implemented IKEv2 force_encap connection parameter

enforces UDP encapsulation by faking NAT detection payloads
  to hurdle restrictive firewalls

src/starter/args.c

@@ -194,6 +194,7 @@ static const token_info_t token_info[] =
     { ARG_MISC, 0, NULL  /* KW_AUTHBY */                                           },
     { ARG_MISC, 0, NULL  /* KW_EAP */                                              },
     { ARG_MISC, 0, NULL  /* KW_MOBIKE */                                           },
+    { ARG_MISC, 0, NULL  /* KW_FORCE_ENCAP */                                      },
     { ARG_TIME, offsetof(starter_conn_t, sa_ike_life_seconds), NULL                },
     { ARG_TIME, offsetof(starter_conn_t, sa_ipsec_life_seconds), NULL              },
     { ARG_TIME, offsetof(starter_conn_t, sa_rekey_margin), NULL                    },

src/starter/confread.c

@@ -554,6 +554,9 @@ load_conn(starter_conn_t *conn, kw_list_t *kw, starter_config_t *cfg)
 		case KW_MOBIKE:
 			KW_POLICY_FLAG("yes", "no", POLICY_MOBIKE)
 			break;
+		case KW_FORCE_ENCAP:
+			KW_POLICY_FLAG("yes", "no", POLICY_FORCE_ENCAP)
+			break;
 		case KW_MODECONFIG:
 			KW_POLICY_FLAG("push", "pull", POLICY_MODECFG_PUSH)
 			break;

src/starter/ipsec.conf.5

@@ -365,6 +365,11 @@ for the connection, e.g.
 (encryption-integrity-[dh-group]). If dh-group is specified, CHILD_SA setup
 and rekeying include a separate diffe hellman exchange (IKEv2 only).
 .TP
+.B force_encap
+Force UDP encapsulation for ESP packets even if no NAT situation is detected.
+This may help to hurdle restrictive firewalls. To enforce the peer to 
+encapsulate packets, NAT detection payloads are faked (IKEv2 only).
+.TP
 .B ike
 IKE/ISAKMP SA encryption/authentication algorithm to be used, e.g.
 .B aes128-sha1-modp2048

src/starter/keywords.h

@@ -71,6 +71,7 @@ typedef enum {
     KW_AUTHBY,
     KW_EAP,
     KW_MOBIKE,
+    KW_FORCE_ENCAP,
     KW_IKELIFETIME,
     KW_KEYLIFE,
     KW_REKEYMARGIN,

src/starter/keywords.txt

@@ -50,6 +50,7 @@ virtual_private,   KW_VIRTUAL_PRIVATE
 eap,               KW_EAP
 eapdir,            KW_EAPDIR
 mobike,	           KW_MOBIKE
+force_encap,       KW_FORCE_ENCAP
 pkcs11module,      KW_PKCS11MODULE
 pkcs11initargs,    KW_PKCS11INITARGS
 pkcs11keepstate,   KW_PKCS11KEEPSTATE