* pluto: more missing checks for failing out_raw() / out_struct() calls
* fix for printing a ";" in ipsec auto --status

Introduced in 9ac4101f
* fix type error in init_nat_traversal (found by Coverity)
* in oakley_alg_makedb, gsp is already NULL enough (Coverity Scan)
* IKEv1: fragmentation never fragment initial main mode packet

If the first packet is fragmented the peer ignore it

"packet from 10.0.11.203:500: received IKE fragment, but have no state.
Ignoring packet"

This can either happen with force on or when pluto
changed the policy to force after receiving a fragmented packet and the
initiator starts the phase one rekeying.

The first packet exceeds ISAKMP_FRAG_MAXLEN fast with all the proposals
and vendorids.

10:05:15.519781 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto UDP (17), length 640)
    10.0.11.203.isakmp > 10.0.14.204.isakmp: [udp sum ok] isakmp 1.0 msgid 00000000 cookie f7490449d6831ca1->0000000000000000: phase 1 I ident:
    (sa: doi=ipsec situation=identity
        (p: #0 protoid=isakmp transform=12
            (t: #0 id=ike (type=lifetype value=sec)(type=lifeduration value=04b0)(type=enc value=aes)(type=hash value=sha1)(type=auth value=rsa sig)(type=group desc value=modp2048)(type=keylen value=0080))
            (t: #1 id=ike (type=lifetype value=sec)(type=lifeduration value=04b0)(type=enc value=aes)(type=hash value=md5)(type=auth value=rsa sig)(type=group desc value=modp2048)(type=keylen value=0080))
            (t: #2 id=ike (type=lifetype value=sec)(type=lifeduration value=04b0)(type=enc value=3des)(type=hash value=sha1)(type=auth value=rsa sig)(type=group desc value=modp2048))
            (t: #3 id=ike (type=lifetype value=sec)(type=lifeduration value=04b0)(type=enc value=3des)(type=hash value=md5)(type=auth value=rsa sig)(type=group desc value=modp2048))
            (t: #4 id=ike (type=lifetype value=sec)(type=lifeduration value=04b0)(type=enc value=aes)(type=hash value=sha1)(type=auth value=rsa sig)(type=group desc value=modp1536)(type=keylen value=0080))
            (t: #5 id=ike (type=lifetype value=sec)(type=lifeduration value=04b0)(type=enc value=aes)(type=hash value=md5)(type=auth value=rsa sig)(type=group desc value=modp1536)(type=keylen value=0080))
            (t: #6 id=ike (type=lifetype value=sec)(type=lifeduration value=04b0)(type=enc value=3des)(type=hash value=sha1)(type=auth value=rsa sig)(type=group desc value=modp1536))
            (t: #7 id=ike (type=lifetype value=sec)(type=lifeduration value=04b0)(type=enc value=3des)(type=hash value=md5)(type=auth value=rsa sig)(type=group desc value=modp1536))
            (t: #8 id=ike (type=lifetype value=sec)(type=lifeduration value=04b0)(type=enc value=3des)(type=hash value=sha1)(type=auth value=rsa sig)(type=group desc value=modp1024))
            (t: #9 id=ike (type=lifetype value=sec)(type=lifeduration value=04b0)(type=enc value=3des)(type=hash value=md5)(type=auth value=rsa sig)(type=group desc value=modp1024))
            (t: #10 id=ike (type=lifetype value=sec)(type=lifeduration value=04b0)(type=enc value=aes)(type=hash value=sha1)(type=auth value=rsa sig)(type=group desc value=modp1024)(type=keylen value=0080))
            (t: #11 id=ike (type=lifetype value=sec)(type=lifeduration value=04b0)(type=enc value=aes)(type=hash value=md5)(type=auth value=rsa sig)(type=group desc value=modp1024)(type=keylen value=0080))))
    (vid: len=12 4f454e584468416b74625a76)
    (vid: len=16 afcad71368a1f1c96b8696fc77570100)
    (vid: len=16 4048b7d56ebce88525e7de7f00d6c2d3)
    (vid: len=16 4a131c81070358455c5728f20e95452f)
    (vid: len=16 7d9419a65310ca6f2c179d9215529d56)
    (vid: len=16 90cb80913ebb696e086381b5ec427b1f)
    (vid: len=16 cd60464335df21f87cfdb2fc68b6a448)
    (vid: len=16 4485152d18b6bbcd0be8a8469579ddcc)
* removed redundant vendor id logging

the used vendor id will be logged twice because of a removed return
in 75269b8de30ae6368c41d5c53e25631ed2e20cc8

e.g.

received Vendor ID payload [RFC 3947]
received Vendor ID payload [RFC 3947]
* IKEv2: narrowing used a wrong port range in determining bestfit

This could lead to narrowed proposals failing.
Merge branch 'master' of vault.libreswan.fi:/srv/src/libreswan
* DPD: Don't try to delete non-events

This happened only when we were just firing up the phase2. It was
ignored, so this is mostly a cosmetic fix.
Merge branch 'master' of vault.foobar.fi:/srv/src/libreswan
* DPD: clarify log message is about a DPD event
makerelease: fix git archive command to work with older git versions.
checkpubkeys: warn 14 days before public keys expire
update CHANGES for X509: Warn 14 days before certificates expire
out_sa: fix syntax errors caused by 249fbd0eda68d71e466812ea8298dc28f6235d74
* fragmentation: Remove spurious Racoon non-ESP marker

During testing we found that racoon sometimes adds a bogus non-esp marker
to the IKE packet. This confuses libreswan, because it causes the ICOOKIE
to not match to an existing state.

We assume now that if the ICOOKIE starts with 00 00 00 00, that it is
such a bogus marker, and we use out_raw() to remove the 4 bytes from
the packet stream. However, it still looks like racoon gets it wrong,
because the ISAKMP header is still not properly formatted.

We're still investigating
rhel: libreswan.spec cleanup
rhel: fix debug package creation
* testing: swan-prep tries to determine testname on pwd if not specified

This saves us from needing to set/export TESTNAME and makes copying
test cases easier.
* testing: fix paste error in gateway setting for north's baseconfig