Changeset 179

Timestamp:

01/11/07 13:05:17 (2 years ago)

Author:

ccase

Message:

merged with upstream 07-01-11

Files:

• upstream/ipsec-tools/ChangeLog (modified) (1 diff)
• upstream/ipsec-tools/configure.ac (modified) (1 diff)
• upstream/ipsec-tools/src/libipsec/Makefile.am (modified) (1 diff)
• upstream/ipsec-tools/src/libipsec/libpfkey.h (modified) (4 diffs)
• upstream/ipsec-tools/src/libipsec/pfkey.c (modified) (24 diffs)
• upstream/ipsec-tools/src/racoon/Makefile.am (modified) (2 diffs)
• upstream/ipsec-tools/src/racoon/backupsa.c (modified) (13 diffs)
• upstream/ipsec-tools/src/racoon/backupsa.h (modified) (2 diffs)
• upstream/ipsec-tools/src/racoon/cfparse.y (modified) (5 diffs)
• upstream/ipsec-tools/src/racoon/cftoken.l (modified) (2 diffs)
• upstream/ipsec-tools/src/racoon/crypto_openssl.c (modified) (3 diffs)
• upstream/ipsec-tools/src/racoon/doc/README.plainrsa (added)
• upstream/ipsec-tools/src/racoon/ipsec_doi.c (modified) (7 diffs)
• upstream/ipsec-tools/src/racoon/ipsec_doi.h (modified) (2 diffs)
• upstream/ipsec-tools/src/racoon/isakmp_inf.c (modified) (2 diffs)
• upstream/ipsec-tools/src/racoon/isakmp_quick.c (modified) (4 diffs)
• upstream/ipsec-tools/src/racoon/pfkey.c (modified) (28 diffs)
• upstream/ipsec-tools/src/racoon/policy.c (modified) (4 diffs)
• upstream/ipsec-tools/src/racoon/policy.h (modified) (4 diffs)
• upstream/ipsec-tools/src/racoon/proposal.c (modified) (6 diffs)
• upstream/ipsec-tools/src/racoon/proposal.h (modified) (3 diffs)
• upstream/ipsec-tools/src/racoon/racoon.conf.5 (modified) (11 diffs)
• upstream/ipsec-tools/src/racoon/remoteconf.c (modified) (2 diffs)

upstream/ipsec-tools/ChangeLog

@@ +1 @@
+2006-12-18  Yvan Vanhullebus  <vanhu@netasq.com>
+        From Joy Latten <latten@austin.ibm.com>
+        * src/racoon/crypto_openssl.c: fixed a memory leak
+        
+---------------------------------------------
+
+        Branch for 0.7 created (ipsec-tools-0_7-branch)
+
+2006-12-11 Emmanuel Dreyfus  <manu@netbsd.org>
+        * src/libipsec/{Makefile.am|libpfkey.h|pfkey.c}
+          src/racoon/{backupsa.c|pfkey.c}: Bring back API and ABI backward
+          compatibility with previous libipsec interface change. Bump 
+          libipsec minor version. Remove ifdefs in struct pfkey_send_sa_args
+          to avoid ABI compatibility lossage.
+        * src/libipsec/{libpfkey.h|pfkey.c} src/racoon/cfparse.y: add 
+          capability flags to detect missing optional feature in libipsec
+
+2006-12-10 Emmanuel Dreyfus  <manu@netbsd.org>
+        From Joy Latten <latten@austin.ibm.com>
+        * src/racoon/Makefile.am
+          src/racoon/doc/README.plainrsa: new file documenting plain RSA auth
+
+2006-12-09 Emmanuel Dreyfus  <manu@netbsd.org>
+        From Joy Latten <latten@austin.ibm.com>
+        * configure.ac src/libipsec/{libpfkey.h|pfkey.c}
+          src/racoon/{Makefile.am|backupsa.c|backupsa.h|cftoken.l|ipsec_doi.c}
+          src/racoon/{ipsec_doi.h|isakmp_inf.c|isakmp_quick.c|pfkey.c|policy.c}
+          src/racoon/{policy.h|proposal.c|proposal.h|remoteconf.c}: Add                   support for SELinux security contexts. Also cleanup the libipsec
+          interface for adding and updating security associations.
+
+        From Simon Chang <simonychang@gmail.com>
+        * src/racoon/racoon.conf.5: More hints about plain RSA authentication
+
+2006-12-05  Yvan Vanhullebus  <vanhu@netasq.com>
+        * src/racoon/proposal.[ch]: Check keys length regarding
+          pcheck_level in cmpsatrns().
+        * src/racoon/racoon.conf.5: updated man page about what is
+          impacted by proposal_check level.
+
-2006-11-12  Matthew Grooms <mgrooms@shrew.net>
-        * src/racoon/sainfo.c: fix anonymous sainfo selection.

upstream/ipsec-tools/configure.ac

@@ -769 +769 @@
-                SECCTX_OBJS="security.o"
-                AC_SUBST(SECCTX_OBJS)
+                LIBS="$LIBS -lselinux"
-        fi
-fi

upstream/ipsec-tools/src/libipsec/Makefile.am

@@ -24 +24 @@
-# version is current:revision:age.
-# See: http://www.gnu.org/manual/libtool-1.4.2/html_chapter/libtool_6.html#SEC32
-0
+1
-libipsec_la_LIBADD = $(LEXLIB)
-

upstream/ipsec-tools/src/libipsec/libpfkey.h

@@ -1 @@
-0 2006/09/09 16:22:0
+2 2006/12/10 18:46:3
-
-/* Id: libpfkey.h,v 1.13 2005/12/04 20:26:43 manubsd Exp */
@@ -69 +69 @@
-#endif
-
+struct pfkey_send_sa_args {
+        int             so;                     /* socket */
+        u_int           type;                   
+        u_int           satype;
+        u_int           mode;
+        struct sockaddr *src;                   /* IP src address for SA */
+        struct sockaddr *dst;                   /* IP dst address for SA */
+        u_int32_t       spi;                    /* SA's spi */
+        u_int32_t       reqid;
+        u_int           wsize;
+        caddr_t         keymat;
+        u_int           e_type, e_keylen;       /* Encryption alg and keylen */
+        u_int           a_type, a_keylen;       /* Authentication alg and key */
+        u_int           flags;
+        u_int32_t       l_alloc;
+        u_int32_t       l_bytes;
+        u_int32_t       l_addtime;
+        u_int32_t       l_usetime;
+        u_int32_t       seq;
+        u_int8_t        l_natt_type;
+        u_int16_t       l_natt_sport, l_natt_dport;
+        struct sockaddr *l_natt_oa;
+        u_int16_t       l_natt_frag;
+        u_int8_t ctxdoi, ctxalg;        /* Security context DOI and algorithm */
+        caddr_t ctxstr;                 /* Security context string */
+        u_int16_t ctxstrlen;            /* length of security context string */
+};
+
+/* The options built into libipsec */
+extern int libipsec_opt;
+#define LIBIPSEC_OPT_NATT               0x01
+#define LIBIPSEC_OPT_FRAG               0x02
+#define LIBIPSEC_OPT_SEC_CTX            0x04
+
-/* IPsec Library Routines */
-
@@ -88 +122 @@
-int pfkey_send_getspi __P((int, u_int, u_int, struct sockaddr *,
-        struct sockaddr *, u_int32_t, u_int32_t, u_int32_t, u_int32_t));
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
-int pfkey_send_delete __P((int, u_int, u_int,
-        struct sockaddr *, struct sockaddr *, u_int32_t));
@@ -147 +165 @@
-int pfkey_align __P((struct sadb_msg *, caddr_t *));
-int pfkey_check __P((caddr_t *));
+
+/* 
+ * Deprecated, available for backward compatibility with third party 
+ * libipsec users. Please use pfkey_send_update2 and pfkey_send_add2 instead
+ */
+int pfkey_send_update __P((int, u_int, u_int, struct sockaddr *,
+        struct sockaddr *, u_int32_t, u_int32_t, u_int,
+        caddr_t, u_int, u_int, u_int, u_int, u_int, u_int32_t, u_int64_t,
+        u_int64_t, u_int64_t, u_int32_t));
+int pfkey_send_update_nat __P((int, u_int, u_int, struct sockaddr *,
+        struct sockaddr *, u_int32_t, u_int32_t, u_int,
+        caddr_t, u_int, u_int, u_int, u_int, u_int, u_int32_t, u_int64_t,
+        u_int64_t, u_int64_t, u_int32_t,
+        u_int8_t, u_int16_t, u_int16_t, struct sockaddr *, u_int16_t));
+int pfkey_send_add __P((int, u_int, u_int, struct sockaddr *,
+        struct sockaddr *, u_int32_t, u_int32_t, u_int,
+        caddr_t, u_int, u_int, u_int, u_int, u_int, u_int32_t, u_int64_t,
+        u_int64_t, u_int64_t, u_int32_t));
+int pfkey_send_add_nat __P((int, u_int, u_int, struct sockaddr *,
+        struct sockaddr *, u_int32_t, u_int32_t, u_int,
+        caddr_t, u_int, u_int, u_int, u_int, u_int, u_int32_t, u_int64_t,
+        u_int64_t, u_int64_t, u_int32_t,
+        u_int8_t, u_int16_t, u_int16_t, struct sockaddr *, u_int16_t));
-
-#ifndef __SYSDEP_SA_LEN__

upstream/ipsec-tools/src/libipsec/pfkey.c

@@ -1 @@
-1 2006/09/21 09:42:08 vanh
+3 2006/12/10 18:46:39 man
-
-/*      $KAME: pfkey.c,v 1.47 2003/10/02 19:52:12 itojun Exp $  */
@@ -61 +61 @@
-static int setsupportedmap __P((struct sadb_supported *));
-static struct sadb_alg *findsupportedalg __P((u_int, u_int));
-
-
-
-
-
+
-static int pfkey_send_x2 __P((int, u_int, u_int, u_int,
-        struct sockaddr *, struct sockaddr *, u_int32_t));
@@ -92 +88 @@
-static caddr_t pfkey_set_natt_frag __P((caddr_t, caddr_t, u_int, u_int16_t));
-#endif
+
+#ifdef SADB_X_EXT_SEC_CTX
+static caddr_t pfkey_setsecctx __P((caddr_t, caddr_t, u_int, u_int8_t, u_int8_t,
+                                    caddr_t, u_int16_t));
+#endif
+
+int libipsec_opt = 0
+#ifdef SADB_X_EXT_NAT_T_TYPE
+        | LIBIPSEC_OPT_NATT
+#endif
+#ifdef SADB_X_EXT_NAT_T_FRAG
+        | LIBIPSEC_OPT_FRAG
+#endif
+#ifdef SADB_X_EXT_NAT_T_SEC_CTX
+        | LIBIPSEC_OPT_SEC_CTX
+#endif
+        ;
-
-/*
@@ -495 +508 @@
- */
-int
-
-
-
-
-
-
-
-
-
-
-
-
+
+
-{
-        int len;
-
-
-
-
-
+
+
+
+
-                return -1;
-
-        return len;
-}
-
-#ifdef SADB_X_EXT_NAT_T_TYPE
-int
-pfkey_send_update_nat(so, satype, mode, src, dst, spi, reqid, wsize,
-                      keymat, e_type, e_keylen, a_type, a_keylen, flags,
-                      l_alloc, l_bytes, l_addtime, l_usetime, seq,
-                      l_natt_type, l_natt_sport, l_natt_dport, l_natt_oa,
-                      l_natt_frag)
-        int so;
-        u_int satype, mode, wsize;
-        struct sockaddr *src, *dst;
-        u_int32_t spi, reqid;
-        caddr_t keymat;
-        u_int e_type, e_keylen, a_type, a_keylen, flags;
-        u_int32_t l_alloc;
-        u_int64_t l_bytes, l_addtime, l_usetime;
-        u_int32_t seq;
-        u_int8_t l_natt_type;
-        u_int16_t l_natt_sport, l_natt_dport;
-        struct sockaddr *l_natt_oa;
-        u_int16_t l_natt_frag;
-{
-        int len;
-        if ((len = pfkey_send_x1(so, SADB_UPDATE, satype, mode, src, dst, spi,
-                        reqid, wsize,
-                        keymat, e_type, e_keylen, a_type, a_keylen, flags,
-                        l_alloc, (u_int)l_bytes, (u_int)l_addtime, 
-                        (u_int)l_usetime, seq, l_natt_type, l_natt_sport, 
-                        l_natt_dport, l_natt_oa, l_natt_frag)) < 0)
-                return -1;
-
-        return len;
-}
-#endif
-
-/*
@@ -561 +529 @@
- */
-int
-
-
-
-
-
-
-
-
-
-
-
-
+
+
-{
-        int len;
-
-
-
-
-
+
+
+
-                return -1;
-
-        return len;
-}
-
-#ifdef SADB_X_EXT_NAT_T_TYPE
-int
-pfkey_send_add_nat(so, satype, mode, src, dst, spi, reqid, wsize,
-                   keymat, e_type, e_keylen, a_type, a_keylen, flags,
-                   l_alloc, l_bytes, l_addtime, l_usetime, seq,
-                   l_natt_type, l_natt_sport, l_natt_dport, l_natt_oa,
-                   l_natt_frag)
-        int so;
-        u_int satype, mode, wsize;
-        struct sockaddr *src, *dst;
-        u_int32_t spi, reqid;
-        caddr_t keymat;
-        u_int e_type, e_keylen, a_type, a_keylen, flags;
-        u_int32_t l_alloc;
-        u_int64_t l_bytes, l_addtime, l_usetime;
-        u_int32_t seq;
-        u_int8_t l_natt_type;
-        u_int16_t l_natt_sport, l_natt_dport;
-        struct sockaddr *l_natt_oa;
-        u_int16_t l_natt_frag;
-{
-        int len;
-        if ((len = pfkey_send_x1(so, SADB_ADD, satype, mode, src, dst, spi,
-                        reqid, wsize,
-                        keymat, e_type, e_keylen, a_type, a_keylen, flags,
-                        l_alloc, (u_int)l_bytes, (u_int)l_addtime, 
-                        (u_int)l_usetime, seq, l_natt_type, l_natt_sport, 
-                        l_natt_dport, l_natt_oa, l_natt_frag)) < 0)
-                return -1;
-
-        return len;
-}
-#endif
-
-/*
@@ -1295 +1217 @@
-/* sending SADB_ADD or SADB_UPDATE message to the kernel */
-static int
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
-{
-        struct sadb_msg *newmsg;
@@ -1319 +1227 @@
-
-        /* validity check */
-rc == NULL || 
+a_parms->src == NULL || sa_parms->
-                __ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
-                return -1;
-        }
-rc->sa_family != 
+a_parms->src->sa_family != sa_parms->
-                __ipsec_errcode = EIPSEC_FAMILY_MISMATCH;
-                return -1;
-        }
-
+a_parms->s
-        case AF_INET:
-                plen = sizeof(struct in_addr) << 3;
@@ -1339 +1247 @@
-        }
-
-
+_parms->sa
-        case SADB_SATYPE_ESP:
-
+sa_parms->
-                        __ipsec_errcode = EIPSEC_NO_ALGS;
-                        return -1;
@@ -1347 +1255 @@
-                break;
-        case SADB_SATYPE_AH:
-
+sa_parms->
-                        __ipsec_errcode = EIPSEC_INVAL_ALGS;
-                        return -1;
-                }
-
+sa_parms->
-                        __ipsec_errcode = EIPSEC_NO_ALGS;
-                        return -1;
@@ -1357 +1265 @@
-                break;
-        case SADB_X_SATYPE_IPCOMP:
-
+sa_parms->
-                        __ipsec_errcode = EIPSEC_INVAL_ALGS;
-                        return -1;
-                }
-
+sa_parms->
-                        __ipsec_errcode = EIPSEC_NO_ALGS;
-                        return -1;
@@ -1368 +1276 @@
-#ifdef SADB_X_AALG_TCP_MD5
-        case SADB_X_SATYPE_TCPSIGNATURE:
-
+sa_parms->
-                        __ipsec_errcode = EIPSEC_INVAL_ALGS;
-                        return -1;
-                }
-
+sa_parms->
-                        __ipsec_errcode = EIPSEC_INVAL_ALGS;
-                        return -1;
@@ -1388 +1296 @@
-                + sizeof(struct sadb_x_sa2)
-                + sizeof(struct sadb_address)
-
+a_parms->s
-                + sizeof(struct sadb_address)
-
+sa_parms->
-                + sizeof(struct sadb_lifetime)
-                + sizeof(struct sadb_lifetime);
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-#ifdef SADB_X_EXT_NAT_T_TYPE
-        /* add nat-t packets */
-
-
+sa_parms->
+_parms->sa
-                case SADB_SATYPE_ESP:
-                case SADB_X_SATYPE_IPCOMP:
@@ -1414 +1331 @@
-                len += sizeof(struct sadb_x_nat_t_port);
-                len += sizeof(struct sadb_x_nat_t_port);
-
+sa_parms->
-                        len += sizeof(struct sadb_address) +
-
+sa_parms->
-#ifdef SADB_X_EXT_NAT_T_FRAG
-
+sa_parms->
-                        len += sizeof(struct sadb_x_nat_t_frag);
-#endif
@@ -1430 +1347 @@
-        ep = ((caddr_t)(void *)newmsg) + len;
-
-
-type, 
+sa_parms->
+_parms->satype, sa_parms->
-        if (!p) {
-                free(newmsg);
-                return -1;
-        }
-
+
+
+
-        if (!p) {
-                free(newmsg);
-                return -1;
-        }
-mode, 
+sa_parms->mode, sa_parms->
-        if (!p) {
-                free(newmsg);
-                return -1;
-        }
-rc, (u_int)plen,
-   
+a_parms->src, 
+                     (u_int)plen,
-        if (!p) {
-                free(newmsg);
-                return -1;
-        }
-dst, (u_int)plen,
-   
+sa_parms->dst, 
+                     (u_int)plen,
-        if (!p) {
-                free(newmsg);
@@ -1459 +1378 @@
-        }
-
-
+
+
-                p = pfkey_setsadbkey(p, ep, SADB_EXT_KEY_ENCRYPT,
-keymat, 
+sa_parms->keymat, sa_parms->
-                if (!p) {
-                        free(newmsg);
@@ -1467 +1387 @@
-                }
-        }
-
+sa_parms->
-                p = pfkey_setsadbkey(p, ep, SADB_EXT_KEY_AUTH,
-
+
+
-                if (!p) {
-                        free(newmsg);
@@ -1478 +1399 @@
-        /* set sadb_lifetime for destination */
-        p = pfkey_setsadblifetime(p, ep, SADB_EXT_LIFETIME_HARD,
-
+
+
-        if (!p) {
-                free(newmsg);
@@ -1484 +1406 @@
-        }
-        p = pfkey_setsadblifetime(p, ep, SADB_EXT_LIFETIME_SOFT,
-
+
+
-        if (!p) {
-                free(newmsg);
-                return -1;
-        }
+#ifdef SADB_X_EXT_SEC_CTX
+        if (sa_parms->ctxstr != NULL) {
+                p = pfkey_setsecctx(p, ep, SADB_X_EXT_SEC_CTX, sa_parms->ctxdoi,
+                                    sa_parms->ctxalg, sa_parms->ctxstr, 
+                                    sa_parms->ctxstrlen);
+                if (!p) {
+                        free(newmsg);
+                        return -1;
+                }
+        }
+#endif
-
-#ifdef SADB_X_EXT_NAT_T_TYPE
-        /* Add nat-t messages */
-
-
+
+
+
-                if (!p) {
-                        free(newmsg);
@@ -1500 +1435 @@
-
-                p = pfkey_set_natt_port(p, ep, SADB_X_EXT_NAT_T_SPORT,
-
+sa_parms->
-                if (!p) {
-                        free(newmsg);
@@ -1507 +1442 @@
-
-                p = pfkey_set_natt_port(p, ep, SADB_X_EXT_NAT_T_DPORT,
-
+sa_parms->
-                if (!p) {
-                        free(newmsg);
@@ -1513 +1448 @@
-                }
-
-
+sa_parms->
-                        p = pfkey_setsadbaddr(p, ep, SADB_X_EXT_NAT_T_OA,
-
-
+sa_parms->
+sa_parms->
-                                              IPSEC_ULPROTO_ANY);
-                        if (!p) {
@@ -1524 +1459 @@
-                }
-
-                if (l_natt_frag) {
-#ifdef SADB_X_EXT_NAT_T_FRAG
+                if (sa_parms->l_natt_frag) {
-                        p = pfkey_set_natt_frag(p, ep, SADB_X_EXT_NAT_T_FRAG,
-
+sa_parms->
-                        if (!p) {
-                                free(newmsg);
-                                return -1;
-                        }
-
-
+
+
-        }
-#endif
@@ -1543 +1478 @@
-
-        /* send message */
-
+a_parms->s
-        free(newmsg);
-
@@ -2504 +2439 @@
-}
-#endif
+
+#ifdef SADB_X_EXT_SEC_CTX
+static caddr_t
+pfkey_setsecctx(buf, lim, type, ctx_doi, ctx_alg, sec_ctx, sec_ctxlen)
+        caddr_t buf;
+        caddr_t lim;
+        u_int type;
+        u_int8_t ctx_doi, ctx_alg;
+        caddr_t sec_ctx;
+        u_int16_t sec_ctxlen;
+{
+        struct sadb_x_sec_ctx *p;
+        u_int len;
+
+        p = (struct sadb_x_sec_ctx *)buf;
+        len = sizeof(struct sadb_x_sec_ctx) + PFKEY_ALIGN8(sec_ctxlen);
+
+        if (buf + len > lim)
+                return NULL;
+
+        memset(p, 0, len);
+        p->sadb_x_sec_len = PFKEY_UNIT64(len);
+        p->sadb_x_sec_exttype = type;
+        p->sadb_x_ctx_len = sec_ctxlen;
+        p->sadb_x_ctx_doi = ctx_doi;
+        p->sadb_x_ctx_alg = ctx_alg;
+
+        memcpy(p + 1, sec_ctx, sec_ctxlen);
+
+        return buf + len;
+}
+#endif
+
+/* 
+ * Deprecated, available for backward compatibility with third party 
+ * libipsec users. Please use pfkey_send_update2 and pfkey_send_add2 instead 
+ */
+int
+pfkey_send_update(so, satype, mode, src, dst, spi, reqid, wsize,
+                keymat, e_type, e_keylen, a_type, a_keylen, flags,
+                l_alloc, l_bytes, l_addtime, l_usetime, seq)
+        int so;
+        u_int satype, mode, wsize;
+        struct sockaddr *src, *dst;
+        u_int32_t spi, reqid;
+        caddr_t keymat;
+        u_int e_type, e_keylen, a_type, a_keylen, flags;
+        u_int32_t l_alloc;
+        u_int64_t l_bytes, l_addtime, l_usetime;
+        u_int32_t seq;
+{
+        struct pfkey_send_sa_args psaa;
+
+        memset(&psaa, 0, sizeof(psaa));
+        psaa.so = so;
+        psaa.type = SADB_UPDATE;
+        psaa.satype = satype;
+        psaa.mode = mode;
+        psaa.wsize = wsize;
+        psaa.src = src;
+        psaa.dst = dst;
+        psaa.spi = spi;
+        psaa.reqid = reqid;
+        psaa.keymat = keymat;
+        psaa.e_type = e_type;
+        psaa.e_keylen = e_keylen;
+        psaa.a_type = a_type;
+        psaa.a_keylen = a_keylen;
+        psaa.flags = flags;
+        psaa.l_alloc = l_alloc;
+        psaa.l_bytes = l_bytes;
+        psaa.l_addtime = l_addtime;
+        psaa.l_usetime = l_usetime;
+        psaa.seq = seq;
+
+        return pfkey_send_update2(&psaa);
+}
+
+int
+pfkey_send_update_nat(so, satype, mode, src, dst, spi, reqid, wsize,
+                      keymat, e_type, e_keylen, a_type, a_keylen, flags,
+                      l_alloc, l_bytes, l_addtime, l_usetime, seq,
+                      l_natt_type, l_natt_sport, l_natt_dport, l_natt_oa,
+                      l_natt_frag)
+        int so;
+        u_int satype, mode, wsize;
+        struct sockaddr *src, *dst;
+        u_int32_t spi, reqid;
+        caddr_t keymat;
+        u_int e_type, e_keylen, a_type, a_keylen, flags;
+        u_int32_t l_alloc;
+        u_int64_t l_bytes, l_addtime, l_usetime;
+        u_int32_t seq;
+        u_int8_t l_natt_type;
+        u_int16_t l_natt_sport, l_natt_dport;
+        struct sockaddr *l_natt_oa;
+        u_int16_t l_natt_frag;
+{
+        struct pfkey_send_sa_args psaa;
+
+        memset(&psaa, 0, sizeof(psaa));
+        psaa.so = so;
+        psaa.type = SADB_UPDATE;
+        psaa.satype = satype;
+        psaa.mode = mode;
+        psaa.wsize = wsize;
+        psaa.src = src;
+        psaa.dst = dst;
+        psaa.spi = spi;
+        psaa.reqid = reqid;
+        psaa.keymat = keymat;
+        psaa.e_type = e_type;
+        psaa.e_keylen = e_keylen;
+        psaa.a_type = a_type;
+        psaa.a_keylen = a_keylen;
+        psaa.flags = flags;
+        psaa.l_alloc = l_alloc;
+        psaa.l_bytes = l_bytes;
+        psaa.l_addtime = l_addtime;
+        psaa.l_usetime = l_usetime;
+        psaa.seq = seq;
+        psaa.l_natt_type = l_natt_type;
+        psaa.l_natt_sport = l_natt_sport;
+        psaa.l_natt_dport = l_natt_dport;
+        psaa.l_natt_oa = l_natt_oa;
+        psaa.l_natt_frag = l_natt_frag;
+
+        return pfkey_send_update2(&psaa);
+}
+
+int
+pfkey_send_add(so, satype, mode, src, dst, spi, reqid, wsize,
+                keymat, e_type, e_keylen, a_type, a_keylen, flags,
+                l_alloc, l_bytes, l_addtime, l_usetime, seq)
+        int so;
+        u_int satype, mode, wsize;
+        struct sockaddr *src, *dst;
+        u_int32_t spi, reqid;
+        caddr_t keymat;
+        u_int e_type, e_keylen, a_type, a_keylen, flags;
+        u_int32_t l_alloc;
+        u_int64_t l_bytes, l_addtime, l_usetime;
+        u_int32_t seq;
+{
+        struct pfkey_send_sa_args psaa;
+
+        memset(&psaa, 0, sizeof(psaa));
+        psaa.so = so;
+        psaa.type = SADB_ADD;
+        psaa.satype = satype;
+        psaa.mode = mode;
+        psaa.wsize = wsize;
+        psaa.src = src;
+        psaa.dst = dst;
+        psaa.spi = spi;
+        psaa.reqid = reqid;
+        psaa.keymat = keymat;
+        psaa.e_type = e_type;
+        psaa.e_keylen = e_keylen;
+        psaa.a_type = a_type;
+        psaa.a_keylen = a_keylen;
+        psaa.flags = flags;
+        psaa.l_alloc = l_alloc;
+        psaa.l_bytes = l_bytes;
+        psaa.l_addtime = l_addtime;
+        psaa.l_usetime = l_usetime;
+        psaa.seq = seq;
+
+        return pfkey_send_add2(&psaa);
+}
+
+int
+pfkey_send_add_nat(so, satype, mode, src, dst, spi, reqid, wsize,
+                      keymat, e_type, e_keylen, a_type, a_keylen, flags,
+                      l_alloc, l_bytes, l_addtime, l_usetime, seq,
+                      l_natt_type, l_natt_sport, l_natt_dport, l_natt_oa,
+                      l_natt_frag)
+        int so;
+        u_int satype, mode, wsize;
+        struct sockaddr *src, *dst;
+        u_int32_t spi, reqid;
+        caddr_t keymat;
+        u_int e_type, e_keylen, a_type, a_keylen, flags;
+        u_int32_t l_alloc;
+        u_int64_t l_bytes, l_addtime, l_usetime;
+        u_int32_t seq;
+        u_int8_t l_natt_type;
+        u_int16_t l_natt_sport, l_natt_dport;
+        struct sockaddr *l_natt_oa;
+        u_int16_t l_natt_frag;
+{
+        struct pfkey_send_sa_args psaa;
+
+        memset(&psaa, 0, sizeof(psaa));
+        psaa.so = so;
+        psaa.type = SADB_ADD;
+        psaa.satype = satype;
+        psaa.mode = mode;
+        psaa.wsize = wsize;
+        psaa.src = src;
+        psaa.dst = dst;
+        psaa.spi = spi;
+        psaa.reqid = reqid;
+        psaa.keymat = keymat;
+        psaa.e_type = e_type;
+        psaa.e_keylen = e_keylen;
+        psaa.a_type = a_type;
+&nb