ported parts of two-sim branch

eap_identity parameter to exchange in eap_identity
	some auth_info/peer_cfg refactorings
	fixed some bugs, introduced new ones

src/charon/plugins/eap_aka/eap_aka.c

@@ -828,6 +828,19 @@ static eap_payload_t *build_aka_payload(private_eap_aka_t *this, eap_code_t code
 	return payload;
 }
 
+/**
+ * generate a new non-zero identifier
+ */
+static u_char get_identifier()
+{
+	u_char id;
+	
+	do {
+		id = random();
+	} while (!id);
+	return id;
+}
+
 /**
  * Initiate a AKA-Challenge using SQN
  */
@@ -900,7 +913,7 @@ static status_t server_initiate_challenge(private_eap_aka_t *this, chunk_t sqn,
 	derive_keys(this, this->peer);
 	
 	/* build payload */
-	*out = build_aka_payload(this, EAP_REQUEST, 0, AKA_CHALLENGE,
+	*out = build_aka_payload(this, EAP_REQUEST, get_identifier(), AKA_CHALLENGE,
 							 AT_RAND, this->rand, AT_AUTN, autn, AT_MAC,
 							 chunk_empty, AT_END);
 	return NEED_MORE;
@@ -1449,6 +1462,8 @@ static bool is_mutual(private_eap_aka_t *this)
  */
 static void destroy(private_eap_aka_t *this)
 {
+	this->server->destroy(this->server);
+	this->peer->destroy(this->peer);
 	DESTROY_IF(this->sha1);
 	DESTROY_IF(this->signer);
 	DESTROY_IF(this->prf);
@@ -1479,8 +1494,8 @@ static private_eap_aka_t *eap_aka_create_generic(identification_t *server,
 	this->public.eap_method_interface.destroy = (void(*)(eap_method_t*))destroy;
 	
 	/* private data */
-	this->server = server;
-	this->peer = peer;
+	this->server = server->clone(server);
+	this->peer = peer->clone(peer);
 	this->k_encr = chunk_empty;
 	this->k_auth = chunk_empty;
 	this->msk = chunk_empty;

src/charon/plugins/eap_gtc/eap_gtc.c

@@ -253,6 +253,8 @@ static bool is_mutual(private_eap_gtc_t *this)
  */
 static void destroy(private_eap_gtc_t *this)
 {
+	this->peer->destroy(this->peer);
+	this->server->destroy(this->server);
 	free(this);
 }
 
@@ -272,9 +274,9 @@ static private_eap_gtc_t *eap_gtc_create_generic(identification_t *server,
 	this->public.eap_method_interface.destroy = (void(*)(eap_method_t*))destroy;
 	
 	/* private data */
-	this->peer = peer;
-	this->server = server;
-	this->identifier = random();
+	this->peer = peer->clone(peer);
+	this->server = server->clone(server);
+	this->identifier = 0;
 	
 	return this;
 }
@@ -289,6 +291,11 @@ eap_gtc_t *eap_gtc_create_server(identification_t *server, identification_t *pee
 	this->public.eap_method_interface.initiate = (status_t(*)(eap_method_t*,eap_payload_t**))initiate_server;
 	this->public.eap_method_interface.process = (status_t(*)(eap_method_t*,eap_payload_t*,eap_payload_t**))process_server;
 
+	/* generate a non-zero identifier */
+	do {
+		this->identifier = random();
+	} while (!this->identifier);
+
 	return &this->public;
 }
 

src/charon/plugins/eap_identity/eap_identity.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Martin Willi
+ * Copyright (C) 2007-2008 Martin Willi
  * Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
@@ -36,38 +36,97 @@ struct private_eap_identity_t {
 	 * ID of the peer
 	 */
 	identification_t *peer;
+	
+	/**
+	 * received identity chunk
+	 */
+	chunk_t identity;
 };
 
+typedef struct eap_identity_header_t eap_identity_header_t;
+
+/**
+ * packed EAP Identity header struct
+ */
+struct eap_identity_header_t {
+	/** EAP code (REQUEST/RESPONSE) */
+	u_int8_t code;
+	/** unique message identifier */
+	u_int8_t identifier;
+	/** length of whole message */
+	u_int16_t length;
+	/** EAP type */
+	u_int8_t type;
+	/** identity data */
+	u_int8_t data[];
+} __attribute__((__packed__));
+
 /**
  * Implementation of eap_method_t.process for the peer
  */
-static status_t process(private_eap_identity_t *this,
-						eap_payload_t *in, eap_payload_t **out)
+static status_t process_peer(private_eap_identity_t *this,
+							 eap_payload_t *in, eap_payload_t **out)
 {
-	chunk_t id, hdr;
+	chunk_t id;
+	eap_identity_header_t *hdr;
+	size_t len;
 	
-	hdr = chunk_alloca(5);
 	id = this->peer->get_encoding(this->peer);
+	len = sizeof(eap_identity_header_t) + id.len;
 	
-	*(hdr.ptr + 0) = EAP_RESPONSE;
-	*(hdr.ptr + 1) = in->get_identifier(in);
-	*(u_int16_t*)(hdr.ptr + 2) = htons(hdr.len + id.len);
-	*(hdr.ptr + 4) = EAP_IDENTITY;
+	hdr = alloca(len);
+	hdr->code = EAP_RESPONSE;
+	hdr->identifier = in->get_identifier(in);
+	hdr->length = htons(len);
+	hdr->type = EAP_IDENTITY;
+	memcpy(hdr->data, id.ptr, id.len);
 	
-	*out = eap_payload_create_data(chunk_cata("cc", hdr, id));
+	*out = eap_payload_create_data(chunk_create((u_char*)hdr, len));
 	return SUCCESS;
-	
 }
 
 /**
  * Implementation of eap_method_t.initiate for the peer
  */
-static status_t initiate(private_eap_identity_t *this, eap_payload_t **out)
+static status_t initiate_peer(private_eap_identity_t *this, eap_payload_t **out)
 {
 	/* peer never initiates */
 	return FAILED;
 }
 
+/**
+ * Implementation of eap_method_t.process for the server
+ */
+static status_t process_server(private_eap_identity_t *this,
+							   eap_payload_t *in, eap_payload_t **out)
+{
+	chunk_t data;
+	
+	data = chunk_skip(in->get_data(in), 5);
+	if (data.len)
+	{
+		this->identity = chunk_clone(data);
+	}
+	return SUCCESS;
+}
+
+/**
+ * Implementation of eap_method_t.initiate for the server
+ */
+static status_t initiate_server(private_eap_identity_t *this, eap_payload_t **out)
+{
+	eap_identity_header_t hdr;
+	
+	hdr.code = EAP_REQUEST;
+	hdr.identifier = 0;
+	hdr.length = htons(sizeof(eap_identity_header_t));
+	hdr.type = EAP_IDENTITY;
+	
+	*out = eap_payload_create_data(chunk_create((u_char*)&hdr,
+												sizeof(eap_identity_header_t)));
+	return NEED_MORE;
+}
+
 /**
  * Implementation of eap_method_t.get_type.
  */
@@ -82,6 +141,11 @@ static eap_type_t get_type(private_eap_identity_t *this, u_int32_t *vendor)
  */
 static status_t get_msk(private_eap_identity_t *this, chunk_t *msk)
 {
+	if (this->identity.ptr)
+	{
+		*msk = this->identity;
+		return SUCCESS;
+	}
 	return FAILED;
 }
 
@@ -98,27 +162,58 @@ static bool is_mutual(private_eap_identity_t *this)
  */
 static void destroy(private_eap_identity_t *this)
 {
+	this->peer->destroy(this->peer);
+	free(this->identity.ptr);
 	free(this);
 }
 
+/**
+ * Generic constructor
+ */
+static private_eap_identity_t *eap_identity_create(identification_t *server,
+												   identification_t *peer)
+{
+	private_eap_identity_t *this = malloc_thing(private_eap_identity_t);
+	
+	this->public.eap_method_interface.initiate = NULL;
+	this->public.eap_method_interface.process = NULL;
+	this->public.eap_method_interface.get_type = (eap_type_t(*)(eap_method_t*,u_int32_t*))get_type;
+	this->public.eap_method_interface.is_mutual = (bool(*)(eap_method_t*))is_mutual;
+	this->public.eap_method_interface.get_msk = (status_t(*)(eap_method_t*,chunk_t*))get_msk;
+	this->public.eap_method_interface.destroy = (void(*)(eap_method_t*))destroy;
+	
+	this->peer = peer->clone(peer);
+	this->identity = chunk_empty;
+	
+	return this;
+}
+
 /*
  * Described in header.
  */
 eap_identity_t *eap_identity_create_peer(identification_t *server,
 										 identification_t *peer)
 {
-	private_eap_identity_t *this = malloc_thing(private_eap_identity_t);
+	private_eap_identity_t *this = eap_identity_create(server, peer);
 	
 	/* public functions */
-	this->public.eap_method_interface.initiate = (status_t(*)(eap_method_t*,eap_payload_t**))initiate;
-	this->public.eap_method_interface.process = (status_t(*)(eap_method_t*,eap_payload_t*,eap_payload_t**))process;
-	this->public.eap_method_interface.get_type = (eap_type_t(*)(eap_method_t*,u_int32_t*))get_type;
-	this->public.eap_method_interface.is_mutual = (bool(*)(eap_method_t*))is_mutual;
-	this->public.eap_method_interface.get_msk = (status_t(*)(eap_method_t*,chunk_t*))get_msk;
-	this->public.eap_method_interface.destroy = (void(*)(eap_method_t*))destroy;
+	this->public.eap_method_interface.initiate = (status_t(*)(eap_method_t*,eap_payload_t**))initiate_peer;
+	this->public.eap_method_interface.process = (status_t(*)(eap_method_t*,eap_payload_t*,eap_payload_t**))process_peer;
 	
-	/* private data */
-	this->peer = peer;
+	return &this->public;
+}
+
+/*
+ * Described in header.
+ */
+eap_identity_t *eap_identity_create_server(identification_t *server,
+										   identification_t *peer)
+{
+	private_eap_identity_t *this = eap_identity_create(server, peer);
+	
+	/* public functions */
+	this->public.eap_method_interface.initiate = (status_t(*)(eap_method_t*,eap_payload_t**))initiate_server;
+	this->public.eap_method_interface.process = (status_t(*)(eap_method_t*,eap_payload_t*,eap_payload_t**))process_server;
 	
 	return &this->public;
 }

src/charon/plugins/eap_identity/eap_identity.h

@@ -38,6 +38,16 @@ struct eap_identity_t {
 	eap_method_t eap_method_interface;
 };
 
+/**
+ * Creates the EAP method EAP Identity, acting as server.
+ *
+ * @param server	ID of the EAP server
+ * @param peer		ID of the EAP client
+ * @return			eap_identity_t object
+ */
+eap_identity_t *eap_identity_create_server(identification_t *server,
+										   identification_t *peer);
+
 /**
  * Creates the EAP method EAP Identity, acting as peer.
  *

src/charon/plugins/eap_identity/eap_identity_plugin.c

@@ -26,6 +26,8 @@
  */
 static void destroy(eap_identity_plugin_t *this)
 {
+	charon->eap->remove_method(charon->eap,
+							   (eap_constructor_t)eap_identity_create_server);
 	charon->eap->remove_method(charon->eap,
 							   (eap_constructor_t)eap_identity_create_peer);
 	free(this);
@@ -40,6 +42,8 @@ plugin_t *plugin_create()
 	
 	this->plugin.destroy = (void(*)(plugin_t*))destroy;
 	
+	charon->eap->add_method(charon->eap, EAP_IDENTITY, 0, EAP_SERVER,
+							(eap_constructor_t)eap_identity_create_server);
 	charon->eap->add_method(charon->eap, EAP_IDENTITY, 0, EAP_PEER,
 							(eap_constructor_t)eap_identity_create_peer);
 	

src/charon/plugins/eap_md5/eap_md5.c

@@ -242,6 +242,8 @@ static bool is_mutual(private_eap_md5_t *this)
  */
 static void destroy(private_eap_md5_t *this)
 {
+	this->peer->destroy(this->peer);
+	this->server->destroy(this->server);
 	chunk_free(&this->challenge);
 	free(this);
 }
@@ -262,10 +264,10 @@ static private_eap_md5_t *eap_md5_create_generic(identification_t *server,
 	this->public.eap_method_interface.destroy = (void(*)(eap_method_t*))destroy;
 	
 	/* private data */
-	this->peer = peer;
-	this->server = server;
+	this->peer = peer->clone(peer);
+	this->server = server->clone(server);
 	this->challenge = chunk_empty;
-	this->identifier = random();
+	this->identifier = 0;
 	
 	return this;
 }
@@ -280,6 +282,11 @@ eap_md5_t *eap_md5_create_server(identification_t *server, identification_t *pee
 	this->public.eap_method_interface.initiate = (status_t(*)(eap_method_t*,eap_payload_t**))initiate_server;
 	this->public.eap_method_interface.process = (status_t(*)(eap_method_t*,eap_payload_t*,eap_payload_t**))process_server;
 
+	/* generate a non-zero identifier */
+	do {
+		this->identifier = random();
+	} while (!this->identifier);
+
 	return &this->public;
 }
 

src/charon/plugins/eap_sim/eap_sim.c

@@ -1016,6 +1016,7 @@ static bool is_mutual(private_eap_sim_t *this)
  */
 static void destroy(private_eap_sim_t *this)
 {
+	this->peer->destroy(this->peer);
 	dlclose(this->handle);
 	DESTROY_IF(this->hasher);
 	DESTROY_IF(this->prf);
@@ -1046,7 +1047,7 @@ eap_sim_t *eap_sim_create_generic(eap_role_t role, identification_t *server,
 	this->get_triplet = NULL;
 	this->nonce = chunk_empty;
 	this->sreses = chunk_empty;
-	this->peer = peer;
+	this->peer = peer->clone(peer);
 	this->tries = MAX_TRIES;
 	this->version.ptr = version;
 	this->version.len = sizeof(version);
@@ -1055,7 +1056,10 @@ eap_sim_t *eap_sim_create_generic(eap_role_t role, identification_t *server,
 	this->k_encr = chunk_empty;
 	this->msk = chunk_empty;
 	this->emsk = chunk_empty;
-	this->identifier = random();
+	/* generate a non-zero identifier */
+	do {
+		this->identifier = random();
+	} while (!this->identifier);
 	
 	this->handle = dlopen(SIM_READER_LIB, RTLD_LAZY);
 	if (this->handle == NULL)

src/charon/plugins/medcli/medcli_config.c

@@ -120,8 +120,7 @@ static peer_cfg_t *get_peer_cfg_by_name(private_medcli_config_t *this, char *nam
 		"mediation", 2, ike_cfg,
 		identification_create_from_encoding(ID_KEY_ID, me),
 		identification_create_from_encoding(ID_KEY_ID, other),
-		CERT_NEVER_SEND, UNIQUE_REPLACE, CONF_AUTH_PUBKEY,
-		0, 0, 							/* EAP method, vendor */
+		CERT_NEVER_SEND, UNIQUE_REPLACE, 
 		1, this->rekey*60, 0,  			/* keytries, rekey, reauth */
 		this->rekey*5, this->rekey*3, 	/* jitter, overtime */
 		TRUE, this->dpd, 				/* mobike, dpddelay */
@@ -149,8 +148,7 @@ static peer_cfg_t *get_peer_cfg_by_name(private_medcli_config_t *this, char *nam
 		name, 2, this->ike->get_ref(this->ike),
 		identification_create_from_encoding(ID_KEY_ID, me),
 		identification_create_from_encoding(ID_KEY_ID, other),
-		CERT_NEVER_SEND, UNIQUE_REPLACE, CONF_AUTH_PUBKEY,
-		0, 0, 							/* EAP method, vendor */
+		CERT_NEVER_SEND, UNIQUE_REPLACE, 
 		1, this->rekey*60, 0,  			/* keytries, rekey, reauth */
 		this->rekey*5, this->rekey*3, 	/* jitter, overtime */
 		TRUE, this->dpd, 				/* mobike, dpddelay */
@@ -213,8 +211,7 @@ static bool peer_enumerator_enumerate(peer_enumerator_t *this, peer_cfg_t **cfg)
 				name, 2, this->ike->get_ref(this->ike),
 				identification_create_from_encoding(ID_KEY_ID, me),
 				identification_create_from_encoding(ID_KEY_ID, other),
-				CERT_NEVER_SEND, UNIQUE_REPLACE, AUTH_RSA,
-				0, 0, 							/* EAP method, vendor */
+				CERT_NEVER_SEND, UNIQUE_REPLACE, 
 				1, this->rekey*60, 0,  			/* keytries, rekey, reauth */
 				this->rekey*5, this->rekey*3, 	/* jitter, overtime */
 				TRUE, this->dpd, 				/* mobike, dpddelay */

src/charon/plugins/medsrv/medsrv_config.c

@@ -99,8 +99,7 @@ static enumerator_t* create_peer_cfg_enumerator(private_medsrv_config_t *this,
 			peer_cfg = peer_cfg_create(
 				name, 2, this->ike->get_ref(this->ike),
 				me->clone(me), other->clone(other),
-				CERT_NEVER_SEND, UNIQUE_REPLACE, CONF_AUTH_PUBKEY,
-				0, 0, 							/* EAP method, vendor */
+				CERT_NEVER_SEND, UNIQUE_REPLACE,
 				1, this->rekey*60, 0,  			/* keytries, rekey, reauth */
 				this->rekey*5, this->rekey*3, 	/* jitter, overtime */
 				TRUE, this->dpd, 				/* mobike, dpddelay */

src/charon/plugins/nm/nm_service.c

@@ -171,7 +171,8 @@ static gboolean connect_(NMVPNPlugin *plugin, NMConnection *connection,
 	child_cfg_t *child_cfg;
 	traffic_selector_t *ts;
 	ike_sa_t *ike_sa;
-	config_auth_method_t method = CONF_AUTH_EAP;
+	auth_info_t *auth;
+	auth_class_t auth_class = AUTH_CLASS_EAP;
 	
 	/**
 	 * Read parameters
@@ -212,11 +213,11 @@ static gboolean connect_(NMVPNPlugin *plugin, NMConnection *connection,
 	{
 		if (streq(str, "psk"))
 		{
-			method = CONF_AUTH_PSK;
+			auth_class = AUTH_CLASS_PSK;
 		}
 		else if (streq(str, "pubkey"))
 		{
-			method = CONF_AUTH_PUBKEY;
+			auth_class = AUTH_CLASS_PUBKEY;
 		}
 	}
 	
@@ -247,13 +248,14 @@ static gboolean connect_(NMVPNPlugin *plugin, NMConnection *connection,
 	ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE));
 	peer_cfg = peer_cfg_create(CONFIG_NAME, 2, ike_cfg, user,
 					identification_create_from_encoding(ID_ANY, chunk_empty),
-					CERT_SEND_IF_ASKED, UNIQUE_REPLACE, method,
-					0, 0, 1, /* EAP method, vendor, keyingtries */
+					CERT_SEND_IF_ASKED, UNIQUE_REPLACE, 1, /* keyingtries */
 					18000, 0, /* rekey 5h, reauth none */
 					600, 600, /* jitter, over 10min */
 					TRUE, 0, /* mobike, DPD */
 					virtual ? host_create_from_string("0.0.0.0", 0) : NULL,
 					NULL, FALSE, NULL, NULL); /* pool, mediation */
+	auth = peer_cfg->get_auth(peer_cfg);
+	auth->add_item(auth, AUTHN_AUTH_CLASS, &auth_class);
 	child_cfg = child_cfg_create(CONFIG_NAME,
 								 3600, 3000, /* lifetime 1h, rekey 50min */
 								 300, /* jitter 5min */

src/charon/plugins/sql/sql_config.c

@@ -267,6 +267,7 @@ static peer_cfg_t *build_peer_cfg(private_sql_config_t *this, enumerator_t *e,
 		peer_cfg_t *peer_cfg, *mediated_cfg;
 		ike_cfg_t *ike;
 		host_t *vip = NULL;
+		auth_info_t *auth;
 		
 		local_id = identification_create_from_encoding(l_type, l_data);
 		remote_id = identification_create_from_encoding(r_type, r_data);
@@ -291,10 +292,19 @@ static peer_cfg_t *build_peer_cfg(private_sql_config_t *this, enumerator_t *e,
 		{
 			peer_cfg = peer_cfg_create(
 					name, 2, ike, local_id, remote_id, cert_policy, uniqueid,
-					auth_method, eap_type, eap_vendor, keyingtries, 
-					rekeytime, reauthtime, jitter, overtime, mobike,
-					dpd_delay, vip, pool,
+					keyingtries, rekeytime, reauthtime, jitter, overtime,
+					mobike,	dpd_delay, vip, pool,
 					mediation, mediated_cfg, peer_id);
+			auth = peer_cfg->get_auth(peer_cfg);
+			auth->add_item(auth, AUTHN_AUTH_CLASS, &auth_method);
+			if (eap_type)
+			{
+				auth->add_item(auth, AUTHN_EAP_TYPE, &eap_type);
+				if (eap_vendor)
+				{
+					auth->add_item(auth, AUTHN_EAP_VENDOR, &eap_vendor);
+				}
+			}
 			add_child_cfgs(this, peer_cfg, id);
 			return peer_cfg;
 		}

src/charon/plugins/stroke/stroke_config.c

@@ -499,8 +499,7 @@ static peer_cfg_t *build_peer_cfg(private_stroke_config_t *this,
 	 * uses to serve pool addresses. */
 	return peer_cfg_create(msg->add_conn.name,
 		msg->add_conn.ikev2 ? 2 : 1, ike_cfg, me, other,
-		msg->add_conn.me.sendcert, unique, msg->add_conn.auth_method,
-		msg->add_conn.eap_type,	msg->add_conn.eap_vendor,
+		msg->add_conn.me.sendcert, unique, 
 		msg->add_conn.rekey.tries, rekey, reauth, jitter, over,
 		msg->add_conn.mobike, msg->add_conn.dpd.delay,
 		vip, msg->add_conn.other.sourceip_size ?
@@ -514,7 +513,7 @@ static peer_cfg_t *build_peer_cfg(private_stroke_config_t *this,
 static void build_auth_info(private_stroke_config_t *this,
 							stroke_msg_t *msg, auth_info_t *auth)
 {
-	identification_t *my_ca = NULL, *other_ca = NULL;
+	identification_t *my_ca = NULL, *other_ca = NULL, *id;
 	bool my_ca_same = FALSE;
 	bool other_ca_same = FALSE;
 	cert_validation_t valid;
@@ -601,6 +600,30 @@ static void build_auth_info(private_stroke_config_t *this,
 		}
 		my_ca->destroy(my_ca);
 	}
+	auth->add_item(auth, AUTHN_AUTH_CLASS, &msg->add_conn.auth_method);
+	if (msg->add_conn.eap_type)
+	{
+		auth->add_item(auth, AUTHN_EAP_TYPE, &msg->add_conn.eap_type);
+		if (msg->add_conn.eap_vendor)
+		{
+			auth->add_item(auth, AUTHN_EAP_VENDOR, &msg->add_conn.eap_vendor);
+		}
+	}
+	if (msg->add_conn.eap_identity)
+	{
+		if (streq(msg->add_conn.eap_identity, "%identity"))
+		{
+			id = identification_create_from_encoding(ID_ANY, chunk_empty);
+		}
+		else
+		{
+			id = identification_create_from_encoding(ID_EAP, chunk_create(
+										msg->add_conn.eap_identity,
+										strlen(msg->add_conn.eap_identity)));
+		}
+		auth->add_item(auth, AUTHN_EAP_IDENTITY, id);
+		id->destroy(id);
+	}
 }
 
 /**

src/charon/plugins/stroke/stroke_cred.c

@@ -827,20 +827,27 @@ static void load_secrets(private_stroke_cred_t *this)
 				{
 					continue;
 				}
-
-				/* NULL terminate the ID string */
-				*(id.ptr + id.len) = '\0';
-
-				peer_id = identification_create_from_string(id.ptr);
-				if (peer_id == NULL)
+				
+				if (type == SHARED_EAP)
 				{
-					DBG1(DBG_CFG, "line %d: malformed ID: %s", line_nr, id.ptr);
-					goto error;
+					/* we use a special EAP identity type for EAP secrets */
+					peer_id = identification_create_from_encoding(ID_EAP, id);
 				}
-				if (peer_id->get_type(peer_id) == ID_ANY)
+				else
 				{
-					peer_id->destroy(peer_id);
-					continue;
+					/* NULL terminate the ID string */
+					*(id.ptr + id.len) = '\0';
+					peer_id = identification_create_from_string(id.ptr);
+					if (peer_id == NULL)
+					{
+						DBG1(DBG_CFG, "line %d: malformed ID: %s", line_nr, id.ptr);
+						goto error;
+					}
+					if (peer_id->get_type(peer_id) == ID_ANY)
+					{
+						peer_id->destroy(peer_id);
+						continue;
+					}
 				}
 				
 				shared_key->add_owner(shared_key, peer_id);

src/charon/plugins/stroke/stroke_list.c

@@ -47,6 +47,23 @@ struct private_stroke_list_t {
 	time_t uptime;
 };
 
+/**
+ * get the authentication class of a config
+ */
+auth_class_t get_auth_class(peer_cfg_t *config)
+{
+	auth_class_t *class;
+	auth_info_t *auth_info;
+	
+	auth_info = config->get_auth(config);
+	if (auth_info->get_item(auth_info, AUTHN_AUTH_CLASS, (void**)&class))
+	{
+		return *class;
+	}
+	/* fallback to pubkey authentication */
+	return AUTH_CLASS_PUBKEY;
+}
+
 /**
  * log an IKE_SA to out
  */
@@ -81,12 +98,8 @@ static void log_ike_sa(FILE *out, ike_sa_t *ike_sa, bool all)
 			}
 			if (reauth)
 			{
-				peer_cfg_t *peer_cfg = ike_sa->get_peer_cfg(ike_sa);
-
-				fprintf(out, ", %N reauthentication in %V",
-						config_auth_method_names,
-						peer_cfg->get_auth_method(peer_cfg),
-						&reauth);
+				fprintf(out, ", %N reauthentication in %V", auth_class_names,
+						get_auth_class(ike_sa->get_peer_cfg(ike_sa)), &reauth);
 			}
 			if (!rekey && !reauth)
 			{
@@ -272,14 +285,13 @@ static void status(private_stroke_list_t *this, stroke_msg_t *msg, FILE *out, bo
 					ike_cfg->get_my_addr(ike_cfg), peer_cfg->get_my_id(peer_cfg),
 					ike_cfg->get_other_addr(ike_cfg), peer_cfg->get_other_id(peer_cfg));
 			fprintf(out, "%12s:  %N authentication",  peer_cfg->get_name(peer_cfg),
-					config_auth_method_names, peer_cfg->get_auth_method(peer_cfg));
+					auth_class_names, get_auth_class(peer_cfg));
 			dpd = peer_cfg->get_dpd(peer_cfg);
 			if (dpd)
 			{
 				fprintf(out, ", dpddelay=%us", dpd);
 			}
 			fprintf(out, "\n");
-
 			/* TODO: list CAs and groups */
 			children = peer_cfg->create_child_cfg_enumerator(peer_cfg);
 			while (children->enumerate(children, &child_cfg))

src/charon/plugins/stroke/stroke_socket.c

@@ -169,10 +169,12 @@ static void stroke_add_conn(private_stroke_socket_t *this, stroke_msg_t *msg)
 	DBG2(DBG_CFG, "conn %s", msg->add_conn.name);
 	pop_end(msg, "left", &msg->add_conn.me);
 	pop_end(msg, "right", &msg->add_conn.other);
+	pop_string(msg, &msg->add_conn.eap_identity);
 	pop_string(msg, &msg->add_conn.algorithms.ike);
 	pop_string(msg, &msg->add_conn.algorithms.esp);
 	pop_string(msg, &msg->add_conn.ikeme.mediated_by);
 	pop_string(msg, &msg->add_conn.ikeme.peerid);
+	DBG2(DBG_CFG, "  eap_identity=%s", msg->add_conn.eap_identity);
 	DBG2(DBG_CFG, "  ike=%s", msg->add_conn.algorithms.ike);
 	DBG2(DBG_CFG, "  esp=%s", msg->add_conn.algorithms.esp);
 	DBG2(DBG_CFG, "  mediation=%s", msg->add_conn.ikeme.mediation ? "yes" : "no");

src/charon/plugins/uci/uci_config.c

@@ -163,6 +163,8 @@ static bool peer_enumerator_enumerate(peer_enumerator_t *this, peer_cfg_t **cfg)
 	char *remote_id, *remote_addr, *remote_net;
 	child_cfg_t *child_cfg;
 	ike_cfg_t *ike_cfg;
+	auth_info_t *auth;
+	auth_class_t class;
 	
 	/* defaults */
 	name = "unnamed";
@@ -186,13 +188,15 @@ static bool peer_enumerator_enumerate(peer_enumerator_t *this, peer_cfg_t **cfg)
 		ike_cfg->add_proposal(ike_cfg, create_proposal(ike_proposal, PROTO_IKE));
 		this->peer_cfg = peer_cfg_create(
 					name, 2, ike_cfg, create_id(local_id), create_id(remote_id),
-					CERT_SEND_IF_ASKED, UNIQUE_NO, CONF_AUTH_PSK,
-					0, 0, 							/* EAP method, vendor */
+					CERT_SEND_IF_ASKED, UNIQUE_NO,
 					1, create_rekey(ike_rekey), 0,  /* keytries, rekey, reauth */
 					1800, 900,						/* jitter, overtime */
 					TRUE, 60, 						/* mobike, dpddelay */
 					NULL, NULL, 					/* vip, pool */
 					FALSE, NULL, NULL); 			/* mediation, med by, peer id */
+		auth = this->peer_cfg->get_auth(this->peer_cfg);
+		class = AUTH_CLASS_PSK;
+		auth->add_item(auth, AUTHN_AUTH_CLASS, &class);
 		child_cfg = child_cfg_create(name,
 					create_rekey(esp_rekey) + 300, create_rekey(ike_rekey), 300,
 					NULL, TRUE,	MODE_TUNNEL, ACTION_NONE, ACTION_NONE, FALSE);