Announce both IPsec and UDP Encap (NAT-T) if available for
  feature_present(3) checks.

  This will help to run-time detect and conditionally handle specific
  optionas of either feature in user space (i.e. in libipsec).

  Descriptions read by: rwatson

  Make the IPsec SADB embedded route cache a union to be able to hold both the
  legacy and IPv6 route destination address.
  Previously in case of IPv6, there was a memory overwrite due to not enough
  space for the IPv6 address.

PR:		kern/122565

  Remove dead code:
  assignment to a local variable not used anywhere after that.

  Style: make the asterisk go with the variable name, not the type.

  MFp4 @178283:

  Improve IPsec flow distribution for better netisr parallelism.
  Instead of using the pointer that would have the last bits masked in a %
  statement in netisr_select_cpuid() to select the queue, use the SPI.

  Reviewed by:  rwatson

This can prevent kernel panics when updating SPs while there is
some traffic for them.

Obtained from:	NETASQ

Set/update SA's NAT-T stuff before calling key_mature() in
key_add() and key_update(), as the SA may be used as soon as
key_mature() has been called

Obtained from: NETASQ

  MFP4: @176978-176982, 176984, 176990-176994, 177441

  "Whitspace" churn after the VIMAGE/VNET whirls.

  Remove the need for some "init" functions within the network
  stack, like pim6_init(), icmp_init() or significantly shorten
  others like ip6_init() and nd6_init(), using static initialization
  again where possible and formerly missed.

  Move (most) variables back to the place they used to be before the
  container structs and VIMAGE_GLOABLS (before r185088) and try to
  reduce the diff to stable/7 and earlier as good as possible,
  to help out-of-tree consumers to update from 6.x or 7.x to 8 or 9.

  This also removes some header file pollution for putatively
  static global variables.

  Revert VIMAGE specific changes in ipfilter::ip_auth.c, that are
  no longer needed.

  Reviewed by:	jhb
  Discussed with:	rwatson
  Sponsored by:	The FreeBSD Foundation
  Sponsored by:	CK Software GmbH

  When tearing down IPsec as part of a (virtual) network stack,
  do not try to free the same list twice but free both the
  acquiring list and the security policy acquiring list.

  Reviewed by:  anchie

  Enable IPcomp by default.

PR:	kern/123587