[svn-upgrade] Integrating new upstream version, strongswan (4.3.6)

1 files changed, 252 insertions, 201 deletions

diff --git a/src/charon/sa/ike_sa.c b/src/charon/sa/ike_sa.c
index be973a2ce..975a0904a 100644
--- a/src/charon/sa/ike_sa.c
+++ b/src/charon/sa/ike_sa.c
@@ -16,7 +16,6 @@
  * for more details.
  */
 
-#include <sys/time.h>
 #include <string.h>
 #include <sys/stat.h>
 #include <errno.h>
@@ -41,6 +40,7 @@
 #include <sa/tasks/ike_reauth.h>
 #include <sa/tasks/ike_delete.h>
 #include <sa/tasks/ike_dpd.h>
+#include <sa/tasks/ike_vendor.h>
 #include <sa/tasks/child_create.h>
 #include <sa/tasks/child_delete.h>
 #include <sa/tasks/child_rekey.h>
@@ -72,169 +72,174 @@ typedef struct attribute_entry_t attribute_entry_t;
  * Private data of an ike_sa_t object.
  */
 struct private_ike_sa_t {
-	
+
 	/**
 	 * Public members
 	 */
 	ike_sa_t public;
-	
+
 	/**
 	 * Identifier for the current IKE_SA.
 	 */
 	ike_sa_id_t *ike_sa_id;
-	
+
 	/**
 	 * unique numerical ID for this IKE_SA.
 	 */
 	u_int32_t unique_id;
-	
+
 	/**
 	 * Current state of the IKE_SA
 	 */
 	ike_sa_state_t state;
-	
+
 	/**
 	 * IKE configuration used to set up this IKE_SA
 	 */
 	ike_cfg_t *ike_cfg;
-	
+
 	/**
 	 * Peer and authentication information to establish IKE_SA.
 	 */
 	peer_cfg_t *peer_cfg;
-	
+
 	/**
 	 * currently used authentication ruleset, local (as auth_cfg_t)
 	 */
 	auth_cfg_t *my_auth;
-	
+
+	/**
+	 * list of completed local authentication rounds
+	 */
+	linked_list_t *my_auths;
+
+	/**
+	 * list of completed remote authentication rounds
+	 */
+	linked_list_t *other_auths;
+
 	/**
 	 * currently used authentication constraints, remote (as auth_cfg_t)
 	 */
 	auth_cfg_t *other_auth;
-	
+
 	/**
 	 * Selected IKE proposal
 	 */
 	proposal_t *proposal;
-	
+
 	/**
 	 * Juggles tasks to process messages
 	 */
 	task_manager_t *task_manager;
-	
+
 	/**
 	 * Address of local host
 	 */
 	host_t *my_host;
-	
+
 	/**
 	 * Address of remote host
 	 */
 	host_t *other_host;
-	
+
 #ifdef ME
 	/**
 	 * Are we mediation server
 	 */
 	bool is_mediation_server;
-	
+
 	/**
 	 * Server reflexive host
 	 */
 	host_t *server_reflexive_host;
-	
+
 	/**
 	 * Connect ID
 	 */
 	chunk_t connect_id;
 #endif /* ME */
-		
+
 	/**
 	 * Identification used for us
 	 */
 	identification_t *my_id;
-	
+
 	/**
 	 * Identification used for other
 	 */
 	identification_t *other_id;
-	
-	/**
-	 * EAP Identity exchange in EAP-Identity method
-	 */
-	identification_t *eap_identity;;
-	
+
 	/**
 	 * set of extensions the peer supports
 	 */
 	ike_extension_t extensions;
-	
+
 	/**
 	 * set of condition flags currently enabled for this IKE_SA
 	 */
 	ike_condition_t conditions;
-	
+
 	/**
 	 * Linked List containing the child sa's of the current IKE_SA.
 	 */
 	linked_list_t *child_sas;
-	
+
 	/**
 	 * keymat of this IKE_SA
 	 */
 	keymat_t *keymat;
-	
+
 	/**
 	 * Virtual IP on local host, if any
 	 */
 	host_t *my_virtual_ip;
-	
+
 	/**
 	 * Virtual IP on remote host, if any
 	 */
 	host_t *other_virtual_ip;
-	
+
 	/**
 	 * List of configuration attributes (attribute_entry_t)
 	 */
 	linked_list_t *attributes;
-	
+
 	/**
 	 * list of peers additional addresses, transmitted via MOBIKE
 	 */
 	linked_list_t *additional_addresses;
-	
+
 	/**
 	 * previously value of received DESTINATION_IP hash
 	 */
 	chunk_t nat_detection_dest;
-	
+
 	/**
 	 * number pending UPDATE_SA_ADDRESS (MOBIKE)
 	 */
 	u_int32_t pending_updates;
-	
+
 	/**
 	 * NAT keep alive interval
 	 */
 	u_int32_t keepalive_interval;
-	
+
 	/**
 	 * Timestamps for this IKE_SA
 	 */
 	u_int32_t stats[STAT_MAX];
-	
+
 	/**
 	 * how many times we have retried so far (keyingtries)
 	 */
 	u_int32_t keyingtry;
-	
+
 	/**
 	 * local host address to be used for IKE, set via MIGRATE kernel message
 	 */
 	host_t *local_host;
-	
+
 	/**
 	 * remote host address to be used for IKE, set via MIGRATE kernel message
 	 */
@@ -261,7 +266,7 @@ static time_t get_use_time(private_ike_sa_t* this, bool inbound)
 	enumerator_t *enumerator;
 	child_sa_t *child_sa;
 	time_t use_time, current;
-	
+
 	if (inbound)
 	{
 		use_time = this->stats[STAT_INBOUND];
@@ -277,7 +282,7 @@ static time_t get_use_time(private_ike_sa_t* this, bool inbound)
 		use_time = max(use_time, current);
 	}
 	enumerator->destroy(enumerator);
-	
+
 	return use_time;
 }
 
@@ -363,7 +368,7 @@ static void set_peer_cfg(private_ike_sa_t *this, peer_cfg_t *peer_cfg)
 	DESTROY_IF(this->peer_cfg);
 	peer_cfg->get_ref(peer_cfg);
 	this->peer_cfg = peer_cfg;
-	
+
 	if (this->ike_cfg == NULL)
 	{
 		this->ike_cfg = peer_cfg->get_ike_cfg(peer_cfg);
@@ -384,6 +389,56 @@ static auth_cfg_t* get_auth_cfg(private_ike_sa_t *this, bool local)
 }
 
 /**
+ * Implementation of ike_sa_t.add_auth_cfg
+ */
+static void add_auth_cfg(private_ike_sa_t *this, bool local, auth_cfg_t *cfg)
+{
+	if (local)
+	{
+		this->my_auths->insert_last(this->my_auths, cfg);
+	}
+	else
+	{
+		this->other_auths->insert_last(this->other_auths, cfg);
+	}
+}
+
+/**
+ * Implementation of ike_sa_t.create_auth_cfg_enumerator
+ */
+static enumerator_t* create_auth_cfg_enumerator(private_ike_sa_t *this,
+												bool local)
+{
+	if (local)
+	{
+		return this->my_auths->create_enumerator(this->my_auths);
+	}
+	return this->other_auths->create_enumerator(this->other_auths);
+}
+
+/**
+ * Flush the stored authentication round information
+ */
+static void flush_auth_cfgs(private_ike_sa_t *this)
+{
+	auth_cfg_t *cfg;
+
+	if (lib->settings->get_bool(lib->settings, "charon.flush_auth_cfg", TRUE))
+	{
+		while (this->my_auths->remove_last(this->my_auths,
+										   (void**)&cfg) == SUCCESS)
+		{
+			cfg->destroy(cfg);
+		}
+		while (this->other_auths->remove_last(this->other_auths,
+											  (void**)&cfg) == SUCCESS)
+		{
+			cfg->destroy(cfg);
+		}
+	}
+}
+
+/**
  * Implementation of ike_sa_t.get_proposal
  */
 static proposal_t* get_proposal(private_ike_sa_t *this)
@@ -422,22 +477,22 @@ static void send_keepalive(private_ike_sa_t *this)
 {
 	send_keepalive_job_t *job;
 	time_t last_out, now, diff;
-	
+
 	if (!(this->conditions & COND_NAT_HERE) || this->keepalive_interval == 0)
 	{	/* disable keep alives if we are not NATed anymore */
 		return;
 	}
-	
+
 	last_out = get_use_time(this, FALSE);
-	now = time(NULL);
-	
+	now = time_monotonic(NULL);
+
 	diff = now - last_out;
-	
+
 	if (diff >= this->keepalive_interval)
 	{
 		packet_t *packet;
 		chunk_t data;
-		
+
 		packet = packet_create();
 		packet->set_source(packet, this->my_host->clone(this->my_host));
 		packet->set_destination(packet, this->other_host->clone(this->other_host));
@@ -552,15 +607,15 @@ static status_t send_dpd(private_ike_sa_t *this)
 {
 	job_t *job;
 	time_t diff, delay;
-	
+
 	delay = this->peer_cfg->get_dpd(this->peer_cfg);
-	
+
 	if (delay == 0)
 	{
 		/* DPD disabled */
 		return SUCCESS;
 	}
-	
+
 	if (this->task_manager->busy(this->task_manager))
 	{
 		/* an exchange is in the air, no need to start a DPD check */
@@ -571,14 +626,14 @@ static status_t send_dpd(private_ike_sa_t *this)
 		/* check if there was any inbound traffic */
 		time_t last_in, now;
 		last_in = get_use_time(this, TRUE);
-		now = time(NULL);
+		now = time_monotonic(NULL);
 		diff = now - last_in;
 		if (diff >= delay)
 		{
 			/* to long ago, initiate dead peer detection */
 			task_t *task;
 			ike_mobike_t *mobike;
-			
+
 			if (supports_extension(this, EXT_MOBIKE) &&
 				has_condition(this, COND_NAT_HERE))
 			{
@@ -593,7 +648,7 @@ static status_t send_dpd(private_ike_sa_t *this)
 			}
 			diff = 0;
 			DBG1(DBG_IKE, "sending DPD request");
-			
+
 			this->task_manager->queue_task(this->task_manager, task);
 			this->task_manager->initiate(this->task_manager);
 		}
@@ -621,7 +676,7 @@ static void set_state(private_ike_sa_t *this, ike_sa_state_t state)
 		 get_name(this), this->unique_id,
 		 ike_sa_state_names, this->state,
 		 ike_sa_state_names, state);
-	
+
 	switch (state)
 	{
 		case IKE_ESTABLISHED:
@@ -631,14 +686,14 @@ static void set_state(private_ike_sa_t *this, ike_sa_state_t state)
 			{
 				job_t *job;
 				u_int32_t t;
-			
+
 				/* calculate rekey, reauth and lifetime */
-				this->stats[STAT_ESTABLISHED] = time(NULL);
-				
+				this->stats[STAT_ESTABLISHED] = time_monotonic(NULL);
+
 				/* schedule rekeying if we have a time which is smaller than
 				 * an already scheduled rekeying */
 				t = this->peer_cfg->get_rekey_time(this->peer_cfg);
-				if (t && (this->stats[STAT_REKEY] == 0 || 
+				if (t && (this->stats[STAT_REKEY] == 0 ||
 					(this->stats[STAT_REKEY] > t + this->stats[STAT_ESTABLISHED])))
 				{
 					this->stats[STAT_REKEY] = t + this->stats[STAT_ESTABLISHED];
@@ -647,7 +702,7 @@ static void set_state(private_ike_sa_t *this, ike_sa_state_t state)
 					DBG1(DBG_IKE, "scheduling rekeying in %ds", t);
 				}
 				t = this->peer_cfg->get_reauth_time(this->peer_cfg);
-				if (t && (this->stats[STAT_REAUTH] == 0 || 
+				if (t && (this->stats[STAT_REAUTH] == 0 ||
 					(this->stats[STAT_REAUTH] > t + this->stats[STAT_ESTABLISHED])))
 				{
 					this->stats[STAT_REAUTH] = t + this->stats[STAT_ESTABLISHED];
@@ -677,7 +732,7 @@ static void set_state(private_ike_sa_t *this, ike_sa_state_t state)
 					charon->scheduler->schedule_job(charon->scheduler, job, t);
 					DBG1(DBG_IKE, "maximum IKE_SA lifetime %ds", t);
 				}
-				
+
 				/* start DPD checks */
 				send_dpd(this);
 			}
@@ -687,7 +742,7 @@ static void set_state(private_ike_sa_t *this, ike_sa_state_t state)
 		{
 			/* delete may fail if a packet gets lost, so set a timeout */
 			job_t *job = (job_t*)delete_ike_sa_job_create(this->ike_sa_id, TRUE);
-			charon->scheduler->schedule_job(charon->scheduler, job, 
+			charon->scheduler->schedule_job(charon->scheduler, job,
 											HALF_OPEN_IKE_SA_TIMEOUT);
 			break;
 		}
@@ -708,9 +763,9 @@ static void reset(private_ike_sa_t *this)
 	{
 		this->ike_sa_id->set_responder_spi(this->ike_sa_id, 0);
 	}
-	
+
 	set_state(this, IKE_CREATED);
-	
+
 	this->task_manager->reset(this->task_manager, 0, 0);
 }
 
@@ -777,7 +832,7 @@ static void add_additional_address(private_ike_sa_t *this, host_t *host)
 {
 	this->additional_addresses->insert_last(this->additional_addresses, host);
 }
-	
+
 /**
  * Implementation of ike_sa_t.create_additional_address_iterator.
  */
@@ -828,7 +883,7 @@ static u_int32_t get_pending_updates(private_ike_sa_t *this)
 static void update_hosts(private_ike_sa_t *this, host_t *me, host_t *other)
 {
 	bool update = FALSE;
-	
+
 	if (me == NULL)
 	{
 		me = this->my_host;
@@ -837,7 +892,7 @@ static void update_hosts(private_ike_sa_t *this, host_t *me, host_t *other)
 	{
 		other = this->other_host;
 	}
-	
+
 	/* apply hosts on first received message */
 	if (this->my_host->is_anyaddr(this->my_host) ||
 		this->other_host->is_anyaddr(this->other_host))
@@ -854,7 +909,7 @@ static void update_hosts(private_ike_sa_t *this, host_t *me, host_t *other)
 			set_my_host(this, me->clone(me));
 			update = TRUE;
 		}
-		
+
 		if (!other->equals(other, this->other_host))
 		{
 			/* update others adress if we are NOT NATed,
@@ -867,13 +922,13 @@ static void update_hosts(private_ike_sa_t *this, host_t *me, host_t *other)
 			}
 		}
 	}
-	
+
 	/* update all associated CHILD_SAs, if required */
 	if (update)
 	{
 		iterator_t *iterator;
 		child_sa_t *child_sa;
-	
+
 		iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
 		while (iterator->iterate(iterator, (void**)&child_sa))
 		{
@@ -896,7 +951,7 @@ static void update_hosts(private_ike_sa_t *this, host_t *me, host_t *other)
 static status_t generate_message(private_ike_sa_t *this, message_t *message,
 								 packet_t **packet)
 {
-	this->stats[STAT_OUTBOUND] = time(NULL);
+	this->stats[STAT_OUTBOUND] = time_monotonic(NULL);
 	message->set_ike_sa_id(message, this->ike_sa_id);
 	return message->generate(message,
 				this->keymat->get_crypter(this->keymat, FALSE),
@@ -911,7 +966,7 @@ static void send_notify_response(private_ike_sa_t *this, message_t *request,
 {
 	message_t *response;
 	packet_t *packet;
-	
+
 	response = message_create();
 	response->set_exchange_type(response, request->get_exchange_type(request));
 	response->set_request(response, FALSE);
@@ -989,7 +1044,7 @@ static chunk_t get_connect_id(private_ike_sa_t *this)
  * Implementation of ike_sa_t.respond
  */
 static status_t respond(private_ike_sa_t *this, identification_t *peer_id,
-		chunk_t connect_id)
+						chunk_t connect_id)
 {
 	ike_me_t *task = ike_me_create(&this->public, TRUE);
 	task->respond(task, peer_id, connect_id);
@@ -1012,7 +1067,8 @@ static status_t callback(private_ike_sa_t *this, identification_t *peer_id)
  * Implementation of ike_sa_t.relay
  */
 static status_t relay(private_ike_sa_t *this, identification_t *requester,
-			chunk_t connect_id, chunk_t connect_key, linked_list_t *endpoints, bool response)
+					  chunk_t connect_id, chunk_t connect_key,
+					  linked_list_t *endpoints, bool response)
 {
 	ike_me_t *task = ike_me_create(&this->public, TRUE);
 	task->relay(task, requester, connect_id, connect_key, endpoints, response);
@@ -1023,7 +1079,8 @@ static status_t relay(private_ike_sa_t *this, identification_t *requester,
 /**
  * Implementation of ike_sa_t.initiate_mediation
  */
-static status_t initiate_mediation(private_ike_sa_t *this, peer_cfg_t *mediated_cfg)
+static status_t initiate_mediation(private_ike_sa_t *this,
+								   peer_cfg_t *mediated_cfg)
 {
 	ike_me_t *task = ike_me_create(&this->public, TRUE);
 	task->connect(task, mediated_cfg->get_peer_id(mediated_cfg));
@@ -1034,14 +1091,13 @@ static status_t initiate_mediation(private_ike_sa_t *this, peer_cfg_t *mediated_
 /**
  * Implementation of ike_sa_t.initiate_mediated
  */
-static status_t initiate_mediated(private_ike_sa_t *this, host_t *me, host_t *other,
-		chunk_t connect_id)
+static status_t initiate_mediated(private_ike_sa_t *this, host_t *me,
+								  host_t *other, chunk_t connect_id)
 {
 	set_my_host(this, me->clone(me));
 	set_other_host(this, other->clone(other));
 	chunk_free(&this->connect_id);
 	this->connect_id = chunk_clone(connect_id);
-	
 	return this->task_manager->initiate(this->task_manager);
 }
 #endif /* ME */
@@ -1052,7 +1108,7 @@ static status_t initiate_mediated(private_ike_sa_t *this, host_t *me, host_t *ot
 static void resolve_hosts(private_ike_sa_t *this)
 {
 	host_t *host;
-	
+
 	if (this->remote_host)
 	{
 		host = this->remote_host->clone(this->remote_host);
@@ -1067,7 +1123,7 @@ static void resolve_hosts(private_ike_sa_t *this)
 	{
 		set_other_host(this, host);
 	}
-	
+
 	if (this->local_host)
 	{
 		host = this->local_host->clone(this->local_host);
@@ -1075,10 +1131,16 @@ static void resolve_hosts(private_ike_sa_t *this)
 	}
 	else
 	{
+		int family = 0;
+
+		/* use same address family as for other */
+		if (!this->other_host->is_anyaddr(this->other_host))
+		{
+			family = this->other_host->get_family(this->other_host);
+		}
 		host = host_create_from_dns(this->ike_cfg->get_my_addr(this->ike_cfg),
-									this->my_host->get_family(this->my_host),
-									IKEV2_UDP_PORT);
-	
+									family, IKEV2_UDP_PORT);
+
 		if (host && host->is_anyaddr(host) &&
 			!this->other_host->is_anyaddr(this->other_host))
 		{
@@ -1111,11 +1173,11 @@ static status_t initiate(private_ike_sa_t *this,
 						 traffic_selector_t *tsi, traffic_selector_t *tsr)
 {
 	task_t *task;
-	
+
 	if (this->state == IKE_CREATED)
 	{
 		resolve_hosts(this);
-		
+
 		if (this->other_host->is_anyaddr(this->other_host)
 #ifdef ME
 			&& !this->peer_cfg->get_mediated_by(this->peer_cfg)
@@ -1126,11 +1188,13 @@ static status_t initiate(private_ike_sa_t *this,
 			DBG1(DBG_IKE, "unable to initiate to %%any");
 			return DESTROY_ME;
 		}
-		
+
 		set_condition(this, COND_ORIGINAL_INITIATOR, TRUE);
-		
+
 		task = (task_t*)ike_init_create(&this->public, TRUE, NULL);
 		this->task_manager->queue_task(this->task_manager, task);
+		task = (task_t*)ike_vendor_create(&this->public, TRUE);
+		this->task_manager->queue_task(this->task_manager, task);
 		task = (task_t*)ike_natd_create(&this->public, TRUE);
 		this->task_manager->queue_task(this->task_manager, task);
 		task = (task_t*)ike_cert_pre_create(&this->public, TRUE);
@@ -1159,8 +1223,8 @@ static status_t initiate(private_ike_sa_t *this,
 	{
 		if (this->state == IKE_ESTABLISHED)
 		{
-			/* mediation connection is already established, retrigger state change
-			 * to notify bus listeners */
+			/* mediation connection is already established, retrigger state
+			 * change to notify bus listeners */
 			DBG1(DBG_IKE, "mediation connection is already up");
 			set_state(this, IKE_ESTABLISHED);
 		}
@@ -1190,7 +1254,7 @@ static status_t initiate(private_ike_sa_t *this,
 		}
 #endif /* ME */
 	}
-	
+
 	return this->task_manager->initiate(this->task_manager);
 }
 
@@ -1201,20 +1265,20 @@ static status_t process_message(private_ike_sa_t *this, message_t *message)
 {
 	status_t status;
 	bool is_request;
-	
+
 	if (this->state == IKE_PASSIVE)
 	{	/* do not handle messages in passive state */
 		return FAILED;
 	}
-	
+
 	is_request = message->get_request(message);
-	
+
 	status = message->parse_body(message,
 								 this->keymat->get_crypter(this->keymat, TRUE),
 								 this->keymat->get_signer(this->keymat, TRUE));
 	if (status != SUCCESS)
 	{
-		
+
 		if (is_request)
 		{
 			switch (status)
@@ -1258,20 +1322,19 @@ static status_t process_message(private_ike_sa_t *this, message_t *message)
 			 exchange_type_names, message->get_exchange_type(message),
 			 message->get_request(message) ? "request" : "response",
 			 message->get_message_id(message));
-		
+
 		if (this->state == IKE_CREATED)
 		{	/* invalid initiation attempt, close SA */
 			return DESTROY_ME;
 		}
-		return status;
 	}
 	else
 	{
 		host_t *me, *other;
-		
+
 		me = message->get_destination(message);
 		other = message->get_source(message);
-		
+
 		/* if this IKE_SA is virgin, we check for a config */
 		if (this->ike_cfg == NULL)
 		{
@@ -1291,7 +1354,7 @@ static status_t process_message(private_ike_sa_t *this, message_t *message)
 			charon->scheduler->schedule_job(charon->scheduler, job,
 											HALF_OPEN_IKE_SA_TIMEOUT);
 		}
-		this->stats[STAT_INBOUND] = time(NULL);
+		this->stats[STAT_INBOUND] = time_monotonic(NULL);
 		/* check if message is trustworthy, and update host information */
 		if (this->state == IKE_CREATED || this->state == IKE_CONNECTING ||
 			message->get_exchange_type(message) != IKE_SA_INIT)
@@ -1301,8 +1364,14 @@ static status_t process_message(private_ike_sa_t *this, message_t *message)
 				update_hosts(this, me, other);
 			}
 		}
-		return this->task_manager->process_message(this->task_manager, message);
+		status = this->task_manager->process_message(this->task_manager, message);
+		if (message->get_exchange_type(message) == IKE_AUTH &&
+			this->state == IKE_ESTABLISHED)
+		{	/* authentication completed */
+			flush_auth_cfgs(this);
+		}
 	}
+	return status;
 }
 
 /**
@@ -1348,23 +1417,6 @@ static void set_other_id(private_ike_sa_t *this, identification_t *other)
 }
 
 /**
- * Implementation of ike_sa_t.get_eap_identity.
- */
-static identification_t* get_eap_identity(private_ike_sa_t *this)
-{
-	return this->eap_identity;
-}
-
-/**
- * Implementation of ike_sa_t.set_eap_identity.
- */
-static void set_eap_identity(private_ike_sa_t *this, identification_t *id)
-{
-	DESTROY_IF(this->eap_identity);
-	this->eap_identity = id;
-}
-
-/**
  * Implementation of ike_sa_t.add_child_sa.
  */
 static void add_child_sa(private_ike_sa_t *this, child_sa_t *child_sa)
@@ -1380,7 +1432,7 @@ static child_sa_t* get_child_sa(private_ike_sa_t *this, protocol_id_t protocol,
 {
 	iterator_t *iterator;
 	child_sa_t *current, *found = NULL;
-	
+
 	iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
 	while (iterator->iterate(iterator, (void**)&current))
 	{
@@ -1409,7 +1461,7 @@ static status_t rekey_child_sa(private_ike_sa_t *this, protocol_id_t protocol,
 							   u_int32_t spi)
 {
 	child_rekey_t *child_rekey;
-	
+
 	child_rekey = child_rekey_create(&this->public, protocol, spi);
 	this->task_manager->queue_task(this->task_manager, &child_rekey->task);
 	return this->task_manager->initiate(this->task_manager);
@@ -1422,7 +1474,7 @@ static status_t delete_child_sa(private_ike_sa_t *this, protocol_id_t protocol,
 								u_int32_t spi)
 {
 	child_delete_t *child_delete;
-	
+
 	child_delete = child_delete_create(&this->public, protocol, spi);
 	this->task_manager->queue_task(this->task_manager, &child_delete->task);
 	return this->task_manager->initiate(this->task_manager);
@@ -1437,7 +1489,7 @@ static status_t destroy_child_sa(private_ike_sa_t *this, protocol_id_t protocol,
 	iterator_t *iterator;
 	child_sa_t *child_sa;
 	status_t status = NOT_FOUND;
-	
+
 	iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
 	while (iterator->iterate(iterator, (void**)&child_sa))
 	{
@@ -1487,9 +1539,9 @@ static status_t delete_(private_ike_sa_t *this)
 static status_t rekey(private_ike_sa_t *this)
 {
 	ike_rekey_t *ike_rekey;
-	
+
 	ike_rekey = ike_rekey_create(&this->public, TRUE);
-	
+
 	this->task_manager->queue_task(this->task_manager, &ike_rekey->task);
 	return this->task_manager->initiate(this->task_manager);
 }
@@ -1510,13 +1562,13 @@ static status_t reauth(private_ike_sa_t *this)
 		if (this->other_virtual_ip != NULL ||
 			has_condition(this, COND_EAP_AUTHENTICATED)
 #ifdef ME
-			/* if we are mediation server we too cannot reauth the IKE_SA */
+			/* as mediation server we too cannot reauth the IKE_SA */
 			|| this->is_mediation_server
 #endif /* ME */
 			)
 		{
-			time_t now = time(NULL);
-			
+			time_t now = time_monotonic(NULL);
+
 			DBG1(DBG_IKE, "IKE_SA will timeout in %V",
 				 &now, &this->stats[STAT_DELETE]);
 			return FAILED;
@@ -1543,10 +1595,10 @@ static status_t reestablish(private_ike_sa_t *this)
 	iterator_t *iterator;
 	child_sa_t *child_sa;
 	child_cfg_t *child_cfg;
-	bool required = FALSE;
+	bool restart = FALSE;
 	status_t status = FAILED;
-	
-	/* check if we have children to keep up at all*/
+
+	/* check if we have children to keep up at all */
 	iterator = create_child_sa_iterator(this);
 	while (iterator->iterate(iterator, (void**)&child_sa))
 	{
@@ -1562,25 +1614,28 @@ static status_t reestablish(private_ike_sa_t *this)
 		switch (action)
 		{
 			case ACTION_RESTART:
+				restart = TRUE;
+				break;
 			case ACTION_ROUTE:
-				required = TRUE;
+				charon->traps->install(charon->traps, this->peer_cfg, child_cfg);
+				break;
 			default:
 				break;
 		}
 	}
 	iterator->destroy(iterator);
 #ifdef ME
-	/* we initiate the new IKE_SA of the mediation connection without CHILD_SA */
+	/* mediation connections have no children, keep them up anyway */
 	if (this->peer_cfg->is_mediation(this->peer_cfg))
 	{
-		required = TRUE;
+		restart = TRUE;
 	}
 #endif /* ME */
-	if (!required)
+	if (!restart)
 	{
 		return FAILED;
 	}
-	
+
 	/* check if we are able to reestablish this IKE_SA */
 	if (!has_condition(this, COND_ORIGINAL_INITIATOR) &&
 		(this->other_virtual_ip != NULL ||
@@ -1593,7 +1648,7 @@ static status_t reestablish(private_ike_sa_t *this)
 		DBG1(DBG_IKE, "unable to reestablish IKE_SA due asymetric setup");
 		return FAILED;
 	}
-	
+
 	new = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager, TRUE);
 	new->set_peer_cfg(new, this->peer_cfg);
 	host = this->other_host;
@@ -1606,7 +1661,7 @@ static status_t reestablish(private_ike_sa_t *this)
 	{
 		new->set_virtual_ip(new, TRUE, host);
 	}
-	
+
 #ifdef ME
 	if (this->peer_cfg->is_mediation(this->peer_cfg))
 	{
@@ -1635,10 +1690,6 @@ static status_t reestablish(private_ike_sa_t *this)
 					child_cfg->get_ref(child_cfg);
 					status = new->initiate(new, child_cfg, 0, NULL, NULL);
 					break;
-				case ACTION_ROUTE:
-					charon->traps->install(charon->traps,
-										   this->peer_cfg, child_cfg);
-					break;
 				default:
 					continue;
 			}
@@ -1649,7 +1700,7 @@ static status_t reestablish(private_ike_sa_t *this)
 		}
 		iterator->destroy(iterator);
 	}
-	
+
 	if (status == DESTROY_ME)
 	{
 		charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, new);
@@ -1669,7 +1720,7 @@ static status_t reestablish(private_ike_sa_t *this)
  */
 static status_t retransmit(private_ike_sa_t *this, u_int32_t message_id)
 {
-	this->stats[STAT_OUTBOUND] = time(NULL);
+	this->stats[STAT_OUTBOUND] = time_monotonic(NULL);
 	if (this->task_manager->retransmit(this->task_manager, message_id) != SUCCESS)
 	{
 		/* send a proper signal to brief interested bus listeners */
@@ -1711,17 +1762,17 @@ static status_t retransmit(private_ike_sa_t *this, u_int32_t message_id)
 static void set_auth_lifetime(private_ike_sa_t *this, u_int32_t lifetime)
 {
 	u_int32_t reduction = this->peer_cfg->get_over_time(this->peer_cfg);
-	u_int32_t reauth_time = time(NULL) + lifetime - reduction;
+	u_int32_t reauth_time = time_monotonic(NULL) + lifetime - reduction;
 
 	if (lifetime < reduction)
 	{
 		DBG1(DBG_IKE, "received AUTH_LIFETIME of %ds, starting reauthentication",
 			 lifetime);
 		charon->processor->queue_job(charon->processor,
-		 			(job_t*)rekey_ike_sa_job_create(this->ike_sa_id, TRUE));
+					(job_t*)rekey_ike_sa_job_create(this->ike_sa_id, TRUE));
 	}
 	else if (this->stats[STAT_REAUTH] == 0 ||
-			 this->stats[STAT_REAUTH] > reauth_time) 
+			 this->stats[STAT_REAUTH] > reauth_time)
 	{
 		this->stats[STAT_REAUTH] = reauth_time;
 		DBG1(DBG_IKE, "received AUTH_LIFETIME of %ds, scheduling reauthentication"
@@ -1732,8 +1783,9 @@ static void set_auth_lifetime(private_ike_sa_t *this, u_int32_t lifetime)
 	}
 	else
 	{
-		DBG1(DBG_IKE, "received AUTH_LIFETIME of %ds, reauthentication already "
-			 "scheduled in %ds", lifetime, this->stats[STAT_REAUTH] - time(NULL));
+		DBG1(DBG_IKE, "received AUTH_LIFETIME of %ds, "
+			 "reauthentication already scheduled in %ds", lifetime,
+			 this->stats[STAT_REAUTH] - time_monotonic(NULL));
 	}
 }
 
@@ -1744,7 +1796,7 @@ static status_t roam(private_ike_sa_t *this, bool address)
 {
 	host_t *src;
 	ike_mobike_t *mobike;
-	
+
 	switch (this->state)
 	{
 		case IKE_CREATED:
@@ -1767,7 +1819,7 @@ static status_t roam(private_ike_sa_t *this, bool address)
 		}
 		return SUCCESS;
 	}
-	
+
 	/* keep existing path if possible */
 	src = charon->kernel_interface->get_source_addr(charon->kernel_interface,
 											this->other_host, this->my_host);
@@ -1782,14 +1834,14 @@ static status_t roam(private_ike_sa_t *this, bool address)
 			return SUCCESS;
 		}
 		src->destroy(src);
-		
+
 	}
 	else
 	{
 		/* check if we find a route at all */
 		enumerator_t *enumerator;
 		host_t *addr;
-		
+
 		src = charon->kernel_interface->get_source_addr(charon->kernel_interface,
 														this->other_host, NULL);
 		if (!src)
@@ -1818,7 +1870,7 @@ static status_t roam(private_ike_sa_t *this, bool address)
 		src->destroy(src);
 	}
 	set_condition(this, COND_STALE, FALSE);
-	
+
 	/* update addresses with mobike, if supported ... */
 	if (supports_extension(this, EXT_MOBIKE))
 	{
@@ -1837,22 +1889,16 @@ static status_t roam(private_ike_sa_t *this, bool address)
  * Implementation of ike_sa_t.add_configuration_attribute
  */
 static void add_configuration_attribute(private_ike_sa_t *this,
+							attribute_handler_t *handler,
 							configuration_attribute_type_t type, chunk_t data)
 {
-	attribute_entry_t *entry;
-	attribute_handler_t *handler;
-	
-	handler = charon->attributes->handle(charon->attributes,
-										 &this->public, type, data);
-	if (handler)
-	{
-		entry = malloc_thing(attribute_entry_t);
-		entry->handler = handler;
-		entry->type = type;
-		entry->data = chunk_clone(data);
-		
-		this->attributes->insert_last(this->attributes, entry);
-	}
+	attribute_entry_t *entry = malloc_thing(attribute_entry_t);
+
+	entry->handler = handler;
+	entry->type = type;
+	entry->data = chunk_clone(data);
+
+	this->attributes->insert_last(this->attributes, entry);
 }
 
 /**
@@ -1862,7 +1908,7 @@ static status_t inherit(private_ike_sa_t *this, private_ike_sa_t *other)
 {
 	child_sa_t *child_sa;
 	attribute_entry_t *entry;
-	
+
 	/* apply hosts and ids */
 	this->my_host->destroy(this->my_host);
 	this->other_host->destroy(this->other_host);
@@ -1872,7 +1918,7 @@ static status_t inherit(private_ike_sa_t *this, private_ike_sa_t *other)
 	this->other_host = other->other_host->clone(other->other_host);
 	this->my_id = other->my_id->clone(other->my_id);
 	this->other_id = other->other_id->clone(other->other_id);
-	
+
 	/* apply virtual assigned IPs... */
 	if (other->my_virtual_ip)
 	{
@@ -1884,9 +1930,9 @@ static status_t inherit(private_ike_sa_t *this, private_ike_sa_t *other)
 		this->other_virtual_ip = other->other_virtual_ip;
 		other->other_virtual_ip = NULL;
 	}
-	
+
 	/* ... and configuration attributes */
-	while (other->attributes->remove_last(other->attributes, 
+	while (other->attributes->remove_last(other->attributes,
 										  (void**)&entry) == SUCCESS)
 	{
 		this->attributes->insert_first(this->attributes, entry);
@@ -1898,7 +1944,7 @@ static status_t inherit(private_ike_sa_t *this, private_ike_sa_t *other)
 	{
 		send_keepalive(this);
 	}
-	
+
 #ifdef ME
 	if (other->is_mediation_server)
 	{
@@ -1913,28 +1959,28 @@ static status_t inherit(private_ike_sa_t *this, private_ike_sa_t *other)
 
 	/* adopt all children */
 	while (other->child_sas->remove_last(other->child_sas,
-		   								 (void**)&child_sa) == SUCCESS)
+										 (void**)&child_sa) == SUCCESS)
 	{
 		this->child_sas->insert_first(this->child_sas, (void*)child_sa);
 	}
-	
+
 	/* move pending tasks to the new IKE_SA */
 	this->task_manager->adopt_tasks(this->task_manager, other->task_manager);
-	
+
 	/* reauthentication timeout survives a rekeying */
 	if (other->stats[STAT_REAUTH])
 	{
-		time_t reauth, delete, now = time(NULL);
-	
+		time_t reauth, delete, now = time_monotonic(NULL);
+
 		this->stats[STAT_REAUTH] = other->stats[STAT_REAUTH];
 		reauth = this->stats[STAT_REAUTH] - now;
 		delete = reauth + this->peer_cfg->get_over_time(this->peer_cfg);
 		this->stats[STAT_DELETE] = this->stats[STAT_REAUTH] + delete;
 		DBG1(DBG_IKE, "rescheduling reauthentication in %ds after rekeying, "
 			 "lifetime reduced to %ds", reauth, delete);
-		charon->scheduler->schedule_job(charon->scheduler, 
+		charon->scheduler->schedule_job(charon->scheduler,
 				(job_t*)rekey_ike_sa_job_create(this->ike_sa_id, TRUE), reauth);
-		charon->scheduler->schedule_job(charon->scheduler, 
+		charon->scheduler->schedule_job(charon->scheduler,
 				(job_t*)delete_ike_sa_job_create(this->ike_sa_id, TRUE), delete);
 	}
 	/* we have to initate here, there may be new tasks to handle */
@@ -1947,30 +1993,30 @@ static status_t inherit(private_ike_sa_t *this, private_ike_sa_t *other)
 static void destroy(private_ike_sa_t *this)
 {
 	attribute_entry_t *entry;
-	
+
 	charon->bus->set_sa(charon->bus, &this->public);
-	
+
 	set_state(this, IKE_DESTROYING);
-	
+
 	/* remove attributes first, as we pass the IKE_SA to the handler */
-	while (this->attributes->remove_last(this->attributes, 
+	while (this->attributes->remove_last(this->attributes,
 										 (void**)&entry) == SUCCESS)
 	{
-		charon->attributes->release(charon->attributes, entry->handler,
-									&this->public, entry->type, entry->data);
+		lib->attributes->release(lib->attributes, entry->handler,
+								 this->other_id, entry->type, entry->data);
 		free(entry->data.ptr);
 		free(entry);
 	}
 	this->attributes->destroy(this->attributes);
-	
+
 	this->child_sas->destroy_offset(this->child_sas, offsetof(child_sa_t, destroy));
-	
+
 	/* unset SA after here to avoid usage by the listeners */
 	charon->bus->set_sa(charon->bus, NULL);
-	
+
 	this->task_manager->destroy(this->task_manager);
 	this->keymat->destroy(this->keymat);
-	
+
 	if (this->my_virtual_ip)
 	{
 		charon->kernel_interface->del_ip(charon->kernel_interface,
@@ -1981,7 +2027,7 @@ static void destroy(private_ike_sa_t *this)
 	{
 		if (this->peer_cfg && this->peer_cfg->get_pool(this->peer_cfg))
 		{
-			charon->attributes->release_address(charon->attributes,
+			lib->attributes->release_address(lib->attributes,
 									this->peer_cfg->get_pool(this->peer_cfg),
 									this->other_virtual_ip, this->other_id);
 		}
@@ -1992,27 +2038,31 @@ static void destroy(private_ike_sa_t *this)
 #ifdef ME
 	if (this->is_mediation_server)
 	{
-		charon->mediation_manager->remove(charon->mediation_manager, this->ike_sa_id);
+		charon->mediation_manager->remove(charon->mediation_manager,
+										  this->ike_sa_id);
 	}
 	DESTROY_IF(this->server_reflexive_host);
 	chunk_free(&this->connect_id);
 #endif /* ME */
 	free(this->nat_detection_dest.ptr);
-	
+
 	DESTROY_IF(this->my_host);
 	DESTROY_IF(this->other_host);
 	DESTROY_IF(this->my_id);
 	DESTROY_IF(this->other_id);
 	DESTROY_IF(this->local_host);
 	DESTROY_IF(this->remote_host);
-	DESTROY_IF(this->eap_identity);
-	
+
 	DESTROY_IF(this->ike_cfg);
 	DESTROY_IF(this->peer_cfg);
 	DESTROY_IF(this->proposal);
 	this->my_auth->destroy(this->my_auth);
 	this->other_auth->destroy(this->other_auth);
-	
+	this->my_auths->destroy_offset(this->my_auths,
+								   offsetof(auth_cfg_t, destroy));
+	this->other_auths->destroy_offset(this->other_auths,
+									  offsetof(auth_cfg_t, destroy));
+
 	this->ike_sa_id->destroy(this->ike_sa_id);
 	free(this);
 }
@@ -2024,7 +2074,7 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
 {
 	private_ike_sa_t *this = malloc_thing(private_ike_sa_t);
 	static u_int32_t unique_id = 0;
-	
+
 	/* Public functions */
 	this->public.get_state = (ike_sa_state_t (*)(ike_sa_t*)) get_state;
 	this->public.set_state = (void (*)(ike_sa_t*,ike_sa_state_t)) set_state;
@@ -2037,6 +2087,8 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
 	this->public.get_peer_cfg = (peer_cfg_t* (*)(ike_sa_t*))get_peer_cfg;
 	this->public.set_peer_cfg = (void (*)(ike_sa_t*,peer_cfg_t*))set_peer_cfg;
 	this->public.get_auth_cfg = (auth_cfg_t*(*)(ike_sa_t*, bool local))get_auth_cfg;
+	this->public.create_auth_cfg_enumerator = (enumerator_t*(*)(ike_sa_t*, bool local))create_auth_cfg_enumerator;
+	this->public.add_auth_cfg = (void(*)(ike_sa_t*, bool local, auth_cfg_t *cfg))add_auth_cfg;
 	this->public.get_proposal = (proposal_t*(*)(ike_sa_t*))get_proposal;
 	this->public.set_proposal = (void(*)(ike_sa_t*, proposal_t *proposal))set_proposal;
 	this->public.get_id = (ike_sa_id_t* (*)(ike_sa_t*)) get_id;
@@ -2050,8 +2102,6 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
 	this->public.set_my_id = (void (*)(ike_sa_t*,identification_t*)) set_my_id;
 	this->public.get_other_id = (identification_t* (*)(ike_sa_t*)) get_other_id;
 	this->public.set_other_id = (void (*)(ike_sa_t*,identification_t*)) set_other_id;
-	this->public.get_eap_identity = (identification_t* (*)(ike_sa_t*)) get_eap_identity;
-	this->public.set_eap_identity = (void (*)(ike_sa_t*,identification_t*)) set_eap_identity;
 	this->public.enable_extension = (void(*)(ike_sa_t*, ike_extension_t extension))enable_extension;
 	this->public.supports_extension = (bool(*)(ike_sa_t*, ike_extension_t extension))supports_extension;
 	this->public.set_condition = (void (*)(ike_sa_t*, ike_condition_t,bool)) set_condition;
@@ -2084,7 +2134,7 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
 	this->public.get_unique_id = (u_int32_t (*)(ike_sa_t*))get_unique_id;
 	this->public.set_virtual_ip = (void (*)(ike_sa_t*,bool,host_t*))set_virtual_ip;
 	this->public.get_virtual_ip = (host_t* (*)(ike_sa_t*,bool))get_virtual_ip;
-	this->public.add_configuration_attribute = (void(*)(ike_sa_t*, configuration_attribute_type_t type, chunk_t data))add_configuration_attribute;
+	this->public.add_configuration_attribute = (void(*)(ike_sa_t*, attribute_handler_t *handler,configuration_attribute_type_t type, chunk_t data))add_configuration_attribute;
 	this->public.set_kmaddress = (void (*)(ike_sa_t*,host_t*,host_t*))set_kmaddress;
 #ifdef ME
 	this->public.act_as_mediation_server = (void (*)(ike_sa_t*)) act_as_mediation_server;
@@ -2097,7 +2147,7 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
 	this->public.callback = (status_t (*)(ike_sa_t*,identification_t*)) callback;
 	this->public.respond = (status_t (*)(ike_sa_t*,identification_t*,chunk_t)) respond;
 #endif /* ME */
-	
+
 	/* initialize private fields */
 	this->ike_sa_id = ike_sa_id->clone(ike_sa_id);
 	this->child_sas = linked_list_create();
@@ -2106,7 +2156,6 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
 	this->other_host = host_create_any(AF_INET);
 	this->my_id = identification_create_from_encoding(ID_ANY, chunk_empty);
 	this->other_id = identification_create_from_encoding(ID_ANY, chunk_empty);
-	this->eap_identity = NULL;
 	this->extensions = 0;
 	this->conditions = 0;
 	this->keymat = keymat_create(ike_sa_id->is_initiator(ike_sa_id));
@@ -2114,11 +2163,13 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
 	this->keepalive_interval = lib->settings->get_time(lib->settings,
 									"charon.keep_alive", KEEPALIVE_INTERVAL);
 	memset(this->stats, 0, sizeof(this->stats));
-	this->stats[STAT_INBOUND] = this->stats[STAT_OUTBOUND] = time(NULL);
+	this->stats[STAT_INBOUND] = this->stats[STAT_OUTBOUND] = time_monotonic(NULL);
 	this->ike_cfg = NULL;
 	this->peer_cfg = NULL;
 	this->my_auth = auth_cfg_create();
 	this->other_auth = auth_cfg_create();
+	this->my_auths = linked_list_create();
+	this->other_auths = linked_list_create();
 	this->proposal = NULL;
 	this->task_manager = task_manager_create(&this->public);
 	this->unique_id = ++unique_id;
@@ -2136,6 +2187,6 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
 	this->server_reflexive_host = NULL;
 	this->connect_id = chunk_empty;
 #endif /* ME */
-	
+
 	return &this->public;
 }