Fixed merge, don't know why this didn't happen automatically - maybe a leftover from the svn->git conversion

9 files changed, 359 insertions, 0 deletions

diff --git a/src/starter/Makefile.am b/src/starter/Makefile.am
index 75297f767..29cdccbed 100644
--- a/src/starter/Makefile.am
+++ b/src/starter/Makefile.am
@@ -25,7 +25,10 @@ AM_CFLAGS = \
 
 starter_LDADD = defs.o $(top_builddir)/src/libfreeswan/libfreeswan.a $(top_builddir)/src/libstrongswan/libstrongswan.la $(SOCKLIB)
 EXTRA_DIST = parser.l parser.y keywords.txt ipsec.conf
+<<<<<<< HEAD
 dist_man_MANS = starter.8
+=======
+>>>>>>> upstream/4.5.1
 MAINTAINERCLEANFILES = lex.yy.c y.tab.c y.tab.h keywords.c
 
 PLUTODIR=$(top_srcdir)/src/pluto
@@ -59,6 +62,7 @@ defs.o:		$(PLUTODIR)/defs.c $(PLUTODIR)/defs.h
 		$(COMPILE) -c -o $@ $(PLUTODIR)/defs.c
 
 install-exec-local :
+<<<<<<< HEAD
 		test -e "$(DESTDIR)${sysconfdir}/ipsec.d" || $(INSTALL) -o ${ipsecuid} -g ${ipsecgid} -d "$(DESTDIR)$(sysconfdir)/ipsec.d" || true
 		test -e "$(DESTDIR)${sysconfdir}/ipsec.d/cacerts" || $(INSTALL) -o ${ipsecuid} -g ${ipsecgid} -d "$(DESTDIR)$(sysconfdir)/ipsec.d/cacerts" || true
 		test -e "$(DESTDIR)${sysconfdir}/ipsec.d/ocspcerts" || $(INSTALL) -o ${ipsecuid} -g ${ipsecgid} -d "$(DESTDIR)$(sysconfdir)/ipsec.d/ocspcerts" || true
@@ -69,4 +73,16 @@ install-exec-local :
 		test -e "$(DESTDIR)${sysconfdir}/ipsec.d/reqs" || $(INSTALL) -o ${ipsecuid} -g ${ipsecgid} -d "$(DESTDIR)$(sysconfdir)/ipsec.d/reqs" || true
 		test -e "$(DESTDIR)${sysconfdir}/ipsec.d/private" || $(INSTALL) -o ${ipsecuid} -g ${ipsecgid} -d -m 750 "$(DESTDIR)$(sysconfdir)/ipsec.d/private" || true
 		test -e "$(DESTDIR)$(sysconfdir)/ipsec.conf" || $(INSTALL) -o ${ipsecuid} -g ${ipsecgid} -m 644 $(srcdir)/ipsec.conf $(DESTDIR)$(sysconfdir)/ipsec.conf || true
+=======
+		test -e "$(DESTDIR)${sysconfdir}/ipsec.d" || $(INSTALL) -o -d "$(DESTDIR)$(sysconfdir)/ipsec.d" || true
+		test -e "$(DESTDIR)${sysconfdir}/ipsec.d/cacerts" || $(INSTALL) -d "$(DESTDIR)$(sysconfdir)/ipsec.d/cacerts" || true
+		test -e "$(DESTDIR)${sysconfdir}/ipsec.d/ocspcerts" || $(INSTALL) -d "$(DESTDIR)$(sysconfdir)/ipsec.d/ocspcerts" || true
+		test -e "$(DESTDIR)${sysconfdir}/ipsec.d/certs" || $(INSTALL) -d "$(DESTDIR)$(sysconfdir)/ipsec.d/certs" || true
+		test -e "$(DESTDIR)${sysconfdir}/ipsec.d/acerts" || $(INSTALL) -d "$(DESTDIR)$(sysconfdir)/ipsec.d/acerts" || true
+		test -e "$(DESTDIR)${sysconfdir}/ipsec.d/aacerts" || $(INSTALL) -d "$(DESTDIR)$(sysconfdir)/ipsec.d/aacerts" || true
+		test -e "$(DESTDIR)${sysconfdir}/ipsec.d/crls" || $(INSTALL) -d "$(DESTDIR)$(sysconfdir)/ipsec.d/crls" || true
+		test -e "$(DESTDIR)${sysconfdir}/ipsec.d/reqs" || $(INSTALL) -d "$(DESTDIR)$(sysconfdir)/ipsec.d/reqs" || true
+		test -e "$(DESTDIR)${sysconfdir}/ipsec.d/private" || $(INSTALL) -d -m 750 "$(DESTDIR)$(sysconfdir)/ipsec.d/private" || true
+		test -e "$(DESTDIR)$(sysconfdir)/ipsec.conf" || $(INSTALL) -m 644 $(srcdir)/ipsec.conf $(DESTDIR)$(sysconfdir)/ipsec.conf || true
+>>>>>>> upstream/4.5.1
 
diff --git a/src/starter/Makefile.in b/src/starter/Makefile.in
index 446f183f1..e38324f4a 100644
--- a/src/starter/Makefile.in
+++ b/src/starter/Makefile.in
@@ -39,8 +39,12 @@ ipsec_PROGRAMS = starter$(EXEEXT)
 @USE_CHARON_TRUE@am__append_2 = -DSTART_CHARON
 @USE_LOAD_WARNING_TRUE@am__append_3 = -DLOAD_WARNING
 subdir = src/starter
+<<<<<<< HEAD
 DIST_COMMON = README $(dist_man_MANS) $(srcdir)/Makefile.am \
 	$(srcdir)/Makefile.in
+=======
+DIST_COMMON = README $(srcdir)/Makefile.am $(srcdir)/Makefile.in
+>>>>>>> upstream/4.5.1
 ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
 am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
 	$(top_srcdir)/m4/config/ltoptions.m4 \
@@ -56,7 +60,11 @@ am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
 mkinstalldirs = $(install_sh) -d
 CONFIG_CLEAN_FILES =
 CONFIG_CLEAN_VPATH_FILES =
+<<<<<<< HEAD
 am__installdirs = "$(DESTDIR)$(ipsecdir)" "$(DESTDIR)$(man8dir)"
+=======
+am__installdirs = "$(DESTDIR)$(ipsecdir)"
+>>>>>>> upstream/4.5.1
 PROGRAMS = $(ipsec_PROGRAMS)
 am_starter_OBJECTS = y.tab.$(OBJEXT) netkey.$(OBJEXT) \
 	starterwhack.$(OBJEXT) starterstroke.$(OBJEXT) \
@@ -85,6 +93,7 @@ LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
 	$(LDFLAGS) -o $@
 SOURCES = $(starter_SOURCES)
 DIST_SOURCES = $(starter_SOURCES)
+<<<<<<< HEAD
 am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
 am__vpath_adj = case $$p in \
     $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
@@ -109,6 +118,8 @@ am__base_list = \
 man8dir = $(mandir)/man8
 NROFF = nroff
 MANS = $(dist_man_MANS)
+=======
+>>>>>>> upstream/4.5.1
 ETAGS = etags
 CTAGS = ctags
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
@@ -231,9 +242,13 @@ includedir = @includedir@
 infodir = @infodir@
 install_sh = @install_sh@
 ipsecdir = @ipsecdir@
+<<<<<<< HEAD
 ipsecgid = @ipsecgid@
 ipsecgroup = @ipsecgroup@
 ipsecuid = @ipsecuid@
+=======
+ipsecgroup = @ipsecgroup@
+>>>>>>> upstream/4.5.1
 ipsecuser = @ipsecuser@
 libcharon_plugins = @libcharon_plugins@
 libdir = @libdir@
@@ -272,6 +287,11 @@ sbindir = @sbindir@
 scepclient_plugins = @scepclient_plugins@
 scripts_plugins = @scripts_plugins@
 sharedstatedir = @sharedstatedir@
+<<<<<<< HEAD
+=======
+soup_CFLAGS = @soup_CFLAGS@
+soup_LIBS = @soup_LIBS@
+>>>>>>> upstream/4.5.1
 srcdir = @srcdir@
 strongswan_conf = @strongswan_conf@
 sysconfdir = @sysconfdir@
@@ -304,7 +324,10 @@ AM_CFLAGS = -DIPSEC_DIR=\"${ipsecdir}\" \
 	$(am__append_2) $(am__append_3)
 starter_LDADD = defs.o $(top_builddir)/src/libfreeswan/libfreeswan.a $(top_builddir)/src/libstrongswan/libstrongswan.la $(SOCKLIB)
 EXTRA_DIST = parser.l parser.y keywords.txt ipsec.conf
+<<<<<<< HEAD
 dist_man_MANS = starter.8
+=======
+>>>>>>> upstream/4.5.1
 MAINTAINERCLEANFILES = lex.yy.c y.tab.c y.tab.h keywords.c
 PLUTODIR = $(top_srcdir)/src/pluto
 SCEPCLIENTDIR = $(top_srcdir)/src/scepclient
@@ -438,6 +461,7 @@ mostlyclean-libtool:
 
 clean-libtool:
 	-rm -rf .libs _libs
+<<<<<<< HEAD
 install-man8: $(dist_man_MANS)
 	@$(NORMAL_INSTALL)
 	test -z "$(man8dir)" || $(MKDIR_P) "$(DESTDIR)$(man8dir)"
@@ -476,6 +500,8 @@ uninstall-man8:
 	test -z "$$files" || { \
 	  echo " ( cd '$(DESTDIR)$(man8dir)' && rm -f" $$files ")"; \
 	  cd "$(DESTDIR)$(man8dir)" && rm -f $$files; }
+=======
+>>>>>>> upstream/4.5.1
 
 ID: $(HEADERS) $(SOURCES) $(LISP) $(TAGS_FILES)
 	list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
@@ -530,6 +556,7 @@ distclean-tags:
 	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
 
 distdir: $(DISTFILES)
+<<<<<<< HEAD
 	@list='$(MANS)'; if test -n "$$list"; then \
 	  list=`for p in $$list; do \
 	    if test -f $$p; then d=; else d="$(srcdir)/"; fi; \
@@ -543,6 +570,8 @@ distdir: $(DISTFILES)
 	    exit 1; \
 	  else :; fi; \
 	else :; fi
+=======
+>>>>>>> upstream/4.5.1
 	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
 	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
 	list='$(DISTFILES)'; \
@@ -574,9 +603,15 @@ distdir: $(DISTFILES)
 	done
 check-am: all-am
 check: check-am
+<<<<<<< HEAD
 all-am: Makefile $(PROGRAMS) $(MANS)
 installdirs:
 	for dir in "$(DESTDIR)$(ipsecdir)" "$(DESTDIR)$(man8dir)"; do \
+=======
+all-am: Makefile $(PROGRAMS)
+installdirs:
+	for dir in "$(DESTDIR)$(ipsecdir)"; do \
+>>>>>>> upstream/4.5.1
 	  test -z "$$dir" || $(MKDIR_P) "$$dir"; \
 	done
 install: install-am
@@ -628,7 +663,11 @@ info: info-am
 
 info-am:
 
+<<<<<<< HEAD
 install-data-am: install-ipsecPROGRAMS install-man
+=======
+install-data-am: install-ipsecPROGRAMS
+>>>>>>> upstream/4.5.1
 
 install-dvi: install-dvi-am
 
@@ -644,7 +683,11 @@ install-info: install-info-am
 
 install-info-am:
 
+<<<<<<< HEAD
 install-man: install-man8
+=======
+install-man:
+>>>>>>> upstream/4.5.1
 
 install-pdf: install-pdf-am
 
@@ -674,9 +717,13 @@ ps: ps-am
 
 ps-am:
 
+<<<<<<< HEAD
 uninstall-am: uninstall-ipsecPROGRAMS uninstall-man
 
 uninstall-man: uninstall-man8
+=======
+uninstall-am: uninstall-ipsecPROGRAMS
+>>>>>>> upstream/4.5.1
 
 .MAKE: install-am install-strip
 
@@ -687,6 +734,7 @@ uninstall-man: uninstall-man8
 	install install-am install-data install-data-am install-dvi \
 	install-dvi-am install-exec install-exec-am install-exec-local \
 	install-html install-html-am install-info install-info-am \
+<<<<<<< HEAD
 	install-ipsecPROGRAMS install-man install-man8 install-pdf \
 	install-pdf-am install-ps install-ps-am install-strip \
 	installcheck installcheck-am installdirs maintainer-clean \
@@ -694,6 +742,14 @@ uninstall-man: uninstall-man8
 	mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
 	tags uninstall uninstall-am uninstall-ipsecPROGRAMS \
 	uninstall-man uninstall-man8
+=======
+	install-ipsecPROGRAMS install-man install-pdf install-pdf-am \
+	install-ps install-ps-am install-strip installcheck \
+	installcheck-am installdirs maintainer-clean \
+	maintainer-clean-generic mostlyclean mostlyclean-compile \
+	mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
+	tags uninstall uninstall-am uninstall-ipsecPROGRAMS
+>>>>>>> upstream/4.5.1
 
 
 lex.yy.c:	$(srcdir)/parser.l $(srcdir)/parser.y $(srcdir)/parser.h y.tab.h
@@ -712,6 +768,7 @@ defs.o:		$(PLUTODIR)/defs.c $(PLUTODIR)/defs.h
 		$(COMPILE) -c -o $@ $(PLUTODIR)/defs.c
 
 install-exec-local :
+<<<<<<< HEAD
 		test -e "$(DESTDIR)${sysconfdir}/ipsec.d" || $(INSTALL) -o ${ipsecuid} -g ${ipsecgid} -d "$(DESTDIR)$(sysconfdir)/ipsec.d" || true
 		test -e "$(DESTDIR)${sysconfdir}/ipsec.d/cacerts" || $(INSTALL) -o ${ipsecuid} -g ${ipsecgid} -d "$(DESTDIR)$(sysconfdir)/ipsec.d/cacerts" || true
 		test -e "$(DESTDIR)${sysconfdir}/ipsec.d/ocspcerts" || $(INSTALL) -o ${ipsecuid} -g ${ipsecgid} -d "$(DESTDIR)$(sysconfdir)/ipsec.d/ocspcerts" || true
@@ -722,6 +779,18 @@ install-exec-local :
 		test -e "$(DESTDIR)${sysconfdir}/ipsec.d/reqs" || $(INSTALL) -o ${ipsecuid} -g ${ipsecgid} -d "$(DESTDIR)$(sysconfdir)/ipsec.d/reqs" || true
 		test -e "$(DESTDIR)${sysconfdir}/ipsec.d/private" || $(INSTALL) -o ${ipsecuid} -g ${ipsecgid} -d -m 750 "$(DESTDIR)$(sysconfdir)/ipsec.d/private" || true
 		test -e "$(DESTDIR)$(sysconfdir)/ipsec.conf" || $(INSTALL) -o ${ipsecuid} -g ${ipsecgid} -m 644 $(srcdir)/ipsec.conf $(DESTDIR)$(sysconfdir)/ipsec.conf || true
+=======
+		test -e "$(DESTDIR)${sysconfdir}/ipsec.d" || $(INSTALL) -o -d "$(DESTDIR)$(sysconfdir)/ipsec.d" || true
+		test -e "$(DESTDIR)${sysconfdir}/ipsec.d/cacerts" || $(INSTALL) -d "$(DESTDIR)$(sysconfdir)/ipsec.d/cacerts" || true
+		test -e "$(DESTDIR)${sysconfdir}/ipsec.d/ocspcerts" || $(INSTALL) -d "$(DESTDIR)$(sysconfdir)/ipsec.d/ocspcerts" || true
+		test -e "$(DESTDIR)${sysconfdir}/ipsec.d/certs" || $(INSTALL) -d "$(DESTDIR)$(sysconfdir)/ipsec.d/certs" || true
+		test -e "$(DESTDIR)${sysconfdir}/ipsec.d/acerts" || $(INSTALL) -d "$(DESTDIR)$(sysconfdir)/ipsec.d/acerts" || true
+		test -e "$(DESTDIR)${sysconfdir}/ipsec.d/aacerts" || $(INSTALL) -d "$(DESTDIR)$(sysconfdir)/ipsec.d/aacerts" || true
+		test -e "$(DESTDIR)${sysconfdir}/ipsec.d/crls" || $(INSTALL) -d "$(DESTDIR)$(sysconfdir)/ipsec.d/crls" || true
+		test -e "$(DESTDIR)${sysconfdir}/ipsec.d/reqs" || $(INSTALL) -d "$(DESTDIR)$(sysconfdir)/ipsec.d/reqs" || true
+		test -e "$(DESTDIR)${sysconfdir}/ipsec.d/private" || $(INSTALL) -d -m 750 "$(DESTDIR)$(sysconfdir)/ipsec.d/private" || true
+		test -e "$(DESTDIR)$(sysconfdir)/ipsec.conf" || $(INSTALL) -m 644 $(srcdir)/ipsec.conf $(DESTDIR)$(sysconfdir)/ipsec.conf || true
+>>>>>>> upstream/4.5.1
 
 # Tell versions [3.59,3.63) of GNU make to not export all variables.
 # Otherwise a system limit (for SysV at least) may be exceeded.
diff --git a/src/starter/args.c b/src/starter/args.c
index 37d600283..0c1a835ae 100644
--- a/src/starter/args.c
+++ b/src/starter/args.c
@@ -239,6 +239,10 @@ static const token_info_t token_info[] =
 	{ ARG_MISC, 0, NULL  /* KW_MARK */                                             },
 	{ ARG_MISC, 0, NULL  /* KW_MARK_IN */                                          },
 	{ ARG_MISC, 0, NULL  /* KW_MARK_OUT */                                         },
+<<<<<<< HEAD
+=======
+	{ ARG_MISC, 0, NULL  /* KW_TFC */                                              },
+>>>>>>> upstream/4.5.1
 
 	/* ca section keywords */
 	{ ARG_STR,  offsetof(starter_ca_t, name), NULL                                 },
@@ -272,6 +276,10 @@ static const token_info_t token_info[] =
 	{ ARG_STR,  offsetof(starter_end_t, rsakey), NULL                              },
 	{ ARG_STR,  offsetof(starter_end_t, cert), NULL                                },
 	{ ARG_STR,  offsetof(starter_end_t, cert2), NULL                               },
+<<<<<<< HEAD
+=======
+	{ ARG_STR,  offsetof(starter_end_t, cert_policy), NULL                         },
+>>>>>>> upstream/4.5.1
 	{ ARG_ENUM, offsetof(starter_end_t, sendcert), LST_sendcert                    },
 	{ ARG_STR,  offsetof(starter_end_t, ca), NULL                                  },
 	{ ARG_STR,  offsetof(starter_end_t, ca2), NULL                                 },
diff --git a/src/starter/confread.c b/src/starter/confread.c
index 3367616ca..f48843750 100644
--- a/src/starter/confread.c
+++ b/src/starter/confread.c
@@ -705,6 +705,26 @@ static void load_conn(starter_conn_t *conn, kw_list_t *kw, starter_config_t *cfg
 				cfg->err++;
 			}
 			break;
+<<<<<<< HEAD
+=======
+		case KW_TFC:
+			if (streq(kw->value, "%mtu"))
+			{
+				conn->tfc = -1;
+			}
+			else
+			{
+				char *endptr;
+
+				conn->tfc = strtoul(kw->value, &endptr, 10);
+				if (*endptr != '\0')
+				{
+					plog("# bad integer value: %s=%s", kw->entry->name, kw->value);
+					cfg->err++;
+				}
+			}
+			break;
+>>>>>>> upstream/4.5.1
 		case KW_KEYINGTRIES:
 			if (streq(kw->value, "%forever"))
 			{
diff --git a/src/starter/confread.h b/src/starter/confread.h
index 982d1d206..ba17d0b9a 100644
--- a/src/starter/confread.h
+++ b/src/starter/confread.h
@@ -64,6 +64,10 @@ struct starter_end {
 		char            *ca;
 		char            *ca2;
 		char            *groups;
+<<<<<<< HEAD
+=======
+		char            *cert_policy;
+>>>>>>> upstream/4.5.1
 		char            *iface;
 		ip_address      addr;
 		u_int           ikeport;
@@ -125,6 +129,10 @@ struct starter_conn {
 		u_int32_t       reqid;
 		mark_t          mark_in;
 		mark_t          mark_out;
+<<<<<<< HEAD
+=======
+		u_int32_t       tfc;
+>>>>>>> upstream/4.5.1
 		sa_family_t     addr_family;
 		sa_family_t     tunnel_addr_family;
 		bool            install_policy;
diff --git a/src/starter/keywords.c b/src/starter/keywords.c
index 0c24c7dcf..78c243f7e 100644
--- a/src/starter/keywords.c
+++ b/src/starter/keywords.c
@@ -54,12 +54,21 @@ struct kw_entry {
     kw_token_t token;
 };
 
+<<<<<<< HEAD
 #define TOTAL_KEYWORDS 127
 #define MIN_WORD_LENGTH 3
 #define MAX_WORD_LENGTH 17
 #define MIN_HASH_VALUE 12
 #define MAX_HASH_VALUE 238
 /* maximum key range = 227, duplicates = 0 */
+=======
+#define TOTAL_KEYWORDS 130
+#define MIN_WORD_LENGTH 3
+#define MAX_WORD_LENGTH 17
+#define MIN_HASH_VALUE 18
+#define MAX_HASH_VALUE 249
+/* maximum key range = 232, duplicates = 0 */
+>>>>>>> upstream/4.5.1
 
 #ifdef __GNUC__
 __inline
@@ -75,6 +84,7 @@ hash (str, len)
 {
   static const unsigned char asso_values[] =
     {
+<<<<<<< HEAD
       239, 239, 239, 239, 239, 239, 239, 239, 239, 239,
       239, 239, 239, 239, 239, 239, 239, 239, 239, 239,
       239, 239, 239, 239, 239, 239, 239, 239, 239, 239,
@@ -101,6 +111,34 @@ hash (str, len)
       239, 239, 239, 239, 239, 239, 239, 239, 239, 239,
       239, 239, 239, 239, 239, 239, 239, 239, 239, 239,
       239, 239, 239, 239, 239, 239
+=======
+      250, 250, 250, 250, 250, 250, 250, 250, 250, 250,
+      250, 250, 250, 250, 250, 250, 250, 250, 250, 250,
+      250, 250, 250, 250, 250, 250, 250, 250, 250, 250,
+      250, 250, 250, 250, 250, 250, 250, 250, 250, 250,
+      250, 250, 250, 250, 250, 250, 250, 250, 250,  11,
+      125, 250, 250, 250, 250, 250, 250, 250, 250, 250,
+      250, 250, 250, 250, 250, 250, 250, 250, 250, 250,
+      250, 250, 250, 250, 250, 250, 250, 250, 250, 250,
+      250, 250, 250, 250, 250, 250, 250, 250, 250, 250,
+      250, 250, 250, 250, 250,  20, 250,  18,   6,  55,
+       59,   3,   9,   3,  92,   3, 250, 147,  71,  12,
+       29,  83,  38,   4,  13,   3,   8,  80,   3, 250,
+      250,  12,   9, 250, 250, 250, 250, 250, 250, 250,
+      250, 250, 250, 250, 250, 250, 250, 250, 250, 250,
+      250, 250, 250, 250, 250, 250, 250, 250, 250, 250,
+      250, 250, 250, 250, 250, 250, 250, 250, 250, 250,
+      250, 250, 250, 250, 250, 250, 250, 250, 250, 250,
+      250, 250, 250, 250, 250, 250, 250, 250, 250, 250,
+      250, 250, 250, 250, 250, 250, 250, 250, 250, 250,
+      250, 250, 250, 250, 250, 250, 250, 250, 250, 250,
+      250, 250, 250, 250, 250, 250, 250, 250, 250, 250,
+      250, 250, 250, 250, 250, 250, 250, 250, 250, 250,
+      250, 250, 250, 250, 250, 250, 250, 250, 250, 250,
+      250, 250, 250, 250, 250, 250, 250, 250, 250, 250,
+      250, 250, 250, 250, 250, 250, 250, 250, 250, 250,
+      250, 250, 250, 250, 250, 250
+>>>>>>> upstream/4.5.1
     };
   register int hval = len;
 
@@ -124,6 +162,7 @@ hash (str, len)
 static const struct kw_entry wordlist[] =
   {
     {"pfs",               KW_PFS},
+<<<<<<< HEAD
     {"uniqueids",         KW_UNIQUEIDS},
     {"rightgroups",       KW_RIGHTGROUPS},
     {"lifetime",          KW_KEYLIFE},
@@ -250,11 +289,143 @@ static const struct kw_entry wordlist[] =
     {"pkcs11initargs",    KW_PKCS11INITARGS},
     {"pkcs11keepstate",   KW_PKCS11KEEPSTATE},
     {"pkcs11proxy",       KW_PKCS11PROXY}
+=======
+    {"right",             KW_RIGHT},
+    {"rightgroups",       KW_RIGHTGROUPS},
+    {"left",              KW_LEFT},
+    {"lifetime",          KW_KEYLIFE},
+    {"rightsubnet",       KW_RIGHTSUBNET},
+    {"rightikeport",      KW_RIGHTIKEPORT},
+    {"rightsendcert",     KW_RIGHTSENDCERT},
+    {"leftcert",          KW_LEFTCERT},
+    {"keyingtries",       KW_KEYINGTRIES},
+    {"keylife",           KW_KEYLIFE},
+    {"leftsendcert",      KW_LEFTSENDCERT},
+    {"lifebytes",         KW_LIFEBYTES},
+    {"keep_alive",        KW_KEEP_ALIVE},
+    {"leftgroups",        KW_LEFTGROUPS},
+    {"leftrsasigkey",     KW_LEFTRSASIGKEY},
+    {"leftcertpolicy",    KW_LEFTCERTPOLICY},
+    {"certuribase",       KW_CERTURIBASE},
+    {"lifepackets",       KW_LIFEPACKETS},
+    {"rightrsasigkey",    KW_RIGHTRSASIGKEY},
+    {"leftprotoport",     KW_LEFTPROTOPORT},
+    {"uniqueids",         KW_UNIQUEIDS},
+    {"rightallowany",     KW_RIGHTALLOWANY},
+    {"virtual_private",   KW_VIRTUAL_PRIVATE},
+    {"leftca",            KW_LEFTCA},
+    {"rightsubnetwithin", KW_RIGHTSUBNETWITHIN},
+    {"strictcrlpolicy",   KW_STRICTCRLPOLICY},
+    {"type",              KW_TYPE},
+    {"interfaces",        KW_INTERFACES},
+    {"rightsourceip",     KW_RIGHTSOURCEIP},
+    {"leftnexthop",       KW_LEFTNEXTHOP},
+    {"rightprotoport",    KW_RIGHTPROTOPORT},
+    {"mark_in",           KW_MARK_IN},
+    {"reqid",             KW_REQID},
+    {"inactivity",        KW_INACTIVITY},
+    {"margintime",        KW_REKEYMARGIN},
+    {"marginbytes",       KW_MARGINBYTES},
+    {"rightid",           KW_RIGHTID},
+    {"marginpackets",     KW_MARGINPACKETS},
+    {"leftnatip",         KW_LEFTNATIP},
+    {"rightcert",         KW_RIGHTCERT},
+    {"ocspuri",           KW_OCSPURI},
+    {"esp",               KW_ESP},
+    {"rightnatip",        KW_RIGHTNATIP},
+    {"keyexchange",       KW_KEYEXCHANGE},
+    {"rightnexthop",      KW_RIGHTNEXTHOP},
+    {"rightca",           KW_RIGHTCA},
+    {"rightcertpolicy",   KW_RIGHTCERTPOLICY},
+    {"leftupdown",        KW_LEFTUPDOWN},
+    {"ocspuri1",          KW_OCSPURI},
+    {"mediated_by",       KW_MEDIATED_BY},
+    {"me_peerid",         KW_ME_PEERID},
+    {"cacert",            KW_CACERT},
+    {"crluri",            KW_CRLURI},
+    {"eap",               KW_EAP},
+    {"leftfirewall",      KW_LEFTFIREWALL},
+    {"rightfirewall",     KW_RIGHTFIREWALL},
+    {"overridemtu",       KW_OVERRIDEMTU},
+    {"mobike",	           KW_MOBIKE},
+    {"packetdefault",     KW_PACKETDEFAULT},
+    {"crluri1",           KW_CRLURI},
+    {"ldapbase",          KW_LDAPBASE},
+    {"leftallowany",      KW_LEFTALLOWANY},
+    {"mediation",         KW_MEDIATION},
+    {"compress",          KW_COMPRESS},
+    {"leftsubnet",        KW_LEFTSUBNET},
+    {"lefthostaccess",    KW_LEFTHOSTACCESS},
+    {"forceencaps",       KW_FORCEENCAPS},
+    {"dumpdir",           KW_DUMPDIR},
+    {"righthostaccess",   KW_RIGHTHOSTACCESS},
+    {"authby",            KW_AUTHBY},
+    {"aaa_identity",      KW_AAA_IDENTITY},
+    {"tfc",               KW_TFC},
+    {"nat_traversal",     KW_NAT_TRAVERSAL},
+    {"rightauth",         KW_RIGHTAUTH},
+    {"rightupdown",       KW_RIGHTUPDOWN},
+    {"dpdtimeout",        KW_DPDTIMEOUT},
+    {"installpolicy",     KW_INSTALLPOLICY},
+    {"mark_out",          KW_MARK_OUT},
+    {"fragicmp",          KW_FRAGICMP},
+    {"force_keepalive",   KW_FORCE_KEEPALIVE},
+    {"leftid",            KW_LEFTID},
+    {"leftsubnetwithin",  KW_LEFTSUBNETWITHIN},
+    {"eap_identity",      KW_EAP_IDENTITY},
+    {"cachecrls",         KW_CACHECRLS},
+    {"pfsgroup",          KW_PFSGROUP},
+    {"rightid2",          KW_RIGHTID2},
+    {"dpdaction",         KW_DPDACTION},
+    {"xauth_identity",    KW_XAUTH_IDENTITY},
+    {"leftsourceip",      KW_LEFTSOURCEIP},
+    {"klipsdebug",        KW_KLIPSDEBUG},
+    {"leftcert2",         KW_LEFTCERT2},
+    {"charondebug",       KW_CHARONDEBUG},
+    {"hidetos",           KW_HIDETOS},
+    {"ike",               KW_IKE},
+    {"charonstart",       KW_CHARONSTART},
+    {"rightauth2",        KW_RIGHTAUTH2},
+    {"also",              KW_ALSO},
+    {"leftca2",           KW_LEFTCA2},
+    {"rekey",             KW_REKEY},
+    {"plutostderrlog",    KW_PLUTOSTDERRLOG},
+    {"plutostart",        KW_PLUTOSTART},
+    {"ikelifetime",       KW_IKELIFETIME},
+    {"crlcheckinterval",  KW_CRLCHECKINTERVAL},
+    {"auto",              KW_AUTO},
+    {"ldaphost",          KW_LDAPHOST},
+    {"rekeyfuzz",         KW_REKEYFUZZ},
+    {"leftikeport",       KW_LEFTIKEPORT},
+    {"mark",              KW_MARK},
+    {"auth",              KW_AUTH},
+    {"prepluto",          KW_PREPLUTO},
+    {"dpddelay",          KW_DPDDELAY},
+    {"leftauth",          KW_LEFTAUTH},
+    {"rightca2",          KW_RIGHTCA2},
+    {"xauth",             KW_XAUTH},
+    {"rightcert2",        KW_RIGHTCERT2},
+    {"rekeymargin",       KW_REKEYMARGIN},
+    {"leftid2",           KW_LEFTID2},
+    {"ocspuri2",          KW_OCSPURI2},
+    {"nocrsend",          KW_NOCRSEND},
+    {"reauth",            KW_REAUTH},
+    {"crluri2",           KW_CRLURI2},
+    {"plutodebug",        KW_PLUTODEBUG},
+    {"leftauth2",         KW_LEFTAUTH2},
+    {"pkcs11module",      KW_PKCS11MODULE},
+    {"pkcs11initargs",    KW_PKCS11INITARGS},
+    {"pkcs11keepstate",   KW_PKCS11KEEPSTATE},
+    {"pkcs11proxy",       KW_PKCS11PROXY},
+    {"modeconfig",        KW_MODECONFIG},
+    {"postpluto",         KW_POSTPLUTO}
+>>>>>>> upstream/4.5.1
   };
 
 static const short lookup[] =
   {
      -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+<<<<<<< HEAD
      -1,  -1,   0,   1,  -1,   2,  -1,  -1,   3,  -1,
      -1,   4,  -1,   5,   6,   7,   8,   9,  -1,  10,
      11,  -1,  12,  13,  14,  15,  16,  17,  -1,  18,
@@ -278,6 +449,32 @@ static const short lookup[] =
      -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
      -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
      -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 126
+=======
+     -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,   0,   1,
+     -1,  -1,  -1,   2,   3,  -1,   4,  -1,   5,   6,
+      7,   8,   9,  -1,  10,  11,  12,  13,  14,  -1,
+     15,  16,  -1,  17,  18,  19,  20,  21,  -1,  22,
+     -1,  -1,  23,  -1,  24,  25,  26,  27,  -1,  28,
+     29,  -1,  -1,  -1,  30,  -1,  31,  -1,  -1,  -1,
+     32,  33,  34,  35,  36,  37,  38,  39,  40,  -1,
+     -1,  41,  42,  43,  44,  45,  46,  -1,  47,  48,
+     49,  -1,  -1,  50,  51,  52,  53,  54,  55,  56,
+     57,  58,  59,  -1,  -1,  60,  61,  62,  63,  64,
+     65,  -1,  66,  67,  -1,  68,  69,  -1,  70,  71,
+     -1,  -1,  72,  73,  -1,  74,  75,  76,  77,  -1,
+     78,  -1,  79,  -1,  80,  -1,  81,  82,  -1,  83,
+     84,  85,  86,  87,  88,  89,  90,  -1,  -1,  91,
+     -1,  -1,  -1,  92,  -1,  93,  94,  -1,  95,  96,
+     -1,  97,  98,  -1,  -1,  -1,  -1,  99,  -1,  -1,
+     -1, 100, 101, 102, 103, 104, 105, 106, 107,  -1,
+     -1,  -1, 108,  -1, 109,  -1,  -1, 110, 111,  -1,
+     -1,  -1, 112,  -1, 113, 114, 115,  -1,  -1,  -1,
+     -1,  -1, 116, 117, 118,  -1,  -1,  -1, 119,  -1,
+     -1, 120,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 121,
+     -1,  -1,  -1, 122,  -1,  -1, 123,  -1, 124,  -1,
+    125, 126,  -1,  -1,  -1,  -1, 127,  -1, 128,  -1,
+     -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 129
+>>>>>>> upstream/4.5.1
   };
 
 #ifdef __GNUC__
diff --git a/src/starter/keywords.h b/src/starter/keywords.h
index 1dae65a99..23f6fd24b 100644
--- a/src/starter/keywords.h
+++ b/src/starter/keywords.h
@@ -102,9 +102,16 @@ typedef enum {
 	KW_MARK,
 	KW_MARK_IN,
 	KW_MARK_OUT,
+<<<<<<< HEAD
 
 #define KW_CONN_FIRST   KW_CONN_SETUP
 #define KW_CONN_LAST    KW_MARK_OUT
+=======
+	KW_TFC,
+
+#define KW_CONN_FIRST   KW_CONN_SETUP
+#define KW_CONN_LAST    KW_TFC
+>>>>>>> upstream/4.5.1
 
    /* ca section keywords */
 	KW_CA_NAME,
@@ -141,6 +148,10 @@ typedef enum {
 	KW_RSASIGKEY,
 	KW_CERT,
 	KW_CERT2,
+<<<<<<< HEAD
+=======
+	KW_CERTPOLICY,
+>>>>>>> upstream/4.5.1
 	KW_SENDCERT,
 	KW_CA,
 	KW_CA2,
@@ -170,6 +181,10 @@ typedef enum {
 	KW_LEFTRSASIGKEY,
 	KW_LEFTCERT,
 	KW_LEFTCERT2,
+<<<<<<< HEAD
+=======
+	KW_LEFTCERTPOLICY,
+>>>>>>> upstream/4.5.1
 	KW_LEFTSENDCERT,
 	KW_LEFTCA,
 	KW_LEFTCA2,
@@ -198,6 +213,10 @@ typedef enum {
 	KW_RIGHTRSASIGKEY,
 	KW_RIGHTCERT,
 	KW_RIGHTCERT2,
+<<<<<<< HEAD
+=======
+	KW_RIGHTCERTPOLICY,
+>>>>>>> upstream/4.5.1
 	KW_RIGHTSENDCERT,
 	KW_RIGHTCA,
 	KW_RIGHTCA2,
diff --git a/src/starter/keywords.txt b/src/starter/keywords.txt
index 06705635a..608981472 100644
--- a/src/starter/keywords.txt
+++ b/src/starter/keywords.txt
@@ -93,6 +93,10 @@ reqid,             KW_REQID
 mark,              KW_MARK
 mark_in,           KW_MARK_IN
 mark_out,          KW_MARK_OUT
+<<<<<<< HEAD
+=======
+tfc,               KW_TFC
+>>>>>>> upstream/4.5.1
 cacert,            KW_CACERT
 ldaphost,          KW_LDAPHOST
 ldapbase,          KW_LDAPBASE
@@ -120,8 +124,14 @@ leftid2,           KW_LEFTID2
 leftauth,          KW_LEFTAUTH
 leftauth2,         KW_LEFTAUTH2
 leftrsasigkey,     KW_LEFTRSASIGKEY
+<<<<<<< HEAD
 leftcert,          KW_LEFTCERT,
 leftcert2,         KW_LEFTCERT2,
+=======
+leftcert,          KW_LEFTCERT
+leftcert2,         KW_LEFTCERT2
+leftcertpolicy,    KW_LEFTCERTPOLICY
+>>>>>>> upstream/4.5.1
 leftsendcert,      KW_LEFTSENDCERT
 leftca,            KW_LEFTCA
 leftca2,           KW_LEFTCA2
@@ -145,6 +155,10 @@ rightauth2,        KW_RIGHTAUTH2
 rightrsasigkey,    KW_RIGHTRSASIGKEY
 rightcert,         KW_RIGHTCERT
 rightcert2,        KW_RIGHTCERT2
+<<<<<<< HEAD
+=======
+rightcertpolicy,   KW_RIGHTCERTPOLICY
+>>>>>>> upstream/4.5.1
 rightsendcert,     KW_RIGHTSENDCERT
 rightca,           KW_RIGHTCA
 rightca2,          KW_RIGHTCA2
diff --git a/src/starter/starterstroke.c b/src/starter/starterstroke.c
index 9ba569d47..45d407384 100644
--- a/src/starter/starterstroke.c
+++ b/src/starter/starterstroke.c
@@ -171,6 +171,10 @@ static void starter_stroke_add_end(stroke_msg_t *msg, stroke_end_t *msg_end, sta
 	msg_end->id2 = push_string(msg, conn_end->id2);
 	msg_end->cert = push_string(msg, conn_end->cert);
 	msg_end->cert2 = push_string(msg, conn_end->cert2);
+<<<<<<< HEAD
+=======
+	msg_end->cert_policy = push_string(msg, conn_end->cert_policy);
+>>>>>>> upstream/4.5.1
 	msg_end->ca = push_string(msg, conn_end->ca);
 	msg_end->ca2 = push_string(msg, conn_end->ca2);
 	msg_end->groups = push_string(msg, conn_end->groups);
@@ -266,6 +270,10 @@ int starter_stroke_add_conn(starter_config_t *cfg, starter_conn_t *conn)
 	msg.add_conn.mark_in.mask = conn->mark_in.mask;
 	msg.add_conn.mark_out.value = conn->mark_out.value;
 	msg.add_conn.mark_out.mask = conn->mark_out.mask;
+<<<<<<< HEAD
+=======
+	msg.add_conn.tfc = conn->tfc;
+>>>>>>> upstream/4.5.1
 
 	starter_stroke_add_end(&msg, &msg.add_conn.me, &conn->left);
 	starter_stroke_add_end(&msg, &msg.add_conn.other, &conn->right);