Fix rtsold(8) remote buffer overflow vulnerability. [SA-14:20]

Fix routed(8) remote denial of service vulnerability. [SA-14:21]

Fix memory leak in sandboxed namei lookup. [SA-14:22]

Approved by: re (so@ blanket)

Copy stable/10@r272459 to releng/10.1 as part of
the 10.1-RELEASE process.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Hoist all the mergeinfo up to the root in preparation for enforcing merges
to the root only. All MFC's were rerecorded to the root.

Going forward, if an MFC includes mergeinfo, it will need to be made to
the root and committed from the root. Merges with --ignore-ancestry
or diff | patch can go anywhere.

The mergeinfo in HEAD is in a bad state from years of neglect and manual
tampering and this was branched into 10.x. This confuses the coalescing
code and prevents it from doing its job.

Approved by: re (gjb, implicit)

Copy head (r256279) to stable/10 as part of the 10.0-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Use sysctl(ICMPV6CTL_ND6_DRLIST) instead of SIOCGDRLST_IN6 ioctl.

- Remove struct ifinfo *iflist. It is no longer used.
- Suppress warnings about increase of alignment requirement.

Fix build on arm and mips.

- Use time_uptime instead of time_second in data structures for
PF_INET6 in kernel. This fixes various malfunction when the wall time
clock is changed. Bump __FreeBSD_version to 1000041.

- Use clock_gettime(CLOCK_MONOTONIC_FAST) in userland utilities.

MFC after: 1 month

Silent warnings.

- Fix wording. [1]
- Improve the descriptions in the FILES section. [2]

Reported by: Jason McIntyre [1]
Obtained from: NetBSD [2]
MFC after: 3 days

Correct the description of the -a option: rtsol(d) -a will in fact send out
router solicitations on multiple interfaces.

Reviewed by: hrs
MFC after: 1 week

Fix warning when compiling with gcc46:
error: variable 'target' set but not used

Approved by: dim, cperciva (mentor, blanket for pre-mentorship already-approved commits)
MFC after: 3 days

Spelling fixes for usr.sbin/

- Add ":origin" label to the interface id for resolvconf(8). (r223149)
- Add -u option to enable adding :[RA-source-address] to the interface id.
(r223149)
- s/INET6_ADDRSTRLEN/sizeof(ntopbuf)/ (r223149)
- Fix a bug that can prevent -D from being overridden by -d. (r223149)
- /-P pidfile/-p pidfile/ for consistency with rtadvd(8). (r223149)
- Fix -F flag handling to support receiving RAs even when ip6.forwarding=1.
(r225150)

Approved by: re (kib)

- Accumulate RA options instead of replacing old ones when a new RA arrived.
RFC 4861 6.3.4 clearly defines handling multiple RAs in this way.

- RDNSS/DNSSL options from multiple RAs on a single link will be
gathered and sent to resolvconf(8).

- Call "resolvconf -d" only after at least one RDNSS or DNSSL option is
received and then all of them are expired.

- The rtsold.dump output now supports displaying a list of the RA options.

- Use more human-readable expression for logging values of struct timeval.

Discussed with: ume

- Disable "resolvconf -d" temporarily to avoid extra invocations of the script
under a certain condition.
- Fix argv handling.

Spotted by: ume

Lower WARNS level to 3 to eliminate alignment warnings related to
casting inherent in CMSG_DATA().

Remove redundant assignments to WARNS.

For these directories, WARNS is already implied to be 6.

- Implement RDNSS and DNSSL options (RFC 6106, IPv6 Router Advertisement
Options for DNS Configuration) into rtadvd(8) and rtsold(8). DNS
information received by rtsold(8) will go to resolv.conf(5) by
resolvconf(8) script. This is based on work by J.R. Oldroyd (kern/156259)
but revised extensively[1].

- rtadvd(8) now supports "noifprefix" to disable gathering on-link prefixes
from interfaces when no "addr" is specified[2]. An entry in rtadvd.conf
with "noifprefix" + no "addr" generates an RA message with no prefix
information option.

- rtadvd(8) now supports RTM_IFANNOUNCE message to fix crashes when an
interface is added or removed.

- Correct bogus ND_OPT_ROUTE_INFO value to one in RFC 4191.

Reviewed by: bz[1]
PR: kern/156259 [1]
PR: bin/152458 [2]

mdoc: move remaining sections into consistent order

This pertains mostly to FILES, HISTORY, EXIT STATUS and AUTHORS sections.

Found by: mdocml lint run
Reviewed by: ru

rtsol(8)/rtsold(8): make WARNS=3 clean

It is actually WARNS=6 clean for non-strict alignment archs.

Approved by: ed (co-mentor)

Exclude the interfaces which IPv6 and/or accepting RA is disabled
from the auto probed interface list.

MFC after: 1 week

Make -a option actually work.

MFC after: 1 week

Test index value is within the range before using it to reference
array member.

PR: bin/141838
Submitted by: Henning Petersen <henning.petersen@t-online.de>
MFC after: 2 weeks

The last big commit: let usr.sbin/ use WARNS=6 by default.

Add support for ND6_IFF_IFDISABLED and ND6_IFF_ACCEPT_RTADV to
the -F flag.

MFC after: 3 days

- rename the RETURN VALUES section to EXIT STATUS [1]
- convert to .Ex macro
- not bumping a date as this is not a real content change

Approved by: ru
MFC after: 3 days

Change arc4random to arc4random_uniform since modulo is not power of 2,
as OpenBSD does.

Obtained from: OpenBSD

Cleanup of userland __P use

Improve wording for -f and -F.

These IPv6-only tools have no explicit dependency on the INET6 macro.

Tested with: cmp(1)

fixed a potential memory leak

Obtained from: KAME
MFC after: 1 day

an English grammar fix

Reported by: ru
MFC after: 1 day

fixed typo

Obtained from: KAME
MFC after: 1 day

Fixed the misplaced $FreeBSD$.

Mechanically kill hard sentence breaks.

Fixed a warning.

-DSMALL will remove the need of dump.c (for rtsol)

Obtained from: KAME

add -F flag, which configures sysctl(8) setting by rtsold
itself (rather than warn about the current setting).

Obtained from: KAME

ansify.

Obtained from: KAME

use timeradd/sub/cmp.

Obtained from: KAME

backout 1.11. ifname in struct ifreq should be copyed by strncpy.

Pointed out by: itojun

- improved the -a option. it can probe a interface automatically when
the interface wake up. it can be started anytime even when there is
no network interface on the list of intarfaces in the kernel.
- get a correct link ID for each interface at initialization
(using scope libraries if HAVE_SCOPELIB is defined).
- fill in sin6_scope_id correctly before sendmsg().

Obtained from: KAME
MFC after: 1 week

use strlcpy().

Pointed out by: Pawel Jakub Dawidek <nick@garage.freebsd.pl>
MFC after: 1 week

- added the case of 802.11 to check link status.
- use strncpy just in case.
- __P() cleanup.

Obtained from: KAME
MFC after: 1 week

support poll(2).

Obtained from: KAME
MFC after: 1 week

daemon() has to be called prior to file descriptor setups
(otherwise file descriptors could be closed mistakenly)

Obtained from: KAME
MFC after: 1 week

signal handler must take "int" arg.

Obtained from: KAME
MFC after: 1 week

avoid fd_set overrun.

Obtained from: KAME
MFC after: 1 week

decreased too-strong log levels.

Obtained from: KAME
MFC after: 1 week

reduce #ifdef.

MFC after: 1 week

use strlcpy() and snprintf().

Obtained from: KAME
MFC after: 1 week

KNF, correct typos and cleanup spaces.

Obtained from: KAME
MFC after: 1 week

drop the code for the environment where getifaddrs(3) is not
supported.

Obtained from: KAME
MFC after: 1 week

Process the "O bit."
If the value of OtherConfigFlag changes from FALSE to TRUE, the
host should invoke the stateful autoconfiguration protocol,
requesting information.
[RFC 2462 Section 5.5.3]

Obtained from: KAME
MFC after: 1 week

__FUNCTION__ --> __func__

Obtained from: KAME
MFC after: 1 week

style.Makefile(5)

Add -DHAVE_ARC4RANDOM to CFLAGS

mdoc(7) police: Deal with self-xrefs.

The .Nm utility

Explicitly specifies sin6_family & sin6_len of sockaddr_in6 for raw socket
destination.
(Currently lack of their specification does not lead to any problem, because
kernel does not check the consistency between actual address and its
address family / length on raw socket.

However kernel should always check their consistency and stop sending packets
if there is a contradiction. Considering backward compatibility of
programs, I just fixed rtsol now; I'd like to fix the kernel behavior later.)

Reviewed by: ume
MFC after: 3 days

typo. netbsd PR 16055

Obtained from: KAME
MFC after: 1 week

mdoc(7) police: Fixed the .Ex calls in manpages that describe more
than one utility.

PR: docs/30437
Submitted by: SUZUKI Koichi <koich@cac.co.jp>

mdoc(7) police: utilize the new .Ex macro.

mdoc(7) police:

Avoid using parenthesis enclosure macros (.Pq and .Po/.Pc) with plain text.
Not only this slows down the mdoc(7) processing significantly, but it also
has an undesired (in this case) effect of disabling hyphenation within the
entire enclosed block.

Perform a major cleanup of the usr.sbin Makefiles.
These are not perfectly in agreement with each other style-wise, but they
are orders of orders of magnitude more consistent style-wise than before.

Sync with recent KAME.
This work was based on kame-20010528-freebsd43-snap.tgz and some
critical problem after the snap was out were fixed.
There are many many changes since last KAME merge.

TODO:
- The definitions of SADB_* in sys/net/pfkeyv2.h are still different
from RFC2407/IANA assignment because of binary compatibility
issue. It should be fixed under 5-CURRENT.
- ip6po_m member of struct ip6_pktopts is no longer used. But, it
is still there because of binary compatibility issue. It should
be removed under 5-CURRENT.

Reviewed by: itojun
Obtained from: KAME
MFC after: 3 weeks

- Backout botched attempt to introduce MANSECT feature.
- MAN[1-9] -> MAN.

Set the default manual section for usr.sbin/ to 8.

mdoc(7) police: use the new features of the Nm macro.

Sync with KAME. Format string auditing, and add -a flag to autoprobe
interfaces.

Obtained from: KAME

Correct style bugs

Sync with latest KAME.

Obtained from: KAME

remove redundant ifdef's.

some part is specified by: phantom

Getaddrinfo(), getnameinfo(), and etc support in libc/net.
Several udp and raw apps IPv6 support.

Reviewed by: freebsd-arch, cvs-committers
Obtained from: KAME project