Index: head/tests/sys/netpfil/pf/forward.sh
===================================================================
--- head/tests/sys/netpfil/pf/forward.sh	(revision 324663)
+++ head/tests/sys/netpfil/pf/forward.sh	(revision 324664)
@@ -1,147 +1,149 @@
 # $FreeBSD$
 
 . $(atf_get_srcdir)/utils.subr
 
 atf_test_case "v4" "cleanup"
 v4_head()
 {
 	atf_set descr 'Basic forwarding test'
 	atf_set require.user root
 
 	# We need scapy to be installed for out test scripts to work
 	atf_set require.progs scapy
 }
 
 v4_body()
 {
 	pft_init
 
 	epair_send=$(pft_mkepair)
 	ifconfig ${epair_send}a 192.0.2.1/24 up
 
 	epair_recv=$(pft_mkepair)
 	ifconfig ${epair_recv}a up
 
 	pft_mkjail alcatraz ${epair_send}b ${epair_recv}b
 	jexec alcatraz ifconfig ${epair_send}b 192.0.2.2/24 up
 	jexec alcatraz ifconfig ${epair_recv}b 198.51.100.2/24 up
 	jexec alcatraz sysctl net.inet.ip.forwarding=1
 	jexec alcatraz arp -s 198.51.100.3 00:01:02:03:04:05
 	route add -net 198.51.100.0/24 192.0.2.2
 
 	# Sanity check, can we forward ICMP echo requests without pf?
 	atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \
 		--sendif ${epair_send}a \
 		--to 198.51.100.3 \
 		--recvif ${epair_recv}a
 
+	jexec alcatraz pfctl -e
+
 	# Forward with pf enabled
-	printf "block in\n" | jexec alcatraz pfctl -ef -
+	pft_set_rules alcatraz "block in"
 	atf_check -s exit:1 $(atf_get_srcdir)/pft_ping.py \
 		--sendif ${epair_send}a \
 		--to 198.51.100.3 \
 		--recvif ${epair_recv}a
 
-	printf "block out\n" | jexec alcatraz pfctl -f -
+	pft_set_rules alcatraz "block out"
 	atf_check -s exit:1 $(atf_get_srcdir)/pft_ping.py \
 		--sendif ${epair_send}a \
 		--to 198.51.100.3 \
 		--recv ${epair_recv}a
 
 	# Allow ICMP
-	printf "block in\npass in proto icmp\n" | jexec alcatraz pfctl -f -
+	pft_set_rules alcatraz "block in" "pass in proto icmp"
 	atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \
 		--sendif ${epair_send}a \
 		--to 198.51.100.3 \
 		--recvif ${epair_recv}a
 }
 
 v4_cleanup()
 {
 	pft_cleanup
 }
 
 atf_test_case "v6" "cleanup"
 v6_head()
 {
 	atf_set descr 'Basic IPv6 forwarding test'
 	atf_set require.user root
 	atf_set require.progs scapy
 }
 
 v6_body()
 {
 	pft_init
 
 	epair_send=$(pft_mkepair)
 	epair_recv=$(pft_mkepair)
 
 	ifconfig ${epair_send}a inet6 2001:db8:42::1/64 up no_dad -ifdisabled
 	ifconfig ${epair_recv}a up
 
 	pft_mkjail alcatraz ${epair_send}b ${epair_recv}b
 
 	jexec alcatraz ifconfig ${epair_send}b inet6 2001:db8:42::2/64 up no_dad
 	jexec alcatraz ifconfig ${epair_recv}b inet6 2001:db8:43::2/64 up no_dad
 	jexec alcatraz sysctl net.inet6.ip6.forwarding=1
 	jexec alcatraz ndp -s 2001:db8:43::3 00:01:02:03:04:05
 	route add -6 2001:db8:43::/64 2001:db8:42::2
 
 	# Sanity check, can we forward ICMP echo requests without pf?
 	atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \
 		--ip6 \
 		--sendif ${epair_send}a \
 		--to 2001:db8:43::3 \
 		--recvif ${epair_recv}a
 
 	jexec alcatraz pfctl -e
 
 	# Block incoming echo request packets
 	pft_set_rules alcatraz \
 		"block in inet6 proto icmp6 icmp6-type echoreq"
 	atf_check -s exit:1 $(atf_get_srcdir)/pft_ping.py \
 		--ip6 \
 		--sendif ${epair_send}a \
 		--to 2001:db8:43::3 \
 		--recvif ${epair_recv}a
 
 	# Block outgoing echo request packets
 	pft_set_rules alcatraz \
 		"block out inet6 proto icmp6 icmp6-type echoreq"
 	atf_check -s exit:1 -e ignore $(atf_get_srcdir)/pft_ping.py \
 		--ip6 \
 		--sendif ${epair_send}a \
 		--to 2001:db8:43::3 \
 		--recvif ${epair_recv}a
 
 	# Allow ICMPv6 but nothing else
 	pft_set_rules alcatraz \
 		"block out" \
 		"pass out inet6 proto icmp6"
 	atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \
 		--ip6 \
 		--sendif ${epair_send}a \
 		--to 2001:db8:43::3 \
 		--recvif ${epair_recv}a
 
 	# Allowing ICMPv4 does not allow ICMPv6
 	pft_set_rules alcatraz \
 		"block out inet6 proto icmp6 icmp6-type echoreq" \
 		"pass in proto icmp"
 	atf_check -s exit:1 $(atf_get_srcdir)/pft_ping.py \
 		--ip6 \
 		--sendif ${epair_send}a \
 		--to 2001:db8:43::3 \
 		--recvif ${epair_recv}a
 }
 
 v6_cleanup()
 {
 	pft_cleanup
 }
 
 atf_init_test_cases()
 {
 	atf_add_test_case "v4"
 	atf_add_test_case "v6"
 }
Index: head/tests/sys/netpfil/pf/pass_block.sh
===================================================================
--- head/tests/sys/netpfil/pf/pass_block.sh	(revision 324663)
+++ head/tests/sys/netpfil/pf/pass_block.sh	(revision 324664)
@@ -1,91 +1,91 @@
 # $FreeBSD$
 
 . $(atf_get_srcdir)/utils.subr
 
 atf_test_case "v4" "cleanup"
 v4_head()
 {
 	atf_set descr 'Basic pass/block test for IPv4'
 	atf_set require.user root
 }
 
 v4_body()
 {
 	pft_init
 
 	epair=$(pft_mkepair)
 	ifconfig ${epair}a 192.0.2.1/24 up
 
 	# Set up a simple jail with one interface
 	pft_mkjail alcatraz ${epair}b
 	jexec alcatraz ifconfig ${epair}b 192.0.2.2/24 up
 
 	# Trivial ping to the jail, without pf
 	atf_check -s exit:0 -o ignore ping -c 1 -t 1 192.0.2.2
 
 	# pf without policy will let us ping
 	jexec alcatraz pfctl -e
 	atf_check -s exit:0 -o ignore ping -c 1 -t 1 192.0.2.2
 
 	# Block everything
-	printf "block in\n" | jexec alcatraz pfctl -f -
+	pft_set_rules alcatraz "block in"
 	atf_check -s exit:2 -o ignore ping -c 1 -t 1 192.0.2.2
 
 	# Block everything but ICMP
-	printf "block in\npass in proto icmp\n" | jexec alcatraz pfctl -f -
+	pft_set_rules alcatraz "block in" "pass in proto icmp"
 	atf_check -s exit:0 -o ignore ping -c 1 -t 1 192.0.2.2
 }
 
 v4_cleanup()
 {
 	pft_cleanup
 }
 
 atf_test_case "v6" "cleanup"
 v6_head()
 {
 	atf_set descr 'Basic pass/block test for IPv6'
 	atf_set require.user root
 }
 
 v6_body()
 {
 	pft_init
 
 	epair=$(pft_mkepair)
 	ifconfig ${epair}a inet6 2001:db8:42::1/64 up no_dad
 
 	# Set up a simple jail with one interface
 	pft_mkjail alcatraz ${epair}b
 	jexec alcatraz ifconfig ${epair}b inet6 2001:db8:42::2/64 up no_dad
 
 	# Trivial ping to the jail, without pf
 	atf_check -s exit:0 -o ignore ping6 -c 1 -x 1 2001:db8:42::2
 
 	# pf without policy will let us ping
 	jexec alcatraz pfctl -e
 	atf_check -s exit:0 -o ignore ping6 -c 1 -x 1 2001:db8:42::2
 
 	# Block everything
-	printf "block in\n" | jexec alcatraz pfctl -f -
+	pft_set_rules alcatraz "block in"
 	atf_check -s exit:2 -o ignore ping6 -c 1 -x 1 2001:db8:42::2
 
 	# Block everything but ICMP
-	printf "block in\npass in proto icmp6\n" | jexec alcatraz pfctl -f -
+	pft_set_rules alcatraz "block in" "pass in proto icmp6"
 	atf_check -s exit:0 -o ignore ping6 -c 1 -x 1 2001:db8:42::2
 
 	# Allowing ICMPv4 does not allow ICMPv6
-	printf "block in\npass in proto icmp\n" | jexec alcatraz pfctl -f -
+	pft_set_rules alcatraz "block in" "pass in proto icmp"
 	atf_check -s exit:2 -o ignore ping6 -c 1 -x 1 2001:db8:42::2
 }
 
 v6_cleanup()
 {
 	pft_cleanup
 }
 
 atf_init_test_cases()
 {
 	atf_add_test_case "v4"
 	atf_add_test_case "v6"
 }
Index: head/tests/sys/netpfil/pf/set_tos.sh
===================================================================
--- head/tests/sys/netpfil/pf/set_tos.sh	(revision 324663)
+++ head/tests/sys/netpfil/pf/set_tos.sh	(revision 324664)
@@ -1,92 +1,93 @@
 # $FreeBSD$
 
 . $(atf_get_srcdir)/utils.subr
 
 atf_test_case "v4" "cleanup"
 v4_head()
 {
 	atf_set descr 'set-tos test'
 	atf_set require.user root
 
 	# We need scapy to be installed for out test scripts to work
 	atf_set require.progs scapy
 }
 
 v4_body()
 {
 	pft_init
 
 	epair_send=$(pft_mkepair)
 	ifconfig ${epair_send}a 192.0.2.1/24 up
 
 	epair_recv=$(pft_mkepair)
 	ifconfig ${epair_recv}a up
 
 	pft_mkjail alcatraz ${epair_send}b ${epair_recv}b
 	jexec alcatraz ifconfig ${epair_send}b 192.0.2.2/24 up
 	jexec alcatraz ifconfig ${epair_recv}b 198.51.100.2/24 up
 	jexec alcatraz sysctl net.inet.ip.forwarding=1
 	jexec alcatraz arp -s 198.51.100.3 00:01:02:03:04:05
 	route add -net 198.51.100.0/24 192.0.2.2
 
+	jexec alcatraz pfctl -e
+
 	# No change is done if not requested
-	printf "scrub out proto icmp\n" | jexec alcatraz pfctl -ef -
+	pft_set_rules alcatraz "scrub out proto icmp"
 	atf_check -s exit:1 -o ignore $(atf_get_srcdir)/pft_ping.py \
 		--sendif ${epair_send}a \
 		--to 198.51.100.3 \
 		--recvif ${epair_recv}a \
 		--expect-tos 42
 
 	# The requested ToS is set
-	printf "scrub out proto icmp set-tos 42\n" | jexec alcatraz pfctl -f -
+	pft_set_rules alcatraz "scrub out proto icmp set-tos 42"
 	atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \
 		--sendif ${epair_send}a \
 		--to 198.51.100.3 \
 		--recvif ${epair_recv}a \
 		--expect-tos 42
 
 	# ToS is not changed if the scrub rule does not match
-	printf "scrub out proto tcp set-tos 42\n" | jexec alcatraz pfctl -f -
+	pft_set_rules alcatraz "scrub out proto tcp set-tos 42"
 	atf_check -s exit:1 -o ignore $(atf_get_srcdir)/pft_ping.py \
 		--sendif ${epair_send}a \
 		--to 198.51.100.3 \
 		--recvif ${epair_recv}a \
 		--expect-tos 42
 
 	# Multiple scrub rules match as expected
-	printf "scrub out proto tcp set-tos 13\nscrub out proto icmp set-tos 14\n" \
-		| jexec alcatraz pfctl -f -
+	pft_set_rules alcatraz "scrub out proto tcp set-tos 13" \
+		"scrub out proto icmp set-tos 14"
 	atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \
 		--sendif ${epair_send}a \
 		--to 198.51.100.3 \
 		--recvif ${epair_recv}a \
 		--expect-tos 14
 
 	# And this works even if the packet already has ToS values set
 	atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \
 		--sendif ${epair_send}a \
 		--to 198.51.100.3 \
 		--recvif ${epair_recv}a \
 		--send-tos 42 \
 		--expect-tos 14
 
 	# ToS values are unmolested if the packets do not match a scrub rule
-	printf "scrub out proto tcp set-tos 13\n" \
-		| jexec alcatraz pfctl -f -
+	pft_set_rules alcatraz "scrub out proto tcp set-tos 13"
 	atf_check -s exit:0 $(atf_get_srcdir)/pft_ping.py \
 		--sendif ${epair_send}a \
 		--to 198.51.100.3 \
 		--recvif ${epair_recv}a \
 		--send-tos 42 \
 		--expect-tos 42
 }
 
 v4_cleanup()
 {
 	pft_cleanup
 }
 
 atf_init_test_cases()
 {
 	atf_add_test_case "v4"
 }