Exempt TCG/SEG attributes from unsupported case statement
Process TCG/PTS File Measurement attribute incrementally
Remove unneeded get_count() method
Version bump to 5.2.1
Enabled IKEv2 fragmentation in ipv6/net2net-ikev2 scenario
Increased fragment size to 1400 in ipv6/net2net-ikev1 scenario
ip-packet: Fix length in IPv6 header of generated packets
updown: Explicitly pass caller PATH to updown script

When invoking /bin/sh, its default PATH is used. On some systems, that does
not include the PATH where the ipsec script is installed, as charon is invoked
with a custom PATH. Explicitly setting the PATH of charon should fix this
case, properly invoking the (default) updown script.

Fixes #745.
chunk: Fix internet checksum calculation on big-endian systems

ntohs() might be defined as noop (#define ntohs(x) (x)) so we have
to manually shorten the negated value (gets promoted to an int).

Fixes #747.
unit-tests: Fix internet checksum tests on big-endian systems

We actually need to do a byte-swap, which ntohs() only does on
little-endian systems.

Fixes #747.
cert-cache: Prevent that a cached issuer is freed too early

Previously we got no reference to the cached issuer certificate
before releasing the lock of the cache line, this allowed other
threads, or even the same thread if it replaces a cache line, to
destroy that issuer certificate in cache() (or flush()) before
get_ref() for the issuer certificate is finally called.
message: Include encrypted fragment payload in payload (order) rules

Otherwise fragmented CREATE_CHILD_SA exchanges won't get accepted
because they don't contain an SA payload.

It also prevents a warning when ordering payloads.

Fixes #752.
threading: Add a more explicit rwlock try_write_lock() testing
threading: Support rwlock try_write_lock() on Windows

We explicitly avoided TryAcquireSRWLockExclusive() because of crashes. This
issue was caused by a MinGW-w64 bug (mingw-w64 fix 46f77afc). Using a newer
toolchain works fine.

While try_write_lock() obviously can fail, not supporting it is not really an
option, as some algorithms depend on occasionally successful calls. Certificate
caching in the certificate manager and the cred_set cache rely on successful
try_write_lock()ing.
unit-tests: Re-align identification_create_from_string() unit test table data
identification: Support prefixes in string constructors for an explicit type
identification: Support custom types in string constructor prefixes
man: Document identification type prefixes in ipsec.conf(5)
swanctl: Document identity type prefixes
NEWS: Mention identity prefixes