src/sys/netipsec, branch releng/5.3

Add missing code needed for the detection of IPSec packet replays. [1]

2006-03-22T16:03:25Z

Correctly identify the user running opiepasswd(1) when the login name differs from the account name. [2] Modify timeout handling logic in sendmail(8) to correct a reported signal handling race condition. [3] Approved by: so (cperciva) Security: FreeBSD-SA-06:11.ipsec [1] Security: FreeBSD-SA-06:12.opie [2] Security: FreeBSD-SA-06:13.sendmail [3]

MFC various fixes:

2004-10-02T04:55:47Z

o Correct handling of SADB_UPDATE and SADB_ADD requests. o Add missing locking for secpolicy refcnt manipulations. o Remove extraneous SECPOLICY_LOCK_DESTROY calls. Submitted by: Roselyn Lee Approved by: re (scottl)

MFC from pfvar.h, rev. 1.9 and keydb.h, rev. 1.4

2004-09-30T20:11:46Z

> Protect sockaddr_union definitions with a protecting define. This allows > to build kernels with FAST_IPSEC and PF. This is the least disruptive > fix. > > PR: kern/71836 > Reviewed by: bms, various mailing lists Approved by: re (scottl)

MFC: Apply error and success logic consistently to the function netisr_queue()

2004-09-15T15:14:19Z

and its users. Approved by: re (kensmith)

Get rid of the RANDOM_IP_ID option and make it a sysctl. NetBSD

2004-08-14T15:32:40Z

have already done this, so I have styled the patch on their work: 1) introduce a ip_newid() static inline function that checks the sysctl and then decides if it should return a sequential or random IP ID. 2) named the sysctl net.inet.ip.random_id 3) IPv6 flow IDs and fragment IDs are now always random. Flow IDs and frag IDs are significantly less common in the IPv6 world (ie. rarely generated per-packet), so there should be smaller performance concerns. The sysctl defaults to 0 (sequential IP IDs). Reviewed by: andre, silby, mlaier, ume Based on: NetBSD MFC after: 2 months

Add required includes for post-sorwakeup() change to fix FAST_IPSEC

2004-06-23T01:58:22Z

compilation.

Fix a paste-o in key_cmpspidx_withmask().

2004-06-22T17:17:44Z

PR: misc/67013 Submitted by: Zhenmin

use correct address for SADB_EXT_ADDRESS_DST in key_do_allocsa_policy

2004-05-03T05:15:53Z

(was using src instead of dst) Submitted by: Bjoern A. Zeeb Obtained from: KAME MFC after: 1 day

correct behaviour of key_getsavbyspi broken in rev 1.7; corrects problems with

2004-05-03T05:11:40Z

removing specific SPIs Submitted by: Bjoern A. Zeeb

add support to prefer old SA to new SA during allocation

2004-05-03T03:29:21Z

(makes net.key.preferred_oldsa work as for KAME) Submitted by: gabor@sentex.net Reviewed by: Bjoern A. Zeeb MFC after: 1 day