NEWS: Introduce charon-systemd
curl: Try to initialize with SSL support to handle https:// URIs

If initialization fails, we fall back to the old behavior.
leak-detective: Whitelist libssl SSL_COMP_get_compression_methods()

This function is called by libcurl initialization with SSL, and uses
a static allocation of compression algorithms not freed.
curl: Dynamically query supported protocols and register appropriate features
configure: Load fetcher plugins after crypto base plugins

Some fetcher plugins (such as curl) might build upon OpenSSL to implement
HTTPS fetching. As we set (and can't unset) threading callbacks in our
openssl plugin, we must ensure that OpenSSL functions don't get called after
openssl plugin unloading.

We achieve that by loading curl and all other fetcher plugins after the base
crypto plugins, including openssl.
curl: For SSL features, depend on thread-safety provided by our crypto plugins

To use SSL in curl, we need to initialize the SSL library in a thread-safe
manner and provide the appropriate callbacks. As we already do that in our
crypto plugins using these libraries, we depend on these features.

This implies that we need the same plugin enabled (openssl, gcrypt) as the
curl backend is configured to use to fetch from HTTPS URIs.
travis: Disable soup in "all" test

On Ubuntu 12.04, there seems to be a resource leak related to pthread keys
when initializing glib or related libraries more than once. With our repeated
initialization for libstrongswan tests, we hit the following error:

  Lib (gthread-posix.c): Unexpected error from C library during
  'pthread_key_create': Resource temporarily unavailable.

The problem is not reproducible on a newer Gnome stack, hence we disable the
glib based soup plugin until we have a more recent Ubuntu on Travis.
Merge branch 'curl-features'

Enable missing https:// support in the curl plugin by initializing libcurl
appropriately.

To initialize the SSL backend properly as required, we rely on our specific
crypto backends (openssl, gcrypt) that already provide this functionality.

Fixes #692.
Revert "ikev2: Insert MOBIKE tasks at the front of the queue"

This reverts commit 3293d146289d7c05e6c6089ae1f7cdbcea378e63.

The position of tasks in the queue does not actually determine the order
in which they are activated.  Instead this is determined by the
statements in task_manager_v2_t.initiate().
ikev2: Reorder task activation for established IKE SAs

We now prefer MOBIKE tasks over delete tasks then the rest.
ikev1: Be more verbose if a peer config would match, but is unusable for Mode
Don't fail to install if sysconfdir isn't writable
kernel-netlink: Add a stub for a test-runner
kernel-netlink: Add a simple send message test querying available links
kernel-netlink: Support parallel Netlink queries

Instead of locking the socket exclusively to wait for replies, use watcher
to wait for and read in responses asynchronously. This allows multiple parallel
Netlink queries, which can significantly improve performance if the kernel
Netlink layer has longer latencies and supports parallel queries.

For vanilla Linux, parallel queries don't make much sense, as it usually returns
EBUSY for the relevant dump requests. This requires a retry, and in the end
makes queries more expensive under high load.

Instead of checking the Netlink message sequence number to detect multi-part
messages, this code now relies on the NLM_F_MULTI flag to detect them. This
has previously been avoided (by 1d51abb7). It is unclear if the flag did not
work correctly on very old Linux kernels, or if the flag was not used
appropriately by strongSwan. The flag seems to work just fine back to 2.6.18,
which is a kernel still in use by RedHat/CentOS 5.
kernel-netlink: Retry netlink query while kernel returns EBUSY

If the kernel can't execute a Netlink query because a different query is already
active, it returns EBUSY. As this can happen now as we support parallel queries,
retry on this error condition.
kernel-netlink: Add a stress test with several threads doing Netlink exchanges
kernel-netlink: Implement configurable Netlink request retransmission
kernel-netlink: Add a compile-time hook to simulate request message loss
kernel-netlink: Add test cases for successful and timing out retransmissions