From 698283eab5699512722318a35812df566d0a8b83 Mon Sep 17 00:00:00 2001
From: Hartmut Penner <hapenner@cisco.com>
Date: Tue, 8 Sep 2026 01:37:17 +0200
Subject: [PATCH 1/7] Add makefile and other changes to build AIX ipfilter
 kernel extensions

---
 Makefile                  | 34 +++++++++-------------
 kernext/Makefile          | 61 ++++++++++++++++++++-------------------
 kernext/ip_lookup.c       |  2 +-
 kernext/ip_pool.c         |  2 +-
 kernext/log.c             | 22 ++++++++++++++
 kernext/radix.c           | 12 ++++----
 usr/lib/Makefile          | 14 +++++++--
 usr/lib/methods/Makefile  | 23 +++++++--------
 usr/lib/methods/cfg_ipf.c |  2 +-
 9 files changed, 97 insertions(+), 75 deletions(-)
 create mode 100644 kernext/log.c

diff --git a/Makefile b/Makefile
index a81520e..aaa60bc 100644
--- a/Makefile
+++ b/Makefile
@@ -1,21 +1,15 @@
-# @(#)51  1.1  src/ipfl/Makefile, ipflt, 53ipfl53H, 0619A_53ipfl53H 5/8/06 07:32:08
-# IBM_PROLOG_BEGIN_TAG 
-# This is an automatically generated prolog. 
-#  
-# 53ipfl53H src/ipfl/Makefile 1.1 
-#  
-# Licensed Materials - Property of IBM 
-#  
-# Restricted Materials of IBM 
-#  
-# (C) COPYRIGHT International Business Machines Corp. 2006 
-# All Rights Reserved 
-#  
-# US Government Users Restricted Rights - Use, duplication or 
-# disclosure restricted by GSA ADP Schedule Contract with IBM Corp. 
-#  
-# IBM_PROLOG_END_TAG 
-SUBDIRS = kernext usr
-EXPLIB_SUBDIRS = usr
+SUBDIRS = usr/lib usr/sbin usr/lib/methods kernext
 
-.include <$(RULES_MK)>
+all: kernext/sys/socketvar.h
+	touch kernext/sys/libsysp.h
+	for i in $(SUBDIRS); do \
+		(cd $$i && $(MAKE) $(MAKEFLAGS)); \
+	done
+clean:
+	rm -f kernext/sys/socketvar.h
+	for i in $(SUBDIRS); do \
+		(cd $$i && $(MAKE) $(MAKEFLAGS) clean); \
+	done
+kernext/sys/socketvar.h: /usr/include/sys/socketvar.h
+	mkdir -p kernext/sys
+	sed "s#free_sock_hash_table\[\]#*free_sock_hash_table#g" $^ > $@
diff --git a/kernext/Makefile b/kernext/Makefile
index 70ef9a9..ec54cdf 100644
--- a/kernext/Makefile
+++ b/kernext/Makefile
@@ -15,47 +15,48 @@
 # disclosure restricted by GSA ADP Schedule Contract with IBM Corp. 
 #  
 # IBM_PROLOG_END_TAG 
-.include <${MAKETOP}bos/kernext/Kernext.mk>
 
-VPATH = .:${MAKETOP}/bos/kernel/exp:${MAKETOP}/bos/kernext/inet
+MAKETOP=../..
+INCFLAGS = -I${MAKETOP}/kernext -I${MAKETOP}/kernext/netinet -include strings.h
+CC = gcc
 
-DUALMODE_KEXT   = true
+all:   ipf
 
-KERNEL_EXT = ipf
-KERNEL_EXT32 = ipf32
-KERNEL_EXT64 = ipf64
-
-IDIR            = /usr/lib/drivers/
-ILIST           = ${KERNEL_EXT}
-
-LIBS            = ${KERNEXT_LIBS}
-
-ipf32_ENTRYPOINT = ipfconfig
-ipf64_ENTRYPOINT = ipfconfig
+clean:
+	rm -f *.o ipf
 
 KERNEXT_IMPORTS += sockets.exp kernex.exp netinet.exp statcmd.exp 
 
-INCFLAGS = -I./netinet
-CFLAGS = -DAIX -D_AIX -D_AIX51 -DIPFILTER_LKM -DIPFILTER_LOG \
-	-DIPFILTER_LOOKUP -DIPFILTER_SCAN -DKERNEL -D_KERNEL -DINET
+INCFLAGS = -I. -I./netinet -include strings.h
+CFLAGS = -O2 -nostdlib -DAIX -D_AIX -D_AIX51 -DIPFILTER_LKM -DIPFILTER_LOG \
+	-DIPFILTER_LOOKUP -DIPFILTER_SCAN -DKERNEL -D_KERNEL -DINET ${INCFLAGS}
 FIXRADIX = -Dradix_node=ipf_radix_node -Dradix_node_head=ipf_radix_node_head \
 	-Drn_inithead=ipf_rn_inithead -Drn_walktree=ipf_rn_walktree
 
-fil.o_CFLAGS = ${CFLAGS} -DIPF_DEFAULT_PASS=FR_PASS
-ip_state.o_CFLAGS = ${CFLAGS} -DIPSTATE_SIZE=127
-ip_pool.o_CFLAGS = ${CFLAGS} ${FIXRADIX}
-ip_lookup.o_CFLAGS = ${CFLAGS} ${FIXRADIX}
+fil.o:  fil.c
+	${CC} -maix64 ${CFLAGS} -DIPF_DEFAULT_PASS=FR_PASS -c $< -o $@
+
+ip_state.o: ip_state.c
+	${CC} -maix64 ${CFLAGS} -DIPSTATE_SIZE=241271 -c $< -o $@
+
+ip_pool.o: ip_pool.c
+	${CC} ${CFLAGS} ${FIXRADIX} -maix64 -c $< -o $@
 
-fil.64o_CFLAGS = ${CFLAGS} -DIPF_DEFAULT_PASS=FR_PASS
-ip_state.64o_CFLAGS = ${CFLAGS} -DIPSTATE_SIZE=127
-ip_pool.64o_CFLAGS = ${CFLAGS} ${FIXRADIX}
-ip_lookup.64o_CFLAGS = ${CFLAGS} ${FIXRADIX}
+ip_lookup.o: ip_lookup.c
+	${CC} ${CFLAGS} ${FIXRADIX} -maix64 -c $< -o $@
+
+radix.o: radix.c
+	${CC} ${CFLAGS} ${FIXRADIX} -maix64 -c $< -o $@
+
+ip_fil_aix.o: ip_fil_aix.c
+	${CC} ${CFLAGS} -maix64 -c $< -o $@
+
+%.o:  %.c
+	${CC} ${CFLAGS} -maix64 -c $< -o $@
 
 OBJFILES = ip_fil_aix.o fil.o md5.o ip_nat.o ip_frag.o ip_state.o \
 	ip_proxy.o ip_auth.o ip_log.o ip_pool.o ip_htable.o \
-	ip_lookup.o ip_sync.o ip_scan.o ip_rules.o radix.o
-
-ipf32_OFILES = ${OBJFILES}
-ipf64_OFILES = ${OBJFILES:.o=.64o}
+	ip_lookup.o ip_sync.o ip_scan.o ip_rules.o radix.o log.o
 
-.include <${RULES_MK}>
+ipf: ${OBJFILES}
+	ld -b64 -o $@ $^ -bI:/usr/lib/kernex.exp -bI:/usr/lib/netinet.exp -bI:/usr/lib/sockets.exp -bI:/usr/lib/statcmd.exp -e ipfconfig -l csys -l sys
diff --git a/kernext/ip_lookup.c b/kernext/ip_lookup.c
index 978d1b6..f702f84 100644
--- a/kernext/ip_lookup.c
+++ b/kernext/ip_lookup.c
@@ -57,6 +57,7 @@ struct file;
 # include "radix_ipf_local.h"
 # define _RADIX_H_
 #endif
+#include <netinet/in.h>
 #include <net/if.h>
 #if defined(__FreeBSD__)
 #  include <sys/cdefs.h>
@@ -68,7 +69,6 @@ struct file;
 #  include <sys/mbuf.h>
 # endif
 #endif
-#include <netinet/in.h>
 
 #include "netinet/ip_compat.h"
 #include "netinet/ip_fil.h"
diff --git a/kernext/ip_pool.c b/kernext/ip_pool.c
index 815064b..037e1b7 100644
--- a/kernext/ip_pool.c
+++ b/kernext/ip_pool.c
@@ -78,8 +78,8 @@ struct file;
 # include "radix_ipf_local.h"
 # define _RADIX_H_
 #endif
-#include <net/if.h>
 #include <netinet/in.h>
+#include <net/if.h>
 #if defined(_KERNEL) && defined(AIX)
 # include <sys/mbuf.h>
 #endif
diff --git a/kernext/log.c b/kernext/log.c
new file mode 100644
index 0000000..fcd2bdf
--- /dev/null
+++ b/kernext/log.c
@@ -0,0 +1,22 @@
+#include <syslog.h>
+#include <net/proto_uipc.h>
+#include <stdio.h>
+#include <stdarg.h>
+
+int puts(const char *str)
+{
+  bsdlog(LOG_DEBUG | LOG_KERN, "%.1000s\n",str);
+}
+
+int printf(const char *fmt, ...)
+{
+  int rc;
+  char buf[1024];
+  va_list arg; 
+  va_start(arg, fmt); 
+	
+  rc = vsnprintf_np(buf, 1024, fmt, arg);
+  rc = puts(buf);
+  va_end(arg);
+  return rc;
+}
diff --git a/kernext/radix.c b/kernext/radix.c
index 699edfb..844ad02 100644
--- a/kernext/radix.c
+++ b/kernext/radix.c
@@ -118,9 +118,9 @@ static char *rn_zeros = NULL, *rn_ones = NULL;
 #undef Bcmp
 #define Bcmp(a, b, l) (l == 0 ? 0 : bcmp((caddr_t)(a), (caddr_t)(b), (u_long)l))
 
-static int rn_satisfies_leaf __P((char *, struct radix_node *, int));
-static int rn_lexobetter __P((void *, void *));
-static struct radix_mask *rn_new_radix_mask __P((struct radix_node *,
+int rn_satisfies_leaf __P((char *, struct radix_node *, int));
+int rn_lexobetter __P((void *, void *));
+struct radix_mask *rn_new_radix_mask __P((struct radix_node *,
     struct radix_mask *));
 static int rn_freenode __P((struct radix_node *, void *));
 #if defined(AIX) && !defined(_KERNEL)
@@ -247,7 +247,7 @@ rn_lookup(v_arg, m_arg, head)
 	return x;
 }
 
-static int
+int
 rn_satisfies_leaf(trial, leaf, skip)
 	char *trial;
 	struct radix_node *leaf;
@@ -561,7 +561,7 @@ rn_addmask(n_arg, search, skip)
 	return (x);
 }
 
-static int	/* XXX: arbitrary ordering for non-contiguous masks */
+int	/* XXX: arbitrary ordering for non-contiguous masks */
 rn_lexobetter(m_arg, n_arg)
 	void *m_arg, *n_arg;
 {
@@ -576,7 +576,7 @@ rn_lexobetter(m_arg, n_arg)
 	return 0;
 }
 
-static struct radix_mask *
+struct radix_mask *
 rn_new_radix_mask(tt, next)
 	struct radix_node *tt;
 	struct radix_mask *next;
diff --git a/usr/lib/Makefile b/usr/lib/Makefile
index 93018dd..3f19849 100644
--- a/usr/lib/Makefile
+++ b/usr/lib/Makefile
@@ -21,8 +21,11 @@ LIBRARIES = libipf.a
 EXPLIB_TARGETS = export_libipf.a
 EXPDIR = /usr/lib/ipfilter/
 
-INCFLAGS = -I${MAKETOP}/ipfl/kernext -I${MAKETOP}/ipfl/kernext/netinet
-CFLAGS = -D_AIX -D_AIX51 -DAIX -qlanglvl=ansi
+MAKETOP=../..
+INCFLAGS = -I${MAKETOP}/kernext -I${MAKETOP}/kernext/netinet -include strings.h
+CC = gcc -maix64
+AR = /usr/bin/ar
+CFLAGS = -O2 -D_AIX -D_AIX51 -DAIX -D_NOGETDELIM ${INCFLAGS}
 
 OFILES = addicmp.o addipopt.o bcopywrap.o \
      binprint.o buildopts.o checkrev.o count6bits.o count4bits.o \
@@ -45,4 +48,9 @@ OFILES = addicmp.o addipopt.o bcopywrap.o \
      to_interface.o var.o verbose.o v6ionames.o v6optvalue.o
 OFILES64 = ${OFILES:.o=.64o}
 
-.include <${RULES_MK}>
+all:	$(LIBRARIES)
+clean:
+	rm -f *.o
+
+$(LIBRARIES):	$(OFILES)
+	$(AR) -Xany $(ARFLAGS) $@ $(OFILES)
diff --git a/usr/lib/methods/Makefile b/usr/lib/methods/Makefile
index b7309c7..b76519c 100644
--- a/usr/lib/methods/Makefile
+++ b/usr/lib/methods/Makefile
@@ -15,19 +15,16 @@
 # disclosure restricted by GSA ADP Schedule Contract with IBM Corp. 
 #  
 # IBM_PROLOG_END_TAG 
-PROGRAMS = cfg_ipf cfg_ipf64
 
-cfg_ipf64_BUILD64 = true
-VPATH = .
-
-cfg_ipf_OFILES = cfg_ipf.o
-cfg_ipf64_OFILES = cfg_ipf.64o
-
-ILIST = ${PROGRAMS}
-IDIR = /usr/lib/methods/
-
-INCFLAGS = -I${MAKETOP}/ipfl/kernext -I${MAKETOP}/ipfl/kernext/netinet
-CFLAGS = -D_ALL_SOURCE -D_KERNEL -D_AIX -D_AIX51 -DAIX
+MAKETOP=../../..
+CC = gcc
+INCFLAGS = -I${MAKETOP}/kernext -I${MAKETOP}/kernext/netinet
+CFLAGS = -D_ALL_SOURCE -D_KERNEL -D_AIX -D_AIX51 -DAIX -O2 -maix64 ${INCFLAGS}
 LIBS = -lodm -lcfg -lrts
 
-.include<${RULES_MK}>
+cfg_ipf: cfg_ipf.c
+	${CC} ${CFLAGS} -o $@ $^ ${LIBS}
+
+all: cfg_ipf
+clean:
+	rm -f *.o cfg_ipf
diff --git a/usr/lib/methods/cfg_ipf.c b/usr/lib/methods/cfg_ipf.c
index 627c3a9..d5809ee 100644
--- a/usr/lib/methods/cfg_ipf.c
+++ b/usr/lib/methods/cfg_ipf.c
@@ -34,7 +34,6 @@ static char sccsid[] = "@(#)99  1.3  src/ipfl/usr/lib/methods/cfg_ipf.c, ipflt,
 #include <sys/uio.h>
 #include <sys/time.h>
 #include <sys/socket.h>
-#include <net/if.h>
 #define _TCP_DEBUG_H_
 #include <netinet/in.h>
 #include <netinet/in_systm.h>
@@ -42,6 +41,7 @@ static char sccsid[] = "@(#)99  1.3  src/ipfl/usr/lib/methods/cfg_ipf.c, ipflt,
 #include <netinet/ip_icmp.h>
 #include <netinet/tcp.h>
 #include <netinet/udp.h>
+#include <net/if.h>
 
 #include <arpa/inet.h>
 

From 032bd6ee5baf8b37dae6d728f0ad104fe220e1ae Mon Sep 17 00:00:00 2001
From: Hartmut Penner <hapenner@cisco.com>
Date: Tue, 8 Sep 2026 02:00:58 +0200
Subject: [PATCH 2/7] Use internal ipfilter tools and kernel extension if no
 ipfilter provided

---
 kernext/Makefile           |  2 +-
 kernext/ip_state.c         |  2 +-
 kernext/netinet/ip_state.h |  3 ++
 usr/lib/methods/Makefile   |  2 +-
 usr/lib/methods/cfg_ipf.c  | 56 ++++++++++++++++++++------------------
 5 files changed, 36 insertions(+), 29 deletions(-)

diff --git a/kernext/Makefile b/kernext/Makefile
index ec54cdf..7b1ae44 100644
--- a/kernext/Makefile
+++ b/kernext/Makefile
@@ -37,7 +37,7 @@ fil.o:  fil.c
 	${CC} -maix64 ${CFLAGS} -DIPF_DEFAULT_PASS=FR_PASS -c $< -o $@
 
 ip_state.o: ip_state.c
-	${CC} -maix64 ${CFLAGS} -DIPSTATE_SIZE=241271 -c $< -o $@
+	${CC} -maix64 ${CFLAGS} -DIPSTATE_SIZE=249989 -DIPSTATE_MAX=1000000 -DIPSTATE_MAXBUCKET=256 -c $< -o $@
 
 ip_pool.o: ip_pool.c
 	${CC} ${CFLAGS} ${FIXRADIX} -maix64 -c $< -o $@
diff --git a/kernext/ip_state.c b/kernext/ip_state.c
index df86f6c..951a224 100644
--- a/kernext/ip_state.c
+++ b/kernext/ip_state.c
@@ -174,7 +174,7 @@ int	fr_statemax = IPSTATE_MAX,
 	fr_statesize = IPSTATE_SIZE;
 int	fr_state_doflush = 0,
 	fr_state_lock = 0,
-	fr_state_maxbucket = 0,
+	fr_state_maxbucket = IPSTATE_MAXBUCKET,
 	fr_state_maxbucket_reset = 1,
 	fr_state_init = 0;
 ipftq_t	ips_tqtqb[IPF_TCP_NSTATES],
diff --git a/kernext/netinet/ip_state.h b/kernext/netinet/ip_state.h
index 72d669b..b7f4c83 100644
--- a/kernext/netinet/ip_state.h
+++ b/kernext/netinet/ip_state.h
@@ -40,6 +40,9 @@ struct ipscan;
 #ifndef	IPSTATE_MAX
 # define	IPSTATE_MAX	4013	/* Maximum number of states held */
 #endif
+#ifndef IPSTATE_MAXBUCKET
+# define        IPSTATE_MAXBUCKET 0
+#endif
 
 #define	PAIRS(s1,d1,s2,d2)	((((s1) == (s2)) && ((d1) == (d2))) ||\
 				 (((s1) == (d2)) && ((d1) == (s2))))
diff --git a/usr/lib/methods/Makefile b/usr/lib/methods/Makefile
index b76519c..e107613 100644
--- a/usr/lib/methods/Makefile
+++ b/usr/lib/methods/Makefile
@@ -19,7 +19,7 @@
 MAKETOP=../../..
 CC = gcc
 INCFLAGS = -I${MAKETOP}/kernext -I${MAKETOP}/kernext/netinet
-CFLAGS = -D_ALL_SOURCE -D_KERNEL -D_AIX -D_AIX51 -DAIX -O2 -maix64 ${INCFLAGS}
+CFLAGS = -D_ALL_SOURCE -D_AIX -D_AIX51 -DAIX -O2 -maix64 ${INCFLAGS}
 LIBS = -lodm -lcfg -lrts
 
 cfg_ipf: cfg_ipf.c
diff --git a/usr/lib/methods/cfg_ipf.c b/usr/lib/methods/cfg_ipf.c
index d5809ee..3fe40c7 100644
--- a/usr/lib/methods/cfg_ipf.c
+++ b/usr/lib/methods/cfg_ipf.c
@@ -53,6 +53,9 @@ static char sccsid[] = "@(#)99  1.3  src/ipfl/usr/lib/methods/cfg_ipf.c, ipflt,
 #include <stdio.h>
 #include <string.h>
 #include <unistd.h>
+#include <strings.h>
+#include <odmi.h>
+#include <cf.h>
 
 #include "netinet/ip_compat.h"
 #include "netinet/ip_fil.h"
@@ -177,7 +180,7 @@ int checkarg(int argc, char *arg)
 
 	if (!strcmp(arg, "-l") && (argc <= 3))
 		return 1;
-	
+
 	if (!strcmp(arg, "-u") && (argc == 2))
 		return 2;
 
@@ -194,35 +197,36 @@ loadipf(int major, int minor, dev_t devno, char *path)
 	struct cfg_dd ipfcfg;
 	struct cfg_load cfg;
 	char *buffer[1024];
-	char *ipfpath;
 	int i;
 	dev_t lastdev = devno;
 
-	bzero(buffer, sizeof(buffer));
+	bzero(&cfg, sizeof(cfg));
 	if (path != NULL)
-		ipfpath = path;
+		cfg.path = path;
 	else
-		ipfpath = "/usr/lib/drivers/ipf";
-
-#if 0
-	bzero((char *)&cfg, sizeof(cfg));
-	cfg.path = ipfpath;
-	cfg.libpath = "/usr/lib/drivers/";
-	sysconfig(SYS_SINGLELOAD, &cfg, sizeof(cfg));
-	ipfcfg.kmid = cfg.kmid;
-#else
-	ipfcfg.kmid = (mid_t)loadext(ipfpath, TRUE, TRUE);
-#endif
-	if (ipfcfg.kmid == (mid_t)NULL)
-	{
-		perror("loadext");
-		buffer[0] = "execerror";
-		buffer[1] = "ipf";
-		loadquery(1, &buffer[2], sizeof(buffer) - sizeof(*buffer)*2);
-		execvp("/usr/sbin/execerror", buffer);
+		cfg.path = "/usr/lib/drivers/ipf";
+	cfg.kmid = 0;
+	if (sysconfig(SYS_QUERYLOAD, &cfg, sizeof(cfg)) == -1) {
+		perror("sysconfig(SYS_QUERYLOAD)");
 		exit(errno);
 	}
-
+	/* Loac only if not already loaded */
+	if (cfg.kmid == 0) {
+		ipfcfg.kmid = loadext(cfg.path, TRUE, TRUE);
+		if (ipfcfg.kmid == 0) {
+			perror("loadext");
+			buffer[0] = "execerror";
+			buffer[1] = "ipf";
+			loadquery(1, &buffer[2], sizeof(buffer) - sizeof(*buffer)*2);
+			execvp("/usr/sbin/execerror", buffer);
+			exit(errno);
+		}
+		printf("New Kernel module ID: %u\n", ipfcfg.kmid);
+	} else {
+		ipfcfg.kmid = cfg.kmid;
+		printf("Existing Kernel module ID: %u\n", cfg.kmid);
+	}
+	/* Initialize in any case */
 	ipfcfg.devno = devno;
 	ipfcfg.cmd = CFG_INIT;
 	ipfcfg.ddsptr = (caddr_t)NULL;
@@ -257,7 +261,7 @@ unloadipf(int major, int minor, dev_t devno)
 		perror("sysconfig(SYS_QUERYLOAD)");
 		exit(errno);
 	}
-
+	printf("Kernel module ID: %u\n", cfg.kmid);
 	ipfcfg.kmid = cfg.kmid;
 	ipfcfg.devno = devno;
 	ipfcfg.cmd = CFG_TERM;
@@ -270,7 +274,7 @@ unloadipf(int major, int minor, dev_t devno)
 		unlink(ipf_devfiles[i]);
 	}
 
-	if (loadext("ipf", FALSE, FALSE) == NULL) {
+	if (loadext("ipf", FALSE, FALSE) == 0) {
 		perror("loadext");
 		exit(errno);
 	}
@@ -292,7 +296,7 @@ queryipf(int major, int minor, dev_t devno)
 		exit(errno);
 	}
 
-	printf("Kernel module ID: %d\n", cfg.kmid);
+	printf("Kernel module ID: %u\n", cfg.kmid);
 
 	ipfcfg.kmid = cfg.kmid;
 	ipfcfg.devno = devno;

From 87039017e15d94cf9d5c2e21d6d18899a2e5fa90 Mon Sep 17 00:00:00 2001
From: Hartmut Penner <hapenner@cisco.com>
Date: Tue, 8 Sep 2026 02:56:02 +0200
Subject: [PATCH 3/7] Warn if pool entry busy or already exist, print pool id
 and IP address

---
 usr/lib/load_pool.c     | 21 ++++++++--
 usr/lib/load_poolnode.c | 12 +++++-
 usr/lib/remove_pool.c   |  9 ++++-
 usr/sbin/Makefile       | 86 ++++++++++++++++++++++++++++-------------
 4 files changed, 94 insertions(+), 34 deletions(-)

diff --git a/usr/lib/load_pool.c b/usr/lib/load_pool.c
index 7a4b0f3..d607745 100644
--- a/usr/lib/load_pool.c
+++ b/usr/lib/load_pool.c
@@ -59,8 +59,13 @@ ioctlfunc_t iocfunc;
 	if ((opts & OPT_REMOVE) == 0) {
 		if ((*iocfunc)(poolfd, SIOCLOOKUPADDTABLE, &op))
 			if ((opts & OPT_DONOTHING) == 0) {
-				perror("load_pool:SIOCLOOKUPADDTABLE");
-				return -1;
+				if (errno == EEXIST) {
+					fprintf(stderr, "Warning load_pool : Pool %s already exists\n", op.iplo_name);
+					return errno;
+				} else {
+					perror("load_pool:SIOCLOOKUPADDTABLE");
+					return -1;
+				}
 			}
 	}
 
@@ -79,8 +84,16 @@ ioctlfunc_t iocfunc;
 	if ((opts & OPT_REMOVE) != 0) {
 		if ((*iocfunc)(poolfd, SIOCLOOKUPDELTABLE, &op))
 			if ((opts & OPT_DONOTHING) == 0) {
-				perror("load_pool:SIOCLOOKUPDELTABLE");
-				return -1;
+				if (errno == EBUSY) {
+					fprintf(stderr,"Warning load_pool : Pool %s still used\n", op.iplo_name);
+					return errno;
+				} else if (errno == ESRCH) {
+					fprintf(stderr,"Warning load_pool : Pool %s does not exist\n", op.iplo_name);
+					return errno;
+				} else {
+					perror("load_pool:SIOCLOOKUPDELTABLE");
+					return -1;
+				}
 			}
 	}
 	return 0;
diff --git a/usr/lib/load_poolnode.c b/usr/lib/load_poolnode.c
index 2a3b84e..105f66e 100644
--- a/usr/lib/load_poolnode.c
+++ b/usr/lib/load_poolnode.c
@@ -69,8 +69,16 @@ ioctlfunc_t iocfunc;
 
 	if (err != 0) {
 		if ((opts & OPT_DONOTHING) == 0) {
-			perror("load_pool:SIOCLOOKUP*NODE");
-			return -1;
+			if (errno == EEXIST) {
+				fprintf(stderr, "Warning load_poolnode : Pool %s already contains %s\n", op.iplo_name, inet_ntoa(pn.ipn_addr.adf_addr.in4));
+				return errno;
+			} else if (errno == ENOENT) {
+				fprintf(stderr, "Warning load_poolnode : Pool %s does not contain %s\n", op.iplo_name, inet_ntoa(pn.ipn_addr.adf_addr.in4));
+				return errno;
+			} else	{
+				perror("load_pool:SIOCLOOKUP*NODE");
+				return -1;
+			}
 		}
 	}
 
diff --git a/usr/lib/remove_pool.c b/usr/lib/remove_pool.c
index 9d6c5eb..f8fe58f 100644
--- a/usr/lib/remove_pool.c
+++ b/usr/lib/remove_pool.c
@@ -57,8 +57,13 @@ ioctlfunc_t iocfunc;
 
 	if ((*iocfunc)(poolfd, SIOCLOOKUPDELTABLE, &op))
 		if ((opts & OPT_DONOTHING) == 0) {
-			perror("remove_pool:SIOCLOOKUPDELTABLE");
-			return -1;
+			if (errno == EBUSY) {
+				printf("Warning remove_pool : Pool %s still used\n", op.iplo_name);
+				return errno;
+			} else {
+				perror("remove_pool:SIOCLOOKUPDELTABLE");
+				return -1;
+			}
 		}
 
 	return 0;
diff --git a/usr/sbin/Makefile b/usr/sbin/Makefile
index 570546c..aabff6d 100644
--- a/usr/sbin/Makefile
+++ b/usr/sbin/Makefile
@@ -23,28 +23,57 @@ ILIST = ${PROGRAMS} IPFL.README
 IPFL.README_IDIR = /usr/lpp/ipfl/
 IDIR = /usr/sbin/
 
-INCFLAGS = -I${MAKETOP}/ipfl/kernext -I${MAKETOP}/ipfl/kernext/netinet
-LIBFLAGS = -L${EXPORTBASE}/usr/lib/ipfilter
-VPATH = .:${MAKETOP}/ipfl/usr/lib
+MAKETOP = ../..
+INCFLAGS = -I${MAKETOP}/kernext -I${MAKETOP}/kernext/netinet -include strings.h
+LIBFLAGS = -L${MAKETOP}/usr/lib
+VPATH = ${MAKETOP}/usr/lib
 
 LIBS = -lipf
-CFLAGS = -D_AIX -D_AIX51 -DAIX
+CC = gcc -maix64 -O2
+CFLAGS = -D_AIX -D_AIX51 -DAIX -D_NOGETDELIM $(INCFLAGS)
+LDFLAGS = $(LIBFLAGS)
 
 ipf_OFILES = ipf.o ipfcomp.o ipf_y.o ipf_l.o
 ipfs_OFILES = ipfs.o
 ipfstat_OFILES = ipfstat.o
 ipmon_OFILES = ipmon.o ipmon_y.o ipmon_l.o
 ipnat_OFILES = ipnat.o ipnat_y.o ipnat_l.o
-ippool_OFILES = ippool_y.o ippool_l.o kmem.o ippool.o
+ippool_OFILES = ippool_y.o ippool_l.o ${MAKETOP}/usr/lib/kmem.o ippool.o
 ipscan_OFILES = ipscan_y.o ipscan_l.o
 ipsyncm_OFILES = ipsyncm.o
 ipsyncs_OFILES = ipsyncs.o
 
-.include <${RULES_MK}>
+RM  = /usr/bin/rm
+SED = /usr/bin/sed
+
+#.include <${RULES_MK}>
+
+all:	$(PROGRAMS)
+
+clean:
+	$(RM) -f $(PROGRAMS) *.o *_[ly].c
+
+ipf:	$(ipf_OFILES)
+	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(ipf_OFILES) $(LIBS)
+
+ipmon:	$(ipmon_OFILES)
+	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(ipmon_OFILES) $(LIBS)
+
+ipnat:	$(ipnat_OFILES)
+	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(ipnat_OFILES) $(LIBS)
+
+ippool:	$(ippool_OFILES) ../lib/libipf.a
+	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(ippool_OFILES) $(LIBS)
+
+ipscan:	$(ipscan_OFILES)
+	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(ipscan_OFILES) $(LIBS)
+
+ipfstat:	$(ipfstat_OFILES)
+	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(ipfstat_OFILES) $(LIBS)
 
 ipf_y.h: ipf_y.c
-ipf_y.c: ipf_l.h
-	${YACC} -d $<
+ipf_y.c: ipf_y.y ipf_l.h
+	${YACC} ${YFLAGS} -d $<
 	${SED} -e 's/yy/ipf_yy/g' -e 's/y.tab.c/ipf_y.c/' \
 		y.tab.c > $@
 	${SED} -e 's/yy/ipf_yy/g' -e 's/y.tab.h/ipf_y.h/' \
@@ -52,25 +81,25 @@ ipf_y.c: ipf_l.h
 	${RM} -f y.tab.c y.tab.h
 ipf_l.c: lexer.c ipf_y.h
 	${SED} -e 's/yy/ipf_yy/g' -e 's/y.tab.h/ipf_y.h/' \
-		-e 's/lexer.h/ipf_l.h/' ${lexer.c:P} > $@
+		-e 's/lexer.h/ipf_l.h/' lexer.c > $@
 ipf_l.h: lexer.h
-	${SED} -e 's/yy/ipf_yy/g' ${lexer.h:P} > $@
+	${SED} -e 's/yy/ipf_yy/g' lexer.h > $@
 
 ipmon_y.h: ipmon_y.c
-ipmon_y.c: ipmon_l.h
-	${YACC} -d $<
+ipmon_y.c: ipmon_y.y ipmon_l.h
+	${YACC} ${YFLAGS} -d $<
 	${SED} -e 's/yy/ipmon_yy/g' y.tab.c > $@
 	${SED} -e 's/yy/ipmon_yy/g' y.tab.h > ipmon_y.h
 	${RM} -f y.tab.c y.tab.h
 ipmon_l.c: lexer.c ipmon_y.h
 	${SED} -e 's/yy/ipmon_yy/g' -e 's/y.tab.h/ipmon_y.h/' \
-		-e 's/lexer.h/ipmon_l.h/' ${lexer.c:P} > $@
+		-e 's/lexer.h/ipmon_l.h/' lexer.c > $@
 ipmon_l.h: lexer.h
-	${SED} -e 's/yy/ipmon_yy/g' ${lexer.h:P} > $@
+	${SED} -e 's/yy/ipmon_yy/g' lexer.h > $@
 
 ipnat_y.h: ipnat_y.c
-ipnat_y.c: ipnat_l.h
-	${YACC} -d $<
+ipnat_y.c: ipnat_y.y ipnat_l.h
+	${YACC} ${YFLAGS} -d $<
 	${SED} -e 's/yy/ipnat_yy/g' -e 's/y.tab.c/ipnat_y.c/' \
 		y.tab.c > $@
 	${SED} -e 's/yy/ipnat_yy/g' -e 's/y.tab.h/ipnat_y.h/' \
@@ -78,30 +107,35 @@ ipnat_y.c: ipnat_l.h
 	${RM} -f y.tab.c y.tab.h
 ipnat_l.c: lexer.c ipnat_y.h
 	${SED} -e 's/yy/ipnat_yy/g' -e 's/y.tab.h/ipnat_y.h/' \
-		-e 's/lexer.h/ipnat_l.h/' ${lexer.c:P} > $@
+		-e 's/lexer.h/ipnat_l.h/' lexer.c > $@
 ipnat_l.h: lexer.h
-	${SED} -e 's/yy/ipnat_yy/g' ${lexer.h:P} > $@
+	${SED} -e 's/yy/ipnat_yy/g' lexer.h > $@
 
 ippool_y.h: ippool_y.c
-ippool_y.c: ippool_l.h
-	${YACC} -d $<
+ippool_y.c: ippool_y.y ippool_l.h
+	${YACC} ${YFLAGS} -d $<
 	${SED} -e 's/yy/ippool_yy/g' y.tab.c > $@
 	${SED} -e 's/yy/ippool_yy/g' y.tab.h > ippool_y.h
 	${RM} -f y.tab.c y.tab.h
 ippool_l.c: lexer.c ippool_y.h
 	${SED} -e 's/yy/ippool_yy/g' -e 's/y.tab.h/ippool_y.h/' \
-		-e 's/lexer.h/ippool_l.h/' ${lexer.c:P} > $@
+		-e 's/lexer.h/ippool_l.h/' lexer.c > $@
 ippool_l.h: lexer.h
-	${SED} -e 's/yy/ippool_yy/g' ${lexer.h:P} > $@
+	${SED} -e 's/yy/ippool_yy/g' lexer.h > $@
 
 ipscan_y.h: ipscan_y.c
-ipscan_y.c: ipscan_l.h
-	${YACC} -d $<
+ipscan_y.c: ipscan_y.y ipscan_l.h
+	${YACC} ${YFLAGS} -d $<
 	${SED} -e 's/yy/ipscan_yy/g' y.tab.c > $@
 	${SED} -e 's/yy/ipscan_yy/g' y.tab.h > ipscan_y.h
 	${RM} -f y.tab.c y.tab.h
 ipscan_l.c: lexer.c ipscan_y.h
 	${SED} -e 's/yy/ipscan_yy/g' -e 's/y.tab.h/ipscan_y.h/' \
-		-e 's/lexer.h/ipscan_l.h/' ${lexer.c:P} > $@
+		-e 's/lexer.h/ipscan_l.h/' lexer.c > $@
 ipscan_l.h: lexer.h
-	${SED} -e 's/yy/ipscan_yy/g' ${lexer.h:P} > $@
+	${SED} -e 's/yy/ipscan_yy/g' lexer.h > $@
+
+${MAKETOP}/usr/lib/kmem.o:	${MAKETOP}/usr/lib/kmem.c
+	cd ${MAKETOP}/usr/lib && make kmem.o
+
+

From 55ed027af4ec6599bcdcd53b39785a59ada3a02f Mon Sep 17 00:00:00 2001
From: Hartmut Penner <hapenner@cisco.com>
Date: Tue, 8 Sep 2026 03:14:15 +0200
Subject: [PATCH 4/7] Add a bff target that packages the built tools and kernel
 extension with mkinstallp

---
 Makefile               | 13 +++++++++++++
 ipfilter.rte.copyright |  9 +++++++++
 ipfilter.rte.post_i    |  0
 ipfilter.rte.pre_i     |  0
 ipfilter.rte.unpost_i  |  0
 ipfilter.tmpl          | 35 +++++++++++++++++++++++++++++++++++
 6 files changed, 57 insertions(+)
 create mode 100644 ipfilter.rte.copyright
 create mode 100644 ipfilter.rte.post_i
 create mode 100644 ipfilter.rte.pre_i
 create mode 100644 ipfilter.rte.unpost_i
 create mode 100644 ipfilter.tmpl

diff --git a/Makefile b/Makefile
index aaa60bc..be0e77c 100644
--- a/Makefile
+++ b/Makefile
@@ -5,11 +5,24 @@ all: kernext/sys/socketvar.h
 	for i in $(SUBDIRS); do \
 		(cd $$i && $(MAKE) $(MAKEFLAGS)); \
 	done
+
+bff:	all
+	mkdir -p usr/lib/drivers
+	cp kernext/ipf usr/lib/drivers/
+	rm -rf .info
+	sed "s#<scriptdir>#`pwd`#g" ipfilter.tmpl >ipfilter.t
+	mkinstallp -d . -T ipfilter.t
+
 clean:
 	rm -f kernext/sys/socketvar.h
 	for i in $(SUBDIRS); do \
 		(cd $$i && $(MAKE) $(MAKEFLAGS) clean); \
 	done
+	rm -f usr/lib/drivers/ipf
+	rmdir usr/lib/drivers || true
+	rm -f ipfilter.t
+	rm -rf .info
+
 kernext/sys/socketvar.h: /usr/include/sys/socketvar.h
 	mkdir -p kernext/sys
 	sed "s#free_sock_hash_table\[\]#*free_sock_hash_table#g" $^ > $@
diff --git a/ipfilter.rte.copyright b/ipfilter.rte.copyright
new file mode 100644
index 0000000..4bebdb2
--- /dev/null
+++ b/ipfilter.rte.copyright
@@ -0,0 +1,9 @@
+Copyright 2020 Cisco Systems, Inc. All rights reserved.
+Copyright International Business Machines Corp. 2006, 2017.
+Copyright Ryan Beasley, 2002-2003.
+Copyright The Regents of the University of California, 1982-1983, 1986, 1988-1989, 1990-1997.
+Copyright Digital Equipment Corporation, 1993.
+Copyright Paul J. Ledbetter III, 2002-2003.
+Copyright Darren Reed and Guido van Rooij, 1998-2003.
+Copyright Darren Reed, 1993-2005.
+Copyright RSA Data Security, Inc. 1990.
diff --git a/ipfilter.rte.post_i b/ipfilter.rte.post_i
new file mode 100644
index 0000000..e69de29
diff --git a/ipfilter.rte.pre_i b/ipfilter.rte.pre_i
new file mode 100644
index 0000000..e69de29
diff --git a/ipfilter.rte.unpost_i b/ipfilter.rte.unpost_i
new file mode 100644
index 0000000..e69de29
diff --git a/ipfilter.tmpl b/ipfilter.tmpl
new file mode 100644
index 0000000..a60d0f3
--- /dev/null
+++ b/ipfilter.tmpl
@@ -0,0 +1,35 @@
+Package Name: ipfl
+Package VRMF: 5.3.1.0
+Update: N
+Fileset
+  Fileset Name: ipfl.rte
+  Fileset VRMF: 5.3.1.0
+  Fileset Description: Ipfilter
+  Bosboot required: N
+  Copyright file path: <scriptdir>/ipfilter.rte.copyright
+  License agreement acceptance required: N
+  Include license files in this package: N
+  Requisites:
+  USRFiles
+        /usr/sbin/ipf
+        /usr/sbin/ipfs
+        /usr/sbin/ipfstat
+        /usr/sbin/ipnat
+        /usr/sbin/ippool
+        /usr/sbin/ipscan
+        /usr/sbin/ipmon
+        /usr/sbin/ipsyncm
+        /usr/sbin/ipsyncs
+        /usr/lib/methods/cfg_ipf
+        /usr/lib/drivers/ipf
+  EOUSRFiles
+  USRLIBLPPFiles
+     Pre-installation Script: <scriptdir>/ipfilter.rte.pre_i
+     Post-installation Script: <scriptdir>/ipfilter.rte.post_i
+     Unpost-installation Script: <scriptdir>/ipfilter.rte.unpost_i
+  EOUSRLIBLPPFiles
+  ROOT Part: N
+  ROOTFiles
+  EOROOTFiles
+  Relocatable: Y
+EOFileset

From 9565ba6f980d428ae0461c3af75aa060e02d47d3 Mon Sep 17 00:00:00 2001
From: Hartmut Penner <hapenner@cisco.com>
Date: Tue, 8 Sep 2026 05:47:03 +0200
Subject: [PATCH 5/7] IPFilter: Add frag fix

---
 kernext/fil.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/kernext/fil.c b/kernext/fil.c
index a541941..460be98 100644
--- a/kernext/fil.c
+++ b/kernext/fil.c
@@ -1363,7 +1363,10 @@ fr_info_t *fin;
 	if (off != 0) {
 		fi->fi_flx |= FI_FRAG;
 		off &= IP_OFFMASK;
-		if (off != 0) {
+		//check if we have IP_MF bit set in offset, if yes then only,
+		//go to loop and validate it with given condition
+		// else that would be the last fragment and should not be validated
+		if ((off & ~IP_OFFMASK) != 0) {
 			fin->fin_flx |= FI_FRAGBODY;
 			off <<= 3;
 			if ((off + fin->fin_dlen > 65535) || 

From f42d2ba8bea19d45d12fde625f4f48bb989179cc Mon Sep 17 00:00:00 2001
From: Hartmut Penner <hapenner@cisco.com>
Date: Tue, 8 Sep 2026 06:37:40 +0200
Subject: [PATCH 6/7] AIX IPFilter: Fix 64 bit issue in ioctl.h

---
 Makefile | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index be0e77c..35a51a9 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 SUBDIRS = usr/lib usr/sbin usr/lib/methods kernext
 
-all: kernext/sys/socketvar.h
+all: kernext/sys/socketvar.h kernext/sys/ioctl.h
 	touch kernext/sys/libsysp.h
 	for i in $(SUBDIRS); do \
 		(cd $$i && $(MAKE) $(MAKEFLAGS)); \
@@ -26,3 +26,7 @@ clean:
 kernext/sys/socketvar.h: /usr/include/sys/socketvar.h
 	mkdir -p kernext/sys
 	sed "s#free_sock_hash_table\[\]#*free_sock_hash_table#g" $^ > $@
+
+kernext/sys/ioctl.h: /usr/include/sys/ioctl.h
+	mkdir -p kernext/sys
+	sed "s#(0x40000000<<1)#(0x80000000)#" $^ | sed "s#((sizeof(t)\&IOCPARM_MASK)#(int)((sizeof(t)\&IOCPARM_MASK)#g" > $@

From e1bf24dfaf7593ae1c0e908ecb4c3b9391b33afe Mon Sep 17 00:00:00 2001
From: Harshavardhan Nalajala <hnalajal@cisco.com>
Date: Tue, 8 Sep 2026 06:43:35 +0200
Subject: [PATCH 7/7] Disable version check in ipfilter

---
 usr/lib/checkrev.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/usr/lib/checkrev.c b/usr/lib/checkrev.c
index 245333b..de22044 100644
--- a/usr/lib/checkrev.c
+++ b/usr/lib/checkrev.c
@@ -32,6 +32,7 @@ static char sccsid[] = "@(#)03  1.1  src/ipfl/usr/lib/checkrev.c, ipflt, 53ipfl5
 int checkrev(ipfname)
 char *ipfname;
 {
+#ifdef CHECK_IPL_VERSION
 	static int vfd = -1;
 	struct friostat fio, *fiop = &fio;
 	ipfobj_t ipfo;
@@ -57,5 +58,6 @@ char *ipfname;
 	if (strncmp(IPL_VERSION, fio.f_version, sizeof(fio.f_version))) {
 		return -1;
 	}
+#endif
 	return 0;
 }