- some logging improvements and cosmetics
[strongswan.git] / src / charon / sa / states / ike_sa_init_responded.c
1 /**
2 * @file ike_sa_init_responded.c
3 *
4 * @brief State of a IKE_SA after responding to an IKE_SA_INIT request
5 *
6 */
7
8 /*
9 * Copyright (C) 2005 Jan Hutter, Martin Willi
10 * Hochschule fuer Technik Rapperswil
11 *
12 * This program is free software; you can redistribute it and/or modify it
13 * under the terms of the GNU General Public License as published by the
14 * Free Software Foundation; either version 2 of the License, or (at your
15 * option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
16 *
17 * This program is distributed in the hope that it will be useful, but
18 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
19 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * for more details.
21 */
22
23 #include <string.h>
24
25 #include "ike_sa_init_responded.h"
26
27 #include <daemon.h>
28 #include <sa/authenticator.h>
29 #include <sa/child_sa.h>
30 #include <encoding/payloads/ts_payload.h>
31 #include <encoding/payloads/sa_payload.h>
32 #include <encoding/payloads/id_payload.h>
33 #include <encoding/payloads/auth_payload.h>
34 #include <encoding/payloads/notify_payload.h>
35 #include <crypto/signers/signer.h>
36 #include <crypto/crypters/crypter.h>
37 #include <sa/states/ike_sa_established.h>
38
39
40 typedef struct private_ike_sa_init_responded_t private_ike_sa_init_responded_t;
41
42 /**
43 * Private data of a ike_sa_init_responded_t object.
44 *
45 */
46 struct private_ike_sa_init_responded_t {
47 /**
48 * Public interface of ike_sa_init_responded_t.
49 */
50 ike_sa_init_responded_t public;
51
52 /**
53 * Assigned IKE_SA.
54 */
55 protected_ike_sa_t *ike_sa;
56
57 /**
58 * Received nonce.
59 */
60 chunk_t received_nonce;
61
62 /**
63 * Sent nonce.
64 */
65 chunk_t sent_nonce;
66
67 /**
68 * Binary representation of the IKE_SA_INIT response.
69 */
70 chunk_t ike_sa_init_response_data;
71
72 /**
73 * Binary representation of the IKE_SA_INIT request.
74 */
75 chunk_t ike_sa_init_request_data;
76
77 /**
78 * SA config to use.
79 */
80 policy_t *policy;
81
82 /**
83 * CHILD_SA, if set up
84 */
85 child_sa_t *child_sa;
86
87 /**
88 * Traffic selectors applicable at our site
89 */
90 linked_list_t *my_ts;
91
92 /**
93 * Traffic selectors applicable at remote site
94 */
95 linked_list_t *other_ts;
96
97 /**
98 * Assigned logger.
99 *
100 * Is logger of ike_sa!
101 */
102 logger_t *logger;
103
104 /**
105 * Process received IDi and IDr payload and build IDr payload for IKE_AUTH response.
106 *
107 * @param this calling object
108 * @param request_idi ID payload representing initiator
109 * @param request_idr ID payload representing responder (May be zero)
110 * @param response The created IDr payload is added to this message_t object
111 * @param response_idr The created IDr payload is also written to this location
112 */
113 status_t (*build_idr_payload) (private_ike_sa_init_responded_t *this,
114 id_payload_t *request_idi,
115 id_payload_t *request_idr,
116 message_t *response,
117 id_payload_t **response_idr);
118
119 /**
120 * Process received SA payload and build SA payload for IKE_AUTH response.
121 *
122 * @param this calling object
123 * @param request SA payload received in IKE_AUTH request
124 * @param response The created SA payload is added to this message_t object
125 */
126 status_t (*build_sa_payload) (private_ike_sa_init_responded_t *this, sa_payload_t *request, message_t *response);
127
128 /**
129 * Process received AUTH payload and build AUTH payload for IKE_AUTH response.
130 *
131 * @param this calling object
132 * @param request AUTH payload received in IKE_AUTH request
133 * @param other_id_payload other ID payload needed to verify AUTH data
134 * @param my_id_payload my ID payload needed to compute AUTH data
135 * @param response The created AUTH payload is added to this message_t object
136 */
137 status_t (*build_auth_payload) (private_ike_sa_init_responded_t *this, auth_payload_t *request,id_payload_t *other_id_payload,id_payload_t *my_id_payload, message_t* response);
138
139 /**
140 * Process received TS payload and build TS payload for IKE_AUTH response.
141 *
142 * @param this calling object
143 * @param is_initiator type of TS payload. TRUE for TSi, FALSE for TSr
144 * @param request TS payload received in IKE_AUTH request
145 * @param response the created TS payload is added to this message_t object
146 */
147 status_t (*build_ts_payload) (private_ike_sa_init_responded_t *this, bool ts_initiator, ts_payload_t *request, message_t *response);
148
149 /**
150 * Sends a IKE_AUTH reply containing a notify payload.
151 *
152 * @param this calling object
153 * @param notify_payload payload to process
154 * @return
155 * - DESTROY_ME if IKE_SA should be deleted
156 * - SUCCSS if processed successfull
157 */
158 status_t (*process_notify_payload) (private_ike_sa_init_responded_t *this, notify_payload_t* notify_payload);
159
160 /**
161 * Destroy function called internally of this class after state change to
162 * state IKE_SA_ESTABLISHED succeeded.
163 *
164 * This destroy function does not destroy objects which were passed to the new state.
165 *
166 * @param this calling object
167 */
168 void (*destroy_after_state_change) (private_ike_sa_init_responded_t *this);
169 };
170
171 /**
172 * Implements state_t.get_state
173 */
174 static status_t process_message(private_ike_sa_init_responded_t *this, message_t *request)
175 {
176 id_payload_t *idi_request = NULL, *idr_request = NULL,*idr_response;
177 ts_payload_t *tsi_request = NULL, *tsr_request = NULL;
178 auth_payload_t *auth_request = NULL;
179 sa_payload_t *sa_request = NULL;
180 iterator_t *payloads;
181 message_t *response;
182 crypter_t *crypter;
183 signer_t *signer;
184 status_t status;
185 host_t *my_host, *other_host;
186 identification_t *my_id, *other_id;
187 connection_t *connection;
188
189 if (request->get_exchange_type(request) != IKE_AUTH)
190 {
191 this->logger->log(this->logger, ERROR | LEVEL1, "Message of type %s not supported in state ike_sa_init_responded",
192 mapping_find(exchange_type_m,request->get_exchange_type(request)));
193 return FAILED;
194 }
195
196 if (!request->get_request(request))
197 {
198 this->logger->log(this->logger, ERROR | LEVEL1, "IKE_AUTH responses not allowed state ike_sa_init_responded");
199 return FAILED;
200 }
201
202 /* get signer for verification and crypter for decryption */
203 signer = this->ike_sa->get_signer_initiator(this->ike_sa);
204 crypter = this->ike_sa->get_crypter_initiator(this->ike_sa);
205
206 status = request->parse_body(request, crypter, signer);
207 if (status != SUCCESS)
208 {
209 if (status == NOT_SUPPORTED)
210 {
211 this->logger->log(this->logger, ERROR | LEVEL1, "IKE_AUTH request contains unsupported payload with critical flag set. "
212 "Deleting IKE_SA");
213 this->ike_sa->send_notify(this->ike_sa, IKE_AUTH, UNSUPPORTED_CRITICAL_PAYLOAD, CHUNK_INITIALIZER);
214 return DESTROY_ME;
215 }
216 else
217 {
218 this->logger->log(this->logger, AUDIT, "IKE_AUTH request decryption failed. Ignoring message");
219 }
220 return status;
221 }
222
223 /* iterate over incoming payloads. Message is verified, we can be sure there are the required payloads */
224 payloads = request->get_payload_iterator(request);
225 while (payloads->has_next(payloads))
226 {
227 payload_t *payload;
228 payloads->current(payloads, (void**)&payload);
229
230 switch (payload->get_type(payload))
231 {
232 case ID_INITIATOR:
233 {
234 idi_request = (id_payload_t*)payload;
235 break;
236 }
237 case AUTHENTICATION:
238 {
239 auth_request = (auth_payload_t*)payload;
240 break;
241 }
242 case ID_RESPONDER:
243 {
244 idr_request = (id_payload_t*)payload;
245 break;
246 }
247 case SECURITY_ASSOCIATION:
248 {
249 sa_request = (sa_payload_t*)payload;
250 break;
251 }
252 case TRAFFIC_SELECTOR_INITIATOR:
253 {
254 tsi_request = (ts_payload_t*)payload;
255 break;
256 }
257 case TRAFFIC_SELECTOR_RESPONDER:
258 {
259 tsr_request = (ts_payload_t*)payload;
260 break;
261 }
262 case NOTIFY:
263 {
264 notify_payload_t *notify_payload = (notify_payload_t *) payload;
265 status = this->process_notify_payload(this, notify_payload);
266 if (status != SUCCESS)
267 {
268 payloads->destroy(payloads);
269 return status;
270 }
271 }
272 case CERTIFICATE:
273 {
274 /* TODO handle cert payloads */
275 }
276 case CERTIFICATE_REQUEST:
277 {
278 /* TODO handle certrequest payloads */
279 }
280 default:
281 {
282 this->logger->log(this->logger, ERROR|LEVEL1, "Ignoring payload %s (%d)",
283 mapping_find(payload_type_m, payload->get_type(payload)), payload->get_type(payload));
284 break;
285 }
286 }
287 }
288 /* iterator can be destroyed */
289 payloads->destroy(payloads);
290
291 /* check if we have all payloads */
292 if (!(idi_request && sa_request && auth_request && tsi_request && tsr_request))
293 {
294 this->logger->log(this->logger, AUDIT, "IKE_AUTH reply did not contain all required payloads. Deleting IKE_SA");
295 return DESTROY_ME;
296 }
297
298 /* build response */
299 this->ike_sa->build_message(this->ike_sa, IKE_AUTH, FALSE, &response);
300
301 /* add payloads to it */
302 status = this->build_idr_payload(this, idi_request, idr_request, response, &idr_response);
303 if (status != SUCCESS)
304 {
305 response->destroy(response);
306 return status;
307 }
308 status = this->build_auth_payload(this, auth_request,idi_request, idr_response,response);
309 if (status != SUCCESS)
310 {
311 response->destroy(response);
312 return status;
313 }
314 status = this->build_sa_payload(this, sa_request, response);
315 if (status != SUCCESS)
316 {
317 response->destroy(response);
318 return status;
319 }
320 status = this->build_ts_payload(this, TRUE, tsi_request, response);
321 if (status != SUCCESS)
322 {
323 response->destroy(response);
324 return status;
325 }
326 status = this->build_ts_payload(this, FALSE, tsr_request, response);
327 if (status != SUCCESS)
328 {
329 response->destroy(response);
330 return status;
331 }
332
333 status = this->ike_sa->send_response(this->ike_sa, response);
334 /* message can now be sent (must not be destroyed) */
335 if (status != SUCCESS)
336 {
337 this->logger->log(this->logger, AUDIT, "Unable to send IKE_AUTH reply. Deleting IKE_SA");
338 response->destroy(response);
339 return DESTROY_ME;
340 }
341
342 /* install child SA policies */
343 if (!this->child_sa)
344 {
345 this->logger->log(this->logger, CONTROL, "Proposal negotiation failed, no CHILD_SA built");
346 }
347 else if (this->my_ts->get_count(this->my_ts) == 0 || this->other_ts->get_count(this->other_ts) == 0)
348 {
349 this->logger->log(this->logger, CONTROL, "Traffic selector negotiation failed, no CHILD_SA built");
350 this->child_sa->destroy(this->child_sa);
351 this->child_sa = NULL;
352 }
353 else
354 {
355 status = this->child_sa->add_policies(this->child_sa, this->my_ts, this->other_ts);
356 if (status != SUCCESS)
357 {
358 this->logger->log(this->logger, AUDIT, "Could not install CHILD_SA policy! Deleting IKE_SA");
359 return DESTROY_ME;
360 }
361 this->ike_sa->add_child_sa(this->ike_sa, this->child_sa);
362 }
363
364 /* create new state */
365 this->ike_sa->set_new_state(this->ike_sa, (state_t*)ike_sa_established_create(this->ike_sa));
366 this->destroy_after_state_change(this);
367
368 connection = this->ike_sa->get_connection(this->ike_sa);
369 my_host = connection->get_my_host(connection);
370 other_host = connection->get_other_host(connection);
371 my_id = connection->get_my_id(connection);
372 other_id = connection->get_other_id(connection);
373 this->logger->log(this->logger, AUDIT, "IKE_SA established %s[%s]...%s[%s]",
374 my_host->get_address(my_host), my_id->get_string(my_id),
375 other_host->get_address(other_host), other_id->get_string(other_id));
376
377 return SUCCESS;
378 }
379
380 /**
381 * Implementation of private_ike_sa_init_responded_t.build_idr_payload.
382 */
383 static status_t build_idr_payload(private_ike_sa_init_responded_t *this, id_payload_t *request_idi, id_payload_t *request_idr, message_t *response,id_payload_t **response_idr)
384 {
385 identification_t *other_id, *my_id = NULL;
386 connection_t *connection;
387 id_payload_t *idr_response;
388
389 connection = this->ike_sa->get_connection(this->ike_sa);
390
391 /* update adresses, as connection may contain wildcards, or wrong IDs */
392 other_id = request_idi->get_identification(request_idi);
393 if (request_idr)
394 {
395 my_id = request_idr->get_identification(request_idr);
396 connection->update_my_id(connection, my_id);
397 }
398 else
399 {
400 my_id = connection->get_my_id(connection);
401 }
402 connection->update_other_id(connection, other_id);
403
404 /* build new sa config */
405 this->policy = charon->policies->get_policy(charon->policies, my_id, other_id);
406 if (this->policy == NULL)
407 {
408 this->logger->log(this->logger, AUDIT, "We don't have a policy for IDs %s - %s. Deleting IKE_SA",
409 my_id->get_string(my_id), other_id->get_string(other_id));
410 return DESTROY_ME;
411 }
412
413 /* get my id from policy, which must contain a fully qualified valid id */
414 my_id = this->policy->get_my_id(this->policy);
415
416 /* update others traffic selectors with actually used address */
417 this->policy->update_other_ts(this->policy, response->get_destination(response));
418
419 /* set policy in ike_sa for other states */
420 this->ike_sa->set_policy(this->ike_sa, this->policy);
421
422 /* build response */
423 idr_response = id_payload_create_from_identification(FALSE, my_id);
424 response->add_payload(response, (payload_t*)idr_response);
425 *response_idr = idr_response;
426
427 return SUCCESS;
428 }
429
430 /**
431 * Implementation of private_ike_sa_init_responded_t.build_sa_payload.
432 */
433 static status_t build_sa_payload(private_ike_sa_init_responded_t *this, sa_payload_t *request, message_t *response)
434 {
435 proposal_t *proposal, *proposal_tmp;
436 linked_list_t *proposal_list;
437 sa_payload_t *sa_response;
438 chunk_t seed;
439 prf_plus_t *prf_plus;
440 status_t status;
441 connection_t *connection;
442
443 /* prepare reply */
444 sa_response = sa_payload_create();
445
446 /* get proposals from request, and select one with ours */
447 proposal_list = request->get_proposals(request);
448 this->logger->log(this->logger, CONTROL|LEVEL1, "Selecting proposals:");
449 proposal = this->policy->select_proposal(this->policy, proposal_list);
450 /* list is not needed anymore */
451 while (proposal_list->remove_last(proposal_list, (void**)&proposal_tmp) == SUCCESS)
452 {
453 proposal_tmp->destroy(proposal_tmp);
454 }
455 proposal_list->destroy(proposal_list);
456 /* do we have a proposal? */
457 if (proposal == NULL)
458 {
459 notify_payload_t *notify;
460 this->logger->log(this->logger, AUDIT, "IKE_AUTH request did not contain any proposals we accept. "
461 "Adding NO_PROPOSAL_CHOSEN notify");
462 /* add NO_PROPOSAL_CHOSEN and an empty SA payload */
463 notify = notify_payload_create_from_protocol_and_type(PROTO_IKE, NO_PROPOSAL_CHOSEN);
464 response->add_payload(response, (payload_t*)notify);
465 }
466 else
467 {
468 /* set up child sa */
469 seed = chunk_alloc(this->received_nonce.len + this->sent_nonce.len);
470 memcpy(seed.ptr, this->received_nonce.ptr, this->received_nonce.len);
471 memcpy(seed.ptr + this->received_nonce.len, this->sent_nonce.ptr, this->sent_nonce.len);
472 prf_plus = prf_plus_create(this->ike_sa->get_child_prf(this->ike_sa), seed);
473 chunk_free(&seed);
474
475 connection = this->ike_sa->get_connection(this->ike_sa);
476 this->child_sa = child_sa_create(connection->get_my_host(connection),
477 connection->get_other_host(connection));
478
479 status = this->child_sa->add(this->child_sa, proposal, prf_plus);
480 prf_plus->destroy(prf_plus);
481 if (status != SUCCESS)
482 {
483 this->logger->log(this->logger, AUDIT, "Could not install CHILD_SA! Deleting IKE_SA");
484 /* TODO: how do we handle this cleanly? */
485 sa_response->destroy(sa_response);
486 proposal->destroy(proposal);
487 return DESTROY_ME;
488 }
489
490 /* add proposal to sa payload */
491 sa_response->add_proposal(sa_response, proposal);
492 proposal->destroy(proposal);
493 }
494 response->add_payload(response, (payload_t*)sa_response);
495 return SUCCESS;
496 }
497
498 /**
499 * Implementation of private_ike_sa_init_responded_t.build_auth_payload.
500 */
501 static status_t build_auth_payload(private_ike_sa_init_responded_t *this, auth_payload_t *auth_request,id_payload_t *other_id_payload,id_payload_t *my_id_payload, message_t* response)
502 {
503 authenticator_t *authenticator;
504 auth_payload_t *auth_reply;
505 status_t status;
506
507 authenticator = authenticator_create(this->ike_sa);
508 status = authenticator->verify_auth_data(authenticator,auth_request, this->ike_sa_init_request_data,this->sent_nonce,other_id_payload,TRUE);
509
510 if (status != SUCCESS)
511 {
512 this->logger->log(this->logger, AUDIT, "IKE_AUTH request verification failed. Deleting IKE_SA");
513 this->ike_sa->send_notify(this->ike_sa, IKE_AUTH, AUTHENTICATION_FAILED, CHUNK_INITIALIZER);
514 authenticator->destroy(authenticator);
515 return DESTROY_ME;
516 }
517
518 status = authenticator->compute_auth_data(authenticator,&auth_reply, this->ike_sa_init_response_data,this->received_nonce,my_id_payload,FALSE);
519 authenticator->destroy(authenticator);
520 if (status != SUCCESS)
521 {
522 this->logger->log(this->logger, AUDIT, "Unable to build authentication data for IKE_AUTH reply. Deleting IKE_SA");
523 return DESTROY_ME;
524 }
525
526 response->add_payload(response, (payload_t *)auth_reply);
527 return SUCCESS;
528 }
529
530 /**
531 * Implementation of private_ike_sa_init_responded_t.build_ts_payload.
532 */
533 static status_t build_ts_payload(private_ike_sa_init_responded_t *this, bool ts_initiator, ts_payload_t *request, message_t* response)
534 {
535 linked_list_t *ts_received, *ts_selected;
536 traffic_selector_t *ts;
537 status_t status = SUCCESS;
538 ts_payload_t *ts_response;
539
540 /* build a reply payload with selected traffic selectors */
541 ts_received = request->get_traffic_selectors(request);
542 /* select ts depending on payload type */
543 if (ts_initiator)
544 {
545 ts_selected = this->policy->select_other_traffic_selectors(this->policy, ts_received);
546 this->other_ts = ts_selected;
547 }
548 else
549 {
550 ts_selected = this->policy->select_my_traffic_selectors(this->policy, ts_received);
551 this->my_ts = ts_selected;
552 }
553
554 ts_response = ts_payload_create_from_traffic_selectors(ts_initiator, ts_selected);
555 response->add_payload(response, (payload_t*)ts_response);
556
557 /* add notify if traffic selectors do not match */
558 if (!ts_initiator &&
559 (ts_selected->get_count(ts_selected) == 0 || this->other_ts->get_count(this->other_ts) == 0))
560 {
561 notify_payload_t *notify;
562
563 this->logger->log(this->logger, AUDIT, "IKE_AUTH request did not contain any traffic selectors we accept. "
564 "Adding TS_UNACCEPTABLE notify");
565
566 notify = notify_payload_create_from_protocol_and_type(0, TS_UNACCEPTABLE);
567 response->add_payload(response, (payload_t*)notify);
568 }
569
570 /* cleanup */
571 while (ts_received->remove_last(ts_received, (void**)&ts) == SUCCESS)
572 {
573 ts->destroy(ts);
574 }
575 ts_received->destroy(ts_received);
576
577 return status;
578 }
579
580 static status_t process_notify_payload(private_ike_sa_init_responded_t *this, notify_payload_t *notify_payload)
581 {
582 notify_message_type_t notify_message_type = notify_payload->get_notify_message_type(notify_payload);
583
584 this->logger->log(this->logger, CONTROL|LEVEL1, "Process notify type %s",
585 mapping_find(notify_message_type_m, notify_message_type));
586
587 switch (notify_message_type)
588 {
589 case SET_WINDOW_SIZE:
590 /*
591 * TODO Increase window size.
592 */
593 case INITIAL_CONTACT:
594 /*
595 * TODO Delete existing IKE_SA's with other Identity.
596 */
597 default:
598 {
599 this->logger->log(this->logger, AUDIT, "IKE_AUTH request contained an unknown notify (%d), ignored.", notify_message_type);
600 }
601 }
602
603 return SUCCESS;
604 }
605
606 /**
607 * Implementation of state_t.get_state.
608 */
609 static ike_sa_state_t get_state(private_ike_sa_init_responded_t *this)
610 {
611 return IKE_SA_INIT_RESPONDED;
612 }
613
614 /**
615 * Implementation of state_t.destroy.
616 */
617 static void destroy(private_ike_sa_init_responded_t *this)
618 {
619 chunk_free(&(this->received_nonce));
620 chunk_free(&(this->sent_nonce));
621 chunk_free(&(this->ike_sa_init_response_data));
622 chunk_free(&(this->ike_sa_init_request_data));
623 if (this->my_ts)
624 {
625 traffic_selector_t *ts;
626 while (this->my_ts->remove_last(this->my_ts, (void**)&ts) == SUCCESS)
627 {
628 ts->destroy(ts);
629 }
630 this->my_ts->destroy(this->my_ts);
631 }
632 if (this->other_ts)
633 {
634 traffic_selector_t *ts;
635 while (this->other_ts->remove_last(this->other_ts, (void**)&ts) == SUCCESS)
636 {
637 ts->destroy(ts);
638 }
639 this->other_ts->destroy(this->other_ts);
640 }
641 if (this->child_sa)
642 {
643 this->child_sa->destroy(this->child_sa);
644 }
645
646 free(this);
647 }
648 /**
649 * Implementation of private_ike_sa_init_responded.destroy_after_state_change.
650 */
651 static void destroy_after_state_change(private_ike_sa_init_responded_t *this)
652 {
653 chunk_free(&(this->received_nonce));
654 chunk_free(&(this->sent_nonce));
655 chunk_free(&(this->ike_sa_init_response_data));
656 chunk_free(&(this->ike_sa_init_request_data));
657 if (this->my_ts)
658 {
659 traffic_selector_t *ts;
660 while (this->my_ts->remove_last(this->my_ts, (void**)&ts) == SUCCESS)
661 {
662 ts->destroy(ts);
663 }
664 this->my_ts->destroy(this->my_ts);
665 }
666 if (this->other_ts)
667 {
668 traffic_selector_t *ts;
669 while (this->other_ts->remove_last(this->other_ts, (void**)&ts) == SUCCESS)
670 {
671 ts->destroy(ts);
672 }
673 this->other_ts->destroy(this->other_ts);
674 }
675
676 free(this);
677 }
678
679 /*
680 * Described in header.
681 */
682 ike_sa_init_responded_t *ike_sa_init_responded_create(protected_ike_sa_t *ike_sa, chunk_t received_nonce, chunk_t sent_nonce,chunk_t ike_sa_init_request_data, chunk_t ike_sa_init_response_data)
683 {
684 private_ike_sa_init_responded_t *this = malloc_thing(private_ike_sa_init_responded_t);
685
686 /* interface functions */
687 this->public.state_interface.process_message = (status_t (*) (state_t *,message_t *)) process_message;
688 this->public.state_interface.get_state = (ike_sa_state_t (*) (state_t *)) get_state;
689 this->public.state_interface.destroy = (void (*) (state_t *)) destroy;
690
691 /* private functions */
692 this->build_idr_payload = build_idr_payload;
693 this->build_sa_payload = build_sa_payload;
694 this->build_auth_payload = build_auth_payload;
695 this->build_ts_payload = build_ts_payload;
696 this->process_notify_payload = process_notify_payload;
697 this->destroy_after_state_change = destroy_after_state_change;
698
699 /* private data */
700 this->ike_sa = ike_sa;
701 this->received_nonce = received_nonce;
702 this->sent_nonce = sent_nonce;
703 this->ike_sa_init_response_data = ike_sa_init_response_data;
704 this->ike_sa_init_request_data = ike_sa_init_request_data;
705 this->my_ts = NULL;
706 this->other_ts = NULL;
707 this->child_sa = NULL;
708 this->logger = logger_manager->get_logger(logger_manager, IKE_SA);
709
710 return &(this->public);
711 }