iface;
-	} a;
-	union {
-#ifdef INET6
-		struct sockaddr_in6	mask6;
-#endif
-		struct xaddr_iface	ifmask;
-	} m;
-	u_int32_t		value;
-};
-
-/*
- * The radix code expects addr and mask to be array of bytes,
- * with the first byte being the length of the array. rn_inithead
- * is called with the offset in bits of the lookup key within the
- * array. If we use a sockaddr_in as the underlying type,
- * sin_len is conveniently located at offset 0, sin_addr is at
- * offset 4 and normally aligned.
- * But for portability, let's avoid assumption and make the code explicit
- */
-#define KEY_LEN(v)	*((uint8_t *)&(v))
-#define KEY_OFS		(8*offsetof(struct sockaddr_in, sin_addr))
-/*
- * Do not require radix to compare more than actual IPv4/IPv6 address
- */
-#define KEY_LEN_INET	(offsetof(struct sockaddr_in, sin_addr) + sizeof(in_addr_t))
-#define KEY_LEN_INET6	(offsetof(struct sockaddr_in6, sin6_addr) + sizeof(struct in6_addr))
-#define KEY_LEN_IFACE	(offsetof(struct xaddr_iface, ifname))
-
-#define OFF_LEN_INET	(8 * offsetof(struct sockaddr_in, sin_addr))
-#define OFF_LEN_INET6	(8 * offsetof(struct sockaddr_in6, sin6_addr))
-#define OFF_LEN_IFACE	(8 * offsetof(struct xaddr_iface, ifname))
-
-
-static inline void
-ipv6_writemask(struct in6_addr *addr6, uint8_t mask)
-{
-	uint32_t *cp;
-
-	for (cp = (uint32_t *)addr6; mask >= 32; mask -= 32)
-		*cp++ = 0xFFFFFFFF;
-	*cp = htonl(mask ? ~((1 << (32 - mask)) - 1) : 0);
-}
-
-int
-ipfw_add_table_entry(struct ip_fw_chain *ch, uint16_t tbl, void *paddr,
-    uint8_t plen, uint8_t mlen, uint8_t type, uint32_t value)
-{
-	struct radix_node_head *rnh, **rnh_ptr;
-	struct table_entry *ent;
-	struct table_xentry *xent;
-	struct radix_node *rn;
-	in_addr_t addr;
-	int offset;
-	void *ent_ptr;
-	struct sockaddr *addr_ptr, *mask_ptr;
-	char c;
-
-	if (tbl >= V_fw_tables_max)
-		return (EINVAL);
-
-	switch (type) {
-	case IPFW_TABLE_CIDR:
-		if (plen == sizeof(in_addr_t)) {
-#ifdef INET
-			/* IPv4 case */
-			if (mlen > 32)
-				return (EINVAL);
-			ent = malloc(sizeof(*ent), M_IPFW_TBL, M_WAITOK | M_ZERO);
-			ent->value = value;
-			/* Set 'total' structure length */
-			KEY_LEN(ent->addr) = KEY_LEN_INET;
-			KEY_LEN(ent->mask) = KEY_LEN_INET;
-			/* Set offset of IPv4 address in bits */
-			offset = OFF_LEN_INET;
-			ent->mask.sin_addr.s_addr = htonl(mlen ? ~((1 << (32 - mlen)) - 1) : 0);
-			addr = *((in_addr_t *)paddr);
-			ent->addr.sin_addr.s_addr = addr & ent->mask.sin_addr.s_addr;
-			/* Set pointers */
-			rnh_ptr = &ch->tables[tbl];
-			ent_ptr = ent;
-			addr_ptr = (struct sockaddr *)&ent->addr;
-			mask_ptr = (struct sockaddr *)&ent->mask;
-#endif
-#ifdef INET6
-		} else if (plen == sizeof(struct in6_addr)) {
-			/* IPv6 case */
-			if (mlen > 128)
-				return (EINVAL);
-			xent = malloc(sizeof(*xent), M_IPFW_TBL, M_WAITOK | M_ZERO);
-			xent->value = value;
-			/* Set 'total' structure length */
-			KEY_LEN(xent->a.addr6) = KEY_LEN_INET6;
-			KEY_LEN(xent->m.mask6) = KEY_LEN_INET6;
-			/* Set offset of IPv6 address in bits */
-			offset = OFF_LEN_INET6;
-			ipv6_writemask(&xent->m.mask6.sin6_addr, mlen);
-			memcpy(&xent->a.addr6.sin6_addr, paddr, sizeof(struct in6_addr));
-			APPLY_MASK(&xent->a.addr6.sin6_addr, &xent->m.mask6.sin6_addr);
-			/* Set pointers */
-			rnh_ptr = &ch->xtables[tbl];
-			ent_ptr = xent;
-			addr_ptr = (struct sockaddr *)&xent->a.addr6;
-			mask_ptr = (struct sockaddr *)&xent->m.mask6;
-#endif
-		} else {
-			/* Unknown CIDR type */
-			return (EINVAL);
-		}
-		break;
-	
-	case IPFW_TABLE_INTERFACE:
-		/* Check if string is terminated */
-		c = ((char *)paddr)[IF_NAMESIZE - 1];
-		((char *)paddr)[IF_NAMESIZE - 1] = '\0';
-		if (((mlen = strlen((char *)paddr)) == IF_NAMESIZE - 1) && (c != '\0'))
-			return (EINVAL);
-
-		/* Include last \0 into comparison */
-		mlen++;
-
-		xent = malloc(sizeof(*xent), M_IPFW_TBL, M_WAITOK | M_ZERO);
-		xent->value = value;
-		/* Set 'total' structure length */
-		KEY_LEN(xent->a.iface) = KEY_LEN_IFACE + mlen;
-		KEY_LEN(xent->m.ifmask) = KEY_LEN_IFACE + mlen;
-		/* Set offset of interface name in bits */
-		offset = OFF_LEN_IFACE;
-		memcpy(xent->a.iface.ifname, paddr, mlen);
-		/* Assume direct match */
-		/* TODO: Add interface pattern matching */
-#if 0
-		memset(xent->m.ifmask.ifname, 0xFF, IF_NAMESIZE);
-		mask_ptr = (struct sockaddr *)&xent->m.ifmask;
-#endif
-		/* Set pointers */
-		rnh_ptr = &ch->xtables[tbl];
-		ent_ptr = xent;
-		addr_ptr = (struct sockaddr *)&xent->a.iface;
-		mask_ptr = NULL;
-		break;
-
-	default:
-		return (EINVAL);
-	}
-
-	IPFW_WLOCK(ch);
-
-	/* Check if tabletype is valid */
-	if ((ch->tabletype[tbl] != 0) && (ch->tabletype[tbl] != type)) {
-		IPFW_WUNLOCK(ch);
-		free(ent_ptr, M_IPFW_TBL);
-		return (EINVAL);
-	}
-
-	/* Check if radix tree exists */
-	if ((rnh = *rnh_ptr) == NULL) {
-		IPFW_WUNLOCK(ch);
-		/* Create radix for a new table */
-		if (!rn_inithead((void **)&rnh, offset)) {
-			free(ent_ptr, M_IPFW_TBL);
-			return (ENOMEM);
-		}
-
-		IPFW_WLOCK(ch);
-		if (*rnh_ptr != NULL) {
-			/* Tree is already attached by other thread */
-			rn_detachhead((void **)&rnh);
-			rnh = *rnh_ptr;
-			/* Check table type another time */
-			if (ch->tabletype[tbl] != type) {
-				IPFW_WUNLOCK(ch);
-				free(ent_ptr, M_IPFW_TBL);
-				return (EINVAL);
-			}
-		} else {
-			*rnh_ptr = rnh;
-			/* 
-			 * Set table type. It can be set already
-			 * (if we have IPv6-only table) but setting
-			 * it another time does not hurt
-			 */
-			ch->tabletype[tbl] = type;
-		}
-	}
-
-	rn = rnh->rnh_addaddr(addr_ptr, mask_ptr, rnh, ent_ptr);
-	IPFW_WUNLOCK(ch);
-
-	if (rn == NULL) {
-		free(ent_ptr, M_IPFW_TBL);
-		return (EEXIST);
-	}
-	return (0);
-}
-
-int
-ipfw_del_table_entry(struct ip_fw_chain *ch, uint16_t tbl, void *paddr,
-    uint8_t plen, uint8_t mlen, uint8_t type)
-{
-	struct radix_node_head *rnh, **rnh_ptr;
-	struct table_entry *ent;
-	in_addr_t addr;
-	struct sockaddr_in sa, mask;
-	struct sockaddr *sa_ptr, *mask_ptr;
-	char c;
-
-	if (tbl >= V_fw_tables_max)
-		return (EINVAL);
-
-	switch (type) {
-	case IPFW_TABLE_CIDR:
-		if (plen == sizeof(in_addr_t)) {
-			/* Set 'total' structure length */
-			KEY_LEN(sa) = KEY_LEN_INET;
-			KEY_LEN(mask) = KEY_LEN_INET;
-			mask.sin_addr.s_addr = htonl(mlen ? ~((1 << (32 - mlen)) - 1) : 0);
-			addr = *((in_addr_t *)paddr);
-			sa.sin_addr.s_addr = addr & mask.sin_addr.s_addr;
-			rnh_ptr = &ch->tables[tbl];
-			sa_ptr = (struct sockaddr *)&sa;
-			mask_ptr = (struct sockaddr *)&mask;
-#ifdef INET6
-		} else if (plen == sizeof(struct in6_addr)) {
-			/* IPv6 case */
-			if (mlen > 128)
-				return (EINVAL);
-			struct sockaddr_in6 sa6, mask6;
-			memset(&sa6, 0, sizeof(struct sockaddr_in6));
-			memset(&mask6, 0, sizeof(struct sockaddr_in6));
-			/* Set 'total' structure length */
-			KEY_LEN(sa6) = KEY_LEN_INET6;
-			KEY_LEN(mask6) = KEY_LEN_INET6;
-			ipv6_writemask(&mask6.sin6_addr, mlen);
-			memcpy(&sa6.sin6_addr, paddr, sizeof(struct in6_addr));
-			APPLY_MASK(&sa6.sin6_addr, &mask6.sin6_addr);
-			rnh_ptr = &ch->xtables[tbl];
-			sa_ptr = (struct sockaddr *)&sa6;
-			mask_ptr = (struct sockaddr *)&mask6;
-#endif
-		} else {
-			/* Unknown CIDR type */
-			return (EINVAL);
-		}
-		break;
-
-	case IPFW_TABLE_INTERFACE:
-		/* Check if string is terminated */
-		c = ((char *)paddr)[IF_NAMESIZE - 1];
-		((char *)paddr)[IF_NAMESIZE - 1] = '\0';
-		if (((mlen = strlen((char *)paddr)) == IF_NAMESIZE - 1) && (c != '\0'))
-			return (EINVAL);
-
-		struct xaddr_iface ifname, ifmask;
-		memset(&ifname, 0, sizeof(ifname));
-
-		/* Set 'total' structure length */
-		KEY_LEN(ifname) = mlen;
-		KEY_LEN(ifmask) = mlen;
-		/* Assume direct match */
-		/* FIXME: Add interface pattern matching */
-#if 0
-		memset(ifmask.ifname, 0xFF, IF_NAMESIZE);
-		mask_ptr = (struct sockaddr *)&ifmask;
-#endif
-		mask_ptr = NULL;
-		memcpy(ifname.ifname, paddr, mlen);
-		/* Set pointers */
-		rnh_ptr = &ch->xtables[tbl];
-		sa_ptr = (struct sockaddr *)&ifname;
-
-		break;
-
-	default:
-		return (EINVAL);
-	}
-
-	IPFW_WLOCK(ch);
-	if ((rnh = *rnh_ptr) == NULL) {
-		IPFW_WUNLOCK(ch);
-		return (ESRCH);
-	}
-
-	if (ch->tabletype[tbl] != type) {
-		IPFW_WUNLOCK(ch);
-		return (EINVAL);
-	}
-
-	ent = (struct table_entry *)rnh->rnh_deladdr(sa_ptr, mask_ptr, rnh);
-	IPFW_WUNLOCK(ch);
-
-	if (ent == NULL)
-		return (ESRCH);
-
-	free(ent, M_IPFW_TBL);
-	return (0);
-}
-
-static int
-flush_table_entry(struct radix_node *rn, void *arg)
-{
-	struct radix_node_head * const rnh = arg;
-	struct table_entry *ent;
-
-	ent = (struct table_entry *)
-	    rnh->rnh_deladdr(rn->rn_key, rn->rn_mask, rnh);
-	if (ent != NULL)
-		free(ent, M_IPFW_TBL);
-	return (0);
-}
-
-int
-ipfw_flush_table(struct ip_fw_chain *ch, uint16_t tbl)
-{
-	struct radix_node_head *rnh, *xrnh;
-
-	if (tbl >= V_fw_tables_max)
-		return (EINVAL);
-
-	/*
-	 * We free both (IPv4 and extended) radix trees and
-	 * clear table type here to permit table to be reused
-	 * for different type without module reload
-	 */
-
-	IPFW_WLOCK(ch);
-	/* Set IPv4 table pointer to zero */
-	if ((rnh = ch->tables[tbl]) != NULL)
-		ch->tables[tbl] = NULL;
-	/* Set extended table pointer to zero */
-	if ((xrnh = ch->xtables[tbl]) != NULL)
-		ch->xtables[tbl] = NULL;
-	/* Zero table type */
-	ch->tabletype[tbl] = 0;
-	IPFW_WUNLOCK(ch);
-
-	if (rnh != NULL) {
-		rnh->rnh_walktree(rnh, flush_table_entry, rnh);
-		rn_detachhead((void **)&rnh);
-	}
-
-	if (xrnh != NULL) {
-		xrnh->rnh_walktree(xrnh, flush_table_entry, xrnh);
-		rn_detachhead((void **)&xrnh);
-	}
-
-	return (0);
-}
-
-void
-ipfw_destroy_tables(struct ip_fw_chain *ch)
-{
-	uint16_t tbl;
-
-	/* Flush all tables */
-	for (tbl = 0; tbl < V_fw_tables_max; tbl++)
-		ipfw_flush_table(ch, tbl);
-
-	/* Free pointers itself */
-	free(ch->tables, M_IPFW);
-	free(ch->xtables, M_IPFW);
-	free(ch->tabletype, M_IPFW);
-}
-
-int
-ipfw_init_tables(struct ip_fw_chain *ch)
-{
-	/* Allocate pointers */
-	ch->tables = malloc(V_fw_tables_max * sizeof(void *), M_IPFW, M_WAITOK | M_ZERO);
-	ch->xtables = malloc(V_fw_tables_max * sizeof(void *), M_IPFW, M_WAITOK | M_ZERO);
-	ch->tabletype = malloc(V_fw_tables_max * sizeof(uint8_t), M_IPFW, M_WAITOK | M_ZERO);
-	return (0);
-}
-
-int
-ipfw_resize_tables(struct ip_fw_chain *ch, unsigned int ntables)
-{
-	struct radix_node_head **tables, **xtables, *rnh;
-	struct radix_node_head **tables_old, **xtables_old;
-	uint8_t *tabletype, *tabletype_old;
-	unsigned int ntables_old, tbl;
-
-	/* Check new value for validity */
-	if (ntables > IPFW_TABLES_MAX)
-		ntables = IPFW_TABLES_MAX;
-
-	/* Allocate new pointers */
-	tables = malloc(ntables * sizeof(void *), M_IPFW, M_WAITOK | M_ZERO);
-	xtables = malloc(ntables * sizeof(void *), M_IPFW, M_WAITOK | M_ZERO);
-	tabletype = malloc(ntables * sizeof(uint8_t), M_IPFW, M_WAITOK | M_ZERO);
-
-	IPFW_WLOCK(ch);
-
-	tbl = (ntables >= V_fw_tables_max) ? V_fw_tables_max : ntables;
-
-	/* Copy old table pointers */
-	memcpy(tables, ch->tables, sizeof(void *) * tbl);
-	memcpy(xtables, ch->xtables, sizeof(void *) * tbl);
-	memcpy(tabletype, ch->tabletype, sizeof(uint8_t) * tbl);
-
-	/* Change pointers and number of tables */
-	tables_old = ch->tables;
-	xtables_old = ch->xtables;
-	tabletype_old = ch->tabletype;
-	ch->tables = tables;
-	ch->xtables = xtables;
-	ch->tabletype = tabletype;
-
-	ntables_old = V_fw_tables_max;
-	V_fw_tables_max = ntables;
-
-	IPFW_WUNLOCK(ch);
-
-	/* Check if we need to destroy radix trees */
-	if (ntables < ntables_old) {
-		for (tbl = ntables; tbl < ntables_old; tbl++) {
-			if ((rnh = tables_old[tbl]) != NULL) {
-				rnh->rnh_walktree(rnh, flush_table_entry, rnh);
-				rn_detachhead((void **)&rnh);
-			}
-
-			if ((rnh = xtables_old[tbl]) != NULL) {
-				rnh->rnh_walktree(rnh, flush_table_entry, rnh);
-				rn_detachhead((void **)&rnh);
-			}
-		}
-	}
-
-	/* Free old pointers */
-	free(tables_old, M_IPFW);
-	free(xtables_old, M_IPFW);
-	free(tabletype_old, M_IPFW);
-
-	return (0);
-}
-
-int
-ipfw_lookup_table(struct ip_fw_chain *ch, uint16_t tbl, in_addr_t addr,
-    uint32_t *val)
-{
-	struct radix_node_head *rnh;
-	struct table_entry *ent;
-	struct sockaddr_in sa;
-
-	if (tbl >= V_fw_tables_max)
-		return (0);
-	if ((rnh = ch->tables[tbl]) == NULL)
-		return (0);
-	KEY_LEN(sa) = KEY_LEN_INET;
-	sa.sin_addr.s_addr = addr;
-	ent = (struct table_entry *)(rnh->rnh_lookup(&sa, NULL, rnh));
-	if (ent != NULL) {
-		*val = ent->value;
-		return (1);
-	}
-	return (0);
-}
-
-int
-ipfw_lookup_table_extended(struct ip_fw_chain *ch, uint16_t tbl, void *paddr,
-    uint32_t *val, int type)
-{
-	struct radix_node_head *rnh;
-	struct table_xentry *xent;
-	struct sockaddr_in6 sa6;
-	struct xaddr_iface iface;
-
-	if (tbl >= V_fw_tables_max)
-		return (0);
-	if ((rnh = ch->xtables[tbl]) == NULL)
-		return (0);
-
-	switch (type) {
-	case IPFW_TABLE_CIDR:
-		KEY_LEN(sa6) = KEY_LEN_INET6;
-		memcpy(&sa6.sin6_addr, paddr, sizeof(struct in6_addr));
-		xent = (struct table_xentry *)(rnh->rnh_lookup(&sa6, NULL, rnh));
-		break;
-
-	case IPFW_TABLE_INTERFACE:
-		KEY_LEN(iface) = KEY_LEN_IFACE +
-		    strlcpy(iface.ifname, (char *)paddr, IF_NAMESIZE);
-		/* Assume direct match */
-		/* FIXME: Add interface pattern matching */
-		xent = (struct table_xentry *)(rnh->rnh_lookup(&iface, NULL, rnh));
-		break;
-
-	default:
-		return (0);
-	}
-
-	if (xent != NULL) {
-		*val = xent->value;
-		return (1);
-	}
-	return (0);
-}
-
-static int
-count_table_entry(struct radix_node *rn, void *arg)
-{
-	u_int32_t * const cnt = arg;
-
-	(*cnt)++;
-	return (0);
-}
-
-int
-ipfw_count_table(struct ip_fw_chain *ch, uint32_t tbl, uint32_t *cnt)
-{
-	struct radix_node_head *rnh;
-
-	if (tbl >= V_fw_tables_max)
-		return (EINVAL);
-	*cnt = 0;
-	if ((rnh = ch->tables[tbl]) == NULL)
-		return (0);
-	rnh->rnh_walktree(rnh, count_table_entry, cnt);
-	return (0);
-}
-
-static int
-dump_table_entry(struct radix_node *rn, void *arg)
-{
-	struct table_entry * const n = (struct table_entry *)rn;
-	ipfw_table * const tbl = arg;
-	ipfw_table_entry *ent;
-
-	if (tbl->cnt == tbl->size)
-		return (1);
-	ent = &tbl->ent[tbl->cnt];
-	ent->tbl = tbl->tbl;
-	if (in_nullhost(n->mask.sin_addr))
-		ent->masklen = 0;
-	else
-		ent->masklen = 33 - ffs(ntohl(n->mask.sin_addr.s_addr));
-	ent->addr = n->addr.sin_addr.s_addr;
-	ent->value = n->value;
-	tbl->cnt++;
-	return (0);
-}
-
-int
-ipfw_dump_table(struct ip_fw_chain *ch, ipfw_table *tbl)
-{
-	struct radix_node_head *rnh;
-
-	if (tbl->tbl >= V_fw_tables_max)
-		return (EINVAL);
-	tbl->cnt = 0;
-	if ((rnh = ch->tables[tbl->tbl]) == NULL)
-		return (0);
-	rnh->rnh_walktree(rnh, dump_table_entry, tbl);
-	return (0);
-}
-
-static int
-count_table_xentry(struct radix_node *rn, void *arg)
-{
-	uint32_t * const cnt = arg;
-
-	(*cnt) += sizeof(ipfw_table_xentry);
-	return (0);
-}
-
-int
-ipfw_count_xtable(struct ip_fw_chain *ch, uint32_t tbl, uint32_t *cnt)
-{
-	struct radix_node_head *rnh;
-
-	if (tbl >= V_fw_tables_max)
-		return (EINVAL);
-	*cnt = 0;
-	if ((rnh = ch->tables[tbl]) != NULL)
-		rnh->rnh_walktree(rnh, count_table_xentry, cnt);
-	if ((rnh = ch->xtables[tbl]) != NULL)
-		rnh->rnh_walktree(rnh, count_table_xentry, cnt);
-	/* Return zero if table is empty */
-	if (*cnt > 0)
-		(*cnt) += sizeof(ipfw_xtable);
-	return (0);
-}
-
-
-static int
-dump_table_xentry_base(struct radix_node *rn, void *arg)
-{
-	struct table_entry * const n = (struct table_entry *)rn;
-	ipfw_xtable * const tbl = arg;
-	ipfw_table_xentry *xent;
-
-	/* Out of memory, returning */
-	if (tbl->cnt == tbl->size)
-		return (1);
-	xent = &tbl->xent[tbl->cnt];
-	xent->len = sizeof(ipfw_table_xentry);
-	xent->tbl = tbl->tbl;
-	if (in_nullhost(n->mask.sin_addr))
-		xent->masklen = 0;
-	else
-		xent->masklen = 33 - ffs(ntohl(n->mask.sin_addr.s_addr));
-	/* Save IPv4 address as deprecated IPv6 compatible */
-	xent->k.addr6.s6_addr32[3] = n->addr.sin_addr.s_addr;
-	xent->value = n->value;
-	tbl->cnt++;
-	return (0);
-}
-
-static int
-dump_table_xentry_extended(struct radix_node *rn, void *arg)
-{
-	struct table_xentry * const n = (struct table_xentry *)rn;
-	ipfw_xtable * const tbl = arg;
-	ipfw_table_xentry *xent;
-#ifdef INET6
-	int i;
-	uint32_t *v;
-#endif
-	/* Out of memory, returning */
-	if (tbl->cnt == tbl->size)
-		return (1);
-	xent = &tbl->xent[tbl->cnt];
-	xent->len = sizeof(ipfw_table_xentry);
-	xent->tbl = tbl->tbl;
-
-	switch (tbl->type) {
-#ifdef INET6
-	case IPFW_TABLE_CIDR:
-		/* Count IPv6 mask */
-		v = (uint32_t *)&n->m.mask6.sin6_addr;
-		for (i = 0; i < sizeof(struct in6_addr) / 4; i++, v++)
-			xent->masklen += bitcount32(*v);
-		memcpy(&xent->k, &n->a.addr6.sin6_addr, sizeof(struct in6_addr));
-		break;
-#endif
-	case IPFW_TABLE_INTERFACE:
-		/* Assume exact mask */
-		xent->masklen = 8 * IF_NAMESIZE;
-		memcpy(&xent->k, &n->a.iface.ifname, IF_NAMESIZE);
-		break;
-	
-	default:
-		/* unknown, skip entry */
-		return (0);
-	}
-
-	xent->value = n->value;
-	tbl->cnt++;
-	return (0);
-}
-
-int
-ipfw_dump_xtable(struct ip_fw_chain *ch, ipfw_xtable *tbl)
-{
-	struct radix_node_head *rnh;
-
-	if (tbl->tbl >= V_fw_tables_max)
-		return (EINVAL);
-	tbl->cnt = 0;
-	tbl->type = ch->tabletype[tbl->tbl];
-	if ((rnh = ch->tables[tbl->tbl]) != NULL)
-		rnh->rnh_walktree(rnh, dump_table_xentry_base, tbl);
-	if ((rnh = ch->xtables[tbl->tbl]) != NULL)
-		rnh->rnh_walktree(rnh, dump_table_xentry_extended, tbl);
-	return (0);
-}
-
-/* end of file */
diff --git a/sys/netinet/ipfw/test/Makefile b/sys/netinet/ipfw/test/Makefile
deleted file mode 100644
index c556a4bf3d51..000000000000
--- a/sys/netinet/ipfw/test/Makefile
+++ /dev/null
@@ -1,51 +0,0 @@
-#
-# $FreeBSD$
-#
-# Makefile for building userland tests
-# this is written in a form compatible with gmake
-
-SCHED_SRCS = test_dn_sched.c
-SCHED_SRCS += dn_sched_fifo.c
-SCHED_SRCS += dn_sched_prio.c
-SCHED_SRCS += dn_sched_qfq.c
-SCHED_SRCS += dn_sched_rr.c
-SCHED_SRCS += dn_sched_wf2q.c
-SCHED_SRCS += dn_heap.c
-SCHED_SRCS += main.c
-
-SCHED_OBJS=$(SCHED_SRCS:.c=.o)
-
-HEAP_SRCS = dn_heap.c test_dn_heap.c
-HEAP_OBJS=$(HEAP_SRCS:.c=.o)
-
-VPATH=	.:..
-
-CFLAGS = -I.. -I. -Wall -Werror -O3 -DIPFW
-TARGETS= test_sched # no test_heap by default
-
-all:	$(TARGETS)
-
-test_heap : $(HEAP_OBJS)
-	$(CC) -o $@ $(HEAP_OBJS)
-
-test_sched : $(SCHED_OBJS)
-	$(CC) -o $@ $(SCHED_OBJS)
-
-$(SCHED_OBJS): dn_test.h
-main.o: mylist.h
-
-clean:
-	- rm *.o $(TARGETS) *.core
-
-ALLSRCS = $(SCHED_SRCS) dn_test.h mylist.h \
-	dn_sched.h dn_heap.h ip_dn_private.h Makefile
-TMPBASE = /tmp/testXYZ
-TMPDIR = $(TMPBASE)/test
-
-tgz:
-	-rm -rf $(TMPDIR)
-	mkdir -p $(TMPDIR)
-	-cp -p $(ALLSRCS) $(TMPDIR)
-	-(cd ..; cp -p $(ALLSRCS) $(TMPDIR))
-	ls -la  $(TMPDIR)
-	(cd $(TMPBASE); tar cvzf /tmp/test.tgz test)
diff --git a/sys/netinet/ipfw/test/dn_test.h b/sys/netinet/ipfw/test/dn_test.h
deleted file mode 100644
index 4e079bc4d68b..000000000000
--- a/sys/netinet/ipfw/test/dn_test.h
+++ /dev/null
@@ -1,175 +0,0 @@
-/*
- * $FreeBSD$
- *
- * userspace compatibility code for dummynet schedulers
- */
-
-#ifndef _DN_TEST_H
-#define _DN_TEST_H
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-#include <inttypes.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <strings.h>	/* bzero, ffs, ... */
-#include <string.h>	/* strcmp */
-#include <errno.h>
-#include <sys/queue.h>
-#include <sys/time.h>
-
-extern int debug;
-#define ND(fmt, args...) do {} while (0)
-#define D1(fmt, args...) do {} while (0)
-#define D(fmt, args...) fprintf(stderr, "%-8s " fmt "\n",      \
-        __FUNCTION__, ## args)
-#define DX(lev, fmt, args...) do {              \
-        if (debug > lev) D(fmt, ## args); } while (0)
-
-
-#ifndef offsetof
-#define offsetof(t,m) (int)((&((t *)0L)->m))
-#endif
-
-#include <mylist.h>
-
-/* prevent include of other system headers */
-#define	_NETINET_IP_VAR_H_	/* ip_fw_args */
-#define _IPFW2_H
-#define _SYS_MBUF_H_
-
-enum	{
-	DN_QUEUE,
-};
-
-enum	{
-	DN_SCHED_FIFO,
-	DN_SCHED_WF2QP,
-};
-
-struct dn_id {
-	int type, subtype, len, id;
-};
-
-struct dn_fs {
-	int par[4];	/* flowset parameters */
-
-	/* simulation entries.
-	 * 'index' is not strictly necessary
-	 * y is used for the inverse mapping ,
-	 */
-	int index;
-	int y;	/* inverse mapping */
-	int base_y;	/* inverse mapping */
-	int next_y;	/* inverse mapping */
-	int n_flows;
-	int first_flow;
-	int next_flow;	/* first_flow + n_flows */
-	/*
-	 * when generating, let 'cur' go from 0 to n_flows-1,
-	 * then point to flow first_flow + cur
-	 */
-	int	cur;
-};
-
-struct dn_sch {
-};
-
-struct dn_flow {
-	struct dn_id oid;
-	int length;
-	int len_bytes;
-	int drops;
-	uint64_t tot_bytes;
-	uint32_t flow_id;
-	struct list_head h;	/* used by the generator */
-};
-
-struct dn_link {
-};
-
-struct ip_fw_args {
-};
-
-struct mbuf {
-        struct {
-                int len;
-        } m_pkthdr;
-        struct mbuf *m_nextpkt;
-	int flow_id;	/* for testing, index of a flow */
-	//int flowset_id;	/* for testing, index of a flowset */
-	void *cfg;	/* config args */
-};
-
-#define MALLOC_DECLARE(x)
-#define KASSERT(x, y)	do { if (!(x)) printf y ; exit(0); } while (0)
-struct ipfw_flow_id {
-};
-
-typedef void * module_t;
-
-struct _md_t {
-	const char *name;
-	int (*f)(module_t, int, void *);
-	void *p;
-};
-
-typedef struct _md_t moduledata_t;
-
-#define DECLARE_MODULE(name, b, c, d)	\
-	moduledata_t *_g_##name = & b
-#define MODULE_DEPEND(a, b, c, d, e)
-
-#ifdef IPFW
-#include <dn_heap.h>
-#include <ip_dn_private.h>
-#include <dn_sched.h>
-#else
-struct dn_queue {
-        struct dn_fsk *fs;             /* parent flowset. */
-        struct dn_sch_inst *_si;	/* parent sched instance. */
-};
-struct dn_schk {
-};
-struct dn_fsk {
-	struct dn_fs fs;
-	struct dn_schk *sched;
-};
-struct dn_sch_inst {
-	struct dn_schk *sched;
-};
-struct dn_alg {
-	int type;
-	const char *name;
-	void *enqueue, *dequeue;
-	int q_datalen, si_datalen, schk_datalen;
-	int (*config)(struct dn_schk *);
-	int (*new_sched)(struct dn_sch_inst *);
-	int (*new_fsk)(struct dn_fsk *);
-        int (*new_queue)(struct dn_queue *q);
-};
-
-#endif
-
-#ifndef __FreeBSD__
-int fls(int);
-#endif
-
-static inline void
-mq_append(struct mq *q, struct mbuf *m)
-{
-        if (q->head == NULL)
-                q->head = m;
-        else
-                q->tail->m_nextpkt = m;
-        q->tail = m;
-        m->m_nextpkt = NULL;
-}
-
-#ifdef __cplusplus
-}
-#endif
-
-#endif /* _DN_TEST_H */
diff --git a/sys/netinet/ipfw/test/main.c b/sys/netinet/ipfw/test/main.c
deleted file mode 100644
index be9fdf53612c..000000000000
--- a/sys/netinet/ipfw/test/main.c
+++ /dev/null
@@ -1,636 +0,0 @@
-/*
- * $FreeBSD$
- *
- * Testing program for schedulers
- *
- * The framework include a simple controller which, at each
- * iteration, decides whether we can enqueue and/or dequeue.
- * Then the mainloop runs the required number of tests,
- * keeping track of statistics.
- */
-
-#include "dn_test.h"
-
-struct q_list {
-	struct list_head h;
-};
-
-struct cfg_s {
-	int ac;
-	char * const *av;
-
-	const char *name;
-	int loops;
-	struct timeval time;
-
-	/* running counters */
-	uint32_t	_enqueue;
-	uint32_t	drop;
-	uint32_t	pending;
-	uint32_t	dequeue;
-
-	/* generator parameters */
-	int th_min, th_max;
-	int maxburst;
-	int lmin, lmax;	/* packet len */
-	int flows;	/* number of flows */
-	int flowsets;	/* number of flowsets */
-	int wsum;	/* sum of weights of all flows */
-	int max_y;	/* max random number in the generation */
-	int cur_y, cur_fs;	/* used in generation, between 0 and max_y - 1 */
-	const char *fs_config; /* flowset config */
-	int can_dequeue;
-	int burst;	/* count of packets sent in a burst */
-	struct mbuf *tosend;	/* packet to send -- also flag to enqueue */
-
-	struct mbuf *freelist;
-
-	struct mbuf *head, *tail;	/* a simple tailq */
-
-	/* scheduler hooks */
-	int (*enq)(struct dn_sch_inst *, struct dn_queue *,
-		struct mbuf *);
-	struct mbuf * (*deq)(struct dn_sch_inst *);
-	/* size of the three fields including sched-specific areas */
-	int schk_len;
-	int q_len; /* size of a queue including sched-fields */
-	int si_len; /* size of a sch_inst including sched-fields */
-	char *q;	/* array of flow queues */
-		/* use a char* because size is variable */
-	struct dn_fsk *fs;	/* array of flowsets */
-	struct dn_sch_inst *si;
-	struct dn_schk *sched;
-
-	/* generator state */
-	int state;		/* 0 = going up, 1: going down */
-
-	/*
-	 * We keep lists for each backlog level, and always serve
-	 * the one with shortest backlog. llmask contains a bitmap
-	 * of lists, and ll are the heads of the lists. The last
-	 * entry (BACKLOG) contains all entries considered 'full'
-	 * XXX to optimize things, entry i could contain queues with
-	 * 2^{i-1}+1 .. 2^i entries.
-	 */
-#define BACKLOG	30
-	uint32_t	llmask;
-	struct list_head ll[BACKLOG + 10];
-};
-
-/* FI2Q and Q2FI converts from flow_id to dn_queue and back.
- * We cannot easily use pointer arithmetic because it is variable size.
-  */
-#define FI2Q(c, i)	((struct dn_queue *)((c)->q + (c)->q_len * (i)))
-#define Q2FI(c, q)	(((char *)(q) - (c)->q)/(c)->q_len)
-
-int debug = 0;
-
-struct dn_parms dn_cfg;
-
-static void controller(struct cfg_s *c);
-
-/* release a packet: put the mbuf in the freelist, and the queue in
- * the bucket.
- */
-int
-drop(struct cfg_s *c, struct mbuf *m)
-{
-	struct dn_queue *q;
-	int i;
-
-	c->drop++;
-	q = FI2Q(c, m->flow_id);
-	i = q->ni.length; // XXX or ffs...
-
-	ND("q %p id %d current length %d", q, m->flow_id, i);
-	if (i < BACKLOG) {
-		struct list_head *h = &q->ni.h;
-		c->llmask &= ~(1<<(i+1));
-		c->llmask |= (1<<(i));
-		list_del(h);
-		list_add_tail(h, &c->ll[i]);
-	}
-	m->m_nextpkt = c->freelist;
-	c->freelist = m;
-	return 0;
-}
-
-/* dequeue returns NON-NULL when a packet is dropped */
-static int
-enqueue(struct cfg_s *c, void *_m)
-{
-	struct mbuf *m = _m;
-	if (c->enq)
-		return c->enq(c->si, FI2Q(c, m->flow_id), m);
-	if (c->head == NULL)
-		c->head = m;
-	else
-		c->tail->m_nextpkt = m;
-	c->tail = m;
-	return 0; /* default - success */
-}
-
-/* dequeue returns NON-NULL when a packet is available */
-static void *
-dequeue(struct cfg_s *c)
-{
-	struct mbuf *m;
-	if (c->deq)
-		return c->deq(c->si);
-	if ((m = c->head)) {
-		m = c->head;
-		c->head = m->m_nextpkt;
-		m->m_nextpkt = NULL;
-	}
-	return m;
-}
-
-static int
-mainloop(struct cfg_s *c)
-{
-	int i;
-	struct mbuf *m;
-
-	for (i=0; i < c->loops; i++) {
-		/* implement histeresis */
-		controller(c);
-		DX(3, "loop %d enq %d send %p rx %d",
-			i, c->_enqueue, c->tosend, c->can_dequeue);
-		if ( (m = c->tosend) ) {
-			c->_enqueue++;
-			if (enqueue(c, m)) {
-				drop(c, m);
-				ND("loop %d enqueue fail", i );
-			} else {
-				ND("enqueue ok");
-				c->pending++;
-			}
-		}
-		if (c->can_dequeue) {
-			c->dequeue++;
-			if ((m = dequeue(c))) {
-				c->pending--;
-				drop(c, m);
-				c->drop--;	/* compensate */
-			}
-		}
-	}
-	DX(1, "mainloop ends %d", i);
-	return 0;
-}
-
-int
-dump(struct cfg_s *c)
-{
-	int i;
-	struct dn_queue *q;
-
-	for (i=0; i < c->flows; i++) {
-		q = FI2Q(c, i);
-		DX(1, "queue %4d tot %10lld", i, q->ni.tot_bytes);
-	}
-	DX(1, "done %d loops\n", c->loops);
-	return 0;
-}
-
-/* interpret a number in human form */
-static long
-getnum(const char *s, char **next, const char *key)
-{
-	char *end = NULL;
-	long l;
-
-	if (next)	/* default */
-		*next = NULL;
-	if (s && *s) {
-		DX(3, "token is <%s> %s", s, key ? key : "-");
-		l = strtol(s, &end, 0);
-	} else {
-		DX(3, "empty string");
-		l = -1;
-	}
-	if (l < 0) {
-		DX(2, "invalid %s for %s", s ? s : "NULL", (key ? key : "") );
-		return 0;	// invalid 
-	}
-	if (!end || !*end)
-		return l;
-	if (*end == 'n')
-		l = -l;	/* multiply by n */
-	else if (*end == 'K')
-		l = l*1000;
-	else if (*end == 'M')
-		l = l*1000000;
-	else if (*end == 'k')
-		l = l*1024;
-	else if (*end == 'm')
-		l = l*1024*1024;
-	else if (*end == 'w')
-		;
-	else {/* not recognized */
-		D("suffix %s for %s, next %p", end, key, next);
-		end--;
-	}
-	end++;
-	DX(3, "suffix now %s for %s, next %p", end, key, next);
-	if (next && *end) {
-		DX(3, "setting next to %s for %s", end, key);
-		*next = end;
-	}
-	return l;
-}
-
-/*
- * flowsets are a comma-separated list of
- *     weight:maxlen:flows
- * indicating how many flows are hooked to that fs.
- * Both weight and range can be min-max-steps.
- * In a first pass we just count the number of flowsets and flows,
- * in a second pass we complete the setup.
- */
-static void
-parse_flowsets(struct cfg_s *c, const char *fs, int pass)
-{
-	char *s, *cur, *next;
-	int n_flows = 0, n_fs = 0, wsum = 0;
-	int i, j;
-	struct dn_fs *prev = NULL;
-
-	DX(3, "--- pass %d flows %d flowsets %d", pass, c->flows, c->flowsets);
-	if (pass == 0)
-		c->fs_config = fs;
-	s = c->fs_config ? strdup(c->fs_config) : NULL;
-	if (s == NULL) {
-		if (pass == 0)
-			D("no fsconfig");
-		return;
-	}
-	for (next = s; (cur = strsep(&next, ","));) {
-		char *p = NULL;
-		int w, w_h, w_steps, wi;
-		int len, len_h, l_steps, li;
-		int flows;
-
-		w = getnum(strsep(&cur, ":"), &p, "weight");
-		if (w <= 0)
-			w = 1;
-		w_h = p ? getnum(p+1, &p, "weight_max") : w;
-		w_steps = p ? getnum(p+1, &p, "w_steps") : (w_h == w ?1:2);
-		len = getnum(strsep(&cur, ":"), &p, "len");
-		if (len <= 0)
-			len = 1000;
-		len_h = p ? getnum(p+1, &p, "len_max") : len;
-		l_steps = p ? getnum(p+1, &p, "l_steps") : (len_h == len ? 1 : 2);
-		flows = getnum(strsep(&cur, ":"), NULL, "flows");
-		if (flows == 0)
-			flows = 1;
-		DX(4, "weight %d..%d (%d) len %d..%d (%d) flows %d",
-			w, w_h, w_steps, len, len_h, l_steps, flows);
-		if (w == 0 || w_h < w || len == 0 || len_h < len ||
-				flows == 0) {
-			DX(4,"wrong parameters %s", fs);
-			return;
-		}
-		n_flows += flows * w_steps * l_steps;
-		for (i = 0; i < w_steps; i++) {
-			wi = w + ((w_h - w)* i)/(w_steps == 1 ? 1 : (w_steps-1));
-			for (j = 0; j < l_steps; j++, n_fs++) {
-				struct dn_fs *fs = &c->fs[n_fs].fs; // tentative
-				int x;
-
-				li = len + ((len_h - len)* j)/(l_steps == 1 ? 1 : (l_steps-1));
-				x = (wi*2048)/li;
-				DX(3, "----- fs %4d weight %4d lmax %4d X %4d flows %d",
-					n_fs, wi, li, x, flows);
-				if (pass == 0)
-					continue;
-				if (c->fs == NULL || c->flowsets <= n_fs) {
-					D("error in number of flowsets");
-					return;
-				}
-				wsum += wi * flows;
-				fs->par[0] = wi;
-				fs->par[1] = li;
-				fs->index = n_fs;
-				fs->n_flows = flows;
-				fs->cur = fs->first_flow = prev==NULL ? 0 : prev->next_flow;
-				fs->next_flow = fs->first_flow + fs->n_flows;
-				fs->y = x * flows;
-				fs->base_y = (prev == NULL) ? 0 : prev->next_y;
-				fs->next_y = fs->base_y + fs->y;
-				prev = fs;
-			}
-		}
-	}
-	c->max_y = prev ? prev->base_y + prev->y : 0;
-	c->flows = n_flows;
-	c->flowsets = n_fs;
-	c->wsum = wsum;
-	if (pass == 0)
-		return;
-
-	/* now link all flows to their parent flowsets */
-	DX(1,"%d flows on %d flowsets max_y %d", c->flows, c->flowsets, c->max_y);
-	for (i=0; i < c->flowsets; i++) {
-		struct dn_fs *fs = &c->fs[i].fs;
-		DX(1, "fs %3d w %5d l %4d flow %5d .. %5d y %6d .. %6d",
-			i, fs->par[0], fs->par[1],
-			fs->first_flow, fs->next_flow,
-			fs->base_y, fs->next_y);
-		for (j = fs->first_flow; j < fs->next_flow; j++) {
-			struct dn_queue *q = FI2Q(c, j);
-			q->fs = &c->fs[i];
-		}
-	}
-}
-
-static int
-init(struct cfg_s *c)
-{
-	int i;
-	int ac = c->ac;
-	char * const *av = c->av;
-
-	c->si_len = sizeof(struct dn_sch_inst);
-	c->q_len = sizeof(struct dn_queue);
-	moduledata_t *mod = NULL;
-	struct dn_alg *p = NULL;
-
-	c->th_min = 0;
-	c->th_max = -20;/* 20 packets per flow */
-	c->lmin = c->lmax = 1280;	/* packet len */
-	c->flows = 1;
-	c->flowsets = 1;
-	c->name = "null";
-	ac--; av++;
-	while (ac > 1) {
-		if (!strcmp(*av, "-n")) {
-			c->loops = getnum(av[1], NULL, av[0]);
-		} else if (!strcmp(*av, "-d")) {
-			debug = atoi(av[1]);
-		} else if (!strcmp(*av, "-alg")) {
-			extern moduledata_t *_g_dn_fifo;
-			extern moduledata_t *_g_dn_wf2qp;
-			extern moduledata_t *_g_dn_rr;
-			extern moduledata_t *_g_dn_qfq;
-#ifdef WITH_KPS
-			extern moduledata_t *_g_dn_kps;
-#endif
-			if (!strcmp(av[1], "rr"))
-				mod = _g_dn_rr;
-			else if (!strcmp(av[1], "wf2qp"))
-				mod = _g_dn_wf2qp;
-			else if (!strcmp(av[1], "fifo"))
-				mod = _g_dn_fifo;
-			else if (!strcmp(av[1], "qfq"))
-				mod = _g_dn_qfq;
-#ifdef WITH_KPS
-			else if (!strcmp(av[1], "kps"))
-				mod = _g_dn_kps;
-#endif
-			else
-				mod = NULL;
-			c->name = mod ? mod->name : "NULL";
-			DX(3, "using scheduler %s", c->name);
-		} else if (!strcmp(*av, "-len")) {
-			c->lmin = getnum(av[1], NULL, av[0]);
-			c->lmax = c->lmin;
-			DX(3, "setting max to %d", c->th_max);
-		} else if (!strcmp(*av, "-burst")) {
-			c->maxburst = getnum(av[1], NULL, av[0]);
-			DX(3, "setting max to %d", c->th_max);
-		} else if (!strcmp(*av, "-qmax")) {
-			c->th_max = getnum(av[1], NULL, av[0]);
-			DX(3, "setting max to %d", c->th_max);
-		} else if (!strcmp(*av, "-qmin")) {
-			c->th_min = getnum(av[1], NULL, av[0]);
-			DX(3, "setting min to %d", c->th_min);
-		} else if (!strcmp(*av, "-flows")) {
-			c->flows = getnum(av[1], NULL, av[0]);
-			DX(3, "setting flows to %d", c->flows);
-		} else if (!strcmp(*av, "-flowsets")) {
-			parse_flowsets(c, av[1], 0);
-			DX(3, "setting flowsets to %d", c->flowsets);
-		} else {
-			D("option %s not recognised, ignore", *av);
-		}
-		ac -= 2; av += 2;
-	}
-	if (c->maxburst <= 0)
-		c->maxburst = 1;
-	if (c->loops <= 0)
-		c->loops = 1;
-	if (c->flows <= 0)
-		c->flows = 1;
-	if (c->flowsets <= 0)
-		c->flowsets = 1;
-	if (c->lmin <= 0)
-		c->lmin = 1;
-	if (c->lmax <= 0)
-		c->lmax = 1;
-	/* multiply by N */
-	if (c->th_min < 0)
-		c->th_min = c->flows * -c->th_min;
-	if (c->th_max < 0)
-		c->th_max = c->flows * -c->th_max;
-	if (c->th_max <= c->th_min)
-		c->th_max = c->th_min + 1;
-	if (mod) {
-		p = mod->p;
-		DX(3, "using module %s f %p p %p", mod->name, mod->f, mod->p);
-		DX(3, "modname %s ty %d", p->name, p->type);
-		c->enq = p->enqueue;
-		c->deq = p->dequeue;
-		c->si_len += p->si_datalen;
-		c->q_len += p->q_datalen;
-		c->schk_len += p->schk_datalen;
-	}
-	/* allocate queues, flowsets and one scheduler */
-	c->q = calloc(c->flows, c->q_len);
-	c->fs = calloc(c->flowsets, sizeof(struct dn_fsk));
-	c->si = calloc(1, c->si_len);
-	c->sched = calloc(c->flows, c->schk_len);
-	if (c->q == NULL || c->fs == NULL) {
-		D("error allocating memory for flows");
-		exit(1);
-	}
-	c->si->sched = c->sched;
-	if (p) {
-		if (p->config)
-			p->config(c->sched);
-		if (p->new_sched)
-			p->new_sched(c->si);
-	}
-	/* parse_flowsets links queues to their flowsets */
-	parse_flowsets(c, av[1], 1);
-	/* complete the work calling new_fsk */
-	for (i = 0; i < c->flowsets; i++) {
-		if (c->fs[i].fs.par[1] == 0)
-			c->fs[i].fs.par[1] = 1000;	/* default pkt len */
-		c->fs[i].sched = c->sched;
-		if (p && p->new_fsk)
-			p->new_fsk(&c->fs[i]);
-	}
-
-	/* initialize the lists for the generator, and put
-	 * all flows in the list for backlog = 0
-	 */
-	for (i=0; i <= BACKLOG+5; i++)
-		INIT_LIST_HEAD(&c->ll[i]);
-
-	for (i = 0; i < c->flows; i++) {
-		struct dn_queue *q = FI2Q(c, i);
-		if (q->fs == NULL)
-			q->fs = &c->fs[0]; /* XXX */
-		q->_si = c->si;
-		if (p && p->new_queue)
-			p->new_queue(q);
-		INIT_LIST_HEAD(&q->ni.h);
-		list_add_tail(&q->ni.h, &c->ll[0]);
-	}
-	c->llmask = 1;
-	return 0;
-}
-
-
-int
-main(int ac, char *av[])
-{
-	struct cfg_s c;
-	struct timeval end;
-	double ll;
-	int i;
-	char msg[40];
-
-	bzero(&c, sizeof(c));
-	c.ac = ac;
-	c.av = av;
-	init(&c);
-	gettimeofday(&c.time, NULL);
-	mainloop(&c);
-	gettimeofday(&end, NULL);
-	end.tv_sec -= c.time.tv_sec;
-	end.tv_usec -= c.time.tv_usec;
-	if (end.tv_usec < 0) {
-		end.tv_usec += 1000000;
-		end.tv_sec--;
-	}
-	c.time = end;
-	ll = end.tv_sec*1000000 + end.tv_usec;
-	ll *= 1000;	/* convert to nanoseconds */
-	ll /= c._enqueue;
-	sprintf(msg, "1::%d", c.flows);
-	D("%-8s n %d %d time %d.%06d %8.3f qlen %d %d flows %s drops %d",
-		c.name, c._enqueue, c.loops,
-		(int)c.time.tv_sec, (int)c.time.tv_usec, ll,
-		c.th_min, c.th_max,
-		c.fs_config ? c.fs_config : msg, c.drop);
-	dump(&c);
-	DX(1, "done ac %d av %p", ac, av);
-	for (i=0; i < ac; i++)
-		DX(1, "arg %d %s", i, av[i]);
-	return 0;
-}
-
-/*
- * The controller decides whether in this iteration we should send
- * (the packet is in c->tosend) and/or receive (flag c->can_dequeue)
- */
-static void
-controller(struct cfg_s *c)
-{
-	struct mbuf *m;
-	struct dn_fs *fs;
-	int flow_id;
-
-	/* histeresis between max and min */
-	if (c->state == 0 && c->pending >= c->th_max)
-		c->state = 1;
-	else if (c->state == 1 && c->pending <= c->th_min)
-		c->state = 0;
-	ND(1, "state %d pending %2d", c->state, c->pending);
-	c->can_dequeue = c->state;
-	c->tosend = NULL;
-	if (c->state)
-		return;
-
-    if (1) {
-	int i;
-	struct dn_queue *q;
-	struct list_head *h;
-
-	i = ffs(c->llmask) - 1;
-	if (i < 0) {
-		DX(2, "no candidate");
-		c->can_dequeue = 1;
-		return;
-	}
-	h = &c->ll[i];
-	ND(1, "backlog %d p %p prev %p next %p", i, h, h->prev, h->next);
-	q = list_first_entry(h, struct dn_queue, ni.h);
-	list_del(&q->ni.h);
-	flow_id = Q2FI(c, q);
-	DX(2, "extracted flow %p %d backlog %d", q, flow_id, i);
-	if (list_empty(h)) {
-		ND(2, "backlog %d empty", i);
-		c->llmask &= ~(1<<i);
-	}
-	ND(1, "before %d p %p prev %p next %p", i+1, h+1, h[1].prev, h[1].next);
-	list_add_tail(&q->ni.h, h+1);
-	ND(1, " after %d p %p prev %p next %p", i+1, h+1, h[1].prev, h[1].next);
-	if (i < BACKLOG) {
-		ND(2, "backlog %d full", i+1);
-		c->llmask |= 1<<(1+i);
-	}
-	fs = &q->fs->fs;
-	c->cur_fs = q->fs - c->fs;
-	fs->cur = flow_id;
-    } else {
-	/* XXX this does not work ? */
-	/* now decide whom to send the packet, and the length */
-	/* lookup in the flow table */
-	if (c->cur_y >= c->max_y) {	/* handle wraparound */
-		c->cur_y = 0;
-		c->cur_fs = 0;
-	}
-	fs = &c->fs[c->cur_fs].fs;
-	flow_id = fs->cur++;
-	if (fs->cur >= fs->next_flow)
-		fs->cur = fs->first_flow;
-	c->cur_y++;
-	if (c->cur_y >= fs->next_y)
-		c->cur_fs++;
-    }
-
-	/* construct a packet */
-	if (c->freelist) {
-		m = c->tosend = c->freelist;
-		c->freelist = c->freelist->m_nextpkt;
-	} else {
-		m = c->tosend = calloc(1, sizeof(struct mbuf));
-	}
-	if (m == NULL)
-		return;
-
-	m->cfg = c;
-	m->m_nextpkt = NULL;
-	m->m_pkthdr.len = fs->par[1]; // XXX maxlen
-	m->flow_id = flow_id;
-
-	ND(2,"y %6d flow %5d fs %3d weight %4d len %4d",
-		c->cur_y, m->flow_id, c->cur_fs,
-		fs->par[0], m->m_pkthdr.len);
-
-}
-
-/*
-Packet allocation:
-to achieve a distribution that matches weights, for each X=w/lmax class
-we should generate a number of packets proportional to Y = X times the number
-of flows in the class.
-So we construct an array with the cumulative distribution of Y's,
-and use it to identify the flow via inverse mapping (if the Y's are
-not too many we can use an array for the lookup). In practice,
-each flow will have X entries [virtually] pointing to it.
-
-*/
diff --git a/sys/netinet/ipfw/test/mylist.h b/sys/netinet/ipfw/test/mylist.h
deleted file mode 100644
index 6247f32ea4e4..000000000000
--- a/sys/netinet/ipfw/test/mylist.h
+++ /dev/null
@@ -1,49 +0,0 @@
-/*
- * $FreeBSD$
- *
- * linux-like bidirectional lists
- */
-
-#ifndef _MYLIST_H
-#define _MYLIST_H
-struct list_head {
-        struct list_head *prev, *next;
-};
-
-#define INIT_LIST_HEAD(l) do {  (l)->prev = (l)->next = (l); } while (0)
-#define list_empty(l)   ( (l)->next == l )
-static inline void
-__list_add(struct list_head *o, struct list_head *prev,
-        struct list_head *next)
-{
-        next->prev = o;
-        o->next = next;
-        o->prev = prev;
-        prev->next = o;
-}
- 
-static inline void
-list_add_tail(struct list_head *o, struct list_head *head)
-{
-        __list_add(o, head->prev, head);
-}
-
-#define list_first_entry(pL, ty, member)        \
-        (ty *)((char *)((pL)->next) - offsetof(ty, member))
-
-static inline void
-__list_del(struct list_head *prev, struct list_head *next)
-{
-        next->prev = prev;
-        prev->next = next;
-}
-
-static inline void
-list_del(struct list_head *entry)
-{
-	ND("called on %p", entry);
-        __list_del(entry->prev, entry->next);
-        entry->next = entry->prev = NULL;
-}
-
-#endif /* _MYLIST_H */
diff --git a/sys/netinet/ipfw/test/test_dn_heap.c b/sys/netinet/ipfw/test/test_dn_heap.c
deleted file mode 100644
index d460cf2ff36b..000000000000
--- a/sys/netinet/ipfw/test/test_dn_heap.c
+++ /dev/null
@@ -1,162 +0,0 @@
-/*-
- * Copyright (c) 1998-2002,2010 Luigi Rizzo, Universita` di Pisa
- * All rights reserved
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-/*
- * Userland code for testing binary heaps and hash tables
- *
- * $FreeBSD$
- */
-
-#include <sys/cdefs.h>
-#include <sys/param.h>
-
-#include <stdio.h>
-#include <strings.h>
-#include <stdlib.h>
-
-#include  "dn_heap.h"
-#define log(x, arg...)	fprintf(stderr, ## arg)
-#define panic(x...)	fprintf(stderr, ## x), exit(1)
-
-#include <string.h>
-
-struct x {
-	struct x *ht_link;
-	char buf[0];
-};
-
-uint32_t hf(uintptr_t key, int flags, void *arg)
-{
-	return (flags & DNHT_KEY_IS_OBJ) ?
-		((struct x *)key)->buf[0] : *(char *)key;
-}
-
-int matchf(void *obj, uintptr_t key, int flags, void *arg)
-{
-	char *s = (flags & DNHT_KEY_IS_OBJ) ?
-		((struct x *)key)->buf : (char *)key;
-	return (strcmp(((struct x *)obj)->buf, s) == 0);
-}
-
-void *newfn(uintptr_t key, int flags, void *arg)
-{
-	char *s = (char *)key;
-	struct x *p = malloc(sizeof(*p) + 1 + strlen(s));
-	if (p)
-		strcpy(p->buf, s);
-	return p;
-}
-
-char *strings[] = {
-	"undici", "unico", "doppio", "devoto",
-	"uno", "due", "tre", "quattro", "cinque", "sei",
-	"uno", "due", "tre", "quattro", "cinque", "sei",
-	NULL,
-};
-
-int doprint(void *_x, void *arg)
-{
-	struct x *x = _x;
-	printf("found element <%s>\n", x->buf);
-	return (int)arg;
-}
-
-static void
-test_hash()
-{
-	char **p;
-	struct dn_ht *h;
-	uintptr_t x = 0;
-	uintptr_t x1 = 0;
-
-	/* first, find and allocate */
-	h = dn_ht_init(NULL, 10, 0, hf, matchf, newfn);
-
-	for (p = strings; *p; p++) {
-		dn_ht_find(h, (uintptr_t)*p, DNHT_INSERT, NULL);
-	}
-	dn_ht_scan(h, doprint, 0);
-	printf("/* second -- find without allocate */\n");
-	h = dn_ht_init(NULL, 10, 0, hf, matchf, NULL);
-	for (p = strings; *p; p++) {
-		void **y = newfn((uintptr_t)*p, 0, NULL);
-		if (x == 0)
-			x = (uintptr_t)y;
-		else {
-			if (x1 == 0)
-				x1 = (uintptr_t)*p;
-		}
-		dn_ht_find(h, (uintptr_t)y, DNHT_INSERT | DNHT_KEY_IS_OBJ, NULL);
-	}
-	dn_ht_scan(h, doprint, 0);
-	printf("remove %p gives %p\n", (void *)x,
-		dn_ht_find(h, x, DNHT_KEY_IS_OBJ | DNHT_REMOVE, NULL));
-	printf("remove %p gives %p\n", (void *)x,
-		dn_ht_find(h, x, DNHT_KEY_IS_OBJ | DNHT_REMOVE, NULL));
-	printf("remove %p gives %p\n", (void *)x,
-		dn_ht_find(h, x1, DNHT_REMOVE, NULL));
-	printf("remove %p gives %p\n", (void *)x,
-		dn_ht_find(h, x1, DNHT_REMOVE, NULL));
-	dn_ht_scan(h, doprint, 0);
-}
-
-int
-main(int argc, char *argv[])
-{
-	struct dn_heap h;
-	int i, n, n2, n3;
-
-	test_hash();
-	return 0;
-
-	/* n = elements, n2 = cycles */
-	n = (argc > 1) ? atoi(argv[1]) : 0;
-	if (n <= 0 || n > 1000000)
-		n = 100;
-	n2 = (argc > 2) ? atoi(argv[2]) : 0;
-	if (n2 <= 0)
-		n = 1000000;
-	n3 = (argc > 3) ? atoi(argv[3]) : 0;
-	bzero(&h, sizeof(h));
-	heap_init(&h, n, -1);
-	while (n2-- > 0) {
-		uint64_t prevk = 0;
-		for (i=0; i < n; i++)
-			heap_insert(&h, n3 ? n-i: random(), (void *)(100+i));
-		
-		for (i=0; h.elements > 0; i++) {
-			uint64_t k = h.p[0].key;
-			if (k < prevk)
-				panic("wrong sequence\n");
-			prevk = k;
-			if (0)
-			printf("%d key %llu, val %p\n",
-				i, h.p[0].key, h.p[0].object);
-			heap_extract(&h, NULL);
-		}
-	}
-	return 0;
-}
diff --git a/sys/netinet/ipfw/test/test_dn_sched.c b/sys/netinet/ipfw/test/test_dn_sched.c
deleted file mode 100644
index ee46c95ed868..000000000000
--- a/sys/netinet/ipfw/test/test_dn_sched.c
+++ /dev/null
@@ -1,89 +0,0 @@
-/*
- * $FreeBSD$
- *
- * library functions for userland testing of dummynet schedulers
- */
-
-#include "dn_test.h"
-
-void
-m_freem(struct mbuf *m)
-{
-	printf("free %p\n", m);
-}
-
-int
-dn_sched_modevent(module_t mod, int cmd, void *arg)
-{
-	return 0;
-}
-
-void
-dn_free_pkts(struct mbuf *m)
-{
-	struct mbuf *x;
-	while ( (x = m) ) {
-		m = m->m_nextpkt;
-		m_freem(x);
-	}
-}
-		
-int
-dn_delete_queue(void *_q, void *do_free)
-{
-	struct dn_queue *q = _q;
-        if (q->mq.head)
-                dn_free_pkts(q->mq.head);
-        free(q);
-        return 0;
-}
-
-/*
- * This is a simplified function for testing purposes, which does
- * not implement statistics or random loss.
- * Enqueue a packet in q, subject to space and queue management policy
- * (whose parameters are in q->fs).
- * Update stats for the queue and the scheduler.
- * Return 0 on success, 1 on drop. The packet is consumed anyways.
- */
-int
-dn_enqueue(struct dn_queue *q, struct mbuf* m, int drop)
-{
-        if (drop)
-                goto drop;
-        if (q->ni.length >= 200)
-                goto drop;
-        mq_append(&q->mq, m);
-        q->ni.length++;
-        q->ni.tot_bytes += m->m_pkthdr.len;
-        return 0;
-
-drop:
-        q->ni.drops++;
-        return 1;
-}
-
-int
-ipdn_bound_var(int *v, int dflt, int lo, int hi, const char *msg)
-{
-        if (*v < lo) {
-                *v = dflt;
-        } else if (*v > hi) {
-                *v = hi;
-        }
-        return *v;
-}
-
-#ifndef __FreeBSD__
-int
-fls(int mask)
-{
-	int bit;
-
-	if (mask == 0)
-		return (0);
-	for (bit = 1; mask != 1; bit++)
-		mask = (unsigned int)mask >> 1;
-	return (bit);
-}
-#endif