testing: remove uml ipv6 hack sysctl values
Merge branch 'master' of vault.libreswan.org:/srv/src/libreswan
Merge branch 'master' of vault.libreswan.org:/srv/src/libreswan
debian: add missing backslash
updated CHANGES
pluto: perform exact XAUTH policy matching in find_host_connection2()
pluto: rename find_host_connection2() to find_host_connection()

This removes a silly macro find_host_connection() that pointed to
find_host_connection2()
ikev2_x509: Use ikev2_build_and_ship_CR(), not (ikev1_)build_and_ship_CR()
pluto: Rename some ikev1 versioned functions, and x509keys.c

x509keys.c is now called x509more.c to match its header file.

Renamed functions:

decode_peer_id -> ikev1_decode_peer_id
decode_cr -> ikev1_decode_cr
build_and_ship_CR -> ikev1_build_and_ship_CR

(ikev1_)decode_peer_id() was also moved from ipsec_doi.c to ikev1.c
documentation: add some urls to ietf_constants.h
_stackmanager: really unload netkey modules on klips startup
Merge branch 'master' of vault.libreswan.org:/srv/src/libreswan
_stackmanager: ip output changed to false match 'mast' stack with master

Since we only really support mast0, we now check for "mast0" instead of
"mast" to avoid matching the new "master" keyword in the ip output.
_stackmanager: abort with friendly msg when missing %defaultroute
_stackmanager: add note about possible slowness of netkey unloading
_stackmanager: optimize unloading stacks

We don't unload the stack on "stop", we only perform a cleanup so the
state should be cleared. Only when we detect a stack change at startup
will we attempt to unload the other stack.

Since rmmod -w takes 10 seconds per kernel module, first loop through
the module list using rmmod without -w to clean what we can, then run
the remainder through rmmod -w. This reduces the wait time for unloading
netkey from minutes to seconds.
_stackmanager: run rmmod --wait on backgroupd so we won't block
_stackmanager: xfrm_larval_drop, read, set and restore when switching stacks
_stackmanager: deal with xfrm_ipcomp and ip_vti properly too

xfrm_ipcomp seems to be the new name of ipcomp module. We try both
for compatibility with kernels.

ip_vti was only unloaded, but not loaded.
update CHANGES