From fd63078a5e6d73eb0a4fd441b0aa6d32d645f77c Mon Sep 17 00:00:00 2001
From: Vadim Kurland <vadim@netcitadel.com>
Date: Wed, 6 Jul 2011 14:36:47 -0700
Subject: [PATCH 01/18] see #2551 "PF Import - source routing rules are not
 imported with rule options set". Importer should import "route-to" rule
 parameters.

---
 doc/ChangeLog                                 |   4 +
 src/import/PFImporter.cpp                     |  44 +
 src/parsers/PFCfgLexer.cpp                    | 433 ++++----
 src/parsers/PFCfgLexer.hpp                    |   2 +-
 src/parsers/PFCfgParser.cpp                   | 922 +++++++++---------
 src/parsers/PFCfgParser.hpp                   |   7 +-
 src/parsers/PFCfgParserTokenTypes.hpp         | 245 ++---
 src/parsers/PFCfgParserTokenTypes.txt         | 245 ++---
 src/parsers/pf.g                              |  10 +-
 .../PFImporterTest/PFImporterTest.cpp         |  18 +
 .../PFImporterTest/PFImporterTest.h           |   2 +
 .../test_data/pf-hosts-matches.output         |   8 +-
 .../PFImporterTest/test_data/pf-route-to.conf |   7 +
 .../PFImporterTest/test_data/pf-route-to.fwb  | 563 +++++++++++
 .../test_data/pf-route-to.output              |   5 +
 .../PFImporterTest/test_data/pf-tables.output |   8 +-
 16 files changed, 1565 insertions(+), 958 deletions(-)
 create mode 100644 src/unit_tests/PFImporterTest/test_data/pf-route-to.conf
 create mode 100644 src/unit_tests/PFImporterTest/test_data/pf-route-to.fwb
 create mode 100644 src/unit_tests/PFImporterTest/test_data/pf-route-to.output

diff --git a/doc/ChangeLog b/doc/ChangeLog
index 95692807d..d27901529 100644
--- a/doc/ChangeLog
+++ b/doc/ChangeLog
@@ -1,5 +1,9 @@
 2011-07-06  Vadim Kurland  <vadim@netcitadel.com>
 
+	* PFImporter.cpp (pushPolicyRule): see #2551 "PF Import - source
+	routing rules are not imported with rule options set". Importer
+	should import "route-to" rule parameters.
+
 	* PFImporter.cpp (newAddressTableObject): see #2546 "PF import -
 	negation inside of inline tables is ignored". We can not import
 	PF table definition that has some addresses negated.
diff --git a/src/import/PFImporter.cpp b/src/import/PFImporter.cpp
index 6accd5cee..188f3b3cb 100644
--- a/src/import/PFImporter.cpp
+++ b/src/import/PFImporter.cpp
@@ -828,6 +828,50 @@ void PFImporter::pushPolicyRule()
      */
     if (! queue.empty()) ropt->setStr("pf_classify_str", queue);
 
+    /*
+     * route-to options
+     *
+     */
+    if (route_type != UNKNOWN && route_group.size() != 0)
+    {
+        switch (route_type)
+        {
+        case ROUTE_TO:
+            ropt->setStr("pf_route_option", "route_through"); break;
+
+        case REPLY_TO:
+            ropt->setStr("pf_route_option", "route_reply_through"); break;
+
+        case DUP_TO:
+            ropt->setStr("pf_route_option", "route_copy_through"); break;
+
+        default: ;
+        }
+
+        QStringList route_opt_addr;
+        list<RouteSpec>::iterator it;
+        for (it=route_group.begin(); it!=route_group.end(); ++it)
+        {
+            RouteSpec &rs = *it;
+
+            Interface *intf = getInterfaceByName(rs.iface);
+            if (intf == NULL)
+            {
+                // this interface was never used in "on <intf>" clause before
+                newInterface(rs.iface);
+            }
+
+            ropt->setStr("pf_route_opt_if", rs.iface);
+
+            if (rs.netmask.empty())
+                route_opt_addr << rs.address.c_str();
+            else
+                route_opt_addr << QString("%1/%2")
+                    .arg(rs.address.c_str()).arg(rs.netmask.c_str());
+        }
+        ropt->setStr("pf_route_opt_addr", route_opt_addr.join(",").toStdString());
+    }
+
     /*
      * Protocols are in proto_list
      * Source addresses are in src_group
diff --git a/src/parsers/PFCfgLexer.cpp b/src/parsers/PFCfgLexer.cpp
index b33837de9..0bbcf2f09 100644
--- a/src/parsers/PFCfgLexer.cpp
+++ b/src/parsers/PFCfgLexer.cpp
@@ -1,4 +1,4 @@
-/* $ANTLR 2.7.7 (20090306): "pf.g" -> "PFCfgLexer.cpp"$ */
+/* $ANTLR 2.7.7 (20100319): "pf.g" -> "PFCfgLexer.cpp"$ */
 #line 43 "pf.g"
 
     // gets inserted before the antlr generated includes in the cpp
@@ -44,14 +44,14 @@ PFCfgLexer::PFCfgLexer(const ANTLR_USE_NAMESPACE(antlr)LexerSharedInputState& st
 
 void PFCfgLexer::initLiterals()
 {
-	literals["badhead"] = 199;
-	literals["notifications"] = 233;
+	literals["badhead"] = 200;
+	literals["notifications"] = 234;
 	literals["state-policy"] = 26;
 	literals["floating"] = 28;
 	literals["no"] = 84;
 	literals["counters"] = 72;
 	literals["esp"] = 126;
-	literals["routersol"] = 158;
+	literals["routersol"] = 159;
 	literals["frags"] = 60;
 	literals["reply-to"] = 139;
 	literals["icmp.first"] = 49;
@@ -59,77 +59,77 @@ void PFCfgLexer::initLiterals()
 	literals["gre"] = 125;
 	literals["pass"] = 86;
 	literals["scrub"] = 65;
-	literals["warnings"] = 234;
+	literals["warnings"] = 235;
 	literals["include"] = 6;
 	literals["skip"] = 32;
 	literals["timeout"] = 13;
 	literals["eigrp"] = 128;
-	literals["icmp-type"] = 149;
-	literals["transit"] = 197;
+	literals["icmp-type"] = 150;
+	literals["transit"] = 198;
 	literals["inet"] = 115;
-	literals["no-df"] = 144;
+	literals["no-df"] = 145;
 	literals["network"] = 77;
-	literals["photuris"] = 174;
+	literals["photuris"] = 175;
 	literals["igmp"] = 120;
-	literals["unreach"] = 152;
-	literals["range"] = 226;
+	literals["unreach"] = 153;
+	literals["range"] = 227;
 	literals["rsvp"] = 124;
-	literals["debugging"] = 229;
-	literals["host-tos"] = 187;
-	literals["paramprob"] = 160;
+	literals["debugging"] = 230;
+	literals["host-tos"] = 188;
+	literals["paramprob"] = 161;
 	literals["user"] = 113;
-	literals["interface"] = 215;
+	literals["interface"] = 216;
 	literals["adaptive.end"] = 58;
 	literals["limit"] = 21;
 	literals["state-defaults"] = 29;
 	literals["hex-key"] = 98;
-	literals["net-unk"] = 181;
+	literals["net-unk"] = 182;
 	literals["antispoof"] = 9;
 	literals["udp.single"] = 47;
-	literals["inforeq"] = 163;
-	literals["ipv6-here"] = 171;
-	literals["redir"] = 154;
+	literals["inforeq"] = 164;
+	literals["ipv6-here"] = 172;
+	literals["redir"] = 155;
 	literals["static-port"] = 88;
-	literals["common-adv"] = 196;
+	literals["common-adv"] = 197;
 	literals["loginterface"] = 22;
 	literals["ip"] = 118;
-	literals["mobregreq"] = 172;
+	literals["mobregreq"] = 173;
 	literals["conservative"] = 17;
 	literals["ospf"] = 129;
-	literals["proto-unr"] = 177;
+	literals["proto-unr"] = 178;
 	literals["peer"] = 79;
-	literals["inforep"] = 164;
-	literals["errors"] = 231;
+	literals["inforep"] = 165;
+	literals["errors"] = 232;
 	literals["tables-entries"] = 64;
 	literals["any"] = 136;
-	literals["mobregrep"] = 173;
-	literals["label"] = 212;
-	literals["pptp"] = 222;
-	literals["synproxy"] = 210;
+	literals["mobregrep"] = 174;
+	literals["label"] = 213;
+	literals["pptp"] = 223;
+	literals["synproxy"] = 211;
 	literals["debug"] = 37;
-	literals["alerts"] = 227;
+	literals["alerts"] = 228;
 	literals["all"] = 112;
-	literals["state"] = 211;
-	literals["tag"] = 207;
+	literals["state"] = 212;
+	literals["tag"] = 208;
 	literals["in"] = 108;
 	literals["tables"] = 63;
 	literals["file"] = 73;
-	literals["nos"] = 219;
+	literals["nos"] = 220;
 	literals["src-nodes"] = 62;
-	literals["ipv6-where"] = 170;
+	literals["ipv6-where"] = 171;
 	literals["require-order"] = 30;
 	literals["udp"] = 122;
 	literals["states"] = 61;
 	literals["sticky-address"] = 101;
 	literals["return-icmp"] = 106;
-	literals["redir-tos-net"] = 193;
-	literals["pim"] = 221;
-	literals["emergencies"] = 230;
-	literals["squench"] = 153;
-	literals["disable"] = 235;
-	literals["flags"] = 148;
+	literals["redir-tos-net"] = 194;
+	literals["pim"] = 222;
+	literals["emergencies"] = 231;
+	literals["squench"] = 154;
+	literals["disable"] = 236;
+	literals["flags"] = 149;
 	literals["tcp"] = 121;
-	literals["net-tos"] = 186;
+	literals["net-tos"] = 187;
 	literals["reassemble"] = 38;
 	literals["adaptive.start"] = 57;
 	literals["frag"] = 54;
@@ -137,58 +137,59 @@ void PFCfgLexer::initLiterals()
 	literals["icmp"] = 119;
 	literals["to"] = 114;
 	literals["return-rst"] = 104;
-	literals["normal-adv"] = 195;
+	literals["normal-adv"] = 196;
 	literals["optimization"] = 15;
 	literals["log"] = 110;
-	literals["fragment"] = 141;
-	literals["snp"] = 224;
+	literals["fragment"] = 142;
+	literals["snp"] = 225;
 	literals["broadcast"] = 78;
-	literals["icmp6-type"] = 205;
+	literals["icmp6-type"] = 206;
 	literals["normal"] = 19;
-	literals["code"] = 150;
+	literals["code"] = 151;
 	literals["if-bound"] = 27;
 	literals["src.track"] = 56;
-	literals["drop-ovl"] = 143;
-	literals["routeradv"] = 157;
+	literals["drop-ovl"] = 144;
+	literals["routeradv"] = 158;
 	literals["other.single"] = 52;
+	literals["dup-to"] = 140;
 	literals["bitmask"] = 95;
-	literals["maskreq"] = 165;
+	literals["maskreq"] = 166;
 	literals["ipip"] = 130;
 	literals["tcp.closed"] = 45;
 	literals["block"] = 103;
 	literals["high-latency"] = 18;
 	literals["udp.first"] = 46;
-	literals["badlen"] = 201;
+	literals["badlen"] = 202;
 	literals["tcp.first"] = 40;
-	literals["host-unr"] = 176;
+	literals["host-unr"] = 177;
 	literals["ah"] = 127;
-	literals["random-id"] = 147;
-	literals["modulate"] = 209;
+	literals["random-id"] = 148;
+	literals["modulate"] = 210;
 	literals["interval"] = 55;
-	literals["maskrep"] = 166;
+	literals["maskrep"] = 167;
 	literals["ruleset-optimization"] = 14;
-	literals["trace"] = 167;
-	literals["rip"] = 223;
+	literals["trace"] = 168;
+	literals["rip"] = 224;
 	literals["urpf-failed"] = 135;
 	literals["set"] = 12;
 	literals["source-hash"] = 97;
-	literals["critical"] = 228;
-	literals["quit"] = 214;
+	literals["critical"] = 229;
+	literals["quit"] = 215;
 	literals["icmp.error"] = 50;
 	literals["const"] = 71;
 	literals["altq"] = 10;
 	literals["tcp.closing"] = 43;
-	literals["port-unr"] = 178;
+	literals["port-unr"] = 179;
 	literals["table"] = 67;
-	literals["redir-tos-host"] = 194;
+	literals["redir-tos-host"] = 195;
 	literals["fingerprints"] = 31;
 	literals["return"] = 25;
-	literals["optmiss"] = 200;
+	literals["optmiss"] = 201;
 	literals["match"] = 66;
-	literals["keep"] = 208;
-	literals["net-prohib"] = 184;
+	literals["keep"] = 209;
+	literals["net-prohib"] = 185;
 	literals["inet6"] = 116;
-	literals["group"] = 140;
+	literals["group"] = 141;
 	literals["from"] = 134;
 	literals["tcp.finwait"] = 44;
 	literals["hostid"] = 39;
@@ -196,64 +197,64 @@ void PFCfgLexer::initLiterals()
 	literals["vrrp"] = 131;
 	literals["drop"] = 24;
 	literals["l2tp"] = 132;
-	literals["max-mss"] = 146;
-	literals["isolate"] = 183;
-	literals["timereq"] = 161;
+	literals["max-mss"] = 147;
+	literals["isolate"] = 184;
+	literals["timereq"] = 162;
 	literals["aggressive"] = 16;
-	literals["icmp6"] = 216;
-	literals["echoreq"] = 156;
+	literals["icmp6"] = 217;
+	literals["echoreq"] = 157;
 	literals["tcp.established"] = 42;
-	literals["decrypt-fail"] = 204;
-	literals["mobredir"] = 169;
+	literals["decrypt-fail"] = 205;
+	literals["mobredir"] = 170;
 	literals["other.first"] = 51;
-	literals["ipsec"] = 218;
+	literals["ipsec"] = 219;
 	literals["no-route"] = 137;
 	literals["random"] = 96;
 	literals["binat"] = 102;
-	literals["srcfail"] = 180;
+	literals["srcfail"] = 181;
 	literals["self"] = 80;
-	literals["timerep"] = 162;
-	literals["crop"] = 142;
-	literals["host-preced"] = 189;
-	literals["host"] = 225;
-	literals["echorep"] = 151;
+	literals["timerep"] = 163;
+	literals["crop"] = 143;
+	literals["host-preced"] = 190;
+	literals["host"] = 226;
+	literals["echorep"] = 152;
 	literals["other.multiple"] = 53;
-	literals["althost"] = 155;
+	literals["althost"] = 156;
 	literals["udp.multiple"] = 48;
-	literals["cutoff-preced"] = 190;
-	literals["redir-host"] = 192;
+	literals["cutoff-preced"] = 191;
+	literals["redir-host"] = 193;
 	literals["rdr"] = 89;
-	literals["tagged"] = 206;
+	literals["tagged"] = 207;
 	literals["on"] = 33;
 	literals["round-robin"] = 100;
-	literals["pcp"] = 220;
+	literals["pcp"] = 221;
 	literals["block-policy"] = 23;
 	literals["persist"] = 70;
-	literals["unknown-ind"] = 202;
-	literals["redir-net"] = 191;
-	literals["filter-prohib"] = 188;
+	literals["unknown-ind"] = 203;
+	literals["redir-net"] = 192;
+	literals["filter-prohib"] = 189;
 	literals["nat"] = 85;
 	literals["satellite"] = 20;
-	literals["informational"] = 232;
-	literals["needfrag"] = 179;
+	literals["informational"] = 233;
+	literals["needfrag"] = 180;
 	literals["tcp.opening"] = 41;
-	literals["igrp"] = 217;
+	literals["igrp"] = 218;
 	literals["quick"] = 111;
-	literals["timex"] = 159;
-	literals["host-unk"] = 182;
+	literals["timex"] = 160;
+	literals["host-unk"] = 183;
 	literals["route-to"] = 138;
-	literals["dataconv"] = 168;
+	literals["dataconv"] = 169;
 	literals["rdp"] = 123;
-	literals["net-unr"] = 175;
+	literals["net-unr"] = 176;
 	literals["queue"] = 11;
 	literals["isis"] = 133;
-	literals["reassemb"] = 198;
-	literals["inactive"] = 236;
+	literals["reassemb"] = 199;
+	literals["inactive"] = 237;
 	literals["out"] = 109;
-	literals["min-ttl"] = 145;
-	literals["auth-fail"] = 203;
-	literals["exit"] = 213;
-	literals["host-prohib"] = 185;
+	literals["min-ttl"] = 146;
+	literals["auth-fail"] = 204;
+	literals["exit"] = 214;
+	literals["host-prohib"] = 186;
 }
 
 ANTLR_USE_NAMESPACE(antlr)RefToken PFCfgLexer::nextToken()
@@ -561,11 +562,11 @@ void PFCfgLexer::mLINE_COMMENT(bool _createToken) {
 			}
 		}
 		else {
-			goto _loop275;
+			goto _loop277;
 		}
 		
 	}
-	_loop275:;
+	_loop277:;
 	} // ( ... )*
 	mNEWLINE(false);
 	if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
@@ -597,9 +598,9 @@ void PFCfgLexer::mNEWLINE(bool _createToken) {
 	
 	}
 	if ( inputState->guessing==0 ) {
-#line 1982 "pf.g"
+#line 1990 "pf.g"
 		newline();
-#line 603 "PFCfgLexer.cpp"
+#line 604 "PFCfgLexer.cpp"
 	}
 	if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
 	   _token = makeToken(_ttype);
@@ -678,9 +679,9 @@ void PFCfgLexer::mWhitespace(bool _createToken) {
 	}
 	}
 	if ( inputState->guessing==0 ) {
-#line 1977 "pf.g"
+#line 1985 "pf.g"
 		_ttype = ANTLR_USE_NAMESPACE(antlr)Token::SKIP;
-#line 684 "PFCfgLexer.cpp"
+#line 685 "PFCfgLexer.cpp"
 	}
 	if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
 	   _token = makeToken(_ttype);
@@ -905,10 +906,10 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 	_ttype = NUMBER_ADDRESS_OR_WORD;
 	ANTLR_USE_NAMESPACE(std)string::size_type _saveIndex;
 	
-	bool synPredMatched328 = false;
+	bool synPredMatched330 = false;
 	if ((((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && (_tokenSet_3.member(LA(2))) && (_tokenSet_3.member(LA(3))))) {
-		int _m328 = mark();
-		synPredMatched328 = true;
+		int _m330 = mark();
+		synPredMatched330 = true;
 		inputState->guessing++;
 		try {
 			{
@@ -919,12 +920,12 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 			}
 		}
 		catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
-			synPredMatched328 = false;
+			synPredMatched330 = false;
 		}
-		rewind(_m328);
+		rewind(_m330);
 		inputState->guessing--;
 	}
-	if ( synPredMatched328 ) {
+	if ( synPredMatched330 ) {
 		{
 		mNUM_3DIGIT(false);
 		match('.' /* charlit */ );
@@ -935,35 +936,20 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 		mNUM_3DIGIT(false);
 		}
 		if ( inputState->guessing==0 ) {
-#line 2037 "pf.g"
+#line 2045 "pf.g"
 			_ttype = IPV4;
-#line 941 "PFCfgLexer.cpp"
+#line 942 "PFCfgLexer.cpp"
 		}
 	}
 	else {
-		bool synPredMatched335 = false;
+		bool synPredMatched337 = false;
 		if ((((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && (_tokenSet_3.member(LA(2))) && (_tokenSet_3.member(LA(3))))) {
-			int _m335 = mark();
-			synPredMatched335 = true;
+			int _m337 = mark();
+			synPredMatched337 = true;
 			inputState->guessing++;
 			try {
 				{
 				{ // ( ... )+
-				int _cnt332=0;
-				for (;;) {
-					if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
-						mDIGIT(false);
-					}
-					else {
-						if ( _cnt332>=1 ) { goto _loop332; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
-					}
-					
-					_cnt332++;
-				}
-				_loop332:;
-				}  // ( ... )+
-				match('.' /* charlit */ );
-				{ // ( ... )+
 				int _cnt334=0;
 				for (;;) {
 					if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
@@ -977,32 +963,32 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 				}
 				_loop334:;
 				}  // ( ... )+
+				match('.' /* charlit */ );
+				{ // ( ... )+
+				int _cnt336=0;
+				for (;;) {
+					if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
+						mDIGIT(false);
+					}
+					else {
+						if ( _cnt336>=1 ) { goto _loop336; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+					}
+					
+					_cnt336++;
+				}
+				_loop336:;
+				}  // ( ... )+
 				}
 			}
 			catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
-				synPredMatched335 = false;
+				synPredMatched337 = false;
 			}
-			rewind(_m335);
+			rewind(_m337);
 			inputState->guessing--;
 		}
-		if ( synPredMatched335 ) {
+		if ( synPredMatched337 ) {
 			{
 			{ // ( ... )+
-			int _cnt338=0;
-			for (;;) {
-				if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
-					mDIGIT(false);
-				}
-				else {
-					if ( _cnt338>=1 ) { goto _loop338; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
-				}
-				
-				_cnt338++;
-			}
-			_loop338:;
-			}  // ( ... )+
-			match('.' /* charlit */ );
-			{ // ( ... )+
 			int _cnt340=0;
 			for (;;) {
 				if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
@@ -1016,63 +1002,78 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 			}
 			_loop340:;
 			}  // ( ... )+
+			match('.' /* charlit */ );
+			{ // ( ... )+
+			int _cnt342=0;
+			for (;;) {
+				if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
+					mDIGIT(false);
+				}
+				else {
+					if ( _cnt342>=1 ) { goto _loop342; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+				}
+				
+				_cnt342++;
+			}
+			_loop342:;
+			}  // ( ... )+
 			}
 			if ( inputState->guessing==0 ) {
-#line 2040 "pf.g"
+#line 2048 "pf.g"
 				_ttype = NUMBER;
-#line 1024 "PFCfgLexer.cpp"
+#line 1025 "PFCfgLexer.cpp"
 			}
 		}
 		else {
-			bool synPredMatched303 = false;
+			bool synPredMatched305 = false;
 			if (((_tokenSet_2.member(LA(1))) && (_tokenSet_4.member(LA(2))) && (true))) {
-				int _m303 = mark();
-				synPredMatched303 = true;
+				int _m305 = mark();
+				synPredMatched305 = true;
 				inputState->guessing++;
 				try {
 					{
 					{ // ( ... )+
-					int _cnt302=0;
+					int _cnt304=0;
 					for (;;) {
 						if ((_tokenSet_2.member(LA(1)))) {
 							mHEX_DIGIT(false);
 						}
 						else {
-							if ( _cnt302>=1 ) { goto _loop302; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+							if ( _cnt304>=1 ) { goto _loop304; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
 						}
 						
-						_cnt302++;
+						_cnt304++;
 					}
-					_loop302:;
+					_loop304:;
 					}  // ( ... )+
 					match(':' /* charlit */ );
 					}
 				}
 				catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
-					synPredMatched303 = false;
+					synPredMatched305 = false;
 				}
-				rewind(_m303);
+				rewind(_m305);
 				inputState->guessing--;
 			}
-			if ( synPredMatched303 ) {
+			if ( synPredMatched305 ) {
 				{
 				{
 				{ // ( ... )+
-				int _cnt307=0;
+				int _cnt309=0;
 				for (;;) {
 					if ((_tokenSet_2.member(LA(1)))) {
 						mHEX_DIGIT(false);
 					}
 					else {
-						if ( _cnt307>=1 ) { goto _loop307; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+						if ( _cnt309>=1 ) { goto _loop309; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
 					}
 					
-					_cnt307++;
+					_cnt309++;
 				}
-				_loop307:;
+				_loop309:;
 				}  // ( ... )+
 				{ // ( ... )+
-				int _cnt311=0;
+				int _cnt313=0;
 				for (;;) {
 					if ((LA(1) == 0x3a /* ':' */ )) {
 						match(':' /* charlit */ );
@@ -1082,34 +1083,34 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 								mHEX_DIGIT(false);
 							}
 							else {
-								goto _loop310;
+								goto _loop312;
 							}
 							
 						}
-						_loop310:;
+						_loop312:;
 						} // ( ... )*
 					}
 					else {
-						if ( _cnt311>=1 ) { goto _loop311; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+						if ( _cnt313>=1 ) { goto _loop313; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
 					}
 					
-					_cnt311++;
+					_cnt313++;
 				}
-				_loop311:;
+				_loop313:;
 				}  // ( ... )+
 				}
 				if ( inputState->guessing==0 ) {
-#line 2022 "pf.g"
+#line 2030 "pf.g"
 					_ttype = IPV6;
-#line 1105 "PFCfgLexer.cpp"
+#line 1106 "PFCfgLexer.cpp"
 				}
 				}
 			}
 			else {
-				bool synPredMatched313 = false;
+				bool synPredMatched315 = false;
 				if (((LA(1) == 0x3a /* ':' */ ))) {
-					int _m313 = mark();
-					synPredMatched313 = true;
+					int _m315 = mark();
+					synPredMatched315 = true;
 					inputState->guessing++;
 					try {
 						{
@@ -1117,93 +1118,93 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 						}
 					}
 					catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
-						synPredMatched313 = false;
+						synPredMatched315 = false;
 					}
-					rewind(_m313);
+					rewind(_m315);
 					inputState->guessing--;
 				}
-				if ( synPredMatched313 ) {
+				if ( synPredMatched315 ) {
 					{
-					bool synPredMatched318 = false;
+					bool synPredMatched320 = false;
 					if (((LA(1) == 0x3a /* ':' */ ) && (LA(2) == 0x3a /* ':' */ ) && (_tokenSet_2.member(LA(3))))) {
-						int _m318 = mark();
-						synPredMatched318 = true;
+						int _m320 = mark();
+						synPredMatched320 = true;
 						inputState->guessing++;
 						try {
 							{
 							match(':' /* charlit */ );
 							match(':' /* charlit */ );
 							{ // ( ... )+
-							int _cnt317=0;
+							int _cnt319=0;
 							for (;;) {
 								if ((_tokenSet_2.member(LA(1)))) {
 									mHEX_DIGIT(false);
 								}
 								else {
-									if ( _cnt317>=1 ) { goto _loop317; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+									if ( _cnt319>=1 ) { goto _loop319; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
 								}
 								
-								_cnt317++;
+								_cnt319++;
 							}
-							_loop317:;
+							_loop319:;
 							}  // ( ... )+
 							}
 						}
 						catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
-							synPredMatched318 = false;
+							synPredMatched320 = false;
 						}
-						rewind(_m318);
+						rewind(_m320);
 						inputState->guessing--;
 					}
-					if ( synPredMatched318 ) {
+					if ( synPredMatched320 ) {
 						{
 						match(':' /* charlit */ );
 						match(':' /* charlit */ );
 						{ // ( ... )+
-						int _cnt321=0;
+						int _cnt323=0;
 						for (;;) {
 							if ((_tokenSet_2.member(LA(1)))) {
 								mHEX_DIGIT(false);
 							}
 							else {
-								if ( _cnt321>=1 ) { goto _loop321; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+								if ( _cnt323>=1 ) { goto _loop323; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
 							}
 							
-							_cnt321++;
+							_cnt323++;
 						}
-						_loop321:;
+						_loop323:;
 						}  // ( ... )+
 						{ // ( ... )*
 						for (;;) {
 							if ((LA(1) == 0x3a /* ':' */ )) {
 								match(':' /* charlit */ );
 								{ // ( ... )+
-								int _cnt324=0;
+								int _cnt326=0;
 								for (;;) {
 									if ((_tokenSet_2.member(LA(1)))) {
 										mHEX_DIGIT(false);
 									}
 									else {
-										if ( _cnt324>=1 ) { goto _loop324; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+										if ( _cnt326>=1 ) { goto _loop326; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
 									}
 									
-									_cnt324++;
+									_cnt326++;
 								}
-								_loop324:;
+								_loop326:;
 								}  // ( ... )+
 							}
 							else {
-								goto _loop325;
+								goto _loop327;
 							}
 							
 						}
-						_loop325:;
+						_loop327:;
 						} // ( ... )*
 						}
 						if ( inputState->guessing==0 ) {
-#line 2028 "pf.g"
+#line 2036 "pf.g"
 							_ttype = IPV6;
-#line 1207 "PFCfgLexer.cpp"
+#line 1208 "PFCfgLexer.cpp"
 						}
 					}
 					else if ((LA(1) == 0x3a /* ':' */ ) && (LA(2) == 0x3a /* ':' */ ) && (true)) {
@@ -1212,17 +1213,17 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 						match(':' /* charlit */ );
 						}
 						if ( inputState->guessing==0 ) {
-#line 2030 "pf.g"
+#line 2038 "pf.g"
 							_ttype = IPV6;
-#line 1218 "PFCfgLexer.cpp"
+#line 1219 "PFCfgLexer.cpp"
 						}
 					}
 					else if ((LA(1) == 0x3a /* ':' */ ) && (true)) {
 						match(':' /* charlit */ );
 						if ( inputState->guessing==0 ) {
-#line 2032 "pf.g"
+#line 2040 "pf.g"
 							_ttype = COLON;
-#line 1226 "PFCfgLexer.cpp"
+#line 1227 "PFCfgLexer.cpp"
 						}
 					}
 					else {
@@ -1233,23 +1234,23 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 				}
 				else if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && (true) && (true)) {
 					{ // ( ... )+
-					int _cnt342=0;
+					int _cnt344=0;
 					for (;;) {
 						if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
 							mDIGIT(false);
 						}
 						else {
-							if ( _cnt342>=1 ) { goto _loop342; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+							if ( _cnt344>=1 ) { goto _loop344; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
 						}
 						
-						_cnt342++;
+						_cnt344++;
 					}
-					_loop342:;
+					_loop344:;
 					}  // ( ... )+
 					if ( inputState->guessing==0 ) {
-#line 2042 "pf.g"
+#line 2050 "pf.g"
 						_ttype = INT_CONST;
-#line 1253 "PFCfgLexer.cpp"
+#line 1254 "PFCfgLexer.cpp"
 					}
 				}
 				else if ((_tokenSet_5.member(LA(1))) && (true) && (true)) {
@@ -1465,16 +1466,16 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 						}
 						default:
 						{
-							goto _loop345;
+							goto _loop347;
 						}
 						}
 					}
-					_loop345:;
+					_loop347:;
 					} // ( ... )*
 					if ( inputState->guessing==0 ) {
-#line 2053 "pf.g"
+#line 2061 "pf.g"
 						_ttype = WORD;
-#line 1478 "PFCfgLexer.cpp"
+#line 1479 "PFCfgLexer.cpp"
 					}
 				}
 	else {
@@ -1502,11 +1503,11 @@ void PFCfgLexer::mSTRING(bool _createToken) {
 			matchNot('\"' /* charlit */ );
 		}
 		else {
-			goto _loop348;
+			goto _loop350;
 		}
 		
 	}
-	_loop348:;
+	_loop350:;
 	} // ( ... )*
 	match('\"' /* charlit */ );
 	if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
diff --git a/src/parsers/PFCfgLexer.hpp b/src/parsers/PFCfgLexer.hpp
index a2eec961c..ee04a539c 100644
--- a/src/parsers/PFCfgLexer.hpp
+++ b/src/parsers/PFCfgLexer.hpp
@@ -9,7 +9,7 @@
 
 #line 11 "PFCfgLexer.hpp"
 #include <antlr/config.hpp>
-/* $ANTLR 2.7.7 (20090306): "pf.g" -> "PFCfgLexer.hpp"$ */
+/* $ANTLR 2.7.7 (20100319): "pf.g" -> "PFCfgLexer.hpp"$ */
 #include <antlr/CommonToken.hpp>
 #include <antlr/InputBuffer.hpp>
 #include <antlr/BitSet.hpp>
diff --git a/src/parsers/PFCfgParser.cpp b/src/parsers/PFCfgParser.cpp
index 706125d25..f78c0ff11 100644
--- a/src/parsers/PFCfgParser.cpp
+++ b/src/parsers/PFCfgParser.cpp
@@ -1,4 +1,4 @@
-/* $ANTLR 2.7.7 (20090306): "pf.g" -> "PFCfgParser.cpp"$ */
+/* $ANTLR 2.7.7 (20100319): "pf.g" -> "PFCfgParser.cpp"$ */
 #line 43 "pf.g"
 
     // gets inserted before the antlr generated includes in the cpp
@@ -45,7 +45,6 @@ PFCfgParser::PFCfgParser(const ANTLR_USE_NAMESPACE(antlr)ParserSharedInputState&
 }
 
 void PFCfgParser::cfgfile() {
-	Tracer traceInOut(this, "cfgfile");
 	
 	try {      // for error handling
 		{ // ( ... )*
@@ -152,7 +151,6 @@ void PFCfgParser::cfgfile() {
 }
 
 void PFCfgParser::comment() {
-	Tracer traceInOut(this, "comment");
 	
 	try {      // for error handling
 		match(LINE_COMMENT);
@@ -164,7 +162,6 @@ void PFCfgParser::comment() {
 }
 
 void PFCfgParser::include_command() {
-	Tracer traceInOut(this, "include_command");
 	
 	try {      // for error handling
 		match(INCLUDE_COMMAND);
@@ -176,7 +173,7 @@ void PFCfgParser::include_command() {
 		QString("Error: import of 'include' commands is not supported."));
 		consumeUntil(NEWLINE);
 		
-#line 180 "PFCfgParser.cpp"
+#line 177 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -185,7 +182,6 @@ void PFCfgParser::include_command() {
 }
 
 void PFCfgParser::macro_definition() {
-	Tracer traceInOut(this, "macro_definition");
 	
 	try {      // for error handling
 		match(WORD);
@@ -196,7 +192,7 @@ void PFCfgParser::macro_definition() {
 		importer->setCurrentLineNumber(LT(0)->getLine());
 		consumeUntil(NEWLINE);
 		
-#line 200 "PFCfgParser.cpp"
+#line 196 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -205,7 +201,6 @@ void PFCfgParser::macro_definition() {
 }
 
 void PFCfgParser::altq_rule() {
-	Tracer traceInOut(this, "altq_rule");
 	
 	try {      // for error handling
 		match(ALTQ);
@@ -217,7 +212,7 @@ void PFCfgParser::altq_rule() {
 		QString("import of 'altq' commands is not supported."));
 		consumeUntil(NEWLINE);
 		
-#line 221 "PFCfgParser.cpp"
+#line 216 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -226,7 +221,6 @@ void PFCfgParser::altq_rule() {
 }
 
 void PFCfgParser::antispoof_rule() {
-	Tracer traceInOut(this, "antispoof_rule");
 	
 	try {      // for error handling
 		match(ANTISPOOF);
@@ -238,7 +232,7 @@ void PFCfgParser::antispoof_rule() {
 		QString("Warning: import of 'antispoof' commands has not been implemented yet."));
 		consumeUntil(NEWLINE);
 		
-#line 242 "PFCfgParser.cpp"
+#line 236 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -247,7 +241,6 @@ void PFCfgParser::antispoof_rule() {
 }
 
 void PFCfgParser::queue_rule() {
-	Tracer traceInOut(this, "queue_rule");
 	
 	try {      // for error handling
 		match(QUEUE);
@@ -259,7 +252,7 @@ void PFCfgParser::queue_rule() {
 		QString("import of 'queue' commands is not supported."));
 		consumeUntil(NEWLINE);
 		
-#line 263 "PFCfgParser.cpp"
+#line 256 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -268,7 +261,6 @@ void PFCfgParser::queue_rule() {
 }
 
 void PFCfgParser::set_rule() {
-	Tracer traceInOut(this, "set_rule");
 	
 	try {      // for error handling
 		match(SET);
@@ -277,7 +269,7 @@ void PFCfgParser::set_rule() {
 		importer->clear();
 		importer->setCurrentLineNumber(LT(0)->getLine());
 		
-#line 281 "PFCfgParser.cpp"
+#line 273 "PFCfgParser.cpp"
 		{
 		switch ( LA(1)) {
 		case TIMEOUT:
@@ -364,7 +356,6 @@ void PFCfgParser::set_rule() {
 }
 
 void PFCfgParser::scrub_rule() {
-	Tracer traceInOut(this, "scrub_rule");
 	
 	try {      // for error handling
 		match(SCRUB);
@@ -376,7 +367,7 @@ void PFCfgParser::scrub_rule() {
 		importer->action = "scrub";
 		*dbg << LT(1)->getLine() << ":" << " scrub ";
 		
-#line 380 "PFCfgParser.cpp"
+#line 371 "PFCfgParser.cpp"
 		rule_extended();
 		match(NEWLINE);
 	}
@@ -387,7 +378,6 @@ void PFCfgParser::scrub_rule() {
 }
 
 void PFCfgParser::match_rule() {
-	Tracer traceInOut(this, "match_rule");
 	
 	try {      // for error handling
 		match(MATCH);
@@ -399,13 +389,13 @@ void PFCfgParser::match_rule() {
 		importer->action = "match";
 		*dbg << LT(1)->getLine() << ":" << " match ";
 		
-#line 403 "PFCfgParser.cpp"
+#line 393 "PFCfgParser.cpp"
 		rule_extended();
 #line 533 "pf.g"
 		
 		if ( ! importer->scrub_rule) importer->pushRule();
 		
-#line 409 "PFCfgParser.cpp"
+#line 399 "PFCfgParser.cpp"
 		match(NEWLINE);
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -415,7 +405,6 @@ void PFCfgParser::match_rule() {
 }
 
 void PFCfgParser::table_rule() {
-	Tracer traceInOut(this, "table_rule");
 	ANTLR_USE_NAMESPACE(antlr)RefToken  name = ANTLR_USE_NAMESPACE(antlr)nullToken;
 	ANTLR_USE_NAMESPACE(antlr)RefToken  file = ANTLR_USE_NAMESPACE(antlr)nullToken;
 	
@@ -426,7 +415,7 @@ void PFCfgParser::table_rule() {
 		importer->clear();
 		importer->setCurrentLineNumber(LT(0)->getLine());
 		
-#line 430 "PFCfgParser.cpp"
+#line 419 "PFCfgParser.cpp"
 		match(LESS_THAN);
 		name = LT(1);
 		match(WORD);
@@ -462,7 +451,7 @@ void PFCfgParser::table_rule() {
 			importer->addMessageToLog(
 			QString("Warning: attribute \"const\" will be dropped from table configuration since this attribute is not supported at this time"));
 			
-#line 466 "PFCfgParser.cpp"
+#line 455 "PFCfgParser.cpp"
 			break;
 		}
 		case NEWLINE:
@@ -488,7 +477,7 @@ void PFCfgParser::table_rule() {
 			importer->addMessageToLog(
 			QString("Warning: attribute \"counters\" will be dropped from table configuration since this attribute is not supported at this time"));
 			
-#line 492 "PFCfgParser.cpp"
+#line 481 "PFCfgParser.cpp"
 			break;
 		}
 		case NEWLINE:
@@ -515,7 +504,7 @@ void PFCfgParser::table_rule() {
 			importer->newAddressTableObject(
 			name->getText(), file->getText());
 			
-#line 519 "PFCfgParser.cpp"
+#line 508 "PFCfgParser.cpp"
 			break;
 		}
 		case OPENING_BRACE:
@@ -562,7 +551,7 @@ void PFCfgParser::table_rule() {
 			importer->newAddressTableObject(
 			name->getText(), importer->tmp_group);
 			
-#line 566 "PFCfgParser.cpp"
+#line 555 "PFCfgParser.cpp"
 			break;
 		}
 		case NEWLINE:
@@ -574,7 +563,7 @@ void PFCfgParser::table_rule() {
 			// Create run-time AddressTable object with name but no file spec.
 			importer->newAddressTableObject(name->getText(), "");
 			
-#line 578 "PFCfgParser.cpp"
+#line 567 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -591,7 +580,6 @@ void PFCfgParser::table_rule() {
 }
 
 void PFCfgParser::no_nat_rule() {
-	Tracer traceInOut(this, "no_nat_rule");
 	
 	try {      // for error handling
 		match(NO);
@@ -603,7 +591,7 @@ void PFCfgParser::no_nat_rule() {
 		importer->action = "nonat";
 		*dbg << LT(1)->getLine() << ":" << " nonat ";
 		
-#line 607 "PFCfgParser.cpp"
+#line 595 "PFCfgParser.cpp"
 		{
 		switch ( LA(1)) {
 		case NAT:
@@ -630,7 +618,6 @@ void PFCfgParser::no_nat_rule() {
 }
 
 void PFCfgParser::nat_rule() {
-	Tracer traceInOut(this, "nat_rule");
 	
 	try {      // for error handling
 		match(NAT);
@@ -645,7 +632,7 @@ void PFCfgParser::nat_rule() {
 		*dbg << LT(1)->getLine() << ":" << " nat ";
 		}
 		
-#line 649 "PFCfgParser.cpp"
+#line 636 "PFCfgParser.cpp"
 		{
 		switch ( LA(1)) {
 		case PASS:
@@ -656,7 +643,7 @@ void PFCfgParser::nat_rule() {
 			importer->error_tracker->registerError(
 			QString("import of 'nat pass' commands is not supported."));
 			
-#line 660 "PFCfgParser.cpp"
+#line 647 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case LOG:
@@ -816,7 +803,7 @@ void PFCfgParser::nat_rule() {
 			importer->error_tracker->registerError(
 			QString("import of 'nat ... tag' commands is not supported."));
 			
-#line 820 "PFCfgParser.cpp"
+#line 807 "PFCfgParser.cpp"
 			break;
 		}
 		case NEWLINE:
@@ -860,7 +847,7 @@ void PFCfgParser::nat_rule() {
 			
 			importer->nat_group = importer->tmp_group;
 			
-#line 864 "PFCfgParser.cpp"
+#line 851 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case PORT:
@@ -870,7 +857,7 @@ void PFCfgParser::nat_rule() {
 				
 				importer->nat_port_group = importer->tmp_port_group;
 				
-#line 874 "PFCfgParser.cpp"
+#line 861 "PFCfgParser.cpp"
 				break;
 			}
 			case NEWLINE:
@@ -916,7 +903,7 @@ void PFCfgParser::nat_rule() {
 				match(STATIC_PORT);
 #line 722 "pf.g"
 				importer->nat_rule_opt_2 = "static-port";
-#line 920 "PFCfgParser.cpp"
+#line 907 "PFCfgParser.cpp"
 				break;
 			}
 			case NEWLINE:
@@ -945,7 +932,7 @@ void PFCfgParser::nat_rule() {
 		
 		importer->pushRule();
 		
-#line 949 "PFCfgParser.cpp"
+#line 936 "PFCfgParser.cpp"
 		match(NEWLINE);
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -955,7 +942,6 @@ void PFCfgParser::nat_rule() {
 }
 
 void PFCfgParser::rdr_rule() {
-	Tracer traceInOut(this, "rdr_rule");
 	
 	try {      // for error handling
 		match(RDR);
@@ -970,7 +956,7 @@ void PFCfgParser::rdr_rule() {
 		*dbg << LT(1)->getLine() << ":" << " rdr ";
 		}
 		
-#line 974 "PFCfgParser.cpp"
+#line 960 "PFCfgParser.cpp"
 		{
 		switch ( LA(1)) {
 		case PASS:
@@ -981,7 +967,7 @@ void PFCfgParser::rdr_rule() {
 			importer->error_tracker->registerError(
 			QString("import of 'nat pass' commands is not supported."));
 			
-#line 985 "PFCfgParser.cpp"
+#line 971 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case LOG:
@@ -1141,7 +1127,7 @@ void PFCfgParser::rdr_rule() {
 			importer->error_tracker->registerError(
 			QString("import of 'nat ... tag' commands is not supported."));
 			
-#line 1145 "PFCfgParser.cpp"
+#line 1131 "PFCfgParser.cpp"
 			break;
 		}
 		case NEWLINE:
@@ -1185,7 +1171,7 @@ void PFCfgParser::rdr_rule() {
 			
 			importer->nat_group = importer->tmp_group;
 			
-#line 1189 "PFCfgParser.cpp"
+#line 1175 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case PORT:
@@ -1195,7 +1181,7 @@ void PFCfgParser::rdr_rule() {
 				
 				importer->nat_port_group = importer->tmp_port_group;
 				
-#line 1199 "PFCfgParser.cpp"
+#line 1185 "PFCfgParser.cpp"
 				break;
 			}
 			case NEWLINE:
@@ -1248,7 +1234,7 @@ void PFCfgParser::rdr_rule() {
 		
 		importer->pushRule();
 		
-#line 1252 "PFCfgParser.cpp"
+#line 1238 "PFCfgParser.cpp"
 		match(NEWLINE);
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -1258,7 +1244,6 @@ void PFCfgParser::rdr_rule() {
 }
 
 void PFCfgParser::binat_rule() {
-	Tracer traceInOut(this, "binat_rule");
 	
 	try {      // for error handling
 		match(BINAT);
@@ -1270,7 +1255,7 @@ void PFCfgParser::binat_rule() {
 		QString("import of 'binat' commands is not supported."));
 		consumeUntil(NEWLINE);
 		
-#line 1274 "PFCfgParser.cpp"
+#line 1259 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -1279,7 +1264,6 @@ void PFCfgParser::binat_rule() {
 }
 
 void PFCfgParser::pass_rule() {
-	Tracer traceInOut(this, "pass_rule");
 	
 	try {      // for error handling
 		match(PASS);
@@ -1291,13 +1275,13 @@ void PFCfgParser::pass_rule() {
 		importer->action = "pass";
 		*dbg << LT(1)->getLine() << ":" << " pass ";
 		
-#line 1295 "PFCfgParser.cpp"
+#line 1279 "PFCfgParser.cpp"
 		rule_extended();
 #line 941 "pf.g"
 		
 		importer->pushRule();
 		
-#line 1301 "PFCfgParser.cpp"
+#line 1285 "PFCfgParser.cpp"
 		match(NEWLINE);
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -1307,7 +1291,6 @@ void PFCfgParser::pass_rule() {
 }
 
 void PFCfgParser::block_rule() {
-	Tracer traceInOut(this, "block_rule");
 	
 	try {      // for error handling
 		match(BLOCK);
@@ -1319,7 +1302,7 @@ void PFCfgParser::block_rule() {
 		importer->action = "block";
 		*dbg << LT(1)->getLine() << ":" << " block   ";
 		
-#line 1323 "PFCfgParser.cpp"
+#line 1306 "PFCfgParser.cpp"
 		{
 		switch ( LA(1)) {
 		case DROP:
@@ -1352,12 +1335,13 @@ void PFCfgParser::block_rule() {
 		case FROM:
 		case ROUTE_TO:
 		case REPLY_TO:
+		case DUP_TO:
 		case GROUP:
 		case LITERAL_fragment:
-		case 144:
 		case 145:
 		case 146:
 		case 147:
+		case 148:
 		case FLAGS:
 		case ICMP_TYPE:
 		case ICMP6_TYPE:
@@ -1381,7 +1365,7 @@ void PFCfgParser::block_rule() {
 		
 		importer->pushRule();
 		
-#line 1385 "PFCfgParser.cpp"
+#line 1369 "PFCfgParser.cpp"
 		match(NEWLINE);
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -1391,7 +1375,6 @@ void PFCfgParser::block_rule() {
 }
 
 void PFCfgParser::set_timeout() {
-	Tracer traceInOut(this, "set_timeout");
 	
 	try {      // for error handling
 		match(TIMEOUT);
@@ -1439,7 +1422,6 @@ void PFCfgParser::set_timeout() {
 }
 
 void PFCfgParser::set_ruleset_optimization() {
-	Tracer traceInOut(this, "set_ruleset_optimization");
 	
 	try {      // for error handling
 		match(14);
@@ -1451,7 +1433,7 @@ void PFCfgParser::set_ruleset_optimization() {
 		QString("Error: import of 'set ruleset-optimization' commands is not supported."));
 		consumeUntil(NEWLINE);
 		
-#line 1455 "PFCfgParser.cpp"
+#line 1437 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -1460,7 +1442,6 @@ void PFCfgParser::set_ruleset_optimization() {
 }
 
 void PFCfgParser::set_optimization() {
-	Tracer traceInOut(this, "set_optimization");
 	
 	try {      // for error handling
 		match(LITERAL_optimization);
@@ -1499,7 +1480,7 @@ void PFCfgParser::set_optimization() {
 		}
 #line 276 "pf.g"
 		importer->set_optimization = LT(0)->getText();
-#line 1503 "PFCfgParser.cpp"
+#line 1484 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -1508,7 +1489,6 @@ void PFCfgParser::set_optimization() {
 }
 
 void PFCfgParser::set_limit() {
-	Tracer traceInOut(this, "set_limit");
 	
 	try {      // for error handling
 		match(LITERAL_limit);
@@ -1542,7 +1522,6 @@ void PFCfgParser::set_limit() {
 }
 
 void PFCfgParser::set_loginterface() {
-	Tracer traceInOut(this, "set_loginterface");
 	
 	try {      // for error handling
 		match(LITERAL_loginterface);
@@ -1554,7 +1533,7 @@ void PFCfgParser::set_loginterface() {
 		QString("Error: import of 'set loginterface' commands is not supported."));
 		consumeUntil(NEWLINE);
 		
-#line 1558 "PFCfgParser.cpp"
+#line 1537 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -1563,7 +1542,6 @@ void PFCfgParser::set_loginterface() {
 }
 
 void PFCfgParser::set_block_policy() {
-	Tracer traceInOut(this, "set_block_policy");
 	
 	try {      // for error handling
 		match(23);
@@ -1587,7 +1565,7 @@ void PFCfgParser::set_block_policy() {
 		}
 #line 299 "pf.g"
 		importer->set_block_policy = LT(0)->getText();
-#line 1591 "PFCfgParser.cpp"
+#line 1569 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -1596,7 +1574,6 @@ void PFCfgParser::set_block_policy() {
 }
 
 void PFCfgParser::set_state_policy() {
-	Tracer traceInOut(this, "set_state_policy");
 	
 	try {      // for error handling
 		match(26);
@@ -1620,7 +1597,7 @@ void PFCfgParser::set_state_policy() {
 		}
 #line 305 "pf.g"
 		importer->set_state_policy = LT(0)->getText();
-#line 1624 "PFCfgParser.cpp"
+#line 1601 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -1629,7 +1606,6 @@ void PFCfgParser::set_state_policy() {
 }
 
 void PFCfgParser::set_state_defaults() {
-	Tracer traceInOut(this, "set_state_defaults");
 	
 	try {      // for error handling
 		match(29);
@@ -1641,7 +1617,7 @@ void PFCfgParser::set_state_defaults() {
 		QString("Error: import of 'set state-defaults' commands is not supported."));
 		consumeUntil(NEWLINE);
 		
-#line 1645 "PFCfgParser.cpp"
+#line 1621 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -1650,7 +1626,6 @@ void PFCfgParser::set_state_defaults() {
 }
 
 void PFCfgParser::set_require_order() {
-	Tracer traceInOut(this, "set_require_order");
 	
 	try {      // for error handling
 		match(30);
@@ -1662,7 +1637,7 @@ void PFCfgParser::set_require_order() {
 		QString("Error: import of 'set require-order' commands is not supported."));
 		consumeUntil(NEWLINE);
 		
-#line 1666 "PFCfgParser.cpp"
+#line 1641 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -1671,7 +1646,6 @@ void PFCfgParser::set_require_order() {
 }
 
 void PFCfgParser::set_fingerprints() {
-	Tracer traceInOut(this, "set_fingerprints");
 	
 	try {      // for error handling
 		match(LITERAL_fingerprints);
@@ -1683,7 +1657,7 @@ void PFCfgParser::set_fingerprints() {
 		QString("Error: import of 'set fingerprints' commands is not supported."));
 		consumeUntil(NEWLINE);
 		
-#line 1687 "PFCfgParser.cpp"
+#line 1661 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -1692,7 +1666,6 @@ void PFCfgParser::set_fingerprints() {
 }
 
 void PFCfgParser::set_skip() {
-	Tracer traceInOut(this, "set_skip");
 	
 	try {      // for error handling
 		match(LITERAL_skip);
@@ -1706,7 +1679,6 @@ void PFCfgParser::set_skip() {
 }
 
 void PFCfgParser::set_debug() {
-	Tracer traceInOut(this, "set_debug");
 	
 	try {      // for error handling
 		match(LITERAL_debug);
@@ -1715,7 +1687,7 @@ void PFCfgParser::set_debug() {
 		
 		importer->set_debug = LT(0)->getText();
 		
-#line 1719 "PFCfgParser.cpp"
+#line 1691 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -1724,7 +1696,6 @@ void PFCfgParser::set_debug() {
 }
 
 void PFCfgParser::set_reassemble() {
-	Tracer traceInOut(this, "set_reassemble");
 	
 	try {      // for error handling
 		match(LITERAL_reassemble);
@@ -1736,7 +1707,7 @@ void PFCfgParser::set_reassemble() {
 		QString("Error: import of 'set reassemble' commands is not supported."));
 		consumeUntil(NEWLINE);
 		
-#line 1740 "PFCfgParser.cpp"
+#line 1711 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -1745,7 +1716,6 @@ void PFCfgParser::set_reassemble() {
 }
 
 void PFCfgParser::set_hostid() {
-	Tracer traceInOut(this, "set_hostid");
 	
 	try {      // for error handling
 		match(LITERAL_hostid);
@@ -1757,7 +1727,7 @@ void PFCfgParser::set_hostid() {
 		QString("Error: import of 'set hostid' commands is not supported."));
 		consumeUntil(NEWLINE);
 		
-#line 1761 "PFCfgParser.cpp"
+#line 1731 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -1766,10 +1736,9 @@ void PFCfgParser::set_hostid() {
 }
 
 void PFCfgParser::timeout_def() {
-	Tracer traceInOut(this, "timeout_def");
 #line 409 "pf.g"
 	std::string timeout_name, timeout_value;
-#line 1773 "PFCfgParser.cpp"
+#line 1742 "PFCfgParser.cpp"
 	
 	try {      // for error handling
 		{
@@ -1879,7 +1848,7 @@ void PFCfgParser::timeout_def() {
 		
 		timeout_name = LT(0)->getText();
 		
-#line 1883 "PFCfgParser.cpp"
+#line 1852 "PFCfgParser.cpp"
 		match(INT_CONST);
 #line 454 "pf.g"
 		
@@ -1887,7 +1856,7 @@ void PFCfgParser::timeout_def() {
 		importer->timeouts.push_back(
 		std::pair<std::string, std::string>(timeout_name, timeout_value));
 		
-#line 1891 "PFCfgParser.cpp"
+#line 1860 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -1896,7 +1865,6 @@ void PFCfgParser::timeout_def() {
 }
 
 void PFCfgParser::timeout_def_list() {
-	Tracer traceInOut(this, "timeout_def_list");
 	
 	try {      // for error handling
 		match(OPENING_BRACE);
@@ -1957,10 +1925,9 @@ void PFCfgParser::timeout_def_list() {
 }
 
 void PFCfgParser::limit_def() {
-	Tracer traceInOut(this, "limit_def");
 #line 472 "pf.g"
 	std::string limit_name, limit_value;
-#line 1964 "PFCfgParser.cpp"
+#line 1931 "PFCfgParser.cpp"
 	
 	try {      // for error handling
 		{
@@ -2000,7 +1967,7 @@ void PFCfgParser::limit_def() {
 		
 		limit_name = LT(0)->getText();
 		
-#line 2004 "PFCfgParser.cpp"
+#line 1971 "PFCfgParser.cpp"
 		match(INT_CONST);
 #line 489 "pf.g"
 		
@@ -2008,7 +1975,7 @@ void PFCfgParser::limit_def() {
 		importer->limits.push_back(
 		std::pair<std::string, std::string>(limit_name, limit_value));
 		
-#line 2012 "PFCfgParser.cpp"
+#line 1979 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -2017,7 +1984,6 @@ void PFCfgParser::limit_def() {
 }
 
 void PFCfgParser::limit_def_list() {
-	Tracer traceInOut(this, "limit_def_list");
 	
 	try {      // for error handling
 		match(OPENING_BRACE);
@@ -2064,7 +2030,6 @@ void PFCfgParser::limit_def_list() {
 }
 
 void PFCfgParser::skip_def() {
-	Tracer traceInOut(this, "skip_def");
 	
 	try {      // for error handling
 		switch ( LA(1)) {
@@ -2073,7 +2038,7 @@ void PFCfgParser::skip_def() {
 			match(WORD);
 #line 351 "pf.g"
 			importer->set_skip_on.push_back(LT(0)->getText());
-#line 2077 "PFCfgParser.cpp"
+#line 2042 "PFCfgParser.cpp"
 			break;
 		}
 		case OPENING_BRACE:
@@ -2094,14 +2059,13 @@ void PFCfgParser::skip_def() {
 }
 
 void PFCfgParser::skip_list() {
-	Tracer traceInOut(this, "skip_list");
 	
 	try {      // for error handling
 		match(OPENING_BRACE);
 		match(WORD);
 #line 360 "pf.g"
 		importer->set_skip_on.push_back(LT(0)->getText());
-#line 2105 "PFCfgParser.cpp"
+#line 2069 "PFCfgParser.cpp"
 		{ // ( ... )*
 		for (;;) {
 			if ((LA(1) == WORD || LA(1) == COMMA)) {
@@ -2120,7 +2084,7 @@ void PFCfgParser::skip_list() {
 				match(WORD);
 #line 363 "pf.g"
 				importer->set_skip_on.push_back(LT(0)->getText());
-#line 2124 "PFCfgParser.cpp"
+#line 2088 "PFCfgParser.cpp"
 			}
 			else {
 				goto _loop33;
@@ -2138,7 +2102,6 @@ void PFCfgParser::skip_list() {
 }
 
 void PFCfgParser::rule_extended() {
-	Tracer traceInOut(this, "rule_extended");
 	
 	try {      // for error handling
 		{
@@ -2168,12 +2131,13 @@ void PFCfgParser::rule_extended() {
 		case FROM:
 		case ROUTE_TO:
 		case REPLY_TO:
+		case DUP_TO:
 		case GROUP:
 		case LITERAL_fragment:
-		case 144:
 		case 145:
 		case 146:
 		case 147:
+		case 148:
 		case FLAGS:
 		case ICMP_TYPE:
 		case ICMP6_TYPE:
@@ -2217,12 +2181,13 @@ void PFCfgParser::rule_extended() {
 		case FROM:
 		case ROUTE_TO:
 		case REPLY_TO:
+		case DUP_TO:
 		case GROUP:
 		case LITERAL_fragment:
-		case 144:
 		case 145:
 		case 146:
 		case 147:
+		case 148:
 		case FLAGS:
 		case ICMP_TYPE:
 		case ICMP6_TYPE:
@@ -2264,12 +2229,13 @@ void PFCfgParser::rule_extended() {
 		case FROM:
 		case ROUTE_TO:
 		case REPLY_TO:
+		case DUP_TO:
 		case GROUP:
 		case LITERAL_fragment:
-		case 144:
 		case 145:
 		case 146:
 		case 147:
+		case 148:
 		case FLAGS:
 		case ICMP_TYPE:
 		case ICMP6_TYPE:
@@ -2292,6 +2258,7 @@ void PFCfgParser::rule_extended() {
 		switch ( LA(1)) {
 		case ROUTE_TO:
 		case REPLY_TO:
+		case DUP_TO:
 		{
 			route();
 			break;
@@ -2312,10 +2279,10 @@ void PFCfgParser::rule_extended() {
 		case FROM:
 		case GROUP:
 		case LITERAL_fragment:
-		case 144:
 		case 145:
 		case 146:
 		case 147:
+		case 148:
 		case FLAGS:
 		case ICMP_TYPE:
 		case ICMP6_TYPE:
@@ -2356,10 +2323,10 @@ void PFCfgParser::rule_extended() {
 		case FROM:
 		case GROUP:
 		case LITERAL_fragment:
-		case 144:
 		case 145:
 		case 146:
 		case 147:
+		case 148:
 		case FLAGS:
 		case ICMP_TYPE:
 		case ICMP6_TYPE:
@@ -2398,10 +2365,10 @@ void PFCfgParser::rule_extended() {
 		case FROM:
 		case GROUP:
 		case LITERAL_fragment:
-		case 144:
 		case 145:
 		case 146:
 		case 147:
+		case 148:
 		case FLAGS:
 		case ICMP_TYPE:
 		case ICMP6_TYPE:
@@ -2442,10 +2409,10 @@ void PFCfgParser::rule_extended() {
 		case USER:
 		case GROUP:
 		case LITERAL_fragment:
-		case 144:
 		case 145:
 		case 146:
 		case 147:
+		case 148:
 		case FLAGS:
 		case ICMP_TYPE:
 		case ICMP6_TYPE:
@@ -2477,10 +2444,9 @@ void PFCfgParser::rule_extended() {
 }
 
 void PFCfgParser::tableaddr_spec() {
-	Tracer traceInOut(this, "tableaddr_spec");
 #line 594 "pf.g"
 	AddressSpec as;
-#line 2484 "PFCfgParser.cpp"
+#line 2450 "PFCfgParser.cpp"
 	
 	try {      // for error handling
 		{
@@ -2490,7 +2456,7 @@ void PFCfgParser::tableaddr_spec() {
 			match(EXLAMATION);
 #line 595 "pf.g"
 			as.neg = true;
-#line 2494 "PFCfgParser.cpp"
+#line 2460 "PFCfgParser.cpp"
 			break;
 		}
 		case WORD:
@@ -2518,7 +2484,7 @@ void PFCfgParser::tableaddr_spec() {
 			as.at = AddressSpec::INTERFACE_OR_HOST_NAME;
 			as.address = LT(0)->getText();
 			
-#line 2522 "PFCfgParser.cpp"
+#line 2488 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case COLON:
@@ -2533,7 +2499,7 @@ void PFCfgParser::tableaddr_spec() {
 					
 					as.at = AddressSpec::INTERFACE_NETWORK;
 					
-#line 2537 "PFCfgParser.cpp"
+#line 2503 "PFCfgParser.cpp"
 					break;
 				}
 				case BROADCAST:
@@ -2543,7 +2509,7 @@ void PFCfgParser::tableaddr_spec() {
 					
 					as.at = AddressSpec::INTERFACE_BROADCAST;
 					
-#line 2547 "PFCfgParser.cpp"
+#line 2513 "PFCfgParser.cpp"
 					break;
 				}
 				case PEER:
@@ -2554,7 +2520,7 @@ void PFCfgParser::tableaddr_spec() {
 					importer->error_tracker->registerError(
 					QString("import of 'interface:peer' is not supported."));
 					
-#line 2558 "PFCfgParser.cpp"
+#line 2524 "PFCfgParser.cpp"
 					break;
 				}
 				case INT_CONST:
@@ -2565,7 +2531,7 @@ void PFCfgParser::tableaddr_spec() {
 					importer->error_tracker->registerError(
 					QString("import of 'interface:0' is not supported."));
 					
-#line 2569 "PFCfgParser.cpp"
+#line 2535 "PFCfgParser.cpp"
 					break;
 				}
 				default:
@@ -2603,7 +2569,7 @@ void PFCfgParser::tableaddr_spec() {
 			as.at = AddressSpec::SPECIAL_ADDRESS;
 			as.address = "self";
 			
-#line 2607 "PFCfgParser.cpp"
+#line 2573 "PFCfgParser.cpp"
 			break;
 		}
 		case INT_CONST:
@@ -2638,7 +2604,7 @@ void PFCfgParser::tableaddr_spec() {
 			as.at = AddressSpec::HOST_ADDRESS;
 			as.address = LT(0)->getText();
 			
-#line 2642 "PFCfgParser.cpp"
+#line 2608 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case SLASH:
@@ -2648,7 +2614,7 @@ void PFCfgParser::tableaddr_spec() {
 				
 				as.at = AddressSpec::NETWORK_ADDRESS;
 				
-#line 2652 "PFCfgParser.cpp"
+#line 2618 "PFCfgParser.cpp"
 				{
 				switch ( LA(1)) {
 				case IPV4:
@@ -2671,7 +2637,7 @@ void PFCfgParser::tableaddr_spec() {
 				
 				as.netmask = LT(0)->getText(); 
 				
-#line 2675 "PFCfgParser.cpp"
+#line 2641 "PFCfgParser.cpp"
 				break;
 			}
 			case WORD:
@@ -2703,7 +2669,7 @@ void PFCfgParser::tableaddr_spec() {
 		
 		importer->tmp_group.push_back(as);
 		
-#line 2707 "PFCfgParser.cpp"
+#line 2673 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -2712,7 +2678,6 @@ void PFCfgParser::tableaddr_spec() {
 }
 
 void PFCfgParser::logging() {
-	Tracer traceInOut(this, "logging");
 	
 	try {      // for error handling
 		match(LOG);
@@ -2746,7 +2711,7 @@ void PFCfgParser::logging() {
 		}
 #line 1032 "pf.g"
 		importer->logging = true;
-#line 2750 "PFCfgParser.cpp"
+#line 2715 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -2755,7 +2720,6 @@ void PFCfgParser::logging() {
 }
 
 void PFCfgParser::intrface() {
-	Tracer traceInOut(this, "intrface");
 	
 	try {      // for error handling
 		match(ON);
@@ -2786,7 +2750,6 @@ void PFCfgParser::intrface() {
 }
 
 void PFCfgParser::address_family() {
-	Tracer traceInOut(this, "address_family");
 	
 	try {      // for error handling
 		switch ( LA(1)) {
@@ -2802,7 +2765,7 @@ void PFCfgParser::address_family() {
 			
 			importer->address_family = LT(0)->getText();
 			
-#line 2806 "PFCfgParser.cpp"
+#line 2769 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -2818,7 +2781,6 @@ void PFCfgParser::address_family() {
 }
 
 void PFCfgParser::protospec() {
-	Tracer traceInOut(this, "protospec");
 	
 	try {      // for error handling
 		match(PROTO);
@@ -2831,7 +2793,6 @@ void PFCfgParser::protospec() {
 }
 
 void PFCfgParser::hosts() {
-	Tracer traceInOut(this, "hosts");
 	
 	try {      // for error handling
 		switch ( LA(1)) {
@@ -2845,7 +2806,7 @@ void PFCfgParser::hosts() {
 			importer->dst_group.push_back(
 			AddressSpec(AddressSpec::ANY, false, "0.0.0.0", "0.0.0.0"));
 			
-#line 2849 "PFCfgParser.cpp"
+#line 2810 "PFCfgParser.cpp"
 			break;
 		}
 		case NEWLINE:
@@ -2861,10 +2822,10 @@ void PFCfgParser::hosts() {
 		case FROM:
 		case GROUP:
 		case LITERAL_fragment:
-		case 144:
 		case 145:
 		case 146:
 		case 147:
+		case 148:
 		case FLAGS:
 		case ICMP_TYPE:
 		case ICMP6_TYPE:
@@ -2894,10 +2855,10 @@ void PFCfgParser::hosts() {
 			case TO:
 			case GROUP:
 			case LITERAL_fragment:
-			case 144:
 			case 145:
 			case 146:
 			case 147:
+			case 148:
 			case FLAGS:
 			case ICMP_TYPE:
 			case ICMP6_TYPE:
@@ -2934,10 +2895,10 @@ void PFCfgParser::hosts() {
 			case USER:
 			case GROUP:
 			case LITERAL_fragment:
-			case 144:
 			case 145:
 			case 146:
 			case 147:
+			case 148:
 			case FLAGS:
 			case ICMP_TYPE:
 			case ICMP6_TYPE:
@@ -2971,7 +2932,6 @@ void PFCfgParser::hosts() {
 }
 
 void PFCfgParser::tagged() {
-	Tracer traceInOut(this, "tagged");
 	
 	try {      // for error handling
 		{
@@ -2979,9 +2939,9 @@ void PFCfgParser::tagged() {
 		case EXLAMATION:
 		{
 			match(EXLAMATION);
-#line 1671 "pf.g"
+#line 1678 "pf.g"
 			importer->tagged_neg = true;
-#line 2985 "PFCfgParser.cpp"
+#line 2945 "PFCfgParser.cpp"
 			break;
 		}
 		case TAGGED:
@@ -2996,11 +2956,11 @@ void PFCfgParser::tagged() {
 		}
 		match(TAGGED);
 		match(WORD);
-#line 1673 "pf.g"
+#line 1680 "pf.g"
 		
 		importer->tagged = LT(0)->getText();
 		
-#line 3004 "PFCfgParser.cpp"
+#line 2964 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -3009,16 +2969,15 @@ void PFCfgParser::tagged() {
 }
 
 void PFCfgParser::tag_clause() {
-	Tracer traceInOut(this, "tag_clause");
 	
 	try {      // for error handling
 		match(TAG);
 		match(WORD);
-#line 1680 "pf.g"
+#line 1687 "pf.g"
 		
 		importer->tag = LT(0)->getText();
 		
-#line 3022 "PFCfgParser.cpp"
+#line 2981 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -3027,10 +2986,9 @@ void PFCfgParser::tag_clause() {
 }
 
 void PFCfgParser::redirhost() {
-	Tracer traceInOut(this, "redirhost");
 #line 789 "pf.g"
 	AddressSpec as;
-#line 3034 "PFCfgParser.cpp"
+#line 2992 "PFCfgParser.cpp"
 	
 	try {      // for error handling
 		{
@@ -3043,7 +3001,7 @@ void PFCfgParser::redirhost() {
 			as.at = AddressSpec::HOST_ADDRESS;
 			as.address = LT(0)->getText();
 			
-#line 3047 "PFCfgParser.cpp"
+#line 3005 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case SLASH:
@@ -3053,7 +3011,7 @@ void PFCfgParser::redirhost() {
 				
 				as.at = AddressSpec::NETWORK_ADDRESS;
 				
-#line 3057 "PFCfgParser.cpp"
+#line 3015 "PFCfgParser.cpp"
 				{
 				switch ( LA(1)) {
 				case IPV4:
@@ -3076,7 +3034,7 @@ void PFCfgParser::redirhost() {
 				
 				as.netmask = LT(0)->getText(); 
 				
-#line 3080 "PFCfgParser.cpp"
+#line 3038 "PFCfgParser.cpp"
 				break;
 			}
 			case NEWLINE:
@@ -3112,7 +3070,7 @@ void PFCfgParser::redirhost() {
 			as.at = AddressSpec::INTERFACE_OR_HOST_NAME;
 			as.address = LT(0)->getText();
 			
-#line 3116 "PFCfgParser.cpp"
+#line 3074 "PFCfgParser.cpp"
 			match(CLOSING_PAREN);
 			break;
 		}
@@ -3125,7 +3083,7 @@ void PFCfgParser::redirhost() {
 			as.at = AddressSpec::INTERFACE_OR_HOST_NAME;
 			as.address = LT(0)->getText();
 			
-#line 3129 "PFCfgParser.cpp"
+#line 3087 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -3138,7 +3096,7 @@ void PFCfgParser::redirhost() {
 		
 		importer->tmp_group.push_back(as);
 		
-#line 3142 "PFCfgParser.cpp"
+#line 3100 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -3147,7 +3105,6 @@ void PFCfgParser::redirhost() {
 }
 
 void PFCfgParser::redirhost_list() {
-	Tracer traceInOut(this, "redirhost_list");
 	
 	try {      // for error handling
 		match(OPENING_BRACE);
@@ -3192,10 +3149,9 @@ void PFCfgParser::redirhost_list() {
 }
 
 void PFCfgParser::portspec() {
-	Tracer traceInOut(this, "portspec");
 #line 848 "pf.g"
 	PortSpec ps;
-#line 3199 "PFCfgParser.cpp"
+#line 3155 "PFCfgParser.cpp"
 	
 	try {      // for error handling
 		match(PORT);
@@ -3211,7 +3167,7 @@ void PFCfgParser::portspec() {
 			ps.port2 = ps.port1;
 			ps.port_op = "=";
 			
-#line 3215 "PFCfgParser.cpp"
+#line 3171 "PFCfgParser.cpp"
 			break;
 		}
 		case IPV6:
@@ -3221,7 +3177,7 @@ void PFCfgParser::portspec() {
 			
 			ps.setFromPortRange(LT(0)->getText());
 			
-#line 3225 "PFCfgParser.cpp"
+#line 3181 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case STAR:
@@ -3229,7 +3185,7 @@ void PFCfgParser::portspec() {
 				match(STAR);
 #line 865 "pf.g"
 				ps.port2 = "65535";
-#line 3233 "PFCfgParser.cpp"
+#line 3189 "PFCfgParser.cpp"
 				break;
 			}
 			case NEWLINE:
@@ -3259,7 +3215,7 @@ void PFCfgParser::portspec() {
 		
 		importer->tmp_port_group.push_back(ps);
 		
-#line 3263 "PFCfgParser.cpp"
+#line 3219 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -3268,7 +3224,6 @@ void PFCfgParser::portspec() {
 }
 
 void PFCfgParser::pooltype() {
-	Tracer traceInOut(this, "pooltype");
 	
 	try {      // for error handling
 		{
@@ -3278,7 +3233,7 @@ void PFCfgParser::pooltype() {
 			match(BITMASK);
 #line 882 "pf.g"
 			importer->nat_rule_opt_1 = "bitmask";
-#line 3282 "PFCfgParser.cpp"
+#line 3237 "PFCfgParser.cpp"
 			break;
 		}
 		case RANDOM:
@@ -3286,7 +3241,7 @@ void PFCfgParser::pooltype() {
 			match(RANDOM);
 #line 884 "pf.g"
 			importer->nat_rule_opt_1 = "random";
-#line 3290 "PFCfgParser.cpp"
+#line 3245 "PFCfgParser.cpp"
 			break;
 		}
 		case SOURCE_HASH:
@@ -3294,7 +3249,7 @@ void PFCfgParser::pooltype() {
 			match(SOURCE_HASH);
 #line 886 "pf.g"
 			importer->nat_rule_opt_1 = "source-hash";
-#line 3298 "PFCfgParser.cpp"
+#line 3253 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case HEX_KEY:
@@ -3306,7 +3261,7 @@ void PFCfgParser::pooltype() {
 				QString("import of 'nat' commands with 'source-hash hex-key' "
 				"option is not supported"));
 				
-#line 3310 "PFCfgParser.cpp"
+#line 3265 "PFCfgParser.cpp"
 				break;
 			}
 			case STRING_KEY:
@@ -3318,7 +3273,7 @@ void PFCfgParser::pooltype() {
 				QString("import of 'nat' commands with 'source-hash string-key' "
 				"option is not supported"));
 				
-#line 3322 "PFCfgParser.cpp"
+#line 3277 "PFCfgParser.cpp"
 				break;
 			}
 			case NEWLINE:
@@ -3340,7 +3295,7 @@ void PFCfgParser::pooltype() {
 			match(ROUND_ROBIN);
 #line 903 "pf.g"
 			importer->nat_rule_opt_1 = "round-robin";
-#line 3344 "PFCfgParser.cpp"
+#line 3299 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -3375,7 +3330,6 @@ void PFCfgParser::pooltype() {
 }
 
 void PFCfgParser::port_def() {
-	Tracer traceInOut(this, "port_def");
 	
 	try {      // for error handling
 		{
@@ -3396,11 +3350,11 @@ void PFCfgParser::port_def() {
 		}
 		}
 		}
-#line 1808 "pf.g"
+#line 1815 "pf.g"
 		
 		importer->tmp_port_def = LT(0)->getText();
 		
-#line 3404 "PFCfgParser.cpp"
+#line 3358 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -3409,7 +3363,6 @@ void PFCfgParser::port_def() {
 }
 
 void PFCfgParser::block_return() {
-	Tracer traceInOut(this, "block_return");
 	
 	try {      // for error handling
 		{
@@ -3419,7 +3372,7 @@ void PFCfgParser::block_return() {
 			match(DROP);
 #line 965 "pf.g"
 			importer->block_action_params.push_back("drop");
-#line 3423 "PFCfgParser.cpp"
+#line 3376 "PFCfgParser.cpp"
 			break;
 		}
 		case RETURN:
@@ -3427,7 +3380,7 @@ void PFCfgParser::block_return() {
 			match(RETURN);
 #line 967 "pf.g"
 			importer->block_action_params.push_back("return");
-#line 3431 "PFCfgParser.cpp"
+#line 3384 "PFCfgParser.cpp"
 			break;
 		}
 		case RETURN_RST:
@@ -3435,7 +3388,7 @@ void PFCfgParser::block_return() {
 			match(RETURN_RST);
 #line 969 "pf.g"
 			importer->block_action_params.push_back("return-rst");
-#line 3439 "PFCfgParser.cpp"
+#line 3392 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case TTL:
@@ -3447,7 +3400,7 @@ void PFCfgParser::block_return() {
 				importer->error_tracker->registerError(
 				QString("Import of \"block return-rst ttl number\" is not supported. "));
 				
-#line 3451 "PFCfgParser.cpp"
+#line 3404 "PFCfgParser.cpp"
 				break;
 			}
 			case NEWLINE:
@@ -3471,12 +3424,13 @@ void PFCfgParser::block_return() {
 			case FROM:
 			case ROUTE_TO:
 			case REPLY_TO:
+			case DUP_TO:
 			case GROUP:
 			case LITERAL_fragment:
-			case 144:
 			case 145:
 			case 146:
 			case 147:
+			case 148:
 			case FLAGS:
 			case ICMP_TYPE:
 			case ICMP6_TYPE:
@@ -3502,22 +3456,21 @@ void PFCfgParser::block_return() {
 			match(RETURN_ICMP);
 #line 978 "pf.g"
 			importer->block_action_params.push_back("return-icmp");
-#line 3506 "PFCfgParser.cpp"
+#line 3460 "PFCfgParser.cpp"
 			{
 			if ((LA(1) == OPENING_PAREN) && (_tokenSet_25.member(LA(2)))) {
 				match(OPENING_PAREN);
 				{
 				switch ( LA(1)) {
-				case 175:
 				case 176:
 				case 177:
 				case 178:
+				case 179:
 				case LITERAL_needfrag:
 				case LITERAL_srcfail:
-				case 181:
 				case 182:
+				case 183:
 				case LITERAL_isolate:
-				case 184:
 				case 185:
 				case 186:
 				case 187:
@@ -3530,14 +3483,15 @@ void PFCfgParser::block_return() {
 				case 194:
 				case 195:
 				case 196:
+				case 197:
 				case LITERAL_transit:
 				case LITERAL_reassemb:
 				case LITERAL_badhead:
 				case LITERAL_optmiss:
 				case LITERAL_badlen:
-				case 202:
 				case 203:
 				case 204:
+				case 205:
 				{
 					icmp_code_by_name();
 					break;
@@ -3555,7 +3509,7 @@ void PFCfgParser::block_return() {
 				}
 #line 982 "pf.g"
 				importer->block_action_params.push_back(LT(0)->getText());
-#line 3559 "PFCfgParser.cpp"
+#line 3513 "PFCfgParser.cpp"
 				{
 				switch ( LA(1)) {
 				case COMMA:
@@ -3563,16 +3517,15 @@ void PFCfgParser::block_return() {
 					match(COMMA);
 					{
 					switch ( LA(1)) {
-					case 175:
 					case 176:
 					case 177:
 					case 178:
+					case 179:
 					case LITERAL_needfrag:
 					case LITERAL_srcfail:
-					case 181:
 					case 182:
+					case 183:
 					case LITERAL_isolate:
-					case 184:
 					case 185:
 					case 186:
 					case 187:
@@ -3585,14 +3538,15 @@ void PFCfgParser::block_return() {
 					case 194:
 					case 195:
 					case 196:
+					case 197:
 					case LITERAL_transit:
 					case LITERAL_reassemb:
 					case LITERAL_badhead:
 					case LITERAL_optmiss:
 					case LITERAL_badlen:
-					case 202:
 					case 203:
 					case 204:
+					case 205:
 					{
 						icmp_code_by_name();
 						break;
@@ -3613,7 +3567,7 @@ void PFCfgParser::block_return() {
 					importer->error_tracker->registerError(
 					QString("Import of \"block return-icmp (icmp_code, icmp6_code)\" is not supported"));
 					
-#line 3617 "PFCfgParser.cpp"
+#line 3571 "PFCfgParser.cpp"
 					break;
 				}
 				case CLOSING_PAREN:
@@ -3646,7 +3600,7 @@ void PFCfgParser::block_return() {
 			QString("Import of \"block return-icmp6\" is not supported"));
 			importer->block_action_params.push_back("return-icmp");
 			
-#line 3650 "PFCfgParser.cpp"
+#line 3604 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -3663,16 +3617,10 @@ void PFCfgParser::block_return() {
 }
 
 void PFCfgParser::icmp_code_by_name() {
-	Tracer traceInOut(this, "icmp_code_by_name");
 	
 	try {      // for error handling
 		{
 		switch ( LA(1)) {
-		case 175:
-		{
-			match(175);
-			break;
-		}
 		case 176:
 		{
 			match(176);
@@ -3688,6 +3636,11 @@ void PFCfgParser::icmp_code_by_name() {
 			match(178);
 			break;
 		}
+		case 179:
+		{
+			match(179);
+			break;
+		}
 		case LITERAL_needfrag:
 		{
 			match(LITERAL_needfrag);
@@ -3698,26 +3651,21 @@ void PFCfgParser::icmp_code_by_name() {
 			match(LITERAL_srcfail);
 			break;
 		}
-		case 181:
-		{
-			match(181);
-			break;
-		}
 		case 182:
 		{
 			match(182);
 			break;
 		}
+		case 183:
+		{
+			match(183);
+			break;
+		}
 		case LITERAL_isolate:
 		{
 			match(LITERAL_isolate);
 			break;
 		}
-		case 184:
-		{
-			match(184);
-			break;
-		}
 		case 185:
 		{
 			match(185);
@@ -3778,6 +3726,11 @@ void PFCfgParser::icmp_code_by_name() {
 			match(196);
 			break;
 		}
+		case 197:
+		{
+			match(197);
+			break;
+		}
 		case LITERAL_transit:
 		{
 			match(LITERAL_transit);
@@ -3803,11 +3756,6 @@ void PFCfgParser::icmp_code_by_name() {
 			match(LITERAL_badlen);
 			break;
 		}
-		case 202:
-		{
-			match(202);
-			break;
-		}
 		case 203:
 		{
 			match(203);
@@ -3818,6 +3766,11 @@ void PFCfgParser::icmp_code_by_name() {
 			match(204);
 			break;
 		}
+		case 205:
+		{
+			match(205);
+			break;
+		}
 		default:
 		{
 			throw ANTLR_USE_NAMESPACE(antlr)NoViableAltException(LT(1), getFilename());
@@ -3832,7 +3785,6 @@ void PFCfgParser::icmp_code_by_name() {
 }
 
 void PFCfgParser::direction() {
-	Tracer traceInOut(this, "direction");
 	
 	try {      // for error handling
 		{
@@ -3857,7 +3809,7 @@ void PFCfgParser::direction() {
 		
 		importer->direction = LT(0)->getText();
 		
-#line 3861 "PFCfgParser.cpp"
+#line 3813 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -3866,7 +3818,6 @@ void PFCfgParser::direction() {
 }
 
 void PFCfgParser::quick_or_log() {
-	Tracer traceInOut(this, "quick_or_log");
 	
 	try {      // for error handling
 		{
@@ -3887,7 +3838,7 @@ void PFCfgParser::quick_or_log() {
 			}
 #line 1023 "pf.g"
 			importer->logging = true;
-#line 3891 "PFCfgParser.cpp"
+#line 3842 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case QUICK:
@@ -3895,7 +3846,7 @@ void PFCfgParser::quick_or_log() {
 				match(QUICK);
 #line 1024 "pf.g"
 				importer->quick = true;
-#line 3899 "PFCfgParser.cpp"
+#line 3850 "PFCfgParser.cpp"
 				break;
 			}
 			case NEWLINE:
@@ -3915,12 +3866,13 @@ void PFCfgParser::quick_or_log() {
 			case FROM:
 			case ROUTE_TO:
 			case REPLY_TO:
+			case DUP_TO:
 			case GROUP:
 			case LITERAL_fragment:
-			case 144:
 			case 145:
 			case 146:
 			case 147:
+			case 148:
 			case FLAGS:
 			case ICMP_TYPE:
 			case ICMP6_TYPE:
@@ -3946,7 +3898,7 @@ void PFCfgParser::quick_or_log() {
 			match(QUICK);
 #line 1026 "pf.g"
 			importer->quick = true;
-#line 3950 "PFCfgParser.cpp"
+#line 3902 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case LOG:
@@ -3965,7 +3917,7 @@ void PFCfgParser::quick_or_log() {
 				}
 #line 1027 "pf.g"
 				importer->logging = true;
-#line 3969 "PFCfgParser.cpp"
+#line 3921 "PFCfgParser.cpp"
 				break;
 			}
 			case NEWLINE:
@@ -3985,12 +3937,13 @@ void PFCfgParser::quick_or_log() {
 			case FROM:
 			case ROUTE_TO:
 			case REPLY_TO:
+			case DUP_TO:
 			case GROUP:
 			case LITERAL_fragment:
-			case 144:
 			case 145:
 			case 146:
 			case 147:
+			case 148:
 			case FLAGS:
 			case ICMP_TYPE:
 			case ICMP6_TYPE:
@@ -4025,7 +3978,6 @@ void PFCfgParser::quick_or_log() {
 }
 
 void PFCfgParser::route() {
-	Tracer traceInOut(this, "route");
 	
 	try {      // for error handling
 		switch ( LA(1)) {
@@ -4039,6 +3991,11 @@ void PFCfgParser::route() {
 			reply_to();
 			break;
 		}
+		case DUP_TO:
+		{
+			dup_to();
+			break;
+		}
 		default:
 		{
 			throw ANTLR_USE_NAMESPACE(antlr)NoViableAltException(LT(1), getFilename());
@@ -4052,7 +4009,6 @@ void PFCfgParser::route() {
 }
 
 void PFCfgParser::filteropts() {
-	Tracer traceInOut(this, "filteropts");
 	
 	try {      // for error handling
 		filteropt();
@@ -4075,10 +4031,10 @@ void PFCfgParser::filteropts() {
 				case USER:
 				case GROUP:
 				case LITERAL_fragment:
-				case 144:
 				case 145:
 				case 146:
 				case 147:
+				case 148:
 				case FLAGS:
 				case ICMP_TYPE:
 				case ICMP6_TYPE:
@@ -4100,11 +4056,11 @@ void PFCfgParser::filteropts() {
 				filteropt();
 			}
 			else {
-				goto _loop200;
+				goto _loop202;
 			}
 			
 		}
-		_loop200:;
+		_loop202:;
 		} // ( ... )*
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -4114,7 +4070,6 @@ void PFCfgParser::filteropts() {
 }
 
 void PFCfgParser::logopts() {
-	Tracer traceInOut(this, "logopts");
 	
 	try {      // for error handling
 		match(OPENING_PAREN);
@@ -4125,7 +4080,7 @@ void PFCfgParser::logopts() {
 				match(COMMA);
 #line 1039 "pf.g"
 				importer->logopts += ",";
-#line 4129 "PFCfgParser.cpp"
+#line 4084 "PFCfgParser.cpp"
 				logopt();
 			}
 			else {
@@ -4144,7 +4099,6 @@ void PFCfgParser::logopts() {
 }
 
 void PFCfgParser::logopt() {
-	Tracer traceInOut(this, "logopt");
 	
 	try {      // for error handling
 		switch ( LA(1)) {
@@ -4166,7 +4120,7 @@ void PFCfgParser::logopt() {
 			
 			importer->logopts += LT(0)->getText();
 			
-#line 4170 "PFCfgParser.cpp"
+#line 4124 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -4182,10 +4136,9 @@ void PFCfgParser::logopt() {
 }
 
 void PFCfgParser::ifspec() {
-	Tracer traceInOut(this, "ifspec");
 #line 1054 "pf.g"
 	InterfaceSpec is;
-#line 4189 "PFCfgParser.cpp"
+#line 4142 "PFCfgParser.cpp"
 	
 	try {      // for error handling
 		{
@@ -4195,7 +4148,7 @@ void PFCfgParser::ifspec() {
 			match(EXLAMATION);
 #line 1055 "pf.g"
 			is.neg = true;
-#line 4199 "PFCfgParser.cpp"
+#line 4152 "PFCfgParser.cpp"
 			break;
 		}
 		case WORD:
@@ -4215,7 +4168,7 @@ void PFCfgParser::ifspec() {
 		importer->iface_group.push_back(is);
 		importer->newInterface(is.name);
 		
-#line 4219 "PFCfgParser.cpp"
+#line 4172 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -4224,7 +4177,6 @@ void PFCfgParser::ifspec() {
 }
 
 void PFCfgParser::interface_list() {
-	Tracer traceInOut(this, "interface_list");
 	
 	try {      // for error handling
 		match(OPENING_BRACE);
@@ -4268,7 +4220,6 @@ void PFCfgParser::interface_list() {
 }
 
 void PFCfgParser::proto_def() {
-	Tracer traceInOut(this, "proto_def");
 	
 	try {      // for error handling
 		{
@@ -4317,7 +4268,6 @@ void PFCfgParser::proto_def() {
 }
 
 void PFCfgParser::proto_name() {
-	Tracer traceInOut(this, "proto_name");
 	
 	try {      // for error handling
 		{
@@ -4412,7 +4362,7 @@ void PFCfgParser::proto_name() {
 		
 		importer->proto_list.push_back(LT(0)->getText());
 		
-#line 4416 "PFCfgParser.cpp"
+#line 4366 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -4421,7 +4371,6 @@ void PFCfgParser::proto_name() {
 }
 
 void PFCfgParser::proto_number() {
-	Tracer traceInOut(this, "proto_number");
 	
 	try {      // for error handling
 		match(INT_CONST);
@@ -4429,7 +4378,7 @@ void PFCfgParser::proto_number() {
 		
 		importer->proto_list.push_back(LT(0)->getText());
 		
-#line 4433 "PFCfgParser.cpp"
+#line 4382 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -4438,7 +4387,6 @@ void PFCfgParser::proto_number() {
 }
 
 void PFCfgParser::proto_list() {
-	Tracer traceInOut(this, "proto_list");
 	
 	try {      // for error handling
 		match(OPENING_BRACE);
@@ -4498,7 +4446,6 @@ void PFCfgParser::proto_list() {
 }
 
 void PFCfgParser::hosts_from() {
-	Tracer traceInOut(this, "hosts_from");
 	
 	try {      // for error handling
 		match(FROM);
@@ -4522,10 +4469,10 @@ void PFCfgParser::hosts_from() {
 		case TO:
 		case GROUP:
 		case LITERAL_fragment:
-		case 144:
 		case 145:
 		case 146:
 		case 147:
+		case 148:
 		case FLAGS:
 		case ICMP_TYPE:
 		case ICMP6_TYPE:
@@ -4552,7 +4499,6 @@ void PFCfgParser::hosts_from() {
 }
 
 void PFCfgParser::hosts_to() {
-	Tracer traceInOut(this, "hosts_to");
 	
 	try {      // for error handling
 		match(TO);
@@ -4575,10 +4521,10 @@ void PFCfgParser::hosts_to() {
 		case USER:
 		case GROUP:
 		case LITERAL_fragment:
-		case 144:
 		case 145:
 		case 146:
 		case 147:
+		case 148:
 		case FLAGS:
 		case ICMP_TYPE:
 		case ICMP6_TYPE:
@@ -4605,7 +4551,6 @@ void PFCfgParser::hosts_to() {
 }
 
 void PFCfgParser::src_hosts_part() {
-	Tracer traceInOut(this, "src_hosts_part");
 	
 	try {      // for error handling
 		{
@@ -4633,7 +4578,7 @@ void PFCfgParser::src_hosts_part() {
 			AddressSpec(AddressSpec::SPECIAL_ADDRESS, false,
 			"urpf-failed", ""));
 			
-#line 4637 "PFCfgParser.cpp"
+#line 4582 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -4648,7 +4593,7 @@ void PFCfgParser::src_hosts_part() {
 		importer->src_group.splice(importer->src_group.begin(),
 		importer->tmp_group);
 		
-#line 4652 "PFCfgParser.cpp"
+#line 4597 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -4657,7 +4602,6 @@ void PFCfgParser::src_hosts_part() {
 }
 
 void PFCfgParser::src_port_part() {
-	Tracer traceInOut(this, "src_port_part");
 	
 	try {      // for error handling
 		match(PORT);
@@ -4685,12 +4629,12 @@ void PFCfgParser::src_port_part() {
 		}
 		}
 		}
-#line 1729 "pf.g"
+#line 1736 "pf.g"
 		
 		importer->src_port_group.splice(importer->src_port_group.begin(),
 		importer->tmp_port_group);
 		
-#line 4694 "PFCfgParser.cpp"
+#line 4638 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -4699,7 +4643,6 @@ void PFCfgParser::src_port_part() {
 }
 
 void PFCfgParser::dst_hosts_part() {
-	Tracer traceInOut(this, "dst_hosts_part");
 	
 	try {      // for error handling
 		common_hosts_part();
@@ -4709,7 +4652,7 @@ void PFCfgParser::dst_hosts_part() {
 		importer->dst_group.splice(importer->dst_group.begin(),
 		importer->tmp_group);
 		
-#line 4713 "PFCfgParser.cpp"
+#line 4656 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -4718,7 +4661,6 @@ void PFCfgParser::dst_hosts_part() {
 }
 
 void PFCfgParser::dst_port_part() {
-	Tracer traceInOut(this, "dst_port_part");
 	
 	try {      // for error handling
 		match(PORT);
@@ -4746,12 +4688,12 @@ void PFCfgParser::dst_port_part() {
 		}
 		}
 		}
-#line 1742 "pf.g"
+#line 1749 "pf.g"
 		
 		importer->dst_port_group.splice(importer->dst_port_group.begin(),
 		importer->tmp_port_group);
 		
-#line 4755 "PFCfgParser.cpp"
+#line 4697 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -4760,7 +4702,6 @@ void PFCfgParser::dst_port_part() {
 }
 
 void PFCfgParser::common_hosts_part() {
-	Tracer traceInOut(this, "common_hosts_part");
 	
 	try {      // for error handling
 		switch ( LA(1)) {
@@ -4772,7 +4713,7 @@ void PFCfgParser::common_hosts_part() {
 			importer->tmp_group.push_back(
 			AddressSpec(AddressSpec::ANY, false, "0.0.0.0", "0.0.0.0"));
 			
-#line 4776 "PFCfgParser.cpp"
+#line 4717 "PFCfgParser.cpp"
 			break;
 		}
 		case NO_ROUTE:
@@ -4783,7 +4724,7 @@ void PFCfgParser::common_hosts_part() {
 			importer->tmp_group.push_back(
 			AddressSpec(AddressSpec::SPECIAL_ADDRESS, false, "no-route", ""));
 			
-#line 4787 "PFCfgParser.cpp"
+#line 4728 "PFCfgParser.cpp"
 			break;
 		}
 		case WORD:
@@ -4815,12 +4756,11 @@ void PFCfgParser::common_hosts_part() {
 }
 
 void PFCfgParser::host() {
-	Tracer traceInOut(this, "host");
 	ANTLR_USE_NAMESPACE(antlr)RefToken  tn = ANTLR_USE_NAMESPACE(antlr)nullToken;
 	ANTLR_USE_NAMESPACE(antlr)RefToken  in = ANTLR_USE_NAMESPACE(antlr)nullToken;
 #line 1182 "pf.g"
 	AddressSpec as;
-#line 4824 "PFCfgParser.cpp"
+#line 4764 "PFCfgParser.cpp"
 	
 	try {      // for error handling
 		{
@@ -4830,7 +4770,7 @@ void PFCfgParser::host() {
 			match(EXLAMATION);
 #line 1183 "pf.g"
 			as.neg = true;
-#line 4834 "PFCfgParser.cpp"
+#line 4774 "PFCfgParser.cpp"
 			break;
 		}
 		case WORD:
@@ -4859,7 +4799,7 @@ void PFCfgParser::host() {
 			as.at = AddressSpec::INTERFACE_OR_HOST_NAME;
 			as.address = LT(0)->getText();
 			
-#line 4863 "PFCfgParser.cpp"
+#line 4803 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case COLON:
@@ -4874,7 +4814,7 @@ void PFCfgParser::host() {
 					
 					as.at = AddressSpec::INTERFACE_NETWORK;
 					
-#line 4878 "PFCfgParser.cpp"
+#line 4818 "PFCfgParser.cpp"
 					break;
 				}
 				case BROADCAST:
@@ -4884,7 +4824,7 @@ void PFCfgParser::host() {
 					
 					as.at = AddressSpec::INTERFACE_BROADCAST;
 					
-#line 4888 "PFCfgParser.cpp"
+#line 4828 "PFCfgParser.cpp"
 					break;
 				}
 				case PEER:
@@ -4895,7 +4835,7 @@ void PFCfgParser::host() {
 					importer->error_tracker->registerError(
 					QString("import of 'interface:peer' is not supported."));
 					
-#line 4899 "PFCfgParser.cpp"
+#line 4839 "PFCfgParser.cpp"
 					break;
 				}
 				case INT_CONST:
@@ -4906,7 +4846,7 @@ void PFCfgParser::host() {
 					importer->error_tracker->registerError(
 					QString("import of 'interface:0' is not supported."));
 					
-#line 4910 "PFCfgParser.cpp"
+#line 4850 "PFCfgParser.cpp"
 					break;
 				}
 				default:
@@ -4937,10 +4877,10 @@ void PFCfgParser::host() {
 			case TO:
 			case GROUP:
 			case LITERAL_fragment:
-			case 144:
 			case 145:
 			case 146:
 			case 147:
+			case 148:
 			case FLAGS:
 			case ICMP_TYPE:
 			case ICMP6_TYPE:
@@ -4969,7 +4909,7 @@ void PFCfgParser::host() {
 			as.at = AddressSpec::SPECIAL_ADDRESS;
 			as.address = "self";
 			
-#line 4973 "PFCfgParser.cpp"
+#line 4913 "PFCfgParser.cpp"
 			break;
 		}
 		case IPV6:
@@ -4981,7 +4921,7 @@ void PFCfgParser::host() {
 			QString("IPv6 import is not supported. "));
 			consumeUntil(NEWLINE);
 			
-#line 4985 "PFCfgParser.cpp"
+#line 4925 "PFCfgParser.cpp"
 			break;
 		}
 		case IPV4:
@@ -4992,7 +4932,7 @@ void PFCfgParser::host() {
 			as.at = AddressSpec::HOST_ADDRESS;
 			as.address = LT(0)->getText();
 			
-#line 4996 "PFCfgParser.cpp"
+#line 4936 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case SLASH:
@@ -5002,7 +4942,7 @@ void PFCfgParser::host() {
 				
 				as.at = AddressSpec::NETWORK_ADDRESS;
 				
-#line 5006 "PFCfgParser.cpp"
+#line 4946 "PFCfgParser.cpp"
 				{
 				switch ( LA(1)) {
 				case IPV4:
@@ -5025,7 +4965,7 @@ void PFCfgParser::host() {
 				
 				as.netmask = LT(0)->getText(); 
 				
-#line 5029 "PFCfgParser.cpp"
+#line 4969 "PFCfgParser.cpp"
 				break;
 			}
 			case NEWLINE:
@@ -5048,10 +4988,10 @@ void PFCfgParser::host() {
 			case TO:
 			case GROUP:
 			case LITERAL_fragment:
-			case 144:
 			case 145:
 			case 146:
 			case 147:
+			case 148:
 			case FLAGS:
 			case ICMP_TYPE:
 			case ICMP6_TYPE:
@@ -5083,7 +5023,7 @@ void PFCfgParser::host() {
 			as.at = AddressSpec::TABLE;
 			as.address = tn->getText();
 			
-#line 5087 "PFCfgParser.cpp"
+#line 5027 "PFCfgParser.cpp"
 			break;
 		}
 		case OPENING_PAREN:
@@ -5098,7 +5038,7 @@ void PFCfgParser::host() {
 			as.at = AddressSpec::INTERFACE_OR_HOST_NAME;
 			as.address = in->getText();
 			
-#line 5102 "PFCfgParser.cpp"
+#line 5042 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -5111,7 +5051,7 @@ void PFCfgParser::host() {
 		
 		importer->tmp_group.push_back(as);
 		
-#line 5115 "PFCfgParser.cpp"
+#line 5055 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -5120,7 +5060,6 @@ void PFCfgParser::host() {
 }
 
 void PFCfgParser::host_list() {
-	Tracer traceInOut(this, "host_list");
 	
 	try {      // for error handling
 		match(OPENING_BRACE);
@@ -5169,7 +5108,6 @@ void PFCfgParser::host_list() {
 }
 
 void PFCfgParser::route_to() {
-	Tracer traceInOut(this, "route_to");
 	
 	try {      // for error handling
 		match(ROUTE_TO);
@@ -5195,7 +5133,7 @@ void PFCfgParser::route_to() {
 		
 		importer->route_type = PFImporter::ROUTE_TO;
 		
-#line 5199 "PFCfgParser.cpp"
+#line 5137 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -5204,7 +5142,6 @@ void PFCfgParser::route_to() {
 }
 
 void PFCfgParser::reply_to() {
-	Tracer traceInOut(this, "reply_to");
 	
 	try {      // for error handling
 		match(REPLY_TO);
@@ -5230,7 +5167,41 @@ void PFCfgParser::reply_to() {
 		
 		importer->route_type = PFImporter::REPLY_TO;
 		
-#line 5234 "PFCfgParser.cpp"
+#line 5171 "PFCfgParser.cpp"
+	}
+	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
+		reportError(ex);
+		recover(ex,_tokenSet_34);
+	}
+}
+
+void PFCfgParser::dup_to() {
+	
+	try {      // for error handling
+		match(DUP_TO);
+		{
+		switch ( LA(1)) {
+		case OPENING_PAREN:
+		{
+			routehost();
+			break;
+		}
+		case OPENING_BRACE:
+		{
+			routehost_list();
+			break;
+		}
+		default:
+		{
+			throw ANTLR_USE_NAMESPACE(antlr)NoViableAltException(LT(1), getFilename());
+		}
+		}
+		}
+#line 1296 "pf.g"
+		
+		importer->route_type = PFImporter::DUP_TO;
+		
+#line 5205 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -5239,21 +5210,20 @@ void PFCfgParser::reply_to() {
 }
 
 void PFCfgParser::routehost() {
-	Tracer traceInOut(this, "routehost");
 	ANTLR_USE_NAMESPACE(antlr)RefToken  h = ANTLR_USE_NAMESPACE(antlr)nullToken;
 	ANTLR_USE_NAMESPACE(antlr)RefToken  v6 = ANTLR_USE_NAMESPACE(antlr)nullToken;
 	ANTLR_USE_NAMESPACE(antlr)RefToken  nm = ANTLR_USE_NAMESPACE(antlr)nullToken;
 	ANTLR_USE_NAMESPACE(antlr)RefToken  nm6 = ANTLR_USE_NAMESPACE(antlr)nullToken;
-#line 1294 "pf.g"
+#line 1301 "pf.g"
 	RouteSpec rs;
-#line 5250 "PFCfgParser.cpp"
+#line 5220 "PFCfgParser.cpp"
 	
 	try {      // for error handling
 		match(OPENING_PAREN);
 		match(WORD);
-#line 1296 "pf.g"
+#line 1303 "pf.g"
 		rs.iface = LT(0)->getText();
-#line 5257 "PFCfgParser.cpp"
+#line 5227 "PFCfgParser.cpp"
 		{
 		switch ( LA(1)) {
 		case IPV4:
@@ -5311,7 +5281,7 @@ void PFCfgParser::routehost() {
 		}
 		}
 		}
-#line 1298 "pf.g"
+#line 1305 "pf.g"
 		
 		if (v6)
 		{
@@ -5325,7 +5295,7 @@ void PFCfgParser::routehost() {
 		importer->route_group.push_back(rs);
 		}
 		
-#line 5329 "PFCfgParser.cpp"
+#line 5299 "PFCfgParser.cpp"
 		match(CLOSING_PAREN);
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -5335,7 +5305,6 @@ void PFCfgParser::routehost() {
 }
 
 void PFCfgParser::routehost_list() {
-	Tracer traceInOut(this, "routehost_list");
 	
 	try {      // for error handling
 		match(OPENING_BRACE);
@@ -5363,11 +5332,11 @@ void PFCfgParser::routehost_list() {
 				routehost();
 			}
 			else {
-				goto _loop196;
+				goto _loop198;
 			}
 			
 		}
-		_loop196:;
+		_loop198:;
 		} // ( ... )*
 		match(CLOSING_BRACE);
 	}
@@ -5378,7 +5347,6 @@ void PFCfgParser::routehost_list() {
 }
 
 void PFCfgParser::filteropt() {
-	Tracer traceInOut(this, "filteropt");
 	
 	try {      // for error handling
 		switch ( LA(1)) {
@@ -5444,10 +5412,10 @@ void PFCfgParser::filteropt() {
 		case LITERAL_reassemble:
 		case OPENING_PAREN:
 		case LITERAL_fragment:
-		case 144:
 		case 145:
 		case 146:
 		case 147:
+		case 148:
 		{
 			scrub_options();
 			break;
@@ -5465,7 +5433,6 @@ void PFCfgParser::filteropt() {
 }
 
 void PFCfgParser::user_match() {
-	Tracer traceInOut(this, "user_match");
 	
 	try {      // for error handling
 		match(USER);
@@ -5492,12 +5459,12 @@ void PFCfgParser::user_match() {
 		}
 		}
 		}
-#line 1363 "pf.g"
+#line 1370 "pf.g"
 		
 		importer->addMessageToLog(
 		QString("Error: import of 'user' match is not supported."));
 		
-#line 5501 "PFCfgParser.cpp"
+#line 5468 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -5506,7 +5473,6 @@ void PFCfgParser::user_match() {
 }
 
 void PFCfgParser::group_match() {
-	Tracer traceInOut(this, "group_match");
 	
 	try {      // for error handling
 		match(GROUP);
@@ -5533,12 +5499,12 @@ void PFCfgParser::group_match() {
 		}
 		}
 		}
-#line 1372 "pf.g"
+#line 1379 "pf.g"
 		
 		importer->addMessageToLog(
 		QString("Error: import of 'group' match is not supported."));
 		
-#line 5542 "PFCfgParser.cpp"
+#line 5508 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -5547,7 +5513,6 @@ void PFCfgParser::group_match() {
 }
 
 void PFCfgParser::tcp_flags() {
-	Tracer traceInOut(this, "tcp_flags");
 	ANTLR_USE_NAMESPACE(antlr)RefToken  check = ANTLR_USE_NAMESPACE(antlr)nullToken;
 	ANTLR_USE_NAMESPACE(antlr)RefToken  mask = ANTLR_USE_NAMESPACE(antlr)nullToken;
 	
@@ -5558,12 +5523,12 @@ void PFCfgParser::tcp_flags() {
 		case ANY:
 		{
 			match(ANY);
-#line 1482 "pf.g"
+#line 1489 "pf.g"
 			
 			importer->flags_check = "none";
 			importer->flags_mask = "none";
 			
-#line 5567 "PFCfgParser.cpp"
+#line 5532 "PFCfgParser.cpp"
 			break;
 		}
 		case WORD:
@@ -5607,10 +5572,10 @@ void PFCfgParser::tcp_flags() {
 			case USER:
 			case GROUP:
 			case LITERAL_fragment:
-			case 144:
 			case 145:
 			case 146:
 			case 147:
+			case 148:
 			case FLAGS:
 			case ICMP_TYPE:
 			case ICMP6_TYPE:
@@ -5629,7 +5594,7 @@ void PFCfgParser::tcp_flags() {
 			}
 			}
 			}
-#line 1488 "pf.g"
+#line 1495 "pf.g"
 			
 			if (check)
 			importer->flags_check = check->getText();
@@ -5640,7 +5605,7 @@ void PFCfgParser::tcp_flags() {
 			else
 			importer->flags_mask = "all";
 			
-#line 5644 "PFCfgParser.cpp"
+#line 5609 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -5657,7 +5622,6 @@ void PFCfgParser::tcp_flags() {
 }
 
 void PFCfgParser::icmp_type() {
-	Tracer traceInOut(this, "icmp_type");
 	
 	try {      // for error handling
 		match(ICMP_TYPE);
@@ -5684,8 +5648,8 @@ void PFCfgParser::icmp_type() {
 		case LITERAL_trace:
 		case LITERAL_dataconv:
 		case LITERAL_mobredir:
-		case 170:
 		case 171:
+		case 172:
 		case LITERAL_mobregreq:
 		case LITERAL_mobregrep:
 		case LITERAL_photuris:
@@ -5712,17 +5676,16 @@ void PFCfgParser::icmp_type() {
 }
 
 void PFCfgParser::icmp6_type() {
-	Tracer traceInOut(this, "icmp6_type");
 	
 	try {      // for error handling
 		match(ICMP6_TYPE);
-#line 1663 "pf.g"
+#line 1670 "pf.g"
 		
 		importer->error_tracker->registerError(
 		QString("ICMP6 import is not supported. "));
 		consumeUntil(NEWLINE);
 		
-#line 5726 "PFCfgParser.cpp"
+#line 5689 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -5731,7 +5694,6 @@ void PFCfgParser::icmp6_type() {
 }
 
 void PFCfgParser::state() {
-	Tracer traceInOut(this, "state");
 	
 	try {      // for error handling
 		{
@@ -5762,11 +5724,11 @@ void PFCfgParser::state() {
 		}
 		}
 		}
-#line 1695 "pf.g"
+#line 1702 "pf.g"
 		
 		importer->state_op = LT(0)->getText();
 		
-#line 5770 "PFCfgParser.cpp"
+#line 5732 "PFCfgParser.cpp"
 		match(STATE);
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -5776,7 +5738,6 @@ void PFCfgParser::state() {
 }
 
 void PFCfgParser::queue() {
-	Tracer traceInOut(this, "queue");
 	
 	try {      // for error handling
 		match(QUEUE);
@@ -5785,36 +5746,36 @@ void PFCfgParser::queue() {
 		case WORD:
 		{
 			match(WORD);
-#line 1704 "pf.g"
+#line 1711 "pf.g"
 			importer->queue += LT(0)->getText();
-#line 5791 "PFCfgParser.cpp"
+#line 5752 "PFCfgParser.cpp"
 			break;
 		}
 		case OPENING_PAREN:
 		{
 			match(OPENING_PAREN);
 			match(WORD);
-#line 1707 "pf.g"
+#line 1714 "pf.g"
 			importer->queue += LT(0)->getText();
-#line 5800 "PFCfgParser.cpp"
+#line 5761 "PFCfgParser.cpp"
 			{ // ( ... )*
 			for (;;) {
 				if ((LA(1) == COMMA)) {
 					match(COMMA);
-#line 1709 "pf.g"
+#line 1716 "pf.g"
 					importer->queue += ",";
-#line 5807 "PFCfgParser.cpp"
+#line 5768 "PFCfgParser.cpp"
 					match(WORD);
-#line 1710 "pf.g"
+#line 1717 "pf.g"
 					importer->queue += LT(0)->getText();
-#line 5811 "PFCfgParser.cpp"
+#line 5772 "PFCfgParser.cpp"
 				}
 				else {
-					goto _loop253;
+					goto _loop255;
 				}
 				
 			}
-			_loop253:;
+			_loop255:;
 			} // ( ... )*
 			match(CLOSING_PAREN);
 			break;
@@ -5833,7 +5794,6 @@ void PFCfgParser::queue() {
 }
 
 void PFCfgParser::label() {
-	Tracer traceInOut(this, "label");
 	
 	try {      // for error handling
 		match(LABEL);
@@ -5846,7 +5806,6 @@ void PFCfgParser::label() {
 }
 
 void PFCfgParser::match_rule_scrub_options() {
-	Tracer traceInOut(this, "match_rule_scrub_options");
 	
 	try {      // for error handling
 		match(SCRUB);
@@ -5859,17 +5818,16 @@ void PFCfgParser::match_rule_scrub_options() {
 }
 
 void PFCfgParser::scrub_options() {
-	Tracer traceInOut(this, "scrub_options");
 	
 	try {      // for error handling
 		{
 		switch ( LA(1)) {
 		case LITERAL_reassemble:
 		case LITERAL_fragment:
-		case 144:
 		case 145:
 		case 146:
 		case 147:
+		case 148:
 		{
 			scrub_option();
 			break;
@@ -5893,7 +5851,6 @@ void PFCfgParser::scrub_options() {
 }
 
 void PFCfgParser::user_group_op() {
-	Tracer traceInOut(this, "user_group_op");
 	
 	try {      // for error handling
 		{
@@ -5990,7 +5947,6 @@ void PFCfgParser::user_group_op() {
 }
 
 void PFCfgParser::user_group_op_list() {
-	Tracer traceInOut(this, "user_group_op_list");
 	
 	try {      // for error handling
 		match(OPENING_BRACE);
@@ -6023,11 +5979,11 @@ void PFCfgParser::user_group_op_list() {
 				user_group_op();
 			}
 			else {
-				goto _loop215;
+				goto _loop217;
 			}
 			
 		}
-		_loop215:;
+		_loop217:;
 		} // ( ... )*
 		match(CLOSING_BRACE);
 	}
@@ -6038,7 +5994,6 @@ void PFCfgParser::user_group_op_list() {
 }
 
 void PFCfgParser::unary_op() {
-	Tracer traceInOut(this, "unary_op");
 	
 	try {      // for error handling
 		{
@@ -6046,46 +6001,46 @@ void PFCfgParser::unary_op() {
 		case EQUAL:
 		{
 			match(EQUAL);
-#line 1750 "pf.g"
+#line 1757 "pf.g"
 			importer->tmp_port_op = "=";
-#line 6052 "PFCfgParser.cpp"
+#line 6007 "PFCfgParser.cpp"
 			break;
 		}
 		case EXLAMATION:
 		{
 			match(EXLAMATION);
 			match(EQUAL);
-#line 1752 "pf.g"
+#line 1759 "pf.g"
 			importer->tmp_port_op = "!=";
-#line 6061 "PFCfgParser.cpp"
+#line 6016 "PFCfgParser.cpp"
 			break;
 		}
 		default:
 			if ((LA(1) == LESS_THAN) && (LA(2) == WORD || LA(2) == INT_CONST)) {
 				match(LESS_THAN);
-#line 1754 "pf.g"
+#line 1761 "pf.g"
 				importer->tmp_port_op = "<";
-#line 6069 "PFCfgParser.cpp"
+#line 6024 "PFCfgParser.cpp"
 			}
 			else if ((LA(1) == LESS_THAN) && (LA(2) == EQUAL)) {
 				match(LESS_THAN);
 				match(EQUAL);
-#line 1756 "pf.g"
+#line 1763 "pf.g"
 				importer->tmp_port_op = "<=";
-#line 6076 "PFCfgParser.cpp"
+#line 6031 "PFCfgParser.cpp"
 			}
 			else if ((LA(1) == GREATER_THAN) && (LA(2) == WORD || LA(2) == INT_CONST)) {
 				match(GREATER_THAN);
-#line 1758 "pf.g"
+#line 1765 "pf.g"
 				importer->tmp_port_op = ">";
-#line 6082 "PFCfgParser.cpp"
+#line 6037 "PFCfgParser.cpp"
 			}
 			else if ((LA(1) == GREATER_THAN) && (LA(2) == EQUAL)) {
 				match(GREATER_THAN);
 				match(EQUAL);
-#line 1760 "pf.g"
+#line 1767 "pf.g"
 				importer->tmp_port_op = ">=";
-#line 6089 "PFCfgParser.cpp"
+#line 6044 "PFCfgParser.cpp"
 			}
 		else {
 			throw ANTLR_USE_NAMESPACE(antlr)NoViableAltException(LT(1), getFilename());
@@ -6100,7 +6055,6 @@ void PFCfgParser::unary_op() {
 }
 
 void PFCfgParser::binary_op() {
-	Tracer traceInOut(this, "binary_op");
 	
 	try {      // for error handling
 		{
@@ -6109,26 +6063,26 @@ void PFCfgParser::binary_op() {
 		{
 			match(LESS_THAN);
 			match(GREATER_THAN);
-#line 1766 "pf.g"
+#line 1773 "pf.g"
 			importer->tmp_port_op = "<>";
-#line 6115 "PFCfgParser.cpp"
+#line 6069 "PFCfgParser.cpp"
 			break;
 		}
 		case GREATER_THAN:
 		{
 			match(GREATER_THAN);
 			match(LESS_THAN);
-#line 1768 "pf.g"
+#line 1775 "pf.g"
 			importer->tmp_port_op = "><";
-#line 6124 "PFCfgParser.cpp"
+#line 6078 "PFCfgParser.cpp"
 			break;
 		}
 		case COLON:
 		{
 			match(COLON);
-#line 1770 "pf.g"
+#line 1777 "pf.g"
 			importer->tmp_port_op = ":";
-#line 6132 "PFCfgParser.cpp"
+#line 6086 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -6145,7 +6099,6 @@ void PFCfgParser::binary_op() {
 }
 
 void PFCfgParser::scrub_option() {
-	Tracer traceInOut(this, "scrub_option");
 	
 	try {      // for error handling
 		{
@@ -6165,9 +6118,9 @@ void PFCfgParser::scrub_option() {
 				match(LITERAL_crop);
 				break;
 			}
-			case 143:
+			case 144:
 			{
-				match(143);
+				match(144);
 				break;
 			}
 			default:
@@ -6176,51 +6129,38 @@ void PFCfgParser::scrub_option() {
 			}
 			}
 			}
-#line 1434 "pf.g"
+#line 1441 "pf.g"
 			
 			importer->scrub_options.push_back(
 			str_tuple("fragment", LT(0)->getText()));
 			importer->scrub_rule = true;
 			
-#line 6186 "PFCfgParser.cpp"
+#line 6139 "PFCfgParser.cpp"
 			break;
 		}
 		case LITERAL_reassemble:
 		{
 			match(LITERAL_reassemble);
 			match(TCP);
-#line 1441 "pf.g"
+#line 1448 "pf.g"
 			
 			importer->scrub_options.push_back(
 			str_tuple("reassemble", "tcp"));
 			importer->scrub_rule = true;
 			
-#line 6199 "PFCfgParser.cpp"
-			break;
-		}
-		case 144:
-		{
-			match(144);
-#line 1448 "pf.g"
-			
-			importer->scrub_options.push_back(
-			str_tuple(LT(0)->getText(), ""));
-			importer->scrub_rule = true;
-			
-#line 6211 "PFCfgParser.cpp"
+#line 6152 "PFCfgParser.cpp"
 			break;
 		}
 		case 145:
 		{
 			match(145);
-			match(INT_CONST);
 #line 1455 "pf.g"
 			
 			importer->scrub_options.push_back(
-			str_tuple("min-ttl", LT(0)->getText()));
+			str_tuple(LT(0)->getText(), ""));
 			importer->scrub_rule = true;
 			
-#line 6224 "PFCfgParser.cpp"
+#line 6164 "PFCfgParser.cpp"
 			break;
 		}
 		case 146:
@@ -6230,22 +6170,35 @@ void PFCfgParser::scrub_option() {
 #line 1462 "pf.g"
 			
 			importer->scrub_options.push_back(
-			str_tuple("max-mss", LT(0)->getText()));
+			str_tuple("min-ttl", LT(0)->getText()));
 			importer->scrub_rule = true;
 			
-#line 6237 "PFCfgParser.cpp"
+#line 6177 "PFCfgParser.cpp"
 			break;
 		}
 		case 147:
 		{
 			match(147);
+			match(INT_CONST);
 #line 1469 "pf.g"
 			
+			importer->scrub_options.push_back(
+			str_tuple("max-mss", LT(0)->getText()));
+			importer->scrub_rule = true;
+			
+#line 6190 "PFCfgParser.cpp"
+			break;
+		}
+		case 148:
+		{
+			match(148);
+#line 1476 "pf.g"
+			
 			importer->scrub_options.push_back(
 			str_tuple(LT(0)->getText(), ""));
 			importer->scrub_rule = true;
 			
-#line 6249 "PFCfgParser.cpp"
+#line 6202 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -6262,7 +6215,6 @@ void PFCfgParser::scrub_option() {
 }
 
 void PFCfgParser::scrub_option_list() {
-	Tracer traceInOut(this, "scrub_option_list");
 	
 	try {      // for error handling
 		match(OPENING_PAREN);
@@ -6279,10 +6231,10 @@ void PFCfgParser::scrub_option_list() {
 				}
 				case LITERAL_reassemble:
 				case LITERAL_fragment:
-				case 144:
 				case 145:
 				case 146:
 				case 147:
+				case 148:
 				{
 					break;
 				}
@@ -6295,11 +6247,11 @@ void PFCfgParser::scrub_option_list() {
 				scrub_option();
 			}
 			else {
-				goto _loop222;
+				goto _loop224;
 			}
 			
 		}
-		_loop222:;
+		_loop224:;
 		} // ( ... )*
 		match(CLOSING_PAREN);
 	}
@@ -6310,10 +6262,9 @@ void PFCfgParser::scrub_option_list() {
 }
 
 void PFCfgParser::icmp_type_code() {
-	Tracer traceInOut(this, "icmp_type_code");
-#line 1510 "pf.g"
+#line 1517 "pf.g"
 	IcmpSpec is;
-#line 6317 "PFCfgParser.cpp"
+#line 6268 "PFCfgParser.cpp"
 	
 	try {      // for error handling
 		{
@@ -6338,24 +6289,24 @@ void PFCfgParser::icmp_type_code() {
 		case LITERAL_trace:
 		case LITERAL_dataconv:
 		case LITERAL_mobredir:
-		case 170:
 		case 171:
+		case 172:
 		case LITERAL_mobregreq:
 		case LITERAL_mobregrep:
 		case LITERAL_photuris:
 		{
 			icmp_type_by_name();
-#line 1512 "pf.g"
+#line 1519 "pf.g"
 			is.icmp_type_name = LT(0)->getText();
-#line 6351 "PFCfgParser.cpp"
+#line 6302 "PFCfgParser.cpp"
 			break;
 		}
 		case INT_CONST:
 		{
 			match(INT_CONST);
-#line 1514 "pf.g"
+#line 1521 "pf.g"
 			is.icmp_type_int = LT(0)->getText();
-#line 6359 "PFCfgParser.cpp"
+#line 6310 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -6371,16 +6322,15 @@ void PFCfgParser::icmp_type_code() {
 			match(ICMP_CODE);
 			{
 			switch ( LA(1)) {
-			case 175:
 			case 176:
 			case 177:
 			case 178:
+			case 179:
 			case LITERAL_needfrag:
 			case LITERAL_srcfail:
-			case 181:
 			case 182:
+			case 183:
 			case LITERAL_isolate:
-			case 184:
 			case 185:
 			case 186:
 			case 187:
@@ -6393,27 +6343,28 @@ void PFCfgParser::icmp_type_code() {
 			case 194:
 			case 195:
 			case 196:
+			case 197:
 			case LITERAL_transit:
 			case LITERAL_reassemb:
 			case LITERAL_badhead:
 			case LITERAL_optmiss:
 			case LITERAL_badlen:
-			case 202:
 			case 203:
 			case 204:
+			case 205:
 			{
 				icmp_code_by_name();
-#line 1520 "pf.g"
+#line 1527 "pf.g"
 				is.icmp_code_name = LT(0)->getText();
-#line 6409 "PFCfgParser.cpp"
+#line 6360 "PFCfgParser.cpp"
 				break;
 			}
 			case INT_CONST:
 			{
 				match(INT_CONST);
-#line 1522 "pf.g"
+#line 1529 "pf.g"
 				is.icmp_code_int = LT(0)->getText();
-#line 6417 "PFCfgParser.cpp"
+#line 6368 "PFCfgParser.cpp"
 				break;
 			}
 			default:
@@ -6438,10 +6389,10 @@ void PFCfgParser::icmp_type_code() {
 		case USER:
 		case GROUP:
 		case LITERAL_fragment:
-		case 144:
 		case 145:
 		case 146:
 		case 147:
+		case 148:
 		case FLAGS:
 		case ICMP_TYPE:
 		case LITERAL_echorep:
@@ -6463,8 +6414,8 @@ void PFCfgParser::icmp_type_code() {
 		case LITERAL_trace:
 		case LITERAL_dataconv:
 		case LITERAL_mobredir:
-		case 170:
 		case 171:
+		case 172:
 		case LITERAL_mobregreq:
 		case LITERAL_mobregrep:
 		case LITERAL_photuris:
@@ -6484,11 +6435,11 @@ void PFCfgParser::icmp_type_code() {
 		}
 		}
 		}
-#line 1525 "pf.g"
+#line 1532 "pf.g"
 		
 		importer->icmp_type_code_group.push_back(is);
 		
-#line 6492 "PFCfgParser.cpp"
+#line 6443 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -6497,7 +6448,6 @@ void PFCfgParser::icmp_type_code() {
 }
 
 void PFCfgParser::icmp_list() {
-	Tracer traceInOut(this, "icmp_list");
 	
 	try {      // for error handling
 		match(OPENING_BRACE);
@@ -6533,8 +6483,8 @@ void PFCfgParser::icmp_list() {
 				case LITERAL_trace:
 				case LITERAL_dataconv:
 				case LITERAL_mobredir:
-				case 170:
 				case 171:
+				case 172:
 				case LITERAL_mobregreq:
 				case LITERAL_mobregrep:
 				case LITERAL_photuris:
@@ -6550,11 +6500,11 @@ void PFCfgParser::icmp_list() {
 				icmp_type_code();
 			}
 			else {
-				goto _loop243;
+				goto _loop245;
 			}
 			
 		}
-		_loop243:;
+		_loop245:;
 		} // ( ... )*
 		match(CLOSING_BRACE);
 	}
@@ -6565,7 +6515,6 @@ void PFCfgParser::icmp_list() {
 }
 
 void PFCfgParser::icmp_type_by_name() {
-	Tracer traceInOut(this, "icmp_type_by_name");
 	
 	try {      // for error handling
 		{
@@ -6665,16 +6614,16 @@ void PFCfgParser::icmp_type_by_name() {
 			match(LITERAL_mobredir);
 			break;
 		}
-		case 170:
-		{
-			match(170);
-			break;
-		}
 		case 171:
 		{
 			match(171);
 			break;
 		}
+		case 172:
+		{
+			match(172);
+			break;
+		}
 		case LITERAL_mobregreq:
 		{
 			match(LITERAL_mobregreq);
@@ -6709,10 +6658,9 @@ void PFCfgParser::icmp_type_by_name() {
 }
 
 void PFCfgParser::port_op() {
-	Tracer traceInOut(this, "port_op");
-#line 1776 "pf.g"
+#line 1783 "pf.g"
 	PortSpec ps;
-#line 6716 "PFCfgParser.cpp"
+#line 6664 "PFCfgParser.cpp"
 	
 	try {      // for error handling
 		{
@@ -6723,39 +6671,39 @@ void PFCfgParser::port_op() {
 		case EXLAMATION:
 		{
 			unary_op();
-#line 1778 "pf.g"
+#line 1785 "pf.g"
 			ps.port_op = importer->tmp_port_op;
-#line 6729 "PFCfgParser.cpp"
+#line 6677 "PFCfgParser.cpp"
 			port_def();
-#line 1780 "pf.g"
+#line 1787 "pf.g"
 			
 			ps.port1 = importer->tmp_port_def;
 			ps.port2 = importer->tmp_port_def;
 			
-#line 6736 "PFCfgParser.cpp"
+#line 6684 "PFCfgParser.cpp"
 			break;
 		}
 		case WORD:
 		case INT_CONST:
 		{
 			port_def();
-#line 1786 "pf.g"
+#line 1793 "pf.g"
 			
 			ps.port1 = importer->tmp_port_def;
 			ps.port2 = ps.port1;
 			ps.port_op = "=";
 			
-#line 6749 "PFCfgParser.cpp"
+#line 6697 "PFCfgParser.cpp"
 			{
 			if ((LA(1) == LESS_THAN || LA(1) == GREATER_THAN || LA(1) == COLON) && (_tokenSet_48.member(LA(2)))) {
 				binary_op();
-#line 1792 "pf.g"
+#line 1799 "pf.g"
 				ps.port_op = importer->tmp_port_op;
-#line 6755 "PFCfgParser.cpp"
+#line 6703 "PFCfgParser.cpp"
 				port_def();
-#line 1793 "pf.g"
+#line 1800 "pf.g"
 				ps.port2 = LT(0)->getText();
-#line 6759 "PFCfgParser.cpp"
+#line 6707 "PFCfgParser.cpp"
 			}
 			else if ((_tokenSet_58.member(LA(1))) && (_tokenSet_59.member(LA(2)))) {
 			}
@@ -6769,11 +6717,11 @@ void PFCfgParser::port_op() {
 		case IPV6:
 		{
 			match(IPV6);
-#line 1797 "pf.g"
+#line 1804 "pf.g"
 			
 			ps.setFromPortRange(LT(0)->getText());
 			
-#line 6777 "PFCfgParser.cpp"
+#line 6725 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -6782,11 +6730,11 @@ void PFCfgParser::port_op() {
 		}
 		}
 		}
-#line 1801 "pf.g"
+#line 1808 "pf.g"
 		
 		importer->tmp_port_group.push_back(ps);
 		
-#line 6790 "PFCfgParser.cpp"
+#line 6738 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -6795,7 +6743,6 @@ void PFCfgParser::port_op() {
 }
 
 void PFCfgParser::port_op_list() {
-	Tracer traceInOut(this, "port_op_list");
 	
 	try {      // for error handling
 		match(OPENING_BRACE);
@@ -6829,11 +6776,11 @@ void PFCfgParser::port_op_list() {
 				port_op();
 			}
 			else {
-				goto _loop271;
+				goto _loop273;
 			}
 			
 		}
-		_loop271:;
+		_loop273:;
 		} // ( ... )*
 		match(CLOSING_BRACE);
 	}
@@ -6987,6 +6934,7 @@ const char* PFCfgParser::tokenNames[] = {
 	"\"no-route\"",
 	"\"route-to\"",
 	"\"reply-to\"",
+	"\"dup-to\"",
 	"\"group\"",
 	"\"fragment\"",
 	"\"crop\"",
@@ -7143,13 +7091,13 @@ const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_5(_tokenSet_5_data
 const unsigned long PFCfgParser::_tokenSet_6_data_[] = { 0UL, 4026531848UL, 1UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // COMMA "frags" "states" "src-nodes" "tables" "tables-entries" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_6(_tokenSet_6_data_,10);
-const unsigned long PFCfgParser::_tokenSet_7_data_[] = { 2064UL, 64UL, 68159490UL, 458752UL, 4141120UL, 0UL, 1564672UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_7_data_[] = { 2064UL, 64UL, 68159490UL, 458752UL, 8282176UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "reassemble" "scrub" EXLAMATION "no" OPENING_PAREN "all" 
 // "user" "to" "from" "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" 
 // "flags" "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
 // "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_7(_tokenSet_7_data_,16);
-const unsigned long PFCfgParser::_tokenSet_8_data_[] = { 8178UL, 134217805UL, 645598270UL, 33685696UL, 4290769792UL, 32767UL, 2088960UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_8_data_[] = { 8178UL, 134217805UL, 645598270UL, 33685696UL, 4286571392UL, 65535UL, 4177920UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE LINE_COMMENT "include" WORD EQUAL "antispoof" "altq" "queue" 
 // "set" "skip" OPENING_BRACE COMMA "reassemble" INT_CONST "scrub" "match" 
 // "table" LESS_THAN GREATER_THAN STRING EXLAMATION "self" IPV4 SLASH "no" 
@@ -7162,12 +7110,12 @@ const unsigned long PFCfgParser::_tokenSet_8_data_[] = { 8178UL, 134217805UL, 64
 // "photuris" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
 // "state" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_8(_tokenSet_8_data_,16);
-const unsigned long PFCfgParser::_tokenSet_9_data_[] = { 2064UL, 64UL, 68159490UL, 131072UL, 4141056UL, 0UL, 1564672UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_9_data_[] = { 2064UL, 64UL, 68159490UL, 131072UL, 8282112UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "reassemble" "scrub" EXLAMATION "no" OPENING_PAREN "user" 
 // "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" "flags" "icmp-type" 
 // "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_9(_tokenSet_9_data_,16);
-const unsigned long PFCfgParser::_tokenSet_10_data_[] = { 8178UL, 134217805UL, 108530750UL, 33685696UL, 4290769152UL, 32767UL, 2088960UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_10_data_[] = { 8178UL, 134217805UL, 108530750UL, 33685696UL, 4286570752UL, 65535UL, 4177920UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE LINE_COMMENT "include" WORD EQUAL "antispoof" "altq" "queue" 
 // "set" "skip" OPENING_BRACE COMMA "reassemble" INT_CONST "scrub" "match" 
 // "table" LESS_THAN GREATER_THAN STRING EXLAMATION SLASH "no" "nat" "pass" 
@@ -7185,35 +7133,36 @@ const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_11(_tokenSet_11_da
 const unsigned long PFCfgParser::_tokenSet_12_data_[] = { 128UL, 134217752UL, 460800UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // WORD COMMA CLOSING_BRACE INT_CONST EXLAMATION "self" IPV4 NUMBER 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_12(_tokenSet_12_data_,10);
-const unsigned long PFCfgParser::_tokenSet_13_data_[] = { 16UL, 2UL, 8390656UL, 3997696UL, 64UL, 0UL, 49152UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_13_data_[] = { 16UL, 2UL, 8390656UL, 3997696UL, 64UL, 0UL, 98304UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "on" EXLAMATION MINUS "all" "to" "inet" "inet6" "proto" "from" 
 // "tagged" "tag" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_13(_tokenSet_13_data_,16);
-const unsigned long PFCfgParser::_tokenSet_14_data_[] = { 2064UL, 64UL, 76548098UL, 4128768UL, 4144192UL, 0UL, 1564672UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_14_data_[] = { 2064UL, 64UL, 76548098UL, 4128768UL, 8289344UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "reassemble" "scrub" EXLAMATION "no" MINUS OPENING_PAREN 
 // "all" "user" "to" "inet" "inet6" "proto" "from" "route-to" "reply-to" 
-// "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" "flags" "icmp-type" 
-// "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" "label" 
+// "dup-to" "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" 
+// "flags" "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
+// "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_14(_tokenSet_14_data_,16);
-const unsigned long PFCfgParser::_tokenSet_15_data_[] = { 2064UL, 64UL, 76548098UL, 2555904UL, 4141120UL, 0UL, 1564672UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_15_data_[] = { 2064UL, 64UL, 76548098UL, 2555904UL, 8282176UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "reassemble" "scrub" EXLAMATION "no" MINUS OPENING_PAREN 
 // "all" "user" "to" "proto" "from" "group" "fragment" "no-df" "min-ttl" 
 // "max-mss" "random-id" "flags" "icmp-type" "icmp6-type" "tagged" "tag" 
 // "keep" "modulate" "synproxy" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_15(_tokenSet_15_data_,16);
-const unsigned long PFCfgParser::_tokenSet_16_data_[] = { 2064UL, 64UL, 76548098UL, 458752UL, 4141120UL, 0UL, 1564672UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_16_data_[] = { 2064UL, 64UL, 76548098UL, 458752UL, 8282176UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "reassemble" "scrub" EXLAMATION "no" MINUS OPENING_PAREN 
 // "all" "user" "to" "from" "group" "fragment" "no-df" "min-ttl" "max-mss" 
 // "random-id" "flags" "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" 
 // "synproxy" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_16(_tokenSet_16_data_,16);
-const unsigned long PFCfgParser::_tokenSet_17_data_[] = { 2064UL, 64UL, 76548098UL, 131072UL, 4141056UL, 0UL, 1564672UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_17_data_[] = { 2064UL, 64UL, 76548098UL, 131072UL, 8282112UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "reassemble" "scrub" EXLAMATION "no" MINUS OPENING_PAREN 
 // "user" "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" "flags" 
 // "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
 // "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_17(_tokenSet_17_data_,16);
-const unsigned long PFCfgParser::_tokenSet_18_data_[] = { 2064UL, 72UL, 76548098UL, 131072UL, 4141056UL, 0UL, 1564672UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_18_data_[] = { 2064UL, 72UL, 76548098UL, 131072UL, 8282112UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" COMMA "reassemble" "scrub" EXLAMATION "no" MINUS OPENING_PAREN 
 // "user" "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" "flags" 
 // "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
@@ -7235,7 +7184,7 @@ const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_22(_tokenSet_22_da
 const unsigned long PFCfgParser::_tokenSet_23_data_[] = { 16UL, 0UL, 16777216UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "static-port" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_23(_tokenSet_23_data_,10);
-const unsigned long PFCfgParser::_tokenSet_24_data_[] = { 2448UL, 134217816UL, 2777684018UL, 393235UL, 4141056UL, 0UL, 1564672UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_24_data_[] = { 2448UL, 134217816UL, 2777684018UL, 393235UL, 8282112UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE WORD EQUAL "queue" COMMA CLOSING_BRACE "reassemble" INT_CONST 
 // "scrub" LESS_THAN GREATER_THAN EXLAMATION COLON "no" MINUS "static-port" 
 // OPENING_PAREN IPV6 "bitmask" "random" "source-hash" "round-robin" "user" 
@@ -7243,7 +7192,7 @@ const unsigned long PFCfgParser::_tokenSet_24_data_[] = { 2448UL, 134217816UL, 2
 // "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
 // "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_24(_tokenSet_24_data_,16);
-const unsigned long PFCfgParser::_tokenSet_25_data_[] = { 0UL, 134217728UL, 0UL, 0UL, 0UL, 4294934528UL, 8191UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_25_data_[] = { 0UL, 134217728UL, 0UL, 0UL, 0UL, 4294901760UL, 16383UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // INT_CONST "net-unr" "host-unr" "proto-unr" "port-unr" "needfrag" "srcfail" 
 // "net-unk" "host-unk" "isolate" "net-prohib" "host-prohib" "net-tos" 
 // "host-tos" "filter-prohib" "host-preced" "cutoff-preced" "redir-net" 
@@ -7251,14 +7200,14 @@ const unsigned long PFCfgParser::_tokenSet_25_data_[] = { 0UL, 134217728UL, 0UL,
 // "transit" "reassemb" "badhead" "optmiss" "badlen" "unknown-ind" "auth-fail" 
 // "decrypt-fail" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_25(_tokenSet_25_data_,16);
-const unsigned long PFCfgParser::_tokenSet_26_data_[] = { 2064UL, 66UL, 68159490UL, 4190208UL, 4144192UL, 0UL, 1564672UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_26_data_[] = { 2064UL, 66UL, 68159490UL, 4190208UL, 8289344UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "on" "reassemble" "scrub" EXLAMATION "no" OPENING_PAREN 
 // "in" "out" "log" "quick" "all" "user" "to" "inet" "inet6" "proto" "from" 
-// "route-to" "reply-to" "group" "fragment" "no-df" "min-ttl" "max-mss" 
-// "random-id" "flags" "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" 
-// "synproxy" "label" 
+// "route-to" "reply-to" "dup-to" "group" "fragment" "no-df" "min-ttl" 
+// "max-mss" "random-id" "flags" "icmp-type" "icmp6-type" "tagged" "tag" 
+// "keep" "modulate" "synproxy" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_26(_tokenSet_26_data_,16);
-const unsigned long PFCfgParser::_tokenSet_27_data_[] = { 8178UL, 134217807UL, 645598270UL, 4294951104UL, 4290772991UL, 32767UL, 2088960UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_27_data_[] = { 8178UL, 134217807UL, 645598270UL, 4294951104UL, 4286578687UL, 65535UL, 4177920UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE LINE_COMMENT "include" WORD EQUAL "antispoof" "altq" "queue" 
 // "set" "skip" "on" OPENING_BRACE COMMA "reassemble" INT_CONST "scrub" 
 // "match" "table" LESS_THAN GREATER_THAN STRING EXLAMATION "self" IPV4 
@@ -7266,14 +7215,14 @@ const unsigned long PFCfgParser::_tokenSet_27_data_[] = { 8178UL, 134217807UL, 6
 // "quick" "all" "user" "to" "inet" "inet6" "proto" "ip" "icmp" "igmp" 
 // "tcp" "udp" "rdp" "rsvp" "gre" "esp" "ah" "eigrp" "ospf" "ipip" "vrrp" 
 // "l2tp" "isis" "from" "urpf-failed" "any" "no-route" "route-to" "reply-to" 
-// "group" "fragment" "crop" "drop-ovl" "no-df" "min-ttl" "max-mss" "random-id" 
-// "flags" "icmp-type" "echorep" "unreach" "squench" "redir" "althost" 
-// "echoreq" "routeradv" "routersol" "timex" "paramprob" "timereq" "timerep" 
-// "inforeq" "inforep" "maskreq" "maskrep" "trace" "dataconv" "mobredir" 
-// "ipv6-where" "ipv6-here" "mobregreq" "mobregrep" "photuris" "icmp6-type" 
-// "tagged" "tag" "keep" "modulate" "synproxy" "state" "label" 
+// "dup-to" "group" "fragment" "crop" "drop-ovl" "no-df" "min-ttl" "max-mss" 
+// "random-id" "flags" "icmp-type" "echorep" "unreach" "squench" "redir" 
+// "althost" "echoreq" "routeradv" "routersol" "timex" "paramprob" "timereq" 
+// "timerep" "inforeq" "inforep" "maskreq" "maskrep" "trace" "dataconv" 
+// "mobredir" "ipv6-where" "ipv6-here" "mobregreq" "mobregrep" "photuris" 
+// "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" "state" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_27(_tokenSet_27_data_,16);
-const unsigned long PFCfgParser::_tokenSet_28_data_[] = { 2064UL, 134217817UL, 202377218UL, 131072UL, 4290719744UL, 32767UL, 1564672UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_28_data_[] = { 2064UL, 134217817UL, 202377218UL, 131072UL, 4286472192UL, 65535UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "skip" COMMA CLOSING_BRACE "reassemble" INT_CONST "scrub" 
 // EXLAMATION "no" OPENING_PAREN CLOSING_PAREN "user" "group" "fragment" 
 // "no-df" "min-ttl" "max-mss" "random-id" "flags" "icmp-type" "echorep" 
@@ -7283,41 +7232,43 @@ const unsigned long PFCfgParser::_tokenSet_28_data_[] = { 2064UL, 134217817UL, 2
 // "mobregrep" "photuris" "icmp6-type" "tagged" "tag" "keep" "modulate" 
 // "synproxy" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_28(_tokenSet_28_data_,16);
-const unsigned long PFCfgParser::_tokenSet_29_data_[] = { 2064UL, 66UL, 68159490UL, 4177920UL, 4144192UL, 0UL, 1564672UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_29_data_[] = { 2064UL, 66UL, 68159490UL, 4177920UL, 8289344UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "on" "reassemble" "scrub" EXLAMATION "no" OPENING_PAREN 
 // "log" "quick" "all" "user" "to" "inet" "inet6" "proto" "from" "route-to" 
-// "reply-to" "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" 
+// "reply-to" "dup-to" "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" 
 // "flags" "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
 // "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_29(_tokenSet_29_data_,16);
-const unsigned long PFCfgParser::_tokenSet_30_data_[] = { 2064UL, 66UL, 68159490UL, 4161536UL, 4144192UL, 0UL, 1564672UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_30_data_[] = { 2064UL, 66UL, 68159490UL, 4161536UL, 8289344UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "on" "reassemble" "scrub" EXLAMATION "no" OPENING_PAREN 
 // "quick" "all" "user" "to" "inet" "inet6" "proto" "from" "route-to" "reply-to" 
-// "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" "flags" "icmp-type" 
-// "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" "label" 
+// "dup-to" "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" 
+// "flags" "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
+// "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_30(_tokenSet_30_data_,16);
-const unsigned long PFCfgParser::_tokenSet_31_data_[] = { 8178UL, 134217807UL, 645598270UL, 4294901952UL, 4290772991UL, 32767UL, 2088960UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_31_data_[] = { 8178UL, 134217807UL, 645598270UL, 4294901952UL, 4286578687UL, 65535UL, 4177920UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE LINE_COMMENT "include" WORD EQUAL "antispoof" "altq" "queue" 
 // "set" "skip" "on" OPENING_BRACE COMMA "reassemble" INT_CONST "scrub" 
 // "match" "table" LESS_THAN GREATER_THAN STRING EXLAMATION "self" IPV4 
 // SLASH "no" "nat" "pass" "rdr" OPENING_PAREN IPV6 "binat" "block" "all" 
 // "user" "to" "inet" "inet6" "proto" "ip" "icmp" "igmp" "tcp" "udp" "rdp" 
 // "rsvp" "gre" "esp" "ah" "eigrp" "ospf" "ipip" "vrrp" "l2tp" "isis" "from" 
-// "urpf-failed" "any" "no-route" "route-to" "reply-to" "group" "fragment" 
-// "crop" "drop-ovl" "no-df" "min-ttl" "max-mss" "random-id" "flags" "icmp-type" 
-// "echorep" "unreach" "squench" "redir" "althost" "echoreq" "routeradv" 
-// "routersol" "timex" "paramprob" "timereq" "timerep" "inforeq" "inforep" 
-// "maskreq" "maskrep" "trace" "dataconv" "mobredir" "ipv6-where" "ipv6-here" 
-// "mobregreq" "mobregrep" "photuris" "icmp6-type" "tagged" "tag" "keep" 
-// "modulate" "synproxy" "state" "label" 
+// "urpf-failed" "any" "no-route" "route-to" "reply-to" "dup-to" "group" 
+// "fragment" "crop" "drop-ovl" "no-df" "min-ttl" "max-mss" "random-id" 
+// "flags" "icmp-type" "echorep" "unreach" "squench" "redir" "althost" 
+// "echoreq" "routeradv" "routersol" "timex" "paramprob" "timereq" "timerep" 
+// "inforeq" "inforep" "maskreq" "maskrep" "trace" "dataconv" "mobredir" 
+// "ipv6-where" "ipv6-here" "mobregreq" "mobregrep" "photuris" "icmp6-type" 
+// "tagged" "tag" "keep" "modulate" "synproxy" "state" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_31(_tokenSet_31_data_,16);
-const unsigned long PFCfgParser::_tokenSet_32_data_[] = { 2064UL, 66UL, 68159490UL, 4128768UL, 4144192UL, 0UL, 1564672UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_32_data_[] = { 2064UL, 66UL, 68159490UL, 4128768UL, 8289344UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "on" "reassemble" "scrub" EXLAMATION "no" OPENING_PAREN 
 // "all" "user" "to" "inet" "inet6" "proto" "from" "route-to" "reply-to" 
-// "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" "flags" "icmp-type" 
-// "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" "label" 
+// "dup-to" "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" 
+// "flags" "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
+// "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_32(_tokenSet_32_data_,16);
-const unsigned long PFCfgParser::_tokenSet_33_data_[] = { 8178UL, 134217805UL, 645598270UL, 4293329088UL, 4290769919UL, 32767UL, 2088960UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_33_data_[] = { 8178UL, 134217805UL, 645598270UL, 4293329088UL, 4286571519UL, 65535UL, 4177920UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE LINE_COMMENT "include" WORD EQUAL "antispoof" "altq" "queue" 
 // "set" "skip" OPENING_BRACE COMMA "reassemble" INT_CONST "scrub" "match" 
 // "table" LESS_THAN GREATER_THAN STRING EXLAMATION "self" IPV4 SLASH "no" 
@@ -7331,34 +7282,35 @@ const unsigned long PFCfgParser::_tokenSet_33_data_[] = { 8178UL, 134217805UL, 6
 // "mobredir" "ipv6-where" "ipv6-here" "mobregreq" "mobregrep" "photuris" 
 // "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" "state" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_33(_tokenSet_33_data_,16);
-const unsigned long PFCfgParser::_tokenSet_34_data_[] = { 2064UL, 64UL, 68159490UL, 4128768UL, 4141120UL, 0UL, 1564672UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_34_data_[] = { 2064UL, 64UL, 68159490UL, 4128768UL, 8282176UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "reassemble" "scrub" EXLAMATION "no" OPENING_PAREN "all" 
 // "user" "to" "inet" "inet6" "proto" "from" "group" "fragment" "no-df" 
 // "min-ttl" "max-mss" "random-id" "flags" "icmp-type" "icmp6-type" "tagged" 
 // "tag" "keep" "modulate" "synproxy" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_34(_tokenSet_34_data_,16);
-const unsigned long PFCfgParser::_tokenSet_35_data_[] = { 2048UL, 72UL, 68159490UL, 131072UL, 4141056UL, 0UL, 1564672UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_35_data_[] = { 2048UL, 72UL, 68159490UL, 131072UL, 8282112UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // "queue" COMMA "reassemble" "scrub" EXLAMATION "no" OPENING_PAREN "user" 
 // "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" "flags" "icmp-type" 
 // "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_35(_tokenSet_35_data_,16);
-const unsigned long PFCfgParser::_tokenSet_36_data_[] = { 2064UL, 66UL, 76548098UL, 4161536UL, 4144192UL, 0UL, 1564672UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_36_data_[] = { 2064UL, 66UL, 76548098UL, 4161536UL, 8289344UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "on" "reassemble" "scrub" EXLAMATION "no" MINUS OPENING_PAREN 
 // "quick" "all" "user" "to" "inet" "inet6" "proto" "from" "route-to" "reply-to" 
-// "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" "flags" "icmp-type" 
-// "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" "label" 
+// "dup-to" "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" 
+// "flags" "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
+// "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_36(_tokenSet_36_data_,16);
 const unsigned long PFCfgParser::_tokenSet_37_data_[] = { 0UL, 8UL, 134217728UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // COMMA CLOSING_PAREN 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_37(_tokenSet_37_data_,10);
-const unsigned long PFCfgParser::_tokenSet_38_data_[] = { 2192UL, 88UL, 76548098UL, 4128768UL, 4144192UL, 0UL, 1564672UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_38_data_[] = { 2192UL, 88UL, 76548098UL, 4128768UL, 8289344UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE WORD "queue" COMMA CLOSING_BRACE "reassemble" "scrub" EXLAMATION 
 // "no" MINUS OPENING_PAREN "all" "user" "to" "inet" "inet6" "proto" "from" 
-// "route-to" "reply-to" "group" "fragment" "no-df" "min-ttl" "max-mss" 
-// "random-id" "flags" "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" 
-// "synproxy" "label" 
+// "route-to" "reply-to" "dup-to" "group" "fragment" "no-df" "min-ttl" 
+// "max-mss" "random-id" "flags" "icmp-type" "icmp6-type" "tagged" "tag" 
+// "keep" "modulate" "synproxy" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_38(_tokenSet_38_data_,16);
-const unsigned long PFCfgParser::_tokenSet_39_data_[] = { 2064UL, 134217820UL, 76548098UL, 4291231744UL, 4141183UL, 0UL, 1564672UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_39_data_[] = { 2064UL, 134217820UL, 76548098UL, 4291231744UL, 8282239UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" OPENING_BRACE COMMA CLOSING_BRACE "reassemble" INT_CONST 
 // "scrub" EXLAMATION "no" MINUS OPENING_PAREN "all" "user" "to" "ip" "icmp" 
 // "igmp" "tcp" "udp" "rdp" "rsvp" "gre" "esp" "ah" "eigrp" "ospf" "ipip" 
@@ -7370,25 +7322,25 @@ const unsigned long PFCfgParser::_tokenSet_40_data_[] = { 0UL, 134217740UL, 0UL,
 // OPENING_BRACE COMMA INT_CONST "ip" "icmp" "igmp" "tcp" "udp" "rdp" "rsvp" 
 // "gre" "esp" "ah" "eigrp" "ospf" "ipip" "vrrp" "l2tp" "isis" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_40(_tokenSet_40_data_,12);
-const unsigned long PFCfgParser::_tokenSet_41_data_[] = { 2064UL, 64UL, 76548098UL, 393216UL, 4141056UL, 0UL, 1564672UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_41_data_[] = { 2064UL, 64UL, 76548098UL, 393216UL, 8282112UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "reassemble" "scrub" EXLAMATION "no" MINUS OPENING_PAREN 
 // "user" "to" "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" 
 // "flags" "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
 // "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_41(_tokenSet_41_data_,16);
-const unsigned long PFCfgParser::_tokenSet_42_data_[] = { 2064UL, 64UL, 344983554UL, 393216UL, 4141056UL, 0UL, 1564672UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_42_data_[] = { 2064UL, 64UL, 344983554UL, 393216UL, 8282112UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "reassemble" "scrub" EXLAMATION "no" MINUS OPENING_PAREN 
 // "port" "user" "to" "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" 
 // "flags" "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
 // "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_42(_tokenSet_42_data_,16);
-const unsigned long PFCfgParser::_tokenSet_43_data_[] = { 2064UL, 64UL, 344983554UL, 131072UL, 4141056UL, 0UL, 1564672UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_43_data_[] = { 2064UL, 64UL, 344983554UL, 131072UL, 8282112UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "reassemble" "scrub" EXLAMATION "no" MINUS OPENING_PAREN 
 // "port" "user" "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" 
 // "flags" "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
 // "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_43(_tokenSet_43_data_,16);
-const unsigned long PFCfgParser::_tokenSet_44_data_[] = { 2192UL, 88UL, 882051090UL, 393216UL, 4141056UL, 0UL, 1564672UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_44_data_[] = { 2192UL, 88UL, 882051090UL, 393216UL, 8282112UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE WORD "queue" COMMA CLOSING_BRACE "reassemble" "scrub" LESS_THAN 
 // EXLAMATION "self" IPV4 "no" MINUS OPENING_PAREN "port" IPV6 "user" "to" 
 // "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" "flags" "icmp-type" 
@@ -7397,13 +7349,13 @@ const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_44(_tokenSet_44_da
 const unsigned long PFCfgParser::_tokenSet_45_data_[] = { 128UL, 8UL, 604178448UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // WORD COMMA LESS_THAN EXLAMATION "self" IPV4 OPENING_PAREN IPV6 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_45(_tokenSet_45_data_,10);
-const unsigned long PFCfgParser::_tokenSet_46_data_[] = { 2064UL, 88UL, 68159490UL, 4128768UL, 4141120UL, 0UL, 1564672UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_46_data_[] = { 2064UL, 88UL, 68159490UL, 4128768UL, 8282176UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" COMMA CLOSING_BRACE "reassemble" "scrub" EXLAMATION 
 // "no" OPENING_PAREN "all" "user" "to" "inet" "inet6" "proto" "from" "group" 
 // "fragment" "no-df" "min-ttl" "max-mss" "random-id" "flags" "icmp-type" 
 // "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_46(_tokenSet_46_data_,16);
-const unsigned long PFCfgParser::_tokenSet_47_data_[] = { 2064UL, 72UL, 68159490UL, 131072UL, 4141056UL, 0UL, 1564672UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_47_data_[] = { 2064UL, 72UL, 68159490UL, 131072UL, 8282112UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" COMMA "reassemble" "scrub" EXLAMATION "no" OPENING_PAREN 
 // "user" "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" "flags" 
 // "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
@@ -7412,13 +7364,13 @@ const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_47(_tokenSet_47_da
 const unsigned long PFCfgParser::_tokenSet_48_data_[] = { 128UL, 134217728UL, 48UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // WORD INT_CONST LESS_THAN GREATER_THAN 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_48(_tokenSet_48_data_,10);
-const unsigned long PFCfgParser::_tokenSet_49_data_[] = { 2448UL, 134217816UL, 68159538UL, 131072UL, 4141056UL, 0UL, 1564672UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_49_data_[] = { 2448UL, 134217816UL, 68159538UL, 131072UL, 8282112UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE WORD EQUAL "queue" COMMA CLOSING_BRACE "reassemble" INT_CONST 
 // "scrub" LESS_THAN GREATER_THAN EXLAMATION "no" OPENING_PAREN "user" 
 // "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" "flags" "icmp-type" 
 // "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_49(_tokenSet_49_data_,16);
-const unsigned long PFCfgParser::_tokenSet_50_data_[] = { 8178UL, 134217821UL, 108534846UL, 33685696UL, 4290769152UL, 32767UL, 2088960UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_50_data_[] = { 8178UL, 134217821UL, 108534846UL, 33685696UL, 4286570752UL, 65535UL, 4177920UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE LINE_COMMENT "include" WORD EQUAL "antispoof" "altq" "queue" 
 // "set" "skip" OPENING_BRACE COMMA CLOSING_BRACE "reassemble" INT_CONST 
 // "scrub" "match" "table" LESS_THAN GREATER_THAN STRING EXLAMATION COLON 
@@ -7436,16 +7388,16 @@ const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_51(_tokenSet_51_da
 const unsigned long PFCfgParser::_tokenSet_52_data_[] = { 128UL, 134217728UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // WORD INT_CONST 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_52(_tokenSet_52_data_,10);
-const unsigned long PFCfgParser::_tokenSet_53_data_[] = { 2064UL, 72UL, 202377218UL, 131072UL, 4141056UL, 0UL, 1564672UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_53_data_[] = { 2064UL, 72UL, 202377218UL, 131072UL, 8282112UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" COMMA "reassemble" "scrub" EXLAMATION "no" OPENING_PAREN 
 // CLOSING_PAREN "user" "group" "fragment" "no-df" "min-ttl" "max-mss" 
 // "random-id" "flags" "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" 
 // "synproxy" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_53(_tokenSet_53_data_,16);
-const unsigned long PFCfgParser::_tokenSet_54_data_[] = { 0UL, 72UL, 0UL, 0UL, 991232UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_54_data_[] = { 0UL, 72UL, 0UL, 0UL, 1982464UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // COMMA "reassemble" "fragment" "no-df" "min-ttl" "max-mss" "random-id" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_54(_tokenSet_54_data_,12);
-const unsigned long PFCfgParser::_tokenSet_55_data_[] = { 2064UL, 134217817UL, 68159490UL, 131072UL, 4290719744UL, 32767UL, 1564672UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_55_data_[] = { 2064UL, 134217817UL, 68159490UL, 131072UL, 4286472192UL, 65535UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "skip" COMMA CLOSING_BRACE "reassemble" INT_CONST "scrub" 
 // EXLAMATION "no" OPENING_PAREN "user" "group" "fragment" "no-df" "min-ttl" 
 // "max-mss" "random-id" "flags" "icmp-type" "echorep" "unreach" "squench" 
@@ -7455,13 +7407,13 @@ const unsigned long PFCfgParser::_tokenSet_55_data_[] = { 2064UL, 134217817UL, 6
 // "photuris" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
 // "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_55(_tokenSet_55_data_,16);
-const unsigned long PFCfgParser::_tokenSet_56_data_[] = { 0UL, 134217737UL, 0UL, 0UL, 4286578688UL, 32767UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_56_data_[] = { 0UL, 134217737UL, 0UL, 0UL, 4278190080UL, 65535UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // "skip" COMMA INT_CONST "echorep" "unreach" "squench" "redir" "althost" 
 // "echoreq" "routeradv" "routersol" "timex" "paramprob" "timereq" "timerep" 
 // "inforeq" "inforep" "maskreq" "maskrep" "trace" "dataconv" "mobredir" 
 // "ipv6-where" "ipv6-here" "mobregreq" "mobregrep" "photuris" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_56(_tokenSet_56_data_,12);
-const unsigned long PFCfgParser::_tokenSet_57_data_[] = { 2064UL, 134217817UL, 68159490UL, 131072UL, 4294914048UL, 32767UL, 1564672UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_57_data_[] = { 2064UL, 134217817UL, 68159490UL, 131072UL, 4294860800UL, 65535UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "skip" COMMA CLOSING_BRACE "reassemble" INT_CONST "scrub" 
 // EXLAMATION "no" OPENING_PAREN "user" "group" "fragment" "no-df" "min-ttl" 
 // "max-mss" "random-id" "flags" "icmp-type" "code" "echorep" "unreach" 
@@ -7471,14 +7423,14 @@ const unsigned long PFCfgParser::_tokenSet_57_data_[] = { 2064UL, 134217817UL, 6
 // "photuris" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
 // "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_57(_tokenSet_57_data_,16);
-const unsigned long PFCfgParser::_tokenSet_58_data_[] = { 2448UL, 134217816UL, 613419058UL, 393216UL, 4141056UL, 0UL, 1564672UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_58_data_[] = { 2448UL, 134217816UL, 613419058UL, 393216UL, 8282112UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE WORD EQUAL "queue" COMMA CLOSING_BRACE "reassemble" INT_CONST 
 // "scrub" LESS_THAN GREATER_THAN EXLAMATION "no" MINUS OPENING_PAREN IPV6 
 // "user" "to" "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" 
 // "flags" "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
 // "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_58(_tokenSet_58_data_,16);
-const unsigned long PFCfgParser::_tokenSet_59_data_[] = { 8178UL, 134217821UL, 653990974UL, 33947840UL, 4290769664UL, 32767UL, 2088960UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_59_data_[] = { 8178UL, 134217821UL, 653990974UL, 33947840UL, 4286571264UL, 65535UL, 4177920UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE LINE_COMMENT "include" WORD EQUAL "antispoof" "altq" "queue" 
 // "set" "skip" OPENING_BRACE COMMA CLOSING_BRACE "reassemble" INT_CONST 
 // "scrub" "match" "table" LESS_THAN GREATER_THAN STRING EXLAMATION COLON 
diff --git a/src/parsers/PFCfgParser.hpp b/src/parsers/PFCfgParser.hpp
index e45fbfa48..0b5fe4ec3 100644
--- a/src/parsers/PFCfgParser.hpp
+++ b/src/parsers/PFCfgParser.hpp
@@ -9,7 +9,7 @@
 
 #line 11 "PFCfgParser.hpp"
 #include <antlr/config.hpp>
-/* $ANTLR 2.7.7 (20090306): "pf.g" -> "PFCfgParser.hpp"$ */
+/* $ANTLR 2.7.7 (20100319): "pf.g" -> "PFCfgParser.hpp"$ */
 #include <antlr/TokenStream.hpp>
 #include <antlr/TokenBuffer.hpp>
 #include "PFCfgParserTokenTypes.hpp"
@@ -165,6 +165,7 @@ public:
 	public: void host_list();
 	public: void route_to();
 	public: void reply_to();
+	public: void dup_to();
 	public: void routehost();
 	public: void routehost_list();
 	public: void filteropt();
@@ -200,10 +201,10 @@ protected:
 private:
 	static const char* tokenNames[];
 #ifndef NO_STATIC_CONSTS
-	static const int NUM_TOKENS = 261;
+	static const int NUM_TOKENS = 262;
 #else
 	enum {
-		NUM_TOKENS = 261
+		NUM_TOKENS = 262
 	};
 #endif
 	
diff --git a/src/parsers/PFCfgParserTokenTypes.hpp b/src/parsers/PFCfgParserTokenTypes.hpp
index ae0e15ba7..221b7acec 100644
--- a/src/parsers/PFCfgParserTokenTypes.hpp
+++ b/src/parsers/PFCfgParserTokenTypes.hpp
@@ -1,7 +1,7 @@
 #ifndef INC_PFCfgParserTokenTypes_hpp_
 #define INC_PFCfgParserTokenTypes_hpp_
 
-/* $ANTLR 2.7.7 (20090306): "pf.g" -> "PFCfgParserTokenTypes.hpp"$ */
+/* $ANTLR 2.7.7 (20100319): "pf.g" -> "PFCfgParserTokenTypes.hpp"$ */
 
 #ifndef CUSTOM_API
 # define CUSTOM_API
@@ -148,127 +148,128 @@ struct CUSTOM_API PFCfgParserTokenTypes {
 		NO_ROUTE = 137,
 		ROUTE_TO = 138,
 		REPLY_TO = 139,
-		GROUP = 140,
-		LITERAL_fragment = 141,
-		LITERAL_crop = 142,
-		// "drop-ovl" = 143
-		// "no-df" = 144
-		// "min-ttl" = 145
-		// "max-mss" = 146
-		// "random-id" = 147
-		FLAGS = 148,
-		ICMP_TYPE = 149,
-		ICMP_CODE = 150,
-		LITERAL_echorep = 151,
-		LITERAL_unreach = 152,
-		LITERAL_squench = 153,
-		LITERAL_redir = 154,
-		LITERAL_althost = 155,
-		LITERAL_echoreq = 156,
-		LITERAL_routeradv = 157,
-		LITERAL_routersol = 158,
-		LITERAL_timex = 159,
-		LITERAL_paramprob = 160,
-		LITERAL_timereq = 161,
-		LITERAL_timerep = 162,
-		LITERAL_inforeq = 163,
-		LITERAL_inforep = 164,
-		LITERAL_maskreq = 165,
-		LITERAL_maskrep = 166,
-		LITERAL_trace = 167,
-		LITERAL_dataconv = 168,
-		LITERAL_mobredir = 169,
-		// "ipv6-where" = 170
-		// "ipv6-here" = 171
-		LITERAL_mobregreq = 172,
-		LITERAL_mobregrep = 173,
-		LITERAL_photuris = 174,
-		// "net-unr" = 175
-		// "host-unr" = 176
-		// "proto-unr" = 177
-		// "port-unr" = 178
-		LITERAL_needfrag = 179,
-		LITERAL_srcfail = 180,
-		// "net-unk" = 181
-		// "host-unk" = 182
-		LITERAL_isolate = 183,
-		// "net-prohib" = 184
-		// "host-prohib" = 185
-		// "net-tos" = 186
-		// "host-tos" = 187
-		// "filter-prohib" = 188
-		// "host-preced" = 189
-		// "cutoff-preced" = 190
-		// "redir-net" = 191
-		// "redir-host" = 192
-		// "redir-tos-net" = 193
-		// "redir-tos-host" = 194
-		// "normal-adv" = 195
-		// "common-adv" = 196
-		LITERAL_transit = 197,
-		LITERAL_reassemb = 198,
-		LITERAL_badhead = 199,
-		LITERAL_optmiss = 200,
-		LITERAL_badlen = 201,
-		// "unknown-ind" = 202
-		// "auth-fail" = 203
-		// "decrypt-fail" = 204
-		ICMP6_TYPE = 205,
-		TAGGED = 206,
-		TAG = 207,
-		KEEP = 208,
-		MODULATE = 209,
-		SYNPROXY = 210,
-		STATE = 211,
-		LABEL = 212,
-		EXIT = 213,
-		QUIT = 214,
-		INTRFACE = 215,
-		ICMP6 = 216,
-		IGRP = 217,
-		IPSEC = 218,
-		NOS = 219,
-		PCP = 220,
-		PIM = 221,
-		PPTP = 222,
-		RIP = 223,
-		SNP = 224,
-		HOST = 225,
-		RANGE = 226,
-		LOG_LEVEL_ALERTS = 227,
-		LOG_LEVEL_CRITICAL = 228,
-		LOG_LEVEL_DEBUGGING = 229,
-		LOG_LEVEL_EMERGENCIES = 230,
-		LOG_LEVEL_ERRORS = 231,
-		LOG_LEVEL_INFORMATIONAL = 232,
-		LOG_LEVEL_NOTIFICATIONS = 233,
-		LOG_LEVEL_WARNINGS = 234,
-		LOG_LEVEL_DISABLE = 235,
-		LOG_LEVEL_INACTIVE = 236,
-		Whitespace = 237,
-		HEX_CONST = 238,
-		NEG_INT_CONST = 239,
-		HEX_DIGIT = 240,
-		DIGIT = 241,
-		NUM_3DIGIT = 242,
-		NUM_HEX_4DIGIT = 243,
-		NUMBER_ADDRESS_OR_WORD = 244,
-		PIPE_CHAR = 245,
-		NUMBER_SIGN = 246,
-		PERCENT = 247,
-		AMPERSAND = 248,
-		APOSTROPHE = 249,
-		PLUS = 250,
-		DOT = 251,
-		SEMICOLON = 252,
-		QUESTION = 253,
-		COMMERCIAL_AT = 254,
-		OPENING_SQUARE = 255,
-		CLOSING_SQUARE = 256,
-		CARET = 257,
-		UNDERLINE = 258,
-		TILDE = 259,
-		DOUBLE_QUOTE = 260,
+		DUP_TO = 140,
+		GROUP = 141,
+		LITERAL_fragment = 142,
+		LITERAL_crop = 143,
+		// "drop-ovl" = 144
+		// "no-df" = 145
+		// "min-ttl" = 146
+		// "max-mss" = 147
+		// "random-id" = 148
+		FLAGS = 149,
+		ICMP_TYPE = 150,
+		ICMP_CODE = 151,
+		LITERAL_echorep = 152,
+		LITERAL_unreach = 153,
+		LITERAL_squench = 154,
+		LITERAL_redir = 155,
+		LITERAL_althost = 156,
+		LITERAL_echoreq = 157,
+		LITERAL_routeradv = 158,
+		LITERAL_routersol = 159,
+		LITERAL_timex = 160,
+		LITERAL_paramprob = 161,
+		LITERAL_timereq = 162,
+		LITERAL_timerep = 163,
+		LITERAL_inforeq = 164,
+		LITERAL_inforep = 165,
+		LITERAL_maskreq = 166,
+		LITERAL_maskrep = 167,
+		LITERAL_trace = 168,
+		LITERAL_dataconv = 169,
+		LITERAL_mobredir = 170,
+		// "ipv6-where" = 171
+		// "ipv6-here" = 172
+		LITERAL_mobregreq = 173,
+		LITERAL_mobregrep = 174,
+		LITERAL_photuris = 175,
+		// "net-unr" = 176
+		// "host-unr" = 177
+		// "proto-unr" = 178
+		// "port-unr" = 179
+		LITERAL_needfrag = 180,
+		LITERAL_srcfail = 181,
+		// "net-unk" = 182
+		// "host-unk" = 183
+		LITERAL_isolate = 184,
+		// "net-prohib" = 185
+		// "host-prohib" = 186
+		// "net-tos" = 187
+		// "host-tos" = 188
+		// "filter-prohib" = 189
+		// "host-preced" = 190
+		// "cutoff-preced" = 191
+		// "redir-net" = 192
+		// "redir-host" = 193
+		// "redir-tos-net" = 194
+		// "redir-tos-host" = 195
+		// "normal-adv" = 196
+		// "common-adv" = 197
+		LITERAL_transit = 198,
+		LITERAL_reassemb = 199,
+		LITERAL_badhead = 200,
+		LITERAL_optmiss = 201,
+		LITERAL_badlen = 202,
+		// "unknown-ind" = 203
+		// "auth-fail" = 204
+		// "decrypt-fail" = 205
+		ICMP6_TYPE = 206,
+		TAGGED = 207,
+		TAG = 208,
+		KEEP = 209,
+		MODULATE = 210,
+		SYNPROXY = 211,
+		STATE = 212,
+		LABEL = 213,
+		EXIT = 214,
+		QUIT = 215,
+		INTRFACE = 216,
+		ICMP6 = 217,
+		IGRP = 218,
+		IPSEC = 219,
+		NOS = 220,
+		PCP = 221,
+		PIM = 222,
+		PPTP = 223,
+		RIP = 224,
+		SNP = 225,
+		HOST = 226,
+		RANGE = 227,
+		LOG_LEVEL_ALERTS = 228,
+		LOG_LEVEL_CRITICAL = 229,
+		LOG_LEVEL_DEBUGGING = 230,
+		LOG_LEVEL_EMERGENCIES = 231,
+		LOG_LEVEL_ERRORS = 232,
+		LOG_LEVEL_INFORMATIONAL = 233,
+		LOG_LEVEL_NOTIFICATIONS = 234,
+		LOG_LEVEL_WARNINGS = 235,
+		LOG_LEVEL_DISABLE = 236,
+		LOG_LEVEL_INACTIVE = 237,
+		Whitespace = 238,
+		HEX_CONST = 239,
+		NEG_INT_CONST = 240,
+		HEX_DIGIT = 241,
+		DIGIT = 242,
+		NUM_3DIGIT = 243,
+		NUM_HEX_4DIGIT = 244,
+		NUMBER_ADDRESS_OR_WORD = 245,
+		PIPE_CHAR = 246,
+		NUMBER_SIGN = 247,
+		PERCENT = 248,
+		AMPERSAND = 249,
+		APOSTROPHE = 250,
+		PLUS = 251,
+		DOT = 252,
+		SEMICOLON = 253,
+		QUESTION = 254,
+		COMMERCIAL_AT = 255,
+		OPENING_SQUARE = 256,
+		CLOSING_SQUARE = 257,
+		CARET = 258,
+		UNDERLINE = 259,
+		TILDE = 260,
+		DOUBLE_QUOTE = 261,
 		NULL_TREE_LOOKAHEAD = 3
 	};
 #ifdef __cplusplus
diff --git a/src/parsers/PFCfgParserTokenTypes.txt b/src/parsers/PFCfgParserTokenTypes.txt
index ebacff9bf..55eb57e32 100644
--- a/src/parsers/PFCfgParserTokenTypes.txt
+++ b/src/parsers/PFCfgParserTokenTypes.txt
@@ -1,4 +1,4 @@
-// $ANTLR 2.7.7 (20090306): pf.g -> PFCfgParserTokenTypes.txt$
+// $ANTLR 2.7.7 (20100319): pf.g -> PFCfgParserTokenTypes.txt$
 PFCfgParser    // output token vocab name
 NEWLINE=4
 LINE_COMMENT=5
@@ -136,124 +136,125 @@ ANY="any"=136
 NO_ROUTE="no-route"=137
 ROUTE_TO="route-to"=138
 REPLY_TO="reply-to"=139
-GROUP="group"=140
-LITERAL_fragment="fragment"=141
-LITERAL_crop="crop"=142
-"drop-ovl"=143
-"no-df"=144
-"min-ttl"=145
-"max-mss"=146
-"random-id"=147
-FLAGS="flags"=148
-ICMP_TYPE="icmp-type"=149
-ICMP_CODE="code"=150
-LITERAL_echorep="echorep"=151
-LITERAL_unreach="unreach"=152
-LITERAL_squench="squench"=153
-LITERAL_redir="redir"=154
-LITERAL_althost="althost"=155
-LITERAL_echoreq="echoreq"=156
-LITERAL_routeradv="routeradv"=157
-LITERAL_routersol="routersol"=158
-LITERAL_timex="timex"=159
-LITERAL_paramprob="paramprob"=160
-LITERAL_timereq="timereq"=161
-LITERAL_timerep="timerep"=162
-LITERAL_inforeq="inforeq"=163
-LITERAL_inforep="inforep"=164
-LITERAL_maskreq="maskreq"=165
-LITERAL_maskrep="maskrep"=166
-LITERAL_trace="trace"=167
-LITERAL_dataconv="dataconv"=168
-LITERAL_mobredir="mobredir"=169
-"ipv6-where"=170
-"ipv6-here"=171
-LITERAL_mobregreq="mobregreq"=172
-LITERAL_mobregrep="mobregrep"=173
-LITERAL_photuris="photuris"=174
-"net-unr"=175
-"host-unr"=176
-"proto-unr"=177
-"port-unr"=178
-LITERAL_needfrag="needfrag"=179
-LITERAL_srcfail="srcfail"=180
-"net-unk"=181
-"host-unk"=182
-LITERAL_isolate="isolate"=183
-"net-prohib"=184
-"host-prohib"=185
-"net-tos"=186
-"host-tos"=187
-"filter-prohib"=188
-"host-preced"=189
-"cutoff-preced"=190
-"redir-net"=191
-"redir-host"=192
-"redir-tos-net"=193
-"redir-tos-host"=194
-"normal-adv"=195
-"common-adv"=196
-LITERAL_transit="transit"=197
-LITERAL_reassemb="reassemb"=198
-LITERAL_badhead="badhead"=199
-LITERAL_optmiss="optmiss"=200
-LITERAL_badlen="badlen"=201
-"unknown-ind"=202
-"auth-fail"=203
-"decrypt-fail"=204
-ICMP6_TYPE="icmp6-type"=205
-TAGGED="tagged"=206
-TAG="tag"=207
-KEEP="keep"=208
-MODULATE="modulate"=209
-SYNPROXY="synproxy"=210
-STATE="state"=211
-LABEL="label"=212
-EXIT="exit"=213
-QUIT="quit"=214
-INTRFACE="interface"=215
-ICMP6="icmp6"=216
-IGRP="igrp"=217
-IPSEC="ipsec"=218
-NOS="nos"=219
-PCP="pcp"=220
-PIM="pim"=221
-PPTP="pptp"=222
-RIP="rip"=223
-SNP="snp"=224
-HOST="host"=225
-RANGE="range"=226
-LOG_LEVEL_ALERTS="alerts"=227
-LOG_LEVEL_CRITICAL="critical"=228
-LOG_LEVEL_DEBUGGING="debugging"=229
-LOG_LEVEL_EMERGENCIES="emergencies"=230
-LOG_LEVEL_ERRORS="errors"=231
-LOG_LEVEL_INFORMATIONAL="informational"=232
-LOG_LEVEL_NOTIFICATIONS="notifications"=233
-LOG_LEVEL_WARNINGS="warnings"=234
-LOG_LEVEL_DISABLE="disable"=235
-LOG_LEVEL_INACTIVE="inactive"=236
-Whitespace=237
-HEX_CONST=238
-NEG_INT_CONST=239
-HEX_DIGIT=240
-DIGIT=241
-NUM_3DIGIT=242
-NUM_HEX_4DIGIT=243
-NUMBER_ADDRESS_OR_WORD=244
-PIPE_CHAR=245
-NUMBER_SIGN=246
-PERCENT=247
-AMPERSAND=248
-APOSTROPHE=249
-PLUS=250
-DOT=251
-SEMICOLON=252
-QUESTION=253
-COMMERCIAL_AT=254
-OPENING_SQUARE=255
-CLOSING_SQUARE=256
-CARET=257
-UNDERLINE=258
-TILDE=259
-DOUBLE_QUOTE=260
+DUP_TO="dup-to"=140
+GROUP="group"=141
+LITERAL_fragment="fragment"=142
+LITERAL_crop="crop"=143
+"drop-ovl"=144
+"no-df"=145
+"min-ttl"=146
+"max-mss"=147
+"random-id"=148
+FLAGS="flags"=149
+ICMP_TYPE="icmp-type"=150
+ICMP_CODE="code"=151
+LITERAL_echorep="echorep"=152
+LITERAL_unreach="unreach"=153
+LITERAL_squench="squench"=154
+LITERAL_redir="redir"=155
+LITERAL_althost="althost"=156
+LITERAL_echoreq="echoreq"=157
+LITERAL_routeradv="routeradv"=158
+LITERAL_routersol="routersol"=159
+LITERAL_timex="timex"=160
+LITERAL_paramprob="paramprob"=161
+LITERAL_timereq="timereq"=162
+LITERAL_timerep="timerep"=163
+LITERAL_inforeq="inforeq"=164
+LITERAL_inforep="inforep"=165
+LITERAL_maskreq="maskreq"=166
+LITERAL_maskrep="maskrep"=167
+LITERAL_trace="trace"=168
+LITERAL_dataconv="dataconv"=169
+LITERAL_mobredir="mobredir"=170
+"ipv6-where"=171
+"ipv6-here"=172
+LITERAL_mobregreq="mobregreq"=173
+LITERAL_mobregrep="mobregrep"=174
+LITERAL_photuris="photuris"=175
+"net-unr"=176
+"host-unr"=177
+"proto-unr"=178
+"port-unr"=179
+LITERAL_needfrag="needfrag"=180
+LITERAL_srcfail="srcfail"=181
+"net-unk"=182
+"host-unk"=183
+LITERAL_isolate="isolate"=184
+"net-prohib"=185
+"host-prohib"=186
+"net-tos"=187
+"host-tos"=188
+"filter-prohib"=189
+"host-preced"=190
+"cutoff-preced"=191
+"redir-net"=192
+"redir-host"=193
+"redir-tos-net"=194
+"redir-tos-host"=195
+"normal-adv"=196
+"common-adv"=197
+LITERAL_transit="transit"=198
+LITERAL_reassemb="reassemb"=199
+LITERAL_badhead="badhead"=200
+LITERAL_optmiss="optmiss"=201
+LITERAL_badlen="badlen"=202
+"unknown-ind"=203
+"auth-fail"=204
+"decrypt-fail"=205
+ICMP6_TYPE="icmp6-type"=206
+TAGGED="tagged"=207
+TAG="tag"=208
+KEEP="keep"=209
+MODULATE="modulate"=210
+SYNPROXY="synproxy"=211
+STATE="state"=212
+LABEL="label"=213
+EXIT="exit"=214
+QUIT="quit"=215
+INTRFACE="interface"=216
+ICMP6="icmp6"=217
+IGRP="igrp"=218
+IPSEC="ipsec"=219
+NOS="nos"=220
+PCP="pcp"=221
+PIM="pim"=222
+PPTP="pptp"=223
+RIP="rip"=224
+SNP="snp"=225
+HOST="host"=226
+RANGE="range"=227
+LOG_LEVEL_ALERTS="alerts"=228
+LOG_LEVEL_CRITICAL="critical"=229
+LOG_LEVEL_DEBUGGING="debugging"=230
+LOG_LEVEL_EMERGENCIES="emergencies"=231
+LOG_LEVEL_ERRORS="errors"=232
+LOG_LEVEL_INFORMATIONAL="informational"=233
+LOG_LEVEL_NOTIFICATIONS="notifications"=234
+LOG_LEVEL_WARNINGS="warnings"=235
+LOG_LEVEL_DISABLE="disable"=236
+LOG_LEVEL_INACTIVE="inactive"=237
+Whitespace=238
+HEX_CONST=239
+NEG_INT_CONST=240
+HEX_DIGIT=241
+DIGIT=242
+NUM_3DIGIT=243
+NUM_HEX_4DIGIT=244
+NUMBER_ADDRESS_OR_WORD=245
+PIPE_CHAR=246
+NUMBER_SIGN=247
+PERCENT=248
+AMPERSAND=249
+APOSTROPHE=250
+PLUS=251
+DOT=252
+SEMICOLON=253
+QUESTION=254
+COMMERCIAL_AT=255
+OPENING_SQUARE=256
+CLOSING_SQUARE=257
+CARET=258
+UNDERLINE=259
+TILDE=260
+DOUBLE_QUOTE=261
diff --git a/src/parsers/pf.g b/src/parsers/pf.g
index 642fb9690..ec37d18ef 100644
--- a/src/parsers/pf.g
+++ b/src/parsers/pf.g
@@ -1274,7 +1274,7 @@ host_list :
 
 // ************************************************************************
 route :
-        route_to | reply_to
+        route_to | reply_to | dup_to
     ;
 
 route_to :
@@ -1291,6 +1291,13 @@ reply_to :
         }
     ;
 
+dup_to :
+        DUP_TO ( routehost | routehost_list )
+        {
+            importer->route_type = PFImporter::DUP_TO;
+        }
+    ;
+
 routehost { RouteSpec rs; } :
         OPENING_PAREN
         WORD { rs.iface = LT(0)->getText(); }
@@ -1942,6 +1949,7 @@ tokens
 
     ROUTE_TO = "route-to";
     REPLY_TO = "reply-to";
+    DUP_TO = "dup-to";
 
     DROP = "drop";
     RETURN = "return";
diff --git a/src/unit_tests/PFImporterTest/PFImporterTest.cpp b/src/unit_tests/PFImporterTest/PFImporterTest.cpp
index a3efeeb6d..e4ea13f7b 100644
--- a/src/unit_tests/PFImporterTest/PFImporterTest.cpp
+++ b/src/unit_tests/PFImporterTest/PFImporterTest.cpp
@@ -523,6 +523,24 @@ void PFImporterTest::userGroupMatches()
                     "pf-user-group-matches.fwb");
 }
 
+void PFImporterTest::routeToTest()
+{
+    platform = "pf";
+
+    std::istringstream instream(
+        openTestFile("test_data/pf-route-to.conf"));
+
+    Importer* imp = new PFImporter(lib, instream, logger, "test_fw");
+    CPPUNIT_ASSERT_NO_THROW( imp->run() );
+    imp->finalize();
+
+    db->setPredictableIds();
+    db->saveFile("pf-route-to.fwb");
+
+    compareResults(logger, "test_data/pf-route-to.output", "pf-route-to.output");
+    compareFwbFiles("test_data/pf-route-to.fwb", "pf-route-to.fwb");
+}
+
 
 
 
diff --git a/src/unit_tests/PFImporterTest/PFImporterTest.h b/src/unit_tests/PFImporterTest/PFImporterTest.h
index 5b838c5c2..518a9b5bb 100644
--- a/src/unit_tests/PFImporterTest/PFImporterTest.h
+++ b/src/unit_tests/PFImporterTest/PFImporterTest.h
@@ -74,6 +74,7 @@ public:
     void scrubCommandsNew();
     void tableDefinitions();
     void userGroupMatches();
+    void routeToTest();
     
     CPPUNIT_TEST_SUITE(PFImporterTest);
 
@@ -93,6 +94,7 @@ public:
     CPPUNIT_TEST(scrubCommandsNew);
     CPPUNIT_TEST(tableDefinitions);
     CPPUNIT_TEST(userGroupMatches);
+    CPPUNIT_TEST(routeToTest);
     
     CPPUNIT_TEST_SUITE_END();
 
diff --git a/src/unit_tests/PFImporterTest/test_data/pf-hosts-matches.output b/src/unit_tests/PFImporterTest/test_data/pf-hosts-matches.output
index 8e1ecc712..22a370f9f 100644
--- a/src/unit_tests/PFImporterTest/test_data/pf-hosts-matches.output
+++ b/src/unit_tests/PFImporterTest/test_data/pf-hosts-matches.output
@@ -1,8 +1,8 @@
-5: Address Table: <dst_addresses_1>:  192.168.1.1/, 192.168.1.2/, 192.168.2.0/24
+5: Address Table: <dst_addresses_1>:  192.168.1.1, 192.168.1.2, 192.168.2.0/24
+6: Address Table: <dst_addresses_2>:  pcn0, pcn0
 6: New interface: pcn0
-6: Address Table: <dst_addresses_2>:  pcn0/, pcn0/
-7: Address Table: <dst_addresses_3>:  pcn0/, pcn0/
-8: Address Table: <dst_addresses_4>:  www.fwbuilder.org/, www.netcitadel.com/
+7: Address Table: <dst_addresses_3>:  pcn0, pcn0
+8: Address Table: <dst_addresses_4>:  www.fwbuilder.org, www.netcitadel.com
 11: filtering rule: action pass; interfaces: 
 12: filtering rule: action pass; interfaces: 
 12: Error: import of 'interface:broadcast' is not supported.
diff --git a/src/unit_tests/PFImporterTest/test_data/pf-route-to.conf b/src/unit_tests/PFImporterTest/test_data/pf-route-to.conf
new file mode 100644
index 000000000..122e45800
--- /dev/null
+++ b/src/unit_tests/PFImporterTest/test_data/pf-route-to.conf
@@ -0,0 +1,7 @@
+
+pass in log quick route-to { ( em0 10.1.2.3 ) } inet from 192.168.1.0/24 to any
+
+pass in quick on bce0 reply-to ( bce0 10.3.4.5 ) inet from 192.168.1.0/24 to any
+
+pass out quick on bce0 dup-to (em0 10.1.2.3) proto tcp from any  port 80 to any
+
diff --git a/src/unit_tests/PFImporterTest/test_data/pf-route-to.fwb b/src/unit_tests/PFImporterTest/test_data/pf-route-to.fwb
new file mode 100644
index 000000000..5871d3756
--- /dev/null
+++ b/src/unit_tests/PFImporterTest/test_data/pf-route-to.fwb
@@ -0,0 +1,563 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
+<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="22" lastModified="1309988144" id="root">
+  <Library id="syslib000" color="#d4f8ff" name="Standard" comment="Standard objects" ro="True">
+    <AnyNetwork id="sysid0" name="Any" comment="Any Network" ro="False" address="0.0.0.0" netmask="0.0.0.0"/>
+    <AnyIPService id="sysid1" protocol_num="0" name="Any" comment="Any IP Service" ro="False"/>
+    <AnyInterval id="sysid2" days_of_week="0,1,2,3,4,5,6" from_day="-1" from_hour="-1" from_minute="-1" from_month="-1" from_weekday="-1" from_year="-1" to_day="-1" to_hour="-1" to_minute="-1" to_month="-1" to_weekday="-1" to_year="-1" name="Any" comment="Any Interval" ro="False"/>
+    <ObjectGroup id="stdid01" name="Objects" comment="" ro="False">
+      <ObjectGroup id="stdid16" name="Addresses" comment="" ro="False">
+        <IPv4 id="id2001X88798" name="all-hosts" comment="" ro="False" address="224.0.0.1" netmask="0.0.0.0"/>
+        <IPv4 id="id2002X88798" name="all-routers" comment="" ro="False" address="224.0.0.2" netmask="0.0.0.0"/>
+        <IPv4 id="id2003X88798" name="all DVMRP" comment="" ro="False" address="224.0.0.4" netmask="0.0.0.0"/>
+        <IPv4 id="id2117X88798" name="OSPF (all routers)" comment="RFC2328" ro="False" address="224.0.0.5" netmask="0.0.0.0"/>
+        <IPv4 id="id2128X88798" name="OSPF (designated routers)" comment="RFC2328" ro="False" address="224.0.0.6" netmask="0.0.0.0"/>
+        <IPv4 id="id2430X88798" name="RIP" comment="RFC1723" ro="False" address="224.0.0.9" netmask="0.0.0.0"/>
+        <IPv4 id="id2439X88798" name="EIGRP" comment="" ro="False" address="224.0.0.10" netmask="0.0.0.0"/>
+        <IPv4 id="id2446X88798" name="DHCP server, relay agent" comment="RFC 1884" ro="False" address="224.0.0.12" netmask="0.0.0.0"/>
+        <IPv4 id="id2455X88798" name="PIM" comment="" ro="False" address="224.0.0.13" netmask="0.0.0.0"/>
+        <IPv4 id="id2462X88798" name="RSVP" comment="" ro="False" address="224.0.0.14" netmask="0.0.0.0"/>
+        <IPv4 id="id2469X88798" name="VRRP" comment="RFC3768" ro="False" address="224.0.0.18" netmask="0.0.0.0"/>
+        <IPv4 id="id2777X88798" name="IGMP" comment="" ro="False" address="224.0.0.22" netmask="0.0.0.0"/>
+        <IPv4 id="id2784X88798" name="OSPFIGP-TE" comment="RFC4973" ro="False" address="224.0.0.24" netmask="0.0.0.0"/>
+        <IPv4 id="id3094X88798" name="HSRP" comment="" ro="False" address="224.0.0.102" netmask="0.0.0.0"/>
+        <IPv4 id="id3403X88798" name="mDNS" comment="" ro="False" address="224.0.0.251" netmask="0.0.0.0"/>
+        <IPv4 id="id3410X88798" name="LLMNR" comment="Link-Local Multicast Name Resolution, RFC4795" ro="False" address="224.0.0.252" netmask="0.0.0.0"/>
+        <IPv4 id="id3411X88798" name="Teredo" comment="" ro="False" address="224.0.0.253" netmask="0.0.0.0"/>
+      </ObjectGroup>
+      <ObjectGroup id="stdid17" name="DNS Names" comment="" ro="False"/>
+      <ObjectGroup id="stdid18" name="Address Tables" comment="" ro="False"/>
+      <ObjectGroup id="stdid04" name="Groups" comment="" ro="False">
+        <ObjectGroup id="id3DC75CE8" name="rfc1918-nets" comment="" ro="False">
+          <ObjectRef ref="id3DC75CE5"/>
+          <ObjectRef ref="id3DC75CE6"/>
+          <ObjectRef ref="id3DC75CE7"/>
+        </ObjectGroup>
+        <ObjectGroup id="id3292X75851" name="ipv6 private" comment="These are various ipv6 networks that should not be routed on the Internet&#10;" ro="False">
+          <ObjectRef ref="id2088X75851"/>
+          <ObjectRef ref="id2986X75851"/>
+          <ObjectRef ref="id2383X75851"/>
+        </ObjectGroup>
+      </ObjectGroup>
+      <ObjectGroup id="stdid02" name="Hosts" comment="" ro="False">
+        <Host id="id3D84EECE" name="internal server" comment="This host is used in examples and template objects" ro="False">
+          <Interface id="id3D84EED2" dedicated_failover="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
+            <IPv4 id="id3D84EED3" name="ip" comment="" ro="False" address="192.168.1.10" netmask="255.255.255.0"/>
+            <InterfaceOptions/>
+          </Interface>
+          <Management address="192.168.1.10">
+            <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
+            <FWBDManagement enabled="False" identity="" port="-1"/>
+            <PolicyInstallScript arguments="" command="" enabled="False"/>
+          </Management>
+          <HostOptions>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
+            <Option name="use_mac_addr">false</Option>
+            <Option name="use_mac_addr_filter">False</Option>
+          </HostOptions>
+        </Host>
+        <Host id="id3D84EECF" name="server on dmz" comment="This host is used in examples and template objects" ro="False">
+          <Interface id="id3D84EEE3" dedicated_failover="False" dyn="False" security_level="0" unnum="False" unprotected="False" name="eth0" comment="" ro="False">
+            <IPv4 id="id3D84EEE4" name="ip" comment="" ro="False" address="192.168.2.10" netmask="255.255.255.0"/>
+            <InterfaceOptions/>
+          </Interface>
+          <Management address="192.168.2.10">
+            <SNMPManagement enabled="False" snmp_read_community="" snmp_write_community=""/>
+            <FWBDManagement enabled="False" identity="" port="-1"/>
+            <PolicyInstallScript arguments="" command="" enabled="False"/>
+          </Management>
+          <HostOptions>
+            <Option name="snmp_contact"></Option>
+            <Option name="snmp_description"></Option>
+            <Option name="snmp_location"></Option>
+            <Option name="use_mac_addr">false</Option>
+            <Option name="use_mac_addr_filter">False</Option>
+          </HostOptions>
+        </Host>
+      </ObjectGroup>
+      <ObjectGroup id="stdid03" name="Networks" comment="" ro="False">
+        <Network id="id3DC75CEC" name="all multicasts" comment="224.0.0.0/4 - This block, formerly known as the Class D address&#10;space, is allocated for use in IPv4 multicast address assignments.&#10;The IANA guidelines for assignments from this space are described in&#10;[RFC3171].&#10;" ro="False" address="224.0.0.0" netmask="240.0.0.0"/>
+        <Network id="id3F4ECE3E" name="link-local" comment="169.254.0.0/16 - This is the &quot;link local&quot; block.  It is allocated for&#10;communication between hosts on a single link.  Hosts obtain these&#10;addresses by auto-configuration, such as when a DHCP server may not&#10;be found.&#10;" ro="False" address="169.254.0.0" netmask="255.255.0.0"/>
+        <Network id="id3F4ECE3D" name="loopback-net" comment="127.0.0.0/8 - This block is assigned for use as the Internet host&#10;loopback address.  A datagram sent by a higher level protocol to an&#10;address anywhere within this block should loop back inside the host.&#10;This is ordinarily implemented using only 127.0.0.1/32 for loopback,&#10;but no addresses within this block should ever appear on any network&#10;anywhere [RFC1700, page 5].&#10;" ro="False" address="127.0.0.0" netmask="255.0.0.0"/>
+        <Network id="id3DC75CE5" name="net-10.0.0.0" comment="10.0.0.0/8 - This block is set aside for use in private networks.&#10;Its intended use is documented in [RFC1918].  Addresses within this&#10;block should not appear on the public Internet." ro="False" address="10.0.0.0" netmask="255.0.0.0"/>
+        <Network id="id3DC75CE7" name="net-172.16.0.0" comment="172.16.0.0/12 - This block is set aside for use in private networks.&#10;Its intended use is documented in [RFC1918].  Addresses within this&#10;block should not appear on the public Internet.&#10;" ro="False" address="172.16.0.0" netmask="255.240.0.0"/>
+        <Network id="id3DC75CE6" name="net-192.168.0.0" comment="192.168.0.0/16 - This block is set aside for use in private networks.&#10;Its intended use is documented in [RFC1918].  Addresses within this&#10;block should not appear on the public Internet.&#10;" ro="False" address="192.168.0.0" netmask="255.255.0.0"/>
+        <Network id="id3F4ECE3F" name="test-net" comment="192.0.2.0/24 - This block is assigned as &quot;TEST-NET&quot; for use in&#10;documentation and example code.  It is often used in conjunction with&#10;domain names example.com or example.net in vendor and protocol&#10;documentation.  Addresses within this block should not appear on the&#10;public Internet.&#10;" ro="False" address="192.0.2.0" netmask="255.255.255.0"/>
+        <Network id="id3F4ECE40" name="this-net" comment="0.0.0.0/8 - Addresses in this block refer to source hosts on &quot;this&quot;&#10;network.  Address 0.0.0.0/32 may be used as a source address for this&#10;host on this network; other addresses within 0.0.0.0/8 may be used to&#10;refer to specified hosts on this network [RFC1700, page 4]." ro="False" address="0.0.0.0" netmask="255.0.0.0"/>
+        <Network id="id3DC75CE7-1" name="net-192.168.1.0" comment="192.168.1.0/24 - Address often used for home and small office networks.&#10;" ro="False" address="192.168.1.0" netmask="255.255.255.0"/>
+        <Network id="id3DC75CE7-2" name="net-192.168.2.0" comment="192.168.2.0/24 - Address often used for home and small office networks.&#10;" ro="False" address="192.168.2.0" netmask="255.255.255.0"/>
+        <NetworkIPv6 id="id2088X75851" name="documentation net" comment="RFC3849" ro="False" address="2001:db8::" netmask="32"/>
+        <NetworkIPv6 id="id2383X75851" name="link-local ipv6" comment="RFC4291   Link-local unicast net" ro="False" address="fe80::" netmask="10"/>
+        <NetworkIPv6 id="id2685X75851" name="multicast ipv6" comment="RFC4291  ipv6 multicast addresses" ro="False" address="ff00::" netmask="8"/>
+        <NetworkIPv6 id="id2986X75851" name="experimental ipv6" comment="RFC2928, RFC4773 &#10;&#10;&quot;The block of Sub-TLA IDs assigned to the IANA&#10;(i.e., 2001:0000::/29 - 2001:01F8::/29) is for&#10;assignment for testing and experimental usage to&#10;support activities such as the 6bone, and&#10;for new approaches like exchanges.&quot;  [RFC2928]&#10;&#10;" ro="False" address="2001::" netmask="23"/>
+      </ObjectGroup>
+      <ObjectGroup id="stdid15" name="Address Ranges" comment="" ro="False">
+        <AddressRange id="id3F6D115C" name="broadcast" comment="" ro="False" start_address="255.255.255.255" end_address="255.255.255.255"/>
+        <AddressRange id="id3F6D115D" name="old-broadcast" comment="" ro="False" start_address="0.0.0.0" end_address="0.0.0.0"/>
+      </ObjectGroup>
+    </ObjectGroup>
+    <ServiceGroup id="stdid05" name="Services" comment="" ro="False">
+      <CustomService id="stdid14_1" name="ESTABLISHED" comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually stateful firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." ro="False" protocol="any" address_family="ipv4">
+        <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+        <CustomServiceCommand platform="iosacl">established</CustomServiceCommand>
+        <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+        <CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
+        <CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
+        <CustomServiceCommand platform="procurve_acl">established</CustomServiceCommand>
+      </CustomService>
+      <CustomService id="stdid14_2" name="ESTABLISHED ipv6" comment="This service matches all packets which are part of network connections established through the firewall, or connections 'related' to those established through the firewall. Term 'established' refers to the state tracking mechanism which exists inside iptables and other stateful firewalls and does not mean any particular combination of packet header options. Packet is considered to correspond to the state 'ESTABLISHED' if it belongs to the network session, for which proper initiation has been seen by the firewall, so its stateful inspection module made appropriate record in the state table. Usually stateful firewalls keep track of network connections using not only tcp protocol, but also udp and sometimes even icmp protocols. 'RELATED' describes packet belonging to a separate network connection, related to the session firewall is keeping track of. One example is FTP command and FTP data sessions." ro="False" protocol="any" address_family="ipv6">
+        <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+        <CustomServiceCommand platform="iosacl">established</CustomServiceCommand>
+        <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+        <CustomServiceCommand platform="ipfw">established</CustomServiceCommand>
+        <CustomServiceCommand platform="iptables">-m state --state ESTABLISHED,RELATED</CustomServiceCommand>
+        <CustomServiceCommand platform="procurve_acl">established</CustomServiceCommand>
+      </CustomService>
+      <ServiceGroup id="stdid10" name="Groups" comment="" ro="False">
+        <ServiceGroup id="sg-DHCP" name="DHCP" comment="" ro="False">
+          <ServiceRef ref="udp-bootpc"/>
+          <ServiceRef ref="udp-bootps"/>
+        </ServiceGroup>
+        <ServiceGroup id="id3F530CC8" name="DNS" comment="" ro="False">
+          <ServiceRef ref="udp-DNS"/>
+          <ServiceRef ref="tcp-DNS"/>
+        </ServiceGroup>
+        <ServiceGroup id="id3CB1279B" name="IPSEC" comment="" ro="False">
+          <ServiceRef ref="id3CB12797"/>
+          <ServiceRef ref="ip-IPSEC"/>
+        </ServiceGroup>
+        <ServiceGroup id="sg-NETBIOS" name="NETBIOS" comment="" ro="False">
+          <ServiceRef ref="udp-netbios-dgm"/>
+          <ServiceRef ref="udp-netbios-ns"/>
+          <ServiceRef ref="id3E755609"/>
+        </ServiceGroup>
+        <ServiceGroup id="id3CB131CC" name="PCAnywhere" comment="" ro="False">
+          <ServiceRef ref="id3CB131CA"/>
+          <ServiceRef ref="id3CB131C8"/>
+        </ServiceGroup>
+        <ServiceGroup id="sg-Useful_ICMP" name="Useful_ICMP" comment="" ro="False">
+          <ServiceRef ref="icmp-Time_exceeded"/>
+          <ServiceRef ref="icmp-Time_exceeded_in_transit"/>
+          <ServiceRef ref="icmp-ping_reply"/>
+          <ServiceRef ref="icmp-Unreachables"/>
+        </ServiceGroup>
+        <ServiceGroup id="id1569X4889" name="Ipv6 unreachable messages" comment="" ro="False">
+          <ServiceRef ref="idE0D27650"/>
+          <ServiceRef ref="idCFE27650"/>
+          <ServiceRef ref="idE0B27650"/>
+          <ServiceRef ref="id1519Z388"/>
+        </ServiceGroup>
+        <ServiceGroup id="id3B4FEDD9" name="kerberos" comment="" ro="False">
+          <ServiceRef ref="id3B4FEDA5"/>
+          <ServiceRef ref="id3B4FEDA9"/>
+          <ServiceRef ref="id3B4FEDA7"/>
+          <ServiceRef ref="id3B4FEDAB"/>
+          <ServiceRef ref="id3B4FEDA3"/>
+          <ServiceRef ref="id3B4FEE21"/>
+          <ServiceRef ref="id3B4FEE23"/>
+          <ServiceRef ref="id3E7E3EA2"/>
+        </ServiceGroup>
+        <ServiceGroup id="id3B4FF35E" name="nfs" comment="" ro="False">
+          <ServiceRef ref="id3B4FEE7A"/>
+          <ServiceRef ref="id3B4FEE78"/>
+        </ServiceGroup>
+        <ServiceGroup id="id3B4FEFFA" name="quake" comment="" ro="False">
+          <ServiceRef ref="id3B4FEF7C"/>
+          <ServiceRef ref="id3B4FEF7E"/>
+        </ServiceGroup>
+        <ServiceGroup id="id3D703C9A" name="Real Player" comment="" ro="False">
+          <ServiceRef ref="id3D703C99"/>
+          <ServiceRef ref="id3D703C8B"/>
+        </ServiceGroup>
+        <ServiceGroup id="id3E7E3E95" name="WinNT" comment="" ro="False">
+          <ServiceRef ref="sg-NETBIOS"/>
+          <ServiceRef ref="id3DC8C8BB"/>
+          <ServiceRef ref="id3E7E3D58"/>
+        </ServiceGroup>
+        <ServiceGroup id="id3E7E3E9A" name="Win2000" comment="" ro="False">
+          <ServiceRef ref="id3E7E3E95"/>
+          <ServiceRef ref="udp-DNS"/>
+          <ServiceRef ref="id3DC8C8BC"/>
+          <ServiceRef ref="id3E7E3EA2"/>
+          <ServiceRef ref="id3AECF778"/>
+          <ServiceRef ref="id3D703C90"/>
+          <ServiceRef ref="id3E7E4039"/>
+          <ServiceRef ref="id3E7E403A"/>
+          <ServiceRef ref="id3B4FEDA5"/>
+          <ServiceRef ref="tcp-DNS"/>
+        </ServiceGroup>
+        <ServiceGroup id="id41291786" name="UPnP" comment="" ro="False">
+          <ServiceRef ref="id41291784"/>
+          <ServiceRef ref="id41291785"/>
+          <ServiceRef ref="id41291783"/>
+          <ServiceRef ref="id412Z18A9"/>
+        </ServiceGroup>
+      </ServiceGroup>
+      <ServiceGroup id="stdid07" name="ICMP" comment="" ro="False">
+        <ICMPService id="icmp-Unreachables" code="-1" type="3" name="all ICMP unreachables" comment="" ro="False"/>
+        <ICMPService id="id3C20EEB5" code="-1" type="-1" name="any ICMP" comment="" ro="False"/>
+        <ICMPService id="icmp-Host_unreach" code="1" type="3" name="host_unreach" comment="" ro="False"/>
+        <ICMPService id="icmp-ping_reply" code="0" type="0" name="ping reply" comment="" ro="False"/>
+        <ICMPService id="icmp-ping_request" code="0" type="8" name="ping request" comment="" ro="False"/>
+        <ICMPService id="icmp-Port_unreach" code="3" type="3" name="port unreach" comment="Port unreachable" ro="False"/>
+        <ICMPService id="icmp-Time_exceeded" code="0" type="11" name="time exceeded" comment="ICMP messages of this type are needed for traceroute" ro="False"/>
+        <ICMPService id="icmp-Time_exceeded_in_transit" code="1" type="11" name="time exceeded in transit" comment="" ro="False"/>
+        <ICMP6Service id="ipv6-icmp-ping_request" code="0" type="128" name="ipv6 ping request" comment="IPv6 ping request" ro="False"/>
+        <ICMP6Service id="ipv6-icmp-ping_reply" code="0" type="129" name="ipv6 ping reply" comment="IPv6 ping reply" ro="False"/>
+        <ICMP6Service id="ipv6-icmp-routersol" code="0" type="133" name="ipv6 routersol" comment="IPv6 router solicitation" ro="False"/>
+        <ICMP6Service id="ipv6-icmp-routeradv" code="0" type="134" name="ipv6 routeradv" comment="IPv6 router advertisement" ro="False"/>
+        <ICMP6Service id="ipv6-icmp-neighbrsol" code="0" type="135" name="ipv6 neighbrsol" comment="IPv6 neighbor solicitation" ro="False"/>
+        <ICMP6Service id="ipv6-icmp-neighbradv" code="0" type="136" name="ipv6 neighbradv" comment="IPv6 neighbor advertisement" ro="False"/>
+        <ICMP6Service id="ipv6-icmp-redir" code="0" type="137" name="ipv6 redir" comment="IPv6 redirect: shorter route exists" ro="False"/>
+        <ICMP6Service id="id1519Z388" code="-1" type="4" name="ipv6 parameter problem" comment="IPv6 Parameter Problem: RFC4443" ro="False"/>
+        <ICMP6Service id="idCFE27650" code="0" type="3" name="ipv6 time exceeded" comment="Time exceeded in transit" ro="False"/>
+        <ICMP6Service id="idCFF27650" code="1" type="3" name="ipv6 time exceeded in reassembly" comment="Time exceeded in reassembly" ro="False"/>
+        <ICMP6Service id="idE0B27650" code="-1" type="2" name="ipv6 packet too big" comment="" ro="False"/>
+        <ICMP6Service id="idE0D27650" code="-1" type="1" name="ipv6 all dest unreachable" comment="All icmpv6 codes for type &quot;destination unreachable&quot;&#10;" ro="False"/>
+        <ICMP6Service id="idCFE27660" code="-1" type="-1" name="ipv6 any ICMP6" comment="any ICMPv6" ro="False"/>
+      </ServiceGroup>
+      <ServiceGroup id="stdid06" name="IP" comment="" ro="False">
+        <IPService id="id3CB12797" fragm="False" lsrr="False" protocol_num="51" rr="False" short_fragm="False" ssrr="False" ts="False" name="AH" comment="IPSEC Authentication Header Protocol" ro="False"/>
+        <IPService id="ip-IPSEC" fragm="False" lsrr="False" protocol_num="50" rr="False" short_fragm="False" ssrr="False" ts="False" name="ESP" comment="IPSEC Encapsulating Security Payload Protocol" ro="False"/>
+        <IPService id="ip-RR" fragm="False" lsrr="False" protocol_num="0" rr="True" short_fragm="False" ssrr="False" ts="False" name="RR" comment="Route recording packets" ro="False"/>
+        <IPService id="ip-SRR" fragm="False" lsrr="True" protocol_num="0" rr="False" short_fragm="False" ssrr="True" ts="False" name="SRR" comment="All sorts of Source Routing Packets" ro="False"/>
+        <IPService id="ip-IP_Fragments" fragm="False" lsrr="False" protocol_num="0" rr="False" short_fragm="True" ssrr="False" ts="False" name="ip_fragments" comment="'Short' fragments" ro="False"/>
+        <IPService id="id3D703C8E" fragm="False" lsrr="False" protocol_num="57" rr="False" short_fragm="False" ssrr="False" ts="False" name="SKIP" comment="IPSEC Simple Key Management for Internet Protocols" ro="False"/>
+        <IPService id="id3D703C8F" fragm="False" lsrr="False" protocol_num="47" rr="False" short_fragm="False" ssrr="False" ts="False" name="GRE" comment="Generic Routing Encapsulation&#10;" ro="False"/>
+        <IPService id="id3D703C95" fragm="False" lsrr="False" protocol_num="112" rr="False" short_fragm="False" ssrr="False" ts="False" name="vrrp" comment="Virtual Router Redundancy Protocol" ro="False"/>
+        <IPService id="ip-IGMP" fragm="False" lsrr="False" protocol_num="2" rr="False" rtralt="True" rtralt_value="0" short_fragm="False" ssrr="False" ts="False" name="IGMP" comment="Internet Group Management Protocol, Version 3, RFC 3376" ro="False"/>
+        <IPService id="ip-PIM" fragm="False" lsrr="False" protocol_num="103" rr="False" rtralt="False" rtralt_value="0" short_fragm="False" ssrr="False" ts="False" name="PIM" comment="Protocol Independent Multicast - Dense Mode (PIM-DM), RFC 3973, or Protocol Independent Multicast-Sparse Mode (PIM-SM) RFC 2362" ro="False"/>
+      </ServiceGroup>
+      <ServiceGroup id="stdid09" name="TCP" comment="" ro="False">
+        <TCPService id="tcp-ALL_TCP_Masqueraded" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ALL TCP Masqueraded" comment="ipchains used to use this range of port numbers for masquerading. " ro="False" src_range_start="61000" src_range_end="65095" dst_range_start="0" dst_range_end="0"/>
+        <TCPService id="id3D703C94" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="AOL" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5190" dst_range_end="5190"/>
+        <TCPService id="tcp-All_TCP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="All TCP" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
+        <TCPService id="id3CB131C4" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="Citrix-ICA" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1494" dst_range_end="1494"/>
+        <TCPService id="id3D703C91" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="Entrust-Admin" comment="Entrust CA Administration Service" ro="False" src_range_start="0" src_range_end="0" dst_range_start="709" dst_range_end="709"/>
+        <TCPService id="id3D703C92" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="Entrust-KeyMgmt" comment="Entrust CA Key Management Service" ro="False" src_range_start="0" src_range_end="0" dst_range_start="710" dst_range_end="710"/>
+        <TCPService id="id3AEDBEAC" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="H323" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1720" dst_range_end="1720"/>
+        <TCPService id="id412Z18A9" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="icslap" comment="Sometimes this protocol is called icslap, but Microsoft does not call it that and just says that DSPP uses port 2869 in Windows XP SP2" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2869" dst_range_end="2869"/>
+        <TCPService id="id3E7E4039" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="LDAP GC" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3268" dst_range_end="3268"/>
+        <TCPService id="id3E7E403A" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="LDAP GC SSL" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3269" dst_range_end="3269"/>
+        <TCPService id="id3D703C83" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="OpenWindows" comment="Open Windows" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2000" dst_range_end="2000"/>
+        <TCPService id="id3CB131C8" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="PCAnywhere-data" comment="data channel for PCAnywhere v7.52 and later " ro="False" src_range_start="0" src_range_end="0" dst_range_start="5631" dst_range_end="5631"/>
+        <TCPService id="id3D703C8B" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="Real-Audio" comment="RealNetworks PNA Protocol" ro="False" src_range_start="0" src_range_end="0" dst_range_start="7070" dst_range_end="7070"/>
+        <TCPService id="id3D703C93" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="RealSecure" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2998" dst_range_end="2998"/>
+        <TCPService id="id3DC8C8BC" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="SMB" comment="SMB over TCP (without NETBIOS)&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="445" dst_range_end="445"/>
+        <TCPService id="id3D703C8D" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="TACACSplus" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="49" dst_range_end="49"/>
+        <TCPService id="id3D703C84" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="TCP high ports" comment="TCP high ports" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1024" dst_range_end="65535"/>
+        <TCPService id="id3E7E3D58" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="WINS replication" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="42" dst_range_end="42"/>
+        <TCPService id="id3D703C82" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="X11" comment="X Window System" ro="False" src_range_start="0" src_range_end="0" dst_range_start="6000" dst_range_end="6063"/>
+        <TCPService id="tcp-Auth" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="auth" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="113" dst_range_end="113"/>
+        <TCPService id="id3AEDBE6E" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="daytime" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="13" dst_range_end="13"/>
+        <TCPService id="tcp-DNS" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="domain" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="53" dst_range_end="53"/>
+        <TCPService id="id3B4FEDA3" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="eklogin" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2105" dst_range_end="2105"/>
+        <TCPService id="id3AECF774" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="finger" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="79" dst_range_end="79"/>
+        <TCPService id="tcp-FTP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ftp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="21" dst_range_end="21"/>
+        <TCPService id="tcp-FTP_data" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ftp data" comment="FTP data channel.&#10;  Note: FTP protocol does not really require server to use source port 20 for the data channel, &#10;  but many ftp server implementations do so." ro="False" src_range_start="20" src_range_end="20" dst_range_start="1024" dst_range_end="65535"/>
+        <TCPService id="id3E7553BC" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ftp data passive" comment="FTP data channel for passive mode transfers&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="20" dst_range_end="20"/>
+        <TCPService id="tcp-HTTP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="http" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="80" dst_range_end="80"/>
+        <TCPService id="id3B4FED69" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="https" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="443" dst_range_end="443"/>
+        <TCPService id="id3AECF776" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="imap" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="143" dst_range_end="143"/>
+        <TCPService id="id3B4FED9F" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="imaps" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="993" dst_range_end="993"/>
+        <TCPService id="id3B4FF13C" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="irc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="6667" dst_range_end="6667"/>
+        <TCPService id="id3E7E3EA2" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="kerberos" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="88" dst_range_end="88"/>
+        <TCPService id="id3B4FEE21" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="klogin" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="543" dst_range_end="543"/>
+        <TCPService id="id3B4FEE23" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ksh" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="544" dst_range_end="544"/>
+        <TCPService id="id3AECF778" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ldap" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="389" dst_range_end="389"/>
+        <TCPService id="id3D703C90" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ldaps" comment="Lightweight Directory Access Protocol over TLS/SSL" ro="False" src_range_start="0" src_range_end="0" dst_range_start="636" dst_range_end="636"/>
+        <TCPService id="id3B4FF000" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="linuxconf" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="98" dst_range_end="98"/>
+        <TCPService id="id3D703C97" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="lpr" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="515" dst_range_end="515"/>
+        <TCPService id="id3DC8C8BB" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="microsoft-rpc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="135" dst_range_end="135"/>
+        <TCPService id="id3D703C98" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ms-sql" comment="Microsoft SQL Server" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1433" dst_range_end="1433"/>
+        <TCPService id="id3B4FEEEE" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="mysql" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3306" dst_range_end="3306"/>
+        <TCPService id="id3E755609" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="netbios-ssn" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="139" dst_range_end="139"/>
+        <TCPService id="id3B4FEE7A" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="nfs" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2049" dst_range_end="2049"/>
+        <TCPService id="tcp-NNTP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="nntp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="119" dst_range_end="119"/>
+        <TCPService id="id3E7553BB" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="nntps" comment="NNTP over SSL" ro="False" src_range_start="0" src_range_end="0" dst_range_start="563" dst_range_end="563"/>
+        <TCPService id="id3B4FEE1D" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="pop3" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="110" dst_range_end="110"/>
+        <TCPService id="id3E7553BA" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="pop3s" comment="POP-3 over SSL" ro="False" src_range_start="0" src_range_end="0" dst_range_start="995" dst_range_end="995"/>
+        <TCPService id="id3B4FF0EA" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="postgres" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5432" dst_range_end="5432"/>
+        <TCPService id="id3AECF782" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="printer" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="515" dst_range_end="515"/>
+        <TCPService id="id3B4FEF7C" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="quake" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="26000" dst_range_end="26000"/>
+        <TCPService id="id3AECF77A" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rexec" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="512" dst_range_end="512"/>
+        <TCPService id="id3AECF77C" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rlogin" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="513" dst_range_end="513"/>
+        <TCPService id="id3AECF77E" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rshell" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="514" dst_range_end="514"/>
+        <TCPService id="id3D703C99" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rtsp" comment="Real Time Streaming Protocol" ro="False" src_range_start="0" src_range_end="0" dst_range_start="554" dst_range_end="554"/>
+        <TCPService id="id3B4FEF34" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rwhois" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="4321" dst_range_end="4321"/>
+        <TCPService id="id3D703C89" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="securidprop" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5510" dst_range_end="5510"/>
+        <TCPService id="tcp-SMTP" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="smtp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="25" dst_range_end="25"/>
+        <TCPService id="id3B4FF04C" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="smtps" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="465" dst_range_end="465"/>
+        <TCPService id="id3B4FEE76" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="socks" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1080" dst_range_end="1080"/>
+        <TCPService id="id3D703C87" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="sqlnet1" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1521" dst_range_end="1521"/>
+        <TCPService id="id3B4FF09A" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="squid" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3128" dst_range_end="3128"/>
+        <TCPService id="tcp-SSH" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="ssh" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="22" dst_range_end="22"/>
+        <TCPService id="id3AEDBE00" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="sunrpc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="111" dst_range_end="111"/>
+        <TCPService id="tcp-TCP-SYN" ack_flag="False" ack_flag_mask="True" fin_flag="False" fin_flag_mask="True" psh_flag="False" psh_flag_mask="True" rst_flag="False" rst_flag_mask="True" syn_flag="True" syn_flag_mask="True" urg_flag="False" urg_flag_mask="True" name="tcp-syn" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
+        <TCPService id="tcp-Telnet" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="telnet" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="23" dst_range_end="23"/>
+        <TCPService id="tcp-uucp" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="uucp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="540" dst_range_end="540"/>
+        <TCPService id="id3CB131C6" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="winterm" comment="Windows Terminal Services" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3389" dst_range_end="3389"/>
+        <TCPService id="id3B4FF1B8" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="xfs" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="7100" dst_range_end="7100"/>
+        <TCPService id="id3C685B2B" ack_flag="True" ack_flag_mask="True" fin_flag="True" fin_flag_mask="True" psh_flag="True" psh_flag_mask="True" rst_flag="True" rst_flag_mask="True" syn_flag="True" syn_flag_mask="True" urg_flag="True" urg_flag_mask="True" name="xmas scan - full" comment="This service object matches TCP packet with all six flags set." ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
+        <TCPService id="id4127E949" ack_flag="False" ack_flag_mask="True" fin_flag="True" fin_flag_mask="True" psh_flag="True" psh_flag_mask="True" rst_flag="False" rst_flag_mask="True" syn_flag="False" syn_flag_mask="True" urg_flag="True" urg_flag_mask="True" name="xmas scan" comment="This service object matches TCP packet with flags FIN, PSH and URG set and other flags cleared. This is a  &quot;christmas scan&quot; as defined in snort rules. Nmap can generate this scan, too." ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
+        <TCPService id="id4127EA72" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rsync" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="873" dst_range_end="873"/>
+        <TCPService id="id4127EBAC" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="distcc" comment="distributed compiler" ro="False" src_range_start="0" src_range_end="0" dst_range_start="3632" dst_range_end="3632"/>
+        <TCPService id="id4127ECF1" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="cvspserver" comment="CVS client/server operations" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2401" dst_range_end="2401"/>
+        <TCPService id="id4127ECF2" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="cvsup" comment="CVSup file transfer/John Polstra/FreeBSD" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5999" dst_range_end="5999"/>
+        <TCPService id="id4127ED5E" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="afp" comment="AFP (Apple file sharing) over TCP" ro="False" src_range_start="0" src_range_end="0" dst_range_start="548" dst_range_end="548"/>
+        <TCPService id="id4127EDF6" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="whois" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="43" dst_range_end="43"/>
+        <TCPService id="id4127F04F" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="bgp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="179" dst_range_end="179"/>
+        <TCPService id="id4127F146" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="radius" comment="Radius protocol" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1812" dst_range_end="1812"/>
+        <TCPService id="id4127F147" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="radius acct" comment="Radius Accounting" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1813" dst_range_end="1813"/>
+        <TCPService id="id41291784" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="upnp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5000" dst_range_end="5000"/>
+        <TCPService id="id41291785" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="upnp-5431" comment="Although UPnP specification say it should use TCP port 5000, Linksys running Sveasoft firmware listens on port 5431" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5431" dst_range_end="5431"/>
+        <TCPService id="id41291787" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="vnc-java-0" comment="Java VNC viewer, display 0" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5800" dst_range_end="5800"/>
+        <TCPService id="id41291788" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="vnc-0" comment="Regular VNC viewer, display 0" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5900" dst_range_end="5900"/>
+        <TCPService id="id41291887" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="vnc-java-1" comment="Java VNC viewer, display 1" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5801" dst_range_end="5801"/>
+        <TCPService id="id41291888" ack_flag="False" ack_flag_mask="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="vnc-1" comment="Regular VNC viewer, display 1" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5901" dst_range_end="5901"/>
+        <TCPService id="id463FE5FE11008" ack_flag="False" ack_flag_mask="False" established="True" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="All TCP established" comment="Some firewall platforms can match TCP packets with flags ACK or RST set; the option is usually called &quot;established&quot;.&#10;&#10;Note that you can use this object only in the policy rules of the firewall that supports this option.&#10;&#10;If you need to match reply packets for a specific TCP service and wish to use option &quot;established&quot;, make a copy of this object and set source port range to match the service.&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
+        <TCPService id="id1577X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="rtmp" comment="Real Time Messaging Protocol" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1935" dst_range_end="1935"/>
+        <TCPService id="id1590X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="xmpp-client" comment="Extensible Messaging and Presence Protocol (XMPP)   RFC3920&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5222" dst_range_end="5222"/>
+        <TCPService id="id1609X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="xmpp-server" comment="Extensible Messaging and Presence Protocol (XMPP)   RFC3920&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5269" dst_range_end="5269"/>
+        <TCPService id="id1622X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="xmpp-client-ssl" comment="Extensible Messaging and Presence Protocol (XMPP)   RFC3920&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5223" dst_range_end="5223"/>
+        <TCPService id="id1631X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="xmpp-server-ssl" comment="Extensible Messaging and Presence Protocol (XMPP)   RFC3920&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5270" dst_range_end="5270"/>
+        <TCPService id="id1644X28030" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="nrpe" comment="NRPE add-on for Nagios  http://www.nagios.org/&#10;" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5666" dst_range_end="5666"/>
+      </ServiceGroup>
+      <ServiceGroup id="stdid08" name="UDP" comment="" ro="False">
+        <UDPService id="udp-ALL_UDP_Masqueraded" name="ALL UDP Masqueraded" comment="ipchains used to use this port range for masqueraded packets" ro="False" src_range_start="61000" src_range_end="65095" dst_range_start="0" dst_range_end="0"/>
+        <UDPService id="udp-All_UDP" name="All UDP" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="0" dst_range_end="0"/>
+        <UDPService id="id3D703C96" name="ICQ" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="4000" dst_range_end="4000"/>
+        <UDPService id="id3CB129D2" name="IKE" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="500" dst_range_end="500"/>
+        <UDPService id="id3CB131CA" name="PCAnywhere-status" comment="status channel for PCAnywhere v7.52 and later" ro="False" src_range_start="0" src_range_end="0" dst_range_start="5632" dst_range_end="5632"/>
+        <UDPService id="id3AED0D6B" name="RIP" comment="routing protocol RIP" ro="False" src_range_start="0" src_range_end="0" dst_range_start="520" dst_range_end="520"/>
+        <UDPService id="id3D703C8C" name="Radius" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1645" dst_range_end="1645"/>
+        <UDPService id="id3D703C85" name="UDP high ports" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1024" dst_range_end="65535"/>
+        <UDPService id="id3D703C86" name="Who" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="513" dst_range_end="513"/>
+        <UDPService id="id3B4FEDA1" name="afs" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="7000" dst_range_end="7009"/>
+        <UDPService id="udp-bootpc" name="bootpc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="68" dst_range_end="68"/>
+        <UDPService id="udp-bootps" name="bootps" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="67" dst_range_end="67"/>
+        <UDPService id="id3AEDBE70" name="daytime" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="13" dst_range_end="13"/>
+        <UDPService id="udp-DNS" name="domain" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="53" dst_range_end="53"/>
+        <UDPService id="id3D703C8A" name="interphone" comment="VocalTec Internet Phone" ro="False" src_range_start="0" src_range_end="0" dst_range_start="22555" dst_range_end="22555"/>
+        <UDPService id="id3B4FEDA5" name="kerberos" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="88" dst_range_end="88"/>
+        <UDPService id="id3B4FEDA9" name="kerberos-adm" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="749" dst_range_end="750"/>
+        <UDPService id="id3B4FEDA7" name="kpasswd" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="464" dst_range_end="464"/>
+        <UDPService id="id3B4FEDAB" name="krb524" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="4444" dst_range_end="4444"/>
+        <UDPService id="id3F865B0D" name="microsoft-rpc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="135" dst_range_end="135"/>
+        <UDPService id="udp-netbios-dgm" name="netbios-dgm" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="138" dst_range_end="138"/>
+        <UDPService id="udp-netbios-ns" name="netbios-ns" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="137" dst_range_end="137"/>
+        <UDPService id="udp-netbios-ssn" name="netbios-ssn" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="139" dst_range_end="139"/>
+        <UDPService id="id3B4FEE78" name="nfs" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="2049" dst_range_end="2049"/>
+        <UDPService id="udp-ntp" name="ntp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="123" dst_range_end="123"/>
+        <UDPService id="id3B4FEF7E" name="quake" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="26000" dst_range_end="26000"/>
+        <UDPService id="id3D703C88" name="secureid-udp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1024" dst_range_end="1024"/>
+        <UDPService id="udp-SNMP" name="snmp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="161" dst_range_end="161"/>
+        <UDPService id="id3AED0D69" name="snmp-trap" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="162" dst_range_end="162"/>
+        <UDPService id="id3AEDBE19" name="sunrpc" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="111" dst_range_end="111"/>
+        <UDPService id="id3AECF780" name="syslog" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="514" dst_range_end="514"/>
+        <UDPService id="id3AED0D67" name="tftp" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="69" dst_range_end="69"/>
+        <UDPService id="id3AED0D8C" name="traceroute" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="33434" dst_range_end="33524"/>
+        <UDPService id="id4127EA73" name="rsync" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="873" dst_range_end="873"/>
+        <UDPService id="id41291783" name="SSDP" comment="Simple Service Discovery Protocol (used for UPnP)" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1900" dst_range_end="1900"/>
+        <UDPService id="id41291883" name="OpenVPN" comment="" ro="False" src_range_start="0" src_range_end="0" dst_range_start="1194" dst_range_end="1194"/>
+      </ServiceGroup>
+      <ServiceGroup id="stdid13" name="Custom" comment="" ro="False">
+        <CustomService id="id3B64EEA8" name="rpc" comment="works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
+          <CustomServiceCommand platform="iptables">-m record_rpc</CustomServiceCommand>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
+        </CustomService>
+        <CustomService id="id3B64EF4E" name="irc-conn" comment="IRC connection tracker, supports DCC.&#10;Works on iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/&#10;" ro="False" protocol="any" address_family="ipv4">
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
+          <CustomServiceCommand platform="iptables">-m irc</CustomServiceCommand>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
+        </CustomService>
+        <CustomService id="id3B64EF50" name="psd" comment="Port scan detector, works only on iptables and  requires patch-o-matic &#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
+          <CustomServiceCommand platform="iptables">-m psd --psd-weight-threshold 5 --psd-delay-threshold 10000</CustomServiceCommand>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
+        </CustomService>
+        <CustomService id="id3B64EF52" name="string" comment="Matches a string in a whole packet, works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
+          <CustomServiceCommand platform="iptables">-m string --string test_pattern</CustomServiceCommand>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
+        </CustomService>
+        <CustomService id="id3B64EF54" name="talk" comment="Talk protocol support. Works in iptables and requires patch-o-matic.&#10;For more information look for patch-o-matic on http://www.netfilter.org/" ro="False" protocol="any" address_family="ipv4">
+          <CustomServiceCommand platform="Undefined"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipf"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfilter"></CustomServiceCommand>
+          <CustomServiceCommand platform="ipfw"></CustomServiceCommand>
+          <CustomServiceCommand platform="iptables">-m talk</CustomServiceCommand>
+          <CustomServiceCommand platform="pf"></CustomServiceCommand>
+          <CustomServiceCommand platform="pix"></CustomServiceCommand>
+          <CustomServiceCommand platform="unknown"></CustomServiceCommand>
+        </CustomService>
+      </ServiceGroup>
+      <ServiceGroup id="stdid19" name="TagServices" comment="" ro="False"/>
+      <ServiceGroup id="stdid20" name="UserServices" comment="" ro="False"/>
+    </ServiceGroup>
+    <ObjectGroup id="stdid12" name="Firewalls" comment="" ro="False"/>
+    <ObjectGroup id="stdid21" name="Clusters" comment="" ro="False"/>
+    <IntervalGroup id="stdid11" name="Time" comment="" ro="False">
+      <Interval id="int-workhours" days_of_week="1,2,3,4,5" from_day="-1" from_hour="9" from_minute="0" from_month="-1" from_weekday="1" from_year="-1" to_day="-1" to_hour="17" to_minute="0" to_month="-1" to_weekday="5" to_year="-1" name="workhours" comment="any day, 9:00am through 5:00pm" ro="False"/>
+      <Interval id="int-weekends" days_of_week="6,0" from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="6" from_year="-1" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="0" to_year="-1" name="weekends" comment="weekends: Saturday 0:00 through Sunday 23:59 " ro="False"/>
+      <Interval id="int-afterhours" days_of_week="0,1,2,3,4,5,6" from_day="-1" from_hour="18" from_minute="0" from_month="-1" from_weekday="-1" from_year="-1" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="-1" to_year="-1" name="afterhours" comment="any day 6:00pm - 12:00am" ro="False"/>
+      <Interval id="id3C63479C" days_of_week="6" from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="6" from_year="-1" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="6" to_year="-1" name="Sat" comment="" ro="False"/>
+      <Interval id="id3C63479E" days_of_week="0" from_day="-1" from_hour="0" from_minute="0" from_month="-1" from_weekday="0" from_year="-1" to_day="-1" to_hour="23" to_minute="59" to_month="-1" to_weekday="0" to_year="-1" name="Sun" comment="" ro="False"/>
+    </IntervalGroup>
+  </Library>
+  <Library id="sysid99" name="Deleted Objects" comment="" ro="False"/>
+  <Library id="id0" name="User" comment="" ro="False">
+    <ObjectGroup id="id1" name="Objects" comment="" ro="False">
+      <ObjectGroup id="id2" name="Addresses" comment="" ro="False"/>
+      <ObjectGroup id="id3" name="DNS Names" comment="" ro="False"/>
+      <ObjectGroup id="id4" name="Address Tables" comment="" ro="False"/>
+      <ObjectGroup id="id5" name="Groups" comment="" ro="False"/>
+      <ObjectGroup id="id6" name="Hosts" comment="" ro="False"/>
+      <ObjectGroup id="id7" name="Networks" comment="" ro="False">
+        <Network id="id8" name="net-192.168.1.0/255.255.255.0" comment="Created during import of  line 2" ro="False" address="192.168.1.0" netmask="255.255.255.0"/>
+      </ObjectGroup>
+      <ObjectGroup id="id9" name="Address Ranges" comment="" ro="False"/>
+    </ObjectGroup>
+    <ServiceGroup id="id10" name="Services" comment="" ro="False">
+      <ServiceGroup id="id11" name="Groups" comment="" ro="False"/>
+      <ServiceGroup id="id12" name="ICMP" comment="" ro="False"/>
+      <ServiceGroup id="id13" name="IP" comment="" ro="False"/>
+      <ServiceGroup id="id14" name="TCP" comment="" ro="False">
+        <TCPService id="id15" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="tcp 80:80 / 0:0" comment="Created during import of  line 6" ro="False" src_range_start="80" src_range_end="80" dst_range_start="0" dst_range_end="0"/>
+      </ServiceGroup>
+      <ServiceGroup id="id16" name="UDP" comment="" ro="False"/>
+      <ServiceGroup id="id17" name="Users" comment="" ro="False"/>
+      <ServiceGroup id="id18" name="Custom" comment="" ro="False"/>
+      <ServiceGroup id="id19" name="TagServices" comment="" ro="False"/>
+    </ServiceGroup>
+    <ObjectGroup id="id20" name="Firewalls" comment="" ro="False">
+      <Firewall id="id21" host_OS="freebsd" lastCompiled="0" lastInstalled="0" lastModified="0" platform="pf" name="test_fw" comment="Created during import of  line 2" ro="False">
+        <NAT id="id61" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
+          <RuleSetOptions/>
+        </NAT>
+        <Policy id="id23" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id25" disabled="False" group="" log="True" position="0" action="Accept" direction="Inbound" comment="Created during import of  line 2">
+            <Src neg="False">
+              <ObjectRef ref="id8"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="pf_route_opt_addr">10.1.2.3</Option>
+              <Option name="pf_route_opt_if">em0</Option>
+              <Option name="pf_route_option">route_through</Option>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id37" disabled="False" group="" log="False" position="1" action="Accept" direction="Inbound" comment="Created during import of  line 4">
+            <Src neg="False">
+              <ObjectRef ref="id8"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="id67"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="pf_route_opt_addr">10.3.4.5</Option>
+              <Option name="pf_route_opt_if">bce0</Option>
+              <Option name="pf_route_option">route_reply_through</Option>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id49" disabled="False" group="" log="False" position="2" action="Accept" direction="Outbound" comment="Created during import of  line 6">
+            <Src neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="id15"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="id67"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="pf_route_opt_addr">10.1.2.3</Option>
+              <Option name="pf_route_opt_if">em0</Option>
+              <Option name="pf_route_option">route_copy_through</Option>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <RuleSetOptions/>
+        </Policy>
+        <Routing id="id63" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
+          <RuleSetOptions/>
+        </Routing>
+        <Interface id="id65" dedicated_failover="False" dyn="True" security_level="0" unnum="False" unprotected="False" name="em0" comment="Created during import of  line 2" ro="False">
+          <InterfaceOptions/>
+        </Interface>
+        <Interface id="id67" dedicated_failover="False" dyn="True" security_level="0" unnum="False" unprotected="False" name="bce0" comment="Created during import of  line 4" ro="False">
+          <InterfaceOptions/>
+        </Interface>
+        <FirewallOptions>
+          <Option name="check_shading">true</Option>
+          <Option name="configure_interfaces">true</Option>
+          <Option name="firewall_dir">/etc</Option>
+          <Option name="freebsd_ip_forward">1</Option>
+          <Option name="in_out_code">true</Option>
+          <Option name="log_prefix">RULE %N -- %A </Option>
+          <Option name="loopback_interface">lo0</Option>
+          <Option name="manage_virtual_addr">true</Option>
+          <Option name="pass_all_out">false</Option>
+          <Option name="pf_limit_frags">5000</Option>
+          <Option name="pf_limit_states">10000</Option>
+          <Option name="pf_scrub_maxmss">1460</Option>
+          <Option name="pf_timeout_frag">30</Option>
+          <Option name="pf_timeout_interval">10</Option>
+        </FirewallOptions>
+      </Firewall>
+    </ObjectGroup>
+    <ObjectGroup id="id69" name="Clusters" comment="" ro="False"/>
+    <IntervalGroup id="id70" name="Time" comment="" ro="False"/>
+  </Library>
+</FWObjectDatabase>
diff --git a/src/unit_tests/PFImporterTest/test_data/pf-route-to.output b/src/unit_tests/PFImporterTest/test_data/pf-route-to.output
new file mode 100644
index 000000000..e5fffa2dc
--- /dev/null
+++ b/src/unit_tests/PFImporterTest/test_data/pf-route-to.output
@@ -0,0 +1,5 @@
+2: New interface: em0
+2: filtering rule: action pass; interfaces: 
+4: New interface: bce0
+4: filtering rule: action pass; interfaces: bce0
+6: filtering rule: action pass; interfaces: bce0
diff --git a/src/unit_tests/PFImporterTest/test_data/pf-tables.output b/src/unit_tests/PFImporterTest/test_data/pf-tables.output
index b2b47c996..d935e7866 100644
--- a/src/unit_tests/PFImporterTest/test_data/pf-tables.output
+++ b/src/unit_tests/PFImporterTest/test_data/pf-tables.output
@@ -7,10 +7,10 @@
 6: Address Table: <spamd-white> file 
 7: Warning: attribute "const" will be dropped from table configuration since this attribute is not supported at this time
 7: Address Table: <private>:  10/8, 172.16/12, 192.168/16
-9: Address Table: <dst_addresses_1>:  192.168.1.1/, 192.168.1.2/, 192.168.2.0/24
+9: Address Table: <dst_addresses_1>:  192.168.1.1, 192.168.1.2, 192.168.2.0/24
+10: Address Table: <dst_addresses_2>:  pcn0, pcn0
 10: New interface: pcn0
-10: Address Table: <dst_addresses_2>:  pcn0/, pcn0/
-11: Address Table: <dst_addresses_3>:  pcn0/, pcn0/
-12: Address Table: <dst_addresses_4>:  www.fwbuilder.org/, www.netcitadel.com/
+11: Address Table: <dst_addresses_3>:  pcn0, pcn0
+12: Address Table: <dst_addresses_4>:  www.fwbuilder.org, www.netcitadel.com
 Could not find enough information in the data file to create any firewall rules.
 

From 6046524a37b4064c13af8c8297e8b468c4a4b0ba Mon Sep 17 00:00:00 2001
From: Vadim Kurland <vadim@netcitadel.com>
Date: Wed, 6 Jul 2011 16:13:59 -0700
Subject: [PATCH 02/18] see #2552 "PF import: add ability to suppress comments
 referring to line numbers in the original file".

---
 doc/ChangeLog                                 |   4 +
 src/import/Importer.cpp                       |  23 +-
 src/import/Importer.h                         |   4 +
 .../IC_PlatformWarningPage.cpp                |   5 +-
 .../IC_ProgressPage.cpp                       |   2 +
 .../ImporterThread.cpp                        |   8 +
 .../ImporterThread.h                          |   2 +
 .../ic_platformwarningpage_q.ui               | 184 ++--
 src/parsers/PFCfgLexer.cpp                    | 405 ++++----
 src/parsers/PFCfgLexer.hpp                    |   7 +-
 src/parsers/PFCfgParser.cpp                   | 935 ++++++++++--------
 src/parsers/PFCfgParser.hpp                   |   4 +-
 src/parsers/PFCfgParserTokenTypes.hpp         |  31 +-
 src/parsers/PFCfgParserTokenTypes.txt         |  31 +-
 src/parsers/pf.g                              |  18 +-
 15 files changed, 887 insertions(+), 776 deletions(-)

diff --git a/doc/ChangeLog b/doc/ChangeLog
index d27901529..5a6529170 100644
--- a/doc/ChangeLog
+++ b/doc/ChangeLog
@@ -1,5 +1,9 @@
 2011-07-06  Vadim Kurland  <vadim@netcitadel.com>
 
+	* Importer.cpp (addStandardImportComment): see #2552 "PF import:
+	add ability to suppress comments referring to line numbers in the
+	original file".
+
 	* PFImporter.cpp (pushPolicyRule): see #2551 "PF Import - source
 	routing rules are not imported with rule options set". Importer
 	should import "route-to" rule parameters.
diff --git a/src/import/Importer.cpp b/src/import/Importer.cpp
index c152a6a65..7ae6bfe12 100644
--- a/src/import/Importer.cpp
+++ b/src/import/Importer.cpp
@@ -167,6 +167,8 @@ Importer::~Importer()
 
 void Importer::clear()
 {
+    last_comment.clear();
+
     action = "";
 
     protocol = "";
@@ -898,6 +900,16 @@ void Importer::addMessageToLog(const QString &msg)
     }
 }
 
+/**
+ * This function adds "standard" comment to the object, plus text
+ * passed as @additional_comment argument. If the object already has
+ * some comment, it is preserved and new text is appended to it. If
+ * flag add_standard_comments is false, then comment referring to the
+ * line number in the original file is not added, but
+ * @additional_comment is added anyway. Note that we also add comments
+ * to rules in case of errors but those are not suppressed by the flag
+ * add_standard_comments
+ */
 void Importer::addStandardImportComment(FWObject *obj,
                                         const QString &additional_comment)
 {
@@ -916,10 +928,13 @@ void Importer::addStandardImportComment(FWObject *obj,
 
     if ( ! additional_comment.isEmpty()) comment << additional_comment;
 
-    QString file_and_line("Created during import of %1 line %2");
-    comment << file_and_line
-        .arg(QString::fromUtf8(input_file_name.c_str()))
-        .arg(getCurrentLineNumber());
+    if (add_standard_comments)
+    {
+        QString file_and_line("Created during import of %1 line %2");
+        comment << file_and_line
+            .arg(QString::fromUtf8(input_file_name.c_str()))
+            .arg(getCurrentLineNumber());
+    }
 
     obj->setComment(comment.join("\n").toUtf8().constData());
     obj->setBool(".import-commited", true);
diff --git a/src/import/Importer.h b/src/import/Importer.h
index b0acefba2..db3f772fd 100644
--- a/src/import/Importer.h
+++ b/src/import/Importer.h
@@ -211,6 +211,9 @@ public:
     // making logger public so I can access it from the code in the grammar
     libfwbuilder::Logger *logger;
     
+    QStringList last_comment;
+    bool add_standard_comments;
+    
     // temporary variables used by parser to store values
     // Importer converts these into a proper rule using method
     // pushRule()
@@ -298,6 +301,7 @@ public:
 
     void setUserChoiceHostOS(const std::string &s) { user_choice_host_os = s; }
     void setUserChoiceVersion(const std::string &s) { user_choice_version = s; }
+    void setAddStandardCommentsFlag(bool f) { add_standard_comments = f; }
     
     virtual void setHostName(const std::string &hn);
     virtual void newInterface(const std::string &interface_name);
diff --git a/src/libgui/importFirewallConfigurationWizard/IC_PlatformWarningPage.cpp b/src/libgui/importFirewallConfigurationWizard/IC_PlatformWarningPage.cpp
index 1bc2fc5f6..c286db8cc 100644
--- a/src/libgui/importFirewallConfigurationWizard/IC_PlatformWarningPage.cpp
+++ b/src/libgui/importFirewallConfigurationWizard/IC_PlatformWarningPage.cpp
@@ -52,8 +52,9 @@ IC_PlatformWarningPage::IC_PlatformWarningPage(QWidget *parent) : QWizardPage(pa
     // user-chosen host os and version, so far we only show these for PF
     registerField("hostOS*", m_dialog->hostOS);
     registerField("version*", m_dialog->version);
+    registerField("addStandardComments", m_dialog->addStandardComments);
 
-    m_dialog->hostOSAndVersionFrame->hide();
+    m_dialog->importOptionsFrame->hide();
 
     platformOk = false;
 }
@@ -242,7 +243,7 @@ void IC_PlatformWarningPage::initializePage()
                 wz->version_list.append(i1->first);
             }
 
-            m_dialog->hostOSAndVersionFrame->show();
+            m_dialog->importOptionsFrame->show();
             break;
         }
 
diff --git a/src/libgui/importFirewallConfigurationWizard/IC_ProgressPage.cpp b/src/libgui/importFirewallConfigurationWizard/IC_ProgressPage.cpp
index 0e64e718c..e151d1b67 100644
--- a/src/libgui/importFirewallConfigurationWizard/IC_ProgressPage.cpp
+++ b/src/libgui/importFirewallConfigurationWizard/IC_ProgressPage.cpp
@@ -158,9 +158,11 @@ void IC_ProgressPage::initializePage()
     {
         int host_os_idx = field("hostOS").toInt();
         int version_idx = field("version").toInt();
+        bool add_standard_comments = field("addStandardComments").toBool();
 
         importer->setUserChoiceHostOS( wz->host_os_list.at( host_os_idx ));
         importer->setUserChoiceVersion( wz->version_list.at( version_idx ));
+        importer->setAddStandardCommentsFlag(add_standard_comments);
     }
     
     connect(importer, SIGNAL(destroyed(QObject*)),
diff --git a/src/libgui/importFirewallConfigurationWizard/ImporterThread.cpp b/src/libgui/importFirewallConfigurationWizard/ImporterThread.cpp
index a504b6838..0cb2bb0bc 100644
--- a/src/libgui/importFirewallConfigurationWizard/ImporterThread.cpp
+++ b/src/libgui/importFirewallConfigurationWizard/ImporterThread.cpp
@@ -66,6 +66,7 @@ ImporterThread::ImporterThread(QWidget *ui,
     this->deduplicate = deduplicate;
     importer = NULL;
     stopFlag = false;
+    addStandardComments = false;
 }
 
 ImporterThread::~ImporterThread()
@@ -83,6 +84,11 @@ void ImporterThread::setUserChoiceVersion(const QString &s)
     userChoiceVersion = s;
 }
 
+void ImporterThread::setAddStandardCommentsFlag(bool f)
+{
+    addStandardComments = f;
+}
+
 void ImporterThread::run()
 {
     QThreadLogger *logger = new QThreadLogger();
@@ -114,6 +120,8 @@ void ImporterThread::run()
         if ( ! userChoiceVersion.isEmpty())
             importer->setUserChoiceVersion(userChoiceVersion.toStdString());
 
+        importer->setAddStandardCommentsFlag(addStandardComments);
+
         importer->setFileName(fileName.toUtf8().constData());
         if (deduplicate) importer->prepareForDeduplication();
 
diff --git a/src/libgui/importFirewallConfigurationWizard/ImporterThread.h b/src/libgui/importFirewallConfigurationWizard/ImporterThread.h
index 73a4e8450..e9b212bd9 100644
--- a/src/libgui/importFirewallConfigurationWizard/ImporterThread.h
+++ b/src/libgui/importFirewallConfigurationWizard/ImporterThread.h
@@ -56,6 +56,7 @@ class ImporterThread : public QThread
     bool stopFlag;
     QString userChoiceHostOS;
     QString userChoiceVersion;
+    bool addStandardComments;
     
 public:
     ImporterThread(QWidget *ui,
@@ -74,6 +75,7 @@ public:
 
     void setUserChoiceHostOS(const QString &s);
     void setUserChoiceVersion(const QString &s);
+    void setAddStandardCommentsFlag(bool f);
     
 signals:
     void finished();
diff --git a/src/libgui/importFirewallConfigurationWizard/ic_platformwarningpage_q.ui b/src/libgui/importFirewallConfigurationWizard/ic_platformwarningpage_q.ui
index be954939c..0cb847d53 100644
--- a/src/libgui/importFirewallConfigurationWizard/ic_platformwarningpage_q.ui
+++ b/src/libgui/importFirewallConfigurationWizard/ic_platformwarningpage_q.ui
@@ -13,97 +13,103 @@
   <property name="windowTitle">
    <string>WizardPage</string>
   </property>
-  <layout class="QGridLayout" name="gridLayout_3">
-   <item row="0" column="0">
-    <layout class="QGridLayout" name="gridLayout_2">
-     <item row="0" column="0" colspan="4">
-      <widget class="QLabel" name="platformSpecificWarning">
-       <property name="text">
-        <string>TextLabel</string>
-       </property>
-       <property name="wordWrap">
-        <bool>true</bool>
-       </property>
-      </widget>
-     </item>
-     <item row="1" column="0">
-      <widget class="QLabel" name="label">
-       <property name="text">
-        <string>Firewall Platform:</string>
-       </property>
-      </widget>
-     </item>
-     <item row="1" column="1">
-      <widget class="QLabel" name="platform">
-       <property name="text">
-        <string>TextLabel</string>
-       </property>
-      </widget>
-     </item>
-     <item row="1" column="2" colspan="2">
-      <spacer name="horizontalSpacer">
-       <property name="orientation">
-        <enum>Qt::Horizontal</enum>
-       </property>
-       <property name="sizeHint" stdset="0">
-        <size>
-         <width>388</width>
-         <height>20</height>
-        </size>
-       </property>
-      </spacer>
-     </item>
-     <item row="2" column="0" colspan="3">
-      <widget class="QFrame" name="hostOSAndVersionFrame">
-       <property name="frameShape">
-        <enum>QFrame::NoFrame</enum>
-       </property>
-       <property name="frameShadow">
-        <enum>QFrame::Raised</enum>
-       </property>
-       <layout class="QGridLayout" name="gridLayout">
-        <property name="margin">
-         <number>0</number>
-        </property>
-        <item row="0" column="0">
-         <widget class="QLabel" name="label_2">
-          <property name="text">
-           <string>Host OS:</string>
-          </property>
-         </widget>
-        </item>
-        <item row="0" column="1">
-         <widget class="QComboBox" name="hostOS"/>
-        </item>
-        <item row="0" column="2">
-         <widget class="QLabel" name="label_3">
-          <property name="text">
-           <string>Version:</string>
-          </property>
-         </widget>
-        </item>
-        <item row="0" column="3">
-         <widget class="QComboBox" name="version"/>
-        </item>
-       </layout>
-      </widget>
-     </item>
-     <item row="2" column="3">
-      <spacer name="horizontalSpacer_2">
-       <property name="orientation">
-        <enum>Qt::Horizontal</enum>
-       </property>
-       <property name="sizeHint" stdset="0">
-        <size>
-         <width>258</width>
-         <height>20</height>
-        </size>
-       </property>
-      </spacer>
-     </item>
-    </layout>
+  <layout class="QGridLayout" name="gridLayout_2">
+   <item row="0" column="0" colspan="3">
+    <widget class="QLabel" name="platformSpecificWarning">
+     <property name="text">
+      <string>TextLabel</string>
+     </property>
+     <property name="wordWrap">
+      <bool>true</bool>
+     </property>
+    </widget>
    </item>
    <item row="1" column="0">
+    <widget class="QLabel" name="label">
+     <property name="text">
+      <string>Firewall Platform:</string>
+     </property>
+    </widget>
+   </item>
+   <item row="1" column="1">
+    <widget class="QLabel" name="platform">
+     <property name="text">
+      <string>TextLabel</string>
+     </property>
+    </widget>
+   </item>
+   <item row="1" column="2">
+    <spacer name="horizontalSpacer">
+     <property name="orientation">
+      <enum>Qt::Horizontal</enum>
+     </property>
+     <property name="sizeHint" stdset="0">
+      <size>
+       <width>442</width>
+       <height>20</height>
+      </size>
+     </property>
+    </spacer>
+   </item>
+   <item row="2" column="0" colspan="3">
+    <widget class="QFrame" name="importOptionsFrame">
+     <property name="frameShape">
+      <enum>QFrame::NoFrame</enum>
+     </property>
+     <property name="frameShadow">
+      <enum>QFrame::Raised</enum>
+     </property>
+     <layout class="QGridLayout" name="gridLayout">
+      <property name="margin">
+       <number>0</number>
+      </property>
+      <item row="0" column="0">
+       <widget class="QLabel" name="label_2">
+        <property name="text">
+         <string>Host OS:</string>
+        </property>
+       </widget>
+      </item>
+      <item row="0" column="1">
+       <widget class="QComboBox" name="hostOS"/>
+      </item>
+      <item row="0" column="2">
+       <widget class="QLabel" name="label_3">
+        <property name="text">
+         <string>Version:</string>
+        </property>
+       </widget>
+      </item>
+      <item row="0" column="3">
+       <widget class="QComboBox" name="version"/>
+      </item>
+      <item row="0" column="4">
+       <spacer name="horizontalSpacer_2">
+        <property name="orientation">
+         <enum>Qt::Horizontal</enum>
+        </property>
+        <property name="sizeType">
+         <enum>QSizePolicy::Expanding</enum>
+        </property>
+        <property name="sizeHint" stdset="0">
+         <size>
+          <width>329</width>
+          <height>20</height>
+         </size>
+        </property>
+       </spacer>
+      </item>
+      <item row="1" column="0" colspan="5">
+       <widget class="QCheckBox" name="addStandardComments">
+        <property name="text">
+         <string>Add line numbers in the original file to comments in rules and objects</string>
+        </property>
+       </widget>
+      </item>
+     </layout>
+    </widget>
+   </item>
+   <item row="3" column="0" colspan="3">
     <widget class="QTextBrowser" name="configFileBrowser"/>
    </item>
   </layout>
diff --git a/src/parsers/PFCfgLexer.cpp b/src/parsers/PFCfgLexer.cpp
index 0bbcf2f09..8fd738e73 100644
--- a/src/parsers/PFCfgLexer.cpp
+++ b/src/parsers/PFCfgLexer.cpp
@@ -266,6 +266,12 @@ ANTLR_USE_NAMESPACE(antlr)RefToken PFCfgLexer::nextToken()
 		resetText();
 		try {   // for lexical and char stream error handling
 			switch ( LA(1)) {
+			case 0x23 /* '#' */ :
+			{
+				mCOMMENT_START(true);
+				theRetToken=_returnToken;
+				break;
+			}
 			case 0xa /* '\n' */ :
 			case 0xd /* '\r' */ :
 			{
@@ -498,11 +504,7 @@ ANTLR_USE_NAMESPACE(antlr)RefToken PFCfgLexer::nextToken()
 				break;
 			}
 			default:
-				if ((LA(1) == 0x23 /* '#' */ ) && ((LA(2) >= 0x3 /* '\3' */  && LA(2) <= 0xff))) {
-					mLINE_COMMENT(true);
-					theRetToken=_returnToken;
-				}
-				else if ((LA(1) == 0x22 /* '\"' */ ) && ((LA(2) >= 0x3 /* '\3' */  && LA(2) <= 0xff))) {
+				if ((LA(1) == 0x22 /* '\"' */ ) && ((LA(2) >= 0x3 /* '\3' */  && LA(2) <= 0xff))) {
 					mSTRING(true);
 					theRetToken=_returnToken;
 				}
@@ -510,10 +512,6 @@ ANTLR_USE_NAMESPACE(antlr)RefToken PFCfgLexer::nextToken()
 					mWhitespace(true);
 					theRetToken=_returnToken;
 				}
-				else if ((LA(1) == 0x23 /* '#' */ ) && (true)) {
-					mNUMBER_SIGN(true);
-					theRetToken=_returnToken;
-				}
 				else if ((LA(1) == 0x22 /* '\"' */ ) && (true)) {
 					mDOUBLE_QUOTE(true);
 					theRetToken=_returnToken;
@@ -548,68 +546,6 @@ tryAgain:;
 	}
 }
 
-void PFCfgLexer::mLINE_COMMENT(bool _createToken) {
-	int _ttype; ANTLR_USE_NAMESPACE(antlr)RefToken _token; ANTLR_USE_NAMESPACE(std)string::size_type _begin = text.length();
-	_ttype = LINE_COMMENT;
-	ANTLR_USE_NAMESPACE(std)string::size_type _saveIndex;
-	
-	match("#");
-	{ // ( ... )*
-	for (;;) {
-		if ((_tokenSet_1.member(LA(1)))) {
-			{
-			match(_tokenSet_1);
-			}
-		}
-		else {
-			goto _loop277;
-		}
-		
-	}
-	_loop277:;
-	} // ( ... )*
-	mNEWLINE(false);
-	if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
-	   _token = makeToken(_ttype);
-	   _token->setText(text.substr(_begin, text.length()-_begin));
-	}
-	_returnToken = _token;
-	_saveIndex=0;
-}
-
-void PFCfgLexer::mNEWLINE(bool _createToken) {
-	int _ttype; ANTLR_USE_NAMESPACE(antlr)RefToken _token; ANTLR_USE_NAMESPACE(std)string::size_type _begin = text.length();
-	_ttype = NEWLINE;
-	ANTLR_USE_NAMESPACE(std)string::size_type _saveIndex;
-	
-	{
-	if ((LA(1) == 0xd /* '\r' */ ) && (LA(2) == 0xa /* '\n' */ )) {
-		match("\r\n");
-	}
-	else if ((LA(1) == 0xd /* '\r' */ ) && (true)) {
-		match('\r' /* charlit */ );
-	}
-	else if ((LA(1) == 0xa /* '\n' */ )) {
-		match('\n' /* charlit */ );
-	}
-	else {
-		throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());
-	}
-	
-	}
-	if ( inputState->guessing==0 ) {
-#line 1990 "pf.g"
-		newline();
-#line 604 "PFCfgLexer.cpp"
-	}
-	if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
-	   _token = makeToken(_ttype);
-	   _token->setText(text.substr(_begin, text.length()-_begin));
-	}
-	_returnToken = _token;
-	_saveIndex=0;
-}
-
 void PFCfgLexer::mWhitespace(bool _createToken) {
 	int _ttype; ANTLR_USE_NAMESPACE(antlr)RefToken _token; ANTLR_USE_NAMESPACE(std)string::size_type _begin = text.length();
 	_ttype = Whitespace;
@@ -679,9 +615,56 @@ void PFCfgLexer::mWhitespace(bool _createToken) {
 	}
 	}
 	if ( inputState->guessing==0 ) {
-#line 1985 "pf.g"
+#line 1996 "pf.g"
 		_ttype = ANTLR_USE_NAMESPACE(antlr)Token::SKIP;
-#line 685 "PFCfgLexer.cpp"
+#line 621 "PFCfgLexer.cpp"
+	}
+	if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
+	   _token = makeToken(_ttype);
+	   _token->setText(text.substr(_begin, text.length()-_begin));
+	}
+	_returnToken = _token;
+	_saveIndex=0;
+}
+
+void PFCfgLexer::mCOMMENT_START(bool _createToken) {
+	int _ttype; ANTLR_USE_NAMESPACE(antlr)RefToken _token; ANTLR_USE_NAMESPACE(std)string::size_type _begin = text.length();
+	_ttype = COMMENT_START;
+	ANTLR_USE_NAMESPACE(std)string::size_type _saveIndex;
+	
+	match('#' /* charlit */ );
+	if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
+	   _token = makeToken(_ttype);
+	   _token->setText(text.substr(_begin, text.length()-_begin));
+	}
+	_returnToken = _token;
+	_saveIndex=0;
+}
+
+void PFCfgLexer::mNEWLINE(bool _createToken) {
+	int _ttype; ANTLR_USE_NAMESPACE(antlr)RefToken _token; ANTLR_USE_NAMESPACE(std)string::size_type _begin = text.length();
+	_ttype = NEWLINE;
+	ANTLR_USE_NAMESPACE(std)string::size_type _saveIndex;
+	
+	{
+	if ((LA(1) == 0xd /* '\r' */ ) && (LA(2) == 0xa /* '\n' */ )) {
+		match("\r\n");
+	}
+	else if ((LA(1) == 0xd /* '\r' */ ) && (true)) {
+		match('\r' /* charlit */ );
+	}
+	else if ((LA(1) == 0xa /* '\n' */ )) {
+		match('\n' /* charlit */ );
+	}
+	else {
+		throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());
+	}
+	
+	}
+	if ( inputState->guessing==0 ) {
+#line 2001 "pf.g"
+		newline();
+#line 668 "PFCfgLexer.cpp"
 	}
 	if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
 	   _token = makeToken(_ttype);
@@ -866,17 +849,17 @@ void PFCfgLexer::mNUM_HEX_4DIGIT(bool _createToken) {
 	
 	mHEX_DIGIT(false);
 	{
-	if ((_tokenSet_2.member(LA(1)))) {
+	if ((_tokenSet_1.member(LA(1)))) {
 		{
 		mHEX_DIGIT(false);
 		}
 		{
-		if ((_tokenSet_2.member(LA(1)))) {
+		if ((_tokenSet_1.member(LA(1)))) {
 			{
 			mHEX_DIGIT(false);
 			}
 			{
-			if ((_tokenSet_2.member(LA(1)))) {
+			if ((_tokenSet_1.member(LA(1)))) {
 				mHEX_DIGIT(false);
 			}
 			else {
@@ -906,10 +889,10 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 	_ttype = NUMBER_ADDRESS_OR_WORD;
 	ANTLR_USE_NAMESPACE(std)string::size_type _saveIndex;
 	
-	bool synPredMatched330 = false;
-	if ((((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && (_tokenSet_3.member(LA(2))) && (_tokenSet_3.member(LA(3))))) {
-		int _m330 = mark();
-		synPredMatched330 = true;
+	bool synPredMatched327 = false;
+	if ((((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && (_tokenSet_2.member(LA(2))) && (_tokenSet_2.member(LA(3))))) {
+		int _m327 = mark();
+		synPredMatched327 = true;
 		inputState->guessing++;
 		try {
 			{
@@ -920,12 +903,12 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 			}
 		}
 		catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
-			synPredMatched330 = false;
+			synPredMatched327 = false;
 		}
-		rewind(_m330);
+		rewind(_m327);
 		inputState->guessing--;
 	}
-	if ( synPredMatched330 ) {
+	if ( synPredMatched327 ) {
 		{
 		mNUM_3DIGIT(false);
 		match('.' /* charlit */ );
@@ -936,181 +919,181 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 		mNUM_3DIGIT(false);
 		}
 		if ( inputState->guessing==0 ) {
-#line 2045 "pf.g"
+#line 2056 "pf.g"
 			_ttype = IPV4;
-#line 942 "PFCfgLexer.cpp"
+#line 925 "PFCfgLexer.cpp"
 		}
 	}
 	else {
-		bool synPredMatched337 = false;
-		if ((((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && (_tokenSet_3.member(LA(2))) && (_tokenSet_3.member(LA(3))))) {
-			int _m337 = mark();
-			synPredMatched337 = true;
+		bool synPredMatched334 = false;
+		if ((((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && (_tokenSet_2.member(LA(2))) && (_tokenSet_2.member(LA(3))))) {
+			int _m334 = mark();
+			synPredMatched334 = true;
 			inputState->guessing++;
 			try {
 				{
 				{ // ( ... )+
-				int _cnt334=0;
+				int _cnt331=0;
 				for (;;) {
 					if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
 						mDIGIT(false);
 					}
 					else {
-						if ( _cnt334>=1 ) { goto _loop334; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+						if ( _cnt331>=1 ) { goto _loop331; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
 					}
 					
-					_cnt334++;
+					_cnt331++;
 				}
-				_loop334:;
+				_loop331:;
 				}  // ( ... )+
 				match('.' /* charlit */ );
 				{ // ( ... )+
-				int _cnt336=0;
+				int _cnt333=0;
 				for (;;) {
 					if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
 						mDIGIT(false);
 					}
 					else {
-						if ( _cnt336>=1 ) { goto _loop336; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+						if ( _cnt333>=1 ) { goto _loop333; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
 					}
 					
-					_cnt336++;
+					_cnt333++;
 				}
-				_loop336:;
+				_loop333:;
 				}  // ( ... )+
 				}
 			}
 			catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
-				synPredMatched337 = false;
+				synPredMatched334 = false;
 			}
-			rewind(_m337);
+			rewind(_m334);
 			inputState->guessing--;
 		}
-		if ( synPredMatched337 ) {
+		if ( synPredMatched334 ) {
 			{
 			{ // ( ... )+
-			int _cnt340=0;
+			int _cnt337=0;
 			for (;;) {
 				if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
 					mDIGIT(false);
 				}
 				else {
-					if ( _cnt340>=1 ) { goto _loop340; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+					if ( _cnt337>=1 ) { goto _loop337; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
 				}
 				
-				_cnt340++;
+				_cnt337++;
 			}
-			_loop340:;
+			_loop337:;
 			}  // ( ... )+
 			match('.' /* charlit */ );
 			{ // ( ... )+
-			int _cnt342=0;
+			int _cnt339=0;
 			for (;;) {
 				if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
 					mDIGIT(false);
 				}
 				else {
-					if ( _cnt342>=1 ) { goto _loop342; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+					if ( _cnt339>=1 ) { goto _loop339; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
 				}
 				
-				_cnt342++;
+				_cnt339++;
 			}
-			_loop342:;
+			_loop339:;
 			}  // ( ... )+
 			}
 			if ( inputState->guessing==0 ) {
-#line 2048 "pf.g"
+#line 2059 "pf.g"
 				_ttype = NUMBER;
-#line 1025 "PFCfgLexer.cpp"
+#line 1008 "PFCfgLexer.cpp"
 			}
 		}
 		else {
-			bool synPredMatched305 = false;
-			if (((_tokenSet_2.member(LA(1))) && (_tokenSet_4.member(LA(2))) && (true))) {
-				int _m305 = mark();
-				synPredMatched305 = true;
+			bool synPredMatched302 = false;
+			if (((_tokenSet_1.member(LA(1))) && (_tokenSet_3.member(LA(2))) && (true))) {
+				int _m302 = mark();
+				synPredMatched302 = true;
 				inputState->guessing++;
 				try {
 					{
 					{ // ( ... )+
-					int _cnt304=0;
+					int _cnt301=0;
 					for (;;) {
-						if ((_tokenSet_2.member(LA(1)))) {
+						if ((_tokenSet_1.member(LA(1)))) {
 							mHEX_DIGIT(false);
 						}
 						else {
-							if ( _cnt304>=1 ) { goto _loop304; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+							if ( _cnt301>=1 ) { goto _loop301; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
 						}
 						
-						_cnt304++;
+						_cnt301++;
 					}
-					_loop304:;
+					_loop301:;
 					}  // ( ... )+
 					match(':' /* charlit */ );
 					}
 				}
 				catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
-					synPredMatched305 = false;
+					synPredMatched302 = false;
 				}
-				rewind(_m305);
+				rewind(_m302);
 				inputState->guessing--;
 			}
-			if ( synPredMatched305 ) {
+			if ( synPredMatched302 ) {
 				{
 				{
 				{ // ( ... )+
-				int _cnt309=0;
+				int _cnt306=0;
 				for (;;) {
-					if ((_tokenSet_2.member(LA(1)))) {
+					if ((_tokenSet_1.member(LA(1)))) {
 						mHEX_DIGIT(false);
 					}
 					else {
-						if ( _cnt309>=1 ) { goto _loop309; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+						if ( _cnt306>=1 ) { goto _loop306; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
 					}
 					
-					_cnt309++;
+					_cnt306++;
 				}
-				_loop309:;
+				_loop306:;
 				}  // ( ... )+
 				{ // ( ... )+
-				int _cnt313=0;
+				int _cnt310=0;
 				for (;;) {
 					if ((LA(1) == 0x3a /* ':' */ )) {
 						match(':' /* charlit */ );
 						{ // ( ... )*
 						for (;;) {
-							if ((_tokenSet_2.member(LA(1)))) {
+							if ((_tokenSet_1.member(LA(1)))) {
 								mHEX_DIGIT(false);
 							}
 							else {
-								goto _loop312;
+								goto _loop309;
 							}
 							
 						}
-						_loop312:;
+						_loop309:;
 						} // ( ... )*
 					}
 					else {
-						if ( _cnt313>=1 ) { goto _loop313; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+						if ( _cnt310>=1 ) { goto _loop310; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
 					}
 					
-					_cnt313++;
+					_cnt310++;
 				}
-				_loop313:;
+				_loop310:;
 				}  // ( ... )+
 				}
 				if ( inputState->guessing==0 ) {
-#line 2030 "pf.g"
+#line 2041 "pf.g"
 					_ttype = IPV6;
-#line 1106 "PFCfgLexer.cpp"
+#line 1089 "PFCfgLexer.cpp"
 				}
 				}
 			}
 			else {
-				bool synPredMatched315 = false;
+				bool synPredMatched312 = false;
 				if (((LA(1) == 0x3a /* ':' */ ))) {
-					int _m315 = mark();
-					synPredMatched315 = true;
+					int _m312 = mark();
+					synPredMatched312 = true;
 					inputState->guessing++;
 					try {
 						{
@@ -1118,93 +1101,93 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 						}
 					}
 					catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
-						synPredMatched315 = false;
+						synPredMatched312 = false;
 					}
-					rewind(_m315);
+					rewind(_m312);
 					inputState->guessing--;
 				}
-				if ( synPredMatched315 ) {
+				if ( synPredMatched312 ) {
 					{
-					bool synPredMatched320 = false;
-					if (((LA(1) == 0x3a /* ':' */ ) && (LA(2) == 0x3a /* ':' */ ) && (_tokenSet_2.member(LA(3))))) {
-						int _m320 = mark();
-						synPredMatched320 = true;
+					bool synPredMatched317 = false;
+					if (((LA(1) == 0x3a /* ':' */ ) && (LA(2) == 0x3a /* ':' */ ) && (_tokenSet_1.member(LA(3))))) {
+						int _m317 = mark();
+						synPredMatched317 = true;
 						inputState->guessing++;
 						try {
 							{
 							match(':' /* charlit */ );
 							match(':' /* charlit */ );
 							{ // ( ... )+
-							int _cnt319=0;
+							int _cnt316=0;
 							for (;;) {
-								if ((_tokenSet_2.member(LA(1)))) {
+								if ((_tokenSet_1.member(LA(1)))) {
 									mHEX_DIGIT(false);
 								}
 								else {
-									if ( _cnt319>=1 ) { goto _loop319; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+									if ( _cnt316>=1 ) { goto _loop316; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
 								}
 								
-								_cnt319++;
+								_cnt316++;
 							}
-							_loop319:;
+							_loop316:;
 							}  // ( ... )+
 							}
 						}
 						catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
-							synPredMatched320 = false;
+							synPredMatched317 = false;
 						}
-						rewind(_m320);
+						rewind(_m317);
 						inputState->guessing--;
 					}
-					if ( synPredMatched320 ) {
+					if ( synPredMatched317 ) {
 						{
 						match(':' /* charlit */ );
 						match(':' /* charlit */ );
 						{ // ( ... )+
-						int _cnt323=0;
+						int _cnt320=0;
 						for (;;) {
-							if ((_tokenSet_2.member(LA(1)))) {
+							if ((_tokenSet_1.member(LA(1)))) {
 								mHEX_DIGIT(false);
 							}
 							else {
-								if ( _cnt323>=1 ) { goto _loop323; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+								if ( _cnt320>=1 ) { goto _loop320; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
 							}
 							
-							_cnt323++;
+							_cnt320++;
 						}
-						_loop323:;
+						_loop320:;
 						}  // ( ... )+
 						{ // ( ... )*
 						for (;;) {
 							if ((LA(1) == 0x3a /* ':' */ )) {
 								match(':' /* charlit */ );
 								{ // ( ... )+
-								int _cnt326=0;
+								int _cnt323=0;
 								for (;;) {
-									if ((_tokenSet_2.member(LA(1)))) {
+									if ((_tokenSet_1.member(LA(1)))) {
 										mHEX_DIGIT(false);
 									}
 									else {
-										if ( _cnt326>=1 ) { goto _loop326; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+										if ( _cnt323>=1 ) { goto _loop323; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
 									}
 									
-									_cnt326++;
+									_cnt323++;
 								}
-								_loop326:;
+								_loop323:;
 								}  // ( ... )+
 							}
 							else {
-								goto _loop327;
+								goto _loop324;
 							}
 							
 						}
-						_loop327:;
+						_loop324:;
 						} // ( ... )*
 						}
 						if ( inputState->guessing==0 ) {
-#line 2036 "pf.g"
+#line 2047 "pf.g"
 							_ttype = IPV6;
-#line 1208 "PFCfgLexer.cpp"
+#line 1191 "PFCfgLexer.cpp"
 						}
 					}
 					else if ((LA(1) == 0x3a /* ':' */ ) && (LA(2) == 0x3a /* ':' */ ) && (true)) {
@@ -1213,17 +1196,17 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 						match(':' /* charlit */ );
 						}
 						if ( inputState->guessing==0 ) {
-#line 2038 "pf.g"
+#line 2049 "pf.g"
 							_ttype = IPV6;
-#line 1219 "PFCfgLexer.cpp"
+#line 1202 "PFCfgLexer.cpp"
 						}
 					}
 					else if ((LA(1) == 0x3a /* ':' */ ) && (true)) {
 						match(':' /* charlit */ );
 						if ( inputState->guessing==0 ) {
-#line 2040 "pf.g"
+#line 2051 "pf.g"
 							_ttype = COLON;
-#line 1227 "PFCfgLexer.cpp"
+#line 1210 "PFCfgLexer.cpp"
 						}
 					}
 					else {
@@ -1234,26 +1217,26 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 				}
 				else if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && (true) && (true)) {
 					{ // ( ... )+
-					int _cnt344=0;
+					int _cnt341=0;
 					for (;;) {
 						if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
 							mDIGIT(false);
 						}
 						else {
-							if ( _cnt344>=1 ) { goto _loop344; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+							if ( _cnt341>=1 ) { goto _loop341; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
 						}
 						
-						_cnt344++;
+						_cnt341++;
 					}
-					_loop344:;
+					_loop341:;
 					}  // ( ... )+
 					if ( inputState->guessing==0 ) {
-#line 2050 "pf.g"
+#line 2061 "pf.g"
 						_ttype = INT_CONST;
-#line 1254 "PFCfgLexer.cpp"
+#line 1237 "PFCfgLexer.cpp"
 					}
 				}
-				else if ((_tokenSet_5.member(LA(1))) && (true) && (true)) {
+				else if ((_tokenSet_4.member(LA(1))) && (true) && (true)) {
 					{
 					switch ( LA(1)) {
 					case 0x61 /* 'a' */ :
@@ -1466,16 +1449,16 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 						}
 						default:
 						{
-							goto _loop347;
+							goto _loop344;
 						}
 						}
 					}
-					_loop347:;
+					_loop344:;
 					} // ( ... )*
 					if ( inputState->guessing==0 ) {
-#line 2061 "pf.g"
+#line 2072 "pf.g"
 						_ttype = WORD;
-#line 1479 "PFCfgLexer.cpp"
+#line 1462 "PFCfgLexer.cpp"
 					}
 				}
 	else {
@@ -1499,15 +1482,15 @@ void PFCfgLexer::mSTRING(bool _createToken) {
 	match('\"' /* charlit */ );
 	{ // ( ... )*
 	for (;;) {
-		if ((_tokenSet_6.member(LA(1)))) {
+		if ((_tokenSet_5.member(LA(1)))) {
 			matchNot('\"' /* charlit */ );
 		}
 		else {
-			goto _loop350;
+			goto _loop347;
 		}
 		
 	}
-	_loop350:;
+	_loop347:;
 	} // ( ... )*
 	match('\"' /* charlit */ );
 	if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
@@ -1532,20 +1515,6 @@ void PFCfgLexer::mPIPE_CHAR(bool _createToken) {
 	_saveIndex=0;
 }
 
-void PFCfgLexer::mNUMBER_SIGN(bool _createToken) {
-	int _ttype; ANTLR_USE_NAMESPACE(antlr)RefToken _token; ANTLR_USE_NAMESPACE(std)string::size_type _begin = text.length();
-	_ttype = NUMBER_SIGN;
-	ANTLR_USE_NAMESPACE(std)string::size_type _saveIndex;
-	
-	match('#' /* charlit */ );
-	if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
-	   _token = makeToken(_ttype);
-	   _token->setText(text.substr(_begin, text.length()-_begin));
-	}
-	_returnToken = _token;
-	_saveIndex=0;
-}
-
 void PFCfgLexer::mPERCENT(bool _createToken) {
 	int _ttype; ANTLR_USE_NAMESPACE(antlr)RefToken _token; ANTLR_USE_NAMESPACE(std)string::size_type _begin = text.length();
 	_ttype = PERCENT;
@@ -1924,36 +1893,20 @@ const unsigned long PFCfgLexer::_tokenSet_0_data_[] = { 4294958072UL, 1UL, 0UL,
 // 0xe4 0xe5 0xe6 0xe7 0xe8 0xe9 0xea 0xeb 0xec 0xed 0xee 0xef 0xf0 0xf1 
 // 0xf2 0xf3 0xf4 0xf5 0xf6 0xf7 0xf8 0xf9 0xfa 0xfb 0xfc 0xfd 0xfe 0xff 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgLexer::_tokenSet_0(_tokenSet_0_data_,16);
-const unsigned long PFCfgLexer::_tokenSet_1_data_[] = { 4294958072UL, 4294967295UL, 4294967295UL, 4294967295UL, 4294967295UL, 4294967295UL, 4294967295UL, 4294967295UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
-// 0x3 0x4 0x5 0x6 0x7 0x8 0x9 0xb 0xc 0xe 0xf 0x10 0x11 0x12 0x13 0x14 
-// 0x15 0x16 0x17 0x18 0x19 0x1a 0x1b 0x1c 0x1d 0x1e 0x1f   ! \" # $ % 
-// & \' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G 
-// H I J K L M N O P Q R S T U V W X Y Z [ 0x5c ] ^ _ ` a b c d e f g h 
-// i j k l m n o p q r s t u v w x y z { | } ~ 0x7f 0x80 0x81 0x82 0x83 
-// 0x84 0x85 0x86 0x87 0x88 0x89 0x8a 0x8b 0x8c 0x8d 0x8e 0x8f 0x90 0x91 
-// 0x92 0x93 0x94 0x95 0x96 0x97 0x98 0x99 0x9a 0x9b 0x9c 0x9d 0x9e 0x9f 
-// 0xa0 0xa1 0xa2 0xa3 0xa4 0xa5 0xa6 0xa7 0xa8 0xa9 0xaa 0xab 0xac 0xad 
-// 0xae 0xaf 0xb0 0xb1 0xb2 0xb3 0xb4 0xb5 0xb6 0xb7 0xb8 0xb9 0xba 0xbb 
-// 0xbc 0xbd 0xbe 0xbf 0xc0 0xc1 0xc2 0xc3 0xc4 0xc5 0xc6 0xc7 0xc8 0xc9 
-// 0xca 0xcb 0xcc 0xcd 0xce 0xcf 0xd0 0xd1 0xd2 0xd3 0xd4 0xd5 0xd6 0xd7 
-// 0xd8 0xd9 0xda 0xdb 0xdc 0xdd 0xde 0xdf 0xe0 0xe1 0xe2 0xe3 0xe4 0xe5 
-// 0xe6 0xe7 0xe8 0xe9 0xea 0xeb 0xec 0xed 0xee 0xef 0xf0 0xf1 0xf2 0xf3 
-// 0xf4 0xf5 0xf6 0xf7 0xf8 0xf9 0xfa 0xfb 0xfc 0xfd 0xfe 0xff 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgLexer::_tokenSet_1(_tokenSet_1_data_,16);
-const unsigned long PFCfgLexer::_tokenSet_2_data_[] = { 0UL, 67043328UL, 126UL, 126UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgLexer::_tokenSet_1_data_[] = { 0UL, 67043328UL, 126UL, 126UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // 0 1 2 3 4 5 6 7 8 9 A B C D E F a b c d e f 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgLexer::_tokenSet_2(_tokenSet_2_data_,10);
-const unsigned long PFCfgLexer::_tokenSet_3_data_[] = { 0UL, 67059712UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgLexer::_tokenSet_1(_tokenSet_1_data_,10);
+const unsigned long PFCfgLexer::_tokenSet_2_data_[] = { 0UL, 67059712UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // . 0 1 2 3 4 5 6 7 8 9 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgLexer::_tokenSet_3(_tokenSet_3_data_,10);
-const unsigned long PFCfgLexer::_tokenSet_4_data_[] = { 0UL, 134152192UL, 126UL, 126UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgLexer::_tokenSet_2(_tokenSet_2_data_,10);
+const unsigned long PFCfgLexer::_tokenSet_3_data_[] = { 0UL, 134152192UL, 126UL, 126UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // 0 1 2 3 4 5 6 7 8 9 : A B C D E F a b c d e f 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgLexer::_tokenSet_4(_tokenSet_4_data_,10);
-const unsigned long PFCfgLexer::_tokenSet_5_data_[] = { 0UL, 0UL, 134217726UL, 134217726UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgLexer::_tokenSet_3(_tokenSet_3_data_,10);
+const unsigned long PFCfgLexer::_tokenSet_4_data_[] = { 0UL, 0UL, 134217726UL, 134217726UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // A B C D E F G H I J K L M N O P Q R S T U V W X Y Z a b c d e f g h 
 // i j k l m n o p q r s t u v w x y z 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgLexer::_tokenSet_5(_tokenSet_5_data_,10);
-const unsigned long PFCfgLexer::_tokenSet_6_data_[] = { 4294967288UL, 4294967291UL, 4294967295UL, 4294967295UL, 4294967295UL, 4294967295UL, 4294967295UL, 4294967295UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgLexer::_tokenSet_4(_tokenSet_4_data_,10);
+const unsigned long PFCfgLexer::_tokenSet_5_data_[] = { 4294967288UL, 4294967291UL, 4294967295UL, 4294967295UL, 4294967295UL, 4294967295UL, 4294967295UL, 4294967295UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // 0x3 0x4 0x5 0x6 0x7 0x8 0x9 0xa 0xb 0xc 0xd 0xe 0xf 0x10 0x11 0x12 0x13 
 // 0x14 0x15 0x16 0x17 0x18 0x19 0x1a 0x1b 0x1c 0x1d 0x1e 0x1f   ! # $ 
 // % & \' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F 
@@ -1968,5 +1921,5 @@ const unsigned long PFCfgLexer::_tokenSet_6_data_[] = { 4294967288UL, 4294967291
 // 0xd8 0xd9 0xda 0xdb 0xdc 0xdd 0xde 0xdf 0xe0 0xe1 0xe2 0xe3 0xe4 0xe5 
 // 0xe6 0xe7 0xe8 0xe9 0xea 0xeb 0xec 0xed 0xee 0xef 0xf0 0xf1 0xf2 0xf3 
 // 0xf4 0xf5 0xf6 0xf7 0xf8 0xf9 0xfa 0xfb 0xfc 0xfd 0xfe 0xff 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgLexer::_tokenSet_6(_tokenSet_6_data_,16);
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgLexer::_tokenSet_5(_tokenSet_5_data_,16);
 
diff --git a/src/parsers/PFCfgLexer.hpp b/src/parsers/PFCfgLexer.hpp
index ee04a539c..37c434224 100644
--- a/src/parsers/PFCfgLexer.hpp
+++ b/src/parsers/PFCfgLexer.hpp
@@ -48,9 +48,9 @@ public:
 	PFCfgLexer(ANTLR_USE_NAMESPACE(antlr)InputBuffer& ib);
 	PFCfgLexer(const ANTLR_USE_NAMESPACE(antlr)LexerSharedInputState& state);
 	ANTLR_USE_NAMESPACE(antlr)RefToken nextToken();
-	public: void mLINE_COMMENT(bool _createToken);
-	public: void mNEWLINE(bool _createToken);
 	public: void mWhitespace(bool _createToken);
+	public: void mCOMMENT_START(bool _createToken);
+	public: void mNEWLINE(bool _createToken);
 	protected: void mINT_CONST(bool _createToken);
 	protected: void mHEX_CONST(bool _createToken);
 	protected: void mNUMBER(bool _createToken);
@@ -63,7 +63,6 @@ public:
 	public: void mNUMBER_ADDRESS_OR_WORD(bool _createToken);
 	public: void mSTRING(bool _createToken);
 	public: void mPIPE_CHAR(bool _createToken);
-	public: void mNUMBER_SIGN(bool _createToken);
 	public: void mPERCENT(bool _createToken);
 	public: void mAMPERSAND(bool _createToken);
 	public: void mAPOSTROPHE(bool _createToken);
@@ -104,8 +103,6 @@ private:
 	static const ANTLR_USE_NAMESPACE(antlr)BitSet _tokenSet_4;
 	static const unsigned long _tokenSet_5_data_[];
 	static const ANTLR_USE_NAMESPACE(antlr)BitSet _tokenSet_5;
-	static const unsigned long _tokenSet_6_data_[];
-	static const ANTLR_USE_NAMESPACE(antlr)BitSet _tokenSet_6;
 };
 
 #endif /*INC_PFCfgLexer_hpp_*/
diff --git a/src/parsers/PFCfgParser.cpp b/src/parsers/PFCfgParser.cpp
index f78c0ff11..0682583d9 100644
--- a/src/parsers/PFCfgParser.cpp
+++ b/src/parsers/PFCfgParser.cpp
@@ -45,12 +45,13 @@ PFCfgParser::PFCfgParser(const ANTLR_USE_NAMESPACE(antlr)ParserSharedInputState&
 }
 
 void PFCfgParser::cfgfile() {
+	Tracer traceInOut(this, "cfgfile");
 	
 	try {      // for error handling
 		{ // ( ... )*
 		for (;;) {
 			switch ( LA(1)) {
-			case LINE_COMMENT:
+			case COMMENT_START:
 			{
 				comment();
 				break;
@@ -151,9 +152,21 @@ void PFCfgParser::cfgfile() {
 }
 
 void PFCfgParser::comment() {
+	Tracer traceInOut(this, "comment");
 	
 	try {      // for error handling
-		match(LINE_COMMENT);
+		match(COMMENT_START);
+#line 156 "pf.g"
+		
+		QStringList str;
+		while (LA(1) != ANTLR_USE_NAMESPACE(antlr)Token::EOF_TYPE && LA(1) != NEWLINE)
+		{
+		str << QString::fromUtf8(LT(1)->getText().c_str());
+		consume();
+		}
+		importer->last_comment << str.join(" ");
+		
+#line 170 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -162,10 +175,11 @@ void PFCfgParser::comment() {
 }
 
 void PFCfgParser::include_command() {
+	Tracer traceInOut(this, "include_command");
 	
 	try {      // for error handling
 		match(INCLUDE_COMMAND);
-#line 158 "pf.g"
+#line 169 "pf.g"
 		
 		importer->clear();
 		importer->setCurrentLineNumber(LT(0)->getLine());
@@ -173,7 +187,7 @@ void PFCfgParser::include_command() {
 		QString("Error: import of 'include' commands is not supported."));
 		consumeUntil(NEWLINE);
 		
-#line 177 "PFCfgParser.cpp"
+#line 191 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -182,17 +196,18 @@ void PFCfgParser::include_command() {
 }
 
 void PFCfgParser::macro_definition() {
+	Tracer traceInOut(this, "macro_definition");
 	
 	try {      // for error handling
 		match(WORD);
 		match(EQUAL);
-#line 169 "pf.g"
+#line 180 "pf.g"
 		
 		importer->clear();
 		importer->setCurrentLineNumber(LT(0)->getLine());
 		consumeUntil(NEWLINE);
 		
-#line 196 "PFCfgParser.cpp"
+#line 211 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -201,10 +216,11 @@ void PFCfgParser::macro_definition() {
 }
 
 void PFCfgParser::altq_rule() {
+	Tracer traceInOut(this, "altq_rule");
 	
 	try {      // for error handling
 		match(ALTQ);
-#line 189 "pf.g"
+#line 200 "pf.g"
 		
 		importer->clear();
 		importer->setCurrentLineNumber(LT(0)->getLine());
@@ -212,7 +228,7 @@ void PFCfgParser::altq_rule() {
 		QString("import of 'altq' commands is not supported."));
 		consumeUntil(NEWLINE);
 		
-#line 216 "PFCfgParser.cpp"
+#line 232 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -221,10 +237,11 @@ void PFCfgParser::altq_rule() {
 }
 
 void PFCfgParser::antispoof_rule() {
+	Tracer traceInOut(this, "antispoof_rule");
 	
 	try {      // for error handling
 		match(ANTISPOOF);
-#line 178 "pf.g"
+#line 189 "pf.g"
 		
 		importer->clear();
 		importer->setCurrentLineNumber(LT(0)->getLine());
@@ -232,7 +249,7 @@ void PFCfgParser::antispoof_rule() {
 		QString("Warning: import of 'antispoof' commands has not been implemented yet."));
 		consumeUntil(NEWLINE);
 		
-#line 236 "PFCfgParser.cpp"
+#line 253 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -241,10 +258,11 @@ void PFCfgParser::antispoof_rule() {
 }
 
 void PFCfgParser::queue_rule() {
+	Tracer traceInOut(this, "queue_rule");
 	
 	try {      // for error handling
 		match(QUEUE);
-#line 200 "pf.g"
+#line 211 "pf.g"
 		
 		importer->clear();
 		importer->setCurrentLineNumber(LT(0)->getLine());
@@ -252,7 +270,7 @@ void PFCfgParser::queue_rule() {
 		QString("import of 'queue' commands is not supported."));
 		consumeUntil(NEWLINE);
 		
-#line 256 "PFCfgParser.cpp"
+#line 274 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -261,15 +279,16 @@ void PFCfgParser::queue_rule() {
 }
 
 void PFCfgParser::set_rule() {
+	Tracer traceInOut(this, "set_rule");
 	
 	try {      // for error handling
 		match(SET);
-#line 211 "pf.g"
+#line 222 "pf.g"
 		
 		importer->clear();
 		importer->setCurrentLineNumber(LT(0)->getLine());
 		
-#line 273 "PFCfgParser.cpp"
+#line 292 "PFCfgParser.cpp"
 		{
 		switch ( LA(1)) {
 		case TIMEOUT:
@@ -356,10 +375,11 @@ void PFCfgParser::set_rule() {
 }
 
 void PFCfgParser::scrub_rule() {
+	Tracer traceInOut(this, "scrub_rule");
 	
 	try {      // for error handling
 		match(SCRUB);
-#line 510 "pf.g"
+#line 521 "pf.g"
 		
 		importer->clear();
 		importer->setCurrentLineNumber(LT(0)->getLine());
@@ -367,7 +387,7 @@ void PFCfgParser::scrub_rule() {
 		importer->action = "scrub";
 		*dbg << LT(1)->getLine() << ":" << " scrub ";
 		
-#line 371 "PFCfgParser.cpp"
+#line 391 "PFCfgParser.cpp"
 		rule_extended();
 		match(NEWLINE);
 	}
@@ -378,10 +398,11 @@ void PFCfgParser::scrub_rule() {
 }
 
 void PFCfgParser::match_rule() {
+	Tracer traceInOut(this, "match_rule");
 	
 	try {      // for error handling
 		match(MATCH);
-#line 525 "pf.g"
+#line 536 "pf.g"
 		
 		importer->clear();
 		importer->setCurrentLineNumber(LT(0)->getLine());
@@ -389,13 +410,13 @@ void PFCfgParser::match_rule() {
 		importer->action = "match";
 		*dbg << LT(1)->getLine() << ":" << " match ";
 		
-#line 393 "PFCfgParser.cpp"
+#line 414 "PFCfgParser.cpp"
 		rule_extended();
-#line 533 "pf.g"
+#line 544 "pf.g"
 		
 		if ( ! importer->scrub_rule) importer->pushRule();
 		
-#line 399 "PFCfgParser.cpp"
+#line 420 "PFCfgParser.cpp"
 		match(NEWLINE);
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -405,17 +426,18 @@ void PFCfgParser::match_rule() {
 }
 
 void PFCfgParser::table_rule() {
+	Tracer traceInOut(this, "table_rule");
 	ANTLR_USE_NAMESPACE(antlr)RefToken  name = ANTLR_USE_NAMESPACE(antlr)nullToken;
 	ANTLR_USE_NAMESPACE(antlr)RefToken  file = ANTLR_USE_NAMESPACE(antlr)nullToken;
 	
 	try {      // for error handling
 		match(TABLE);
-#line 542 "pf.g"
+#line 553 "pf.g"
 		
 		importer->clear();
 		importer->setCurrentLineNumber(LT(0)->getLine());
 		
-#line 419 "PFCfgParser.cpp"
+#line 441 "PFCfgParser.cpp"
 		match(LESS_THAN);
 		name = LT(1);
 		match(WORD);
@@ -446,12 +468,12 @@ void PFCfgParser::table_rule() {
 		case CONST_WORD:
 		{
 			match(CONST_WORD);
-#line 554 "pf.g"
+#line 565 "pf.g"
 			
 			importer->addMessageToLog(
 			QString("Warning: attribute \"const\" will be dropped from table configuration since this attribute is not supported at this time"));
 			
-#line 455 "PFCfgParser.cpp"
+#line 477 "PFCfgParser.cpp"
 			break;
 		}
 		case NEWLINE:
@@ -472,12 +494,12 @@ void PFCfgParser::table_rule() {
 		case COUNTERS:
 		{
 			match(COUNTERS);
-#line 561 "pf.g"
+#line 572 "pf.g"
 			
 			importer->addMessageToLog(
 			QString("Warning: attribute \"counters\" will be dropped from table configuration since this attribute is not supported at this time"));
 			
-#line 481 "PFCfgParser.cpp"
+#line 503 "PFCfgParser.cpp"
 			break;
 		}
 		case NEWLINE:
@@ -499,12 +521,12 @@ void PFCfgParser::table_rule() {
 			match(FILE);
 			file = LT(1);
 			match(STRING);
-#line 568 "pf.g"
+#line 579 "pf.g"
 			
 			importer->newAddressTableObject(
 			name->getText(), file->getText());
 			
-#line 508 "PFCfgParser.cpp"
+#line 530 "PFCfgParser.cpp"
 			break;
 		}
 		case OPENING_BRACE:
@@ -546,24 +568,24 @@ void PFCfgParser::table_rule() {
 			_loop58:;
 			} // ( ... )*
 			match(CLOSING_BRACE);
-#line 580 "pf.g"
+#line 591 "pf.g"
 			
 			importer->newAddressTableObject(
 			name->getText(), importer->tmp_group);
 			
-#line 555 "PFCfgParser.cpp"
+#line 577 "PFCfgParser.cpp"
 			break;
 		}
 		case NEWLINE:
 		{
 			match(NEWLINE);
-#line 586 "pf.g"
+#line 597 "pf.g"
 			
 			// Special case: table definition without file name or list of addresses.
 			// Create run-time AddressTable object with name but no file spec.
 			importer->newAddressTableObject(name->getText(), "");
 			
-#line 567 "PFCfgParser.cpp"
+#line 589 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -580,10 +602,11 @@ void PFCfgParser::table_rule() {
 }
 
 void PFCfgParser::no_nat_rule() {
+	Tracer traceInOut(this, "no_nat_rule");
 	
 	try {      // for error handling
 		match(NO);
-#line 661 "pf.g"
+#line 672 "pf.g"
 		
 		importer->clear();
 		importer->setCurrentLineNumber(LT(0)->getLine());
@@ -591,7 +614,7 @@ void PFCfgParser::no_nat_rule() {
 		importer->action = "nonat";
 		*dbg << LT(1)->getLine() << ":" << " nonat ";
 		
-#line 595 "PFCfgParser.cpp"
+#line 618 "PFCfgParser.cpp"
 		{
 		switch ( LA(1)) {
 		case NAT:
@@ -618,10 +641,11 @@ void PFCfgParser::no_nat_rule() {
 }
 
 void PFCfgParser::nat_rule() {
+	Tracer traceInOut(this, "nat_rule");
 	
 	try {      // for error handling
 		match(NAT);
-#line 678 "pf.g"
+#line 689 "pf.g"
 		
 		if ( importer->action != "nonat" )
 		{
@@ -632,18 +656,18 @@ void PFCfgParser::nat_rule() {
 		*dbg << LT(1)->getLine() << ":" << " nat ";
 		}
 		
-#line 636 "PFCfgParser.cpp"
+#line 660 "PFCfgParser.cpp"
 		{
 		switch ( LA(1)) {
 		case PASS:
 		{
 			match(PASS);
-#line 690 "pf.g"
+#line 701 "pf.g"
 			
 			importer->error_tracker->registerError(
 			QString("import of 'nat pass' commands is not supported."));
 			
-#line 647 "PFCfgParser.cpp"
+#line 671 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case LOG:
@@ -798,12 +822,12 @@ void PFCfgParser::nat_rule() {
 		case TAG:
 		{
 			tag_clause();
-#line 703 "pf.g"
+#line 714 "pf.g"
 			
 			importer->error_tracker->registerError(
 			QString("import of 'nat ... tag' commands is not supported."));
 			
-#line 807 "PFCfgParser.cpp"
+#line 831 "PFCfgParser.cpp"
 			break;
 		}
 		case NEWLINE:
@@ -843,21 +867,21 @@ void PFCfgParser::nat_rule() {
 			}
 			}
 			}
-#line 711 "pf.g"
+#line 722 "pf.g"
 			
 			importer->nat_group = importer->tmp_group;
 			
-#line 851 "PFCfgParser.cpp"
+#line 875 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case PORT:
 			{
 				portspec();
-#line 716 "pf.g"
+#line 727 "pf.g"
 				
 				importer->nat_port_group = importer->tmp_port_group;
 				
-#line 861 "PFCfgParser.cpp"
+#line 885 "PFCfgParser.cpp"
 				break;
 			}
 			case NEWLINE:
@@ -901,9 +925,9 @@ void PFCfgParser::nat_rule() {
 			case STATIC_PORT:
 			{
 				match(STATIC_PORT);
-#line 722 "pf.g"
+#line 733 "pf.g"
 				importer->nat_rule_opt_2 = "static-port";
-#line 907 "PFCfgParser.cpp"
+#line 931 "PFCfgParser.cpp"
 				break;
 			}
 			case NEWLINE:
@@ -928,11 +952,11 @@ void PFCfgParser::nat_rule() {
 		}
 		}
 		}
-#line 725 "pf.g"
+#line 736 "pf.g"
 		
 		importer->pushRule();
 		
-#line 936 "PFCfgParser.cpp"
+#line 960 "PFCfgParser.cpp"
 		match(NEWLINE);
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -942,10 +966,11 @@ void PFCfgParser::nat_rule() {
 }
 
 void PFCfgParser::rdr_rule() {
+	Tracer traceInOut(this, "rdr_rule");
 	
 	try {      // for error handling
 		match(RDR);
-#line 734 "pf.g"
+#line 745 "pf.g"
 		
 		if ( importer->action != "nonat" )
 		{
@@ -956,18 +981,18 @@ void PFCfgParser::rdr_rule() {
 		*dbg << LT(1)->getLine() << ":" << " rdr ";
 		}
 		
-#line 960 "PFCfgParser.cpp"
+#line 985 "PFCfgParser.cpp"
 		{
 		switch ( LA(1)) {
 		case PASS:
 		{
 			match(PASS);
-#line 746 "pf.g"
+#line 757 "pf.g"
 			
 			importer->error_tracker->registerError(
 			QString("import of 'nat pass' commands is not supported."));
 			
-#line 971 "PFCfgParser.cpp"
+#line 996 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case LOG:
@@ -1122,12 +1147,12 @@ void PFCfgParser::rdr_rule() {
 		case TAG:
 		{
 			tag_clause();
-#line 759 "pf.g"
+#line 770 "pf.g"
 			
 			importer->error_tracker->registerError(
 			QString("import of 'nat ... tag' commands is not supported."));
 			
-#line 1131 "PFCfgParser.cpp"
+#line 1156 "PFCfgParser.cpp"
 			break;
 		}
 		case NEWLINE:
@@ -1167,21 +1192,21 @@ void PFCfgParser::rdr_rule() {
 			}
 			}
 			}
-#line 767 "pf.g"
+#line 778 "pf.g"
 			
 			importer->nat_group = importer->tmp_group;
 			
-#line 1175 "PFCfgParser.cpp"
+#line 1200 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case PORT:
 			{
 				portspec();
-#line 772 "pf.g"
+#line 783 "pf.g"
 				
 				importer->nat_port_group = importer->tmp_port_group;
 				
-#line 1185 "PFCfgParser.cpp"
+#line 1210 "PFCfgParser.cpp"
 				break;
 			}
 			case NEWLINE:
@@ -1230,11 +1255,11 @@ void PFCfgParser::rdr_rule() {
 		}
 		}
 		}
-#line 778 "pf.g"
+#line 789 "pf.g"
 		
 		importer->pushRule();
 		
-#line 1238 "PFCfgParser.cpp"
+#line 1263 "PFCfgParser.cpp"
 		match(NEWLINE);
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -1244,10 +1269,11 @@ void PFCfgParser::rdr_rule() {
 }
 
 void PFCfgParser::binat_rule() {
+	Tracer traceInOut(this, "binat_rule");
 	
 	try {      // for error handling
 		match(BINAT);
-#line 910 "pf.g"
+#line 921 "pf.g"
 		
 		importer->clear();
 		importer->setCurrentLineNumber(LT(0)->getLine());
@@ -1255,7 +1281,7 @@ void PFCfgParser::binat_rule() {
 		QString("import of 'binat' commands is not supported."));
 		consumeUntil(NEWLINE);
 		
-#line 1259 "PFCfgParser.cpp"
+#line 1285 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -1264,10 +1290,11 @@ void PFCfgParser::binat_rule() {
 }
 
 void PFCfgParser::pass_rule() {
+	Tracer traceInOut(this, "pass_rule");
 	
 	try {      // for error handling
 		match(PASS);
-#line 933 "pf.g"
+#line 944 "pf.g"
 		
 		importer->clear();
 		importer->setCurrentLineNumber(LT(0)->getLine());
@@ -1275,13 +1302,13 @@ void PFCfgParser::pass_rule() {
 		importer->action = "pass";
 		*dbg << LT(1)->getLine() << ":" << " pass ";
 		
-#line 1279 "PFCfgParser.cpp"
+#line 1306 "PFCfgParser.cpp"
 		rule_extended();
-#line 941 "pf.g"
+#line 952 "pf.g"
 		
 		importer->pushRule();
 		
-#line 1285 "PFCfgParser.cpp"
+#line 1312 "PFCfgParser.cpp"
 		match(NEWLINE);
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -1291,10 +1318,11 @@ void PFCfgParser::pass_rule() {
 }
 
 void PFCfgParser::block_rule() {
+	Tracer traceInOut(this, "block_rule");
 	
 	try {      // for error handling
 		match(BLOCK);
-#line 948 "pf.g"
+#line 959 "pf.g"
 		
 		importer->clear();
 		importer->setCurrentLineNumber(LT(0)->getLine());
@@ -1302,7 +1330,7 @@ void PFCfgParser::block_rule() {
 		importer->action = "block";
 		*dbg << LT(1)->getLine() << ":" << " block   ";
 		
-#line 1306 "PFCfgParser.cpp"
+#line 1334 "PFCfgParser.cpp"
 		{
 		switch ( LA(1)) {
 		case DROP:
@@ -1361,11 +1389,11 @@ void PFCfgParser::block_rule() {
 		}
 		}
 		rule_extended();
-#line 957 "pf.g"
+#line 968 "pf.g"
 		
 		importer->pushRule();
 		
-#line 1369 "PFCfgParser.cpp"
+#line 1397 "PFCfgParser.cpp"
 		match(NEWLINE);
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -1375,6 +1403,7 @@ void PFCfgParser::block_rule() {
 }
 
 void PFCfgParser::set_timeout() {
+	Tracer traceInOut(this, "set_timeout");
 	
 	try {      // for error handling
 		match(TIMEOUT);
@@ -1422,10 +1451,11 @@ void PFCfgParser::set_timeout() {
 }
 
 void PFCfgParser::set_ruleset_optimization() {
+	Tracer traceInOut(this, "set_ruleset_optimization");
 	
 	try {      // for error handling
 		match(14);
-#line 254 "pf.g"
+#line 265 "pf.g"
 		
 		importer->clear();
 		importer->setCurrentLineNumber(LT(0)->getLine());
@@ -1433,7 +1463,7 @@ void PFCfgParser::set_ruleset_optimization() {
 		QString("Error: import of 'set ruleset-optimization' commands is not supported."));
 		consumeUntil(NEWLINE);
 		
-#line 1437 "PFCfgParser.cpp"
+#line 1467 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -1442,6 +1472,7 @@ void PFCfgParser::set_ruleset_optimization() {
 }
 
 void PFCfgParser::set_optimization() {
+	Tracer traceInOut(this, "set_optimization");
 	
 	try {      // for error handling
 		match(LITERAL_optimization);
@@ -1478,9 +1509,9 @@ void PFCfgParser::set_optimization() {
 		}
 		}
 		}
-#line 276 "pf.g"
+#line 287 "pf.g"
 		importer->set_optimization = LT(0)->getText();
-#line 1484 "PFCfgParser.cpp"
+#line 1515 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -1489,6 +1520,7 @@ void PFCfgParser::set_optimization() {
 }
 
 void PFCfgParser::set_limit() {
+	Tracer traceInOut(this, "set_limit");
 	
 	try {      // for error handling
 		match(LITERAL_limit);
@@ -1522,10 +1554,11 @@ void PFCfgParser::set_limit() {
 }
 
 void PFCfgParser::set_loginterface() {
+	Tracer traceInOut(this, "set_loginterface");
 	
 	try {      // for error handling
 		match(LITERAL_loginterface);
-#line 287 "pf.g"
+#line 298 "pf.g"
 		
 		importer->clear();
 		importer->setCurrentLineNumber(LT(0)->getLine());
@@ -1533,7 +1566,7 @@ void PFCfgParser::set_loginterface() {
 		QString("Error: import of 'set loginterface' commands is not supported."));
 		consumeUntil(NEWLINE);
 		
-#line 1537 "PFCfgParser.cpp"
+#line 1570 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -1542,6 +1575,7 @@ void PFCfgParser::set_loginterface() {
 }
 
 void PFCfgParser::set_block_policy() {
+	Tracer traceInOut(this, "set_block_policy");
 	
 	try {      // for error handling
 		match(23);
@@ -1563,9 +1597,9 @@ void PFCfgParser::set_block_policy() {
 		}
 		}
 		}
-#line 299 "pf.g"
+#line 310 "pf.g"
 		importer->set_block_policy = LT(0)->getText();
-#line 1569 "PFCfgParser.cpp"
+#line 1603 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -1574,6 +1608,7 @@ void PFCfgParser::set_block_policy() {
 }
 
 void PFCfgParser::set_state_policy() {
+	Tracer traceInOut(this, "set_state_policy");
 	
 	try {      // for error handling
 		match(26);
@@ -1595,9 +1630,9 @@ void PFCfgParser::set_state_policy() {
 		}
 		}
 		}
-#line 305 "pf.g"
+#line 316 "pf.g"
 		importer->set_state_policy = LT(0)->getText();
-#line 1601 "PFCfgParser.cpp"
+#line 1636 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -1606,10 +1641,11 @@ void PFCfgParser::set_state_policy() {
 }
 
 void PFCfgParser::set_state_defaults() {
+	Tracer traceInOut(this, "set_state_defaults");
 	
 	try {      // for error handling
 		match(29);
-#line 311 "pf.g"
+#line 322 "pf.g"
 		
 		importer->clear();
 		importer->setCurrentLineNumber(LT(0)->getLine());
@@ -1617,7 +1653,7 @@ void PFCfgParser::set_state_defaults() {
 		QString("Error: import of 'set state-defaults' commands is not supported."));
 		consumeUntil(NEWLINE);
 		
-#line 1621 "PFCfgParser.cpp"
+#line 1657 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -1626,10 +1662,11 @@ void PFCfgParser::set_state_defaults() {
 }
 
 void PFCfgParser::set_require_order() {
+	Tracer traceInOut(this, "set_require_order");
 	
 	try {      // for error handling
 		match(30);
-#line 323 "pf.g"
+#line 334 "pf.g"
 		
 		importer->clear();
 		importer->setCurrentLineNumber(LT(0)->getLine());
@@ -1637,7 +1674,7 @@ void PFCfgParser::set_require_order() {
 		QString("Error: import of 'set require-order' commands is not supported."));
 		consumeUntil(NEWLINE);
 		
-#line 1641 "PFCfgParser.cpp"
+#line 1678 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -1646,10 +1683,11 @@ void PFCfgParser::set_require_order() {
 }
 
 void PFCfgParser::set_fingerprints() {
+	Tracer traceInOut(this, "set_fingerprints");
 	
 	try {      // for error handling
 		match(LITERAL_fingerprints);
-#line 335 "pf.g"
+#line 346 "pf.g"
 		
 		importer->clear();
 		importer->setCurrentLineNumber(LT(0)->getLine());
@@ -1657,7 +1695,7 @@ void PFCfgParser::set_fingerprints() {
 		QString("Error: import of 'set fingerprints' commands is not supported."));
 		consumeUntil(NEWLINE);
 		
-#line 1661 "PFCfgParser.cpp"
+#line 1699 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -1666,6 +1704,7 @@ void PFCfgParser::set_fingerprints() {
 }
 
 void PFCfgParser::set_skip() {
+	Tracer traceInOut(this, "set_skip");
 	
 	try {      // for error handling
 		match(LITERAL_skip);
@@ -1679,54 +1718,15 @@ void PFCfgParser::set_skip() {
 }
 
 void PFCfgParser::set_debug() {
+	Tracer traceInOut(this, "set_debug");
 	
 	try {      // for error handling
 		match(LITERAL_debug);
 		match(WORD);
-#line 371 "pf.g"
+#line 382 "pf.g"
 		
 		importer->set_debug = LT(0)->getText();
 		
-#line 1691 "PFCfgParser.cpp"
-	}
-	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
-		reportError(ex);
-		recover(ex,_tokenSet_1);
-	}
-}
-
-void PFCfgParser::set_reassemble() {
-	
-	try {      // for error handling
-		match(LITERAL_reassemble);
-#line 379 "pf.g"
-		
-		importer->clear();
-		importer->setCurrentLineNumber(LT(0)->getLine());
-		importer->addMessageToLog(
-		QString("Error: import of 'set reassemble' commands is not supported."));
-		consumeUntil(NEWLINE);
-		
-#line 1711 "PFCfgParser.cpp"
-	}
-	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
-		reportError(ex);
-		recover(ex,_tokenSet_1);
-	}
-}
-
-void PFCfgParser::set_hostid() {
-	
-	try {      // for error handling
-		match(LITERAL_hostid);
-#line 391 "pf.g"
-		
-		importer->clear();
-		importer->setCurrentLineNumber(LT(0)->getLine());
-		importer->addMessageToLog(
-		QString("Error: import of 'set hostid' commands is not supported."));
-		consumeUntil(NEWLINE);
-		
 #line 1731 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -1735,10 +1735,53 @@ void PFCfgParser::set_hostid() {
 	}
 }
 
+void PFCfgParser::set_reassemble() {
+	Tracer traceInOut(this, "set_reassemble");
+	
+	try {      // for error handling
+		match(LITERAL_reassemble);
+#line 390 "pf.g"
+		
+		importer->clear();
+		importer->setCurrentLineNumber(LT(0)->getLine());
+		importer->addMessageToLog(
+		QString("Error: import of 'set reassemble' commands is not supported."));
+		consumeUntil(NEWLINE);
+		
+#line 1752 "PFCfgParser.cpp"
+	}
+	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
+		reportError(ex);
+		recover(ex,_tokenSet_1);
+	}
+}
+
+void PFCfgParser::set_hostid() {
+	Tracer traceInOut(this, "set_hostid");
+	
+	try {      // for error handling
+		match(LITERAL_hostid);
+#line 402 "pf.g"
+		
+		importer->clear();
+		importer->setCurrentLineNumber(LT(0)->getLine());
+		importer->addMessageToLog(
+		QString("Error: import of 'set hostid' commands is not supported."));
+		consumeUntil(NEWLINE);
+		
+#line 1773 "PFCfgParser.cpp"
+	}
+	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
+		reportError(ex);
+		recover(ex,_tokenSet_1);
+	}
+}
+
 void PFCfgParser::timeout_def() {
-#line 409 "pf.g"
+	Tracer traceInOut(this, "timeout_def");
+#line 420 "pf.g"
 	std::string timeout_name, timeout_value;
-#line 1742 "PFCfgParser.cpp"
+#line 1785 "PFCfgParser.cpp"
 	
 	try {      // for error handling
 		{
@@ -1844,19 +1887,19 @@ void PFCfgParser::timeout_def() {
 		}
 		}
 		}
-#line 450 "pf.g"
+#line 461 "pf.g"
 		
 		timeout_name = LT(0)->getText();
 		
-#line 1852 "PFCfgParser.cpp"
+#line 1895 "PFCfgParser.cpp"
 		match(INT_CONST);
-#line 454 "pf.g"
+#line 465 "pf.g"
 		
 		timeout_value = LT(0)->getText();
 		importer->timeouts.push_back(
 		std::pair<std::string, std::string>(timeout_name, timeout_value));
 		
-#line 1860 "PFCfgParser.cpp"
+#line 1903 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -1865,6 +1908,7 @@ void PFCfgParser::timeout_def() {
 }
 
 void PFCfgParser::timeout_def_list() {
+	Tracer traceInOut(this, "timeout_def_list");
 	
 	try {      // for error handling
 		match(OPENING_BRACE);
@@ -1925,9 +1969,10 @@ void PFCfgParser::timeout_def_list() {
 }
 
 void PFCfgParser::limit_def() {
-#line 472 "pf.g"
+	Tracer traceInOut(this, "limit_def");
+#line 483 "pf.g"
 	std::string limit_name, limit_value;
-#line 1931 "PFCfgParser.cpp"
+#line 1976 "PFCfgParser.cpp"
 	
 	try {      // for error handling
 		{
@@ -1963,19 +2008,19 @@ void PFCfgParser::limit_def() {
 		}
 		}
 		}
-#line 485 "pf.g"
+#line 496 "pf.g"
 		
 		limit_name = LT(0)->getText();
 		
-#line 1971 "PFCfgParser.cpp"
+#line 2016 "PFCfgParser.cpp"
 		match(INT_CONST);
-#line 489 "pf.g"
+#line 500 "pf.g"
 		
 		limit_value = LT(0)->getText();
 		importer->limits.push_back(
 		std::pair<std::string, std::string>(limit_name, limit_value));
 		
-#line 1979 "PFCfgParser.cpp"
+#line 2024 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -1984,6 +2029,7 @@ void PFCfgParser::limit_def() {
 }
 
 void PFCfgParser::limit_def_list() {
+	Tracer traceInOut(this, "limit_def_list");
 	
 	try {      // for error handling
 		match(OPENING_BRACE);
@@ -2030,15 +2076,16 @@ void PFCfgParser::limit_def_list() {
 }
 
 void PFCfgParser::skip_def() {
+	Tracer traceInOut(this, "skip_def");
 	
 	try {      // for error handling
 		switch ( LA(1)) {
 		case WORD:
 		{
 			match(WORD);
-#line 351 "pf.g"
+#line 362 "pf.g"
 			importer->set_skip_on.push_back(LT(0)->getText());
-#line 2042 "PFCfgParser.cpp"
+#line 2089 "PFCfgParser.cpp"
 			break;
 		}
 		case OPENING_BRACE:
@@ -2059,13 +2106,14 @@ void PFCfgParser::skip_def() {
 }
 
 void PFCfgParser::skip_list() {
+	Tracer traceInOut(this, "skip_list");
 	
 	try {      // for error handling
 		match(OPENING_BRACE);
 		match(WORD);
-#line 360 "pf.g"
+#line 371 "pf.g"
 		importer->set_skip_on.push_back(LT(0)->getText());
-#line 2069 "PFCfgParser.cpp"
+#line 2117 "PFCfgParser.cpp"
 		{ // ( ... )*
 		for (;;) {
 			if ((LA(1) == WORD || LA(1) == COMMA)) {
@@ -2082,9 +2130,9 @@ void PFCfgParser::skip_list() {
 				_loop32:;
 				} // ( ... )*
 				match(WORD);
-#line 363 "pf.g"
+#line 374 "pf.g"
 				importer->set_skip_on.push_back(LT(0)->getText());
-#line 2088 "PFCfgParser.cpp"
+#line 2136 "PFCfgParser.cpp"
 			}
 			else {
 				goto _loop33;
@@ -2102,6 +2150,7 @@ void PFCfgParser::skip_list() {
 }
 
 void PFCfgParser::rule_extended() {
+	Tracer traceInOut(this, "rule_extended");
 	
 	try {      // for error handling
 		{
@@ -2444,9 +2493,10 @@ void PFCfgParser::rule_extended() {
 }
 
 void PFCfgParser::tableaddr_spec() {
-#line 594 "pf.g"
+	Tracer traceInOut(this, "tableaddr_spec");
+#line 605 "pf.g"
 	AddressSpec as;
-#line 2450 "PFCfgParser.cpp"
+#line 2500 "PFCfgParser.cpp"
 	
 	try {      // for error handling
 		{
@@ -2454,9 +2504,9 @@ void PFCfgParser::tableaddr_spec() {
 		case EXLAMATION:
 		{
 			match(EXLAMATION);
-#line 595 "pf.g"
+#line 606 "pf.g"
 			as.neg = true;
-#line 2460 "PFCfgParser.cpp"
+#line 2510 "PFCfgParser.cpp"
 			break;
 		}
 		case WORD:
@@ -2478,13 +2528,13 @@ void PFCfgParser::tableaddr_spec() {
 		case WORD:
 		{
 			match(WORD);
-#line 598 "pf.g"
+#line 609 "pf.g"
 			
 			// interface name or domain/host name
 			as.at = AddressSpec::INTERFACE_OR_HOST_NAME;
 			as.address = LT(0)->getText();
 			
-#line 2488 "PFCfgParser.cpp"
+#line 2538 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case COLON:
@@ -2495,43 +2545,43 @@ void PFCfgParser::tableaddr_spec() {
 				case NETWORK:
 				{
 					match(NETWORK);
-#line 607 "pf.g"
+#line 618 "pf.g"
 					
 					as.at = AddressSpec::INTERFACE_NETWORK;
 					
-#line 2503 "PFCfgParser.cpp"
+#line 2553 "PFCfgParser.cpp"
 					break;
 				}
 				case BROADCAST:
 				{
 					match(BROADCAST);
-#line 612 "pf.g"
+#line 623 "pf.g"
 					
 					as.at = AddressSpec::INTERFACE_BROADCAST;
 					
-#line 2513 "PFCfgParser.cpp"
+#line 2563 "PFCfgParser.cpp"
 					break;
 				}
 				case PEER:
 				{
 					match(PEER);
-#line 617 "pf.g"
+#line 628 "pf.g"
 					
 					importer->error_tracker->registerError(
 					QString("import of 'interface:peer' is not supported."));
 					
-#line 2524 "PFCfgParser.cpp"
+#line 2574 "PFCfgParser.cpp"
 					break;
 				}
 				case INT_CONST:
 				{
 					match(INT_CONST);
-#line 623 "pf.g"
+#line 634 "pf.g"
 					
 					importer->error_tracker->registerError(
 					QString("import of 'interface:0' is not supported."));
 					
-#line 2535 "PFCfgParser.cpp"
+#line 2585 "PFCfgParser.cpp"
 					break;
 				}
 				default:
@@ -2564,12 +2614,12 @@ void PFCfgParser::tableaddr_spec() {
 		case SELF:
 		{
 			match(SELF);
-#line 631 "pf.g"
+#line 642 "pf.g"
 			
 			as.at = AddressSpec::SPECIAL_ADDRESS;
 			as.address = "self";
 			
-#line 2573 "PFCfgParser.cpp"
+#line 2623 "PFCfgParser.cpp"
 			break;
 		}
 		case INT_CONST:
@@ -2599,22 +2649,22 @@ void PFCfgParser::tableaddr_spec() {
 			}
 			}
 			}
-#line 638 "pf.g"
+#line 649 "pf.g"
 			
 			as.at = AddressSpec::HOST_ADDRESS;
 			as.address = LT(0)->getText();
 			
-#line 2608 "PFCfgParser.cpp"
+#line 2658 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case SLASH:
 			{
 				match(SLASH);
-#line 644 "pf.g"
+#line 655 "pf.g"
 				
 				as.at = AddressSpec::NETWORK_ADDRESS;
 				
-#line 2618 "PFCfgParser.cpp"
+#line 2668 "PFCfgParser.cpp"
 				{
 				switch ( LA(1)) {
 				case IPV4:
@@ -2633,11 +2683,11 @@ void PFCfgParser::tableaddr_spec() {
 				}
 				}
 				}
-#line 648 "pf.g"
+#line 659 "pf.g"
 				
 				as.netmask = LT(0)->getText(); 
 				
-#line 2641 "PFCfgParser.cpp"
+#line 2691 "PFCfgParser.cpp"
 				break;
 			}
 			case WORD:
@@ -2665,11 +2715,11 @@ void PFCfgParser::tableaddr_spec() {
 		}
 		}
 		}
-#line 653 "pf.g"
+#line 664 "pf.g"
 		
 		importer->tmp_group.push_back(as);
 		
-#line 2673 "PFCfgParser.cpp"
+#line 2723 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -2678,6 +2728,7 @@ void PFCfgParser::tableaddr_spec() {
 }
 
 void PFCfgParser::logging() {
+	Tracer traceInOut(this, "logging");
 	
 	try {      // for error handling
 		match(LOG);
@@ -2709,9 +2760,9 @@ void PFCfgParser::logging() {
 		}
 		}
 		}
-#line 1032 "pf.g"
+#line 1043 "pf.g"
 		importer->logging = true;
-#line 2715 "PFCfgParser.cpp"
+#line 2766 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -2720,6 +2771,7 @@ void PFCfgParser::logging() {
 }
 
 void PFCfgParser::intrface() {
+	Tracer traceInOut(this, "intrface");
 	
 	try {      // for error handling
 		match(ON);
@@ -2750,6 +2802,7 @@ void PFCfgParser::intrface() {
 }
 
 void PFCfgParser::address_family() {
+	Tracer traceInOut(this, "address_family");
 	
 	try {      // for error handling
 		switch ( LA(1)) {
@@ -2761,11 +2814,11 @@ void PFCfgParser::address_family() {
 		case INET6:
 		{
 			match(INET6);
-#line 1076 "pf.g"
+#line 1087 "pf.g"
 			
 			importer->address_family = LT(0)->getText();
 			
-#line 2769 "PFCfgParser.cpp"
+#line 2822 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -2781,6 +2834,7 @@ void PFCfgParser::address_family() {
 }
 
 void PFCfgParser::protospec() {
+	Tracer traceInOut(this, "protospec");
 	
 	try {      // for error handling
 		match(PROTO);
@@ -2793,20 +2847,21 @@ void PFCfgParser::protospec() {
 }
 
 void PFCfgParser::hosts() {
+	Tracer traceInOut(this, "hosts");
 	
 	try {      // for error handling
 		switch ( LA(1)) {
 		case ALL:
 		{
 			match(ALL);
-#line 1119 "pf.g"
+#line 1130 "pf.g"
 			
 			importer->src_group.push_back(
 			AddressSpec(AddressSpec::ANY, false, "0.0.0.0", "0.0.0.0"));
 			importer->dst_group.push_back(
 			AddressSpec(AddressSpec::ANY, false, "0.0.0.0", "0.0.0.0"));
 			
-#line 2810 "PFCfgParser.cpp"
+#line 2865 "PFCfgParser.cpp"
 			break;
 		}
 		case NEWLINE:
@@ -2932,6 +2987,7 @@ void PFCfgParser::hosts() {
 }
 
 void PFCfgParser::tagged() {
+	Tracer traceInOut(this, "tagged");
 	
 	try {      // for error handling
 		{
@@ -2939,9 +2995,9 @@ void PFCfgParser::tagged() {
 		case EXLAMATION:
 		{
 			match(EXLAMATION);
-#line 1678 "pf.g"
+#line 1689 "pf.g"
 			importer->tagged_neg = true;
-#line 2945 "PFCfgParser.cpp"
+#line 3001 "PFCfgParser.cpp"
 			break;
 		}
 		case TAGGED:
@@ -2956,11 +3012,11 @@ void PFCfgParser::tagged() {
 		}
 		match(TAGGED);
 		match(WORD);
-#line 1680 "pf.g"
+#line 1691 "pf.g"
 		
 		importer->tagged = LT(0)->getText();
 		
-#line 2964 "PFCfgParser.cpp"
+#line 3020 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -2969,15 +3025,16 @@ void PFCfgParser::tagged() {
 }
 
 void PFCfgParser::tag_clause() {
+	Tracer traceInOut(this, "tag_clause");
 	
 	try {      // for error handling
 		match(TAG);
 		match(WORD);
-#line 1687 "pf.g"
+#line 1698 "pf.g"
 		
 		importer->tag = LT(0)->getText();
 		
-#line 2981 "PFCfgParser.cpp"
+#line 3038 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -2986,9 +3043,10 @@ void PFCfgParser::tag_clause() {
 }
 
 void PFCfgParser::redirhost() {
-#line 789 "pf.g"
+	Tracer traceInOut(this, "redirhost");
+#line 800 "pf.g"
 	AddressSpec as;
-#line 2992 "PFCfgParser.cpp"
+#line 3050 "PFCfgParser.cpp"
 	
 	try {      // for error handling
 		{
@@ -2996,22 +3054,22 @@ void PFCfgParser::redirhost() {
 		case IPV4:
 		{
 			match(IPV4);
-#line 792 "pf.g"
+#line 803 "pf.g"
 			
 			as.at = AddressSpec::HOST_ADDRESS;
 			as.address = LT(0)->getText();
 			
-#line 3005 "PFCfgParser.cpp"
+#line 3063 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case SLASH:
 			{
 				match(SLASH);
-#line 798 "pf.g"
+#line 809 "pf.g"
 				
 				as.at = AddressSpec::NETWORK_ADDRESS;
 				
-#line 3015 "PFCfgParser.cpp"
+#line 3073 "PFCfgParser.cpp"
 				{
 				switch ( LA(1)) {
 				case IPV4:
@@ -3030,11 +3088,11 @@ void PFCfgParser::redirhost() {
 				}
 				}
 				}
-#line 802 "pf.g"
+#line 813 "pf.g"
 				
 				as.netmask = LT(0)->getText(); 
 				
-#line 3038 "PFCfgParser.cpp"
+#line 3096 "PFCfgParser.cpp"
 				break;
 			}
 			case NEWLINE:
@@ -3064,26 +3122,26 @@ void PFCfgParser::redirhost() {
 		{
 			match(OPENING_PAREN);
 			match(WORD);
-#line 809 "pf.g"
+#line 820 "pf.g"
 			
 			// interface name or domain/host name
 			as.at = AddressSpec::INTERFACE_OR_HOST_NAME;
 			as.address = LT(0)->getText();
 			
-#line 3074 "PFCfgParser.cpp"
+#line 3132 "PFCfgParser.cpp"
 			match(CLOSING_PAREN);
 			break;
 		}
 		case WORD:
 		{
 			match(WORD);
-#line 817 "pf.g"
+#line 828 "pf.g"
 			
 			// interface name or domain/host name
 			as.at = AddressSpec::INTERFACE_OR_HOST_NAME;
 			as.address = LT(0)->getText();
 			
-#line 3087 "PFCfgParser.cpp"
+#line 3145 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -3092,11 +3150,11 @@ void PFCfgParser::redirhost() {
 		}
 		}
 		}
-#line 823 "pf.g"
+#line 834 "pf.g"
 		
 		importer->tmp_group.push_back(as);
 		
-#line 3100 "PFCfgParser.cpp"
+#line 3158 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -3105,6 +3163,7 @@ void PFCfgParser::redirhost() {
 }
 
 void PFCfgParser::redirhost_list() {
+	Tracer traceInOut(this, "redirhost_list");
 	
 	try {      // for error handling
 		match(OPENING_BRACE);
@@ -3149,9 +3208,10 @@ void PFCfgParser::redirhost_list() {
 }
 
 void PFCfgParser::portspec() {
-#line 848 "pf.g"
+	Tracer traceInOut(this, "portspec");
+#line 859 "pf.g"
 	PortSpec ps;
-#line 3155 "PFCfgParser.cpp"
+#line 3215 "PFCfgParser.cpp"
 	
 	try {      // for error handling
 		match(PORT);
@@ -3161,31 +3221,31 @@ void PFCfgParser::portspec() {
 		case INT_CONST:
 		{
 			port_def();
-#line 852 "pf.g"
+#line 863 "pf.g"
 			
 			ps.port1 = importer->tmp_port_def;
 			ps.port2 = ps.port1;
 			ps.port_op = "=";
 			
-#line 3171 "PFCfgParser.cpp"
+#line 3231 "PFCfgParser.cpp"
 			break;
 		}
 		case IPV6:
 		{
 			match(IPV6);
-#line 861 "pf.g"
+#line 872 "pf.g"
 			
 			ps.setFromPortRange(LT(0)->getText());
 			
-#line 3181 "PFCfgParser.cpp"
+#line 3241 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case STAR:
 			{
 				match(STAR);
-#line 865 "pf.g"
+#line 876 "pf.g"
 				ps.port2 = "65535";
-#line 3189 "PFCfgParser.cpp"
+#line 3249 "PFCfgParser.cpp"
 				break;
 			}
 			case NEWLINE:
@@ -3211,11 +3271,11 @@ void PFCfgParser::portspec() {
 		}
 		}
 		}
-#line 868 "pf.g"
+#line 879 "pf.g"
 		
 		importer->tmp_port_group.push_back(ps);
 		
-#line 3219 "PFCfgParser.cpp"
+#line 3279 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -3224,6 +3284,7 @@ void PFCfgParser::portspec() {
 }
 
 void PFCfgParser::pooltype() {
+	Tracer traceInOut(this, "pooltype");
 	
 	try {      // for error handling
 		{
@@ -3231,49 +3292,49 @@ void PFCfgParser::pooltype() {
 		case BITMASK:
 		{
 			match(BITMASK);
-#line 882 "pf.g"
+#line 893 "pf.g"
 			importer->nat_rule_opt_1 = "bitmask";
-#line 3237 "PFCfgParser.cpp"
+#line 3298 "PFCfgParser.cpp"
 			break;
 		}
 		case RANDOM:
 		{
 			match(RANDOM);
-#line 884 "pf.g"
+#line 895 "pf.g"
 			importer->nat_rule_opt_1 = "random";
-#line 3245 "PFCfgParser.cpp"
+#line 3306 "PFCfgParser.cpp"
 			break;
 		}
 		case SOURCE_HASH:
 		{
 			match(SOURCE_HASH);
-#line 886 "pf.g"
+#line 897 "pf.g"
 			importer->nat_rule_opt_1 = "source-hash";
-#line 3253 "PFCfgParser.cpp"
+#line 3314 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case HEX_KEY:
 			{
 				match(HEX_KEY);
-#line 889 "pf.g"
+#line 900 "pf.g"
 				
 				importer->error_tracker->registerError(
 				QString("import of 'nat' commands with 'source-hash hex-key' "
 				"option is not supported"));
 				
-#line 3265 "PFCfgParser.cpp"
+#line 3326 "PFCfgParser.cpp"
 				break;
 			}
 			case STRING_KEY:
 			{
 				match(STRING_KEY);
-#line 896 "pf.g"
+#line 907 "pf.g"
 				
 				importer->error_tracker->registerError(
 				QString("import of 'nat' commands with 'source-hash string-key' "
 				"option is not supported"));
 				
-#line 3277 "PFCfgParser.cpp"
+#line 3338 "PFCfgParser.cpp"
 				break;
 			}
 			case NEWLINE:
@@ -3293,9 +3354,9 @@ void PFCfgParser::pooltype() {
 		case ROUND_ROBIN:
 		{
 			match(ROUND_ROBIN);
-#line 903 "pf.g"
+#line 914 "pf.g"
 			importer->nat_rule_opt_1 = "round-robin";
-#line 3299 "PFCfgParser.cpp"
+#line 3360 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -3330,6 +3391,7 @@ void PFCfgParser::pooltype() {
 }
 
 void PFCfgParser::port_def() {
+	Tracer traceInOut(this, "port_def");
 	
 	try {      // for error handling
 		{
@@ -3350,11 +3412,11 @@ void PFCfgParser::port_def() {
 		}
 		}
 		}
-#line 1815 "pf.g"
+#line 1826 "pf.g"
 		
 		importer->tmp_port_def = LT(0)->getText();
 		
-#line 3358 "PFCfgParser.cpp"
+#line 3420 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -3363,6 +3425,7 @@ void PFCfgParser::port_def() {
 }
 
 void PFCfgParser::block_return() {
+	Tracer traceInOut(this, "block_return");
 	
 	try {      // for error handling
 		{
@@ -3370,37 +3433,37 @@ void PFCfgParser::block_return() {
 		case DROP:
 		{
 			match(DROP);
-#line 965 "pf.g"
+#line 976 "pf.g"
 			importer->block_action_params.push_back("drop");
-#line 3376 "PFCfgParser.cpp"
+#line 3439 "PFCfgParser.cpp"
 			break;
 		}
 		case RETURN:
 		{
 			match(RETURN);
-#line 967 "pf.g"
+#line 978 "pf.g"
 			importer->block_action_params.push_back("return");
-#line 3384 "PFCfgParser.cpp"
+#line 3447 "PFCfgParser.cpp"
 			break;
 		}
 		case RETURN_RST:
 		{
 			match(RETURN_RST);
-#line 969 "pf.g"
+#line 980 "pf.g"
 			importer->block_action_params.push_back("return-rst");
-#line 3392 "PFCfgParser.cpp"
+#line 3455 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case TTL:
 			{
 				match(TTL);
 				match(INT_CONST);
-#line 972 "pf.g"
+#line 983 "pf.g"
 				
 				importer->error_tracker->registerError(
 				QString("Import of \"block return-rst ttl number\" is not supported. "));
 				
-#line 3404 "PFCfgParser.cpp"
+#line 3467 "PFCfgParser.cpp"
 				break;
 			}
 			case NEWLINE:
@@ -3454,9 +3517,9 @@ void PFCfgParser::block_return() {
 		case RETURN_ICMP:
 		{
 			match(RETURN_ICMP);
-#line 978 "pf.g"
+#line 989 "pf.g"
 			importer->block_action_params.push_back("return-icmp");
-#line 3460 "PFCfgParser.cpp"
+#line 3523 "PFCfgParser.cpp"
 			{
 			if ((LA(1) == OPENING_PAREN) && (_tokenSet_25.member(LA(2)))) {
 				match(OPENING_PAREN);
@@ -3507,9 +3570,9 @@ void PFCfgParser::block_return() {
 				}
 				}
 				}
-#line 982 "pf.g"
+#line 993 "pf.g"
 				importer->block_action_params.push_back(LT(0)->getText());
-#line 3513 "PFCfgParser.cpp"
+#line 3576 "PFCfgParser.cpp"
 				{
 				switch ( LA(1)) {
 				case COMMA:
@@ -3562,12 +3625,12 @@ void PFCfgParser::block_return() {
 					}
 					}
 					}
-#line 986 "pf.g"
+#line 997 "pf.g"
 					
 					importer->error_tracker->registerError(
 					QString("Import of \"block return-icmp (icmp_code, icmp6_code)\" is not supported"));
 					
-#line 3571 "PFCfgParser.cpp"
+#line 3634 "PFCfgParser.cpp"
 					break;
 				}
 				case CLOSING_PAREN:
@@ -3594,13 +3657,13 @@ void PFCfgParser::block_return() {
 		case RETURN_ICMP6:
 		{
 			match(RETURN_ICMP6);
-#line 995 "pf.g"
+#line 1006 "pf.g"
 			
 			importer->error_tracker->registerError(
 			QString("Import of \"block return-icmp6\" is not supported"));
 			importer->block_action_params.push_back("return-icmp");
 			
-#line 3604 "PFCfgParser.cpp"
+#line 3667 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -3617,6 +3680,7 @@ void PFCfgParser::block_return() {
 }
 
 void PFCfgParser::icmp_code_by_name() {
+	Tracer traceInOut(this, "icmp_code_by_name");
 	
 	try {      // for error handling
 		{
@@ -3785,6 +3849,7 @@ void PFCfgParser::icmp_code_by_name() {
 }
 
 void PFCfgParser::direction() {
+	Tracer traceInOut(this, "direction");
 	
 	try {      // for error handling
 		{
@@ -3805,11 +3870,11 @@ void PFCfgParser::direction() {
 		}
 		}
 		}
-#line 1015 "pf.g"
+#line 1026 "pf.g"
 		
 		importer->direction = LT(0)->getText();
 		
-#line 3813 "PFCfgParser.cpp"
+#line 3878 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -3818,6 +3883,7 @@ void PFCfgParser::direction() {
 }
 
 void PFCfgParser::quick_or_log() {
+	Tracer traceInOut(this, "quick_or_log");
 	
 	try {      // for error handling
 		{
@@ -3836,17 +3902,17 @@ void PFCfgParser::quick_or_log() {
 			}
 			
 			}
-#line 1023 "pf.g"
+#line 1034 "pf.g"
 			importer->logging = true;
-#line 3842 "PFCfgParser.cpp"
+#line 3908 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case QUICK:
 			{
 				match(QUICK);
-#line 1024 "pf.g"
+#line 1035 "pf.g"
 				importer->quick = true;
-#line 3850 "PFCfgParser.cpp"
+#line 3916 "PFCfgParser.cpp"
 				break;
 			}
 			case NEWLINE:
@@ -3896,9 +3962,9 @@ void PFCfgParser::quick_or_log() {
 		case QUICK:
 		{
 			match(QUICK);
-#line 1026 "pf.g"
+#line 1037 "pf.g"
 			importer->quick = true;
-#line 3902 "PFCfgParser.cpp"
+#line 3968 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case LOG:
@@ -3915,9 +3981,9 @@ void PFCfgParser::quick_or_log() {
 				}
 				
 				}
-#line 1027 "pf.g"
+#line 1038 "pf.g"
 				importer->logging = true;
-#line 3921 "PFCfgParser.cpp"
+#line 3987 "PFCfgParser.cpp"
 				break;
 			}
 			case NEWLINE:
@@ -3978,6 +4044,7 @@ void PFCfgParser::quick_or_log() {
 }
 
 void PFCfgParser::route() {
+	Tracer traceInOut(this, "route");
 	
 	try {      // for error handling
 		switch ( LA(1)) {
@@ -4009,6 +4076,7 @@ void PFCfgParser::route() {
 }
 
 void PFCfgParser::filteropts() {
+	Tracer traceInOut(this, "filteropts");
 	
 	try {      // for error handling
 		filteropt();
@@ -4070,6 +4138,7 @@ void PFCfgParser::filteropts() {
 }
 
 void PFCfgParser::logopts() {
+	Tracer traceInOut(this, "logopts");
 	
 	try {      // for error handling
 		match(OPENING_PAREN);
@@ -4078,9 +4147,9 @@ void PFCfgParser::logopts() {
 		for (;;) {
 			if ((LA(1) == COMMA)) {
 				match(COMMA);
-#line 1039 "pf.g"
+#line 1050 "pf.g"
 				importer->logopts += ",";
-#line 4084 "PFCfgParser.cpp"
+#line 4153 "PFCfgParser.cpp"
 				logopt();
 			}
 			else {
@@ -4099,6 +4168,7 @@ void PFCfgParser::logopts() {
 }
 
 void PFCfgParser::logopt() {
+	Tracer traceInOut(this, "logopt");
 	
 	try {      // for error handling
 		switch ( LA(1)) {
@@ -4116,11 +4186,11 @@ void PFCfgParser::logopt() {
 		{
 			match(TO);
 			match(WORD);
-#line 1046 "pf.g"
+#line 1057 "pf.g"
 			
 			importer->logopts += LT(0)->getText();
 			
-#line 4124 "PFCfgParser.cpp"
+#line 4194 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -4136,9 +4206,10 @@ void PFCfgParser::logopt() {
 }
 
 void PFCfgParser::ifspec() {
-#line 1054 "pf.g"
+	Tracer traceInOut(this, "ifspec");
+#line 1065 "pf.g"
 	InterfaceSpec is;
-#line 4142 "PFCfgParser.cpp"
+#line 4213 "PFCfgParser.cpp"
 	
 	try {      // for error handling
 		{
@@ -4146,9 +4217,9 @@ void PFCfgParser::ifspec() {
 		case EXLAMATION:
 		{
 			match(EXLAMATION);
-#line 1055 "pf.g"
+#line 1066 "pf.g"
 			is.neg = true;
-#line 4152 "PFCfgParser.cpp"
+#line 4223 "PFCfgParser.cpp"
 			break;
 		}
 		case WORD:
@@ -4162,13 +4233,13 @@ void PFCfgParser::ifspec() {
 		}
 		}
 		match(WORD);
-#line 1057 "pf.g"
+#line 1068 "pf.g"
 		
 		is.name = LT(0)->getText();
 		importer->iface_group.push_back(is);
 		importer->newInterface(is.name);
 		
-#line 4172 "PFCfgParser.cpp"
+#line 4243 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -4177,6 +4248,7 @@ void PFCfgParser::ifspec() {
 }
 
 void PFCfgParser::interface_list() {
+	Tracer traceInOut(this, "interface_list");
 	
 	try {      // for error handling
 		match(OPENING_BRACE);
@@ -4220,6 +4292,7 @@ void PFCfgParser::interface_list() {
 }
 
 void PFCfgParser::proto_def() {
+	Tracer traceInOut(this, "proto_def");
 	
 	try {      // for error handling
 		{
@@ -4268,6 +4341,7 @@ void PFCfgParser::proto_def() {
 }
 
 void PFCfgParser::proto_name() {
+	Tracer traceInOut(this, "proto_name");
 	
 	try {      // for error handling
 		{
@@ -4358,11 +4432,11 @@ void PFCfgParser::proto_name() {
 		}
 		}
 		}
-#line 1096 "pf.g"
+#line 1107 "pf.g"
 		
 		importer->proto_list.push_back(LT(0)->getText());
 		
-#line 4366 "PFCfgParser.cpp"
+#line 4440 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -4371,14 +4445,15 @@ void PFCfgParser::proto_name() {
 }
 
 void PFCfgParser::proto_number() {
+	Tracer traceInOut(this, "proto_number");
 	
 	try {      // for error handling
 		match(INT_CONST);
-#line 1102 "pf.g"
+#line 1113 "pf.g"
 		
 		importer->proto_list.push_back(LT(0)->getText());
 		
-#line 4382 "PFCfgParser.cpp"
+#line 4457 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -4387,6 +4462,7 @@ void PFCfgParser::proto_number() {
 }
 
 void PFCfgParser::proto_list() {
+	Tracer traceInOut(this, "proto_list");
 	
 	try {      // for error handling
 		match(OPENING_BRACE);
@@ -4446,6 +4522,7 @@ void PFCfgParser::proto_list() {
 }
 
 void PFCfgParser::hosts_from() {
+	Tracer traceInOut(this, "hosts_from");
 	
 	try {      // for error handling
 		match(FROM);
@@ -4499,6 +4576,7 @@ void PFCfgParser::hosts_from() {
 }
 
 void PFCfgParser::hosts_to() {
+	Tracer traceInOut(this, "hosts_to");
 	
 	try {      // for error handling
 		match(TO);
@@ -4551,6 +4629,7 @@ void PFCfgParser::hosts_to() {
 }
 
 void PFCfgParser::src_hosts_part() {
+	Tracer traceInOut(this, "src_hosts_part");
 	
 	try {      // for error handling
 		{
@@ -4572,13 +4651,13 @@ void PFCfgParser::src_hosts_part() {
 		case URPF_FAILED:
 		{
 			match(URPF_FAILED);
-#line 1142 "pf.g"
+#line 1153 "pf.g"
 			
 			importer->tmp_group.push_back(
 			AddressSpec(AddressSpec::SPECIAL_ADDRESS, false,
 			"urpf-failed", ""));
 			
-#line 4582 "PFCfgParser.cpp"
+#line 4661 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -4587,13 +4666,13 @@ void PFCfgParser::src_hosts_part() {
 		}
 		}
 		}
-#line 1148 "pf.g"
+#line 1159 "pf.g"
 		
 		importer->src_neg = importer->tmp_neg;
 		importer->src_group.splice(importer->src_group.begin(),
 		importer->tmp_group);
 		
-#line 4597 "PFCfgParser.cpp"
+#line 4676 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -4602,6 +4681,7 @@ void PFCfgParser::src_hosts_part() {
 }
 
 void PFCfgParser::src_port_part() {
+	Tracer traceInOut(this, "src_port_part");
 	
 	try {      // for error handling
 		match(PORT);
@@ -4629,12 +4709,12 @@ void PFCfgParser::src_port_part() {
 		}
 		}
 		}
-#line 1736 "pf.g"
+#line 1747 "pf.g"
 		
 		importer->src_port_group.splice(importer->src_port_group.begin(),
 		importer->tmp_port_group);
 		
-#line 4638 "PFCfgParser.cpp"
+#line 4718 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -4643,16 +4723,17 @@ void PFCfgParser::src_port_part() {
 }
 
 void PFCfgParser::dst_hosts_part() {
+	Tracer traceInOut(this, "dst_hosts_part");
 	
 	try {      // for error handling
 		common_hosts_part();
-#line 1157 "pf.g"
+#line 1168 "pf.g"
 		
 		importer->dst_neg = importer->tmp_neg;
 		importer->dst_group.splice(importer->dst_group.begin(),
 		importer->tmp_group);
 		
-#line 4656 "PFCfgParser.cpp"
+#line 4737 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -4661,6 +4742,7 @@ void PFCfgParser::dst_hosts_part() {
 }
 
 void PFCfgParser::dst_port_part() {
+	Tracer traceInOut(this, "dst_port_part");
 	
 	try {      // for error handling
 		match(PORT);
@@ -4688,12 +4770,12 @@ void PFCfgParser::dst_port_part() {
 		}
 		}
 		}
-#line 1749 "pf.g"
+#line 1760 "pf.g"
 		
 		importer->dst_port_group.splice(importer->dst_port_group.begin(),
 		importer->tmp_port_group);
 		
-#line 4697 "PFCfgParser.cpp"
+#line 4779 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -4702,29 +4784,30 @@ void PFCfgParser::dst_port_part() {
 }
 
 void PFCfgParser::common_hosts_part() {
+	Tracer traceInOut(this, "common_hosts_part");
 	
 	try {      // for error handling
 		switch ( LA(1)) {
 		case ANY:
 		{
 			match(ANY);
-#line 1166 "pf.g"
+#line 1177 "pf.g"
 			
 			importer->tmp_group.push_back(
 			AddressSpec(AddressSpec::ANY, false, "0.0.0.0", "0.0.0.0"));
 			
-#line 4717 "PFCfgParser.cpp"
+#line 4800 "PFCfgParser.cpp"
 			break;
 		}
 		case NO_ROUTE:
 		{
 			match(NO_ROUTE);
-#line 1172 "pf.g"
+#line 1183 "pf.g"
 			
 			importer->tmp_group.push_back(
 			AddressSpec(AddressSpec::SPECIAL_ADDRESS, false, "no-route", ""));
 			
-#line 4728 "PFCfgParser.cpp"
+#line 4811 "PFCfgParser.cpp"
 			break;
 		}
 		case WORD:
@@ -4756,11 +4839,12 @@ void PFCfgParser::common_hosts_part() {
 }
 
 void PFCfgParser::host() {
+	Tracer traceInOut(this, "host");
 	ANTLR_USE_NAMESPACE(antlr)RefToken  tn = ANTLR_USE_NAMESPACE(antlr)nullToken;
 	ANTLR_USE_NAMESPACE(antlr)RefToken  in = ANTLR_USE_NAMESPACE(antlr)nullToken;
-#line 1182 "pf.g"
+#line 1193 "pf.g"
 	AddressSpec as;
-#line 4764 "PFCfgParser.cpp"
+#line 4848 "PFCfgParser.cpp"
 	
 	try {      // for error handling
 		{
@@ -4768,9 +4852,9 @@ void PFCfgParser::host() {
 		case EXLAMATION:
 		{
 			match(EXLAMATION);
-#line 1183 "pf.g"
+#line 1194 "pf.g"
 			as.neg = true;
-#line 4774 "PFCfgParser.cpp"
+#line 4858 "PFCfgParser.cpp"
 			break;
 		}
 		case WORD:
@@ -4793,13 +4877,13 @@ void PFCfgParser::host() {
 		case WORD:
 		{
 			match(WORD);
-#line 1186 "pf.g"
+#line 1197 "pf.g"
 			
 			// interface name or domain/host name
 			as.at = AddressSpec::INTERFACE_OR_HOST_NAME;
 			as.address = LT(0)->getText();
 			
-#line 4803 "PFCfgParser.cpp"
+#line 4887 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case COLON:
@@ -4810,43 +4894,43 @@ void PFCfgParser::host() {
 				case NETWORK:
 				{
 					match(NETWORK);
-#line 1195 "pf.g"
+#line 1206 "pf.g"
 					
 					as.at = AddressSpec::INTERFACE_NETWORK;
 					
-#line 4818 "PFCfgParser.cpp"
+#line 4902 "PFCfgParser.cpp"
 					break;
 				}
 				case BROADCAST:
 				{
 					match(BROADCAST);
-#line 1200 "pf.g"
+#line 1211 "pf.g"
 					
 					as.at = AddressSpec::INTERFACE_BROADCAST;
 					
-#line 4828 "PFCfgParser.cpp"
+#line 4912 "PFCfgParser.cpp"
 					break;
 				}
 				case PEER:
 				{
 					match(PEER);
-#line 1205 "pf.g"
+#line 1216 "pf.g"
 					
 					importer->error_tracker->registerError(
 					QString("import of 'interface:peer' is not supported."));
 					
-#line 4839 "PFCfgParser.cpp"
+#line 4923 "PFCfgParser.cpp"
 					break;
 				}
 				case INT_CONST:
 				{
 					match(INT_CONST);
-#line 1211 "pf.g"
+#line 1222 "pf.g"
 					
 					importer->error_tracker->registerError(
 					QString("import of 'interface:0' is not supported."));
 					
-#line 4850 "PFCfgParser.cpp"
+#line 4934 "PFCfgParser.cpp"
 					break;
 				}
 				default:
@@ -4904,45 +4988,45 @@ void PFCfgParser::host() {
 		case SELF:
 		{
 			match(SELF);
-#line 1219 "pf.g"
+#line 1230 "pf.g"
 			
 			as.at = AddressSpec::SPECIAL_ADDRESS;
 			as.address = "self";
 			
-#line 4913 "PFCfgParser.cpp"
+#line 4997 "PFCfgParser.cpp"
 			break;
 		}
 		case IPV6:
 		{
 			match(IPV6);
-#line 1225 "pf.g"
+#line 1236 "pf.g"
 			
 			importer->error_tracker->registerError(
 			QString("IPv6 import is not supported. "));
 			consumeUntil(NEWLINE);
 			
-#line 4925 "PFCfgParser.cpp"
+#line 5009 "PFCfgParser.cpp"
 			break;
 		}
 		case IPV4:
 		{
 			match(IPV4);
-#line 1232 "pf.g"
+#line 1243 "pf.g"
 			
 			as.at = AddressSpec::HOST_ADDRESS;
 			as.address = LT(0)->getText();
 			
-#line 4936 "PFCfgParser.cpp"
+#line 5020 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case SLASH:
 			{
 				match(SLASH);
-#line 1238 "pf.g"
+#line 1249 "pf.g"
 				
 				as.at = AddressSpec::NETWORK_ADDRESS;
 				
-#line 4946 "PFCfgParser.cpp"
+#line 5030 "PFCfgParser.cpp"
 				{
 				switch ( LA(1)) {
 				case IPV4:
@@ -4961,11 +5045,11 @@ void PFCfgParser::host() {
 				}
 				}
 				}
-#line 1242 "pf.g"
+#line 1253 "pf.g"
 				
 				as.netmask = LT(0)->getText(); 
 				
-#line 4969 "PFCfgParser.cpp"
+#line 5053 "PFCfgParser.cpp"
 				break;
 			}
 			case NEWLINE:
@@ -5018,12 +5102,12 @@ void PFCfgParser::host() {
 			tn = LT(1);
 			match(WORD);
 			match(GREATER_THAN);
-#line 1248 "pf.g"
+#line 1259 "pf.g"
 			
 			as.at = AddressSpec::TABLE;
 			as.address = tn->getText();
 			
-#line 5027 "PFCfgParser.cpp"
+#line 5111 "PFCfgParser.cpp"
 			break;
 		}
 		case OPENING_PAREN:
@@ -5032,13 +5116,13 @@ void PFCfgParser::host() {
 			in = LT(1);
 			match(WORD);
 			match(CLOSING_PAREN);
-#line 1254 "pf.g"
+#line 1265 "pf.g"
 			
 			// interface name or domain/host name
 			as.at = AddressSpec::INTERFACE_OR_HOST_NAME;
 			as.address = in->getText();
 			
-#line 5042 "PFCfgParser.cpp"
+#line 5126 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -5047,11 +5131,11 @@ void PFCfgParser::host() {
 		}
 		}
 		}
-#line 1260 "pf.g"
+#line 1271 "pf.g"
 		
 		importer->tmp_group.push_back(as);
 		
-#line 5055 "PFCfgParser.cpp"
+#line 5139 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -5060,6 +5144,7 @@ void PFCfgParser::host() {
 }
 
 void PFCfgParser::host_list() {
+	Tracer traceInOut(this, "host_list");
 	
 	try {      // for error handling
 		match(OPENING_BRACE);
@@ -5108,6 +5193,7 @@ void PFCfgParser::host_list() {
 }
 
 void PFCfgParser::route_to() {
+	Tracer traceInOut(this, "route_to");
 	
 	try {      // for error handling
 		match(ROUTE_TO);
@@ -5129,11 +5215,11 @@ void PFCfgParser::route_to() {
 		}
 		}
 		}
-#line 1282 "pf.g"
+#line 1293 "pf.g"
 		
 		importer->route_type = PFImporter::ROUTE_TO;
 		
-#line 5137 "PFCfgParser.cpp"
+#line 5223 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -5142,6 +5228,7 @@ void PFCfgParser::route_to() {
 }
 
 void PFCfgParser::reply_to() {
+	Tracer traceInOut(this, "reply_to");
 	
 	try {      // for error handling
 		match(REPLY_TO);
@@ -5163,11 +5250,11 @@ void PFCfgParser::reply_to() {
 		}
 		}
 		}
-#line 1289 "pf.g"
+#line 1300 "pf.g"
 		
 		importer->route_type = PFImporter::REPLY_TO;
 		
-#line 5171 "PFCfgParser.cpp"
+#line 5258 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -5176,6 +5263,7 @@ void PFCfgParser::reply_to() {
 }
 
 void PFCfgParser::dup_to() {
+	Tracer traceInOut(this, "dup_to");
 	
 	try {      // for error handling
 		match(DUP_TO);
@@ -5197,11 +5285,11 @@ void PFCfgParser::dup_to() {
 		}
 		}
 		}
-#line 1296 "pf.g"
+#line 1307 "pf.g"
 		
 		importer->route_type = PFImporter::DUP_TO;
 		
-#line 5205 "PFCfgParser.cpp"
+#line 5293 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -5210,20 +5298,21 @@ void PFCfgParser::dup_to() {
 }
 
 void PFCfgParser::routehost() {
+	Tracer traceInOut(this, "routehost");
 	ANTLR_USE_NAMESPACE(antlr)RefToken  h = ANTLR_USE_NAMESPACE(antlr)nullToken;
 	ANTLR_USE_NAMESPACE(antlr)RefToken  v6 = ANTLR_USE_NAMESPACE(antlr)nullToken;
 	ANTLR_USE_NAMESPACE(antlr)RefToken  nm = ANTLR_USE_NAMESPACE(antlr)nullToken;
 	ANTLR_USE_NAMESPACE(antlr)RefToken  nm6 = ANTLR_USE_NAMESPACE(antlr)nullToken;
-#line 1301 "pf.g"
+#line 1312 "pf.g"
 	RouteSpec rs;
-#line 5220 "PFCfgParser.cpp"
+#line 5309 "PFCfgParser.cpp"
 	
 	try {      // for error handling
 		match(OPENING_PAREN);
 		match(WORD);
-#line 1303 "pf.g"
+#line 1314 "pf.g"
 		rs.iface = LT(0)->getText();
-#line 5227 "PFCfgParser.cpp"
+#line 5316 "PFCfgParser.cpp"
 		{
 		switch ( LA(1)) {
 		case IPV4:
@@ -5281,7 +5370,7 @@ void PFCfgParser::routehost() {
 		}
 		}
 		}
-#line 1305 "pf.g"
+#line 1316 "pf.g"
 		
 		if (v6)
 		{
@@ -5295,7 +5384,7 @@ void PFCfgParser::routehost() {
 		importer->route_group.push_back(rs);
 		}
 		
-#line 5299 "PFCfgParser.cpp"
+#line 5388 "PFCfgParser.cpp"
 		match(CLOSING_PAREN);
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -5305,6 +5394,7 @@ void PFCfgParser::routehost() {
 }
 
 void PFCfgParser::routehost_list() {
+	Tracer traceInOut(this, "routehost_list");
 	
 	try {      // for error handling
 		match(OPENING_BRACE);
@@ -5347,6 +5437,7 @@ void PFCfgParser::routehost_list() {
 }
 
 void PFCfgParser::filteropt() {
+	Tracer traceInOut(this, "filteropt");
 	
 	try {      // for error handling
 		switch ( LA(1)) {
@@ -5433,6 +5524,7 @@ void PFCfgParser::filteropt() {
 }
 
 void PFCfgParser::user_match() {
+	Tracer traceInOut(this, "user_match");
 	
 	try {      // for error handling
 		match(USER);
@@ -5459,12 +5551,12 @@ void PFCfgParser::user_match() {
 		}
 		}
 		}
-#line 1370 "pf.g"
+#line 1381 "pf.g"
 		
 		importer->addMessageToLog(
 		QString("Error: import of 'user' match is not supported."));
 		
-#line 5468 "PFCfgParser.cpp"
+#line 5560 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -5473,6 +5565,7 @@ void PFCfgParser::user_match() {
 }
 
 void PFCfgParser::group_match() {
+	Tracer traceInOut(this, "group_match");
 	
 	try {      // for error handling
 		match(GROUP);
@@ -5499,12 +5592,12 @@ void PFCfgParser::group_match() {
 		}
 		}
 		}
-#line 1379 "pf.g"
+#line 1390 "pf.g"
 		
 		importer->addMessageToLog(
 		QString("Error: import of 'group' match is not supported."));
 		
-#line 5508 "PFCfgParser.cpp"
+#line 5601 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -5513,6 +5606,7 @@ void PFCfgParser::group_match() {
 }
 
 void PFCfgParser::tcp_flags() {
+	Tracer traceInOut(this, "tcp_flags");
 	ANTLR_USE_NAMESPACE(antlr)RefToken  check = ANTLR_USE_NAMESPACE(antlr)nullToken;
 	ANTLR_USE_NAMESPACE(antlr)RefToken  mask = ANTLR_USE_NAMESPACE(antlr)nullToken;
 	
@@ -5523,12 +5617,12 @@ void PFCfgParser::tcp_flags() {
 		case ANY:
 		{
 			match(ANY);
-#line 1489 "pf.g"
+#line 1500 "pf.g"
 			
 			importer->flags_check = "none";
 			importer->flags_mask = "none";
 			
-#line 5532 "PFCfgParser.cpp"
+#line 5626 "PFCfgParser.cpp"
 			break;
 		}
 		case WORD:
@@ -5594,7 +5688,7 @@ void PFCfgParser::tcp_flags() {
 			}
 			}
 			}
-#line 1495 "pf.g"
+#line 1506 "pf.g"
 			
 			if (check)
 			importer->flags_check = check->getText();
@@ -5605,7 +5699,7 @@ void PFCfgParser::tcp_flags() {
 			else
 			importer->flags_mask = "all";
 			
-#line 5609 "PFCfgParser.cpp"
+#line 5703 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -5622,6 +5716,7 @@ void PFCfgParser::tcp_flags() {
 }
 
 void PFCfgParser::icmp_type() {
+	Tracer traceInOut(this, "icmp_type");
 	
 	try {      // for error handling
 		match(ICMP_TYPE);
@@ -5676,16 +5771,17 @@ void PFCfgParser::icmp_type() {
 }
 
 void PFCfgParser::icmp6_type() {
+	Tracer traceInOut(this, "icmp6_type");
 	
 	try {      // for error handling
 		match(ICMP6_TYPE);
-#line 1670 "pf.g"
+#line 1681 "pf.g"
 		
 		importer->error_tracker->registerError(
 		QString("ICMP6 import is not supported. "));
 		consumeUntil(NEWLINE);
 		
-#line 5689 "PFCfgParser.cpp"
+#line 5785 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -5694,6 +5790,7 @@ void PFCfgParser::icmp6_type() {
 }
 
 void PFCfgParser::state() {
+	Tracer traceInOut(this, "state");
 	
 	try {      // for error handling
 		{
@@ -5724,11 +5821,11 @@ void PFCfgParser::state() {
 		}
 		}
 		}
-#line 1702 "pf.g"
+#line 1713 "pf.g"
 		
 		importer->state_op = LT(0)->getText();
 		
-#line 5732 "PFCfgParser.cpp"
+#line 5829 "PFCfgParser.cpp"
 		match(STATE);
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -5738,6 +5835,7 @@ void PFCfgParser::state() {
 }
 
 void PFCfgParser::queue() {
+	Tracer traceInOut(this, "queue");
 	
 	try {      // for error handling
 		match(QUEUE);
@@ -5746,29 +5844,29 @@ void PFCfgParser::queue() {
 		case WORD:
 		{
 			match(WORD);
-#line 1711 "pf.g"
+#line 1722 "pf.g"
 			importer->queue += LT(0)->getText();
-#line 5752 "PFCfgParser.cpp"
+#line 5850 "PFCfgParser.cpp"
 			break;
 		}
 		case OPENING_PAREN:
 		{
 			match(OPENING_PAREN);
 			match(WORD);
-#line 1714 "pf.g"
+#line 1725 "pf.g"
 			importer->queue += LT(0)->getText();
-#line 5761 "PFCfgParser.cpp"
+#line 5859 "PFCfgParser.cpp"
 			{ // ( ... )*
 			for (;;) {
 				if ((LA(1) == COMMA)) {
 					match(COMMA);
-#line 1716 "pf.g"
+#line 1727 "pf.g"
 					importer->queue += ",";
-#line 5768 "PFCfgParser.cpp"
+#line 5866 "PFCfgParser.cpp"
 					match(WORD);
-#line 1717 "pf.g"
+#line 1728 "pf.g"
 					importer->queue += LT(0)->getText();
-#line 5772 "PFCfgParser.cpp"
+#line 5870 "PFCfgParser.cpp"
 				}
 				else {
 					goto _loop255;
@@ -5794,6 +5892,7 @@ void PFCfgParser::queue() {
 }
 
 void PFCfgParser::label() {
+	Tracer traceInOut(this, "label");
 	
 	try {      // for error handling
 		match(LABEL);
@@ -5806,6 +5905,7 @@ void PFCfgParser::label() {
 }
 
 void PFCfgParser::match_rule_scrub_options() {
+	Tracer traceInOut(this, "match_rule_scrub_options");
 	
 	try {      // for error handling
 		match(SCRUB);
@@ -5818,6 +5918,7 @@ void PFCfgParser::match_rule_scrub_options() {
 }
 
 void PFCfgParser::scrub_options() {
+	Tracer traceInOut(this, "scrub_options");
 	
 	try {      // for error handling
 		{
@@ -5851,6 +5952,7 @@ void PFCfgParser::scrub_options() {
 }
 
 void PFCfgParser::user_group_op() {
+	Tracer traceInOut(this, "user_group_op");
 	
 	try {      // for error handling
 		{
@@ -5947,6 +6049,7 @@ void PFCfgParser::user_group_op() {
 }
 
 void PFCfgParser::user_group_op_list() {
+	Tracer traceInOut(this, "user_group_op_list");
 	
 	try {      // for error handling
 		match(OPENING_BRACE);
@@ -5994,6 +6097,7 @@ void PFCfgParser::user_group_op_list() {
 }
 
 void PFCfgParser::unary_op() {
+	Tracer traceInOut(this, "unary_op");
 	
 	try {      // for error handling
 		{
@@ -6001,46 +6105,46 @@ void PFCfgParser::unary_op() {
 		case EQUAL:
 		{
 			match(EQUAL);
-#line 1757 "pf.g"
+#line 1768 "pf.g"
 			importer->tmp_port_op = "=";
-#line 6007 "PFCfgParser.cpp"
+#line 6111 "PFCfgParser.cpp"
 			break;
 		}
 		case EXLAMATION:
 		{
 			match(EXLAMATION);
 			match(EQUAL);
-#line 1759 "pf.g"
+#line 1770 "pf.g"
 			importer->tmp_port_op = "!=";
-#line 6016 "PFCfgParser.cpp"
+#line 6120 "PFCfgParser.cpp"
 			break;
 		}
 		default:
 			if ((LA(1) == LESS_THAN) && (LA(2) == WORD || LA(2) == INT_CONST)) {
 				match(LESS_THAN);
-#line 1761 "pf.g"
+#line 1772 "pf.g"
 				importer->tmp_port_op = "<";
-#line 6024 "PFCfgParser.cpp"
+#line 6128 "PFCfgParser.cpp"
 			}
 			else if ((LA(1) == LESS_THAN) && (LA(2) == EQUAL)) {
 				match(LESS_THAN);
 				match(EQUAL);
-#line 1763 "pf.g"
+#line 1774 "pf.g"
 				importer->tmp_port_op = "<=";
-#line 6031 "PFCfgParser.cpp"
+#line 6135 "PFCfgParser.cpp"
 			}
 			else if ((LA(1) == GREATER_THAN) && (LA(2) == WORD || LA(2) == INT_CONST)) {
 				match(GREATER_THAN);
-#line 1765 "pf.g"
+#line 1776 "pf.g"
 				importer->tmp_port_op = ">";
-#line 6037 "PFCfgParser.cpp"
+#line 6141 "PFCfgParser.cpp"
 			}
 			else if ((LA(1) == GREATER_THAN) && (LA(2) == EQUAL)) {
 				match(GREATER_THAN);
 				match(EQUAL);
-#line 1767 "pf.g"
+#line 1778 "pf.g"
 				importer->tmp_port_op = ">=";
-#line 6044 "PFCfgParser.cpp"
+#line 6148 "PFCfgParser.cpp"
 			}
 		else {
 			throw ANTLR_USE_NAMESPACE(antlr)NoViableAltException(LT(1), getFilename());
@@ -6055,6 +6159,7 @@ void PFCfgParser::unary_op() {
 }
 
 void PFCfgParser::binary_op() {
+	Tracer traceInOut(this, "binary_op");
 	
 	try {      // for error handling
 		{
@@ -6063,26 +6168,26 @@ void PFCfgParser::binary_op() {
 		{
 			match(LESS_THAN);
 			match(GREATER_THAN);
-#line 1773 "pf.g"
+#line 1784 "pf.g"
 			importer->tmp_port_op = "<>";
-#line 6069 "PFCfgParser.cpp"
+#line 6174 "PFCfgParser.cpp"
 			break;
 		}
 		case GREATER_THAN:
 		{
 			match(GREATER_THAN);
 			match(LESS_THAN);
-#line 1775 "pf.g"
+#line 1786 "pf.g"
 			importer->tmp_port_op = "><";
-#line 6078 "PFCfgParser.cpp"
+#line 6183 "PFCfgParser.cpp"
 			break;
 		}
 		case COLON:
 		{
 			match(COLON);
-#line 1777 "pf.g"
+#line 1788 "pf.g"
 			importer->tmp_port_op = ":";
-#line 6086 "PFCfgParser.cpp"
+#line 6191 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -6099,6 +6204,7 @@ void PFCfgParser::binary_op() {
 }
 
 void PFCfgParser::scrub_option() {
+	Tracer traceInOut(this, "scrub_option");
 	
 	try {      // for error handling
 		{
@@ -6129,76 +6235,76 @@ void PFCfgParser::scrub_option() {
 			}
 			}
 			}
-#line 1441 "pf.g"
+#line 1452 "pf.g"
 			
 			importer->scrub_options.push_back(
 			str_tuple("fragment", LT(0)->getText()));
 			importer->scrub_rule = true;
 			
-#line 6139 "PFCfgParser.cpp"
+#line 6245 "PFCfgParser.cpp"
 			break;
 		}
 		case LITERAL_reassemble:
 		{
 			match(LITERAL_reassemble);
 			match(TCP);
-#line 1448 "pf.g"
+#line 1459 "pf.g"
 			
 			importer->scrub_options.push_back(
 			str_tuple("reassemble", "tcp"));
 			importer->scrub_rule = true;
 			
-#line 6152 "PFCfgParser.cpp"
+#line 6258 "PFCfgParser.cpp"
 			break;
 		}
 		case 145:
 		{
 			match(145);
-#line 1455 "pf.g"
+#line 1466 "pf.g"
 			
 			importer->scrub_options.push_back(
 			str_tuple(LT(0)->getText(), ""));
 			importer->scrub_rule = true;
 			
-#line 6164 "PFCfgParser.cpp"
+#line 6270 "PFCfgParser.cpp"
 			break;
 		}
 		case 146:
 		{
 			match(146);
 			match(INT_CONST);
-#line 1462 "pf.g"
+#line 1473 "pf.g"
 			
 			importer->scrub_options.push_back(
 			str_tuple("min-ttl", LT(0)->getText()));
 			importer->scrub_rule = true;
 			
-#line 6177 "PFCfgParser.cpp"
+#line 6283 "PFCfgParser.cpp"
 			break;
 		}
 		case 147:
 		{
 			match(147);
 			match(INT_CONST);
-#line 1469 "pf.g"
+#line 1480 "pf.g"
 			
 			importer->scrub_options.push_back(
 			str_tuple("max-mss", LT(0)->getText()));
 			importer->scrub_rule = true;
 			
-#line 6190 "PFCfgParser.cpp"
+#line 6296 "PFCfgParser.cpp"
 			break;
 		}
 		case 148:
 		{
 			match(148);
-#line 1476 "pf.g"
+#line 1487 "pf.g"
 			
 			importer->scrub_options.push_back(
 			str_tuple(LT(0)->getText(), ""));
 			importer->scrub_rule = true;
 			
-#line 6202 "PFCfgParser.cpp"
+#line 6308 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -6215,6 +6321,7 @@ void PFCfgParser::scrub_option() {
 }
 
 void PFCfgParser::scrub_option_list() {
+	Tracer traceInOut(this, "scrub_option_list");
 	
 	try {      // for error handling
 		match(OPENING_PAREN);
@@ -6262,9 +6369,10 @@ void PFCfgParser::scrub_option_list() {
 }
 
 void PFCfgParser::icmp_type_code() {
-#line 1517 "pf.g"
+	Tracer traceInOut(this, "icmp_type_code");
+#line 1528 "pf.g"
 	IcmpSpec is;
-#line 6268 "PFCfgParser.cpp"
+#line 6376 "PFCfgParser.cpp"
 	
 	try {      // for error handling
 		{
@@ -6296,17 +6404,17 @@ void PFCfgParser::icmp_type_code() {
 		case LITERAL_photuris:
 		{
 			icmp_type_by_name();
-#line 1519 "pf.g"
+#line 1530 "pf.g"
 			is.icmp_type_name = LT(0)->getText();
-#line 6302 "PFCfgParser.cpp"
+#line 6410 "PFCfgParser.cpp"
 			break;
 		}
 		case INT_CONST:
 		{
 			match(INT_CONST);
-#line 1521 "pf.g"
+#line 1532 "pf.g"
 			is.icmp_type_int = LT(0)->getText();
-#line 6310 "PFCfgParser.cpp"
+#line 6418 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -6354,17 +6462,17 @@ void PFCfgParser::icmp_type_code() {
 			case 205:
 			{
 				icmp_code_by_name();
-#line 1527 "pf.g"
+#line 1538 "pf.g"
 				is.icmp_code_name = LT(0)->getText();
-#line 6360 "PFCfgParser.cpp"
+#line 6468 "PFCfgParser.cpp"
 				break;
 			}
 			case INT_CONST:
 			{
 				match(INT_CONST);
-#line 1529 "pf.g"
+#line 1540 "pf.g"
 				is.icmp_code_int = LT(0)->getText();
-#line 6368 "PFCfgParser.cpp"
+#line 6476 "PFCfgParser.cpp"
 				break;
 			}
 			default:
@@ -6435,11 +6543,11 @@ void PFCfgParser::icmp_type_code() {
 		}
 		}
 		}
-#line 1532 "pf.g"
+#line 1543 "pf.g"
 		
 		importer->icmp_type_code_group.push_back(is);
 		
-#line 6443 "PFCfgParser.cpp"
+#line 6551 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -6448,6 +6556,7 @@ void PFCfgParser::icmp_type_code() {
 }
 
 void PFCfgParser::icmp_list() {
+	Tracer traceInOut(this, "icmp_list");
 	
 	try {      // for error handling
 		match(OPENING_BRACE);
@@ -6515,6 +6624,7 @@ void PFCfgParser::icmp_list() {
 }
 
 void PFCfgParser::icmp_type_by_name() {
+	Tracer traceInOut(this, "icmp_type_by_name");
 	
 	try {      // for error handling
 		{
@@ -6658,9 +6768,10 @@ void PFCfgParser::icmp_type_by_name() {
 }
 
 void PFCfgParser::port_op() {
-#line 1783 "pf.g"
+	Tracer traceInOut(this, "port_op");
+#line 1794 "pf.g"
 	PortSpec ps;
-#line 6664 "PFCfgParser.cpp"
+#line 6775 "PFCfgParser.cpp"
 	
 	try {      // for error handling
 		{
@@ -6671,39 +6782,39 @@ void PFCfgParser::port_op() {
 		case EXLAMATION:
 		{
 			unary_op();
-#line 1785 "pf.g"
+#line 1796 "pf.g"
 			ps.port_op = importer->tmp_port_op;
-#line 6677 "PFCfgParser.cpp"
+#line 6788 "PFCfgParser.cpp"
 			port_def();
-#line 1787 "pf.g"
+#line 1798 "pf.g"
 			
 			ps.port1 = importer->tmp_port_def;
 			ps.port2 = importer->tmp_port_def;
 			
-#line 6684 "PFCfgParser.cpp"
+#line 6795 "PFCfgParser.cpp"
 			break;
 		}
 		case WORD:
 		case INT_CONST:
 		{
 			port_def();
-#line 1793 "pf.g"
+#line 1804 "pf.g"
 			
 			ps.port1 = importer->tmp_port_def;
 			ps.port2 = ps.port1;
 			ps.port_op = "=";
 			
-#line 6697 "PFCfgParser.cpp"
+#line 6808 "PFCfgParser.cpp"
 			{
 			if ((LA(1) == LESS_THAN || LA(1) == GREATER_THAN || LA(1) == COLON) && (_tokenSet_48.member(LA(2)))) {
 				binary_op();
-#line 1799 "pf.g"
+#line 1810 "pf.g"
 				ps.port_op = importer->tmp_port_op;
-#line 6703 "PFCfgParser.cpp"
+#line 6814 "PFCfgParser.cpp"
 				port_def();
-#line 1800 "pf.g"
+#line 1811 "pf.g"
 				ps.port2 = LT(0)->getText();
-#line 6707 "PFCfgParser.cpp"
+#line 6818 "PFCfgParser.cpp"
 			}
 			else if ((_tokenSet_58.member(LA(1))) && (_tokenSet_59.member(LA(2)))) {
 			}
@@ -6717,11 +6828,11 @@ void PFCfgParser::port_op() {
 		case IPV6:
 		{
 			match(IPV6);
-#line 1804 "pf.g"
+#line 1815 "pf.g"
 			
 			ps.setFromPortRange(LT(0)->getText());
 			
-#line 6725 "PFCfgParser.cpp"
+#line 6836 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -6730,11 +6841,11 @@ void PFCfgParser::port_op() {
 		}
 		}
 		}
-#line 1808 "pf.g"
+#line 1819 "pf.g"
 		
 		importer->tmp_port_group.push_back(ps);
 		
-#line 6738 "PFCfgParser.cpp"
+#line 6849 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -6743,6 +6854,7 @@ void PFCfgParser::port_op() {
 }
 
 void PFCfgParser::port_op_list() {
+	Tracer traceInOut(this, "port_op_list");
 	
 	try {      // for error handling
 		match(OPENING_BRACE);
@@ -6799,7 +6911,7 @@ const char* PFCfgParser::tokenNames[] = {
 	"<2>",
 	"NULL_TREE_LOOKAHEAD",
 	"NEWLINE",
-	"LINE_COMMENT",
+	"COMMENT_START",
 	"\"include\"",
 	"WORD",
 	"EQUAL",
@@ -7041,7 +7153,6 @@ const char* PFCfgParser::tokenNames[] = {
 	"NUM_HEX_4DIGIT",
 	"NUMBER_ADDRESS_OR_WORD",
 	"PIPE_CHAR",
-	"NUMBER_SIGN",
 	"PERCENT",
 	"AMPERSAND",
 	"APOSTROPHE",
@@ -7063,19 +7174,19 @@ const unsigned long PFCfgParser::_tokenSet_0_data_[] = { 2UL, 0UL, 0UL, 0UL, 0UL
 // EOF 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_0(_tokenSet_0_data_,10);
 const unsigned long PFCfgParser::_tokenSet_1_data_[] = { 7922UL, 0UL, 40894478UL, 192UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
-// EOF NEWLINE LINE_COMMENT "include" WORD "antispoof" "altq" "queue" "set" 
-// "scrub" "match" "table" "no" "nat" "pass" "rdr" "binat" "block" 
+// EOF NEWLINE COMMENT_START "include" WORD "antispoof" "altq" "queue" 
+// "set" "scrub" "match" "table" "no" "nat" "pass" "rdr" "binat" "block" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_1(_tokenSet_1_data_,10);
 const unsigned long PFCfgParser::_tokenSet_2_data_[] = { 128UL, 134217736UL, 460800UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // WORD COMMA INT_CONST EXLAMATION "self" IPV4 NUMBER 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_2(_tokenSet_2_data_,10);
 const unsigned long PFCfgParser::_tokenSet_3_data_[] = { 7922UL, 134217496UL, 40894478UL, 192UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
-// EOF NEWLINE LINE_COMMENT "include" WORD "antispoof" "altq" "queue" "set" 
-// COMMA CLOSING_BRACE "tcp.first" "tcp.opening" "tcp.established" "tcp.closing" 
-// "tcp.finwait" "tcp.closed" "udp.first" "udp.single" "udp.multiple" "icmp.first" 
-// "icmp.error" "other.first" "other.single" "other.multiple" "frag" "interval" 
-// "src.track" "adaptive.start" "adaptive.end" "scrub" "match" "table" 
-// "no" "nat" "pass" "rdr" "binat" "block" 
+// EOF NEWLINE COMMENT_START "include" WORD "antispoof" "altq" "queue" 
+// "set" COMMA CLOSING_BRACE "tcp.first" "tcp.opening" "tcp.established" 
+// "tcp.closing" "tcp.finwait" "tcp.closed" "udp.first" "udp.single" "udp.multiple" 
+// "icmp.first" "icmp.error" "other.first" "other.single" "other.multiple" 
+// "frag" "interval" "src.track" "adaptive.start" "adaptive.end" "scrub" 
+// "match" "table" "no" "nat" "pass" "rdr" "binat" "block" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_3(_tokenSet_3_data_,10);
 const unsigned long PFCfgParser::_tokenSet_4_data_[] = { 0UL, 134217480UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // COMMA "tcp.first" "tcp.opening" "tcp.established" "tcp.closing" "tcp.finwait" 
@@ -7084,8 +7195,8 @@ const unsigned long PFCfgParser::_tokenSet_4_data_[] = { 0UL, 134217480UL, 0UL,
 // "adaptive.start" "adaptive.end" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_4(_tokenSet_4_data_,10);
 const unsigned long PFCfgParser::_tokenSet_5_data_[] = { 7922UL, 4026531864UL, 40894479UL, 192UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
-// EOF NEWLINE LINE_COMMENT "include" WORD "antispoof" "altq" "queue" "set" 
-// COMMA CLOSING_BRACE "frags" "states" "src-nodes" "tables" "tables-entries" 
+// EOF NEWLINE COMMENT_START "include" WORD "antispoof" "altq" "queue" 
+// "set" COMMA CLOSING_BRACE "frags" "states" "src-nodes" "tables" "tables-entries" 
 // "scrub" "match" "table" "no" "nat" "pass" "rdr" "binat" "block" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_5(_tokenSet_5_data_,10);
 const unsigned long PFCfgParser::_tokenSet_6_data_[] = { 0UL, 4026531848UL, 1UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
@@ -7098,7 +7209,7 @@ const unsigned long PFCfgParser::_tokenSet_7_data_[] = { 2064UL, 64UL, 68159490U
 // "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_7(_tokenSet_7_data_,16);
 const unsigned long PFCfgParser::_tokenSet_8_data_[] = { 8178UL, 134217805UL, 645598270UL, 33685696UL, 4286571392UL, 65535UL, 4177920UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
-// EOF NEWLINE LINE_COMMENT "include" WORD EQUAL "antispoof" "altq" "queue" 
+// EOF NEWLINE COMMENT_START "include" WORD EQUAL "antispoof" "altq" "queue" 
 // "set" "skip" OPENING_BRACE COMMA "reassemble" INT_CONST "scrub" "match" 
 // "table" LESS_THAN GREATER_THAN STRING EXLAMATION "self" IPV4 SLASH "no" 
 // "nat" "pass" "rdr" OPENING_PAREN IPV6 "binat" "block" "user" "tcp" "urpf-failed" 
@@ -7116,7 +7227,7 @@ const unsigned long PFCfgParser::_tokenSet_9_data_[] = { 2064UL, 64UL, 68159490U
 // "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_9(_tokenSet_9_data_,16);
 const unsigned long PFCfgParser::_tokenSet_10_data_[] = { 8178UL, 134217805UL, 108530750UL, 33685696UL, 4286570752UL, 65535UL, 4177920UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
-// EOF NEWLINE LINE_COMMENT "include" WORD EQUAL "antispoof" "altq" "queue" 
+// EOF NEWLINE COMMENT_START "include" WORD EQUAL "antispoof" "altq" "queue" 
 // "set" "skip" OPENING_BRACE COMMA "reassemble" INT_CONST "scrub" "match" 
 // "table" LESS_THAN GREATER_THAN STRING EXLAMATION SLASH "no" "nat" "pass" 
 // "rdr" OPENING_PAREN "binat" "block" "user" "tcp" "any" "group" "fragment" 
@@ -7208,7 +7319,7 @@ const unsigned long PFCfgParser::_tokenSet_26_data_[] = { 2064UL, 66UL, 68159490
 // "keep" "modulate" "synproxy" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_26(_tokenSet_26_data_,16);
 const unsigned long PFCfgParser::_tokenSet_27_data_[] = { 8178UL, 134217807UL, 645598270UL, 4294951104UL, 4286578687UL, 65535UL, 4177920UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
-// EOF NEWLINE LINE_COMMENT "include" WORD EQUAL "antispoof" "altq" "queue" 
+// EOF NEWLINE COMMENT_START "include" WORD EQUAL "antispoof" "altq" "queue" 
 // "set" "skip" "on" OPENING_BRACE COMMA "reassemble" INT_CONST "scrub" 
 // "match" "table" LESS_THAN GREATER_THAN STRING EXLAMATION "self" IPV4 
 // SLASH "no" "nat" "pass" "rdr" OPENING_PAREN IPV6 "binat" "block" "log" 
@@ -7247,7 +7358,7 @@ const unsigned long PFCfgParser::_tokenSet_30_data_[] = { 2064UL, 66UL, 68159490
 // "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_30(_tokenSet_30_data_,16);
 const unsigned long PFCfgParser::_tokenSet_31_data_[] = { 8178UL, 134217807UL, 645598270UL, 4294901952UL, 4286578687UL, 65535UL, 4177920UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
-// EOF NEWLINE LINE_COMMENT "include" WORD EQUAL "antispoof" "altq" "queue" 
+// EOF NEWLINE COMMENT_START "include" WORD EQUAL "antispoof" "altq" "queue" 
 // "set" "skip" "on" OPENING_BRACE COMMA "reassemble" INT_CONST "scrub" 
 // "match" "table" LESS_THAN GREATER_THAN STRING EXLAMATION "self" IPV4 
 // SLASH "no" "nat" "pass" "rdr" OPENING_PAREN IPV6 "binat" "block" "all" 
@@ -7269,7 +7380,7 @@ const unsigned long PFCfgParser::_tokenSet_32_data_[] = { 2064UL, 66UL, 68159490
 // "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_32(_tokenSet_32_data_,16);
 const unsigned long PFCfgParser::_tokenSet_33_data_[] = { 8178UL, 134217805UL, 645598270UL, 4293329088UL, 4286571519UL, 65535UL, 4177920UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
-// EOF NEWLINE LINE_COMMENT "include" WORD EQUAL "antispoof" "altq" "queue" 
+// EOF NEWLINE COMMENT_START "include" WORD EQUAL "antispoof" "altq" "queue" 
 // "set" "skip" OPENING_BRACE COMMA "reassemble" INT_CONST "scrub" "match" 
 // "table" LESS_THAN GREATER_THAN STRING EXLAMATION "self" IPV4 SLASH "no" 
 // "nat" "pass" "rdr" OPENING_PAREN IPV6 "binat" "block" "all" "user" "to" 
@@ -7371,7 +7482,7 @@ const unsigned long PFCfgParser::_tokenSet_49_data_[] = { 2448UL, 134217816UL, 6
 // "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_49(_tokenSet_49_data_,16);
 const unsigned long PFCfgParser::_tokenSet_50_data_[] = { 8178UL, 134217821UL, 108534846UL, 33685696UL, 4286570752UL, 65535UL, 4177920UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
-// EOF NEWLINE LINE_COMMENT "include" WORD EQUAL "antispoof" "altq" "queue" 
+// EOF NEWLINE COMMENT_START "include" WORD EQUAL "antispoof" "altq" "queue" 
 // "set" "skip" OPENING_BRACE COMMA CLOSING_BRACE "reassemble" INT_CONST 
 // "scrub" "match" "table" LESS_THAN GREATER_THAN STRING EXLAMATION COLON 
 // SLASH "no" "nat" "pass" "rdr" OPENING_PAREN "binat" "block" "user" "tcp" 
@@ -7431,7 +7542,7 @@ const unsigned long PFCfgParser::_tokenSet_58_data_[] = { 2448UL, 134217816UL, 6
 // "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_58(_tokenSet_58_data_,16);
 const unsigned long PFCfgParser::_tokenSet_59_data_[] = { 8178UL, 134217821UL, 653990974UL, 33947840UL, 4286571264UL, 65535UL, 4177920UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
-// EOF NEWLINE LINE_COMMENT "include" WORD EQUAL "antispoof" "altq" "queue" 
+// EOF NEWLINE COMMENT_START "include" WORD EQUAL "antispoof" "altq" "queue" 
 // "set" "skip" OPENING_BRACE COMMA CLOSING_BRACE "reassemble" INT_CONST 
 // "scrub" "match" "table" LESS_THAN GREATER_THAN STRING EXLAMATION COLON 
 // "self" IPV4 SLASH "no" "nat" "pass" MINUS "rdr" OPENING_PAREN IPV6 "binat" 
diff --git a/src/parsers/PFCfgParser.hpp b/src/parsers/PFCfgParser.hpp
index 0b5fe4ec3..85670849a 100644
--- a/src/parsers/PFCfgParser.hpp
+++ b/src/parsers/PFCfgParser.hpp
@@ -201,10 +201,10 @@ protected:
 private:
 	static const char* tokenNames[];
 #ifndef NO_STATIC_CONSTS
-	static const int NUM_TOKENS = 262;
+	static const int NUM_TOKENS = 261;
 #else
 	enum {
-		NUM_TOKENS = 262
+		NUM_TOKENS = 261
 	};
 #endif
 	
diff --git a/src/parsers/PFCfgParserTokenTypes.hpp b/src/parsers/PFCfgParserTokenTypes.hpp
index 221b7acec..107d29e36 100644
--- a/src/parsers/PFCfgParserTokenTypes.hpp
+++ b/src/parsers/PFCfgParserTokenTypes.hpp
@@ -13,7 +13,7 @@ struct CUSTOM_API PFCfgParserTokenTypes {
 	enum {
 		EOF_ = 1,
 		NEWLINE = 4,
-		LINE_COMMENT = 5,
+		COMMENT_START = 5,
 		INCLUDE_COMMAND = 6,
 		WORD = 7,
 		EQUAL = 8,
@@ -255,21 +255,20 @@ struct CUSTOM_API PFCfgParserTokenTypes {
 		NUM_HEX_4DIGIT = 244,
 		NUMBER_ADDRESS_OR_WORD = 245,
 		PIPE_CHAR = 246,
-		NUMBER_SIGN = 247,
-		PERCENT = 248,
-		AMPERSAND = 249,
-		APOSTROPHE = 250,
-		PLUS = 251,
-		DOT = 252,
-		SEMICOLON = 253,
-		QUESTION = 254,
-		COMMERCIAL_AT = 255,
-		OPENING_SQUARE = 256,
-		CLOSING_SQUARE = 257,
-		CARET = 258,
-		UNDERLINE = 259,
-		TILDE = 260,
-		DOUBLE_QUOTE = 261,
+		PERCENT = 247,
+		AMPERSAND = 248,
+		APOSTROPHE = 249,
+		PLUS = 250,
+		DOT = 251,
+		SEMICOLON = 252,
+		QUESTION = 253,
+		COMMERCIAL_AT = 254,
+		OPENING_SQUARE = 255,
+		CLOSING_SQUARE = 256,
+		CARET = 257,
+		UNDERLINE = 258,
+		TILDE = 259,
+		DOUBLE_QUOTE = 260,
 		NULL_TREE_LOOKAHEAD = 3
 	};
 #ifdef __cplusplus
diff --git a/src/parsers/PFCfgParserTokenTypes.txt b/src/parsers/PFCfgParserTokenTypes.txt
index 55eb57e32..c59b573c1 100644
--- a/src/parsers/PFCfgParserTokenTypes.txt
+++ b/src/parsers/PFCfgParserTokenTypes.txt
@@ -1,7 +1,7 @@
 // $ANTLR 2.7.7 (20100319): pf.g -> PFCfgParserTokenTypes.txt$
 PFCfgParser    // output token vocab name
 NEWLINE=4
-LINE_COMMENT=5
+COMMENT_START=5
 INCLUDE_COMMAND="include"=6
 WORD=7
 EQUAL=8
@@ -243,18 +243,17 @@ NUM_3DIGIT=243
 NUM_HEX_4DIGIT=244
 NUMBER_ADDRESS_OR_WORD=245
 PIPE_CHAR=246
-NUMBER_SIGN=247
-PERCENT=248
-AMPERSAND=249
-APOSTROPHE=250
-PLUS=251
-DOT=252
-SEMICOLON=253
-QUESTION=254
-COMMERCIAL_AT=255
-OPENING_SQUARE=256
-CLOSING_SQUARE=257
-CARET=258
-UNDERLINE=259
-TILDE=260
-DOUBLE_QUOTE=261
+PERCENT=247
+AMPERSAND=248
+APOSTROPHE=249
+PLUS=250
+DOT=251
+SEMICOLON=252
+QUESTION=253
+COMMERCIAL_AT=254
+OPENING_SQUARE=255
+CLOSING_SQUARE=256
+CARET=257
+UNDERLINE=258
+TILDE=259
+DOUBLE_QUOTE=260
diff --git a/src/parsers/pf.g b/src/parsers/pf.g
index ec37d18ef..4e4fdb368 100644
--- a/src/parsers/pf.g
+++ b/src/parsers/pf.g
@@ -151,7 +151,18 @@ cfgfile :
     ;
 
 //****************************************************************
-comment : LINE_COMMENT ;
+comment :
+        COMMENT_START
+        {
+            QStringList str;
+            while (LA(1) != ANTLR_USE_NAMESPACE(antlr)Token::EOF_TYPE && LA(1) != NEWLINE)
+            {
+                str << QString::fromUtf8(LT(1)->getText().c_str());
+                consume();
+            }
+            importer->last_comment << str.join(" ");
+        }
+    ;
 
 //****************************************************************
 include_command : INCLUDE_COMMAND
@@ -1979,13 +1990,13 @@ tokens
     STATIC_PORT = "static-port";
 }
 
-LINE_COMMENT : "#" (~('\r' | '\n'))* NEWLINE ;
+// LINE_COMMENT : "#" (~('\r' | '\n'))* NEWLINE ;
 
 Whitespace :  ( '\003'..'\010' | '\t' | '\013' | '\f' | '\016'.. '\037' | '\177'..'\377' | ' ' )
         { $setType(ANTLR_USE_NAMESPACE(antlr)Token::SKIP);  } ;
 
 
-//COMMENT_START : '!' ;
+COMMENT_START : '#' ;
 
 NEWLINE : ( "\r\n" | '\r' | '\n' ) { newline();  } ;
 
@@ -2064,7 +2075,6 @@ options {
 STRING : '"' (~'"')* '"';
 
 PIPE_CHAR : '|';
-NUMBER_SIGN : '#' ;
 // DOLLAR : '$' ;
 PERCENT : '%' ;
 AMPERSAND : '&' ;

From e0be917ef24a87a9401d1d62617bf0d989a56f3c Mon Sep 17 00:00:00 2001
From: Vadim Kurland <vadim@netcitadel.com>
Date: Wed, 6 Jul 2011 16:43:38 -0700
Subject: [PATCH 03/18] * applied two patches by Vadim Zhukov
 persgray@gmail.com to replace calls to sprintf with safer calls to snprintf
 and fix some compiler warnings.

---
 doc/ChangeLog              | 4 ++++
 src/antlr/String.cpp       | 9 +++++----
 src/import/objectMaker.cpp | 1 +
 3 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/doc/ChangeLog b/doc/ChangeLog
index 5a6529170..4cf6a226a 100644
--- a/doc/ChangeLog
+++ b/doc/ChangeLog
@@ -1,5 +1,9 @@
 2011-07-06  Vadim Kurland  <vadim@netcitadel.com>
 
+	* applied two patches by Vadim Zhukov persgray@gmail.com to
+	replace calls to sprintf with safer calls to snprintf and fix some
+	compiler warnings.
+
 	* Importer.cpp (addStandardImportComment): see #2552 "PF import:
 	add ability to suppress comments referring to line numbers in the
 	original file".
diff --git a/src/antlr/String.cpp b/src/antlr/String.cpp
index ae70f4797..526b0a1bf 100644
--- a/src/antlr/String.cpp
+++ b/src/antlr/String.cpp
@@ -21,24 +21,25 @@ namespace antlr {
 
 // wh: hack for Borland C++ 5.6
 #if __BORLANDC__
-  using std::sprintf;
+  using std::snprintf;
 #endif
 
 
 // RK: should be using snprintf actually... (or stringstream)
-ANTLR_C_USING(sprintf)
+ANTLR_C_USING(snprintf)
 
 ANTLR_USE_NAMESPACE(std)string operator+( const ANTLR_USE_NAMESPACE(std)string& lhs, const int rhs )
 {
 	char tmp[100];
-	sprintf(tmp,"%d",rhs);
+        snprintf(tmp, sizeof(tmp), "%d", rhs);
 	return lhs+tmp;
 }
 
 ANTLR_USE_NAMESPACE(std)string operator+( const ANTLR_USE_NAMESPACE(std)string& lhs, size_t rhs )
 {
 	char tmp[100];
-	sprintf(tmp,"%u",rhs);
+        snprintf(tmp, sizeof(tmp), "%zu", rhs);
+//	sprintf(tmp,"%u",rhs);
 	return lhs+tmp;
 }
 
diff --git a/src/import/objectMaker.cpp b/src/import/objectMaker.cpp
index 440a61c70..f96ebd206 100644
--- a/src/import/objectMaker.cpp
+++ b/src/import/objectMaker.cpp
@@ -317,6 +317,7 @@ ObjectSignature::ObjectSignature(ObjectMakerErrorTracker *et)
 }
 
 ObjectSignature::ObjectSignature(const ObjectSignature &other)
+  : libfwbuilder::Dispatch(other)
 {
     error_tracker = other.error_tracker;
 

From bc490dad178763f9d213587e8b8933382ee488de Mon Sep 17 00:00:00 2001
From: Vadim Kurland <vadim@netcitadel.com>
Date: Wed, 6 Jul 2011 17:35:05 -0700
Subject: [PATCH 04/18] another patch from persgray@gmail.com, making
 commandLinePrintingTest run on both Linux and BSD

---
 .../commandLinePrintingTest                   | 27 +++++++++----------
 1 file changed, 13 insertions(+), 14 deletions(-)

diff --git a/src/unit_tests/commandLinePrintingTest/commandLinePrintingTest b/src/unit_tests/commandLinePrintingTest/commandLinePrintingTest
index e9e325fa5..b9e8fcf88 100755
--- a/src/unit_tests/commandLinePrintingTest/commandLinePrintingTest
+++ b/src/unit_tests/commandLinePrintingTest/commandLinePrintingTest
@@ -1,47 +1,46 @@
-#!/bin/bash
+#!/bin/sh
 
 rm -f print.pdf >/dev/null 2>/dev/null
 
-QTVERSION=`qmake --version | tail -n1| cut -d' ' -f4`
-TESTNAME=$(basename `pwd`)
+QTVERSION=$(${QMAKE:-qmake} --version 2>&1 | tail -n1| cut -d' ' -f4)
+TESTNAME=${0##/}
 PASSED=0
 FAILED=0
 SKIPPED=0
 
-function pass # test_name
+pass() # test_name
 {
     echo "PASS   : ${TESTNAME}::$1()"    
     PASSED=$((PASSED+1))
 }
 
-function fail # test_name
+fail() # test_name
 {
     echo "FAIL!  : ${TESTNAME}::$1()"    
     FAILED=$((FAILED+1))
 }
 
-function output # test_name text
+output() # test_name text
 {
     echo -n "QDEBUG : ${TESTNAME}::$1() "
     shift
     echo $@
 }
 
-function run_command # test_name command
+run_command() # test_name command
 {
     test=$1
     shift
-    command=$@
-    output=$($command 2>&1)
+    output=$("$@" 2>&1)
     returned=$?
     ORIGIFS=$IFS
-    IFS=`echo -en "\n\b"`
+    IFS=`printf "\n\b"`
     for line in $output
     do
         output $test $line
     done
     IFS=$ORIGIFS
-    [ $returned -eq 0 ] && pass $test || fail $test
+    [ "$returned" -eq 0 ] && pass "$test" || fail "$test"
 }
 
 
@@ -51,8 +50,8 @@ pass "initTestCase"
 
 # -------- actual testing goes here --------
 
-run_command "runPrinting" "../../gui/fwbuilder -f test.fwb -P test"
-run_command "fileExists" "ls print.pdf"
+run_command "runPrinting" ../../gui/fwbuilder -f test.fwb -P test
+run_command "fileExists" ls print.pdf
 
 # --------- end of actual testing ---------
 
@@ -61,4 +60,4 @@ rm -f print.pdf >/dev/null 2>&1
 pass "cleanupTestCase"
 echo "Totals: ${PASSED} passed, ${FAILED} failed, ${SKIPPED} skipped"
 echo "********* Finished testing of ${TESTNAME} *********"
-[ ${FAILED} -eq 0 ] && exit 0 || exit 1
+[ "${FAILED}" -eq 0 ] && exit 0 || exit 1

From bde7cd1043c7d67b4a941a38d854d25a63749191 Mon Sep 17 00:00:00 2001
From: Vadim Kurland <vadim@netcitadel.com>
Date: Wed, 6 Jul 2011 18:06:11 -0700
Subject: [PATCH 05/18] clear option "prolog_place" in compiler for iosacl to
 make sure function CompilerDriver::assembleFwScriptInternal() does not get
 confused if user switched fw platform

---
 src/cisco_lib/CompilerDriver_iosacl_run.cpp | 5 +++++
 test/ipt/rc.firewall.local                  | 4 ++--
 test/pf/pf_cluster_4_rc.conf.local          | 4 ++--
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/src/cisco_lib/CompilerDriver_iosacl_run.cpp b/src/cisco_lib/CompilerDriver_iosacl_run.cpp
index 4b04f9e9b..d6a528687 100644
--- a/src/cisco_lib/CompilerDriver_iosacl_run.cpp
+++ b/src/cisco_lib/CompilerDriver_iosacl_run.cpp
@@ -110,6 +110,11 @@ QString CompilerDriver_iosacl::assembleFwScript(Cluster *cluster,
     options->setStr("prolog_script", options->getStr("iosacl_prolog_script"));
     options->setStr("epilog_script", options->getStr("iosacl_epilog_script"));
 
+    // we do not offer user a choice of the place where to put prolog
+    // lines, therefore we can reset this attribute to make sure it
+    // does not interfere
+    options->setStr("prolog_place", "");
+
     assembleFwScriptInternal(cluster, fw, cluster_member,
                              oscnf, &script_skeleton, &top_comment, "!", true);
     return script_skeleton.expand();
diff --git a/test/ipt/rc.firewall.local b/test/ipt/rc.firewall.local
index 476684bb2..8175a6781 100755
--- a/test/ipt/rc.firewall.local
+++ b/test/ipt/rc.firewall.local
@@ -2,9 +2,9 @@
 #
 #  This is automatically generated file. DO NOT MODIFY !
 #
-#  Firewall Builder  fwb_ipt v5.0.0.3556
+#  Firewall Builder  fwb_ipt v5.0.0.3557
 #
-#  Generated Tue Jul  5 18:03:29 2011 PDT by vadim
+#  Generated Wed Jul  6 17:48:03 2011 PDT by vadim
 #
 # files: * rc.firewall.local /etc/rc.d//rc.firewall.local
 #
diff --git a/test/pf/pf_cluster_4_rc.conf.local b/test/pf/pf_cluster_4_rc.conf.local
index af28ee0d1..523b35c73 100755
--- a/test/pf/pf_cluster_4_rc.conf.local
+++ b/test/pf/pf_cluster_4_rc.conf.local
@@ -1,9 +1,9 @@
 #
 #  This is automatically generated file. DO NOT MODIFY !
 #
-#  Firewall Builder  fwb_pf v5.0.0.3556
+#  Firewall Builder  fwb_pf v5.0.0.3557
 #
-#  Generated Tue Jul  5 18:05:39 2011 PDT by vadim
+#  Generated Wed Jul  6 17:49:01 2011 PDT by vadim
 #
 # files: * pf_cluster_4_rc.conf.local /etc/pf_cluster_4_rc.conf.local
 # files:   pf_cluster_4_pf.conf /etc/pf_cluster_4_pf.conf

From 758e96a7bbabb413c3f4149abaed9dd4b86a637a Mon Sep 17 00:00:00 2001
From: Vadim Kurland <vadim@netcitadel.com>
Date: Wed, 6 Jul 2011 18:34:14 -0700
Subject: [PATCH 06/18] need to create clipboard object for unit tests

---
 src/unit_tests/main/main.cpp | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/unit_tests/main/main.cpp b/src/unit_tests/main/main.cpp
index 436eb2a56..57f87f258 100644
--- a/src/unit_tests/main/main.cpp
+++ b/src/unit_tests/main/main.cpp
@@ -25,6 +25,7 @@
 #include "FWBSettings.h"
 #include "FWBApplication.h"
 #include "UserWorkflow.h"
+#include "FWObjectClipboard.h"
 
 #include "common/commoninit.h"
 
@@ -77,4 +78,6 @@ void build_app(int argc, char** argv,
     qt_translator.load(QLatin1String("qt_") + QLocale::system().name(),
                        qt_resource_dir);
     (*app)->installTranslator (&qt_translator);
+
+    new FWObjectClipboard();
 }

From d98250b2727478d7ed759176cca8edd249068501 Mon Sep 17 00:00:00 2001
From: Vadim Kurland <vadim@netcitadel.com>
Date: Wed, 6 Jul 2011 18:42:14 -0700
Subject: [PATCH 07/18] correct way to deal with object clipboard in unit
 tests; another patch from persgray@gmail.com

---
 .../CustomServiceDialogTest/CustomServiceDialogTest.cpp   | 8 ++++----
 .../RuleSetViewContextMenuTest.cpp                        | 2 +-
 src/unit_tests/RuleSetViewTest/RuleSetViewTest.cpp        | 2 +-
 .../instDialogClusterTest/instDialogClusterTest.cpp       | 2 +-
 .../instDialogCompileTest/instDialogCompileTest.cpp       | 2 +-
 .../instDialogInspectTest/instDialogInspectTest.cpp       | 2 +-
 .../instDialogInstallTest/instDialogInstallTest.cpp       | 2 +-
 .../instDialogObjectListTest/instDialogObjectListTest.cpp | 2 +-
 src/unit_tests/main/main.cpp                              | 2 --
 9 files changed, 11 insertions(+), 13 deletions(-)

diff --git a/src/unit_tests/CustomServiceDialogTest/CustomServiceDialogTest.cpp b/src/unit_tests/CustomServiceDialogTest/CustomServiceDialogTest.cpp
index b9caf4a20..93a495669 100644
--- a/src/unit_tests/CustomServiceDialogTest/CustomServiceDialogTest.cpp
+++ b/src/unit_tests/CustomServiceDialogTest/CustomServiceDialogTest.cpp
@@ -182,10 +182,10 @@ void CustomServiceDialogTest::testDialog()
     selectComboItem(platform, "iptables");
     dialog->platformChanged();
     QTest::mouseClick(ipv6, Qt::LeftButton, Qt::NoModifier, QPoint(10,10));
-    QVERIFY(service->getAddressFamily() == 10);
+    QVERIFY(service->getAddressFamily() == AF_INET6);
     selectComboItem(platform, "PF");
     dialog->platformChanged();
-    QVERIFY(service->getAddressFamily() == 10);
+    QVERIFY(service->getAddressFamily() == AF_INET6);
 
     // testing that changing address family does not change platform code
     foreach (QString key, platforms.keys())
@@ -193,11 +193,11 @@ void CustomServiceDialogTest::testDialog()
         string oldcode = service->getCodeForPlatform(key.toStdString().c_str());
         string oldprotocol = service->getProtocol();
         QTest::mouseClick(ipv4, Qt::LeftButton, Qt::NoModifier, QPoint(10,10));
-        QVERIFY(service->getAddressFamily() == 2);
+        QVERIFY(service->getAddressFamily() == AF_INET);
         QVERIFY(oldcode == service->getCodeForPlatform(key.toStdString().c_str()));
         QVERIFY(oldprotocol == service->getProtocol());
         QTest::mouseClick(ipv6, Qt::LeftButton, Qt::NoModifier, QPoint(10,10));
-        QVERIFY(service->getAddressFamily() == 10);
+        QVERIFY(service->getAddressFamily() == AF_INET6);
         QVERIFY(oldcode == service->getCodeForPlatform(key.toStdString().c_str()));
         QVERIFY(oldprotocol == service->getProtocol());
     }
diff --git a/src/unit_tests/RuleSetViewContextMenuTest/RuleSetViewContextMenuTest.cpp b/src/unit_tests/RuleSetViewContextMenuTest/RuleSetViewContextMenuTest.cpp
index ebfd826c5..7b2895f94 100644
--- a/src/unit_tests/RuleSetViewContextMenuTest/RuleSetViewContextMenuTest.cpp
+++ b/src/unit_tests/RuleSetViewContextMenuTest/RuleSetViewContextMenuTest.cpp
@@ -52,6 +52,7 @@ using namespace libfwbuilder;
 
 void RuleSetViewContextMenuTest::initTestCase()
 {
+    new FWObjectClipboard();
     mw = new FWWindow();
     mw->show();
     mw->move(0,0);
@@ -60,7 +61,6 @@ void RuleSetViewContextMenuTest::initTestCase()
     else
         mw->resize(1024, 768);
     mw->startupLoad();
-    new FWObjectClipboard();
     StartTipDialog *d = mw->findChild<StartTipDialog*>();
     if (d!=NULL) d->close();
     om = dynamic_cast<ObjectManipulator*>(mw->getCurrentObjectTree()->parent()->parent());
diff --git a/src/unit_tests/RuleSetViewTest/RuleSetViewTest.cpp b/src/unit_tests/RuleSetViewTest/RuleSetViewTest.cpp
index 7ca792320..44d5a2103 100644
--- a/src/unit_tests/RuleSetViewTest/RuleSetViewTest.cpp
+++ b/src/unit_tests/RuleSetViewTest/RuleSetViewTest.cpp
@@ -49,11 +49,11 @@ using namespace libfwbuilder;
 
 void RuleSetViewTest::initTestCase()
 {
+    new FWObjectClipboard();
     mw = new FWWindow();
     mw->show();
     mw->resize(QSize(800,600));
     mw->startupLoad();
-    new FWObjectClipboard();
     StartTipDialog *d = mw->findChild<StartTipDialog*>();
     if (d) if (d!=NULL) d->close();
     om = dynamic_cast<ObjectManipulator*>(mw->getCurrentObjectTree()->parent()->parent());
diff --git a/src/unit_tests/instDialogClusterTest/instDialogClusterTest.cpp b/src/unit_tests/instDialogClusterTest/instDialogClusterTest.cpp
index a30f7f0e8..b22782e8e 100644
--- a/src/unit_tests/instDialogClusterTest/instDialogClusterTest.cpp
+++ b/src/unit_tests/instDialogClusterTest/instDialogClusterTest.cpp
@@ -77,11 +77,11 @@ using namespace libfwbuilder;
 
 void instDialogClusterTest::initTestCase()
 {
+    new FWObjectClipboard();
     mw = new FWWindow();
     wfl = new UserWorkflow();
     mw->show();
     mw->loadFile("test_work.fwb", false);
-    new FWObjectClipboard();
 }
 
 void instDialogClusterTest::openPolicy(QString fwname)
diff --git a/src/unit_tests/instDialogCompileTest/instDialogCompileTest.cpp b/src/unit_tests/instDialogCompileTest/instDialogCompileTest.cpp
index 42d9b98f1..2341fedbe 100644
--- a/src/unit_tests/instDialogCompileTest/instDialogCompileTest.cpp
+++ b/src/unit_tests/instDialogCompileTest/instDialogCompileTest.cpp
@@ -54,10 +54,10 @@ using namespace libfwbuilder;
 
 void instDialogCompileTest::initTestCase()
 {
+    new FWObjectClipboard();
     mw = new FWWindow();
     mw->show();
     mw->loadFile("test_work.fwb", false);
-    new FWObjectClipboard();
 }
 
 bool checkProgress(QTreeWidget *list)
diff --git a/src/unit_tests/instDialogInspectTest/instDialogInspectTest.cpp b/src/unit_tests/instDialogInspectTest/instDialogInspectTest.cpp
index dd1bd5f5e..0c38a5874 100644
--- a/src/unit_tests/instDialogInspectTest/instDialogInspectTest.cpp
+++ b/src/unit_tests/instDialogInspectTest/instDialogInspectTest.cpp
@@ -57,10 +57,10 @@ bool checkProgress(QTreeWidget *list)
 
 void instDialogInspectTest::initTestCase()
 {
+    new FWObjectClipboard();
     mw = new FWWindow();
     mw->show();
     mw->loadFile("test_work.fwb", false);
-    new FWObjectClipboard();
     dialogClosed = false;
     om = mw->findChild<ObjectManipulator*>("om");
     tree = mw->activeProject()->getCurrentObjectTree();
diff --git a/src/unit_tests/instDialogInstallTest/instDialogInstallTest.cpp b/src/unit_tests/instDialogInstallTest/instDialogInstallTest.cpp
index 448a6337c..ce7e9ed01 100644
--- a/src/unit_tests/instDialogInstallTest/instDialogInstallTest.cpp
+++ b/src/unit_tests/instDialogInstallTest/instDialogInstallTest.cpp
@@ -128,10 +128,10 @@ bool checkProgress(QTreeWidget *list)
 
 void instDialogInstallTest::initTestCase()
 {
+    new FWObjectClipboard();
     mw = new FWWindow();
     mw->show();
     mw->loadFile("test_work.fwb", false);
-    new FWObjectClipboard();
     ssh_auth_sock = getenv("SSH_AUTH_SOCK");
 }
 
diff --git a/src/unit_tests/instDialogObjectListTest/instDialogObjectListTest.cpp b/src/unit_tests/instDialogObjectListTest/instDialogObjectListTest.cpp
index f41b2d9eb..7b4eb0137 100644
--- a/src/unit_tests/instDialogObjectListTest/instDialogObjectListTest.cpp
+++ b/src/unit_tests/instDialogObjectListTest/instDialogObjectListTest.cpp
@@ -105,10 +105,10 @@ using namespace libfwbuilder;
 
 void instDialogObjectListTest::initTestCase()
 {
+    new FWObjectClipboard();
     mw = new FWWindow();
     mw->show();
     mw->loadFile("test_work.fwb", false);
-    new FWObjectClipboard();
 }
 
 void instDialogObjectListTest::openPolicy(QString fwname)
diff --git a/src/unit_tests/main/main.cpp b/src/unit_tests/main/main.cpp
index 57f87f258..dbf93d0d6 100644
--- a/src/unit_tests/main/main.cpp
+++ b/src/unit_tests/main/main.cpp
@@ -78,6 +78,4 @@ void build_app(int argc, char** argv,
     qt_translator.load(QLatin1String("qt_") + QLocale::system().name(),
                        qt_resource_dir);
     (*app)->installTranslator (&qt_translator);
-
-    new FWObjectClipboard();
 }

From 6f842f1b994e042c7fb57d0e7ee1846d6120f8fc Mon Sep 17 00:00:00 2001
From: Vadim Kurland <vadim@netcitadel.com>
Date: Thu, 7 Jul 2011 11:04:45 -0700
Subject: [PATCH 08/18] see #2551 making sure rules that have route-to option
 get the call to setRoute() in the importer

---
 src/import/PFImporter.cpp    |  2 ++
 src/import/PFImporterRun.cpp | 13 +++++++++++++
 2 files changed, 15 insertions(+)

diff --git a/src/import/PFImporter.cpp b/src/import/PFImporter.cpp
index 188f3b3cb..d4f503cc8 100644
--- a/src/import/PFImporter.cpp
+++ b/src/import/PFImporter.cpp
@@ -870,6 +870,8 @@ void PFImporter::pushPolicyRule()
                     .arg(rs.address.c_str()).arg(rs.netmask.c_str());
         }
         ropt->setStr("pf_route_opt_addr", route_opt_addr.join(",").toStdString());
+
+        rule->setRouting( ! ropt->getStr("pf_route_option").empty());
     }
 
     /*
diff --git a/src/import/PFImporterRun.cpp b/src/import/PFImporterRun.cpp
index 6e5ac4b36..8a261ae36 100644
--- a/src/import/PFImporterRun.cpp
+++ b/src/import/PFImporterRun.cpp
@@ -103,6 +103,12 @@ void PFImporter::run()
     int pass = 0;
     while (1)
     {
+        if (fwbdebug)
+        {
+            qDebug() << "################################";
+            qDebug() << "Pass " << pass;
+        }
+
         QMapIterator<QString, QString> it(macros);
         while (it.hasNext())
         {
@@ -114,6 +120,13 @@ void PFImporter::run()
             whole_input.replace(macro_instance, macro_value);
         }
         QRegExp any_macro_instance("\\$\\w+\\W");
+
+        if (fwbdebug)
+        {
+            qDebug() << "pf.conf file after line unfolding and macro substitution:";
+            qDebug() << whole_input;
+        }
+
         if (! whole_input.contains(any_macro_instance)) break;
         pass++;
     }

From c4000fc0a2691e643e109287ef646ba8274629d5 Mon Sep 17 00:00:00 2001
From: Vadim Kurland <vadim@netcitadel.com>
Date: Thu, 7 Jul 2011 11:16:16 -0700
Subject: [PATCH 09/18] set the flag to make importer add standard comments to
 rules and objects in unit test

---
 .../PFImporterTest/PFImporterTest.cpp           | 17 +++++++++++++++++
 .../PFImporterTest/test_data/pf-route-to.fwb    |  5 ++++-
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/src/unit_tests/PFImporterTest/PFImporterTest.cpp b/src/unit_tests/PFImporterTest/PFImporterTest.cpp
index e4ea13f7b..e9f6b2aaa 100644
--- a/src/unit_tests/PFImporterTest/PFImporterTest.cpp
+++ b/src/unit_tests/PFImporterTest/PFImporterTest.cpp
@@ -212,6 +212,7 @@ void PFImporterTest::macrosTest()
         openTestFile("test_data/pf-macros.conf"));
 
     Importer* imp = new PFImporter(lib, instream, logger, "test_fw");
+    imp->setAddStandardCommentsFlag(true);
     CPPUNIT_ASSERT_NO_THROW( imp->run() );
     imp->finalize();
 
@@ -230,6 +231,7 @@ void PFImporterTest::hostsMatchTest()
         openTestFile("test_data/pf-hosts-matches.conf"));
 
     Importer* imp = new PFImporter(lib, instream, logger, "test_fw");
+    imp->setAddStandardCommentsFlag(true);
     CPPUNIT_ASSERT_NO_THROW( imp->run() );
     imp->finalize();
 
@@ -251,6 +253,7 @@ void PFImporterTest::blockReturnTest()
         openTestFile("test_data/pf-block-return-actions.conf"));
 
     Importer* imp = new PFImporter(lib, instream, logger, "test_fw");
+    imp->setAddStandardCommentsFlag(true);
     CPPUNIT_ASSERT_NO_THROW( imp->run() );
     imp->finalize();
 
@@ -272,6 +275,7 @@ void PFImporterTest::icmpMatchTest()
         openTestFile("test_data/pf-icmp-matches.conf"));
 
     Importer* imp = new PFImporter(lib, instream, logger, "test_fw");
+    imp->setAddStandardCommentsFlag(true);
     CPPUNIT_ASSERT_NO_THROW( imp->run() );
     imp->finalize();
 
@@ -293,6 +297,7 @@ void PFImporterTest::interfaceMatchTest()
         openTestFile("test_data/pf-interface-matches.conf"));
 
     Importer* imp = new PFImporter(lib, instream, logger, "test_fw");
+    imp->setAddStandardCommentsFlag(true);
     CPPUNIT_ASSERT_NO_THROW( imp->run() );
     imp->finalize();
 
@@ -314,6 +319,7 @@ void PFImporterTest::portMatchTest()
         openTestFile("test_data/pf-port-matches.conf"));
 
     Importer* imp = new PFImporter(lib, instream, logger, "test_fw");
+    imp->setAddStandardCommentsFlag(true);
     CPPUNIT_ASSERT_NO_THROW( imp->run() );
     imp->finalize();
 
@@ -335,6 +341,7 @@ void PFImporterTest::setCommandsTest()
         openTestFile("test_data/pf-set-commands.conf"));
 
     Importer* imp = new PFImporter(lib, instream, logger, "test_fw");
+    imp->setAddStandardCommentsFlag(true);
     CPPUNIT_ASSERT_NO_THROW( imp->run() );
     imp->finalize();
 
@@ -356,6 +363,7 @@ void PFImporterTest::stateMatchTest()
         openTestFile("test_data/pf-state-matches.conf"));
 
     Importer* imp = new PFImporter(lib, instream, logger, "test_fw");
+    imp->setAddStandardCommentsFlag(true);
     CPPUNIT_ASSERT_NO_THROW( imp->run() );
     imp->finalize();
 
@@ -377,6 +385,7 @@ void PFImporterTest::tcpFlagsMatchTest()
         openTestFile("test_data/pf-tcp-flags-matches.conf"));
 
     Importer* imp = new PFImporter(lib, instream, logger, "test_fw");
+    imp->setAddStandardCommentsFlag(true);
     CPPUNIT_ASSERT_NO_THROW( imp->run() );
     imp->finalize();
 
@@ -398,6 +407,7 @@ void PFImporterTest::natCommands()
         openTestFile("test_data/pf-nat-rules.conf"));
 
     Importer* imp = new PFImporter(lib, instream, logger, "test_fw");
+    imp->setAddStandardCommentsFlag(true);
     CPPUNIT_ASSERT_NO_THROW( imp->run() );
     imp->finalize();
 
@@ -419,6 +429,7 @@ void PFImporterTest::rdrCommands()
         openTestFile("test_data/pf-rdr-rules.conf"));
 
     Importer* imp = new PFImporter(lib, instream, logger, "test_fw");
+    imp->setAddStandardCommentsFlag(true);
     CPPUNIT_ASSERT_NO_THROW( imp->run() );
     imp->finalize();
 
@@ -440,6 +451,7 @@ void PFImporterTest::setTimeoutCommands()
         openTestFile("test_data/pf-timeouts.conf"));
 
     Importer* imp = new PFImporter(lib, instream, logger, "test_fw");
+    imp->setAddStandardCommentsFlag(true);
     CPPUNIT_ASSERT_NO_THROW( imp->run() );
     imp->finalize();
 
@@ -459,6 +471,7 @@ void PFImporterTest::scrubCommandsOld()
         openTestFile("test_data/pf-scrub-commands-old.conf"));
 
     Importer* imp = new PFImporter(lib, instream, logger, "test_fw");
+    imp->setAddStandardCommentsFlag(true);
     CPPUNIT_ASSERT_NO_THROW( imp->run() );
     imp->finalize();
 
@@ -475,6 +488,7 @@ void PFImporterTest::scrubCommandsNew()
         openTestFile("test_data/pf-scrub-commands-new.conf"));
 
     Importer* imp = new PFImporter(lib, instream, logger, "test_fw");
+    imp->setAddStandardCommentsFlag(true);
     CPPUNIT_ASSERT_NO_THROW( imp->run() );
     imp->finalize();
 
@@ -491,6 +505,7 @@ void PFImporterTest::tableDefinitions()
         openTestFile("test_data/pf-tables.conf"));
 
     Importer* imp = new PFImporter(lib, instream, logger, "test_fw");
+    imp->setAddStandardCommentsFlag(true);
     CPPUNIT_ASSERT_NO_THROW( imp->run() );
     imp->finalize();
 
@@ -510,6 +525,7 @@ void PFImporterTest::userGroupMatches()
         openTestFile("test_data/pf-user-group-matches.conf"));
 
     Importer* imp = new PFImporter(lib, instream, logger, "test_fw");
+    imp->setAddStandardCommentsFlag(true);
     CPPUNIT_ASSERT_NO_THROW( imp->run() );
     imp->finalize();
 
@@ -531,6 +547,7 @@ void PFImporterTest::routeToTest()
         openTestFile("test_data/pf-route-to.conf"));
 
     Importer* imp = new PFImporter(lib, instream, logger, "test_fw");
+    imp->setAddStandardCommentsFlag(true);
     CPPUNIT_ASSERT_NO_THROW( imp->run() );
     imp->finalize();
 
diff --git a/src/unit_tests/PFImporterTest/test_data/pf-route-to.fwb b/src/unit_tests/PFImporterTest/test_data/pf-route-to.fwb
index 5871d3756..df4edbff1 100644
--- a/src/unit_tests/PFImporterTest/test_data/pf-route-to.fwb
+++ b/src/unit_tests/PFImporterTest/test_data/pf-route-to.fwb
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
-<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="22" lastModified="1309988144" id="root">
+<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="22" lastModified="1310062508" id="root">
   <Library id="syslib000" color="#d4f8ff" name="Standard" comment="Standard objects" ro="True">
     <AnyNetwork id="sysid0" name="Any" comment="Any Network" ro="False" address="0.0.0.0" netmask="0.0.0.0"/>
     <AnyIPService id="sysid1" protocol_num="0" name="Any" comment="Any IP Service" ro="False"/>
@@ -479,6 +479,7 @@
               <Option name="pf_route_opt_addr">10.1.2.3</Option>
               <Option name="pf_route_opt_if">em0</Option>
               <Option name="pf_route_option">route_through</Option>
+              <Option name="routing">True</Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
@@ -502,6 +503,7 @@
               <Option name="pf_route_opt_addr">10.3.4.5</Option>
               <Option name="pf_route_opt_if">bce0</Option>
               <Option name="pf_route_option">route_reply_through</Option>
+              <Option name="routing">True</Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
@@ -525,6 +527,7 @@
               <Option name="pf_route_opt_addr">10.1.2.3</Option>
               <Option name="pf_route_opt_if">em0</Option>
               <Option name="pf_route_option">route_copy_through</Option>
+              <Option name="routing">True</Option>
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>

From 5544cd94d46caef1eea9b977771fa10d6d4ade1f Mon Sep 17 00:00:00 2001
From: Vadim Kurland <vadim@netcitadel.com>
Date: Thu, 7 Jul 2011 11:16:48 -0700
Subject: [PATCH 10/18] check if a macro used somewhere in the file to be
 imported is actually defined and abort if not

---
 src/import/PFImporterRun.cpp | 24 ++++++++++++++----------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/src/import/PFImporterRun.cpp b/src/import/PFImporterRun.cpp
index 8a261ae36..31b7eb759 100644
--- a/src/import/PFImporterRun.cpp
+++ b/src/import/PFImporterRun.cpp
@@ -103,11 +103,7 @@ void PFImporter::run()
     int pass = 0;
     while (1)
     {
-        if (fwbdebug)
-        {
-            qDebug() << "################################";
-            qDebug() << "Pass " << pass;
-        }
+        if (fwbdebug) qDebug() << "Pass " << pass;
 
         QMapIterator<QString, QString> it(macros);
         while (it.hasNext())
@@ -119,15 +115,23 @@ void PFImporter::run()
 
             whole_input.replace(macro_instance, macro_value);
         }
-        QRegExp any_macro_instance("\\$\\w+\\W");
 
-        if (fwbdebug)
+        QRegExp any_macro_instance("\\$(\\w+)\\W");
+        if (any_macro_instance.indexIn(whole_input) == -1)
         {
-            qDebug() << "pf.conf file after line unfolding and macro substitution:";
-            qDebug() << whole_input;
+            break;
+        } else
+        {
+            QString macro_name = any_macro_instance.cap(1);
+            if (!macros.contains(macro_name))
+            {
+                err << gen_err + " " +
+                    QObject::tr("Macro %1 is undefined").arg(macro_name);
+                *logger << err.join("\n").toUtf8().constData();
+                return;
+            }
         }
 
-        if (! whole_input.contains(any_macro_instance)) break;
         pass++;
     }
 

From fff5775c3943308c03541d779e8b33526b87acb4 Mon Sep 17 00:00:00 2001
From: Vadim Kurland <vadim@netcitadel.com>
Date: Thu, 7 Jul 2011 11:31:09 -0700
Subject: [PATCH 11/18] new build 3558

---
 VERSION                            | 2 +-
 VERSION.h                          | 2 +-
 doc/ChangeLog                      | 8 ++++++++
 packaging/fwbuilder-static-qt.spec | 2 +-
 packaging/fwbuilder.control        | 2 +-
 packaging/fwbuilder.spec           | 2 +-
 6 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/VERSION b/VERSION
index 65dc28a1b..aa36e16ef 100644
--- a/VERSION
+++ b/VERSION
@@ -7,7 +7,7 @@ FWB_MICRO_VERSION=0
 # build number is like "nano" version number. I am incrementing build
 # number during development cycle
 #
-BUILD_NUM="3557"
+BUILD_NUM="3558"
 
 VERSION="$FWB_MAJOR_VERSION.$FWB_MINOR_VERSION.$FWB_MICRO_VERSION.$BUILD_NUM"
 
diff --git a/VERSION.h b/VERSION.h
index 29e63cd86..8d8498f7d 100644
--- a/VERSION.h
+++ b/VERSION.h
@@ -1,2 +1,2 @@
-#define VERSION      "5.0.0.3557"
+#define VERSION      "5.0.0.3558"
 #define GENERATION   "5.0"
diff --git a/doc/ChangeLog b/doc/ChangeLog
index 4cf6a226a..a1f2a3957 100644
--- a/doc/ChangeLog
+++ b/doc/ChangeLog
@@ -1,3 +1,11 @@
+2011-07-07  Vadim Kurland  <vadim@netcitadel.com>
+
+	* PF import: check if a macro used somewhere in the file to be
+	imported is actually defined and abort if not
+
+	* PF import: see #2551 making sure rules that have route-to option
+	get the call to setRoute() in the importer
+
 2011-07-06  Vadim Kurland  <vadim@netcitadel.com>
 
 	* applied two patches by Vadim Zhukov persgray@gmail.com to
diff --git a/packaging/fwbuilder-static-qt.spec b/packaging/fwbuilder-static-qt.spec
index 02536c3dd..a82e0826b 100644
--- a/packaging/fwbuilder-static-qt.spec
+++ b/packaging/fwbuilder-static-qt.spec
@@ -3,7 +3,7 @@
 
 
 %define name    fwbuilder
-%define version 5.0.0.3557
+%define version 5.0.0.3558
 %define release 1
 
 %if "%_vendor" == "MandrakeSoft"
diff --git a/packaging/fwbuilder.control b/packaging/fwbuilder.control
index 585b32549..bc330bf1c 100644
--- a/packaging/fwbuilder.control
+++ b/packaging/fwbuilder.control
@@ -4,6 +4,6 @@ Replaces: fwbuilder (<=4.1.1-1), fwbuilder-common, fwbuilder-bsd, fwbuilder-linu
 Priority: extra
 Section: checkinstall
 Maintainer: vadim@fwbuilder.org
-Version: 5.0.0.3557-1
+Version: 5.0.0.3558-1
 Depends: libqt4-gui (>= 4.3.0), libxml2, libxslt1.1, libsnmp | libsnmp15
 Description: Firewall Builder GUI and policy compilers
diff --git a/packaging/fwbuilder.spec b/packaging/fwbuilder.spec
index 24c32dda9..18e8f7922 100644
--- a/packaging/fwbuilder.spec
+++ b/packaging/fwbuilder.spec
@@ -1,6 +1,6 @@
 
 %define name    fwbuilder
-%define version 5.0.0.3557
+%define version 5.0.0.3558
 %define release 1
 
 %if "%_vendor" == "MandrakeSoft"

From d850139f2d8465dd5189bf020168d4bc75e0229d Mon Sep 17 00:00:00 2001
From: Vadim Kurland <vadim@netcitadel.com>
Date: Thu, 7 Jul 2011 16:17:27 -0700
Subject: [PATCH 12/18] see #2554 "PF import: create groups of address objects
 for macros where possible". Importer for PF recognizes macros that define
 lists of ip addresses, interfaces or host names and creates object groups
 with the same name from them.  Only macros that contain at least one ip
 address in the list are recognized.

---
 doc/ChangeLog                                 |   7 +
 src/import/PFImporter.h                       |   5 +-
 src/import/PFImporterRun.cpp                  | 179 ++++-
 .../test_data/pf-hosts-matches.fwb            | 540 ++++++++-------
 .../test_data/pf-hosts-matches.output         |   1 +
 .../PFImporterTest/test_data/pf-macros.conf   |  29 +-
 .../PFImporterTest/test_data/pf-macros.fwb    | 636 +++++++++++-------
 .../PFImporterTest/test_data/pf-macros.output |  44 +-
 8 files changed, 879 insertions(+), 562 deletions(-)

diff --git a/doc/ChangeLog b/doc/ChangeLog
index a1f2a3957..d2c501b54 100644
--- a/doc/ChangeLog
+++ b/doc/ChangeLog
@@ -1,5 +1,12 @@
 2011-07-07  Vadim Kurland  <vadim@netcitadel.com>
 
+	* PFImporterRun.cpp (run): see #2554 "PF import: create groups of
+	address objects for macros where possible". Importer for PF
+	recognizes macros that define lists of ip addresses, interfaces or
+	host names and creates object groups with the same name from them.
+	Only macros that contain at least one ip address in the list are
+	recognized.
+
 	* PF import: check if a macro used somewhere in the file to be
 	imported is actually defined and abort if not
 
diff --git a/src/import/PFImporter.h b/src/import/PFImporter.h
index 97d5c48ee..5400ae3de 100644
--- a/src/import/PFImporter.h
+++ b/src/import/PFImporter.h
@@ -61,7 +61,10 @@ class PFImporter : public Importer
         const std::list< PortSpec > &src_port_spec_list,
         const std::list< PortSpec > &dst_port_spec_list,
         bool for_nat_rhs);
-    
+
+    void substituteMacros(const QMap<QString,QString> &macros,
+                          QString &buffer);
+
 public:
 
     typedef enum {
diff --git a/src/import/PFImporterRun.cpp b/src/import/PFImporterRun.cpp
index 31b7eb759..282acb76f 100644
--- a/src/import/PFImporterRun.cpp
+++ b/src/import/PFImporterRun.cpp
@@ -23,6 +23,8 @@
 
 #include "../../config.h"
 
+#include "fwbuilder/InetAddr.h"
+
 #include "PFImporter.h"
 
 #include <QString>
@@ -42,6 +44,7 @@
 extern int fwbdebug;
 
 using namespace std;
+using namespace libfwbuilder;
 
 
 /*
@@ -81,7 +84,10 @@ void PFImporter::run()
 
     QRegExp inline_comment("#.*$");
     QRegExp macro_definition("^\\s*(\\S+)\\s*=\\s*(.*)$");
+    QRegExp list_of_items("^\\{\\s*((\\S+,?\\s*)+)\\s*\\}$");
+
     QMap<QString, QString> macros;
+    QMap<QString, QString> macros_source_lines;
 
     foreach(QString str, whole_input.split("\n"))
     {
@@ -91,49 +97,110 @@ void PFImporter::run()
 
         if (macro_definition.indexIn(work_str) != -1)
         {
+            QString macro_name = macro_definition.cap(1);
             QString value = macro_definition.cap(2);
-            macros[macro_definition.cap(1)] = value.replace("\"", "").trimmed();
+            value.replace('\"', "");
+            value = value.simplified();
+
+            macros[macro_name] = value;
+            macros_source_lines[macro_name] = macro_definition.cap(0);
+        }
+    }
+
+    QMapIterator<QString, QString> it(macros);
+    while (it.hasNext())
+    {
+        it.next();
+        QString macro_name = it.key();
+        QString value = it.value();
+        substituteMacros(macros, value);
+        macros[macro_name] = value;
+    }
+
+    it = macros;
+    while (it.hasNext())
+    {
+        it.next();
+        QString macro_name = it.key();
+        QString value = it.value();
+
+        qDebug() << "Macro: name=" << macro_name << "value=" << value;
+
+        /*
+         * Special case: if this macro defines list of addresses
+         * in '{' '}', we convert it to a table with the same name
+         * so that importer later on can create object group for
+         * it.
+         *
+         * RegExp list_of_items assumes the string has been
+         * stripped of any quotes and trimmed.
+         */
+        if (list_of_items.indexIn(value) != -1)
+        {
+            qDebug() << "This macro defines a list";
+
+            /*
+             * we only convert to table if the list contains at
+             * least one ip address. We assume that if there is an
+             * address there, then all items in the list must
+             * represent addresses, host names or interface names
+             * because pf does not allow mixed address/service
+             * lists anywhere.
+             */
+            QString list_str = list_of_items.cap(1);
+            list_str.replace(",", "");
+            QStringList items = list_str.split(QRegExp("\\s"),
+                                               QString::SkipEmptyParts);
+            qDebug() << items;
+
+            bool has_address = false;
+            foreach(QString item, items)
+            {
+                qDebug() << "Item:" << item;
+                if (!item.isEmpty() && (item.contains(':') || item.contains('.')))
+                {
+                    try
+                    {
+                        InetAddr(item.toStdString());
+                        // stop the loop if string successfully
+                        // converts to an ip address
+                        has_address = true;
+                        break;
+                    } catch(FWException &ex)
+                    {
+                        ;
+                    }
+                }
+            }
+
+            if (has_address)
+            {
+                /*
+                 * Convert as follows:
+                 * Macro:
+                 * name = "{ 1.1.1.1  2.2.2.2 }"
+                 * to a table:
+                 * table <name> "{ 1.1.1.1  2.2.2.2 }"
+                 */
+                QString table_def("table <%1> %2");
+                whole_input.replace(macros_source_lines[macro_name],
+                                    table_def.arg(macro_name).arg(value));
+                /*
+                 * And add a macro to the dictionary to map macro_name to
+                 * the table
+                 */
+                macros[macro_name] = "<" + macro_name + ">";
+
+                qDebug() << "Replacing macro definition with table:";
+                qDebug() << table_def.arg(macro_name).arg(value);
+            }
         }
     }
 
     if (fwbdebug)
         qDebug() << "Macros defined in this file: " << macros;
 
-    // make several passes: sometimes macros can use other macros
-    int pass = 0;
-    while (1)
-    {
-        if (fwbdebug) qDebug() << "Pass " << pass;
-
-        QMapIterator<QString, QString> it(macros);
-        while (it.hasNext())
-        {
-            it.next();
-            QString macro_name = it.key();
-            QString macro_value = it.value();
-            QRegExp macro_instance(QString("\\$%1(?=\\W)").arg(macro_name));
-
-            whole_input.replace(macro_instance, macro_value);
-        }
-
-        QRegExp any_macro_instance("\\$(\\w+)\\W");
-        if (any_macro_instance.indexIn(whole_input) == -1)
-        {
-            break;
-        } else
-        {
-            QString macro_name = any_macro_instance.cap(1);
-            if (!macros.contains(macro_name))
-            {
-                err << gen_err + " " +
-                    QObject::tr("Macro %1 is undefined").arg(macro_name);
-                *logger << err.join("\n").toUtf8().constData();
-                return;
-            }
-        }
-
-        pass++;
-    }
+    substituteMacros(macros, whole_input);
 
     if (fwbdebug)
     {
@@ -188,3 +255,43 @@ void PFImporter::run()
         *logger << err.join("\n").toUtf8().constData();
 }
 
+void PFImporter::substituteMacros(const QMap<QString,QString> &macros,
+                                  QString &buffer)
+{
+    // make several passes: sometimes macros can use other macros
+    int pass = 0;
+    while (1)
+    {
+        if (fwbdebug) qDebug() << "Pass " << pass;
+
+        QMapIterator<QString, QString> it(macros);
+        while (it.hasNext())
+        {
+            it.next();
+            QString macro_name = it.key();
+            QString macro_value = it.value();
+            QRegExp macro_instance(QString("\\$%1(?=\\W)").arg(macro_name));
+
+            buffer.replace(macro_instance, macro_value);
+        }
+
+        QRegExp any_macro_instance("\\$(\\w+)\\W");
+        if (any_macro_instance.indexIn(buffer) == -1)
+        {
+            break;
+        } else
+        {
+            QString macro_name = any_macro_instance.cap(1);
+            if (!macros.contains(macro_name))
+            {
+                QString err;
+                err = QObject::tr("Error: Macro %1 is undefined").arg(macro_name);
+                *logger << err.toUtf8().constData();
+                return;
+            }
+        }
+
+        pass++;
+    }
+}
+
diff --git a/src/unit_tests/PFImporterTest/test_data/pf-hosts-matches.fwb b/src/unit_tests/PFImporterTest/test_data/pf-hosts-matches.fwb
index ed1bb8806..785cdf03f 100644
--- a/src/unit_tests/PFImporterTest/test_data/pf-hosts-matches.fwb
+++ b/src/unit_tests/PFImporterTest/test_data/pf-hosts-matches.fwb
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
-<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="22" lastModified="1309897476" id="root">
+<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="22" lastModified="1310079789" id="root">
   <Library id="syslib000" color="#d4f8ff" name="Standard" comment="Standard objects" ro="True">
     <AnyNetwork id="sysid0" name="Any" comment="Any Network" ro="False" address="0.0.0.0" netmask="0.0.0.0"/>
     <AnyIPService id="sysid1" protocol_num="0" name="Any" comment="Any IP Service" ro="False"/>
@@ -442,62 +442,68 @@
       </ObjectGroup>
       <ObjectGroup id="id9" name="Address Tables" comment="" ro="False"/>
       <ObjectGroup id="id10" name="Groups" comment="" ro="False">
-        <ObjectGroup id="id11" name="dst_addresses_1" comment="Created during import of  line 5" ro="False">
+        <ObjectGroup id="id11" name="addr_list_macro" comment="Created during import of  line 2" ro="False">
+          <ObjectRef ref="id31"/>
+          <ObjectRef ref="id32"/>
+          <ObjectRef ref="id33"/>
+          <ObjectRef ref="id34"/>
+        </ObjectGroup>
+        <ObjectGroup id="id16" name="dst_addresses_1" comment="Created during import of  line 5" ro="False">
           <ObjectRef ref="id3"/>
           <ObjectRef ref="id4"/>
-          <ObjectRef ref="id26"/>
+          <ObjectRef ref="id35"/>
         </ObjectGroup>
-        <ObjectGroup id="id15" name="dst_addresses_2" comment="Created during import of  line 6" ro="False">
-          <ObjectRef ref="id481"/>
-          <ObjectRef ref="id482"/>
+        <ObjectGroup id="id20" name="dst_addresses_2" comment="Created during import of  line 6" ro="False">
+          <ObjectRef ref="id468"/>
+          <ObjectRef ref="id469"/>
         </ObjectGroup>
-        <ObjectGroup id="id18" name="dst_addresses_3" comment="Created during import of  line 7" ro="False">
-          <ObjectRef ref="id481"/>
-          <ObjectRef ref="id481"/>
+        <ObjectGroup id="id23" name="dst_addresses_3" comment="Created during import of  line 7" ro="False">
+          <ObjectRef ref="id468"/>
+          <ObjectRef ref="id468"/>
         </ObjectGroup>
-        <ObjectGroup id="id21" name="dst_addresses_4" comment="Created during import of  line 8" ro="False">
+        <ObjectGroup id="id26" name="dst_addresses_4" comment="Created during import of  line 8" ro="False">
           <ObjectRef ref="id6"/>
           <ObjectRef ref="id7"/>
         </ObjectGroup>
       </ObjectGroup>
-      <ObjectGroup id="id24" name="Hosts" comment="" ro="False"/>
-      <ObjectGroup id="id25" name="Networks" comment="" ro="False">
-        <Network id="id26" name="net-192.168.2.0/255.255.255.0" comment="Created during import of  line 5" ro="False" address="192.168.2.0" netmask="255.255.255.0"/>
-        <Network id="id27" name="net-192.168.1.0/255.255.255.0" comment="Created during import of  line 17" ro="False" address="192.168.1.0" netmask="255.255.255.0"/>
-        <Network id="id28" name="net-10.123.12.32/255.255.255.224" comment="Created during import of  line 26" ro="False" address="10.123.12.32" netmask="255.255.255.224"/>
-        <Network id="id29" name="net-10.123.14.8/255.255.255.224" comment="Created during import of  line 26" ro="False" address="10.123.14.8" netmask="255.255.255.224"/>
-        <Network id="id30" name="net-10.123.10.16/255.255.255.240" comment="Created during import of  line 26" ro="False" address="10.123.10.16" netmask="255.255.255.240"/>
-        <Network id="id31" name="net-10.123.0.0/255.255.255.0" comment="Created during import of  line 26" ro="False" address="10.123.0.0" netmask="255.255.255.0"/>
+      <ObjectGroup id="id29" name="Hosts" comment="" ro="False"/>
+      <ObjectGroup id="id30" name="Networks" comment="" ro="False">
+        <Network id="id31" name="net-10.123.12.32/255.255.255.224" comment="Created during import of  line 2" ro="False" address="10.123.12.32" netmask="255.255.255.224"/>
+        <Network id="id32" name="net-10.123.14.8/255.255.255.224" comment="Created during import of  line 2" ro="False" address="10.123.14.8" netmask="255.255.255.224"/>
+        <Network id="id33" name="net-10.123.10.16/255.255.255.240" comment="Created during import of  line 2" ro="False" address="10.123.10.16" netmask="255.255.255.240"/>
+        <Network id="id34" name="net-10.123.0.0/255.255.255.0" comment="Created during import of  line 2" ro="False" address="10.123.0.0" netmask="255.255.255.0"/>
+        <Network id="id35" name="net-192.168.2.0/255.255.255.0" comment="Created during import of  line 5" ro="False" address="192.168.2.0" netmask="255.255.255.0"/>
+        <Network id="id36" name="net-192.168.1.0/255.255.255.0" comment="Created during import of  line 17" ro="False" address="192.168.1.0" netmask="255.255.255.0"/>
       </ObjectGroup>
-      <ObjectGroup id="id32" name="Address Ranges" comment="" ro="False"/>
+      <ObjectGroup id="id37" name="Address Ranges" comment="" ro="False"/>
     </ObjectGroup>
-    <ServiceGroup id="id33" name="Services" comment="" ro="False">
-      <ServiceGroup id="id34" name="Groups" comment="" ro="False"/>
-      <ServiceGroup id="id35" name="ICMP" comment="" ro="False"/>
-      <ServiceGroup id="id36" name="IP" comment="" ro="False"/>
-      <ServiceGroup id="id37" name="TCP" comment="" ro="False">
-        <TCPService id="id38" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="tcp 0:0 / 80:80" comment="Created during import of  line 18" ro="False" src_range_start="0" src_range_end="0" dst_range_start="80" dst_range_end="80"/>
-        <TCPService id="id39" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="tcp 0:0 / 22:22" comment="Created during import of  line 21" ro="False" src_range_start="0" src_range_end="0" dst_range_start="22" dst_range_end="22"/>
-        <TCPService id="id40" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="tcp 80:80 / 0:0" comment="Created during import of  line 35" ro="False" src_range_start="80" src_range_end="80" dst_range_start="0" dst_range_end="0"/>
-        <TCPService id="id41" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="tcp 22:22 / 0:0" comment="Created during import of  line 38" ro="False" src_range_start="22" src_range_end="22" dst_range_start="0" dst_range_end="0"/>
+    <ServiceGroup id="id38" name="Services" comment="" ro="False">
+      <ServiceGroup id="id39" name="Groups" comment="" ro="False"/>
+      <ServiceGroup id="id40" name="ICMP" comment="" ro="False"/>
+      <ServiceGroup id="id41" name="IP" comment="" ro="False"/>
+      <ServiceGroup id="id42" name="TCP" comment="" ro="False">
+        <TCPService id="id43" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="tcp 0:0 / 80:80" comment="Created during import of  line 18" ro="False" src_range_start="0" src_range_end="0" dst_range_start="80" dst_range_end="80"/>
+        <TCPService id="id44" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="tcp 0:0 / 22:22" comment="Created during import of  line 21" ro="False" src_range_start="0" src_range_end="0" dst_range_start="22" dst_range_end="22"/>
+        <TCPService id="id45" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="tcp 80:80 / 0:0" comment="Created during import of  line 35" ro="False" src_range_start="80" src_range_end="80" dst_range_start="0" dst_range_end="0"/>
+        <TCPService id="id46" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="tcp 22:22 / 0:0" comment="Created during import of  line 38" ro="False" src_range_start="22" src_range_end="22" dst_range_start="0" dst_range_end="0"/>
       </ServiceGroup>
-      <ServiceGroup id="id42" name="UDP" comment="" ro="False"/>
-      <ServiceGroup id="id43" name="Users" comment="" ro="False"/>
-      <ServiceGroup id="id44" name="Custom" comment="" ro="False"/>
-      <ServiceGroup id="id45" name="TagServices" comment="" ro="False"/>
+      <ServiceGroup id="id47" name="UDP" comment="" ro="False"/>
+      <ServiceGroup id="id48" name="Users" comment="" ro="False"/>
+      <ServiceGroup id="id49" name="Custom" comment="" ro="False"/>
+      <ServiceGroup id="id50" name="TagServices" comment="" ro="False"/>
     </ServiceGroup>
-    <ObjectGroup id="id46" name="Firewalls" comment="" ro="False">
-      <Firewall id="id47" host_OS="freebsd" lastCompiled="0" lastInstalled="0" lastModified="0" platform="pf" name="test_fw" comment="Created during import of  line 6" ro="False">
-        <NAT id="id477" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
+    <ObjectGroup id="id51" name="Firewalls" comment="" ro="False">
+      <Firewall id="id52" host_OS="freebsd" lastCompiled="0" lastInstalled="0" lastModified="0" platform="pf" name="test_fw" comment="Created during import of  line 6" ro="False">
+        <NAT id="id464" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
           <RuleSetOptions/>
         </NAT>
-        <Policy id="id49" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id51" disabled="False" group="" log="False" position="0" action="Accept" direction="Inbound" comment="Created during import of  line 11">
+        <Policy id="id54" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id56" disabled="False" group="" log="False" position="0" action="Accept" direction="Inbound" comment="Created during import of  line 11">
             <Src neg="False">
-              <ObjectRef ref="id482"/>
+              <ObjectRef ref="id469"/>
             </Src>
             <Dst neg="False">
-              <ObjectRef ref="id47"/>
+              <ObjectRef ref="id52"/>
             </Dst>
             <Srv neg="False">
               <ServiceRef ref="sysid1"/>
@@ -512,12 +518,12 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id63" disabled="False" group="" log="False" position="1" action="Accept" direction="Inbound" comment="Created during import of  line 12&#10;import of 'interface:broadcast' is not supported.">
+          <PolicyRule id="id68" disabled="False" group="" log="False" position="1" action="Accept" direction="Inbound" comment="Created during import of  line 12&#10;import of 'interface:broadcast' is not supported.">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
             <Dst neg="False">
-              <ObjectRef ref="id47"/>
+              <ObjectRef ref="id52"/>
             </Dst>
             <Srv neg="False">
               <ServiceRef ref="sysid1"/>
@@ -533,12 +539,12 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id75" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="Created during import of  line 13&#10;import of 'interface:peer' is not supported.">
+          <PolicyRule id="id80" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="Created during import of  line 13&#10;import of 'interface:peer' is not supported.">
             <Src neg="False">
-              <ObjectRef ref="id481"/>
+              <ObjectRef ref="id468"/>
             </Src>
             <Dst neg="False">
-              <ObjectRef ref="id47"/>
+              <ObjectRef ref="id52"/>
             </Dst>
             <Srv neg="False">
               <ServiceRef ref="sysid1"/>
@@ -554,12 +560,12 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id87" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Created during import of  line 14&#10;import of 'interface:0' is not supported.">
+          <PolicyRule id="id92" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Created during import of  line 14&#10;import of 'interface:0' is not supported.">
             <Src neg="False">
-              <ObjectRef ref="id481"/>
+              <ObjectRef ref="id468"/>
             </Src>
             <Dst neg="False">
-              <ObjectRef ref="id47"/>
+              <ObjectRef ref="id52"/>
             </Dst>
             <Srv neg="False">
               <ServiceRef ref="sysid1"/>
@@ -575,7 +581,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id99" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Created during import of  line 16">
+          <PolicyRule id="id104" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Created during import of  line 16">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -595,12 +601,12 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id111" disabled="False" group="" log="False" position="5" action="Accept" direction="Inbound" comment="Created during import of  line 17">
+          <PolicyRule id="id116" disabled="False" group="" log="False" position="5" action="Accept" direction="Inbound" comment="Created during import of  line 17">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
             <Dst neg="False">
-              <ObjectRef ref="id27"/>
+              <ObjectRef ref="id36"/>
             </Dst>
             <Srv neg="False">
               <ServiceRef ref="sysid1"/>
@@ -615,15 +621,15 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id123" disabled="False" group="" log="False" position="6" action="Accept" direction="Inbound" comment="Created during import of  line 18">
+          <PolicyRule id="id128" disabled="False" group="" log="False" position="6" action="Accept" direction="Inbound" comment="Created during import of  line 18">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
             <Dst neg="False">
-              <ObjectRef ref="id481"/>
+              <ObjectRef ref="id468"/>
             </Dst>
             <Srv neg="False">
-              <ServiceRef ref="id38"/>
+              <ServiceRef ref="id43"/>
             </Srv>
             <Itf neg="False">
               <ObjectRef ref="sysid0"/>
@@ -635,15 +641,15 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id135" disabled="False" group="" log="False" position="7" action="Accept" direction="Inbound" comment="Created during import of  line 19">
+          <PolicyRule id="id140" disabled="False" group="" log="False" position="7" action="Accept" direction="Inbound" comment="Created during import of  line 19">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
             <Dst neg="False">
-              <ObjectRef ref="id481"/>
+              <ObjectRef ref="id468"/>
             </Dst>
             <Srv neg="False">
-              <ServiceRef ref="id38"/>
+              <ServiceRef ref="id43"/>
             </Srv>
             <Itf neg="False">
               <ObjectRef ref="sysid0"/>
@@ -655,7 +661,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id147" disabled="False" group="" log="False" position="8" action="Accept" direction="Inbound" comment="Created during import of  line 20">
+          <PolicyRule id="id152" disabled="False" group="" log="False" position="8" action="Accept" direction="Inbound" comment="Created during import of  line 20">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -663,7 +669,7 @@
               <ObjectRef ref="id6"/>
             </Dst>
             <Srv neg="False">
-              <ServiceRef ref="id38"/>
+              <ServiceRef ref="id43"/>
             </Srv>
             <Itf neg="False">
               <ObjectRef ref="sysid0"/>
@@ -675,15 +681,15 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id159" disabled="False" group="" log="False" position="9" action="Accept" direction="Inbound" comment="Created during import of  line 21">
+          <PolicyRule id="id164" disabled="False" group="" log="False" position="9" action="Accept" direction="Inbound" comment="Created during import of  line 21">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
             <Dst neg="False">
-              <ObjectRef ref="id47"/>
+              <ObjectRef ref="id52"/>
             </Dst>
             <Srv neg="False">
-              <ServiceRef ref="id39"/>
+              <ServiceRef ref="id44"/>
             </Srv>
             <Itf neg="False">
               <ObjectRef ref="sysid0"/>
@@ -695,7 +701,87 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id171" disabled="False" group="" log="False" position="10" action="Accept" direction="Inbound" comment="Created during import of  line 22">
+          <PolicyRule id="id176" disabled="False" group="" log="False" position="10" action="Accept" direction="Inbound" comment="Created during import of  line 22">
+            <Src neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="id16"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id188" disabled="False" group="" log="False" position="11" action="Accept" direction="Inbound" comment="Created during import of  line 23">
+            <Src neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="id20"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id200" disabled="False" group="" log="False" position="12" action="Accept" direction="Inbound" comment="Created during import of  line 24">
+            <Src neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="id23"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id212" disabled="False" group="" log="False" position="13" action="Accept" direction="Inbound" comment="Created during import of  line 25">
+            <Src neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="id26"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id224" disabled="False" group="" log="False" position="14" action="Accept" direction="Inbound" comment="Created during import of  line 26">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -715,15 +801,15 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id183" disabled="False" group="" log="False" position="11" action="Accept" direction="Inbound" comment="Created during import of  line 23">
+          <PolicyRule id="id236" disabled="False" group="" log="False" position="15" action="Accept" direction="Inbound" comment="Created during import of  line 27">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
             <Dst neg="False">
-              <ObjectRef ref="id15"/>
+              <ObjectRef ref="id11"/>
             </Dst>
             <Srv neg="False">
-              <ServiceRef ref="sysid1"/>
+              <ServiceRef ref="id44"/>
             </Srv>
             <Itf neg="False">
               <ObjectRef ref="sysid0"/>
@@ -735,104 +821,15 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id195" disabled="False" group="" log="False" position="12" action="Accept" direction="Inbound" comment="Created during import of  line 24">
+          <PolicyRule id="id248" disabled="False" group="" log="False" position="16" action="Accept" direction="Inbound" comment="Created during import of  line 28">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
             <Dst neg="False">
-              <ObjectRef ref="id18"/>
+              <ObjectRef ref="id11"/>
             </Dst>
             <Srv neg="False">
-              <ServiceRef ref="sysid1"/>
-            </Srv>
-            <Itf neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Itf>
-            <When neg="False">
-              <IntervalRef ref="sysid2"/>
-            </When>
-            <PolicyRuleOptions>
-              <Option name="stateless">True</Option>
-            </PolicyRuleOptions>
-          </PolicyRule>
-          <PolicyRule id="id207" disabled="False" group="" log="False" position="13" action="Accept" direction="Inbound" comment="Created during import of  line 25">
-            <Src neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Src>
-            <Dst neg="False">
-              <ObjectRef ref="id21"/>
-            </Dst>
-            <Srv neg="False">
-              <ServiceRef ref="sysid1"/>
-            </Srv>
-            <Itf neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Itf>
-            <When neg="False">
-              <IntervalRef ref="sysid2"/>
-            </When>
-            <PolicyRuleOptions>
-              <Option name="stateless">True</Option>
-            </PolicyRuleOptions>
-          </PolicyRule>
-          <PolicyRule id="id219" disabled="False" group="" log="False" position="14" action="Accept" direction="Inbound" comment="Created during import of  line 26">
-            <Src neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Src>
-            <Dst neg="False">
-              <ObjectRef ref="id28"/>
-              <ObjectRef ref="id29"/>
-              <ObjectRef ref="id30"/>
-              <ObjectRef ref="id31"/>
-            </Dst>
-            <Srv neg="False">
-              <ServiceRef ref="sysid1"/>
-            </Srv>
-            <Itf neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Itf>
-            <When neg="False">
-              <IntervalRef ref="sysid2"/>
-            </When>
-            <PolicyRuleOptions>
-              <Option name="stateless">True</Option>
-            </PolicyRuleOptions>
-          </PolicyRule>
-          <PolicyRule id="id234" disabled="False" group="" log="False" position="15" action="Accept" direction="Inbound" comment="Created during import of  line 27">
-            <Src neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Src>
-            <Dst neg="False">
-              <ObjectRef ref="id28"/>
-              <ObjectRef ref="id29"/>
-              <ObjectRef ref="id30"/>
-              <ObjectRef ref="id31"/>
-            </Dst>
-            <Srv neg="False">
-              <ServiceRef ref="id39"/>
-            </Srv>
-            <Itf neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Itf>
-            <When neg="False">
-              <IntervalRef ref="sysid2"/>
-            </When>
-            <PolicyRuleOptions>
-              <Option name="stateless">True</Option>
-            </PolicyRuleOptions>
-          </PolicyRule>
-          <PolicyRule id="id249" disabled="False" group="" log="False" position="16" action="Accept" direction="Inbound" comment="Created during import of  line 28">
-            <Src neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Src>
-            <Dst neg="False">
-              <ObjectRef ref="id28"/>
-              <ObjectRef ref="id29"/>
-              <ObjectRef ref="id30"/>
-              <ObjectRef ref="id31"/>
-            </Dst>
-            <Srv neg="False">
-              <ServiceRef ref="id39"/>
+              <ServiceRef ref="id44"/>
             </Srv>
             <Itf neg="False">
               <ObjectRef ref="sysid0"/>
@@ -844,7 +841,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id264" disabled="False" group="" log="False" position="17" action="Accept" direction="Inbound" comment="Created during import of  line 30&#10;IPv6 import is not supported. ">
+          <PolicyRule id="id260" disabled="False" group="" log="False" position="17" action="Accept" direction="Inbound" comment="Created during import of  line 30&#10;IPv6 import is not supported. ">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -865,7 +862,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id276" disabled="False" group="" log="False" position="18" action="Accept" direction="Inbound" comment="Created during import of  line 31">
+          <PolicyRule id="id272" disabled="False" group="" log="False" position="18" action="Accept" direction="Inbound" comment="Created during import of  line 31">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -885,7 +882,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id288" disabled="False" group="" log="False" position="19" action="Accept" direction="Inbound" comment="Created during import of  line 33">
+          <PolicyRule id="id284" disabled="False" group="" log="False" position="19" action="Accept" direction="Inbound" comment="Created during import of  line 33">
             <Src neg="False">
               <ObjectRef ref="id3"/>
             </Src>
@@ -905,9 +902,9 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id300" disabled="False" group="" log="False" position="20" action="Accept" direction="Inbound" comment="Created during import of  line 34">
+          <PolicyRule id="id296" disabled="False" group="" log="False" position="20" action="Accept" direction="Inbound" comment="Created during import of  line 34">
             <Src neg="False">
-              <ObjectRef ref="id27"/>
+              <ObjectRef ref="id36"/>
             </Src>
             <Dst neg="False">
               <ObjectRef ref="sysid0"/>
@@ -925,15 +922,15 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id312" disabled="False" group="" log="False" position="21" action="Accept" direction="Inbound" comment="Created during import of  line 35">
+          <PolicyRule id="id308" disabled="False" group="" log="False" position="21" action="Accept" direction="Inbound" comment="Created during import of  line 35">
             <Src neg="False">
-              <ObjectRef ref="id481"/>
+              <ObjectRef ref="id468"/>
             </Src>
             <Dst neg="False">
               <ObjectRef ref="sysid0"/>
             </Dst>
             <Srv neg="False">
-              <ServiceRef ref="id40"/>
+              <ServiceRef ref="id45"/>
             </Srv>
             <Itf neg="False">
               <ObjectRef ref="sysid0"/>
@@ -945,15 +942,15 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id324" disabled="False" group="" log="False" position="22" action="Accept" direction="Inbound" comment="Created during import of  line 36">
+          <PolicyRule id="id320" disabled="False" group="" log="False" position="22" action="Accept" direction="Inbound" comment="Created during import of  line 36">
             <Src neg="False">
-              <ObjectRef ref="id481"/>
+              <ObjectRef ref="id468"/>
             </Src>
             <Dst neg="False">
               <ObjectRef ref="sysid0"/>
             </Dst>
             <Srv neg="False">
-              <ServiceRef ref="id40"/>
+              <ServiceRef ref="id45"/>
             </Srv>
             <Itf neg="False">
               <ObjectRef ref="sysid0"/>
@@ -965,7 +962,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id336" disabled="False" group="" log="False" position="23" action="Accept" direction="Inbound" comment="Created during import of  line 37">
+          <PolicyRule id="id332" disabled="False" group="" log="False" position="23" action="Accept" direction="Inbound" comment="Created during import of  line 37">
             <Src neg="False">
               <ObjectRef ref="id6"/>
             </Src>
@@ -973,7 +970,7 @@
               <ObjectRef ref="sysid0"/>
             </Dst>
             <Srv neg="False">
-              <ServiceRef ref="id40"/>
+              <ServiceRef ref="id45"/>
             </Srv>
             <Itf neg="False">
               <ObjectRef ref="sysid0"/>
@@ -985,15 +982,15 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id348" disabled="False" group="" log="False" position="24" action="Accept" direction="Inbound" comment="Created during import of  line 38">
+          <PolicyRule id="id344" disabled="False" group="" log="False" position="24" action="Accept" direction="Inbound" comment="Created during import of  line 38">
             <Src neg="False">
-              <ObjectRef ref="id47"/>
+              <ObjectRef ref="id52"/>
             </Src>
             <Dst neg="False">
               <ObjectRef ref="sysid0"/>
             </Dst>
             <Srv neg="False">
-              <ServiceRef ref="id41"/>
+              <ServiceRef ref="id46"/>
             </Srv>
             <Itf neg="False">
               <ObjectRef ref="sysid0"/>
@@ -1005,7 +1002,87 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id360" disabled="False" group="" log="False" position="25" action="Accept" direction="Inbound" comment="Created during import of  line 39">
+          <PolicyRule id="id356" disabled="False" group="" log="False" position="25" action="Accept" direction="Inbound" comment="Created during import of  line 39">
+            <Src neg="False">
+              <ObjectRef ref="id16"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id368" disabled="False" group="" log="False" position="26" action="Accept" direction="Inbound" comment="Created during import of  line 40">
+            <Src neg="False">
+              <ObjectRef ref="id20"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id380" disabled="False" group="" log="False" position="27" action="Accept" direction="Inbound" comment="Created during import of  line 41">
+            <Src neg="False">
+              <ObjectRef ref="id23"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id392" disabled="False" group="" log="False" position="28" action="Accept" direction="Inbound" comment="Created during import of  line 42">
+            <Src neg="False">
+              <ObjectRef ref="id26"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id404" disabled="False" group="" log="False" position="29" action="Accept" direction="Inbound" comment="Created during import of  line 43">
             <Src neg="False">
               <ObjectRef ref="id11"/>
             </Src>
@@ -1025,15 +1102,15 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id372" disabled="False" group="" log="False" position="26" action="Accept" direction="Inbound" comment="Created during import of  line 40">
+          <PolicyRule id="id416" disabled="False" group="" log="False" position="30" action="Accept" direction="Inbound" comment="Created during import of  line 44">
             <Src neg="False">
-              <ObjectRef ref="id15"/>
+              <ObjectRef ref="id11"/>
             </Src>
             <Dst neg="False">
               <ObjectRef ref="sysid0"/>
             </Dst>
             <Srv neg="False">
-              <ServiceRef ref="sysid1"/>
+              <ServiceRef ref="id46"/>
             </Srv>
             <Itf neg="False">
               <ObjectRef ref="sysid0"/>
@@ -1045,104 +1122,15 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id384" disabled="False" group="" log="False" position="27" action="Accept" direction="Inbound" comment="Created during import of  line 41">
+          <PolicyRule id="id428" disabled="False" group="" log="False" position="31" action="Accept" direction="Inbound" comment="Created during import of  line 45">
             <Src neg="False">
-              <ObjectRef ref="id18"/>
+              <ObjectRef ref="id11"/>
             </Src>
             <Dst neg="False">
               <ObjectRef ref="sysid0"/>
             </Dst>
             <Srv neg="False">
-              <ServiceRef ref="sysid1"/>
-            </Srv>
-            <Itf neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Itf>
-            <When neg="False">
-              <IntervalRef ref="sysid2"/>
-            </When>
-            <PolicyRuleOptions>
-              <Option name="stateless">True</Option>
-            </PolicyRuleOptions>
-          </PolicyRule>
-          <PolicyRule id="id396" disabled="False" group="" log="False" position="28" action="Accept" direction="Inbound" comment="Created during import of  line 42">
-            <Src neg="False">
-              <ObjectRef ref="id21"/>
-            </Src>
-            <Dst neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Dst>
-            <Srv neg="False">
-              <ServiceRef ref="sysid1"/>
-            </Srv>
-            <Itf neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Itf>
-            <When neg="False">
-              <IntervalRef ref="sysid2"/>
-            </When>
-            <PolicyRuleOptions>
-              <Option name="stateless">True</Option>
-            </PolicyRuleOptions>
-          </PolicyRule>
-          <PolicyRule id="id408" disabled="False" group="" log="False" position="29" action="Accept" direction="Inbound" comment="Created during import of  line 43">
-            <Src neg="False">
-              <ObjectRef ref="id28"/>
-              <ObjectRef ref="id29"/>
-              <ObjectRef ref="id30"/>
-              <ObjectRef ref="id31"/>
-            </Src>
-            <Dst neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Dst>
-            <Srv neg="False">
-              <ServiceRef ref="sysid1"/>
-            </Srv>
-            <Itf neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Itf>
-            <When neg="False">
-              <IntervalRef ref="sysid2"/>
-            </When>
-            <PolicyRuleOptions>
-              <Option name="stateless">True</Option>
-            </PolicyRuleOptions>
-          </PolicyRule>
-          <PolicyRule id="id423" disabled="False" group="" log="False" position="30" action="Accept" direction="Inbound" comment="Created during import of  line 44">
-            <Src neg="False">
-              <ObjectRef ref="id28"/>
-              <ObjectRef ref="id29"/>
-              <ObjectRef ref="id30"/>
-              <ObjectRef ref="id31"/>
-            </Src>
-            <Dst neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Dst>
-            <Srv neg="False">
-              <ServiceRef ref="id41"/>
-            </Srv>
-            <Itf neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Itf>
-            <When neg="False">
-              <IntervalRef ref="sysid2"/>
-            </When>
-            <PolicyRuleOptions>
-              <Option name="stateless">True</Option>
-            </PolicyRuleOptions>
-          </PolicyRule>
-          <PolicyRule id="id438" disabled="False" group="" log="False" position="31" action="Accept" direction="Inbound" comment="Created during import of  line 45">
-            <Src neg="False">
-              <ObjectRef ref="id28"/>
-              <ObjectRef ref="id29"/>
-              <ObjectRef ref="id30"/>
-              <ObjectRef ref="id31"/>
-            </Src>
-            <Dst neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Dst>
-            <Srv neg="False">
-              <ServiceRef ref="id41"/>
+              <ServiceRef ref="id46"/>
             </Srv>
             <Itf neg="False">
               <ObjectRef ref="sysid0"/>
@@ -1154,7 +1142,7 @@
               <Option name="stateless">False</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id453" disabled="False" group="" log="False" position="32" action="Accept" direction="Inbound" comment="Created during import of  line 47&#10;IPv6 import is not supported. ">
+          <PolicyRule id="id440" disabled="False" group="" log="False" position="32" action="Accept" direction="Inbound" comment="Created during import of  line 47&#10;IPv6 import is not supported. ">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -1175,7 +1163,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id465" disabled="False" group="" log="False" position="33" action="Accept" direction="Inbound" comment="Created during import of  line 48">
+          <PolicyRule id="id452" disabled="False" group="" log="False" position="33" action="Accept" direction="Inbound" comment="Created during import of  line 48">
             <Src neg="False">
               <ObjectRef ref="id8"/>
             </Src>
@@ -1197,12 +1185,12 @@
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
-        <Routing id="id479" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
+        <Routing id="id466" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
           <RuleSetOptions/>
         </Routing>
-        <Interface id="id481" dedicated_failover="False" dyn="True" security_level="0" unnum="False" unprotected="False" name="pcn0" comment="Created during import of  line 6" ro="False">
+        <Interface id="id468" dedicated_failover="False" dyn="True" security_level="0" unnum="False" unprotected="False" name="pcn0" comment="Created during import of  line 6" ro="False">
           <InterfaceOptions/>
-          <AttachedNetworks id="id482" name="pcn0-net" comment="" ro="False"/>
+          <AttachedNetworks id="id469" name="pcn0-net" comment="" ro="False"/>
         </Interface>
         <FirewallOptions>
           <Option name="check_shading">true</Option>
@@ -1222,7 +1210,7 @@
         </FirewallOptions>
       </Firewall>
     </ObjectGroup>
-    <ObjectGroup id="id484" name="Clusters" comment="" ro="False"/>
-    <IntervalGroup id="id485" name="Time" comment="" ro="False"/>
+    <ObjectGroup id="id471" name="Clusters" comment="" ro="False"/>
+    <IntervalGroup id="id472" name="Time" comment="" ro="False"/>
   </Library>
 </FWObjectDatabase>
diff --git a/src/unit_tests/PFImporterTest/test_data/pf-hosts-matches.output b/src/unit_tests/PFImporterTest/test_data/pf-hosts-matches.output
index 22a370f9f..385f2a480 100644
--- a/src/unit_tests/PFImporterTest/test_data/pf-hosts-matches.output
+++ b/src/unit_tests/PFImporterTest/test_data/pf-hosts-matches.output
@@ -1,3 +1,4 @@
+2: Address Table: <addr_list_macro>:  10.123.12.32/27, 10.123.14.8/27, 10.123.10.16/28, 10.123.0.0/24
 5: Address Table: <dst_addresses_1>:  192.168.1.1, 192.168.1.2, 192.168.2.0/24
 6: Address Table: <dst_addresses_2>:  pcn0, pcn0
 6: New interface: pcn0
diff --git a/src/unit_tests/PFImporterTest/test_data/pf-macros.conf b/src/unit_tests/PFImporterTest/test_data/pf-macros.conf
index 5a47e80f8..026de83da 100644
--- a/src/unit_tests/PFImporterTest/test_data/pf-macros.conf
+++ b/src/unit_tests/PFImporterTest/test_data/pf-macros.conf
@@ -1,11 +1,20 @@
 
 one_address = 10.1.1.1   # comment is allowed here
 addr_list_1 = "{ 10.123.12.32/27 10.123.14.8/27 10.123.10.16/28 10.123.0.0/24 }"
-# another macro is used inside this one recursively
+# another macro is used inside this one recursively and only {} are in quotes
 addr_list_2 = "{" $one_address 10.123.12.32/27 10.123.14.8/27 10.123.10.16/28 10.123.0.0/24 "}"
+# now use comma as a separator
+addr_list_3 = "{" $one_address, 10.123.12.33/27, 10.123.14.9/27 "}"
+# spaces are mixed with tabs and messed up
+addr_list_4 = "{$one_address,	 10.123.12.34/27,		 10.123.14.10/27}"
+
+# multi-line
+addr_list_5 = "{$one_address, \
+                10.123.12.35/27,\
+                10.123.14.11/27}"
+
 # another macro name is a substring of this one's name
 addr_list_1_foo = "{ 10.1.2.3 10.4.5.6 10.7.8.9 }"
-baddies = "{" 192.168.1.1 192.168.1.2 "}"  # this works, too
 
 host1 = "192.168.1.1"
 host2 = "192.168.1.2"
@@ -13,6 +22,12 @@ recursive_macro = "{" $host1 $host2 "}"
 tcp_services = "{ ssh, smtp }"
 ext_if = "em1"
 
+mixed_macro_1 = "{ $host1 192.168.2.1 www.fwbuilder.org }"
+mixed_macro_2 = "{ $host1 192.168.2.1 em1 }"
+mixed_macro_3 = "{ $host1 192.168.2.1 em1:network }"
+mixed_macro_4 = "{ em1:network www.fwbuilder.org }"
+
+
 pass in quick from any to $one_address
 
 pass in quick from any to { 10.11.11.11 $one_address }
@@ -26,8 +41,14 @@ pass in quick from any to {$one_address , 10.18.18.18 }
 
 pass in quick from any to $addr_list_1
 pass in quick from any to $addr_list_2
+pass in quick from any to $addr_list_3
+pass in quick from any to $addr_list_4
+pass in quick from any to $addr_list_5
 pass in quick from any to $addr_list_1_foo
 
-block in from $baddies to any
-
 pass out quick on $ext_if proto tcp to $recursive_macro port $tcp_services
+
+pass in quick on $ext_if proto tcp from any to $mixed_macro_1 port 80
+pass in quick on $ext_if proto tcp from any to $mixed_macro_2 port 80
+pass in quick on $ext_if proto tcp from any to $mixed_macro_3 port 80
+pass in quick on $ext_if proto tcp from any to $mixed_macro_4 port 80
diff --git a/src/unit_tests/PFImporterTest/test_data/pf-macros.fwb b/src/unit_tests/PFImporterTest/test_data/pf-macros.fwb
index d15fbad12..beb43efda 100644
--- a/src/unit_tests/PFImporterTest/test_data/pf-macros.fwb
+++ b/src/unit_tests/PFImporterTest/test_data/pf-macros.fwb
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
-<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="22" lastModified="1309979482" id="root">
+<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="22" lastModified="1310080604" id="root">
   <Library id="syslib000" color="#d4f8ff" name="Standard" comment="Standard objects" ro="True">
     <AnyNetwork id="sysid0" name="Any" comment="Any Network" ro="False" address="0.0.0.0" netmask="0.0.0.0"/>
     <AnyIPService id="sysid1" protocol_num="0" name="Any" comment="Any IP Service" ro="False"/>
@@ -432,53 +432,116 @@
   <Library id="id0" name="User" comment="" ro="False">
     <ObjectGroup id="id1" name="Objects" comment="" ro="False">
       <ObjectGroup id="id2" name="Addresses" comment="" ro="False">
-        <IPv4 id="id3" name="h-10.1.1.1" comment="Created during import of  line 16" ro="False" address="10.1.1.1" netmask="255.255.255.255"/>
-        <IPv4 id="id4" name="h-10.11.11.11" comment="Created during import of  line 18" ro="False" address="10.11.11.11" netmask="255.255.255.255"/>
-        <IPv4 id="id5" name="h-10.12.12.12" comment="Created during import of  line 19" ro="False" address="10.12.12.12" netmask="255.255.255.255"/>
-        <IPv4 id="id6" name="h-10.13.13.13" comment="Created during import of  line 20" ro="False" address="10.13.13.13" netmask="255.255.255.255"/>
-        <IPv4 id="id7" name="h-10.14.14.14" comment="Created during import of  line 21" ro="False" address="10.14.14.14" netmask="255.255.255.255"/>
-        <IPv4 id="id8" name="h-10.15.15.15" comment="Created during import of  line 22" ro="False" address="10.15.15.15" netmask="255.255.255.255"/>
-        <IPv4 id="id9" name="h-10.16.16.16" comment="Created during import of  line 23" ro="False" address="10.16.16.16" netmask="255.255.255.255"/>
-        <IPv4 id="id10" name="h-10.17.17.17" comment="Created during import of  line 24" ro="False" address="10.17.17.17" netmask="255.255.255.255"/>
-        <IPv4 id="id11" name="h-10.18.18.18" comment="Created during import of  line 25" ro="False" address="10.18.18.18" netmask="255.255.255.255"/>
-        <IPv4 id="id12" name="h-10.1.2.3" comment="Created during import of  line 29" ro="False" address="10.1.2.3" netmask="255.255.255.255"/>
-        <IPv4 id="id13" name="h-10.4.5.6" comment="Created during import of  line 29" ro="False" address="10.4.5.6" netmask="255.255.255.255"/>
-        <IPv4 id="id14" name="h-10.7.8.9" comment="Created during import of  line 29" ro="False" address="10.7.8.9" netmask="255.255.255.255"/>
-        <IPv4 id="id15" name="h-192.168.1.1" comment="Created during import of  line 31" ro="False" address="192.168.1.1" netmask="255.255.255.255"/>
-        <IPv4 id="id16" name="h-192.168.1.2" comment="Created during import of  line 31" ro="False" address="192.168.1.2" netmask="255.255.255.255"/>
+        <IPv4 id="id3" name="h-10.1.1.1" comment="Created during import of  line 5" ro="False" address="10.1.1.1" netmask="255.255.255.255"/>
+        <IPv4 id="id4" name="h-10.1.2.3" comment="Created during import of  line 15" ro="False" address="10.1.2.3" netmask="255.255.255.255"/>
+        <IPv4 id="id5" name="h-10.4.5.6" comment="Created during import of  line 15" ro="False" address="10.4.5.6" netmask="255.255.255.255"/>
+        <IPv4 id="id6" name="h-10.7.8.9" comment="Created during import of  line 15" ro="False" address="10.7.8.9" netmask="255.255.255.255"/>
+        <IPv4 id="id7" name="h-192.168.1.1" comment="Created during import of  line 19" ro="False" address="192.168.1.1" netmask="255.255.255.255"/>
+        <IPv4 id="id8" name="h-192.168.1.2" comment="Created during import of  line 19" ro="False" address="192.168.1.2" netmask="255.255.255.255"/>
+        <IPv4 id="id9" name="h-192.168.2.1" comment="Created during import of  line 23" ro="False" address="192.168.2.1" netmask="255.255.255.255"/>
+        <IPv4 id="id10" name="h-10.11.11.11" comment="Created during import of  line 31" ro="False" address="10.11.11.11" netmask="255.255.255.255"/>
+        <IPv4 id="id11" name="h-10.12.12.12" comment="Created during import of  line 32" ro="False" address="10.12.12.12" netmask="255.255.255.255"/>
+        <IPv4 id="id12" name="h-10.13.13.13" comment="Created during import of  line 33" ro="False" address="10.13.13.13" netmask="255.255.255.255"/>
+        <IPv4 id="id13" name="h-10.14.14.14" comment="Created during import of  line 34" ro="False" address="10.14.14.14" netmask="255.255.255.255"/>
+        <IPv4 id="id14" name="h-10.15.15.15" comment="Created during import of  line 35" ro="False" address="10.15.15.15" netmask="255.255.255.255"/>
+        <IPv4 id="id15" name="h-10.16.16.16" comment="Created during import of  line 36" ro="False" address="10.16.16.16" netmask="255.255.255.255"/>
+        <IPv4 id="id16" name="h-10.17.17.17" comment="Created during import of  line 37" ro="False" address="10.17.17.17" netmask="255.255.255.255"/>
+        <IPv4 id="id17" name="h-10.18.18.18" comment="Created during import of  line 38" ro="False" address="10.18.18.18" netmask="255.255.255.255"/>
       </ObjectGroup>
-      <ObjectGroup id="id17" name="DNS Names" comment="" ro="False"/>
-      <ObjectGroup id="id18" name="Address Tables" comment="" ro="False"/>
-      <ObjectGroup id="id19" name="Groups" comment="" ro="False"/>
-      <ObjectGroup id="id20" name="Hosts" comment="" ro="False"/>
-      <ObjectGroup id="id21" name="Networks" comment="" ro="False">
-        <Network id="id22" name="net-10.123.12.32/255.255.255.224" comment="Created during import of  line 27" ro="False" address="10.123.12.32" netmask="255.255.255.224"/>
-        <Network id="id23" name="net-10.123.14.8/255.255.255.224" comment="Created during import of  line 27" ro="False" address="10.123.14.8" netmask="255.255.255.224"/>
-        <Network id="id24" name="net-10.123.10.16/255.255.255.240" comment="Created during import of  line 27" ro="False" address="10.123.10.16" netmask="255.255.255.240"/>
-        <Network id="id25" name="net-10.123.0.0/255.255.255.0" comment="Created during import of  line 27" ro="False" address="10.123.0.0" netmask="255.255.255.0"/>
+      <ObjectGroup id="id18" name="DNS Names" comment="" ro="False">
+        <DNSName id="id19" dnsrec="www.fwbuilder.org" dnsrectype="A" run_time="True" name="www.fwbuilder.org" comment="" ro="False"/>
       </ObjectGroup>
-      <ObjectGroup id="id26" name="Address Ranges" comment="" ro="False"/>
+      <ObjectGroup id="id20" name="Address Tables" comment="" ro="False"/>
+      <ObjectGroup id="id21" name="Groups" comment="" ro="False">
+        <ObjectGroup id="id22" name="addr_list_1" comment="Created during import of  line 3" ro="False">
+          <ObjectRef ref="id66"/>
+          <ObjectRef ref="id67"/>
+          <ObjectRef ref="id68"/>
+          <ObjectRef ref="id69"/>
+        </ObjectGroup>
+        <ObjectGroup id="id27" name="addr_list_2" comment="Created during import of  line 5" ro="False">
+          <ObjectRef ref="id3"/>
+          <ObjectRef ref="id66"/>
+          <ObjectRef ref="id67"/>
+          <ObjectRef ref="id68"/>
+          <ObjectRef ref="id69"/>
+        </ObjectGroup>
+        <ObjectGroup id="id33" name="addr_list_3" comment="Created during import of  line 7" ro="False">
+          <ObjectRef ref="id3"/>
+          <ObjectRef ref="id70"/>
+          <ObjectRef ref="id71"/>
+        </ObjectGroup>
+        <ObjectGroup id="id37" name="addr_list_4" comment="Created during import of  line 9" ro="False">
+          <ObjectRef ref="id3"/>
+          <ObjectRef ref="id72"/>
+          <ObjectRef ref="id73"/>
+        </ObjectGroup>
+        <ObjectGroup id="id41" name="addr_list_5" comment="Created during import of  line 12" ro="False">
+          <ObjectRef ref="id3"/>
+          <ObjectRef ref="id74"/>
+          <ObjectRef ref="id75"/>
+        </ObjectGroup>
+        <ObjectGroup id="id45" name="addr_list_1_foo" comment="Created during import of  line 15" ro="False">
+          <ObjectRef ref="id4"/>
+          <ObjectRef ref="id5"/>
+          <ObjectRef ref="id6"/>
+        </ObjectGroup>
+        <ObjectGroup id="id49" name="recursive_macro" comment="Created during import of  line 19" ro="False">
+          <ObjectRef ref="id7"/>
+          <ObjectRef ref="id8"/>
+        </ObjectGroup>
+        <ObjectGroup id="id52" name="mixed_macro_1" comment="Created during import of  line 23" ro="False">
+          <ObjectRef ref="id7"/>
+          <ObjectRef ref="id9"/>
+          <ObjectRef ref="id19"/>
+        </ObjectGroup>
+        <ObjectGroup id="id56" name="mixed_macro_2" comment="Created during import of  line 24" ro="False">
+          <ObjectRef ref="id7"/>
+          <ObjectRef ref="id9"/>
+          <ObjectRef ref="id348"/>
+        </ObjectGroup>
+        <ObjectGroup id="id60" name="mixed_macro_3" comment="Created during import of  line 25" ro="False">
+          <ObjectRef ref="id7"/>
+          <ObjectRef ref="id9"/>
+          <ObjectRef ref="id349"/>
+        </ObjectGroup>
+      </ObjectGroup>
+      <ObjectGroup id="id64" name="Hosts" comment="" ro="False"/>
+      <ObjectGroup id="id65" name="Networks" comment="" ro="False">
+        <Network id="id66" name="net-10.123.12.32/255.255.255.224" comment="Created during import of  line 3" ro="False" address="10.123.12.32" netmask="255.255.255.224"/>
+        <Network id="id67" name="net-10.123.14.8/255.255.255.224" comment="Created during import of  line 3" ro="False" address="10.123.14.8" netmask="255.255.255.224"/>
+        <Network id="id68" name="net-10.123.10.16/255.255.255.240" comment="Created during import of  line 3" ro="False" address="10.123.10.16" netmask="255.255.255.240"/>
+        <Network id="id69" name="net-10.123.0.0/255.255.255.0" comment="Created during import of  line 3" ro="False" address="10.123.0.0" netmask="255.255.255.0"/>
+        <Network id="id70" name="net-10.123.12.33/255.255.255.224" comment="Created during import of  line 7" ro="False" address="10.123.12.33" netmask="255.255.255.224"/>
+        <Network id="id71" name="net-10.123.14.9/255.255.255.224" comment="Created during import of  line 7" ro="False" address="10.123.14.9" netmask="255.255.255.224"/>
+        <Network id="id72" name="net-10.123.12.34/255.255.255.224" comment="Created during import of  line 9" ro="False" address="10.123.12.34" netmask="255.255.255.224"/>
+        <Network id="id73" name="net-10.123.14.10/255.255.255.224" comment="Created during import of  line 9" ro="False" address="10.123.14.10" netmask="255.255.255.224"/>
+        <Network id="id74" name="net-10.123.12.35/255.255.255.224" comment="Created during import of  line 12" ro="False" address="10.123.12.35" netmask="255.255.255.224"/>
+        <Network id="id75" name="net-10.123.14.11/255.255.255.224" comment="Created during import of  line 12" ro="False" address="10.123.14.11" netmask="255.255.255.224"/>
+      </ObjectGroup>
+      <ObjectGroup id="id76" name="Address Ranges" comment="" ro="False"/>
     </ObjectGroup>
-    <ServiceGroup id="id27" name="Services" comment="" ro="False">
-      <ServiceGroup id="id28" name="Groups" comment="" ro="False"/>
-      <ServiceGroup id="id29" name="ICMP" comment="" ro="False"/>
-      <ServiceGroup id="id30" name="IP" comment="" ro="False"/>
-      <ServiceGroup id="id31" name="TCP" comment="" ro="False">
-        <TCPService id="id32" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="tcp 0:0 / 22:22" comment="Created during import of  line 33" ro="False" src_range_start="0" src_range_end="0" dst_range_start="22" dst_range_end="22"/>
-        <TCPService id="id33" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="tcp 0:0 / 25:25" comment="Created during import of  line 33" ro="False" src_range_start="0" src_range_end="0" dst_range_start="25" dst_range_end="25"/>
+    <ServiceGroup id="id77" name="Services" comment="" ro="False">
+      <ServiceGroup id="id78" name="Groups" comment="" ro="False"/>
+      <ServiceGroup id="id79" name="ICMP" comment="" ro="False"/>
+      <ServiceGroup id="id80" name="IP" comment="" ro="False"/>
+      <ServiceGroup id="id81" name="TCP" comment="" ro="False">
+        <TCPService id="id82" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="tcp 0:0 / 22:22" comment="Created during import of  line 47" ro="False" src_range_start="0" src_range_end="0" dst_range_start="22" dst_range_end="22"/>
+        <TCPService id="id83" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="tcp 0:0 / 25:25" comment="Created during import of  line 47" ro="False" src_range_start="0" src_range_end="0" dst_range_start="25" dst_range_end="25"/>
+        <TCPService id="id84" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="tcp 0:0 / 80:80" comment="Created during import of  line 49" ro="False" src_range_start="0" src_range_end="0" dst_range_start="80" dst_range_end="80"/>
       </ServiceGroup>
-      <ServiceGroup id="id34" name="UDP" comment="" ro="False"/>
-      <ServiceGroup id="id35" name="Users" comment="" ro="False"/>
-      <ServiceGroup id="id36" name="Custom" comment="" ro="False"/>
-      <ServiceGroup id="id37" name="TagServices" comment="" ro="False"/>
+      <ServiceGroup id="id85" name="UDP" comment="" ro="False"/>
+      <ServiceGroup id="id86" name="Users" comment="" ro="False"/>
+      <ServiceGroup id="id87" name="Custom" comment="" ro="False"/>
+      <ServiceGroup id="id88" name="TagServices" comment="" ro="False"/>
     </ServiceGroup>
-    <ObjectGroup id="id38" name="Firewalls" comment="" ro="False">
-      <Firewall id="id39" host_OS="freebsd" lastCompiled="0" lastInstalled="0" lastModified="0" platform="pf" name="test_fw" comment="Created during import of  line 16" ro="False">
-        <NAT id="id231" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
+    <ObjectGroup id="id89" name="Firewalls" comment="" ro="False">
+      <Firewall id="id90" host_OS="freebsd" lastCompiled="0" lastInstalled="0" lastModified="0" platform="pf" name="test_fw" comment="Created during import of  line 24" ro="False">
+        <NAT id="id344" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
           <RuleSetOptions/>
         </NAT>
-        <Policy id="id41" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id43" disabled="False" group="" log="False" position="0" action="Accept" direction="Inbound" comment="Created during import of  line 16">
+        <Policy id="id92" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id94" disabled="False" group="" log="False" position="0" action="Accept" direction="Inbound" comment="Created during import of  line 29">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -498,139 +561,13 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id55" disabled="False" group="" log="False" position="1" action="Accept" direction="Inbound" comment="Created during import of  line 18">
+          <PolicyRule id="id106" disabled="False" group="" log="False" position="1" action="Accept" direction="Inbound" comment="Created during import of  line 31">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
             <Dst neg="False">
-              <ObjectRef ref="id4"/>
-              <ObjectRef ref="id3"/>
-            </Dst>
-            <Srv neg="False">
-              <ServiceRef ref="sysid1"/>
-            </Srv>
-            <Itf neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Itf>
-            <When neg="False">
-              <IntervalRef ref="sysid2"/>
-            </When>
-            <PolicyRuleOptions>
-              <Option name="stateless">True</Option>
-            </PolicyRuleOptions>
-          </PolicyRule>
-          <PolicyRule id="id68" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="Created during import of  line 19">
-            <Src neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Src>
-            <Dst neg="False">
-              <ObjectRef ref="id5"/>
-              <ObjectRef ref="id3"/>
-            </Dst>
-            <Srv neg="False">
-              <ServiceRef ref="sysid1"/>
-            </Srv>
-            <Itf neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Itf>
-            <When neg="False">
-              <IntervalRef ref="sysid2"/>
-            </When>
-            <PolicyRuleOptions>
-              <Option name="stateless">True</Option>
-            </PolicyRuleOptions>
-          </PolicyRule>
-          <PolicyRule id="id81" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Created during import of  line 20">
-            <Src neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Src>
-            <Dst neg="False">
-              <ObjectRef ref="id6"/>
-              <ObjectRef ref="id3"/>
-            </Dst>
-            <Srv neg="False">
-              <ServiceRef ref="sysid1"/>
-            </Srv>
-            <Itf neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Itf>
-            <When neg="False">
-              <IntervalRef ref="sysid2"/>
-            </When>
-            <PolicyRuleOptions>
-              <Option name="stateless">True</Option>
-            </PolicyRuleOptions>
-          </PolicyRule>
-          <PolicyRule id="id94" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Created during import of  line 21">
-            <Src neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Src>
-            <Dst neg="False">
-              <ObjectRef ref="id3"/>
-              <ObjectRef ref="id7"/>
-            </Dst>
-            <Srv neg="False">
-              <ServiceRef ref="sysid1"/>
-            </Srv>
-            <Itf neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Itf>
-            <When neg="False">
-              <IntervalRef ref="sysid2"/>
-            </When>
-            <PolicyRuleOptions>
-              <Option name="stateless">True</Option>
-            </PolicyRuleOptions>
-          </PolicyRule>
-          <PolicyRule id="id107" disabled="False" group="" log="False" position="5" action="Accept" direction="Inbound" comment="Created during import of  line 22">
-            <Src neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Src>
-            <Dst neg="False">
-              <ObjectRef ref="id3"/>
-              <ObjectRef ref="id8"/>
-            </Dst>
-            <Srv neg="False">
-              <ServiceRef ref="sysid1"/>
-            </Srv>
-            <Itf neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Itf>
-            <When neg="False">
-              <IntervalRef ref="sysid2"/>
-            </When>
-            <PolicyRuleOptions>
-              <Option name="stateless">True</Option>
-            </PolicyRuleOptions>
-          </PolicyRule>
-          <PolicyRule id="id120" disabled="False" group="" log="False" position="6" action="Accept" direction="Inbound" comment="Created during import of  line 23">
-            <Src neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Src>
-            <Dst neg="False">
-              <ObjectRef ref="id3"/>
-              <ObjectRef ref="id9"/>
-            </Dst>
-            <Srv neg="False">
-              <ServiceRef ref="sysid1"/>
-            </Srv>
-            <Itf neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Itf>
-            <When neg="False">
-              <IntervalRef ref="sysid2"/>
-            </When>
-            <PolicyRuleOptions>
-              <Option name="stateless">True</Option>
-            </PolicyRuleOptions>
-          </PolicyRule>
-          <PolicyRule id="id133" disabled="False" group="" log="False" position="7" action="Accept" direction="Inbound" comment="Created during import of  line 24">
-            <Src neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Src>
-            <Dst neg="False">
-              <ObjectRef ref="id3"/>
               <ObjectRef ref="id10"/>
+              <ObjectRef ref="id3"/>
             </Dst>
             <Srv neg="False">
               <ServiceRef ref="sysid1"/>
@@ -645,60 +582,13 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id146" disabled="False" group="" log="False" position="8" action="Accept" direction="Inbound" comment="Created during import of  line 25">
+          <PolicyRule id="id119" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="Created during import of  line 32">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
             <Dst neg="False">
-              <ObjectRef ref="id3"/>
               <ObjectRef ref="id11"/>
-            </Dst>
-            <Srv neg="False">
-              <ServiceRef ref="sysid1"/>
-            </Srv>
-            <Itf neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Itf>
-            <When neg="False">
-              <IntervalRef ref="sysid2"/>
-            </When>
-            <PolicyRuleOptions>
-              <Option name="stateless">True</Option>
-            </PolicyRuleOptions>
-          </PolicyRule>
-          <PolicyRule id="id159" disabled="False" group="" log="False" position="9" action="Accept" direction="Inbound" comment="Created during import of  line 27">
-            <Src neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Src>
-            <Dst neg="False">
-              <ObjectRef ref="id22"/>
-              <ObjectRef ref="id23"/>
-              <ObjectRef ref="id24"/>
-              <ObjectRef ref="id25"/>
-            </Dst>
-            <Srv neg="False">
-              <ServiceRef ref="sysid1"/>
-            </Srv>
-            <Itf neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Itf>
-            <When neg="False">
-              <IntervalRef ref="sysid2"/>
-            </When>
-            <PolicyRuleOptions>
-              <Option name="stateless">True</Option>
-            </PolicyRuleOptions>
-          </PolicyRule>
-          <PolicyRule id="id174" disabled="False" group="" log="False" position="10" action="Accept" direction="Inbound" comment="Created during import of  line 28">
-            <Src neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Src>
-            <Dst neg="False">
               <ObjectRef ref="id3"/>
-              <ObjectRef ref="id22"/>
-              <ObjectRef ref="id23"/>
-              <ObjectRef ref="id24"/>
-              <ObjectRef ref="id25"/>
             </Dst>
             <Srv neg="False">
               <ServiceRef ref="sysid1"/>
@@ -713,13 +603,54 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id190" disabled="False" group="" log="False" position="11" action="Accept" direction="Inbound" comment="Created during import of  line 29">
+          <PolicyRule id="id132" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Created during import of  line 33">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
             <Dst neg="False">
               <ObjectRef ref="id12"/>
+              <ObjectRef ref="id3"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id145" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Created during import of  line 34">
+            <Src neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="id3"/>
               <ObjectRef ref="id13"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id158" disabled="False" group="" log="False" position="5" action="Accept" direction="Inbound" comment="Created during import of  line 35">
+            <Src neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="id3"/>
               <ObjectRef ref="id14"/>
             </Dst>
             <Srv neg="False">
@@ -735,13 +666,13 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id204" disabled="False" group="" log="False" position="12" action="Deny" direction="Inbound" comment="Created during import of  line 31">
+          <PolicyRule id="id171" disabled="False" group="" log="False" position="6" action="Accept" direction="Inbound" comment="Created during import of  line 36">
             <Src neg="False">
-              <ObjectRef ref="id15"/>
-              <ObjectRef ref="id16"/>
+              <ObjectRef ref="sysid0"/>
             </Src>
             <Dst neg="False">
-              <ObjectRef ref="sysid0"/>
+              <ObjectRef ref="id3"/>
+              <ObjectRef ref="id15"/>
             </Dst>
             <Srv neg="False">
               <ServiceRef ref="sysid1"/>
@@ -756,20 +687,262 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id217" disabled="False" group="" log="False" position="13" action="Accept" direction="Outbound" comment="Created during import of  line 33">
+          <PolicyRule id="id184" disabled="False" group="" log="False" position="7" action="Accept" direction="Inbound" comment="Created during import of  line 37">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
             <Dst neg="False">
-              <ObjectRef ref="id15"/>
+              <ObjectRef ref="id3"/>
               <ObjectRef ref="id16"/>
             </Dst>
             <Srv neg="False">
-              <ServiceRef ref="id32"/>
-              <ServiceRef ref="id33"/>
+              <ServiceRef ref="sysid1"/>
             </Srv>
             <Itf neg="False">
-              <ObjectRef ref="id235"/>
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id197" disabled="False" group="" log="False" position="8" action="Accept" direction="Inbound" comment="Created during import of  line 38">
+            <Src neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="id3"/>
+              <ObjectRef ref="id17"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id210" disabled="False" group="" log="False" position="9" action="Accept" direction="Inbound" comment="Created during import of  line 40">
+            <Src neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="id22"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id222" disabled="False" group="" log="False" position="10" action="Accept" direction="Inbound" comment="Created during import of  line 41">
+            <Src neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="id27"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id234" disabled="False" group="" log="False" position="11" action="Accept" direction="Inbound" comment="Created during import of  line 42">
+            <Src neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="id33"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id246" disabled="False" group="" log="False" position="12" action="Accept" direction="Inbound" comment="Created during import of  line 43">
+            <Src neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="id37"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id258" disabled="False" group="" log="False" position="13" action="Accept" direction="Inbound" comment="Created during import of  line 44">
+            <Src neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="id41"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id270" disabled="False" group="" log="False" position="14" action="Accept" direction="Inbound" comment="Created during import of  line 45">
+            <Src neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="id45"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id282" disabled="False" group="" log="False" position="15" action="Accept" direction="Outbound" comment="Created during import of  line 47">
+            <Src neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="id49"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="id82"/>
+              <ServiceRef ref="id83"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="id348"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id295" disabled="False" group="" log="False" position="16" action="Accept" direction="Inbound" comment="Created during import of  line 49">
+            <Src neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="id52"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="id84"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="id348"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id307" disabled="False" group="" log="False" position="17" action="Accept" direction="Inbound" comment="Created during import of  line 50">
+            <Src neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="id56"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="id84"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="id348"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id319" disabled="False" group="" log="False" position="18" action="Accept" direction="Inbound" comment="Created during import of  line 51">
+            <Src neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="id60"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="id84"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="id348"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id331" disabled="False" group="" log="False" position="19" action="Accept" direction="Inbound" comment="Created during import of  line 52">
+            <Src neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="id349"/>
+              <ObjectRef ref="id19"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="id84"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="id348"/>
             </Itf>
             <When neg="False">
               <IntervalRef ref="sysid2"/>
@@ -780,11 +953,12 @@
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
-        <Routing id="id233" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
+        <Routing id="id346" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
           <RuleSetOptions/>
         </Routing>
-        <Interface id="id235" dedicated_failover="False" dyn="True" security_level="0" unnum="False" unprotected="False" name="em1" comment="Created during import of  line 33" ro="False">
+        <Interface id="id348" dedicated_failover="False" dyn="True" security_level="0" unnum="False" unprotected="False" name="em1" comment="Created during import of  line 24" ro="False">
           <InterfaceOptions/>
+          <AttachedNetworks id="id349" name="em1-net" comment="" ro="False"/>
         </Interface>
         <FirewallOptions>
           <Option name="check_shading">true</Option>
@@ -804,7 +978,7 @@
         </FirewallOptions>
       </Firewall>
     </ObjectGroup>
-    <ObjectGroup id="id237" name="Clusters" comment="" ro="False"/>
-    <IntervalGroup id="id238" name="Time" comment="" ro="False"/>
+    <ObjectGroup id="id351" name="Clusters" comment="" ro="False"/>
+    <IntervalGroup id="id352" name="Time" comment="" ro="False"/>
   </Library>
 </FWObjectDatabase>
diff --git a/src/unit_tests/PFImporterTest/test_data/pf-macros.output b/src/unit_tests/PFImporterTest/test_data/pf-macros.output
index 2320785a8..033af45ef 100644
--- a/src/unit_tests/PFImporterTest/test_data/pf-macros.output
+++ b/src/unit_tests/PFImporterTest/test_data/pf-macros.output
@@ -1,15 +1,31 @@
-16: filtering rule: action pass; interfaces: 
-18: filtering rule: action pass; interfaces: 
-19: filtering rule: action pass; interfaces: 
-20: filtering rule: action pass; interfaces: 
-21: filtering rule: action pass; interfaces: 
-22: filtering rule: action pass; interfaces: 
-23: filtering rule: action pass; interfaces: 
-24: filtering rule: action pass; interfaces: 
-25: filtering rule: action pass; interfaces: 
-27: filtering rule: action pass; interfaces: 
-28: filtering rule: action pass; interfaces: 
+3: Address Table: <addr_list_1>:  10.123.12.32/27, 10.123.14.8/27, 10.123.10.16/28, 10.123.0.0/24
+5: Address Table: <addr_list_2>:  10.1.1.1, 10.123.12.32/27, 10.123.14.8/27, 10.123.10.16/28, 10.123.0.0/24
+7: Address Table: <addr_list_3>:  10.1.1.1, 10.123.12.33/27, 10.123.14.9/27
+9: Address Table: <addr_list_4>:  10.1.1.1, 10.123.12.34/27, 10.123.14.10/27
+12: Address Table: <addr_list_5>:  10.1.1.1, 10.123.12.35/27, 10.123.14.11/27
+15: Address Table: <addr_list_1_foo>:  10.1.2.3, 10.4.5.6, 10.7.8.9
+19: Address Table: <recursive_macro>:  192.168.1.1, 192.168.1.2
+23: Address Table: <mixed_macro_1>:  192.168.1.1, 192.168.2.1, www.fwbuilder.org
+24: Address Table: <mixed_macro_2>:  192.168.1.1, 192.168.2.1, em1
+24: New interface: em1
+25: Address Table: <mixed_macro_3>:  192.168.1.1, 192.168.2.1, em1
 29: filtering rule: action pass; interfaces: 
-31: filtering rule: action block; interfaces: 
-33: New interface: em1
-33: filtering rule: action pass; interfaces: em1
+31: filtering rule: action pass; interfaces: 
+32: filtering rule: action pass; interfaces: 
+33: filtering rule: action pass; interfaces: 
+34: filtering rule: action pass; interfaces: 
+35: filtering rule: action pass; interfaces: 
+36: filtering rule: action pass; interfaces: 
+37: filtering rule: action pass; interfaces: 
+38: filtering rule: action pass; interfaces: 
+40: filtering rule: action pass; interfaces: 
+41: filtering rule: action pass; interfaces: 
+42: filtering rule: action pass; interfaces: 
+43: filtering rule: action pass; interfaces: 
+44: filtering rule: action pass; interfaces: 
+45: filtering rule: action pass; interfaces: 
+47: filtering rule: action pass; interfaces: em1
+49: filtering rule: action pass; interfaces: em1
+50: filtering rule: action pass; interfaces: em1
+51: filtering rule: action pass; interfaces: em1
+52: filtering rule: action pass; interfaces: em1

From 56ee41fdee4c2d8215a34350a1e1ea094d3879f9 Mon Sep 17 00:00:00 2001
From: Vadim Kurland <vadim@netcitadel.com>
Date: Thu, 7 Jul 2011 17:24:57 -0700
Subject: [PATCH 13/18] see #2556 "PF import: impor of rules referring to
 undefined macros". If pf.conf file uses an undefined macro (there is $macro
 somewhere but the macro has never been defined), importer issues a warning,
 creates run-time DNSName object with the name "$macro" and marks all rules
 where it is used as broken, that is, rules are colored red and the error
 message is added to the comment field. Using run-time DNSName object makes
 compiler use "$macro" in the generated pf rule which means fwbuilder
 generates exactly the same pf rule as the one it tried to import.

---
 doc/ChangeLog                                 |  11 +
 src/import/Importer.cpp                       |  10 +
 src/import/PFImporter.cpp                     |  27 +-
 src/import/PFImporterRun.cpp                  |  23 +-
 src/import/objectMaker.cpp                    |   6 +
 src/import/objectMaker.h                      |  10 +-
 src/parsers/PFCfgLexer.cpp                    | 998 ++++++++++--------
 src/parsers/PFCfgParser.cpp                   | 480 +++++----
 src/parsers/PFCfgParser.hpp                   |   4 +-
 src/parsers/PFCfgParserTokenTypes.hpp         | 247 ++---
 src/parsers/PFCfgParserTokenTypes.txt         | 247 ++---
 src/parsers/pf.g                              |  11 +-
 .../PFImporterTest/test_data/pf-macros.conf   |   5 +
 .../PFImporterTest/test_data/pf-macros.fwb    | 274 ++---
 .../PFImporterTest/test_data/pf-macros.output |  18 +-
 15 files changed, 1318 insertions(+), 1053 deletions(-)

diff --git a/doc/ChangeLog b/doc/ChangeLog
index d2c501b54..b5fd9e7a5 100644
--- a/doc/ChangeLog
+++ b/doc/ChangeLog
@@ -1,5 +1,16 @@
 2011-07-07  Vadim Kurland  <vadim@netcitadel.com>
 
+	* PFImporter.cpp (makeAddressObj): see #2556 "PF import: impor of
+	rules referring to undefined macros". If pf.conf file uses an
+	undefined macro (there is $macro somewhere but the macro has never
+	been defined), importer issues a warning, creates run-time DNSName
+	object with the name "$macro" and marks all rules where it is used
+	as broken, that is, rules are colored red and the error message is
+	added to the comment field. Using run-time DNSName object makes
+	compiler use "$macro" in the generated pf rule which means
+	fwbuilder generates exactly the same pf rule as the one it tried
+	to import.
+
 	* PFImporterRun.cpp (run): see #2554 "PF import: create groups of
 	address objects for macros where possible". Importer for PF
 	recognizes macros that define lists of ip addresses, interfaces or
diff --git a/src/import/Importer.cpp b/src/import/Importer.cpp
index 7ae6bfe12..263ce2bb4 100644
--- a/src/import/Importer.cpp
+++ b/src/import/Importer.cpp
@@ -562,6 +562,13 @@ void Importer::pushRule()
     // then add it to the current ruleset
     current_ruleset->ruleset->add(current_rule);
 
+    if (error_tracker->hasWarnings())
+    {
+        QStringList warn = error_tracker->getWarnings();
+        addMessageToLog("Warning: " + warn.join("\n"));
+        markCurrentRuleBad();
+    }
+
     if (error_tracker->hasErrors())
     {
         QStringList err = error_tracker->getErrors();
@@ -791,6 +798,9 @@ void Importer::markCurrentRuleBad()
     if ( ! current_rule->getComment().empty())
         comment.append(QString::fromUtf8(current_rule->getComment().c_str()));
 
+    foreach(QString err, error_tracker->getWarnings())
+        comment.append(err);
+
     foreach(QString err, error_tracker->getErrors())
         comment.append(err);
 
diff --git a/src/import/PFImporter.cpp b/src/import/PFImporter.cpp
index d4f503cc8..6eb8b0ba4 100644
--- a/src/import/PFImporter.cpp
+++ b/src/import/PFImporter.cpp
@@ -507,11 +507,25 @@ FWObject* PFImporter::makeAddressObj(AddressSpec &as)
             return intf;
         } else
         {
-            // TODO: create and return DNSName object
+            QString name = QString::fromUtf8(as.address.c_str());
+            if (name.startsWith('$'))
+            {
+                /*
+                 * We perform macro substitutions in
+                 * PFImporter::substituteMacros(), however if we get a
+                 * host name that starts with a '$' here, then this is
+                 * an undefined macro that could not be substituted.
+                 * Mark rule as bad but still create run-time DNSName
+                 * object.
+                 */
+                error_tracker->registerWarning(
+                    QObject::tr("Macro '%1' was undefined, rule may be broken")
+                    .arg(name));
+            }
             ObjectSignature sig(error_tracker);
             sig.type_name = DNSName::TYPENAME;
-            sig.object_name = QString::fromUtf8(as.address.c_str());
-            sig.dns_name = QString::fromUtf8(as.address.c_str());
+            sig.object_name = name;
+            sig.dns_name = name;
             return address_maker->createObject(sig);
         }
     }
@@ -651,6 +665,13 @@ void PFImporter::pushRule()
 
     assert(current_rule!=NULL);
 
+    if (error_tracker->hasWarnings())
+    {
+        QStringList warn = error_tracker->getWarnings();
+        addMessageToLog("Warning: " + warn.join("\n"));
+        markCurrentRuleBad();
+    }
+
     if (error_tracker->hasErrors())
     {
         QStringList err = error_tracker->getErrors();
diff --git a/src/import/PFImporterRun.cpp b/src/import/PFImporterRun.cpp
index 282acb76f..d019cc74c 100644
--- a/src/import/PFImporterRun.cpp
+++ b/src/import/PFImporterRun.cpp
@@ -259,11 +259,10 @@ void PFImporter::substituteMacros(const QMap<QString,QString> &macros,
                                   QString &buffer)
 {
     // make several passes: sometimes macros can use other macros
-    int pass = 0;
-    while (1)
-    {
-        if (fwbdebug) qDebug() << "Pass " << pass;
+    QRegExp any_macro_instance("\\$(\\w+)\\W");
 
+    for (;;)
+    {
         QMapIterator<QString, QString> it(macros);
         while (it.hasNext())
         {
@@ -275,23 +274,19 @@ void PFImporter::substituteMacros(const QMap<QString,QString> &macros,
             buffer.replace(macro_instance, macro_value);
         }
 
-        QRegExp any_macro_instance("\\$(\\w+)\\W");
-        if (any_macro_instance.indexIn(buffer) == -1)
-        {
-            break;
-        } else
+        bool has_known_macros = false;
+        if (any_macro_instance.indexIn(buffer) != -1)
         {
             QString macro_name = any_macro_instance.cap(1);
-            if (!macros.contains(macro_name))
+            if (macros.contains(macro_name)) has_known_macros = true;
+            else
             {
                 QString err;
-                err = QObject::tr("Error: Macro %1 is undefined").arg(macro_name);
+                err = QObject::tr("Warning: Macro %1 is undefined").arg(macro_name);
                 *logger << err.toUtf8().constData();
-                return;
             }
         }
-
-        pass++;
+        if (!has_known_macros) break;
     }
 }
 
diff --git a/src/import/objectMaker.cpp b/src/import/objectMaker.cpp
index f96ebd206..c903f6f52 100644
--- a/src/import/objectMaker.cpp
+++ b/src/import/objectMaker.cpp
@@ -81,6 +81,12 @@ void ObjectMakerErrorTracker::registerError(const QString &msg)
     error_status = true;
 }
 
+void ObjectMakerErrorTracker::registerWarning(const QString &msg)
+{
+    if ( ! warnings.contains(msg)) warnings.append(msg);
+    warning_status = true;
+}
+
 
 ObjectSignature::ObjectSignature(ObjectMakerErrorTracker *et)
 {
diff --git a/src/import/objectMaker.h b/src/import/objectMaker.h
index 51023ed8a..2a4cbc3a5 100644
--- a/src/import/objectMaker.h
+++ b/src/import/objectMaker.h
@@ -76,15 +76,21 @@ class ObjectMakerErrorTracker
 {
     QStringList errors;
     bool error_status;
+    QStringList warnings;
+    bool warning_status;
     
 public:
-    ObjectMakerErrorTracker() { error_status = false; }
+    ObjectMakerErrorTracker() { error_status = false; warning_status = false; }
 
-    void clear() { error_status = false; errors.clear(); }
+    void clear() { error_status = false; warning_status = false; errors.clear(); warnings.clear(); }
     
     void registerError(const QString &msg);
     bool hasErrors() { return error_status; }
     QStringList getErrors() { return errors; }
+
+    void registerWarning(const QString &msg);
+    bool hasWarnings() { return warning_status; }
+    QStringList getWarnings() { return warnings; }
 };
 
 
diff --git a/src/parsers/PFCfgLexer.cpp b/src/parsers/PFCfgLexer.cpp
index 8fd738e73..95937e554 100644
--- a/src/parsers/PFCfgLexer.cpp
+++ b/src/parsers/PFCfgLexer.cpp
@@ -44,92 +44,92 @@ PFCfgLexer::PFCfgLexer(const ANTLR_USE_NAMESPACE(antlr)LexerSharedInputState& st
 
 void PFCfgLexer::initLiterals()
 {
-	literals["badhead"] = 200;
-	literals["notifications"] = 234;
+	literals["badhead"] = 201;
+	literals["notifications"] = 235;
 	literals["state-policy"] = 26;
 	literals["floating"] = 28;
 	literals["no"] = 84;
 	literals["counters"] = 72;
 	literals["esp"] = 126;
-	literals["routersol"] = 159;
+	literals["routersol"] = 160;
 	literals["frags"] = 60;
-	literals["reply-to"] = 139;
+	literals["reply-to"] = 140;
 	literals["icmp.first"] = 49;
 	literals["string-key"] = 99;
 	literals["gre"] = 125;
 	literals["pass"] = 86;
 	literals["scrub"] = 65;
-	literals["warnings"] = 235;
+	literals["warnings"] = 236;
 	literals["include"] = 6;
 	literals["skip"] = 32;
 	literals["timeout"] = 13;
 	literals["eigrp"] = 128;
-	literals["icmp-type"] = 150;
-	literals["transit"] = 198;
+	literals["icmp-type"] = 151;
+	literals["transit"] = 199;
 	literals["inet"] = 115;
-	literals["no-df"] = 145;
+	literals["no-df"] = 146;
 	literals["network"] = 77;
-	literals["photuris"] = 175;
+	literals["photuris"] = 176;
 	literals["igmp"] = 120;
-	literals["unreach"] = 153;
-	literals["range"] = 227;
+	literals["unreach"] = 154;
+	literals["range"] = 228;
 	literals["rsvp"] = 124;
-	literals["debugging"] = 230;
-	literals["host-tos"] = 188;
-	literals["paramprob"] = 161;
+	literals["debugging"] = 231;
+	literals["host-tos"] = 189;
+	literals["paramprob"] = 162;
 	literals["user"] = 113;
-	literals["interface"] = 216;
+	literals["interface"] = 217;
 	literals["adaptive.end"] = 58;
 	literals["limit"] = 21;
 	literals["state-defaults"] = 29;
 	literals["hex-key"] = 98;
-	literals["net-unk"] = 182;
+	literals["net-unk"] = 183;
 	literals["antispoof"] = 9;
 	literals["udp.single"] = 47;
-	literals["inforeq"] = 164;
-	literals["ipv6-here"] = 172;
-	literals["redir"] = 155;
+	literals["inforeq"] = 165;
+	literals["ipv6-here"] = 173;
+	literals["redir"] = 156;
 	literals["static-port"] = 88;
-	literals["common-adv"] = 197;
+	literals["common-adv"] = 198;
 	literals["loginterface"] = 22;
 	literals["ip"] = 118;
-	literals["mobregreq"] = 173;
+	literals["mobregreq"] = 174;
 	literals["conservative"] = 17;
 	literals["ospf"] = 129;
-	literals["proto-unr"] = 178;
+	literals["proto-unr"] = 179;
 	literals["peer"] = 79;
-	literals["inforep"] = 165;
-	literals["errors"] = 232;
+	literals["inforep"] = 166;
+	literals["errors"] = 233;
 	literals["tables-entries"] = 64;
 	literals["any"] = 136;
-	literals["mobregrep"] = 174;
-	literals["label"] = 213;
-	literals["pptp"] = 223;
-	literals["synproxy"] = 211;
+	literals["mobregrep"] = 175;
+	literals["label"] = 214;
+	literals["pptp"] = 224;
+	literals["synproxy"] = 212;
 	literals["debug"] = 37;
-	literals["alerts"] = 228;
+	literals["alerts"] = 229;
 	literals["all"] = 112;
-	literals["state"] = 212;
-	literals["tag"] = 208;
+	literals["state"] = 213;
+	literals["tag"] = 209;
 	literals["in"] = 108;
 	literals["tables"] = 63;
 	literals["file"] = 73;
-	literals["nos"] = 220;
+	literals["nos"] = 221;
 	literals["src-nodes"] = 62;
-	literals["ipv6-where"] = 171;
+	literals["ipv6-where"] = 172;
 	literals["require-order"] = 30;
 	literals["udp"] = 122;
 	literals["states"] = 61;
 	literals["sticky-address"] = 101;
 	literals["return-icmp"] = 106;
-	literals["redir-tos-net"] = 194;
-	literals["pim"] = 222;
-	literals["emergencies"] = 231;
-	literals["squench"] = 154;
-	literals["disable"] = 236;
-	literals["flags"] = 149;
+	literals["redir-tos-net"] = 195;
+	literals["pim"] = 223;
+	literals["emergencies"] = 232;
+	literals["squench"] = 155;
+	literals["disable"] = 237;
+	literals["flags"] = 150;
 	literals["tcp"] = 121;
-	literals["net-tos"] = 187;
+	literals["net-tos"] = 188;
 	literals["reassemble"] = 38;
 	literals["adaptive.start"] = 57;
 	literals["frag"] = 54;
@@ -137,59 +137,59 @@ void PFCfgLexer::initLiterals()
 	literals["icmp"] = 119;
 	literals["to"] = 114;
 	literals["return-rst"] = 104;
-	literals["normal-adv"] = 196;
+	literals["normal-adv"] = 197;
 	literals["optimization"] = 15;
 	literals["log"] = 110;
-	literals["fragment"] = 142;
-	literals["snp"] = 225;
+	literals["fragment"] = 143;
+	literals["snp"] = 226;
 	literals["broadcast"] = 78;
-	literals["icmp6-type"] = 206;
+	literals["icmp6-type"] = 207;
 	literals["normal"] = 19;
-	literals["code"] = 151;
+	literals["code"] = 152;
 	literals["if-bound"] = 27;
 	literals["src.track"] = 56;
-	literals["drop-ovl"] = 144;
-	literals["routeradv"] = 158;
+	literals["drop-ovl"] = 145;
+	literals["routeradv"] = 159;
 	literals["other.single"] = 52;
-	literals["dup-to"] = 140;
+	literals["dup-to"] = 141;
 	literals["bitmask"] = 95;
-	literals["maskreq"] = 166;
+	literals["maskreq"] = 167;
 	literals["ipip"] = 130;
 	literals["tcp.closed"] = 45;
 	literals["block"] = 103;
 	literals["high-latency"] = 18;
 	literals["udp.first"] = 46;
-	literals["badlen"] = 202;
+	literals["badlen"] = 203;
 	literals["tcp.first"] = 40;
-	literals["host-unr"] = 177;
+	literals["host-unr"] = 178;
 	literals["ah"] = 127;
-	literals["random-id"] = 148;
-	literals["modulate"] = 210;
+	literals["random-id"] = 149;
+	literals["modulate"] = 211;
 	literals["interval"] = 55;
-	literals["maskrep"] = 167;
+	literals["maskrep"] = 168;
 	literals["ruleset-optimization"] = 14;
-	literals["trace"] = 168;
-	literals["rip"] = 224;
+	literals["trace"] = 169;
+	literals["rip"] = 225;
 	literals["urpf-failed"] = 135;
 	literals["set"] = 12;
 	literals["source-hash"] = 97;
-	literals["critical"] = 229;
-	literals["quit"] = 215;
+	literals["critical"] = 230;
+	literals["quit"] = 216;
 	literals["icmp.error"] = 50;
 	literals["const"] = 71;
 	literals["altq"] = 10;
 	literals["tcp.closing"] = 43;
-	literals["port-unr"] = 179;
+	literals["port-unr"] = 180;
 	literals["table"] = 67;
-	literals["redir-tos-host"] = 195;
+	literals["redir-tos-host"] = 196;
 	literals["fingerprints"] = 31;
 	literals["return"] = 25;
-	literals["optmiss"] = 201;
+	literals["optmiss"] = 202;
 	literals["match"] = 66;
-	literals["keep"] = 209;
-	literals["net-prohib"] = 185;
+	literals["keep"] = 210;
+	literals["net-prohib"] = 186;
 	literals["inet6"] = 116;
-	literals["group"] = 141;
+	literals["group"] = 142;
 	literals["from"] = 134;
 	literals["tcp.finwait"] = 44;
 	literals["hostid"] = 39;
@@ -197,64 +197,64 @@ void PFCfgLexer::initLiterals()
 	literals["vrrp"] = 131;
 	literals["drop"] = 24;
 	literals["l2tp"] = 132;
-	literals["max-mss"] = 147;
-	literals["isolate"] = 184;
-	literals["timereq"] = 162;
+	literals["max-mss"] = 148;
+	literals["isolate"] = 185;
+	literals["timereq"] = 163;
 	literals["aggressive"] = 16;
-	literals["icmp6"] = 217;
-	literals["echoreq"] = 157;
+	literals["icmp6"] = 218;
+	literals["echoreq"] = 158;
 	literals["tcp.established"] = 42;
-	literals["decrypt-fail"] = 205;
-	literals["mobredir"] = 170;
+	literals["decrypt-fail"] = 206;
+	literals["mobredir"] = 171;
 	literals["other.first"] = 51;
-	literals["ipsec"] = 219;
+	literals["ipsec"] = 220;
 	literals["no-route"] = 137;
 	literals["random"] = 96;
 	literals["binat"] = 102;
-	literals["srcfail"] = 181;
+	literals["srcfail"] = 182;
 	literals["self"] = 80;
-	literals["timerep"] = 163;
-	literals["crop"] = 143;
-	literals["host-preced"] = 190;
-	literals["host"] = 226;
-	literals["echorep"] = 152;
+	literals["timerep"] = 164;
+	literals["crop"] = 144;
+	literals["host-preced"] = 191;
+	literals["host"] = 227;
+	literals["echorep"] = 153;
 	literals["other.multiple"] = 53;
-	literals["althost"] = 156;
+	literals["althost"] = 157;
 	literals["udp.multiple"] = 48;
-	literals["cutoff-preced"] = 191;
-	literals["redir-host"] = 193;
+	literals["cutoff-preced"] = 192;
+	literals["redir-host"] = 194;
 	literals["rdr"] = 89;
-	literals["tagged"] = 207;
+	literals["tagged"] = 208;
 	literals["on"] = 33;
 	literals["round-robin"] = 100;
-	literals["pcp"] = 221;
+	literals["pcp"] = 222;
 	literals["block-policy"] = 23;
 	literals["persist"] = 70;
-	literals["unknown-ind"] = 203;
-	literals["redir-net"] = 192;
-	literals["filter-prohib"] = 189;
+	literals["unknown-ind"] = 204;
+	literals["redir-net"] = 193;
+	literals["filter-prohib"] = 190;
 	literals["nat"] = 85;
 	literals["satellite"] = 20;
-	literals["informational"] = 233;
-	literals["needfrag"] = 180;
+	literals["informational"] = 234;
+	literals["needfrag"] = 181;
 	literals["tcp.opening"] = 41;
-	literals["igrp"] = 218;
+	literals["igrp"] = 219;
 	literals["quick"] = 111;
-	literals["timex"] = 160;
-	literals["host-unk"] = 183;
-	literals["route-to"] = 138;
-	literals["dataconv"] = 169;
+	literals["timex"] = 161;
+	literals["host-unk"] = 184;
+	literals["route-to"] = 139;
+	literals["dataconv"] = 170;
 	literals["rdp"] = 123;
-	literals["net-unr"] = 176;
+	literals["net-unr"] = 177;
 	literals["queue"] = 11;
 	literals["isis"] = 133;
-	literals["reassemb"] = 199;
-	literals["inactive"] = 237;
+	literals["reassemb"] = 200;
+	literals["inactive"] = 238;
 	literals["out"] = 109;
-	literals["min-ttl"] = 146;
-	literals["auth-fail"] = 204;
-	literals["exit"] = 214;
-	literals["host-prohib"] = 186;
+	literals["min-ttl"] = 147;
+	literals["auth-fail"] = 205;
+	literals["exit"] = 215;
+	literals["host-prohib"] = 187;
 }
 
 ANTLR_USE_NAMESPACE(antlr)RefToken PFCfgLexer::nextToken()
@@ -279,6 +279,7 @@ ANTLR_USE_NAMESPACE(antlr)RefToken PFCfgLexer::nextToken()
 				theRetToken=_returnToken;
 				break;
 			}
+			case 0x24 /* '$' */ :
 			case 0x30 /* '0' */ :
 			case 0x31 /* '1' */ :
 			case 0x32 /* '2' */ :
@@ -617,7 +618,7 @@ void PFCfgLexer::mWhitespace(bool _createToken) {
 	if ( inputState->guessing==0 ) {
 #line 1996 "pf.g"
 		_ttype = ANTLR_USE_NAMESPACE(antlr)Token::SKIP;
-#line 621 "PFCfgLexer.cpp"
+#line 622 "PFCfgLexer.cpp"
 	}
 	if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
 	   _token = makeToken(_ttype);
@@ -664,7 +665,7 @@ void PFCfgLexer::mNEWLINE(bool _createToken) {
 	if ( inputState->guessing==0 ) {
 #line 2001 "pf.g"
 		newline();
-#line 668 "PFCfgLexer.cpp"
+#line 669 "PFCfgLexer.cpp"
 	}
 	if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
 	   _token = makeToken(_ttype);
@@ -889,351 +890,506 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 	_ttype = NUMBER_ADDRESS_OR_WORD;
 	ANTLR_USE_NAMESPACE(std)string::size_type _saveIndex;
 	
-	bool synPredMatched327 = false;
-	if ((((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && (_tokenSet_2.member(LA(2))) && (_tokenSet_2.member(LA(3))))) {
-		int _m327 = mark();
-		synPredMatched327 = true;
-		inputState->guessing++;
-		try {
-			{
-			mNUM_3DIGIT(false);
-			match('.' /* charlit */ );
-			mNUM_3DIGIT(false);
-			match('.' /* charlit */ );
-			}
-		}
-		catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
-			synPredMatched327 = false;
-		}
-		rewind(_m327);
-		inputState->guessing--;
-	}
-	if ( synPredMatched327 ) {
+	switch ( LA(1)) {
+	case 0x3a /* ':' */ :
+	{
 		{
-		mNUM_3DIGIT(false);
-		match('.' /* charlit */ );
-		mNUM_3DIGIT(false);
-		match('.' /* charlit */ );
-		mNUM_3DIGIT(false);
-		match('.' /* charlit */ );
-		mNUM_3DIGIT(false);
-		}
-		if ( inputState->guessing==0 ) {
-#line 2056 "pf.g"
-			_ttype = IPV4;
-#line 925 "PFCfgLexer.cpp"
-		}
-	}
-	else {
-		bool synPredMatched334 = false;
-		if ((((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && (_tokenSet_2.member(LA(2))) && (_tokenSet_2.member(LA(3))))) {
-			int _m334 = mark();
-			synPredMatched334 = true;
+		bool synPredMatched318 = false;
+		if (((LA(1) == 0x3a /* ':' */ ) && (LA(2) == 0x3a /* ':' */ ) && (_tokenSet_1.member(LA(3))))) {
+			int _m318 = mark();
+			synPredMatched318 = true;
 			inputState->guessing++;
 			try {
 				{
+				match(':' /* charlit */ );
+				match(':' /* charlit */ );
 				{ // ( ... )+
-				int _cnt331=0;
-				for (;;) {
-					if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
-						mDIGIT(false);
-					}
-					else {
-						if ( _cnt331>=1 ) { goto _loop331; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
-					}
-					
-					_cnt331++;
-				}
-				_loop331:;
-				}  // ( ... )+
-				match('.' /* charlit */ );
-				{ // ( ... )+
-				int _cnt333=0;
-				for (;;) {
-					if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
-						mDIGIT(false);
-					}
-					else {
-						if ( _cnt333>=1 ) { goto _loop333; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
-					}
-					
-					_cnt333++;
-				}
-				_loop333:;
-				}  // ( ... )+
-				}
-			}
-			catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
-				synPredMatched334 = false;
-			}
-			rewind(_m334);
-			inputState->guessing--;
-		}
-		if ( synPredMatched334 ) {
-			{
-			{ // ( ... )+
-			int _cnt337=0;
-			for (;;) {
-				if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
-					mDIGIT(false);
-				}
-				else {
-					if ( _cnt337>=1 ) { goto _loop337; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
-				}
-				
-				_cnt337++;
-			}
-			_loop337:;
-			}  // ( ... )+
-			match('.' /* charlit */ );
-			{ // ( ... )+
-			int _cnt339=0;
-			for (;;) {
-				if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
-					mDIGIT(false);
-				}
-				else {
-					if ( _cnt339>=1 ) { goto _loop339; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
-				}
-				
-				_cnt339++;
-			}
-			_loop339:;
-			}  // ( ... )+
-			}
-			if ( inputState->guessing==0 ) {
-#line 2059 "pf.g"
-				_ttype = NUMBER;
-#line 1008 "PFCfgLexer.cpp"
-			}
-		}
-		else {
-			bool synPredMatched302 = false;
-			if (((_tokenSet_1.member(LA(1))) && (_tokenSet_3.member(LA(2))) && (true))) {
-				int _m302 = mark();
-				synPredMatched302 = true;
-				inputState->guessing++;
-				try {
-					{
-					{ // ( ... )+
-					int _cnt301=0;
-					for (;;) {
-						if ((_tokenSet_1.member(LA(1)))) {
-							mHEX_DIGIT(false);
-						}
-						else {
-							if ( _cnt301>=1 ) { goto _loop301; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
-						}
-						
-						_cnt301++;
-					}
-					_loop301:;
-					}  // ( ... )+
-					match(':' /* charlit */ );
-					}
-				}
-				catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
-					synPredMatched302 = false;
-				}
-				rewind(_m302);
-				inputState->guessing--;
-			}
-			if ( synPredMatched302 ) {
-				{
-				{
-				{ // ( ... )+
-				int _cnt306=0;
+				int _cnt317=0;
 				for (;;) {
 					if ((_tokenSet_1.member(LA(1)))) {
 						mHEX_DIGIT(false);
 					}
 					else {
-						if ( _cnt306>=1 ) { goto _loop306; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+						if ( _cnt317>=1 ) { goto _loop317; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
 					}
 					
-					_cnt306++;
+					_cnt317++;
 				}
-				_loop306:;
+				_loop317:;
 				}  // ( ... )+
-				{ // ( ... )+
-				int _cnt310=0;
-				for (;;) {
-					if ((LA(1) == 0x3a /* ':' */ )) {
-						match(':' /* charlit */ );
-						{ // ( ... )*
-						for (;;) {
-							if ((_tokenSet_1.member(LA(1)))) {
-								mHEX_DIGIT(false);
-							}
-							else {
-								goto _loop309;
-							}
-							
-						}
-						_loop309:;
-						} // ( ... )*
-					}
-					else {
-						if ( _cnt310>=1 ) { goto _loop310; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
-					}
-					
-					_cnt310++;
-				}
-				_loop310:;
-				}  // ( ... )+
-				}
-				if ( inputState->guessing==0 ) {
-#line 2041 "pf.g"
-					_ttype = IPV6;
-#line 1089 "PFCfgLexer.cpp"
-				}
 				}
 			}
-			else {
-				bool synPredMatched312 = false;
-				if (((LA(1) == 0x3a /* ':' */ ))) {
-					int _m312 = mark();
-					synPredMatched312 = true;
-					inputState->guessing++;
-					try {
-						{
-						match(':' /* charlit */ );
-						}
-					}
-					catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
-						synPredMatched312 = false;
-					}
-					rewind(_m312);
-					inputState->guessing--;
+			catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
+				synPredMatched318 = false;
+			}
+			rewind(_m318);
+			inputState->guessing--;
+		}
+		if ( synPredMatched318 ) {
+			{
+			match(':' /* charlit */ );
+			match(':' /* charlit */ );
+			{ // ( ... )+
+			int _cnt321=0;
+			for (;;) {
+				if ((_tokenSet_1.member(LA(1)))) {
+					mHEX_DIGIT(false);
 				}
-				if ( synPredMatched312 ) {
-					{
-					bool synPredMatched317 = false;
-					if (((LA(1) == 0x3a /* ':' */ ) && (LA(2) == 0x3a /* ':' */ ) && (_tokenSet_1.member(LA(3))))) {
-						int _m317 = mark();
-						synPredMatched317 = true;
-						inputState->guessing++;
-						try {
-							{
-							match(':' /* charlit */ );
-							match(':' /* charlit */ );
-							{ // ( ... )+
-							int _cnt316=0;
-							for (;;) {
-								if ((_tokenSet_1.member(LA(1)))) {
-									mHEX_DIGIT(false);
-								}
-								else {
-									if ( _cnt316>=1 ) { goto _loop316; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
-								}
-								
-								_cnt316++;
-							}
-							_loop316:;
-							}  // ( ... )+
-							}
-						}
-						catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
-							synPredMatched317 = false;
-						}
-						rewind(_m317);
-						inputState->guessing--;
-					}
-					if ( synPredMatched317 ) {
-						{
-						match(':' /* charlit */ );
-						match(':' /* charlit */ );
-						{ // ( ... )+
-						int _cnt320=0;
-						for (;;) {
-							if ((_tokenSet_1.member(LA(1)))) {
-								mHEX_DIGIT(false);
-							}
-							else {
-								if ( _cnt320>=1 ) { goto _loop320; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
-							}
-							
-							_cnt320++;
-						}
-						_loop320:;
-						}  // ( ... )+
-						{ // ( ... )*
-						for (;;) {
-							if ((LA(1) == 0x3a /* ':' */ )) {
-								match(':' /* charlit */ );
-								{ // ( ... )+
-								int _cnt323=0;
-								for (;;) {
-									if ((_tokenSet_1.member(LA(1)))) {
-										mHEX_DIGIT(false);
-									}
-									else {
-										if ( _cnt323>=1 ) { goto _loop323; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
-									}
-									
-									_cnt323++;
-								}
-								_loop323:;
-								}  // ( ... )+
-							}
-							else {
-								goto _loop324;
-							}
-							
-						}
-						_loop324:;
-						} // ( ... )*
-						}
-						if ( inputState->guessing==0 ) {
-#line 2047 "pf.g"
-							_ttype = IPV6;
-#line 1191 "PFCfgLexer.cpp"
-						}
-					}
-					else if ((LA(1) == 0x3a /* ':' */ ) && (LA(2) == 0x3a /* ':' */ ) && (true)) {
-						{
-						match(':' /* charlit */ );
-						match(':' /* charlit */ );
-						}
-						if ( inputState->guessing==0 ) {
-#line 2049 "pf.g"
-							_ttype = IPV6;
-#line 1202 "PFCfgLexer.cpp"
-						}
-					}
-					else if ((LA(1) == 0x3a /* ':' */ ) && (true)) {
-						match(':' /* charlit */ );
-						if ( inputState->guessing==0 ) {
-#line 2051 "pf.g"
-							_ttype = COLON;
-#line 1210 "PFCfgLexer.cpp"
-						}
-					}
-					else {
-						throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());
-					}
-					
-					}
+				else {
+					if ( _cnt321>=1 ) { goto _loop321; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
 				}
-				else if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && (true) && (true)) {
+				
+				_cnt321++;
+			}
+			_loop321:;
+			}  // ( ... )+
+			{ // ( ... )*
+			for (;;) {
+				if ((LA(1) == 0x3a /* ':' */ )) {
+					match(':' /* charlit */ );
 					{ // ( ... )+
-					int _cnt341=0;
+					int _cnt324=0;
+					for (;;) {
+						if ((_tokenSet_1.member(LA(1)))) {
+							mHEX_DIGIT(false);
+						}
+						else {
+							if ( _cnt324>=1 ) { goto _loop324; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+						}
+						
+						_cnt324++;
+					}
+					_loop324:;
+					}  // ( ... )+
+				}
+				else {
+					goto _loop325;
+				}
+				
+			}
+			_loop325:;
+			} // ( ... )*
+			}
+			if ( inputState->guessing==0 ) {
+#line 2047 "pf.g"
+				_ttype = IPV6;
+#line 977 "PFCfgLexer.cpp"
+			}
+		}
+		else if ((LA(1) == 0x3a /* ':' */ ) && (LA(2) == 0x3a /* ':' */ ) && (true)) {
+			{
+			match(':' /* charlit */ );
+			match(':' /* charlit */ );
+			}
+			if ( inputState->guessing==0 ) {
+#line 2049 "pf.g"
+				_ttype = IPV6;
+#line 988 "PFCfgLexer.cpp"
+			}
+		}
+		else if ((LA(1) == 0x3a /* ':' */ ) && (true)) {
+			match(':' /* charlit */ );
+			if ( inputState->guessing==0 ) {
+#line 2051 "pf.g"
+				_ttype = COLON;
+#line 996 "PFCfgLexer.cpp"
+			}
+		}
+		else {
+			throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());
+		}
+		
+		}
+		break;
+	}
+	case 0x24 /* '$' */ :
+	{
+		match('$' /* charlit */ );
+		{
+		switch ( LA(1)) {
+		case 0x61 /* 'a' */ :
+		case 0x62 /* 'b' */ :
+		case 0x63 /* 'c' */ :
+		case 0x64 /* 'd' */ :
+		case 0x65 /* 'e' */ :
+		case 0x66 /* 'f' */ :
+		case 0x67 /* 'g' */ :
+		case 0x68 /* 'h' */ :
+		case 0x69 /* 'i' */ :
+		case 0x6a /* 'j' */ :
+		case 0x6b /* 'k' */ :
+		case 0x6c /* 'l' */ :
+		case 0x6d /* 'm' */ :
+		case 0x6e /* 'n' */ :
+		case 0x6f /* 'o' */ :
+		case 0x70 /* 'p' */ :
+		case 0x71 /* 'q' */ :
+		case 0x72 /* 'r' */ :
+		case 0x73 /* 's' */ :
+		case 0x74 /* 't' */ :
+		case 0x75 /* 'u' */ :
+		case 0x76 /* 'v' */ :
+		case 0x77 /* 'w' */ :
+		case 0x78 /* 'x' */ :
+		case 0x79 /* 'y' */ :
+		case 0x7a /* 'z' */ :
+		{
+			matchRange('a','z');
+			break;
+		}
+		case 0x41 /* 'A' */ :
+		case 0x42 /* 'B' */ :
+		case 0x43 /* 'C' */ :
+		case 0x44 /* 'D' */ :
+		case 0x45 /* 'E' */ :
+		case 0x46 /* 'F' */ :
+		case 0x47 /* 'G' */ :
+		case 0x48 /* 'H' */ :
+		case 0x49 /* 'I' */ :
+		case 0x4a /* 'J' */ :
+		case 0x4b /* 'K' */ :
+		case 0x4c /* 'L' */ :
+		case 0x4d /* 'M' */ :
+		case 0x4e /* 'N' */ :
+		case 0x4f /* 'O' */ :
+		case 0x50 /* 'P' */ :
+		case 0x51 /* 'Q' */ :
+		case 0x52 /* 'R' */ :
+		case 0x53 /* 'S' */ :
+		case 0x54 /* 'T' */ :
+		case 0x55 /* 'U' */ :
+		case 0x56 /* 'V' */ :
+		case 0x57 /* 'W' */ :
+		case 0x58 /* 'X' */ :
+		case 0x59 /* 'Y' */ :
+		case 0x5a /* 'Z' */ :
+		{
+			matchRange('A','Z');
+			break;
+		}
+		default:
+		{
+			throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());
+		}
+		}
+		}
+		{ // ( ... )*
+		for (;;) {
+			switch ( LA(1)) {
+			case 0x61 /* 'a' */ :
+			case 0x62 /* 'b' */ :
+			case 0x63 /* 'c' */ :
+			case 0x64 /* 'd' */ :
+			case 0x65 /* 'e' */ :
+			case 0x66 /* 'f' */ :
+			case 0x67 /* 'g' */ :
+			case 0x68 /* 'h' */ :
+			case 0x69 /* 'i' */ :
+			case 0x6a /* 'j' */ :
+			case 0x6b /* 'k' */ :
+			case 0x6c /* 'l' */ :
+			case 0x6d /* 'm' */ :
+			case 0x6e /* 'n' */ :
+			case 0x6f /* 'o' */ :
+			case 0x70 /* 'p' */ :
+			case 0x71 /* 'q' */ :
+			case 0x72 /* 'r' */ :
+			case 0x73 /* 's' */ :
+			case 0x74 /* 't' */ :
+			case 0x75 /* 'u' */ :
+			case 0x76 /* 'v' */ :
+			case 0x77 /* 'w' */ :
+			case 0x78 /* 'x' */ :
+			case 0x79 /* 'y' */ :
+			case 0x7a /* 'z' */ :
+			{
+				matchRange('a','z');
+				break;
+			}
+			case 0x41 /* 'A' */ :
+			case 0x42 /* 'B' */ :
+			case 0x43 /* 'C' */ :
+			case 0x44 /* 'D' */ :
+			case 0x45 /* 'E' */ :
+			case 0x46 /* 'F' */ :
+			case 0x47 /* 'G' */ :
+			case 0x48 /* 'H' */ :
+			case 0x49 /* 'I' */ :
+			case 0x4a /* 'J' */ :
+			case 0x4b /* 'K' */ :
+			case 0x4c /* 'L' */ :
+			case 0x4d /* 'M' */ :
+			case 0x4e /* 'N' */ :
+			case 0x4f /* 'O' */ :
+			case 0x50 /* 'P' */ :
+			case 0x51 /* 'Q' */ :
+			case 0x52 /* 'R' */ :
+			case 0x53 /* 'S' */ :
+			case 0x54 /* 'T' */ :
+			case 0x55 /* 'U' */ :
+			case 0x56 /* 'V' */ :
+			case 0x57 /* 'W' */ :
+			case 0x58 /* 'X' */ :
+			case 0x59 /* 'Y' */ :
+			case 0x5a /* 'Z' */ :
+			{
+				matchRange('A','Z');
+				break;
+			}
+			case 0x30 /* '0' */ :
+			case 0x31 /* '1' */ :
+			case 0x32 /* '2' */ :
+			case 0x33 /* '3' */ :
+			case 0x34 /* '4' */ :
+			case 0x35 /* '5' */ :
+			case 0x36 /* '6' */ :
+			case 0x37 /* '7' */ :
+			case 0x38 /* '8' */ :
+			case 0x39 /* '9' */ :
+			{
+				matchRange('0','9');
+				break;
+			}
+			case 0x5f /* '_' */ :
+			{
+				match('_' /* charlit */ );
+				break;
+			}
+			default:
+			{
+				goto _loop348;
+			}
+			}
+		}
+		_loop348:;
+		} // ( ... )*
+		if ( inputState->guessing==0 ) {
+#line 2075 "pf.g"
+			_ttype = MACRO;
+#line 1170 "PFCfgLexer.cpp"
+		}
+		break;
+	}
+	default:
+		bool synPredMatched328 = false;
+		if ((((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && (_tokenSet_2.member(LA(2))) && (_tokenSet_2.member(LA(3))))) {
+			int _m328 = mark();
+			synPredMatched328 = true;
+			inputState->guessing++;
+			try {
+				{
+				mNUM_3DIGIT(false);
+				match('.' /* charlit */ );
+				mNUM_3DIGIT(false);
+				match('.' /* charlit */ );
+				}
+			}
+			catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
+				synPredMatched328 = false;
+			}
+			rewind(_m328);
+			inputState->guessing--;
+		}
+		if ( synPredMatched328 ) {
+			{
+			mNUM_3DIGIT(false);
+			match('.' /* charlit */ );
+			mNUM_3DIGIT(false);
+			match('.' /* charlit */ );
+			mNUM_3DIGIT(false);
+			match('.' /* charlit */ );
+			mNUM_3DIGIT(false);
+			}
+			if ( inputState->guessing==0 ) {
+#line 2056 "pf.g"
+				_ttype = IPV4;
+#line 1207 "PFCfgLexer.cpp"
+			}
+		}
+		else {
+			bool synPredMatched335 = false;
+			if ((((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && (_tokenSet_2.member(LA(2))) && (_tokenSet_2.member(LA(3))))) {
+				int _m335 = mark();
+				synPredMatched335 = true;
+				inputState->guessing++;
+				try {
+					{
+					{ // ( ... )+
+					int _cnt332=0;
 					for (;;) {
 						if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
 							mDIGIT(false);
 						}
 						else {
-							if ( _cnt341>=1 ) { goto _loop341; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+							if ( _cnt332>=1 ) { goto _loop332; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
 						}
 						
-						_cnt341++;
+						_cnt332++;
 					}
-					_loop341:;
+					_loop332:;
+					}  // ( ... )+
+					match('.' /* charlit */ );
+					{ // ( ... )+
+					int _cnt334=0;
+					for (;;) {
+						if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
+							mDIGIT(false);
+						}
+						else {
+							if ( _cnt334>=1 ) { goto _loop334; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+						}
+						
+						_cnt334++;
+					}
+					_loop334:;
+					}  // ( ... )+
+					}
+				}
+				catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
+					synPredMatched335 = false;
+				}
+				rewind(_m335);
+				inputState->guessing--;
+			}
+			if ( synPredMatched335 ) {
+				{
+				{ // ( ... )+
+				int _cnt338=0;
+				for (;;) {
+					if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
+						mDIGIT(false);
+					}
+					else {
+						if ( _cnt338>=1 ) { goto _loop338; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+					}
+					
+					_cnt338++;
+				}
+				_loop338:;
+				}  // ( ... )+
+				match('.' /* charlit */ );
+				{ // ( ... )+
+				int _cnt340=0;
+				for (;;) {
+					if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
+						mDIGIT(false);
+					}
+					else {
+						if ( _cnt340>=1 ) { goto _loop340; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+					}
+					
+					_cnt340++;
+				}
+				_loop340:;
+				}  // ( ... )+
+				}
+				if ( inputState->guessing==0 ) {
+#line 2059 "pf.g"
+					_ttype = NUMBER;
+#line 1290 "PFCfgLexer.cpp"
+				}
+			}
+			else {
+				bool synPredMatched303 = false;
+				if (((_tokenSet_1.member(LA(1))) && (_tokenSet_3.member(LA(2))) && (true))) {
+					int _m303 = mark();
+					synPredMatched303 = true;
+					inputState->guessing++;
+					try {
+						{
+						{ // ( ... )+
+						int _cnt302=0;
+						for (;;) {
+							if ((_tokenSet_1.member(LA(1)))) {
+								mHEX_DIGIT(false);
+							}
+							else {
+								if ( _cnt302>=1 ) { goto _loop302; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+							}
+							
+							_cnt302++;
+						}
+						_loop302:;
+						}  // ( ... )+
+						match(':' /* charlit */ );
+						}
+					}
+					catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& pe) {
+						synPredMatched303 = false;
+					}
+					rewind(_m303);
+					inputState->guessing--;
+				}
+				if ( synPredMatched303 ) {
+					{
+					{
+					{ // ( ... )+
+					int _cnt307=0;
+					for (;;) {
+						if ((_tokenSet_1.member(LA(1)))) {
+							mHEX_DIGIT(false);
+						}
+						else {
+							if ( _cnt307>=1 ) { goto _loop307; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+						}
+						
+						_cnt307++;
+					}
+					_loop307:;
+					}  // ( ... )+
+					{ // ( ... )+
+					int _cnt311=0;
+					for (;;) {
+						if ((LA(1) == 0x3a /* ':' */ )) {
+							match(':' /* charlit */ );
+							{ // ( ... )*
+							for (;;) {
+								if ((_tokenSet_1.member(LA(1)))) {
+									mHEX_DIGIT(false);
+								}
+								else {
+									goto _loop310;
+								}
+								
+							}
+							_loop310:;
+							} // ( ... )*
+						}
+						else {
+							if ( _cnt311>=1 ) { goto _loop311; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+						}
+						
+						_cnt311++;
+					}
+					_loop311:;
+					}  // ( ... )+
+					}
+					if ( inputState->guessing==0 ) {
+#line 2041 "pf.g"
+						_ttype = IPV6;
+#line 1371 "PFCfgLexer.cpp"
+					}
+					}
+				}
+				else if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ )) && (true) && (true)) {
+					{ // ( ... )+
+					int _cnt342=0;
+					for (;;) {
+						if (((LA(1) >= 0x30 /* '0' */  && LA(1) <= 0x39 /* '9' */ ))) {
+							mDIGIT(false);
+						}
+						else {
+							if ( _cnt342>=1 ) { goto _loop342; } else {throw ANTLR_USE_NAMESPACE(antlr)NoViableAltForCharException(LA(1), getFilename(), getLine(), getColumn());}
+						}
+						
+						_cnt342++;
+					}
+					_loop342:;
 					}  // ( ... )+
 					if ( inputState->guessing==0 ) {
 #line 2061 "pf.g"
 						_ttype = INT_CONST;
-#line 1237 "PFCfgLexer.cpp"
+#line 1393 "PFCfgLexer.cpp"
 					}
 				}
 				else if ((_tokenSet_4.member(LA(1))) && (true) && (true)) {
@@ -1449,16 +1605,16 @@ void PFCfgLexer::mNUMBER_ADDRESS_OR_WORD(bool _createToken) {
 						}
 						default:
 						{
-							goto _loop344;
+							goto _loop345;
 						}
 						}
 					}
-					_loop344:;
+					_loop345:;
 					} // ( ... )*
 					if ( inputState->guessing==0 ) {
 #line 2072 "pf.g"
 						_ttype = WORD;
-#line 1462 "PFCfgLexer.cpp"
+#line 1618 "PFCfgLexer.cpp"
 					}
 				}
 	else {
@@ -1486,11 +1642,11 @@ void PFCfgLexer::mSTRING(bool _createToken) {
 			matchNot('\"' /* charlit */ );
 		}
 		else {
-			goto _loop347;
+			goto _loop351;
 		}
 		
 	}
-	_loop347:;
+	_loop351:;
 	} // ( ... )*
 	match('\"' /* charlit */ );
 	if ( _createToken && _token==ANTLR_USE_NAMESPACE(antlr)nullToken && _ttype!=ANTLR_USE_NAMESPACE(antlr)Token::SKIP ) {
diff --git a/src/parsers/PFCfgParser.cpp b/src/parsers/PFCfgParser.cpp
index 0682583d9..58bb44bc5 100644
--- a/src/parsers/PFCfgParser.cpp
+++ b/src/parsers/PFCfgParser.cpp
@@ -1366,10 +1366,10 @@ void PFCfgParser::block_rule() {
 		case DUP_TO:
 		case GROUP:
 		case LITERAL_fragment:
-		case 145:
 		case 146:
 		case 147:
 		case 148:
+		case 149:
 		case FLAGS:
 		case ICMP_TYPE:
 		case ICMP6_TYPE:
@@ -2183,10 +2183,10 @@ void PFCfgParser::rule_extended() {
 		case DUP_TO:
 		case GROUP:
 		case LITERAL_fragment:
-		case 145:
 		case 146:
 		case 147:
 		case 148:
+		case 149:
 		case FLAGS:
 		case ICMP_TYPE:
 		case ICMP6_TYPE:
@@ -2233,10 +2233,10 @@ void PFCfgParser::rule_extended() {
 		case DUP_TO:
 		case GROUP:
 		case LITERAL_fragment:
-		case 145:
 		case 146:
 		case 147:
 		case 148:
+		case 149:
 		case FLAGS:
 		case ICMP_TYPE:
 		case ICMP6_TYPE:
@@ -2281,10 +2281,10 @@ void PFCfgParser::rule_extended() {
 		case DUP_TO:
 		case GROUP:
 		case LITERAL_fragment:
-		case 145:
 		case 146:
 		case 147:
 		case 148:
+		case 149:
 		case FLAGS:
 		case ICMP_TYPE:
 		case ICMP6_TYPE:
@@ -2328,10 +2328,10 @@ void PFCfgParser::rule_extended() {
 		case FROM:
 		case GROUP:
 		case LITERAL_fragment:
-		case 145:
 		case 146:
 		case 147:
 		case 148:
+		case 149:
 		case FLAGS:
 		case ICMP_TYPE:
 		case ICMP6_TYPE:
@@ -2372,10 +2372,10 @@ void PFCfgParser::rule_extended() {
 		case FROM:
 		case GROUP:
 		case LITERAL_fragment:
-		case 145:
 		case 146:
 		case 147:
 		case 148:
+		case 149:
 		case FLAGS:
 		case ICMP_TYPE:
 		case ICMP6_TYPE:
@@ -2414,10 +2414,10 @@ void PFCfgParser::rule_extended() {
 		case FROM:
 		case GROUP:
 		case LITERAL_fragment:
-		case 145:
 		case 146:
 		case 147:
 		case 148:
+		case 149:
 		case FLAGS:
 		case ICMP_TYPE:
 		case ICMP6_TYPE:
@@ -2458,10 +2458,10 @@ void PFCfgParser::rule_extended() {
 		case USER:
 		case GROUP:
 		case LITERAL_fragment:
-		case 145:
 		case 146:
 		case 147:
 		case 148:
+		case 149:
 		case FLAGS:
 		case ICMP_TYPE:
 		case ICMP6_TYPE:
@@ -2877,10 +2877,10 @@ void PFCfgParser::hosts() {
 		case FROM:
 		case GROUP:
 		case LITERAL_fragment:
-		case 145:
 		case 146:
 		case 147:
 		case 148:
+		case 149:
 		case FLAGS:
 		case ICMP_TYPE:
 		case ICMP6_TYPE:
@@ -2910,10 +2910,10 @@ void PFCfgParser::hosts() {
 			case TO:
 			case GROUP:
 			case LITERAL_fragment:
-			case 145:
 			case 146:
 			case 147:
 			case 148:
+			case 149:
 			case FLAGS:
 			case ICMP_TYPE:
 			case ICMP6_TYPE:
@@ -2950,10 +2950,10 @@ void PFCfgParser::hosts() {
 			case USER:
 			case GROUP:
 			case LITERAL_fragment:
-			case 145:
 			case 146:
 			case 147:
 			case 148:
+			case 149:
 			case FLAGS:
 			case ICMP_TYPE:
 			case ICMP6_TYPE:
@@ -3490,10 +3490,10 @@ void PFCfgParser::block_return() {
 			case DUP_TO:
 			case GROUP:
 			case LITERAL_fragment:
-			case 145:
 			case 146:
 			case 147:
 			case 148:
+			case 149:
 			case FLAGS:
 			case ICMP_TYPE:
 			case ICMP6_TYPE:
@@ -3525,16 +3525,15 @@ void PFCfgParser::block_return() {
 				match(OPENING_PAREN);
 				{
 				switch ( LA(1)) {
-				case 176:
 				case 177:
 				case 178:
 				case 179:
+				case 180:
 				case LITERAL_needfrag:
 				case LITERAL_srcfail:
-				case 182:
 				case 183:
+				case 184:
 				case LITERAL_isolate:
-				case 185:
 				case 186:
 				case 187:
 				case 188:
@@ -3547,14 +3546,15 @@ void PFCfgParser::block_return() {
 				case 195:
 				case 196:
 				case 197:
+				case 198:
 				case LITERAL_transit:
 				case LITERAL_reassemb:
 				case LITERAL_badhead:
 				case LITERAL_optmiss:
 				case LITERAL_badlen:
-				case 203:
 				case 204:
 				case 205:
+				case 206:
 				{
 					icmp_code_by_name();
 					break;
@@ -3580,16 +3580,15 @@ void PFCfgParser::block_return() {
 					match(COMMA);
 					{
 					switch ( LA(1)) {
-					case 176:
 					case 177:
 					case 178:
 					case 179:
+					case 180:
 					case LITERAL_needfrag:
 					case LITERAL_srcfail:
-					case 182:
 					case 183:
+					case 184:
 					case LITERAL_isolate:
-					case 185:
 					case 186:
 					case 187:
 					case 188:
@@ -3602,14 +3601,15 @@ void PFCfgParser::block_return() {
 					case 195:
 					case 196:
 					case 197:
+					case 198:
 					case LITERAL_transit:
 					case LITERAL_reassemb:
 					case LITERAL_badhead:
 					case LITERAL_optmiss:
 					case LITERAL_badlen:
-					case 203:
 					case 204:
 					case 205:
+					case 206:
 					{
 						icmp_code_by_name();
 						break;
@@ -3685,11 +3685,6 @@ void PFCfgParser::icmp_code_by_name() {
 	try {      // for error handling
 		{
 		switch ( LA(1)) {
-		case 176:
-		{
-			match(176);
-			break;
-		}
 		case 177:
 		{
 			match(177);
@@ -3705,6 +3700,11 @@ void PFCfgParser::icmp_code_by_name() {
 			match(179);
 			break;
 		}
+		case 180:
+		{
+			match(180);
+			break;
+		}
 		case LITERAL_needfrag:
 		{
 			match(LITERAL_needfrag);
@@ -3715,26 +3715,21 @@ void PFCfgParser::icmp_code_by_name() {
 			match(LITERAL_srcfail);
 			break;
 		}
-		case 182:
-		{
-			match(182);
-			break;
-		}
 		case 183:
 		{
 			match(183);
 			break;
 		}
+		case 184:
+		{
+			match(184);
+			break;
+		}
 		case LITERAL_isolate:
 		{
 			match(LITERAL_isolate);
 			break;
 		}
-		case 185:
-		{
-			match(185);
-			break;
-		}
 		case 186:
 		{
 			match(186);
@@ -3795,6 +3790,11 @@ void PFCfgParser::icmp_code_by_name() {
 			match(197);
 			break;
 		}
+		case 198:
+		{
+			match(198);
+			break;
+		}
 		case LITERAL_transit:
 		{
 			match(LITERAL_transit);
@@ -3820,11 +3820,6 @@ void PFCfgParser::icmp_code_by_name() {
 			match(LITERAL_badlen);
 			break;
 		}
-		case 203:
-		{
-			match(203);
-			break;
-		}
 		case 204:
 		{
 			match(204);
@@ -3835,6 +3830,11 @@ void PFCfgParser::icmp_code_by_name() {
 			match(205);
 			break;
 		}
+		case 206:
+		{
+			match(206);
+			break;
+		}
 		default:
 		{
 			throw ANTLR_USE_NAMESPACE(antlr)NoViableAltException(LT(1), getFilename());
@@ -3935,10 +3935,10 @@ void PFCfgParser::quick_or_log() {
 			case DUP_TO:
 			case GROUP:
 			case LITERAL_fragment:
-			case 145:
 			case 146:
 			case 147:
 			case 148:
+			case 149:
 			case FLAGS:
 			case ICMP_TYPE:
 			case ICMP6_TYPE:
@@ -4006,10 +4006,10 @@ void PFCfgParser::quick_or_log() {
 			case DUP_TO:
 			case GROUP:
 			case LITERAL_fragment:
-			case 145:
 			case 146:
 			case 147:
 			case 148:
+			case 149:
 			case FLAGS:
 			case ICMP_TYPE:
 			case ICMP6_TYPE:
@@ -4099,10 +4099,10 @@ void PFCfgParser::filteropts() {
 				case USER:
 				case GROUP:
 				case LITERAL_fragment:
-				case 145:
 				case 146:
 				case 147:
 				case 148:
+				case 149:
 				case FLAGS:
 				case ICMP_TYPE:
 				case ICMP6_TYPE:
@@ -4124,11 +4124,11 @@ void PFCfgParser::filteropts() {
 				filteropt();
 			}
 			else {
-				goto _loop202;
+				goto _loop203;
 			}
 			
 		}
-		_loop202:;
+		_loop203:;
 		} // ( ... )*
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -4546,10 +4546,10 @@ void PFCfgParser::hosts_from() {
 		case TO:
 		case GROUP:
 		case LITERAL_fragment:
-		case 145:
 		case 146:
 		case 147:
 		case 148:
+		case 149:
 		case FLAGS:
 		case ICMP_TYPE:
 		case ICMP6_TYPE:
@@ -4599,10 +4599,10 @@ void PFCfgParser::hosts_to() {
 		case USER:
 		case GROUP:
 		case LITERAL_fragment:
-		case 145:
 		case 146:
 		case 147:
 		case 148:
+		case 149:
 		case FLAGS:
 		case ICMP_TYPE:
 		case ICMP6_TYPE:
@@ -4644,6 +4644,7 @@ void PFCfgParser::src_hosts_part() {
 		case IPV6:
 		case ANY:
 		case NO_ROUTE:
+		case MACRO:
 		{
 			common_hosts_part();
 			break;
@@ -4657,7 +4658,7 @@ void PFCfgParser::src_hosts_part() {
 			AddressSpec(AddressSpec::SPECIAL_ADDRESS, false,
 			"urpf-failed", ""));
 			
-#line 4661 "PFCfgParser.cpp"
+#line 4662 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -4672,7 +4673,7 @@ void PFCfgParser::src_hosts_part() {
 		importer->src_group.splice(importer->src_group.begin(),
 		importer->tmp_group);
 		
-#line 4676 "PFCfgParser.cpp"
+#line 4677 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -4714,7 +4715,7 @@ void PFCfgParser::src_port_part() {
 		importer->src_port_group.splice(importer->src_port_group.begin(),
 		importer->tmp_port_group);
 		
-#line 4718 "PFCfgParser.cpp"
+#line 4719 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -4733,7 +4734,7 @@ void PFCfgParser::dst_hosts_part() {
 		importer->dst_group.splice(importer->dst_group.begin(),
 		importer->tmp_group);
 		
-#line 4737 "PFCfgParser.cpp"
+#line 4738 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -4775,7 +4776,7 @@ void PFCfgParser::dst_port_part() {
 		importer->dst_port_group.splice(importer->dst_port_group.begin(),
 		importer->tmp_port_group);
 		
-#line 4779 "PFCfgParser.cpp"
+#line 4780 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -4796,7 +4797,7 @@ void PFCfgParser::common_hosts_part() {
 			importer->tmp_group.push_back(
 			AddressSpec(AddressSpec::ANY, false, "0.0.0.0", "0.0.0.0"));
 			
-#line 4800 "PFCfgParser.cpp"
+#line 4801 "PFCfgParser.cpp"
 			break;
 		}
 		case NO_ROUTE:
@@ -4807,7 +4808,7 @@ void PFCfgParser::common_hosts_part() {
 			importer->tmp_group.push_back(
 			AddressSpec(AddressSpec::SPECIAL_ADDRESS, false, "no-route", ""));
 			
-#line 4811 "PFCfgParser.cpp"
+#line 4812 "PFCfgParser.cpp"
 			break;
 		}
 		case WORD:
@@ -4817,6 +4818,7 @@ void PFCfgParser::common_hosts_part() {
 		case IPV4:
 		case OPENING_PAREN:
 		case IPV6:
+		case MACRO:
 		{
 			host();
 			break;
@@ -4844,7 +4846,7 @@ void PFCfgParser::host() {
 	ANTLR_USE_NAMESPACE(antlr)RefToken  in = ANTLR_USE_NAMESPACE(antlr)nullToken;
 #line 1193 "pf.g"
 	AddressSpec as;
-#line 4848 "PFCfgParser.cpp"
+#line 4850 "PFCfgParser.cpp"
 	
 	try {      // for error handling
 		{
@@ -4854,7 +4856,7 @@ void PFCfgParser::host() {
 			match(EXLAMATION);
 #line 1194 "pf.g"
 			as.neg = true;
-#line 4858 "PFCfgParser.cpp"
+#line 4860 "PFCfgParser.cpp"
 			break;
 		}
 		case WORD:
@@ -4863,6 +4865,7 @@ void PFCfgParser::host() {
 		case IPV4:
 		case OPENING_PAREN:
 		case IPV6:
+		case MACRO:
 		{
 			break;
 		}
@@ -4875,15 +4878,33 @@ void PFCfgParser::host() {
 		{
 		switch ( LA(1)) {
 		case WORD:
+		case MACRO:
 		{
-			match(WORD);
+			{
+			switch ( LA(1)) {
+			case WORD:
+			{
+				match(WORD);
+				break;
+			}
+			case MACRO:
+			{
+				match(MACRO);
+				break;
+			}
+			default:
+			{
+				throw ANTLR_USE_NAMESPACE(antlr)NoViableAltException(LT(1), getFilename());
+			}
+			}
+			}
 #line 1197 "pf.g"
 			
 			// interface name or domain/host name
 			as.at = AddressSpec::INTERFACE_OR_HOST_NAME;
 			as.address = LT(0)->getText();
 			
-#line 4887 "PFCfgParser.cpp"
+#line 4908 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case COLON:
@@ -4898,7 +4919,7 @@ void PFCfgParser::host() {
 					
 					as.at = AddressSpec::INTERFACE_NETWORK;
 					
-#line 4902 "PFCfgParser.cpp"
+#line 4923 "PFCfgParser.cpp"
 					break;
 				}
 				case BROADCAST:
@@ -4908,7 +4929,7 @@ void PFCfgParser::host() {
 					
 					as.at = AddressSpec::INTERFACE_BROADCAST;
 					
-#line 4912 "PFCfgParser.cpp"
+#line 4933 "PFCfgParser.cpp"
 					break;
 				}
 				case PEER:
@@ -4919,7 +4940,7 @@ void PFCfgParser::host() {
 					importer->error_tracker->registerError(
 					QString("import of 'interface:peer' is not supported."));
 					
-#line 4923 "PFCfgParser.cpp"
+#line 4944 "PFCfgParser.cpp"
 					break;
 				}
 				case INT_CONST:
@@ -4930,7 +4951,7 @@ void PFCfgParser::host() {
 					importer->error_tracker->registerError(
 					QString("import of 'interface:0' is not supported."));
 					
-#line 4934 "PFCfgParser.cpp"
+#line 4955 "PFCfgParser.cpp"
 					break;
 				}
 				default:
@@ -4959,12 +4980,13 @@ void PFCfgParser::host() {
 			case IPV6:
 			case USER:
 			case TO:
+			case MACRO:
 			case GROUP:
 			case LITERAL_fragment:
-			case 145:
 			case 146:
 			case 147:
 			case 148:
+			case 149:
 			case FLAGS:
 			case ICMP_TYPE:
 			case ICMP6_TYPE:
@@ -4993,7 +5015,7 @@ void PFCfgParser::host() {
 			as.at = AddressSpec::SPECIAL_ADDRESS;
 			as.address = "self";
 			
-#line 4997 "PFCfgParser.cpp"
+#line 5019 "PFCfgParser.cpp"
 			break;
 		}
 		case IPV6:
@@ -5005,7 +5027,7 @@ void PFCfgParser::host() {
 			QString("IPv6 import is not supported. "));
 			consumeUntil(NEWLINE);
 			
-#line 5009 "PFCfgParser.cpp"
+#line 5031 "PFCfgParser.cpp"
 			break;
 		}
 		case IPV4:
@@ -5016,7 +5038,7 @@ void PFCfgParser::host() {
 			as.at = AddressSpec::HOST_ADDRESS;
 			as.address = LT(0)->getText();
 			
-#line 5020 "PFCfgParser.cpp"
+#line 5042 "PFCfgParser.cpp"
 			{
 			switch ( LA(1)) {
 			case SLASH:
@@ -5026,7 +5048,7 @@ void PFCfgParser::host() {
 				
 				as.at = AddressSpec::NETWORK_ADDRESS;
 				
-#line 5030 "PFCfgParser.cpp"
+#line 5052 "PFCfgParser.cpp"
 				{
 				switch ( LA(1)) {
 				case IPV4:
@@ -5049,7 +5071,7 @@ void PFCfgParser::host() {
 				
 				as.netmask = LT(0)->getText(); 
 				
-#line 5053 "PFCfgParser.cpp"
+#line 5075 "PFCfgParser.cpp"
 				break;
 			}
 			case NEWLINE:
@@ -5070,12 +5092,13 @@ void PFCfgParser::host() {
 			case IPV6:
 			case USER:
 			case TO:
+			case MACRO:
 			case GROUP:
 			case LITERAL_fragment:
-			case 145:
 			case 146:
 			case 147:
 			case 148:
+			case 149:
 			case FLAGS:
 			case ICMP_TYPE:
 			case ICMP6_TYPE:
@@ -5107,7 +5130,7 @@ void PFCfgParser::host() {
 			as.at = AddressSpec::TABLE;
 			as.address = tn->getText();
 			
-#line 5111 "PFCfgParser.cpp"
+#line 5134 "PFCfgParser.cpp"
 			break;
 		}
 		case OPENING_PAREN:
@@ -5122,7 +5145,7 @@ void PFCfgParser::host() {
 			as.at = AddressSpec::INTERFACE_OR_HOST_NAME;
 			as.address = in->getText();
 			
-#line 5126 "PFCfgParser.cpp"
+#line 5149 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -5135,7 +5158,7 @@ void PFCfgParser::host() {
 		
 		importer->tmp_group.push_back(as);
 		
-#line 5139 "PFCfgParser.cpp"
+#line 5162 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -5166,6 +5189,7 @@ void PFCfgParser::host_list() {
 				case IPV4:
 				case OPENING_PAREN:
 				case IPV6:
+				case MACRO:
 				{
 					break;
 				}
@@ -5178,11 +5202,11 @@ void PFCfgParser::host_list() {
 				host();
 			}
 			else {
-				goto _loop183;
+				goto _loop184;
 			}
 			
 		}
-		_loop183:;
+		_loop184:;
 		} // ( ... )*
 		match(CLOSING_BRACE);
 	}
@@ -5219,7 +5243,7 @@ void PFCfgParser::route_to() {
 		
 		importer->route_type = PFImporter::ROUTE_TO;
 		
-#line 5223 "PFCfgParser.cpp"
+#line 5247 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -5254,7 +5278,7 @@ void PFCfgParser::reply_to() {
 		
 		importer->route_type = PFImporter::REPLY_TO;
 		
-#line 5258 "PFCfgParser.cpp"
+#line 5282 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -5289,7 +5313,7 @@ void PFCfgParser::dup_to() {
 		
 		importer->route_type = PFImporter::DUP_TO;
 		
-#line 5293 "PFCfgParser.cpp"
+#line 5317 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -5305,14 +5329,14 @@ void PFCfgParser::routehost() {
 	ANTLR_USE_NAMESPACE(antlr)RefToken  nm6 = ANTLR_USE_NAMESPACE(antlr)nullToken;
 #line 1312 "pf.g"
 	RouteSpec rs;
-#line 5309 "PFCfgParser.cpp"
+#line 5333 "PFCfgParser.cpp"
 	
 	try {      // for error handling
 		match(OPENING_PAREN);
 		match(WORD);
 #line 1314 "pf.g"
 		rs.iface = LT(0)->getText();
-#line 5316 "PFCfgParser.cpp"
+#line 5340 "PFCfgParser.cpp"
 		{
 		switch ( LA(1)) {
 		case IPV4:
@@ -5384,7 +5408,7 @@ void PFCfgParser::routehost() {
 		importer->route_group.push_back(rs);
 		}
 		
-#line 5388 "PFCfgParser.cpp"
+#line 5412 "PFCfgParser.cpp"
 		match(CLOSING_PAREN);
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -5422,11 +5446,11 @@ void PFCfgParser::routehost_list() {
 				routehost();
 			}
 			else {
-				goto _loop198;
+				goto _loop199;
 			}
 			
 		}
-		_loop198:;
+		_loop199:;
 		} // ( ... )*
 		match(CLOSING_BRACE);
 	}
@@ -5503,10 +5527,10 @@ void PFCfgParser::filteropt() {
 		case LITERAL_reassemble:
 		case OPENING_PAREN:
 		case LITERAL_fragment:
-		case 145:
 		case 146:
 		case 147:
 		case 148:
+		case 149:
 		{
 			scrub_options();
 			break;
@@ -5556,7 +5580,7 @@ void PFCfgParser::user_match() {
 		importer->addMessageToLog(
 		QString("Error: import of 'user' match is not supported."));
 		
-#line 5560 "PFCfgParser.cpp"
+#line 5584 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -5597,7 +5621,7 @@ void PFCfgParser::group_match() {
 		importer->addMessageToLog(
 		QString("Error: import of 'group' match is not supported."));
 		
-#line 5601 "PFCfgParser.cpp"
+#line 5625 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -5622,7 +5646,7 @@ void PFCfgParser::tcp_flags() {
 			importer->flags_check = "none";
 			importer->flags_mask = "none";
 			
-#line 5626 "PFCfgParser.cpp"
+#line 5650 "PFCfgParser.cpp"
 			break;
 		}
 		case WORD:
@@ -5666,10 +5690,10 @@ void PFCfgParser::tcp_flags() {
 			case USER:
 			case GROUP:
 			case LITERAL_fragment:
-			case 145:
 			case 146:
 			case 147:
 			case 148:
+			case 149:
 			case FLAGS:
 			case ICMP_TYPE:
 			case ICMP6_TYPE:
@@ -5699,7 +5723,7 @@ void PFCfgParser::tcp_flags() {
 			else
 			importer->flags_mask = "all";
 			
-#line 5703 "PFCfgParser.cpp"
+#line 5727 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -5743,8 +5767,8 @@ void PFCfgParser::icmp_type() {
 		case LITERAL_trace:
 		case LITERAL_dataconv:
 		case LITERAL_mobredir:
-		case 171:
 		case 172:
+		case 173:
 		case LITERAL_mobregreq:
 		case LITERAL_mobregrep:
 		case LITERAL_photuris:
@@ -5781,7 +5805,7 @@ void PFCfgParser::icmp6_type() {
 		QString("ICMP6 import is not supported. "));
 		consumeUntil(NEWLINE);
 		
-#line 5785 "PFCfgParser.cpp"
+#line 5809 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -5825,7 +5849,7 @@ void PFCfgParser::state() {
 		
 		importer->state_op = LT(0)->getText();
 		
-#line 5829 "PFCfgParser.cpp"
+#line 5853 "PFCfgParser.cpp"
 		match(STATE);
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
@@ -5846,7 +5870,7 @@ void PFCfgParser::queue() {
 			match(WORD);
 #line 1722 "pf.g"
 			importer->queue += LT(0)->getText();
-#line 5850 "PFCfgParser.cpp"
+#line 5874 "PFCfgParser.cpp"
 			break;
 		}
 		case OPENING_PAREN:
@@ -5855,25 +5879,25 @@ void PFCfgParser::queue() {
 			match(WORD);
 #line 1725 "pf.g"
 			importer->queue += LT(0)->getText();
-#line 5859 "PFCfgParser.cpp"
+#line 5883 "PFCfgParser.cpp"
 			{ // ( ... )*
 			for (;;) {
 				if ((LA(1) == COMMA)) {
 					match(COMMA);
 #line 1727 "pf.g"
 					importer->queue += ",";
-#line 5866 "PFCfgParser.cpp"
+#line 5890 "PFCfgParser.cpp"
 					match(WORD);
 #line 1728 "pf.g"
 					importer->queue += LT(0)->getText();
-#line 5870 "PFCfgParser.cpp"
+#line 5894 "PFCfgParser.cpp"
 				}
 				else {
-					goto _loop255;
+					goto _loop256;
 				}
 				
 			}
-			_loop255:;
+			_loop256:;
 			} // ( ... )*
 			match(CLOSING_PAREN);
 			break;
@@ -5925,10 +5949,10 @@ void PFCfgParser::scrub_options() {
 		switch ( LA(1)) {
 		case LITERAL_reassemble:
 		case LITERAL_fragment:
-		case 145:
 		case 146:
 		case 147:
 		case 148:
+		case 149:
 		{
 			scrub_option();
 			break;
@@ -6082,11 +6106,11 @@ void PFCfgParser::user_group_op_list() {
 				user_group_op();
 			}
 			else {
-				goto _loop217;
+				goto _loop218;
 			}
 			
 		}
-		_loop217:;
+		_loop218:;
 		} // ( ... )*
 		match(CLOSING_BRACE);
 	}
@@ -6107,7 +6131,7 @@ void PFCfgParser::unary_op() {
 			match(EQUAL);
 #line 1768 "pf.g"
 			importer->tmp_port_op = "=";
-#line 6111 "PFCfgParser.cpp"
+#line 6135 "PFCfgParser.cpp"
 			break;
 		}
 		case EXLAMATION:
@@ -6116,7 +6140,7 @@ void PFCfgParser::unary_op() {
 			match(EQUAL);
 #line 1770 "pf.g"
 			importer->tmp_port_op = "!=";
-#line 6120 "PFCfgParser.cpp"
+#line 6144 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -6124,27 +6148,27 @@ void PFCfgParser::unary_op() {
 				match(LESS_THAN);
 #line 1772 "pf.g"
 				importer->tmp_port_op = "<";
-#line 6128 "PFCfgParser.cpp"
+#line 6152 "PFCfgParser.cpp"
 			}
 			else if ((LA(1) == LESS_THAN) && (LA(2) == EQUAL)) {
 				match(LESS_THAN);
 				match(EQUAL);
 #line 1774 "pf.g"
 				importer->tmp_port_op = "<=";
-#line 6135 "PFCfgParser.cpp"
+#line 6159 "PFCfgParser.cpp"
 			}
 			else if ((LA(1) == GREATER_THAN) && (LA(2) == WORD || LA(2) == INT_CONST)) {
 				match(GREATER_THAN);
 #line 1776 "pf.g"
 				importer->tmp_port_op = ">";
-#line 6141 "PFCfgParser.cpp"
+#line 6165 "PFCfgParser.cpp"
 			}
 			else if ((LA(1) == GREATER_THAN) && (LA(2) == EQUAL)) {
 				match(GREATER_THAN);
 				match(EQUAL);
 #line 1778 "pf.g"
 				importer->tmp_port_op = ">=";
-#line 6148 "PFCfgParser.cpp"
+#line 6172 "PFCfgParser.cpp"
 			}
 		else {
 			throw ANTLR_USE_NAMESPACE(antlr)NoViableAltException(LT(1), getFilename());
@@ -6170,7 +6194,7 @@ void PFCfgParser::binary_op() {
 			match(GREATER_THAN);
 #line 1784 "pf.g"
 			importer->tmp_port_op = "<>";
-#line 6174 "PFCfgParser.cpp"
+#line 6198 "PFCfgParser.cpp"
 			break;
 		}
 		case GREATER_THAN:
@@ -6179,7 +6203,7 @@ void PFCfgParser::binary_op() {
 			match(LESS_THAN);
 #line 1786 "pf.g"
 			importer->tmp_port_op = "><";
-#line 6183 "PFCfgParser.cpp"
+#line 6207 "PFCfgParser.cpp"
 			break;
 		}
 		case COLON:
@@ -6187,7 +6211,7 @@ void PFCfgParser::binary_op() {
 			match(COLON);
 #line 1788 "pf.g"
 			importer->tmp_port_op = ":";
-#line 6191 "PFCfgParser.cpp"
+#line 6215 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -6224,9 +6248,9 @@ void PFCfgParser::scrub_option() {
 				match(LITERAL_crop);
 				break;
 			}
-			case 144:
+			case 145:
 			{
-				match(144);
+				match(145);
 				break;
 			}
 			default:
@@ -6241,7 +6265,7 @@ void PFCfgParser::scrub_option() {
 			str_tuple("fragment", LT(0)->getText()));
 			importer->scrub_rule = true;
 			
-#line 6245 "PFCfgParser.cpp"
+#line 6269 "PFCfgParser.cpp"
 			break;
 		}
 		case LITERAL_reassemble:
@@ -6254,24 +6278,24 @@ void PFCfgParser::scrub_option() {
 			str_tuple("reassemble", "tcp"));
 			importer->scrub_rule = true;
 			
-#line 6258 "PFCfgParser.cpp"
+#line 6282 "PFCfgParser.cpp"
 			break;
 		}
-		case 145:
+		case 146:
 		{
-			match(145);
+			match(146);
 #line 1466 "pf.g"
 			
 			importer->scrub_options.push_back(
 			str_tuple(LT(0)->getText(), ""));
 			importer->scrub_rule = true;
 			
-#line 6270 "PFCfgParser.cpp"
+#line 6294 "PFCfgParser.cpp"
 			break;
 		}
-		case 146:
+		case 147:
 		{
-			match(146);
+			match(147);
 			match(INT_CONST);
 #line 1473 "pf.g"
 			
@@ -6279,12 +6303,12 @@ void PFCfgParser::scrub_option() {
 			str_tuple("min-ttl", LT(0)->getText()));
 			importer->scrub_rule = true;
 			
-#line 6283 "PFCfgParser.cpp"
+#line 6307 "PFCfgParser.cpp"
 			break;
 		}
-		case 147:
+		case 148:
 		{
-			match(147);
+			match(148);
 			match(INT_CONST);
 #line 1480 "pf.g"
 			
@@ -6292,19 +6316,19 @@ void PFCfgParser::scrub_option() {
 			str_tuple("max-mss", LT(0)->getText()));
 			importer->scrub_rule = true;
 			
-#line 6296 "PFCfgParser.cpp"
+#line 6320 "PFCfgParser.cpp"
 			break;
 		}
-		case 148:
+		case 149:
 		{
-			match(148);
+			match(149);
 #line 1487 "pf.g"
 			
 			importer->scrub_options.push_back(
 			str_tuple(LT(0)->getText(), ""));
 			importer->scrub_rule = true;
 			
-#line 6308 "PFCfgParser.cpp"
+#line 6332 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -6338,10 +6362,10 @@ void PFCfgParser::scrub_option_list() {
 				}
 				case LITERAL_reassemble:
 				case LITERAL_fragment:
-				case 145:
 				case 146:
 				case 147:
 				case 148:
+				case 149:
 				{
 					break;
 				}
@@ -6354,11 +6378,11 @@ void PFCfgParser::scrub_option_list() {
 				scrub_option();
 			}
 			else {
-				goto _loop224;
+				goto _loop225;
 			}
 			
 		}
-		_loop224:;
+		_loop225:;
 		} // ( ... )*
 		match(CLOSING_PAREN);
 	}
@@ -6372,7 +6396,7 @@ void PFCfgParser::icmp_type_code() {
 	Tracer traceInOut(this, "icmp_type_code");
 #line 1528 "pf.g"
 	IcmpSpec is;
-#line 6376 "PFCfgParser.cpp"
+#line 6400 "PFCfgParser.cpp"
 	
 	try {      // for error handling
 		{
@@ -6397,8 +6421,8 @@ void PFCfgParser::icmp_type_code() {
 		case LITERAL_trace:
 		case LITERAL_dataconv:
 		case LITERAL_mobredir:
-		case 171:
 		case 172:
+		case 173:
 		case LITERAL_mobregreq:
 		case LITERAL_mobregrep:
 		case LITERAL_photuris:
@@ -6406,7 +6430,7 @@ void PFCfgParser::icmp_type_code() {
 			icmp_type_by_name();
 #line 1530 "pf.g"
 			is.icmp_type_name = LT(0)->getText();
-#line 6410 "PFCfgParser.cpp"
+#line 6434 "PFCfgParser.cpp"
 			break;
 		}
 		case INT_CONST:
@@ -6414,7 +6438,7 @@ void PFCfgParser::icmp_type_code() {
 			match(INT_CONST);
 #line 1532 "pf.g"
 			is.icmp_type_int = LT(0)->getText();
-#line 6418 "PFCfgParser.cpp"
+#line 6442 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -6430,16 +6454,15 @@ void PFCfgParser::icmp_type_code() {
 			match(ICMP_CODE);
 			{
 			switch ( LA(1)) {
-			case 176:
 			case 177:
 			case 178:
 			case 179:
+			case 180:
 			case LITERAL_needfrag:
 			case LITERAL_srcfail:
-			case 182:
 			case 183:
+			case 184:
 			case LITERAL_isolate:
-			case 185:
 			case 186:
 			case 187:
 			case 188:
@@ -6452,19 +6475,20 @@ void PFCfgParser::icmp_type_code() {
 			case 195:
 			case 196:
 			case 197:
+			case 198:
 			case LITERAL_transit:
 			case LITERAL_reassemb:
 			case LITERAL_badhead:
 			case LITERAL_optmiss:
 			case LITERAL_badlen:
-			case 203:
 			case 204:
 			case 205:
+			case 206:
 			{
 				icmp_code_by_name();
 #line 1538 "pf.g"
 				is.icmp_code_name = LT(0)->getText();
-#line 6468 "PFCfgParser.cpp"
+#line 6492 "PFCfgParser.cpp"
 				break;
 			}
 			case INT_CONST:
@@ -6472,7 +6496,7 @@ void PFCfgParser::icmp_type_code() {
 				match(INT_CONST);
 #line 1540 "pf.g"
 				is.icmp_code_int = LT(0)->getText();
-#line 6476 "PFCfgParser.cpp"
+#line 6500 "PFCfgParser.cpp"
 				break;
 			}
 			default:
@@ -6497,10 +6521,10 @@ void PFCfgParser::icmp_type_code() {
 		case USER:
 		case GROUP:
 		case LITERAL_fragment:
-		case 145:
 		case 146:
 		case 147:
 		case 148:
+		case 149:
 		case FLAGS:
 		case ICMP_TYPE:
 		case LITERAL_echorep:
@@ -6522,8 +6546,8 @@ void PFCfgParser::icmp_type_code() {
 		case LITERAL_trace:
 		case LITERAL_dataconv:
 		case LITERAL_mobredir:
-		case 171:
 		case 172:
+		case 173:
 		case LITERAL_mobregreq:
 		case LITERAL_mobregrep:
 		case LITERAL_photuris:
@@ -6547,7 +6571,7 @@ void PFCfgParser::icmp_type_code() {
 		
 		importer->icmp_type_code_group.push_back(is);
 		
-#line 6551 "PFCfgParser.cpp"
+#line 6575 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -6592,8 +6616,8 @@ void PFCfgParser::icmp_list() {
 				case LITERAL_trace:
 				case LITERAL_dataconv:
 				case LITERAL_mobredir:
-				case 171:
 				case 172:
+				case 173:
 				case LITERAL_mobregreq:
 				case LITERAL_mobregrep:
 				case LITERAL_photuris:
@@ -6609,11 +6633,11 @@ void PFCfgParser::icmp_list() {
 				icmp_type_code();
 			}
 			else {
-				goto _loop245;
+				goto _loop246;
 			}
 			
 		}
-		_loop245:;
+		_loop246:;
 		} // ( ... )*
 		match(CLOSING_BRACE);
 	}
@@ -6724,16 +6748,16 @@ void PFCfgParser::icmp_type_by_name() {
 			match(LITERAL_mobredir);
 			break;
 		}
-		case 171:
-		{
-			match(171);
-			break;
-		}
 		case 172:
 		{
 			match(172);
 			break;
 		}
+		case 173:
+		{
+			match(173);
+			break;
+		}
 		case LITERAL_mobregreq:
 		{
 			match(LITERAL_mobregreq);
@@ -6771,7 +6795,7 @@ void PFCfgParser::port_op() {
 	Tracer traceInOut(this, "port_op");
 #line 1794 "pf.g"
 	PortSpec ps;
-#line 6775 "PFCfgParser.cpp"
+#line 6799 "PFCfgParser.cpp"
 	
 	try {      // for error handling
 		{
@@ -6784,14 +6808,14 @@ void PFCfgParser::port_op() {
 			unary_op();
 #line 1796 "pf.g"
 			ps.port_op = importer->tmp_port_op;
-#line 6788 "PFCfgParser.cpp"
+#line 6812 "PFCfgParser.cpp"
 			port_def();
 #line 1798 "pf.g"
 			
 			ps.port1 = importer->tmp_port_def;
 			ps.port2 = importer->tmp_port_def;
 			
-#line 6795 "PFCfgParser.cpp"
+#line 6819 "PFCfgParser.cpp"
 			break;
 		}
 		case WORD:
@@ -6804,17 +6828,17 @@ void PFCfgParser::port_op() {
 			ps.port2 = ps.port1;
 			ps.port_op = "=";
 			
-#line 6808 "PFCfgParser.cpp"
+#line 6832 "PFCfgParser.cpp"
 			{
 			if ((LA(1) == LESS_THAN || LA(1) == GREATER_THAN || LA(1) == COLON) && (_tokenSet_48.member(LA(2)))) {
 				binary_op();
 #line 1810 "pf.g"
 				ps.port_op = importer->tmp_port_op;
-#line 6814 "PFCfgParser.cpp"
+#line 6838 "PFCfgParser.cpp"
 				port_def();
 #line 1811 "pf.g"
 				ps.port2 = LT(0)->getText();
-#line 6818 "PFCfgParser.cpp"
+#line 6842 "PFCfgParser.cpp"
 			}
 			else if ((_tokenSet_58.member(LA(1))) && (_tokenSet_59.member(LA(2)))) {
 			}
@@ -6832,7 +6856,7 @@ void PFCfgParser::port_op() {
 			
 			ps.setFromPortRange(LT(0)->getText());
 			
-#line 6836 "PFCfgParser.cpp"
+#line 6860 "PFCfgParser.cpp"
 			break;
 		}
 		default:
@@ -6845,7 +6869,7 @@ void PFCfgParser::port_op() {
 		
 		importer->tmp_port_group.push_back(ps);
 		
-#line 6849 "PFCfgParser.cpp"
+#line 6873 "PFCfgParser.cpp"
 	}
 	catch (ANTLR_USE_NAMESPACE(antlr)RecognitionException& ex) {
 		reportError(ex);
@@ -6888,11 +6912,11 @@ void PFCfgParser::port_op_list() {
 				port_op();
 			}
 			else {
-				goto _loop273;
+				goto _loop274;
 			}
 			
 		}
-		_loop273:;
+		_loop274:;
 		} // ( ... )*
 		match(CLOSING_BRACE);
 	}
@@ -7044,6 +7068,7 @@ const char* PFCfgParser::tokenNames[] = {
 	"\"urpf-failed\"",
 	"\"any\"",
 	"\"no-route\"",
+	"MACRO",
 	"\"route-to\"",
 	"\"reply-to\"",
 	"\"dup-to\"",
@@ -7202,31 +7227,31 @@ const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_5(_tokenSet_5_data
 const unsigned long PFCfgParser::_tokenSet_6_data_[] = { 0UL, 4026531848UL, 1UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // COMMA "frags" "states" "src-nodes" "tables" "tables-entries" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_6(_tokenSet_6_data_,10);
-const unsigned long PFCfgParser::_tokenSet_7_data_[] = { 2064UL, 64UL, 68159490UL, 458752UL, 8282176UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_7_data_[] = { 2064UL, 64UL, 68159490UL, 458752UL, 16564288UL, 0UL, 6258688UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "reassemble" "scrub" EXLAMATION "no" OPENING_PAREN "all" 
 // "user" "to" "from" "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" 
 // "flags" "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
 // "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_7(_tokenSet_7_data_,16);
-const unsigned long PFCfgParser::_tokenSet_8_data_[] = { 8178UL, 134217805UL, 645598270UL, 33685696UL, 4286571392UL, 65535UL, 4177920UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_8_data_[] = { 8178UL, 134217805UL, 645598270UL, 33685696UL, 4278175616UL, 131071UL, 8355840UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE COMMENT_START "include" WORD EQUAL "antispoof" "altq" "queue" 
 // "set" "skip" OPENING_BRACE COMMA "reassemble" INT_CONST "scrub" "match" 
 // "table" LESS_THAN GREATER_THAN STRING EXLAMATION "self" IPV4 SLASH "no" 
 // "nat" "pass" "rdr" OPENING_PAREN IPV6 "binat" "block" "user" "tcp" "urpf-failed" 
-// "any" "no-route" "group" "fragment" "crop" "drop-ovl" "no-df" "min-ttl" 
-// "max-mss" "random-id" "flags" "icmp-type" "echorep" "unreach" "squench" 
-// "redir" "althost" "echoreq" "routeradv" "routersol" "timex" "paramprob" 
-// "timereq" "timerep" "inforeq" "inforep" "maskreq" "maskrep" "trace" 
-// "dataconv" "mobredir" "ipv6-where" "ipv6-here" "mobregreq" "mobregrep" 
+// "any" "no-route" MACRO "group" "fragment" "crop" "drop-ovl" "no-df" 
+// "min-ttl" "max-mss" "random-id" "flags" "icmp-type" "echorep" "unreach" 
+// "squench" "redir" "althost" "echoreq" "routeradv" "routersol" "timex" 
+// "paramprob" "timereq" "timerep" "inforeq" "inforep" "maskreq" "maskrep" 
+// "trace" "dataconv" "mobredir" "ipv6-where" "ipv6-here" "mobregreq" "mobregrep" 
 // "photuris" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
 // "state" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_8(_tokenSet_8_data_,16);
-const unsigned long PFCfgParser::_tokenSet_9_data_[] = { 2064UL, 64UL, 68159490UL, 131072UL, 8282112UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_9_data_[] = { 2064UL, 64UL, 68159490UL, 131072UL, 16564224UL, 0UL, 6258688UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "reassemble" "scrub" EXLAMATION "no" OPENING_PAREN "user" 
 // "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" "flags" "icmp-type" 
 // "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_9(_tokenSet_9_data_,16);
-const unsigned long PFCfgParser::_tokenSet_10_data_[] = { 8178UL, 134217805UL, 108530750UL, 33685696UL, 4286570752UL, 65535UL, 4177920UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_10_data_[] = { 8178UL, 134217805UL, 108530750UL, 33685696UL, 4278173952UL, 131071UL, 8355840UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE COMMENT_START "include" WORD EQUAL "antispoof" "altq" "queue" 
 // "set" "skip" OPENING_BRACE COMMA "reassemble" INT_CONST "scrub" "match" 
 // "table" LESS_THAN GREATER_THAN STRING EXLAMATION SLASH "no" "nat" "pass" 
@@ -7244,36 +7269,36 @@ const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_11(_tokenSet_11_da
 const unsigned long PFCfgParser::_tokenSet_12_data_[] = { 128UL, 134217752UL, 460800UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // WORD COMMA CLOSING_BRACE INT_CONST EXLAMATION "self" IPV4 NUMBER 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_12(_tokenSet_12_data_,10);
-const unsigned long PFCfgParser::_tokenSet_13_data_[] = { 16UL, 2UL, 8390656UL, 3997696UL, 64UL, 0UL, 98304UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_13_data_[] = { 16UL, 2UL, 8390656UL, 3997696UL, 64UL, 0UL, 196608UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "on" EXLAMATION MINUS "all" "to" "inet" "inet6" "proto" "from" 
 // "tagged" "tag" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_13(_tokenSet_13_data_,16);
-const unsigned long PFCfgParser::_tokenSet_14_data_[] = { 2064UL, 64UL, 76548098UL, 4128768UL, 8289344UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_14_data_[] = { 2064UL, 64UL, 76548098UL, 4128768UL, 16578624UL, 0UL, 6258688UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "reassemble" "scrub" EXLAMATION "no" MINUS OPENING_PAREN 
 // "all" "user" "to" "inet" "inet6" "proto" "from" "route-to" "reply-to" 
 // "dup-to" "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" 
 // "flags" "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
 // "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_14(_tokenSet_14_data_,16);
-const unsigned long PFCfgParser::_tokenSet_15_data_[] = { 2064UL, 64UL, 76548098UL, 2555904UL, 8282176UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_15_data_[] = { 2064UL, 64UL, 76548098UL, 2555904UL, 16564288UL, 0UL, 6258688UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "reassemble" "scrub" EXLAMATION "no" MINUS OPENING_PAREN 
 // "all" "user" "to" "proto" "from" "group" "fragment" "no-df" "min-ttl" 
 // "max-mss" "random-id" "flags" "icmp-type" "icmp6-type" "tagged" "tag" 
 // "keep" "modulate" "synproxy" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_15(_tokenSet_15_data_,16);
-const unsigned long PFCfgParser::_tokenSet_16_data_[] = { 2064UL, 64UL, 76548098UL, 458752UL, 8282176UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_16_data_[] = { 2064UL, 64UL, 76548098UL, 458752UL, 16564288UL, 0UL, 6258688UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "reassemble" "scrub" EXLAMATION "no" MINUS OPENING_PAREN 
 // "all" "user" "to" "from" "group" "fragment" "no-df" "min-ttl" "max-mss" 
 // "random-id" "flags" "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" 
 // "synproxy" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_16(_tokenSet_16_data_,16);
-const unsigned long PFCfgParser::_tokenSet_17_data_[] = { 2064UL, 64UL, 76548098UL, 131072UL, 8282112UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_17_data_[] = { 2064UL, 64UL, 76548098UL, 131072UL, 16564224UL, 0UL, 6258688UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "reassemble" "scrub" EXLAMATION "no" MINUS OPENING_PAREN 
 // "user" "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" "flags" 
 // "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
 // "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_17(_tokenSet_17_data_,16);
-const unsigned long PFCfgParser::_tokenSet_18_data_[] = { 2064UL, 72UL, 76548098UL, 131072UL, 8282112UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_18_data_[] = { 2064UL, 72UL, 76548098UL, 131072UL, 16564224UL, 0UL, 6258688UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" COMMA "reassemble" "scrub" EXLAMATION "no" MINUS OPENING_PAREN 
 // "user" "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" "flags" 
 // "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
@@ -7295,7 +7320,7 @@ const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_22(_tokenSet_22_da
 const unsigned long PFCfgParser::_tokenSet_23_data_[] = { 16UL, 0UL, 16777216UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "static-port" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_23(_tokenSet_23_data_,10);
-const unsigned long PFCfgParser::_tokenSet_24_data_[] = { 2448UL, 134217816UL, 2777684018UL, 393235UL, 8282112UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_24_data_[] = { 2448UL, 134217816UL, 2777684018UL, 393235UL, 16564224UL, 0UL, 6258688UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE WORD EQUAL "queue" COMMA CLOSING_BRACE "reassemble" INT_CONST 
 // "scrub" LESS_THAN GREATER_THAN EXLAMATION COLON "no" MINUS "static-port" 
 // OPENING_PAREN IPV6 "bitmask" "random" "source-hash" "round-robin" "user" 
@@ -7303,7 +7328,7 @@ const unsigned long PFCfgParser::_tokenSet_24_data_[] = { 2448UL, 134217816UL, 2
 // "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
 // "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_24(_tokenSet_24_data_,16);
-const unsigned long PFCfgParser::_tokenSet_25_data_[] = { 0UL, 134217728UL, 0UL, 0UL, 0UL, 4294901760UL, 16383UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_25_data_[] = { 0UL, 134217728UL, 0UL, 0UL, 0UL, 4294836224UL, 32767UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // INT_CONST "net-unr" "host-unr" "proto-unr" "port-unr" "needfrag" "srcfail" 
 // "net-unk" "host-unk" "isolate" "net-prohib" "host-prohib" "net-tos" 
 // "host-tos" "filter-prohib" "host-preced" "cutoff-preced" "redir-net" 
@@ -7311,29 +7336,30 @@ const unsigned long PFCfgParser::_tokenSet_25_data_[] = { 0UL, 134217728UL, 0UL,
 // "transit" "reassemb" "badhead" "optmiss" "badlen" "unknown-ind" "auth-fail" 
 // "decrypt-fail" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_25(_tokenSet_25_data_,16);
-const unsigned long PFCfgParser::_tokenSet_26_data_[] = { 2064UL, 66UL, 68159490UL, 4190208UL, 8289344UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_26_data_[] = { 2064UL, 66UL, 68159490UL, 4190208UL, 16578624UL, 0UL, 6258688UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "on" "reassemble" "scrub" EXLAMATION "no" OPENING_PAREN 
 // "in" "out" "log" "quick" "all" "user" "to" "inet" "inet6" "proto" "from" 
 // "route-to" "reply-to" "dup-to" "group" "fragment" "no-df" "min-ttl" 
 // "max-mss" "random-id" "flags" "icmp-type" "icmp6-type" "tagged" "tag" 
 // "keep" "modulate" "synproxy" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_26(_tokenSet_26_data_,16);
-const unsigned long PFCfgParser::_tokenSet_27_data_[] = { 8178UL, 134217807UL, 645598270UL, 4294951104UL, 4286578687UL, 65535UL, 4177920UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_27_data_[] = { 8178UL, 134217807UL, 645598270UL, 4294951104UL, 4278190079UL, 131071UL, 8355840UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE COMMENT_START "include" WORD EQUAL "antispoof" "altq" "queue" 
 // "set" "skip" "on" OPENING_BRACE COMMA "reassemble" INT_CONST "scrub" 
 // "match" "table" LESS_THAN GREATER_THAN STRING EXLAMATION "self" IPV4 
 // SLASH "no" "nat" "pass" "rdr" OPENING_PAREN IPV6 "binat" "block" "log" 
 // "quick" "all" "user" "to" "inet" "inet6" "proto" "ip" "icmp" "igmp" 
 // "tcp" "udp" "rdp" "rsvp" "gre" "esp" "ah" "eigrp" "ospf" "ipip" "vrrp" 
-// "l2tp" "isis" "from" "urpf-failed" "any" "no-route" "route-to" "reply-to" 
-// "dup-to" "group" "fragment" "crop" "drop-ovl" "no-df" "min-ttl" "max-mss" 
-// "random-id" "flags" "icmp-type" "echorep" "unreach" "squench" "redir" 
-// "althost" "echoreq" "routeradv" "routersol" "timex" "paramprob" "timereq" 
-// "timerep" "inforeq" "inforep" "maskreq" "maskrep" "trace" "dataconv" 
-// "mobredir" "ipv6-where" "ipv6-here" "mobregreq" "mobregrep" "photuris" 
-// "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" "state" "label" 
+// "l2tp" "isis" "from" "urpf-failed" "any" "no-route" MACRO "route-to" 
+// "reply-to" "dup-to" "group" "fragment" "crop" "drop-ovl" "no-df" "min-ttl" 
+// "max-mss" "random-id" "flags" "icmp-type" "echorep" "unreach" "squench" 
+// "redir" "althost" "echoreq" "routeradv" "routersol" "timex" "paramprob" 
+// "timereq" "timerep" "inforeq" "inforep" "maskreq" "maskrep" "trace" 
+// "dataconv" "mobredir" "ipv6-where" "ipv6-here" "mobregreq" "mobregrep" 
+// "photuris" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
+// "state" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_27(_tokenSet_27_data_,16);
-const unsigned long PFCfgParser::_tokenSet_28_data_[] = { 2064UL, 134217817UL, 202377218UL, 131072UL, 4286472192UL, 65535UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_28_data_[] = { 2064UL, 134217817UL, 202377218UL, 131072UL, 4277977088UL, 131071UL, 6258688UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "skip" COMMA CLOSING_BRACE "reassemble" INT_CONST "scrub" 
 // EXLAMATION "no" OPENING_PAREN CLOSING_PAREN "user" "group" "fragment" 
 // "no-df" "min-ttl" "max-mss" "random-id" "flags" "icmp-type" "echorep" 
@@ -7343,68 +7369,69 @@ const unsigned long PFCfgParser::_tokenSet_28_data_[] = { 2064UL, 134217817UL, 2
 // "mobregrep" "photuris" "icmp6-type" "tagged" "tag" "keep" "modulate" 
 // "synproxy" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_28(_tokenSet_28_data_,16);
-const unsigned long PFCfgParser::_tokenSet_29_data_[] = { 2064UL, 66UL, 68159490UL, 4177920UL, 8289344UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_29_data_[] = { 2064UL, 66UL, 68159490UL, 4177920UL, 16578624UL, 0UL, 6258688UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "on" "reassemble" "scrub" EXLAMATION "no" OPENING_PAREN 
 // "log" "quick" "all" "user" "to" "inet" "inet6" "proto" "from" "route-to" 
 // "reply-to" "dup-to" "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" 
 // "flags" "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
 // "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_29(_tokenSet_29_data_,16);
-const unsigned long PFCfgParser::_tokenSet_30_data_[] = { 2064UL, 66UL, 68159490UL, 4161536UL, 8289344UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_30_data_[] = { 2064UL, 66UL, 68159490UL, 4161536UL, 16578624UL, 0UL, 6258688UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "on" "reassemble" "scrub" EXLAMATION "no" OPENING_PAREN 
 // "quick" "all" "user" "to" "inet" "inet6" "proto" "from" "route-to" "reply-to" 
 // "dup-to" "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" 
 // "flags" "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
 // "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_30(_tokenSet_30_data_,16);
-const unsigned long PFCfgParser::_tokenSet_31_data_[] = { 8178UL, 134217807UL, 645598270UL, 4294901952UL, 4286578687UL, 65535UL, 4177920UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_31_data_[] = { 8178UL, 134217807UL, 645598270UL, 4294901952UL, 4278190079UL, 131071UL, 8355840UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE COMMENT_START "include" WORD EQUAL "antispoof" "altq" "queue" 
 // "set" "skip" "on" OPENING_BRACE COMMA "reassemble" INT_CONST "scrub" 
 // "match" "table" LESS_THAN GREATER_THAN STRING EXLAMATION "self" IPV4 
 // SLASH "no" "nat" "pass" "rdr" OPENING_PAREN IPV6 "binat" "block" "all" 
 // "user" "to" "inet" "inet6" "proto" "ip" "icmp" "igmp" "tcp" "udp" "rdp" 
 // "rsvp" "gre" "esp" "ah" "eigrp" "ospf" "ipip" "vrrp" "l2tp" "isis" "from" 
-// "urpf-failed" "any" "no-route" "route-to" "reply-to" "dup-to" "group" 
-// "fragment" "crop" "drop-ovl" "no-df" "min-ttl" "max-mss" "random-id" 
+// "urpf-failed" "any" "no-route" MACRO "route-to" "reply-to" "dup-to" 
+// "group" "fragment" "crop" "drop-ovl" "no-df" "min-ttl" "max-mss" "random-id" 
 // "flags" "icmp-type" "echorep" "unreach" "squench" "redir" "althost" 
 // "echoreq" "routeradv" "routersol" "timex" "paramprob" "timereq" "timerep" 
 // "inforeq" "inforep" "maskreq" "maskrep" "trace" "dataconv" "mobredir" 
 // "ipv6-where" "ipv6-here" "mobregreq" "mobregrep" "photuris" "icmp6-type" 
 // "tagged" "tag" "keep" "modulate" "synproxy" "state" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_31(_tokenSet_31_data_,16);
-const unsigned long PFCfgParser::_tokenSet_32_data_[] = { 2064UL, 66UL, 68159490UL, 4128768UL, 8289344UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_32_data_[] = { 2064UL, 66UL, 68159490UL, 4128768UL, 16578624UL, 0UL, 6258688UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "on" "reassemble" "scrub" EXLAMATION "no" OPENING_PAREN 
 // "all" "user" "to" "inet" "inet6" "proto" "from" "route-to" "reply-to" 
 // "dup-to" "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" 
 // "flags" "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
 // "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_32(_tokenSet_32_data_,16);
-const unsigned long PFCfgParser::_tokenSet_33_data_[] = { 8178UL, 134217805UL, 645598270UL, 4293329088UL, 4286571519UL, 65535UL, 4177920UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_33_data_[] = { 8178UL, 134217805UL, 645598270UL, 4293329088UL, 4278175743UL, 131071UL, 8355840UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE COMMENT_START "include" WORD EQUAL "antispoof" "altq" "queue" 
 // "set" "skip" OPENING_BRACE COMMA "reassemble" INT_CONST "scrub" "match" 
 // "table" LESS_THAN GREATER_THAN STRING EXLAMATION "self" IPV4 SLASH "no" 
 // "nat" "pass" "rdr" OPENING_PAREN IPV6 "binat" "block" "all" "user" "to" 
 // "proto" "ip" "icmp" "igmp" "tcp" "udp" "rdp" "rsvp" "gre" "esp" "ah" 
 // "eigrp" "ospf" "ipip" "vrrp" "l2tp" "isis" "from" "urpf-failed" "any" 
-// "no-route" "group" "fragment" "crop" "drop-ovl" "no-df" "min-ttl" "max-mss" 
-// "random-id" "flags" "icmp-type" "echorep" "unreach" "squench" "redir" 
-// "althost" "echoreq" "routeradv" "routersol" "timex" "paramprob" "timereq" 
-// "timerep" "inforeq" "inforep" "maskreq" "maskrep" "trace" "dataconv" 
-// "mobredir" "ipv6-where" "ipv6-here" "mobregreq" "mobregrep" "photuris" 
-// "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" "state" "label" 
+// "no-route" MACRO "group" "fragment" "crop" "drop-ovl" "no-df" "min-ttl" 
+// "max-mss" "random-id" "flags" "icmp-type" "echorep" "unreach" "squench" 
+// "redir" "althost" "echoreq" "routeradv" "routersol" "timex" "paramprob" 
+// "timereq" "timerep" "inforeq" "inforep" "maskreq" "maskrep" "trace" 
+// "dataconv" "mobredir" "ipv6-where" "ipv6-here" "mobregreq" "mobregrep" 
+// "photuris" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
+// "state" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_33(_tokenSet_33_data_,16);
-const unsigned long PFCfgParser::_tokenSet_34_data_[] = { 2064UL, 64UL, 68159490UL, 4128768UL, 8282176UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_34_data_[] = { 2064UL, 64UL, 68159490UL, 4128768UL, 16564288UL, 0UL, 6258688UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "reassemble" "scrub" EXLAMATION "no" OPENING_PAREN "all" 
 // "user" "to" "inet" "inet6" "proto" "from" "group" "fragment" "no-df" 
 // "min-ttl" "max-mss" "random-id" "flags" "icmp-type" "icmp6-type" "tagged" 
 // "tag" "keep" "modulate" "synproxy" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_34(_tokenSet_34_data_,16);
-const unsigned long PFCfgParser::_tokenSet_35_data_[] = { 2048UL, 72UL, 68159490UL, 131072UL, 8282112UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_35_data_[] = { 2048UL, 72UL, 68159490UL, 131072UL, 16564224UL, 0UL, 6258688UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // "queue" COMMA "reassemble" "scrub" EXLAMATION "no" OPENING_PAREN "user" 
 // "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" "flags" "icmp-type" 
 // "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_35(_tokenSet_35_data_,16);
-const unsigned long PFCfgParser::_tokenSet_36_data_[] = { 2064UL, 66UL, 76548098UL, 4161536UL, 8289344UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_36_data_[] = { 2064UL, 66UL, 76548098UL, 4161536UL, 16578624UL, 0UL, 6258688UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "on" "reassemble" "scrub" EXLAMATION "no" MINUS OPENING_PAREN 
 // "quick" "all" "user" "to" "inet" "inet6" "proto" "from" "route-to" "reply-to" 
 // "dup-to" "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" 
@@ -7414,14 +7441,14 @@ const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_36(_tokenSet_36_da
 const unsigned long PFCfgParser::_tokenSet_37_data_[] = { 0UL, 8UL, 134217728UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // COMMA CLOSING_PAREN 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_37(_tokenSet_37_data_,10);
-const unsigned long PFCfgParser::_tokenSet_38_data_[] = { 2192UL, 88UL, 76548098UL, 4128768UL, 8289344UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_38_data_[] = { 2192UL, 88UL, 76548098UL, 4128768UL, 16578624UL, 0UL, 6258688UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE WORD "queue" COMMA CLOSING_BRACE "reassemble" "scrub" EXLAMATION 
 // "no" MINUS OPENING_PAREN "all" "user" "to" "inet" "inet6" "proto" "from" 
 // "route-to" "reply-to" "dup-to" "group" "fragment" "no-df" "min-ttl" 
 // "max-mss" "random-id" "flags" "icmp-type" "icmp6-type" "tagged" "tag" 
 // "keep" "modulate" "synproxy" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_38(_tokenSet_38_data_,16);
-const unsigned long PFCfgParser::_tokenSet_39_data_[] = { 2064UL, 134217820UL, 76548098UL, 4291231744UL, 8282239UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_39_data_[] = { 2064UL, 134217820UL, 76548098UL, 4291231744UL, 16564351UL, 0UL, 6258688UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" OPENING_BRACE COMMA CLOSING_BRACE "reassemble" INT_CONST 
 // "scrub" EXLAMATION "no" MINUS OPENING_PAREN "all" "user" "to" "ip" "icmp" 
 // "igmp" "tcp" "udp" "rdp" "rsvp" "gre" "esp" "ah" "eigrp" "ospf" "ipip" 
@@ -7433,40 +7460,41 @@ const unsigned long PFCfgParser::_tokenSet_40_data_[] = { 0UL, 134217740UL, 0UL,
 // OPENING_BRACE COMMA INT_CONST "ip" "icmp" "igmp" "tcp" "udp" "rdp" "rsvp" 
 // "gre" "esp" "ah" "eigrp" "ospf" "ipip" "vrrp" "l2tp" "isis" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_40(_tokenSet_40_data_,12);
-const unsigned long PFCfgParser::_tokenSet_41_data_[] = { 2064UL, 64UL, 76548098UL, 393216UL, 8282112UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_41_data_[] = { 2064UL, 64UL, 76548098UL, 393216UL, 16564224UL, 0UL, 6258688UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "reassemble" "scrub" EXLAMATION "no" MINUS OPENING_PAREN 
 // "user" "to" "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" 
 // "flags" "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
 // "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_41(_tokenSet_41_data_,16);
-const unsigned long PFCfgParser::_tokenSet_42_data_[] = { 2064UL, 64UL, 344983554UL, 393216UL, 8282112UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_42_data_[] = { 2064UL, 64UL, 344983554UL, 393216UL, 16564224UL, 0UL, 6258688UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "reassemble" "scrub" EXLAMATION "no" MINUS OPENING_PAREN 
 // "port" "user" "to" "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" 
 // "flags" "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
 // "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_42(_tokenSet_42_data_,16);
-const unsigned long PFCfgParser::_tokenSet_43_data_[] = { 2064UL, 64UL, 344983554UL, 131072UL, 8282112UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_43_data_[] = { 2064UL, 64UL, 344983554UL, 131072UL, 16564224UL, 0UL, 6258688UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "reassemble" "scrub" EXLAMATION "no" MINUS OPENING_PAREN 
 // "port" "user" "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" 
 // "flags" "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
 // "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_43(_tokenSet_43_data_,16);
-const unsigned long PFCfgParser::_tokenSet_44_data_[] = { 2192UL, 88UL, 882051090UL, 393216UL, 8282112UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_44_data_[] = { 2192UL, 88UL, 882051090UL, 393216UL, 16565248UL, 0UL, 6258688UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE WORD "queue" COMMA CLOSING_BRACE "reassemble" "scrub" LESS_THAN 
 // EXLAMATION "self" IPV4 "no" MINUS OPENING_PAREN "port" IPV6 "user" "to" 
-// "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" "flags" "icmp-type" 
-// "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" "label" 
+// MACRO "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" "flags" 
+// "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
+// "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_44(_tokenSet_44_data_,16);
-const unsigned long PFCfgParser::_tokenSet_45_data_[] = { 128UL, 8UL, 604178448UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
-// WORD COMMA LESS_THAN EXLAMATION "self" IPV4 OPENING_PAREN IPV6 
-const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_45(_tokenSet_45_data_,10);
-const unsigned long PFCfgParser::_tokenSet_46_data_[] = { 2064UL, 88UL, 68159490UL, 4128768UL, 8282176UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_45_data_[] = { 128UL, 8UL, 604178448UL, 0UL, 1024UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+// WORD COMMA LESS_THAN EXLAMATION "self" IPV4 OPENING_PAREN IPV6 MACRO 
+const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_45(_tokenSet_45_data_,12);
+const unsigned long PFCfgParser::_tokenSet_46_data_[] = { 2064UL, 88UL, 68159490UL, 4128768UL, 16564288UL, 0UL, 6258688UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" COMMA CLOSING_BRACE "reassemble" "scrub" EXLAMATION 
 // "no" OPENING_PAREN "all" "user" "to" "inet" "inet6" "proto" "from" "group" 
 // "fragment" "no-df" "min-ttl" "max-mss" "random-id" "flags" "icmp-type" 
 // "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_46(_tokenSet_46_data_,16);
-const unsigned long PFCfgParser::_tokenSet_47_data_[] = { 2064UL, 72UL, 68159490UL, 131072UL, 8282112UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_47_data_[] = { 2064UL, 72UL, 68159490UL, 131072UL, 16564224UL, 0UL, 6258688UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" COMMA "reassemble" "scrub" EXLAMATION "no" OPENING_PAREN 
 // "user" "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" "flags" 
 // "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
@@ -7475,13 +7503,13 @@ const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_47(_tokenSet_47_da
 const unsigned long PFCfgParser::_tokenSet_48_data_[] = { 128UL, 134217728UL, 48UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // WORD INT_CONST LESS_THAN GREATER_THAN 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_48(_tokenSet_48_data_,10);
-const unsigned long PFCfgParser::_tokenSet_49_data_[] = { 2448UL, 134217816UL, 68159538UL, 131072UL, 8282112UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_49_data_[] = { 2448UL, 134217816UL, 68159538UL, 131072UL, 16564224UL, 0UL, 6258688UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE WORD EQUAL "queue" COMMA CLOSING_BRACE "reassemble" INT_CONST 
 // "scrub" LESS_THAN GREATER_THAN EXLAMATION "no" OPENING_PAREN "user" 
 // "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" "flags" "icmp-type" 
 // "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_49(_tokenSet_49_data_,16);
-const unsigned long PFCfgParser::_tokenSet_50_data_[] = { 8178UL, 134217821UL, 108534846UL, 33685696UL, 4286570752UL, 65535UL, 4177920UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_50_data_[] = { 8178UL, 134217821UL, 108534846UL, 33685696UL, 4278173952UL, 131071UL, 8355840UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE COMMENT_START "include" WORD EQUAL "antispoof" "altq" "queue" 
 // "set" "skip" OPENING_BRACE COMMA CLOSING_BRACE "reassemble" INT_CONST 
 // "scrub" "match" "table" LESS_THAN GREATER_THAN STRING EXLAMATION COLON 
@@ -7499,16 +7527,16 @@ const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_51(_tokenSet_51_da
 const unsigned long PFCfgParser::_tokenSet_52_data_[] = { 128UL, 134217728UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // WORD INT_CONST 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_52(_tokenSet_52_data_,10);
-const unsigned long PFCfgParser::_tokenSet_53_data_[] = { 2064UL, 72UL, 202377218UL, 131072UL, 8282112UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_53_data_[] = { 2064UL, 72UL, 202377218UL, 131072UL, 16564224UL, 0UL, 6258688UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" COMMA "reassemble" "scrub" EXLAMATION "no" OPENING_PAREN 
 // CLOSING_PAREN "user" "group" "fragment" "no-df" "min-ttl" "max-mss" 
 // "random-id" "flags" "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" 
 // "synproxy" "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_53(_tokenSet_53_data_,16);
-const unsigned long PFCfgParser::_tokenSet_54_data_[] = { 0UL, 72UL, 0UL, 0UL, 1982464UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_54_data_[] = { 0UL, 72UL, 0UL, 0UL, 3964928UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // COMMA "reassemble" "fragment" "no-df" "min-ttl" "max-mss" "random-id" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_54(_tokenSet_54_data_,12);
-const unsigned long PFCfgParser::_tokenSet_55_data_[] = { 2064UL, 134217817UL, 68159490UL, 131072UL, 4286472192UL, 65535UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_55_data_[] = { 2064UL, 134217817UL, 68159490UL, 131072UL, 4277977088UL, 131071UL, 6258688UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "skip" COMMA CLOSING_BRACE "reassemble" INT_CONST "scrub" 
 // EXLAMATION "no" OPENING_PAREN "user" "group" "fragment" "no-df" "min-ttl" 
 // "max-mss" "random-id" "flags" "icmp-type" "echorep" "unreach" "squench" 
@@ -7518,13 +7546,13 @@ const unsigned long PFCfgParser::_tokenSet_55_data_[] = { 2064UL, 134217817UL, 6
 // "photuris" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
 // "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_55(_tokenSet_55_data_,16);
-const unsigned long PFCfgParser::_tokenSet_56_data_[] = { 0UL, 134217737UL, 0UL, 0UL, 4278190080UL, 65535UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_56_data_[] = { 0UL, 134217737UL, 0UL, 0UL, 4261412864UL, 131071UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // "skip" COMMA INT_CONST "echorep" "unreach" "squench" "redir" "althost" 
 // "echoreq" "routeradv" "routersol" "timex" "paramprob" "timereq" "timerep" 
 // "inforeq" "inforep" "maskreq" "maskrep" "trace" "dataconv" "mobredir" 
 // "ipv6-where" "ipv6-here" "mobregreq" "mobregrep" "photuris" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_56(_tokenSet_56_data_,12);
-const unsigned long PFCfgParser::_tokenSet_57_data_[] = { 2064UL, 134217817UL, 68159490UL, 131072UL, 4294860800UL, 65535UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_57_data_[] = { 2064UL, 134217817UL, 68159490UL, 131072UL, 4294754304UL, 131071UL, 6258688UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE "queue" "skip" COMMA CLOSING_BRACE "reassemble" INT_CONST "scrub" 
 // EXLAMATION "no" OPENING_PAREN "user" "group" "fragment" "no-df" "min-ttl" 
 // "max-mss" "random-id" "flags" "icmp-type" "code" "echorep" "unreach" 
@@ -7534,20 +7562,20 @@ const unsigned long PFCfgParser::_tokenSet_57_data_[] = { 2064UL, 134217817UL, 6
 // "photuris" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
 // "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_57(_tokenSet_57_data_,16);
-const unsigned long PFCfgParser::_tokenSet_58_data_[] = { 2448UL, 134217816UL, 613419058UL, 393216UL, 8282112UL, 0UL, 3129344UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_58_data_[] = { 2448UL, 134217816UL, 613419058UL, 393216UL, 16564224UL, 0UL, 6258688UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // NEWLINE WORD EQUAL "queue" COMMA CLOSING_BRACE "reassemble" INT_CONST 
 // "scrub" LESS_THAN GREATER_THAN EXLAMATION "no" MINUS OPENING_PAREN IPV6 
 // "user" "to" "group" "fragment" "no-df" "min-ttl" "max-mss" "random-id" 
 // "flags" "icmp-type" "icmp6-type" "tagged" "tag" "keep" "modulate" "synproxy" 
 // "label" 
 const ANTLR_USE_NAMESPACE(antlr)BitSet PFCfgParser::_tokenSet_58(_tokenSet_58_data_,16);
-const unsigned long PFCfgParser::_tokenSet_59_data_[] = { 8178UL, 134217821UL, 653990974UL, 33947840UL, 4286571264UL, 65535UL, 4177920UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
+const unsigned long PFCfgParser::_tokenSet_59_data_[] = { 8178UL, 134217821UL, 653990974UL, 33947840UL, 4278175488UL, 131071UL, 8355840UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL, 0UL };
 // EOF NEWLINE COMMENT_START "include" WORD EQUAL "antispoof" "altq" "queue" 
 // "set" "skip" OPENING_BRACE COMMA CLOSING_BRACE "reassemble" INT_CONST 
 // "scrub" "match" "table" LESS_THAN GREATER_THAN STRING EXLAMATION COLON 
 // "self" IPV4 SLASH "no" "nat" "pass" MINUS "rdr" OPENING_PAREN IPV6 "binat" 
-// "block" "user" "to" "tcp" "any" "no-route" "group" "fragment" "crop" 
-// "drop-ovl" "no-df" "min-ttl" "max-mss" "random-id" "flags" "icmp-type" 
+// "block" "user" "to" "tcp" "any" "no-route" MACRO "group" "fragment" 
+// "crop" "drop-ovl" "no-df" "min-ttl" "max-mss" "random-id" "flags" "icmp-type" 
 // "echorep" "unreach" "squench" "redir" "althost" "echoreq" "routeradv" 
 // "routersol" "timex" "paramprob" "timereq" "timerep" "inforeq" "inforep" 
 // "maskreq" "maskrep" "trace" "dataconv" "mobredir" "ipv6-where" "ipv6-here" 
diff --git a/src/parsers/PFCfgParser.hpp b/src/parsers/PFCfgParser.hpp
index 85670849a..0b5fe4ec3 100644
--- a/src/parsers/PFCfgParser.hpp
+++ b/src/parsers/PFCfgParser.hpp
@@ -201,10 +201,10 @@ protected:
 private:
 	static const char* tokenNames[];
 #ifndef NO_STATIC_CONSTS
-	static const int NUM_TOKENS = 261;
+	static const int NUM_TOKENS = 262;
 #else
 	enum {
-		NUM_TOKENS = 261
+		NUM_TOKENS = 262
 	};
 #endif
 	
diff --git a/src/parsers/PFCfgParserTokenTypes.hpp b/src/parsers/PFCfgParserTokenTypes.hpp
index 107d29e36..fabc7025c 100644
--- a/src/parsers/PFCfgParserTokenTypes.hpp
+++ b/src/parsers/PFCfgParserTokenTypes.hpp
@@ -146,129 +146,130 @@ struct CUSTOM_API PFCfgParserTokenTypes {
 		URPF_FAILED = 135,
 		ANY = 136,
 		NO_ROUTE = 137,
-		ROUTE_TO = 138,
-		REPLY_TO = 139,
-		DUP_TO = 140,
-		GROUP = 141,
-		LITERAL_fragment = 142,
-		LITERAL_crop = 143,
-		// "drop-ovl" = 144
-		// "no-df" = 145
-		// "min-ttl" = 146
-		// "max-mss" = 147
-		// "random-id" = 148
-		FLAGS = 149,
-		ICMP_TYPE = 150,
-		ICMP_CODE = 151,
-		LITERAL_echorep = 152,
-		LITERAL_unreach = 153,
-		LITERAL_squench = 154,
-		LITERAL_redir = 155,
-		LITERAL_althost = 156,
-		LITERAL_echoreq = 157,
-		LITERAL_routeradv = 158,
-		LITERAL_routersol = 159,
-		LITERAL_timex = 160,
-		LITERAL_paramprob = 161,
-		LITERAL_timereq = 162,
-		LITERAL_timerep = 163,
-		LITERAL_inforeq = 164,
-		LITERAL_inforep = 165,
-		LITERAL_maskreq = 166,
-		LITERAL_maskrep = 167,
-		LITERAL_trace = 168,
-		LITERAL_dataconv = 169,
-		LITERAL_mobredir = 170,
-		// "ipv6-where" = 171
-		// "ipv6-here" = 172
-		LITERAL_mobregreq = 173,
-		LITERAL_mobregrep = 174,
-		LITERAL_photuris = 175,
-		// "net-unr" = 176
-		// "host-unr" = 177
-		// "proto-unr" = 178
-		// "port-unr" = 179
-		LITERAL_needfrag = 180,
-		LITERAL_srcfail = 181,
-		// "net-unk" = 182
-		// "host-unk" = 183
-		LITERAL_isolate = 184,
-		// "net-prohib" = 185
-		// "host-prohib" = 186
-		// "net-tos" = 187
-		// "host-tos" = 188
-		// "filter-prohib" = 189
-		// "host-preced" = 190
-		// "cutoff-preced" = 191
-		// "redir-net" = 192
-		// "redir-host" = 193
-		// "redir-tos-net" = 194
-		// "redir-tos-host" = 195
-		// "normal-adv" = 196
-		// "common-adv" = 197
-		LITERAL_transit = 198,
-		LITERAL_reassemb = 199,
-		LITERAL_badhead = 200,
-		LITERAL_optmiss = 201,
-		LITERAL_badlen = 202,
-		// "unknown-ind" = 203
-		// "auth-fail" = 204
-		// "decrypt-fail" = 205
-		ICMP6_TYPE = 206,
-		TAGGED = 207,
-		TAG = 208,
-		KEEP = 209,
-		MODULATE = 210,
-		SYNPROXY = 211,
-		STATE = 212,
-		LABEL = 213,
-		EXIT = 214,
-		QUIT = 215,
-		INTRFACE = 216,
-		ICMP6 = 217,
-		IGRP = 218,
-		IPSEC = 219,
-		NOS = 220,
-		PCP = 221,
-		PIM = 222,
-		PPTP = 223,
-		RIP = 224,
-		SNP = 225,
-		HOST = 226,
-		RANGE = 227,
-		LOG_LEVEL_ALERTS = 228,
-		LOG_LEVEL_CRITICAL = 229,
-		LOG_LEVEL_DEBUGGING = 230,
-		LOG_LEVEL_EMERGENCIES = 231,
-		LOG_LEVEL_ERRORS = 232,
-		LOG_LEVEL_INFORMATIONAL = 233,
-		LOG_LEVEL_NOTIFICATIONS = 234,
-		LOG_LEVEL_WARNINGS = 235,
-		LOG_LEVEL_DISABLE = 236,
-		LOG_LEVEL_INACTIVE = 237,
-		Whitespace = 238,
-		HEX_CONST = 239,
-		NEG_INT_CONST = 240,
-		HEX_DIGIT = 241,
-		DIGIT = 242,
-		NUM_3DIGIT = 243,
-		NUM_HEX_4DIGIT = 244,
-		NUMBER_ADDRESS_OR_WORD = 245,
-		PIPE_CHAR = 246,
-		PERCENT = 247,
-		AMPERSAND = 248,
-		APOSTROPHE = 249,
-		PLUS = 250,
-		DOT = 251,
-		SEMICOLON = 252,
-		QUESTION = 253,
-		COMMERCIAL_AT = 254,
-		OPENING_SQUARE = 255,
-		CLOSING_SQUARE = 256,
-		CARET = 257,
-		UNDERLINE = 258,
-		TILDE = 259,
-		DOUBLE_QUOTE = 260,
+		MACRO = 138,
+		ROUTE_TO = 139,
+		REPLY_TO = 140,
+		DUP_TO = 141,
+		GROUP = 142,
+		LITERAL_fragment = 143,
+		LITERAL_crop = 144,
+		// "drop-ovl" = 145
+		// "no-df" = 146
+		// "min-ttl" = 147
+		// "max-mss" = 148
+		// "random-id" = 149
+		FLAGS = 150,
+		ICMP_TYPE = 151,
+		ICMP_CODE = 152,
+		LITERAL_echorep = 153,
+		LITERAL_unreach = 154,
+		LITERAL_squench = 155,
+		LITERAL_redir = 156,
+		LITERAL_althost = 157,
+		LITERAL_echoreq = 158,
+		LITERAL_routeradv = 159,
+		LITERAL_routersol = 160,
+		LITERAL_timex = 161,
+		LITERAL_paramprob = 162,
+		LITERAL_timereq = 163,
+		LITERAL_timerep = 164,
+		LITERAL_inforeq = 165,
+		LITERAL_inforep = 166,
+		LITERAL_maskreq = 167,
+		LITERAL_maskrep = 168,
+		LITERAL_trace = 169,
+		LITERAL_dataconv = 170,
+		LITERAL_mobredir = 171,
+		// "ipv6-where" = 172
+		// "ipv6-here" = 173
+		LITERAL_mobregreq = 174,
+		LITERAL_mobregrep = 175,
+		LITERAL_photuris = 176,
+		// "net-unr" = 177
+		// "host-unr" = 178
+		// "proto-unr" = 179
+		// "port-unr" = 180
+		LITERAL_needfrag = 181,
+		LITERAL_srcfail = 182,
+		// "net-unk" = 183
+		// "host-unk" = 184
+		LITERAL_isolate = 185,
+		// "net-prohib" = 186
+		// "host-prohib" = 187
+		// "net-tos" = 188
+		// "host-tos" = 189
+		// "filter-prohib" = 190
+		// "host-preced" = 191
+		// "cutoff-preced" = 192
+		// "redir-net" = 193
+		// "redir-host" = 194
+		// "redir-tos-net" = 195
+		// "redir-tos-host" = 196
+		// "normal-adv" = 197
+		// "common-adv" = 198
+		LITERAL_transit = 199,
+		LITERAL_reassemb = 200,
+		LITERAL_badhead = 201,
+		LITERAL_optmiss = 202,
+		LITERAL_badlen = 203,
+		// "unknown-ind" = 204
+		// "auth-fail" = 205
+		// "decrypt-fail" = 206
+		ICMP6_TYPE = 207,
+		TAGGED = 208,
+		TAG = 209,
+		KEEP = 210,
+		MODULATE = 211,
+		SYNPROXY = 212,
+		STATE = 213,
+		LABEL = 214,
+		EXIT = 215,
+		QUIT = 216,
+		INTRFACE = 217,
+		ICMP6 = 218,
+		IGRP = 219,
+		IPSEC = 220,
+		NOS = 221,
+		PCP = 222,
+		PIM = 223,
+		PPTP = 224,
+		RIP = 225,
+		SNP = 226,
+		HOST = 227,
+		RANGE = 228,
+		LOG_LEVEL_ALERTS = 229,
+		LOG_LEVEL_CRITICAL = 230,
+		LOG_LEVEL_DEBUGGING = 231,
+		LOG_LEVEL_EMERGENCIES = 232,
+		LOG_LEVEL_ERRORS = 233,
+		LOG_LEVEL_INFORMATIONAL = 234,
+		LOG_LEVEL_NOTIFICATIONS = 235,
+		LOG_LEVEL_WARNINGS = 236,
+		LOG_LEVEL_DISABLE = 237,
+		LOG_LEVEL_INACTIVE = 238,
+		Whitespace = 239,
+		HEX_CONST = 240,
+		NEG_INT_CONST = 241,
+		HEX_DIGIT = 242,
+		DIGIT = 243,
+		NUM_3DIGIT = 244,
+		NUM_HEX_4DIGIT = 245,
+		NUMBER_ADDRESS_OR_WORD = 246,
+		PIPE_CHAR = 247,
+		PERCENT = 248,
+		AMPERSAND = 249,
+		APOSTROPHE = 250,
+		PLUS = 251,
+		DOT = 252,
+		SEMICOLON = 253,
+		QUESTION = 254,
+		COMMERCIAL_AT = 255,
+		OPENING_SQUARE = 256,
+		CLOSING_SQUARE = 257,
+		CARET = 258,
+		UNDERLINE = 259,
+		TILDE = 260,
+		DOUBLE_QUOTE = 261,
 		NULL_TREE_LOOKAHEAD = 3
 	};
 #ifdef __cplusplus
diff --git a/src/parsers/PFCfgParserTokenTypes.txt b/src/parsers/PFCfgParserTokenTypes.txt
index c59b573c1..f59bbc1cc 100644
--- a/src/parsers/PFCfgParserTokenTypes.txt
+++ b/src/parsers/PFCfgParserTokenTypes.txt
@@ -134,126 +134,127 @@ FROM="from"=134
 URPF_FAILED="urpf-failed"=135
 ANY="any"=136
 NO_ROUTE="no-route"=137
-ROUTE_TO="route-to"=138
-REPLY_TO="reply-to"=139
-DUP_TO="dup-to"=140
-GROUP="group"=141
-LITERAL_fragment="fragment"=142
-LITERAL_crop="crop"=143
-"drop-ovl"=144
-"no-df"=145
-"min-ttl"=146
-"max-mss"=147
-"random-id"=148
-FLAGS="flags"=149
-ICMP_TYPE="icmp-type"=150
-ICMP_CODE="code"=151
-LITERAL_echorep="echorep"=152
-LITERAL_unreach="unreach"=153
-LITERAL_squench="squench"=154
-LITERAL_redir="redir"=155
-LITERAL_althost="althost"=156
-LITERAL_echoreq="echoreq"=157
-LITERAL_routeradv="routeradv"=158
-LITERAL_routersol="routersol"=159
-LITERAL_timex="timex"=160
-LITERAL_paramprob="paramprob"=161
-LITERAL_timereq="timereq"=162
-LITERAL_timerep="timerep"=163
-LITERAL_inforeq="inforeq"=164
-LITERAL_inforep="inforep"=165
-LITERAL_maskreq="maskreq"=166
-LITERAL_maskrep="maskrep"=167
-LITERAL_trace="trace"=168
-LITERAL_dataconv="dataconv"=169
-LITERAL_mobredir="mobredir"=170
-"ipv6-where"=171
-"ipv6-here"=172
-LITERAL_mobregreq="mobregreq"=173
-LITERAL_mobregrep="mobregrep"=174
-LITERAL_photuris="photuris"=175
-"net-unr"=176
-"host-unr"=177
-"proto-unr"=178
-"port-unr"=179
-LITERAL_needfrag="needfrag"=180
-LITERAL_srcfail="srcfail"=181
-"net-unk"=182
-"host-unk"=183
-LITERAL_isolate="isolate"=184
-"net-prohib"=185
-"host-prohib"=186
-"net-tos"=187
-"host-tos"=188
-"filter-prohib"=189
-"host-preced"=190
-"cutoff-preced"=191
-"redir-net"=192
-"redir-host"=193
-"redir-tos-net"=194
-"redir-tos-host"=195
-"normal-adv"=196
-"common-adv"=197
-LITERAL_transit="transit"=198
-LITERAL_reassemb="reassemb"=199
-LITERAL_badhead="badhead"=200
-LITERAL_optmiss="optmiss"=201
-LITERAL_badlen="badlen"=202
-"unknown-ind"=203
-"auth-fail"=204
-"decrypt-fail"=205
-ICMP6_TYPE="icmp6-type"=206
-TAGGED="tagged"=207
-TAG="tag"=208
-KEEP="keep"=209
-MODULATE="modulate"=210
-SYNPROXY="synproxy"=211
-STATE="state"=212
-LABEL="label"=213
-EXIT="exit"=214
-QUIT="quit"=215
-INTRFACE="interface"=216
-ICMP6="icmp6"=217
-IGRP="igrp"=218
-IPSEC="ipsec"=219
-NOS="nos"=220
-PCP="pcp"=221
-PIM="pim"=222
-PPTP="pptp"=223
-RIP="rip"=224
-SNP="snp"=225
-HOST="host"=226
-RANGE="range"=227
-LOG_LEVEL_ALERTS="alerts"=228
-LOG_LEVEL_CRITICAL="critical"=229
-LOG_LEVEL_DEBUGGING="debugging"=230
-LOG_LEVEL_EMERGENCIES="emergencies"=231
-LOG_LEVEL_ERRORS="errors"=232
-LOG_LEVEL_INFORMATIONAL="informational"=233
-LOG_LEVEL_NOTIFICATIONS="notifications"=234
-LOG_LEVEL_WARNINGS="warnings"=235
-LOG_LEVEL_DISABLE="disable"=236
-LOG_LEVEL_INACTIVE="inactive"=237
-Whitespace=238
-HEX_CONST=239
-NEG_INT_CONST=240
-HEX_DIGIT=241
-DIGIT=242
-NUM_3DIGIT=243
-NUM_HEX_4DIGIT=244
-NUMBER_ADDRESS_OR_WORD=245
-PIPE_CHAR=246
-PERCENT=247
-AMPERSAND=248
-APOSTROPHE=249
-PLUS=250
-DOT=251
-SEMICOLON=252
-QUESTION=253
-COMMERCIAL_AT=254
-OPENING_SQUARE=255
-CLOSING_SQUARE=256
-CARET=257
-UNDERLINE=258
-TILDE=259
-DOUBLE_QUOTE=260
+MACRO=138
+ROUTE_TO="route-to"=139
+REPLY_TO="reply-to"=140
+DUP_TO="dup-to"=141
+GROUP="group"=142
+LITERAL_fragment="fragment"=143
+LITERAL_crop="crop"=144
+"drop-ovl"=145
+"no-df"=146
+"min-ttl"=147
+"max-mss"=148
+"random-id"=149
+FLAGS="flags"=150
+ICMP_TYPE="icmp-type"=151
+ICMP_CODE="code"=152
+LITERAL_echorep="echorep"=153
+LITERAL_unreach="unreach"=154
+LITERAL_squench="squench"=155
+LITERAL_redir="redir"=156
+LITERAL_althost="althost"=157
+LITERAL_echoreq="echoreq"=158
+LITERAL_routeradv="routeradv"=159
+LITERAL_routersol="routersol"=160
+LITERAL_timex="timex"=161
+LITERAL_paramprob="paramprob"=162
+LITERAL_timereq="timereq"=163
+LITERAL_timerep="timerep"=164
+LITERAL_inforeq="inforeq"=165
+LITERAL_inforep="inforep"=166
+LITERAL_maskreq="maskreq"=167
+LITERAL_maskrep="maskrep"=168
+LITERAL_trace="trace"=169
+LITERAL_dataconv="dataconv"=170
+LITERAL_mobredir="mobredir"=171
+"ipv6-where"=172
+"ipv6-here"=173
+LITERAL_mobregreq="mobregreq"=174
+LITERAL_mobregrep="mobregrep"=175
+LITERAL_photuris="photuris"=176
+"net-unr"=177
+"host-unr"=178
+"proto-unr"=179
+"port-unr"=180
+LITERAL_needfrag="needfrag"=181
+LITERAL_srcfail="srcfail"=182
+"net-unk"=183
+"host-unk"=184
+LITERAL_isolate="isolate"=185
+"net-prohib"=186
+"host-prohib"=187
+"net-tos"=188
+"host-tos"=189
+"filter-prohib"=190
+"host-preced"=191
+"cutoff-preced"=192
+"redir-net"=193
+"redir-host"=194
+"redir-tos-net"=195
+"redir-tos-host"=196
+"normal-adv"=197
+"common-adv"=198
+LITERAL_transit="transit"=199
+LITERAL_reassemb="reassemb"=200
+LITERAL_badhead="badhead"=201
+LITERAL_optmiss="optmiss"=202
+LITERAL_badlen="badlen"=203
+"unknown-ind"=204
+"auth-fail"=205
+"decrypt-fail"=206
+ICMP6_TYPE="icmp6-type"=207
+TAGGED="tagged"=208
+TAG="tag"=209
+KEEP="keep"=210
+MODULATE="modulate"=211
+SYNPROXY="synproxy"=212
+STATE="state"=213
+LABEL="label"=214
+EXIT="exit"=215
+QUIT="quit"=216
+INTRFACE="interface"=217
+ICMP6="icmp6"=218
+IGRP="igrp"=219
+IPSEC="ipsec"=220
+NOS="nos"=221
+PCP="pcp"=222
+PIM="pim"=223
+PPTP="pptp"=224
+RIP="rip"=225
+SNP="snp"=226
+HOST="host"=227
+RANGE="range"=228
+LOG_LEVEL_ALERTS="alerts"=229
+LOG_LEVEL_CRITICAL="critical"=230
+LOG_LEVEL_DEBUGGING="debugging"=231
+LOG_LEVEL_EMERGENCIES="emergencies"=232
+LOG_LEVEL_ERRORS="errors"=233
+LOG_LEVEL_INFORMATIONAL="informational"=234
+LOG_LEVEL_NOTIFICATIONS="notifications"=235
+LOG_LEVEL_WARNINGS="warnings"=236
+LOG_LEVEL_DISABLE="disable"=237
+LOG_LEVEL_INACTIVE="inactive"=238
+Whitespace=239
+HEX_CONST=240
+NEG_INT_CONST=241
+HEX_DIGIT=242
+DIGIT=243
+NUM_3DIGIT=244
+NUM_HEX_4DIGIT=245
+NUMBER_ADDRESS_OR_WORD=246
+PIPE_CHAR=247
+PERCENT=248
+AMPERSAND=249
+APOSTROPHE=250
+PLUS=251
+DOT=252
+SEMICOLON=253
+QUESTION=254
+COMMERCIAL_AT=255
+OPENING_SQUARE=256
+CLOSING_SQUARE=257
+CARET=258
+UNDERLINE=259
+TILDE=260
+DOUBLE_QUOTE=261
diff --git a/src/parsers/pf.g b/src/parsers/pf.g
index 4e4fdb368..bac80da57 100644
--- a/src/parsers/pf.g
+++ b/src/parsers/pf.g
@@ -1193,7 +1193,7 @@ common_hosts_part :
 host { AddressSpec as; } :
         ( EXLAMATION { as.neg = true; } )?
         (
-            WORD
+            ( WORD | MACRO )
             {
                 // interface name or domain/host name
                 as.at = AddressSpec::INTERFACE_OR_HOST_NAME;
@@ -2061,15 +2061,16 @@ options {
     | ( DIGIT )+ { $setType(INT_CONST); }
 
 
-// making sure ',' '(' ')' '=' '<' '>' '+' are not part of WORD do
-// not start WORD with '$' since we expand macros in PFImporterRun
-// using regex.
-// double quote " should be included, without it STRING does not match
+// Making sure ',' '(' ')' '=' '<' '>' '+' are not part of WORD.
+// Double quote " should be included, without it STRING does not match
 
     | ( 'a'..'z' | 'A'..'Z' )
       ( '"' | '$' | '%' | '&' | '-' | '.' | '0'..'9' | ';' |
         '?' | '@' | 'A'..'Z' | '\\' | '^' | '_' | '`' | 'a'..'z' )*
       { $setType(WORD); }
+
+    | '$' ( 'a'..'z' | 'A'..'Z' ) ( 'a'..'z' | 'A'..'Z' | '0'..'9' | '_' )*
+      { $setType(MACRO); }
     ;
 
 STRING : '"' (~'"')* '"';
diff --git a/src/unit_tests/PFImporterTest/test_data/pf-macros.conf b/src/unit_tests/PFImporterTest/test_data/pf-macros.conf
index 026de83da..5e695ff87 100644
--- a/src/unit_tests/PFImporterTest/test_data/pf-macros.conf
+++ b/src/unit_tests/PFImporterTest/test_data/pf-macros.conf
@@ -27,6 +27,8 @@ mixed_macro_2 = "{ $host1 192.168.2.1 em1 }"
 mixed_macro_3 = "{ $host1 192.168.2.1 em1:network }"
 mixed_macro_4 = "{ em1:network www.fwbuilder.org }"
 
+# test for an undefined macro
+# undefined_macro = 192.168.23.45
 
 pass in quick from any to $one_address
 
@@ -46,6 +48,9 @@ pass in quick from any to $addr_list_4
 pass in quick from any to $addr_list_5
 pass in quick from any to $addr_list_1_foo
 
+# test for undefined macro
+pass in quick from any to $undefined_macro
+
 pass out quick on $ext_if proto tcp to $recursive_macro port $tcp_services
 
 pass in quick on $ext_if proto tcp from any to $mixed_macro_1 port 80
diff --git a/src/unit_tests/PFImporterTest/test_data/pf-macros.fwb b/src/unit_tests/PFImporterTest/test_data/pf-macros.fwb
index beb43efda..c640f050d 100644
--- a/src/unit_tests/PFImporterTest/test_data/pf-macros.fwb
+++ b/src/unit_tests/PFImporterTest/test_data/pf-macros.fwb
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
-<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="22" lastModified="1310080604" id="root">
+<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="22" lastModified="1310084677" id="root">
   <Library id="syslib000" color="#d4f8ff" name="Standard" comment="Standard objects" ro="True">
     <AnyNetwork id="sysid0" name="Any" comment="Any Network" ro="False" address="0.0.0.0" netmask="0.0.0.0"/>
     <AnyIPService id="sysid1" protocol_num="0" name="Any" comment="Any IP Service" ro="False"/>
@@ -439,109 +439,110 @@
         <IPv4 id="id7" name="h-192.168.1.1" comment="Created during import of  line 19" ro="False" address="192.168.1.1" netmask="255.255.255.255"/>
         <IPv4 id="id8" name="h-192.168.1.2" comment="Created during import of  line 19" ro="False" address="192.168.1.2" netmask="255.255.255.255"/>
         <IPv4 id="id9" name="h-192.168.2.1" comment="Created during import of  line 23" ro="False" address="192.168.2.1" netmask="255.255.255.255"/>
-        <IPv4 id="id10" name="h-10.11.11.11" comment="Created during import of  line 31" ro="False" address="10.11.11.11" netmask="255.255.255.255"/>
-        <IPv4 id="id11" name="h-10.12.12.12" comment="Created during import of  line 32" ro="False" address="10.12.12.12" netmask="255.255.255.255"/>
-        <IPv4 id="id12" name="h-10.13.13.13" comment="Created during import of  line 33" ro="False" address="10.13.13.13" netmask="255.255.255.255"/>
-        <IPv4 id="id13" name="h-10.14.14.14" comment="Created during import of  line 34" ro="False" address="10.14.14.14" netmask="255.255.255.255"/>
-        <IPv4 id="id14" name="h-10.15.15.15" comment="Created during import of  line 35" ro="False" address="10.15.15.15" netmask="255.255.255.255"/>
-        <IPv4 id="id15" name="h-10.16.16.16" comment="Created during import of  line 36" ro="False" address="10.16.16.16" netmask="255.255.255.255"/>
-        <IPv4 id="id16" name="h-10.17.17.17" comment="Created during import of  line 37" ro="False" address="10.17.17.17" netmask="255.255.255.255"/>
-        <IPv4 id="id17" name="h-10.18.18.18" comment="Created during import of  line 38" ro="False" address="10.18.18.18" netmask="255.255.255.255"/>
+        <IPv4 id="id10" name="h-10.11.11.11" comment="Created during import of  line 33" ro="False" address="10.11.11.11" netmask="255.255.255.255"/>
+        <IPv4 id="id11" name="h-10.12.12.12" comment="Created during import of  line 34" ro="False" address="10.12.12.12" netmask="255.255.255.255"/>
+        <IPv4 id="id12" name="h-10.13.13.13" comment="Created during import of  line 35" ro="False" address="10.13.13.13" netmask="255.255.255.255"/>
+        <IPv4 id="id13" name="h-10.14.14.14" comment="Created during import of  line 36" ro="False" address="10.14.14.14" netmask="255.255.255.255"/>
+        <IPv4 id="id14" name="h-10.15.15.15" comment="Created during import of  line 37" ro="False" address="10.15.15.15" netmask="255.255.255.255"/>
+        <IPv4 id="id15" name="h-10.16.16.16" comment="Created during import of  line 38" ro="False" address="10.16.16.16" netmask="255.255.255.255"/>
+        <IPv4 id="id16" name="h-10.17.17.17" comment="Created during import of  line 39" ro="False" address="10.17.17.17" netmask="255.255.255.255"/>
+        <IPv4 id="id17" name="h-10.18.18.18" comment="Created during import of  line 40" ro="False" address="10.18.18.18" netmask="255.255.255.255"/>
       </ObjectGroup>
       <ObjectGroup id="id18" name="DNS Names" comment="" ro="False">
         <DNSName id="id19" dnsrec="www.fwbuilder.org" dnsrectype="A" run_time="True" name="www.fwbuilder.org" comment="" ro="False"/>
+        <DNSName id="id20" dnsrec="$undefined_macro" dnsrectype="A" run_time="True" name="$undefined_macro" comment="" ro="False"/>
       </ObjectGroup>
-      <ObjectGroup id="id20" name="Address Tables" comment="" ro="False"/>
-      <ObjectGroup id="id21" name="Groups" comment="" ro="False">
-        <ObjectGroup id="id22" name="addr_list_1" comment="Created during import of  line 3" ro="False">
-          <ObjectRef ref="id66"/>
+      <ObjectGroup id="id21" name="Address Tables" comment="" ro="False"/>
+      <ObjectGroup id="id22" name="Groups" comment="" ro="False">
+        <ObjectGroup id="id23" name="addr_list_1" comment="Created during import of  line 3" ro="False">
           <ObjectRef ref="id67"/>
           <ObjectRef ref="id68"/>
           <ObjectRef ref="id69"/>
-        </ObjectGroup>
-        <ObjectGroup id="id27" name="addr_list_2" comment="Created during import of  line 5" ro="False">
-          <ObjectRef ref="id3"/>
-          <ObjectRef ref="id66"/>
-          <ObjectRef ref="id67"/>
-          <ObjectRef ref="id68"/>
-          <ObjectRef ref="id69"/>
-        </ObjectGroup>
-        <ObjectGroup id="id33" name="addr_list_3" comment="Created during import of  line 7" ro="False">
-          <ObjectRef ref="id3"/>
           <ObjectRef ref="id70"/>
+        </ObjectGroup>
+        <ObjectGroup id="id28" name="addr_list_2" comment="Created during import of  line 5" ro="False">
+          <ObjectRef ref="id3"/>
+          <ObjectRef ref="id67"/>
+          <ObjectRef ref="id68"/>
+          <ObjectRef ref="id69"/>
+          <ObjectRef ref="id70"/>
+        </ObjectGroup>
+        <ObjectGroup id="id34" name="addr_list_3" comment="Created during import of  line 7" ro="False">
+          <ObjectRef ref="id3"/>
           <ObjectRef ref="id71"/>
-        </ObjectGroup>
-        <ObjectGroup id="id37" name="addr_list_4" comment="Created during import of  line 9" ro="False">
-          <ObjectRef ref="id3"/>
           <ObjectRef ref="id72"/>
-          <ObjectRef ref="id73"/>
         </ObjectGroup>
-        <ObjectGroup id="id41" name="addr_list_5" comment="Created during import of  line 12" ro="False">
+        <ObjectGroup id="id38" name="addr_list_4" comment="Created during import of  line 9" ro="False">
           <ObjectRef ref="id3"/>
+          <ObjectRef ref="id73"/>
           <ObjectRef ref="id74"/>
-          <ObjectRef ref="id75"/>
         </ObjectGroup>
-        <ObjectGroup id="id45" name="addr_list_1_foo" comment="Created during import of  line 15" ro="False">
+        <ObjectGroup id="id42" name="addr_list_5" comment="Created during import of  line 12" ro="False">
+          <ObjectRef ref="id3"/>
+          <ObjectRef ref="id75"/>
+          <ObjectRef ref="id76"/>
+        </ObjectGroup>
+        <ObjectGroup id="id46" name="addr_list_1_foo" comment="Created during import of  line 15" ro="False">
           <ObjectRef ref="id4"/>
           <ObjectRef ref="id5"/>
           <ObjectRef ref="id6"/>
         </ObjectGroup>
-        <ObjectGroup id="id49" name="recursive_macro" comment="Created during import of  line 19" ro="False">
+        <ObjectGroup id="id50" name="recursive_macro" comment="Created during import of  line 19" ro="False">
           <ObjectRef ref="id7"/>
           <ObjectRef ref="id8"/>
         </ObjectGroup>
-        <ObjectGroup id="id52" name="mixed_macro_1" comment="Created during import of  line 23" ro="False">
+        <ObjectGroup id="id53" name="mixed_macro_1" comment="Created during import of  line 23" ro="False">
           <ObjectRef ref="id7"/>
           <ObjectRef ref="id9"/>
           <ObjectRef ref="id19"/>
         </ObjectGroup>
-        <ObjectGroup id="id56" name="mixed_macro_2" comment="Created during import of  line 24" ro="False">
+        <ObjectGroup id="id57" name="mixed_macro_2" comment="Created during import of  line 24" ro="False">
           <ObjectRef ref="id7"/>
           <ObjectRef ref="id9"/>
-          <ObjectRef ref="id348"/>
+          <ObjectRef ref="id361"/>
         </ObjectGroup>
-        <ObjectGroup id="id60" name="mixed_macro_3" comment="Created during import of  line 25" ro="False">
+        <ObjectGroup id="id61" name="mixed_macro_3" comment="Created during import of  line 25" ro="False">
           <ObjectRef ref="id7"/>
           <ObjectRef ref="id9"/>
-          <ObjectRef ref="id349"/>
+          <ObjectRef ref="id362"/>
         </ObjectGroup>
       </ObjectGroup>
-      <ObjectGroup id="id64" name="Hosts" comment="" ro="False"/>
-      <ObjectGroup id="id65" name="Networks" comment="" ro="False">
-        <Network id="id66" name="net-10.123.12.32/255.255.255.224" comment="Created during import of  line 3" ro="False" address="10.123.12.32" netmask="255.255.255.224"/>
-        <Network id="id67" name="net-10.123.14.8/255.255.255.224" comment="Created during import of  line 3" ro="False" address="10.123.14.8" netmask="255.255.255.224"/>
-        <Network id="id68" name="net-10.123.10.16/255.255.255.240" comment="Created during import of  line 3" ro="False" address="10.123.10.16" netmask="255.255.255.240"/>
-        <Network id="id69" name="net-10.123.0.0/255.255.255.0" comment="Created during import of  line 3" ro="False" address="10.123.0.0" netmask="255.255.255.0"/>
-        <Network id="id70" name="net-10.123.12.33/255.255.255.224" comment="Created during import of  line 7" ro="False" address="10.123.12.33" netmask="255.255.255.224"/>
-        <Network id="id71" name="net-10.123.14.9/255.255.255.224" comment="Created during import of  line 7" ro="False" address="10.123.14.9" netmask="255.255.255.224"/>
-        <Network id="id72" name="net-10.123.12.34/255.255.255.224" comment="Created during import of  line 9" ro="False" address="10.123.12.34" netmask="255.255.255.224"/>
-        <Network id="id73" name="net-10.123.14.10/255.255.255.224" comment="Created during import of  line 9" ro="False" address="10.123.14.10" netmask="255.255.255.224"/>
-        <Network id="id74" name="net-10.123.12.35/255.255.255.224" comment="Created during import of  line 12" ro="False" address="10.123.12.35" netmask="255.255.255.224"/>
-        <Network id="id75" name="net-10.123.14.11/255.255.255.224" comment="Created during import of  line 12" ro="False" address="10.123.14.11" netmask="255.255.255.224"/>
+      <ObjectGroup id="id65" name="Hosts" comment="" ro="False"/>
+      <ObjectGroup id="id66" name="Networks" comment="" ro="False">
+        <Network id="id67" name="net-10.123.12.32/255.255.255.224" comment="Created during import of  line 3" ro="False" address="10.123.12.32" netmask="255.255.255.224"/>
+        <Network id="id68" name="net-10.123.14.8/255.255.255.224" comment="Created during import of  line 3" ro="False" address="10.123.14.8" netmask="255.255.255.224"/>
+        <Network id="id69" name="net-10.123.10.16/255.255.255.240" comment="Created during import of  line 3" ro="False" address="10.123.10.16" netmask="255.255.255.240"/>
+        <Network id="id70" name="net-10.123.0.0/255.255.255.0" comment="Created during import of  line 3" ro="False" address="10.123.0.0" netmask="255.255.255.0"/>
+        <Network id="id71" name="net-10.123.12.33/255.255.255.224" comment="Created during import of  line 7" ro="False" address="10.123.12.33" netmask="255.255.255.224"/>
+        <Network id="id72" name="net-10.123.14.9/255.255.255.224" comment="Created during import of  line 7" ro="False" address="10.123.14.9" netmask="255.255.255.224"/>
+        <Network id="id73" name="net-10.123.12.34/255.255.255.224" comment="Created during import of  line 9" ro="False" address="10.123.12.34" netmask="255.255.255.224"/>
+        <Network id="id74" name="net-10.123.14.10/255.255.255.224" comment="Created during import of  line 9" ro="False" address="10.123.14.10" netmask="255.255.255.224"/>
+        <Network id="id75" name="net-10.123.12.35/255.255.255.224" comment="Created during import of  line 12" ro="False" address="10.123.12.35" netmask="255.255.255.224"/>
+        <Network id="id76" name="net-10.123.14.11/255.255.255.224" comment="Created during import of  line 12" ro="False" address="10.123.14.11" netmask="255.255.255.224"/>
       </ObjectGroup>
-      <ObjectGroup id="id76" name="Address Ranges" comment="" ro="False"/>
+      <ObjectGroup id="id77" name="Address Ranges" comment="" ro="False"/>
     </ObjectGroup>
-    <ServiceGroup id="id77" name="Services" comment="" ro="False">
-      <ServiceGroup id="id78" name="Groups" comment="" ro="False"/>
-      <ServiceGroup id="id79" name="ICMP" comment="" ro="False"/>
-      <ServiceGroup id="id80" name="IP" comment="" ro="False"/>
-      <ServiceGroup id="id81" name="TCP" comment="" ro="False">
-        <TCPService id="id82" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="tcp 0:0 / 22:22" comment="Created during import of  line 47" ro="False" src_range_start="0" src_range_end="0" dst_range_start="22" dst_range_end="22"/>
-        <TCPService id="id83" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="tcp 0:0 / 25:25" comment="Created during import of  line 47" ro="False" src_range_start="0" src_range_end="0" dst_range_start="25" dst_range_end="25"/>
-        <TCPService id="id84" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="tcp 0:0 / 80:80" comment="Created during import of  line 49" ro="False" src_range_start="0" src_range_end="0" dst_range_start="80" dst_range_end="80"/>
+    <ServiceGroup id="id78" name="Services" comment="" ro="False">
+      <ServiceGroup id="id79" name="Groups" comment="" ro="False"/>
+      <ServiceGroup id="id80" name="ICMP" comment="" ro="False"/>
+      <ServiceGroup id="id81" name="IP" comment="" ro="False"/>
+      <ServiceGroup id="id82" name="TCP" comment="" ro="False">
+        <TCPService id="id83" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="tcp 0:0 / 22:22" comment="Created during import of  line 52" ro="False" src_range_start="0" src_range_end="0" dst_range_start="22" dst_range_end="22"/>
+        <TCPService id="id84" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="tcp 0:0 / 25:25" comment="Created during import of  line 52" ro="False" src_range_start="0" src_range_end="0" dst_range_start="25" dst_range_end="25"/>
+        <TCPService id="id85" ack_flag="False" ack_flag_mask="False" established="False" fin_flag="False" fin_flag_mask="False" psh_flag="False" psh_flag_mask="False" rst_flag="False" rst_flag_mask="False" syn_flag="False" syn_flag_mask="False" urg_flag="False" urg_flag_mask="False" name="tcp 0:0 / 80:80" comment="Created during import of  line 54" ro="False" src_range_start="0" src_range_end="0" dst_range_start="80" dst_range_end="80"/>
       </ServiceGroup>
-      <ServiceGroup id="id85" name="UDP" comment="" ro="False"/>
-      <ServiceGroup id="id86" name="Users" comment="" ro="False"/>
-      <ServiceGroup id="id87" name="Custom" comment="" ro="False"/>
-      <ServiceGroup id="id88" name="TagServices" comment="" ro="False"/>
+      <ServiceGroup id="id86" name="UDP" comment="" ro="False"/>
+      <ServiceGroup id="id87" name="Users" comment="" ro="False"/>
+      <ServiceGroup id="id88" name="Custom" comment="" ro="False"/>
+      <ServiceGroup id="id89" name="TagServices" comment="" ro="False"/>
     </ServiceGroup>
-    <ObjectGroup id="id89" name="Firewalls" comment="" ro="False">
-      <Firewall id="id90" host_OS="freebsd" lastCompiled="0" lastInstalled="0" lastModified="0" platform="pf" name="test_fw" comment="Created during import of  line 24" ro="False">
-        <NAT id="id344" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
+    <ObjectGroup id="id90" name="Firewalls" comment="" ro="False">
+      <Firewall id="id91" host_OS="freebsd" lastCompiled="0" lastInstalled="0" lastModified="0" platform="pf" name="test_fw" comment="Created during import of  line 24" ro="False">
+        <NAT id="id357" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
           <RuleSetOptions/>
         </NAT>
-        <Policy id="id92" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
-          <PolicyRule id="id94" disabled="False" group="" log="False" position="0" action="Accept" direction="Inbound" comment="Created during import of  line 29">
+        <Policy id="id93" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id95" disabled="False" group="" log="False" position="0" action="Accept" direction="Inbound" comment="Created during import of  line 31">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -561,7 +562,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id106" disabled="False" group="" log="False" position="1" action="Accept" direction="Inbound" comment="Created during import of  line 31">
+          <PolicyRule id="id107" disabled="False" group="" log="False" position="1" action="Accept" direction="Inbound" comment="Created during import of  line 33">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -582,7 +583,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id119" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="Created during import of  line 32">
+          <PolicyRule id="id120" disabled="False" group="" log="False" position="2" action="Accept" direction="Inbound" comment="Created during import of  line 34">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -603,7 +604,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id132" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Created during import of  line 33">
+          <PolicyRule id="id133" disabled="False" group="" log="False" position="3" action="Accept" direction="Inbound" comment="Created during import of  line 35">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -624,7 +625,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id145" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Created during import of  line 34">
+          <PolicyRule id="id146" disabled="False" group="" log="False" position="4" action="Accept" direction="Inbound" comment="Created during import of  line 36">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -645,7 +646,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id158" disabled="False" group="" log="False" position="5" action="Accept" direction="Inbound" comment="Created during import of  line 35">
+          <PolicyRule id="id159" disabled="False" group="" log="False" position="5" action="Accept" direction="Inbound" comment="Created during import of  line 37">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -666,7 +667,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id171" disabled="False" group="" log="False" position="6" action="Accept" direction="Inbound" comment="Created during import of  line 36">
+          <PolicyRule id="id172" disabled="False" group="" log="False" position="6" action="Accept" direction="Inbound" comment="Created during import of  line 38">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -687,7 +688,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id184" disabled="False" group="" log="False" position="7" action="Accept" direction="Inbound" comment="Created during import of  line 37">
+          <PolicyRule id="id185" disabled="False" group="" log="False" position="7" action="Accept" direction="Inbound" comment="Created during import of  line 39">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -708,7 +709,7 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id197" disabled="False" group="" log="False" position="8" action="Accept" direction="Inbound" comment="Created during import of  line 38">
+          <PolicyRule id="id198" disabled="False" group="" log="False" position="8" action="Accept" direction="Inbound" comment="Created during import of  line 40">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
@@ -729,12 +730,12 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id210" disabled="False" group="" log="False" position="9" action="Accept" direction="Inbound" comment="Created during import of  line 40">
+          <PolicyRule id="id211" disabled="False" group="" log="False" position="9" action="Accept" direction="Inbound" comment="Created during import of  line 42">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
             <Dst neg="False">
-              <ObjectRef ref="id22"/>
+              <ObjectRef ref="id23"/>
             </Dst>
             <Srv neg="False">
               <ServiceRef ref="sysid1"/>
@@ -749,12 +750,12 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id222" disabled="False" group="" log="False" position="10" action="Accept" direction="Inbound" comment="Created during import of  line 41">
+          <PolicyRule id="id223" disabled="False" group="" log="False" position="10" action="Accept" direction="Inbound" comment="Created during import of  line 43">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
             <Dst neg="False">
-              <ObjectRef ref="id27"/>
+              <ObjectRef ref="id28"/>
             </Dst>
             <Srv neg="False">
               <ServiceRef ref="sysid1"/>
@@ -769,12 +770,12 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id234" disabled="False" group="" log="False" position="11" action="Accept" direction="Inbound" comment="Created during import of  line 42">
+          <PolicyRule id="id235" disabled="False" group="" log="False" position="11" action="Accept" direction="Inbound" comment="Created during import of  line 44">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
             <Dst neg="False">
-              <ObjectRef ref="id33"/>
+              <ObjectRef ref="id34"/>
             </Dst>
             <Srv neg="False">
               <ServiceRef ref="sysid1"/>
@@ -789,12 +790,12 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id246" disabled="False" group="" log="False" position="12" action="Accept" direction="Inbound" comment="Created during import of  line 43">
+          <PolicyRule id="id247" disabled="False" group="" log="False" position="12" action="Accept" direction="Inbound" comment="Created during import of  line 45">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
             <Dst neg="False">
-              <ObjectRef ref="id37"/>
+              <ObjectRef ref="id38"/>
             </Dst>
             <Srv neg="False">
               <ServiceRef ref="sysid1"/>
@@ -809,12 +810,12 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id258" disabled="False" group="" log="False" position="13" action="Accept" direction="Inbound" comment="Created during import of  line 44">
+          <PolicyRule id="id259" disabled="False" group="" log="False" position="13" action="Accept" direction="Inbound" comment="Created during import of  line 46">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
             <Dst neg="False">
-              <ObjectRef ref="id41"/>
+              <ObjectRef ref="id42"/>
             </Dst>
             <Srv neg="False">
               <ServiceRef ref="sysid1"/>
@@ -829,12 +830,12 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id270" disabled="False" group="" log="False" position="14" action="Accept" direction="Inbound" comment="Created during import of  line 45">
+          <PolicyRule id="id271" disabled="False" group="" log="False" position="14" action="Accept" direction="Inbound" comment="Created during import of  line 47">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
             <Dst neg="False">
-              <ObjectRef ref="id45"/>
+              <ObjectRef ref="id46"/>
             </Dst>
             <Srv neg="False">
               <ServiceRef ref="sysid1"/>
@@ -849,39 +850,40 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id282" disabled="False" group="" log="False" position="15" action="Accept" direction="Outbound" comment="Created during import of  line 47">
+          <PolicyRule id="id283" disabled="False" group="" log="False" position="15" action="Accept" direction="Inbound" comment="Created during import of  line 50&#10;Macro '$undefined_macro' was undefined, rule may be broken">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
             <Dst neg="False">
-              <ObjectRef ref="id49"/>
+              <ObjectRef ref="id20"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="color">#C86E6E</Option>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id295" disabled="False" group="" log="False" position="16" action="Accept" direction="Outbound" comment="Created during import of  line 52">
+            <Src neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="id50"/>
             </Dst>
             <Srv neg="False">
-              <ServiceRef ref="id82"/>
               <ServiceRef ref="id83"/>
-            </Srv>
-            <Itf neg="False">
-              <ObjectRef ref="id348"/>
-            </Itf>
-            <When neg="False">
-              <IntervalRef ref="sysid2"/>
-            </When>
-            <PolicyRuleOptions>
-              <Option name="stateless">True</Option>
-            </PolicyRuleOptions>
-          </PolicyRule>
-          <PolicyRule id="id295" disabled="False" group="" log="False" position="16" action="Accept" direction="Inbound" comment="Created during import of  line 49">
-            <Src neg="False">
-              <ObjectRef ref="sysid0"/>
-            </Src>
-            <Dst neg="False">
-              <ObjectRef ref="id52"/>
-            </Dst>
-            <Srv neg="False">
               <ServiceRef ref="id84"/>
             </Srv>
             <Itf neg="False">
-              <ObjectRef ref="id348"/>
+              <ObjectRef ref="id361"/>
             </Itf>
             <When neg="False">
               <IntervalRef ref="sysid2"/>
@@ -890,18 +892,18 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id307" disabled="False" group="" log="False" position="17" action="Accept" direction="Inbound" comment="Created during import of  line 50">
+          <PolicyRule id="id308" disabled="False" group="" log="False" position="17" action="Accept" direction="Inbound" comment="Created during import of  line 54">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
             <Dst neg="False">
-              <ObjectRef ref="id56"/>
+              <ObjectRef ref="id53"/>
             </Dst>
             <Srv neg="False">
-              <ServiceRef ref="id84"/>
+              <ServiceRef ref="id85"/>
             </Srv>
             <Itf neg="False">
-              <ObjectRef ref="id348"/>
+              <ObjectRef ref="id361"/>
             </Itf>
             <When neg="False">
               <IntervalRef ref="sysid2"/>
@@ -910,18 +912,18 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id319" disabled="False" group="" log="False" position="18" action="Accept" direction="Inbound" comment="Created during import of  line 51">
+          <PolicyRule id="id320" disabled="False" group="" log="False" position="18" action="Accept" direction="Inbound" comment="Created during import of  line 55">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
             <Dst neg="False">
-              <ObjectRef ref="id60"/>
+              <ObjectRef ref="id57"/>
             </Dst>
             <Srv neg="False">
-              <ServiceRef ref="id84"/>
+              <ServiceRef ref="id85"/>
             </Srv>
             <Itf neg="False">
-              <ObjectRef ref="id348"/>
+              <ObjectRef ref="id361"/>
             </Itf>
             <When neg="False">
               <IntervalRef ref="sysid2"/>
@@ -930,19 +932,39 @@
               <Option name="stateless">True</Option>
             </PolicyRuleOptions>
           </PolicyRule>
-          <PolicyRule id="id331" disabled="False" group="" log="False" position="19" action="Accept" direction="Inbound" comment="Created during import of  line 52">
+          <PolicyRule id="id332" disabled="False" group="" log="False" position="19" action="Accept" direction="Inbound" comment="Created during import of  line 56">
             <Src neg="False">
               <ObjectRef ref="sysid0"/>
             </Src>
             <Dst neg="False">
-              <ObjectRef ref="id349"/>
+              <ObjectRef ref="id61"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="id85"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="id361"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
+          <PolicyRule id="id344" disabled="False" group="" log="False" position="20" action="Accept" direction="Inbound" comment="Created during import of  line 57">
+            <Src neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="id362"/>
               <ObjectRef ref="id19"/>
             </Dst>
             <Srv neg="False">
-              <ServiceRef ref="id84"/>
+              <ServiceRef ref="id85"/>
             </Srv>
             <Itf neg="False">
-              <ObjectRef ref="id348"/>
+              <ObjectRef ref="id361"/>
             </Itf>
             <When neg="False">
               <IntervalRef ref="sysid2"/>
@@ -953,12 +975,12 @@
           </PolicyRule>
           <RuleSetOptions/>
         </Policy>
-        <Routing id="id346" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
+        <Routing id="id359" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
           <RuleSetOptions/>
         </Routing>
-        <Interface id="id348" dedicated_failover="False" dyn="True" security_level="0" unnum="False" unprotected="False" name="em1" comment="Created during import of  line 24" ro="False">
+        <Interface id="id361" dedicated_failover="False" dyn="True" security_level="0" unnum="False" unprotected="False" name="em1" comment="Created during import of  line 24" ro="False">
           <InterfaceOptions/>
-          <AttachedNetworks id="id349" name="em1-net" comment="" ro="False"/>
+          <AttachedNetworks id="id362" name="em1-net" comment="" ro="False"/>
         </Interface>
         <FirewallOptions>
           <Option name="check_shading">true</Option>
@@ -978,7 +1000,7 @@
         </FirewallOptions>
       </Firewall>
     </ObjectGroup>
-    <ObjectGroup id="id351" name="Clusters" comment="" ro="False"/>
-    <IntervalGroup id="id352" name="Time" comment="" ro="False"/>
+    <ObjectGroup id="id364" name="Clusters" comment="" ro="False"/>
+    <IntervalGroup id="id365" name="Time" comment="" ro="False"/>
   </Library>
 </FWObjectDatabase>
diff --git a/src/unit_tests/PFImporterTest/test_data/pf-macros.output b/src/unit_tests/PFImporterTest/test_data/pf-macros.output
index 033af45ef..750373ebb 100644
--- a/src/unit_tests/PFImporterTest/test_data/pf-macros.output
+++ b/src/unit_tests/PFImporterTest/test_data/pf-macros.output
@@ -1,4 +1,4 @@
-3: Address Table: <addr_list_1>:  10.123.12.32/27, 10.123.14.8/27, 10.123.10.16/28, 10.123.0.0/24
+Warning: Macro undefined_macro is undefined3: Address Table: <addr_list_1>:  10.123.12.32/27, 10.123.14.8/27, 10.123.10.16/28, 10.123.0.0/24
 5: Address Table: <addr_list_2>:  10.1.1.1, 10.123.12.32/27, 10.123.14.8/27, 10.123.10.16/28, 10.123.0.0/24
 7: Address Table: <addr_list_3>:  10.1.1.1, 10.123.12.33/27, 10.123.14.9/27
 9: Address Table: <addr_list_4>:  10.1.1.1, 10.123.12.34/27, 10.123.14.10/27
@@ -9,23 +9,25 @@
 24: Address Table: <mixed_macro_2>:  192.168.1.1, 192.168.2.1, em1
 24: New interface: em1
 25: Address Table: <mixed_macro_3>:  192.168.1.1, 192.168.2.1, em1
-29: filtering rule: action pass; interfaces: 
 31: filtering rule: action pass; interfaces: 
-32: filtering rule: action pass; interfaces: 
 33: filtering rule: action pass; interfaces: 
 34: filtering rule: action pass; interfaces: 
 35: filtering rule: action pass; interfaces: 
 36: filtering rule: action pass; interfaces: 
 37: filtering rule: action pass; interfaces: 
 38: filtering rule: action pass; interfaces: 
+39: filtering rule: action pass; interfaces: 
 40: filtering rule: action pass; interfaces: 
-41: filtering rule: action pass; interfaces: 
 42: filtering rule: action pass; interfaces: 
 43: filtering rule: action pass; interfaces: 
 44: filtering rule: action pass; interfaces: 
 45: filtering rule: action pass; interfaces: 
-47: filtering rule: action pass; interfaces: em1
-49: filtering rule: action pass; interfaces: em1
-50: filtering rule: action pass; interfaces: em1
-51: filtering rule: action pass; interfaces: em1
+46: filtering rule: action pass; interfaces: 
+47: filtering rule: action pass; interfaces: 
+50: filtering rule: action pass; interfaces: 
+50: Warning: Macro '$undefined_macro' was undefined, rule may be broken
 52: filtering rule: action pass; interfaces: em1
+54: filtering rule: action pass; interfaces: em1
+55: filtering rule: action pass; interfaces: em1
+56: filtering rule: action pass; interfaces: em1
+57: filtering rule: action pass; interfaces: em1

From 0d69945d2feda863b6c0c20478f7e3f94046ea6f Mon Sep 17 00:00:00 2001
From: Vadim Kurland <vadim@netcitadel.com>
Date: Thu, 7 Jul 2011 18:04:24 -0700
Subject: [PATCH 14/18] see #2546 "PF import - negation inside of inline tables
 is ignored". Since we can not import address lists or tables that contain a
 mix of negated and non-negated items, importer should display an error when
 it enounters one of these and mark all rules that use it as "broken" (rule is
 colored red and error message is added to the comment).

---
 doc/ChangeLog                                 |   7 +
 src/import/Importer.cpp                       |  15 ++
 src/import/Importer.h                         |  11 ++
 src/import/PFImporter.cpp                     |  32 +++--
 .../PFImporterTest/test_data/pf-tables.conf   |   6 +
 .../PFImporterTest/test_data/pf-tables.fwb    | 132 +++++++++++-------
 .../PFImporterTest/test_data/pf-tables.output |   7 +-
 7 files changed, 148 insertions(+), 62 deletions(-)

diff --git a/doc/ChangeLog b/doc/ChangeLog
index b5fd9e7a5..22a0711b2 100644
--- a/doc/ChangeLog
+++ b/doc/ChangeLog
@@ -1,5 +1,12 @@
 2011-07-07  Vadim Kurland  <vadim@netcitadel.com>
 
+	* PFImporter.cpp (makeAddressObj): see #2546 "PF import - negation
+	inside of inline tables is ignored". Since we can not import
+	address lists or tables that contain a mix of negated and
+	non-negated items, importer should display an error when it
+	enounters one of these and mark all rules that use it as "broken"
+	(rule is colored red and error message is added to the comment).
+
 	* PFImporter.cpp (makeAddressObj): see #2556 "PF import: impor of
 	rules referring to undefined macros". If pf.conf file uses an
 	undefined macro (there is $macro somewhere but the macro has never
diff --git a/src/import/Importer.cpp b/src/import/Importer.cpp
index 263ce2bb4..d55990ca0 100644
--- a/src/import/Importer.cpp
+++ b/src/import/Importer.cpp
@@ -1016,3 +1016,18 @@ void Importer::rearrangeVlanInterfaces()
 
 }
 
+void Importer::registerBrokenObject(FWObject *obj, const QString &err)
+{
+    broken_objects[obj] = err;
+}
+
+bool Importer::isObjectBroken(FWObject *obj)
+{
+    return broken_objects.count(obj) != 0;
+}
+
+QString Importer::getBrokenObjectError(FWObject *obj)
+{
+    return broken_objects[obj];
+}
+
diff --git a/src/import/Importer.h b/src/import/Importer.h
index db3f772fd..9700fb7db 100644
--- a/src/import/Importer.h
+++ b/src/import/Importer.h
@@ -142,6 +142,13 @@ protected:
     // use this to quickly find objects to avoid creating duplicates
     std::map<const std::string,libfwbuilder::FWObject*>   all_objects;
 
+    // registry of broken objects. Sometimes we create an AddressTable
+    // or a group object during import that may have some kind of a problem
+    // that we leave for the user to fix manually. In order to be able to mark
+    // all rules that use this object as "broken", we should register these
+    // broken objects somewhere.
+    std::map<libfwbuilder::FWObject*, QString> broken_objects;
+    
     UnidirectionalRuleSet* current_ruleset;
     
     libfwbuilder::Rule* current_rule;
@@ -203,6 +210,10 @@ protected:
     virtual void addOSrv();
 
     virtual void addLogging();
+
+    void registerBrokenObject(libfwbuilder::FWObject *o, const QString &err);
+    bool isObjectBroken(libfwbuilder::FWObject*);
+    QString getBrokenObjectError(libfwbuilder::FWObject*);
     
 public:
 
diff --git a/src/import/PFImporter.cpp b/src/import/PFImporter.cpp
index 6eb8b0ba4..4cf12d90c 100644
--- a/src/import/PFImporter.cpp
+++ b/src/import/PFImporter.cpp
@@ -587,7 +587,12 @@ FWObject* PFImporter::makeAddressObj(AddressSpec &as)
 
     if (as.at == AddressSpec::TABLE)
     {
-        return address_table_registry[as.address.c_str()];
+        FWObject *at = address_table_registry[as.address.c_str()];
+        if (isObjectBroken(at))
+        {
+            error_tracker->registerError(getBrokenObjectError(at));
+        }
+        return at;
     }
 
     return NULL;
@@ -1375,21 +1380,28 @@ void PFImporter::newAddressTableObject(const string &name,
                     .arg(QString::fromUtf8(name.c_str()))
                     .arg(addr_list.join(", ")));
 
-    if (has_negations)
-    {
-        // can not use error_tracker->registerError() here because
-        // tables are created before importer encounters any rules and
-        // so this error can not be associated with a rule.
-        addMessageToLog(
-            QObject::tr("Error: import of table definition with negated addresses is not supported."));
-    }
-
     ObjectMaker maker(Library::cast(library), error_tracker);
     FWObject *og =
         commitObject(maker.createObject(ObjectGroup::TYPENAME, name.c_str()));
     assert(og!=NULL);
     address_table_registry[name.c_str()] = og;
 
+    if (has_negations)
+    {
+        // can not use error_tracker->registerError() here because
+        // tables are created before importer encounters any rules and
+        // so this error can not be associated with a rule.
+        QString err =
+            QObject::tr("Error: import of table definition with negated "
+                        "addresses is not supported.");
+        addMessageToLog(err);
+
+        err =
+            QObject::tr("Address table '%1' has a mix of negated and non-negated "
+                        "addresses in the original file.");
+        registerBrokenObject(og, err.arg(QString::fromUtf8(name.c_str())));
+    }
+
     for (it=addresses.begin(); it!=addresses.end(); ++it)
     {
         FWObject *obj = makeAddressObj(*it);
diff --git a/src/unit_tests/PFImporterTest/test_data/pf-tables.conf b/src/unit_tests/PFImporterTest/test_data/pf-tables.conf
index 85b430f7d..baf82a3da 100644
--- a/src/unit_tests/PFImporterTest/test_data/pf-tables.conf
+++ b/src/unit_tests/PFImporterTest/test_data/pf-tables.conf
@@ -10,3 +10,9 @@ table <dst_addresses_1> { 192.168.1.1, 192.168.1.2, 192.168.2.0/24 }
 table <dst_addresses_2> { pcn0, pcn0:network }
 table <dst_addresses_3> { pcn0:peer, pcn0:0 }
 table <dst_addresses_4> { www.fwbuilder.org, www.netcitadel.com }
+
+# unsupported: this table has a mix of negated and non-negated addresses
+table <dst_addresses_5> { 192.168.10.1, !192.168.10.2, 192.168.20.0/24 }
+
+# the rule should be marked as "broken"
+pass in quick on em1 from <dst_addresses_5> to any
diff --git a/src/unit_tests/PFImporterTest/test_data/pf-tables.fwb b/src/unit_tests/PFImporterTest/test_data/pf-tables.fwb
index 34418c699..1d1ffc76a 100644
--- a/src/unit_tests/PFImporterTest/test_data/pf-tables.fwb
+++ b/src/unit_tests/PFImporterTest/test_data/pf-tables.fwb
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <!DOCTYPE FWObjectDatabase SYSTEM "fwbuilder.dtd">
-<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="22" lastModified="1307340472" id="root">
+<FWObjectDatabase xmlns="http://www.fwbuilder.org/1.0/" version="22" lastModified="1310086930" id="root">
   <Library id="syslib000" color="#d4f8ff" name="Standard" comment="Standard objects" ro="True">
     <AnyNetwork id="sysid0" name="Any" comment="Any Network" ro="False" address="0.0.0.0" netmask="0.0.0.0"/>
     <AnyIPService id="sysid1" protocol_num="0" name="Any" comment="Any IP Service" ro="False"/>
@@ -434,75 +434,107 @@
       <ObjectGroup id="id2" name="Addresses" comment="" ro="False">
         <IPv4 id="id3" name="h-192.168.1.1" comment="Created during import of  line 9" ro="False" address="192.168.1.1" netmask="255.255.255.255"/>
         <IPv4 id="id4" name="h-192.168.1.2" comment="Created during import of  line 9" ro="False" address="192.168.1.2" netmask="255.255.255.255"/>
+        <IPv4 id="id5" name="h-192.168.10.1" comment="Created during import of  line 15" ro="False" address="192.168.10.1" netmask="255.255.255.255"/>
+        <IPv4 id="id6" name="h-192.168.10.2" comment="Created during import of  line 15" ro="False" address="192.168.10.2" netmask="255.255.255.255"/>
       </ObjectGroup>
-      <ObjectGroup id="id5" name="DNS Names" comment="" ro="False">
-        <DNSName id="id6" dnsrec="www.fwbuilder.org" dnsrectype="A" run_time="True" name="www.fwbuilder.org" comment="" ro="False"/>
-        <DNSName id="id7" dnsrec="www.netcitadel.com" dnsrectype="A" run_time="True" name="www.netcitadel.com" comment="" ro="False"/>
+      <ObjectGroup id="id7" name="DNS Names" comment="" ro="False">
+        <DNSName id="id8" dnsrec="www.fwbuilder.org" dnsrectype="A" run_time="True" name="www.fwbuilder.org" comment="" ro="False"/>
+        <DNSName id="id9" dnsrec="www.netcitadel.com" dnsrectype="A" run_time="True" name="www.netcitadel.com" comment="" ro="False"/>
       </ObjectGroup>
-      <ObjectGroup id="id8" name="Address Tables" comment="" ro="False">
-        <AddressTable id="id9" filename="" run_time="True" name="mike" comment="" ro="False"/>
-        <AddressTable id="id10" filename="" run_time="True" name="BLOCKTEMP" comment="" ro="False"/>
-        <AddressTable id="id11" filename="./pf_block_permanent" run_time="True" name="BLOCKPERM" comment="" ro="False"/>
-        <AddressTable id="id12" filename="./pf_table" run_time="True" name="BLOCK" comment="" ro="False"/>
-        <AddressTable id="id13" filename="" run_time="True" name="spamd-white" comment="" ro="False"/>
+      <ObjectGroup id="id10" name="Address Tables" comment="" ro="False">
+        <AddressTable id="id11" filename="" run_time="True" name="mike" comment="" ro="False"/>
+        <AddressTable id="id12" filename="" run_time="True" name="BLOCKTEMP" comment="" ro="False"/>
+        <AddressTable id="id13" filename="./pf_block_permanent" run_time="True" name="BLOCKPERM" comment="" ro="False"/>
+        <AddressTable id="id14" filename="./pf_table" run_time="True" name="BLOCK" comment="" ro="False"/>
+        <AddressTable id="id15" filename="" run_time="True" name="spamd-white" comment="" ro="False"/>
       </ObjectGroup>
-      <ObjectGroup id="id14" name="Groups" comment="" ro="False">
-        <ObjectGroup id="id15" name="private" comment="Created during import of  line 7" ro="False">
-          <ObjectRef ref="id34"/>
-          <ObjectRef ref="id35"/>
-          <ObjectRef ref="id36"/>
+      <ObjectGroup id="id16" name="Groups" comment="" ro="False">
+        <ObjectGroup id="id17" name="private" comment="Created during import of  line 7" ro="False">
+          <ObjectRef ref="id40"/>
+          <ObjectRef ref="id41"/>
+          <ObjectRef ref="id42"/>
         </ObjectGroup>
-        <ObjectGroup id="id19" name="dst_addresses_1" comment="Created during import of  line 9" ro="False">
+        <ObjectGroup id="id21" name="dst_addresses_1" comment="Created during import of  line 9" ro="False">
           <ObjectRef ref="id3"/>
           <ObjectRef ref="id4"/>
-          <ObjectRef ref="id37"/>
+          <ObjectRef ref="id43"/>
         </ObjectGroup>
-        <ObjectGroup id="id23" name="dst_addresses_2" comment="Created during import of  line 10" ro="False">
-          <ObjectRef ref="id57"/>
-          <ObjectRef ref="id58"/>
+        <ObjectGroup id="id25" name="dst_addresses_2" comment="Created during import of  line 10" ro="False">
+          <ObjectRef ref="id76"/>
+          <ObjectRef ref="id77"/>
         </ObjectGroup>
-        <ObjectGroup id="id26" name="dst_addresses_3" comment="Created during import of  line 11" ro="False">
-          <ObjectRef ref="id57"/>
-          <ObjectRef ref="id57"/>
+        <ObjectGroup id="id28" name="dst_addresses_3" comment="Created during import of  line 11" ro="False">
+          <ObjectRef ref="id76"/>
+          <ObjectRef ref="id76"/>
         </ObjectGroup>
-        <ObjectGroup id="id29" name="dst_addresses_4" comment="Created during import of  line 12" ro="False">
+        <ObjectGroup id="id31" name="dst_addresses_4" comment="Created during import of  line 12" ro="False">
+          <ObjectRef ref="id8"/>
+          <ObjectRef ref="id9"/>
+        </ObjectGroup>
+        <ObjectGroup id="id34" name="dst_addresses_5" comment="Created during import of  line 15" ro="False">
+          <ObjectRef ref="id5"/>
           <ObjectRef ref="id6"/>
-          <ObjectRef ref="id7"/>
+          <ObjectRef ref="id44"/>
         </ObjectGroup>
       </ObjectGroup>
-      <ObjectGroup id="id32" name="Hosts" comment="" ro="False"/>
-      <ObjectGroup id="id33" name="Networks" comment="" ro="False">
-        <Network id="id34" name="net-10/255.0.0.0" comment="Created during import of  line 7" ro="False" address="255.192.0.0" netmask="255.0.0.0"/>
-        <Network id="id35" name="net-172.16/255.240.0.0" comment="Created during import of  line 7" ro="False" address="172.16.0.0" netmask="255.240.0.0"/>
-        <Network id="id36" name="net-192.168/255.255.0.0" comment="Created during import of  line 7" ro="False" address="192.168.0.0" netmask="255.255.0.0"/>
-        <Network id="id37" name="net-192.168.2.0/255.255.255.0" comment="Created during import of  line 9" ro="False" address="192.168.2.0" netmask="255.255.255.0"/>
+      <ObjectGroup id="id38" name="Hosts" comment="" ro="False"/>
+      <ObjectGroup id="id39" name="Networks" comment="" ro="False">
+        <Network id="id40" name="net-10/255.0.0.0" comment="Created during import of  line 7" ro="False" address="255.192.0.0" netmask="255.0.0.0"/>
+        <Network id="id41" name="net-172.16/255.240.0.0" comment="Created during import of  line 7" ro="False" address="172.16.0.0" netmask="255.240.0.0"/>
+        <Network id="id42" name="net-192.168/255.255.0.0" comment="Created during import of  line 7" ro="False" address="192.168.0.0" netmask="255.255.0.0"/>
+        <Network id="id43" name="net-192.168.2.0/255.255.255.0" comment="Created during import of  line 9" ro="False" address="192.168.2.0" netmask="255.255.255.0"/>
+        <Network id="id44" name="net-192.168.20.0/255.255.255.0" comment="Created during import of  line 15" ro="False" address="192.168.20.0" netmask="255.255.255.0"/>
       </ObjectGroup>
-      <ObjectGroup id="id38" name="Address Ranges" comment="" ro="False"/>
+      <ObjectGroup id="id45" name="Address Ranges" comment="" ro="False"/>
     </ObjectGroup>
-    <ServiceGroup id="id39" name="Services" comment="" ro="False">
-      <ServiceGroup id="id40" name="Groups" comment="" ro="False"/>
-      <ServiceGroup id="id41" name="ICMP" comment="" ro="False"/>
-      <ServiceGroup id="id42" name="IP" comment="" ro="False"/>
-      <ServiceGroup id="id43" name="TCP" comment="" ro="False"/>
-      <ServiceGroup id="id44" name="UDP" comment="" ro="False"/>
-      <ServiceGroup id="id45" name="Users" comment="" ro="False"/>
-      <ServiceGroup id="id46" name="Custom" comment="" ro="False"/>
-      <ServiceGroup id="id47" name="TagServices" comment="" ro="False"/>
+    <ServiceGroup id="id46" name="Services" comment="" ro="False">
+      <ServiceGroup id="id47" name="Groups" comment="" ro="False"/>
+      <ServiceGroup id="id48" name="ICMP" comment="" ro="False"/>
+      <ServiceGroup id="id49" name="IP" comment="" ro="False"/>
+      <ServiceGroup id="id50" name="TCP" comment="" ro="False"/>
+      <ServiceGroup id="id51" name="UDP" comment="" ro="False"/>
+      <ServiceGroup id="id52" name="Users" comment="" ro="False"/>
+      <ServiceGroup id="id53" name="Custom" comment="" ro="False"/>
+      <ServiceGroup id="id54" name="TagServices" comment="" ro="False"/>
     </ServiceGroup>
-    <ObjectGroup id="id48" name="Firewalls" comment="" ro="False">
-      <Firewall id="id49" host_OS="freebsd" lastCompiled="0" lastInstalled="0" lastModified="0" platform="pf" name="test_fw" comment="Created during import of  line 10" ro="False">
-        <NAT id="id53" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
+    <ObjectGroup id="id55" name="Firewalls" comment="" ro="False">
+      <Firewall id="id56" host_OS="freebsd" lastCompiled="0" lastInstalled="0" lastModified="0" platform="pf" name="test_fw" comment="Created during import of  line 10" ro="False">
+        <NAT id="id72" name="NAT" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
           <RuleSetOptions/>
         </NAT>
-        <Policy id="id51" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
+        <Policy id="id58" name="Policy" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
+          <PolicyRule id="id60" disabled="False" group="" log="False" position="0" action="Accept" direction="Inbound" comment="Created during import of  line 18&#10;Address table 'dst_addresses_5' has a mix of negated and non-negated addresses in the original file.">
+            <Src neg="False">
+              <ObjectRef ref="id34"/>
+            </Src>
+            <Dst neg="False">
+              <ObjectRef ref="sysid0"/>
+            </Dst>
+            <Srv neg="False">
+              <ServiceRef ref="sysid1"/>
+            </Srv>
+            <Itf neg="False">
+              <ObjectRef ref="id79"/>
+            </Itf>
+            <When neg="False">
+              <IntervalRef ref="sysid2"/>
+            </When>
+            <PolicyRuleOptions>
+              <Option name="color">#C86E6E</Option>
+              <Option name="stateless">True</Option>
+            </PolicyRuleOptions>
+          </PolicyRule>
           <RuleSetOptions/>
         </Policy>
-        <Routing id="id55" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
+        <Routing id="id74" name="Routing" comment="" ro="False" ipv4_rule_set="False" ipv6_rule_set="False" top_rule_set="True">
           <RuleSetOptions/>
         </Routing>
-        <Interface id="id57" dedicated_failover="False" dyn="True" security_level="0" unnum="False" unprotected="False" name="pcn0" comment="Created during import of  line 10" ro="False">
+        <Interface id="id76" dedicated_failover="False" dyn="True" security_level="0" unnum="False" unprotected="False" name="pcn0" comment="Created during import of  line 10" ro="False">
+          <InterfaceOptions/>
+          <AttachedNetworks id="id77" name="pcn0-net" comment="" ro="False"/>
+        </Interface>
+        <Interface id="id79" dedicated_failover="False" dyn="True" security_level="0" unnum="False" unprotected="False" name="em1" comment="Created during import of  line 18" ro="False">
           <InterfaceOptions/>
-          <AttachedNetworks id="id58" name="pcn0-net" comment="" ro="False"/>
         </Interface>
         <FirewallOptions>
           <Option name="check_shading">true</Option>
@@ -522,7 +554,7 @@
         </FirewallOptions>
       </Firewall>
     </ObjectGroup>
-    <ObjectGroup id="id60" name="Clusters" comment="" ro="False"/>
-    <IntervalGroup id="id61" name="Time" comment="" ro="False"/>
+    <ObjectGroup id="id81" name="Clusters" comment="" ro="False"/>
+    <IntervalGroup id="id82" name="Time" comment="" ro="False"/>
   </Library>
 </FWObjectDatabase>
diff --git a/src/unit_tests/PFImporterTest/test_data/pf-tables.output b/src/unit_tests/PFImporterTest/test_data/pf-tables.output
index d935e7866..5a1242668 100644
--- a/src/unit_tests/PFImporterTest/test_data/pf-tables.output
+++ b/src/unit_tests/PFImporterTest/test_data/pf-tables.output
@@ -12,5 +12,8 @@
 10: New interface: pcn0
 11: Address Table: <dst_addresses_3>:  pcn0, pcn0
 12: Address Table: <dst_addresses_4>:  www.fwbuilder.org, www.netcitadel.com
-Could not find enough information in the data file to create any firewall rules.
-
+15: Address Table: <dst_addresses_5>:  192.168.10.1, !192.168.10.2, 192.168.20.0/24
+15: Error: import of table definition with negated addresses is not supported.
+18: New interface: em1
+18: filtering rule: action pass; interfaces: em1
+18: Error: Address table 'dst_addresses_5' has a mix of negated and non-negated addresses in the original file.

From b3215ddafb5b4c3a9c5d961076a629502000bce9 Mon Sep 17 00:00:00 2001
From: Vadim Kurland <vadim@netcitadel.com>
Date: Thu, 7 Jul 2011 18:10:49 -0700
Subject: [PATCH 15/18] see #2558 made the input field 300 pixels wide to be
 able to accommodate more than one ip address (which we do support btw)

---
 src/libgui/ruleoptionsdialog_q.ui | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/src/libgui/ruleoptionsdialog_q.ui b/src/libgui/ruleoptionsdialog_q.ui
index 1b7d4fffd..f59339617 100644
--- a/src/libgui/ruleoptionsdialog_q.ui
+++ b/src/libgui/ruleoptionsdialog_q.ui
@@ -1719,7 +1719,7 @@ p, li { white-space: pre-wrap; }
           <enum>QTabWidget::Triangular</enum>
          </property>
          <property name="currentIndex">
-          <number>6</number>
+          <number>0</number>
          </property>
          <widget class="QWidget" name="tab12">
           <attribute name="title">
@@ -2429,7 +2429,14 @@ p, li { white-space: pre-wrap; }
               </widget>
              </item>
              <item>
-              <widget class="QLineEdit" name="pf_route_opt_addr"/>
+              <widget class="QLineEdit" name="pf_route_opt_addr">
+               <property name="minimumSize">
+                <size>
+                 <width>300</width>
+                 <height>0</height>
+                </size>
+               </property>
+              </widget>
              </item>
             </layout>
            </item>
@@ -2564,7 +2571,7 @@ p, li { white-space: pre-wrap; }
           <enum>QTabWidget::Triangular</enum>
          </property>
          <property name="currentIndex">
-          <number>1</number>
+          <number>0</number>
          </property>
          <widget class="QWidget" name="tab_7">
           <attribute name="title">

From 3cd58db242683bd42d577a7510882170b0dc84ce Mon Sep 17 00:00:00 2001
From: Vadim Kurland <vadim@netcitadel.com>
Date: Thu, 7 Jul 2011 18:25:18 -0700
Subject: [PATCH 16/18] fixes #2538 always use normal 64x64 icon for the editor
 dialog even if object is locked

---
 src/libgui/utils.cpp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/libgui/utils.cpp b/src/libgui/utils.cpp
index f0e3f43f9..3b6e0150d 100644
--- a/src/libgui/utils.cpp
+++ b/src/libgui/utils.cpp
@@ -503,7 +503,8 @@ void doSetObjectIcon(FWObject *obj, QPixmap *pm, int icon_size)
     default: icn_sfx = "icon"; break;
     }
 
-    if (obj->getRO())
+    // note that we do not have "locked" version of large icons
+    if (obj->getRO() && icon_size != 2)
         icn_alias = ":/Icons/lock";
     else
     {

From 98593d384397578b7ad1d0f6cbbda1e2f560ffc2 Mon Sep 17 00:00:00 2001
From: Vadim Kurland <vadim@netcitadel.com>
Date: Thu, 7 Jul 2011 18:58:46 -0700
Subject: [PATCH 17/18] see #2191 "Crash when compiling a route with table
 object". Compiler for PF crashed when run-time AddressTable object was used
 in RDst of a routing rule.

---
 doc/ChangeLog                                 |  5 +++
 .../src/fwcompiler/RoutingCompiler.cpp        | 33 +++++++++++++++++++
 .../src/fwcompiler/RoutingCompiler.h          | 20 +++++++++++
 src/pflib/RoutingCompiler_openbsd.cpp         |  3 ++
 4 files changed, 61 insertions(+)

diff --git a/doc/ChangeLog b/doc/ChangeLog
index 22a0711b2..c4e5b0e00 100644
--- a/doc/ChangeLog
+++ b/doc/ChangeLog
@@ -1,5 +1,10 @@
 2011-07-07  Vadim Kurland  <vadim@netcitadel.com>
 
+	* RoutingCompiler.cpp (processNext): see #2191 "Crash when
+	compiling a route with table object". Compiler for PF crashed
+	when run-time AddressTable object was used in RDst of a routing
+	rule.
+
 	* PFImporter.cpp (makeAddressObj): see #2546 "PF import - negation
 	inside of inline tables is ignored". Since we can not import
 	address lists or tables that contain a mix of negated and
diff --git a/src/libfwbuilder/src/fwcompiler/RoutingCompiler.cpp b/src/libfwbuilder/src/fwcompiler/RoutingCompiler.cpp
index d739fcb77..9c78ecbbf 100644
--- a/src/libfwbuilder/src/fwcompiler/RoutingCompiler.cpp
+++ b/src/libfwbuilder/src/fwcompiler/RoutingCompiler.cpp
@@ -32,6 +32,7 @@
 
 #include "RoutingCompiler.h"
 
+#include "fwbuilder/AddressTable.h"
 #include "fwbuilder/AddressRange.h"
 #include "fwbuilder/RuleElement.h"
 #include "fwbuilder/Network.h"
@@ -53,6 +54,7 @@
 #include "fwbuilder/XMLTools.h"
 #include "fwbuilder/FWException.h"
 #include "fwbuilder/Group.h"
+#include "fwbuilder/MultiAddress.h"
 
 #include <iostream>
 #include <iomanip>
@@ -831,4 +833,35 @@ bool RoutingCompiler::createSortedDstIdsLabel::processNext()
     return true;
 }
 
+/*
+ * This is identical to 
+ * PolicyCompiler_ipf::processMultiAddressObjectsInRE::processNext()
+ * TODO: move the code to the class Compiler so it can be reused.
+ */
+bool RoutingCompiler::processMultiAddressObjectsInRE::processNext()
+{
+    RoutingRule *rule = getNext(); if (rule==NULL) return false;
+    RuleElement *re = RuleElement::cast( rule->getFirstByType(re_type) );
+
+    for (FWObject::iterator i=re->begin(); i!=re->end(); i++)
+    {
+        FWObject *o= *i;
+        if (FWReference::cast(o)!=NULL) o=FWReference::cast(o)->getPointer();
+        MultiAddressRunTime *atrt = MultiAddressRunTime::cast(o);
+        if (atrt!=NULL && atrt->getSubstitutionTypeName()==AddressTable::TYPENAME)
+            compiler->abort(
+                rule, 
+                "Run-time AddressTable objects are not supported.");
+
+        AddressTable *at = AddressTable::cast(o);
+        if (at && at->isRunTime())
+            compiler->abort(
+                rule, 
+                "Run-time AddressTable objects are not supported.");
+    }
+
+    tmp_queue.push_back(rule);
+    return true;
+}
+
 
diff --git a/src/libfwbuilder/src/fwcompiler/RoutingCompiler.h b/src/libfwbuilder/src/fwcompiler/RoutingCompiler.h
index cc546fb16..dbbf237bf 100644
--- a/src/libfwbuilder/src/fwcompiler/RoutingCompiler.h
+++ b/src/libfwbuilder/src/fwcompiler/RoutingCompiler.h
@@ -230,6 +230,26 @@ namespace fwcompiler
         };
         friend class RoutingCompiler::classifyRoutingRules;
 
+        /**
+         * Placeholders for MultiAddressRunTime objects
+         */
+        class processMultiAddressObjectsInRE : public RoutingRuleProcessor
+        {
+            std::string re_type;
+            public:
+            processMultiAddressObjectsInRE(const std::string &name,
+                      const std::string &t) : RoutingRuleProcessor(name) { re_type=t; }
+            virtual bool processNext();
+        };
+
+        class processMultiAddressObjectsInRDst : public processMultiAddressObjectsInRE
+        {
+            public:
+            processMultiAddressObjectsInRDst(const std::string &n) :
+                processMultiAddressObjectsInRE(
+                    n, libfwbuilder::RuleElementRDst::TYPENAME) {}
+        };
+        
         /**
          * detects if rules r1 and r2 are identical (that is, have the
          * same effect, rather than use the same objects)
diff --git a/src/pflib/RoutingCompiler_openbsd.cpp b/src/pflib/RoutingCompiler_openbsd.cpp
index 95650b5aa..36624b253 100644
--- a/src/pflib/RoutingCompiler_openbsd.cpp
+++ b/src/pflib/RoutingCompiler_openbsd.cpp
@@ -207,6 +207,9 @@ void RoutingCompiler_openbsd::compile()
 
     add(new addressRangesInDst("process address ranges"));
 
+    add( new processMultiAddressObjectsInRDst(
+             "process MultiAddress objects in RDst") );
+
     //add(new eliminateDuplicatesInDST("Eliminate duplicates in DST"));
 
     add(new FindDefaultRoute("Find rules that install default route"));

From fae60ec91567a591c3fdfd70a4871c9eda21c1f5 Mon Sep 17 00:00:00 2001
From: Vadim Kurland <vadim@netcitadel.com>
Date: Thu, 7 Jul 2011 19:01:01 -0700
Subject: [PATCH 18/18] build 3559

---
 VERSION                            | 2 +-
 VERSION.h                          | 2 +-
 packaging/fwbuilder-static-qt.spec | 2 +-
 packaging/fwbuilder.control        | 2 +-
 packaging/fwbuilder.spec           | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/VERSION b/VERSION
index aa36e16ef..c8c44d4d6 100644
--- a/VERSION
+++ b/VERSION
@@ -7,7 +7,7 @@ FWB_MICRO_VERSION=0
 # build number is like "nano" version number. I am incrementing build
 # number during development cycle
 #
-BUILD_NUM="3558"
+BUILD_NUM="3559"
 
 VERSION="$FWB_MAJOR_VERSION.$FWB_MINOR_VERSION.$FWB_MICRO_VERSION.$BUILD_NUM"
 
diff --git a/VERSION.h b/VERSION.h
index 8d8498f7d..f8b2665b6 100644
--- a/VERSION.h
+++ b/VERSION.h
@@ -1,2 +1,2 @@
-#define VERSION      "5.0.0.3558"
+#define VERSION      "5.0.0.3559"
 #define GENERATION   "5.0"
diff --git a/packaging/fwbuilder-static-qt.spec b/packaging/fwbuilder-static-qt.spec
index a82e0826b..849b49537 100644
--- a/packaging/fwbuilder-static-qt.spec
+++ b/packaging/fwbuilder-static-qt.spec
@@ -3,7 +3,7 @@
 
 
 %define name    fwbuilder
-%define version 5.0.0.3558
+%define version 5.0.0.3559
 %define release 1
 
 %if "%_vendor" == "MandrakeSoft"
diff --git a/packaging/fwbuilder.control b/packaging/fwbuilder.control
index bc330bf1c..da2a38a19 100644
--- a/packaging/fwbuilder.control
+++ b/packaging/fwbuilder.control
@@ -4,6 +4,6 @@ Replaces: fwbuilder (<=4.1.1-1), fwbuilder-common, fwbuilder-bsd, fwbuilder-linu
 Priority: extra
 Section: checkinstall
 Maintainer: vadim@fwbuilder.org
-Version: 5.0.0.3558-1
+Version: 5.0.0.3559-1
 Depends: libqt4-gui (>= 4.3.0), libxml2, libxslt1.1, libsnmp | libsnmp15
 Description: Firewall Builder GUI and policy compilers
diff --git a/packaging/fwbuilder.spec b/packaging/fwbuilder.spec
index 18e8f7922..09dd6431c 100644
--- a/packaging/fwbuilder.spec
+++ b/packaging/fwbuilder.spec
@@ -1,6 +1,6 @@
 
 %define name    fwbuilder
-%define version 5.0.0.3558
+%define version 5.0.0.3559
 %define release 1
 
 %if "%_vendor" == "MandrakeSoft"