added support for "ike" and "esp" keywords

fixed bugs in proposal code
algorithm selection for charon works now with ipsec.conf
a lot of other fixes

src/charon/sa/ike_sa.c

@@ -368,8 +368,7 @@ static status_t build_transforms(private_ike_sa_t *this, proposal_t *proposal, d
 	{
 		this->prf->destroy(this->prf);
 	}
-	proposal->get_algorithm(proposal, PSEUDO_RANDOM_FUNCTION, &algo);
-	if (algo == NULL)
+	if (!proposal->get_algorithm(proposal, PSEUDO_RANDOM_FUNCTION, &algo))
 	{
 		this->logger->log(this->logger, ERROR|LEVEL2, "No PRF algoithm selected!?");
 		return FAILED;
@@ -434,8 +433,7 @@ static status_t build_transforms(private_ike_sa_t *this, proposal_t *proposal, d
 	
 	
 	/* SK_ai/SK_ar used for integrity protection */
-	proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM, &algo);
-	if (algo == NULL)
+	if (!proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM, &algo))
 	{
 		this->logger->log(this->logger, ERROR|LEVEL2, "No integrity algoithm selected?!");
 		return FAILED;
@@ -472,8 +470,7 @@ static status_t build_transforms(private_ike_sa_t *this, proposal_t *proposal, d
 	
 	
 	/* SK_ei/SK_er used for encryption */
-	proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &algo);
-	if (algo == NULL)
+	if (!proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &algo))
 	{
 		this->logger->log(this->logger, ERROR|LEVEL2, "No encryption algoithm selected!?");
 		return FAILED;
@@ -510,7 +507,6 @@ static status_t build_transforms(private_ike_sa_t *this, proposal_t *proposal, d
 	chunk_free(&key);
 	
 	/* SK_pi/SK_pr used for authentication */
-	proposal->get_algorithm(proposal, PSEUDO_RANDOM_FUNCTION, &algo);
 	if (this->prf_auth_i != NULL)
 	{
 		this->prf_auth_i->destroy(this->prf_auth_i);
@@ -520,6 +516,7 @@ static status_t build_transforms(private_ike_sa_t *this, proposal_t *proposal, d
 		this->prf_auth_r->destroy(this->prf_auth_r);
 	}
 	
+	proposal->get_algorithm(proposal, PSEUDO_RANDOM_FUNCTION, &algo);
 	this->prf_auth_i = prf_create(algo->algorithm);
 	this->prf_auth_r = prf_create(algo->algorithm);
 	
@@ -724,7 +721,7 @@ static void send_notify(private_ike_sa_t *this, exchange_type_t exchange_type, n
 	this->logger->log(this->logger, CONTROL|LEVEL2, "Going to build message with notify payload");
 	/* set up the reply */
 	build_message(this, exchange_type, FALSE, &response);
-	payload = notify_payload_create_from_protocol_and_type(PROTO_IKE, type);
+	payload = notify_payload_create_from_protocol_and_type(PROTO_NONE, type);
 	if ((data.ptr != NULL) && (data.len > 0))
 	{
 		this->logger->log(this->logger, CONTROL|LEVEL2, "Add Data to notify payload");

src/charon/sa/states/ike_sa_established.c

@@ -133,6 +133,8 @@ static status_t build_sa_payload(private_ike_sa_established_t *this, sa_payload_
 		prf_plus = prf_plus_create(this->ike_sa->get_child_prf(this->ike_sa), seed);
 		this->logger->log_chunk(this->logger, RAW|LEVEL2, "Rekey seed", seed);
 		chunk_free(&seed);
+		chunk_free(&this->nonce_i);
+		chunk_free(&this->nonce_r);
 		
 		policy = this->ike_sa->get_policy(this->ike_sa);
 		connection = this->ike_sa->get_connection(this->ike_sa);
@@ -226,20 +228,19 @@ static status_t build_nonce_payload(private_ike_sa_established_t *this, nonce_pa
 	randomizer_t *randomizer;
 	status_t status;
 	
-	this->nonce_i = nonce_request->get_nonce(nonce_request);
-	
 	randomizer = this->ike_sa->get_randomizer(this->ike_sa);
 	status = randomizer->allocate_pseudo_random_bytes(randomizer, NONCE_SIZE, &this->nonce_r);
 	if (status != SUCCESS)
 	{
 		return status;
 	}
-	
 	nonce_payload = nonce_payload_create();
 	nonce_payload->set_nonce(nonce_payload, this->nonce_r);
 	
 	response->add_payload(response,(payload_t *) nonce_payload);
 	
+	this->nonce_i = nonce_request->get_nonce(nonce_request);
+	
 	return SUCCESS;
 }
 
@@ -431,6 +432,7 @@ static status_t process_informational(private_ike_sa_established_t *this, messag
 			 * allow the clean destruction of an SA only in this state. */
 			this->ike_sa->set_new_state(this->ike_sa, (state_t*)delete_ike_sa_requested_create(this->ike_sa));
 			this->public.state_interface.destroy(&(this->public.state_interface));
+			this->ike_sa->send_response(this->ike_sa, response);
 			return DESTROY_ME;
 		}
 		else
@@ -523,9 +525,6 @@ static status_t process_message(private_ike_sa_established_t *this, message_t *m
 							  mapping_find(exchange_type_m, message->get_exchange_type(message)));
 			status = NOT_SUPPORTED;
 	}
-	/* clean up private members */
-	chunk_free(&this->nonce_i);
-	chunk_free(&this->nonce_r);
 	return status;
 }
 
@@ -542,6 +541,8 @@ static ike_sa_state_t get_state(private_ike_sa_established_t *this)
  */
 static void destroy(private_ike_sa_established_t *this)
 {
+	chunk_free(&this->nonce_i);
+	chunk_free(&this->nonce_r);
 	free(this);
 }
 

src/charon/sa/states/responder_init.c

@@ -344,8 +344,10 @@ static status_t build_sa_payload(private_responder_init_t *this,sa_payload_t *sa
 		return DESTROY_ME;
 	}
 	/* get selected DH group to force policy, this is very restrictive!? */
-	this->proposal->get_algorithm(this->proposal, DIFFIE_HELLMAN_GROUP, &algo);
-	this->dh_group_number = algo->algorithm;
+	if (this->proposal->get_algorithm(this->proposal, DIFFIE_HELLMAN_GROUP, &algo))
+	{
+		this->dh_group_number = algo->algorithm;
+	}
 	
 	this->logger->log(this->logger, CONTROL | LEVEL2, "SA Payload processed");