Merge branch 'ikev1'

Conflicts:
	configure.in
	man/ipsec.conf.5.in
	src/libcharon/encoding/generator.c
	src/libcharon/encoding/payloads/notify_payload.c
	src/libcharon/encoding/payloads/notify_payload.h
	src/libcharon/encoding/payloads/payload.c
	src/libcharon/network/receiver.c
	src/libcharon/sa/authenticator.c
	src/libcharon/sa/authenticator.h
	src/libcharon/sa/ikev2/tasks/ike_init.c
	src/libcharon/sa/task_manager.c
	src/libstrongswan/credentials/auth_cfg.c

src/libcharon/config/backend_manager.c

@@ -146,10 +146,11 @@ METHOD(backend_manager_t, get_ike_cfg, ike_cfg_t*,
 	ike_cfg_match_t match, best = MATCH_ANY;
 	ike_data_t *data;
 
-	data = malloc_thing(ike_data_t);
-	data->this = this;
-	data->me = me;
-	data->other = other;
+	INIT(data,
+		.this = this,
+		.me = me,
+		.other = other,
+	);
 
 	DBG2(DBG_CFG, "looking for an ike config for %H...%H", me, other);
 
@@ -160,7 +161,7 @@ METHOD(backend_manager_t, get_ike_cfg, ike_cfg_t*,
 	while (enumerator->enumerate(enumerator, (void**)&current))
 	{
 		match = get_ike_match(current, me, other);
-
+		DBG3(DBG_CFG, "ike config match: %d (%H %H)", match, me, other);
 		if (match)
 		{
 			DBG2(DBG_CFG, "  candidate: %s...%s, prio %d",
@@ -195,9 +196,13 @@ static id_match_t get_peer_match(identification_t *id,
 	auth_cfg_t *auth;
 	identification_t *candidate;
 	id_match_t match = ID_MATCH_NONE;
+	char *where = local ? "local" : "remote";
+	chunk_t data;
 
 	if (!id)
 	{
+		DBG3(DBG_CFG, "peer config match %s: %d (%N)",
+			 where, ID_MATCH_ANY, id_type_names, ID_ANY);
 		return ID_MATCH_ANY;
 	}
 
@@ -221,9 +226,29 @@ static id_match_t get_peer_match(identification_t *id,
 		}
 	}
 	enumerator->destroy(enumerator);
+
+	data = id->get_encoding(id);
+	DBG3(DBG_CFG, "peer config match %s: %d (%N -> %#B)",
+		 where, match, id_type_names, id->get_type(id), &data);
 	return match;
 }
 
+/**
+ * Get match quality of IKE version
+ */
+static int get_version_match(ike_version_t cfg, ike_version_t req)
+{
+	if (req == IKE_ANY || cfg == IKE_ANY)
+	{
+		return 1;
+	}
+	if (req == cfg)
+	{
+		return 2;
+	}
+	return 0;
+}
+
 /**
  * data to pass nested peer enumerator
  */
@@ -317,17 +342,18 @@ static void insert_sorted(match_entry_t *entry, linked_list_t *list,
 
 METHOD(backend_manager_t, create_peer_cfg_enumerator, enumerator_t*,
 	private_backend_manager_t *this, host_t *me, host_t *other,
-	identification_t *my_id, identification_t *other_id)
+	identification_t *my_id, identification_t *other_id, ike_version_t version)
 {
 	enumerator_t *enumerator;
 	peer_data_t *data;
 	peer_cfg_t *cfg;
 	linked_list_t *configs, *helper;
 
-	data = malloc_thing(peer_data_t);
-	data->lock = this->lock;
-	data->me = my_id;
-	data->other = other_id;
+	INIT(data,
+		.lock = this->lock,
+		.me = my_id,
+		.other = other_id,
+	);
 
 	/* create a sorted list with all matches */
 	this->lock->read_lock(this->lock);
@@ -340,9 +366,6 @@ METHOD(backend_manager_t, create_peer_cfg_enumerator, enumerator_t*,
 		return enumerator;
 	}
 
-	DBG1(DBG_CFG, "looking for peer configs matching %H[%Y]...%H[%Y]",
-		 me, my_id, other, other_id);
-
 	configs = linked_list_create();
 	/* only once allocated helper list for sorting */
 	helper = linked_list_create();
@@ -350,29 +373,26 @@ METHOD(backend_manager_t, create_peer_cfg_enumerator, enumerator_t*,
 	{
 		id_match_t match_peer_me, match_peer_other;
 		ike_cfg_match_t match_ike;
+		int match_version;
 		match_entry_t *entry;
-		chunk_t data;
 
 		match_peer_me = get_peer_match(my_id, cfg, TRUE);
-		data = my_id->get_encoding(my_id);
-		DBG3(DBG_CFG, "match_peer_me: %d (%N -> %#B)", match_peer_me,
-			 id_type_names, my_id->get_type(my_id), &data);
 		match_peer_other = get_peer_match(other_id, cfg, FALSE);
-		data = other_id->get_encoding(other_id);
-		DBG3(DBG_CFG, "match_peer_other: %d (%N -> %#B)", match_peer_other,
-			 id_type_names, other_id->get_type(other_id), &data);
 		match_ike = get_ike_match(cfg->get_ike_cfg(cfg), me, other);
-		DBG3(DBG_CFG, "match_ike: %d (%H %H)", match_ike, me, other);
+		match_version = get_version_match(cfg->get_ike_version(cfg), version);
+		DBG3(DBG_CFG, "ike config match: %d (%H %H)", match_ike, me, other);
 
-		if (match_peer_me && match_peer_other && match_ike)
+		if (match_peer_me && match_peer_other && match_ike && match_version)
 		{
-			DBG2(DBG_CFG, "  candidate \"%s\", match: %d/%d/%d (me/other/ike)",
-				 cfg->get_name(cfg), match_peer_me, match_peer_other, match_ike);
+			DBG2(DBG_CFG, "  candidate \"%s\", match: %d/%d/%d/%d "
+				 "(me/other/ike/version)", cfg->get_name(cfg),
+				 match_peer_me, match_peer_other, match_ike, match_version);
 
-			entry = malloc_thing(match_entry_t);
-			entry->match_peer = match_peer_me + match_peer_other;
-			entry->match_ike = match_ike;
-			entry->cfg = cfg->get_ref(cfg);
+			INIT(entry,
+				.match_peer = match_peer_me + match_peer_other,
+				.match_ike = match_ike,
+				.cfg = cfg->get_ref(cfg),
+			);
 			insert_sorted(entry, configs, helper);
 		}
 	}

src/libcharon/config/backend_manager.h

@@ -56,6 +56,7 @@ struct backend_manager_t {
 	 *
 	 * @param my_host			address of own host
 	 * @param other_host		address of remote host
+	 * @param version			IKE version to get a config for
 	 * @return					matching ike_config, or NULL if none found
 	 */
 	ike_cfg_t* (*get_ike_cfg)(backend_manager_t *this,
@@ -79,11 +80,12 @@ struct backend_manager_t {
 	 * @param other				remote address
 	 * @param my_id				IDr in first authentication round
 	 * @param other_id			IDi in first authentication round
+	 * @param version			IKE version to get a config for
 	 * @return 					enumerator over peer_cfg_t
 	 */
 	enumerator_t* (*create_peer_cfg_enumerator)(backend_manager_t *this,
 							host_t *me, host_t *other, identification_t *my_id,
-							identification_t *other_id);
+							identification_t *other_id, ike_version_t version);
 	/**
 	 * Register a backend on the manager.
 	 *

src/libcharon/config/peer_cfg.c

@@ -25,6 +25,12 @@
 #include <utils/linked_list.h>
 #include <utils/identification.h>
 
+ENUM(ike_version_names, IKE_ANY, IKEV2,
+	"IKEv1/2",
+	"IKEv1",
+	"IKEv2",
+);
+
 ENUM(cert_policy_names, CERT_ALWAYS_SEND, CERT_NEVER_SEND,
 	"CERT_ALWAYS_SEND",
 	"CERT_SEND_IF_ASKED",
@@ -62,7 +68,7 @@ struct private_peer_cfg_t {
 	/**
 	 * IKE version to use for initiation
 	 */
-	u_int ike_version;
+	ike_version_t ike_version;
 
 	/**
 	 * IKE config associated to this peer config
@@ -99,6 +105,11 @@ struct private_peer_cfg_t {
 	 */
 	bool use_mobike;
 
+	/**
+	 * Use aggressive mode?
+	 */
+	bool aggressive;
+
 	/**
 	 * Time before starting rekeying
 	 */
@@ -169,7 +180,7 @@ METHOD(peer_cfg_t, get_name, char*,
 	return this->name;
 }
 
-METHOD(peer_cfg_t, get_ike_version, u_int,
+METHOD(peer_cfg_t, get_ike_version, ike_version_t,
 	private_peer_cfg_t *this)
 {
 	return this->ike_version;
@@ -336,13 +347,13 @@ METHOD(peer_cfg_t, get_keyingtries, u_int32_t,
 }
 
 METHOD(peer_cfg_t, get_rekey_time, u_int32_t,
-	private_peer_cfg_t *this)
+	private_peer_cfg_t *this, bool jitter)
 {
 	if (this->rekey_time == 0)
 	{
 		return 0;
 	}
-	if (this->jitter_time == 0)
+	if (this->jitter_time == 0 || !jitter)
 	{
 		return this->rekey_time;
 	}
@@ -350,13 +361,13 @@ METHOD(peer_cfg_t, get_rekey_time, u_int32_t,
 }
 
 METHOD(peer_cfg_t, get_reauth_time, u_int32_t,
-	private_peer_cfg_t *this)
+	private_peer_cfg_t *this, bool jitter)
 {
 	if (this->reauth_time == 0)
 	{
 		return 0;
 	}
-	if (this->jitter_time == 0)
+	if (this->jitter_time == 0 || !jitter)
 	{
 		return this->reauth_time;
 	}
@@ -375,6 +386,12 @@ METHOD(peer_cfg_t, use_mobike, bool,
 	return this->use_mobike;
 }
 
+METHOD(peer_cfg_t, use_aggressive, bool,
+	private_peer_cfg_t *this)
+{
+	return this->aggressive;
+}
+
 METHOD(peer_cfg_t, get_dpd, u_int32_t,
 	private_peer_cfg_t *this)
 {
@@ -563,14 +580,14 @@ METHOD(peer_cfg_t, destroy, void,
 /*
  * Described in header-file
  */
-peer_cfg_t *peer_cfg_create(char *name, u_int ike_version, ike_cfg_t *ike_cfg,
-							cert_policy_t cert_policy, unique_policy_t unique,
-							u_int32_t keyingtries, u_int32_t rekey_time,
-							u_int32_t reauth_time, u_int32_t jitter_time,
-							u_int32_t over_time, bool mobike, u_int32_t dpd,
-							host_t *virtual_ip, char *pool,
-							bool mediation, peer_cfg_t *mediated_by,
-							identification_t *peer_id)
+peer_cfg_t *peer_cfg_create(char *name, ike_version_t ike_version,
+							ike_cfg_t *ike_cfg, cert_policy_t cert_policy,
+							unique_policy_t unique, u_int32_t keyingtries,
+							u_int32_t rekey_time, u_int32_t reauth_time,
+							u_int32_t jitter_time, u_int32_t over_time,
+							bool mobike, bool aggressive, u_int32_t dpd,
+							host_t *virtual_ip, char *pool, bool mediation,
+							peer_cfg_t *mediated_by, identification_t *peer_id)
 {
 	private_peer_cfg_t *this;
 
@@ -599,6 +616,7 @@ peer_cfg_t *peer_cfg_create(char *name, u_int ike_version, ike_cfg_t *ike_cfg,
 			.get_reauth_time = _get_reauth_time,
 			.get_over_time = _get_over_time,
 			.use_mobike = _use_mobike,
+			.use_aggressive = _use_aggressive,
 			.get_dpd = _get_dpd,
 			.get_virtual_ip = _get_virtual_ip,
 			.get_pool = _get_pool,
@@ -626,6 +644,7 @@ peer_cfg_t *peer_cfg_create(char *name, u_int ike_version, ike_cfg_t *ike_cfg,
 		.jitter_time = jitter_time,
 		.over_time = over_time,
 		.use_mobike = mobike,
+		.aggressive = aggressive,
 		.dpd = dpd,
 		.virtual_ip = virtual_ip,
 		.pool = strdupnull(pool),

src/libcharon/config/peer_cfg.h

@@ -23,6 +23,7 @@
 #ifndef PEER_CFG_H_
 #define PEER_CFG_H_
 
+typedef enum ike_version_t ike_version_t;
 typedef enum cert_policy_t cert_policy_t;
 typedef enum unique_policy_t unique_policy_t;
 typedef struct peer_cfg_t peer_cfg_t;
@@ -34,10 +35,25 @@ typedef struct peer_cfg_t peer_cfg_t;
 #include <config/proposal.h>
 #include <config/ike_cfg.h>
 #include <config/child_cfg.h>
-#include <sa/authenticators/authenticator.h>
-#include <sa/authenticators/eap/eap_method.h>
 #include <credentials/auth_cfg.h>
 
+/**
+ * IKE version.
+ */
+enum ike_version_t {
+	/** any version */
+	IKE_ANY = 0,
+	/** IKE version 1 */
+	IKEV1 = 1,
+	/** IKE version 2 */
+	IKEV2 = 2,
+};
+
+/**
+ * enum strings fro ike_version_t
+ */
+extern enum_name_t *ike_version_names;
+
 /**
  * Certificate sending policy. This is also used for certificate
  * requests when using this definition for the other peer. If
@@ -130,7 +146,7 @@ struct peer_cfg_t {
 	 *
 	 * @return				IKE major version
 	 */
-	u_int (*get_ike_version)(peer_cfg_t *this);
+	ike_version_t (*get_ike_version)(peer_cfg_t *this);
 
 	/**
 	 * Get the IKE config to use for initiaton.
@@ -211,18 +227,20 @@ struct peer_cfg_t {
 	u_int32_t (*get_keyingtries) (peer_cfg_t *this);
 
 	/**
-	 * Get a time to start rekeying (is randomized with jitter).
+	 * Get a time to start rekeying.
 	 *
+	 * @param jitter	remove a jitter value to randomize time
 	 * @return			time in s when to start rekeying, 0 disables rekeying
 	 */
-	u_int32_t (*get_rekey_time)(peer_cfg_t *this);
+	u_int32_t (*get_rekey_time)(peer_cfg_t *this, bool jitter);
 
 	/**
-	 * Get a time to start reauthentication (is randomized with jitter).
+	 * Get a time to start reauthentication.
 	 *
+	 * @param jitter	remove a jitter value to randomize time
 	 * @return			time in s when to start reauthentication, 0 disables it
 	 */
-	u_int32_t (*get_reauth_time)(peer_cfg_t *this);
+	u_int32_t (*get_reauth_time)(peer_cfg_t *this, bool jitter);
 
 	/**
 	 * Get the timeout of a rekeying/reauthenticating SA.
@@ -238,6 +256,13 @@ struct peer_cfg_t {
 	 */
 	bool (*use_mobike) (peer_cfg_t *this);
 
+	/**
+	 * Use/Accept aggressive mode with IKEv1?.
+	 *
+	 * @return			TRUE to use aggressive mode
+	 */
+	bool (*use_aggressive)(peer_cfg_t *this);
+
 	/**
 	 * Get the DPD check interval.
 	 *
@@ -339,6 +364,7 @@ struct peer_cfg_t {
  * @param jitter_time		timerange to randomly subtract from rekey/reauth time
  * @param over_time			maximum overtime before closing a rekeying/reauth SA
  * @param mobike			use MOBIKE (RFC4555) if peer supports it
+ * @param aggressive		use/accept aggressive mode with IKEv1
  * @param dpd				DPD check interval, 0 to disable
  * @param virtual_ip		virtual IP for local host, or NULL
  * @param pool				pool name to get configuration attributes from, or NULL
@@ -347,13 +373,13 @@ struct peer_cfg_t {
  * @param peer_id			ID that identifies our peer at the mediation server
  * @return					peer_cfg_t object
  */
-peer_cfg_t *peer_cfg_create(char *name, u_int ike_version, ike_cfg_t *ike_cfg,
-							cert_policy_t cert_policy, unique_policy_t unique,
-							u_int32_t keyingtries, u_int32_t rekey_time,
-							u_int32_t reauth_time, u_int32_t jitter_time,
-							u_int32_t over_time, bool mobike, u_int32_t dpd,
-							host_t *virtual_ip, char *pool,
-							bool mediation, peer_cfg_t *mediated_by,
-							identification_t *peer_id);
+peer_cfg_t *peer_cfg_create(char *name, ike_version_t ike_version,
+							ike_cfg_t *ike_cfg, cert_policy_t cert_policy,
+							unique_policy_t unique, u_int32_t keyingtries,
+							u_int32_t rekey_time, u_int32_t reauth_time,
+							u_int32_t jitter_time, u_int32_t over_time,
+							bool mobike, bool aggressive, u_int32_t dpd,
+							host_t *virtual_ip, char *pool, bool mediation,
+							peer_cfg_t *mediated_by, identification_t *peer_id);
 
 #endif /** PEER_CFG_H_ @}*/