- authentication with preshared key working but code MUST be cleaned

Source/charon/sa/states/ike_auth_requested.c

@@ -60,6 +60,16 @@ struct private_ike_auth_requested_t {
 	 * Received nonce from responder
 	 */
 	chunk_t received_nonce;
+	
+	/**
+	 * Sent nonce in IKE_SA_INIT request.
+	 */
+	chunk_t sent_nonce;
+	
+	/**
+	 * IKE_SA_INIT-Request in binary form.
+	 */
+	chunk_t ike_sa_init_reply_data;
 	 
 	/**
 	 * Logger used to log data 
@@ -336,26 +346,28 @@ static status_t process_sa_payload(private_ike_auth_requested_t *this, sa_payloa
  */
 static status_t process_auth_payload(private_ike_auth_requested_t *this, auth_payload_t *auth_payload, id_payload_t *other_id_payload)
 {
-	
-	chunk_t received_auth_data = auth_payload->get_data(auth_payload);
-	chunk_t last_message_data = this->ike_sa->get_last_sent_message_data(this->ike_sa);
-	bool verified;
-	identification_t *identification;
 	authenticator_t *authenticator;
-	
-	identification = other_id_payload->get_identification(other_id_payload);
-	
+	status_t status;
+	bool verified;
+		
 	/* TODO VERIFY auth here */
 	authenticator = authenticator_create(this->ike_sa);
 
-	authenticator->verify_authentication(authenticator,auth_payload->get_auth_method(auth_payload),received_auth_data,last_message_data,this->received_nonce,identification,&verified);
-	
+	status = authenticator->verify_auth_data(authenticator,auth_payload,this->ike_sa_init_reply_data,this->sent_nonce,other_id_payload,&verified);
 	authenticator->destroy(authenticator);
-	
-	allocator_free_chunk(&received_auth_data);
-	
-	
-	/* TODO VERIFY auth here */
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, ERROR, "Could not verify AUTH data. Error status: %s",mapping_find(status_m,status));
+		return FAILED;	
+	}
+
+	if (!verified)
+	{
+		this->logger->log(this->logger, ERROR | MORE, "AUTH data could not be verified");
+		return FAILED;	
+	}
+
+	this->logger->log(this->logger, CONTROL | MORE, "AUTH data verified");
 	return SUCCESS;	
 }
 
@@ -415,13 +427,15 @@ static ike_sa_state_t get_state(private_ike_auth_requested_t *this)
 static void destroy(private_ike_auth_requested_t *this)
 {
 	allocator_free_chunk(&(this->received_nonce));
+	allocator_free_chunk(&(this->sent_nonce));
+	allocator_free_chunk(&(this->ike_sa_init_reply_data));	
 	allocator_free(this);
 }
 
 /* 
  * Described in header.
  */
-ike_auth_requested_t *ike_auth_requested_create(protected_ike_sa_t *ike_sa, chunk_t received_nonce)
+ike_auth_requested_t *ike_auth_requested_create(protected_ike_sa_t *ike_sa,chunk_t sent_nonce,chunk_t received_nonce,chunk_t ike_sa_init_reply_data)
 {
 	private_ike_auth_requested_t *this = allocator_alloc_thing(private_ike_auth_requested_t);
 
@@ -440,6 +454,8 @@ ike_auth_requested_t *ike_auth_requested_create(protected_ike_sa_t *ike_sa, chun
 	/* private data */
 	this->ike_sa = ike_sa;
 	this->received_nonce = received_nonce;
+	this->sent_nonce = sent_nonce;
+	this->ike_sa_init_reply_data = ike_sa_init_reply_data;
 	this->logger = this->ike_sa->get_logger(this->ike_sa);
 	
 	return &(this->public);

Source/charon/sa/states/ike_auth_requested.h

@@ -55,6 +55,6 @@ struct ike_auth_requested_t {
  * 
  * @ingroup states
  */
-ike_auth_requested_t *ike_auth_requested_create(protected_ike_sa_t *ike_sa, chunk_t received_nonce);
+ike_auth_requested_t *ike_auth_requested_create(protected_ike_sa_t *ike_sa,chunk_t sent_nonce,chunk_t received_nonce,chunk_t ike_sa_init_repy_data);
 
 #endif /*IKE_AUTH_REQUESTED_H_*/

Source/charon/sa/states/ike_sa_init_requested.c

@@ -34,6 +34,7 @@
 #include <transforms/diffie_hellman.h>
 #include <sa/states/ike_auth_requested.h>
 #include <sa/states/initiator_init.h>
+#include <sa/authenticator.h>
 
 
 typedef struct private_ike_sa_init_requested_t private_ike_sa_init_requested_t;
@@ -73,6 +74,11 @@ struct private_ike_sa_init_requested_t {
 	 */
 	chunk_t received_nonce;
 	
+	/**
+	 * Packet data of ike_sa_init request
+	 */
+	chunk_t ike_sa_init_request_data;
+	
 	/**
 	 * DH group priority used to get dh_group_number from configuration manager.
 	 * 
@@ -92,8 +98,11 @@ struct private_ike_sa_init_requested_t {
 	 * 
 	 * @param this		calling object
 	 * @param message	the created message will be stored at this location
+	 * @return
+	 * 					- SUCCESS
+	 * 					- FAILED
 	 */
-	void (*build_ike_auth_request) (private_ike_sa_init_requested_t *this, message_t **message);
+	status_t (*build_ike_auth_request) (private_ike_sa_init_requested_t *this, message_t **message);
 	
 	/**
 	 * Builds the id payload for this state.
@@ -110,8 +119,11 @@ struct private_ike_sa_init_requested_t {
 	 * @param this		calling object
 	 * @param payload	The generated payload object of type auth_payload_t is 
 	 * 					stored at this location.
+	 * @return
+	 * 					- SUCCESS
+	 * 					- FAILED
 	 */
-	void (*build_auth_payload) (private_ike_sa_init_requested_t *this, payload_t **payload);
+	status_t (*build_auth_payload) (private_ike_sa_init_requested_t *this, payload_t **payload,id_payload_t *my_id_payload);
 	
 	/**
 	 * Builds the SA payload for this state.
@@ -156,6 +168,7 @@ struct private_ike_sa_init_requested_t {
 static status_t process_message(private_ike_sa_init_requested_t *this, message_t *ike_sa_init_reply)
 {
 	ike_auth_requested_t *next_state;
+	chunk_t ike_sa_init_reply_data;
 	exchange_type_t	exchange_type;
 	init_config_t *init_config;	
 	u_int64_t responder_spi;
@@ -381,8 +394,14 @@ static status_t process_message(private_ike_sa_init_requested_t *this, message_t
 	this->ike_sa->compute_secrets(this->ike_sa,this->shared_secret,this->sent_nonce, this->received_nonce);
 
 	/* build the complete IKE_AUTH request */
-	this->build_ike_auth_request (this,&request);
-
+	status = this->build_ike_auth_request (this,&request);
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, ERROR, "Could not build request message");
+		return DELETE_ME;
+	}
+	
+	
 	/* message can now be sent (must not be destroyed) */
 	status = this->ike_sa->send_request(this->ike_sa, request);
 	if (status != SUCCESS)
@@ -394,9 +413,11 @@ static status_t process_message(private_ike_sa_init_requested_t *this, message_t
 	
 	this->ike_sa->set_last_replied_message_id(this->ike_sa,ike_sa_init_reply->get_message_id(ike_sa_init_reply));
 
+	ike_sa_init_reply_data = ike_sa_init_reply->get_packet_data(ike_sa_init_reply);
+
 	/* state can now be changed */
 	this->logger->log(this->logger, CONTROL|MOST, "Create next state object");
-	next_state = ike_auth_requested_create(this->ike_sa,this->received_nonce);
+	next_state = ike_auth_requested_create(this->ike_sa,this->sent_nonce,this->received_nonce,ike_sa_init_reply_data);
 
 	/* state can now be changed */ 
 	this->ike_sa->set_new_state(this->ike_sa,(state_t *) next_state);
@@ -412,10 +433,11 @@ static status_t process_message(private_ike_sa_init_requested_t *this, message_t
 /**
  * implements private_ike_sa_init_requested_t.build_ike_auth_request
  */
-static void build_ike_auth_request (private_ike_sa_init_requested_t *this, message_t **request)
+static status_t build_ike_auth_request (private_ike_sa_init_requested_t *this, message_t **request)
 {
 	payload_t *payload;
 	message_t *message;
+	status_t status;
 	
 	/* going to build message */
 	this->logger->log(this->logger, CONTROL|MOST, "Going to build empty message");
@@ -427,7 +449,14 @@ static void build_ike_auth_request (private_ike_sa_init_requested_t *this, messa
 	message->add_payload(message, payload);
 
 	/* build auth payload */
-	this->build_auth_payload(this, &payload);
+	status = this->build_auth_payload(this, &payload,(id_payload_t *) payload);
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, ERROR, "Could not create auth payload");
+		message->destroy(message);
+		return status;
+	}
+	
 	this->logger->log(this->logger, CONTROL|MOST, "add AUTH payload to message");
 	message->add_payload(message, payload);
 	
@@ -447,6 +476,7 @@ static void build_ike_auth_request (private_ike_sa_init_requested_t *this, messa
 	message->add_payload(message, payload);	
 	
 	*request = message;
+	return SUCCESS;
 }
 
 /**
@@ -469,19 +499,23 @@ static void build_id_payload (private_ike_sa_init_requested_t *this, payload_t *
 /**
  * Implementation of private_ike_sa_init_requested_t.build_auth_payload.
  */
-static void build_auth_payload (private_ike_sa_init_requested_t *this, payload_t **payload)
+static status_t build_auth_payload (private_ike_sa_init_requested_t *this, payload_t **payload,id_payload_t *my_id_payload)
 {
+	authenticator_t *authenticator;
 	auth_payload_t *auth_payload;
-	sa_config_t *sa_config;
-
-	sa_config = this->ike_sa->get_sa_config(this->ike_sa);
-	auth_payload = auth_payload_create();
-	auth_payload->set_auth_method(auth_payload,sa_config->get_auth_method(sa_config));
-	/*
-	 * TODO generate AUTH DATA 
-	 */
-
+	status_t status;
+	
+	authenticator = authenticator_create(this->ike_sa);
+	status = authenticator->compute_auth_data(authenticator,&auth_payload,this->ike_sa_init_request_data,this->received_nonce,my_id_payload);	
+	authenticator->destroy(authenticator);
+	
+	if (status != SUCCESS)
+	{
+		return status;		
+	}
+	
 	*payload = (payload_t *) auth_payload;
+	return SUCCESS;
 }
 
 /**
@@ -575,10 +609,10 @@ static void destroy_after_state_change (private_ike_sa_init_requested_t *this)
 	
 	this->logger->log(this->logger, CONTROL | MOST, "Destroy diffie hellman object");
 	this->diffie_hellman->destroy(this->diffie_hellman);
-	this->logger->log(this->logger, CONTROL | MOST, "Destroy sent nonce");	
-	allocator_free(this->sent_nonce.ptr);
-	this->logger->log(this->logger, CONTROL | MOST, "Destroy shared secret (secrets allready derived)");
+	this->logger->log(this->logger, CONTROL | MOST, "Destroy shared secret");	
 	allocator_free_chunk(&(this->shared_secret));
+	this->logger->log(this->logger, CONTROL | MOST, "Destroy ike_sa_init_request_data");	
+	allocator_free_chunk(&(this->ike_sa_init_request_data));
 	this->logger->log(this->logger, CONTROL | MOST, "Destroy object itself");
 	allocator_free(this);	
 }
@@ -598,6 +632,8 @@ static void destroy(private_ike_sa_init_requested_t *this)
 	allocator_free(this->received_nonce.ptr);
 	this->logger->log(this->logger, CONTROL | MOST, "Destroy shared secret (secrets allready derived)");
 	allocator_free_chunk(&(this->shared_secret));
+	this->logger->log(this->logger, CONTROL | MOST, "Destroy ike_sa_init_request_data");	
+	allocator_free_chunk(&(this->ike_sa_init_request_data));
 	this->logger->log(this->logger, CONTROL | MOST, "Destroy object itself");
 	allocator_free(this);
 }
@@ -605,7 +641,7 @@ static void destroy(private_ike_sa_init_requested_t *this)
 /* 
  * Described in header.
  */
-ike_sa_init_requested_t *ike_sa_init_requested_create(protected_ike_sa_t *ike_sa, u_int16_t dh_group_priority, diffie_hellman_t *diffie_hellman, chunk_t sent_nonce)
+ike_sa_init_requested_t *ike_sa_init_requested_create(protected_ike_sa_t *ike_sa, u_int16_t dh_group_priority, diffie_hellman_t *diffie_hellman, chunk_t sent_nonce,chunk_t ike_sa_init_request_data)
 {
 	private_ike_sa_init_requested_t *this = allocator_alloc_thing(private_ike_sa_init_requested_t);
 	
@@ -630,6 +666,7 @@ ike_sa_init_requested_t *ike_sa_init_requested_create(protected_ike_sa_t *ike_sa
 	this->logger = this->ike_sa->get_logger(this->ike_sa);
 	this->diffie_hellman = diffie_hellman;
 	this->sent_nonce = sent_nonce;
+	this->ike_sa_init_request_data = ike_sa_init_request_data;
 	this->dh_group_priority = dh_group_priority;
 	
 	return &(this->public);

Source/charon/sa/states/ike_sa_init_requested.h

@@ -53,6 +53,6 @@ struct ike_sa_init_requested_t {
  * 
  * @ingroup states
  */
-ike_sa_init_requested_t *ike_sa_init_requested_create(protected_ike_sa_t *ike_sa, u_int16_t dh_group_priority, diffie_hellman_t *diffie_hellman, chunk_t sent_nonce);
+ike_sa_init_requested_t *ike_sa_init_requested_create(protected_ike_sa_t *ike_sa, u_int16_t dh_group_priority, diffie_hellman_t *diffie_hellman, chunk_t sent_nonce, chunk_t ike_sa_init_request_data);
 
 #endif /*IKE_SA_INIT_REQUESTED_H_*/

Source/charon/sa/states/ike_sa_init_responded.c

@@ -56,6 +56,21 @@ struct private_ike_sa_init_responded_t {
 	 */
 	chunk_t received_nonce;
 	
+	/**
+	 * Sent nonce.
+	 */
+	chunk_t sent_nonce;
+	
+	/**
+	 * Data of the IKE_SA_INIT response.
+	 */
+	chunk_t ike_sa_init_response_data;
+
+	/**
+	 * Data of the IKE_SA_INIT request.
+	 */	
+	chunk_t ike_sa_init_request_data;
+	
 	/**
 	 * sa config to use
 	 */
@@ -68,9 +83,9 @@ struct private_ike_sa_init_responded_t {
 	 */
 	logger_t *logger;
 	
-	status_t (*build_idr_payload) (private_ike_sa_init_responded_t *this, id_payload_t *request_idi, id_payload_t *request_idr, message_t *response);
+	status_t (*build_idr_payload) (private_ike_sa_init_responded_t *this, id_payload_t *request_idi, id_payload_t *request_idr, message_t *response,id_payload_t **response_idr);
 	status_t (*build_sa_payload) (private_ike_sa_init_responded_t *this, sa_payload_t *request, message_t *response);
-	status_t (*build_auth_payload) (private_ike_sa_init_responded_t *this, auth_payload_t *request,id_payload_t *other_id_payload, message_t *response);
+	status_t (*build_auth_payload) (private_ike_sa_init_responded_t *this, auth_payload_t *request,id_payload_t *other_id_payload,id_payload_t *my_id_payload, message_t* response);
 	status_t (*build_ts_payload) (private_ike_sa_init_responded_t *this, bool ts_initiator, ts_payload_t *request, message_t *response);
 };
 
@@ -84,7 +99,7 @@ static status_t process_message(private_ike_sa_init_responded_t *this, message_t
 	crypter_t *crypter;
 	iterator_t *payloads;
 	exchange_type_t exchange_type;
-	id_payload_t *idi_request, *idr_request = NULL;
+	id_payload_t *idi_request, *idr_request = NULL,*idr_response;
 	auth_payload_t *auth_request;
 	sa_payload_t *sa_request;
 	ts_payload_t *tsi_request, *tsr_request;
@@ -182,7 +197,7 @@ static status_t process_message(private_ike_sa_init_responded_t *this, message_t
 	
 	/* add payloads to it */
 	
-	status = this->build_idr_payload(this, idi_request, idr_request, response);
+	status = this->build_idr_payload(this, idi_request, idr_request, response,&idr_response);
 	if (status != SUCCESS)
 	{
 		this->logger->log(this->logger, ERROR, "Building idr payload failed");
@@ -196,7 +211,7 @@ static status_t process_message(private_ike_sa_init_responded_t *this, message_t
 		response->destroy(response);
 		return status;
 	}
-	status = this->build_auth_payload(this, auth_request,idi_request, response);
+	status = this->build_auth_payload(this, auth_request,idi_request, idr_response,response);
 	if (status != SUCCESS)
 	{
 		this->logger->log(this->logger, ERROR, "Building auth payload failed");
@@ -240,7 +255,7 @@ static status_t process_message(private_ike_sa_init_responded_t *this, message_t
 /**
  * Implements private_ike_sa_init_responded_t.build_idr_payload
  */
-static status_t build_idr_payload(private_ike_sa_init_responded_t *this, id_payload_t *request_idi, id_payload_t *request_idr, message_t *response)
+static status_t build_idr_payload(private_ike_sa_init_responded_t *this, id_payload_t *request_idi, id_payload_t *request_idr, message_t *response,id_payload_t **response_idr)
 {
 	identification_t *other_id, *my_id = NULL;
 	init_config_t *init_config;
@@ -280,7 +295,7 @@ static status_t build_idr_payload(private_ike_sa_init_responded_t *this, id_payl
 	/*  build response */
 	idr_response = id_payload_create_from_identification(FALSE, my_id);
 	response->add_payload(response, (payload_t*)idr_response);
-	
+	*response_idr = idr_response;
 	
 	return SUCCESS;
 }
@@ -331,37 +346,41 @@ static status_t build_sa_payload(private_ike_sa_init_responded_t *this, sa_paylo
 /**
  * Implements private_ike_sa_init_responded_t.build_auth_payload
  */
-static status_t build_auth_payload(private_ike_sa_init_responded_t *this, auth_payload_t *request,id_payload_t *other_id_payload, message_t *response)
+static status_t build_auth_payload(private_ike_sa_init_responded_t *this, auth_payload_t *auth_request,id_payload_t *other_id_payload,id_payload_t *my_id_payload, message_t* response)
 {
-	auth_payload_t *dummy;
-	u_int8_t data[] = {0x01,0x03,0x01,0x03,0x01,0x03,0x01,0x03,0x01,0x03,0x01,0x03,0x01,0x03,0x01,0x03};
-	chunk_t auth_data;
-	auth_data.ptr = data;
-	auth_data.len = sizeof(data);
 	authenticator_t *authenticator;
-	chunk_t received_auth_data = request->get_data(request);
-	chunk_t last_message_data = this->ike_sa->get_last_sent_message_data(this->ike_sa);
-	bool verified;
-	identification_t *identification;
+	auth_payload_t *auth_reply;
+	status_t status;
+	bool verified;	
 	
-	identification = other_id_payload->get_identification(other_id_payload);
-	
-	/* TODO VERIFY auth here */
 	authenticator = authenticator_create(this->ike_sa);
 
-	authenticator->verify_authentication(authenticator,request->get_auth_method(request),received_auth_data,last_message_data,this->received_nonce,identification,&verified);
-	
+
+	status =  authenticator->verify_auth_data(authenticator,auth_request, this->ike_sa_init_request_data,this->sent_nonce,other_id_payload,&verified);
+
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, ERROR, "Verification of AUTH payload returned status %s",mapping_find(status_m,status));
+		authenticator->destroy(authenticator);
+		return status;
+	}
+	if (!verified)
+	{
+		this->logger->log(this->logger, ERROR, "Verification of AUTH failed.");
+		authenticator->destroy(authenticator);
+		return FAILED;
+	}
+
+	status = authenticator->compute_auth_data(authenticator,&auth_reply, this->ike_sa_init_response_data,this->received_nonce,my_id_payload);
 	authenticator->destroy(authenticator);
-	
-	allocator_free_chunk(&received_auth_data);
-	
-	dummy = auth_payload_create();
-	dummy->set_data(dummy, auth_data);
-	dummy->set_auth_method(dummy, RSA_DIGITAL_SIGNATURE);
-	
-	/* TODO replace dummy */
-	
-	response->add_payload(response, (payload_t *)dummy);
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, ERROR, "Could not compute AUTH payload.");
+		return FAILED;
+		
+	}
+
+	response->add_payload(response, (payload_t *)auth_reply);
 	return SUCCESS;	
 }
 
@@ -427,14 +446,22 @@ static void destroy(private_ike_sa_init_responded_t *this)
 {
 	this->logger->log(this->logger, CONTROL | MORE, "Going to destroy ike_sa_init_responded_t state object");
 	
+	this->logger->log(this->logger, CONTROL | MOST, "Destroy received nonce");
 	allocator_free_chunk(&(this->received_nonce));
+	this->logger->log(this->logger, CONTROL | MOST, "Destroy sent nonce");
+	allocator_free_chunk(&(this->sent_nonce));
+	this->logger->log(this->logger, CONTROL | MOST, "Destroy IKE_SA_INIT response octets");
+	allocator_free_chunk(&(this->ike_sa_init_response_data));
+	this->logger->log(this->logger, CONTROL | MOST, "Destroy IKE_SA_INIT request octets");
+	allocator_free_chunk(&(this->ike_sa_init_request_data));
+
 	allocator_free(this);
 }
 
 /* 
  * Described in header.
  */
-ike_sa_init_responded_t *ike_sa_init_responded_create(protected_ike_sa_t *ike_sa, chunk_t received_nonce)
+ike_sa_init_responded_t *ike_sa_init_responded_create(protected_ike_sa_t *ike_sa, chunk_t received_nonce, chunk_t sent_nonce,chunk_t ike_sa_init_request_data, chunk_t ike_sa_init_response_data)
 {
 	private_ike_sa_init_responded_t *this = allocator_alloc_thing(private_ike_sa_init_responded_t);
 
@@ -452,6 +479,9 @@ ike_sa_init_responded_t *ike_sa_init_responded_create(protected_ike_sa_t *ike_sa
 	/* private data */
 	this->ike_sa = ike_sa;
 	this->received_nonce = received_nonce;
+	this->sent_nonce = sent_nonce;
+	this->ike_sa_init_response_data = ike_sa_init_response_data;
+	this->ike_sa_init_request_data = ike_sa_init_request_data;
 	this->logger = this->ike_sa->get_logger(this->ike_sa);
 	
 	return &(this->public);

Source/charon/sa/states/ike_sa_init_responded.h

@@ -54,6 +54,6 @@ struct ike_sa_init_responded_t {
  * 
  * @ingroup states
  */
-ike_sa_init_responded_t *ike_sa_init_responded_create(protected_ike_sa_t *ike_sa, chunk_t received_nonce);
+ike_sa_init_responded_t *ike_sa_init_responded_create(protected_ike_sa_t *ike_sa, chunk_t received_nonce,chunk_t sent_nonce,chunk_t ike_sa_init_request_data,chunk_t ike_sa_init_response_data);
 
 #endif /*IKE_SA_INIT_RESPONDED_H_*/

Source/charon/sa/states/initiator_init.c

@@ -134,6 +134,7 @@ static status_t initiate_connection (private_initiator_init_t *this, char *name)
 	init_config_t *init_config;
 	sa_config_t *sa_config;
 	status_t status;
+
 	
 	this->logger->log(this->logger, CONTROL, "Initializing connection %s",name);
 	
@@ -177,11 +178,13 @@ static status_t initiate_connection (private_initiator_init_t *this, char *name)
 status_t retry_initiate_connection (private_initiator_init_t *this, int dh_group_priority)
 {
 	ike_sa_init_requested_t *next_state;
+	chunk_t ike_sa_init_request_data;
 	init_config_t *init_config;
 	randomizer_t *randomizer;
+	ike_sa_id_t *ike_sa_id;
 	message_t *message;
 	status_t status;
-	ike_sa_id_t *ike_sa_id;
+
 	
 	this->dh_group_priority = dh_group_priority;
 		
@@ -218,10 +221,14 @@ status_t retry_initiate_connection (private_initiator_init_t *this, int dh_group
 		message->destroy(message);
 		return DELETE_ME;
 	}
+	
+	message = this->ike_sa->get_last_requested_message(this->ike_sa);
+	
+	ike_sa_init_request_data = message->get_packet_data(message);
 
 	/* state can now be changed */
 	this->logger->log(this->logger, CONTROL|MOST, "Create next state object");
-	next_state = ike_sa_init_requested_create(this->ike_sa, this->dh_group_priority, this->diffie_hellman, this->sent_nonce);
+	next_state = ike_sa_init_requested_create(this->ike_sa, this->dh_group_priority, this->diffie_hellman, this->sent_nonce,ike_sa_init_request_data);
 
 	/* state can now be changed */ 
 	this->ike_sa->set_new_state(this->ike_sa,(state_t *) next_state);

Source/charon/sa/states/responder_init.c

@@ -155,6 +155,8 @@ struct private_responder_init_t {
 static status_t process_message(private_responder_init_t *this, message_t *message)
 {
 	ike_sa_init_responded_t *next_state;
+	chunk_t ike_sa_init_response_data;
+	chunk_t ike_sa_init_request_data;
 	exchange_type_t	exchange_type;
 	host_t *source, *destination;
 	init_config_t *init_config;
@@ -166,6 +168,7 @@ static status_t process_message(private_responder_init_t *this, message_t *messa
 	host_t *my_host;
 	status_t status;
 
+
 	exchange_type = message->get_exchange_type(message);
 	if (exchange_type != IKE_SA_INIT)
 	{
@@ -357,12 +360,14 @@ static status_t process_message(private_responder_init_t *this, message_t *messa
 		return DELETE_ME;
 	}
 
-
-
 	/* state can now be changed */
 	this->logger->log(this->logger, CONTROL|MOST, "Create next state object");
 
-	next_state = ike_sa_init_responded_create(this->ike_sa, this->received_nonce);
+	response = this->ike_sa->get_last_responded_message(this->ike_sa);
+	ike_sa_init_response_data = response->get_packet_data(response);
+	ike_sa_init_request_data = message->get_packet_data(message);
+
+	next_state = ike_sa_init_responded_create(this->ike_sa, this->received_nonce, this->sent_nonce,ike_sa_init_request_data,ike_sa_init_response_data);
 	
 	/* state can now be changed */
 	this->ike_sa->set_new_state(this->ike_sa, (state_t *) next_state);
@@ -534,8 +539,6 @@ static void destroy_after_state_change (private_responder_init_t *this)
 		this->diffie_hellman->destroy(this->diffie_hellman);
 	}
 	
-	this->logger->log(this->logger, CONTROL | MOST, "Destroy sent nonce");
-	allocator_free_chunk(&(this->sent_nonce));
 	this->logger->log(this->logger, CONTROL | MOST, "Destroy object");	
 	allocator_free(this);
 }