android: Change how features of VPN types are stored and checked
android: Add EAP-TLS VPN type to the GUI
android: Enable EAP-TLS plugin in the app
android: Handle EAP-TLS in Android service
android: Allow enumeration of untrusted certificates
android: Add support for signature schemes used by EAP-TLS
android: Use %any as AAA identity, but disable EAP-only authentication

Without verification of the identity we can't prevent a malicious user
with a valid certificate from impersonating the AAA server and thus the
VPN gateway.  So unless we make the AAA identity configurable we have to
prevent EAP-only authentication.
Merge branch 'android-eap-tls'

This adds support for EAP-TLS authentication on Android.

EAP-only authentication is currently not allowed because the AAA identity
is not configurable, so to prevent anyone with a valid certificate from
impersonating the AAA server and thus the gateway, we authenticate the
gateway (like we do with other authentication methods).
Also, it's currently not possible to select a specific CA certificate to
authenticate the AAA server certificate, so it either must be issued by the
same CA as that of the gateway or automatic CA certificate selection must
be used.
android: Enable IKEv2 fragmentation
android: Increase fragment size

We use the same value we use as MTU on TUN devices.
android: Build binaries for MIPS
android: New release based on 5.2.1 and after adding EAP-TLS

Also enables support for IKEv2 fragmentation, provides improved MOBIKE
handling and optionally enables PFS for CHILD_SAs.
mem-pool: Fix potential memory leak and lost leases when reassigning leases

If no offline leases are available for the current client and assigning online
leases is disabled, and if all IPs of the pool have already been assigned to
clients we look for offline leases that previously were assigned to other
clients.

In case the current client has online leases the previous code would
replace the existing mapping entry and besides resulting in a memory leak
the online leases would be lost forever (even if the client later releases
the addresses).  If this happens repeatedly the number of available addresses
would decrease even though the total number of online and offline leases seen
in `ipsec leases` would indicate that there are free addresses available.

Fixes #764.
kernel-netlink: Add a stub for a test-runner
kernel-netlink: Add a simple send message test querying available links
kernel-netlink: Support parallel Netlink queries

Instead of locking the socket exclusively to wait for replies, use watcher
to wait for and read in responses asynchronously. This allows multiple parallel
Netlink queries, which can significantly improve performance if the kernel
Netlink layer has longer latencies and supports parallel queries.

For vanilla Linux, parallel queries don't make much sense, as it usually returns
EBUSY for the relevant dump requests. This requires a retry, and in the end
makes queries more expensive under high load.

Instead of checking the Netlink message sequence number to detect multi-part
messages, this code now relies on the NLM_F_MULTI flag to detect them. This
has previously been avoided (by 1d51abb7). It is unclear if the flag did not
work correctly on very old Linux kernels, or if the flag was not used
appropriately by strongSwan. The flag seems to work just fine back to 2.6.18,
which is a kernel still in use by RedHat/CentOS 5.
kernel-netlink: Retry netlink query while kernel returns EBUSY

If the kernel can't execute a Netlink query because a different query is already
active, it returns EBUSY. As this can happen now as we support parallel queries,
retry on this error condition.
kernel-netlink: Add a stress test with several threads doing Netlink exchanges
kernel-netlink: Implement configurable Netlink request retransmission
kernel-netlink: Add a compile-time hook to simulate request message loss