Remove svn:mergeinfo carried over from stable/9.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Copy stable/9 to releng/9.3 as part of the 9.3-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

MFC: r264585

Add a missing break in the TCP case.

Reviewed by: bms

A set of MFCs allowing stable/9 to be built again on head after r250881:

r250227:
Improve compatibility with recent flex from flex.sourceforge.net.

r250914:
Improve compatibility with old flex and fix build with GCC.

r250926 (partial):
Work around build breakages with GCC 4.2.

MFC r231532:

MFp4 204292:

Ignore the NAT_T extension types so we can at least dump the SADB from
the in-base libipsec/setkey without error when NAT_T support is present
in the kernel, though not printing the additional information yet.
However in case there is no NAT_T support in kernel still consider them
to be an error.

MFC r231515:

Use the correct constant (with same value) for comparying the SA type.

PR: kern/142741
Submitted by: Matthijs Kooiman (matthijs stdin.nl)

MFC r227458, r226436:

- change "is is" to "is" or "it is"
- change "the the" to "the"
- other typo fixes

Approved by: lstewart

MFC r228552:

Define YY_NO_INPUT in lib/libipsec/policy_token.l, so lex's input()
function does not get defined needlessly.

MFC r228555:

In lib/libipsec/policy_token.l, use lex's standard "%option noinput"
instead of hand-defining the YY_NO_INPUT macro.

Copy head to stable/9 as part of 9.0-RELEASE release cycle.

Approved by: re (implicit)

The use of snprintf() to append to a buffer is not valid according to C99

Build lib/ with WARNS=6 by default.

Similar to libexec/, do the same with lib/. Make WARNS=6 the norm and
lower it when needed.

I'm setting WARNS?=0 for secure/. It seems secure/ includes the
Makefile.inc provided by lib/. I'm not going to touch that directory.
Most of the code there is contributed anyway.

Bump the version of all non-symbol-versioned shared libraries in
preparation for 8.0-RELEASE. Add the previous version of those
libraries to ObsoleteFiles.inc and bump __FreeBSD_Version.

Reviewed by: kib
Approved by: re (rwatson)

Commit IPv6 support for FAST_IPSEC to the tree.
This commit includes all remaining changes for the time being including
user space updates.

Submitted by: bz
Approved by: re

Bump library versions in preparation for 7.0.

Ok'd by: kan

Integrate the Camellia Block Cipher. For more information see RFC 4132
and its bibliography.

Submitted by: Tomoyuki Okazaki <okazaki at kick dot gr dot jp>
MFC after: 1 month

Markup fixes.

Provide alternate default for SHLIBDIR before bsd.own.mk does this.

Reported by: phk

Reimplementation of world/kernel build options. For details, see:

http://lists.freebsd.org/pipermail/freebsd-current/2006-March/061725.html

The src.conf(5) manpage is to follow in a few days.

Brought to you by: imp, jhb, kris, phk, ru (all bugs are mine)

Clean up some descriptions and remove ambiguities in the language.
Add explanations to the examples.

MFC after: 1 week

Bump the shared library version number of all libraries that have not
been bumped since RELENG_5.

Reviewed by: ru
Approved by: re (not needed for commit check but in principle...)

Fixed the misplaced $FreeBSD$.

NOINET6 -> NO_INET6

Back out last delta, it just unpolitely reverted some local changes.

Initial import of RFC 2385 (TCP-MD5) digest support.

This is the second of two commits; bring in the userland support to finish.

Teach libipsec and setkey about the tcp-md5 class of security associations,
thus allowing administrators to add per-host keys to the SADB for use by
the tcpsignature_compute() function.

Document that a single SPI must be used until such time as the code which
adds support to the SPD to specify flows for tcp-md5 treatment is suitable
for production.

Sponsored by: sentex.net

- plug memory leak.
- fixed a length of the sadb extension in the case of pfkey_send_x5().
- used getprotobynumber() for printing a upper layer protocol name.
- modified the output format against the change of the setkey syntax
about a icmp6 type/code.
- don't enumerate reserved fields. use memset.

Obtained from: KAME

- errx() doesn't need `\n'.
- use %u for unsigned variable.

Obtained from: KAME

stop use of NI_WITHSCOPEID. it was deprecated.

Obtained from: KAME

- support AES counter mode for ESP.
- use size_t as return type of schedlen(), as there's no error
check needed.
- clear key schedule buffer before freeing.

Obtained from: KAME

- support AES XCBC MAC for AH
- correct SADB_X_AALG_RIPEMD160HMAC to 8

Obtained from: KAME

- RIPEMD160 support
- pass size arg to ah->result (avoid assuming result buffer size)

Obtained from: KAME

mdoc(7): Properly mark C headers.

style.Makefile(5)

Stage 3 of dynamic root support. Make all the libraries needed to run
binaries in /bin and /sbin installed in /lib. Only the versioned files
reside in /lib, the .so symlink continues to live /usr/lib so the
toolchain doesn't need to be modified.

Buffer size is not enough in the previous commit. Use 128.

Pointed out by: nectar
MFC after: 1 week

Make character buffer more bigger.

Obtained from: KAME
MFC after: 1 week

The .Fn function

The .Fn function. Spelling.

Correct typos, mostly s/ a / an / where appropriate. Some whitespace cleanup,
especially in troff files.

english(4) police.

Zap now-unused SHLIB_MINOR

just merged cosmetic changes from KAME to ease sync between KAME and FreeBSD.
(based on freebsd4-snap-20020128)

Reviewed by: ume
MFC after: 1 week

Remove multi-line __P() usage.

Remove __P() usage.

mdoc(7) police: Use the new .In macro for #include statements.

Add __FBSDID()s to libipsec

mdoc(7) police: fixed the "new sentence" bogons.

mdoc(7) police:

Avoid using parenthesis enclosure macros (.Pq and .Po/.Pc) with plain text.
Not only this slows down the mdoc(7) processing significantly, but it also
has an undesired (in this case) effect of disabling hyphenation within the
entire enclosed block.

printed current sequence number of the SA. accordingly, changed
into sadb_x_sa2_sequence from sadb_x_sa2_reserved3 in the sadb_x_sa2
structure. Also the output of setkey is changed. sequence number
of the sadb is replaced to the end of the output.

Obtained from: KAME

Remove whitespace at EOL.

Sync with recent KAME.
This work was based on kame-20010528-freebsd43-snap.tgz and some
critical problem after the snap was out were fixed.
There are many many changes since last KAME merge.

TODO:
- The definitions of SADB_* in sys/net/pfkeyv2.h are still different
from RFC2407/IANA assignment because of binary compatibility
issue. It should be fixed under 5-CURRENT.
- ip6po_m member of struct ip6_pktopts is no longer used. But, it
is still there because of binary compatibility issue. It should
be removed under 5-CURRENT.

Reviewed by: itojun
Obtained from: KAME
MFC after: 3 weeks

MAN[1-9] -> MAN.

mdoc(7) police: split punctuation characters + misc fixes.

Fix typo: ispec -> ipsec

PR: 24005
Submitted by: Jimmy Olgeni <olgeni@uli.it>

Change the spelling of `.' to `.' from .OBJDIR since `.' really is where
generated files land. Also give precedence to generated files.

The GCC 2.96 snapshots have slightly different rules for finding include
files. Mostly -I${.CURDIR} was needed -- especially for YACC generated
files as the new cpp does not look in the ultimate source file
(ie, the .y file)'s directory as told by the "#line" directive. Some were
misspellings of "-I${.CURDIR}" as "-I.".

synchronize with latest kame tree.

behavior change: policy syntax was changed. you may need to update your
setkey(8) configuration files.

Fix typo.

Noticed by: hoek

. remove some unneeded comments
. replace .Os value with empty value since this library is not KAME only
anymore
. add a note about IPv6 and IPsec integration to the FreeBSD

. add a note about IPv6/IPsec integration to the FreeBSD
. replace .Po/.Pc pairs with .Pq
. remove some unneeded comments
. .Lb-ify

Don't try to compile in INET6 support when NOINET6 is defined.

Replace the prefix for yylval to less confusing one.
(Sorry, this should be committed with previous commit to Makefile.)

Replace the prefix for yylval to less confusing one.

Suggested by: bruce

Actually, ${LIBY}/-ly aren't needed either. This should finish unbreaking
the world build.

Remove libl related dependencies, because it is not necessary, and even more,
it cause building world failure.

Specified by: Nickolay Dudorov <nnd@mail.nsk.ru>

Fixed missing DPADD.

Fixed style bug for LDADD (don't use += for variables defined only once).

Initialize mbuf pointer at getting ipsec policy.
Without this, kernel will panic at getsockopt() of IPSEC_POLICY.
Also make compilable libipsec/test-policy.c which tries getsockopt() of
IPSEC_POLICY.

Approved by: jkh

Submitted by: sakane@kame.net

s/ispec/ipsec/, and add a missing comma.

PR: docs/16995
Submitted by: Benno Rice <benno@netizen.com.au>

Change IPv6 scoped addr format again based on recent standard discussion.
Sorry for the flapping, but no change will be done for 4.0 anymore.
Official standard will be published around April or later.
If different format would be adopted at that time, then support for
the new format will be added to the succeeding FreeBSD 4.x.

Approved by: jkh

Set libipsec shared library number to 0

When libipsec library is created, no SHLIB numbers are
specified in the Makefile. Then the library version was set
to 2.(by default?)
So change it to 0.
For now it should not be problem, because the contents are same.
I'll also prepare an entry for UPDATING.

Fixed missing include and missing arg in synopsis.

Fixed missing include in synopsis.

libipsec and IPsec related apps. (and some KAME related man pages)

Reviewed by: freebsd-arch, cvs-committers
Obtained from: KAME project