From: Josh <jrosenba@cisco.com>
Date: Tue, 12 Aug 2014 22:57:03 +0000 (-0400)
Subject: removing SFIP macros
X-Git-Tag: 3.0.0-233~1426^2~8^2~4
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=200282cc9fd14b91cccd0333db48e45490b8cba7;p=thirdparty%2Fsnort3.git

removing SFIP macros
---

diff --git a/src/codecs/ip/cd_icmp6.cc b/src/codecs/ip/cd_icmp6.cc
index 12c532faf..3b6d93036 100644
--- a/src/codecs/ip/cd_icmp6.cc
+++ b/src/codecs/ip/cd_icmp6.cc
@@ -137,7 +137,7 @@ bool Icmp6Codec::decode(const uint8_t* raw_pkt, const uint32_t& raw_len,
                 p->dsize -= sizeof(ICMPHdr::icmp_hun.idseq);
                 p->data += sizeof(ICMPHdr::icmp_hun.idseq);
 
-                if ( ipv6::is_multicast(p->ip_api.get_dst()->ip.u6_addr8[0]) )
+                if ( ipv6::is_multicast(p->ip_api.get_dst()->ip8[0]) )
                     codec_events::decoder_event(p, DECODE_ICMP6_DST_MULTICAST);
             }
             else
diff --git a/src/codecs/ip/cd_ipv6.cc b/src/codecs/ip/cd_ipv6.cc
index 12137fb96..24130aaf8 100644
--- a/src/codecs/ip/cd_ipv6.cc
+++ b/src/codecs/ip/cd_ipv6.cc
@@ -162,14 +162,13 @@ bool Ipv6Codec::decode(const uint8_t *raw_pkt, const uint32_t& raw_len,
         goto decodeipv6_fail;
     }
 
+#if 0
+    // multiple encapsulations are now allowed.  this alert is no longer valid
+    if (p->encapsulations)
+        codec_events::decoder_alert_encapsulated(p, DECODE_IP_MULTIPLE_ENCAPSULATION,
+                        raw_pkt, raw_len);
+#endif
 
-    // This will need to go
-    if (p->family != NO_IP)
-    {
-        if (p->encapsulations)
-            codec_events::decoder_alert_encapsulated(p, DECODE_IP_MULTIPLE_ENCAPSULATION,
-                            raw_pkt, raw_len);
-    }
 
     payload_len = ntohs(ip6h->ip6plen) + ipv6::hdr_len();
 
@@ -252,7 +251,7 @@ static inline void IPV6CheckIsatap(const ipv6::IP6RawHdr* ip6h, Packet* p)
            fe80:0000:0000:0000:0000:5efe, followed by the IPv4 address. */
         if (isatap_interface_id == 0x00005EFE)
         {
-            if (p->ip_api.get_src()->ip.u6_addr32[0] != ip6h->ip6_src.u6_addr32[3])
+            if (p->ip_api.get_src()->ip32[0] != ip6h->ip6_src.u6_addr32[3])
                 codec_events::decoder_event(p, DECODE_IPV6_ISATAP_SPOOF);
         }
     }
diff --git a/src/codecs/ip/cd_udp.cc b/src/codecs/ip/cd_udp.cc
index 16d8e6bd2..e429d3dce 100644
--- a/src/codecs/ip/cd_udp.cc
+++ b/src/codecs/ip/cd_udp.cc
@@ -336,8 +336,8 @@ bool UdpCodec::encode (EncState* enc, Buffer* out, const uint8_t* raw_in)
         {
             checksum::Pseudoheader ps;
             const IPHdr *ip4h = ip_api->get_ip4h();
-            ps.sip = ((IPHdr *)enc->ip_hdr)->ip_src;
-            ps.dip = ((IPHdr *)enc->ip_hdr)->ip_dst;
+            ps.sip = ip4h->get_src();
+            ps.dip = ip4h->get_dst();
             ps.zero = 0;
             ps.protocol = IPPROTO_UDP;
             ps.len = ho->uh_len;
diff --git a/src/detection/fpdetect.cc b/src/detection/fpdetect.cc
index f2d874e1e..800e5387e 100644
--- a/src/detection/fpdetect.cc
+++ b/src/detection/fpdetect.cc
@@ -223,12 +223,12 @@ int fpLogEvent(RuleTreeNode *rtn, OptTreeNode *otn, Packet *p)
     else
     {
         sfip_t cleared;
-        IP_CLEAR(cleared);
+        sfip_clear(cleared);
 
         filterEvent = sfthreshold_test(
             otn->sigInfo.generator,
             otn->sigInfo.id,
-            IP_ARG(cleared), IP_ARG(cleared),
+            &cleared, &cleared,
             p->pkth->ts.tv_sec);
     }
 
diff --git a/src/detection/tag.cc b/src/detection/tag.cc
index e5e819042..9b868e205 100644
--- a/src/detection/tag.cc
+++ b/src/detection/tag.cc
@@ -367,8 +367,8 @@ static void AddTagNode(Packet *p, TagData *tag, int mode, uint32_t now,
         return;
     }
 
-    IP_COPY_VALUE(idx->key.sip, p->ip_api.get_src());
-    IP_COPY_VALUE(idx->key.dip, p->ip_api.get_dst());
+    sfip_copy(idx->key.sip, p->ip_api.get_src());
+    sfip_copy(idx->key.dip, p->ip_api.get_dst());
     idx->key.sp = p->sp;
     idx->key.dp = p->dp;
     idx->proto = p->ip_api.proto();
@@ -468,8 +468,8 @@ int CheckTagList(Packet *p, Event *event)
 
     DEBUG_WRAP(DebugMessage(DEBUG_FLOW, "[*] Checking session tag list (forward)...\n"););
 
-    IP_COPY_VALUE(idx.key.sip, p->ip_api.get_src());
-    IP_COPY_VALUE(idx.key.dip, p->ip_api.get_dst());
+    sfip_copy(idx.key.sip, p->ip_api.get_src());
+    sfip_copy(idx.key.dip, p->ip_api.get_dst());
     idx.key.sp = p->sp;
     idx.key.dp = p->dp;
 
@@ -478,8 +478,8 @@ int CheckTagList(Packet *p, Event *event)
 
     if(returned == NULL)
     {
-        IP_COPY_VALUE(idx.key.dip, p->ip_api.get_src());
-        IP_COPY_VALUE(idx.key.sip, p->ip_api.get_dst());
+        sfip_copy(idx.key.dip, p->ip_api.get_src());
+        sfip_copy(idx.key.sip, p->ip_api.get_dst());
         idx.key.dp = p->sp;
         idx.key.sp = p->dp;
 
@@ -499,7 +499,7 @@ int CheckTagList(Packet *p, Event *event)
                 **  Only switch sip, because that's all we check for
                 **  the host tags.
                 */
-                IP_COPY_VALUE(idx.key.sip, p->ip_api.get_src());
+                sfip_copy(idx.key.sip, p->ip_api.get_src());
 
                 returned = (TagNode *) sfxhash_find(host_tag_cache_ptr, &idx);
             }
diff --git a/src/file_api/file_resume_block.cc b/src/file_api/file_resume_block.cc
index b15b20743..0e5cfc491 100644
--- a/src/file_api/file_resume_block.cc
+++ b/src/file_api/file_resume_block.cc
@@ -105,8 +105,8 @@ int file_resume_block_add_file(void *pkt, uint32_t file_sig, uint32_t timeout,
 
     srcIP = p->ip_api.get_src();
     dstIP = p->ip_api.get_dst();
-    IP_COPY_VALUE(hashKey.dip, dstIP);
-    IP_COPY_VALUE(hashKey.sip, srcIP);
+    sfip_copy(hashKey.dip, dstIP);
+    sfip_copy(hashKey.sip, srcIP);
     hashKey.file_sig = file_sig;
 
     hash_node = sfxhash_find_node(fileHash, &hashKey);
@@ -241,8 +241,8 @@ File_Verdict file_resume_block_check(void *pkt, uint32_t file_sig)
     }
     srcIP = p->ip_api.get_src();
     dstIP = p->ip_api.get_dst();
-    IP_COPY_VALUE(hashKey.dip, dstIP);
-    IP_COPY_VALUE(hashKey.sip, srcIP);
+    sfip_copy(hashKey.dip, dstIP);
+    sfip_copy(hashKey.sip, srcIP);
     hashKey.file_sig = file_sig;
 
     hash_node = sfxhash_find_node(fileHash, &hashKey);
diff --git a/src/filters/rate_filter.cc b/src/filters/rate_filter.cc
index 6f6a08a9e..0a756d366 100644
--- a/src/filters/rate_filter.cc
+++ b/src/filters/rate_filter.cc
@@ -141,9 +141,9 @@ int RateFilter_Test(
     }
     else
     {
-        IP_CLEAR(cleared);
-        sip = IP_ARG(cleared);
-        dip = IP_ARG(cleared);
+        sfip_clear(cleared);
+        sip = &cleared;
+        dip = &cleared;
     }
 
     if ((snort_conf == NULL) || (snort_conf->rate_filter_config == NULL))
diff --git a/src/filters/sfrf.cc b/src/filters/sfrf.cc
index 88e62e987..572769d31 100644
--- a/src/filters/sfrf.cc
+++ b/src/filters/sfrf.cc
@@ -566,8 +566,8 @@ int SFRF_TestThreshold(
             case SFRF_TRACK_BY_RULE:
                 {
                     sfip_t cleared;
-                    IP_CLEAR(cleared);
-                    newStatus = SFRF_TestObject(cfgNode, IP_ARG(cleared), curTime, op);
+                    sfip_clear(cleared);
+                    newStatus = SFRF_TestObject(cfgNode, &cleared, curTime, op);
                 }
                 break;
 
@@ -808,7 +808,7 @@ static tSFRFTrackingNode* _getSFRFTrackingNode(
     SFXHASH_NODE * hnode = NULL;
 
     /* Setup key */
-    key.ip = *(IP_PTR(ip));
+    key.ip = *(ip);
     key.tid = tid;
     key.policyId = get_network_policy()->policy_id;
 
diff --git a/src/filters/sfthd.cc b/src/filters/sfthd.cc
index 38b3994d4..62cb955cd 100644
--- a/src/filters/sfthd.cc
+++ b/src/filters/sfthd.cc
@@ -942,7 +942,7 @@ int sfthd_test_local(
 
     /* Set up the key */
     key.policyId = policy_id;
-    key.ip     = IP_VAL(ip);
+    key.ip = *ip;
     key.thd_id = sfthd_node->thd_id;
 
     /* Set up a new data element */
@@ -1033,7 +1033,7 @@ static inline int sfthd_test_global(
     */
 
     /* Set up the key */
-    key.ip     = IP_VAL(ip);
+    key.ip = *ip;
     key.gen_id = sfthd_node->gen_id;
     key.sig_id = sig_id;
     key.policyId = policy_id;
diff --git a/src/flow/expect_cache.cc b/src/flow/expect_cache.cc
index 3f5827cde..499864c4f 100644
--- a/src/flow/expect_cache.cc
+++ b/src/flow/expect_cache.cc
@@ -142,17 +142,17 @@ inline bool ExpectKey::set(
 
     if (rval == SFIP_LESSER || (rval == SFIP_EQUAL && cliPort < srvPort))
     {
-        IP_COPY_VALUE(ip1, cliIP);
+        sfip_copy(ip1, cliIP);
         port1 = cliPort;
-        IP_COPY_VALUE(ip2, srvIP);
+        sfip_copy(ip2, srvIP);
         port2 = srvPort;
         reverse = false;
     }
     else
     {
-        IP_COPY_VALUE(ip1, srvIP);
+        sfip_copy(ip1, srvIP);
         port1 = srvPort;
-        IP_COPY_VALUE(ip2, cliIP);
+        sfip_copy(ip2, cliIP);
         port2 = cliPort;
         reverse = true;
     }
diff --git a/src/ips_options/ips_rpc.cc b/src/ips_options/ips_rpc.cc
index a2e3879dc..3baffe2c8 100644
--- a/src/ips_options/ips_rpc.cc
+++ b/src/ips_options/ips_rpc.cc
@@ -136,7 +136,7 @@ int RpcOption::eval(Cursor&, Packet *p)
 #endif
     PROFILE_VARS;
 
-    if(!p->iph_api || (IsTCP(p) && !p->tcph)
+    if(!p->ip_api.is_valid() || (IsTCP(p) && !p->tcph)
        || (IsUDP(p) && !p->udph))
         return 0; /* if error occured while ip header
                    * was processed, return 0 automagically.  */
diff --git a/src/log/messages.cc b/src/log/messages.cc
index c7e3bfdc1..1965b4505 100644
--- a/src/log/messages.cc
+++ b/src/log/messages.cc
@@ -360,7 +360,7 @@ char * ObfuscateIpToText(const sfip_t *ip)
     if (ip == NULL)
         return ip_buf;
 
-    if (!IP_IS_SET(snort_conf->obfuscation_net))
+    if (!sfip_is_set(snort_conf->obfuscation_net))
     {
         if (ip->is_ip6())
             SnortSnprintf(ip_buf, buf_size, "x:x:x:x::x:x:x:x");
@@ -372,9 +372,9 @@ char * ObfuscateIpToText(const sfip_t *ip)
         sfip_t tmp;
         char *tmp_buf;
 
-        IP_COPY_VALUE(tmp, ip);
+        sfip_copy(tmp, ip);
 
-        if (IP_IS_SET(snort_conf->homenet))
+        if (sfip_is_set(snort_conf->homenet))
         {
             if (sfip_contains(&snort_conf->homenet, &tmp) == SFIP_CONTAINS)
                 sfip_obfuscate(&snort_conf->obfuscation_net, &tmp);
diff --git a/src/managers/packet_manager.cc b/src/managers/packet_manager.cc
index a03e8d7f7..805edc149 100644
--- a/src/managers/packet_manager.cc
+++ b/src/managers/packet_manager.cc
@@ -562,10 +562,7 @@ SO_PUBLIC int PacketManager::encode_format_with_daq_info (
     Layer* lyr;
     int len;
     int num_layers = p->num_layers;
-
-    // TODO -- remove
     DAQ_PktHdr_t* pkth = (DAQ_PktHdr_t*)c->pkth;
-    uint8_t* pkt = (uint8_t*)c->pkt;
 
     if ( num_layers <= 0 )
         return -1;
diff --git a/src/network_inspectors/arp_spoof/arp_spoof.cc b/src/network_inspectors/arp_spoof/arp_spoof.cc
index 3f4258414..ae2ec2be1 100644
--- a/src/network_inspectors/arp_spoof/arp_spoof.cc
+++ b/src/network_inspectors/arp_spoof/arp_spoof.cc
@@ -127,7 +127,7 @@ static void PrintIPMacEntryList(IPMacEntryList& ipmel)
         sfip_t in;
         sfip_set_raw(&in, &p.ipv4_addr, AF_INET);
         // FIXIT replace all inet_ntoa() with thread safe
-        LogMessage("    %s -> ", inet_ntoa(IP_ARG(in)));
+        LogMessage("    %s -> ", inet_ntoa(&in));
 
         for (int i = 0; i < 6; i++)
         {
diff --git a/src/network_inspectors/perf_monitor/perf_flow.cc b/src/network_inspectors/perf_monitor/perf_flow.cc
index 9e9c5d15f..12718b300 100644
--- a/src/network_inspectors/perf_monitor/perf_flow.cc
+++ b/src/network_inspectors/perf_monitor/perf_flow.cc
@@ -288,16 +288,16 @@ static sfSFSValue *findFlowIPStats(SFFLOW *sfFlow, const sfip_t *src_addr, const
     sfSFSKey key;
     sfSFSValue *value;
 
-    if (IP_LESSER(src_addr, dst_addr))
+    if (sfip_lesser(src_addr, dst_addr))
     {
-        IP_COPY_VALUE(key.ipA, src_addr);
-        IP_COPY_VALUE(key.ipB, dst_addr);
+        sfip_copy(key.ipA, src_addr);
+        sfip_copy(key.ipB, dst_addr);
         *swapped = 0;
     }
     else
     {
-        IP_COPY_VALUE(key.ipA, dst_addr);
-        IP_COPY_VALUE(key.ipB, src_addr);
+        sfip_copy(key.ipA, dst_addr);
+        sfip_copy(key.ipB, src_addr);
         *swapped = 1;
     }
 
diff --git a/src/network_inspectors/port_scan/port_scan.cc b/src/network_inspectors/port_scan/port_scan.cc
index 3da621cc2..97ada1d9f 100644
--- a/src/network_inspectors/port_scan/port_scan.cc
+++ b/src/network_inspectors/port_scan/port_scan.cc
@@ -65,7 +65,6 @@
 #include "snort.h"
 #include "filters/sfthreshold.h"
 #include "sfsnprintfappend.h"
-#include "sf_iph.h"
 #include "framework/inspector.h"
 #include "framework/share.h"
 #include "framework/plug_data.h"
@@ -193,7 +192,7 @@ static int LogPortscanAlert(Packet *p, uint32_t event_id,
     const sfip_t *src_addr;
     const sfip_t *dst_addr;
 
-    if(!p->iph_api)
+    if(!p->ip_api.is_valid())
         return -1;
 
     /* Do not log if being suppressed */
diff --git a/src/network_inspectors/port_scan/ps_detect.cc b/src/network_inspectors/port_scan/ps_detect.cc
index 65531a4cb..695b0cdab 100644
--- a/src/network_inspectors/port_scan/ps_detect.cc
+++ b/src/network_inspectors/port_scan/ps_detect.cc
@@ -511,12 +511,12 @@ int PortScan::ps_tracker_lookup(PS_PKT *ps_pkt, PS_TRACKER **scanner,
     if (config->detect_scan_type &
         (PS_TYPE_PORTSCAN | PS_TYPE_DECOYSCAN | PS_TYPE_DISTPORTSCAN))
     {
-        IP_CLEAR(key.scanner);
+        sfip_clear(key.scanner);
 
         if(ps_pkt->reverse_pkt)
-            IP_COPY_VALUE(key.scanned, p->ip_api.get_src());
+            sfip_copy(key.scanned, p->ip_api.get_src());
         else
-            IP_COPY_VALUE(key.scanned, p->ip_api.get_dst());
+            sfip_copy(key.scanned, p->ip_api.get_dst());
 
         /*
         **  Get the scanned tracker.
@@ -529,12 +529,12 @@ int PortScan::ps_tracker_lookup(PS_PKT *ps_pkt, PS_TRACKER **scanner,
     */
     if(config->detect_scan_type & PS_TYPE_PORTSWEEP)
     {
-        IP_CLEAR(key.scanned);
+        sfip_clear(key.scanned);
 
         if(ps_pkt->reverse_pkt)
-            IP_COPY_VALUE(key.scanner, p->ip_api.get_dst());
+            sfip_copy(key.scanner, p->ip_api.get_dst());
         else
-            IP_COPY_VALUE(key.scanner, p->ip_api.get_src());
+            sfip_copy(key.scanner, p->ip_api.get_src());
 
         /*
         **  Get the scanner tracker
@@ -726,32 +726,32 @@ int PortScan::ps_proto_update(PS_PROTO *proto, int ps_cnt, int pri_cnt, const sf
     if(proto->connection_count < 0)
         proto->connection_count = 0;
 
-    if(!IP_EQUALITY_UNSET(&proto->u_ips, ip))
+    if(!sfip_unset_equals(&proto->u_ips, ip))
     {
         proto->u_ip_count++;
-        IP_COPY_VALUE(proto->u_ips, ip);
+        sfip_copy(proto->u_ips, ip);
     }
 
     /* we need to do the IP comparisons in host order */
 
     if(sfip_is_set(&proto->low_ip))
     {
-        if(IP_GREATER(&proto->low_ip, ip))
-            IP_COPY_VALUE(proto->low_ip, ip);
+        if(sfip_greater(&proto->low_ip, ip))
+            sfip_copy(proto->low_ip, ip);
     }
     else
     {
-        IP_COPY_VALUE(proto->low_ip, ip);
+        sfip_copy(proto->low_ip, ip);
     }
 
-    if(IP_IS_SET(proto->high_ip))
+    if(sfip_is_set(proto->high_ip))
     {
-        if(IP_LESSER(&proto->high_ip, ip))
-            IP_COPY_VALUE(proto->high_ip, ip);
+        if(sfip_lesser(&proto->high_ip, ip))
+            sfip_copy(proto->high_ip, ip);
     }
     else
     {
-        IP_COPY_VALUE(proto->high_ip, ip);
+        sfip_copy(proto->high_ip, ip);
     }
 
     if(proto->u_ports != port)
@@ -827,7 +827,7 @@ int PortScan::ps_tracker_update_tcp(PS_PKT *ps_pkt, PS_TRACKER *scanner,
     Packet  *p;
     uint32_t session_flags;
     sfip_t cleared;
-    IP_CLEAR(cleared);
+    sfip_clear(cleared);
 
     p = (Packet *)ps_pkt->pkt;
 
@@ -1006,7 +1006,7 @@ int PortScan::ps_tracker_update_ip(PS_PKT *ps_pkt, PS_TRACKER *scanner,
 {
     Packet *p;
     sfip_t cleared;
-    IP_CLEAR(cleared);
+    sfip_clear(cleared);
 
     p = (Packet *)ps_pkt->pkt;
 
@@ -1038,7 +1038,7 @@ int PortScan::ps_tracker_update_udp(PS_PKT *ps_pkt, PS_TRACKER *scanner,
 {
     Packet  *p;
     sfip_t    cleared;
-    IP_CLEAR(cleared);
+    sfip_clear(cleared);
 
     p = (Packet *)ps_pkt->pkt;
 
@@ -1095,7 +1095,7 @@ int PortScan::ps_tracker_update_icmp(
 {
     Packet  *p;
     sfip_t cleared;
-    IP_CLEAR(cleared);
+    sfip_clear(cleared);
 
     p = (Packet *)ps_pkt->pkt;
 
diff --git a/src/protocols/gre.h b/src/protocols/gre.h
index e00515806..6911482ee 100644
--- a/src/protocols/gre.h
+++ b/src/protocols/gre.h
@@ -38,7 +38,7 @@ struct GREHdr
     inline uint8_t get_version() const
     { return version & 0x07; }
 
-    inline uint8_t get_proto() const
+    inline uint16_t get_proto() const
     { return ntohs(ether_type); }
 };
 
diff --git a/src/protocols/ip.h b/src/protocols/ip.h
index c06a4db8c..b0169885f 100644
--- a/src/protocols/ip.h
+++ b/src/protocols/ip.h
@@ -40,7 +40,7 @@
 #include "sfip/sfip_t.h"
 
 
-class Packet;
+struct Packet;
 
 namespace ip
 {
diff --git a/src/protocols/layer.h b/src/protocols/layer.h
index cfc15bc3d..8ef08c628 100644
--- a/src/protocols/layer.h
+++ b/src/protocols/layer.h
@@ -82,6 +82,8 @@ namespace icmp
 struct ICMPHdr;
 }
 
+struct Packet;
+
 namespace layer
 {
 
diff --git a/src/protocols/packet.h b/src/protocols/packet.h
index 65a65f469..604252c08 100644
--- a/src/protocols/packet.h
+++ b/src/protocols/packet.h
@@ -49,7 +49,6 @@ extern "C" {
 #include "main/snort_types.h"
 #include "sfip/ipv6_port.h"
 #include "sfip/sf_ip.h"
-#include "sfip/sf_iph.h"
 #include "codecs/sf_protocols.h"
 
 
@@ -191,8 +190,6 @@ struct Packet
     Flow* flow;   /* for session tracking */
 
     //vvv-----------------------------
-    IPH_API* iph_api;
-
     int family;
     //^^^-----------------------------
 
diff --git a/src/service_inspectors/ftp_telnet/ftp_bounce_lookup.cc b/src/service_inspectors/ftp_telnet/ftp_bounce_lookup.cc
index ce0bcda1f..bc876629c 100644
--- a/src/service_inspectors/ftp_telnet/ftp_bounce_lookup.cc
+++ b/src/service_inspectors/ftp_telnet/ftp_bounce_lookup.cc
@@ -129,7 +129,7 @@ int ftp_bounce_lookup_add(BOUNCE_LOOKUP *BounceLookup,
         return FTPP_INVALID_ARG;
     }
 
-    iRet = KMapAdd(BounceLookup, (void*)IP_PTR(Ip), IP_SIZE(Ip), (void*)BounceTo);
+    iRet = KMapAdd(BounceLookup, (void*)Ip, Ip->sfip_size(), (void*)BounceTo);
 
     if (iRet)
     {
@@ -185,7 +185,7 @@ FTP_BOUNCE_TO  *ftp_bounce_lookup_find(
 
     *iError = FTPP_SUCCESS;
 
-    BounceTo = (FTP_BOUNCE_TO *)KMapFind(BounceLookup, (void*)IP_PTR(Ip), IP_SIZE(Ip));
+    BounceTo = (FTP_BOUNCE_TO *)KMapFind(BounceLookup, (void*)Ip, Ip->sfip_size());
     if (!BounceTo)
     {
         *iError = FTPP_NOT_FOUND;
diff --git a/src/service_inspectors/ftp_telnet/ftp_parse.cc b/src/service_inspectors/ftp_telnet/ftp_parse.cc
index a7287d27b..7e2c33053 100644
--- a/src/service_inspectors/ftp_telnet/ftp_parse.cc
+++ b/src/service_inspectors/ftp_telnet/ftp_parse.cc
@@ -840,7 +840,7 @@ int ProcessFTPAllowBounce(
         newBounce->porthi = high;
  
         int iRet = ftp_bounce_lookup_add(
-            ClientConf->bounce_lookup, IP_ARG(newBounce->ip), newBounce);
+            ClientConf->bounce_lookup, &newBounce->ip, newBounce);
 
         if (iRet)
         {
diff --git a/src/service_inspectors/ftp_telnet/ftpp_si.cc b/src/service_inspectors/ftp_telnet/ftpp_si.cc
index 20cb1c4b5..91eb79f3a 100644
--- a/src/service_inspectors/ftp_telnet/ftpp_si.cc
+++ b/src/service_inspectors/ftp_telnet/ftpp_si.cc
@@ -488,9 +488,9 @@ static inline int FTPResetsession(FTP_SESSION *Ftpsession)
     Ftpsession->server_conf = NULL;
 
     Ftpsession->encr_state = NO_STATE;
-    IP_CLEAR(Ftpsession->clientIP);
+    sfip_clear(Ftpsession->clientIP);
     Ftpsession->clientPort = 0;
-    IP_CLEAR(Ftpsession->serverIP);
+    sfip_clear(Ftpsession->serverIP);
     Ftpsession->serverPort = 0;
     Ftpsession->data_chan_state = NO_STATE;
     Ftpsession->data_chan_index = -1;
@@ -596,8 +596,8 @@ int FTPsessionInspection(
  */
 int SetSiInput(FTPP_SI_INPUT *SiInput, Packet *p)
 {   
-    IP_COPY_VALUE(SiInput->sip, p->ip_api.get_src());
-    IP_COPY_VALUE(SiInput->dip, p->ip_api.get_dst());
+    sfip_copy(SiInput->sip, p->ip_api.get_src());
+    sfip_copy(SiInput->dip, p->ip_api.get_dst());
     SiInput->sport = p->sp;
     SiInput->dport = p->dp;
         
diff --git a/src/service_inspectors/ftp_telnet/pp_ftp.cc b/src/service_inspectors/ftp_telnet/pp_ftp.cc
index 47b756168..2d742d868 100644
--- a/src/service_inspectors/ftp_telnet/pp_ftp.cc
+++ b/src/service_inspectors/ftp_telnet/pp_ftp.cc
@@ -363,7 +363,7 @@ static int getIP2428 (
     int family = AF_UNSPEC, port = 0;
     char buf[64];
 
-    IP_CLEAR((*ipRet));
+    sfip_clear((*ipRet));
     *portRet = 0;
 
     /* check first delimiter */
@@ -787,7 +787,7 @@ static int validate_param(Packet *p,
                 break;
             }
 
-            if ( ThisFmt->type == e_extd_host_port && !IP_IS_SET(ipAddr) )
+            if ( ThisFmt->type == e_extd_host_port && !sfip_is_set(ipAddr) )
             {
                 // actually, we expect no addr in 229 responses, which is
                 // understood to be server address, so we set that here
@@ -795,12 +795,12 @@ static int validate_param(Packet *p,
             }
             if ( session->client_conf->bounce )
             {
-                if (!IP_EQUALITY(&ipAddr, p->ip_api.get_src()))
+                if (!sfip_equals(&ipAddr, p->ip_api.get_src()))
                 {
                     int alert = 1;
 
                     FTP_BOUNCE_TO *BounceTo = ftp_bounce_lookup_find(
-                        session->client_conf->bounce_lookup, (const sfip_t*)IP_ARG(ipAddr), &iRet);
+                        session->client_conf->bounce_lookup, &ipAddr, &iRet);
                     if (BounceTo)
                     {
                         if (BounceTo->portlo)
@@ -844,7 +844,7 @@ static int validate_param(Packet *p,
                 session->data_chan_state &= ~DATA_CHAN_PASV_CMD_ISSUED;
             }
 
-            IP_CLEAR(session->serverIP);
+            sfip_clear(session->serverIP);
             session->serverPort = 0;
         }
         break;
@@ -1088,7 +1088,7 @@ static int do_stateful_checks(FTP_SESSION *session, Packet *p,
                     sfip_t ipAddr;
                     uint16_t port=0;
                     const char *ip_begin = req->param_begin;
-                    IP_CLEAR(ipAddr);
+                    sfip_clear(ipAddr);
                     session->data_chan_state &= ~DATA_CHAN_PASV_CMD_ISSUED;
                     session->data_chan_state |= DATA_CHAN_PASV_CMD_ACCEPT;
                     session->data_chan_index = -1;
@@ -1124,14 +1124,14 @@ static int do_stateful_checks(FTP_SESSION *session, Packet *p,
                         );
                         if (iRet == FTPP_SUCCESS)
                         {
-                            if (!IP_IS_SET(ipAddr))
-                                IP_COPY_VALUE(session->serverIP, p->ip_api.get_src());
+                            if (!sfip_is_set(ipAddr))
+                                sfip_copy(session->serverIP, p->ip_api.get_src());
                             else
                             {
                                 session->serverIP = ipAddr;
                             }
                             session->serverPort = port;
-                            IP_COPY_VALUE(session->clientIP, p->ip_api.get_dst());
+                            sfip_copy(session->clientIP, p->ip_api.get_dst());
                             session->clientPort = 0;
 
                             if ((file_api->get_max_file_depth() > 0) || !(session->server_conf->data_chan))
@@ -1146,8 +1146,8 @@ static int do_stateful_checks(FTP_SESSION *session, Packet *p,
 
                                 /* Call into Streams to mark data channel as ftp-data */
                                 result = stream.set_application_protocol_id_expected(
-                                    IP_ARG(session->clientIP), session->clientPort,
-                                    IP_ARG(session->serverIP), session->serverPort,
+                                    &session->clientIP, session->clientPort,
+                                    &session->serverIP, session->serverPort,
                                     (uint8_t)(p->ip_api.proto()), ftp_data_app_id, fd);
 
                                 if (result < 0)
@@ -1158,8 +1158,8 @@ static int do_stateful_checks(FTP_SESSION *session, Packet *p,
                                 /* Call into Streams to mark data channel as something
                                  * to ignore. */
                                 stream.ignore_session(
-                                    IP_ARG(session->clientIP), session->clientPort,
-                                    IP_ARG(session->serverIP), session->serverPort,
+                                    &session->clientIP, session->clientPort,
+                                    &session->serverIP, session->serverPort,
                                     (uint8_t)(p->ip_api.proto()),
                                     FtpDataFlowData::flow_id, SSN_DIR_BOTH);
                             }
@@ -1189,13 +1189,13 @@ static int do_stateful_checks(FTP_SESSION *session, Packet *p,
                     session->data_chan_state &= ~DATA_CHAN_PORT_CMD_ISSUED;
                     session->data_chan_state |= DATA_CHAN_PORT_CMD_ACCEPT;
                     session->data_chan_index = -1;
-                    if (IP_IS_SET(session->clientIP))
+                    if (sfip_is_set(session->clientIP))
                     {
                         /* This means we're not in passive mode. */
                         /* Server is listening/sending from its own IP,
                          * FTP Port -1 */
                         /* Client IP, Port specified via PORT command */
-                        IP_COPY_VALUE(session->serverIP, p->ip_api.get_src());
+                        sfip_copy(session->serverIP, p->ip_api.get_src());
 
                         /* Can't necessarily guarantee this, especially
                          * in the case of a proxy'd connection where the
@@ -1217,8 +1217,8 @@ static int do_stateful_checks(FTP_SESSION *session, Packet *p,
 
                             /* Call into Streams to mark data channel as ftp-data */
                             result = stream.set_application_protocol_id_expected(
-                                IP_ARG(session->clientIP), session->clientPort,
-                                IP_ARG(session->serverIP), session->serverPort,
+                                &session->clientIP, session->clientPort,
+                                &session->serverIP, session->serverPort,
                                 (uint8_t)(p->ip_api.proto()), ftp_data_app_id, fd);
 
                             if (result < 0)
@@ -1229,8 +1229,8 @@ static int do_stateful_checks(FTP_SESSION *session, Packet *p,
                             /* Call into Streams to mark data channel as something
                              * to ignore. */
                             stream.ignore_session(
-                                IP_ARG(session->clientIP), session->clientPort,
-                                IP_ARG(session->serverIP), session->serverPort,
+                                &session->clientIP, session->clientPort,
+                                &session->serverIP, session->serverPort,
                                 (uint8_t)(p->ip_api.proto()),
                                 FtpDataFlowData::flow_id, SSN_DIR_BOTH);
                         }
@@ -1257,8 +1257,8 @@ static int do_stateful_checks(FTP_SESSION *session, Packet *p,
                 }
                 /* Clear the session info for next transfer -->
                  * reset host/port */
-                IP_CLEAR(session->serverIP);
-                IP_CLEAR(session->clientIP);
+                sfip_clear(session->serverIP);
+                sfip_clear(session->clientIP);
                 session->serverPort = session->clientPort = 0;
 
                 session->data_chan_state = NO_STATE;
diff --git a/src/service_inspectors/http_inspect/hi_client.cc b/src/service_inspectors/http_inspect/hi_client.cc
index d41fe756c..7f16c4a93 100644
--- a/src/service_inspectors/http_inspect/hi_client.cc
+++ b/src/service_inspectors/http_inspect/hi_client.cc
@@ -1870,7 +1870,7 @@ const u_char *extract_http_xff(HI_SESSION *session, const u_char *p, const u_cha
             }
             if(*true_ip)
             {
-                if(!IP_EQUALITY(*true_ip, tmp))
+                if(!sfip_equals(*true_ip, tmp))
                 {
                     sfip_free(*true_ip);
                     *true_ip = tmp;
diff --git a/src/service_inspectors/http_inspect/hi_main.cc b/src/service_inspectors/http_inspect/hi_main.cc
index abd21a58c..a7040fa5d 100644
--- a/src/service_inspectors/http_inspect/hi_main.cc
+++ b/src/service_inspectors/http_inspect/hi_main.cc
@@ -351,8 +351,8 @@ int PrintGlobalConf(HTTPINSPECT_GLOBAL_CONF *GlobalConf)
 
 static inline int SetSiInput(HI_SI_INPUT *SiInput, Packet *p)
 {
-    IP_COPY_VALUE(SiInput->sip, p->ip_api.get_src());
-    IP_COPY_VALUE(SiInput->dip, p->ip_api.get_dst());
+    sfip_copy(SiInput->sip, p->ip_api.get_src());
+    sfip_copy(SiInput->dip, p->ip_api.get_dst());
     SiInput->sport = p->sp;
     SiInput->dport = p->dp;
 
diff --git a/src/service_inspectors/http_inspect/hi_si.cc b/src/service_inspectors/http_inspect/hi_si.cc
index e7c4e4e03..4a4c9dda7 100644
--- a/src/service_inspectors/http_inspect/hi_si.cc
+++ b/src/service_inspectors/http_inspect/hi_si.cc
@@ -95,11 +95,11 @@ static int InitServerConf(HTTPINSPECT_CONF *GlobalConf,
 
     if (sip.family == AF_INET)
     {
-        sip.ip.u6_addr32[0] = ntohl(sip.ip.u6_addr32[0]);
+        sip.ip32[0] = ntohl(sip.ip32[0]);
     }
     if (dip.family == AF_INET)
     {
-        dip.ip.u6_addr32[0] = ntohl(dip.ip.u6_addr32[0]);
+        dip.ip32[0] = ntohl(dip.ip32[0]);
     }
 
     ServerConfDip = ServerConfSip = GlobalConf;
diff --git a/src/sfip/CMakeLists.txt b/src/sfip/CMakeLists.txt
index b42009a56..def879992 100644
--- a/src/sfip/CMakeLists.txt
+++ b/src/sfip/CMakeLists.txt
@@ -2,7 +2,6 @@
 
 set(SFIP_INCLUDES
     ipv6_port.h
-    sf_iph.h
     sf_ip.h
     sf_ipvar.h
     sfip_t.h
@@ -11,7 +10,6 @@ set(SFIP_INCLUDES
 add_library ( sfip STATIC
     ${SFIP_INCLUDES}
     sf_ip.cc
-    sf_iph.cc
     sf_ipvar.cc
     sf_vartable.cc
     sf_vartable.h 
diff --git a/src/sfip/Makefile.am b/src/sfip/Makefile.am
index fcd725dde..12934fc0e 100644
--- a/src/sfip/Makefile.am
+++ b/src/sfip/Makefile.am
@@ -7,13 +7,11 @@ x_includedir = $(pkgincludedir)/sfip
 x_include_HEADERS = \
 ipv6_port.h \
 sf_ip.h \
-sf_iph.h \
 sf_ipvar.h \
 sfip_t.h
 
 libsfip_a_SOURCES = \
 sf_ip.cc \
-sf_iph.cc \
 sf_ipvar.cc \
 sf_vartable.cc \
 sf_vartable.h
diff --git a/src/sfip/ipv6_port.h b/src/sfip/ipv6_port.h
index c71084cfb..b54993af4 100644
--- a/src/sfip/ipv6_port.h
+++ b/src/sfip/ipv6_port.h
@@ -32,10 +32,6 @@
 #include "sfip/sf_ipvar.h"
 
 
-#ifdef inet_ntoa
-#undef inet_ntoa
-#endif
-#define inet_ntoa sfip_ntoa
 
 #if 0
 typedef const sfip_t *const sfip_t*;
@@ -59,10 +55,6 @@ typedef const sfip_t snort_ip;
 #define GET_IPH_OFF(p)   (p)->iph_api->iph_ret_off(p)
 #define GET_IPH_VER(p)   (p)->iph_api->iph_ret_ver(p)
 
-#endif
-
-
-#if 0
 #define p->ip_api.proto() ((uint8_t)(IS_IP6(p) ? ((p)->ip6h->next) : ((p)->iph_api->iph_ret_proto(p))))
 
 
@@ -80,18 +72,14 @@ typedef const sfip_t snort_ip;
 /* XXX make sure these aren't getting confused with sfip_is_valid within the code */
 #define IPH_IS_VALID(p) iph_is_valid(p)
 
-#endif
 
 #define IP_EQUALITY(x,y) (sfip_compare((x),(y)) == SFIP_EQUAL)
 #define IP_EQUALITY_UNSET(x,y) (sfip_compare_unset((x),(y)) == SFIP_EQUAL)
 #define IP_LESSER(x,y)   (sfip_compare((x),(y)) == SFIP_LESSER)
 #define IP_GREATER(x,y)  (sfip_compare((x),(y)) == SFIP_GREATER)
-
-
-
 #define IP_CLEAR(x) (x).bits = (x).family = 0; (x).ip32[0] = (x).ip32[1] = (x).ip32[2] = (x).ip32[3] = 0;
-
 #define IP_IS_SET(x) sfip_is_set(&x)
+#define IP_COPY_VALUE(x,y) ( x = *y)
 
 /* This loop trickery is intentional.  If each copy is performed
  * individually on each field, then the following expression gets broken:
@@ -101,7 +89,8 @@ typedef const sfip_t snort_ip;
  * If the macro is instead enclosed in braces, then having a semicolon
  * trailing the macro causes compile breakage.
  * So: use loop. */
-#define IP_COPY_VALUE(x,y) \
+
+ \
         do {  \
                 (x).bits = (y)->bits; \
                 (x).family = (y)->family; \
@@ -111,7 +100,6 @@ typedef const sfip_t snort_ip;
                 (x).ip32[3] = (y)->ip32[3]; \
         } while(0)
 
-#if 0
 #define GET_IPH_HLEN(p) ((p)->iph_api->iph_ret_hlen(p))
 #define SET_IPH_HLEN(p, val)
 
@@ -121,12 +109,14 @@ typedef const sfip_t snort_ip;
 
 #define GET_INNER_SRC_IP(p)  (IS_IP6(p) ? (&((p)->inner_ip6h.ip_src)):(&((p)->inner_ip4h.ip_src)))
 #define GET_INNER_DST_IP(p)  (IS_IP6(p) ? (&((p)->inner_ip6h.ip_dst)):(&((p)->inner_ip4h.ip_dst)))
-#endif
+
+
 #define IP_ARG(ipt)  (&ipt)
 #define IP_PTR(ipp)  (ipp)
 #define IP_VAL(ipt)  (*ipt)
 #define IP_SIZE(ipp) (sfip_size(ipp))
 
+
 static inline int sfip_equal (const sfip_t *ip1, const sfip_t *ip2)
 {
     if ( ip1->family != ip2->family )
@@ -143,6 +133,7 @@ static inline int sfip_equal (const sfip_t *ip1, const sfip_t *ip2)
     }
     return 0;
 }
+#endif
 
 #endif /* IPV6_PORT_H */
 
diff --git a/src/sfip/sf_ip.h b/src/sfip/sf_ip.h
index dc6a73441..47dca2dfa 100644
--- a/src/sfip/sf_ip.h
+++ b/src/sfip/sf_ip.h
@@ -122,7 +122,7 @@ void sfip_obfuscate(sfip_t *ob, sfip_t *ip);
 static inline unsigned int sfip_size(const sfip_t *ipt)
 {
     if ( ipt->family == AF_INET6 ) return sizeof(*ipt);
-    return (unsigned int)((ipt->ip.u6_addr8+4) - (u_int8_t*)ipt);
+    return (unsigned int)((ipt->ip8+4) - (u_int8_t*)ipt);
 }
 
 /* Member-access *******************************************************/
@@ -160,9 +160,10 @@ static inline void sfip_set_bits(sfip_t *p, int bits) {
 /* Returns SFIP_EQUAL if so */
 SFIP_RET sfip_contains(const sfip_t *net, const sfip_t *ip);
 
+#if 0
 /* Returns 1 if the IP is non-zero. 0 otherwise */
 /* XXX This is a performance critical function, \
- *  need to determine if it's safe to not check these pointers */\
+ *  need to determine if it's safe to not check these pointers */
 static inline int sfip_is_set(const sfip_t *ip) {
 //    ARG_CHECK1(ip, -1);
     return ip->ip32[0] ||
@@ -171,6 +172,7 @@ static inline int sfip_is_set(const sfip_t *ip) {
               ip->ip32[2] ||
               ip->ip32[3] || ip->bits != 128)) || ((ip->family == AF_INET) && ip->bits != 32)  ;
 }
+#endif
 
 /* Return 1 if the IP is a loopback IP */
 int sfip_is_loopback(const sfip_t *ip);
@@ -214,7 +216,7 @@ static inline SFIP_RET _ip6_cmp(const sfip_t *ip1, const sfip_t *ip2) {
  * or greater than ip2 In the case of mismatched families, the IPv4 address
  * is converted to an IPv6 representation. */
 /* XXX-IPv6 Should add version of sfip_compare that just tests equality */
-static inline SFIP_RET sfip_compare(const sfip_t *ip1, const sfip_t *ip2) {
+static inline SFIP_RET sfip_compare(const sfip_t* const ip1, const sfip_t* const ip2) {
     int f1,f2;
 
     ARG_CHECK2(ip1, ip2, SFIP_ARG_ERR);
@@ -255,7 +257,7 @@ static inline SFIP_RET sfip_compare(const sfip_t *ip1, const sfip_t *ip2) {
  * or greater than ip2 In the case of mismatched families, the IPv4 address
  * is converted to an IPv6 representation. */
 /* XXX-IPv6 Should add version of sfip_compare that just tests equality */
-static inline SFIP_RET sfip_compare_unset(const sfip_t *ip1, const sfip_t *ip2) {
+static inline SFIP_RET sfip_compare_unset(const sfip_t* const ip1, const sfip_t* const ip2) {
     int f1,f2;
 
     ARG_CHECK2(ip1, ip2, SFIP_ARG_ERR);
@@ -292,17 +294,17 @@ static inline SFIP_RET sfip_compare_unset(const sfip_t *ip1, const sfip_t *ip2)
     return SFIP_FAILURE;
 }
 
-static inline int sfip_fast_lt4(const sfip_t *ip1, const sfip_t *ip2) {
+static inline int sfip_fast_lt4(const sfip_t* const ip1, const sfip_t* const ip2) {
     return *ip1->ip32 < *ip2->ip32;
 }
-static inline int sfip_fast_gt4(const sfip_t *ip1, const sfip_t *ip2) {
+static inline int sfip_fast_gt4(const sfip_t* const ip1, const sfip_t* const ip2) {
     return *ip1->ip32 > *ip2->ip32;
 }
-static inline int sfip_fast_eq4(const sfip_t *ip1, const sfip_t *ip2) {
+static inline int sfip_fast_eq4(const sfip_t* const ip1, const sfip_t* const ip2) {
     return *ip1->ip32 == *ip2->ip32;
 }
 
-static inline int sfip_fast_lt6(const sfip_t *ip1, const sfip_t *ip2) {
+static inline int sfip_fast_lt6(const sfip_t* const ip1, const sfip_t* const ip2) {
     const u_int32_t *p1, *p2;
 
     p1 = ip1->ip32;
@@ -323,7 +325,7 @@ static inline int sfip_fast_lt6(const sfip_t *ip1, const sfip_t *ip2) {
     return 0;
 }
 
-static inline int sfip_fast_gt6(const sfip_t *ip1, const sfip_t *ip2) {
+static inline int sfip_fast_gt6(const sfip_t* const ip1, const sfip_t* const ip2) {
     const u_int32_t *p1, *p2;
 
     p1 = ip1->ip32;
@@ -477,15 +479,15 @@ static inline int sfip_is_private(const sfip_t *ip)
 
 }
 
+#if 0
 #define sfip_equals(x,y) (sfip_compare(&x, &y) == SFIP_EQUAL)
 #define sfip_not_equals !sfip_equals
 #define sfip_clear(x) memset(x, 0, 16)
+#endif
 
 /* Printing ************************************************************/
 
 /* Uses a static buffer to return a string representation of the IP */
-char *sfip_to_str(const sfip_t *ip);
-#define sfip_ntoa(x) sfip_to_str(x)
 void sfip_raw_ntop(int family, const void *ip_raw, char *buf, int bufsize);
 void sfip_ntop(const sfip_t *ip, char *buf, int bufsize);
 
diff --git a/src/sfip/sf_iph.cc b/src/sfip/sf_iph.cc
deleted file mode 100644
index d9b7796fe..000000000
--- a/src/sfip/sf_iph.cc
+++ /dev/null
@@ -1,536 +0,0 @@
-/****************************************************************************
- *
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
- * Copyright (C) 2007-2013 Sourcefire, Inc.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License Version 2 as
- * published by the Free Software Foundation.  You may not use, modify or
- * distribute this program under any other version of the GNU General
- * Public License.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
- *
- ****************************************************************************/
-
-#include "sf_iph.h"
-
-#ifdef HAVE_CONFIG_H
-#include "config.h"
-#endif
-#include <string.h>
-#include "protocols/packet.h"
-
-#define FAILURE -1
-#define SUCCESS 0
-#define IP6_HDR_LEN 40
-
-/* Version is the first four bits of the uint32_t passed in */
-#define IP6_VER(x) \
-   (ntohl(x) >> 28)
-
-/* The 'Packet' structure is almost always allocated on the stack.
- * Likewise, return buffers will almost always be aswell.
- * So, for performance reasons, argument validation can be disabled
- * and removed from the code at compile time to prevent unecessary extra
- * conditionals from being checked at run-time. */
-#define ERR_CHK_LVL  0
-#if ERR_CHK_LVL == 2
-#define VALIDATE(x,y) if(!x || !y) return FAILURE;
-#elif ERR_CHK_LVL == 1
-#define VALIDATE(x,y) if(!y) return FAILURE;
-#else
-#define VALIDATE(x,y)
-#endif
-
-#if 0
-
-sfip_t *ip6_ret_src(const Packet *p)
-{
-    VALIDATE(p, 1);
-    return &p->ip6h->ip_src;
-}
-
-sfip_t *orig_ip6_ret_src(const Packet *p)
-{
-    VALIDATE(p, 1);
-
-    return nullptr;
-//  return &p->orig_ip6h->ip_src;
-}
-
-sfip_t *ip6_ret_dst(const Packet *p)
-{
-    VALIDATE(p, 1);
-
-    return &p->ip6h->ip_dst;
-}
-
-
-sfip_t *orig_ip6_ret_dst(const Packet *p)
-{
-    VALIDATE(p, 1);
-    return nullptr;
-//  return &p->orig_ip6h->ip_dst;
-}
-
-uint16_t ip6_ret_toc(const Packet *p)
-{
-    uint16_t toc;
-    VALIDATE(p,1);
-
-    toc = (uint16_t)((ntohl(p->ip6h->vcl) & 0x0FF00000) >> 20);
-
-    return 0;
-//  return toc;
-}
-
-uint16_t orig_ip6_ret_toc(const Packet *p)
-{
-    uint16_t toc;
-    VALIDATE(p,1);
-
-    return 0;
-//    toc = (uint16_t)((ntohl(p->orig_ip6h->vcl) & 0x0FF00000) >> 20);
-//  return toc;
-}
-
-uint8_t ip6_ret_hops(const Packet *p)
-{
-//    VALIDATE(p,1);
-
-    return p->ip6h->hop_lmt;
-}
-
-uint8_t orig_ip6_ret_hops(const Packet *p)
-{
-//    VALIDATE(p,1);
-
-    return 0;
-//  return p->orig_ip6h->hop_lmt;
-}
-
-uint16_t ip6_ret_len(const Packet *p)
-{
-    VALIDATE(p,1);
-
-    /* The length field does not include the header in IPv6, but does in IPv4.
-     * To make this analogous to IPv4, for Snort's purposes, we need to tack
-     * on the difference. */
-    return p->ip6h->len;
-}
-
-uint16_t orig_ip6_ret_len(const Packet *p)
-{
-    VALIDATE(p,1);
-
-    return 0;
-//  return p->orig_ip6h->len;
-}
-
-uint32_t ip6_ret_id(const Packet *p)
-{
-    IP6Frag *frag_hdr;
-    if (p->ip6_extension_count == 0)
-        return 0;
-
-    frag_hdr = (IP6Frag*)p->ip6_extensions[p->ip6_frag_index].data;
-
-    return frag_hdr->ip6f_ident;
-}
-
-uint32_t orig_ip6_ret_id(const Packet*)
-{
-// XXX-IPv6 "NOT YET IMPLEMENTED - IP6 identification"
-    return 0;
-}
-
-uint8_t ip6_ret_next(const Packet *p)
-{
-    VALIDATE(p,1);
-    return p->ip6h->next;
-}
-
-uint8_t orig_ip6_ret_next(const Packet *p)
-{
-    VALIDATE(p,1);
-    return 0;
-//  return p->orig_ip6h->next;
-}
-
-uint16_t ip6_ret_off(const Packet *p)
-{
-    IP6Frag *frag_hdr;
-    if (p->ip6_extension_count == 0)
-        return 0;
-
-    frag_hdr = (IP6Frag *)p->ip6_extensions[p->ip6_frag_index].data;
-
-    return frag_hdr->ip6f_offlg;
-}
-
-uint16_t orig_ip6_ret_off(const Packet*)
-{
-// XXX-IPv6 "NOT YET IMPLEMENTED - IP6 frag offset"
-    return 0;
-}
-
-uint8_t ip6_ret_ver(const Packet *p)
-{
-    return (uint8_t)IP6_VER(p->ip6h->vcl);
-}
-
-uint8_t orig_ip6_ret_ver(const Packet *p)
-{
-    return 0;
-//  return (uint8_t)IP6_VER(p->orig_ip6h->vcl);
-}
-
-sfip_t *ip4_ret_dst(const Packet *p)
-{
-    VALIDATE(p,1);
-    return &p->ip4h->ip_dst;
-}
-
-sfip_t *orig_ip4_ret_dst(const Packet *p)
-{
-    VALIDATE(p,1);
-    return nullptr;
-//  return &p->orig_ip4h->ip_dst;
-}
-
-sfip_t *ip4_ret_src(const Packet *p)
-{
-    VALIDATE(p,1);
-    return &p->ip4h->ip_src;
-}
-
-sfip_t *orig_ip4_ret_src(const Packet *p)
-{
-    VALIDATE(p,1);
-    return nullptr;
-//  return &p->orig_ip4h->ip_src;
-}
-
-uint16_t ip4_ret_tos(const Packet *p)
-{
-   VALIDATE(p,1);
-
-   return p->ip4h->ip_tos;
-}
-
-uint16_t orig_ip4_ret_tos(const Packet *p)
-{
-   VALIDATE(p,1);
-
-    return 0;
-//  return p->orig_ip4h->ip_tos;
-}
-
-uint8_t ip4_ret_ttl(const Packet *p)
-{
-    VALIDATE(p,1);
-
-    return p->ip4h->ip_ttl;
-}
-
-uint8_t orig_ip4_ret_ttl(const Packet *p)
-{
-    VALIDATE(p,1);
-
-    return 0;
-//  return p->orig_ip4h->ip_ttl;
-}
-
-uint16_t ip4_ret_len(const Packet *p)
-{
-    VALIDATE(p,1);
-
-    return p->ip4h->ip_len;
-}
-
-uint16_t orig_ip4_ret_len(const Packet *p)
-{
-    VALIDATE(p,1);
-
-    return 0;
-//  return p->orig_ip4h->ip_len;
-}
-
-uint32_t ip4_ret_id(const Packet *p)
-{
-    VALIDATE(p,1);
-
-    return (uint32_t)p->ip4h->ip_id;
-}
-
-uint32_t orig_ip4_ret_id(const Packet *p)
-{
-    VALIDATE(p,1);
-
-    return 0;
-//  return (uint32_t)p->orig_ip4h->ip_id;
-}
-
-uint8_t ip4_ret_proto(const Packet *p)
-{
-    // VALIDATION()
-
-    return p->ip4h->ip_proto;
-}
-
-uint8_t orig_ip4_ret_proto(const Packet *p)
-{
-    // VALIDATION()
-
-    return 0;
-//  return p->orig_ip4h->ip_proto;
-}
-
-uint16_t ip4_ret_off(const Packet *p)
-{
-    return p->ip4h->ip_off;
-}
-
-uint16_t orig_ip4_ret_off(const Packet *p)
-{
-    return 0;
-//  return p->orig_ip4h->ip_off;
-}
-
-uint8_t ip4_ret_ver(const Packet *p)
-{
-    return (p->iph->ip_verhl & 0xf0) >> 4;
-}
-
-#if 0
-uint8_t orig_ip4_ret_ver(const Packet *p)
-{
-    return (p->orig_iph->ip_verhl & 0xf0) >> 4;
-}
-#endif
-
-uint8_t ip4_ret_hlen(const Packet *p)
-{
-    return p->iph->ip_verhl & 0x0f;
-}
-
-uint8_t orig_ip4_ret_hlen(const Packet *p)
-{
-    return 0;
-//    return p->orig_iph->ip_verhl & 0x0f;
-}
-
-uint8_t ip6_ret_hlen(const Packet*)
-{
-    /* Snort is expecting this number to be in terms of 32 bit words */
-    return IP6_HDR_LEN / 4 ;
-}
-
-uint8_t orig_ip6_ret_hlen(const Packet*)
-{
-    return IP6_HDR_LEN / 4;
-}
-
-#endif
-
-IPH_API ip4 =
-{
-#if 0
-   ip4_ret_src,
-   ip4_ret_dst,
-   ip4_ret_tos,
-   ip4_ret_ttl,
-   ip4_ret_len,
-   ip4_ret_id,
-   ip4_ret_proto,
-   ip4_ret_off,
-   ip4_ret_ver,
-   ip4_ret_hlen,
-   orig_ip4_ret_src,
-   orig_ip4_ret_dst,
-   orig_ip4_ret_tos,
-   orig_ip4_ret_ttl,
-   orig_ip4_ret_len,
-   orig_ip4_ret_id,
-   orig_ip4_ret_proto,
-   orig_ip4_ret_off,
-   orig_ip4_ret_ver,
-   orig_ip4_ret_hlen,
-#endif
-   IPH_API_V4
-};
-
-IPH_API ip6 =
-{
-#if 0
-   ip6_ret_src,
-   ip6_ret_dst,
-   ip6_ret_toc,
-   ip6_ret_hops,
-   ip6_ret_len,
-   ip6_ret_id,
-   ip6_ret_next,
-   ip6_ret_off,
-   ip6_ret_ver,
-   ip6_ret_hlen,
-   orig_ip6_ret_src,
-   orig_ip6_ret_dst,
-   orig_ip6_ret_toc,
-   orig_ip6_ret_hops,
-   orig_ip6_ret_len,
-   orig_ip6_ret_id,
-   orig_ip6_ret_next,
-   orig_ip6_ret_off,
-   orig_ip6_ret_ver,
-   orig_ip6_ret_hlen,
-#endif
-   IPH_API_V6
-};
-
-static inline void _set_callbacks(Packet* p, int family, char orig)
-{
-    if ( !orig )
-    {
-        if(family == AF_INET)
-            p->iph_api = &ip4;
-        else
-            p->iph_api = &ip6;
-
-        p->family = family;
-    }
-}
-
-void set_callbacks(Packet* p, int family, char orig)
-{
-    _set_callbacks(p, family, orig);
-}
-
-void sfiph_build(Packet *p, const void *hdr, int family)
-{
-    ipv6::IP6RawHdr *hdr6;
-    IPHdr *hdr4;
-
-    if(!p || !hdr)
-        return;
-
-    /* If family is already set, we've been here before.
-     * That means this is a nested IP.  */
-#if 0
-    if (p->family != NO_IP)
-    {
-        if (p->iph_api->ver == IPH_API_V4)
-            memcpy(&p->outer_ip4h, &p->inner_ip4h, sizeof(IP4Hdr));
-        else if (p->iph_api->ver == IPH_API_V6)
-            memcpy(&p->outer_ip6h, &p->inner_ip6h, sizeof(IP6Hdr));
-
-    }
-#endif
-    _set_callbacks(p, family, CALLBACK_IP);
-
-#if 0
-
-    if(family == AF_INET)
-    {
-        hdr4 = (IPHdr*)hdr;
-
-        /* The struct Snort uses is identical to the actual IP6 struct,
-         * with the exception of the IP addresses. Copy over everything but
-         * the IPs */
-        memcpy(&p->inner_ip4h, hdr4, sizeof(IPHdr) - 8);
-        sfip_set_raw(&p->inner_ip4h.ip_src, &hdr4->ip_src, family);
-        sfip_set_raw(&p->inner_ip4h.ip_dst, &hdr4->ip_dst, family);
-//        p->actual_ip_len = ntohs(p->inner_ip4h.ip_len);
-        p->ip4h = &p->inner_ip4h;
-    }
-    else
-    {
-        hdr6 = (ipv6::IP6RawHdr*)hdr;
-
-        /* The struct Snort uses is identical to the actual IP6 struct,
-         * with the exception of the IP addresses. Copy over everything but
-         * the IPs*/
-        memcpy(&p->inner_ip6h, hdr6, sizeof(ipv6::IP6RawHdr) - 32);
-        sfip_set_raw(&p->inner_ip6h.ip_src, &hdr6->ip6_src, family);
-        sfip_set_raw(&p->inner_ip6h.ip_dst, &hdr6->ip6_dst, family);
-//        p->actual_ip_len = ntohs(p->inner_ip6h.len) + IP6_HDR_LEN;
-        p->ip6h = &p->inner_ip6h;
-    }
-#endif
-}
-
-void sfiph_orig_build(Packet *p, const void *hdr, int family)
-{
-#if 0
-    ipv6::IP6RawHdr *hdr6;
-    IPHdr *hdr4;
-
-    if(!p || !hdr)
-        return;
-
-    /* If iph_api is already set, we've been here before.
-     * That means this is a nested IP.  */
-    if (p->orig_iph_api && (p->orig_iph_api->ver == IPH_API_V4))
-        memcpy(&p->outer_orig_ip4h, &p->inner_orig_ip4h, sizeof(IP4Hdr));
-
-    else if (p->orig_iph_api && (p->orig_iph_api->ver == IPH_API_V6))
-        memcpy(&p->outer_orig_ip6h, &p->inner_orig_ip6h, sizeof(IP6Hdr));
-
-
-    _set_callbacks(p, family, CALLBACK_ICMP_ORIG);
-
-    if(family == AF_INET)
-    {
-        hdr4 = (IPHdr*)hdr;
-
-        /* The struct Snort uses is identical to the actual IP6 struct,
-         * with the exception of the IP addresses. Copy over everything but
-         * the IPs */
-        memcpy(&p->inner_orig_ip4h, hdr4, sizeof(IPHdr) - 8);
-        sfip_set_raw(&p->inner_orig_ip4h.ip_src, &hdr4->ip_src, family);
-        sfip_set_raw(&p->inner_orig_ip4h.ip_dst, &hdr4->ip_dst, family);
-        p->actual_ip_len = ntohs(p->inner_orig_ip4h.ip_len);
-        p->orig_ip4h = &p->inner_orig_ip4h;
-    }
-    else
-    {
-        hdr6 = (ipv6::IP6RawHdr*)hdr;
-
-        /* The struct Snort uses is identical to the actual IP6 struct,
-         * with the exception of the IP addresses. Copy over everything but
-         * the IPs*/
-        memcpy(&p->inner_orig_ip6h, hdr6, sizeof(ipv6::IP6RawHdr) - 32);
-        sfip_set_raw(&p->inner_orig_ip6h.ip_src, &hdr6->ip6_src, family);
-        sfip_set_raw(&p->inner_orig_ip6h.ip_dst, &hdr6->ip6_dst, family);
-        p->actual_ip_len = ntohs(p->inner_orig_ip6h.len) + IP6_HDR_LEN;
-        p->orig_ip6h = &p->inner_orig_ip6h;
-    }
-  #endif
-}
-
-#ifdef TESTER
-int main()
-{
-    Packet p;
-    IP4Hdr i4;
-    IP6Hdr i6;
-
-    /* This test assumes we get an IPv4 packet and verifies
-     * that the correct callbacks are setup, and they return
-     * the correct values. */
-
-    _set_callbacks(&p, AF_INET, CALLBACK_IP);
-
-    /* Same test as above, but with IPv6 */
-    _set_callbacks(&p, AF_INET6, CALLBACK_IP);
-
-    return 0;
-}
-#endif
diff --git a/src/sfip/sf_iph.h b/src/sfip/sf_iph.h
deleted file mode 100644
index 6bbdb1a30..000000000
--- a/src/sfip/sf_iph.h
+++ /dev/null
@@ -1,75 +0,0 @@
-/*  
-** Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
-** Copyright (C) 2007-2013 Sourcefire, Inc.
-**
-** This program is free software; you can redistribute it and/or modify
-** it under the terms of the GNU General Public License Version 2 as
-** published by the Free Software Foundation.  You may not use, modify or
-** distribute this program under any other version of the GNU General
-** Public License.
-**
-** This program is distributed in the hope that it will be useful,
-** but WITHOUT ANY WARRANTY; without even the implied warranty of
-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-** GNU General Public License for more details.
-**
-** You should have received a copy of the GNU General Public License
-** along with this program; if nto, write to the Free Software
-** Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301,
-** USA
-*/
-
-#ifndef SF_IPH_H
-#define SF_IPH_H
-
-#include "sfip_t.h"
-
-struct Packet;
-
-typedef struct _IPH_API
-{
-#if 0
-    sfip_t *   (*iph_ret_src)(const Packet*);
-    sfip_t *   (*iph_ret_dst)(const Packet*);
-    uint16_t   (*iph_ret_tos)(const Packet*);
-    uint8_t    (*iph_ret_ttl)(const Packet*);
-    uint16_t   (*iph_ret_len)(const Packet*);
-    uint32_t   (*iph_ret_id)(const Packet*);
-    uint8_t    (*iph_ret_proto)(const Packet*);
-    uint16_t   (*iph_ret_off)(const Packet*);
-    uint8_t    (*iph_ret_ver)(const Packet*);
-    uint8_t    (*iph_ret_hlen)(const Packet*);
-
-    sfip_t *   (*orig_iph_ret_src)(const Packet*);
-    sfip_t *   (*orig_iph_ret_dst)(const Packet*);
-    uint16_t   (*orig_iph_ret_tos)(const Packet*);
-    uint8_t    (*orig_iph_ret_ttl)(const Packet*);
-    uint16_t   (*orig_iph_ret_len)(const Packet*);
-    uint32_t   (*orig_iph_ret_id)(const Packet*);
-    uint8_t    (*orig_iph_ret_proto)(const Packet*);
-    uint16_t   (*orig_iph_ret_off)(const Packet*);
-    uint8_t    (*orig_iph_ret_ver)(const Packet*);
-    uint8_t    (*orig_iph_ret_hlen)(const Packet*);
-#endif
-    char ver;
-} IPH_API;
-
-extern IPH_API ip4;
-extern IPH_API ip6;
-
-#define IPH_API_V4 4
-#define IPH_API_V6 6
-
-#define iph_is_valid(p) ((p)->family != NO_IP)
-#define NO_IP 0
-
-void sfiph_build(Packet*, const void *hdr, int family);
-
-/* Sets the callbacks to point at the family selected by
- *  * "family".  "family" is either AF_INET or AF_INET6 */
-#define CALLBACK_IP 0
-#define CALLBACK_ICMP_ORIG 1
-
-void set_callbacks(Packet*, int family, char orig);
-
-#endif
diff --git a/src/sfip/sfip_t.h b/src/sfip/sfip_t.h
index f5fc2babf..e3c8d5c0c 100644
--- a/src/sfip/sfip_t.h
+++ b/src/sfip/sfip_t.h
@@ -28,10 +28,12 @@
  * 11/17/06
 */
 
-#ifndef SFIP_T_H
-#define SFIP_T_H
+#ifndef SFIP_SFIP_T_H
+#define SFIP_SFIP_T_H
 
+#include <cstddef>
 #include <stdint.h>
+#include <arpa/inet.h>
 
 #ifndef WIN32
 #include <netinet/in.h>
@@ -39,6 +41,7 @@
 #include <winsock2.h>
 #endif
 
+
 /* factored out for attribute table */
 
 struct sfip_t {
@@ -49,15 +52,11 @@ struct sfip_t {
      * must be the last field in this struct */
     union
     {
-        uint8_t  u6_addr8[16];
-        uint16_t u6_addr16[8];
-        uint32_t u6_addr32[4];
-/*      uint64_t    u6_addr64[2]; */
-    } ip;
-    #define ip8  ip.u6_addr8
-    #define ip16 ip.u6_addr16
-    #define ip32 ip.u6_addr32
-/*    #define ip64 ip.u6_addr64 */
+        uint8_t  ip8[16];
+        uint16_t ip16[8];
+        uint32_t ip32[4];
+/*      uint64_t    ip64[2]; */
+    };
 
     inline bool is_ip6() const
     { return family == AF_INET6; }
@@ -65,23 +64,80 @@ struct sfip_t {
     inline bool is_ip4() const
     { return family == AF_INET; }
 
+    // the '+ 4' is the int32_t IPv4 address
+    inline std::size_t sfip_size() const
+    { return is_ip6() ? sizeof(sfip_t) : offsetof(sfip_t, ip8) + 4; }
 
 };
 
-inline bool operator==(const sfip_t& lhs, const sfip_t& rhs)
+
+// because we can --- and this is leftover from Snort which we're stuck with
+#ifdef inet_ntoa
+#undef inet_ntoa
+#endif
+
+char *sfip_to_str(const sfip_t *ip);
+#define sfip_ntoa(x) sfip_to_str(x)
+#define inet_ntoa sfip_ntoa
+
+
+/*
+ * Implementing these functions rather than opeators since
+ * the Google style guide recomends staying away from
+ * operators.  Most of these are a copy and paste from sf_ip.h
+ */
+static inline int sfip_is_set(const sfip_t& ip);
+static inline int sfip_is_set(const sfip_t* const ip);
+static inline bool sfip_equals(const sfip_t& lhs, const sfip_t& rhs);
+static inline bool sfip_unset_equals(const sfip_t& lhs, const sfip_t& rhs);
+static inline bool sfip_not_equals(const sfip_t& lhs, const sfip_t& rhs);
+static inline bool sfip_lesser(const sfip_t* const lhs, const sfip_t* const rhs);
+static inline bool sfip_greater(const sfip_t* const lhs, const sfip_t* const rhs);
+static inline void sfip_clear(sfip_t& x);
+static inline void sfip_copy(sfip_t& lhs, const sfip_t* const rhs);
+
+
+
+/* Returns 1 if the IP is non-zero. 0 otherwise *
+ * XXX This is a performance critical function,
+ *  need to determine if it's safe to not check these pointers
+ *
+ * SNORT RELIC
+ */
+static inline int sfip_is_set(const sfip_t* const ip) {
+//    ARG_CHECK1(ip, -1);
+    return ip->ip32[0] ||
+            ( (ip->family == AF_INET6) &&
+              (ip->ip32[1] ||
+              ip->ip32[2] ||
+              ip->ip32[3] || ip->bits != 128)) || ((ip->family == AF_INET) && ip->bits != 32)  ;
+}
+
+static inline int sfip_is_set(const sfip_t& ip) {
+//    ARG_CHECK1(ip, -1);
+    return ip.ip32[0] ||
+            ( (ip.family == AF_INET6) &&
+              (ip.ip32[1] ||
+              ip.ip32[2] ||
+              ip.ip32[3] || ip.bits != 128)) || ((ip.family == AF_INET) && ip.bits != 32)  ;
+}
+
+
+
+static inline bool _is_sfip_equals(const sfip_t* const lhs, const sfip_t* const rhs)
 {
-    if (lhs.is_ip4())
+    if (lhs->is_ip4())
     {
-        return  (rhs.is_ip4()) &&
-                (lhs.ip.u6_addr32[0] == rhs.ip.u6_addr32[0]);
+        return  (rhs->is_ip4()) &&
+                (lhs->ip32[0] == rhs->ip32[0]);
     }
-    else if (lhs.is_ip6())
+    else if (lhs->is_ip6())
     {
-        return  (rhs.is_ip6()) &&
-                (lhs.ip.u6_addr32[0] == rhs.ip.u6_addr32[0]) &&
-                (lhs.ip.u6_addr32[1] == rhs.ip.u6_addr32[1]) &&
-                (lhs.ip.u6_addr32[2] == rhs.ip.u6_addr32[2]) &&
-                (lhs.ip.u6_addr32[3] == rhs.ip.u6_addr32[3]);
+        return  (rhs->is_ip6()) &&
+                (lhs->ip32[0] == rhs->ip32[0]) &&
+                (lhs->ip32[1] == rhs->ip32[1]) &&
+                (lhs->ip32[2] == rhs->ip32[2]) &&
+                (lhs->ip32[3] == rhs->ip32[3]);
     }
     else
     {
@@ -89,9 +145,88 @@ inline bool operator==(const sfip_t& lhs, const sfip_t& rhs)
     }
 }
 
-inline bool operator!=(const sfip_t& lhs, const sfip_t& rhs)
-{ return !(lhs == rhs); }
 
+static inline bool _is_sfip_lesser(const sfip_t* const lhs, const sfip_t* const rhs)
+{
+    if (lhs->is_ip4())
+    {
+        return (rhs->is_ip4() &&
+               (htonl(lhs->ip32[0]) < htonl(rhs->ip32[0])));
+    }
+    else if (lhs->is_ip6())
+    {
+        return (rhs->is_ip6() &&
+               (htonl(lhs->ip32[0]) < htonl(rhs->ip32[0])) &&
+               (htonl(lhs->ip32[1]) < htonl(rhs->ip32[1])) &&
+               (htonl(lhs->ip32[2]) < htonl(rhs->ip32[2])) &&
+               (htonl(lhs->ip32[3]) < htonl(rhs->ip32[3])));
+    }
+    else
+    {
+        return false;
+    }
+}
+
+
+static inline bool sfip_equals(const sfip_t* const lhs, const sfip_t* const rhs)
+{
+    if(!sfip_is_set(lhs) || !sfip_is_set(rhs))
+        return true;
+
+    return _is_sfip_equals(lhs, rhs);
+}
+
+
+static inline bool sfip_not_equals(const sfip_t* const lhs, const sfip_t* const rhs)
+{ return !sfip_equals(lhs,rhs); }
+
+
+static inline bool sfip_unset_equals(const sfip_t* const lhs, const sfip_t* const rhs)
+{
+    if(!sfip_is_set(lhs) || !sfip_is_set(rhs))
+        return false;
+
+    return _is_sfip_equals(lhs, rhs);
+}
+
+
+static inline bool sfip_lesser(const sfip_t* const lhs, const sfip_t* const rhs)
+{
+    // I'm copying and pasting.  Don't ask me why this is different then sfip_equals
+    if(!sfip_is_set(lhs) || !sfip_is_set(rhs))
+        return false;
+
+    return _is_sfip_lesser(lhs, rhs);
+}
+
+
+static inline bool sfip_greater(const sfip_t* const lhs, const sfip_t* const rhs)
+{
+    // I'm copying and pasting.  Don't ask me why this is different then sfip_equals
+    if(!sfip_is_set(lhs) || !sfip_is_set(rhs))
+        return false;
+
+    return _is_sfip_lesser(rhs, lhs);
+}
+
+
+static inline void sfip_clear(sfip_t& x)
+{
+    x.family = 0;
+    x.bits = 0;
+    x.ip32[0] = 0;
+    x.ip32[1] = 0;
+    x.ip32[2] = 0;
+    x.ip32[3] = 0;
+}
+
+/*
+ * This is the former macro IP_COPY_VALUE(x, y).  No need to assign
+ * specific operator since the default equals operator will
+ * correctly assign values
+ */
+static inline void sfip_copy(sfip_t& lhs, const sfip_t* const rhs)
+{ lhs = *rhs; }
 
 #endif
 
diff --git a/src/stream/icmp/icmp_session.cc b/src/stream/icmp/icmp_session.cc
index 0660a1e4f..e8ebf43b9 100644
--- a/src/stream/icmp/icmp_session.cc
+++ b/src/stream/icmp/icmp_session.cc
@@ -122,7 +122,7 @@ static int ProcessIcmpUnreach(Packet *p)
         COPY4(skey.ip_h, dst->ip32);
         skey.port_h = dport;
     }
-    else if (IP_EQUALITY(iph.get_src(), iph.get_dst()))
+    else if (sfip_equals(iph.get_src(), iph.get_dst()))
     {
         COPY4(skey.ip_l, src->ip32);
         COPY4(skey.ip_h, skey.ip_l);
@@ -225,7 +225,7 @@ int IcmpSession::process(Packet* p)
 
 void IcmpSession::update_direction(char dir, const sfip_t *ip, uint16_t)
 {
-    if (IP_EQUALITY(&icmp_sender_ip, ip))
+    if (sfip_equals(&icmp_sender_ip, ip))
     {
         if ((dir == SSN_DIR_SENDER) && (flow->s5_state.direction == SSN_DIR_SENDER))
         {
@@ -233,7 +233,7 @@ void IcmpSession::update_direction(char dir, const sfip_t *ip, uint16_t)
             return;
         }
     }
-    else if (IP_EQUALITY(&icmp_responder_ip, ip))
+    else if (sfip_equals(&icmp_responder_ip, ip))
     {
         if ((dir == SSN_DIR_RESPONDER) && (flow->s5_state.direction == SSN_DIR_RESPONDER))
         {
diff --git a/src/stream/ip/ip_session.cc b/src/stream/ip/ip_session.cc
index f756ccad8..006a51882 100644
--- a/src/stream/ip/ip_session.cc
+++ b/src/stream/ip/ip_session.cc
@@ -130,8 +130,8 @@ bool IpSession::setup (Packet* p)
 
     ipStats.sessions++;
 
-    IP_COPY_VALUE(flow->client_ip, p->ip_api.get_src());
-    IP_COPY_VALUE(flow->server_ip, p->ip_api.get_dst());
+    sfip_copy(flow->client_ip, p->ip_api.get_src());
+    sfip_copy(flow->server_ip, p->ip_api.get_dst());
 
 #ifdef ENABLE_EXPECTED_IP
     if ( flow_con->expected_session(flow, p))
diff --git a/src/stream/stream_api.cc b/src/stream/stream_api.cc
index 612d58ac0..db1f22bf0 100644
--- a/src/stream/stream_api.cc
+++ b/src/stream/stream_api.cc
@@ -456,7 +456,7 @@ int16_t Stream::get_application_protocol_id(Flow* flow)
         set_ip_protocol(flow);
     }
 
-    host_entry = SFAT_LookupHostEntryByIP(IP_ARG(flow->server_ip));
+    host_entry = SFAT_LookupHostEntryByIP(&flow->server_ip);
     if (host_entry)
     {
         set_application_protocol_id_from_host_entry(flow, host_entry, SSN_DIR_SERVER);
@@ -467,7 +467,7 @@ int16_t Stream::get_application_protocol_id(Flow* flow)
         }
     }
 
-    host_entry = SFAT_LookupHostEntryByIP(IP_ARG(flow->client_ip));
+    host_entry = SFAT_LookupHostEntryByIP(&flow->client_ip);
 
     if (host_entry)
     {
@@ -501,7 +501,7 @@ int16_t Stream::set_application_protocol_id(Flow* flow, int16_t id)
         set_ip_protocol(flow);
 
     SFAT_UpdateApplicationProtocol(
-        IP_ARG(flow->server_ip), ntohs(flow->server_port),
+        &flow->server_ip, ntohs(flow->server_port),
         flow->s5_state.ipprotocol, id);
 
     return id;
diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc
index 6efd79b1e..1e393144f 100644
--- a/src/stream/tcp/tcp_session.cc
+++ b/src/stream/tcp/tcp_session.cc
@@ -78,7 +78,6 @@
 #include "flow/session.h"
 #include "profiler.h"
 #include "ipv6_port.h"
-#include "sf_iph.h"
 #include "fpdetect.h"
 #include "detection_util.h"
 #include "file_api/file_api.h"
@@ -553,7 +552,7 @@ void Stream5UpdatePerfBaseState(SFBASE *sf_base,
             sf_base->iSessionsEstablished++;
 
             if (perfmon_config && (perfmon_config->perf_flags & SFPERF_FLOWIP))
-                UpdateFlowIPState(&sfFlow, IP_ARG(lwssn->client_ip), IP_ARG(lwssn->server_ip), SFS_STATE_TCP_ESTABLISHED);
+                UpdateFlowIPState(&sfFlow, &lwssn->client_ip, &lwssn->server_ip, SFS_STATE_TCP_ESTABLISHED);
 
             lwssn->s5_state.session_flags |= SSNFLAG_COUNTED_ESTABLISH;
 
@@ -576,7 +575,7 @@ void Stream5UpdatePerfBaseState(SFBASE *sf_base,
                 sf_base->iSessionsEstablished--;
 
                 if (perfmon_config && (perfmon_config->perf_flags & SFPERF_FLOWIP))
-                    UpdateFlowIPState(&sfFlow, IP_ARG(lwssn->client_ip), IP_ARG(lwssn->server_ip), SFS_STATE_TCP_CLOSED);
+                    UpdateFlowIPState(&sfFlow, &lwssn->client_ip, &lwssn->server_ip, SFS_STATE_TCP_CLOSED);
             }
             else if (lwssn->s5_state.session_flags & SSNFLAG_COUNTED_INITIALIZE)
             {
@@ -597,7 +596,7 @@ void Stream5UpdatePerfBaseState(SFBASE *sf_base,
             sf_base->iSessionsEstablished--;
 
             if (perfmon_config && (perfmon_config->perf_flags & SFPERF_FLOWIP))
-                UpdateFlowIPState(&sfFlow, IP_ARG(lwssn->client_ip), IP_ARG(lwssn->server_ip), SFS_STATE_TCP_CLOSED);
+                UpdateFlowIPState(&sfFlow, &lwssn->client_ip, &lwssn->server_ip, SFS_STATE_TCP_CLOSED);
         }
         else if (lwssn->s5_state.session_flags & SSNFLAG_COUNTED_INITIALIZE)
         {
@@ -4727,9 +4726,9 @@ static int ProcessTcp(
                     "session direction.\n"););
             /* SYN packet from client */
             lwssn->s5_state.direction = FROM_CLIENT;
-            IP_COPY_VALUE(lwssn->client_ip, p->ip_api.get_src());
+            sfip_copy(lwssn->client_ip, p->ip_api.get_src());
             lwssn->client_port = p->tcph->th_sport;
-            IP_COPY_VALUE(lwssn->server_ip, p->ip_api.get_dst());
+            sfip_copy(lwssn->server_ip, p->ip_api.get_dst());
             lwssn->server_port = p->tcph->th_dport;
             lwssn->session_state |= STREAM5_STATE_SYN;
 
@@ -4762,9 +4761,9 @@ static int ProcessTcp(
                         "Stream5 SYN|ACK PACKET, establishing lightweight"
                         "session direction.\n"););
                 lwssn->s5_state.direction = FROM_SERVER;
-                IP_COPY_VALUE(lwssn->client_ip, p->ip_api.get_dst());
+                sfip_copy(lwssn->client_ip, p->ip_api.get_dst());
                 lwssn->client_port = p->tcph->th_dport;
-                IP_COPY_VALUE(lwssn->server_ip, p->ip_api.get_src());
+                sfip_copy(lwssn->server_ip, p->ip_api.get_src());
                 lwssn->server_port = p->tcph->th_sport;
             }
             lwssn->session_state |= STREAM5_STATE_SYN_ACK;
@@ -4797,17 +4796,17 @@ static int ProcessTcp(
             if (p->sp > p->dp)
             {
                 lwssn->s5_state.direction = FROM_CLIENT;
-                IP_COPY_VALUE(lwssn->client_ip, p->ip_api.get_src());
+                sfip_copy(lwssn->client_ip, p->ip_api.get_src());
                 lwssn->client_port = p->tcph->th_sport;
-                IP_COPY_VALUE(lwssn->server_ip, p->ip_api.get_dst());
+                sfip_copy(lwssn->server_ip, p->ip_api.get_dst());
                 lwssn->server_port = p->tcph->th_dport;
             }
             else
             {
                 lwssn->s5_state.direction = FROM_SERVER;
-                IP_COPY_VALUE(lwssn->client_ip, p->ip_api.get_dst());
+                sfip_copy(lwssn->client_ip, p->ip_api.get_dst());
                 lwssn->client_port = p->tcph->th_dport;
-                IP_COPY_VALUE(lwssn->server_ip, p->ip_api.get_src());
+                sfip_copy(lwssn->server_ip, p->ip_api.get_src());
                 lwssn->server_port = p->tcph->th_sport;
             }
             lwssn->session_state |= STREAM5_STATE_MIDSTREAM;
@@ -4962,9 +4961,9 @@ static int ProcessTcp(
                      !TCP_ISFLAGSET(p->tcph, TH_ACK))
             {
                 lwssn->s5_state.direction = FROM_CLIENT;
-                IP_COPY_VALUE(lwssn->client_ip, p->ip_api.get_src());
+                sfip_copy(lwssn->client_ip, p->ip_api.get_src());
                 lwssn->client_port = p->tcph->th_sport;
-                IP_COPY_VALUE(lwssn->server_ip, p->ip_api.get_dst());
+                sfip_copy(lwssn->server_ip, p->ip_api.get_dst());
                 lwssn->server_port = p->tcph->th_dport;
                 lwssn->session_state = STREAM5_STATE_SYN;
                 lwssn->set_ttl(p, true);
@@ -4981,9 +4980,9 @@ static int ProcessTcp(
             else if (TCP_ISFLAGSET(p->tcph, (TH_SYN|TH_ACK)))
             {
                 lwssn->s5_state.direction = FROM_SERVER;
-                IP_COPY_VALUE(lwssn->client_ip, p->ip_api.get_dst());
+                sfip_copy(lwssn->client_ip, p->ip_api.get_dst());
                 lwssn->client_port = p->tcph->th_dport;
-                IP_COPY_VALUE(lwssn->server_ip, p->ip_api.get_src());
+                sfip_copy(lwssn->server_ip, p->ip_api.get_src());
                 lwssn->server_port = p->tcph->th_sport;
                 lwssn->session_state = STREAM5_STATE_SYN_ACK;
                 lwssn->set_ttl(p, false);
@@ -6203,7 +6202,7 @@ int GetTcpRebuiltPackets(Packet *p, Flow *ssn,
 
     /* StreamTracker is the opposite of the ip of the reassembled
      * packet --> it came out the queue for the other side */
-    if (IP_EQUALITY(p->ip_api.get_src(), &tcpssn->tcp_client_ip))
+    if (sfip_equals(p->ip_api.get_src(), &tcpssn->tcp_client_ip))
     {
         st = &tcpssn->server;
     }
@@ -6251,7 +6250,7 @@ int GetTcpStreamSegments(Packet *p, Flow *ssn,
 
     /* StreamTracker is the opposite of the ip of the reassembled
      * packet --> it came out the queue for the other side */
-    if (IP_EQUALITY(p->ip_api.get_src(), &tcpssn->tcp_client_ip))
+    if (sfip_equals(p->ip_api.get_src(), &tcpssn->tcp_client_ip))
         st = &tcpssn->server;
     else
         st = &tcpssn->client;
@@ -6290,7 +6289,7 @@ int Stream5AddSessionAlertTcp(
     Stream5AlertInfo* ai;
     TcpSession *tcpssn = (TcpSession*)lwssn->session;
 
-    if (IP_EQUALITY(p->ip_api.get_src(),&tcpssn->tcp_client_ip))
+    if (sfip_equals(p->ip_api.get_src(),&tcpssn->tcp_client_ip))
     {
         st = &tcpssn->server;
     }
@@ -6328,7 +6327,7 @@ int Stream5CheckSessionAlertTcp(Flow *lwssn, Packet *p, uint32_t gid, uint32_t s
         return 0;
     }
 
-    if (IP_EQUALITY(p->ip_api.get_src(), &tcpssn->tcp_client_ip))
+    if (sfip_equals(p->ip_api.get_src(), &tcpssn->tcp_client_ip))
     {
         st = &tcpssn->server;
     }
@@ -6362,7 +6361,7 @@ int Stream5UpdateSessionAlertTcp (
     uint32_t seq_num;
     TcpSession *tcpssn = (TcpSession*)lwssn->session;
 
-    if (IP_EQUALITY(p->ip_api.get_src(), &tcpssn->tcp_client_ip))
+    if (sfip_equals(p->ip_api.get_src(), &tcpssn->tcp_client_ip))
     {
         st = &tcpssn->server;
     }
@@ -6397,7 +6396,7 @@ void Stream5SetExtraDataTcp (Flow* lwssn, Packet* p, uint32_t xid)
     StreamTracker *st;
     TcpSession *tcpssn = (TcpSession*)lwssn->session;
 
-    if (IP_EQUALITY(p->ip_api.get_src(),&tcpssn->tcp_client_ip))
+    if (sfip_equals(p->ip_api.get_src(),&tcpssn->tcp_client_ip))
         st = &tcpssn->server;
     else
         st = &tcpssn->client;
@@ -6410,7 +6409,7 @@ void Stream5ClearExtraDataTcp (Flow* lwssn, Packet* p, uint32_t xid)
     StreamTracker *st;
     TcpSession *tcpssn = (TcpSession*)lwssn->session;
 
-    if (IP_EQUALITY(p->ip_api.get_src(),&tcpssn->tcp_client_ip))
+    if (sfip_equals(p->ip_api.get_src(),&tcpssn->tcp_client_ip))
         st = &tcpssn->server;
     else
         st = &tcpssn->client;
@@ -6643,7 +6642,7 @@ void TcpSession::update_direction(
     uint16_t tmpPort;
     StreamTracker tmpTracker;
 
-    if (IP_EQUALITY(&tcp_client_ip, ip) && (tcp_client_port == port))
+    if (sfip_equals(&tcp_client_ip, ip) && (tcp_client_port == port))
     {
         if ((dir == SSN_DIR_CLIENT) && (flow->s5_state.direction == SSN_DIR_CLIENT))
         {
@@ -6651,7 +6650,7 @@ void TcpSession::update_direction(
             return;
         }
     }
-    else if (IP_EQUALITY(&tcp_server_ip, ip) && (tcp_server_port == port))
+    else if (sfip_equals(&tcp_server_ip, ip) && (tcp_server_port == port))
     {
         if ((dir == SSN_DIR_SERVER) && (flow->s5_state.direction == SSN_DIR_SERVER))
         {
diff --git a/src/stream/udp/udp_session.cc b/src/stream/udp/udp_session.cc
index 9ac727872..866ca5981 100644
--- a/src/stream/udp/udp_session.cc
+++ b/src/stream/udp/udp_session.cc
@@ -152,13 +152,13 @@ bool UdpSession::setup(Packet* p)
     AddUDPSession(&sfBase);
 
     if (perfmon_config && (perfmon_config->perf_flags & SFPERF_FLOWIP))
-        UpdateFlowIPState(&sfFlow, IP_ARG(flow->client_ip),
-            IP_ARG(flow->server_ip), SFS_STATE_UDP_CREATED);
+        UpdateFlowIPState(&sfFlow, &flow->client_ip,
+            &flow->server_ip, SFS_STATE_UDP_CREATED);
 
     flow->s5_state.direction = FROM_SENDER;
-    IP_COPY_VALUE(flow->client_ip, p->ip_api.get_src());
+    sfip_copy(flow->client_ip, p->ip_api.get_src());
     flow->client_port = p->udph->uh_sport;
-    IP_COPY_VALUE(flow->server_ip, p->ip_api.get_dst());
+    sfip_copy(flow->server_ip, p->ip_api.get_dst());
     flow->server_port = p->udph->uh_dport;
 
     if ( flow_con->expected_flow(flow, p) )
@@ -179,7 +179,7 @@ void UdpSession::update_direction(
     sfip_t tmpIp;
     uint16_t tmpPort;
 
-    if (IP_EQUALITY(&udp_sender_ip, ip) && (udp_sender_port == port))
+    if (sfip_equals(&udp_sender_ip, ip) && (udp_sender_port == port))
     {
         if ((dir == SSN_DIR_SENDER) && (flow->s5_state.direction == SSN_DIR_SENDER))
         {
@@ -187,7 +187,7 @@ void UdpSession::update_direction(
             return;
         }
     }
-    else if (IP_EQUALITY(&udp_responder_ip, ip) && (udp_responder_port == port))
+    else if (sfip_equals(&udp_responder_ip, ip) && (udp_responder_port == port))
     {
         if ((dir == SSN_DIR_RESPONDER) && (flow->s5_state.direction == SSN_DIR_RESPONDER))
         {
diff --git a/src/target_based/sftarget_reader.cc b/src/target_based/sftarget_reader.cc
index 6aa1b3b8f..e3e28c162 100644
--- a/src/target_based/sftarget_reader.cc
+++ b/src/target_based/sftarget_reader.cc
@@ -376,7 +376,7 @@ HostAttributeEntry *SFAT_LookupHostEntryByIP(const sfip_t *ipAddr)
 
 HostAttributeEntry *SFAT_LookupHostEntryBySrc(Packet *p)
 {
-    if (!p || !p->iph_api)
+    if (!p || !p->ip_api.is_valid())
         return NULL;
 
     return SFAT_LookupHostEntryByIP(p->ip_api.get_src());
@@ -384,7 +384,7 @@ HostAttributeEntry *SFAT_LookupHostEntryBySrc(Packet *p)
 
 HostAttributeEntry *SFAT_LookupHostEntryByDst(Packet *p)
 {
-    if (!p || !p->iph_api)
+    if (!p || !p->ip_api.is_valid())
         return NULL;
 
     return SFAT_LookupHostEntryByIP(p->ip_api.get_dst());
diff --git a/src/test/sfrf_test.cc b/src/test/sfrf_test.cc
index 03faf592d..0430a46fe 100644
--- a/src/test/sfrf_test.cc
+++ b/src/test/sfrf_test.cc
@@ -951,7 +951,7 @@ static int EventTest (EventData* p) {
     sfip_pton(p->dip, &dip);
 
     status = SFRF_TestThreshold(
-        &rfc, p->gid, p->sid, IP_ARG(sip), IP_ARG(dip), curtime, op);
+        &rfc, p->gid, p->sid, &sip, &dip, curtime, op);
 
     if ( status >= RULE_TYPE__MAX ) status -= RULE_TYPE__MAX;
 
diff --git a/src/test/sfthd_test.cc b/src/test/sfthd_test.cc
index 5ba680f72..00d69e935 100644
--- a/src/test/sfthd_test.cc
+++ b/src/test/sfthd_test.cc
@@ -804,12 +804,12 @@ static int EventTest (EventData* p, void* rule) {
     if ( rule )
     {
         status = sfthd_test_rule(
-            dThd, (THD_NODE *)rule, IP_ARG(sip), IP_ARG(dip), curtime);
+            dThd, (THD_NODE *)rule, &sip, &dip, curtime);
     }
     else
     {
         status = sfthd_test_threshold(
-            pThdObjs, pThd, p->gid, p->sid, IP_ARG(sip), IP_ARG(dip), curtime);
+            pThdObjs, pThd, p->gid, p->sid, &sip, &dip, curtime);
     }
 
     return status;
diff --git a/src/time/ppm.cc b/src/time/ppm.cc
index 2c63771b9..9f1a181f7 100644
--- a/src/time/ppm.cc
+++ b/src/time/ppm.cc
@@ -374,12 +374,12 @@ void ppm_pkt_log(ppm_cfg_t *ppm_cfg, Packet* p)
         else
         {
             sfip_t cleared;
-            IP_CLEAR(cleared);
+            sfip_clear(cleared);
 
             filterEvent = sfthreshold_test(
                         potn->sigInfo.generator,
                         potn->sigInfo.id,
-                        IP_ARG(cleared), IP_ARG(cleared),
+                        &cleared, &cleared,
                         p->pkth->ts.tv_sec);
         }
 
@@ -452,12 +452,12 @@ void ppm_rule_log(ppm_cfg_t *ppm_cfg, uint64_t pktcnt, Packet *p)
                 else
                 {
                     sfip_t cleared;
-                    IP_CLEAR(cleared);
+                    sfip_clear(cleared);
 
                     filterEvent = sfthreshold_test(
                                 otn->sigInfo.generator,
                                 otn->sigInfo.id,
-                                IP_ARG(cleared), IP_ARG(cleared),
+                                &cleared, &cleared,
                                 p->pkth->ts.tv_sec);
                 }
 
@@ -506,12 +506,12 @@ void ppm_rule_log(ppm_cfg_t *ppm_cfg, uint64_t pktcnt, Packet *p)
                 else
                 {
                     sfip_t cleared;
-                    IP_CLEAR(cleared);
+                    sfip_clear(cleared);
 
                     filterEvent = sfthreshold_test(
                                 otn->sigInfo.generator,
                                 otn->sigInfo.id,
-                                IP_ARG(cleared), IP_ARG(cleared),
+                                &cleared, &cleared,
                                 p->pkth->ts.tv_sec);
                 }