OpenBSD-3/3.5-sys-diffs

--- sys/arch/alpha/alpha/conf.c.orig	Sat Feb 21 15:09:52 2004
+++ sys/arch/alpha/alpha/conf.c	Thu Jul  8 14:04:39 2004
@@ -103,6 +103,11 @@
 #include "lpt.h"
 cdev_decl(lpt);
 cdev_decl(prom);			/* XXX XXX XXX */
+#ifdef IPFILTER
+#define NIPF 1
+#else
+#define NIPF 0
+#endif
 cdev_decl(wd);
 cdev_decl(fd);
 #include "cy.h"
@@ -173,7 +178,7 @@
 	cdev_midi_init(NMIDI,midi),     /* 41: MIDI I/O */
         cdev_midi_init(NSEQUENCER,sequencer),   /* 42: sequencer I/O */
 	cdev_disk_init(NRAID,raid),	/* 43: RAIDframe disk driver */
-	cdev_notdef(),			/* 44 */
+	cdev_gen_ipf(NIPF,ipl),		/* 44: IP filter log */
 	cdev_usb_init(NUSB,usb),	/* 45: USB controller */
 	cdev_usbdev_init(NUHID,uhid),	/* 46: USB generic HID */
 	cdev_ulpt_init(NULPT,ulpt),	/* 47: USB printer */
--- sys/arch/hp300/hp300/conf.c.orig	Sat Feb 21 15:10:07 2004
+++ sys/arch/hp300/hp300/conf.c	Thu Jul  8 14:04:40 2004
@@ -122,6 +122,12 @@
 cdev_decl(xfs_dev);
 #endif
 
+#ifdef IPFILTER
+#define NIPF 1
+#else
+#define NIPF 0
+#endif
+
 #include "pf.h"
 
 #include "systrace.h"
@@ -165,7 +171,7 @@
 	cdev_disk_init(NRD,rd),		/* 34: RAM disk */
 	cdev_tty_init(NAPCI,apci),	/* 35: Apollo APCI UARTs */
 	cdev_ksyms_init(NKSYMS,ksyms),	/* 36: Kernel symbols device */
-	cdev_notdef(),			/* 37 */
+	cdev_pf_init(NIPF,ipl),		/* 37: packet filter */
 	cdev_notdef(),			/* 38 */
 	cdev_notdef(),			/* 39 */
 	cdev_notdef(),			/* 40 */
--- sys/arch/hppa/hppa/conf.c.orig	Sat Feb 21 15:10:10 2004
+++ sys/arch/hppa/hppa/conf.c	Thu Jul  8 14:07:09 2004
@@ -107,6 +107,12 @@
 #include "com.h"
 cdev_decl(com);
 
+#ifdef IPFILTER
+#define NIPF 1
+#else
+#define NIPF 0
+#endif
+
 #include "pf.h"
 
 #include "systrace.h"
@@ -166,7 +172,7 @@
 	cdev_crypto_init(NCRYPTO,crypto), /* 36: /dev/crypto */
 	cdev_ses_init(NSES,ses),	/* 37: SCSI SES/SAF-TE */
 	cdev_ptm_init(NPTY,ptm),	/* 38: pseudo-tty ptm device */
-	cdev_lkm_dummy(),
+	cdev_gen_ipf(NIPF,ipl),		/* 39: ip filtering */
 	cdev_lkm_dummy(),
 	cdev_lkm_dummy(),
 	cdev_lkm_dummy(),
--- sys/arch/i386/i386/conf.c.orig	Sat Feb 21 15:10:12 2004
+++ sys/arch/i386/i386/conf.c	Thu Jul  8 14:07:28 2004
@@ -185,6 +185,12 @@
 #include "radio.h"
 #include "gpr.h"
 
+#ifdef IPFILTER
+#define NIPF 1
+#else
+#define NIPF 0
+#endif
+
 /* XXX -- this needs to be supported by config(8)! */
 #if (NCOM > 0) && (NPCCOM > 0)
 #error com and pccom are mutually exclusive.  Sorry.
@@ -310,6 +316,7 @@
  	cdev_oci_init(NBIO,bio),	/* 79: ioctl tunnel */
 	cdev_ch_init(NGPR,gpr),		/* 80: GPR400 SmartCard reader */
 	cdev_ptm_init(NPTY,ptm),	/* 81: pseudo-tty ptm device */
+	cdev_gen_ipf(NIPF,ipl),		/* 82: ip filtering */
 };
 int	nchrdev = sizeof(cdevsw) / sizeof(cdevsw[0]);
 
--- sys/arch/mac68k/mac68k/conf.c.orig	Sat Feb 21 15:10:19 2004
+++ sys/arch/mac68k/mac68k/conf.c	Thu Jul  8 14:04:40 2004
@@ -104,6 +104,12 @@
 cdev_decl(xfs_dev);
 #endif
 
+#ifdef IPFILTER
+#define NIPF 1
+#else
+#define NIPF 0
+#endif
+
 #include "pf.h"
 
 #include "systrace.h"
@@ -148,7 +154,7 @@
 	cdev_pf_init(NPF,pf),		/* 35: packet filter */
 	cdev_audio_init(NASC,asc),      /* 36: ASC audio device */
 	cdev_ksyms_init(NKSYMS,ksyms),	/* 37: Kernel symbols device */
-	cdev_notdef(),			/* 38 */
+	cdev_gen_ipf(NIPF,ipl),		/* 38: IP filter log */
 	cdev_notdef(),			/* 39 */
 	cdev_notdef(),			/* 40 */
 	cdev_notdef(),			/* 41 */
--- sys/arch/macppc/macppc/conf.c.orig	Sat Feb 21 15:10:20 2004
+++ sys/arch/macppc/macppc/conf.c	Thu Jul  8 14:04:40 2004
@@ -105,6 +105,12 @@
 
 #include "tun.h"
 
+#ifdef IPFILTER
+#define NIPF 1
+#else
+#define NIPF 0
+#endif
+
 #ifdef XFS
 #include <xfs/nxfs.h>
 cdev_decl(xfs_dev);
@@ -191,7 +197,7 @@
 	cdev_ss_init(NSS,ss),		/* 42: SCSI scanner */
 	cdev_ksyms_init(NKSYMS,ksyms),	/* 43: Kernel symbols device */
 	cdev_audio_init(NAUDIO,audio),	/* 44: generic audio I/O */
-	cdev_notdef(),			/* 45 */
+	cdev_gen_ipf(NIPF,ipl),		/* 45: IP filter */
 	cdev_notdef(),			/* 46 */
 	cdev_crypto_init(NCRYPTO,crypto), /* 47: /dev/crypto */
 	cdev_notdef(),			/* 48 */
--- sys/arch/mvme68k/mvme68k/conf.c.orig	Sat Feb 21 15:10:21 2004
+++ sys/arch/mvme68k/mvme68k/conf.c	Thu Jul  8 14:08:04 2004
@@ -148,6 +148,12 @@
 #include "bpfilter.h"
 #include "tun.h"
 
+#ifdef IPFILTER
+#define NIPF 1
+#else
+#define NIPF 0
+#endif
+
 #include "pf.h"
 
 #include "systrace.h"
@@ -203,7 +209,7 @@
 	cdev_ss_init(NSS,ss),           /* 42: SCSI scanner */
 	cdev_ksyms_init(NKSYMS,ksyms),	/* 43: Kernel symbols device */
 	cdev_ch_init(NCH,ch),		/* 44: SCSI autochanger */
-	cdev_lkm_dummy(),		/* 45 */
+	cdev_gen_ipf(NIPF,ipl),		/* 45: IP filter */
 	cdev_lkm_dummy(),		/* 46 */
 	cdev_lkm_dummy(),		/* 47 */
 	cdev_lkm_dummy(),		/* 48 */
--- sys/arch/mvme88k/mvme88k/conf.c.orig	Sat Feb 21 15:10:24 2004
+++ sys/arch/mvme88k/mvme88k/conf.c	Thu Jul  8 14:09:53 2004
@@ -99,6 +99,12 @@
 cdev_decl(lptwo);
 #endif /* notyet */
 
+#ifdef IPFILTER
+#define NIPF 1
+#else
+#define NIPF 0
+#endif
+
 #include "pf.h"
 
 #include "systrace.h"
@@ -189,7 +195,7 @@
 	cdev_ss_init(NSS,ss),		/* 42 */
 	cdev_ksyms_init(NKSYMS,ksyms),	/* 43: Kernel symbols device */
 	cdev_ch_init(NCH,ch),		/* 44: SCSI autochanger */
-	cdev_notdef(),			/* 45 */
+	cdev_gen_ipf(NIPF,ipl),		/* 45: IP filter */
 	cdev_notdef(),			/* 46 */
 	cdev_notdef(),			/* 47 */
 	cdev_notdef(),			/* 48 */
--- sys/arch/mvmeppc/mvmeppc/conf.c.orig	Sat Feb 21 15:10:29 2004
+++ sys/arch/mvmeppc/mvmeppc/conf.c	Thu Jul  8 14:04:41 2004
@@ -112,6 +112,12 @@
  
 #include "ksyms.h"
 
+#ifdef IPFILTER
+#define NIPF 1
+#else
+#define NIPF 0
+#endif
+
 #include "pf.h"
 
 #include "systrace.h"
@@ -165,7 +171,7 @@
 	cdev_uk_init(NUK,uk),		/* 41: unknown SCSI */
 	cdev_ss_init(NSS,ss),           /* 42: SCSI scanner */
 	cdev_ksyms_init(NKSYMS,ksyms),	/* 43: Kernel symbols device */
-        cdev_notdef(),                  /* 44 */
+	cdev_gen_ipf(NIPF,ipl),		/* 44: IP filter */
         cdev_notdef(),                  /* 45 */
         cdev_notdef(),                  /* 46 */
         cdev_notdef(),                  /* 47 */
--- sys/arch/sparc/sparc/conf.c.orig	Sat Feb 21 15:10:36 2004
+++ sys/arch/sparc/sparc/conf.c	Thu Jul  8 14:04:41 2004
@@ -124,6 +124,12 @@
 };
 int	nblkdev = sizeof(bdevsw) / sizeof(bdevsw[0]);
 
+#ifdef IPFILTER
+#define NIPF 1
+#else
+#define NIPF 0
+#endif
+
 #include "pf.h"
 
 #include "systrace.h"
@@ -194,7 +200,7 @@
 	cdev_notdef(),			/* 57 */
 	cdev_disk_init(NCD,cd),		/* 58: SCSI CD-ROM */
 	cdev_pf_init(NPF,pf),		/* 59: packet filter */
-	cdev_notdef(),			/* 60 */
+	cdev_gen_ipf(NIPF,ipl),		/* 60: ip filtering log */
 	cdev_notdef(),			/* 61 */
 	cdev_notdef(),			/* 62 */
 	cdev_notdef(),			/* 63 */
--- sys/arch/sparc64/sparc64/conf.c.orig	Sat Feb 21 15:10:38 2004
+++ sys/arch/sparc64/sparc64/conf.c	Thu Jul  8 14:04:41 2004
@@ -110,6 +110,12 @@
 #include "ucom.h"
 #include "uscanner.h"
 
+#ifdef IPFILTER
+#define NIPF 1
+#else
+#define NIPF 0
+#endif
+
 #include "pf.h"
 
 #ifdef XFS
@@ -246,7 +252,7 @@
 	cdev_mouse_init(NWSKBD, wskbd),	/* 79: keyboards */
 	cdev_mouse_init(NWSMOUSE, wsmouse), /* 80: mice */
 	cdev_mouse_init(NWSMUX, wsmux),	/* 81: ws multiplexor */
-	cdev_notdef(),			/* 82 */
+	cdev_gen_ipf(NIPF,ipl),		/* 82: IP filter */
 	cdev_notdef(),			/* 83 */
 	cdev_notdef(),			/* 84 */
 	cdev_notdef(),			/* 85 */
--- sys/arch/vax/vax/conf.c.orig	Sat Feb 21 15:10:41 2004
+++ sys/arch/vax/vax/conf.c	Thu Jul  8 14:04:41 2004
@@ -353,6 +353,12 @@
 #include "wskbd.h"
 #include "wsmouse.h"
 
+#ifdef IPFILTER
+#define NIPF 1
+#else
+#define NIPF 0
+#endif
+
 #include "pf.h"
 
 #include "systrace.h"
@@ -406,7 +412,7 @@
 	cdev_notdef(),			/* 44  was Datakit */
 	cdev_notdef(),			/* 45  was Datakit */
 	cdev_notdef(),			/* 46  was Datakit */
-	cdev_notdef(),			/* 47 */
+	cdev_gen_ipf(NIPF,ipl),		/* 47: IP filter */
 	cdev_notdef(),			/* 48 */
 	cdev_systrace_init(NSYSTRACE,systrace),	/* 49: system call tracing */
 	cdev_ksyms_init(NKSYMS,ksyms),  /* 50: Kernel symbols device */
--- sys/arch/amd64/amd64/conf.c.orig	Thu Feb 26 06:22:12 2004
+++ sys/arch/amd64/amd64/conf.c	Sat Jul 10 12:31:46 2004
@@ -191,6 +191,12 @@
 
 #include "pf.h"
 
+#ifdef IPFILTER
+#define NIPF 1
+#else
+#define NIPF 0
+#endif
+
 struct cdevsw	cdevsw[] =
 {
 	cdev_cn_init(1,cn),		/* 0: virtual console */
@@ -295,6 +301,7 @@
  	cdev_oci_init(NBIO,bio),	/* 79: ioctl tunnel */
 	cdev_notdef(),			/* 80: gpr? XXX */
 	cdev_ptm_init(NPTY,ptm),	/* 81: pseudo-tty ptm device */
+	cdev_gen_ipf(NIPF, ipl),	/* 82: IP Filtering */
 };
 int	nchrdev = sizeof(cdevsw) / sizeof(cdevsw[0]);
 
--- sys/conf/GENERIC.orig	Wed Mar  3 08:23:46 2004
+++ sys/conf/GENERIC	Thu Jul  8 14:04:41 2004
@@ -72,6 +72,8 @@
 #option		EON		# OSI tunneling over IP
 #option		NETATALK	# AppleTalk
 #option		CCITT,LLC,HDLC	# X.25
+option		IPFILTER	# IP packet filter for security
+option		IPFILTER_LOG	# use /dev/ipl to log IPF
 option		PPP_BSDCOMP	# PPP BSD compression
 option		PPP_DEFLATE
 #option		MROUTING	# Multicast router
--- sys/conf/files.orig	Sun Mar 14 05:44:13 2004
+++ sys/conf/files	Thu Jul  8 14:04:41 2004
@@ -719,6 +719,14 @@
 file netinet/tcp_usrreq.c		inet
 file netinet/udp_usrreq.c		inet
 file netinet/ip_gre.c			inet
+file netinet/ip_fil.c			ipfilter
+file netinet/fil.c			ipfilter
+file netinet/ip_nat.c			ipfilter
+file netinet/ip_frag.c			ipfilter
+file netinet/ip_state.c			ipfilter
+file netinet/ip_proxy.c			ipfilter
+file netinet/ip_auth.c			ipfilter
+file netinet/ip_log.c			ipfilter
 file netinet/ip_ipsp.c			(inet | inet6) & (ipsec | tcp_signature)
 file netinet/ip_spd.c			(inet | inet6) & (ipsec | tcp_signature)
 file netinet/ip_ipip.c			inet | inet6
--- sys/net/bridgestp.c.orig	Wed Dec  3 09:00:10 2003
+++ sys/net/bridgestp.c	Thu Jul  8 14:04:42 2004
@@ -58,6 +58,11 @@
 #include <netinet/in_var.h>
 #include <netinet/ip.h>
 #include <netinet/if_ether.h>
+
+#ifdef IPFILTER
+#include <netinet/ip_compat.h>
+#include <netinet/ip_fil.h>
+#endif
 #endif
 
 #if NBPFILTER > 0
--- sys/net/if.c.orig	Sun Feb 29 05:34:01 2004
+++ sys/net/if.c	Thu Jul  8 14:04:42 2004
@@ -99,6 +99,12 @@
 #include <netinet6/nd6.h>
 #endif
 
+#ifdef IPFILTER
+#include <netinet/ip_compat.h>
+#include <netinet/ip_fil.h>
+#include <netinet/ip_nat.h>
+#endif
+
 #if NBPFILTER > 0
 #include <net/bpf.h>
 #endif
@@ -556,6 +562,11 @@
 
 	/* Remove the interface from the list of all interfaces.  */
 	TAILQ_REMOVE(&ifnet, ifp, if_list);
+
+#ifdef IPFILTER
+	/* XXX More ipf & ipnat cleanup needed.  */
+	frsync(ifp);
+#endif
 
 	/*
 	 * Deallocate private resources.
--- sys/net/if_bridge.c.orig	Sat Feb 21 15:11:02 2004
+++ sys/net/if_bridge.c	Thu Jul  8 14:04:42 2004
@@ -66,7 +66,11 @@
 #include <netinet/ip_ipsp.h>
 
 #include <net/if_enc.h>
+#if (defined(IPFILTER) || defined(IPFILTER_LKM))
+#include <netinet/ip_compat.h>
+#include <netinet/ip_fil.h>
 #endif
+#endif
 
 #ifdef INET6
 #include <netinet/ip6.h>
@@ -152,7 +156,7 @@
 int	bridge_brlconf(struct bridge_softc *, struct ifbrlconf *);
 u_int8_t bridge_filterrule(struct brl_head *, struct ether_header *,
     struct mbuf *);
-#if NPF > 0
+#if (NPF > 0) || (defined(IPFILTER) || defined(IPFILTER_LKM))
 struct mbuf *bridge_filter(struct bridge_softc *, int, struct ifnet *,
     struct ether_header *, struct mbuf *m);
 #endif
@@ -1218,7 +1222,7 @@
 		m_freem(m);
 		return;
 	}
-#if NPF > 0
+#if (NPF > 0) || (defined(IPFILTER) || defined(IPFILTER_LKM))
 	m = bridge_filter(sc, BRIDGE_IN, src_if, &eh, m);
 	if (m == NULL)
 		return;
@@ -1261,7 +1265,7 @@
 		m_freem(m);
 		return;
 	}
-#if NPF > 0
+#if (NPF > 0) || (defined(IPFILTER) || defined(IPFILTER_LKM))
 	m = bridge_filter(sc, BRIDGE_OUT, dst_if, &eh, m);
 	if (m == NULL)
 		return;
@@ -1509,7 +1513,7 @@
 			mc = m1;
 		}
 
-#if NPF > 0
+#if (NPF > 0) || (defined(IPFILTER) || defined(IPFILTER_LKM))
 		mc = bridge_filter(sc, BRIDGE_OUT, dst_if, eh, mc);
 		if (mc == NULL)
 			continue;
@@ -2287,6 +2291,12 @@
 			 * We don't need to do loop detection, the
 			 * bridge will do that for us.
 			 */
+#if defined(IPFILTER) || defined(IPFILTER_LKM)
+			if (dir == BRIDGE_OUT && fr_checkp &&
+			    ((*fr_checkp)(ip, hlen, &encif[0].sc_if,
+			     1, &m) || !m))
+				return 1;
+#endif
 #if NPF > 0
 			switch (af) {
 #ifdef INET
@@ -2311,6 +2321,12 @@
 			if (m == NULL)
 				return (1);
 #endif /* NPF */
+#if defined(IPFILTER) || defined(IPFILTER_LKM)
+			if (dir == BRIDGE_IN && fr_checkp &&
+			    ((*fr_checkp)(ip, hlen, &encif[0].sc_if,
+					  0, &m) || !m))
+				return 1;
+#endif
 			error = ipsp_process_packet(m, tdb, af, 0);
 			return (1);
 		} else
@@ -2321,7 +2337,7 @@
 }
 #endif /* IPSEC */
 
-#if NPF > 0
+#if (NPF > 0) || (defined(IPFILTER) || defined(IPFILTER_LKM))
 /*
  * Filter IP packets by peeking into the ethernet frame.  This violates
  * the ISO model, but allows us to act as a IP filter at the data link
@@ -2424,14 +2440,32 @@
 			return (NULL);
 #endif /* IPSEC */
 
-#if NPF > 0
+#if defined(IPFILTER) || defined(IPFILTER_LKM) || (NPF > 0)
 		/* Finally, we get to filter the packet! */
 		m->m_pkthdr.rcvif = ifp;
+#endif
+#if defined(IPFILTER) || defined(IPFILTER_LKM)
+		if (dir == BRIDGE_OUT) {
+			if (fr_checkp && (*fr_checkp)(ip, hlen, ifp, 1, &m))
+				goto dropit;
+			if (m == NULL)
+				goto dropit;
+		}
+#endif
+#if NPF > 0
 		if (pf_test(dir, ifp, &m) != PF_PASS)
 			goto dropit;
 		if (m == NULL)
 			goto dropit;
 #endif /* NPF */
+#if defined(IPFILTER) || defined(IPFILTER_LKM)
+		if (dir == BRIDGE_IN) {
+			if (fr_checkp && (*fr_checkp)(ip, hlen, ifp, 0, &m))
+				goto dropit;
+			if (m == NULL)
+				goto dropit;
+		}
+#endif
 
 		/* Rebuild the IP header */
 		if (m->m_len < hlen && ((m = m_pullup(m, hlen)) == NULL))
@@ -2472,6 +2506,14 @@
 			return (NULL);
 #endif /* IPSEC */
 
+#if defined(IPFILTER) || defined(IPFILTER_LKM)
+		if (dir == BRIDGE_OUT) {
+			if (fr_checkp && (*fr_checkp)(ip, hlen, ifp, 1, &m))
+				goto dropit;
+			if (m == NULL)
+				return (NULL);
+		}
+#endif
 #if NPF > 0
 		if (pf_test6(dir, ifp, &m) != PF_PASS)
 			goto dropit;
@@ -2478,6 +2520,14 @@
 		if (m == NULL)
 			return (NULL);
 #endif /* NPF */
+#if defined(IPFILTER) || defined(IPFILTER_LKM)
+		if (dir == BRIDGE_IN) {
+			if (fr_checkp && (*fr_checkp)(ip, hlen, ifp, 0, &m))
+				goto dropit;
+			if (m == NULL)
+				return (NULL);
+		}
+#endif
 
 		break;
 	}
@@ -2509,7 +2559,7 @@
 		m_freem(m);
 	return (NULL);
 }
-#endif /* NPF > 0 */
+#endif /* (NPF > 0) || (defined(IPFILTER) || defined(IPFILTER_LKM)) */
 
 void
 bridge_fragment(struct bridge_softc *sc, struct ifnet *ifp,
--- sys/netinet/in_proto.c.orig	Tue Dec 16 15:33:09 2003
+++ sys/netinet/in_proto.c	Thu Jul  8 14:04:42 2004
@@ -159,6 +159,11 @@
 #include <netinet/ip_mroute.h>
 #endif /* MROUTING */
 
+#ifdef IPFILTER
+void iplinit __P((void));
+#define ip_init iplinit
+#endif
+
 #ifdef INET6
 #include <netinet6/ip6_var.h>
 #endif /* INET6 */
--- sys/netinet/ip_input.c.orig	Tue Mar 16 10:36:27 2004
+++ sys/netinet/ip_input.c	Thu Jul  8 14:04:42 2004
@@ -149,6 +149,10 @@
 struct	in_ifaddrhead in_ifaddr;
 struct	ifqueue ipintrq;
 
+#if defined(IPFILTER) || defined(IPFILTER_LKM)
+int	(*fr_checkp) __P((struct ip *, int, struct ifnet *, int, struct mbuf **));
+#endif
+
 int	ipq_locked;
 static __inline int ipq_lock_try(void);
 static __inline void ipq_unlock(void);
@@ -404,6 +408,23 @@
 	ip = mtod(m, struct ip *);
 	hlen = ip->ip_hl << 2;
 	pfrdr = (pfrdr != ip->ip_dst.s_addr);
+#endif
+
+#if defined(IPFILTER) || defined(IPFILTER_LKM)
+	/*
+	 * Check if we want to allow this packet to be processed.
+	 * Consider it to be bad if not.
+	 */
+	{
+		struct mbuf *m0 = m;
+		if (fr_checkp && (*fr_checkp)(ip, hlen, m->m_pkthdr.rcvif, 0, &m0)) {
+			return;   
+		}
+		if (m0 == 0) {  /* in case of 'fastroute' */
+			return;
+		}
+		ip = mtod(m = m0, struct ip *);
+	}
 #endif
 
 	/*
--- sys/netinet/ip_output.c.orig	Sat Feb 21 15:11:04 2004
+++ sys/netinet/ip_output.c	Thu Jul  8 14:04:42 2004
@@ -82,6 +82,10 @@
 static struct mbuf *ip_insertoptions(struct mbuf *, struct mbuf *, int *);
 static void ip_mloopback(struct ifnet *, struct mbuf *, struct sockaddr_in *);
 
+#if defined(IPFILTER) || defined(IPFILTER_LKM)
+extern int (*fr_checkp) __P((struct ip *, int, struct ifnet *, int, struct mbuf **));
+#endif
+
 /*
  * IP output.  The packet in mbuf chain m contains a skeletal IP
  * header (with len, off, ttl, proto, tos, src, dst).
@@ -555,7 +559,31 @@
 	if (sproto != 0) {
 		s = splnet();
 
+#if defined(IPFILTER) || defined(IPFILTER_LKM)
+		if (fr_checkp) {
 		/*
+		 * Ok, it's time for a simple round-trip to the IPF/NAT
+		 * code with the enc0 interface.
+		 */
+			struct mbuf *m1 = m;
+			void *ifp = (void *)&encif[0].sc_if;
+
+			if ((*fr_checkp)(ip, hlen, ifp, 1, &m1)) {
+				error = EHOSTUNREACH;
+				splx(s);
+				goto done;
+			}
+			if (m1 == 0) { /* in case of 'fastroute' */
+				error = 0;
+				splx(s);
+				goto done;
+			}
+			ip = mtod(m = m1, struct ip *);
+			hlen = ip->ip_hl << 2;
+		}
+#endif /* IPFILTER */
+
+		/*
 		 * Packet filter
 		 */
 #if NPF > 0
@@ -653,6 +681,25 @@
 			m->m_pkthdr.csum &= ~M_UDPV4_CSUM_OUT; /* Clear */
 		}
 	}
+
+#if defined(IPFILTER) || defined(IPFILTER_LKM)
+	/*
+	 * looks like most checking has been done now...do a filter check
+	 */
+	{
+		struct mbuf *m1 = m;
+
+		if (fr_checkp && (*fr_checkp)(ip, hlen, ifp, 1, &m1)) {
+			error = EHOSTUNREACH;
+			goto done;
+		}
+		if (m1 == 0) { /* in case of 'fastroute' */
+			error = 0;
+			goto done;
+		}
+		ip = mtod(m = m1, struct ip *);
+	}
+#endif
 
 	/*
 	 * Packet filter
--- sys/netinet6/ip6_input.c.orig	Sat Feb 21 15:11:05 2004
+++ sys/netinet6/ip6_input.c	Thu Jul  8 14:04:42 2004
@@ -128,6 +128,10 @@
 static int ip6_hopopts_input(u_int32_t *, u_int32_t *, struct mbuf **, int *);
 static struct mbuf *ip6_pullexthdr(struct mbuf *, size_t, int);
 
+#if defined(IPFILTER) || defined(IPFILTER_LKM)
+extern int (*fr_checkp) __P((struct ip *, int, struct ifnet *, int, struct mbuf **));
+#endif
+
 /*
  * IP6 initialization: fill in IP6 protocol switch table.
  * All protocols not implemented in kernel go to raw IP6 protocol handler.
@@ -244,6 +248,26 @@
 		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
 		goto bad;
 	}
+
+#if defined(IPFILTER) || defined(IPFILTER_LKM)
+	/*
+	 * Check if we want to allow this packet to be processed.
+	 * Consider it to be bad if not.
+	 */
+	if (fr_checkp != NULL) {
+		struct mbuf *m0 = m;
+
+		if ((*fr_checkp)((struct ip *)ip6, sizeof(*ip6),
+				m->m_pkthdr.rcvif, 0, &m0)) {
+			return;
+		}
+		m = m0;
+		if (m == 0) {  /* in case of 'fastroute' */
+			return;
+		}
+		ip6 = mtod(m, struct ip6_hdr *);
+	}
+#endif
 
 	ip6stat.ip6s_nxthist[ip6->ip6_nxt]++;
 
--- sys/netinet6/ip6_output.c.orig	Thu Feb  5 08:11:17 2004
+++ sys/netinet6/ip6_output.c	Thu Jul  8 14:11:07 2004
@@ -118,6 +118,9 @@
 
 static int ip6_pcbopts(struct ip6_pktopts **, struct mbuf *, struct socket *);
 static int ip6_setmoptions(int, struct ip6_moptions **, struct mbuf *);
+#if defined(IPFILTER) || defined(IPFILTER_LKM)
+extern int (*fr_checkp) __P((struct ip *, int, struct ifnet *, int, struct mbuf **));
+#endif
 static int ip6_getmoptions(int, struct ip6_moptions *, struct mbuf **);
 static int ip6_copyexthdr(struct mbuf **, caddr_t, int);
 static int ip6_insertfraghdr(struct mbuf *, struct mbuf *, int,
@@ -124,7 +127,7 @@
 	struct ip6_frag **);
 static int ip6_insert_jumboopt(struct ip6_exthdrs *, u_int32_t);
 static int ip6_splithdr(struct mbuf *, struct ip6_exthdrs *);
-static int ip6_getpmtu(struct route_in6 *, struct route_in6 *,
+int ip6_getpmtu(struct route_in6 *, struct route_in6 *,
 	struct ifnet *, struct in6_addr *, u_long *, int *);
 
 /*
@@ -797,6 +800,25 @@
 		goto done;
 	ip6 = mtod(m, struct ip6_hdr *);
 #endif
+ 
+#if defined(IPFILTER) || defined(IPFILTER_LKM)     
+ 	/* 
+ 	 * looks like most checking has been done now...do a filter check
+ 	 */
+ 	if (fr_checkp != NULL) {
+ 		struct mbuf *m1 = m;
+ 		if ((*fr_checkp)((struct ip *)ip6, sizeof(*ip6), ifp, 1, &m1)) {
+ 			error = EHOSTUNREACH;
+ 			goto done;
+ 		}
+ 		m = m1;
+ 		if (m1 == 0) { /* in case of 'fastroute' */
+ 			error = 0;
+ 			goto done;
+ 		}
+ 		ip6 = mtod(m, struct ip6_hdr *);
+ 	}
+#endif
 
 	/*
 	 * Send the packet to the outgoing interface.
@@ -1192,7 +1214,7 @@
 	return (0);
 }
 
-static int
+int
 ip6_getpmtu(ro_pmtu, ro, ifp, dst, mtup, alwaysfragp)
 	struct route_in6 *ro_pmtu, *ro;
 	struct ifnet *ifp;
--- sys/sys/conf.h.orig	Sat Feb 21 15:11:07 2004
+++ sys/sys/conf.h	Thu Jul  8 15:11:14 2004
@@ -406,6 +406,13 @@
 	dev_init(c,n,write), dev_init(c,n,ioctl), (dev_type_stop((*))) enodev, \
 	0, (dev_type_poll((*))) enodev, (dev_type_mmap((*))) enodev }
 
+/* open, close, read, ioctl */
+#define cdev_gen_ipf(c, n) { \
+dev_init(c,n,open), dev_init(c,n,close), dev_init(c,n,read), \
+	(dev_type_write((*))) enodev, dev_init(c,n,ioctl), \
+	(dev_type_stop((*))) enodev, 0, (dev_type_poll((*))) enodev, \
+	(dev_type_mmap((*))) enodev }
+
 /* open, close, ioctl */
 #define cdev_pf_init(c,n) { \
 	dev_init(c,n,open), dev_init(c,n,close), (dev_type_read((*))) enodev, \
@@ -586,6 +593,7 @@
 
 cdev_decl(bpf);
 
+cdev_decl(ipl);
 cdev_decl(pf);
 
 cdev_decl(tun);