diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..1312b66
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,4 @@
+SOURCES/ikev1_dsa.fax.bz2
+SOURCES/ikev1_psk.fax.bz2
+SOURCES/ikev2.fax.bz2
+SOURCES/libreswan-3.25.tar.gz
diff --git a/.libreswan.metadata b/.libreswan.metadata
new file mode 100644
index 0000000..ed2101e
--- /dev/null
+++ b/.libreswan.metadata
@@ -0,0 +1,4 @@
+b35cd50b8bc0a08b9c07713bf19c72d53bfe66bb SOURCES/ikev1_dsa.fax.bz2
+861d97bf488f9e296cad8c43ab72f111a5b1a848 SOURCES/ikev1_psk.fax.bz2
+fcaf77f3deae3d8e99cdb3b1f8abea63167a0633 SOURCES/ikev2.fax.bz2
+5a83fbde704576cd5c2b6357af400d49a033e274 SOURCES/libreswan-3.25.tar.gz
diff --git a/SOURCES/libreswan-3.23-del-with-notify-1630355.patch b/SOURCES/libreswan-3.23-del-with-notify-1630355.patch
new file mode 100644
index 0000000..cefecfa
--- /dev/null
+++ b/SOURCES/libreswan-3.23-del-with-notify-1630355.patch
@@ -0,0 +1,33 @@
+diff -Naur libreswan-3.25-orig/programs/pluto/ikev1.c libreswan-3.25/programs/pluto/ikev1.c
+--- libreswan-3.25-orig/programs/pluto/ikev1.c	2018-06-27 22:42:26.000000000 +0700
++++ libreswan-3.25/programs/pluto/ikev1.c	2018-11-22 20:04:44.961824151 +0700
+@@ -727,28 +727,7 @@
+ 			return dpd_inR(st, n, n_pbs);
+ 
+ 		case PAYLOAD_MALFORMED:
+-			if (st != NULL) {
+-				st->hidden_variables.st_malformed_received++;
+-
+-				libreswan_log(
+-					"received %u malformed payload notifies",
+-					st->hidden_variables.st_malformed_received);
+-
+-				if (st->hidden_variables.st_malformed_sent >
+-				    MAXIMUM_MALFORMED_NOTIFY / 2 &&
+-				    ((st->hidden_variables.st_malformed_sent +
+-				      st->hidden_variables.
+-				      st_malformed_received) >
+-				     MAXIMUM_MALFORMED_NOTIFY)) {
+-					libreswan_log(
+-						"too many malformed payloads (we sent %u and received %u",
+-						st->hidden_variables.st_malformed_sent,
+-						st->hidden_variables.st_malformed_received);
+-					delete_state(st);
+-					md->st = st = NULL;
+-				}
+-			}
+-
++			libreswan_log("received PAYLOAD_MALFORMED");
+ 			return STF_IGNORE;
+ 
+ 		case ISAKMP_N_CISCO_LOAD_BALANCE:
diff --git a/SOURCES/libreswan-3.23-zerolengthkey.patch b/SOURCES/libreswan-3.23-zerolengthkey.patch
new file mode 100644
index 0000000..5daebae
--- /dev/null
+++ b/SOURCES/libreswan-3.23-zerolengthkey.patch
@@ -0,0 +1,18 @@
+diff -Naur libreswan-3.25-orig/programs/pluto/ikev1_spdb_struct.c libreswan-3.25/programs/pluto/ikev1_spdb_struct.c
+--- libreswan-3.25-orig/programs/pluto/ikev1_spdb_struct.c	2018-06-27 22:42:26.000000000 +0700
++++ libreswan-3.25/programs/pluto/ikev1_spdb_struct.c	2018-11-22 20:29:34.034626926 +0700
+@@ -1053,10 +1053,11 @@
+ 				loglog(RC_LOG_SERIOUS,
+ 				       "You should NOT use insecure/broken IKE algorithms (%s)!",
+ 				       ta->ta_encrypt->common.fqn);
++			} else {
++				DBG(DBG_CONTROL,
++					DBG_log("OAKLEY proposal verified; matching alg_info found"));
++				return true;
+ 			}
+-			DBG(DBG_CONTROL,
+-			    DBG_log("OAKLEY proposal verified; matching alg_info found"));
+-			return true;
+ 		}
+ 	}
+ 	libreswan_log("Oakley Transform [%s (%d), %s, %s] refused%s",
diff --git a/SOURCES/libreswan-3.25-1625303-recursive-incl.patch b/SOURCES/libreswan-3.25-1625303-recursive-incl.patch
new file mode 100644
index 0000000..bd68345
--- /dev/null
+++ b/SOURCES/libreswan-3.25-1625303-recursive-incl.patch
@@ -0,0 +1,19 @@
+commit b257545675ae4564d866758eb3ef4230d7c1ede2
+Author: D. Hugh Redelmeier <hugh@mimosa.com>
+Date:   Tue Sep 25 17:14:36 2018 -0400
+
+    libipsecconf: fix off-by-one in config file "include" handling
+
+diff --git a/lib/libipsecconf/parser.l b/lib/libipsecconf/parser.l
+index cc2faf5c9..aad2fc9b2 100644
+--- a/lib/libipsecconf/parser.l
++++ b/lib/libipsecconf/parser.l
+@@ -260,7 +260,7 @@ int parser_y_include (const char *filename)
+ 	case 0:
+ 		/* success */
+ 
+-		if (ic_private.stack_ptr >= MAX_INCLUDE_DEPTH) {
++		if (ic_private.stack_ptr >= MAX_INCLUDE_DEPTH - 1) {
+ 			yyerror("max inclusion depth reached");
+ 			return 1;
+ 		}
diff --git a/SOURCES/libreswan-3.25-1664244-xauth-null-pwd.patch b/SOURCES/libreswan-3.25-1664244-xauth-null-pwd.patch
new file mode 100644
index 0000000..b9b3598
--- /dev/null
+++ b/SOURCES/libreswan-3.25-1664244-xauth-null-pwd.patch
@@ -0,0 +1,47 @@
+diff -Naur libreswan-3.25-orig/include/chunk.h libreswan-3.25/include/chunk.h
+--- libreswan-3.25-orig/include/chunk.h	2018-06-27 11:42:26.000000000 -0400
++++ libreswan-3.25/include/chunk.h	2018-12-14 13:30:29.269684194 -0500
+@@ -55,6 +55,9 @@
+ 
+ chunk_t clone_chunk(chunk_t old, const char *name);
+ 
++/* always NUL terminated; NULL is NULL */
++char *clone_chunk_as_string(chunk_t chunk, const char *name);
++
+ /* note: the caller must free the result */
+ char *str_from_chunk(chunk_t c, const char *name);
+ 
+diff -Naur libreswan-3.25-orig/lib/libswan/chunk.c libreswan-3.25/lib/libswan/chunk.c
+--- libreswan-3.25-orig/lib/libswan/chunk.c	2018-06-27 11:42:26.000000000 -0400
++++ libreswan-3.25/lib/libswan/chunk.c	2018-12-14 13:29:24.077050581 -0500
+@@ -49,3 +49,16 @@
+ 	s[c.len] = '\0';	/* redundant */
+ 	return s;
+ }
++
++char *clone_chunk_as_string(chunk_t chunk, const char *name)
++{
++	if (chunk.ptr == NULL) {
++		return NULL;
++	} else if (chunk.len > 0 && chunk.ptr[chunk.len - 1] == '\0') {
++		return clone_bytes(chunk.ptr, chunk.len, name);
++	} else {
++		char *string = alloc_things(char, chunk.len + 1, name);
++		memcpy(string, chunk.ptr, chunk.len);
++		return string;
++	}
++}
+diff -Naur libreswan-3.25-orig/programs/pluto/ikev1_xauth.c libreswan-3.25/programs/pluto/ikev1_xauth.c
+--- libreswan-3.25-orig/programs/pluto/ikev1_xauth.c	2018-06-27 11:42:26.000000000 -0400
++++ libreswan-3.25/programs/pluto/ikev1_xauth.c	2018-12-14 13:29:24.078050590 -0500
+@@ -1214,8 +1214,8 @@
+ 		return 0;
+ #endif
+ 
+-	char *arg_name = str_from_chunk(*name, "XAUTH Name");
+-	char *arg_password = str_from_chunk(*password, "XAUTH Name");
++	char *arg_name = clone_chunk_as_string(*name, "XAUTH Name");
++	char *arg_password = clone_chunk_as_string(*password, "XAUTH Name");
+ 
+ 	/*
+ 	 * For XAUTH, we're flipping between retransmitting the packet
diff --git a/SOURCES/libreswan-3.25-1664521-fips-keysize.patch b/SOURCES/libreswan-3.25-1664521-fips-keysize.patch
new file mode 100644
index 0000000..e382f8c
--- /dev/null
+++ b/SOURCES/libreswan-3.25-1664521-fips-keysize.patch
@@ -0,0 +1,35 @@
+diff --git a/programs/pluto/connections.c b/programs/pluto/connections.c
+index 45e5bee1f..db1ac5303 100644
+--- a/programs/pluto/connections.c
++++ b/programs/pluto/connections.c
+@@ -846,9 +846,10 @@ static void load_end_nss_certificate(const char *which, CERTCertificate *cert,
+ 	if (libreswan_fipsmode()) {
+ 		SECKEYPublicKey *pk = CERT_ExtractPublicKey(cert);
+ 		passert(pk != NULL);
+-		if (pk->u.rsa.modulus.len < FIPS_MIN_RSA_KEY_SIZE) {
++		if (pk->u.rsa.modulus.len * BITS_PER_BYTE < FIPS_MIN_RSA_KEY_SIZE) {
+ 			whack_log(RC_FATAL,
+-				"FIPS: Rejecting cert with key size under %d",
++				"FIPS: Rejecting cert with key size %d which is under %d",
++				pk->u.rsa.modulus.len * BITS_PER_BYTE,
+ 				FIPS_MIN_RSA_KEY_SIZE);
+ 			SECKEY_DestroyPublicKey(pk);
+ 			return;
+diff --git a/programs/pluto/nss_cert_verify.c b/programs/pluto/nss_cert_verify.c
+index b4de167bb..9b031354b 100644
+--- a/programs/pluto/nss_cert_verify.c
++++ b/programs/pluto/nss_cert_verify.c
+@@ -460,9 +460,10 @@ static bool import_der_cert(CERTCertDBHandle *handle,
+ 	if (libreswan_fipsmode()) {
+ 		SECKEYPublicKey *pk = CERT_ExtractPublicKey(cert);
+ 		passert(pk != NULL);
+-		if (pk->u.rsa.modulus.len < FIPS_MIN_RSA_KEY_SIZE) {
+-			libreswan_log("FIPS: Rejecting cert with key size under %d",
+-				      FIPS_MIN_RSA_KEY_SIZE);
++		if ((pk->u.rsa.modulus.len * BITS_PER_BYTE) < FIPS_MIN_RSA_KEY_SIZE) {
++			libreswan_log("FIPS: Rejecting peer cert with key size %d under %d",
++					pk->u.rsa.modulus.len * BITS_PER_BYTE,
++					FIPS_MIN_RSA_KEY_SIZE);
+ 			SECKEY_DestroyPublicKey(pk);
+ 			/*
+ 			 * XXX: Since the certificate isn't added to
diff --git a/SOURCES/libreswan-3.25-1673105-down-restart.patch b/SOURCES/libreswan-3.25-1673105-down-restart.patch
new file mode 100644
index 0000000..1aa295b
--- /dev/null
+++ b/SOURCES/libreswan-3.25-1673105-down-restart.patch
@@ -0,0 +1,455 @@
+diff -Naur libreswan-3.25-orig/include/pluto_constants.h libreswan-3.25/include/pluto_constants.h
+--- libreswan-3.25-orig/include/pluto_constants.h	2019-05-02 10:54:07.265614654 -0400
++++ libreswan-3.25/include/pluto_constants.h	2019-05-02 10:55:42.634626504 -0400
+@@ -152,6 +152,7 @@
+ 	EVENT_SD_WATCHDOG,		/* update systemd's watchdog interval */
+ 	EVENT_PENDING_PHASE2,		/* do not make pending phase2 wait forever */
+ 	EVENT_CHECK_CRLS,		/* check/update CRLS */
++	EVENT_REVIVE_CONNS,
+ 
+ 	/* events associated with states */
+ 
+@@ -203,6 +204,9 @@
+ #define EVENT_CRYPTO_TIMEOUT_DELAY	RETRANSMIT_TIMEOUT_DEFAULT /* wait till the other side give up on us */
+ #define EVENT_PAM_TIMEOUT_DELAY		RETRANSMIT_TIMEOUT_DEFAULT /* wait until this side give up on PAM */
+ 
++#define REVIVE_CONN_DELAY      5 /* seconds */
++#define REVIVE_CONN_DELAY_MAX  300 /* Do not delay more than 5 minutes per attempt */
++
+ /*
+  * operational importance of this cryptographic operation.
+  * this determines if the operation will be dropped (because the other
+diff -Naur libreswan-3.25-orig/programs/pluto/connections.c libreswan-3.25/programs/pluto/connections.c
+--- libreswan-3.25-orig/programs/pluto/connections.c	2019-05-02 10:54:07.265614654 -0400
++++ libreswan-3.25/programs/pluto/connections.c	2019-05-02 10:55:42.635626515 -0400
+@@ -4629,3 +4629,28 @@
+ 		c->name, prio));
+ 	return prio;
+ }
++
++/*
++ * If the connection contains a newer SA, return it.
++ */
++so_serial_t get_newer_sa_from_connection(struct state *st)
++{
++	struct connection *c = st->st_connection;
++	so_serial_t newest;
++
++	if (IS_IKE_SA(st)) {
++		newest = c->newest_isakmp_sa;
++		DBG(DBG_CONTROL, DBG_log("picked newest_isakmp_sa #%lu for #%lu",
++			newest, st->st_serialno));
++        } else {
++                newest = c->newest_ipsec_sa;
++                DBG(DBG_CONTROL, DBG_log("picked newest_ipsec_sa #%lu for #%lu",
++                    newest, st->st_serialno));
++        }
++
++        if (newest != SOS_NOBODY && newest > st->st_serialno) {
++                return newest;
++        } else {
++                return SOS_NOBODY;
++        }
++}
+diff -Naur libreswan-3.25-orig/programs/pluto/connections.h libreswan-3.25/programs/pluto/connections.h
+--- libreswan-3.25-orig/programs/pluto/connections.h	2018-06-27 11:42:26.000000000 -0400
++++ libreswan-3.25/programs/pluto/connections.h	2019-05-02 10:57:22.626689082 -0400
+@@ -343,6 +343,7 @@
+ 	u_int32_t statsval;	/* track what we have told statsd */
+ 	u_int16_t nflog_group;	/* NFLOG group - 0 means disabled  */
+ 	msgid_t ike_window;     /* IKE v2 window size 7296#section-2.3 */
++	int revive_delay;
+ };
+ 
+ extern void parse_mark_mask(const struct connection* c,int * mark, int * mask);
+@@ -385,7 +386,7 @@
+ 			     struct xfrm_user_sec_ctx_ike *uctx,
+ #endif
+ 			     err_t why);
+-extern void terminate_connection(const char *name);
++extern void terminate_connection(const char *name, bool quiet);
+ extern void release_connection(struct connection *c, bool relations);
+ extern void delete_connection(struct connection *c, bool relations);
+ extern void suppress_delete(struct connection *c);
+@@ -539,3 +540,8 @@
+ extern bool idr_wildmatch(const struct connection *c, const struct id *b);
+ 
+ extern uint32_t calculate_sa_prio(const struct connection *c);
++
++so_serial_t get_newer_sa_from_connection(struct state *st);
++
++extern void flush_revival(const struct connection *c);
++
+diff -Naur libreswan-3.25-orig/programs/pluto/hostpair.c libreswan-3.25/programs/pluto/hostpair.c
+--- libreswan-3.25-orig/programs/pluto/hostpair.c	2018-06-27 11:42:26.000000000 -0400
++++ libreswan-3.25/programs/pluto/hostpair.c	2019-05-02 10:55:42.635626515 -0400
+@@ -274,7 +274,7 @@
+ 					 */
+ 					passert(p == *pp);
+ 
+-					terminate_connection(p->name);
++					terminate_connection(p->name, FALSE);
+ 					p->interface = NULL; /* withdraw orientation */
+ 
+ 					*pp = p->hp_next; /* advance *pp */
+diff -Naur libreswan-3.25-orig/programs/pluto/initiate.c libreswan-3.25/programs/pluto/initiate.c
+--- libreswan-3.25-orig/programs/pluto/initiate.c	2018-06-27 11:42:26.000000000 -0400
++++ libreswan-3.25/programs/pluto/initiate.c	2019-05-02 10:55:42.640626568 -0400
+@@ -148,7 +148,7 @@
+ 								c->interface->ip_dev->id_rname,
+ 								p->ip_dev->id_rname);
+ 							}
+-						terminate_connection(c->name);
++						terminate_connection(c->name, FALSE);
+ 						c->interface = NULL; /* withdraw orientation */
+ 						return FALSE;
+ 					}
+@@ -401,7 +401,7 @@
+ 		{
+ 			/* This might delete c if CK_INSTANCE */
+ 			/* ??? is there a chance hp becomes dangling? */
+-			terminate_connection(d->name);
++			terminate_connection(d->name, FALSE);
+ 		}
+ 		d = next;
+ 	}
+@@ -750,6 +750,12 @@
+ 				    fmt_conn_instance(c, cib));
+ 		    });
+ 
++		if (sr->routing == RT_ROUTED_PROSPECTIVE && eclipsable(sr)) {
++			DBG(DBG_CONTROL, DBG_log("route is eclipsed"));
++			sr->routing = RT_ROUTED_ECLIPSED;
++			eclipse_count++;
++		}
++
+ 		idtoa(&sr->this.id, mycredentialstr, sizeof(mycredentialstr));
+ 
+ 		passert(c->policy & POLICY_OPPORTUNISTIC); /* can't initiate Road Warrior connections */
+diff -Naur libreswan-3.25-orig/programs/pluto/kernel.c libreswan-3.25/programs/pluto/kernel.c
+--- libreswan-3.25-orig/programs/pluto/kernel.c	2018-06-27 11:42:26.000000000 -0400
++++ libreswan-3.25/programs/pluto/kernel.c	2019-05-02 10:55:42.640626568 -0400
+@@ -982,22 +982,11 @@
+ 	if (ro != NULL && !routes_agree(ro, c)) {
+ 		char cib[CONN_INST_BUF];
+ 		loglog(RC_LOG_SERIOUS,
+-			"cannot route -- route already in use for \"%s\"%s",
++			"cannot route -- route already in use for \"%s\"%s - but allowing anyway",
+ 			ro->name, fmt_conn_instance(ro, cib));
+-		/*
+-		 * We ignore this if the stack supports overlapping, and this
+-		 * connection was marked that overlapping is OK.  Below we will
+-		 * check the other eroute, ero.
+-		 */
+-		if (!compatible_overlapping_connections(c, ero)) {
+-			/*
+-			 * Another connection is already using the eroute.
+-			 * TODO: NETKEY can do this?
+-			 */
+-			return route_impossible;
+-		}
+ 	}
+ 
++
+ 	/* if there is an eroute for another connection, there is a problem */
+ 	if (ero != NULL && ero != c) {
+ 		/*
+@@ -3080,7 +3069,8 @@
+ 		/* record unrouting */
+ 		if (route_installed) {
+ 			do {
+-				passert(!erouted(rosr->routing));
++				 DBG(DBG_CONTROL,
++					DBG_log("ro name=%s, rosr->routing=%d", ro->name, rosr->routing));
+ 				rosr->routing = RT_UNROUTED;
+ 
+ 				/* no need to keep old value */
+@@ -3292,6 +3282,14 @@
+ 		DBG(DBG_KERNEL,
+ 			DBG_log("set up incoming SA, ref=%u/%u", st->st_ref,
+ 				st->st_refhim));
++
++		/*
++		 * We successfully installed an IPsec SA, meaning it is safe
++		 * to clear our revival back-off delay. This is based on the
++		 * assumption that an unwilling partner might complete an IKE
++		 * SA to us, but won't complete an IPsec SA to us.
++		 */
++		st->st_connection->revive_delay = 0;
+ 	}
+ 
+ 	if (rb == route_unnecessary)
+diff -Naur libreswan-3.25-orig/programs/pluto/kernel.h libreswan-3.25/programs/pluto/kernel.h
+--- libreswan-3.25-orig/programs/pluto/kernel.h	2018-06-27 11:42:26.000000000 -0400
++++ libreswan-3.25/programs/pluto/kernel.h	2019-05-02 10:55:42.640626568 -0400
+@@ -421,14 +421,6 @@
+ #endif
+ 			      );
+ 
+-static inline bool compatible_overlapping_connections(const struct connection *a,
+-						      const struct connection *b)
+-{
+-	return kernel_ops->overlap_supported &&
+-	       a != NULL && b != NULL &&
+-	       a != b &&
+-	       LIN(POLICY_OVERLAPIP, a->policy & b->policy);
+-}
+ 
+ #ifdef KLIPS
+ extern const struct kernel_ops klips_kernel_ops;
+diff -Naur libreswan-3.25-orig/programs/pluto/pluto_constants.c libreswan-3.25/programs/pluto/pluto_constants.c
+--- libreswan-3.25-orig/programs/pluto/pluto_constants.c	2018-06-27 11:42:26.000000000 -0400
++++ libreswan-3.25/programs/pluto/pluto_constants.c	2019-05-02 10:55:42.636626526 -0400
+@@ -121,6 +121,7 @@
+ 	"EVENT_SD_WATCHDOG",
+ 	"EVENT_PENDING_PHASE2",
+ 	"EVENT_CHECK_CRLS",
++	"EVENT_REVIVE_CONNS",
+ 
+ 	"EVENT_SO_DISCARD",
+ 	"EVENT_v1_RETRANSMIT",
+diff -Naur libreswan-3.25-orig/programs/pluto/rcv_whack.c libreswan-3.25/programs/pluto/rcv_whack.c
+--- libreswan-3.25-orig/programs/pluto/rcv_whack.c	2018-06-27 11:42:26.000000000 -0400
++++ libreswan-3.25/programs/pluto/rcv_whack.c	2019-05-02 10:55:42.636626526 -0400
+@@ -380,8 +380,14 @@
+ 	 * To make this more useful, in only this combination,
+ 	 * delete will silently ignore the lack of the connection.
+ 	 */
+-	if (m->whack_delete)
+-		delete_connections_by_name(m->name, !m->whack_connection);
++	if (m->whack_delete) {
++		if (m->name == NULL) {
++			whack_log(RC_FATAL, "received whack command to delete a connection, but did not receive the connection name - ignored"); 
++		} else {
++			terminate_connection(m->name, TRUE);
++			delete_connections_by_name(m->name, !m->whack_connection);
++		}
++	}
+ 
+ 	if (m->whack_deleteuser) {
+ 		DBG_log("received whack to delete connection by user %s",
+@@ -573,7 +579,7 @@
+ 	}
+ 
+ 	if (m->whack_terminate)
+-		terminate_connection(m->name);
++		terminate_connection(m->name, TRUE);
+ 
+ 	if (m->whack_status)
+ 		show_status();
+diff -Naur libreswan-3.25-orig/programs/pluto/state.c libreswan-3.25/programs/pluto/state.c
+--- libreswan-3.25-orig/programs/pluto/state.c	2019-05-02 10:54:07.252614517 -0400
++++ libreswan-3.25/programs/pluto/state.c	2019-05-02 10:56:28.447113336 -0400
+@@ -77,6 +77,8 @@
+ #include "crypt_dh.h"
+ #include "hostpair.h"
+ 
++#include "kernel.h"
++
+ #include <nss.h>
+ #include <pk11pub.h>
+ #include <keyhi.h>
+@@ -128,6 +130,115 @@
+ 	[STATE_UNDEFINED] = &state_undefined,
+ };
+ 
++/*
++ * Revival mechanism: keep track of connections
++ * that should be kept up, even though all their
++ * states have been deleted.
++ *
++ * We record the connection names.
++ * Each name is recorded only once.
++ *
++ * XXX: This functionality totally overlaps both "initiate" and
++ * "pending" and should be merged (howerver, this simple code might
++ * prove to be a better starting point).
++ */
++
++struct revival {
++	char *name;
++	struct revival *next;
++};
++
++static struct revival *revivals = NULL;
++
++/*
++ * XXX: Return connection C's revival object's link, if found.  If the
++ * connection C can't be found, then the address of the revival list's
++ * tail is returned.  Perhaps, exiting the loop and returning NULL
++ * would be more obvious.
++ */
++static struct revival **find_revival(const struct connection *c)
++{
++	for (struct revival **rp = &revivals; ; rp = &(*rp)->next) {
++		if (*rp == NULL || streq((*rp)->name, c->name)) {
++			return rp;
++		}
++	}
++}
++
++/*
++ * XXX: In addition to freeing RP (and killing the pointer), this
++ * "free" function has the side effect of unlinks RP from the revival
++ * list.  Perhaps free*() isn't the best name.
++ */
++static void free_revival(struct revival **rp)
++{
++	struct revival *r = *rp;
++	*rp = r->next;
++	pfree(r->name);
++	pfree(r);
++}
++
++void flush_revival(const struct connection *c)
++{
++	struct revival **rp = find_revival(c);
++
++	if (*rp == NULL) {
++		DBG(DBG_CONTROL, DBG_log("flush revival: connection '%s' wasn't on the list",
++		    c->name));
++	} else {
++		DBG(DBG_CONTROL, DBG_log("flush revival: connection '%s' revival flushed",
++		    c->name));
++		free_revival(rp);
++	}
++}
++
++static void add_revival(struct connection *c)
++{
++	if (*find_revival(c) == NULL) {
++		struct revival *r = alloc_thing(struct revival,
++						"revival struct");
++
++		r->name = clone_str(c->name, "revival conn name");
++		r->next = revivals;
++		revivals = r;
++		int delay = c->revive_delay;
++		DBG(DBG_CONTROL, DBG_log("add revival: connection '%s' added to the list and scheduled for %d seconds",
++		    c->name, delay));
++		c->revive_delay = min(delay + REVIVE_CONN_DELAY,
++						REVIVE_CONN_DELAY_MAX);
++		/*
++		 * XXX: Schedule the next revival using this
++		 * connection's revival delay and not the most urgent
++		 * connection's revival delay.  Trying to fix this
++		 * here just is annoying and probably of marginal
++		 * benefit: it is something better handled with a
++		 * proper connection event so that the event loop deal
++		 * with all the math (this code would then be
++		 * deleted); and would encroach even further on
++		 * "initiate" and "pending" functionality.
++		 */
++		event_schedule(EVENT_REVIVE_CONNS, deltatime(delay), NULL);
++	}
++}
++
++void revive_conns(void)
++{
++	/*
++	 * XXX: Revive all listed connections regardless of their
++	 * DELAY.  See note above in add_revival().
++	 */
++	while (revivals != NULL) {
++		libreswan_log("Initiating connection %s which received a Delete/Notify but must remain up per local policy",
++			revivals->name);
++		initiate_connection(revivals->name, NULL_FD, empty_lmod, empty_lmod, pcim_demand_crypto, NULL);
++		free_revival(&revivals);
++	}
++}
++
++/* end of revival mechanism */
++
++
++
+ void lswlog_finite_state(struct lswlog *buf, const struct finite_state *fs)
+ {
+ 	if (fs == NULL) {
+@@ -1156,6 +1267,23 @@
+ 	if (c->newest_isakmp_sa == st->st_serialno)
+ 		c->newest_isakmp_sa = SOS_NOBODY;
+ 
++	if ((c->policy & POLICY_UP) && IS_IKE_SA(st)) {
++		so_serial_t newer_sa = get_newer_sa_from_connection(st);
++
++		if (state_by_serialno(newer_sa) != NULL) {
++			/*
++			 * Presumably this is an old state that has
++			 * either been rekeyed or replaced.
++			 */
++			DBG(DBG_CONTROL, DBG_log("IKE delete_state() for #%lu and connection '%s' that is supposed to remain up;  not a problem - have newer #%lu",
++                            st->st_serialno, c->name, newer_sa));
++		} else {
++			libreswan_log("deleting IKE SA for connection '%s' but connection is supposed to remain up; schedule EVENT_REVIVE_CONNS",
++				c->name);
++			add_revival(c);
++		}
++	}
++
+ 	/*
+ 	 * fake a state change here while we are still associated with a
+ 	 * connection.  Without this the state logging (when enabled) cannot
+diff -Naur libreswan-3.25-orig/programs/pluto/state.h libreswan-3.25/programs/pluto/state.h
+--- libreswan-3.25-orig/programs/pluto/state.h	2018-06-27 11:42:26.000000000 -0400
++++ libreswan-3.25/programs/pluto/state.h	2019-05-02 10:55:42.638626547 -0400
+@@ -809,5 +809,5 @@
+ 
+ extern bool uniqueIDs;  /* --uniqueids? */
+ extern void ISAKMP_SA_established(const struct state *pst);
+-
++extern void revive_conns(void);
+ #endif /* _STATE_H */
+diff -Naur libreswan-3.25-orig/programs/pluto/terminate.c libreswan-3.25/programs/pluto/terminate.c
+--- libreswan-3.25-orig/programs/pluto/terminate.c	2018-06-27 11:42:26.000000000 -0400
++++ libreswan-3.25/programs/pluto/terminate.c	2019-05-02 10:55:42.638626547 -0400
+@@ -90,7 +90,7 @@
+ 	return 1;
+ }
+ 
+-void terminate_connection(const char *name)
++void terminate_connection(const char *name, bool quiet)
+ {
+ 	/*
+ 	 * Loop because more than one may match (master and instances)
+@@ -112,7 +112,8 @@
+ 	} else {
+ 		int count = foreach_connection_by_alias(name, terminate_a_connection, NULL);
+ 		if (count == 0) {
+-			loglog(RC_UNKNOWN_NAME,
++			if (!quiet)
++				loglog(RC_UNKNOWN_NAME,
+ 				  "no such connection or aliased connection named \"%s\"", name);
+ 		} else {
+ 			loglog(RC_COMMENT, "terminated %d connections from aliased connection \"%s\"",
+diff -Naur libreswan-3.25-orig/programs/pluto/timer.c libreswan-3.25/programs/pluto/timer.c
+--- libreswan-3.25-orig/programs/pluto/timer.c	2018-06-27 11:42:26.000000000 -0400
++++ libreswan-3.25/programs/pluto/timer.c	2019-05-02 10:55:42.638626547 -0400
+@@ -334,6 +334,7 @@
+ 	case EVENT_SD_WATCHDOG:
+ 	case EVENT_NAT_T_KEEPALIVE:
+ 	case EVENT_CHECK_CRLS:
++	case EVENT_REVIVE_CONNS:
+ 		passert(st == NULL);
+ 		break;
+ 
+@@ -435,6 +436,10 @@
+ 		check_crls();
+ 		break;
+ 
++	case EVENT_REVIVE_CONNS:
++		revive_conns();
++		break;
++
+ 	case EVENT_v2_RELEASE_WHACK:
+ 		DBG(DBG_CONTROL, DBG_log("%s releasing whack for #%lu %s (sock=%d)",
+ 					enum_show(&timer_event_names, type),
+diff -Naur libreswan-3.25-orig/programs/pluto/timer.h libreswan-3.25/programs/pluto/timer.h
+--- libreswan-3.25-orig/programs/pluto/timer.h	2018-06-27 11:42:26.000000000 -0400
++++ libreswan-3.25/programs/pluto/timer.h	2019-05-02 10:55:42.638626547 -0400
+@@ -47,4 +47,6 @@
+ #define delete_dpd_event(ST) delete_state_event((ST), &(ST)->st_dpd_event)
+ 
+ extern void timer_list(void);
++extern char *revive_conn;
++
+ #endif /* _TIMER_H */
diff --git a/SOURCES/libreswan-3.25-1679735-critical_flag.patch b/SOURCES/libreswan-3.25-1679735-critical_flag.patch
new file mode 100644
index 0000000..9371c31
--- /dev/null
+++ b/SOURCES/libreswan-3.25-1679735-critical_flag.patch
@@ -0,0 +1,86 @@
+diff -Naur libreswan-3.25-orig/programs/pluto/nss_cert_verify.c libreswan-3.25/programs/pluto/nss_cert_verify.c
+--- libreswan-3.25-orig/programs/pluto/nss_cert_verify.c	2019-04-11 12:50:35.423733161 +0200
++++ libreswan-3.25/programs/pluto/nss_cert_verify.c	2019-04-11 12:51:58.832735953 +0200
+@@ -121,7 +121,7 @@
+ 	return FALSE;
+ }
+ 
+-static int nss_err_to_revfail(CERTVerifyLogNode *node)
++static int nss_err_to_revfail(char *prefix, CERTVerifyLogNode *node)
+ {
+ 	int ret = VERIFY_RET_FAIL;
+ 
+@@ -131,7 +131,7 @@
+ 
+ 	loglog(RC_LOG_SERIOUS, "Certificate %s failed verification",
+ 		    node->cert->subjectName);
+-	loglog(RC_LOG_SERIOUS, "ERROR: %s",
++	loglog(RC_LOG_SERIOUS, "%s: %s", prefix,
+ 		    nss_err_str(node->error));
+ 
+ 	if (node->error == SEC_ERROR_REVOKED_CERTIFICATE) {
+@@ -298,18 +298,18 @@
+ 	cvout[1].value.pointer.chain = NULL;
+ 	cvout[2].type = cert_po_end;
+ 
+-	int fin;
++	int fin = VERIFY_RET_FAIL;
+ 
+ #ifdef NSS_IPSEC_PROFILE
+ 	SECStatus rv = CERT_PKIXVerifyCert(end_cert, certificateUsageIPsec,
+ 						cvin, cvout, NULL);
+ 	if (rv != SECSuccess || cur_log->count > 0) {
+ 		if (cur_log->count > 0 && cur_log->head != NULL) {
+-			fin = nss_err_to_revfail(cur_log->head);
++			fin = nss_err_to_revfail("warning", cur_log->head);
+ 		} else {
+ 			/*
+ 			 * An rv != SECSuccess without CERTVerifyLog
+-			 * results should not * happen, but catch it anyway
++			 * results should not happen, but catch it anyway
+ 			 */
+ 			loglog(RC_LOG_SERIOUS, "X509: unspecified NSS verification failure");
+ 			fin = VERIFY_RET_FAIL;
+@@ -319,7 +319,11 @@
+ 		*end_out = end_cert;
+ 		fin = VERIFY_RET_OK;
+ 	}
+-#else
++#endif
++
++	if (fin != VERIFY_RET_OK)
++	{
++
+ 	/* kludge alert!!
+ 	 * verification may be performed twice: once with the
+ 	 * 'client' usage and once with 'server', which is an NSS
+@@ -332,7 +336,7 @@
+ 
+ 	for (usage = certificateUsageSSLClient; ; usage = certificateUsageSSLServer) {
+ 		SECStatus rv = CERT_PKIXVerifyCert(end_cert, usage, cvin, cvout, NULL);
+-		if (rv != SECSuccess || cur_log->count > 0) {
++		if (rv != SECSuccess) {
+ 			if (cur_log->count > 0 && cur_log->head != NULL) {
+ 				if (usage == certificateUsageSSLClient &&
+ 				    RETRYABLE_TYPE(cur_log->head->error)) {
+@@ -348,7 +352,8 @@
+ 					cvout[1].value.pointer.chain = NULL;
+ 					continue;
+ 				} else {
+-					fin = nss_err_to_revfail(cur_log->head);
++					fin = nss_err_to_revfail("ERROR", cur_log->head);
++					loglog(RC_LOG_SERIOUS, "X509: verification failure using NSS TLS profile validation");
+ 				}
+ 			} else {
+ 				/*
+@@ -365,7 +370,9 @@
+ 		}
+ 		break;
+ 	}
+-#endif
++
++	}
++
+ 	pexpect(fin != 0);
+ 
+ 	CERT_DestroyCertList(trustcl);
diff --git a/SOURCES/libreswan-3.25-1686991-ikev1-del.patch b/SOURCES/libreswan-3.25-1686991-ikev1-del.patch
new file mode 100644
index 0000000..d8d8933
--- /dev/null
+++ b/SOURCES/libreswan-3.25-1686991-ikev1-del.patch
@@ -0,0 +1,39 @@
+diff -Naur libreswan-3.25-orig/programs/pluto/ikev1_main.c libreswan-3.25/programs/pluto/ikev1_main.c
+--- libreswan-3.25-orig/programs/pluto/ikev1_main.c	2019-05-07 15:41:26.366181612 -0400
++++ libreswan-3.25/programs/pluto/ikev1_main.c	2019-05-07 15:45:41.780183599 -0400
+@@ -2727,30 +2727,11 @@
+ 					 * Useful if the other peer is
+ 					 * rebooting.
+ 					 */
+-					if (dst->st_event != NULL &&
+-					    dst->st_event->ev_type ==
+-						  EVENT_SA_REPLACE &&
+-					    !monobefore(monotimesum(mononow(),
+-						  deltatime(DELETE_SA_DELAY)),
+-						dst->st_event->ev_time)) {
+-						/*
+-						 * Patch from Angus Lees to
+-						 * ignore retransmitted
+-						 * Delete SA.
+-						 */
+-						loglog(RC_LOG_SERIOUS,
+-							"received Delete SA payload: already replacing IPSEC State #%lu in %ld seconds",
+-							dst->st_serialno,
+-							(long)deltasecs(monotimediff(
+-								dst->st_event->ev_time,
+-								mononow())));
+-					} else {
+-						loglog(RC_LOG_SERIOUS,
+-							"received Delete SA payload: replace IPSEC State #%lu now",
+-							dst->st_serialno);
+-						dst->st_margin = deltatime(0);
+-						event_force(EVENT_SA_REPLACE, dst);
+-					}
++					loglog(RC_LOG_SERIOUS,
++						"received Delete SA payload: replace IPSEC State #%lu now",
++						dst->st_serialno);
++					dst->st_margin = deltatime(0);
++					event_force(EVENT_SA_REPLACE, dst);
+ 				} else {
+ 					loglog(RC_LOG_SERIOUS,
+ 						"received Delete SA(0x%08" PRIx32 ") payload: deleting IPSEC State #%lu",
diff --git a/SOURCES/libreswan-3.25-1724200-halfopen-shunt.patch b/SOURCES/libreswan-3.25-1724200-halfopen-shunt.patch
new file mode 100644
index 0000000..839b7c3
--- /dev/null
+++ b/SOURCES/libreswan-3.25-1724200-halfopen-shunt.patch
@@ -0,0 +1,13 @@
+diff -Naur libreswan-3.25-orig/programs/pluto/state.c libreswan-3.25/programs/pluto/state.c
+--- libreswan-3.25-orig/programs/pluto/state.c	2019-07-03 15:52:47.246474906 -0400
++++ libreswan-3.25/programs/pluto/state.c	2019-07-03 15:54:37.671850020 -0400
+@@ -1101,7 +1101,8 @@
+ #endif
+ 
+ 	/* If we are failed OE initiator, make shunt bare */
+-	if (IS_IKE_SA(st) && (c->policy & POLICY_OPPORTUNISTIC) &&
++	if (IS_IKE_SA(st) && c->newest_isakmp_sa == st->st_serialno &&
++		(c->policy & POLICY_OPPORTUNISTIC) &&
+ 	    (st->st_state == STATE_PARENT_I1 || st->st_state == STATE_PARENT_I2)) {
+ 		ipsec_spi_t failure_shunt = shunt_policy_spi(c, FALSE /* failure_shunt */);
+ 		ipsec_spi_t nego_shunt = shunt_policy_spi(c, TRUE /* negotiation shunt */);
diff --git a/SOURCES/libreswan-3.25-EKU-1639404.patch b/SOURCES/libreswan-3.25-EKU-1639404.patch
new file mode 100644
index 0000000..7249f6c
--- /dev/null
+++ b/SOURCES/libreswan-3.25-EKU-1639404.patch
@@ -0,0 +1,108 @@
+diff --git a/lib/libswan/Makefile b/lib/libswan/Makefile
+index 510148ad1..0f5c26228 100644
+--- a/lib/libswan/Makefile
++++ b/lib/libswan/Makefile
+@@ -200,10 +200,6 @@ CFLAGS+=-I${LIBRESWANSRCDIR}/include ${PORTINCLUDE}
+ CFLAGS+=$(USERLAND_CFLAGS)
+ CFLAGS+=${CROSSFLAGS}
+ 
+-ifeq ($(NSS_REQ_AVA_COPY),true)
+-CFLAGS+=-DNSS_REQ_AVA_COPY
+-endif
+-
+ OBJS += $(abs_builddir)/version.o
+ 
+ include $(top_srcdir)/mk/library.mk
+diff --git a/mk/config.mk b/mk/config.mk
+index 3f2bd55c1..fcdabd1fb 100644
+--- a/mk/config.mk
++++ b/mk/config.mk
+@@ -242,6 +242,17 @@ NSPR_LDFLAGS ?= -lnspr4
+ # Use nss copy for CERT_CompareAVA
+ # See https://bugzilla.mozilla.org/show_bug.cgi?id=1336487
+ NSS_REQ_AVA_COPY?=true
++ifeq ($(NSS_REQ_AVA_COPY),true)
++NSSFLAGS+=-DNSS_REQ_AVA_COPY
++endif
++
++# Use nss IPsec profile for X509 validation. This is less restrictive
++# ok EKU's. This is not yet in upstream nss.
++# See https://bugzilla.mozilla.org/show_bug.cgi?id=1252891
++NSS_HAS_IPSEC_PROFILE?=false
++ifeq ($(NSS_HAS_IPSEC_PROFILE),true)
++NSSFLAGS+=-DNSS_IPSEC_PROFILE
++endif
+ 
+ # Use a local copy of xfrm.h. This can be needed on older systems
+ # that do not ship linux/xfrm.h, or when the shipped version is too
+diff --git a/programs/pluto/nss_cert_verify.c b/programs/pluto/nss_cert_verify.c
+index 95c637f53..7d458ac2a 100644
+--- a/programs/pluto/nss_cert_verify.c
++++ b/programs/pluto/nss_cert_verify.c
+@@ -299,6 +299,28 @@ static int vfy_chain_pkix(CERTCertificate **chain, int chain_len,
+ 	cvout[1].value.pointer.chain = NULL;
+ 	cvout[2].type = cert_po_end;
+ 
++	int fin;
++
++#ifdef NSS_IPSEC_PROFILE
++	SECStatus rv = CERT_PKIXVerifyCert(end_cert, certificateUsageIPsec,
++						cvin, cvout, NULL);
++	if (rv != SECSuccess || cur_log->count > 0) {
++		if (cur_log->count > 0 && cur_log->head != NULL) {
++			fin = nss_err_to_revfail(cur_log->head);
++		} else {
++			/*
++			 * An rv != SECSuccess without CERTVerifyLog
++			 * results should not * happen, but catch it anyway
++			 */
++			loglog(RC_LOG_SERIOUS, "X509: unspecified NSS verification failure");
++			fin = VERIFY_RET_FAIL;
++		}
++	} else {
++		DBG(DBG_X509, DBG_log("certificate is valid"));
++		*end_out = end_cert;
++		fin = VERIFY_RET_OK;
++	}
++#else
+ 	/* kludge alert!!
+ 	 * verification may be performed twice: once with the
+ 	 * 'client' usage and once with 'server', which is an NSS
+@@ -307,12 +329,10 @@ static int vfy_chain_pkix(CERTCertificate **chain, int chain_len,
+ 	 * KU/EKU combinations
+ 	 */
+ 
+-	int fin;
+ 	SECCertificateUsage usage;
+ 
+ 	for (usage = certificateUsageSSLClient; ; usage = certificateUsageSSLServer) {
+ 		SECStatus rv = CERT_PKIXVerifyCert(end_cert, usage, cvin, cvout, NULL);
+-
+ 		if (rv != SECSuccess || cur_log->count > 0) {
+ 			if (cur_log->count > 0 && cur_log->head != NULL) {
+ 				if (usage == certificateUsageSSLClient &&
+@@ -346,6 +366,7 @@ static int vfy_chain_pkix(CERTCertificate **chain, int chain_len,
+ 		}
+ 		break;
+ 	}
++#endif
+ 	pexpect(fin != 0);
+ 
+ 	CERT_DestroyCertList(trustcl);
+diff --git a/programs/pluto/plutomain.c b/programs/pluto/plutomain.c
+index 50582822d..007d73f45 100644
+--- a/programs/pluto/plutomain.c
++++ b/programs/pluto/plutomain.c
+@@ -180,6 +180,12 @@ static const char compile_time_interop_options[] = ""
+ 	" BROKEN_POPEN"
+ #endif
+ 	" NSS"
++#ifdef NSS_REQ_AVA_COPY
++	" (AVA copy)"
++#endif
++#ifdef NSS_IPSEC_PROFILE
++	" (IPsec profile)"
++#endif
+ #ifdef USE_DNSSEC
+ 	" DNSSEC"
+ #endif
diff --git a/SOURCES/libreswan-3.25-alg_info.patch b/SOURCES/libreswan-3.25-alg_info.patch
new file mode 100644
index 0000000..3e47c47
--- /dev/null
+++ b/SOURCES/libreswan-3.25-alg_info.patch
@@ -0,0 +1,13 @@
+diff --git a/lib/libswan/alg_info.c b/lib/libswan/alg_info.c
+index fd45e4991..ade54db06 100644
+--- a/lib/libswan/alg_info.c
++++ b/lib/libswan/alg_info.c
+@@ -426,7 +426,7 @@ static bool parser_alg_info_add(const struct proposal_parser *parser,
+ 	LSWDBGP(DBG_PROPOSAL_PARSER, buf) {
+ 		lswlogs(buf, "algs:");
+ 		for (struct token *token = tokens; token->alg.ptr != NULL; token++) {
+-			lswlogf(buf, " algs[%zu] = '"PRISHUNK"'",
++			lswlogf(buf, " algs[%tu] = '"PRISHUNK"'",
+ 				token - tokens, SHUNKF(token->alg));
+ 		}
+ 	}
diff --git a/SOURCES/libreswan-3.25-relax-delete.patch b/SOURCES/libreswan-3.25-relax-delete.patch
new file mode 100644
index 0000000..e5a0280
--- /dev/null
+++ b/SOURCES/libreswan-3.25-relax-delete.patch
@@ -0,0 +1,62 @@
+diff --git a/programs/pluto/state.c b/programs/pluto/state.c
+index 7b33145..a3bcc3c 100644
+--- a/programs/pluto/state.c
++++ b/programs/pluto/state.c
+@@ -3155,27 +3155,40 @@ void ISAKMP_SA_established(const struct state *pst)
+ 			d = next;
+ 		}
+ 
+-		if (c->newest_isakmp_sa != SOS_NOBODY &&
+-			c->newest_isakmp_sa != pst->st_serialno) {
+-				struct state *old_p1 = state_by_serialno(c->newest_isakmp_sa);
++		/*
++		 * This only affects IKEv2, since we don't store any
++		 * received INITIAL_CONTACT for IKEv1.
++		 * We don't do this on IKEv1, because it seems to
++		 * confuse various third parties (Windows, Cisco VPN 300,
++		 * and juniper
++		 * likely because this would be called before the IPsec SA
++		 * of QuickMode is installed, so the remote endpoints view
++		 * this IKE SA still as the active one?
++		 */
++		if (pst->st_seen_initialc) {
+ 
+-				DBG(DBG_CONTROL, DBG_log("deleting replaced IKE state for %s",
+-					old_p1->st_connection->name));
+-				old_p1->st_suppress_del_notify = TRUE;
+-				event_force(EVENT_SA_EXPIRE, old_p1);
+-		}
++			if (c->newest_isakmp_sa != SOS_NOBODY &&
++				c->newest_isakmp_sa != pst->st_serialno) {
++					struct state *old_p1 = state_by_serialno(c->newest_isakmp_sa);
+ 
+-		if (pst->st_seen_initialc && (c->newest_ipsec_sa != SOS_NOBODY))
+-		{
+-			struct state *old_p2 = state_by_serialno(c->newest_ipsec_sa);
+-			struct connection *d = old_p2 == NULL ? NULL : old_p2->st_connection;
++					DBG(DBG_CONTROL, DBG_log("deleting replaced IKE state for %s",
++						old_p1->st_connection->name));
++					old_p1->st_suppress_del_notify = TRUE;
++					event_force(EVENT_SA_EXPIRE, old_p1);
++			}
+ 
+-			if (c == d && same_id(&c->spd.that.id, &d->spd.that.id))
++			if (c->newest_ipsec_sa != SOS_NOBODY)
+ 			{
+-				DBG(DBG_CONTROL, DBG_log("Initial Contact received, deleting old state #%lu from connection '%s'",
+-					c->newest_ipsec_sa, c->name));
+-				old_p2->st_suppress_del_notify = TRUE;
+-				event_force(EVENT_SA_EXPIRE, old_p2);
++				struct state *old_p2 = state_by_serialno(c->newest_ipsec_sa);
++				struct connection *d = old_p2 == NULL ? NULL : old_p2->st_connection;
++
++				if (c == d && same_id(&c->spd.that.id, &d->spd.that.id))
++				{
++					DBG(DBG_CONTROL, DBG_log("Initial Contact received, deleting old state #%lu from connection '%s'",
++						c->newest_ipsec_sa, c->name));
++					old_p2->st_suppress_del_notify = TRUE;
++					event_force(EVENT_SA_EXPIRE, old_p2);
++				}
+ 			}
+ 		}
+ 
diff --git a/SOURCES/libreswan-3.27-1672921-delete.patch b/SOURCES/libreswan-3.27-1672921-delete.patch
new file mode 100644
index 0000000..87447ad
--- /dev/null
+++ b/SOURCES/libreswan-3.27-1672921-delete.patch
@@ -0,0 +1,82 @@
+diff -Naur libreswan-3.25-orig/include/pluto_constants.h libreswan-3.25/include/pluto_constants.h
+--- libreswan-3.25-orig/include/pluto_constants.h	2018-06-27 11:42:26.000000000 -0400
++++ libreswan-3.25/include/pluto_constants.h	2019-02-15 17:41:06.954865678 -0500
+@@ -436,6 +436,8 @@
+ 
+ 	IMPAIR_SEND_PKCS7_THINGIE_IX,		/* send certificates as a PKCS7 thingie */
+ 
++	IMPAIR_IKEv1_DEL_WITH_NOTIFY_IX,
++
+ 	IMPAIR_roof_IX	/* first unassigned IMPAIR */
+ };
+ 
+@@ -495,6 +497,7 @@
+ 
+ #define IMPAIR_SEND_PKCS7_THINGIE		LELEM(IMPAIR_SEND_PKCS7_THINGIE_IX)
+ 
++#define IMPAIR_IKEv1_DEL_WITH_NOTIFY   LELEM(IMPAIR_IKEv1_DEL_WITH_NOTIFY_IX)
+ /* State of exchanges
+  *
+  * The name of the state describes the last message sent, not the
+diff -Naur libreswan-3.25-orig/lib/libswan/impair.c libreswan-3.25/lib/libswan/impair.c
+--- libreswan-3.25-orig/lib/libswan/impair.c	2018-06-27 11:42:26.000000000 -0400
++++ libreswan-3.25/lib/libswan/impair.c	2019-02-15 17:41:06.954865678 -0500
+@@ -75,6 +75,8 @@
+ 	I(IMPAIR_ALLOW_DNS_INSECURE, "impair-allow-dns-insecure"),
+ 
+ 	I(IMPAIR_SEND_PKCS7_THINGIE, "impair-send-pkcs7-thingie"),
++
++	I(IMPAIR_IKEv1_DEL_WITH_NOTIFY, "impair-ikev1-del-with-notify"),
+ };
+ 
+ const enum_names impair_names = {
+diff -Naur libreswan-3.25-orig/programs/pluto/ikev1_main.c libreswan-3.25/programs/pluto/ikev1_main.c
+--- libreswan-3.25-orig/programs/pluto/ikev1_main.c	2018-06-27 11:42:26.000000000 -0400
++++ libreswan-3.25/programs/pluto/ikev1_main.c	2019-02-15 17:42:50.876885416 -0500
+@@ -2491,12 +2491,36 @@
+ 			isad.isad_protoid = ns->proto;
+ 
+ 			isad.isad_nospi = 1;
++
++			if (DBGP(IMPAIR_IKEv1_DEL_WITH_NOTIFY))
++				isad.isad_np = ISAKMP_NEXT_N; /* Notify */
++
+ 			passert(out_struct(&isad, &isakmp_delete_desc, &r_hdr_pbs,
+ 					   &del_pbs));
+ 			passert(out_raw(&ns->spi, sizeof(ipsec_spi_t),
+ 					&del_pbs,
+ 					"delete payload"));
+ 			close_output_pbs(&del_pbs);
++
++			if (DBGP(IMPAIR_IKEv1_DEL_WITH_NOTIFY)) {
++				pb_stream cruft_pbs;
++
++				libreswan_log("IMPAIR: adding bogus Notify payload after IKE Delete payload");
++				struct isakmp_notification isan = {
++					.isan_np = ISAKMP_NEXT_NONE,
++					.isan_doi = ISAKMP_DOI_IPSEC,
++					.isan_protoid = PROTO_ISAKMP,
++					.isan_spisize = COOKIE_SIZE * 2,
++					.isan_type = INVALID_PAYLOAD_TYPE,
++				};
++
++				passert(out_struct(&isan, &isakmp_notification_desc, &r_hdr_pbs,
++					&cruft_pbs));
++				passert(out_raw(&ns->spi, sizeof(ipsec_spi_t), &cruft_pbs,
++					"notify payload"));
++				close_output_pbs(&cruft_pbs);
++			}
++
+ 		}
+ 	}
+ 
+@@ -2743,7 +2767,9 @@
+ 					rc->policy &= ~POLICY_UP;
+ 					if (!shared_phase1_connection(rc)) {
+ 						flush_pending_by_connection(rc);
++						/* This also deletes the IKE SA, clear pointer  */
+ 						delete_states_by_connection(rc, FALSE);
++						md->st = NULL;
+ 					}
+ 					reset_cur_connection();
+ 				}
diff --git a/SPECS/libreswan.spec b/SPECS/libreswan.spec
new file mode 100644
index 0000000..b1bf760
--- /dev/null
+++ b/SPECS/libreswan.spec
@@ -0,0 +1,625 @@
+# These are rpm macros and are 0 or 1
+%global crl_fetching 1
+%global _hardened_build 1
+%global buildefence 0
+%global development 0
+%global cavstests 1
+
+# These are libreswan/make macros and are false or true
+%global USE_FIPSCHECK true
+%global USE_LIBCAP_NG true
+%global USE_LABELED_IPSEC true
+%global USE_DNSSEC true
+%global USE_NM true
+%global USE_LINUX_AUDIT true
+%global USE_SECCOMP true
+%global NSS_HAS_IPSEC_PROFILE true
+
+%if 0%{?fedora}
+%global rhel 7
+%endif
+
+#global prever dr1
+
+Name: libreswan
+Summary: IPsec implementation with IKEv1 and IKEv2 keying protocols
+Version: 3.25
+Release: %{?prever:0.}5%{?prever:.%{prever}}%{?dist}
+License: GPLv2
+Group: System Environment/Daemons
+Url: https://libreswan.org/
+Source: https://download.libreswan.org/%{?prever:development/}%{name}-%{version}%{?prever}.tar.gz
+Source1: ikev1_dsa.fax.bz2
+Source2: ikev1_psk.fax.bz2
+Source3: ikev2.fax.bz2
+
+Patch1: libreswan-3.25-alg_info.patch
+Patch2: libreswan-3.25-relax-delete.patch
+Patch3: libreswan-3.25-EKU-1639404.patch
+Patch4: libreswan-3.23-zerolengthkey.patch
+Patch5: libreswan-3.25-1625303-recursive-incl.patch
+Patch6: libreswan-3.23-del-with-notify-1630355.patch
+Patch7: libreswan-3.25-1664244-xauth-null-pwd.patch
+Patch8: libreswan-3.25-1664521-fips-keysize.patch
+Patch9: libreswan-3.27-1672921-delete.patch
+Patch10: libreswan-3.25-1679735-critical_flag.patch
+Patch11: libreswan-3.25-1673105-down-restart.patch
+Patch12: libreswan-3.25-1686991-ikev1-del.patch
+Patch13: libreswan-3.25-1724200-halfopen-shunt.patch
+
+Requires: iproute >= 2.6.8
+Requires: nss-tools nss-softokn
+
+BuildRequires: bison flex redhat-rpm-config pkgconfig
+BuildRequires: nspr-devel
+BuildRequires: pam-devel
+BuildRequires: xmlto
+# minimum nss version for IPsec profile support, see rhbz#1212132
+Requires: nss >= 3.36.0-7.1
+BuildRequires: nss-devel >= 3.36.0-7.1
+
+%if %{?rhel} <= 6
+BuildRequires: libevent2-devel net-tools
+
+Requires(post): coreutils bash
+Requires(preun): initscripts chkconfig
+Requires(post): /sbin/chkconfig
+Requires(preun): /sbin/chkconfig
+Requires(preun): /sbin/service
+%else
+BuildRequires: libevent-devel hostname
+
+BuildRequires: systemd-devel
+Requires(post): coreutils bash systemd
+Requires(preun): systemd
+Requires(postun): systemd
+%endif
+
+%if %{USE_DNSSEC}
+BuildRequires: ldns-devel
+Requires: unbound-libs >= 1.6.6
+BuildRequires: unbound-devel >= 1.6.6
+%endif
+
+%if %{USE_SECCOMP}
+BuildRequires: libseccomp-devel
+%endif
+
+%if %{USE_LABELED_IPSEC}
+BuildRequires: libselinux-devel
+%endif
+
+%if %{USE_FIPSCHECK}
+BuildRequires: fipscheck-devel
+# we need fipshmac
+Requires: fipscheck%{_isa}
+%endif
+
+%if %{USE_LINUX_AUDIT}
+Buildrequires: audit-libs-devel
+%endif
+
+%if %{USE_LIBCAP_NG}
+BuildRequires: libcap-ng-devel
+%endif
+
+%if %{crl_fetching}
+BuildRequires: openldap-devel curl-devel
+%endif
+
+%if %{buildefence}
+BuildRequires: ElectricFence
+%endif
+
+Conflicts: openswan < %{version}-%{release}
+Provides: openswan = %{version}-%{release}
+Provides: openswan-doc = %{version}-%{release}
+Obsoletes: openswan < %{version}-%{release}
+
+%description
+Libreswan is a free implementation of IPsec & IKE for Linux.  IPsec is
+the Internet Protocol Security and uses strong cryptography to provide
+both authentication and encryption services.  These services allow you
+to build secure tunnels through untrusted networks.  Everything passing
+through the untrusted net is encrypted by the ipsec gateway machine and
+decrypted by the gateway at the other end of the tunnel.  The resulting
+tunnel is a virtual private network or VPN.
+
+This package contains the daemons and userland tools for setting up
+Libreswan. It supports the NETKEY/XFRM IPsec kernel stack that exists
+in the default Linux kernel.
+
+Libreswan also supports IKEv2 (RFC-7296) and Secure Labeling
+
+Libreswan is based on Openswan-2.6.38 which in turn is based on FreeS/WAN-2.04
+
+%prep
+%setup -q -n libreswan-%{version}%{?prever}
+%patch1 -p1
+%patch2 -p1
+%patch3 -p1
+%patch4 -p1
+%patch5 -p1
+%patch6 -p1
+%patch7 -p1
+%patch8 -p1
+%patch9 -p1
+%patch10 -p1
+%patch11 -p1
+%patch12 -p1
+%patch13 -p1
+
+%build
+%if %{buildefence}
+ %define efence "-lefence"
+%endif
+
+make %{?_smp_mflags} \
+%if %{development}
+   USERCOMPILE="-g -DGCC_LINT %(echo %{optflags} | sed -e s/-O[0-9]*/ /) %{?efence} -fPIE -pie -fno-strict-aliasing -Wformat-nonliteral -Wformat-security" \
+%else
+  USERCOMPILE="-g -DGCC_LINT %{optflags} %{?efence} -fPIE -pie -fno-strict-aliasing -Wformat-nonliteral -Wformat-security" \
+%endif
+  USERLINK="-g -pie -Wl,-z,relro,-z,now %{?efence}" \
+  INC_USRLOCAL=%{_prefix} \
+  FINALLIBDIR=%{_libexecdir}/ipsec \
+  FINALLIBEXECDIR=%{_libexecdir}/ipsec \
+  FINALRUNDIR=%{_rundir}/pluto \
+  MANTREE=%{buildroot}%{_mandir} \
+  INC_RCDEFAULT=%{_initrddir} \
+%if %{?rhel} <= 6
+  INITSYSTEM=sysvinit \
+%else
+  INITSYSTEM=systemd \
+%endif
+  USE_NM=%{USE_NM} \
+  USE_XAUTHPAM=true \
+  USE_FIPSCHECK="%{USE_FIPSCHECK}" \
+  USE_LIBCAP_NG="%{USE_LIBCAP_NG}" \
+  USE_LABELED_IPSEC="%{USE_LABELED_IPSEC}" \
+  USE_LINUX_AUDIT="%{USE_LINUX_AUDIT}" \
+%if %{crl_fetching}
+  USE_LDAP=true \
+  USE_LIBCURL=true \
+%else
+  USE_LDAP=false \
+  USE_LIBCURL=false \
+%endif
+  USE_DNSSEC="%{USE_DNSSEC}" \
+  USE_SECCOMP="%{USE_SECCOMP}" \
+  NSS_HAS_IPSEC_PROFILE="%{NSS_HAS_IPSEC_PROFILE}" \
+  USE_DH22=true \
+  programs
+FS=$(pwd)
+
+%if %{USE_FIPSCHECK}
+# Add generation of HMAC checksums of the final stripped binaries
+%if %{?rhel} <= 6
+%define __spec_install_post \
+    %{?__debug_package:%{__debug_install_post}} \
+    %{__arch_install_post} \
+    %{__os_install_post} \
+    fipshmac %{buildroot}%{_libexecdir}/ipsec/pluto \
+%{nil}
+%else
+%define __spec_install_post \
+    %{?__debug_package:%{__debug_install_post}} \
+    %{__arch_install_post} \
+    %{__os_install_post} \
+    mkdir -p %{buildroot}%{_libdir}/fipscheck/ \
+    fipshmac -d %{buildroot}%{_libdir}/fipscheck %{buildroot}%{_libexecdir}/ipsec/pluto
+%{nil}
+%endif
+%endif
+
+%install
+make \
+  DESTDIR=%{buildroot} \
+  INC_USRLOCAL=%{_prefix} \
+  FINALLIBDIR=%{_libexecdir}/ipsec \
+  FINALLIBEXECDIR=%{_libexecdir}/ipsec \
+  FINALRUNDIR=%{_rundir}/pluto \
+  MANTREE=%{buildroot}%{_mandir} \
+  INC_RCDEFAULT=%{_initrddir} \
+%if %{?rhel} <= 6
+  INITSYSTEM=sysvinit \
+%else
+  INITSYSTEM=systemd \
+%endif
+  USE_NM=%{USE_NM} \
+  USE_XAUTHPAM=true \
+  USE_FIPSCHECK="%{USE_FIPSCHECK}" \
+  USE_LIBCAP_NG="%{USE_LIBCAP_NG}" \
+  USE_LABELED_IPSEC="%{USE_LABELED_IPSEC}" \
+  USE_LINUX_AUDIT="%{USE_LINUX_AUDIT}" \
+%if %{crl_fetching}
+  USE_LDAP=true \
+  USE_LIBCURL=true \
+%else
+  USE_LDAP=false \
+  USE_LIBCURL=false \
+%endif
+  USE_DNSSEC="%{USE_DNSSEC}" \
+  USE_SECCOMP="%{USE_SECCOMP}" \
+  NSS_HAS_IPSEC_PROFILE="%{NSS_HAS_IPSEC_PROFILE}" \
+  USE_DH22=true \
+  install
+FS=$(pwd)
+rm -rf %{buildroot}/usr/share/doc/libreswan
+sed -i "s:^#include /etc/ipsec.d/\*.conf$:include /etc/ipsec.d/*.conf:" %{buildroot}%{_sysconfdir}/ipsec.conf
+
+install -d -m 0755 %{buildroot}%{_localstatedir}/run/pluto
+# used when setting --perpeerlog without --perpeerlogbase
+install -d -m 0700 %{buildroot}%{_localstatedir}/log/pluto/peer
+install -d %{buildroot}%{_sbindir}
+%if %{?rhel} <= 6
+# replace with rhel6 specific version
+install -m 0755 initsystems/sysvinit/init.rhel %{buildroot}%{_initrddir}/ipsec
+rm -fr %{buildroot}/etc/rc.d/rc*
+%endif
+
+%if %{USE_FIPSCHECK}
+%if %{?rhel} == 7
+mkdir -p %{buildroot}%{_libdir}/fipscheck
+%endif
+install -d %{buildroot}%{_sysconfdir}/prelink.conf.d/
+install -m644 packaging/fedora/libreswan-prelink.conf %{buildroot}%{_sysconfdir}/prelink.conf.d/libreswan-fips.conf
+%endif
+
+echo "include /etc/ipsec.d/*.secrets" > %{buildroot}%{_sysconfdir}/ipsec.secrets
+
+%if %{cavstests}
+%check
+# There is an elaborate upstream testing infrastructure which we do not run here
+# We only run the CAVS tests here
+cp %{SOURCE1} %{SOURCE2} %{SOURCE3} .
+bunzip2 *.fax.bz2
+
+# work around for rhel6 builders on xen
+export NSS_DISABLE_HW_GCM=1
+
+: "starting CAVS test for IKEv2"
+%{buildroot}%{_libexecdir}/ipsec/cavp -v2 ikev2.fax | diff -u ikev2.fax - > /dev/null
+: "starting CAVS test for IKEv1 RSASIG"
+%{buildroot}%{_libexecdir}/ipsec/cavp -v1dsa ikev1_dsa.fax | diff -u ikev1_dsa.fax - > /dev/null
+: "starting CAVS test for IKEv1 PSK"
+%{buildroot}%{_libexecdir}/ipsec/cavp -v1psk ikev1_psk.fax | diff -u ikev1_psk.fax - > /dev/null
+: "CAVS tests passed"
+%endif
+
+%if %{?rhel} <= 6
+%post
+/sbin/chkconfig --add ipsec || :
+%if %{USE_FIPSCHECK}
+prelink -u %{_libexecdir}/ipsec/* 2>/dev/null || :
+%endif
+
+%preun
+if [ $1 -eq 0 ]; then
+    /sbin/service ipsec stop > /dev/null 2>&1 || :
+    /sbin/chkconfig --del ipsec
+fi
+
+%postun
+if [ $1 -ge 1 ] ; then
+     /sbin/service ipsec condrestart 2>&1 >/dev/null || :
+fi
+%else
+%preun
+%systemd_preun ipsec.service
+
+%postun
+%systemd_postun_with_restart ipsec.service
+
+%post
+%systemd_post ipsec.service
+%endif
+
+%files
+%doc CHANGES COPYING CREDITS README* LICENSE
+%doc docs/*.* docs/examples packaging/rhel/libreswan-sysctl.conf
+
+%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipsec.conf
+%attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ipsec.secrets
+%attr(0700,root,root) %dir %{_sysconfdir}/ipsec.d
+%attr(0700,root,root) %dir %{_sysconfdir}/ipsec.d/policies
+%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ipsec.d/policies/*
+%attr(0700,root,root) %dir %{_localstatedir}/log/pluto/peer
+%attr(0755,root,root) %dir %{_localstatedir}/run/pluto
+%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/pam.d/pluto
+%{_sbindir}/ipsec
+%attr(0755,root,root) %dir %{_libexecdir}/ipsec
+%{_libexecdir}/ipsec/*
+%attr(0644,root,root) %{_mandir}/*/*.gz
+%if %{?rhel} <= 6
+%{_initrddir}/ipsec
+%else
+%attr(0644,root,root) %{_unitdir}/ipsec.service
+%endif
+
+%if %{USE_FIPSCHECK}
+%if %{?rhel} <= 6
+%{_sbindir}/.ipsec.hmac
+%{_libexecdir}/ipsec/.*.hmac
+%else
+%{_libdir}/fipscheck/*.hmac
+%endif
+
+# We own the directory so we don't have to require prelink
+%attr(0755,root,root) %dir %{_sysconfdir}/prelink.conf.d/
+%{_sysconfdir}/prelink.conf.d/libreswan-fips.conf
+%endif
+
+%changelog
+* Wed Jul 03 2019 Paul Wouters <pwouters@redhat.com> - 3.25-5
+- Resolves: rhbz#1728175 XFRM policy for OE/32 peer is deleted when shunts for previous half-open state expire [rhel-7.6.z]
+
+* Thu May 09 2019 Paul Wouters <pwouters@redhat.com> - 3.25-4.8
+- Resolves: rhbz#1708060 IKEv1 traffic interruption when responder deletes SAs 60 seconds before EVENT_SA_REPLACE [rhel-7.6.z]
+
+* Thu May 02 2019 Paul Wouters <pwouters@redhat.com> - 3.25-4.7
+- Resolves: rhbz#1683577 Opportunistic IPsec instances of /32 groups or auto=start [updated for eclipsed handling]
+
+* Thu Apr 11 2019 Paul Wouters <pwouters@redhat.com> - 3.25-4.6
+- Resolves: rhbz#1680483 libreswan using NSS IPsec profiles regresses when critical flags are set causing validation failure [rhel-7.6.z] [updated]
+
+* Sun Mar 31 2019 Paul Wouters <pwouters@redhat.com> - 3.25-4.5
+- Resolves: rhbz#1683577 Opportunistic IPsec instances of /32 groups or auto=start that receive delete won't restart [rhel-7.6.z] [updated]
+
+* Tue Feb 26 2019 Paul Wouters <pwouters@redhat.com> - 3.25-4.4
+- Resolves: rhbz#1683577 Opportunistic IPsec instances of /32 groups or auto=start that receive delete won't restart [rhel-7.6.z]
+
+* Mon Feb 25 2019 Paul Wouters <pwouters@redhat.com> - 3.25-4.3
+- Resolves: rhbz#1680483 libreswan using NSS IPsec profiles regresses when critical flags are set causing validation failure [rhel-7.6.z]
+
+* Fri Feb 15 2019 Paul Wouters <pwouters@redhat.com> - 3.25-4.2
+- Resolves: rhbz#1672921 - Libreswan crash upon receiving ISAKMP_NEXT_D with appended ISAKMP_NEXT_N [updated bugfix]
+
+* Fri Jan 11 2019 Paul Wouters <pwouters@redhat.com> - 3.25-4.1
+- Resolves: rhbz#1665369 libreswan 3.25 in FIPS mode is incorrectly rejecting X.509 public keys that are >= 3072 bits [rhel-7.6.z]
+
+* Tue Jan 08 2019 Paul Wouters <pwouters@redhat.com> - 3.25-4
+- Resolves: rhbz#1660536 libreswan assertion failed when OAKLEY_KEY_LENGTH is zero for IKE using AES_CBC
+- Resolves: rhbz#1660544 config: recursive include check doesn't work
+- Resolves: rhbz#1660542 Libreswan crash upon receiving ISAKMP_NEXT_D with appended ISAKMP_NEXT_N
+- Resolves: rhbz#1664244 [abrt] [faf] libreswan: strncpy(): /usr/libexec/ipsec/pluto killed by 11
+
+* Mon Dec 03 2018 Paul Wouters <pwouters@redhat.com> - 3.25-3
+- Resolves: rhbz#1655440 Unable to verify certificate with non-empty Extended Key Usage which does not include serverAuth or clientAuth
+
+* Mon Jul 02 2018 Paul Wouters <pwouters@redhat.com> - 3.25-2
+- Resolves: rhbz#1597322 Relax deleting IKE SA's and IPsec SA's to avoid interop issues with third party VPN vendors
+
+* Wed Jun 27 2018 Paul Wouters <pwouters@redhat.com> - 3.25-1
+- Resolves: rhbz#1591817 rebase libreswan to 3.25
+- Resolves: rhbz#1536404 CERT_PKCS7_WRAPPED_X509 error
+- Resolves: rhbz#1544143 ipsec newhostkey fails in FIPS mode when RSA key is generated
+- Resolves: rhbz#1574011 libreswan is missing a Requires: unbound-libs >= 1.6.6
+
+* Fri Apr 27 2018 Paul Wouters <pwouters@redhat.com> - 3.23-4
+- Resolves: rhbz#1544143 ipsec newhostkey fails in FIPS mode when RSA key is generated
+- Resolves: rhbz#1553406 IKEv2 liveness false positive on IKEv2 idle connections causes tunnel to be restarted
+- Resolves: rhbz#1572425 shared IKE SA leads to rekey interop issues
+
+* Wed Feb 07 2018 Paul Wouters <pwouters@redhat.com> - 3.23-3
+- Resolves: rhbz#1471553 libreswan postquantum preshared key (PPK) support [IANA update]
+
+* Tue Feb 06 2018 Paul Wouters <pwouters@redhat.com> - 3.23-2
+- Resolves: rhbz#1457904 rebase libreswan to 3.23 [updated]
+- Resolves: rhbz#1375750 SECCOMP support for libreswan [updated]
+
+* Thu Jan 25 2018 Paul Wouters <pwouters@redhat.com> - 3.23-1
+- Resolves: rhbz#1457904 rebase libreswan to 3.23 [updated]
+
+* Thu Jan 11 2018 Paul Wouters <pwouters@redhat.com> - 3.23-0.1.rc4
+- Resolves: rhbz#1471763 RFE: libreswan MOBIKE support (RFC-4555) [client support]
+- Resolves: rhbz#1457904 rebase libreswan to 3.23 [updated]
+- Resolves: rhbz#1471553 libreswan postquantum preshared key (PPK) support
+- Resolves: rhbz#1492501 Reboot or 'systemctl stop ipsec' brings down _ethernet_ interfaces on _both_ ends of ipv4 ipsec tunnel
+- Resolves: rhbz#1324421 libreswan works not well when setting leftid field to be email address
+- Resolves: rhbz#1136076 After IKE rekeying Pluto sends DPD even if there is active SA
+
+* Tue Dec 12 2017 Paul Wouters <pwouters@redhat.com> - 3.22-5
+- Resolves: rhbz#1471763 RFE: libreswan MOBIKE support (RFC-4555) [updated]
+- Resolves: rhbz#1471553 libreswan postquantum preshared key (PPK) support
+- Resolves: rhbz#1375776 [IKEv2 Conformance] Test IKEv2.EN.R.1.2.2.1: Receipt of retransmitted CREATE_CHILD_SA reques failed
+- Resolves: rhbz#1375750 SECCOMP support for libreswan [updated for libunbound syscalls]
+- Resolves: rhbz#1300763 Implement draft-ietf-ipsecme-split-dns for libreswan
+
+* Thu Nov 30 2017 Paul Wouters <pwouters@redhat.com> - 3.22-4
+- Resolves: rhbz#1463062 NIC-card hardware offload support backport
+
+* Thu Nov 16 2017 Paul Wouters <pwouters@redhat.com> - 3.22-3
+- Resolves: rhbz#1475434 Add support for AES-GMAC for ESP (RFC-4543) to libreswan
+- Resolves: rhbz#1300759 Implement RFC-7427 Digital Signature authentication
+
+* Tue Oct 31 2017 Paul Wouters <pwouters@redhat.com> - 3.22-2
+- Resolves: rhbz#1471763 RFE: libreswan MOBIKE support (RFC-4555)
+- Resolves: rhbz#1372050 RFE: Support IKE and ESP over TCP: RFC 8229
+
+* Mon Oct 23 2017 Paul Wouters <pwouters@redhat.com> - 3.22-1
+- Resolves: rhbz#1457904 rebase libreswan to 3.22 [updated]
+
+* Mon Oct 16 2017 Paul Wouters <pwouters@redhat.com> - 3.21-2
+- Resolves: rhbz#1499845 libreswan does not establish IKE with xauth enabled but modecfg disabled
+- Resolves: rhbz#1497158 xauth password length limited to 64 bytes while XAUTH_MAX_PASS_LENGTH (128)
+
+* Wed Sep 20 2017 Paul Wouters <pwouters@redhat.com> - 3.21-1
+- Resolves: rhbz#1457904 rebase libreswan to 3.22
+
+* Mon Jun 12 2017 Paul Wouters <pwouters@redhat.com> - 3.20-3
+- Resolves: rhbz#1372279 ipsec auto --down CONNECTION returns error for tunnels [updated]
+- Resolves: rhbz#1458227 CAVS test driver does not work in FIPS mode
+- Resolves: rhbz#1452672 (new-ksk-libreswan-el7) DNSSEC trust anchor cannot be updated without recompilation
+
+* Thu Apr 13 2017 Paul Wouters <pwouters@redhat.com> - 3.20-2
+- Resolves: rhbz#1372279 ipsec auto --down CONNECTION returns error for tunnels
+- Resolves: rhbz#1444115 FIPS: libreswan must generate RSA keys with a minimal exponent of F4, nor E=3
+- Resolves: rhbz#1341353 Allow Preshared Key authentication in FIPS mode for libreswan
+
+* Tue Mar 14 2017 Paul Wouters <pwouters@redhat.com> - 3.20-1
+- Resolves: rhbz#1399883 rebase libreswan to 3.20 (full release)
+
+* Mon Feb 20 2017 Paul Wouters <pwouters@redhat.com> - 3.20-0.1.dr3
+- Resolves: rhbz#1399883 rebase libreswan to 3.20
+
+* Wed Sep 07 2016 Paul Wouters <pwouters@redhat.com> - 3.15-8
+- Resolves: rhbz#1361721 libreswan pluto segfault [UPDATED]
+- Resolves: rhbz#1276524 [USGv6] IKEv2.EN.R.1.1.3.2 case failed due to response to bad INFORMATIONAL request [UPDATED]
+- Resolves: rhbz#1309764 ipsec barf [additional man page update and --no-pager]
+
+* Mon Aug 08 2016 Paul Wouters <pwouters@redhat.com> - 3.15-7
+- Resolves: rhbz#1311360  When IKE rekeys, if on a different tunnel, all subsequent attempts to rekey fail
+- Resolves: rhbz#1361721 libreswan pluto segfault
+
+* Tue Jul 05 2016 Paul Wouters <pwouters@redhat.com> - 3.15-6
+- Resolves: rhbz#1283468 keyingtries=0 is broken
+- Resolves: rhbz#1297816 When using SHA2 as PRF algorithm, nonce payload is below the RFC minimum size
+- Resolves: rhbz#1344567 CVE-2016-5361 libreswan: IKEv1 protocol is vulnerable to DoS amplification attack
+- Resolves: rhbz#1313747 ipsec pluto returns zero even if it fails
+- Resolves: rhbz#1302778 fips does not check hash of some files (like _import_crl)
+- Resolves: rhbz#1278063 Unable to authenticate with PAM for IKEv1 XAUTH
+- Resolves: rhbz#1257079 Libreswan doesn't call NetworkManager helper in case of a connection error
+- Resolves: rhbz#1272112 ipsec whack man page discrepancies
+- Resolves: rhbz#1280449 PAM xauth method does not work with pam_sss
+- Resolves: rhbz#1290907 ipsec initnss/checknss custom directory not recognized
+- Resolves: rhbz#1309764 ipsec barf does not show pluto log correctly in the output
+- Resolves: rhbz#1347735 libreswan needs to check additional CRLs after LDAP CRL distributionpoint fails
+- Resolves: rhbz#1219049 Pluto does not handle delete message from responder site in ikev1
+- Resolves: rhbz#1276524 [USGv6] IKEv2.EN.R.1.1.3.2 case failed due to response to bad INFORMATIONAL request
+- Resolves: rhbz#1315412 ipsec.conf manpage does not contain any mention about crl-strict option
+- Resolves: rhbz#1229766 Pluto crashes after stop when I use floating ip address
+
+* Wed Oct 21 2015 Paul Wouters <pwouters@redhat.com> - 3.15-5
+- Resolves: rhbz#1271811 libreswan FIPS test mistakenly looks for non-existent file hashes
+
+* Wed Sep 30 2015 Paul Wouters <pwouters@redhat.com> - 3.15-4
+- Resolves: rhbz#1267370 libreswan should support strictcrlpolicy alias
+- Resolves: rhbz#1229766 Pluto crashes after stop when I use floating ip address
+- Resolves: rhbz#1166146 Pluto crashes on INITIATOR site during 'service ipsec stop'
+- Resolves: rhbz#1259209 CVE-2015-3240
+- Resolves: rhbz#1199374 libreswan does not enforce all FIPS or IPsec Suite B restrictions
+- Resolves: rhbz#1207689 libreswan ignores module blacklist rules
+- Merge rhel6 and rhel7 spec into one
+- Be lenient for racoon padding behaviour
+- Fix seedev option to /dev/random
+- Some IKEv1 PAM methods always gave 'Permission denied'
+- Parser workarounds for differences in gcc/flex/bison on rhel6/rhel7
+- Parser fix to allow specifying time without unit (openswan compat)
+- Fix Labeled IPsec on rekeyed IPsec SA's
+- Workaround for wrong padding by racoon2
+- Disable NSS HW GCM to workaround rhel6 xen builers bug
+
+* Fri May 29 2015 Paul Wouters <pwouters@redhat.com> - 3.12-12
+- Resolves: rhbz#1212121 Support CAVS [updated bogus fips mode fix]
+
+* Fri May 29 2015 Paul Wouters <pwouters@redhat.com> - 3.12-11
+- Resolves: rhbz#1226408 CVE-2015-3204 libreswan: crafted IKE packet causes daemon restart
+
+* Tue May 05 2015 Paul Wouters <pwouters@redhat.com> - 3.12-10
+- Resolves: rhbz#1212121 Support CAVS testing of the PRF/PRF+ functions
+- Resolves: rhbz#1127313 Libreswan with IPv6 [updated patch by Jaroslav Aster]
+- Resolves: rhbz#1207689 libreswan ignores module blacklist [updated modprobe handling]
+- Resolves: rhbz#1218358 pluto crashes in fips mode without dracut-fips package
+
+* Sat Feb 21 2015 Paul Wouters <pwouters@redhat.com> - 3.12-6
+- Resolves: rhbz#1056559 loopback support deprecated
+- Resolves: rhbz#1182224 Add new option for BSI random requirement
+- Resolves: rhbz#1170018 [increase] SELinux context string size limit
+- Resolves: rhbz#1127313 Libreswan with IPv6 in RHEL7 fails after reboot
+- Resolves: rhbz#1207689 libreswan ignores module blacklist rules
+- Resolves: rhbz#1203794 pluto crashes in fips mode
+
+* Tue Jan 20 2015 Paul Wouters <pwouters@redhat.com> - 3.12-5
+- Resolves: rhbz#826264 aes-gcm implementation support (for IKEv2)
+- Resolves: rhbz#1074018 Audit key agreement (integ gcm fixup)
+
+* Tue Dec 30 2014 Paul Wouters <pwouters@redhat.com> - 3.12-4
+- Resolves: rhbz#1134297 aes-ctr cipher is not supported
+- Resolves: rhbz#1131503 non-zero rSPI on INVALID_KE (and proper INVALID_KE handling)
+
+* Thu Dec 04 2014 Paul Wouters <pwouters@redhat.com> - 3.12-2
+- Resolves: rhbz#1105171 (Update man page entry)
+- Resolves: rhbz#1144120 (Update for ESP CAMELLIA with IKEv2)
+- Resolves: rhbz#1074018 Audit key agreement
+
+* Fri Nov 07 2014 Paul Wouters <pwouters@redhat.com> - 3.12-1
+- Resolves: rhbz#1136124 rebase to libreswan 3.12
+- Resolves: rhbz#1052811 [TAHI] (also clear reserved flags for isakmp_sa header)
+- Resolves: rhbz#1157379 [TAHI][IKEv2] IKEv2.EN.R.1.3.3.1: Non RESERVED fields in INFORMATIONAL request
+
+* Mon Oct 27 2014 Paul Wouters <pwouters@redhat.com> - 3.11-2
+- Resolves: rhbz#1136124 rebase to libreswan 3.11 (coverity fixup, dpdaction=clear fix)
+
+* Wed Oct 22 2014 Paul Wouters <pwouters@redhat.com> - 3.11-1
+- Resolves: rhbz#1136124 rebase to libreswan 3.11
+- Resolves: rhbz#1099905 ikev2 delete payloads are not delivered to peer
+- Resolves: rhbz#1147693 NetworkManger-libreswan can not connect to Red Hat IPSec Xauth VPN
+- Resolves: rhbz#1055865 [TAHI][IKEv2] libreswan do not ignore the content of version bit
+- Resolves: rhbz#1146106 Pluto crashes after start when some ah algorithms are used
+- Resolves: rhbz#1108256 addconn compatibility with openswan
+- Resolves: rhbz#1152625 [TAHI][IKEv2] IKEv2.EN.I.1.1.6.2 Part D: Integrity Algorithm AUTH_AES_XCBC_96 fail
+- Resolves: rhbz#1119704 [TAHI][IKEv2]IKEv2Interop.1.13a test fail
+- Resolves: rhbz#1100261 libreswan does not send response when when it receives Delete Payload for a CHILD_SA
+- Resolves: rhbz#1100239 ikev2 IKE SA responder does not send delete request to IKE SA initiator
+- Resolves: rhbz#1052811 [TAHI][IKEv2]IKEv2.EN.I.1.1.11.1: Non zero RESERVED fields in IKE_SA_INIT response
+- Resolves: rhbz#1126868 ikev2 sequence numbers are implemented incorrectly
+- Resolves: rhbz#1145245 Libreswan appears to start with systemd before all the NICs are up and running.
+- Resolves: rhbz#1145231 libreswan 3.10 upgrade breaks old ipsec.secrets configs
+- Resolves: rhbz#1144123 Add ESP support for AES_XCBC hash for USGv6 and IPsec-v3 compliance
+- Resolves: rhbz#1144120 Add ESP support for CAMELLIA for USGv6 and IPsec-v3 compliance
+- Resolves: rhbz#1099877 Missing man-pages ipsec_whack, ipsec_manual
+- Resolves: rhbz#1100255 libreswan Ikev2 implementation does not send an INFORMATIONAL response when it receives an INFORMATIONAL request with a Delete Payload for an IKE_SA
+
+* Tue Sep 09 2014 Paul Wouters <pwouters@redhat.com> - 3.10-3
+- Resolves: rhbz#1136124 rebase to 3.10 (auto=route bug on startup)
+
+* Mon Sep 08 2014 Paul Wouters <pwouters@redhat.com> - 3.10-2
+- Resolves: rhbz#1136124 rebase to libreswan 3.10
+
+* Mon Jul 14 2014 Paul Wouters <pwouters@redhat.com> - 3.8-6
+- Resolves: rhbz#1092047 pluto cannot write to directories not owned by root
+
+* Thu Apr 10 2014 Paul Wouters <pwouters@redhat.com> - 3.8-5
+- Resolves: rhbz#1052834 create_child_sa message ID handling
+
+
+* Tue Mar 18 2014 Paul Wouters <pwouters@redhat.com> - 3.8-4
+- Resolves: rhbz#1052834 create_child_sa response
+
+* Wed Mar 05 2014 Paul Wouters <pwouters@redhat.com> - 3.8-3
+- Resolves: rhbz#1069024  erroneous debug line with mixture [...]
+- Resolves: rhbz#1030939 update nss/x509 documents, don't load acerts
+- Resolves: rhbz#1058813 newhostkey returns zero value when it fails
+
+* Fri Jan 24 2014 Daniel Mach <dmach@redhat.com> - 3.8-2
+- Mass rebuild 2014-01-24
+
+* Thu Jan 16 2014 Paul Wouters <pwouters@redhat.com> - 3.8-1
+- Resolves: rhbz#CVE-2013-6467 
+- Resolves: rhbz#1043642 rebase to version 3.8
+- Resolves: rhbz#1029912 ipsec force-reload doesn't work
+- Resolves: rhbz#826261 Implement SHA384/512 support for Openswan
+- Resolves: rhbz#1039655 ipsec newhostkey generates false configuration
+
+* Fri Dec 27 2013 Daniel Mach <dmach@redhat.com> - 3.6-3
+- Mass rebuild 2013-12-27
+
+* Fri Nov 08 2013 Paul Wouters <pwouters@redhat.com> - 3.6-2
+- Fix race condition in post for creating nss db
+
+* Thu Oct 31 2013 Paul Wouters <pwouters@redhat.com> - 3.6-1
+- Updated to version 3.6 (IKEv2, MODECFG, Cisco interop fixes)
+- Generate empty NSS db if none exists
+- FIPS update using /etc/system-fips
+- Provide: openswan-doc
+
+* Fri Aug 09 2013 Paul Wouters <pwouters@redhat.com> - 3.5-2
+- rebuilt and bumped EVR to avoid confusion of import->delete->import
+- require iproute
+
+* Mon Jul 15 2013 Paul Wouters <pwouters@redhat.com> - 3.5-1
+- Initial package for RHEL7
+- Added interop patch for (some?) Cisco VPN clients sending 16 zero
+  bytes of extraneous IKE data
+- Removed fipscheck_version