- Copy stable/10 (r259064) to releng/10.0 as part of the
10.0-RELEASE cycle.
- Update __FreeBSD_version [1]
- Set branch name to -RC1

[1] 10.0-CURRENT __FreeBSD_version value ended at '55', so
start releng/10.0 at '100' so the branch is started with
a value ending in zero.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Copy head (r256279) to stable/10 as part of the 10.0-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Minor wording improvments to some manual pages

Approved by: bcr (mentor)
Obtained from: DragonflyBSD (a5294ca835317c68c919ab43936da4f05ab6e926)
MFC after: 3 days

Minor mdoc improvements.

Minor mdoc nits.

mdoc: correct .Bd/.Bl arguments.

Reviewed by: brueffer

Remove superfluous paragraph macro.

mdoc: fix markup

mdoc: drop even more redundant .Pp calls

No change in rendered output, less mandoc lint warnings.

Tool provided by: Nobuyuki Koganemaru n-kogane at syd.odn.ne.jp

o Fix typo.

PR: docs/145031
Submitted by: olgeni
MFC after: 1 week

Use the newly brought %U macro.

o Add missed dot.

Integrate the Camellia Block Cipher. For more information see RFC 4132
and its bibliography.

Submitted by: Tomoyuki Okazaki <okazaki at kick dot gr dot jp>
MFC after: 1 month

Markup fixes.

Include other AES key lengths in the comment.

Langauge fixes required to disambiguate some statements.

Explain the examples.

Fixed the misplaced $FreeBSD$.

Added the EXIT STATUS section where appropriate.

Fixed display type.

Reapply traditionally lost fixes, fixed some more.
This manpage needs an English clenup.

Initial import of RFC 2385 (TCP-MD5) digest support.

This is the second of two commits; bring in the userland support to finish.

Teach libipsec and setkey about the tcp-md5 class of security associations,
thus allowing administrators to add per-host keys to the SADB for use by
the tcpsignature_compute() function.

Document that a single SPI must be used until such time as the code which
adds support to the SPD to specify flows for tcp-md5 treatment is suitable
for production.

Sponsored by: sentex.net

enable aes-xcbc-mac and aes-ctr, again.

- do hexdump on send. set length field properly
- check for encryption/authentication key together with algorithm.
- warned if a deprecated encryption algorithm (that includes "simple")
is specified.
- changed the syntax how to define a policy of a ICMPv6 type and/or a
code, like spdadd ::/0 ::/0 icmp6 134,0 -P out none;
- random cleanup in parser.
- use yyfatal, or return -1 after yyerror.
- deal with strdup() failure.
- permit scope notation in policy string (-P
esp/tunnel/foo%scope-bar%scope/use)
- simplify /prefix and [port].
- g/c some unused symbols.

Obtained from: KAME

- support AES counter mode for ESP.
- use size_t as return type of schedlen(), as there's no error
check needed.
- clear key schedule buffer before freeing.

Obtained from: KAME

- support AES XCBC MAC for AH
- correct SADB_X_AALG_RIPEMD160HMAC to 8

Obtained from: KAME

- RIPEMD160 support
- pass size arg to ah->result (avoid assuming result buffer size)

Obtained from: KAME

Correct typos, mostly s/ a / an / where appropriate. Some whitespace cleanup,
especially in troff files.

english(4) police.

Fix spacing for -P (policy) examples.

s/IPSEC/IPsec according to RFCs

PR: in part docs/38668
Reviewed by: charnier
MFC after: 10 days

The .Nm utility

mdoc(7) police: protect trailing full stops of abbreviations
with a trailing zero-width space: `e.g.\&'.

can not -> cannot

mdoc(7) police:

Avoid using parenthesis enclosure macros (.Pq and .Po/.Pc) with plain text.
Not only this slows down the mdoc(7) processing significantly, but it also
has an undesired (in this case) effect of disabling hyphenation within the
entire enclosed block.

Remove whitespace at EOL.

mdoc(7) police: sort SEE ALSO xrefs (sort -b -f +2 -3 +1 -2).

Sync with recent KAME.
This work was based on kame-20010528-freebsd43-snap.tgz and some
critical problem after the snap was out were fixed.
There are many many changes since last KAME merge.

TODO:
- The definitions of SADB_* in sys/net/pfkeyv2.h are still different
from RFC2407/IANA assignment because of binary compatibility
issue. It should be fixed under 5-CURRENT.
- ip6po_m member of struct ip6_pktopts is no longer used. But, it
is still there because of binary compatibility issue. It should
be removed under 5-CURRENT.

Reviewed by: itojun
Obtained from: KAME
MFC after: 3 weeks

Allow ``ip4'' as an ``upperspec'' value, and update the man
page with *all* the permissible values.

This should really be spelt ipencap (as /etc/protocols does),
but a precedent has already been set by the ipproto array in
setkey.c.

It would be nice if /etc/protocols was parsed for the upperspec
field, but I don't do yacc/lex...

This change allows policies that only encrypt the encapsulated
packets passing between the endpoints of a gif tunnel. Setting
such a policy means that you can still talk directly (and
unencrypted) between the public IP numbers with (say) ssh.

MFC after: 1 week

mdoc(7) police: normalize .Nd.

mdoc(7) police: split punctuation characters + misc fixes.

Minor layout fixes.

PR: 24004
Submitted by: Jimmy Olgeni <olgeni@uli.it>

mdoc(7) police: use the new features of the Nm macro.

synchronize with latest kame tree.

behavior change: policy syntax was changed. you may need to update your
setkey(8) configuration files.

Typo: "ealgo" -> "aalgo"

PR: docs/18547 (OKAZAKI Tetsurou <okazaki@be.to>)

Fix typo

Noticed by: hoek

. clear `.Os' macro value since this tool is not KAME only anymore
. add integration note

Add missing end of semi colon of an example setkey command.

Submitted by: kuriyama

Typo fix. s/SAD/SPD/.

Specified by: jdp

Remove single-space hard sentence breaks. These degrade the quality
of the typeset output, tend to make diffs harder to read and provide
bad examples for new-comers to mdoc.

libipsec and IPsec related apps. (and some KAME related man pages)

Reviewed by: freebsd-arch, cvs-committers
Obtained from: KAME project