initsystems: ipsec.init.in fix status function to return correct result code

Signed-off-by: Tuomo Soini <tis@foobar.fi>
building: INSTMANFLAGS setting belongs to Makefile.inc
install: Fix installation of /etc/pam.d/pluto to use INSTCONFFLAGS
pluto: filter PF_KEY registrations for KLIPS and NETKEY

The kernel PF_KEY interface returns the ciphers supported by the
kernel. We currently use this for KLIPS and NETKEY, although for
NETKEY some registrations not announced via the PF_KEY API are
added manually (AES_GCM, AES_CCM, AES_CTR, etc).

The kernel allows ESP_CAST with variable keysizes, and we only want to
support 128bit. This patch overrides the minkeysize for CAST to be 128.

The kernel also advertises ESP_BLOWFISH (with variable keysize), but its
inventor Bruce Schneier has said to stop using blowfish and use twofish
instead. So this registration is now ignored.

Finally, the kernel advertises ESP_DES, which is simply too weak to
be allowed. While we already disallowed it elsewhere in the pluto code,
with this patch it is no longer registered.

TODO: Check if we are running in FIPS mode, and if so, disallow ciphers
not allowed while in FIPS mode (md5, twofish, serpent, ripemd160)
updated changes
systemd: use After=network-online.target instead of network.target
updated changes
testing: update TESTLIST wip to good
replace  dotest.sh  to swantest and remove dotest.sh
testing: add basic-pluto-15-no-retransmit
testing: status changed from hashlen= to hashsize=
testing: fix netkey tests with ipsec auto --status output

- ESP_DES and ESP_BLOWFISH are no longer registered
- CAST minimum keysize is now 128
testing: updated reference output for ikev2-algo-08-cast and netkey-algo-cast-01
testing: WIP interop-ikev2-strongswan-20-strongswan-eap
testing grep for segfault in cosole output
man page: sendcert default is "sendifasked", not "ifasked"
look: sort the certutil output. This is used in testing

It seems the order of certs can be variable despite identical import
procedures. This flags false positives in testing. This patch does
call certutil twice now. Once for the header and once for everything
but the header. the last call is sorted.
testing: ikeport-01 add --impair-retransmits and remove fake baseline
output
Renamed AUTH_ALGORITHM_AES_CBC to AUTH_ALGORITHM_AES_XCBC

It's more consistent
add a debug message to ikev2_crypto.c
add debug line in setup_half_ipsec_sa() for keymat