main/strongswan: add patches for quagga/nrhpd support

5 files changed, 968 insertions, 1 deletions

diff --git a/main/strongswan/0001-charon-add-optional-source-and-remote-overrides-for-.patch b/main/strongswan/0001-charon-add-optional-source-and-remote-overrides-for-.patch
new file mode 100644
index 000000000..9bd1030d8
--- /dev/null
+++ b/main/strongswan/0001-charon-add-optional-source-and-remote-overrides-for-.patch
@@ -0,0 +1,585 @@
+From 75c546a8000f4ac294710e8d2b972587e14ad229 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
+Date: Wed, 27 Aug 2014 16:05:21 +0300
+Subject: [PATCH 1/4] charon: add optional source and remote overrides for
+ initiate
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This introduces support for specifying optional IKE SA specific
+source and remote address for child sa initiation. This allows
+to initiate wildcard connection for known address via vici.
+
+In addition this allows impler implementation of trap-any patches
+and is a prerequisite for dmvpn support.
+
+Signed-off-by: Timo Teräs <timo.teras@iki.fi>
+---
+ src/charon-cmd/cmd/cmd_connection.c                |  2 +-
+ src/charon-nm/nm/nm_service.c                      |  2 +-
+ src/libcharon/control/controller.c                 | 43 +++++++++++++++-
+ src/libcharon/control/controller.h                 |  3 ++
+ src/libcharon/plugins/maemo/maemo_service.c        |  2 +-
+ src/libcharon/plugins/stroke/stroke_control.c      |  5 +-
+ src/libcharon/plugins/vici/vici_config.c           |  2 +-
+ src/libcharon/plugins/vici/vici_control.c          | 58 ++++++++++++++++++---
+ src/libcharon/processing/jobs/start_action_job.c   |  2 +-
+ src/libcharon/sa/ike_sa.c                          |  4 ++
+ src/libcharon/sa/ike_sa_manager.c                  | 60 +++++++++++++++++++---
+ src/libcharon/sa/ike_sa_manager.h                  |  8 ++-
+ src/libcharon/sa/trap_manager.c                    |  3 +-
+ src/swanctl/commands/initiate.c                    | 40 ++++++++++++++-
+ 15 files changed, 210 insertions(+), 26 deletions(-)
+
+diff --git a/src/charon-cmd/cmd/cmd_connection.c b/src/charon-cmd/cmd/cmd_connection.c
+index 2c0b7b9..471b444 100644
+--- a/src/charon-cmd/cmd/cmd_connection.c
++++ b/src/charon-cmd/cmd/cmd_connection.c
+@@ -434,7 +434,7 @@ static job_requeue_t initiate(private_cmd_connection_t *this)
+ 	child_cfg = create_child_cfg(this, peer_cfg);
+ 
+ 	if (charon->controller->initiate(charon->controller, peer_cfg, child_cfg,
+-									 controller_cb_empty, NULL, 0) != SUCCESS)
++									 NULL, NULL, controller_cb_empty, NULL, 0) != SUCCESS)
+ 	{
+ 		terminate(pid);
+ 	}
+diff --git a/src/charon-nm/nm/nm_service.c b/src/charon-nm/nm/nm_service.c
+index fc7e899..4f4461a 100644
+--- a/src/charon-nm/nm/nm_service.c
++++ b/src/charon-nm/nm/nm_service.c
+@@ -579,7 +579,7 @@ static gboolean connect_(NMVPNPlugin *plugin, NMConnection *connection,
+ 	 * Prepare IKE_SA
+ 	 */
+ 	ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager,
+-														peer_cfg);
++														peer_cfg, NULL, NULL);
+ 	if (!ike_sa)
+ 	{
+ 		peer_cfg->destroy(peer_cfg);
+diff --git a/src/libcharon/control/controller.c b/src/libcharon/control/controller.c
+index fd8349e..665c2fa 100644
+--- a/src/libcharon/control/controller.c
++++ b/src/libcharon/control/controller.c
+@@ -15,6 +15,28 @@
+  * for more details.
+  */
+ 
++/*
++ * Copyright (C) 2014 Timo Teräs <timo.teras@iki.fi>
++ *
++ * Permission is hereby granted, free of charge, to any person obtaining a copy
++ * of this software and associated documentation files (the "Software"), to deal
++ * in the Software without restriction, including without limitation the rights
++ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
++ * copies of the Software, and to permit persons to whom the Software is
++ * furnished to do so, subject to the following conditions:
++ *
++ * The above copyright notice and this permission notice shall be included in
++ * all copies or substantial portions of the Software.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
++ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
++ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
++ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
++ * THE SOFTWARE.
++ */
++
+ #include "controller.h"
+ 
+ #include <sys/types.h>
+@@ -103,6 +125,16 @@ struct interface_listener_t {
+ 	ike_sa_t *ike_sa;
+ 
+ 	/**
++	 * Our host hint.
++	 */
++	host_t *my_host;
++
++	/**
++	 * Other host hint.
++	 */
++	host_t *other_host;
++
++	/**
+ 	 * unique ID, used for various methods
+ 	 */
+ 	u_int32_t id;
+@@ -350,9 +382,14 @@ METHOD(job_t, initiate_execute, job_requeue_t,
+ 	ike_sa_t *ike_sa;
+ 	interface_listener_t *listener = &job->listener;
+ 	peer_cfg_t *peer_cfg = listener->peer_cfg;
++	host_t *my_host = listener->my_host;
++	host_t *other_host = listener->other_host;
+ 
+ 	ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager,
+-														peer_cfg);
++														peer_cfg, my_host, other_host);
++	DESTROY_IF(my_host);
++	DESTROY_IF(other_host);
++
+ 	if (!ike_sa)
+ 	{
+ 		listener->child_cfg->destroy(listener->child_cfg);
+@@ -362,6 +399,7 @@ METHOD(job_t, initiate_execute, job_requeue_t,
+ 		listener_done(listener);
+ 		return JOB_REQUEUE_NONE;
+ 	}
++
+ 	listener->lock->lock(listener->lock);
+ 	listener->ike_sa = ike_sa;
+ 	listener->lock->unlock(listener->lock);
+@@ -391,6 +429,7 @@ METHOD(job_t, initiate_execute, job_requeue_t,
+ 
+ METHOD(controller_t, initiate, status_t,
+ 	private_controller_t *this, peer_cfg_t *peer_cfg, child_cfg_t *child_cfg,
++	host_t *my_host, host_t *other_host,
+ 	controller_cb_t callback, void *param, u_int timeout)
+ {
+ 	interface_job_t *job;
+@@ -413,6 +452,8 @@ METHOD(controller_t, initiate, status_t,
+ 			.status = FAILED,
+ 			.child_cfg = child_cfg,
+ 			.peer_cfg = peer_cfg,
++			.my_host = my_host ? my_host->clone(my_host) : NULL,
++			.other_host = other_host ? other_host->clone(other_host) : NULL,
+ 			.lock = spinlock_create(),
+ 		},
+ 		.public = {
+diff --git a/src/libcharon/control/controller.h b/src/libcharon/control/controller.h
+index 02f4ebb..e70f2b5 100644
+--- a/src/libcharon/control/controller.h
++++ b/src/libcharon/control/controller.h
+@@ -79,6 +79,8 @@ struct controller_t {
+ 	 *
+ 	 * @param peer_cfg		peer_cfg to use for IKE_SA setup
+ 	 * @param child_cfg		child_cfg to set up CHILD_SA from
++	 * @param my_host		optional address hint for source
++	 * @param other_host	optional address hint for destination
+ 	 * @param cb			logging callback
+ 	 * @param param			parameter to include in each call of cb
+ 	 * @param timeout		timeout in ms to wait for callbacks, 0 to disable
+@@ -90,6 +92,7 @@ struct controller_t {
+ 	 */
+ 	status_t (*initiate)(controller_t *this,
+ 						 peer_cfg_t *peer_cfg, child_cfg_t *child_cfg,
++						 host_t *my_host, host_t *other_host,
+ 						 controller_cb_t callback, void *param, u_int timeout);
+ 
+ 	/**
+diff --git a/src/libcharon/plugins/maemo/maemo_service.c b/src/libcharon/plugins/maemo/maemo_service.c
+index 2e96f8f..e594a71 100644
+--- a/src/libcharon/plugins/maemo/maemo_service.c
++++ b/src/libcharon/plugins/maemo/maemo_service.c
+@@ -362,7 +362,7 @@ static gboolean initiate_connection(private_maemo_service_t *this,
+ 
+ 	/* get us an IKE_SA */
+ 	ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager,
+-														peer_cfg);
++														peer_cfg, NULL, NULL);
+ 	if (!ike_sa)
+ 	{
+ 		peer_cfg->destroy(peer_cfg);
+diff --git a/src/libcharon/plugins/stroke/stroke_control.c b/src/libcharon/plugins/stroke/stroke_control.c
+index 0084fbf..e5f38b4 100644
+--- a/src/libcharon/plugins/stroke/stroke_control.c
++++ b/src/libcharon/plugins/stroke/stroke_control.c
+@@ -109,7 +109,7 @@ static void charon_initiate(private_stroke_control_t *this, peer_cfg_t *peer_cfg
+ 	if (msg->output_verbosity < 0)
+ 	{
+ 		charon->controller->initiate(charon->controller, peer_cfg, child_cfg,
+-									 NULL, NULL, 0);
++									 NULL, NULL, NULL, NULL, 0);
+ 	}
+ 	else
+ 	{
+@@ -117,7 +117,8 @@ static void charon_initiate(private_stroke_control_t *this, peer_cfg_t *peer_cfg
+ 		status_t status;
+ 
+ 		status = charon->controller->initiate(charon->controller,
+-							peer_cfg, child_cfg, (controller_cb_t)stroke_log,
++							peer_cfg, child_cfg, NULL, NULL,
++							(controller_cb_t)stroke_log,
+ 							&info, this->timeout);
+ 		switch (status)
+ 		{
+diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c
+index d232599..3c4e3ec 100644
+--- a/src/libcharon/plugins/vici/vici_config.c
++++ b/src/libcharon/plugins/vici/vici_config.c
+@@ -1558,7 +1558,7 @@ static void run_start_action(private_vici_config_t *this, peer_cfg_t *peer_cfg,
+ 			DBG1(DBG_CFG, "initiating '%s'", child_cfg->get_name(child_cfg));
+ 			charon->controller->initiate(charon->controller,
+ 					peer_cfg->get_ref(peer_cfg), child_cfg->get_ref(child_cfg),
+-					NULL, NULL, 0);
++					NULL, NULL, NULL, NULL, 0);
+ 			break;
+ 		case ACTION_ROUTE:
+ 			DBG1(DBG_CFG, "installing '%s'", child_cfg->get_name(child_cfg));
+diff --git a/src/libcharon/plugins/vici/vici_control.c b/src/libcharon/plugins/vici/vici_control.c
+index 01d5036..9a58399 100644
+--- a/src/libcharon/plugins/vici/vici_control.c
++++ b/src/libcharon/plugins/vici/vici_control.c
+@@ -13,6 +13,28 @@
+  * for more details.
+  */
+ 
++/*
++ * Copyright (C) 2014 Timo Teräs <timo.teras@iki.fi>
++ *
++ * Permission is hereby granted, free of charge, to any person obtaining a copy
++ * of this software and associated documentation files (the "Software"), to deal
++ * in the Software without restriction, including without limitation the rights
++ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
++ * copies of the Software, and to permit persons to whom the Software is
++ * furnished to do so, subject to the following conditions:
++ *
++ * The above copyright notice and this permission notice shall be included in
++ * all copies or substantial portions of the Software.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
++ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
++ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
++ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
++ * THE SOFTWARE.
++ */
++
+ #include "vici_control.h"
+ #include "vici_builder.h"
+ 
+@@ -159,9 +181,11 @@ static child_cfg_t* find_child_cfg(char *name, peer_cfg_t **out)
+ CALLBACK(initiate, vici_message_t*,
+ 	private_vici_control_t *this, char *name, u_int id, vici_message_t *request)
+ {
++	vici_message_t* msg;
+ 	child_cfg_t *child_cfg = NULL;
+ 	peer_cfg_t *peer_cfg;
+-	char *child;
++	host_t *my_host = NULL, *other_host = NULL;
++	char *child, *my_host_str, *other_host_str;
+ 	u_int timeout;
+ 	log_info_t log = {
+ 		.dispatcher = this->dispatcher,
+@@ -171,31 +195,51 @@ CALLBACK(initiate, vici_message_t*,
+ 	child = request->get_str(request, NULL, "child");
+ 	timeout = request->get_int(request, 0, "timeout");
+ 	log.level = request->get_int(request, 1, "loglevel");
++	my_host_str = request->get_str(request, NULL, "my-host");
++	other_host_str = request->get_str(request, NULL, "other-host");
+ 
+ 	if (!child)
+ 	{
+ 		return send_reply(this, "missing configuration name");
+ 	}
+ 
+-	DBG1(DBG_CFG, "vici initiate '%s'", child);
++	if (my_host_str)
++	{
++		my_host = host_create_from_string(my_host_str, 0);
++	}
++	if (other_host_str)
++	{
++		other_host = host_create_from_string(other_host_str, 0);
++	}
++
++	DBG1(DBG_CFG, "vici initiate '%s', me %H, other %H", child, my_host, other_host);
+ 
+ 	child_cfg = find_child_cfg(child, &peer_cfg);
+ 	if (!child_cfg)
+ 	{
+-		return send_reply(this, "CHILD_SA config '%s' not found", child);
++		msg = send_reply(this, "CHILD_SA config '%s' not found", child);
++		goto ret;
+ 	}
+ 	switch (charon->controller->initiate(charon->controller,
+-				peer_cfg, child_cfg, (controller_cb_t)log_vici, &log, timeout))
++				peer_cfg, child_cfg, my_host, other_host,
++				(controller_cb_t)log_vici, &log, timeout))
+ 	{
+ 		case SUCCESS:
+-			return send_reply(this, NULL);
++			msg = send_reply(this, NULL);
++			break;
+ 		case OUT_OF_RES:
+-			return send_reply(this, "CHILD_SA '%s' not established after %dms",
++			msg = send_reply(this, "CHILD_SA '%s' not established after %dms",
+ 							  child, timeout);
++			break;
+ 		case FAILED:
+ 		default:
+-			return send_reply(this, "establishing CHILD_SA '%s' failed", child);
++			msg = send_reply(this, "establishing CHILD_SA '%s' failed", child);
++			break;
+ 	}
++ret:
++	if (my_host) my_host->destroy(my_host);
++	if (other_host) other_host->destroy(other_host);
++	return msg;
+ }
+ 
+ CALLBACK(terminate, vici_message_t*,
+diff --git a/src/libcharon/processing/jobs/start_action_job.c b/src/libcharon/processing/jobs/start_action_job.c
+index 981473b..fd42f3b 100644
+--- a/src/libcharon/processing/jobs/start_action_job.c
++++ b/src/libcharon/processing/jobs/start_action_job.c
+@@ -61,7 +61,7 @@ METHOD(job_t, execute, job_requeue_t,
+ 					charon->controller->initiate(charon->controller,
+ 												 peer_cfg->get_ref(peer_cfg),
+ 												 child_cfg->get_ref(child_cfg),
+-												 NULL, NULL, 0);
++												 NULL, NULL, NULL, NULL, 0);
+ 					break;
+ 				case ACTION_ROUTE:
+ 					DBG1(DBG_JOB, "start action: route '%s'", name);
+diff --git a/src/libcharon/sa/ike_sa.c b/src/libcharon/sa/ike_sa.c
+index 3aafa4c..dcd54a1 100644
+--- a/src/libcharon/sa/ike_sa.c
++++ b/src/libcharon/sa/ike_sa.c
+@@ -1208,6 +1208,10 @@ static void resolve_hosts(private_ike_sa_t *this)
+ 	else
+ 	{
+ 		host = this->ike_cfg->resolve_other(this->ike_cfg, family);
++		if (host->is_anyaddr(host))
++		{
++			host = NULL;
++		}
+ 	}
+ 	if (host)
+ 	{
+diff --git a/src/libcharon/sa/ike_sa_manager.c b/src/libcharon/sa/ike_sa_manager.c
+index 938f784..23d0488 100644
+--- a/src/libcharon/sa/ike_sa_manager.c
++++ b/src/libcharon/sa/ike_sa_manager.c
+@@ -16,6 +16,28 @@
+  * for more details.
+  */
+ 
++/*
++ * Copyright (C) 2014 Timo Teräs <timo.teras@iki.fi>
++ *
++ * Permission is hereby granted, free of charge, to any person obtaining a copy
++ * of this software and associated documentation files (the "Software"), to deal
++ * in the Software without restriction, including without limitation the rights
++ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
++ * copies of the Software, and to permit persons to whom the Software is
++ * furnished to do so, subject to the following conditions:
++ *
++ * The above copyright notice and this permission notice shall be included in
++ * all copies or substantial portions of the Software.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
++ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
++ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
++ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
++ * THE SOFTWARE.
++ */
++
+ #include <string.h>
+ 
+ #include "ike_sa_manager.h"
+@@ -1328,16 +1350,28 @@ METHOD(ike_sa_manager_t, checkout_by_message, ike_sa_t*,
+ }
+ 
+ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
+-	private_ike_sa_manager_t *this, peer_cfg_t *peer_cfg)
++	private_ike_sa_manager_t *this, peer_cfg_t *peer_cfg,
++	host_t *my_host, host_t *other_host)
+ {
+ 	enumerator_t *enumerator;
+ 	entry_t *entry;
+-	ike_sa_t *ike_sa = NULL;
++	ike_sa_t *ike_sa;
+ 	peer_cfg_t *current_peer;
+ 	ike_cfg_t *current_ike;
+ 	u_int segment;
++	bool matched = FALSE;
+ 
+-	DBG2(DBG_MGR, "checkout IKE_SA by config");
++	if (my_host && my_host->get_port(my_host) == 0)
++	{
++		my_host->set_port(my_host, IKEV2_UDP_PORT);
++	}
++	if (other_host && other_host->get_port(other_host) == 0)
++	{
++		other_host->set_port(other_host, IKEV2_UDP_PORT);
++	}
++
++	DBG2(DBG_MGR, "checkout IKE_SA by config '%s', me %H, other %H",
++		 peer_cfg->get_name(peer_cfg), my_host, other_host);
+ 
+ 	if (!this->reuse_ikesa)
+ 	{	/* IKE_SA reuse disable by config */
+@@ -1358,14 +1392,24 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
+ 			continue;
+ 		}
+ 
+-		current_peer = entry->ike_sa->get_peer_cfg(entry->ike_sa);
++		ike_sa = entry->ike_sa;
++		if (my_host && !my_host->ip_equals(my_host, ike_sa->get_my_host(ike_sa)))
++		{
++			continue;
++		}
++		if (other_host && !other_host->ip_equals(other_host, ike_sa->get_other_host(ike_sa)))
++		{
++			continue;
++		}
++
++		current_peer = ike_sa->get_peer_cfg(ike_sa);
+ 		if (current_peer && current_peer->equals(current_peer, peer_cfg))
+ 		{
+ 			current_ike = current_peer->get_ike_cfg(current_peer);
+ 			if (current_ike->equals(current_ike, peer_cfg->get_ike_cfg(peer_cfg)))
+ 			{
+ 				entry->checked_out = TRUE;
+-				ike_sa = entry->ike_sa;
++				matched = TRUE;
+ 				DBG2(DBG_MGR, "found existing IKE_SA %u with a '%s' config",
+ 						ike_sa->get_unique_id(ike_sa),
+ 						current_peer->get_name(current_peer));
+@@ -1375,9 +1419,13 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
+ 	}
+ 	enumerator->destroy(enumerator);
+ 
+-	if (!ike_sa)
++	if (!matched)
+ 	{	/* no IKE_SA using such a config, hand out a new */
+ 		ike_sa = checkout_new(this, peer_cfg->get_ike_version(peer_cfg), TRUE);
++		if (my_host || other_host)
++		{
++			ike_sa->update_hosts(ike_sa, my_host, other_host, TRUE);
++		}
+ 	}
+ 	charon->bus->set_sa(charon->bus, ike_sa);
+ 	return ike_sa;
+diff --git a/src/libcharon/sa/ike_sa_manager.h b/src/libcharon/sa/ike_sa_manager.h
+index f259d8e..5a69083 100644
+--- a/src/libcharon/sa/ike_sa_manager.h
++++ b/src/libcharon/sa/ike_sa_manager.h
+@@ -83,7 +83,8 @@ struct ike_sa_manager_t {
+ 	ike_sa_t* (*checkout_by_message) (ike_sa_manager_t* this, message_t *message);
+ 
+ 	/**
+-	 * Checkout an IKE_SA for initiation by a peer_config.
++	 * Checkout an IKE_SA for initiation by a peer_config and optional
++	 * source and remote host addresses.
+ 	 *
+ 	 * To initiate, a CHILD_SA may be established within an existing IKE_SA.
+ 	 * This call checks for an existing IKE_SA by comparing the configuration.
+@@ -93,10 +94,13 @@ struct ike_sa_manager_t {
+ 	 * the found IKE_SA is in the DELETING state.
+ 	 *
+ 	 * @param peer_cfg			configuration used to find an existing IKE_SA
++	 * @param my_host			source host address for wildcard peer_cfg
++	 * @param other_host		remote host address for wildcard peer_cfg
+ 	 * @return					checked out/created IKE_SA
+ 	 */
+ 	ike_sa_t* (*checkout_by_config) (ike_sa_manager_t* this,
+-									 peer_cfg_t *peer_cfg);
++									 peer_cfg_t *peer_cfg,
++									 host_t *my_host, host_t *other_host);
+ 
+ 	/**
+ 	 * Check for duplicates of the given IKE_SA.
+diff --git a/src/libcharon/sa/trap_manager.c b/src/libcharon/sa/trap_manager.c
+index d6ff3c8..eeb188e 100644
+--- a/src/libcharon/sa/trap_manager.c
++++ b/src/libcharon/sa/trap_manager.c
+@@ -351,7 +351,8 @@ METHOD(trap_manager_t, acquire, void,
+ 	this->lock->unlock(this->lock);
+ 
+ 	ike_sa = charon->ike_sa_manager->checkout_by_config(
+-											charon->ike_sa_manager, peer);
++											charon->ike_sa_manager, peer,
++											NULL, NULL);
+ 	if (ike_sa)
+ 	{
+ 		if (ike_sa->get_peer_cfg(ike_sa) == NULL)
+diff --git a/src/swanctl/commands/initiate.c b/src/swanctl/commands/initiate.c
+index eb7b6ad..706fa57 100644
+--- a/src/swanctl/commands/initiate.c
++++ b/src/swanctl/commands/initiate.c
+@@ -13,6 +13,28 @@
+  * for more details.
+  */
+ 
++/*
++ * Copyright (C) 2014 Timo Teräs <timo.teras@iki.fi>
++ *
++ * Permission is hereby granted, free of charge, to any person obtaining a copy
++ * of this software and associated documentation files (the "Software"), to deal
++ * in the Software without restriction, including without limitation the rights
++ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
++ * copies of the Software, and to permit persons to whom the Software is
++ * furnished to do so, subject to the following conditions:
++ *
++ * The above copyright notice and this permission notice shall be included in
++ * all copies or substantial portions of the Software.
++ *
++ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
++ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
++ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
++ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
++ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
++ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
++ * THE SOFTWARE.
++ */
++
+ #include "command.h"
+ 
+ #include <errno.h>
+@@ -37,7 +59,7 @@ static int initiate(vici_conn_t *conn)
+ 	vici_req_t *req;
+ 	vici_res_t *res;
+ 	command_format_options_t format = COMMAND_FORMAT_NONE;
+-	char *arg, *child = NULL;
++	char *arg, *child = NULL, *my_host = NULL, *other_host = NULL;
+ 	int ret = 0, timeout = 0, level = 1;
+ 
+ 	while (TRUE)
+@@ -61,6 +83,12 @@ static int initiate(vici_conn_t *conn)
+ 			case 'l':
+ 				level = atoi(arg);
+ 				continue;
++			case 'S':
++				my_host = arg;
++				continue;
++			case 'R':
++				other_host = arg;
++				continue;
+ 			case EOF:
+ 				break;
+ 			default:
+@@ -80,6 +108,14 @@ static int initiate(vici_conn_t *conn)
+ 	{
+ 		vici_add_key_valuef(req, "child", "%s", child);
+ 	}
++	if (my_host)
++	{
++		vici_add_key_valuef(req, "my-host", "%s", my_host);
++	}
++	if (other_host)
++	{
++		vici_add_key_valuef(req, "other-host", "%s", other_host);
++	}
+ 	if (timeout)
+ 	{
+ 		vici_add_key_valuef(req, "timeout", "%d", timeout * 1000);
+@@ -125,6 +161,8 @@ static void __attribute__ ((constructor))reg()
+ 		{
+ 			{"help",		'h', 0, "show usage information"},
+ 			{"child",		'c', 1, "initate a CHILD_SA configuration"},
++			{"source",		'S', 1, "override source address"},
++			{"remote",		'R', 1, "override remote address"},
+ 			{"timeout",		't', 1, "timeout in seconds before detaching"},
+ 			{"raw",			'r', 0, "dump raw response message"},
+ 			{"pretty",		'P', 0, "dump raw response message in pretty print"},
+-- 
+2.4.2
+
diff --git a/main/strongswan/0002-vici-send-certificates-for-ike-sa-events.patch b/main/strongswan/0002-vici-send-certificates-for-ike-sa-events.patch
new file mode 100644
index 000000000..2769dff24
--- /dev/null
+++ b/main/strongswan/0002-vici-send-certificates-for-ike-sa-events.patch
@@ -0,0 +1,106 @@
+From b47b7feba0a45d70c8909fad37e97baa0d317144 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
+Date: Thu, 30 Apr 2015 12:08:13 +0300
+Subject: [PATCH 2/4] vici: send certificates for ike-sa events
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Timo Teräs <timo.teras@iki.fi>
+---
+ src/libcharon/plugins/vici/vici_query.c | 42 +++++++++++++++++++++++++++++----
+ 1 file changed, 38 insertions(+), 4 deletions(-)
+
+diff --git a/src/libcharon/plugins/vici/vici_query.c b/src/libcharon/plugins/vici/vici_query.c
+index d94d760..3d461f7 100644
+--- a/src/libcharon/plugins/vici/vici_query.c
++++ b/src/libcharon/plugins/vici/vici_query.c
+@@ -225,13 +225,15 @@ static void list_task_queue(private_vici_query_t *this, vici_builder_t *b,
+  * List details of an IKE_SA
+  */
+ static void list_ike(private_vici_query_t *this, vici_builder_t *b,
+-					 ike_sa_t *ike_sa, time_t now)
++					 ike_sa_t *ike_sa, time_t now, bool add_certs)
+ {
+ 	time_t t;
+ 	ike_sa_id_t *id;
+ 	identification_t *eap;
+ 	proposal_t *proposal;
+ 	u_int16_t alg, ks;
++	auth_cfg_t *auth_cfg;
++	enumerator_t *enumerator;
+ 
+ 	b->add_kv(b, "uniqueid", "%u", ike_sa->get_unique_id(ike_sa));
+ 	b->add_kv(b, "version", "%u", ike_sa->get_version(ike_sa));
+@@ -239,9 +241,41 @@ static void list_ike(private_vici_query_t *this, vici_builder_t *b,
+ 
+ 	b->add_kv(b, "local-host", "%H", ike_sa->get_my_host(ike_sa));
+ 	b->add_kv(b, "local-id", "%Y", ike_sa->get_my_id(ike_sa));
++	if (add_certs)
++	{
++		enumerator = ike_sa->create_auth_cfg_enumerator(ike_sa, TRUE);
++		if (enumerator->enumerate(enumerator, &auth_cfg))
++		{
++			certificate_t *cert = auth_cfg->get(auth_cfg, AUTH_RULE_SUBJECT_CERT);
++			chunk_t encoding;
++
++			if (cert && cert->get_encoding(cert, CERT_ASN1_DER, &encoding))
++			{
++				b->add(b, VICI_KEY_VALUE, "local-cert-data", encoding);
++				free(encoding.ptr);
++			}
++		}
++		enumerator->destroy(enumerator);
++	}
+ 
+ 	b->add_kv(b, "remote-host", "%H", ike_sa->get_other_host(ike_sa));
+ 	b->add_kv(b, "remote-id", "%Y", ike_sa->get_other_id(ike_sa));
++	if (add_certs)
++	{
++		enumerator = ike_sa->create_auth_cfg_enumerator(ike_sa, FALSE);
++		if (enumerator->enumerate(enumerator, &auth_cfg))
++		{
++			certificate_t *cert = auth_cfg->get(auth_cfg, AUTH_RULE_SUBJECT_CERT);
++			chunk_t encoding;
++
++			if (cert && cert->get_encoding(cert, CERT_ASN1_DER, &encoding))
++			{
++				b->add(b, VICI_KEY_VALUE, "remote-cert-data", encoding);
++				free(encoding.ptr);
++			}
++		}
++		enumerator->destroy(enumerator);
++	}
+ 
+ 	eap = ike_sa->get_other_eap_id(ike_sa);
+ 
+@@ -348,7 +382,7 @@ CALLBACK(list_sas, vici_message_t*,
+ 		b = vici_builder_create();
+ 		b->begin_section(b, ike_sa->get_name(ike_sa));
+ 
+-		list_ike(this, b, ike_sa, now);
++		list_ike(this, b, ike_sa, now, TRUE);
+ 
+ 		b->begin_section(b, "child-sas");
+ 		csas = ike_sa->create_child_sa_enumerator(ike_sa);
+@@ -1055,7 +1089,7 @@ METHOD(listener_t, ike_updown, bool,
+ 
+ 	b = vici_builder_create();
+ 	b->begin_section(b, ike_sa->get_name(ike_sa));
+-	list_ike(this, b, ike_sa, now);
++	list_ike(this, b, ike_sa, now, up);
+ 	b->begin_section(b, "child-sas");
+ 	b->end_section(b);
+ 	b->end_section(b);
+@@ -1081,7 +1115,7 @@ METHOD(listener_t, child_updown, bool,
+ 	b = vici_builder_create();
+ 
+ 	b->begin_section(b, ike_sa->get_name(ike_sa));
+-	list_ike(this, b, ike_sa, now);
++	list_ike(this, b, ike_sa, now, up);
+ 	b->begin_section(b, "child-sas");
+ 
+ 	b->begin_section(b, child_sa->get_name(child_sa));
+-- 
+2.4.2
+
diff --git a/main/strongswan/0003-vici-add-support-rekeying-events-and-individual-sa-s.patch b/main/strongswan/0003-vici-add-support-rekeying-events-and-individual-sa-s.patch
new file mode 100644
index 000000000..635e75fee
--- /dev/null
+++ b/main/strongswan/0003-vici-add-support-rekeying-events-and-individual-sa-s.patch
@@ -0,0 +1,213 @@
+From 228bfd9f9c0fb27a6802f5d4dc8d747cf4644a1d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
+Date: Thu, 30 Apr 2015 10:58:15 +0300
+Subject: [PATCH 3/4] vici: add support rekeying events, and individual sa
+ state changes
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Useful for monitoring and tracking full SA.
+
+Signed-off-by: Timo Teräs <timo.teras@iki.fi>
+---
+ src/libcharon/plugins/vici/vici_query.c | 160 ++++++++++++++++++++++++++++++++
+ 1 file changed, 160 insertions(+)
+
+diff --git a/src/libcharon/plugins/vici/vici_query.c b/src/libcharon/plugins/vici/vici_query.c
+index 3d461f7..ade181c 100644
+--- a/src/libcharon/plugins/vici/vici_query.c
++++ b/src/libcharon/plugins/vici/vici_query.c
+@@ -1065,7 +1065,13 @@ static void manage_commands(private_vici_query_t *this, bool reg)
+ 	this->dispatcher->manage_event(this->dispatcher, "list-conn", reg);
+ 	this->dispatcher->manage_event(this->dispatcher, "list-cert", reg);
+ 	this->dispatcher->manage_event(this->dispatcher, "ike-updown", reg);
++	this->dispatcher->manage_event(this->dispatcher, "ike-rekey", reg);
++	this->dispatcher->manage_event(this->dispatcher, "ike-state-established", reg);
++	this->dispatcher->manage_event(this->dispatcher, "ike-state-destroying", reg);
+ 	this->dispatcher->manage_event(this->dispatcher, "child-updown", reg);
++	this->dispatcher->manage_event(this->dispatcher, "child-rekey", reg);
++	this->dispatcher->manage_event(this->dispatcher, "child-state-installed", reg);
++	this->dispatcher->manage_event(this->dispatcher, "child-state-destroying", reg);
+ 	manage_command(this, "list-sas", list_sas, reg);
+ 	manage_command(this, "list-policies", list_policies, reg);
+ 	manage_command(this, "list-conns", list_conns, reg);
+@@ -1100,6 +1106,77 @@ METHOD(listener_t, ike_updown, bool,
+ 	return TRUE;
+ }
+ 
++METHOD(listener_t, ike_rekey, bool,
++	private_vici_query_t *this, ike_sa_t *old, ike_sa_t *new)
++{
++	vici_builder_t *b;
++	time_t now;
++
++	if (!this->dispatcher->has_event_listeners(this->dispatcher, "ike-rekey"))
++	{
++		return TRUE;
++	}
++
++	now = time_monotonic(NULL);
++
++	b = vici_builder_create();
++	b->begin_section(b, old->get_name(old));
++	list_ike(this, b, old, now, TRUE);
++	b->begin_section(b, "child-sas");
++	b->end_section(b);
++	b->end_section(b);
++
++	b->begin_section(b, new->get_name(new));
++	list_ike(this, b, new, now, TRUE);
++	b->begin_section(b, "child-sas");
++	b->end_section(b);
++	b->end_section(b);
++
++	this->dispatcher->raise_event(this->dispatcher,
++								  "ike-rekey", 0, b->finalize(b));
++
++	return TRUE;
++}
++
++METHOD(listener_t, ike_state_change, bool,
++	private_vici_query_t *this, ike_sa_t *ike_sa, ike_sa_state_t state)
++{
++	char *event;
++	vici_builder_t *b;
++	time_t now;
++
++	switch (state)
++	{
++	case IKE_ESTABLISHED:
++		event = "ike-state-established";
++		break;
++	case IKE_DESTROYING:
++		event = "ike-state-destroying";
++		break;
++	default:
++		return TRUE;
++	}
++
++	if (!this->dispatcher->has_event_listeners(this->dispatcher, event))
++	{
++		return TRUE;
++	}
++
++	now = time_monotonic(NULL);
++
++	b = vici_builder_create();
++	b->begin_section(b, ike_sa->get_name(ike_sa));
++	list_ike(this, b, ike_sa, now, state != IKE_DESTROYING);
++	b->begin_section(b, "child-sas");
++	b->end_section(b);
++	b->end_section(b);
++
++	this->dispatcher->raise_event(this->dispatcher,
++								  event, 0, b->finalize(b));
++
++	return TRUE;
++}
++
+ METHOD(listener_t, child_updown, bool,
+ 	private_vici_query_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa, bool up)
+ {
+@@ -1131,6 +1208,85 @@ METHOD(listener_t, child_updown, bool,
+ 	return TRUE;
+ }
+ 
++METHOD(listener_t, child_rekey, bool,
++	private_vici_query_t *this, ike_sa_t *ike_sa, child_sa_t *old, child_sa_t *new)
++{
++	vici_builder_t *b;
++	time_t now;
++
++	if (!this->dispatcher->has_event_listeners(this->dispatcher, "child-rekey"))
++	{
++		return TRUE;
++	}
++
++	now = time_monotonic(NULL);
++	b = vici_builder_create();
++
++	b->begin_section(b, ike_sa->get_name(ike_sa));
++	list_ike(this, b, ike_sa, now, TRUE);
++	b->begin_section(b, "child-sas");
++
++	b->begin_section(b, old->get_name(old));
++	list_child(this, b, old, now);
++	b->end_section(b);
++
++	b->begin_section(b, new->get_name(new));
++	list_child(this, b, new, now);
++	b->end_section(b);
++
++	b->end_section(b);
++	b->end_section(b);
++
++	this->dispatcher->raise_event(this->dispatcher,
++								  "child-rekey", 0, b->finalize(b));
++
++	return TRUE;
++}
++
++METHOD(listener_t, child_state_change, bool,
++	private_vici_query_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa, child_sa_state_t state)
++{
++	char *event;
++	vici_builder_t *b;
++	time_t now;
++
++	switch (state)
++	{
++	case CHILD_INSTALLED:
++		event = "child-state-installed";
++		break;
++	case CHILD_DESTROYING:
++		event = "child-state-destroying";
++		break;
++	default:
++		return TRUE;
++	}
++
++	if (!this->dispatcher->has_event_listeners(this->dispatcher, event))
++	{
++		return TRUE;
++	}
++
++	now = time_monotonic(NULL);
++
++	b = vici_builder_create();
++	b->begin_section(b, ike_sa->get_name(ike_sa));
++	list_ike(this, b, ike_sa, now, state != CHILD_DESTROYING);
++	b->begin_section(b, "child-sas");
++
++	b->begin_section(b, child_sa->get_name(child_sa));
++	list_child(this, b, child_sa, now);
++	b->end_section(b);
++
++	b->end_section(b);
++	b->end_section(b);
++
++	this->dispatcher->raise_event(this->dispatcher,
++								  event, 0, b->finalize(b));
++
++	return TRUE;
++}
++
+ METHOD(vici_query_t, destroy, void,
+ 	private_vici_query_t *this)
+ {
+@@ -1149,7 +1305,11 @@ vici_query_t *vici_query_create(vici_dispatcher_t *dispatcher)
+ 		.public = {
+ 			.listener = {
+ 				.ike_updown = _ike_updown,
++				.ike_rekey = _ike_rekey,
++				.ike_state_change = _ike_state_change,
+ 				.child_updown = _child_updown,
++				.child_rekey = _child_rekey,
++				.child_state_change = _child_state_change,
+ 			},
+ 			.destroy = _destroy,
+ 		},
+-- 
+2.4.2
+
diff --git a/main/strongswan/0004-vici-support-asynchronous-initiation.patch b/main/strongswan/0004-vici-support-asynchronous-initiation.patch
new file mode 100644
index 000000000..eefda89fd
--- /dev/null
+++ b/main/strongswan/0004-vici-support-asynchronous-initiation.patch
@@ -0,0 +1,47 @@
+From 18c8cb346648a385878d6cde8d1d95fa22cf0a9b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
+Date: Thu, 28 May 2015 13:06:51 +0300
+Subject: [PATCH 4/4] vici: support asynchronous initiation
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Timo Teräs <timo.teras@iki.fi>
+---
+ src/libcharon/plugins/vici/vici_control.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/src/libcharon/plugins/vici/vici_control.c b/src/libcharon/plugins/vici/vici_control.c
+index 9a58399..e9bcb90 100644
+--- a/src/libcharon/plugins/vici/vici_control.c
++++ b/src/libcharon/plugins/vici/vici_control.c
+@@ -186,7 +186,7 @@ CALLBACK(initiate, vici_message_t*,
+ 	peer_cfg_t *peer_cfg;
+ 	host_t *my_host = NULL, *other_host = NULL;
+ 	char *child, *my_host_str, *other_host_str;
+-	u_int timeout;
++	u_int timeout, async;
+ 	log_info_t log = {
+ 		.dispatcher = this->dispatcher,
+ 		.id = id,
+@@ -194,6 +194,7 @@ CALLBACK(initiate, vici_message_t*,
+ 
+ 	child = request->get_str(request, NULL, "child");
+ 	timeout = request->get_int(request, 0, "timeout");
++	async = request->get_int(request, 0, "async");
+ 	log.level = request->get_int(request, 1, "loglevel");
+ 	my_host_str = request->get_str(request, NULL, "my-host");
+ 	other_host_str = request->get_str(request, NULL, "other-host");
+@@ -222,7 +223,8 @@ CALLBACK(initiate, vici_message_t*,
+ 	}
+ 	switch (charon->controller->initiate(charon->controller,
+ 				peer_cfg, child_cfg, my_host, other_host,
+-				(controller_cb_t)log_vici, &log, timeout))
++				async ? NULL : (controller_cb_t)log_vici,
++				&log, timeout))
+ 	{
+ 		case SUCCESS:
+ 			msg = send_reply(this, NULL);
+-- 
+2.4.2
+
diff --git a/main/strongswan/APKBUILD b/main/strongswan/APKBUILD
index cd8e6e50c..4860b5d85 100644
--- a/main/strongswan/APKBUILD
+++ b/main/strongswan/APKBUILD
@@ -3,7 +3,7 @@
 pkgname=strongswan
 pkgver=5.3.1
 _pkgver=${pkgver//_rc/rc}
-pkgrel=0
+pkgrel=1
 pkgdesc="IPsec-based VPN solution focused on security and ease of use, supporting IKEv1/IKEv2 and MOBIKE"
 url="http://www.strongswan.org/"
 arch="all"
@@ -16,6 +16,10 @@ makedepends="$depends_dev linux-headers"
 install="$pkgname.pre-install"
 subpackages="$pkgname-doc"
 source="http://download.strongswan.org/$pkgname-$_pkgver.tar.bz2
+	0001-charon-add-optional-source-and-remote-overrides-for-.patch
+	0002-vici-send-certificates-for-ike-sa-events.patch
+	0003-vici-add-support-rekeying-events-and-individual-sa-s.patch
+	0004-vici-support-asynchronous-initiation.patch
 
 	strongswan.initd
 	charon.initd"
@@ -99,11 +103,23 @@ package() {
 }
 
 md5sums="66f258901a3d6c271da1a0c7fb3e5013  strongswan-5.3.1.tar.bz2
+e553c5e9a895a2d95b1cbc33407d64a0  0001-charon-add-optional-source-and-remote-overrides-for-.patch
+8bea05feac6f4e90c4973b2459864437  0002-vici-send-certificates-for-ike-sa-events.patch
+125c4e648f73b0dbdaa741ac13ed6d87  0003-vici-add-support-rekeying-events-and-individual-sa-s.patch
+f65811bd1ae6e7f98cf9d76928a0aa03  0004-vici-support-asynchronous-initiation.patch
 85ebc1b6c6b9c0c6640d8136e97da8e1  strongswan.initd
 7962a720ebef6892d80a3cbdab72c204  charon.initd"
 sha256sums="83fa7b004e65356ff5bb755d9d0e03901d578a99e90b6328a350a4335a32f6de  strongswan-5.3.1.tar.bz2
+a472df28677d4f43a063926a65b52b317dfca0b74f8c6a2e3bf852b94fbf5f0f  0001-charon-add-optional-source-and-remote-overrides-for-.patch
+c1cfe3d1e3345238e125a46a492f8dc0800aa3dc75aea060d54cdbab35fd60cb  0002-vici-send-certificates-for-ike-sa-events.patch
+4e08d4fe01717de0601411b4756141394ced2d3107adc47f2c2beac2f92a967e  0003-vici-add-support-rekeying-events-and-individual-sa-s.patch
+42171ee35e7679fe3d4efb80fdb121b0a7ea8df5cf3395bbcccb97d56327027c  0004-vici-support-asynchronous-initiation.patch
 ad43d1ed2585d84e12ad1e67fbdfe93983c424c5c64b230d5027c0aae496c65f  strongswan.initd
 97b018796f0f15106b70694449cff36e8fc586292aab09ef83a05c0c13142e73  charon.initd"
 sha512sums="b789c18de1fa6663d8140c4173c2fe9b668e7741098340aad439e7346d4542df702f59760d1886d82d68c070ebde3121b5b29ccdab031876399d0d5d771f1381  strongswan-5.3.1.tar.bz2
+682c768e82c6b8e48680ab73db49eb3a462b90ee317c943a42a82812d171a19da27ff4139bff0fc9af7b228cdcef44a75b86979f4b1b3af0bbc9698e4329fb4a  0001-charon-add-optional-source-and-remote-overrides-for-.patch
+ca6eec72f75f243234baa1b361ab6dba82a810d1efb01dbcfd16cd7ce104c3f18fb932c1f6f280a566bfcbe16bc67d7d55e024f72c9eef82a62fe78505293c5c  0002-vici-send-certificates-for-ike-sa-events.patch
+2e28af9043cab41f16c57f41ccb65b6591ec32d50a811bd393c4dcf7f0ffe81fac67679c41b716dfc74fca9ebedd178fe0b572b1c2cda3ccc685a0ad0d02f65a  0003-vici-add-support-rekeying-events-and-individual-sa-s.patch
+39e4a9839b2f6f42f662620b20697c684b90949622f8cc21c393ca55ab40e669befd1d2055e0f0c799cf37733a37bbf4df2b9cebc984a45bb66ecba6fa0ef116  0004-vici-support-asynchronous-initiation.patch
 b56008c07b804dacb3441d3802880058986ab7b314297fe485649a771861885b9232f9fd53b94faa3388a5e9330e2b38a86af5c04f3ff119199720043967ec64  strongswan.initd
 6f3abaaa8da0925f06cdd184fdf534518e40c49533dba427dbf31dbe88172e5626bdc9aadf798d791f82fbded08801c1f565d514e2c289e1f28448d0c2e72b79  charon.initd"