Copy stable/10@r272459 to releng/10.1 as part of
the 10.1-RELEASE process.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Copy head (r256279) to stable/10 as part of the 10.0-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Nm ipsec

Put parentheses around a few macros to prevent mdoc warnings.

Correct typo.

Reported by: gabor
MFC after: 5 days

Enable IPcomp by default.

PR: kern/123587
MFC after: 5 days

Add sysctls to toggle the behaviour of the (former) IPSEC_FILTERTUNNEL
kernel option.
This also permits tuning of the option per virtual network stack, as
well as separately per inet, inet6.

The kernel option is left for a transition period, marked deprecated,
and will be removed soon.

Initially requested by: phk (1 year 1 day ago)
MFC after: 4 weeks

Rename option IPSEC_FILTERGIF to IPSEC_FILTERTUNNEL.
Also rename the related functions in a similar way.
There are no functional changes.

For a packet coming in with IPsec tunnel mode, the default is
to only call into the firewall with the "outer" IP header and
payload.

With this option turned on, in addition to the "outer" parts,
the "inner" IP header and payload are passed to the
firewall too when going through ip_input() the second time.

The option was never only related to a gif(4) tunnel within
an IPsec tunnel and thus the name was very misleading.

Discussed at: BSDCan 2007
Best new name suggested by: rwatson
Reviewed by: rwatson
Approved by: re (bmah)

Remove the last entries to fast_ipsec.
Merge in parts of the old fast_ipsec.4 man page to ipsec.4 and
start updating ipsec.4 man page.

Reviewed by: brueffer, sam (slightly earlier versions), bmah
Approved by: re (bmah)

Markup fixes.

- add note about IPSEC_FILTERGIF to fast_ipsec(4) and let the users know
that it is not possible to use Fast IPsec in conjuction with KAME IPsec
- add available kernel options to ipsec(4)
- add reference for fast_ipsec(4) to ipsec(4)

Reviewed by: trhodes (mentor), keramida (mentor)
Approved by: keramida (mentor)

A little extra cleaning up.

MFC after: 1 week

Clean up some descriptions and remove ambiguities in the language.
Add explanations to the examples.

MFC after: 1 week

Expand contractions.

Fixed the misplaced $FreeBSD$.

List RFCs under SEE ALSO.

PR: 46918

mdoc(7) police: Use the new .In macro for #include statements.

mdoc(7) police:

Avoid using parenthesis enclosure macros (.Pq and .Po/.Pc) with plain text.
Not only this slows down the mdoc(7) processing significantly, but it also
has an undesired (in this case) effect of disabling hyphenation within the
entire enclosed block.

mdoc(7) police: remove extraneous .Pp before and/or after .Sh.

clarify problem with inbound AH.
spdadd A B -P in ipsec esp/tunnel/C-D/use ah/tunnel/C-D/require;
does not work due to 1-bit validation bit we are using with inbound
policy checking.

Submitted by: itojun
Obtained from: KAME
MFC after: 1 week

Sync with recent KAME.
This work was based on kame-20010528-freebsd43-snap.tgz and some
critical problem after the snap was out were fixed.
There are many many changes since last KAME merge.

TODO:
- The definitions of SADB_* in sys/net/pfkeyv2.h are still different
from RFC2407/IANA assignment because of binary compatibility
issue. It should be fixed under 5-CURRENT.
- ip6po_m member of struct ip6_pktopts is no longer used. But, it
is still there because of binary compatibility issue. It should
be removed under 5-CURRENT.

Reviewed by: itojun
Obtained from: KAME
MFC after: 3 weeks

Correct cross-references:
setsockopt.3 --> setsockopt.2
syslog.8 --> syslogd.8
tcpdump.8 --> tcpdump.1

MFC after: 1 week

Prepare for mdoc(7)NG.

mdoc(7) police: use the new features of the Nm macro.

bring in latest kame doc. talk about ah tunnel caveat.

Remove references to man pages that don't exist.

PR: docs/17506

Merge from KAME. Basically man doc improvement and contents fix.

Obtained from: KAME project

Change .Os macro to an empty one to denote that the KAME files are
not FreeBSD specific.

Made happy: sheldonh

libipsec and IPsec related apps. (and some KAME related man pages)

Reviewed by: freebsd-arch, cvs-committers
Obtained from: KAME project