reimplemented CHILD_SA rekeying & delete

no simultanous transaction with CHILD_SAs yet!
2006-07-07 07:04:07 +00:00
parent 54da7eb962
commit 698d774918
21 changed files with 1594 additions and 306 deletions
@@ -0,0 +1,809 @@
+/**
+ * @file create_child_sa.c
+ *
+ * @brief Implementation of create_child_sa_t transaction.
+ *
+ */
+
+/*
+ * Copyright (C) 2006 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#include "create_child_sa.h"
+
+#include <string.h>
+
+#include <daemon.h>
+#include <encoding/payloads/sa_payload.h>
+#include <encoding/payloads/nonce_payload.h>
+#include <encoding/payloads/ts_payload.h>
+#include <sa/child_sa.h>
+#include <sa/transactions/delete_child_sa.h>
+#include <utils/randomizer.h>
+
+
+typedef struct private_create_child_sa_t private_create_child_sa_t;
+
+/**
+ * Private members of a create_child_sa_t object..
+ */
+struct private_create_child_sa_t {
+	
+	/**
+	 * Public methods and transaction_t interface.
+	 */
+	create_child_sa_t public;
+	
+	/**
+	 * Assigned IKE_SA.
+	 */
+	ike_sa_t *ike_sa;
+	
+	/**
+	 * Message sent by our peer, if already generated
+	 */
+	message_t *message;
+	
+	/**
+	 * Message ID this transaction uses
+	 */
+	u_int32_t message_id;
+	
+	/**
+	 * Times we did send the request
+	 */
+	u_int32_t requested;
+	
+	/**
+	 * initiators inbound SPI of the CHILD_SA which gets rekeyed
+	 */
+	u_int32_t rekey_spi;
+	
+	/**
+	 * connection of IKE_SA
+	 */
+	connection_t *connection;
+	
+	/**
+	 * policy definition used
+	 */
+	policy_t *policy;
+	
+	/**
+	 * Negotiated proposal used for CHILD_SA
+	 */
+	proposal_t *proposal;
+	
+	/**
+	 * initiator chosen nonce
+	 */
+	chunk_t nonce_i;
+	
+	/**
+	 * responder chosen nonce
+	 */
+	chunk_t nonce_r;
+	
+	/**
+	 * Negotiated traffic selectors for initiator
+	 */
+	linked_list_t *tsi;
+	
+	/**
+	 * Negotiated traffic selectors for responder
+	 */
+	linked_list_t *tsr;
+	
+	/**
+	 * CHILD_SA created by this transaction
+	 */
+	child_sa_t *child_sa;
+	
+	/**
+	 * CHILD_SA rekeyed if we are rekeying
+	 */
+	child_sa_t *rekeyed_sa;
+	
+	/**
+	 * source of randomness
+	 */
+	randomizer_t *randomizer;
+	
+	/**
+	 * Assigned logger.
+	 */
+	logger_t *logger;
+};
+
+/**
+ * Implementation of transaction_t.get_message_id.
+ */
+static u_int32_t get_message_id(private_create_child_sa_t *this)
+{
+	return this->message_id;
+}
+
+/**
+ * Implementation of transaction_t.requested.
+ */
+static u_int32_t requested(private_create_child_sa_t *this)
+{
+	return this->requested++;
+}
+
+/**
+ * Implementation of transaction_t.rekeys_child.
+ */
+static void rekeys_child(private_create_child_sa_t *this, child_sa_t *child_sa)
+{
+	this->rekeyed_sa = child_sa;
+}
+
+/**
+ * Implementation of transaction_t.get_request.
+ */
+static status_t get_request(private_create_child_sa_t *this, message_t **result)
+{
+	message_t *request;
+	host_t *me, *other;
+	
+	/* check if we already have built a message (retransmission) */
+	if (this->message)
+	{
+		*result = this->message;
+		return SUCCESS;
+	}
+	
+	this->connection = this->ike_sa->get_connection(this->ike_sa);
+	me = this->connection->get_my_host(this->connection);
+	other = this->connection->get_other_host(this->connection);
+	this->policy = this->ike_sa->get_policy(this->ike_sa);
+	
+	/* build the request */
+	request = message_create();
+	request->set_source(request, me->clone(me));
+	request->set_destination(request, other->clone(other));
+	request->set_exchange_type(request, CREATE_CHILD_SA);
+	request->set_request(request, TRUE);
+	request->set_message_id(request, this->message_id);
+	request->set_ike_sa_id(request, this->ike_sa->get_id(this->ike_sa));
+	*result = request;
+	this->message = request;
+	
+	{	/* build SA payload */
+		sa_payload_t *sa_payload;
+		linked_list_t *proposals;
+		bool use_natt;
+		u_int32_t reqid = 0;
+		
+		if (this->rekeyed_sa)
+		{
+			reqid = this->rekeyed_sa->get_reqid(this->rekeyed_sa);
+		}
+		
+		proposals = this->policy->get_proposals(this->policy);
+		use_natt = this->ike_sa->is_natt_enabled(this->ike_sa);
+		this->child_sa = child_sa_create(reqid, me, other,
+							this->policy->get_soft_lifetime(this->policy),
+							this->policy->get_hard_lifetime(this->policy),
+							use_natt);
+		if (this->child_sa->alloc(this->child_sa, proposals) != SUCCESS)
+		{
+			this->logger->log(this->logger, ERROR,
+							  "could not install CHILD_SA, CHILD_SA creation aborted");
+			return FAILED;
+		}
+		sa_payload = sa_payload_create_from_proposal_list(proposals);
+		request->add_payload(request, (payload_t*)sa_payload);
+	}
+	
+	{	/* build the NONCE payload for us (initiator) */
+		nonce_payload_t *nonce_payload;
+		
+		if (this->randomizer->allocate_pseudo_random_bytes(this->randomizer, 
+			NONCE_SIZE, &this->nonce_i) != SUCCESS)
+		{
+			return FAILED;
+		}
+		nonce_payload = nonce_payload_create();
+		nonce_payload->set_nonce(nonce_payload, this->nonce_i);
+		request->add_payload(request, (payload_t*)nonce_payload);
+	}
+	
+	{	/* build TSi payload */
+		linked_list_t *ts_list;
+		ts_payload_t *ts_payload;
+		
+		ts_list = this->policy->get_my_traffic_selectors(this->policy);
+		ts_payload = ts_payload_create_from_traffic_selectors(TRUE, ts_list);
+		request->add_payload(request, (payload_t*)ts_payload);
+	}
+	
+	{	/* build TSr payload */
+		linked_list_t *ts_list;
+		ts_payload_t *ts_payload;
+		
+		ts_list = this->policy->get_other_traffic_selectors(this->policy);
+		ts_payload = ts_payload_create_from_traffic_selectors(FALSE, ts_list);
+		request->add_payload(request, (payload_t*)ts_payload);
+	}
+	
+	if (this->rekeyed_sa)
+	{	/* add REKEY_SA notify if we are rekeying */
+		notify_payload_t *notify;
+		protocol_id_t protocol;
+		
+		protocol = this->rekeyed_sa->get_protocol(this->rekeyed_sa);
+		notify = notify_payload_create_from_protocol_and_type(protocol, REKEY_SA);
+		notify->set_spi(notify, this->rekeyed_sa->get_spi(this->rekeyed_sa, TRUE));
+		request->add_payload(request, (payload_t*)notify);
+		
+		/* and mark sa with rekeying-in-progress */
+		this->rekeyed_sa->set_rekeyed(this->rekeyed_sa);
+	}
+	
+	return SUCCESS;
+}
+
+/**
+ * Handle all kind of notifys
+ */
+static status_t process_notifys(private_create_child_sa_t *this, notify_payload_t *notify_payload)
+{
+	notify_type_t notify_type = notify_payload->get_notify_type(notify_payload);
+	
+	this->logger->log(this->logger, CONTROL|LEVEL1, "process notify type %s",
+					  mapping_find(notify_type_m, notify_type));
+
+	switch (notify_type)
+	{
+		case SINGLE_PAIR_REQUIRED:
+		{
+			this->logger->log(this->logger, AUDIT, 
+							  "received a SINGLE_PAIR_REQUIRED notify");
+			return FAILED;
+		}
+		case TS_UNACCEPTABLE:
+		{
+			this->logger->log(this->logger, CONTROL, 
+							  "received TS_UNACCEPTABLE notify");
+			return FAILED;
+		}
+		case NO_PROPOSAL_CHOSEN:
+		{
+			this->logger->log(this->logger, CONTROL,
+							  "received NO_PROPOSAL_CHOSEN notify");
+			return FAILED;
+		}
+		case REKEY_SA:
+		{
+			u_int32_t spi;
+			protocol_id_t protocol;
+			
+			protocol = notify_payload->get_protocol_id(notify_payload);
+			switch (protocol)
+			{
+				case PROTO_AH:
+				case PROTO_ESP:
+					spi = notify_payload->get_spi(notify_payload);
+					this->rekeyed_sa = this->ike_sa->get_child_sa(this->ike_sa, 
+																  protocol, spi,
+																  FALSE);
+					break;
+				default:
+					break;
+			}
+			return SUCCESS;
+		}
+		default:
+		{
+			if (notify_type < 16383)
+			{
+				this->logger->log(this->logger, AUDIT, 
+								  "received %s notify error (%d), deleting IKE_SA",
+								  mapping_find(notify_type_m, notify_type),
+								  notify_type);
+				return FAILED;	
+			}
+			else
+			{
+				this->logger->log(this->logger, CONTROL, 
+								  "received %s notify (%d), ignored",
+								  mapping_find(notify_type_m, notify_type),
+								  notify_type);
+				return SUCCESS;
+			}
+		}
+	}
+}
+
+/**
+ * Build a notify message.
+ */
+static void build_notify(notify_type_t type, message_t *message, bool flush_message)
+{
+	notify_payload_t *notify;
+	
+	if (flush_message)
+	{
+		payload_t *payload;
+		iterator_t *iterator = message->get_payload_iterator(message);
+		while (iterator->iterate(iterator, (void**)&payload))
+		{
+			payload->destroy(payload);
+			iterator->remove(iterator);
+		}
+		iterator->destroy(iterator);
+	}
+	
+	notify = notify_payload_create();
+	notify->set_notify_type(notify, type);
+	message->add_payload(message, (payload_t*)notify);
+}
+
+/**
+ * Install a CHILD_SA for usage
+ */
+static status_t install_child_sa(private_create_child_sa_t *this, bool initiator)
+{
+	prf_plus_t *prf_plus;
+	chunk_t seed;
+	status_t status;
+	
+	seed = chunk_alloc(this->nonce_i.len + this->nonce_r.len);
+	memcpy(seed.ptr, this->nonce_i.ptr, this->nonce_i.len);
+	memcpy(seed.ptr + this->nonce_i.len, this->nonce_r.ptr, this->nonce_r.len);
+	prf_plus = prf_plus_create(this->ike_sa->get_child_prf(this->ike_sa), seed);
+	chunk_free(&seed);
+	
+	if (initiator)
+	{
+		status = this->child_sa->update(this->child_sa, this->proposal, prf_plus);
+	}
+	else
+	{
+		status = this->child_sa->add(this->child_sa, this->proposal, prf_plus);
+	}
+	prf_plus->destroy(prf_plus);
+	if (status != SUCCESS)
+	{
+		return DESTROY_ME;
+	}
+	if (initiator)
+	{
+		status = this->child_sa->add_policies(this->child_sa, this->tsi, this->tsr);
+	}
+	else
+	{
+		status = this->child_sa->add_policies(this->child_sa, this->tsr, this->tsi);
+	}
+	if (status != SUCCESS)
+	{
+		return DESTROY_ME;
+	}
+	/* add to IKE_SA, and remove from transaction */
+	this->ike_sa->add_child_sa(this->ike_sa, this->child_sa);
+	this->child_sa = NULL;
+	return SUCCESS;
+}
+
+/**
+ * destroy a list of traffic selectors
+ */
+static void destroy_ts_list(linked_list_t *list)
+{
+	if (list)
+	{
+		traffic_selector_t *ts;
+		while (list->remove_last(list, (void**)&ts) == SUCCESS)
+		{
+			ts->destroy(ts);
+		}
+		list->destroy(list);
+	}
+}
+
+/**
+ * Implementation of transaction_t.get_response.
+ */
+static status_t get_response(private_create_child_sa_t *this, message_t *request, 
+							 message_t **result, transaction_t **next)
+{
+	host_t *me, *other;
+	message_t *response;
+	status_t status;
+	iterator_t *payloads;
+	sa_payload_t *sa_request = NULL;
+	nonce_payload_t *nonce_request = NULL;
+	ts_payload_t *tsi_request = NULL;
+	ts_payload_t *tsr_request = NULL;
+	
+	/* check if we already have built a response (retransmission) */
+	if (this->message)
+	{
+		*result = this->message;
+		return SUCCESS;
+	}
+	
+	this->connection = this->ike_sa->get_connection(this->ike_sa);
+	me = this->connection->get_my_host(this->connection);
+	other = this->connection->get_other_host(this->connection);
+	this->policy = this->ike_sa->get_policy(this->ike_sa);
+	
+	/* set up response */
+	response = message_create();
+	response->set_source(response, me->clone(me));
+	response->set_destination(response, other->clone(other));
+	response->set_exchange_type(response, CREATE_CHILD_SA);
+	response->set_request(response, FALSE);
+	response->set_message_id(response, this->message_id);
+	response->set_ike_sa_id(response, this->ike_sa->get_id(this->ike_sa));
+	this->message = response;
+	*result = response;
+	
+	/* check message type */
+	if (request->get_exchange_type(request) != CREATE_CHILD_SA)
+	{
+		this->logger->log(this->logger, ERROR,
+						  "CREATE_CHILD_SA response of invalid type, aborted");
+		return FAILED;
+	}
+	
+	/* Iterate over all payloads. */
+	payloads = request->get_payload_iterator(request);
+	while (payloads->has_next(payloads))
+	{
+		payload_t *payload;
+		payloads->current(payloads, (void**)&payload);
+		switch (payload->get_type(payload))
+		{
+			case SECURITY_ASSOCIATION:
+				sa_request = (sa_payload_t*)payload;
+				break;
+			case NONCE:
+				nonce_request = (nonce_payload_t*)payload;
+				break;
+			case TRAFFIC_SELECTOR_INITIATOR:
+				tsi_request = (ts_payload_t*)payload;
+				break;	
+			case TRAFFIC_SELECTOR_RESPONDER:
+				tsr_request = (ts_payload_t*)payload;
+				break;
+			case NOTIFY:
+			{
+				status = process_notifys(this, (notify_payload_t*)payload);
+				if (status != SUCCESS)
+				{
+					payloads->destroy(payloads);
+					return status;
+				}
+				break;
+			}
+			default:
+			{
+				this->logger->log(this->logger, ERROR, "ignoring %s payload (%d)", 
+								  mapping_find(payload_type_m, payload->get_type(payload)),
+								  payload->get_type(payload));
+				break;
+			}
+		}
+	}
+	payloads->destroy(payloads);
+	
+	/* check if we have all payloads */
+	if (!(sa_request && nonce_request && tsi_request && tsr_request))
+	{
+		build_notify(INVALID_SYNTAX, response, TRUE);
+		this->logger->log(this->logger, AUDIT, 
+						  "request message incomplete, no CHILD_SA created");
+		return FAILED;
+	}
+	
+	{	/* process nonce payload */
+		nonce_payload_t *nonce_response;
+		
+		this->nonce_i = nonce_request->get_nonce(nonce_request);
+		if (this->randomizer->allocate_pseudo_random_bytes(this->randomizer, 
+			NONCE_SIZE, &this->nonce_r) != SUCCESS)
+		{
+			build_notify(NO_PROPOSAL_CHOSEN, response, TRUE);
+			return FAILED;
+		}
+		nonce_response = nonce_payload_create();
+		nonce_response->set_nonce(nonce_response, this->nonce_r);
+		response->add_payload(response, (payload_t *)nonce_response);
+	}
+	
+	{	/* process traffic selectors for other */
+		linked_list_t *ts_received = tsi_request->get_traffic_selectors(tsi_request);
+		this->tsi = this->policy->select_other_traffic_selectors(this->policy, ts_received);
+		destroy_ts_list(ts_received);
+	}
+	
+	{	/* process traffic selectors for us */
+		linked_list_t *ts_received = ts_received = tsr_request->get_traffic_selectors(tsr_request);
+		this->tsr = this->policy->select_my_traffic_selectors(this->policy, ts_received);
+		destroy_ts_list(ts_received);
+	}
+	
+	{	/* process SA payload */
+		proposal_t *proposal;
+		linked_list_t *proposal_list;
+		sa_payload_t *sa_response;
+		ts_payload_t *ts_response;
+		bool use_natt;
+		u_int32_t soft_lifetime, hard_lifetime;
+		
+		sa_response = sa_payload_create();
+		/* get proposals from request, and select one with ours */
+		proposal_list = sa_request->get_proposals(sa_request);
+		this->logger->log(this->logger, CONTROL|LEVEL1, "selecting proposals:");
+		this->proposal = this->policy->select_proposal(this->policy, proposal_list);
+		/* list is not needed anymore */
+		while (proposal_list->remove_last(proposal_list, (void**)&proposal) == SUCCESS)
+		{
+			proposal->destroy(proposal);
+		}
+		proposal_list->destroy(proposal_list);
+
+		/* do we have a proposal? */
+		if (this->proposal == NULL)
+		{
+			this->logger->log(this->logger, AUDIT, 
+							  "CHILD_SA proposals unacceptable, adding NO_PROPOSAL_CHOSEN notify");
+			build_notify(NO_PROPOSAL_CHOSEN, response, TRUE);
+			return FAILED;
+		}
+		/* do we have traffic selectors? */
+		else if (this->tsi->get_count(this->tsi) == 0 || this->tsr->get_count(this->tsr) == 0)
+		{
+			this->logger->log(this->logger, AUDIT,
+							  "CHILD_SA traffic selectors unacceptable, adding TS_UNACCEPTABLE notify");
+			build_notify(TS_UNACCEPTABLE, response, TRUE);
+			return FAILED;
+		}
+		else
+		{	/* create child sa */
+			u_int32_t reqid = 0;
+		
+			if (this->rekeyed_sa)
+			{
+				reqid = this->rekeyed_sa->get_reqid(this->rekeyed_sa);
+			}
+			soft_lifetime = this->policy->get_soft_lifetime(this->policy);
+			hard_lifetime = this->policy->get_hard_lifetime(this->policy);
+			use_natt = this->ike_sa->is_natt_enabled(this->ike_sa);
+			this->child_sa = child_sa_create(reqid, me, other,
+											 soft_lifetime, hard_lifetime,
+											 use_natt);
+			if (install_child_sa(this, FALSE) != SUCCESS)
+			{
+				this->logger->log(this->logger, ERROR,
+								  "installing CHILD_SA failed, adding NO_PROPOSAL_CHOSEN notify");
+				build_notify(NO_PROPOSAL_CHOSEN, response, TRUE);
+				return FAILED;
+			}
+			/* add proposal to sa payload */
+			sa_response->add_proposal(sa_response, this->proposal);
+		}
+		response->add_payload(response, (payload_t*)sa_response);
+		
+		/* add ts payload after sa payload */
+		ts_response = ts_payload_create_from_traffic_selectors(TRUE, this->tsi);
+		response->add_payload(response, (payload_t*)ts_response);
+		ts_response = ts_payload_create_from_traffic_selectors(FALSE, this->tsr);
+		response->add_payload(response, (payload_t*)ts_response);
+	}
+	/* CHILD_SA successfully created. Now we must check if it rekeys an old one, 
+	 * and if so, mark the old as rekeyed. It will get deleted from the other
+	 * peer. */
+	if (this->rekeyed_sa)
+	{
+		this->rekeyed_sa->set_rekeyed(this->rekeyed_sa);
+	}
+	return SUCCESS;
+}
+
+/**
+ * Implementation of transaction_t.conclude
+ */
+static status_t conclude(private_create_child_sa_t *this, message_t *response, 
+						 transaction_t **next)
+{
+	iterator_t *payloads;
+	host_t *me, *other;
+	sa_payload_t *sa_payload = NULL;
+	nonce_payload_t *nonce_payload = NULL;
+	ts_payload_t *tsi_payload = NULL;
+	ts_payload_t *tsr_payload = NULL;
+	status_t status;
+	
+	/* check message type */
+	if (response->get_exchange_type(response) != CREATE_CHILD_SA)
+	{
+		this->logger->log(this->logger, ERROR,
+						  "CREATE_CHILD_SA response of invalid type, aborting");
+		return FAILED;
+	}
+	
+	me = this->connection->get_my_host(this->connection);
+	other = this->connection->get_other_host(this->connection);
+	
+	/* Iterate over all payloads to collect them */
+	payloads = response->get_payload_iterator(response);
+	while (payloads->has_next(payloads))
+	{
+		payload_t *payload;
+		payloads->current(payloads, (void**)&payload);
+		switch (payload->get_type(payload))
+		{
+			case SECURITY_ASSOCIATION:
+				sa_payload = (sa_payload_t*)payload;
+				break;
+			case NONCE:
+				nonce_payload = (nonce_payload_t*)payload;
+				break;
+			case TRAFFIC_SELECTOR_INITIATOR:
+				tsi_payload = (ts_payload_t*)payload;
+				break;	
+			case TRAFFIC_SELECTOR_RESPONDER:
+				tsr_payload = (ts_payload_t*)payload;
+				break;
+			case NOTIFY:
+			{
+				status = process_notifys(this, (notify_payload_t*)payload);
+				if (status != SUCCESS)
+				{
+					payloads->destroy(payloads);
+					return status;
+				}
+				break;
+			}
+			default:
+			{
+				this->logger->log(this->logger, ERROR, "ignoring %s payload (%d)", 
+								  mapping_find(payload_type_m, payload->get_type(payload)),
+								  payload->get_type(payload));
+				break;
+			}
+		}
+	}
+	payloads->destroy(payloads);
+	
+	if (!(sa_payload && nonce_payload && tsi_payload && tsr_payload))
+	{
+		this->logger->log(this->logger, AUDIT, "response message incomplete, no CHILD_SA built");
+		return FAILED;
+	}
+	
+	{	/* process NONCE payload  */
+		this->nonce_r = nonce_payload->get_nonce(nonce_payload);
+	}
+	
+	{	/* process traffic selectors for us */
+		linked_list_t *ts_received = tsi_payload->get_traffic_selectors(tsi_payload);
+		this->tsi = this->policy->select_my_traffic_selectors(this->policy, ts_received);
+		destroy_ts_list(ts_received);
+	}
+	
+	{	/* process traffic selectors for other */
+		linked_list_t *ts_received = tsr_payload->get_traffic_selectors(tsr_payload);
+		this->tsr = this->policy->select_other_traffic_selectors(this->policy, ts_received);
+		destroy_ts_list(ts_received);
+	}
+	
+	{	/* process sa payload */
+		proposal_t *proposal;
+		linked_list_t *proposal_list;
+		
+		proposal_list = sa_payload->get_proposals(sa_payload);
+		/* we have to re-check here if other's selection is valid */
+		this->proposal = this->policy->select_proposal(this->policy, proposal_list);
+		/* list not needed anymore */
+		while (proposal_list->remove_last(proposal_list, (void**)&proposal) == SUCCESS)
+		{
+			proposal->destroy(proposal);
+		}
+		proposal_list->destroy(proposal_list);
+		
+		/* everything fine to create CHILD? */
+		if (this->proposal == NULL ||
+			this->tsi->get_count(this->tsi) == 0 ||
+			this->tsr->get_count(this->tsr) == 0)
+		{
+			this->logger->log(this->logger, AUDIT,
+							  "CHILD_SA creation failed");
+			return FAILED;
+		}
+		if (install_child_sa(this, TRUE) != SUCCESS)
+		{
+			this->logger->log(this->logger, ERROR,
+							"installing CHILD_SA failed, no CHILD_SA built");
+			return FAILED;
+		}
+	}
+	/* CHILD_SA successfully created. If we have rekeyed an old one, delete it */
+	if (this->rekeyed_sa)
+	{
+		delete_child_sa_t *delete_child_sa;
+		
+		delete_child_sa = delete_child_sa_create(this->ike_sa, 
+												 this->message_id + 1);
+		delete_child_sa->set_child_sa(delete_child_sa, this->rekeyed_sa);
+		*next = (transaction_t*)delete_child_sa;
+	}
+	return SUCCESS;
+}
+
+/**
+ * implements transaction_t.destroy
+ */
+static void destroy(private_create_child_sa_t *this)
+{
+	if (this->message)
+	{
+		this->message->destroy(this->message);
+	}
+	if (this->proposal)
+	{
+		this->proposal->destroy(this->proposal);
+	}
+	if (this->child_sa)
+	{
+		this->child_sa->destroy(this->child_sa);
+	}
+	destroy_ts_list(this->tsi);
+	destroy_ts_list(this->tsr);
+	chunk_free(&this->nonce_i);
+	chunk_free(&this->nonce_r);
+	this->randomizer->destroy(this->randomizer);
+	free(this);
+}
+
+/*
+ * Described in header.
+ */
+create_child_sa_t *create_child_sa_create(ike_sa_t *ike_sa, u_int32_t message_id)
+{
+	private_create_child_sa_t *this = malloc_thing(private_create_child_sa_t);
+	
+	/* transaction interface functions */
+	this->public.transaction.get_request = (status_t(*)(transaction_t*,message_t**))get_request;
+	this->public.transaction.get_response = (status_t(*)(transaction_t*,message_t*,message_t**,transaction_t**))get_response;
+	this->public.transaction.conclude = (status_t(*)(transaction_t*,message_t*,transaction_t**))conclude;
+	this->public.transaction.get_message_id = (u_int32_t(*)(transaction_t*))get_message_id;
+	this->public.transaction.requested = (u_int32_t(*)(transaction_t*))requested;
+	this->public.transaction.destroy = (void(*)(transaction_t*))destroy;
+	
+	/* public functions */
+	this->public.rekeys_child = (void(*)(create_child_sa_t*,child_sa_t*))rekeys_child;
+	
+	/* private data */
+	this->ike_sa = ike_sa;
+	this->message_id = message_id;
+	this->message = NULL;
+	this->requested = 0;
+	this->rekey_spi = 0;
+	this->nonce_i = CHUNK_INITIALIZER;
+	this->nonce_r = CHUNK_INITIALIZER;
+	this->child_sa = NULL;
+	this->rekeyed_sa = NULL;
+	this->proposal = NULL;
+	this->tsi = NULL;
+	this->tsr = NULL;
+	this->randomizer = randomizer_create();
+	this->logger = logger_manager->get_logger(logger_manager, IKE_SA);
+	
+	return &this->public;
+}
@@ -0,0 +1,77 @@
+/**
+ * @file create_child_sa.h
+ * 
+ * @brief Interface of transaction create_child_sa.
+ * 
+ */
+
+/*
+ * Copyright (C) 2006 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+
+#ifndef CREATE_CHILD_SA_
+#define CREATE_CHILD_SA_
+
+#include <sa/ike_sa.h>
+#include <sa/child_sa.h>
+#include <sa/transactions/transaction.h>
+
+
+typedef struct create_child_sa_t create_child_sa_t;
+
+/**
+ * @brief A transaction to create a new or rekey an existing CHILD_SA.
+ *
+ * Rekeying of an CHILD_SA works the same way as creating a new one,
+ * but includes an additional REKEY_SA notify and deletes the old
+ * one (in a separate transaction).
+ *
+ * @b Constructors:
+ *  - create_child_sa_create()
+ *  - transaction_create() with the appropriate message
+ *
+ * @ingroup transactions
+ */
+struct create_child_sa_t {
+	
+	/**
+	 * The transaction_t interface.
+	 */
+	transaction_t transaction;
+	
+	/**
+	 * @brief Set the CHILD_SA which gets rekeyed by the new one.
+	 *
+	 * If this transaction is used for rekeying, set the inbound
+	 * SPI of the CHILD_SA which the new CHILD_SA rekeys.
+	 *
+	 * @param this		calling object
+	 * @param child_sa	CHILD_SA to rekey
+	 */
+	void (*rekeys_child) (create_child_sa_t* this, child_sa_t *child_sa);
+};
+
+/**
+ * @brief Create a new transaction which creates/rekeys CHILD_SAs.
+ *
+ * @param ike_sa		assigned IKE_SA
+ * @param message_id	message ids used in this transaction
+ * @return				created create_child_sa transaction
+ *
+ * @ingroup transactions
+ */
+create_child_sa_t *create_child_sa_create(ike_sa_t *ike_sa, u_int32_t message_id);
+
+#endif /* CREATE_CHILD_SA_ */
@@ -0,0 +1,352 @@
+/**
+ * @file delete_child_sa.c
+ *
+ * @brief Implementation of the delete_child_sa transaction.
+ *
+ */
+
+/*
+ * Copyright (C) 2006 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#include "delete_child_sa.h"
+
+#include <daemon.h>
+#include <encoding/payloads/delete_payload.h>
+
+
+typedef struct private_delete_child_sa_t private_delete_child_sa_t;
+
+/**
+ * Private members of a delete_child_sa_t object..
+ */
+struct private_delete_child_sa_t {
+	
+	/**
+	 * Public methods and transaction_t interface.
+	 */
+	delete_child_sa_t public;
+	
+	/**
+	 * Assigned IKE_SA.
+	 */
+	ike_sa_t *ike_sa;
+	
+	/**
+	 * Message sent by our peer, if already generated
+	 */
+	message_t *message;
+	
+	/**
+	 * Message ID this transaction uses
+	 */
+	u_int32_t message_id;
+	
+	/**
+	 * Times we did send the request
+	 */
+	u_int32_t requested;
+	
+	/**
+	 * CHILD SA to delete
+	 */
+	child_sa_t *child_sa;
+	
+	/**
+	 * Assigned logger.
+	 */
+	logger_t *logger;
+};
+
+/**
+ * Implementation of transaction_t.get_message_id.
+ */
+static u_int32_t get_message_id(private_delete_child_sa_t *this)
+{
+	return this->message_id;
+}
+
+/**
+ * Implementation of transaction_t.requested.
+ */
+static u_int32_t requested(private_delete_child_sa_t *this)
+{
+	return this->requested++;
+}
+
+/**
+ * Implementation of delete_child_sa_t.set_child_sa.
+ */
+static void set_child_sa(private_delete_child_sa_t *this, child_sa_t *child_sa)
+{
+	this->child_sa = child_sa;
+}
+
+/**
+ * Implementation of transaction_t.get_request.
+ */
+static status_t get_request(private_delete_child_sa_t *this, message_t **result)
+{
+	message_t *request;
+	connection_t *connection;
+	host_t *me, *other;
+	
+	/* check if we already have built a message (retransmission) */
+	if (this->message)
+	{
+		*result = this->message;
+		return SUCCESS;
+	}
+	
+	connection = this->ike_sa->get_connection(this->ike_sa);
+	me = connection->get_my_host(connection);
+	other = connection->get_other_host(connection);
+	
+	/* build the request */
+	request = message_create();
+	request->set_source(request, me->clone(me));
+	request->set_destination(request, other->clone(other));
+	request->set_exchange_type(request, INFORMATIONAL);
+	request->set_request(request, TRUE);
+	request->set_message_id(request, this->message_id);
+	request->set_ike_sa_id(request, this->ike_sa->get_id(this->ike_sa));
+	*result = request;
+	this->message = request;
+	
+	{	/* add delete payload */
+		delete_payload_t *delete_payload;
+		protocol_id_t protocol;
+		u_int32_t spi;
+		
+		protocol = this->child_sa->get_protocol(this->child_sa);
+		spi = this->child_sa->get_spi(this->child_sa, TRUE);
+		delete_payload = delete_payload_create(protocol);
+		
+		this->logger->log(this->logger, CONTROL,
+						  "created DELETE payload for %s CHILD_SA with SPI 0x%x",
+						  mapping_find(protocol_id_m, protocol), htonl(spi));
+		delete_payload->add_spi(delete_payload, spi);
+		request->add_payload(request, (payload_t*)delete_payload);
+	}
+	
+	return SUCCESS;
+}
+
+/**
+ * process a delete payload
+ */
+static status_t process_delete(private_delete_child_sa_t *this, delete_payload_t *delete_request, message_t *response)
+{
+	protocol_id_t protocol;
+	u_int32_t spi;
+	iterator_t *iterator;
+	delete_payload_t *delete_response;
+	
+	/* get requested CHILD */
+	protocol = delete_request->get_protocol_id(delete_request);
+	if (protocol != PROTO_ESP && protocol != PROTO_AH)
+	{
+		this->logger->log(this->logger, CONTROL,
+						  "CHILD_SA delete response contained unexpected protocol");
+		return FAILED;
+	}
+	
+	/* prepare response payload */
+	if (response)
+	{
+		delete_response = delete_payload_create(protocol);
+		response->add_payload(response, (payload_t*)delete_response);
+	}
+
+	iterator = delete_request->create_spi_iterator(delete_request);
+	while (iterator->iterate(iterator, (void**)&spi))
+	{
+		child_sa_t *child_sa;
+		
+		child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol, spi, FALSE);
+		
+		if (child_sa != NULL)
+		{
+			this->logger->log(this->logger, CONTROL,
+							  "received DELETE for %s CHILD_SA with SPI 0x%x, deleting", 
+							  mapping_find(protocol_id_m, protocol), ntohl(spi));
+			/* delete it, with inbound spi */
+			spi = child_sa->get_spi(child_sa, TRUE);
+			this->ike_sa->destroy_child_sa(this->ike_sa, protocol, spi);
+			/* add delete response to message, if we are responding */
+			if (response)
+			{
+				delete_response->add_spi(delete_response, spi);
+			}
+		}
+		else
+		{
+			this->logger->log(this->logger, ERROR,
+							  "received DELETE for %s CHILD_SA with SPI 0x%x, but no such SA", 
+							  mapping_find(protocol_id_m, protocol), ntohl(spi));
+		}
+	}
+	iterator->destroy(iterator);
+	return SUCCESS;
+}
+
+/**
+ * Implementation of transaction_t.get_response.
+ */
+static status_t get_response(private_delete_child_sa_t *this, message_t *request, 
+							 message_t **result, transaction_t **next)
+{
+	host_t *me, *other;
+	message_t *response;
+	iterator_t *payloads;
+	connection_t *connection;
+	
+	/* check if we already have built a response (retransmission) */
+	if (this->message)
+	{
+		*result = this->message;
+		return SUCCESS;
+	}
+	
+	connection = this->ike_sa->get_connection(this->ike_sa);
+	me = connection->get_my_host(connection);
+	other = connection->get_other_host(connection);
+	
+	/* set up response */
+	response = message_create();
+	response->set_source(response, me->clone(me));
+	response->set_destination(response, other->clone(other));
+	response->set_exchange_type(response, INFORMATIONAL);
+	response->set_request(response, FALSE);
+	response->set_message_id(response, this->message_id);
+	response->set_ike_sa_id(response, this->ike_sa->get_id(this->ike_sa));
+	this->message = response;
+	*result = response;
+	
+	if (request->get_exchange_type(request) != INFORMATIONAL)
+	{
+		this->logger->log(this->logger, ERROR,
+						  "INFORMATIONAL response of invalid type, aborting");
+		return FAILED;
+	}
+	
+	/* iterate over all payloads */
+	payloads = request->get_payload_iterator(request);	
+	while (payloads->has_next(payloads))
+	{
+		payload_t *payload;
+		payloads->current(payloads, (void**)&payload);
+		
+		switch (payload->get_type(payload))
+		{
+			case DELETE:
+			{
+				process_delete(this, (delete_payload_t*)payload, response);
+				break;
+			}
+			default:
+			{
+				this->logger->log(this->logger, ERROR|LEVEL1, "ignoring payload %s (%d)",
+								  mapping_find(payload_type_m, payload->get_type(payload)),
+								  payload->get_type(payload));
+				break;
+			}
+		}
+	}
+	payloads->destroy(payloads);
+	return SUCCESS;
+}
+
+/**
+ * Implementation of transaction_t.conclude
+ */
+static status_t conclude(private_delete_child_sa_t *this, message_t *response, 
+						 transaction_t **transaction)
+{
+	iterator_t *payloads;
+	
+	/* check message type */
+	if (response->get_exchange_type(response) != INFORMATIONAL)
+	{
+		this->logger->log(this->logger, ERROR,
+						  "INFORMATIONAL response of invalid type, aborting");
+		return FAILED;
+	}
+	
+	/* iterate over all payloads */
+	payloads = response->get_payload_iterator(response);
+	while (payloads->has_next(payloads))
+	{
+		payload_t *payload;
+		payloads->current(payloads, (void**)&payload);
+		
+		switch (payload->get_type(payload))
+		{
+			case DELETE:
+			{
+				process_delete(this, (delete_payload_t*)payload, NULL);
+				break;
+			}
+			default:
+			{
+				this->logger->log(this->logger, ERROR|LEVEL1, "ignoring payload %s (%d)",
+								  mapping_find(payload_type_m, payload->get_type(payload)),
+								  payload->get_type(payload));
+				break;
+			}
+		}
+	}
+	payloads->destroy(payloads);
+	return SUCCESS;
+}
+
+/**
+ * implements transaction_t.destroy
+ */
+static void destroy(private_delete_child_sa_t *this)
+{
+	if (this->message)
+	{
+		this->message->destroy(this->message);
+	}
+	free(this);
+}
+
+/*
+ * Described in header.
+ */
+delete_child_sa_t *delete_child_sa_create(ike_sa_t *ike_sa, u_int32_t message_id)
+{
+	private_delete_child_sa_t *this = malloc_thing(private_delete_child_sa_t);
+	
+	/* transaction interface functions */
+	this->public.transaction.get_request = (status_t(*)(transaction_t*,message_t**))get_request;
+	this->public.transaction.get_response = (status_t(*)(transaction_t*,message_t*,message_t**,transaction_t**))get_response;
+	this->public.transaction.conclude = (status_t(*)(transaction_t*,message_t*,transaction_t**))conclude;
+	this->public.transaction.get_message_id = (u_int32_t(*)(transaction_t*))get_message_id;
+	this->public.transaction.requested = (u_int32_t(*)(transaction_t*))requested;
+	this->public.transaction.destroy = (void(*)(transaction_t*))destroy;
+	
+	/* publics */
+	this->public.set_child_sa = (void(*)(delete_child_sa_t*,child_sa_t*))set_child_sa;
+	
+	/* private data */
+	this->ike_sa = ike_sa;
+	this->message_id = message_id;
+	this->message = NULL;
+	this->requested = 0;
+	this->logger = logger_manager->get_logger(logger_manager, IKE_SA);
+	
+	return &this->public;
+}
@@ -0,0 +1,69 @@
+/**
+ * @file delete_child_sa.h
+ * 
+ * @brief Interface of transaction delete_child_sa.
+ * 
+ */
+
+/*
+ * Copyright (C) 2006 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+
+#ifndef DELETE_CHILD_SA_H_
+#define DELETE_CHILD_SA_H_
+
+#include <sa/ike_sa.h>
+#include <sa/transactions/transaction.h>
+
+
+typedef struct delete_child_sa_t delete_child_sa_t;
+
+/**
+ * @brief A transaction used to delete a CHILD_SA.
+ *
+ * @b Constructors:
+ *  - delete_child_sa_create()
+ *  - transaction_create() with the appropriate message
+ *
+ * @ingroup transactions
+ */
+struct delete_child_sa_t {
+	
+	/**
+	 * The transaction_t interface.
+	 */
+	transaction_t transaction;
+	
+	/**
+	 * @brief Set the CHILD_SA to delete.
+	 *
+	 * @param this		calling object
+	 * @param child_sa	CHILD_SA to rekey
+	 */
+	void (*set_child_sa) (delete_child_sa_t* this, child_sa_t *child_sa);
+};
+
+/**
+ * @brief Create a new transaction which deletes a CHILD_SA.
+ *
+ * @param ike_sa		assigned IKE_SA
+ * @param message_id	message ids used in this transaction
+ * @return				created delete_child_sa transaction
+ *
+ * @ingroup transactions
+ */
+delete_child_sa_t *delete_child_sa_create(ike_sa_t *ike_sa, u_int32_t message_id);
+
+#endif /* DELETE_CHILD_SA_H_ */
@@ -135,14 +135,6 @@ static status_t get_response(private_delete_ike_sa_t *this, message_t *request,
 	delete_payload_t *delete_request = NULL;
 	connection_t *connection;
 	
-	/* check message type */
-	if (request->get_exchange_type(request) != INFORMATIONAL)
-	{
-		this->logger->log(this->logger, ERROR,
-						  "INFORMATIONAL response of invalid type, deleting IKE_SA");
-		return DESTROY_ME;
-	}
-	
 	/* check if we already have built a response (retransmission) 
 	 * this only happens in special simultanous transaction cases,
 	 * as we delete the IKE_SA after the response is sent. */
@@ -167,6 +159,14 @@ static status_t get_response(private_delete_ike_sa_t *this, message_t *request,
 	this->message = response;
 	*result = response;
 	
+	/* check message type */
+	if (request->get_exchange_type(request) != INFORMATIONAL)
+	{
+		this->logger->log(this->logger, ERROR,
+						  "INFORMATIONAL response of invalid type, deleting IKE_SA");
+		return DESTROY_ME;
+	}
+	
 	/* iterate over all payloads */
 	payloads = request->get_payload_iterator(request);	
 	while (payloads->has_next(payloads))
@@ -498,14 +498,6 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
 	ts_payload_t *tsr_request = NULL;
 	id_payload_t *idr_response;
 	
-	/* check message type */
-	if (request->get_exchange_type(request) != IKE_AUTH)
-	{
-		this->logger->log(this->logger, ERROR,
-						  "IKE_AUTH response of invalid type, deleting IKE_SA");
-		return DESTROY_ME;
-	}
-	
 	/* check if we already have built a response (retransmission) */
 	if (this->message)
 	{
@@ -528,6 +520,14 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
 	this->message = response;
 	*result = response;
 	
+	/* check message type */
+	if (request->get_exchange_type(request) != IKE_AUTH)
+	{
+		this->logger->log(this->logger, ERROR,
+						  "IKE_AUTH response of invalid type, deleting IKE_SA");
+		return DESTROY_ME;
+	}
+	
 	/* Iterate over all payloads. */
 	payloads = request->get_payload_iterator(request);
 	while (payloads->has_next(payloads))
@@ -316,17 +316,12 @@ static status_t get_request(private_ike_sa_init_t *this, message_t **result)
 	
 	{	/* build the NONCE payload for us (initiator) */
 		nonce_payload_t *nonce_payload;
-		randomizer_t *randomizer;
 		
-		randomizer = randomizer_create();
-		if (randomizer->allocate_pseudo_random_bytes(randomizer, 
+		if (this->randomizer->allocate_pseudo_random_bytes(this->randomizer, 
 			NONCE_SIZE, &this->nonce_i) != SUCCESS)
 		{
-			randomizer->destroy(randomizer);
-			request->destroy(request);
 			return DESTROY_ME;
 		}
-		randomizer->destroy(randomizer);
 		nonce_payload = nonce_payload_create();
 		nonce_payload->set_nonce(nonce_payload, this->nonce_i);
 		
@@ -484,14 +479,6 @@ static status_t get_response(private_ike_sa_init_t *this,
 	ike_sa_id_t *ike_sa_id;
 	u_int32_t timeout;
 	
-	/* check message type */
-	if (request->get_exchange_type(request) != IKE_SA_INIT)
-	{
-		this->logger->log(this->logger, ERROR, 
-						  "IKE_SA_INIT request of invalid type, deleting IKE_SA");
-		return DESTROY_ME;
-	}
-	
 	/* check if we already have built a response (retransmission) */
 	if (this->message)
 	{
@@ -513,6 +500,14 @@ static status_t get_response(private_ike_sa_init_t *this,
 	this->message = response;
 	*result = response;
 	
+	/* check message type */
+	if (request->get_exchange_type(request) != IKE_SA_INIT)
+	{
+		this->logger->log(this->logger, ERROR, 
+						  "IKE_SA_INIT request of invalid type, deleting IKE_SA");
+		return DESTROY_ME;
+	}
+	
 	/* this is the first message to process, find a connection for IKE_SA */
 	this->connection = charon->connections->get_connection_by_hosts(
 			charon->connections, me, other);
@@ -1003,7 +998,7 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
 		response_chunk = response->get_packet_data(response);
 		
 		/* create next transaction, for which we except a message */
-		ike_auth = ike_auth_create(this->ike_sa, 1);
+		ike_auth = ike_auth_create(this->ike_sa, this->message_id + 1);
 		ike_auth->set_nonces(ike_auth,
 							 chunk_clone(this->nonce_i),
 							 chunk_clone(this->nonce_r));
@@ -26,6 +26,8 @@
 #include <sa/transactions/ike_sa_init.h>
 #include <sa/transactions/ike_auth.h>
 #include <sa/transactions/delete_ike_sa.h>
+#include <sa/transactions/create_child_sa.h>
+#include <sa/transactions/delete_child_sa.h>
 #include <sa/transactions/dead_peer_detection.h>
 #include <encoding/payloads/ts_payload.h>
 #include <encoding/payloads/sa_payload.h>
@@ -56,7 +58,10 @@ transaction_t *transaction_create(ike_sa_t *ike_sa, message_t *request)
 	{
 		case IKE_SA_INIT:
 		{
-			transaction = (transaction_t*)ike_sa_init_create(ike_sa, message_id);
+			if (ike_sa->get_state(ike_sa) == SA_CREATED)
+			{
+				transaction = (transaction_t*)ike_sa_init_create(ike_sa, message_id);
+			}
 			break;
 		}
 		case IKE_AUTH:
@@ -67,6 +72,10 @@ transaction_t *transaction_create(ike_sa_t *ike_sa, message_t *request)
 		}
 		case CREATE_CHILD_SA:
 		{
+			if (ike_sa->get_state(ike_sa) != SA_ESTABLISHED)
+			{
+				break;
+			}
 			/* look for a REKEY_SA notify */
 			iterator = request->get_payload_iterator(request);
 			while (iterator->has_next(iterator))
@@ -88,10 +97,9 @@ transaction_t *transaction_create(ike_sa_t *ike_sa, message_t *request)
 						break;
 					case PROTO_AH:
 					case PROTO_ESP:
-					{
-						/* TODO: transaction = rekey_child_sa_create(ike_sa, message_id); */
-						break;
-					}
+						/* we do not handle rekeying of CHILD_SAs in a special 
+						 * transaction, as the procedure is nearly equal 
+						 * to create a new CHILD_SA. */
 					default:
 						break;
 				}
@@ -101,10 +109,21 @@ transaction_t *transaction_create(ike_sa_t *ike_sa, message_t *request)
 				}
 			}
 			iterator->destroy(iterator);
+			if (!transaction)
+			{
+				/* we have not found a REKEY_SA notify for IKE. This means
+				 * we create a new CHILD_SA, or rekey an existing one.
+				 * Both cases are handled with the create_child_sa transaction. */
+				transaction = (transaction_t*)create_child_sa_create(ike_sa, message_id);
+			}
 			break;
 		}
 		case INFORMATIONAL:
 		{
+			if (ike_sa->get_state(ike_sa) == SA_CREATED)
+			{
+				break;
+			}
 			u_int payload_count = 0;
 			iterator = request->get_payload_iterator(request);
 			while (iterator->has_next(iterator))
@@ -117,12 +136,21 @@ transaction_t *transaction_create(ike_sa_t *ike_sa, message_t *request)
 					{
 						delete_payload_t *delete_payload;
 						delete_payload = (delete_payload_t*)current;
-						if (delete_payload->get_protocol_id(delete_payload) == PROTO_IKE)
+						switch (delete_payload->get_protocol_id(delete_payload))
 						{
-							transaction = (transaction_t*)
-									delete_ike_sa_create(ike_sa, message_id);
-							break;
+							case PROTO_IKE:
+								transaction = (transaction_t*)
+										delete_ike_sa_create(ike_sa, message_id);
+								break;
+							case PROTO_AH:
+							case PROTO_ESP:
+								transaction = (transaction_t*)
+										delete_child_sa_create(ike_sa, message_id);
+								break;
+							default:
+								break;
 						}
+						break;
 					}
 					default:
 						break;
@@ -133,6 +161,8 @@ transaction_t *transaction_create(ike_sa_t *ike_sa, message_t *request)
 				}
 			}
 			iterator->destroy(iterator);
+			/* empty informationals are used for dead peer detection in
+			 * IKEv2. We use a special transaction for it. */
 			if (payload_count == 0)
 			{
 				transaction = (transaction_t*)