CVS log for kame/CHANGELOG

2008-10-03  JINMEI, Tatuya  <jinmei@isc.org>
	* kame/sys/netinet6/nd6_nbr.c (nd6_ns_input),
	  kame/sys/netinet6/nd6_rtr.c (nd6_rs_input):
	added stricter validation on source address (for reference purpose
	only).

2007-05-17  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/icmp6.c: Disabled responding to NI queries
	from a global address by default as specified in RFC4620.
	It can be re-enabled by setting the 0x8 flag of
	net.inet6.icmp6.nodeinfo.

fixed a memory leak in unresolved ND queue processing. (Reported by Hikaru Abe)

2006-10-25  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/route6d/route6d.c (riprecv): implemented more
	validation checks about incoming responses per RFC2080, and one
	additional heuristic check for safer operation.

2006-10-25  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/rip6query/rip6query.c (main): added some new options
	various options to customize the packet.

stop updating MLDv1-compat-timer when an MLDv2 Query is received
in MLDv1-compat-mode (the 2006-09-06's commit is not enough)

stop updating MLDv1-compat-timer when an MLDv2 Query is received in
MLDv1-compat-mode (a bug due to a commit 2006-09-04)

let a loop-backed IPv6 packet go to lo0's BPF, while software-emulated
loopbacked ethernet frame still goes to the physical I/F's BPF.

This closes the todo issue of the following item in CHANGELOG.2000.

  > Tue May 30 01:29:04 JST 2000  itojun@iijlab.net
  ...
  > XXX if_simloop() call from ip6_output() causes junk to be injected
  > to bpf buffer.  we may need some fix separately from this commit.

(suggested by Max Laier)

does not search MSF by 'fmode' in case of SIOCGMSFILTER or SIOCGIPMSFILTER.
(RFC3768 5.1.2 and 5.2.2)

fixed several bugs regarding MLDv2 (suggested by Yu-Jung Lee)
  - returns an error code when the MSF state change fails due to a
    lack of memory
  - fixed a bug that an MLDv2 State-Change Report is not always
    advertised robustness-variables times.
  - MLDv1-compat-timer properly checks the current compat-timer
    status

use ifdef for IGMPv3/MLDv2-related state macros to prevent a macro duplication
in userland applications.  (suggested by Hitoshi Asaeda)

fixed a kernel crash in freebsd5 when MSF advanced-API is used in a kernel with IGMPV3 option on.

fixed a bug that MSF advanced-API is rejected in case of IPv4

RFC4285 is implemented.

2006-04-23  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/nd6.c (nd6_is_addr_neighbor): disabled the
	on-link assumption from the determination logic.

2006-04-09  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_mroute.c (ip6_mrouter_done): used
	if_allmulti(0) for diabling the multicast promiscuous mode for
	FreeBSD.  Without this change, an IPv6 multicast router would
	leave interfaces in the promiscuous mode even after the routing
	daemon terminates.

fixed a bug that an MLDv2 IS-IN Report is not advertised for an MLDv2 general Query

kame/sys/netinet6/ip6_output.c: fixed a kernel crash by an ASM join
from a userland application (KAME PR sys/932)

fixed several bugs regarding MLDv2-timer

fixed a kernel crash due to a double-free introduced in the below fix

fixed a memory leak for an unresolved packet in ND queue

implements section 2.2. of RFC4191, regarding the reserved preference value (10).

wording

Fri Mar  3 20:20:37 JST 2006    keiichi@iijlab.net
        * netbsd/sys/netinet6/in6_pcb.c: send an IPV6_PATHMTU ancillary
        data when sending a packet which size is larger than the path
        mtu to the destination.

removed the dhcpv6-related programs, since they are now maintained/developed/released in wide-dhcpv6 project in sourceforge.net

fixed a bug that no MLDv2 report is advertised when host state changes
from IN/EX to EX/IN, respectively. (the previous patch to mldv2.c was
not enough)

2006-02-24  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/icmp6.c (icmp6_redirect_input): fixed a bug
	that a Redirect couldn't be processed correctly if the original
	packet contained an extension header.
	Pointed out by: Qing Li

fixed a bug that no MLDv2 report is advertised when host state changes from IN/EX to EX/IN, respectively.

Reported by: Yu-Jung Lee

<200602>
2006-02-01  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd5/sys/kern/uipc_mbuf.c (m_pullup): fixed memory leak when
	the original mbuf had an mtag and the pull-up operation required
	allocating a new mbuf.
	Reported by: Garfield Hsieh

not reply an ICMPv6 Error message for a packet from an obvious anycast address

<200601>
2006-01-09  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd5/sys/netinet6/in6_pcb.c (in6_{set,peer}sockaddr):
	converted embedded scope zone IDs into the sin6_scope_id field
	appropriately.
	Reported by: Susan.Lan

Proxy DAD is supported

not reinitialize the host-variables in kernel to the ones at the start-up time, since RA is a stateless autoconfiguration protocol.

Suggested by: Hideaki YOSHIFUJI

fixed a MLDv2-kernel crash when an inappropriate address is given to IPV6_JOIN_GROUP API

wording

2005-10-15  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* raw_ip6.c (rip6_attach): caught failure of MALLOC for
	icmp6_filter.  The old could dereference to a NULL pointer in the
	failure case.

removed the following multicast-related programs, since they are
now maintained/developed/released in mcast-tools project.
	pim6sd (including mtrace6) pim6dd mfc mcastsend mcastread pmsft

Tue Sep 20 14:09:07 JST 2005	keiichi@iijlab.net
	*kame/{free|net}bsd/lib/libipsec
	stop installing libipsec.  The main user of the library was
	racoon, but racoon is not distributed from the KAME kit
	(instead, it is provided from ipsec-tools with libipsec).  We
	don't have a strong reason to install the library now.

	also, the basic functions of the libipsec are already being
	provided from the base distributions of FreeBSD and NetBSD.

- support compilation on linux
- dhcp6relay can listen to multiple interfaces
- dhcp6s ignores the received DHCP message unless it comes from the
  listening interface

Contributed by: Francis Dupont

removed the following entry, since now we don't need our own res_init.

2005-09-15  SUZUKI, Shinsuke <suz@alaxala.net>
	* freebsd5/lib/libinet6: use KAME's res_init() to enable KAME-specific
	changes for DNS-resolver.

noted the relationship between getaddinfo change and resolver bug.

2005-09-15  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/libinet6/getaddrinfo.c: removed IPPROTO_SCTP from the
	explore array for SOCK_DGRAM, according to the usage described in
	draft-ietf-tsvwg-sctpsocket-11.txt.
	Also removed IPPROTO_DCCP entries altogether, since returning DCCP
	addrinfo for SOCK_DGRAM has a bad effect on some existing UDP
	applications.  We'll need to revisit this once the DCCP API is
	fixed.

use KAME's res_init() to enable KAME-specific changes for DNS-resolver.

2005-09-14  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/nd6_nbr.c (nd6_na_input): fixed incorrect
	comparison introduced with cleanups on Aug 24th.  This made NUD
	unworkable, so all KAME snap kernels since then should be
	upgraded.

typo
(hint: ispell is Emacser's friend)

Thu Aug 25 14:21:44 JST 2005	keiichi@iijlab.net
	* kame/sys/net/pfkeyv2.h,kame/sys/netinet6/ipsec.c,
	  kame/sys/netkey/key,c,key.h,key_debug.c
	- added SADB_X_PACKET message type to deliver the information
	  of triggering packet of IKE negotiation when sending a
	  KEY_ACQUIRE message.  This change should not cause any
	  binary compatibility issues, but if you found any, let us
	  know.

	  Great thanks to Francis Dupont for this extention.

fixed a kernel crash at the start-up time of an IPv6 multicast program (pim6[sd]d, mfc)

- fixed a kernel crash due to a IN_MULTI locking failure.
- supports IN_MULTI locking in igmpv3

- introduced a fine-grain-locking for interface-address list and
  in_multi list.
- use malloc() with M_NOWAIT when joining a multicast group in layer2,
  drivers.  Error handling routine is also added when malloc() fails.
  This is to prevent unnecessary locking failure. (e.g. nd-proxy)

Obtained from: freebsd-net
ToDo: support it on IGMPv3

ports some MLDv1 enhancements into MLDv2.
 - use callout timer mechanism for protocol timer
 - impose a random delay (when necessary) according to rfc2462bis

wording

2005-07-26  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/route6d: route6d now does not care about the kernel
	internal form for scoped addresses at all.  In particular, can
	transparently specify the source of a RIPng response as a gateway
	address through the routing socket.

2005-07-26  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* netbsd, openbsd: applied the same changes for routing sockets as
	those for FreeBSD (see the next entry).

2005-07-23  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd5/sys/net/rtsock.c: added support for IPv6 scoped
	  addresses for routing sockets:
	- route_output() now accepts IPv6 addresses with non-0
	  sin6_scope_id field and converts those into the kernel internal
	  form.
	- rt_msg[12]() recovers the embedded scope zone ID and set the
	  sin6_scope_id field appropriately.
	* freebsd5/sbin/{ifconfig,route}: got rid of ugly (but still
	incomplete) special cases for IPv6 link-local addresses thanks to
	this change.

FreeBSD Security Advisory FreeBSD-SA-05:17.devfs

2005-07-22  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6: fixed memory leak for renew/rebind event data.
	(KAME PR 872 reported by Meng Huan Hsieh)

2005-07-22  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/in6_src.c: allowed an application to send a
	packet to a scoped address without explicitly disambiguating the
	scope zone but with specifying the outgoing interface.  It's a bad
	practice and should be discouraged, but such code has been spread,
	unfortunately.

2005-07-16  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_output.c (ip6_output): do not send
	ctlinput notification unconditionally when an outgoing packet is
	larger than the link MTU.  From FreeBSD.

fixed an interoperability problem in AES-XCBC-MAC96 (encryption
was always done with the same key)

 Submitted from: Yukiyo Akisada <akisada@64translator.com>

implemented a static MRIB for RPF calculation.

       * kame/kame/ndp/ndp.c
       fixed the proxy directive to work properly.

applied recent security fixes on freebsd5

2005-06-22  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd5/sys/netinet6/in6_pcb.c (init_sin6): corrected argument
	to sa6_recoverscope().  The previous code since June 17th's change
	could modify invalid memory space (while the possibility should be
	very rare) so upgrading is necessary.

A bug of unit mismatch is fixed

	added dccp modification status

2005-06-17  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/in6_ifattach.c (in6_ifattach): do not
	auto-configure link-local addresses on loopback or PPP interfaces.
	The latter is based on a comment from Francis Dupont.

2005-06-17  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/nd6.c (nd6_need_cache): perform NUD on PPP
	interfaces.

2005-06-17  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* {kame,*bsd}/sys/(various files): revised scope-related
	interfaces, clarifying the relationship between the
	kernel-internal form and the public sockaddr_in6 form.  Details
	are described in kame/IMPLEMENTATION.  External behavior basically
	should not change, although several bugs in minor cases were also
	fixed with the clarification.  Some scope-related functions were
	deprecated.

2005-05-21  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/in6.c (in6_if2idlen): supported IFT_PPP.

(forgot to commit)

fixed a bug that some of the subcommands in 'ndp -i ..' command does not work (e.g. accept_rtadv, nud)

send a Multicast-Listener-Done message when stop listening to a group.
(this fix is necessary if MLDv2 is enabled in kernel and
 net.inet6.icmp6.mld_version is set to 1)

Wed May 25 12:20:25 JST 2005	keiichi@iijlab.net
	* kame/kame/shisa: now shisa daemons uses configuration files
	instead of command line options.  please check sample
	configuratoin files located in the shisa directory.

assign the same ioctl number to MSF-API-related ioctls among all *BSDs (to keep binary compatibilities as much as possible)

wording

2005-05-14  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/libinet6/getaddrinfo.c (matchlen): corrected a wrong
	cast from a sockaddr_in to sockaddr_in6.

FreeBSD-Security-Advisory FreeBSD-SA-05:09.htt

sync with 5.4-RELEASE (it includes a fix for the FreeBSD Security Advisory FreeBSD-SA-05:06-08)

2005-05-03  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6/dhcp6c_ia.c (ia_timo): kept the latest server's
	DUID even in the REBIND state in case of sending a Release message
	in that state.

<200505>
2005-05-03  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6/cfparse.y: corrected "address parameters" so
	that we don't have to specify the meaningless (but mandatory)
	prefix length in the context of IA_NA.

2005-05-03  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6/config.c (configure_commit): made sure that
	interface parameters are initialized with the default values even
	if the interface is not explicitly configured in the configuration
	file.  This particularly made sure that the preference option is
	not included unless explicitly specified.  A memory leakage for
	the client when specifying a script file was also fixed.

2005-04-29  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6/dhcp6c.c (client6_mainloop): corrected error
	handling for select(2) in order to avoid unexpected blocking when
	receiving a signal.

* freebsd[45]/usr.sbin/Makefile,netbsd/usr.sbin/Makefile:
racoon was removed from the make list.

stop including ip6fw in FreeBSD5's KAME-SNAP, since FreeBSD5's ip6fw is enough
(KAME's ip6fw does not have any function different from ip6fw)

wording

2005-04-27  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/in6.c (in6_update_ifa): always updated
	ia6_updatetime regardless of whether the address is created or
	updated.  This is necessary so that the expiration times will be
	updated	correctly when the lifetiems of an existing address is
	modified by hand or by a process such as a DHCPv6 client.

2005-04-26  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6/addrconf.c (na_ifaddrconf): corrected lifetime
	arguments to ifaddrconf().

fattach.c: fixed a kernel crash by a lock-order-reversal in freebsd5

FreeBSD Security Advisory  FreeBSD-SA-05:04.ifconf

reflect the following MLDv2 changes into the NetBSD/OpenBSD's IGMPv3 implementation

fixed an copy&paste error

fixed a kernel crash by an IGMP packet (a bug introduced in the change at 2005-04-14)

modified another file to implement the following:
	  IGMPv3 treats 224.0.0.x(x!=1) as a normal IPv4 multicast address,
	  as specified in RFC3766.

* IGMPv3 treats 224.0.0.x(x!=1) as a normal IPv4 multicast address,
  as specified in RFC3766.

* reflect the following MLDv2 changes into the NetBSD/OpenBSD's IGMPv3
  implementation:
-- renames IGMPv3-ready in_multi{} manipulation functions (2004-02-05)

fixed the byte order of an IPv4 address for IN_XXX macros (freebsd-only)

remove freebsd[234]-specific code, since they are no longer supported in KAME-SNAP

renames IGMPv3-ready in_multi{} manipulation functions to reduce the number
of "ifdef IGMPV3" (as done for MLDv2 at Feb 5, 2004)

specifies spl()s as done in original FreeBSD5

reflect the following MLDv2 changes into the FreeBSD5's IGMPv3 implementation.
 - fixs a kernel crash by an IGMPv3 Query (2005-01-01)
 - retransmits IGMPv3 report RobustnessVariable times (2004-12-31)
 - corrects an MLD-query handling when MaxResponseCode=0 (2004-12-27)
 - introduces a sysctl option to force IGMP version (2004-07-09)

FreeBSD-SA-05:02.sendfile

when the number of the packets queued in a NDP cache exceed the limit,
discard the oldest packet, as specified in RFC2461 7.2.2.

limits the number of fragmented packets stored in a NDP cache

reflect router-variables in RA configuration into host-variables in kernel.

2005-03-30  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6/addrconf.c (update_address): make sure that
	the lifetimes of addresses are updated when the client receives a
	Reply in response to Renew or Rebind.

added a sanity check for the IPv4 address embedded in the configured IPv6 address

added a knob to enable path MTU discovery for multicast packets.
(by default, it is disabled)

fixed a kernel crash due to a LOR by a multicast-group join without
specifying any receiving interface.

implemented a knob to fulfil the spec in the last paragraph of RFC2461 pp.43-44

makes SCTP compilable on FreeBSD5 (SCTP behavior is not confirmed yet)

* kame/kame/racoon/isakmp.c:
one of buffer overrun problem was fixed.  from ipsec-tools team.

mention sctp new patch

fix a DHCPv6-Client initialization failure when a node has no IPv6 global address.
DHCPv6-Client often encounters such situation, since it is normally used to obtain a global IPv6 address (through prefix-delegation or stateful-address-autoconfiguration).

ToDo: other client program is really free from this problem?

supports multiple client-side interfaces on dhcp6-relay

fixed a freebsd5 kernel crash when WITNESS debug option is enabled.
(M_WAITOK leads to an assertion failure when a non-sleepable
fine-grain-lock exists and WITNESS debug option is on. If this option is off,
M_WAITOK is just regarded as M_NOWAIT)

babymdd is introduced as a new movement detection daemon

integrated dhcp6lc functionality into dhcp6c ('i' option), so dhcp6lc is removed

2005-02-28  Tsuyoshi MOMOSE  <momose@az.jp.nec.com>
	* kame/sys/net/mipsock.c, kame/kame/shisad/mnd.c: Fixed word alignment
	problems.

fixed a bug that PF discards every packet with option headers.

Reported by: Stig Venaas

fixed PF malfunction for inbound IPv6 traffic on freebsd5

2005-02-15  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ipsec.c: (ipsec[46]_in_reject): fixed
	unexpected panic on freebsd5.

Today is February...

FreeBSD4.10->4.11

2005-01-31  Tsuyoshi MOMOSE  <momose@az.jp.nec.com>
        * kame/sys/netinet6/mip6.c: stop proxy ND on a home agent when
        the home agent daemon was terminated.
        This problem was found by Christian Vogt<chvogt@tm.uka.de>.

temporary remedy to fix an IPv6 packet output failure when an ICMPv6 Redirect
message announces that the destination is onlink.
(the NDP entry created by ICMPv6 Redirect is mistaken as a permanent one
 in nd6_output())

ToDo: further consideration for much more generic solution.
(e.g. assign some lifetime to such non-permanent entries when creating
an NDP entry in nd6_lookup())

fixed a loss of fragmented packets when the corresponding NDP state is not resolved.

ignores an ICMPv6 code field when receiving an ICMPv6 Packet-Too-Big. (RFC2463 3.2)

fixed a path MTU discovery failure on FreeBSD5.

fixed an ICMPv6 Redirect message corruption

implemented stateful non-temporary address assignment using DHCPv6.

fixed an unexpected addr/port matching failure in SA management.

fixed a NetBSD kernel crash by referring to an uninitialized variable.

netbsd 2.0

fixed date:-)

- fixed a kernel crash by an MLDv2 Query (Multicast Address and Source Specific Query).
- happy new year!

fixed a bug that MLDv2 report is not retransmitted RobustnessVariable times

corrected an MLD-query handling when MaxResponseDelay=0.

removed a white space at EOL

added a per-I/F timer to refresh a (possibly) stale cached route towards the tunnel end.  (same as the fix to in_gif.c at Oct 23 2001)

2004-12-09  MOMOSE, Tsuyoshi  <momose@az.jp.nec.com>
	* Mobile IPv6 codes are entirly changed. Most of codes are
	moved to userland from kernel. And now it also supports NEMO
	basic. It works on FreeBSD4, FreeBSD5 and NetBSD.

Thu Dec  9 12:55:19 JST 2004 <sakane@tanu.org>
	* kame/kame/racoon/ipsec_doi.c:
	In main mode with pre-shared key, the address type is only allowed
	in the Interop consensus.  however Cisco PIX uses the FQDN type often.
	so the FQDN type is allowed as the phase1 ID.

2004-12-07  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/libinet6/getaddrinfo.c (getaddrinfo): fixed missing
	initialization of the addrconfig structure.  KAME snaps since
	20041129 must be upgraded to apply this fix.

2004-12-07  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/libinet6/getaddrinfo.c: synchronized with FreeBSD5.3's
	getaddrinfo implementation:
	- ensure thread-safeness
	- use nsswitch.conf instead of host.conf

2004-12-03  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd5/lib/libinet6/res_send.c (res_send): made sure this
	function return a valid value.

2004-12-03  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6/common.c: silenced strict-aliasing warnings.
	Otherwise dhcp6 could not be built with -O2 on FreeBSD 5.3.
	(KAME-PR 851)

2004-12-02  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6/config.c (configure_commit): corrected list
	management operation.  (mostly harmless, but it was incorrect.)
	From: Nicolas Dichtel

fixed a committing date

2004-12-02  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd5/lib/libinet6: imported some res_* files and related
	header files from FreeBSD's source tree to be synchronized with
	KAME's local changes.  libinet6 now includes getaddrinfo().

FreeBSD Security Advisory: FreeBSD-SA-04:17.procfs

2004-12-02  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* *bsd/sys/netinet/tcp_subr.c (tcp[6]_notify):  implemented quick
	fall-back optimization as described in
	draft-gont-tcpm-tcp-soft-errors-01.

<200412>

supports TCP-MD5(IPv4) on FreeBSD5.

ISATAP supported on OpenBSD

revived ISATAP on NetBSD, because the IPR issue has been solved

revived ISATAP on freebsd5, since the IPR issue has been solved!
(ToDo: freebsd4, netbsd, openbsd)

2004-11-30  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd4/sys/netinet/tcp_subr.c (tcp_notify): implemented quick
	fall-back optimization as described in
	draft-gont-tcpm-tcp-soft-errors-01.

wording

2004-11-28  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6: catch up draft-ietf-dhc-lifetime-02.
	Specifically,
	- renamed "lifetime" to "refreshtime".  Note that configuration
	  compatibility was lost.
	- implemented the default and minimum timer values
	- clarified that the refresh time option can only be available for
	  Information-request and reply exchanges

2004-11-28  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/libinet6/getaddrinfo.c (res_queryN): set an
	appropriate limit of query timeouts in order to mitigate hopeless
	delay due to misbehaving DNS servers ignoring AAAA queries.
	getaddrinfo() now sends A queries first with this change, but the
	query ordering does not affect the ordering of the resulting
	addrinfo list.
	(FreeBSD only at the moment)

grammar

2004-11-27  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/libinet6/getaddrinfo.c (set_source): fixed a bug that
	deprecated source addresses was not correctly identified for
	address ordering (RFC3484).

2004-11-27  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/libinet6/getaddrinfo.c: suppress AAAA queries if the
	node does not have IPv6 addresses other than the loopback and
	link-local addresses.  Additionally, AI_ADDRCONFIG is now more
	specification compliant in that getaddrinfo() only issues AAAA
	queries when the node has non-loopback addresses.

removed the following note from the change log on Nov18 by suz.
  (RFC2460 section 4.4 needs an update)

2004-11-18  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/in6.c (in6_if2idlen): introduced a new
	function, which was previously a local module "if2idlen", and
	called it when necessary.  With this change we do not store the
	IFID length in in6_ifextra{}.  It did not always work as intended
	due to initialization timing issues.

removed the previous fix on Nov 12, since it can lead to a buffer overrun.
(RFC2460 section 4.4 needs an update)

openbsd: switch to 3.6

a Type-0 Routing-header is skipped if Segments Left is set to zero, regardless of the Hdr-Ext-Len value. (RFC2460 section 4.4)

freebsd5.3+kame gets stable enough at least for minimam everyday use
(advanced features, such as ALTQ, MLDv2 etc, are not checked yet)

catch up with freebsd53

<200411>
2004-11-08  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd4/sys/netinet/tcp_input.c (tcp_mssopt): corrected the
	default MSS computation for TCP/IPv6.

* sys/netinet6/nd6_rtr.c: remove "onlink assumption" handling code.

Tue Oct 26 15:42:56 JST 2004    keiichi@iij.ad.jp
        * kame/sys/netinet6/icmp6.c: fixed a freebsd5 kernel crash due to a
        LOR caused by ICMPv6 redirect.

2004-10-21  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/nd6_rtr.c (in6_ifadd): made sure that the
	"new" address does not happen to have been configured already.
	Otherwise, the same address can be doubly configured under some
	rare conditions.

fixed a freebsd5 kernel crash due to a LOR caused by ICMPv6 redirect

FreeBSD Security Advisory: FreeBSD-SA-04:15.syscons

<200410>
2004-10-01  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/in6_rmx.c (in6_clsroute):
	* freebsd4/sys/netinet/in_rmx.c (in_clsroute):
	avoided duplicate free (and system crash) when
	net.inet[6].ip[6].rtexpire is set to 0.

removed a "Bad malloc flag" warning on freebsd5.

style: removed some space chars at EOL

2004-09-07  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6: provided a new command "dhcp6ctl", deprecating
	dhcp6sctl.  This new command controls the client as well as the
	server.  For the client, the "start" and "stop" (which can specify
	a particular interface) commands are available.

<200409>
2004-09-04  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6: added the ability of dhcp6c to work on multiple
	interfaces simultaneously.

wording

added a blank line

Thu Aug 12 12:54:25 JST 2004    keiichi@iij.ad.jp
        * kame/sys/netinet6/nd6.c,in6_src.c
        made it possible to specify the address of the other side of
        a p2p interface as nexthop when sending a packet with
        the NEXTHOP pktoption.

2004-08-11  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/ndp/ndp.c (ifinfo): supported the "disabled" ndp flag
	to view or modify the status of whether IPv6 operation is disabled
	on the interface. (see also the next log entry)

2004-08-11  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/nd6_nbr.c (nd6_dad_duplicated):
	* kame/sys/netinet6/ip6_input.c (ip6intr):
	* kame/sys/netinet6/nd6.c (nd6_output):
	disabled IPv6 operation if DAD fails if the interface identifier
	is based on EUI-64 ID which is supposed to be unique
	(clarification in rfc2462bis).

rewound timestamp of a "future" change:-)

* freebsd5/sbin/ifconfig/ifconfig.c: stopped unnecessary kernel module loading
* kame/pmsft: protocol-independent Multicast-Source-Filter testing tool

2004-08-11  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/nd6_rtr.c (prelist_update): applied
	clarification on the prefix length check in rfc2462bis:
	- any prefix length is now accepted for on-link determination
	- determine the appropriate length based on the link type, rather
	  than on the prefix value (visible behavior should be same
	  though)

<200408>

builds DHCPv6 in FreeBSD5

Sun Aug  1 04:07:45 2004  SUMIKAWA Munechika  <sumikawa@ebina.hitachi.co.jp>
	* freebsd4: Upgrade to 4.10-RELEASE

2004-07-31  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6/dhcp6c.c (main): made sure to dump the correct
	PID in the background mode.
	* kame/kame/dhcp6/dhcp6s.c (process_auth): corrected the timing to
	set the realm length.  Without this, dhcp6s could crash when
	processing authentication information.
	From: Kensaku Fujimoto

2004-07-30  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6: relocated some configuration files.
	Automatically-generated DUID files are now in /var/db.  All the
	other configuration files should be put under /usr/local/v6/etc
	by default for consistency.
	Note: This change may affect the compatibility with old
	configurations.

wording

2004-07-30  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6/dhcp6s.c: allowed a Request/Renew/Release
	message to be unicasted when it is forwarded from a relay.
	From: Bilal Ahmed

removed a "malloc() failure" warning message at start-up time on freebsd5.

(M_WAIT(mbuf flag) is equal to M_WAITOK(malloc() flag) in every BSD
 except freebsd5, so this problem occurs only in freebsd5)

today's commit summary

byebye ip6.int

English grammar

folded a long line

* fixed a wrong S-flag handling.
* uses TCP-hostcache framework for pMTU discovery in freebsd5,
  so that pMTU discovery on TCP works fine.

fixed a freebsd5 kernel crash by "ndp -P" command.

* kame/sys/netinet6/in6.c: fixed a freebsd5 kernel crash due to LOR.
* freebsd5/sys/netinet6/in6_pcb.c: fixed a bug that some TCP/UDP packets
  does not go outside on freebsd5.

folded a long line

2004-07-10  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* *bsd/usr.sbin/Makefile: stopped building KAME bgpd.  It has
	reached the end of life.

fixed a bug that that MLDv1/v2 query is not advertised when a router becomes a new querier

implemented a sysctl option to force MLD version in MLDv2-ready kernel.

freebsd5+kame starts up properly (other behavior is to be confirmed).

2004-07-06  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netkey/key.c (key_spddump, key_dump): fixed possible
	infinite loops.

pim6dd has also been fixed

fixed a bug that pim6sd cannot receive PIM messages on MLDv2-ready kernel.

2004-07-05  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/nd6_rtr.c (prelist_update): ignored manually
	configured addresses to decide whether to autoconfigure a new
	address from an RA. (This is a clarification in rfc2462bis-02.)

2004-07-05  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/mld6.c: use as high clock granularity as
	possible (i.e., per 10 msec) for protocol timers.

2004-07-05  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/(many places): revised delay for DAD according
	to rfc2462bis-02: impose a random delay (when necessary) before
	sending the corresponding MLD report, while still listening to the
	multicast group, not just delaying a DAD NS.

<200407>
2004-07-03  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_output.c (ip6_ctloutput): fixed the use of
	an uninitialized pointer for the IPV6_IPSEC_POLICY socket option
	on FreeBSD.  All FreeBSD users using IPv6 IPsec must apply this
	fix.  Snaps since 20040524 are affected.

2004-06-30  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/libinet6/name6.c (_dns_ghbyaddr): plugged a memory
	leak.  All KAME snaps need this fix, and it is recommended to
	update libinet6 and all snap applications with this fix.

(note: no need to merge)

removed white space after EOL

2004-06-16  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/in6.c (in6_update_ifa): do not attempt to join
	multicast groups or to perform DAD when an existing address is
	modified.  This change will avoid unnecessary memory
	consumption in this case.

MLDv1-compat-mode related fixes

2004-06-12  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6: added control channel for the server so that
	the administrator can reload the server or remove a particular
	binding.  A new command "dhcp6sctl" was added for this purpose.
	This is a very experimental support, and may change in the near
	future.

authentication support is not only for the client but also for the server.

2004-06-10  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6/dhcp6c.c: supported the delayed authentication
	protocol as specified in RFC3315 for secure DHCPv6 exchanges
	between the client and the server(s).

fixed a bug that pim6sd never return from MLDv1-compat-mode to MLDv2-mode
if MLDv1 listener disappears but MLDv2 listener remains.

doesn't increment MLD statistics counter when an MLD packet is not transmitted by some reason.

pim6sd now transmits MLDv2 Group-Specific Query, if necessary

- accepts MLDv2 Group-Specific Query
- specifies MLDv2 filter_mode based on the received MLDv2 report type

decides the MLD-compat-mode based on an arriving MLDv1/v2 packet.

When pim6sd receives a MLDv1 done from an interface, it advertises a
group-specific Query in MLDv2 unless the interface is configured only
with MLDv1.

This is to prevent MLDv2 hosts from shifting to MLDv1-compatible-mode
unnecessarily.

FreeBSD Security Advisory: FreeBSD-SA-04:12.jailroute

discard ALLOW_NEW_SOURCES without any source in MLDv1 compat mode,
since it's a meaningless MLDv2-REPORT.

discard MLDv2 packets with hoplimit != 1
(draft-vida-mld-v2-08.txt section 6.2 mandates it, although RFC2710 does not
explicitly mention it).

some MLDv2 related bugs are fixed

2004-06-01  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_input.c (ip6_savecontrol): do not check
	the current process or thread in the input path.  It is
	unnecessary and can even prohibit a legitimate process from
	getting the information.

FreeBSD Security Advisory: FreeBSD-SA-04:11.msync

openbsd 3.5

netkey now supports sleep/wakeup

- don't send MLDv1 Query even in MLDv1-compat mode to prevent MLDv2 hosts
  from unnecessarily shifting to MLDv1-compatible mode
  (see draft-vida-mld-v2-08.txt section 8.3.2 p.47)
- don't send MLDv2 General Query when it is not a querier
- implements start-up query timer for MLDv2

sync with FreeBSD 5.2.1-RELEASE.
 ToDo:
	- reflect changes by FreeBSD community into KAME repository
	- test ...
	- additional features like ALTQ, MIP6, SSM, ...

fixed a bug that (*,G) entry is not created with static-rp configuration
once PIM neighboring goes down and up toward RP.

fixed a bug that (*,G) entry is not created at RP router when the RP address
is specified in static-rp configuration.

2004-05-19  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/nd6.c (nd6_output): simply returned an error
	if rtalloc1() provided a route to an unexpected interface.
	Based on a discussion for KAME PR 615 with Luigi Rizzo.

2004-05-18  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* {net,open}bsd/include/netdb.h (AI_ADDRCONFIG): defined the flag.

2004-05-16  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* *bsd/include/netdb.h: added a new error code EAI_OVERFLOW
	defined in RFC3493.
	* kame/kame/libinet6/getaddrinfo.c: supported EAI_OVERFLOW in
	gai_strerror().
	* kame/kame/libinet6/getnameinfo.c: use EAI_OVERFLOW (instead of
	EAI_MEMORY) for the error of short buffers.

receives MLDv2 TO_EX{NULL} report properly

	* kame/kame/dhcp6: added a set of bug fixes and cleanups based on
	comments and patches from Hiro Muraji:
	- fixed the bug that IA_PD sub options were not correctly
	  recognized when more than one option was provided

wording

2004-05-14  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6: added a set of bug fixes and cleanups based on
	comments from Hiro Muraji:
	- avoided casting when pointers can be unnaturally aligned,
	  for alignment sensitive architectures
	- fixed the bug that IA_PD sub options were not correctly
	  recognized when more than one options were provided
	- dropped DHCPv6 packets when IA_PD_PREFIX appears outside of
	  IA_PD (this seems to be a saner behavior)
	- corrected some log message formats

fixed an IPv6 per-interface MSF calculation failure when MSF is in EXCLUDE mode

silently ignore an advanced MSF-API call (instead of returning EINVAL) when the requested MSF is same as the one stored in kernel.

2004-04-21  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_output.c (ip6_ctloutput): simplified the
	fix to FreeBSD-SA-04:06.ipv6 (merged from FreeBSD to KAME on
	040406).  The previous one worried too much about parameters even
	though we actually validate them in subroutines.  This code also
	is more compatible with other *BSDs, which do copyin within
	setsockopt().

ICMPv6 packets regarding multicast routing (e.g. MLDv1 report) shouldn't be
a target of MSF, although draft-vida-mld-v2-08.txt says only MLDv2 is such
exception.
(otherwise multicast routing process cannot receive such packets, which
prevents it from shifting to MLDv1-compatible-mode)

fixed a MLDv2-enabled freebsd[45] kernel crash due to an improper termincation of layer2 multicast listening.
(ToDo: same fix is necesary for freebsd[45]/sys/netinet/in.c)

All MLDv2-capable routers multicast address has been officially assigned as "ff02::16"

2004-04-18  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/libinet6/getaddrinfo.c (explore_numeric): re-enabled
	the special case for AF_INET (use inet_aton instead of inet_pton)
	as required in RFC3493.  getaddrinfo now accepts the "classful"
	form of IPv4 addresses.

2004-04-17  kjc@csl.sony.co.jp
	* kame/sys/altq/
	build altq under freebsd5-current.
	submitted by Max Laier <max@love2party.net>

* freebsd4/sys/netinet/ip_input.c:
* kame/sys/netinet6/natpt_trans.c:
- Fixed a compile error when you enable a NATPT/NATPT-NAT kernel option.

ICMPv6-Type number has been officially assigned to MLDv2-Listener-REPORT

2004-04-13  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/libinet6/getaddrinfo.c (getaddrinfo): clean-up:
	removed the definition of the AI_V4MAPPED and AI_ALL flags (when
	they are defined), and removed incomplete support for the flags.

2004-04-13  itojun
	* kame/kame/libinet6/getaddrinfo.c (getaddrinfo): added support
	for the AI_NUMERICSERV flag.

2004-04-10  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/libinet6/getaddrinfo.c (reorder): made sure to call
	set_source() to set the source address information for each
	candidate of destination.  This was lost by accident in April
	2003, and the destination address ordering has been incomplete
	since then.

* kame/kame/racoon/proposal.c:
fixed the EXACT mode to compare the proposals.  the lifetime in phase2
did not work in the case of EXACT mode.  reported by <vanhu@free.fr>.

renamed the name of the changed files

FreeBSD Security Advisory: FreeBSD-SA-04:06.ipv6

moved the 0403 tag to the correct position.

- makes kame/freebsd5 compilable.
- uses per-socket/interface MSF-check function for IPv4 and IPv6 for all the *BSDs

code cleanup: uses a generic per-socket/interface MSF-check function

implemented a per-socket/interface MSF-check function for IPv4

* kame/sys/netkey/key.c:
fixed that a memory leak happend in the case that the compile
option, IPSEC_DOSEQCHECK was defined and called key_update().

* kame/kame/tcpdump/print-isakmp.c:
fixed that there was a possibility tcpdump(8) fell into infinite loop.
and the problem was at print-isakmp.c, so racoon also fell into it
when the debug option was used.

code cleanup: uses a per-socket/interface MSF-check functions implemented at Feb 6 2004.

FreeBSD's multicast-related macros assumes IPv4 address is formatted in host-byte-order.

ToDo: code refinement to share IGMPv3 codes among *BSDs.

udp cksum

* kame/kame/racoon/isakmp.c:
fixed a critical bug in the case of FreeBSD.  racoon will reject
the packet in which the value of the length field is too big.
however the problem is due to malloc(3) of FreeBSD.

fixed a kernel crash when an IGMPv3/MLDv2 Advanced-API function is used on freebsd[45]

wording

2004-03-21  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6: added experimental support for the lifetime
	option based on draft-ietf-dhc-lifetime-00.txt.  dhcp6c now
	restart information-request/reply exchanges when it has received
	the option and the lifetime expires.

I still need a change to revice IGMPv3/MLDv2 completely

to receive an MLD report for any group,
mld6query behaves like an IPv6 multicast daemon, instead of joining to ::.
If cannot, just transmits MLDv1 Queries.

modified another file to revive IGMPv3/MLDv2

english wording

* dest6.c: A Binding Error against a packet includes an invalid
home address is sent only when the packet is not Binding Update.
This problem was found by the v6pc conformance test tool and fixed
with help by Noriko Mizusawa <mizusawa@mitaka.ntt-at.co.jp> in the
team.

netbsd 1.6.2

IGMPv3/MLDv2 works again

2004-03-14  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd4/sys/kern/uipc_syscalls.c (sockargs): allow more than
	MLEN bytes for ancillary data to meet the requirement in Section
	20.1 of RFC3542.  (Still not large enough though, because the new
	upper limit is MCLBYTES).

2004-03-13  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/mld6.c (mld_input): use a local sockaddr_in6
	structure to match multicast addresses in order to handle
	multicast scope correctly.
	In response to a report from Kentarou.Oohara@jp.yokogawa.com.

2004-03-12  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/nd6.c (nd6_output): fixed overkilling about
	the "dst" argument to this function.  The caller side were fixed
	accordingly.  This change also contains a bug fix about incorrect
	arguments to rtalloc1().

2004-03-12  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_output. (ip6_output): recovered some
	features related address scope lost for a while:
	- use scope6_check_id() for the first hop of a routing header in
	  case the default scope zone is specified and the 1st hop is a
	  scoped address.
	- recovered scope zone boundary check in ip6_output().  Without
	  this, an application can originate a packet that breaks the
	  scope boundary for the source or destination address.

typo

wording

2004-03-10  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet/icmp6.h (ICMP6_MEMBERSHIP_REDUCTION): defined
	an alias of MLD_LISTENER_DONE to be compliant to RFC3542.

additional note about a previous change:
multicasted echo requests were not properly responded.

2004-03-10  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_mroute.c (ip6_mdq): recovered scope zone
	check.

wording

2004-03-10  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/icmp6.c (icmp6_reflect): made sure to provide
	a valid sockaddr_in6 structure with regards to scope zone.  With
	the previous the code a forwarding node could not return an ICMPv6
	error if the source of the erroneous packet was link-local.

2004-03-10  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_forward.c (ip6_forward): recovered scope
	zone boundary check for the destination address.

2004-03-09  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_output.c (ip6_setmoptions): disallowed the
	use of the unspecified address for IPV6_JOIN_GROUP and
	IPV6_LEAVE_GROUP.  The special case is not documented in the
	official API specification, and for whatever purpose, this should
	actually have not been working for a long time.

FreeBSD Security Advisory: FreeBSD-SA-04:04.tcp

2004-02-28  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_output.c (ip6_setmoptions): explicitly
	handle the case where a non-0 interface index points to a NULL
	ifp in the process of IPV6_LEAVE_GROUP.

ipcomp/tunnel input is not implemented yet

ipcomp/tunnel

applies per-socket MSF at ICMPv6 layer, instead of IPv6 layer,
to stop rejecting MLDv2 Group/Source-Group-Specific Queries.

ToDo: *BSDs, IGMPv3, confirm behaviour...

2004-02-14  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/ifmcstat/ifmcstat.c (in[6]_multientry): avoid
	inserting redundant blank lines.

2004-02-13  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd4/sys/netinet6/in6_pcb.c (in6_setsockaddr):
	* freebsd4/sys/netinet6/in6_pcb.c (in6_setpeeraddr):
	corrected the behavior of these functions for scoped addresses
	(had been buggy for a very short period).

2004-02-13  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/ping6/ping6.c (pr_pack): printed the arriving
	interface index explicitly with the -v option, instead of setting
	sin6_scope_id to the index automatically (the latter is not always
	correct).

2004-02-13  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/icmp6.c (icmp6_error2): introduced as a
	wrapper for icmp6_error() to recover lost scope zone information
	(if any).  This also fixed a recent bug that an ICMPv6 error when
	ND failed cannot be returned for a scoped destination.

2004-02-13  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/icmp6.c (icmp6_reflect): fixed a very recent
	bug that source address selection did not check the correct
	address.

Fri Feb 13 12:03:32 JST 2004	keiichi@iij.ad.jp
	draft-ietf-mip6-mipext-advapi-00 support.

FreeBSD Security Advisory: FreeBSD-SA-04:02.shmat

created per-socket/per-interface MSF-check function

refines MLDv2-code for maintenance convenience
 - creates mldv2.c to concentrate almost all the MLDv2-related functions here
 - renamed MLDv2-ready in6_multi manupulation functions

back to embedded scopeid

fixed date

sync with mldv2-20031021 to prohibit improper MSF delta-API call.

<200402>
2004-02-01  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/mcastread/mcastread.c (get_socket): set the
	SO_REUSEPORT option for the receiving socket so that multiple
	processes on a node can run this program for the same group and
	port.

wording

2004-01-26  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/mld6.c (mld6_input):
	* kame/kame/pim6sd/mld6.c (accept_mld6):
	discarded MLD packets with the unspecified source address as
	specified in RFC3590.

sctp items

Sat Jan 24 18:18:27 JST 2004	keiichi@iij.ad.jp
	* kame/sys/net/if_hif.[hc], kame/sys/netinet6/mip6_icmp6.c
	made a mobile node send a mobile prefix solicitation message
	when it receives an unsolicited mobile prefix adv message.
	detected by the v6pc certification WG test suite.

Sat Jan 24 18:15:08 JST 2004	keiichi@iij.ad.jp
	* kame/sys/netinet6/mip6_mncore.c
	- made a mobile node send a mobile prefix solicitation message
	  when it receives a binding ack message with status code 1.
	- made a mobile node send a home registration message before
	  the current binding expires even when a refresh interval
	  is not explicitly specified by its home agent.
	detected by the v6pc certification WG test suite.

Added '-N' option to mip6control

2004-01-22  MOMOSE Tsuyoshi  <t-momose@netlab.nec.co.jp>
        * kame/kame/had/haadic.c:
        A global home agent address is registerred even
        if on-link flag in a prefix information option
        isn't set. The problem is found and discussed at
        the 5th TAHI introp test event.

supported DHCPv6 option for SIP servers (RFC3319).

added the test suite name which discovered mip6 bugs.

Mon Jan 19 16:15:48 JST 2004	keiichi@iij.ad.jp
	* kame/sys/netinet6/dest6.c
	send a binding error message when CN receives a home
	address option which includes an inappropriate address.

Mon Jan 19 16:14:14 JST 2004	keiichi@iij.ad.jp
	* kame/sys/netinet6/mip6_hacore.c:
	convert ICMPv6 time exceeded to address unreachable, when
	receiving an error packet from Mobile IPv6 tunnel interface.

update date for racoon fix (due to missing ntohs)

racoon

ipsec.c fixes

rtsold pidfile change
happy 2004

fixed a bug that pim6[sd]d cannot interpret PIM hello options following an unknown ones.

2003-12-20  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/nd6_rtr.c (nd6_setdefaultiface): allowed the
	case of ifindex is 0 for 'ndp -I delete'.

Thu Dec 18 12:30:16 JST 2003    keiichi@iij.ad.jp
        * kame/sys/netinet6/mip6_hacore.c
        - reject an incorrect binding update which doesn't have any one of
        home prefixes.
        reported by Alain Giraud <alain.giraud@alcatel.fr>

SCTP patch

2003-12-16  MOMOSE Tsuyoshi  <t-momose@netlab.nec.co.jp>
        * kame/sys/netinet/icmp6.h: Some of ICMPv6 parameters related
        mip6(DHAAD/MPS/MPA) were changed as assigned IANA.

'ip6addrctl delete ...' works now

RFC3526 support in racoon

2003-12-11  MOMOSE Tsuyoshi  <t-momose@netlab.nec.co.jp>
        * sys/netinet6/mip6_{ha,cn}core.c, mip6_var.h:
        Changed a method of time management for binding cache entries.
        Use system built-in timeout functions instead of
        checking their expiration every second.

2003-12-10  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_mroute.c (add_m6fc): corrected the
	coverage of spl(soft)net.

ip_id.c fix

2003-12-09  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_mroute.c (ip6_mrouter_set): validated the
	argument for multicast routing socket options correctly.

if_index -> if_indexlim transition

2003-12-09  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_mroute.h: cleaned-up the mif6 structure by
	removing unused members.  Note: netstat will have to be rebuilt
	since it reads the structure from the kernel.

2003-12-08  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_mroute.c (add_m6if): corrected the
	coverage of spl(soft)net: reg_mif_num and nummifs must be
	protected at this lock level since these values can be referred to
	in an input path.

fixed a kernel panic and error message on freebsd5-kame in TCP TIME_WAIT state.

Reported by: KOZUKA Masahiro <ma-kun@kozuka.jp>

        * sys/netinet/sctp*: sctp patch 15 from rrs@cisco.com.

        1) Updated to a consisten comment in copyright section
        2) Fixes so tie-tags are new 32 bit nonces not the v-tags (I-G.10)
        3) Fixes so a primary cannot be set to a UNCONFIRMED address (I-G.10)
        4) Updates ICMP handling to fix a bug/incompleteness (I-G.10)
        5) Expanded forms of logging as an option during optimization.
        6) Expanded pegs.
        7) Fixes to utilize larger MTU sizes
        8) Fixes a stray shutdown that was being sent when it
           was not supposed to (in SHUTDOWN-ACK-SENT state).

2003-11-18  Hideki ONO  <ono@soft.net.fujitsu.co.jp>
        * kame/sys/netinet/dccp_*, kame/sys/netinet6/dccp6_*:
        makes DCCP compilable on openbsd.

typo

        * netbsd/sys/netinet/if_arp.c: added arp lock/unlock in
        arp_rtdrain().

* kame/kame/racoon/ipsec_doi.c:
comparing the content of the ID payload failed when the ID type
is IP address and the type is defined in the configuration file
explicitly.

Wed Nov 12 16:15:52 CST 2003	keiichi@iij.ad.jp
	* MIP6
	changed Mobility Header protocol number and ICMPv6 type numbers
	related to Mobile IPv6 based on the latest IANA assignmanet.

openbsd3.4
november

changed the default values of the IA_PD and and IA_PD_PREFIX option to those officially assigned by IANA.

sync with freebsd49

        * kame/sys/netinet/dccp_*, kame/sys/netinet6/dccp6_*:
        makes DCCP compilable on netbsd.

* netbsd/sys/sys/null.h: define NULL as (void *)0.  misuse of NULL as
  integer value will be punished with compilation error.
  sync with netbsd-current.

removed ISATAP due to the IPR issue raised in
http://www.ietf.org/ietf/IPR/sri-ipr-draft-ietf-ngtrans-isatap.txt.

Wed Oct 22 11:32:25 JST 2003	keiichi@iij.ad.jp
	* kame/sys/netinet6/in6.c,in6_ifattach.c,mip6_mncore.c,mip6_icmp6.c
	fixed a panic when removing an interface which has a CoA
	of a mobile node.

Tue Oct 21 12:03:10 JST 2003	keiichi@iij.ad.jp
	* kame/sys/netinet6/icmp6.c,mip6_cncore.[hc]
	fixed a bug of icmp dest unreach lost when sending an icmp to
	an (non-existent) onlink destination with extension headers.
	also, fixed a coresspondent node bug that ignores icmp dest unreach
	from a mobile node.

Thu Oct 16 17:12:54 JST 2003	keiichi@iij.ad.jp
	* kame/sys/netinet6/mip6_cncore.[hc]
	take care the case when a wrapping occurs on the nonce and nodekey
	ring buffer of a correspondent node.

one more typo

typo

        * kame/sys/netinet/dccp_*: imported dccp code for freebsd5
        from http://www.dccp.org
        makes it compilable on freebsd[45]. experimental.

sends the interface-address-list option in option-24, as well as
in option-65001, to catch up with draft-ietf-pim-sm-v2-new-08.txt

2003-10-15  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/in6_var.h: defined the prf_ra structure
	outside of the in6_prflags structure to be friendly with C++.
	Pointed out by: Pavlin Radoslavov <pavlin@icir.org>

2003-10-15  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/in6.c (in6_ifinit): tried rtinit() to a p2p
	(or loopback) destination only when the route is not installed.
	This change allows, e.g., duplicated attempts of 'ifconfig lo0
	::1' like for IPv4.
	Pointed out by Pavlin Radoslavov <pavlin@icir.org>.

revert nd6_rtmsg() change

fixed an endian bug on fragment header scanning.

Fri Oct 10 11:17:46 JST 2003    keiichi@iij.ad.jp
        * kame/sys/netinet6/nd6_rtr.c:nd6_rtmsg()
        fixed a null pointer access when sending rtmsg where an interface
        has no address on it.
        a patch from Hajimu UMEMOTO <ume@mahoroba.org>.

* bsdi3/4: discontinue support of kame/bsdi[34].

Wed Oct  1 22:01:59 JST 2003
	* kame/sys/netinet6/icmp6.c:
	when MIP6 route optimizaion is being perfomed, the address in
	RTHDR2 of the payload of ICMPv6 packet too big message
	must be considerred as a final destination of path MTU.

Wed Oct  1 21:20:16 JST 2003	keiichi@iij.ad.jp
	* kame/sys/netinet6/mip6_cncore.c:
	do not insert Home Address Option to any MH header except
	binding update.
	detected by the conformance test provided by
	Yaskawa	Information Systems Corp.

Wed Oct  1 21:20:16 JST 2003	keiichi@iij.ad.jp
	* kame/kame/mip6control/mip6makeconfig.sh
	updated SA/SPD configuration generator script to make it easy
	to produce esp entry with authentication.  non-null authentication
	must be used according to the Mobile IPv6 spec.

* sys/net/if.c: make ifindex2ifnet[] growing code safer.  from IIJ SEIL
  team.

october.

* kame/kame/racoon/oakley.c:
The length of the Diffie-Hellman public value MUST be equal to the
length of the prime modulus over which the exponentiation was
performed, prepending zero bits to the value if necessary.
reported by <takagaki.keiichi@jp.panasonic.com>

2003-09-29  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6: changed the default values of the DNS
	(recursive) server address and the DNS search path options to
	those officially assigned by IANA.  Though these values are still
	configurable by autoconf to provide interoperability with old
	implementations, it is recommended to use the standard values
	whenever possible.
	Note: the latest clients and servers built with the default
	configuration are not interoperable with older KAME snaps in terms
	of these options.

corrected a path in a log entry.

2003-09-25  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/setkey/setkey.c (sysctldump): disabled this function
	when KEYCTL_DUMPSA is undefined.  This change fixes the output
	of setkey -D or -DP on FreeBSD.

2003-09-25  itojun
	* kame/sys/netkey/key_var.h: undefined KEYCTL_DUMPSA and
	KEYCTL_DUMPSP for FreeBSD since it does not work for now.  The
	change implicitly corrected the termination behavior of racoon.

fixed wording ambiguity

2003-09-24  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd4/kame/racoon/session.c (check_flushsa): handled the case
	where pfkey_dump_sadb() returns NULL correctly.  Otherwise, racoon
	could crash in such a case.

2003-09-21  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_output.c (ip6_ctloutput): simplified the
	case of getsockopt IPV6_PKTOPTIONS by simply returning empty
	data.  Note that the change does not make any difference from the
	application's point of view, since we've already quitted storing
	the options on a socket.

2003-09-21  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_input.c (ip6_savecontrol): simplified the
	function interface as a cleanup.  This change should not make any
	difference from the API point of view.  Many other kernel files
	that call this function were changed accordingly.

2003-09-20  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/rtadvd/if.c (if_nametosdl): made sure to free the
	temporary buffer.
	In response to KAME PR 502 reported by Takayuki Sakuma.

2003-09-19  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ipsec.c (ipsec_copypkt): avoided coping m_flag
	after M_MOVE_PKTHDR().  It would clear M_PKTHDR from the copy
	target and cause unexpected behavior.  It is highly recommended
	for IPsec ESP or IPcomp users to apply this fix.

2003/09/17 23:37:38 JST kjc@csl.sony.co.jp
        * eliminate reserved qids (class handles).
          allow cbq, hfsc and priq to use arbitrary non-zero qids.
        * make the qid assignment similar to the pf_tag assignment.
          this is a step to share the logic with pf_tag.

Some of parameters in hif_ifreq wer changed not to use pointers

* netbsd/sys/netinet/udp_usrreq.c: send icmp admin prohibit if
  socket policy mismatches.

* sys/netkey/key.c: make it possible to get SA/SP dump via sysctl.
* setkey: use sysctl

* netbsd/sys/netinet/tcp_input.c: if inbound IPsec policy mismatches
  (like IPsec is required and plaintext packet comes in), respond to
  SYN with RST instead of silently discard the packet.  it will allow
  TCP client to react quickly against the connection failure due to
  IPsec policy mismatch.

/kern/ipsec{sa,sp}

spi hash lookup

grammar

* sys/netinet6/ip6_id.c: randomize flowlabel and fragment ID.

Fixed a bug that RS message is not advertised on ISATAP interface.

If your SNAP is newer than kame-snap-20030414 and you'd like to use
ISATAP, you have to rebuild rtsold from scratch.

Tue Aug 26 22:37:38 JST 2003	keiichi@iij.ad.jp
	* kame/sys/net/if_hif.*,netnet6/mip6*
	support multiple global addresses handling of a home agent.
	support selecting alternative home agent mechanism when
	the current registered home agent seems to be unavailable.

recovered the title line.

fixed an IGMPv3-related buffer overrun in freebsd[45].
Reported by: Hitoshi Asaeda <Hitoshi.Asaeda@sophia.inria.fr>

Wed Aug 20 22:31:22 JST 2003	keiichi@iij.ad.jp
	* kame/kame/sys/netinet6/mip6_mncore.c,mip6_mncore.h,mip6_icmp6.c
	  kame/kame/sys/netinet6/nd6.c
	  kame/kame/kame/had/mpa.c
	sending/receiving Mobile Prefix Solicitation/Advertisement is
	supported.

2003-08-19  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6/dhcp6relay.c: fixed a missing initialization.
	Without this fix, dhcp6relay could crash when it has no global
	addresses.
	From: Hajimu UMEMOTO <ume@mahoroba.org>

PR_LASTHDR for raw wildcard

fixed static-RP related bugs again

Now static-RP configuration can work together with bootstrap-message-based RP configuration

sync with FreeBSD-5.1 (it isn't still working, though)

2003-08-07  MOMOSE Tsuyoshi  <t-momose@netlab.nec.co.jp>
        * kame/kame/had/mpa.c,haadisc.c
        A home address should be passed in the source address of a mobile
        solicit pakcet. This problem was reported and donated the code by
        Kenichi Yajima <yajima@netlab.nec.co.jp>

2003-08-07  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6/cftoken.l: use a stronger lexical check for
	interface names.
	From: Hajimu UMEMOTO <ume@mahoroba.org>
	* kame/kame/dhcp6/config.c (configure_interface): check interfaces
	specified in the configuration file really exist.

add cisco IPR URL for reference

removed vrrp6 support because it might be a patent infringement.

	* The DHCPv6 implementation is now built by default under
	  *bsd/usr.sbin/.

<200308>
2003-08-01  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6: implemented various clarifications and some new
	features:
	- supported DNS name and NTP servers options
	- dhcp6s now uses the server/relay port to send a relay-rely
	  message
	- dhcp6s now ignores a rebind message when it cannot find a
	  binding, according to prefix-delegation-04
	- dhcp6relay now accepts relay-reply messages on the socket
	  listening on the server/relay port

Thu Jul 31 19:19:48 JST 2003	keiichi@iij.ad.jp
	* kame/sys/netinet6/mip6_mncore.c,mip6_cncore.c
	sending/receiving a binding refresh request message is supported.

Tue Jul 29 17:09:15 JST 2003	keiichi@iij.ad.jp
	* kame/sys/netinet6/mip6_mncore.[hc]
	select a CoA using the source address selection like algorithm.
	suggested by Francis.Dupont@enst-bretagne.fr.

2003-07-28  MOMOSE Tsuyoshi  <t-momose@netlab.nec.co.jp>
        * sys/netinet6/{ip6_output.c, ip6_var.h, mip6_cncore.c,
        mip6_hacore.[ch], nd6.c}:
        CN or HA dosen't add a type2 routing header to a Binding
        Acknowledgement packet when a deregistration packet was issued
        on home link and it was failed by some reasons.
        reported by Yukiyo.Akisada@jp.yokogawa.com and v6pc cert.
        team.

Mon Jul 28 20:03:46 JST 2003	keiichi@iij.ad.jp
	* kame/sys/netinet6/mip6_cncore.c,mip6_mncore.[hc],in6.c,nd6_rtr.c
	  kame/sys/net/if_hif.[hc]
	assign a CoA separately for each home interface, since a home
	interface is logically independent from each other.

Mon Jul 28 14:38:11 JST 2003	keiichi@iij.ad.jp
	* kame/sys/netinet6/mip6_hacore.c,mip6_cncore.c:
	- fixed a bug not sending a binding ack when DAD for a link-local
	  address is failed.  (en-bugged during re-structuring BC logic.)
	- fixed a bug using RTHDR2 with Mobility Headers other than
	  a binding ack.
	reported by Yukiyo.Akisada@jp.yokogawa.com.

* sys/netinet/ah_core.c: hmac-ripemd160 support

* kame/sys/netkey/key.c
fixed that the kernel crashed when key_spdacquire() was called
because key_spdacquire() had been implemented imcopletely.

Thu Jul 24 16:11:06 JST 2003	keiichi@iij.ad.jp
	* mip6 related files.
	simplify the prefix and advertising router list management
	mechanism on a mobile node.

grammar.

2003-07-20  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6/config.c (configure_duid): fixed a bug of
	allocating short memory.  Upgrading is required if you configure
	dhcp6s with the duid statement.

* sys/netinet6/esp_aesctr.c: support draft-ietf-ipsec-ciph-aes-ctr-03
  as there's no official DOI assignment yet, we use private DOI number.
* sys/netinet6/ah_aesxcbcmac.c: support
  draft-ietf-ipsec-ciph-aes-xcbc-mac-03.
  as there's no official DOI assignment yet, we use private DOI number.

* sys/netinet6/esp_rijndael.c: simplify and update rijndael code.
  markus@openbsd

2003-07-14  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6: revised the relay agent implementation
	based on dhcpv6-28.
	- dhcp6relay now relays packets between clients and servers using
	  relay forward/reply messages.
	- dhcp6s now accepts relay forward messages and replies with a
	  relay reply messages.

makes IGMPV3-kernel compilable on openbsd

Thu Jul 10 21:35:04 JST 2003	keiichi@iij.ad.jp
	* kame/kame/had/halist.c
	fixed a bug that a DHAAD reply message only includes one global
	address per home agent.  the message must include all global
	addresses of all home agents.
	reported by Yukiyo.Akisada@jp.yokogawa.com.

2003/07/10 21:07:50 JST kjc@csl.sony.co.jp
	the first step for transition to pf/altq.
	marge pf/altq into the existing altq-3.
	allow both pf/altq and altq-3 to coexit.
	currently, ALTQ3_COMPAT and ALTQ3_CLFIER_COMPAT are defined
	in sys/altq/altq.h to support altq-3.
	altq-3 will remain in kame for research experiments but will
	not be merged into bsd releases.

* kame/racoon
racoon left a re-send schedule, but called unbindph12() after it
finished IPsec-SA negotiation.  the re-send routine would use ph1
handler, but it would be NULL, then it caused a crush.  the report
from <robert_kw@yahoo.com>

2003-07-08  Hideki ONO  <ono@soft.net.fujitsu.co.jp>
        * kame/sys/netinet6/{in6_ifattach.c,ip6_mroute.c,ip6_mroute.h}
        protect against interface removal.

more wording.

wording.

Tue Jul  8 18:51:06 JST 2003	keiichi@iij.ad.jp
	* kame/sys/netinet6/mip6_mncore.c
	insert alternate careof address sub-option when creating a
	binding update for the home registration.  strictly speaking,
	this sub-option is not necessary if we protect the message by AH
	for now, we always include this option though...

Tue Jul  8 17:11:20 JST 2003	keiichi@iij.ad.jp
	* kame/sys/netinet6/mip6_cncore.c,mip6_hacore.c,mip6_var.h,
	  kame/kame/mip6control/mip6control.c
	better handling for a cloned binding cache for link-local
	address of a mobile node, when a binding update has a L flag on.

Tue Jul  8 12:04:14 JST 2003	keiichi@iij.ad.jp
	* kame/sys/netinet6/mip6_mncore.c
	a mobile node must send a multicast neighbor advertisement
	for its link-local address when returning to home.
	reported by Yasukawa Information Corp.

Mon Jul  7 20:23:00 JST 2003	keiichi@iij.ad.jp
	* kame/sys/netinet6/mip6_cncore.c,kame/sys/netkey/key.[ch]
	made draft-ietf-mip6-ha-ipsec as a default configuration.
	you must explicitly define MIP6_NOHAIPSEC to disable this feature.

* sys/netinet6/{ipcomp,esp}_input.c: critical missing length check/typo
  found by markus@openbsd.

* kame/sys/net/pf.c: PF now available on freebsd4 too.
* {net,open}bsd/sys/netinet/ip_mroute.c: better protection against
  interface removal, by ono@kame

* kame/sys/netkey/{key.[ch],keydb.[ch]}
* kame/sys/netinet6/ipsec.[ch]:
an user can define a policy-id between 1 and IPSEC_MANUAL_POLICYID_MAX.
when an user specifies 0 as a policy-id, the kernel assigns a policy-id
for the security policy.

* kame/racoon
- fixed to get a subjectaltname from a x509 certificate.
it did not work with racoon if the openssl version
was 0x00906002L or later.

byebye new_struct_route for net/open

* sys/netinet6/ipsec.c: policy can be looked up by PF tags.  see
  (KAME-snap 7878) for more complete example.
* setkey: syntax addition: "spdadd taggged" for PF-and-IPsec interaction

* kame/racoon
- fixed that the configure program did not work.
- the configure program checks if racoon's sha2 can work on an openssl.
- racoon supports the "proxy mode" SA negotiation.  it is useful
for MIP6 security.  patch from <Francis.Dupont@enst-bretagne.fr>

* kame/sys/net/pf.c: PF from openbsd-current 2002/6/26.
  compilable on openbsd/netbsd.  the goal would be to integrate PF
  into KAME IPsec policy lookup engine.

2003-06-26  Tsuyoshi MOMOSE  <t-momose@netlab.nec.co.jp>

	* kame/sys/netinet6/{mip6_cncore.c, dest6.c}: Several bugs related
	mobile ipv6 correspondent node functinonalyty was fixed.  Thease
	problems are found and reported by v6pc certification WG
	conformance testing.
	  - shouldn't check care-of nonce index on deregistration.
	  - shouldn't send binding errors with Home Address optino in HoTI,
	    or CoTI packet
	  - should send a binding error when an address included in home
	    address option is not a  routable unicast address.
	  - should send binding error with status code 2 when received
	    a packet which has a unknown mobility header type.

sctp patch 9

removed garbage.

2003-06-19  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_output.c (ip6_setpktoption): deprecated
	the IPV6_REACHCONF socket option and ancillary data item.  It was
	once introduced during the migration from RFC 2292 to RFC 3542,
	but was dropped in the migration process.

2003-06-19  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/nd6.c (nd6_rtrequest): changed a condition to
	decide whether to create an empty llinfo stricter so that a user
	can manually change the link-layer address of an existing neighbor
	cache.
	Pointed out by: KIU Shueng Chuan

* sys/netinet6/nd6.c: have separate timer in each llinfo_nd6
  (neighor cache); should allow timeout control in finer granurality.
  ln->ln_expire is kept just for backward compat (i.e. ndp(8))

Mon Jun 16 18:49:02 JST 2003	keiichi@iij.ad.jp
	* kame/sys/netinet6/icmp6.c
	fixed a bug that ICMP error may be sent to mobile node's home
	address instead of its care-of address.
	reported by Yukiyo Akisada <Yukiyo.Akisada@jp.yokogawa.com>.

2003-06-14  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd4/sys/net/if.c (if_detach): be sure to free the link
	ifaddr at the end of the function.  (A supplement fix to another
	one by ono on June 9th)

flyspell

Wed Jun 11 20:39:57 JST 2003	keiichi@iij.ad.jp
	* tcp_output()
	the length of extention headers, which are created and inserted
	by the MIP6 kernel automatically if bindings exist, is taken
	into account when sending TCP segments to avoid fragmentation.
	pointed out by A. Dev pramil <dev.dhas@kcl.ac.uk> and others.

wording

2003-06-03  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/icmp6.c (icmp6_redirect_output): do not check
	ip6_accept_rtadv to decide redirects should be sent.  This
	parameter is irrelevant to sending redirects.

<200306>
2003-06-03  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/nd6_nbr.c (nd6_na_input):
	* kame/sys/netinet6/nd6.c (nd6_free):
	loosened the check requiring ip6_accept_rtadv where we needed to
	consider redirect cases.
	Pointed out by: KIU Shueng Chuan

wording

* netbsd/sys/netinet/tcp_input.c: inherit IPV6_V6ONLY bit from
  listening socket.  NetBSD PR 21713

Thu May 29 18:01:28 JST 2003 sakane@kame.net
	* kame/racoon
	the patches from <Francis.Dupont@enst-bretagne.fr>
	- racoon must use the source addresss of the phase 1 negotiation
	  that is in the acquire message.
	- the missing in pk_recvspdupdate() was added.

2003-05-27  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/setkey/{token.l, parse.y}: added a new keyword "null"
	as the null encryption algorithm.  The old keyword "simple" was
	obsoleted.  Backward compatibility is provided with a warning
	message. [KAME PR 475]

Fri May 23 16:00:26 JST 2003 sakane@kame.net
	* kame/racoon
	applyed RFC compliance patches from <toml@us.ibm.com>.
	- only single proposal and single transform are allowed to be received
	  during phase 1 by a initiator.
	- ESP with NULL encryption must specify authentication.

Fri May 23 16:00:26 JST 2003 sakane@kame.net
	* kame/racoon
	- a regular expression can be used as a include file name
	  in a configuratoin file.
	- some memory leaks are fixed.
	they are from <jgraessley@apple.com>.

fixed a bug that UDP packet cannot be received if it's bound for linklocal multicast.  (introduced in Apr 28)

Mon May 19 18:47:38 JST 2003	keiichi@iij.ad.jp
	* kame/kame/rtadvd/advcap.c,config.c,dump.c,rtadvd.[hc]
	  implemented the rapid router advertisement which is defined in the
	  mobile ipv6 spec.

2003-05-15  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd4/sys/net/if.c (if_detach): be sure to reset the
	ifindex2ifnet[] entry for the detached interface.

moved the default location of the configuration file from
/usr/local/v6/etc/... to /etc/...,  for the convenience of ports/pkgsrc
maintenance.

People using pim6[sd]d MUST move their pim6[sd]d configuration file to /etc.

pim6sd related changes

2003-05-08  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/nd6_rtr.c (nd6_rtmsg): corrected the pointer
	value for RTAX_IFP.
	Pointed out by: KIU Shueng Chuan

* openbsd: switch to 3.3.

* kame/pim6sd/{cfparse.y cftoken.l pim6_proto.c, pim6sd.conf.5,
  rp.[ch] timer.h}: implemented static group-to-RP mapping
  configuration.

* kame/pim6sd/{rp.c, pim6_proto.c}: sync with draft-ietf-pim-sm-bsr-03.txt
	- BSR message's Randomized Override Interval
	- BSR message is advertised to the incoming interface, too

answers to MLD query for link-local multicast group address.
(stopped embedding the ifindex of group address in struct in6_multi)

Reported by: Kentaro Ohara <Kentarou.Oohara@jp.yokogawa.com>
(users@jp.ipv6.org #3055)

Wed Apr 23 18:22:53 JST 2003	keiichi@iij.ad.jp
	* mip6 related part restructuring.
	codes are divided into three parts based on node types.
	a user can build CN only, MN only and HA only kernel now.

netbsd 1.6.1

sctp patch 8

2003-04-17  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/libinet6/getaddrinfo.c (getaddrinfo): when AI_PASSIVE
	is specified, put non-SCTP protocols before SCTP not to break
	buggy-but-deployed applications.

2003-04-17  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/libinet6/getaddrinfo.c (getaddrinfo): corrected the
	initial check for socktype/protocol combination of hints.
	the previous code could reject {AF_INET6, SOCK_STREAM,
	IPPROTO_TCP} when we had IPPROTO_SCTP before TCP in the explore
	structure.

2003-04-16  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd4/ports/openssh-portable-sctp: added a port kit to
	support other stream protocols than TCP (mainly intending SCTP) in
	OpenSSH 3.6.1p1.

2003-04-11  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/rtsold/rtsold.c (main): corrected over-killing
	pid-file generation.

2003-04-11  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6/dhcp6c: added the -p pid-file option.

2003-04-11  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/rtsold/if.c (interface_status): considered IEEE 802.11
	interfaces correctly.

2003-04-11  MOMOSE Tsuyoshi  <t-momose@netlab.nec.co.jp>

        * kame/kame/had: a part of handling MPA is divided to another
        file. Current handling MPA code prevents to port 'had' to
        other MIP6 implementations due to accessing kernel internal
        structures.

typo

log wording

2003-04-11  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/rtsold: added the "O-bit" support.  When rtsold
	receives a router advertisement, it will invoke a script file
	(if specified by the -O option) to kick a separate protocol for
	the "other" configuration.

2003-04-11  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6: supported the ability for the client to call a
	configuration script when the client receives a reply message.  A
	new configuration statement to specify the script was provided.

wording

2003-04-10  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/rtadvd/config.c (getconfig): supported a string
	notation for flag parameters.  For example, rtflags="o" specifies
	the daemon to set the "O bit" of the router flag of the router
	advertisement header.  This change is backward compatible; the
	traditional numeric notation is also accepted.

sync with FreeBSD 4.8-RELEASE

apr03

always advertise group-specific query from link-local address

Mon Mar 31 11:19:31 JST 2003	keiichi@iij.ad.jp
	* kame/sys/netinet6/mip6.c,mip6_var.h,nd6_rtr.c:
	fixed a bug in a update routine of mip6 related data structure
	(prefix list and home agent list) when receiving a router
	advertisement.

2003-03-28  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/libinet6/name6.c: upgraded the support of ICMPv6
	nodeinfo for address to name mapping to recent versions of the
	specification.
	Note that:
	- this version sends queries to non-link-local addresses
	- this version does not cache the results

stf/gif/dummy/faith are working on freebsd5

makes MIP6 compilable on freebsd5 (bahavior is not confirmed yet)

updates supported I/F list

KAME-origined logical-interfaces (gif, dummy, and stf for the time being)
are now recognized on freebsd5.

supported LARGE_LOMTU kernel configuration option for Jumbogram testing.

fixed a bug that MSF does not work properly when changing its mode
by advanced API.

When the gap in the IPv4 multicast membership array is removed,
multicast-socket-filter must be removed as well as multicast
membership array.  (specific to IGMPv3 extension)

2003-03-22  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/nd6_rtr.c (prelist_update): made sure to keep
	the current stored lifetime when it was not updated by an RA.
	Discovered through a periodic TAHI test by Ozoe Nobumichi
	<ozoe@tahi.org>.

2003-03-19  Hideki ONO  <ono@soft.net.fujitsu.co.jp>
        * kame/kame/vrrp6d,
          kame/sys/net/{if_vrrp.c,if_vrrp_var.h},kame/sys/netinet6/mld6.c,
          openbsd/sbin/ifconfig, openbsd/sys/net/{if_ethersubr.c,if_types.h},
          openbsd/sys/sys/mbuf.h
        VRRP6 implementation for OpenBSD

Wed Mar 19 17:17:55 JST 2003	keiichi@iij.ad.jp
	* kame/sys/netinet6/icmp6.c
	fixed a mbuf leak when generating an ICMPv6 redirect message.

typo

2003-03-14  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6: C99 compliance; avoid using __func__ with
	concatenating other strings since the it is a const char variable.

2003-03-14  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6/configure.in: checked if __func__ works with
	string concatenation.
	From: Masahiro =Rhythm Drive= Ishiyama <masahiro@isl.rdc.toshiba.co.jp>

2003-03-13  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/rafixd: this is a new application.  The rafixd daemon
	invalidates bogus RAs by overriding them with the 0 router
	lifetime.  This is particularly useful on an event network that
	contains mis-configured "routers".

* sctp: merged patch 7 from randall.

<200303>
2003-03-06  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6/dhcp6c.c (client6_send): made sure that the
	elapsed time does not overflow, according to dhcpv6-interop-00.

reflected FreeBSD-SA-03:03.syncookies (Brute force attack on SYN cookies)

2003-02-19  Hideki ONO  <ono@soft.net.fujitsu.co.jp>
	* kame/kame/vrrp6d,
	  kame/sys/net/{if_vrrp.c,if_vrrp_var.h},kame/sys/netinet6/mld6.c,
	  netbsd/sbin/ifconfig, netbsd/sys/net/{if_ethersubr.c,if_types.h},
	  netbsd/sys/sys/mbuf.h
	VRRP6 implementation for NetBSD
	* freebsd4/sbin/ifconfig, freebsd4/sys/net/{if_ethersubr.c,if_types.h},
	  freebsd4/sys/sys/mbuf.h
	changed VRRP6 implementation for FreeBSD4

Wed Feb 19 17:26:11 JST 2003	keiichi@iij.ad.jp
	more mtag leaks are fidex.  M_MOVE_PKTHDR is introduced to
	NetBSD (ported from OpenBSD).
	TODO: KAME/freebsd5

Wed Feb 19 12:15:00 JST 2003	keiichi@iij.ad.jp
	* kame/sys/netkey/key.c
	MIP6: flush a cached route of a SA when the destaddr of the SA
	has been changed.

2003-02-18  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd4/sys/sys/mbuf.h (M_MOVE_PKTHDR): ported from OpenBSD to
	"move" mtag from one mbuf to another.
	* kame/sys/netinet6/{icmp6.c, ip6_output, ipsec.c}: used
	M_MOVE_PKTHDR instead of M_COPY_PKTHDR when appropriate, in order
	to avoid mtag leakage.
	(We may need to change more, including support for other OSes)

properly handles IPv4 UDP packet for IPv4 broadcast address
on IGMPv3 kernel

fixed an IGMPv3 or MLDv2 kernel crash by a UDP multicast packet to
addr:port, when some application joins to the addr and another
application listens to the UDP port by unicast.

  Reported by: Hitoshi Asaeda <Hitoshi.Asaeda@sophia.inria.fr>

2003-02-14  MOMOSE Tsuyoshi  <t-momose@netlab.nec.co.jp>
        *  kame/kame/sys/netinet6/{mobility6.c,mip6_pktproc.c},
           kame/kame/sys/netinet/ip6.h
        - Changed some codes to be MIP6 ID-20 compliant.
         + Binding Auth. Option no longer require alignments
         + Changed Binding Refresh Advice option type
         + Send Parameter Problem if received mobility header is too small
           or it's next header value is not no next header.

2003-02-12  MOMOSE Tsuyoshi  <t-momose@netlab.nec.co.jp>
        * kame/sys/netinet6/{mip6.c,mip6_pktproc.c,mip6_var.h}: Only Home
        nonce is used for calculation Kbm when a binding update message
        tells to delete a binding cache.(HoA==CoA || lifetime==0)
        One of Known bugs in TODO.mobile-ip6 is fixed.

ifmcstat works on freebsd5 now

fixed a pim6sd crash by SIGHUP

2003-02-10  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6/dhcp6c_ia.c (reestablish_ia): prevented the
	client from crashing when receiving a NoBinding code in response
	to a Rebind.
	Reported by: Ozoe Nobumichi <ozoe@intap.or.jp>

getsockname()/getpeername() now returns proper port number for IPv6 socket.
(this makes rpcbind work properly on freebsd5)

2003/02/09 03:33:58 JST kjc@csl.sony.co.jp
	merge altq support into the freebsd5 tree.
	the original code was made for 5.0-dp1 and it hasn't been fully
	tested on 5.0 yet.

wording

2003-02-07  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6/dhcp6c: obsoleted 'prefix-delegation' as an
	DHCPv6 option name.

2003-02-07  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_input.c (ip6_getpktaddrs): changed the 2nd
	and the 3rd arguments from 'sockaddr_in6 **' to 'sockaddr_in6 *'.
	The change will avoid sharing pointer in an mbuf with the caller
	of the function, and will be considered as less error-prone.
	* {*bsd, kame}/sys/netinet[6]/: all the points that called
	ip6_getpktaddrs() were modified accordingly.  There should be no
	change on behavior, but we may need some time to stabilize the
	code.

fixed file descriptor leak by SIGHUP
(reported by SUDOH Yoshiaki <sudo@iij.ad.jp>)

KAME for FreeBSD 5-RELEASE.
  ToDo: altq integration, snap distribution, stability

typo and wording

removed white space after EOL.

wording

2003-02-06  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6: the client now sends Request to establish an IA
	when receiving a NoBinding for the IA in response to a Renew or
	Reply.  The behavior is compliant to Section 18.1.8 of dhcpv6-28.

fixed pim6sd crash by SIGHUP
(reported by SUDOH Yoshiaki <sudo@iij.ad.jp>)

Wed Feb  5 20:25:32 JST 2003	keiichi@iij.ad.jp
	* kame/sys/netinet/icmp6.h,ip6.h
	* kame/sys/netinet6/mip6_binding.c,mip6_pktproc.c
	* kame/kame/mip6control/mip6control.c
	- support for the MIP6 ID20 draft has been added.

2003-02-05  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* {freebsd4,kame}/sys/netinet6/udp6_usrreq.c (udp6_input)
	* {freebsd4,kame}/sys/netinet6/raw_ip6.c (rip6_input)
	removed redundant code fragments; we do not have to copy mtag back
	to the source any more.
	(There should be no change on behavior.)

Wed Feb  5 10:31:48 JST 2003	keiichi@iij.ad.jp
	* kame/sys/netinet6/ip6_forward.c,ip6_output.c
	* freebsd4/sys/sys/mbuf.h
	- changed m_copy() behavior of freebsd4.  m_copy() now copies
	  mtags.

2003-02-04  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6/dhcp6c.c (client6_timo): changed the upper bound
	of retransmissions according to Section 14 of dhcpv6-28, so that
	the total number of transmissions (including the first one) is
	limited up to MRC.
	pointed out by: Ozoe Nobumichi <ozoe@intap.or.jp>

Mon Feb  3 18:53:50 JST 2003	keiichi@iij.ad.jp
	* kame/sys/netinet6/{mip6_binding.c|ipsec.c}
	* kame/sys/netkey/key.[hc]
	- added partial support for the mip6-ha-ipsec draft.
	  define MIP6_HAIPSEC macro in your kernel config file to
	  enable optimized tunneling format.

Fri Jan 31 21:28:08 JST 2003	keiichi@iij.ad.jp
	* kame/kame/mip6control:
	- the file format for mip6makeconfig.sh has been changed.

fixed a bug that pim6sd's MLD-compat-mode never switches back to MLDv2
from MLDv1-compatible mode.

fixed a bug that "cand_bsr/cand_rp (ifname)" does not work.
(reported by Pekka Savola in snap-users ML #7516)

2003-01-29  MOMOSE Tsuyoshi  <t-momose@netlab.nec.co.jp>

        * kame/kame/sys/netinet6/mip6.c, mip6_var.h, mip6_pktpro.c:
        supports returning binding ack. status of expired nonce index when
        the nonces indicated in a binding update are already expired.

2003-01-27  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6: added some minor bug fixes and clarifications:
	- let the event structure to have IA for solicit and request so
	  that it is easier to handle each IA separately
	- fixed a bug that the server ID was not copied to request when
	  receiving an advertisement with the highest preference
	- fixed a bug of moving tailq list entries.  Introduced a new
	  library dhcp6_move_list() to address this problem.

Thu Jan 23 18:09:14 JST 2003	keiichi@iij.ad.jp
	* kame/sys/netinet6/ip6_output.c:
	leave mtags in the original mbuf when copying the mbuf in
	ip6_mloopback().  the aux information stored in the mtags
	may be needed in the later process of the output routine.

* sys/net/if_gif.c: detect encapsulation loop by using m_tag,
  just like openbsd-current does.

2003-01-23  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6: supported a new substatement "prefix" for the
	id-assoc statement, which allows the client to require a
	particular prefix(es) as a subotion of the IA_PD option in Solicit
	messages.

2003-01-23  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6/dhcp6s.c (make_binding_ia): used local values
	for the pltime and vltime of a prefix to be renewed/rebound, not
	values in the renew/rebind message.

- fixed MLD query advertisement failure
- displayes MLD group management info in dump

2003-01-22  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6: supported the elapsed time DHCPv6 option:
	- the client now includes the option for all messages.
	- the server logs the received option, though it does not care
	about the option value.

grammar

2003-01-21  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6: supported the Release message:
	- client now releases stateful resources before exiting or restarting
	  by sending the message.
	- server now accepts the message and release the corresponding
	  binding.

s/bsdi3/bsdi4/

* sys/mbuf.h: switch from m_aux framework to m_tag framework (from
  openbsd) for tagging extra information to mbuf chain.
  TODO: bsdi3

2003-01-20  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/ndp/ndp.c (ifinfo): printed the max MTU for ndp -i IFNAME.

2003-01-20  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/(several files): clarified library interfaces
	for prefix manipulation.  There was no change on behavior.

Fri Jan 17 20:53:58 JST 2003	keiichi@iij.ad.jp
	* kame/sys/netinet6/mip6_pktproc.c:
	more sanity checks.  a home test init and a care-of test init
	must not contain a home address destination option.
	reported by Yukiyo Akisada <Yukiyo.Akisada@jp.yokogawa.com>.

Fri Jan 17 19:28:45 JST 2003	keiichi@iij.ad.jp
	* kame/sys/netinet6/mip6_binding.c:
	fixed a bug that sending with an invalid lifetime from a home
	agent when unregistering.
	reported by Yukiyo Akisada <Yukiyo.Akisada@jp.yokogawa.com>.

Fri Jan 17 19:18:44 JST 2003   keiichi@iij.ad.jp
       * kame/sys/netinet/icmp6.h
       corrected the dhaad reply format.

When listening to a source-specific-multicast group, receives
IPv6 packets (e.g. ICMPv6 ECHO) as well as IPv6 UDP packets
if source and group are matched.

rtsold now periodically solicites RA on ISATAP interface.

moved all the log written in 2002 to CHANGELOG.2002

folded a long line.

ISATAP implementation for bsdi4 (just confirmed compilation)

fixed a bug that some interfaces cannot be manipulated under OpenBSD+KAME.

ISATAP implementation for OpenBSD

ISATAP implementation for NetBSD

ISATAP kernel implementation for NetBSD

ISATAP implementation based on draft-ietf-ngtrans-isatap-08.txt

* sys/netkey/keydb.h: in struct secashead, "struct route" is not
  sufficient if !NEW_STRUCT_ROUTE.  NetBSD PR 18751.

<200301>
2003-01-06  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6: upgraded base specification of DHCPv6 and prefix
	delegation using DHCPv6 according to the latest drafts.
	Note that backward compatibility to older versions of prefix
	delegation was not provided.

fixed a pim6sd crash when it's located at first-hop router

2002-12-18  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/nd6_rtr.c (pfxlist_onlink_check): checked
	whether there is a router that does not advertise any prefixes
	even if there's no prefix with a reachable router.  The change
	addressed the case that we've received a prefix but the
	advertising router(s) has been unreachable.

2002-12-16 Keiichi SHIMA <keiichi@iij.ad.jp>
        The ID-19 based Mobile IPv6 code is announced.

* kame/sys/netinet6/natpt_trans.c: FTP connection from v4 client
  to v6 server with port redirection mode was supported.  Passive
  and non-passive mode are both available.

pim6sd works on kernel with more than MAXMIFS interfaces, unless the number of PIM-enabled interfaces exceeds MAXMIFS.

grammar

improved wording

2002-12-08  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/raw_ip6.c (rip6_input): cleared link zone
	identifiers embedded in "from" addresses.  Without this fix,
	applications would see the embedded values when calling recvfrom()
	or recvmsg() on an IPv6 raw socket.  This would also prevent
	pim6sd from working correctly.

introduced a configuration option "default_phyint_status" to disable multicast routing on all interfaces except explicitly enabled ones.

2002-12-06  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/in6.c (in6_unlink_ifa): always decremented the
	reference count of the associated prefix.  Otherwise, the prefix
	would never be purged after a manually configured address expires.

2002-12-06  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/in6.c (in6_control): initialized the lifetimes
	of a manually configured prefix correctly.

* kame/sys/netinet6/natpt_trans.c: Support FTP connection from v4
  client to v6 server with non-passive mode.
* kame/sys/netinet6/natpt_{defs,trans,tslot}.[ch]: Support packet
  retransmission of when TCP payload was modified in FTP
  translation.

2002-12-04  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd4/usr.bin/netstat/inet[6].c: replaced inet6print() and
	inet6name() with a new function "sa_print()" using getnameinfo()
	for a better support IPv6 scoped addresses.

* kame/sys/netinet6/natpt_dispatch.c: Changed a way of cv6->plen
  calculation.  There is a case m->m_len is greater than real
  packet size calculated from ipv6 header.
* kame/sys/netinet6/natpt_trans.c: Support FTP connection from v4
  client to v6 server with passive mode.

if_stf.c more sanity check

typo

fixed an MLDv2-kernel crash by MLDv2 Query packet with small maximum-response-code.

deletes MLDv2 info created automatically within kernel, if it is of no use.

supported MLDv2 on OpenBSD

fixed committing date

2002-11-08  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd4/sys/netinet/tcp_usrreq.c (tcp6_connect): made the way
	to fill in flowinfo consistent with in6_pcbconnect(); use an
	automatically generated value or 0, and always ignore
	the sin6_flowinfo value given by the application.

fixed a kernel crash by IPv6 UDP packet arrival (e.g. DNS response).
OpenBSD-KAME users are strongly recommended to update the kernel.

a major rework of HFSC in ALTQ.

sctp changes

openbsd32

IGMPv2-compat-mode implementation for host side

announces linklocal multicast join by MLDv2 on MLDv2-ready kernel.

MLDv1-compat-mode implementation for host side

2002-10-31  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_output.c (ip6_pcbopts, ip6_copypktopts):
	plugged memory leaks in some erroneous cases.
	From: "Sam Leffler" <sam@errno.com>

added options to filter its output by address-family or interface.

MLDv1-compat-mode implementation for router side

2002-10-29  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_forward.c: added a destination scope
	check: if a packet is going to break the scope zone of packet's
	destination address, be sure to discard it.

* kame/sys/net/radix_mpath.c: add random jitter to hash value passed
  to rtalloc_mpath(), to avoid synchronization between routers.

2002-10-28  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/nd6_rtr.c (nd6_ra_input): treated "reserved"
	router preference value as if the router had 0 lifetime, according
	to the specification.
	Reported by: Hiroshi MIYATA <H.Miyata@jp.yokogawa.com>

* sys/net/if_sec.c: obsolete "pseudo-device sec" support.  the design
  does only half of what i intended to accomplish.

Sat Oct 26 16:14:22 JST 2002	kjc@csl.sony.co.jp
	* add a new queueing discipline, JoBS, to ALTQ
	JoBS is contributed by Nicolas Christin <nicolas@cs.virginia.edu>
	and has been in the altq distribution since altq-3.1

sync with FreeBSD 4.7-RELEASE

fixed a kernel crash in FreeBSD-4 by "ifconfig stf0 inet 1.2.3.4"

fixed a kernel crash occuring when specifying multiple source addresses in MLDv2-API

removed garbage

updated to ver 2.0

2002-10-17  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/libinet6/{ip6opt.c, rthdr.c}: synchronized with
	rfc2292bis-08.  Many size_t values changed to socklen_t.  Man
	pages were also updated.
	* kame/sys/netinet6/in6.h: updated prototypes of rfc2292bis
	library functions accordingly.

2002-10-17  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* *bsd/sbin/ifconfig/ifconfig.c: made the IN6_IFF_DEPRECATED flag
	obsolete, since it was not effectively used in the kernel any
	more.
	- "ifconfig ADDR deprecate" is now equivalent to
	  "ifconfig ADDR pltime 0".
	- "ifconfig [ifname]" prints "deprecated" when pltime is 0,
	  regardless of the flag value.
	(Note: there should be no difference on the behavior for users.)

netbsd/netiso reverted to the previous code.

2002-10-17  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* netbsd/sys/net/route.h: used padding in the route structure
	instead of using sockaddr_storage.  (See the change on Oct 7 below.)
	* netbsd/sys/netiso: backed out considerations about
	NEW_STRUCT_ROUTE cases, since there is no compatibility issue with
	the change above.

added the source of the previous fix.

2002-10-17  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/in6.c (in6_control): do not differentiate
	manually configured address from autoconfigured ones with regard
	to prefix management.  This should fix the problem that the direct
	route to a prefix was removed when one of the addresses sharing the
	prefix was removed.

fixed a kernel crash caused by the IGMPv3/MLDv2 operation adding new source address to the existing source address list.

fixed a kernel crash with MLDv2 advanced API.

implements MLDv1 Startup Query as in RFC2710 section 7.6-7.7.

sctp changes

drop cloning interface support for sys/net/if_*

2002-10-07  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd4/sys/net/route.h: experimentally added a trailing pad in
	the route structure instead of having the sockaddr_storage
	structure in order to
	1. keep it as small as possible, and
	2. avoid redefining "ro_dst" that caused a compatibility issue.

fixed MLDv2-related timer calculation bug.

it's already October

fixed kernel crash when stopping a multicast daemon.

more on 1.6 transition

netbsd 1.6

* sys/netinet6/ip6_output.c: pad length for PADN option header before
  jumbo payload option was incorrect.  from wang.zhong3@zte.com.cn

* sys/netinet6/{in6,nd6}.c: a better fix to "deprecated" address
  configuration.

2002-09-20  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/nd6.c (nd6_timer): backed out a change
	committed on September 4th, because it did not solve the actual
	problem and had a bad effect to other parts.

fixed a bug in SS_CMP() macro

* lib/libsctp: library for additional SCTP system calls.

* sys/netinet*/sctp*.c: result of sctp bakeoff from randall and folks.
  remove PR_ATOMIC from SOCK_STREAM model, to make it more compatible
  with TCP.

fixed a bug that IGMPv3 report is not sometimes advertised on FreeBSD4
when an application stopped listening.

fixed a kernel crash when forwarding an incoming PIM Register packet to outgoing interfaces.
 From: Alain Ritoux <alain.ritoux@6wind.com>

* kame/sys/netinet6/in6.h: use ff02::16 for all-mldv2-routers linklocal
  multicast (just in sync with IGMPv3's 224.0.0.22)

* sys/netinet{,6}/*: correct signedness mixups in pointer passing.

fixed a kernel-hangup with MLDV2 option, when an IPv6 prefix is removed

* mdnsd: make it compatible with Rendezvous in Apple Jaguar.
  (use port 5353 for multicast, attach "local" at the end of local
  names)

* */sys/netinet*/tcp*input.c: always respect shutdown(s, SHUT_RD).
  previous (4.4BSD) code did not check it in certain cases, resulting
  in unexpected kernel memory waste.

* kame/sys/netinet6/natpt_*.c:
- Does not process a IPv4 multicast packet.
  This packet is processed with code in ip_input().
- Drop fragmented ICMPv4 packet.
  We can not re-calculate ICMP checksum because translator does not
  re-assemble this fragmented packet so we can not get an ICMP length
  information.
- Fix a problem that data transfer fails when connect from v6
  client to v4 FTP server, and FTP server does not use 20 as
  source port number in data transfer with non-passive mode.
- Change the expiration time of translation slot entry.

MLDv2 host-side implementation for NetBSD and FreeBSD-4

* sys/netinet6/nd6.c: allow "deprecated" bit be specified via userland
  like ifconfig(8).   NetBSD PR 18163

protocol-independent multicast API sockopts (MCAST_*) number should not be duplicated with IPv6-level sockopts.

fixed typo

ported NetBSD IGMPv3 implementation into OpenBSD

2002-08-24  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* {freebsd4, netbsd}/sys/net/route.h (RTUSE, RTREUSE, RTRELEASE):
	avoided overriding invalid memory space by these macros when the
	system clock was rewinded.  This could really happen for FreeBSD,
	so the fix should apply to FreeBSD.
	As reported by Larry Baird <lab@gta.com> in KAME PR 439.

sync with FreeBSD 4.6.2-RELEASE

* sys/netinet6/esp_input.c: check packet length before fetching
  ESP authentication data.

remove use_deprecated change

* sys/netinet6/nd6.c: correct sysctl for ndp -p/-r to use proper
  copyout() logic.

* sys/netinet6/in6_proto.c: set default value for use_deprecated to 0,
  to avoid consequences with ftpd.

* sys/netinet6/esp_output.c: make a correct guess of ESP header size.
  it caused PMTUD problem on netbsd (we need to check esp4_ctlinput).

backout stf change, which was incorrect

* sys/net/if_stf.c: according to RFC2529, 6to4 MTU is 1480, not 1280.

kame/kame/ifmcstat: displays IGMPv2 and v3 multicast info

* sys/netinet6/dest6.c: disable home address destination option
  in default KAME(support MIP6 kernel only)

* netbsd: use NetBSD 1.5.3 as base.  beware: NetBSD 1.5.3 is shipped
  with vulnerable openssl.

* sys/netinet/sctp*: new sctp patch from randall.
* faithd.libevent: support PORT response without paren.

typo

2002-07-30  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/: added a new socket option/cmsg type
	"IPV6_PREFER_TEMPADDR" to control source address selection wrt
	temporary addresses per socket/packet.

wording

makes mcastread SSM-ready

IPv4 multicast packet is accepted/rejected properly as specified in IGMPv2/v3.

2002-07-25  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/libinet6/getifaddrs.c (getifaddrs): tried
	sysctl(NET_RT_IFLIST) up to several (currently 5) times.
	This will make the behavior robuster if many addresses are added
	after the size estimation of storage at the first sysctl.
	From: Hajimu UMEMOTO <ume@mahoroba.org>

* netbsd, kame/sys/netinet/in_msf.[ch]: merged NetBSD IGMPv3 code
  written by Hitoshi Asaeda@INRIA.
* freebsd4: ported the above implementation into FreeBSD-4.

ToDos: MLDv2 implementation based on this.
       merge into other platform(darwin, openbsd, bsdi4)

* sys/netinet6/esp_input:
fixed re-making mbuf chain after decrypting ipv6 esp packet
in case of a kernel without PULLDOWN_TEST.
that was only kame-snap on both fbsd3 and fbsd4 had this problem.

* ndp: update message for per-interface ND flags (-i) to be in sync
  with command line args.

* sys/netkey/key_debug.c:
debugging with "setkey -x" probably becomes easier.
this patch is from <archie@packetdesign.com>.

* sys/netkey/key.c:
the order of searching SA table for packets is fixed.
the kernel might select dying SAs when the kernel needed newest SA.

* sys/netinet/sctp*: new sctp patch from randall.  uses RADIX_MPATH
  codepath for freebsd4.

<200207>
2002-07-01  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* bsdi4/contrib/bind/src/lib/irs/dns_ho.c (gethostans,
	map_v4v6_hostent): synchronized with a recent security fix of the
	resolver library.  It is highly recommended to upgrade the KAME
	kit to the latest version and rebuild all applications.

resolver buffer overrun

* rtadvd: deprecate addrs#n and routes#n from rtadvd.conf, as it was
  difficult for users to keep consistency between addrs#n and addrN,
  and addrs#n were not really needed.

* faithd.libevent: faithd re-implementation using libevent (by niels
  provos - a great library!).  it does not fork(2) at all.  supports
  ftp protocol translation (EPSV only).

* sys/netinet/ip_output.c (except bsdi3/bsdi4/freebsd4):
  skip routing table lookup if outgoing interface is specified via
  setsockopt().

* faithd: correct ftp relay.

* kame/sys/netinet6/natpt_*.c:
- Fix a bug that port number does not changed when translator
  has a lots of TCP/UDP sessions and use one IPv4 source
  address for outgoing packet with IPv6->IPv4 translation.
- Re-calculate TCP checksum when TCP payload was modified with
  IPv6->IPv4 translation.
- Change IPv6 MTU which looked from IPv4 in 1260[octet] from
  1280[octet].

sync with freebsd46

2002-06-21  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6/dhcp6c: improved signal handling; the client now
	released all stateful resources when receiving SIGHUP or SIGTERM.
	In the former case dhcp6c would then restart.
	A bug that could produce dangling pointers was fixed, too.  It is
	recommended to upgrade the client to the latest version.

* sys/net/if_stf.c: reject packets with private IPv4 address
  (or 6to4 address derived from private IPv4 address).  from hitachi

* sys/netinet6/ipsec.c: use per-socket policy cache even more.

2002-06-15  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6:
	- caught up some changes in dhcpv6-26.
	- corrected configuration parser against multiple DNS addresses in
	  a single line.
	- sync the parser with the man page about infinite duration
	- bind client well-known port to the outgoing socket for better
	interoperability

* sys/netinet6/ipsec.c: avoid copying per-socket policy.  saves memory
  when a lot of pcbs are present (like busy webservers).  requested
  by markus@openbsd.org.

2002-06-10  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd4/ports/ppp/: made the interface ID selection more
	compliant to RFC 2472;
	- first IEEE EUI-48/64 identifiers are checked
	- use the full 64 bits when generating a random ID

* sys/netinet/ip_input.c: look at rmx_mtu on IPsec tunnel MTU
  computation.  From: David Waitzman <djw@bbn.com>

2002-06-06  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/rtadvd: when an advertised prefix configured from the
	kernel has been added or invalidated, notice the change in a short
	delay.

* kame/sys/netinet6/natpt_*.[ch]:
* kame/kame/natptconfig/*.[chly]:
  Picked up a modification minute of April and May, because I
  forgot to change CHANGELOG.
  - Revise the conformity with rfc2765 and rfc2766.
  - Changed the expiration time of translation slot entry
    (icmp=10, udp=10, tcp=1800).
  - "natptconfig" command does not read kernel symbol table any more.

2002-06-03  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd4/ports/ppp: upgraded to the latest snap kit as of today
	with KAME-original patches.

* sys/netinet6/nd6.c: in nd6_setmtu0(), do not hardcode if_mtu
  values (let sys/net layer handle them).  special cases are IFT_ARC
  and IFT_FDDI, which needs special handling in L3.

wording

2002-05-31  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/rtadvd: changed the behavior when an interface-direct
	prefix being advertised was removed from the kernel;
	rtadvd will continue to advertise the prefix with zero lifetimes
	rather than to stop advertising the prefix.
	This will help renumber a receiving host by deprecating the
	address derived from the old prefix.

* sys/netinet6/ip6_output.c: implement RFC2460 section 5, last
  paragraph (ICMPv6 too big with < 1280).

the reporter was added.

* kame/sys/netkey/key.c:
- the memory leak was fixed when an error happened during
  the kernel made a sadb_delete message.
- the SA type in the sadb_delete message was fixed when the kernel
  deleted the SA and made the message to tell it userland programs.

2002-05-30  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/nd6.c (nd6_setmtu0): separated from
	nd6_setmtu() to handle two different cases; interface (and its MTU)
	initialization and changing the MTU of an interface.
	This change also fixed a bug that could destroy kernel stack
	(when changing the interface MTU by hand) introduced yesterday.

2002-05-30  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6: [dhcp6c] added an ability to specify the SLA
	length in the configuration file.

folded a long line.

fixed RPF algorithm bugs for P2P connected routes and static interface routes
(reported from pekkas@netcore.fi)

* netbsd/freebsd2: provide arc4random(9) and use it.

* sys/netinet/tcp_subr.c: PMTUD blackhole detection.  sync w/netbsd-
  current.

* sys/netinet6/frag6.c: enforce max # of fragments (not fragment
  queues) to defend against DoS.  similar logic should be incorporated
  into IPv4 reassembly code (openbsd has one already).

* sys/netinet6/in6_ifattach.c: attach per-interface data structure
  to if_afdata[AF_INET6] member via dom_ifattach framework.

* sys/sys/if.h: add framework to have per-domain/af data onto
  struct ifnet.  as discussed on bsd-api-discuss.

2002-05-25  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/scope6.c (scope6_init): newly added to
	inialize scope zone IDs for as many interfaces as possible.
	This is important when an interface is somehow used for IPv6
	before activating (i.e. making it up) the interface.
	TODO: we'll still need to handle the case where an interface is
	dynamically attached.

2002-05-23  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6/dhcp6[cs].conf.5: provided man pages for
	configuration files of DHCPv6 client and server.

dhcp6 supported rebinding prefixes, too.

2002-05-22  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6: supported renewal of delegated prefixes.

* kame/revlookupd: a daemon to translate DNS reverse lookup (PTR query)
  into ICMPv6 node information query.  internet draft for this
  will be issued shortly.

sctp doesn't work for openbsd 3.1

openbsd 3.1

* sys/netinet/sctp_usrreq.c (and other sctp related code):
  upgraded to latest shipment from randall and folks.

2002-05-17  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6/dhcp6c: when constructing a reply message,
	included prefixes given in the corresponding advertisement message.
	* kame/kame/dhcp6/dhcp6s.c (server6_react_request): chose
	delegated prefixes based on the ones specified in the request
	message.

2002-05-17  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6/dhcp6.h: changed option type values that have
	not been officially assigned to the values documented in NTTC's
	service specification (as of today).
	Note: the current version has lost interoperability with former
	versions of KAME's dhcp6.  Please upgrade all clients and servers
	to the latest version.
	Note: we'll change the temporary values if different type values
	are officially assigned.

wording

2002-05-17  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6: supported the preference option; servers can
	specify the preference value for a particular interface.  Clients
	can parse the preference option and take it into account of
	choosing the best server.

2002-05-16  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6: supported the "normal" sequence of
	client-server exchange; solicit, advertise(s), request, and then
	reply.  There are still some restrictions; unicasted requests are
	not supported.  Address allocation is not supported (nor will be.)
	When the client received multiple advertisements, it would just
	pick the server that had the highest preference (though preference
	option is not supported).

2002-05-09  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6: implemented a limited support of prefix
	delegation based on draft-troan-dhcpv6-opt-prefix-delegation-01.txt.
	A client sends a solicit with a rapid commit option and an option
	request option specifying a prefix delegation option.  A server
	responds to the solicit with a reply containing a prefix
	delegation option.  The client accepts the reply and configure an
	address on specified interfaces using the delegated prefix.

* faithd: drop rsh/rlogin protocol support.

* kame/racoon:
fixed the behavior when
- when the "unique" level policy was used, racoon in the responder side
mis-configured the SAs.  <yvan.vanhullebus@netasq.com> reported and
donated the patch.

2002-05-01  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/in6.h: declared sockaddr in all supported OSes
	(KAME PR 418).

2002-05-01  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6/dhcp6s.c: added an ability to respond to a
	solicit message with a rapid commit option.

<200205>
2002-05-01  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6/dhcp6c.c (client6_send): ensured that the
	transaction-ID unchanged in retransmissions of a message according
	to Section 15.1 of dhcpv6-24.

wording

2002-04-30  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6: added the ability to send solicit messages with
	a rapid commit option.  A configuration file for dhcp6c was
	introduced to include the option.

2002-04-28  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/rtadvd/config.c (getconfig): if "addrs" was explicitly
	set to 0, enabled prefix autoconfiguration from the kernel.
	* kame/kame/rtadvd/rtadvd.c (main): set LOG_PERROR for openlog()
	when running in the foreground.
	Suggested by: Andrew White <awhite@arc.corp.mot.com>

* kame/kame/racoon:
fixed the key length of the null encryption for phase 2.
racoon configured incorrect key length of the null encryption
to the kernel.

2002-04-25  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6/dhcp6c.c (client6_recvreply):
	tightened DUID validation.
	* kame/kame/dhcp6/dhcp6s.c (server6_react_informreq):
	processed server and client DUID correctly.

2002-04-25  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6/common.c (get_dhcp6_option): newly added as a
	shared routine to parse DHCPv6 options.

2002-04-24  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6/dhcp6c.c: corrected handling DUID for the client
	side according to dhcpv6-24.

faithd changes

2002-04-24  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/dhcp6/dhcp6.h: removed the "dh6_servaddr" member from
	the dhcp6{} structure, which had been removed from the
	specification.
	Note that interoperability with implementations in older KAME
	snaps had been lost by this change.

2002-04-24  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/ping6/ping6.c (main): changed the behaivor of the -m
	option as follows:
	  - when the option is specified once, the default behavior (send
	    packets at the minimum MTU) will be disabled for unicast
	    packets.
	  - when the option is more than once, it will be disabled for both
	    unicast and multicast packets.

2002-04-24  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/ndp/ndp.c (ifinfo): used the new member of the
	nd_ifinfo structure (see the next log entry) to see if the
	structure had been initialized.

2002-04-24  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/nd6.c (nd6_ifattach): obsoleted the usage of
	nd_ifinfo.linkmtu as the flag if the structure had been
	initialized.  Introduced a new member "initialized" for this
	specific purpose instead.
	Note: this change had broken binary compatibility to ndp(8) with
	the -i option.  Be sure to upgrade the application as well.

2002-04-22  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/nd6.c (nd6_setmtu): warned if configured (or
	detected) interface MTU is smaller than IPv6 minimum link MTU.

2002-04-22  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/in6_ifattach.c (in6_ifattach): do not update
	in6_maxmtu in this function, in order to avoid using the MTU for a
	loopback MTU mistakenly.

2002-04-22  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/nd6.c (nd6_ifattach): do not synchronize an ND
	link MTU with the corresponding interface MTU, since this
	synchronization had a bad side effect when increasing the
	interface MTU.  Instead, when detecting the link's "real" MTU
	always consider those two values, and take the smaller one.
	(many code points, such as ip6_output(), that relied on the
	previous behavior were rewritten accordingly.)

wording

wording

2002-04-22  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/nd6.c (nd6_output): if there has been no NS
	for the neighbor after entering the INCOMPLETE state, send the
	first solicitation in nd6_output(), regardless of the timer value.
	This change will improve the response time to the first NS.

2002-04-19  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd4/sys/netinet/tcp_subr.c (tcp_respond): if
	IPV6_USE_MIN_MTU is specified for the option tell ip6_output to
	fragment the packet at the minimum MTU.

2002-04-19  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_output.c: changed the policy about
	performing path MTU discovery; from now on multicast packets will
	be sent at the IPv6 minimum link MTU by default.  The semantics of
	IPV6_USE_MIN_MTU was changed accordingly, as will be described in
	the forthcoming rfc2292bis-07.

does not log warning againt MLD message from :: (sync with the change of kame/sys/netinet6/nd6_nbr.c at Rev 1.76)

removed a white space after an EOL

2002-04-18  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd4/sys/netinet/ip_output.c (ip_output): always freed
	the route entry stored in iproute (if it was used) regardless of
	the IPSEC kernel compilation option.
	This should be a better fix to FreeBSD-SA-02:21.tcpip, and should
	apply the kernel without the IPSEC option.

2002-04-13  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/{icmp6.c, nd6.c}:
	* netbsd/sys/netinet/if_arp.c (arp_rtdrain):
	* netbsd/sys/net/route.c:
	ported the cached route management routines from freebsd4.

2002-04-12  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/: use nd_ifinfo.linkmtu instead of
	ifp->if_mtu to handle link MTU issues wrt IPv6, whenever possible.
	Some OS dependent code for freebsd4 and bsdi4 was also modified in
	this manner.  Some for netbsd and openbsd was untouched.

2002-04-10  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd4/sys/netinet/if_ether.c (arp_rtdrain):
	* kame/sys/netinet6/nd6.c (nd6_rtdrain):
	allowed the case where these functions received a NULL llinfo in
	order to avoid kernel panic in some situations.

2002-04-09  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd4/sys/netinet/if_ether.c (arp_rtdrain): newly added as
	the hook for arp entries in the route cache queue.  Since arp does
	not have much state, the detection algorithm cannot be very smart;
	we only keep entries that have already been resolved.
	(see also: nd6_rtdrain below)

2002-04-09  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/icmp6.c (icmp6_input, icmp6_mtudisc_update):
	dropped icmp6 too big messages that reported an MTU less than the
	minimum MTU (i.e., 1280 bytes).  We believe such an error is only
	meaningful when we're acting as an SIIT(-like) client, which we do
	not support.

2002-04-08  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/in6_proto.c: added a new sysctl knob
	"net.inet6.ip6.pmtu_expire" to configure the timer value (in
	seconds).
	(only available in freebsd4)

2002-04-08  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/icmp6.c (icmp6_mtudisc_timeout): enabled the
	function for FreeBSD to purge stale path MTU information.

corrected the previous log about path MTU discovery.

2002-04-06  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/icmp6.c (icmp6_mtudisc_update): revised the
	case that the reported path MTU is less than the minimum MTU so
	that the minimum MTU would be used instead.  The former behavior,
	which disabled path MTU discovery, was probably just derived from
	the IPv4 code, and was meaningless for IPv6, because path MTU
	discovery is mandatory in IPv6.  The previous behavior may even be
	exploited by some DoS attacks that intentionally send a too big
	message with an MTU less than the minimum.

2002-04-06  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/nd6.c (nd6_lookup): specified RTF_CACHE for a
	newly created route so that the route entry would be subject to
	cached route management.

2002-04-06  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/nd6.c (nd6_rtdrain): added as the callback
	function for each ND entry as a cached route, and decides
	whether the entry should really be removed based on the ND state.
	Entries which are reachable, delay or probe will not be removed.
	An ND cache to a default route will not be removed either.
	[FreeBSD4 only]

2002-04-06  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd4/sys/net/route.c (rtredirect): set RTF_CACHE before
	calling rtrequest() so that routes created by redirect will be
	subject to management of cached routes.

2002-04-06  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd4/sys/net/route.c: made cached route management more
	refined:
	- we now have 3 parameters to limit the cache; max, hiwat, and
	  lowat, all of which are configured automatically based on the
	  kernel memory limit.
	- rt_draincache() is called when the number of entries are being
	  beyond "hiwat", and the function tries to keep the entries
	  between "lowat" and "hiwat".
	- do not regard static routes as cache.
	- allow ifa_rtrequest() functions to add a timer entry so that
	  they can set a refined cleanup function.

2002-04-01  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* bsdi4/sys/net/route.c: added cached routes management (see
	below).

removed garbage.

<200204>
2002-04-01  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/nd6.c (nd6_lookup): checked if rt_llinfo is
	non-NULL to avoid returning an entry that has the LLINFO flag but
	is not a neighbor cache entry.
	* kame/sys/netinet6/nd6.c (nd6_is_addr_neighbor): removed the
	check for the pointer, because the check is now done in nd6_lookup().

(forgot to add log entries)

2002-03-29  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* {freebsd4, netbsd, openbsd}/sys/net/route.c: added an ability to
	manage the number of route entries that can be regarded as cache,
	in order to prevent local/remote DoS.  This is a preliminary and
	experimental support, which will need more work.  The same
	function for bsdi will be committed next week.

2002-03-29  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd4/sys/net/route.c: ported routing entry timer from
	NetBSD (which was originally derived from BSD/OS).

2002-03-29  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/pim6sd/mld6v2.c (make_mld6v2_msg):
	* kame/kame/pim6sd/mld6.c (make_mld6_msg):
	* kame/kame/pim6dd/mld6.c (make_mld6_msg):
	always initialized destination address structures.
	Otherwise, the strucuture may contain garbages in sin6_scope_id,
	which might be rejected in recent versions of kernel.

2002-03-29  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/nd6_rtr.c (defrouter_addifreq): set
	RTF_CLONING when installing a default route to an interface
	in order to perform ND correctly.  Previously this flag was
	implicitly set from the corresponding ifa_flags, which was dropped
	by a fix on 2002-02-26.  We could revert the former change, but I
	belive we should set the flag explicitly.

- Fix some fragmentation related bugs.
- Revise the following nonconformance to RFC2765.

2002-03-25  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/nd6.c (nd6_purge): zero-cleard the
	corresponding ND info.  Otherwise, parameters for removed
	interfaces could be reused for a newly-created interface.

folded a long line.

2002-03-18  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ah_input.c (ah6_ctlinput):
	* kame/sys/netinet6/esp_input.c (esp6_ctlinput):
	corrected arguments to key_allocsa().  This fix is very important
	if you use IPsec, because key_allocsa() in recent snaps has a
	strong validation check which will cause kernel panic against
	bogus values.

2002-03-18  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_output.c (ip6_output): do not update the
	"dst" address, which is the next-hop address, for multicast
	destinations.  Otherwise, the layer 2 destination address would be
	bogus.

2002-03-17  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd4/sys/netinet6/udp6_usrreq.c (udp6_input): corrected
	address matching rules for incoming multicast packets, as
	suggested by Konstantin KABASSANOV <Konstantin.Kabassanov@lip6.fr>
	Without the change, multicast applications that binds the
	receiving socket with the multicast address would fail to accept
	incoming packets.

* sys/netinet6/frag6.c: implement real lock around IPv6 reassembly code.
  (netbsd/openbsd only)

* netbsd/sys/netinet/tcp_subr.c: have tcp6_drain().

2002-03-10  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_mroute.c:
	- made sure to attach packet addresses to every mbuf even after
	  m_copy().
	- added a supplement function m_copy_withpktaddrs() for this
	  purpose.
	Thanks to: "Konstantin KABASSANOV" <Konstantin.Kabassanov@lip6.fr>
	for finding the problem and testing patches.

2002-03-03  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/wru: added the -z option to specify the zone of the
	destination, particularly for the default destination, ff02::1.

2002-03-03  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* bsdi4/sys/netinet/tcp_subr.c (tcp6_ctlinput): loosened the
	assertion check for the "inner" source.  The check was so strong
	that it caused kernel panic when the function called from
	ip6_output() via pfctlinput2().
	bsdi4 KAME snap users are recommended to apply this fix.

Sun Mar  3 01:51:54 JST 2002 Keiichi SHIMA <keiichi@iij.ad.jp>
	* kame/sys/netinet6/{in6.c|mip6.c|mip_var.h|nd6_rtr.c}
	check the CoA when p2p address (like gif) is set.  this enables
	you to use MIP6 with molec.

2002-03-02  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_output.c (ip6_ctloutput, and related
	functions):
	- applied recent clarifications in rfc2292bis:
	  + ignored IPV6_DONTFRAG and IPV6_RECVPATHMTU for TCP sockets
	  + disallowed to set non-unspecified address by IPV6_PKTINFO for
	    TCP sockets
	- corrected the return value from getsocketopt for IPV6_DONTFRAG and
	  IPV6_USE_MIN_MTU

<200203>
2002-03-02  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/icmp6.c (icmp6_redirect_output): included
	a target link layer address option in the redirect message for an
	on-link destination as well as for a better router.  This behavior
	should be correct according to the specification.

	* freebsd4/ports/ppp: awkhulhak ppp

2002-02-26  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd4/sys/netinet6/in6_pcb.c (in6_mapped_sockaddr,
	in6_mapped_peeraddr): do not convert the unspecified address (::)
	to the mapped address form.  Otherwise, get{peer, sock}name(2) for
	an AF_INET6 wildcard address would return ::ffff:0.0.0.0.

	* freebsd4/sys/netinet/tcp_usrreq.c (tcp6_usr_connect): set
	inc_isipv6 when connecting to a non-mapped AF_INET6 address.

2002-02-26  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd4/sys/netinet/tcp_syncache.c (syncache_socket): when
	making a PCB entry from a syn cache, do not forget to copy
	inc_isipv6.  Otherwise, we would fail to update a stale cached
	route.

corrected a change date

fixed a bug that sendmsg() on raw socket sometimes fails by ENXIO,
due to the inconsistency between embedded zone-id and the calculated
outgoing interface-id.

* sys/netinet/ip_input.c: enforce ipsec policy checking on forwarding
  case (the portion was lost during transition to PR_LASTHDR).
  From: Greg Troxel <gdt@ir.bbn.com>

not remove global addresses on loopback interface from routing table by route aging.

2002-02-23  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/nd6.c (nd6_rtrequest): rejected the process of
	RESOLVE when the interface does not need neighbor caches.
	Otherwise, this function would mistakenly try to make a neighbor
	cache for an stf interface.
	Based on a report from Ross Finlayson <finlayson@live.com> at the
	freebsd-net ML.

pim6sd doesn't crash now when receiving (*,*,RP) entry.

* kame/kame/racoon:
to specify the identifier in "sainfo" directive is deprecated.
the identifier should be always made from SPD.

fixed a kernel crash that occurs when you enable IPv6 Multicast on VLAN interface.

2002-02-19  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_output.c (ip6_setmoptions): fixed kernel
	panic in the case of IPV6_LEAVE_GROUP without an interface.
	The kernel would choose the group based on the address only with
	fix.
	Note, however, that ambiguity on the scope zone of the address
	would not be allowed by default.  This particularly means that you
	should always specify the interface for interface or link local
	groups.
	Based on: a report from Tomomi Suzuki <stomomi@ebina.hitachi.co.jp>

2002-02-19  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/tcp6_subr.c (tcp6_respond): called
	ip6_getpktaddrs() correctly.  NULL pointers would be referred to
	without this fix.
	Based on: a report from Tomomi Suzuki <stomomi@ebina.hitachi.co.jp>

2002-02-19  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_input.c (ip6_init2): called nd6_ifattach()
	for the loopback interface, in order to make sure to initialize
	the nd_ifinfo structure for the interface.

2002/02/19 16:05:42 JST kjc@csl.sony.co.jp
	* reduce differences from netbsd-current and openbsd-3.0:
	 - use ALTQ_DECL() for altq only variables.
	 - make IFQ_ENQUEUE() take 4 args even for the non-altq case
	 - the return type of altq_etherclassify() is changed from
	   int to void.
	   the function prototype is moved to if_altq.h.
	* add more altq supported drivers and link types.
	  most of the remaining drivers are supported by now.

2002-02-18  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/in6.h: stopped defining the route_in6{}
	structure for bsdi4 regardless of local configuration options.
	We'll never need this because BSD/OS has merged the "new" route{}
	structure, which can store all socket addresses.
	* kame/sys/netinet6/{mld6.c, route6.h}: always included route.h
	based on the change above.

* kame/sys/netinet6/natpt_*.[ch]:
* kame/kame/natptconfig/*.[chly58]:
- About natptcofig command
  - Add "-q" option to suppress error message.
  - Change it to return non ZERO value when detects syntax error.
- NAT-PT rule has rule number.
  You can omit rule number when setting NAT-PT.  In this case,
  behaviour of natptconfig command is same as previous.
  Rules can be deleted individually; Rule number can be
  renumbered;
- see natptconfig(8) and natpt.conf(5) for more detail.

2002-02-14  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_input.c (ip6_input): cleanup; removed a
	duplicated check for mapped source or destination addresses.

2002-02-14  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/mld6.c (mld6_start_listening): added an
	assertion in the case of this function was called before
	mld6_init().

2002-02-14  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_input.c (ip6_init2): stopped calling
	in6_ifattach(lo0).  We in fact do not need to call in6_ifattach()
	at this stage.  Additionally, in6_ifattach() has a bad effect of
	sending packets even though some parts of the kernel are not ready
	for sending.

* freebsd4: sync with 4.5-RELEASE

openbsd netstat change

2002-02-09  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/{netinet6, netkey}/: changed the definition of
	in6_multi{} to contain a full sockaddr_in6 of the multicast
	address.  Related functions were also modified accordingly.

	* kame/kame/ifmcstat/ifmcstat.c (in6_multientry):
	* netbsd/usr.bin/netstat/if.c (intpr):
	Modified according to the change above.  These tools should
	be rebuilt as well as the kernel.

2002-02-04  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* bsdi4/sys/netinet6/in6_pcb.c (in6_pcbbind): correctly separated
	IPv4-mapped address case in in6_pcbbind().  Reported from bsdi.

2002-02-04  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/ping6: supported a new option '-g gateway' to allow a
	specific next hop.

2002-02-03  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* bsdi4/sbin/sysctl/sysctl.c (sysctl_key): supported net.key.*
	sysctls.

2002-02-02  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd4/sys/netinet6/udp6_usrreq.c (udp6_ctlinput):
	* openbsd/sys/netinet/udp_usrreq.c (udp6_ctlinput):
	* bsdi4/sys/netinet/udp_usrreq.c (udp6_ctlinput):
	corrected arguments to ip6_pcbnotify().

2002-02-02  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd4/sys/netinet/tcp_subr.c (tcp_respond): correctly reset
	returned IPv6 header.  This is essential when the original packet
	contains an IPv6 extension header.

2002-02-02  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* bsdi4/usr.sbin/netstat/inet.c (ipsec6_stats): supported printing
	statistics for IPsec over IPv6.

2002-02-02  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* many kernel files: totally revised IPv6 scoped address
	architecture in the kernel.
	- sticked to use sockaddr_in6, not in6_addr, as much as possible
	- did not refer to ip6_src/ip6_dst (which may have ambiguity on
	  scope zones), but used full sockaddr_in6 structures attached to
	  the packet
	- replaced special cases for link-local addresses with code that
	  used generic functions such as in6_addr2zoneid()
        - additional cleanups mainly for scoped address handling

	The change is so big and we'll need some more time to stabilize
	the code.  It is not recommended to use the latest code for
	purposes that need stable behavior.

* kame/sys/netinet6/natpt_{defs,rule,soctl,usrreq}.[ch]:
* kame/kame/natptconfig/misc.c:
- Change NATPT related ioctl macro name which begin with
  "SIOC" to name which begin with "NATPT".  "SIOC" as ioctl
  macro name prefix is too general.

Mon Jan 28 17:19:19 JST 2002 keiichi@iij.ad.jp
	* kame/sys/netnet6/{mip6.c,mip6_binding.c,mip6.h}
	- fix a bug in the processing routine of the authentication data
	  sub-option.
	- change the default security policy for protecting bu/ba.
	  if compiled for ID-15, IPsec = 0 and authdata = 1.
	  if compiled for ID-13, IPsec = 1.

* bsdi4: upgrade base version to BSD/OS 4.3.

removed a white space after an eol

2002-01-26  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_output.c (ip6_ctloutput): handled
	getsockopt(IPV6_RTHDR) correctly.
	In response to: KAME PR 403 from ylg@logique.jussieu.fr

* kame/kame/racoon:
the port number in the phase1 identifier is set 500
when the identifier type is the ip address
although it is described ambiguity in RFC2407 4.6.2.

2002-01-23  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_output.c (ip6_output): checked the
	IPV6_MINMTU flag in ip6_output as well as the IP6PO_MINMTU flag in
	the outgoing packet options.  The former can still be set by
	icmp6_reflect or gif_output.

Mon Jan 21 21:07:25 JST 2002 keiichi@iij.ad.jp
	* kame/sys/netinet6/mip6*,kame/kame/mip6control/
	add swithces to enable/disable
	- the check code of bu/ba if they are protected by the ipsec.
	- the check code of bu/ba if they are protected by the authdata.
	to enable/disable those switches, use mip6cotrol.

2002-01-21  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/in6_pcb.h:
	* {bsdi4, freebsd, openbsd}/sys/netinet/in_pcb.h:
	- added foreign/local socket address structures to in[6]pcb{} in order
	  to have scope zone information of IPv6 addresses
	- changed [fl]addr and [fl]port as shortcut macro
	* kame/sys/netinet6/in6_pcb.c (in6_pcballoc):
	* {bsdi4, freebsd, openbsd}/sys/netinet/in_pcb.c (in_pcballoc):
	- set sin6_family and sin6_len when allocating an AF_INET6 pcb

	Note: this change implicitly affected applications that referred
	to the in[6]pcb structure (e.g. netstat).  Be sure to update
	header files and recompile all KAME applications.

2002-01-21  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/wru: allowed the user to omit the hostname, in which
	case the command used ff02::1 disambiguating the link zone using
	the default interface.

tabified.

2002-01-21  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/route6.c (ip6_rthdr0): made the source routing
	code more scope-aware:
	- it now considers all type of scopes (i.e. not only link-local
	  addresses).
        - it conforms to the forwarding rule described in the scoping arch
	  draft.

fixed a bug that MLDv2 Report crashes pim6sd.

2002-01-20  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	improved the support of IPv6 scoped addresses:
	* kame/sys/netinet6/ip6_var.h: added sockaddr_in6 structures to
	record source and destinaion addresses with scope information.
	* kame/sys/netinet6/ip6_input.c (ip6_input): recorded the
	addresses.
	* kame/sys/netinet6/ip6_forward.c(ip6_forward): used the recorded
	addresses to check scope breakage and to get a route.

2002-01-20  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/udp6_output.c (udp6_output): corrected the
	length argument to in_cksum (bsdi4 only).

2002-01-20  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd4/sys/netinet/in_pcb.c (in_pcbladdr):
	* {freebsd4, netbsd, openbsd}/sys/netinet/ip_output.c (ip_output):
	* {netbsd, openbsd}/sys/netinet/in_pcb.c (in_selectsrc):
	- check the address family of the destination cached in a PCB.
	- clear the cached destination before getting another cached
	  route.  Otherwise, garbage in the padding space (which might be
	  filled in if it was used for IPv6) could annoy rtalloc.

	Note for OpenBSD: though Openbsd actually does not need these
	fixes since it does not support IPv4-mapped IPv6 addresses, the
	fixes are at least not harmful and will avoid possible bugs in the
	future if it will ever support mapped addresses.

2002-01-20  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/in6_src.c (in6_selectroute): checked the
	address family of a cached destination, in case of sharing the
	cache with IPv4.
	In response to: a bug report from Vineet Goel in the snap-users
	ML.

fixed a bug that (*,G) entry diminishes due to a failure of MLD Query advertisement.

* kame/sys/netinet6/natpt_*.[chly]:
  kame/kame/natptconfig/natpt_{defs,dispatch}.[ch]:
- Change a method of modification or reference of NAT-PT local
  variable.  Natptconfig show subcommand does not read
  /dev/kmem any more when refer to variable.

the log message in the previous commit was wrong.
it should have been "wording fix."

cut hair
cleaning

2002-01-12  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/icmp6.c (icmp6_rip6_input): if the received
	data is small enough but in an mbuf cluster, copy the data to a
	separate mbuf that do not use a cluster.
	This change will reduce the possiblity of packet loss in the
	socket layer.

wording

2002-01-12  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/wru: was added as a separate command for ICMPv6 node
	information queries.  The first motivation of this command is to
	provide the ability to handle the queries and responses with
	platforms that do not support 'ping6 -w'.  Though this command is
	just a subset of 'ping6 -w' at this moment, it has some useful
	properties comparing to the existing command.  For example, wru
	only sends a single query even for a multicast destination.  In
	this case, it collects replies during a certain amount of period,
	prints the result, and then exits.

2002-01-11  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/in6_src.c (in6_selectif): do not use a
	rejected or black route to pick the outgoing interface.
	Otherwise, we could disambiguate a scoped destination with the
	invalid route and would see some confusing results.

2002-01-11  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_input.c (ip6_input): do not accept packets
	to a destination that has a rejected or blackhole host route.

wording

2002-01-10  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* (many kernel files): cleaned up the code to receive extension
	headers (and other optional information) on TCP sockets.  The
	kernel TCP stack does not pass the information to applications.
	All related functions were removed with this change, while the
	"imputopts" member in the PCB structure was remained just in case.

2002-01-10  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_output.c (ip6_clearpktopts): avoided NULL
	pointer reference.  The reference should have occurred in very
	rare cases, but it is recommended to upgrade the kernel the
	20011231 snap and later.

2002-01-10  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_input.c (ip6_savecontrol): do not compare
	the previous value of each option to decide if the option should
	be passed to application.  This part has been removed from the
	advanced API spec.

2002/01/07 21:26:21 JST kjc@csl.sony.co.jp
	add ECN (Explicit Congestion Notification) support (RFC3168).
	the ECN implementation consists of 3 independent components:
	  - marking mechanism in ALTQ
	  - tunnel-egress and fragment reassenbly rules in layer-3
	  - TCP mechanisms

	to enable ECN support in TCP, build a kernel with TCP_ECN
	and turn it on by sysctl -w net.inet.tcp.ecn=1
	netstat(1) shows the ECN related statistics.

	a simple example setup for ALTQ to mark packets on interface xl0:
		interface xl0 bandwidth 3M red ecn

2002-01-03  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* bsdi4/sys/netinet/ip_icmp.c (icmp_input): passed applications
	icmp6 error packets that contained ipv6 over ipv4 packets,
	even if the error packet did not have enough length to store the
	whole IPv6 packets.  traceroute -6 in fact needed this behavior.

2002-01-02  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/traceroute: added a new option "-6" to send IPv6 over
	IPv4 probe packets.  This option will specifically be useful to
	see if an intermediate router rejects the tunneled packets.

<200201>
2002-01-02  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/in6.h: restricted the use of
	IPV6_RECVRTHDRDSTOPTS in the kernel.  This option was obsoleted in
	rfc2292bis-03.

removed all changes in 2001.

2001-12-28  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_input.c (ip6_savecontrol): do not separate
	the case for IPV6_RTHDRDSTOPTS and the case for IPV6_DSTOPTS,
	according to rfc2292bis-03.
	* kame/sys/netinet6/ip6_var.h: accordingly replaced the dest1 and
	dest2 members of ip6_recvpktopts{} with a single "dest" member.

2001-12-27  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* *bsd/usr.sbin/ip6addrctl: a dedicated directory was digged in
	order for the tool to be compiled as a standard package.
	* kame/kame/ip6addrctl: renamed from kame/kame/addrselect
	according to the change of the command name.

* dhcp6: use draft 22 Inform/Reply exchange as suggested in
  draft-droms-dnsconfig-dhcpv6-00.txt.  no backward compatibility
  provided.

Thu Dec 27 11:42:38 JST 2001 keiichi@iij.ad.jp
	* kame/sys/netinet6/mip6*
	- implemented authdata sub-optoin.  this implementation uses
	  KAME/IPSEC spd/sa database.  because of this reason, OpenBSD can't
	  use authdata sub-option.  the spd and sa can be set using
	  setkey program.  the protocol number is currently ipv6-opts(60).
	  it needs some discussion how to set spd/sa for authdata/mip6.

	  currently, i do not provide a switch to disable authdata
	  feature.  the users must specify spd and sa between the mn and
	  ha/cn.  otherwise, the home registration/bu operation will fail.

	  take a look into TODO.mobile-ip6 to understand how to set up
	  spd/sa for authdata sub-option.

(an addition to the previous change)
	- corrected the option length value returned by these functions so
	  that the length would only contain the data length (i.e. without
	  the type and length fields)

wording

grammar

2001-12-25  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/libinet6/ip6opt.c (inet6_opt_next, inet6_opt_find):
	corrected the calculation of the "previous length" returned by
	these functions.  The returned length should contain the length of
	the returned option.

2001-12-24  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* *bsd/sbin/ip6addrctl: a dedicated directory was digged in order
	for the tool to be compiled as a standard package.

wording

2001-12-22  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/in6_src.c (in6_selectroute): corrected a
	condition to getting a route to the next hop specified by the
	IPV6_NEXTHOP option.  Statistics counter was also incremented in
	this function.

style

2001-12-21  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/addrselect/: renamed the program to ip6addrctl so that
	the name would describe its function well.

2001-12-21  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_output.c (ip6_raw_ctloutput): added as a new
	function ip6_raw_ctloutput, which only handles IPV6_CHECKSUM.  The
	purpose for the separate function is to share the logic by all
	*BSD.
	A new validation rule to reject odd offset values was added,
	according to the latest specification of the advanced API.

2001-12-21  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_output.c (ip6_raw_ctloutput): added as a new
	function ip6_raw_ctloutput, which only handles IPV6_CHECKSUM.  The
	purpose for the separate function is to share the logic by all *BSD.

2001-12-21  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_output.c (ip6_ctloutput): supported a new
	IPv6 socket option IPV6_PATHMTU defined in rfc2292bis-03.

* sys/netinet6/in6_gif.c: correct default hoplimit value for
  IPvX-over-IPv6 tunnel (has been set to 0 due to #include mistake).

2001-12-20  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_output.c: supported a new IPv6 socket
	option IPV6_DONTFRAG as described in rfc2292bis-03.  This option
	is used to disable IPv6-layer fragmentation.

* kame/racoon:
fixed that the negotiation always failed when "verify_identifier"
was defined with aggressive mode.

2001-12-19  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/libinet6/getaddrinfo.c (get_addrselectpolicy): enabled
	for FreeBSD.

2001-12-19  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/addrselect/addrselect.c: used ioctl()s just added below
	to set/delete policy entries.

2001-12-19  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/{in6.c, in6_src.c}:
	- implemented two new ioctls to set/delete address selection
	  policy entry
	- disabled write operation of net.inet6.ip6.addrselpolicy
	  accordingly
	with these changes, address selection policy can now be installed
	on all supported platforms.

2001-12-18  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/{kame,sys}/(many files): replaced mld6_xxx and MLD6_XXX
	with mld_xxx and MLD_XXX according to the change below.

2001-12-18  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet/icmp6.h: revised MLD-related definitions:
	- used mld_xxx and MLD_xxx instead of mld6_xxx and MLD6_xxx
	  according to the official defintions in rfc2292bis
	- changed the first member of mld_hdr{} from mld_hdr to
	  mld_icmp6_hdr to avoid name space conflict in C++

* kame/racoon:
Suported the 6144-bit DH MODP group.  Fixed some memory leaks.

2001-12-14  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/in6.c (in6_control): always called
	pfxlist_onlink_check() after the process of SIOCAIFADDR_IN6.  The
	function call was mistakenly put in a wrong block with another
	fix.
	Based on: a report from <hei@kddilabs.jp>

fixed a bug that multicast routing daemon sometimes fails in (S,G) entry
installation if multicast routing is enabled on IPv4 and IPv6 at the same
time.

wording

* kame/sys/natpt_{defs,dispatch}.[ch]:
- Add a code to send ICMP "packet too big" message to IPv4
  host when IPv4 packet is too big (at most 1232 octets,
  excluding the IPv4 header) to translate into IPv6.  1232
  comes from 1280 (IPv6 minimum MTU) minus 40 for the IPv6
  header and 8 for the Fragment header.

  A problem of the host who does not listen to ICMP is still
  unsolved.

Correct wording.

* kame/racoon:
the retransmission logic has been improved.  racoon stores the packet
that have been sent.  when racoon receives a packet that have been
processed already, racoon reply a saved packet simply.
the default timer for waiting each negotiation also has been changed.

* kame/sys/netinet6/natpt_{dispatch,tslot,var}.[ch]:
- Support translation from ICMPv6 that occurred with IPv6 host
  into ICMPv4 in "IPv4->IPv6" translation.

  This translation is done even if there is no "IPv6->IPv4"
  translation rule, but only this ICMPv6 packet is a target of
  translation.  Because translator examines whether this is
  ICMP of return more first than translation rule, eventually
  "IPv6->IPv4" translation rule is not adapted to.

2001-12-12  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/libinet6/getaddrinfo.c: implemented more rules for
	destination addr ordering; matching label, higher precedence, and
	longest matching.  Due to differences on sysctl, the first two
	rules are not available for FreeBSD at this moment.

* kame/sys/netinet6/natpt_{defs,dispatch,trans,tslot,var}.[ch]:
- Support fragmented IPv4 packet translation.
  Fragmented IPv4 packet is translated into fragmented one or
  two IPv6 packet.  IPv4 packet larger than 1280 bytes
  (monolithic or fragmented) is translated into fragmented
  two IPv6 pakcets.  Sorry, DF flag is not cared yet.

Tue Dec  4 20:58:54 JST 2001 keiichi@iij.ad.jp
	* kame/sys/net/if_hif.[hc]
	* kame/sys/netinet6/{mip6.[hc],mip6_binding.c}
	* kame/sys/netinet6/nd6_rtr.c
	- do movement detection in pfxlist_onlink_check() instead of
	  nd6_ra_input().  this change makes it possible to utilize
	  the change of the status of (detached) prefixes to detect
	  movement.

2001-12-04  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* bsdi4/contrib/bind/src/lib/irs/dns_ho.c (ho_byaddr):
	* bsdi4/contrib/bind/src/lib/resolv/res_init.c (res_setoptions):
	use ip6.arpa. then ip6.int. as the upper domain for IPv6 reverse
	loookups (with the nibble format), unless the "no-ip6-arpa"
	resolver option is specified.

* libinet6/name6.c: on IPv6 reverse name lookup, query ip6.arpa
  then ip6.int (both using nibble format).

2001-12-03  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* netbsd/sys/netinet/tcp_subr.c (ipsec4_hdrsiz_tcp): corrected
	IP+TCP headers to calculate the header size.
	This fix is very important, because without the fix the kernel
	would bypass the path acquiring SAs even if the policy requires
	IPsec.
	All KAME netbsd users who use IPsec for TCP/IPv4 should apply this
	fix.

200112

Mon Dec  3 21:24:25 JST 2001 keiichi@iij.ad.jp
	* kame/sys/net/if_hif.c, kame/sys/netinet6/mip6*
	- change the movement detection algorithm from prefix infomation
	  based to coa based.  this is more stateless addrconf friendly.
	- fix incorrect ifa_rtrequest setting in hif_ioctl.

* ALTQ works again for openbsd-3.0.
- the ALTQ base is enabled in "sys/conf/GENERIC" but other ALTQ
  options are enabled in "openbsd/sys/arch/i386/conf/GENERIC.KAME".

* openbsd: switched to openbsd 3.0.  still needs a torture-testing.
  ALTQ is unavailable for the moment.

* kame/sys/netinet6/natpt_{defs,dispatch,trans,tslot,var}.[ch]:
- Support translation from fragmented IPv6 packet to IPv4.
  IPv4 packet is also fragmented.

  Restriction: The first fragmented packet must have all of
  header of ICMP/TCP/UDP, because this translation does not
  support assembly of fragmented packets.

* kame/sys/crypto/cast128,kame/sys/netinet6/esp_core.c:
fixed the cast128 calculation with a short cipher key length.
the memory was overridden when the key length was less than 16 bytes.

- never uses timer with id == 0, since it means "unspecified"
- frees/discards/resets everything with regard to the stopping VIF.

* kame/kame/pim6sd
- SSM prefix definition is now based on draft-ietf-ipngwg-uni-based-mcast-03.txt
- joins all MLDv2 routers group on all interfaces listening to MLDv2
- updated MLDv2-related code (from Mickael Hoerdt)

* kame/kame/racoon:
- when racoon receives a IKE packet, it checks the value of the
responder's cookie strictly.
- fixed to recover the state when a error happens during the phase1
negotiation.  the return value was overwritten a illegal value.
- added a debugging code to find memory leaks.  two memory leaks
have been fixed.

2001-11-26  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_output.c(ip6_output): initialized the last
	argument to ip6_process_hopopts(), because the callee requires it
	to be 0 when a jumbo payload option is contained.
	(We may have to reconsider the requirement, though.)

2001-11-25  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd4/{altq*, hroute6d, ppp, pvc*, ifconfig}/Makefile:
	linked KAME's libinet6 in order to make sure to use the latest
	getaddrinfo() and getnameinfo().  Those applications may not work
	well with libc due to latest changes of handling IPv6 scoped
	addresses, particularly the lack of NI_WITHSCOPEID.

* sys/netinet/ip_output.c: update outgoing interface only if ipsec
  tunnel mode encapsulation is applied.  the change is necessary to
  use IPsec over multicast (like IP_MULTICAST_IF).

* sys/netinet6/udp6_output.c: initialize IPv4 source address on packet
  correctly, when IPv4 mapped address is used on AF_INET6 socket.
  affects bsdi4 only.

Thu Nov 15 20:09:26 JST 2001 keiichi@iij.ad.jp
	* kame/sys/netinet6/mip6*
  	- fix a binding request bug. now CN sends a binding request for
  	  the mobile node of a expiring binding cache.
  	- add auth sub-option handling.
  	  currently zero-length auth sub-option (means no auth) is
  	  sent/received with bu.
	- stop using in6_control() for address handling.  instead,
	  use in6_update_ifa/in6_purgeaddr.

* kame/kame/natptconfig/showsubs.c:
- Invert the source and destination address of the remote side
  of "natptconfig show xlate" command output.
  Prior to this change, "natptconfig show xlate" command
  indicates it in order having with kernel internal table.
  However this output is against intuition (and does not fit
  header line either).

* kame/sys/netinet6/natpt_rule.c:
- Adapt a translation rule when packet is TCP and only SYN
  flag is set.  Until now, this NAT-PT starts translation
  even if TCP packet with no SYN flag is coming.  However,
  this behavior seems no good, action was changed in this way.

2001-11-14  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/raw_ip6.c (rip6_usrreq):
	* freebsd4/sys/netinet6/raw_ip6.c (rip6_send):
	allow (with warning messages) an unspecified address family for
	the destination address to provide backward compatibility to
	buggy(!) applications.
	We may change our mind later on this.

added recent changes:
2001-11-13  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/(many files): removed all references to
	NI_WITHSCOPEID.

2001-11-13  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* *bsd/lib/libinet6/Makefile: added scope.c to SRCS in order to
	deal with scope zone IDs.  The library functions defined in the
	file are KAME specific, and not standard ones.

2001-11-13  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/rtsold/rtsold.c (ifconfig): got a proper link ID for
	each interface.
	* kame/kame/rtsold/rtsol.c (sendpacket):
	* kame/kame/rtsold/probe.c (sendprobe):
	set the link ID for the outgoing link-local packet.

2001-11-13  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/rtsold/rtsol.c (sockopen): initialize the family and
	the length members of a sockaddr_in6 structure correctly.

2001-11-13  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/raw_ip6.c (rip6_usrreq):
	* freebsd4/sys/netinet6/raw_ip6.c (rip6_send):
	validated the length and the address family of the destination for
	the send operation.  This fix is correct per se, but breaks
	backward compatibility to old rtsol(d) due to a bug of the
	application(s).

2001-11-13  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/(many files): changed the way of qualifying
	the zone of address scope.  The current code basically assumes the
	application sets the scope zone correctly, and only uses the
	default zone value as the last resort (if configured so).
	However, a workaround was provided for backward compatibility; the
	kernel also tries to disambiguate the scope zone after selecting
	the source address and the outgoing interface.

net.inet6.ip6.use_defaultzone is probably okay for openbsd as well.

2001-11-10  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/kame/ping6/ping6.c (main): used a pair of the
	IPV6_UNICAST_HOPS and IPV6_MULTICAST_HOPS socket options
	instead of the IPV6_HOPLIMIT sticky option, because the usage
	of IPV6_HOPLIMIT might be disabled in a future version of
	rfc2292bis.

2001-11-10  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* {kame, *BSD}/sys/netinet6/various files: introduced a new sysctl
	variable "net.inet[6].ip6.use_defaultzone" to enable the notion of
	default scope zone.  When the variable is non-0, the kernel will
	try to set an appropriate zone ID for an address given from an
	application if its scope zone is ambiguous.
	TODO: port to openbsd.

2001-11-10  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/ip6_output.c (ip6_setpktoption): disabled the
	check for the address part of IPV6_PKTINFO, and let
	in6_selectsrc() do the check.
	* kame/sys/netinet6/in6_src.c (in6_selectsrc): validate the
	address specified by IPV6_PKTINFO.  This change will introduce
	additional cost when the option is specified as a sticky option,
	but this type of usage should be rare and can be ignored.

2001-11-10  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* freebsd4/sys/netinet6/in6_pcb.c (in6_pcbladdr, in6_pcbbind):
	set the default scope zone ID when unspecified.
	* freebsd4/sys/netinet6/in6_pcb.c (in6_setsockaddr,
	in6_setpeeraddr): use in6_recoverscope(), which is more generic.

* bsdi4/sbin/ifconfig/ifconfig.c: support "tunnel" and "deletetunnel"
  keyword for setting/removing gif physical address.

* kame/kame/racoon:
racoon will compare between the list of "sainfo" and the initiator's
proposal even when "generate_policy" is defined.

* kame/kame/natptconfig/{cfparse,yylex}.[cy]:
- Keyword "proto" is necessary before protocol when you write
  protocol dependant rule.  It is written that "proto" is
  necessary in man page, and "natptconfig show rules" command
  also indicates "proto".

2001-11-07  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/in6.c (in6_update_ifa): when a user (perhaps
	mistakenly) tried to install an IPv6 address with 0 valid
	lifetime, just returned without any operation that had side
	effects.  There should be no difference on the behaviour from the
	user's side, but the code should be safer than before because of
	the lack of the effects.

Wed Nov  7 12:30:49 JST 2001 keiichi@iij.ad.jp
	* kame/sys/netinet6/mip6_var.h,mip6_binding.c
        - add ifnet info to the binding cache structure
          to distinguish one bc on the home link from the other bcs
          which has a same interface identifier on the other link.
          (need to recompile mip6control)

style: folded a long line.

2001-11-06  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/nd6.c (nd6_purge): corrected purging the
	default router list in nd6_purge(), so that both two loops would
	surely start from the head of the list.  Otherwise, we'd see some
	garbage routers after purging the interface.

grammar

2001-11-06  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/in6.c (in6_update_ifa): set address lifetimes
	before calling in6_ifinit().  The previous code should be correct,
	but at least this one should not be wrong.  Additionally, it
	surely solves the situation that configuring an IPv6 address on
	some NetBSD PCMCIA card cause kernel panic.
	Suggested by {karino, sugyo}@kame.

* kame/sys/netinet6/ipsec.c:
fixed the behavior when there is no inbound policy for the ipsec
tunneled packet.
when there is no suitable inbound policy for the packet of the ipsec
tunnel mode, the kernel never decapsulate the tunneled packet
as the ipsec tunnel mode even when the system wide policy is "none".
then the kernel leaves the generic tunnel module to process this
packet.  if there is no rule of the generic tunnel, the packet
is rejected and the statistics will be counted up.

* kame/sys/netinet6/udp6_usrreq.c, netbsd/sys/netinet/udp_usrreq.c:
  remove in6_mcmatch().  now sockets after bind(2) won't grab packets
  to joined multicast groups (behavior now looks like 4.4BSD IPv4 code).

2001-11-04  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/nd6_rtr.c (defrouter_select): do not override
	a working router unless the new one is really better.  "better"
	means (1) the old router is not known to be reachable, or (2) the
	new router has a really higher preference value than the old one.

2001-11-04  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	clarified cached route manipulation:
	* kame/sys/netinet6/in6_src.c (in6_selectroute): check if the
	cached route is up before using the cache.  With this check, we
	can select more appropriate source addresses.
	* kame/sys/netinet6/ip6_output.c (ip6_output): removed the check
	for the cached route to avoid redundancy.

calculates PIM checksum without encapsulated packet if it is a Register message.

2001-11-02  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* bsdi4/sys/netinet/in.c (in_control): fixed a bug that the kernel
	can panic in process of the SIOCSIFADDR ioctl unless the
	COMPAT_IFIOCTL kernel compilation option is specified.

2001-10-31  JINMEI, Tatuya  <jinmei@isl.rdc.toshiba.co.jp>
	* kame/sys/netinet6/nd6_rtr.c (defrtrlist_update): corrected the
	default router selection algorithm so that round-robin will surely
	be performed when there's no reachable router.

	Also, do not try to install more than one default router,
	regardless of the availability of the multipath routing.  This is
	because I'm not sure about the benefits for stub hosts comparing
	to the risk of making the code complicated and the possibility of
	introducing bugs.  (the previous code was actually buggy.)

	The bug was found by recent TAHI tests, and was reported by Yukiyo
	Akisada <yukiyo_akisada@yokogawa.co.jp>

- Support IPv4 -> IPv6 translation.

  Translation is restricted, one ipv4 host can connect to ipv6
  host.  This connection is one-on-one.  So, if you want to
  connect more than one IPv6 host, same number of IPv4 addresses
  are necessary.

  For example,  assume you add following rule.
	map from daddr 10.21.32.252
		to daddr 2001:240:10a:5555:260:8ff:feb0:96f4

# I bend this line because line is long, but describe it in
  single line.

  IPv4 packet destined to this IPv4 address described just after
  first "daddr" is a target of translation of IPv4->IPv6, and is
  redirected to 2001:240:10a:5555:260:8ff:feb0:96f4, also
  described just after second "daddr".

  This IPv4 address (10.21.32.252 in above example) had better
  not to be NAT-PT box address.  It will be easy to use ifconfig
  command.  For example,
	ifconfig fxp0 inet 10.21.32.252 netmask 255.255.255.0 alias
  Of course, change interface name, ip address and netmask in
  accordance with your network.

added a past log.
* kame/kame/racoon:
fixed that the negotiation of the tunnel mode always failed.

fixed in date order.

* kame/sys/netkey/key.c:
the system wide policy should be returned when no policy found
in the SPD.  the packet was rejected in ipsec[46]_tunnel_validate().

* kame/sys/netinet6/natpt_{defs,rule,transtslot}.[ch]:
  kame/kame/natptconfig/{cfparse,misc,showsubs,yylex}.[cy]:
- Support bi-directional IPv4 NAT.
    This NAT binds global address to private address
    one-on-one statically.  Sessions can be initiated from
    hosts in the public network as well as the private
    network.  So, if you can set nat session as bidirectional,
    you can connect to the host located behind this NAT from
    public IPv4 network.
    You need several IPv4 address, an equal number of host to
    be connected to.  Sorry, manual page is not ready yet.

Fri Oct 26 22:29:15 JST 2001 keiichi@iij.ad.jp
	* kame/sys/netinet6/mip6.c
        - add a binding request sending code.