src/sys/netipsec, branch releng/10.2

MFC r285204:

2015-07-15T21:09:38Z

Fill the port and protocol information in the SADB_ACQUIRE message in case when security policy has it as required by RFC 2367. PR: 192774 Approved by: re (delphij)

MFC r283146:

2015-06-03T02:50:58Z

In the reply to SADB_X_SPDGET message use the same sequence number that was in the request. Some IKE deamons expect it will the same. Linux and NetBSD also follow this behaviour. PR: 137309

MFC r283101:

2015-06-02T03:51:33Z

Teach key_expire() send SADB_EXPIRE message with the SADB_EXT_LIFETIME_HARD extension header type. The key_flush_sad() now will send SADB_EXPIRE message when HARD lifetime expires. This is required by RFC 2367 and some keying daemons rely on these messages. HARD lifetime messages have precedence over SOFT lifetime messages, so now they will be checked first. Also now SADB_EXPIRE messages will be send even the SA has not been used, because keying daemons might want to rekey such SA. PR: 200282, 200283 MFC r283102: Change SA's state before sending SADB_EXPIRE message. This state will be reported to keying daemon.

MFC r275390:

2015-06-02T03:43:36Z

Remove unused declartations. MFC r275437: ANSIfy function declarations. MFC r275438: Remove __P() macro. Sponsored by: Yandex LLC

MFC r275392:

2015-06-02T03:14:42Z

Remove route chaching support from ipsec code. It isn't used for some time. * remove sa_route_union declaration and route_cache member from struct secashead; * remove key_sa_routechange() call from ICMP and ICMPv6 code; * simplify ip_ipsec_mtu(); * remove #include ; Sponsored by: Yandex LLC

MFC r283117:

2015-05-31T22:49:32Z

Remove unneded mbuf length adjustment, M_PREPEND() already did that. PR: 139387

MFC r279735:

2015-03-14T14:38:25Z

Remove extra '&'. sin6 is already a pointer. PR: 195011

MFC r275393:

2014-12-16T11:45:33Z

Remove unneded check. No need to do m_pullup to the size that we prepended. MFC r275473: Fix style(9) and remove m_freem(NULL). Add XXX comment, it looks incorrect, because m_pkthdr.len is already incremented by M_PREPEND(). Sponsored by: Yandex LLC

MFC r275575:

2014-12-16T11:24:07Z

key_getspacq() returns holding the spacq_lock. Unlock it in all cases. Sponsored by: Yandex LLC

MFC r274230:

2014-11-21T15:21:39Z

Pass mbuf to pfil processing before stripping outer IP header as it is described in if_enc(4).