New upstream version 5.7.0

8 files changed, 471 insertions, 72 deletions

diff --git a/src/libcharon/sa/ikev2/tasks/child_create.c b/src/libcharon/sa/ikev2/tasks/child_create.c
index c90af23b9..c7eb0c854 100644
--- a/src/libcharon/sa/ikev2/tasks/child_create.c
+++ b/src/libcharon/sa/ikev2/tasks/child_create.c
@@ -481,12 +481,14 @@ static linked_list_t* narrow_ts(private_child_create_t *this, bool local,
 		this->ike_sa->has_condition(this->ike_sa, cond))
 	{
 		nat = get_transport_nat_ts(this, local, in);
-		ts = this->config->get_traffic_selectors(this->config, local, nat, hosts);
+		ts = this->config->get_traffic_selectors(this->config, local, nat,
+												 hosts, TRUE);
 		nat->destroy_offset(nat, offsetof(traffic_selector_t, destroy));
 	}
 	else
 	{
-		ts = this->config->get_traffic_selectors(this->config, local, in, hosts);
+		ts = this->config->get_traffic_selectors(this->config, local, in,
+												 hosts, TRUE);
 	}
 
 	hosts->destroy(hosts);
@@ -497,8 +499,8 @@ static linked_list_t* narrow_ts(private_child_create_t *this, bool local,
 /**
  * Install a CHILD_SA for usage, return value:
  * - FAILED: no acceptable proposal
- * - INVALID_ARG: diffie hellman group inacceptable
- * - NOT_FOUND: TS inacceptable
+ * - INVALID_ARG: diffie hellman group unacceptable
+ * - NOT_FOUND: TS unacceptable
  */
 static status_t select_and_install(private_child_create_t *this,
 								   bool no_dh, bool ike_auth)
@@ -559,7 +561,7 @@ static status_t select_and_install(private_child_create_t *this,
 		if (this->proposal->get_algorithm(this->proposal, DIFFIE_HELLMAN_GROUP,
 										  &group, NULL))
 		{
-			DBG1(DBG_IKE, "DH group %N inacceptable, requesting %N",
+			DBG1(DBG_IKE, "DH group %N unacceptable, requesting %N",
 				 diffie_hellman_group_names, this->dh_group,
 				 diffie_hellman_group_names, group);
 			this->dh_group = group;
@@ -1075,7 +1077,7 @@ METHOD(task_t, build_i, status_t,
 	if (list->get_count(list))
 	{
 		this->tsi = this->config->get_traffic_selectors(this->config,
-														TRUE, NULL, list);
+														TRUE, NULL, list, TRUE);
 		list->destroy_offset(list, offsetof(host_t, destroy));
 	}
 	else
@@ -1083,12 +1085,12 @@ METHOD(task_t, build_i, status_t,
 		list->destroy(list);
 		list = get_dynamic_hosts(this->ike_sa, TRUE);
 		this->tsi = this->config->get_traffic_selectors(this->config,
-														TRUE, NULL, list);
+														TRUE, NULL, list, TRUE);
 		list->destroy(list);
 	}
 	list = get_dynamic_hosts(this->ike_sa, FALSE);
 	this->tsr = this->config->get_traffic_selectors(this->config,
-													FALSE, NULL, list);
+													FALSE, NULL, list, TRUE);
 	list->destroy(list);
 
 	if (this->packet_tsi)
@@ -1356,7 +1358,7 @@ METHOD(task_t, build_r, status_t,
 	}
 	if (this->config == NULL)
 	{
-		DBG1(DBG_IKE, "traffic selectors %#R === %#R inacceptable",
+		DBG1(DBG_IKE, "traffic selectors %#R === %#R unacceptable",
 			 this->tsr, this->tsi);
 		charon->bus->alert(charon->bus, ALERT_TS_MISMATCH, this->tsi, this->tsr);
 		message->add_notify(message, FALSE, TS_UNACCEPTABLE, chunk_empty);
diff --git a/src/libcharon/sa/ikev2/tasks/ike_auth.c b/src/libcharon/sa/ikev2/tasks/ike_auth.c
index 6b63197d5..b055ff064 100644
--- a/src/libcharon/sa/ikev2/tasks/ike_auth.c
+++ b/src/libcharon/sa/ikev2/tasks/ike_auth.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012-2015 Tobias Brunner
+ * Copyright (C) 2012-2018 Tobias Brunner
  * Copyright (C) 2005-2009 Martin Willi
  * Copyright (C) 2005 Jan Hutter
  * HSR Hochschule fuer Technik Rapperswil
@@ -24,6 +24,7 @@
 #include <encoding/payloads/auth_payload.h>
 #include <encoding/payloads/eap_payload.h>
 #include <encoding/payloads/nonce_payload.h>
+#include <sa/ikev2/keymat_v2.h>
 #include <sa/ikev2/authenticators/eap_authenticator.h>
 #include <processing/jobs/delete_ike_sa_job.h>
 
@@ -60,6 +61,16 @@ struct private_ike_auth_t {
 	chunk_t other_nonce;
 
 	/**
+	 * PPK_ID sent or received
+	 */
+	identification_t *ppk_id;
+
+	/**
+	 * Optional PPK to use
+	 */
+	chunk_t ppk;
+
+	/**
 	 * IKE_SA_INIT message sent by us
 	 */
 	packet_t *my_packet;
@@ -144,7 +155,7 @@ static status_t collect_my_init_data(private_ike_auth_t *this,
 
 	/* get the nonce that was generated in ike_init */
 	nonce = (nonce_payload_t*)message->get_payload(message, PLV2_NONCE);
-	if (nonce == NULL)
+	if (!nonce)
 	{
 		return FAILED;
 	}
@@ -170,7 +181,7 @@ static status_t collect_other_init_data(private_ike_auth_t *this,
 
 	/* get the nonce that was generated in ike_init */
 	nonce = (nonce_payload_t*)message->get_payload(message, PLV2_NONCE);
-	if (nonce == NULL)
+	if (!nonce)
 	{
 		return FAILED;
 	}
@@ -279,19 +290,47 @@ static bool do_another_auth(private_ike_auth_t *this)
 }
 
 /**
+ * Check if this is the first authentication round
+ */
+static bool is_first_round(private_ike_auth_t *this, bool local)
+{
+	enumerator_t *done;
+	auth_cfg_t *cfg;
+
+	if (!this->ike_sa->supports_extension(this->ike_sa, EXT_MULTIPLE_AUTH))
+	{
+		return TRUE;
+	}
+
+	done = this->ike_sa->create_auth_cfg_enumerator(this->ike_sa, local);
+	if (done->enumerate(done, &cfg))
+	{
+		done->destroy(done);
+		return FALSE;
+	}
+	done->destroy(done);
+	return TRUE;
+}
+
+/**
  * Get peer configuration candidates from backends
  */
 static bool load_cfg_candidates(private_ike_auth_t *this)
 {
 	enumerator_t *enumerator;
 	peer_cfg_t *peer_cfg;
+	ike_cfg_t *ike_cfg;
 	host_t *me, *other;
 	identification_t *my_id, *other_id;
+	proposal_t *ike_proposal;
+	bool private;
 
 	me = this->ike_sa->get_my_host(this->ike_sa);
 	other = this->ike_sa->get_other_host(this->ike_sa);
 	my_id = this->ike_sa->get_my_id(this->ike_sa);
 	other_id = this->ike_sa->get_other_id(this->ike_sa);
+	ike_proposal = this->ike_sa->get_proposal(this->ike_sa);
+	private = this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN);
 
 	DBG1(DBG_CFG, "looking for peer configs matching %H[%Y]...%H[%Y]",
 		 me, my_id, other, other_id);
@@ -299,11 +338,18 @@ static bool load_cfg_candidates(private_ike_auth_t *this)
 											me, other, my_id, other_id, IKEV2);
 	while (enumerator->enumerate(enumerator, &peer_cfg))
 	{
+		/* ignore all configs that have no matching IKE proposal */
+		ike_cfg = peer_cfg->get_ike_cfg(peer_cfg);
+		if (!ike_cfg->has_proposal(ike_cfg, ike_proposal, private))
+		{
+			DBG2(DBG_CFG, "ignore candidate '%s' without matching IKE proposal",
+				 peer_cfg->get_name(peer_cfg));
+			continue;
+		}
 		peer_cfg->get_ref(peer_cfg);
-		if (this->peer_cfg == NULL)
+		if (!this->peer_cfg)
 		{	/* best match */
 			this->peer_cfg = peer_cfg;
-			this->ike_sa->set_peer_cfg(this->ike_sa, peer_cfg);
 		}
 		else
 		{
@@ -313,6 +359,7 @@ static bool load_cfg_candidates(private_ike_auth_t *this)
 	enumerator->destroy(enumerator);
 	if (this->peer_cfg)
 	{
+		this->ike_sa->set_peer_cfg(this->ike_sa, this->peer_cfg);
 		DBG1(DBG_CFG, "selected peer config '%s'",
 			 this->peer_cfg->get_name(this->peer_cfg));
 		return TRUE;
@@ -369,7 +416,7 @@ static bool update_cfg_candidates(private_ike_auth_t *this, bool strict)
 			{
 				break;
 			}
-			DBG1(DBG_CFG, "selected peer config '%s' inacceptable: %s",
+			DBG1(DBG_CFG, "selected peer config '%s' unacceptable: %s",
 				 this->peer_cfg->get_name(this->peer_cfg), comply_error);
 			this->peer_cfg->destroy(this->peer_cfg);
 		}
@@ -391,6 +438,149 @@ static bool update_cfg_candidates(private_ike_auth_t *this, bool strict)
 	return this->peer_cfg != NULL;
 }
 
+/**
+ * Currently defined PPK_ID types
+ */
+#define PPK_ID_OPAQUE 1
+#define PPK_ID_FIXED 2
+
+/**
+ * Parse the payload data of the given PPK_IDENTITY notify
+ */
+static bool parse_ppk_identity(notify_payload_t *notify, identification_t **id)
+{
+	chunk_t data;
+
+	data = notify->get_notification_data(notify);
+	if (data.len < 2)
+	{
+		return FALSE;
+	}
+	switch (data.ptr[0])
+	{
+		case PPK_ID_FIXED:
+			data = chunk_skip(data, 1);
+			break;
+		default:
+			return FALSE;
+	}
+	*id = identification_create_from_data(data);
+	return TRUE;
+}
+
+/**
+ * Add a PPK_IDENTITY with the given PPK_ID to the given message
+ */
+static void add_ppk_identity(identification_t *id, message_t *msg)
+{
+	chunk_t data;
+	uint8_t type = PPK_ID_FIXED;
+
+	/* we currently only support one type */
+	data = chunk_cata("cc", chunk_from_thing(type), id->get_encoding(id));
+	msg->add_notify(msg, FALSE, PPK_IDENTITY, data);
+}
+
+/**
+ * Use the given PPK_ID to find a PPK and store it and the ID in the task
+ */
+static bool get_ppk(private_ike_auth_t *this, identification_t *ppk_id)
+{
+	shared_key_t *key;
+
+	key = lib->credmgr->get_shared(lib->credmgr, SHARED_PPK, ppk_id, NULL);
+	if (!key)
+	{
+		if (this->peer_cfg->ppk_required(this->peer_cfg))
+		{
+			DBG1(DBG_CFG, "PPK required but no PPK found for '%Y'", ppk_id);
+			return FALSE;
+		}
+		DBG1(DBG_CFG, "no PPK for '%Y' found, ignored because PPK is not "
+			 "required", ppk_id);
+		return TRUE;
+	}
+	this->ppk = chunk_clone(key->get_key(key));
+	this->ppk_id = ppk_id->clone(ppk_id);
+	key->destroy(key);
+	return TRUE;
+}
+
+/**
+ * Check if we have a PPK available and, if not, whether we require one as
+ * initiator
+ */
+static bool get_ppk_i(private_ike_auth_t *this)
+{
+	identification_t *ppk_id;
+
+	if (!this->ike_sa->supports_extension(this->ike_sa, EXT_PPK))
+	{
+		if (this->peer_cfg->ppk_required(this->peer_cfg))
+		{
+			DBG1(DBG_CFG, "PPK required but peer does not support PPK");
+			return FALSE;
+		}
+		return TRUE;
+	}
+
+	ppk_id = this->peer_cfg->get_ppk_id(this->peer_cfg);
+	if (!ppk_id)
+	{
+		if (this->peer_cfg->ppk_required(this->peer_cfg))
+		{
+			DBG1(DBG_CFG, "PPK required but no PPK_ID configured");
+			return FALSE;
+		}
+		return TRUE;
+	}
+	return get_ppk(this, ppk_id);
+}
+
+/**
+ * Check if we have a PPK available and if not whether we require one as
+ * responder
+ */
+static bool get_ppk_r(private_ike_auth_t *this, message_t *msg)
+{
+	notify_payload_t *notify;
+	identification_t *ppk_id, *ppk_id_cfg;
+	bool result;
+
+	if (!this->ike_sa->supports_extension(this->ike_sa, EXT_PPK))
+	{
+		if (this->peer_cfg->ppk_required(this->peer_cfg))
+		{
+			DBG1(DBG_CFG, "PPK required but peer does not support PPK");
+			return FALSE;
+		}
+		return TRUE;
+	}
+
+	notify = msg->get_notify(msg, PPK_IDENTITY);
+	if (!notify || !parse_ppk_identity(notify, &ppk_id))
+	{
+		if (this->peer_cfg->ppk_required(this->peer_cfg))
+		{
+			DBG1(DBG_CFG, "PPK required but no PPK_IDENTITY received");
+			return FALSE;
+		}
+		return TRUE;
+	}
+
+	ppk_id_cfg = this->peer_cfg->get_ppk_id(this->peer_cfg);
+	if (ppk_id_cfg && !ppk_id->matches(ppk_id, ppk_id_cfg))
+	{
+		DBG1(DBG_CFG, "received PPK_ID '%Y', but require '%Y'", ppk_id,
+			 ppk_id_cfg);
+		ppk_id->destroy(ppk_id);
+		return FALSE;
+	}
+	result = get_ppk(this, ppk_id);
+	ppk_id->destroy(ppk_id);
+	return result;
+}
+
 METHOD(task_t, build_i, status_t,
 	private_ike_auth_t *this, message_t *message)
 {
@@ -401,7 +591,7 @@ METHOD(task_t, build_i, status_t,
 		return collect_my_init_data(this, message);
 	}
 
-	if (this->peer_cfg == NULL)
+	if (!this->peer_cfg)
 	{
 		this->peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
 		this->peer_cfg->get_ref(this->peer_cfg);
@@ -420,6 +610,12 @@ METHOD(task_t, build_i, status_t,
 		/* indicate support for RFC 6311 Message ID synchronization */
 		message->add_notify(message, FALSE, IKEV2_MESSAGE_ID_SYNC_SUPPORTED,
 							chunk_empty);
+		/* only use a PPK in the first round */
+		if (!get_ppk_i(this))
+		{
+			charon->bus->alert(charon->bus, ALERT_LOCAL_AUTH_FAILED);
+			return FAILED;
+		}
 	}
 
 	if (!this->do_another_auth && !this->my_auth)
@@ -428,7 +624,7 @@ METHOD(task_t, build_i, status_t,
 	}
 
 	/* check if an authenticator is in progress */
-	if (this->my_auth == NULL)
+	if (!this->my_auth)
 	{
 		identification_t *idi, *idr = NULL;
 		id_payload_t *id_payload;
@@ -495,6 +691,14 @@ METHOD(task_t, build_i, status_t,
 			return FAILED;
 		}
 	}
+	/* for authentication methods that return NEED_MORE, the PPK will be reset
+	 * in process_i() for messages without PPK_ID notify, so we always set it
+	 * during the first round (afterwards the PPK won't be available) */
+	if (this->ppk.ptr && this->my_auth->use_ppk)
+	{
+		this->my_auth->use_ppk(this->my_auth, this->ppk,
+							!this->peer_cfg->ppk_required(this->peer_cfg));
+	}
 	switch (this->my_auth->build(this->my_auth, message))
 	{
 		case SUCCESS:
@@ -509,6 +713,12 @@ METHOD(task_t, build_i, status_t,
 			return FAILED;
 	}
 
+	/* add a PPK_IDENTITY notify to the message that contains AUTH */
+	if (this->ppk_id && message->get_payload(message, PLV2_AUTH))
+	{
+		add_ppk_identity(this->ppk_id, message);
+	}
+
 	/* check for additional authentication rounds */
 	if (do_another_auth(this))
 	{
@@ -536,7 +746,7 @@ METHOD(task_t, process_r, status_t,
 		return collect_other_init_data(this, message);
 	}
 
-	if (this->my_auth == NULL && this->do_another_auth)
+	if (!this->my_auth && this->do_another_auth)
 	{
 		/* handle (optional) IDr payload, apply proposed identity */
 		id_payload = (id_payload_t*)message->get_payload(message, PLV2_ID_RESPONDER);
@@ -573,7 +783,7 @@ METHOD(task_t, process_r, status_t,
 		}
 	}
 
-	if (this->other_auth == NULL)
+	if (!this->other_auth)
 	{
 		/* handle IDi payload */
 		id_payload = (id_payload_t*)message->get_payload(message, PLV2_ID_INITIATOR);
@@ -588,7 +798,7 @@ METHOD(task_t, process_r, status_t,
 		cfg = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
 		cfg->add(cfg, AUTH_RULE_IDENTITY, id->clone(id));
 
-		if (this->peer_cfg == NULL)
+		if (!this->peer_cfg)
 		{
 			if (!load_cfg_candidates(this))
 			{
@@ -596,14 +806,14 @@ METHOD(task_t, process_r, status_t,
 				return NEED_MORE;
 			}
 		}
-		if (message->get_payload(message, PLV2_AUTH) == NULL)
+		if (!message->get_payload(message, PLV2_AUTH))
 		{	/* before authenticating with EAP, we need a EAP config */
 			cand = get_auth_cfg(this, FALSE);
 			while (!cand || (
 					(uintptr_t)cand->get(cand, AUTH_RULE_EAP_TYPE) == EAP_NAK &&
 					(uintptr_t)cand->get(cand, AUTH_RULE_EAP_VENDOR) == 0))
 			{	/* peer requested EAP, but current config does not match */
-				DBG1(DBG_IKE, "peer requested EAP, config inacceptable");
+				DBG1(DBG_IKE, "peer requested EAP, config unacceptable");
 				this->peer_cfg->destroy(this->peer_cfg);
 				this->peer_cfg = NULL;
 				if (!update_cfg_candidates(this, FALSE))
@@ -642,6 +852,19 @@ METHOD(task_t, process_r, status_t,
 			return NEED_MORE;
 		}
 	}
+	if (message->get_payload(message, PLV2_AUTH) &&
+		is_first_round(this, FALSE))
+	{
+		if (!get_ppk_r(this, message))
+		{
+			this->authentication_failed = TRUE;
+			return NEED_MORE;
+		}
+		else if (this->ppk.ptr && this->other_auth->use_ppk)
+		{
+			this->other_auth->use_ppk(this->other_auth, this->ppk, FALSE);
+		}
+	}
 	switch (this->other_auth->process(this->other_auth, message))
 	{
 		case SUCCESS:
@@ -675,7 +898,7 @@ METHOD(task_t, process_r, status_t,
 		return NEED_MORE;
 	}
 
-	if (message->get_notify(message, ANOTHER_AUTH_FOLLOWS) == NULL)
+	if (!message->get_notify(message, ANOTHER_AUTH_FOLLOWS))
 	{
 		this->expect_another_auth = FALSE;
 		if (!update_cfg_candidates(this, TRUE))
@@ -687,6 +910,37 @@ METHOD(task_t, process_r, status_t,
 	return NEED_MORE;
 }
 
+/**
+ * Clear the PPK and PPK_ID
+ */
+static void clear_ppk(private_ike_auth_t *this)
+{
+	DESTROY_IF(this->ppk_id);
+	this->ppk_id = NULL;
+	chunk_clear(&this->ppk);
+}
+
+/**
+ * Derive new keys and clear the PPK
+ */
+static bool apply_ppk(private_ike_auth_t *this)
+{
+	keymat_v2_t *keymat;
+
+	if (this->ppk.ptr)
+	{
+		keymat = (keymat_v2_t*)this->ike_sa->get_keymat(this->ike_sa);
+		if (!keymat->derive_ike_keys_ppk(keymat, this->ppk))
+		{
+			return FALSE;
+		}
+		DBG1(DBG_CFG, "using PPK for PPK_ID '%Y'", this->ppk_id);
+		this->ike_sa->set_condition(this->ike_sa, COND_PPK, TRUE);
+	}
+	clear_ppk(this);
+	return TRUE;
+}
+
 METHOD(task_t, build_r, status_t,
 	private_ike_auth_t *this, message_t *message)
 {
@@ -703,12 +957,12 @@ METHOD(task_t, build_r, status_t,
 		return collect_my_init_data(this, message);
 	}
 
-	if (this->authentication_failed || this->peer_cfg == NULL)
+	if (this->authentication_failed || !this->peer_cfg)
 	{
 		goto peer_auth_failed;
 	}
 
-	if (this->my_auth == NULL && this->do_another_auth)
+	if (!this->my_auth && this->do_another_auth)
 	{
 		identification_t *id, *id_cfg;
 		id_payload_t *id_payload;
@@ -793,6 +1047,10 @@ METHOD(task_t, build_r, status_t,
 	}
 	if (this->my_auth)
 	{
+		if (this->ppk.ptr && this->my_auth->use_ppk)
+		{
+			this->my_auth->use_ppk(this->my_auth, this->ppk, FALSE);
+		}
 		switch (this->my_auth->build(this->my_auth, message))
 		{
 			case SUCCESS:
@@ -807,6 +1065,16 @@ METHOD(task_t, build_r, status_t,
 		}
 	}
 
+	/* add a PPK_IDENTITY notify and derive new keys and clear the PPK */
+	if (this->ppk.ptr)
+	{
+		message->add_notify(message, FALSE, PPK_IDENTITY, chunk_empty);
+		if (!apply_ppk(this))
+		{
+			goto local_auth_failed;
+		}
+	}
+
 	/* check for additional authentication rounds */
 	if (do_another_auth(this))
 	{
@@ -942,7 +1210,7 @@ METHOD(task_t, process_i, status_t,
 	enumerator_t *enumerator;
 	payload_t *payload;
 	auth_cfg_t *cfg;
-	bool mutual_eap = FALSE;
+	bool mutual_eap = FALSE, ppk_id_received = FALSE;
 
 	if (message->get_exchange_type(message) == IKE_SA_INIT)
 	{
@@ -998,6 +1266,9 @@ METHOD(task_t, process_i, status_t,
 					this->ike_sa->enable_extension(this->ike_sa,
 												   EXT_IKE_MESSAGE_ID_SYNC);
 					break;
+				case PPK_IDENTITY:
+					ppk_id_received = TRUE;
+					break;
 				default:
 				{
 					if (type <= 16383)
@@ -1019,7 +1290,7 @@ METHOD(task_t, process_i, status_t,
 
 	if (this->expect_another_auth)
 	{
-		if (this->other_auth == NULL)
+		if (!this->other_auth)
 		{
 			id_payload_t *id_payload;
 			identification_t *id;
@@ -1059,6 +1330,11 @@ METHOD(task_t, process_i, status_t,
 		}
 		if (this->other_auth)
 		{
+			if (ppk_id_received && is_first_round(this, FALSE) &&
+				this->other_auth->use_ppk)
+			{
+				this->other_auth->use_ppk(this->other_auth, this->ppk, FALSE);
+			}
 			switch (this->other_auth->process(this->other_auth, message))
 			{
 				case SUCCESS:
@@ -1094,6 +1370,14 @@ METHOD(task_t, process_i, status_t,
 
 	if (this->my_auth)
 	{
+		/* while we already set the PPK in build_i(), we MUST not use it if
+		 * the peer did not reply with a PPK_ID notify */
+		if (this->ppk.ptr && this->my_auth->use_ppk)
+		{
+			this->my_auth->use_ppk(this->my_auth,
+								   ppk_id_received ? this->ppk : chunk_empty,
+								   FALSE);
+		}
 		switch (this->my_auth->process(this->my_auth, message))
 		{
 			case SUCCESS:
@@ -1109,11 +1393,29 @@ METHOD(task_t, process_i, status_t,
 			case NEED_MORE:
 				break;
 			default:
-				charon->bus->alert(charon->bus, ALERT_LOCAL_AUTH_FAILED);
-				send_auth_failed_informational(this, message);
-				return FAILED;
+				goto local_auth_failed;
+		}
+	}
+
+	/* change keys and clear PPK after we are done with our authentication, so
+	 * we only explicitly use it for the first round, afterwards we just use the
+	 * changed SK_p keys implicitly */
+	if (!this->my_auth && this->ppk_id)
+	{
+		if (ppk_id_received)
+		{
+			if (!apply_ppk(this))
+			{
+				goto local_auth_failed;
+			}
+		}
+		else
+		{
+			DBG1(DBG_CFG, "peer didn't use PPK for PPK_ID '%Y'", this->ppk_id);
 		}
+		clear_ppk(this);
 	}
+
 	if (mutual_eap)
 	{
 		if (!this->my_auth || !this->my_auth->is_mutual(this->my_auth))
@@ -1124,7 +1426,7 @@ METHOD(task_t, process_i, status_t,
 		DBG1(DBG_IKE, "allow mutual EAP-only authentication");
 	}
 
-	if (message->get_notify(message, ANOTHER_AUTH_FOLLOWS) == NULL)
+	if (!message->get_notify(message, ANOTHER_AUTH_FOLLOWS))
 	{
 		this->expect_another_auth = FALSE;
 	}
@@ -1162,6 +1464,10 @@ peer_auth_failed:
 	charon->bus->alert(charon->bus, ALERT_PEER_AUTH_FAILED);
 	send_auth_failed_informational(this, message);
 	return FAILED;
+local_auth_failed:
+	charon->bus->alert(charon->bus, ALERT_LOCAL_AUTH_FAILED);
+	send_auth_failed_informational(this, message);
+	return FAILED;
 }
 
 METHOD(task_t, get_type, task_type_t,
@@ -1173,6 +1479,7 @@ METHOD(task_t, get_type, task_type_t,
 METHOD(task_t, migrate, void,
 	private_ike_auth_t *this, ike_sa_t *ike_sa)
 {
+	clear_ppk(this);
 	chunk_free(&this->my_nonce);
 	chunk_free(&this->other_nonce);
 	DESTROY_IF(this->my_packet);
@@ -1199,6 +1506,7 @@ METHOD(task_t, migrate, void,
 METHOD(task_t, destroy, void,
 	private_ike_auth_t *this)
 {
+	clear_ppk(this);
 	chunk_free(&this->my_nonce);
 	chunk_free(&this->other_nonce);
 	DESTROY_IF(this->my_packet);
diff --git a/src/libcharon/sa/ikev2/tasks/ike_auth_lifetime.h b/src/libcharon/sa/ikev2/tasks/ike_auth_lifetime.h
index f6862ca27..fd14e9faf 100644
--- a/src/libcharon/sa/ikev2/tasks/ike_auth_lifetime.h
+++ b/src/libcharon/sa/ikev2/tasks/ike_auth_lifetime.h
@@ -45,7 +45,7 @@ struct ike_auth_lifetime_t {
  * Create a new TASK_IKE_AUTH_LIFETIME task.
  *
  * @param ike_sa		IKE_SA this task works for
- * @param initiator		TRUE if taks is initiated by us
+ * @param initiator		TRUE if task is initiated by us
  * @return				ike_auth_lifetime task to handle by the task_manager
  */
 ike_auth_lifetime_t *ike_auth_lifetime_create(ike_sa_t *ike_sa, bool initiator);
diff --git a/src/libcharon/sa/ikev2/tasks/ike_init.c b/src/libcharon/sa/ikev2/tasks/ike_init.c
index 3d73d728b..307d99264 100644
--- a/src/libcharon/sa/ikev2/tasks/ike_init.c
+++ b/src/libcharon/sa/ikev2/tasks/ike_init.c
@@ -55,11 +55,6 @@ struct private_ike_init_t {
 	bool initiator;
 
 	/**
-	 * IKE config to establish
-	 */
-	ike_cfg_t *config;
-
-	/**
 	 * diffie hellman group to use
 	 */
 	diffie_hellman_group_t dh_group;
@@ -275,6 +270,38 @@ static void handle_supported_hash_algorithms(private_ike_init_t *this,
 }
 
 /**
+ * Check whether to send a USE_PPK notify
+ */
+static bool send_use_ppk(private_ike_init_t *this)
+{
+	peer_cfg_t *peer;
+	enumerator_t *keys;
+	shared_key_t *key;
+	bool use_ppk = FALSE;
+
+	if (this->initiator)
+	{
+		peer = this->ike_sa->get_peer_cfg(this->ike_sa);
+		if (peer->get_ppk_id(peer))
+		{
+			use_ppk = TRUE;
+		}
+	}
+	else if (this->ike_sa->supports_extension(this->ike_sa, EXT_PPK))
+	{
+		/* check if we have at least one PPK available */
+		keys = lib->credmgr->create_shared_enumerator(lib->credmgr, SHARED_PPK,
+													  NULL, NULL);
+		if (keys->enumerate(keys, &key, NULL, NULL))
+		{
+			use_ppk = TRUE;
+		}
+		keys->destroy(keys);
+	}
+	return use_ppk;
+}
+
+/**
  * build the payloads for the message
  */
 static bool build_payloads(private_ike_init_t *this, message_t *message)
@@ -286,14 +313,15 @@ static bool build_payloads(private_ike_init_t *this, message_t *message)
 	ike_sa_id_t *id;
 	proposal_t *proposal;
 	enumerator_t *enumerator;
+	ike_cfg_t *ike_cfg;
 
 	id = this->ike_sa->get_id(this->ike_sa);
 
-	this->config = this->ike_sa->get_ike_cfg(this->ike_sa);
+	ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
 
 	if (this->initiator)
 	{
-		proposal_list = this->config->get_proposals(this->config);
+		proposal_list = ike_cfg->get_proposals(ike_cfg);
 		other_dh_groups = linked_list_create();
 		enumerator = proposal_list->create_enumerator(proposal_list);
 		while (enumerator->enumerate(enumerator, (void**)&proposal))
@@ -334,8 +362,6 @@ static bool build_payloads(private_ike_init_t *this, message_t *message)
 	}
 	message->add_payload(message, (payload_t*)sa_payload);
 
-	nonce_payload = nonce_payload_create(PLV2_NONCE);
-	nonce_payload->set_nonce(nonce_payload, this->my_nonce);
 	ke_payload = ke_payload_create_from_diffie_hellman(PLV2_KEY_EXCHANGE,
 													   this->dh);
 	if (!ke_payload)
@@ -343,6 +369,8 @@ static bool build_payloads(private_ike_init_t *this, message_t *message)
 		DBG1(DBG_IKE, "creating KE payload failed");
 		return FALSE;
 	}
+	nonce_payload = nonce_payload_create(PLV2_NONCE);
+	nonce_payload->set_nonce(nonce_payload, this->my_nonce);
 
 	if (this->old_sa)
 	{	/* payload order differs if we are rekeying */
@@ -357,7 +385,7 @@ static bool build_payloads(private_ike_init_t *this, message_t *message)
 
 	/* negotiate fragmentation if we are not rekeying */
 	if (!this->old_sa &&
-		 this->config->fragmentation(this->config) != FRAGMENTATION_NO)
+		 ike_cfg->fragmentation(ike_cfg) != FRAGMENTATION_NO)
 	{
 		if (this->initiator ||
 			this->ike_sa->supports_extension(this->ike_sa,
@@ -400,10 +428,77 @@ static bool build_payloads(private_ike_init_t *this, message_t *message)
 								chunk_empty);
 		}
 	}
+	/* notify the peer if we want to use/support PPK */
+	if (!this->old_sa && send_use_ppk(this))
+	{
+		message->add_notify(message, FALSE, USE_PPK, chunk_empty);
+	}
 	return TRUE;
 }
 
 /**
+ * Process the SA payload and select a proposal
+ */
+static void process_sa_payload(private_ike_init_t *this, message_t *message,
+							   sa_payload_t *sa_payload)
+{
+	ike_cfg_t *ike_cfg, *cfg, *alt_cfg = NULL;
+	enumerator_t *enumerator;
+	linked_list_t *proposal_list;
+	host_t *me, *other;
+	bool private, prefer_configured;
+
+	ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
+
+	proposal_list = sa_payload->get_proposals(sa_payload);
+	private = this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN);
+	prefer_configured = lib->settings->get_bool(lib->settings,
+							"%s.prefer_configured_proposals", TRUE, lib->ns);
+
+	this->proposal = ike_cfg->select_proposal(ike_cfg, proposal_list, private,
+											  prefer_configured);
+	if (!this->proposal)
+	{
+		if (!this->initiator && !this->old_sa)
+		{
+			me = message->get_destination(message);
+			other = message->get_source(message);
+			enumerator = charon->backends->create_ike_cfg_enumerator(
+											charon->backends, me, other, IKEV2);
+			while (enumerator->enumerate(enumerator, &cfg))
+			{
+				if (ike_cfg == cfg)
+				{	/* already tried and failed */
+					continue;
+				}
+				DBG1(DBG_IKE, "no matching proposal found, trying alternative "
+					 "config");
+				this->proposal = cfg->select_proposal(cfg, proposal_list,
+													private, prefer_configured);
+				if (this->proposal)
+				{
+					alt_cfg = cfg->get_ref(cfg);
+					break;
+				}
+			}
+			enumerator->destroy(enumerator);
+		}
+		if (alt_cfg)
+		{
+			this->ike_sa->set_ike_cfg(this->ike_sa, alt_cfg);
+			alt_cfg->destroy(alt_cfg);
+		}
+		else
+		{
+			charon->bus->alert(charon->bus, ALERT_PROPOSAL_MISMATCH_IKE,
+							   proposal_list);
+		}
+	}
+	proposal_list->destroy_offset(proposal_list,
+								  offsetof(proposal_t, destroy));
+}
+
+/**
  * Read payloads from message
  */
 static void process_payloads(private_ike_init_t *this, message_t *message)
@@ -419,24 +514,7 @@ static void process_payloads(private_ike_init_t *this, message_t *message)
 		{
 			case PLV2_SECURITY_ASSOCIATION:
 			{
-				sa_payload_t *sa_payload = (sa_payload_t*)payload;
-				linked_list_t *proposal_list;
-				bool private, prefer_configured;
-
-				proposal_list = sa_payload->get_proposals(sa_payload);
-				private = this->ike_sa->supports_extension(this->ike_sa,
-														   EXT_STRONGSWAN);
-				prefer_configured = lib->settings->get_bool(lib->settings,
-							"%s.prefer_configured_proposals", TRUE, lib->ns);
-				this->proposal = this->config->select_proposal(this->config,
-									proposal_list, private, prefer_configured);
-				if (!this->proposal)
-				{
-					charon->bus->alert(charon->bus, ALERT_PROPOSAL_MISMATCH_IKE,
-									   proposal_list);
-				}
-				proposal_list->destroy_offset(proposal_list,
-											  offsetof(proposal_t, destroy));
+				process_sa_payload(this, message, (sa_payload_t*)payload);
 				break;
 			}
 			case PLV2_KEY_EXCHANGE:
@@ -469,6 +547,13 @@ static void process_payloads(private_ike_init_t *this, message_t *message)
 							handle_supported_hash_algorithms(this, notify);
 						}
 						break;
+					case USE_PPK:
+						if (!this->old_sa)
+						{
+							this->ike_sa->enable_extension(this->ike_sa,
+														   EXT_PPK);
+						}
+						break;
 					case REDIRECTED_FROM:
 					{
 						identification_t *gateway;
@@ -533,7 +618,10 @@ static void process_payloads(private_ike_init_t *this, message_t *message)
 METHOD(task_t, build_i, status_t,
 	private_ike_init_t *this, message_t *message)
 {
-	this->config = this->ike_sa->get_ike_cfg(this->ike_sa);
+	ike_cfg_t *ike_cfg;
+
+	ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
+
 	DBG0(DBG_IKE, "initiating IKE_SA %s[%d] to %H",
 		 this->ike_sa->get_name(this->ike_sa),
 		 this->ike_sa->get_unique_id(this->ike_sa),
@@ -563,12 +651,12 @@ METHOD(task_t, build_i, status_t,
 			}
 			else
 			{	/* this shouldn't happen, but let's be safe */
-				this->dh_group = this->config->get_dh_group(this->config);
+				this->dh_group = ike_cfg->get_dh_group(ike_cfg);
 			}
 		}
 		else
 		{
-			this->dh_group = this->config->get_dh_group(this->config);
+			this->dh_group = ike_cfg->get_dh_group(ike_cfg);
 		}
 		this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat,
 												  this->dh_group);
@@ -627,7 +715,6 @@ METHOD(task_t, build_i, status_t,
 METHOD(task_t, process_r,  status_t,
 	private_ike_init_t *this, message_t *message)
 {
-	this->config = this->ike_sa->get_ike_cfg(this->ike_sa);
 	DBG0(DBG_IKE, "%H is initiating an IKE_SA", message->get_source(message));
 	this->ike_sa->set_state(this->ike_sa, IKE_CONNECTING);
 
@@ -699,7 +786,7 @@ METHOD(task_t, build_r, status_t,
 	if (this->proposal == NULL ||
 		this->other_nonce.len == 0 || this->my_nonce.len == 0)
 	{
-		DBG1(DBG_IKE, "received proposals inacceptable");
+		DBG1(DBG_IKE, "received proposals unacceptable");
 		message->add_notify(message, TRUE, NO_PROPOSAL_CHOSEN, chunk_empty);
 		return FAILED;
 	}
@@ -728,7 +815,7 @@ METHOD(task_t, build_r, status_t,
 		if (this->proposal->get_algorithm(this->proposal, DIFFIE_HELLMAN_GROUP,
 										  &group, NULL))
 		{
-			DBG1(DBG_IKE, "DH group %N inacceptable, requesting %N",
+			DBG1(DBG_IKE, "DH group %N unacceptable, requesting %N",
 				 diffie_hellman_group_names, this->dh_group,
 				 diffie_hellman_group_names, group);
 			this->dh_group = group;
@@ -770,12 +857,14 @@ METHOD(task_t, build_r, status_t,
  */
 static void raise_alerts(private_ike_init_t *this, notify_type_t type)
 {
+	ike_cfg_t *ike_cfg;
 	linked_list_t *list;
 
 	switch (type)
 	{
 		case NO_PROPOSAL_CHOSEN:
-			list = this->config->get_proposals(this->config);
+			ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
+			list = ike_cfg->get_proposals(ike_cfg);
 			charon->bus->alert(charon->bus, ALERT_PROPOSAL_MISMATCH_IKE, list);
 			list->destroy_offset(list, offsetof(proposal_t, destroy));
 			break;
diff --git a/src/libcharon/sa/ikev2/tasks/ike_mobike.c b/src/libcharon/sa/ikev2/tasks/ike_mobike.c
index fe41a1cac..b2ad0a02a 100644
--- a/src/libcharon/sa/ikev2/tasks/ike_mobike.c
+++ b/src/libcharon/sa/ikev2/tasks/ike_mobike.c
@@ -193,7 +193,7 @@ static void process_payloads(private_ike_mobike_t *this, message_t *message)
 			case NAT_DETECTION_DESTINATION_IP:
 			{
 				/* NAT check in this MOBIKE exchange, create subtask for it */
-				if (this->natd == NULL)
+				if (!this->natd)
 				{
 					this->natd = ike_natd_create(this->ike_sa, this->initiator);
 				}
@@ -648,7 +648,7 @@ METHOD(ike_mobike_t, roam, void,
 METHOD(ike_mobike_t, dpd, void,
 	   private_ike_mobike_t *this)
 {
-	if (!this->natd)
+	if (!this->natd && this->ike_sa->has_condition(this->ike_sa, COND_NAT_HERE))
 	{
 		this->natd = ike_natd_create(this->ike_sa, this->initiator);
 	}
diff --git a/src/libcharon/sa/ikev2/tasks/ike_mobike.h b/src/libcharon/sa/ikev2/tasks/ike_mobike.h
index 288b87178..8789ac0af 100644
--- a/src/libcharon/sa/ikev2/tasks/ike_mobike.h
+++ b/src/libcharon/sa/ikev2/tasks/ike_mobike.h
@@ -91,7 +91,7 @@ struct ike_mobike_t {
  * Create a new ike_mobike task.
  *
  * @param ike_sa		IKE_SA this task works for
- * @param initiator		TRUE if taks is initiated by us
+ * @param initiator		TRUE if task is initiated by us
  * @return				ike_mobike task to handle by the task_manager
  */
 ike_mobike_t *ike_mobike_create(ike_sa_t *ike_sa, bool initiator);
diff --git a/src/libcharon/sa/ikev2/tasks/ike_rekey.c b/src/libcharon/sa/ikev2/tasks/ike_rekey.c
index 11123b415..57f9a797e 100644
--- a/src/libcharon/sa/ikev2/tasks/ike_rekey.c
+++ b/src/libcharon/sa/ikev2/tasks/ike_rekey.c
@@ -259,7 +259,7 @@ METHOD(task_t, build_r, status_t,
 	}
 	if (this->new_sa == NULL)
 	{
-		/* IKE_SA/a CHILD_SA is in an inacceptable state, deny rekeying */
+		/* IKE_SA/a CHILD_SA is in an unacceptable state, deny rekeying */
 		message->add_notify(message, TRUE, NO_PROPOSAL_CHOSEN, chunk_empty);
 		return SUCCESS;
 	}
diff --git a/src/libcharon/sa/ikev2/tasks/ike_vendor.c b/src/libcharon/sa/ikev2/tasks/ike_vendor.c
index 8d8969ea0..e81a18a14 100644
--- a/src/libcharon/sa/ikev2/tasks/ike_vendor.c
+++ b/src/libcharon/sa/ikev2/tasks/ike_vendor.c
@@ -59,7 +59,7 @@ struct private_ike_vendor_t {
 	ike_sa_t *ike_sa;
 
 	/**
-	 * Are we the inititator of this task
+	 * Are we the initiator of this task
 	 */
 	bool initiator;
 };