implemented IKEv2 force_encap connection parameter

enforces UDP encapsulation by faking NAT detection payloads
  to hurdle restrictive firewalls

src/pluto/constants.h

@@ -876,6 +876,7 @@ extern const char *prettypolicy(lset_t policy);
 #define POLICY_DONT_REAUTH	LELEM(21)	/* don't reauthenticate on rekeying, IKEv2 only */
 #define POLICY_BEET		LELEM(22)	/* bound end2end tunnel, IKEv2 */
 #define POLICY_MOBIKE		LELEM(23)	/* enable MOBIKE for IKEv2  */
+#define POLICY_FORCE_ENCAP	LELEM(24)	/* force UDP encapsulation (IKEv2)  */
 
 /* Any IPsec policy?  If not, a connection description
  * is only for ISAKMP SA, not IPSEC SA.  (A pun, I admit.)