Remove modular exponential groups specified in RFC5114

Brought up by doug@, ok reyk, djm, doug

ikelifetime time spec is the same the one for lifetime

Remove plain DES encryption from IPsec.

DES is insecure since brute force attacks are practical due to its
short key length.

This removes support for DES-CBC encryption in ESP and in IKE main
and q

Remove plain DES encryption from IPsec.

DES is insecure since brute force attacks are practical due to its
short key length.

This removes support for DES-CBC encryption in ESP and in IKE main
and quick mode from the kernel, isakmpd(8), ipsecctl(8), and iked(8).

ok mikeb@

show more ...

Support Chacha20-Poly1305 for Child SAs; ok reyk

replace "can not" with "cannot";

pasto

break long lines in examples; ok jmc@

clarification from trondd;
ok mikeb

Reduce usage of predefined strings in manpages.

Predefined strings are not very portable across troff implementations,
and they make the source much harder to read. Usually the intended
character ca

Reduce usage of predefined strings in manpages.

Predefined strings are not very portable across troff implementations,
and they make the source much harder to read. Usually the intended
character can be written directly.

No output changes, except for two instances where the incorrect escape
was used in the first place.

tweaks + ok schwarze@

show more ...

tell the truth about DES.

joint work with djm@ and jsing@

ok djm@

PFS stands for Perfect Forward Secrecy.

ok reyk@

Add support for Curve25519 using the public domain code that is found
in OpenSSH. The "private use" DH group 1034 is based on the value
that was picked by strongswan recently.

OK mikeb@ markus@

Add support for DH groups 27-30 using the Brainpool curves which have
previously been added to LibreSSL's libcrypto.

ok markus@ mikeb@

Fix an example, nat-to requires to specify the "out" direction in pf rules.

From "Vigdis" via misc@
can go in deraadt@

zap stray word; ok markus

initiate ike sa rekeying (ikesalifetime keyword), re-queue pfkey
events while we are busy initiating child-SAs; ok mikeb@

macro fixes for previous; ok reyk

bump copyright

Add missing documentation for ipcomp(4) support and the configuration
payloads.

ok sthen@ krw@

basic OCSP support. enable with 'set ocsp "http://10.0.0.10:8888/"'
ok mikeb@

altq -> new queue in examples
From: Arto Jonsson <ajonsson at kapsi.fi>

Add missing .Mt macros for AUTHORS email addresses.
From Jan Stary <hans at stare dot cz>.
ok jmc@

Move the gmac/null ciphers to a different table block, clearly labelled as
not doing encryption. ok reyk@

cross referencing the manual page is better.

change suggested and ok'd by jmc@

fix program name used in AUTHORS section.

ok mikeb@