documentation: clarify the aes_gcm ike/esp options in ipsec.conf.5
ipsec: ipsec --import does not need to run restorecon
testing: more test strongswan results with 169.x.x.x  fix
testing: tidy runkvm.py and swantest
libipsecconf: add missing support for authby=secret|rsasig
vendorid: added some comments
documentation: clarify aggrmde is an ikev1-only option.
documentation: add missing send-vendorid= man page entry for ipsec.conf

And fix the reference in myvendorid= from send_vendorid to send-vendorid
documentation: clarify aggresive mode, delete bogus 20overlapip.xml
pluto: vendorid printing for swan versions

Clarify libreswan and openswan versions
Merge branch 'master' of vault.libreswan.fi:/srv/src/libreswan
testing: remove bogus rightca= from aggr-pluto-03/east.conf

(I added that a while ago by mistake)
testing: Added INVALID_KE test cases

ikev2-21-invalid-ke
interop-ikev2-strongswan-25-ke-mismatch-initiator
interop-ikev2-strongswan-26-ke-mismatch-responder
testing: delete old interop-ikev2-strongswan-25-ke-mismatch
IKEv2: Support for INVALID_KE DH group re-transmits

    As responder, send a proper INVALID_KE with an acceptable DH group as
    notify payload (instead of returning NO_PROPOSAL_CHOSEN)

    As initiator, receive the DH group in the INVALID_KE, look up if the
    group is acceptable, and if so, re-initiate with a new KE payload.

    - expose the default_ike_groups to pick a last-effort DH group
    - added the following functins:
        void send_v2_notification_invalid_ke(struct state *st)
        bool modp_in_propset(oakley_group_t received, struct alg_info_ike *ai_list)
        oakley_group_t first_modp_from_propset(struct alg_info_ike *ai_list)
        stf_status crypto_helper_build_ke(struct state *st)
        clear_dh_from_state(struct state *st)
    - cleanup some duplicate code
    - add comment and log about excessive calling of sa_v2_convert()
    - check spisize before the switch(), as it applies to all notify payloads
    - Support for in_struct() reading a notify payload [Hugh]
    - Removed some dead code [Hugh]
    - Notify chunk building [Hugh]
updated changes
Muck about with the fine points of policy lset_t matching

- Make find_host_connection more rigorous in matching required policy.

- Some callers of find_host_connection need to step to the next
  matching connection with a matching policy, add
  find_next_host_connection to do that.

- Ditch the imaginary distinction between aggr_inI1_outR1_psk and
  aggr_inI1_outR1_rsasig: the two entries were indistinguishable.

- Fixed comments in microcode for Aggressive mode.

- Simplified pick_initiator.

- Simplify collect_rw_ca_candidates
  + replace find_host_connection call with find_host_pair call
    because policy filtering was not used
  + simplified loop logic
  + eliminated reference parameter requiring caller-initialized variable;
    made corresponding simplification to callers

- POLICY_IKEV1_DISABLE => POLICY_IKEV1_ALLOW
  This caused a lot of changes to tests' reference output
testing: more results, where 169.x.x.x is removed
HappyDance: Calculate Shannon Entropy of PSK and prepare to refuse weak PSKs

Currently, we warn at a Shannon Entropy value of < 3.5

The first libreswan release after July 1st, 2015 will refuse to use any
PSKs with entropy less than 3.5.