Itojun,


Thanks very much for the heads-up and the OpenBSD patch.  (ISTR Markus
was working on this since you raised the issue again with Sam Leffler:
is this the same fix you mentioned then?)  I'll merge this into the
code I have in very short order (like, Wednesday, unless the day-job
intervenes).


I still propose to first commit a snapshot of FAST_IPSEC from before
this fix. That commit will work (for some version of "work"); but will
exist mostly for reference purposes. Then I'll commit the transport-mode
fix as a subsequent change, *before* announcing FAST_IPSEC for general availability.
That  way we have a CVS record of something which can still be diffed
against the FreeBSED version, for maintenance purposes.

(I currently use a header file with a bunch of macros to map between
various FreeBSD global variables and struct field names.  If desired,
I will replace those macros with with native NetBSD versions, right
before committing the two-trips-through- ip_input() issue. Plus
anything else found in the meantime.)