move more extra packages from ./trunk to ./packages

SVN-Revision: 12359

1 files changed, 0 insertions, 1753 deletions

diff --git a/package/isakmpd/patches/010-debian_3.patch b/package/isakmpd/patches/010-debian_3.patch
deleted file mode 100644
index 0f50cf9c07..0000000000
--- a/package/isakmpd/patches/010-debian_3.patch
+++ /dev/null
@@ -1,1753 +0,0 @@
-Index: isakmpd-20041012.orig/dpd.c
-===================================================================
---- isakmpd-20041012.orig.orig/dpd.c	2007-06-04 13:22:39.088912864 +0200
-+++ isakmpd-20041012.orig/dpd.c	2007-06-04 13:22:39.282883376 +0200
-@@ -26,6 +26,7 @@
- 
- #include <sys/types.h>
- #include <stdlib.h>
-+#include <memory.h>
- 
- #include "sysdep.h"
- 
-@@ -174,6 +175,7 @@
- 		}
- 		break;
- 	default:
-+	;
- 	}
- 
- 	/* Mark handled.  */
-@@ -223,6 +225,7 @@
- 		    dpd_check_event, sa, &tv);
- 		break;
- 	default:
-+	;
- 	}
- 	if (!sa->dpd_event) 
- 		log_print("dpd_timer_reset: timer_add_event failed");
-Index: isakmpd-20041012.orig/ipsec.c
-===================================================================
---- isakmpd-20041012.orig.orig/ipsec.c	2007-06-04 13:22:39.093912104 +0200
-+++ isakmpd-20041012.orig/ipsec.c	2007-06-04 13:22:39.283883224 +0200
-@@ -1020,6 +1020,52 @@
- 	}
- }
- 
-+/*
-+ * deal with a NOTIFY of INVALID_SPI
-+ */
-+static void
-+ipsec_invalid_spi (struct message *msg, struct payload *p)
-+{
-+  struct sockaddr *dst;
-+  int invspisz, off;
-+  u_int32_t spi;
-+  u_int16_t totsiz;
-+  u_int8_t spisz;
-+
-+  /* Any notification that make us do something should be protected */
-+  if(!TAILQ_FIRST (&msg->payload[ISAKMP_PAYLOAD_HASH]))
-+    {
-+      LOG_DBG ((LOG_SA, 40,
-+      	       "ipsec_invalid_spi: missing HASH payload in INVALID_SPI"
-+      	       " notification"));
-+      return;
-+    }
-+
-+  /*
-+   * get the invalid spi out of the variable sized notification data
-+   * field, which is after the variable sized SPI field [which specifies
-+   * the receiving entity's phase-1 SPI, not the invalid spi]
-+   */
-+  totsiz = GET_ISAKMP_GEN_LENGTH (p->p);
-+  spisz = GET_ISAKMP_NOTIFY_SPI_SZ (p->p);
-+  off = ISAKMP_NOTIFY_SPI_OFF + spisz;
-+  invspisz = totsiz - off;
-+
-+  if (invspisz != sizeof spi)
-+    {
-+      LOG_DBG ((LOG_SA, 40,
-+	       "ipsec_invalid_spi: SPI size %d in INVALID_SPI "
-+	       "payload unsupported", spisz));
-+       return;
-+    }
-+  memcpy (&spi, p->p + off, sizeof spi);
-+
-+  msg->transport->vtbl->get_dst (msg->transport, &dst);
-+
-+  /* delete matching SPI's from this peer */
-+  ipsec_delete_spi_list (dst, 0, (u_int8_t *)&spi, 1, "INVALID_SPI");
-+}
-+
- static int
- ipsec_responder(struct message *msg)
- {
-@@ -1205,7 +1251,9 @@
- 			return dv != IPSEC_ENCAP_TUNNEL
- 			    && dv != IPSEC_ENCAP_TRANSPORT
- 			    && dv != IPSEC_ENCAP_UDP_ENCAP_TUNNEL
--			    && dv != IPSEC_ENCAP_UDP_ENCAP_TRANSPORT;
-+			    && dv != IPSEC_ENCAP_UDP_ENCAP_TRANSPORT
-+			    && dv != IPSEC_ENCAP_UDP_ENCAP_TUNNEL_DRAFT
-+			    && dv != IPSEC_ENCAP_UDP_ENCAP_TRANSPORT_DRAFT;
- #else
- 			return dv < IPSEC_ENCAP_TUNNEL
- 			    || dv > IPSEC_ENCAP_TRANSPORT;
-@@ -1837,7 +1885,7 @@
- ipsec_get_id(char *section, int *id, struct sockaddr **addr,
-     struct sockaddr **mask, u_int8_t *tproto, u_int16_t *port)
- {
--	char	*type, *address, *netmask;
-+    char	*type, *address, *netmask;
- 
- 	type = conf_get_str(section, "ID-type");
- 	if (!type) {
-Index: isakmpd-20041012.orig/GNUmakefile
-===================================================================
---- isakmpd-20041012.orig.orig/GNUmakefile	2007-06-04 13:22:39.099911192 +0200
-+++ isakmpd-20041012.orig/GNUmakefile	2007-06-04 13:22:39.283883224 +0200
-@@ -40,12 +40,12 @@
- # integrated, freebsd/netbsd means FreeBSD/NetBSD with KAME IPsec.
- # darwin means MacOS X 10.2 and later with KAME IPsec. linux means Linux-2.5
- # and later with native IPSec support.
--OS=		openbsd
-+#OS=		openbsd
- #OS=		netbsd
- #OS=		freebsd
- #OS=		freeswan
- #OS=		darwin
--#OS=		linux
-+OS=		linux
- 
- .CURDIR:=	$(shell pwd)
- VPATH=		${.CURDIR}/sysdep/${OS}
-@@ -55,9 +55,10 @@
- ifndef BINDIR
- BINDIR=		/sbin
- endif
--ifndef LDSTATIC
--LDSTATIC=	-static
--endif
-+
-+#ifndef LDSTATIC
-+#LDSTATIC=	-static
-+#endif
- 
- SRCS=		app.c attribute.c cert.c connection.c \
- 		constants.c conf.c cookie.c crypto.c dh.c doi.c exchange.c \
-@@ -131,11 +132,14 @@
- ifneq ($(findstring install,$(MAKECMDGOALS)),install)
- # Skip 'regress' until the regress/ structure has gmake makefiles for it.
- #SUBDIR:=	regress
--SUBDIR:=
-+#SUBDIR:=	apps/certpatch
- mksubdirs:
- 	$(foreach DIR, ${SUBDIR}, \
--		cd ${DIR}; ${MAKE} ${MAKEFLAGS} CFLAGS="${CFLAGS}" \
--			MKDEP="${MKDEP}" ${MAKECMDGOALS})
-+		cd ${.CURDIR}/${DIR}; ${MAKE} ${MAKECMDGOALS};)
-+		
-+#	$(foreach DIR, ${SUBDIR}, \
-+#		cd ${DIR}; ${MAKE} CFLAGS="${CFLAGS}" \
-+#			MKDEP="${MKDEP}" ${MAKECMDGOALS})
- else
- mksubdirs:
- endif
-@@ -173,7 +177,7 @@
- endif
- 
- SRCS+=		${IPSEC_SRCS} ${X509} ${POLICY} ${EC} ${AGGRESSIVE} ${DNSSEC} \
--		$(ISAKMP_CFG)
-+			$(ISAKMP_CFG) ${DPD} ${NAT_TRAVERSAL}
- CFLAGS+=	${IPSEC_CFLAGS}
- LDADD+=		${DESLIB}
- DPADD+=		${DESLIBDEP}
-Index: isakmpd-20041012.orig/exchange.h
-===================================================================
---- isakmpd-20041012.orig.orig/exchange.h	2007-06-04 13:22:39.104910432 +0200
-+++ isakmpd-20041012.orig/exchange.h	2007-06-04 13:22:39.283883224 +0200
-@@ -221,6 +221,8 @@
- #define EXCHANGE_FLAG_NAT_T_ENABLE	0x10	/* We are doing NAT-T.  */
- #define EXCHANGE_FLAG_NAT_T_KEEPALIVE	0x20	/* We are the NAT:ed peer.  */
- #define EXCHANGE_FLAG_DPD_CAP_PEER	0x40	/* Peer is DPD capable.  */
-+#define EXCHANGE_FLAG_NAT_T_RFC		0x0080	/* Peer does RFC NAT-T. */
-+#define EXCHANGE_FLAG_NAT_T_DRAFT	0x0100	/* Peer does draft NAT-T.*/
- 
- extern int      exchange_add_certs(struct message *);
- extern void     exchange_finalize(struct message *);
-Index: isakmpd-20041012.orig/log.c
-===================================================================
---- isakmpd-20041012.orig.orig/log.c	2007-06-04 13:22:39.110909520 +0200
-+++ isakmpd-20041012.orig/log.c	2007-06-04 13:22:39.284883072 +0200
-@@ -79,7 +79,6 @@
- 
- struct packhdr {
- 	struct pcap_pkthdr pcap;/* pcap file packet header */
--	u_int32_t sa_family;	/* address family */
- 	union {
- 		struct ip       ip4;	/* IPv4 header (w/o options) */
- 		struct ip6_hdr  ip6;	/* IPv6 header */
-@@ -97,7 +96,7 @@
- static u_int8_t *packet_buf = NULL;
- 
- static int      udp_cksum(struct packhdr *, const struct udphdr *,
--    u_int16_t *);
-+    u_int16_t *, int);
- static u_int16_t in_cksum(const u_int16_t *, int);
- #endif				/* USE_DEBUG */
- 
-@@ -539,11 +538,9 @@
- 	udp.uh_ulen = htons(datalen);
- 
- 	/* ip */
--	hdr.sa_family = htonl(src->sa_family);
- 	switch (src->sa_family) {
- 	default:
- 		/* Assume IPv4. XXX Can 'default' ever happen here?  */
--		hdr.sa_family = htonl(AF_INET);
- 		hdr.ip.ip4.ip_src.s_addr = 0x02020202;
- 		hdr.ip.ip4.ip_dst.s_addr = 0x01010101;
- 		/* The rest of the setup is common to AF_INET.  */
-@@ -584,9 +581,7 @@
- 	}
- 
- 	/* Calculate UDP checksum.  */
--	udp.uh_sum = udp_cksum(&hdr, &udp, (u_int16_t *) packet_buf);
--	hdrlen += sizeof hdr.sa_family;
--
-+	udp.uh_sum = udp_cksum(&hdr, &udp, (u_int16_t *) packet_buf, src->sa_family);
- 	/* pcap file packet header */
- 	gettimeofday(&tv, 0);
- 	hdr.pcap.ts.tv_sec = tv.tv_sec;
-@@ -610,7 +605,7 @@
- 
- /* Copied from tcpdump/print-udp.c, mostly rewritten.  */
- static int
--udp_cksum(struct packhdr *hdr, const struct udphdr *u, u_int16_t *d)
-+udp_cksum(struct packhdr *hdr, const struct udphdr *u, u_int16_t *d, int af)
- {
- 	struct ip	*ip4;
- 	struct ip6_hdr	*ip6;
-@@ -639,7 +634,7 @@
- 
- 	/* Setup pseudoheader.  */
- 	memset(phu.pa, 0, sizeof phu);
--	switch (ntohl(hdr->sa_family)) {
-+	switch (af) {
- 	case AF_INET:
- 		ip4 = &hdr->ip.ip4;
- 		memcpy(&phu.ip4p.src, &ip4->ip_src, sizeof(struct in_addr));
-@@ -664,7 +659,7 @@
- 
- 	/* IPv6 wants a 0xFFFF checksum "on error", not 0x0.  */
- 	if (tlen < 0)
--		return (ntohl(hdr->sa_family) == AF_INET ? 0 : 0xFFFF);
-+		return (af == AF_INET ? 0 : 0xFFFF);
- 
- 	sum = 0;
- 	for (i = 0; i < hdrlen; i += 2)
-Index: isakmpd-20041012.orig/nat_traversal.c
-===================================================================
---- isakmpd-20041012.orig.orig/nat_traversal.c	2007-06-04 13:22:39.115908760 +0200
-+++ isakmpd-20041012.orig/nat_traversal.c	2007-06-04 13:22:39.284883072 +0200
-@@ -1,4 +1,4 @@
--/*	$OpenBSD: nat_traversal.c,v 1.7 2004/08/08 19:11:06 deraadt Exp $	*/
-+/*	$OpenBSD: nat_traversal.c,v 1.17 2006/06/14 14:03:33 hshoexer Exp $	*/
- 
- /*
-  * Copyright (c) 2004 Håkan Olsson.  All rights reserved.
-@@ -48,40 +48,40 @@
- #include "util.h"
- #include "virtual.h"
- 
-+int	disable_nat_t = 0;
-+
- /*
-- * XXX According to draft-ietf-ipsec-nat-t-ike-07.txt, the NAT-T
-- * capability of the other peer is determined by a particular vendor ID
-- * sent as the first message. This vendor ID string is supposed to be a
-- * MD5 hash of "RFC XXXX", where XXXX is the future RFC number.
-+ * NAT-T capability of the other peer is determined by a particular vendor
-+ * ID sent in the first message. This vendor ID string is supposed to be a
-+ * MD5 hash of "RFC 3947".
-  *
-  * These seem to be the "well" known variants of this string in use by
-  * products today.
-  */
--static const char *isakmp_nat_t_cap_text[] = {
--	"draft-ietf-ipsec-nat-t-ike-00",	/* V1 (XXX: may be obsolete) */
--	"draft-ietf-ipsec-nat-t-ike-02\n",	/* V2 */
--	"draft-ietf-ipsec-nat-t-ike-03",	/* V3 */
--#ifdef notyet
--	"RFC XXXX",
--#endif
-+
-+static struct nat_t_cap isakmp_nat_t_cap[] = {
-+	{ VID_DRAFT_V2_N, EXCHANGE_FLAG_NAT_T_DRAFT,
-+	  "draft-ietf-ipsec-nat-t-ike-02\n", NULL, 0 },
-+	{ VID_DRAFT_V3, EXCHANGE_FLAG_NAT_T_DRAFT,
-+	  "draft-ietf-ipsec-nat-t-ike-03", NULL, 0 },
-+	{ VID_RFC3947, EXCHANGE_FLAG_NAT_T_RFC,
-+	  "RFC 3947", NULL, 0 },
- };
- 
-+#define NUMNATTCAP	(sizeof isakmp_nat_t_cap / sizeof isakmp_nat_t_cap[0])
-+
- /* In seconds. Recommended in draft-ietf-ipsec-udp-encaps-09.  */
- #define NAT_T_KEEPALIVE_INTERVAL	20
- 
--/* The MD5 hashes of the above strings is put in this array.  */
--static char	**nat_t_hashes;
--static size_t	  nat_t_hashsize;
--
- static int	nat_t_setup_hashes(void);
--static int	nat_t_add_vendor_payload(struct message *, char *);
-+static int	nat_t_add_vendor_payload(struct message *, struct nat_t_cap *);
- static int	nat_t_add_nat_d(struct message *, struct sockaddr *);
- static int	nat_t_match_nat_d_payload(struct message *, struct sockaddr *);
- 
- void
- nat_t_init(void)
- {
--	nat_t_hashes = (char **)NULL;
-+	nat_t_setup_hashes();
- }
- 
- /* Generate the NAT-T capability marker hashes. Executed only once.  */
-@@ -89,7 +89,7 @@
- nat_t_setup_hashes(void)
- {
- 	struct hash *hash;
--	int n = sizeof isakmp_nat_t_cap_text / sizeof isakmp_nat_t_cap_text[0];
-+	int n = NUMNATTCAP;
- 	int i;
- 
- 	/* The draft says to use MD5.  */
-@@ -100,56 +100,49 @@
- 		    "could not find MD5 hash structure!");
- 		return -1;
- 	}
--	nat_t_hashsize = hash->hashsize;
- 
--	/* Allocate one more than is necessary, i.e NULL terminated.  */
--	nat_t_hashes = (char **)calloc((size_t)(n + 1), sizeof(char *));
--	if (!nat_t_hashes) {
--		log_error("nat_t_setup_hashes: calloc (%lu,%lu) failed",
--		    (unsigned long)n, (unsigned long)sizeof(char *));
--		return -1;
--	}
--
--	/* Populate with hashes.  */
-+	/* Populate isakmp_nat_t_cap with hashes.  */
- 	for (i = 0; i < n; i++) {
--		nat_t_hashes[i] = (char *)malloc(nat_t_hashsize);
--		if (!nat_t_hashes[i]) {
-+		isakmp_nat_t_cap[i].hashsize = hash->hashsize;
-+		isakmp_nat_t_cap[i].hash = (char *)malloc(hash->hashsize);
-+		if (!isakmp_nat_t_cap[i].hash) {
- 			log_error("nat_t_setup_hashes: malloc (%lu) failed",
--			    (unsigned long)nat_t_hashsize);
-+			    (unsigned long)hash->hashsize);
- 			goto errout;
- 		}
- 
- 		hash->Init(hash->ctx);
- 		hash->Update(hash->ctx,
--		    (unsigned char *)isakmp_nat_t_cap_text[i],
--		    strlen(isakmp_nat_t_cap_text[i]));
--		hash->Final(nat_t_hashes[i], hash->ctx);
-+		    (unsigned char *)isakmp_nat_t_cap[i].text,
-+		    strlen(isakmp_nat_t_cap[i].text));
-+		hash->Final(isakmp_nat_t_cap[i].hash, hash->ctx);
- 
- 		LOG_DBG((LOG_EXCHANGE, 50, "nat_t_setup_hashes: "
--		    "MD5(\"%s\") (%lu bytes)", isakmp_nat_t_cap_text[i],
--		    (unsigned long)nat_t_hashsize));
-+		    "MD5(\"%s\") (%lu bytes)", isakmp_nat_t_cap[i].text,
-+		    (unsigned long)hash->hashsize));
- 		LOG_DBG_BUF((LOG_EXCHANGE, 50, "nat_t_setup_hashes",
--		    nat_t_hashes[i], nat_t_hashsize));
-+		    isakmp_nat_t_cap[i].hash, hash->hashsize));
- 	}
- 
- 	return 0;
- 
--  errout:
-+errout:
- 	for (i = 0; i < n; i++)
--		if (nat_t_hashes[i])
--			free(nat_t_hashes[i]);
--	free(nat_t_hashes);
--	nat_t_hashes = NULL;
-+		if (isakmp_nat_t_cap[i].hash)
-+			free(isakmp_nat_t_cap[i].hash);
- 	return -1;
- }
- 
- /* Add one NAT-T VENDOR payload.  */
- static int
--nat_t_add_vendor_payload(struct message *msg, char *hash)
-+nat_t_add_vendor_payload(struct message *msg, struct nat_t_cap *cap)
- {
--	size_t	 buflen = nat_t_hashsize + ISAKMP_GEN_SZ;
-+	size_t	  buflen = cap->hashsize + ISAKMP_GEN_SZ;
- 	u_int8_t *buf;
- 
-+	if (disable_nat_t)
-+		return 0;
-+
- 	buf = malloc(buflen);
- 	if (!buf) {
- 		log_error("nat_t_add_vendor_payload: malloc (%lu) failed",
-@@ -158,12 +151,11 @@
- 	}
- 
- 	SET_ISAKMP_GEN_LENGTH(buf, buflen);
--	memcpy(buf + ISAKMP_VENDOR_ID_OFF, hash, nat_t_hashsize);
-+	memcpy(buf + ISAKMP_VENDOR_ID_OFF, cap->hash, cap->hashsize);
- 	if (message_add_payload(msg, ISAKMP_PAYLOAD_VENDOR, buf, buflen, 1)) {
- 		free(buf);
- 		return -1;
- 	}
--
- 	return 0;
- }
- 
-@@ -171,16 +163,14 @@
- int
- nat_t_add_vendor_payloads(struct message *msg)
- {
--	int i = 0;
-+	int i;
- 
--	if (!nat_t_hashes)
--		if (nat_t_setup_hashes())
--			return 0;  /* XXX should this be an error?  */
-+	if (disable_nat_t)
-+		return 0;
- 
--	while (nat_t_hashes[i])
--		if (nat_t_add_vendor_payload(msg, nat_t_hashes[i++]))
-+	for (i = 0; i < NUMNATTCAP; i++)
-+		if (nat_t_add_vendor_payload(msg, &isakmp_nat_t_cap[i]))
- 			return -1;
--
- 	return 0;
- }
- 
-@@ -192,36 +182,31 @@
- {
- 	u_int8_t *pbuf = p->p;
- 	size_t	  vlen;
--	int	  i = 0;
-+	int	  i;
- 
--	/* Already checked? */
--	if (p->flags & PL_MARK ||
--	    msg->exchange->flags & EXCHANGE_FLAG_NAT_T_CAP_PEER)
-+	if (disable_nat_t)
- 		return;
- 
--	if (!nat_t_hashes)
--		if (nat_t_setup_hashes())
--			return;
--
- 	vlen = GET_ISAKMP_GEN_LENGTH(pbuf) - ISAKMP_GEN_SZ;
--	if (vlen != nat_t_hashsize) {
--		LOG_DBG((LOG_EXCHANGE, 50, "nat_t_check_vendor_payload: "
--		    "bad size %lu != %lu", (unsigned long)vlen,
--		    (unsigned long)nat_t_hashsize));
--		return;
--	}
- 
--	while (nat_t_hashes[i])
--		if (memcmp(nat_t_hashes[i++], pbuf + ISAKMP_GEN_SZ,
-+	for (i = 0; i < NUMNATTCAP; i++) {
-+		if (vlen != isakmp_nat_t_cap[i].hashsize) {
-+			LOG_DBG((LOG_EXCHANGE, 50, "nat_t_check_vendor_payload: "
-+			    "bad size %lu != %lu", (unsigned long)vlen,
-+			    (unsigned long)isakmp_nat_t_cap[i].hashsize));
-+			continue;
-+		}
-+		if (memcmp(isakmp_nat_t_cap[i].hash, pbuf + ISAKMP_GEN_SZ,
- 		    vlen) == 0) {
- 			/* This peer is NAT-T capable.  */
- 			msg->exchange->flags |= EXCHANGE_FLAG_NAT_T_CAP_PEER;
-+			msg->exchange->flags |= isakmp_nat_t_cap[i].flags;
- 			LOG_DBG((LOG_EXCHANGE, 10,
- 			    "nat_t_check_vendor_payload: "
- 			    "NAT-T capable peer detected"));
- 			p->flags |= PL_MARK;
--			return;
- 		}
-+	}
- 
- 	return;
- }
-@@ -233,10 +218,8 @@
- {
- 	struct ipsec_exch *ie = (struct ipsec_exch *)msg->exchange->data;
- 	struct hash	 *hash;
--	struct prf	 *prf;
- 	u_int8_t	 *res;
- 	in_port_t	  port;
--	int		  prf_type = PRF_HMAC; /* XXX */
- 
- 	hash = hash_get(ie->hash->type);
- 	if (hash == NULL) {
-@@ -244,31 +227,25 @@
- 		return NULL;
- 	}
- 
--	prf = prf_alloc(prf_type, hash->type, msg->exchange->cookies,
--	    ISAKMP_HDR_COOKIES_LEN);
--	if(!prf) {
--		log_print("nat_t_generate_nat_d_hash: prf_alloc failed");
--		return NULL;
--	}
-+	*hashlen = hash->hashsize;
- 
--	*hashlen = prf->blocksize;
- 	res = (u_int8_t *)malloc((unsigned long)*hashlen);
- 	if (!res) {
- 		log_print("nat_t_generate_nat_d_hash: malloc (%lu) failed",
- 		    (unsigned long)*hashlen);
--		prf_free(prf);
- 		*hashlen = 0;
- 		return NULL;
- 	}
- 
- 	port = sockaddr_port(sa);
--	memset(res, 0, *hashlen);
--
--	prf->Update(prf->prfctx, sockaddr_addrdata(sa), sockaddr_addrlen(sa));
--	prf->Update(prf->prfctx, (unsigned char *)&port, sizeof port);
--	prf->Final(res, prf->prfctx);
--	prf_free (prf);
-+	bzero(res, *hashlen);
- 
-+	hash->Init(hash->ctx);
-+	hash->Update(hash->ctx, msg->exchange->cookies,
-+	    sizeof msg->exchange->cookies);
-+	hash->Update(hash->ctx, sockaddr_addrdata(sa), sockaddr_addrlen(sa));
-+	hash->Update(hash->ctx, (unsigned char *)&port, sizeof port);
-+	hash->Final(res, hash->ctx);
- 	return res;
- }
- 
-@@ -276,6 +253,7 @@
- static int
- nat_t_add_nat_d(struct message *msg, struct sockaddr *sa)
- {
-+	int	  ret;
- 	u_int8_t *hbuf, *buf;
- 	size_t	  hbuflen, buflen;
- 
-@@ -298,11 +276,19 @@
- 	memcpy(buf + ISAKMP_NAT_D_DATA_OFF, hbuf, hbuflen);
- 	free(hbuf);
- 
--	if (message_add_payload(msg, ISAKMP_PAYLOAD_NAT_D, buf, buflen, 1)) {
-+	if (msg->exchange->flags & EXCHANGE_FLAG_NAT_T_RFC)
-+		ret = message_add_payload(msg, ISAKMP_PAYLOAD_NAT_D, buf,
-+		    buflen, 1);
-+	else if (msg->exchange->flags & EXCHANGE_FLAG_NAT_T_DRAFT)
-+		ret = message_add_payload(msg, ISAKMP_PAYLOAD_NAT_D_DRAFT,
-+		    buf, buflen, 1);
-+	else
-+		ret = -1;
-+		
-+	if (ret) {
- 		free(buf);
- 		return -1;
- 	}
--
- 	return 0;
- }
- 
-@@ -312,14 +298,14 @@
- {
- 	struct sockaddr *sa;
- 
--	msg->transport->vtbl->get_src(msg->transport, &sa);
-+	/* Remote address first. */
-+	msg->transport->vtbl->get_dst(msg->transport, &sa);
- 	if (nat_t_add_nat_d(msg, sa))
- 		return -1;
- 
--	msg->transport->vtbl->get_dst(msg->transport, &sa);
-+	msg->transport->vtbl->get_src(msg->transport, &sa);
- 	if (nat_t_add_nat_d(msg, sa))
- 		return -1;
--
- 	return 0;
- }
- 
-@@ -336,8 +322,8 @@
- 	 * If there are no NAT-D payloads in the message, return "found"
- 	 * as this will avoid NAT-T (see nat_t_exchange_check_nat_d()).
- 	 */
--	p = payload_first(msg, ISAKMP_PAYLOAD_NAT_D);
--	if (!p)
-+	if ((p = payload_first(msg, ISAKMP_PAYLOAD_NAT_D_DRAFT)) == NULL &&
-+	    (p = payload_first(msg, ISAKMP_PAYLOAD_NAT_D)) == NULL)
- 		return 1;
- 
- 	hbuf = nat_t_generate_nat_d_hash(msg, sa, &hbuflen);
-Index: isakmpd-20041012.orig/udp_encap.c
-===================================================================
---- isakmpd-20041012.orig.orig/udp_encap.c	2007-06-04 13:22:39.121907848 +0200
-+++ isakmpd-20041012.orig/udp_encap.c	2007-06-04 13:22:39.284883072 +0200
-@@ -61,6 +61,11 @@
- 
- #define UDP_SIZE 65536
- 
-+#if defined(USE_NAT_TRAVERSAL) && defined (LINUX_IPSEC)
-+#include <linux/socket.h>
-+#include <linux/udp.h>
-+#endif
-+
- /* If a system doesn't have SO_REUSEPORT, SO_REUSEADDR will have to do.  */
- #ifndef SO_REUSEPORT
- #define SO_REUSEPORT SO_REUSEADDR
-@@ -134,6 +139,18 @@
- 	if (sysdep_cleartext(s, laddr->sa_family) == -1)
- 		goto err;
- 
-+#if defined(USE_NAT_TRAVERSAL) && defined (LINUX_IPSEC)
-+    {
-+#ifndef SOL_UDP
-+#define SOL_UDP 17
-+#endif
-+        int option = UDP_ENCAP_ESPINUDP;
-+        if(setsockopt(s, SOL_UDP, UDP_ENCAP, &option,
-+                      sizeof (option)) < 0)
-+            goto err;
-+    }
-+#endif
-+
- 	/* Wildcard address ?  */
- 	switch (laddr->sa_family) {
- 	case AF_INET:
-Index: isakmpd-20041012.orig/apps/Makefile
-===================================================================
---- isakmpd-20041012.orig.orig/apps/Makefile	2007-06-04 13:22:39.126907088 +0200
-+++ isakmpd-20041012.orig/apps/Makefile	2007-06-04 13:22:39.285882920 +0200
-@@ -31,4 +31,4 @@
- 
- SUBDIR= certpatch
- 
--.include <bsd.subdir.mk>
-+#.include <bsd.subdir.mk>
-Index: isakmpd-20041012.orig/apps/certpatch/GNUmakefile
-===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ isakmpd-20041012.orig/apps/certpatch/GNUmakefile	2007-06-04 13:22:39.285882920 +0200
-@@ -0,0 +1,55 @@
-+#	$OpenBSD: Makefile,v 1.7 2003/06/03 14:35:00 ho Exp $
-+#	$EOM: Makefile,v 1.6 2000/03/28 21:22:06 ho Exp $
-+
-+#
-+# Copyright (c) 1999 Niels Provos.  All rights reserved.
-+# Copyright (c) 2001 Niklas Hallqvist.  All rights reserved.
-+#
-+# Redistribution and use in source and binary forms, with or without
-+# modification, are permitted provided that the following conditions
-+# are met:
-+# 1. Redistributions of source code must retain the above copyright
-+#    notice, this list of conditions and the following disclaimer.
-+# 2. Redistributions in binary form must reproduce the above copyright
-+#    notice, this list of conditions and the following disclaimer in the
-+#    documentation and/or other materials provided with the distribution.
-+#
-+# THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
-+# IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
-+# OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
-+# IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
-+# INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
-+# NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-+# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-+#
-+
-+#
-+# This code was written under funding by Ericsson Radio Systems.
-+#
-+
-+PROG=		certpatch
-+SRCS=		certpatch.c
-+BINDIR?=	/usr/sbin
-+TOPSRC=		${.CURDIR}../..
-+TOPOBJ!=	cd ${TOPSRC}; printf "all:\n\t@pwd\n" |${MAKE} -f-
-+OS=			linux
-+FEATURES!=	awk '/^FEATURES=/ { print $$0 }' ${.CURDIR}/../../Makefile | sed 's/FEATURES=.//'
-+.PATH:		${TOPSRC} ${TOPSRC}/sysdep/${OS} ${TOPOBJ}
-+CFLAGS+=	-I${TOPSRC} -I${TOPSRC}/sysdep/${OS} -I${TOPOBJ} -Wall
-+LDFLAGS+=	-lcrypto -lssl -lgmp
-+MAN=		certpatch.8
-+
-+CFLAGS+=	-DMP_FLAVOUR=MP_FLAVOUR_GMP
-+LDADD+=		-lgmp
-+DPADD+=		${LIBGMP}
-+
-+# Override LIBSYSDEPDIR definition from Makefile.sysdep
-+LIBSYSDEPDIR=	${TOPSRC}/sysdep/common/libsysdep
-+
-+all:	${PROG}
-+
-+clean:	
-+	rm -f ${PROG}
-Index: isakmpd-20041012.orig/pf_key_v2.c
-===================================================================
---- isakmpd-20041012.orig.orig/pf_key_v2.c	2007-06-04 13:22:39.137905416 +0200
-+++ isakmpd-20041012.orig/pf_key_v2.c	2007-06-04 13:22:39.287882616 +0200
-@@ -1055,6 +1055,10 @@
- #endif
- #if defined (USE_NAT_TRAVERSAL) && defined (SADB_X_EXT_UDPENCAP)
- 	struct sadb_x_udpencap udpencap;
-+#elif defined (USE_NAT_TRAVERSAL) && defined (SADB_X_EXT_NAT_T_TYPE)
-+	struct sadb_x_nat_t_type nat_t_type;
-+	struct sadb_x_nat_t_port nat_t_sport;
-+	struct sadb_x_nat_t_port nat_t_dport;
- #endif
- #ifdef USE_DEBUG
- 	char           *addr_str;
-@@ -1273,10 +1277,15 @@
- 		log_print("pf_key_v2_set_spi: invalid proto %d", proto->proto);
- 		goto cleanup;
- 	}
--	if (incoming)
-+	if (incoming) {
- 		sa->transport->vtbl->get_src(sa->transport, &dst);
--	else
-+		sa->transport->vtbl->get_dst(sa->transport, &src);
-+	}
-+	else {
- 		sa->transport->vtbl->get_dst(sa->transport, &dst);
-+		sa->transport->vtbl->get_src(sa->transport, &src);
-+	}
-+
- #ifdef KAME
- 	msg.sadb_msg_seq = (incoming ?
- 	    pf_key_v2_seq_by_sa(proto->spi[incoming], sizeof ssa.sadb_sa_spi,
-@@ -1319,12 +1328,13 @@
- 	ssa.sadb_sa_flags = 0;
- #ifdef SADB_X_SAFLAGS_TUNNEL
- 	if (iproto->encap_mode == IPSEC_ENCAP_TUNNEL ||
--	    iproto->encap_mode == IPSEC_ENCAP_UDP_ENCAP_TUNNEL)
-+	    iproto->encap_mode == IPSEC_ENCAP_UDP_ENCAP_TUNNEL ||
-+	    iproto->encap_mode == IPSEC_ENCAP_UDP_ENCAP_TUNNEL_DRAFT)
- 		ssa.sadb_sa_flags = SADB_X_SAFLAGS_TUNNEL;
- #endif
- 
--#if defined (USE_NAT_TRAVERSAL) && defined (SADB_X_EXT_UDPENCAP)
- 	if (isakmp_sa->flags & SA_FLAG_NAT_T_ENABLE) {
-+#if defined (USE_NAT_TRAVERSAL) && defined (SADB_X_EXT_UDPENCAP)
- 		memset(&udpencap, 0, sizeof udpencap);
- 		ssa.sadb_sa_flags |= SADB_X_SAFLAGS_UDPENCAP;
- 		udpencap.sadb_x_udpencap_exttype = SADB_X_EXT_UDPENCAP;
-@@ -1334,8 +1344,40 @@
- 		if (pf_key_v2_msg_add(update, (struct sadb_ext *)&udpencap, 0)
- 		    == -1)
- 			goto cleanup;
--	}
-+#elif defined (USE_NAT_TRAVERSAL) && defined (SADB_X_EXT_NAT_T_TYPE)
-+#ifndef UDP_ENCAP_ESPINUDP
-+#define UDP_ENCAP_ESPINUDP	2
-+#endif
-+		memset(&nat_t_type, 0, sizeof nat_t_type);
-+		memset(&nat_t_sport, 0, sizeof nat_t_sport);
-+		memset(&nat_t_dport, 0, sizeof nat_t_dport);
-+
-+		/* type = draft-udp-encap-06 */
-+		nat_t_type.sadb_x_nat_t_type_len = sizeof nat_t_type / PF_KEY_V2_CHUNK;
-+		nat_t_type.sadb_x_nat_t_type_exttype = SADB_X_EXT_NAT_T_TYPE;
-+		nat_t_type.sadb_x_nat_t_type_type = UDP_ENCAP_ESPINUDP;
-+		if(pf_key_v2_msg_add(update, (struct sadb_ext *)&nat_t_type, 0) == -1)
-+			goto cleanup;
-+
-+		/* source port */
-+		nat_t_sport.sadb_x_nat_t_port_len = sizeof nat_t_sport / 
-+		                                           PF_KEY_V2_CHUNK;
-+		nat_t_sport.sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_SPORT;
-+		nat_t_sport.sadb_x_nat_t_port_port = sockaddr_port(src);
-+		if(pf_key_v2_msg_add(update, (struct sadb_ext *)&nat_t_sport, 0) == -1)
-+			goto cleanup;
-+
-+		/* destination port */
-+		nat_t_dport.sadb_x_nat_t_port_len = sizeof nat_t_dport / 
-+		                                           PF_KEY_V2_CHUNK;
-+		nat_t_dport.sadb_x_nat_t_port_exttype = SADB_X_EXT_NAT_T_DPORT;
-+		nat_t_dport.sadb_x_nat_t_port_port = sockaddr_port(dst);
-+		if(pf_key_v2_msg_add(update, (struct sadb_ext *)&nat_t_dport, 0) == -1)
-+			goto cleanup;
-+
-+		/* original address (transport mode checksum missing info) goes here */
- #endif
-+    }
- 
- 	if (pf_key_v2_msg_add(update, (struct sadb_ext *)&ssa, 0) == -1)
- 		goto cleanup;
-@@ -1395,10 +1437,6 @@
- 	/*
- 	 * Setup the ADDRESS extensions.
-          */
--	if (incoming)
--		sa->transport->vtbl->get_dst(sa->transport, &src);
--	else
--		sa->transport->vtbl->get_src(sa->transport, &src);
- 	len = sizeof *addr + PF_KEY_V2_ROUND(sysdep_sa_len(src));
- 	addr = calloc(1, len);
- 	if (!addr)
-@@ -2167,7 +2205,7 @@
- 		pf_key_v2_msg_free(ret);
- 	return -1;
- 
--#elif defined (SADB_X_SPDADD) && defined (SADB_X_SPDDELETE)
-+#elif defined (SADB_X_SPDUPDATE) && defined (SADB_X_SPDDELETE)
- 	struct sadb_msg msg;
- 	struct sadb_x_policy *policy = 0;
- 	struct sadb_x_ipsecrequest *ipsecrequest;
-@@ -2181,7 +2219,7 @@
- 	struct sockaddr_in *ip4_sa;
- 	struct sockaddr_in6 *ip6_sa;
- 
--	msg.sadb_msg_type = delete ? SADB_X_SPDDELETE : SADB_X_SPDADD;
-+	msg.sadb_msg_type = delete ? SADB_X_SPDDELETE : SADB_X_SPDUPDATE;
- 	msg.sadb_msg_satype = SADB_SATYPE_UNSPEC;
- 	msg.sadb_msg_seq = 0;
- 	flow = pf_key_v2_msg_new(&msg, 0);
-Index: isakmpd-20041012.orig/isakmp_num.cst
-===================================================================
---- isakmpd-20041012.orig.orig/isakmp_num.cst	2007-06-04 13:22:39.143904504 +0200
-+++ isakmpd-20041012.orig/isakmp_num.cst	2007-06-04 13:22:39.287882616 +0200
-@@ -57,15 +57,18 @@
-   KD				17	# RFC 3547, Key Download
-   SEQ				18	# RFC 3547, Sequence Number
-   POP				19	# RFC 3547, Proof of possession
--  RESERVED_MIN			20
-+  NAT_D				20	# RFC 3947, NAT Discovery payload
-+  NAT_OA			21	# RFC 3947, NAT Original Address payload
-+  RESERVED_MIN			22
-   RESERVED_MAX			127
-   PRIVATE_MIN			128
- # XXX values from draft-ietf-ipsec-nat-t-ike-01,02,03. Later drafts specify
- # XXX NAT_D as payload 15 and NAT_OA as 16, but these are allocated by RFC
- # XXX 3547 as seen above.
--  NAT_D				130	# NAT Discovery payload
--  NAT_OA			131	# NAT Original Address payload
-+  NAT_D_DRAFT			130	# NAT Discovery payload
-+  NAT_OA_DRAFT			131	# NAT Original Address payload
-   PRIVATE_MAX			255
-+  MAX				255
- .
- 
- # ISAKMP exchange types.
-Index: isakmpd-20041012.orig/ipsec_num.cst
-===================================================================
---- isakmpd-20041012.orig.orig/ipsec_num.cst	2007-06-04 13:22:39.149903592 +0200
-+++ isakmpd-20041012.orig/ipsec_num.cst	2007-06-04 13:22:39.287882616 +0200
-@@ -62,10 +62,10 @@
- IPSEC_ENCAP
-   TUNNEL				1
-   TRANSPORT				2
--  FUTURE_UDP_ENCAP_TUNNEL		3	# XXX Not yet assigned
--  FUTURE_UDP_ENCAP_TRANSPORT		4	# XXX Not yet assigned
--  UDP_ENCAP_TUNNEL			61443	# draft-ietf-ipsec-nat-t-ike
--  UDP_ENCAP_TRANSPORT			61443	# draft-ietf-ipsec-nat-t-ike
-+  UDP_ENCAP_TUNNEL			3
-+  UDP_ENCAP_TRANSPORT			4
-+  UDP_ENCAP_TUNNEL_DRAFT		61443	# draft-ietf-ipsec-nat-t-ike
-+  UDP_ENCAP_TRANSPORT_DRAFT		61443	# draft-ietf-ipsec-nat-t-ike
- .
- 
- # IPSEC authentication algorithm.
-Index: isakmpd-20041012.orig/nat_traversal.h
-===================================================================
---- isakmpd-20041012.orig.orig/nat_traversal.h	2007-06-04 13:22:39.154902832 +0200
-+++ isakmpd-20041012.orig/nat_traversal.h	2007-06-04 13:22:39.287882616 +0200
-@@ -1,4 +1,4 @@
--/*	$OpenBSD: nat_traversal.h,v 1.2 2004/06/21 23:27:10 ho Exp $	*/
-+/*	$OpenBSD: nat_traversal.h,v 1.4 2005/07/25 15:03:47 hshoexer Exp $	*/
- 
- /*
-  * Copyright (c) 2004 Håkan Olsson.  All rights reserved.
-@@ -27,6 +27,24 @@
- #ifndef _NAT_TRAVERSAL_H_
- #define _NAT_TRAVERSAL_H_
- 
-+#define VID_DRAFT_V2	0
-+#define VID_DRAFT_V2_N	1
-+#define VID_DRAFT_V3	2
-+#define VID_RFC3947	3
-+
-+struct nat_t_cap {
-+	int		 id;
-+	u_int32_t	 flags;
-+	const char	*text;
-+	char		*hash;
-+	size_t		 hashsize;
-+};
-+
-+/*
-+ * Set if -T is given on the command line to disable NAT-T support.
-+ */
-+extern int	disable_nat_t;
-+
- void	nat_t_init(void);
- int	nat_t_add_vendor_payloads(struct message *);
- void	nat_t_check_vendor_payload(struct message *, struct payload *);
-Index: isakmpd-20041012.orig/message.c
-===================================================================
---- isakmpd-20041012.orig.orig/message.c	2007-06-04 13:22:39.160901920 +0200
-+++ isakmpd-20041012.orig/message.c	2007-06-04 13:22:39.288882464 +0200
-@@ -112,6 +112,7 @@
- 	message_validate_hash, message_validate_sig, message_validate_nonce,
- 	message_validate_notify, message_validate_delete,
- 	message_validate_vendor, message_validate_attribute,
-+	message_validate_nat_d, message_validate_nat_oa,
- 	message_validate_nat_d, message_validate_nat_oa
- };
- 
-@@ -120,7 +121,7 @@
- 	isakmp_id_fld, isakmp_cert_fld, isakmp_certreq_fld, isakmp_hash_fld,
- 	isakmp_sig_fld, isakmp_nonce_fld, isakmp_notify_fld, isakmp_delete_fld,
- 	isakmp_vendor_fld, isakmp_attribute_fld, isakmp_nat_d_fld,
--	isakmp_nat_oa_fld
-+	isakmp_nat_oa_fld, isakmp_nat_d_fld, isakmp_nat_oa_fld
- };
- 
- /*
-@@ -138,7 +139,8 @@
- 	ISAKMP_PAYLOAD_SAK, ISAKMP_PAYLOAD_SAT, ISAKMP_PAYLOAD_KD,
- 	ISAKMP_PAYLOAD_SEQ, ISAKMP_PAYLOAD_POP
- #endif
--	ISAKMP_PAYLOAD_NAT_D, ISAKMP_PAYLOAD_NAT_OA
-+	ISAKMP_PAYLOAD_NAT_D, ISAKMP_PAYLOAD_NAT_OA, 
-+	ISAKMP_PAYLOAD_NAT_D_DRAFT, ISAKMP_PAYLOAD_NAT_OA_DRAFT
- };
- 
- static u_int8_t payload_map[256];
-@@ -347,8 +349,8 @@
- 		}
- 		/* Ignore most private payloads.  */
- 		if (next >= ISAKMP_PAYLOAD_PRIVATE_MIN &&
--		    next != ISAKMP_PAYLOAD_NAT_D &&
--		    next != ISAKMP_PAYLOAD_NAT_OA) {
-+		    next != ISAKMP_PAYLOAD_NAT_D_DRAFT &&
-+		    next != ISAKMP_PAYLOAD_NAT_OA_DRAFT) {
- 			LOG_DBG((LOG_MESSAGE, 30, "message_parse_payloads: "
- 			    "private next payload type %s in payload of "
- 			    "type %d ignored",
-@@ -460,8 +462,10 @@
- 		return ISAKMP_ATTRIBUTE_SZ;
- #if defined (USE_NAT_TRAVERSAL)
- 	case ISAKMP_PAYLOAD_NAT_D:
-+	case ISAKMP_PAYLOAD_NAT_D_DRAFT:
- 		return ISAKMP_NAT_D_SZ;
- 	case ISAKMP_PAYLOAD_NAT_OA:
-+	case ISAKMP_PAYLOAD_NAT_OA_DRAFT:
- 		return ISAKMP_NAT_OA_SZ;
- #endif
- 	/* Not yet supported and any other unknown payloads. */
-Index: isakmpd-20041012.orig/policy.c
-===================================================================
---- isakmpd-20041012.orig.orig/policy.c	2007-06-04 13:22:39.165901160 +0200
-+++ isakmpd-20041012.orig/policy.c	2007-06-04 13:22:39.289882312 +0200
-@@ -511,7 +511,10 @@
- 							break;
- 						}
- #if defined (USE_NAT_TRAVERSAL)
--					else if (decode_16(value) == IPSEC_ENCAP_UDP_ENCAP_TUNNEL)
-+					else if (decode_16(value) ==
-+					    IPSEC_ENCAP_UDP_ENCAP_TUNNEL ||
-+					    decode_16(value) ==
-+					    IPSEC_ENCAP_UDP_ENCAP_TUNNEL_DRAFT)
- 						switch (proto->proto) {
- 						case IPSEC_PROTO_IPSEC_AH:
- 							ah_encapsulation = "udp-encap-tunnel";
-@@ -1932,7 +1935,7 @@
- void
- policy_init(void)
- {
--	char           *ptr, *policy_file;
-+	char           *ptr, *policy_file, *use_keynote;
- 	char          **asserts;
- 	size_t          sz, len;
- 	int             fd, i;
-@@ -1940,10 +1943,11 @@
- 	LOG_DBG((LOG_POLICY, 30, "policy_init: initializing"));
- 
- 	/* Do we want to use the policy modules?  */
--	if (ignore_policy ||
--	    strncmp("yes", conf_get_str("General", "Use-Keynote"), 3))
--		return;
--
-+	use_keynote = conf_get_str("General", "Use-Keynote");
-+	if (ignore_policy || 
-+		(use_keynote && strncmp("yes", use_keynote, 3)))
-+	         return;
-+ 
- 	/* Get policy file from configuration.  */
- 	policy_file = conf_get_str("General", "Policy-file");
- 	if (!policy_file)
-Index: isakmpd-20041012.orig/ike_phase_1.c
-===================================================================
---- isakmpd-20041012.orig.orig/ike_phase_1.c	2007-06-04 13:22:39.170900400 +0200
-+++ isakmpd-20041012.orig/ike_phase_1.c	2007-06-04 13:22:39.290882160 +0200
-@@ -1040,9 +1040,9 @@
- 
- 		/* Compare expected/desired and received remote ID */
- 		if (bcmp(rid, payload->p + ISAKMP_ID_DATA_OFF, sz)) {
--			free(rid);
- 			log_print("ike_phase_1_recv_ID: "
--			    "received remote ID other than expected %s", p);
-+			    "received remote ID other than expected %s - %s", p, payload->p);
-+			free(rid);
- 			return -1;
- 		}
- 		free(rid);
-Index: isakmpd-20041012.orig/x509.c
-===================================================================
---- isakmpd-20041012.orig.orig/x509.c	2007-06-04 13:22:39.176899488 +0200
-+++ isakmpd-20041012.orig/x509.c	2007-06-04 13:22:39.290882160 +0200
-@@ -910,7 +910,11 @@
- 	X509_STORE_CTX_init(&csc, x509_cas, cert, NULL);
- #if OPENSSL_VERSION_NUMBER >= 0x00907000L
- 	/* XXX See comment in x509_read_crls_from_dir.  */
-+#if OPENSSL_VERSION_NUMBER >= 0x00908000L
-+	if (x509_cas->param->flags & X509_V_FLAG_CRL_CHECK) {
-+#else
- 	if (x509_cas->flags & X509_V_FLAG_CRL_CHECK) {
-+#endif
- 		X509_STORE_CTX_set_flags(&csc, X509_V_FLAG_CRL_CHECK);
- 		X509_STORE_CTX_set_flags(&csc, X509_V_FLAG_CRL_CHECK_ALL);
- 	}
-Index: isakmpd-20041012.orig/sysdep/linux/sysdep.c
-===================================================================
---- isakmpd-20041012.orig.orig/sysdep/linux/sysdep.c	2007-06-04 13:22:39.182898576 +0200
-+++ isakmpd-20041012.orig/sysdep/linux/sysdep.c	2007-06-04 13:22:39.291882008 +0200
-@@ -169,22 +169,22 @@
-     return 0;
- 
-   if (!(af == AF_INET || af == AF_INET6))
--    {
-+    { 
-       log_print ("sysdep_cleartext: unsupported protocol family %d", af);
-       return -1;
-     }
- 
-   if (setsockopt (fd, af == AF_INET ? IPPROTO_IP : IPPROTO_IPV6,
--		  af == AF_INET ? IP_IPSEC_POLICY : IPV6_IPSEC_POLICY,
--		  &pol_in, sizeof pol_in) < 0 ||
-+          af == AF_INET ? IP_IPSEC_POLICY : IPV6_IPSEC_POLICY,
-+          &pol_in, sizeof pol_in) < 0 ||
-       setsockopt (fd, af == AF_INET ? IPPROTO_IP : IPPROTO_IPV6,
--		  af == AF_INET ? IP_IPSEC_POLICY : IPV6_IPSEC_POLICY,
--		  &pol_out, sizeof pol_out) < 0)
--    {
-+          af == AF_INET ? IP_IPSEC_POLICY : IPV6_IPSEC_POLICY,
-+          &pol_out, sizeof pol_out) < 0)
-+    { 
-       log_error ("sysdep_cleartext: "
--		 "setsockopt (%d, IPPROTO_IP%s, IP%s_IPSEC_POLICY, ...) "
--		 "failed", fd, af == AF_INET ? "" : "V6",
--		 af == AF_INET ? "" : "V6");
-+         "setsockopt (%d, IPPROTO_IP%s, IP%s_IPSEC_POLICY, ...) "
-+         "failed", fd, af == AF_INET ? "" : "V6",
-+         af == AF_INET ? "" : "V6");
-       return -1;
-     }
-   return 0;
-Index: isakmpd-20041012.orig/sysdep/linux/GNUmakefile.sysdep
-===================================================================
---- isakmpd-20041012.orig.orig/sysdep/linux/GNUmakefile.sysdep	2007-06-04 13:22:39.187897816 +0200
-+++ isakmpd-20041012.orig/sysdep/linux/GNUmakefile.sysdep	2007-06-04 13:22:39.291882008 +0200
-@@ -33,13 +33,13 @@
- LDADD+=		-lgmp ${LIBSYSDEP} ${LIBCRYPTO}
- DPADD+=		${LIBGMP} ${LIBSYSDEP}
- 
--CFLAGS+=	-DUSE_OLD_SOCKADDR -DHAVE_PCAP \
--		-DNEED_SYSDEP_APP -DMP_FLAVOUR=MP_FLAVOUR_GMP \
--		-I/usr/src/linux/include -I${.CURDIR}/sysdep/common \
-+CFLAGS+=	-DHAVE_GETNAMEINFO -DUSE_OLD_SOCKADDR -DHAVE_PCAP \
-+		-DNEED_SYSDEP_APP -DMP_FLAVOUR=MP_FLAVOUR_GMP -DUSE_AES \
-+		-I${.CURDIR}/sysdep/linux/include -I${.CURDIR}/sysdep/common \
- 		-I/usr/include/openssl
- 
- FEATURES=	debug tripledes blowfish cast ec aggressive x509 policy
--FEATURES+=	des aes
-+FEATURES+=	dpd nat_traversal isakmp_cfg des aes
- 
- IPSEC_SRCS=	pf_key_v2.c
- IPSEC_CFLAGS=	-DUSE_PF_KEY_V2
-@@ -51,7 +51,7 @@
- # hack libsysdep.a dependenc
- ${LIBSYSDEPDIR}/.depend ${LIBSYSDEP}:
- 	cd ${LIBSYSDEPDIR} && \
--		${MAKE} --no-print-directory ${MAKEFLAGS} \
-+		${MAKE} --no-print-directory \
- 			CFLAGS="${CFLAGS}" MKDEP="${MKDEP}" ${MAKECMDGOALS}
- 
- ifeq ($(findstring clean,$(MAKECMDGOALS)),clean)
-Index: isakmpd-20041012.orig/sysdep/linux/include/bitstring.h
-===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ isakmpd-20041012.orig/sysdep/linux/include/bitstring.h	2007-06-04 13:22:39.291882008 +0200
-@@ -0,0 +1,132 @@
-+/*	$OpenBSD: bitstring.h,v 1.4 2002/06/19 02:50:10 millert Exp $	*/
-+/*	$NetBSD: bitstring.h,v 1.5 1997/05/14 15:49:55 pk Exp $	*/
-+
-+/*
-+ * Copyright (c) 1989, 1993
-+ *	The Regents of the University of California.  All rights reserved.
-+ *
-+ * This code is derived from software contributed to Berkeley by
-+ * Paul Vixie.
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ *    notice, this list of conditions and the following disclaimer.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ *    notice, this list of conditions and the following disclaimer in the
-+ *    documentation and/or other materials provided with the distribution.
-+ * 3. All advertising materials mentioning features or use of this software
-+ *    must display the following acknowledgement:
-+ *	This product includes software developed by the University of
-+ *	California, Berkeley and its contributors.
-+ * 4. Neither the name of the University nor the names of its contributors
-+ *    may be used to endorse or promote products derived from this software
-+ *    without specific prior written permission.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
-+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
-+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-+ * SUCH DAMAGE.
-+ *
-+ *	@(#)bitstring.h	8.1 (Berkeley) 7/19/93
-+ */
-+
-+#ifndef _BITSTRING_H_
-+#define	_BITSTRING_H_
-+
-+/* modified for SV/AT and bitstring bugfix by M.R.Murphy, 11oct91
-+ * bitstr_size changed gratuitously, but shorter
-+ * bit_alloc   spelling error fixed
-+ * the following were efficient, but didn't work, they've been made to
-+ * work, but are no longer as efficient :-)
-+ * bit_nclear, bit_nset, bit_ffc, bit_ffs
-+ */
-+typedef	unsigned char bitstr_t;
-+
-+/* internal macros */
-+				/* byte of the bitstring bit is in */
-+#define	_bit_byte(bit) \
-+	((bit) >> 3)
-+
-+				/* mask for the bit within its byte */
-+#define	_bit_mask(bit) \
-+	(1 << ((bit)&0x7))
-+
-+/* external macros */
-+				/* bytes in a bitstring of nbits bits */
-+#define	bitstr_size(nbits) \
-+	(((nbits) + 7) >> 3)
-+
-+				/* allocate a bitstring */
-+#define	bit_alloc(nbits) \
-+	(bitstr_t *)calloc((size_t)bitstr_size(nbits), sizeof(bitstr_t))
-+
-+				/* allocate a bitstring on the stack */
-+#define	bit_decl(name, nbits) \
-+	((name)[bitstr_size(nbits)])
-+
-+				/* is bit N of bitstring name set? */
-+#define	bit_test(name, bit) \
-+	((name)[_bit_byte(bit)] & _bit_mask(bit))
-+
-+				/* set bit N of bitstring name */
-+#define	bit_set(name, bit) \
-+	((name)[_bit_byte(bit)] |= _bit_mask(bit))
-+
-+				/* clear bit N of bitstring name */
-+#define	bit_clear(name, bit) \
-+	((name)[_bit_byte(bit)] &= ~_bit_mask(bit))
-+
-+				/* clear bits start ... stop in bitstring */
-+#define	bit_nclear(name, start, stop) do { \
-+	register bitstr_t *_name = name; \
-+	register int _start = start, _stop = stop; \
-+	while (_start <= _stop) { \
-+		bit_clear(_name, _start); \
-+		_start++; \
-+		} \
-+} while(0)
-+
-+				/* set bits start ... stop in bitstring */
-+#define	bit_nset(name, start, stop) do { \
-+	register bitstr_t *_name = name; \
-+	register int _start = start, _stop = stop; \
-+	while (_start <= _stop) { \
-+		bit_set(_name, _start); \
-+		_start++; \
-+		} \
-+} while(0)
-+
-+				/* find first bit clear in name */
-+#define	bit_ffc(name, nbits, value) do { \
-+	register bitstr_t *_name = name; \
-+	register int _bit, _nbits = nbits, _value = -1; \
-+	for (_bit = 0; _bit < _nbits; ++_bit) \
-+		if (!bit_test(_name, _bit)) { \
-+			_value = _bit; \
-+			break; \
-+		} \
-+	*(value) = _value; \
-+} while(0)
-+
-+				/* find first bit set in name */
-+#define	bit_ffs(name, nbits, value) do { \
-+	register bitstr_t *_name = name; \
-+	register int _bit, _nbits = nbits, _value = -1; \
-+	for (_bit = 0; _bit < _nbits; ++_bit) \
-+		if (bit_test(_name, _bit)) { \
-+			_value = _bit; \
-+			break; \
-+		} \
-+	*(value) = _value; \
-+} while(0)
-+
-+#endif /* !_BITSTRING_H_ */
-Index: isakmpd-20041012.orig/sysdep/linux/include/sys/queue.h
-===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ isakmpd-20041012.orig/sysdep/linux/include/sys/queue.h	2007-06-04 13:22:39.292881856 +0200
-@@ -0,0 +1,453 @@
-+/*
-+ * Copyright (c) 1991, 1993
-+ *	The Regents of the University of California.  All rights reserved.
-+ *
-+ * Redistribution and use in source and binary forms, with or without
-+ * modification, are permitted provided that the following conditions
-+ * are met:
-+ * 1. Redistributions of source code must retain the above copyright
-+ *    notice, this list of conditions and the following disclaimer.
-+ * 2. Redistributions in binary form must reproduce the above copyright
-+ *    notice, this list of conditions and the following disclaimer in the
-+ *    documentation and/or other materials provided with the distribution.
-+ * 3. All advertising materials mentioning features or use of this software
-+ *    must display the following acknowledgement:
-+ *	This product includes software developed by the University of
-+ *	California, Berkeley and its contributors.
-+ * 4. Neither the name of the University nor the names of its contributors
-+ *    may be used to endorse or promote products derived from this software
-+ *    without specific prior written permission.
-+ *
-+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
-+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
-+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-+ * SUCH DAMAGE.
-+ *
-+ *	@(#)queue.h	8.5 (Berkeley) 8/20/94
-+ * $FreeBSD: src/sys/sys/queue.h,v 1.45 2001/12/11 11:49:58 sheldonh Exp $
-+ */
-+
-+#ifndef _SYS_QUEUE_H_
-+#define	_SYS_QUEUE_H_
-+
-+//#include <machine/ansi.h>	/* for __offsetof */
-+
-+/*
-+ * This file defines four types of data structures: singly-linked lists,
-+ * singly-linked tail queues, lists and tail queues.
-+ *
-+ * A singly-linked list is headed by a single forward pointer. The elements
-+ * are singly linked for minimum space and pointer manipulation overhead at
-+ * the expense of O(n) removal for arbitrary elements. New elements can be
-+ * added to the list after an existing element or at the head of the list.
-+ * Elements being removed from the head of the list should use the explicit
-+ * macro for this purpose for optimum efficiency. A singly-linked list may
-+ * only be traversed in the forward direction.  Singly-linked lists are ideal
-+ * for applications with large datasets and few or no removals or for
-+ * implementing a LIFO queue.
-+ *
-+ * A singly-linked tail queue is headed by a pair of pointers, one to the
-+ * head of the list and the other to the tail of the list. The elements are
-+ * singly linked for minimum space and pointer manipulation overhead at the
-+ * expense of O(n) removal for arbitrary elements. New elements can be added
-+ * to the list after an existing element, at the head of the list, or at the
-+ * end of the list. Elements being removed from the head of the tail queue
-+ * should use the explicit macro for this purpose for optimum efficiency.
-+ * A singly-linked tail queue may only be traversed in the forward direction.
-+ * Singly-linked tail queues are ideal for applications with large datasets
-+ * and few or no removals or for implementing a FIFO queue.
-+ *
-+ * A list is headed by a single forward pointer (or an array of forward
-+ * pointers for a hash table header). The elements are doubly linked
-+ * so that an arbitrary element can be removed without a need to
-+ * traverse the list. New elements can be added to the list before
-+ * or after an existing element or at the head of the list. A list
-+ * may only be traversed in the forward direction.
-+ *
-+ * A tail queue is headed by a pair of pointers, one to the head of the
-+ * list and the other to the tail of the list. The elements are doubly
-+ * linked so that an arbitrary element can be removed without a need to
-+ * traverse the list. New elements can be added to the list before or
-+ * after an existing element, at the head of the list, or at the end of
-+ * the list. A tail queue may be traversed in either direction.
-+ *
-+ * For details on the use of these macros, see the queue(3) manual page.
-+ *
-+ *
-+ *			SLIST	LIST	STAILQ	TAILQ
-+ * _HEAD		+	+	+	+
-+ * _HEAD_INITIALIZER	+	+	+	+
-+ * _ENTRY		+	+	+	+
-+ * _INIT		+	+	+	+
-+ * _EMPTY		+	+	+	+
-+ * _FIRST		+	+	+	+
-+ * _NEXT		+	+	+	+
-+ * _PREV		-	-	-	+
-+ * _LAST		-	-	+	+
-+ * _FOREACH		+	+	+	+
-+ * _FOREACH_REVERSE	-	-	-	+
-+ * _INSERT_HEAD		+	+	+	+
-+ * _INSERT_BEFORE	-	+	-	+
-+ * _INSERT_AFTER	+	+	+	+
-+ * _INSERT_TAIL		-	-	+	+
-+ * _REMOVE_HEAD		+	-	+	-
-+ * _REMOVE		+	+	+	+
-+ *
-+ */
-+
-+/*
-+ * Singly-linked List declarations.
-+ */
-+#define	SLIST_HEAD(name, type)						\
-+struct name {								\
-+	struct type *slh_first;	/* first element */			\
-+}
-+
-+#define	SLIST_HEAD_INITIALIZER(head)					\
-+	{ NULL }
-+ 
-+#define	SLIST_ENTRY(type)						\
-+struct {								\
-+	struct type *sle_next;	/* next element */			\
-+}
-+ 
-+/*
-+ * Singly-linked List functions.
-+ */
-+#define	SLIST_EMPTY(head)	((head)->slh_first == NULL)
-+
-+#define	SLIST_FIRST(head)	((head)->slh_first)
-+
-+#define	SLIST_FOREACH(var, head, field)					\
-+	for ((var) = SLIST_FIRST((head));				\
-+	    (var);							\
-+	    (var) = SLIST_NEXT((var), field))
-+
-+#define	SLIST_INIT(head) do {						\
-+	SLIST_FIRST((head)) = NULL;					\
-+} while (0)
-+
-+#define	SLIST_INSERT_AFTER(slistelm, elm, field) do {			\
-+	SLIST_NEXT((elm), field) = SLIST_NEXT((slistelm), field);	\
-+	SLIST_NEXT((slistelm), field) = (elm);				\
-+} while (0)
-+
-+#define	SLIST_INSERT_HEAD(head, elm, field) do {			\
-+	SLIST_NEXT((elm), field) = SLIST_FIRST((head));			\
-+	SLIST_FIRST((head)) = (elm);					\
-+} while (0)
-+
-+#define	SLIST_NEXT(elm, field)	((elm)->field.sle_next)
-+
-+#define	SLIST_REMOVE(head, elm, type, field) do {			\
-+	if (SLIST_FIRST((head)) == (elm)) {				\
-+		SLIST_REMOVE_HEAD((head), field);			\
-+	}								\
-+	else {								\
-+		struct type *curelm = SLIST_FIRST((head));		\
-+		while (SLIST_NEXT(curelm, field) != (elm))		\
-+			curelm = SLIST_NEXT(curelm, field);		\
-+		SLIST_NEXT(curelm, field) =				\
-+		    SLIST_NEXT(SLIST_NEXT(curelm, field), field);	\
-+	}								\
-+} while (0)
-+
-+#define	SLIST_REMOVE_HEAD(head, field) do {				\
-+	SLIST_FIRST((head)) = SLIST_NEXT(SLIST_FIRST((head)), field);	\
-+} while (0)
-+
-+/*
-+ * Singly-linked Tail queue declarations.
-+ */
-+#define	STAILQ_HEAD(name, type)						\
-+struct name {								\
-+	struct type *stqh_first;/* first element */			\
-+	struct type **stqh_last;/* addr of last next element */		\
-+}
-+
-+#define	STAILQ_HEAD_INITIALIZER(head)					\
-+	{ NULL, &(head).stqh_first }
-+
-+#define	STAILQ_ENTRY(type)						\
-+struct {								\
-+	struct type *stqe_next;	/* next element */			\
-+}
-+
-+/*
-+ * Singly-linked Tail queue functions.
-+ */
-+#define	STAILQ_EMPTY(head)	((head)->stqh_first == NULL)
-+
-+#define	STAILQ_FIRST(head)	((head)->stqh_first)
-+
-+#define	STAILQ_FOREACH(var, head, field)				\
-+	for((var) = STAILQ_FIRST((head));				\
-+	   (var);							\
-+	   (var) = STAILQ_NEXT((var), field))
-+
-+#define	STAILQ_INIT(head) do {						\
-+	STAILQ_FIRST((head)) = NULL;					\
-+	(head)->stqh_last = &STAILQ_FIRST((head));			\
-+} while (0)
-+
-+#define	STAILQ_INSERT_AFTER(head, tqelm, elm, field) do {		\
-+	if ((STAILQ_NEXT((elm), field) = STAILQ_NEXT((tqelm), field)) == NULL)\
-+		(head)->stqh_last = &STAILQ_NEXT((elm), field);		\
-+	STAILQ_NEXT((tqelm), field) = (elm);				\
-+} while (0)
-+
-+#define	STAILQ_INSERT_HEAD(head, elm, field) do {			\
-+	if ((STAILQ_NEXT((elm), field) = STAILQ_FIRST((head))) == NULL)	\
-+		(head)->stqh_last = &STAILQ_NEXT((elm), field);		\
-+	STAILQ_FIRST((head)) = (elm);					\
-+} while (0)
-+
-+#define	STAILQ_INSERT_TAIL(head, elm, field) do {			\
-+	STAILQ_NEXT((elm), field) = NULL;				\
-+	*(head)->stqh_last = (elm);					\
-+	(head)->stqh_last = &STAILQ_NEXT((elm), field);			\
-+} while (0)
-+
-+#define	STAILQ_LAST(head, type, field)					\
-+	(STAILQ_EMPTY(head) ?						\
-+		NULL :							\
-+	        ((struct type *)					\
-+		((char *)((head)->stqh_last) - __offsetof(struct type, field))))
-+
-+#define	STAILQ_NEXT(elm, field)	((elm)->field.stqe_next)
-+
-+#define	STAILQ_REMOVE(head, elm, type, field) do {			\
-+	if (STAILQ_FIRST((head)) == (elm)) {				\
-+		STAILQ_REMOVE_HEAD(head, field);			\
-+	}								\
-+	else {								\
-+		struct type *curelm = STAILQ_FIRST((head));		\
-+		while (STAILQ_NEXT(curelm, field) != (elm))		\
-+			curelm = STAILQ_NEXT(curelm, field);		\
-+		if ((STAILQ_NEXT(curelm, field) =			\
-+		     STAILQ_NEXT(STAILQ_NEXT(curelm, field), field)) == NULL)\
-+			(head)->stqh_last = &STAILQ_NEXT((curelm), field);\
-+	}								\
-+} while (0)
-+
-+#define	STAILQ_REMOVE_HEAD(head, field) do {				\
-+	if ((STAILQ_FIRST((head)) =					\
-+	     STAILQ_NEXT(STAILQ_FIRST((head)), field)) == NULL)		\
-+		(head)->stqh_last = &STAILQ_FIRST((head));		\
-+} while (0)
-+
-+#define	STAILQ_REMOVE_HEAD_UNTIL(head, elm, field) do {			\
-+	if ((STAILQ_FIRST((head)) = STAILQ_NEXT((elm), field)) == NULL)	\
-+		(head)->stqh_last = &STAILQ_FIRST((head));		\
-+} while (0)
-+
-+/*
-+ * List declarations.
-+ */
-+#define	LIST_HEAD(name, type)						\
-+struct name {								\
-+	struct type *lh_first;	/* first element */			\
-+}
-+
-+#define	LIST_HEAD_INITIALIZER(head)					\
-+	{ NULL }
-+
-+#define	LIST_ENTRY(type)						\
-+struct {								\
-+	struct type *le_next;	/* next element */			\
-+	struct type **le_prev;	/* address of previous next element */	\
-+}
-+
-+/*
-+ * List functions.
-+ */
-+
-+#define	LIST_EMPTY(head)	((head)->lh_first == NULL)
-+
-+#define	LIST_FIRST(head)	((head)->lh_first)
-+
-+#define	LIST_FOREACH(var, head, field)					\
-+	for ((var) = LIST_FIRST((head));				\
-+	    (var);							\
-+	    (var) = LIST_NEXT((var), field))
-+
-+#define	LIST_INIT(head) do {						\
-+	LIST_FIRST((head)) = NULL;					\
-+} while (0)
-+
-+#define	LIST_INSERT_AFTER(listelm, elm, field) do {			\
-+	if ((LIST_NEXT((elm), field) = LIST_NEXT((listelm), field)) != NULL)\
-+		LIST_NEXT((listelm), field)->field.le_prev =		\
-+		    &LIST_NEXT((elm), field);				\
-+	LIST_NEXT((listelm), field) = (elm);				\
-+	(elm)->field.le_prev = &LIST_NEXT((listelm), field);		\
-+} while (0)
-+
-+#define	LIST_INSERT_BEFORE(listelm, elm, field) do {			\
-+	(elm)->field.le_prev = (listelm)->field.le_prev;		\
-+	LIST_NEXT((elm), field) = (listelm);				\
-+	*(listelm)->field.le_prev = (elm);				\
-+	(listelm)->field.le_prev = &LIST_NEXT((elm), field);		\
-+} while (0)
-+
-+#define	LIST_INSERT_HEAD(head, elm, field) do {				\
-+	if ((LIST_NEXT((elm), field) = LIST_FIRST((head))) != NULL)	\
-+		LIST_FIRST((head))->field.le_prev = &LIST_NEXT((elm), field);\
-+	LIST_FIRST((head)) = (elm);					\
-+	(elm)->field.le_prev = &LIST_FIRST((head));			\
-+} while (0)
-+
-+#define	LIST_NEXT(elm, field)	((elm)->field.le_next)
-+
-+#define	LIST_REMOVE(elm, field) do {					\
-+	if (LIST_NEXT((elm), field) != NULL)				\
-+		LIST_NEXT((elm), field)->field.le_prev = 		\
-+		    (elm)->field.le_prev;				\
-+	*(elm)->field.le_prev = LIST_NEXT((elm), field);		\
-+} while (0)
-+
-+/*
-+ * Tail queue declarations.
-+ */
-+#define	TAILQ_HEAD(name, type)						\
-+struct name {								\
-+	struct type *tqh_first;	/* first element */			\
-+	struct type **tqh_last;	/* addr of last next element */		\
-+}
-+
-+#define	TAILQ_HEAD_INITIALIZER(head)					\
-+	{ NULL, &(head).tqh_first }
-+
-+#define	TAILQ_ENTRY(type)						\
-+struct {								\
-+	struct type *tqe_next;	/* next element */			\
-+	struct type **tqe_prev;	/* address of previous next element */	\
-+}
-+
-+/*
-+ * Tail queue functions.
-+ */
-+#define	TAILQ_EMPTY(head)	((head)->tqh_first == NULL)
-+
-+#define	TAILQ_FIRST(head)	((head)->tqh_first)
-+
-+#define	TAILQ_FOREACH(var, head, field)					\
-+	for ((var) = TAILQ_FIRST((head));				\
-+	    (var);							\
-+	    (var) = TAILQ_NEXT((var), field))
-+
-+#define	TAILQ_FOREACH_REVERSE(var, head, headname, field)		\
-+	for ((var) = TAILQ_LAST((head), headname);			\
-+	    (var);							\
-+	    (var) = TAILQ_PREV((var), headname, field))
-+
-+#define	TAILQ_INIT(head) do {						\
-+	TAILQ_FIRST((head)) = NULL;					\
-+	(head)->tqh_last = &TAILQ_FIRST((head));			\
-+} while (0)
-+
-+#define	TAILQ_INSERT_AFTER(head, listelm, elm, field) do {		\
-+	if ((TAILQ_NEXT((elm), field) = TAILQ_NEXT((listelm), field)) != NULL)\
-+		TAILQ_NEXT((elm), field)->field.tqe_prev = 		\
-+		    &TAILQ_NEXT((elm), field);				\
-+	else								\
-+		(head)->tqh_last = &TAILQ_NEXT((elm), field);		\
-+	TAILQ_NEXT((listelm), field) = (elm);				\
-+	(elm)->field.tqe_prev = &TAILQ_NEXT((listelm), field);		\
-+} while (0)
-+
-+#define	TAILQ_INSERT_BEFORE(listelm, elm, field) do {			\
-+	(elm)->field.tqe_prev = (listelm)->field.tqe_prev;		\
-+	TAILQ_NEXT((elm), field) = (listelm);				\
-+	*(listelm)->field.tqe_prev = (elm);				\
-+	(listelm)->field.tqe_prev = &TAILQ_NEXT((elm), field);		\
-+} while (0)
-+
-+#define	TAILQ_INSERT_HEAD(head, elm, field) do {			\
-+	if ((TAILQ_NEXT((elm), field) = TAILQ_FIRST((head))) != NULL)	\
-+		TAILQ_FIRST((head))->field.tqe_prev =			\
-+		    &TAILQ_NEXT((elm), field);				\
-+	else								\
-+		(head)->tqh_last = &TAILQ_NEXT((elm), field);		\
-+	TAILQ_FIRST((head)) = (elm);					\
-+	(elm)->field.tqe_prev = &TAILQ_FIRST((head));			\
-+} while (0)
-+
-+#define	TAILQ_INSERT_TAIL(head, elm, field) do {			\
-+	TAILQ_NEXT((elm), field) = NULL;				\
-+	(elm)->field.tqe_prev = (head)->tqh_last;			\
-+	*(head)->tqh_last = (elm);					\
-+	(head)->tqh_last = &TAILQ_NEXT((elm), field);			\
-+} while (0)
-+
-+#define	TAILQ_LAST(head, headname)					\
-+	(*(((struct headname *)((head)->tqh_last))->tqh_last))
-+
-+#define	TAILQ_NEXT(elm, field) ((elm)->field.tqe_next)
-+
-+#define	TAILQ_PREV(elm, headname, field)				\
-+	(*(((struct headname *)((elm)->field.tqe_prev))->tqh_last))
-+
-+#define	TAILQ_REMOVE(head, elm, field) do {				\
-+	if ((TAILQ_NEXT((elm), field)) != NULL)				\
-+		TAILQ_NEXT((elm), field)->field.tqe_prev = 		\
-+		    (elm)->field.tqe_prev;				\
-+	else								\
-+		(head)->tqh_last = (elm)->field.tqe_prev;		\
-+	*(elm)->field.tqe_prev = TAILQ_NEXT((elm), field);		\
-+} while (0)
-+
-+
-+#ifdef _KERNEL
-+
-+/*
-+ * XXX insque() and remque() are an old way of handling certain queues.
-+ * They bogusly assumes that all queue heads look alike.
-+ */
-+
-+struct quehead {
-+	struct quehead *qh_link;
-+	struct quehead *qh_rlink;
-+};
-+
-+#ifdef	__GNUC__
-+
-+static __inline void
-+insque(void *a, void *b)
-+{
-+	struct quehead *element = (struct quehead *)a,
-+		 *head = (struct quehead *)b;
-+
-+	element->qh_link = head->qh_link;
-+	element->qh_rlink = head;
-+	head->qh_link = element;
-+	element->qh_link->qh_rlink = element;
-+}
-+
-+static __inline void
-+remque(void *a)
-+{
-+	struct quehead *element = (struct quehead *)a;
-+
-+	element->qh_link->qh_rlink = element->qh_rlink;
-+	element->qh_rlink->qh_link = element->qh_link;
-+	element->qh_rlink = 0;
-+}
-+
-+#else /* !__GNUC__ */
-+
-+void	insque __P((void *a, void *b));
-+void	remque __P((void *a));
-+
-+#endif /* __GNUC__ */
-+
-+#endif /* _KERNEL */
-+
-+#endif /* !_SYS_QUEUE_H_ */
-Index: isakmpd-20041012.orig/sysdep/common/pcap.h
-===================================================================
---- isakmpd-20041012.orig.orig/sysdep/common/pcap.h	2007-06-04 13:22:39.203895384 +0200
-+++ isakmpd-20041012.orig/sysdep/common/pcap.h	2007-06-04 13:22:39.292881856 +0200
-@@ -55,8 +55,13 @@
- 	u_int32_t linktype;	/* data link type (DLT_*) */
- };
- 
-+struct pcap_timeval {
-+	int32_t tv_sec;		/* seconds */
-+	int32_t tv_usec;	/* microseconds */
-+};
-+
- struct pcap_pkthdr {
--	struct timeval ts;	/* time stamp */
-+	struct pcap_timeval ts;	/* time stamp */
- 	u_int32_t caplen;	/* length of portion present */
- 	u_int32_t len;		/* length this packet (off wire) */
- };
-Index: isakmpd-20041012.orig/sysdep/common/libsysdep/arc4random.c
-===================================================================
---- isakmpd-20041012.orig.orig/sysdep/common/libsysdep/arc4random.c	2007-06-04 13:22:39.211894168 +0200
-+++ isakmpd-20041012.orig/sysdep/common/libsysdep/arc4random.c	2007-06-04 13:22:39.292881856 +0200
-@@ -78,7 +78,7 @@
- static void
- arc4_stir(struct arc4_stream *as)
- {
--	int     fd;
-+	int     fd, i;
- 	struct {
- 		struct timeval tv;
- 		u_int8_t rnd[128 - sizeof(struct timeval)];
-Index: isakmpd-20041012.orig/x509v3.cnf
-===================================================================
---- /dev/null	1970-01-01 00:00:00.000000000 +0000
-+++ isakmpd-20041012.orig/x509v3.cnf	2007-06-04 13:22:39.293881704 +0200
-@@ -0,0 +1,26 @@
-+# default settings
-+CERTPATHLEN             = 1
-+CERTUSAGE               = digitalSignature,keyCertSign
-+CERTIP                  = 0.0.0.0
-+CERTFQDN                = nohost.nodomain
-+
-+# This section should be referenced when building an x509v3 CA
-+# Certificate.
-+# The default path length and the key usage can be overriden
-+# modified by setting the CERTPATHLEN and CERTUSAGE environment 
-+# variables.
-+[x509v3_CA]
-+basicConstraints=critical,CA:true,pathlen:$ENV::CERTPATHLEN
-+keyUsage=$ENV::CERTUSAGE
-+
-+# This section should be referenced to add an IP Address
-+# as an alternate subject name, needed by isakmpd
-+# The address must be provided in the CERTIP environment variable
-+[x509v3_IPAddr]
-+subjectAltName=IP:$ENV::CERTIP
-+
-+# This section should be referenced to add a FQDN hostname
-+# as an alternate subject name, needed by isakmpd
-+# The address must be provided in the CERTFQDN environment variable
-+[x509v3_FQDN]
-+subjectAltName=DNS:$ENV::CERTFQDN