implemented IKEv2 force_encap connection parameter

enforces UDP encapsulation by faking NAT detection payloads
  to hurdle restrictive firewalls

src/charon/config/backends/sqlite_backend.c

@@ -192,6 +192,7 @@ static peer_cfg_t *process_peer_cfg_row(private_sqlite_backend_t *this,
 			sqlite3_column_int(stmt, 10),				/* jitter */
 			sqlite3_column_int(stmt, 13),				/* reauth */
 			sqlite3_column_int(stmt, 14),				/* mobike */
+			FALSE,										/* force_encap */
 			sqlite3_column_int(stmt, 11),				/* dpd_delay */
 			sqlite3_column_int(stmt, 12),				/* dpd_action */
 			local_vip, remote_vip);

src/charon/config/peer_cfg.c

@@ -140,6 +140,11 @@ struct private_peer_cfg_t {
 	 */
 	bool use_mobike;
 	
+	/**
+	 * enforce UDP encapsulation
+	 */
+	bool force_encap;
+	
 	/**
 	 * Time before an SA gets invalid
 	 */
@@ -364,6 +369,14 @@ static bool use_mobike(private_peer_cfg_t *this)
 {
 	return this->use_mobike;
 }
+	
+/**
+ * Implementation of peer_cfg_t.force_encap.
+ */
+static bool force_encap_meth(private_peer_cfg_t *this)
+{
+	return this->force_encap;
+}
 
 /**
  * Implements peer_cfg_t.get_dpd_delay
@@ -452,7 +465,7 @@ peer_cfg_t *peer_cfg_create(char *name, u_int ike_version, ike_cfg_t *ike_cfg,
 							auth_method_t auth_method, eap_type_t eap_type,
 							u_int32_t keyingtries, u_int32_t lifetime,
 							u_int32_t rekeytime, u_int32_t jitter,
-							bool reauth, bool mobike,
+							bool reauth, bool mobike, bool force_encap,
 							u_int32_t dpd_delay, dpd_action_t dpd_action,
 							host_t *my_virtual_ip, host_t *other_virtual_ip)
 {
@@ -477,6 +490,7 @@ peer_cfg_t *peer_cfg_create(char *name, u_int ike_version, ike_cfg_t *ike_cfg,
 	this->public.get_lifetime = (u_int32_t (*) (peer_cfg_t *, bool rekey))get_lifetime;
 	this->public.use_reauth = (bool (*) (peer_cfg_t *))use_reauth;
 	this->public.use_mobike = (bool (*) (peer_cfg_t *))use_mobike;
+	this->public.force_encap = (bool (*) (peer_cfg_t *))force_encap_meth;
 	this->public.get_dpd_delay = (u_int32_t (*) (peer_cfg_t *))get_dpd_delay;
 	this->public.get_dpd_action = (dpd_action_t (*) (peer_cfg_t *))get_dpd_action;
 	this->public.get_my_virtual_ip = (host_t* (*) (peer_cfg_t *))get_my_virtual_ip;
@@ -504,6 +518,7 @@ peer_cfg_t *peer_cfg_create(char *name, u_int ike_version, ike_cfg_t *ike_cfg,
 	this->jitter = jitter;
 	this->use_reauth = reauth;
 	this->use_mobike = mobike;
+	this->force_encap = force_encap;
 	this->dpd_delay = dpd_delay;
 	this->dpd_action = dpd_action;
 	this->my_virtual_ip = my_virtual_ip;

src/charon/config/peer_cfg.h

@@ -273,6 +273,14 @@ struct peer_cfg_t {
 	 */
 	bool (*use_mobike) (peer_cfg_t *this);
 	
+	/**
+	 * @brief Enforce UDP encapsulation by faking NATD notifies?
+	 * 
+	 * @param this		calling object
+	 * @return			TRUE to enfoce UDP encapsulation
+	 */
+	bool (*force_encap) (peer_cfg_t *this);
+	
 	/**
 	 * @brief Get the DPD check interval.
 	 * 
@@ -364,8 +372,9 @@ struct peer_cfg_t {
  * @param lifetime			lifetime before deleting an SA
  * @param rekeytime			lifetime before rekeying an SA
  * @param jitter			range of random to substract from rekeytime
- * @param use_reauth		sould be done reauthentication instead of rekeying?
- * @param use_mobike		use MOBIKE (RFC4555) if peer supports it
+ * @param reauth			sould be done reauthentication instead of rekeying?
+ * @param mobike			use MOBIKE (RFC4555) if peer supports it
+ * @param force_encap		enforce UDP encapsulation by faking NATD notify
  * @param dpd_delay			after how many seconds of inactivity to check DPD
  * @param dpd_action		what to do with CHILD_SAs when detected a dead peer
  * @param my_virtual_ip		virtual IP for local host, or NULL
@@ -381,7 +390,7 @@ peer_cfg_t *peer_cfg_create(char *name, u_int ikev_version, ike_cfg_t *ike_cfg,
 							auth_method_t auth_method, eap_type_t eap_type,
 							u_int32_t keyingtries, u_int32_t lifetime,
 							u_int32_t rekeytime, u_int32_t jitter,
-							bool reauth, bool mobike,
+							bool reauth, bool mobike, bool force_encap,
 							u_int32_t dpd_delay, dpd_action_t dpd_action,
 							host_t *my_virtual_ip, host_t *other_virtual_ip);