src/charon/sa/states/Makefile.states

@@ -0,0 +1,43 @@
+# Copyright (C) 2005 Jan Hutter, Martin Willi
+# Hochschule fuer Technik Rapperswil
+#
+# This program is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License as published by the
+# Free Software Foundation; either version 2 of the License, or (at your
+# option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+#
+# This program is distributed in the hope that it will be useful, but
+# WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+# or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+# for more details.
+#
+
+STATES_DIR= $(SA_DIR)states/
+
+CHARON_OBJS+= $(BUILD_DIR)ike_auth_requested.o
+$(BUILD_DIR)ike_auth_requested.o :		$(STATES_DIR)ike_auth_requested.c $(STATES_DIR)ike_auth_requested.h
+										$(CC) $(CFLAGS) -c -o $@ $<
+
+CHARON_OBJS+= $(BUILD_DIR)ike_sa_established.o
+$(BUILD_DIR)ike_sa_established.o :		$(STATES_DIR)ike_sa_established.c $(STATES_DIR)ike_sa_established.h
+										$(CC) $(CFLAGS) -c -o $@ $<
+
+CHARON_OBJS+= $(BUILD_DIR)ike_sa_init_requested.o
+$(BUILD_DIR)ike_sa_init_requested.o :	$(STATES_DIR)ike_sa_init_requested.c $(STATES_DIR)ike_sa_init_requested.h
+										$(CC) $(CFLAGS) -c -o $@ $<
+
+CHARON_OBJS+= $(BUILD_DIR)ike_sa_init_responded.o
+$(BUILD_DIR)ike_sa_init_responded.o :	$(STATES_DIR)ike_sa_init_responded.c $(STATES_DIR)ike_sa_init_responded.h
+										$(CC) $(CFLAGS) -c -o $@ $<
+
+CHARON_OBJS+= $(BUILD_DIR)initiator_init.o
+$(BUILD_DIR)initiator_init.o :			$(STATES_DIR)initiator_init.c $(STATES_DIR)initiator_init.h
+										$(CC) $(CFLAGS) -c -o $@ $<
+										
+CHARON_OBJS+= $(BUILD_DIR)responder_init.o
+$(BUILD_DIR)responder_init.o :			$(STATES_DIR)responder_init.c $(STATES_DIR)responder_init.h
+										$(CC) $(CFLAGS) -c -o $@ $<
+										
+CHARON_OBJS+= $(BUILD_DIR)state.o
+$(BUILD_DIR)state.o :					$(STATES_DIR)state.c $(STATES_DIR)state.h
+										$(CC) $(CFLAGS) -c -o $@ $<

src/charon/sa/states/ike_auth_requested.c

@@ -0,0 +1,671 @@
+/**
+ * @file ike_auth_requested.c
+ * 
+ * @brief Implementation of ike_auth_requested_t.
+ * 
+ */
+
+/*
+ * Copyright (C) 2005 Jan Hutter, Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#include <string.h>
+
+#include "ike_auth_requested.h"
+
+#include <daemon.h>
+#include <encoding/payloads/ts_payload.h>
+#include <encoding/payloads/sa_payload.h>
+#include <encoding/payloads/id_payload.h>
+#include <encoding/payloads/auth_payload.h>
+#include <encoding/payloads/notify_payload.h>
+#include <crypto/signers/signer.h>
+#include <crypto/crypters/crypter.h>
+#include <sa/states/ike_sa_established.h>
+#include <sa/authenticator.h>
+#include <sa/child_sa.h>
+
+typedef struct private_ike_auth_requested_t private_ike_auth_requested_t;
+
+/**
+ * Private data of a ike_auth_requested_t object.
+ *
+ */
+struct private_ike_auth_requested_t {
+	/**
+	 * Public interface of ike_auth_requested_t.
+	 */
+	ike_auth_requested_t public;
+	
+	/**
+	 * Assigned IKE_SA.
+	 */
+	 protected_ike_sa_t *ike_sa;
+	 
+	/**
+	 * SA config, just a copy of the one stored in the ike_sa.
+	 */
+	policy_t *policy; 
+	
+	/**
+	 * Received nonce from responder.
+	 */
+	chunk_t received_nonce;
+	
+	/**
+	 * Sent nonce in IKE_SA_INIT request.
+	 */
+	chunk_t sent_nonce;
+	
+	/**
+	 * IKE_SA_INIT-Request in binary form.
+	 */
+	chunk_t ike_sa_init_reply_data;
+	
+	/**
+	 * Proposal to setup CHILD_SA
+	 */
+	proposal_t *proposal;
+	
+	/**
+	 * Traffic selectors applicable at our site
+	 */
+	linked_list_t *my_ts;
+	
+	/**
+	 * Traffic selectors applicable at remote site
+	 */
+	linked_list_t *other_ts;
+	
+	/**
+	 * Child sa created in ike_sa_init_requested
+	 */
+	child_sa_t *child_sa;
+	 
+	/**
+	 * Assigned Logger.
+	 * 
+	 * Is logger of ike_sa!
+	 */
+	logger_t *logger;
+	
+	/**
+	 * Process the IDr payload (check if other id is valid)
+	 * 
+	 * @param this			calling object
+	 * @param idr_payload	ID payload of responder
+	 * @return				
+	 * 						- SUCCESS
+	 * 						- DELETE_ME
+	 */
+	status_t (*process_idr_payload) (private_ike_auth_requested_t *this, id_payload_t *idr_payload);
+	
+	/**
+	 * Process the SA payload (check if selected proposals are valid, setup child sa)
+	 * 
+	 * @param this			calling object
+	 * @param sa_payload	SA payload of responder
+	 *
+	 * 						- SUCCESS
+	 * 						- DELETE_ME
+	 */
+	status_t (*process_sa_payload) (private_ike_auth_requested_t *this, sa_payload_t *sa_payload);
+	
+	/**
+	 * Process the AUTH payload (check authenticity of message)
+	 * 
+	 * @param this				calling object
+	 * @param auth_payload		AUTH payload of responder
+	 * @param other_id_payload	ID payload of responder
+	 *
+	 * 						- SUCCESS
+	 * 						- DELETE_ME
+	 */
+	status_t (*process_auth_payload) (private_ike_auth_requested_t *this, auth_payload_t *auth_payload, id_payload_t *other_id_payload);
+	
+	/**
+	 * Process the TS payload (check if selected traffic selectors are valid)
+	 * 
+	 * @param this			calling object
+	 * @param ts_initiator	TRUE if TS payload is TSi, FALSE for TSr
+	 * @param ts_payload	TS payload of responder
+	 *
+	 * 						- SUCCESS
+	 * 						- DELETE_ME
+	 */
+	status_t (*process_ts_payload) (private_ike_auth_requested_t *this, bool ts_initiator, ts_payload_t *ts_payload);
+	
+	/**
+	 * Process a notify payload
+	 * 
+	 * @param this				calling object
+	 * @param notify_payload	notify payload
+	 *
+	 * 						- SUCCESS
+	 * 						- FAILED
+	 * 						- DELETE_ME
+	 */
+	status_t (*process_notify_payload) (private_ike_auth_requested_t *this, notify_payload_t *notify_payload);
+	
+	/**
+	 * Destroy function called internally of this class after state change to 
+	 * state IKE_SA_ESTABLISHED succeeded. 
+	 * 
+	 * This destroy function does not destroy objects which were passed to the new state.
+	 * 
+	 * @param this		calling object
+	 */
+	void (*destroy_after_state_change) (private_ike_auth_requested_t *this);
+};
+
+
+/**
+ * Implements state_t.process_message
+ */
+static status_t process_message(private_ike_auth_requested_t *this, message_t *ike_auth_reply)
+{
+	ts_payload_t *tsi_payload = NULL, *tsr_payload = NULL;
+	id_payload_t *idr_payload = NULL;
+	auth_payload_t *auth_payload = NULL;
+	sa_payload_t *sa_payload = NULL;
+	iterator_t *payloads = NULL;
+	crypter_t *crypter = NULL;
+	signer_t *signer = NULL;
+	status_t status;
+	host_t *my_host, *other_host;
+	chunk_t seed;
+	prf_plus_t *prf_plus;
+	connection_t *connection;
+	
+	if (ike_auth_reply->get_exchange_type(ike_auth_reply) != IKE_AUTH)
+	{
+		this->logger->log(this->logger, ERROR | LEVEL1, "Message of type %s not supported in state ike_auth_requested",
+							mapping_find(exchange_type_m,ike_auth_reply->get_exchange_type(ike_auth_reply)));
+		return FAILED;
+	}
+	
+	if (ike_auth_reply->get_request(ike_auth_reply))
+	{
+		this->logger->log(this->logger, ERROR | LEVEL1, "IKE_AUTH requests not allowed state ike_sa_init_responded");
+		return FAILED;
+	}
+	
+	/* get signer for verification and crypter for decryption */
+	signer = this->ike_sa->get_signer_responder(this->ike_sa);
+	crypter = this->ike_sa->get_crypter_responder(this->ike_sa);
+	
+	/* parse incoming message */
+	status = ike_auth_reply->parse_body(ike_auth_reply, crypter, signer);
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, AUDIT, "IKE_AUTH reply decryption failed. Ignoring message");
+		return status;
+	}
+	
+	this->policy = this->ike_sa->get_policy(this->ike_sa);
+	
+	/* we collect all payloads, which are processed later. Notify's are processed 
+	 * in place, since we don't know how may are there.
+	 */
+	payloads = ike_auth_reply->get_payload_iterator(ike_auth_reply);
+	while (payloads->has_next(payloads))
+	{
+		payload_t *payload;
+		payloads->current(payloads, (void**)&payload);
+		
+		switch (payload->get_type(payload))
+		{
+			case AUTHENTICATION:
+			{
+				auth_payload = (auth_payload_t*)payload;
+				break;	
+			}
+			case ID_RESPONDER:
+			{
+				idr_payload = (id_payload_t*)payload;
+				break;	
+			}
+			case SECURITY_ASSOCIATION:
+			{
+				sa_payload = (sa_payload_t*)payload;
+				break;
+			}
+			case TRAFFIC_SELECTOR_INITIATOR:
+			{
+				tsi_payload = (ts_payload_t*)payload;				
+				break;	
+			}
+			case TRAFFIC_SELECTOR_RESPONDER:
+			{
+				tsr_payload = (ts_payload_t*)payload;
+				break;	
+			}
+			case NOTIFY:
+			{
+				notify_payload_t *notify_payload = (notify_payload_t *) payload;
+				/* handle the notify directly, abort if no further processing required */
+				status = this->process_notify_payload(this, notify_payload);
+				if (status != SUCCESS)
+				{
+					payloads->destroy(payloads);
+					return status;
+				}
+			}
+			case CERTIFICATE:
+			{
+				/* TODO handle cert payloads */
+			}
+			default:
+			{
+				this->logger->log(this->logger, ERROR|LEVEL1, "Ignoring Payload %s (%d)", 
+									mapping_find(payload_type_m, payload->get_type(payload)), payload->get_type(payload));
+				break;
+			}
+		}
+	}
+	/* iterator can be destroyed */
+	payloads->destroy(payloads);
+	
+	/* check if we have all payloads */
+	if (!(idr_payload && sa_payload && auth_payload && tsi_payload && tsr_payload))
+	{
+		this->logger->log(this->logger, AUDIT, "IKE_AUTH reply did not contain all required payloads. Deleting IKE_SA");
+		return DELETE_ME;
+	}
+
+	/* process all payloads */
+	status = this->process_idr_payload(this, idr_payload);
+	if (status != SUCCESS)
+	{
+		return status;
+	}
+	status = this->process_auth_payload(this, auth_payload,idr_payload);
+	if (status != SUCCESS)
+	{
+		return status;
+	}
+	status = this->process_sa_payload(this, sa_payload);
+	if (status != SUCCESS)
+	{
+		return status;
+	}
+	status = this->process_ts_payload(this, TRUE, tsi_payload);
+	if (status != SUCCESS)
+	{
+		return status;
+	}
+	status = this->process_ts_payload(this, FALSE, tsr_payload);
+	if (status != SUCCESS)
+	{
+		return status;
+	}
+	
+	/* install child SAs for AH and esp */
+	if (!this->child_sa)
+	{
+		this->logger->log(this->logger, CONTROL, "No CHILD_SA requested, no CHILD_SA built");
+	}
+	if (!this->proposal)
+	{
+		this->logger->log(this->logger, CONTROL, "Proposal negotiation failed, no CHILD_SA built");
+		this->child_sa->destroy(this->child_sa);
+		this->child_sa = NULL;
+	}
+	else if (this->my_ts->get_count(this->my_ts) == 0 || this->other_ts->get_count(this->other_ts) == 0)
+	{
+		this->logger->log(this->logger, CONTROL, "Traffic selector negotiation failed, no CHILD_SA built");
+		this->child_sa->destroy(this->child_sa);
+		this->child_sa = NULL;
+	}
+	else
+	{
+		seed = chunk_alloc(this->sent_nonce.len + this->received_nonce.len);
+		memcpy(seed.ptr, this->sent_nonce.ptr, this->sent_nonce.len);
+		memcpy(seed.ptr + this->sent_nonce.len, this->received_nonce.ptr, this->received_nonce.len);
+		prf_plus = prf_plus_create(this->ike_sa->get_child_prf(this->ike_sa), seed);
+		chunk_free(&seed);
+		
+		status = this->child_sa->update(this->child_sa, this->proposal, prf_plus);
+		prf_plus->destroy(prf_plus);
+		if (status != SUCCESS)
+		{
+			this->logger->log(this->logger, AUDIT, "Could not install CHILD_SA! Deleting IKE_SA");
+			return DELETE_ME;
+		}
+		status = this->child_sa->add_policies(this->child_sa, this->my_ts, this->other_ts);
+		if (status != SUCCESS)
+		{
+			this->logger->log(this->logger, AUDIT, "Could not install CHILD_SA policy! Deleting IKE_SA");
+			return DELETE_ME;
+		}
+		this->ike_sa->add_child_sa(this->ike_sa, this->child_sa);
+	}
+	
+	this->ike_sa->set_last_replied_message_id(this->ike_sa,ike_auth_reply->get_message_id(ike_auth_reply));
+	
+	/* create new state */
+	this->ike_sa->set_new_state(this->ike_sa, (state_t*)ike_sa_established_create(this->ike_sa));
+	this->destroy_after_state_change(this);
+	
+	connection = this->ike_sa->get_connection(this->ike_sa);
+	my_host = connection->get_my_host(connection);
+	other_host = connection->get_other_host(connection);
+	this->logger->log(this->logger, AUDIT, "IKE_SA established between %s - %s", 
+					  my_host->get_address(my_host), other_host->get_address(other_host));
+	
+	return SUCCESS;
+}
+
+/**
+ * Implements private_ike_auth_requested_t.process_idr_payload
+ */
+static status_t process_idr_payload(private_ike_auth_requested_t *this, id_payload_t *idr_payload)
+{
+	identification_t *other_id, *configured_other_id;
+	connection_t *connection;
+	
+	other_id = idr_payload->get_identification(idr_payload);
+	configured_other_id = this->policy->get_other_id(this->policy);
+	
+	this->logger->log(this->logger, CONTROL|LEVEL1, "configured ID: %s, ID of responder: %s",
+						configured_other_id->get_string(configured_other_id),
+						other_id->get_string(other_id));
+	
+	if (!other_id->belongs_to(other_id, configured_other_id))
+	{
+		other_id->destroy(other_id);
+		this->logger->log(this->logger, AUDIT, "IKE_AUTH reply contained a not acceptable ID. Deleting IKE_SA");
+		return DELETE_ME;
+	}
+	
+	connection = this->ike_sa->get_connection(this->ike_sa);
+	connection->update_other_id(connection, other_id->clone(other_id));
+	
+	this->policy->update_other_id(this->policy, other_id);
+	return SUCCESS;
+}
+
+/**
+ * Implements private_ike_auth_requested_t.process_sa_payload
+ */
+static status_t process_sa_payload(private_ike_auth_requested_t *this, sa_payload_t *sa_payload)
+{
+	proposal_t *proposal, *proposal_tmp;
+	linked_list_t *proposal_list;
+	
+	/* get his selected proposal */
+	proposal_list = sa_payload->get_proposals(sa_payload);
+	/* check count of proposals */
+	if (proposal_list->get_count(proposal_list) == 0)
+	{
+		/* no proposal? we accept this, but no child sa is built */
+		this->logger->log(this->logger, AUDIT, "IKE_AUTH reply's SA_PAYLOAD didn't contain any proposals. No CHILD_SA created",
+						  proposal_list->get_count(proposal_list));
+		proposal_list->destroy(proposal_list);
+		return SUCCESS;
+	}
+	if (proposal_list->get_count(proposal_list) > 1)
+	{
+		this->logger->log(this->logger, AUDIT, "IKE_AUTH reply's SA_PAYLOAD contained %d proposal. Deleting IKE_SA",
+						  proposal_list->get_count(proposal_list));
+		while (proposal_list->remove_last(proposal_list, (void**)&proposal) == SUCCESS)
+		{
+			proposal->destroy(proposal);
+		}
+		proposal_list->destroy(proposal_list);
+		return DELETE_ME;
+	}
+	
+	/* we have to re-check here if other's selection is valid */
+	proposal = this->policy->select_proposal(this->policy, proposal_list);
+	/* list not needed anymore */
+	while (proposal_list->remove_last(proposal_list, (void**)&proposal_tmp) == SUCCESS)
+	{
+		proposal_tmp->destroy(proposal_tmp);
+	}
+	proposal_list->destroy(proposal_list);
+	/* got a match? */
+	if (proposal == NULL)
+	{
+		this->logger->log(this->logger, AUDIT, "IKE_AUTH reply contained a not offered proposal. Deleting IKE_SA");
+		return DELETE_ME;
+	}
+	
+	/* apply proposal */
+	this->proposal = proposal;
+	
+	return SUCCESS;
+}
+
+/**
+ * Implements private_ike_auth_requested_t.process_auth_payload
+ */
+static status_t process_auth_payload(private_ike_auth_requested_t *this, auth_payload_t *auth_payload, id_payload_t *other_id_payload)
+{
+	authenticator_t *authenticator;
+	status_t status;
+		
+	authenticator = authenticator_create(this->ike_sa);
+	status = authenticator->verify_auth_data(authenticator,auth_payload,this->ike_sa_init_reply_data,this->sent_nonce,other_id_payload,FALSE);
+	authenticator->destroy(authenticator);
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, AUDIT, "Verification of IKE_AUTH reply failed. Deleting IKE_SA");
+		return DELETE_ME;	
+	}
+
+	this->logger->log(this->logger, CONTROL|LEVEL1, "AUTH data verified successfully");
+	return SUCCESS;	
+}
+
+/**
+ * Implements private_ike_auth_requested_t.process_ts_payload
+ */
+static status_t process_ts_payload(private_ike_auth_requested_t *this, bool ts_initiator, ts_payload_t *ts_payload)
+{
+	linked_list_t *ts_received, *ts_selected;
+	traffic_selector_t *ts;
+	
+	/* get ts form payload */
+	ts_received = ts_payload->get_traffic_selectors(ts_payload);
+	/* select ts depending on payload type */
+	if (ts_initiator)
+	{
+		ts_selected = this->policy->select_my_traffic_selectors(this->policy, ts_received);
+		this->my_ts = ts_selected;
+	}
+	else
+	{
+		ts_selected = this->policy->select_other_traffic_selectors(this->policy, ts_received);
+		this->other_ts = ts_selected;
+	}
+	/* check if the responder selected valid proposals */
+	if (ts_selected->get_count(ts_selected) != ts_received->get_count(ts_received))
+	{
+		this->logger->log(this->logger, AUDIT, "IKE_AUTH reply contained not offered traffic selectors.");
+	}
+	
+	/* cleanup */
+	while (ts_received->remove_last(ts_received, (void**)&ts) == SUCCESS)
+	{
+		ts->destroy(ts);
+	}
+	ts_received->destroy(ts_received);
+
+	return SUCCESS;
+}
+
+/**
+ * Implements private_ike_auth_requested_t.process_notify_payload
+ */
+static status_t process_notify_payload(private_ike_auth_requested_t *this, notify_payload_t *notify_payload)
+{
+	notify_message_type_t notify_message_type = notify_payload->get_notify_message_type(notify_payload);
+	
+	this->logger->log(this->logger, CONTROL|LEVEL1, "Process notify type %s",
+							  mapping_find(notify_message_type_m, notify_message_type));
+	
+	switch (notify_message_type)
+	{
+		case INVALID_SYNTAX:
+		{
+			this->logger->log(this->logger, AUDIT, "IKE_AUTH reply contained an INVALID_SYNTAX notify. Deleting IKE_SA");
+			return DELETE_ME;	
+			
+		}
+		case AUTHENTICATION_FAILED:
+		{
+			this->logger->log(this->logger, AUDIT, "IKE_AUTH reply contained an AUTHENTICATION_FAILED notify. Deleting IKE_SA");
+			return DELETE_ME;	
+			
+		}
+		case SINGLE_PAIR_REQUIRED:
+		{
+			this->logger->log(this->logger, AUDIT, "IKE_AUTH reply contained a SINGLE_PAIR_REQUIRED notify. Deleting IKE_SA");
+			return DELETE_ME;		
+		}
+		default:
+		{
+			/*
+			 * - In case of unknown error: IKE_SA gets destroyed.
+			 * - In case of unknown status: logging
+			 */
+			
+			if (notify_message_type < 16383)
+			{
+				this->logger->log(this->logger, AUDIT, "IKE_AUTH reply contained an unknown notify error (%d). Deleting IKE_SA",
+								  notify_message_type);
+				return DELETE_ME;	
+
+			}
+			else
+			{
+				this->logger->log(this->logger, CONTROL, "IKE_AUTH reply contained an unknown notify (%d), ignored.", 
+									notify_message_type);
+				return SUCCESS;
+			}
+		}
+	}	
+}
+
+/**
+ * Implements state_t.get_state
+ */
+static ike_sa_state_t get_state(private_ike_auth_requested_t *this)
+{
+	return IKE_AUTH_REQUESTED;
+}
+
+/**
+ * Implements state_t.get_state
+ */
+static void destroy(private_ike_auth_requested_t *this)
+{
+	chunk_free(&(this->received_nonce));
+	chunk_free(&(this->sent_nonce));
+	chunk_free(&(this->ike_sa_init_reply_data));
+	if (this->child_sa)
+	{
+		this->child_sa->destroy(this->child_sa);
+	}
+	if (this->my_ts)
+	{
+		traffic_selector_t *ts;
+		while (this->my_ts->remove_last(this->my_ts, (void**)&ts) == SUCCESS)
+		{
+			ts->destroy(ts);
+		}
+		this->my_ts->destroy(this->my_ts);
+	}
+	if (this->other_ts)
+	{
+		traffic_selector_t *ts;
+		while (this->other_ts->remove_last(this->other_ts, (void**)&ts) == SUCCESS)
+		{
+			ts->destroy(ts);
+		}
+		this->other_ts->destroy(this->other_ts);
+	}
+	if (this->proposal)
+	{
+		this->proposal->destroy(this->proposal);
+	}
+	free(this);
+}
+/**
+ * Implements protected_ike_sa_t.destroy_after_state_change
+ */
+static void destroy_after_state_change(private_ike_auth_requested_t *this)
+{
+	chunk_free(&(this->received_nonce));
+	chunk_free(&(this->sent_nonce));
+	chunk_free(&(this->ike_sa_init_reply_data));
+	if (this->my_ts)
+	{
+		traffic_selector_t *ts;
+		while (this->my_ts->remove_last(this->my_ts, (void**)&ts) == SUCCESS)
+		{
+			ts->destroy(ts);
+		}
+		this->my_ts->destroy(this->my_ts);
+	}
+	if (this->other_ts)
+	{
+		traffic_selector_t *ts;
+		while (this->other_ts->remove_last(this->other_ts, (void**)&ts) == SUCCESS)
+		{
+			ts->destroy(ts);
+		}
+		this->other_ts->destroy(this->other_ts);
+	}
+	if (this->proposal)
+	{
+		this->proposal->destroy(this->proposal);
+	}
+	free(this);
+}
+
+/* 
+ * Described in header.
+ */
+ike_auth_requested_t *ike_auth_requested_create(protected_ike_sa_t *ike_sa,chunk_t sent_nonce,chunk_t received_nonce,chunk_t ike_sa_init_reply_data, child_sa_t *child_sa)
+{
+	private_ike_auth_requested_t *this = malloc_thing(private_ike_auth_requested_t);
+
+	/* interface functions */
+	this->public.state_interface.process_message = (status_t (*) (state_t *,message_t *)) process_message;
+	this->public.state_interface.get_state = (ike_sa_state_t (*) (state_t *)) get_state;
+	this->public.state_interface.destroy  = (void (*) (state_t *)) destroy;
+	
+	/* private functions */
+	this->process_idr_payload = process_idr_payload;
+	this->process_sa_payload = process_sa_payload;
+	this->process_auth_payload = process_auth_payload;
+	this->process_ts_payload = process_ts_payload;
+	this->process_notify_payload = process_notify_payload;
+	this->destroy_after_state_change = destroy_after_state_change;
+	
+	/* private data */
+	this->ike_sa = ike_sa;
+	this->received_nonce = received_nonce;
+	this->sent_nonce = sent_nonce;
+	this->ike_sa_init_reply_data = ike_sa_init_reply_data;
+	this->logger = logger_manager->get_logger(logger_manager, IKE_SA);
+	this->my_ts = NULL;
+	this->other_ts = NULL;
+	this->proposal = NULL;
+	this->child_sa = child_sa;
+	
+	return &(this->public);
+}

src/charon/sa/states/ike_auth_requested.h

@@ -0,0 +1,72 @@
+/**
+ * @file ike_auth_requested.h
+ * 
+ * @brief Interface of ike_auth_requested_t.
+ * 
+ */
+
+/*
+ * Copyright (C) 2005 Jan Hutter, Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#ifndef IKE_AUTH_REQUESTED_H_
+#define IKE_AUTH_REQUESTED_H_
+
+#include <sa/states/state.h>
+#include <sa/ike_sa.h>
+
+
+typedef struct ike_auth_requested_t ike_auth_requested_t;
+
+/**
+ * @brief This class represents an IKE_SA, which has requested an IKE_AUTH.
+ * 
+ * The state accpets IKE_AUTH responses. It proves the authenticity
+ * and sets up the first child sa. After that, it changes IKE_SA state to 
+ * IKE_SA_ESTABLISHED.
+ * 
+ * @ Constructors:
+ *  - ike_auth_requested_create()
+ * 
+ * @todo handle certificate payloads
+ * 
+ * @ingroup states
+ */
+struct ike_auth_requested_t {
+	/**
+	 * The state_t interface.
+	 */
+	state_t state_interface;
+
+};
+
+/**
+ * Constructor of class ike_auth_requested_t
+ * 
+ * @param ike_sa					assigned ike_sa object
+ * @param sent_nonce				Sent nonce value in IKE_SA_INIT request
+ * @param received_nonce			Received nonce value in IKE_SA_INIT response
+ * @param ike_sa_init_reply_data	binary representation of IKE_SA_INIT reply 
+ * @param child_sa					opened but not completed child_sa
+ * @return							created ike_auth_requested_t object
+ * 
+ * @ingroup states
+ */
+ike_auth_requested_t *ike_auth_requested_create(protected_ike_sa_t *ike_sa,
+												chunk_t sent_nonce,
+												chunk_t received_nonce,
+												chunk_t ike_sa_init_reply_data,
+												child_sa_t *child_sa);
+
+#endif /*IKE_AUTH_REQUESTED_H_*/

src/charon/sa/states/ike_sa_established.c

@@ -0,0 +1,239 @@
+/**
+ * @file ike_sa_established.c
+ * 
+ * @brief Implementation of ike_sa_established_t.
+ * 
+ */
+
+/*
+ * Copyright (C) 2005 Jan Hutter, Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+ 
+#include "ike_sa_established.h"
+
+#include <daemon.h>
+#include <encoding/payloads/delete_payload.h>
+
+
+typedef struct private_ike_sa_established_t private_ike_sa_established_t;
+
+/**
+ * Private data of a ike_sa_established_t object.
+ */
+struct private_ike_sa_established_t {
+	/**
+	 * methods of the state_t interface
+	 */
+	ike_sa_established_t public;
+	
+	/** 
+	 * Assigned IKE_SA.
+	 */
+	protected_ike_sa_t *ike_sa;
+	
+	/** 
+	 * Assigned logger. Use logger of IKE_SA.
+	 */
+	logger_t *logger;
+	
+	/**
+	 * Process a notify payload
+	 * 
+	 * @param this				calling object
+	 * @param notify_payload	notify payload
+	 * @param response			response message of type INFORMATIONAL
+	 *
+	 * 						- SUCCESS
+	 * 						- FAILED
+	 * 						- DELETE_ME
+	 */
+	status_t (*process_notify_payload) (private_ike_sa_established_t *this, notify_payload_t *notify_payload,message_t *response);
+};
+
+/**
+ * Implements state_t.get_state
+ */
+static status_t process_message(private_ike_sa_established_t *this, message_t *message)
+{
+	delete_payload_t *delete_request = NULL;
+	ike_sa_id_t *ike_sa_id;
+	iterator_t *payloads;
+	message_t *response;
+	crypter_t *crypter;
+	signer_t *signer;
+	status_t status;
+	
+	if (message->get_exchange_type(message) != INFORMATIONAL)
+	{
+		this->logger->log(this->logger, ERROR | LEVEL1, "Message of type %s not supported in state ike_sa_established",
+							mapping_find(exchange_type_m,message->get_exchange_type(message)));
+		return FAILED;
+	}
+	
+	if (!message->get_request(message))
+	{
+		this->logger->log(this->logger, ERROR | LEVEL1, "INFORMATIONAL responses not handled in state ike_sa_established");
+		return FAILED;
+	}
+	
+	ike_sa_id = this->ike_sa->public.get_id(&(this->ike_sa->public));
+	
+	/* get signer for verification and crypter for decryption */
+	if (!ike_sa_id->is_initiator(ike_sa_id))
+	{
+		crypter = this->ike_sa->get_crypter_initiator(this->ike_sa);
+		signer = this->ike_sa->get_signer_initiator(this->ike_sa);
+	}
+	else
+	{
+		crypter = this->ike_sa->get_crypter_responder(this->ike_sa);
+		signer = this->ike_sa->get_signer_responder(this->ike_sa);
+	}
+	
+	/* parse incoming message */
+	status = message->parse_body(message, crypter, signer);
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, AUDIT, "INFORMATIONAL request decryption failed. Ignoring message");
+		return status;
+	}
+	
+	/* build empty INFORMATIONAL message */
+	this->ike_sa->build_message(this->ike_sa, INFORMATIONAL, FALSE, &response);
+	
+	payloads = message->get_payload_iterator(message);
+	
+	while (payloads->has_next(payloads))
+	{
+		payload_t *payload;
+		payloads->current(payloads, (void**)&payload);
+		
+		switch (payload->get_type(payload))
+		{
+			case NOTIFY:
+			{
+				notify_payload_t *notify_payload = (notify_payload_t *) payload;
+				/* handle the notify directly, abort if no further processing required */
+				status = this->process_notify_payload(this, notify_payload,response);
+				if (status != SUCCESS)
+				{
+					payloads->destroy(payloads);
+					response->destroy(response);
+					return status;
+				}
+			}
+			case DELETE:
+			{
+				delete_request = (delete_payload_t *) payload;
+				break;
+			}
+			default:
+			{
+				this->logger->log(this->logger, ERROR|LEVEL1, "Ignoring Payload %s (%d)", 
+									mapping_find(payload_type_m, payload->get_type(payload)), payload->get_type(payload));
+				break;
+			}
+		}
+	}
+	/* iterator can be destroyed */
+	payloads->destroy(payloads);
+	
+	if (delete_request)
+	{	
+		if (delete_request->get_protocol_id(delete_request) == PROTO_IKE)
+		{
+			this->logger->log(this->logger, AUDIT, "DELETE request for IKE_SA received");
+			response->destroy(response);
+			return DELETE_ME;
+		}
+		else
+		{
+			this->logger->log(this->logger, AUDIT, "DELETE request for CHILD_SA received. Ignored");
+			response->destroy(response);
+			return SUCCESS;
+		}
+	}
+	
+	status = this->ike_sa->send_response(this->ike_sa, response);
+	/* message can now be sent (must not be destroyed) */
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, AUDIT, "Unable to send INFORMATIONAL reply");
+		response->destroy(response);
+		return FAILED;
+	}
+	
+	return SUCCESS;
+}
+
+/**
+ * Implementation of private_ike_sa_established_t.process_notify_payload;
+ */
+static status_t process_notify_payload (private_ike_sa_established_t *this, notify_payload_t *notify_payload, message_t *response)
+{
+	notify_message_type_t notify_message_type = notify_payload->get_notify_message_type(notify_payload);
+	
+	this->logger->log(this->logger, CONTROL|LEVEL1, "Process notify type %s for protocol %s",
+					  mapping_find(notify_message_type_m, notify_message_type),
+					  mapping_find(protocol_id_m, notify_payload->get_protocol_id(notify_payload)));
+					  
+	switch (notify_message_type)
+	{
+		default:
+		{
+			this->logger->log(this->logger, AUDIT, "INFORMATIONAL request contained an unknown notify (%d), ignored.", notify_message_type);
+		}
+	}
+
+
+	return SUCCESS;	
+}
+
+/**
+ * Implementation of state_t.get_state.
+ */
+static ike_sa_state_t get_state(private_ike_sa_established_t *this)
+{
+	return IKE_SA_ESTABLISHED;
+}
+
+/**
+ * Implementation of state_t.get_state
+ */
+static void destroy(private_ike_sa_established_t *this)
+{
+	free(this);
+}
+
+/* 
+ * Described in header.
+ */
+ike_sa_established_t *ike_sa_established_create(protected_ike_sa_t *ike_sa)
+{
+	private_ike_sa_established_t *this = malloc_thing(private_ike_sa_established_t);
+
+	/* interface functions */
+	this->public.state_interface.process_message = (status_t (*) (state_t *,message_t *)) process_message;
+	this->public.state_interface.get_state = (ike_sa_state_t (*) (state_t *)) get_state;
+	this->public.state_interface.destroy  = (void (*) (state_t *)) destroy;
+	
+	/* private functions */
+	this->process_notify_payload = process_notify_payload;
+	
+	/* private data */
+	this->ike_sa = ike_sa;
+	this->logger = logger_manager->get_logger(logger_manager, IKE_SA);
+	
+	return &(this->public);
+}

src/charon/sa/states/ike_sa_established.h

@@ -0,0 +1,64 @@
+/**
+ * @file ike_sa_established.h
+ * 
+ * @brief Interface of ike_sa_established_t.
+ * 
+ */
+
+/*
+ * Copyright (C) 2005 Jan Hutter, Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#ifndef IKE_SA_ESTABLISHED_H_
+#define IKE_SA_ESTABLISHED_H_
+
+#include <sa/states/state.h>
+#include <sa/ike_sa.h>
+
+typedef struct ike_sa_established_t ike_sa_established_t;
+
+/**
+ * @brief This class represents an the state of an established
+ * IKE_SA.
+ * 
+ * @b Constructors:
+ * - ike_sa_established_create()
+ * 
+ * @todo Implement handling of CREATE_CHILD_SA requests
+ * 
+ * @todo Implement initialization of CREATE_CHILD_SA requests
+ * 
+ * @todo Implement handling of any other message
+ * 
+ * @ingroup states
+ */
+struct ike_sa_established_t {
+	/**
+	 * methods of the state_t interface
+	 */
+	state_t state_interface;
+
+};
+
+/**
+ * @brief Constructor of class ike_sa_established_t
+ * 
+ * @param ike_sa 	assigned ike_sa
+ * @return			created ike_sa_established_t object
+ * 
+ * @ingroup states
+ */
+ike_sa_established_t *ike_sa_established_create(protected_ike_sa_t *ike_sa);
+
+#endif /*IKE_SA_ESTABLISHED_H_*/

src/charon/sa/states/ike_sa_init_requested.c

@@ -0,0 +1,798 @@
+/**
+ * @file ike_sa_init_requested.c
+ * 
+ * @brief Implementation of ike_sa_init_requested_t.
+ * 
+ */
+
+/*
+ * Copyright (C) 2005 Jan Hutter, Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+ 
+#include "ike_sa_init_requested.h"
+
+#include <daemon.h>
+#include <encoding/payloads/sa_payload.h>
+#include <encoding/payloads/ke_payload.h>
+#include <encoding/payloads/nonce_payload.h>
+#include <encoding/payloads/notify_payload.h>
+#include <encoding/payloads/id_payload.h>
+#include <encoding/payloads/auth_payload.h>
+#include <encoding/payloads/ts_payload.h>
+#include <crypto/diffie_hellman.h>
+#include <sa/states/ike_auth_requested.h>
+#include <sa/states/initiator_init.h>
+#include <sa/authenticator.h>
+
+
+typedef struct private_ike_sa_init_requested_t private_ike_sa_init_requested_t;
+
+/**
+ * Private data of a ike_sa_init_requested_t object.
+ *
+ */
+struct private_ike_sa_init_requested_t {
+	/**
+	 * Public interface of an ike_sa_init_requested_t object.
+	 */
+	ike_sa_init_requested_t public;
+	
+	/** 
+	 * Assigned IKE_SA
+	 */
+	protected_ike_sa_t *ike_sa;
+	
+	/**
+	 * Diffie Hellman object used to compute shared secret.
+	 */
+	diffie_hellman_t *diffie_hellman;
+		
+	/**
+	 * Sent nonce value.
+	 */
+	chunk_t sent_nonce;
+	
+	/**
+	 * Received nonce
+	 */
+	chunk_t received_nonce;
+	
+	/**
+	 * Selected proposal
+	 */
+	proposal_t *proposal;
+	
+	/**
+	 * Packet data of ike_sa_init request
+	 */
+	chunk_t ike_sa_init_request_data;
+	
+	/**
+	 * Created child sa, if any
+	 */
+	child_sa_t *child_sa;
+	
+	/**
+	 * Assigned logger
+	 * 
+	 * Is logger of ike_sa!
+	 */
+	logger_t *logger;
+	
+
+	/**
+	 * Process NONCE payload of IKE_SA_INIT response.
+	 * 
+	 * @param this			calling object
+	 * @param nonce_payload	NONCE payload to process
+	 * @return				SUCCESS in any case
+	 */
+	status_t (*process_nonce_payload) (private_ike_sa_init_requested_t *this, nonce_payload_t *nonce_payload);
+
+	/**
+	 * Process SA payload of IKE_SA_INIT response.
+	 * 
+	 * @param this			calling object
+	 * @param sa_payload	SA payload to process
+	 * @return				
+	 * 						- SUCCESS
+	 * 						- FAILED
+	 */
+	status_t (*process_sa_payload) (private_ike_sa_init_requested_t *this, sa_payload_t *sa_payload);
+	
+	/**
+	 * Process KE payload of IKE_SA_INIT response.
+	 * 
+	 * @param this			calling object
+	 * @param sa_payload	KE payload to process
+	 * @return				
+	 * 						- SUCCESS
+	 * 						- FAILED
+	 */
+	status_t (*process_ke_payload) (private_ike_sa_init_requested_t *this, ke_payload_t *ke_payload);
+
+	/**
+	 * Build ID payload for IKE_AUTH request.
+	 * 
+	 * @param this				calling object
+	 * @param[out] id_payload	buildet ID payload
+	 * @param response			created payload will be added to this message_t object
+	 * @return
+	 * 							- SUCCESS
+	 * 							- FAILED
+	 */
+	status_t (*build_id_payload) (private_ike_sa_init_requested_t *this,id_payload_t **id_payload, message_t *response);
+	
+	/**
+	 * Build IDr payload for IKE_AUTH request.
+	 * 
+	 * Only built when the ID of the responder contains no wildcards.
+	 * 
+	 * @param this				calling object
+	 * @param response			created payload will be added to this message_t object
+	 * @return
+	 * 							- SUCCESS
+	 * 							- FAILED
+	 */
+	status_t (*build_idr_payload) (private_ike_sa_init_requested_t *this, message_t *response);
+	
+	/**
+	 * Build AUTH payload for IKE_AUTH request.
+	 * 
+	 * @param this				calling object
+	 * @param my_id_payload		buildet ID payload
+	 * @param response			created payload will be added to this message_t object
+	 * @return
+	 * 							- SUCCESS
+	 * 							- FAILED
+	 */
+	status_t (*build_auth_payload) (private_ike_sa_init_requested_t *this,id_payload_t *my_id_payload, message_t *response);
+
+	/**
+	 * Build SA payload for IKE_AUTH request.
+	 * 
+	 * @param this				calling object
+	 * @param response			created payload will be added to this message_t object
+	 * @return
+	 * 							- SUCCESS
+	 * 							- FAILED
+	 */
+	status_t (*build_sa_payload) (private_ike_sa_init_requested_t *this, message_t *response);
+	
+	/**
+	 * Build TSi payload for IKE_AUTH request.
+	 * 
+	 * @param this				calling object
+	 * @param response			created payload will be added to this message_t object
+	 * @return
+	 * 							- SUCCESS
+	 * 							- FAILED
+	 */
+	status_t (*build_tsi_payload) (private_ike_sa_init_requested_t *this, message_t *response);
+	
+	/**
+	 * Build TSr payload for IKE_AUTH request.
+	 * 
+	 * @param this				calling object
+	 * @param response			created payload will be added to this message_t object
+	 * @return
+	 * 							- SUCCESS
+	 * 							- FAILED
+	 */
+	status_t (*build_tsr_payload) (private_ike_sa_init_requested_t *this, message_t *response);
+	
+	/**
+	 * Process a notify payload and react.
+	 * 
+	 * @param this				calling object
+	 * @param notify_payload	notify_payload to handle
+	 */
+	status_t (*process_notify_payload) (private_ike_sa_init_requested_t *this, notify_payload_t *notify_payload);
+	
+	/**
+	 * Destroy function called internally of this class after state change to 
+	 * state IKE_AUTH_REQUESTED succeeded. 
+	 * 
+	 * This destroy function does not destroy objects which were passed to the new state.
+	 * 
+	 * @param this		calling object
+	 */
+	void (*destroy_after_state_change) (private_ike_sa_init_requested_t *this);
+};
+
+/**
+ * Implementation of state_t.process_message.
+ */
+static status_t process_message(private_ike_sa_init_requested_t *this, message_t *ike_sa_init_reply)
+{
+	ike_auth_requested_t *next_state;
+	chunk_t ike_sa_init_reply_data;
+	sa_payload_t *sa_payload = NULL;
+	ke_payload_t *ke_payload = NULL;
+	id_payload_t *id_payload = NULL;
+	nonce_payload_t *nonce_payload = NULL;
+	u_int64_t responder_spi;
+	ike_sa_id_t *ike_sa_id;
+	iterator_t *payloads;
+	host_t *me;
+	connection_t *connection;
+	policy_t *policy;
+
+	message_t *request;
+	status_t status;
+	
+	/*
+	 * In this state a reply message of type IKE_SA_INIT is expected:
+	 * 
+	 *   <--    HDR, SAr1, KEr, Nr, [CERTREQ]
+	 * or
+	 *   <--    HDR, N
+	 */
+
+	if (ike_sa_init_reply->get_exchange_type(ike_sa_init_reply) != IKE_SA_INIT)
+	{
+		this->logger->log(this->logger, ERROR | LEVEL1, "Message of type %s not supported in state ike_sa_init_requested",
+							mapping_find(exchange_type_m,ike_sa_init_reply->get_exchange_type(ike_sa_init_reply)));
+		return FAILED;
+	}
+	
+	if (ike_sa_init_reply->get_request(ike_sa_init_reply))
+	{
+		this->logger->log(this->logger, ERROR | LEVEL1, "IKE_SA_INIT requests not allowed state ike_sa_init_responded");
+		return FAILED;
+	}
+	
+	/* parse incoming message */
+	status = ike_sa_init_reply->parse_body(ike_sa_init_reply, NULL, NULL);
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, ERROR | LEVEL1, "IKE_SA_INIT reply parsing faild. Ignoring message");
+		return status;	
+	}
+	
+	/* because we are original initiator we have to update the responder SPI to the new one */	
+	responder_spi = ike_sa_init_reply->get_responder_spi(ike_sa_init_reply);
+	if (responder_spi == 0)
+	{
+		this->logger->log(this->logger, ERROR | LEVEL1, "IKE_SA_INIT reply contained a SPI of zero");
+		return FAILED;
+	}
+	ike_sa_id = this->ike_sa->public.get_id(&(this->ike_sa->public));
+	ike_sa_id->set_responder_spi(ike_sa_id,responder_spi);
+	
+	/* Iterate over all payloads.
+	 * 
+	 * The message is allready checked for the right payload types.
+	 */
+	payloads = ike_sa_init_reply->get_payload_iterator(ike_sa_init_reply);
+	while (payloads->has_next(payloads))
+	{ 
+		payload_t *payload;
+		payloads->current(payloads, (void**)&payload);
+		
+		switch (payload->get_type(payload))
+		{
+			case SECURITY_ASSOCIATION:
+			{
+				sa_payload = (sa_payload_t*)payload;
+				break;
+			}
+			case KEY_EXCHANGE:
+			{
+				ke_payload = (ke_payload_t*)payload;
+				break;
+			}
+			case NONCE:
+			{
+				nonce_payload = (nonce_payload_t*)payload;
+				break;
+			}
+			case NOTIFY:
+			{
+				notify_payload_t *notify_payload = (notify_payload_t *) payload;
+				
+				status = this->process_notify_payload(this, notify_payload);
+				if (status != SUCCESS)
+				{
+					payloads->destroy(payloads);
+					return status;
+				}
+				break;
+			}
+			default:
+			{
+				this->logger->log(this->logger, ERROR|LEVEL1, "Ignoring payload %s (%d)", 
+									mapping_find(payload_type_m, payload->get_type(payload)), payload->get_type(payload));
+				break;
+			}
+				
+		}
+			
+	}
+	payloads->destroy(payloads);
+	
+	if (!(nonce_payload && sa_payload && ke_payload))
+	{
+		this->logger->log(this->logger, AUDIT, "IKE_SA_INIT reply did not contain all required payloads. Deleting IKE_SA");
+		return DELETE_ME;
+	}
+	
+	status = this->process_nonce_payload (this,nonce_payload);
+	if (status != SUCCESS)
+	{
+		return status;
+	}
+	
+	status = this->process_sa_payload (this,sa_payload);
+	if (status != SUCCESS)
+	{
+		return status;
+	}
+	
+	status = this->process_ke_payload (this,ke_payload);
+	if (status != SUCCESS)
+	{
+		return status;
+	}
+	
+	/* derive all the keys used in the IKE_SA */
+	status = this->ike_sa->build_transforms(this->ike_sa, this->proposal, this->diffie_hellman, this->sent_nonce, this->received_nonce);
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, AUDIT, "Transform objects could not be created from selected proposal. Deleting IKE_SA");
+		return DELETE_ME;
+	}
+	
+	/* apply the address on wich we really received the packet */
+	connection = this->ike_sa->get_connection(this->ike_sa);
+	me = ike_sa_init_reply->get_destination(ike_sa_init_reply);
+	connection->update_my_host(connection, me->clone(me));
+	policy = this->ike_sa->get_policy(this->ike_sa);
+	policy->update_my_ts(policy, me);
+	
+	/*  build empty message */
+	this->ike_sa->build_message(this->ike_sa, IKE_AUTH, TRUE, &request);
+	
+	status = this->build_id_payload(this, &id_payload, request);
+	if (status != SUCCESS)
+	{
+		request->destroy(request);
+		return status;
+	}	
+	status = this->build_idr_payload(this, request);
+	if (status != SUCCESS)
+	{
+		request->destroy(request);
+		return status;
+	}
+	status = this->build_auth_payload(this, (id_payload_t*)id_payload, request);
+	if (status != SUCCESS)
+	{
+		request->destroy(request);
+		return status;
+	}
+	status = this->build_sa_payload(this, request);
+	if (status != SUCCESS)
+	{
+		request->destroy(request);
+		return status;
+	}
+	status = this->build_tsi_payload(this, request);
+	if (status != SUCCESS)
+	{
+		request->destroy(request);
+		return status;
+	}
+	status = this->build_tsr_payload(this, request);
+	if (status != SUCCESS)
+	{
+		request->destroy(request);
+		return status;
+	}	
+	
+	/* message can now be sent (must not be destroyed) */
+	status = this->ike_sa->send_request(this->ike_sa, request);
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, AUDIT, "Unable to send IKE_AUTH request. Deleting IKE_SA");
+		request->destroy(request);
+		return DELETE_ME;
+	}
+	
+	this->ike_sa->set_last_replied_message_id(this->ike_sa,ike_sa_init_reply->get_message_id(ike_sa_init_reply));
+
+	ike_sa_init_reply_data = ike_sa_init_reply->get_packet_data(ike_sa_init_reply);
+
+	/* state can now be changed */
+	next_state = ike_auth_requested_create(this->ike_sa, this->sent_nonce, this->received_nonce,
+										   ike_sa_init_reply_data, this->child_sa);
+	this->ike_sa->set_new_state(this->ike_sa,(state_t *) next_state);
+
+	this->destroy_after_state_change(this);
+	return SUCCESS;
+}
+
+
+/**
+ * Implementation of private_ike_sa_init_requested_t.process_nonce_payload.
+ */
+status_t process_nonce_payload (private_ike_sa_init_requested_t *this, nonce_payload_t *nonce_payload)
+{
+	free(this->received_nonce.ptr);
+	this->received_nonce = nonce_payload->get_nonce(nonce_payload);
+	return SUCCESS;
+}
+
+
+/**
+ * Implementation of private_ike_sa_init_requested_t.process_sa_payload.
+ */
+status_t process_sa_payload (private_ike_sa_init_requested_t *this, sa_payload_t *sa_payload)
+{
+	proposal_t *proposal;
+	linked_list_t *proposal_list;
+	connection_t *connection;
+	
+	connection = this->ike_sa->get_connection(this->ike_sa);
+	
+	/* get the list of selected proposals, the peer has to select only one proposal */
+	proposal_list = sa_payload->get_proposals (sa_payload);
+	if (proposal_list->get_count(proposal_list) != 1)
+	{
+		this->logger->log(this->logger, AUDIT, "IKE_SA_INIT response did not contain a single proposal. Deleting IKE_SA");
+		while (proposal_list->remove_last(proposal_list, (void**)&proposal) == SUCCESS)
+		{
+			proposal->destroy(proposal);
+		}
+		proposal_list->destroy(proposal_list);
+		return DELETE_ME;
+	}
+	
+	/* we have to re-check if the others selection is valid */
+	this->proposal = connection->select_proposal(connection, proposal_list);
+	while (proposal_list->remove_last(proposal_list, (void**)&proposal) == SUCCESS)
+	{
+		proposal->destroy(proposal);
+	}
+	proposal_list->destroy(proposal_list);
+	
+	if (this->proposal == NULL)
+	{
+		this->logger->log(this->logger, AUDIT, "IKE_SA_INIT response contained selected proposal we did not offer. Deleting IKE_SA");
+		return DELETE_ME;
+	}
+	
+	return SUCCESS;
+}
+
+/**
+ * Implementation of private_ike_sa_init_requested_t.process_ke_payload.
+ */
+status_t process_ke_payload (private_ike_sa_init_requested_t *this, ke_payload_t *ke_payload)
+{	
+	this->diffie_hellman->set_other_public_value(this->diffie_hellman, ke_payload->get_key_exchange_data(ke_payload));
+	
+	return SUCCESS;
+}
+
+/**
+ * Implementation of private_ike_sa_init_requested_t.build_id_payload.
+ */
+static status_t build_id_payload (private_ike_sa_init_requested_t *this,id_payload_t **id_payload, message_t *request)
+{
+	policy_t *policy;
+	id_payload_t *new_id_payload;
+	identification_t *identification;
+	
+	policy = this->ike_sa->get_policy(this->ike_sa);
+	identification = policy->get_my_id(policy);
+	new_id_payload = id_payload_create_from_identification(TRUE, identification);
+	
+	this->logger->log(this->logger, CONTROL|LEVEL2, "Add ID payload to message");
+	request->add_payload(request,(payload_t *) new_id_payload);
+	
+	*id_payload = new_id_payload;
+	
+	return SUCCESS;
+}
+
+/**
+ * Implementation of private_ike_sa_init_requested_t.build_idr_payload.
+ */
+static status_t build_idr_payload (private_ike_sa_init_requested_t *this, message_t *request)
+{
+	policy_t *policy;
+	id_payload_t *idr_payload;
+	identification_t *identification;
+	
+	policy = this->ike_sa->get_policy(this->ike_sa);
+	identification = policy->get_other_id(policy);
+	if (!identification->contains_wildcards(identification))
+	{
+		idr_payload = id_payload_create_from_identification(FALSE, identification);
+	
+		this->logger->log(this->logger, CONTROL|LEVEL2, "Add IDr payload to message");
+		request->add_payload(request,(payload_t *) idr_payload);
+	}
+	return SUCCESS;
+}
+
+/**
+ * Implementation of private_ike_sa_init_requested_t.build_auth_payload.
+ */
+static status_t build_auth_payload (private_ike_sa_init_requested_t *this, id_payload_t *my_id_payload, message_t *request)
+{
+	authenticator_t *authenticator;
+	auth_payload_t *auth_payload;
+	status_t status;
+	
+	authenticator = authenticator_create(this->ike_sa);
+	status = authenticator->compute_auth_data(authenticator,&auth_payload,this->ike_sa_init_request_data,this->received_nonce,my_id_payload,TRUE);	
+	authenticator->destroy(authenticator);
+	
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, AUDIT, "Could not generate AUTH data for IKE_AUTH request. Deleting IKE_SA");
+		return DELETE_ME;		
+	}
+	
+	this->logger->log(this->logger, CONTROL|LEVEL2, "Add AUTH payload to message");
+	request->add_payload(request,(payload_t *) auth_payload);
+	
+	return SUCCESS;
+}
+
+/**
+ * Implementation of private_ike_sa_init_requested_t.build_sa_payload.
+ */
+static status_t build_sa_payload (private_ike_sa_init_requested_t *this, message_t *request)
+{
+	linked_list_t *proposal_list;
+	sa_payload_t *sa_payload;
+	policy_t *policy;
+	connection_t *connection;
+	
+	/* get proposals form config, add to payload */
+	policy = this->ike_sa->get_policy(this->ike_sa);
+	proposal_list = policy->get_proposals(policy);
+	/* build child sa */
+	connection = this->ike_sa->get_connection(this->ike_sa);
+	this->child_sa = child_sa_create(connection->get_my_host(connection),
+									 connection->get_other_host(connection));
+	if (this->child_sa->alloc(this->child_sa, proposal_list) != SUCCESS)
+	{
+		this->logger->log(this->logger, AUDIT, "Could not install CHILD_SA! Deleting IKE_SA");
+		return DELETE_ME;
+	}
+	
+	sa_payload = sa_payload_create_from_proposal_list(proposal_list);
+
+	this->logger->log(this->logger, CONTROL|LEVEL2, "Add SA payload to message");
+	request->add_payload(request,(payload_t *) sa_payload);
+	
+	return SUCCESS;
+}
+
+/**
+ * Implementation of private_ike_sa_init_requested_t.build_tsi_payload.
+ */
+static status_t build_tsi_payload (private_ike_sa_init_requested_t *this, message_t *request)
+{
+	linked_list_t *ts_list;
+	ts_payload_t *ts_payload;
+	policy_t *policy;
+	
+	policy = this->ike_sa->get_policy(this->ike_sa);
+	ts_list = policy->get_my_traffic_selectors(policy);
+	ts_payload = ts_payload_create_from_traffic_selectors(TRUE, ts_list);
+	
+	this->logger->log(this->logger, CONTROL|LEVEL2, "Add TSi payload to message");
+	request->add_payload(request,(payload_t *) ts_payload);
+	
+	return SUCCESS;
+}
+
+/**
+ * Implementation of private_ike_sa_init_requested_t.build_tsr_payload.
+ */
+static status_t build_tsr_payload (private_ike_sa_init_requested_t *this, message_t *request)
+{
+	linked_list_t *ts_list;
+	ts_payload_t *ts_payload;
+	policy_t *policy;
+	
+	policy = this->ike_sa->get_policy(this->ike_sa);
+	ts_list = policy->get_other_traffic_selectors(policy);
+	ts_payload = ts_payload_create_from_traffic_selectors(FALSE, ts_list);
+
+	this->logger->log(this->logger, CONTROL|LEVEL2, "Add TSr payload to message");
+	request->add_payload(request,(payload_t *) ts_payload);
+	
+	return SUCCESS;
+}
+
+/**
+ * Implementation of private_ike_sa_init_requested_t.process_notify_payload.
+ */
+static status_t process_notify_payload(private_ike_sa_init_requested_t *this, notify_payload_t *notify_payload)
+{
+	notify_message_type_t notify_message_type = notify_payload->get_notify_message_type(notify_payload);
+	
+	this->logger->log(this->logger, CONTROL|LEVEL1, "Process notify type %s",
+					  mapping_find(notify_message_type_m, notify_message_type));
+	
+	switch (notify_message_type)
+	{
+		case NO_PROPOSAL_CHOSEN:
+		{
+			this->logger->log(this->logger, AUDIT, "IKE_SA_INIT response contained a NO_PROPOSAL_CHOSEN notify. Deleting IKE_SA");
+			return DELETE_ME;
+		}
+		case INVALID_MAJOR_VERSION:
+		{
+			this->logger->log(this->logger, AUDIT, "IKE_SA_INIT response contained a INVALID_MAJOR_VERSION notify. Deleting IKE_SA");
+			return DELETE_ME;						
+		}
+		case INVALID_KE_PAYLOAD:
+		{
+			initiator_init_t *initiator_init_state;
+			chunk_t notify_data;
+			diffie_hellman_group_t dh_group, old_dh_group;
+			connection_t *connection;
+			
+			connection = this->ike_sa->get_connection(this->ike_sa);
+			old_dh_group = connection->get_dh_group(connection);
+			notify_data = notify_payload->get_notification_data(notify_payload);
+			dh_group = ntohs(*((u_int16_t*)notify_data.ptr));
+			
+			/* TODO:
+			 * We are very restrictive here: If the other didn't accept
+			 * our DH group, and we do not accept his offer, continuation
+			 * is cancelled...
+			 */
+			
+			this->logger->log(this->logger, AUDIT, "Peer didn't accept %s, it requested %s!",
+							  mapping_find(diffie_hellman_group_m, old_dh_group),
+							  mapping_find(diffie_hellman_group_m, dh_group));
+			/* check if we can accept this dh group */
+			if (!connection->check_dh_group(connection, dh_group))
+			{
+				this->logger->log(this->logger, AUDIT, 
+								  "Peer does only accept DH group %s, which we do not accept! Aborting",
+								  mapping_find(diffie_hellman_group_m, dh_group));
+				return DELETE_ME;
+			}
+			
+			/* Going to change state back to initiator_init_t */
+			this->logger->log(this->logger, CONTROL|LEVEL2, "Create next state object");
+			initiator_init_state = initiator_init_create(this->ike_sa);
+
+			/* buffer of sent and received messages has to get reseted */
+			this->ike_sa->reset_message_buffers(this->ike_sa);
+
+			/* state can now be changed */ 
+			this->ike_sa->set_new_state(this->ike_sa,(state_t *) initiator_init_state);
+
+			/* state has NOW changed :-) */
+			this->logger->log(this->logger, CONTROL|LEVEL2, "Destroy old sate object");
+			this->logger->log(this->logger, CONTROL|LEVEL2, "Going to retry initialization of connection");
+			
+			this->public.state_interface.destroy(&(this->public.state_interface));
+			if (initiator_init_state->retry_initiate_connection (initiator_init_state, dh_group) != SUCCESS)
+			{
+				return DELETE_ME;
+			}
+			return FAILED;
+		}
+		default:
+		{
+			/*
+			 * - In case of unknown error: IKE_SA gets destroyed.
+			 * - In case of unknown status: logging
+			 */
+			if (notify_message_type < 16383)
+			{
+				this->logger->log(this->logger, AUDIT, "IKE_SA_INIT reply contained an unknown notify error (%d). Deleting IKE_SA",
+								  notify_message_type);
+				return DELETE_ME;	
+			}
+			else
+			{
+				this->logger->log(this->logger, CONTROL, "IKE_SA_INIT reply contained an unknown notify (%d), ignored.", 
+									notify_message_type);
+				return SUCCESS;
+			}
+		}
+	}
+}
+
+/**
+ * Implementation of state_t.get_state.
+ */
+static ike_sa_state_t get_state(private_ike_sa_init_requested_t *this)
+{
+	return IKE_SA_INIT_REQUESTED;
+}
+
+/**
+ * Implementation of private_ike_sa_init_requested_t.destroy_after_state_change.
+ */
+static void destroy_after_state_change (private_ike_sa_init_requested_t *this)
+{
+	this->diffie_hellman->destroy(this->diffie_hellman);
+	chunk_free(&(this->ike_sa_init_request_data));
+	if (this->proposal)
+	{
+		this->proposal->destroy(this->proposal);
+	}
+	free(this);
+}
+
+/**
+ * Implementation state_t.destroy.
+ */
+static void destroy(private_ike_sa_init_requested_t *this)
+{
+	this->diffie_hellman->destroy(this->diffie_hellman);
+	free(this->sent_nonce.ptr);
+	free(this->received_nonce.ptr);
+	chunk_free(&(this->ike_sa_init_request_data));
+	if (this->child_sa)
+	{
+		this->child_sa->destroy(this->child_sa);
+	}
+	if (this->proposal)
+	{
+		this->proposal->destroy(this->proposal);
+	}
+	free(this);
+}
+
+/* 
+ * Described in header.
+ */
+ike_sa_init_requested_t *ike_sa_init_requested_create(protected_ike_sa_t *ike_sa, diffie_hellman_t *diffie_hellman, chunk_t sent_nonce,chunk_t ike_sa_init_request_data)
+{
+	private_ike_sa_init_requested_t *this = malloc_thing(private_ike_sa_init_requested_t);
+	
+	/* interface functions */
+	this->public.state_interface.process_message = (status_t (*) (state_t *,message_t *)) process_message;
+	this->public.state_interface.get_state = (ike_sa_state_t (*) (state_t *)) get_state;
+	this->public.state_interface.destroy  = (void (*) (state_t *)) destroy;
+	
+	/* private functions */
+	this->destroy_after_state_change = destroy_after_state_change;
+	this->process_nonce_payload = process_nonce_payload;
+	this->process_sa_payload = process_sa_payload;
+	this->process_ke_payload = process_ke_payload;
+	this->build_auth_payload = build_auth_payload;
+	this->build_tsi_payload = build_tsi_payload;
+	this->build_tsr_payload = build_tsr_payload;
+	this->build_id_payload = build_id_payload;
+	this->build_idr_payload = build_idr_payload;
+	this->build_sa_payload = build_sa_payload;
+	this->process_notify_payload = process_notify_payload;
+	
+	/* private data */
+	this->ike_sa = ike_sa;
+	this->received_nonce = CHUNK_INITIALIZER;
+	this->logger = logger_manager->get_logger(logger_manager, IKE_SA);
+	this->diffie_hellman = diffie_hellman;
+	this->proposal = NULL;
+	this->sent_nonce = sent_nonce;
+	this->child_sa = NULL;
+	this->ike_sa_init_request_data = ike_sa_init_request_data;
+	
+	return &(this->public);
+}

src/charon/sa/states/ike_sa_init_requested.h

@@ -0,0 +1,68 @@
+/**
+ * @file ike_sa_init_requested.h
+ * 
+ * @brief Interface of ike_sa_init_requestet_t.
+ * 
+ */
+
+/*
+ * Copyright (C) 2005 Jan Hutter, Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+ 
+
+#ifndef IKE_SA_INIT_REQUESTED_H_
+#define IKE_SA_INIT_REQUESTED_H_
+
+#include <types.h>
+#include <sa/ike_sa.h>
+#include <sa/states/state.h>
+#include <crypto/diffie_hellman.h>
+
+typedef struct ike_sa_init_requested_t ike_sa_init_requested_t;
+
+/**
+ * @brief This class represents an IKE_SA state when 
+ * requested an IKE_SA_INIT as initiator.
+ * 
+ * @b Constructors:
+ *  - ike_sa_init_requested_create()
+ * 
+ * @todo Include valid child sa SPIs in proposal
+ * 
+ * @ingroup states
+ */
+struct ike_sa_init_requested_t {
+	/**
+	 * The state_t interface.
+	 */
+	state_t state_interface;
+};
+
+/**
+ * Constructor of class ike_sa_init_requested_t.
+ * 
+ * @param ike_sa 					assigned ike_sa
+ * @param diffie_hellman			diffie_hellman object use to retrieve shared secret
+ * @param sent_nonce				Sent nonce value
+ * @param ike_sa_init_request_data	the binary representation of the IKE_SA_INIT request message
+ * @return							created ike_sa_init_request_t object
+ * 
+ * @ingroup states
+ */
+ike_sa_init_requested_t *ike_sa_init_requested_create(protected_ike_sa_t *ike_sa,
+														diffie_hellman_t *diffie_hellman,
+														chunk_t sent_nonce,
+														chunk_t ike_sa_init_request_data);
+
+#endif /*IKE_SA_INIT_REQUESTED_H_*/

src/charon/sa/states/ike_sa_init_responded.c

@@ -0,0 +1,695 @@
+/**
+ * @file ike_sa_init_responded.c
+ * 
+ * @brief State of a IKE_SA after responding to an IKE_SA_INIT request
+ * 
+ */
+
+/*
+ * Copyright (C) 2005 Jan Hutter, Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#include <string.h>
+
+#include "ike_sa_init_responded.h"
+
+#include <daemon.h>
+#include <sa/authenticator.h>
+#include <sa/child_sa.h>
+#include <encoding/payloads/ts_payload.h>
+#include <encoding/payloads/sa_payload.h>
+#include <encoding/payloads/id_payload.h>
+#include <encoding/payloads/auth_payload.h>
+#include <encoding/payloads/notify_payload.h>
+#include <crypto/signers/signer.h>
+#include <crypto/crypters/crypter.h>
+#include <sa/states/ike_sa_established.h>
+
+
+typedef struct private_ike_sa_init_responded_t private_ike_sa_init_responded_t;
+
+/**
+ * Private data of a ike_sa_init_responded_t object.
+ *
+ */
+struct private_ike_sa_init_responded_t {
+	/**
+	 * Public interface of ike_sa_init_responded_t.
+	 */
+	ike_sa_init_responded_t public;
+	
+	/**
+	 * Assigned IKE_SA.
+	 */
+	protected_ike_sa_t *ike_sa;
+	
+	/**
+	 * Received nonce.
+	 */
+	chunk_t received_nonce;
+	
+	/**
+	 * Sent nonce.
+	 */
+	chunk_t sent_nonce;
+	
+	/**
+	 * Binary representation of the IKE_SA_INIT response.
+	 */
+	chunk_t ike_sa_init_response_data;
+
+	/**
+	 * Binary representation of the IKE_SA_INIT request.
+	 */	
+	chunk_t ike_sa_init_request_data;
+	
+	/**
+	 * SA config to use.
+	 */
+	policy_t *policy;
+	
+	/**
+	 * CHILD_SA, if set up
+	 */
+	child_sa_t *child_sa;
+	
+	/**
+	 * Traffic selectors applicable at our site
+	 */
+	linked_list_t *my_ts;
+	
+	/**
+	 * Traffic selectors applicable at remote site
+	 */
+	linked_list_t *other_ts;
+	
+	/**
+	 * Assigned logger.
+	 * 
+	 * Is logger of ike_sa!
+	 */
+	logger_t *logger;
+	
+	/**
+	 * Process received IDi and IDr payload and build IDr payload for IKE_AUTH response.
+	 * 
+	 * @param this			calling object
+	 * @param request_idi	ID payload representing initiator
+	 * @param request_idr	ID payload representing responder (May be zero)
+	 * @param response		The created IDr payload is added to this message_t object
+	 * @param response_idr	The created IDr payload is also written to this location
+	 */
+	status_t (*build_idr_payload) (private_ike_sa_init_responded_t *this,
+									id_payload_t *request_idi, 
+									id_payload_t *request_idr, 
+									message_t *response,
+									id_payload_t **response_idr);
+
+	/**
+	 * Process received SA payload and build SA payload for IKE_AUTH response.
+	 * 
+	 * @param this			calling object
+	 * @param request		SA payload received in IKE_AUTH request
+	 * @param response		The created SA payload is added to this message_t object
+	 */
+	status_t (*build_sa_payload) (private_ike_sa_init_responded_t *this, sa_payload_t *request, message_t *response);
+
+	/**
+	 * Process received AUTH payload and build AUTH payload for IKE_AUTH response.
+	 * 
+	 * @param this				calling object
+	 * @param request			AUTH payload received in IKE_AUTH request
+	 * @param other_id_payload	other ID payload needed to verify AUTH data
+	 * @param my_id_payload		my ID payload needed to compute AUTH data
+	 * @param response			The created AUTH payload is added to this message_t object
+	 */
+	status_t (*build_auth_payload) (private_ike_sa_init_responded_t *this, auth_payload_t *request,id_payload_t *other_id_payload,id_payload_t *my_id_payload, message_t* response);
+	
+	/**
+	 * Process received TS payload and build TS payload for IKE_AUTH response.
+	 * 
+	 * @param this			calling object
+	 * @param is_initiator	type of TS payload. TRUE for TSi, FALSE for TSr
+	 * @param request		TS payload received in IKE_AUTH request
+	 * @param response		the created TS payload is added to this message_t object
+	 */
+	status_t (*build_ts_payload) (private_ike_sa_init_responded_t *this, bool ts_initiator, ts_payload_t *request, message_t *response);
+	
+	/**
+	 * Sends a IKE_AUTH reply containing a notify payload.
+	 * 
+	 * @param this		calling object
+	 * @param notify_payload payload to process
+	 * @return
+	 * 					- DELETE_ME if IKE_SA should be deleted
+	 * 					- SUCCSS if processed successfull
+	 */
+	status_t (*process_notify_payload) (private_ike_sa_init_responded_t *this, notify_payload_t* notify_payload);
+	
+	/**
+	 * Destroy function called internally of this class after state change to 
+	 * state IKE_SA_ESTABLISHED succeeded. 
+	 * 
+	 * This destroy function does not destroy objects which were passed to the new state.
+	 * 
+	 * @param this		calling object
+	 */
+	void (*destroy_after_state_change) (private_ike_sa_init_responded_t *this);
+};
+
+/**
+ * Implements state_t.get_state
+ */
+static status_t process_message(private_ike_sa_init_responded_t *this, message_t *request)
+{
+	id_payload_t *idi_request = NULL, *idr_request = NULL,*idr_response;
+	ts_payload_t *tsi_request = NULL, *tsr_request = NULL;
+	auth_payload_t *auth_request = NULL;
+	sa_payload_t *sa_request = NULL;
+	iterator_t *payloads;
+	message_t *response;
+	crypter_t *crypter;
+	signer_t *signer;
+	status_t status;
+	host_t *my_host, *other_host;
+	connection_t *connection;
+	
+	if (request->get_exchange_type(request) != IKE_AUTH)
+	{
+		this->logger->log(this->logger, ERROR | LEVEL1, "Message of type %s not supported in state ike_sa_init_responded",
+							mapping_find(exchange_type_m,request->get_exchange_type(request)));
+		return FAILED;
+	}
+	
+	if (!request->get_request(request))
+	{
+		this->logger->log(this->logger, ERROR | LEVEL1, "IKE_AUTH responses not allowed state ike_sa_init_responded");
+		return FAILED;
+	}
+	
+	/* get signer for verification and crypter for decryption */
+	signer = this->ike_sa->get_signer_initiator(this->ike_sa);
+	crypter = this->ike_sa->get_crypter_initiator(this->ike_sa);
+	
+	status = request->parse_body(request, crypter, signer);
+	if (status != SUCCESS)
+	{
+		if (status == NOT_SUPPORTED)
+		{
+			this->logger->log(this->logger, ERROR | LEVEL1, "IKE_AUTH request contains unsupported payload with critical flag set."
+															"Deleting IKE_SA");
+			this->ike_sa->send_notify(this->ike_sa, IKE_AUTH, UNSUPPORTED_CRITICAL_PAYLOAD, CHUNK_INITIALIZER);
+			return DELETE_ME;
+		}
+		else
+		{
+			this->logger->log(this->logger, AUDIT, "IKE_AUTH request decryption faild. Ignoring message");
+		}
+		return status;
+	}
+	
+	/* iterate over incoming payloads. Message is verified, we can be sure there are the required payloads */
+	payloads = request->get_payload_iterator(request);
+	while (payloads->has_next(payloads))
+	{
+		payload_t *payload;
+		payloads->current(payloads, (void**)&payload);
+		
+		switch (payload->get_type(payload))
+		{
+			case ID_INITIATOR:
+			{
+				idi_request = (id_payload_t*)payload;
+				break;	
+			}
+			case AUTHENTICATION:
+			{
+				auth_request = (auth_payload_t*)payload;
+				break;	
+			}
+			case ID_RESPONDER:
+			{
+				idr_request = (id_payload_t*)payload;
+				break;	
+			}
+			case SECURITY_ASSOCIATION:
+			{
+				sa_request = (sa_payload_t*)payload;
+				break;
+			}
+			case TRAFFIC_SELECTOR_INITIATOR:
+			{
+				tsi_request = (ts_payload_t*)payload;
+				break;	
+			}
+			case TRAFFIC_SELECTOR_RESPONDER:
+			{
+				tsr_request = (ts_payload_t*)payload;
+				break;	
+			}
+			case NOTIFY:
+			{
+				notify_payload_t *notify_payload = (notify_payload_t *) payload;
+				status = this->process_notify_payload(this, notify_payload);
+				if (status != SUCCESS)
+				{
+					payloads->destroy(payloads);
+					return status;	
+				}
+			}			
+			case CERTIFICATE:
+			{
+				/* TODO handle cert payloads */
+			}
+			case CERTIFICATE_REQUEST:
+			{
+				/* TODO handle certrequest payloads */
+			}
+			default:
+			{
+				this->logger->log(this->logger, ERROR|LEVEL1, "Ignoring payload %s (%d)", 
+									mapping_find(payload_type_m, payload->get_type(payload)), payload->get_type(payload));
+				break;
+			}
+		}
+	}
+	/* iterator can be destroyed */
+	payloads->destroy(payloads);
+	
+	/* check if we have all payloads */
+	if (!(idi_request && sa_request && auth_request && tsi_request && tsr_request))
+	{
+		this->logger->log(this->logger, AUDIT, "IKE_AUTH reply did not contain all required payloads. Deleting IKE_SA");
+		return DELETE_ME;
+	}
+		
+	/* build response */
+	this->ike_sa->build_message(this->ike_sa, IKE_AUTH, FALSE, &response);
+	
+	/* add payloads to it */
+	status = this->build_idr_payload(this, idi_request, idr_request, response,&idr_response);
+	if (status != SUCCESS)
+	{
+		response->destroy(response);
+		return status;
+	}
+	status = this->build_auth_payload(this, auth_request,idi_request, idr_response,response);
+	if (status != SUCCESS)
+	{
+		response->destroy(response);
+		return status;
+	}
+	status = this->build_sa_payload(this, sa_request, response);
+	if (status != SUCCESS)
+	{
+		response->destroy(response);
+		return status;
+	}
+	status = this->build_ts_payload(this, TRUE, tsi_request, response);
+	if (status != SUCCESS)
+	{
+		response->destroy(response);
+		return status;
+	}
+	status = this->build_ts_payload(this, FALSE, tsr_request, response);
+	if (status != SUCCESS)
+	{
+		response->destroy(response);
+		return status;
+	}		
+
+	status = this->ike_sa->send_response(this->ike_sa, response);
+	/* message can now be sent (must not be destroyed) */
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, AUDIT, "Unable to send IKE_AUTH reply. Deleting IKE_SA");
+		response->destroy(response);
+		return DELETE_ME;
+	}
+	
+	/* install child SA policies */
+	if (!this->child_sa)
+	{
+		this->logger->log(this->logger, CONTROL, "Proposal negotiation failed, no CHILD_SA built");
+	}
+	else if (this->my_ts->get_count(this->my_ts) == 0 || this->other_ts->get_count(this->other_ts) == 0)
+	{
+		this->logger->log(this->logger, CONTROL, "Traffic selector negotiation failed, no CHILD_SA built");
+		this->child_sa->destroy(this->child_sa);
+		this->child_sa = NULL;
+	}
+	else
+	{
+		status = this->child_sa->add_policies(this->child_sa, this->my_ts, this->other_ts);
+		if (status != SUCCESS)
+		{
+			this->logger->log(this->logger, AUDIT, "Could not install CHILD_SA policy! Deleting IKE_SA");
+			return DELETE_ME;
+		}
+		this->ike_sa->add_child_sa(this->ike_sa, this->child_sa);
+	}
+	
+	/* create new state */						
+	this->ike_sa->set_new_state(this->ike_sa, (state_t*)ike_sa_established_create(this->ike_sa));
+	this->destroy_after_state_change(this);
+	
+	connection = this->ike_sa->get_connection(this->ike_sa);
+	my_host = connection->get_my_host(connection);
+	other_host = connection->get_other_host(connection);
+	this->logger->log(this->logger, AUDIT, "IKE_SA established between %s - %s", 
+					  my_host->get_address(my_host), other_host->get_address(other_host));
+
+	return SUCCESS;
+}
+
+/**
+ * Implementation of private_ike_sa_init_responded_t.build_idr_payload.
+ */
+static status_t build_idr_payload(private_ike_sa_init_responded_t *this, id_payload_t *request_idi, id_payload_t *request_idr, message_t *response,id_payload_t **response_idr)
+{
+	identification_t *other_id, *my_id = NULL;
+	connection_t *connection;
+	id_payload_t *idr_response;
+	
+	connection = this->ike_sa->get_connection(this->ike_sa);
+	
+	/* update adresses, as connection may contain wildcards, or wrong IDs */
+	other_id = request_idi->get_identification(request_idi);
+	if (request_idr)
+	{
+		my_id = request_idr->get_identification(request_idr);
+		connection->update_my_id(connection, my_id);
+	}
+	else
+	{
+		my_id = connection->get_my_id(connection);
+	}
+	connection->update_other_id(connection, other_id);
+
+	/* build new sa config */
+	this->policy = charon->policies->get_policy(charon->policies, my_id, other_id);
+	if (this->policy == NULL)
+	{
+		this->logger->log(this->logger, AUDIT, "We don't have a policy for IDs %s - %s. Deleting IKE_SA", 
+						  my_id->get_string(my_id), other_id->get_string(other_id));
+		return DELETE_ME;
+	}
+	
+	/* get my id from policy, which must contain a fully qualified valid id */
+	my_id = this->policy->get_my_id(this->policy);
+	
+	/* update others traffic selectors with actually used address */
+	this->policy->update_other_ts(this->policy, response->get_destination(response));
+	
+	/* set policy in ike_sa for other states */
+	this->ike_sa->set_policy(this->ike_sa, this->policy);
+	
+	/*  build response */
+	idr_response = id_payload_create_from_identification(FALSE, my_id);
+	response->add_payload(response, (payload_t*)idr_response);
+	*response_idr = idr_response;
+	
+	return SUCCESS;
+}
+
+/**
+ * Implementation of private_ike_sa_init_responded_t.build_sa_payload.
+ */
+static status_t build_sa_payload(private_ike_sa_init_responded_t *this, sa_payload_t *request, message_t *response)
+{
+	proposal_t *proposal, *proposal_tmp;
+	linked_list_t *proposal_list;
+	sa_payload_t *sa_response;
+	chunk_t seed;
+	prf_plus_t *prf_plus;
+	status_t status;
+	connection_t *connection;
+	
+	/* get proposals from request */
+	proposal_list = request->get_proposals(request);
+	if (proposal_list->get_count(proposal_list) == 0)
+	{
+		/* if the other side did not offer any proposals, we do not create child sa's */
+		this->logger->log(this->logger, AUDIT, "IKE_AUH request did not contain any proposals. No CHILD_SA created");
+		sa_response = sa_payload_create();
+		response->add_payload(response, (payload_t*)sa_response);
+		proposal_list->destroy(proposal_list);
+		return SUCCESS;
+	}
+
+	/* now select a proposal */
+	this->logger->log(this->logger, CONTROL|LEVEL1, "Selecting proposals:");
+	proposal = this->policy->select_proposal(this->policy, proposal_list);
+	/* list is not needed anymore */
+	while (proposal_list->remove_last(proposal_list, (void**)&proposal_tmp) == SUCCESS)
+	{
+		proposal_tmp->destroy(proposal_tmp);
+	}
+	proposal_list->destroy(proposal_list);
+	/* do we have a proposal */
+	if (proposal == NULL)
+	{
+		this->logger->log(this->logger, AUDIT, "IKE_AUTH request did not contain any proposals we accept. Deleting IKE_SA");
+		this->ike_sa->send_notify(this->ike_sa, IKE_AUTH, NO_PROPOSAL_CHOSEN, CHUNK_INITIALIZER);
+		return DELETE_ME;	
+	}
+	
+	/* set up child sa */
+	seed = chunk_alloc(this->received_nonce.len + this->sent_nonce.len);
+	memcpy(seed.ptr, this->received_nonce.ptr, this->received_nonce.len);
+	memcpy(seed.ptr + this->received_nonce.len, this->sent_nonce.ptr, this->sent_nonce.len);
+	prf_plus = prf_plus_create(this->ike_sa->get_child_prf(this->ike_sa), seed);
+	chunk_free(&seed);
+	
+	connection = this->ike_sa->get_connection(this->ike_sa);
+	this->child_sa = child_sa_create(connection->get_my_host(connection),
+									 connection->get_other_host(connection));
+		
+	status = this->child_sa->add(this->child_sa, proposal, prf_plus);
+	prf_plus->destroy(prf_plus);
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, AUDIT, "Could not install CHILD_SA! Deleting IKE_SA");
+		return DELETE_ME;
+	}
+	
+	/* create payload with selected propsal */
+	sa_response = sa_payload_create_from_proposal(proposal);
+	response->add_payload(response, (payload_t*)sa_response);
+	proposal->destroy(proposal);
+	return SUCCESS;
+}
+
+/**
+ * Implementation of private_ike_sa_init_responded_t.build_auth_payload.
+ */
+static status_t build_auth_payload(private_ike_sa_init_responded_t *this, auth_payload_t *auth_request,id_payload_t *other_id_payload,id_payload_t *my_id_payload, message_t* response)
+{
+	authenticator_t *authenticator;
+	auth_payload_t *auth_reply;
+	status_t status;
+	
+	authenticator = authenticator_create(this->ike_sa);
+	status =  authenticator->verify_auth_data(authenticator,auth_request, this->ike_sa_init_request_data,this->sent_nonce,other_id_payload,TRUE);
+	
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, AUDIT, "IKE_AUTH request verification failed. Deleting IKE_SA");
+		this->ike_sa->send_notify(this->ike_sa, IKE_AUTH, AUTHENTICATION_FAILED, CHUNK_INITIALIZER);
+		authenticator->destroy(authenticator);
+		return DELETE_ME;
+	}
+		
+	status = authenticator->compute_auth_data(authenticator,&auth_reply, this->ike_sa_init_response_data,this->received_nonce,my_id_payload,FALSE);
+	authenticator->destroy(authenticator);
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, AUDIT, "Unable to build authentication data for IKE_AUTH reply. Deleting IKE_SA");
+		return DELETE_ME;
+		
+	}
+	
+	response->add_payload(response, (payload_t *)auth_reply);
+	return SUCCESS;	
+}
+
+/**
+ * Implementation of private_ike_sa_init_responded_t.build_ts_payload.
+ */
+static status_t build_ts_payload(private_ike_sa_init_responded_t *this, bool ts_initiator, ts_payload_t *request, message_t* response)
+{
+	linked_list_t *ts_received, *ts_selected;
+	traffic_selector_t *ts;
+	status_t status = SUCCESS;
+	ts_payload_t *ts_response;
+
+	/* build a reply payload with selected traffic selectors */
+	ts_received = request->get_traffic_selectors(request);
+	/* select ts depending on payload type */
+	if (ts_initiator)
+	{
+		ts_selected = this->policy->select_other_traffic_selectors(this->policy, ts_received);
+		this->other_ts = ts_selected;
+	}
+	else
+	{
+		ts_selected = this->policy->select_my_traffic_selectors(this->policy, ts_received);
+		this->my_ts = ts_selected;
+	}
+	
+	ts_response = ts_payload_create_from_traffic_selectors(ts_initiator, ts_selected);
+	response->add_payload(response, (payload_t*)ts_response);
+	
+	/* cleanup */
+	while (ts_received->remove_last(ts_received, (void**)&ts) == SUCCESS)
+	{
+		ts->destroy(ts);
+	}
+	ts_received->destroy(ts_received);
+	
+	return status;
+}
+
+static status_t process_notify_payload(private_ike_sa_init_responded_t *this, notify_payload_t *notify_payload)
+{
+	notify_message_type_t notify_message_type = notify_payload->get_notify_message_type(notify_payload);
+	
+	this->logger->log(this->logger, CONTROL|LEVEL1, "Process notify type %s",
+					  mapping_find(notify_message_type_m, notify_message_type));
+					  
+	switch (notify_message_type)
+	{
+		case SET_WINDOW_SIZE:
+		/*
+		 * TODO Increase window size.
+		 */
+		case INITIAL_CONTACT:
+		/*
+		 * TODO Delete existing IKE_SA's with other Identity.
+		 */
+		default:
+		{
+			this->logger->log(this->logger, AUDIT, "IKE_AUTH request contained an unknown notify (%d), ignored.", notify_message_type);
+		}
+	}
+
+	return SUCCESS;	
+}
+
+/**
+ * Implementation of state_t.get_state.
+ */
+static ike_sa_state_t get_state(private_ike_sa_init_responded_t *this)
+{
+	return IKE_SA_INIT_RESPONDED;
+}
+
+/**
+ * Implementation of state_t.destroy.
+ */
+static void destroy(private_ike_sa_init_responded_t *this)
+{
+	chunk_free(&(this->received_nonce));
+	chunk_free(&(this->sent_nonce));
+	chunk_free(&(this->ike_sa_init_response_data));
+	chunk_free(&(this->ike_sa_init_request_data));
+	if (this->my_ts)
+	{
+		traffic_selector_t *ts;
+		while (this->my_ts->remove_last(this->my_ts, (void**)&ts) == SUCCESS)
+		{
+			ts->destroy(ts);
+		}
+		this->my_ts->destroy(this->my_ts);
+	}
+	if (this->other_ts)
+	{
+		traffic_selector_t *ts;
+		while (this->other_ts->remove_last(this->other_ts, (void**)&ts) == SUCCESS)
+		{
+			ts->destroy(ts);
+		}
+		this->other_ts->destroy(this->other_ts);
+	}
+	if (this->child_sa)
+	{
+		this->child_sa->destroy(this->child_sa);
+	}
+
+	free(this);
+}
+/**
+ * Implementation of private_ike_sa_init_responded.destroy_after_state_change.
+ */
+static void destroy_after_state_change(private_ike_sa_init_responded_t *this)
+{
+	chunk_free(&(this->received_nonce));
+	chunk_free(&(this->sent_nonce));
+	chunk_free(&(this->ike_sa_init_response_data));
+	chunk_free(&(this->ike_sa_init_request_data));
+	if (this->my_ts)
+	{
+		traffic_selector_t *ts;
+		while (this->my_ts->remove_last(this->my_ts, (void**)&ts) == SUCCESS)
+		{
+			ts->destroy(ts);
+		}
+		this->my_ts->destroy(this->my_ts);
+	}
+	if (this->other_ts)
+	{
+		traffic_selector_t *ts;
+		while (this->other_ts->remove_last(this->other_ts, (void**)&ts) == SUCCESS)
+		{
+			ts->destroy(ts);
+		}
+		this->other_ts->destroy(this->other_ts);
+	}
+
+	free(this);
+}
+
+/* 
+ * Described in header.
+ */
+ike_sa_init_responded_t *ike_sa_init_responded_create(protected_ike_sa_t *ike_sa, chunk_t received_nonce, chunk_t sent_nonce,chunk_t ike_sa_init_request_data, chunk_t ike_sa_init_response_data)
+{
+	private_ike_sa_init_responded_t *this = malloc_thing(private_ike_sa_init_responded_t);
+
+	/* interface functions */
+	this->public.state_interface.process_message = (status_t (*) (state_t *,message_t *)) process_message;
+	this->public.state_interface.get_state = (ike_sa_state_t (*) (state_t *)) get_state;
+	this->public.state_interface.destroy  = (void (*) (state_t *)) destroy;
+	
+	/* private functions */
+	this->build_idr_payload = build_idr_payload;
+	this->build_sa_payload = build_sa_payload;
+	this->build_auth_payload = build_auth_payload;
+	this->build_ts_payload = build_ts_payload;
+	this->process_notify_payload = process_notify_payload;
+	this->destroy_after_state_change = destroy_after_state_change;
+	
+	/* private data */
+	this->ike_sa = ike_sa;
+	this->received_nonce = received_nonce;
+	this->sent_nonce = sent_nonce;
+	this->ike_sa_init_response_data = ike_sa_init_response_data;
+	this->ike_sa_init_request_data = ike_sa_init_request_data;
+	this->my_ts = NULL;
+	this->other_ts = NULL;
+	this->child_sa = NULL;
+	this->logger = logger_manager->get_logger(logger_manager, IKE_SA);
+	
+	return &(this->public);
+}

src/charon/sa/states/ike_sa_init_responded.h

@@ -0,0 +1,73 @@
+/**
+ * @file ike_sa_init_responded.h
+ * 
+ * @brief Interface of ike_sa_init_responded_t.
+ * 
+ */
+
+/*
+ * Copyright (C) 2005 Jan Hutter, Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#ifndef IKE_SA_INIT_RESPONDED_H_
+#define IKE_SA_INIT_RESPONDED_H_
+
+#include <sa/ike_sa.h>
+#include <sa/states/state.h>
+
+typedef struct ike_sa_init_responded_t ike_sa_init_responded_t;
+
+/**
+ * @brief This class represents an IKE_SA state when 
+ * responded to an IKE_SA_INIT request.
+ * 
+ * The state accpets IKE_AUTH requests. It proves the authenticity
+ * and sets up the first child sa. Then it sends back an IKE_AUTH
+ * reply and changes to the IKE_SA_ESTABLISHED state.
+ * 
+ * @b Constructors:
+ *  - ike_sa_init_response_data()
+ * 
+ * @todo Implement handling of SET_WINDOW_SIZE notify
+ * 
+ * @todo Implement handling of INITIAL_CONTACT notify
+ * 
+ * @ingroup states
+ */
+struct ike_sa_init_responded_t {
+	/**
+	 * The state_t interface.
+	 */
+	state_t state_interface;
+
+};
+
+/**
+ * @brief Constructor of class ike_sa_init_responded_t
+ * 
+ * @param ike_sa 						assigned IKE_SA
+ * @param received_nonce				received nonce data in IKE_SA_INIT request
+ * @param sent_nonce					sent nonce data in IKE_SA_INIT response
+ * @param ike_sa_init_request_data		binary representation of received IKE_SA_INIT request
+ * @param ike_sa_init_response_data		binary representation of sent IKE_SA_INIT response
+ * 
+ * @ingroup states
+ */
+ike_sa_init_responded_t *ike_sa_init_responded_create(protected_ike_sa_t *ike_sa,
+														chunk_t received_nonce,
+														chunk_t sent_nonce,
+														chunk_t ike_sa_init_request_data,
+														chunk_t ike_sa_init_response_data);
+
+#endif /*IKE_SA_INIT_RESPONDED_H_*/

src/charon/sa/states/initiator_init.c

@@ -0,0 +1,360 @@
+/**
+ * @file initiator_init.c
+ * 
+ * @brief Implementation of initiator_init_t.
+ * 
+ */
+
+/*
+ * Copyright (C) 2005 Jan Hutter, Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+ 
+#include "initiator_init.h"
+
+
+#include <daemon.h>
+#include <sa/states/state.h>
+#include <sa/states/ike_sa_init_requested.h>
+#include <queues/jobs/retransmit_request_job.h>
+#include <crypto/diffie_hellman.h>
+#include <encoding/payloads/sa_payload.h>
+#include <encoding/payloads/ke_payload.h>
+#include <encoding/payloads/nonce_payload.h>
+
+
+typedef struct private_initiator_init_t private_initiator_init_t;
+
+/**
+ * Private data of a initiator_init_t object..
+ *
+ */
+struct private_initiator_init_t {
+	/**
+	 * Methods of the state_t interface.
+	 */
+	initiator_init_t public;
+	
+	/**
+	 * Assigned IKE_SA.
+	 */
+	protected_ike_sa_t *ike_sa;
+	
+	/**
+	 * Diffie hellman object used to generate public DH value.
+	 * This objet is passed to the next state of type IKE_SA_INIT_REQUESTED.
+	 */
+	diffie_hellman_t *diffie_hellman;
+	
+	/**
+	 * Sent nonce.
+	 * This nonce is passed to the next state of type IKE_SA_INIT_REQUESTED.
+	 */
+	chunk_t sent_nonce;
+
+	/**
+	 * Assigned logger.
+	 * 
+	 * Is logger of ike_sa!
+	 */
+	logger_t *logger;
+	
+	/**
+	 * Builds the SA payload for this state.
+	 * 
+	 * @param this		calling object
+	 * @param request	message_t object to add the SA payload
+	 */
+	void (*build_sa_payload) (private_initiator_init_t *this, message_t *request);
+
+	/**
+	 * Builds the KE payload for this state.
+	 * 
+	 * @param this		calling object
+	 * @param request	message_t object to add the KE payload
+	 */
+	void (*build_ke_payload) (private_initiator_init_t *this, message_t *request);
+	
+	/**
+	 * Builds the NONCE payload for this state.
+	 * 
+	 * @param this		calling object
+	 * @param request	message_t object to add the NONCE payload
+	 */
+	status_t (*build_nonce_payload) (private_initiator_init_t *this,message_t *request);	
+	
+	/**
+	 * Destroy function called internally of this class after state change to state 
+	 * IKE_SA_INIT_REQUESTED succeeded.
+	 * 
+	 * This destroy function does not destroy objects which were passed to the new state.
+	 * 
+	 * @param this		calling object
+	 */
+	void (*destroy_after_state_change) (private_initiator_init_t *this);
+};
+
+/**
+ * Implementation of initiator_init_t.initiate_connection.
+ */
+static status_t initiate_connection (private_initiator_init_t *this, connection_t *connection)
+{
+	policy_t *policy;
+	diffie_hellman_group_t dh_group;
+	host_t *my_host, *other_host;
+	identification_t *my_id, *other_id;
+	
+	my_host = connection->get_my_host(connection);
+	other_host = connection->get_other_host(connection);
+	my_id = connection->get_my_id(connection);
+	other_id = connection->get_other_id(connection);
+	
+	this->logger->log(this->logger, CONTROL, "Initiating connection between %s (%s) - %s (%s)",
+					  my_id->get_string(my_id), my_host->get_address(my_host),
+					  other_id->get_string(other_id), other_host->get_address(other_host));
+	
+	this->ike_sa->set_connection(this->ike_sa, connection);
+	
+	/* get policy */
+	policy = charon->policies->get_policy(charon->policies, my_id, other_id);
+	if (policy == NULL)
+	{
+		this->logger->log(this->logger, ERROR | LEVEL1, "Could not get a policy for '%s - %s', aborting",
+						  my_id->get_string(my_id), other_id->get_string(other_id));
+		return DELETE_ME;
+	}
+	this->ike_sa->set_policy(this->ike_sa,policy);
+	
+	/* we must guess now a DH group. For that we choose our most preferred group */
+	dh_group = connection->get_dh_group(connection);
+	
+	/* next step is done in retry_initiate_connection */
+	return this->public.retry_initiate_connection(&this->public, dh_group);
+}
+
+/**
+ * Implementation of initiator_init_t.retry_initiate_connection.
+ */
+status_t retry_initiate_connection (private_initiator_init_t *this, diffie_hellman_group_t dh_group)
+{
+	ike_sa_init_requested_t *next_state;
+	chunk_t ike_sa_init_request_data;
+	connection_t *connection;
+	ike_sa_id_t *ike_sa_id;
+	message_t *message;
+	status_t status;
+	
+	if (dh_group == MODP_UNDEFINED)
+	{
+		this->logger->log(this->logger, AUDIT, "No DH group acceptable for initialization, Aborting");
+		return DELETE_ME;
+	}
+	
+	connection = this->ike_sa->get_connection(this->ike_sa);
+	this->diffie_hellman = diffie_hellman_create(dh_group);
+	ike_sa_id = this->ike_sa->public.get_id(&(this->ike_sa->public));
+	ike_sa_id->set_responder_spi(ike_sa_id,0);
+
+	/* going to build message */
+	this->logger->log(this->logger, CONTROL|LEVEL2, "Going to build message");
+	this->ike_sa->build_message(this->ike_sa, IKE_SA_INIT, TRUE, &message);
+	
+	/* build SA payload */		
+	this->build_sa_payload(this, message);
+	
+	/* build KE payload */
+	this->build_ke_payload(this, message);
+	
+	/* build Nonce payload */
+	status = this->build_nonce_payload(this, message);
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, ERROR, "Building nonce payload failed. Aborting");
+		message->destroy(message);
+		return DELETE_ME;
+	}
+	
+	/* message can now be sent (must not be destroyed) */
+	status = this->ike_sa->send_request(this->ike_sa, message);
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, AUDIT, "Unable to initiate connection, could not send message. Aborting");
+		message->destroy(message);
+		return DELETE_ME;
+	}
+	
+	message = this->ike_sa->get_last_requested_message(this->ike_sa);
+	
+	ike_sa_init_request_data = message->get_packet_data(message);
+
+	/* state can now be changed */
+	this->logger->log(this->logger, CONTROL|LEVEL2, "Create next state object");
+	next_state = ike_sa_init_requested_create(this->ike_sa, this->diffie_hellman, this->sent_nonce,ike_sa_init_request_data);
+	this->ike_sa->set_new_state(this->ike_sa,(state_t *) next_state);
+	
+	this->logger->log(this->logger, CONTROL|LEVEL2, "Destroy old sate object");
+	this->destroy_after_state_change(this);
+	return SUCCESS;
+}
+
+/**
+ * Implementation of private_initiator_init_t.build_sa_payload.
+ */
+static void build_sa_payload(private_initiator_init_t *this, message_t *request)
+{
+	sa_payload_t* sa_payload;
+	linked_list_t *proposal_list;
+	connection_t *connection;
+	
+	this->logger->log(this->logger, CONTROL|LEVEL1, "Building SA payload");
+	
+	connection = this->ike_sa->get_connection(this->ike_sa);
+
+	proposal_list = connection->get_proposals(connection);
+	
+	sa_payload = sa_payload_create_from_proposal_list(proposal_list);	
+
+	this->logger->log(this->logger, CONTROL|LEVEL2, "Add SA payload to message");
+	request->add_payload(request, (payload_t *) sa_payload);
+}
+
+/**
+ * Implementation of private_initiator_init_t.build_ke_payload.
+ */
+static void build_ke_payload(private_initiator_init_t *this, message_t *request)
+{
+	ke_payload_t *ke_payload;
+	chunk_t key_data;
+	diffie_hellman_group_t dh_group;
+	
+	this->logger->log(this->logger, CONTROL|LEVEL1, "Building KE payload");
+	
+	this->diffie_hellman->get_my_public_value(this->diffie_hellman,&key_data);
+	dh_group = this->diffie_hellman->get_dh_group(this->diffie_hellman);
+
+	ke_payload = ke_payload_create();
+	ke_payload->set_dh_group_number(ke_payload, dh_group);
+	ke_payload->set_key_exchange_data(ke_payload, key_data);
+	
+	chunk_free(&key_data);
+	
+	this->logger->log(this->logger, CONTROL|LEVEL2, "Add KE payload to message");
+	request->add_payload(request, (payload_t *) ke_payload);
+}
+
+/**
+ * Implementation of private_initiator_init_t.build_nonce_payload.
+ */
+static status_t build_nonce_payload(private_initiator_init_t *this, message_t *request)
+{
+	nonce_payload_t *nonce_payload;
+	randomizer_t *randomizer;
+	status_t status;
+	
+	this->logger->log(this->logger, CONTROL|LEVEL1, "Building NONCE payload");
+	
+	this->logger->log(this->logger, CONTROL|LEVEL2, "Get pseudo random bytes for NONCE");
+	randomizer = this->ike_sa->get_randomizer(this->ike_sa);
+	
+	status = randomizer->allocate_pseudo_random_bytes(randomizer, NONCE_SIZE, &(this->sent_nonce));
+	if (status != SUCCESS)
+	{
+		return status;
+	}
+
+	this->logger->log(this->logger, RAW|LEVEL2, "Initiator NONCE",&(this->sent_nonce));
+	
+	nonce_payload = nonce_payload_create();
+	
+	nonce_payload->set_nonce(nonce_payload, this->sent_nonce);
+	
+	this->logger->log(this->logger, CONTROL|LEVEL2, "Add NONCE payload to message");
+	request->add_payload(request, (payload_t *) nonce_payload);
+	return SUCCESS;
+}
+
+/**
+ * Implementation of state_t.process_message.
+ */
+static status_t process_message(private_initiator_init_t *this, message_t *message)
+{
+	this->logger->log(this->logger, ERROR, "In state INITIATOR_INIT, no message is processed");
+	return FAILED;
+}
+
+/**
+ * Implementation of state_t.get_state.
+ */
+static ike_sa_state_t get_state(private_initiator_init_t *this)
+{
+	return INITIATOR_INIT;
+}
+
+/**
+ * Implementation of state_t.destroy.
+ */
+static void destroy(private_initiator_init_t *this)
+{
+	this->logger->log(this->logger, CONTROL | LEVEL3, "Going to destroy initiator_init_t state object");
+
+	/* destroy diffie hellman object */
+	if (this->diffie_hellman != NULL)
+	{
+		this->diffie_hellman->destroy(this->diffie_hellman);
+	}
+	if (this->sent_nonce.ptr != NULL)
+	{
+		free(this->sent_nonce.ptr);
+	}
+	free(this);
+}
+
+/**
+ * Implementation of private_initiator_init_t.destroy_after_state_change
+ */
+static void destroy_after_state_change (private_initiator_init_t *this)
+{
+	this->logger->log(this->logger, CONTROL | LEVEL3, "Going to destroy initiator_init_t state object");
+	free(this);
+}
+
+/* 
+ * Described in header.
+ */
+initiator_init_t *initiator_init_create(protected_ike_sa_t *ike_sa)
+{
+	private_initiator_init_t *this = malloc_thing(private_initiator_init_t);
+
+	/* interface functions */
+	this->public.state_interface.process_message = (status_t (*) (state_t *,message_t *)) process_message;
+	this->public.state_interface.get_state = (ike_sa_state_t (*) (state_t *)) get_state;
+	this->public.state_interface.destroy  = (void (*) (state_t *)) destroy;
+	
+	/* public functions */
+	this->public.initiate_connection = (status_t (*)(initiator_init_t *, connection_t*)) initiate_connection;
+	this->public.retry_initiate_connection = (status_t (*)(initiator_init_t *, int )) retry_initiate_connection;
+	
+	/* private functions */
+	this->destroy_after_state_change = destroy_after_state_change;
+	this->build_nonce_payload = build_nonce_payload;
+	this->build_sa_payload = build_sa_payload;
+	this->build_ke_payload = build_ke_payload;
+	
+	/* private data */
+	this->ike_sa = ike_sa;
+	this->logger = logger_manager->get_logger(logger_manager, IKE_SA);
+	this->sent_nonce = CHUNK_INITIALIZER;
+	this->diffie_hellman = NULL;
+
+	return &(this->public);
+}

src/charon/sa/states/initiator_init.h

@@ -0,0 +1,84 @@
+/**
+ * @file initiator_init.h
+ * 
+ * @brief Interface of initiator_init_t.
+ * 
+ */
+
+/*
+ * Copyright (C) 2005 Jan Hutter, Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+
+#ifndef INITIATOR_INIT_H_
+#define INITIATOR_INIT_H_
+
+#include <sa/ike_sa.h>
+#include <sa/states/state.h>
+
+
+typedef struct initiator_init_t initiator_init_t;
+
+/**
+ * @brief This class represents an IKE_SA state when 
+ * initializing a connection as initiator.
+ * 
+ * @b Constructors:
+ *  - initiator_init_create() 
+ * 
+ * @ingroup states
+ */
+struct initiator_init_t {
+	/**
+	 * The state_t interface.
+	 */
+	state_t state_interface;
+	
+	/**
+	 * Initiate a new connection with given connection_t object.
+	 * 
+	 * @param this 			calling object
+	 * @param connection	connection to initiate
+	 * @return				
+	 * 						- SUCCESS
+	 * 						- DELETE_ME if something failed
+	 */
+	status_t (*initiate_connection) (initiator_init_t *this, connection_t *connection);
+	
+	/**
+	 * Retry to initiate a new connection with a specific dh_group_priority.
+	 * 
+	 * The dh_group_priority is starting at 1.
+	 * 
+	 * @param this 				calling object
+	 * @param dh_group_priority	dh group priority to try with
+	 * @return				
+	 * 							- SUCCESS
+	 * 							- DELETE_ME if something failed (see log for error)
+	 */
+	status_t (*retry_initiate_connection) (initiator_init_t *this, int dh_group_priority);
+};
+
+/**
+ * @brief Constructor of class initiator_init_t.
+ * 
+ * @param ike_sa 	assigned IKE_SA
+ * @return			created initiator_init_t object
+ * 
+ * @ingroup states
+ */
+initiator_init_t *initiator_init_create(protected_ike_sa_t *ike_sa);
+
+
+#endif /*INITIATOR_INIT_H_*/

src/charon/sa/states/responder_init.c

@@ -0,0 +1,568 @@
+/**
+ * @file responder_init.c
+ * 
+ * @brief Implementation of responder_init_t.
+ * 
+ */
+
+/*
+ * Copyright (C) 2005 Jan Hutter, Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+ 
+#include "responder_init.h"
+
+#include <daemon.h>
+#include <sa/states/state.h>
+#include <sa/states/ike_sa_init_responded.h>
+#include <encoding/payloads/sa_payload.h>
+#include <encoding/payloads/ke_payload.h>
+#include <encoding/payloads/nonce_payload.h>
+#include <encoding/payloads/notify_payload.h>
+#include <crypto/diffie_hellman.h>
+
+
+typedef struct private_responder_init_t private_responder_init_t;
+
+/**
+ * Private data of a responder_init_t object.
+ *
+ */
+struct private_responder_init_t {
+	/**
+	 * Methods of the state_t interface.
+	 */
+	responder_init_t public;
+	
+	/**
+	 * Assigned IKE_SA.
+	 */
+	protected_ike_sa_t *ike_sa;
+	
+	/**
+	 * Diffie Hellman object used to compute shared secret.
+	 */
+	diffie_hellman_t *diffie_hellman;
+		
+	/**
+	 * Diffie Hellman group number from selected IKE proposal.
+	 */
+	u_int16_t dh_group_number;	
+	
+	/**
+	 * Priority used to get matching dh_group number.
+	 */
+	u_int16_t dh_group_priority;
+
+	/**
+	 * Sent nonce value.
+	 * 
+	 * This value is passed to the next state of type IKE_SA_INIT_RESPONDED.
+	 */
+	chunk_t sent_nonce;
+	
+	/**
+	 * Received nonce value
+	 * 
+	 * This value is passed to the next state of type IKE_SA_INIT_RESPONDED.
+	 */
+	chunk_t received_nonce;
+	
+	/**
+	 * Selected proposal
+	 */
+	proposal_t *proposal;
+	
+	/**
+	 * Logger used to log data .
+	 * 
+	 * Is logger of ike_sa!
+	 */
+	logger_t *logger;
+	
+	/**
+	 * Handles received SA payload and builds the SA payload for the response.
+	 * 
+	 * @param this			calling object
+	 * @param sa_request	The received SA payload
+	 * @param response		the SA payload is added to this response message_t object.
+	 * @return
+	 * 						- DELETE_ME
+	 * 						- SUCCESS
+	 */
+	status_t (*build_sa_payload) (private_responder_init_t *this,sa_payload_t *sa_request, message_t *response);
+
+	/**
+	 * Handles received KE payload and builds the KE payload for the response.
+	 * 
+	 * @param this		calling object
+	 * @param ke_request	The received KE payload
+	 * @param response		the KE payload is added to this response message_t object.
+	 * 						- DELETE_ME
+	 * 						- SUCCESS
+	 */
+	status_t (*build_ke_payload) (private_responder_init_t *this,ke_payload_t *ke_request, message_t *response);
+	
+	/**
+	 * Handles received NONCE payload and builds the NONCE payload for the response.
+	 * 
+	 * @param this			calling object
+	 * @param nonce_request	The received NONCE payload
+	 * @param response		the NONCE payload is added to this response message_t object.
+	 * 						- DELETE_ME
+	 * 						- SUCCESS
+	 */
+	status_t (*build_nonce_payload) (private_responder_init_t *this,nonce_payload_t *nonce_request, message_t *response);	
+	
+	/**
+	 * Sends a IKE_SA_INIT reply containing a notify payload.
+	 * 
+	 * @param this				calling object
+	 * @param notify_payload 	notify_payload to process
+	 */
+	status_t (*process_notify_payload) (private_responder_init_t *this, notify_payload_t *notify_payload);
+	
+	/**
+	 * Destroy function called internally of this class after change 
+	 * to state IKE_SA_INIT_RESPONDED succeeded.
+	 * 
+	 * This destroy function does not destroy objects which were passed to the new state.
+	 * 
+	 * @param this		calling object
+	 */
+	void (*destroy_after_state_change) (private_responder_init_t *this);
+
+};
+
+/**
+ * Implementation of state_t.process_message.
+ */
+static status_t process_message(private_responder_init_t *this, message_t *message)
+{
+	ike_sa_init_responded_t *next_state;
+	chunk_t ike_sa_init_response_data;
+	chunk_t ike_sa_init_request_data;
+	sa_payload_t *sa_request = NULL;
+	ke_payload_t *ke_request = NULL;
+	nonce_payload_t *nonce_request = NULL;
+	host_t *source, *destination;
+	connection_t *connection;
+	iterator_t *payloads;
+	message_t *response;
+	status_t status;
+
+	if (message->get_exchange_type(message) != IKE_SA_INIT)
+	{
+		this->logger->log(this->logger, ERROR | LEVEL1, "Message of type %s not supported in state responder_init",mapping_find(exchange_type_m,message->get_exchange_type(message)));
+		return DELETE_ME;
+	}
+	if (!message->get_request(message))
+	{
+		this->logger->log(this->logger, ERROR | LEVEL1, "IKE_SA_INIT responses not allowed state ike_sa_init_responded");
+		return DELETE_ME;
+	}
+	
+	/* this is the first message to process, so get host infos */
+	source = message->get_source(message);
+	destination = message->get_destination(message);
+
+	connection = charon->connections->get_connection_by_hosts(charon->connections, destination, source);
+	if (connection == NULL)
+	{
+		/* no configuration matches given hosts */
+		this->logger->log(this->logger, AUDIT, "IKE_SA_INIT request does not match any available connection. Deleting IKE_SA");
+		/* TODO: inform requestor */
+		return DELETE_ME;
+	}
+	this->ike_sa->set_connection(this->ike_sa,connection);
+	
+	/* parse incoming message */
+	status = message->parse_body(message, NULL, NULL);
+	if (status != SUCCESS)
+	{
+		if (status == NOT_SUPPORTED)
+		{
+			this->logger->log(this->logger, AUDIT, "IKE_SA_INIT request contains unsupported payload with critical flag set. "
+													"Deleting IKE_SA");
+			this->ike_sa->send_notify(this->ike_sa, IKE_SA_INIT, UNSUPPORTED_CRITICAL_PAYLOAD, CHUNK_INITIALIZER);
+		}
+		else
+		{
+			this->logger->log(this->logger, AUDIT, "Unable to parse IKE_SA_INIT request. Deleting IKE_SA");
+		}
+		return DELETE_ME;
+	}
+
+	payloads = message->get_payload_iterator(message);	
+	while (payloads->has_next(payloads))
+	{
+		payload_t *payload;
+
+		payloads->current(payloads, (void**)&payload);
+		
+		switch (payload->get_type(payload))
+		{
+			case SECURITY_ASSOCIATION:
+			{
+				sa_request = (sa_payload_t*)payload;
+				break;
+			}
+			case KEY_EXCHANGE:
+			{
+				ke_request = (ke_payload_t*)payload;
+				break;
+			}
+			case NONCE:
+			{
+				nonce_request = (nonce_payload_t*)payload;
+				break;
+			}
+			case NOTIFY:
+			{
+				notify_payload_t *notify_payload = (notify_payload_t *) payload;
+				status = this->process_notify_payload(this, notify_payload);
+				if (status != SUCCESS)
+				{
+					payloads->destroy(payloads);
+					return status;	
+				}
+			}
+			default:
+			{
+				this->logger->log(this->logger, ERROR|LEVEL1, "Ignoring payload %s (%d)", 
+									mapping_find(payload_type_m, payload->get_type(payload)), payload->get_type(payload));
+				break;
+			}
+		}
+	}
+	payloads->destroy(payloads);
+	
+	/* check if we have all payloads */
+	if (!(sa_request && ke_request && nonce_request))
+	{
+		this->logger->log(this->logger, AUDIT, "IKE_SA_INIT request did not contain all required payloads. Deleting IKE_SA");
+		return DELETE_ME;
+	}
+	
+	this->ike_sa->build_message(this->ike_sa, IKE_SA_INIT, FALSE, &response);
+	
+	status = this->build_sa_payload(this, sa_request, response);
+	if (status != SUCCESS)
+	{
+		response->destroy(response);
+		return status;
+	}
+	
+	status = this->build_ke_payload(this, ke_request, response);
+	if (status != SUCCESS)
+	{
+		response->destroy(response);
+		return status;
+	}
+	
+	status = this->build_nonce_payload(this, nonce_request, response);
+	if (status != SUCCESS)
+	{
+		response->destroy(response);
+		return status;
+	}	
+	
+	/* derive all the keys used in the IKE_SA */
+	status = this->ike_sa->build_transforms(this->ike_sa, this->proposal, this->diffie_hellman, this->received_nonce, this->sent_nonce);
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, AUDIT, "Transform objects could not be created from selected proposal. Deleting IKE_SA");
+		return DELETE_ME;
+	}
+	
+	/* message can now be sent (must not be destroyed) */
+	status = this->ike_sa->send_response(this->ike_sa, response);
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, AUDIT, "Unable to send IKE_SA_INIT response. Deleting IKE_SA");
+		response->destroy(response);
+		return DELETE_ME;
+	}
+
+	/* state can now be changed */
+	this->logger->log(this->logger, CONTROL|LEVEL2, "Create next state object of type IKE_SA_INIT_RESPONDED");
+
+	response = this->ike_sa->get_last_responded_message(this->ike_sa);
+	ike_sa_init_response_data = response->get_packet_data(response);
+	ike_sa_init_request_data = message->get_packet_data(message);
+
+	next_state = ike_sa_init_responded_create(this->ike_sa, this->received_nonce, this->sent_nonce,ike_sa_init_request_data,
+												ike_sa_init_response_data);
+	
+	/* state can now be changed */
+	this->ike_sa->set_new_state(this->ike_sa, (state_t *) next_state);
+	this->destroy_after_state_change(this);	
+	
+	return SUCCESS;
+}
+
+/**
+ * Implementation of private_initiator_init_t.build_sa_payload.
+ */
+static status_t build_sa_payload(private_responder_init_t *this,sa_payload_t *sa_request, message_t *response)
+{
+	proposal_t *proposal;
+	linked_list_t *proposal_list;
+	connection_t *connection;
+	sa_payload_t* sa_payload;
+	algorithm_t *algo;
+
+	connection = this->ike_sa->get_connection(this->ike_sa);
+
+	this->logger->log(this->logger, CONTROL | LEVEL2, "Process received SA payload");
+	
+	/* get the list of suggested proposals */ 
+	proposal_list = sa_request->get_proposals (sa_request);
+
+	/* select proposal */
+	this->proposal = connection->select_proposal(connection, proposal_list);
+	while(proposal_list->remove_last(proposal_list, (void**)&proposal) == SUCCESS)
+	{
+		proposal->destroy(proposal);
+	}
+	proposal_list->destroy(proposal_list);
+	if (this->proposal == NULL)
+	{
+		this->logger->log(this->logger, AUDIT, "IKE_SA_INIT request did not contain any acceptable proposals. Deleting IKE_SA");
+		this->ike_sa->send_notify(this->ike_sa, IKE_SA_INIT, NO_PROPOSAL_CHOSEN, CHUNK_INITIALIZER);
+		return DELETE_ME;
+	}
+	/* get selected DH group to force policy, this is very restrictive!? */
+	this->proposal->get_algorithm(this->proposal, PROTO_IKE, DIFFIE_HELLMAN_GROUP, &algo);
+	this->dh_group_number = algo->algorithm;
+	
+	this->logger->log(this->logger, CONTROL | LEVEL2, "SA Payload processed");
+	
+	this->logger->log(this->logger, CONTROL|LEVEL2, "Building SA payload");
+	sa_payload = sa_payload_create_from_proposal(this->proposal);	
+	this->logger->log(this->logger, CONTROL|LEVEL2, "add SA payload to message");
+	response->add_payload(response,(payload_t *) sa_payload);
+	
+	return SUCCESS;
+}
+
+/**
+ * Implementation of private_initiator_init_t.build_ke_payload.
+ */
+static status_t build_ke_payload(private_responder_init_t *this,ke_payload_t *ke_request, message_t *response)
+{
+	diffie_hellman_group_t group;
+	ke_payload_t *ke_payload;
+	diffie_hellman_t *dh;
+	chunk_t key_data;
+				
+	this->logger->log(this->logger, CONTROL | LEVEL2, "Process received KE payload");
+	group = ke_request->get_dh_group_number(ke_request);
+				
+	if (group == MODP_UNDEFINED)
+	{
+		this->logger->log(this->logger, AUDIT, "No diffie hellman group to select. Deleting IKE_SA");
+		return DELETE_ME;
+	}
+	
+	if (this->dh_group_number != group)
+	{
+		u_int16_t accepted_group;
+		chunk_t accepted_group_chunk;
+		/* group not same as selected one 
+		 * Maybe key exchange payload is before SA payload */
+		this->logger->log(this->logger, AUDIT, "IKE_SA_INIT request did not contain a acceptable diffie hellman group. Deleting IKE_SA");
+		
+		accepted_group = htons(this->dh_group_number);
+		accepted_group_chunk.ptr = (u_int8_t*) &(accepted_group);
+		accepted_group_chunk.len = 2;
+		this->ike_sa->send_notify(this->ike_sa,IKE_SA_INIT,INVALID_KE_PAYLOAD,accepted_group_chunk);
+		return DELETE_ME;
+	}
+			
+	/* create diffie hellman object to handle DH exchange */
+	dh = diffie_hellman_create(group);
+	if (dh == NULL)
+	{
+		this->logger->log(this->logger, AUDIT, "Could not generate DH object with group %d. Deleting IKE_SA",
+							mapping_find(diffie_hellman_group_m,group) );
+		return DELETE_ME;
+	}
+	this->logger->log(this->logger, CONTROL | LEVEL2, "Set other DH public value");
+	
+	dh->set_other_public_value(dh, ke_request->get_key_exchange_data(ke_request));
+
+	this->diffie_hellman = dh;
+	
+	this->logger->log(this->logger, CONTROL | LEVEL2, "KE Payload processed.");
+
+	this->logger->log(this->logger, CONTROL|LEVEL2, "Building KE payload");
+	this->diffie_hellman->get_my_public_value(this->diffie_hellman,&key_data);
+
+	ke_payload = ke_payload_create();
+	ke_payload->set_key_exchange_data(ke_payload,key_data);
+	ke_payload->set_dh_group_number(ke_payload, this->dh_group_number);
+	chunk_free(&key_data);
+
+	this->logger->log(this->logger, CONTROL|LEVEL2, "Add KE payload to message");
+	response->add_payload(response,(payload_t *) ke_payload);
+	
+	return SUCCESS;
+}
+
+/**
+ * Implementation of private_responder_init_t.build_nonce_payload.
+ */
+static status_t build_nonce_payload(private_responder_init_t *this,nonce_payload_t *nonce_request, message_t *response)
+{
+	nonce_payload_t *nonce_payload;
+	randomizer_t *randomizer;
+	status_t status;
+
+	this->logger->log(this->logger, CONTROL | LEVEL2, "Process received NONCE payload");
+	free(this->received_nonce.ptr);
+	this->received_nonce = CHUNK_INITIALIZER;
+
+	this->logger->log(this->logger, CONTROL | LEVEL2, "Get NONCE value and store it");
+	this->received_nonce = nonce_request->get_nonce(nonce_request);
+	
+	this->logger->log(this->logger, CONTROL | LEVEL2, "Create new NONCE value.");	
+	
+	randomizer = this->ike_sa->get_randomizer(this->ike_sa);
+	status = randomizer->allocate_pseudo_random_bytes(randomizer, NONCE_SIZE, &(this->sent_nonce));
+	if (status != SUCCESS)
+	{
+		return status;
+	}
+	
+	this->logger->log(this->logger, CONTROL|LEVEL2, "Building NONCE payload");
+	nonce_payload = nonce_payload_create();
+	nonce_payload->set_nonce(nonce_payload, this->sent_nonce);
+	
+	this->logger->log(this->logger, CONTROL|LEVEL2, "Add NONCE payload to message");
+	response->add_payload(response,(payload_t *) nonce_payload);
+	
+	return SUCCESS;
+}
+
+/**
+ * Implementation of private_responder_init_t.process_notify_payload.
+ */
+static status_t process_notify_payload(private_responder_init_t *this, notify_payload_t *notify_payload)
+{
+	notify_message_type_t notify_message_type = notify_payload->get_notify_message_type(notify_payload);
+	
+	this->logger->log(this->logger, CONTROL|LEVEL1, "Process notify type %s",
+						  mapping_find(notify_message_type_m, notify_message_type));
+								  
+	if (notify_payload->get_protocol_id(notify_payload) != PROTO_IKE)
+	{
+		this->logger->log(this->logger, ERROR | LEVEL1, "Notify reply not for IKE protocol.");
+		return FAILED;	
+	}
+	switch (notify_message_type)
+	{
+		default:
+		{
+				this->logger->log(this->logger, CONTROL, "IKE_SA_INIT request contained a notify (%d), ignored.", 
+									notify_message_type);
+			return SUCCESS;
+		}
+	}	
+}
+
+/**
+ * Implementation of  state_t.get_state.
+ */
+static ike_sa_state_t get_state(private_responder_init_t *this)
+{
+	return RESPONDER_INIT;
+}
+
+/**
+ * Implementation of state_t.destroy.
+ */
+static void destroy(private_responder_init_t *this)
+{
+	this->logger->log(this->logger, CONTROL | LEVEL1, "Going to destroy responder init state object");
+	
+	this->logger->log(this->logger, CONTROL | LEVEL2, "Destroy sent nonce");
+	chunk_free(&(this->sent_nonce));
+	this->logger->log(this->logger, CONTROL | LEVEL2, "Destroy received nonce");
+	chunk_free(&(this->received_nonce));
+
+	if (this->diffie_hellman != NULL)
+	{
+		this->logger->log(this->logger, CONTROL | LEVEL2, "Destroy diffie_hellman_t hellman object");
+		this->diffie_hellman->destroy(this->diffie_hellman);
+	}
+	if (this->proposal)
+	{
+		this->proposal->destroy(this->proposal);
+	}
+	this->logger->log(this->logger, CONTROL | LEVEL2, "Destroy object");
+	free(this);
+}
+
+/**
+ * Implementation of private_responder_init_t.destroy_after_state_change
+ */
+static void destroy_after_state_change (private_responder_init_t *this)
+{
+	this->logger->log(this->logger, CONTROL | LEVEL1, "Going to destroy responder_init_t state object");
+	
+	/* destroy diffie hellman object */
+	if (this->diffie_hellman != NULL)
+	{
+		this->logger->log(this->logger, CONTROL | LEVEL2, "Destroy diffie_hellman_t object");
+		this->diffie_hellman->destroy(this->diffie_hellman);
+	}
+	if (this->proposal)
+	{
+		this->proposal->destroy(this->proposal);
+	}
+	
+	this->logger->log(this->logger, CONTROL | LEVEL2, "Destroy object");	
+	free(this);
+}
+
+/* 
+ * Described in header.
+ */
+responder_init_t *responder_init_create(protected_ike_sa_t *ike_sa)
+{
+	private_responder_init_t *this = malloc_thing(private_responder_init_t);
+
+	/* interface functions */
+	this->public.state_interface.process_message = (status_t (*) (state_t *,message_t *)) process_message;
+	this->public.state_interface.get_state = (ike_sa_state_t (*) (state_t *)) get_state;
+	this->public.state_interface.destroy  = (void (*) (state_t *)) destroy;
+	
+	/* private functions */
+	this->build_sa_payload = build_sa_payload;
+	this->build_ke_payload = build_ke_payload;
+	this->build_nonce_payload = build_nonce_payload;
+	this->destroy_after_state_change = destroy_after_state_change;
+	this->process_notify_payload = process_notify_payload;
+	
+	/* private data */
+	this->ike_sa = ike_sa;
+	this->logger = logger_manager->get_logger(logger_manager, IKE_SA);
+	this->sent_nonce = CHUNK_INITIALIZER;
+	this->received_nonce = CHUNK_INITIALIZER;
+	this->dh_group_number = MODP_UNDEFINED;
+	this->diffie_hellman = NULL;
+	this->proposal = NULL;
+
+	return &(this->public);
+}

src/charon/sa/states/responder_init.h

@@ -0,0 +1,68 @@
+/**
+ * @file responder_init.h
+ * 
+ * @brief Interface of responder_init_t.
+ * 
+ */
+
+/*
+ * Copyright (C) 2005 Jan Hutter, Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#ifndef RESPONDER_INIT_H_
+#define RESPONDER_INIT_H_
+
+#include <sa/ike_sa.h>
+#include <sa/states/state.h>
+
+
+typedef struct responder_init_t responder_init_t;
+
+/**
+ * @brief This class represents an IKE_SA state when 
+ * initializing a connection as responder.
+ * 
+ * @b Constructors:
+ *  - responder_init_create()
+ * 
+ * @ingroup states
+ */
+struct responder_init_t {
+	/**
+	 * The state_t interface.
+	 */
+	state_t state_interface;
+};
+
+/**
+ * Constructor of class responder_init_t.
+ * 
+ * The following functions of the assigned protected_ike_sa_t object are being called with 
+ * valid values after successfully processing a received message and before changing
+ * to next state IKE_SA_INIT_RESPONDED:
+ *  - protected_ike_sa_t.set_connection()
+ *  - protected_ike_sa_t.set_my_host()
+ *  - protected_ike_sa_t.set_other_host()
+ *  - protected_ike_sa_t.compute_secrets()
+ *  - protected_ike_sa_t.create_transforms_from_proposal()
+ * 
+ * @param ike_sa 	assigned IKE_SA
+ * 
+ * @return 			responder_init_t object
+ * 
+ * @ingroup states
+ */
+responder_init_t *responder_init_create(protected_ike_sa_t *ike_sa);
+
+#endif /*RESPONDER_INIT_H_*/

src/charon/sa/states/state.c

@@ -0,0 +1,37 @@
+/**
+ * @file state.c
+ * 
+ * @brief Interface state_t.
+ * 
+ */
+
+/*
+ * Copyright (C) 2005 Jan Hutter, Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+ 
+#include "state.h"
+
+
+/**
+ * String mappings for ike_sa_state_t.
+ */
+mapping_t ike_sa_state_m[] = {
+	{INITIATOR_INIT, "INITIATOR_INIT"},
+	{RESPONDER_INIT, "RESPONDER_INIT"},
+	{IKE_SA_INIT_REQUESTED, "IKE_SA_INIT_REQUESTED"},
+	{IKE_SA_INIT_RESPONDED, "IKE_SA_INIT_RESPONDED"},
+	{IKE_AUTH_REQUESTED, "IKE_AUTH_REQUESTED"},
+	{IKE_SA_ESTABLISHED, "IKE_SA_ESTABLISHED"},
+	{MAPPING_END, NULL}
+};

src/charon/sa/states/state.h

@@ -0,0 +1,166 @@
+/**
+ * @file state.h
+ * 
+ * @brief Interface state_t.
+ * 
+ */
+
+/*
+ * Copyright (C) 2005 Jan Hutter, Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#ifndef STATE_H_
+#define STATE_H_
+
+#include <definitions.h>
+#include <types.h>
+#include <encoding/message.h>
+
+typedef enum ike_sa_state_t ike_sa_state_t;
+
+/**
+ * States in which a IKE_SA can be.
+ * 
+ * @todo Support of more states (CHILD_SA_REQUESTED, etc...)
+ * 
+ * @ingroup states
+ */
+enum ike_sa_state_t {
+
+	/**
+	 * @brief IKE_SA is in initial state as initiator and is going to initiate a new connection.
+	 * 
+	 * Next state following this state is IKE_SA_INIT_REQUESTED.
+	 * 
+	 * Implemented in class initiator_init_t.
+	 */
+	INITIATOR_INIT = 1,
+
+	/**
+	 * @brief IKE_SA is in initial state as responder and is going to respond to a initiated connection.
+	 * 
+	 * Next state following this state is IKE_SA_INIT_RESPONDED.
+	 * 
+	 * Implemented in class responder_init_t.
+	 */
+	RESPONDER_INIT = 2,
+
+	/**
+	 * @brief A IKE_SA_INIT request was sent. In this state a reply of type IKE_SA_INIT is expected.
+	 * 
+	 * Two states are possible as next states:
+	 *  - IKE_AUTH_REQUESTED if IKE_SA_INIT reply could successfully processed and IKE_AUTH request could be sent.
+	 *  - INITIATOR_INIT if selected DH group was not the one selected by other peer.
+	 * 
+	 * Implemented in class ike_sa_init_requested_t.
+	 */
+	IKE_SA_INIT_REQUESTED = 3,
+
+	/**
+	 * @brief A IKE_SA_INIT response was sent. In this state a request of type IKE_AUTH is expected.
+	 * 
+ 	 * Next state following this state is IKE_SA_ESTABLISHED.
+ 	 * 
+ 	 * Implemented in class ike_sa_init_responded_t.
+	 */
+	IKE_SA_INIT_RESPONDED = 4,
+
+	/**
+	 * @brief An IKE_AUTH request was sent after a successful IKE_SA_INIT-exchange.
+	 * 
+ 	 * Next state following this state is IKE_SA_ESTABLISHED.
+ 	 * 
+ 	 * Implemented in class ike_auth_requested_t.
+	 */
+	IKE_AUTH_REQUESTED = 5,
+
+	/**
+	 * @brief An IKE_AUTH exchange was successfuly handled either as initiator or responder.
+	 * 
+	 * In this state, all the informations for an IKE_SA and one CHILD_SA are known.
+	 * 
+ 	 * Implemented in class ike_sa_established_t.
+	 */
+	IKE_SA_ESTABLISHED = 6
+};
+
+
+/**
+ * String mappings for ike_sa_state_t.
+ */
+extern mapping_t ike_sa_state_m[];
+
+
+typedef struct state_t state_t;
+
+/**
+ * @brief This interface represents an IKE_SA state.
+ * 
+ * A state_t object is responsible to handle incoming messages.
+ * 
+ * It's the responsibility of the state_t object to parse the body of the message and to process each 
+ * payload.
+ * 
+ * Needed Configurations and transform objects can be retrieved over an internal stored protected_ike_sa_t object 
+ * which is passed to a state_t object when creating it (see different constructors).
+ * 
+ * The following states are supported and implemented:
+ * - INITIATOR_INIT: implemented in initiator_init_t
+ * - RESPONDER_INIT: implemented in responder_init_t
+ * - IKE_SA_INIT_REQUESTED: implemented in ike_sa_init_requested_t
+ * - IKE_SA_INIT_RESPONDED: implemented in ike_sa_init_responded_t
+ * - IKE_AUTH_REQUESTED: implemented in ike_auth_requested_t
+ * - IKE_SA_ESTABLISHED: implemented in ike_sa_established_t
+ * 
+ * @b Constructors:
+ *  - initiator_init_create()
+ *  - responder_init_create()
+ *  - ike_sa_init_requested_create()
+ *  - ike_sa_init_responded_create()
+ *  - ike_auth_requested_create()
+ *  - ike_sa_established_create()
+ * 
+ * @ingroup states
+ */
+struct state_t {
+
+	/**
+	 * @brief Processes a incoming IKEv2-Message of type message_t.
+	 *
+	 * @param this 			calling object
+ 	 * @param[in] 			message message_t object to process
+	 * @return 				
+	 * 						- SUCCESSFUL
+	 * 						- FAILED
+	 * 						- DELETE_ME if belonging IKE_SA should be deleted
+	 */
+	status_t (*process_message) (state_t *this,message_t *message);
+
+	/**
+	 * @brief Get the current state representing by this state_t object.
+	 *
+	 * @param this 	calling object
+	 * @return 		state 
+	 */
+	ike_sa_state_t (*get_state) (state_t *this);
+
+	/**
+	 * @brief Destroys a state_t object.
+	 *
+	 * @param this 	calling object
+	 */
+	void (*destroy) (state_t *this);
+};
+
+#endif /*STATE_H_*/