- new configuration support added to ike_sa and states

Source/charon/sa/ike_sa.c

@@ -81,6 +81,16 @@ struct private_ike_sa_t {
 	 * Linked List containing the child sa's of the current IKE_SA
 	 */
 	linked_list_t *child_sas;
+	
+	/**
+	 * TODO
+	 */
+	init_config_t *init_config;
+	
+	/**
+	 * TODO
+	 */
+	sa_config_t *sa_config;
 
 	/**
 	 * Current state of the IKE_SA
@@ -297,11 +307,7 @@ static status_t initialize_connection(private_ike_sa_t *this, char *name)
 	current_state = (initiator_init_t *) this->current_state;
 	
 	status = current_state->initiate_connection(current_state,name);
-	
-	if (status != SUCCESS)
-	{
-		this->create_delete_job(this);
-	}
+
 	return status;
 }
 
@@ -467,16 +473,43 @@ static host_t *get_other_host (private_ike_sa_t *this)
 	return this->other.host;
 }
 
+/**
+ * Implementation of protected_ike_sa_t.get_init_config.
+ */
+static init_config_t *get_init_config (private_ike_sa_t *this)
+{
+	return this->init_config;
+}
+
+/**
+ * Implementation of protected_ike_sa_t.set_init_config.
+ */
+static void set_init_config (private_ike_sa_t *this,init_config_t * init_config)
+{
+	this->init_config = init_config;
+}
+
+/**
+ * Implementation of protected_ike_sa_t.get_sa_config.
+ */
+static sa_config_t *get_sa_config (private_ike_sa_t *this)
+{
+	return this->sa_config;
+}
+
+/**
+ * Implementation of protected_ike_sa_t.set_sa_config.
+ */
+static void set_sa_config (private_ike_sa_t *this,sa_config_t * sa_config)
+{
+	this->sa_config = sa_config;
+}
+
 /**
  * Implementation of protected_ike_sa_t.set_my_host.
  */
 static void set_my_host (private_ike_sa_t *this, host_t *my_host)
 {
-	if (this->me.host != NULL)
-	{
-		this	->logger->log(this->logger, CONTROL|MOST, "Destroy existing my host object");
-		this->me.host->destroy(this->me.host);
-	}
 	this->me.host = my_host;
 }
 
@@ -485,61 +518,25 @@ static void set_my_host (private_ike_sa_t *this, host_t *my_host)
  */
 static void set_other_host (private_ike_sa_t *this, host_t *other_host)
 {
-	if (this->other.host != NULL)
-	{
-		this	->logger->log(this->logger, CONTROL|MOST, "Destroy existing other host object");
-		this->other.host->destroy(this->other.host);
-	}
 	this->other.host = other_host;
 }
 
 /**
  * Implementation of protected_ike_sa_t.set_prf.
  */
-static status_t create_transforms_from_proposal (private_ike_sa_t *this,proposal_substructure_t *proposal)
+static status_t create_transforms_from_proposal (private_ike_sa_t *this,ike_proposal_t *proposal)
 {
-	status_t status;
-	u_int16_t encryption_algorithm;
-	u_int16_t encryption_algorithm_key_length;
-	u_int16_t integrity_algorithm;
-	u_int16_t integrity_algorithm_key_length;
-	u_int16_t pseudo_random_function;
-	u_int16_t pseudo_random_function_key_length;
-	
 	this->logger->log(this->logger, CONTROL|MORE, "Going to create transform objects for proposal");
 	
-	this->logger->log(this->logger, CONTROL|MOST, "Get encryption transform type");
-	status = proposal->get_info_for_transform_type(proposal,ENCRYPTION_ALGORITHM,&(encryption_algorithm),&(encryption_algorithm_key_length));
-	if (status != SUCCESS)
-	{
-		this->logger->log(this->logger, ERROR|MORE, "Could not get encryption transform type");
-		return status;
-	}
-	this->logger->log(this->logger, CONTROL|MORE, "Encryption algorithm: %s with keylength %d",mapping_find(encryption_algorithm_m,encryption_algorithm),encryption_algorithm_key_length);
-	
-	this->logger->log(this->logger, CONTROL|MOST, "Get integrity transform type");
-	status = proposal->get_info_for_transform_type(proposal,INTEGRITY_ALGORITHM,&(integrity_algorithm),&(integrity_algorithm_key_length));
-	if (status != SUCCESS)
-	{
-		this->logger->log(this->logger, ERROR|MORE, "Could not get integrity transform type");
-		return status;
-	}
-	this->logger->log(this->logger, CONTROL|MORE, "integrity algorithm: %s with keylength %d",mapping_find(integrity_algorithm_m,integrity_algorithm),integrity_algorithm_key_length);
-	
-	this->logger->log(this->logger, CONTROL|MOST, "Get prf transform type");
-	status = proposal->get_info_for_transform_type(proposal,PSEUDO_RANDOM_FUNCTION,&(pseudo_random_function),&(pseudo_random_function_key_length));
-	if (status != SUCCESS)
-	{
-		this->logger->log(this->logger, ERROR|MORE, "Could not prf transform type");
-		return status;
-	}
-	this->logger->log(this->logger, CONTROL|MORE, "prf: %s with keylength %d",mapping_find(pseudo_random_function_m,pseudo_random_function),pseudo_random_function_key_length);
+	this->logger->log(this->logger, CONTROL|MORE, "Encryption algorithm: %s with keylength %d",mapping_find(encryption_algorithm_m,proposal->encryption_algorithm),proposal->encryption_algorithm_key_length);
+	this->logger->log(this->logger, CONTROL|MORE, "integrity algorithm: %s with keylength %d",mapping_find(integrity_algorithm_m,proposal->integrity_algorithm),proposal->integrity_algorithm_key_length);
+	this->logger->log(this->logger, CONTROL|MORE, "prf: %s with keylength %d",mapping_find(pseudo_random_function_m,proposal->pseudo_random_function),proposal->pseudo_random_function_key_length);
 	
 	if (this->prf != NULL)
 	{
 		this->prf->destroy(this->prf);
 	}
-	this->prf = prf_create(pseudo_random_function);
+	this->prf = prf_create(proposal->pseudo_random_function);
 	if (this->prf == NULL)
 	{
 		this->logger->log(this->logger, ERROR|MORE, "prf not supported!");
@@ -550,7 +547,7 @@ static status_t create_transforms_from_proposal (private_ike_sa_t *this,proposal
 	{
 		this->crypter_initiator->destroy(this->crypter_initiator);
 	}
-	this->crypter_initiator = crypter_create(encryption_algorithm,encryption_algorithm_key_length);
+	this->crypter_initiator = crypter_create(proposal->encryption_algorithm,proposal->encryption_algorithm_key_length);
 	if (this->crypter_initiator == NULL)
 	{
 		this->logger->log(this->logger, ERROR|MORE, "encryption algorithm not supported!");
@@ -561,7 +558,7 @@ static status_t create_transforms_from_proposal (private_ike_sa_t *this,proposal
 	{
 		this->crypter_responder->destroy(this->crypter_responder);
 	}
-	this->crypter_responder = crypter_create(encryption_algorithm,encryption_algorithm_key_length);
+	this->crypter_responder = crypter_create(proposal->encryption_algorithm,proposal->encryption_algorithm_key_length);
 	if (this->crypter_responder == NULL)
 	{
 		this->logger->log(this->logger, ERROR|MORE, "encryption algorithm not supported!");
@@ -572,7 +569,7 @@ static status_t create_transforms_from_proposal (private_ike_sa_t *this,proposal
 	{
 		this->signer_initiator->destroy(this->signer_initiator);
 	}
-	this->signer_initiator = signer_create(integrity_algorithm);
+	this->signer_initiator = signer_create(proposal->integrity_algorithm);
 	if (this->signer_initiator == NULL)
 	{
 		this->logger->log(this->logger, ERROR|MORE, "integrity algorithm not supported!");
@@ -583,7 +580,7 @@ static status_t create_transforms_from_proposal (private_ike_sa_t *this,proposal
 	{
 		this->signer_responder->destroy(this->signer_responder);
 	}
-	this->signer_responder = signer_create(integrity_algorithm);
+	this->signer_responder = signer_create(proposal->integrity_algorithm);
 	if (this->signer_responder == NULL)
 	{
 		this->logger->log(this->logger, ERROR|MORE, "integrity algorithm not supported!");
@@ -733,6 +730,19 @@ static void destroy (private_ike_sa_t *this)
 		this->last_requested_message->destroy(this->last_requested_message);
 	}
 	
+	/* destroy stored host_t objects */
+	if (this->me.host != NULL)
+	{
+		this->me.host->destroy(this->me.host);
+	}
+	
+	/* destroy stored host_t objects */
+	if (this->other.host != NULL)
+	{
+		this->other.host->destroy(this->other.host);
+	}
+	
+	
 	/* destroy stored responded messages */
 	if (this->last_responded_message != NULL)
 	{
@@ -741,16 +751,6 @@ static void destroy (private_ike_sa_t *this)
 	
 	this->randomizer->destroy(this->randomizer);
 
-	if (this->me.host != NULL)
-	{
-		this->me.host->destroy(this->me.host);
-	}
-	
-	if (this->other.host != NULL)
-	{
-		this->other.host->destroy(this->other.host);
-	}
-	
 	this->logger->log(this->logger, CONTROL | MOST, "Destroy current state object");
 	this->current_state->destroy(this->current_state);
 	
@@ -777,6 +777,10 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
 	this->protected.build_message = (void (*) (protected_ike_sa_t *, exchange_type_t , bool , message_t **)) build_message;
 	this->protected.compute_secrets = (void (*) (protected_ike_sa_t *,chunk_t ,chunk_t , chunk_t )) compute_secrets;
 	this->protected.get_logger = (logger_t *(*) (protected_ike_sa_t *)) get_logger;		
+	this->protected.set_init_config = (void (*) (protected_ike_sa_t *,init_config_t *)) set_init_config;
+	this->protected.get_init_config = (init_config_t *(*) (protected_ike_sa_t *)) get_init_config;
+	this->protected.set_sa_config = (void (*) (protected_ike_sa_t *,sa_config_t *)) set_sa_config;
+	this->protected.get_sa_config = (sa_config_t *(*) (protected_ike_sa_t *)) get_sa_config;
 	this->protected.get_my_host = (host_t *(*) (protected_ike_sa_t *)) get_my_host;
 	this->protected.get_other_host = (host_t *(*) (protected_ike_sa_t *)) get_other_host;
 	this->protected.set_my_host = (void(*) (protected_ike_sa_t *,host_t *)) set_my_host;
@@ -784,7 +788,7 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
 	this->protected.get_randomizer = (randomizer_t *(*) (protected_ike_sa_t *)) get_randomizer;
 	this->protected.set_last_requested_message = (status_t (*) (protected_ike_sa_t *,message_t *)) set_last_requested_message;
 	this->protected.set_last_responded_message = (status_t (*) (protected_ike_sa_t *,message_t *)) set_last_responded_message;
-	this->protected.create_transforms_from_proposal = (status_t (*) (protected_ike_sa_t *,proposal_substructure_t *)) create_transforms_from_proposal;
+	this->protected.create_transforms_from_proposal = (status_t (*) (protected_ike_sa_t *,ike_proposal_t *)) create_transforms_from_proposal;
 	this->protected.set_new_state = (void (*) (protected_ike_sa_t *,state_t *)) set_new_state;
 	this->protected.get_crypter_initiator = (crypter_t *(*) (protected_ike_sa_t *)) get_crypter_initiator;
 	this->protected.get_signer_initiator = (signer_t *(*) (protected_ike_sa_t *)) get_signer_initiator;	
@@ -821,6 +825,8 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
 	this->signer_initiator = NULL;
 	this->signer_responder = NULL;
 	this->prf = NULL;
+	this->init_config = NULL;
+	this->sa_config = NULL;
 	
 	/* at creation time, IKE_SA is in a initiator state */
 	if (ike_sa_id->is_initiator(ike_sa_id))

Source/charon/sa/ike_sa.h

@@ -27,6 +27,7 @@
 #include <encoding/message.h>
 #include <encoding/payloads/proposal_substructure.h>
 #include <sa/ike_sa_id.h>
+#include <config/configuration_manager.h>
 #include <utils/logger.h>
 #include <utils/randomizer.h>
 #include <sa/states/state.h>
@@ -137,6 +138,41 @@ struct protected_ike_sa_t {
 	 */
 	logger_t *(*get_logger) (protected_ike_sa_t *this);
 	
+	/**
+	 * Gets the internal stored init_config_t object.
+	 * 
+	 * Returned value has to get checked for NULL value!
+	 * 
+	 * @param this 				calling object
+	 * @return					pointer to the internal stored init_config_t object
+	 */
+	init_config_t *(*get_init_config) (protected_ike_sa_t *this);
+	
+	/**
+	 * Sets the internal init_config_t object.
+	 * 
+	 * @param this 				calling object
+	 * @param init_config		object of type init_config_t
+	 */
+	void (*set_init_config) (protected_ike_sa_t *this,init_config_t *init_config);
+	
+	/**
+	 * Gets the internal stored sa_config_t object.
+	 * 
+	 * Returned value has to get checked for NULL value!
+	 * 
+	 * @param this 				calling object
+	 * @return					pointer to the internal stored sa_config_t object
+	 */
+	sa_config_t *(*get_sa_config) (protected_ike_sa_t *this);
+	
+	/**
+	 * Sets the internal sa_config_t object.
+	 * 
+	 * @param this 				calling object
+	 * @param sa_config			object of type sa_config_t
+	 */
+	void (*set_sa_config) (protected_ike_sa_t *this,sa_config_t *sa_config);
 
 	/**
 	 * Gets the internal stored host_t object for my host.
@@ -176,7 +212,7 @@ struct protected_ike_sa_t {
 	
 	/**
 	 * Creates all needed transform objects for given ike_sa_t using 
-	 * the informations stored in a proposal_substructure_t object
+	 * the informations stored in a ike_proposal_t object
 	 * 
 	 * Allready existing objects get destroyed.
 	 * 
@@ -184,7 +220,7 @@ struct protected_ike_sa_t {
 	 * @param proposal			proposal used to get informations for transform
 	 * 							objects (algorithms, key lengths, etc.)
 	 */
-	status_t (*create_transforms_from_proposal) (protected_ike_sa_t *this,proposal_substructure_t *proposal);
+	status_t (*create_transforms_from_proposal) (protected_ike_sa_t *this,ike_proposal_t * proposal);
 	
 	/**
 	 * Sets the last requested message.

Source/charon/sa/states/ike_sa_init_requested.c

@@ -173,57 +173,48 @@ static status_t process_message(private_ike_sa_init_requested_t *this, message_t
 			case SECURITY_ASSOCIATION:
 			{
 				sa_payload_t *sa_payload = (sa_payload_t*)payload;
-				iterator_t 	*suggested_proposals;
-				proposal_substructure_t *suggested_proposal;			
-				bool valid;
-				
+				ike_proposal_t *ike_proposals;
+				ike_proposal_t selected_proposal;
+				size_t proposal_count;			
+				init_config_t *init_config;	
 				
 				/* get the list of suggested proposals */ 
-				suggested_proposals = sa_payload->create_proposal_substructure_iterator(sa_payload, TRUE);
-
+				status = sa_payload->get_ike_proposals (sa_payload, &ike_proposals,&proposal_count);
+				if (status != SUCCESS)
+				{
+					this->logger->log(this->logger, ERROR | MORE, "SA payload does not contain IKE proposals");
+					payloads->destroy(payloads);
+					return status;	
+				}
+				
+				if (proposal_count != 1)
+				{
+					this->logger->log(this->logger, ERROR | MORE, "More then one proposal selected!");
+					allocator_free(ike_proposals);
+					payloads->destroy(payloads);
+					return status;							
+				}
 				
 				/* now let the configuration-manager check the selected proposals*/
 				this->logger->log(this->logger, CONTROL | MOST, "Check suggested proposals");
-				status = charon->configuration_manager->check_selected_proposals_for_host(charon->configuration_manager,
-									this->ike_sa->get_other_host(this->ike_sa), suggested_proposals,&valid);
+				init_config = this->ike_sa->get_init_config(this->ike_sa);
+
+				status = init_config->select_proposal (init_config,ike_proposals,1,&selected_proposal);
+				allocator_free(ike_proposals);
 				if (status != SUCCESS)
 				{
-					this->logger->log(this->logger, ERROR | MORE, "Could not check suggested proposals!");
-					suggested_proposals->destroy(suggested_proposals);
+					this->logger->log(this->logger, ERROR | MORE, "Selected proposal not a suggested one!");
 					payloads->destroy(payloads);
 					return status;
 				}
-
-				if (!valid)
-				{
-					this->logger->log(this->logger, ERROR | MORE, "Suggested proposals not accepted!");
-					payloads->destroy(payloads);
-					return status;
-				}
-
-
-				/* let the ike_sa create their own transforms from proposal informations */
-				suggested_proposals->reset(suggested_proposals);
-				/* TODO check for true*/
-				suggested_proposals->has_next(suggested_proposals);
-				status = suggested_proposals->current(suggested_proposals,(void **)&suggested_proposal);
-				suggested_proposals->destroy(suggested_proposals);
-				if (status != SUCCESS)
-				{
-					this->logger->log(this->logger, ERROR | MORE, "Could not get first proposal");
-					payloads->destroy(payloads);
-					return status;
-				}
-								
-				status = this->ike_sa->create_transforms_from_proposal(this->ike_sa,suggested_proposal);	
+							
+				status = this->ike_sa->create_transforms_from_proposal(this->ike_sa,&selected_proposal);	
 				if (status != SUCCESS)
 				{
 					this->logger->log(this->logger, ERROR | MORE, "Transform objects could not be created from selected proposal");
 					payloads->destroy(payloads);
 					return status;
 				}
-				
-
 				/* ok, we have what we need for sa_payload */
 				break;
 			}

Source/charon/sa/states/ike_sa_init_responded.c

@@ -83,7 +83,7 @@ static status_t process_message(private_ike_sa_init_responded_t *this, message_t
 	status_t status;
 	signer_t *signer;
 	crypter_t *crypter;
-	iterator_t *payloads, *iterator;
+	iterator_t *payloads;
 	exchange_type_t exchange_type;
 	id_payload_t *idi_payload, *idr_payload;
 	auth_payload_t *auth_payload;
@@ -234,7 +234,6 @@ static status_t process_message(private_ike_sa_init_responded_t *this, message_t
 
 static status_t build_id_payload(private_ike_sa_init_responded_t *this, id_payload_t *id_payload)
 {
-	
 	return SUCCESS;
 }
 

Source/charon/sa/states/initiator_init.c

@@ -72,12 +72,6 @@ struct private_initiator_init_t {
 	 * This nonce is passed to the next state of type ike_sa_init_requested_t.
 	 */
 	chunk_t sent_nonce;
-	
-	/**
-	 * Proposals used to initiate connection.
-	 * 
-	 */
-	linked_list_t *proposals;
 
 	/**
 	 * Logger used to log :-)
@@ -136,66 +130,43 @@ struct private_initiator_init_t {
  */
 static status_t initiate_connection (private_initiator_init_t *this, char *name)
 {
-	iterator_t *proposal_iterator;
 	ike_sa_init_requested_t *next_state;
 	message_t *message;
 	packet_t *packet;
 	status_t status;
-	host_t *my_host;
-	host_t *other_host;
 	randomizer_t *randomizer;
+	init_config_t *init_config;
 	
 	this->logger->log(this->logger, CONTROL, "Initializing connection %s",name);
 	
-	/* get local host */
-	status = charon->configuration_manager->get_local_host(charon->configuration_manager, name, &my_host);
+	/* get init_config_t object */
+	status = charon->configuration_manager->get_init_config_for_name(charon->configuration_manager,name,&init_config);
+	
 	if (status != SUCCESS)
 	{	
-		this->logger->log(this->logger, ERROR | MORE, "Could not retrieve local host configuration information for %s",name);
+		this->logger->log(this->logger, ERROR | MORE, "Could not retrieve INIT configuration informations for %s",name);
 		return INVALID_ARG;
 	}
-	this->ike_sa->set_my_host(this->ike_sa,my_host);
 	
-	/* get remote host */
-	status = charon->configuration_manager->get_remote_host(charon->configuration_manager, name, &other_host);
-	if (status != SUCCESS)
-	{	
-		this->logger->log(this->logger, ERROR | MORE, "Could not retrieve remote host configuration information for %s",name);
-		return INVALID_ARG;
-	}
-	this->ike_sa->set_other_host(this->ike_sa,other_host);
+	/* configuration can be set */
+	this->ike_sa->set_init_config(this->ike_sa,init_config);
 	
-	/* get dh group */
-	status = charon->configuration_manager->get_dh_group_number(charon->configuration_manager, name, &(this->dh_group_number), this->dh_group_priority);
-	if (status != SUCCESS)
+	this->ike_sa->set_other_host(this->ike_sa,init_config->get_other_host_clone(init_config));
+	this->ike_sa->set_my_host(this->ike_sa,init_config->get_my_host_clone(init_config));
+	
+	this->dh_group_number = init_config->get_dh_group_number(init_config,this->dh_group_priority);
+	if (this->dh_group_number == MODP_UNDEFINED)
 	{
-		this->logger->log(this->logger, ERROR | MORE, "Could not retrieve DH group number configuration for %s",name);
+		this->logger->log(this->logger, ERROR | MORE, "Diffie hellman group could not be  retrieved with priority %d", this->dh_group_priority);
 		return INVALID_ARG;
 	}
-
-	/* get proposals */
-	proposal_iterator = this->proposals->create_iterator(this->proposals, FALSE);
-	status = charon->configuration_manager->get_proposals_for_host(charon->configuration_manager, this->ike_sa->get_other_host(this->ike_sa), proposal_iterator);
 	
-	proposal_iterator->destroy(proposal_iterator);
-	if (status != SUCCESS)
-	{
-		this->logger->log(this->logger, ERROR | MORE, "Could not retrieve Proposals for %s",name);
-		return status;
-	}
-
 	/* a diffie hellman object could allready exist caused by an failed initiate_connection call */	
 	if (this->diffie_hellman == NULL)
 	{
 		this->diffie_hellman = diffie_hellman_create(this->dh_group_number);
 	}
 	
-	if (this->diffie_hellman == NULL)
-	{
-		this->logger->log(this->logger, ERROR, "Object of type diffie_hellman_t could not be created!");
-		return FAILED;
-	}
-	
 	if (this->sent_nonce.ptr != NULL)
 	{
 		allocator_free(this->sent_nonce.ptr);
@@ -286,29 +257,19 @@ static void build_ike_sa_init_request (private_initiator_init_t *this, message_t
 static void build_sa_payload(private_initiator_init_t *this, payload_t **payload)
 {
 	sa_payload_t* sa_payload;
-	iterator_t *proposal_iterator;
+	size_t proposal_count;
+	ike_proposal_t *proposals;
+	init_config_t *init_config;
 	
-	/* SA payload takes proposals from this->ike_sa_init_data.proposals 
-	 * and writes them to the created sa_payload 
-	 */
-
 	this->logger->log(this->logger, CONTROL|MORE, "building sa payload");
-	proposal_iterator = this->proposals->create_iterator(this->proposals, FALSE);
 	
-	sa_payload = sa_payload_create();
-	
-	while (proposal_iterator->has_next(proposal_iterator))
-	{
-		proposal_substructure_t *current_proposal;
-		proposal_substructure_t *current_proposal_clone;
-		proposal_iterator->current(proposal_iterator,(void **) &current_proposal);
+	init_config = this->ike_sa->get_init_config(this->ike_sa);
 
-		current_proposal_clone = current_proposal->clone(current_proposal);
-		
-		sa_payload->add_proposal_substructure(sa_payload,current_proposal_clone);
-	}
-	proposal_iterator->destroy(proposal_iterator);
+	proposal_count = init_config->get_proposals(init_config,&proposals);
 	
+	sa_payload = sa_payload_create_from_ike_proposals(proposals,proposal_count);	
+
+	allocator_free(proposals);
 	*payload = (payload_t *) sa_payload;	
 }
 
@@ -375,14 +336,7 @@ static void destroy(private_initiator_init_t *this)
 
 	/* destroy stored proposal */
 	this->logger->log(this->logger, CONTROL | MOST, "Destroy stored proposals");
-	while (this->proposals->get_count(this->proposals) > 0)
-	{
-		proposal_substructure_t *current_proposal;
-		this->proposals->remove_first(this->proposals,(void **)&current_proposal);
-		current_proposal->destroy(current_proposal);
-	}
-	this->proposals->destroy(this->proposals);
-	
+
 	/* destroy diffie hellman object */
 	if (this->diffie_hellman != NULL)
 	{
@@ -406,13 +360,6 @@ static void destroy_after_state_change (private_initiator_init_t *this)
 	
 	/* destroy stored proposal */
 	this->logger->log(this->logger, CONTROL | MOST, "Destroy stored proposals");
-	while (this->proposals->get_count(this->proposals) > 0)
-	{
-		proposal_substructure_t *current_proposal;
-		this->proposals->remove_first(this->proposals,(void **)&current_proposal);
-		current_proposal->destroy(current_proposal);
-	}
-	this->proposals->destroy(this->proposals);
 	allocator_free(this);
 }
 
@@ -442,7 +389,6 @@ initiator_init_t *initiator_init_create(protected_ike_sa_t *ike_sa)
 	this->ike_sa = ike_sa;
 	this->dh_group_priority = 1;
 	this->logger = this->ike_sa->get_logger(this->ike_sa);
-	this->proposals = linked_list_create();
 	this->sent_nonce = CHUNK_INITIALIZER;
 
 	return &(this->public);

Source/charon/sa/states/responder_init.c

@@ -89,10 +89,10 @@ struct private_responder_init_t {
 	logger_t *logger;
 	
 	/**
-	 * Proposals used to initiate connection
+	 * Selected proposal from suggested ones.
 	 */
-	linked_list_t *proposals;
-	
+	ike_proposal_t selected_proposal;
+
 	/**
 	 * Builds the SA payload for this state.
 	 * 
@@ -147,6 +147,8 @@ static status_t process_message(private_responder_init_t *this, message_t *messa
 	host_t *my_host;
 	host_t *other_host;
 	randomizer_t *randomizer;
+	init_config_t *init_config;
+	diffie_hellman_group_t dh_group = MODP_UNDEFINED;
 
 	exchange_type = message->get_exchange_type(message);
 	if (exchange_type != IKE_SA_INIT)
@@ -154,16 +156,26 @@ static status_t process_message(private_responder_init_t *this, message_t *messa
 		this->logger->log(this->logger, ERROR | MORE, "Message of type %s not supported in state responder_init",mapping_find(exchange_type_m,exchange_type));
 		return FAILED;
 	}
-	
 	if (!message->get_request(message))
 	{
 		this->logger->log(this->logger, ERROR | MORE, "Only requests of type IKE_SA_INIT supported in state responder_init");
 		return FAILED;
 	}
-	
 	/* this is the first message we process, so copy host infos */
 	source = message->get_source(message);
 	destination = message->get_destination(message);
+
+	status = charon->configuration_manager->get_init_config_for_host(charon->configuration_manager,destination,source,&init_config);
+
+	if (status != SUCCESS)
+	{
+		/* no configuration matches given host */
+		this->logger->log(this->logger, ERROR | MORE, "No INIT configuration found for given remote and local hosts");
+		return FAILED;
+	}
+	
+	this->ike_sa->set_init_config(this->ike_sa,init_config);
+	
 	
 	/* we need to clone them, since we destroy the message later */
 	my_host = destination->clone(destination);
@@ -195,44 +207,30 @@ static status_t process_message(private_responder_init_t *this, message_t *messa
 			case SECURITY_ASSOCIATION:
 			{
 				sa_payload_t *sa_payload = (sa_payload_t*)payload;
-				iterator_t *suggested_proposals, *accepted_proposals;
-				proposal_substructure_t *accepted_proposal;
-				
-				accepted_proposals = this->proposals->create_iterator(this->proposals, FALSE);
-				
+				ike_proposal_t *ike_proposals;
+				size_t proposal_count;
+			
 				/* get the list of suggested proposals */ 
-				suggested_proposals = sa_payload->create_proposal_substructure_iterator(sa_payload, TRUE);
-				
-				/* now let the configuration-manager select a subset of the proposals */
-				status = charon->configuration_manager->select_proposals_for_host(charon->configuration_manager,
-									this->ike_sa->get_other_host(this->ike_sa), suggested_proposals, accepted_proposals);
+				status = sa_payload->get_ike_proposals (sa_payload, &ike_proposals,&proposal_count);
 				if (status != SUCCESS)
 				{
-					this->logger->log(this->logger, CONTROL | MORE, "No proposal of suggested proposals selected");
-					suggested_proposals->destroy(suggested_proposals);
-					accepted_proposals->destroy(accepted_proposals);
+					this->logger->log(this->logger, ERROR | MORE, "SA payload does not contain IKE proposals");
+					payloads->destroy(payloads);
+					return status;	
+				}
+	
+				status = init_config->select_proposal(init_config, ike_proposals,proposal_count,&(this->selected_proposal));
+				allocator_free(ike_proposals);
+				if (status != SUCCESS)
+				{
+					this->logger->log(this->logger, ERROR | MORE, "No proposal of suggested proposals selected");
 					payloads->destroy(payloads);
 					return status;
 				}
 				
-				/* iterators are not needed anymore */			
-				suggested_proposals->destroy(suggested_proposals);
+				dh_group = this->selected_proposal.diffie_hellman_group;
 				
-				/* let the ike_sa create their own transforms from proposal informations */
-				accepted_proposals->reset(accepted_proposals);
-				/* TODO check for true*/
-				accepted_proposals->has_next(accepted_proposals);
-				status = accepted_proposals->current(accepted_proposals,(void **)&accepted_proposal);
-				if (status != SUCCESS)
-				{
-					this->logger->log(this->logger, ERROR | MORE, "Accepted proposals not supported?!");
-					accepted_proposals->destroy(accepted_proposals);
-					payloads->destroy(payloads);
-					return status;
-				}
-				
-				status = this->ike_sa->create_transforms_from_proposal(this->ike_sa,accepted_proposal);	
-				accepted_proposals->destroy(accepted_proposals);
+				status = this->ike_sa->create_transforms_from_proposal(this->ike_sa,&(this->selected_proposal));	
 				if (status != SUCCESS)
 				{
 					this->logger->log(this->logger, ERROR | MORE, "Transform objects could not be created from selected proposal");
@@ -253,12 +251,9 @@ static status_t process_message(private_responder_init_t *this, message_t *messa
 				
 				group = ke_payload->get_dh_group_number(ke_payload);
 				
-				status = charon->configuration_manager->is_dh_group_allowed_for_host(charon->configuration_manager,
-								this->ike_sa->get_other_host(this->ike_sa), group, &allowed_group);
-
-				if (status != SUCCESS)
+				if (dh_group == MODP_UNDEFINED)
 				{
-					this->logger->log(this->logger, ERROR | MORE, "Could not get informations about DH group");
+					this->logger->log(this->logger, ERROR | MORE, "Could not get informations about DH group. SA payload before KE payload?");
 					payloads->destroy(payloads);
 					return status;
 				}
@@ -387,27 +382,12 @@ static status_t process_message(private_responder_init_t *this, message_t *messa
 static void build_sa_payload(private_responder_init_t *this, payload_t **payload)
 {
 	sa_payload_t* sa_payload;
-	iterator_t *proposal_iterator;
 	
 	/* SA payload takes proposals from this->ike_sa_init_data.proposals and writes them to the created sa_payload */
 	
 	this->logger->log(this->logger, CONTROL|MORE, "building sa payload");
 	
-	proposal_iterator = this->proposals->create_iterator(this->proposals, FALSE);
-	
-	sa_payload = sa_payload_create();
-	
-	while (proposal_iterator->has_next(proposal_iterator))
-	{
-		proposal_substructure_t *current_proposal;
-		proposal_substructure_t *current_proposal_clone;
-		
-		proposal_iterator->current(proposal_iterator,(void **) &current_proposal);
-		current_proposal_clone = current_proposal->clone(current_proposal);
-		sa_payload->add_proposal_substructure(sa_payload,current_proposal_clone);
-	}
-	
-	proposal_iterator->destroy(proposal_iterator);	
+	sa_payload = sa_payload_create_from_ike_proposals(&(this->selected_proposal),1);	
 	
 	*payload = (payload_t *) sa_payload;
 }
@@ -466,13 +446,6 @@ static void destroy(private_responder_init_t *this)
 	
 	/* destroy stored proposal */
 	this->logger->log(this->logger, CONTROL | MOST, "Destroy stored proposals");
-	while (this->proposals->get_count(this->proposals) > 0)
-	{
-		proposal_substructure_t *current_proposal;
-		this->proposals->remove_first(this->proposals,(void **)&current_proposal);
-		current_proposal->destroy(current_proposal);
-	}
-	this->proposals->destroy(this->proposals);
 	
 	allocator_free(this->sent_nonce.ptr);
 	allocator_free(this->received_nonce.ptr);
@@ -493,13 +466,6 @@ static void destroy_after_state_change (private_responder_init_t *this)
 	
 	/* destroy stored proposal */
 	this->logger->log(this->logger, CONTROL | MOST, "Destroy stored proposals");
-	while (this->proposals->get_count(this->proposals) > 0)
-	{
-		proposal_substructure_t *current_proposal;
-		this->proposals->remove_first(this->proposals,(void **)&current_proposal);
-		current_proposal->destroy(current_proposal);
-	}
-	this->proposals->destroy(this->proposals);
 	
 	/* destroy diffie hellman object */
 	if (this->diffie_hellman != NULL)
@@ -534,7 +500,6 @@ responder_init_t *responder_init_create(protected_ike_sa_t *ike_sa)
 	this->logger = this->ike_sa->get_logger(this->ike_sa);
 	this->sent_nonce = CHUNK_INITIALIZER;
 	this->received_nonce = CHUNK_INITIALIZER;
-	this->proposals = linked_list_create();
 
 	return &(this->public);
 }