main/strongswan: upgrade to 5.3.3

remove upstreamed patches; rebase the rest

36 files changed, 175 insertions, 2777 deletions

diff --git a/main/strongswan/0001-vici-Asynchronize-debug-logging.patch b/main/strongswan/0001-vici-Asynchronize-debug-logging.patch
deleted file mode 100644
index c756f9d3e..000000000
--- a/main/strongswan/0001-vici-Asynchronize-debug-logging.patch
+++ /dev/null
@@ -1,169 +0,0 @@
-From 856ea64129cdc7ee56969524d7abaaae08c22c6a Mon Sep 17 00:00:00 2001
-From: Martin Willi <martin@revosec.ch>
-Date: Thu, 2 Jul 2015 09:10:21 +0200
-Subject: [PATCH] vici: Asynchronize debug logging
-
-The vici logger uses the listener_t.log() callback to raise vici events.
-
-When doing so, it holds the bus lock as reader while acquiring the vici socket
-mutex (1). If at the same time the vici socket enables a writer, that thread
-tries to lock the watcher mutex (2). The watcher thread uses debugging while
-holding the lock, i.e. acquires the bus read lock (3).
-
-(1) bus.rlock -> vici.lock!
-(2) vici.lock -> watcher.lock!
-(3) watcher.lock -> bus.rlock!
-
-This all actually would resolve just fine, as we have a shared read lock on the
-bus. However, under Windows we seem to have a strict writer preference when
-acquiring the rwlock (4). This results in blocking read locks until any pending
-write lock can be fulfilled, and makes the constellation deadlock. The relevant
-threads are:
-
-Thread (1)
-6  0x71313d25 in wait_ at threading/windows/mutex.c:137
-7  0x7054c8a2 in find_entry at vici_socket.c:201
-8  0x7054d690 in send_ at vici_socket.c:624
-9  0x7054f6c1 in send_op at vici_dispatcher.c:119
-10 0x705502c1 in raise_event at vici_dispatcher.c:469
-12 0x704c3878 in log_cb at bus/bus.c:332
-13 0x712c7c3a in invoke_function at collections/linked_list.c:414
-14 0x704c3a63 in vlog at bus/bus.c:400
-15 0x704c3b36 in log_ at bus/bus.c:430
-18 0x70508f1f in process_response at sa/ikev2/task_manager_v2.c:664
-20 0x704f5430 in process_message at sa/ike_sa.c:1369
-21 0x704e3823 in execute at processing/jobs/process_message_job.c:74
-22 0x712e629f in process_job at processing/processor.c:235
-
-Thread (2)
-4  0x71313b61 in lock at threading/windows/mutex.c:66
-5  0x712e81fd in add at processing/watcher.c:441
-6  0x712e1ab9 in add_watcher at networking/streams/stream.c:213
-7  0x712e1b4d in on_write at networking/streams/stream.c:237
-8  0x7054d606 in _cb_enable_writer at vici_socket.c:609
-9  0x712e5e34 in execute at processing/jobs/callback_job.c:77
-10 0x712e629f in process_job at processing/processor.c:235
-
-Thread (3)
-3  0x71313f38 in read_lock at threading/windows/rwlock.c:74
-4  0x704c3971 in vlog at bus/bus.c:373
-5  0x704cc156 in dbg_bus at daemon.c:126
-6  0x712e7bf9 in watch at processing/watcher.c:316
-7  0x712e5e34 in execute at processing/jobs/callback_job.c:77
-8  0x712e629f in process_job at processing/processor.c:235
-
-Thread (4)
-3  0x71313f70 in write_lock at threading/windows/rwlock.c:82
-4  0x704c378b in remove_logger at bus/bus.c:290
-5  0x704cb284 in listener_unregister at control/controller.c:166
-6  0x713136cd in thread_cleanup_pop at threading/windows/thread.c:558
-8  0x704cb94e in initiate at control/controller.c:435
-9  0x70553996 in _cb_initiate at vici_control.c:187
-12 0x7054d200 in _cb_process_queue at vici_socket.c:508
-13 0x712e5e34 in execute at processing/jobs/callback_job.c:77
-14 0x712e629f in process_job at processing/processor.c:235
-
-To avoid such a situation, we dissolve the (1) lock sequence. It's actually
-never good practice to acquire shared locks during bus hooks, as it is
-problematic if we raise bus events while holding the lock. We do so by
-raising vici events for log message asynchronously, but of curse must keep
-log order as is using a synchronized queue.
----
- src/libcharon/plugins/vici/vici_logger.c | 48 +++++++++++++++++++++++++++++++-
- 1 file changed, 47 insertions(+), 1 deletion(-)
-
-diff --git a/src/libcharon/plugins/vici/vici_logger.c b/src/libcharon/plugins/vici/vici_logger.c
-index cffd65b..6d3584e 100644
---- a/src/libcharon/plugins/vici/vici_logger.c
-+++ b/src/libcharon/plugins/vici/vici_logger.c
-@@ -18,6 +18,7 @@
- 
- #include <daemon.h>
- #include <threading/mutex.h>
-+#include <processing/jobs/callback_job.h>
- 
- typedef struct private_vici_logger_t private_vici_logger_t;
- 
-@@ -42,11 +43,54 @@ struct private_vici_logger_t {
- 	int recursive;
- 
- 	/**
-+	 * List of messages to raise async events
-+	 */
-+	linked_list_t *queue;
-+
-+	/**
- 	 * Mutex to synchronize logging
- 	 */
- 	mutex_t *mutex;
- };
- 
-+/**
-+ * Async callback to raise events for queued messages
-+ */
-+static job_requeue_t raise_events(private_vici_logger_t *this)
-+{
-+	vici_message_t *message;
-+	u_int count;
-+
-+	this->mutex->lock(this->mutex);
-+	count = this->queue->get_count(this->queue);
-+	this->queue->remove_first(this->queue, (void**)&message);
-+	this->mutex->unlock(this->mutex);
-+
-+	if (count > 0)
-+	{
-+		this->dispatcher->raise_event(this->dispatcher, "log", 0, message);
-+	}
-+	if (count > 1)
-+	{
-+		return JOB_REQUEUE_DIRECT;
-+	}
-+	return JOB_REQUEUE_NONE;
-+}
-+
-+/**
-+ * Queue a message for async processing
-+ */
-+static void queue_messsage(private_vici_logger_t *this, vici_message_t *message)
-+{
-+	this->queue->insert_last(this->queue, message);
-+	if (this->queue->get_count(this->queue) == 1)
-+	{
-+		lib->processor->queue_job(lib->processor, (job_t*)
-+					callback_job_create((callback_job_cb_t)raise_events,
-+										this, NULL, NULL));
-+	}
-+}
-+
- METHOD(logger_t, log_, void,
- 	private_vici_logger_t *this, debug_t group, level_t level, int thread,
- 	ike_sa_t* ike_sa, const char *msg)
-@@ -75,7 +119,7 @@ METHOD(logger_t, log_, void,
- 		message = builder->finalize(builder);
- 		if (message)
- 		{
--			this->dispatcher->raise_event(this->dispatcher, "log", 0, message);
-+			queue_messsage(this, message);
- 		}
- 	}
- 	this->recursive--;
-@@ -101,6 +145,7 @@ METHOD(vici_logger_t, destroy, void,
- 	private_vici_logger_t *this)
- {
- 	manage_commands(this, FALSE);
-+	this->queue->destroy_offset(this->queue, offsetof(vici_message_t, destroy));
- 	this->mutex->destroy(this->mutex);
- 	free(this);
- }
-@@ -121,6 +166,7 @@ vici_logger_t *vici_logger_create(vici_dispatcher_t *dispatcher)
- 			.destroy = _destroy,
- 		},
- 		.dispatcher = dispatcher,
-+		.queue = linked_list_create(),
- 		.mutex = mutex_create(MUTEX_TYPE_RECURSIVE),
- 	);
- 
--- 
-2.4.6
-
diff --git a/main/strongswan/0002-host-Properly-handle-NULL-in-host_create_from_string.patch b/main/strongswan/0002-host-Properly-handle-NULL-in-host_create_from_string.patch
deleted file mode 100644
index ff79e322e..000000000
--- a/main/strongswan/0002-host-Properly-handle-NULL-in-host_create_from_string.patch
+++ /dev/null
@@ -1,67 +0,0 @@
-From 65579569adfa0e2c9602ee250f4554169ba5a87d Mon Sep 17 00:00:00 2001
-From: Tobias Brunner <tobias@strongswan.org>
-Date: Thu, 11 Jun 2015 15:07:07 +0200
-Subject: [PATCH] host: Properly handle NULL in
- host_create_from_string[_and_family]
-
----
- src/libstrongswan/networking/host.c        | 4 ++++
- src/libstrongswan/tests/suites/test_host.c | 6 ++++++
- 2 files changed, 10 insertions(+)
-
-diff --git a/src/libstrongswan/networking/host.c b/src/libstrongswan/networking/host.c
-index 07da3ef..2e464b0 100644
---- a/src/libstrongswan/networking/host.c
-+++ b/src/libstrongswan/networking/host.c
-@@ -354,6 +354,10 @@ host_t *host_create_from_string_and_family(char *string, int family,
- 		struct sockaddr_in6 v6;
- 	} addr;
- 
-+	if (!string)
-+	{
-+		return NULL;
-+	}
- 	if (streq(string, "%any"))
- 	{
- 		return host_create_any_port(family ? family : AF_INET, port);
-diff --git a/src/libstrongswan/tests/suites/test_host.c b/src/libstrongswan/tests/suites/test_host.c
-index 7161b2c..5cb8013 100644
---- a/src/libstrongswan/tests/suites/test_host.c
-+++ b/src/libstrongswan/tests/suites/test_host.c
-@@ -104,6 +104,9 @@ START_TEST(test_create_from_string_v4)
- {
- 	host_t *host;
- 
-+	host = host_create_from_string(NULL, 500);
-+	ck_assert(!host);
-+
- 	host = host_create_from_string("%any", 500);
- 	verify_any(host, AF_INET, 500);
- 	host->destroy(host);
-@@ -196,6 +199,7 @@ static void test_create_from_string_and_family_addr(char *string, chunk_t addr,
- 
- START_TEST(test_create_from_string_and_family_v4)
- {
-+	test_create_from_string_and_family_any(NULL, AF_INET, AF_UNSPEC);
- 	test_create_from_string_and_family_any("%any", AF_INET, AF_INET);
- 	test_create_from_string_and_family_any("%any4", AF_INET, AF_INET);
- 	test_create_from_string_and_family_any("0.0.0.0", AF_INET, AF_INET);
-@@ -210,6 +214,7 @@ END_TEST
- 
- START_TEST(test_create_from_string_and_family_v6)
- {
-+	test_create_from_string_and_family_any(NULL, AF_INET6, AF_UNSPEC);
- 	test_create_from_string_and_family_any("%any", AF_INET6, AF_INET6);
- 	test_create_from_string_and_family_any("%any6", AF_INET6, AF_INET6);
- 	test_create_from_string_and_family_any("::", AF_INET6, AF_INET6);
-@@ -224,6 +229,7 @@ END_TEST
- 
- START_TEST(test_create_from_string_and_family_other)
- {
-+	test_create_from_string_and_family_any(NULL, AF_UNSPEC, AF_UNSPEC);
- 	test_create_from_string_and_family_any("%any", AF_UNSPEC, AF_INET);
- 	test_create_from_string_and_family_any("%any4", AF_UNSPEC, AF_INET);
- 	test_create_from_string_and_family_any("0.0.0.0", AF_UNSPEC, AF_INET);
--- 
-2.4.6
-
diff --git a/main/strongswan/0002-ike-sa-manager-Safely-access-the-RNG-instance-with-a.patch b/main/strongswan/0002-ike-sa-manager-Safely-access-the-RNG-instance-with-a.patch
deleted file mode 100644
index c17141460..000000000
--- a/main/strongswan/0002-ike-sa-manager-Safely-access-the-RNG-instance-with-a.patch
+++ /dev/null
@@ -1,91 +0,0 @@
-From 390ae7a2c2f899122e722241cb261f53dfc81b9a Mon Sep 17 00:00:00 2001
-From: Tobias Brunner <tobias@strongswan.org>
-Date: Wed, 8 Jul 2015 15:28:46 +0200
-Subject: [PATCH] ike-sa-manager: Safely access the RNG instance with an rwlock
-
-Threads might still be allocating SPIs (e.g. triggered by an acquire or
-an inbound message) while the main thread calls flush().  If there is a
-context switch right after such a thread successfully checked this->rng
-in get_spi() and the main thread destroys the RNG instance right then,
-that worker thread will cause a segmentation fault when it continues and
-attempts to call get_bytes().
-
-Fixes #1014.
----
- src/libcharon/sa/ike_sa_manager.c | 21 ++++++++++++++++-----
- 1 file changed, 16 insertions(+), 5 deletions(-)
-
-diff --git a/src/libcharon/sa/ike_sa_manager.c b/src/libcharon/sa/ike_sa_manager.c
-index 938f784..987260d 100644
---- a/src/libcharon/sa/ike_sa_manager.c
-+++ b/src/libcharon/sa/ike_sa_manager.c
-@@ -1,7 +1,7 @@
- /*
-  * Copyright (C) 2005-2011 Martin Willi
-  * Copyright (C) 2011 revosec AG
-- * Copyright (C) 2008-2012 Tobias Brunner
-+ * Copyright (C) 2008-2015 Tobias Brunner
-  * Copyright (C) 2005 Jan Hutter
-  * Hochschule fuer Technik Rapperswil
-  *
-@@ -384,6 +384,11 @@ struct private_ike_sa_manager_t {
- 	rng_t *rng;
- 
- 	/**
-+	 * Lock to access the RNG instance
-+	 */
-+	rwlock_t *rng_lock;
-+
-+	/**
- 	 * reuse existing IKE_SAs in checkout_by_config
- 	 */
- 	bool reuse_ikesa;
-@@ -943,12 +948,14 @@ static u_int64_t get_spi(private_ike_sa_manager_t *this)
- {
- 	u_int64_t spi;
- 
--	if (this->rng &&
--		this->rng->get_bytes(this->rng, sizeof(spi), (u_int8_t*)&spi))
-+	this->rng_lock->read_lock(this->rng_lock);
-+	if (!this->rng ||
-+		!this->rng->get_bytes(this->rng, sizeof(spi), (u_int8_t*)&spi))
- 	{
--		return spi;
-+		spi = 0;
- 	}
--	return 0;
-+	this->rng_lock->unlock(this->rng_lock);
-+	return spi;
- }
- 
- /**
-@@ -2055,8 +2062,10 @@ METHOD(ike_sa_manager_t, flush, void,
- 	charon->bus->set_sa(charon->bus, NULL);
- 	unlock_all_segments(this);
- 
-+	this->rng_lock->write_lock(this->rng_lock);
- 	this->rng->destroy(this->rng);
- 	this->rng = NULL;
-+	this->rng_lock->unlock(this->rng_lock);
- }
- 
- METHOD(ike_sa_manager_t, destroy, void,
-@@ -2081,6 +2090,7 @@ METHOD(ike_sa_manager_t, destroy, void,
- 	free(this->connected_peers_segments);
- 	free(this->init_hashes_segments);
- 
-+	this->rng_lock->destroy(this->rng_lock);
- 	free(this);
- }
- 
-@@ -2138,6 +2148,7 @@ ike_sa_manager_t *ike_sa_manager_create()
- 		free(this);
- 		return NULL;
- 	}
-+	this->rng_lock = rwlock_create(RWLOCK_TYPE_DEFAULT);
- 
- 	this->ikesa_limit = lib->settings->get_int(lib->settings,
- 											   "%s.ikesa_limit", 0, lib->ns);
--- 
-2.4.6
-
diff --git a/main/strongswan/0003-ike-cfg-Add-helper-function-to-determine-address-fam.patch b/main/strongswan/0003-ike-cfg-Add-helper-function-to-determine-address-fam.patch
deleted file mode 100644
index 0cf63a3f7..000000000
--- a/main/strongswan/0003-ike-cfg-Add-helper-function-to-determine-address-fam.patch
+++ /dev/null
@@ -1,106 +0,0 @@
-From 6bfa66069304c1fc1345b4e72762a3b1a80e4338 Mon Sep 17 00:00:00 2001
-From: Tobias Brunner <tobias@strongswan.org>
-Date: Thu, 11 Jun 2015 15:42:54 +0200
-Subject: [PATCH] ike-cfg: Add helper function to determine address family of
- IP addresses
-
-All configured static addresses (hostnames, ranges or subnets are not
-considered) must be of the same family, otherwise AF_UNSPEC is returned.
----
- src/libcharon/config/ike_cfg.c | 47 ++++++++++++++++++++++++++++++++++++++++++
- src/libcharon/config/ike_cfg.h | 13 +++++++++++-
- 2 files changed, 59 insertions(+), 1 deletion(-)
-
-diff --git a/src/libcharon/config/ike_cfg.c b/src/libcharon/config/ike_cfg.c
-index 9464ceb..dee9e4c 100644
---- a/src/libcharon/config/ike_cfg.c
-+++ b/src/libcharon/config/ike_cfg.c
-@@ -1,4 +1,5 @@
- /*
-+ * Copyright (C) 2012-2015 Tobias Brunner
-  * Copyright (C) 2005-2007 Martin Willi
-  * Copyright (C) 2005 Jan Hutter
-  * Hochschule fuer Technik Rapperswil
-@@ -513,6 +514,52 @@ static void parse_addresses(char *str, linked_list_t *hosts,
- /**
-  * Described in header.
-  */
-+int ike_cfg_get_family(ike_cfg_t *cfg, bool local)
-+{
-+	private_ike_cfg_t *this = (private_ike_cfg_t*)cfg;
-+	enumerator_t *enumerator;
-+	host_t *host;
-+	char *str;
-+	int family = AF_UNSPEC;
-+
-+	if (local)
-+	{
-+		enumerator = this->my_hosts->create_enumerator(this->my_hosts);
-+	}
-+	else
-+	{
-+		enumerator = this->other_hosts->create_enumerator(this->other_hosts);
-+	}
-+	while (enumerator->enumerate(enumerator, &str))
-+	{
-+		if (streq(str, "%any"))
-+		{	/* ignore %any as its family is undetermined */
-+			continue;
-+		}
-+		host = host_create_from_string(str, 0);
-+		if (host)
-+		{
-+			if (family == AF_UNSPEC)
-+			{
-+				family = host->get_family(host);
-+			}
-+			else if (family != host->get_family(host))
-+			{
-+				/* more than one address family defined */
-+				family = AF_UNSPEC;
-+				host->destroy(host);
-+				break;
-+			}
-+		}
-+		DESTROY_IF(host);
-+	}
-+	enumerator->destroy(enumerator);
-+	return family;
-+}
-+
-+/**
-+ * Described in header.
-+ */
- ike_cfg_t *ike_cfg_create(ike_version_t version, bool certreq, bool force_encap,
- 						  char *me, u_int16_t my_port,
- 						  char *other, u_int16_t other_port,
-diff --git a/src/libcharon/config/ike_cfg.h b/src/libcharon/config/ike_cfg.h
-index adfcabf..62f5b74 100644
---- a/src/libcharon/config/ike_cfg.h
-+++ b/src/libcharon/config/ike_cfg.h
-@@ -1,5 +1,5 @@
- /*
-- * Copyright (C) 2012 Tobias Brunner
-+ * Copyright (C) 2012-2015 Tobias Brunner
-  * Copyright (C) 2005-2007 Martin Willi
-  * Copyright (C) 2005 Jan Hutter
-  * Hochschule fuer Technik Rapperswil
-@@ -254,4 +254,15 @@ ike_cfg_t *ike_cfg_create(ike_version_t version, bool certreq, bool force_encap,
- 						  char *other, u_int16_t other_port,
- 						  fragmentation_t fragmentation, u_int8_t dscp);
- 
-+/**
-+ * Determine the address family of the local or remtoe address(es).  If multiple
-+ * families are configured AF_UNSPEC is returned.  %any is ignored (%any4|6 are
-+ * not though).
-+ *
-+ * @param local				TRUE to check local addresses, FALSE for remote
-+ * @return					address family of address(es) if distinct
-+ */
-+int ike_cfg_get_family(ike_cfg_t *this, bool local);
-+
-+
- #endif /** IKE_CFG_H_ @}*/
--- 
-2.4.6
-
diff --git a/main/strongswan/0004-ike-Use-address-family-of-local-address-when-resolvi.patch b/main/strongswan/0004-ike-Use-address-family-of-local-address-when-resolvi.patch
deleted file mode 100644
index 7114d6247..000000000
--- a/main/strongswan/0004-ike-Use-address-family-of-local-address-when-resolvi.patch
+++ /dev/null
@@ -1,48 +0,0 @@
-From a11048adee0aeab8af10259f406363d7cc6beccc Mon Sep 17 00:00:00 2001
-From: Tobias Brunner <tobias@strongswan.org>
-Date: Thu, 11 Jun 2015 15:10:29 +0200
-Subject: [PATCH] ike: Use address family of local address when resolving
- remote host
-
-If static local addresses are configured we should use their address family
-as a hint when resolving the remote address.
-We don't do this if %any is configured as this might break existing
-configurations (%any4 and %any6 are however used as hint).
----
- src/libcharon/sa/ike_sa.c | 15 ++++++++++++++-
- 1 file changed, 14 insertions(+), 1 deletion(-)
-
-diff --git a/src/libcharon/sa/ike_sa.c b/src/libcharon/sa/ike_sa.c
-index 3aafa4c..0c13c58 100644
---- a/src/libcharon/sa/ike_sa.c
-+++ b/src/libcharon/sa/ike_sa.c
-@@ -1,5 +1,5 @@
- /*
-- * Copyright (C) 2006-2014 Tobias Brunner
-+ * Copyright (C) 2006-2015 Tobias Brunner
-  * Copyright (C) 2006 Daniel Roethlisberger
-  * Copyright (C) 2005-2009 Martin Willi
-  * Copyright (C) 2005 Jan Hutter
-@@ -1200,6 +1200,19 @@ static void resolve_hosts(private_ike_sa_t *this)
- 			break;
- 	}
- 
-+	/* if an IP address is set locally, use the same family to resolve remote */
-+	if (family == AF_UNSPEC && !this->remote_host)
-+	{
-+		if (this->local_host)
-+		{
-+			family = this->local_host->get_family(this->local_host);
-+		}
-+		else
-+		{
-+			family = ike_cfg_get_family(this->ike_cfg, TRUE);
-+		}
-+	}
-+
- 	if (this->remote_host)
- 	{
- 		host = this->remote_host->clone(this->remote_host);
--- 
-2.4.6
-
diff --git a/main/strongswan/0005-ike-Fall-back-to-the-current-remote-IP-if-it-resolve.patch b/main/strongswan/0005-ike-Fall-back-to-the-current-remote-IP-if-it-resolve.patch
deleted file mode 100644
index 411bc58df..000000000
--- a/main/strongswan/0005-ike-Fall-back-to-the-current-remote-IP-if-it-resolve.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-From 6f7a3b33bc044e0c212be54be74b9497d513ca86 Mon Sep 17 00:00:00 2001
-From: Tobias Brunner <tobias@strongswan.org>
-Date: Fri, 10 Jul 2015 10:23:02 +0200
-Subject: [PATCH] ike: Fall back to the current remote IP if it resolves to
- %any
-
-In some situations it might be valid for a host that configures
-right=%any to reestablish or reauthenticate an IKE_SA. Using %any would
-immediately abort the initiation causing the new SA to fail (which
-might already have the existing CHILD_SAs assigned).
-
-Fixes #1027.
----
- src/libcharon/sa/ike_sa.c | 7 ++++++-
- 1 file changed, 6 insertions(+), 1 deletion(-)
-
-diff --git a/src/libcharon/sa/ike_sa.c b/src/libcharon/sa/ike_sa.c
-index 0c13c58..752a756 100644
---- a/src/libcharon/sa/ike_sa.c
-+++ b/src/libcharon/sa/ike_sa.c
-@@ -1224,7 +1224,12 @@ static void resolve_hosts(private_ike_sa_t *this)
- 	}
- 	if (host)
- 	{
--		set_other_host(this, host);
-+		if (!host->is_anyaddr(host) ||
-+			this->other_host->is_anyaddr(this->other_host))
-+		{	/* don't set to %any if we currently have an address, but the
-+			 * address family might have changed */
-+			set_other_host(this, host);
-+		}
- 	}
- 
- 	if (this->local_host)
--- 
-2.4.6
-
diff --git a/main/strongswan/0006-trap-manager-Properly-check-in-IKE_SA-if-initiating-.patch b/main/strongswan/0006-trap-manager-Properly-check-in-IKE_SA-if-initiating-.patch
deleted file mode 100644
index f7517568c..000000000
--- a/main/strongswan/0006-trap-manager-Properly-check-in-IKE_SA-if-initiating-.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 773fcb1605d413997450b59d114a1c035910cc58 Mon Sep 17 00:00:00 2001
-From: Tobias Brunner <tobias@strongswan.org>
-Date: Thu, 9 Jul 2015 14:34:19 +0200
-Subject: [PATCH] trap-manager: Properly check-in IKE_SA if initiating fails
-
-This basically reverts f4e822c1b422 ("trap-manager: don't check-in
-nonexisting IKE_SA if acquire fails").  As checkout_by_config() could
-return an already existing and established IKE_SA we have to properly
-destroy it, for instance, in case other threads are waiting to check
-it out.  checkin_and_destroy() should handle the case of a new SA
-properly (it produces a log message on level 1, though).
----
- src/libcharon/sa/trap_manager.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/src/libcharon/sa/trap_manager.c b/src/libcharon/sa/trap_manager.c
-index d6ff3c8..3a70bd1 100644
---- a/src/libcharon/sa/trap_manager.c
-+++ b/src/libcharon/sa/trap_manager.c
-@@ -377,8 +377,8 @@ METHOD(trap_manager_t, acquire, void,
- 		}
- 		else
- 		{
--			ike_sa->destroy(ike_sa);
--			charon->bus->set_sa(charon->bus, NULL);
-+			charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager,
-+														ike_sa);
- 		}
- 	}
- 	peer->destroy(peer);
--- 
-2.4.6
-
diff --git a/main/strongswan/0007-trap-manager-Changed-how-acquires-we-acted-on-are-tr.patch b/main/strongswan/0007-trap-manager-Changed-how-acquires-we-acted-on-are-tr.patch
deleted file mode 100644
index 1dea7b139..000000000
--- a/main/strongswan/0007-trap-manager-Changed-how-acquires-we-acted-on-are-tr.patch
+++ /dev/null
@@ -1,260 +0,0 @@
-From a229bdce625338117966a53efd0475b2c7c84566 Mon Sep 17 00:00:00 2001
-From: Tobias Brunner <tobias@strongswan.org>
-Date: Thu, 9 Jul 2015 12:00:56 +0200
-Subject: [PATCH] trap-manager: Changed how acquires we acted on are tracked
-
-This fixes potential race conditions in case complete() or flush() is
-executed before or concurrently with a thread that handles an acquire.
-It will also simplify tracking multiple acquires created for the same
-trap policy in the future.
-
-Also fixes the behavior in some error situations.
----
- src/libcharon/sa/trap_manager.c | 122 ++++++++++++++++++++++++++++------------
- 1 file changed, 86 insertions(+), 36 deletions(-)
-
-diff --git a/src/libcharon/sa/trap_manager.c b/src/libcharon/sa/trap_manager.c
-index 3a70bd1..83b6d6a 100644
---- a/src/libcharon/sa/trap_manager.c
-+++ b/src/libcharon/sa/trap_manager.c
-@@ -1,5 +1,5 @@
- /*
-- * Copyright (C) 2011-2013 Tobias Brunner
-+ * Copyright (C) 2011-2015 Tobias Brunner
-  * Copyright (C) 2009 Martin Willi
-  * Hochschule fuer Technik Rapperswil
-  *
-@@ -18,10 +18,10 @@
- 
- #include <hydra.h>
- #include <daemon.h>
-+#include <threading/mutex.h>
- #include <threading/rwlock.h>
- #include <collections/linked_list.h>
- 
--
- typedef struct private_trap_manager_t private_trap_manager_t;
- typedef struct trap_listener_t trap_listener_t;
- 
-@@ -67,6 +67,16 @@ struct private_trap_manager_t {
- 	trap_listener_t listener;
- 
- 	/**
-+	 * list of acquires we currently handle
-+	 */
-+	linked_list_t *acquires;
-+
-+	/**
-+	 * mutex for list of acquires
-+	 */
-+	mutex_t *mutex;
-+
-+	/**
- 	 * Whether to ignore traffic selectors from acquires
- 	 */
- 	bool ignore_acquire_ts;
-@@ -80,23 +90,45 @@ typedef struct {
- 	char *name;
- 	/** ref to peer_cfg to initiate */
- 	peer_cfg_t *peer_cfg;
--	/** ref to instanciated CHILD_SA */
-+	/** ref to instantiated CHILD_SA (i.e the trap policy) */
- 	child_sa_t *child_sa;
--	/** TRUE if an acquire is pending */
--	bool pending;
-+} entry_t;
-+
-+/**
-+ * A handled acquire
-+ */
-+typedef struct {
- 	/** pending IKE_SA connecting upon acquire */
- 	ike_sa_t *ike_sa;
--} entry_t;
-+	/** reqid of pending trap policy */
-+	u_int32_t reqid;
-+} acquire_t;
- 
- /**
-  * actually uninstall and destroy an installed entry
-  */
--static void destroy_entry(entry_t *entry)
-+static void destroy_entry(entry_t *this)
-+{
-+	this->child_sa->destroy(this->child_sa);
-+	this->peer_cfg->destroy(this->peer_cfg);
-+	free(this->name);
-+	free(this);
-+}
-+
-+/**
-+ * destroy a cached acquire entry
-+ */
-+static void destroy_acquire(acquire_t *this)
- {
--	entry->child_sa->destroy(entry->child_sa);
--	entry->peer_cfg->destroy(entry->peer_cfg);
--	free(entry->name);
--	free(entry);
-+	free(this);
-+}
-+
-+/**
-+ * match an acquire entry by reqid
-+ */
-+static bool acquire_by_reqid(acquire_t *this, u_int32_t *reqid)
-+{
-+	return this->reqid == *reqid;
- }
- 
- METHOD(trap_manager_t, install, u_int32_t,
-@@ -314,6 +346,7 @@ METHOD(trap_manager_t, acquire, void,
- {
- 	enumerator_t *enumerator;
- 	entry_t *entry, *found = NULL;
-+	acquire_t *acquire;
- 	peer_cfg_t *peer;
- 	child_cfg_t *child;
- 	ike_sa_t *ike_sa;
-@@ -337,16 +370,29 @@ METHOD(trap_manager_t, acquire, void,
- 		this->lock->unlock(this->lock);
- 		return;
- 	}
--	if (!cas_bool(&found->pending, FALSE, TRUE))
-+	reqid = found->child_sa->get_reqid(found->child_sa);
-+
-+	this->mutex->lock(this->mutex);
-+	if (this->acquires->find_first(this->acquires, (void*)acquire_by_reqid,
-+								  (void**)&acquire, &reqid) == SUCCESS)
- 	{
- 		DBG1(DBG_CFG, "ignoring acquire, connection attempt pending");
-+		this->mutex->unlock(this->mutex);
- 		this->lock->unlock(this->lock);
- 		return;
- 	}
-+	else
-+	{
-+		INIT(acquire,
-+			.reqid = reqid,
-+		);
-+		this->acquires->insert_last(this->acquires, acquire);
-+	}
-+	this->mutex->unlock(this->mutex);
-+
- 	peer = found->peer_cfg->get_ref(found->peer_cfg);
- 	child = found->child_sa->get_config(found->child_sa);
- 	child = child->get_ref(child);
--	reqid = found->child_sa->get_reqid(found->child_sa);
- 	/* don't hold the lock while checking out the IKE_SA */
- 	this->lock->unlock(this->lock);
- 
-@@ -363,16 +409,13 @@ METHOD(trap_manager_t, acquire, void,
- 			 * have a single TS that we can establish in a Quick Mode. */
- 			src = dst = NULL;
- 		}
-+
-+		this->mutex->lock(this->mutex);
-+		acquire->ike_sa = ike_sa;
-+		this->mutex->unlock(this->mutex);
-+
- 		if (ike_sa->initiate(ike_sa, child, reqid, src, dst) != DESTROY_ME)
- 		{
--			/* make sure the entry is still there */
--			this->lock->read_lock(this->lock);
--			if (this->traps->find_first(this->traps, NULL,
--										(void**)&found) == SUCCESS)
--			{
--				found->ike_sa = ike_sa;
--			}
--			this->lock->unlock(this->lock);
- 			charon->ike_sa_manager->checkin(charon->ike_sa_manager, ike_sa);
- 		}
- 		else
-@@ -381,6 +424,14 @@ METHOD(trap_manager_t, acquire, void,
- 														ike_sa);
- 		}
- 	}
-+	else
-+	{
-+		this->mutex->lock(this->mutex);
-+		this->acquires->remove(this->acquires, acquire, NULL);
-+		this->mutex->unlock(this->mutex);
-+		destroy_acquire(acquire);
-+		child->destroy(child);
-+	}
- 	peer->destroy(peer);
- }
- 
-@@ -391,26 +442,25 @@ static void complete(private_trap_manager_t *this, ike_sa_t *ike_sa,
- 					 child_sa_t *child_sa)
- {
- 	enumerator_t *enumerator;
--	entry_t *entry;
-+	acquire_t *acquire;
- 
--	this->lock->read_lock(this->lock);
--	enumerator = this->traps->create_enumerator(this->traps);
--	while (enumerator->enumerate(enumerator, &entry))
-+	this->mutex->lock(this->mutex);
-+	enumerator = this->acquires->create_enumerator(this->acquires);
-+	while (enumerator->enumerate(enumerator, &acquire))
- 	{
--		if (entry->ike_sa != ike_sa)
-+		if (!acquire->ike_sa || acquire->ike_sa != ike_sa)
- 		{
- 			continue;
- 		}
--		if (child_sa && child_sa->get_reqid(child_sa) !=
--									entry->child_sa->get_reqid(entry->child_sa))
-+		if (child_sa && child_sa->get_reqid(child_sa) != acquire->reqid)
- 		{
- 			continue;
- 		}
--		entry->ike_sa = NULL;
--		entry->pending = FALSE;
-+		this->acquires->remove_at(this->acquires, enumerator);
-+		destroy_acquire(acquire);
- 	}
- 	enumerator->destroy(enumerator);
--	this->lock->unlock(this->lock);
-+	this->mutex->unlock(this->mutex);
- }
- 
- METHOD(listener_t, ike_state_change, bool,
-@@ -444,14 +494,10 @@ METHOD(listener_t, child_state_change, bool,
- METHOD(trap_manager_t, flush, void,
- 	private_trap_manager_t *this)
- {
--	linked_list_t *traps;
--	/* since destroying the CHILD_SA results in events which require a read
--	 * lock we cannot destroy the list while holding the write lock */
- 	this->lock->write_lock(this->lock);
--	traps = this->traps;
-+	this->traps->destroy_function(this->traps, (void*)destroy_entry);
- 	this->traps = linked_list_create();
- 	this->lock->unlock(this->lock);
--	traps->destroy_function(traps, (void*)destroy_entry);
- }
- 
- METHOD(trap_manager_t, destroy, void,
-@@ -459,6 +505,8 @@ METHOD(trap_manager_t, destroy, void,
- {
- 	charon->bus->remove_listener(charon->bus, &this->listener.listener);
- 	this->traps->destroy_function(this->traps, (void*)destroy_entry);
-+	this->acquires->destroy_function(this->acquires, (void*)destroy_acquire);
-+	this->mutex->destroy(this->mutex);
- 	this->lock->destroy(this->lock);
- 	free(this);
- }
-@@ -488,6 +536,8 @@ trap_manager_t *trap_manager_create(void)
- 			},
- 		},
- 		.traps = linked_list_create(),
-+		.acquires = linked_list_create(),
-+		.mutex = mutex_create(MUTEX_TYPE_DEFAULT),
- 		.lock = rwlock_create(RWLOCK_TYPE_DEFAULT),
- 		.ignore_acquire_ts = lib->settings->get_bool(lib->settings,
- 										"%s.ignore_acquire_ts", FALSE, lib->ns),
--- 
-2.4.6
-
diff --git a/main/strongswan/0008-trap-manager-Resolve-race-conditions-between-flush-a.patch b/main/strongswan/0008-trap-manager-Resolve-race-conditions-between-flush-a.patch
deleted file mode 100644
index 60a28724c..000000000
--- a/main/strongswan/0008-trap-manager-Resolve-race-conditions-between-flush-a.patch
+++ /dev/null
@@ -1,118 +0,0 @@
-From 12b3cdba7689113558f58a5265827f3086852bae Mon Sep 17 00:00:00 2001
-From: Tobias Brunner <tobias@strongswan.org>
-Date: Mon, 13 Jul 2015 13:20:14 +0200
-Subject: [PATCH] trap-manager: Resolve race conditions between flush() and
- install()
-
-When flush() is called there might be threads in install() waiting for
-trap policies to get installed (without holding the lock).  We have to
-wait until they updated the entries with the respective CHILD_SAs before
-destroying the list.
-
-We also have to prevent further trap policy installations (and wait until
-threads in install() are really finished), otherwise we might end up
-destroying CHILD_SA objects after the kernel interface implementations
-have already been unloaded (avoiding this is the whole point of calling
-flush() before unloading the plugins).
----
- src/libcharon/sa/trap_manager.c | 31 +++++++++++++++++++++++++++++++
- 1 file changed, 31 insertions(+)
-
-diff --git a/src/libcharon/sa/trap_manager.c b/src/libcharon/sa/trap_manager.c
-index 83b6d6a..424d9e7 100644
---- a/src/libcharon/sa/trap_manager.c
-+++ b/src/libcharon/sa/trap_manager.c
-@@ -20,8 +20,11 @@
- #include <daemon.h>
- #include <threading/mutex.h>
- #include <threading/rwlock.h>
-+#include <threading/rwlock_condvar.h>
- #include <collections/linked_list.h>
- 
-+#define INSTALL_DISABLED ((u_int)~0)
-+
- typedef struct private_trap_manager_t private_trap_manager_t;
- typedef struct trap_listener_t trap_listener_t;
- 
-@@ -77,6 +80,16 @@ struct private_trap_manager_t {
- 	mutex_t *mutex;
- 
- 	/**
-+	 * number of threads currently installing trap policies, or INSTALL_DISABLED
-+	 */
-+	u_int installing;
-+
-+	/**
-+	 * condvar to signal trap policy installation
-+	 */
-+	rwlock_condvar_t *condvar;
-+
-+	/**
- 	 * Whether to ignore traffic selectors from acquires
- 	 */
- 	bool ignore_acquire_ts;
-@@ -171,6 +184,11 @@ METHOD(trap_manager_t, install, u_int32_t,
- 	}
- 
- 	this->lock->write_lock(this->lock);
-+	if (this->installing == INSTALL_DISABLED)
-+	{	/* flush() has been called */
-+		this->lock->unlock(this->lock);
-+		return 0;
-+	}
- 	enumerator = this->traps->create_enumerator(this->traps);
- 	while (enumerator->enumerate(enumerator, &entry))
- 	{
-@@ -204,6 +222,7 @@ METHOD(trap_manager_t, install, u_int32_t,
- 		.peer_cfg = peer->get_ref(peer),
- 	);
- 	this->traps->insert_first(this->traps, entry);
-+	this->installing++;
- 	/* don't hold lock while creating CHILD_SA and installing policies */
- 	this->lock->unlock(this->lock);
- 
-@@ -252,6 +271,11 @@ METHOD(trap_manager_t, install, u_int32_t,
- 	{
- 		destroy_entry(found);
- 	}
-+	this->lock->write_lock(this->lock);
-+	/* do this at the end, so entries created temporarily are also destroyed */
-+	this->installing--;
-+	this->condvar->signal(this->condvar);
-+	this->lock->unlock(this->lock);
- 	return reqid;
- }
- 
-@@ -495,8 +519,13 @@ METHOD(trap_manager_t, flush, void,
- 	private_trap_manager_t *this)
- {
- 	this->lock->write_lock(this->lock);
-+	while (this->installing)
-+	{
-+		this->condvar->wait(this->condvar, this->lock);
-+	}
- 	this->traps->destroy_function(this->traps, (void*)destroy_entry);
- 	this->traps = linked_list_create();
-+	this->installing = INSTALL_DISABLED;
- 	this->lock->unlock(this->lock);
- }
- 
-@@ -506,6 +535,7 @@ METHOD(trap_manager_t, destroy, void,
- 	charon->bus->remove_listener(charon->bus, &this->listener.listener);
- 	this->traps->destroy_function(this->traps, (void*)destroy_entry);
- 	this->acquires->destroy_function(this->acquires, (void*)destroy_acquire);
-+	this->condvar->destroy(this->condvar);
- 	this->mutex->destroy(this->mutex);
- 	this->lock->destroy(this->lock);
- 	free(this);
-@@ -539,6 +569,7 @@ trap_manager_t *trap_manager_create(void)
- 		.acquires = linked_list_create(),
- 		.mutex = mutex_create(MUTEX_TYPE_DEFAULT),
- 		.lock = rwlock_create(RWLOCK_TYPE_DEFAULT),
-+		.condvar = rwlock_condvar_create(),
- 		.ignore_acquire_ts = lib->settings->get_bool(lib->settings,
- 										"%s.ignore_acquire_ts", FALSE, lib->ns),
- 	);
--- 
-2.4.6
-
diff --git a/main/strongswan/0009-shunt-manager-Add-a-lock-to-safely-access-the-list-o.patch b/main/strongswan/0009-shunt-manager-Add-a-lock-to-safely-access-the-list-o.patch
deleted file mode 100644
index 6fa2c339f..000000000
--- a/main/strongswan/0009-shunt-manager-Add-a-lock-to-safely-access-the-list-o.patch
+++ /dev/null
@@ -1,112 +0,0 @@
-From f3d39666e0d62fb9a790b72ee7ae2b9255b21cdd Mon Sep 17 00:00:00 2001
-From: Tobias Brunner <tobias@strongswan.org>
-Date: Tue, 14 Jul 2015 16:35:21 +0200
-Subject: [PATCH] shunt-manager: Add a lock to safely access the list of shunt
- policies
-
----
- src/libcharon/sa/shunt_manager.c | 20 +++++++++++++++++---
- 1 file changed, 17 insertions(+), 3 deletions(-)
-
-diff --git a/src/libcharon/sa/shunt_manager.c b/src/libcharon/sa/shunt_manager.c
-index 73e1abb..434bace 100644
---- a/src/libcharon/sa/shunt_manager.c
-+++ b/src/libcharon/sa/shunt_manager.c
-@@ -1,4 +1,5 @@
- /*
-+ * Copyright (C) 2015 Tobias Brunner
-  * Copyright (C) 2011 Andreas Steffen
-  * HSR Hochschule fuer Technik Rapperswil
-  *
-@@ -20,7 +21,6 @@
- #include <threading/rwlock.h>
- #include <collections/linked_list.h>
- 
--
- typedef struct private_shunt_manager_t private_shunt_manager_t;
- 
- /**
-@@ -37,6 +37,11 @@ struct private_shunt_manager_t {
- 	 * Installed shunts, as child_cfg_t
- 	 */
- 	linked_list_t *shunts;
-+
-+	/**
-+	 * Lock to safely access the list of shunts
-+	 */
-+	rwlock_t *lock;
- };
- 
- /**
-@@ -120,6 +125,7 @@ METHOD(shunt_manager_t, install, bool,
- 	bool found = FALSE;
- 
- 	/* check if not already installed */
-+	this->lock->write_lock(this->lock);
- 	enumerator = this->shunts->create_enumerator(this->shunts);
- 	while (enumerator->enumerate(enumerator, &child_cfg))
- 	{
-@@ -130,14 +136,15 @@ METHOD(shunt_manager_t, install, bool,
- 		}
- 	}
- 	enumerator->destroy(enumerator);
--
- 	if (found)
- 	{
- 		DBG1(DBG_CFG, "shunt %N policy '%s' already installed",
- 			 ipsec_mode_names, child->get_mode(child), child->get_name(child));
-+		this->lock->unlock(this->lock);
- 		return TRUE;
- 	}
- 	this->shunts->insert_last(this->shunts, child->get_ref(child));
-+	this->lock->unlock(this->lock);
- 
- 	return install_shunt_policy(child);
- }
-@@ -215,6 +222,7 @@ METHOD(shunt_manager_t, uninstall, bool,
- 	enumerator_t *enumerator;
- 	child_cfg_t *child, *found = NULL;
- 
-+	this->lock->write_lock(this->lock);
- 	enumerator = this->shunts->create_enumerator(this->shunts);
- 	while (enumerator->enumerate(enumerator, &child))
- 	{
-@@ -226,6 +234,7 @@ METHOD(shunt_manager_t, uninstall, bool,
- 		}
- 	}
- 	enumerator->destroy(enumerator);
-+	this->lock->unlock(this->lock);
- 
- 	if (!found)
- 	{
-@@ -239,7 +248,10 @@ METHOD(shunt_manager_t, uninstall, bool,
- METHOD(shunt_manager_t, create_enumerator, enumerator_t*,
- 	private_shunt_manager_t *this)
- {
--	return this->shunts->create_enumerator(this->shunts);
-+	this->lock->read_lock(this->lock);
-+	return enumerator_create_cleaner(
-+							this->shunts->create_enumerator(this->shunts),
-+							(void*)this->lock->unlock, this->lock);
- }
- 
- METHOD(shunt_manager_t, destroy, void,
-@@ -253,6 +265,7 @@ METHOD(shunt_manager_t, destroy, void,
- 		child->destroy(child);
- 	}
- 	this->shunts->destroy(this->shunts);
-+	this->lock->destroy(this->lock);
- 	free(this);
- }
- 
-@@ -271,6 +284,7 @@ shunt_manager_t *shunt_manager_create()
- 			.destroy = _destroy,
- 		},
- 		.shunts = linked_list_create(),
-+		.lock = rwlock_create(RWLOCK_TYPE_DEFAULT),
- 	);
- 
- 	return &this->public;
--- 
-2.4.6
-
diff --git a/main/strongswan/0010-shunt-manager-Remove-stored-entries-if-installation-.patch b/main/strongswan/0010-shunt-manager-Remove-stored-entries-if-installation-.patch
deleted file mode 100644
index f8af98c62..000000000
--- a/main/strongswan/0010-shunt-manager-Remove-stored-entries-if-installation-.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From 616ff9a2369fd250a2b9e8d2a00f37e2e8d3a2f3 Mon Sep 17 00:00:00 2001
-From: Tobias Brunner <tobias@strongswan.org>
-Date: Tue, 14 Jul 2015 16:50:32 +0200
-Subject: [PATCH] shunt-manager: Remove stored entries if installation fails
-
----
- src/libcharon/sa/shunt_manager.c | 13 +++++++++++--
- 1 file changed, 11 insertions(+), 2 deletions(-)
-
-diff --git a/src/libcharon/sa/shunt_manager.c b/src/libcharon/sa/shunt_manager.c
-index 434bace..2e42e7e 100644
---- a/src/libcharon/sa/shunt_manager.c
-+++ b/src/libcharon/sa/shunt_manager.c
-@@ -122,7 +122,7 @@ METHOD(shunt_manager_t, install, bool,
- {
- 	enumerator_t *enumerator;
- 	child_cfg_t *child_cfg;
--	bool found = FALSE;
-+	bool found = FALSE, success;
- 
- 	/* check if not already installed */
- 	this->lock->write_lock(this->lock);
-@@ -146,7 +146,16 @@ METHOD(shunt_manager_t, install, bool,
- 	this->shunts->insert_last(this->shunts, child->get_ref(child));
- 	this->lock->unlock(this->lock);
- 
--	return install_shunt_policy(child);
-+	success = install_shunt_policy(child);
-+
-+	if (!success)
-+	{
-+		this->lock->write_lock(this->lock);
-+		this->shunts->remove(this->shunts, child, NULL);
-+		this->lock->unlock(this->lock);
-+		child->destroy(child);
-+	}
-+	return success;
- }
- 
- /**
--- 
-2.4.6
-
diff --git a/main/strongswan/0011-shunt-manager-Add-flush-method-to-properly-uninstall.patch b/main/strongswan/0011-shunt-manager-Add-flush-method-to-properly-uninstall.patch
deleted file mode 100644
index 3aa6b561b..000000000
--- a/main/strongswan/0011-shunt-manager-Add-flush-method-to-properly-uninstall.patch
+++ /dev/null
@@ -1,153 +0,0 @@
-From bc36530670cbbe2362053f1604f67e481afd336c Mon Sep 17 00:00:00 2001
-From: Tobias Brunner <tobias@strongswan.org>
-Date: Tue, 14 Jul 2015 16:55:36 +0200
-Subject: [PATCH] shunt-manager: Add flush() method to properly uninstall
- shunts
-
-This will allow us to uninstall shunts before unloading the
-kernel-interface plugins.
----
- src/libcharon/sa/shunt_manager.c | 44 ++++++++++++++++++++++++++++++++++++----
- src/libcharon/sa/shunt_manager.h |  6 ++++++
- 2 files changed, 46 insertions(+), 4 deletions(-)
-
-diff --git a/src/libcharon/sa/shunt_manager.c b/src/libcharon/sa/shunt_manager.c
-index 2e42e7e..1a98443 100644
---- a/src/libcharon/sa/shunt_manager.c
-+++ b/src/libcharon/sa/shunt_manager.c
-@@ -19,8 +19,11 @@
- #include <hydra.h>
- #include <daemon.h>
- #include <threading/rwlock.h>
-+#include <threading/rwlock_condvar.h>
- #include <collections/linked_list.h>
- 
-+#define INSTALL_DISABLED ((u_int)~0)
-+
- typedef struct private_shunt_manager_t private_shunt_manager_t;
- 
- /**
-@@ -42,6 +45,16 @@ struct private_shunt_manager_t {
- 	 * Lock to safely access the list of shunts
- 	 */
- 	rwlock_t *lock;
-+
-+	/**
-+	 * Number of threads currently installing shunts, or INSTALL_DISABLED
-+	 */
-+	u_int installing;
-+
-+	/**
-+	 * Condvar to signal shunt installation
-+	 */
-+	rwlock_condvar_t *condvar;
- };
- 
- /**
-@@ -126,6 +139,11 @@ METHOD(shunt_manager_t, install, bool,
- 
- 	/* check if not already installed */
- 	this->lock->write_lock(this->lock);
-+	if (this->installing == INSTALL_DISABLED)
-+	{	/* flush() has been called */
-+		this->lock->unlock(this->lock);
-+		return FALSE;
-+	}
- 	enumerator = this->shunts->create_enumerator(this->shunts);
- 	while (enumerator->enumerate(enumerator, &child_cfg))
- 	{
-@@ -144,17 +162,20 @@ METHOD(shunt_manager_t, install, bool,
- 		return TRUE;
- 	}
- 	this->shunts->insert_last(this->shunts, child->get_ref(child));
-+	this->installing++;
- 	this->lock->unlock(this->lock);
- 
- 	success = install_shunt_policy(child);
- 
-+	this->lock->write_lock(this->lock);
- 	if (!success)
- 	{
--		this->lock->write_lock(this->lock);
- 		this->shunts->remove(this->shunts, child, NULL);
--		this->lock->unlock(this->lock);
- 		child->destroy(child);
- 	}
-+	this->installing--;
-+	this->condvar->signal(this->condvar);
-+	this->lock->unlock(this->lock);
- 	return success;
- }
- 
-@@ -263,18 +284,31 @@ METHOD(shunt_manager_t, create_enumerator, enumerator_t*,
- 							(void*)this->lock->unlock, this->lock);
- }
- 
--METHOD(shunt_manager_t, destroy, void,
-+METHOD(shunt_manager_t, flush, void,
- 	private_shunt_manager_t *this)
- {
- 	child_cfg_t *child;
- 
-+	this->lock->write_lock(this->lock);
-+	while (this->installing)
-+	{
-+		this->condvar->wait(this->condvar, this->lock);
-+	}
- 	while (this->shunts->remove_last(this->shunts, (void**)&child) == SUCCESS)
- 	{
- 		uninstall_shunt_policy(child);
- 		child->destroy(child);
- 	}
--	this->shunts->destroy(this->shunts);
-+	this->installing = INSTALL_DISABLED;
-+	this->lock->unlock(this->lock);
-+}
-+
-+METHOD(shunt_manager_t, destroy, void,
-+	private_shunt_manager_t *this)
-+{
-+	this->shunts->destroy_offset(this->shunts, offsetof(child_cfg_t, destroy));
- 	this->lock->destroy(this->lock);
-+	this->condvar->destroy(this->condvar);
- 	free(this);
- }
- 
-@@ -290,10 +324,12 @@ shunt_manager_t *shunt_manager_create()
- 			.install = _install,
- 			.uninstall = _uninstall,
- 			.create_enumerator = _create_enumerator,
-+			.flush = _flush,
- 			.destroy = _destroy,
- 		},
- 		.shunts = linked_list_create(),
- 		.lock = rwlock_create(RWLOCK_TYPE_DEFAULT),
-+		.condvar = rwlock_condvar_create(),
- 	);
- 
- 	return &this->public;
-diff --git a/src/libcharon/sa/shunt_manager.h b/src/libcharon/sa/shunt_manager.h
-index 28a795d..c43f5db 100644
---- a/src/libcharon/sa/shunt_manager.h
-+++ b/src/libcharon/sa/shunt_manager.h
-@@ -1,4 +1,5 @@
- /*
-+ * Copyright (C) 2015 Tobias Brunner
-  * Copyright (C) 2011 Andreas Steffen
-  * HSR Hochschule fuer Technik Rapperswil
-  *
-@@ -56,6 +57,11 @@ struct shunt_manager_t {
- 	enumerator_t* (*create_enumerator)(shunt_manager_t *this);
- 
- 	/**
-+	 * Clear any installed shunt.
-+	 */
-+	void (*flush)(shunt_manager_t *this);
-+
-+	/**
- 	 * Destroy a shunt_manager_t.
- 	 */
- 	void (*destroy)(shunt_manager_t *this);
--- 
-2.4.6
-
diff --git a/main/strongswan/0012-daemon-Flush-shunts-before-unloading-plugins.patch b/main/strongswan/0012-daemon-Flush-shunts-before-unloading-plugins.patch
deleted file mode 100644
index 9d3be529b..000000000
--- a/main/strongswan/0012-daemon-Flush-shunts-before-unloading-plugins.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From c04345d5edbbc4c37027cdfc21dba85d03e312af Mon Sep 17 00:00:00 2001
-From: Tobias Brunner <tobias@strongswan.org>
-Date: Tue, 14 Jul 2015 16:56:33 +0200
-Subject: [PATCH] daemon: Flush shunts before unloading plugins
-
----
- src/libcharon/daemon.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/src/libcharon/daemon.c b/src/libcharon/daemon.c
-index b1b8f57..316be76 100644
---- a/src/libcharon/daemon.c
-+++ b/src/libcharon/daemon.c
-@@ -462,6 +462,10 @@ static void destroy(private_daemon_t *this)
- 	{
- 		this->public.traps->flush(this->public.traps);
- 	}
-+	if (this->public.shunts)
-+	{
-+		this->public.shunts->flush(this->public.shunts);
-+	}
- 	if (this->public.sender)
- 	{
- 		this->public.sender->flush(this->public.sender);
--- 
-2.4.6
-
diff --git a/main/strongswan/0013-ike-rekey-Reset-IKE_SA-on-the-bus-after-destroying-n.patch b/main/strongswan/0013-ike-rekey-Reset-IKE_SA-on-the-bus-after-destroying-n.patch
deleted file mode 100644
index 56038b46f..000000000
--- a/main/strongswan/0013-ike-rekey-Reset-IKE_SA-on-the-bus-after-destroying-n.patch
+++ /dev/null
@@ -1,105 +0,0 @@
-From 86d20b0b40066590f5e26d1f9aca21cc0cba97e1 Mon Sep 17 00:00:00 2001
-From: Tobias Brunner <tobias@strongswan.org>
-Date: Mon, 15 Jun 2015 11:46:33 +0200
-Subject: [PATCH] ike-rekey: Reset IKE_SA on the bus after destroying new
- IKE_SA
-
-The destroy() method sets the IKE_SA on the bus to NULL, we reset it to
-the current IKE_SA so any events and log messages that follow happen in
-the correct context.
-
-A practical example where this is problematic is a DH group mismatch,
-which causes the first CREATE_CHILD_SA exchange to fail.  Because the SA
-was not reset previously, the message() hook for the CREATE_CHILD_SA
-response, for instance, was triggered outside the context of an IKE_SA,
-that is, the ike_sa parameter was NULL, which is definitely not expected
-by several plugins.
-
-Fixes #862.
----
- src/libcharon/sa/ikev2/tasks/ike_rekey.c | 31 +++++++++++++++----------------
- 1 file changed, 15 insertions(+), 16 deletions(-)
-
-diff --git a/src/libcharon/sa/ikev2/tasks/ike_rekey.c b/src/libcharon/sa/ikev2/tasks/ike_rekey.c
-index 1855517..1dfdc05 100644
---- a/src/libcharon/sa/ikev2/tasks/ike_rekey.c
-+++ b/src/libcharon/sa/ikev2/tasks/ike_rekey.c
-@@ -116,7 +116,6 @@ static void establish_new(private_ike_rekey_t *this)
- 			lib->processor->queue_job(lib->processor, job);
- 		}
- 		this->new_sa = NULL;
--		/* set threads active IKE_SA after checkin */
- 		charon->bus->set_sa(charon->bus, this->ike_sa);
- 	}
- }
-@@ -335,15 +334,13 @@ METHOD(task_t, process_i, status_t,
- 				{
- 					charon->ike_sa_manager->checkin(
- 								charon->ike_sa_manager, this->new_sa);
--					/* set threads active IKE_SA after checkin */
--					charon->bus->set_sa(charon->bus, this->ike_sa);
- 				}
-+				charon->bus->set_sa(charon->bus, this->ike_sa);
- 				this->new_sa = NULL;
- 				establish_new(other);
- 				return SUCCESS;
- 			}
- 		}
--		/* set threads active IKE_SA after checkin */
- 		charon->bus->set_sa(charon->bus, this->ike_sa);
- 	}
- 
-@@ -372,9 +369,13 @@ METHOD(ike_rekey_t, collide, void,
- 	this->collision = other;
- }
- 
--METHOD(task_t, migrate, void,
--	private_ike_rekey_t *this, ike_sa_t *ike_sa)
-+/**
-+ * Cleanup the task
-+ */
-+static void cleanup(private_ike_rekey_t *this)
- {
-+	ike_sa_t *cur_sa;
-+
- 	if (this->ike_init)
- 	{
- 		this->ike_init->task.destroy(&this->ike_init->task);
-@@ -383,9 +384,16 @@ METHOD(task_t, migrate, void,
- 	{
- 		this->ike_delete->task.destroy(&this->ike_delete->task);
- 	}
-+	cur_sa = charon->bus->get_sa(charon->bus);
- 	DESTROY_IF(this->new_sa);
-+	charon->bus->set_sa(charon->bus, cur_sa);
- 	DESTROY_IF(this->collision);
-+}
- 
-+METHOD(task_t, migrate, void,
-+	private_ike_rekey_t *this, ike_sa_t *ike_sa)
-+{
-+	cleanup();
- 	this->collision = NULL;
- 	this->ike_sa = ike_sa;
- 	this->new_sa = NULL;
-@@ -396,16 +404,7 @@ METHOD(task_t, migrate, void,
- METHOD(task_t, destroy, void,
- 	private_ike_rekey_t *this)
- {
--	if (this->ike_init)
--	{
--		this->ike_init->task.destroy(&this->ike_init->task);
--	}
--	if (this->ike_delete)
--	{
--		this->ike_delete->task.destroy(&this->ike_delete->task);
--	}
--	DESTROY_IF(this->new_sa);
--	DESTROY_IF(this->collision);
-+	cleanup();
- 	free(this);
- }
- 
--- 
-2.4.6
-
diff --git a/main/strongswan/0014-ike-rekey-Reset-IKE_SA-on-bus-before-sending-CREATE_.patch b/main/strongswan/0014-ike-rekey-Reset-IKE_SA-on-bus-before-sending-CREATE_.patch
deleted file mode 100644
index 9aa06d925..000000000
--- a/main/strongswan/0014-ike-rekey-Reset-IKE_SA-on-bus-before-sending-CREATE_.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 2efcc9586714fd3ae26fe6ff57ea1b9ee09a58ea Mon Sep 17 00:00:00 2001
-From: Tobias Brunner <tobias@strongswan.org>
-Date: Mon, 15 Jun 2015 11:52:16 +0200
-Subject: [PATCH] ike-rekey: Reset IKE_SA on bus before sending CREATE_CHILD_SA
- response
-
-Even when there is no error the CREATE_CHILD_SA response should be sent
-in the context of the existing IKE_SA.
----
- src/libcharon/sa/ikev2/tasks/ike_rekey.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/src/libcharon/sa/ikev2/tasks/ike_rekey.c b/src/libcharon/sa/ikev2/tasks/ike_rekey.c
-index 1dfdc05..4133c93 100644
---- a/src/libcharon/sa/ikev2/tasks/ike_rekey.c
-+++ b/src/libcharon/sa/ikev2/tasks/ike_rekey.c
-@@ -228,9 +228,10 @@ METHOD(task_t, build_r, status_t,
- 
- 	if (this->ike_init->task.build(&this->ike_init->task, message) == FAILED)
- 	{
-+		charon->bus->set_sa(charon->bus, this->ike_sa);
- 		return SUCCESS;
- 	}
--
-+	charon->bus->set_sa(charon->bus, this->ike_sa);
- 	this->ike_sa->set_state(this->ike_sa, IKE_REKEYING);
- 
- 	/* rekeying successful, delete the IKE_SA using a subtask */
--- 
-2.4.6
-
diff --git a/main/strongswan/0015-ike-rekey-Fix-cleanup-call.patch b/main/strongswan/0015-ike-rekey-Fix-cleanup-call.patch
deleted file mode 100644
index e17cf30cd..000000000
--- a/main/strongswan/0015-ike-rekey-Fix-cleanup-call.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From 81f1aa8dc375a84d9f0dc3e4027f2aebf6d03b18 Mon Sep 17 00:00:00 2001
-From: Tobias Brunner <tobias@strongswan.org>
-Date: Mon, 27 Jul 2015 15:20:01 +0200
-Subject: [PATCH] ike-rekey: Fix cleanup() call
-
----
- src/libcharon/sa/ikev2/tasks/ike_rekey.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/src/libcharon/sa/ikev2/tasks/ike_rekey.c b/src/libcharon/sa/ikev2/tasks/ike_rekey.c
-index 4133c93..eaba04e 100644
---- a/src/libcharon/sa/ikev2/tasks/ike_rekey.c
-+++ b/src/libcharon/sa/ikev2/tasks/ike_rekey.c
-@@ -394,7 +394,7 @@ static void cleanup(private_ike_rekey_t *this)
- METHOD(task_t, migrate, void,
- 	private_ike_rekey_t *this, ike_sa_t *ike_sa)
- {
--	cleanup();
-+	cleanup(this);
- 	this->collision = NULL;
- 	this->ike_sa = ike_sa;
- 	this->new_sa = NULL;
-@@ -405,7 +405,7 @@ METHOD(task_t, migrate, void,
- METHOD(task_t, destroy, void,
- 	private_ike_rekey_t *this)
- {
--	cleanup();
-+	cleanup(this);
- 	free(this);
- }
- 
--- 
-2.4.6
-
diff --git a/main/strongswan/0016-ike-Fix-memory-leak-if-remote-address-is-kept.patch b/main/strongswan/0016-ike-Fix-memory-leak-if-remote-address-is-kept.patch
deleted file mode 100644
index 3b773d02a..000000000
--- a/main/strongswan/0016-ike-Fix-memory-leak-if-remote-address-is-kept.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From faebdeac8eafad7b5c2109d5a9ce0af41dbf315c Mon Sep 17 00:00:00 2001
-From: Tobias Brunner <tobias@strongswan.org>
-Date: Mon, 27 Jul 2015 19:37:41 +0200
-Subject: [PATCH] ike: Fix memory leak if remote address is kept
-
----
- src/libcharon/sa/ike_sa.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/src/libcharon/sa/ike_sa.c b/src/libcharon/sa/ike_sa.c
-index 752a756..6ffbd55 100644
---- a/src/libcharon/sa/ike_sa.c
-+++ b/src/libcharon/sa/ike_sa.c
-@@ -1230,6 +1230,10 @@ static void resolve_hosts(private_ike_sa_t *this)
- 			 * address family might have changed */
- 			set_other_host(this, host);
- 		}
-+		else
-+		{
-+			host->destroy(host);
-+		}
- 	}
- 
- 	if (this->local_host)
--- 
-2.4.6
-
diff --git a/main/strongswan/0017-kernel-netlink-unlock-mutex-in-del-policy.patch b/main/strongswan/0017-kernel-netlink-unlock-mutex-in-del-policy.patch
deleted file mode 100644
index 63f120d28..000000000
--- a/main/strongswan/0017-kernel-netlink-unlock-mutex-in-del-policy.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-From 1ce32c9cdcb1cfacd4c8389402a24c4ed7cf0109 Mon Sep 17 00:00:00 2001
-From: Tobias Brunner <tobias@strongswan.org>
-Date: Fri, 31 Jul 2015 11:20:24 +0200
-Subject: [PATCH] kernel-netlink: Unlock mutex in del_policy() if mark can't be
- added to message
-
----
- src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c b/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
-index a6cf977..e0f1dd7 100644
---- a/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
-+++ b/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
-@@ -2562,6 +2562,7 @@ METHOD(kernel_ipsec_t, del_policy, status_t,
- 
- 	if (!add_mark(hdr, sizeof(request), mark))
- 	{
-+		this->mutex->unlock(this->mutex);
- 		return FAILED;
- 	}
- 
diff --git a/main/strongswan/0101-kernel-netlink-Actually-verify-if-the-netlink-messag.patch b/main/strongswan/0101-kernel-netlink-Actually-verify-if-the-netlink-messag.patch
deleted file mode 100644
index 945f1da2b..000000000
--- a/main/strongswan/0101-kernel-netlink-Actually-verify-if-the-netlink-messag.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From e0e3b6d92b37ba6633a9cd7f0ed2bd3ce56fdcc0 Mon Sep 17 00:00:00 2001
-From: Tobias Brunner <tobias@strongswan.org>
-Date: Thu, 16 Jul 2015 11:43:44 +0200
-Subject: [PATCH] kernel-netlink: Actually verify if the netlink message
- exceeds the buffer size
-
-It might equal it and that's fine. With MSG_TRUNC we get the actual
-message size and can only report an error if we haven't received the
-complete message.
----
- src/libhydra/plugins/kernel_netlink/kernel_netlink_shared.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/src/libhydra/plugins/kernel_netlink/kernel_netlink_shared.c b/src/libhydra/plugins/kernel_netlink/kernel_netlink_shared.c
-index b0e3103..809d0f4 100644
---- a/src/libhydra/plugins/kernel_netlink/kernel_netlink_shared.c
-+++ b/src/libhydra/plugins/kernel_netlink/kernel_netlink_shared.c
-@@ -185,8 +185,8 @@ static ssize_t read_msg(private_netlink_socket_t *this,
- 			return -1;
- 		}
- 	}
--	len = recv(this->socket, buf, buflen, block ? 0 : MSG_DONTWAIT);
--	if (len == buflen)
-+	len = recv(this->socket, buf, buflen, (block ? 0 : MSG_DONTWAIT)|MSG_TRUNC);
-+	if (len > buflen)
- 	{
- 		DBG1(DBG_KNL, "netlink response exceeds buffer size");
- 		return 0;
--- 
-2.4.6
-
diff --git a/main/strongswan/0102-kernel-netlink-Use-the-PAGE_SIZE-as-default-for-the-.patch b/main/strongswan/0102-kernel-netlink-Use-the-PAGE_SIZE-as-default-for-the-.patch
deleted file mode 100644
index 410e15b0c..000000000
--- a/main/strongswan/0102-kernel-netlink-Use-the-PAGE_SIZE-as-default-for-the-.patch
+++ /dev/null
@@ -1,59 +0,0 @@
-From 7e40d9705de5e94ff64684573c573deb97950b5e Mon Sep 17 00:00:00 2001
-From: Tobias Brunner <tobias@strongswan.org>
-Date: Thu, 16 Jul 2015 11:50:22 +0200
-Subject: [PATCH] kernel-netlink: Use the PAGE_SIZE as default for the netlink
- receive buffer
-
-The kernel uses NLMSG_GOODSIZE as default buffer size, which defaults to
-the PAGE_SIZE if it is lower than 8192 or to that value otherwise.
-
-In some cases (e.g. for dump messages) the kernel might use up to 16k
-for messages, which might require increasing this value.
----
- conf/plugins/kernel-netlink.opt                             |  2 +-
- src/libhydra/plugins/kernel_netlink/kernel_netlink_shared.c | 12 +++++++++++-
- 2 files changed, 12 insertions(+), 2 deletions(-)
-
-diff --git a/conf/plugins/kernel-netlink.opt b/conf/plugins/kernel-netlink.opt
-index 4338a5f..6adefd8 100644
---- a/conf/plugins/kernel-netlink.opt
-+++ b/conf/plugins/kernel-netlink.opt
-@@ -1,4 +1,4 @@
--charon.plugins.kernel-netlink.buflen = 4096
-+charon.plugins.kernel-netlink.buflen = <min(PAGE_SIZE, 8192)>
- 	Buffer size for received Netlink messages.
- 
- charon.plugins.kernel-netlink.fwmark =
-diff --git a/src/libhydra/plugins/kernel_netlink/kernel_netlink_shared.c b/src/libhydra/plugins/kernel_netlink/kernel_netlink_shared.c
-index 809d0f4..ddb2254 100644
---- a/src/libhydra/plugins/kernel_netlink/kernel_netlink_shared.c
-+++ b/src/libhydra/plugins/kernel_netlink/kernel_netlink_shared.c
-@@ -571,7 +571,7 @@ netlink_socket_t *netlink_socket_create(int protocol, enum_name_t *names,
- 		.protocol = protocol,
- 		.names = names,
- 		.buflen = lib->settings->get_int(lib->settings,
--							"%s.plugins.kernel-netlink.buflen", 4096, lib->ns),
-+							"%s.plugins.kernel-netlink.buflen", 0, lib->ns),
- 		.timeout = lib->settings->get_int(lib->settings,
- 							"%s.plugins.kernel-netlink.timeout", 0, lib->ns),
- 		.retries = lib->settings->get_int(lib->settings,
-@@ -582,6 +582,16 @@ netlink_socket_t *netlink_socket_create(int protocol, enum_name_t *names,
- 		.parallel = parallel,
- 	);
- 
-+	if (!this->buflen)
-+	{
-+		long pagesize = sysconf(_SC_PAGESIZE);
-+		if (pagesize == -1)
-+		{
-+			pagesize = 4096;
-+		}
-+		/* base this on NLMSG_GOODSIZE */
-+		this->buflen = min(pagesize, 8192);
-+	}
- 	if (this->socket == -1)
- 	{
- 		DBG1(DBG_KNL, "unable to create netlink socket");
--- 
-2.4.6
-
diff --git a/main/strongswan/0103-kernel-netlink-when-adding-policy-do-an-update-if-it.patch b/main/strongswan/0103-kernel-netlink-when-adding-policy-do-an-update-if-it.patch
deleted file mode 100644
index 134ce6406..000000000
--- a/main/strongswan/0103-kernel-netlink-when-adding-policy-do-an-update-if-it.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From cd83d5c5e51db6c903496369f6edc74901703eb7 Mon Sep 17 00:00:00 2001
-From: Tobias Brunner <tobias@strongswan.org>
-Date: Wed, 3 Jun 2015 17:31:30 +0200
-Subject: [PATCH] kernel-netlink: When adding a policy do an update if it
- already exists
-
-This may be the case when SAs are reestablished after a crash of the
-IKE daemon.
----
- src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c | 10 +++++++++-
- 1 file changed, 9 insertions(+), 1 deletion(-)
-
-diff --git a/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c b/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
-index f22e07d..e41c10a 100644
---- a/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
-+++ b/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
-@@ -2057,6 +2057,7 @@ static status_t add_policy_internal(private_kernel_netlink_ipsec_t *this,
- 	ipsec_sa_t *ipsec = mapping->sa;
- 	struct xfrm_userpolicy_info *policy_info;
- 	struct nlmsghdr *hdr;
-+	status_t status;
- 	int i;
- 
- 	/* clone the policy so we are able to check it out again later */
-@@ -2151,7 +2152,14 @@ static status_t add_policy_internal(private_kernel_netlink_ipsec_t *this,
- 	}
- 	this->mutex->unlock(this->mutex);
- 
--	if (this->socket_xfrm->send_ack(this->socket_xfrm, hdr) != SUCCESS)
-+	status = this->socket_xfrm->send_ack(this->socket_xfrm, hdr);
-+	if (status == ALREADY_DONE && !update)
-+	{
-+		DBG1(DBG_KNL, "policy already exists, try to update it");
-+		hdr->nlmsg_type = XFRM_MSG_UPDPOLICY;
-+		status = this->socket_xfrm->send_ack(this->socket_xfrm, hdr);
-+	}
-+	if (status != SUCCESS)
- 	{
- 		return FAILED;
- 	}
diff --git a/main/strongswan/0201-ike-Also-track-initiating-IKE_SAs-as-half-open.patch b/main/strongswan/0201-ike-Also-track-initiating-IKE_SAs-as-half-open.patch
deleted file mode 100644
index e7897c17c..000000000
--- a/main/strongswan/0201-ike-Also-track-initiating-IKE_SAs-as-half-open.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-From 36d77e36bb1556bebe0f98c06a757b123caef940 Mon Sep 17 00:00:00 2001
-From: Tobias Brunner <tobias@strongswan.org>
-Date: Fri, 17 Jul 2015 11:48:53 +0200
-Subject: [PATCH] ike: Also track initiating IKE_SAs as half-open
-
----
- src/libcharon/sa/ike_sa_manager.c | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/src/libcharon/sa/ike_sa_manager.c b/src/libcharon/sa/ike_sa_manager.c
-index 987260d..51b7f2c 100644
---- a/src/libcharon/sa/ike_sa_manager.c
-+++ b/src/libcharon/sa/ike_sa_manager.c
-@@ -1570,7 +1570,6 @@ METHOD(ike_sa_manager_t, checkin, void,
- 			put_half_open(this, entry);
- 		}
- 		else if (!entry->half_open &&
--				 !entry->ike_sa_id->is_initiator(entry->ike_sa_id) &&
- 				 ike_sa->get_state(ike_sa) == IKE_CONNECTING)
- 		{
- 			/* this is a new half-open SA */
--- 
-2.4.6
-
diff --git a/main/strongswan/0202-controller-Optionally-adhere-to-init-limits-also-whe.patch b/main/strongswan/0202-controller-Optionally-adhere-to-init-limits-also-whe.patch
deleted file mode 100644
index fbc54c11c..000000000
--- a/main/strongswan/0202-controller-Optionally-adhere-to-init-limits-also-whe.patch
+++ /dev/null
@@ -1,317 +0,0 @@
-From 0d6412ab81fbf0376cc99e9419de417e58dc0e72 Mon Sep 17 00:00:00 2001
-From: Tobias Brunner <tobias@strongswan.org>
-Date: Thu, 16 Jul 2015 17:21:54 +0200
-Subject: [PATCH] controller: Optionally adhere to init limits also when
- initiating IKE_SAs
-
----
- src/charon-cmd/cmd/cmd_connection.c                |  2 +-
- src/conftest/actions.c                             |  2 +-
- src/libcharon/control/controller.c                 | 54 ++++++++++++++++++++--
- src/libcharon/control/controller.h                 |  5 +-
- .../plugins/load_tester/load_tester_control.c      |  2 +-
- .../plugins/load_tester/load_tester_plugin.c       |  2 +-
- src/libcharon/plugins/medcli/medcli_config.c       |  2 +-
- src/libcharon/plugins/smp/smp.c                    |  2 +-
- src/libcharon/plugins/stroke/stroke_control.c      |  4 +-
- src/libcharon/plugins/uci/uci_control.c            |  2 +-
- src/libcharon/plugins/vici/vici_config.c           |  2 +-
- src/libcharon/plugins/vici/vici_control.c          |  4 +-
- .../processing/jobs/initiate_mediation_job.c       |  4 +-
- src/libcharon/processing/jobs/start_action_job.c   |  2 +-
- 15 files changed, 71 insertions(+), 20 deletions(-)
-
-diff --git a/src/charon-cmd/cmd/cmd_connection.c b/src/charon-cmd/cmd/cmd_connection.c
-index 2c0b7b9..0c6a504 100644
---- a/src/charon-cmd/cmd/cmd_connection.c
-+++ b/src/charon-cmd/cmd/cmd_connection.c
-@@ -434,7 +434,7 @@ static job_requeue_t initiate(private_cmd_connection_t *this)
- 	child_cfg = create_child_cfg(this, peer_cfg);
- 
- 	if (charon->controller->initiate(charon->controller, peer_cfg, child_cfg,
--									 controller_cb_empty, NULL, 0) != SUCCESS)
-+								controller_cb_empty, NULL, 0, FALSE) != SUCCESS)
- 	{
- 		terminate(pid);
- 	}
-diff --git a/src/conftest/actions.c b/src/conftest/actions.c
-index 474672c..256b63d 100644
---- a/src/conftest/actions.c
-+++ b/src/conftest/actions.c
-@@ -65,7 +65,7 @@ static job_requeue_t initiate(char *config)
- 	{
- 		DBG1(DBG_CFG, "initiating IKE_SA for CHILD_SA config '%s'", config);
- 		charon->controller->initiate(charon->controller, peer_cfg, child_cfg,
--									 NULL, NULL, 0);
-+									 NULL, NULL, 0, FALSE);
- 	}
- 	else
- 	{
-diff --git a/src/libcharon/control/controller.c b/src/libcharon/control/controller.c
-index fd8349e..097f5ac 100644
---- a/src/libcharon/control/controller.c
-+++ b/src/libcharon/control/controller.c
-@@ -1,5 +1,5 @@
- /*
-- * Copyright (C) 2011-2012 Tobias Brunner
-+ * Copyright (C) 2011-2015 Tobias Brunner
-  * Copyright (C) 2007-2011 Martin Willi
-  * Copyright (C) 2011 revosec AG
-  * Hochschule fuer Technik Rapperswil
-@@ -116,6 +116,11 @@ struct interface_listener_t {
- 	 * spinlock to update the IKE_SA handle properly
- 	 */
- 	spinlock_t *lock;
-+
-+	/**
-+	 * whether to check limits
-+	 */
-+	bool limits;
- };
- 
- 
-@@ -358,7 +363,6 @@ METHOD(job_t, initiate_execute, job_requeue_t,
- 		listener->child_cfg->destroy(listener->child_cfg);
- 		peer_cfg->destroy(peer_cfg);
- 		listener->status = FAILED;
--		/* release listener */
- 		listener_done(listener);
- 		return JOB_REQUEUE_NONE;
- 	}
-@@ -372,6 +376,49 @@ METHOD(job_t, initiate_execute, job_requeue_t,
- 	}
- 	peer_cfg->destroy(peer_cfg);
- 
-+	if (listener->limits && ike_sa->get_state(ike_sa) == IKE_CREATED)
-+	{	/* only check if we are not reusing an IKE_SA */
-+		u_int half_open, limit_half_open, limit_job_load;
-+
-+		half_open = charon->ike_sa_manager->get_half_open_count(
-+										charon->ike_sa_manager, NULL);
-+		limit_half_open = lib->settings->get_int(lib->settings,
-+										"%s.init_limit_half_open", 0, lib->ns);
-+		limit_job_load = lib->settings->get_int(lib->settings,
-+										"%s.init_limit_job_load", 0, lib->ns);
-+		if (limit_half_open && half_open >= limit_half_open)
-+		{
-+			DBG1(DBG_IKE, "abort IKE_SA initiation, half open IKE_SA count of "
-+				 "%d exceeds limit of %d", half_open, limit_half_open);
-+			charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager,
-+														ike_sa);
-+			listener->child_cfg->destroy(listener->child_cfg);
-+			listener->status = INVALID_STATE;
-+			listener_done(listener);
-+			return JOB_REQUEUE_NONE;
-+		}
-+		if (limit_job_load)
-+		{
-+			u_int jobs = 0, i;
-+
-+			for (i = 0; i < JOB_PRIO_MAX; i++)
-+			{
-+				jobs += lib->processor->get_job_load(lib->processor, i);
-+			}
-+			if (jobs > limit_job_load)
-+			{
-+				DBG1(DBG_IKE, "abort IKE_SA initiation, job load of %d exceeds "
-+					 "limit of %d", jobs, limit_job_load);
-+				charon->ike_sa_manager->checkin_and_destroy(
-+												charon->ike_sa_manager, ike_sa);
-+				listener->child_cfg->destroy(listener->child_cfg);
-+				listener->status = INVALID_STATE;
-+				listener_done(listener);
-+				return JOB_REQUEUE_NONE;
-+			}
-+		}
-+	}
-+
- 	if (ike_sa->initiate(ike_sa, listener->child_cfg, 0, NULL, NULL) == SUCCESS)
- 	{
- 		if (!listener->logger.callback)
-@@ -391,7 +438,7 @@ METHOD(job_t, initiate_execute, job_requeue_t,
- 
- METHOD(controller_t, initiate, status_t,
- 	private_controller_t *this, peer_cfg_t *peer_cfg, child_cfg_t *child_cfg,
--	controller_cb_t callback, void *param, u_int timeout)
-+	controller_cb_t callback, void *param, u_int timeout, bool limits)
- {
- 	interface_job_t *job;
- 	status_t status;
-@@ -414,6 +461,7 @@ METHOD(controller_t, initiate, status_t,
- 			.child_cfg = child_cfg,
- 			.peer_cfg = peer_cfg,
- 			.lock = spinlock_create(),
-+			.limits = limits,
- 		},
- 		.public = {
- 			.execute = _initiate_execute,
-diff --git a/src/libcharon/control/controller.h b/src/libcharon/control/controller.h
-index 02f4ebb..5ffeac5 100644
---- a/src/libcharon/control/controller.h
-+++ b/src/libcharon/control/controller.h
-@@ -82,15 +82,18 @@ struct controller_t {
- 	 * @param cb			logging callback
- 	 * @param param			parameter to include in each call of cb
- 	 * @param timeout		timeout in ms to wait for callbacks, 0 to disable
-+	 * @param limits		whether to check limits regarding IKE_SA initiation
- 	 * @return
- 	 *						- SUCCESS, if CHILD_SA established
- 	 *						- FAILED, if setup failed
- 	 *						- NEED_MORE, if callback returned FALSE
- 	 *						- OUT_OF_RES if timed out
-+	 *						- INVALID_STATE if limits prevented initiation
- 	 */
- 	status_t (*initiate)(controller_t *this,
- 						 peer_cfg_t *peer_cfg, child_cfg_t *child_cfg,
--						 controller_cb_t callback, void *param, u_int timeout);
-+						 controller_cb_t callback, void *param, u_int timeout,
-+						 bool limits);
- 
- 	/**
- 	 * Terminate an IKE_SA and all of its CHILD_SAs.
-diff --git a/src/libcharon/plugins/load_tester/load_tester_control.c b/src/libcharon/plugins/load_tester/load_tester_control.c
-index 5f089f5..24076d4 100644
---- a/src/libcharon/plugins/load_tester/load_tester_control.c
-+++ b/src/libcharon/plugins/load_tester/load_tester_control.c
-@@ -239,7 +239,7 @@ static bool on_accept(private_load_tester_control_t *this, stream_t *io)
- 
- 		switch (charon->controller->initiate(charon->controller,
- 										peer_cfg, child_cfg->get_ref(child_cfg),
--										(void*)initiate_cb, listener, 0))
-+										(void*)initiate_cb, listener, 0, FALSE))
- 		{
- 			case NEED_MORE:
- 				/* Callback returns FALSE once it got track of this IKE_SA.
-diff --git a/src/libcharon/plugins/load_tester/load_tester_plugin.c b/src/libcharon/plugins/load_tester/load_tester_plugin.c
-index e684f22..c7380b9 100644
---- a/src/libcharon/plugins/load_tester/load_tester_plugin.c
-+++ b/src/libcharon/plugins/load_tester/load_tester_plugin.c
-@@ -152,7 +152,7 @@ static job_requeue_t do_load_test(private_load_tester_plugin_t *this)
- 
- 		charon->controller->initiate(charon->controller,
- 					peer_cfg, child_cfg->get_ref(child_cfg),
--					NULL, NULL, 0);
-+					NULL, NULL, 0, FALSE);
- 		if (s)
- 		{
- 			sleep(s);
-diff --git a/src/libcharon/plugins/medcli/medcli_config.c b/src/libcharon/plugins/medcli/medcli_config.c
-index 1fb57b9..25b1383 100644
---- a/src/libcharon/plugins/medcli/medcli_config.c
-+++ b/src/libcharon/plugins/medcli/medcli_config.c
-@@ -314,7 +314,7 @@ static job_requeue_t initiate_config(peer_cfg_t *peer_cfg)
- 		peer_cfg->get_ref(peer_cfg);
- 		enumerator->destroy(enumerator);
- 		charon->controller->initiate(charon->controller,
--									 peer_cfg, child_cfg, NULL, NULL, 0);
-+									 peer_cfg, child_cfg, NULL, NULL, 0, FALSE);
- 	}
- 	else
- 	{
-diff --git a/src/libcharon/plugins/smp/smp.c b/src/libcharon/plugins/smp/smp.c
-index 04bf382..2aa061f 100644
---- a/src/libcharon/plugins/smp/smp.c
-+++ b/src/libcharon/plugins/smp/smp.c
-@@ -488,7 +488,7 @@ static void request_control_initiate(xmlTextReaderPtr reader,
- 			{
- 				status = charon->controller->initiate(charon->controller,
- 							peer, child, (controller_cb_t)xml_callback,
--							writer, 0);
-+							writer, 0, FALSE);
- 			}
- 			else
- 			{
-diff --git a/src/libcharon/plugins/stroke/stroke_control.c b/src/libcharon/plugins/stroke/stroke_control.c
-index 0084fbf..0125d17 100644
---- a/src/libcharon/plugins/stroke/stroke_control.c
-+++ b/src/libcharon/plugins/stroke/stroke_control.c
-@@ -109,7 +109,7 @@ static void charon_initiate(private_stroke_control_t *this, peer_cfg_t *peer_cfg
- 	if (msg->output_verbosity < 0)
- 	{
- 		charon->controller->initiate(charon->controller, peer_cfg, child_cfg,
--									 NULL, NULL, 0);
-+									 NULL, NULL, 0, FALSE);
- 	}
- 	else
- 	{
-@@ -118,7 +118,7 @@ static void charon_initiate(private_stroke_control_t *this, peer_cfg_t *peer_cfg
- 
- 		status = charon->controller->initiate(charon->controller,
- 							peer_cfg, child_cfg, (controller_cb_t)stroke_log,
--							&info, this->timeout);
-+							&info, this->timeout, FALSE);
- 		switch (status)
- 		{
- 			case SUCCESS:
-diff --git a/src/libcharon/plugins/uci/uci_control.c b/src/libcharon/plugins/uci/uci_control.c
-index cebc389..a7d26e6 100644
---- a/src/libcharon/plugins/uci/uci_control.c
-+++ b/src/libcharon/plugins/uci/uci_control.c
-@@ -147,7 +147,7 @@ static void initiate(private_uci_control_t *this, char *name)
- 		if (enumerator->enumerate(enumerator, &child_cfg) &&
- 			charon->controller->initiate(charon->controller, peer_cfg,
- 								child_cfg->get_ref(child_cfg),
--								controller_cb_empty, NULL, 0) == SUCCESS)
-+								controller_cb_empty, NULL, 0, FALSE) == SUCCESS)
- 		{
- 			write_fifo(this, "connection '%s' established\n", name);
- 		}
-diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c
-index d232599..dfea2ab 100644
---- a/src/libcharon/plugins/vici/vici_config.c
-+++ b/src/libcharon/plugins/vici/vici_config.c
-@@ -1558,7 +1558,7 @@ static void run_start_action(private_vici_config_t *this, peer_cfg_t *peer_cfg,
- 			DBG1(DBG_CFG, "initiating '%s'", child_cfg->get_name(child_cfg));
- 			charon->controller->initiate(charon->controller,
- 					peer_cfg->get_ref(peer_cfg), child_cfg->get_ref(child_cfg),
--					NULL, NULL, 0);
-+					NULL, NULL, 0, FALSE);
- 			break;
- 		case ACTION_ROUTE:
- 			DBG1(DBG_CFG, "installing '%s'", child_cfg->get_name(child_cfg));
-diff --git a/src/libcharon/plugins/vici/vici_control.c b/src/libcharon/plugins/vici/vici_control.c
-index 01d5036..e568239 100644
---- a/src/libcharon/plugins/vici/vici_control.c
-+++ b/src/libcharon/plugins/vici/vici_control.c
-@@ -184,8 +184,8 @@ CALLBACK(initiate, vici_message_t*,
- 	{
- 		return send_reply(this, "CHILD_SA config '%s' not found", child);
- 	}
--	switch (charon->controller->initiate(charon->controller,
--				peer_cfg, child_cfg, (controller_cb_t)log_vici, &log, timeout))
-+	switch (charon->controller->initiate(charon->controller, peer_cfg,
-+					child_cfg, (controller_cb_t)log_vici, &log, timeout, FALSE))
- 	{
- 		case SUCCESS:
- 			return send_reply(this, NULL);
-diff --git a/src/libcharon/processing/jobs/initiate_mediation_job.c b/src/libcharon/processing/jobs/initiate_mediation_job.c
-index 17ab830..5b5fb9d 100644
---- a/src/libcharon/processing/jobs/initiate_mediation_job.c
-+++ b/src/libcharon/processing/jobs/initiate_mediation_job.c
-@@ -119,8 +119,8 @@ METHOD(job_t, initiate, job_requeue_t,
- 		/* we need an additional reference because initiate consumes one */
- 		mediation_cfg->get_ref(mediation_cfg);
- 
--		if (charon->controller->initiate(charon->controller, mediation_cfg,
--				NULL, (controller_cb_t)initiate_callback, this, 0) != SUCCESS)
-+		if (charon->controller->initiate(charon->controller, mediation_cfg, NULL,
-+				(controller_cb_t)initiate_callback, this, 0, FALSE) != SUCCESS)
- 		{
- 			mediation_cfg->destroy(mediation_cfg);
- 			mediated_cfg->destroy(mediated_cfg);
-diff --git a/src/libcharon/processing/jobs/start_action_job.c b/src/libcharon/processing/jobs/start_action_job.c
-index 981473b..5e88ac2 100644
---- a/src/libcharon/processing/jobs/start_action_job.c
-+++ b/src/libcharon/processing/jobs/start_action_job.c
-@@ -61,7 +61,7 @@ METHOD(job_t, execute, job_requeue_t,
- 					charon->controller->initiate(charon->controller,
- 												 peer_cfg->get_ref(peer_cfg),
- 												 child_cfg->get_ref(child_cfg),
--												 NULL, NULL, 0);
-+												 NULL, NULL, 0, FALSE);
- 					break;
- 				case ACTION_ROUTE:
- 					DBG1(DBG_JOB, "start action: route '%s'", name);
--- 
-2.4.6
-
diff --git a/main/strongswan/0203-vici-Add-get_bool-convenience-getter-for-VICI-messag.patch b/main/strongswan/0203-vici-Add-get_bool-convenience-getter-for-VICI-messag.patch
deleted file mode 100644
index d6cc09071..000000000
--- a/main/strongswan/0203-vici-Add-get_bool-convenience-getter-for-VICI-messag.patch
+++ /dev/null
@@ -1,170 +0,0 @@
-From f3b6de5afdc48550680c12359154eb18a5812ecb Mon Sep 17 00:00:00 2001
-From: Tobias Brunner <tobias@strongswan.org>
-Date: Thu, 16 Jul 2015 17:51:40 +0200
-Subject: [PATCH] vici: Add get_bool() convenience getter for VICI messages
-
----
- src/libcharon/plugins/vici/suites/test_message.c | 31 ++++++++++++++++++
- src/libcharon/plugins/vici/vici_message.c        | 40 ++++++++++++++++++++++++
- src/libcharon/plugins/vici/vici_message.h        | 23 ++++++++++++++
- 3 files changed, 94 insertions(+)
-
-diff --git a/src/libcharon/plugins/vici/suites/test_message.c b/src/libcharon/plugins/vici/suites/test_message.c
-index e76d273..045e34f 100644
---- a/src/libcharon/plugins/vici/suites/test_message.c
-+++ b/src/libcharon/plugins/vici/suites/test_message.c
-@@ -1,4 +1,7 @@
- /*
-+ * Copyright (C) 2015 Tobias Brunner
-+ * Hochschule fuer Technik Rapperswil
-+ *
-  * Copyright (C) 2014 Martin Willi
-  * Copyright (C) 2014 revosec AG
-  *
-@@ -355,6 +358,33 @@ START_TEST(test_get_int)
- }
- END_TEST
- 
-+START_TEST(test_get_bool)
-+{
-+	vici_message_t *m;
-+
-+	m = build_getter_msg();
-+
-+	ck_assert(m->get_bool(m, TRUE, "key1"));
-+	ck_assert(m->get_bool(m, FALSE, "key1"));
-+
-+	ck_assert(m->get_bool(m, TRUE, "section1.key2"));
-+	ck_assert(m->get_bool(m, TRUE, "section1.section2.key3"));
-+	ck_assert(m->get_bool(m, TRUE, "section1.key4"));
-+	ck_assert(m->get_bool(m, TRUE, "key5"));
-+	ck_assert(m->get_bool(m, TRUE, "nonexistent"));
-+	ck_assert(m->get_bool(m, TRUE, "n.o.n.e.x.i.s.t.e.n.t"));
-+
-+	ck_assert(!m->get_bool(m, FALSE, "section1.key2"));
-+	ck_assert(!m->get_bool(m, FALSE, "section1.section2.key3"));
-+	ck_assert(!m->get_bool(m, FALSE, "section1.key4"));
-+	ck_assert(!m->get_bool(m, FALSE, "key5"));
-+	ck_assert(!m->get_bool(m, FALSE, "nonexistent"));
-+	ck_assert(!m->get_bool(m, FALSE, "n.o.n.e.x.i.s.t.e.n.t"));
-+
-+	m->destroy(m);
-+}
-+END_TEST
-+
- START_TEST(test_get_value)
- {
- 	vici_message_t *m;
-@@ -400,6 +430,7 @@ Suite *message_suite_create()
- 	tc = tcase_create("convenience getters");
- 	tcase_add_test(tc, test_get_str);
- 	tcase_add_test(tc, test_get_int);
-+	tcase_add_test(tc, test_get_bool);
- 	tcase_add_test(tc, test_get_value);
- 	suite_add_tcase(s, tc);
- 
-diff --git a/src/libcharon/plugins/vici/vici_message.c b/src/libcharon/plugins/vici/vici_message.c
-index e79fbc8..fb6e8a1 100644
---- a/src/libcharon/plugins/vici/vici_message.c
-+++ b/src/libcharon/plugins/vici/vici_message.c
-@@ -1,4 +1,7 @@
- /*
-+ * Copyright (C) 2015 Tobias Brunner
-+ * Hochschule fuer Technik Rapperswil
-+ *
-  * Copyright (C) 2014 Martin Willi
-  * Copyright (C) 2014 revosec AG
-  *
-@@ -385,6 +388,41 @@ METHOD(vici_message_t, get_int, int,
- 	return val;
- }
- 
-+METHOD(vici_message_t, vget_bool, bool,
-+	private_vici_message_t *this, bool def, char *fmt, va_list args)
-+{
-+	chunk_t value;
-+	bool found;
-+	char buf[16];
-+
-+	found = find_value(this, &value, fmt, args);
-+	if (found)
-+	{
-+		if (value.len == 0)
-+		{
-+			return def;
-+		}
-+		if (chunk_printable(value, NULL, 0))
-+		{
-+			snprintf(buf, sizeof(buf), "%.*s", (int)value.len, value.ptr);
-+			return settings_value_as_bool(buf, def);
-+		}
-+	}
-+	return def;
-+}
-+
-+METHOD(vici_message_t, get_bool, bool,
-+	private_vici_message_t *this, bool def, char *fmt, ...)
-+{
-+	va_list args;
-+	bool val;
-+
-+	va_start(args, fmt);
-+	val = vget_bool(this, def, fmt, args);
-+	va_end(args);
-+	return val;
-+}
-+
- METHOD(vici_message_t, vget_value, chunk_t,
- 	private_vici_message_t *this, chunk_t def, char *fmt, va_list args)
- {
-@@ -633,6 +671,8 @@ vici_message_t *vici_message_create_from_data(chunk_t data, bool cleanup)
- 			.vget_str = _vget_str,
- 			.get_int = _get_int,
- 			.vget_int = _vget_int,
-+			.get_bool = _get_bool,
-+			.vget_bool = _vget_bool,
- 			.get_value = _get_value,
- 			.vget_value = _vget_value,
- 			.get_encoding = _get_encoding,
-diff --git a/src/libcharon/plugins/vici/vici_message.h b/src/libcharon/plugins/vici/vici_message.h
-index 1a89cf8..7f357b8 100644
---- a/src/libcharon/plugins/vici/vici_message.h
-+++ b/src/libcharon/plugins/vici/vici_message.h
-@@ -1,4 +1,7 @@
- /*
-+ * Copyright (C) 2015 Tobias Brunner
-+ * Hochschule fuer Technik Rapperswil
-+ *
-  * Copyright (C) 2014 Martin Willi
-  * Copyright (C) 2014 revosec AG
-  *
-@@ -138,6 +141,26 @@ struct vici_message_t {
- 	int (*vget_int)(vici_message_t *this, int def, char *fmt, va_list args);
- 
- 	/**
-+	 * Get the value of a key/value pair as boolean.
-+	 *
-+	 * @param def	default value if not found
-+	 * @param fmt	printf style format string for key, with sections
-+	 * @param ...	arguments to fmt string
-+	 * @return		value
-+	 */
-+	bool (*get_bool)(vici_message_t *this, bool def, char *fmt, ...);
-+
-+	/**
-+	 * Get the value of a key/value pair as boolean, va_list variant
-+	 *
-+	 * @param def	default value if not found
-+	 * @param fmt	printf style format string for key, with sections
-+	 * @param args	arguments to fmt string
-+	 * @return		value
-+	 */
-+	bool (*vget_bool)(vici_message_t *this, bool def, char *fmt, va_list args);
-+
-+	/**
- 	 * Get the raw value of a key/value pair.
- 	 *
- 	 * @param def	default value if not found
--- 
-2.4.6
-
diff --git a/main/strongswan/0204-vici-Optionally-check-limits-when-initiating-connect.patch b/main/strongswan/0204-vici-Optionally-check-limits-when-initiating-connect.patch
deleted file mode 100644
index f904af30b..000000000
--- a/main/strongswan/0204-vici-Optionally-check-limits-when-initiating-connect.patch
+++ /dev/null
@@ -1,65 +0,0 @@
-From 2d4671feca3d2d17bfa2d846cc170478f18a8fcc Mon Sep 17 00:00:00 2001
-From: Tobias Brunner <tobias@strongswan.org>
-Date: Thu, 16 Jul 2015 17:56:16 +0200
-Subject: [PATCH] vici: Optionally check limits when initiating connections
-
-If the init-limits parameter is set (disabled by default) init limits
-will be checked and might prevent new SAs from getting initiated.
----
- src/libcharon/plugins/vici/README.md      | 1 +
- src/libcharon/plugins/vici/vici_control.c | 7 ++++++-
- 2 files changed, 7 insertions(+), 1 deletion(-)
-
-diff --git a/src/libcharon/plugins/vici/README.md b/src/libcharon/plugins/vici/README.md
-index 0ce4271..71356fb 100644
---- a/src/libcharon/plugins/vici/README.md
-+++ b/src/libcharon/plugins/vici/README.md
-@@ -259,6 +259,7 @@ Initiates an SA while streaming _control-log_ events.
- 	{
- 		child = <CHILD_SA configuration name to initiate>
- 		timeout = <timeout in seconds before returning>
-+		init-limits = <whether limits may prevent initiating the CHILD_SA>
- 		loglevel = <loglevel to issue "control-log" events for>
- 	} => {
- 		success = <yes or no>
-diff --git a/src/libcharon/plugins/vici/vici_control.c b/src/libcharon/plugins/vici/vici_control.c
-index e568239..88574f8 100644
---- a/src/libcharon/plugins/vici/vici_control.c
-+++ b/src/libcharon/plugins/vici/vici_control.c
-@@ -163,6 +163,7 @@ CALLBACK(initiate, vici_message_t*,
- 	peer_cfg_t *peer_cfg;
- 	char *child;
- 	u_int timeout;
-+	bool limits;
- 	log_info_t log = {
- 		.dispatcher = this->dispatcher,
- 		.id = id,
-@@ -170,6 +171,7 @@ CALLBACK(initiate, vici_message_t*,
- 
- 	child = request->get_str(request, NULL, "child");
- 	timeout = request->get_int(request, 0, "timeout");
-+	limits = request->get_bool(request, FALSE, "init-limits");
- 	log.level = request->get_int(request, 1, "loglevel");
- 
- 	if (!child)
-@@ -185,13 +187,16 @@ CALLBACK(initiate, vici_message_t*,
- 		return send_reply(this, "CHILD_SA config '%s' not found", child);
- 	}
- 	switch (charon->controller->initiate(charon->controller, peer_cfg,
--					child_cfg, (controller_cb_t)log_vici, &log, timeout, FALSE))
-+				child_cfg, (controller_cb_t)log_vici, &log, timeout, limits))
- 	{
- 		case SUCCESS:
- 			return send_reply(this, NULL);
- 		case OUT_OF_RES:
- 			return send_reply(this, "CHILD_SA '%s' not established after %dms",
- 							  child, timeout);
-+		case INVALID_STATE:
-+			return send_reply(this, "establishing CHILD_SA '%s' not possible "
-+							  "at the moment due to limits", child);
- 		case FAILED:
- 		default:
- 			return send_reply(this, "establishing CHILD_SA '%s' failed", child);
--- 
-2.4.6
-
diff --git a/main/strongswan/0301-ikev1-Assign-different-job-priorities-for-inbound-IK.patch b/main/strongswan/0301-ikev1-Assign-different-job-priorities-for-inbound-IK.patch
deleted file mode 100644
index 4a837486e..000000000
--- a/main/strongswan/0301-ikev1-Assign-different-job-priorities-for-inbound-IK.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 470b58d897338c89c83f416808cf1ccac38fe028 Mon Sep 17 00:00:00 2001
-From: Tobias Brunner <tobias@strongswan.org>
-Date: Fri, 17 Jul 2015 14:08:09 +0200
-Subject: [PATCH] ikev1: Assign different job priorities for inbound IKEv1
- messages
-
----
- src/libcharon/processing/jobs/process_message_job.c | 14 ++++++++++++--
- 1 file changed, 12 insertions(+), 2 deletions(-)
-
-diff --git a/src/libcharon/processing/jobs/process_message_job.c b/src/libcharon/processing/jobs/process_message_job.c
-index a6795e7..31f048d 100644
---- a/src/libcharon/processing/jobs/process_message_job.c
-+++ b/src/libcharon/processing/jobs/process_message_job.c
-@@ -91,16 +91,26 @@ METHOD(job_t, get_priority, job_priority_t,
- 	{
- 		case IKE_AUTH:
- 			/* IKE auth is rather expensive and often blocking, low priority */
-+		case AGGRESSIVE:
-+		case ID_PROT:
-+			/* AM is basically IKE_SA_INIT/IKE_AUTH combined (without EAP/XAuth)
-+			 * MM is similar, but stretched out more */
- 			return JOB_PRIO_LOW;
- 		case INFORMATIONAL:
-+		case INFORMATIONAL_V1:
- 			/* INFORMATIONALs are inexpensive, for DPD we should have low
- 			 * reaction times */
- 			return JOB_PRIO_HIGH;
- 		case IKE_SA_INIT:
--		case CREATE_CHILD_SA:
--		default:
- 			/* IKE_SA_INIT is expensive, but we will drop them in the receiver
- 			 * if we are overloaded */
-+		case CREATE_CHILD_SA:
-+		case QUICK_MODE:
-+			/* these may require DH, but if not they are relatively cheap */
-+		case TRANSACTION:
-+			/* these are mostly cheap, however, if XAuth via RADIUS is used
-+			 * they may block */
-+		default:
- 			return JOB_PRIO_MEDIUM;
- 	}
- }
--- 
-2.4.6
-
diff --git a/main/strongswan/0401-printf-hook-builtin-Fix-invalid-memory-access.patch b/main/strongswan/0401-printf-hook-builtin-Fix-invalid-memory-access.patch
deleted file mode 100644
index 630151b40..000000000
--- a/main/strongswan/0401-printf-hook-builtin-Fix-invalid-memory-access.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From 944e99d57243fb42ccb2be475c8386a0c4c116f4 Mon Sep 17 00:00:00 2001
-From: Tobias Brunner <tobias@strongswan.org>
-Date: Mon, 27 Jul 2015 11:18:53 +0200
-Subject: [PATCH] printf-hook-builtin: Fix invalid memory access
-
-When precision is given for a string, we must not run unbounded
-strlen() as it will read beyond the given length. It might even cause
-a crash if the given pointer is near end of heap or mapping.
-
-Fixes numerous valgrind errors such as:
-
-==19215== Invalid read of size 1
-==19215==    at 0x52D36C6: builtin_vsnprintf (printf_hook_builtin.c:853)
-==19215==    by 0x52D40A8: builtin_snprintf (printf_hook_builtin.c:1084)
-==19215==    by 0x52CE464: dntoa (identification.c:337)
-==19215==    by 0x52CE464: identification_printf_hook (identification.c:837)
-==19215==    by 0x52D3DAA: builtin_vsnprintf (printf_hook_builtin.c:1010)
-==19215==    by 0x57040EB: vlog (bus.c:388)
-==19215==    by 0x570427D: log_ (bus.c:430)
-==19215==    by 0xA8445D3: load_x509_ca (stroke_cred.c:416)
-==19215==    by 0xA8445D3: load_certdir (stroke_cred.c:537)
-==19215==    by 0xA846A95: load_certs (stroke_cred.c:1353)
-==19215==    by 0xA846A95: stroke_cred_create (stroke_cred.c:1475)
-==19215==    by 0xA84073E: stroke_socket_create (stroke_socket.c:782)
-==19215==    by 0xA83F27C: register_stroke (stroke_plugin.c:53)
-==19215==    by 0x52C3125: load_feature (plugin_loader.c:716)
-==19215==    by 0x52C3125: load_provided (plugin_loader.c:778)
-==19215==    by 0x52C3A20: load_features (plugin_loader.c:799)
-==19215==    by 0x52C3A20: load_plugins (plugin_loader.c:1159)
-==19215==  Address 0x50cdb42 is 0 bytes after a block of size 2 alloc'd
-==19215==    at 0x4C919FE: malloc (vg_replace_malloc.c:296)
-==19215==    by 0x52CD198: chunk_printable (chunk.c:759)
-==19215==    by 0x52CE442: dntoa (identification.c:334)
-==19215==    by 0x52CE442: identification_printf_hook (identification.c:837)
-==19215==    by 0x52D3DAA: builtin_vsnprintf (printf_hook_builtin.c:1010)
-==19215==    by 0x57040EB: vlog (bus.c:388)
-==19215==    by 0x570427D: log_ (bus.c:430)
-==19215==    by 0xA8445D3: load_x509_ca (stroke_cred.c:416)
-==19215==    by 0xA8445D3: load_certdir (stroke_cred.c:537)
-==19215==    by 0xA846A95: load_certs (stroke_cred.c:1353)
-==19215==    by 0xA846A95: stroke_cred_create (stroke_cred.c:1475)
-==19215==    by 0xA84073E: stroke_socket_create (stroke_socket.c:782)
-==19215==    by 0xA83F27C: register_stroke (stroke_plugin.c:53)
-==19215==    by 0x52C3125: load_feature (plugin_loader.c:716)
-==19215==    by 0x52C3125: load_provided (plugin_loader.c:778)
-==19215==    by 0x52C3A20: load_features (plugin_loader.c:799)
-==19215==    by 0x52C3A20: load_plugins (plugin_loader.c:1159)
----
- src/libstrongswan/utils/printf_hook/printf_hook_builtin.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/src/libstrongswan/utils/printf_hook/printf_hook_builtin.c b/src/libstrongswan/utils/printf_hook/printf_hook_builtin.c
-index 466c673..af54940 100644
---- a/src/libstrongswan/utils/printf_hook/printf_hook_builtin.c
-+++ b/src/libstrongswan/utils/printf_hook/printf_hook_builtin.c
-@@ -843,7 +843,8 @@ int builtin_vsnprintf(char *buffer, size_t n, const char *format, va_list ap)
- 								/* String */
- 								sarg = va_arg(ap, const char *);
- 								sarg = sarg ? sarg : "(null)";
--								slen = strlen(sarg);
-+								slen = prec != -1 ? strnlen(sarg, prec)
-+												  : strlen(sarg);
- 								goto is_string;
- 							}
- 							case 'm':
--- 
-2.4.6
-
diff --git a/main/strongswan/0501-child-create-Fix-crash-when-retrying-CHILD_SA-rekeyi.patch b/main/strongswan/0501-child-create-Fix-crash-when-retrying-CHILD_SA-rekeyi.patch
deleted file mode 100644
index 7f6e17662..000000000
--- a/main/strongswan/0501-child-create-Fix-crash-when-retrying-CHILD_SA-rekeyi.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From 78bab0b68254accb48f08c5110a904a0dedabc60 Mon Sep 17 00:00:00 2001
-From: Tobias Brunner <tobias@strongswan.org>
-Date: Tue, 28 Jul 2015 15:10:17 +0200
-Subject: [PATCH] child-create: Fix crash when retrying CHILD_SA rekeying due
- to a DH group mismatch
-
-If the responder declines our KE payload during a CHILD_SA rekeying migrate()
-is called to reuse the child-create task.  But the child-rekey task then
-calls the same method again.
-
-Fixes: 32df0d81fb46 ("child-create: Destroy nonceg in migrate()")
----
- src/libcharon/sa/ikev2/tasks/child_create.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/src/libcharon/sa/ikev2/tasks/child_create.c b/src/libcharon/sa/ikev2/tasks/child_create.c
-index e0f930c..ee5086f 100644
---- a/src/libcharon/sa/ikev2/tasks/child_create.c
-+++ b/src/libcharon/sa/ikev2/tasks/child_create.c
-@@ -1596,6 +1596,7 @@ METHOD(task_t, migrate, void,
- 	this->tsi = NULL;
- 	this->tsr = NULL;
- 	this->dh = NULL;
-+	this->nonceg = NULL;
- 	this->child_sa = NULL;
- 	this->mode = MODE_TUNNEL;
- 	this->ipcomp = IPCOMP_NONE;
--- 
-2.5.0
-
diff --git a/main/strongswan/0601-child-sa-fix-refcounting-of-allocated-reqids.patch b/main/strongswan/0601-child-sa-fix-refcounting-of-allocated-reqids.patch
deleted file mode 100644
index a1b696a50..000000000
--- a/main/strongswan/0601-child-sa-fix-refcounting-of-allocated-reqids.patch
+++ /dev/null
@@ -1,69 +0,0 @@
-From ce1f82060c037eebf0da6de164215d9a06b92c5b Mon Sep 17 00:00:00 2001
-From: Tobias Brunner <tobias@strongswan.org>
-Date: Fri, 31 Jul 2015 16:51:35 +0200
-Subject: [PATCH] child-sa: Fix refcounting of allocated reqids
-
-During a rekeying we want to reuse the current reqid, but if the new SA
-does not allocate it via kernel-interface the state there will disappear
-when the old SA is destroyed after the rekeying.  When the IKE_SA is
-later reauthenticated with make-before-break reatuhentication the new
-CHILD_SAs there will get new reqids as no existing state is found in the
-kernel-interface.
-
-Fixes: a49393954f31 ("child-sa: Use any fixed reqid configured on the CHILD_SA config")
----
- src/libcharon/sa/child_sa.c | 15 ++++++++++++---
- 1 file changed, 12 insertions(+), 3 deletions(-)
-
-diff --git a/src/libcharon/sa/child_sa.c b/src/libcharon/sa/child_sa.c
-index 94cf07c..73f2ec9 100644
---- a/src/libcharon/sa/child_sa.c
-+++ b/src/libcharon/sa/child_sa.c
-@@ -1,5 +1,5 @@
- /*
-- * Copyright (C) 2006-2011 Tobias Brunner
-+ * Copyright (C) 2006-2015 Tobias Brunner
-  * Copyright (C) 2005-2008 Martin Willi
-  * Copyright (C) 2006 Daniel Roethlisberger
-  * Copyright (C) 2005 Jan Hutter
-@@ -106,6 +106,11 @@ struct private_child_sa_t {
- 	 */
- 	bool reqid_allocated;
- 
-+	/**
-+	 * Is the reqid statically configured
-+	 */
-+	bool static_reqid;
-+
- 	/*
- 	 * Unique CHILD_SA identifier
- 	 */
-@@ -698,7 +703,7 @@ METHOD(child_sa_t, install, status_t,
- 	this->proposal->get_algorithm(this->proposal, EXTENDED_SEQUENCE_NUMBERS,
- 								  &esn, NULL);
- 
--	if (!this->reqid_allocated && !this->reqid)
-+	if (!this->reqid_allocated && !this->static_reqid)
- 	{
- 		status = hydra->kernel_interface->alloc_reqid(hydra->kernel_interface,
- 							my_ts, other_ts, this->mark_in, this->mark_out,
-@@ -826,7 +831,7 @@ METHOD(child_sa_t, add_policies, status_t,
- 	traffic_selector_t *my_ts, *other_ts;
- 	status_t status = SUCCESS;
- 
--	if (!this->reqid_allocated && !this->reqid)
-+	if (!this->reqid_allocated && !this->static_reqid)
- 	{
- 		/* trap policy, get or confirm reqid */
- 		status = hydra->kernel_interface->alloc_reqid(
-@@ -1305,6 +1310,10 @@ child_sa_t * child_sa_create(host_t *me, host_t* other,
- 			this->reqid = charon->traps->find_reqid(charon->traps, config);
- 		}
- 	}
-+	else
-+	{
-+		this->static_reqid = TRUE;
-+	}
- 
- 	/* MIPv6 proxy transport mode sets SA endpoints to TS hosts */
- 	if (config->get_mode(config) == MODE_TRANSPORT &&
diff --git a/main/strongswan/0701-auth-cfg-Similar-to-certificates-matching-one-CA-sho.patch b/main/strongswan/0701-auth-cfg-Similar-to-certificates-matching-one-CA-sho.patch
deleted file mode 100644
index 2c9a1db4f..000000000
--- a/main/strongswan/0701-auth-cfg-Similar-to-certificates-matching-one-CA-sho.patch
+++ /dev/null
@@ -1,95 +0,0 @@
-From 7c7f85a0fd7e6f90c19d797304410da3925a9f96 Mon Sep 17 00:00:00 2001
-From: Tobias Brunner <tobias@strongswan.org>
-Date: Mon, 3 Aug 2015 13:55:36 +0200
-Subject: [PATCH] auth-cfg: Similar to certificates matching one CA should be
- enough
-
-Not sure if defining multiple CA constraints and enforcing _all_ of them,
-that is, the previous behavior, makes even sense.  To ensure a very specific
-chain it should be enough to define the last intermediate CA.  On the
-other hand, the ability to define multiple CAs could simplify configuration.
-
-This can currently only be used with swanctl/VICI based configs as `rightca`
-only takes a single DN.
----
- src/libstrongswan/credentials/auth_cfg.c | 35 ++++++++++++++++++--------------
- 1 file changed, 20 insertions(+), 15 deletions(-)
-
-diff --git a/src/libstrongswan/credentials/auth_cfg.c b/src/libstrongswan/credentials/auth_cfg.c
-index 0ca45a1..9b57631 100644
---- a/src/libstrongswan/credentials/auth_cfg.c
-+++ b/src/libstrongswan/credentials/auth_cfg.c
-@@ -514,9 +514,10 @@ METHOD(auth_cfg_t, complies, bool,
- 	private_auth_cfg_t *this, auth_cfg_t *constraints, bool log_error)
- {
- 	enumerator_t *e1, *e2;
--	bool success = TRUE, group_match = FALSE, cert_match = FALSE;
-+	bool success = TRUE, group_match = FALSE;
-+	bool ca_match = FALSE, cert_match = FALSE;
- 	identification_t *require_group = NULL;
--	certificate_t *require_cert = NULL;
-+	certificate_t *require_ca = NULL, *require_cert = NULL;
- 	signature_scheme_t scheme = SIGN_UNKNOWN;
- 	u_int strength = 0;
- 	auth_rule_t t1, t2;
-@@ -531,26 +532,21 @@ METHOD(auth_cfg_t, complies, bool,
- 			case AUTH_RULE_CA_CERT:
- 			case AUTH_RULE_IM_CERT:
- 			{
--				certificate_t *c1, *c2;
-+				certificate_t *cert;
- 
--				c1 = (certificate_t*)value;
-+				/* for CA certs, a match of a single cert is sufficient */
-+				require_ca = (certificate_t*)value;
- 
--				success = FALSE;
- 				e2 = create_enumerator(this);
--				while (e2->enumerate(e2, &t2, &c2))
-+				while (e2->enumerate(e2, &t2, &cert))
- 				{
- 					if ((t2 == AUTH_RULE_CA_CERT || t2 == AUTH_RULE_IM_CERT) &&
--						c1->equals(c1, c2))
-+						cert->equals(cert, require_ca))
- 					{
--						success = TRUE;
-+						ca_match = TRUE;
- 					}
- 				}
- 				e2->destroy(e2);
--				if (!success && log_error)
--				{
--					DBG1(DBG_CFG, "constraint check failed: peer not "
--						 "authenticated by CA '%Y'.", c1->get_subject(c1));
--				}
- 				break;
- 			}
- 			case AUTH_RULE_SUBJECT_CERT:
-@@ -853,13 +849,22 @@ METHOD(auth_cfg_t, complies, bool,
- 		}
- 		return FALSE;
- 	}
--
-+	if (require_ca && !ca_match)
-+	{
-+		if (log_error)
-+		{
-+			DBG1(DBG_CFG, "constraint check failed: peer not "
-+				 "authenticated by CA '%Y'",
-+				 require_ca->get_subject(require_ca));
-+		}
-+		return FALSE;
-+	}
- 	if (require_cert && !cert_match)
- 	{
- 		if (log_error)
- 		{
- 			DBG1(DBG_CFG, "constraint check failed: peer not "
--				 "authenticated with peer cert '%Y'.",
-+				 "authenticated with peer cert '%Y'",
- 				 require_cert->get_subject(require_cert));
- 		}
- 		return FALSE;
--- 
-2.5.0
-
diff --git a/main/strongswan/1001-charon-add-optional-source-and-remote-overrides-for-.patch b/main/strongswan/1001-charon-add-optional-source-and-remote-overrides-for-.patch
index e246c0429..3f61be658 100644
--- a/main/strongswan/1001-charon-add-optional-source-and-remote-overrides-for-.patch
+++ b/main/strongswan/1001-charon-add-optional-source-and-remote-overrides-for-.patch
@@ -1,6 +1,6 @@
-From 82c26f6c6c8dc8de620cdb6b191f04451ddedd11 Mon Sep 17 00:00:00 2001
+From 6bc204df6722a9c3726d95fc3b34353e7ce9bd3d Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
-Date: Wed, 27 Aug 2014 16:05:21 +0300
+Date: Mon, 21 Sep 2015 13:41:58 +0300
 Subject: [PATCH] charon: add optional source and remote overrides for initiate
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
@@ -26,9 +26,9 @@ Signed-off-by: Timo Teräs <timo.teras@iki.fi>
  src/libcharon/processing/jobs/start_action_job.c |  2 +-
  src/libcharon/sa/ike_sa_manager.c                | 51 ++++++++++++++++++-
  src/libcharon/sa/ike_sa_manager.h                |  8 ++-
- src/libcharon/sa/trap_manager.c                  |  3 +-
+ src/libcharon/sa/trap_manager.c                  | 46 +++++++----------
  src/swanctl/commands/initiate.c                  | 40 ++++++++++++++-
- 13 files changed, 203 insertions(+), 23 deletions(-)
+ 13 files changed, 220 insertions(+), 49 deletions(-)
 
 diff --git a/src/charon-cmd/cmd/cmd_connection.c b/src/charon-cmd/cmd/cmd_connection.c
 index 0c6a504..dc4eca3 100644
@@ -57,7 +57,7 @@ index fc7e899..4f4461a 100644
  	{
  		peer_cfg->destroy(peer_cfg);
 diff --git a/src/libcharon/control/controller.c b/src/libcharon/control/controller.c
-index 097f5ac..9c3b45b 100644
+index 6dd54b4..d0524a5 100644
 --- a/src/libcharon/control/controller.c
 +++ b/src/libcharon/control/controller.c
 @@ -15,6 +15,28 @@
@@ -205,10 +205,10 @@ index 0125d17..72c806c 100644
  		switch (status)
  		{
 diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c
-index b6950f3..600b83f 100644
+index ea6d295..5537ed9 100644
 --- a/src/libcharon/plugins/vici/vici_config.c
 +++ b/src/libcharon/plugins/vici/vici_config.c
-@@ -1584,7 +1584,7 @@ static void run_start_action(private_vici_config_t *this, peer_cfg_t *peer_cfg,
+@@ -1589,7 +1589,7 @@ static void run_start_action(private_vici_config_t *this, peer_cfg_t *peer_cfg,
  			DBG1(DBG_CFG, "initiating '%s'", child_cfg->get_name(child_cfg));
  			charon->controller->initiate(charon->controller,
  					peer_cfg->get_ref(peer_cfg), child_cfg->get_ref(child_cfg),
@@ -218,7 +218,7 @@ index b6950f3..600b83f 100644
  		case ACTION_ROUTE:
  			DBG1(DBG_CFG, "installing '%s'", child_cfg->get_name(child_cfg));
 diff --git a/src/libcharon/plugins/vici/vici_control.c b/src/libcharon/plugins/vici/vici_control.c
-index 88574f8..55f667b 100644
+index 752007c..174bae4 100644
 --- a/src/libcharon/plugins/vici/vici_control.c
 +++ b/src/libcharon/plugins/vici/vici_control.c
 @@ -13,6 +13,28 @@
@@ -341,7 +341,7 @@ index 5e88ac2..7043332 100644
  				case ACTION_ROUTE:
  					DBG1(DBG_JOB, "start action: route '%s'", name);
 diff --git a/src/libcharon/sa/ike_sa_manager.c b/src/libcharon/sa/ike_sa_manager.c
-index 20b6e50..ccce3de 100644
+index 9a613a6..9fa615a 100644
 --- a/src/libcharon/sa/ike_sa_manager.c
 +++ b/src/libcharon/sa/ike_sa_manager.c
 @@ -16,6 +16,28 @@
@@ -373,7 +373,7 @@ index 20b6e50..ccce3de 100644
  #include <string.h>
  
  #include "ike_sa_manager.h"
-@@ -1335,7 +1357,8 @@ METHOD(ike_sa_manager_t, checkout_by_message, ike_sa_t*,
+@@ -1358,7 +1380,8 @@ METHOD(ike_sa_manager_t, checkout_by_message, ike_sa_t*,
  }
  
  METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
@@ -383,7 +383,7 @@ index 20b6e50..ccce3de 100644
  {
  	enumerator_t *enumerator;
  	entry_t *entry;
-@@ -1344,7 +1367,17 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
+@@ -1367,7 +1390,17 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
  	ike_cfg_t *current_ike;
  	u_int segment;
  
@@ -402,7 +402,7 @@ index 20b6e50..ccce3de 100644
  
  	if (this->reuse_ikesa)
  	{
-@@ -1359,6 +1392,16 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
+@@ -1382,6 +1415,16 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
  			{	/* skip IKE_SAs which are not usable */
  				continue;
  			}
@@ -419,7 +419,7 @@ index 20b6e50..ccce3de 100644
  			current_peer = entry->ike_sa->get_peer_cfg(entry->ike_sa);
  			if (current_peer && current_peer->equals(current_peer, peer_cfg))
  			{
-@@ -1388,6 +1431,10 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
+@@ -1411,6 +1454,10 @@ METHOD(ike_sa_manager_t, checkout_by_config, ike_sa_t*,
  			return NULL;
  		}
  		ike_sa = checkout_new(this, peer_cfg->get_ike_version(peer_cfg), TRUE);
@@ -431,7 +431,7 @@ index 20b6e50..ccce3de 100644
  	charon->bus->set_sa(charon->bus, ike_sa);
  	return ike_sa;
 diff --git a/src/libcharon/sa/ike_sa_manager.h b/src/libcharon/sa/ike_sa_manager.h
-index f259d8e..5a69083 100644
+index 3ea928e..151ab22 100644
 --- a/src/libcharon/sa/ike_sa_manager.h
 +++ b/src/libcharon/sa/ike_sa_manager.h
 @@ -83,7 +83,8 @@ struct ike_sa_manager_t {
@@ -460,16 +460,70 @@ index f259d8e..5a69083 100644
  	/**
  	 * Check for duplicates of the given IKE_SA.
 diff --git a/src/libcharon/sa/trap_manager.c b/src/libcharon/sa/trap_manager.c
-index 424d9e7..62a70f5 100644
+index 63505c9..442919f 100644
 --- a/src/libcharon/sa/trap_manager.c
 +++ b/src/libcharon/sa/trap_manager.c
-@@ -421,7 +421,8 @@ METHOD(trap_manager_t, acquire, void,
+@@ -401,7 +401,7 @@ METHOD(trap_manager_t, acquire, void,
+ 	peer_cfg_t *peer;
+ 	child_cfg_t *child;
+ 	ike_sa_t *ike_sa;
+-	host_t *host;
++	host_t *host, *my_host = NULL, *other_host = NULL;
+ 	bool wildcard, ignore = FALSE;
+ 
+ 	this->lock->read_lock(this->lock);
+@@ -477,36 +477,28 @@ METHOD(trap_manager_t, acquire, void,
  	this->lock->unlock(this->lock);
  
- 	ike_sa = charon->ike_sa_manager->checkout_by_config(
+ 	if (wildcard)
+-	{	/* the peer config would match IKE_SAs with other peers */
+-		ike_sa = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
+-											peer->get_ike_version(peer), TRUE);
+-		if (ike_sa)
+-		{
+-			ike_cfg_t *ike_cfg;
+-			u_int16_t port;
+-			u_int8_t mask;
+-
+-			ike_sa->set_peer_cfg(ike_sa, peer);
+-			ike_cfg = ike_sa->get_ike_cfg(ike_sa);
++	{
++		ike_cfg_t *ike_cfg;
++		u_int16_t port;
++		u_int8_t mask;
+ 
+-			port = ike_cfg->get_other_port(ike_cfg);
+-			dst->to_subnet(dst, &host, &mask);
+-			host->set_port(host, port);
+-			ike_sa->set_other_host(ike_sa, host);
++		ike_sa->set_peer_cfg(ike_sa, peer);
++		ike_cfg = ike_sa->get_ike_cfg(ike_sa);
+ 
+-			port = ike_cfg->get_my_port(ike_cfg);
+-			src->to_subnet(src, &host, &mask);
+-			host->set_port(host, port);
+-			ike_sa->set_my_host(ike_sa, host);
++		port = ike_cfg->get_other_port(ike_cfg);
++		dst->to_subnet(dst, &other_host, &mask);
++		other_host->set_port(other_host, port);
+ 
+-			charon->bus->set_sa(charon->bus, ike_sa);
+-		}
+-	}
+-	else
+-	{
+-		ike_sa = charon->ike_sa_manager->checkout_by_config(
 -											charon->ike_sa_manager, peer);
++		port = ike_cfg->get_my_port(ike_cfg);
++		src->to_subnet(src, &my_host, &mask);
++		my_host->set_port(my_host, port);
+ 	}
++	ike_sa = charon->ike_sa_manager->checkout_by_config(
 +											charon->ike_sa_manager, peer,
-+											NULL, NULL);
++											my_host, other_host);
++	DESTROY_IF(my_host);
++	DESTROY_IF(other_host);
++
  	if (ike_sa)
  	{
  		if (ike_sa->get_peer_cfg(ike_sa) == NULL)
@@ -553,5 +607,5 @@ index eb7b6ad..706fa57 100644
  			{"raw",			'r', 0, "dump raw response message"},
  			{"pretty",		'P', 0, "dump raw response message in pretty print"},
 -- 
-2.4.6
+2.5.3
 
diff --git a/main/strongswan/1002-vici-send-certificates-for-ike-sa-events.patch b/main/strongswan/1002-vici-send-certificates-for-ike-sa-events.patch
index 773722064..8caabd063 100644
--- a/main/strongswan/1002-vici-send-certificates-for-ike-sa-events.patch
+++ b/main/strongswan/1002-vici-send-certificates-for-ike-sa-events.patch
@@ -1,6 +1,6 @@
-From dde551360cbe9ac09f1cd2d01047131c6332c576 Mon Sep 17 00:00:00 2001
+From 2a175cc40c5754b803ccfe3f641b438f54b569ec Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
-Date: Thu, 30 Apr 2015 12:08:13 +0300
+Date: Mon, 21 Sep 2015 13:42:05 +0300
 Subject: [PATCH] vici: send certificates for ike-sa events
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
@@ -8,11 +8,11 @@ Content-Transfer-Encoding: 8bit
 
 Signed-off-by: Timo Teräs <timo.teras@iki.fi>
 ---
- src/libcharon/plugins/vici/vici_query.c | 42 +++++++++++++++++++++++++++++----
- 1 file changed, 38 insertions(+), 4 deletions(-)
+ src/libcharon/plugins/vici/vici_query.c | 48 ++++++++++++++++++++++++++++-----
+ 1 file changed, 41 insertions(+), 7 deletions(-)
 
 diff --git a/src/libcharon/plugins/vici/vici_query.c b/src/libcharon/plugins/vici/vici_query.c
-index d94d760..3d461f7 100644
+index 98d264f..5245afc 100644
 --- a/src/libcharon/plugins/vici/vici_query.c
 +++ b/src/libcharon/plugins/vici/vici_query.c
 @@ -225,13 +225,15 @@ static void list_task_queue(private_vici_query_t *this, vici_builder_t *b,
@@ -83,17 +83,30 @@ index d94d760..3d461f7 100644
  
  		b->begin_section(b, "child-sas");
  		csas = ike_sa->create_child_sa_enumerator(ike_sa);
-@@ -1055,7 +1089,7 @@ METHOD(listener_t, ike_updown, bool,
+@@ -1063,7 +1097,7 @@ METHOD(listener_t, ike_updown, bool,
+ 	}
  
- 	b = vici_builder_create();
  	b->begin_section(b, ike_sa->get_name(ike_sa));
 -	list_ike(this, b, ike_sa, now);
 +	list_ike(this, b, ike_sa, now, up);
- 	b->begin_section(b, "child-sas");
  	b->end_section(b);
- 	b->end_section(b);
-@@ -1081,7 +1115,7 @@ METHOD(listener_t, child_updown, bool,
+ 
+ 	this->dispatcher->raise_event(this->dispatcher,
+@@ -1088,10 +1122,10 @@ METHOD(listener_t, ike_rekey, bool,
  	b = vici_builder_create();
+ 	b->begin_section(b, old->get_name(old));
+ 	b->begin_section(b, "old");
+-	list_ike(this, b, old, now);
++	list_ike(this, b, old, now, TRUE);
+ 	b->end_section(b);
+ 	b->begin_section(b, "new");
+-	list_ike(this, b, new, now);
++	list_ike(this, b, new, now, TRUE);
+ 	b->end_section(b);
+ 	b->end_section(b);
+ 
+@@ -1121,7 +1155,7 @@ METHOD(listener_t, child_updown, bool,
+ 	}
  
  	b->begin_section(b, ike_sa->get_name(ike_sa));
 -	list_ike(this, b, ike_sa, now);
@@ -101,6 +114,15 @@ index d94d760..3d461f7 100644
  	b->begin_section(b, "child-sas");
  
  	b->begin_section(b, child_sa->get_name(child_sa));
+@@ -1153,7 +1187,7 @@ METHOD(listener_t, child_rekey, bool,
+ 	b = vici_builder_create();
+ 
+ 	b->begin_section(b, ike_sa->get_name(ike_sa));
+-	list_ike(this, b, ike_sa, now);
++	list_ike(this, b, ike_sa, now, TRUE);
+ 	b->begin_section(b, "child-sas");
+ 
+ 	b->begin_section(b, old->get_name(old));
 -- 
-2.4.6
+2.5.3
 
diff --git a/main/strongswan/1003-vici-add-support-rekeying-events-and-individual-sa-s.patch b/main/strongswan/1003-vici-add-support-for-individual-sa-state-changes.patch
index c42b40d2d..ac739eafa 100644
--- a/main/strongswan/1003-vici-add-support-rekeying-events-and-individual-sa-s.patch
+++ b/main/strongswan/1003-vici-add-support-for-individual-sa-state-changes.patch
@@ -1,8 +1,7 @@
-From 728f1a0afc45264715ee7a77d5ce6614cec42863 Mon Sep 17 00:00:00 2001
+From 6ca8cf5415f8a984d281a1b5115df34c26ef9057 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
-Date: Thu, 30 Apr 2015 10:58:15 +0300
-Subject: [PATCH] vici: add support rekeying events, and individual sa state
- changes
+Date: Mon, 21 Sep 2015 13:42:11 +0300
+Subject: [PATCH] vici: add support for individual sa state changes
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -11,22 +10,21 @@ Useful for monitoring and tracking full SA.
 
 Signed-off-by: Timo Teräs <timo.teras@iki.fi>
 ---
- src/libcharon/plugins/vici/vici_query.c | 176 ++++++++++++++++++++++++++++++++
- 1 file changed, 176 insertions(+)
+ src/libcharon/plugins/vici/vici_query.c | 105 ++++++++++++++++++++++++++++++++
+ 1 file changed, 105 insertions(+)
 
 diff --git a/src/libcharon/plugins/vici/vici_query.c b/src/libcharon/plugins/vici/vici_query.c
-index 3d461f7..316c698 100644
+index 5245afc..71fbf54 100644
 --- a/src/libcharon/plugins/vici/vici_query.c
 +++ b/src/libcharon/plugins/vici/vici_query.c
-@@ -1065,7 +1065,17 @@ static void manage_commands(private_vici_query_t *this, bool reg)
- 	this->dispatcher->manage_event(this->dispatcher, "list-conn", reg);
+@@ -1066,8 +1066,16 @@ static void manage_commands(private_vici_query_t *this, bool reg)
  	this->dispatcher->manage_event(this->dispatcher, "list-cert", reg);
  	this->dispatcher->manage_event(this->dispatcher, "ike-updown", reg);
-+	this->dispatcher->manage_event(this->dispatcher, "ike-rekey", reg);
+ 	this->dispatcher->manage_event(this->dispatcher, "ike-rekey", reg);
 +	this->dispatcher->manage_event(this->dispatcher, "ike-state-established", reg);
 +	this->dispatcher->manage_event(this->dispatcher, "ike-state-destroying", reg);
  	this->dispatcher->manage_event(this->dispatcher, "child-updown", reg);
-+	this->dispatcher->manage_event(this->dispatcher, "child-rekey", reg);
+ 	this->dispatcher->manage_event(this->dispatcher, "child-rekey", reg);
 +	this->dispatcher->manage_event(this->dispatcher, "child-state-installing", reg);
 +	this->dispatcher->manage_event(this->dispatcher, "child-state-installed", reg);
 +	this->dispatcher->manage_event(this->dispatcher, "child-state-updating", reg);
@@ -36,42 +34,10 @@ index 3d461f7..316c698 100644
  	manage_command(this, "list-sas", list_sas, reg);
  	manage_command(this, "list-policies", list_policies, reg);
  	manage_command(this, "list-conns", list_conns, reg);
-@@ -1100,6 +1110,77 @@ METHOD(listener_t, ike_updown, bool,
+@@ -1135,6 +1143,45 @@ METHOD(listener_t, ike_rekey, bool,
  	return TRUE;
  }
  
-+METHOD(listener_t, ike_rekey, bool,
-+	private_vici_query_t *this, ike_sa_t *old, ike_sa_t *new)
-+{
-+	vici_builder_t *b;
-+	time_t now;
-+
-+	if (!this->dispatcher->has_event_listeners(this->dispatcher, "ike-rekey"))
-+	{
-+		return TRUE;
-+	}
-+
-+	now = time_monotonic(NULL);
-+
-+	b = vici_builder_create();
-+	b->begin_section(b, old->get_name(old));
-+	list_ike(this, b, old, now, TRUE);
-+	b->begin_section(b, "child-sas");
-+	b->end_section(b);
-+	b->end_section(b);
-+
-+	b->begin_section(b, new->get_name(new));
-+	list_ike(this, b, new, now, TRUE);
-+	b->begin_section(b, "child-sas");
-+	b->end_section(b);
-+	b->end_section(b);
-+
-+	this->dispatcher->raise_event(this->dispatcher,
-+								  "ike-rekey", 0, b->finalize(b));
-+
-+	return TRUE;
-+}
-+
 +METHOD(listener_t, ike_state_change, bool,
 +	private_vici_query_t *this, ike_sa_t *ike_sa, ike_sa_state_t state)
 +{
@@ -114,45 +80,10 @@ index 3d461f7..316c698 100644
  METHOD(listener_t, child_updown, bool,
  	private_vici_query_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa, bool up)
  {
-@@ -1131,6 +1212,97 @@ METHOD(listener_t, child_updown, bool,
+@@ -1210,6 +1257,62 @@ METHOD(listener_t, child_rekey, bool,
  	return TRUE;
  }
  
-+METHOD(listener_t, child_rekey, bool,
-+	private_vici_query_t *this, ike_sa_t *ike_sa, child_sa_t *old, child_sa_t *new)
-+{
-+	vici_builder_t *b;
-+	time_t now;
-+
-+	if (!this->dispatcher->has_event_listeners(this->dispatcher, "child-rekey"))
-+	{
-+		return TRUE;
-+	}
-+
-+	now = time_monotonic(NULL);
-+	b = vici_builder_create();
-+
-+	b->begin_section(b, ike_sa->get_name(ike_sa));
-+	list_ike(this, b, ike_sa, now, TRUE);
-+	b->begin_section(b, "child-sas");
-+
-+	b->begin_section(b, old->get_name(old));
-+	list_child(this, b, old, now);
-+	b->end_section(b);
-+
-+	b->begin_section(b, new->get_name(new));
-+	list_child(this, b, new, now);
-+	b->end_section(b);
-+
-+	b->end_section(b);
-+	b->end_section(b);
-+
-+	this->dispatcher->raise_event(this->dispatcher,
-+								  "child-rekey", 0, b->finalize(b));
-+
-+	return TRUE;
-+}
-+
 +METHOD(listener_t, child_state_change, bool,
 +	private_vici_query_t *this, ike_sa_t *ike_sa, child_sa_t *child_sa, child_sa_state_t state)
 +{
@@ -212,18 +143,17 @@ index 3d461f7..316c698 100644
  METHOD(vici_query_t, destroy, void,
  	private_vici_query_t *this)
  {
-@@ -1149,7 +1321,11 @@ vici_query_t *vici_query_create(vici_dispatcher_t *dispatcher)
- 		.public = {
+@@ -1229,8 +1332,10 @@ vici_query_t *vici_query_create(vici_dispatcher_t *dispatcher)
  			.listener = {
  				.ike_updown = _ike_updown,
-+				.ike_rekey = _ike_rekey,
+ 				.ike_rekey = _ike_rekey,
 +				.ike_state_change = _ike_state_change,
  				.child_updown = _child_updown,
-+				.child_rekey = _child_rekey,
+ 				.child_rekey = _child_rekey,
 +				.child_state_change = _child_state_change,
  			},
  			.destroy = _destroy,
  		},
 -- 
-2.5.0
+2.5.3
 
diff --git a/main/strongswan/1004-vici-support-asynchronous-initiation.patch b/main/strongswan/1004-vici-support-asynchronous-initiation.patch
index dc95bde74..b7d351a73 100644
--- a/main/strongswan/1004-vici-support-asynchronous-initiation.patch
+++ b/main/strongswan/1004-vici-support-asynchronous-initiation.patch
@@ -1,6 +1,6 @@
-From 21efa8dbe5aab423b452277d6aa70f9c14e2f440 Mon Sep 17 00:00:00 2001
+From 69f5bad1039df91c3d459b5a599b03e8852aca65 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
-Date: Thu, 28 May 2015 13:06:51 +0300
+Date: Mon, 21 Sep 2015 13:42:15 +0300
 Subject: [PATCH] vici: support asynchronous initiation
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
@@ -12,7 +12,7 @@ Signed-off-by: Timo Teräs <timo.teras@iki.fi>
  1 file changed, 4 insertions(+), 2 deletions(-)
 
 diff --git a/src/libcharon/plugins/vici/vici_control.c b/src/libcharon/plugins/vici/vici_control.c
-index 55f667b..da2b68f 100644
+index 174bae4..5a83cb1 100644
 --- a/src/libcharon/plugins/vici/vici_control.c
 +++ b/src/libcharon/plugins/vici/vici_control.c
 @@ -187,7 +187,7 @@ CALLBACK(initiate, vici_message_t*,
@@ -43,5 +43,5 @@ index 55f667b..da2b68f 100644
  		case SUCCESS:
  			msg = send_reply(this, NULL);
 -- 
-2.4.6
+2.5.3
 
diff --git a/main/strongswan/2001-support-gre-key-in-ikev1.patch b/main/strongswan/2001-support-gre-key-in-ikev1.patch
index 72cdd8b82..9c1d9e0d8 100644
--- a/main/strongswan/2001-support-gre-key-in-ikev1.patch
+++ b/main/strongswan/2001-support-gre-key-in-ikev1.patch
@@ -1,6 +1,6 @@
-From f69e2daf4c4ccc57c14fd73d6b7320c5359758c8 Mon Sep 17 00:00:00 2001
+From 8addb45c033b13f3063ece56823a925c2b8bf9a8 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Timo=20Ter=C3=A4s?= <timo.teras@iki.fi>
-Date: Mon, 13 Jul 2015 14:03:49 +0300
+Date: Mon, 21 Sep 2015 13:42:18 +0300
 Subject: [PATCH] support gre key in ikev1
 
 this implements gre key negotiation in ikev1 similarly to the
@@ -205,10 +205,10 @@ index df1d075..7558e91 100644
  
  #endif /** ID_PAYLOAD_H_ @}*/
 diff --git a/src/libcharon/plugins/stroke/stroke_config.c b/src/libcharon/plugins/stroke/stroke_config.c
-index 55ec7cd..87a1d08 100644
+index f717194..cde175f 100644
 --- a/src/libcharon/plugins/stroke/stroke_config.c
 +++ b/src/libcharon/plugins/stroke/stroke_config.c
-@@ -1032,6 +1032,11 @@ static bool parse_protoport(char *token, u_int16_t *from_port,
+@@ -1049,6 +1049,11 @@ static bool parse_protoport(char *token, u_int16_t *from_port,
  		*from_port = 0xffff;
  		*to_port = 0;
  	}
@@ -234,10 +234,10 @@ index 227d24b..7749d8c 100644
  			}
  			first = FALSE;
 diff --git a/src/libcharon/plugins/vici/vici_config.c b/src/libcharon/plugins/vici/vici_config.c
-index 3c4e3ec..9495d4d 100644
+index 5537ed9..70c83d4 100644
 --- a/src/libcharon/plugins/vici/vici_config.c
 +++ b/src/libcharon/plugins/vici/vici_config.c
-@@ -586,8 +586,13 @@ CALLBACK(parse_ts, bool,
+@@ -596,8 +596,13 @@ CALLBACK(parse_ts, bool,
  		}
  		else if (*port && !streq(port, "any"))
  		{
@@ -254,10 +254,10 @@ index 3c4e3ec..9495d4d 100644
  				from = to = ntohs(svc->s_port);
  			}
 diff --git a/src/libcharon/sa/ikev1/tasks/quick_mode.c b/src/libcharon/sa/ikev1/tasks/quick_mode.c
-index 96edfd8..c0830dd 100644
+index d6a3f2c..8533112 100644
 --- a/src/libcharon/sa/ikev1/tasks/quick_mode.c
 +++ b/src/libcharon/sa/ikev1/tasks/quick_mode.c
-@@ -536,9 +536,9 @@ static void add_ts(private_quick_mode_t *this, message_t *message)
+@@ -541,9 +541,9 @@ static void add_ts(private_quick_mode_t *this, message_t *message)
  {
  	id_payload_t *id_payload;
  
@@ -269,7 +269,7 @@ index 96edfd8..c0830dd 100644
  	message->add_payload(message, &id_payload->payload_interface);
  }
  
-@@ -549,7 +549,7 @@ static bool get_ts(private_quick_mode_t *this, message_t *message)
+@@ -554,7 +554,7 @@ static bool get_ts(private_quick_mode_t *this, message_t *message)
  {
  	traffic_selector_t *tsi = NULL, *tsr = NULL;
  	enumerator_t *enumerator;
@@ -278,7 +278,7 @@ index 96edfd8..c0830dd 100644
  	payload_t *payload;
  	host_t *hsi, *hsr;
  	bool first = TRUE;
-@@ -559,20 +559,22 @@ static bool get_ts(private_quick_mode_t *this, message_t *message)
+@@ -564,20 +564,22 @@ static bool get_ts(private_quick_mode_t *this, message_t *message)
  	{
  		if (payload->get_type(payload) == PLV1_ID)
  		{
@@ -306,10 +306,10 @@ index 96edfd8..c0830dd 100644
  
  	/* create host2host selectors if ID payloads missing */
 diff --git a/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c b/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
-index f22e07d..e43df3f 100644
+index 605476e..ef94c26 100644
 --- a/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
 +++ b/src/libhydra/plugins/kernel_netlink/kernel_netlink_ipsec.c
-@@ -743,7 +743,18 @@ static struct xfrm_selector ts2selector(traffic_selector_t *src,
+@@ -745,7 +745,18 @@ static struct xfrm_selector ts2selector(traffic_selector_t *src,
  	ts2subnet(src, &sel.saddr, &sel.prefixlen_s);
  	ts2ports(dst, &sel.dport, &sel.dport_mask);
  	ts2ports(src, &sel.sport, &sel.sport_mask);
@@ -328,8 +328,8 @@ index f22e07d..e43df3f 100644
 +	else if ((sel.proto == IPPROTO_ICMP || sel.proto == IPPROTO_ICMPV6) &&
  		(sel.dport || sel.sport))
  	{
- 		/* the ICMP type is encoded in the most significant 8 bits and the ICMP
-@@ -767,7 +778,7 @@ static traffic_selector_t* selector2ts(struct xfrm_selector *sel, bool src)
+ 		/* the kernel expects the ICMP type and code in the source and
+@@ -769,7 +780,7 @@ static traffic_selector_t* selector2ts(struct xfrm_selector *sel, bool src)
  {
  	u_char *addr;
  	u_int8_t prefixlen;
@@ -338,7 +338,7 @@ index f22e07d..e43df3f 100644
  	host_t *host = NULL;
  
  	if (src)
-@@ -776,7 +787,7 @@ static traffic_selector_t* selector2ts(struct xfrm_selector *sel, bool src)
+@@ -778,7 +789,7 @@ static traffic_selector_t* selector2ts(struct xfrm_selector *sel, bool src)
  		prefixlen = sel->prefixlen_s;
  		if (sel->sport_mask)
  		{
@@ -347,7 +347,7 @@ index f22e07d..e43df3f 100644
  		}
  	}
  	else
-@@ -785,14 +796,27 @@ static traffic_selector_t* selector2ts(struct xfrm_selector *sel, bool src)
+@@ -787,14 +798,27 @@ static traffic_selector_t* selector2ts(struct xfrm_selector *sel, bool src)
  		prefixlen = sel->prefixlen_d;
  		if (sel->dport_mask)
  		{
@@ -379,7 +379,7 @@ index f22e07d..e43df3f 100644
  	}
  	/* The Linux 2.6 kernel does not set the selector's family field,
  	 * so as a kludge we additionally test the prefix length.
-@@ -809,7 +833,7 @@ static traffic_selector_t* selector2ts(struct xfrm_selector *sel, bool src)
+@@ -811,7 +835,7 @@ static traffic_selector_t* selector2ts(struct xfrm_selector *sel, bool src)
  	if (host)
  	{
  		return traffic_selector_create_from_subnet(host, prefixlen,
@@ -389,7 +389,7 @@ index f22e07d..e43df3f 100644
  	return NULL;
  }
 diff --git a/src/libstrongswan/selectors/traffic_selector.c b/src/libstrongswan/selectors/traffic_selector.c
-index 3b7f8c5..c593a3f 100644
+index 6686324..776c765 100644
 --- a/src/libstrongswan/selectors/traffic_selector.c
 +++ b/src/libstrongswan/selectors/traffic_selector.c
 @@ -209,6 +209,14 @@ static int print_icmp(printf_hook_data_t *data, u_int16_t port)
@@ -503,5 +503,5 @@ index cf9a286..d458c68 100644
   *
   * If protocol is ICMP or ICMPv6 the ports are interpreted as follows:  If they
 -- 
-2.4.5
+2.5.3
 
diff --git a/main/strongswan/APKBUILD b/main/strongswan/APKBUILD
index 97d9ed342..1c196e24c 100644
--- a/main/strongswan/APKBUILD
+++ b/main/strongswan/APKBUILD
@@ -1,9 +1,9 @@
 # Contributor: Jesse Young <jlyo@jlyo.org>
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=strongswan
-pkgver=5.3.2
+pkgver=5.3.3
 _pkgver=${pkgver//_rc/rc}
-pkgrel=10
+pkgrel=0
 pkgdesc="IPsec-based VPN solution focused on security and ease of use, supporting IKEv1/IKEv2 and MOBIKE"
 url="http://www.strongswan.org/"
 arch="all"
@@ -16,40 +16,10 @@ makedepends="$depends_dev linux-headers python"
 install="$pkgname.pre-install"
 subpackages="$pkgname-doc $pkgname-dbg"
 source="http://download.strongswan.org/$pkgname-$_pkgver.tar.bz2
-	0001-vici-Asynchronize-debug-logging.patch
-	0002-host-Properly-handle-NULL-in-host_create_from_string.patch
-	0002-ike-sa-manager-Safely-access-the-RNG-instance-with-a.patch
-	0003-ike-cfg-Add-helper-function-to-determine-address-fam.patch
-	0004-ike-Use-address-family-of-local-address-when-resolvi.patch
-	0005-ike-Fall-back-to-the-current-remote-IP-if-it-resolve.patch
-	0006-trap-manager-Properly-check-in-IKE_SA-if-initiating-.patch
-	0007-trap-manager-Changed-how-acquires-we-acted-on-are-tr.patch
-	0008-trap-manager-Resolve-race-conditions-between-flush-a.patch
-	0009-shunt-manager-Add-a-lock-to-safely-access-the-list-o.patch
-	0010-shunt-manager-Remove-stored-entries-if-installation-.patch
-	0011-shunt-manager-Add-flush-method-to-properly-uninstall.patch
-	0012-daemon-Flush-shunts-before-unloading-plugins.patch
-	0013-ike-rekey-Reset-IKE_SA-on-the-bus-after-destroying-n.patch
-	0014-ike-rekey-Reset-IKE_SA-on-bus-before-sending-CREATE_.patch
-	0015-ike-rekey-Fix-cleanup-call.patch
-	0016-ike-Fix-memory-leak-if-remote-address-is-kept.patch
-	0017-kernel-netlink-unlock-mutex-in-del-policy.patch
-	0101-kernel-netlink-Actually-verify-if-the-netlink-messag.patch
-	0102-kernel-netlink-Use-the-PAGE_SIZE-as-default-for-the-.patch
-	0103-kernel-netlink-when-adding-policy-do-an-update-if-it.patch
-	0201-ike-Also-track-initiating-IKE_SAs-as-half-open.patch
-	0202-controller-Optionally-adhere-to-init-limits-also-whe.patch
-	0203-vici-Add-get_bool-convenience-getter-for-VICI-messag.patch
-	0204-vici-Optionally-check-limits-when-initiating-connect.patch
 	0205-ike-Adhere-to-IKE_SA-limit-when-checking-out-by-conf.patch
-	0301-ikev1-Assign-different-job-priorities-for-inbound-IK.patch
-	0401-printf-hook-builtin-Fix-invalid-memory-access.patch
-	0501-child-create-Fix-crash-when-retrying-CHILD_SA-rekeyi.patch
-	0601-child-sa-fix-refcounting-of-allocated-reqids.patch
-	0701-auth-cfg-Similar-to-certificates-matching-one-CA-sho.patch
 	1001-charon-add-optional-source-and-remote-overrides-for-.patch
 	1002-vici-send-certificates-for-ike-sa-events.patch
-	1003-vici-add-support-rekeying-events-and-individual-sa-s.patch
+	1003-vici-add-support-for-individual-sa-state-changes.patch
 	1004-vici-support-asynchronous-initiation.patch
 	2001-support-gre-key-in-ikev1.patch
 
@@ -62,9 +32,18 @@ prepare() {
 	cd "$srcdir/$pkgname-$_pkgver"
 	for i in $source; do
 		case $i in
-		*.patch) msg $i; patch -Np1 -i "$srcdir"/$i || return 1;;
+		*.patch) msg $i; patch -Np1 -i "$srcdir"/$i || _err="$_err $i" ;;
 		esac
 	done
+
+	if [ -n "$_err" ]; then
+		error "The following patches failed:"
+		for i in $_err; do
+			echo "  $i"
+		done
+		return 1
+	fi
+
 	# the headers they ship conflicts with the real thing.
 	rm -r src/include/linux
 }
@@ -132,120 +111,30 @@ package() {
 	install -m755 -D "$srcdir/charon.initd" "$pkgdir/etc/init.d/charon" || return 1
 }
 
-md5sums="fab014be1477ef4ebf9a765e10f8802c  strongswan-5.3.2.tar.bz2
-78960bec9b1d3be2db9bfe8d73347ceb  0001-vici-Asynchronize-debug-logging.patch
-f05c992e0c79a254fe8dfe3989d29ae6  0002-host-Properly-handle-NULL-in-host_create_from_string.patch
-5d2720f3b0f9ae4632703c8638e29088  0002-ike-sa-manager-Safely-access-the-RNG-instance-with-a.patch
-413d0409a1232de61d61e99d7e57c2f5  0003-ike-cfg-Add-helper-function-to-determine-address-fam.patch
-0660bab646fc9dbf99a5f9485e570b0e  0004-ike-Use-address-family-of-local-address-when-resolvi.patch
-30ac430b88cdfb23546a3ac1a6247d6c  0005-ike-Fall-back-to-the-current-remote-IP-if-it-resolve.patch
-de114c8e0f0fb84aaef46b55b912c7df  0006-trap-manager-Properly-check-in-IKE_SA-if-initiating-.patch
-a99f6c1cc578b17e9c69378869942ffd  0007-trap-manager-Changed-how-acquires-we-acted-on-are-tr.patch
-e7e8b6171239f3462f8f6739fcfdc56b  0008-trap-manager-Resolve-race-conditions-between-flush-a.patch
-400a514e50a378265a0ec1cff46f1f02  0009-shunt-manager-Add-a-lock-to-safely-access-the-list-o.patch
-551d01ca98e3e8b6bfea54938c576ec6  0010-shunt-manager-Remove-stored-entries-if-installation-.patch
-b5f4a1a5cd7e5f10e9487a23078bcbab  0011-shunt-manager-Add-flush-method-to-properly-uninstall.patch
-65341200450445191b67914df2629fe6  0012-daemon-Flush-shunts-before-unloading-plugins.patch
-1ea2d1a97aa37bac24a1ec9b1ce7c985  0013-ike-rekey-Reset-IKE_SA-on-the-bus-after-destroying-n.patch
-054b28fd78fccb20b993ec2679f98bc6  0014-ike-rekey-Reset-IKE_SA-on-bus-before-sending-CREATE_.patch
-6b57da364f1222eb2a8eda8f146c784b  0015-ike-rekey-Fix-cleanup-call.patch
-0941f8e871fff5ab8c984830d23b35a1  0016-ike-Fix-memory-leak-if-remote-address-is-kept.patch
-be62ce82080a0b7325709d6fbe0b9e46  0017-kernel-netlink-unlock-mutex-in-del-policy.patch
-d97c846c00c60a35925662ba551495df  0101-kernel-netlink-Actually-verify-if-the-netlink-messag.patch
-d73abf4c9c3354120152144e7985d428  0102-kernel-netlink-Use-the-PAGE_SIZE-as-default-for-the-.patch
-0800173ace99e4f835365350142cf198  0103-kernel-netlink-when-adding-policy-do-an-update-if-it.patch
-c3f86cc9b0866f2e748f40d3058a5b14  0201-ike-Also-track-initiating-IKE_SAs-as-half-open.patch
-55feb2633c42927672113e44465fd824  0202-controller-Optionally-adhere-to-init-limits-also-whe.patch
-d57e117d13da147910e2ae09219d2492  0203-vici-Add-get_bool-convenience-getter-for-VICI-messag.patch
-8e79293070086233035a93322b935048  0204-vici-Optionally-check-limits-when-initiating-connect.patch
+md5sums="5a25f3d1c31a77ef44d14a2e7b3eaad0  strongswan-5.3.3.tar.bz2
 c46165934687326a26ec9153a34e2227  0205-ike-Adhere-to-IKE_SA-limit-when-checking-out-by-conf.patch
-9b607cf38cff83547368d82fa34d716f  0301-ikev1-Assign-different-job-priorities-for-inbound-IK.patch
-c7c0338de6dc4993cb8cb71238fd13dc  0401-printf-hook-builtin-Fix-invalid-memory-access.patch
-2d191d850683a6ed34f171ed64b643f0  0501-child-create-Fix-crash-when-retrying-CHILD_SA-rekeyi.patch
-b361ef4d3ed853620febc2117b4aa6cf  0601-child-sa-fix-refcounting-of-allocated-reqids.patch
-d4f9141b0e63a1af35df04d970e27af7  0701-auth-cfg-Similar-to-certificates-matching-one-CA-sho.patch
-06607758b690f2db961d84e26ee7d6ea  1001-charon-add-optional-source-and-remote-overrides-for-.patch
-1aae491acf4739d871a64cd4481551f6  1002-vici-send-certificates-for-ike-sa-events.patch
-41a343863ffc1259c8a64771cd85c724  1003-vici-add-support-rekeying-events-and-individual-sa-s.patch
-ca53b3df714aa588af99d4f720c4318b  1004-vici-support-asynchronous-initiation.patch
-b9f874287c35cce075b761087c28ab50  2001-support-gre-key-in-ikev1.patch
+d75b757fa44738dbdc5bcc8c60c9780d  1001-charon-add-optional-source-and-remote-overrides-for-.patch
+4dfadf6fcb74c95c7360e33a416fb0d8  1002-vici-send-certificates-for-ike-sa-events.patch
+ada5c5fda3aa5cd5b797feff3cba4b5d  1003-vici-add-support-for-individual-sa-state-changes.patch
+366d0ee2ed135d9364e6449b56ac596a  1004-vici-support-asynchronous-initiation.patch
+ccb77ee342e1b3108a49262549bbbf36  2001-support-gre-key-in-ikev1.patch
 85ebc1b6c6b9c0c6640d8136e97da8e1  strongswan.initd
 7962a720ebef6892d80a3cbdab72c204  charon.initd"
-sha256sums="a4a9bc8c4e42bdc4366a87a05a02bf9f425169a7ab0c6f4482d347e44acbf225  strongswan-5.3.2.tar.bz2
-37da81cde0afd5b2d025a62b36020ff4739bccc086bcfd1528e461534b99e1e8  0001-vici-Asynchronize-debug-logging.patch
-ee88c4636efb8e06ff66e50e82b5de5a2f49a2b60042b157b09c110332db1f2c  0002-host-Properly-handle-NULL-in-host_create_from_string.patch
-442b721d4ee156e5bb8167f4f5831abe727d8440b26f0ba91a32f21eade14305  0002-ike-sa-manager-Safely-access-the-RNG-instance-with-a.patch
-28fb9b57d5c02ae2b10e283f13de4d7257913a44ce68e287f73144d4fe2c0972  0003-ike-cfg-Add-helper-function-to-determine-address-fam.patch
-e8e967357a6741df02b80fcd75729044179549e24623d483c1f4ee603a83152b  0004-ike-Use-address-family-of-local-address-when-resolvi.patch
-a246364122d40ef70091cdf86ea16413a20f3461e137f8209c58959dfaf09396  0005-ike-Fall-back-to-the-current-remote-IP-if-it-resolve.patch
-79861e897dd8e973d2426f083079adb74cc3c281b1c891eb6fbf7e569f0b74f4  0006-trap-manager-Properly-check-in-IKE_SA-if-initiating-.patch
-a9f59b91d3ac04fd52684fd4143545452368d65af9f6026020ba95eae114c103  0007-trap-manager-Changed-how-acquires-we-acted-on-are-tr.patch
-1b463d03b3ce0cf5223bacb08155b69c1c362fa311b1af20cb79b392ac6a233e  0008-trap-manager-Resolve-race-conditions-between-flush-a.patch
-3679e3f63a72c1f32b67ab71f60f8922384cbdeb916beca779bc7776db0332fe  0009-shunt-manager-Add-a-lock-to-safely-access-the-list-o.patch
-cd1d28855c13c9544c6f4caa619a00226d8c84cc75c3e88f962ebea9736619ad  0010-shunt-manager-Remove-stored-entries-if-installation-.patch
-ce95459cea9eaa4d7f1695e10f99ca886d428843ada8134e8f337dce957cdda0  0011-shunt-manager-Add-flush-method-to-properly-uninstall.patch
-b8b82e4b99c70cd76b09a2c7d6144e1e572bee6b4c821fcf7338d1692e1843cb  0012-daemon-Flush-shunts-before-unloading-plugins.patch
-2c4a898a4b17e196acc44947f4b48688649d29ac15c0d19e14d664bf0d9f0274  0013-ike-rekey-Reset-IKE_SA-on-the-bus-after-destroying-n.patch
-a1b61e2aafcd502c8398bfefd556dfb1429d862faecc5d6c0c843e7da215abf3  0014-ike-rekey-Reset-IKE_SA-on-bus-before-sending-CREATE_.patch
-ef5f7d38483909ae3aff5e474ac6f5f20804645ead6a6108f2534408434023ff  0015-ike-rekey-Fix-cleanup-call.patch
-257931d4443a4ed2284bf8872e73ab1e93c0d69f490e1b9b3bb2b12210cec677  0016-ike-Fix-memory-leak-if-remote-address-is-kept.patch
-02a230822398be1cf04a362163bee03f4c4edd4eb1b622fba8a93f5dcb2fb06d  0017-kernel-netlink-unlock-mutex-in-del-policy.patch
-130db52dea23eae4081bf25c5ef050f9dfbaa4e7e99dc0a623fdfc991eb4c5c7  0101-kernel-netlink-Actually-verify-if-the-netlink-messag.patch
-16a41ef4cf25e3432c8a61aa34ac12d6eccd5796d921c75d72570d4f9fda2717  0102-kernel-netlink-Use-the-PAGE_SIZE-as-default-for-the-.patch
-4b9f8d087ef7e6f9c46fa0d5d687dd99fdbfbef1e871ef451a156474282cfefe  0103-kernel-netlink-when-adding-policy-do-an-update-if-it.patch
-ab4042b193a68d3ff771be006fdea81eb786fee7b7c4c8c24aa60ef3372de9c8  0201-ike-Also-track-initiating-IKE_SAs-as-half-open.patch
-f81bb1934c67263e0fcb75ffa449f7d663a17ffacc4d76d233acaed54e13b10d  0202-controller-Optionally-adhere-to-init-limits-also-whe.patch
-7aac3748cabf9293701924b6e6a3f0bb74c4d4302a019eb8012af48473f35b67  0203-vici-Add-get_bool-convenience-getter-for-VICI-messag.patch
-3060dd59d44de1f6e7b82146db4b09c3fd80869c75e9a31823bcbdd9f66ac923  0204-vici-Optionally-check-limits-when-initiating-connect.patch
+sha256sums="39d2e8f572a57a77dda8dd8bdaf2ee47ad3cefeb86bbb840d594aa75f00f33e2  strongswan-5.3.3.tar.bz2
 6ee2826d8f2acf4010886b9990c4fe1f1be99e869144f3dd3705e38184300ca1  0205-ike-Adhere-to-IKE_SA-limit-when-checking-out-by-conf.patch
-d5e0fa9012e5d4f35b5fe903fe555019c639000f75cd269acd73126f2105149b  0301-ikev1-Assign-different-job-priorities-for-inbound-IK.patch
-74a12c42d63d6e9e920afc976b287144118c79740743beec769e5a9f239acac6  0401-printf-hook-builtin-Fix-invalid-memory-access.patch
-6eec00bdb7778a51d04157ec640394959d599f3b8cef6bad0d875658cace99ea  0501-child-create-Fix-crash-when-retrying-CHILD_SA-rekeyi.patch
-a558247c9b6eeabfa2a677440a3e25a0841171347484d624c6c4668f9064b67d  0601-child-sa-fix-refcounting-of-allocated-reqids.patch
-b591c93065a018cf79f8f39041a196b2142c5de0bda6b8eed2590be993329266  0701-auth-cfg-Similar-to-certificates-matching-one-CA-sho.patch
-d2f05dc1d3e921358ca2ba8c7c68cbfa3eca3fdc108fd2b89311d8b25ff6f4bc  1001-charon-add-optional-source-and-remote-overrides-for-.patch
-b2a6f23ede01b2d24ff973dc6c1466dc5600df259eb35d3ea6efa9a4e322ae34  1002-vici-send-certificates-for-ike-sa-events.patch
-811a0b67311546ec5371ce4322b1f69886be7754875c2522ebaeff08713bd26e  1003-vici-add-support-rekeying-events-and-individual-sa-s.patch
-cd0de223af1f831232b2339de4ec6f902bf8fbd826aed85aa70aedfb961b1ea1  1004-vici-support-asynchronous-initiation.patch
-ec58de15c3856a2fd9ea003b7e78a7434dad54f9a4c54d499b09a6eef3761d18  2001-support-gre-key-in-ikev1.patch
+47152a8d54c8ae75ea6e1d7c3c7695fb2e6eb48d24e80b13c25589a6570e3977  1001-charon-add-optional-source-and-remote-overrides-for-.patch
+e70a78f8efa29d3a428d6393cd7c59a36acfdf676b51897d14b495c236a1996c  1002-vici-send-certificates-for-ike-sa-events.patch
+f814519a0476477620f06d8bde0fd16f9094ee79807c0cbe4eb6d45034b5ff7d  1003-vici-add-support-for-individual-sa-state-changes.patch
+f4415bd1a68311fca2a4159b74aa7c2577c6500db7f323bfc684a9dfba7c6450  1004-vici-support-asynchronous-initiation.patch
+bbdbc73ba6cafaaab1ea303eec6d026ebb50ecd12b7c32be0b4dfeaf8ae24245  2001-support-gre-key-in-ikev1.patch
 ad43d1ed2585d84e12ad1e67fbdfe93983c424c5c64b230d5027c0aae496c65f  strongswan.initd
 97b018796f0f15106b70694449cff36e8fc586292aab09ef83a05c0c13142e73  charon.initd"
-sha512sums="60b17645c00769d497f4cea2229b41a217c29fe1109b58be256a0d4a6ccf4765348b9eb89466539c2528756344c2fa969f25ea1cd8856d56c5d55aa78e632e68  strongswan-5.3.2.tar.bz2
-d3135206f61496d0877b22c52c0f4246d17777935a4277bfc6e7ca8b69fb2754a52fed7e8691292df91745c00fa0d597f11cd866bb4ee91453c0e252ba77eef8  0001-vici-Asynchronize-debug-logging.patch
-87ab03664dddf30ed1ae1a1e1fc2a22715a0e74b220f316937cf0f86a5b9c38262fd8a9ad62aa1866405d0bf552d33a62621c8b91634e6bd3c7967b6e7955894  0002-host-Properly-handle-NULL-in-host_create_from_string.patch
-8f16ab691c7e778894f0fc8889ac9be8813da27e09fb304443e9053f2ed384ccd3976d7956f762136c94c870dabe808d3f97116f4573bb0df74299f1da34d643  0002-ike-sa-manager-Safely-access-the-RNG-instance-with-a.patch
-dbb5454e32cea4e671fdb109e2252536d2f8ee97097a45ad280010de7d6b7fedeb40c0418ae2af45a4393b98ac6badd9072846259be6ca823f056919fcd3b985  0003-ike-cfg-Add-helper-function-to-determine-address-fam.patch
-73dcb7874aadcf641051cef91d83158fa8a1c664c094d131fcd5ad9d1c5d00abec5a75dd92780fabf2c0690079aad73275af885a83c8791c62025593fa7af61c  0004-ike-Use-address-family-of-local-address-when-resolvi.patch
-8e3636933b7ee3eddb28b9797e3da21c494e470067bc6996509bd28a9894e037fa7575d68fb717247762dc468543b67d965745370cb1335b1f9fbc6bdf260f6e  0005-ike-Fall-back-to-the-current-remote-IP-if-it-resolve.patch
-e970869f5552557d18133bb279b98a81b7d12a6656bddccfcfbdb2b2dc80ad90cc4d1d63135b3682ccb26c83408790c792de9d64056a97c1b7df16f0b159d179  0006-trap-manager-Properly-check-in-IKE_SA-if-initiating-.patch
-65a20b7d059770786c5912811db8692ab9c03a3527f83d0d23e14db4da8c64c3ed43de7a04ba1cf2a794551471ee9456e70f723b0bb4599792a668edea1f6e77  0007-trap-manager-Changed-how-acquires-we-acted-on-are-tr.patch
-e5bd98af84b248642fb6206497c7d2fca7e42362632171e271a8a715179d10f3590eb25a7b38c9fbc058c82d657668c01e9b98d8ef1f422d0887e710342eff36  0008-trap-manager-Resolve-race-conditions-between-flush-a.patch
-c4a30bbff90c2ef59e9bebb64d336bddde811f0ffba3dcef423dc71a17e98be26192f8aa8654702e9a2cdc9dbfc8ec960fbf1a126c411efef6f95dc1a19c518e  0009-shunt-manager-Add-a-lock-to-safely-access-the-list-o.patch
-6e11b006b4fd0c6d000ff301ce18170bf9540f567ada2eb23f0f1c705be8d0f9299364313249cef5528858e75c10ba9d65315c941b49cb12ae07808d3b6e1faa  0010-shunt-manager-Remove-stored-entries-if-installation-.patch
-2a5503558dcfe654335d9b6b7056e9888b2304389bb76369b8222d54add6c8a9895ab175701eeb636c42f0df53d1078fdae7a9f11167fc2beadad82de68b0e4c  0011-shunt-manager-Add-flush-method-to-properly-uninstall.patch
-4e3ac34b2ecca6c1eefd9354a96a1a1fe7499571d2c5756c1cc889c23e125073517c6af57047de5b96bbc6acf9c6bb8c677df4206633f67551336fa8e62c77fb  0012-daemon-Flush-shunts-before-unloading-plugins.patch
-f643be8dbc32c27f2c31ac91612ae7d2f1a34e9387257d1247cd8c7fb8e5b9c58fc0b8448dd692723a6f7f2ac4d4629ffa2c440c40f5f1bfb550f1cc526b3916  0013-ike-rekey-Reset-IKE_SA-on-the-bus-after-destroying-n.patch
-bd161f1d4fa2881c8c07c2b7bccc0b9f06a99b12203d00329c8295f8a5ebe49f6cf27eca286ddd3c9e443fe132c64cae6849d691ddeda49b5fe716aebc73441e  0014-ike-rekey-Reset-IKE_SA-on-bus-before-sending-CREATE_.patch
-3f8c5ed171eb7c99218005b038ff0e0bc23841aab76cb97fbb7b8a3091b9f5ba318bd23c347de42bd969ac599f3d5f1b6bcf5110d5e23643858b24a719374f50  0015-ike-rekey-Fix-cleanup-call.patch
-bdc74e2b6f91e94aa0041927ff5cf3f2f5d67d5d37a0c389a2b6328919bd9f2f0376957676fd359009117a1d01cd06ecfadb7151bd7875c1df5cb82e159a378a  0016-ike-Fix-memory-leak-if-remote-address-is-kept.patch
-459bfd98c7cbb54bb6b7e95403eb1d62e290ce8ca04f164a49bac8684f8c1c9d4ab88a051e7a0a88fba1b3a5a030cba1aa5b4960a71c1726dbbc512be401cd40  0017-kernel-netlink-unlock-mutex-in-del-policy.patch
-2d667eeba6d567008d8fe27d4dafa9a913c7aafa096258d7b5c95e2d8428e9dc8a40ace9e729a3d323e8d639d2ae3dae945904f90a39076c5ca5ddba7d70a0b6  0101-kernel-netlink-Actually-verify-if-the-netlink-messag.patch
-539bfec16350c035f7ce2f3551b52ba2e22c75146a6c1494f4b25ec283f2245b7a03be9470c0e0cd3e6fc368bcf1bda60ce8166928737ab396e6cf88ffafaf79  0102-kernel-netlink-Use-the-PAGE_SIZE-as-default-for-the-.patch
-a3488021316606e1fdaadfacc86ec8e9bcb741d3ac063498a64594214d97e0193270101388f61e118ec29ccfb8c6314a9fa6f3f8832a4cd8fe6b3f3445529b00  0103-kernel-netlink-when-adding-policy-do-an-update-if-it.patch
-b81fed84f361862c618fdfd9b2993dac3bcb4b298d806523ee9c8f47b1f5b0b679426eaeed8bc88ab1635ba30f9ff0ca9945aa264b3213561548648d64eb25ae  0201-ike-Also-track-initiating-IKE_SAs-as-half-open.patch
-9a2cb61c55a03977fc4bce42fdf043706498c86d69ea094852735b2ef525fbc0f81bad33aad7afc29ef301f3e2146746b56f458980529057e05007e0bab7b972  0202-controller-Optionally-adhere-to-init-limits-also-whe.patch
-95e3544a87bf503ed17059298ec6330501f39a2210e583fed59c5d03ef25b8d8227317016bf0181e49c87a7e36e1d902b0b24bda184d2166f3ad5b79166ce0dd  0203-vici-Add-get_bool-convenience-getter-for-VICI-messag.patch
-055b7769b0f587a77585ccf8e44c30fdf0981a1418f8e426eb696cfde671ac0013b355fdfb9e73ed3605c97a3a8c5f8ac38a2a0a137a5b87f9d6491752254543  0204-vici-Optionally-check-limits-when-initiating-connect.patch
+sha512sums="469b32635bb4c60af1fa5ee535bea5abcd91081c7d482baa861e3951e4aab00783620698b5eade82d9a77aea4ab60d2a00fbf7e9e8760feeffb67c517756169f  strongswan-5.3.3.tar.bz2
 6b01e9810566e4f928fa72f01b5fa6cdbddaf1045433cb5b73b5a3d1cd73260ff195709e4d46384c2aa6540e4e62ad9021d9cad19b2061bc0153581e74cf2d0e  0205-ike-Adhere-to-IKE_SA-limit-when-checking-out-by-conf.patch
-8788fb376eaf57d9f277cac785db08578de3992e2484e7ab21ec044bc91000565ecb2adae4d2632f43ca6ed76519fd4422d86a3ba07a499594fbd7a61298458c  0301-ikev1-Assign-different-job-priorities-for-inbound-IK.patch
-86f244b3d8b35e8b9e25692554b7e8711bc663843e316e8895b340b3bd567c38543d24367250c93910b5d9462a2901bfc7717b5e3824f4682b4c736d33450834  0401-printf-hook-builtin-Fix-invalid-memory-access.patch
-f0dfb8aee6fd456d5d330d9a1212842ecd7f88b9b76bb1667dacdbbb2c38369fa089df6ce13c6363735012f653df91b4bbb082a970a11ec63e6a2d14ca2b0ec2  0501-child-create-Fix-crash-when-retrying-CHILD_SA-rekeyi.patch
-dad393b5d8b5152d7544a42818c446098b748cf4114b544d0bcf6a039c5f9f266ac850f6725b58d653186dcd23cae8a9db627f245412ad1cd3b5a4ccadc90825  0601-child-sa-fix-refcounting-of-allocated-reqids.patch
-bc31b3fa089e594e7989e6cb095eb144cfdad55f991729235fda98e010bf715f5efb4b65f2ef2fd12bbc2d5c48e40f6010554bff43b30c7978402247114263e0  0701-auth-cfg-Similar-to-certificates-matching-one-CA-sho.patch
-2522571163b1d6de0aae2e2c1c2db69c52c3ff76e27a383e8a01e0933a0c0a06212168b1356308d6fd548aa7416d88ecd2bcfc79d3391ff17e6c799e83c5f88d  1001-charon-add-optional-source-and-remote-overrides-for-.patch
-ccf60c52d75b3f2eff719fbac1403eb141029651fccf2a1927ec4dffc0ccdc49c061a4971c38a0f37a32b2a53aa79422e17f3f993c48ebbcd07840a867c15881  1002-vici-send-certificates-for-ike-sa-events.patch
-98b46369adcbe86635a83779ed54b192c67ef34310a42f0c131f3ce50f2d46e3135caefeece6993a9ac92abba1a38854b128f4687dec0eb30b108788386688ea  1003-vici-add-support-rekeying-events-and-individual-sa-s.patch
-e65579093692ca58314245d1dd3e5b4bdbff0603e5dc7baf3f80d7d9f415f62ae1656ef67da8a36efdec58235b6b1862d63c13991f1e5fefc02d8ee39d6dc9b6  1004-vici-support-asynchronous-initiation.patch
-723aad9269ae7da54b1d551b290c80951c3b779737353fa845c00d190c9ef6c6bc406d8ed22254a27844985b7ffaa12b99acce91ec0b192caf639c81b06bf771  2001-support-gre-key-in-ikev1.patch
+0daa63c1da1d84a02b6f675b2ba246c30de537a2494e43bceb13eb201ca9c90644493cf5b85d522b4ccdb57928978fb65b4d44a43ecd2648376c8fdc1cd8bc2d  1001-charon-add-optional-source-and-remote-overrides-for-.patch
+3cf83b588e4bc1ae20956f940f5f92357cbcc0bdcf7bf1b5984b64e09ae16b4871e836a1503fee8f6f55a4dbd0a47f39c75b3d4ed5fd52b71dd41bea15964d28  1002-vici-send-certificates-for-ike-sa-events.patch
+00dbbd8ea9a434de13f1bb74b7cd2d64a97fbefa7ff943ba138282d02d3860e1363ca4fded0d24c215dc5678f13af16242b61ed192d3b7935e2d747f9aafdf61  1003-vici-add-support-for-individual-sa-state-changes.patch
+fbfb4a2740d98d633a6ba946eb1a6b3ecc1dd924989bb94f23b34e5525471b11f735c82f0e8ce56441f836866d6e86c2c34f9bfe83689cd34f814dab6641c107  1004-vici-support-asynchronous-initiation.patch
+0e554a6117f51a564a1b269c9ed2f2858d22ef61df483e2eb09997a3075444deb10df9d0cc8b9ddbe2bb2f740640860c21b1492a9ec28657844fa9c41b822bfc  2001-support-gre-key-in-ikev1.patch
 b56008c07b804dacb3441d3802880058986ab7b314297fe485649a771861885b9232f9fd53b94faa3388a5e9330e2b38a86af5c04f3ff119199720043967ec64  strongswan.initd
 6f3abaaa8da0925f06cdd184fdf534518e40c49533dba427dbf31dbe88172e5626bdc9aadf798d791f82fbded08801c1f565d514e2c289e1f28448d0c2e72b79  charon.initd"