Imported Upstream version 5.0.1

1 files changed, 0 insertions, 2527 deletions

diff --git a/src/pluto/demux.c b/src/pluto/demux.c
deleted file mode 100644
index 612e0813c..000000000
--- a/src/pluto/demux.c
+++ /dev/null
@@ -1,2527 +0,0 @@
-/* demultiplex incoming IKE messages
- * Copyright (C) 1997 Angelos D. Keromytis.
- * Copyright (C) 1998-2002  D. Hugh Redelmeier.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-/* Ordering Constraints on Payloads
- *
- * rfc2409: The Internet Key Exchange (IKE)
- *
- * 5 Exchanges:
- *   "The SA payload MUST precede all other payloads in a phase 1 exchange."
- *
- *   "Except where otherwise noted, there are no requirements for ISAKMP
- *    payloads in any message to be in any particular order."
- *
- * 5.3 Phase 1 Authenticated With a Revised Mode of Public Key Encryption:
- *
- *   "If the HASH payload is sent it MUST be the first payload of the
- *    second message exchange and MUST be followed by the encrypted
- *    nonce. If the HASH payload is not sent, the first payload of the
- *    second message exchange MUST be the encrypted nonce."
- *
- *   "Save the requirements on the location of the optional HASH payload
- *    and the mandatory nonce payload there are no further payload
- *    requirements. All payloads-- in whatever order-- following the
- *    encrypted nonce MUST be encrypted with Ke_i or Ke_r depending on the
- *    direction."
- *
- * 5.5 Phase 2 - Quick Mode
- *
- *   "In Quick Mode, a HASH payload MUST immediately follow the ISAKMP
- *    header and a SA payload MUST immediately follow the HASH."
- *   [NOTE: there may be more than one SA payload, so this is not
- *    totally reasonable.  Probably all SAs should be so constrained.]
- *
- *   "If ISAKMP is acting as a client negotiator on behalf of another
- *    party, the identities of the parties MUST be passed as IDci and
- *    then IDcr."
- *
- *   "With the exception of the HASH, SA, and the optional ID payloads,
- *    there are no payload ordering restrictions on Quick Mode."
- */
-
-/* Unfolding of Identity -- a central mystery
- *
- * This concerns Phase 1 identities, those of the IKE hosts.
- * These are the only ones that are authenticated.  Phase 2
- * identities are for IPsec SAs.
- *
- * There are three case of interest:
- *
- * (1) We initiate, based on a whack command specifying a Connection.
- *     We know the identity of the peer from the Connection.
- *
- * (2) (to be implemented) we initiate based on a flow from our client
- *     to some IP address.
- *     We immediately know one of the peer's client IP addresses from
- *     the flow.  We must use this to figure out the peer's IP address
- *     and Id.  To be solved.
- *
- * (3) We respond to an IKE negotiation.
- *     We immediately know the peer's IP address.
- *     We get an ID Payload in Main I2.
- *
- *     Unfortunately, this is too late for a number of things:
- *     - the ISAKMP SA proposals have already been made (Main I1)
- *       AND one accepted (Main R1)
- *     - the SA includes a specification of the type of ID
- *       authentication so this is negotiated without being told the ID.
- *     - with Preshared Key authentication, Main I2 is encrypted
- *       using the key, so it cannot be decoded to reveal the ID
- *       without knowing (or guessing) which key to use.
- *
- *     There are three reasonable choices here for the responder:
- *     + assume that the initiator is making wise offers since it
- *       knows the IDs involved.  We can balk later (but not gracefully)
- *       when we find the actual initiator ID
- *     + attempt to infer identity by IP address.  Again, we can balk
- *       when the true identity is revealed.  Actually, it is enough
- *       to infer properties of the identity (eg. SA properties and
- *       PSK, if needed).
- *     + make all properties universal so discrimination based on
- *       identity isn't required.  For example, always accept the same
- *       kinds of encryption.  Accept Public Key Id authentication
- *       since the Initiator presumably has our public key and thinks
- *       we must have / can find his.  This approach is weakest
- *       for preshared key since the actual key must be known to
- *       decrypt the Initiator's ID Payload.
- *     These choices can be blended.  For example, a class of Identities
- *     can be inferred, sufficient to select a preshared key but not
- *     sufficient to infer a unique identity.
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <stddef.h>
-#include <string.h>
-#include <unistd.h>
-#include <errno.h>
-#include <sys/types.h>
-#include <sys/time.h>   /* only used for belt-and-suspenders select call */
-#include <sys/poll.h>   /* only used for forensic poll call */
-#include <sys/socket.h>
-#include <sys/ioctl.h>
-#include <netinet/in.h>
-#include <arpa/inet.h>
-#include <sys/queue.h>
-
-#if defined(IP_RECVERR) && defined(MSG_ERRQUEUE)
-#  include <asm/types.h>        /* for __u8, __u32 */
-#  include <linux/errqueue.h>
-#  include <sys/uio.h>  /* struct iovec */
-#endif
-
-#include <freeswan.h>
-
-#include "constants.h"
-#include "defs.h"
-#include "cookie.h"
-#include "connections.h"
-#include "state.h"
-#include "packet.h"
-#include "crypto.h"
-#include "ike_alg.h"
-#include "log.h"
-#include "demux.h"      /* needs packet.h */
-#include "ipsec_doi.h"  /* needs demux.h and state.h */
-#include "timer.h"
-#include "whack.h"      /* requires connections.h */
-#include "server.h"
-#include "nat_traversal.h"
-#include "vendor.h"
-#include "modecfg.h"
-
-/* This file does basic header checking and demux of
- * incoming packets.
- */
-
-/* forward declarations */
-static bool read_packet(struct msg_digest *md);
-static void process_packet(struct msg_digest **mdp);
-
-/* Reply messages are built in this buffer.
- * Only one state transition function can be using it at a time
- * so suspended STFs must save and restore it.
- * It could be an auto variable of complete_state_transition except for the fact
- * that when a suspended STF resumes, its reply message buffer
- * must be at the same location -- there are pointers into it.
- */
-u_int8_t reply_buffer[MAX_OUTPUT_UDP_SIZE];
-
-/* state_microcode is a tuple of information parameterizing certain
- * centralized processing of a packet.  For example, it roughly
- * specifies what payloads are expected in this message.
- * The microcode is selected primarily based on the state.
- * In Phase 1, the payload structure often depends on the
- * authentication technique, so that too plays a part in selecting
- * the state_microcode to use.
- */
-
-struct state_microcode {
-	enum state_kind state, next_state;
-	lset_t flags;
-	lset_t req_payloads;        /* required payloads (allows just one) */
-	lset_t opt_payloads;        /* optional payloads (any mumber) */
-	/* if not ISAKMP_NEXT_NONE, process_packet will emit HDR with this as np */
-	u_int8_t first_out_payload;
-	enum event_type timeout_event;
-	state_transition_fn *processor;
-};
-
-/* State Microcode Flags, in several groups */
-
-/* Oakley Auth values: to which auth values does this entry apply?
- * Most entries will use SMF_ALL_AUTH because they apply to all.
- * Note: SMF_ALL_AUTH matches 0 for those circumstances when no auth
- * has been set.
- */
-#define SMF_ALL_AUTH    LRANGE(0, OAKLEY_AUTH_ROOF-1)
-#define SMF_PSK_AUTH    LELEM(OAKLEY_PRESHARED_KEY)
-#define SMF_DS_AUTH     (LELEM(OAKLEY_DSS_SIG)   | LELEM(OAKLEY_RSA_SIG)   | \
-						 LELEM(OAKLEY_ECDSA_SIG) | LELEM(OAKLEY_ECDSA_256) | \
-						 LELEM(OAKLEY_ECDSA_384) | LELEM(OAKLEY_ECDSA_521))
-#define SMF_PKE_AUTH    (LELEM(OAKLEY_RSA_ENC) | LELEM(OAKLEY_ELGAMAL_ENC))
-#define SMF_RPKE_AUTH   (LELEM(OAKLEY_RSA_ENC_REV) | LELEM(OAKLEY_ELGAMAL_ENC_REV))
-
-/* misc flags */
-
-#define SMF_INITIATOR   LELEM(OAKLEY_AUTH_ROOF + 0)
-#define SMF_FIRST_ENCRYPTED_INPUT       LELEM(OAKLEY_AUTH_ROOF + 1)
-#define SMF_INPUT_ENCRYPTED     LELEM(OAKLEY_AUTH_ROOF + 2)
-#define SMF_OUTPUT_ENCRYPTED    LELEM(OAKLEY_AUTH_ROOF + 3)
-#define SMF_RETRANSMIT_ON_DUPLICATE     LELEM(OAKLEY_AUTH_ROOF + 4)
-
-#define SMF_ENCRYPTED (SMF_INPUT_ENCRYPTED | SMF_OUTPUT_ENCRYPTED)
-
-/* this state generates a reply message */
-#define SMF_REPLY   LELEM(OAKLEY_AUTH_ROOF + 5)
-
-/* this state completes P1, so any pending P2 negotiations should start */
-#define SMF_RELEASE_PENDING_P2  LELEM(OAKLEY_AUTH_ROOF + 6)
-
-/* end of flags */
-
-
-static state_transition_fn      /* forward declaration */
-	unexpected,
-	informational;
-
-/* state_microcode_table is a table of all state_microcode tuples.
- * It must be in order of state (the first element).
- * After initialization, ike_microcode_index[s] points to the
- * first entry in state_microcode_table for state s.
- * Remember that each state name in Main or Quick Mode describes
- * what has happened in the past, not what this message is.
- */
-
-static const struct state_microcode
-	*ike_microcode_index[STATE_IKE_ROOF - STATE_IKE_FLOOR];
-
-static const struct state_microcode state_microcode_table[] = {
-#define PT(n) ISAKMP_NEXT_##n
-#define P(n) LELEM(PT(n))
-
-	/***** Phase 1 Main Mode *****/
-
-	/* No state for main_outI1: --> HDR, SA */
-
-	/* STATE_MAIN_R0: I1 --> R1
-	 * HDR, SA --> HDR, SA
-	 */
-	{ STATE_MAIN_R0, STATE_MAIN_R1
-	, SMF_ALL_AUTH | SMF_REPLY
-	, P(SA), P(VID) | P(CR), PT(NONE)
-	, EVENT_RETRANSMIT, main_inI1_outR1},
-
-	/* STATE_MAIN_I1: R1 --> I2
-	 * HDR, SA --> auth dependent
-	 * SMF_PSK_AUTH, SMF_DS_AUTH: --> HDR, KE, Ni
-	 * SMF_PKE_AUTH:
-	 *  --> HDR, KE, [ HASH(1), ] <IDi1_b>PubKey_r, <Ni_b>PubKey_r
-	 * SMF_RPKE_AUTH:
-	 *  --> HDR, [ HASH(1), ] <Ni_b>Pubkey_r, <KE_b>Ke_i, <IDi1_b>Ke_i [,<<Cert-I_b>Ke_i]
-	 * Note: since we don't know auth at start, we cannot differentiate
-	 * microcode entries based on it.
-	 */
-	{ STATE_MAIN_I1, STATE_MAIN_I2
-	, SMF_ALL_AUTH | SMF_INITIATOR | SMF_REPLY
-	, P(SA), P(VID) | P(CR), PT(NONE) /* don't know yet */
-	, EVENT_RETRANSMIT, main_inR1_outI2 },
-
-	/* STATE_MAIN_R1: I2 --> R2
-	 * SMF_PSK_AUTH, SMF_DS_AUTH: HDR, KE, Ni --> HDR, KE, Nr
-	 * SMF_PKE_AUTH: HDR, KE, [ HASH(1), ] <IDi1_b>PubKey_r, <Ni_b>PubKey_r
-	 *      --> HDR, KE, <IDr1_b>PubKey_i, <Nr_b>PubKey_i
-	 * SMF_RPKE_AUTH:
-	 *      HDR, [ HASH(1), ] <Ni_b>Pubkey_r, <KE_b>Ke_i, <IDi1_b>Ke_i [,<<Cert-I_b>Ke_i]
-	 *      --> HDR, <Nr_b>PubKey_i, <KE_b>Ke_r, <IDr1_b>Ke_r
-	 */
-	{ STATE_MAIN_R1, STATE_MAIN_R2
-	, SMF_PSK_AUTH | SMF_DS_AUTH | SMF_REPLY
-	, P(KE) | P(NONCE), P(VID) | P(CR) | P(NATD_RFC), PT(KE)
-	, EVENT_RETRANSMIT, main_inI2_outR2 },
-
-	{ STATE_MAIN_R1, STATE_UNDEFINED
-	, SMF_PKE_AUTH | SMF_REPLY
-	, P(KE) | P(ID) | P(NONCE), P(VID) | P(CR) | P(HASH), PT(KE)
-	, EVENT_RETRANSMIT, unexpected /* ??? not yet implemented */ },
-
-	{ STATE_MAIN_R1, STATE_UNDEFINED
-	, SMF_RPKE_AUTH | SMF_REPLY
-	, P(NONCE) | P(KE) | P(ID), P(VID) | P(CR) | P(HASH) | P(CERT), PT(NONCE)
-	, EVENT_RETRANSMIT, unexpected /* ??? not yet implemented */ },
-
-	/* for states from here on, output message must be encrypted */
-
-	/* STATE_MAIN_I2: R2 --> I3
-	 * SMF_PSK_AUTH: HDR, KE, Nr --> HDR*, IDi1, HASH_I
-	 * SMF_DS_AUTH: HDR, KE, Nr --> HDR*, IDi1, [ CERT, ] SIG_I
-	 * SMF_PKE_AUTH: HDR, KE, <IDr1_b>PubKey_i, <Nr_b>PubKey_i
-	 *      --> HDR*, HASH_I
-	 * SMF_RPKE_AUTH: HDR, <Nr_b>PubKey_i, <KE_b>Ke_r, <IDr1_b>Ke_r
-	 *      --> HDR*, HASH_I
-	 */
-	{ STATE_MAIN_I2, STATE_MAIN_I3
-	, SMF_PSK_AUTH | SMF_DS_AUTH | SMF_INITIATOR | SMF_OUTPUT_ENCRYPTED | SMF_REPLY
-	, P(KE) | P(NONCE), P(VID) | P(CR) | P(NATD_RFC), PT(ID)
-	, EVENT_RETRANSMIT, main_inR2_outI3 },
-
-	{ STATE_MAIN_I2, STATE_UNDEFINED
-	, SMF_PKE_AUTH | SMF_INITIATOR | SMF_OUTPUT_ENCRYPTED | SMF_REPLY
-	, P(KE) | P(ID) | P(NONCE), P(VID) | P(CR), PT(HASH)
-	, EVENT_RETRANSMIT, unexpected /* ??? not yet implemented */ },
-
-	{ STATE_MAIN_I2, STATE_UNDEFINED
-	, SMF_ALL_AUTH | SMF_INITIATOR | SMF_OUTPUT_ENCRYPTED | SMF_REPLY
-	, P(NONCE) | P(KE) | P(ID), P(VID) | P(CR), PT(HASH)
-	, EVENT_RETRANSMIT, unexpected /* ??? not yet implemented */ },
-
-	/* for states from here on, input message must be encrypted */
-
-	/* STATE_MAIN_R2: I3 --> R3
-	 * SMF_PSK_AUTH: HDR*, IDi1, HASH_I --> HDR*, IDr1, HASH_R
-	 * SMF_DS_AUTH: HDR*, IDi1, [ CERT, ] SIG_I --> HDR*, IDr1, [ CERT, ] SIG_R
-	 * SMF_PKE_AUTH, SMF_RPKE_AUTH: HDR*, HASH_I --> HDR*, HASH_R
-	 */
-	{ STATE_MAIN_R2, STATE_MAIN_R3
-	, SMF_PSK_AUTH | SMF_FIRST_ENCRYPTED_INPUT | SMF_ENCRYPTED
-	  | SMF_REPLY | SMF_RELEASE_PENDING_P2
-	, P(ID) | P(HASH), P(VID) | P(CR), PT(NONE)
-	, EVENT_SA_REPLACE, main_inI3_outR3 },
-
-	{ STATE_MAIN_R2, STATE_MAIN_R3
-	, SMF_DS_AUTH | SMF_FIRST_ENCRYPTED_INPUT | SMF_ENCRYPTED
-	  | SMF_REPLY | SMF_RELEASE_PENDING_P2
-	, P(ID) | P(SIG), P(VID) | P(CR) | P(CERT), PT(NONE)
-	, EVENT_SA_REPLACE, main_inI3_outR3 },
-
-	{ STATE_MAIN_R2, STATE_UNDEFINED
-	, SMF_PKE_AUTH | SMF_RPKE_AUTH | SMF_FIRST_ENCRYPTED_INPUT | SMF_ENCRYPTED
-	  | SMF_REPLY | SMF_RELEASE_PENDING_P2
-	, P(HASH), P(VID) | P(CR), PT(NONE)
-	, EVENT_SA_REPLACE, unexpected /* ??? not yet implemented */ },
-
-	/* STATE_MAIN_I3: R3 --> done
-	 * SMF_PSK_AUTH: HDR*, IDr1, HASH_R --> done
-	 * SMF_DS_AUTH: HDR*, IDr1, [ CERT, ] SIG_R --> done
-	 * SMF_PKE_AUTH, SMF_RPKE_AUTH: HDR*, HASH_R --> done
-	 * May initiate quick mode by calling quick_outI1
-	 */
-	{ STATE_MAIN_I3, STATE_MAIN_I4
-	, SMF_PSK_AUTH | SMF_INITIATOR
-	  | SMF_FIRST_ENCRYPTED_INPUT | SMF_ENCRYPTED | SMF_RELEASE_PENDING_P2
-	, P(ID) | P(HASH), P(VID) | P(CR), PT(NONE)
-	, EVENT_SA_REPLACE, main_inR3 },
-
-	{ STATE_MAIN_I3, STATE_MAIN_I4
-	, SMF_DS_AUTH | SMF_INITIATOR
-	  | SMF_FIRST_ENCRYPTED_INPUT | SMF_ENCRYPTED | SMF_RELEASE_PENDING_P2
-	, P(ID) | P(SIG), P(VID) | P(CR) | P(CERT), PT(NONE)
-	, EVENT_SA_REPLACE, main_inR3 },
-
-	{ STATE_MAIN_I3, STATE_UNDEFINED
-	, SMF_PKE_AUTH | SMF_RPKE_AUTH | SMF_INITIATOR
-	  | SMF_FIRST_ENCRYPTED_INPUT | SMF_ENCRYPTED | SMF_RELEASE_PENDING_P2
-	, P(HASH), P(VID) | P(CR), PT(NONE)
-	, EVENT_SA_REPLACE, unexpected /* ??? not yet implemented */ },
-
-	/* STATE_MAIN_R3: can only get here due to packet loss */
-	{ STATE_MAIN_R3, STATE_UNDEFINED
-	, SMF_ALL_AUTH | SMF_ENCRYPTED | SMF_RETRANSMIT_ON_DUPLICATE
-	, LEMPTY, LEMPTY
-	, PT(NONE), EVENT_NULL, unexpected },
-
-	/* STATE_MAIN_I4: can only get here due to packet loss */
-	{ STATE_MAIN_I4, STATE_UNDEFINED
-	, SMF_ALL_AUTH | SMF_INITIATOR | SMF_ENCRYPTED
-	, LEMPTY, LEMPTY
-	, PT(NONE), EVENT_NULL, unexpected },
-
-
-	/***** Phase 2 Quick Mode *****/
-
-	/* No state for quick_outI1:
-	 * --> HDR*, HASH(1), SA, Nr [, KE ] [, IDci, IDcr ]
-	 */
-
-	/* STATE_QUICK_R0:
-	 * HDR*, HASH(1), SA, Ni [, KE ] [, IDci, IDcr ] -->
-	 * HDR*, HASH(2), SA, Nr [, KE ] [, IDci, IDcr ]
-	 * Installs inbound IPsec SAs.
-	 * Because it may suspend for asynchronous DNS, first_out_payload
-	 * is set to NONE to suppress early emission of HDR*.
-	 * ??? it is legal to have multiple SAs, but we don't support it yet.
-	 */
-	{ STATE_QUICK_R0, STATE_QUICK_R1
-	, SMF_ALL_AUTH | SMF_ENCRYPTED | SMF_REPLY
-	, P(HASH) | P(SA) | P(NONCE), /* P(SA) | */ P(KE) | P(ID) | P(NATOA_RFC), PT(NONE)
-	, EVENT_RETRANSMIT, quick_inI1_outR1 },
-
-	/* STATE_QUICK_I1:
-	 * HDR*, HASH(2), SA, Nr [, KE ] [, IDci, IDcr ] -->
-	 * HDR*, HASH(3)
-	 * Installs inbound and outbound IPsec SAs, routing, etc.
-	 * ??? it is legal to have multiple SAs, but we don't support it yet.
-	 */
-	{ STATE_QUICK_I1, STATE_QUICK_I2
-	, SMF_ALL_AUTH | SMF_INITIATOR | SMF_ENCRYPTED | SMF_REPLY
-	, P(HASH) | P(SA) | P(NONCE), /* P(SA) | */ P(KE) | P(ID) | P(NATOA_RFC), PT(HASH)
-	, EVENT_SA_REPLACE, quick_inR1_outI2 },
-
-	/* STATE_QUICK_R1: HDR*, HASH(3) --> done
-	 * Installs outbound IPsec SAs, routing, etc.
-	 */
-	{ STATE_QUICK_R1, STATE_QUICK_R2
-	, SMF_ALL_AUTH | SMF_ENCRYPTED
-	, P(HASH), LEMPTY, PT(NONE)
-	, EVENT_SA_REPLACE, quick_inI2 },
-
-	/* STATE_QUICK_I2: can only happen due to lost packet */
-	{ STATE_QUICK_I2, STATE_UNDEFINED
-	, SMF_ALL_AUTH | SMF_INITIATOR | SMF_ENCRYPTED | SMF_RETRANSMIT_ON_DUPLICATE
-	, LEMPTY, LEMPTY, PT(NONE)
-	, EVENT_NULL, unexpected },
-
-	/* STATE_QUICK_R2: can only happen due to lost packet */
-	{ STATE_QUICK_R2, STATE_UNDEFINED
-	, SMF_ALL_AUTH | SMF_ENCRYPTED
-	, LEMPTY, LEMPTY, PT(NONE)
-	, EVENT_NULL, unexpected },
-
-
-	/***** informational messages *****/
-
-	/* STATE_INFO: */
-	{ STATE_INFO, STATE_UNDEFINED
-	, SMF_ALL_AUTH
-	, LEMPTY, LEMPTY, PT(NONE)
-	, EVENT_NULL, informational },
-
-	/* STATE_INFO_PROTECTED: */
-	{ STATE_INFO_PROTECTED, STATE_UNDEFINED
-	, SMF_ALL_AUTH | SMF_ENCRYPTED
-	, P(HASH), LEMPTY, PT(NONE)
-	, EVENT_NULL, informational },
-
-	/* XAUTH state transitions */
-	{ STATE_XAUTH_I0, STATE_XAUTH_I1
-	, SMF_ALL_AUTH | SMF_ENCRYPTED | SMF_REPLY
-	, P(ATTR) | P(HASH), P(VID), PT(HASH)
-	, EVENT_RETRANSMIT, xauth_inI0 },
-
-	{ STATE_XAUTH_R1, STATE_XAUTH_R2
-	, SMF_ALL_AUTH | SMF_ENCRYPTED
-	, P(ATTR) | P(HASH), P(VID), PT(HASH)
-	, EVENT_RETRANSMIT, xauth_inR1 },
-
-	{ STATE_XAUTH_I1, STATE_XAUTH_I2
-	, SMF_ALL_AUTH | SMF_ENCRYPTED | SMF_REPLY | SMF_RELEASE_PENDING_P2
-	, P(ATTR) | P(HASH), P(VID), PT(HASH)
-	, EVENT_SA_REPLACE, xauth_inI1 },
-
-	{ STATE_XAUTH_R2, STATE_XAUTH_R3
-	, SMF_ALL_AUTH | SMF_ENCRYPTED | SMF_RELEASE_PENDING_P2
-	, P(ATTR) | P(HASH), P(VID), PT(NONE)
-	, EVENT_SA_REPLACE, xauth_inR2 },
-
-	{ STATE_XAUTH_I2, STATE_UNDEFINED
-	, SMF_ALL_AUTH | SMF_ENCRYPTED
-	, LEMPTY, LEMPTY, PT(NONE)
-	, EVENT_NULL, unexpected },
-
-	{ STATE_XAUTH_R3, STATE_UNDEFINED
-	, SMF_ALL_AUTH | SMF_ENCRYPTED
-	, LEMPTY, LEMPTY, PT(NONE)
-	, EVENT_NULL, unexpected },
-
-	/* ModeCfg pull mode state transitions */
-
-	{ STATE_MODE_CFG_R0, STATE_MODE_CFG_R1
-	, SMF_ALL_AUTH | SMF_ENCRYPTED | SMF_REPLY | SMF_RELEASE_PENDING_P2
-	, P(ATTR) | P(HASH), P(VID), PT(HASH)
-	, EVENT_SA_REPLACE, modecfg_inR0 },
-
-	{ STATE_MODE_CFG_I1, STATE_MODE_CFG_I2
-	, SMF_ALL_AUTH | SMF_ENCRYPTED | SMF_RELEASE_PENDING_P2
-	, P(ATTR) | P(HASH), P(VID), PT(HASH)
-	, EVENT_SA_REPLACE, modecfg_inI1 },
-
-	{ STATE_MODE_CFG_R1, STATE_UNDEFINED
-	, SMF_ALL_AUTH | SMF_ENCRYPTED
-	, LEMPTY, LEMPTY, PT(NONE)
-	, EVENT_NULL, unexpected },
-
-	{ STATE_MODE_CFG_I2, STATE_UNDEFINED
-	, SMF_ALL_AUTH | SMF_ENCRYPTED
-	, LEMPTY, LEMPTY, PT(NONE)
-	, EVENT_NULL, unexpected },
-
-   /* ModeCfg push mode state transitions */
-
-	{ STATE_MODE_CFG_I0, STATE_MODE_CFG_I3
-	, SMF_ALL_AUTH | SMF_ENCRYPTED | SMF_REPLY | SMF_RELEASE_PENDING_P2
-	, P(ATTR) | P(HASH), P(VID), PT(HASH)
-	, EVENT_SA_REPLACE, modecfg_inI0 },
-
-	{ STATE_MODE_CFG_R3, STATE_MODE_CFG_R4
-	, SMF_ALL_AUTH | SMF_ENCRYPTED | SMF_RELEASE_PENDING_P2
-	, P(ATTR) | P(HASH), P(VID), PT(HASH)
-	, EVENT_SA_REPLACE, modecfg_inR3 },
-
-	{ STATE_MODE_CFG_I3, STATE_UNDEFINED
-	, SMF_ALL_AUTH | SMF_ENCRYPTED
-	, LEMPTY, LEMPTY, PT(NONE)
-	, EVENT_NULL, unexpected },
-
-	{ STATE_MODE_CFG_R4, STATE_UNDEFINED
-	, SMF_ALL_AUTH | SMF_ENCRYPTED
-	, LEMPTY, LEMPTY, PT(NONE)
-	, EVENT_NULL, unexpected },
-
-#undef P
-#undef PT
-};
-
-void
-init_demux(void)
-{
-	/* fill ike_microcode_index:
-	 * make ike_microcode_index[s] point to first entry in
-	 * state_microcode_table for state s (backward scan makes this easier).
-	 * Check that table is in order -- catch coding errors.
-	 * For what it's worth, this routine is idempotent.
-	 */
-	const struct state_microcode *t;
-
-	for (t = &state_microcode_table[countof(state_microcode_table) - 1];;)
-	{
-		passert(STATE_IKE_FLOOR <= t->state && t->state < STATE_IKE_ROOF);
-		ike_microcode_index[t->state - STATE_IKE_FLOOR] = t;
-		if (t == state_microcode_table)
-			break;
-		t--;
-		passert(t[0].state <= t[1].state);
-	}
-}
-
-/* Process any message on the MSG_ERRQUEUE
- *
- * This information is generated because of the IP_RECVERR socket option.
- * The API is sparsely documented, and may be LINUX-only, and only on
- * fairly recent versions at that (hence the conditional compilation).
- *
- * - ip(7) describes IP_RECVERR
- * - recvmsg(2) describes MSG_ERRQUEUE
- * - readv(2) describes iovec
- * - cmsg(3) describes how to process auxiliary messages
- *
- * ??? we should link this message with one we've sent
- * so that the diagnostic can refer to that negotiation.
- *
- * ??? how long can the messge be?
- *
- * ??? poll(2) has a very incomplete description of the POLL* events.
- * We assume that POLLIN, POLLOUT, and POLLERR are all we need to deal with
- * and that POLLERR will be on iff there is a MSG_ERRQUEUE message.
- *
- * We have to code around a couple of surprises:
- *
- * - Select can say that a socket is ready to read from, and
- *   yet a read will hang.  It turns out that a message available on the
- *   MSG_ERRQUEUE will cause select to say something is pending, but
- *   a normal read will hang.  poll(2) can tell when a MSG_ERRQUEUE
- *   message is pending.
- *
- *   This is dealt with by calling check_msg_errqueue after select
- *   has indicated that there is something to read, but before the
- *   read is performed.  check_msg_errqueue will return TRUE if there
- *   is something left to read.
- *
- * - A write to a socket may fail because there is a pending MSG_ERRQUEUE
- *   message, without there being anything wrong with the write.  This
- *   makes for confusing diagnostics.
- *
- *   To avoid this, we call check_msg_errqueue before a write.  True,
- *   there is a race condition (a MSG_ERRQUEUE message might arrive
- *   between the check and the write), but we should eliminate many
- *   of the problematic events.  To narrow the window, the poll(2)
- *   will await until an event happens (in the case or a write,
- *   POLLOUT; this should be benign for POLLIN).
- */
-
-#if defined(IP_RECVERR) && defined(MSG_ERRQUEUE)
-static bool
-check_msg_errqueue(const struct iface *ifp, short interest)
-{
-	struct pollfd pfd;
-
-	pfd.fd = ifp->fd;
-	pfd.events = interest | POLLPRI | POLLOUT;
-
-	while (pfd.revents = 0
-	, poll(&pfd, 1, -1) > 0 && (pfd.revents & POLLERR))
-	{
-		u_int8_t buffer[3000];  /* hope that this is big enough */
-		union
-		{
-			struct sockaddr sa;
-			struct sockaddr_in sa_in4;
-			struct sockaddr_in6 sa_in6;
-		} from;
-
-		int from_len = sizeof(from);
-
-		int packet_len;
-
-		struct msghdr emh;
-		struct iovec eiov;
-		union {
-			/* force alignment (not documented as necessary) */
-			struct cmsghdr ecms;
-
-			/* how much space is enough? */
-			unsigned char space[256];
-		} ecms_buf;
-
-		struct cmsghdr *cm;
-		char fromstr[sizeof(" for message to  port 65536") + INET6_ADDRSTRLEN];
-		struct state *sender = NULL;
-
-		zero(&from.sa);
-		from_len = sizeof(from);
-
-		emh.msg_name = &from.sa;        /* ??? filled in? */
-		emh.msg_namelen = sizeof(from);
-		emh.msg_iov = &eiov;
-		emh.msg_iovlen = 1;
-		emh.msg_control = &ecms_buf;
-		emh.msg_controllen = sizeof(ecms_buf);
-		emh.msg_flags = 0;
-
-		eiov.iov_base = buffer; /* see readv(2) */
-		eiov.iov_len = sizeof(buffer);
-
-		packet_len = recvmsg(ifp->fd, &emh, MSG_ERRQUEUE);
-
-		if (packet_len == -1)
-		{
-			log_errno((e, "recvmsg(,, MSG_ERRQUEUE) on %s failed in comm_handle"
-				, ifp->rname));
-			break;
-		}
-		else if (packet_len == sizeof(buffer))
-		{
-			plog("MSG_ERRQUEUE message longer than %lu bytes; truncated"
-				, (unsigned long) sizeof(buffer));
-		}
-		else
-		{
-			sender = find_sender((size_t) packet_len, buffer);
-		}
-
-		DBG_cond_dump(DBG_ALL, "rejected packet:\n", buffer, packet_len);
-		DBG_cond_dump(DBG_ALL, "control:\n", emh.msg_control, emh.msg_controllen);
-		/* ??? Andi Kleen <ak@suse.de> and misc documentation
-		 * suggests that name will have the original destination
-		 * of the packet.  We seem to see msg_namelen == 0.
-		 * Andi says that this is a kernel bug and has fixed it.
-		 * Perhaps in 2.2.18/2.4.0.
-		 */
-		passert(emh.msg_name == &from.sa);
-		DBG_cond_dump(DBG_ALL, "name:\n", emh.msg_name
-			, emh.msg_namelen);
-
-		fromstr[0] = '\0';      /* usual case :-( */
-		switch (from.sa.sa_family)
-		{
-		char as[INET6_ADDRSTRLEN];
-
-		case AF_INET:
-			if (emh.msg_namelen == sizeof(struct sockaddr_in))
-				snprintf(fromstr, sizeof(fromstr)
-				, " for message to %s port %u"
-					, inet_ntop(from.sa.sa_family
-					, &from.sa_in4.sin_addr, as, sizeof(as))
-					, ntohs(from.sa_in4.sin_port));
-			break;
-		case AF_INET6:
-			if (emh.msg_namelen == sizeof(struct sockaddr_in6))
-				snprintf(fromstr, sizeof(fromstr)
-					, " for message to %s port %u"
-					, inet_ntop(from.sa.sa_family
-					, &from.sa_in6.sin6_addr, as, sizeof(as))
-					, ntohs(from.sa_in6.sin6_port));
-			break;
-		}
-
-		for (cm = CMSG_FIRSTHDR(&emh)
-		; cm != NULL
-		; cm = CMSG_NXTHDR(&emh,cm))
-		{
-			if (cm->cmsg_level == SOL_IP
-			&& cm->cmsg_type == IP_RECVERR)
-			{
-				/* ip(7) and recvmsg(2) specify:
-				 * ee_origin is SO_EE_ORIGIN_ICMP for ICMP
-				 *  or SO_EE_ORIGIN_LOCAL for locally generated errors.
-				 * ee_type and ee_code are from the ICMP header.
-				 * ee_info is the discovered MTU for EMSGSIZE errors
-				 * ee_data is not used.
-				 *
-				 * ??? recvmsg(2) says "SOCK_EE_OFFENDER" but
-				 * means "SO_EE_OFFENDER".  The OFFENDER is really
-				 * the router that complained.  As such, the port
-				 * is meaningless.
-				 */
-
-				/* ??? cmsg(3) claims that CMSG_DATA returns
-				 * void *, but RFC 2292 and /usr/include/bits/socket.h
-				 * say unsigned char *.  The manual is being fixed.
-				 */
-				struct sock_extended_err *ee = (void *)CMSG_DATA(cm);
-				const char *offstr = "unspecified";
-				char offstrspace[INET6_ADDRSTRLEN];
-				char orname[50];
-
-				if (cm->cmsg_len > CMSG_LEN(sizeof(struct sock_extended_err)))
-				{
-					const struct sockaddr *offender = SO_EE_OFFENDER(ee);
-
-					switch (offender->sa_family)
-					{
-					case AF_INET:
-						offstr = inet_ntop(offender->sa_family
-							, &((const struct sockaddr_in *)offender)->sin_addr
-							, offstrspace, sizeof(offstrspace));
-						break;
-					case AF_INET6:
-						offstr = inet_ntop(offender->sa_family
-							, &((const struct sockaddr_in6 *)offender)->sin6_addr
-							, offstrspace, sizeof(offstrspace));
-						break;
-					default:
-						offstr = "unknown";
-						break;
-					}
-				}
-
-				switch (ee->ee_origin)
-				{
-				case SO_EE_ORIGIN_NONE:
-					snprintf(orname, sizeof(orname), "none");
-					break;
-				case SO_EE_ORIGIN_LOCAL:
-					snprintf(orname, sizeof(orname), "local");
-					break;
-				case SO_EE_ORIGIN_ICMP:
-					snprintf(orname, sizeof(orname)
-						, "ICMP type %d code %d (not authenticated)"
-						, ee->ee_type, ee->ee_code
-						);
-					break;
-				case SO_EE_ORIGIN_ICMP6:
-					snprintf(orname, sizeof(orname)
-						, "ICMP6 type %d code %d (not authenticated)"
-						, ee->ee_type, ee->ee_code
-						);
-					break;
-				default:
-					snprintf(orname, sizeof(orname), "invalid origin %lu"
-						, (unsigned long) ee->ee_origin);
-					break;
-				}
-
-				{
-					struct state *old_state = cur_state;
-
-					cur_state = sender;
-
-					/* note dirty trick to suppress ~ at start of format
-					 * if we know what state to blame.
-					 */
-					if ((packet_len == 1) && (buffer[0] == 0xff)
-#ifdef DEBUG
-						&& ((cur_debugging & DBG_NATT) == 0)
-#endif
-						) {
-							/* don't log NAT-T keepalive related errors unless NATT debug is
-							 * enabled
-							 */
-					}
-					else
-					plog((sender != NULL) + "~"
-						"ERROR: asynchronous network error report on %s"
-						"%s"
-						", complainant %s"
-						": %s"
-						" [errno %lu, origin %s"
-						/* ", pad %d, info %ld" */
-						/* ", data %ld" */
-						"]"
-						, ifp->rname
-						, fromstr
-						, offstr
-						, strerror(ee->ee_errno)
-						, (unsigned long) ee->ee_errno
-						, orname
-						/* , ee->ee_pad, (unsigned long)ee->ee_info */
-						/* , (unsigned long)ee->ee_data */
-						);
-					cur_state = old_state;
-				}
-			}
-			else
-			{
-				/* .cmsg_len is a kernel_size_t(!), but the value
-				 * certainly ought to fit in an unsigned long.
-				 */
-				plog("unknown cmsg: level %d, type %d, len %lu"
-					, cm->cmsg_level, cm->cmsg_type
-					, (unsigned long) cm->cmsg_len);
-			}
-		}
-	}
-	return (pfd.revents & interest) != 0;
-}
-#endif /* defined(IP_RECVERR) && defined(MSG_ERRQUEUE) */
-
-bool
-send_packet(struct state *st, const char *where)
-{
-	connection_t *c = st->st_connection;
-	int port_buf;
-	bool err;
-	u_int8_t ike_pkt[MAX_OUTPUT_UDP_SIZE];
-	u_int8_t *ptr;
-	unsigned long len;
-
-	if (c->interface->ike_float && st->st_tpacket.len != 1)
-	{
-		if ((unsigned long) st->st_tpacket.len > (MAX_OUTPUT_UDP_SIZE-sizeof(u_int32_t)))
-		{
-			DBG_log("send_packet(): really too big");
-			return FALSE;
-		}
-		ptr = ike_pkt;
-		/** Add Non-ESP marker **/
-		memset(ike_pkt, 0, sizeof(u_int32_t));
-		memcpy(ike_pkt + sizeof(u_int32_t), st->st_tpacket.ptr,
-			(unsigned long)st->st_tpacket.len);
-		len = (unsigned long) st->st_tpacket.len + sizeof(u_int32_t);
-	}
-	else
-	{
-		ptr = st->st_tpacket.ptr;
-		len = (unsigned long) st->st_tpacket.len;
-	}
-
-	DBG(DBG_RAW,
-		{
-			DBG_log("sending %lu bytes for %s through %s to %s:%u:"
-				, (unsigned long) st->st_tpacket.len
-				, where
-				, c->interface->rname
-				, ip_str(&c->spd.that.host_addr)
-				, (unsigned)c->spd.that.host_port);
-			DBG_dump_chunk(NULL, st->st_tpacket);
-		});
-
-	/* XXX: Not very clean.  We manipulate the port of the ip_address to
-	 * have a port in the sockaddr*, but we retain the original port
-	 * and restore it afterwards.
-	 */
-
-	port_buf = portof(&c->spd.that.host_addr);
-	setportof(htons(c->spd.that.host_port), &c->spd.that.host_addr);
-
-#if defined(IP_RECVERR) && defined(MSG_ERRQUEUE)
-	(void) check_msg_errqueue(c->interface, POLLOUT);
-#endif /* defined(IP_RECVERR) && defined(MSG_ERRQUEUE) */
-
-	err = sendto(c->interface->fd
-		, ptr, len, 0
-		, sockaddrof(&c->spd.that.host_addr)
-		, sockaddrlenof(&c->spd.that.host_addr)) != (ssize_t)len;
-
-	/* restore port */
-	setportof(port_buf, &c->spd.that.host_addr);
-
-	if (err)
-	{
-	   /* do not log NAT-T Keep Alive packets */
-		if (streq(where, "NAT-T Keep Alive"))
-			return FALSE;
-		log_errno((e, "sendto on %s to %s:%u failed in %s"
-			, c->interface->rname
-			, ip_str(&c->spd.that.host_addr)
-			, (unsigned)c->spd.that.host_port
-			, where));
-		return FALSE;
-	}
-	else
-	{
-		return TRUE;
-	}
-}
-
-static stf_status
-unexpected(struct msg_digest *md)
-{
-	loglog(RC_LOG_SERIOUS, "unexpected message received in state %s"
-		, enum_name(&state_names, md->st->st_state));
-	return STF_IGNORE;
-}
-
-static stf_status
-informational(struct msg_digest *md UNUSED)
-{
-	struct payload_digest *const n_pld = md->chain[ISAKMP_NEXT_N];
-
-	/* If the Notification Payload is not null... */
-	if (n_pld != NULL)
-	{
-		pb_stream *const n_pbs = &n_pld->pbs;
-		struct isakmp_notification *const n = &n_pld->payload.notification;
-		int disp_len;
-		char disp_buf[200];
-
-		/* Switch on Notification Type (enum) */
-		switch (n->isan_type)
-		{
-		case R_U_THERE:
-			return dpd_inI_outR(md->st, n, n_pbs);
-
-		case R_U_THERE_ACK:
-			return dpd_inR(md->st, n, n_pbs);
-		default:
-			if (pbs_left(n_pbs) >= sizeof(disp_buf)-1)
-				disp_len = sizeof(disp_buf)-1;
-			else
-				disp_len = pbs_left(n_pbs);
-			memcpy(disp_buf, n_pbs->cur, disp_len);
-			disp_buf[disp_len] = '\0';
-			break;
-		}
-	}
-	return STF_IGNORE;
-}
-
-/* message digest allocation and deallocation */
-
-static struct msg_digest *md_pool = NULL;
-
-/* free_md_pool is only used to avoid leak reports */
-void
-free_md_pool(void)
-{
-	for (;;)
-	{
-		struct msg_digest *md = md_pool;
-
-		if (md == NULL)
-			break;
-		md_pool = md->next;
-		free(md);
-	}
-}
-
-static struct msg_digest *
-malloc_md(void)
-{
-	struct msg_digest *md = md_pool;
-
-	/* convenient initializer:
-	 * - all pointers NULL
-	 * - .note = NOTHING_WRONG
-	 * - .encrypted = FALSE
-	 */
-	static const struct msg_digest blank_md = {
-		.next = NULL,
-	};
-
-	if (md == NULL)
-	{
-		md = malloc_thing(struct msg_digest);
-		zero(md);
-	}
-	else
-		md_pool = md->next;
-
-	*md = blank_md;
-	md->digest_roof = md->digest;
-
-	/* note: although there may be multiple msg_digests at once
-	 * (due to suspended state transitions), there is a single
-	 * global reply_buffer.  It will need to be saved and restored.
-	 */
-	init_pbs(&md->reply, reply_buffer, sizeof(reply_buffer), "reply packet");
-
-	return md;
-}
-
-void
-release_md(struct msg_digest *md)
-{
-	chunk_free(&md->raw_packet);
-	free(md->packet_pbs.start);
-	md->packet_pbs.start = NULL;
-	md->next = md_pool;
-	md_pool = md;
-}
-
-/* wrapper for read_packet and process_packet
- *
- * The main purpose of this wrapper is to factor out teardown code
- * from the many return points in process_packet.  This amounts to
- * releasing the msg_digest and resetting global variables.
- *
- * When processing of a packet is suspended (STF_SUSPEND),
- * process_packet sets md to NULL to prevent the msg_digest being freed.
- * Someone else must ensure that msg_digest is freed eventually.
- *
- * read_packet is broken out to minimize the lifetime of the
- * enormous input packet buffer, an auto.
- */
-void
-comm_handle(const struct iface *ifp)
-{
-	static struct msg_digest *md;
-
-#if defined(IP_RECVERR) && defined(MSG_ERRQUEUE)
-	/* Even though select(2) says that there is a message,
-	 * it might only be a MSG_ERRQUEUE message.  At least
-	 * sometimes that leads to a hanging recvfrom.  To avoid
-	 * what appears to be a kernel bug, check_msg_errqueue
-	 * uses poll(2) and tells us if there is anything for us
-	 * to read.
-	 *
-	 * This is early enough that teardown isn't required:
-	 * just return on failure.
-	 */
-	if (!check_msg_errqueue(ifp, POLLIN))
-		return; /* no normal message to read */
-#endif /* defined(IP_RECVERR) && defined(MSG_ERRQUEUE) */
-
-	md = malloc_md();
-	md->iface = ifp;
-
-	if (read_packet(md))
-		process_packet(&md);
-
-	if (md != NULL)
-		release_md(md);
-
-	cur_state = NULL;
-	reset_cur_connection();
-	cur_from = NULL;
-}
-
-/* read the message.
- * Since we don't know its size, we read it into
- * an overly large buffer and then copy it to a
- * new, properly sized buffer.
- */
-static bool
-read_packet(struct msg_digest *md)
-{
-	const struct iface *ifp = md->iface;
-	int packet_len;
-	u_int8_t *buffer;
-	u_int8_t *buffer_nat;
-	union
-	{
-		struct sockaddr sa;
-		struct sockaddr_in sa_in4;
-		struct sockaddr_in6 sa_in6;
-	} from;
-	int from_len = sizeof(from);
-	err_t from_ugh = NULL;
-	static const char undisclosed[] = "unknown source";
-
-	happy(anyaddr(addrtypeof(&ifp->addr), &md->sender));
-	zero(&from.sa);
-	ioctl(ifp->fd, FIONREAD, &packet_len);
-	buffer = malloc(packet_len);
-	packet_len = recvfrom(ifp->fd, buffer, packet_len, 0
-		, &from.sa, &from_len);
-
-	/* First: digest the from address.
-	 * We presume that nothing here disturbs errno.
-	 */
-	if (packet_len == -1
-	&& from_len == sizeof(from)
-	&& all_zero((const void *)&from.sa, sizeof(from)))
-	{
-		/* "from" is untouched -- not set by recvfrom */
-		from_ugh = undisclosed;
-	}
-	else if (from_len
-	< (int) (offsetof(struct sockaddr, sa_family) + sizeof(from.sa.sa_family)))
-	{
-		from_ugh = "truncated";
-	}
-	else
-	{
-		const struct af_info *afi = aftoinfo(from.sa.sa_family);
-
-		if (afi == NULL)
-		{
-			from_ugh = "unexpected Address Family";
-		}
-		else if (from_len != (int)afi->sa_sz)
-		{
-			from_ugh = "wrong length";
-		}
-		else
-		{
-			switch (from.sa.sa_family)
-			{
-			case AF_INET:
-				from_ugh = initaddr((void *) &from.sa_in4.sin_addr
-					, sizeof(from.sa_in4.sin_addr), AF_INET, &md->sender);
-				md->sender_port = ntohs(from.sa_in4.sin_port);
-				break;
-			case AF_INET6:
-				from_ugh = initaddr((void *) &from.sa_in6.sin6_addr
-					, sizeof(from.sa_in6.sin6_addr), AF_INET6, &md->sender);
-				md->sender_port = ntohs(from.sa_in6.sin6_port);
-				break;
-			}
-		}
-	}
-
-	/* now we report any actual I/O error */
-	if (packet_len == -1)
-	{
-		if (from_ugh == undisclosed
-		&& errno == ECONNREFUSED)
-		{
-			/* Tone down scary message for vague event:
-			 * We get "connection refused" in response to some
-			 * datagram we sent, but we cannot tell which one.
-			 */
-			plog("some IKE message we sent has been rejected with ECONNREFUSED (kernel supplied no details)");
-		}
-		else if (from_ugh != NULL)
-		{
-			log_errno((e, "recvfrom on %s failed; Pluto cannot decode source sockaddr in rejection: %s"
-				, ifp->rname, from_ugh));
-		}
-		else
-		{
-			log_errno((e, "recvfrom on %s from %s:%u failed"
-				, ifp->rname
-				, ip_str(&md->sender), (unsigned)md->sender_port));
-		}
-		free(buffer);
-		return FALSE;
-	}
-	else if (from_ugh != NULL)
-	{
-		plog("recvfrom on %s returned malformed source sockaddr: %s"
-			, ifp->rname, from_ugh);
-		free(buffer);
-		return FALSE;
-	}
-	cur_from = &md->sender;
-	cur_from_port = md->sender_port;
-
-	if (ifp->ike_float == TRUE)
-	{
-		u_int32_t non_esp;
-
-		if (packet_len < (int)sizeof(u_int32_t))
-		{
-			plog("recvfrom %s:%u too small packet (%d)"
-				, ip_str(cur_from), (unsigned) cur_from_port, packet_len);
-			free(buffer);
-			return FALSE;
-		}
-		memcpy(&non_esp, buffer, sizeof(u_int32_t));
-		if (non_esp != 0)
-		{
-			plog("recvfrom %s:%u has no Non-ESP marker"
-				, ip_str(cur_from), (unsigned) cur_from_port);
-			free(buffer);
-			return FALSE;
-		}
-		packet_len -= sizeof(u_int32_t);
-		buffer_nat = malloc(packet_len);
-		memcpy(buffer_nat, buffer + sizeof(u_int32_t), packet_len);
-		free(buffer);
-		buffer = buffer_nat;
-	}
-
-	/* Clone actual message contents
-	 * and set up md->packet_pbs to describe it.
-	 */
-	init_pbs(&md->packet_pbs, buffer, packet_len, "packet");
-
-	DBG(DBG_RAW | DBG_CRYPT | DBG_PARSING | DBG_CONTROL,
-		{
-			DBG_log(BLANK_FORMAT);
-			DBG_log("*received %d bytes from %s:%u on %s"
-				, (int) pbs_room(&md->packet_pbs)
-				, ip_str(cur_from), (unsigned) cur_from_port
-				, ifp->rname);
-		});
-
-	DBG(DBG_RAW,
-		DBG_dump("", md->packet_pbs.start, pbs_room(&md->packet_pbs)));
-
-		if ((pbs_room(&md->packet_pbs)==1) && (md->packet_pbs.start[0]==0xff))
-		{
-			/**
-			 * NAT-T Keep-alive packets should be discarded by kernel ESPinUDP
-			 * layer. But bogus keep-alive packets (sent with a non-esp marker)
-			 * can reach this point. Complain and discard them.
-			 */
-			DBG(DBG_NATT,
-				DBG_log("NAT-T keep-alive (bogus ?) should not reach this point. "
-						"Ignored. Sender: %s:%u", ip_str(cur_from),
-						(unsigned) cur_from_port);
-			)
-			return FALSE;
-		}
-
-#define IKEV2_VERSION_OFFSET    17
-#define IKEV2_VERSION           0x20
-
-	/* ignore IKEv2 packets - they will be handled by charon */
-	if (pbs_room(&md->packet_pbs) > IKEV2_VERSION_OFFSET
-	&&  (md->packet_pbs.start[IKEV2_VERSION_OFFSET] & 0xF0) == IKEV2_VERSION)
-	{
-		DBG(DBG_CONTROLMORE,
-			DBG_log("  ignoring IKEv2 packet")
-		)
-		return FALSE;
-	}
-
-	return TRUE;
-}
-
-/* process an input packet, possibly generating a reply.
- *
- * If all goes well, this routine eventually calls a state-specific
- * transition function.
- */
-static void
-process_packet(struct msg_digest **mdp)
-{
-	struct msg_digest *md = *mdp;
-	const struct state_microcode *smc;
-	bool new_iv_set = FALSE;
-	bool restore_iv = FALSE;
-	u_char new_iv[MAX_DIGEST_LEN];
-	u_int new_iv_len = 0;
-
-	struct state *st = NULL;
-	enum state_kind from_state = STATE_UNDEFINED;       /* state we started in */
-
-#define SEND_NOTIFICATION(t) { \
-	if (st) send_notification_from_state(st, from_state, t); \
-	else send_notification_from_md(md, t); }
-
-	if (!in_struct(&md->hdr, &isakmp_hdr_desc, &md->packet_pbs, &md->message_pbs))
-	{
-		/* Identify specific failures:
-		 * - bad ISAKMP major/minor version numbers
-		 */
-		if (md->packet_pbs.roof - md->packet_pbs.cur >= (ptrdiff_t)isakmp_hdr_desc.size)
-		{
-			struct isakmp_hdr *hdr = (struct isakmp_hdr *)md->packet_pbs.cur;
-			if ((hdr->isa_version >> ISA_MAJ_SHIFT) != ISAKMP_MAJOR_VERSION)
-			{
-				SEND_NOTIFICATION(ISAKMP_INVALID_MAJOR_VERSION);
-				return;
-			}
-			else if ((hdr->isa_version & ISA_MIN_MASK) != ISAKMP_MINOR_VERSION)
-			{
-				SEND_NOTIFICATION(ISAKMP_INVALID_MINOR_VERSION);
-				return;
-			}
-		}
-		SEND_NOTIFICATION(ISAKMP_PAYLOAD_MALFORMED);
-		return;
-	}
-
-	if (md->packet_pbs.roof != md->message_pbs.roof)
-	{
-		plog("size (%u) differs from size specified in ISAKMP HDR (%u)"
-			, (unsigned) pbs_room(&md->packet_pbs), md->hdr.isa_length);
-#ifdef CISCO_QUIRKS
-		if (pbs_room(&md->packet_pbs) - md->hdr.isa_length == 16)
-			plog("Cisco VPN client appends 16 surplus NULL bytes");
-		else
-#endif
-		return;
-	}
-
-	switch (md->hdr.isa_xchg)
-	{
-#ifdef NOTYET
-	case ISAKMP_XCHG_NONE:
-	case ISAKMP_XCHG_BASE:
-#endif
-
-	case ISAKMP_XCHG_IDPROT:    /* part of a Main Mode exchange */
-		if (md->hdr.isa_msgid != MAINMODE_MSGID)
-		{
-			plog("Message ID was 0x%08lx but should be zero in Main Mode",
-				(unsigned long) md->hdr.isa_msgid);
-			SEND_NOTIFICATION(ISAKMP_INVALID_MESSAGE_ID);
-			return;
-		}
-
-		if (is_zero_cookie(md->hdr.isa_icookie))
-		{
-			plog("Initiator Cookie must not be zero in Main Mode message");
-			SEND_NOTIFICATION(ISAKMP_INVALID_COOKIE);
-			return;
-		}
-
-		if (is_zero_cookie(md->hdr.isa_rcookie))
-		{
-			/* initial message from initiator
-			 * ??? what if this is a duplicate of another message?
-			 */
-			if (md->hdr.isa_flags & ISAKMP_FLAG_ENCRYPTION)
-			{
-				plog("initial Main Mode message is invalid:"
-					" its Encrypted Flag is on");
-				SEND_NOTIFICATION(ISAKMP_INVALID_FLAGS);
-				return;
-			}
-
-			/* don't build a state until the message looks tasty */
-			from_state = STATE_MAIN_R0;
-		}
-		else
-		{
-			/* not an initial message */
-
-			st = find_state(md->hdr.isa_icookie, md->hdr.isa_rcookie
-				, &md->sender, md->hdr.isa_msgid);
-
-			if (st == NULL)
-			{
-				/* perhaps this is a first message from the responder
-				 * and contains a responder cookie that we've not yet seen.
-				 */
-				st = find_state(md->hdr.isa_icookie, zero_cookie
-					, &md->sender, md->hdr.isa_msgid);
-
-				if (st == NULL)
-				{
-					plog("Main Mode message is part of an unknown exchange");
-					/* XXX Could send notification back */
-					return;
-				}
-			}
-			set_cur_state(st);
-			from_state = st->st_state;
-		}
-		break;
-
-#ifdef NOTYET
-	case ISAKMP_XCHG_AO:
-	case ISAKMP_XCHG_AGGR:
-#endif
-
-	case ISAKMP_XCHG_INFO:      /* an informational exchange */
-		st = find_state(md->hdr.isa_icookie, md->hdr.isa_rcookie
-			, &md->sender, MAINMODE_MSGID);
-
-		if (st != NULL)
-			set_cur_state(st);
-
-		if (md->hdr.isa_flags & ISAKMP_FLAG_ENCRYPTION)
-		{
-			if (st == NULL)
-			{
-				plog("Informational Exchange is for an unknown (expired?) SA");
-				/* XXX Could send notification back */
-				return;
-			}
-
-			if (!IS_ISAKMP_ENCRYPTED(st->st_state))
-			{
-				loglog(RC_LOG_SERIOUS, "encrypted Informational Exchange message is invalid"
-					" because no key is known");
-				/* XXX Could send notification back */
-				return;
-			}
-
-			if (md->hdr.isa_msgid == MAINMODE_MSGID)
-			{
-				loglog(RC_LOG_SERIOUS, "Informational Exchange message is invalid because"
-					" it has a Message ID of 0");
-				/* XXX Could send notification back */
-				return;
-			}
-
-			if (!reserve_msgid(st, md->hdr.isa_msgid))
-			{
-				loglog(RC_LOG_SERIOUS, "Informational Exchange message is invalid because"
-					" it has a previously used Message ID (0x%08lx)"
-					, (unsigned long)md->hdr.isa_msgid);
-				/* XXX Could send notification back */
-				return;
-			}
-
-			if (!IS_ISAKMP_SA_ESTABLISHED(st->st_state))
-			{
-				memcpy(st->st_ph1_iv, st->st_new_iv, st->st_new_iv_len);
-				st->st_ph1_iv_len = st->st_new_iv_len;
-
-				/* backup new_iv */
-				new_iv_len = st->st_new_iv_len;
-				passert(new_iv_len <= MAX_DIGEST_LEN)
-				memcpy(new_iv, st->st_new_iv, new_iv_len);
-				restore_iv = TRUE;
-			}
-			init_phase2_iv(st, &md->hdr.isa_msgid);
-			new_iv_set = TRUE;
-
-			from_state = STATE_INFO_PROTECTED;
-		}
-		else
-		{
-			if (st != NULL && IS_ISAKMP_ENCRYPTED(st->st_state))
-			{
-				loglog(RC_LOG_SERIOUS, "Informational Exchange message"
-					" must be encrypted");
-				/* XXX Could send notification back */
-				return;
-			}
-			from_state = STATE_INFO;
-		}
-		break;
-
-	case ISAKMP_XCHG_QUICK:     /* part of a Quick Mode exchange */
-		if (is_zero_cookie(md->hdr.isa_icookie))
-		{
-			plog("Quick Mode message is invalid because"
-				" it has an Initiator Cookie of 0");
-			SEND_NOTIFICATION(ISAKMP_INVALID_COOKIE);
-			return;
-		}
-
-		if (is_zero_cookie(md->hdr.isa_rcookie))
-		{
-			plog("Quick Mode message is invalid because"
-				" it has a Responder Cookie of 0");
-			SEND_NOTIFICATION(ISAKMP_INVALID_COOKIE);
-			return;
-		}
-
-		if (md->hdr.isa_msgid == MAINMODE_MSGID)
-		{
-			plog("Quick Mode message is invalid because"
-				" it has a Message ID of 0");
-			SEND_NOTIFICATION(ISAKMP_INVALID_MESSAGE_ID);
-			return;
-		}
-
-		st = find_state(md->hdr.isa_icookie, md->hdr.isa_rcookie
-			, &md->sender, md->hdr.isa_msgid);
-
-		if (st == NULL)
-		{
-			/* No appropriate Quick Mode state.
-			 * See if we have a Main Mode state.
-			 * ??? what if this is a duplicate of another message?
-			 */
-			st = find_state(md->hdr.isa_icookie, md->hdr.isa_rcookie
-				, &md->sender, MAINMODE_MSGID);
-
-			if (st == NULL)
-			{
-				plog("Quick Mode message is for a non-existent (expired?)"
-					" ISAKMP SA");
-				/* XXX Could send notification back */
-				return;
-			}
-
-			set_cur_state(st);
-
-			if (!IS_ISAKMP_SA_ESTABLISHED(st->st_state))
-			{
-				loglog(RC_LOG_SERIOUS, "Quick Mode message is unacceptable because"
-					" it is for an incomplete ISAKMP SA");
-				SEND_NOTIFICATION(ISAKMP_PAYLOAD_MALFORMED /* XXX ? */);
-				return;
-			}
-
-			/* only accept this new Quick Mode exchange if it has a unique message ID */
-			if (!reserve_msgid(st, md->hdr.isa_msgid))
-			{
-				loglog(RC_LOG_SERIOUS, "Quick Mode I1 message is unacceptable because"
-					" it uses a previously used Message ID 0x%08lx"
-					" (perhaps this is a duplicated packet)"
-					, (unsigned long) md->hdr.isa_msgid);
-				SEND_NOTIFICATION(ISAKMP_INVALID_MESSAGE_ID);
-				return;
-			}
-
-			/* Quick Mode Initial IV */
-			init_phase2_iv(st, &md->hdr.isa_msgid);
-			new_iv_set = TRUE;
-
-			from_state = STATE_QUICK_R0;
-		}
-		else
-		{
-			set_cur_state(st);
-			from_state = st->st_state;
-		}
-
-		break;
-
-	case ISAKMP_XCHG_MODE_CFG:
-		if (is_zero_cookie(md->hdr.isa_icookie))
-		{
-			plog("ModeCfg message is invalid because"
-				" it has an Initiator Cookie of 0");
-			/* XXX Could send notification back */
-			return;
-		}
-
-		if (is_zero_cookie(md->hdr.isa_rcookie))
-		{
-			plog("ModeCfg message is invalid because"
-				" it has a Responder Cookie of 0");
-			/* XXX Could send notification back */
-			return;
-		}
-
-		if (md->hdr.isa_msgid == 0)
-		{
-			plog("ModeCfg message is invalid because"
-				" it has a Message ID of 0");
-			/* XXX Could send notification back */
-			return;
-		}
-
-		st = find_state(md->hdr.isa_icookie, md->hdr.isa_rcookie
-						, &md->sender, md->hdr.isa_msgid);
-
-		if (st == NULL)
-		{
-			bool has_xauth_policy;
-
-			/* No appropriate ModeCfg state.
-			 * See if we have a Main Mode state.
-			 * ??? what if this is a duplicate of another message?
-			 */
-			st = find_state(md->hdr.isa_icookie, md->hdr.isa_rcookie
-							, &md->sender, 0);
-
-			if (st == NULL)
-			{
-				plog("ModeCfg message is for a non-existent (expired?)"
-					" ISAKMP SA");
-				/* XXX Could send notification back */
-				return;
-			}
-
-			set_cur_state(st);
-
-			/* the XAUTH_STATUS message might have a new msgid */
-			if (st->st_state == STATE_XAUTH_I1)
-			{
-				init_phase2_iv(st, &md->hdr.isa_msgid);
-				new_iv_set = TRUE;
-				from_state = st->st_state;
-				break;
-			}
-
-			if (!IS_ISAKMP_SA_ESTABLISHED(st->st_state))
-			{
-				loglog(RC_LOG_SERIOUS, "ModeCfg message is unacceptable because"
-						" it is for an incomplete ISAKMP SA (state=%s)"
-						, enum_name(&state_names, st->st_state));
-				/* XXX Could send notification back */
-				return;
-			}
-			init_phase2_iv(st, &md->hdr.isa_msgid);
-			new_iv_set = TRUE;
-
-			/*
-			 * okay, now we have to figure out if we are receiving a bogus
-			 * new message in an outstanding XAUTH server conversation
-			 * (i.e. a reply to our challenge)
-			 * (this occurs with some broken other implementations).
-			 *
-			 * or if receiving for the first time, an XAUTH challenge.
-			 *
-			 * or if we are getting a MODECFG request.
-			 *
-			 * we distinguish these states because we can not both be an
-			 * XAUTH server and client, and our policy tells us which
-			 * one we are.
-			 *
-			 * to complicate further, it is normal to start a new msgid
-			 * when going from one state to another, or when restarting
-			 * the challenge.
-			 *
-			 */
-
-			has_xauth_policy = (st->st_connection->policy
-							   & (POLICY_XAUTH_RSASIG | POLICY_XAUTH_PSK))
-							   != LEMPTY;
-
-			if (has_xauth_policy && !st->st_xauth.started
-			&& IS_PHASE1(st->st_state))
-			{
-				from_state = STATE_XAUTH_I0;
-			}
-			else if (st->st_connection->spd.that.modecfg
-			&& IS_PHASE1(st->st_state))
-			{
-				from_state = STATE_MODE_CFG_R0;
-			}
-			else if (st->st_connection->spd.this.modecfg
-			&& IS_PHASE1(st->st_state))
-			{
-				from_state = STATE_MODE_CFG_I0;
-			}
-			else
-			{
-				/* XXX check if we are being a mode config server here */
-				plog("received ModeCfg message when in state %s, and we aren't mode config client"
-					 , enum_name(&state_names, st->st_state));
-				return;
-			}
-		}
-		else
-		{
-			set_cur_state(st);
-			from_state = st->st_state;
-		}
-		break;
-
-#ifdef NOTYET
-	case ISAKMP_XCHG_NGRP:
-	case ISAKMP_XCHG_ACK_INFO:
-#endif
-
-	default:
-		plog("unsupported exchange type %s in message"
-			, enum_show(&exchange_names, md->hdr.isa_xchg));
-		SEND_NOTIFICATION(ISAKMP_UNSUPPORTED_EXCHANGE_TYPE);
-		return;
-	}
-
-	/* We have found a from_state, and perhaps a state object.
-	 * If we need to build a new state object,
-	 * we wait until the packet has been sanity checked.
-	 */
-
-	/* We don't support the Commit Flag.  It is such a bad feature.
-	 * It isn't protected -- neither encrypted nor authenticated.
-	 * A man in the middle turns it on, leading to DoS.
-	 * We just ignore it, with a warning.
-	 * By placing the check here, we could easily add a policy bit
-	 * to a connection to suppress the warning.  This might be useful
-	 * because the Commit Flag is expected from some peers.
-	 */
-	if (md->hdr.isa_flags & ISAKMP_FLAG_COMMIT)
-	{
-		plog("IKE message has the Commit Flag set but Pluto doesn't implement this feature; ignoring flag");
-	}
-
-	/* Set smc to describe this state's properties.
-	 * Look up the appropriate microcode based on state and
-	 * possibly Oakley Auth type.
-	 */
-	passert(STATE_IKE_FLOOR <= from_state && from_state < STATE_IKE_ROOF);
-	smc = ike_microcode_index[from_state - STATE_IKE_FLOOR];
-
-	if (st != NULL)
-	{
-		u_int16_t auth;
-
-		switch (st->st_oakley.auth)
-		{
-		case XAUTHInitPreShared:
-		case XAUTHRespPreShared:
-			auth = OAKLEY_PRESHARED_KEY;
-			break;
-		case XAUTHInitRSA:
-		case XAUTHRespRSA:
-			auth = OAKLEY_RSA_SIG;
-			break;
-		default:
-			auth = st->st_oakley.auth;
-		}
-
-		while (!LHAS(smc->flags, auth))
-		{
-			smc++;
-			passert(smc->state == from_state);
-		}
-	}
-
-	/* Ignore a packet if the state has a suspended state transition
-	 * Probably a duplicated packet but the original packet is not yet
-	 * recorded in st->st_rpacket, so duplicate checking won't catch.
-	 * ??? Should the packet be recorded earlier to improve diagnosis?
-	 */
-	if (st != NULL && st->st_suspended_md != NULL)
-	{
-		loglog(RC_LOG, "discarding packet received during DNS lookup in %s"
-			, enum_name(&state_names, st->st_state));
-		return;
-	}
-
-	/* Detect and handle duplicated packets.
-	 * This won't work for the initial packet of an exchange
-	 * because we won't have a state object to remember it.
-	 * If we are in a non-receiving state (terminal), and the preceding
-	 * state did transmit, then the duplicate may indicate that that
-	 * transmission wasn't received -- retransmit it.
-	 * Otherwise, just discard it.
-	 * ??? Notification packets are like exchanges -- I hope that
-	 * they are idempotent!
-	 */
-	if (st != NULL
-	&& st->st_rpacket.ptr != NULL
-	&& st->st_rpacket.len == pbs_room(&md->packet_pbs)
-	&& memeq(st->st_rpacket.ptr, md->packet_pbs.start, st->st_rpacket.len))
-	{
-		if (smc->flags & SMF_RETRANSMIT_ON_DUPLICATE)
-		{
-			if (st->st_retransmit < MAXIMUM_RETRANSMISSIONS)
-			{
-				st->st_retransmit++;
-				loglog(RC_RETRANSMISSION
-					, "retransmitting in response to duplicate packet; already %s"
-					, enum_name(&state_names, st->st_state));
-				send_packet(st, "retransmit in response to duplicate");
-			}
-			else
-			{
-				loglog(RC_LOG_SERIOUS, "discarding duplicate packet -- exhausted retransmission; already %s"
-					, enum_name(&state_names, st->st_state));
-			}
-		}
-		else
-		{
-			loglog(RC_LOG_SERIOUS, "discarding duplicate packet; already %s"
-				, enum_name(&state_names, st->st_state));
-		}
-		return;
-	}
-
-	if (md->hdr.isa_flags & ISAKMP_FLAG_ENCRYPTION)
-	{
-		DBG(DBG_CRYPT, DBG_log("received encrypted packet from %s:%u"
-			, ip_str(&md->sender), (unsigned)md->sender_port));
-
-		if (st == NULL)
-		{
-			plog("discarding encrypted message for an unknown ISAKMP SA");
-			SEND_NOTIFICATION(ISAKMP_PAYLOAD_MALFORMED /* XXX ? */);
-			return;
-		}
-		if (st->st_skeyid_e.ptr == (u_char *) NULL)
-		{
-			loglog(RC_LOG_SERIOUS, "discarding encrypted message"
-				" because we haven't yet negotiated keying materiel");
-			SEND_NOTIFICATION(ISAKMP_INVALID_FLAGS);
-			return;
-		}
-
-		/* Mark as encrypted */
-		md->encrypted = TRUE;
-
-		DBG(DBG_CRYPT, DBG_log("decrypting %u bytes using algorithm %s"
-			, (unsigned) pbs_left(&md->message_pbs)
-			, enum_show(&oakley_enc_names, st->st_oakley.encrypt)));
-
-		/* do the specified decryption
-		 *
-		 * IV is from st->st_iv or (if new_iv_set) st->st_new_iv.
-		 * The new IV is placed in st->st_new_iv
-		 *
-		 * See RFC 2409 "IKE" Appendix B
-		 *
-		 * XXX The IV should only be updated really if the packet
-		 * is successfully processed.
-		 * We should keep this value, check for a success return
-		 * value from the parsing routines and then replace.
-		 *
-		 * Each post phase 1 exchange generates IVs from
-		 * the last phase 1 block, not the last block sent.
-		 */
-		{
-			size_t crypter_block_size, crypter_iv_size;
-			encryption_algorithm_t enc_alg;
-			crypter_t *crypter;
-			chunk_t data, iv;
-		    char *new_iv;
-
-			enc_alg = oakley_to_encryption_algorithm(st->st_oakley.encrypt);
-			crypter = lib->crypto->create_crypter(lib->crypto, enc_alg, st->st_enc_key.len);
-			crypter_block_size = crypter->get_block_size(crypter);
-			crypter_iv_size = crypter->get_iv_size(crypter);
-
-			if (pbs_left(&md->message_pbs) % crypter_block_size != 0)
-			{
-				loglog(RC_LOG_SERIOUS, "malformed message: not a multiple of encryption blocksize");
-				SEND_NOTIFICATION(ISAKMP_PAYLOAD_MALFORMED);
-				return;
-			}
-
-			/* XXX Detect weak keys */
-
-			/* grab a copy of raw packet (for duplicate packet detection) */
-			md->raw_packet = chunk_create(md->packet_pbs.start, pbs_room(&md->packet_pbs));
-			md->raw_packet = chunk_clone(md->raw_packet);
-
-			data = chunk_create(md->message_pbs.cur, pbs_left(&md->message_pbs));
-
-			/* Decrypt everything after header */
-			if (!new_iv_set)
-			{
-				/* use old IV */
-				passert(st->st_iv_len <= sizeof(st->st_new_iv));
-				st->st_new_iv_len = st->st_iv_len;
-				memcpy(st->st_new_iv, st->st_iv, st->st_new_iv_len);
-			}
-
-			/* form iv by truncation */
-			st->st_new_iv_len = crypter_iv_size;
-			iv = chunk_create(st->st_new_iv, st->st_new_iv_len);
-			new_iv = alloca(crypter_iv_size);
-			memcpy(new_iv, data.ptr + data.len - crypter_iv_size,
-				   crypter_iv_size);
-
-			crypter->set_key(crypter, st->st_enc_key);
-			crypter->decrypt(crypter, data, iv, NULL);
-			crypter->destroy(crypter);
-
-			memcpy(st->st_new_iv, new_iv, crypter_iv_size);
-			if (restore_iv)
-			{
-				memcpy(st->st_new_iv, new_iv, new_iv_len);
-				st->st_new_iv_len = new_iv_len;
-			}
-		}
-
-		DBG_cond_dump(DBG_CRYPT, "decrypted:\n", md->message_pbs.cur
-			, md->message_pbs.roof - md->message_pbs.cur);
-
-		DBG_cond_dump(DBG_CRYPT, "next IV:"
-			, st->st_new_iv, st->st_new_iv_len);
-	}
-	else
-	{
-		/* packet was not encryped -- should it have been? */
-
-		if (smc->flags & SMF_INPUT_ENCRYPTED)
-		{
-			loglog(RC_LOG_SERIOUS, "packet rejected: should have been encrypted");
-			SEND_NOTIFICATION(ISAKMP_INVALID_FLAGS);
-			return;
-		}
-	}
-
-	/* Digest the message.
-	 * Padding must be removed to make hashing work.
-	 * Padding comes from encryption (so this code must be after decryption).
-	 * Padding rules are described before the definition of
-	 * struct isakmp_hdr in packet.h.
-	 */
-	{
-		struct payload_digest *pd = md->digest;
-		int np = md->hdr.isa_np;
-		lset_t needed = smc->req_payloads;
-		const char *excuse
-			= LIN(SMF_PSK_AUTH | SMF_FIRST_ENCRYPTED_INPUT, smc->flags)
-				? "probable authentication failure (mismatch of preshared secrets?): "
-				: "";
-
-		while (np != ISAKMP_NEXT_NONE)
-		{
-			struct_desc *sd = np < ISAKMP_NEXT_ROOF? payload_descs[np] : NULL;
-
-			if (pd == &md->digest[PAYLIMIT])
-			{
-				loglog(RC_LOG_SERIOUS, "more than %d payloads in message; ignored", PAYLIMIT);
-				SEND_NOTIFICATION(ISAKMP_PAYLOAD_MALFORMED);
-				return;
-			}
-
-			switch (np)
-			{
-				case ISAKMP_NEXT_NATD_RFC:
-				case ISAKMP_NEXT_NATOA_RFC:
-					if (!st || !(st->nat_traversal & NAT_T_WITH_RFC_VALUES))
-					{
-						/*
-						 * don't accept NAT-D/NAT-OA reloc directly in message, unless
-						 * we're using NAT-T RFC
-						 */
-						sd = NULL;
-					}
-					break;
-			}
-
-			if (sd == NULL)
-			{
-				/* payload type is out of range or requires special handling */
-				switch (np)
-				{
-				case ISAKMP_NEXT_ID:
-					sd = IS_PHASE1(from_state)
-						? &isakmp_identification_desc : &isakmp_ipsec_identification_desc;
-					break;
-				case ISAKMP_NEXT_NATD_DRAFTS:
-					np = ISAKMP_NEXT_NATD_RFC;  /* NAT-D relocated */
-					sd = payload_descs[np];
-					break;
-				case ISAKMP_NEXT_NATOA_DRAFTS:
-					np = ISAKMP_NEXT_NATOA_RFC;  /* NAT-OA relocated */
-					sd = payload_descs[np];
-					break;
-				default:
-					loglog(RC_LOG_SERIOUS, "%smessage ignored because it contains an unknown or"
-						" unexpected payload type (%s) at the outermost level"
-						, excuse, enum_show(&payload_names, np));
-					SEND_NOTIFICATION(ISAKMP_INVALID_PAYLOAD_TYPE);
-					return;
-				}
-			}
-
-			{
-				lset_t s = LELEM(np);
-
-				if (LDISJOINT(s
-				, needed | smc->opt_payloads| LELEM(ISAKMP_NEXT_N) | LELEM(ISAKMP_NEXT_D)))
-				{
-					loglog(RC_LOG_SERIOUS, "%smessage ignored because it "
-						   "contains an unexpected payload type (%s)"
-						, excuse, enum_show(&payload_names, np));
-					SEND_NOTIFICATION(ISAKMP_INVALID_PAYLOAD_TYPE);
-					return;
-				}
-				needed &= ~s;
-			}
-
-			if (!in_struct(&pd->payload, sd, &md->message_pbs, &pd->pbs))
-			{
-				loglog(RC_LOG_SERIOUS, "%smalformed payload in packet", excuse);
-				if (md->hdr.isa_xchg != ISAKMP_XCHG_INFO)
-					SEND_NOTIFICATION(ISAKMP_PAYLOAD_MALFORMED);
-				return;
-			}
-
-			/* place this payload at the end of the chain for this type */
-			{
-				struct payload_digest **p;
-
-				for (p = &md->chain[np]; *p != NULL; p = &(*p)->next)
-					;
-				*p = pd;
-				pd->next = NULL;
-			}
-
-			np = pd->payload.generic.isag_np;
-			pd++;
-
-			/* since we've digested one payload happily, it is probably
-			 * the case that any decryption worked.  So we will not suggest
-			 * encryption failure as an excuse for subsequent payload
-			 * problems.
-			 */
-			excuse = "";
-		}
-
-		md->digest_roof = pd;
-
-		DBG(DBG_PARSING,
-			if (pbs_left(&md->message_pbs) != 0)
-				DBG_log("removing %d bytes of padding", (int) pbs_left(&md->message_pbs)));
-
-		md->message_pbs.roof = md->message_pbs.cur;
-
-		/* check that all mandatory payloads appeared */
-
-		if (needed != 0)
-		{
-			loglog(RC_LOG_SERIOUS, "message for %s is missing payloads %s"
-				, enum_show(&state_names, from_state)
-				, bitnamesof(payload_name, needed));
-			SEND_NOTIFICATION(ISAKMP_PAYLOAD_MALFORMED);
-			return;
-		}
-	}
-
-	/* more sanity checking: enforce most ordering constraints */
-
-	if (IS_PHASE1(from_state))
-	{
-		/* rfc2409: The Internet Key Exchange (IKE), 5 Exchanges:
-		 * "The SA payload MUST precede all other payloads in a phase 1 exchange."
-		 */
-		if (md->chain[ISAKMP_NEXT_SA] != NULL
-		&& md->hdr.isa_np != ISAKMP_NEXT_SA)
-		{
-			loglog(RC_LOG_SERIOUS, "malformed Phase 1 message: does not start with an SA payload");
-			SEND_NOTIFICATION(ISAKMP_PAYLOAD_MALFORMED);
-			return;
-		}
-	}
-	else if (IS_QUICK(from_state))
-	{
-		/* rfc2409: The Internet Key Exchange (IKE), 5.5 Phase 2 - Quick Mode
-		 *
-		 * "In Quick Mode, a HASH payload MUST immediately follow the ISAKMP
-		 *  header and a SA payload MUST immediately follow the HASH."
-		 * [NOTE: there may be more than one SA payload, so this is not
-		 *  totally reasonable.  Probably all SAs should be so constrained.]
-		 *
-		 * "If ISAKMP is acting as a client negotiator on behalf of another
-		 *  party, the identities of the parties MUST be passed as IDci and
-		 *  then IDcr."
-		 *
-		 * "With the exception of the HASH, SA, and the optional ID payloads,
-		 *  there are no payload ordering restrictions on Quick Mode."
-		 */
-
-		if (md->hdr.isa_np != ISAKMP_NEXT_HASH)
-		{
-			loglog(RC_LOG_SERIOUS, "malformed Quick Mode message: does not start with a HASH payload");
-			SEND_NOTIFICATION(ISAKMP_PAYLOAD_MALFORMED);
-			return;
-		}
-
-		{
-			struct payload_digest *p;
-			int i;
-
-			for (p = md->chain[ISAKMP_NEXT_SA], i = 1; p != NULL
-			; p = p->next, i++)
-			{
-				if (p != &md->digest[i])
-				{
-					loglog(RC_LOG_SERIOUS, "malformed Quick Mode message: SA payload is in wrong position");
-					SEND_NOTIFICATION(ISAKMP_PAYLOAD_MALFORMED);
-					return;
-				}
-			}
-		}
-
-		/* rfc2409: The Internet Key Exchange (IKE), 5.5 Phase 2 - Quick Mode:
-		 * "If ISAKMP is acting as a client negotiator on behalf of another
-		 *  party, the identities of the parties MUST be passed as IDci and
-		 *  then IDcr."
-		 */
-		{
-			struct payload_digest *id = md->chain[ISAKMP_NEXT_ID];
-
-			if (id != NULL)
-			{
-				if (id->next == NULL || id->next->next != NULL)
-				{
-					loglog(RC_LOG_SERIOUS, "malformed Quick Mode message:"
-						" if any ID payload is present,"
-						" there must be exactly two");
-					SEND_NOTIFICATION(ISAKMP_PAYLOAD_MALFORMED);
-					return;
-				}
-				if (id+1 != id->next)
-				{
-					loglog(RC_LOG_SERIOUS, "malformed Quick Mode message:"
-						" the ID payloads are not adjacent");
-					SEND_NOTIFICATION(ISAKMP_PAYLOAD_MALFORMED);
-					return;
-				}
-			}
-		}
-	}
-
-	/* Ignore payloads that we don't handle:
-	 * Delete, Notification, VendorID
-	 */
-	/* XXX Handle deletions */
-	/* XXX Handle Notifications */
-	/* XXX Handle VID payloads */
-	{
-		struct payload_digest *p;
-
-		for (p = md->chain[ISAKMP_NEXT_N]; p != NULL; p = p->next)
-		{
-			if (p->payload.notification.isan_type != R_U_THERE
-			&&  p->payload.notification.isan_type != R_U_THERE_ACK)
-			{
-				loglog(RC_LOG_SERIOUS, "ignoring informational payload, type %s"
-					, enum_show(&notification_names, p->payload.notification.isan_type));
-			}
-			DBG_cond_dump(DBG_PARSING, "info:", p->pbs.cur, pbs_left(&p->pbs));
-		}
-
-		for (p = md->chain[ISAKMP_NEXT_D]; p != NULL; p = p->next)
-		{
-			accept_delete(st, md, p);
-			DBG_cond_dump(DBG_PARSING, "del:", p->pbs.cur, pbs_left(&p->pbs));
-		}
-
-		for (p = md->chain[ISAKMP_NEXT_VID]; p != NULL; p = p->next)
-		{
-			handle_vendorid(md, p->pbs.cur, pbs_left(&p->pbs));
-		}
-	}
-	md->from_state = from_state;
-	md->smc = smc;
-	md->st = st;
-
-	/* possibly fill in hdr */
-	if (smc->first_out_payload != ISAKMP_NEXT_NONE)
-		echo_hdr(md, (smc->flags & SMF_OUTPUT_ENCRYPTED) != 0
-			, smc->first_out_payload);
-
-	complete_state_transition(mdp, smc->processor(md));
-}
-
-/* complete job started by the state-specific state transition function */
-
-void
-complete_state_transition(struct msg_digest **mdp, stf_status result)
-{
-	bool has_xauth_policy;
-	bool is_xauth_server;
-	struct msg_digest *md = *mdp;
-	const struct state_microcode *smc = md->smc;
-	enum state_kind from_state = md->from_state;
-	struct state *st;
-
-	cur_state = st = md->st;    /* might have changed */
-
-	/* If state has DPD support, import it */
-	if (st && md->dpd)
-		st->st_dpd = TRUE;
-
-	switch (result)
-	{
-		case STF_IGNORE:
-			break;
-
-		case STF_SUSPEND:
-			/* the stf didn't complete its job: don't relase md */
-			*mdp = NULL;
-			break;
-
-		case STF_OK:
-			/* advance the state */
-			st->st_state = smc->next_state;
-
-			/* Delete previous retransmission event.
-			 * New event will be scheduled below.
-			 */
-			delete_event(st);
-
-			/* replace previous receive packet with latest */
-
-			free(st->st_rpacket.ptr);
-
-			if (md->encrypted)
-			{
-				/* if encrypted, duplication already done */
-				st->st_rpacket = md->raw_packet;
-				md->raw_packet.ptr = NULL;
-			}
-			else
-			{
-				st->st_rpacket = chunk_create(md->packet_pbs.start,
-											  pbs_room(&md->packet_pbs));
-				st->st_rpacket = chunk_clone(st->st_rpacket);
-			}
-
-			/* free previous transmit packet */
-			chunk_free(&st->st_tpacket);
-
-			/* if requested, send the new reply packet */
-			if (smc->flags & SMF_REPLY)
-			{
-				close_output_pbs(&md->reply);   /* good form, but actually a no-op */
-
-				st->st_tpacket = chunk_create(md->reply.start, pbs_offset(&md->reply));
-				st->st_tpacket = chunk_clone(st->st_tpacket);
-
-				if (nat_traversal_enabled)
-					nat_traversal_change_port_lookup(md, md->st);
-
-				/* actually send the packet
-				 * Note: this is a great place to implement "impairments"
-				 * for testing purposes.  Suppress or duplicate the
-				 * send_packet call depending on st->st_state.
-				 */
-				send_packet(st, enum_name(&state_names, from_state));
-			}
-
-			/* Schedule for whatever timeout is specified */
-			{
-				time_t delay = UNDEFINED_TIME;
-				enum event_type kind = smc->timeout_event;
-				bool agreed_time = FALSE;
-				connection_t *c = st->st_connection;
-
-				switch (kind)
-				{
-				case EVENT_RETRANSMIT:  /* Retransmit packet */
-					delay = EVENT_RETRANSMIT_DELAY_0;
-					break;
-
-				case EVENT_SA_REPLACE:  /* SA replacement event */
-					if (IS_PHASE1(st->st_state))
-					{
-						/* Note: we will defer to the "negotiated" (dictated)
-						 * lifetime if we are POLICY_DONT_REKEY.
-						 * This allows the other side to dictate
-						 * a time we would not otherwise accept
-						 * but it prevents us from having to initiate
-						 * rekeying.  The negative consequences seem
-						 * minor.
-						 */
-						delay = c->sa_ike_life_seconds;
-						if ((c->policy & POLICY_DONT_REKEY)
-						|| delay >= st->st_oakley.life_seconds)
-						{
-							agreed_time = TRUE;
-							delay = st->st_oakley.life_seconds;
-						}
-					}
-					else
-					{
-						/* Delay is min of up to four things:
-						 * each can limit the lifetime.
-						 */
-						delay = c->sa_ipsec_life_seconds;
-						if (st->st_ah.present
-						&& delay >= st->st_ah.attrs.life_seconds)
-						{
-							agreed_time = TRUE;
-							delay = st->st_ah.attrs.life_seconds;
-						}
-						if (st->st_esp.present
-						&& delay >= st->st_esp.attrs.life_seconds)
-						{
-							agreed_time = TRUE;
-							delay = st->st_esp.attrs.life_seconds;
-						}
-						if (st->st_ipcomp.present
-						&& delay >= st->st_ipcomp.attrs.life_seconds)
-						{
-							agreed_time = TRUE;
-							delay = st->st_ipcomp.attrs.life_seconds;
-						}
-					}
-
-					/* By default, we plan to rekey.
-					 *
-					 * If there isn't enough time to rekey, plan to
-					 * expire.
-					 *
-					 * If we are --dontrekey, a lot more rules apply.
-					 * If we are the Initiator, use REPLACE_IF_USED.
-					 * If we are the Responder, and the dictated time
-					 * was unacceptable (too large), plan to REPLACE
-					 * (the only way to ratchet down the time).
-					 * If we are the Responder, and the dictated time
-					 * is acceptable, plan to EXPIRE.
-					 *
-					 * Important policy lies buried here.
-					 * For example, we favour the initiator over the
-					 * responder by making the initiator start rekeying
-					 * sooner.  Also, fuzz is only added to the
-					 * initiator's margin.
-					 *
-					 * Note: for ISAKMP SA, we let the negotiated
-					 * time stand (implemented by earlier logic).
-					 */
-					if (agreed_time
-					&& (c->policy & POLICY_DONT_REKEY))
-					{
-						kind = (smc->flags & SMF_INITIATOR)
-							? EVENT_SA_REPLACE_IF_USED
-							: EVENT_SA_EXPIRE;
-					}
-					if (kind != EVENT_SA_EXPIRE)
-					{
-						unsigned long marg = c->sa_rekey_margin;
-
-						if (smc->flags & SMF_INITIATOR)
-							marg += marg
-								* c->sa_rekey_fuzz / 100.E0
-								* (rand() / (RAND_MAX + 1.E0));
-						else
-							marg /= 2;
-
-						if ((unsigned long)delay > marg)
-						{
-							delay -= marg;
-							st->st_margin = marg;
-						}
-						else
-						{
-							kind = EVENT_SA_EXPIRE;
-						}
-					}
-					break;
-
-				case EVENT_NULL:                /* non-event */
-				case EVENT_REINIT_SECRET:       /* Refresh cookie secret */
-				default:
-					bad_case(kind);
-				}
-				event_schedule(kind, delay, st);
-			}
-
-			/* tell whack and log of progress */
-			{
-				const char *story = state_story[st->st_state];
-				enum rc_type w = RC_NEW_STATE + st->st_state;
-				char sadetails[128];
-
-				sadetails[0]='\0';
-
-				if (IS_IPSEC_SA_ESTABLISHED(st->st_state))
-				{
-					char *b = sadetails;
-					const char *ini = " {";
-					const char *fin = "";
-
-					/* -1 is to leave space for "fin" */
-
-					if (st->st_esp.present)
-					{
-						snprintf(b, sizeof(sadetails)-(b-sadetails)-1
-								 , "%sESP=>0x%08x <0x%08x"
-								 , ini
-								 , ntohl(st->st_esp.attrs.spi)
-								 , ntohl(st->st_esp.our_spi));
-						ini = " ";
-						fin = "}";
-					}
-					/* advance b to end of string */
-					b = b + strlen(b);
-
-					if (st->st_ah.present)
-					{
-						snprintf(b, sizeof(sadetails)-(b-sadetails)-1
-								 , "%sAH=>0x%08x <0x%08x"
-								 , ini
-								 , ntohl(st->st_ah.attrs.spi)
-								 , ntohl(st->st_ah.our_spi));
-						ini = " ";
-						fin = "}";
-					}
-					/* advance b to end of string */
-					b = b + strlen(b);
-
-					if (st->st_ipcomp.present)
-					{
-						snprintf(b, sizeof(sadetails)-(b-sadetails)-1
-								 , "%sIPCOMP=>0x%08x <0x%08x"
-								 , ini
-								 , ntohl(st->st_ipcomp.attrs.spi)
-								 , ntohl(st->st_ipcomp.our_spi));
-						ini = " ";
-						fin = "}";
-					}
-					/* advance b to end of string */
-					b = b + strlen(b);
-
-					if (st->nat_traversal)
-					{
-						char oa[ADDRTOT_BUF];
-						addrtot(&st->nat_oa, 0, oa, sizeof(oa));
-						snprintf(b, sizeof(sadetails)-(b-sadetails)-1
-								 , "%sNATOA=%s"
-								 , ini, oa);
-						ini = " ";
-						fin = "}";
-					}
-
-					/* advance b to end of string */
-					b = b + strlen(b);
-
-					if (st->st_dpd)
-					{
-						snprintf(b, sizeof(sadetails)-(b-sadetails)-1
-								 , "%sDPD"
-								 , ini);
-						ini = " ";
-						fin = "}";
-					}
-
-					strcat(b, fin);
-				}
-
-				if (IS_ISAKMP_SA_ESTABLISHED(st->st_state)
-				||  IS_IPSEC_SA_ESTABLISHED(st->st_state))
-				{
-					/* log our success */
-					plog("%s%s", story, sadetails);
-					w = RC_SUCCESS;
-				}
-
-				/* tell whack our progress */
-				whack_log(w
-					, "%s: %s%s"
-					, enum_name(&state_names, st->st_state)
-					, story, sadetails);
-			}
-
-			has_xauth_policy = (st->st_connection->policy
-							   & (POLICY_XAUTH_RSASIG | POLICY_XAUTH_PSK))
-							   != LEMPTY;
-			is_xauth_server =  (st->st_connection->policy
-							   & POLICY_XAUTH_SERVER)
-							   != LEMPTY;
-
-			/* Should we start XAUTH as a server */
-			if (has_xauth_policy && is_xauth_server
-			&& IS_ISAKMP_SA_ESTABLISHED(st->st_state)
-			&& !st->st_xauth.started)
-			{
-				DBG(DBG_CONTROL,
-					DBG_log("starting XAUTH server")
-				)
-				xauth_send_request(st);
-				break;
-			}
-
-			/* Wait for XAUTH request from server */
-			if (has_xauth_policy && !is_xauth_server
-			&& IS_ISAKMP_SA_ESTABLISHED(st->st_state)
-			&& !st->st_xauth.started)
-			{
-				DBG(DBG_CONTROL,
-					DBG_log("waiting for XAUTH request from server")
-				)
-				break;
-			}
-
-			/* Should we start ModeConfig as a client? */
-			if (st->st_connection->spd.this.modecfg
-			&& IS_ISAKMP_SA_ESTABLISHED(st->st_state)
-			&& !(st->st_connection->policy & POLICY_MODECFG_PUSH)
-			&& !st->st_modecfg.started)
-			{
-				DBG(DBG_CONTROL,
-					DBG_log("starting ModeCfg client in pull mode")
-				)
-				modecfg_send_request(st);
-				break;
-			}
-
-			/* Should we start ModeConfig as a server? */
-			if (st->st_connection->spd.that.modecfg
-			&& IS_ISAKMP_SA_ESTABLISHED(st->st_state)
-			&& !st->st_modecfg.started
-			&& (st->st_connection->policy & POLICY_MODECFG_PUSH))
-			{
-				DBG(DBG_CONTROL,
-					DBG_log("starting ModeCfg server in push mode")
-				)
-				modecfg_send_set(st);
-				break;
-			}
-
-			/* Wait for ModeConfig set from server */
-			if (st->st_connection->spd.this.modecfg
-			&& IS_ISAKMP_SA_ESTABLISHED(st->st_state)
-			&& !st->st_modecfg.vars_set)
-			{
-				DBG(DBG_CONTROL,
-					DBG_log("waiting for ModeCfg set from server")
-				)
-				break;
-			}
-
-			if (smc->flags & SMF_RELEASE_PENDING_P2)
-			{
-				/* Initiate any Quick Mode negotiations that
-				 * were waiting to piggyback on this Keying Channel.
-				 *
-				 * ??? there is a potential race condition
-				 * if we are the responder: the initial Phase 2
-				 * message might outrun the final Phase 1 message.
-				 * I think that retransmission will recover.
-				 */
-				unpend(st);
-			}
-
-			if (IS_ISAKMP_SA_ESTABLISHED(st->st_state)
-			||  IS_IPSEC_SA_ESTABLISHED(st->st_state))
-				release_whack(st);
-			break;
-
-		case STF_INTERNAL_ERROR:
-			whack_log(RC_INTERNALERR + md->note
-				, "%s: internal error"
-				, enum_name(&state_names, st->st_state));
-
-			DBG(DBG_CONTROL,
-				DBG_log("state transition function for %s had internal error"
-					, enum_name(&state_names, from_state)));
-			break;
-
-		default:        /* a shortcut to STF_FAIL, setting md->note */
-			passert(result > STF_FAIL);
-			md->note = result - STF_FAIL;
-			result = STF_FAIL;
-			/* FALL THROUGH ... */
-		case STF_FAIL:
-			/* As it is, we act as if this message never happened:
-			 * whatever retrying was in place, remains in place.
-			 */
-			whack_log(RC_NOTIFICATION + md->note
-				, "%s: %s"
-				, enum_name(&state_names, (st == NULL)? STATE_MAIN_R0:st->st_state)
-				, enum_name(&notification_names, md->note));
-
-			SEND_NOTIFICATION(md->note);
-
-			DBG(DBG_CONTROL,
-				DBG_log("state transition function for %s failed: %s"
-					, enum_name(&state_names, from_state)
-					, enum_name(&notification_names, md->note)));
-			break;
-	}
-}