redesigned IKE_SA using a transaction mechanism:

removed old state machine
  reimplemented IKE_SA setup and delete
  implemented dead peer detection
  implemented keep-alives
  a lot of fixes
  no rekeying yet

src/charon/encoding/message.c

@@ -22,6 +22,7 @@
  */
 
 #include <stdlib.h>
+#include <string.h>
 
 #include "message.h"
 
@@ -413,14 +414,9 @@ static void set_ike_sa_id (private_message_t *this,ike_sa_id_t *ike_sa_id)
 /**
  * Implementation of message_t.get_ike_sa_id.
  */
-static status_t get_ike_sa_id (private_message_t *this,ike_sa_id_t **ike_sa_id)
+static ike_sa_id_t* get_ike_sa_id (private_message_t *this)
 {
-	if (this->ike_sa_id == NULL)
-	{
-		return FAILED;
-	}
-	*ike_sa_id = this->ike_sa_id->clone(this->ike_sa_id);
-	return SUCCESS;
+	return this->ike_sa_id;
 }
 
 /**
@@ -520,6 +516,20 @@ static exchange_type_t get_request (private_message_t *this)
 	return this->is_request;
 }
 
+/**
+ * Is this message in an encoded form?
+ */
+static bool is_encoded(private_message_t *this)
+{
+	chunk_t data = this->packet->get_data(this->packet);
+	
+	if (data.ptr == NULL)
+	{
+		return FALSE;
+	}
+	return TRUE;
+}
+
 /**
  * Implementation of message_t.add_payload.
  */
@@ -583,6 +593,48 @@ static iterator_t *get_payload_iterator(private_message_t *this)
 	return this->payloads->create_iterator(this->payloads, TRUE);
 }
 
+/**
+ * Build a string containing short names for all payload in this message
+ */
+static void build_payload_string(private_message_t *this, char* buffer, size_t size)
+{
+	iterator_t *iterator;
+	payload_t *payload;
+	bool first = TRUE;
+	
+	*buffer = '\0';
+	size--;
+	
+	iterator = this->payloads->create_iterator(this->payloads, TRUE);
+	while (iterator->iterate(iterator, (void**)&payload))
+	{
+		payload_type_t type = payload->get_type(payload);
+		char *name = mapping_find(payload_type_short_m, type);
+		size_t name_len = strlen(name);
+		if (!first)
+		{
+			strncat(buffer, " ", size);
+			if (size)
+			{
+				size--;
+			}
+		}
+		else
+		{
+			first = FALSE;
+		}
+		strncat(buffer, name, size);
+		if (name_len > size)
+		{
+			size = 0;
+		}
+		else
+		{
+			size -= name_len;
+		}
+	}
+	iterator->destroy(iterator);
+}
 
 /**
  * Implementation of message_t.generate.
@@ -595,11 +647,20 @@ static status_t generate(private_message_t *this, crypter_t *crypter, signer_t*
 	iterator_t *iterator;
 	status_t status;
 	chunk_t packet_data;
+	char payload_names[128];
 	
-	this->logger->log(this->logger, CONTROL, "generating %s %s, contains %d payloads",
+	if (is_encoded(this))
+	{
+		/* already generated, return a new packet clone */
+		*packet = this->packet->clone(this->packet);
+		return SUCCESS;
+	}
+	
+	build_payload_string(this, payload_names, sizeof(payload_names));
+	this->logger->log(this->logger, CONTROL, "generating %s %s [%s]",
 					  mapping_find(exchange_type_m,this->exchange_type),
 					  this->is_request ? "request" : "response",
-					  this->payloads->get_count(this->payloads));
+					  payload_names);
 	
 	if (this->exchange_type == EXCHANGE_TYPE_UNDEFINED)
 	{
@@ -710,20 +771,6 @@ static chunk_t get_packet_data (private_message_t *this)
 	return chunk_clone(this->packet->get_data(this->packet));
 }
 
-/**
- * Implementation of message_t.is_encoded.
- */
-static bool is_encoded(private_message_t *this)
-{
-	chunk_t data = this->packet->get_data(this->packet);
-	
-	if (data.ptr == NULL)
-	{
-		return FALSE;
-	}
-	return TRUE;
-}
-
 /**
  * Implementation of message_t.parse_header.
  */
@@ -794,6 +841,7 @@ static status_t parse_body(private_message_t *this, crypter_t *crypter, signer_t
 {
 	status_t status = SUCCESS;
 	payload_type_t current_payload_type;
+	char payload_names[128];
 		
 	current_payload_type = this->first_payload;	
 		
@@ -815,7 +863,7 @@ static status_t parse_body(private_message_t *this, crypter_t *crypter, signer_t
 		{
 			this->logger->log(this->logger, ERROR, "payload type %s could not be parsed",
 								mapping_find(payload_type_m,current_payload_type));
-			return status;
+			return PARSE_ERROR;
 		}
 
 		this->logger->log(this->logger, CONTROL|LEVEL2, "verify payload of type %s", 
@@ -828,8 +876,7 @@ static status_t parse_body(private_message_t *this, crypter_t *crypter, signer_t
 			this->logger->log(this->logger, ERROR, "%s payload verification failed",
 								mapping_find(payload_type_m,current_payload_type));
 			current_payload->destroy(current_payload);
-			status = VERIFY_ERROR;
-			return status;
+			return VERIFY_ERROR;
 		}
 		
 		this->logger->log(this->logger, CONTROL|LEVEL2, "%s payload verified. Adding to payload list", 
@@ -862,14 +909,16 @@ static status_t parse_body(private_message_t *this, crypter_t *crypter, signer_t
 	if (status != SUCCESS)
 	{
 		this->logger->log(this->logger, ERROR, "verification of message failed");
+		return status;
 	}
 	
-	this->logger->log(this->logger, CONTROL, "parsed %s %s, contains %d payloads", 
+	build_payload_string(this, payload_names, sizeof(payload_names));
+	this->logger->log(this->logger, CONTROL, "parsed %s %s [%s]", 
 					mapping_find(exchange_type_m, this->exchange_type),
 					this->is_request ? "request" : "response",
-					this->payloads->get_count(this->payloads));
+					payload_names);
 	
-	return status;
+	return SUCCESS;
 }
 
 /**
@@ -926,7 +975,7 @@ static status_t verify(private_message_t *this)
 									  mapping_find(payload_type_m, current_payload_type),
 									  this->message_rule->payload_rules[i].max_occurence, found_payloads);
 					iterator->destroy(iterator);
-					return FAILED;					
+					return VERIFY_ERROR;
 				}
 			}
 		}
@@ -937,7 +986,7 @@ static status_t verify(private_message_t *this)
 							  mapping_find(payload_type_m, this->message_rule->payload_rules[i].payload_type),
 							  this->message_rule->payload_rules[i].min_occurence, found_payloads);
 			iterator->destroy(iterator);
-			return FAILED;
+			return VERIFY_ERROR;
 		}
 		if ((this->message_rule->payload_rules[i].sufficient) && (this->payloads->get_count(this->payloads) == total_found_payloads))
 		{
@@ -993,7 +1042,7 @@ static status_t decrypt_payloads(private_message_t *this,crypter_t *crypter, sig
 				/* encrypted payload is not last one */
 				this->logger->log(this->logger, ERROR, "encrypted payload is not last payload");
 				iterator->destroy(iterator);
-				return FAILED;
+				return VERIFY_ERROR;
 			}
 			/* decrypt */
 			encryption_payload->set_transforms(encryption_payload, crypter, signer);
@@ -1003,7 +1052,7 @@ static status_t decrypt_payloads(private_message_t *this,crypter_t *crypter, sig
 			{
 				this->logger->log(this->logger, ERROR, "encryption payload signature invalid");
 				iterator->destroy(iterator);
-				return status;
+				return FAILED;
 			}
 			this->logger->log(this->logger, CONTROL | LEVEL2, "decrypt content of encryption payload");
 			status = encryption_payload->decrypt(encryption_payload);
@@ -1013,7 +1062,7 @@ static status_t decrypt_payloads(private_message_t *this,crypter_t *crypter, sig
 								  "encrypted payload could not be decrypted and parsed: %s", 
 								  mapping_find(status_m, status));
 				iterator->destroy(iterator);
-				return status;
+				return PARSE_ERROR;
 			}
 			
 			/* needed later to find out if a payload was encrypted */
@@ -1073,7 +1122,7 @@ static status_t decrypt_payloads(private_message_t *this,crypter_t *crypter, sig
 				this->logger->log(this->logger, ERROR, "payload type %s not allowed",
 								  mapping_find(payload_type_m,current_payload_type));
 				iterator->destroy(iterator);
-				return status;
+				return VERIFY_ERROR;
 			}
 			
 			/* check if the payload was encrypted, and if it should been have encrypted */
@@ -1084,7 +1133,7 @@ static status_t decrypt_payloads(private_message_t *this,crypter_t *crypter, sig
 									mapping_find(payload_type_m,current_payload_type),
 									(payload_rule->encrypted) ? "encrypted" : "not encrypted");
 				iterator->destroy(iterator);
-				return FAILED;
+				return VERIFY_ERROR;
 			}
 		}
 		/* advance to the next payload */
@@ -1188,8 +1237,6 @@ static void destroy (private_message_t *this)
 {
 	iterator_t *iterator;
 	
-	this->logger->log(this->logger, CONTROL|LEVEL3, "going to destroy message_t object");
-	
 	this->packet->destroy(this->packet);
 
 	if (this->ike_sa_id != NULL)
@@ -1202,8 +1249,6 @@ static void destroy (private_message_t *this)
 	{
 		payload_t *payload;
 		iterator->current(iterator, (void**)&payload);	
-		this->logger->log(this->logger, CONTROL|LEVEL3, "destroying payload of type %s", 
-							mapping_find(payload_type_m, payload->get_type(payload)));
 		payload->destroy(payload);
 	}
 	iterator->destroy(iterator);
@@ -1230,7 +1275,7 @@ message_t *message_create_from_packet(packet_t *packet)
 	this->public.get_initiator_spi = (u_int64_t(*)(message_t*))get_initiator_spi;
 	this->public.get_responder_spi = (u_int64_t(*)(message_t*))get_responder_spi;
 	this->public.set_ike_sa_id = (void(*)(message_t*, ike_sa_id_t *))set_ike_sa_id;
-	this->public.get_ike_sa_id = (status_t(*)(message_t*, ike_sa_id_t **))get_ike_sa_id;
+	this->public.get_ike_sa_id = (ike_sa_id_t*(*)(message_t*))get_ike_sa_id;
 	this->public.set_exchange_type = (void(*)(message_t*, exchange_type_t))set_exchange_type;
 	this->public.get_exchange_type = (exchange_type_t(*)(message_t*))get_exchange_type;
 	this->public.set_request = (void(*)(message_t*, bool))set_request;
@@ -1246,7 +1291,6 @@ message_t *message_create_from_packet(packet_t *packet)
 	this->public.parse_body = (status_t (*) (message_t *,crypter_t*,signer_t*)) parse_body;
 	this->public.get_packet = (packet_t * (*) (message_t*)) get_packet;
 	this->public.get_packet_data = (chunk_t (*) (message_t *this)) get_packet_data;
-	this->public.is_encoded = (bool (*) (message_t *this)) is_encoded;
 	this->public.destroy = (void(*)(message_t*))destroy;
 		
 	/* private values */

src/charon/encoding/message.h

@@ -120,27 +120,22 @@ struct message_t {
 	/**
 	 * @brief Sets the IKE_SA ID of the message.
 	 * 
-	 * @warning ike_sa_id gets cloned  internaly and 
-	 * so can be destroyed afterwards.
+	 * ike_sa_id gets cloned.
 	 *
 	 * @param this 			message_t object
 	 * @param ike_sa_id		ike_sa_id to set
 	 */
-	void (*set_ike_sa_id) (message_t *this,ike_sa_id_t * ike_sa_id);
+	void (*set_ike_sa_id) (message_t *this, ike_sa_id_t * ike_sa_id);
 
 	/**
 	 * @brief Gets the IKE_SA ID of the message.
-	 * 
-	 * @warning The returned ike_sa_id is a clone of the internal one.
-	 * So it has to be destroyed by the caller.
+	 *
+	 * The ike_sa_id points to the message internal id, do not modify.
 	 *
 	 * @param this 			message_t object
-	 * @param ike_sa_id		pointer to ike_sa_id pointer which will be set
-	 * @return				
-	 * 						- SUCCESS
-	 * 						- FAILED if no ike_sa_id is set
+	 * @return				ike_sa_id of message
 	 */
-	status_t (*get_ike_sa_id) (message_t *this,ike_sa_id_t **ike_sa_id);
+	ike_sa_id_t *(*get_ike_sa_id) (message_t *this);
 
 	/**
 	 * @brief Sets the exchange type of the message.
@@ -219,11 +214,12 @@ struct message_t {
 	 * @param crypter	crypter to decrypt encryption payloads
 	 * @param signer	signer to verifiy a message with an encryption payload
 	 * @return
-	 * 					- SUCCESS if header could be parsed
+	 * 					- SUCCESS if parsing successful
 	 * 					- NOT_SUPPORTED if ciritcal unknown payloads found
-	 * 					- FAILED if message type is not suppported!
-	 *					- PARSE_ERROR if corrupted/invalid data found
-	 * 					- VERIFY_ERROR if verification of some payload failed
+	 * 					- NOT_SUPPORTED if message type is not supported!
+	 *					- PARSE_ERROR if message parsing failed
+	 * 					- VERIFY_ERROR if message verification failed (bad syntax)
+	 * 					- FAILED if integrity check failed
 	 * 					- INVALID_STATE if crypter/signer not supplied, but needed
 	 */
 	status_t (*parse_body) (message_t *this, crypter_t *crypter, signer_t *signer);
@@ -238,10 +234,12 @@ struct message_t {
 	 * message.
 	 * Crypter/signer can be omitted (by passing NULL) when no encryption 
 	 * payload is expected.
+	 * Generation is only done once, multiple calls will just return a packet copy.
 	 *
 	 * @param this 		message_t object
 	 * @param crypter	crypter to use when a payload must be encrypted
 	 * @param signer	signer to build a mac
+	 * @param packet	copy of generated packet
 	 * @return
 	 * 					- SUCCESS if packet could be generated
 	 * 					- INVALID_STATE if exchange type is currently not set
@@ -321,19 +319,6 @@ struct message_t {
 	 */	
 	chunk_t (*get_packet_data) (message_t *this);
 	
-	/**
-	 * @brief Check if a message is encoded.
-	 *
-	 * Check if the packet is in a generated (and encrypted) form available
-	 * and can be passed down to the socket. If not, it has to be generated
-	 * first.
-	 *
-	 * @param this 		message_t object
-	 * @return			TRUE if encoded, FALSE if not
-	 */	
-	bool (*is_encoded) (message_t *this);
-	
-	
 	/**
 	 * @brief Destroys a message and all including objects.
 	 *

src/charon/encoding/payloads/cert_payload.c

@@ -291,4 +291,4 @@ cert_payload_t *cert_payload_create_from_x509(x509_t *cert)
 	this->set_cert_encoding(this, CERT_X509_SIGNATURE);
 	this->set_data(this, cert->get_certificate(cert));
 	return this;
-}
+}

src/charon/encoding/payloads/ke_payload.c

@@ -216,9 +216,7 @@ static void set_key_exchange_data(private_ke_payload_t *this, chunk_t key_exchan
 		
 	}
 	
-	this->key_exchange_data.ptr = clalloc(key_exchange_data.ptr,key_exchange_data.len);
-
-	this->key_exchange_data.len = key_exchange_data.len;
+	this->key_exchange_data = chunk_clone(key_exchange_data);
 	this->compute_length(this);
 }
 
@@ -268,9 +266,22 @@ ke_payload_t *ke_payload_create()
 	this->critical = FALSE;
 	this->next_payload = NO_PAYLOAD;
 	this->payload_length = KE_PAYLOAD_HEADER_LENGTH;
-	this->key_exchange_data.ptr = NULL;
-	this->key_exchange_data.len = 0;
-	this->dh_group_number = 0;
+	this->key_exchange_data = CHUNK_INITIALIZER;
+	this->dh_group_number = MODP_NONE;
 
-	return (&(this->public));
+	return &this->public;
+}
+
+/*
+ * Described in header
+ */
+ke_payload_t *ke_payload_create_from_diffie_hellman(diffie_hellman_t *dh)
+{
+	private_ke_payload_t *this = (private_ke_payload_t*)ke_payload_create();
+	
+	dh->get_my_public_value(dh, &this->key_exchange_data);
+	this->dh_group_number = dh->get_dh_group(dh);
+	this->compute_length(this);
+	
+	return &this->public;
 }

src/charon/encoding/payloads/ke_payload.h

@@ -27,6 +27,8 @@
 #include <encoding/payloads/payload.h>
 #include <encoding/payloads/transform_substructure.h>
 #include <utils/linked_list.h>
+#include <crypto/diffie_hellman.h>
+
 /**
  * KE payload length in bytes without any key exchange data.
  * 
@@ -106,5 +108,14 @@ struct ke_payload_t {
  */
 ke_payload_t *ke_payload_create(void);
 
+/**
+ * @brief Creates a ke_payload_t from a diffie_hellman_t
+ * 
+ * @param diffie_hellman	diffie hellman object containing group and key
+ * @return 					ke_payload_t object
+ * 
+ * @ingroup payloads
+ */
+ke_payload_t *ke_payload_create_from_diffie_hellman(diffie_hellman_t *diffie_hellman);
 
-#endif /*KE_PAYLOAD_H_*/
+#endif /* KE_PAYLOAD_H_ */

src/charon/encoding/payloads/nonce_payload.h

@@ -26,6 +26,15 @@
 #include <types.h>
 #include <encoding/payloads/payload.h>
 
+/**
+ * Nonce size in bytes for nonces sending to other peer.
+ * 
+ * @warning Nonce size MUST be between 16 and 256 bytes.
+ * 
+ * @ingroup payloads
+ */
+#define NONCE_SIZE 16
+
 /**
  * Length of a nonce payload without a nonce in bytes.
  * 

src/charon/encoding/payloads/notify_payload.c

@@ -28,10 +28,12 @@
 #include <daemon.h>
 #include <encoding/payloads/encodings.h>
 
+#define SHA1_HASH_SIZE 20
+
 /** 
- * String mappings for notify_message_type_t.
+ * String mappings for notify_type_t.
  */
-mapping_t notify_message_type_m[] = {
+mapping_t notify_type_m[] = {
 	{UNSUPPORTED_CRITICAL_PAYLOAD, "UNSUPPORTED_CRITICAL_PAYLOAD"},
 	{INVALID_IKE_SPI, "INVALID_IKE_SPI"},
 	{INVALID_MAJOR_VERSION, "INVALID_MAJOR_VERSION"},
@@ -94,7 +96,7 @@ struct private_notify_payload_t {
 	/**
 	 * Notify message type.
 	 */
-	u_int16_t notify_message_type;
+	u_int16_t notify_type;
 	
 	/**
 	 * Security parameter index (spi).
@@ -146,7 +148,7 @@ encoding_rule_t notify_payload_encodings[] = {
 	/* SPI Size as 8 bit field*/
 	{ SPI_SIZE,			offsetof(private_notify_payload_t, spi_size) 			},
 	/* Notify message type as 16 bit field*/
-	{ U_INT_16,			offsetof(private_notify_payload_t, notify_message_type)	},
+	{ U_INT_16,			offsetof(private_notify_payload_t, notify_type)	},
 	/* SPI as variable length field*/
 	{ SPI,				offsetof(private_notify_payload_t, spi)		 			},
 	/* Key Exchange Data is from variable size */
@@ -195,31 +197,60 @@ static status_t verify(private_notify_payload_t *this)
 			return FAILED;
 	}
 	
-	/* TODO: Check all kinds of notify */
-	if (this->notify_message_type == INVALID_KE_PAYLOAD)
+	switch (this->notify_type)
 	{
-		/* check notification data */
-		diffie_hellman_group_t dh_group;
-		if (this->notification_data.len != 2)
+		case INVALID_KE_PAYLOAD:
 		{
-			return FAILED;
-		}
-		dh_group = ntohs(*((u_int16_t*)this->notification_data.ptr));
-		switch (dh_group)
-		{
-			case MODP_768_BIT:
-			case MODP_1024_BIT:
-			case MODP_1536_BIT:
-			case MODP_2048_BIT:
-			case MODP_3072_BIT:
-			case MODP_4096_BIT:
-			case MODP_6144_BIT:
-			case MODP_8192_BIT:
-				break;
-			default:
-				this->logger->log(this->logger, ERROR, "Bad DH group (%d)", dh_group);
+			/* check notification data */
+			diffie_hellman_group_t dh_group;
+			if (this->notification_data.len != 2)
+			{
 				return FAILED;
+			}
+			dh_group = ntohs(*((u_int16_t*)this->notification_data.ptr));
+			switch (dh_group)
+			{
+				case MODP_768_BIT:
+				case MODP_1024_BIT:
+				case MODP_1536_BIT:
+				case MODP_2048_BIT:
+				case MODP_3072_BIT:
+				case MODP_4096_BIT:
+				case MODP_6144_BIT:
+				case MODP_8192_BIT:
+					break;
+				default:
+					this->logger->log(this->logger, ERROR, "Bad DH group (%d)", dh_group);
+					return FAILED;
+			}
+			break;
 		}
+		case NAT_DETECTION_SOURCE_IP:
+		case NAT_DETECTION_DESTINATION_IP:
+		{
+			if (this->notification_data.len != SHA1_HASH_SIZE)
+			{
+				this->logger->log(this->logger, ERROR, "invalid %s notify length",
+								  mapping_find(notify_type_m, this->notify_type));
+				return FAILED;
+			}
+			break;
+		}
+		case INVALID_SYNTAX:
+		case INVALID_MAJOR_VERSION:
+		case NO_PROPOSAL_CHOSEN:
+		{
+			if (this->notification_data.len != 0)
+			{
+				this->logger->log(this->logger, ERROR, "invalid %s notify",
+								  mapping_find(notify_type_m, this->notify_type));
+				return FAILED;
+			}
+			break;
+		}
+		default:
+			/* TODO: verify */
+			break;
 	}
 	return SUCCESS;
 }
@@ -300,19 +331,19 @@ static void set_protocol_id(private_notify_payload_t *this, u_int8_t protocol_id
 }
 
 /**
- * Implementation of notify_payload_t.get_notify_message_type.
+ * Implementation of notify_payload_t.get_notify_type.
  */
-static notify_message_type_t get_notify_message_type(private_notify_payload_t *this)
+static notify_type_t get_notify_type(private_notify_payload_t *this)
 {
-	return this->notify_message_type;
+	return this->notify_type;
 }
 
 /**
- * Implementation of notify_payload_t.set_notify_message_type.
+ * Implementation of notify_payload_t.set_notify_type.
  */
-static void set_notify_message_type(private_notify_payload_t *this, u_int16_t notify_message_type)
+static void set_notify_type(private_notify_payload_t *this, u_int16_t notify_type)
 {
-	this->notify_message_type = notify_message_type;
+	this->notify_type = notify_type;
 }
 
 /**
@@ -363,20 +394,9 @@ static chunk_t get_notification_data(private_notify_payload_t *this)
  */
 static status_t set_notification_data(private_notify_payload_t *this, chunk_t notification_data)
 {
-	/* destroy existing data first */
-	if (this->notification_data.ptr != NULL)
-	{
-		/* free existing value */
-		free(this->notification_data.ptr);
-		this->notification_data.ptr = NULL;
-		this->notification_data.len = 0;
-		
-	}
-	
-	this->notification_data.ptr = clalloc(notification_data.ptr,notification_data.len);
-	this->notification_data.len = notification_data.len;
+	chunk_free(&this->notification_data);
+	this->notification_data = chunk_clone(notification_data);
 	this->compute_length(this);
-	
 	return SUCCESS;
 }
 
@@ -385,14 +405,8 @@ static status_t set_notification_data(private_notify_payload_t *this, chunk_t no
  */
 static status_t destroy(private_notify_payload_t *this)
 {
-	if (this->notification_data.ptr != NULL)
-	{
-		free(this->notification_data.ptr);
-	}
-	if (this->spi.ptr != NULL)
-	{
-		free(this->spi.ptr);
-	}
+	chunk_free(&this->notification_data);
+	chunk_free(&this->spi);
 	free(this);
 	return SUCCESS;
 }
@@ -416,8 +430,8 @@ notify_payload_t *notify_payload_create()
 	/* public functions */
 	this->public.get_protocol_id = (u_int8_t (*) (notify_payload_t *)) get_protocol_id;
 	this->public.set_protocol_id  = (void (*) (notify_payload_t *,u_int8_t)) set_protocol_id;
-	this->public.get_notify_message_type = (notify_message_type_t (*) (notify_payload_t *)) get_notify_message_type;
-	this->public.set_notify_message_type = (void (*) (notify_payload_t *,notify_message_type_t)) set_notify_message_type;
+	this->public.get_notify_type = (notify_type_t (*) (notify_payload_t *)) get_notify_type;
+	this->public.set_notify_type = (void (*) (notify_payload_t *,notify_type_t)) set_notify_type;
 	this->public.get_spi = (u_int32_t (*) (notify_payload_t *)) get_spi;
 	this->public.set_spi = (void (*) (notify_payload_t *,u_int32_t)) set_spi;
 	this->public.get_notification_data = (chunk_t (*) (notify_payload_t *)) get_notification_data;
@@ -432,7 +446,7 @@ notify_payload_t *notify_payload_create()
 	this->next_payload = NO_PAYLOAD;
 	this->payload_length = NOTIFY_PAYLOAD_HEADER_LENGTH;
 	this->protocol_id = 0;
-	this->notify_message_type = 0;
+	this->notify_type = 0;
 	this->spi.ptr = NULL;
 	this->spi.len = 0;
 	this->spi_size = 0;
@@ -440,17 +454,17 @@ notify_payload_t *notify_payload_create()
 	this->notification_data.len = 0;
 	this->logger = logger_manager->get_logger(logger_manager, PAYLOAD);
 
-	return (&(this->public));
+	return &this->public;
 }
 
 /*
  * Described in header.
  */
-notify_payload_t *notify_payload_create_from_protocol_and_type(protocol_id_t protocol_id, notify_message_type_t notify_message_type)
+notify_payload_t *notify_payload_create_from_protocol_and_type(protocol_id_t protocol_id, notify_type_t notify_type)
 {
 	notify_payload_t *notify = notify_payload_create();
 
-	notify->set_notify_message_type(notify,notify_message_type);
+	notify->set_notify_type(notify,notify_type);
 	notify->set_protocol_id(notify,protocol_id);
 	
 	return notify;

src/charon/encoding/payloads/notify_payload.h

@@ -37,7 +37,7 @@
  */
 #define NOTIFY_PAYLOAD_HEADER_LENGTH 8
 
-typedef enum notify_message_type_t notify_message_type_t;
+typedef enum notify_type_t notify_type_t;
 
 
 /** 
@@ -47,7 +47,7 @@ typedef enum notify_message_type_t notify_message_type_t;
  * 
  * @ingroup payloads
  */
-enum notify_message_type_t {
+enum notify_type_t {
 	UNSUPPORTED_CRITICAL_PAYLOAD = 1,
 	INVALID_IKE_SPI = 4,
 	INVALID_MAJOR_VERSION = 5,
@@ -72,11 +72,11 @@ enum notify_message_type_t {
 };
 
 /** 
- * String mappings for notify_message_type_t.
+ * String mappings for notify_type_t.
  * 
  * @ingroup payloads
  */
-extern mapping_t notify_message_type_m[];
+extern mapping_t notify_type_m[];
 
 
 typedef struct notify_payload_t notify_payload_t;
@@ -122,7 +122,7 @@ struct notify_payload_t {
 	 * @param this 		calling notify_payload_t object
 	 * @return 			notify message type of this payload
 	 */
-	notify_message_type_t (*get_notify_message_type) (notify_payload_t *this);
+	notify_type_t (*get_notify_type) (notify_payload_t *this);
 
 	/**
 	 * @brief Sets notify message type of this payload.
@@ -130,7 +130,7 @@ struct notify_payload_t {
 	 * @param this 		calling notify_payload_t object
 	 * @param type		notify message type to set
 	 */
-	void (*set_notify_message_type) (notify_payload_t *this, notify_message_type_t type);
+	void (*set_notify_type) (notify_payload_t *this, notify_type_t type);
 
 	/**
 	 * @brief Returns the currently set spi of this payload.
@@ -193,12 +193,12 @@ notify_payload_t *notify_payload_create(void);
  * @brief Creates an notify_payload_t object of specific type for specific protocol id.
  * 
  * @param protocol_id			protocol id (IKE, AH or ESP)
- * @param notify_message_type	notify type (see notify_message_type_t)
+ * @param type					notify type (see notify_type_t)
  * @return						notify_payload_t object
  * 
  * @ingroup payloads
  */
-notify_payload_t *notify_payload_create_from_protocol_and_type(protocol_id_t protocol_id, notify_message_type_t notify_message_type);
+notify_payload_t *notify_payload_create_from_protocol_and_type(protocol_id_t protocol_id, notify_type_t type);
 
 
 #endif /*NOTIFY_PAYLOAD_H_*/

src/charon/encoding/payloads/payload.c

@@ -73,6 +73,37 @@ mapping_t payload_type_m[] = {
 	{MAPPING_END, NULL}
 };
 
+/*
+ * build the short mappings for payload_type_t
+ */
+mapping_t payload_type_short_m[] = {
+	{NO_PAYLOAD, "--"},
+	{SECURITY_ASSOCIATION, "SA"},
+	{KEY_EXCHANGE, "KE"},
+	{ID_INITIATOR, "IDi"},
+	{ID_RESPONDER, "IDr"},
+	{CERTIFICATE, "CERT"},
+	{CERTIFICATE_REQUEST, "CERTREQ"},
+	{AUTHENTICATION, "AUTH"},
+	{NONCE, "No"},
+	{NOTIFY, "N"},
+	{DELETE, "D"},
+	{VENDOR_ID, "V"},
+	{TRAFFIC_SELECTOR_INITIATOR, "TSi"},
+	{TRAFFIC_SELECTOR_RESPONDER, "TSr"},
+	{ENCRYPTED, "E"},
+	{CONFIGURATION, "CP"},
+	{EXTENSIBLE_AUTHENTICATION, "EAP"},
+	{HEADER, "HDR"},
+	{PROPOSAL_SUBSTRUCTURE, "PROP"},
+	{TRANSFORM_SUBSTRUCTURE, "TRANS"},
+	{TRANSFORM_ATTRIBUTE, "TRANSATTR"},
+	{TRAFFIC_SELECTOR_SUBSTRUCTURE, "TSSUB"},
+	{CONFIGURATION_ATTRIBUTE, "CPATTR"},
+	{UNKNOWN_PAYLOAD, "??"},
+	{MAPPING_END, NULL}
+};
+
 /*
  * see header
  */

src/charon/encoding/payloads/payload.h

@@ -188,6 +188,11 @@ enum payload_type_t{
  */
 extern mapping_t payload_type_m[];
 
+/**
+ * Special string mappings for payload_type_t in a short form.
+ */
+extern mapping_t payload_type_short_m[];
+
 
 typedef struct payload_t payload_t;
 

src/charon/encoding/payloads/proposal_substructure.c

@@ -632,15 +632,11 @@ proposal_substructure_t *proposal_substructure_create_from_proposal(proposal_t *
 	iterator->destroy(iterator);
 	
 	/* take over general infos */
-	this->spi_size = proposal->get_protocol(proposal) == PROTO_IKE ? 8 : 4;
+	this->spi_size = proposal->get_protocol(proposal) == PROTO_IKE ? 0 : 4;
 	this->spi.len = this->spi_size;
-	this->spi.ptr = malloc(this->spi_size);
-	if (this->spi_size == 8)
-	{
-		*((u_int64_t*)this->spi.ptr) = proposal->get_spi(proposal);
-	}
-	else
+	if (this->spi_size == 4)
 	{
+		this->spi.ptr = malloc(this->spi_size);
 		*((u_int32_t*)this->spi.ptr) = proposal->get_spi(proposal);
 	}
 	this->proposal_number = 0;

src/charon/encoding/payloads/sa_payload.c

@@ -303,7 +303,7 @@ static linked_list_t *get_proposals(private_sa_payload_t *this)
 			if (ignore_struct_number < struct_number)
 			{
 				/* remova an already added, if first of series */
-				proposal_list->remove_last(proposal_list, (void**)proposal);
+				proposal_list->remove_last(proposal_list, (void**)&proposal);
 				proposal->destroy(proposal);
 				ignore_struct_number = struct_number;
 			}