Copy stable/10@r272459 to releng/10.1 as part of
the 10.1-RELEASE process.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Copy head (r256279) to stable/10 as part of the 10.0-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Add -a and -A option to the usage.

MFC after: 1 week

Remove the advertising clause from UCB copyrighted files in usr.sbin. This
is in accordance with the information provided at
ftp://ftp.cs.berkeley.edu/pub/4bsd/README.Impt.License.Change

traceroute6(8): make WARNS=3 clean

The last big commit: let usr.sbin/ use WARNS=6 by default.

- Add AS lookup functionality to traceroute6(8) as well.
- Support for IPv6 transport for AS lookup.
- Introduce $RA_SERVER to set whois server.
- Support for 4 byte ASN.
- ANSIfy function declaration in as.c.

Tested by: IHANet folks.

- rename the RETURN VALUES section to EXIT STATUS
- not bumping a date as this is not a real content change

Approved by: ru
MFC after: 3 days

Give traceroute6 the ability to traceroute with packets with no
upper layer header (IP PROTO = 59). Useful for testing firewalls.

MFC after: 2 months

Cleanup of userland __P use

When processing multi-path ip6 routers, place each router entry on its
own line. We made this change in traceroute(8) some time ago. This
is particularly useful when you are not resolving hostnames since ip6
addresses can be quite long, and lines wrap fairly easily in the
multi-path router case.

Discussed with: bz
MFC after: 1 month

Remove the -DFAST_IPSEC from Makefiles again.

This was needed during the IPSEC->FAST_IPSEC->IPSEC transition
period to not break the build after picking up netipsec header
files. Now that the FAST_IPSEC kernel option is gone and the
default is IPSEC again those defines are superfluous.

Approved by: re (rwatson)

Commit IPv6 support for FAST_IPSEC to the tree.
This commit includes all remaining changes for the time being including
user space updates.

Submitted by: bz
Approved by: re

o I failed to find a suitable explanation why traceroute(8) and
traceroute6(8) force -w flag (wait time) to be > 1 sec. Make it
possible to use 1 sec wait time.

PR: bin/110933
Submitted by: Dmitry Marakasov
Reviewed by: freebsd-net (silence)
MFC after: 1 month

Use setresuid for simple privilege dropping.

These IPv6-only tools have no explicit dependency on the INET6 macro.

Tested with: cmp(1)

- Fix: documentation for -m option was inserted halfway thru the text of -l
option.

PR: docs/90359
Submitted by: Gavin Atkinson <gavin.atkinson@ury.york.ac.uk>
MFC after: 3 days

Copy the description for the -r option from the traceroute(8) man
page. I'm pretty sure that this description applies the same way to
ipv6, and at least mentioning SO_DONTROUTE is better than having no
description at all.

Fixed the misplaced $FreeBSD$.

mdoc(7) fixes.

Sync up with KAME. The main change is to try to avoid exposing
exposing information about the endianness and alighment requirements
in the packets sent by traceroute6.

Obtained from: KAME

Add some more details about what traceroute6 does.

Submitted by: Orla McGann <orly@redbrick.dcu.ie>
Obtained from: KAME
MFC after: 2 weeks

Reapply traditionally lost fixes.

- setsockopt/sysctl takes int, not u_long.
- be more picky about argument parsing - like ERANGE.
- use u_long for args, not to lose accuracy/prevent overflow.
- socklen_t audit.
- Add -I (use icmp) option.
- warn if multiple addresses are present for dest.
- no need to pass tz.
- type pedant. check -p range.
- grab hlim from sysctl.
- typo in port number setting.

Obtained from: KAME

Switch Advanced Sockets API for IPv6 from RFC2292 to RFC3542
(aka RFC2292bis). Though I believe this commit doesn't break
backward compatibility againt existing binaries, it breaks
backward compatibility of API.
Now, the applications which use Advanced Sockets API such as
telnet, ping6, mld6query and traceroute6 use RFC3542 API.

Obtained from: KAME

- style
- index() -> strchr()
- stop use of MAXHOSTNAMELEN

Obtained from: KAME

stop use of NI_WITHSCOPEID. it was deprecated.

Obtained from: KAME

Quote from a Problem Report:

The output format specifier for the round-trip time in ping6 should be
changed to %.3f instead of %g since %g doesn't accurately represent the
precision of the number being output. In particular, %g truncates trailing
zeroes. 0.01 ms does not mean the same thing as 0.010 ms. Although they
are numerically identical, they do not have the same precision.

PR: bin/52324, bin/52750
Submitted by: dg
MFC after: 1 week

Correct typos, mostly s/ a / an / where appropriate. Some whitespace cleanup,
especially in troff files.

Back out previous commit. I was a bit overzealous: the fd_set size is
calculated dynamically here.

Check for FD_SET overrun.

The .Nm utility

Don't override BINGRP -- this binary is not ``setgid bin''.

PR: bin/30538
Submitted by: Tony Finch <dot@dotat.at>

mdoc(7) police:

Avoid using parenthesis enclosure macros (.Pq and .Po/.Pc) with plain text.
Not only this slows down the mdoc(7) processing significantly, but it also
has an undesired (in this case) effect of disabling hyphenation within the
entire enclosed block.

Perform a major cleanup of the usr.sbin Makefiles.
These are not perfectly in agreement with each other style-wise, but they
are orders of orders of magnitude more consistent style-wise than before.

Sync with recent KAME.
This work was based on kame-20010528-freebsd43-snap.tgz and some
critical problem after the snap was out were fixed.
There are many many changes since last KAME merge.

TODO:
- The definitions of SADB_* in sys/net/pfkeyv2.h are still different
from RFC2407/IANA assignment because of binary compatibility
issue. It should be fixed under 5-CURRENT.
- ip6po_m member of struct ip6_pktopts is no longer used. But, it
is still there because of binary compatibility issue. It should
be removed under 5-CURRENT.

Reviewed by: itojun
Obtained from: KAME
MFC after: 3 weeks

- Backout botched attempt to introduce MANSECT feature.
- MAN[1-9] -> MAN.

Set the default manual section for usr.sbin/ to 8.

mdoc(7) police: use the new features of the Nm macro.

Enable use of poll()

Sync with KAME. Don't write past the end of the fd_set.

Obtained from: KAME

Don't call errx() without a format string, to protect against possible
localized error messages from ipsec_strerror().

Obtained from: OpenBSD

Sync with latest KAME code.

Obtained from: KAME

Fix miscellaneous mdoc macro argument limit infringements.

PR: 18465
Reported by: Kazu TAKAMUNE <takamune@avrl.mei.co.jp>

Fix typo

Noticed by: hoek

. clear `.Os' macro value since this tool is not KAME only anymore
. add integration note
. avoid `.Nm' value upper case usage

Security fixes. (Just same as sbin/ping and usr.sbin/traceroute)
-Open socket() at first and then setuid() to actual user.
-Allow ping6 preload option only for root.

Approved by: jkh

Submitted by: Neil Blakey-Milner <nbm@mithrandr.moria.org>

replace gethostbyname() with getaddrinfo(), and gethostbyaddr() with
getipnodebyaddr().
This resolve 2 problems.
-can specify scope index(@ifname) for IPv6 link local addr
-reverse lookup for IPv6 loopback addr(::1) was strange, but fixed

remove redundant ifdef's.

some part is specified by: phantom

libipsec and IPsec related apps. (and some KAME related man pages)

Reviewed by: freebsd-arch, cvs-committers
Obtained from: KAME project

Getaddrinfo(), getnameinfo(), and etc support in libc/net.
Several udp and raw apps IPv6 support.

Reviewed by: freebsd-arch, cvs-committers
Obtained from: KAME project