added CHILD_SA states, which allows us to detect further simultaneous transactions

reimplemented the buggy message id handling

src/charon/sa/transactions/create_child_sa.c

@@ -94,6 +94,11 @@ struct private_create_child_sa_t {
 	 */
 	chunk_t nonce_r;
 	
+	/**
+	 * lower of the nonces of a simultaneus rekeying request
+	 */
+	chunk_t nonce_s;
+	
 	/**
 	 * Negotiated traffic selectors for initiator
 	 */
@@ -172,12 +177,22 @@ static status_t get_request(private_create_child_sa_t *this, message_t **result)
 	host_t *me, *other;
 	
 	/* check if we are not already rekeying */
-	if (this->rekeyed_sa &&
-		this->rekeyed_sa->get_rekeying_transaction(this->rekeyed_sa))
+	if (this->rekeyed_sa)
 	{
-		this->logger->log(this->logger, ERROR,
-						  "rekeying a CHILD_SA which is already rekeying, aborted");
-		return FAILED;
+		switch (this->rekeyed_sa->get_state(this->rekeyed_sa))
+		{
+			case CHILD_REKEYING:
+				this->logger->log(this->logger, ERROR,
+								  "rekeying a CHILD_SA which is already rekeying, aborted");
+				return FAILED;
+			case CHILD_DELETING:
+				this->logger->log(this->logger, ERROR,
+								  "rekeying a CHILD_SA which is deleting, aborted");
+				return FAILED;
+			default:
+				break;
+		}
+		this->rekeyed_sa->set_state(this->rekeyed_sa, CHILD_REKEYING);
 	}
 	
 	/* check if we already have built a message (retransmission) */
@@ -198,7 +213,6 @@ static status_t get_request(private_create_child_sa_t *this, message_t **result)
 	request->set_destination(request, other->clone(other));
 	request->set_exchange_type(request, CREATE_CHILD_SA);
 	request->set_request(request, TRUE);
-	request->set_message_id(request, this->message_id);
 	request->set_ike_sa_id(request, this->ike_sa->get_id(this->ike_sa));
 	*result = request;
 	this->message = request;
@@ -275,6 +289,9 @@ static status_t get_request(private_create_child_sa_t *this, message_t **result)
 		this->rekeyed_sa->set_rekeying_transaction(this->rekeyed_sa, &this->public);
 	}
 	
+	this->message_id = this->ike_sa->get_next_message_id(this->ike_sa);
+	request->set_message_id(request, this->message_id);
+	
 	return SUCCESS;
 }
 
@@ -463,6 +480,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
 	me = this->connection->get_my_host(this->connection);
 	other = this->connection->get_other_host(this->connection);
 	this->policy = this->ike_sa->get_policy(this->ike_sa);
+	this->message_id = request->get_message_id(request);
 	
 	/* set up response */
 	response = message_create();
@@ -626,12 +644,29 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
 		ts_response = ts_payload_create_from_traffic_selectors(FALSE, this->tsr);
 		response->add_payload(response, (payload_t*)ts_response);
 	}
-	/* CHILD_SA successfully created. We set us as the rekeying transaction of
-	 * the rekeyed SA. If we already initiated rekeying of the same SA, we will detect
-	 * this later in the conclude() call. */
+	/* CHILD_SA successfully created. If another transaction is already rekeying
+	 * this SA, our lower nonce must be registered for a later nonce compare. */
 	if (this->rekeyed_sa)
 	{
-		this->rekeyed_sa->set_rekeying_transaction(this->rekeyed_sa, &this->public);
+		private_create_child_sa_t *other;
+		
+		other = this->rekeyed_sa->get_rekeying_transaction(this->rekeyed_sa);
+		if (other)
+		{
+			/* store our lower nonce in the simultaneus transaction, it 
+			 * will later compare it against his nonces when it calls conclude().
+			 */
+			if (memcmp(this->nonce_i.ptr, this->nonce_r.ptr,
+				min(this->nonce_i.len, this->nonce_r.len)) < 0)
+			{
+				other->nonce_s = chunk_clone(this->nonce_i);
+			}
+			else
+			{
+				other->nonce_s = chunk_clone(this->nonce_r);
+			}
+		}
+		this->rekeyed_sa->set_state(this->rekeyed_sa, CHILD_REKEYING);
 	}
 	return SUCCESS;
 }
@@ -763,20 +798,15 @@ static status_t conclude(private_create_child_sa_t *this, message_t *response,
 	 * If no simultaneous rekeying is going on, we just initiate the delete of
 	 * the superseded SA. */
 	if (this->rekeyed_sa)
-	{
-		private_create_child_sa_t *other;
-		
-		other = (private_create_child_sa_t*)
-					this->rekeyed_sa->get_rekeying_transaction(this->rekeyed_sa);
-		
+	{	
 		/* rekeying finished, update SA status */
 		this->rekeyed_sa->set_rekeying_transaction(this->rekeyed_sa, NULL);
 		
-		if (other != this)
+		if (this->nonce_s.ptr)
 		{	/* simlutaneous rekeying is going on, not so good */
-			chunk_t this_lowest, other_lowest;
+			chunk_t this_lowest;
 			
-			/* check if this has a lower nonce than other */
+			/* first get our lowest nonce */
 			if (memcmp(this->nonce_i.ptr, this->nonce_r.ptr, 
 				min(this->nonce_i.len, this->nonce_r.len)) < 0)
 			{
@@ -786,33 +816,24 @@ static status_t conclude(private_create_child_sa_t *this, message_t *response,
 			{
 				this_lowest = this->nonce_r;
 			}
-			if (memcmp(other->nonce_i.ptr, other->nonce_r.ptr, 
-				min(other->nonce_i.len, other->nonce_r.len)) < 0)
+			/* then compare against other lowest nonce */
+			if (memcmp(this_lowest.ptr, this->nonce_s.ptr, 
+				min(this_lowest.len, this->nonce_s.len)) < 0)
 			{
-				other_lowest = other->nonce_i;
-			}
-			else
-			{
-				other_lowest = other->nonce_r;
-			}
-			if (memcmp(this_lowest.ptr, other_lowest.ptr, 
-				min(this_lowest.len, other_lowest.len)) < 0)
-			{
-				this->logger->log(this->logger, ERROR,
-								  "detected simultaneous CHILD_SA rekeying, but ours is preferred");
-			}
-			else
-			{
-				
 				this->logger->log(this->logger, ERROR,
 								  "detected simultaneous CHILD_SA rekeying, deleting ours");
 				this->lost = TRUE;
 			}
+			else
+			{
+				this->logger->log(this->logger, ERROR,
+								  "detected simultaneous CHILD_SA rekeying, but ours is preferred");
+			}
 		}	
 		/* delete the old SA if we have won the rekeying nonce compare*/
 		if (!this->lost)
 		{
-			delete_child_sa = delete_child_sa_create(this->ike_sa, this->message_id + 1);
+			delete_child_sa = delete_child_sa_create(this->ike_sa);
 			delete_child_sa->set_child_sa(delete_child_sa, this->rekeyed_sa);
 			*next = (transaction_t*)delete_child_sa;
 		}
@@ -820,7 +841,7 @@ static status_t conclude(private_create_child_sa_t *this, message_t *response,
 	if (this->lost)
 	{
 		/* we have lost simlutaneous rekeying, delete the CHILD_SA we just have created */
-		delete_child_sa = delete_child_sa_create(this->ike_sa, this->message_id + 1);
+		delete_child_sa = delete_child_sa_create(this->ike_sa);
 		delete_child_sa->set_child_sa(delete_child_sa, new_child);
 		*next = (transaction_t*)delete_child_sa;
 	}
@@ -848,6 +869,7 @@ static void destroy(private_create_child_sa_t *this)
 	destroy_ts_list(this->tsr);
 	chunk_free(&this->nonce_i);
 	chunk_free(&this->nonce_r);
+	chunk_free(&this->nonce_s);
 	this->randomizer->destroy(this->randomizer);
 	free(this);
 }
@@ -855,7 +877,7 @@ static void destroy(private_create_child_sa_t *this)
 /*
  * Described in header.
  */
-create_child_sa_t *create_child_sa_create(ike_sa_t *ike_sa, u_int32_t message_id)
+create_child_sa_t *create_child_sa_create(ike_sa_t *ike_sa)
 {
 	private_create_child_sa_t *this = malloc_thing(private_create_child_sa_t);
 	
@@ -873,12 +895,13 @@ create_child_sa_t *create_child_sa_create(ike_sa_t *ike_sa, u_int32_t message_id
 	
 	/* private data */
 	this->ike_sa = ike_sa;
-	this->message_id = message_id;
+	this->message_id = 0;
 	this->message = NULL;
 	this->requested = 0;
 	this->rekey_spi = 0;
 	this->nonce_i = CHUNK_INITIALIZER;
 	this->nonce_r = CHUNK_INITIALIZER;
+	this->nonce_s = CHUNK_INITIALIZER;
 	this->child_sa = NULL;
 	this->rekeyed_sa = NULL;
 	this->lost = FALSE;

src/charon/sa/transactions/create_child_sa.h

@@ -95,11 +95,10 @@ struct create_child_sa_t {
  * @brief Create a new transaction which creates/rekeys CHILD_SAs.
  *
  * @param ike_sa		assigned IKE_SA
- * @param message_id	message ids used in this transaction
  * @return				created create_child_sa transaction
  *
  * @ingroup transactions
  */
-create_child_sa_t *create_child_sa_create(ike_sa_t *ike_sa, u_int32_t message_id);
+create_child_sa_t *create_child_sa_create(ike_sa_t *ike_sa);
 
 #endif /* CREATE_CHILD_SA_H_ */

src/charon/sa/transactions/dead_peer_detection.c

@@ -105,6 +105,7 @@ static status_t get_request(private_dead_peer_detection_t *this, message_t **res
 	request->set_destination(request, other->clone(other));
 	request->set_exchange_type(request, INFORMATIONAL);
 	request->set_request(request, TRUE);
+	this->message_id = this->ike_sa->get_next_message_id(this->ike_sa);
 	request->set_message_id(request, this->message_id);
 	request->set_ike_sa_id(request, this->ike_sa->get_id(this->ike_sa));
 	/* apply for caller */
@@ -135,6 +136,7 @@ static status_t get_response(private_dead_peer_detection_t *this, message_t *req
 	connection = this->ike_sa->get_connection(this->ike_sa);
 	me = connection->get_my_host(connection);
 	other = connection->get_other_host(connection);
+	this->message_id = request->get_message_id(request);
 	
 	/* set up response */
 	response = message_create();
@@ -175,7 +177,7 @@ static void destroy(private_dead_peer_detection_t *this)
 /*
  * Described in header.
  */
-dead_peer_detection_t *dead_peer_detection_create(ike_sa_t *ike_sa, u_int32_t message_id)
+dead_peer_detection_t *dead_peer_detection_create(ike_sa_t *ike_sa)
 {
 	private_dead_peer_detection_t *this = malloc_thing(private_dead_peer_detection_t);
 	
@@ -189,7 +191,7 @@ dead_peer_detection_t *dead_peer_detection_create(ike_sa_t *ike_sa, u_int32_t me
 	
 	/* private data */
 	this->ike_sa = ike_sa;
-	this->message_id = message_id;
+	this->message_id = 0;
 	this->message = NULL;
 	this->requested = 0;
 	this->logger = logger_manager->get_logger(logger_manager, IKE_SA);

src/charon/sa/transactions/dead_peer_detection.h

@@ -50,11 +50,10 @@ struct dead_peer_detection_t {
  * @brief Create a new transaction which detects dead peers.
  *
  * @param ike_sa		assigned IKE_SA
- * @param message_id	message ids used in this transaction
  * @return				created dead_peer_detection transaction
  *
  * @ingroup transactions
  */
-dead_peer_detection_t *dead_peer_detection_create(ike_sa_t *ike_sa, u_int32_t message_id);
+dead_peer_detection_t *dead_peer_detection_create(ike_sa_t *ike_sa);
 
 #endif /* DEAD_PEER_DETECTION_H_ */

src/charon/sa/transactions/delete_child_sa.c

@@ -120,6 +120,7 @@ static status_t get_request(private_delete_child_sa_t *this, message_t **result)
 	request->set_destination(request, other->clone(other));
 	request->set_exchange_type(request, INFORMATIONAL);
 	request->set_request(request, TRUE);
+	this->message_id = this->ike_sa->get_next_message_id(this->ike_sa);
 	request->set_message_id(request, this->message_id);
 	request->set_ike_sa_id(request, this->ike_sa->get_id(this->ike_sa));
 	*result = request;
@@ -141,6 +142,8 @@ static status_t get_request(private_delete_child_sa_t *this, message_t **result)
 		request->add_payload(request, (payload_t*)delete_payload);
 	}
 	
+	this->child_sa->set_state(this->child_sa, CHILD_DELETING);
+	
 	return SUCCESS;
 }
 
@@ -181,6 +184,8 @@ static status_t process_delete(private_delete_child_sa_t *this, delete_payload_t
 		{
 			create_child_sa_t *rekey;
 			
+			child_sa->set_state(child_sa, CHILD_DELETING);
+			
 			this->logger->log(this->logger, CONTROL,
 							  "received DELETE for %s CHILD_SA with SPI 0x%x, deleting",
 							  mapping_find(protocol_id_m, protocol), ntohl(spi));
@@ -192,11 +197,6 @@ static status_t process_delete(private_delete_child_sa_t *this, delete_payload_t
 				 * this means we have lost the nonce comparison, and the rekeying
 				 * will fail. We set a flag in the transaction for this special case.
 				 */
-				if (!response)
-				{	/* only whine as initiator */
-					this->logger->log(this->logger, CONTROL,
-									  "DELETE received while rekeying, rekeying cancelled");
-				}
 				rekey->cancel(rekey);
 			}
 			/* delete it, with inbound spi */
@@ -240,6 +240,7 @@ static status_t get_response(private_delete_child_sa_t *this, message_t *request
 	connection = this->ike_sa->get_connection(this->ike_sa);
 	me = connection->get_my_host(connection);
 	other = connection->get_other_host(connection);
+	this->message_id = request->get_message_id(request);
 	
 	/* set up response */
 	response = message_create();
@@ -344,7 +345,7 @@ static void destroy(private_delete_child_sa_t *this)
 /*
  * Described in header.
  */
-delete_child_sa_t *delete_child_sa_create(ike_sa_t *ike_sa, u_int32_t message_id)
+delete_child_sa_t *delete_child_sa_create(ike_sa_t *ike_sa)
 {
 	private_delete_child_sa_t *this = malloc_thing(private_delete_child_sa_t);
 	
@@ -361,7 +362,7 @@ delete_child_sa_t *delete_child_sa_create(ike_sa_t *ike_sa, u_int32_t message_id
 	
 	/* private data */
 	this->ike_sa = ike_sa;
-	this->message_id = message_id;
+	this->message_id = 0;
 	this->message = NULL;
 	this->requested = 0;
 	this->logger = logger_manager->get_logger(logger_manager, IKE_SA);

src/charon/sa/transactions/delete_child_sa.h

@@ -59,11 +59,10 @@ struct delete_child_sa_t {
  * @brief Create a new transaction which deletes a CHILD_SA.
  *
  * @param ike_sa		assigned IKE_SA
- * @param message_id	message ids used in this transaction
  * @return				created delete_child_sa transaction
  *
  * @ingroup transactions
  */
-delete_child_sa_t *delete_child_sa_create(ike_sa_t *ike_sa, u_int32_t message_id);
+delete_child_sa_t *delete_child_sa_create(ike_sa_t *ike_sa);
 
 #endif /* DELETE_CHILD_SA_H_ */

src/charon/sa/transactions/delete_ike_sa.c

@@ -107,6 +107,7 @@ static status_t get_request(private_delete_ike_sa_t *this, message_t **result)
 	request->set_destination(request, other->clone(other));
 	request->set_exchange_type(request, INFORMATIONAL);
 	request->set_request(request, TRUE);
+	this->message_id = this->ike_sa->get_next_message_id(this->ike_sa);
 	request->set_message_id(request, this->message_id);
 	request->set_ike_sa_id(request, this->ike_sa->get_id(this->ike_sa));
 	/* apply for caller */
@@ -118,7 +119,7 @@ static status_t get_request(private_delete_ike_sa_t *this, message_t **result)
 	request->add_payload(request, (payload_t*)delete_payload);
 	
 	/* transit to state SA_DELETING */
-	this->ike_sa->set_state(this->ike_sa, SA_DELETING);
+	this->ike_sa->set_state(this->ike_sa, IKE_DELETING);
 	
 	return SUCCESS;
 }
@@ -147,6 +148,7 @@ static status_t get_response(private_delete_ike_sa_t *this, message_t *request,
 	connection = this->ike_sa->get_connection(this->ike_sa);
 	me = connection->get_my_host(connection);
 	other = connection->get_other_host(connection);
+	this->message_id = request->get_message_id(request);
 	
 	/* set up response */
 	response = message_create();
@@ -204,13 +206,13 @@ static status_t get_response(private_delete_ike_sa_t *this, message_t *request,
 		this->logger->log(this->logger, CONTROL, 
 						  "received a weird DELETE request for IKE_SA, deleting anyway");
 	}
-	if (this->ike_sa->get_state(this->ike_sa) == SA_DELETING)
+	if (this->ike_sa->get_state(this->ike_sa) == IKE_DELETING)
 	{
 		/* if we are already deleting an IKE_SA, we do not destroy. We wait
 		 * until we get the response for our initiated delete. */
 		return SUCCESS;
 	}
-	this->ike_sa->set_state(this->ike_sa, SA_DELETING);
+	this->ike_sa->set_state(this->ike_sa, IKE_DELETING);
 	return DESTROY_ME;
 }
 
@@ -248,7 +250,7 @@ static void destroy(private_delete_ike_sa_t *this)
 /*
  * Described in header.
  */
-delete_ike_sa_t *delete_ike_sa_create(ike_sa_t *ike_sa, u_int32_t message_id)
+delete_ike_sa_t *delete_ike_sa_create(ike_sa_t *ike_sa)
 {
 	private_delete_ike_sa_t *this = malloc_thing(private_delete_ike_sa_t);
 	
@@ -262,7 +264,7 @@ delete_ike_sa_t *delete_ike_sa_create(ike_sa_t *ike_sa, u_int32_t message_id)
 	
 	/* private data */
 	this->ike_sa = ike_sa;
-	this->message_id = message_id;
+	this->message_id = 0;
 	this->message = NULL;
 	this->requested = 0;
 	this->logger = logger_manager->get_logger(logger_manager, IKE_SA);

src/charon/sa/transactions/delete_ike_sa.h

@@ -73,11 +73,10 @@ struct delete_ike_sa_t {
  * @brief Create a new transaction which deletes the IKE_SA.
  *
  * @param ike_sa		assigned IKE_SA
- * @param message_id	message ids used in this transaction
  * @return				created delete_ike_sa transaction
  *
  * @ingroup transactions
  */
-delete_ike_sa_t *delete_ike_sa_create(ike_sa_t *ike_sa, u_int32_t message_id);
+delete_ike_sa_t *delete_ike_sa_create(ike_sa_t *ike_sa);
 
 #endif /* DELETE_IKE_SA_H_ */

src/charon/sa/transactions/ike_auth.c

@@ -194,7 +194,6 @@ static status_t get_request(private_ike_auth_t *this, message_t **result)
 	request->set_destination(request, other->clone(other));
 	request->set_exchange_type(request, IKE_AUTH);
 	request->set_request(request, TRUE);
-	request->set_message_id(request, this->message_id);
 	request->set_ike_sa_id(request, this->ike_sa->get_id(this->ike_sa));
 	/* apply for caller */
 	*result = request;
@@ -295,6 +294,8 @@ static status_t get_request(private_ike_auth_t *this, message_t **result)
 		request->add_payload(request, (payload_t*)ts_payload);
 	}
 	
+	this->message_id = this->ike_sa->get_next_message_id(this->ike_sa);
+	request->set_message_id(request, this->message_id);
 	return SUCCESS;
 }
 
@@ -510,6 +511,7 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
 	this->connection = this->ike_sa->get_connection(this->ike_sa);
 	me = this->connection->get_my_host(this->connection);
 	other = this->connection->get_other_host(this->connection);
+	this->message_id = request->get_message_id(request);
 	
 	/* set up response */
 	response = message_create();
@@ -761,7 +763,7 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
 		response->add_payload(response, (payload_t*)ts_response);
 	}
 	/* set established state */
-	this->ike_sa->set_state(this->ike_sa, SA_ESTABLISHED);
+	this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
 	return SUCCESS;
 }
 
@@ -941,7 +943,7 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
 		}
 	}
 	/* set new state */
-	this->ike_sa->set_state(this->ike_sa, SA_ESTABLISHED);
+	this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
 	return SUCCESS;
 }
 
@@ -974,7 +976,7 @@ static void destroy(private_ike_auth_t *this)
 /*
  * Described in header.
  */
-ike_auth_t *ike_auth_create(ike_sa_t *ike_sa, u_int32_t message_id)
+ike_auth_t *ike_auth_create(ike_sa_t *ike_sa)
 {
 	private_ike_auth_t *this = malloc_thing(private_ike_auth_t);
 
@@ -992,7 +994,7 @@ ike_auth_t *ike_auth_create(ike_sa_t *ike_sa, u_int32_t message_id)
 	
 	/* private data */
 	this->ike_sa = ike_sa;
-	this->message_id = message_id;
+	this->message_id = 0;
 	this->message = NULL;
 	this->requested = 0;
 	this->nonce_i = CHUNK_INITIALIZER;

src/charon/sa/transactions/ike_auth.h

@@ -76,11 +76,10 @@ struct ike_auth_t {
  * @brief Create a new transaction which processes IKE_AUTH exchanges.
  *
  * @param ike_sa		assigned IKE_SA
- * @param message_id	message ids used in this transaction
  * @return				created ike_auth transaction
  *
  * @ingroup transactions
  */
-ike_auth_t *ike_auth_create(ike_sa_t *ike_sa, u_int32_t message_id);
+ike_auth_t *ike_auth_create(ike_sa_t *ike_sa);
 
 #endif /* IKE_AUTH_H_ */

src/charon/sa/transactions/ike_sa_init.c

@@ -348,8 +348,7 @@ static status_t get_request(private_ike_sa_init_t *this, message_t **result)
 		request->add_payload(request, (payload_t*)notify);
 	}
 	
-	/* set new state */
-	this->ike_sa->set_state(this->ike_sa, SA_CONNECTING);
+	this->ike_sa->set_state(this->ike_sa, IKE_CONNECTING);
 	return SUCCESS;
 }
 
@@ -398,7 +397,7 @@ static status_t process_notifys(private_ike_sa_init_t *this, notify_payload_t *n
 								  "requested DH group not acceptable, aborting");
 				return DESTROY_ME;
 			}
-			retry = ike_sa_init_create(this->ike_sa, 0);
+			retry = ike_sa_init_create(this->ike_sa);
 			retry->use_dh_group(retry, dh_group);
 			*this->next = (transaction_t*)retry;
 			return FAILED;
@@ -489,6 +488,7 @@ static status_t get_response(private_ike_sa_init_t *this,
 	
 	me = request->get_destination(request);
 	other = request->get_source(request);
+	this->message_id = request->get_message_id(request);
 	
 	/* set up response */
 	response = message_create();
@@ -768,7 +768,7 @@ static status_t get_response(private_ike_sa_init_t *this,
 		response_chunk = response->get_packet_data(response);
 		
 		/* create next transaction, for which we except a message */
-		ike_auth = ike_auth_create(this->ike_sa, 1);
+		ike_auth = ike_auth_create(this->ike_sa);
 		ike_auth->set_nonces(ike_auth,
 							 chunk_clone(this->nonce_i),
 							 chunk_clone(this->nonce_r));
@@ -784,7 +784,7 @@ static status_t get_response(private_ike_sa_init_t *this,
 		charon->event_queue->add_relative(charon->event_queue, job, timeout);
 	}
 	/* set new state */
-	this->ike_sa->set_state(this->ike_sa, SA_CONNECTING);
+	this->ike_sa->set_state(this->ike_sa, IKE_CONNECTING);
 	return SUCCESS;
 }
 
@@ -999,7 +999,7 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
 		response_chunk = response->get_packet_data(response);
 		
 		/* create next transaction, for which we except a message */
-		ike_auth = ike_auth_create(this->ike_sa, this->message_id + 1);
+		ike_auth = ike_auth_create(this->ike_sa);
 		ike_auth->set_nonces(ike_auth,
 							 chunk_clone(this->nonce_i),
 							 chunk_clone(this->nonce_r));
@@ -1036,7 +1036,7 @@ static void destroy(private_ike_sa_init_t *this)
 /*
  * Described in header.
  */
-ike_sa_init_t *ike_sa_init_create(ike_sa_t *ike_sa, u_int32_t message_id)
+ike_sa_init_t *ike_sa_init_create(ike_sa_t *ike_sa)
 {
 	private_ike_sa_init_t *this = malloc_thing(private_ike_sa_init_t);
 
@@ -1053,7 +1053,7 @@ ike_sa_init_t *ike_sa_init_create(ike_sa_t *ike_sa, u_int32_t message_id)
 	
 	/* private data */
 	this->ike_sa = ike_sa;
-	this->message_id = message_id;
+	this->message_id = 0;
 	this->message = NULL;
 	this->requested = 0;
 	this->diffie_hellman = NULL;

src/charon/sa/transactions/ike_sa_init.h

@@ -63,11 +63,10 @@ struct ike_sa_init_t {
  * @brief Create a new transaction which processes IKE_SA_INIT exchanges.
  *
  * @param ike_sa		assigned IKE_SA
- * @param message_id	message ids used in this transaction
  * @return				created ike_sa_init transaction
  *
  * @ingroup transactions
  */
-ike_sa_init_t *ike_sa_init_create(ike_sa_t *ike_sa, u_int32_t message_id);
+ike_sa_init_t *ike_sa_init_create(ike_sa_t *ike_sa);
 
 #endif /* IKE_SA_INIT_H_ */

src/charon/sa/transactions/transaction.c

@@ -46,21 +46,19 @@ transaction_t *transaction_create(ike_sa_t *ike_sa, message_t *request)
 	payload_t *current;
 	notify_payload_t *notify;
 	transaction_t *transaction = NULL;
-	u_int32_t message_id;
 	
 	if (!request->get_request(request))
 	{
 		return NULL;
 	}
-	message_id = request->get_message_id(request);
 	
 	switch (request->get_exchange_type(request))
 	{
 		case IKE_SA_INIT:
 		{
-			if (ike_sa->get_state(ike_sa) == SA_CREATED)
+			if (ike_sa->get_state(ike_sa) == IKE_CREATED)
 			{
-				transaction = (transaction_t*)ike_sa_init_create(ike_sa, message_id);
+				transaction = (transaction_t*)ike_sa_init_create(ike_sa);
 			}
 			break;
 		}
@@ -72,7 +70,7 @@ transaction_t *transaction_create(ike_sa_t *ike_sa, message_t *request)
 		}
 		case CREATE_CHILD_SA:
 		{
-			if (ike_sa->get_state(ike_sa) != SA_ESTABLISHED)
+			if (ike_sa->get_state(ike_sa) != IKE_ESTABLISHED)
 			{
 				break;
 			}
@@ -93,14 +91,14 @@ transaction_t *transaction_create(ike_sa_t *ike_sa, message_t *request)
 				switch (notify->get_protocol_id(notify))
 				{
 					case PROTO_IKE:
-						/* TODO: transaction = rekey_ike_sa_create(ike_sa, message_id); */
+						/* TODO: transaction = rekey_ike_sa_create(ike_sa); */
 						break;
 					case PROTO_AH:
 					case PROTO_ESP:
 						/* we do not handle rekeying of CHILD_SAs in a special 
 						 * transaction, as the procedure is nearly equal 
 						 * to create a new CHILD_SA. */
-						transaction = (transaction_t*)create_child_sa_create(ike_sa, message_id);
+						transaction = (transaction_t*)create_child_sa_create(ike_sa);
 						break;
 					default:
 						break;
@@ -116,13 +114,13 @@ transaction_t *transaction_create(ike_sa_t *ike_sa, message_t *request)
 				/* we have not found a REKEY_SA notify for IKE. This means
 				 * we create a new CHILD_SA, or rekey an existing one.
 				 * Both cases are handled with the create_child_sa transaction. */
-				transaction = (transaction_t*)create_child_sa_create(ike_sa, message_id);
+				transaction = (transaction_t*)create_child_sa_create(ike_sa);
 			}
 			break;
 		}
 		case INFORMATIONAL:
 		{
-			if (ike_sa->get_state(ike_sa) == SA_CREATED)
+			if (ike_sa->get_state(ike_sa) == IKE_CREATED)
 			{
 				break;
 			}
@@ -142,12 +140,12 @@ transaction_t *transaction_create(ike_sa_t *ike_sa, message_t *request)
 						{
 							case PROTO_IKE:
 								transaction = (transaction_t*)
-										delete_ike_sa_create(ike_sa, message_id);
+										delete_ike_sa_create(ike_sa);
 								break;
 							case PROTO_AH:
 							case PROTO_ESP:
 								transaction = (transaction_t*)
-										delete_child_sa_create(ike_sa, message_id);
+										delete_child_sa_create(ike_sa);
 								break;
 							default:
 								break;
@@ -168,7 +166,7 @@ transaction_t *transaction_create(ike_sa_t *ike_sa, message_t *request)
 			if (payload_count == 0)
 			{
 				transaction = (transaction_t*)
-						dead_peer_detection_create(ike_sa, message_id);
+						dead_peer_detection_create(ike_sa);
 			}
 			break;
 		}