 @@ -1,1114 +1,1114 @@
-/*	$NetBSD: ip_nat.c,v 1.23 2020/08/01 06:50:42 maxv Exp $	*/
+/*	$NetBSD: ip_nat.c,v 1.24 2021/05/26 14:48:02 christos Exp $	*/
 /*
  * Copyright (C) 2012 by Darren Reed.
+ *
  * See the IPFILTER.LICENCE file for details on licencing.
  */
 #if defined(KERNEL) || defined(_KERNEL)
 # undef KERNEL
 # undef KERNEL
 # define        KERNEL	1
 # define        KERNEL	1
 #endif
 #include <sys/errno.h>
 #include <sys/types.h>
 #include <sys/param.h>
 #include <sys/time.h>
 #include <sys/file.h>
 #if defined(_KERNEL) && \
     (defined(__NetBSD_Version) && (__NetBSD_Version >= 399002000))
 # include <sys/kauth.h>
 #endif
 #if !defined(_KERNEL)
 # include <stdio.h>
 # include <string.h>
 # include <stdlib.h>
 # define KERNEL
 # ifdef _OpenBSD__
 struct file;
 # endif
 # include <sys/uio.h>
 # undef KERNEL
 #endif
 #if defined(_KERNEL) && \
     defined(__FreeBSD_version) && (__FreeBSD_version >= 220000)
 # include <sys/filio.h>
 # include <sys/fcntl.h>
 #else
 # include <sys/ioctl.h>
 #endif
 #if !defined(AIX)
 # include <sys/fcntl.h>
 #endif
 #if !defined(linux)
 # include <sys/protosw.h>
 #endif
 #include <sys/socket.h>
 #if defined(_KERNEL)
 # include <sys/systm.h>
 # if !defined(__SVR4) && !defined(__svr4__)
 #  include <sys/mbuf.h>
 # endif
 #endif
 #if defined(__SVR4) || defined(__svr4__)
 # include <sys/filio.h>
 # include <sys/byteorder.h>
 # ifdef KERNEL
 #  include <sys/dditypes.h>
 # endif
 # include <sys/stream.h>
 # include <sys/kmem.h>
 #endif
 #if _FreeBSD_version >= 300000
 # include <sys/queue.h>
 #endif
 #include <net/if.h>
 #if _FreeBSD_version >= 300000
 # include <net/if_var.h>
 #endif
 #ifdef sun
 # include <net/af.h>
 #endif
 #include <netinet/in.h>
 #include <netinet/in_systm.h>
 #include <netinet/ip.h>
 #ifdef RFC1825
 # include <vpn/md5.h>
 # include <vpn/ipsec.h>
 extern struct ifnet vpnif;
 #endif
 #if !defined(linux)
 # include <netinet/ip_var.h>
 #endif
 #include <netinet/tcp.h>
 #include <netinet/udp.h>
 #include <netinet/ip_icmp.h>
 #include "netinet/ip_compat.h"
 #include "netinet/ipl.h"
 #include "netinet/ip_fil.h"
 #include "netinet/ip_nat.h"
 #include "netinet/ip_frag.h"
 #include "netinet/ip_state.h"
 #include "netinet/ip_proxy.h"
 #include "netinet/ip_lookup.h"
 #include "netinet/ip_dstlist.h"
 #include "netinet/ip_sync.h"
 #if FREEBSD_GE_REV(300000)
 # include <sys/malloc.h>
 #endif
 #ifdef HAS_SYS_MD5_H
 # include <sys/md5.h>
 #else
 # include "md5.h"
 #endif
 /* END OF INCLUDES */
 #undef	SOCKADDR_IN
 #define	SOCKADDR_IN	struct sockaddr_in
 #if !defined(lint)
 #if defined(__NetBSD__)
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ip_nat.c,v 1.23 2020/08/01 06:50:42 maxv Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ip_nat.c,v 1.24 2021/05/26 14:48:02 christos Exp $");
 #else
 static const char sccsid[] = "@(#)ip_nat.c	1.11 6/5/96 (C) 1995 Darren Reed";
 static const char rcsid[] = "@(#)Id: ip_nat.c,v 1.1.1.2 2012/07/22 13:45:27 darrenr Exp";
 #endif
 #endif
 #define	NATFSUM(n,v,f)	((v) == 4 ? (n)->f.in4.s_addr : (n)->f.i6[0] + \
 			 (n)->f.i6[1] + (n)->f.i6[2] + (n)->f.i6[3])
 #define	NBUMP(x)	softn->(x)++
 #define	NBUMPD(x, y)	do { \
 				softn->x.y++; \
 				DT(y); \
 			} while (0)
 #define	NBUMPSIDE(y,x)	softn->ipf_nat_stats.ns_side[y].x++
 #define	NBUMPSIDED(y,x)	do { softn->ipf_nat_stats.ns_side[y].x++; \
 			     DT(x); } while (0)
 #define	NBUMPSIDEX(y,x,z) \
 			do { softn->ipf_nat_stats.ns_side[y].x++; \
 			     DT(z); } while (0)
 #define	NBUMPSIDEDF(y,x)do { softn->ipf_nat_stats.ns_side[y].x++; \
 			     DT1(x, fr_info_t *, fin); } while (0)
 frentry_t	ipfnatblock;
 static const ipftuneable_t ipf_nat_tuneables[] = {
 	/* nat */
 	{ { (void *)offsetof(ipf_nat_softc_t, ipf_nat_lock) },
 		"nat_lock",	0,	1,
 		stsizeof(ipf_nat_softc_t, ipf_nat_lock),
 		IPFT_RDONLY,		NULL,	NULL },
 	{ { (void *)offsetof(ipf_nat_softc_t, ipf_nat_table_sz) },
 		"nat_table_size", 1,	0x7fffffff,
 		stsizeof(ipf_nat_softc_t, ipf_nat_table_sz),
 ,			NULL,	ipf_nat_rehash },
 	{ { (void *)offsetof(ipf_nat_softc_t, ipf_nat_table_max) },
 		"nat_table_max", 1,	0x7fffffff,
 		stsizeof(ipf_nat_softc_t, ipf_nat_table_max),
 ,			NULL,	NULL },
 	{ { (void *)offsetof(ipf_nat_softc_t, ipf_nat_maprules_sz) },
 		"nat_rules_size", 1,	0x7fffffff,
 		stsizeof(ipf_nat_softc_t, ipf_nat_maprules_sz),
 ,			NULL,	ipf_nat_rehash_rules },
 	{ { (void *)offsetof(ipf_nat_softc_t, ipf_nat_rdrrules_sz) },
 		"rdr_rules_size", 1,	0x7fffffff,
 		stsizeof(ipf_nat_softc_t, ipf_nat_rdrrules_sz),
 ,			NULL,	ipf_nat_rehash_rules },
 	{ { (void *)offsetof(ipf_nat_softc_t, ipf_nat_hostmap_sz) },
 		"hostmap_size",	1,	0x7fffffff,
 		stsizeof(ipf_nat_softc_t, ipf_nat_hostmap_sz),
 ,			NULL,	ipf_nat_hostmap_rehash },
 	{ { (void *)offsetof(ipf_nat_softc_t, ipf_nat_maxbucket) },
 		"nat_maxbucket",1,	0x7fffffff,
 		stsizeof(ipf_nat_softc_t, ipf_nat_maxbucket),
 ,			NULL,	NULL },
 	{ { (void *)offsetof(ipf_nat_softc_t, ipf_nat_logging) },
 		"nat_logging",	0,	1,
 		stsizeof(ipf_nat_softc_t, ipf_nat_logging),
 ,			NULL,	NULL },
 	{ { (void *)offsetof(ipf_nat_softc_t, ipf_nat_doflush) },
 		"nat_doflush",	0,	1,
 		stsizeof(ipf_nat_softc_t, ipf_nat_doflush),
 ,			NULL,	NULL },
 	{ { (void *)offsetof(ipf_nat_softc_t, ipf_nat_table_wm_low) },
 		"nat_table_wm_low",	1,	99,
 		stsizeof(ipf_nat_softc_t, ipf_nat_table_wm_low),
 ,			NULL,	NULL },
 	{ { (void *)offsetof(ipf_nat_softc_t, ipf_nat_table_wm_high) },
 		"nat_table_wm_high",	2,	100,
 		stsizeof(ipf_nat_softc_t, ipf_nat_table_wm_high),
 ,			NULL,	NULL },
 	{ { 0 },
 		NULL,			0,	0,
 ,
 ,			NULL,	NULL }
 };
 /* ======================================================================== */
 /* How the NAT is organised and works.                                      */
 /*                                                                          */
 /* Inside (interface y) NAT       Outside (interface x)                     */
 /* -------------------- -+- -------------------------------------           */
 /* Packet going          |   out, processsed by ipf_nat_checkout() for x    */
 /* ------------>         |   ------------>                                  */
 /* src=10.1.1.1          |   src=192.1.1.1                                  */
 /*                       |                                                  */
 /*                       |   in, processed by ipf_nat_checkin() for x       */
 /* <------------         |   <------------                                  */
 /* dst=10.1.1.1          |   dst=192.1.1.1                                  */
 /* -------------------- -+- -------------------------------------           */
 /* ipf_nat_checkout() - changes ip_src and if required, sport               */
 /*             - creates a new mapping, if required.                        */
 /* ipf_nat_checkin()  - changes ip_dst and if required, dport               */
 /*                                                                          */
 /* In the NAT table, internal source is recorded as "in" and externally     */
 /* seen as "out".                                                           */
 /* ======================================================================== */
 #if SOLARIS && !defined(INSTANCES)
 extern	int		pfil_delayed_copy;
 #endif
 static	int	ipf_nat_flush_entry(ipf_main_softc_t *, void *);
 static	int	ipf_nat_getent(ipf_main_softc_t *, void *, int);
 static	int	ipf_nat_getsz(ipf_main_softc_t *, void *, int);
 static	int	ipf_nat_putent(ipf_main_softc_t *, void *, int);
 static	void	ipf_nat_addmap(ipf_nat_softc_t *, ipnat_t *);
 static	void	ipf_nat_addrdr(ipf_nat_softc_t *, ipnat_t *);
 static	int	ipf_nat_builddivertmp(ipf_nat_softc_t *, ipnat_t *);
 static	int	ipf_nat_clearlist(ipf_main_softc_t *, ipf_nat_softc_t *);
 static	int	ipf_nat_cmp_rules(ipnat_t *, ipnat_t *);
 static	int	ipf_nat_decap(fr_info_t *, nat_t *);
 static	void	ipf_nat_delrule(ipf_main_softc_t *, ipf_nat_softc_t *,
 				     ipnat_t *, int);
 static	int	ipf_nat_extraflush(ipf_main_softc_t *, ipf_nat_softc_t *, int);
 static	int	ipf_nat_finalise(fr_info_t *, nat_t *);
 static	int	ipf_nat_flushtable(ipf_main_softc_t *, ipf_nat_softc_t *);
 static	int	ipf_nat_getnext(ipf_main_softc_t *, ipftoken_t *,
 				ipfgeniter_t *, ipfobj_t *);
 static	int	ipf_nat_gettable(ipf_main_softc_t *, ipf_nat_softc_t *, char *);
 static	hostmap_t *ipf_nat_hostmap(ipf_nat_softc_t *, ipnat_t *,
 				   struct in_addr, struct in_addr,
 				   struct in_addr, u_32_t);
 static	int	ipf_nat_icmpquerytype(int);
 static	int	ipf_nat_iterator(ipf_main_softc_t *, ipftoken_t *,
 				 ipfgeniter_t *, ipfobj_t *);
 static	int	ipf_nat_match(fr_info_t *, ipnat_t *);
 static	int	ipf_nat_matcharray(nat_t *, int *, u_long);
 static	int	ipf_nat_matchflush(ipf_main_softc_t *, ipf_nat_softc_t *,
 				   void *);
 static	void	ipf_nat_mssclamp(tcphdr_t *, u_32_t, fr_info_t *, u_short *);
 static	int	ipf_nat_newmap(fr_info_t *, nat_t *, natinfo_t *);
 static	int	ipf_nat_newdivert(fr_info_t *, nat_t *, natinfo_t *);
 static	int	ipf_nat_newrdr(fr_info_t *, nat_t *, natinfo_t *);
 static	int	ipf_nat_newrewrite(fr_info_t *, nat_t *, natinfo_t *);
 static	int	ipf_nat_nextaddr(fr_info_t *, nat_addr_t *, u_32_t *, u_32_t *);
 static	int	ipf_nat_nextaddrinit(ipf_main_softc_t *, char *,
 				     nat_addr_t *, int, void *);
 static	int	ipf_nat_resolverule(ipf_main_softc_t *, ipnat_t *);
 static	int	ipf_nat_ruleaddrinit(ipf_main_softc_t *,
 				     ipf_nat_softc_t *, ipnat_t *);
 static	void	ipf_nat_rule_fini(ipf_main_softc_t *, ipnat_t *);
 static	int	ipf_nat_rule_init(ipf_main_softc_t *, ipf_nat_softc_t *,
 				       ipnat_t *);
 static	int	ipf_nat_siocaddnat(ipf_main_softc_t *, ipf_nat_softc_t *,
 					ipnat_t *, int);
 static	void	ipf_nat_siocdelnat(ipf_main_softc_t *, ipf_nat_softc_t *,
 					ipnat_t *, int);
 static	void	ipf_nat_tabmove(ipf_nat_softc_t *, nat_t *);
 /* ------------------------------------------------------------------------ */
 /* Function:    ipf_nat_main_load                                           */
 /* Returns:     int - 0 == success, -1 == failure                           */
 /* Parameters:  Nil                                                         */
 /*                                                                          */
 /* The only global NAT structure that needs to be initialised is the filter */
 /* rule that is used with blocking packets.                                 */
 /* ------------------------------------------------------------------------ */
 int
 ipf_nat_main_load(void)
+{
 	bzero((char *)&ipfnatblock, sizeof(ipfnatblock));
 	ipfnatblock.fr_flags = FR_BLOCK|FR_QUICK;
 	ipfnatblock.fr_ref = 1;
 	return 0;
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    ipf_nat_main_unload                                         */
 /* Returns:     int - 0 == success, -1 == failure                           */
 /* Parameters:  Nil                                                         */
 /*                                                                          */
 /* A null-op function that exists as a placeholder so that the flow in      */
 /* other functions is obvious.                                              */
 /* ------------------------------------------------------------------------ */
 int
 ipf_nat_main_unload(void)
+{
 	return 0;
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    ipf_nat_soft_create                                         */
 /* Returns:     void * - NULL = failure, else pointer to NAT context        */
 /* Parameters:  softc(I) - pointer to soft context main structure           */
 /*                                                                          */
 /* Allocate the initial soft context structure for NAT and populate it with */
 /* some default values. Creating the tables is left until we call _init so  */
 /* that sizes can be changed before we get under way.                       */
 /* ------------------------------------------------------------------------ */
 void *
 ipf_nat_soft_create(ipf_main_softc_t *softc)
+{
 	ipf_nat_softc_t *softn;
 	KMALLOC(softn, ipf_nat_softc_t *);
 	if (softn == NULL)
 		return NULL;
 	bzero((char *)softn, sizeof(*softn));
 	softn->ipf_nat_tune = ipf_tune_array_copy(softn,
 						  sizeof(ipf_nat_tuneables),
 						  ipf_nat_tuneables);
 	if (softn->ipf_nat_tune == NULL) {
 		ipf_nat_soft_destroy(softc, softn);
 		return NULL;
+	}
 	if (ipf_tune_array_link(softc, softn->ipf_nat_tune) == -1) {
 		ipf_nat_soft_destroy(softc, softn);
 		return NULL;
+	}
 	softn->ipf_nat_list_tail = &softn->ipf_nat_list;
 	softn->ipf_nat_table_max = NAT_TABLE_MAX;
 	softn->ipf_nat_table_sz = NAT_TABLE_SZ;
 	softn->ipf_nat_maprules_sz = NAT_SIZE;
 	softn->ipf_nat_rdrrules_sz = RDR_SIZE;
 	softn->ipf_nat_hostmap_sz = HOSTMAP_SIZE;
 	softn->ipf_nat_doflush = 0;
 #ifdef  IPFILTER_LOG
 	softn->ipf_nat_logging = 1;
 #else
 	softn->ipf_nat_logging = 0;
 #endif
 	softn->ipf_nat_defage = DEF_NAT_AGE;
 	softn->ipf_nat_defipage = IPF_TTLVAL(60);
 	softn->ipf_nat_deficmpage = IPF_TTLVAL(3);
 	softn->ipf_nat_table_wm_high = 99;
 	softn->ipf_nat_table_wm_low = 90;
 	return softn;
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    ipf_nat_soft_destroy                                        */
 /* Returns:     Nil                                                         */
 /* Parameters:  softc(I) - pointer to soft context main structure           */
 /*                                                                          */
 /* ------------------------------------------------------------------------ */
 void
 ipf_nat_soft_destroy(ipf_main_softc_t *softc, void *arg)
+{
 	ipf_nat_softc_t *softn = arg;
 	if (softn->ipf_nat_tune != NULL) {
 		ipf_tune_array_unlink(softc, softn->ipf_nat_tune);
 		KFREES(softn->ipf_nat_tune, sizeof(ipf_nat_tuneables));
 		softn->ipf_nat_tune = NULL;
+	}
 	KFREE(softn);
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    ipf_nat_init                                                */
 /* Returns:     int - 0 == success, -1 == failure                           */
 /* Parameters:  softc(I) - pointer to soft context main structure           */
 /*                                                                          */
 /* Initialise all of the NAT locks, tables and other structures.            */
 /* ------------------------------------------------------------------------ */
 int
 ipf_nat_soft_init(ipf_main_softc_t *softc, void *arg)
+{
 	ipf_nat_softc_t *softn = arg;
 	ipftq_t *tq;
 	int i;
 	KMALLOCS(softn->ipf_nat_table[0], nat_t **, \
 		 sizeof(nat_t *) * softn->ipf_nat_table_sz);
 	if (softn->ipf_nat_table[0] != NULL) {
 		bzero((char *)softn->ipf_nat_table[0],
 		      softn->ipf_nat_table_sz * sizeof(nat_t *));
 	} else {
 		return -1;
+	}
 	KMALLOCS(softn->ipf_nat_table[1], nat_t **, \
 		 sizeof(nat_t *) * softn->ipf_nat_table_sz);
 	if (softn->ipf_nat_table[1] != NULL) {
 		bzero((char *)softn->ipf_nat_table[1],
 		      softn->ipf_nat_table_sz * sizeof(nat_t *));
 	} else {
 		return -2;
+	}
 	KMALLOCS(softn->ipf_nat_map_rules, ipnat_t **, \
 		 sizeof(ipnat_t *) * softn->ipf_nat_maprules_sz);
 	if (softn->ipf_nat_map_rules != NULL) {
 		bzero((char *)softn->ipf_nat_map_rules,
 		      softn->ipf_nat_maprules_sz * sizeof(ipnat_t *));
 	} else {
 		return -3;
+	}
 	KMALLOCS(softn->ipf_nat_rdr_rules, ipnat_t **, \
 		 sizeof(ipnat_t *) * softn->ipf_nat_rdrrules_sz);
 	if (softn->ipf_nat_rdr_rules != NULL) {
 		bzero((char *)softn->ipf_nat_rdr_rules,
 		      softn->ipf_nat_rdrrules_sz * sizeof(ipnat_t *));
 	} else {
 		return -4;
+	}
 	KMALLOCS(softn->ipf_hm_maptable, hostmap_t **, \
 		 sizeof(hostmap_t *) * softn->ipf_nat_hostmap_sz);
 	if (softn->ipf_hm_maptable != NULL) {
 		bzero((char *)softn->ipf_hm_maptable,
 		      sizeof(hostmap_t *) * softn->ipf_nat_hostmap_sz);
 	} else {
 		return -5;
+	}
 	softn->ipf_hm_maplist = NULL;
 	KMALLOCS(softn->ipf_nat_stats.ns_side[0].ns_bucketlen, u_int *,
 		 softn->ipf_nat_table_sz * sizeof(u_int));
 	if (softn->ipf_nat_stats.ns_side[0].ns_bucketlen == NULL) {
 		return -6;
+	}
 	bzero((char *)softn->ipf_nat_stats.ns_side[0].ns_bucketlen,
 	      softn->ipf_nat_table_sz * sizeof(u_int));
 	KMALLOCS(softn->ipf_nat_stats.ns_side[1].ns_bucketlen, u_int *,
 		 softn->ipf_nat_table_sz * sizeof(u_int));
 	if (softn->ipf_nat_stats.ns_side[1].ns_bucketlen == NULL) {
 		return -7;
+	}
 	bzero((char *)softn->ipf_nat_stats.ns_side[1].ns_bucketlen,
 	      softn->ipf_nat_table_sz * sizeof(u_int));
 	if (softn->ipf_nat_maxbucket == 0) {
 		for (i = softn->ipf_nat_table_sz; i > 0; i >>= 1)
 			softn->ipf_nat_maxbucket++;
 		softn->ipf_nat_maxbucket *= 2;
+	}
 	ipf_sttab_init(softc, softn->ipf_nat_tcptq);
 	/*
 	 * Increase this because we may have "keep state" following this too
 	 * and packet storms can occur if this is removed too quickly.
 	 */
 	softn->ipf_nat_tcptq[IPF_TCPS_CLOSED].ifq_ttl = softc->ipf_tcplastack;
 	softn->ipf_nat_tcptq[IPF_TCP_NSTATES - 1].ifq_next =
 							&softn->ipf_nat_udptq;
 	IPFTQ_INIT(&softn->ipf_nat_udptq, softn->ipf_nat_defage,
 		   "nat ipftq udp tab");
 	softn->ipf_nat_udptq.ifq_next = &softn->ipf_nat_udpacktq;
 	IPFTQ_INIT(&softn->ipf_nat_udpacktq, softn->ipf_nat_defage,
 		   "nat ipftq udpack tab");
 	softn->ipf_nat_udpacktq.ifq_next = &softn->ipf_nat_icmptq;
 	IPFTQ_INIT(&softn->ipf_nat_icmptq, softn->ipf_nat_deficmpage,
 		   "nat icmp ipftq tab");
 	softn->ipf_nat_icmptq.ifq_next = &softn->ipf_nat_icmpacktq;
 	IPFTQ_INIT(&softn->ipf_nat_icmpacktq, softn->ipf_nat_defage,
 		   "nat icmpack ipftq tab");
 	softn->ipf_nat_icmpacktq.ifq_next = &softn->ipf_nat_iptq;
 	IPFTQ_INIT(&softn->ipf_nat_iptq, softn->ipf_nat_defipage,
 		   "nat ip ipftq tab");
 	softn->ipf_nat_iptq.ifq_next = &softn->ipf_nat_pending;
 	IPFTQ_INIT(&softn->ipf_nat_pending, 1, "nat pending ipftq tab");
 	softn->ipf_nat_pending.ifq_next = NULL;
 	for (i = 0, tq = softn->ipf_nat_tcptq; i < IPF_TCP_NSTATES; i++, tq++) {
 		if (tq->ifq_ttl < softn->ipf_nat_deficmpage)
 			tq->ifq_ttl = softn->ipf_nat_deficmpage;
 #ifdef LARGE_NAT
 		else if (tq->ifq_ttl > softn->ipf_nat_defage)
 			tq->ifq_ttl = softn->ipf_nat_defage;
 #endif
+	}
 	/*
 	 * Increase this because we may have "keep state" following
 	 * this too and packet storms can occur if this is removed
 	 * too quickly.
 	 */
 	softn->ipf_nat_tcptq[IPF_TCPS_CLOSED].ifq_ttl = softc->ipf_tcplastack;
 	MUTEX_INIT(&softn->ipf_nat_new, "ipf nat new mutex");
 	MUTEX_INIT(&softn->ipf_nat_io, "ipf nat io mutex");
 	softn->ipf_nat_inited = 1;
 	return 0;
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    ipf_nat_soft_fini                                           */
 /* Returns:     Nil                                                         */
 /* Parameters:  softc(I) - pointer to soft context main structure           */
 /*                                                                          */
 /* Free all memory used by NAT structures allocated at runtime.             */
 /* ------------------------------------------------------------------------ */
 int
 ipf_nat_soft_fini(ipf_main_softc_t *softc, void *arg)
+{
 	ipf_nat_softc_t *softn = arg;
 	ipftq_t *ifq, *ifqnext;
 	(void) ipf_nat_clearlist(softc, softn);
 	(void) ipf_nat_flushtable(softc, softn);
 	/*
 	 * Proxy timeout queues are not cleaned here because although they
 	 * exist on the NAT list, ipf_proxy_unload is called after unload
 	 * and the proxies actually are responsible for them being created.
 	 * Should the proxy timeouts have their own list?  There's no real
 	 * justification as this is the only complication.
 	 */
 	for (ifq = softn->ipf_nat_utqe; ifq != NULL; ifq = ifqnext) {
 		ifqnext = ifq->ifq_next;
 		if (ipf_deletetimeoutqueue(ifq) == 0)
 			ipf_freetimeoutqueue(softc, ifq);
+	}
 	if (softn->ipf_nat_table[0] != NULL) {
 		KFREES(softn->ipf_nat_table[0],
 		       sizeof(nat_t *) * softn->ipf_nat_table_sz);
 		softn->ipf_nat_table[0] = NULL;
+	}
 	if (softn->ipf_nat_table[1] != NULL) {
 		KFREES(softn->ipf_nat_table[1],
 		       sizeof(nat_t *) * softn->ipf_nat_table_sz);
 		softn->ipf_nat_table[1] = NULL;
+	}
 	if (softn->ipf_nat_map_rules != NULL) {
 		KFREES(softn->ipf_nat_map_rules,
 		       sizeof(ipnat_t *) * softn->ipf_nat_maprules_sz);
 		softn->ipf_nat_map_rules = NULL;
+	}
 	if (softn->ipf_nat_rdr_rules != NULL) {
 		KFREES(softn->ipf_nat_rdr_rules,
 		       sizeof(ipnat_t *) * softn->ipf_nat_rdrrules_sz);
 		softn->ipf_nat_rdr_rules = NULL;
+	}
 	if (softn->ipf_hm_maptable != NULL) {
 		KFREES(softn->ipf_hm_maptable,
 		       sizeof(hostmap_t *) * softn->ipf_nat_hostmap_sz);
 		softn->ipf_hm_maptable = NULL;
+	}
 	if (softn->ipf_nat_stats.ns_side[0].ns_bucketlen != NULL) {
 		KFREES(softn->ipf_nat_stats.ns_side[0].ns_bucketlen,
 		       sizeof(u_int) * softn->ipf_nat_table_sz);
 		softn->ipf_nat_stats.ns_side[0].ns_bucketlen = NULL;
+	}
 	if (softn->ipf_nat_stats.ns_side[1].ns_bucketlen != NULL) {
 		KFREES(softn->ipf_nat_stats.ns_side[1].ns_bucketlen,
 		       sizeof(u_int) * softn->ipf_nat_table_sz);
 		softn->ipf_nat_stats.ns_side[1].ns_bucketlen = NULL;
+	}
 	if (softn->ipf_nat_inited == 1) {
 		softn->ipf_nat_inited = 0;
 		ipf_sttab_destroy(softn->ipf_nat_tcptq);
 		MUTEX_DESTROY(&softn->ipf_nat_new);
 		MUTEX_DESTROY(&softn->ipf_nat_io);
 		MUTEX_DESTROY(&softn->ipf_nat_udptq.ifq_lock);
 		MUTEX_DESTROY(&softn->ipf_nat_udpacktq.ifq_lock);
 		MUTEX_DESTROY(&softn->ipf_nat_icmptq.ifq_lock);
 		MUTEX_DESTROY(&softn->ipf_nat_icmpacktq.ifq_lock);
 		MUTEX_DESTROY(&softn->ipf_nat_iptq.ifq_lock);
 		MUTEX_DESTROY(&softn->ipf_nat_pending.ifq_lock);
+	}
 	return 0;
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    ipf_nat_setlock                                             */
 /* Returns:     Nil                                                         */
 /* Parameters:  arg(I) - pointer to soft state information                  */
 /*              tmp(I) - new lock value                                     */
 /*                                                                          */
 /* Set the "lock status" of NAT to the value in tmp.                        */
 /* ------------------------------------------------------------------------ */
 void
 ipf_nat_setlock(void *arg, int tmp)
+{
 	ipf_nat_softc_t *softn = arg;
 	softn->ipf_nat_lock = tmp;
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    ipf_nat_addrdr                                              */
 /* Returns:     Nil                                                         */
 /* Parameters:  n(I) - pointer to NAT rule to add                           */
 /*                                                                          */
 /* Adds a redirect rule to the hash table of redirect rules and the list of */
 /* loaded NAT rules.  Updates the bitmask indicating which netmasks are in  */
 /* use by redirect rules.                                                   */
 /* ------------------------------------------------------------------------ */
 static void
 ipf_nat_addrdr(ipf_nat_softc_t *softn, ipnat_t *n)
+{
 	ipnat_t **np;
 	u_32_t j;
 	u_int hv;
 	u_int rhv;
 	int k;
 	if (n->in_odstatype == FRI_NORMAL) {
 		k = count4bits(n->in_odstmsk);
 		ipf_inet_mask_add(k, &softn->ipf_nat_rdr_mask);
 		j = (n->in_odstaddr & n->in_odstmsk);
 		rhv = NAT_HASH_FN(j, 0, 0xffffffff);
 	} else {
 		ipf_inet_mask_add(0, &softn->ipf_nat_rdr_mask);
 		j = 0;
 		rhv = 0;
+	}
 	hv = rhv % softn->ipf_nat_rdrrules_sz;
 	np = softn->ipf_nat_rdr_rules + hv;
 	while (*np != NULL)
 		np = &(*np)->in_rnext;
 	n->in_rnext = NULL;
 	n->in_prnext = np;
 	n->in_hv[0] = hv;
 	n->in_use++;
 	*np = n;
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    ipf_nat_addmap                                              */
 /* Returns:     Nil                                                         */
 /* Parameters:  n(I) - pointer to NAT rule to add                           */
 /*                                                                          */
 /* Adds a NAT map rule to the hash table of rules and the list of  loaded   */
 /* NAT rules.  Updates the bitmask indicating which netmasks are in use by  */
 /* redirect rules.                                                          */
 /* ------------------------------------------------------------------------ */
 static void
 ipf_nat_addmap(ipf_nat_softc_t *softn, ipnat_t *n)
+{
 	ipnat_t **np;
 	u_32_t j;
 	u_int hv;
 	u_int rhv;
 	int k;
 	if (n->in_osrcatype == FRI_NORMAL) {
 		k = count4bits(n->in_osrcmsk);
 		ipf_inet_mask_add(k, &softn->ipf_nat_map_mask);
 		j = (n->in_osrcaddr & n->in_osrcmsk);
 		rhv = NAT_HASH_FN(j, 0, 0xffffffff);
 	} else {
 		ipf_inet_mask_add(0, &softn->ipf_nat_map_mask);
 		j = 0;
 		rhv = 0;
+	}
 	hv = rhv % softn->ipf_nat_maprules_sz;
 	np = softn->ipf_nat_map_rules + hv;
 	while (*np != NULL)
 		np = &(*np)->in_mnext;
 	n->in_mnext = NULL;
 	n->in_pmnext = np;
 	n->in_hv[1] = rhv;
 	n->in_use++;
 	*np = n;
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    ipf_nat_delrdr                                              */
 /* Returns:     Nil                                                         */
 /* Parameters:  n(I) - pointer to NAT rule to delete                        */
 /*                                                                          */
 /* Removes a redirect rule from the hash table of redirect rules.           */
 /* ------------------------------------------------------------------------ */
 void
 ipf_nat_delrdr(ipf_nat_softc_t *softn, ipnat_t *n)
+{
 	if (n->in_odstatype == FRI_NORMAL) {
 		int k = count4bits(n->in_odstmsk);
 		ipf_inet_mask_del(k, &softn->ipf_nat_rdr_mask);
 	} else {
 		ipf_inet_mask_del(0, &softn->ipf_nat_rdr_mask);
+	}
 	if (n->in_rnext)
 		n->in_rnext->in_prnext = n->in_prnext;
 	*n->in_prnext = n->in_rnext;
 	n->in_use--;
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    ipf_nat_delmap                                              */
 /* Returns:     Nil                                                         */
 /* Parameters:  n(I) - pointer to NAT rule to delete                        */
 /*                                                                          */
 /* Removes a NAT map rule from the hash table of NAT map rules.             */
 /* ------------------------------------------------------------------------ */
 void
 ipf_nat_delmap(ipf_nat_softc_t *softn, ipnat_t *n)
+{
 	if (n->in_osrcatype == FRI_NORMAL) {
 		int k = count4bits(n->in_osrcmsk);
 		ipf_inet_mask_del(k, &softn->ipf_nat_map_mask);
 	} else {
 		ipf_inet_mask_del(0, &softn->ipf_nat_map_mask);
+	}
 	if (n->in_mnext != NULL)
 		n->in_mnext->in_pmnext = n->in_pmnext;
 	*n->in_pmnext = n->in_mnext;
 	n->in_use--;
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    ipf_nat_hostmap                                             */
 /* Returns:     struct hostmap* - NULL if no hostmap could be created,      */
 /*                                else a pointer to the hostmapping to use  */
 /* Parameters:  np(I)   - pointer to NAT rule                               */
 /*              real(I) - real IP address                                   */
 /*              map(I)  - mapped IP address                                 */
 /*              port(I) - destination port number                           */
 /* Write Locks: ipf_nat                                                     */
 /*                                                                          */
 /* Check if an ip address has already been allocated for a given mapping    */
 /* that is not doing port based translation.  If is not yet allocated, then */
 /* create a new entry if a non-NULL NAT rule pointer has been supplied.     */
 /* ------------------------------------------------------------------------ */
 static struct hostmap *
 ipf_nat_hostmap(ipf_nat_softc_t *softn, ipnat_t *np, struct in_addr src,
     struct in_addr dst, struct in_addr map, u_32_t port)
+{
 	hostmap_t *hm;
 	u_int hv, rhv;
 	hv = (src.s_addr ^ dst.s_addr);
 	hv += src.s_addr;
 	hv += dst.s_addr;
 	rhv = hv;
 	hv %= softn->ipf_nat_hostmap_sz;
 	for (hm = softn->ipf_hm_maptable[hv]; hm; hm = hm->hm_hnext)
 		if ((hm->hm_osrcip.s_addr == src.s_addr) &&
 		    (hm->hm_odstip.s_addr == dst.s_addr) &&
 		    ((np == NULL) || (np == hm->hm_ipnat)) &&
 		    ((port == 0) || (port == hm->hm_port))) {
 			softn->ipf_nat_stats.ns_hm_addref++;
 			hm->hm_ref++;
 			return hm;
+		}
 	if (np == NULL) {
 		softn->ipf_nat_stats.ns_hm_nullnp++;
 		return NULL;
+	}
 	KMALLOC(hm, hostmap_t *);
 	if (hm) {
 		hm->hm_next = softn->ipf_hm_maplist;
 		hm->hm_pnext = &softn->ipf_hm_maplist;
 		if (softn->ipf_hm_maplist != NULL)
 			softn->ipf_hm_maplist->hm_pnext = &hm->hm_next;
 		softn->ipf_hm_maplist = hm;
 		hm->hm_hnext = softn->ipf_hm_maptable[hv];
 		hm->hm_phnext = softn->ipf_hm_maptable + hv;
 		if (softn->ipf_hm_maptable[hv] != NULL)
 			softn->ipf_hm_maptable[hv]->hm_phnext = &hm->hm_hnext;
 		softn->ipf_hm_maptable[hv] = hm;
 		hm->hm_ipnat = np;
 		np->in_use++;
 		hm->hm_osrcip = src;
 		hm->hm_odstip = dst;
 		hm->hm_nsrcip = map;
 		hm->hm_ndstip.s_addr = 0;
 		hm->hm_ref = 1;
 		hm->hm_port = port;
 		hm->hm_hv = rhv;
 		hm->hm_v = 4;
 		softn->ipf_nat_stats.ns_hm_new++;
 	} else {
 		softn->ipf_nat_stats.ns_hm_newfail++;
+	}
 	return hm;
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    ipf_nat_hostmapdel                                          */
 /* Returns:     Nil                                                         */
 /* Parameters:  hmp(I) - pointer to hostmap structure pointer               */
 /* Write Locks: ipf_nat                                                     */
 /*                                                                          */
 /* Decrement the references to this hostmap structure by one.  If this      */
 /* reaches zero then remove it and free it.                                 */
 /* ------------------------------------------------------------------------ */
 void
 ipf_nat_hostmapdel(ipf_main_softc_t *softc, struct hostmap **hmp)
+{
 	struct hostmap *hm;
 	hm = *hmp;
 	*hmp = NULL;
 	hm->hm_ref--;
 	if (hm->hm_ref == 0) {
 		ipf_nat_rule_deref(softc, &hm->hm_ipnat);
 		if (hm->hm_hnext)
 			hm->hm_hnext->hm_phnext = hm->hm_phnext;
 		*hm->hm_phnext = hm->hm_hnext;
 		if (hm->hm_next)
 			hm->hm_next->hm_pnext = hm->hm_pnext;
 		*hm->hm_pnext = hm->hm_next;
 		KFREE(hm);
+	}
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    ipf_fix_outcksum                                            */
 /* Returns:     Nil                                                         */
 /* Parameters:  fin(I) - pointer to packet information                      */
 /*              sp(I)  - location of 16bit checksum to update               */
 /*              n((I)  - amount to adjust checksum by                       */
 /*                                                                          */
 /* Adjusts the 16bit checksum by "n" for packets going out.                 */
 /* ------------------------------------------------------------------------ */
 void
 ipf_fix_outcksum(int cksum, u_short *sp, u_32_t n, u_32_t partial)
+{
 	u_short sumshort;
 	u_32_t sum1;
 	if (n == 0)
 		return;
 	if (cksum == 4) {
 		*sp = 0;
 		return;
+	}
 	if (cksum == 2) {
 		sum1 = partial;
 		sum1 = (sum1 & 0xffff) + (sum1 >> 16);
 		*sp = htons(sum1);
 		return;
+	}
 	sum1 = (~ntohs(*sp)) & 0xffff;
 	sum1 += (n);
 	sum1 = (sum1 >> 16) + (sum1 & 0xffff);
 	/* Again */
 	sum1 = (sum1 >> 16) + (sum1 & 0xffff);
 	sumshort = ~(u_short)sum1;
 	*(sp) = htons(sumshort);
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    ipf_fix_incksum                                             */
 /* Returns:     Nil                                                         */
 /* Parameters:  fin(I) - pointer to packet information                      */
 /*              sp(I)  - location of 16bit checksum to update               */
 /*              n((I)  - amount to adjust checksum by                       */
 /*                                                                          */
 /* Adjusts the 16bit checksum by "n" for packets going in.                  */
 /* ------------------------------------------------------------------------ */
 void
 ipf_fix_incksum(int cksum, u_short *sp, u_32_t n, u_32_t partial)
+{
 	u_short sumshort;
 	u_32_t sum1;
 	if (n == 0)
 		return;
 	if (cksum == 4) {
 		*sp = 0;
 		return;
+	}
 	if (cksum == 2) {
 		sum1 = partial;
 		sum1 = (sum1 & 0xffff) + (sum1 >> 16);
 		*sp = htons(sum1);
 		return;
+	}
 	sum1 = (~ntohs(*sp)) & 0xffff;
 	sum1 += ~(n) & 0xffff;
 	sum1 = (sum1 >> 16) + (sum1 & 0xffff);
 	/* Again */
 	sum1 = (sum1 >> 16) + (sum1 & 0xffff);
 	sumshort = ~(u_short)sum1;
 	*(sp) = htons(sumshort);
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    ipf_fix_datacksum                                           */
 /* Returns:     Nil                                                         */
 /* Parameters:  sp(I)  - location of 16bit checksum to update               */
 /*              n((I)  - amount to adjust checksum by                       */
 /*                                                                          */
 /* Fix_datacksum is used *only* for the adjustments of checksums in the     */
 /* data section of an IP packet.                                            */
 /*                                                                          */
 /* The only situation in which you need to do this is when NAT'ing an       */
 /* ICMP error message. Such a message, contains in its body the IP header   */
 /* of the original IP packet, that causes the error.                        */
 /*                                                                          */
 /* You can't use fix_incksum or fix_outcksum in that case, because for the  */
 /* kernel the data section of the ICMP error is just data, and no special   */
 /* processing like hardware cksum or ntohs processing have been done by the */
 /* kernel on the data section.                                              */
 /* ------------------------------------------------------------------------ */
 void
 ipf_fix_datacksum(u_short *sp, u_32_t n)
+{
 	u_short sumshort;
 	u_32_t sum1;
 	if (n == 0)
 		return;
 	sum1 = (~ntohs(*sp)) & 0xffff;
 	sum1 += (n);
 	sum1 = (sum1 >> 16) + (sum1 & 0xffff);
 	/* Again */
 	sum1 = (sum1 >> 16) + (sum1 & 0xffff);
 	sumshort = ~(u_short)sum1;
 	*(sp) = htons(sumshort);
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    ipf_nat_ioctl                                               */
 /* Returns:     int - 0 == success, != 0 == failure                         */
 /* Parameters:  softc(I) - pointer to soft context main structure           */
 /*              data(I)  - pointer to ioctl data                            */
 /*              cmd(I)   - ioctl command integer                            */
 /*              mode(I)  - file mode bits used with open                    */
 /*              uid(I)   - uid of calling process                           */
 /*              ctx(I)   - pointer used as key for finding context          */
 /*                                                                          */
 /* Processes an ioctl call made to operate on the IP Filter NAT device.     */
 /* ------------------------------------------------------------------------ */
 int
 ipf_nat_ioctl(ipf_main_softc_t *softc, void *data, ioctlcmd_t cmd, int mode,
    int uid, void *ctx)
+{
 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
 	int error = 0, ret, arg, getlock;
 	ipnat_t *nat, *nt, *n;
 	ipnat_t *natd = NULL;
 	SPL_INT(s);
 #if BSD_GE_YEAR(199306) && defined(_KERNEL)
 # if NETBSD_GE_REV(399002000)
 	if ((mode & FWRITE) &&
 	     kauth_authorize_network(curlwp->l_cred, KAUTH_NETWORK_FIREWALL,
 				     KAUTH_REQ_NETWORK_FIREWALL_FW,
 				     NULL, NULL, NULL))
 # else
 #  if defined(__FreeBSD_version) && (__FreeBSD_version >= 500034)
 	if (securelevel_ge(curthread->td_ucred, 3) && (mode & FWRITE))
 #  else
 	if ((securelevel >= 3) && (mode & FWRITE))
 #  endif
 # endif
+	{
 		IPFERROR(60001);
 		return EPERM;
+	}
 #endif
 #if defined(__osf__) && defined(_KERNEL)
 	getlock = 0;
 #else
 	getlock = (mode & NAT_LOCKHELD) ? 0 : 1;
 #endif
 	n = NULL;
 	nt = NULL;
 	nat = NULL;
 	if ((cmd == (ioctlcmd_t)SIOCADNAT) || (cmd == (ioctlcmd_t)SIOCRMNAT) ||
 	    (cmd == (ioctlcmd_t)SIOCPURGENAT)) {
 		KMALLOC(natd, ipnat_t *);
 		if (natd == NULL) {
 			error = ENOMEM;
 			goto done;
+		}
 		if (mode & NAT_SYSSPACE) {
 			bcopy(data, natd, sizeof(*natd));
 			nat = natd;
 			error = 0;
 		} else {
 			bzero(natd, sizeof(*natd));
 			error = ipf_inobj(softc, data, NULL, natd,
 					  IPFOBJ_IPNAT);
 			if (error != 0)
 				goto done;
 			if (natd->in_size < sizeof(ipnat_t)) {
 				error = EINVAL;
 				goto done;
+			}
 			KMALLOCS(nt, ipnat_t *, natd->in_size);
 			if (nt == NULL) {
 				IPFERROR(60070);
 				error = ENOMEM;
 				goto done;
+			}
 			bzero(nt, natd->in_size);
 			error = ipf_inobjsz(softc, data, nt, IPFOBJ_IPNAT,
 					    natd->in_size);
 			if (error)
 				goto done;
 			nat = nt;
+		}
 		/*
 		 * For add/delete, look to see if the NAT entry is
 		 * already present
 		 */
 		nat->in_flags &= IPN_USERFLAGS;
 		if ((nat->in_redir & NAT_MAPBLK) == 0) {
 			if (nat->in_osrcatype == FRI_NORMAL ||
 			    nat->in_osrcatype == FRI_NONE)
 				nat->in_osrcaddr &= nat->in_osrcmsk;
 			if (nat->in_odstatype == FRI_NORMAL ||
 			    nat->in_odstatype == FRI_NONE)
 				nat->in_odstaddr &= nat->in_odstmsk;
 			if ((nat->in_flags & (IPN_SPLIT|IPN_SIPRANGE)) == 0) {
 				if (nat->in_nsrcatype == FRI_NORMAL)
 					nat->in_nsrcaddr &= nat->in_nsrcmsk;
 				if (nat->in_ndstatype == FRI_NORMAL)
 					nat->in_ndstaddr &= nat->in_ndstmsk;
+			}
+		}
 		error = ipf_nat_rule_init(softc, softn, nat);
 		if (error != 0)
 			goto done;
 		MUTEX_ENTER(&softn->ipf_nat_io);
 		for (n = softn->ipf_nat_list; n != NULL; n = n->in_next)
 			if (ipf_nat_cmp_rules(nat, n) == 0)
 				break;
+	}
 	switch (cmd)
+	{
 #ifdef  IPFILTER_LOG
 	case SIOCIPFFB :
+	{
 		int tmp;
 		if (!(mode & FWRITE)) {
 			IPFERROR(60002);
 			error = EPERM;
 		} else {
 			tmp = ipf_log_clear(softc, IPL_LOGNAT);
 			error = BCOPYOUT(&tmp, data, sizeof(tmp));
 			if (error != 0) {
 				IPFERROR(60057);
 				error = EFAULT;
+			}
+		}
 		break;
+	}
 	case SIOCSETLG :
 		if (!(mode & FWRITE)) {
 			IPFERROR(60003);
 			error = EPERM;
 		} else {
 			error = BCOPYIN(data, &softn->ipf_nat_logging,
 					sizeof(softn->ipf_nat_logging));
 			if (error != 0)
 				error = EFAULT;
+		}
 @@ -5182,1999 +5182,1999 @@ ipf_nat_out(fr_info_t *fin, nat_t *nat,
 				tcp->th_dport = nat->nat_ndport;
 				fin->fin_data[1] = ntohs(nat->nat_ndport);
 				break;
 			case NAT_INBOUND :
 				tcp->th_sport = nat->nat_odport;
 				fin->fin_data[0] = ntohs(nat->nat_odport);
 				tcp->th_dport = nat->nat_osport;
 				fin->fin_data[1] = ntohs(nat->nat_osport);
 				break;
+			}
+		}
 		if ((nat->nat_oicmpid != 0) && (nflags & IPN_ICMPQUERY)) {
 			icmp = fin->fin_dp;
 			switch (nat->nat_dir)
+			{
 			case NAT_OUTBOUND :
 				icmp->icmp_id = nat->nat_nicmpid;
 				break;
 			case NAT_INBOUND :
 				icmp->icmp_id = nat->nat_oicmpid;
 				break;
+			}
+		}
 		csump = ipf_nat_proto(fin, nat, nflags);
 		/*
 		 * The above comments do not hold for layer 4 (or higher)
 		 * checksums...
 		 */
 		if (csump != NULL) {
 			if (nat->nat_dir == NAT_OUTBOUND)
 				ipf_fix_outcksum(fin->fin_cksum, csump,
 						 nat->nat_sumd[0],
 						 nat->nat_sumd[1] +
 						 fin->fin_dlen);
 			else
 				ipf_fix_incksum(fin->fin_cksum, csump,
 						nat->nat_sumd[0],
 						nat->nat_sumd[1] +
 						fin->fin_dlen);
+		}
+	}
 	ipf_sync_update(softc, SMC_NAT, fin, nat->nat_sync);
 	/* ------------------------------------------------------------- */
 	/* A few quick notes:                                            */
 	/*      Following are test conditions prior to calling the       */
 	/*      ipf_proxy_check routine.                                 */
 	/*                                                               */
 	/*      A NULL tcp indicates a non TCP/UDP packet.  When dealing */
 	/*      with a redirect rule, we attempt to match the packet's   */
 	/*      source port against in_dport, otherwise we'd compare the */
 	/*      packet's destination.                                    */
 	/* ------------------------------------------------------------- */
 	if ((np != NULL) && (np->in_apr != NULL)) {
 		i = ipf_proxy_check(fin, nat);
 		if (i == 0) {
 			i = 1;
 		} else if (i == -1) {
 			NBUMPSIDED(1, ns_ipf_proxy_fail);
+		}
 	} else {
 		i = 1;
+	}
 	fin->fin_flx |= FI_NATED;
 	return i;
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    ipf_nat_checkin                                             */
 /* Returns:     int - -1 == packet failed NAT checks so block it,           */
 /*                     0 == no packet translation occurred,                 */
 /*                     1 == packet was successfully translated.             */
 /* Parameters:  fin(I)   - pointer to packet information                    */
 /*              passp(I) - pointer to filtering result flags                */
 /*                                                                          */
 /* Check to see if an incoming packet should be changed.  ICMP packets are  */
 /* first checked to see if they match an existing entry (if an error),      */
 /* otherwise a search of the current NAT table is made.  If neither results */
 /* in a match then a search for a matching NAT rule is made.  Create a new  */
 /* NAT entry if a we matched a NAT rule.  Lastly, actually change the       */
 /* packet header(s) as required.                                            */
 /* ------------------------------------------------------------------------ */
 int
 ipf_nat_checkin(fr_info_t *fin, u_32_t *passp)
+{
 	ipf_main_softc_t *softc;
 	ipf_nat_softc_t *softn;
 	u_int nflags, natadd;
 	ipnat_t *np, *npnext;
 	int rval, natfailed;
 	struct ifnet *ifp;
 	struct in_addr in;
 	icmphdr_t *icmp;
 	tcphdr_t *tcp;
 	u_short dport;
 	nat_t *nat;
 	u_32_t iph;
 	softc = fin->fin_main_soft;
 	softn = softc->ipf_nat_soft;
 	if (softn->ipf_nat_lock != 0)
 		return 0;
 	if (softn->ipf_nat_stats.ns_rules == 0 &&
 	    softn->ipf_nat_instances == NULL)
 		return 0;
 	tcp = NULL;
 	icmp = NULL;
 	dport = 0;
 	natadd = 1;
 	nflags = 0;
 	natfailed = 0;
 	ifp = fin->fin_ifp;
 	if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) {
 		switch (fin->fin_p)
+		{
 		case IPPROTO_TCP :
 			nflags = IPN_TCP;
 			break;
 		case IPPROTO_UDP :
 			nflags = IPN_UDP;
 			break;
 		case IPPROTO_ICMP :
 			icmp = fin->fin_dp;
 			/*
 			 * This is an incoming packet, so the destination is
 			 * the icmp_id and the source port equals 0
 			 */
 			if ((fin->fin_flx & FI_ICMPQUERY) != 0) {
 				nflags = IPN_ICMPQUERY;
 				dport = icmp->icmp_id;
 			} break;
 		default :
 			break;
+		}
 		if ((nflags & IPN_TCPUDP)) {
 			tcp = fin->fin_dp;
 			dport = fin->fin_data[1];
+		}
+	}
 	in = fin->fin_dst;
 	READ_ENTER(&softc->ipf_nat);
 	if ((fin->fin_p == IPPROTO_ICMP) && !(nflags & IPN_ICMPQUERY) &&
 	    (nat = ipf_nat_icmperror(fin, &nflags, NAT_INBOUND)))
 		/*EMPTY*/;
 	else if ((fin->fin_flx & FI_FRAG) && (nat = ipf_frag_natknown(fin)))
 		natadd = 0;
 	else if ((nat = ipf_nat_inlookup(fin, nflags|NAT_SEARCH,
 					 (u_int)fin->fin_p,
 					 fin->fin_src, in))) {
 		nflags = nat->nat_flags;
 	} else if (fin->fin_off == 0) {
 		u_32_t hv, msk, rmsk = 0;
 		/*
 		 * If there is no current entry in the nat table for this IP#,
 		 * create one for it (if there is a matching rule).
 		 */
 maskloop:
 		msk = softn->ipf_nat_rdr_active_masks[rmsk];
 		iph = in.s_addr & msk;
 		hv = NAT_HASH_FN(iph, 0, softn->ipf_nat_rdrrules_sz);
 retry_roundrobin:
 		/* TRACE (iph,msk,rmsk,hv,softn->ipf_nat_rdrrules_sz) */
 		for (np = softn->ipf_nat_rdr_rules[hv]; np; np = npnext) {
 			npnext = np->in_rnext;
 			if (np->in_ifps[0] && (np->in_ifps[0] != ifp))
 				continue;
 			if (np->in_v[0] != 4)
 				continue;
 			if (np->in_pr[0] && (np->in_pr[0] != fin->fin_p))
 				continue;
 			if ((np->in_flags & IPN_RF) && !(np->in_flags & nflags))
 				continue;
 			if (np->in_flags & IPN_FILTER) {
 				switch (ipf_nat_match(fin, np))
+				{
 				case 0 :
 					continue;
 				case -1 :
 					rval = -1;
 					goto inmatchfail;
 				case 1 :
 				default :
 					break;
+				}
 			} else {
 				if ((in.s_addr & np->in_odstmsk) !=
 				    np->in_odstaddr)
 					continue;
 				if (np->in_odport &&
 				    ((np->in_dtop < dport) ||
 				     (dport < np->in_odport)))
 					continue;
+			}
 			if (np->in_plabel != -1) {
 				if (!ipf_proxy_ok(fin, tcp, np)) {
 					continue;
+				}
+			}
 			if (np->in_flags & IPN_NO) {
 				np->in_hits++;
 				break;
+			}
 			MUTEX_ENTER(&softn->ipf_nat_new);
 			/*
 			 * If we've matched a round-robin rule but it has
 			 * moved in the list since we got it, start over as
 			 * this is now no longer correct.
 			 */
 			if (npnext != np->in_rnext) {
 				if ((np->in_flags & IPN_ROUNDR) != 0) {
 					MUTEX_EXIT(&softn->ipf_nat_new);
 					goto retry_roundrobin;
+				}
 				npnext = np->in_rnext;
+			}
 			nat = ipf_nat_add(fin, np, NULL, nflags, NAT_INBOUND);
 			MUTEX_EXIT(&softn->ipf_nat_new);
 			if (nat != NULL) {
 				natfailed = 0;
 				break;
+			}
 			natfailed = -1;
+		}
 		if ((np == NULL) && (rmsk < softn->ipf_nat_rdr_max)) {
 			rmsk++;
 			goto maskloop;
+		}
+	}
 	if (nat != NULL) {
 		rval = ipf_nat_in(fin, nat, natadd, nflags);
 		if (rval == 1) {
 			MUTEX_ENTER(&nat->nat_lock);
 			ipf_nat_update(fin, nat);
 			nat->nat_bytes[0] += fin->fin_plen;
 			nat->nat_pkts[0]++;
 			fin->fin_pktnum = nat->nat_pkts[0];
 			MUTEX_EXIT(&nat->nat_lock);
+		}
 	} else
 		rval = natfailed;
 inmatchfail:
 	RWLOCK_EXIT(&softc->ipf_nat);
 	switch (rval)
+	{
 	case -1 :
 		if (passp != NULL) {
 			DT1(frb_natv4in, fr_info_t *, fin);
 			NBUMPSIDED(0, ns_drop);
 			*passp = FR_BLOCK;
 			fin->fin_reason = FRB_NATV4;
+		}
 		fin->fin_flx |= FI_BADNAT;
 		NBUMPSIDED(0, ns_badnat);
 		break;
 	case 0 :
 		NBUMPSIDE(0, ns_ignored);
 		break;
 	case 1 :
 		NBUMPSIDE(0, ns_translated);
 		break;
+	}
 	return rval;
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    ipf_nat_in                                                  */
 /* Returns:     int - -1 == packet failed NAT checks so block it,           */
 /*                     1 == packet was successfully translated.             */
 /* Parameters:  fin(I)    - pointer to packet information                   */
 /*              nat(I)    - pointer to NAT structure                        */
 /*              natadd(I) - flag indicating if it is safe to add frag cache */
 /*              nflags(I) - NAT flags set for this packet                   */
 /* Locks Held:  ipf_nat(READ)                                               */
 /*                                                                          */
 /* Translate a packet coming "in" on an interface.                          */
 /* ------------------------------------------------------------------------ */
 int
 ipf_nat_in(fr_info_t *fin, nat_t *nat, int natadd, u_32_t nflags)
+{
 	ipf_main_softc_t *softc = fin->fin_main_soft;
 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
 	u_32_t sumd, ipsumd, sum1, sum2;
 	icmphdr_t *icmp;
 	tcphdr_t *tcp;
 	ipnat_t *np;
 	int skip;
 	int i;
 	tcp = NULL;
 	np = nat->nat_ptr;
 	fin->fin_fr = nat->nat_fr;
 	if (np != NULL) {
 		if ((natadd != 0) && (fin->fin_flx & FI_FRAG))
 			(void) ipf_frag_natnew(softc, fin, 0, nat);
 	/* ------------------------------------------------------------- */
 	/* A few quick notes:                                            */
 	/*      Following are test conditions prior to calling the       */
 	/*      ipf_proxy_check routine.                                 */
 	/*                                                               */
 	/*      A NULL tcp indicates a non TCP/UDP packet.  When dealing */
 	/*      with a map rule, we attempt to match the packet's        */
 	/*      source port against in_dport, otherwise we'd compare the */
 	/*      packet's destination.                                    */
 	/* ------------------------------------------------------------- */
 		if (np->in_apr != NULL) {
 			i = ipf_proxy_check(fin, nat);
 			if (i == -1) {
 				NBUMPSIDED(0, ns_ipf_proxy_fail);
 				return -1;
+			}
+		}
+	}
 	ipf_sync_update(softc, SMC_NAT, fin, nat->nat_sync);
 	ipsumd = nat->nat_ipsumd;
 	/*
 	 * Fix up checksums, not by recalculating them, but
 	 * simply computing adjustments.
 	 * Why only do this for some platforms on inbound packets ?
 	 * Because for those that it is done, IP processing is yet to happen
 	 * and so the IPv4 header checksum has not yet been evaluated.
 	 * Perhaps it should always be done for the benefit of things like
 	 * fast forwarding (so that it doesn't need to be recomputed) but with
 	 * header checksum offloading, perhaps it is a moot point.
 	 */
 	switch (nat->nat_dir)
+	{
 	case NAT_INBOUND :
 		if ((fin->fin_flx & FI_ICMPERR) == 0) {
 			fin->fin_ip->ip_src = nat->nat_nsrcip;
 			fin->fin_saddr = nat->nat_nsrcaddr;
 		} else {
 			sum1 = nat->nat_osrcaddr;
 			sum2 = nat->nat_nsrcaddr;
 			CALC_SUMD(sum1, sum2, sumd);
 			ipsumd -= sumd;
+		}
 		fin->fin_ip->ip_dst = nat->nat_ndstip;
 		fin->fin_daddr = nat->nat_ndstaddr;
 #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) || \
      defined(__osf__) || defined(linux)
 		ipf_fix_outcksum(0, &fin->fin_ip->ip_sum, ipsumd, 0);
 #endif
 		break;
 	case NAT_OUTBOUND :
 		if ((fin->fin_flx & FI_ICMPERR) == 0) {
 			fin->fin_ip->ip_src = nat->nat_odstip;
 			fin->fin_saddr = nat->nat_odstaddr;
 		} else {
 			sum1 = nat->nat_odstaddr;
 			sum2 = nat->nat_ndstaddr;
 			CALC_SUMD(sum1, sum2, sumd);
 			ipsumd -= sumd;
+		}
 		fin->fin_ip->ip_dst = nat->nat_osrcip;
 		fin->fin_daddr = nat->nat_osrcaddr;
 #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) || \
      defined(__osf__) || defined(linux)
 		ipf_fix_incksum(0, &fin->fin_ip->ip_sum, ipsumd, 0);
 #endif
 		break;
 	case NAT_DIVERTIN :
+	    {
 		udphdr_t *uh;
 		ip_t *ip;
 		mb_t *m;
 		m = M_DUP(np->in_divmp);
 		if (m == NULL) {
 			NBUMPSIDED(0, ns_divert_dup);
 			return -1;
+		}
 		ip = MTOD(m, ip_t *);
 		ip->ip_id = htons(ipf_nextipid(fin));
 		sum1 = ntohs(ip->ip_len);
 		ip->ip_len = ntohs(ip->ip_len);
 		ip->ip_len += fin->fin_plen;
 		ip->ip_len = htons(ip->ip_len);
 		uh = (udphdr_t *)(ip + 1);
 		uh->uh_ulen += fin->fin_plen;
 		uh->uh_ulen = htons(uh->uh_ulen);
 		sum2 = ntohs(ip->ip_id) + ntohs(ip->ip_len);
 		sum2 += ntohs(ip->ip_off) & IP_DF;
 		CALC_SUMD(sum1, sum2, sumd);
 #if !defined(_KERNEL) || defined(MENTAT) || defined(__sgi) || \
      defined(__osf__) || defined(linux)
 		ipf_fix_outcksum(0, &ip->ip_sum, sumd, 0);
 #endif
 		PREP_MB_T(fin, m);
 		fin->fin_ip = ip;
 		fin->fin_plen += sizeof(ip_t) + 8;	/* UDP + new IPv4 hdr */
 		fin->fin_dlen += sizeof(ip_t) + 8;	/* UDP + old IPv4 hdr */
 		nflags &= ~IPN_TCPUDPICMP;
 		break;
+	    }
 	case NAT_DIVERTOUT :
+	    {
 		mb_t *m;
 		skip = ipf_nat_decap(fin, nat);
 		if (skip <= 0) {
 			NBUMPSIDED(0, ns_decap_fail);
 			return -1;
+		}
 		m = fin->fin_m;
 #if defined(MENTAT) && defined(_KERNEL)
 		m->b_rptr += skip;
 #else
 		m->m_data += skip;
 		m->m_len -= skip;
 # ifdef M_PKTHDR
 		if (m->m_flags & M_PKTHDR)
 			m->m_pkthdr.len -= skip;
 # endif
 #endif
 		ipf_nat_update(fin, nat);
 		nflags &= ~IPN_TCPUDPICMP;
 		fin->fin_flx |= FI_NATED;
 		if (np != NULL && np->in_tag.ipt_num[0] != 0)
 			fin->fin_nattag = &np->in_tag;
 		return 1;
 		/* NOTREACHED */
+	    }
+	}
 	if (nflags & IPN_TCPUDP)
 		tcp = fin->fin_dp;
 	if (!(fin->fin_flx & FI_SHORT) && (fin->fin_off == 0)) {
 		u_short *csump;
 		if ((nat->nat_odport != 0) && (nflags & IPN_TCPUDP)) {
 			switch (nat->nat_dir)
+			{
 			case NAT_INBOUND :
 				tcp->th_sport = nat->nat_nsport;
 				fin->fin_data[0] = ntohs(nat->nat_nsport);
 				tcp->th_dport = nat->nat_ndport;
 				fin->fin_data[1] = ntohs(nat->nat_ndport);
 				break;
 			case NAT_OUTBOUND :
 				tcp->th_sport = nat->nat_odport;
 				fin->fin_data[0] = ntohs(nat->nat_odport);
 				tcp->th_dport = nat->nat_osport;
 				fin->fin_data[1] = ntohs(nat->nat_osport);
 				break;
+			}
+		}
 		if ((nat->nat_oicmpid != 0) && (nflags & IPN_ICMPQUERY)) {
 			icmp = fin->fin_dp;
 			switch (nat->nat_dir)
+			{
 			case NAT_INBOUND :
 				icmp->icmp_id = nat->nat_nicmpid;
 				break;
 			case NAT_OUTBOUND :
 				icmp->icmp_id = nat->nat_oicmpid;
 				break;
+			}
+		}
 		csump = ipf_nat_proto(fin, nat, nflags);
 		/*
 		 * The above comments do not hold for layer 4 (or higher)
 		 * checksums...
 		 */
 		if (csump != NULL) {
 			if (nat->nat_dir == NAT_OUTBOUND)
 				ipf_fix_incksum(0, csump, nat->nat_sumd[0], 0);
 			else
 				ipf_fix_outcksum(0, csump, nat->nat_sumd[0], 0);
+		}
+	}
 	fin->fin_flx |= FI_NATED;
 	if (np != NULL && np->in_tag.ipt_num[0] != 0)
 		fin->fin_nattag = &np->in_tag;
 	return 1;
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    ipf_nat_proto                                               */
 /* Returns:     u_short* - pointer to transport header checksum to update,  */
 /*                         NULL if the transport protocol is not recognised */
 /*                         as needing a checksum update.                    */
 /* Parameters:  fin(I)    - pointer to packet information                   */
 /*              nat(I)    - pointer to NAT structure                        */
 /*              nflags(I) - NAT flags set for this packet                   */
 /*                                                                          */
 /* Return the pointer to the checksum field for each protocol so understood.*/
 /* If support for making other changes to a protocol header is required,    */
 /* that is not strictly 'address' translation, such as clamping the MSS in  */
 /* TCP down to a specific value, then do it from here.                      */
 /* ------------------------------------------------------------------------ */
 u_short *
 ipf_nat_proto(fr_info_t *fin, nat_t *nat, u_int nflags)
+{
 	icmphdr_t *icmp;
 	u_short *csump;
 	tcphdr_t *tcp;
 	udphdr_t *udp;
 	csump = NULL;
 	if (fin->fin_out == 0) {
 		fin->fin_rev = (nat->nat_dir & NAT_OUTBOUND);
 	} else {
 		fin->fin_rev = ((nat->nat_dir & NAT_OUTBOUND) == 0);
+	}
 	switch (fin->fin_p)
+	{
 	case IPPROTO_TCP :
 		tcp = fin->fin_dp;
 		if ((nflags & IPN_TCP) != 0)
 			csump = &tcp->th_sum;
 		/*
 		 * Do a MSS CLAMPING on a SYN packet,
 		 * only deal IPv4 for now.
 		 */
 		if ((nat->nat_mssclamp != 0) && (tcp->th_flags & TH_SYN) != 0)
 			ipf_nat_mssclamp(tcp, nat->nat_mssclamp, fin, csump);
 		break;
 	case IPPROTO_UDP :
 		udp = fin->fin_dp;
 		if ((nflags & IPN_UDP) != 0) {
 			if (udp->uh_sum != 0)
 				csump = &udp->uh_sum;
+		}
 		break;
 	case IPPROTO_ICMP :
 		icmp = fin->fin_dp;
 		if ((nflags & IPN_ICMPQUERY) != 0) {
 			if (icmp->icmp_cksum != 0)
 				csump = &icmp->icmp_cksum;
+		}
 		break;
 #ifdef USE_INET6
 	case IPPROTO_ICMPV6 :
+	    {
 		struct icmp6_hdr *icmp6 = (struct icmp6_hdr *)fin->fin_dp;
 		icmp6 = fin->fin_dp;
 		if ((nflags & IPN_ICMPQUERY) != 0) {
 			if (icmp6->icmp6_cksum != 0)
 				csump = &icmp6->icmp6_cksum;
+		}
 		break;
+	    }
 #endif
+	}
 	return csump;
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    ipf_nat_expire                                              */
 /* Returns:     Nil                                                         */
 /* Parameters:  softc(I) - pointer to soft context main structure           */
 /*                                                                          */
 /* Check all of the timeout queues for entries at the top which need to be  */
 /* expired.                                                                 */
 /* ------------------------------------------------------------------------ */
 void
 ipf_nat_expire(ipf_main_softc_t *softc)
+{
 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
 	ipftq_t *ifq, *ifqnext;
 	ipftqent_t *tqe, *tqn;
 	int i;
 	SPL_INT(s);
 	SPL_NET(s);
 	WRITE_ENTER(&softc->ipf_nat);
 	for (ifq = softn->ipf_nat_tcptq, i = 0; ifq != NULL;
 	     ifq = ifq->ifq_next) {
 		for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); i++) {
 			if (tqe->tqe_die > softc->ipf_ticks)
 				break;
 			tqn = tqe->tqe_next;
 			ipf_nat_delete(softc, tqe->tqe_parent, NL_EXPIRE);
+		}
+	}
 	for (ifq = softn->ipf_nat_utqe; ifq != NULL; ifq = ifq->ifq_next) {
 		for (tqn = ifq->ifq_head; ((tqe = tqn) != NULL); i++) {
 			if (tqe->tqe_die > softc->ipf_ticks)
 				break;
 			tqn = tqe->tqe_next;
 			ipf_nat_delete(softc, tqe->tqe_parent, NL_EXPIRE);
+		}
+	}
 	for (ifq = softn->ipf_nat_utqe; ifq != NULL; ifq = ifqnext) {
 		ifqnext = ifq->ifq_next;
 		if (((ifq->ifq_flags & IFQF_DELETE) != 0) &&
 		    (ifq->ifq_ref == 0)) {
 			ipf_freetimeoutqueue(softc, ifq);
+		}
+	}
 	if (softn->ipf_nat_doflush != 0) {
 		ipf_nat_extraflush(softc, softn, 2);
 		softn->ipf_nat_doflush = 0;
+	}
 	RWLOCK_EXIT(&softc->ipf_nat);
 	SPL_X(s);
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    ipf_nat_sync                                                */
 /* Returns:     Nil                                                         */
 /* Parameters:  softc(I) - pointer to soft context main structure           */
 /*              ifp(I) - pointer to network interface                       */
 /*                                                                          */
 /* Walk through all of the currently active NAT sessions, looking for those */
 /* which need to have their translated address updated.                     */
 /* ------------------------------------------------------------------------ */
 void
 ipf_nat_sync(ipf_main_softc_t *softc, void *ifp)
+{
 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
 	u_32_t sum1, sum2, sumd;
 	i6addr_t in;
 	ipnat_t *n;
 	nat_t *nat;
 	void *ifp2;
 	int idx;
 	SPL_INT(s);
 	if (softc->ipf_running <= 0)
 		return;
 	/*
 	 * Change IP addresses for NAT sessions for any protocol except TCP
 	 * since it will break the TCP connection anyway.  The only rules
 	 * which will get changed are those which are "map ... -> 0/32",
 	 * where the rule specifies the address is taken from the interface.
 	 */
 	SPL_NET(s);
 	WRITE_ENTER(&softc->ipf_nat);
 	if (softc->ipf_running <= 0) {
 		RWLOCK_EXIT(&softc->ipf_nat);
 		return;
+	}
 	for (nat = softn->ipf_nat_instances; nat; nat = nat->nat_next) {
 		if ((nat->nat_flags & IPN_TCP) != 0)
 			continue;
 		n = nat->nat_ptr;
 		if (n != NULL) {
 			if (n->in_v[1] == 4) {
 				if (n->in_redir & NAT_MAP) {
 					if ((n->in_nsrcaddr != 0) ||
 					    (n->in_nsrcmsk != 0xffffffff))
 						continue;
 				} else if (n->in_redir & NAT_REDIRECT) {
 					if ((n->in_ndstaddr != 0) ||
 					    (n->in_ndstmsk != 0xffffffff))
 						continue;
+				}
+			}
 #ifdef USE_INET6
 			if (n->in_v[1] == 4) {
 				if (n->in_redir & NAT_MAP) {
 					if (!IP6_ISZERO(&n->in_nsrcaddr) ||
 					    !IP6_ISONES(&n->in_nsrcmsk))
 						continue;
 				} else if (n->in_redir & NAT_REDIRECT) {
 					if (!IP6_ISZERO(&n->in_ndstaddr) ||
 					    !IP6_ISONES(&n->in_ndstmsk))
 						continue;
+				}
+			}
 #endif
+		}
 		if (((ifp == NULL) || (ifp == nat->nat_ifps[0]) ||
 		     (ifp == nat->nat_ifps[1]))) {
 			nat->nat_ifps[0] = GETIFP(nat->nat_ifnames[0],
 						  nat->nat_v[0]);
 			if ((nat->nat_ifps[0] != NULL) &&
 			    (nat->nat_ifps[0] != (void *)-1)) {
 				nat->nat_mtu[0] = GETIFMTU_4(nat->nat_ifps[0]);
+			}
 			if (nat->nat_ifnames[1][0] != '\0') {
 				nat->nat_ifps[1] = GETIFP(nat->nat_ifnames[1],
 							  nat->nat_v[1]);
 			} else {
 				nat->nat_ifps[1] = nat->nat_ifps[0];
+			}
 			if ((nat->nat_ifps[1] != NULL) &&
 			    (nat->nat_ifps[1] != (void *)-1)) {
 				nat->nat_mtu[1] = GETIFMTU_4(nat->nat_ifps[1]);
+			}
 			ifp2 = nat->nat_ifps[0];
 			if (ifp2 == NULL)
 				continue;
 			/*
 			 * Change the map-to address to be the same as the
 			 * new one.
 			 */
 			sum1 = NATFSUM(nat, nat->nat_v[1], nat_nsrc6);
 			if (ipf_ifpaddr(softc, nat->nat_v[0], FRI_NORMAL, ifp2,
 				       &in, NULL) != -1) {
 				if (nat->nat_v[0] == 4)
 					nat->nat_nsrcip = in.in4;
+			}
 			sum2 = NATFSUM(nat, nat->nat_v[1], nat_nsrc6);
 			if (sum1 == sum2)
 				continue;
 			/*
 			 * Readjust the checksum adjustment to take into
 			 * account the new IP#.
 			 */
 			CALC_SUMD(sum1, sum2, sumd);
 			/* XXX - dont change for TCP when solaris does
 			 * hardware checksumming.
 			 */
 			sumd += nat->nat_sumd[0];
 			nat->nat_sumd[0] = (sumd & 0xffff) + (sumd >> 16);
 			nat->nat_sumd[1] = nat->nat_sumd[0];
+		}
+	}
 	for (n = softn->ipf_nat_list; (n != NULL); n = n->in_next) {
 		char *base = n->in_names;
 		if ((ifp == NULL) || (n->in_ifps[0] == ifp))
 			n->in_ifps[0] = ipf_resolvenic(softc,
 						       base + n->in_ifnames[0],
 						       n->in_v[0]);
 		if ((ifp == NULL) || (n->in_ifps[1] == ifp))
 			n->in_ifps[1] = ipf_resolvenic(softc,
 						       base + n->in_ifnames[1],
 						       n->in_v[1]);
 		if (n->in_redir & NAT_REDIRECT)
 			idx = 1;
 		else
 			idx = 0;
 		if (((ifp == NULL) || (n->in_ifps[idx] == ifp)) &&
 		    (n->in_ifps[idx] != NULL &&
 		     n->in_ifps[idx] != (void *)-1)) {
 			ipf_nat_nextaddrinit(softc, n->in_names, &n->in_osrc,
 , n->in_ifps[idx]);
 			ipf_nat_nextaddrinit(softc, n->in_names, &n->in_odst,
 , n->in_ifps[idx]);
 			ipf_nat_nextaddrinit(softc, n->in_names, &n->in_nsrc,
 , n->in_ifps[idx]);
 			ipf_nat_nextaddrinit(softc, n->in_names, &n->in_ndst,
 , n->in_ifps[idx]);
+		}
+	}
 	RWLOCK_EXIT(&softc->ipf_nat);
 	SPL_X(s);
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    ipf_nat_icmpquerytype                                       */
 /* Returns:     int - 1 == success, 0 == failure                            */
 /* Parameters:  icmptype(I) - ICMP type number                              */
 /*                                                                          */
 /* Tests to see if the ICMP type number passed is a query/response type or  */
 /* not.                                                                     */
 /* ------------------------------------------------------------------------ */
 static int
 ipf_nat_icmpquerytype(int icmptype)
+{
 	/*
 	 * For the ICMP query NAT code, it is essential that both the query
 	 * and the reply match on the NAT rule. Because the NAT structure
 	 * does not keep track of the icmptype, and a single NAT structure
 	 * is used for all icmp types with the same src, dest and id, we
 	 * simply define the replies as queries as well. The funny thing is,
 	 * although it seems silly to call a reply a query, this is exactly
 	 * as it is defined in the IPv4 specification
 	 */
 	switch (icmptype)
+	{
 	case ICMP_ECHOREPLY:
 	case ICMP_ECHO:
 	/* route advertisement/sollicitation is currently unsupported: */
 	/* it would require rewriting the ICMP data section            */
 	case ICMP_TSTAMP:
 	case ICMP_TSTAMPREPLY:
 	case ICMP_IREQ:
 	case ICMP_IREQREPLY:
 	case ICMP_MASKREQ:
 	case ICMP_MASKREPLY:
 		return 1;
 	default:
 		return 0;
+	}
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    nat_log                                                     */
 /* Returns:     Nil                                                         */
 /* Parameters:  softc(I) - pointer to soft context main structure           */
 /*              softn(I) - pointer to NAT context structure                 */
 /*              nat(I)    - pointer to NAT structure                        */
 /*              action(I) - action related to NAT structure being performed */
 /*                                                                          */
 /* Creates a NAT log entry.                                                 */
 /* ------------------------------------------------------------------------ */
 void
 ipf_nat_log(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, struct nat *nat,
     u_int action)
+{
 #ifdef	IPFILTER_LOG
 # ifndef LARGE_NAT
 	struct ipnat *np;
 	int rulen;
 # endif
 	struct natlog natl;
 	void *items[1];
 	size_t sizes[1];
 	int types[1];
 	bcopy((char *)&nat->nat_osrc6, (char *)&natl.nl_osrcip,
 	      sizeof(natl.nl_osrcip));
 	bcopy((char *)&nat->nat_nsrc6, (char *)&natl.nl_nsrcip,
 	      sizeof(natl.nl_nsrcip));
 	bcopy((char *)&nat->nat_odst6, (char *)&natl.nl_odstip,
 	      sizeof(natl.nl_odstip));
 	bcopy((char *)&nat->nat_ndst6, (char *)&natl.nl_ndstip,
 	      sizeof(natl.nl_ndstip));
 	natl.nl_bytes[0] = nat->nat_bytes[0];
 	natl.nl_bytes[1] = nat->nat_bytes[1];
 	natl.nl_pkts[0] = nat->nat_pkts[0];
 	natl.nl_pkts[1] = nat->nat_pkts[1];
 	natl.nl_odstport = nat->nat_odport;
 	natl.nl_osrcport = nat->nat_osport;
 	natl.nl_nsrcport = nat->nat_nsport;
 	natl.nl_ndstport = nat->nat_ndport;
 	natl.nl_p[0] = nat->nat_pr[0];
 	natl.nl_p[1] = nat->nat_pr[1];
 	natl.nl_v[0] = nat->nat_v[0];
 	natl.nl_v[1] = nat->nat_v[1];
 	natl.nl_type = nat->nat_redir;
 	natl.nl_action = action;
 	natl.nl_rule = -1;
 	bcopy(nat->nat_ifnames[0], natl.nl_ifnames[0],
 	      sizeof(nat->nat_ifnames[0]));
 	bcopy(nat->nat_ifnames[1], natl.nl_ifnames[1],
 	      sizeof(nat->nat_ifnames[1]));
 # ifndef LARGE_NAT
 	if (nat->nat_ptr != NULL) {
 		for (rulen = 0, np = softn->ipf_nat_list; np != NULL;
 		     np = np->in_next, rulen++)
 			if (np == nat->nat_ptr) {
 				natl.nl_rule = rulen;
 				break;
+			}
+	}
 # endif
 	items[0] = &natl;
 	sizes[0] = sizeof(natl);
 	types[0] = 0;
 	(void) ipf_log_items(softc, IPL_LOGNAT, NULL, items, sizes, types, 1);
 #endif
+}
 #if defined(__OpenBSD__)
 /* ------------------------------------------------------------------------ */
 /* Function:    ipf_nat_ifdetach                                            */
 /* Returns:     Nil                                                         */
 /* Parameters:  ifp(I) - pointer to network interface                       */
 /*                                                                          */
 /* Compatibility interface for OpenBSD to trigger the correct updating of   */
 /* interface references within IPFilter.                                    */
 /* ------------------------------------------------------------------------ */
 void
 ipf_nat_ifdetach(ifp)
 	void *ifp;
+{
 	ipf_main_softc_t *softc;
 	softc = ipf_get_softc(0);
 	ipf_sync(ifp);
 	return;
+}
 #endif
 /* ------------------------------------------------------------------------ */
 /* Function:    ipf_nat_rule_deref                                          */
 /* Returns:     Nil                                                         */
 /* Parameters:  softc(I) - pointer to soft context main structure           */
 /*              inp(I)   - pointer to pointer to NAT rule                   */
 /* Write Locks: ipf_nat                                                     */
 /*                                                                          */
 /* Dropping the refernce count for a rule means that whatever held the      */
 /* pointer to this rule (*inp) is no longer interested in it and when the   */
 /* reference count drops to zero, any resources allocated for the rule can  */
 /* be released and the rule itself free'd.                                  */
 /* ------------------------------------------------------------------------ */
 void
 ipf_nat_rule_deref(ipf_main_softc_t *softc, ipnat_t **inp)
+{
 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
 	ipnat_t *n;
 	n = *inp;
 	*inp = NULL;
 	n->in_use--;
 	if (n->in_use > 0)
 		return;
 	if (n->in_apr != NULL)
 		ipf_proxy_deref(n->in_apr);
 	ipf_nat_rule_fini(softc, n);
 	if (n->in_redir & NAT_REDIRECT) {
 		if ((n->in_flags & IPN_PROXYRULE) == 0) {
 			ATOMIC_DEC32(softn->ipf_nat_stats.ns_rules_rdr);
+		}
+	}
 	if (n->in_redir & (NAT_MAP|NAT_MAPBLK)) {
 		if ((n->in_flags & IPN_PROXYRULE) == 0) {
 			ATOMIC_DEC32(softn->ipf_nat_stats.ns_rules_map);
+		}
+	}
 	if (n->in_tqehead[0] != NULL) {
 		if (ipf_deletetimeoutqueue(n->in_tqehead[0]) == 0) {
-			ipf_freetimeoutqueue(softc, n->in_tqehead[1]);
+			ipf_freetimeoutqueue(softc, n->in_tqehead[0]);
+		}
+	}
 	if (n->in_tqehead[1] != NULL) {
 		if (ipf_deletetimeoutqueue(n->in_tqehead[1]) == 0) {
 			ipf_freetimeoutqueue(softc, n->in_tqehead[1]);
+		}
+	}
 	if ((n->in_flags & IPN_PROXYRULE) == 0) {
 		ATOMIC_DEC32(softn->ipf_nat_stats.ns_rules);
+	}
 	MUTEX_DESTROY(&n->in_lock);
 	KFREES(n, n->in_size);
 #if SOLARIS && !defined(INSTANCES)
 	if (softn->ipf_nat_stats.ns_rules == 0)
 		pfil_delayed_copy = 1;
 #endif
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    ipf_nat_deref                                               */
 /* Returns:     Nil                                                         */
 /* Parameters:  softc(I) - pointer to soft context main structure           */
 /*              natp(I)  - pointer to pointer to NAT table entry            */
 /*                                                                          */
 /* Decrement the reference counter for this NAT table entry and free it if  */
 /* there are no more things using it.                                       */
 /*                                                                          */
 /* IF nat_ref == 1 when this function is called, then we have an orphan nat */
 /* structure *because* it only gets called on paths _after_ nat_ref has been*/
 /* incremented.  If nat_ref == 1 then we shouldn't decrement it here        */
 /* because nat_delete() will do that and send nat_ref to -1.                */
 /*                                                                          */
 /* Holding the lock on nat_lock is required to serialise nat_delete() being */
 /* called from a NAT flush ioctl with a deref happening because of a packet.*/
 /* ------------------------------------------------------------------------ */
 void
 ipf_nat_deref(ipf_main_softc_t *softc, nat_t **natp)
+{
 	nat_t *nat;
 	nat = *natp;
 	*natp = NULL;
 	MUTEX_ENTER(&nat->nat_lock);
 	if (nat->nat_ref > 1) {
 		nat->nat_ref--;
 		ASSERT(nat->nat_ref >= 0);
 		MUTEX_EXIT(&nat->nat_lock);
 		return;
+	}
 	MUTEX_EXIT(&nat->nat_lock);
 	WRITE_ENTER(&softc->ipf_nat);
 	ipf_nat_delete(softc, nat, NL_EXPIRE);
 	RWLOCK_EXIT(&softc->ipf_nat);
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    ipf_nat_clone                                               */
 /* Returns:     ipstate_t* - NULL == cloning failed,                        */
 /*                           else pointer to new state structure            */
 /* Parameters:  fin(I) - pointer to packet information                      */
 /*              is(I)  - pointer to master state structure                  */
 /* Write Lock:  ipf_nat                                                     */
 /*                                                                          */
 /* Create a "duplcate" state table entry from the master.                   */
 /* ------------------------------------------------------------------------ */
 nat_t *
 ipf_nat_clone(fr_info_t *fin, nat_t *nat)
+{
 	ipf_main_softc_t *softc = fin->fin_main_soft;
 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
 	frentry_t *fr;
 	nat_t *clone;
 	ipnat_t *np;
 	KMALLOC(clone, nat_t *);
 	if (clone == NULL) {
 		NBUMPSIDED(fin->fin_out, ns_clone_nomem);
 		return NULL;
+	}
 	bcopy((char *)nat, (char *)clone, sizeof(*clone));
 	MUTEX_NUKE(&clone->nat_lock);
 	clone->nat_rev = fin->fin_rev;
 	clone->nat_aps = NULL;
 	/*
 	 * Initialize all these so that ipf_nat_delete() doesn't cause a crash.
 	 */
 	clone->nat_tqe.tqe_pnext = NULL;
 	clone->nat_tqe.tqe_next = NULL;
 	clone->nat_tqe.tqe_ifq = NULL;
 	clone->nat_tqe.tqe_parent = clone;
 	clone->nat_flags &= ~SI_CLONE;
 	clone->nat_flags |= SI_CLONED;
 	if (clone->nat_hm)
 		clone->nat_hm->hm_ref++;
 	if (ipf_nat_insert(softc, softn, clone) == -1) {
 		KFREE(clone);
 		NBUMPSIDED(fin->fin_out, ns_insert_fail);
 		return NULL;
+	}
 	np = clone->nat_ptr;
 	if (np != NULL) {
 		if (softn->ipf_nat_logging)
 			ipf_nat_log(softc, softn, clone, NL_CLONE);
 		np->in_use++;
+	}
 	fr = clone->nat_fr;
 	if (fr != NULL) {
 		MUTEX_ENTER(&fr->fr_lock);
 		fr->fr_ref++;
 		MUTEX_EXIT(&fr->fr_lock);
+	}
 	/*
 	 * Because the clone is created outside the normal loop of things and
 	 * TCP has special needs in terms of state, initialise the timeout
 	 * state of the new NAT from here.
 	 */
 	if (clone->nat_pr[0] == IPPROTO_TCP) {
 		(void) ipf_tcp_age(&clone->nat_tqe, fin, softn->ipf_nat_tcptq,
 				   clone->nat_flags, 2);
+	}
 	clone->nat_sync = ipf_sync_new(softc, SMC_NAT, fin, clone);
 	if (softn->ipf_nat_logging)
 		ipf_nat_log(softc, softn, clone, NL_CLONE);
 	return clone;
+}
 /* ------------------------------------------------------------------------ */
 /* Function:   ipf_nat_wildok                                               */
 /* Returns:    int - 1 == packet's ports match wildcards                    */
 /*                   0 == packet's ports don't match wildcards              */
 /* Parameters: nat(I)   - NAT entry                                         */
 /*             sport(I) - source port                                       */
 /*             dport(I) - destination port                                  */
 /*             flags(I) - wildcard flags                                    */
 /*             dir(I)   - packet direction                                  */
 /*                                                                          */
 /* Use NAT entry and packet direction to determine which combination of     */
 /* wildcard flags should be used.                                           */
 /* ------------------------------------------------------------------------ */
 int
 ipf_nat_wildok(nat_t *nat, int sport, int dport, int flags, int dir)
+{
 	/*
 	 * When called by       dir is set to
 	 * nat_inlookup         NAT_INBOUND (0)
 	 * nat_outlookup        NAT_OUTBOUND (1)
+	 *
 	 * We simply combine the packet's direction in dir with the original
 	 * "intended" direction of that NAT entry in nat->nat_dir to decide
 	 * which combination of wildcard flags to allow.
 	 */
 	switch ((dir << 1) | (nat->nat_dir & (NAT_INBOUND|NAT_OUTBOUND)))
+	{
 	case 3: /* outbound packet / outbound entry */
 		if (((nat->nat_osport == sport) ||
 		    (flags & SI_W_SPORT)) &&
 		    ((nat->nat_odport == dport) ||
 		    (flags & SI_W_DPORT)))
 			return 1;
 		break;
 	case 2: /* outbound packet / inbound entry */
 		if (((nat->nat_osport == dport) ||
 		    (flags & SI_W_SPORT)) &&
 		    ((nat->nat_odport == sport) ||
 		    (flags & SI_W_DPORT)))
 			return 1;
 		break;
 	case 1: /* inbound packet / outbound entry */
 		if (((nat->nat_osport == dport) ||
 		    (flags & SI_W_SPORT)) &&
 		    ((nat->nat_odport == sport) ||
 		    (flags & SI_W_DPORT)))
 			return 1;
 		break;
 	case 0: /* inbound packet / inbound entry */
 		if (((nat->nat_osport == sport) ||
 		    (flags & SI_W_SPORT)) &&
 		    ((nat->nat_odport == dport) ||
 		    (flags & SI_W_DPORT)))
 			return 1;
 		break;
 	default:
 		break;
+	}
 	return(0);
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    nat_mssclamp                                                */
 /* Returns:     Nil                                                         */
 /* Parameters:  tcp(I)    - pointer to TCP header                           */
 /*              maxmss(I) - value to clamp the TCP MSS to                   */
 /*              fin(I)    - pointer to packet information                   */
 /*              csump(I)  - pointer to TCP checksum                         */
 /*                                                                          */
 /* Check for MSS option and clamp it if necessary.  If found and changed,   */
 /* then the TCP header checksum will be updated to reflect the change in    */
 /* the MSS.                                                                 */
 /* ------------------------------------------------------------------------ */
 static void
 ipf_nat_mssclamp(tcphdr_t *tcp, u_32_t maxmss, fr_info_t *fin, u_short *csump)
+{
 	u_char *cp, *ep, opt;
 	int hlen, advance;
 	u_32_t mss, sumd;
 	hlen = TCP_OFF(tcp) << 2;
 	if (hlen > sizeof(*tcp)) {
 		cp = (u_char *)tcp + sizeof(*tcp);
 		ep = (u_char *)tcp + hlen;
 		while (cp < ep) {
 			opt = cp[0];
 			if (opt == TCPOPT_EOL)
 				break;
 			else if (opt == TCPOPT_NOP) {
 				cp++;
 				continue;
+			}
 			if (cp + 1 >= ep)
 				break;
 			advance = cp[1];
 			if ((cp + advance > ep) || (advance <= 0))
 				break;
 			switch (opt)
+			{
 			case TCPOPT_MAXSEG:
 				if (advance != 4)
 					break;
 				mss = cp[2] * 256 + cp[3];
 				if (mss > maxmss) {
 					cp[2] = maxmss / 256;
 					cp[3] = maxmss & 0xff;
 					CALC_SUMD(mss, maxmss, sumd);
 					ipf_fix_outcksum(0, csump, sumd, 0);
+				}
 				break;
 			default:
 				/* ignore unknown options */
 				break;
+			}
 			cp += advance;
+		}
+	}
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    ipf_nat_setqueue                                            */
 /* Returns:     Nil                                                         */
 /* Parameters:  softc(I) - pointer to soft context main structure           */
 /*              softn(I) - pointer to NAT context structure                 */
 /*              nat(I)- pointer to NAT structure                            */
 /* Locks:       ipf_nat (read or write)                                     */
 /*                                                                          */
 /* Put the NAT entry on its default queue entry, using rev as a helped in   */
 /* determining which queue it should be placed on.                          */
 /* ------------------------------------------------------------------------ */
 void
 ipf_nat_setqueue(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, nat_t *nat)
+{
 	ipftq_t *oifq, *nifq;
 	int rev = nat->nat_rev;
 	if (nat->nat_ptr != NULL)
 		nifq = nat->nat_ptr->in_tqehead[rev];
 	else
 		nifq = NULL;
 	if (nifq == NULL) {
 		switch (nat->nat_pr[0])
+		{
 		case IPPROTO_UDP :
 			nifq = &softn->ipf_nat_udptq;
 			break;
 		case IPPROTO_ICMP :
 			nifq = &softn->ipf_nat_icmptq;
 			break;
 		case IPPROTO_TCP :
 			nifq = softn->ipf_nat_tcptq +
 			       nat->nat_tqe.tqe_state[rev];
 			break;
 		default :
 			nifq = &softn->ipf_nat_iptq;
 			break;
+		}
+	}
 	oifq = nat->nat_tqe.tqe_ifq;
 	/*
 	 * If it's currently on a timeout queue, move it from one queue to
 	 * another, else put it on the end of the newly determined queue.
 	 */
 	if (oifq != NULL)
 		ipf_movequeue(softc->ipf_ticks, &nat->nat_tqe, oifq, nifq);
 	else
 		ipf_queueappend(softc->ipf_ticks, &nat->nat_tqe, nifq, nat);
 	return;
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    nat_getnext                                                 */
 /* Returns:     int - 0 == ok, else error                                   */
 /* Parameters:  softc(I) - pointer to soft context main structure           */
 /*              t(I)   - pointer to ipftoken structure                      */
 /*              itp(I) - pointer to ipfgeniter_t structure                  */
 /*                                                                          */
 /* Fetch the next nat/ipnat structure pointer from the linked list and      */
 /* copy it out to the storage space pointed to by itp_data.  The next item  */
 /* in the list to look at is put back in the ipftoken struture.             */
 /* ------------------------------------------------------------------------ */
 static int
 ipf_nat_getnext(ipf_main_softc_t *softc, ipftoken_t *t, ipfgeniter_t *itp,
     ipfobj_t *objp)
+{
 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
 	hostmap_t *hm, *nexthm = NULL, zerohm;
 	ipnat_t *ipn, *nextipnat = NULL, zeroipn;
 	nat_t *nat, *nextnat = NULL, zeronat;
 	int error = 0;
 	void *nnext;
 	if (itp->igi_nitems != 1) {
 		IPFERROR(60075);
 		return ENOSPC;
+	}
 	READ_ENTER(&softc->ipf_nat);
 	switch (itp->igi_type)
+	{
 	case IPFGENITER_HOSTMAP :
 		hm = t->ipt_data;
 		if (hm == NULL) {
 			nexthm = softn->ipf_hm_maplist;
 		} else {
 			nexthm = hm->hm_next;
+		}
 		if (nexthm != NULL) {
 			ATOMIC_INC32(nexthm->hm_ref);
 			t->ipt_data = nexthm;
 		} else {
 			bzero(&zerohm, sizeof(zerohm));
 			nexthm = &zerohm;
 			t->ipt_data = NULL;
+		}
 		nnext = nexthm->hm_next;
 		break;
 	case IPFGENITER_IPNAT :
 		ipn = t->ipt_data;
 		if (ipn == NULL) {
 			nextipnat = softn->ipf_nat_list;
 		} else {
 			nextipnat = ipn->in_next;
+		}
 		if (nextipnat != NULL) {
 			ATOMIC_INC32(nextipnat->in_use);
 			t->ipt_data = nextipnat;
 		} else {
 			bzero(&zeroipn, sizeof(zeroipn));
 			nextipnat = &zeroipn;
 			t->ipt_data = NULL;
+		}
 		nnext = nextipnat->in_next;
 		break;
 	case IPFGENITER_NAT :
 		nat = t->ipt_data;
 		if (nat == NULL) {
 			nextnat = softn->ipf_nat_instances;
 		} else {
 			nextnat = nat->nat_next;
+		}
 		if (nextnat != NULL) {
 			MUTEX_ENTER(&nextnat->nat_lock);
 			nextnat->nat_ref++;
 			MUTEX_EXIT(&nextnat->nat_lock);
 			t->ipt_data = nextnat;
 		} else {
 			bzero(&zeronat, sizeof(zeronat));
 			nextnat = &zeronat;
 			t->ipt_data = NULL;
+		}
 		nnext = nextnat->nat_next;
 		break;
 	default :
 		RWLOCK_EXIT(&softc->ipf_nat);
 		IPFERROR(60055);
 		return EINVAL;
+	}
 	RWLOCK_EXIT(&softc->ipf_nat);
 	objp->ipfo_ptr = itp->igi_data;
 	switch (itp->igi_type)
+	{
 	case IPFGENITER_HOSTMAP :
 		error = COPYOUT(nexthm, objp->ipfo_ptr, sizeof(*nexthm));
 		if (error != 0) {
 			IPFERROR(60049);
 			error = EFAULT;
+		}
 		if (hm != NULL) {
 			WRITE_ENTER(&softc->ipf_nat);
 			ipf_nat_hostmapdel(softc, &hm);
 			RWLOCK_EXIT(&softc->ipf_nat);
+		}
 		break;
 	case IPFGENITER_IPNAT :
 		objp->ipfo_size = nextipnat->in_size;
 		objp->ipfo_type = IPFOBJ_IPNAT;
 		error = ipf_outobjk(softc, objp, nextipnat);
 		if (ipn != NULL) {
 			WRITE_ENTER(&softc->ipf_nat);
 			ipf_nat_rule_deref(softc, &ipn);
 			RWLOCK_EXIT(&softc->ipf_nat);
+		}
 		break;
 	case IPFGENITER_NAT :
 		objp->ipfo_size = sizeof(nat_t);
 		objp->ipfo_type = IPFOBJ_NAT;
 		error = ipf_outobjk(softc, objp, nextnat);
 		if (nat != NULL)
 			ipf_nat_deref(softc, &nat);
 		break;
+	}
 	if (nnext == NULL)
 		ipf_token_mark_complete(t);
 	return error;
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    nat_extraflush                                              */
 /* Returns:     int - 0 == success, -1 == failure                           */
 /* Parameters:  softc(I) - pointer to soft context main structure           */
 /*              softn(I) - pointer to NAT context structure                 */
 /*              which(I) - how to flush the active NAT table                */
 /* Write Locks: ipf_nat                                                     */
 /*                                                                          */
 /* Flush nat tables.  Three actions currently defined:                      */
 /* which == 0 : flush all nat table entries                                 */
 /* which == 1 : flush TCP connections which have started to close but are   */
 /*	      stuck for some reason.                                        */
 /* which == 2 : flush TCP connections which have been idle for a long time, */
 /*	      starting at > 4 days idle and working back in successive half-*/
 /*	      days to at most 12 hours old.  If this fails to free enough   */
 /*            slots then work backwards in half hour slots to 30 minutes.   */
 /*            If that too fails, then work backwards in 30 second intervals */
 /*            for the last 30 minutes to at worst 30 seconds idle.          */
 /* ------------------------------------------------------------------------ */
 static int
 ipf_nat_extraflush(ipf_main_softc_t *softc, ipf_nat_softc_t *softn, int which)
+{
 	nat_t *nat, **natp;
 	ipftqent_t *tqn;
 	ipftq_t *ifq;
 	int removed;
 	SPL_INT(s);
 	removed = 0;
 	SPL_NET(s);
 	switch (which)
+	{
 	case 0 :
 		softn->ipf_nat_stats.ns_flush_all++;
 		/*
 		 * Style 0 flush removes everything...
 		 */
 		for (natp = &softn->ipf_nat_instances;
 		     ((nat = *natp) != NULL); ) {
 			ipf_nat_delete(softc, nat, NL_FLUSH);
 			removed++;
+		}
 		break;
 	case 1 :
 		softn->ipf_nat_stats.ns_flush_closing++;
 		/*
 		 * Since we're only interested in things that are closing,
 		 * we can start with the appropriate timeout queue.
 		 */
 		for (ifq = softn->ipf_nat_tcptq + IPF_TCPS_CLOSE_WAIT;
 		     ifq != NULL; ifq = ifq->ifq_next) {
 			for (tqn = ifq->ifq_head; tqn != NULL; ) {
 				nat = tqn->tqe_parent;
 				tqn = tqn->tqe_next;
 				if (nat->nat_pr[0] != IPPROTO_TCP ||
 				    nat->nat_pr[1] != IPPROTO_TCP)
 					break;
 				ipf_nat_delete(softc, nat, NL_EXPIRE);
 				removed++;
+			}
+		}
 		/*
 		 * Also need to look through the user defined queues.
 		 */
 		for (ifq = softn->ipf_nat_utqe; ifq != NULL;
 		     ifq = ifq->ifq_next) {
 			for (tqn = ifq->ifq_head; tqn != NULL; ) {
 				nat = tqn->tqe_parent;
 				tqn = tqn->tqe_next;
 				if (nat->nat_pr[0] != IPPROTO_TCP ||
 				    nat->nat_pr[1] != IPPROTO_TCP)
 					continue;
 				if ((nat->nat_tcpstate[0] >
 				     IPF_TCPS_ESTABLISHED) &&
 				    (nat->nat_tcpstate[1] >
 				     IPF_TCPS_ESTABLISHED)) {
 					ipf_nat_delete(softc, nat, NL_EXPIRE);
 					removed++;
+				}
+			}
+		}
 		break;
 		/*
 		 * Args 5-11 correspond to flushing those particular states
 		 * for TCP connections.
 		 */
 	case IPF_TCPS_CLOSE_WAIT :
 	case IPF_TCPS_FIN_WAIT_1 :
 	case IPF_TCPS_CLOSING :
 	case IPF_TCPS_LAST_ACK :
 	case IPF_TCPS_FIN_WAIT_2 :
 	case IPF_TCPS_TIME_WAIT :
 	case IPF_TCPS_CLOSED :
 		softn->ipf_nat_stats.ns_flush_state++;
 		tqn = softn->ipf_nat_tcptq[which].ifq_head;
 		while (tqn != NULL) {
 			nat = tqn->tqe_parent;
 			tqn = tqn->tqe_next;
 			ipf_nat_delete(softc, nat, NL_FLUSH);
 			removed++;
+		}
 		break;
 	default :
 		if (which < 30)
 			break;
 		softn->ipf_nat_stats.ns_flush_timeout++;
 		/*
 		 * Take a large arbitrary number to mean the number of seconds
 		 * for which which consider to be the maximum value we'll allow
 		 * the expiration to be.
 		 */
 		which = IPF_TTLVAL(which);
 		for (natp = &softn->ipf_nat_instances;
 		     ((nat = *natp) != NULL); ) {
 			if (softc->ipf_ticks - nat->nat_touched > which) {
 				ipf_nat_delete(softc, nat, NL_FLUSH);
 				removed++;
 			} else
 				natp = &nat->nat_next;
+		}
 		break;
+	}
 	if (which != 2) {
 		SPL_X(s);
 		return removed;
+	}
 	softn->ipf_nat_stats.ns_flush_queue++;
 	/*
 	 * Asked to remove inactive entries because the table is full, try
 	 * again, 3 times, if first attempt failed with a different criteria
 	 * each time.  The order tried in must be in decreasing age.
 	 * Another alternative is to implement random drop and drop N entries
 	 * at random until N have been freed up.
 	 */
 	if (softc->ipf_ticks - softn->ipf_nat_last_force_flush >
 	    IPF_TTLVAL(5)) {
 		softn->ipf_nat_last_force_flush = softc->ipf_ticks;
 		removed = ipf_queueflush(softc, ipf_nat_flush_entry,
 					 softn->ipf_nat_tcptq,
 					 softn->ipf_nat_utqe,
 					 &softn->ipf_nat_stats.ns_active,
 					 softn->ipf_nat_table_sz,
 					 softn->ipf_nat_table_wm_low);
+	}
 	SPL_X(s);
 	return removed;
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    ipf_nat_flush_entry                                         */
 /* Returns:     0 - always succeeds                                         */
 /* Parameters:  softc(I) - pointer to soft context main structure           */
 /*              entry(I) - pointer to NAT entry                             */
 /* Write Locks: ipf_nat                                                     */
 /*                                                                          */
 /* This function is a stepping stone between ipf_queueflush() and           */
 /* nat_dlete().  It is used so we can provide a uniform interface via the   */
 /* ipf_queueflush() function.  Since the nat_delete() function returns void */
 /* we translate that to mean it always succeeds in deleting something.      */
 /* ------------------------------------------------------------------------ */
 static int
 ipf_nat_flush_entry(ipf_main_softc_t *softc, void *entry)
+{
 	ipf_nat_delete(softc, entry, NL_FLUSH);
 	return 0;
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    ipf_nat_iterator                                            */
 /* Returns:     int - 0 == ok, else error                                   */
 /* Parameters:  softc(I) - pointer to soft context main structure           */
 /*              token(I) - pointer to ipftoken structure                    */
 /*              itp(I)   - pointer to ipfgeniter_t structure                */
 /*              obj(I)   - pointer to data description structure            */
 /*                                                                          */
 /* This function acts as a handler for the SIOCGENITER ioctls that use a    */
 /* generic structure to iterate through a list.  There are three different  */
 /* linked lists of NAT related information to go through: NAT rules, active */
 /* NAT mappings and the NAT fragment cache.                                 */
 /* ------------------------------------------------------------------------ */
 static int
 ipf_nat_iterator(ipf_main_softc_t *softc, ipftoken_t *token, ipfgeniter_t *itp,
     ipfobj_t *obj)
+{
 	int error;
 	if (itp->igi_data == NULL) {
 		IPFERROR(60052);
 		return EFAULT;
+	}
 	switch (itp->igi_type)
+	{
 	case IPFGENITER_HOSTMAP :
 	case IPFGENITER_IPNAT :
 	case IPFGENITER_NAT :
 		error = ipf_nat_getnext(softc, token, itp, obj);
 		break;
 	case IPFGENITER_NATFRAG :
 		error = ipf_frag_nat_next(softc, token, itp);
 		break;
 	default :
 		IPFERROR(60053);
 		error = EINVAL;
 		break;
+	}
 	return error;
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    ipf_nat_setpending                                          */
 /* Returns:     Nil                                                         */
 /* Parameters:  softc(I) - pointer to soft context main structure           */
 /*              nat(I)   - pointer to NAT structure                         */
 /* Locks:       ipf_nat (read or write)                                     */
 /*                                                                          */
 /* Put the NAT entry on to the pending queue - this queue has a very short  */
 /* lifetime where items are put that can't be deleted straight away because */
 /* of locking issues but we want to delete them ASAP, anyway.  In calling   */
 /* this function, it is assumed that the owner (if there is one, as shown   */
 /* by nat_me) is no longer interested in it.                                */
 /* ------------------------------------------------------------------------ */
 void
 ipf_nat_setpending(ipf_main_softc_t *softc, nat_t *nat)
+{
 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
 	ipftq_t *oifq;
 	oifq = nat->nat_tqe.tqe_ifq;
 	if (oifq != NULL)
 		ipf_movequeue(softc->ipf_ticks, &nat->nat_tqe, oifq,
 			      &softn->ipf_nat_pending);
 	else
 		ipf_queueappend(softc->ipf_ticks, &nat->nat_tqe,
 				&softn->ipf_nat_pending, nat);
 	if (nat->nat_me != NULL) {
 		*nat->nat_me = NULL;
 		nat->nat_me = NULL;
 		nat->nat_ref--;
 		ASSERT(nat->nat_ref >= 0);
+	}
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    nat_newrewrite                                              */
 /* Returns:     int - -1 == error, 0 == success (no move), 1 == success and */
 /*                    allow rule to be moved if IPN_ROUNDR is set.          */
 /* Parameters:  fin(I) - pointer to packet information                      */
 /*              nat(I) - pointer to NAT entry                               */
 /*              ni(I)  - pointer to structure with misc. information needed */
 /*                       to create new NAT entry.                           */
 /* Write Lock:  ipf_nat                                                     */
 /*                                                                          */
 /* This function is responsible for setting up an active NAT session where  */
 /* we are changing both the source and destination parameters at the same   */
 /* time.  The loop in here works differently to elsewhere - each iteration  */
 /* is responsible for changing a single parameter that can be incremented.  */
 /* So one pass may increase the source IP#, next source port, next dest. IP#*/
 /* and the last destination port for a total of 4 iterations to try each.   */
 /* This is done to try and exhaustively use the translation space available.*/
 /* ------------------------------------------------------------------------ */
 static int
 ipf_nat_newrewrite(fr_info_t *fin, nat_t *nat, natinfo_t *nai)
+{
 	int src_search = 1;
 	int dst_search = 1;
 	fr_info_t frnat;
 	u_32_t flags;
 	u_short swap;
 	ipnat_t *np;
 	nat_t *natl;
 	int l = 0;
 	int changed;
 	natl = NULL;
 	changed = -1;
 	np = nai->nai_np;
 	flags = nat->nat_flags;
 	bcopy((char *)fin, (char *)&frnat, sizeof(*fin));
 	nat->nat_hm = NULL;
 	do {
 		changed = -1;
 		/* TRACE (l, src_search, dst_search, np) */
 		if ((src_search == 0) && (np->in_spnext == 0) &&
 		    (dst_search == 0) && (np->in_dpnext == 0)) {
 			if (l > 0)
 				return -1;
+		}
 		/*
 		 * Find a new source address
 		 */
 		if (ipf_nat_nextaddr(fin, &np->in_nsrc, &frnat.fin_saddr,
 				     &frnat.fin_saddr) == -1) {
 			return -1;
+		}
 		if ((np->in_nsrcaddr == 0) && (np->in_nsrcmsk == 0xffffffff)) {
 			src_search = 0;
 			if (np->in_stepnext == 0)
 				np->in_stepnext = 1;
 		} else if ((np->in_nsrcaddr == 0) && (np->in_nsrcmsk == 0)) {
 			src_search = 0;
 			if (np->in_stepnext == 0)
 				np->in_stepnext = 1;
 		} else if (np->in_nsrcmsk == 0xffffffff) {
 			src_search = 0;
 			if (np->in_stepnext == 0)
 				np->in_stepnext = 1;
 		} else if (np->in_nsrcmsk != 0xffffffff) {
 			if (np->in_stepnext == 0 && changed == -1) {
 				np->in_snip++;
 				np->in_stepnext++;
 				changed = 0;
+			}
+		}
 		if ((flags & IPN_TCPUDPICMP) != 0) {
 			if (np->in_spnext != 0)
 				frnat.fin_data[0] = np->in_spnext;
 			/*
 			 * Standard port translation.  Select next port.
 			 */
 			if ((flags & IPN_FIXEDSPORT) != 0) {
 				np->in_stepnext = 2;
 			} else if ((np->in_stepnext == 1) &&
 				   (changed == -1) && (natl != NULL)) {
 				np->in_spnext++;
 				np->in_stepnext++;
 				changed = 1;
 				if (np->in_spnext > np->in_spmax)
 					np->in_spnext = np->in_spmin;
+			}
 		} else {
 			np->in_stepnext = 2;
+		}
 		np->in_stepnext &= 0x3;
 		/*
 		 * Find a new destination address
 		 */
 		/* TRACE (fin, np, l, frnat) */
 		if (ipf_nat_nextaddr(fin, &np->in_ndst, &frnat.fin_daddr,
 				     &frnat.fin_daddr) == -1)
 			return -1;
 		if ((np->in_ndstaddr == 0) && (np->in_ndstmsk == 0xffffffff)) {
 			dst_search = 0;
 			if (np->in_stepnext == 2)
 				np->in_stepnext = 3;
 		} else if ((np->in_ndstaddr == 0) && (np->in_ndstmsk == 0)) {
 			dst_search = 0;
 			if (np->in_stepnext == 2)
 				np->in_stepnext = 3;
 		} else if (np->in_ndstmsk == 0xffffffff) {
 			dst_search = 0;
 			if (np->in_stepnext == 2)
 				np->in_stepnext = 3;
 		} else if (np->in_ndstmsk != 0xffffffff) {
 			if ((np->in_stepnext == 2) && (changed == -1) &&
 			    (natl != NULL)) {
 				changed = 2;
 				np->in_stepnext++;
 				np->in_dnip++;
+			}
+		}
 		if ((flags & IPN_TCPUDPICMP) != 0) {
 			if (np->in_dpnext != 0)
 				frnat.fin_data[1] = np->in_dpnext;
 			/*
 			 * Standard port translation.  Select next port.
 			 */
 			if ((flags & IPN_FIXEDDPORT) != 0) {
 				np->in_stepnext = 0;
 			} else if (np->in_stepnext == 3 && changed == -1) {
 				np->in_dpnext++;
 				np->in_stepnext++;
 				changed = 3;
 				if (np->in_dpnext > np->in_dpmax)
 					np->in_dpnext = np->in_dpmin;
+			}
 		} else {
 			if (np->in_stepnext == 3)
 				np->in_stepnext = 0;
+		}
 		/* TRACE (frnat) */
 		/*
 		 * Here we do a lookup of the connection as seen from
 		 * the outside.  If an IP# pair already exists, try
 		 * again.  So if you have A->B becomes C->B, you can
 		 * also have D->E become C->E but not D->B causing
 		 * another C->B.  Also take protocol and ports into
 		 * account when determining whether a pre-existing
 		 * NAT setup will cause an external conflict where
 		 * this is appropriate.
+		 *
 		 * fin_data[] is swapped around because we are doing a
 		 * lookup of the packet is if it were moving in the opposite
 		 * direction of the one we are working with now.
 		 */
 		if (flags & IPN_TCPUDP) {
 			swap = frnat.fin_data[0];
 			frnat.fin_data[0] = frnat.fin_data[1];
 			frnat.fin_data[1] = swap;
+		}
 		if (fin->fin_out == 1) {
 			natl = ipf_nat_inlookup(&frnat,
 						flags & ~(SI_WILDP|NAT_SEARCH),
 						(u_int)frnat.fin_p,
 						frnat.fin_dst, frnat.fin_src);
 		} else {
 			natl = ipf_nat_outlookup(&frnat,
 						 flags & ~(SI_WILDP|NAT_SEARCH),
 						 (u_int)frnat.fin_p,
 						 frnat.fin_dst, frnat.fin_src);
+		}
 		if (flags & IPN_TCPUDP) {
 			swap = frnat.fin_data[0];
 			frnat.fin_data[0] = frnat.fin_data[1];
 			frnat.fin_data[1] = swap;
+		}
 		/* TRACE natl, in_stepnext, l */
 		if ((natl != NULL) && (l > 8))	/* XXX 8 is arbitrary */
 			return -1;
 		np->in_stepnext &= 0x3;
 		l++;
 		changed = -1;
 	} while (natl != NULL);
 	nat->nat_osrcip = fin->fin_src;
 	nat->nat_odstip = fin->fin_dst;
 	nat->nat_nsrcip = frnat.fin_src;
 	nat->nat_ndstip = frnat.fin_dst;
 	if ((flags & IPN_TCPUDP) != 0) {
 		nat->nat_osport = htons(fin->fin_data[0]);
 		nat->nat_odport = htons(fin->fin_data[1]);
 		nat->nat_nsport = htons(frnat.fin_data[0]);
 		nat->nat_ndport = htons(frnat.fin_data[1]);
 	} else if ((flags & IPN_ICMPQUERY) != 0) {
 		nat->nat_oicmpid = fin->fin_data[1];
 		nat->nat_nicmpid = frnat.fin_data[1];
+	}
 	return 0;
+}
 /* ------------------------------------------------------------------------ */
 /* Function:    nat_newdivert                                               */
 /* Returns:     int - -1 == error, 0 == success                             */
 /* Parameters:  fin(I) - pointer to packet information                      */
 /*              nat(I) - pointer to NAT entry                               */
 /*              ni(I)  - pointer to structure with misc. information needed */
 /*                       to create new NAT entry.                           */
 /* Write Lock:  ipf_nat                                                     */
 /*                                                                          */
 /* Create a new NAT  divert session as defined by the NAT rule.  This is    */
 /* somewhat different to other NAT session creation routines because we     */
 /* do not iterate through either port numbers or IP addresses, searching    */
 /* for a unique mapping, however, a complimentary duplicate check is made.  */
 /* ------------------------------------------------------------------------ */
 static int
 ipf_nat_newdivert(fr_info_t *fin, nat_t *nat, natinfo_t *nai)
+{
 	ipf_main_softc_t *softc = fin->fin_main_soft;
 	ipf_nat_softc_t *softn = softc->ipf_nat_soft;
 	fr_info_t frnat;
 	ipnat_t *np;
 	nat_t *natl;
 	int p;
 	np = nai->nai_np;
 	bcopy((char *)fin, (char *)&frnat, sizeof(*fin));
 	nat->nat_pr[0] = 0;
 	nat->nat_osrcaddr = fin->fin_saddr;
 	nat->nat_odstaddr = fin->fin_daddr;
 	frnat.fin_saddr = htonl(np->in_snip);
 	frnat.fin_daddr = htonl(np->in_dnip);
 	if ((nat->nat_flags & IPN_TCPUDP) != 0) {
 		nat->nat_osport = htons(fin->fin_data[0]);
 		nat->nat_odport = htons(fin->fin_data[1]);
 	} else if ((nat->nat_flags & IPN_ICMPQUERY) != 0) {
 		nat->nat_oicmpid = fin->fin_data[1];
+	}
 	if (np->in_redir & NAT_DIVERTUDP) {
 		frnat.fin_data[0] = np->in_spnext;
 		frnat.fin_data[1] = np->in_dpnext;
 		frnat.fin_flx |= FI_TCPUDP;
 		p = IPPROTO_UDP;
 	} else {
 		frnat.fin_flx &= ~FI_TCPUDP;
 		p = IPPROTO_IPIP;
+	}