ipsec-146.3.tar.gz

[apple/ipsec.git] / ipsec-tools / racoon / isakmp_agg.c

diff --git a/ipsec-tools/racoon/isakmp_agg.c b/ipsec-tools/racoon/isakmp_agg.c
index eea772629fa7a9981be5421cff4438aa13ed022e..2b29675dc7861777fda6f53a0bf1fb505ec8b9e6 100644 (file)
--- a/ipsec-tools/racoon/isakmp_agg.c
+++ b/ipsec-tools/racoon/isakmp_agg.c
@@ -1,4 +1,6 @@
-/* $Id: isakmp_agg.c,v 1.20.2.5 2005/11/21 09:46:23 vanhu Exp $ */
+/*     $NetBSD: isakmp_agg.c,v 1.9 2006/09/30 21:49:37 manu Exp $      */
+
+/* Id: isakmp_agg.c,v 1.28 2006/04/06 16:46:08 manubsd Exp */

 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.


@@ -59,6 +61,10 @@
 #include "schedule.h"
 #include "debug.h"
 
 #include "schedule.h"
 #include "debug.h"
 

+#ifdef ENABLE_HYBRID
+#include <resolv.h>
+#endif
+

 #include "localconf.h"
 #include "remoteconf.h"
 #include "isakmp_var.h"
 #include "localconf.h"
 #include "remoteconf.h"
 #include "isakmp_var.h"


@@ -91,6 +97,11 @@
 
 #include "vpn_control.h"
 #include "vpn_control_var.h"
 
 #include "vpn_control.h"
 #include "vpn_control_var.h"

+#include "ipsecSessionTracer.h"
+#include "ipsecMessageTracer.h"
+#ifndef HAVE_OPENSSL
+#include <Security/SecDH.h>
+#endif

 
 /*
  * begin Aggressive Mode as initiator.
 
 /*
  * begin Aggressive Mode as initiator.


@@ -111,7 +122,7 @@ agg_i1send(iph1, msg)
 {
        struct payload_list *plist = NULL;
        int need_cr = 0;
 {
        struct payload_list *plist = NULL;
        int need_cr = 0;

-       vchar_t *cr = NULL, *gsstoken = NULL;
+       vchar_t *cr = NULL; 

        int error = -1;
 #ifdef ENABLE_NATT
        vchar_t *vid_natt[MAX_NATT_VID_COUNT] = { NULL };
        int error = -1;
 #ifdef ENABLE_NATT
        vchar_t *vid_natt[MAX_NATT_VID_COUNT] = { NULL };


@@ -125,6 +136,7 @@ agg_i1send(iph1, msg)
        vchar_t *vid_frag = NULL;
 #endif
 #ifdef HAVE_GSSAPI
        vchar_t *vid_frag = NULL;
 #endif
 #ifdef HAVE_GSSAPI

+       vchar_t *gsstoken = NULL;

        int len;
 #endif
 #ifdef ENABLE_DPD
        int len;
 #endif
 #ifdef ENABLE_DPD


@@ -149,13 +161,19 @@ agg_i1send(iph1, msg)
        isakmp_newcookie((caddr_t)&iph1->index, iph1->remote, iph1->local);
 
        /* make ID payload into isakmp status */
        isakmp_newcookie((caddr_t)&iph1->index, iph1->remote, iph1->local);
 
        /* make ID payload into isakmp status */

-       if (ipsecdoi_setid1(iph1) < 0)
+       if (ipsecdoi_setid1(iph1) < 0) {
+               plog(LLV_ERROR, LOCATION, NULL,
+                        "failed to set ID");

                goto end;
                goto end;

+       }

 
        /* create SA payload for my proposal */
        iph1->sa = ipsecdoi_setph1proposal(iph1->rmconf->proposal);
 
        /* create SA payload for my proposal */
        iph1->sa = ipsecdoi_setph1proposal(iph1->rmconf->proposal);

-       if (iph1->sa == NULL)
+       if (iph1->sa == NULL) {
+               plog(LLV_ERROR, LOCATION, NULL,
+                        "failed to set proposal");

                goto end;
                goto end;

+       }

 
        /* consistency check of proposals */
        if (iph1->rmconf->dhgrp == NULL) {
 
        /* consistency check of proposals */
        if (iph1->rmconf->dhgrp == NULL) {


@@ -165,20 +183,36 @@ agg_i1send(iph1, msg)
        }
 
        /* generate DH public value */
        }
 
        /* generate DH public value */

+#ifdef HAVE_OPENSSL
+       if (oakley_dh_generate(iph1->rmconf->dhgrp,
+                                                  &iph1->dhpub, &iph1->dhpriv) < 0) {  
+#else

        if (oakley_dh_generate(iph1->rmconf->dhgrp,
        if (oakley_dh_generate(iph1->rmconf->dhgrp,

-                               &iph1->dhpub, &iph1->dhpriv) < 0)
+                                                  &iph1->dhpub, &iph1->publicKeySize, &iph1->dhC) < 0) {
+#endif         
+               plog(LLV_ERROR, LOCATION, NULL,
+                        "failed to generate DH");

                goto end;
                goto end;

+       }

 
        /* generate NONCE value */
        iph1->nonce = eay_set_random(iph1->rmconf->nonce_size);
 
        /* generate NONCE value */
        iph1->nonce = eay_set_random(iph1->rmconf->nonce_size);

-       if (iph1->nonce == NULL)
+       if (iph1->nonce == NULL) {
+               plog(LLV_ERROR, LOCATION, NULL,
+                        "failed to generate NONCE");

                goto end;
                goto end;

+       }

 
 #ifdef ENABLE_HYBRID
        /* Do we need Xauth VID? */
 
 #ifdef ENABLE_HYBRID
        /* Do we need Xauth VID? */

-       switch (iph1->rmconf->proposal->authmethod) {
-       case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R:
-       case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R:
+       switch (RMAUTHMETHOD(iph1)) {
+       case FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I:
+       case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
+       case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
+       case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I:
+       case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I:
+       case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_I:
+       case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_I:

                if ((vid_xauth = set_vendorid(VENDORID_XAUTH)) == NULL)
                        plog(LLV_ERROR, LOCATION, NULL, 
                             "Xauth vendor ID generation failed\n");
                if ((vid_xauth = set_vendorid(VENDORID_XAUTH)) == NULL)
                        plog(LLV_ERROR, LOCATION, NULL, 
                             "Xauth vendor ID generation failed\n");


@@ -211,7 +245,7 @@ agg_i1send(iph1, msg)
                cr = oakley_getcr(iph1);
                if (cr == NULL) {
                        plog(LLV_ERROR, LOCATION, NULL,
                cr = oakley_getcr(iph1);
                if (cr == NULL) {
                        plog(LLV_ERROR, LOCATION, NULL,

-                               "failed to get cr buffer.\n");
+                               "failed to get CR");

                        goto end;
                }
        }
                        goto end;
                }
        }


@@ -219,10 +253,8 @@ agg_i1send(iph1, msg)
        plog(LLV_DEBUG, LOCATION, NULL, "authmethod is %s\n",
                s_oakley_attr_method(iph1->rmconf->proposal->authmethod));
 #ifdef HAVE_GSSAPI
        plog(LLV_DEBUG, LOCATION, NULL, "authmethod is %s\n",
                s_oakley_attr_method(iph1->rmconf->proposal->authmethod));
 #ifdef HAVE_GSSAPI

-       if (iph1->rmconf->proposal->authmethod ==
-           OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB) {
+       if (RMAUTHMETHOD(iph1) == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB)

                gssapi_get_itoken(iph1, &len);
                gssapi_get_itoken(iph1, &len);

-       }

 #endif
 
        /* set SA payload to propose */
 #endif
 
        /* set SA payload to propose */


@@ -238,11 +270,10 @@ agg_i1send(iph1, msg)
        plist = isakmp_plist_append(plist, iph1->id, ISAKMP_NPTYPE_ID);
 
 #ifdef HAVE_GSSAPI
        plist = isakmp_plist_append(plist, iph1->id, ISAKMP_NPTYPE_ID);
 
 #ifdef HAVE_GSSAPI

-       if (iph1->rmconf->proposal->authmethod ==
-           OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB) {
+       if (RMAUTHMETHOD(iph1) == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB) {

                gssapi_get_token_to_send(iph1, &gsstoken);
                plist = isakmp_plist_append(plist, gsstoken, ISAKMP_NPTYPE_GSS);
                gssapi_get_token_to_send(iph1, &gsstoken);
                plist = isakmp_plist_append(plist, gsstoken, ISAKMP_NPTYPE_GSS);

-       } else
+       }

 #endif
        /* create isakmp CR payload */
        if (need_cr)
 #endif
        /* create isakmp CR payload */
        if (need_cr)


@@ -284,18 +315,34 @@ agg_i1send(iph1, msg)
 
        /* send the packet, add to the schedule to resend */
        iph1->retry_counter = iph1->rmconf->retry_counter;
 
        /* send the packet, add to the schedule to resend */
        iph1->retry_counter = iph1->rmconf->retry_counter;

-       if (isakmp_ph1resend(iph1) == -1)
+       if (isakmp_ph1resend(iph1) == -1) {
+               plog(LLV_ERROR, LOCATION, NULL,
+                        "failed to send packet");

                goto end;
                goto end;

+       }

 
        iph1->status = PHASE1ST_MSG1SENT;
 
        error = 0;
 
 
        iph1->status = PHASE1ST_MSG1SENT;
 
        error = 0;
 

+       IPSECSESSIONTRACEREVENT(iph1->parent_session,
+                                                       IPSECSESSIONEVENTCODE_IKE_PACKET_TX_SUCC,
+                                                       CONSTSTR("Initiator, Aggressive-Mode message 1"),
+                                                       CONSTSTR(NULL));
+       

 end:
 end:

+       if (error) {
+               IPSECSESSIONTRACEREVENT(iph1->parent_session,
+                                                               IPSECSESSIONEVENTCODE_IKE_PACKET_TX_FAIL,
+                                                               CONSTSTR("Initiator, Aggressive-Mode Message 1"),
+                                                               CONSTSTR("Failed to transmit Aggressive-Mode Message 1"));
+       }

        if (cr)
                vfree(cr);
        if (cr)
                vfree(cr);

+#ifdef HAVE_GSSAPI

        if (gsstoken)
                vfree(gsstoken);
        if (gsstoken)
                vfree(gsstoken);

+#endif

 #ifdef ENABLE_FRAG
        if (vid_frag)
                vfree(vid_frag);
 #ifdef ENABLE_FRAG
        if (vid_frag)
                vfree(vid_frag);


@@ -304,16 +351,16 @@ end:
        for (i = 0; i < MAX_NATT_VID_COUNT && vid_natt[i] != NULL; i++)
                vfree(vid_natt[i]);
 #endif
        for (i = 0; i < MAX_NATT_VID_COUNT && vid_natt[i] != NULL; i++)
                vfree(vid_natt[i]);
 #endif

-#ifdef ENABLE_DPD
-       if (vid_dpd != NULL)
-               vfree(vid_dpd);
-#endif

 #ifdef ENABLE_HYBRID
        if (vid_xauth != NULL)
                vfree(vid_xauth);
        if (vid_unity != NULL)
                vfree(vid_unity);
 #endif
 #ifdef ENABLE_HYBRID
        if (vid_xauth != NULL)
                vfree(vid_xauth);
        if (vid_unity != NULL)
                vfree(vid_unity);
 #endif

+#ifdef ENABLE_DPD
+       if (vid_dpd != NULL)
+               vfree(vid_dpd);
+#endif

 
        return error;
 }
 
        return error;
 }


@@ -344,6 +391,7 @@ agg_i2recv(iph1, msg)
 #ifdef HAVE_GSSAPI
        vchar_t *gsstoken = NULL;
 #endif
 #ifdef HAVE_GSSAPI
        vchar_t *gsstoken = NULL;
 #endif

+       int received_cert = 0;

 
 #ifdef ENABLE_NATT
        int natd_seq = 0;
 
 #ifdef ENABLE_NATT
        int natd_seq = 0;


@@ -365,8 +413,11 @@ agg_i2recv(iph1, msg)
 
        /* validate the type of next payload */
        pbuf = isakmp_parse(msg);
 
        /* validate the type of next payload */
        pbuf = isakmp_parse(msg);

-       if (pbuf == NULL)
+       if (pbuf == NULL) {
+               plog(LLV_ERROR, LOCATION, NULL,
+                        "failed to parse msg");

                goto end;
                goto end;

+       }

        pa = (struct isakmp_parse_t *)pbuf->v;
 
        iph1->pl_hash = NULL;
        pa = (struct isakmp_parse_t *)pbuf->v;
 
        iph1->pl_hash = NULL;


@@ -380,8 +431,11 @@ agg_i2recv(iph1, msg)
                goto end;
        }
 
                goto end;
        }
 

-       if (isakmp_p2ph(&satmp, pa->ptr) < 0)
+       if (isakmp_p2ph(&satmp, pa->ptr) < 0) {
+               plog(LLV_ERROR, LOCATION, NULL,
+                        "failed to process SA payload");

                goto end;
                goto end;

+       }

        pa++;
 
        for (/*nothing*/;
        pa++;
 
        for (/*nothing*/;


@@ -390,31 +444,50 @@ agg_i2recv(iph1, msg)
 
                switch (pa->type) {
                case ISAKMP_NPTYPE_KE:
 
                switch (pa->type) {
                case ISAKMP_NPTYPE_KE:

-                       if (isakmp_p2ph(&iph1->dhpub_p, pa->ptr) < 0)
+                       if (isakmp_p2ph(&iph1->dhpub_p, pa->ptr) < 0) {
+                               plog(LLV_ERROR, LOCATION, NULL,
+                                        "failed to process KE payload");

                                goto end;
                                goto end;

+                       }

                        break;
                case ISAKMP_NPTYPE_NONCE:
                        break;
                case ISAKMP_NPTYPE_NONCE:

-                       if (isakmp_p2ph(&iph1->nonce_p, pa->ptr) < 0)
+                       if (isakmp_p2ph(&iph1->nonce_p, pa->ptr) < 0) {
+                               plog(LLV_ERROR, LOCATION, NULL,
+                                        "failed to process NONCE payload");

                                goto end;
                                goto end;

+                       }

                        break;
                case ISAKMP_NPTYPE_ID:
                        break;
                case ISAKMP_NPTYPE_ID:

-                       if (isakmp_p2ph(&iph1->id_p, pa->ptr) < 0)
+                       if (isakmp_p2ph(&iph1->id_p, pa->ptr) < 0) {
+                               plog(LLV_ERROR, LOCATION, NULL,
+                                        "failed to process ID payload");

                                goto end;
                                goto end;

+                       }

                        break;
                case ISAKMP_NPTYPE_HASH:
                        iph1->pl_hash = (struct isakmp_pl_hash *)pa->ptr;
                        break;
                case ISAKMP_NPTYPE_CR:
                        break;
                case ISAKMP_NPTYPE_HASH:
                        iph1->pl_hash = (struct isakmp_pl_hash *)pa->ptr;
                        break;
                case ISAKMP_NPTYPE_CR:

-                       if (oakley_savecr(iph1, pa->ptr) < 0)
+                       if (oakley_savecr(iph1, pa->ptr) < 0) {
+                               plog(LLV_ERROR, LOCATION, NULL,
+                                        "failed to process CR payload");

                                goto end;
                                goto end;

+                       }

                        break;
                case ISAKMP_NPTYPE_CERT:
                        break;
                case ISAKMP_NPTYPE_CERT:

-                       if (oakley_savecert(iph1, pa->ptr) < 0)
+                       if (oakley_savecert(iph1, pa->ptr) < 0) {
+                               plog(LLV_ERROR, LOCATION, NULL,
+                                        "failed to process CERT payload");

                                goto end;
                                goto end;

+                       }
+                       received_cert = 1;

                        break;
                case ISAKMP_NPTYPE_SIG:
                        break;
                case ISAKMP_NPTYPE_SIG:

-                       if (isakmp_p2ph(&iph1->sig_p, pa->ptr) < 0)
+                       if (isakmp_p2ph(&iph1->sig_p, pa->ptr) < 0) {
+                               plog(LLV_ERROR, LOCATION, NULL,
+                                        "failed to process SIG payload");

                                goto end;
                                goto end;

+                       }

                        break;
                case ISAKMP_NPTYPE_VID:
                        vid_numeric = check_vendorid(pa->ptr);
                        break;
                case ISAKMP_NPTYPE_VID:
                        vid_numeric = check_vendorid(pa->ptr);


@@ -444,6 +517,14 @@ agg_i2recv(iph1, msg)
                                plog(LLV_DEBUG, LOCATION, NULL,
                                         "remote supports DPD\n");
                        }
                                plog(LLV_DEBUG, LOCATION, NULL,
                                         "remote supports DPD\n");
                        }

+#endif
+#ifdef ENABLE_FRAG
+                       if ((vid_numeric == VENDORID_FRAG) &&
+                               (vendorid_frag_cap(pa->ptr) & VENDORID_FRAG_AGG)) {
+                               plog(LLV_DEBUG, LOCATION, NULL,
+                                        "remote supports FRAGMENTATION\n");
+                               iph1->frag = 1;
+                       }

 #endif
                        break;
                case ISAKMP_NPTYPE_N:
 #endif
                        break;
                case ISAKMP_NPTYPE_N:


@@ -451,8 +532,11 @@ agg_i2recv(iph1, msg)
                        break;
 #ifdef HAVE_GSSAPI
                case ISAKMP_NPTYPE_GSS:
                        break;
 #ifdef HAVE_GSSAPI
                case ISAKMP_NPTYPE_GSS:

-                       if (isakmp_p2ph(&gsstoken, pa->ptr) < 0)
+                       if (isakmp_p2ph(&gsstoken, pa->ptr) < 0) {
+                               plog(LLV_ERROR, LOCATION, NULL,
+                                        "failed to process GSS payload");

                                goto end;
                                goto end;

+                       }

                        gssapi_save_received_token(iph1, gsstoken);
                        break;
 #endif
                        gssapi_save_received_token(iph1, gsstoken);
                        break;
 #endif


@@ -460,20 +544,24 @@ agg_i2recv(iph1, msg)
 #ifdef ENABLE_NATT
                case ISAKMP_NPTYPE_NATD_DRAFT:
                case ISAKMP_NPTYPE_NATD_RFC:
 #ifdef ENABLE_NATT
                case ISAKMP_NPTYPE_NATD_DRAFT:
                case ISAKMP_NPTYPE_NATD_RFC:

-#ifdef __APPLE__

                case ISAKMP_NPTYPE_NATD_BADDRAFT:
                case ISAKMP_NPTYPE_NATD_BADDRAFT:

-#endif

                        if (NATT_AVAILABLE(iph1) && iph1->natt_options != NULL &&
                            pa->type == iph1->natt_options->payload_nat_d) {
                                struct natd_payload *natd;
                                natd = (struct natd_payload *)racoon_malloc(sizeof(*natd));
                        if (NATT_AVAILABLE(iph1) && iph1->natt_options != NULL &&
                            pa->type == iph1->natt_options->payload_nat_d) {
                                struct natd_payload *natd;
                                natd = (struct natd_payload *)racoon_malloc(sizeof(*natd));

-                               if (!natd)
+                               if (!natd) {
+                                       plog(LLV_ERROR, LOCATION, NULL,
+                                                "failed to pre-process NATD payload");

                                        goto end;
                                        goto end;

+                               }

 
                                natd->payload = NULL;
 
 
                                natd->payload = NULL;
 

-                               if (isakmp_p2ph (&natd->payload, pa->ptr) < 0)
+                               if (isakmp_p2ph (&natd->payload, pa->ptr) < 0) {
+                                       plog(LLV_ERROR, LOCATION, NULL,
+                                                "failed to process NATD payload");

                                        goto end;
                                        goto end;

+                               }

 
                                natd->seq = natd_seq++;
 
 
                                natd->seq = natd_seq++;
 


@@ -495,6 +583,10 @@ agg_i2recv(iph1, msg)
                }
        }
 
                }
        }
 

+       if (received_cert) {
+               oakley_verify_certid(iph1);
+       }
+

        /* payload existency check */
        if (iph1->dhpub_p == NULL || iph1->nonce_p == NULL) {
                plog(LLV_ERROR, LOCATION, iph1->remote,
        /* payload existency check */
        if (iph1->dhpub_p == NULL || iph1->nonce_p == NULL) {
                plog(LLV_ERROR, LOCATION, iph1->remote,


@@ -559,27 +651,51 @@ agg_i2recv(iph1, msg)
 
                if (iph1->natt_flags & NAT_DETECTED)
                        natt_float_ports (iph1);
 
                if (iph1->natt_flags & NAT_DETECTED)
                        natt_float_ports (iph1);

+               ike_session_update_natt_version(iph1);

        }
 #endif
 
        /* compute sharing secret of DH */
        }
 #endif
 
        /* compute sharing secret of DH */

+#ifdef HAVE_OPENSSL

        if (oakley_dh_compute(iph1->rmconf->dhgrp, iph1->dhpub,
        if (oakley_dh_compute(iph1->rmconf->dhgrp, iph1->dhpub,

-                               iph1->dhpriv, iph1->dhpub_p, &iph1->dhgxy) < 0)
+                                                 iph1->dhpriv, iph1->dhpub_p, &iph1->dhgxy) < 0) {
+#else
+               if (oakley_dh_compute(iph1->rmconf->dhgrp, iph1->dhpub_p, iph1->publicKeySize, &iph1->dhgxy, iph1->dhC) < 0) {
+#endif
+               plog(LLV_ERROR, LOCATION, NULL,
+                        "failed to compute DH");

                goto end;
                goto end;

+       }

 
        /* generate SKEYIDs & IV & final cipher key */
 
        /* generate SKEYIDs & IV & final cipher key */

-       if (oakley_skeyid(iph1) < 0)
+       if (oakley_skeyid(iph1) < 0) {
+               plog(LLV_ERROR, LOCATION, NULL,
+                        "failed to generate SKEYID");

                goto end;
                goto end;

-       if (oakley_skeyid_dae(iph1) < 0)
+       }
+       if (oakley_skeyid_dae(iph1) < 0) {
+               plog(LLV_ERROR, LOCATION, NULL,
+                        "failed to generate SKEYID-DAE");

                goto end;
                goto end;

-       if (oakley_compute_enckey(iph1) < 0)
+       }
+       if (oakley_compute_enckey(iph1) < 0) {
+               plog(LLV_ERROR, LOCATION, NULL,
+                        "failed to generate ENCKEY");

                goto end;
                goto end;

-       if (oakley_newiv(iph1) < 0)
+       }
+       if (oakley_newiv(iph1) < 0) {
+               plog(LLV_ERROR, LOCATION, NULL,
+                        "failed to generate IV");

                goto end;
                goto end;

+       }

 
        /* validate authentication value */
        ptype = oakley_validate_auth(iph1);
        if (ptype != 0) {
 
        /* validate authentication value */
        ptype = oakley_validate_auth(iph1);
        if (ptype != 0) {

+               IPSECSESSIONTRACEREVENT(iph1->parent_session,
+                                                               IPSECSESSIONEVENTCODE_IKEV1_PH1_AUTH_FAIL,
+                                                               CONSTSTR("Initiator, Aggressive-Mode Message 2"),
+                                                               CONSTSTR("Failed to authenticate, Aggressive-Mode Message 2"));

                if (ptype == -1) {
                        /* message printed inner oakley_validate_auth() */
                        goto end;
                if (ptype == -1) {
                        /* message printed inner oakley_validate_auth() */
                        goto end;


@@ -589,7 +705,11 @@ agg_i2recv(iph1, msg)
                isakmp_info_send_n1(iph1, ptype, NULL);
                goto end;
        }
                isakmp_info_send_n1(iph1, ptype, NULL);
                goto end;
        }

-
+       IPSECSESSIONTRACEREVENT(iph1->parent_session,
+                                                       IPSECSESSIONEVENTCODE_IKEV1_PH1_AUTH_SUCC,
+                                                       CONSTSTR("Initiator, Aggressive-Mode Message 2"),
+                                                       CONSTSTR(NULL));
+       

        if (oakley_checkcr(iph1) < 0) {
                /* Ignore this error in order to be interoperability. */
                ;
        if (oakley_checkcr(iph1) < 0) {
                /* Ignore this error in order to be interoperability. */
                ;


@@ -604,7 +724,22 @@ agg_i2recv(iph1, msg)
 
        error = 0;
 
 
        error = 0;
 

+       IPSECSESSIONTRACEREVENT(iph1->parent_session,
+                                                       IPSECSESSIONEVENTCODE_IKE_PACKET_RX_SUCC,
+                                                       CONSTSTR("Initiator, Aggressive-Mode message 2"),
+                                                       CONSTSTR(NULL));
+       

 end:
 end:

+       if (error) {
+               IPSECSESSIONTRACEREVENT(iph1->parent_session,
+                                                               IPSECSESSIONEVENTCODE_IKE_PACKET_RX_FAIL,
+                                                               CONSTSTR("Initiator, Aggressive-Mode Message 2"),
+                                                               CONSTSTR("Failure processing Aggressive-Mode Message 2"));
+       }
+#ifdef HAVE_GSSAPI
+       if (gsstoken)
+               vfree(gsstoken);
+#endif

        if (pbuf)
                vfree(pbuf);
        if (satmp)
        if (pbuf)
                vfree(pbuf);
        if (satmp)


@@ -642,6 +777,11 @@ agg_i2send(iph1, msg)
        int need_cert = 0;
        int error = -1;
        vchar_t *gsshash = NULL;
        int need_cert = 0;
        int error = -1;
        vchar_t *gsshash = NULL;

+#ifdef ENABLE_NATT
+       vchar_t *natd[2] = { NULL, NULL };
+#endif
+    vchar_t *notp_unity = NULL;
+    vchar_t *notp_ini = NULL;

 
        /* validity check */
        if (iph1->status != PHASE1ST_MSG2RECEIVED) {
 
        /* validity check */
        if (iph1->status != PHASE1ST_MSG2RECEIVED) {


@@ -655,40 +795,56 @@ agg_i2send(iph1, msg)
        iph1->hash = oakley_ph1hash_common(iph1, GENERATE);
        if (iph1->hash == NULL) {
 #ifdef HAVE_GSSAPI
        iph1->hash = oakley_ph1hash_common(iph1, GENERATE);
        if (iph1->hash == NULL) {
 #ifdef HAVE_GSSAPI

-               if (gssapi_more_tokens(iph1))
+               if (gssapi_more_tokens(iph1) &&
+#ifdef ENABLE_HYBRID
+                   !iph1->rmconf->xauth &&
+#endif
+                   1)

                        isakmp_info_send_n1(iph1,
                            ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE, NULL);
 #endif
                        isakmp_info_send_n1(iph1,
                            ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE, NULL);
 #endif

+               plog(LLV_ERROR, LOCATION, NULL,
+                        "failed to generate HASH");

                goto end;
        }
 
                goto end;
        }
 

-       switch (iph1->approval->authmethod) {
+       switch (AUTHMETHOD(iph1)) {

        case OAKLEY_ATTR_AUTH_METHOD_PSKEY:
 #ifdef ENABLE_HYBRID
        case OAKLEY_ATTR_AUTH_METHOD_PSKEY:
 #ifdef ENABLE_HYBRID

-       case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R:
-       case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R:
+       case FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I:
+       case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
+       case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:

 #endif  
                /* set HASH payload */
 #endif  
                /* set HASH payload */

-               plist = isakmp_plist_append(plist, iph1->hash, ISAKMP_NPTYPE_HASH);
+               plist = isakmp_plist_append(plist, 
+                   iph1->hash, ISAKMP_NPTYPE_HASH);

                break;
                break;

+

        case OAKLEY_ATTR_AUTH_METHOD_DSSSIG:
        case OAKLEY_ATTR_AUTH_METHOD_RSASIG:
 #ifdef ENABLE_HYBRID
        case OAKLEY_ATTR_AUTH_METHOD_DSSSIG:
        case OAKLEY_ATTR_AUTH_METHOD_RSASIG:
 #ifdef ENABLE_HYBRID

-       case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
-       case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
-#endif  
+       case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I:
+       case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I:
+#endif

                /* XXX if there is CR or not ? */
 
                /* XXX if there is CR or not ? */
 

-               if (oakley_getmycert(iph1) < 0)
+               if (oakley_getmycert(iph1) < 0) {
+                       plog(LLV_ERROR, LOCATION, NULL,
+                                "failed to get mycert");

                        goto end;
                        goto end;

+               }

 
 

-               if (oakley_getsign(iph1) < 0)
+               if (oakley_getsign(iph1) < 0) {
+                       plog(LLV_ERROR, LOCATION, NULL,
+                                "failed to get sign");

                        goto end;
                        goto end;

+               }

 
                if (iph1->cert != NULL && iph1->rmconf->send_cert)
                        need_cert = 1;
 
                /* add CERT payload if there */
 
                if (iph1->cert != NULL && iph1->rmconf->send_cert)
                        need_cert = 1;
 
                /* add CERT payload if there */

+               // we don't support sending of certchains

                if (need_cert)
                        plist = isakmp_plist_append(plist, iph1->cert->pl, ISAKMP_NPTYPE_CERT);
 
                if (need_cert)
                        plist = isakmp_plist_append(plist, iph1->cert->pl, ISAKMP_NPTYPE_CERT);
 


@@ -698,13 +854,17 @@ agg_i2send(iph1, msg)
 
        case OAKLEY_ATTR_AUTH_METHOD_RSAENC:
        case OAKLEY_ATTR_AUTH_METHOD_RSAREV:
 
        case OAKLEY_ATTR_AUTH_METHOD_RSAENC:
        case OAKLEY_ATTR_AUTH_METHOD_RSAREV:

+#ifdef ENABLE_HYBRID
+       case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_I:
+       case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_I:
+#endif

                break;
 #ifdef HAVE_GSSAPI
        case OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB:
                gsshash = gssapi_wraphash(iph1);
                if (gsshash == NULL) {
                        plog(LLV_ERROR, LOCATION, NULL,
                break;
 #ifdef HAVE_GSSAPI
        case OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB:
                gsshash = gssapi_wraphash(iph1);
                if (gsshash == NULL) {
                        plog(LLV_ERROR, LOCATION, NULL,

-                               "failed to wrap hash\n");
+                               "failed to get GSS hash\n");

                        isakmp_info_send_n1(iph1,
                                ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE, NULL);
                        goto end;
                        isakmp_info_send_n1(iph1,
                                ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE, NULL);
                        goto end;


@@ -713,19 +873,11 @@ agg_i2send(iph1, msg)
                plist = isakmp_plist_append(plist, gsshash, ISAKMP_NPTYPE_HASH);
                break;
 #endif
                plist = isakmp_plist_append(plist, gsshash, ISAKMP_NPTYPE_HASH);
                break;
 #endif

-       default:
-               plog(LLV_ERROR, LOCATION, NULL, "invalid authmethod %d\n",
-                       iph1->approval->authmethod);
-               goto end;
-               break;

        }
 
 #ifdef ENABLE_NATT
        /* generate NAT-D payloads */
        }
 
 #ifdef ENABLE_NATT
        /* generate NAT-D payloads */

-       if (NATT_AVAILABLE(iph1))
-       {
-               vchar_t *natd[2] = { NULL, NULL };
-
+       if (NATT_AVAILABLE(iph1)) {

                plog (LLV_INFO, LOCATION, NULL, "Adding remote and local NAT-D payloads.\n");
                if ((natd[0] = natt_hash_addr (iph1, iph1->remote)) == NULL) {
                        plog(LLV_ERROR, LOCATION, NULL,
                plog (LLV_INFO, LOCATION, NULL, "Adding remote and local NAT-D payloads.\n");
                if ((natd[0] = natt_hash_addr (iph1, iph1->remote)) == NULL) {
                        plog(LLV_ERROR, LOCATION, NULL,


@@ -738,14 +890,11 @@ agg_i2send(iph1, msg)
                                "NAT-D hashing failed for %s\n", saddr2str(iph1->local));
                        goto end;
                }
                                "NAT-D hashing failed for %s\n", saddr2str(iph1->local));
                        goto end;
                }

-
-#ifdef __APPLE__

                /* old Apple version sends natd payloads in the wrong order */
                if (iph1->natt_options->version == VENDORID_NATT_APPLE) {
                        plist = isakmp_plist_append(plist, natd[1], iph1->natt_options->payload_nat_d);
                        plist = isakmp_plist_append(plist, natd[0], iph1->natt_options->payload_nat_d);
                } else
                /* old Apple version sends natd payloads in the wrong order */
                if (iph1->natt_options->version == VENDORID_NATT_APPLE) {
                        plist = isakmp_plist_append(plist, natd[1], iph1->natt_options->payload_nat_d);
                        plist = isakmp_plist_append(plist, natd[0], iph1->natt_options->payload_nat_d);
                } else

-#endif

                {
                        plist = isakmp_plist_append(plist, natd[0], iph1->natt_options->payload_nat_d);
                        plist = isakmp_plist_append(plist, natd[1], iph1->natt_options->payload_nat_d);
                {
                        plist = isakmp_plist_append(plist, natd[0], iph1->natt_options->payload_nat_d);
                        plist = isakmp_plist_append(plist, natd[1], iph1->natt_options->payload_nat_d);


@@ -753,18 +902,24 @@ agg_i2send(iph1, msg)
        }
 #endif
 
        }
 #endif
 

-       iph1->sendbuf = isakmp_plist_set_all (&plist, iph1);

 
 

+       iph1->sendbuf = isakmp_plist_set_all (&plist, iph1);
+       

 #ifdef HAVE_PRINT_ISAKMP_C
        isakmp_printpacket(iph1->sendbuf, iph1->local, iph1->remote, 0);
 #endif
 
 #ifdef HAVE_PRINT_ISAKMP_C
        isakmp_printpacket(iph1->sendbuf, iph1->local, iph1->remote, 0);
 #endif
 

+

        /* send to responder */
        /* send to responder */

-       if (isakmp_send(iph1, iph1->sendbuf) < 0)
+       if (isakmp_send(iph1, iph1->sendbuf) < 0) {
+               plog(LLV_ERROR, LOCATION, NULL,
+                        "failed to send packet");

                goto end;
                goto end;

+       }

 
        /* the sending message is added to the received-list. */
 
        /* the sending message is added to the received-list. */

-       if (add_recvdpkt(iph1->remote, iph1->local, iph1->sendbuf, msg) == -1) {
+       if (add_recvdpkt(iph1->remote, iph1->local, iph1->sendbuf, msg,
+                     PH1_NON_ESP_EXTRA_LEN(iph1), PH1_FRAG_FLAGS(iph1)) == -1) {

                plog(LLV_ERROR , LOCATION, NULL,
                        "failed to add a response packet to the tree.\n");
                goto end;
                plog(LLV_ERROR , LOCATION, NULL,
                        "failed to add a response packet to the tree.\n");
                goto end;


@@ -775,9 +930,35 @@ agg_i2send(iph1, msg)
 
        iph1->status = PHASE1ST_ESTABLISHED;
 
 
        iph1->status = PHASE1ST_ESTABLISHED;
 

+       IPSECSESSIONTRACEREVENT(iph1->parent_session,
+                                                       IPSECSESSIONEVENTCODE_IKEV1_PH1_INIT_SUCC,
+                                                       CONSTSTR("Initiator, Aggressive-Mode"),
+                                                       CONSTSTR(NULL));
+

        error = 0;
 
        error = 0;
 

+       IPSECSESSIONTRACEREVENT(iph1->parent_session,
+                                                       IPSECSESSIONEVENTCODE_IKE_PACKET_TX_SUCC,
+                                                       CONSTSTR("Initiator, Aggressive-Mode message 3"),
+                                                       CONSTSTR(NULL));
+

 end:
 end:

+       if (error) {
+               IPSECSESSIONTRACEREVENT(iph1->parent_session,
+                                                               IPSECSESSIONEVENTCODE_IKE_PACKET_TX_FAIL,
+                                                               CONSTSTR("Initiator, Aggressive-Mode Message 3"),
+                                                               CONSTSTR("Failed to transmit Aggressive-Mode Message 3"));
+       }
+#ifdef ENABLE_NATT
+       if (natd[0])
+               vfree(natd[0]);
+       if (natd[1])
+               vfree(natd[1]);
+#endif
+       if (notp_unity)
+               vfree(notp_unity);
+       if (notp_ini)
+               vfree(notp_ini);

        if (gsshash)
                vfree(gsshash);
        return error;
        if (gsshash)
                vfree(gsshash);
        return error;


@@ -814,8 +995,11 @@ agg_r1recv(iph1, msg)
 
        /* validate the type of next payload */
        pbuf = isakmp_parse(msg);
 
        /* validate the type of next payload */
        pbuf = isakmp_parse(msg);

-       if (pbuf == NULL)
+       if (pbuf == NULL) {
+               plog(LLV_ERROR, LOCATION, NULL,
+                        "failed to parse msg");

                goto end;
                goto end;

+       }

        pa = (struct isakmp_parse_t *)pbuf->v;
 
        /* SA payload is fixed postion */
        pa = (struct isakmp_parse_t *)pbuf->v;
 
        /* SA payload is fixed postion */


@@ -826,8 +1010,11 @@ agg_r1recv(iph1, msg)
                        pa->type, ISAKMP_NPTYPE_SA);
                goto end;
        }
                        pa->type, ISAKMP_NPTYPE_SA);
                goto end;
        }

-       if (isakmp_p2ph(&iph1->sa, pa->ptr) < 0)
+       if (isakmp_p2ph(&iph1->sa, pa->ptr) < 0) {
+               plog(LLV_ERROR, LOCATION, NULL,
+                        "failed to process SA payload");

                goto end;
                goto end;

+       }

        pa++;
 
        for (/*nothing*/;
        pa++;
 
        for (/*nothing*/;


@@ -840,16 +1027,25 @@ agg_r1recv(iph1, msg)
 
                switch (pa->type) {
                case ISAKMP_NPTYPE_KE:
 
                switch (pa->type) {
                case ISAKMP_NPTYPE_KE:

-                       if (isakmp_p2ph(&iph1->dhpub_p, pa->ptr) < 0)
+                       if (isakmp_p2ph(&iph1->dhpub_p, pa->ptr) < 0) {
+                               plog(LLV_ERROR, LOCATION, NULL,
+                                        "failed to process KE payload");

                                goto end;
                                goto end;

+                       }

                        break;
                case ISAKMP_NPTYPE_NONCE:
                        break;
                case ISAKMP_NPTYPE_NONCE:

-                       if (isakmp_p2ph(&iph1->nonce_p, pa->ptr) < 0)
+                       if (isakmp_p2ph(&iph1->nonce_p, pa->ptr) < 0) {
+                               plog(LLV_ERROR, LOCATION, NULL,
+                                        "failed to process NONCE payload");

                                goto end;
                                goto end;

+                       }

                        break;
                case ISAKMP_NPTYPE_ID:
                        break;
                case ISAKMP_NPTYPE_ID:

-                       if (isakmp_p2ph(&iph1->id_p, pa->ptr) < 0)
+                       if (isakmp_p2ph(&iph1->id_p, pa->ptr) < 0) {
+                               plog(LLV_ERROR, LOCATION, NULL,
+                                        "failed to process ID payload");

                                goto end;
                                goto end;

+                       }

                        break;
                case ISAKMP_NPTYPE_VID:
                        vid_numeric = check_vendorid(pa->ptr);
                        break;
                case ISAKMP_NPTYPE_VID:
                        vid_numeric = check_vendorid(pa->ptr);


@@ -885,20 +1081,29 @@ agg_r1recv(iph1, msg)
 #endif
 #ifdef ENABLE_FRAG
                        if ((vid_numeric == VENDORID_FRAG) &&
 #endif
 #ifdef ENABLE_FRAG
                        if ((vid_numeric == VENDORID_FRAG) &&

-                           (vendorid_frag_cap(pa->ptr) & VENDORID_FRAG_AGG))
+                               (vendorid_frag_cap(pa->ptr) & VENDORID_FRAG_AGG)) {
+                               plog(LLV_DEBUG, LOCATION, NULL,
+                                        "remote supports FRAGMENTATION\n");

                                iph1->frag = 1;
                                iph1->frag = 1;

+                       }

 #endif
                        break;
 
                case ISAKMP_NPTYPE_CR:
 #endif
                        break;
 
                case ISAKMP_NPTYPE_CR:

-                       if (oakley_savecr(iph1, pa->ptr) < 0)
+                       if (oakley_savecr(iph1, pa->ptr) < 0) {
+                               plog(LLV_ERROR, LOCATION, NULL,
+                                        "failed to process CR payload");

                                goto end;
                                goto end;

+                       }

                        break;
 
 #ifdef HAVE_GSSAPI
                case ISAKMP_NPTYPE_GSS:
                        break;
 
 #ifdef HAVE_GSSAPI
                case ISAKMP_NPTYPE_GSS:

-                       if (isakmp_p2ph(&gsstoken, pa->ptr) < 0)
+                       if (isakmp_p2ph(&gsstoken, pa->ptr) < 0) {
+                               plog(LLV_ERROR, LOCATION, NULL,
+                                        "failed to process GSS payload");

                                goto end;
                                goto end;

+                       }

                        gssapi_save_received_token(iph1, gsstoken);
                        break;
 #endif
                        gssapi_save_received_token(iph1, gsstoken);
                        break;
 #endif


@@ -927,10 +1132,12 @@ agg_r1recv(iph1, msg)
        }
 
 #ifdef ENABLE_NATT
        }
 
 #ifdef ENABLE_NATT

-       if (NATT_AVAILABLE(iph1))
+       if (NATT_AVAILABLE(iph1)) {

                plog(LLV_INFO, LOCATION, iph1->remote,
                     "Selected NAT-T version: %s\n",
                     vid_string_by_id(iph1->natt_options->version));
                plog(LLV_INFO, LOCATION, iph1->remote,
                     "Selected NAT-T version: %s\n",
                     vid_string_by_id(iph1->natt_options->version));

+               ike_session_update_natt_version(iph1);
+       }

 #endif
 
        /* check SA payload and set approval SA for use */
 #endif
 
        /* check SA payload and set approval SA for use */


@@ -950,7 +1157,22 @@ agg_r1recv(iph1, msg)
 
        error = 0;
 
 
        error = 0;
 

+       IPSECSESSIONTRACEREVENT(iph1->parent_session,
+                                                       IPSECSESSIONEVENTCODE_IKE_PACKET_RX_SUCC,
+                                                       CONSTSTR("Responder, Aggressive-Mode message 1"),
+                                                       CONSTSTR(NULL));
+       

 end:
 end:

+       if (error) {
+               IPSECSESSIONTRACEREVENT(iph1->parent_session,
+                                                               IPSECSESSIONEVENTCODE_IKE_PACKET_RX_FAIL,
+                                                               CONSTSTR("Responder, Aggressive-Mode Message 1"),
+                                                               CONSTSTR("Failed to process Aggressive-Mode Message 1"));
+       }
+#ifdef HAVE_GSSAPI
+       if (gsstoken)
+               vfree(gsstoken);
+#endif

        if (pbuf)
                vfree(pbuf);
        if (error) {
        if (pbuf)
                vfree(pbuf);
        if (error) {


@@ -982,7 +1204,6 @@ agg_r1send(iph1, msg)
        int need_cr = 0;
        int need_cert = 0;
        vchar_t *cr = NULL;
        int need_cr = 0;
        int need_cert = 0;
        vchar_t *cr = NULL;

-       vchar_t *vid = NULL;

        int error = -1;
 #ifdef ENABLE_HYBRID
        vchar_t *xauth_vid = NULL;
        int error = -1;
 #ifdef ENABLE_HYBRID
        vchar_t *xauth_vid = NULL;


@@ -995,11 +1216,15 @@ agg_r1send(iph1, msg)
 #ifdef ENABLE_DPD
        vchar_t *vid_dpd = NULL;
 #endif
 #ifdef ENABLE_DPD
        vchar_t *vid_dpd = NULL;
 #endif

+#ifdef ENABLE_FRAG
+       vchar_t *vid_frag = NULL;
+#endif

 
 #ifdef HAVE_GSSAPI
        int gsslen;
        vchar_t *gsstoken = NULL, *gsshash = NULL;
        vchar_t *gss_sa = NULL;
 
 #ifdef HAVE_GSSAPI
        int gsslen;
        vchar_t *gsstoken = NULL, *gsshash = NULL;
        vchar_t *gss_sa = NULL;

+       int free_gss_sa = 0;

 #endif
 
        /* validity check */
 #endif
 
        /* validity check */


@@ -1013,37 +1238,69 @@ agg_r1send(iph1, msg)
        isakmp_newcookie((caddr_t)&iph1->index.r_ck, iph1->remote, iph1->local);
 
        /* make ID payload into isakmp status */
        isakmp_newcookie((caddr_t)&iph1->index.r_ck, iph1->remote, iph1->local);
 
        /* make ID payload into isakmp status */

-       if (ipsecdoi_setid1(iph1) < 0)
+       if (ipsecdoi_setid1(iph1) < 0) {
+               plog(LLV_ERROR, LOCATION, NULL,
+                        "failed to set ID");

                goto end;
                goto end;

+       }

 
        /* generate DH public value */
 
        /* generate DH public value */

+#ifdef HAVE_OPENSSL

        if (oakley_dh_generate(iph1->rmconf->dhgrp,
        if (oakley_dh_generate(iph1->rmconf->dhgrp,

-                               &iph1->dhpub, &iph1->dhpriv) < 0)
+                                                  &iph1->dhpub, &iph1->dhpriv) < 0) {  
+#else
+       if (oakley_dh_generate(iph1->rmconf->dhgrp,
+                                                  &iph1->dhpub, &iph1->publicKeySize, &iph1->dhC) < 0) {
+#endif
+               plog(LLV_ERROR, LOCATION, NULL,
+                        "failed to generate DH");

                goto end;
                goto end;

+       }

 
        /* generate NONCE value */
        iph1->nonce = eay_set_random(iph1->rmconf->nonce_size);
 
        /* generate NONCE value */
        iph1->nonce = eay_set_random(iph1->rmconf->nonce_size);

-       if (iph1->nonce == NULL)
+       if (iph1->nonce == NULL) {
+               plog(LLV_ERROR, LOCATION, NULL,
+                        "failed to generate NONCE");

                goto end;
                goto end;

+       }

 
        /* compute sharing secret of DH */
 
        /* compute sharing secret of DH */

-       if (oakley_dh_compute(iph1->approval->dhgrp, iph1->dhpub,
-                               iph1->dhpriv, iph1->dhpub_p, &iph1->dhgxy) < 0)
+#ifdef HAVE_OPENSSL
+               if (oakley_dh_compute(iph1->approval->dhgrp, iph1->dhpub,
+                                                         iph1->dhpriv, iph1->dhpub_p, &iph1->dhgxy) < 0) {
+#else
+       if (oakley_dh_compute(iph1->approval->dhgrp, iph1->dhpub_p, iph1->publicKeySize, &iph1->dhgxy, iph1->dhC) < 0) {
+#endif
+               plog(LLV_ERROR, LOCATION, NULL,
+                        "failed to compute DH");

                goto end;
                goto end;

+       }

 
        /* generate SKEYIDs & IV & final cipher key */
 
        /* generate SKEYIDs & IV & final cipher key */

-       if (oakley_skeyid(iph1) < 0)
+       if (oakley_skeyid(iph1) < 0) {
+               plog(LLV_ERROR, LOCATION, NULL,
+                        "failed to generate SKEYID");

                goto end;
                goto end;

-       if (oakley_skeyid_dae(iph1) < 0)
+       }
+       if (oakley_skeyid_dae(iph1) < 0) {
+               plog(LLV_ERROR, LOCATION, NULL,
+                        "failed to generate SKEYID-DAE");

                goto end;
                goto end;

-       if (oakley_compute_enckey(iph1) < 0)
+       }
+       if (oakley_compute_enckey(iph1) < 0) {
+               plog(LLV_ERROR, LOCATION, NULL,
+                        "failed to generate ENCKEY");

                goto end;
                goto end;

-       if (oakley_newiv(iph1) < 0)
+       }
+       if (oakley_newiv(iph1) < 0) {
+               plog(LLV_ERROR, LOCATION, NULL,
+                        "failed to generate IV");

                goto end;
                goto end;

+       }

 
 #ifdef HAVE_GSSAPI
 
 #ifdef HAVE_GSSAPI

-       if (iph1->rmconf->proposal->authmethod ==       
-           OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB)
+       if (RMAUTHMETHOD(iph1) == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB)

                gssapi_get_rtoken(iph1, &gsslen);
 #endif
 
                gssapi_get_rtoken(iph1, &gsslen);
 #endif
 


@@ -1056,6 +1313,8 @@ agg_r1send(iph1, msg)
                        isakmp_info_send_n1(iph1,
                            ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE, NULL);
 #endif
                        isakmp_info_send_n1(iph1,
                            ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE, NULL);
 #endif

+               plog(LLV_ERROR, LOCATION, NULL,
+                        "failed to generate GSS HASH");

                goto end;
        }
 
                goto end;
        }
 


@@ -1067,7 +1326,7 @@ agg_r1send(iph1, msg)
                cr = oakley_getcr(iph1);
                if (cr == NULL) {
                        plog(LLV_ERROR, LOCATION, NULL,
                cr = oakley_getcr(iph1);
                if (cr == NULL) {
                        plog(LLV_ERROR, LOCATION, NULL,

-                               "failed to get cr buffer.\n");
+                               "failed to get CR.\n");

                        goto end;
                }
        }
                        goto end;
                }
        }


@@ -1098,9 +1357,23 @@ agg_r1send(iph1, msg)
        if (iph1->dpd_support && iph1->rmconf->dpd)
                vid_dpd = set_vendorid(VENDORID_DPD);
 #endif
        if (iph1->dpd_support && iph1->rmconf->dpd)
                vid_dpd = set_vendorid(VENDORID_DPD);
 #endif

+#ifdef ENABLE_FRAG
+       if (iph1->frag) {
+               vid_frag = set_vendorid(VENDORID_FRAG);
+               if (vid_frag != NULL)
+                       vid_frag = isakmp_frag_addcap(vid_frag,
+                           VENDORID_FRAG_AGG);
+               if (vid_frag == NULL)
+                       plog(LLV_ERROR, LOCATION, NULL,
+                           "Frag vendorID construction failed\n");
+       }
+#endif

 
 

-       switch (iph1->approval->authmethod) {
+       switch (AUTHMETHOD(iph1)) {

        case OAKLEY_ATTR_AUTH_METHOD_PSKEY:
        case OAKLEY_ATTR_AUTH_METHOD_PSKEY:

+#ifdef ENABLE_HYBRID
+       case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
+#endif

                /* set SA payload to reply */
                plist = isakmp_plist_append(plist, iph1->sa_ret, ISAKMP_NPTYPE_SA);
 
                /* set SA payload to reply */
                plist = isakmp_plist_append(plist, iph1->sa_ret, ISAKMP_NPTYPE_SA);
 


@@ -1114,11 +1387,8 @@ agg_r1send(iph1, msg)
                plist = isakmp_plist_append(plist, iph1->id, ISAKMP_NPTYPE_ID);
 
                /* create isakmp HASH payload */
                plist = isakmp_plist_append(plist, iph1->id, ISAKMP_NPTYPE_ID);
 
                /* create isakmp HASH payload */

-               plist = isakmp_plist_append(plist, iph1->hash, ISAKMP_NPTYPE_HASH);
-
-               /* append vendor id, if needed */
-               if (vid)
-                       plist = isakmp_plist_append(plist, vid, ISAKMP_NPTYPE_VID);
+               plist = isakmp_plist_append(plist, 
+                   iph1->hash, ISAKMP_NPTYPE_HASH);

 
                /* create isakmp CR payload if needed */
                if (need_cr)
 
                /* create isakmp CR payload if needed */
                if (need_cr)


@@ -1127,16 +1397,24 @@ agg_r1send(iph1, msg)
        case OAKLEY_ATTR_AUTH_METHOD_DSSSIG:
        case OAKLEY_ATTR_AUTH_METHOD_RSASIG:
 #ifdef ENABLE_HYBRID
        case OAKLEY_ATTR_AUTH_METHOD_DSSSIG:
        case OAKLEY_ATTR_AUTH_METHOD_RSASIG:
 #ifdef ENABLE_HYBRID

-       case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
-       case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
+       case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R:
+       case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R:
+       case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R:
+       case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R:

 #endif
                /* XXX if there is CR or not ? */
 
 #endif
                /* XXX if there is CR or not ? */
 

-               if (oakley_getmycert(iph1) < 0)
+               if (oakley_getmycert(iph1) < 0) {
+                       plog(LLV_ERROR, LOCATION, NULL,
+                                "failed to get mycert");

                        goto end;
                        goto end;

+               }

 
 

-               if (oakley_getsign(iph1) < 0)
+               if (oakley_getsign(iph1) < 0) {
+                       plog(LLV_ERROR, LOCATION, NULL,
+                                "failed to get sign");

                        goto end;
                        goto end;

+               }

 
                if (iph1->cert != NULL && iph1->rmconf->send_cert)
                        need_cert = 1;
 
                if (iph1->cert != NULL && iph1->rmconf->send_cert)
                        need_cert = 1;


@@ -1160,12 +1438,78 @@ agg_r1send(iph1, msg)
                /* add SIG payload */
                plist = isakmp_plist_append(plist, iph1->sig, ISAKMP_NPTYPE_SIG);
 
                /* add SIG payload */
                plist = isakmp_plist_append(plist, iph1->sig, ISAKMP_NPTYPE_SIG);
 

-               /* append vendor id, if needed */
-               if (vid)
-                       plist = isakmp_plist_append(plist, vid, ISAKMP_NPTYPE_VID);
+               /* create isakmp CR payload if needed */
+               if (need_cr)
+                       plist = isakmp_plist_append(plist, 
+                           cr, ISAKMP_NPTYPE_CR);
+               break;
+
+       case OAKLEY_ATTR_AUTH_METHOD_RSAENC:
+       case OAKLEY_ATTR_AUTH_METHOD_RSAREV:
+#ifdef ENABLE_HYBRID
+       case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_R:
+       case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_R:
+#endif
+               break;
+#ifdef HAVE_GSSAPI
+       case OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB:
+                       /* create buffer to send isakmp payload */
+                       gsshash = gssapi_wraphash(iph1);
+                       if (gsshash == NULL) {
+                               plog(LLV_ERROR, LOCATION, NULL,
+                                       "failed to generate GSS HASH\n");
+                               /*
+                                * This is probably due to the GSS 
+                                * roundtrips not being finished yet. 
+                                * Return this error in the hope that 
+                                * a fallback to main mode will be done.
+                                */
+                               isakmp_info_send_n1(iph1,
+                                   ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE, NULL);
+                               goto end;
+                       }
+                       if (iph1->approval->gssid != NULL)
+                               gss_sa = 
+                                   ipsecdoi_setph1proposal(iph1->approval);  
+                       else
+                               gss_sa = iph1->sa_ret;
+
+                       if (gss_sa != iph1->sa_ret)
+                               free_gss_sa = 1;
+
+                       /* set SA payload to reply */
+                       plist = isakmp_plist_append(plist, 
+                           gss_sa, ISAKMP_NPTYPE_SA);
+
+                       /* create isakmp KE payload */
+                       plist = isakmp_plist_append(plist, 
+                           iph1->dhpub, ISAKMP_NPTYPE_KE);
+
+                       /* create isakmp NONCE payload */
+                       plist = isakmp_plist_append(plist, 
+                           iph1->nonce, ISAKMP_NPTYPE_NONCE);
+
+                       /* create isakmp ID payload */
+                       plist = isakmp_plist_append(plist, 
+                           iph1->id, ISAKMP_NPTYPE_ID);
+
+                       /* create GSS payload */
+                       gssapi_get_token_to_send(iph1, &gsstoken);
+                       plist = isakmp_plist_append(plist, 
+                           gsstoken, ISAKMP_NPTYPE_GSS);
+
+                       /* create isakmp HASH payload */
+                       plist = isakmp_plist_append(plist, 
+                           gsshash, ISAKMP_NPTYPE_HASH);
+
+                       /* append vendor id, if needed */
+                       break;
+#endif
+       }

 
 #ifdef ENABLE_HYBRID
        if (iph1->mode_cfg->flags & ISAKMP_CFG_VENDORID_XAUTH) {
 
 #ifdef ENABLE_HYBRID
        if (iph1->mode_cfg->flags & ISAKMP_CFG_VENDORID_XAUTH) {

+               plog (LLV_INFO, LOCATION, NULL, "Adding xauth VID payload.\n");

                if ((xauth_vid = set_vendorid(VENDORID_XAUTH)) == NULL) {
                        plog(LLV_ERROR, LOCATION, NULL,
                            "Cannot create Xauth vendor ID\n");
                if ((xauth_vid = set_vendorid(VENDORID_XAUTH)) == NULL) {
                        plog(LLV_ERROR, LOCATION, NULL,
                            "Cannot create Xauth vendor ID\n");


@@ -1186,87 +1530,29 @@ agg_r1send(iph1, msg)
        }
 #endif
 
        }
 #endif
 

-               /* create isakmp CR payload if needed */
-               if (need_cr)
-                       plist = isakmp_plist_append(plist, cr, ISAKMP_NPTYPE_CR);
-               break;
-
-       case OAKLEY_ATTR_AUTH_METHOD_RSAENC:
-       case OAKLEY_ATTR_AUTH_METHOD_RSAREV:
-               break;
-#ifdef HAVE_GSSAPI
-       case OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB:
-               /* create buffer to send isakmp payload */
-               gsshash = gssapi_wraphash(iph1);
-               if (gsshash == NULL) {
-                       plog(LLV_ERROR, LOCATION, NULL,
-                               "failed to wrap hash\n");
-                       /*
-                        * This is probably due to the GSS roundtrips not
-                        * being finished yet. Return this error in
-                        * the hope that a fallback to main mode will
-                        * be done.
-                        */
-                       isakmp_info_send_n1(iph1,
-                           ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE, NULL);
-                       goto end;
-               }
-               if (iph1->approval->gssid != NULL)
-                       gss_sa = ipsecdoi_setph1proposal(iph1->approval);  
-               else
-                       gss_sa = iph1->sa_ret;
-
-               /* set SA payload to reply */
-               plist = isakmp_plist_append(plist, gss_sa, ISAKMP_NPTYPE_SA);
-
-               /* create isakmp KE payload */
-               plist = isakmp_plist_append(plist, iph1->dhpub, ISAKMP_NPTYPE_KE);
-
-               /* create isakmp NONCE payload */
-               plist = isakmp_plist_append(plist, iph1->nonce, ISAKMP_NPTYPE_NONCE);
-
-               /* create isakmp ID payload */
-               plist = isakmp_plist_append(plist, iph1->id, ISAKMP_NPTYPE_ID);
-
-               /* create GSS payload */
-               gssapi_get_token_to_send(iph1, &gsstoken);
-               plist = isakmp_plist_append(plist, gsstoken, ISAKMP_NPTYPE_GSS);
-
-               /* create isakmp HASH payload */
-               plist = isakmp_plist_append(plist, gsshash, ISAKMP_NPTYPE_HASH);
-
-               /* append vendor id, if needed */
-               if (vid)
-                       plist = isakmp_plist_append(plist, vid, ISAKMP_NPTYPE_VID);
-
-               break;
-#endif
-       default:
-               plog(LLV_ERROR, LOCATION, NULL, "Invalid authmethod %d\n",
-                       iph1->approval->authmethod);
-               goto end;
-               break;
-       }
-

 #ifdef ENABLE_NATT
        /* append NAT-T payloads */
        if (vid_natt) {
                /* chosen VID */
                plist = isakmp_plist_append(plist, vid_natt, ISAKMP_NPTYPE_VID);
                /* NAT-D */
 #ifdef ENABLE_NATT
        /* append NAT-T payloads */
        if (vid_natt) {
                /* chosen VID */
                plist = isakmp_plist_append(plist, vid_natt, ISAKMP_NPTYPE_VID);
                /* NAT-D */

-#ifdef __APPLE__

                /* old Apple version sends natd payloads in the wrong order */
                if (iph1->natt_options->version == VENDORID_NATT_APPLE) {
                        plist = isakmp_plist_append(plist, natd[1], iph1->natt_options->payload_nat_d);
                        plist = isakmp_plist_append(plist, natd[0], iph1->natt_options->payload_nat_d);
                } else
                /* old Apple version sends natd payloads in the wrong order */
                if (iph1->natt_options->version == VENDORID_NATT_APPLE) {
                        plist = isakmp_plist_append(plist, natd[1], iph1->natt_options->payload_nat_d);
                        plist = isakmp_plist_append(plist, natd[0], iph1->natt_options->payload_nat_d);
                } else

-#endif

                {
                        plist = isakmp_plist_append(plist, natd[0], iph1->natt_options->payload_nat_d);
                        plist = isakmp_plist_append(plist, natd[1], iph1->natt_options->payload_nat_d);
                }
        }
 #endif
                {
                        plist = isakmp_plist_append(plist, natd[0], iph1->natt_options->payload_nat_d);
                        plist = isakmp_plist_append(plist, natd[1], iph1->natt_options->payload_nat_d);
                }
        }
 #endif

+
+#ifdef ENABLE_FRAG
+       if (vid_frag)
+               plist = isakmp_plist_append(plist, vid_frag, ISAKMP_NPTYPE_VID);
+#endif
+

 #ifdef ENABLE_DPD
        if (vid_dpd)
                plist = isakmp_plist_append(plist, vid_dpd, ISAKMP_NPTYPE_VID);
 #ifdef ENABLE_DPD
        if (vid_dpd)
                plist = isakmp_plist_append(plist, vid_dpd, ISAKMP_NPTYPE_VID);


@@ -1280,11 +1566,15 @@ agg_r1send(iph1, msg)
 
        /* send the packet, add to the schedule to resend */
        iph1->retry_counter = iph1->rmconf->retry_counter;
 
        /* send the packet, add to the schedule to resend */
        iph1->retry_counter = iph1->rmconf->retry_counter;

-       if (isakmp_ph1resend(iph1) == -1)
+       if (isakmp_ph1resend(iph1) == -1) {
+               plog(LLV_ERROR , LOCATION, NULL,
+                        "failed to send packet");

                goto end;
                goto end;

+       }

 
        /* the sending message is added to the received-list. */
 
        /* the sending message is added to the received-list. */

-       if (add_recvdpkt(iph1->remote, iph1->local, iph1->sendbuf, msg) == -1) {
+       if (add_recvdpkt(iph1->remote, iph1->local, iph1->sendbuf, msg,
+                     PH1_NON_ESP_EXTRA_LEN(iph1), PH1_FRAG_FLAGS(iph1)) == -1) {

                plog(LLV_ERROR , LOCATION, NULL,
                        "failed to add a response packet to the tree.\n");
                goto end;
                plog(LLV_ERROR , LOCATION, NULL,
                        "failed to add a response packet to the tree.\n");
                goto end;


@@ -1298,11 +1588,20 @@ agg_r1send(iph1, msg)
 
        error = 0;
 
 
        error = 0;
 

+       IPSECSESSIONTRACEREVENT(iph1->parent_session,
+                                                       IPSECSESSIONEVENTCODE_IKE_PACKET_TX_SUCC,
+                                                       CONSTSTR("Responder, Aggressive-Mode message 2"),
+                                                       CONSTSTR(NULL));
+       

 end:
 end:

+       if (error) {
+               IPSECSESSIONTRACEREVENT(iph1->parent_session,
+                                                               IPSECSESSIONEVENTCODE_IKE_PACKET_TX_FAIL,
+                                                               CONSTSTR("Responder, Aggressive-Mode Message 2"),
+                                                               CONSTSTR("Failed to process Aggressive-Mode Message 2"));
+       }

        if (cr)
                vfree(cr);
        if (cr)
                vfree(cr);

-       if (vid)
-               vfree(vid);

 #ifdef ENABLE_HYBRID
        if (xauth_vid)
                vfree(xauth_vid);
 #ifdef ENABLE_HYBRID
        if (xauth_vid)
                vfree(xauth_vid);


@@ -1314,13 +1613,25 @@ end:
                vfree(gsstoken);
        if (gsshash)
                vfree(gsshash);
                vfree(gsstoken);
        if (gsshash)
                vfree(gsshash);

-       if (gss_sa != iph1->sa_ret)
+       if (free_gss_sa)

                vfree(gss_sa);
 #endif
                vfree(gss_sa);
 #endif

+#ifdef ENABLE_NATT
+       if (vid_natt)
+               vfree(vid_natt);
+       if (natd[0])
+               vfree(natd[0]);
+       if (natd[1])
+               vfree(natd[1]);
+#endif

 #ifdef ENABLE_DPD
        if (vid_dpd)
                vfree(vid_dpd);
 #endif
 #ifdef ENABLE_DPD
        if (vid_dpd)
                vfree(vid_dpd);
 #endif

+#ifdef ENABLE_FRAG
+       if (vid_frag)
+               vfree(vid_frag);
+#endif

 
        return error;
 }
 
        return error;
 }


@@ -1347,6 +1658,7 @@ agg_r2recv(iph1, msg0)
 #ifdef ENABLE_NATT
        int natd_seq = 0;
 #endif
 #ifdef ENABLE_NATT
        int natd_seq = 0;
 #endif

+       int received_cert = 0;

 
        /* validity check */
        if (iph1->status != PHASE1ST_MSG1SENT) {
 
        /* validity check */
        if (iph1->status != PHASE1ST_MSG1SENT) {


@@ -1360,15 +1672,21 @@ agg_r2recv(iph1, msg0)
        if (ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E)) {
                msg = oakley_do_decrypt(iph1, msg0,
                                        iph1->ivm->iv, iph1->ivm->ive);
        if (ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E)) {
                msg = oakley_do_decrypt(iph1, msg0,
                                        iph1->ivm->iv, iph1->ivm->ive);

-               if (msg == NULL)
+               if (msg == NULL) {
+                       plog(LLV_ERROR, LOCATION, NULL,
+                                "failed to decrypt msg");

                        goto end;
                        goto end;

+               }

        } else
                msg = vdup(msg0);
 
        /* validate the type of next payload */
        pbuf = isakmp_parse(msg);
        } else
                msg = vdup(msg0);
 
        /* validate the type of next payload */
        pbuf = isakmp_parse(msg);

-       if (pbuf == NULL)
+       if (pbuf == NULL) {
+               plog(LLV_ERROR, LOCATION, NULL,
+                        "failed to parse msg");

                goto end;
                goto end;

+       }

 
        iph1->pl_hash = NULL;
 
 
        iph1->pl_hash = NULL;
 


@@ -1384,12 +1702,19 @@ agg_r2recv(iph1, msg0)
                        (void)check_vendorid(pa->ptr);
                        break;
                case ISAKMP_NPTYPE_CERT:
                        (void)check_vendorid(pa->ptr);
                        break;
                case ISAKMP_NPTYPE_CERT:

-                       if (oakley_savecert(iph1, pa->ptr) < 0)
+                       if (oakley_savecert(iph1, pa->ptr) < 0) {
+                               plog(LLV_ERROR, LOCATION, NULL,
+                                        "failed to process CERT payload");

                                goto end;
                                goto end;

+                       }
+                       received_cert = 1;

                        break;
                case ISAKMP_NPTYPE_SIG:
                        break;
                case ISAKMP_NPTYPE_SIG:

-                       if (isakmp_p2ph(&iph1->sig_p, pa->ptr) < 0)
+                       if (isakmp_p2ph(&iph1->sig_p, pa->ptr) < 0) {
+                               plog(LLV_ERROR, LOCATION, NULL,
+                                        "failed to process SIG payload");

                                goto end;
                                goto end;

+                       }

                        break;
                case ISAKMP_NPTYPE_N:
                        isakmp_check_notify(pa->ptr, iph1);
                        break;
                case ISAKMP_NPTYPE_N:
                        isakmp_check_notify(pa->ptr, iph1);


@@ -1398,17 +1723,17 @@ agg_r2recv(iph1, msg0)
 #ifdef ENABLE_NATT
                case ISAKMP_NPTYPE_NATD_DRAFT:
                case ISAKMP_NPTYPE_NATD_RFC:
 #ifdef ENABLE_NATT
                case ISAKMP_NPTYPE_NATD_DRAFT:
                case ISAKMP_NPTYPE_NATD_RFC:

-#ifdef __APPLE__
-               case ISAKMP_NPTYPE_NATD_BADDRAFT:
-#endif

                        if (NATT_AVAILABLE(iph1) && iph1->natt_options != NULL &&
                                pa->type == iph1->natt_options->payload_nat_d)
                        {
                                vchar_t *natd_received = NULL;
                                int natd_verified;
                                
                        if (NATT_AVAILABLE(iph1) && iph1->natt_options != NULL &&
                                pa->type == iph1->natt_options->payload_nat_d)
                        {
                                vchar_t *natd_received = NULL;
                                int natd_verified;
                                

-                               if (isakmp_p2ph (&natd_received, pa->ptr) < 0)
+                               if (isakmp_p2ph (&natd_received, pa->ptr) < 0) {
+                                       plog(LLV_ERROR, LOCATION, NULL,
+                                                "failed to process NATD payload");

                                        goto end;
                                        goto end;

+                               }

                                
                                if (natd_seq == 0)
                                        iph1->natt_flags |= NAT_DETECTED;
                                
                                if (natd_seq == 0)
                                        iph1->natt_flags |= NAT_DETECTED;


@@ -1447,9 +1772,17 @@ agg_r2recv(iph1, msg0)
                      iph1->natt_flags & NAT_DETECTED_PEER ? "PEER" : "");
 #endif
 
                      iph1->natt_flags & NAT_DETECTED_PEER ? "PEER" : "");
 #endif
 

+       if (received_cert) {
+               oakley_verify_certid(iph1);
+       }
+       

        /* validate authentication value */
        ptype = oakley_validate_auth(iph1);
        if (ptype != 0) {
        /* validate authentication value */
        ptype = oakley_validate_auth(iph1);
        if (ptype != 0) {

+               IPSECSESSIONTRACEREVENT(iph1->parent_session,
+                                                               IPSECSESSIONEVENTCODE_IKEV1_PH1_AUTH_FAIL,
+                                                               CONSTSTR("Responder, Aggressive-Mode Message 3"),
+                                                               CONSTSTR("Failed to authenticate Aggressive-Mode Message 3"));

                if (ptype == -1) {
                        /* message printed inner oakley_validate_auth() */
                        goto end;
                if (ptype == -1) {
                        /* message printed inner oakley_validate_auth() */
                        goto end;


@@ -1459,12 +1792,27 @@ agg_r2recv(iph1, msg0)
                isakmp_info_send_n1(iph1, ptype, NULL);
                goto end;
        }
                isakmp_info_send_n1(iph1, ptype, NULL);
                goto end;
        }

+       IPSECSESSIONTRACEREVENT(iph1->parent_session,
+                                                       IPSECSESSIONEVENTCODE_IKEV1_PH1_AUTH_SUCC,
+                                                       CONSTSTR("Responder, Aggressive-Mode Message 3"),
+                                                       CONSTSTR(NULL));

 
        iph1->status = PHASE1ST_MSG2RECEIVED;
 
        error = 0;
 
 
        iph1->status = PHASE1ST_MSG2RECEIVED;
 
        error = 0;
 

+       IPSECSESSIONTRACEREVENT(iph1->parent_session,
+                                                       IPSECSESSIONEVENTCODE_IKE_PACKET_RX_SUCC,
+                                                       CONSTSTR("Responder, Aggressive-Mode message 3"),
+                                                       CONSTSTR(NULL));
+       

 end:
 end:

+       if (error) {
+               IPSECSESSIONTRACEREVENT(iph1->parent_session,
+                                                               IPSECSESSIONEVENTCODE_IKE_PACKET_RX_FAIL,
+                                                               CONSTSTR("Responder, Aggressive-Mode Message 3"),
+                                                               CONSTSTR("Failed to process Aggressive-Mode Message 3"));
+       }

        if (pbuf)
                vfree(pbuf);
        if (msg)
        if (pbuf)
                vfree(pbuf);
        if (msg)


@@ -1507,6 +1855,11 @@ agg_r2send(iph1, msg)
 
        iph1->status = PHASE1ST_ESTABLISHED;
 
 
        iph1->status = PHASE1ST_ESTABLISHED;
 

+       IPSECSESSIONTRACEREVENT(iph1->parent_session,
+                                                       IPSECSESSIONEVENTCODE_IKEV1_PH1_RESP_SUCC,
+                                                       CONSTSTR("Responder, Aggressive-Mode"),
+                                                       CONSTSTR(NULL));
+       

        error = 0;
 
 end:
        error = 0;
 
 end: