get rid of pointless test in pfkey_was_eroute_idle()
fix mysterious error in ike_idtype_name by adding a comma
testing: updated enumcheck and add known good output
DPD: openbsd isakmpd bug workaround for duplicate DPD seqno

openbsd mistakenly re-uses the same DPD sequence number when its DPD
probe did not receive an answer. If the probe hit the other endpoint,
but got lost on the return, it means openbsd sends a duplicate DPD seqno,
which according to RFC 3706 Section 7 "Security Considerations" we detect
as a replayed packet that we drop.

This patch introduced the same kludge openbsd uses to interop with
itself. That is, we allow and answer 3 dupliates before we remain quiet
and assume it is a DDOS attack.

If you read this and have openbsd commit access, please do:

isakmpd/dpd.c around line 350:

 LOG_DBG((LOG_MESSAGE, 10, "dpd_check_event: "
  "peer not responding, retry %u of %u",
  isakmp_sa->dpd_failcount, DPD_RETRANS_MAX));
 message_send_dpd_notify(isakmp_sa,
- ISAKMP_NOTIFY_STATUS_DPD_R_U_THERE, isakmp_sa->dpd_seq);
+ ISAKMP_NOTIFY_STATUS_DPD_R_U_THERE, isakmp_sa->dpd_seq++);
update changes
updated changes
pluto: dpd_event() should never be called with a null state
Merge branch 'master' into github_master