Change processing sequence:  - if the source IP address if unset (INADDR_ANY)    - if higher level protocol has cached the SA to use, and the SA specifies      the source address, use that    - otherwise, do a routing lookup to determine our outgoing interface      and fix the source address  - do an SPD lookup (which is why we needed the source address)    - if no IPsec is needed, proceed to multicast processing (if necessary),      IPF, etc. -- transmit the packet as usual; use the routing information      from before (if routing lookup was performed), or do a routing lookup      at this point.    - if IPsec is needed, do multicast processing (if needed), then do      IPsec processing, then call ip_output() recursively. Currently,      the second invocation does not do another SPD lookup (it will be      changed to do so in the near future, to support independent nested      tunnels without infinite loops).
Change processing sequence:
 - if the source IP address if unset (INADDR_ANY)
   - if higher level protocol has cached the SA to use, and the SA specifies
     the source address, use that
   - otherwise, do a routing lookup to determine our outgoing interface
     and fix the source address
 - do an SPD lookup (which is why we needed the source address)
   - if no IPsec is needed, proceed to multicast processing (if necessary),
     IPF, etc. -- transmit the packet as usual; use the routing information
     from before (if routing lookup was performed), or do a routing lookup
     at this point.
   - if IPsec is needed, do multicast processing (if needed), then do
     IPsec processing, then call ip_output() recursively. Currently,
     the second invocation does not do another SPD lookup (it will be
     changed to do so in the near future, to support independent nested
     tunnels without infinite loops).

Note that if the inner packet (the one that will have IPsec applied to) is
multicast or broadcast, the interface flags are not checked (since it's not
clear what their meaning is in this case). If the IPsec destination address
is multicast/broadcast, the interface flags are checked of course.

It is no longer necessary to have routing entries for private networks on
IPsec gateways (or default routing entries if they're not needed, for that
matter).

Finally, this patch solves a problem with ever-increasing reference counts
on routing entries when doing IPsec processing.

orumin/openbsd-efivars,orumin/openbsd-efivars,orumin/openbsd-efivars,orumin/openbsd-efivars