- state ike_sa_init_responded implemented (has some memleaks)

Source/charon/sa/states/ike_auth_requested.c

@@ -22,8 +22,15 @@
  
 #include "ike_auth_requested.h"
 
+#include <daemon.h>
 #include <utils/allocator.h>
-
+#include <encoding/payloads/ts_payload.h>
+#include <encoding/payloads/sa_payload.h>
+#include <encoding/payloads/id_payload.h>
+#include <encoding/payloads/auth_payload.h>
+#include <transforms/signers/signer.h>
+#include <transforms/crypters/crypter.h>
+#include <sa/states/ike_sa_established.h>
 
 typedef struct private_ike_auth_requested_t private_ike_auth_requested_t;
 
@@ -51,16 +58,280 @@ struct private_ike_auth_requested_t {
 	 * Assigned IKE_SA
 	 */
 	 protected_ike_sa_t *ike_sa;
+	 
+	/**
+	 * SA config, just a copy of the one stored in the ike_sa
+	 */
+	sa_config_t *sa_config; 
+	 
+	/**
+	 * Logger used to log data 
+	 * 
+	 * Is logger of ike_sa!
+	 */
+	logger_t *logger;
+	
+	status_t (*process_idr_payload) (private_ike_auth_requested_t *this, id_payload_t *idr_payload);
+	status_t (*process_sa_payload) (private_ike_auth_requested_t *this, sa_payload_t *sa_payload);
+	status_t (*process_auth_payload) (private_ike_auth_requested_t *this, auth_payload_t *auth_payload);
+	status_t (*process_ts_payload) (private_ike_auth_requested_t *this, bool ts_initiator, ts_payload_t *ts_payload);
+	 
 };
 
+
 /**
- * Implements state_t.get_state
+ * Implements state_t.process_message
  */
-static status_t process_message(private_ike_auth_requested_t *this, message_t *message)
+static status_t process_message(private_ike_auth_requested_t *this, message_t *request)
 {
+	status_t status;
+	signer_t *signer;
+	crypter_t *crypter;
+	iterator_t *payloads;
+	exchange_type_t exchange_type;
+	id_payload_t *idr_payload;
+	auth_payload_t *auth_payload;
+	sa_payload_t *sa_payload;
+	ts_payload_t *tsi_payload, *tsr_payload;
+	
+	return SUCCESS;
+
+	exchange_type = request->get_exchange_type(request);
+	if (exchange_type != IKE_AUTH)
+	{
+		this->logger->log(this->logger, ERROR | MORE, "Message of type %s not supported in state ike_auth_requested",
+							mapping_find(exchange_type_m,exchange_type));
+		return FAILED;
+	}
+	
+	if (request->get_request(request))
+	{
+		this->logger->log(this->logger, ERROR | MORE, "Only responses of type IKE_AUTH supported in state ike_auth_requested");
+		return FAILED;
+	}
+	
+	/* get signer for verification and crypter for decryption */
+	signer = this->ike_sa->get_signer_responder(this->ike_sa);
+	crypter = this->ike_sa->get_crypter_responder(this->ike_sa);
+	
+	/* parse incoming message */
+	status = request->parse_body(request, crypter, signer);
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, ERROR | MORE, "Could not parse body of request message");
+		return status;
+	}
+	
+	this->sa_config = this->ike_sa->get_sa_config(this->ike_sa);
+	
+	/* iterate over incoming payloads. Message is verified, we can be sure there are the required payloads */
+	payloads = request->get_payload_iterator(request);
+	while (payloads->has_next(payloads))
+	{
+		payload_t *payload;
+		payloads->current(payloads, (void**)&payload);
+		
+		switch (payload->get_type(payload))
+		{
+			case AUTHENTICATION:
+			{
+				auth_payload = (auth_payload_t*)payload;
+				break;	
+			}
+			case ID_RESPONDER:
+			{
+				idr_payload = (id_payload_t*)payload;
+				break;	
+			}
+			case SECURITY_ASSOCIATION:
+			{
+				sa_payload = (sa_payload_t*)payload;
+				break;
+			}
+			case CERTIFICATE:
+			{
+				/* TODO handle cert payloads */
+				break;
+			}
+			case TRAFFIC_SELECTOR_INITIATOR:
+			{
+				tsi_payload = (ts_payload_t*)payload;				
+				break;	
+			}
+			case TRAFFIC_SELECTOR_RESPONDER:
+			{
+				tsr_payload = (ts_payload_t*)payload;
+				break;	
+			}
+			default:
+			{
+				/* can't happen, since message is verified, notify's? */
+				break;
+			}
+		}
+	}
+	/* iterator can be destroyed */
+	payloads->destroy(payloads);
+	
+	
+	/* add payloads to it */
+	status = this->process_idr_payload(this, idr_payload);
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, ERROR, "Processing idr payload failed");
+		return status;
+	}
+	status = this->process_sa_payload(this, sa_payload);
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, ERROR, "Processing sa payload failed");
+		return status;
+	}
+	status = this->process_auth_payload(this, auth_payload);
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, ERROR, "Processing auth payload failed");
+		return status;
+	}
+	status = this->process_ts_payload(this, TRUE, tsi_payload);
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, ERROR, "Processing tsi payload failed");
+		return status;
+	}
+	status = this->process_ts_payload(this, FALSE, tsr_payload);
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, ERROR, "Processing tsr payload failed");
+		return status;
+	}
+
+	this->logger->log(this->logger, CONTROL | MORE, "IKE_AUTH response successfully handled. IKE_SA established.");
+	
+	/* create new state */
+	this->ike_sa->set_new_state(this->ike_sa, (state_t*)ike_sa_established_create(this->ike_sa));
+
 	return SUCCESS;
 }
 
+/**
+ * Implements private_ike_auth_requested_t.build_idr_payload
+ */
+static status_t process_idr_payload(private_ike_auth_requested_t *this, id_payload_t *idr_payload)
+{
+	identification_t *other_id, *configured_other_id;
+	
+	other_id = idr_payload->get_identification(idr_payload);
+
+	configured_other_id = this->sa_config->get_other_id(this->sa_config);
+	if (configured_other_id)
+	{
+		if (!other_id->equals(other_id, configured_other_id))
+		{
+			this->logger->log(this->logger, ERROR, "IKE_AUTH reply didn't contain requested id");
+			return FAILED;	
+		}
+	}
+	
+	/* TODO do we have to store other_id  somewhere ? */	
+	return SUCCESS;
+}
+
+/**
+ * Implements private_ike_auth_requested_t.build_sa_payload
+ */
+static status_t process_sa_payload(private_ike_auth_requested_t *this, sa_payload_t *sa_payload)
+{
+	child_proposal_t *proposals, *proposal_chosen;
+	size_t proposal_count;
+	status_t status;
+	
+	/* dummy spis, until we have a child sa to request them */
+	u_int8_t ah_spi[4] = {0x01, 0x02, 0x03, 0x04};
+	u_int8_t esp_spi[4] = {0x05, 0x06, 0x07, 0x08};
+	
+	/* check selected proposal */
+	status = sa_payload->get_child_proposals(sa_payload, &proposals, &proposal_count);
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, ERROR, "responders sa payload contained no proposals");
+		return FAILED;
+	}
+	if (proposal_count > 1)
+	{
+		allocator_free(proposals);
+		this->logger->log(this->logger, ERROR, "responders sa payload contained more than one proposal");
+		return FAILED;
+	}
+	
+	proposal_chosen = this->sa_config->select_proposal(this->sa_config, ah_spi, esp_spi, proposals, proposal_count);
+	if (proposal_chosen == NULL)
+	{
+		this->logger->log(this->logger, ERROR, "responder selected an not offered proposal");
+		allocator_free(proposals);
+		return FAILED;
+	}
+	else
+	{
+		allocator_free(proposal_chosen);
+	}
+	
+	allocator_free(proposals);
+	
+	return SUCCESS;
+}
+
+/**
+ * Implements private_ike_auth_requested_t.build_auth_payload
+ */
+static status_t process_auth_payload(private_ike_auth_requested_t *this, auth_payload_t *auth_payload)
+{
+	/* TODO VERIFY auth here */
+	return SUCCESS;	
+}
+
+/**
+ * Implements private_ike_auth_requested_t.build_ts_payload
+ */
+static status_t process_ts_payload(private_ike_auth_requested_t *this, bool ts_initiator, ts_payload_t *ts_payload)
+{
+	traffic_selector_t **ts_received, **ts_selected;
+	size_t ts_received_count, ts_selected_count;
+	status_t status = SUCCESS;
+	
+	/* get ts form payload */
+	ts_received_count = ts_payload->get_traffic_selectors(ts_payload, &ts_received);
+	/* select ts depending on payload type */
+	if (ts_initiator)
+	{
+		ts_selected_count = this->sa_config->select_traffic_selectors_initiator(this->sa_config, ts_received, ts_received_count, &ts_selected);
+	}
+	else
+	{
+		ts_selected_count = this->sa_config->select_traffic_selectors_responder(this->sa_config, ts_received, ts_received_count, &ts_selected);
+	}
+	/* check if the responder selected valid proposals */
+	if (ts_selected_count != ts_received_count)
+	{
+		this->logger->log(this->logger, ERROR, "responder selected invalid traffic selectors");
+		status = FAILED;	
+	}
+	
+	/* cleanup */
+	while(ts_received_count--) 
+	{
+		traffic_selector_t *ts = *ts_received + ts_received_count;
+		ts->destroy(ts);
+	}
+	allocator_free(ts_received);
+	while(ts_selected_count--) 
+	{
+		traffic_selector_t *ts = *ts_selected + ts_selected_count;
+		ts->destroy(ts);
+	}
+	allocator_free(ts_selected);
+	return status;
+}
 /**
  * Implements state_t.get_state
  */
@@ -91,6 +362,13 @@ ike_auth_requested_t *ike_auth_requested_create(protected_ike_sa_t *ike_sa, chun
 	this->public.state_interface.get_state = (ike_sa_state_t (*) (state_t *)) get_state;
 	this->public.state_interface.destroy  = (void (*) (state_t *)) destroy;
 	
+	/* private functions */
+	
+	this->process_idr_payload = process_idr_payload;
+	this->process_sa_payload = process_sa_payload;
+	this->process_auth_payload = process_auth_payload;
+	this->process_ts_payload = process_ts_payload;
+	
 	/* private data */
 	this->ike_sa = ike_sa;
 	this->sent_nonce = sent_nonce;

Source/charon/sa/states/ike_sa_init_requested.c

@@ -534,7 +534,9 @@ static void build_tsi_payload (private_ike_sa_init_requested_t *this, payload_t
 	
 	sa_config = this->ike_sa->get_sa_config(this->ike_sa);
 	traffic_selectors_count = sa_config->get_traffic_selectors_initiator(sa_config,&traffic_selectors);
+	printf("traffic_selectors: %d\n", traffic_selectors_count);
 	ts_payload = ts_payload_create_from_traffic_selectors(TRUE,traffic_selectors, traffic_selectors_count);
+	
 	allocator_free(traffic_selectors);
 
 	*payload = (payload_t *) ts_payload;

Source/charon/sa/states/ike_sa_init_responded.c

@@ -30,6 +30,7 @@
 #include <encoding/payloads/auth_payload.h>
 #include <transforms/signers/signer.h>
 #include <transforms/crypters/crypter.h>
+#include <sa/states/ike_sa_established.h>
 
 
 typedef struct private_ike_sa_init_responded_t private_ike_sa_init_responded_t;
@@ -44,53 +45,47 @@ struct private_ike_sa_init_responded_t {
 	 */
 	ike_sa_init_responded_t public;
 	
-	/**
-	 * Shared secret from DH-Exchange
-	 * 
-	 * All needed secrets are derived from this shared secret and then passed to the next
-	 * state of type ike_sa_established_t
-	 */
-	chunk_t shared_secret;
-	
-	/**
-	 * Sent nonce used to calculate secrets
-	 */
-	chunk_t received_nonce;
-	
-	/**
-	 * Sent nonce used to calculate secrets
-	 */
-	chunk_t sent_nonce;
-	
 	/**
 	 * Assigned IKE_SA
 	 */
 	protected_ike_sa_t *ike_sa;
 	
+	/**
+	 * sa config to use
+	 */
+	sa_config_t *sa_config;
+	
 	/**
 	 * Logger used to log data 
 	 * 
 	 * Is logger of ike_sa!
 	 */
 	logger_t *logger;
+	
+	status_t (*build_idr_payload) (private_ike_sa_init_responded_t *this, id_payload_t *request_idi, id_payload_t *request_idr, message_t *response);
+	status_t (*build_sa_payload) (private_ike_sa_init_responded_t *this, sa_payload_t *request, message_t *response);
+	status_t (*build_auth_payload) (private_ike_sa_init_responded_t *this, auth_payload_t *request, message_t *response);
+	status_t (*build_ts_payload) (private_ike_sa_init_responded_t *this, bool ts_initiator, ts_payload_t *request, message_t *response);
 };
 
 /**
  * Implements state_t.get_state
  */
-static status_t process_message(private_ike_sa_init_responded_t *this, message_t *message)
+static status_t process_message(private_ike_sa_init_responded_t *this, message_t *request)
 {
 	status_t status;
 	signer_t *signer;
 	crypter_t *crypter;
 	iterator_t *payloads;
 	exchange_type_t exchange_type;
-	id_payload_t *idi_payload, *idr_payload;
-	auth_payload_t *auth_payload;
-	sa_payload_t *sa_payload;
-	ts_payload_t *tsi_payload, *tsr_payload;
+	id_payload_t *idi_request, *idr_request = NULL;
+	auth_payload_t *auth_request;
+	sa_payload_t *sa_request;
+	ts_payload_t *tsi_request, *tsr_request;
+	message_t *response;
+	packet_t *response_packet;
 
-	exchange_type = message->get_exchange_type(message);
+	exchange_type = request->get_exchange_type(request);
 	if (exchange_type != IKE_AUTH)
 	{
 		this->logger->log(this->logger, ERROR | MORE, "Message of type %s not supported in state ike_sa_init_responded",
@@ -98,7 +93,7 @@ static status_t process_message(private_ike_sa_init_responded_t *this, message_t
 		return FAILED;
 	}
 	
-	if (!message->get_request(message))
+	if (!request->get_request(request))
 	{
 		this->logger->log(this->logger, ERROR | MORE, "Only requests of type IKE_AUTH supported in state ike_sa_init_responded");
 		return FAILED;
@@ -110,7 +105,7 @@ static status_t process_message(private_ike_sa_init_responded_t *this, message_t
 	
 	/* parse incoming message */
 
-	status = message->parse_body(message, crypter, signer);
+	status = request->parse_body(request, crypter, signer);
 	if (status != SUCCESS)
 	{
 		this->logger->log(this->logger, ERROR | MORE, "Could not parse body of request message");
@@ -118,7 +113,7 @@ static status_t process_message(private_ike_sa_init_responded_t *this, message_t
 	}
 	
 	/* iterate over incoming payloads. Message is verified, we can be sure there are the required payloads */
-	payloads = message->get_payload_iterator(message);
+	payloads = request->get_payload_iterator(request);
 	while (payloads->has_next(payloads))
 	{
 		payload_t *payload;
@@ -128,22 +123,22 @@ static status_t process_message(private_ike_sa_init_responded_t *this, message_t
 		{
 			case ID_INITIATOR:
 			{
-				idi_payload = (id_payload_t*)payload;
+				idi_request = (id_payload_t*)payload;
 				break;	
 			}
 			case AUTHENTICATION:
 			{
-				auth_payload = (auth_payload_t*)payload;
+				auth_request = (auth_payload_t*)payload;
 				break;	
 			}
 			case ID_RESPONDER:
 			{
-				/* TODO handle idr payloads */
+				idr_request = (id_payload_t*)payload;
 				break;	
 			}
 			case SECURITY_ASSOCIATION:
 			{
-				sa_payload = (sa_payload_t*)payload;
+				sa_request = (sa_payload_t*)payload;
 				break;
 			}
 			case CERTIFICATE:
@@ -158,17 +153,17 @@ static status_t process_message(private_ike_sa_init_responded_t *this, message_t
 			}
 			case TRAFFIC_SELECTOR_INITIATOR:
 			{
-				tsi_payload = (ts_payload_t*)payload;				
+				tsi_request = (ts_payload_t*)payload;				
 				break;	
 			}
 			case TRAFFIC_SELECTOR_RESPONDER:
 			{
-				tsr_payload = (ts_payload_t*)payload;
+				tsr_request = (ts_payload_t*)payload;
 				break;	
 			}
 			default:
 			{
-				/* can't happen, since message is verified */
+				/* can't happen, since message is verified, notify's? */
 				break;
 			}
 		}
@@ -176,66 +171,223 @@ static status_t process_message(private_ike_sa_init_responded_t *this, message_t
 	/* iterator can be destroyed */
 	payloads->destroy(payloads);
 	
+	/* build response */
+	this->ike_sa->build_message(this->ike_sa, IKE_AUTH, FALSE, &response);
 	
-	/* 
-	 * ID Payload 
-	 */
-	this->logger->log(this->logger, CONTROL|MOST, "type of IDi is %s", 
-						mapping_find(id_type_m, idi_payload->get_id_type(idi_payload)));
-	chunk_t data = idi_payload->get_data(idi_payload);
+	/* add payloads to it */
 	
-	this->logger->log(this->logger, CONTROL|MOST, "data of IDi is %s", 
-						data.ptr);
+	status = this->build_idr_payload(this, idi_request, idr_request, response);
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, ERROR, "Building idr payload failed");
+		response->destroy(response);
+		return status;
+	}
+	status = this->build_sa_payload(this, sa_request, response);
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, ERROR, "Building sa payload failed");
+		response->destroy(response);
+		return status;
+	}
+	status = this->build_auth_payload(this, auth_request, response);
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, ERROR, "Building auth payload failed");
+		response->destroy(response);
+		return status;
+	}
+	status = this->build_ts_payload(this, TRUE, tsi_request, response);
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, ERROR, "Building tsi payload failed");
+		response->destroy(response);
+		return status;
+	}
+	status = this->build_ts_payload(this, FALSE, tsr_request, response);
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, ERROR, "Building tsr payload failed");
+		response->destroy(response);
+		return status;
+	}
 	
-//	charon->configuration_manager->get_my_default_id(charon->configuration_manager, id
-//
-//	
-//	
-//	
-//	this->logger->log(this->logger, CONTROL|MOST, "type of AUTH is %s", 
-//						mapping_find(auth_method_m, auth_payload->get_auth_method(auth_payload)));
-//	
-//	/* get the list of suggested proposals */ 
-//	suggested_proposals = sa_payload->create_proposal_substructure_iterator(sa_payload, TRUE);
-//	
-//	/* now let the configuration-manager select a subset of the proposals */
-//	status = charon->configuration_manager->select_proposals_for_host(charon->configuration_manager,
-//						this->ike_sa->get_other_host(this->ike_sa), suggested_proposals, accepted_proposals);
-//				
-			
-//	iterator = tsi_payload->create_traffic_selector_substructure_iterator(tsi_payload, TRUE);
-//	while (iterator->has_next(iterator))
-//	{
-//		traffic_selector_substructure_t *ts;
-//		iterator->current(iterator, (void**)ts);
-//		this->logger->log(this->logger, CONTROL|MOST, "type of TSi is %s", 
-//							mapping_find(ts_type_m, ts->get_ts_type(ts)));
-//		
-//	}
-//	iterator->destroy(iterator);
-//	
-//	iterator = tsr_payload->create_traffic_selector_substructure_iterator(tsr_payload, TRUE);
-//	while (iterator->has_next(iterator))
-//	{
-//		traffic_selector_substructure_t *ts;
-//		iterator->current(iterator, (void**)ts);
-//		this->logger->log(this->logger, CONTROL|MOST, "type of TSr is %s", 
-//							mapping_find(ts_type_m, ts->get_ts_type(ts)));
-//		
-//	}
-//	iterator->destroy(iterator);
+	/* generate response, get transfroms first */
+	signer = this->ike_sa->get_signer_responder(this->ike_sa);
+	crypter = this->ike_sa->get_crypter_responder(this->ike_sa);
+	status = response->generate(response, crypter, signer, &response_packet);
+	if (status != SUCCESS)
+	{
+		this->logger->log(this->logger, ERROR, "Error in message generation");
+		response->destroy(response);
+		return status;
+	}
+
 	
+	/* send it out */
+	this->logger->log(this->logger, CONTROL | MORE, "IKE_AUTH request successfully handled. Sending reply.");
+	charon->send_queue->add(charon->send_queue, response_packet);
+	/* store for timeout reply */
+	this->ike_sa->set_last_responded_message(this->ike_sa, response);
 	
+	/* create new state */
+	this->ike_sa->set_new_state(this->ike_sa, (state_t*)ike_sa_established_create(this->ike_sa));
+
+	return SUCCESS;
+}
+
+/**
+ * Implements private_ike_sa_init_responded_t.build_idr_payload
+ */
+static status_t build_idr_payload(private_ike_sa_init_responded_t *this, id_payload_t *request_idi, id_payload_t *request_idr, message_t *response)
+{
+	identification_t *other_id, *my_id = NULL;
+	init_config_t *init_config;
+	status_t status;
+	id_payload_t *idr_response;
 	
-	this->logger->log(this->logger, CONTROL | MORE, "Request successfully handled. Going to create reply.");
+	other_id = request_idi->get_identification(request_idi);
+	if (request_idr)
+	{
+		my_id = request_idr->get_identification(request_idr);
+	}
+
+	/* build new sa config */
+	init_config = this->ike_sa->get_init_config(this->ike_sa);
+	status = charon->configuration_manager->get_sa_config_for_init_config_and_id(charon->configuration_manager,init_config, other_id,my_id, &(this->sa_config));
+	if (status != SUCCESS)
+	{	
+		this->logger->log(this->logger, ERROR, "Could not find config for %s", other_id->get_string(other_id));
+		return NOT_FOUND;
+	}
+	
+	/* set sa_config in ike_sa for other states */
+	this->ike_sa->set_sa_config(this->ike_sa, this->sa_config);
+	
+	/*  build response */
+	idr_response = id_payload_create_from_identification(FALSE, other_id);
+	response->add_payload(response, (payload_t*)idr_response);
+	
+	if (my_id)
+	{
+		my_id->destroy(my_id);	
+	}
+	other_id->destroy(other_id);
 	
 	return SUCCESS;
 }
 
-
-static status_t build_id_payload(private_ike_sa_init_responded_t *this, id_payload_t *id_payload)
+/**
+ * Implements private_ike_sa_init_responded_t.build_sa_payload
+ */
+static status_t build_sa_payload(private_ike_sa_init_responded_t *this, sa_payload_t *request, message_t *response)
 {
-	return SUCCESS;
+	child_proposal_t *proposals, *proposal_chosen;
+	size_t proposal_count;
+	status_t status;
+	sa_payload_t *sa_response;
+	
+	/* dummy spis, until we have a child sa to request them */
+	u_int8_t ah_spi[4] = {0x01, 0x02, 0x03, 0x04};
+	u_int8_t esp_spi[4] = {0x05, 0x06, 0x07, 0x08};
+	
+	status = request->get_child_proposals(request, &proposals, &proposal_count);
+	if (status == SUCCESS)
+	{
+		proposal_chosen = this->sa_config->select_proposal(this->sa_config, ah_spi, esp_spi, proposals, proposal_count);
+		if (proposal_chosen != NULL)
+		{
+			sa_response = sa_payload_create_from_child_proposals(proposal_chosen, 1);
+			response->add_payload(response, (payload_t*)sa_response);
+		}
+		else
+		{
+			this->logger->log(this->logger, ERROR, "no matching proposal found");
+			status = NOT_FOUND;	
+		}
+	}
+	else
+	{
+		this->logger->log(this->logger, ERROR, "requestor's sa payload contained no proposals");
+		status =  NOT_FOUND;
+	}
+	
+	
+	allocator_free(proposal_chosen);
+	allocator_free(proposals);
+	
+	
+	return status;
+}
+
+/**
+ * Implements private_ike_sa_init_responded_t.build_auth_payload
+ */
+static status_t build_auth_payload(private_ike_sa_init_responded_t *this, auth_payload_t *request, message_t *response)
+{
+	auth_payload_t *dummy;
+	u_int8_t data[] = {0x01,0x03,0x01,0x03,0x01,0x03,0x01,0x03,0x01,0x03,0x01,0x03,0x01,0x03,0x01,0x03};
+	chunk_t auth_data;
+	auth_data.ptr = data;
+	auth_data.len = sizeof(data);
+	
+	/* TODO VERIFY auth here */
+	
+	dummy = auth_payload_create();
+	dummy->set_data(dummy, auth_data);
+	dummy->set_auth_method(dummy, RSA_DIGITAL_SIGNATURE);
+	
+	/* TODO replace dummy */
+	
+	response->add_payload(response, (payload_t *)dummy);
+	return SUCCESS;	
+}
+
+/**
+ * Implements private_ike_sa_init_responded_t.build_ts_payload
+ */
+static status_t build_ts_payload(private_ike_sa_init_responded_t *this, bool ts_initiator, ts_payload_t *request, message_t* response)
+{
+	traffic_selector_t **ts_received, **ts_selected;
+	size_t ts_received_count, ts_selected_count;
+	status_t status = SUCCESS;
+	ts_payload_t *ts_response;
+	
+	/* build a reply payload with selected traffic selectors */
+	ts_received_count = request->get_traffic_selectors(request, &ts_received);
+	/* select ts depending on payload type */
+	if (ts_initiator)
+	{
+		ts_selected_count = this->sa_config->select_traffic_selectors_initiator(this->sa_config, ts_received, ts_received_count, &ts_selected);
+	}
+	else
+	{
+		ts_selected_count = this->sa_config->select_traffic_selectors_responder(this->sa_config, ts_received, ts_received_count, &ts_selected);
+	}
+	if(ts_selected_count == 0)
+	{
+		status = NOT_FOUND;	
+	}
+	else
+	{
+		ts_response = ts_payload_create_from_traffic_selectors(FALSE, ts_selected, ts_selected_count);
+		response->add_payload(response, (payload_t*)ts_response);
+	}
+	
+	/* cleanup */
+	while(ts_received_count--) 
+	{
+		traffic_selector_t *ts = *ts_received + ts_received_count;
+		ts->destroy(ts);
+	}
+	allocator_free(ts_received);
+	while(ts_selected_count--) 
+	{
+		traffic_selector_t *ts = *ts_selected + ts_selected_count;
+		ts->destroy(ts);
+	}
+	allocator_free(ts_selected);
+	return status;
 }
 
 /**
@@ -253,14 +405,7 @@ static void destroy(private_ike_sa_init_responded_t *this)
 {
 	this->logger->log(this->logger, CONTROL | MORE, "Going to destroy ike_sa_init_responded_t state object");
 	
-	this->logger->log(this->logger, CONTROL | MOST, "Destroy shared_secret");
-	allocator_free(this->shared_secret.ptr);
-
-	this->logger->log(this->logger, CONTROL | MOST, "Destroy sent nonce");
-	allocator_free(this->sent_nonce.ptr);
-
-	this->logger->log(this->logger, CONTROL | MOST, "Destroy received nonce");
-	allocator_free(this->received_nonce.ptr);
+	charon->logger_manager->destroy_logger(charon->logger_manager, this->logger);
 	
 	allocator_free(this);
 }
@@ -268,8 +413,7 @@ static void destroy(private_ike_sa_init_responded_t *this)
 /* 
  * Described in header.
  */
- 
-ike_sa_init_responded_t *ike_sa_init_responded_create(protected_ike_sa_t *ike_sa, chunk_t shared_secret, chunk_t received_nonce, chunk_t sent_nonce)
+ike_sa_init_responded_t *ike_sa_init_responded_create(protected_ike_sa_t *ike_sa)
 {
 	private_ike_sa_init_responded_t *this = allocator_alloc_thing(private_ike_sa_init_responded_t);
 
@@ -278,12 +422,15 @@ ike_sa_init_responded_t *ike_sa_init_responded_create(protected_ike_sa_t *ike_sa
 	this->public.state_interface.get_state = (ike_sa_state_t (*) (state_t *)) get_state;
 	this->public.state_interface.destroy  = (void (*) (state_t *)) destroy;
 	
+	/* private functions */
+	this->build_idr_payload = build_idr_payload;
+	this->build_sa_payload = build_sa_payload;
+	this->build_auth_payload = build_auth_payload;
+	this->build_ts_payload = build_ts_payload;
+	
 	/* private data */
 	this->ike_sa = ike_sa;
 	this->logger = this->ike_sa->get_logger(this->ike_sa);
-	this->shared_secret = shared_secret;
-	this->received_nonce = received_nonce;
-	this->sent_nonce = sent_nonce;
 	
 	return &(this->public);
 }

Source/charon/sa/states/ike_sa_init_responded.h

@@ -50,6 +50,6 @@ struct ike_sa_init_responded_t {
  * 
  * @ingroup states
  */
-ike_sa_init_responded_t *ike_sa_init_responded_create(protected_ike_sa_t *ike_sa, chunk_t shared_secret, chunk_t received_nonce, chunk_t sent_nonce);
+ike_sa_init_responded_t *ike_sa_init_responded_create(protected_ike_sa_t *ike_sa);
 
 #endif /*IKE_SA_INIT_RESPONDED_H_*/

Source/charon/sa/states/responder_init.c

@@ -361,7 +361,7 @@ static status_t process_message(private_responder_init_t *this, message_t *messa
 	/* state can now be changed */
 	this->logger->log(this->logger, CONTROL|MOST, "Create next state object");
 
-	next_state = ike_sa_init_responded_create(this->ike_sa, shared_secret, this->received_nonce, this->sent_nonce);
+	next_state = ike_sa_init_responded_create(this->ike_sa);
 	
 	/* last message can now be set */
 	status = this->ike_sa->set_last_responded_message(this->ike_sa, response);