Print "request" instead of "config" if dumping config when "request XX"
is used. From William Rusnack, ok tobhe@

add a "natt" option that forces negotiation of nat-t (and udpencap).

this is like the -t command line option on iked itself, but you get
to keep the ike listener on port 500 and you can enable this

add a "natt" option that forces negotiation of nat-t (and udpencap).

this is like the -t command line option on iked itself, but you get
to keep the ike listener on port 500 and you can enable this on
specific policies instead of all of them.

this is useful if you're dealing with an org that can't firewall
ESP traffic well and so you need to force the traffic to be udp
encapsulated even if there's no NAT involved.

ok markus@ tobhe@

show more ...

iked: introduce and use print_addr()

The vast majority of print_host() callers cast the first argument
(usually a sockaddr_storage *) to (struct sockaddr *) and pass both
a NULL buffer and 0 length.

iked: introduce and use print_addr()

The vast majority of print_host() callers cast the first argument
(usually a sockaddr_storage *) to (struct sockaddr *) and pass both
a NULL buffer and 0 length. Cast and useless arguments lead to
awkward line wrapping in many places. Clean this up by introducing a
helper. Make this helper take a void pointer, so all casts go away.

ok claudio kn tobhe

show more ...

Make proto config option accept a list to allow specifying multiple
protocols for a single policy, e.g. "proto { ipencap, ipv6 }".

feedback and ok benno@
ok patrick@

The tag comes after iface in iked.conf(5).

Move policy printing code from parse.y to new print.c

ok patrick@