Index: head/share/man/man4/enc.4
===================================================================
--- head/share/man/man4/enc.4	(nonexistent)
+++ head/share/man/man4/enc.4	(revision 159965)
@@ -0,0 +1,82 @@
+.\"	$OpenBSD: enc.4,v 1.22 2006/05/26 08:51:29 jmc Exp $
+.\"
+.\" Copyright (c) 1999 Angelos D. Keromytis
+.\" All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\"
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\" 3. All advertising materials mentioning features or use of this software
+.\"    must display the following acknowledgement:
+.\"	This product includes software developed by Angelos D. Keromytis.
+.\" 4. The name of the author may not be used to endorse or promote products
+.\"    derived from this software without specific prior written permission.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+.\"
+.\" $FreeBSD$
+.\"
+.Dd June 16, 2006
+.Dt ENC 4
+.Os
+.Sh NAME
+.Nm enc
+.Nd Encapsulating Interface
+.Sh SYNOPSIS
+.Cd "device enc"
+.Sh DESCRIPTION
+The
+.Nm
+interface is a software loopback mechanism that allows hosts or
+firewalls to filter
+.Xr fast_ipsec 4
+traffic using any firewall package that hooks in via the
+.Xr pfil 9
+framework.
+.Pp
+The
+.Nm
+interface allows an administrator
+to see outgoing packets before they have been processed by
+.Xr fast_ipsec 4 ,
+or incoming packets after they have been similarly processed, via
+.Xr tcpdump 8 .
+.Pp
+The
+.Dq enc0
+interface inherits all IPsec traffic.
+Thus all IPsec traffic can be filtered based on
+.Dq enc0 ,
+and all IPsec traffic could be seen by invoking
+.Xr tcpdump 8
+on the
+.Dq enc0
+interface.
+.Sh EXAMPLES
+To see all outgoing packets before they have been processed via
+.Xr fast_ipsec 4 ,
+or all incoming packets after they have been similarly processed:
+.Pp
+.Dl # tcpdump -i enc0
+.Sh SEE ALSO
+.Xr bpf 4 ,
+.Xr fast_ipsec 4 ,
+.Xr ipf 4 ,
+.Xr ipfw 4 ,
+.Xr pf 4 ,
+.Xr tcpdump 8

Property changes on: head/share/man/man4/enc.4
___________________________________________________________________
Added: svn:keywords
## -0,0 +1 ##
+FreeBSD=%H
\ No newline at end of property
Index: head/share/man/man4/fast_ipsec.4
===================================================================
--- head/share/man/man4/fast_ipsec.4	(revision 159964)
+++ head/share/man/man4/fast_ipsec.4	(revision 159965)
@@ -1,116 +1,122 @@
 .\" Copyright (c) 2003
 .\"	Sam Leffler <sam@errno.com>. All rights reserved.
 .\"
 .\" Redistribution and use in source and binary forms, with or without
 .\" modification, are permitted provided that the following conditions
 .\" are met:
 .\" 1. Redistributions of source code must retain the above copyright
 .\"    notice, this list of conditions and the following disclaimer.
 .\" 2. Redistributions in binary form must reproduce the above copyright
 .\"    notice, this list of conditions and the following disclaimer in the
 .\"    documentation and/or other materials provided with the distribution.
 .\"
 .\" THIS SOFTWARE IS PROVIDED BY Sam Leffler AND CONTRIBUTORS ``AS IS'' AND
 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 .\" ARE DISCLAIMED.  IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
 .\" BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 .\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 .\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 .\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 .\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
 .\" THE POSSIBILITY OF SUCH DAMAGE.
 .\"
 .\" $FreeBSD$
 .\"
 .Dd January 20, 2003
 .Dt FAST_IPSEC 4
 .Os
 .Sh NAME
 .Nm "Fast IPsec"
 .Nd hardware-accelerated IP Security Protocols
 .Sh SYNOPSIS
 .Cd "options FAST_IPSEC"
 .Cd "device crypto"
 .Pp
 .Bl -item -compact
 .It
 .Va net.inet.esp.enable
 .It
 .Va net.inet.ah.enable
 .It
 .Va net.inet.ipcomp.enable
 .El
 .Sh DESCRIPTION
 .Tn IPsec
 is a set of protocols,
 .Tn ESP
 (for Encapsulating Security Payload)
 .Tn AH
 (for Authentication Header),
 and
 .Tn IPComp
 (for IP Payload Compression Protocol)
 that provide security services for IP datagrams.
 .Nm
 is an experimental implementation of these protocols that uses the
 .Xr crypto 4
 subsystem to carry out cryptographic operations.
 This means, in particular, that cryptographic hardware devices are
 employed whenever possible to optimize the performance of these protocols.
 .Pp
 In general, the
 .Nm
 implementation is intended to be compatible with the
 .Tn KAME IPsec
 implementation.
 This documentation concentrates on differences from that software.
 The user should refer to
 .Xr ipsec 4
 for basic information on setting up and using these protocols.
 .Pp
 System configuration requires the
 .Xr crypto 4
 subsystem.
 When the
 .Nm
 protocols are configured for use, all protocols are included in the system.
 To selectively enable/disable protocols, use
 .Xr sysctl 8 .
+.Pp
+The packets can be passed to a virtual interface,
+.Dq enc0 ,
+to perform packet filtering before outbound encryption and after decapsulation
+inbound.
 .Sh DIAGNOSTICS
 To be added.
 .Sh SEE ALSO
 .Xr crypto 4 ,
+.Xr enc 4 ,
 .Xr ipsec 4 ,
 .Xr setkey 8 ,
 .Xr sysctl 8
 .Sh HISTORY
 The protocols draw heavily on the
 .Ox
 implementation of the
 .Tn IPsec
 protocols.
 The policy management code is derived from the
 .Tn KAME
 implementation found
 in their
 .Tn IPsec
 protocols.
 The
 .Nm
 protocols first appeared in
 .Fx 5.0 .
 .Sh BUGS
 There is presently no support for IPv6.
 .Pp
 The
 .Tn IPcomp
 protocol support does not work.
 .Pp
 Certain legacy authentication algorithms are not supported because of
 issues with the
 .Xr crypto 4
 subsystem.
 .Pp
 This documentation is incomplete.
Index: head/sys/conf/files
===================================================================
--- head/sys/conf/files	(revision 159964)
+++ head/sys/conf/files	(revision 159965)
@@ -1,2072 +1,2073 @@
 # $FreeBSD$
 #
 # The long compile-with and dependency lines are required because of
 # limitations in config: backslash-newline doesn't work in strings, and
 # dependency lines other than the first are silently ignored.
 #
 acpi_quirks.h			optional acpi				   \
 	dependency	"$S/tools/acpi_quirks2h.awk $S/dev/acpica/acpi_quirks" \
 	compile-with	"${AWK} -f $S/tools/acpi_quirks2h.awk $S/dev/acpica/acpi_quirks" \
 	no-obj no-implicit-rule before-depend				   \
 	clean		"acpi_quirks.h"
 aicasm				optional ahc | ahd			   \
 	dependency	"$S/dev/aic7xxx/aicasm/*.[chyl]"		   \
 	compile-with	"CC='${CC}' ${MAKE} -f $S/dev/aic7xxx/aicasm/Makefile MAKESRCPATH=$S/dev/aic7xxx/aicasm" \
 	no-obj no-implicit-rule						   \
 	clean		"aicasm* y.tab.h"
 aic7xxx_seq.h			optional ahc				   \
 	compile-with	"./aicasm ${INCLUDES} -I$S/cam/scsi -I$S/dev/aic7xxx -o aic7xxx_seq.h -r aic7xxx_reg.h -p aic7xxx_reg_print.c -i $S/dev/aic7xxx/aic7xxx_osm.h $S/dev/aic7xxx/aic7xxx.seq"   \
 	no-obj no-implicit-rule before-depend local			   \
 	clean		"aic7xxx_seq.h"					   \
 	dependency	"$S/dev/aic7xxx/aic7xxx.{reg,seq} $S/cam/scsi/scsi_message.h aicasm"
 aic7xxx_reg.h			optional ahc				   \
 	compile-with	"./aicasm ${INCLUDES} -I$S/cam/scsi -I$S/dev/aic7xxx -o aic7xxx_seq.h -r aic7xxx_reg.h -p aic7xxx_reg_print.c -i $S/dev/aic7xxx/aic7xxx_osm.h $S/dev/aic7xxx/aic7xxx.seq"   \
 	no-obj no-implicit-rule before-depend local			   \
 	clean		"aic7xxx_reg.h"					   \
 	dependency	"$S/dev/aic7xxx/aic7xxx.{reg,seq} $S/cam/scsi/scsi_message.h aicasm"
 aic7xxx_reg_print.c		optional ahc				   \
 	compile-with	"./aicasm ${INCLUDES} -I$S/cam/scsi -I$S/dev/aic7xxx -o aic7xxx_seq.h -r aic7xxx_reg.h -p aic7xxx_reg_print.c -i $S/dev/aic7xxx/aic7xxx_osm.h $S/dev/aic7xxx/aic7xxx.seq"   \
 	no-obj no-implicit-rule local					   \
 	clean		"aic7xxx_reg_print.c"				   \
 	dependency	"$S/dev/aic7xxx/aic7xxx.{reg,seq} $S/cam/scsi/scsi_message.h aicasm"
 aic7xxx_reg_print.o		optional ahc ahc_reg_pretty_print	   \
 	compile-with	"${NORMAL_C}"					   \
 	no-implicit-rule local
 aic79xx_seq.h		optional ahd pci				   \
 	compile-with	"./aicasm ${INCLUDES} -I$S/cam/scsi -I$S/dev/aic7xxx -o aic79xx_seq.h -r aic79xx_reg.h -p aic79xx_reg_print.c -i $S/dev/aic7xxx/aic79xx_osm.h $S/dev/aic7xxx/aic79xx.seq"   \
 	no-obj no-implicit-rule before-depend local			   \
 	clean		"aic79xx_seq.h"					   \
 	dependency	"$S/dev/aic7xxx/aic79xx.{reg,seq} $S/cam/scsi/scsi_message.h aicasm"
 aic79xx_reg.h		optional ahd pci				   \
 	compile-with	"./aicasm ${INCLUDES} -I$S/cam/scsi -I$S/dev/aic7xxx -o aic79xx_seq.h -r aic79xx_reg.h -p aic79xx_reg_print.c -i $S/dev/aic7xxx/aic79xx_osm.h $S/dev/aic7xxx/aic79xx.seq"   \
 	no-obj no-implicit-rule before-depend local			   \
 	clean		"aic79xx_reg.h"					   \
 	dependency	"$S/dev/aic7xxx/aic79xx.{reg,seq} $S/cam/scsi/scsi_message.h aicasm"
 aic79xx_reg_print.c	optional ahd pci				   \
 	compile-with	"./aicasm ${INCLUDES} -I$S/cam/scsi -I$S/dev/aic7xxx -o aic79xx_seq.h -r aic79xx_reg.h -p aic79xx_reg_print.c -i $S/dev/aic7xxx/aic79xx_osm.h $S/dev/aic7xxx/aic79xx.seq"   \
 	no-obj no-implicit-rule local					   \
 	clean		"aic79xx_reg_print.c"				   \
 	dependency	"$S/dev/aic7xxx/aic79xx.{reg,seq} $S/cam/scsi/scsi_message.h aicasm"
 aic79xx_reg_print.o		optional ahd pci ahd_reg_pretty_print	   \
 	compile-with	"${NORMAL_C}"					   \
 	no-implicit-rule local
 emu10k1-alsa%diked.h		optional snd_emu10k1 pci			   \
 	dependency	"$S/tools/emu10k1-mkalsa.sh $S/gnu/dev/sound/pci/emu10k1-alsa.h" \
 	compile-with	"CC='${CC}' AWK=${AWK} sh $S/tools/emu10k1-mkalsa.sh $S/gnu/dev/sound/pci/emu10k1-alsa.h emu10k1-alsa%diked.h" \
 	no-obj no-implicit-rule before-depend				   \
 	clean		"emu10k1-alsa%diked.h"
 miidevs.h			optional miibus | mii			   \
 	dependency	"$S/tools/miidevs2h.awk $S/dev/mii/miidevs"	   \
 	compile-with	"${AWK} -f $S/tools/miidevs2h.awk $S/dev/mii/miidevs" \
 	no-obj no-implicit-rule before-depend				   \
 	clean		"miidevs.h"
 pccarddevs.h			standard				   \
 	dependency	"$S/tools/pccarddevs2h.awk $S/dev/pccard/pccarddevs" \
 	compile-with	"${AWK} -f $S/tools/pccarddevs2h.awk $S/dev/pccard/pccarddevs" \
 	no-obj no-implicit-rule before-depend				   \
 	clean		"pccarddevs.h"
 usbdevs.h			optional usb				   \
 	dependency	"$S/tools/usbdevs2h.awk $S/dev/usb/usbdevs" \
 	compile-with	"${AWK} -f $S/tools/usbdevs2h.awk $S/dev/usb/usbdevs -h" \
 	no-obj no-implicit-rule before-depend				   \
 	clean		"usbdevs.h"
 usbdevs_data.h			optional usb				   \
 	dependency	"$S/tools/usbdevs2h.awk $S/dev/usb/usbdevs" \
 	compile-with	"${AWK} -f $S/tools/usbdevs2h.awk $S/dev/usb/usbdevs -d" \
 	no-obj no-implicit-rule before-depend				   \
 	clean		"usbdevs_data.h"
 cam/cam.c			optional scbus
 cam/cam_periph.c		optional scbus
 cam/cam_queue.c			optional scbus
 cam/cam_sim.c			optional scbus
 cam/cam_xpt.c			optional scbus
 cam/scsi/scsi_all.c		optional scbus
 cam/scsi/scsi_cd.c		optional cd
 cam/scsi/scsi_ch.c		optional ch
 cam/scsi/scsi_da.c		optional da
 cam/scsi/scsi_low.c		optional ct | ncv | nsp | stg
 cam/scsi/scsi_low_pisa.c	optional ct | ncv | nsp | stg
 cam/scsi/scsi_pass.c		optional pass
 cam/scsi/scsi_pt.c		optional pt
 cam/scsi/scsi_sa.c		optional sa
 cam/scsi/scsi_ses.c		optional ses
 cam/scsi/scsi_targ_bh.c		optional targbh
 cam/scsi/scsi_target.c		optional targ
 coda/coda_fbsd.c		optional vcoda
 coda/coda_namecache.c		optional vcoda
 coda/coda_psdev.c		optional vcoda
 coda/coda_subr.c		optional vcoda
 coda/coda_venus.c		optional vcoda
 coda/coda_vfsops.c		optional vcoda
 coda/coda_vnops.c		optional vcoda
 contrib/altq/altq/altq_cbq.c	optional altq \
 	compile-with "${NORMAL_C} -I$S/contrib/pf"
 contrib/altq/altq/altq_cdnr.c	optional altq
 contrib/altq/altq/altq_hfsc.c	optional altq \
 	compile-with "${NORMAL_C} -I$S/contrib/pf"
 contrib/altq/altq/altq_priq.c	optional altq \
 	compile-with "${NORMAL_C} -I$S/contrib/pf"
 contrib/altq/altq/altq_red.c	optional altq \
 	compile-with "${NORMAL_C} -I$S/contrib/pf"
 contrib/altq/altq/altq_rio.c	optional altq \
 	compile-with "${NORMAL_C} -I$S/contrib/pf"
 contrib/altq/altq/altq_rmclass.c optional altq
 contrib/altq/altq/altq_subr.c	optional altq \
 	compile-with "${NORMAL_C} -I$S/contrib/pf"
 contrib/dev/acpica/dbcmds.c	optional acpi acpi_debug
 contrib/dev/acpica/dbdisply.c	optional acpi acpi_debug
 contrib/dev/acpica/dbexec.c	optional acpi acpi_debug
 contrib/dev/acpica/dbfileio.c	optional acpi acpi_debug
 contrib/dev/acpica/dbhistry.c	optional acpi acpi_debug
 contrib/dev/acpica/dbinput.c	optional acpi acpi_debug
 contrib/dev/acpica/dbstats.c	optional acpi acpi_debug
 contrib/dev/acpica/dbutils.c	optional acpi acpi_debug
 contrib/dev/acpica/dbxface.c	optional acpi acpi_debug
 contrib/dev/acpica/dmbuffer.c	optional acpi acpi_debug
 contrib/dev/acpica/dmnames.c	optional acpi acpi_debug
 contrib/dev/acpica/dmopcode.c	optional acpi acpi_debug
 contrib/dev/acpica/dmobject.c	optional acpi acpi_debug
 contrib/dev/acpica/dmresrc.c	optional acpi acpi_debug
 contrib/dev/acpica/dmresrcl.c	optional acpi acpi_debug
 contrib/dev/acpica/dmresrcs.c	optional acpi acpi_debug
 contrib/dev/acpica/dmutils.c	optional acpi acpi_debug
 contrib/dev/acpica/dmwalk.c	optional acpi acpi_debug
 contrib/dev/acpica/dsfield.c	optional acpi
 contrib/dev/acpica/dsinit.c	optional acpi
 contrib/dev/acpica/dsmethod.c	optional acpi
 contrib/dev/acpica/dsmthdat.c	optional acpi
 contrib/dev/acpica/dsobject.c	optional acpi
 contrib/dev/acpica/dsopcode.c	optional acpi
 contrib/dev/acpica/dsutils.c	optional acpi
 contrib/dev/acpica/dswexec.c	optional acpi
 contrib/dev/acpica/dswload.c	optional acpi
 contrib/dev/acpica/dswscope.c	optional acpi
 contrib/dev/acpica/dswstate.c	optional acpi
 contrib/dev/acpica/evevent.c	optional acpi
 contrib/dev/acpica/evgpe.c	optional acpi
 contrib/dev/acpica/evgpeblk.c	optional acpi
 contrib/dev/acpica/evmisc.c	optional acpi
 contrib/dev/acpica/evregion.c	optional acpi
 contrib/dev/acpica/evrgnini.c	optional acpi
 contrib/dev/acpica/evsci.c	optional acpi
 contrib/dev/acpica/evxface.c	optional acpi
 contrib/dev/acpica/evxfevnt.c	optional acpi
 contrib/dev/acpica/evxfregn.c	optional acpi
 contrib/dev/acpica/exconfig.c	optional acpi
 contrib/dev/acpica/exconvrt.c	optional acpi
 contrib/dev/acpica/excreate.c	optional acpi
 contrib/dev/acpica/exdump.c	optional acpi
 contrib/dev/acpica/exfield.c	optional acpi
 contrib/dev/acpica/exfldio.c	optional acpi
 contrib/dev/acpica/exmisc.c	optional acpi
 contrib/dev/acpica/exmutex.c	optional acpi
 contrib/dev/acpica/exnames.c	optional acpi
 contrib/dev/acpica/exoparg1.c	optional acpi
 contrib/dev/acpica/exoparg2.c	optional acpi
 contrib/dev/acpica/exoparg3.c	optional acpi
 contrib/dev/acpica/exoparg6.c	optional acpi
 contrib/dev/acpica/exprep.c	optional acpi
 contrib/dev/acpica/exregion.c	optional acpi
 contrib/dev/acpica/exresnte.c	optional acpi
 contrib/dev/acpica/exresolv.c	optional acpi
 contrib/dev/acpica/exresop.c	optional acpi
 contrib/dev/acpica/exstore.c	optional acpi
 contrib/dev/acpica/exstoren.c	optional acpi
 contrib/dev/acpica/exstorob.c	optional acpi
 contrib/dev/acpica/exsystem.c	optional acpi
 contrib/dev/acpica/exutils.c	optional acpi
 contrib/dev/acpica/hwacpi.c	optional acpi
 contrib/dev/acpica/hwgpe.c	optional acpi
 contrib/dev/acpica/hwregs.c	optional acpi
 contrib/dev/acpica/hwsleep.c	optional acpi
 contrib/dev/acpica/hwtimer.c	optional acpi
 contrib/dev/acpica/nsaccess.c	optional acpi
 contrib/dev/acpica/nsalloc.c	optional acpi
 contrib/dev/acpica/nsdump.c	optional acpi
 contrib/dev/acpica/nseval.c	optional acpi
 contrib/dev/acpica/nsinit.c	optional acpi
 contrib/dev/acpica/nsload.c	optional acpi
 contrib/dev/acpica/nsnames.c	optional acpi
 contrib/dev/acpica/nsobject.c	optional acpi
 contrib/dev/acpica/nsparse.c	optional acpi
 contrib/dev/acpica/nssearch.c	optional acpi
 contrib/dev/acpica/nsutils.c	optional acpi
 contrib/dev/acpica/nswalk.c	optional acpi
 contrib/dev/acpica/nsxfeval.c	optional acpi
 contrib/dev/acpica/nsxfname.c	optional acpi
 contrib/dev/acpica/nsxfobj.c	optional acpi
 contrib/dev/acpica/psargs.c	optional acpi
 contrib/dev/acpica/psloop.c	optional acpi
 contrib/dev/acpica/psopcode.c	optional acpi
 contrib/dev/acpica/psparse.c	optional acpi
 contrib/dev/acpica/psscope.c	optional acpi
 contrib/dev/acpica/pstree.c	optional acpi
 contrib/dev/acpica/psutils.c	optional acpi
 contrib/dev/acpica/pswalk.c	optional acpi
 contrib/dev/acpica/psxface.c	optional acpi
 contrib/dev/acpica/rsaddr.c	optional acpi
 contrib/dev/acpica/rscalc.c	optional acpi
 contrib/dev/acpica/rscreate.c	optional acpi
 contrib/dev/acpica/rsdump.c	optional acpi
 contrib/dev/acpica/rsinfo.c	optional acpi
 contrib/dev/acpica/rsio.c	optional acpi
 contrib/dev/acpica/rsirq.c	optional acpi
 contrib/dev/acpica/rslist.c	optional acpi
 contrib/dev/acpica/rsmemory.c	optional acpi
 contrib/dev/acpica/rsmisc.c	optional acpi
 contrib/dev/acpica/rsutils.c	optional acpi
 contrib/dev/acpica/rsxface.c	optional acpi
 contrib/dev/acpica/tbconvrt.c	optional acpi
 contrib/dev/acpica/tbget.c	optional acpi
 contrib/dev/acpica/tbgetall.c	optional acpi
 contrib/dev/acpica/tbinstal.c	optional acpi
 contrib/dev/acpica/tbrsdt.c	optional acpi
 contrib/dev/acpica/tbutils.c	optional acpi
 contrib/dev/acpica/tbxface.c	optional acpi
 contrib/dev/acpica/tbxfroot.c	optional acpi
 contrib/dev/acpica/utalloc.c	optional acpi
 contrib/dev/acpica/utcache.c	optional acpi \
 	compile-with "${NORMAL_C} -DACPI_USE_LOCAL_CACHE"
 contrib/dev/acpica/utclib.c	optional acpi
 contrib/dev/acpica/utcopy.c	optional acpi
 contrib/dev/acpica/utdebug.c	optional acpi
 contrib/dev/acpica/utdelete.c	optional acpi
 contrib/dev/acpica/uteval.c	optional acpi
 contrib/dev/acpica/utglobal.c	optional acpi
 contrib/dev/acpica/utinit.c	optional acpi
 contrib/dev/acpica/utmath.c	optional acpi
 contrib/dev/acpica/utmisc.c	optional acpi
 contrib/dev/acpica/utmutex.c	optional acpi
 contrib/dev/acpica/utobject.c	optional acpi
 contrib/dev/acpica/utstate.c	optional acpi
 contrib/dev/acpica/utxface.c	optional acpi
 contrib/dev/ath/freebsd/ah_osdep.c optional ath_hal \
 	compile-with "${NORMAL_C} -I$S/contrib/dev/ath/freebsd"
 contrib/ipfilter/netinet/fil.c	optional ipfilter inet \
 	compile-with "${NORMAL_C} -I$S/contrib/ipfilter"
 contrib/ipfilter/netinet/ip_auth.c optional ipfilter inet \
 	compile-with "${NORMAL_C} -I$S/contrib/ipfilter"
 contrib/ipfilter/netinet/ip_fil_freebsd.c optional ipfilter inet \
 	compile-with "${NORMAL_C} -I$S/contrib/ipfilter"
 contrib/ipfilter/netinet/ip_frag.c optional ipfilter inet \
 	compile-with "${NORMAL_C} -I$S/contrib/ipfilter"
 contrib/ipfilter/netinet/ip_log.c optional ipfilter inet \
 	compile-with "${NORMAL_C} -I$S/contrib/ipfilter"
 contrib/ipfilter/netinet/ip_nat.c optional ipfilter inet \
 	compile-with "${NORMAL_C} -I$S/contrib/ipfilter"
 contrib/ipfilter/netinet/ip_proxy.c optional ipfilter inet \
 	compile-with "${NORMAL_C} -I$S/contrib/ipfilter"
 contrib/ipfilter/netinet/ip_state.c optional ipfilter inet \
 	compile-with "${NORMAL_C} -I$S/contrib/ipfilter"
 contrib/ipfilter/netinet/ip_lookup.c optional ipfilter inet \
 	compile-with "${NORMAL_C} -I$S/contrib/ipfilter"
 contrib/ipfilter/netinet/ip_pool.c optional ipfilter inet \
 	compile-with "${NORMAL_C} -I$S/contrib/ipfilter"
 contrib/ipfilter/netinet/ip_htable.c optional ipfilter inet \
 	compile-with "${NORMAL_C} -I$S/contrib/ipfilter"
 contrib/ipfilter/netinet/ip_sync.c optional ipfilter inet \
 	compile-with "${NORMAL_C} -I$S/contrib/ipfilter"
 contrib/ipfilter/netinet/mlfk_ipl.c optional ipfilter inet \
 	compile-with "${NORMAL_C} -I$S/contrib/ipfilter"
 contrib/ngatm/netnatm/api/cc_conn.c optional ngatm_ccatm \
 	compile-with "${NORMAL_C} -I$S/contrib/ngatm"
 contrib/ngatm/netnatm/api/cc_data.c optional ngatm_ccatm \
 	compile-with "${NORMAL_C} -I$S/contrib/ngatm"
 contrib/ngatm/netnatm/api/cc_dump.c optional ngatm_ccatm \
 	compile-with "${NORMAL_C} -I$S/contrib/ngatm"
 contrib/ngatm/netnatm/api/cc_port.c optional ngatm_ccatm \
 	compile-with "${NORMAL_C} -I$S/contrib/ngatm"
 contrib/ngatm/netnatm/api/cc_sig.c optional ngatm_ccatm \
 	compile-with "${NORMAL_C} -I$S/contrib/ngatm"
 contrib/ngatm/netnatm/api/cc_user.c optional ngatm_ccatm \
 	compile-with "${NORMAL_C} -I$S/contrib/ngatm"
 contrib/ngatm/netnatm/api/unisap.c optional ngatm_ccatm \
 	compile-with "${NORMAL_C} -I$S/contrib/ngatm"
 contrib/ngatm/netnatm/misc/straddr.c optional ngatm_atmbase \
 	compile-with "${NORMAL_C} -I$S/contrib/ngatm"
 contrib/ngatm/netnatm/misc/unimsg_common.c optional ngatm_atmbase \
 	compile-with "${NORMAL_C} -I$S/contrib/ngatm"
 contrib/ngatm/netnatm/msg/traffic.c optional ngatm_atmbase \
 	compile-with "${NORMAL_C} -I$S/contrib/ngatm"
 contrib/ngatm/netnatm/msg/uni_ie.c optional ngatm_atmbase \
 	compile-with "${NORMAL_C} -I$S/contrib/ngatm"
 contrib/ngatm/netnatm/msg/uni_msg.c optional ngatm_atmbase \
 	compile-with "${NORMAL_C} -I$S/contrib/ngatm"
 contrib/ngatm/netnatm/saal/saal_sscfu.c	optional ngatm_sscfu \
 	compile-with "${NORMAL_C} -I$S/contrib/ngatm"
 contrib/ngatm/netnatm/saal/saal_sscop.c	optional ngatm_sscop \
 	compile-with "${NORMAL_C} -I$S/contrib/ngatm"
 contrib/ngatm/netnatm/sig/sig_call.c optional ngatm_uni \
 	compile-with "${NORMAL_C} -I$S/contrib/ngatm"
 contrib/ngatm/netnatm/sig/sig_coord.c optional ngatm_uni \
 	compile-with "${NORMAL_C} -I$S/contrib/ngatm"
 contrib/ngatm/netnatm/sig/sig_party.c optional ngatm_uni \
 	compile-with "${NORMAL_C} -I$S/contrib/ngatm"
 contrib/ngatm/netnatm/sig/sig_print.c optional ngatm_uni \
 	compile-with "${NORMAL_C} -I$S/contrib/ngatm"
 contrib/ngatm/netnatm/sig/sig_reset.c optional ngatm_uni \
 	compile-with "${NORMAL_C} -I$S/contrib/ngatm"
 contrib/ngatm/netnatm/sig/sig_uni.c optional ngatm_uni \
 	compile-with "${NORMAL_C} -I$S/contrib/ngatm"
 contrib/ngatm/netnatm/sig/sig_unimsgcpy.c optional ngatm_uni \
 	compile-with "${NORMAL_C} -I$S/contrib/ngatm"
 contrib/ngatm/netnatm/sig/sig_verify.c optional ngatm_uni \
 	compile-with "${NORMAL_C} -I$S/contrib/ngatm"
 contrib/pf/net/if_pflog.c	optional pflog \
 	compile-with "${NORMAL_C} -I$S/contrib/pf"
 contrib/pf/net/if_pfsync.c	optional pfsync \
 	compile-with "${NORMAL_C} -I$S/contrib/pf"
 contrib/pf/net/pf.c		optional pf \
 	compile-with "${NORMAL_C} -I$S/contrib/pf"
 contrib/pf/net/pf_if.c		optional pf \
 	compile-with "${NORMAL_C} -I$S/contrib/pf"
 contrib/pf/net/pf_subr.c	optional pf \
 	compile-with "${NORMAL_C} -I$S/contrib/pf"
 contrib/pf/net/pf_ioctl.c	optional pf \
 	compile-with "${NORMAL_C} -I$S/contrib/pf"
 contrib/pf/net/pf_norm.c	optional pf \
 	compile-with "${NORMAL_C} -I$S/contrib/pf"
 contrib/pf/net/pf_table.c	optional pf \
 	compile-with "${NORMAL_C} -I$S/contrib/pf"
 contrib/pf/net/pf_osfp.c	optional pf \
 	compile-with "${NORMAL_C} -I$S/contrib/pf"
 contrib/pf/netinet/in4_cksum.c	optional pf inet
 crypto/blowfish/bf_ecb.c	optional ipsec ipsec_esp
 crypto/blowfish/bf_skey.c	optional crypto | ipsec ipsec_esp
 crypto/des/des_ecb.c		optional crypto | ipsec ipsec_esp | netsmb
 crypto/des/des_setkey.c		optional crypto | ipsec ipsec_esp | netsmb
 crypto/rc4/rc4.c		optional netgraph_mppc_encryption
 crypto/rijndael/rijndael-alg-fst.c optional crypto | geom_bde | \
 					 ipsec | random | wlan_ccmp
 crypto/rijndael/rijndael-api-fst.c optional geom_bde | random
 crypto/rijndael/rijndael-api.c	optional crypto | ipsec | wlan_ccmp
 crypto/sha1.c			optional carp | crypto | ipsec | \
 					 netgraph_mppc_encryption
 crypto/sha2/sha2.c		optional crypto | geom_bde | ipsec | random
 ddb/db_access.c			optional	ddb
 ddb/db_break.c			optional	ddb
 ddb/db_command.c		optional	ddb
 ddb/db_examine.c		optional	ddb
 ddb/db_expr.c			optional	ddb
 ddb/db_input.c			optional	ddb
 ddb/db_lex.c			optional	ddb
 ddb/db_main.c			optional	ddb
 ddb/db_output.c			optional	ddb
 ddb/db_print.c			optional	ddb
 ddb/db_ps.c			optional	ddb
 ddb/db_run.c			optional	ddb
 ddb/db_sym.c			optional	ddb
 ddb/db_thread.c			optional	ddb
 ddb/db_variables.c		optional	ddb
 ddb/db_watch.c			optional	ddb
 ddb/db_write_cmd.c		optional	ddb
 #dev/dpt/dpt_control.c		optional dpt
 dev/aac/aac.c			optional aac
 dev/aac/aac_cam.c		optional aacp aac
 dev/aac/aac_debug.c		optional aac
 dev/aac/aac_disk.c		optional aac
 dev/aac/aac_linux.c		optional aac compat_linux
 dev/aac/aac_pci.c		optional aac pci
 dev/acpi_support/acpi_asus.c	optional acpi_asus acpi
 dev/acpi_support/acpi_fujitsu.c	optional acpi_fujitsu acpi
 dev/acpi_support/acpi_ibm.c	optional acpi_ibm acpi
 dev/acpi_support/acpi_panasonic.c optional acpi_panasonic acpi
 dev/acpi_support/acpi_sony.c	optional acpi_sony acpi
 dev/acpi_support/acpi_toshiba.c	optional acpi_toshiba acpi
 dev/acpica/Osd/OsdDebug.c	optional acpi
 dev/acpica/Osd/OsdHardware.c	optional acpi
 dev/acpica/Osd/OsdInterrupt.c	optional acpi
 dev/acpica/Osd/OsdMemory.c	optional acpi
 dev/acpica/Osd/OsdSchedule.c	optional acpi
 dev/acpica/Osd/OsdStream.c	optional acpi
 dev/acpica/Osd/OsdSynch.c	optional acpi
 dev/acpica/Osd/OsdTable.c	optional acpi
 dev/acpica/acpi.c		optional acpi
 dev/acpica/acpi_acad.c		optional acpi
 dev/acpica/acpi_battery.c	optional acpi
 dev/acpica/acpi_button.c	optional acpi
 dev/acpica/acpi_cmbat.c		optional acpi
 dev/acpica/acpi_cpu.c		optional acpi
 dev/acpica/acpi_ec.c		optional acpi
 dev/acpica/acpi_hpet.c		optional acpi
 dev/acpica/acpi_isab.c		optional acpi isa
 dev/acpica/acpi_lid.c		optional acpi
 dev/acpica/acpi_package.c	optional acpi
 dev/acpica/acpi_pci.c		optional acpi pci
 dev/acpica/acpi_pci_link.c	optional acpi pci
 dev/acpica/acpi_pcib.c		optional acpi pci
 dev/acpica/acpi_pcib_acpi.c	optional acpi pci
 dev/acpica/acpi_pcib_pci.c	optional acpi pci
 dev/acpica/acpi_perf.c		optional acpi
 dev/acpica/acpi_powerres.c	optional acpi
 dev/acpica/acpi_quirk.c		optional acpi
 dev/acpica/acpi_resource.c	optional acpi
 dev/acpica/acpi_smbat.c		optional acpi
 dev/acpica/acpi_thermal.c	optional acpi
 dev/acpica/acpi_throttle.c	optional acpi
 dev/acpica/acpi_timer.c		optional acpi
 dev/acpica/acpi_video.c		optional acpi_video acpi
 dev/acpica/acpi_dock.c		optional acpi_dock acpi
 dev/adlink/adlink.c		optional adlink
 dev/advansys/adv_eisa.c		optional adv eisa
 dev/advansys/adv_pci.c		optional adv pci
 dev/advansys/advansys.c		optional adv
 dev/advansys/advlib.c		optional adv
 dev/advansys/advmcode.c		optional adv
 dev/advansys/adw_pci.c		optional adw pci
 dev/advansys/adwcam.c		optional adw
 dev/advansys/adwlib.c		optional adw
 dev/advansys/adwmcode.c		optional adw
 dev/aha/aha.c			optional aha
 dev/aha/aha_isa.c		optional aha isa
 dev/aha/aha_mca.c		optional aha mca
 dev/ahb/ahb.c			optional ahb eisa
 dev/aic/aic.c			optional aic
 dev/aic/aic_pccard.c		optional aic pccard
 dev/aic7xxx/ahc_eisa.c		optional ahc eisa
 dev/aic7xxx/ahc_isa.c		optional ahc isa
 dev/aic7xxx/ahc_pci.c		optional ahc pci
 dev/aic7xxx/ahd_pci.c		optional ahd pci
 dev/aic7xxx/aic7770.c		optional ahc
 dev/aic7xxx/aic79xx.c		optional ahd pci
 dev/aic7xxx/aic79xx_osm.c	optional ahd pci
 dev/aic7xxx/aic79xx_pci.c	optional ahd pci
 dev/aic7xxx/aic7xxx.c		optional ahc
 dev/aic7xxx/aic7xxx_93cx6.c	optional ahc
 dev/aic7xxx/aic7xxx_osm.c	optional ahc
 dev/aic7xxx/aic7xxx_pci.c	optional ahc pci
 dev/amd/amd.c			optional amd
 dev/amr/amr.c			optional amr
 dev/amr/amr_cam.c		optional amr
 dev/amr/amr_disk.c		optional amr
 dev/amr/amr_linux.c		optional amr compat_linux
 dev/amr/amr_pci.c		optional amr pci
 dev/an/if_an.c			optional an
 dev/an/if_an_isa.c		optional an isa
 dev/an/if_an_pccard.c		optional an pccard
 dev/an/if_an_pci.c		optional an pci
 dev/asr/asr.c			optional asr pci
 dev/ata/ata_if.m		optional ata
 dev/ata/ata-all.c		optional ata
 dev/ata/ata-card.c		optional ata pccard
 dev/ata/ata-cbus.c		optional ata pc98
 dev/ata/ata-chipset.c		optional ata pci
 dev/ata/ata-disk.c		optional atadisk
 dev/ata/ata-dma.c		optional ata pci
 dev/ata/ata-isa.c		optional ata isa
 dev/ata/ata-lowlevel.c		optional ata
 dev/ata/ata-pci.c		optional ata pci
 dev/ata/ata-queue.c		optional ata
 dev/ata/ata-raid.c		optional ataraid
 dev/ata/ata-usb.c		optional atausb
 dev/ata/atapi-cam.c		optional atapicam
 dev/ata/atapi-cd.c		optional atapicd
 dev/ata/atapi-fd.c		optional atapifd
 dev/ata/atapi-tape.c		optional atapist
 dev/ath/ath_rate/amrr/amrr.c	optional ath_rate_amrr
 dev/ath/ath_rate/onoe/onoe.c	optional ath_rate_onoe \
 	compile-with "${NORMAL_C} -I$S/contrib/dev/ath/freebsd"
 dev/ath/ath_rate/sample/sample.c	optional ath_rate_sample \
 	compile-with "${NORMAL_C} -I$S/contrib/dev/ath/freebsd"
 dev/ath/if_ath.c		optional ath \
 	compile-with "${NORMAL_C} -I$S/contrib/dev/ath/freebsd"
 dev/ath/if_ath_pci.c		optional ath pci \
 	compile-with "${NORMAL_C} -I$S/contrib/dev/ath/freebsd"
 dev/awi/am79c930.c		optional awi
 dev/awi/awi.c			optional awi
 dev/awi/if_awi_pccard.c		optional awi pccard
 dev/bce/if_bce.c		optional bce
 dev/bfe/if_bfe.c		optional bfe
 dev/bge/if_bge.c		optional bge
 dev/bktr/bktr_audio.c		optional bktr pci
 dev/bktr/bktr_card.c		optional bktr pci
 dev/bktr/bktr_core.c		optional bktr pci
 dev/bktr/bktr_i2c.c		optional bktr pci smbus
 dev/bktr/bktr_os.c		optional bktr pci
 dev/bktr/bktr_tuner.c		optional bktr pci
 dev/bktr/msp34xx.c		optional bktr pci
 dev/buslogic/bt.c		optional bt
 dev/buslogic/bt_eisa.c		optional bt eisa
 dev/buslogic/bt_isa.c		optional bt isa
 dev/buslogic/bt_mca.c		optional bt mca
 dev/buslogic/bt_pci.c		optional bt pci
 dev/cardbus/cardbus.c		optional cardbus
 dev/cardbus/cardbus_cis.c	optional cardbus
 dev/cardbus/cardbus_device.c	optional cardbus
 dev/ciss/ciss.c			optional ciss
 dev/cm/smc90cx6.c		optional cm
 dev/cnw/if_cnw.c		optional cnw pccard
 dev/cpufreq/ichss.c		optional cpufreq
 dev/cs/if_cs.c			optional cs
 dev/cs/if_cs_isa.c		optional cs isa
 dev/cs/if_cs_pccard.c		optional cs pccard
 dev/cy/cy.c			optional cy
 dev/cy/cy_isa.c			optional cy isa
 dev/cy/cy_pci.c			optional cy pci
 dev/dc/if_dc.c			optional dc pci
 dev/dc/dcphy.c			optional dc pci
 dev/dc/pnphy.c			optional dc pci
 dev/dcons/dcons.c		optional dcons
 dev/dcons/dcons_crom.c		optional dcons_crom
 dev/dcons/dcons_os.c		optional dcons
 dev/de/if_de.c			optional de pci
 dev/digi/CX.c			optional digi_CX
 dev/digi/CX_PCI.c		optional digi_CX_PCI
 dev/digi/EPCX.c			optional digi_EPCX
 dev/digi/EPCX_PCI.c		optional digi_EPCX_PCI
 dev/digi/Xe.c			optional digi_Xe
 dev/digi/Xem.c			optional digi_Xem
 dev/digi/Xr.c			optional digi_Xr
 dev/digi/digi.c			optional digi
 dev/digi/digi_isa.c		optional digi isa
 dev/digi/digi_pci.c		optional digi pci
 dev/dpt/dpt_eisa.c		optional dpt eisa
 dev/dpt/dpt_pci.c		optional dpt pci
 dev/dpt/dpt_scsi.c		optional dpt
 dev/drm/ati_pcigart.c		optional drm
 dev/drm/drm_agpsupport.c	optional drm
 dev/drm/drm_auth.c		optional drm
 dev/drm/drm_bufs.c		optional drm
 dev/drm/drm_context.c		optional drm
 dev/drm/drm_dma.c		optional drm
 dev/drm/drm_drawable.c		optional drm
 dev/drm/drm_drv.c		optional drm
 dev/drm/drm_fops.c		optional drm
 dev/drm/drm_ioctl.c		optional drm
 dev/drm/drm_irq.c		optional drm
 dev/drm/drm_lock.c		optional drm
 dev/drm/drm_memory.c		optional drm
 dev/drm/drm_pci.c		optional drm
 dev/drm/drm_scatter.c		optional drm
 dev/drm/drm_sysctl.c		optional drm
 dev/drm/drm_vm.c		optional drm
 dev/drm/i915_dma.c		optional i915drm
 dev/drm/i915_drv.c		optional i915drm
 dev/drm/i915_irq.c		optional i915drm
 dev/drm/i915_mem.c		optional i915drm
 dev/drm/mach64_dma.c		optional mach64drm
 dev/drm/mach64_drv.c		optional mach64drm
 dev/drm/mach64_irq.c		optional mach64drm
 dev/drm/mach64_state.c		optional mach64drm
 dev/drm/mga_dma.c		optional mgadrm
 dev/drm/mga_drv.c		optional mgadrm
 dev/drm/mga_irq.c		optional mgadrm
 dev/drm/mga_state.c		optional mgadrm \
 	compile-with "${NORMAL_C} -finline-limit=13500"
 dev/drm/mga_warp.c		optional mgadrm
 dev/drm/r128_cce.c		optional r128drm
 dev/drm/r128_drv.c		optional r128drm
 dev/drm/r128_irq.c		optional r128drm
 dev/drm/r128_state.c		optional r128drm \
 	compile-with "${NORMAL_C} -finline-limit=13500"
 dev/drm/r300_cmdbuf.c		optional radeondrm
 dev/drm/radeon_cp.c		optional radeondrm
 dev/drm/radeon_drv.c		optional radeondrm
 dev/drm/radeon_irq.c		optional radeondrm
 dev/drm/radeon_mem.c		optional radeondrm
 dev/drm/radeon_state.c		optional radeondrm
 dev/drm/savage_bci.c		optional savagedrm
 dev/drm/savage_drv.c		optional savagedrm
 dev/drm/savage_state.c		optional savagedrm
 dev/drm/sis_drv.c		optional sisdrm
 dev/drm/sis_ds.c		optional sisdrm
 dev/drm/sis_mm.c		optional sisdrm
 dev/drm/tdfx_drv.c		optional tdfxdrm
 dev/ed/if_ed.c			optional ed
 dev/ed/if_ed_novell.c		optional ed
 dev/ed/if_ed_rtl80x9.c		optional ed
 dev/ed/if_ed_pccard.c		optional ed pccard
 dev/ed/if_ed_pci.c		optional ed pci
 dev/eisa/eisa_if.m		standard
 dev/eisa/eisaconf.c		optional eisa
 dev/em/if_em.c			optional em
 dev/em/if_em_hw.c		optional em
 dev/en/if_en_pci.c		optional en pci
 dev/en/midway.c			optional en
 dev/ep/if_ep.c			optional ep
 dev/ep/if_ep_eisa.c		optional ep eisa
 dev/ep/if_ep_isa.c		optional ep isa
 dev/ep/if_ep_mca.c		optional ep mca
 dev/ep/if_ep_pccard.c		optional ep pccard
 dev/esp/ncr53c9x.c		optional esp
 dev/ex/if_ex.c			optional ex
 dev/ex/if_ex_isa.c		optional ex isa
 dev/ex/if_ex_pccard.c		optional ex pccard
 dev/exca/exca.c			optional cbb
 dev/fatm/if_fatm.c		optional fatm pci
 dev/fe/if_fe.c			optional fe
 dev/fe/if_fe_pccard.c		optional fe pccard
 dev/firewire/firewire.c		optional firewire
 dev/firewire/fwcrom.c		optional firewire
 dev/firewire/fwdev.c		optional firewire
 dev/firewire/fwdma.c		optional firewire
 dev/firewire/fwmem.c		optional firewire
 dev/firewire/fwohci.c		optional firewire
 dev/firewire/fwohci_pci.c	optional firewire pci
 dev/firewire/if_fwe.c		optional fwe
 dev/firewire/if_fwip.c		optional fwip
 dev/firewire/sbp.c		optional sbp
 dev/firewire/sbp_targ.c		optional sbp_targ
 dev/fxp/if_fxp.c		optional fxp
 dev/gem/if_gem.c		optional gem
 dev/gem/if_gem_pci.c		optional gem pci
 dev/harp/if_harp.c		optional harp pci
 dev/hatm/if_hatm.c		optional hatm pci
 dev/hatm/if_hatm_intr.c		optional hatm pci
 dev/hatm/if_hatm_ioctl.c	optional hatm pci
 dev/hatm/if_hatm_rx.c		optional hatm pci
 dev/hatm/if_hatm_tx.c		optional hatm pci
 dev/hfa/fore_buffer.c		optional hfa
 dev/hfa/fore_command.c		optional hfa
 dev/hfa/fore_globals.c		optional hfa
 dev/hfa/fore_if.c		optional hfa
 dev/hfa/fore_init.c		optional hfa
 dev/hfa/fore_intr.c		optional hfa
 dev/hfa/fore_output.c		optional hfa
 dev/hfa/fore_receive.c		optional hfa
 dev/hfa/fore_stats.c		optional hfa
 dev/hfa/fore_timer.c		optional hfa
 dev/hfa/fore_transmit.c		optional hfa
 dev/hfa/fore_vcm.c		optional hfa
 #dev/hfa/hfa_eisa.c		optional hfa eisa
 dev/hfa/hfa_freebsd.c		optional hfa
 dev/hfa/hfa_pci.c		optional hfa pci
 #dev/hfa/hfa_sbus.c		optional hfa sbus
 dev/hifn/hifn7751.c		optional hifn
 dev/hme/if_hme.c		optional hme
 dev/hme/if_hme_pci.c		optional hme pci
 dev/hme/if_hme_sbus.c		optional hme sbus
 dev/hwpmc/hwpmc_logging.c	optional hwpmc
 dev/hwpmc/hwpmc_mod.c		optional hwpmc
 dev/ichsmb/ichsmb.c		optional ichsmb
 dev/ichsmb/ichsmb_pci.c		optional ichsmb pci
 dev/ida/ida.c			optional ida
 dev/ida/ida_disk.c		optional ida
 dev/ida/ida_eisa.c		optional ida eisa
 dev/ida/ida_pci.c		optional ida pci
 dev/ie/if_ie.c			optional ie isa nowerror
 dev/ie/if_ie_isa.c		optional ie isa
 dev/ieee488/ibfoo.c		optional pcii | tnt4882
 dev/ieee488/pcii.c		optional pcii
 dev/ieee488/tnt4882.c		optional tnt4882
 dev/ieee488/upd7210.c		optional pcii | tnt4882
 dev/iicbus/if_ic.c		optional ic
 dev/iicbus/iic.c		optional iic
 dev/iicbus/iicbb.c		optional iicbb
 dev/iicbus/iicbb_if.m		optional iicbb
 dev/iicbus/iicbus.c		optional iicbus
 dev/iicbus/iicbus_if.m		optional iicbus
 dev/iicbus/iiconf.c		optional iicbus
 dev/iicbus/iicsmb.c		optional iicsmb				\
 	dependency	"iicbus_if.h"
 dev/iir/iir.c			optional iir
 dev/iir/iir_ctrl.c		optional iir
 dev/iir/iir_pci.c		optional iir pci
 dev/ips/ips.c			optional ips
 dev/ips/ips_commands.c		optional ips
 dev/ips/ips_disk.c		optional ips
 dev/ips/ips_ioctl.c		optional ips
 dev/ips/ips_pci.c		optional ips pci
 dev/ipw/if_ipw.c		optional ipw
 dev/isp/isp.c			optional isp
 dev/isp/isp_freebsd.c		optional isp
 dev/isp/isp_library.c		optional isp
 dev/isp/isp_pci.c		optional isp pci
 dev/isp/isp_sbus.c		optional isp sbus
 dev/isp/isp_target.c		optional isp
 dev/ispfw/ispfw.c		optional ispfw
 dev/iwi/if_iwi.c		optional iwi
 dev/ixgb/if_ixgb.c		optional ixgb
 dev/ixgb/ixgb_ee.c		optional ixgb
 dev/ixgb/ixgb_hw.c		optional ixgb
 dev/joy/joy.c			optional joy
 dev/joy/joy_isa.c		optional joy isa
 dev/joy/joy_pccard.c		optional joy pccard
 dev/kbdmux/kbdmux.c		optional kbdmux
 dev/le/am7990.c			optional le
 dev/le/am79900.c		optional le
 dev/le/if_le_pci.c		optional le pci
 dev/le/lance.c			optional le
 dev/led/led.c			standard
 dev/lge/if_lge.c		optional lge
 dev/lmc/if_lmc.c		optional lmc
 dev/mc146818/mc146818.c		optional mc146818
 dev/mca/mca_bus.c		optional mca
 dev/mcd/mcd.c			optional mcd isa nowerror
 dev/mcd/mcd_isa.c		optional mcd isa nowerror
 dev/md/md.c			optional md
 dev/mem/memdev.c		optional mem
 dev/mfi/mfi.c			optional mfi
 dev/mfi/mfi_pci.c		optional mfi pci
 dev/mfi/mfi_disk.c		optional mfi
 dev/mfi/mfi_linux.c		optional mfi compat_linux
 dev/mii/acphy.c			optional miibus | acphy
 dev/mii/amphy.c			optional miibus | amphy
 dev/mii/bmtphy.c		optional miibus | bmtphy
 dev/mii/brgphy.c		optional miibus | brgphy
 dev/mii/ciphy.c			optional miibus | ciphy
 dev/mii/e1000phy.c		optional miibus | e1000phy
 # XXX only xl cards?
 dev/mii/exphy.c			optional miibus | exphy
 # XXX only fxp cards?
 dev/mii/inphy.c			optional miibus | inphy
 dev/mii/lxtphy.c		optional miibus | lxtphy
 dev/mii/mii.c			optional miibus | mii
 dev/mii/mii_physubr.c		optional miibus | mii
 dev/mii/miibus_if.m		optional miibus | mii
 dev/mii/mlphy.c			optional miibus | mlphy
 dev/mii/nsgphy.c		optional miibus | nsgphy
 dev/mii/nsphy.c			optional miibus | nsphy
 dev/mii/pnaphy.c		optional miibus | pnaphy
 dev/mii/qsphy.c			optional miibus | qsphy
 dev/mii/rgephy.c		optional miibus | rgephy
 # XXX rl and re only?
 dev/mii/rlphy.c			optional miibus | rlphy
 # XXX rue only?
 dev/mii/ruephy.c		optional miibus | ruephy
 dev/mii/tdkphy.c		optional miibus | tdkphy
 dev/mii/tlphy.c			optional miibus | tlphy
 dev/mii/ukphy.c			optional miibus | mii
 dev/mii/ukphy_subr.c		optional miibus | mii
 dev/mii/xmphy.c			optional miibus | xmphy
 dev/mk48txx/mk48txx.c		optional mk48txx
 dev/mlx/mlx.c			optional mlx
 dev/mlx/mlx_disk.c		optional mlx
 dev/mlx/mlx_pci.c		optional mlx pci
 dev/mly/mly.c			optional mly
 dev/mpt/mpt.c			optional mpt
 dev/mpt/mpt_cam.c		optional mpt
 dev/mpt/mpt_debug.c		optional mpt
 dev/mpt/mpt_pci.c		optional mpt pci
 dev/mpt/mpt_raid.c		optional mpt
 dev/my/if_my.c			optional my
 dev/ncv/ncr53c500.c		optional ncv
 dev/ncv/ncr53c500_pccard.c	optional ncv pccard
 dev/nge/if_nge.c		optional nge
 dev/nmdm/nmdm.c			optional nmdm
 dev/nsp/nsp.c			optional nsp
 dev/nsp/nsp_pccard.c		optional nsp pccard
 dev/null/null.c			standard
 dev/patm/if_patm.c		optional patm pci
 dev/patm/if_patm_attach.c	optional patm pci
 dev/patm/if_patm_intr.c		optional patm pci
 dev/patm/if_patm_ioctl.c	optional patm pci
 dev/patm/if_patm_rtables.c	optional patm pci
 dev/patm/if_patm_rx.c		optional patm pci
 dev/patm/if_patm_tx.c		optional patm pci
 dev/pbio/pbio.c			optional pbio isa
 dev/pccard/card_if.m		standard
 dev/pccard/pccard.c		optional pccard
 dev/pccard/pccard_cis.c		optional pccard
 dev/pccard/pccard_cis_quirks.c	optional pccard
 dev/pccard/pccard_device.c	optional pccard
 dev/pccard/power_if.m		standard
 dev/pccbb/pccbb.c		optional cbb
 dev/pccbb/pccbb_isa.c		optional cbb isa
 dev/pccbb/pccbb_pci.c		optional cbb pci
 dev/pcf/pcf.c			optional pcf
 dev/pci/eisa_pci.c		optional pci eisa
 dev/pci/fixup_pci.c		optional pci
 dev/pci/hostb_pci.c		optional pci
 dev/pci/ignore_pci.c		optional pci
 dev/pci/isa_pci.c		optional pci isa
 dev/pci/pci.c			optional pci
 dev/pci/pci_if.m		standard
 dev/pci/pci_pci.c		optional pci
 dev/pci/pci_user.c		optional pci
 dev/pci/pcib_if.m		standard
 dev/pci/vga_pci.c		optional pci
 dev/pdq/if_fea.c		optional fea eisa
 dev/pdq/if_fpa.c		optional fpa pci
 dev/pdq/pdq.c			optional nowerror fea eisa | fpa pci
 dev/pdq/pdq_ifsubr.c		optional nowerror fea eisa | fpa pci
 dev/ppbus/if_plip.c		optional plip
 dev/ppbus/immio.c		optional vpo
 dev/ppbus/lpbb.c		optional lpbb
 dev/ppbus/lpt.c			optional lpt
 dev/ppbus/pcfclock.c		optional pcfclock
 dev/ppbus/ppb_1284.c		optional ppbus
 dev/ppbus/ppb_base.c		optional ppbus
 dev/ppbus/ppb_msq.c		optional ppbus
 dev/ppbus/ppbconf.c		optional ppbus
 dev/ppbus/ppbus_if.m		optional ppbus
 dev/ppbus/ppi.c			optional ppi
 dev/ppbus/pps.c			optional pps
 dev/ppbus/vpo.c			optional vpo
 dev/ppbus/vpoio.c		optional vpo
 dev/ppc/ppc.c			optional ppc
 dev/ppc/ppc_acpi.c		optional ppc acpi
 dev/ppc/ppc_isa.c		optional ppc isa
 dev/ppc/ppc_pci.c		optional ppc pci
 dev/ppc/ppc_puc.c		optional ppc puc
 dev/pst/pst-iop.c		optional pst
 dev/pst/pst-pci.c		optional pst pci
 dev/pst/pst-raid.c		optional pst
 dev/puc/puc.c			optional puc
 dev/puc/puc_cfg.c		optional puc
 dev/puc/puc_pccard.c		optional puc pccard
 dev/puc/puc_pci.c		optional puc pci
 dev/puc/pucdata.c		optional puc pci
 dev/ral/rt2560.c		optional ral
 dev/ral/rt2661.c		optional ral
 dev/ral/if_ralrate.c		optional ral
 dev/ral/if_ral_pci.c		optional ral pci
 dev/random/harvest.c		standard
 dev/random/hash.c		optional random
 dev/random/probe.c		optional random
 dev/random/randomdev.c		optional random
 dev/random/randomdev_soft.c	optional random
 dev/random/yarrow.c		optional random
 dev/ray/if_ray.c		optional ray pccard
 dev/rc/rc.c			optional rc
 dev/re/if_re.c			optional re
 dev/rndtest/rndtest.c		optional rndtest
 dev/rp/rp.c			optional rp
 dev/rp/rp_isa.c			optional rp isa
 dev/rp/rp_pci.c			optional rp pci
 dev/safe/safe.c			optional safe
 dev/sbsh/if_sbsh.c		optional sbsh
 dev/scc/scc_if.m		optional	scc
 dev/scc/scc_bfe_ebus.c		optional	scc ebus
 dev/scc/scc_bfe_sbus.c		optional	scc fhc | scc sbus
 dev/scc/scc_core.c		optional	scc
 dev/scc/scc_dev_sab82532.c	optional	scc
 dev/scc/scc_dev_z8530.c		optional	scc
 dev/scd/scd.c			optional scd isa
 dev/scd/scd_isa.c		optional scd isa
 dev/si/si.c			optional si
 dev/si/si2_z280.c		optional si
 dev/si/si3_t225.c		optional si
 dev/si/si_eisa.c		optional si eisa
 dev/si/si_isa.c			optional si isa
 dev/si/si_pci.c			optional si pci
 dev/sio/sio_pccard.c		optional sio pccard
 dev/sio/sio_pci.c		optional sio pci
 dev/sio/sio_puc.c		optional sio puc
 dev/sk/if_sk.c			optional sk pci
 dev/smbus/smb.c			optional smb
 dev/smbus/smbconf.c		optional smbus
 dev/smbus/smbus.c		optional smbus
 dev/smbus/smbus_if.m		optional smbus
 dev/sn/if_sn.c			optional sn
 dev/sn/if_sn_isa.c		optional sn isa
 dev/sn/if_sn_pccard.c		optional sn pccard
 dev/snp/snp.c			optional snp
 dev/sound/isa/ad1816.c		optional snd_ad1816 isa
 dev/sound/isa/ess.c		optional snd_ess isa
 dev/sound/isa/gusc.c		optional snd_gusc isa
 dev/sound/isa/mss.c		optional snd_mss isa
 dev/sound/isa/sb16.c		optional snd_sb16 isa
 dev/sound/isa/sb8.c		optional snd_sb8 isa
 dev/sound/isa/sbc.c		optional snd_sbc isa
 dev/sound/isa/sndbuf_dma.c	optional sound isa
 dev/sound/pci/als4000.c		optional snd_als4000 pci
 dev/sound/pci/atiixp.c		optional snd_atiixp pci
 #dev/sound/pci/au88x0.c		optional snd_au88x0 pci
 dev/sound/pci/cmi.c		optional snd_cmi pci
 dev/sound/pci/cs4281.c		optional snd_cs4281 pci
 dev/sound/pci/csa.c		optional snd_csa pci \
 	warning "kernel contains GPL contaminated csaimg.h header"
 dev/sound/pci/csapcm.c		optional snd_csa pci
 dev/sound/pci/ds1.c		optional snd_ds1 pci
 dev/sound/pci/emu10k1.c		optional snd_emu10k1 pci \
 	dependency "emu10k1-alsa%diked.h" \
 	warning "kernel contains GPL contaminated emu10k1 headers"
 dev/sound/pci/es137x.c		optional snd_es137x pci
 dev/sound/pci/fm801.c		optional snd_fm801 pci
 dev/sound/pci/ich.c		optional snd_ich pci
 dev/sound/pci/maestro.c		optional snd_maestro pci
 dev/sound/pci/maestro3.c	optional snd_maestro3 pci \
 	warning "kernel contains GPL contaminated maestro3 headers"
 dev/sound/pci/neomagic.c	optional snd_neomagic pci
 dev/sound/pci/solo.c		optional snd_solo pci
 dev/sound/pci/t4dwave.c		optional snd_t4dwave pci
 dev/sound/pci/via8233.c		optional snd_via8233 pci
 dev/sound/pci/via82c686.c	optional snd_via82c686 pci
 dev/sound/pci/vibes.c		optional snd_vibes pci
 dev/sound/pcm/ac97.c		optional sound
 dev/sound/pcm/ac97_if.m		optional sound
 dev/sound/pcm/ac97_patch.c	optional sound
 dev/sound/pcm/buffer.c		optional sound
 dev/sound/pcm/channel.c		optional sound
 dev/sound/pcm/channel_if.m	optional sound
 dev/sound/pcm/dsp.c		optional sound
 dev/sound/pcm/fake.c		optional sound
 dev/sound/pcm/feeder.c		optional sound
 dev/sound/pcm/feeder_fmt.c	optional sound
 dev/sound/pcm/feeder_if.m	optional sound
 dev/sound/pcm/feeder_rate.c	optional sound
 dev/sound/pcm/feeder_volume.c	optional sound
 dev/sound/pcm/mixer.c		optional sound
 dev/sound/pcm/mixer_if.m	optional sound
 dev/sound/pcm/sndstat.c		optional sound
 dev/sound/pcm/sound.c		optional sound
 dev/sound/pcm/vchan.c		optional sound
 #dev/sound/usb/upcm.c		optional snd_upcm usb
 dev/sound/usb/uaudio.c		optional snd_uaudio usb
 dev/sound/usb/uaudio_pcm.c	optional snd_uaudio usb
 dev/sound/midi/midi.c		optional sound
 dev/sound/midi/mpu401.c		optional sound
 dev/sound/midi/mpu_if.m		optional sound
 dev/sound/midi/mpufoi_if.m	optional sound
 dev/sound/midi/sequencer.c	optional sound
 dev/sound/midi/synth_if.m	optional sound
 dev/sr/if_sr.c			optional sr
 dev/sr/if_sr_pci.c		optional sr pci
 dev/stg/tmc18c30.c		optional stg
 dev/stg/tmc18c30_isa.c		optional stg isa
 dev/stg/tmc18c30_pccard.c	optional stg pccard
 dev/stg/tmc18c30_pci.c		optional stg pci
 dev/stg/tmc18c30_subr.c		optional stg
 dev/streams/streams.c		optional streams
 dev/sym/sym_hipd.c		optional sym				\
 	dependency	"$S/dev/sym/sym_{conf,defs}.h"
 dev/syscons/blank/blank_saver.c	optional blank_saver
 dev/syscons/daemon/daemon_saver.c optional daemon_saver
 dev/syscons/dragon/dragon_saver.c optional dragon_saver
 dev/syscons/fade/fade_saver.c	optional fade_saver
 dev/syscons/fire/fire_saver.c	optional fire_saver
 dev/syscons/green/green_saver.c	optional green_saver
 dev/syscons/logo/logo.c		optional logo_saver
 dev/syscons/logo/logo_saver.c	optional logo_saver
 dev/syscons/rain/rain_saver.c	optional rain_saver
 dev/syscons/snake/snake_saver.c	optional snake_saver
 dev/syscons/star/star_saver.c	optional star_saver
 dev/syscons/warp/warp_saver.c	optional warp_saver
 dev/tdfx/tdfx_linux.c		optional tdfx_linux tdfx compat_linux
 dev/tdfx/tdfx_pci.c		optional tdfx pci
 dev/ti/if_ti.c			optional ti pci
 dev/trm/trm.c			optional trm
 dev/twa/tw_cl_fwimg.c		optional twa \
 	compile-with "${NORMAL_C} -I$S/dev/twa"
 dev/twa/tw_cl_init.c		optional twa \
 	compile-with "${NORMAL_C} -I$S/dev/twa"
 dev/twa/tw_cl_intr.c		optional twa \
 	compile-with "${NORMAL_C} -I$S/dev/twa"
 dev/twa/tw_cl_io.c		optional twa \
 	compile-with "${NORMAL_C} -I$S/dev/twa"
 dev/twa/tw_cl_misc.c		optional twa \
 	compile-with "${NORMAL_C} -I$S/dev/twa"
 dev/twa/tw_osl_cam.c		optional twa \
 	compile-with "${NORMAL_C} -I$S/dev/twa"
 dev/twa/tw_osl_freebsd.c	optional twa \
 	compile-with "${NORMAL_C} -I$S/dev/twa"
 dev/twe/twe.c			optional twe
 dev/twe/twe_freebsd.c		optional twe
 dev/tx/if_tx.c			optional tx
 dev/txp/if_txp.c		optional txp
 dev/uart/uart_bus_acpi.c	optional	uart acpi
 #dev/uart/uart_bus_cbus.c	optional	uart cbus
 dev/uart/uart_bus_ebus.c	optional	uart ebus
 dev/uart/uart_bus_isa.c		optional	uart isa
 dev/uart/uart_bus_pccard.c	optional	uart pccard
 dev/uart/uart_bus_pci.c		optional	uart pci
 dev/uart/uart_bus_puc.c		optional	uart puc
 dev/uart/uart_bus_scc.c		optional	uart scc
 dev/uart/uart_core.c		optional	uart
 dev/uart/uart_dbg.c		optional	uart gdb
 dev/uart/uart_dev_ns8250.c	optional	uart uart_ns8250
 dev/uart/uart_dev_sab82532.c	optional	uart uart_sab82532
 dev/uart/uart_dev_sab82532.c	optional	uart scc
 dev/uart/uart_dev_z8530.c	optional	uart uart_z8530
 dev/uart/uart_dev_z8530.c	optional	uart scc
 dev/uart/uart_if.m		optional	uart
 dev/uart/uart_subr.c		optional	uart
 dev/uart/uart_tty.c		optional	uart
 dev/ubsec/ubsec.c		optional ubsec
 #
 # USB support
 dev/usb/ehci.c			optional ehci
 dev/usb/ehci_pci.c		optional ehci pci
 dev/usb/hid.c			optional usb
 dev/usb/if_aue.c		optional aue
 dev/usb/if_axe.c		optional axe
 dev/usb/if_cdce.c		optional cdce
 dev/usb/if_cue.c		optional cue
 dev/usb/if_kue.c		optional kue
 dev/usb/if_ural.c		optional ural
 dev/usb/if_rue.c		optional rue
 dev/usb/if_udav.c		optional udav
 dev/usb/ohci.c			optional ohci
 dev/usb/ohci_pci.c		optional ohci pci
 dev/usb/sl811hs.c		optional slhci
 dev/usb/slhci_pccard.c		optional slhci pccard
 dev/usb/ubsa.c			optional ubsa ucom
 dev/usb/ubser.c			optional ubser
 dev/usb/ucom.c			optional ucom
 dev/usb/ucycom.c		optional ucycom ucom
 dev/usb/udbp.c			optional udbp
 dev/usb/ufoma.c			optional ufoma ucom
 dev/usb/ufm.c			optional ufm
 dev/usb/uftdi.c			optional uftdi ucom
 dev/usb/ugen.c			optional ugen
 dev/usb/uhci.c			optional uhci
 dev/usb/uhci_pci.c		optional uhci pci
 dev/usb/uhid.c			optional uhid
 dev/usb/uhub.c			optional usb
 dev/usb/ukbd.c			optional ukbd
 dev/usb/ulpt.c			optional ulpt
 dev/usb/umass.c			optional umass
 dev/usb/umct.c			optional umct
 dev/usb/umodem.c		optional umodem
 dev/usb/ums.c			optional ums
 dev/usb/uplcom.c		optional uplcom ucom
 dev/usb/urio.c			optional urio
 dev/usb/usb.c			optional usb
 dev/usb/usb_ethersubr.c		optional usb
 dev/usb/usb_if.m		optional usb
 dev/usb/usb_mem.c		optional usb
 dev/usb/usb_quirks.c		optional usb
 dev/usb/usb_subr.c		optional usb
 dev/usb/usbdi.c			optional usb
 dev/usb/usbdi_util.c		optional usb
 dev/usb/uscanner.c		optional uscanner
 dev/usb/uvisor.c		optional uvisor ucom
 dev/usb/uvscom.c		optional uvscom ucom
 dev/utopia/idtphy.c		optional utopia
 dev/utopia/suni.c		optional utopia
 dev/utopia/utopia.c		optional utopia
 dev/vge/if_vge.c		optional vge
 dev/vkbd/vkbd.c			optional vkbd
 dev/vx/if_vx.c			optional vx
 dev/vx/if_vx_eisa.c		optional vx eisa
 dev/vx/if_vx_pci.c		optional vx pci
 dev/watchdog/watchdog.c		standard
 dev/wds/wd7000.c		optional wds isa
 dev/wi/if_wi.c			optional wi
 dev/wi/if_wi_pccard.c		optional wi pccard
 dev/wi/if_wi_pci.c		optional wi pci
 dev/wl/if_wl.c			optional wl isa
 dev/xe/if_xe.c			optional xe
 dev/xe/if_xe_pccard.c		optional xe pccard
 fs/deadfs/dead_vnops.c		standard
 fs/devfs/devfs_devs.c		standard
 fs/devfs/devfs_rule.c		standard
 fs/devfs/devfs_vfsops.c		standard
 fs/devfs/devfs_vnops.c		standard
 fs/fdescfs/fdesc_vfsops.c	optional fdescfs
 fs/fdescfs/fdesc_vnops.c	optional fdescfs
 fs/fifofs/fifo_vnops.c		standard
 fs/hpfs/hpfs_alsubr.c		optional hpfs
 fs/hpfs/hpfs_lookup.c		optional hpfs
 fs/hpfs/hpfs_subr.c		optional hpfs
 fs/hpfs/hpfs_vfsops.c		optional hpfs
 fs/hpfs/hpfs_vnops.c		optional hpfs
 fs/msdosfs/msdosfs_conv.c	optional msdosfs
 fs/msdosfs/msdosfs_denode.c	optional msdosfs
 fs/msdosfs/msdosfs_fat.c	optional msdosfs
 fs/msdosfs/msdosfs_fileno.c	optional msdosfs_large
 fs/msdosfs/msdosfs_iconv.c	optional msdosfs_iconv
 fs/msdosfs/msdosfs_lookup.c	optional msdosfs
 fs/msdosfs/msdosfs_vfsops.c	optional msdosfs
 fs/msdosfs/msdosfs_vnops.c	optional msdosfs
 fs/ntfs/ntfs_compr.c		optional ntfs
 fs/ntfs/ntfs_iconv.c		optional ntfs_iconv
 fs/ntfs/ntfs_ihash.c		optional ntfs
 fs/ntfs/ntfs_subr.c		optional ntfs
 fs/ntfs/ntfs_vfsops.c		optional ntfs
 fs/ntfs/ntfs_vnops.c		optional ntfs
 fs/nullfs/null_subr.c		optional nullfs
 fs/nullfs/null_vfsops.c		optional nullfs
 fs/nullfs/null_vnops.c		optional nullfs
 fs/nwfs/nwfs_io.c		optional nwfs
 fs/nwfs/nwfs_ioctl.c		optional nwfs
 fs/nwfs/nwfs_node.c		optional nwfs
 fs/nwfs/nwfs_subr.c		optional nwfs
 fs/nwfs/nwfs_vfsops.c		optional nwfs
 fs/nwfs/nwfs_vnops.c		optional nwfs
 fs/portalfs/portal_vfsops.c	optional portalfs
 fs/portalfs/portal_vnops.c	optional portalfs
 fs/procfs/procfs.c		optional procfs
 fs/procfs/procfs_ctl.c		optional procfs
 fs/procfs/procfs_dbregs.c	optional procfs
 fs/procfs/procfs_fpregs.c	optional procfs
 fs/procfs/procfs_ioctl.c	optional procfs
 fs/procfs/procfs_map.c		optional procfs
 fs/procfs/procfs_mem.c		optional procfs
 fs/procfs/procfs_note.c		optional procfs
 fs/procfs/procfs_regs.c		optional procfs
 fs/procfs/procfs_rlimit.c	optional procfs
 fs/procfs/procfs_status.c	optional procfs
 fs/procfs/procfs_type.c		optional procfs
 fs/pseudofs/pseudofs.c		optional pseudofs
 fs/pseudofs/pseudofs_fileno.c	optional pseudofs
 fs/pseudofs/pseudofs_vncache.c	optional pseudofs
 fs/pseudofs/pseudofs_vnops.c	optional pseudofs
 fs/smbfs/smbfs_io.c		optional smbfs
 fs/smbfs/smbfs_node.c		optional smbfs
 fs/smbfs/smbfs_smb.c		optional smbfs
 fs/smbfs/smbfs_subr.c		optional smbfs
 fs/smbfs/smbfs_vfsops.c		optional smbfs
 fs/smbfs/smbfs_vnops.c		optional smbfs
 fs/udf/osta.c			optional udf
 fs/udf/udf_iconv.c		optional udf_iconv
 fs/udf/udf_vfsops.c		optional udf
 fs/udf/udf_vnops.c		optional udf
 fs/umapfs/umap_subr.c		optional umapfs
 fs/umapfs/umap_vfsops.c		optional umapfs
 fs/umapfs/umap_vnops.c		optional umapfs
 fs/unionfs/union_subr.c		optional unionfs
 fs/unionfs/union_vfsops.c	optional unionfs
 fs/unionfs/union_vnops.c	optional unionfs
 gdb/gdb_cons.c			optional gdb
 gdb/gdb_main.c			optional gdb
 gdb/gdb_packet.c		optional gdb
 geom/bde/g_bde.c		optional geom_bde
 geom/bde/g_bde_crypt.c		optional geom_bde
 geom/bde/g_bde_lock.c		optional geom_bde
 geom/bde/g_bde_work.c		optional geom_bde
 geom/concat/g_concat.c		optional geom_concat
 geom/eli/g_eli.c		optional geom_eli
 geom/eli/g_eli_crypto.c		optional geom_eli
 geom/eli/g_eli_ctl.c		optional geom_eli
 geom/eli/g_eli_integrity.c	optional geom_eli
 geom/eli/g_eli_key.c		optional geom_eli
 geom/eli/g_eli_privacy.c	optional geom_eli
 geom/eli/pkcs5v2.c		optional geom_eli
 geom/gate/g_gate.c		optional geom_gate
 geom/geom_aes.c			optional geom_aes
 geom/geom_apple.c		optional geom_apple
 geom/geom_bsd.c			optional geom_bsd
 geom/geom_bsd_enc.c		optional geom_bsd
 geom/geom_ccd.c			optional ccd | geom_ccd
 geom/geom_ctl.c			standard
 geom/geom_dev.c			standard
 geom/geom_disk.c		standard
 geom/geom_dump.c		standard
 geom/geom_event.c		standard
 geom/geom_fox.c			optional geom_fox
 geom/geom_gpt.c			optional geom_gpt
 geom/geom_io.c			standard
 geom/geom_kern.c		standard
 geom/geom_mbr.c			optional geom_mbr
 geom/geom_mbr_enc.c		optional geom_mbr
 geom/geom_pc98.c		optional geom_pc98
 geom/geom_pc98_enc.c		optional geom_pc98
 geom/geom_slice.c		standard
 geom/geom_subr.c		standard
 geom/geom_sunlabel.c		optional geom_sunlabel
 geom/geom_sunlabel_enc.c	optional geom_sunlabel
 geom/geom_vfs.c			standard
 geom/geom_vol_ffs.c		optional geom_vol
 geom/label/g_label.c		optional geom_label
 geom/label/g_label_ext2fs.c	optional geom_label
 geom/label/g_label_iso9660.c	optional geom_label
 geom/label/g_label_msdosfs.c	optional geom_label
 geom/label/g_label_ntfs.c	optional geom_label
 geom/label/g_label_reiserfs.c	optional geom_label
 geom/label/g_label_ufs.c	optional geom_label
 geom/mirror/g_mirror.c		optional geom_mirror
 geom/mirror/g_mirror_ctl.c	optional geom_mirror
 geom/nop/g_nop.c		optional geom_nop
 geom/raid3/g_raid3.c		optional geom_raid3
 geom/raid3/g_raid3_ctl.c	optional geom_raid3
 geom/shsec/g_shsec.c		optional geom_shsec
 geom/stripe/g_stripe.c		optional geom_stripe
 geom/uzip/g_uzip.c		optional geom_uzip
 geom/zero/g_zero.c		optional geom_zero
 gnu/fs/ext2fs/ext2_alloc.c		optional ext2fs \
 	warning "kernel contains GPL contaminated ext2fs filesystem"
 gnu/fs/ext2fs/ext2_balloc.c	optional ext2fs
 gnu/fs/ext2fs/ext2_bmap.c		optional ext2fs
 gnu/fs/ext2fs/ext2_inode.c		optional ext2fs
 gnu/fs/ext2fs/ext2_inode_cnv.c	optional ext2fs
 gnu/fs/ext2fs/ext2_linux_balloc.c	optional ext2fs
 gnu/fs/ext2fs/ext2_linux_ialloc.c	optional ext2fs
 gnu/fs/ext2fs/ext2_lookup.c	optional ext2fs
 gnu/fs/ext2fs/ext2_subr.c		optional ext2fs
 gnu/fs/ext2fs/ext2_vfsops.c	optional ext2fs
 gnu/fs/ext2fs/ext2_vnops.c		optional ext2fs
 gnu/fs/reiserfs/reiserfs_hashes.c	optional reiserfs \
 	warning "kernel contains GPL contaminated ReiserFS filesystem"
 gnu/fs/reiserfs/reiserfs_inode.c	optional reiserfs
 gnu/fs/reiserfs/reiserfs_item_ops.c	optional reiserfs
 gnu/fs/reiserfs/reiserfs_namei.c	optional reiserfs
 gnu/fs/reiserfs/reiserfs_prints.c	optional reiserfs
 gnu/fs/reiserfs/reiserfs_stree.c	optional reiserfs
 gnu/fs/reiserfs/reiserfs_vfsops.c	optional reiserfs
 gnu/fs/reiserfs/reiserfs_vnops.c	optional reiserfs
 #
 # isdn4bsd device drivers
 #
 i4b/driver/i4b_trace.c		optional i4btrc
 i4b/driver/i4b_rbch.c		optional i4brbch
 i4b/driver/i4b_tel.c		optional i4btel
 i4b/driver/i4b_ipr.c		optional i4bipr
 net/slcompress.c		optional i4bipr | i4bisppp
 i4b/driver/i4b_ctl.c		optional i4bctl
 i4b/driver/i4b_ing.c		optional i4bing
 i4b/driver/i4b_isppp.c		optional i4bisppp
 #
 # isdn4bsd CAPI driver
 #
 i4b/capi/capi_l4if.c		optional i4bcapi
 i4b/capi/capi_llif.c		optional i4bcapi
 i4b/capi/capi_msgs.c		optional i4bcapi
 #
 # isdn4bsd AVM B1/T1 CAPI driver
 #
 i4b/capi/iavc/iavc_pci.c	optional iavc i4bcapi pci
 i4b/capi/iavc/iavc_isa.c	optional iavc i4bcapi isa
 i4b/capi/iavc/iavc_lli.c	optional iavc i4bcapi
 i4b/capi/iavc/iavc_card.c	optional iavc i4bcapi
 #
 # isdn4bsd support
 #
 i4b/layer2/i4b_mbuf.c		optional i4btrc
 #
 # isdn4bsd Q.921 handler
 #
 i4b/layer2/i4b_l2.c		optional i4bq921
 i4b/layer2/i4b_l2fsm.c		optional i4bq921
 i4b/layer2/i4b_uframe.c		optional i4bq921
 i4b/layer2/i4b_tei.c		optional i4bq921
 i4b/layer2/i4b_sframe.c		optional i4bq921
 i4b/layer2/i4b_iframe.c		optional i4bq921
 i4b/layer2/i4b_l2timer.c	optional i4bq921
 i4b/layer2/i4b_util.c		optional i4bq921
 i4b/layer2/i4b_lme.c		optional i4bq921
 #
 # isdn4bsd Q.931 handler
 #
 i4b/layer3/i4b_q931.c		optional i4bq931
 i4b/layer3/i4b_l3fsm.c		optional i4bq931
 i4b/layer3/i4b_l3timer.c	optional i4bq931
 i4b/layer3/i4b_l2if.c		optional i4bq931
 i4b/layer3/i4b_l4if.c		optional i4bq931
 i4b/layer3/i4b_q932fac.c	optional i4bq931
 #
 # isdn4bsd control device driver, interface to isdnd
 #
 i4b/layer4/i4b_i4bdrv.c		optional i4b
 i4b/layer4/i4b_l4.c		optional i4b
 i4b/layer4/i4b_l4mgmt.c		optional i4b
 i4b/layer4/i4b_l4timer.c	optional i4b
 #
 isa/isa_if.m			standard
 isa/isa_common.c		optional isa
 isa/isahint.c			optional isa
 isa/orm.c			optional isa
 isa/pnp.c			optional isa isapnp
 isa/pnpparse.c			optional isa isapnp
 isofs/cd9660/cd9660_bmap.c	optional cd9660
 isofs/cd9660/cd9660_lookup.c	optional cd9660
 isofs/cd9660/cd9660_node.c	optional cd9660
 isofs/cd9660/cd9660_rrip.c	optional cd9660
 isofs/cd9660/cd9660_util.c	optional cd9660
 isofs/cd9660/cd9660_vfsops.c	optional cd9660
 isofs/cd9660/cd9660_vnops.c	optional cd9660
 isofs/cd9660/cd9660_iconv.c	optional cd9660_iconv
 kern/bus_if.m			standard
 kern/clock_if.m			optional genclock
 kern/cpufreq_if.m		standard
 kern/device_if.m		standard
 kern/imgact_elf.c		standard
 kern/imgact_shell.c		standard
 kern/inflate.c			optional gzip
 kern/init_main.c		standard
 kern/init_sysent.c		standard
 kern/kern_acct.c		standard
 kern/kern_acl.c			standard
 kern/kern_alq.c			optional alq
 kern/kern_clock.c		standard
 kern/kern_condvar.c		standard
 kern/kern_conf.c		standard
 kern/kern_cpu.c			standard
 kern/kern_context.c		standard
 kern/kern_descrip.c		standard
 kern/kern_environment.c		standard
 kern/kern_event.c		standard
 kern/kern_exec.c		standard
 kern/kern_exit.c		standard
 kern/kern_fork.c		standard
 kern/kern_idle.c		standard
 kern/kern_intr.c		standard
 kern/kern_jail.c		standard
 kern/kern_kse.c			standard
 kern/kern_kthread.c		standard
 kern/kern_ktr.c			optional ktr
 kern/kern_ktrace.c		standard
 kern/kern_linker.c		standard
 kern/kern_lock.c		standard
 kern/kern_lockf.c		standard
 kern/kern_mac.c			standard
 kern/kern_malloc.c		standard
 kern/kern_mbuf.c		standard
 kern/kern_mib.c			standard
 kern/kern_module.c		standard
 kern/kern_mtxpool.c		standard
 kern/kern_mutex.c		standard
 kern/kern_ntptime.c		standard
 kern/kern_physio.c		standard
 kern/kern_pmc.c			standard
 kern/kern_poll.c		optional device_polling
 kern/kern_proc.c		standard
 kern/kern_prot.c		standard
 kern/kern_resource.c		standard
 kern/kern_rwlock.c		standard
 kern/kern_sema.c		standard
 kern/kern_shutdown.c		standard
 kern/kern_sig.c			standard
 kern/kern_subr.c		standard
 kern/kern_sx.c			standard
 kern/kern_synch.c		standard
 kern/kern_syscalls.c		standard
 kern/kern_sysctl.c		standard
 kern/kern_tc.c			standard
 kern/kern_thr.c			standard
 kern/kern_thread.c		standard
 kern/kern_time.c		standard
 kern/kern_timeout.c		standard
 kern/kern_umtx.c		standard
 kern/kern_uuid.c		standard
 kern/kern_xxx.c			standard
 kern/link_elf.c			standard
 kern/linker_if.m		standard
 kern/md4c.c			optional netsmb
 kern/md5c.c			standard
 kern/sched_4bsd.c		optional sched_4bsd
 kern/sched_core.c		optional sched_core
 kern/sched_ule.c		optional sched_ule
 kern/serdev_if.m		optional puc | scc
 kern/subr_autoconf.c		standard
 kern/subr_blist.c		standard
 kern/subr_bus.c			standard
 kern/subr_clock.c		optional genclock
 kern/subr_devstat.c		standard
 kern/subr_disk.c		standard
 kern/subr_eventhandler.c	standard
 kern/subr_firmware.c		optional firmware
 kern/subr_hints.c		standard
 kern/subr_kdb.c			standard
 kern/subr_kobj.c		standard
 kern/subr_lock.c		standard
 kern/subr_log.c			standard
 kern/subr_mbpool.c		optional libmbpool
 kern/subr_mchain.c		optional libmchain
 kern/subr_module.c		standard
 kern/subr_msgbuf.c		standard
 kern/subr_param.c		standard
 kern/subr_pcpu.c		standard
 kern/subr_power.c		standard
 kern/subr_prf.c			standard
 kern/subr_prof.c		standard
 kern/subr_rman.c		standard
 kern/subr_sbuf.c		standard
 kern/subr_scanf.c		standard
 kern/subr_sleepqueue.c		standard
 kern/subr_smp.c			standard
 kern/subr_stack.c		optional ddb
 kern/subr_taskqueue.c		standard
 kern/subr_trap.c		standard
 kern/subr_turnstile.c		standard
 kern/subr_unit.c		standard
 kern/subr_witness.c		optional witness
 kern/sys_generic.c		standard
 kern/sys_pipe.c			standard
 kern/sys_process.c		standard
 kern/sys_socket.c		standard
 kern/syscalls.c			optional witness
 kern/sysv_ipc.c			standard
 kern/sysv_msg.c			optional sysvmsg
 kern/sysv_sem.c			optional sysvsem
 kern/sysv_shm.c			optional sysvshm
 kern/tty.c			standard
 kern/tty_compat.c		optional compat_43tty
 kern/tty_conf.c			standard
 kern/tty_cons.c			standard
 kern/tty_pty.c			optional pty
 kern/tty_pts.c			optional pty
 kern/tty_subr.c			standard
 kern/tty_tty.c			standard
 kern/uipc_accf.c		optional inet
 kern/uipc_cow.c			optional zero_copy_sockets
 kern/uipc_domain.c		standard
 kern/uipc_mbuf.c		standard
 kern/uipc_mbuf2.c		standard
 kern/uipc_mqueue.c		optional p1003_1b_mqueue
 kern/uipc_proto.c		standard
 kern/uipc_sem.c			optional p1003_1b_semaphores
 kern/uipc_socket.c		standard
 kern/uipc_socket2.c		standard
 kern/uipc_syscalls.c		standard
 kern/uipc_usrreq.c		standard
 kern/vfs_aio.c			optional vfs_aio
 kern/vfs_bio.c			standard
 kern/vfs_cache.c		standard
 kern/vfs_cluster.c		standard
 kern/vfs_default.c		standard
 kern/vfs_export.c		standard
 kern/vfs_hash.c			standard
 kern/vfs_init.c			standard
 kern/vfs_lookup.c		standard
 kern/vfs_mount.c		standard
 kern/vfs_subr.c			standard
 kern/vfs_syscalls.c		standard
 kern/vfs_vnops.c		standard
 #
 # These files in libkern/ are those needed by all architectures.  Some
 # of the files in libkern/ are only needed on some architectures, e.g.,
 # libkern/divdi3.c is needed by i386 but not alpha.  Also, some of these
 # routines may be optimized for a particular platform.  In either case,
 # the file should be moved to conf/files.<arch> from here.
 #
 libkern/arc4random.c		standard
 libkern/bcd.c			standard
 libkern/bsearch.c		standard
 libkern/crc32.c			standard
 libkern/fnmatch.c		standard
 libkern/gets.c			standard
 libkern/iconv.c			optional libiconv
 libkern/iconv_converter_if.m	optional libiconv
 libkern/iconv_xlat.c		optional libiconv
 libkern/iconv_xlat16.c		optional libiconv
 libkern/index.c			standard
 libkern/inet_ntoa.c		standard
 libkern/mcount.c		optional profiling-routine
 libkern/qsort.c			standard
 libkern/qsort_r.c		standard
 libkern/random.c		standard
 libkern/rindex.c		standard
 libkern/scanc.c			standard
 libkern/skpc.c			standard
 libkern/strcasecmp.c		standard
 libkern/strcat.c		standard
 libkern/strcmp.c		standard
 libkern/strcpy.c		standard
 libkern/strdup.c		standard
 libkern/strlcat.c		standard
 libkern/strlcpy.c		standard
 libkern/strlen.c		standard
 libkern/strncmp.c		standard
 libkern/strncpy.c		standard
 libkern/strsep.c		standard
 libkern/strspn.c		standard
 libkern/strtol.c		standard
 libkern/strtoq.c		standard
 libkern/strtoul.c		standard
 libkern/strtouq.c		standard
 libkern/strvalid.c		standard
 net/bpf.c			standard
 net/bpf_jitter.c		optional bpf_jitter
 net/bpf_filter.c		optional bpf | netgraph_bpf
 net/bridgestp.c			optional if_bridge
 net/bsd_comp.c			optional ppp_bsdcomp
 net/if.c			standard
 net/if_arcsubr.c		optional arcnet
 net/if_atmsubr.c		optional atm
 net/if_bridge.c			optional if_bridge
 net/if_clone.c			standard
 net/if_disc.c			optional disc
 net/if_ef.c			optional ef
+net/if_enc.c			optional enc
 net/if_ethersubr.c		optional ether
 net/if_faith.c			optional faith
 net/if_fddisubr.c		optional fddi
 net/if_fwsubr.c			optional fwip
 net/if_gif.c			optional gif
 net/if_gre.c			optional gre
 net/if_iso88025subr.c		optional token
 net/if_loop.c			optional loop
 net/if_media.c			standard
 net/if_mib.c			standard
 net/if_ppp.c			optional ppp
 net/if_sl.c			optional sl
 net/if_spppfr.c			optional i4bisppp | sppp
 net/if_spppsubr.c		optional i4bisppp | sppp
 net/if_stf.c			optional stf
 net/if_tun.c			optional tun
 net/if_tap.c			optional tap
 net/if_vlan.c			optional vlan
 net/netisr.c			standard
 net/ppp_deflate.c		optional ppp_deflate
 net/ppp_tty.c			optional ppp
 net/pfil.c			optional ether | inet
 net/radix.c			standard
 net/raw_cb.c			standard
 net/raw_usrreq.c		standard
 net/route.c			standard
 net/rtsock.c			standard
 net/slcompress.c		optional netgraph_vjc | ppp | sl | sppp
 net/zlib.c			optional crypto | geom_uzip | ipsec | \
 					 ppp_deflate
 net80211/ieee80211.c		optional wlan
 net80211/ieee80211_acl.c	optional wlan_acl
 net80211/ieee80211_crypto.c	optional wlan
 net80211/ieee80211_crypto_ccmp.c optional wlan_ccmp
 net80211/ieee80211_crypto_none.c optional wlan
 net80211/ieee80211_crypto_tkip.c optional wlan_tkip
 net80211/ieee80211_crypto_wep.c	optional wlan_wep
 net80211/ieee80211_freebsd.c	optional wlan
 net80211/ieee80211_input.c	optional wlan
 net80211/ieee80211_ioctl.c	optional wlan
 net80211/ieee80211_node.c	optional wlan
 net80211/ieee80211_output.c	optional wlan
 net80211/ieee80211_proto.c	optional wlan
 net80211/ieee80211_xauth.c	optional wlan_xauth
 netatalk/aarp.c			optional netatalk
 netatalk/at_control.c		optional netatalk
 netatalk/at_proto.c		optional netatalk
 netatalk/at_rmx.c		optional netatalkdebug
 netatalk/ddp_input.c		optional netatalk
 netatalk/ddp_output.c		optional netatalk
 netatalk/ddp_pcb.c		optional netatalk
 netatalk/ddp_usrreq.c		optional netatalk
 netatm/atm_aal5.c		optional atm_core
 netatm/atm_cm.c			optional atm_core
 netatm/atm_device.c		optional atm_core
 netatm/atm_if.c			optional atm_core
 netatm/atm_proto.c		optional atm_core
 netatm/atm_signal.c		optional atm_core
 netatm/atm_socket.c		optional atm_core
 netatm/atm_subr.c		optional atm_core
 netatm/atm_usrreq.c		optional atm_core
 netatm/ipatm/ipatm_event.c	optional atm_ip atm_core
 netatm/ipatm/ipatm_if.c		optional atm_ip atm_core
 netatm/ipatm/ipatm_input.c	optional atm_ip atm_core
 netatm/ipatm/ipatm_load.c	optional atm_ip atm_core
 netatm/ipatm/ipatm_output.c	optional atm_ip atm_core
 netatm/ipatm/ipatm_usrreq.c	optional atm_ip atm_core
 netatm/ipatm/ipatm_vcm.c	optional atm_ip atm_core
 netatm/sigpvc/sigpvc_if.c	optional atm_sigpvc atm_core
 netatm/sigpvc/sigpvc_subr.c	optional atm_sigpvc atm_core
 netatm/spans/spans_arp.c	optional atm_spans atm_core	\
 	dependency	"spans_xdr.h"
 netatm/spans/spans_cls.c	optional atm_spans atm_core
 netatm/spans/spans_if.c		optional atm_spans atm_core
 netatm/spans/spans_kxdr.c	optional atm_spans atm_core
 netatm/spans/spans_msg.c	optional atm_spans atm_core
 netatm/spans/spans_print.c	optional atm_spans atm_core
 netatm/spans/spans_proto.c	optional atm_spans atm_core
 netatm/spans/spans_subr.c	optional atm_spans atm_core
 netatm/spans/spans_util.c	optional atm_spans atm_core
 spans_xdr.h			optional atm_spans atm_core	\
 	before-depend						\
 	dependency	"$S/netatm/spans/spans_xdr.x"		\
 	compile-with	"rpcgen -h -C $S/netatm/spans/spans_xdr.x | grep -v rpc/rpc.h > spans_xdr.h" \
 	clean		"spans_xdr.h"				\
 	no-obj no-implicit-rule
 spans_xdr.c			optional atm_spans atm_core	\
 	before-depend						\
 	dependency	"$S/netatm/spans/spans_xdr.x"		\
 	compile-with	"rpcgen -c -C $S/netatm/spans/spans_xdr.x | grep -v rpc/rpc.h > spans_xdr.c" \
 	clean		"spans_xdr.c"				\
 	no-obj no-implicit-rule local
 spans_xdr.o			optional atm_spans atm_core	\
 	dependency	"$S/netatm/spans/spans_xdr.x"		\
 	compile-with	"${NORMAL_C}"				\
 	no-implicit-rule local
 netatm/uni/q2110_sigaa.c	optional atm_uni atm_core
 netatm/uni/q2110_sigcpcs.c	optional atm_uni atm_core
 netatm/uni/q2110_subr.c		optional atm_uni atm_core
 netatm/uni/qsaal1_sigaa.c	optional atm_uni atm_core
 netatm/uni/qsaal1_sigcpcs.c	optional atm_uni atm_core
 netatm/uni/qsaal1_subr.c	optional atm_uni atm_core
 netatm/uni/sscf_uni.c		optional atm_uni atm_core
 netatm/uni/sscf_uni_lower.c	optional atm_uni atm_core
 netatm/uni/sscf_uni_upper.c	optional atm_uni atm_core
 netatm/uni/sscop.c		optional atm_uni atm_core
 netatm/uni/sscop_lower.c	optional atm_uni atm_core
 netatm/uni/sscop_pdu.c		optional atm_uni atm_core
 netatm/uni/sscop_sigaa.c	optional atm_uni atm_core
 netatm/uni/sscop_sigcpcs.c	optional atm_uni atm_core
 netatm/uni/sscop_subr.c		optional atm_uni atm_core
 netatm/uni/sscop_timer.c	optional atm_uni atm_core
 netatm/uni/sscop_upper.c	optional atm_uni atm_core
 netatm/uni/uni_load.c		optional atm_uni atm_core
 netatm/uni/uniarp.c		optional atm_uni atm_core
 netatm/uni/uniarp_cache.c	optional atm_uni atm_core
 netatm/uni/uniarp_input.c	optional atm_uni atm_core
 netatm/uni/uniarp_output.c	optional atm_uni atm_core
 netatm/uni/uniarp_timer.c	optional atm_uni atm_core
 netatm/uni/uniarp_vcm.c		optional atm_uni atm_core
 netatm/uni/uniip.c		optional atm_uni atm_core
 netatm/uni/unisig_decode.c	optional atm_uni atm_core
 netatm/uni/unisig_encode.c	optional atm_uni atm_core
 netatm/uni/unisig_if.c		optional atm_uni atm_core
 netatm/uni/unisig_mbuf.c	optional atm_uni atm_core
 netatm/uni/unisig_msg.c		optional atm_uni atm_core
 netatm/uni/unisig_print.c	optional atm_uni atm_core
 netatm/uni/unisig_proto.c	optional atm_uni atm_core
 netatm/uni/unisig_sigmgr_state.c optional atm_uni atm_core
 netatm/uni/unisig_subr.c	optional atm_uni atm_core
 netatm/uni/unisig_util.c	optional atm_uni atm_core
 netatm/uni/unisig_vc_state.c	optional atm_uni atm_core
 netgraph/atm/atmpif/ng_atmpif.c	optional netgraph_atm_atmpif
 netgraph/atm/atmpif/ng_atmpif_harp.c optional netgraph_atm_atmpif
 netgraph/atm/ccatm/ng_ccatm.c	optional ngatm_ccatm \
 	compile-with "${NORMAL_C} -I$S/contrib/ngatm"
 netgraph/atm/ng_atm.c		optional ngatm_atm
 netgraph/atm/ngatmbase.c	optional ngatm_atmbase \
 	compile-with "${NORMAL_C} -I$S/contrib/ngatm"
 netgraph/atm/sscfu/ng_sscfu.c	optional ngatm_sscfu \
 	compile-with "${NORMAL_C} -I$S/contrib/ngatm"
 netgraph/atm/sscop/ng_sscop.c optional ngatm_sscop \
 	compile-with "${NORMAL_C} -I$S/contrib/ngatm"
 netgraph/atm/uni/ng_uni.c	optional ngatm_uni \
 	compile-with "${NORMAL_C} -I$S/contrib/ngatm"
 netgraph/bluetooth/common/ng_bluetooth.c optional netgraph_bluetooth
 netgraph/bluetooth/drivers/bt3c/ng_bt3c_pccard.c optional netgraph_bluetooth_bt3c
 netgraph/bluetooth/drivers/h4/ng_h4.c optional netgraph_bluetooth_h4
 netgraph/bluetooth/drivers/ubt/ng_ubt.c optional netgraph_bluetooth_ubt
 netgraph/bluetooth/drivers/ubtbcmfw/ubtbcmfw.c optional netgraph_bluetooth_ubtbcmfw
 netgraph/bluetooth/hci/ng_hci_cmds.c optional netgraph_bluetooth_hci
 netgraph/bluetooth/hci/ng_hci_evnt.c optional netgraph_bluetooth_hci
 netgraph/bluetooth/hci/ng_hci_main.c optional netgraph_bluetooth_hci
 netgraph/bluetooth/hci/ng_hci_misc.c optional netgraph_bluetooth_hci
 netgraph/bluetooth/hci/ng_hci_ulpi.c optional netgraph_bluetooth_hci
 netgraph/bluetooth/l2cap/ng_l2cap_cmds.c optional netgraph_bluetooth_l2cap
 netgraph/bluetooth/l2cap/ng_l2cap_evnt.c optional netgraph_bluetooth_l2cap
 netgraph/bluetooth/l2cap/ng_l2cap_llpi.c optional netgraph_bluetooth_l2cap
 netgraph/bluetooth/l2cap/ng_l2cap_main.c optional netgraph_bluetooth_l2cap
 netgraph/bluetooth/l2cap/ng_l2cap_misc.c optional netgraph_bluetooth_l2cap
 netgraph/bluetooth/l2cap/ng_l2cap_ulpi.c optional netgraph_bluetooth_l2cap
 netgraph/bluetooth/socket/ng_btsocket.c optional netgraph_bluetooth_socket
 netgraph/bluetooth/socket/ng_btsocket_hci_raw.c	optional netgraph_bluetooth_socket
 netgraph/bluetooth/socket/ng_btsocket_l2cap.c optional netgraph_bluetooth_socket
 netgraph/bluetooth/socket/ng_btsocket_l2cap_raw.c optional netgraph_bluetooth_socket
 netgraph/bluetooth/socket/ng_btsocket_rfcomm.c optional netgraph_bluetooth_socket
 netgraph/netflow/netflow.c	optional netgraph_netflow
 netgraph/netflow/ng_netflow.c	optional netgraph_netflow
 netgraph/ng_UI.c		optional netgraph_UI
 netgraph/ng_async.c		optional netgraph_async
 netgraph/ng_atmllc.c		optional netgraph_atmllc
 netgraph/ng_base.c		optional netgraph
 netgraph/ng_bpf.c		optional netgraph_bpf
 netgraph/ng_bridge.c		optional netgraph_bridge
 netgraph/ng_cisco.c		optional netgraph_cisco
 netgraph/ng_device.c		optional netgraph_device
 netgraph/ng_echo.c		optional netgraph_echo
 netgraph/ng_eiface.c		optional netgraph_eiface
 netgraph/ng_ether.c		optional netgraph_ether
 netgraph/ng_fec.c		optional netgraph_fec
 netgraph/ng_frame_relay.c	optional netgraph_frame_relay
 netgraph/ng_gif.c		optional netgraph_gif
 netgraph/ng_gif_demux.c		optional netgraph_gif_demux
 netgraph/ng_hole.c		optional netgraph_hole
 netgraph/ng_iface.c		optional netgraph_iface
 netgraph/ng_ip_input.c		optional netgraph_ip_input
 netgraph/ng_ipfw.c		optional netgraph_ipfw
 netgraph/ng_ksocket.c		optional netgraph_ksocket
 netgraph/ng_l2tp.c		optional netgraph_l2tp
 netgraph/ng_lmi.c		optional netgraph_lmi
 netgraph/ng_mppc.c		optional netgraph_mppc_compression | \
 					 netgraph_mppc_encryption
 netgraph/ng_nat.c		optional netgraph_nat
 netgraph/ng_one2many.c		optional netgraph_one2many
 netgraph/ng_parse.c		optional netgraph
 netgraph/ng_ppp.c		optional netgraph_ppp
 netgraph/ng_pppoe.c		optional netgraph_pppoe
 netgraph/ng_pptpgre.c		optional netgraph_pptpgre
 netgraph/ng_rfc1490.c		optional netgraph_rfc1490
 netgraph/ng_socket.c		optional netgraph_socket
 netgraph/ng_split.c		optional netgraph_split
 netgraph/ng_sppp.c		optional netgraph_sppp
 netgraph/ng_tcpmss.c		optional netgraph_tcpmss
 netgraph/ng_tee.c		optional netgraph_tee
 netgraph/ng_tty.c		optional netgraph_tty
 netgraph/ng_vjc.c		optional netgraph_vjc
 netinet/accf_data.c		optional accept_filter_data
 netinet/accf_http.c		optional accept_filter_http
 netinet/if_atm.c		optional atm
 netinet/if_ether.c		optional ether
 netinet/igmp.c			optional inet
 netinet/in.c			optional inet
 netinet/ip_carp.c		optional carp
 netinet/in_gif.c		optional gif inet
 netinet/ip_gre.c		optional gre inet
 netinet/ip_id.c			optional inet
 netinet/in_pcb.c		optional inet
 netinet/in_proto.c		optional inet \
 	compile-with "${NORMAL_C} -I$S/contrib/pf"
 netinet/in_rmx.c		optional inet
 netinet/ip_divert.c		optional ipdivert
 netinet/ip_dummynet.c		optional dummynet
 netinet/ip_ecn.c		optional inet | inet6
 netinet/ip_encap.c		optional inet | inet6
 netinet/ip_fastfwd.c		optional inet
 netinet/ip_fw2.c		optional ipfirewall
 netinet/ip_fw_pfil.c		optional ipfirewall
 netinet/ip_icmp.c		optional inet
 netinet/ip_input.c		optional inet
 netinet/ip_ipsec.c		optional ipsec
 netinet/ip_ipsec.c		optional fast_ipsec
 netinet/ip_mroute.c		optional mrouting
 netinet/ip_options.c		optional inet
 netinet/ip_output.c		optional inet
 netinet/raw_ip.c		optional inet
 netinet/tcp_debug.c		optional tcpdebug
 netinet/tcp_hostcache.c		optional inet
 netinet/tcp_input.c		optional inet
 netinet/tcp_output.c		optional inet
 netinet/tcp_sack.c		optional inet
 netinet/tcp_subr.c		optional inet
 netinet/tcp_syncache.c		optional inet
 netinet/tcp_timer.c		optional inet
 netinet/tcp_usrreq.c		optional inet
 netinet/udp_usrreq.c		optional inet
 netinet/libalias/alias.c	optional libalias
 netinet/libalias/alias_cuseeme.c optional libalias
 netinet/libalias/alias_db.c	optional libalias
 netinet/libalias/alias_ftp.c	optional libalias
 netinet/libalias/alias_irc.c	optional libalias
 netinet/libalias/alias_nbt.c	optional libalias
 netinet/libalias/alias_pptp.c	optional libalias
 netinet/libalias/alias_proxy.c	optional libalias
 netinet/libalias/alias_skinny.c	optional libalias
 netinet/libalias/alias_smedia.c	optional libalias
 netinet/libalias/alias_util.c	optional libalias
 netinet6/ah_aesxcbcmac.c	optional ipsec
 netinet6/ah_core.c		optional ipsec
 netinet6/ah_input.c		optional ipsec
 netinet6/ah_output.c		optional ipsec
 netinet6/dest6.c		optional inet6
 netinet6/esp_aesctr.c		optional ipsec ipsec_esp
 netinet6/esp_core.c		optional ipsec ipsec_esp
 netinet6/esp_input.c		optional ipsec ipsec_esp
 netinet6/esp_output.c		optional ipsec ipsec_esp
 netinet6/esp_rijndael.c		optional ipsec ipsec_esp
 netinet6/frag6.c		optional inet6
 netinet6/icmp6.c		optional inet6
 netinet6/in6.c			optional inet6
 netinet6/in6_cksum.c		optional inet6
 netinet6/in6_gif.c		optional gif inet6
 netinet6/in6_ifattach.c		optional inet6
 netinet6/in6_pcb.c		optional inet6
 netinet6/in6_proto.c		optional inet6
 netinet6/in6_rmx.c		optional inet6
 netinet6/in6_src.c		optional inet6
 netinet6/ip6_forward.c		optional inet6
 netinet6/ip6_id.c		optional inet6
 netinet6/ip6_input.c		optional inet6
 netinet6/ip6_mroute.c		optional inet6
 netinet6/ip6_output.c		optional inet6
 netinet6/ipcomp_core.c		optional ipsec
 netinet6/ipcomp_input.c		optional ipsec
 netinet6/ipcomp_output.c	optional ipsec
 netinet6/ipsec.c		optional ipsec
 netinet6/mld6.c			optional inet6
 netinet6/nd6.c			optional inet6
 netinet6/nd6_nbr.c		optional inet6
 netinet6/nd6_rtr.c		optional inet6
 netinet6/raw_ip6.c		optional inet6
 netinet6/route6.c		optional inet6
 netinet6/scope6.c		optional inet6
 netinet6/udp6_output.c		optional inet6
 netinet6/udp6_usrreq.c		optional inet6
 netipsec/ipsec.c		optional fast_ipsec
 netipsec/ipsec_input.c		optional fast_ipsec
 netipsec/ipsec_mbuf.c		optional fast_ipsec
 netipsec/ipsec_output.c		optional fast_ipsec
 netipsec/key.c			optional fast_ipsec
 netipsec/key_debug.c		optional fast_ipsec
 netipsec/keysock.c		optional fast_ipsec
 netipsec/xform_ah.c		optional fast_ipsec
 netipsec/xform_esp.c		optional fast_ipsec
 netipsec/xform_ipcomp.c		optional fast_ipsec
 netipsec/xform_ipip.c		optional fast_ipsec
 netipsec/xform_tcp.c		optional fast_ipsec tcp_signature
 netipx/ipx.c			optional ipx
 netipx/ipx_cksum.c		optional ipx
 netipx/ipx_input.c		optional ipx
 netipx/ipx_ip.c			optional ipx
 netipx/ipx_outputfl.c		optional ipx
 netipx/ipx_pcb.c		optional ipx
 netipx/ipx_proto.c		optional ipx
 netipx/ipx_usrreq.c		optional ipx
 netipx/spx_debug.c		optional ipx
 netipx/spx_usrreq.c		optional ipx
 netkey/key.c			optional ipsec
 netkey/key_debug.c		optional ipsec
 netkey/keydb.c			optional ipsec
 netkey/keysock.c		optional ipsec
 netnatm/natm.c			optional natm
 netnatm/natm_pcb.c		optional natm
 netnatm/natm_proto.c		optional natm
 netncp/ncp_conn.c		optional ncp
 netncp/ncp_crypt.c		optional ncp
 netncp/ncp_login.c		optional ncp
 netncp/ncp_mod.c		optional ncp
 netncp/ncp_ncp.c		optional ncp
 netncp/ncp_nls.c		optional ncp
 netncp/ncp_rq.c			optional ncp
 netncp/ncp_sock.c		optional ncp
 netncp/ncp_subr.c		optional ncp
 netsmb/smb_conn.c		optional netsmb
 netsmb/smb_crypt.c		optional netsmb
 netsmb/smb_dev.c		optional netsmb
 netsmb/smb_iod.c		optional netsmb
 netsmb/smb_rq.c			optional netsmb
 netsmb/smb_smb.c		optional netsmb
 netsmb/smb_subr.c		optional netsmb
 netsmb/smb_trantcp.c		optional netsmb
 netsmb/smb_usr.c		optional netsmb
 nfs/nfs_common.c		optional nfsclient | nfsserver
 nfs4client/nfs4_dev.c		optional nfsclient
 nfs4client/nfs4_idmap.c		optional nfsclient
 nfs4client/nfs4_socket.c	optional nfsclient
 nfs4client/nfs4_subs.c		optional nfsclient
 nfs4client/nfs4_vfs_subs.c	optional nfsclient
 nfs4client/nfs4_vfsops.c	optional nfsclient
 nfs4client/nfs4_vn_subs.c	optional nfsclient
 nfs4client/nfs4_vnops.c		optional nfsclient
 nfsclient/bootp_subr.c		optional bootp nfsclient
 nfsclient/krpc_subr.c		optional bootp nfsclient
 nfsclient/nfs_bio.c		optional nfsclient
 nfsclient/nfs_diskless.c	optional nfsclient nfs_root
 nfsclient/nfs_node.c		optional nfsclient
 nfsclient/nfs_socket.c		optional nfsclient
 nfsclient/nfs_subs.c		optional nfsclient
 nfsclient/nfs_nfsiod.c		optional nfsclient
 nfsclient/nfs_vfsops.c		optional nfsclient
 nfsclient/nfs_vnops.c		optional nfsclient
 nfsclient/nfs_lock.c		optional nfsclient
 nfsserver/nfs_serv.c		optional nfsserver
 nfsserver/nfs_srvsock.c		optional nfsserver
 nfsserver/nfs_srvcache.c	optional nfsserver
 nfsserver/nfs_srvsubs.c		optional nfsserver
 nfsserver/nfs_syscalls.c	optional nfsserver
 # crypto support
 opencrypto/cast.c		optional crypto | ipsec ipsec_esp
 opencrypto/criov.c		optional crypto
 opencrypto/crypto.c		optional crypto
 opencrypto/cryptodev.c		optional cryptodev
 opencrypto/cryptosoft.c		optional crypto
 opencrypto/deflate.c		optional crypto
 opencrypto/rmd160.c		optional crypto | ipsec
 opencrypto/skipjack.c		optional crypto
 opencrypto/xform.c		optional crypto
 pci/agp.c			optional agp pci
 pci/agp_if.m			optional agp pci
 pci/alpm.c			optional alpm pci
 pci/amdpm.c			optional amdpm pci | nfpm pci
 pci/amdsmb.c			optional amdsmb pci
 pci/if_mn.c			optional mn pci
 pci/if_pcn.c			optional pcn pci
 pci/if_rl.c			optional rl pci
 pci/if_sf.c			optional sf pci
 pci/if_sis.c			optional sis pci
 pci/if_ste.c			optional ste pci
 pci/if_tl.c			optional tl pci
 pci/if_vr.c			optional vr pci
 pci/if_wb.c			optional wb pci
 pci/if_xl.c			optional xl pci
 pci/intpm.c			optional intpm pci
 pci/ncr.c			optional ncr pci
 pci/nfsmb.c			optional nfsmb pci
 pci/viapm.c			optional viapm pci
 pci/xrpu.c			optional xrpu pci
 posix4/ksched.c			optional _kposix_priority_scheduling
 posix4/p1003_1b.c		standard
 posix4/posix4_mib.c		standard
 rpc/rpcclnt.c			optional nfsclient
 security/audit/audit.c		optional audit
 security/audit/audit_arg.c	optional audit
 security/audit/audit_bsm.c	optional audit
 security/audit/audit_bsm_klib.c	optional audit
 security/audit/audit_bsm_token.c	optional audit
 security/audit/audit_pipe.c	optional audit
 security/audit/audit_syscalls.c	standard
 security/audit/audit_trigger.c	optional audit
 security/audit/audit_worker.c	optional audit
 security/mac/mac_inet.c		optional mac inet
 security/mac/mac_label.c	optional mac
 security/mac/mac_net.c		optional mac
 security/mac/mac_pipe.c		optional mac
 security/mac/mac_posix_sem.c	optional mac
 security/mac/mac_process.c	optional mac
 security/mac/mac_socket.c	optional mac
 security/mac/mac_system.c	optional mac
 security/mac/mac_sysv_msg.c	optional mac
 security/mac/mac_sysv_sem.c	optional mac
 security/mac/mac_sysv_shm.c	optional mac
 security/mac/mac_vfs.c		optional mac
 security/mac_biba/mac_biba.c	optional mac_biba
 security/mac_bsdextended/mac_bsdextended.c optional mac_bsdextended
 security/mac_ifoff/mac_ifoff.c	optional mac_ifoff
 security/mac_lomac/mac_lomac.c	optional mac_lomac
 security/mac_mls/mac_mls.c	optional mac_mls
 security/mac_none/mac_none.c	optional mac_none
 security/mac_partition/mac_partition.c optional mac_partition
 security/mac_portacl/mac_portacl.c optional mac_portacl
 security/mac_seeotheruids/mac_seeotheruids.c optional mac_seeotheruids
 security/mac_stub/mac_stub.c	optional mac_stub
 security/mac_test/mac_test.c	optional mac_test
 ufs/ffs/ffs_alloc.c		optional ffs
 ufs/ffs/ffs_balloc.c		optional ffs
 ufs/ffs/ffs_inode.c		optional ffs
 ufs/ffs/ffs_snapshot.c		optional ffs
 ufs/ffs/ffs_softdep.c		optional ffs
 ufs/ffs/ffs_subr.c		optional ffs
 ufs/ffs/ffs_tables.c		optional ffs
 ufs/ffs/ffs_vfsops.c		optional ffs
 ufs/ffs/ffs_vnops.c		optional ffs
 ufs/ffs/ffs_rawread.c		optional directio
 ufs/ufs/ufs_acl.c		optional ffs
 ufs/ufs/ufs_bmap.c		optional ffs
 ufs/ufs/ufs_dirhash.c		optional ffs
 ufs/ufs/ufs_extattr.c		optional ffs
 ufs/ufs/ufs_inode.c		optional ffs
 ufs/ufs/ufs_lookup.c		optional ffs
 ufs/ufs/ufs_quota.c		optional ffs
 ufs/ufs/ufs_vfsops.c		optional ffs
 ufs/ufs/ufs_vnops.c		optional ffs
 vm/default_pager.c		standard
 vm/device_pager.c		standard
 vm/phys_pager.c			standard
 vm/redzone.c			optional DEBUG_REDZONE
 vm/swap_pager.c			standard
 vm/uma_core.c			standard
 vm/uma_dbg.c			standard
 vm/vm_contig.c			standard
 vm/memguard.c			optional DEBUG_MEMGUARD
 vm/vm_fault.c			standard
 vm/vm_glue.c			standard
 vm/vm_init.c			standard
 vm/vm_kern.c			standard
 vm/vm_map.c			standard
 vm/vm_meter.c			standard
 vm/vm_mmap.c			standard
 vm/vm_object.c			standard
 vm/vm_page.c			standard
 vm/vm_pageout.c			standard
 vm/vm_pageq.c			standard
 vm/vm_pager.c			standard
 vm/vm_unix.c			standard
 vm/vm_zeroidle.c		standard
 vm/vnode_pager.c		standard
 #
 gnu/fs/xfs/xfs_alloc.c		optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs" \
 	warning "kernel contains GPL contaminated xfs filesystem"
 gnu/fs/xfs/xfs_alloc_btree.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_bit.c		optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_bmap.c		optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_bmap_btree.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_btree.c		optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_buf_item.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_da_btree.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_dir.c		optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_dir2.c		optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_dir2_block.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_dir2_data.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_dir2_leaf.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_dir2_node.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_dir2_sf.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_dir2_trace.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_dir_leaf.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_error.c		optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_extfree_item.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_fsops.c		optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_ialloc.c		optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_ialloc_btree.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_inode.c		optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_inode_item.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_iocore.c		optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_itable.c		optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_dfrag.c		optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_log.c		optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_log_recover.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_mount.c		optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_rename.c		optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_trans.c		optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_trans_ail.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_trans_buf.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_trans_extfree.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_trans_inode.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_trans_item.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_utils.c		optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_vfsops.c		optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_vnodeops.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_rw.c		optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_attr_leaf.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_attr.c		optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_dmops.c		optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_qmops.c		optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_iget.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/FreeBSD/xfs_freebsd_iget.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/FreeBSD/xfs_mountops.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/FreeBSD/xfs_vnops.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/FreeBSD/xfs_frw.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/FreeBSD/xfs_buf.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/FreeBSD/xfs_globals.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/FreeBSD/xfs_dmistubs.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/FreeBSD/xfs_super.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/FreeBSD/xfs_stats.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/FreeBSD/xfs_vfs.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/FreeBSD/xfs_vnode.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/FreeBSD/xfs_sysctl.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/FreeBSD/xfs_fs_subr.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/FreeBSD/xfs_ioctl.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/FreeBSD/support/debug.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/FreeBSD/support/ktrace.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/FreeBSD/support/mrlock.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/FreeBSD/support/uuid.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/FreeBSD/support/kmem.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_iomap.c		optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
 gnu/fs/xfs/xfs_behavior.c	optional xfs \
 	compile-with "${NORMAL_C} -I$S/gnu/fs/xfs/FreeBSD -I$S/gnu/fs/xfs/FreeBSD/support -I$S/gnu/fs/xfs"
Index: head/sys/conf/options
===================================================================
--- head/sys/conf/options	(revision 159964)
+++ head/sys/conf/options	(revision 159965)
@@ -1,725 +1,726 @@
 # $FreeBSD$
 #
 #        On the handling of kernel options
 #
 # All kernel options should be listed in NOTES, with suitable
 # descriptions.  Negative options (options that make some code not
 # compile) should be commented out; LINT (generated from NOTES) should
 # compile as much code as possible.  Try to structure option-using
 # code so that a single option only switch code on, or only switch
 # code off, to make it possible to have a full compile-test.  If
 # necessary, you can check for COMPILING_LINT to get maximum code
 # coverage.
 #
 # All new options shall also be listed in either "conf/options" or
 # "conf/options.<machine>".  Options that affect a single source-file
 # <xxx>.[c|s] should be directed into "opt_<xxx>.h", while options
 # that affect multiple files should either go in "opt_global.h" if
 # this is a kernel-wide option (used just about everywhere), or in
 # "opt_<option-name-in-lower-case>.h" if it affect only some files.
 # Note that the effect of listing only an option without a
 # header-file-name in conf/options (and cousins) is that the last
 # convention is followed.
 #
 # This handling scheme is not yet fully implemented.
 #
 #
 # Format of this file:
 # Option name	filename
 #
 # If filename is missing, the default is
 # opt_<name-of-option-in-lower-case>.h
 
 AAC_DEBUG		opt_aac.h
 AHC_ALLOW_MEMIO		opt_aic7xxx.h
 AHC_TMODE_ENABLE	opt_aic7xxx.h
 AHC_DUMP_EEPROM		opt_aic7xxx.h
 AHC_DEBUG		opt_aic7xxx.h
 AHC_DEBUG_OPTS		opt_aic7xxx.h
 AHC_REG_PRETTY_PRINT    opt_aic7xxx.h
 AHD_DEBUG		opt_aic79xx.h
 AHD_DEBUG_OPTS		opt_aic79xx.h
 AHD_TMODE_ENABLE	opt_aic79xx.h	
 AHD_REG_PRETTY_PRINT	opt_aic79xx.h
 ADW_ALLOW_MEMIO		opt_adw.h
 
 TWA_DEBUG		opt_twa.h
 TWA_FLASH_FIRMWARE	opt_twa.h
 
 # Debugging options.
 DDB
 DDB_NUMSYM	opt_ddb.h
 GDB
 GDBSPEED	opt_gdb.h
 KDB		opt_global.h
 KDB_TRACE	opt_kdb.h
 KDB_UNATTENDED	opt_kdb.h
 SYSCTL_DEBUG	opt_sysctl.h
 
 # Miscellaneous options.
 ADAPTIVE_GIANT	opt_adaptive_mutexes.h
 NO_ADAPTIVE_MUTEXES	opt_adaptive_mutexes.h
 ALQ
 AUDIT		opt_global.h
 CODA_COMPAT_5	opt_coda.h
 COMPAT_43	opt_compat.h
 COMPAT_43TTY	opt_compat.h
 COMPAT_FREEBSD4	opt_compat.h
 COMPAT_FREEBSD5	opt_compat.h
 COMPILING_LINT	opt_global.h
 CONSPEED	opt_comconsole.h
 CY_PCI_FASTINTR
 DIRECTIO
 FULL_PREEMPTION	opt_sched.h
 IPI_PREEMPTION	opt_sched.h
 GEOM_AES	opt_geom.h
 GEOM_APPLE	opt_geom.h
 GEOM_BDE	opt_geom.h
 GEOM_BSD	opt_geom.h
 GEOM_CONCAT	opt_geom.h
 GEOM_ELI	opt_geom.h
 GEOM_FOX	opt_geom.h
 GEOM_GATE	opt_geom.h
 GEOM_GPT	opt_geom.h
 GEOM_LABEL	opt_geom.h
 GEOM_MBR	opt_geom.h
 GEOM_MIRROR	opt_geom.h
 GEOM_NOP	opt_geom.h
 GEOM_PC98	opt_geom.h
 GEOM_RAID3	opt_geom.h
 GEOM_SHSEC	opt_geom.h
 GEOM_STRIPE	opt_geom.h
 GEOM_SUNLABEL	opt_geom.h
 GEOM_UZIP	opt_geom.h
 GEOM_VOL	opt_geom.h
 GEOM_ZERO	opt_geom.h
 KSTACK_MAX_PAGES
 KSTACK_PAGES
 KTRACE
 KTRACE_REQUEST_POOL	opt_ktrace.h
 LIBICONV
 MAC
 MAC_ALWAYS_LABEL_MBUF	opt_mac.h
 MAC_BIBA	opt_dontuse.h
 MAC_BSDEXTENDED	opt_dontuse.h
 MAC_DEBUG	opt_mac.h
 MAC_IFOFF	opt_dontuse.h
 MAC_LOMAC	opt_dontuse.h
 MAC_MLS		opt_dontuse.h
 MAC_NONE	opt_dontuse.h
 MAC_PARTITION	opt_dontuse.h
 MAC_PORTACL	opt_dontuse.h
 MAC_SEEOTHERUIDS	opt_dontuse.h
 MAC_STATIC	opt_mac.h
 MAC_STUB	opt_dontuse.h
 MAC_TEST	opt_dontuse.h
 MD_ROOT		opt_md.h
 MD_ROOT_SIZE	opt_md.h
 MFI_DEBUG	opt_mfi.h
 MFI_DECODE_LOG	opt_mfi.h
 MPROF_BUFFERS	opt_mprof.h
 MPROF_HASH_SIZE	opt_mprof.h
 MUTEX_WAKE_ALL
 NSWBUF_MIN	opt_swap.h
 PANIC_REBOOT_WAIT_TIME	opt_panic.h
 PPC_DEBUG	opt_ppc.h
 PPC_PROBE_CHIPSET opt_ppc.h
 PPS_SYNC	opt_ntp.h
 PREEMPTION	opt_sched.h
 QUOTA
 SCHED_4BSD	opt_sched.h
 SCHED_CORE	opt_sched.h
 SCHED_ULE	opt_sched.h
 SHOW_BUSYBUFS
 SLEEPQUEUE_PROFILING
 SLHCI_DEBUG	opt_slhci.h
 SPX_HACK
 SUIDDIR
 MSGMNB		opt_sysvipc.h
 MSGMNI		opt_sysvipc.h
 MSGSEG		opt_sysvipc.h
 MSGSSZ		opt_sysvipc.h
 MSGTQL		opt_sysvipc.h
 SEMMAP		opt_sysvipc.h
 SEMMNI		opt_sysvipc.h
 SEMMNS		opt_sysvipc.h
 SEMMNU		opt_sysvipc.h
 SEMMSL		opt_sysvipc.h
 SEMOPM		opt_sysvipc.h
 SEMUME		opt_sysvipc.h
 SHMALL		opt_sysvipc.h
 SHMMAX		opt_sysvipc.h
 SHMMAXPGS	opt_sysvipc.h
 SHMMIN		opt_sysvipc.h
 SHMMNI		opt_sysvipc.h
 SHMSEG		opt_sysvipc.h
 SYSVMSG		opt_sysvipc.h
 SYSVSEM		opt_sysvipc.h
 SYSVSHM		opt_sysvipc.h
 SW_WATCHDOG	opt_watchdog.h
 TURNSTILE_PROFILING
 TTYHOG		opt_tty.h
 VFS_AIO
 VERBOSE_SYSINIT	opt_global.h
 WLCACHE		opt_wavelan.h
 WLDEBUG		opt_wavelan.h
 
 # POSIX kernel options
 P1003_1B_MQUEUE			opt_posix.h
 P1003_1B_SEMAPHORES		opt_posix.h
 _KPOSIX_PRIORITY_SCHEDULING	opt_posix.h
 
 # Do we want the config file compiled into the kernel?
 INCLUDE_CONFIG_FILE	opt_config.h
 
 # Options for static filesystems.  These should only be used at config
 # time, since the corresponding lkms cannot work if there are any static
 # dependencies.  Unusability is enforced by hiding the defines for the
 # options in a never-included header.
 CD9660		opt_dontuse.h
 CODA		opt_dontuse.h
 EXT2FS		opt_dontuse.h
 FDESCFS		opt_dontuse.h
 HPFS		opt_dontuse.h
 MSDOSFS		opt_dontuse.h
 NTFS		opt_dontuse.h
 NULLFS		opt_dontuse.h
 NWFS		opt_dontuse.h
 PORTALFS	opt_dontuse.h
 PROCFS		opt_dontuse.h
 PSEUDOFS	opt_dontuse.h
 REISERFS	opt_dontuse.h
 SMBFS		opt_dontuse.h
 UDF		opt_dontuse.h
 UMAPFS		opt_dontuse.h
 UNIONFS		opt_dontuse.h
 
 # Pseudofs debugging
 PSEUDOFS_TRACE	opt_pseudofs.h
 
 # Broken - ffs_snapshot() dependency from ufs_lookup() :-(
 FFS		opt_ffs_broken_fixme.h
 
 # These static filesystems have one slightly bogus static dependency in
 # sys/i386/i386/autoconf.c.  If any of these filesystems are
 # statically compiled into the kernel, code for mounting them as root
 # filesystems will be enabled - but look below.
 NFSCLIENT	opt_nfs.h
 NFSSERVER	opt_nfs.h
 
 # filesystems and libiconv bridge
 CD9660_ICONV	opt_dontuse.h
 MSDOSFS_ICONV	opt_dontuse.h
 NTFS_ICONV	opt_dontuse.h
 UDF_ICONV	opt_dontuse.h
 
 # If you are following the conditions in the copyright,
 # you can enable soft-updates which will speed up a lot of thigs
 # and make the system safer from crashes at the same time.
 # otherwise a STUB module will be compiled in.
 SOFTUPDATES	opt_ffs.h
 
 # On small, embedded systems, it can be useful to turn off support for
 # snapshots.  It saves about 30-40k for a feature that would be lightly
 # used, if it is used at all.
 NO_FFS_SNAPSHOT	opt_ffs.h
 
 # Enabling this option turns on support for Access Control Lists in UFS,
 # which can be used to support high security configurations.  Depends on
 # UFS_EXTATTR.
 UFS_ACL		opt_ufs.h
 
 # Enabling this option turns on support for extended attributes in UFS-based
 # filesystems, which can be used to support high security configurations
 # as well as new filesystem features.
 UFS_EXTATTR	opt_ufs.h
 UFS_EXTATTR_AUTOSTART	opt_ufs.h
 
 # Enable fast hash lookups for large directories on UFS-based filesystems.
 UFS_DIRHASH	opt_ufs.h
 
 # The below sentence is not in English, and neither is this one.
 # We plan to remove the static dependences above, with a
 # <filesystem>_ROOT option to control if it usable as root.  This list
 # allows these options to be present in config files already (though
 # they won't make any difference yet).
 NFS_ROOT	opt_nfsroot.h
 
 # SMB/CIFS requester
 NETSMB		opt_netsmb.h
 
 # Experimental support for large MS-DOS filesystems; SEE WARNING IN "NOTES"!
 MSDOSFS_LARGE	opt_msdosfs.h
 
 # Options used only in subr_param.c.
 HZ		opt_param.h
 MAXFILES	opt_param.h
 NBUF		opt_param.h
 NMBCLUSTERS	opt_param.h
 NSFBUFS		opt_param.h
 VM_BCACHE_SIZE_MAX	opt_param.h
 VM_SWZONE_SIZE_MAX	opt_param.h
 MAXUSERS
 DFLDSIZ		opt_param.h
 MAXDSIZ		opt_param.h
 MAXSSIZ		opt_param.h
 
 # Generic SCSI options.
 CAM_MAX_HIGHPOWER	opt_cam.h
 CAMDEBUG		opt_cam.h
 CAM_DEBUG_DELAY		opt_cam.h
 CAM_DEBUG_BUS		opt_cam.h
 CAM_DEBUG_TARGET	opt_cam.h
 CAM_DEBUG_LUN		opt_cam.h
 CAM_DEBUG_FLAGS		opt_cam.h
 CAM_NEW_TRAN_CODE	opt_cam.h
 SCSI_DELAY		opt_scsi.h
 SCSI_NO_SENSE_STRINGS	opt_scsi.h
 SCSI_NO_OP_STRINGS	opt_scsi.h
 
 # Options used only in cam/scsi/scsi_cd.c
 CHANGER_MIN_BUSY_SECONDS	opt_cd.h
 CHANGER_MAX_BUSY_SECONDS	opt_cd.h
 
 # Options used only in cam/scsi/scsi_sa.c.
 SA_IO_TIMEOUT		opt_sa.h
 SA_SPACE_TIMEOUT	opt_sa.h
 SA_REWIND_TIMEOUT	opt_sa.h
 SA_ERASE_TIMEOUT	opt_sa.h
 SA_1FM_AT_EOD		opt_sa.h
 
 # Options used only in cam/scsi/scsi_pt.c
 SCSI_PT_DEFAULT_TIMEOUT	opt_pt.h
 
 # Options used only in cam/scsi/scsi_ses.c
 SES_ENABLE_PASSTHROUGH	opt_ses.h
 
 # Options used in dev/sym/ (Symbios SCSI driver).
 SYM_SETUP_LP_PROBE_MAP	opt_sym.h	#-Low Priority Probe Map (bits)
 					# Allows the ncr to take precedence
 					# 1 (1<<0) -> 810a, 860
 					# 2 (1<<1) -> 825a, 875, 885, 895
 					# 4 (1<<2) -> 895a, 896, 1510d 
 SYM_SETUP_SCSI_DIFF	opt_sym.h	#-HVD support for 825a, 875, 885
 					# disabled:0 (default), enabled:1
 SYM_SETUP_PCI_PARITY	opt_sym.h	#-PCI parity checking
 					# disabled:0, enabled:1 (default)
 SYM_SETUP_MAX_LUN	opt_sym.h	#-Number of LUNs supported
 					# default:8, range:[1..64]
 
 # Options used only in pci/ncr.c
 SCSI_NCR_DEBUG		opt_ncr.h
 SCSI_NCR_MAX_SYNC	opt_ncr.h
 SCSI_NCR_MAX_WIDE	opt_ncr.h
 SCSI_NCR_MYADDR		opt_ncr.h
 
 # Options used only in dev/isp/*
 ISP_TARGET_MODE		opt_isp.h
 ISP_FW_CRASH_DUMP	opt_isp.h
 ISP_DEFAULT_ROLES	opt_isp.h
 
 # Options used in the 'ata' ATA/ATAPI driver
 ATA_STATIC_ID		opt_ata.h
 ATA_NOPCI		opt_ata.h
 
 # Net stuff.
 ACCEPT_FILTER_DATA
 ACCEPT_FILTER_HTTP
 ALTQ			opt_global.h
 ALTQ_CBQ		opt_altq.h
 ALTQ_RED		opt_altq.h
 ALTQ_RIO		opt_altq.h
 ALTQ_HFSC		opt_altq.h
 ALTQ_CDNR		opt_altq.h
 ALTQ_PRIQ		opt_altq.h
 ALTQ_NOPCC		opt_altq.h
 ALTQ_DEBUG		opt_altq.h
 BOOTP			opt_bootp.h
 BOOTP_COMPAT		opt_bootp.h
 BOOTP_NFSROOT		opt_bootp.h
 BOOTP_NFSV3		opt_bootp.h
 BOOTP_WIRED_TO		opt_bootp.h
 DEVICE_POLLING
+DEV_ENC			opt_enc.h
 DEV_PF			opt_pf.h
 DEV_PFLOG		opt_pf.h
 DEV_PFSYNC		opt_pf.h
 ETHER_II		opt_ef.h
 ETHER_8023		opt_ef.h
 ETHER_8022		opt_ef.h
 ETHER_SNAP		opt_ef.h
 MROUTING		opt_mrouting.h
 PIM			opt_mrouting.h
 INET			opt_inet.h
 INET6			opt_inet6.h
 IPSEC			opt_ipsec.h
 IPSEC_ESP		opt_ipsec.h
 IPSEC_DEBUG		opt_ipsec.h
 IPSEC_FILTERGIF		opt_ipsec.h
 FAST_IPSEC		opt_ipsec.h
 IPDIVERT
 DUMMYNET		opt_ipdn.h
 IPFILTER		opt_ipfilter.h
 IPFILTER_LOG		opt_ipfilter.h
 IPFILTER_LOOKUP		opt_ipfilter.h
 IPFILTER_DEFAULT_BLOCK	opt_ipfilter.h
 IPFIREWALL		opt_ipfw.h
 IPFIREWALL_VERBOSE	opt_ipfw.h
 IPFIREWALL_VERBOSE_LIMIT	opt_ipfw.h
 IPFIREWALL_DEFAULT_TO_ACCEPT	opt_ipfw.h
 IPFIREWALL_FORWARD	opt_ipfw.h
 IPFIREWALL_FORWARD_EXTENDED	opt_ipfw.h
 IPSTEALTH
 IPX
 IPXIP			opt_ipx.h
 LIBMBPOOL
 LIBMCHAIN
 LIBALIAS
 MBUF_STRESS_TEST
 NCP
 NETATALK		opt_atalk.h
 NET_WITH_GIANT		opt_net.h
 PPP_BSDCOMP		opt_ppp.h
 PPP_DEFLATE		opt_ppp.h
 PPP_FILTER		opt_ppp.h
 SLIP_IFF_OPTS		opt_slip.h
 TCPDEBUG
 TCP_SIGNATURE		opt_inet.h
 TCP_SACK_DEBUG		opt_tcp_sack.h 
 TCP_DROP_SYNFIN		opt_tcp_input.h
 DEV_VLAN		opt_vlan.h
 VLAN_ARRAY		opt_vlan.h
 XBONEHACK
 
 # Netgraph(4). Use option NETGRAPH to enable the base netgraph code.
 # Each netgraph node type can be either be compiled into the kernel
 # or loaded dynamically. To get the former, include the corresponding
 # option below. Each type has its own man page, e.g. ng_async(4).
 NETGRAPH
 NETGRAPH_DEBUG		opt_netgraph.h
 NETGRAPH_ASYNC		opt_netgraph.h
 NETGRAPH_ATMLLC		opt_netgraph.h
 NETGRAPH_ATM_ATMPIF	opt_netgraph.h
 NETGRAPH_BLUETOOTH	opt_netgraph.h
 NETGRAPH_BLUETOOTH_BT3C	opt_netgraph.h
 NETGRAPH_BLUETOOTH_H4	opt_netgraph.h
 NETGRAPH_BLUETOOTH_HCI	opt_netgraph.h
 NETGRAPH_BLUETOOTH_L2CAP	opt_netgraph.h
 NETGRAPH_BLUETOOTH_SOCKET	opt_netgraph.h
 NETGRAPH_BLUETOOTH_UBT	opt_netgraph.h
 NETGRAPH_BLUETOOTH_UBTBCMFW	opt_netgraph.h
 NETGRAPH_BPF		opt_netgraph.h
 NETGRAPH_BRIDGE		opt_netgraph.h
 NETGRAPH_CISCO		opt_netgraph.h
 NETGRAPH_DEVICE		opt_netgraph.h
 NETGRAPH_ECHO		opt_netgraph.h
 NETGRAPH_EIFACE		opt_netgraph.h
 NETGRAPH_ETHER		opt_netgraph.h
 NETGRAPH_FEC		opt_netgraph.h
 NETGRAPH_FRAME_RELAY	opt_netgraph.h
 NETGRAPH_GIF		opt_netgraph.h
 NETGRAPH_GIF_DEMUX	opt_netgraph.h
 NETGRAPH_HOLE		opt_netgraph.h
 NETGRAPH_IFACE		opt_netgraph.h
 NETGRAPH_IP_INPUT	opt_netgraph.h
 NETGRAPH_IPFW		opt_netgraph.h
 NETGRAPH_KSOCKET	opt_netgraph.h
 NETGRAPH_L2TP		opt_netgraph.h
 NETGRAPH_LMI		opt_netgraph.h
 # MPPC compression requires proprietary files (not included)
 NETGRAPH_MPPC_COMPRESSION	opt_netgraph.h
 NETGRAPH_MPPC_ENCRYPTION	opt_netgraph.h
 NETGRAPH_NAT		opt_netgraph.h
 NETGRAPH_NETFLOW	opt_netgraph.h
 NETGRAPH_ONE2MANY	opt_netgraph.h
 NETGRAPH_PPP		opt_netgraph.h
 NETGRAPH_PPPOE		opt_netgraph.h
 NETGRAPH_PPTPGRE	opt_netgraph.h
 NETGRAPH_RFC1490	opt_netgraph.h
 NETGRAPH_SOCKET		opt_netgraph.h
 NETGRAPH_SPLIT		opt_netgraph.h
 NETGRAPH_SPPP		opt_netgraph.h
 NETGRAPH_TCPMSS		opt_netgraph.h
 NETGRAPH_TEE		opt_netgraph.h
 NETGRAPH_TTY		opt_netgraph.h
 NETGRAPH_UI		opt_netgraph.h
 NETGRAPH_VJC		opt_netgraph.h
 
 # NgATM options
 NGATM_ATM		opt_netgraph.h
 NGATM_ATMBASE		opt_netgraph.h
 NGATM_SSCOP		opt_netgraph.h
 NGATM_SSCFU		opt_netgraph.h
 NGATM_UNI		opt_netgraph.h
 NGATM_CCATM		opt_netgraph.h
 
 # DRM options
 DRM_DEBUG		opt_drm.h
 
 ZERO_COPY_SOCKETS	opt_zero.h
 TI_PRIVATE_JUMBOS	opt_ti.h
 TI_JUMBO_HDRSPLIT	opt_ti.h
 
 # ATM (HARP version)
 ATM_CORE		opt_atm.h
 ATM_IP			opt_atm.h
 ATM_SIGPVC		opt_atm.h
 ATM_SPANS		opt_atm.h
 ATM_UNI			opt_atm.h
 
 # XXX Conflict: # of devices vs network protocol (Native ATM).
 # This makes "atm.h" unusable.
 NATM
 
 # DPT driver debug flags
 DPT_MEASURE_PERFORMANCE	opt_dpt.h
 DPT_HANDLE_TIMEOUTS	opt_dpt.h
 DPT_TIMEOUT_FACTOR	opt_dpt.h
 DPT_LOST_IRQ		opt_dpt.h
 DPT_RESET_HBA		opt_dpt.h
 
 # Misc debug flags.  Most of these should probably be replaced with
 # 'DEBUG', and then let people recompile just the interesting modules
 # with 'make CC="cc -DDEBUG"'.
 CLUSTERDEBUG		opt_debug_cluster.h
 DEBUG_1284		opt_ppb_1284.h
 VP0_DEBUG		opt_vpo.h
 LPT_DEBUG		opt_lpt.h
 PLIP_DEBUG		opt_plip.h
 LOCKF_DEBUG		opt_debug_lockf.h
 NETATALKDEBUG		opt_atalk.h
 SI_DEBUG		opt_debug_si.h
 
 # Fb options
 FB_DEBUG		opt_fb.h
 FB_INSTALL_CDEV		opt_fb.h
 
 # ppbus related options
 PERIPH_1284		opt_ppb_1284.h
 DONTPROBE_1284		opt_ppb_1284.h
 
 # smbus related options
 ENABLE_ALART		opt_intpm.h
 
 # These cause changes all over the kernel
 BLKDEV_IOSIZE		opt_global.h
 BURN_BRIDGES		opt_global.h
 DEBUG			opt_global.h
 DEBUG_LOCKS		opt_global.h
 DEBUG_VFS_LOCKS		opt_global.h
 DIAGNOSTIC		opt_global.h
 INVARIANT_SUPPORT	opt_global.h
 INVARIANTS		opt_global.h
 MCLSHIFT		opt_global.h
 MUTEX_DEBUG		opt_global.h
 MUTEX_NOINLINE		opt_global.h
 MUTEX_PROFILING		opt_global.h
 MSIZE			opt_global.h
 REGRESSION		opt_global.h
 RESTARTABLE_PANICS	opt_global.h
 RWLOCK_NOINLINE		opt_global.h
 VFS_BIO_DEBUG		opt_global.h
 
 # These are VM related options
 VM_KMEM_SIZE		opt_vm.h
 VM_KMEM_SIZE_SCALE	opt_vm.h
 VM_KMEM_SIZE_MAX	opt_vm.h
 NO_SWAPPING		opt_vm.h
 MALLOC_MAKE_FAILURES	opt_vm.h
 MALLOC_PROFILE		opt_vm.h
 PQ_NOOPT		opt_vmpage.h
 
 # The MemGuard replacement allocator used for tamper-after-free detection
 DEBUG_MEMGUARD		opt_vm.h
 
 # The RedZone malloc(9) protection
 DEBUG_REDZONE		opt_vm.h
 
 # Standard SMP options
 SMP			opt_global.h
 
 # Size of the kernel message buffer
 MSGBUF_SIZE		opt_msgbuf.h
 
 # NFS options
 NFS_MINATTRTIMO		opt_nfs.h
 NFS_MAXATTRTIMO		opt_nfs.h
 NFS_MINDIRATTRTIMO	opt_nfs.h
 NFS_MAXDIRATTRTIMO	opt_nfs.h
 NFS_GATHERDELAY		opt_nfs.h
 NFS_WDELAYHASHSIZ	opt_nfs.h
 NFS_DEBUG		opt_nfs.h
 
 # For the Bt848/Bt848A/Bt849/Bt878/Bt879 driver
 OVERRIDE_CARD			opt_bktr.h
 OVERRIDE_TUNER			opt_bktr.h
 OVERRIDE_DBX			opt_bktr.h
 OVERRIDE_MSP			opt_bktr.h
 BROOKTREE_SYSTEM_DEFAULT	opt_bktr.h
 BROOKTREE_ALLOC_PAGES		opt_bktr.h
 BKTR_OVERRIDE_CARD		opt_bktr.h
 BKTR_OVERRIDE_TUNER		opt_bktr.h
 BKTR_OVERRIDE_DBX		opt_bktr.h
 BKTR_OVERRIDE_MSP		opt_bktr.h
 BKTR_SYSTEM_DEFAULT		opt_bktr.h
 BKTR_ALLOC_PAGES		opt_bktr.h
 BKTR_USE_PLL			opt_bktr.h	
 BKTR_GPIO_ACCESS		opt_bktr.h
 BKTR_NO_MSP_RESET		opt_bktr.h
 BKTR_430_FX_MODE		opt_bktr.h
 BKTR_SIS_VIA_MODE		opt_bktr.h
 BKTR_USE_FREEBSD_SMBUS		opt_bktr.h
 BKTR_NEW_MSP34XX_DRIVER		opt_bktr.h
 
 # options for serial support
 COM_ESP			opt_sio.h
 COM_MULTIPORT		opt_sio.h
 BREAK_TO_DEBUGGER	opt_comconsole.h
 ALT_BREAK_TO_DEBUGGER	opt_comconsole.h
 
 # Options to support PPS
 UART_PPS_ON_CTS		opt_uart.h
 
 # options for bus/device framework
 BUS_DEBUG		opt_bus.h
 
 # options for USB support
 USB_DEBUG		opt_usb.h
 USBVERBOSE		opt_usb.h
 UKBD_DFLT_KEYMAP	opt_ukbd.h
 UPLCOM_INTR_INTERVAL	opt_uplcom.h
 UVSCOM_DEFAULT_OPKTSIZE	opt_uvscom.h
 UVSCOM_INTR_INTERVAL	opt_uvscom.h
 
 # Embedded system options
 INIT_PATH
 
 ROOTDEVNAME
 
 FDC_DEBUG		opt_fdc.h
 PCFCLOCK_VERBOSE	opt_pcfclock.h
 PCFCLOCK_MAX_RETRIES	opt_pcfclock.h
 
 KTR			opt_global.h
 KTR_ALQ			opt_ktr.h
 KTR_MASK		opt_ktr.h
 KTR_CPUMASK		opt_ktr.h
 KTR_COMPILE		opt_global.h
 KTR_ENTRIES		opt_global.h
 KTR_VERBOSE		opt_ktr.h
 WITNESS			opt_global.h
 WITNESS_KDB		opt_witness.h
 WITNESS_SKIPSPIN	opt_witness.h
 
 # options for ACPI support
 ACPI_DEBUG		opt_acpi.h
 ACPI_MAX_THREADS	opt_acpi.h
 ACPI_NO_SEMAPHORES	opt_acpi.h
 ACPICA_PEDANTIC		opt_acpi.h
 
 # ISA support
 DEV_ISA			opt_isa.h
 ISAPNP			opt_isa.h
 
 # options for DEVFS, see sys/fs/devfs/devfs.h
 NDEVFSINO		opt_devfs.h
 NDEVFSOVERFLOW		opt_devfs.h
 
 # various 'device presence' options.
 DEV_BPF			opt_bpf.h
 DEV_MCA			opt_mca.h
 DEV_CARP		opt_carp.h
 DEV_SPLASH		opt_splash.h
 
 EISA_SLOTS		opt_eisa.h
 
 # ed driver
 ED_HPP			opt_ed.h
 ED_3C503		opt_ed.h
 ED_SIC			opt_ed.h
 
 # bce driver
 BCE_DEBUG		opt_bce.h
 
 # wi driver
 WI_SYMBOL_FIRMWARE	opt_wi.h
 
 SOCKBUF_DEBUG		opt_global.h
 
 # options for ubsec driver
 UBSEC_DEBUG		opt_ubsec.h
 UBSEC_RNDTEST		opt_ubsec.h
 UBSEC_NO_RNG		opt_ubsec.h
 
 # options for hifn driver
 HIFN_DEBUG		opt_hifn.h
 HIFN_RNDTEST		opt_hifn.h
 
 # options for safenet driver
 SAFE_DEBUG		opt_safe.h
 SAFE_NO_RNG		opt_safe.h
 SAFE_RNDTEST		opt_safe.h
 
 # syscons options
 MAXCONS			opt_syscons.h
 SC_ALT_MOUSE_IMAGE	opt_syscons.h
 SC_CUT_SPACES2TABS	opt_syscons.h
 SC_CUT_SEPCHARS		opt_syscons.h
 SC_DEBUG_LEVEL		opt_syscons.h
 SC_DFLT_FONT		opt_syscons.h
 SC_DISABLE_KDBKEY	opt_syscons.h
 SC_DISABLE_REBOOT	opt_syscons.h
 SC_HISTORY_SIZE		opt_syscons.h
 SC_KERNEL_CONS_ATTR	opt_syscons.h
 SC_KERNEL_CONS_REV_ATTR	opt_syscons.h
 SC_MOUSE_CHAR		opt_syscons.h
 SC_NO_CUTPASTE		opt_syscons.h
 SC_NO_FONT_LOADING	opt_syscons.h
 SC_NO_HISTORY		opt_syscons.h
 SC_NO_SUSPEND_VTYSWITCH	opt_syscons.h
 SC_NO_SYSMOUSE		opt_syscons.h
 SC_NORM_ATTR		opt_syscons.h
 SC_NORM_REV_ATTR	opt_syscons.h
 SC_PIXEL_MODE		opt_syscons.h
 SC_RENDER_DEBUG		opt_syscons.h
 SC_TWOBUTTON_MOUSE	opt_syscons.h
 
 # kbd options
 KBD_DISABLE_KEYMAP_LOAD	opt_kbd.h
 KBD_INSTALL_CDEV	opt_kbd.h
 KBD_MAXRETRY		opt_kbd.h
 KBD_MAXWAIT		opt_kbd.h
 KBD_RESETDELAY		opt_kbd.h
 KBDIO_DEBUG		opt_kbd.h
 
 # options for the Atheros driver
 ATH_DEBUG		opt_ath.h
 ATH_TXBUF		opt_ath.h
 ATH_RXBUF		opt_ath.h
 ATH_DIAGAPI		opt_ath.h
 ATH_TX99_DIAG		opt_ath.h
 
 # dcons options 
 DCONS_BUF_SIZE		opt_dcons.h
 DCONS_POLL_HZ		opt_dcons.h
 DCONS_FORCE_CONSOLE	opt_dcons.h
 DCONS_FORCE_GDB		opt_dcons.h
 
 # Static unit counts
 NI4BTRC			opt_i4b.h
 NI4BRBCH		opt_i4b.h
 NI4BTEL			opt_i4b.h
 NI4BIPR			opt_i4b.h
 NI4BING			opt_i4b.h
 NI4BISPPP		opt_i4b.h
 
 # VFS options
 LOOKUP_SHARED		opt_vfs.h
 
 # HWPMC options
 HWPMC_HOOKS
 
 # XBOX options for FreeBSD/i386, but some files are MI
 XBOX			opt_xbox.h
 
 # XFS
 XFS
Index: head/sys/net/if_enc.c
===================================================================
--- head/sys/net/if_enc.c	(nonexistent)
+++ head/sys/net/if_enc.c	(revision 159965)
@@ -0,0 +1,323 @@
+/*-
+ * Copyright (c) 2006 The FreeBSD Project.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/kernel.h>
+#include <sys/malloc.h>
+#include <sys/mbuf.h>
+#include <sys/module.h>
+#include <machine/bus.h>
+#include <sys/rman.h>
+#include <sys/socket.h>
+#include <sys/sockio.h>
+#include <sys/sysctl.h>
+
+#include <net/if.h>
+#include <net/if_clone.h>
+#include <net/if_types.h>
+#include <net/pfil.h>
+#include <net/route.h>
+#include <net/netisr.h>
+#include <net/bpf.h>
+#include <net/bpfdesc.h>
+
+#include <netinet/in.h>
+#include <netinet/in_systm.h>
+#include <netinet/ip.h>
+#include <netinet/ip_var.h>
+#include <netinet/in_var.h>
+#include "opt_inet6.h"
+
+#ifdef INET6
+#include <netinet/ip6.h>
+#include <netinet6/ip6_var.h>
+#endif
+
+#include <netipsec/ipsec.h>
+
+#define ENCMTU		(1024+512)
+#define ENC_HDRLEN	12
+
+/* XXX this define must have the same value as in OpenBSD */
+#define M_CONF		0x0400	/* payload was encrypted (ESP-transport) */
+#define M_AUTH		0x0800	/* payload was authenticated (AH or ESP auth) */
+#define M_AUTH_AH	0x2000	/* header was authenticated (AH) */
+
+struct enchdr {
+	u_int32_t af;
+	u_int32_t spi;
+	u_int32_t flags;
+};
+
+static struct ifnet	*encif;
+static struct mtx	enc_mtx;
+
+struct enc_softc {
+	struct	ifnet *sc_ifp;
+};
+
+static int	enc_ioctl(struct ifnet *, u_long, caddr_t);
+static int	enc_output(struct ifnet *ifp, struct mbuf *m,
+		    struct sockaddr *dst, struct rtentry *rt);
+static int	enc_clone_create(struct if_clone *, int);
+static void	enc_clone_destroy(struct ifnet *);
+
+IFC_SIMPLE_DECLARE(enc, 1);
+
+static void
+enc_clone_destroy(struct ifnet *ifp)
+{
+
+	KASSERT(encif == ifp, ("%s: unknown ifnet", __func__));
+
+	mtx_lock(&enc_mtx);
+	encif = NULL;
+	mtx_unlock(&enc_mtx);
+
+	bpfdetach(ifp);
+	if_detach(ifp);
+	if_free(ifp);
+
+}
+
+static int
+enc_clone_create(struct if_clone *ifc, int unit)
+{
+	struct ifnet *ifp;
+	struct enc_softc *sc;
+
+	mtx_lock(&enc_mtx);
+	if (encif != NULL)
+		return (EBUSY);
+	mtx_unlock(&enc_mtx);
+
+	sc = malloc(sizeof(*sc), M_DEVBUF, M_WAITOK|M_ZERO);
+	ifp = sc->sc_ifp = if_alloc(IFT_ENC);
+	if (ifp == NULL) {
+		free(sc, M_DEVBUF);
+		return (ENOSPC);
+	}
+
+	if_initname(ifp, ifc->ifc_name, unit);
+	ifp->if_mtu = ENCMTU;
+	ifp->if_ioctl = enc_ioctl;
+	ifp->if_output = enc_output;
+	ifp->if_snd.ifq_maxlen = ifqmaxlen;
+	ifp->if_softc = sc;
+	if_attach(ifp);
+	bpfattach(ifp, DLT_ENC, ENC_HDRLEN);
+
+	mtx_lock(&enc_mtx);
+	encif = ifp;
+	mtx_unlock(&enc_mtx);
+
+	return (0);
+}
+
+static int
+enc_modevent(module_t mod, int type, void *data)
+{
+	switch (type) {
+	case MOD_LOAD:
+		mtx_init(&enc_mtx, "enc mtx", NULL, MTX_DEF);
+		if_clone_attach(&enc_cloner);
+		break;
+	case MOD_UNLOAD:
+		printf("enc module unload - not possible for this module\n");
+		return (EINVAL);
+	default:
+		return (EOPNOTSUPP);
+	}
+	return (0);
+}
+
+static moduledata_t enc_mod = {
+	"enc",
+	enc_modevent,
+	0
+};
+
+DECLARE_MODULE(enc, enc_mod, SI_SUB_PROTO_IFATTACHDOMAIN, SI_ORDER_ANY);
+
+static int
+enc_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
+    struct rtentry *rt)
+{
+	m_freem(m);
+	return (0);
+}
+
+/*
+ * Process an ioctl request.
+ */
+/* ARGSUSED */
+static int
+enc_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
+{
+	int error = 0;
+
+	switch (cmd) {
+
+	case SIOCSIFFLAGS:
+		if (ifp->if_flags & IFF_UP)
+			ifp->if_drv_flags |= IFF_DRV_RUNNING;
+		else
+			ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
+
+		break;
+
+	default:
+		error = EINVAL;
+	}
+	return (error);
+}
+
+int
+ipsec_filter(struct mbuf **mp, int dir)
+{
+	int error, i;
+	struct ip *ip;
+
+	mtx_lock(&enc_mtx);
+	if (encif == NULL || (encif->if_drv_flags & IFF_DRV_RUNNING) == 0) {
+		mtx_unlock(&enc_mtx);
+		return (0);
+	}
+
+	/* Skip pfil(9) if no filters are loaded */
+	if (!(PFIL_HOOKED(&inet_pfil_hook)
+#ifdef INET6
+	    || PFIL_HOOKED(&inet6_pfil_hook)
+#endif
+	    )) {
+		mtx_unlock(&enc_mtx);
+		return (0);
+	}
+
+	i = min((*mp)->m_pkthdr.len, max_protohdr);
+	if ((*mp)->m_len < i) {
+		*mp = m_pullup(*mp, i);
+		if (*mp == NULL) {
+			printf("%s: m_pullup failed\n", __func__);
+			mtx_unlock(&enc_mtx);
+			return (-1);
+		}
+	}
+
+	error = 0;
+	ip = mtod(*mp, struct ip *);
+	switch (ip->ip_v) {
+		case 4:
+			/*
+			 * before calling the firewall, swap fields the same as
+			 * IP does. here we assume the header is contiguous
+			 */
+			ip->ip_len = ntohs(ip->ip_len);
+			ip->ip_off = ntohs(ip->ip_off);
+
+			error = pfil_run_hooks(&inet_pfil_hook, mp,
+			    encif, dir, NULL);
+
+			if (*mp == NULL || error != 0)
+				break;
+
+			/* restore byte ordering */
+			ip = mtod(*mp, struct ip *);
+			ip->ip_len = htons(ip->ip_len);
+			ip->ip_off = htons(ip->ip_off);
+			break;
+
+#ifdef INET6
+		case 6:
+			error = pfil_run_hooks(&inet6_pfil_hook, mp,
+			    encif, dir, NULL);
+			break;
+#endif
+		default:
+			printf("%s: unknown IP version\n", __func__);
+	}
+
+	mtx_unlock(&enc_mtx);
+	if (*mp == NULL)
+		return (error);
+	if (error != 0)
+		goto bad;
+
+	return (error);
+
+bad:
+	mtx_unlock(&enc_mtx);
+	m_freem(*mp);
+	*mp = NULL;
+	return (error);
+}
+
+void
+ipsec_bpf(struct mbuf *m, struct secasvar *sav, int af)
+{
+	int flags;
+	struct enchdr hdr;
+	struct mbuf m1;
+
+	KASSERT(sav != NULL, ("%s: sav is null", __func__));
+
+	mtx_lock(&enc_mtx);
+	if (encif == NULL || (encif->if_drv_flags & IFF_DRV_RUNNING) == 0) {
+		mtx_unlock(&enc_mtx);
+		return;
+	}
+
+	if (encif->if_bpf) {
+		flags = 0;
+		if (sav->alg_enc != SADB_EALG_NONE)
+			flags |= M_CONF;
+		if (sav->alg_auth != SADB_AALG_NONE)
+			flags |= M_AUTH;
+
+		/*
+		 * We need to prepend the address family as a four byte
+		 * field.  Cons up a dummy header to pacify bpf.  This
+		 * is safe because bpf will only read from the mbuf
+		 * (i.e., it won't try to free it or keep a pointer a
+		 * to it).
+		 */
+		hdr.af = af;
+		hdr.spi = sav->spi;
+		hdr.flags = flags;
+
+		m1.m_flags = 0;
+		m1.m_next = m;
+		m1.m_len = ENC_HDRLEN;
+		m1.m_data = (char *) &hdr;
+
+		bpf_mtap(encif->if_bpf, &m1);
+	}
+	mtx_unlock(&enc_mtx);
+}

Property changes on: head/sys/net/if_enc.c
___________________________________________________________________
Added: svn:keywords
## -0,0 +1 ##
+FreeBSD=%H
\ No newline at end of property
Index: head/sys/net/if_types.h
===================================================================
--- head/sys/net/if_types.h	(revision 159964)
+++ head/sys/net/if_types.h	(revision 159965)
@@ -1,253 +1,254 @@
 /*-
  * Copyright (c) 1989, 1993, 1994
  *	The Regents of the University of California.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  * 4. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
  *	@(#)if_types.h	8.3 (Berkeley) 4/28/95
  * $FreeBSD$
  * $NetBSD: if_types.h,v 1.16 2000/04/19 06:30:53 itojun Exp $
  */
 
 #ifndef _NET_IF_TYPES_H_
 #define _NET_IF_TYPES_H_
 
 /*
  * Interface types for benefit of parsing media address headers.
  * This list is derived from the SNMP list of ifTypes, originally
  * documented in RFC1573, now maintained as:
  *
  * 	http://www.iana.org/assignments/smi-numbers
  */
 
 #define	IFT_OTHER	0x1		/* none of the following */
 #define	IFT_1822	0x2		/* old-style arpanet imp */
 #define	IFT_HDH1822	0x3		/* HDH arpanet imp */
 #define	IFT_X25DDN	0x4		/* x25 to imp */
 #define	IFT_X25		0x5		/* PDN X25 interface (RFC877) */
 #define	IFT_ETHER	0x6		/* Ethernet CSMA/CD */
 #define	IFT_ISO88023	0x7		/* CMSA/CD */
 #define	IFT_ISO88024	0x8		/* Token Bus */
 #define	IFT_ISO88025	0x9		/* Token Ring */
 #define	IFT_ISO88026	0xa		/* MAN */
 #define	IFT_STARLAN	0xb
 #define	IFT_P10		0xc		/* Proteon 10MBit ring */
 #define	IFT_P80		0xd		/* Proteon 80MBit ring */
 #define	IFT_HY		0xe		/* Hyperchannel */
 #define	IFT_FDDI	0xf
 #define	IFT_LAPB	0x10
 #define	IFT_SDLC	0x11
 #define	IFT_T1		0x12
 #define	IFT_CEPT	0x13		/* E1 - european T1 */
 #define	IFT_ISDNBASIC	0x14
 #define	IFT_ISDNPRIMARY	0x15
 #define	IFT_PTPSERIAL	0x16		/* Proprietary PTP serial */
 #define	IFT_PPP		0x17		/* RFC 1331 */
 #define	IFT_LOOP	0x18		/* loopback */
 #define	IFT_EON		0x19		/* ISO over IP */
 #define	IFT_XETHER	0x1a		/* obsolete 3MB experimental ethernet */
 #define	IFT_NSIP	0x1b		/* XNS over IP */
 #define	IFT_SLIP	0x1c		/* IP over generic TTY */
 #define	IFT_ULTRA	0x1d		/* Ultra Technologies */
 #define	IFT_DS3		0x1e		/* Generic T3 */
 #define	IFT_SIP		0x1f		/* SMDS */
 #define	IFT_FRELAY	0x20		/* Frame Relay DTE only */
 #define	IFT_RS232	0x21
 #define	IFT_PARA	0x22		/* parallel-port */
 #define	IFT_ARCNET	0x23
 #define	IFT_ARCNETPLUS	0x24
 #define	IFT_ATM		0x25		/* ATM cells */
 #define	IFT_MIOX25	0x26
 #define	IFT_SONET	0x27		/* SONET or SDH */
 #define	IFT_X25PLE	0x28
 #define	IFT_ISO88022LLC	0x29
 #define	IFT_LOCALTALK	0x2a
 #define	IFT_SMDSDXI	0x2b
 #define	IFT_FRELAYDCE	0x2c		/* Frame Relay DCE */
 #define	IFT_V35		0x2d
 #define	IFT_HSSI	0x2e
 #define	IFT_HIPPI	0x2f
 #define	IFT_MODEM	0x30		/* Generic Modem */
 #define	IFT_AAL5	0x31		/* AAL5 over ATM */
 #define	IFT_SONETPATH	0x32
 #define	IFT_SONETVT	0x33
 #define	IFT_SMDSICIP	0x34		/* SMDS InterCarrier Interface */
 #define	IFT_PROPVIRTUAL	0x35		/* Proprietary Virtual/internal */
 #define	IFT_PROPMUX	0x36		/* Proprietary Multiplexing */
 #define	IFT_IEEE80212		   0x37 /* 100BaseVG */
 #define	IFT_FIBRECHANNEL	   0x38 /* Fibre Channel */
 #define	IFT_HIPPIINTERFACE	   0x39 /* HIPPI interfaces	 */
 #define	IFT_FRAMERELAYINTERCONNECT 0x3a /* Obsolete, use either 0x20 or 0x2c */
 #define	IFT_AFLANE8023		   0x3b /* ATM Emulated LAN for 802.3 */
 #define	IFT_AFLANE8025		   0x3c /* ATM Emulated LAN for 802.5 */
 #define	IFT_CCTEMUL		   0x3d /* ATM Emulated circuit		  */
 #define	IFT_FASTETHER		   0x3e /* Fast Ethernet (100BaseT) */
 #define	IFT_ISDN		   0x3f /* ISDN and X.25	    */
 #define	IFT_V11			   0x40 /* CCITT V.11/X.21		*/
 #define	IFT_V36			   0x41 /* CCITT V.36			*/
 #define	IFT_G703AT64K		   0x42 /* CCITT G703 at 64Kbps */
 #define	IFT_G703AT2MB		   0x43 /* Obsolete see DS1-MIB */
 #define	IFT_QLLC		   0x44 /* SNA QLLC			*/
 #define	IFT_FASTETHERFX		   0x45 /* Fast Ethernet (100BaseFX)	*/
 #define	IFT_CHANNEL		   0x46 /* channel			*/
 #define	IFT_IEEE80211		   0x47 /* radio spread spectrum	*/
 #define	IFT_IBM370PARCHAN	   0x48 /* IBM System 360/370 OEMI Channel */
 #define	IFT_ESCON		   0x49 /* IBM Enterprise Systems Connection */
 #define	IFT_DLSW		   0x4a /* Data Link Switching */
 #define	IFT_ISDNS		   0x4b /* ISDN S/T interface */
 #define	IFT_ISDNU		   0x4c /* ISDN U interface */
 #define	IFT_LAPD		   0x4d /* Link Access Protocol D */
 #define	IFT_IPSWITCH		   0x4e /* IP Switching Objects */
 #define	IFT_RSRB		   0x4f /* Remote Source Route Bridging */
 #define	IFT_ATMLOGICAL		   0x50 /* ATM Logical Port */
 #define	IFT_DS0			   0x51 /* Digital Signal Level 0 */
 #define	IFT_DS0BUNDLE		   0x52 /* group of ds0s on the same ds1 */
 #define	IFT_BSC			   0x53 /* Bisynchronous Protocol */
 #define	IFT_ASYNC		   0x54 /* Asynchronous Protocol */
 #define	IFT_CNR			   0x55 /* Combat Net Radio */
 #define	IFT_ISO88025DTR		   0x56 /* ISO 802.5r DTR */
 #define	IFT_EPLRS		   0x57 /* Ext Pos Loc Report Sys */
 #define	IFT_ARAP		   0x58 /* Appletalk Remote Access Protocol */
 #define	IFT_PROPCNLS		   0x59 /* Proprietary Connectionless Protocol*/
 #define	IFT_HOSTPAD		   0x5a /* CCITT-ITU X.29 PAD Protocol */
 #define	IFT_TERMPAD		   0x5b /* CCITT-ITU X.3 PAD Facility */
 #define	IFT_FRAMERELAYMPI	   0x5c /* Multiproto Interconnect over FR */
 #define	IFT_X213		   0x5d /* CCITT-ITU X213 */
 #define	IFT_ADSL		   0x5e /* Asymmetric Digital Subscriber Loop */
 #define	IFT_RADSL		   0x5f /* Rate-Adapt. Digital Subscriber Loop*/
 #define	IFT_SDSL		   0x60 /* Symmetric Digital Subscriber Loop */
 #define	IFT_VDSL		   0x61 /* Very H-Speed Digital Subscrib. Loop*/
 #define	IFT_ISO88025CRFPINT	   0x62 /* ISO 802.5 CRFP */
 #define	IFT_MYRINET		   0x63 /* Myricom Myrinet */
 #define	IFT_VOICEEM		   0x64 /* voice recEive and transMit */
 #define	IFT_VOICEFXO		   0x65 /* voice Foreign Exchange Office */
 #define	IFT_VOICEFXS		   0x66 /* voice Foreign Exchange Station */
 #define	IFT_VOICEENCAP		   0x67 /* voice encapsulation */
 #define	IFT_VOICEOVERIP		   0x68 /* voice over IP encapsulation */
 #define	IFT_ATMDXI		   0x69 /* ATM DXI */
 #define	IFT_ATMFUNI		   0x6a /* ATM FUNI */
 #define	IFT_ATMIMA		   0x6b /* ATM IMA		      */
 #define	IFT_PPPMULTILINKBUNDLE	   0x6c /* PPP Multilink Bundle */
 #define	IFT_IPOVERCDLC		   0x6d /* IBM ipOverCdlc */
 #define	IFT_IPOVERCLAW		   0x6e /* IBM Common Link Access to Workstn */
 #define	IFT_STACKTOSTACK	   0x6f /* IBM stackToStack */
 #define	IFT_VIRTUALIPADDRESS	   0x70 /* IBM VIPA */
 #define	IFT_MPC			   0x71 /* IBM multi-protocol channel support */
 #define	IFT_IPOVERATM		   0x72 /* IBM ipOverAtm */
 #define	IFT_ISO88025FIBER	   0x73 /* ISO 802.5j Fiber Token Ring */
 #define	IFT_TDLC		   0x74 /* IBM twinaxial data link control */
 #define	IFT_GIGABITETHERNET	   0x75 /* Gigabit Ethernet */
 #define	IFT_HDLC		   0x76 /* HDLC */
 #define	IFT_LAPF		   0x77 /* LAP F */
 #define	IFT_V37			   0x78 /* V.37 */
 #define	IFT_X25MLP		   0x79 /* Multi-Link Protocol */
 #define	IFT_X25HUNTGROUP	   0x7a /* X25 Hunt Group */
 #define	IFT_TRANSPHDLC		   0x7b /* Transp HDLC */
 #define	IFT_INTERLEAVE		   0x7c /* Interleave channel */
 #define	IFT_FAST		   0x7d /* Fast channel */
 #define	IFT_IP			   0x7e /* IP (for APPN HPR in IP networks) */
 #define	IFT_DOCSCABLEMACLAYER	   0x7f /* CATV Mac Layer */
 #define	IFT_DOCSCABLEDOWNSTREAM	   0x80 /* CATV Downstream interface */
 #define	IFT_DOCSCABLEUPSTREAM	   0x81 /* CATV Upstream interface */
 #define	IFT_A12MPPSWITCH	   0x82	/* Avalon Parallel Processor */
 #define	IFT_TUNNEL		   0x83	/* Encapsulation interface */
 #define	IFT_COFFEE		   0x84	/* coffee pot */
 #define	IFT_CES			   0x85	/* Circiut Emulation Service */
 #define	IFT_ATMSUBINTERFACE	   0x86	/* (x)  ATM Sub Interface */
 #define	IFT_L2VLAN		   0x87	/* Layer 2 Virtual LAN using 802.1Q */
 #define	IFT_L3IPVLAN		   0x88	/* Layer 3 Virtual LAN - IP Protocol */
 #define	IFT_L3IPXVLAN		   0x89	/* Layer 3 Virtual LAN - IPX Prot. */
 #define	IFT_DIGITALPOWERLINE	   0x8a	/* IP over Power Lines */
 #define	IFT_MEDIAMAILOVERIP	   0x8b	/* (xxx)  Multimedia Mail over IP */
 #define	IFT_DTM			   0x8c	/* Dynamic synchronous Transfer Mode */
 #define	IFT_DCN			   0x8d	/* Data Communications Network */
 #define	IFT_IPFORWARD		   0x8e	/* IP Forwarding Interface */
 #define	IFT_MSDSL		   0x8f	/* Multi-rate Symmetric DSL */
 #define	IFT_IEEE1394		   0x90	/* IEEE1394 High Performance SerialBus*/
 #define	IFT_IFGSN		   0x91	/* HIPPI-6400 */
 #define	IFT_DVBRCCMACLAYER	   0x92	/* DVB-RCC MAC Layer */
 #define	IFT_DVBRCCDOWNSTREAM	   0x93	/* DVB-RCC Downstream Channel */
 #define	IFT_DVBRCCUPSTREAM	   0x94	/* DVB-RCC Upstream Channel */
 #define	IFT_ATMVIRTUAL		   0x95	/* ATM Virtual Interface */
 #define	IFT_MPLSTUNNEL		   0x96	/* MPLS Tunnel Virtual Interface */
 #define	IFT_SRP			   0x97	/* Spatial Reuse Protocol */
 #define	IFT_VOICEOVERATM	   0x98	/* Voice over ATM */
 #define	IFT_VOICEOVERFRAMERELAY	   0x99	/* Voice Over Frame Relay */
 #define	IFT_IDSL		   0x9a	/* Digital Subscriber Loop over ISDN */
 #define	IFT_COMPOSITELINK	   0x9b	/* Avici Composite Link Interface */
 #define	IFT_SS7SIGLINK		   0x9c	/* SS7 Signaling Link */
 #define	IFT_PROPWIRELESSP2P	   0x9d	/* Prop. P2P wireless interface */
 #define	IFT_FRFORWARD		   0x9e	/* Frame forward Interface */
 #define	IFT_RFC1483		   0x9f	/* Multiprotocol over ATM AAL5 */
 #define	IFT_USB			   0xa0	/* USB Interface */
 #define	IFT_IEEE8023ADLAG	   0xa1	/* IEEE 802.3ad Link Aggregate*/
 #define	IFT_BGPPOLICYACCOUNTING	   0xa2	/* BGP Policy Accounting */
 #define	IFT_FRF16MFRBUNDLE	   0xa3	/* FRF.16 Multilik Frame Relay*/
 #define	IFT_H323GATEKEEPER	   0xa4	/* H323 Gatekeeper */
 #define	IFT_H323PROXY		   0xa5	/* H323 Voice and Video Proxy */
 #define	IFT_MPLS		   0xa6	/* MPLS */
 #define	IFT_MFSIGLINK		   0xa7	/* Multi-frequency signaling link */
 #define	IFT_HDSL2		   0xa8	/* High Bit-Rate DSL, 2nd gen. */
 #define	IFT_SHDSL		   0xa9	/* Multirate HDSL2 */
 #define	IFT_DS1FDL		   0xaa	/* Facility Data Link (4Kbps) on a DS1*/
 #define	IFT_POS			   0xab	/* Packet over SONET/SDH Interface */
 #define	IFT_DVBASILN		   0xac	/* DVB-ASI Input */
 #define	IFT_DVBASIOUT		   0xad	/* DVB-ASI Output */
 #define	IFT_PLC			   0xae	/* Power Line Communications */
 #define	IFT_NFAS		   0xaf	/* Non-Facility Associated Signaling */
 #define	IFT_TR008		   0xb0	/* TROO8 */
 #define	IFT_GR303RDT		   0xb1	/* Remote Digital Terminal */
 #define	IFT_GR303IDT		   0xb2	/* Integrated Digital Terminal */
 #define	IFT_ISUP		   0xb3	/* ISUP */
 #define	IFT_PROPDOCSWIRELESSMACLAYER	   0xb4	/* prop/Wireless MAC Layer */
 #define	IFT_PROPDOCSWIRELESSDOWNSTREAM	   0xb5	/* prop/Wireless Downstream */
 #define	IFT_PROPDOCSWIRELESSUPSTREAM	   0xb6	/* prop/Wireless Upstream */
 #define	IFT_HIPERLAN2		   0xb7	/* HIPERLAN Type 2 Radio Interface */
 #define	IFT_PROPBWAP2MP		   0xb8	/* PropBroadbandWirelessAccess P2MP*/
 #define	IFT_SONETOVERHEADCHANNEL   0xb9	/* SONET Overhead Channel */
 #define	IFT_DIGITALWRAPPEROVERHEADCHANNEL  0xba	/* Digital Wrapper Overhead */
 #define	IFT_AAL2		   0xbb	/* ATM adaptation layer 2 */
 #define	IFT_RADIOMAC		   0xbc	/* MAC layer over radio links */
 #define	IFT_ATMRADIO		   0xbd	/* ATM over radio links */
 #define	IFT_IMT			   0xbe /* Inter-Machine Trunks */
 #define	IFT_MVL			   0xbf /* Multiple Virtual Lines DSL */
 #define	IFT_REACHDSL		   0xc0 /* Long Reach DSL */
 #define	IFT_FRDLCIENDPT		   0xc1 /* Frame Relay DLCI End Point */
 #define	IFT_ATMVCIENDPT		   0xc2 /* ATM VCI End Point */
 #define	IFT_OPTICALCHANNEL	   0xc3 /* Optical Channel */
 #define	IFT_OPTICALTRANSPORT	   0xc4 /* Optical Transport */
 #define	IFT_BRIDGE		   0xd1 /* Transparent bridge interface */
 
 #define	IFT_STF			   0xd7	/* 6to4 interface */
 
 /* not based on IANA assignments */
 #define	IFT_GIF		0xf0
 #define	IFT_PVC		0xf1
 #define	IFT_FAITH	0xf2
+#define	IFT_ENC		0xf4
 #define	IFT_PFLOG	0xf6
 #define	IFT_PFSYNC	0xf7
 #define	IFT_CARP	0xf8	/* Common Address Redundancy Protocol */
 #define IFT_IPXIP	0xf9
 #endif /* !_NET_IF_TYPES_H_ */
Index: head/sys/netipsec/ipsec.h
===================================================================
--- head/sys/netipsec/ipsec.h	(revision 159964)
+++ head/sys/netipsec/ipsec.h	(revision 159965)
@@ -1,430 +1,432 @@
 /*	$FreeBSD$	*/
 /*	$KAME: ipsec.h,v 1.53 2001/11/20 08:32:38 itojun Exp $	*/
 
 /*-
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  * 3. Neither the name of the project nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
  *
  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
 
 /*
  * IPsec controller part.
  */
 
 #ifndef _NETIPSEC_IPSEC_H_
 #define _NETIPSEC_IPSEC_H_
 
 #if defined(_KERNEL) && !defined(_LKM) && !defined(KLD_MODULE)
 #include "opt_inet.h"
 #include "opt_ipsec.h"
 #endif
 
 #include <net/pfkeyv2.h>
 #include <netipsec/keydb.h>
 #include <netipsec/ipsec_osdep.h>
 
 #ifdef _KERNEL
 
 /*
  * Security Policy Index
  * Ensure that both address families in the "src" and "dst" are same.
  * When the value of the ul_proto is ICMPv6, the port field in "src"
  * specifies ICMPv6 type, and the port field in "dst" specifies ICMPv6 code.
  */
 struct secpolicyindex {
 	u_int8_t dir;			/* direction of packet flow, see blow */
 	union sockaddr_union src;	/* IP src address for SP */
 	union sockaddr_union dst;	/* IP dst address for SP */
 	u_int8_t prefs;			/* prefix length in bits for src */
 	u_int8_t prefd;			/* prefix length in bits for dst */
 	u_int16_t ul_proto;		/* upper layer Protocol */
 #ifdef notyet
 	uid_t uids;
 	uid_t uidd;
 	gid_t gids;
 	gid_t gidd;
 #endif
 };
 
 /* Security Policy Data Base */
 struct secpolicy {
 	LIST_ENTRY(secpolicy) chain;
 	struct mtx lock;
 
 	u_int refcnt;			/* reference count */
 	struct secpolicyindex spidx;	/* selector */
 	u_int32_t id;			/* It's unique number on the system. */
 	u_int state;			/* 0: dead, others: alive */
 #define IPSEC_SPSTATE_DEAD	0
 #define IPSEC_SPSTATE_ALIVE	1
 	u_int16_t policy;		/* policy_type per pfkeyv2.h */
 	u_int16_t scangen;		/* scan generation # */
 	struct ipsecrequest *req;
 				/* pointer to the ipsec request tree, */
 				/* if policy == IPSEC else this value == NULL.*/
 
 	/*
 	 * lifetime handler.
 	 * the policy can be used without limitiation if both lifetime and
 	 * validtime are zero.
 	 * "lifetime" is passed by sadb_lifetime.sadb_lifetime_addtime.
 	 * "validtime" is passed by sadb_lifetime.sadb_lifetime_usetime.
 	 */
 	time_t created;		/* time created the policy */
 	time_t lastused;	/* updated every when kernel sends a packet */
 	long lifetime;		/* duration of the lifetime of this policy */
 	long validtime;		/* duration this policy is valid without use */
 };
 
 #define	SECPOLICY_LOCK_INIT(_sp) \
 	mtx_init(&(_sp)->lock, "ipsec policy", NULL, MTX_DEF)
 #define	SECPOLICY_LOCK(_sp)		mtx_lock(&(_sp)->lock)
 #define	SECPOLICY_UNLOCK(_sp)		mtx_unlock(&(_sp)->lock)
 #define	SECPOLICY_LOCK_DESTROY(_sp)	mtx_destroy(&(_sp)->lock)
 #define	SECPOLICY_LOCK_ASSERT(_sp)	mtx_assert(&(_sp)->lock, MA_OWNED)
 
 /* Request for IPsec */
 struct ipsecrequest {
 	struct ipsecrequest *next;
 				/* pointer to next structure */
 				/* If NULL, it means the end of chain. */
 	struct secasindex saidx;/* hint for search proper SA */
 				/* if __ss_len == 0 then no address specified.*/
 	u_int level;		/* IPsec level defined below. */
 
 	struct secasvar *sav;	/* place holder of SA for use */
 	struct secpolicy *sp;	/* back pointer to SP */
 	struct mtx lock;	/* to interlock updates */
 };
 
 /*
  * Need recursion for when crypto callbacks happen directly,
  * as in the case of software crypto.  Need to look at how
  * hard it is to remove this...
  */
 #define	IPSECREQUEST_LOCK_INIT(_isr) \
 	mtx_init(&(_isr)->lock, "ipsec request", NULL, MTX_DEF | MTX_RECURSE)
 #define	IPSECREQUEST_LOCK(_isr)		mtx_lock(&(_isr)->lock)
 #define	IPSECREQUEST_UNLOCK(_isr)	mtx_unlock(&(_isr)->lock)
 #define	IPSECREQUEST_LOCK_DESTROY(_isr)	mtx_destroy(&(_isr)->lock)
 #define	IPSECREQUEST_LOCK_ASSERT(_isr)	mtx_assert(&(_isr)->lock, MA_OWNED)
 
 /* security policy in PCB */
 struct inpcbpolicy {
 	struct secpolicy *sp_in;
 	struct secpolicy *sp_out;
 	int priv;			/* privileged socket ? */
 };
 
 /* SP acquiring list table. */
 struct secspacq {
 	LIST_ENTRY(secspacq) chain;
 
 	struct secpolicyindex spidx;
 
 	time_t created;		/* for lifetime */
 	int count;		/* for lifetime */
 	/* XXX: here is mbuf place holder to be sent ? */
 };
 #endif /* _KERNEL */
 
 /* according to IANA assignment, port 0x0000 and proto 0xff are reserved. */
 #define IPSEC_PORT_ANY		0
 #define IPSEC_ULPROTO_ANY	255
 #define IPSEC_PROTO_ANY		255
 
 /* mode of security protocol */
 /* NOTE: DON'T use IPSEC_MODE_ANY at SPD.  It's only use in SAD */
 #define	IPSEC_MODE_ANY		0	/* i.e. wildcard. */
 #define	IPSEC_MODE_TRANSPORT	1
 #define	IPSEC_MODE_TUNNEL	2
 #define	IPSEC_MODE_TCPMD5	3	/* TCP MD5 mode */
 
 /*
  * Direction of security policy.
  * NOTE: Since INVALID is used just as flag.
  * The other are used for loop counter too.
  */
 #define IPSEC_DIR_ANY		0
 #define IPSEC_DIR_INBOUND	1
 #define IPSEC_DIR_OUTBOUND	2
 #define IPSEC_DIR_MAX		3
 #define IPSEC_DIR_INVALID	4
 
 /* Policy level */
 /*
  * IPSEC, ENTRUST and BYPASS are allowed for setsockopt() in PCB,
  * DISCARD, IPSEC and NONE are allowed for setkey() in SPD.
  * DISCARD and NONE are allowed for system default.
  */
 #define IPSEC_POLICY_DISCARD	0	/* discarding packet */
 #define IPSEC_POLICY_NONE	1	/* through IPsec engine */
 #define IPSEC_POLICY_IPSEC	2	/* do IPsec */
 #define IPSEC_POLICY_ENTRUST	3	/* consulting SPD if present. */
 #define IPSEC_POLICY_BYPASS	4	/* only for privileged socket. */
 
 /* Security protocol level */
 #define	IPSEC_LEVEL_DEFAULT	0	/* reference to system default */
 #define	IPSEC_LEVEL_USE		1	/* use SA if present. */
 #define	IPSEC_LEVEL_REQUIRE	2	/* require SA. */
 #define	IPSEC_LEVEL_UNIQUE	3	/* unique SA. */
 
 #define IPSEC_MANUAL_REQID_MAX	0x3fff
 				/*
 				 * if security policy level == unique, this id
 				 * indicate to a relative SA for use, else is
 				 * zero.
 				 * 1 - 0x3fff are reserved for manual keying.
 				 * 0 are reserved for above reason.  Others is
 				 * for kernel use.
 				 * Note that this id doesn't identify SA
 				 * by only itself.
 				 */
 #define IPSEC_REPLAYWSIZE  32
 
 /* old statistics for ipsec processing */
 struct ipsecstat {
 	u_quad_t in_success;  /* succeeded inbound process */
 	u_quad_t in_polvio;
 			/* security policy violation for inbound process */
 	u_quad_t in_nosa;     /* inbound SA is unavailable */
 	u_quad_t in_inval;    /* inbound processing failed due to EINVAL */
 	u_quad_t in_nomem;    /* inbound processing failed due to ENOBUFS */
 	u_quad_t in_badspi;   /* failed getting a SPI */
 	u_quad_t in_ahreplay; /* AH replay check failed */
 	u_quad_t in_espreplay; /* ESP replay check failed */
 	u_quad_t in_ahauthsucc; /* AH authentication success */
 	u_quad_t in_ahauthfail; /* AH authentication failure */
 	u_quad_t in_espauthsucc; /* ESP authentication success */
 	u_quad_t in_espauthfail; /* ESP authentication failure */
 	u_quad_t in_esphist[256];
 	u_quad_t in_ahhist[256];
 	u_quad_t in_comphist[256];
 	u_quad_t out_success; /* succeeded outbound process */
 	u_quad_t out_polvio;
 			/* security policy violation for outbound process */
 	u_quad_t out_nosa;    /* outbound SA is unavailable */
 	u_quad_t out_inval;   /* outbound process failed due to EINVAL */
 	u_quad_t out_nomem;    /* inbound processing failed due to ENOBUFS */
 	u_quad_t out_noroute; /* there is no route */
 	u_quad_t out_esphist[256];
 	u_quad_t out_ahhist[256];
 	u_quad_t out_comphist[256];
 
 	u_quad_t spdcachelookup;
 	u_quad_t spdcachemiss;
 };
 
 /* statistics for ipsec processing */
 struct newipsecstat {
 	u_int32_t ips_in_polvio;	/* input: sec policy violation */
 	u_int32_t ips_out_polvio;	/* output: sec policy violation */
 	u_int32_t ips_out_nosa;		/* output: SA unavailable  */
 	u_int32_t ips_out_nomem;	/* output: no memory available */
 	u_int32_t ips_out_noroute;	/* output: no route available */
 	u_int32_t ips_out_inval;	/* output: generic error */
 	u_int32_t ips_out_bundlesa;	/* output: bundled SA processed */
 	u_int32_t ips_mbcoalesced;	/* mbufs coalesced during clone */
 	u_int32_t ips_clcoalesced;	/* clusters coalesced during clone */
 	u_int32_t ips_clcopied;		/* clusters copied during clone */
 	u_int32_t ips_mbinserted;	/* mbufs inserted during makespace */
 	/* 
 	 * Temporary statistics for performance analysis.
 	 */
 	/* See where ESP/AH/IPCOMP header land in mbuf on input */
 	u_int32_t ips_input_front;
 	u_int32_t ips_input_middle;
 	u_int32_t ips_input_end;
 };
 
 /*
  * Definitions for IPsec & Key sysctl operations.
  */
 /*
  * Names for IPsec & Key sysctl objects
  */
 #define IPSECCTL_STATS			1	/* stats */
 #define IPSECCTL_DEF_POLICY		2
 #define IPSECCTL_DEF_ESP_TRANSLEV	3	/* int; ESP transport mode */
 #define IPSECCTL_DEF_ESP_NETLEV		4	/* int; ESP tunnel mode */
 #define IPSECCTL_DEF_AH_TRANSLEV	5	/* int; AH transport mode */
 #define IPSECCTL_DEF_AH_NETLEV		6	/* int; AH tunnel mode */
 #if 0	/* obsolete, do not reuse */
 #define IPSECCTL_INBOUND_CALL_IKE	7
 #endif
 #define	IPSECCTL_AH_CLEARTOS		8
 #define	IPSECCTL_AH_OFFSETMASK		9
 #define	IPSECCTL_DFBIT			10
 #define	IPSECCTL_ECN			11
 #define	IPSECCTL_DEBUG			12
 #define	IPSECCTL_ESP_RANDPAD		13
 #define IPSECCTL_MAXID			14
 
 #define IPSECCTL_NAMES { \
 	{ 0, 0 }, \
 	{ 0, 0 }, \
 	{ "def_policy", CTLTYPE_INT }, \
 	{ "esp_trans_deflev", CTLTYPE_INT }, \
 	{ "esp_net_deflev", CTLTYPE_INT }, \
 	{ "ah_trans_deflev", CTLTYPE_INT }, \
 	{ "ah_net_deflev", CTLTYPE_INT }, \
 	{ 0, 0 }, \
 	{ "ah_cleartos", CTLTYPE_INT }, \
 	{ "ah_offsetmask", CTLTYPE_INT }, \
 	{ "dfbit", CTLTYPE_INT }, \
 	{ "ecn", CTLTYPE_INT }, \
 	{ "debug", CTLTYPE_INT }, \
 	{ "esp_randpad", CTLTYPE_INT }, \
 }
 
 #define IPSEC6CTL_NAMES { \
 	{ 0, 0 }, \
 	{ 0, 0 }, \
 	{ "def_policy", CTLTYPE_INT }, \
 	{ "esp_trans_deflev", CTLTYPE_INT }, \
 	{ "esp_net_deflev", CTLTYPE_INT }, \
 	{ "ah_trans_deflev", CTLTYPE_INT }, \
 	{ "ah_net_deflev", CTLTYPE_INT }, \
 	{ 0, 0 }, \
 	{ 0, 0 }, \
 	{ 0, 0 }, \
 	{ 0, 0 }, \
 	{ "ecn", CTLTYPE_INT }, \
 	{ "debug", CTLTYPE_INT }, \
 	{ "esp_randpad", CTLTYPE_INT }, \
 }
 
 #ifdef _KERNEL
 struct ipsec_output_state {
 	struct mbuf *m;
 	struct route *ro;
 	struct sockaddr *dst;
 };
 
 struct ipsec_history {
 	int ih_proto;
 	u_int32_t ih_spi;
 };
 
 extern int ipsec_debug;
 #ifdef REGRESSION
 extern int ipsec_replay;
 extern int ipsec_integrity;
 #endif
 
 extern struct newipsecstat newipsecstat;
 extern struct secpolicy ip4_def_policy;
 extern int ip4_esp_trans_deflev;
 extern int ip4_esp_net_deflev;
 extern int ip4_ah_trans_deflev;
 extern int ip4_ah_net_deflev;
 extern int ip4_ah_cleartos;
 extern int ip4_ah_offsetmask;
 extern int ip4_ipsec_dfbit;
 extern int ip4_ipsec_ecn;
 extern int ip4_esp_randpad;
 extern int crypto_support;
 
 #define ipseclog(x)	do { if (ipsec_debug) log x; } while (0)
 /* for openbsd compatibility */
 #define	DPRINTF(x)	do { if (ipsec_debug) printf x; } while (0)
 
 /* XXX for KAME code compatibility */
 #define ipsec_pcbconn(_x)
 #define	ipsec_pcbdisconn(_x)
 
 extern	struct ipsecrequest *ipsec_newisr(void);
 extern	void ipsec_delisr(struct ipsecrequest *);
 
 struct tdb_ident;
 extern struct secpolicy *ipsec_getpolicy __P((struct tdb_ident*, u_int));
 struct inpcb;
 extern struct secpolicy *ipsec4_checkpolicy __P((struct mbuf *, u_int, u_int,
 	int *, struct inpcb *));
 extern struct secpolicy *ipsec_getpolicybysock(struct mbuf *, u_int,
 	struct inpcb *, int *);
 extern struct secpolicy * ipsec_getpolicybyaddr(struct mbuf *, u_int,
 	int, int *);
 
 struct inpcb;
 extern int ipsec_init_policy __P((struct socket *so, struct inpcbpolicy **));
 extern int ipsec_copy_policy
 	__P((struct inpcbpolicy *, struct inpcbpolicy *));
 extern u_int ipsec_get_reqlevel __P((struct ipsecrequest *));
 extern int ipsec_in_reject __P((struct secpolicy *, struct mbuf *));
 
 extern int ipsec4_set_policy __P((struct inpcb *inp, int optname,
 	caddr_t request, size_t len, int priv));
 extern int ipsec4_get_policy __P((struct inpcb *inpcb, caddr_t request,
 	size_t len, struct mbuf **mp));
 extern int ipsec4_delete_pcbpolicy __P((struct inpcb *));
 extern int ipsec4_in_reject __P((struct mbuf *, struct inpcb *));
 
 struct secas;
 struct tcpcb;
 extern int ipsec_chkreplay __P((u_int32_t, struct secasvar *));
 extern int ipsec_updatereplay __P((u_int32_t, struct secasvar *));
 
 extern size_t ipsec4_hdrsiz __P((struct mbuf *, u_int, struct inpcb *));
 extern size_t ipsec_hdrsiz_tcp __P((struct tcpcb *));
 
 union sockaddr_union;
 extern char * ipsec_address(union sockaddr_union* sa);
 extern const char *ipsec_logsastr __P((struct secasvar *));
 
 extern void ipsec_dumpmbuf __P((struct mbuf *));
 
 struct m_tag;
 extern void ah4_input(struct mbuf *m, int off);
 extern void ah4_ctlinput(int cmd, struct sockaddr *sa, void *);
 extern void esp4_input(struct mbuf *m, int off);
 extern void esp4_ctlinput(int cmd, struct sockaddr *sa, void *);
 extern void ipcomp4_input(struct mbuf *m, int off);
 extern int ipsec4_common_input(struct mbuf *m, ...);
 extern int ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav,
 			int skip, int protoff, struct m_tag *mt);
 extern int ipsec4_process_packet __P((struct mbuf *, struct ipsecrequest *,
 			int, int));
 extern int ipsec_process_done __P((struct mbuf *, struct ipsecrequest *));
 
 extern struct mbuf *ipsec_copypkt __P((struct mbuf *));
 
 extern	void m_checkalignment(const char* where, struct mbuf *m0,
 		int off, int len);
 extern	struct mbuf *m_makespace(struct mbuf *m0, int skip, int hlen, int *off);
 extern	caddr_t m_pad(struct mbuf *m, int n);
 extern	int m_striphdr(struct mbuf *m, int skip, int hlen);
+extern	int ipsec_filter(struct mbuf **, int);
+extern	void ipsec_bpf(struct mbuf *, struct secasvar *, int);
 #endif /* _KERNEL */
 
 #ifndef _KERNEL
 extern caddr_t ipsec_set_policy __P((char *, int));
 extern int ipsec_get_policylen __P((caddr_t));
 extern char *ipsec_dump_policy __P((caddr_t, char *));
 
 extern const char *ipsec_strerror __P((void));
 #endif /* !_KERNEL */
 
 #endif /* _NETIPSEC_IPSEC_H_ */
Index: head/sys/netipsec/ipsec_input.c
===================================================================
--- head/sys/netipsec/ipsec_input.c	(revision 159964)
+++ head/sys/netipsec/ipsec_input.c	(revision 159965)
@@ -1,810 +1,823 @@
 /*	$FreeBSD$	*/
 /*	$OpenBSD: ipsec_input.c,v 1.63 2003/02/20 18:35:43 deraadt Exp $	*/
 /*-
  * The authors of this code are John Ioannidis (ji@tla.org),
  * Angelos D. Keromytis (kermit@csd.uch.gr) and
  * Niels Provos (provos@physnet.uni-hamburg.de).
  *
  * This code was written by John Ioannidis for BSD/OS in Athens, Greece,
  * in November 1995.
  *
  * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
  * by Angelos D. Keromytis.
  *
  * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
  * and Niels Provos.
  *
  * Additional features in 1999 by Angelos D. Keromytis.
  *
  * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis,
  * Angelos D. Keromytis and Niels Provos.
  * Copyright (c) 2001, Angelos D. Keromytis.
  *
  * Permission to use, copy, and modify this software with or without fee
  * is hereby granted, provided that this entire notice is included in
  * all copies of any software which is or includes a copy or
  * modification of this software.
  * You may use this code under the GNU public license if you so wish. Please
  * contribute changes back to the authors under this freer than GPL license
  * so that we may further the use of strong encryption without limitations to
  * all.
  *
  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
  * PURPOSE.
  */
 
 /*
  * IPsec input processing.
  */
 
 #include "opt_inet.h"
 #include "opt_inet6.h"
 #include "opt_ipsec.h"
+#include "opt_enc.h"
 
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
 #include <sys/domain.h>
 #include <sys/protosw.h>
 #include <sys/socket.h>
 #include <sys/errno.h>
 #include <sys/syslog.h>
 
 #include <net/if.h>
 #include <net/route.h>
 #include <net/netisr.h>
 
 #include <netinet/in.h>
 #include <netinet/in_systm.h>
 #include <netinet/ip.h>
 #include <netinet/ip_var.h>
 #include <netinet/in_var.h>
 
 #include <netinet/ip6.h>
 #ifdef INET6
 #include <netinet6/ip6_var.h>
 #endif
 #include <netinet/in_pcb.h>
 #ifdef INET6
 #include <netinet/icmp6.h>
 #endif
 
 #include <netipsec/ipsec.h>
 #ifdef INET6
 #include <netipsec/ipsec6.h>
 #endif
 #include <netipsec/ah_var.h>
 #include <netipsec/esp.h>
 #include <netipsec/esp_var.h>
 #include <netipsec/ipcomp_var.h>
 
 #include <netipsec/key.h>
 #include <netipsec/keydb.h>
 
 #include <netipsec/xform.h>
 #include <netinet6/ip6protosw.h>
 
 #include <machine/in_cksum.h>
 #include <machine/stdarg.h>
 
 #define IPSEC_ISTAT(p,x,y,z) ((p) == IPPROTO_ESP ? (x)++ : \
 			    (p) == IPPROTO_AH ? (y)++ : (z)++)
 
 static void ipsec4_common_ctlinput(int, struct sockaddr *, void *, int);
 
 /*
  * ipsec_common_input gets called when an IPsec-protected packet
  * is received by IPv4 or IPv6.  It's job is to find the right SA
  # and call the appropriate transform.  The transform callback
  * takes care of further processing (like ingress filtering).
  */
 static int
 ipsec_common_input(struct mbuf *m, int skip, int protoff, int af, int sproto)
 {
 	union sockaddr_union dst_address;
 	struct secasvar *sav;
 	u_int32_t spi;
 	int error;
 
 	IPSEC_ISTAT(sproto, espstat.esps_input, ahstat.ahs_input,
 		ipcompstat.ipcomps_input);
 
 	IPSEC_ASSERT(m != NULL, ("null packet"));
 
 	if ((sproto == IPPROTO_ESP && !esp_enable) ||
 	    (sproto == IPPROTO_AH && !ah_enable) ||
 	    (sproto == IPPROTO_IPCOMP && !ipcomp_enable)) {
 		m_freem(m);
 		IPSEC_ISTAT(sproto, espstat.esps_pdrops, ahstat.ahs_pdrops,
 		    ipcompstat.ipcomps_pdrops);
 		return EOPNOTSUPP;
 	}
 
 	if (m->m_pkthdr.len - skip < 2 * sizeof (u_int32_t)) {
 		m_freem(m);
 		IPSEC_ISTAT(sproto, espstat.esps_hdrops, ahstat.ahs_hdrops,
 		    ipcompstat.ipcomps_hdrops);
 		DPRINTF(("%s: packet too small\n", __func__));
 		return EINVAL;
 	}
 
 	/* Retrieve the SPI from the relevant IPsec header */
 	if (sproto == IPPROTO_ESP)
 		m_copydata(m, skip, sizeof(u_int32_t), (caddr_t) &spi);
 	else if (sproto == IPPROTO_AH)
 		m_copydata(m, skip + sizeof(u_int32_t), sizeof(u_int32_t),
 		    (caddr_t) &spi);
 	else if (sproto == IPPROTO_IPCOMP) {
 		u_int16_t cpi;
 		m_copydata(m, skip + sizeof(u_int16_t), sizeof(u_int16_t),
 		    (caddr_t) &cpi);
 		spi = ntohl(htons(cpi));
 	}
 
 	/*
 	 * Find the SA and (indirectly) call the appropriate
 	 * kernel crypto routine. The resulting mbuf chain is a valid
 	 * IP packet ready to go through input processing.
 	 */
 	bzero(&dst_address, sizeof (dst_address));
 	dst_address.sa.sa_family = af;
 	switch (af) {
 #ifdef INET
 	case AF_INET:
 		dst_address.sin.sin_len = sizeof(struct sockaddr_in);
 		m_copydata(m, offsetof(struct ip, ip_dst),
 		    sizeof(struct in_addr),
 		    (caddr_t) &dst_address.sin.sin_addr);
 		break;
 #endif /* INET */
 #ifdef INET6
 	case AF_INET6:
 		dst_address.sin6.sin6_len = sizeof(struct sockaddr_in6);
 		m_copydata(m, offsetof(struct ip6_hdr, ip6_dst),
 		    sizeof(struct in6_addr),
 		    (caddr_t) &dst_address.sin6.sin6_addr);
 		break;
 #endif /* INET6 */
 	default:
 		DPRINTF(("%s: unsupported protocol family %u\n", __func__, af));
 		m_freem(m);
 		IPSEC_ISTAT(sproto, espstat.esps_nopf, ahstat.ahs_nopf,
 		    ipcompstat.ipcomps_nopf);
 		return EPFNOSUPPORT;
 	}
 
 	/* NB: only pass dst since key_allocsa follows RFC2401 */
 	sav = KEY_ALLOCSA(&dst_address, sproto, spi);
 	if (sav == NULL) {
 		DPRINTF(("%s: no key association found for SA %s/%08lx/%u\n",
 			  __func__, ipsec_address(&dst_address),
 			  (u_long) ntohl(spi), sproto));
 		IPSEC_ISTAT(sproto, espstat.esps_notdb, ahstat.ahs_notdb,
 		    ipcompstat.ipcomps_notdb);
 		m_freem(m);
 		return ENOENT;
 	}
 
 	if (sav->tdb_xform == NULL) {
 		DPRINTF(("%s: attempted to use uninitialized SA %s/%08lx/%u\n",
 			 __func__, ipsec_address(&dst_address),
 			 (u_long) ntohl(spi), sproto));
 		IPSEC_ISTAT(sproto, espstat.esps_noxform, ahstat.ahs_noxform,
 		    ipcompstat.ipcomps_noxform);
 		KEY_FREESAV(&sav);
 		m_freem(m);
 		return ENXIO;
 	}
 
 	/*
 	 * Call appropriate transform and return -- callback takes care of
 	 * everything else.
 	 */
 	error = (*sav->tdb_xform->xf_input)(m, sav, skip, protoff);
 	KEY_FREESAV(&sav);
 	return error;
 }
 
 #ifdef INET
 /*
  * Common input handler for IPv4 AH, ESP, and IPCOMP.
  */
 int
 ipsec4_common_input(struct mbuf *m, ...)
 {
 	va_list ap;
 	int off, nxt;
 
 	va_start(ap, m);
 	off = va_arg(ap, int);
 	nxt = va_arg(ap, int);
 	va_end(ap);
 
 	return ipsec_common_input(m, off, offsetof(struct ip, ip_p),
 				  AF_INET, nxt);
 }
 
 void
 ah4_input(struct mbuf *m, int off)
 {
 	ipsec4_common_input(m, off, IPPROTO_AH);
 }
 void
 ah4_ctlinput(int cmd, struct sockaddr *sa, void *v)
 {
 	if (sa->sa_family == AF_INET &&
 	    sa->sa_len == sizeof(struct sockaddr_in))
 		ipsec4_common_ctlinput(cmd, sa, v, IPPROTO_AH);
 }
 
 void
 esp4_input(struct mbuf *m, int off)
 {
 	ipsec4_common_input(m, off, IPPROTO_ESP);
 }
 void
 esp4_ctlinput(int cmd, struct sockaddr *sa, void *v)
 {
 	if (sa->sa_family == AF_INET &&
 	    sa->sa_len == sizeof(struct sockaddr_in))
 		ipsec4_common_ctlinput(cmd, sa, v, IPPROTO_ESP);
 }
 
 void
 ipcomp4_input(struct mbuf *m, int off)
 {
 	ipsec4_common_input(m, off, IPPROTO_IPCOMP);
 }
 
 /*
  * IPsec input callback for INET protocols.
  * This routine is called as the transform callback.
  * Takes care of filtering and other sanity checks on
  * the processed packet.
  */
 int
 ipsec4_common_input_cb(struct mbuf *m, struct secasvar *sav,
 			int skip, int protoff, struct m_tag *mt)
 {
 	int prot, af, sproto;
 	struct ip *ip;
 	struct m_tag *mtag;
 	struct tdb_ident *tdbi;
 	struct secasindex *saidx;
 	int error;
 
 	IPSEC_SPLASSERT_SOFTNET(__func__);
 
 	IPSEC_ASSERT(m != NULL, ("null mbuf"));
 	IPSEC_ASSERT(sav != NULL, ("null SA"));
 	IPSEC_ASSERT(sav->sah != NULL, ("null SAH"));
 	saidx = &sav->sah->saidx;
 	af = saidx->dst.sa.sa_family;
 	IPSEC_ASSERT(af == AF_INET, ("unexpected af %u", af));
 	sproto = saidx->proto;
 	IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH ||
 		sproto == IPPROTO_IPCOMP,
 		("unexpected security protocol %u", sproto));
 
 	/* Sanity check */
 	if (m == NULL) {
 		DPRINTF(("%s: null mbuf", __func__));
 		IPSEC_ISTAT(sproto, espstat.esps_badkcr, ahstat.ahs_badkcr,
 		    ipcompstat.ipcomps_badkcr);
 		KEY_FREESAV(&sav);
 		return EINVAL;
 	}
 
 	if (skip != 0) {
 		/* Fix IPv4 header */
 		if (m->m_len < skip && (m = m_pullup(m, skip)) == NULL) {
 			DPRINTF(("%s: processing failed for SA %s/%08lx\n",
 			    __func__, ipsec_address(&sav->sah->saidx.dst),
 			    (u_long) ntohl(sav->spi)));
 			IPSEC_ISTAT(sproto, espstat.esps_hdrops, ahstat.ahs_hdrops,
 			    ipcompstat.ipcomps_hdrops);
 			error = ENOBUFS;
 			goto bad;
 		}
 
 		ip = mtod(m, struct ip *);
 		ip->ip_len = htons(m->m_pkthdr.len);
 		ip->ip_off = htons(ip->ip_off);
 		ip->ip_sum = 0;
 		ip->ip_sum = in_cksum(m, ip->ip_hl << 2);
 	} else {
 		ip = mtod(m, struct ip *);
 	}
 	prot = ip->ip_p;
 
 #ifdef notyet
 	/* IP-in-IP encapsulation */
 	if (prot == IPPROTO_IPIP) {
 		struct ip ipn;
 
 		if (m->m_pkthdr.len - skip < sizeof(struct ip)) {
 			IPSEC_ISTAT(sproto, espstat.esps_hdrops,
 			    ahstat.ahs_hdrops,
 			    ipcompstat.ipcomps_hdrops);
 			error = EINVAL;
 			goto bad;
 		}
 		/* ipn will now contain the inner IPv4 header */
 		m_copydata(m, ip->ip_hl << 2, sizeof(struct ip),
 		    (caddr_t) &ipn);
 
 		/* XXX PROXY address isn't recorded in SAH */
 		/*
 		 * Check that the inner source address is the same as
 		 * the proxy address, if available.
 		 */
 		if ((saidx->proxy.sa.sa_family == AF_INET &&
 		    saidx->proxy.sin.sin_addr.s_addr !=
 		    INADDR_ANY &&
 		    ipn.ip_src.s_addr !=
 		    saidx->proxy.sin.sin_addr.s_addr) ||
 		    (saidx->proxy.sa.sa_family != AF_INET &&
 			saidx->proxy.sa.sa_family != 0)) {
 
 			DPRINTF(("%s: inner source address %s doesn't "
 			    "correspond to expected proxy source %s, "
 			    "SA %s/%08lx\n", __func__,
 			    inet_ntoa4(ipn.ip_src),
 			    ipsp_address(saidx->proxy),
 			    ipsp_address(saidx->dst),
 			    (u_long) ntohl(sav->spi)));
 
 			IPSEC_ISTAT(sproto, espstat.esps_pdrops,
 			    ahstat.ahs_pdrops,
 			    ipcompstat.ipcomps_pdrops);
 			error = EACCES;
 			goto bad;
 		}
 	}
 #ifdef INET6
 	/* IPv6-in-IP encapsulation. */
 	if (prot == IPPROTO_IPV6) {
 		struct ip6_hdr ip6n;
 
 		if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) {
 			IPSEC_ISTAT(sproto, espstat.esps_hdrops,
 			    ahstat.ahs_hdrops,
 			    ipcompstat.ipcomps_hdrops);
 			error = EINVAL;
 			goto bad;
 		}
 		/* ip6n will now contain the inner IPv6 header. */
 		m_copydata(m, ip->ip_hl << 2, sizeof(struct ip6_hdr),
 		    (caddr_t) &ip6n);
 
 		/*
 		 * Check that the inner source address is the same as
 		 * the proxy address, if available.
 		 */
 		if ((saidx->proxy.sa.sa_family == AF_INET6 &&
 		    !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) &&
 		    !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src,
 			&saidx->proxy.sin6.sin6_addr)) ||
 		    (saidx->proxy.sa.sa_family != AF_INET6 &&
 			saidx->proxy.sa.sa_family != 0)) {
 
 			DPRINTF(("%s: inner source address %s doesn't "
 			    "correspond to expected proxy source %s, "
 			    "SA %s/%08lx\n", __func__,
 			    ip6_sprintf(&ip6n.ip6_src),
 			    ipsec_address(&saidx->proxy),
 			    ipsec_address(&saidx->dst),
 			    (u_long) ntohl(sav->spi)));
 
 			IPSEC_ISTAT(sproto, espstat.esps_pdrops,
 			    ahstat.ahs_pdrops,
 			    ipcompstat.ipcomps_pdrops);
 			error = EACCES;
 			goto bad;
 		}
 	}
 #endif /* INET6 */
 #endif /*XXX*/
 
 	/*
 	 * Record what we've done to the packet (under what SA it was
 	 * processed). If we've been passed an mtag, it means the packet
 	 * was already processed by an ethernet/crypto combo card and
 	 * thus has a tag attached with all the right information, but
 	 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to
 	 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type.
 	 */
 	if (mt == NULL && sproto != IPPROTO_IPCOMP) {
 		mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE,
 		    sizeof(struct tdb_ident), M_NOWAIT);
 		if (mtag == NULL) {
 			DPRINTF(("%s: failed to get tag\n", __func__));
 			IPSEC_ISTAT(sproto, espstat.esps_hdrops,
 			    ahstat.ahs_hdrops, ipcompstat.ipcomps_hdrops);
 			error = ENOMEM;
 			goto bad;
 		}
 
 		tdbi = (struct tdb_ident *)(mtag + 1);
 		bcopy(&saidx->dst, &tdbi->dst, saidx->dst.sa.sa_len);
 		tdbi->proto = sproto;
 		tdbi->spi = sav->spi;
 
 		m_tag_prepend(m, mtag);
 	} else {
 		mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE;
 		/* XXX do we need to mark m_flags??? */
 	}
 
 	key_sa_recordxfer(sav, m);		/* record data transfer */
+
+#ifdef DEV_ENC
+	/*
+	 * Pass the mbuf to enc0 for bpf and pfil. We will filter the IPIP
+	 * packet later after it has been decapsulated.
+	 */
+	ipsec_bpf(m, sav, AF_INET);
+
+	if (prot != IPPROTO_IPIP)
+		if ((error = ipsec_filter(&m, 1)) != 0)
+			return (error);
+#endif
 
 	/*
 	 * Re-dispatch via software interrupt.
 	 */
 	if ((error = netisr_queue(NETISR_IP, m))) {
 		IPSEC_ISTAT(sproto, espstat.esps_qfull, ahstat.ahs_qfull,
 			    ipcompstat.ipcomps_qfull);
 
 		DPRINTF(("%s: queue full; proto %u packet dropped\n",
 			__func__, sproto));
 		return error;
 	}
 	return 0;
 bad:
 	m_freem(m);
 	return error;
 }
 
 void
 ipsec4_common_ctlinput(int cmd, struct sockaddr *sa, void *v, int proto)
 {
 	/* XXX nothing just yet */
 }
 #endif /* INET */
 
 #ifdef INET6
 /* IPv6 AH wrapper. */
 int
 ipsec6_common_input(struct mbuf **mp, int *offp, int proto)
 {
 	int l = 0;
 	int protoff;
 	struct ip6_ext ip6e;
 
 	if (*offp < sizeof(struct ip6_hdr)) {
 		DPRINTF(("%s: bad offset %u\n", __func__, *offp));
 		return IPPROTO_DONE;
 	} else if (*offp == sizeof(struct ip6_hdr)) {
 		protoff = offsetof(struct ip6_hdr, ip6_nxt);
 	} else {
 		/* Chase down the header chain... */
 		protoff = sizeof(struct ip6_hdr);
 
 		do {
 			protoff += l;
 			m_copydata(*mp, protoff, sizeof(ip6e),
 			    (caddr_t) &ip6e);
 
 			if (ip6e.ip6e_nxt == IPPROTO_AH)
 				l = (ip6e.ip6e_len + 2) << 2;
 			else
 				l = (ip6e.ip6e_len + 1) << 3;
 			IPSEC_ASSERT(l > 0, ("l went zero or negative"));
 		} while (protoff + l < *offp);
 
 		/* Malformed packet check */
 		if (protoff + l != *offp) {
 			DPRINTF(("%s: bad packet header chain, protoff %u, "
 				"l %u, off %u\n", __func__, protoff, l, *offp));
 			IPSEC_ISTAT(proto, espstat.esps_hdrops,
 				    ahstat.ahs_hdrops,
 				    ipcompstat.ipcomps_hdrops);
 			m_freem(*mp);
 			*mp = NULL;
 			return IPPROTO_DONE;
 		}
 		protoff += offsetof(struct ip6_ext, ip6e_nxt);
 	}
 	(void) ipsec_common_input(*mp, *offp, protoff, AF_INET6, proto);
 	return IPPROTO_DONE;
 }
 
 /*
  * IPsec input callback, called by the transform callback. Takes care of
  * filtering and other sanity checks on the processed packet.
  */
 int
 ipsec6_common_input_cb(struct mbuf *m, struct secasvar *sav, int skip, int protoff,
     struct m_tag *mt)
 {
 	int prot, af, sproto;
 	struct ip6_hdr *ip6;
 	struct m_tag *mtag;
 	struct tdb_ident *tdbi;
 	struct secasindex *saidx;
 	int nxt;
 	u_int8_t nxt8;
 	int error, nest;
 
 	IPSEC_ASSERT(m != NULL, ("null mbuf"));
 	IPSEC_ASSERT(sav != NULL, ("null SA"));
 	IPSEC_ASSERT(sav->sah != NULL, ("null SAH"));
 	saidx = &sav->sah->saidx;
 	af = saidx->dst.sa.sa_family;
 	IPSEC_ASSERT(af == AF_INET6, ("unexpected af %u", af));
 	sproto = saidx->proto;
 	IPSEC_ASSERT(sproto == IPPROTO_ESP || sproto == IPPROTO_AH ||
 		sproto == IPPROTO_IPCOMP,
 		("unexpected security protocol %u", sproto));
 
 	/* Sanity check */
 	if (m == NULL) {
 		DPRINTF(("%s: null mbuf", __func__));
 		IPSEC_ISTAT(sproto, espstat.esps_badkcr, ahstat.ahs_badkcr,
 		    ipcompstat.ipcomps_badkcr);
 		error = EINVAL;
 		goto bad;
 	}
 
 	/* Fix IPv6 header */
 	if (m->m_len < sizeof(struct ip6_hdr) &&
 	    (m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
 
 		DPRINTF(("%s: processing failed for SA %s/%08lx\n",
 		    __func__, ipsec_address(&sav->sah->saidx.dst),
 		    (u_long) ntohl(sav->spi)));
 
 		IPSEC_ISTAT(sproto, espstat.esps_hdrops, ahstat.ahs_hdrops,
 		    ipcompstat.ipcomps_hdrops);
 		error = EACCES;
 		goto bad;
 	}
 
 	ip6 = mtod(m, struct ip6_hdr *);
 	ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr));
 
 	/* Save protocol */
 	m_copydata(m, protoff, 1, (unsigned char *) &prot);
 
 #ifdef notyet
 #ifdef INET
 	/* IP-in-IP encapsulation */
 	if (prot == IPPROTO_IPIP) {
 		struct ip ipn;
 
 		if (m->m_pkthdr.len - skip < sizeof(struct ip)) {
 			IPSEC_ISTAT(sproto, espstat.esps_hdrops,
 			    ahstat.ahs_hdrops,
 			    ipcompstat.ipcomps_hdrops);
 			error = EINVAL;
 			goto bad;
 		}
 		/* ipn will now contain the inner IPv4 header */
 		m_copydata(m, skip, sizeof(struct ip), (caddr_t) &ipn);
 
 		/*
 		 * Check that the inner source address is the same as
 		 * the proxy address, if available.
 		 */
 		if ((saidx->proxy.sa.sa_family == AF_INET &&
 		    saidx->proxy.sin.sin_addr.s_addr != INADDR_ANY &&
 		    ipn.ip_src.s_addr != saidx->proxy.sin.sin_addr.s_addr) ||
 		    (saidx->proxy.sa.sa_family != AF_INET &&
 			saidx->proxy.sa.sa_family != 0)) {
 
 			DPRINTF(("%s: inner source address %s doesn't "
 			    "correspond to expected proxy source %s, "
 			    "SA %s/%08lx\n", __func__,
 			    inet_ntoa4(ipn.ip_src),
 			    ipsec_address(&saidx->proxy),
 			    ipsec_address(&saidx->dst),
 			    (u_long) ntohl(sav->spi)));
 
 			IPSEC_ISTATsproto, (espstat.esps_pdrops,
 			    ahstat.ahs_pdrops, ipcompstat.ipcomps_pdrops);
 			error = EACCES;
 			goto bad;
 		}
 	}
 #endif /* INET */
 
 	/* IPv6-in-IP encapsulation */
 	if (prot == IPPROTO_IPV6) {
 		struct ip6_hdr ip6n;
 
 		if (m->m_pkthdr.len - skip < sizeof(struct ip6_hdr)) {
 			IPSEC_ISTAT(sproto, espstat.esps_hdrops,
 			    ahstat.ahs_hdrops,
 			    ipcompstat.ipcomps_hdrops);
 			error = EINVAL;
 			goto bad;
 		}
 		/* ip6n will now contain the inner IPv6 header. */
 		m_copydata(m, skip, sizeof(struct ip6_hdr),
 		    (caddr_t) &ip6n);
 
 		/*
 		 * Check that the inner source address is the same as
 		 * the proxy address, if available.
 		 */
 		if ((saidx->proxy.sa.sa_family == AF_INET6 &&
 		    !IN6_IS_ADDR_UNSPECIFIED(&saidx->proxy.sin6.sin6_addr) &&
 		    !IN6_ARE_ADDR_EQUAL(&ip6n.ip6_src,
 			&saidx->proxy.sin6.sin6_addr)) ||
 		    (saidx->proxy.sa.sa_family != AF_INET6 &&
 			saidx->proxy.sa.sa_family != 0)) {
 
 			DPRINTF(("%s: inner source address %s doesn't "
 			    "correspond to expected proxy source %s, "
 			    "SA %s/%08lx\n", __func__,
 			    ip6_sprintf(&ip6n.ip6_src),
 			    ipsec_address(&saidx->proxy),
 			    ipsec_address(&saidx->dst),
 			    (u_long) ntohl(sav->spi)));
 
 			IPSEC_ISTAT(sproto, espstat.esps_pdrops,
 			    ahstat.ahs_pdrops, ipcompstat.ipcomps_pdrops);
 			error = EACCES;
 			goto bad;
 		}
 	}
 #endif /*XXX*/
 
 	/*
 	 * Record what we've done to the packet (under what SA it was
 	 * processed). If we've been passed an mtag, it means the packet
 	 * was already processed by an ethernet/crypto combo card and
 	 * thus has a tag attached with all the right information, but
 	 * with a PACKET_TAG_IPSEC_IN_CRYPTO_DONE as opposed to
 	 * PACKET_TAG_IPSEC_IN_DONE type; in that case, just change the type.
 	 */
 	if (mt == NULL && sproto != IPPROTO_IPCOMP) {
 		mtag = m_tag_get(PACKET_TAG_IPSEC_IN_DONE,
 		    sizeof(struct tdb_ident), M_NOWAIT);
 		if (mtag == NULL) {
 			DPRINTF(("%s: failed to get tag\n", __func__));
 			IPSEC_ISTAT(sproto, espstat.esps_hdrops,
 			    ahstat.ahs_hdrops, ipcompstat.ipcomps_hdrops);
 			error = ENOMEM;
 			goto bad;
 		}
 
 		tdbi = (struct tdb_ident *)(mtag + 1);
 		bcopy(&saidx->dst, &tdbi->dst, sizeof(union sockaddr_union));
 		tdbi->proto = sproto;
 		tdbi->spi = sav->spi;
 
 		m_tag_prepend(m, mtag);
 	} else {
 		if (mt != NULL)
 			mt->m_tag_id = PACKET_TAG_IPSEC_IN_DONE;
 		/* XXX do we need to mark m_flags??? */
 	}
 
 	key_sa_recordxfer(sav, m);
 
 	/* Retrieve new protocol */
 	m_copydata(m, protoff, sizeof(u_int8_t), (caddr_t) &nxt8);
 
 	/*
 	 * See the end of ip6_input for this logic.
 	 * IPPROTO_IPV[46] case will be processed just like other ones
 	 */
 	nest = 0;
 	nxt = nxt8;
 	while (nxt != IPPROTO_DONE) {
 		if (ip6_hdrnestlimit && (++nest > ip6_hdrnestlimit)) {
 			ip6stat.ip6s_toomanyhdr++;
 			error = EINVAL;
 			goto bad;
 		}
 
 		/*
 		 * Protection against faulty packet - there should be
 		 * more sanity checks in header chain processing.
 		 */
 		if (m->m_pkthdr.len < skip) {
 			ip6stat.ip6s_tooshort++;
 			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated);
 			error = EINVAL;
 			goto bad;
 		}
 		/*
 		 * Enforce IPsec policy checking if we are seeing last header.
 		 * note that we do not visit this with protocols with pcb layer
 		 * code - like udp/tcp/raw ip.
 		 */
 		if ((inet6sw[ip6_protox[nxt]].pr_flags & PR_LASTHDR) != 0 &&
 		    ipsec6_in_reject(m, NULL)) {
 			error = EINVAL;
 			goto bad;
 		}
 		nxt = (*inet6sw[ip6_protox[nxt]].pr_input)(&m, &skip, nxt);
 	}
 	return 0;
 bad:
 	if (m)
 		m_freem(m);
 	return error;
 }
 
 void
 esp6_ctlinput(int cmd, struct sockaddr *sa, void *d)
 {
 	if (sa->sa_family != AF_INET6 ||
 	    sa->sa_len != sizeof(struct sockaddr_in6))
 		return;
 	if ((unsigned)cmd >= PRC_NCMDS)
 		return;
 
 	/* if the parameter is from icmp6, decode it. */
 	if (d !=  NULL) {
 		struct ip6ctlparam *ip6cp = (struct ip6ctlparam *)d;
 		struct mbuf *m = ip6cp->ip6c_m;
 		int off = ip6cp->ip6c_off;
 
 		struct ip6ctlparam ip6cp1;
 
 		/*
 		 * Notify the error to all possible sockets via pfctlinput2.
 		 * Since the upper layer information (such as protocol type,
 		 * source and destination ports) is embedded in the encrypted
 		 * data and might have been cut, we can't directly call
 		 * an upper layer ctlinput function. However, the pcbnotify
 		 * function will consider source and destination addresses
 		 * as well as the flow info value, and may be able to find
 		 * some PCB that should be notified.
 		 * Although pfctlinput2 will call esp6_ctlinput(), there is
 		 * no possibility of an infinite loop of function calls,
 		 * because we don't pass the inner IPv6 header.
 		 */
 		bzero(&ip6cp1, sizeof(ip6cp1));
 		ip6cp1.ip6c_src = ip6cp->ip6c_src;
 		pfctlinput2(cmd, sa, (void *)&ip6cp1);
 
 		/*
 		 * Then go to special cases that need ESP header information.
 		 * XXX: We assume that when ip6 is non NULL,
 		 * M and OFF are valid.
 		 */
 
 		if (cmd == PRC_MSGSIZE) {
 			struct secasvar *sav;
 			u_int32_t spi;
 			int valid;
 
 			/* check header length before using m_copydata */
 			if (m->m_pkthdr.len < off + sizeof (struct esp))
 				return;
 			m_copydata(m, off + offsetof(struct esp, esp_spi),
 				sizeof(u_int32_t), (caddr_t) &spi);
 			/*
 			 * Check to see if we have a valid SA corresponding to
 			 * the address in the ICMP message payload.
 			 */
 			sav = KEY_ALLOCSA((union sockaddr_union *)sa,
 					IPPROTO_ESP, spi);
 			valid = (sav != NULL);
 			if (sav)
 				KEY_FREESAV(&sav);
 
 			/* XXX Further validation? */
 
 			/*
 			 * Depending on whether the SA is "valid" and
 			 * routing table size (mtudisc_{hi,lo}wat), we will:
 			 * - recalcurate the new MTU and create the
 			 *   corresponding routing entry, or
 			 * - ignore the MTU change notification.
 			 */
 			icmp6_mtudisc_update(ip6cp, valid);
 		}
 	} else {
 		/* we normally notify any pcb here */
 	}
 }
 #endif /* INET6 */
Index: head/sys/netipsec/ipsec_output.c
===================================================================
--- head/sys/netipsec/ipsec_output.c	(revision 159964)
+++ head/sys/netipsec/ipsec_output.c	(revision 159965)
@@ -1,768 +1,781 @@
 /*-
  * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
  * $FreeBSD$
  */
 
 /*
  * IPsec output processing.
  */
 #include "opt_inet.h"
 #include "opt_inet6.h"
 #include "opt_ipsec.h"
+#include "opt_enc.h"
 
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/mbuf.h>
 #include <sys/domain.h>
 #include <sys/protosw.h>
 #include <sys/socket.h>
 #include <sys/errno.h>
 #include <sys/syslog.h>
 
 #include <net/if.h>
 #include <net/route.h>
 
 #include <netinet/in.h>
 #include <netinet/in_systm.h>
 #include <netinet/ip.h>
 #include <netinet/ip_var.h>
 #include <netinet/in_var.h>
 #include <netinet/ip_ecn.h>
 #ifdef INET6
 #include <netinet6/ip6_ecn.h>
 #endif
 
 #include <netinet/ip6.h>
 #ifdef INET6
 #include <netinet6/ip6_var.h>
 #endif
 #include <netinet/in_pcb.h>
 #ifdef INET6
 #include <netinet/icmp6.h>
 #endif
 
 #include <netipsec/ipsec.h>
 #ifdef INET6
 #include <netipsec/ipsec6.h>
 #endif
 #include <netipsec/ah_var.h>
 #include <netipsec/esp_var.h>
 #include <netipsec/ipcomp_var.h>
 
 #include <netipsec/xform.h>
 
 #include <netipsec/key.h>
 #include <netipsec/keydb.h>
 #include <netipsec/key_debug.h>
 
 #include <machine/in_cksum.h>
 
 int
 ipsec_process_done(struct mbuf *m, struct ipsecrequest *isr)
 {
 	struct tdb_ident *tdbi;
 	struct m_tag *mtag;
 	struct secasvar *sav;
 	struct secasindex *saidx;
 	int error;
 
 	IPSEC_SPLASSERT_SOFTNET(__func__);
 
 	IPSEC_ASSERT(m != NULL, ("null mbuf"));
 	IPSEC_ASSERT(isr != NULL, ("null ISR"));
 	sav = isr->sav;
 	IPSEC_ASSERT(sav != NULL, ("null SA"));
 	IPSEC_ASSERT(sav->sah != NULL, ("null SAH"));
 
 	saidx = &sav->sah->saidx;
 	switch (saidx->dst.sa.sa_family) {
 #ifdef INET
 	case AF_INET:
 		/* Fix the header length, for AH processing. */
 		mtod(m, struct ip *)->ip_len = htons(m->m_pkthdr.len);
 		break;
 #endif /* INET */
 #ifdef INET6
 	case AF_INET6:
 		/* Fix the header length, for AH processing. */
 		if (m->m_pkthdr.len < sizeof (struct ip6_hdr)) {
 			error = ENXIO;
 			goto bad;
 		}
 		if (m->m_pkthdr.len - sizeof (struct ip6_hdr) > IPV6_MAXPACKET) {
 			/* No jumbogram support. */
 			error = ENXIO;	/*?*/
 			goto bad;
 		}
 		mtod(m, struct ip6_hdr *)->ip6_plen =
 			htons(m->m_pkthdr.len - sizeof(struct ip6_hdr));
 		break;
 #endif /* INET6 */
 	default:
 		DPRINTF(("%s: unknown protocol family %u\n", __func__,
 		    saidx->dst.sa.sa_family));
 		error = ENXIO;
 		goto bad;
 	}
 
 	/*
 	 * Add a record of what we've done or what needs to be done to the
 	 * packet.
 	 */
 	mtag = m_tag_get(PACKET_TAG_IPSEC_OUT_DONE,
 			sizeof(struct tdb_ident), M_NOWAIT);
 	if (mtag == NULL) {
 		DPRINTF(("%s: could not get packet tag\n", __func__));
 		error = ENOMEM;
 		goto bad;
 	}
 
 	tdbi = (struct tdb_ident *)(mtag + 1);
 	tdbi->dst = saidx->dst;
 	tdbi->proto = saidx->proto;
 	tdbi->spi = sav->spi;
 	m_tag_prepend(m, mtag);
 
 	/*
 	 * If there's another (bundled) SA to apply, do so.
 	 * Note that this puts a burden on the kernel stack size.
 	 * If this is a problem we'll need to introduce a queue
 	 * to set the packet on so we can unwind the stack before
 	 * doing further processing.
 	 */
 	if (isr->next) {
 		newipsecstat.ips_out_bundlesa++;
 		return ipsec4_process_packet(m, isr->next, 0, 0);
 	}
 	key_sa_recordxfer(sav, m);		/* record data transfer */
 
 	/*
 	 * We're done with IPsec processing, transmit the packet using the
 	 * appropriate network protocol (IP or IPv6). SPD lookup will be
 	 * performed again there.
 	 */
 	switch (saidx->dst.sa.sa_family) {
 #ifdef INET
 	struct ip *ip;
 	case AF_INET:
 		ip = mtod(m, struct ip *);
 		ip->ip_len = ntohs(ip->ip_len);
 		ip->ip_off = ntohs(ip->ip_off);
 
 		return ip_output(m, NULL, NULL, IP_RAWOUTPUT, NULL, NULL);
 #endif /* INET */
 #ifdef INET6
 	case AF_INET6:
 		/*
 		 * We don't need massage, IPv6 header fields are always in
 		 * net endian.
 		 */
 		return ip6_output(m, NULL, NULL, 0, NULL, NULL, NULL);
 #endif /* INET6 */
 	}
 	panic("ipsec_process_done");
 bad:
 	m_freem(m);
 	KEY_FREESAV(&sav);
 	return (error);
 }
 
 static struct ipsecrequest *
 ipsec_nextisr(
 	struct mbuf *m,
 	struct ipsecrequest *isr,
 	int af,
 	struct secasindex *saidx,
 	int *error
 )
 {
 #define IPSEC_OSTAT(x,y,z) (isr->saidx.proto == IPPROTO_ESP ? (x)++ : \
 			    isr->saidx.proto == IPPROTO_AH ? (y)++ : (z)++)
 	struct secasvar *sav;
 
 	IPSEC_SPLASSERT_SOFTNET(__func__);
 	IPSECREQUEST_LOCK_ASSERT(isr);
 
 	IPSEC_ASSERT(af == AF_INET || af == AF_INET6,
 		("invalid address family %u", af));
 again:
 	/*
 	 * Craft SA index to search for proper SA.  Note that
 	 * we only fillin unspecified SA peers for transport
 	 * mode; for tunnel mode they must already be filled in.
 	 */
 	*saidx = isr->saidx;
 	if (isr->saidx.mode == IPSEC_MODE_TRANSPORT) {
 		/* Fillin unspecified SA peers only for transport mode */
 		if (af == AF_INET) {
 			struct sockaddr_in *sin;
 			struct ip *ip = mtod(m, struct ip *);
 
 			if (saidx->src.sa.sa_len == 0) {
 				sin = &saidx->src.sin;
 				sin->sin_len = sizeof(*sin);
 				sin->sin_family = AF_INET;
 				sin->sin_port = IPSEC_PORT_ANY;
 				sin->sin_addr = ip->ip_src;
 			}
 			if (saidx->dst.sa.sa_len == 0) {
 				sin = &saidx->dst.sin;
 				sin->sin_len = sizeof(*sin);
 				sin->sin_family = AF_INET;
 				sin->sin_port = IPSEC_PORT_ANY;
 				sin->sin_addr = ip->ip_dst;
 			}
 		} else {
 			struct sockaddr_in6 *sin6;
 			struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
 
 			if (saidx->src.sin6.sin6_len == 0) {
 				sin6 = (struct sockaddr_in6 *)&saidx->src;
 				sin6->sin6_len = sizeof(*sin6);
 				sin6->sin6_family = AF_INET6;
 				sin6->sin6_port = IPSEC_PORT_ANY;
 				sin6->sin6_addr = ip6->ip6_src;
 				if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src)) {
 					/* fix scope id for comparing SPD */
 					sin6->sin6_addr.s6_addr16[1] = 0;
 					sin6->sin6_scope_id =
 					    ntohs(ip6->ip6_src.s6_addr16[1]);
 				}
 			}
 			if (saidx->dst.sin6.sin6_len == 0) {
 				sin6 = (struct sockaddr_in6 *)&saidx->dst;
 				sin6->sin6_len = sizeof(*sin6);
 				sin6->sin6_family = AF_INET6;
 				sin6->sin6_port = IPSEC_PORT_ANY;
 				sin6->sin6_addr = ip6->ip6_dst;
 				if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst)) {
 					/* fix scope id for comparing SPD */
 					sin6->sin6_addr.s6_addr16[1] = 0;
 					sin6->sin6_scope_id =
 					    ntohs(ip6->ip6_dst.s6_addr16[1]);
 				}
 			}
 		}
 	}
 
 	/*
 	 * Lookup SA and validate it.
 	 */
 	*error = key_checkrequest(isr, saidx);
 	if (*error != 0) {
 		/*
 		 * IPsec processing is required, but no SA found.
 		 * I assume that key_acquire() had been called
 		 * to get/establish the SA. Here I discard
 		 * this packet because it is responsibility for
 		 * upper layer to retransmit the packet.
 		 */
 		newipsecstat.ips_out_nosa++;
 		goto bad;
 	}
 	sav = isr->sav;
 	if (sav == NULL) {		/* XXX valid return */
 		IPSEC_ASSERT(ipsec_get_reqlevel(isr) == IPSEC_LEVEL_USE,
 			("no SA found, but required; level %u",
 			ipsec_get_reqlevel(isr)));
 		IPSECREQUEST_UNLOCK(isr);
 		isr = isr->next;
 		if (isr == NULL) {
 			/*XXXstatistic??*/
 			*error = EINVAL;		/*XXX*/
 			return isr;
 		}
 		IPSECREQUEST_LOCK(isr);
 		goto again;
 	}
 
 	/*
 	 * Check system global policy controls.
 	 */
 	if ((isr->saidx.proto == IPPROTO_ESP && !esp_enable) ||
 	    (isr->saidx.proto == IPPROTO_AH && !ah_enable) ||
 	    (isr->saidx.proto == IPPROTO_IPCOMP && !ipcomp_enable)) {
 		DPRINTF(("%s: IPsec outbound packet dropped due"
 			" to policy (check your sysctls)\n", __func__));
 		IPSEC_OSTAT(espstat.esps_pdrops, ahstat.ahs_pdrops,
 		    ipcompstat.ipcomps_pdrops);
 		*error = EHOSTUNREACH;
 		goto bad;
 	}
 
 	/*
 	 * Sanity check the SA contents for the caller
 	 * before they invoke the xform output method.
 	 */
 	if (sav->tdb_xform == NULL) {
 		DPRINTF(("%s: no transform for SA\n", __func__));
 		IPSEC_OSTAT(espstat.esps_noxform, ahstat.ahs_noxform,
 		    ipcompstat.ipcomps_noxform);
 		*error = EHOSTUNREACH;
 		goto bad;
 	}
 	return isr;
 bad:
 	IPSEC_ASSERT(*error != 0, ("error return w/ no error code"));
 	IPSECREQUEST_UNLOCK(isr);
 	return NULL;
 #undef IPSEC_OSTAT
 }
 
 #ifdef INET
 /*
  * IPsec output logic for IPv4.
  */
 int
 ipsec4_process_packet(
 	struct mbuf *m,
 	struct ipsecrequest *isr,
 	int flags,
 	int tunalready)
 {
 	struct secasindex saidx;
 	struct secasvar *sav;
 	struct ip *ip;
 	int error, i, off;
 
 	IPSEC_ASSERT(m != NULL, ("null mbuf"));
 	IPSEC_ASSERT(isr != NULL, ("null isr"));
 
 	IPSECREQUEST_LOCK(isr);		/* insure SA contents don't change */
 
 	isr = ipsec_nextisr(m, isr, AF_INET, &saidx, &error);
 	if (isr == NULL)
 		goto bad;
 
 	sav = isr->sav;
+
+#ifdef DEV_ENC
+	/* pass the mbuf to enc0 for packet filtering */
+	if ((error = ipsec_filter(&m, 2)) != 0)
+		goto bad;
+#endif
+
 	if (!tunalready) {
 		union sockaddr_union *dst = &sav->sah->saidx.dst;
 		int setdf;
 
 		/*
 		 * Collect IP_DF state from the outer header.
 		 */
 		if (dst->sa.sa_family == AF_INET) {
 			if (m->m_len < sizeof (struct ip) &&
 			    (m = m_pullup(m, sizeof (struct ip))) == NULL) {
 				error = ENOBUFS;
 				goto bad;
 			}
 			ip = mtod(m, struct ip *);
 			/* Honor system-wide control of how to handle IP_DF */
 			switch (ip4_ipsec_dfbit) {
 			case 0:			/* clear in outer header */
 			case 1:			/* set in outer header */
 				setdf = ip4_ipsec_dfbit;
 				break;
 			default:		/* propagate to outer header */
 				setdf = ntohs(ip->ip_off & IP_DF);
 				break;
 			}
 		} else {
 			ip = NULL;		/* keep compiler happy */
 			setdf = 0;
 		}
 		/* Do the appropriate encapsulation, if necessary */
 		if (isr->saidx.mode == IPSEC_MODE_TUNNEL || /* Tunnel requ'd */
 		    dst->sa.sa_family != AF_INET ||	    /* PF mismatch */
 #if 0
 		    (sav->flags & SADB_X_SAFLAGS_TUNNEL) || /* Tunnel requ'd */
 		    sav->tdb_xform->xf_type == XF_IP4 ||    /* ditto */
 #endif
 		    (dst->sa.sa_family == AF_INET &&	    /* Proxy */
 		     dst->sin.sin_addr.s_addr != INADDR_ANY &&
 		     dst->sin.sin_addr.s_addr != ip->ip_dst.s_addr)) {
 			struct mbuf *mp;
 
 			/* Fix IPv4 header checksum and length */
 			if (m->m_len < sizeof (struct ip) &&
 			    (m = m_pullup(m, sizeof (struct ip))) == NULL) {
 				error = ENOBUFS;
 				goto bad;
 			}
 			ip = mtod(m, struct ip *);
 			ip->ip_len = htons(m->m_pkthdr.len);
 			ip->ip_sum = 0;
 #ifdef _IP_VHL
 			if (ip->ip_vhl == IP_VHL_BORING)
 				ip->ip_sum = in_cksum_hdr(ip);
 			else
 				ip->ip_sum = in_cksum(m,
 					_IP_VHL_HL(ip->ip_vhl) << 2);
 #else
 			ip->ip_sum = in_cksum(m, ip->ip_hl << 2);
 #endif
 
 			/* Encapsulate the packet */
 			error = ipip_output(m, isr, &mp, 0, 0);
 			if (mp == NULL && !error) {
 				/* Should never happen. */
 				DPRINTF(("%s: ipip_output returns no mbuf and "
 					"no error!", __func__));
 				error = EFAULT;
 			}
 			if (error) {
 				if (mp) {
 					/* XXX: Should never happen! */
 					m_freem(mp);
 				}
 				m = NULL; /* ipip_output() already freed it */
 				goto bad;
 			}
 			m = mp, mp = NULL;
 			/*
 			 * ipip_output clears IP_DF in the new header.  If
 			 * we need to propagate IP_DF from the outer header,
 			 * then we have to do it here.
 			 *
 			 * XXX shouldn't assume what ipip_output does.
 			 */
 			if (dst->sa.sa_family == AF_INET && setdf) {
 				if (m->m_len < sizeof (struct ip) &&
 				    (m = m_pullup(m, sizeof (struct ip))) == NULL) {
 					error = ENOBUFS;
 					goto bad;
 				}
 				ip = mtod(m, struct ip *);
 				ip->ip_off = ntohs(ip->ip_off);
 				ip->ip_off |= IP_DF;
 				ip->ip_off = htons(ip->ip_off);
 			}
 		}
 	}
+
+#ifdef DEV_ENC
+	/* pass the mbuf to enc0 for bpf processing */
+	ipsec_bpf(m, sav, AF_INET);
+#endif
 
 	/*
 	 * Dispatch to the appropriate IPsec transform logic.  The
 	 * packet will be returned for transmission after crypto
 	 * processing, etc. are completed.  For encapsulation we
 	 * bypass this call because of the explicit call done above
 	 * (necessary to deal with IP_DF handling for IPv4).
 	 *
 	 * NB: m & sav are ``passed to caller'' who's reponsible for
 	 *     for reclaiming their resources.
 	 */
 	if (sav->tdb_xform->xf_type != XF_IP4) {
 		ip = mtod(m, struct ip *);
 		i = ip->ip_hl << 2;
 		off = offsetof(struct ip, ip_p);
 		error = (*sav->tdb_xform->xf_output)(m, isr, NULL, i, off);
 	} else {
 		error = ipsec_process_done(m, isr);
 	}
 	IPSECREQUEST_UNLOCK(isr);
 	return error;
 bad:
 	if (isr)
 		IPSECREQUEST_UNLOCK(isr);
 	if (m)
 		m_freem(m);
 	return error;
 }
 #endif
 
 #ifdef INET6
 /*
  * Chop IP6 header from the payload.
  */
 static struct mbuf *
 ipsec6_splithdr(struct mbuf *m)
 {
 	struct mbuf *mh;
 	struct ip6_hdr *ip6;
 	int hlen;
 
 	IPSEC_ASSERT(m->m_len >= sizeof (struct ip6_hdr),
 		("first mbuf too short, len %u", m->m_len));
 	ip6 = mtod(m, struct ip6_hdr *);
 	hlen = sizeof(struct ip6_hdr);
 	if (m->m_len > hlen) {
 		MGETHDR(mh, M_DONTWAIT, MT_DATA);
 		if (!mh) {
 			m_freem(m);
 			return NULL;
 		}
 		M_MOVE_PKTHDR(mh, m);
 		MH_ALIGN(mh, hlen);
 		m->m_len -= hlen;
 		m->m_data += hlen;
 		mh->m_next = m;
 		m = mh;
 		m->m_len = hlen;
 		bcopy((caddr_t)ip6, mtod(m, caddr_t), hlen);
 	} else if (m->m_len < hlen) {
 		m = m_pullup(m, hlen);
 		if (!m)
 			return NULL;
 	}
 	return m;
 }
 
 /*
  * IPsec output logic for IPv6, transport mode.
  */
 int
 ipsec6_output_trans(
 	struct ipsec_output_state *state,
 	u_char *nexthdrp,
 	struct mbuf *mprev,
 	struct secpolicy *sp,
 	int flags,
 	int *tun)
 {
 	struct ipsecrequest *isr;
 	struct secasindex saidx;
 	int error = 0;
 	struct mbuf *m;
 
 	IPSEC_ASSERT(state != NULL, ("null state"));
 	IPSEC_ASSERT(state->m != NULL, ("null m"));
 	IPSEC_ASSERT(nexthdrp != NULL, ("null nexthdrp"));
 	IPSEC_ASSERT(mprev != NULL, ("null mprev"));
 	IPSEC_ASSERT(sp != NULL, ("null sp"));
 	IPSEC_ASSERT(tun != NULL, ("null tun"));
 
 	KEYDEBUG(KEYDEBUG_IPSEC_DATA,
 		printf("%s: applyed SP\n", __func__);
 		kdebug_secpolicy(sp));
 
 	isr = sp->req;
 	if (isr->saidx.mode == IPSEC_MODE_TUNNEL) {
 		/* the rest will be handled by ipsec6_output_tunnel() */
 		*tun = 1;		/* need tunnel-mode processing */
 		return 0;
 	}
 
 	*tun = 0;
 	m = state->m;
 
 	isr = ipsec_nextisr(m, isr, AF_INET6, &saidx, &error);
 	if (isr == NULL) {
 #ifdef notdef
 		/* XXX should notification be done for all errors ? */
 		/*
 		 * Notify the fact that the packet is discarded
 		 * to ourselves. I believe this is better than
 		 * just silently discarding. (jinmei@kame.net)
 		 * XXX: should we restrict the error to TCP packets?
 		 * XXX: should we directly notify sockets via
 		 *      pfctlinputs?
 		 */
 		icmp6_error(m, ICMP6_DST_UNREACH,
 			    ICMP6_DST_UNREACH_ADMIN, 0);
 		m = NULL;	/* NB: icmp6_error frees mbuf */
 #endif
 		goto bad;
 	}
 
 	return (*isr->sav->tdb_xform->xf_output)(m, isr, NULL,
 		sizeof (struct ip6_hdr),
 		offsetof(struct ip6_hdr, ip6_nxt));
 bad:
 	if (m)
 		m_freem(m);
 	state->m = NULL;
 	return error;
 }
 
 static int
 ipsec6_encapsulate(struct mbuf *m, struct secasvar *sav)
 {
 	struct ip6_hdr *oip6;
 	struct ip6_hdr *ip6;
 	size_t plen;
 
 	/* can't tunnel between different AFs */
 	if (sav->sah->saidx.src.sa.sa_family != AF_INET6 ||
 	    sav->sah->saidx.dst.sa.sa_family != AF_INET6) {
 		m_freem(m);
 		return EINVAL;
 	}
 	IPSEC_ASSERT(m->m_len != sizeof (struct ip6_hdr),
 		("mbuf wrong size; len %u", m->m_len));
 
 
 	/*
 	 * grow the mbuf to accomodate the new IPv6 header.
 	 */
 	plen = m->m_pkthdr.len;
 	if (M_LEADINGSPACE(m->m_next) < sizeof(struct ip6_hdr)) {
 		struct mbuf *n;
 		MGET(n, M_DONTWAIT, MT_DATA);
 		if (!n) {
 			m_freem(m);
 			return ENOBUFS;
 		}
 		n->m_len = sizeof(struct ip6_hdr);
 		n->m_next = m->m_next;
 		m->m_next = n;
 		m->m_pkthdr.len += sizeof(struct ip6_hdr);
 		oip6 = mtod(n, struct ip6_hdr *);
 	} else {
 		m->m_next->m_len += sizeof(struct ip6_hdr);
 		m->m_next->m_data -= sizeof(struct ip6_hdr);
 		m->m_pkthdr.len += sizeof(struct ip6_hdr);
 		oip6 = mtod(m->m_next, struct ip6_hdr *);
 	}
 	ip6 = mtod(m, struct ip6_hdr *);
 	bcopy((caddr_t)ip6, (caddr_t)oip6, sizeof(struct ip6_hdr));
 
 	/* Fake link-local scope-class addresses */
 	if (IN6_IS_SCOPE_LINKLOCAL(&oip6->ip6_src))
 		oip6->ip6_src.s6_addr16[1] = 0;
 	if (IN6_IS_SCOPE_LINKLOCAL(&oip6->ip6_dst))
 		oip6->ip6_dst.s6_addr16[1] = 0;
 
 	/* construct new IPv6 header. see RFC 2401 5.1.2.2 */
 	/* ECN consideration. */
 	ip6_ecn_ingress(ip6_ipsec_ecn, &ip6->ip6_flow, &oip6->ip6_flow);
 	if (plen < IPV6_MAXPACKET - sizeof(struct ip6_hdr))
 		ip6->ip6_plen = htons(plen);
 	else {
 		/* ip6->ip6_plen will be updated in ip6_output() */
 	}
 	ip6->ip6_nxt = IPPROTO_IPV6;
 	sav->sah->saidx.src.sin6.sin6_addr = ip6->ip6_src;
 	sav->sah->saidx.dst.sin6.sin6_addr = ip6->ip6_dst;
 	ip6->ip6_hlim = IPV6_DEFHLIM;
 
 	/* XXX Should ip6_src be updated later ? */
 
 	return 0;
 }
 
 /*
  * IPsec output logic for IPv6, tunnel mode.
  */
 int
 ipsec6_output_tunnel(struct ipsec_output_state *state, struct secpolicy *sp, int flags)
 {
 	struct ip6_hdr *ip6;
 	struct ipsecrequest *isr;
 	struct secasindex saidx;
 	int error;
 	struct sockaddr_in6* dst6;
 	struct mbuf *m;
 
 	IPSEC_ASSERT(state != NULL, ("null state"));
 	IPSEC_ASSERT(state->m != NULL, ("null m"));
 	IPSEC_ASSERT(sp != NULL, ("null sp"));
 
 	KEYDEBUG(KEYDEBUG_IPSEC_DATA,
 		printf("%s: applyed SP\n", __func__);
 		kdebug_secpolicy(sp));
 
 	m = state->m;
 	/*
 	 * transport mode ipsec (before the 1st tunnel mode) is already
 	 * processed by ipsec6_output_trans().
 	 */
 	for (isr = sp->req; isr; isr = isr->next) {
 		if (isr->saidx.mode == IPSEC_MODE_TUNNEL)
 			break;
 	}
 	isr = ipsec_nextisr(m, isr, AF_INET6, &saidx, &error);
 	if (isr == NULL)
 		goto bad;
 
 	/*
 	 * There may be the case that SA status will be changed when
 	 * we are refering to one. So calling splsoftnet().
 	 */
 	if (isr->saidx.mode == IPSEC_MODE_TUNNEL) {
 		/*
 		 * build IPsec tunnel.
 		 */
 		/* XXX should be processed with other familiy */
 		if (isr->sav->sah->saidx.src.sa.sa_family != AF_INET6) {
 			ipseclog((LOG_ERR, "%s: family mismatched between "
 			    "inner and outer, spi=%u\n", __func__,
 			    ntohl(isr->sav->spi)));
 			newipsecstat.ips_out_inval++;
 			error = EAFNOSUPPORT;
 			goto bad;
 		}
 
 		m = ipsec6_splithdr(m);
 		if (!m) {
 			newipsecstat.ips_out_nomem++;
 			error = ENOMEM;
 			goto bad;
 		}
 		error = ipsec6_encapsulate(m, isr->sav);
 		if (error) {
 			m = NULL;
 			goto bad;
 		}
 		ip6 = mtod(m, struct ip6_hdr *);
 
 		state->ro = &isr->sav->sah->sa_route;
 		state->dst = (struct sockaddr *)&state->ro->ro_dst;
 		dst6 = (struct sockaddr_in6 *)state->dst;
 		if (state->ro->ro_rt
 		 && ((state->ro->ro_rt->rt_flags & RTF_UP) == 0
 		  || !IN6_ARE_ADDR_EQUAL(&dst6->sin6_addr, &ip6->ip6_dst))) {
 			RTFREE(state->ro->ro_rt);
 			state->ro->ro_rt = NULL;
 		}
 		if (state->ro->ro_rt == 0) {
 			bzero(dst6, sizeof(*dst6));
 			dst6->sin6_family = AF_INET6;
 			dst6->sin6_len = sizeof(*dst6);
 			dst6->sin6_addr = ip6->ip6_dst;
 			rtalloc(state->ro);
 		}
 		if (state->ro->ro_rt == 0) {
 			ip6stat.ip6s_noroute++;
 			newipsecstat.ips_out_noroute++;
 			error = EHOSTUNREACH;
 			goto bad;
 		}
 
 		/* adjust state->dst if tunnel endpoint is offlink */
 		if (state->ro->ro_rt->rt_flags & RTF_GATEWAY) {
 			state->dst = (struct sockaddr *)state->ro->ro_rt->rt_gateway;
 			dst6 = (struct sockaddr_in6 *)state->dst;
 		}
 	}
 
 	m = ipsec6_splithdr(m);
 	if (!m) {
 		newipsecstat.ips_out_nomem++;
 		error = ENOMEM;
 		goto bad;
 	}
 	ip6 = mtod(m, struct ip6_hdr *);
 	return (*isr->sav->tdb_xform->xf_output)(m, isr, NULL,
 		sizeof (struct ip6_hdr),
 		offsetof(struct ip6_hdr, ip6_nxt));
 bad:
 	if (m)
 		m_freem(m);
 	state->m = NULL;
 	return error;
 }
 #endif /*INET6*/
Index: head/sys/netipsec/xform_ipip.c
===================================================================
--- head/sys/netipsec/xform_ipip.c	(revision 159964)
+++ head/sys/netipsec/xform_ipip.c	(revision 159965)
@@ -1,681 +1,688 @@
 /*	$FreeBSD$	*/
 /*	$OpenBSD: ip_ipip.c,v 1.25 2002/06/10 18:04:55 itojun Exp $ */
 /*-
  * The authors of this code are John Ioannidis (ji@tla.org),
  * Angelos D. Keromytis (kermit@csd.uch.gr) and
  * Niels Provos (provos@physnet.uni-hamburg.de).
  *
  * The original version of this code was written by John Ioannidis
  * for BSD/OS in Athens, Greece, in November 1995.
  *
  * Ported to OpenBSD and NetBSD, with additional transforms, in December 1996,
  * by Angelos D. Keromytis.
  *
  * Additional transforms and features in 1997 and 1998 by Angelos D. Keromytis
  * and Niels Provos.
  *
  * Additional features in 1999 by Angelos D. Keromytis.
  *
  * Copyright (C) 1995, 1996, 1997, 1998, 1999 by John Ioannidis,
  * Angelos D. Keromytis and Niels Provos.
  * Copyright (c) 2001, Angelos D. Keromytis.
  *
  * Permission to use, copy, and modify this software with or without fee
  * is hereby granted, provided that this entire notice is included in
  * all copies of any software which is or includes a copy or
  * modification of this software.
  * You may use this code under the GNU public license if you so wish. Please
  * contribute changes back to the authors under this freer than GPL license
  * so that we may further the use of strong encryption without limitations to
  * all.
  *
  * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR
  * IMPLIED WARRANTY. IN PARTICULAR, NONE OF THE AUTHORS MAKES ANY
  * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE
  * MERCHANTABILITY OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR
  * PURPOSE.
  */
 
 /*
  * IP-inside-IP processing
  */
 #include "opt_inet.h"
 #include "opt_inet6.h"
+#include "opt_enc.h"
 
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/mbuf.h>
 #include <sys/socket.h>
 #include <sys/kernel.h>
 #include <sys/protosw.h>
 #include <sys/sysctl.h>
 
 #include <net/if.h>
 #include <net/route.h>
 #include <net/netisr.h>
 
 #include <netinet/in.h>
 #include <netinet/in_systm.h>
 #include <netinet/in_var.h>
 #include <netinet/ip.h>
 #include <netinet/ip_ecn.h>
 #include <netinet/ip_var.h>
 #include <netinet/ip_encap.h>
 
 #include <netipsec/ipsec.h>
 #include <netipsec/xform.h>
 
 #include <netipsec/ipip_var.h>
 
 #ifdef MROUTING
 #include <netinet/ip_mroute.h>
 #endif
 
 #ifdef INET6
 #include <netinet/ip6.h>
 #include <netipsec/ipsec6.h>
 #include <netinet6/ip6_ecn.h>
 #include <netinet6/in6_var.h>
 #include <netinet6/ip6protosw.h>
 #endif
 
 #include <netipsec/key.h>
 #include <netipsec/key_debug.h>
 
 #include <machine/stdarg.h>
 
 /*
  * We can control the acceptance of IP4 packets by altering the sysctl
  * net.inet.ipip.allow value.  Zero means drop them, all else is acceptance.
  */
 int	ipip_allow = 0;
 struct	ipipstat ipipstat;
 
 SYSCTL_DECL(_net_inet_ipip);
 SYSCTL_INT(_net_inet_ipip, OID_AUTO,
 	ipip_allow,	CTLFLAG_RW,	&ipip_allow,	0, "");
 SYSCTL_STRUCT(_net_inet_ipip, IPSECCTL_STATS,
 	stats,		CTLFLAG_RD,	&ipipstat,	ipipstat, "");
 
 /* XXX IPCOMP */
 #define	M_IPSEC	(M_AUTHIPHDR|M_AUTHIPDGM|M_DECRYPTED)
 
 static void _ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp);
 
 #ifdef INET6
 /*
  * Really only a wrapper for ipip_input(), for use with IPv6.
  */
 int
 ip4_input6(struct mbuf **m, int *offp, int proto)
 {
 #if 0
 	/* If we do not accept IP-in-IP explicitly, drop.  */
 	if (!ipip_allow && ((*m)->m_flags & M_IPSEC) == 0) {
 		DPRINTF(("%s: dropped due to policy\n", __func__));
 		ipipstat.ipips_pdrops++;
 		m_freem(*m);
 		return IPPROTO_DONE;
 	}
 #endif
 	_ipip_input(*m, *offp, NULL);
 	return IPPROTO_DONE;
 }
 #endif /* INET6 */
 
 #ifdef INET
 /*
  * Really only a wrapper for ipip_input(), for use with IPv4.
  */
 void
 ip4_input(struct mbuf *m, int off)
 {
 #if 0
 	/* If we do not accept IP-in-IP explicitly, drop.  */
 	if (!ipip_allow && (m->m_flags & M_IPSEC) == 0) {
 		DPRINTF(("%s: dropped due to policy\n", __func__));
 		ipipstat.ipips_pdrops++;
 		m_freem(m);
 		return;
 	}
 #endif
 	_ipip_input(m, off, NULL);
 }
 #endif /* INET */
 
 /*
  * ipip_input gets called when we receive an IP{46} encapsulated packet,
  * either because we got it at a real interface, or because AH or ESP
  * were being used in tunnel mode (in which case the rcvif element will
  * contain the address of the encX interface associated with the tunnel.
  */
 
 static void
 _ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp)
 {
 	register struct sockaddr_in *sin;
 	register struct ifnet *ifp;
 	register struct ifaddr *ifa;
 	struct ip *ipo;
 #ifdef INET6
 	register struct sockaddr_in6 *sin6;
 	struct ip6_hdr *ip6 = NULL;
 	u_int8_t itos;
 #endif
 	u_int8_t nxt;
 	int isr;
 	u_int8_t otos;
 	u_int8_t v;
 	int hlen;
 
 	ipipstat.ipips_ipackets++;
 
 	m_copydata(m, 0, 1, &v);
 
 	switch (v >> 4) {
 #ifdef INET
         case 4:
 		hlen = sizeof(struct ip);
 		break;
 #endif /* INET */
 #ifdef INET6
         case 6:
 		hlen = sizeof(struct ip6_hdr);
 		break;
 #endif
         default:
 		ipipstat.ipips_family++;
 		m_freem(m);
 		return /* EAFNOSUPPORT */;
 	}
 
 	/* Bring the IP header in the first mbuf, if not there already */
 	if (m->m_len < hlen) {
 		if ((m = m_pullup(m, hlen)) == NULL) {
 			DPRINTF(("%s: m_pullup (1) failed\n", __func__));
 			ipipstat.ipips_hdrops++;
 			return;
 		}
 	}
 
 	ipo = mtod(m, struct ip *);
 
 #ifdef MROUTING
 	if (ipo->ip_v == IPVERSION && ipo->ip_p == IPPROTO_IPV4) {
 		if (IN_MULTICAST(((struct ip *)((char *) ipo + iphlen))->ip_dst.s_addr)) {
 			ipip_mroute_input (m, iphlen);
 			return;
 		}
 	}
 #endif /* MROUTING */
 
 	/* Keep outer ecn field. */
 	switch (v >> 4) {
 #ifdef INET
 	case 4:
 		otos = ipo->ip_tos;
 		break;
 #endif /* INET */
 #ifdef INET6
 	case 6:
 		otos = (ntohl(mtod(m, struct ip6_hdr *)->ip6_flow) >> 20) & 0xff;
 		break;
 #endif
 	default:
 		panic("ipip_input: unknown ip version %u (outer)", v>>4);
 	}
 
 	/* Remove outer IP header */
 	m_adj(m, iphlen);
 
 	/* Sanity check */
 	if (m->m_pkthdr.len < sizeof(struct ip))  {
 		ipipstat.ipips_hdrops++;
 		m_freem(m);
 		return;
 	}
 
 	m_copydata(m, 0, 1, &v);
 
 	switch (v >> 4) {
 #ifdef INET
         case 4:
 		hlen = sizeof(struct ip);
 		break;
 #endif /* INET */
 
 #ifdef INET6
         case 6:
 		hlen = sizeof(struct ip6_hdr);
 		break;
 #endif
 	default:
 		ipipstat.ipips_family++;
 		m_freem(m);
 		return; /* EAFNOSUPPORT */
 	}
 
 	/*
 	 * Bring the inner IP header in the first mbuf, if not there already.
 	 */
 	if (m->m_len < hlen) {
 		if ((m = m_pullup(m, hlen)) == NULL) {
 			DPRINTF(("%s: m_pullup (2) failed\n", __func__));
 			ipipstat.ipips_hdrops++;
 			return;
 		}
 	}
 
 	/*
 	 * RFC 1853 specifies that the inner TTL should not be touched on
 	 * decapsulation. There's no reason this comment should be here, but
 	 * this is as good as any a position.
 	 */
 
 	/* Some sanity checks in the inner IP header */
 	switch (v >> 4) {
 #ifdef INET
     	case 4:
                 ipo = mtod(m, struct ip *);
                 nxt = ipo->ip_p;
 		ip_ecn_egress(ip4_ipsec_ecn, &otos, &ipo->ip_tos);
                 break;
 #endif /* INET */
 #ifdef INET6
     	case 6:
                 ip6 = (struct ip6_hdr *) ipo;
                 nxt = ip6->ip6_nxt;
 		itos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
 		ip_ecn_egress(ip6_ipsec_ecn, &otos, &itos);
 		ip6->ip6_flow &= ~htonl(0xff << 20);
 		ip6->ip6_flow |= htonl((u_int32_t) itos << 20);
                 break;
 #endif
 	default:
 		panic("ipip_input: unknown ip version %u (inner)", v>>4);
 	}
 
 	/* Check for local address spoofing. */
 	if ((m->m_pkthdr.rcvif == NULL ||
 	    !(m->m_pkthdr.rcvif->if_flags & IFF_LOOPBACK)) &&
 	    ipip_allow != 2) {
 	    	IFNET_RLOCK();
 		TAILQ_FOREACH(ifp, &ifnet, if_link) {
 			TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
 #ifdef INET
 				if (ipo) {
 					if (ifa->ifa_addr->sa_family !=
 					    AF_INET)
 						continue;
 
 					sin = (struct sockaddr_in *) ifa->ifa_addr;
 
 					if (sin->sin_addr.s_addr ==
 					    ipo->ip_src.s_addr)	{
 						ipipstat.ipips_spoof++;
 						m_freem(m);
 						IFNET_RUNLOCK();
 						return;
 					}
 				}
 #endif /* INET */
 
 #ifdef INET6
 				if (ip6) {
 					if (ifa->ifa_addr->sa_family !=
 					    AF_INET6)
 						continue;
 
 					sin6 = (struct sockaddr_in6 *) ifa->ifa_addr;
 
 					if (IN6_ARE_ADDR_EQUAL(&sin6->sin6_addr, &ip6->ip6_src)) {
 						ipipstat.ipips_spoof++;
 						m_freem(m);
 						IFNET_RUNLOCK();
 						return;
 					}
 
 				}
 #endif /* INET6 */
 			}
 		}
 		IFNET_RUNLOCK();
 	}
 
 	/* Statistics */
 	ipipstat.ipips_ibytes += m->m_pkthdr.len - iphlen;
+
+#ifdef DEV_ENC
+	/* pass the mbuf to enc0 for packet filtering */
+	if (ipsec_filter(&m, 1) != 0)
+		return;
+#endif
 
 	/*
 	 * Interface pointer stays the same; if no IPsec processing has
 	 * been done (or will be done), this will point to a normal
 	 * interface. Otherwise, it'll point to an enc interface, which
 	 * will allow a packet filter to distinguish between secure and
 	 * untrusted packets.
 	 */
 
 	switch (v >> 4) {
 #ifdef INET
 	case 4:
 		isr = NETISR_IP;
 		break;
 #endif
 #ifdef INET6
 	case 6:
 		isr = NETISR_IPV6;
 		break;
 #endif
 	default:
 		panic("%s: bogus ip version %u", __func__, v>>4);
 	}
 
 	if (netisr_queue(isr, m)) {	/* (0) on success. */
 		ipipstat.ipips_qfull++;
 		DPRINTF(("%s: packet dropped because of full queue\n",
 			__func__));
 	}
 }
 
 int
 ipip_output(
 	struct mbuf *m,
 	struct ipsecrequest *isr,
 	struct mbuf **mp,
 	int skip,
 	int protoff
 )
 {
 	struct secasvar *sav;
 	u_int8_t tp, otos;
 	struct secasindex *saidx;
 	int error;
 #ifdef INET
 	u_int8_t itos;
 	struct ip *ipo;
 #endif /* INET */
 #ifdef INET6
 	struct ip6_hdr *ip6, *ip6o;
 #endif /* INET6 */
 
 	IPSEC_SPLASSERT_SOFTNET(__func__);
 
 	sav = isr->sav;
 	IPSEC_ASSERT(sav != NULL, ("null SA"));
 	IPSEC_ASSERT(sav->sah != NULL, ("null SAH"));
 
 	/* XXX Deal with empty TDB source/destination addresses. */
 
 	m_copydata(m, 0, 1, &tp);
 	tp = (tp >> 4) & 0xff;  /* Get the IP version number. */
 
 	saidx = &sav->sah->saidx;
 	switch (saidx->dst.sa.sa_family) {
 #ifdef INET
 	case AF_INET:
 		if (saidx->src.sa.sa_family != AF_INET ||
 		    saidx->src.sin.sin_addr.s_addr == INADDR_ANY ||
 		    saidx->dst.sin.sin_addr.s_addr == INADDR_ANY) {
 			DPRINTF(("%s: unspecified tunnel endpoint "
 			    "address in SA %s/%08lx\n", __func__,
 			    ipsec_address(&saidx->dst),
 			    (u_long) ntohl(sav->spi)));
 			ipipstat.ipips_unspec++;
 			error = EINVAL;
 			goto bad;
 		}
 
 		M_PREPEND(m, sizeof(struct ip), M_DONTWAIT);
 		if (m == 0) {
 			DPRINTF(("%s: M_PREPEND failed\n", __func__));
 			ipipstat.ipips_hdrops++;
 			error = ENOBUFS;
 			goto bad;
 		}
 
 		ipo = mtod(m, struct ip *);
 
 		ipo->ip_v = IPVERSION;
 		ipo->ip_hl = 5;
 		ipo->ip_len = htons(m->m_pkthdr.len);
 		ipo->ip_ttl = ip_defttl;
 		ipo->ip_sum = 0;
 		ipo->ip_src = saidx->src.sin.sin_addr;
 		ipo->ip_dst = saidx->dst.sin.sin_addr;
 
 		ipo->ip_id = ip_newid();
 
 		/* If the inner protocol is IP... */
 		if (tp == IPVERSION) {
 			/* Save ECN notification */
 			m_copydata(m, sizeof(struct ip) +
 			    offsetof(struct ip, ip_tos),
 			    sizeof(u_int8_t), (caddr_t) &itos);
 
 			ipo->ip_p = IPPROTO_IPIP;
 
 			/*
 			 * We should be keeping tunnel soft-state and
 			 * send back ICMPs if needed.
 			 */
 			m_copydata(m, sizeof(struct ip) +
 			    offsetof(struct ip, ip_off),
 			    sizeof(u_int16_t), (caddr_t) &ipo->ip_off);
 			ipo->ip_off = ntohs(ipo->ip_off);
 			ipo->ip_off &= ~(IP_DF | IP_MF | IP_OFFMASK);
 			ipo->ip_off = htons(ipo->ip_off);
 		}
 #ifdef INET6
 		else if (tp == (IPV6_VERSION >> 4)) {
 			u_int32_t itos32;
 
 			/* Save ECN notification. */
 			m_copydata(m, sizeof(struct ip) +
 			    offsetof(struct ip6_hdr, ip6_flow),
 			    sizeof(u_int32_t), (caddr_t) &itos32);
 			itos = ntohl(itos32) >> 20;
 			ipo->ip_p = IPPROTO_IPV6;
 			ipo->ip_off = 0;
 		}
 #endif /* INET6 */
 		else {
 			goto nofamily;
 		}
 
 		otos = 0;
 		ip_ecn_ingress(ECN_ALLOWED, &otos, &itos);
 		ipo->ip_tos = otos;
 		break;
 #endif /* INET */
 
 #ifdef INET6
 	case AF_INET6:
 		if (IN6_IS_ADDR_UNSPECIFIED(&saidx->dst.sin6.sin6_addr) ||
 		    saidx->src.sa.sa_family != AF_INET6 ||
 		    IN6_IS_ADDR_UNSPECIFIED(&saidx->src.sin6.sin6_addr)) {
 			DPRINTF(("%s: unspecified tunnel endpoint "
 			    "address in SA %s/%08lx\n", __func__,
 			    ipsec_address(&saidx->dst),
 			    (u_long) ntohl(sav->spi)));
 			ipipstat.ipips_unspec++;
 			error = ENOBUFS;
 			goto bad;
 		}
 
 		/* scoped address handling */
 		ip6 = mtod(m, struct ip6_hdr *);
 		if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_src))
 			ip6->ip6_src.s6_addr16[1] = 0;
 		if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst))
 			ip6->ip6_dst.s6_addr16[1] = 0;
 
 		M_PREPEND(m, sizeof(struct ip6_hdr), M_DONTWAIT);
 		if (m == 0) {
 			DPRINTF(("%s: M_PREPEND failed\n", __func__));
 			ipipstat.ipips_hdrops++;
 			error = ENOBUFS;
 			goto bad;
 		}
 
 		/* Initialize IPv6 header */
 		ip6o = mtod(m, struct ip6_hdr *);
 		ip6o->ip6_flow = 0;
 		ip6o->ip6_vfc &= ~IPV6_VERSION_MASK;
 		ip6o->ip6_vfc |= IPV6_VERSION;
 		ip6o->ip6_plen = htons(m->m_pkthdr.len);
 		ip6o->ip6_hlim = ip_defttl;
 		ip6o->ip6_dst = saidx->dst.sin6.sin6_addr;
 		ip6o->ip6_src = saidx->src.sin6.sin6_addr;
 
 #ifdef INET
 		if (tp == IPVERSION) {
 			/* Save ECN notification */
 			m_copydata(m, sizeof(struct ip6_hdr) +
 			    offsetof(struct ip, ip_tos), sizeof(u_int8_t),
 			    (caddr_t) &itos);
 
 			/* This is really IPVERSION. */
 			ip6o->ip6_nxt = IPPROTO_IPIP;
 		} else
 #endif /* INET */
 			if (tp == (IPV6_VERSION >> 4)) {
 				u_int32_t itos32;
 
 				/* Save ECN notification. */
 				m_copydata(m, sizeof(struct ip6_hdr) +
 				    offsetof(struct ip6_hdr, ip6_flow),
 				    sizeof(u_int32_t), (caddr_t) &itos32);
 				itos = ntohl(itos32) >> 20;
 
 				ip6o->ip6_nxt = IPPROTO_IPV6;
 			} else {
 				goto nofamily;
 			}
 
 		otos = 0;
 		ip_ecn_ingress(ECN_ALLOWED, &otos, &itos);
 		ip6o->ip6_flow |= htonl((u_int32_t) otos << 20);
 		break;
 #endif /* INET6 */
 
 	default:
 nofamily:
 		DPRINTF(("%s: unsupported protocol family %u\n", __func__,
 		    saidx->dst.sa.sa_family));
 		ipipstat.ipips_family++;
 		error = EAFNOSUPPORT;		/* XXX diffs from openbsd */
 		goto bad;
 	}
 
 	ipipstat.ipips_opackets++;
 	*mp = m;
 
 #ifdef INET
 	if (saidx->dst.sa.sa_family == AF_INET) {
 #if 0
 		if (sav->tdb_xform->xf_type == XF_IP4)
 			tdb->tdb_cur_bytes +=
 			    m->m_pkthdr.len - sizeof(struct ip);
 #endif
 		ipipstat.ipips_obytes += m->m_pkthdr.len - sizeof(struct ip);
 	}
 #endif /* INET */
 
 #ifdef INET6
 	if (saidx->dst.sa.sa_family == AF_INET6) {
 #if 0
 		if (sav->tdb_xform->xf_type == XF_IP4)
 			tdb->tdb_cur_bytes +=
 			    m->m_pkthdr.len - sizeof(struct ip6_hdr);
 #endif
 		ipipstat.ipips_obytes +=
 		    m->m_pkthdr.len - sizeof(struct ip6_hdr);
 	}
 #endif /* INET6 */
 
 	return 0;
 bad:
 	if (m)
 		m_freem(m);
 	*mp = NULL;
 	return (error);
 }
 
 #ifdef FAST_IPSEC
 static int
 ipe4_init(struct secasvar *sav, struct xformsw *xsp)
 {
 	sav->tdb_xform = xsp;
 	return 0;
 }
 
 static int
 ipe4_zeroize(struct secasvar *sav)
 {
 	sav->tdb_xform = NULL;
 	return 0;
 }
 
 static int
 ipe4_input(struct mbuf *m, struct secasvar *sav, int skip, int protoff)
 {
 	/* This is a rather serious mistake, so no conditional printing. */
 	printf("%s: should never be called\n", __func__);
 	if (m)
 		m_freem(m);
 	return EOPNOTSUPP;
 }
 
 static struct xformsw ipe4_xformsw = {
 	XF_IP4,		0,		"IPv4 Simple Encapsulation",
 	ipe4_init,	ipe4_zeroize,	ipe4_input,	ipip_output,
 };
 
 extern struct domain inetdomain;
 static struct protosw ipe4_protosw =
 { SOCK_RAW,	&inetdomain,	IPPROTO_IPV4,	PR_ATOMIC|PR_ADDR|PR_LASTHDR,
   ip4_input,
 		0, 		0,		rip_ctloutput,
   0,
   0,		0,		0,		0,
   &rip_usrreqs
 };
 #ifdef INET6
 static struct ip6protosw ipe6_protosw =
 { SOCK_RAW,	&inetdomain,	IPPROTO_IPV6,	PR_ATOMIC|PR_ADDR|PR_LASTHDR,
   ip4_input6,
 		0,	 	0,		rip_ctloutput,
   0,
   0,		0,		0,		0,
   &rip_usrreqs
 };
 #endif
 
 /*
  * Check the encapsulated packet to see if we want it
  */
 static int
 ipe4_encapcheck(const struct mbuf *m, int off, int proto, void *arg)
 {
 	/*
 	 * Only take packets coming from IPSEC tunnels; the rest
 	 * must be handled by the gif tunnel code.  Note that we
 	 * also return a minimum priority when we want the packet
 	 * so any explicit gif tunnels take precedence.
 	 */
 	return ((m->m_flags & M_IPSEC) != 0 ? 1 : 0);
 }
 
 static void
 ipe4_attach(void)
 {
 	xform_register(&ipe4_xformsw);
 	/* attach to encapsulation framework */
 	/* XXX save return cookie for detach on module remove */
 	(void) encap_attach_func(AF_INET, -1,
 		ipe4_encapcheck, &ipe4_protosw, NULL);
 #ifdef INET6
 	(void) encap_attach_func(AF_INET6, -1,
 		ipe4_encapcheck, (struct protosw *)&ipe6_protosw, NULL);
 #endif
 }
 SYSINIT(ipe4_xform_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_MIDDLE, ipe4_attach, NULL);
 #endif	/* FAST_IPSEC */