Might be useful for users of other daemons too. Note that compared to the previous implementation in charon-tkm, the mask/label are applied in network order. Closes strongswan/strongswan#134.