added package to load dependancy for developers
Update links in the README and mention that Python is a dependancy fir ipsec verify now
remove directory testing
* updown: Delete the source ip addres on down only for Cisco peer

We know we obtained (and need to lose) an IP when connecting using
a Cisco peer. There are other cases where an obtained sourceip should
not be removed (eg when moving from LAN to Wifi, using a setup where
you get the same sourceip, a case that Tuomo has)

This should cover most cases. I confirmed it works using the Red Hat
VPN.
Only set MODP768_MODULUS with USE_VERYWEAK_DH1
Always assume UDPFROMTO works on Linux and BSD

- Phased out UDPFROMTO_DEFS
- Moved HAVE_UDPFROMTO, HAVE_IP_RECVDSTADDR and HAVE_IP_PKTINFO defines to arch
  specific sysdep.h versions of bsd and linux
- Fixes a bug where compiling just NETKEY and no KLIPS support would lose HAVE_UDPFROMTO
Log a warning for NETKEY/XFRM breaking RFC 4301, Section 5.2

When setting up a transport mode connection with a protoport selector,
the Linux NETKEY/XFRM stack will accept any encrpyted packets between
the hostpairs, and not just the ones covered by the selector. We log
a warning about this.
Sync patches with variables names

ESP_reserved -> ESP_RESERVED
IPCOMP_V42BIS -> IPCOMP_LZJH
Additional safety checks to addrtot(), inet_addrtot() and sin_addrtot()

These functions when used properly are bassed a char of size ADDRTOT_BUF
which is more then enough to strncat "<invalid>" into.  But scanning
tools don't know about these and show red flags in case something smaller
is passed.

So now we check if the dstlen passed in is smaller then sizeof("invalid")

At least if someone would call these functions with chars that are too
small, we just truncate the text "<invalid>".
Close socket fd of the interface in _iface_down()
Move the close() call for the sock to the function that created it.
Fix addrtot() with a passert and off-by-one
Redone and simplified functions around strncat/snprintf for addrtot.c
DPD typo fix: Dectection -> Detection
Removed some /testing links in Makefile.top
Revert "introduce new argument to atoid(_picky) which indicates what kinds of ID"

I had to do this as this commit breaks core functionality.  MCR will have to try again.

This reverts commit bf3428f60b17478e13e8df3dc6c5829bff65d52e.
Call "ss" without using the fully qualified path as this binary is installed in different place depending on the distro
Remove debug code
Only use -Wno-error=cpp when GCC's version is >= 4.6
Handle NULL returns from glibc 2.17+ crypt().

Starting with glibc 2.17 (eglibc 2.17), crypt() fails with EINVAL
(w/ NULL return) if the salt violates specifications. Additionally,
on FIPS-140 enabled Linux systems, DES/MD5-encrypted passwords
passed to crypt() fail with EPERM (w/ NULL return).

If using glibc's crypt(), check return value to avoid a possible
NULL pointer dereference.