diff --git a/Android.mk b/Android.mk
index b11ce55..078770f 100644
--- a/Android.mk
+++ b/Android.mk
@@ -21,6 +21,10 @@
 include $(CLEAR_VARS)
 
 LOCAL_SRC_FILES := \
+	src/racoon/algorithm.c \
+	src/racoon/crypto_openssl.c \
+	src/racoon/genlist.c \
+	src/racoon/handler.c \
 	src/racoon/isakmp.c \
 	src/racoon/isakmp_agg.c \
 	src/racoon/isakmp_base.c \
@@ -29,22 +33,19 @@
 	src/racoon/isakmp_inf.c \
 	src/racoon/isakmp_newg.c \
 	src/racoon/isakmp_quick.c \
-	src/racoon/handler.c \
-	src/racoon/pfkey.c \
-	src/racoon/ipsec_doi.c \
-	src/racoon/oakley.c \
-	src/racoon/vendorid.c \
-	src/racoon/policy.c \
-	src/racoon/crypto_openssl.c \
-	src/racoon/algorithm.c \
-	src/racoon/proposal.c \
-	src/racoon/strnames.c \
-	src/racoon/schedule.c \
-	src/racoon/str2val.c \
-	src/racoon/genlist.c \
-	src/racoon/vmbuf.c \
-	src/racoon/sockmisc.c \
+	src/racoon/ipsec_doi-0.7.3.c \
 	src/racoon/nattraversal.c \
+	src/racoon/oakley.c \
+	src/racoon/pfkey.c \
+	src/racoon/policy.c \
+	src/racoon/proposal.c \
+	src/racoon/remoteconf.c \
+	src/racoon/schedule.c \
+	src/racoon/sockmisc.c \
+	src/racoon/str2val.c \
+	src/racoon/strnames.c \
+	src/racoon/vendorid.c \
+	src/racoon/vmbuf.c \
 	main.c \
 	setup.c
 
diff --git a/ChangeLog b/ChangeLog
index 0bc2ef7..b071e40 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,46 +1,574 @@
-2009-08-13  tag ipsec-tools-0_7_3
+2011-03-17  Yvan Vanhullebus <vanhu@netasq.com>
+
+	* src/racoon/oakley.c: fixed a memory leak in
+	  oakley_append_rmconf_cr() while generating plist. patch by Roman
+	  Hoog Antink <rha@open.ch>
+
+	* src/racoon/oakley.c: free name later, to avoid a memory use after
+	  free in oakley_check_certid(). also give iph1->remote to some plog()
+	  calls. patch by Roman Hoog Antink <rha@open.ch>
+
+	* src/racoon/oakley.c: fixed a memory leak in
+	  oakley_check_certid(). patch by Roman Hoog Antink <rha@open.ch>
+
+2011-03-15  Yvan Vanhullebus <vanhu@netasq.com>
+
+	* src/racoon/: isakmp.c, isakmp_inf.c, pfkey.c: directly call
+	  isakmp_ph1delete() instead of scheduling isakmp_ph1delete_stub(), as
+	  it is useless an can lead to memory access after free
+
+2011-03-14  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/: grabmyaddr.c, handler.c, isakmp.c, isakmp_inf.c,
+	  isakmp_quick.c, nattraversal.c, pfkey.c, policy.c, sockmisc.c,
+	  sockmisc.h, throttle.c: Explicitly compare return value of
+	  cmpsaddr() against a return value define to make it more obvious
+	  what is the intended action. One more return value is also added, to
+	  fix comparison of security policy descriptors. Namely, getsp()
+	  should not allow wildcard matching (as the comment says, it does
+	  exact matching) - otherwise we get problems when kernel has generic
+	  policy with no ports, and a second similar policy with ports.
+
+2011-03-14  Yvan Vanhullebus <vanhu@netasq.com>
+
+	* src/racoon/: cfparse.y, isakmp_xauth.c, isakmp_xauth.h,
+	  remoteconf.c, remoteconf.h, rsalist.c, rsalist.h: avoid some
+	  memory leaks / free memory access when reloading conf and have
+	  inherited config. patch from Roman Hoog Antink <rha@open.ch>
+
+	* src/racoon/handler.c: removed an useless comment
+
+	* src/racoon/handler.c: check if we got RMCONF_ERR_MULTIPLE from
+	  getrmconf_by_ph1() in revalidate_ph1tree_rmconf()
+
+2011-03-11  Yvan Vanhullebus <vanhu@netasq.com>
+
+	* src/racoon/: handler.c, isakmp.c: directly delete a ph1 in
+	  remove_ph1-) instead of scheduling it, to avoid (completely ?) a
+	  race condition when reloading configuration
+
+2011-03-06  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/privsep.c: Quiet a gcc warning when strict-aliasing
+	  checks are enabled. Reported by Stephen Clark.
+
+2011-03-02  Yvan Vanhullebus <vanhu@netasq.com>
+
+	* src/racoon/session.c: flush sainfo list when closing session.
+	  patch by Roman Hoog Antink <rha@open.ch>
+
+	* src/racoon/: remoteconf.c, rsalist.c, rsalist.h: free rsa
+	  structures when deleting a struct rmconf. patch by Roman Hoog Antink
+	  <rha@open.ch>
+
+	* src/racoon/: cfparse.y, remoteconf.c, remoteconf.h: free spspec
+	  when deleting a rmconf struct. patch by Roman Hoog Antink
+	  <rha@open.ch>
+
+	* src/racoon/: remoteconf.c, session.c: fixed some memory leaks in
+	  remoteconf. patch by Roman Hoog Antink <rha@open.ch>
+
+	* src/racoon/: cfparse.y, prsa_par.y: fixed some memory leaks
+	  during configuration parsing. patch by Roman Hoog Antink
+	  <rha@open.ch>
+
+2011-03-01  Yvan Vanhullebus <vanhu@netasq.com>
+
+	* src/racoon/: isakmp.c, pfkey.c: plog text fixes, patch from M E
+	  Andersson <debian@gisladisker.se>
+
+	* src/racoon/cfparse.y: reset yyerrorcount before doing parse
+	  stuff. patch by Roman Hoog Antink <rha@open.ch>
+
+2011-02-20  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/oakley.c: From Roman Hoog Antink <rha@open.ch>: Fix
+	  memory leak when using plain RSA key authentication.
+
+2011-02-11  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/plainrsa-gen.c: From Mats E Andersson
+	  <debian@gisladisker.se>: Fix fprintf format specifier usage from
+	  previous patch.
+
+2011-02-10  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/plainrsa-gen.c: From Mats Erik Andersson
+	  <debian@gisladisker.se>: Implement importing of RSA keys from PEM
+	  files.
+
+	* src/racoon/prsa_par.y: From M E Andersson
+	  <debian@gisladisker.se>: Fix parsing of restricted RSA key
+	  addresses.
+
+2011-02-02  Yvan Vanhullebus <vanhu@netasq.com>
+
+	* src/racoon/: cftoken.l, isakmp.c, remoteconf.h, sainfo.c,
+	  sainfo.h: store ph1id in an u_int32_t instead of a (signed)int.
+	  Patch from Christophe Carre
+
+2011-01-28  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/: sainfo.c, sainfo.h, session.c: From Roman Hoog
+	  Antink <rha@open.ch>: Clean up sainfo reloading: rename the
+	  functions, and remove unneeded global variable.
+
+	* src/racoon/: remoteconf.c, remoteconf.h, session.c: From Roman
+	  Hoog Antink <rha@open.ch>: Clean up rmconf reloading: rename the
+	  functions, and remove unneeded global variable.
+
+	* src/racoon/plog.c: From Roman Hoog Antink <rha@open.ch>: Log
+	  remote IP address if available (slightly modified by tteras)
+
+2011-01-22  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/isakmp_inf.c: From Roman Hoog Antink <rha@open.ch>:
+	  Fixes a null pointer dereference that might occur after removing
+	  peers from the config and then reloading.
+
+2011-01-20  Yvan Vanhullebus <vanhu@netasq.com>
+
+	* src/libipsec/pfkey.c: fixed a typo, it will now compile when
+	  KMADDRESS is defined. reported by Roman Hoog Antink (rha (at)
+	  open.ch)
+
+2010-12-28  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/handler.c: From Roman Hoog Antink <rha@open.ch>: Fix
+	  config reload to not delete too many phase 2 handles, because wrong
+	  chain field is used when enumerating the handles.
+
+2010-12-16  gdt
+
+	* src/racoon/oakley.c: When encountering a certificate where "ID
+	  mismatched with ASN1 SubjectName", and verify_identifier is off,
+	  don't raise an error.  This makes the behavior match the man page.
+
+	  Patch sent for review long ago:
+	    http://mail-index.netbsd.org/tech-security/2006/03/24/0000.html
+	  with no negative feedback received to date.
+
+2010-12-14  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/ipsec_doi.c: From Roman Hoog Antink <rha@open.ch>: Fix
+	  possible null derefence.
+
+2010-12-08  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/admin.c: Use separate SA addresses for phase2's
+	  created by admin command. The phase2 startup overwrites src/dst with
+	  ISAKMP ports if they are zero and we don't want that to happen for
+	  the SA ports.
+
+2010-12-08  joerg
+
+	* src/libipsec/pfkey.c: ANSIfy
+
+2010-12-07  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/isakmp_quick.c: Fix spacing and improve wording in
+	  some log messages.
+
+2010-12-03  Timo Teras <timo.teras@iki.fi>
+
+	* src/libipsec/ipsec_dump_policy.c: Recognize direction for Linux
+	  per-socket policies.
+
+	* src/: libipsec/libpfkey.h, libipsec/pfkey_dump.c, setkey/parse.y,
+	  setkey/setkey.8: Support GRE key as upper layer protocol
+	  specifier (will be supported in Linux kernel 2.6.38).
+
+	* src/racoon/grabmyaddr.c: Netlink deletion notification does not
+	  guarentee actual address deletion: it might still exist on some
+	  other interface. Make sure we do not unbind unless the address is
+	  really gone.
+
+2010-11-17  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/: handler.c, handler.h, isakmp.c, isakmp_inf.c: Fix my
+	  previous patch to not call purge_remote() twice. Change the place
+	  where purge_remote() is called. This fixes also a possible crash
+	  from the same patch since ph1->remote can be NULL (when we are
+	  responder and config is not yet selected).
+
+2010-11-12  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/: admin.c, isakmp.c, isakmp_var.h, pfkey.c:
+	  isakmp_post_acquire is now called from admin commands too, add a
+	  flag so admin commands can be used to establish even passive links
+	  on demand.
+
+	* src/racoon/isakmp.c: Purge all IPsec-SA's if the last main
+	  ISAKMP-SA for the node is deleted by remote request and the phase1
+	  rekeying is enabled (this will also trigger the new phase1_dead
+	  script hook).
+
+	* src/racoon/: handler.h, isakmp_inf.c: Improve DPD sequence checks
+	  to allow any reply within valid sequence window to be proof of
+	  livelyness. This can improves things if there's random packet
+	  delays, or if racoon is not getting enough CPU time.
+
+	* src/racoon/: admin.c, admin.h, kmpstat.c, racoonctl.c: Extern
+	  admin protocol to allow reply packets to exceed 64kb. E.g SA dumps
+	  with many established SAs can be easily over the limit.
+
+2010-10-22  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/grabmyaddr.c: Change Linux Netlink address monitoring
+	  to monitor local route changes.  This works around a kernel bug, and
+	  slightly improves behaviour on some special cases.
+
+2010-10-21  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/: admin.c, evt.c, grabmyaddr.c, isakmp.c, pfkey.c,
+	  session.c, session.h: Introduce priorities for file descriptor
+	  polling mechanism and give priority to admin port. If admin port is
+	  used by ISAKMP-SA hook scripts they should be preferred, other wise
+	  heavy traffic can delay admin port requests considerably. This in
+	  turn may cause renegotiation loop for ISAKMP-SA. This is mostly
+	  useful for OpenNHRP setup, but can benefit other setups too.
+
+	* src/racoon/: admin.c, handler.c, handler.h: Remove
+	  initial-contact entry when all ISAKMP-SA are purged via adminport.
+	  This will avoid stale security associations if some of the delete
+	  notifications happens to get lost.
+
+2010-10-20  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/crypto_openssl.c: Use high-level openssl EVP and HMAC
+	  functions when possible: this allows openssl to perform hardware
+	  acceleration if available.
+
+	* src/racoon/: isakmp.c, isakmp_quick.c: Various improvements to
+	  error log messages and a few additional error log messages to
+	  improve diagnosing an error condition.
+
+	* src/racoon/grabmyaddr.c: Fix address comparison so we actually
+	  close sockets which were bound to IP-address that got deconfigured.
+
+2010-10-11  Yvan Vanhullebus <vanhu@netasq.com>
+
+	* src/racoon/ipsec_doi.c: report a higher encryption key length in
+	  approval for OBEY / CLAIM / STRICT modes
+
+2010-09-27  Yvan Vanhullebus <vanhu@netasq.com>
+
+	* src/racoon/isakmp_xauth.c: fixed some typos in logs (reported by
+	  fazaeli (at) sepehrs.com)
+
+2010-09-24  Yvan Vanhullebus <vanhu@netasq.com>
+
+	* src/racoon/cftoken.l: fixed a fd leak, patch by getlaser (at)
+	  gmail.com
+
+2010-09-22  Yvan Vanhullebus <vanhu@netasq.com>
+
+	* src/racoon/admin.c: get the correct length of username when
+	  processing ADMIN_LOGOUT_USER, patch by rweikusat (at) mssgmbh.com
+
+	* src/racoon/nattraversal.h: fixed a typo in macros, reported by
+	  marisp (at) mt.lv
+
+2010-09-21  Yvan Vanhullebus <vanhu@netasq.com>
+
+	* src/racoon/isakmp_cfg.c: moved from utmp.h to utmpx.h (patch
+	  provided by marcin.cieslak (at) gmail.com)
+
+2010-09-08  Yvan Vanhullebus <vanhu@netasq.com>
+
+	* src/racoon/remoteconf.c: fixed remoteconf selection when no ID
+	  specified in configuration, and added some debug to remoteconf
+	  selection
+
+2010-08-26  Yvan Vanhullebus <vanhu@netasq.com>
+
+	* src/racoon/remoteconf.c: fix by Sergio.Gelato (at) astro.su.se:
+	  duplicate some dynamic values in duprmconf()
+
+2010-08-04  Yvan Vanhullebus <vanhu@netasq.com>
+
+	* src/racoon/isakmp_cfg.c: fixed answer for IP4_SUBNET request
+
+2010-07-30  Yvan Vanhullebus <vanhu@netasq.com>
+
+	* src/racoon/doc/FAQ: updated link to NetBSD's documentation
+
+2010-06-22  Thomas Klausner <wiz@netbsd.org>
+
+	* src/racoon/racoon.conf.5: Bump date for previous.
+
+2010-06-22  Yvan Vanhullebus <vanhu@netasq.com>
+
+	* src/racoon/: cfparse.y, cftoken.l, isakmp.c, isakmp_inf.c,
+	  racoon.conf.5, remoteconf.c, remoteconf.h: added a specific
+	  script hook when a dead peer is detected
+
+2010-06-04  Thomas Klausner <wiz@netbsd.org>
+
+	* src/setkey/setkey.8: New sentence, new line. Bump date for
+	  previous.
+
+2010-06-04  Yvan Vanhullebus <vanhu@netasq.com>
+
+	* src/setkey/: parse.y, setkey.8, token.l: Added support for
+	  spdupdate command in setkey
+
+2010-04-07  Yvan Vanhullebus <vanhu@netasq.com>
+
+	* src/libipsec/ipsec_strerror.c: by Eric Preston: fixed a typo
+
+2010-04-02  Christos Zoulas <christos@netbsd.org>
+
+	* src/: libipsec/pfkey_dump.c, racoon/backupsa.c: handle ctime
+	  returning NULL.
+
+2010-03-11  Christos Zoulas <christos@netbsd.org>
+
+	* src/racoon/handler.c: PR/42363: Yasuoka Masahiko: Second part of
+	  the patch: iterate only on the phase2 handles that are bound by the
+	  given phase1 handle.
+
+2010-03-05  Timo Teras <timo.teras@iki.fi>
+
+	* src/: libipsec/ipsec_set_policy.3, racoon/privsep.c,
+	  racoon/doc/FAQ, setkey/setkey.8: From Stefan Bauer: Fix multiple
+	  typoes and manpage formatting errors.
+
+2010-03-04  Yvan Vanhullebus <vanhu@netasq.com>
+
+	* src/racoon/session.c: From Pierre POMES: fixed admin port
+	  initialization
+
+2010-02-28  snj
+
+	* src/racoon/: sockmisc.c, sockmisc.h: Fight the ever-increasing
+	  size of src checkouts by spelling "useful" without an extra l.
+
+2010-02-09  Thomas Klausner <wiz@netbsd.org>
+
+	* src/racoon/: pfkey.c, proposal.h: Fix typo in comment.
+
+2010-01-17  Thomas Klausner <wiz@netbsd.org>
+
+	* src/racoon/sainfo.c: Free strdeupped string after using it. Found
+	  by cppcheck.
+
+	* src/racoon/: eaytest.c, ipsec_doi.c: Close file handles after
+	  using them. Found by cppcheck.
+
+2010-01-15  joerg
+
+	* src/setkey/setkey.8: Use .%U instead of .%O for URLs.
+
+2009-12-11  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/Makefile.am: From Paul Wernau: vmbuf.h was defined
+	  twice in the headers. Remove the redundant entry so new install tool
+	  does not complain about overwriting just installed file.
+
+2009-11-22  Christos Zoulas <christos@netbsd.org>
+
+	* src/racoon/handler.c: PR/42363: Yasuoka Masahiko:
+
+	  racoon uses a wrong IPsec-SA handle that is for other peer in case
+	  it receives a ISAKMP message for IPsec-SA that has the same
+	  message-id as the message-id that is received before.
+
+	  racoon uses message-id to find the handle of IPsec-SA.  The
+	  message-id is a unique number for each peer, but different peers may
+	  use the same value.
+
+	  Different Windows Vista or Windows 7 peers seem to use the same
+	  message-id.  racoon can handle the first Windows's Phase-2, but it
+	  cannot handle the second Windows.  Because racoon misunderstands the
+	  message for the second Windows as the message for the first Windows.
+
+	  >Category:       bin >Synopsis:       racoon uses a wrong IPsec-SA
+	  that is for different peer >Confidential:   no >Severity:
+	  serious >Priority:       medium >Responsible:    bin-bug-people
+	  >State:          open >Class:          sw-bug >Submitter-Id:   net
+	  >Arrival-Date:   Sun Nov 22 18:25:00 +0000 2009 >Originator:
+	  yasuoka@iij.ad.jp
+
+2009-10-29  Christos Zoulas <christos@netbsd.org>
+
+	* src/setkey/token.l: use %option noinput nounput
+
+2009-10-28  Christos Zoulas <christos@netbsd.org>
+
+	* src/setkey/token.l: no unput
+
+2009-10-14  joerg
+
+	* src/libipsec/ipsec_set_policy.3: Do not use .Xo/.Xc to workaround
+	  ancient groff limits.
+
+	* src/setkey/setkey.8: Do not use .Xo/.Xc to work around ancient
+	  groff limits.  Fix markup.
+
+	* src/racoon/racoon.conf.5: Don't use .Xo/.Xc to work around
+	  ancient groff limits.  Set only one list type.
+
+2009-09-18  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/: isakmp_agg.c, isakmp_ident.c: From Tomas Mraz: Fix
+	  gssapi error checking.
+
+2009-09-03  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/: admin.c, handler.c, handler.h, isakmp.c,
+	  isakmp_var.h, pfkey.c: When rekeying phase2 use phase1 used to
+	  negotiate phase2 as a hint to select the phase1 for rekeying the new
+	  phase2.
+
+2009-09-01  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/: nattraversal.c, racoon.conf.5, vendorid.c: Check
+	  nat_traversal configuration from remote configuration candidates
+	  when acting as responder. Enable NAT-T if any of the remote
+	  candidates have NAT-T enabled.
+
+	* src/racoon/remoteconf.c: Change remote conf matching level to
+	  matching score. This way one can override anonymous certificate
+	  block config with more exact "inhereted" IP specific block.
+
+	* src/racoon/: isakmp.c, racoon.conf.5: From Maik Broemme: export
+	  ISAKMP SA identity as REMOTE_ID for phase1 up script (trac #313).
+
+2009-08-24  Yvan Vanhullebus <vanhu@netasq.com>
+
+	* src/racoon/oakley.c: fixed typo: algoriym -> algorithm
+
+2009-08-19  Yvan Vanhullebus <vanhu@netasq.com>
+
+	* src/racoon/remoteconf.c: fixed address check in
+	  rmconf_match_type(), just check address with wildcard port
+
+2009-08-19  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/remoteconf.c: Have an enum for rmconf_match_type()
+	  return values to make the code a bit more readable.
+
+2009-08-18  Yvan Vanhullebus <vanhu@netasq.com>
+
+	* src/racoon/oakley.c: typo: algoritym -> algorithm
+
+2009-08-17  Yvan Vanhullebus <vanhu@netasq.com>
+
+	* src/libipsec/libpfkey.h: do not use SADB_X_NAT_T_NEW_MAPPING to
+	  check system support for NAT-T, as at least FreeBSD doesn't have
+	  this define anymore
+
+	* src/racoon/schedule.h: include stddef.h so we have a chance to
+	  get the system offsetof if present
+
+	* src/racoon/crypto_openssl.h: removed a self include
 
 2009-08-13  Yvan Vanhullebus <vanhu@netasq.com>
 
-	* NEWS, configure.ac: 0.7.3 release
-
 	* src/racoon/oakley.c: fixed a potential DoS in
 	  oakley_do_decrypt(), reported by Orange Labs
 
+2009-08-10  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/pfkey.c: Don't print EAGAIN error from
+	  pfkey_handler(), it can occur normally under some code paths and is
+	  not a hard error in any case.
+
 2009-08-06  Timo Teras <timo.teras@iki.fi>
 
 	* src/setkey/setkey.c: From Paul Wenau: Check fgets return value in
 	  setkey to make gcc happy.
 
-2009-06-19  Timo Teras <timo.teras@iki.fi>
+2009-08-05  Timo Teras <timo.teras@iki.fi>
 
-	* src/racoon/ipsec_doi.c: Backport S.P.Zeidler's fix to IPv6
-	  address related stack smashing in ipsecdoi_id2str() from CVS HEAD.
+	* src/racoon/pfkey.c: From Paul Wernau: Fix transport mode per-port
+	  security associations that got broke during NAT-T fixes.
+
+2009-07-07  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/sockmisc.c: From Arnaud Ebalard: Fix possible usage of
+	  uninitialized local variable (not sure if any code path triggers
+	  this, but this makes compiler happy).
+
+2009-07-03  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/: admin.c, grabmyaddr.c, handler.c, handler.h,
+	  isakmp.c, isakmp_cfg.c, isakmp_inf.c, isakmp_quick.c,
+	  nattraversal.c, pfkey.c, policy.c, remoteconf.c, remoteconf.h,
+	  sockmisc.c, sockmisc.h, throttle.c: Get rid of the evil CMPSADDR
+	  macro. Trac #295.
+
+	* src/: libipsec/libpfkey.h, libipsec/pfkey.c, racoon/isakmp.c,
+	  racoon/isakmp_inf.c, racoon/pfkey.c, racoon/pfkey.h: From Yvan
+	  Vanhullebus: Use SADB_X_EXT_NAT_T_* consistently for passing the
+	  NAT-T port information. This might break compatibility with some
+	  kernels, but as discussed this is the proper way to pass NAT-T ports
+	  and the broken kernels need to be fixed.
+
+2009-06-24  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/session.c: Fix a call to null pointer: in some cases,
+	  the unmonitor_fd can be called from another fd's callback. That
+	  could lead to still have callback pending after unmonitoring the fd
+	  resulting in a call to null pointer.  This is fixed by making
+	  unmonitor_fd now clear the pending fd_set too.  Bug was introduced
+	  by my commit in 2008-12-23.
+
+2009-05-20  Yvan Vanhullebus <vanhu@netasq.com>
+
+	* src/racoon/isakmp.h: typo
+
+2009-05-19  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/: ipsec_doi.c, isakmp.c: From Jukka Salmi: Fix couple
+	  of typos from previous commit.
 
 2009-05-18  Timo Teras <timo.teras@iki.fi>
 
+	* src/racoon/: ipsec_doi.c, isakmp.c, sockmisc.c, sockmisc.h: From
+	  Tomas Mraz: Introduce union sockaddr_any and use it to make code
+	  more readable. Related to trac #293.
+
 	* src/racoon/isakmp_inf.c: From Tomas Mraz: Remove variable that is
 	  not really used; only referenced while uninitialized causing
 	  valgrind error.
 
 	* src/racoon/nattraversal.c: From Tomas Mraz: Fix natt_flags check.
 
+2009-05-04  Thomas Klausner <wiz@netbsd.org>
+
+	* src/racoon/racoon.conf.5: Remove superfluous spaces around
+	  parentheses.
+
 2009-04-29  Timo Teras <timo.teras@iki.fi>
 
 	* src/racoon/crypto_openssl.c: From Ross Meng: Fix a memory leak in
 	  X509 certificate validation.
 
-2009-04-22  tag ipsec-tools-0_7_2
+2009-04-28  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/handler.c: Reset nat_oa variables too when reusing
+	  phase two handler. Otherwise phase2 rekeying might fail in some
+	  scenarios.
 
 2009-04-22  Timo Teras <timo.teras@iki.fi>
 
-	* NEWS, configure.ac: Updates for 0.7.2 release
-
 	* src/racoon/isakmp_frag.c: From Neil Kettle: Fix a possible null
 	  pointer dereference in fragmentation code.
 
+2009-04-21  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/: grabmyaddr.c, grabmyaddr.h, session.c: Fix
+	  strict_address to work again. The lists needs to be initialized
+	  before configuration is read, which happens before my_addr_init()
+	  call.
+
 2009-04-20  Timo Teras <timo.teras@iki.fi>
 
+	* src/racoon/: isakmp.c, isakmp.h, isakmp_var.h: Fix a memory leak
+	  in certificate request generation.
+
 	* src/racoon/: isakmp_inf.c, isakmp_xauth.c, plog.c: Orignally from
 	  Bin Li: Fix possible memory corruption in binsanitize().
 
@@ -56,25 +584,257 @@
 	* src/racoon/handler.c: From Paul Moore: Phase2 message id's should
 	  be unique wrt phase1, not globally.
 
+2009-03-13  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/: pfkey.c, remoteconf.h: From Arnaud Ebalard: Fix
+	  couple of problems with previous commit.
+
+2009-03-12  he
+
+	* src/racoon/: isakmp.c, remoteconf.c: When casting to/from a
+	  pointer to an integral type (a bad practice, if you ask me), you
+	  need to cast via intptr_t for portability.
+
+2009-03-12  Thomas Klausner <wiz@netbsd.org>
+
+	* src/racoon/racoon.conf.5: New sentence, new line. Avoid marking
+	  up punctuation.
+
+	* src/racoon/racoonctl.8: Bump date for previous. Sort options to
+	  establish-sa.  Stop using Xo/Xc.
+
+2009-03-12  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/: admin.c, cfparse.y, cftoken.l, crypto_openssl.c,
+	  crypto_openssl.h, dnssec.c, dnssec.h, handler.c, handler.h,
+	  ipsec_doi.c, ipsec_doi.h, isakmp.c, isakmp.h, isakmp_agg.c,
+	  isakmp_base.c, isakmp_ident.c, isakmp_inf.c, isakmp_quick.c,
+	  isakmp_var.h, nattraversal.c, oakley.c, oakley.h, racoon.conf.5,
+	  racoonctl.8, racoonctl.c, remoteconf.c, remoteconf.h, sockmisc.c,
+	  vendorid.c: Support multiple anonymous remotes and decide
+	  remoteconf based on identity, received certificates and other
+	  information. General code clean up.
+
+2009-03-06  Timo Teras <timo.teras@iki.fi>
+
+	* src/setkey/: extern.h, parse.y, setkey.c: setkey: fix deleteall
+	  in Linux
+
+	  Linux requires SADB_DELETE message to have SPI. So send a
+	  SADB_DELETE message for each matching SA. Trac #284.
+
+	  From: Gabriel Somlo <somlo@cmu.edu>
+
 2009-02-16  Timo Teras <timo.teras@iki.fi>
 
 	* src/libipsec/policy_parse.y: From Paul Moore: Fix a heap
 	  corruption bug (yacc return non-null terminated buffer and sprintf
 	  writes over bounds).
 
+2009-02-11  Yvan Vanhullebus <vanhu@netasq.com>
+
+	* src/racoon/: isakmp.c, sockmisc.c, sockmisc.h: trac#301: fixed
+	  IPsec SAs flush in purge_remote() when NAT-T enabled but no NAT-T on
+	  tunnel
+
+2009-02-03  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/isakmp.c: From: Phil Sutter. Fix script environment
+	  variables with IPv6 addresses.
+
+2009-01-26  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/main.c: Argument parsing needs lcconf initialized.
+
+2009-01-24  Thomas Klausner <wiz@netbsd.org>
+
+	* src/racoon/racoonctl.c: Sort options in usage.
+
+	* src/racoon/racoonctl.8: Sort options. New sentence, new line.
+
+	* src/racoon/racoon.8: Sort options.
+
+2009-01-23  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/: racoonctl.8, racoonctl.c: Update usage and manpage
+	  for racoonctl.
+
+	* src/racoon/: main.c, racoon.8: Racoon -v to print version and
+	  compilation information. Update usage message.
+
+	* NEWS: Update NEWS with major changes since 0.7 release.
+
+	* src/racoon/schedule.c: Fix monotonic scheduler change, to not
+	  refresh 'now' before exit. Otherwise we can return negative timeout
+	  after spending time handling other events.
+
+	* src/racoon/: handler.c, pfkey.c: From Arnaud Ebalard: Handle
+	  reception of MIGRATE message during Phase 1 and Phase 2 negotiation.
+	  Also corrects some debugging statements.
+
+	* src/racoon/pfkey.c: From Arnaud Ebalard: On the responder (for
+	  instance), there is a need to not only migrate local and remote
+	  addresses of Phase 1 that match previous addresses but also the
+	  local and remote addresses of a Phase 1 *associated* with a migrated
+	  Phase 2. For instance, we have that need when receiving the first
+	  MIGRATE/KMADDRESS message because the old addresses are still the
+	  HoA and the address of the HA (while the peer has contacted us using
+	  the CoA and we have negotiated this address as src attribute in
+	  Phase 2). The patch fixes that by having migrate_ph1_ike_addresses()
+	  called from migrate_ph2_ike_addresses() callback.
+
+	* src/racoon/isakmp_quick.c: From Arnaud Ebalard: Set phase2 spid
+	  when acting as responder.
+
+	* configure.ac, src/racoon/handler.c, src/racoon/handler.h,
+	  src/racoon/isakmp_inf.c, src/racoon/isakmp_xauth.c,
+	  src/racoon/schedule.c, src/racoon/schedule.h,
+	  src/racoon/throttle.c, src/racoon/throttle.h: Detect if monotonic
+	  system clock is available, and use it for relative time measurements
+	  to avoid complite hang if time jumps backwards.
+
+	* src/racoon/: cfparse.y, ipsec_doi.c, isakmp.c, isakmp_agg.c,
+	  isakmp_base.c, isakmp_cfg.c, isakmp_ident.c, isakmp_xauth.c,
+	  oakley.c, oakley.h: Fix authentication method ambiguity by
+	  internally using unique ID and setting/interpreting the wire format
+	  based on received vendor ID:s. Fixes trac #280.
+
+	* src/racoon/: handler.h, isakmp_agg.c, isakmp_base.c,
+	  isakmp_ident.c, vendorid.c, vendorid.h: Introduce vendorid
+	  bitmask that can be used otherwhere to detect peer capabilities.
+
+	* configure.ac, src/racoon/admin.c, src/racoon/evt.c,
+	  src/racoon/grabmyaddr.c, src/racoon/isakmp.c, src/racoon/pfkey.c,
+	  src/racoon/session.c, src/racoon/session.h: Remove "fastquit"
+	  configure option and make it the default behaviour. The previous
+	  normal behaviour is buggy, as after flush kernel can immediately
+	  create larval SA:s which would prevent exit.
+
 2009-01-20  Timo Teras <timo.teras@iki.fi>
 
-	* configure.ac: Fix a CPPLAGS typo to CPPFLAGS which was intended
-
-	* misc/cvs2cl.pl, misc/cvsusermap, Makefile.am: Autogenerate
+	* Makefile.am, misc/cvs2cl.pl, misc/cvsusermap: Autogenerate
 	  ChangeLog from NetBSD CVS. Put sourceforge.net changes to
 	  ChangeLog.old.
 
-	* misc/cvs2cl.pl: file cvs2cl.pl was added on branch
-	  ipsec-tools-0_7-branch on 2009-01-20 14:36:32 +0000
+2009-01-10  Thomas Klausner <wiz@netbsd.org>
 
-	* misc/cvsusermap: file cvsusermap was added on branch
-	  ipsec-tools-0_7-branch on 2009-01-20 14:36:32 +0000
+	* src/racoon/racoon.conf.5: Make ready for HTML output.  Use proper
+	  escape for backslash ('\e').
+
+2009-01-10  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/: crypto_openssl.c, racoon.conf.5: From Cyrus Rahman:
+	  Accept RFC2253 compliant escaped special characters for asn1dn
+	  identifier.
+
+2009-01-09  Timo Teras <timo.teras@iki.fi>
+
+	* configure.ac: Fix a CPPLAGS typo to CPPFLAGS which was intended
+
+2009-01-05  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/: cfparse.y, cftoken.l, racoon.conf.5: Remove obsolete
+	  configuration options, fix radius configuration block and add GRE as
+	  recognized protocol.
+
+	* src/racoon/session.c: Do not use counting in signal handling as
+	  it was unsafe by not using atomic functions (post increment is not
+	  necessarily atomic).  Instead reap all children on SIGCHLD as that
+	  was the only signal needing signal counting.
+
+2008-12-30  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/session.c: schedular() call can now modify fd mask so
+	  make the working copy just before calling select(); otherwise it can
+	  contain bad file descriptors
+
+2008-12-29  Michael van Elst <mlelstv@netbsd.org>
+
+	* src/setkey/parse.y: support icmp codes. Fixes PR 39056.
+
+2008-12-24  Christos Zoulas <christos@netbsd.org>
+
+	* src/racoon/grabmyaddr.c: remove sin{6,}_len linux does not have
+	  it. From Timo Teras.
+
+	* src/racoon/grabmyaddr.c: I was wrong. addr is actually set.
+
+	* src/racoon/grabmyaddr.c:
+	  - make this compile by zeroing out the whole structure not just
+	  bogus fields.
+	  - set length field of sockets appropriately.
+	  - mark bogus no-op code (I don't understand what the author intended
+	  here).
+
+2008-12-23  Thomas Klausner <wiz@netbsd.org>
+
+	* src/racoon/racoon.conf.5: Bump date for identity configuration
+	  option removal.
+
+2008-12-23  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/: cfparse.y, cftoken.l, ipsec_doi.c, localconf.c,
+	  localconf.h, racoon.conf.5: Remove the obsoleted global identity
+	  configuration option.
+
+	* src/racoon/: admin.c, admin_var.h, cfparse.y, debug.h, evt.c,
+	  evt.h, grabmyaddr.c, grabmyaddr.h, handler.c, isakmp.c,
+	  isakmp_inf.c, isakmp_var.h, localconf.c, localconf.h, main.c,
+	  nattraversal.c, pfkey.c, pfkey.h, privsep.c, session.c,
+	  session.h: rewrite local address detection make some functions
+	  static that arr not needed globally rework how fd_set is
+	  construction for the main loop select()
+
+2008-12-18  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/pfkey.c: From Arnaud Ebalard: Delete larval ph2handles
+	  when expire with hard lifetime received
+
+2008-12-16  Timo Teras <timo.teras@iki.fi>
+
+	* README: Update README
+
+	* src/racoon/pfkey.c: Fix transport mode address selection in
+	  acquire handling.  Some earlier fixes got lost on 2008-12-05 commit.
+
+2008-12-11  Yvan Vanhullebus <vanhu@netasq.com>
+
+	* src/racoon/grabmyaddr.c: Fixed compilation on FreeBSD (RTM_IFINFO
+	  and RTM_OIFINFO stuff)
+
+	* src/racoon/isakmp.c: Fixed compilation when DPD support is
+	  disabled
+
+2008-12-08  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/: pfkey.c, privsep.c, privsep.h: Do not cache pfkey
+	  sockets: it might cause to not handle some pfkey events when
+	  select() has marked pfkey socket readable, but a timer callback
+	  first calls pfkey_dump_sadb().
+
+2008-12-05  Timo Teras <timo.teras@iki.fi>
+
+	* src/: libipsec/key_debug.c, libipsec/libpfkey.h,
+	  libipsec/pfkey.c, racoon/handler.c, racoon/handler.h,
+	  racoon/ipsec_doi.c, racoon/isakmp.c, racoon/isakmp_quick.c,
+	  racoon/pfkey.c, racoon/policy.c, racoon/policy.h: From Arnaud
+	  Ebalard: Improved Mobile IPv6 support per
+	  draft-ebalard-mext-pfkey-enhanced-migrate.
+
+2008-12-04  Christoph Badura <bad@netbsd.org>
+
+	* src/racoon/privsep.c: Fix typo in previous and use SIG_IGN as I
+	  intended.
+
+2008-12-02  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/session.c: Explicitly ignore SIGPIPE. Default action
+	  on Linux is terminate.
+
+2008-11-28  Thomas Klausner <wiz@netbsd.org>
+
+	* src/racoon/racoon.conf.5: Remove empty line. Fix typo. New
+	  sentence, new line.
 
 2008-11-27  Yvan Vanhullebus <vanhu@netasq.com>
 
@@ -83,26 +843,181 @@
 
 	* src/racoon/isakmp_cfg.c: Fixed pool resizing
 
+2008-11-27  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/pfkey.c: From Arnaud Ebalard: Remove MAXNESTEDSA
+	  weirdness. It's probably meant for bundle support which is not done.
+	  When someone actually writes bundle support, the nested SA stuff
+	  would probably be reworked too anyway.
+
+	* src/: libipsec/libpfkey.h, libipsec/pfkey.c, racoon/cfparse.y,
+	  racoon/cftoken.l, racoon/localconf.c, racoon/localconf.h,
+	  racoon/pfkey.c, racoon/racoon.conf.5: From: Matthew Krenzer
+	  Ability to set pfkey socket buffer size via configuration file
+	  directive.  (Indentation and minor fixes by me.)
+
+2008-11-25  Christoph Badura <bad@netbsd.org>
+
+	* src/racoon/: evt.c, privsep.c, session.c: Avoid using
+	  MSG_NOSIGNAL as it is not available everywhere.  Ignore SIGPIPE
+	  instead.
+
+	* src/racoon/grabmyaddr.c: Ignore unspecified and looback
+	  addresses.  Ignoring unspecified addresses prevents racoon from
+	  trying to bind to the wildcard address and specific addresses
+	  simultaneously after e.g. dhclient has changed an interface's
+	  address to 0.0.0.0.
+
+	* src/racoon/grabmyaddr.c: RTM_DELETE and RTM_IFINFO don't carry
+	  info for added or deleted addresses.  Ignore them silently.
+
+	* src/racoon/grabmyaddr.c: Ignoring an unsuitable address is not an
+	  error.  Therefore log it as informational.  Make it clear from the
+	  log message that a route message is not interesting.
+
+	* src/racoon/grabmyaddr.c: Use insmyaddr() instead of open coding
+	  it.
+
+	* src/racoon/isakmp.c: Do not return erroneously from isakmp_open()
+	  when setting IPV6_USE_MIN_MTU fails.
+
+	* src/racoon/: grabmyaddr.c, isakmp.c: Keep myaddr.sock at -1 when
+	  no socket is opened.
+
+2008-11-08  Christoph Badura <bad@netbsd.org>
+
+	* src/racoon/samples/roadwarrior/client/: phase1-down.sh,
+	  phase1-up.sh: Preserve owner and permissions of original
+	  /etc/resolv.conf.  Ensure that new /etc/resolv.conf isn't group or
+	  world writable.
+
+	* src/racoon/samples/roadwarrior/client/: phase1-down.sh,
+	  phase1-up.sh: Print and check INTERNAL_NETMASK4.
+
+	* src/racoon/samples/roadwarrior/client/: phase1-down.sh,
+	  phase1-up.sh: Make the handling of NAT-T SPD entries automatic.
+
+	* src/racoon/samples/roadwarrior/client/: phase1-down.sh,
+	  phase1-up.sh: Ensure that the determination of the default
+	  gateway and the corresponding interface don't get confused by
+	  multiple, possibly non-IPv4  default routes.  Bring the NetBSD case
+	  of deleting the VPN routes and address in line with the Linux case
+	  and delete the address after deleting the VPN routes.
+
+2008-11-06  Yvan Vanhullebus <vanhu@netasq.com>
+
+	* src/racoon/sainfo.c: fixed delsainfo() to avoid a crash when
+	  iddst's value is SAINFO_CLIENTADDR
+
+2008-10-29  S.P.Zeidler <spz@netbsd.org>
+
+	* src/racoon/ipsec_doi.c: Changes to ipsecdoi_id2str():
+
+	  struct sockaddr -> struct sockaddr_storage fixes a stack overflow
+
+	  For non-linklocal addresses the value in 'scope' is garbage and gets
+	  set to zero instead.
+
+2008-10-27  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/pfkey.c: From Arnaud Ebalard: Add missing return to
+	  error path
+
+	* src/racoon/grabmyaddr.c: From Francis Dupont (sent by Arnaud
+	  Ebalard): recognize RTM_IFANNOUNCE
+
+	* src/racoon/grabmyaddr.c: From Arnaud Ebalard: Fix indentation
+	  issues for readability
+
+	* src/racoon/session.c: From Arnaud Ebalard: initfds() needs to be
+	  called only if monitored file descriptor numbers have changed
+
+	* src/racoon/isakmp_var.h: From Arnaud Ebalard: Remove duplicate
+	  declaration
+
+2008-10-23  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/: privsep.c, session.c, session.h: From Krzysztof
+	  Piotr Oledzki <olel@ans.pl>: Revert parts of 2008-08-06 commit; the
+	  problem those changes address are already handled in a sensible way
+	  by Cyrus Rahman's patch from 2008-03-06.
+
+2008-10-09  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/isakmp_quick.c: From Arnaud Ebalard: remove
+	  unnecessary unbindph12() call which is now done in remph2()
+
 2008-09-25  Yvan Vanhullebus <vanhu@netasq.com>
 
 	* src/racoon/isakmp.c: Fixed resending mechanism to have non-ESP
 	  marker for retransmitted packets
 
+2008-09-19  Thomas Klausner <wiz@netbsd.org>
+
+	* src/racoon/racoon.conf.5: New sentence, new line.
+
+2008-09-19  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/: admin.c, cfparse.y, cftoken.l, handler.c, handler.h,
+	  isakmp.c, isakmp_cfg.c, isakmp_inf.c, isakmp_quick.c,
+	  isakmp_var.h, isakmp_xauth.c, pfkey.c, proposal.c, racoon.conf.5,
+	  remoteconf.c, remoteconf.h: Implement ISAKMP SA rekeying
+	  configurable with rekey {on|off|force} option in remote conf.
+
+	* src/racoon/: handler.c, handler.h, isakmp.c, isakmp_inf.c,
+	  isakmp_quick.c, isakmp_var.h, isakmp_xauth.c, isakmp_xauth.h,
+	  nattraversal.c, pfkey.c, pfkey.h, schedule.c, schedule.h,
+	  session.c: Change struct sched to be allocated be the caller to
+	  avoid some memory allocations. Optimize scheduling algorithm to not
+	  scan all entries in the main loop.
+
 2008-09-17  Yvan Vanhullebus <vanhu@netasq.com>
 
 	* src/racoon/isakmp_inf.c: Fixed port match in purge_ipsec_spi()
 	  when NAT-T enabled and trying to purge non NAT-T SAs
 
+2008-09-09  Yvan Vanhullebus <vanhu@netasq.com>
+
+	* src/racoon/pfkey.c: Some calls to set_port() were not correctly
+	  updated in the previous commit
+
+2008-09-03  Yvan Vanhullebus <vanhu@netasq.com>
+
+	* src/racoon/pfkey.c: From Tomas Mraz: Duplicate addresses in
+	  pk_sendxxx functions, as they may be altered for NAT-T stuff.
+
+2008-09-03  Timo Teras <timo.teras@iki.fi>
+
+	* src/: libipsec/pfkey.c, racoon/pfkey.c, racoon/sockmisc.c:
+	  - Fix reloading of SPD (Linux satype check, handling of SPD dump
+	  responses)
+	  - Remove some spurious error log message from extract_port()
+
+2008-08-29  Gregory McGarry <gmcgarry@netbsd.org>
+
+	* src/racoon/isakmp.c: Eliminate gcc-specific feature of empty
+	  structures.
+
+	* src/racoon/evt.h: Eliminate superfluous semicolon.
+
+	* src/racoon/: admin.c, admin.h: Eliminate gcc-specific feature of
+	  unnamed structures added recently.
+
 2008-08-12  Yvan Vanhullebus <vanhu@netasq.com>
 
-	* src/racoon/isakmp.c: From Krzysztof Oledzki: Remove ph1handler if
-	  we received an invalid first exchange from initiator.
+	* src/racoon/isakmp.c: From Krzysztof Piotr Oledzki: Remove
+	  ph1handler if we received an invalid first exchange from initiator.
 
-2008-07-23  tag ipsec-tools-0_7_1
+2008-08-06  Timo Teras <timo.teras@iki.fi>
 
-2008-07-23  Yvan Vanhullebus <vanhu@netasq.com>
+	* src/racoon/: privsep.c, session.c, session.h: From Krzysztof
+	  Piotr Oledzki: Make privileged process exit if unprivileged process
+	  is terminated and some spelling fixes.
 
-	* NEWS: NEWS for 0.7.1 release
+2008-07-23  Matthew Grooms <mgrooms@shrew.net>
+
+	* src/racoon/: cfparse.y, session.c: Add some missing ifdefs
+	  required for non-radius enabled builds.
 
 2008-07-23  Timo Teras <timo.teras@iki.fi>
 
@@ -114,16 +1029,30 @@
 
 2008-07-22  Yvan Vanhullebus <vanhu@netasq.com>
 
-	* configure.ac: 0.7.1 coming !
-
 	* src/racoon/proposal.c: From Kohki Ohhira: fix some memory leaks,
 	  when malloc fails or when peer sends invalid proposal.
 
-2008-07-21  Timo Teras <timo.teras@iki.fi>
+2008-07-22  Matthew Grooms <mgrooms@shrew.net>
+
+	* src/racoon/: cfparse.y, cftoken.l, isakmp_cfg.c, isakmp_xauth.c,
+	  isakmp_xauth.h, main.c, racoon.conf.5, session.c: Add an optional
+	  radius configuration section to the racoon.conf file. This is
+	  similar to the the LDAP configuration section and overrides settings
+	  in the system radius configuration file.
+
+2008-07-21  Matthias Scheler <tron@netbsd.org>
 
 	* src/racoon/cfparse.y: Correct typo to fix the build.
 
-	* src/racoon/cfparse.y: Do not set default gss id if xauth is used.
+2008-07-21  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/: isakmp_agg.c, isakmp_base.c, isakmp_ident.c,
+	  vendorid.c, vendorid.h: Separate generic vendor id handling to a
+	  new function and use it.
+
+	* src/racoon/cfparse.y: Do not set default gss id if xauth is used,
+	  otherwise gss-id attribute might be sent even if it was not
+	  requested.
 
 2008-07-15  Matthew Grooms <mgrooms@shrew.net>
 
@@ -134,6 +1063,17 @@
 	  racoonctl.c: Fix a conflict with the FreeBSD 8 system hexdump
 	  function.
 
+2008-07-14  Timo Teras <timo.teras@iki.fi>
+
+	* src/racoon/: handler.h, ipsec_doi.c, ipsec_doi.h, isakmp_quick.c,
+	  pfkey.c: Handle RESPONDER-LIFETIME notification in quick mode.
+
+	* src/racoon/: handler.h, isakmp.c, isakmp_agg.c, isakmp_ident.c,
+	  isakmp_inf.c, isakmp_inf.h, isakmp_quick.c, strnames.c: Clean up
+	  notification payload handling. Handle INITIAL-CONTACT notification
+	  in last main mode exchange (delayed) and during quick mode
+	  exchanges.
+
 2008-07-11  Timo Teras <timo.teras@iki.fi>
 
 	* src/racoon/: isakmp.c, isakmp_inf.c: Original patch from Atis
@@ -147,48 +1087,125 @@
 
 2008-07-02  Yvan Vanhullebus <vanhu@netasq.com>
 
-	* src/racoon/isakmp_inf.c: From Timo Teras: fixed some %d to %zu
-	  (size_t values).
+	* src/racoon/isakmp_inf.c: From Timo Teras: fix some %d to %zu
+	  (size_t values)
+
+2008-06-18  Thomas Klausner <wiz@netbsd.org>
+
+	* src/racoon/racoonctl.8: Bump date for previous.
 
 2008-06-18  Matthew Grooms <mgrooms@shrew.net>
 
-	* src/racoon/: grabmyaddr.c, admin.c, ipsec_doi.c, isakmp.c,
-	  isakmp_cfg.c, isakmp_inf.c, remoteconf.c: Use utility functions
-	  to evaluate and manipulate network port values. No functional
-	  changes. Submitted by Timo Teras.
+	* src/racoon/: admin.c, admin.h, racoonctl.8, racoonctl.c: Add an
+	  admin port command to retrieve the peer certificate. Submitted by
+	  Timo Teras.
+
+	* src/racoon/: admin.c, grabmyaddr.c, isakmp.c, misc.c, misc.h: Set
+	  sockets to be closed on exec to avoid potential file descriptor
+	  inheritance issues. Submitted by Timo Teras.
+
+	* src/racoon/: admin.c, grabmyaddr.c, ipsec_doi.c, isakmp.c,
+	  isakmp_cfg.c, isakmp_inf.c, privsep.c, remoteconf.c: Use utility
+	  functions to evaluate and manipulate network port values. No
+	  functional changes. Submitted by Timo Teras.
+
+	* src/racoon/: admin.c, racoonctl.c: Admin port code cleanup. No
+	  functional changes. Submitted by Timo Teras.
+
+	* src/racoon/pfkey.c: Correct a phase2 status event. Submitted by
+	  Timo Teras.
+
+2008-05-24  Christos Zoulas <christos@netbsd.org>
+
+	* src/racoon/privsep.c: Coverity CID 5018: Fix double frees.
+
+2008-05-08  Emmanuel Dreyfus <manu@netbsd.org>
+
+	* configure.ac: From Christian Hohnstaedt: allow out of tree
+	  building
+
+2008-04-30  Martin Husemann <martin@netbsd.org>
+
+	* netbsd-import.sh: Convert TNF licenses to new 2 clause variant
 
 2008-04-25  Yvan Vanhullebus <vanhu@netasq.com>
 
 	* src/racoon/isakmp_inf.c: From Timo Teras: extract port numbers
 	  from SADB_X_EXT_NAT_T[SD]PORT if present in purge_ipsec_spi().
 
+2008-04-13  Christos Zoulas <christos@netbsd.org>
+
+	* src/racoon/privsep.c: for symmetry set controllen the same way we
+	  set it on the receiving side.
+
+2008-04-02  Emmanuel Dreyfus <manu@netbsd.org>
+
+	* src/racoon/: Makefile.am, sockmisc.c, sockmisc.h: fix Linux build
+
+2008-03-28  Christos Zoulas <christos@netbsd.org>
+
+	* src/racoon/privsep.c: properly fix the variable stack allocation
+	  code.
+
+2008-03-28  Emmanuel Dreyfus <manu@netbsd.org>
+
+	* src/racoon/privsep.c: Still from Cyrus Rahman: fix file
+	  descriptor leak introduced by previous commit.
+
+	* src/racoon/: Makefile.am, isakmp.c, isakmp_inf.c, privsep.c,
+	  privsep.h, sockmisc.c, doc/README.privsep: From Cyrus Rahman:
+	  Allow interface reconfiguration when running in privilege separation
+	  mode, document privilege separation
+
 2008-03-06  Yvan Vanhullebus <vanhu@netasq.com>
 
 	* src/racoon/oakley.c: Generates a log if cert validation has been
 	  disabled by configuration
 
+2008-03-06  Emmanuel Dreyfus <manu@netbsd.org>
+
+	* src/racoon/: privsep.c, session.c: From Cyrus Rahman
+	  <crahman@gmail.com> privilegied instance exit when unprivilegied one
+	  terminates. Save PID in real root, not in chroot
+
+2008-03-06  Matthew Grooms <mgrooms@shrew.net>
+
+	* src/racoon/: admin.c, isakmp.c, isakmp_var.h, pfkey.c,
+	  racoonctl.8, racoonctl.c: Add the ability to initiate IPsec SA
+	  negotiations using the admin socket.  Submitted by Timo Teras.
+
+	* src/racoon/: admin.c, admin.h, evt.c, evt.h, handler.c,
+	  handler.h, isakmp.c, isakmp_agg.c, isakmp_base.c, isakmp_cfg.c,
+	  isakmp_ident.c, isakmp_inf.c, isakmp_var.h, isakmp_xauth.c,
+	  racoonctl.8, racoonctl.c, session.c: Refactor admin socket event
+	  protocol to be less error prone. Backwards compatibility is
+	  provided. Submitted by Timo Teras.
+
 2008-03-05  Matthew Grooms <mgrooms@shrew.net>
 
 	* src/racoon/cfparse.y: Properly initialize the unity network
 	  struct to prevent erroneous protocol and port info from being
 	  transmitted.
 
-	* src/racoon/pfkey.c: Provide better handling for pfkey socket read
+	* src/racoon/: pfkey.c, pfkey.h, session.c: Reload SPD on SIGHUP or
+	  adminport reload. Also provide better handling for pfkey socket read
 	  errors. Submitted by Timo Teras.
 
 2008-02-25  Emmanuel Dreyfus <manu@netbsd.org>
 
-	* src/racoon/ipsec_doi.c: From Brian Haley <brian.haley@hp.com>:
+	* src/racoon/ipsec_doi.c: From Brian Haley <brian.haley@hp.com>
 	  There's a cut/paste error in cmp_aproppair_i(), it's supposed to be
 	  checking spi_size but it's not.  I'm not sure this patch is correct,
 	  but what's there isn't either.
 
-	  Add fogotten entry in ChangeLog
-
 2008-02-22  Emmanuel Dreyfus <manu@netbsd.org>
 
-	* src/racoon/isakmp.c: Fix bad address length computation, from
-	  Brian Haley.
+	* src/racoon/isakmp.c: Fix address length, from Brian Haley
+
+2008-02-10  S.P.Zeidler <spz@netbsd.org>
+
+	* src/racoon/ipsec_doi.c: closes PR bin/37644 did not meet violent
+	  opposition ( :) ) on ipsec-tools-devel
 
 2008-01-11  Yvan Vanhullebus <vanhu@netasq.com>
 
@@ -208,12 +1225,58 @@
 	* src/racoon/: handler.c, handler.h: added an 'established' arg to
 	  getph1byaddr()
 
+2007-12-31  Matthew Grooms <mgrooms@shrew.net>
+
+	* src/racoon/: policy.c, racoonctl.8, racoonctl.c: Add GRE protocol
+	  number to racoonctl. Correct id wildcard matching for transport
+	  mode. Submitted by Timo Teras.
+
+2007-12-12  Matthew Grooms <mgrooms@shrew.net>
+
+	* NEWS, src/racoon/isakmp_quick.c: Add corrections submitted in a
+	  follow up patch for the nat-t oa support.
+
+	* src/racoon/: handler.c, handler.h, isakmp_quick.c, pfkey.c: Add
+	  support for nat-t oa payload handling. Submitted by Timo Teras.
+
+2007-12-04  Matthew Grooms <mgrooms@shrew.net>
+
+	* src/racoon/: ipsec_doi.c, ipsec_doi.h, isakmp_quick.c: Modify
+	  ipsecdoi_sockaddr2id() to obtain an id without specifying the exact
+	  prefix length. Correct a memory leak in phase2. Both submitted by
+	  Timo Teras.
+
+2007-12-01  Thomas Klausner <wiz@netbsd.org>
+
+	* src/racoon/racoon.conf.5: Fix typos. New sentence, new line.
+
 2007-11-29  Yvan Vanhullebus <vanhu@netasq.com>
 
 	* src/racoon/Makefile.am: From Natanael Copa: fixed a race
 	  condition when building yacc stuff.
 
-2007-11-06  Yvan Vanhullebus <vanhu@netasq.com>
+2007-11-09  Yvan Vanhullebus <vanhu@netasq.com>
+
+	* src/racoon/pfkey.c: From Arnaud Ebalard: Some sanity checking in
+	  pk_recv()
+
+	* src/racoon/policy.c: From Arnaud Ebalard: Better matching of SPD
+	  entries in getsp_r().
+
+	* src/racoon/isakmp_quick.c: From Arnaud Ebalard: Added some debug
+	  in get_proposal_r().
+
+2007-10-19  Emmanuel Dreyfus <manu@netbsd.org>
+
+	* src/racoon/: isakmp_cfg.c, isakmp_unity.c, isakmp_unity.h,
+	  racoon.conf.5: Add SPLITNET_{INCLUDR_LOCAL}_CIDR to hook scripts
+
+2007-10-15  Yvan Vanhullebus <vanhu@netasq.com>
+
+	* src/libipsec/pfkey.c: Try to increase the buffer size of the
+	  pfkey socket, this may help things when we have a huge SPD
+
+2007-10-02  Yvan Vanhullebus <vanhu@netasq.com>
 
 	* src/racoon/crypto_openssl.c: From Scott Lamb: include plog.h to
 	  work with the new plog macro.
@@ -223,34 +1286,53 @@
 
 	* src/racoon/: plog.c, plog.h: From Scott Lamb: new plog macro.
 
-2007-10-15  Yvan Vanhullebus <vanhu@netasq.com>
-
-	* src/libipsec/pfkey.c: Try to increase the buffer size of the
-	  pfkey socket, this may help things when we have a huge SPD
-
 2007-09-19  Matthew Grooms <mgrooms@shrew.net>
 
+	* src/racoon/isakmp.c: Set REUSE option on sockets to prevent
+	  failures associated with closing and immediately re-opening.
+	  Submitted by Gabriel Somlo.
+
+	* src/racoon/isakmp_unity.c: Prevent duplicate entries in splitnet
+	  list. Submitted by Gabriel Somlo.
+
+2007-09-13  Matthew Grooms <mgrooms@shrew.net>
+
 	* configure.ac: Fix autoconf check for selinux support. Submitted
 	  by Joy Latten.
 
+2007-09-12  Matthew Grooms <mgrooms@shrew.net>
+
+	* src/racoon/: cfparse.y, cftoken.l, handler.c, isakmp_quick.c,
+	  pfkey.c, racoon.conf.5, sainfo.c, sainfo.h: Implement clientaddr
+	  sainfo remote id option and refine the sainfo man page syntax.
+
+2007-09-05  Matthew Grooms <mgrooms@shrew.net>
+
+	* src/racoon/sainfo.c: Sort sainfo sections on insert and improve
+	  matching logic.
+
 2007-09-03  Matthew Grooms <mgrooms@shrew.net>
 
 	* src/racoon/: cftoken.l, racoon.conf.5: Correct the syntax for
 	  wins4 in the man page and add nbns4 as an alias. Pointed out by
 	  Claas Langbehn.
 
-2007-08-09  tag ipsec-tools-0_7
-
-2007-08-09  Matthew Grooms <mgrooms@shrew.net>
-
-	* NEWS, configure.ac: Prepare for 0.7 release tag.
-
 2007-08-07  Emmanuel Dreyfus <manu@netbsd.org>
 
-	* src/racoon/isakmp_xauth.c: Don't mix up RADIUS authentication and
-	  authorization ports. Allow interoperability with freeradius
+	* src/racoon/isakmp_xauth.c: src/racoon/isakmp_xauth.c: Don't mix
+	  up RADIUS authentication and authorization ports. Allow
+	  interoperability with freeradius
 
-2007-08-01  Yvan Vanhullebus <vanhu@netasq.com>
+2007-07-24  Matthew Grooms <mgrooms@shrew.net>
+
+	* NEWS: Update NEWS file with additional 0.7 improvements.
+
+2007-07-18  Matthew Grooms <mgrooms@shrew.net>
+
+	* src/racoon/racoon.conf.5: Various racoon configuration manpage
+	  updates.
+
+2007-07-18  Yvan Vanhullebus <vanhu@netasq.com>
 
 	* configure.ac, src/libipsec/ipsec_dump_policy.c,
 	  src/libipsec/ipsec_get_policylen.c,
@@ -269,58 +1351,50 @@
 	  src/setkey/token.l: use a single PATH_IPSEC_H to fix some
 	  path_to_ipsec.h issues
 
-2007-07-24  Matthew Grooms <mgrooms@shrew.net>
-
-	* NEWS: Update NEWS file with additional 0.7 improvements.
-
-2007-07-18  Matthew Grooms <mgrooms@shrew.net>
-
-	* src/racoon/racoon.conf.5: Various racoon configuration manpage
-	  updates.
-
 2007-07-16  Yvan Vanhullebus <vanhu@netasq.com>
 
 	* src/racoon/grabmyaddr.c: fixed a socket leak
 
-2007-06-12  tag ipsec-tools-0_7-RC1
-
-2007-06-12  tag ipsec-tools-0_7-rc1
-
-2007-06-12  Emmanuel Dreyfus <manu@netbsd.org>
-
-	* configure.ac: ipsec-tools used to use tags in lower case
-
-2007-06-12  Yvan Vanhullebus <vanhu@netasq.com>
-
-	* configure.ac: 0.7-RC1
+	* src/racoon/proposal.c: indentation
 
 2007-06-07  Emmanuel Dreyfus <manu@netbsd.org>
 
-	* src/racoon/: main.c, policy.h, security.c: From Joy Latten
-	  <latten@austin.ibm.com> Fix file descriptor shortage when using
-	  labeled IPsec.
-
 	* src/racoon/isakmp_cfg.c: From Paul Winder
-	  <Paul.Winder@tadpole.com> Fix ignored INTERNAL_DNS4_LIST
+	  <Paul.Winder@tadpole.com>: Fix ignored INTERNAL_DNS4_LIST
 
 2007-06-06  Yvan Vanhullebus <vanhu@netasq.com>
 
 	* src/racoon/: eaytest.c, var.h: From Rong-En Fan: fix compilation
 	  with gcc 4.2
 
-2007-06-06  Emmanuel Dreyfus <manu@netbsd.org>
-
-	* src/racoon/kmpstat.c: From Jianli Liu <jlliu@nortel.com>: Use the
-	  specified socket path instead of the default location
-
-2007-06-06  Yvan Vanhullebus <vanhu@netasq.com>
-
 	* src/racoon/session.c: From Jianli Liu: speed up interfaces update
 	  when they change.
 
 	* src/racoon/handler.c: ignore obsolete lifebyte when validating
 	  reloaded configuration
 
+2007-05-31  Emmanuel Dreyfus <manu@netbsd.org>
+
+	* src/racoon/: main.c, policy.h, security.c: From Joy Latten
+	  <latten@austin.ibm.com> Fix file descriptor shortage when using
+	  labeled IPsec.
+
+2007-05-30  Emmanuel Dreyfus <manu@netbsd.org>
+
+	* src/racoon/kmpstat.c: From Jianli Liu <jlliu@nortel.com>: In
+	  racoonctl, use the specified socket path instead of the default
+	  location
+
+2007-05-16  Christos Zoulas <christos@netbsd.org>
+
+	* src/racoon/cfparse.y: coverity CID 4168: yyerror() does not
+	  return, so we proceed to de-reference NULL. Make it return -1
+	  instead like in other places.
+
+	* src/racoon/cfparse.y: coverity CID 4170: yyerror() does not
+	  return, so we proceed to de-reference NULL. Make it return -1
+	  instead like in other places.
+
 2007-05-04  Yvan Vanhullebus <vanhu@netasq.com>
 
 	* src/racoon/handler.c: search a ph1 by address if iph2->ph1 is
@@ -345,18 +1419,17 @@
 	* src/racoon/oakley.c: dumps peer's ID and peer's certificate
 	  subject /subjectaltname if they don't match
 
-2007-03-29  tag ipsec-tools-0_7-beta3
-
-2007-03-29  Emmanuel Dreyfus <manu@netbsd.org>
-
-	* configure.ac: Bump to 0.7beta3
-
 2007-03-26  Yvan Vanhullebus <vanhu@netasq.com>
 
 	* src/racoon/isakmp_inf.c: Store the DPD main scheduler in ph1
 	  handler, to be able to cancel it when removing the handler, and some
 	  minor cleanups in DPD code
 
+2007-03-24  Christos Zoulas <christos@netbsd.org>
+
+	* src/racoon/isakmp_xauth.c: PR/36069: Huang Yushuo: racoon can't
+	  work with pam_group Set RUSER.
+
 2007-03-23  Yvan Vanhullebus <vanhu@netasq.com>
 
 	* src/racoon/: ipsec_doi.c, security.c: From Joy Latten: fix a
@@ -389,13 +1462,7 @@
 	* src/racoon/isakmp.c: Consider a negociation timeout when
 	  retry_counter is <=0 instead of < 0
 
-2007-03-06  tag ipsec-tools-0_7-beta2
-
-2007-03-06  Emmanuel Dreyfus <manu@netbsd.org>
-
-	* configure.ac: Bump to 0.7beta2
-
-2007-03-01  Matthew Grooms <mgrooms@shrew.net>
+2007-02-28  Matthew Grooms <mgrooms@shrew.net>
 
 	* src/racoon/ipsec_doi.c: Add logic to allow ip address ids to be
 	  matched to ip subnet ids when appropriate.
@@ -423,12 +1490,6 @@
 
 	* src/racoon/isakmp.c: Removed a debug printf....
 
-2007-02-16  tag ipsec-tools-0_7-beta1
-
-2007-02-16  Emmanuel Dreyfus <manu@netbsd.org>
-
-	* configure.ac: Bump to 0.7beta1
-
 2007-02-16  Yvan Vanhullebus <vanhu@netasq.com>
 
 	* src/racoon/ipsec_doi.c: From Olivier Warin: Fix a %zu in a
@@ -436,7 +1497,7 @@
 
 2007-02-15  Emmanuel Dreyfus <manu@netbsd.org>
 
-	* src/racoon/security.c: Missing file for SELinux
+	* src/racoon/security.c: Missing SELinux file
 
 	* configure.ac: Missing stuff for SELinux
 
@@ -460,6 +1521,20 @@
 	  deleted from payload instead of just deleting the ISAKMP SA used to
 	  protect the informational exchange.
 
+2006-12-26  Arnaud Lacombe <alc@netbsd.org>
+
+	* src/racoon/ipsec_doi.c: CID-4167: check for 'iph1->approval !=
+	  NULL'
+
+2006-12-23  Thomas Klausner <wiz@netbsd.org>
+
+	* src/racoon/racoon.conf.5: Use even more macros.
+
+	* src/racoon/racoon.conf.5: Use more macros.
+
+	* src/racoon/racoon.conf.5: Serial comma, and bump date for
+	  previous.
+
 2006-12-18  Yvan Vanhullebus <vanhu@netasq.com>
 
 	* src/racoon/crypto_openssl.c: From Joy Latten: fix a memory leak
diff --git a/Makefile b/Makefile
index 52d3187..06e2a39 100644
--- a/Makefile
+++ b/Makefile
@@ -3,6 +3,10 @@
 	-Isrc/racoon -Isrc/racoon/missing -DHAVE_CONFIG_H -lcrypto \
 	src/libipsec/pfkey.c \
 	src/libipsec/ipsec_strerror.c \
+	src/racoon/algorithm.c \
+	src/racoon/crypto_openssl.c \
+	src/racoon/genlist.c \
+	src/racoon/handler.c \
 	src/racoon/isakmp.c \
 	src/racoon/isakmp_agg.c \
 	src/racoon/isakmp_base.c \
@@ -11,21 +15,18 @@
 	src/racoon/isakmp_inf.c \
 	src/racoon/isakmp_newg.c \
 	src/racoon/isakmp_quick.c \
-	src/racoon/handler.c \
-	src/racoon/pfkey.c \
-	src/racoon/ipsec_doi.c \
-	src/racoon/oakley.c \
-	src/racoon/vendorid.c \
-	src/racoon/policy.c \
-	src/racoon/crypto_openssl.c \
-	src/racoon/algorithm.c \
-	src/racoon/proposal.c \
-	src/racoon/strnames.c \
-	src/racoon/schedule.c \
-	src/racoon/str2val.c \
-	src/racoon/genlist.c \
-	src/racoon/vmbuf.c \
-	src/racoon/sockmisc.c \
+	src/racoon/ipsec_doi-0.7.3.c \
 	src/racoon/nattraversal.c \
+	src/racoon/oakley.c \
+	src/racoon/pfkey.c \
+	src/racoon/policy.c \
+	src/racoon/proposal.c \
+	src/racoon/remoteconf.c \
+	src/racoon/schedule.c \
+	src/racoon/sockmisc.c \
+	src/racoon/str2val.c \
+	src/racoon/strnames.c \
+	src/racoon/vendorid.c \
+	src/racoon/vmbuf.c \
 	main.c \
 	setup.c
diff --git a/NEWS b/NEWS
index 29ce752..6193c65 100644
--- a/NEWS
+++ b/NEWS
@@ -1,36 +1,38 @@
 Version history:
 ----------------
+0.8	- 18 March 2011
+	o Fix authentication method ambiguity with kerberos and xauth
+	o RFC2253 compliant escaping of asn1dn identifiers (Cyrus Rahman)
+	o Local address code rewrite to speed things up
+	o Improved MIPv6 support (Arnaud Ebalard)
+	o ISAKMP SA (phase1) rekeying
+	o Improved scheduler (faster algorithm, support monotonic clock)
+	o Handle RESPONDER-LIFETIME in quick mode
+	o Handle INITIAL-CONTACT in from main mode too
+	o Rewritten event handling framework for admin port
+	o Ability to initiate IPsec SA through admin port
+	o NAT-T Original Address handling (transport mode NAT-T support)
+	o clean NAT-T - PFkey support
+	o support for multiple anonymous remoteconfs
+	o Remove various obsolete configuration options
+	o A lot of other bug fixes, performance improvements and clean ups
 
-0.7.3 - 23 August 2009
-	o Fix a remote crash and a memory leak
-	o Fixed a NAT-T flag check
-	o Some code cleanups/compilation fixes with recent gcc
-
-0.7.2 - 22 April 2009
-	o Fix a remote crash in fragmentation code
-	o Phase2 message identities are phase1 specific (Vista compatibility=
-	o Autogenerate ChangeLog from cvs metadata
-	o Fix mode config pool resizing
-	o NAT-T fixes related to purging of IPsec SA:s and retransmission
-	o Remove phase1 handler immediately if first exchange is bad
-	o A bunch of memory leak and possible memory corruptions (triggerable
-	  by bad configuration or startup parameters)
-
-0.7.1 - 23 July 2008
+0.7.1	- 23 July 2008
 	o Fixes a memory leak when invalid proposal received
 	o Some fixes in DPD
 	o do not set default gss id if xauth is used
 	o fixed hybrid enabled builds
 	o fixed compilation on FreeBSD8
 	o cleanup in network port value manipulation
-	o gets ports from SADB_X_EXT_NAT_T_[SD]PORT if present in purge_ipsec_spi()
-	o Generates a log if cert validation has been disabled by configuration
+	o Gets ports from SADB_X_EXT_NAT_T_[SD]PORT if present in
+	  purge_ipsec_spi()
+	o Generates a log if cert validation has been disabled by
+	  configuration
 	o better handling for pfkey socket read errors
 	o Fixes in yacc / bison stuff
 	o new plog() macro (reduced CPU usage when logging is disabled)
-	o Try to works better with huge SPD/SAD
+	o Try to work better with huge SPD/SAD
 	o Corrected modecfg option syntax
-	o Many other various fixes...
 
 0.7	- 09 August 2007
 	o Xauth with pre-shared key PSK
@@ -63,7 +65,7 @@
 	o ESP fragmentation in tunnel mode can be tunned (NetBSD only)
 	o racoon admin interface is exported (header and library) to 
 	  help building control programs for racoon (think GUI)
- 	o Fixed single DES support; single DES users MUST UPGRADE.
+	o Fixed single DES support; single DES users MUST UPGRADE.
 
 0.5	- 10 April 2005
 	o Rewritten buildsystem. Now completely autoconfed, automaked,
@@ -91,7 +93,7 @@
 	o All source files now have 3-clause BSD license.
 
 0.3	- 14 April 2004
-        o Fixed setkey to handle multiline commands again.
+	o Fixed setkey to handle multiline commands again.
 	o Added command 'exit' to setkey.
 	o Fixed racoon to only Warn if no CRL was found.
 	o Improved testsuite.
diff --git a/README b/README
index 2e4f90a..9623997 100644
--- a/README
+++ b/README
@@ -11,20 +11,27 @@
 IPsec-tools were ported to Linux from the KAME project 
 (http://www.kame.net) by Derek Atkins  <derek@ihtfp.com>.
 
-Currently the package is actively maintained and developed 
-by Michal Ludvig <mludvig@suse.cz>, Aidas Kasparas <a.kasparas@gmc.lt>
-Emmanuel Dreyfus <manu@netbsd.org>, VANHULLEBUS Yvan <vanhu@zeninc.net>,
-and Fred Senault <fred.letter@lacave.net>.
+Currently the package is actively maintained and developed by: 
+	Emmanuel Dreyfus <manu@netbsd.org>
+	VANHULLEBUS Yvan <vanhu@free.fr>
+	Matthew Grooms <mgrooms@shrew.net>
+	Timo Teräs <timo.teras@iki.fi>
 
 Sources can be found at the IPsec-Tools home page at:
 	http://ipsec-tools.sourceforge.net/
 
+And CVS repository is hosted at NetBSD tree:
+	cvs -danoncvs@anoncvs.netbsd.org:/cvsroot co ipsec-tools
+
+Bug reports and project wiki is located at:
+	https://trac.ipsec-tools.net/
+
 Please report any problems to the mailing list:
 	ipsec-tools-devel@lists.sourceforge.net
 	ipsec-tools-users@lists.sourceforge.net
 
 You can also browse the list archive:
-	http://sourceforge.net/mailarchive/forum.php?forum_id=32000
+	http://sf.net/mailarchive/forum.php?forum_name=ipsec-tools-devel
 
 Credits:
 	IHTFP Consulting, see http://www.ihtfp.com/
diff --git a/ThirdPartyProject.prop b/ThirdPartyProject.prop
index 6ec7936..9af3ed7 100644
--- a/ThirdPartyProject.prop
+++ b/ThirdPartyProject.prop
@@ -1,7 +1,7 @@
-# Copyright 2010 Google Inc. All Rights Reserved.
-#Fri Jul 16 10:03:09 PDT 2010
-currentVersion=0.7.3
-version=0.7.3 (unreleased)
+# Copyright 2011 Google Inc. All Rights Reserved.
+#Tue Jul  5 19:05:36 PDT 2011
+currentVersion=0.8.0
+version=0.8.0
 isNative=true
 name=ipsec-tools
 keywords=ipsec-tools
diff --git a/config.h b/config.h
index fd560d4..87099b5 100644
--- a/config.h
+++ b/config.h
@@ -21,4 +21,6 @@
 #define HAVE_SYS_TIME_H 1
 #define HAVE_UNISTD_H
 
+#define RETSIGTYPE void
+
 #define ANDROID_PATCHED
diff --git a/main.c b/main.c
index a123afb..c10e32b 100644
--- a/main.c
+++ b/main.c
@@ -16,56 +16,40 @@
 
 #include <stdio.h>
 #include <stdlib.h>
-#include <string.h>
 #include <stdarg.h>
 #include <signal.h>
+#include <poll.h>
+
+#ifdef ANDROID_CHANGES
 #include <unistd.h>
 #include <sys/types.h>
 #include <sys/socket.h>
-#include <sys/select.h>
-
-#ifdef ANDROID_CHANGES
-#include <sys/ioctl.h>
-#include <linux/if.h>
 #include <android/log.h>
 #include <cutils/sockets.h>
 #include <private/android_filesystem_config.h>
-#include "keystore_get.h"
 #endif
 
 #include "config.h"
-#include "libpfkey.h"
 #include "gcmalloc.h"
-#include "vmbuf.h"
-#include "crypto_openssl.h"
-#include "oakley.h"
-#include "pfkey.h"
+#include "session.h"
 #include "schedule.h"
-#include "isakmp_var.h"
-#include "nattraversal.h"
-#include "localconf.h"
-#include "sockmisc.h"
-#include "grabmyaddr.h"
 #include "plog.h"
-#include "admin.h"
-#include "privsep.h"
-#include "misc.h"
 
 #ifdef ANDROID_CHANGES
 
-static int get_control_and_arguments(int *argc, char ***argv)
+static void android_get_arguments(int *argc, char ***argv)
 {
     static char *args[32];
     int control;
     int i;
 
     if ((i = android_get_control_socket("racoon")) == -1) {
-        return -1;
+        return;
     }
     do_plog(LLV_DEBUG, "Waiting for control socket");
     if (listen(i, 1) == -1 || (control = accept(i, NULL, 0)) == -1) {
         do_plog(LLV_ERROR, "Cannot get control socket");
-        exit(-1);
+        exit(1);
     }
     close(i);
 
@@ -75,7 +59,7 @@
         if (recv(control, &bytes[0], 1, 0) != 1
             || recv(control, &bytes[1], 1, 0) != 1) {
             do_plog(LLV_ERROR, "Cannot get argument length");
-            exit(-1);
+            exit(1);
         } else {
             int length = bytes[0] << 8 | bytes[1];
             int offset = 0;
@@ -90,7 +74,7 @@
                     offset += n;
                 } else {
                     do_plog(LLV_ERROR, "Cannot get argument value");
-                    exit(-1);
+                    exit(1);
                 }
             }
             args[i][length] = 0;
@@ -100,38 +84,19 @@
 
     *argc = i;
     *argv = args;
-    return control;
-}
-
-static void bind_interface()
-{
-    struct ifreq ifreqs[64];
-    struct ifconf ifconf = {.ifc_len = sizeof(ifreqs), .ifc_req = ifreqs};
-    struct myaddrs *p = lcconf->myaddrs;
-
-    if (ioctl(p->sock, SIOCGIFCONF, &ifconf) == -1) {
-        do_plog(LLV_WARNING, "Cannot list interfaces");
-        return;
-    }
-
-    while (p) {
-        int i = ifconf.ifc_len / sizeof(struct ifreq) - 1;
-        while (i >= 0 && cmpsaddrwop(p->addr, &ifreqs[i].ifr_addr)) {
-            --i;
-        }
-        if (i < 0 || setsockopt(p->sock, SOL_SOCKET, SO_BINDTODEVICE,
-                                ifreqs[i].ifr_name, IFNAMSIZ) == -1) {
-            do_plog(LLV_WARNING, "Cannot bind socket %d to proper interface",
-                    p->sock);
-        }
-        p = p->next;
-    }
+    close(control);
 }
 
 #endif
 
 extern void setup(int argc, char **argv);
-int f_local = 0;
+
+static int monitor_count;
+static struct {
+    int (*callback)(void *ctx, int fd);
+    void *ctx;
+} monitors[10];
+static struct pollfd pollfds[10];
 
 static void terminate(int signal)
 {
@@ -145,69 +110,60 @@
 
 int main(int argc, char **argv)
 {
-    fd_set fdset;
-    int fdset_size;
-    struct myaddrs *p;
-#ifdef ANDROID_CHANGES
-    int control = get_control_and_arguments(&argc, &argv);
-#endif
+    do_plog(LLV_INFO, "ipsec-tools 0.8.0 (http://ipsec-tools.sf.net)\n");
 
     signal(SIGHUP, terminate);
     signal(SIGINT, terminate);
     signal(SIGTERM, terminate);
     signal(SIGPIPE, SIG_IGN);
-    setup(argc, argv);
-
-    do_plog(LLV_INFO, "ipsec-tools 0.7.3 (http://ipsec-tools.sf.net)\n");
     atexit(terminated);
 
-    eay_init();
-    oakley_dhinit();
-    compute_vendorids();
-    sched_init();
-
-    if (pfkey_init() < 0 || isakmp_init() < 0) {
-        exit(1);
-    }
-
-#ifdef ENABLE_NATT
-    natt_keepalive_init();
-#endif
-
 #ifdef ANDROID_CHANGES
-    bind_interface();
-    setuid(AID_VPN);
+/*    setuid(AID_VPN); */
+    android_get_arguments(&argc, &argv);
 #endif
-
-    FD_ZERO(&fdset);
-    FD_SET(lcconf->sock_pfkey, &fdset);
-    fdset_size = lcconf->sock_pfkey;
-    for (p = lcconf->myaddrs; p; p = p->next) {
-        FD_SET(p->sock, &fdset);
-        if (fdset_size < p->sock) {
-            fdset_size = p->sock;
-        }
-    }
-    ++fdset_size;
+    setup(argc, argv);
 
     while (1) {
-        fd_set readset = fdset;
-        struct timeval *timeout = schedular();
-        if (select(fdset_size, &readset, NULL, NULL, timeout) < 0) {
-            exit(1);
-        }
-        if (FD_ISSET(lcconf->sock_pfkey, &readset)) {
-            pfkey_handler();
-        }
-        for (p = lcconf->myaddrs; p; p = p->next) {
-            if (FD_ISSET(p->sock, &readset)) {
-                isakmp_handler(p->sock);
+        struct timeval *tv = schedular();
+        int timeout = tv->tv_sec * 1000 + tv->tv_usec / 1000 + 1;
+
+        if (poll(pollfds, monitor_count, timeout) > 0) {
+            int i;
+            for (i = 0; i < monitor_count; ++i) {
+                if (pollfds[i].revents & POLLHUP) {
+                    do_plog(LLV_ERROR, "fd %d is closed\n", pollfds[i].fd);
+                    exit(1);
+                }
+                if (pollfds[i].revents & POLLIN) {
+                    monitors[i].callback(monitors[i].ctx, pollfds[i].fd);
+                }
             }
         }
     }
     return 0;
 }
 
+/* session.h */
+
+void monitor_fd(int fd, int (*callback)(void *, int), void *ctx, int priority)
+{
+    if (fd < 0 || monitor_count == 10) {
+        do_plog(LLV_ERROR, "Cannot monitor fd");
+        exit(1);
+    }
+    monitors[monitor_count].callback = callback;
+    monitors[monitor_count].ctx = ctx;
+    pollfds[monitor_count].fd = fd;
+    pollfds[monitor_count].events = POLLIN;
+    ++monitor_count;
+}
+
+void unmonitor_fd(int fd)
+{
+    exit(1);
+}
+
 /* plog.h */
 
 void do_plog(int level, char *format, ...)
@@ -245,54 +201,3 @@
     }
     return output;
 }
-
-/* privsep.h */
-
-int privsep_pfkey_open()
-{
-    return pfkey_open();
-}
-
-void privsep_pfkey_close(int key)
-{
-    pfkey_close(key);
-}
-
-vchar_t *privsep_eay_get_pkcs1privkey(char *file)
-{
-    return eay_get_pkcs1privkey(file);
-}
-
-vchar_t *privsep_getpsk(const char *key, int size)
-{
-    vchar_t *p = NULL;
-    if (key && (p = vmalloc(size)) != NULL) {
-        memcpy(p->v, key, p->l);
-    }
-    return p;
-}
-
-int privsep_script_exec(char *script, int name, char * const *environ)
-{
-    return 0;
-}
-
-/* grabmyaddr.h */
-
-int getsockmyaddr(struct sockaddr *addr)
-{
-    struct myaddrs *p;
-    for (p = lcconf->myaddrs; p; p = p->next) {
-        if (cmpsaddrstrict(addr, p->addr) == 0) {
-            return p->sock;
-        }
-    }
-    return -1;
-}
-
-/* misc.h */
-
-int racoon_hexdump(void *data, size_t length)
-{
-    return 0;
-}
diff --git a/setup.c b/setup.c
index 8bbbf81..eb575ce 100644
--- a/setup.c
+++ b/setup.c
@@ -17,22 +17,29 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <unistd.h>
 #include <sys/types.h>
 #include <sys/socket.h>
 #include <netinet/in.h>
 #include <netinet/ip.h>
 #include <netdb.h>
+#include <fcntl.h>
 
 #include "config.h"
+#include "gcmalloc.h"
 #include "libpfkey.h"
 #include "var.h"
 #include "isakmp_var.h"
 #include "isakmp.h"
 #include "vmbuf.h"
+#include "crypto_openssl.h"
 #include "oakley.h"
 #include "ipsec_doi.h"
 #include "algorithm.h"
 #include "vendorid.h"
+#include "schedule.h"
+#include "pfkey.h"
+#include "nattraversal.h"
 #include "proposal.h"
 #include "sainfo.h"
 #include "localconf.h"
@@ -42,125 +49,24 @@
 #include "plog.h"
 #include "admin.h"
 #include "privsep.h"
+#include "misc.h"
 
-static struct myaddrs myaddrs[2];
-static struct etypes main_mode = { .type = ISAKMP_ETYPE_IDENT };
 static struct localconf localconf;
-static struct remoteconf remoteconf;
 static struct sainfo sainfo;
 static char *pre_shared_key;
-static struct sockaddr target;
+
+static char *interface;
+static struct sockaddr *target;
+static struct {
+    struct sockaddr *addr;
+    int fd;
+} myaddrs[2];
 
 struct localconf *lcconf = &localconf;
 char *script_names[SCRIPT_MAX + 1];
+int f_local = 0;
 
-static void set_default()
-{
-    localconf.myaddrs = &myaddrs[0];
-    localconf.port_isakmp = PORT_ISAKMP;
-    localconf.port_isakmp_natt = PORT_ISAKMP_NATT;
-    localconf.default_af = AF_INET;
-    localconf.pad_random = LC_DEFAULT_PAD_RANDOM;
-    localconf.pad_randomlen = LC_DEFAULT_PAD_RANDOM;
-    localconf.pad_strict = LC_DEFAULT_PAD_STRICT;
-    localconf.pad_excltail = LC_DEFAULT_PAD_EXCLTAIL;
-    localconf.retry_counter = 10;
-    localconf.retry_interval = 3;
-    localconf.count_persend = LC_DEFAULT_COUNT_PERSEND;
-    localconf.secret_size = LC_DEFAULT_SECRETSIZE;
-    localconf.retry_checkph1 = LC_DEFAULT_RETRY_CHECKPH1;
-    localconf.wait_ph2complete = LC_DEFAULT_WAIT_PH2COMPLETE;
-    localconf.natt_ka_interval = LC_DEFAULT_NATT_KA_INTERVAL;
-    localconf.pathinfo[LC_PATHTYPE_CERT] = "/";
-
-    remoteconf.etypes = &main_mode;
-    remoteconf.doitype = IPSEC_DOI;
-    remoteconf.sittype = IPSECDOI_SIT_IDENTITY_ONLY;
-    remoteconf.idvtype = IDTYPE_ADDRESS;
-    remoteconf.nonce_size = DEFAULT_NONCE_SIZE;
-
-    remoteconf.ike_frag = TRUE;
-    remoteconf.esp_frag = IP_MAXPACKET;
-    remoteconf.ini_contact = TRUE;
-    remoteconf.pcheck_level = PROP_CHECK_OBEY;
-    remoteconf.verify_identifier = FALSE;
-    remoteconf.verify_cert = TRUE;
-    remoteconf.getcert_method = ISAKMP_GETCERT_PAYLOAD;
-    remoteconf.certtype = ISAKMP_CERT_X509SIGN;
-    remoteconf.getcacert_method = ISAKMP_GETCERT_LOCALFILE;
-    remoteconf.cacerttype = ISAKMP_CERT_X509SIGN;
-    remoteconf.send_cert = TRUE;
-    remoteconf.send_cr = TRUE;
-    remoteconf.gen_policy = TRUE;
-    remoteconf.retry_counter = LC_DEFAULT_RETRY_COUNTER;
-    remoteconf.retry_interval = LC_DEFAULT_RETRY_INTERVAL;
-    remoteconf.nat_traversal = TRUE;
-    remoteconf.rsa_private = genlist_init();
-    remoteconf.rsa_public = genlist_init();
-    remoteconf.dpd = TRUE;
-    remoteconf.dpd_interval = 0;
-    remoteconf.dpd_retry = 5;
-    remoteconf.dpd_maxfails = 5;
-
-    sainfo.lifetime = IPSECDOI_ATTR_SA_LD_SEC_DEFAULT;
-    sainfo.lifebyte = IPSECDOI_ATTR_SA_LD_KB_MAX;
-}
-
-static void set_address(char *server, char *port)
-{
-    struct addrinfo hints = {
-        .ai_flags = AI_NUMERICSERV,
-#ifndef INET6
-        .ai_family = AF_INET,
-#else
-        .ai_family = AF_UNSPEC,
-#endif
-        .ai_socktype = SOCK_DGRAM,
-    };
-    struct addrinfo *r;
-
-    if (getaddrinfo(server, port, &hints, &r) != 0) {
-        do_plog(LLV_ERROR, "Cannot resolve server address\n");
-        exit(1);
-    }
-    if (r->ai_next) {
-        do_plog(LLV_WARNING, "Multiple server address found\n");
-    }
-    remoteconf.remote = dupsaddr(r->ai_addr);
-    freeaddrinfo(r);
-
-    myaddrs[0].addr = getlocaladdr(remoteconf.remote);
-    if (!myaddrs[0].addr) {
-        do_plog(LLV_ERROR, "Cannot get local address\n");
-        exit(1);
-    }
-}
-
-static void add_proposal(int auth, int hash, int encryption, int length)
-{
-    struct isakmpsa *p = calloc(1, sizeof(struct isakmpsa));
-    p->prop_no = 1;
-    p->lifetime = OAKLEY_ATTR_SA_LD_SEC_DEFAULT;
-    p->enctype = encryption;
-    p->encklen = length;
-    p->authmethod = auth;
-    p->hashtype = hash;
-    p->dh_group = OAKLEY_ATTR_GRP_DESC_MODP1024;
-    p->vendorid = VENDORID_UNKNOWN;
-    p->rmconf = &remoteconf;
-
-    if (!remoteconf.proposal) {
-      p->trns_no = 1;
-      remoteconf.proposal = p;
-    } else {
-        struct isakmpsa *q = remoteconf.proposal;
-        while (q->next) {
-            q = q->next;
-        }
-        p->trns_no = q->trns_no + 1;
-        q->next = p;
-    }
-}
+/*****************************************************************************/
 
 static void add_sainfo_algorithm(int class, int algorithm, int length)
 {
@@ -179,11 +85,71 @@
     }
 }
 
-static int match(struct sadb_address *address)
+static void set_globals(char *interfaze, char *server)
+{
+    struct addrinfo hints = {
+        .ai_flags = AI_NUMERICSERV,
+#ifndef INET6
+        .ai_family = AF_INET,
+#else
+        .ai_family = AF_UNSPEC,
+#endif
+        .ai_socktype = SOCK_DGRAM,
+    };
+    struct addrinfo *info;
+
+    if (getaddrinfo(server, "80", &hints, &info) != 0) {
+        do_plog(LLV_ERROR, "Cannot resolve address: %s\n", server);
+        exit(1);
+    }
+    if (info->ai_next) {
+        do_plog(LLV_WARNING, "Found multiple addresses. Use the first one.\n");
+    }
+    target = dupsaddr(info->ai_addr);
+    freeaddrinfo(info);
+
+    interface = interfaze;
+    myaddrs[0].addr = getlocaladdr(target);
+    if (!myaddrs[0].addr) {
+        do_plog(LLV_ERROR, "Cannot get local address\n");
+        exit(1);
+    }
+    set_port(target, 0);
+    set_port(myaddrs[0].addr, 0);
+    myaddrs[0].fd = -1;
+    myaddrs[1].addr = dupsaddr(myaddrs[0].addr);
+    myaddrs[1].fd = -1;
+
+    localconf.port_isakmp = PORT_ISAKMP;
+    localconf.port_isakmp_natt = PORT_ISAKMP_NATT;
+    localconf.default_af = AF_INET;
+    localconf.pad_random = LC_DEFAULT_PAD_RANDOM;
+    localconf.pad_randomlen = LC_DEFAULT_PAD_RANDOM;
+    localconf.pad_strict = LC_DEFAULT_PAD_STRICT;
+    localconf.pad_excltail = LC_DEFAULT_PAD_EXCLTAIL;
+    localconf.retry_counter = 10;
+    localconf.retry_interval = 3;
+    localconf.count_persend = LC_DEFAULT_COUNT_PERSEND;
+    localconf.secret_size = LC_DEFAULT_SECRETSIZE;
+    localconf.retry_checkph1 = LC_DEFAULT_RETRY_CHECKPH1;
+    localconf.wait_ph2complete = LC_DEFAULT_WAIT_PH2COMPLETE;
+    localconf.natt_ka_interval = LC_DEFAULT_NATT_KA_INTERVAL;
+
+    sainfo.lifetime = IPSECDOI_ATTR_SA_LD_SEC_DEFAULT;
+    sainfo.lifebyte = IPSECDOI_ATTR_SA_LD_KB_MAX;
+    add_sainfo_algorithm(algclass_ipsec_auth, IPSECDOI_ATTR_AUTH_HMAC_SHA1, 0);
+    add_sainfo_algorithm(algclass_ipsec_auth, IPSECDOI_ATTR_AUTH_HMAC_MD5, 0);
+    add_sainfo_algorithm(algclass_ipsec_enc, IPSECDOI_ESP_3DES, 0);
+    add_sainfo_algorithm(algclass_ipsec_enc, IPSECDOI_ESP_DES, 0);
+    add_sainfo_algorithm(algclass_ipsec_enc, IPSECDOI_ESP_AES, 128);
+}
+
+/*****************************************************************************/
+
+static int policy_match(struct sadb_address *address)
 {
     if (address) {
-        struct sockaddr *source = PFKEY_ADDR_SADDR(address);
-        return !cmpsaddrwop(source, &target);
+        return cmpsaddr(PFKEY_ADDR_SADDR(address), target) < CMPSADDR_MISMATCH;
     }
     return 0;
 }
@@ -213,8 +179,8 @@
         if (p->sadb_msg_errno || pfkey_align(p, q) || pfkey_check(q)) {
             continue;
         }
-        if (match((struct sadb_address *)q[SADB_EXT_ADDRESS_SRC]) ||
-            match((struct sadb_address *)q[SADB_EXT_ADDRESS_DST])) {
+        if (policy_match((struct sadb_address *)q[SADB_EXT_ADDRESS_SRC]) ||
+            policy_match((struct sadb_address *)q[SADB_EXT_ADDRESS_DST])) {
             p->sadb_msg_type = (p->sadb_msg_type == SADB_DUMP) ?
                                SADB_DELETE : SADB_X_SPDDELETE;
             p->sadb_msg_reserved = 0;
@@ -227,34 +193,68 @@
 }
 
 /* flush; spdflush;
- * spdadd local remote udp -P out ipsec esp/transport//require; */
-static void spdadd(struct sockaddr *local, struct sockaddr *remote)
+ * spdadd src dst protocol -P out ipsec esp/transport//require; OR
+ * spdadd src any protocol -P out ipsec esp/tunnel/local-remote/require; */
+static void spdadd(struct sockaddr *src, struct sockaddr *dst,
+        int protocol, struct sockaddr *local, struct sockaddr *remote)
 {
     struct __attribute__((packed)) {
         struct sadb_x_policy p;
         struct sadb_x_ipsecrequest q;
+        char addresses[sizeof(struct sockaddr_storage) * 2];
     } policy;
-    int prefix = (local->sa_family == AF_INET) ? sizeof(struct in_addr) * 8 :
-               sizeof(struct in6_addr) * 8;
-    int key = pfkey_open();
 
+    struct sockaddr_storage any = {
+#ifndef __linux__
+        .ss_len = src->sa_len,
+#endif
+        .ss_family = src->sa_family,
+    };
+
+    int src_prefix = (src->sa_family == AF_INET) ? 32 : 128;
+    int dst_prefix = src_prefix;
+    int length = 0;
+    int key;
+
+    /* Fill default values. */
     memset(&policy, 0, sizeof(policy));
-    policy.p.sadb_x_policy_len = PFKEY_UNIT64(sizeof(policy));
     policy.p.sadb_x_policy_exttype = SADB_X_EXT_POLICY;
     policy.p.sadb_x_policy_type = IPSEC_POLICY_IPSEC;
     policy.p.sadb_x_policy_dir = IPSEC_DIR_OUTBOUND;
 #ifdef HAVE_PFKEY_POLICY_PRIORITY
     policy.p.sadb_x_policy_priority = PRIORITY_DEFAULT;
 #endif
-    policy.q.sadb_x_ipsecrequest_len = sizeof(struct sadb_x_ipsecrequest);
     policy.q.sadb_x_ipsecrequest_proto = IPPROTO_ESP;
     policy.q.sadb_x_ipsecrequest_mode = IPSEC_MODE_TRANSPORT;
     policy.q.sadb_x_ipsecrequest_level = IPSEC_LEVEL_REQUIRE;
 
-    target = *remote;
+    /* Deal with tunnel mode. */
+    if (!dst) {
+        policy.q.sadb_x_ipsecrequest_mode = IPSEC_MODE_TUNNEL;
+        dst = (struct sockaddr *)&any;
+        dst_prefix = 0;
+
+        length = sysdep_sa_len(local);
+        memcpy(policy.addresses, local, length);
+        memcpy(&policy.addresses[length], remote, length);
+        length += length;
+
+        /* Use the source address to flush policies. */
+        racoon_free(target);
+        target = dupsaddr(src);
+    }
+
+    /* Fix lengths. */
+    length += sizeof(policy.q);
+    policy.q.sadb_x_ipsecrequest_len = length;
+    length += sizeof(policy.p);
+    policy.p.sadb_x_policy_len = PFKEY_UNIT64(length);
+
+    /* Always do a flush before adding the new policy. */
     flush();
-    if (pfkey_send_spdadd(key, local, prefix, remote, prefix, IPPROTO_UDP,
-                          (caddr_t)&policy, sizeof(policy), 0) <= 0) {
+    key = pfkey_open();
+    if (pfkey_send_spdadd(key, src, src_prefix, dst, dst_prefix, protocol,
+            (caddr_t)&policy, length, 0) <= 0) {
         do_plog(LLV_ERROR, "Cannot initialize SAD and SPD\n");
         exit(1);
     }
@@ -262,66 +262,135 @@
     atexit(flush);
 }
 
+/*****************************************************************************/
+
+static void add_proposal(struct remoteconf *remoteconf,
+        int auth, int hash, int encryption, int length)
+{
+    struct isakmpsa *p = racoon_calloc(1, sizeof(struct isakmpsa));
+    p->prop_no = 1;
+    p->lifetime = OAKLEY_ATTR_SA_LD_SEC_DEFAULT;
+    p->enctype = encryption;
+    p->encklen = length;
+    p->authmethod = auth;
+    p->hashtype = hash;
+    p->dh_group = OAKLEY_ATTR_GRP_DESC_MODP1024;
+    p->vendorid = VENDORID_UNKNOWN;
+
+    if (!remoteconf->proposal) {
+      p->trns_no = 1;
+      remoteconf->proposal = p;
+    } else {
+        struct isakmpsa *q = remoteconf->proposal;
+        while (q->next) {
+            q = q->next;
+        }
+        p->trns_no = q->trns_no + 1;
+        q->next = p;
+    }
+}
+
 void setup(int argc, char **argv)
 {
+    struct remoteconf *remoteconf;
     int auth;
-    if (argc != 4 && argc != 6) {
-        printf("Usage: %s server port pre-shared-key\n"
-               "       %s server port my-private-key my-cert ca-cert\n",
-               argv[0], argv[0]);
-        exit(0);
-    }
-    set_default();
 
-    /* Set local address and remote address. */
-    set_address(argv[1], argv[2]);
+    if (argc > 2) {
+        set_globals(argv[1], argv[2]);
 
-    /* Initialize SAD and SPD. */
-    spdadd(myaddrs[0].addr, remoteconf.remote);
-
-    /* Set local port and remote port. */
-    set_port(myaddrs[0].addr, localconf.port_isakmp);
-    set_port(remoteconf.remote, localconf.port_isakmp);
+        /* Initialize everything else. */
+        eay_init();
+        initrmconf();
+        oakley_dhinit();
+        compute_vendorids();
+        sched_init();
+        if (pfkey_init() < 0 || isakmp_init() < 0) {
+            exit(1);
+        }
 #ifdef ENABLE_NATT
-    myaddrs[0].next = &myaddrs[1];
-    myaddrs[1].addr = dupsaddr(myaddrs[0].addr);
-    set_port(myaddrs[1].addr, localconf.port_isakmp_natt);
-    myaddrs[1].udp_encap = 1;
+        natt_keepalive_init();
 #endif
 
-    /* Set authentication method. */
-    if (argc == 4) {
-        pre_shared_key = argv[3];
-        auth = OAKLEY_ATTR_AUTH_METHOD_PSKEY;
-    } else {
-        remoteconf.idvtype = IDTYPE_ASN1DN;
-        remoteconf.myprivfile = argv[3];
-        remoteconf.mycertfile = argv[4];
-        remoteconf.cacertfile = argv[5];
-        auth = OAKLEY_ATTR_AUTH_METHOD_RSASIG;
+        /* Create remote configuration. */
+        remoteconf = newrmconf();
+        remoteconf->etypes = racoon_calloc(1, sizeof(struct etypes));
+        remoteconf->etypes->type = ISAKMP_ETYPE_IDENT;
+        remoteconf->ike_frag = TRUE;
+        remoteconf->pcheck_level = PROP_CHECK_OBEY;
+        remoteconf->gen_policy = TRUE;
+        remoteconf->nat_traversal = TRUE;
+        remoteconf->remote = dupsaddr(target);
+        set_port(remoteconf->remote, localconf.port_isakmp);
     }
 
-    /* Create proposals. */
-    add_proposal(auth, OAKLEY_ATTR_HASH_ALG_SHA, OAKLEY_ATTR_ENC_ALG_3DES, 0);
-    add_proposal(auth, OAKLEY_ATTR_HASH_ALG_MD5, OAKLEY_ATTR_ENC_ALG_3DES, 0);
-    add_proposal(auth, OAKLEY_ATTR_HASH_ALG_SHA, OAKLEY_ATTR_ENC_ALG_DES, 0);
-    add_proposal(auth, OAKLEY_ATTR_HASH_ALG_MD5, OAKLEY_ATTR_ENC_ALG_DES, 0);
-    add_proposal(auth, OAKLEY_ATTR_HASH_ALG_SHA, OAKLEY_ATTR_ENC_ALG_AES, 128);
-    add_proposal(auth, OAKLEY_ATTR_HASH_ALG_MD5, OAKLEY_ATTR_ENC_ALG_AES, 128);
+    /* Set authentication method and credentials. */
+    if (argc == 6 && !strcmp(argv[3], "udppsk")) {
+        set_port(target, atoi(argv[4]));
+        spdadd(myaddrs[0].addr, target, IPPROTO_UDP, NULL, NULL);
+        pre_shared_key = argv[5];
+        remoteconf->idvtype = IDTYPE_ADDRESS;
+        auth = OAKLEY_ATTR_AUTH_METHOD_PSKEY;
+    } else if (argc == 8 && !strcmp(argv[3], "udprsa")) {
+        set_port(target, atoi(argv[4]));
+        spdadd(myaddrs[0].addr, target, IPPROTO_UDP, NULL, NULL);
+        remoteconf->myprivfile = argv[5];
+        remoteconf->mycertfile = argv[6];
+        remoteconf->cacertfile = argv[7];
+        remoteconf->idvtype = IDTYPE_ASN1DN;
+        auth = OAKLEY_ATTR_AUTH_METHOD_RSASIG;
+    } else {
+        printf("Usage: %s <interface> <server> [...],\n"
+               "    where [...] can be:\n"
+               "    udppsk <port> <pre-shared-key>\n"
+               "    udprsa <port> <my-private-key> <my-cert> <ca-cert>\n",
+               argv[0]);
+        exit(0);
+    }
 
-    /* Create sainfo algorithms. */
-    add_sainfo_algorithm(algclass_ipsec_auth, IPSECDOI_ATTR_AUTH_HMAC_SHA1, 0);
-    add_sainfo_algorithm(algclass_ipsec_auth, IPSECDOI_ATTR_AUTH_HMAC_MD5, 0);
-    add_sainfo_algorithm(algclass_ipsec_enc, IPSECDOI_ESP_3DES, 0);
-    add_sainfo_algorithm(algclass_ipsec_enc, IPSECDOI_ESP_DES, 0);
-    add_sainfo_algorithm(algclass_ipsec_enc, IPSECDOI_ESP_AES, 128);
+    /* Add proposals. */
+    add_proposal(remoteconf, auth,
+            OAKLEY_ATTR_HASH_ALG_SHA, OAKLEY_ATTR_ENC_ALG_3DES, 0);
+    add_proposal(remoteconf, auth,
+            OAKLEY_ATTR_HASH_ALG_MD5, OAKLEY_ATTR_ENC_ALG_3DES, 0);
+    add_proposal(remoteconf, auth,
+            OAKLEY_ATTR_HASH_ALG_SHA, OAKLEY_ATTR_ENC_ALG_DES, 0);
+    add_proposal(remoteconf, auth,
+            OAKLEY_ATTR_HASH_ALG_MD5, OAKLEY_ATTR_ENC_ALG_DES, 0);
+    add_proposal(remoteconf, auth,
+            OAKLEY_ATTR_HASH_ALG_SHA, OAKLEY_ATTR_ENC_ALG_AES, 128);
+    add_proposal(remoteconf, auth,
+            OAKLEY_ATTR_HASH_ALG_MD5, OAKLEY_ATTR_ENC_ALG_AES, 128);
+
+    /* Install remote configuration. */
+    insrmconf(remoteconf);
+
+    /* Create ISAKMP sockets. */
+    set_port(myaddrs[0].addr, localconf.port_isakmp);
+    myaddrs[0].fd = isakmp_open(myaddrs[0].addr, FALSE);
+    if (myaddrs[0].fd == -1) {
+        do_plog(LLV_ERROR, "Cannot create ISAKMP socket");
+        exit(1);
+    }
+#ifdef ENABLE_NATT
+    set_port(myaddrs[1].addr, localconf.port_isakmp_natt);
+    myaddrs[1].fd = isakmp_open(myaddrs[1].addr, TRUE);
+    if (myaddrs[1].fd == -1) {
+        do_plog(LLV_WARNING, "Cannot create ISAKMP socket for NAT-T");
+    }
+#endif
 }
 
+/*****************************************************************************/
+
 /* localconf.h */
 
 vchar_t *getpskbyaddr(struct sockaddr *addr)
 {
-    return privsep_getpsk(pre_shared_key, strlen(pre_shared_key));
+    vchar_t *p = NULL;
+    if (pre_shared_key && (p = vmalloc(strlen(pre_shared_key)))) {
+        memcpy(p->v, pre_shared_key, p->l);
+    }
+    return p;
 }
 
 vchar_t *getpskbyname(vchar_t *name)
@@ -334,56 +403,10 @@
     strncpy(path, name, length);
 }
 
-/* remoteconf.h */
-
-struct remoteconf *getrmconf(struct sockaddr *addr)
-{
-    return cmpsaddrwop(addr, remoteconf.remote) ? NULL : &remoteconf;
-}
-
-struct isakmpsa *dupisakmpsa(struct isakmpsa *sa)
-{
-    struct isakmpsa *p = NULL;
-    if (sa && (p = malloc(sizeof(struct isakmpsa)))) {
-        *p = *sa;
-        p->next = NULL;
-        if (sa->dhgrp) {
-            oakley_setdhgroup(sa->dh_group, &p->dhgrp);
-        }
-    }
-    return p;
-}
-
-void delisakmpsa(struct isakmpsa *sa)
-{
-    while (sa) {
-        struct isakmpsa *p = sa->next;
-        if (sa->dhgrp) {
-            oakley_dhgrp_free(sa->dhgrp);
-        }
-        free(sa);
-        sa = p;
-    }
-}
-
-struct etypes *check_etypeok(struct remoteconf *rmconf, uint8_t etype)
-{
-    struct etypes *p = rmconf->etypes;
-    while (p && etype != p->type) {
-        p = p->next;
-    }
-    return p;
-}
-
-struct remoteconf *foreachrmconf(rmconf_func_t function, void *data)
-{
-    return (*function)(&remoteconf, data);
-}
-
 /* sainfo.h */
 
 struct sainfo *getsainfo(const vchar_t *src, const vchar_t *dst,
-                         const vchar_t *peer, int remoteid)
+        const vchar_t *peer, const vchar_t *client, uint32_t remoteid)
 {
     return &sainfo;
 }
@@ -392,3 +415,63 @@
 {
     return "*";
 }
+
+/* privsep.h */
+
+int privsep_socket(int domain, int type, int protocol)
+{
+    int fd = socket(domain, type, protocol);
+    if ((domain == AF_INET || domain == AF_INET6) && setsockopt(
+            fd, SOL_SOCKET, SO_BINDTODEVICE, interface, strlen(interface))) {
+        do_plog(LLV_WARNING, "Cannot bind socket to %s", interface);
+    }
+    return fd;
+}
+
+int privsep_bind(int fd, const struct sockaddr *addr, socklen_t addrlen)
+{
+    return bind(fd, addr, addrlen);
+}
+
+vchar_t *privsep_eay_get_pkcs1privkey(char *file)
+{
+    return eay_get_pkcs1privkey(file);
+}
+
+int privsep_script_exec(char *script, int name, char * const *environ)
+{
+    return 0;
+}
+
+/* grabmyaddr.h */
+
+int myaddr_getsport(struct sockaddr *addr)
+{
+    return 0;
+}
+
+int myaddr_getfd(struct sockaddr *addr)
+{
+#ifdef ENABLE_NATT
+    if (myaddrs[1].fd != -1 &&
+            cmpsaddr(addr, myaddrs[1].addr) == CMPSADDR_MATCH) {
+        return myaddrs[1].fd;
+    }
+#endif
+    if (cmpsaddr(addr, myaddrs[0].addr) < CMPSADDR_MISMATCH) {
+        return myaddrs[0].fd;
+    }
+    return -1;
+}
+
+/* misc.h */
+
+int racoon_hexdump(void *data, size_t length)
+{
+    return 0;
+}
+
+void close_on_exec(int fd)
+{
+    fcntl(fd, F_SETFD, FD_CLOEXEC);
+}
diff --git a/src/include-glibc/Makefile.in b/src/include-glibc/Makefile.in
index 842728e..d92fdf6 100644
--- a/src/include-glibc/Makefile.in
+++ b/src/include-glibc/Makefile.in
@@ -1,8 +1,9 @@
-# Makefile.in generated by automake 1.10.1 from Makefile.am.
+# Makefile.in generated by automake 1.11.1 from Makefile.am.
 # @configure_input@
 
 # Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005, 2006, 2007, 2008  Free Software Foundation, Inc.
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009  Free Software Foundation,
+# Inc.
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
 # with or without modifications, as long as this notice is preserved.
@@ -15,8 +16,9 @@
 @SET_MAKE@
 VPATH = @srcdir@
 pkgdatadir = $(datadir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
 pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
 am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
 install_sh_DATA = $(install_sh) -c -m 644
 install_sh_PROGRAM = $(install_sh) -c
@@ -41,6 +43,7 @@
 mkinstalldirs = $(install_sh) -d
 CONFIG_HEADER = $(top_builddir)/config.h
 CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
 SOURCES =
 DIST_SOURCES =
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
@@ -58,23 +61,18 @@
 CPP = @CPP@
 CPPFLAGS = @CPPFLAGS@
 CRYPTOBJS = @CRYPTOBJS@
-CXX = @CXX@
-CXXCPP = @CXXCPP@
-CXXDEPMODE = @CXXDEPMODE@
-CXXFLAGS = @CXXFLAGS@
 CYGPATH_W = @CYGPATH_W@
 DEFS = @DEFS@
 DEPDIR = @DEPDIR@
 DSYMUTIL = @DSYMUTIL@
-ECHO = @ECHO@
+DUMPBIN = @DUMPBIN@
 ECHO_C = @ECHO_C@
 ECHO_N = @ECHO_N@
 ECHO_T = @ECHO_T@
 EGREP = @EGREP@
 EXEEXT = @EXEEXT@
 EXTRA_CRYPTO = @EXTRA_CRYPTO@
-F77 = @F77@
-FFLAGS = @FFLAGS@
+FGREP = @FGREP@
 FRAG_OBJS = @FRAG_OBJS@
 GLIBC_BUGS = @GLIBC_BUGS@
 GREP = @GREP@
@@ -88,6 +86,7 @@
 INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
 KERNEL_INCLUDE = @KERNEL_INCLUDE@
 KRB5_CONFIG = @KRB5_CONFIG@
+LD = @LD@
 LDFLAGS = @LDFLAGS@
 LEX = @LEX@
 LEXLIB = @LEXLIB@
@@ -95,18 +94,24 @@
 LIBOBJS = @LIBOBJS@
 LIBS = @LIBS@
 LIBTOOL = @LIBTOOL@
+LIPO = @LIPO@
 LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
 MAKEINFO = @MAKEINFO@
 MKDIR_P = @MKDIR_P@
 NATT_OBJS = @NATT_OBJS@
+NM = @NM@
 NMEDIT = @NMEDIT@
+OBJDUMP = @OBJDUMP@
 OBJEXT = @OBJEXT@
+OTOOL = @OTOOL@
+OTOOL64 = @OTOOL64@
 PACKAGE = @PACKAGE@
 PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
 PACKAGE_NAME = @PACKAGE_NAME@
 PACKAGE_STRING = @PACKAGE_STRING@
 PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
 PACKAGE_VERSION = @PACKAGE_VERSION@
 PATH_SEPARATOR = @PATH_SEPARATOR@
 RANLIB = @RANLIB@
@@ -124,8 +129,7 @@
 abs_top_builddir = @abs_top_builddir@
 abs_top_srcdir = @abs_top_srcdir@
 ac_ct_CC = @ac_ct_CC@
-ac_ct_CXX = @ac_ct_CXX@
-ac_ct_F77 = @ac_ct_F77@
+ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
 am__include = @am__include@
 am__leading_dot = @am__leading_dot@
 am__quote = @am__quote@
@@ -157,6 +161,7 @@
 libexecdir = @libexecdir@
 localedir = @localedir@
 localstatedir = @localstatedir@
+lt_ECHO = @lt_ECHO@
 mandir = @mandir@
 mkdir_p = @mkdir_p@
 oldincludedir = @oldincludedir@
@@ -169,6 +174,7 @@
 srcdir = @srcdir@
 sysconfdir = @sysconfdir@
 target_alias = @target_alias@
+top_build_prefix = @top_build_prefix@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
 EXTRA_DIST = \
@@ -185,14 +191,14 @@
 	@for dep in $?; do \
 	  case '$(am__configure_deps)' in \
 	    *$$dep*) \
-	      cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh \
-		&& exit 0; \
+	      ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
+	        && { if test -f $@; then exit 0; else break; fi; }; \
 	      exit 1;; \
 	  esac; \
 	done; \
-	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign  src/include-glibc/Makefile'; \
-	cd $(top_srcdir) && \
-	  $(AUTOMAKE) --foreign  src/include-glibc/Makefile
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign src/include-glibc/Makefile'; \
+	$(am__cd) $(top_srcdir) && \
+	  $(AUTOMAKE) --foreign src/include-glibc/Makefile
 .PRECIOUS: Makefile
 Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	@case '$?' in \
@@ -210,6 +216,7 @@
 	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
 $(ACLOCAL_M4):  $(am__aclocal_m4_deps)
 	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
 
 mostlyclean-libtool:
 	-rm -f *.lo
@@ -239,13 +246,17 @@
 	  if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
 	  if test -d $$d/$$file; then \
 	    dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
-	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
-	      cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+	    if test -d "$(distdir)/$$file"; then \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
 	    fi; \
-	    cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
+	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
+	      cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
 	  else \
-	    test -f $(distdir)/$$file \
-	    || cp -p $$d/$$file $(distdir)/$$file \
+	    test -f "$(distdir)/$$file" \
+	    || cp -p $$d/$$file "$(distdir)/$$file" \
 	    || exit 1; \
 	  fi; \
 	done
@@ -273,6 +284,7 @@
 
 distclean-generic:
 	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
 	-test -z "$(DISTCLEANFILES)" || rm -f $(DISTCLEANFILES)
 
 maintainer-clean-generic:
@@ -292,6 +304,8 @@
 
 html: html-am
 
+html-am:
+
 info: info-am
 
 info-am:
@@ -300,18 +314,28 @@
 
 install-dvi: install-dvi-am
 
+install-dvi-am:
+
 install-exec-am:
 
 install-html: install-html-am
 
+install-html-am:
+
 install-info: install-info-am
 
+install-info-am:
+
 install-man:
 
 install-pdf: install-pdf-am
 
+install-pdf-am:
+
 install-ps: install-ps-am
 
+install-ps-am:
+
 installcheck-am:
 
 maintainer-clean: maintainer-clean-am
@@ -351,6 +375,7 @@
 	touch .includes
 
 all: .includes
+
 # Tell versions [3.59,3.63) of GNU make to not export all variables.
 # Otherwise a system limit (for SysV at least) may be exceeded.
 .NOEXPORT:
diff --git a/src/libipsec/Makefile.in b/src/libipsec/Makefile.in
index 748877a..cd0993b 100644
--- a/src/libipsec/Makefile.in
+++ b/src/libipsec/Makefile.in
@@ -1,8 +1,9 @@
-# Makefile.in generated by automake 1.10.1 from Makefile.am.
+# Makefile.in generated by automake 1.11.1 from Makefile.am.
 # @configure_input@
 
 # Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005, 2006, 2007, 2008  Free Software Foundation, Inc.
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009  Free Software Foundation,
+# Inc.
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
 # with or without modifications, as long as this notice is preserved.
@@ -17,8 +18,9 @@
 
 VPATH = @srcdir@
 pkgdatadir = $(datadir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
 pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
 am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
 install_sh_DATA = $(install_sh) -c -m 644
 install_sh_PROGRAM = $(install_sh) -c
@@ -45,15 +47,30 @@
 mkinstalldirs = $(install_sh) -d
 CONFIG_HEADER = $(top_builddir)/config.h
 CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
 am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
 am__vpath_adj = case $$p in \
     $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
     *) f=$$p;; \
   esac;
-am__strip_dir = `echo $$p | sed -e 's|^.*/||'`;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+  srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+  for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+  for p in $$list; do echo "$$p $$p"; done | \
+  sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+  $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+    if (++n[$$2] == $(am__install_max)) \
+      { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+    END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+  sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+  sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
 am__installdirs = "$(DESTDIR)$(libdir)" "$(DESTDIR)$(man3dir)" \
 	"$(DESTDIR)$(libipsecdir)"
-libLTLIBRARIES_INSTALL = $(INSTALL)
 LTLIBRARIES = $(lib_LTLIBRARIES)
 am__DEPENDENCIES_1 =
 libipsec_la_DEPENDENCIES = $(am__DEPENDENCIES_1)
@@ -67,6 +84,7 @@
 DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)
 depcomp = $(SHELL) $(top_srcdir)/depcomp
 am__depfiles_maybe = depfiles
+am__mv = mv -f
 COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
 	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
 LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
@@ -88,7 +106,6 @@
 man3dir = $(mandir)/man3
 NROFF = nroff
 MANS = $(man3_MANS)
-libipsecHEADERS_INSTALL = $(INSTALL_HEADER)
 HEADERS = $(libipsec_HEADERS) $(noinst_HEADERS)
 ETAGS = etags
 CTAGS = ctags
@@ -107,23 +124,18 @@
 CPP = @CPP@
 CPPFLAGS = @CPPFLAGS@
 CRYPTOBJS = @CRYPTOBJS@
-CXX = @CXX@
-CXXCPP = @CXXCPP@
-CXXDEPMODE = @CXXDEPMODE@
-CXXFLAGS = @CXXFLAGS@
 CYGPATH_W = @CYGPATH_W@
 DEFS = @DEFS@
 DEPDIR = @DEPDIR@
 DSYMUTIL = @DSYMUTIL@
-ECHO = @ECHO@
+DUMPBIN = @DUMPBIN@
 ECHO_C = @ECHO_C@
 ECHO_N = @ECHO_N@
 ECHO_T = @ECHO_T@
 EGREP = @EGREP@
 EXEEXT = @EXEEXT@
 EXTRA_CRYPTO = @EXTRA_CRYPTO@
-F77 = @F77@
-FFLAGS = @FFLAGS@
+FGREP = @FGREP@
 FRAG_OBJS = @FRAG_OBJS@
 GLIBC_BUGS = @GLIBC_BUGS@
 GREP = @GREP@
@@ -137,6 +149,7 @@
 INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
 KERNEL_INCLUDE = @KERNEL_INCLUDE@
 KRB5_CONFIG = @KRB5_CONFIG@
+LD = @LD@
 LDFLAGS = @LDFLAGS@
 LEX = @LEX@
 LEXLIB = @LEXLIB@
@@ -144,18 +157,24 @@
 LIBOBJS = @LIBOBJS@
 LIBS = @LIBS@
 LIBTOOL = @LIBTOOL@
+LIPO = @LIPO@
 LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
 MAKEINFO = @MAKEINFO@
 MKDIR_P = @MKDIR_P@
 NATT_OBJS = @NATT_OBJS@
+NM = @NM@
 NMEDIT = @NMEDIT@
+OBJDUMP = @OBJDUMP@
 OBJEXT = @OBJEXT@
+OTOOL = @OTOOL@
+OTOOL64 = @OTOOL64@
 PACKAGE = @PACKAGE@
 PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
 PACKAGE_NAME = @PACKAGE_NAME@
 PACKAGE_STRING = @PACKAGE_STRING@
 PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
 PACKAGE_VERSION = @PACKAGE_VERSION@
 PATH_SEPARATOR = @PATH_SEPARATOR@
 RANLIB = @RANLIB@
@@ -173,8 +192,7 @@
 abs_top_builddir = @abs_top_builddir@
 abs_top_srcdir = @abs_top_srcdir@
 ac_ct_CC = @ac_ct_CC@
-ac_ct_CXX = @ac_ct_CXX@
-ac_ct_F77 = @ac_ct_F77@
+ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
 am__include = @am__include@
 am__leading_dot = @am__leading_dot@
 am__quote = @am__quote@
@@ -206,6 +224,7 @@
 libexecdir = @libexecdir@
 localedir = @localedir@
 localstatedir = @localstatedir@
+lt_ECHO = @lt_ECHO@
 mandir = @mandir@
 mkdir_p = @mkdir_p@
 oldincludedir = @oldincludedir@
@@ -218,6 +237,7 @@
 srcdir = @srcdir@
 sysconfdir = @sysconfdir@
 target_alias = @target_alias@
+top_build_prefix = @top_build_prefix@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
 
@@ -262,14 +282,14 @@
 	@for dep in $?; do \
 	  case '$(am__configure_deps)' in \
 	    *$$dep*) \
-	      cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh \
-		&& exit 0; \
+	      ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
+	        && { if test -f $@; then exit 0; else break; fi; }; \
 	      exit 1;; \
 	  esac; \
 	done; \
-	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign  src/libipsec/Makefile'; \
-	cd $(top_srcdir) && \
-	  $(AUTOMAKE) --foreign  src/libipsec/Makefile
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign src/libipsec/Makefile'; \
+	$(am__cd) $(top_srcdir) && \
+	  $(AUTOMAKE) --foreign src/libipsec/Makefile
 .PRECIOUS: Makefile
 Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	@case '$?' in \
@@ -287,23 +307,28 @@
 	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
 $(ACLOCAL_M4):  $(am__aclocal_m4_deps)
 	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
 install-libLTLIBRARIES: $(lib_LTLIBRARIES)
 	@$(NORMAL_INSTALL)
 	test -z "$(libdir)" || $(MKDIR_P) "$(DESTDIR)$(libdir)"
-	@list='$(lib_LTLIBRARIES)'; for p in $$list; do \
+	@list='$(lib_LTLIBRARIES)'; test -n "$(libdir)" || list=; \
+	list2=; for p in $$list; do \
 	  if test -f $$p; then \
-	    f=$(am__strip_dir) \
-	    echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(libLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) '$$p' '$(DESTDIR)$(libdir)/$$f'"; \
-	    $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(libLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) "$$p" "$(DESTDIR)$(libdir)/$$f"; \
+	    list2="$$list2 $$p"; \
 	  else :; fi; \
-	done
+	done; \
+	test -z "$$list2" || { \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(libdir)'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(libdir)"; \
+	}
 
 uninstall-libLTLIBRARIES:
 	@$(NORMAL_UNINSTALL)
-	@list='$(lib_LTLIBRARIES)'; for p in $$list; do \
-	  p=$(am__strip_dir) \
-	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(libdir)/$$p'"; \
-	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(libdir)/$$p"; \
+	@list='$(lib_LTLIBRARIES)'; test -n "$(libdir)" || list=; \
+	for p in $$list; do \
+	  $(am__strip_dir) \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(libdir)/$$f'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(libdir)/$$f"; \
 	done
 
 clean-libLTLIBRARIES:
@@ -339,21 +364,21 @@
 
 .c.o:
 @am__fastdepCC_TRUE@	$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@	mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(COMPILE) -c $<
 
 .c.obj:
 @am__fastdepCC_TRUE@	$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
-@am__fastdepCC_TRUE@	mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(COMPILE) -c `$(CYGPATH_W) '$<'`
 
 .c.lo:
 @am__fastdepCC_TRUE@	$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@	mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(LTCOMPILE) -c -o $@ $<
@@ -369,82 +394,74 @@
 
 clean-libtool:
 	-rm -rf .libs _libs
-install-man3: $(man3_MANS) $(man_MANS)
+install-man3: $(man3_MANS)
 	@$(NORMAL_INSTALL)
 	test -z "$(man3dir)" || $(MKDIR_P) "$(DESTDIR)$(man3dir)"
-	@list='$(man3_MANS) $(dist_man3_MANS) $(nodist_man3_MANS)'; \
-	l2='$(man_MANS) $(dist_man_MANS) $(nodist_man_MANS)'; \
-	for i in $$l2; do \
-	  case "$$i" in \
-	    *.3*) list="$$list $$i" ;; \
-	  esac; \
+	@list='$(man3_MANS)'; test -n "$(man3dir)" || exit 0; \
+	{ for i in $$list; do echo "$$i"; done; \
+	} | while read p; do \
+	  if test -f $$p; then d=; else d="$(srcdir)/"; fi; \
+	  echo "$$d$$p"; echo "$$p"; \
+	done | \
+	sed -e 'n;s,.*/,,;p;h;s,.*\.,,;s,^[^3][0-9a-z]*$$,3,;x' \
+	      -e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,' | \
+	sed 'N;N;s,\n, ,g' | { \
+	list=; while read file base inst; do \
+	  if test "$$base" = "$$inst"; then list="$$list $$file"; else \
+	    echo " $(INSTALL_DATA) '$$file' '$(DESTDIR)$(man3dir)/$$inst'"; \
+	    $(INSTALL_DATA) "$$file" "$(DESTDIR)$(man3dir)/$$inst" || exit $$?; \
+	  fi; \
 	done; \
-	for i in $$list; do \
-	  if test -f $(srcdir)/$$i; then file=$(srcdir)/$$i; \
-	  else file=$$i; fi; \
-	  ext=`echo $$i | sed -e 's/^.*\\.//'`; \
-	  case "$$ext" in \
-	    3*) ;; \
-	    *) ext='3' ;; \
-	  esac; \
-	  inst=`echo $$i | sed -e 's/\\.[0-9a-z]*$$//'`; \
-	  inst=`echo $$inst | sed -e 's/^.*\///'`; \
-	  inst=`echo $$inst | sed '$(transform)'`.$$ext; \
-	  echo " $(INSTALL_DATA) '$$file' '$(DESTDIR)$(man3dir)/$$inst'"; \
-	  $(INSTALL_DATA) "$$file" "$(DESTDIR)$(man3dir)/$$inst"; \
-	done
+	for i in $$list; do echo "$$i"; done | $(am__base_list) | \
+	while read files; do \
+	  test -z "$$files" || { \
+	    echo " $(INSTALL_DATA) $$files '$(DESTDIR)$(man3dir)'"; \
+	    $(INSTALL_DATA) $$files "$(DESTDIR)$(man3dir)" || exit $$?; }; \
+	done; }
+
 uninstall-man3:
 	@$(NORMAL_UNINSTALL)
-	@list='$(man3_MANS) $(dist_man3_MANS) $(nodist_man3_MANS)'; \
-	l2='$(man_MANS) $(dist_man_MANS) $(nodist_man_MANS)'; \
-	for i in $$l2; do \
-	  case "$$i" in \
-	    *.3*) list="$$list $$i" ;; \
-	  esac; \
-	done; \
-	for i in $$list; do \
-	  ext=`echo $$i | sed -e 's/^.*\\.//'`; \
-	  case "$$ext" in \
-	    3*) ;; \
-	    *) ext='3' ;; \
-	  esac; \
-	  inst=`echo $$i | sed -e 's/\\.[0-9a-z]*$$//'`; \
-	  inst=`echo $$inst | sed -e 's/^.*\///'`; \
-	  inst=`echo $$inst | sed '$(transform)'`.$$ext; \
-	  echo " rm -f '$(DESTDIR)$(man3dir)/$$inst'"; \
-	  rm -f "$(DESTDIR)$(man3dir)/$$inst"; \
-	done
+	@list='$(man3_MANS)'; test -n "$(man3dir)" || exit 0; \
+	files=`{ for i in $$list; do echo "$$i"; done; \
+	} | sed -e 's,.*/,,;h;s,.*\.,,;s,^[^3][0-9a-z]*$$,3,;x' \
+	      -e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,'`; \
+	test -z "$$files" || { \
+	  echo " ( cd '$(DESTDIR)$(man3dir)' && rm -f" $$files ")"; \
+	  cd "$(DESTDIR)$(man3dir)" && rm -f $$files; }
 install-libipsecHEADERS: $(libipsec_HEADERS)
 	@$(NORMAL_INSTALL)
 	test -z "$(libipsecdir)" || $(MKDIR_P) "$(DESTDIR)$(libipsecdir)"
-	@list='$(libipsec_HEADERS)'; for p in $$list; do \
+	@list='$(libipsec_HEADERS)'; test -n "$(libipsecdir)" || list=; \
+	for p in $$list; do \
 	  if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
-	  f=$(am__strip_dir) \
-	  echo " $(libipsecHEADERS_INSTALL) '$$d$$p' '$(DESTDIR)$(libipsecdir)/$$f'"; \
-	  $(libipsecHEADERS_INSTALL) "$$d$$p" "$(DESTDIR)$(libipsecdir)/$$f"; \
+	  echo "$$d$$p"; \
+	done | $(am__base_list) | \
+	while read files; do \
+	  echo " $(INSTALL_HEADER) $$files '$(DESTDIR)$(libipsecdir)'"; \
+	  $(INSTALL_HEADER) $$files "$(DESTDIR)$(libipsecdir)" || exit $$?; \
 	done
 
 uninstall-libipsecHEADERS:
 	@$(NORMAL_UNINSTALL)
-	@list='$(libipsec_HEADERS)'; for p in $$list; do \
-	  f=$(am__strip_dir) \
-	  echo " rm -f '$(DESTDIR)$(libipsecdir)/$$f'"; \
-	  rm -f "$(DESTDIR)$(libipsecdir)/$$f"; \
-	done
+	@list='$(libipsec_HEADERS)'; test -n "$(libipsecdir)" || list=; \
+	files=`for p in $$list; do echo $$p; done | sed -e 's|^.*/||'`; \
+	test -n "$$files" || exit 0; \
+	echo " ( cd '$(DESTDIR)$(libipsecdir)' && rm -f" $$files ")"; \
+	cd "$(DESTDIR)$(libipsecdir)" && rm -f $$files
 
 ID: $(HEADERS) $(SOURCES) $(LISP) $(TAGS_FILES)
 	list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
 	unique=`for i in $$list; do \
 	    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
 	  done | \
-	  $(AWK) '{ files[$$0] = 1; nonemtpy = 1; } \
+	  $(AWK) '{ files[$$0] = 1; nonempty = 1; } \
 	      END { if (nonempty) { for (i in files) print i; }; }'`; \
 	mkid -fID $$unique
 tags: TAGS
 
 TAGS:  $(HEADERS) $(SOURCES)  $(TAGS_DEPENDENCIES) \
 		$(TAGS_FILES) $(LISP)
-	tags=; \
+	set x; \
 	here=`pwd`; \
 	list='$(SOURCES) $(HEADERS)  $(LISP) $(TAGS_FILES)'; \
 	unique=`for i in $$list; do \
@@ -452,34 +469,52 @@
 	  done | \
 	  $(AWK) '{ files[$$0] = 1; nonempty = 1; } \
 	      END { if (nonempty) { for (i in files) print i; }; }'`; \
-	if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
+	shift; \
+	if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
 	  test -n "$$unique" || unique=$$empty_fix; \
-	  $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
-	    $$tags $$unique; \
+	  if test $$# -gt 0; then \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      "$$@" $$unique; \
+	  else \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      $$unique; \
+	  fi; \
 	fi
 ctags: CTAGS
 CTAGS:  $(HEADERS) $(SOURCES)  $(TAGS_DEPENDENCIES) \
 		$(TAGS_FILES) $(LISP)
-	tags=; \
 	list='$(SOURCES) $(HEADERS)  $(LISP) $(TAGS_FILES)'; \
 	unique=`for i in $$list; do \
 	    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
 	  done | \
 	  $(AWK) '{ files[$$0] = 1; nonempty = 1; } \
 	      END { if (nonempty) { for (i in files) print i; }; }'`; \
-	test -z "$(CTAGS_ARGS)$$tags$$unique" \
+	test -z "$(CTAGS_ARGS)$$unique" \
 	  || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
-	     $$tags $$unique
+	     $$unique
 
 GTAGS:
 	here=`$(am__cd) $(top_builddir) && pwd` \
-	  && cd $(top_srcdir) \
-	  && gtags -i $(GTAGS_ARGS) $$here
+	  && $(am__cd) $(top_srcdir) \
+	  && gtags -i $(GTAGS_ARGS) "$$here"
 
 distclean-tags:
 	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
 
 distdir: $(DISTFILES)
+	@list='$(MANS)'; if test -n "$$list"; then \
+	  list=`for p in $$list; do \
+	    if test -f $$p; then d=; else d="$(srcdir)/"; fi; \
+	    if test -f "$$d$$p"; then echo "$$d$$p"; else :; fi; done`; \
+	  if test -n "$$list" && \
+	    grep 'ab help2man is required to generate this page' $$list >/dev/null; then \
+	    echo "error: found man pages containing the \`missing help2man' replacement text:" >&2; \
+	    grep -l 'ab help2man is required to generate this page' $$list | sed 's/^/         /' >&2; \
+	    echo "       to fix them, install help2man, remove and regenerate the man pages;" >&2; \
+	    echo "       typically \`make maintainer-clean' will remove them" >&2; \
+	    exit 1; \
+	  else :; fi; \
+	else :; fi
 	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
 	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
 	list='$(DISTFILES)'; \
@@ -495,13 +530,17 @@
 	  if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
 	  if test -d $$d/$$file; then \
 	    dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
-	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
-	      cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+	    if test -d "$(distdir)/$$file"; then \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
 	    fi; \
-	    cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
+	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
+	      cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
 	  else \
-	    test -f $(distdir)/$$file \
-	    || cp -p $$d/$$file $(distdir)/$$file \
+	    test -f "$(distdir)/$$file" \
+	    || cp -p $$d/$$file "$(distdir)/$$file" \
 	    || exit 1; \
 	  fi; \
 	done
@@ -534,6 +573,7 @@
 
 distclean-generic:
 	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
 
 maintainer-clean-generic:
 	@echo "This command is intended for maintainers to use"
@@ -559,6 +599,8 @@
 
 html: html-am
 
+html-am:
+
 info: info-am
 
 info-am:
@@ -567,18 +609,28 @@
 
 install-dvi: install-dvi-am
 
+install-dvi-am:
+
 install-exec-am: install-libLTLIBRARIES
 
 install-html: install-html-am
 
+install-html-am:
+
 install-info: install-info-am
 
+install-info-am:
+
 install-man: install-man3
 
 install-pdf: install-pdf-am
 
+install-pdf-am:
+
 install-ps: install-ps-am
 
+install-ps-am:
+
 installcheck-am:
 
 maintainer-clean: maintainer-clean-am
@@ -604,7 +656,7 @@
 
 uninstall-man: uninstall-man3
 
-.MAKE: install-am install-strip
+.MAKE: all check install install-am install-strip
 
 .PHONY: CTAGS GTAGS all all-am check check-am clean clean-generic \
 	clean-libLTLIBRARIES clean-libtool ctags distclean \
@@ -622,6 +674,7 @@
 	uninstall-am uninstall-libLTLIBRARIES \
 	uninstall-libipsecHEADERS uninstall-man uninstall-man3
 
+
 # Tell versions [3.59,3.63) of GNU make to not export all variables.
 # Otherwise a system limit (for SysV at least) may be exceeded.
 .NOEXPORT:
diff --git a/src/libipsec/ipsec_dump_policy.c b/src/libipsec/ipsec_dump_policy.c
index bdadb47..4d0eb77 100644
--- a/src/libipsec/ipsec_dump_policy.c
+++ b/src/libipsec/ipsec_dump_policy.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ipsec_dump_policy.c,v 1.7.6.1 2007/08/01 11:52:17 vanhu Exp $	*/
+/*	$NetBSD: ipsec_dump_policy.c,v 1.9 2010/12/03 15:01:11 tteras Exp $	*/
 
 /* Id: ipsec_dump_policy.c,v 1.10 2005/06/29 09:12:37 manubsd Exp */
 
@@ -53,7 +53,10 @@
 #include "libpfkey.h"
 
 static const char *ipsp_dir_strs[] = {
-	"any", "in", "out", "fwd"
+	"any", "in", "out", "fwd",
+#ifdef __linux__
+	"in(socket)", "out(socket)"
+#endif
 };
 
 static const char *ipsp_policy_strs[] = {
@@ -165,6 +168,8 @@
 	case IPSEC_DIR_OUTBOUND:
 #ifdef HAVE_POLICY_FWD
 	case IPSEC_DIR_FWD:
+	case IPSEC_DIR_FWD + 1:
+	case IPSEC_DIR_FWD + 2:
 #endif
 		break;
 	default:
diff --git a/src/libipsec/ipsec_get_policylen.c b/src/libipsec/ipsec_get_policylen.c
index 2f4f6e9..5a49778 100644
--- a/src/libipsec/ipsec_get_policylen.c
+++ b/src/libipsec/ipsec_get_policylen.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ipsec_get_policylen.c,v 1.6.6.1 2007/08/01 11:52:17 vanhu Exp $	*/
+/*	$NetBSD: ipsec_get_policylen.c,v 1.7 2007/07/18 12:07:50 vanhu Exp $	*/
 
 /*	$KAME: ipsec_get_policylen.c,v 1.5 2000/05/07 05:25:03 itojun Exp $	*/
 
diff --git a/src/libipsec/ipsec_set_policy.3 b/src/libipsec/ipsec_set_policy.3
index 643b582..f3832b5 100644
--- a/src/libipsec/ipsec_set_policy.3
+++ b/src/libipsec/ipsec_set_policy.3
@@ -1,4 +1,4 @@
-.\"	$NetBSD: ipsec_set_policy.3,v 1.13 2006/09/09 16:22:09 manu Exp $
+.\"	$NetBSD: ipsec_set_policy.3,v 1.15 2010/03/05 06:47:58 tteras Exp $
 .\"
 .\"	$KAME: ipsec_set_policy.3,v 1.16 2003/01/06 21:59:03 sumikawa Exp $
 .\"
@@ -124,14 +124,10 @@
 support policy priorities (Linux \*[Gt]= 2.6.6).
 It takes one of the following formats:
 .Bl -tag  -width "discard"
-.It Xo
-.Ar {priority,prio} offset
-.Xc
+.It Ar {priority,prio} offset
 .Ar offset
-is an integer in the range -2147483647..214783648.
-.It Xo
-.Ar {priority,prio} base {+,-} offset
-.Xc
+is an integer in the range \-2147483647..214783648.
+.It Ar {priority,prio} base {+,-} offset
 .Ar base
 is either
 .Li low (-1073741824) ,
@@ -162,12 +158,7 @@
 means to bypass the IPsec processing.
 .Pq the packet will be transmitted in clear .
 This is for privileged sockets.
-.It Xo
-.Ar direction
-.Bq Ar priority specification
-.Li ipsec
-.Ar request ...
-.Xc
+.It Ar direction Bo Ar priority specification Bc Li ipsec Ar request ...
 .Li ipsec
 means that the matching packets are subject to IPsec processing.
 .Li ipsec
@@ -175,16 +166,7 @@
 .Ar request
 strings, which are formatted as below:
 .Bl -tag  -width "discard"
-.It Xo
-.Ar protocol
-.Li /
-.Ar mode
-.Li /
-.Ar src
-.Li -
-.Ar dst
-.Op Ar /level
-.Xc
+.It Ar protocol Li / Ar mode Li / Ar src Li - Ar dst Op Ar /level
 .Ar protocol
 is either
 .Li ah ,
diff --git a/src/libipsec/ipsec_strerror.c b/src/libipsec/ipsec_strerror.c
index ad1ab2a..ca26d0e 100644
--- a/src/libipsec/ipsec_strerror.c
+++ b/src/libipsec/ipsec_strerror.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: ipsec_strerror.c,v 1.4.6.1 2007/08/01 11:52:17 vanhu Exp $	*/
+/*	$NetBSD: ipsec_strerror.c,v 1.6 2010/04/07 14:53:52 vanhu Exp $	*/
 
 /*	$KAME: ipsec_strerror.c,v 1.7 2000/07/30 00:45:12 itojun Exp $	*/
 
@@ -63,7 +63,7 @@
 "Invalid key length",				/*EIPSEC_INVAL_KEYLEN*/
 "Invalid address family",			/*EIPSEC_INVAL_FAMILY*/
 "Invalid prefix length",			/*EIPSEC_INVAL_PREFIXLEN*/
-"Invalid direciton",				/*EIPSEC_INVAL_DIR*/
+"Invalid direction",				/*EIPSEC_INVAL_DIR*/
 "SPI range violation",				/*EIPSEC_INVAL_SPI*/
 "No protocol specified",			/*EIPSEC_NO_PROTO*/
 "No algorithm specified",			/*EIPSEC_NO_ALGS*/
diff --git a/src/libipsec/key_debug.c b/src/libipsec/key_debug.c
index 60f1602..e381a98 100644
--- a/src/libipsec/key_debug.c
+++ b/src/libipsec/key_debug.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: key_debug.c,v 1.7.6.1 2007/08/01 11:52:18 vanhu Exp $	*/
+/*	$NetBSD: key_debug.c,v 1.9 2008/12/05 06:02:20 tteras Exp $	*/
 
 /*	$KAME: key_debug.c,v 1.29 2001/08/16 14:25:41 itojun Exp $	*/
 
@@ -91,6 +91,10 @@
 static void kdebug_sadb_x_packet __P((struct sadb_ext *));
 #endif
 
+#ifdef SADB_X_EXT_KMADDRESS
+static void kdebug_sadb_x_kmaddress __P((struct sadb_ext *));
+#endif
+
 #ifdef _KERNEL
 static void kdebug_secreplay __P((struct secreplay *));
 #endif
@@ -194,6 +198,11 @@
 			kdebug_sadb_x_packet(ext);
 			break;
 #endif
+#ifdef SADB_X_EXT_KMADDRESS
+		case SADB_X_EXT_KMADDRESS:
+			kdebug_sadb_x_kmaddress(ext);
+			break;
+#endif
 		default:
 			printf("kdebug_sadb: invalid ext_type %u was passed.\n",
 			    ext->sadb_ext_type);
@@ -556,6 +565,48 @@
 }
 #endif
 
+#ifdef SADB_X_EXT_KMADDRESS
+static void
+kdebug_sadb_x_kmaddress(ext)
+	struct sadb_ext *ext;
+{
+	struct sadb_x_kmaddress *kma = (struct sadb_x_kmaddress *)ext;
+	struct sockaddr * sa;
+	sa_family_t family;
+	int len, sa_len;
+
+	/* sanity check */
+	if (ext == NULL)
+		panic("kdebug_sadb_x_kmaddress: NULL pointer was passed.\n");
+
+	len = (PFKEY_UNUNIT64(kma->sadb_x_kmaddress_len) - sizeof(*kma));
+
+	printf("sadb_x_kmaddress{ reserved=0x%02x%02x%02x%02x }\n",
+	       ((u_char *)(void *)&kma->sadb_x_kmaddress_reserved)[0],
+	       ((u_char *)(void *)&kma->sadb_x_kmaddress_reserved)[1],
+	       ((u_char *)(void *)&kma->sadb_x_kmaddress_reserved)[2],
+	       ((u_char *)(void *)&kma->sadb_x_kmaddress_reserved)[3]);
+
+	sa = (struct sockaddr *)(kma + 1);
+	if (len < sizeof(struct sockaddr) || (sa_len = sysdep_sa_len(sa)) > len)
+		panic("kdebug_sadb_x_kmaddress: not enough data to read"
+		      " first sockaddr.\n");
+	kdebug_sockaddr((void *)sa); /* local address */
+	family = sa->sa_family;
+
+	len -= sa_len;
+	sa = (struct sockaddr *)((char *)sa + sa_len);
+	if (len < sizeof(struct sockaddr) || sysdep_sa_len(sa) > len)
+		panic("kdebug_sadb_x_kmaddress: not enough data to read"
+		      " second sockaddr.\n");
+	kdebug_sockaddr((void *)sa); /* remote address */
+
+	if (family != sa->sa_family)
+		printf("kdebug_sadb_x_kmaddress:  !!!! Please, note the "
+		       "unexpected mismatch in address family.\n");
+}
+#endif
+
 
 #ifdef _KERNEL
 /* %%%: about SPD and SAD */
diff --git a/src/libipsec/libpfkey.h b/src/libipsec/libpfkey.h
index b312015..ff4c603 100644
--- a/src/libipsec/libpfkey.h
+++ b/src/libipsec/libpfkey.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: libpfkey.h,v 1.12.4.1 2007/08/01 11:52:18 vanhu Exp $	*/
+/*	$NetBSD: libpfkey.h,v 1.18 2010/12/03 14:32:52 tteras Exp $	*/
 
 /* Id: libpfkey.h,v 1.13 2005/12/04 20:26:43 manubsd Exp */
 
@@ -121,6 +121,10 @@
 u_int pfkey_get_softrate __P((u_int));
 int pfkey_send_getspi __P((int, u_int, u_int, struct sockaddr *,
 	struct sockaddr *, u_int32_t, u_int32_t, u_int32_t, u_int32_t));
+int pfkey_send_getspi_nat __P((int, u_int, u_int,
+	struct sockaddr *, struct sockaddr *, u_int8_t, u_int16_t, u_int16_t,
+	u_int32_t, u_int32_t, u_int32_t, u_int32_t));
+
 int pfkey_send_update2 __P((struct pfkey_send_sa_args *));
 int pfkey_send_add2 __P((struct pfkey_send_sa_args *)); 
 int pfkey_send_delete __P((int, u_int, u_int,
@@ -154,12 +158,22 @@
 int pfkey_send_spdflush __P((int));
 int pfkey_send_spddump __P((int));
 #ifdef SADB_X_MIGRATE
-int pfkey_send_migrate __P((int, struct sockaddr *, u_int,
-	struct sockaddr *, u_int, u_int, caddr_t, int, u_int32_t));
+int pfkey_send_migrate __P((int, struct sockaddr *, struct sockaddr *,
+        struct sockaddr *, u_int, struct sockaddr *, u_int, u_int,
+        caddr_t, int, u_int32_t));
 #endif
 
+/* XXX should be somewhere else !!!
+ */
+#ifdef SADB_X_EXT_NAT_T_TYPE
+#define PFKEY_ADDR_X_PORT(ext) (ntohs(((struct sadb_x_nat_t_port *)ext)->sadb_x_nat_t_port_port))
+#define PFKEY_ADDR_X_NATTYPE(ext) ( ext != NULL && ((struct sadb_x_nat_t_type *)ext)->sadb_x_nat_t_type_type )
+#endif
+
+
 int pfkey_open __P((void));
 void pfkey_close __P((int));
+int pfkey_set_buffer_size __P((int, int));
 struct sadb_msg *pfkey_recv __P((int));
 int pfkey_send __P((int, struct sadb_msg *, int));
 int pfkey_align __P((struct sadb_msg *, caddr_t *));
@@ -200,6 +214,10 @@
 #define IPPROTO_IPCOMP IPPROTO_COMP
 #endif
 
+#ifndef IPPROTO_MH
+#define IPPROTO_MH		135
+#endif
+
 static __inline u_int8_t
 sysdep_sa_len (const struct sockaddr *sa)
 {
diff --git a/src/libipsec/pfkey.c b/src/libipsec/pfkey.c
index fae0415..e64cf36 100644
--- a/src/libipsec/pfkey.c
+++ b/src/libipsec/pfkey.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: pfkey.c,v 1.13.4.2 2007/10/15 16:05:22 vanhu Exp $	*/
+/*	$NetBSD: pfkey.c,v 1.21 2011/01/20 16:08:35 vanhu Exp $	*/
 
 /*	$KAME: pfkey.c,v 1.47 2003/10/02 19:52:12 itojun Exp $	*/
 
@@ -71,6 +71,12 @@
 	u_int, u_int, u_int32_t));
 static caddr_t pfkey_setsadbaddr __P((caddr_t, caddr_t, u_int,
 	struct sockaddr *, u_int, u_int));
+
+#ifdef SADB_X_EXT_KMADDRESS
+static caddr_t pfkey_setsadbkmaddr __P((caddr_t, caddr_t, struct sockaddr *,
+	struct sockaddr *));
+#endif
+
 static caddr_t pfkey_setsadbkey __P((caddr_t, caddr_t, u_int, caddr_t, u_int));
 static caddr_t pfkey_setsadblifetime __P((caddr_t, caddr_t, u_int, u_int32_t,
 	u_int32_t, u_int32_t, u_int32_t));
@@ -374,11 +380,10 @@
  *	-1	: error occured, and set errno.
  */
 int
-pfkey_send_getspi(so, satype, mode, src, dst, min, max, reqid, seq)
-	int so;
-	u_int satype, mode;
-	struct sockaddr *src, *dst;
-	u_int32_t min, max, reqid, seq;
+pfkey_send_getspi_nat(int so, u_int satype, u_int mode, struct sockaddr *src,
+    struct sockaddr *dst, u_int8_t natt_type, u_int16_t sport,
+    u_int16_t dport, u_int32_t min, u_int32_t max, u_int32_t reqid,
+    u_int32_t seq)
 {
 	struct sadb_msg *newmsg;
 	caddr_t ep;
@@ -425,6 +430,14 @@
 		len += sizeof(struct sadb_spirange);
 	}
 
+#ifdef SADB_X_EXT_NAT_T_TYPE
+	if(natt_type||sport||dport){
+		len += sizeof(struct sadb_x_nat_t_type);
+		len += sizeof(struct sadb_x_nat_t_port);
+		len += sizeof(struct sadb_x_nat_t_port);
+	}
+#endif
+
 	if ((newmsg = CALLOC((size_t)len, struct sadb_msg *)) == NULL) {
 		__ipsec_set_strerror(strerror(errno));
 		return -1;
@@ -460,6 +473,32 @@
 		return -1;
 	}
 
+#ifdef SADB_X_EXT_NAT_T_TYPE
+	/* Add nat-t messages */
+	if (natt_type) {
+		p = pfkey_set_natt_type(p, ep, SADB_X_EXT_NAT_T_TYPE, 
+					natt_type);
+		if (!p) {
+			free(newmsg);
+			return -1;
+		}
+
+		p = pfkey_set_natt_port(p, ep, SADB_X_EXT_NAT_T_SPORT,
+					sport);
+		if (!p) {
+			free(newmsg);
+			return -1;
+		}
+
+		p = pfkey_set_natt_port(p, ep, SADB_X_EXT_NAT_T_DPORT,
+					dport);
+		if (!p) {
+			free(newmsg);
+			return -1;
+		}
+	}
+#endif
+
 	/* proccessing spi range */
 	if (need_spirange) {
 		struct sadb_spirange spirange;
@@ -495,6 +534,15 @@
 	return len;
 }
 
+int
+pfkey_send_getspi(int so, u_int satype, u_int mode, struct sockaddr *src,
+    struct sockaddr *dst, u_int32_t min, u_int32_t max, u_int32_t reqid,
+    u_int32_t seq)
+{
+	return pfkey_send_getspi_nat(so, satype, mode, src, dst, 0, 0, 0,
+		min, max, reqid, seq);
+}
+
 /*
  * sending SADB_UPDATE message to the kernel.
  * The length of key material is a_keylen + e_keylen.
@@ -503,12 +551,10 @@
  *	-1	: error occured, and set errno.
  */
 int
-pfkey_send_update2(sa_parms)
-	struct pfkey_send_sa_args *sa_parms;
+pfkey_send_update2(struct pfkey_send_sa_args *sa_parms)
 {
 	int len;
 
-	
 	sa_parms->type = SADB_UPDATE;
 	if ((len = pfkey_send_x1(sa_parms)) < 0)
 		return -1;
@@ -524,8 +570,7 @@
  *	-1	: error occured, and set errno.
  */
 int
-pfkey_send_add2(sa_parms)
-	struct pfkey_send_sa_args *sa_parms;
+pfkey_send_add2(struct pfkey_send_sa_args *sa_parms)
 {
 	int len;
 	
@@ -543,11 +588,8 @@
  *	-1	: error occured, and set errno.
  */
 int
-pfkey_send_delete(so, satype, mode, src, dst, spi)
-	int so;
-	u_int satype, mode;
-	struct sockaddr *src, *dst;
-	u_int32_t spi;
+pfkey_send_delete(int so, u_int satype, u_int mode, struct sockaddr *src,
+    struct sockaddr *dst, u_int32_t spi)
 {
 	int len;
 	if ((len = pfkey_send_x2(so, SADB_DELETE, satype, mode, src, dst, spi)) < 0)
@@ -567,10 +609,8 @@
  */
 /*ARGSUSED*/
 int
-pfkey_send_delete_all(so, satype, mode, src, dst)
-	int so;
-	u_int satype, mode;
-	struct sockaddr *src, *dst;
+pfkey_send_delete_all(int so, u_int satype, u_int mode, struct sockaddr *src,
+    struct sockaddr *dst)
 {
 	struct sadb_msg *newmsg;
 	int len;
@@ -649,11 +689,8 @@
  *	-1	: error occured, and set errno.
  */
 int
-pfkey_send_get(so, satype, mode, src, dst, spi)
-	int so;
-	u_int satype, mode;
-	struct sockaddr *src, *dst;
-	u_int32_t spi;
+pfkey_send_get(int so, u_int satype, u_int mode, struct sockaddr *src,
+    struct sockaddr *dst, u_int32_t spi)
 {
 	int len;
 	if ((len = pfkey_send_x2(so, SADB_GET, satype, mode, src, dst, spi)) < 0)
@@ -669,9 +706,7 @@
  *	-1	: error occured, and set errno.
  */
 int
-pfkey_send_register(so, satype)
-	int so;
-	u_int satype;
+pfkey_send_register(int so, u_int satype)
 {
 	int len, algno;
 
@@ -711,8 +746,7 @@
  *	-1: error occured, and set errno.
  */
 int
-pfkey_recv_register(so)
-	int so;
+pfkey_recv_register(int so)
 {
 	pid_t pid = getpid();
 	struct sadb_msg *newmsg;
@@ -751,9 +785,7 @@
  *	-1: error occured, and set errno.
  */
 int
-pfkey_set_supported(msg, tlen)
-	struct sadb_msg *msg;
-	int tlen;
+pfkey_set_supported(struct sadb_msg *msg, int tlen)
 {
 	struct sadb_supported *sup;
 	caddr_t p;
@@ -815,9 +847,7 @@
  *	-1	: error occured, and set errno.
  */
 int
-pfkey_send_flush(so, satype)
-	int so;
-	u_int satype;
+pfkey_send_flush(int so, u_int satype)
 {
 	int len;
 
@@ -834,9 +864,7 @@
  *	-1	: error occured, and set errno.
  */
 int
-pfkey_send_dump(so, satype)
-	int so;
-	u_int satype;
+pfkey_send_dump(int so, u_int satype)
 {
 	int len;
 
@@ -859,9 +887,7 @@
  *	        algorithms is.
  */
 int
-pfkey_send_promisc_toggle(so, flag)
-	int so;
-	int flag;
+pfkey_send_promisc_toggle(int so, int flag)
 {
 	int len;
 
@@ -879,13 +905,9 @@
  *	-1	: error occured, and set errno.
  */
 int
-pfkey_send_spdadd(so, src, prefs, dst, prefd, proto, policy, policylen, seq)
-	int so;
-	struct sockaddr *src, *dst;
-	u_int prefs, prefd, proto;
-	caddr_t policy;
-	int policylen;
-	u_int32_t seq;
+pfkey_send_spdadd(int so, struct sockaddr *src, u_int prefs,
+    struct sockaddr *dst, u_int prefd, u_int proto, caddr_t policy,
+    int policylen, u_int32_t seq)
 {
 	int len;
 
@@ -905,15 +927,9 @@
  *	-1	: error occured, and set errno.
  */
 int
-pfkey_send_spdadd2(so, src, prefs, dst, prefd, proto, ltime, vtime,
-		policy, policylen, seq)
-	int so;
-	struct sockaddr *src, *dst;
-	u_int prefs, prefd, proto;
-	u_int64_t ltime, vtime;
-	caddr_t policy;
-	int policylen;
-	u_int32_t seq;
+pfkey_send_spdadd2(int so, struct sockaddr *src, u_int prefs,
+    struct sockaddr *dst, u_int prefd, u_int proto, u_int64_t ltime,
+    u_int64_t vtime, caddr_t policy, int policylen, u_int32_t seq)
 {
 	int len;
 
@@ -933,13 +949,9 @@
  *	-1	: error occured, and set errno.
  */
 int
-pfkey_send_spdupdate(so, src, prefs, dst, prefd, proto, policy, policylen, seq)
-	int so;
-	struct sockaddr *src, *dst;
-	u_int prefs, prefd, proto;
-	caddr_t policy;
-	int policylen;
-	u_int32_t seq;
+pfkey_send_spdupdate(int so, struct sockaddr *src, u_int prefs,
+    struct sockaddr *dst, u_int prefd, u_int proto, caddr_t policy,
+    int policylen, u_int32_t seq)
 {
 	int len;
 
@@ -959,15 +971,9 @@
  *	-1	: error occured, and set errno.
  */
 int
-pfkey_send_spdupdate2(so, src, prefs, dst, prefd, proto, ltime, vtime,
-		policy, policylen, seq)
-	int so;
-	struct sockaddr *src, *dst;
-	u_int prefs, prefd, proto;
-	u_int64_t ltime, vtime;
-	caddr_t policy;
-	int policylen;
-	u_int32_t seq;
+pfkey_send_spdupdate2(int so, struct sockaddr *src, u_int prefs,
+    struct sockaddr *dst, u_int prefd, u_int proto, u_int64_t ltime,
+    u_int64_t vtime, caddr_t policy, int policylen, u_int32_t seq)
 {
 	int len;
 
@@ -987,13 +993,9 @@
  *	-1	: error occured, and set errno.
  */
 int
-pfkey_send_spddelete(so, src, prefs, dst, prefd, proto, policy, policylen, seq)
-	int so;
-	struct sockaddr *src, *dst;
-	u_int prefs, prefd, proto;
-	caddr_t policy;
-	int policylen;
-	u_int32_t seq;
+pfkey_send_spddelete(int so, struct sockaddr *src, u_int prefs,
+    struct sockaddr *dst, u_int prefd, u_int proto, caddr_t policy,
+    int policylen, u_int32_t seq)
 {
 	int len;
 
@@ -1018,9 +1020,7 @@
  *	-1	: error occured, and set errno.
  */
 int
-pfkey_send_spddelete2(so, spid)
-	int so;
-	u_int32_t spid;
+pfkey_send_spddelete2(int so, u_int32_t spid)
 {
 	int len;
 
@@ -1037,9 +1037,7 @@
  *	-1	: error occured, and set errno.
  */
 int
-pfkey_send_spdget(so, spid)
-	int so;
-	u_int32_t spid;
+pfkey_send_spdget(int so, u_int32_t spid)
 {
 	int len;
 
@@ -1056,13 +1054,9 @@
  *	-1	: error occured, and set errno.
  */
 int
-pfkey_send_spdsetidx(so, src, prefs, dst, prefd, proto, policy, policylen, seq)
-	int so;
-	struct sockaddr *src, *dst;
-	u_int prefs, prefd, proto;
-	caddr_t policy;
-	int policylen;
-	u_int32_t seq;
+pfkey_send_spdsetidx(int so, struct sockaddr *src, u_int prefs,
+    struct sockaddr *dst, u_int prefd, u_int proto, caddr_t policy,
+    int policylen, u_int32_t seq)
 {
 	int len;
 
@@ -1087,8 +1081,7 @@
  *	-1	: error occured, and set errno.
  */
 int
-pfkey_send_spdflush(so)
-	int so;
+pfkey_send_spdflush(int so)
 {
 	int len;
 
@@ -1105,8 +1098,7 @@
  *	-1	: error occured, and set errno.
  */
 int
-pfkey_send_spddump(so)
-	int so;
+pfkey_send_spddump(int so)
 {
 	int len;
 
@@ -1125,13 +1117,9 @@
  *	-1	: error occured, and set errno.
  */
 int
-pfkey_send_migrate(so, src, prefs, dst, prefd, proto, policy, policylen, seq)
-	int so;
-	struct sockaddr *src, *dst;
-	u_int prefs, prefd, proto;
-	caddr_t policy;
-	int policylen;
-	u_int32_t seq;
+pfkey_send_migrate(int so, struct sockaddr *local, struct sockaddr *remote,
+    struct sockaddr *src, u_int prefs, struct sockaddr *dst, u_int prefd,
+    u_int proto, caddr_t policy, int policylen, u_int32_t seq)
 {
 	struct sadb_msg *newmsg;
 	int len;
@@ -1149,6 +1137,17 @@
 		return -1;
 	}
 
+	if (local == NULL || remote == NULL) {
+		__ipsec_errcode = EIPSEC_INVAL_ARGUMENT;
+		return -1;
+	}
+#ifdef SADB_X_EXT_KMADDRESS
+	if (local->sa_family != remote->sa_family) {
+		__ipsec_errcode = EIPSEC_FAMILY_MISMATCH;
+		return -1;
+	}
+#endif
+
 	switch (src->sa_family) {
 	case AF_INET:
 		plen = sizeof(struct in_addr) << 3;
@@ -1167,6 +1166,10 @@
 
 	/* create new sadb_msg to reply. */
 	len = sizeof(struct sadb_msg)
+#ifdef SADB_X_EXT_KMADDRESS
+		+ sizeof(struct sadb_x_kmaddress)
+		+ PFKEY_ALIGN8(2*sysdep_sa_len(local))
+#endif
 		+ sizeof(struct sadb_address)
 		+ PFKEY_ALIGN8(sysdep_sa_len(src))
 		+ sizeof(struct sadb_address)
@@ -1185,6 +1188,13 @@
 		free(newmsg);
 		return -1;
 	}
+#ifdef SADB_X_EXT_KMADDRESS
+	p = pfkey_setsadbkmaddr(p, ep, local, remote);
+	if (!p) {
+		free(newmsg);
+		return -1;
+	}
+#endif
 	p = pfkey_setsadbaddr(p, ep, SADB_EXT_ADDRESS_SRC, src, prefs, proto);
 	if (!p) {
 		free(newmsg);
@@ -1212,8 +1222,7 @@
 
 /* sending SADB_ADD or SADB_UPDATE message to the kernel */
 static int
-pfkey_send_x1(sa_parms)
-	struct pfkey_send_sa_args *sa_parms;
+pfkey_send_x1(struct pfkey_send_sa_args *sa_parms)
 {
 	struct sadb_msg *newmsg;
 	int len;
@@ -1486,11 +1495,8 @@
 /* sending SADB_DELETE or SADB_GET message to the kernel */
 /*ARGSUSED*/
 static int
-pfkey_send_x2(so, type, satype, mode, src, dst, spi)
-	int so;
-	u_int type, satype, mode;
-	struct sockaddr *src, *dst;
-	u_int32_t spi;
+pfkey_send_x2(int so, u_int type, u_int satype, u_int mode,
+    struct sockaddr *src, struct sockaddr *dst, u_int32_t spi)
 {
 	struct sadb_msg *newmsg;
 	int len;
@@ -1573,9 +1579,7 @@
  * to the kernel
  */
 static int
-pfkey_send_x3(so, type, satype)
-	int so;
-	u_int type, satype;
+pfkey_send_x3(int so, u_int type, u_int satype)
 {
 	struct sadb_msg *newmsg;
 	int len;
@@ -1635,15 +1639,9 @@
 
 /* sending SADB_X_SPDADD message to the kernel */
 static int
-pfkey_send_x4(so, type, src, prefs, dst, prefd, proto,
-		ltime, vtime, policy, policylen, seq)
-	int so;
-	struct sockaddr *src, *dst;
-	u_int type, prefs, prefd, proto;
-	u_int64_t ltime, vtime;
-	char *policy;
-	int policylen;
-	u_int32_t seq;
+pfkey_send_x4(int so, u_int type, struct sockaddr *src, u_int prefs,
+    struct sockaddr *dst, u_int prefd, u_int proto, u_int64_t ltime,
+    u_int64_t vtime, char *policy, int policylen, u_int32_t seq)
 {
 	struct sadb_msg *newmsg;
 	int len;
@@ -1729,10 +1727,7 @@
 
 /* sending SADB_X_SPDGET or SADB_X_SPDDELETE message to the kernel */
 static int
-pfkey_send_x5(so, type, spid)
-	int so;
-	u_int type;
-	u_int32_t spid;
+pfkey_send_x5(int so, u_int type, u_int32_t spid)
 {
 	struct sadb_msg *newmsg;
 	struct sadb_x_policy xpl;
@@ -1785,7 +1780,7 @@
  *	others : success and return value of socket.
  */
 int
-pfkey_open()
+pfkey_open(void)
 {
 	int so;
 	int bufsiz = 128 * 1024;	/*is 128K enough?*/
@@ -1811,6 +1806,42 @@
 	return so;
 }
 
+int
+pfkey_set_buffer_size(int so, int size)
+{
+	int newsize;
+	int actual_bufsiz;
+	socklen_t sizebufsiz;
+	int desired_bufsiz;
+
+	/*
+	 * on linux you may need to allow the kernel to allocate
+	 * more buffer space by increasing:
+	 * /proc/sys/net/core/rmem_max and wmem_max
+	 */
+	if (size > 0) {
+		actual_bufsiz = 0;
+		sizebufsiz = sizeof(actual_bufsiz);
+		desired_bufsiz = size * 1024;
+		if ((getsockopt(so, SOL_SOCKET, SO_RCVBUF,
+				&actual_bufsiz, &sizebufsiz) < 0)
+		    || (actual_bufsiz < desired_bufsiz)) {
+			if (setsockopt(so, SOL_SOCKET, SO_RCVBUF,
+				       &desired_bufsiz, sizeof(desired_bufsiz)) < 0) {
+				__ipsec_set_strerror(strerror(errno));
+				return -1;
+			}
+		}
+	}
+
+	/* return actual buffer size */
+	actual_bufsiz = 0;
+	sizebufsiz = sizeof(actual_bufsiz);
+	getsockopt(so, SOL_SOCKET, SO_RCVBUF,
+		   &actual_bufsiz, &sizebufsiz);
+	return actual_bufsiz / 1024;
+}
+
 /*
  * close a socket.
  * OUT:
@@ -1818,8 +1849,7 @@
  *	-1: fail.
  */
 void
-pfkey_close(so)
-	int so;
+pfkey_close(int so)
 {
 	(void)close(so);
 
@@ -1837,8 +1867,7 @@
  * XXX should be rewritten to pass length explicitly
  */
 struct sadb_msg *
-pfkey_recv(so)
-	int so;
+pfkey_recv(int so)
 {
 	struct sadb_msg buf, *newmsg;
 	int len, reallen;
@@ -1895,10 +1924,7 @@
  *	-1     : fail.
  */
 int
-pfkey_send(so, msg, len)
-	int so;
-	struct sadb_msg *msg;
-	int len;
+pfkey_send(int so, struct sadb_msg *msg, int len)
 {
 	if ((len = send(so, (void *)msg, (socklen_t)len, 0)) < 0) {
 		__ipsec_set_strerror(strerror(errno));
@@ -1924,9 +1950,7 @@
  * XXX should be rewritten to obtain length explicitly
  */
 int
-pfkey_align(msg, mhp)
-	struct sadb_msg *msg;
-	caddr_t *mhp;
+pfkey_align(struct sadb_msg *msg, caddr_t *mhp)
 {
 	struct sadb_ext *ext;
 	int i;
@@ -2001,6 +2025,9 @@
 #ifdef SADB_X_EXT_PACKET
 		case SADB_X_EXT_PACKET:
 #endif
+#ifdef SADB_X_EXT_KMADDRESS
+		case SADB_X_EXT_KMADDRESS:
+#endif
 #ifdef SADB_X_EXT_SEC_CTX
 		case SADB_X_EXT_SEC_CTX:
 #endif
@@ -2035,8 +2062,7 @@
  *	 0: valid.
  */
 int
-pfkey_check(mhp)
-	caddr_t *mhp;
+pfkey_check(caddr_t *mhp)
 {
 	struct sadb_msg *msg;
 
@@ -2112,6 +2138,12 @@
 			break;
 		/*FALLTHROUGH*/
 	default:
+#ifdef __linux__
+		/* Linux kernel seems to be buggy and return
+		 * uninitialized satype for spd flush message */
+		if (msg->sadb_msg_type == SADB_X_SPDFLUSH)
+			break;
+#endif
 		__ipsec_errcode = EIPSEC_INVAL_SATYPE;
 		return -1;
 	}
@@ -2159,13 +2191,8 @@
  * `buf' must has been allocated sufficiently.
  */
 static caddr_t
-pfkey_setsadbmsg(buf, lim, type, tlen, satype, seq, pid)
-	caddr_t buf;
-	caddr_t lim;
-	u_int type, satype;
-	u_int tlen;
-	u_int32_t seq;
-	pid_t pid;
+pfkey_setsadbmsg(caddr_t buf, caddr_t lim, u_int type, u_int tlen,
+    u_int satype, u_int32_t seq, pid_t pid)
 {
 	struct sadb_msg *p;
 	u_int len;
@@ -2194,11 +2221,8 @@
  * `buf' must has been allocated sufficiently.
  */
 static caddr_t
-pfkey_setsadbsa(buf, lim, spi, wsize, auth, enc, flags)
-	caddr_t buf;
-	caddr_t lim;
-	u_int32_t spi, flags;
-	u_int wsize, auth, enc;
+pfkey_setsadbsa(caddr_t buf, caddr_t lim, u_int32_t spi, u_int wsize,
+    u_int auth, u_int enc, u_int32_t flags)
 {
 	struct sadb_sa *p;
 	u_int len;
@@ -2228,13 +2252,8 @@
  * prefixlen is in bits.
  */
 static caddr_t
-pfkey_setsadbaddr(buf, lim, exttype, saddr, prefixlen, ul_proto)
-	caddr_t buf;
-	caddr_t lim;
-	u_int exttype;
-	struct sockaddr *saddr;
-	u_int prefixlen;
-	u_int ul_proto;
+pfkey_setsadbaddr(caddr_t buf, caddr_t lim, u_int exttype,
+    struct sockaddr *saddr, u_int prefixlen, u_int ul_proto)
 {
 	struct sadb_address *p;
 	u_int len;
@@ -2257,16 +2276,50 @@
 	return(buf + len);
 }
 
+#ifdef SADB_X_EXT_KMADDRESS
+/*
+ * set data into sadb_x_kmaddress.
+ * `buf' must has been allocated sufficiently.
+ */
+static caddr_t
+pfkey_setsadbkmaddr(caddr_t buf, caddr_t lim, struct sockaddr *local,
+    struct sockaddr *remote)
+{
+	struct sadb_x_kmaddress *p;
+	struct sockaddr *sa;
+	u_int salen = sysdep_sa_len(local);
+	u_int len;
+
+	/* sanity check */
+	if (local->sa_family != remote->sa_family)
+		return NULL;
+
+	p = (void *)buf;
+	len = sizeof(struct sadb_x_kmaddress) + PFKEY_ALIGN8(2*salen);
+
+	if (buf + len > lim)
+		return NULL;
+
+	memset(p, 0, len);
+	p->sadb_x_kmaddress_len = PFKEY_UNIT64(len);
+	p->sadb_x_kmaddress_exttype = SADB_X_EXT_KMADDRESS;
+	p->sadb_x_kmaddress_reserved = 0;
+	sa = (struct sockaddr *)(p + 1);
+	memcpy(sa, local, salen);
+	sa = (struct sockaddr *)((char *)sa + salen);
+	memcpy(sa, remote, salen);
+
+	return(buf + len);
+}
+#endif
+
 /*
  * set sadb_key structure after clearing buffer with zero.
  * OUT: the pointer of buf + len.
  */
 static caddr_t
-pfkey_setsadbkey(buf, lim, type, key, keylen)
-	caddr_t buf;
-	caddr_t lim;
-	caddr_t key;
-	u_int type, keylen;
+pfkey_setsadbkey(caddr_t buf, caddr_t lim, u_int type, caddr_t key,
+    u_int keylen)
 {
 	struct sadb_key *p;
 	u_int len;
@@ -2293,11 +2346,8 @@
  * OUT: the pointer of buf + len.
  */
 static caddr_t
-pfkey_setsadblifetime(buf, lim, type, l_alloc, l_bytes, l_addtime, l_usetime)
-	caddr_t buf;
-	caddr_t lim;
-	u_int type;
-	u_int32_t l_alloc, l_bytes, l_addtime, l_usetime;
+pfkey_setsadblifetime(caddr_t buf, caddr_t lim, u_int type, u_int32_t l_alloc,
+    u_int32_t l_bytes, u_int32_t l_addtime, u_int32_t l_usetime)
 {
 	struct sadb_lifetime *p;
 	u_int len;
@@ -2339,11 +2389,7 @@
  * `buf' must has been allocated sufficiently.
  */
 static caddr_t
-pfkey_setsadbxsa2(buf, lim, mode0, reqid)
-	caddr_t buf;
-	caddr_t lim;
-	u_int32_t mode0;
-	u_int32_t reqid;
+pfkey_setsadbxsa2(caddr_t buf, caddr_t lim, u_int32_t mode0, u_int32_t reqid)
 {
 	struct sadb_x_sa2 *p;
 	u_int8_t mode = mode0 & 0xff;
@@ -2366,11 +2412,7 @@
 
 #ifdef SADB_X_EXT_NAT_T_TYPE
 static caddr_t
-pfkey_set_natt_type(buf, lim, type, l_natt_type)
-	caddr_t buf;
-	caddr_t lim;
-	u_int type;
-	u_int8_t l_natt_type;
+pfkey_set_natt_type(caddr_t buf, caddr_t lim, u_int type, u_int8_t l_natt_type)
 {
 	struct sadb_x_nat_t_type *p;
 	u_int len;
@@ -2390,11 +2432,7 @@
 }
 
 static caddr_t
-pfkey_set_natt_port(buf, lim, type, l_natt_port)
-	caddr_t buf;
-	caddr_t lim;
-	u_int type;
-	u_int16_t l_natt_port;
+pfkey_set_natt_port(caddr_t buf, caddr_t lim, u_int type, u_int16_t l_natt_port)
 {
 	struct sadb_x_nat_t_port *p;
 	u_int len;
@@ -2416,11 +2454,8 @@
 
 #ifdef SADB_X_EXT_NAT_T_FRAG
 static caddr_t
-pfkey_set_natt_frag(buf, lim, type, l_natt_frag)
-	caddr_t buf;
-	caddr_t lim;
-	u_int type;
-	u_int16_t l_natt_frag;
+pfkey_set_natt_frag(caddr_t buf, caddr_t lim, u_int type, 
+    u_int16_t l_natt_frag)
 {
 	struct sadb_x_nat_t_frag *p;
 	u_int len;
@@ -2442,13 +2477,8 @@
 
 #ifdef SADB_X_EXT_SEC_CTX
 static caddr_t
-pfkey_setsecctx(buf, lim, type, ctx_doi, ctx_alg, sec_ctx, sec_ctxlen)
-	caddr_t buf;
-	caddr_t lim;
-	u_int type;
-	u_int8_t ctx_doi, ctx_alg;
-	caddr_t sec_ctx;
-	u_int16_t sec_ctxlen;
+pfkey_setsecctx(caddr_t buf, caddr_t lim, u_int type, u_int8_t ctx_doi,
+    u_int8_t ctx_alg, caddr_t sec_ctx, u_int16_t sec_ctxlen)
 {
 	struct sadb_x_sec_ctx *p;
 	u_int len;
@@ -2477,18 +2507,11 @@
  * libipsec users. Please use pfkey_send_update2 and pfkey_send_add2 instead 
  */
 int
-pfkey_send_update(so, satype, mode, src, dst, spi, reqid, wsize,
-		keymat, e_type, e_keylen, a_type, a_keylen, flags,
-		l_alloc, l_bytes, l_addtime, l_usetime, seq)
-	int so;
-	u_int satype, mode, wsize;
-	struct sockaddr *src, *dst;
-	u_int32_t spi, reqid;
-	caddr_t keymat;
-	u_int e_type, e_keylen, a_type, a_keylen, flags;
-	u_int32_t l_alloc;
-	u_int64_t l_bytes, l_addtime, l_usetime;
-	u_int32_t seq;
+pfkey_send_update(int so, u_int satype, u_int mode, struct sockaddr *src,
+    struct sockaddr *dst, u_int32_t spi, u_int32_t reqid, u_int wsize,
+    caddr_t keymat, u_int e_type, u_int e_keylen, u_int a_type,
+    u_int a_keylen, u_int flags, u_int32_t l_alloc, u_int64_t l_bytes,
+    u_int64_t l_addtime, u_int64_t l_usetime, u_int32_t seq)
 {
 	struct pfkey_send_sa_args psaa;
 
@@ -2518,24 +2541,13 @@
 }
 
 int
-pfkey_send_update_nat(so, satype, mode, src, dst, spi, reqid, wsize,
-		      keymat, e_type, e_keylen, a_type, a_keylen, flags,
-		      l_alloc, l_bytes, l_addtime, l_usetime, seq,
-		      l_natt_type, l_natt_sport, l_natt_dport, l_natt_oa,
-		      l_natt_frag)
-	int so;
-	u_int satype, mode, wsize;
-	struct sockaddr *src, *dst;
-	u_int32_t spi, reqid;
-	caddr_t keymat;
-	u_int e_type, e_keylen, a_type, a_keylen, flags;
-	u_int32_t l_alloc;
-	u_int64_t l_bytes, l_addtime, l_usetime;
-	u_int32_t seq;
-	u_int8_t l_natt_type;
-	u_int16_t l_natt_sport, l_natt_dport;
-	struct sockaddr *l_natt_oa;
-	u_int16_t l_natt_frag;
+pfkey_send_update_nat(int so, u_int satype, u_int mode, struct sockaddr *src,
+    struct sockaddr *dst, u_int32_t spi, u_int32_t reqid, u_int wsize,
+    caddr_t keymat, u_int e_type, u_int e_keylen, u_int a_type,
+    u_int a_keylen, u_int flags, u_int32_t l_alloc, u_int64_t l_bytes,
+    u_int64_t l_addtime, u_int64_t l_usetime, u_int32_t seq,
+    u_int8_t l_natt_type, u_int16_t l_natt_sport, u_int16_t l_natt_dport,
+    struct sockaddr *l_natt_oa, u_int16_t l_natt_frag)
 {
 	struct pfkey_send_sa_args psaa;
 
@@ -2570,18 +2582,11 @@
 }
 
 int
-pfkey_send_add(so, satype, mode, src, dst, spi, reqid, wsize,
-		keymat, e_type, e_keylen, a_type, a_keylen, flags,
-		l_alloc, l_bytes, l_addtime, l_usetime, seq)
-	int so;
-	u_int satype, mode, wsize;
-	struct sockaddr *src, *dst;
-	u_int32_t spi, reqid;
-	caddr_t keymat;
-	u_int e_type, e_keylen, a_type, a_keylen, flags;
-	u_int32_t l_alloc;
-	u_int64_t l_bytes, l_addtime, l_usetime;
-	u_int32_t seq;
+pfkey_send_add(int so, u_int satype, u_int mode, struct sockaddr *src,
+    struct sockaddr *dst, u_int32_t spi, u_int32_t reqid, u_int wsize,
+    caddr_t keymat, u_int e_type, u_int e_keylen, u_int a_type,
+    u_int a_keylen, u_int flags, u_int32_t l_alloc, u_int64_t l_bytes,
+    u_int64_t l_addtime, u_int64_t l_usetime, u_int32_t seq)
 {
 	struct pfkey_send_sa_args psaa;
 
@@ -2611,24 +2616,13 @@
 }
 
 int
-pfkey_send_add_nat(so, satype, mode, src, dst, spi, reqid, wsize,
-		      keymat, e_type, e_keylen, a_type, a_keylen, flags,
-		      l_alloc, l_bytes, l_addtime, l_usetime, seq,
-		      l_natt_type, l_natt_sport, l_natt_dport, l_natt_oa,
-		      l_natt_frag)
-	int so;
-	u_int satype, mode, wsize;
-	struct sockaddr *src, *dst;
-	u_int32_t spi, reqid;
-	caddr_t keymat;
-	u_int e_type, e_keylen, a_type, a_keylen, flags;
-	u_int32_t l_alloc;
-	u_int64_t l_bytes, l_addtime, l_usetime;
-	u_int32_t seq;
-	u_int8_t l_natt_type;
-	u_int16_t l_natt_sport, l_natt_dport;
-	struct sockaddr *l_natt_oa;
-	u_int16_t l_natt_frag;
+pfkey_send_add_nat(int so, u_int satype, u_int mode, struct sockaddr *src,
+    struct sockaddr *dst, u_int32_t spi, u_int32_t reqid, u_int wsize,
+    caddr_t keymat, u_int e_type, u_int e_keylen, u_int a_type,
+    u_int a_keylen, u_int flags, u_int32_t l_alloc, u_int64_t l_bytes,
+    u_int64_t l_addtime, u_int64_t l_usetime, u_int32_t seq,
+    u_int8_t l_natt_type, u_int16_t l_natt_sport, u_int16_t l_natt_dport,
+    struct sockaddr *l_natt_oa, u_int16_t l_natt_frag)
 {
 	struct pfkey_send_sa_args psaa;
 
diff --git a/src/libipsec/pfkey_dump.c b/src/libipsec/pfkey_dump.c
index 8fa4084..4627ebc 100644
--- a/src/libipsec/pfkey_dump.c
+++ b/src/libipsec/pfkey_dump.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: pfkey_dump.c,v 1.15.6.1 2007/08/01 11:52:18 vanhu Exp $	*/
+/*	$NetBSD: pfkey_dump.c,v 1.18 2010/12/03 14:32:52 tteras Exp $	*/
 
 /*	$KAME: pfkey_dump.c,v 1.45 2003/09/08 10:14:56 itojun Exp $	*/
 
@@ -716,13 +716,19 @@
 	else
 		snprintf(prefbuf, sizeof(prefbuf), "/%u", pref);
 
-	if (ulp == IPPROTO_ICMPV6)
+	switch (ulp) {
+	case IPPROTO_ICMP:
+	case IPPROTO_ICMPV6:
+	case IPPROTO_MH:
+	case IPPROTO_GRE:
 		memset(portbuf, 0, sizeof(portbuf));
-	else {
+		break;
+	default:
 		if (port == IPSEC_PORT_ANY)
-			snprintf(portbuf, sizeof(portbuf), "[%s]", "any");
+			strcpy(portbuf, "[any]");
 		else
 			snprintf(portbuf, sizeof(portbuf), "[%u]", port);
+		break;
 	}
 
 	snprintf(buf, sizeof(buf), "%s%s", prefbuf, portbuf);
@@ -734,29 +740,26 @@
 str_upperspec(ulp, p1, p2)
 	u_int ulp, p1, p2;
 {
-	if (ulp == IPSEC_ULPROTO_ANY)
-		printf("any");
-	else if (ulp == IPPROTO_ICMPV6) {
-		printf("icmp6");
-		if (!(p1 == IPSEC_PORT_ANY && p2 == IPSEC_PORT_ANY))
-			printf(" %u,%u", p1, p2);
-	} else {
-		struct protoent *ent;
+	struct protoent *ent;
 
-		switch (ulp) {
-		case IPPROTO_IPV4:
-			printf("ip4");
-			break;
-		default:
-			ent = getprotobynumber((int)ulp);
-			if (ent)
-				printf("%s", ent->p_name);
-			else
-				printf("%u", ulp);
+	ent = getprotobynumber((int)ulp);
+	if (ent)
+		printf("%s", ent->p_name);
+	else
+		printf("%u", ulp);
 
-			endprotoent();
-			break;
-		}
+	if (p1 == IPSEC_PORT_ANY && p2 == IPSEC_PORT_ANY)
+		return;
+
+	switch (ulp) {
+	case IPPROTO_ICMP:
+	case IPPROTO_ICMPV6:
+	case IPPROTO_MH:
+		printf(" %u,%u", p1, p2);
+		break;
+	case IPPROTO_GRE:
+		printf(" %u", (p1 << 16) + p2);
+		break;
 	}
 }
 
@@ -774,8 +777,10 @@
 		for (;i < 20;) buf[i++] = ' ';
 	} else {
 		char *t0;
-		t0 = ctime(&t);
-		memcpy(buf, t0 + 4, 20);
+		if ((t0 = ctime(&t)) == NULL)
+			memset(buf, '?', 20);
+		else
+			memcpy(buf, t0 + 4, 20);
 	}
 
 	buf[20] = '\0';
diff --git a/src/libipsec/policy_parse.h b/src/libipsec/policy_parse.h
index a4c1d0b..dc629dd 100644
--- a/src/libipsec/policy_parse.h
+++ b/src/libipsec/policy_parse.h
@@ -1,24 +1,23 @@
-/* A Bison parser, made by GNU Bison 2.3.  */
+
+/* A Bison parser, made by GNU Bison 2.4.1.  */
 
 /* Skeleton interface for Bison's Yacc-like parsers in C
-
-   Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
+   
+      Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
    Free Software Foundation, Inc.
-
-   This program is free software; you can redistribute it and/or modify
+   
+   This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2, or (at your option)
-   any later version.
-
+   the Free Software Foundation, either version 3 of the License, or
+   (at your option) any later version.
+   
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-
+   
    You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 51 Franklin Street, Fifth Floor,
-   Boston, MA 02110-1301, USA.  */
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
 
 /* As a special exception, you may create a larger work that contains
    part or all of the Bison parser skeleton and distribute that work
@@ -29,10 +28,11 @@
    special exception, which will cause the skeleton and the resulting
    Bison output files to be licensed under the GNU General Public
    License without this special exception.
-
+   
    This special exception was added by the Free Software Foundation in
    version 2.2 of Bison.  */
 
+
 /* Tokens.  */
 #ifndef YYTOKENTYPE
 # define YYTOKENTYPE
@@ -80,22 +80,28 @@
 
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
-#line 129 "policy_parse.y"
 {
+
+/* Line 1676 of yacc.c  */
+#line 129 "policy_parse.y"
+
 	u_int num;
 	u_int32_t num32;
 	struct _val {
 		int len;
 		char *buf;
 	} val;
-}
-/* Line 1489 of yacc.c.  */
-#line 94 "policy_parse.h"
-	YYSTYPE;
+
+
+
+/* Line 1676 of yacc.c  */
+#line 99 "policy_parse.h"
+} YYSTYPE;
+# define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
-# define YYSTYPE_IS_TRIVIAL 1
 #endif
 
 extern YYSTYPE __libipseclval;
 
+
diff --git a/src/libipsec/policy_parse.y b/src/libipsec/policy_parse.y
index a13dc12..321f4f0 100644
--- a/src/libipsec/policy_parse.y
+++ b/src/libipsec/policy_parse.y
@@ -1,4 +1,4 @@
-/*	$NetBSD: policy_parse.y,v 1.9.6.2 2009/02/16 18:38:26 tteras Exp $	*/
+/*	$NetBSD: policy_parse.y,v 1.11 2009/02/16 18:36:21 tteras Exp $	*/
 
 /*	$KAME: policy_parse.y,v 1.21 2003/12/12 08:01:26 itojun Exp $	*/
 
diff --git a/src/libipsec/policy_token.l b/src/libipsec/policy_token.l
index 0833c20..243b678 100644
--- a/src/libipsec/policy_token.l
+++ b/src/libipsec/policy_token.l
@@ -1,4 +1,4 @@
-/*	$NetBSD: policy_token.l,v 1.6.6.1 2007/08/01 11:52:19 vanhu Exp $	*/
+/*	$NetBSD: policy_token.l,v 1.7 2007/07/18 12:07:50 vanhu Exp $	*/
 
 /* Id: policy_token.l,v 1.12 2005/05/05 12:32:18 manubsd Exp */
 
diff --git a/src/racoon/Makefile.am b/src/racoon/Makefile.am
index 202a18e..dbaded9 100644
--- a/src/racoon/Makefile.am
+++ b/src/racoon/Makefile.am
@@ -3,7 +3,7 @@
 sbin_PROGRAMS = racoon racoonctl plainrsa-gen
 noinst_PROGRAMS = eaytest
 include_racoon_HEADERS = racoonctl.h var.h vmbuf.h misc.h gcmalloc.h admin.h \
-	schedule.h sockmisc.h vmbuf.h isakmp_var.h isakmp.h isakmp_xauth.h \
+	schedule.h sockmisc.h isakmp_var.h isakmp.h isakmp_xauth.h \
 	isakmp_cfg.h isakmp_unity.h ipsec_doi.h evt.h
 lib_LTLIBRARIES = libracoon.la
 
@@ -48,6 +48,7 @@
 racoonctl_LDADD = libracoon.la ../libipsec/libipsec.la 
 
 libracoon_la_SOURCES = kmpstat.c vmbuf.c sockmisc.c misc.c
+libracoon_la_CFLAGS = -DNOUSE_PRIVSEP $(AM_CFLAGS)
 
 plainrsa_gen_SOURCES = plainrsa-gen.c plog.c \
 	crypto_openssl.c logger.c 
@@ -88,6 +89,7 @@
    ${man5_MANS} ${man8_MANS} \
    missing/crypto/rijndael/boxes-fst.dat \
    doc/FAQ doc/README.certificate doc/README.gssapi doc/README.plainrsa \
+   doc/README.privsep \
    contrib/sp.pl stats.pl \
    samples/psk.txt.sample  samples/racoon.conf.sample \
    samples/psk.txt.in samples/racoon.conf.in \
diff --git a/src/racoon/Makefile.in b/src/racoon/Makefile.in
index 47e997b..4b4e635 100644
--- a/src/racoon/Makefile.in
+++ b/src/racoon/Makefile.in
@@ -1,8 +1,9 @@
-# Makefile.in generated by automake 1.10.1 from Makefile.am.
+# Makefile.in generated by automake 1.11.1 from Makefile.am.
 # @configure_input@
 
 # Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005, 2006, 2007, 2008  Free Software Foundation, Inc.
+# 2003, 2004, 2005, 2006, 2007, 2008, 2009  Free Software Foundation,
+# Inc.
 # This Makefile.in is free software; the Free Software Foundation
 # gives unlimited permission to copy and/or distribute it,
 # with or without modifications, as long as this notice is preserved.
@@ -20,8 +21,9 @@
 
 VPATH = @srcdir@
 pkgdatadir = $(datadir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
 pkgincludedir = $(includedir)/@PACKAGE@
+pkglibdir = $(libdir)/@PACKAGE@
+pkglibexecdir = $(libexecdir)/@PACKAGE@
 am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
 install_sh_DATA = $(install_sh) -c -m 644
 install_sh_PROGRAM = $(install_sh) -c
@@ -52,21 +54,40 @@
 mkinstalldirs = $(install_sh) -d
 CONFIG_HEADER = $(top_builddir)/config.h
 CONFIG_CLEAN_FILES =
+CONFIG_CLEAN_VPATH_FILES =
 am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
 am__vpath_adj = case $$p in \
     $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
     *) f=$$p;; \
   esac;
-am__strip_dir = `echo $$p | sed -e 's|^.*/||'`;
+am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
+am__install_max = 40
+am__nobase_strip_setup = \
+  srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
+am__nobase_strip = \
+  for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
+am__nobase_list = $(am__nobase_strip_setup); \
+  for p in $$list; do echo "$$p $$p"; done | \
+  sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
+  $(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
+    if (++n[$$2] == $(am__install_max)) \
+      { print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
+    END { for (dir in files) print dir, files[dir] }'
+am__base_list = \
+  sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
+  sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
 am__installdirs = "$(DESTDIR)$(libdir)" "$(DESTDIR)$(sbindir)" \
 	"$(DESTDIR)$(man5dir)" "$(DESTDIR)$(man8dir)" \
 	"$(DESTDIR)$(include_racoondir)"
-libLTLIBRARIES_INSTALL = $(INSTALL)
 LTLIBRARIES = $(lib_LTLIBRARIES)
 libracoon_la_LIBADD =
-am_libracoon_la_OBJECTS = kmpstat.lo vmbuf.lo sockmisc.lo misc.lo
+am_libracoon_la_OBJECTS = libracoon_la-kmpstat.lo \
+	libracoon_la-vmbuf.lo libracoon_la-sockmisc.lo \
+	libracoon_la-misc.lo
 libracoon_la_OBJECTS = $(am_libracoon_la_OBJECTS)
-sbinPROGRAMS_INSTALL = $(INSTALL_PROGRAM)
+libracoon_la_LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) \
+	$(LIBTOOLFLAGS) --mode=link $(CCLD) $(libracoon_la_CFLAGS) \
+	$(CFLAGS) $(AM_LDFLAGS) $(LDFLAGS) -o $@
 PROGRAMS = $(noinst_PROGRAMS) $(sbin_PROGRAMS)
 am_eaytest_OBJECTS = eaytest.$(OBJEXT) plog.$(OBJEXT) logger.$(OBJEXT)
 eaytest_OBJECTS = $(am_eaytest_OBJECTS)
@@ -96,6 +117,7 @@
 DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)
 depcomp = $(SHELL) $(top_srcdir)/depcomp
 am__depfiles_maybe = depfiles
+am__mv = mv -f
 COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
 	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
 LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
@@ -124,10 +146,11 @@
 man8dir = $(mandir)/man8
 NROFF = nroff
 MANS = $(man5_MANS) $(man8_MANS)
-include_racoonHEADERS_INSTALL = $(INSTALL_HEADER)
 HEADERS = $(include_racoon_HEADERS) $(noinst_HEADERS)
 ETAGS = etags
 CTAGS = ctags
+am__tty_colors = \
+red=; grn=; lgn=; blu=; std=
 DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
 ACLOCAL = @ACLOCAL@
 AMTAR = @AMTAR@
@@ -143,23 +166,18 @@
 CPP = @CPP@
 CPPFLAGS = @CPPFLAGS@
 CRYPTOBJS = @CRYPTOBJS@
-CXX = @CXX@
-CXXCPP = @CXXCPP@
-CXXDEPMODE = @CXXDEPMODE@
-CXXFLAGS = @CXXFLAGS@
 CYGPATH_W = @CYGPATH_W@
 DEFS = @DEFS@
 DEPDIR = @DEPDIR@
 DSYMUTIL = @DSYMUTIL@
-ECHO = @ECHO@
+DUMPBIN = @DUMPBIN@
 ECHO_C = @ECHO_C@
 ECHO_N = @ECHO_N@
 ECHO_T = @ECHO_T@
 EGREP = @EGREP@
 EXEEXT = @EXEEXT@
 EXTRA_CRYPTO = @EXTRA_CRYPTO@
-F77 = @F77@
-FFLAGS = @FFLAGS@
+FGREP = @FGREP@
 FRAG_OBJS = @FRAG_OBJS@
 GLIBC_BUGS = @GLIBC_BUGS@
 GREP = @GREP@
@@ -173,6 +191,7 @@
 INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
 KERNEL_INCLUDE = @KERNEL_INCLUDE@
 KRB5_CONFIG = @KRB5_CONFIG@
+LD = @LD@
 LDFLAGS = @LDFLAGS@
 LEX = @LEX@
 LEXLIB = @LEXLIB@
@@ -180,18 +199,24 @@
 LIBOBJS = @LIBOBJS@
 LIBS = @LIBS@
 LIBTOOL = @LIBTOOL@
+LIPO = @LIPO@
 LN_S = @LN_S@
 LTLIBOBJS = @LTLIBOBJS@
 MAKEINFO = @MAKEINFO@
 MKDIR_P = @MKDIR_P@
 NATT_OBJS = @NATT_OBJS@
+NM = @NM@
 NMEDIT = @NMEDIT@
+OBJDUMP = @OBJDUMP@
 OBJEXT = @OBJEXT@
+OTOOL = @OTOOL@
+OTOOL64 = @OTOOL64@
 PACKAGE = @PACKAGE@
 PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
 PACKAGE_NAME = @PACKAGE_NAME@
 PACKAGE_STRING = @PACKAGE_STRING@
 PACKAGE_TARNAME = @PACKAGE_TARNAME@
+PACKAGE_URL = @PACKAGE_URL@
 PACKAGE_VERSION = @PACKAGE_VERSION@
 PATH_SEPARATOR = @PATH_SEPARATOR@
 RANLIB = @RANLIB@
@@ -209,8 +234,7 @@
 abs_top_builddir = @abs_top_builddir@
 abs_top_srcdir = @abs_top_srcdir@
 ac_ct_CC = @ac_ct_CC@
-ac_ct_CXX = @ac_ct_CXX@
-ac_ct_F77 = @ac_ct_F77@
+ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
 am__include = @am__include@
 am__leading_dot = @am__leading_dot@
 am__quote = @am__quote@
@@ -242,6 +266,7 @@
 libexecdir = @libexecdir@
 localedir = @localedir@
 localstatedir = @localstatedir@
+lt_ECHO = @lt_ECHO@
 mandir = @mandir@
 mkdir_p = @mkdir_p@
 oldincludedir = @oldincludedir@
@@ -254,10 +279,11 @@
 srcdir = @srcdir@
 sysconfdir = @sysconfdir@
 target_alias = @target_alias@
+top_build_prefix = @top_build_prefix@
 top_builddir = @top_builddir@
 top_srcdir = @top_srcdir@
 include_racoon_HEADERS = racoonctl.h var.h vmbuf.h misc.h gcmalloc.h admin.h \
-	schedule.h sockmisc.h vmbuf.h isakmp_var.h isakmp.h isakmp_xauth.h \
+	schedule.h sockmisc.h isakmp_var.h isakmp.h isakmp_xauth.h \
 	isakmp_cfg.h isakmp_unity.h ipsec_doi.h evt.h
 
 lib_LTLIBRARIES = libracoon.la
@@ -302,6 +328,7 @@
 racoonctl_SOURCES = racoonctl.c str2val.c 
 racoonctl_LDADD = libracoon.la ../libipsec/libipsec.la 
 libracoon_la_SOURCES = kmpstat.c vmbuf.c sockmisc.c misc.c
+libracoon_la_CFLAGS = -DNOUSE_PRIVSEP $(AM_CFLAGS)
 plainrsa_gen_SOURCES = plainrsa-gen.c plog.c \
 	crypto_openssl.c logger.c 
 
@@ -341,6 +368,7 @@
    ${man5_MANS} ${man8_MANS} \
    missing/crypto/rijndael/boxes-fst.dat \
    doc/FAQ doc/README.certificate doc/README.gssapi doc/README.plainrsa \
+   doc/README.privsep \
    contrib/sp.pl stats.pl \
    samples/psk.txt.sample  samples/racoon.conf.sample \
    samples/psk.txt.in samples/racoon.conf.in \
@@ -362,14 +390,14 @@
 	@for dep in $?; do \
 	  case '$(am__configure_deps)' in \
 	    *$$dep*) \
-	      cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh \
-		&& exit 0; \
+	      ( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
+	        && { if test -f $@; then exit 0; else break; fi; }; \
 	      exit 1;; \
 	  esac; \
 	done; \
-	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign  src/racoon/Makefile'; \
-	cd $(top_srcdir) && \
-	  $(AUTOMAKE) --foreign  src/racoon/Makefile
+	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign src/racoon/Makefile'; \
+	$(am__cd) $(top_srcdir) && \
+	  $(AUTOMAKE) --foreign src/racoon/Makefile
 .PRECIOUS: Makefile
 Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
 	@case '$?' in \
@@ -387,23 +415,28 @@
 	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
 $(ACLOCAL_M4):  $(am__aclocal_m4_deps)
 	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
+$(am__aclocal_m4_deps):
 install-libLTLIBRARIES: $(lib_LTLIBRARIES)
 	@$(NORMAL_INSTALL)
 	test -z "$(libdir)" || $(MKDIR_P) "$(DESTDIR)$(libdir)"
-	@list='$(lib_LTLIBRARIES)'; for p in $$list; do \
+	@list='$(lib_LTLIBRARIES)'; test -n "$(libdir)" || list=; \
+	list2=; for p in $$list; do \
 	  if test -f $$p; then \
-	    f=$(am__strip_dir) \
-	    echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(libLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) '$$p' '$(DESTDIR)$(libdir)/$$f'"; \
-	    $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(libLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) "$$p" "$(DESTDIR)$(libdir)/$$f"; \
+	    list2="$$list2 $$p"; \
 	  else :; fi; \
-	done
+	done; \
+	test -z "$$list2" || { \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 '$(DESTDIR)$(libdir)'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL) $(INSTALL_STRIP_FLAG) $$list2 "$(DESTDIR)$(libdir)"; \
+	}
 
 uninstall-libLTLIBRARIES:
 	@$(NORMAL_UNINSTALL)
-	@list='$(lib_LTLIBRARIES)'; for p in $$list; do \
-	  p=$(am__strip_dir) \
-	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(libdir)/$$p'"; \
-	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(libdir)/$$p"; \
+	@list='$(lib_LTLIBRARIES)'; test -n "$(libdir)" || list=; \
+	for p in $$list; do \
+	  $(am__strip_dir) \
+	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(libdir)/$$f'"; \
+	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(libdir)/$$f"; \
 	done
 
 clean-libLTLIBRARIES:
@@ -415,42 +448,59 @@
 	  rm -f "$${dir}/so_locations"; \
 	done
 libracoon.la: $(libracoon_la_OBJECTS) $(libracoon_la_DEPENDENCIES) 
-	$(LINK) -rpath $(libdir) $(libracoon_la_OBJECTS) $(libracoon_la_LIBADD) $(LIBS)
+	$(libracoon_la_LINK) -rpath $(libdir) $(libracoon_la_OBJECTS) $(libracoon_la_LIBADD) $(LIBS)
 
 clean-noinstPROGRAMS:
-	@list='$(noinst_PROGRAMS)'; for p in $$list; do \
-	  f=`echo $$p|sed 's/$(EXEEXT)$$//'`; \
-	  echo " rm -f $$p $$f"; \
-	  rm -f $$p $$f ; \
-	done
+	@list='$(noinst_PROGRAMS)'; test -n "$$list" || exit 0; \
+	echo " rm -f" $$list; \
+	rm -f $$list || exit $$?; \
+	test -n "$(EXEEXT)" || exit 0; \
+	list=`for p in $$list; do echo "$$p"; done | sed 's/$(EXEEXT)$$//'`; \
+	echo " rm -f" $$list; \
+	rm -f $$list
 install-sbinPROGRAMS: $(sbin_PROGRAMS)
 	@$(NORMAL_INSTALL)
 	test -z "$(sbindir)" || $(MKDIR_P) "$(DESTDIR)$(sbindir)"
-	@list='$(sbin_PROGRAMS)'; for p in $$list; do \
-	  p1=`echo $$p|sed 's/$(EXEEXT)$$//'`; \
-	  if test -f $$p \
-	     || test -f $$p1 \
-	  ; then \
-	    f=`echo "$$p1" | sed 's,^.*/,,;$(transform);s/$$/$(EXEEXT)/'`; \
-	   echo " $(INSTALL_PROGRAM_ENV) $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(sbinPROGRAMS_INSTALL) '$$p' '$(DESTDIR)$(sbindir)/$$f'"; \
-	   $(INSTALL_PROGRAM_ENV) $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(sbinPROGRAMS_INSTALL) "$$p" "$(DESTDIR)$(sbindir)/$$f" || exit 1; \
-	  else :; fi; \
-	done
+	@list='$(sbin_PROGRAMS)'; test -n "$(sbindir)" || list=; \
+	for p in $$list; do echo "$$p $$p"; done | \
+	sed 's/$(EXEEXT)$$//' | \
+	while read p p1; do if test -f $$p || test -f $$p1; \
+	  then echo "$$p"; echo "$$p"; else :; fi; \
+	done | \
+	sed -e 'p;s,.*/,,;n;h' -e 's|.*|.|' \
+	    -e 'p;x;s,.*/,,;s/$(EXEEXT)$$//;$(transform);s/$$/$(EXEEXT)/' | \
+	sed 'N;N;N;s,\n, ,g' | \
+	$(AWK) 'BEGIN { files["."] = ""; dirs["."] = 1 } \
+	  { d=$$3; if (dirs[d] != 1) { print "d", d; dirs[d] = 1 } \
+	    if ($$2 == $$4) files[d] = files[d] " " $$1; \
+	    else { print "f", $$3 "/" $$4, $$1; } } \
+	  END { for (d in files) print "f", d, files[d] }' | \
+	while read type dir files; do \
+	    if test "$$dir" = .; then dir=; else dir=/$$dir; fi; \
+	    test -z "$$files" || { \
+	    echo " $(INSTALL_PROGRAM_ENV) $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL_PROGRAM) $$files '$(DESTDIR)$(sbindir)$$dir'"; \
+	    $(INSTALL_PROGRAM_ENV) $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(INSTALL_PROGRAM) $$files "$(DESTDIR)$(sbindir)$$dir" || exit $$?; \
+	    } \
+	; done
 
 uninstall-sbinPROGRAMS:
 	@$(NORMAL_UNINSTALL)
-	@list='$(sbin_PROGRAMS)'; for p in $$list; do \
-	  f=`echo "$$p" | sed 's,^.*/,,;s/$(EXEEXT)$$//;$(transform);s/$$/$(EXEEXT)/'`; \
-	  echo " rm -f '$(DESTDIR)$(sbindir)/$$f'"; \
-	  rm -f "$(DESTDIR)$(sbindir)/$$f"; \
-	done
+	@list='$(sbin_PROGRAMS)'; test -n "$(sbindir)" || list=; \
+	files=`for p in $$list; do echo "$$p"; done | \
+	  sed -e 'h;s,^.*/,,;s/$(EXEEXT)$$//;$(transform)' \
+	      -e 's/$$/$(EXEEXT)/' `; \
+	test -n "$$list" || exit 0; \
+	echo " ( cd '$(DESTDIR)$(sbindir)' && rm -f" $$files ")"; \
+	cd "$(DESTDIR)$(sbindir)" && rm -f $$files
 
 clean-sbinPROGRAMS:
-	@list='$(sbin_PROGRAMS)'; for p in $$list; do \
-	  f=`echo $$p|sed 's/$(EXEEXT)$$//'`; \
-	  echo " rm -f $$p $$f"; \
-	  rm -f $$p $$f ; \
-	done
+	@list='$(sbin_PROGRAMS)'; test -n "$$list" || exit 0; \
+	echo " rm -f" $$list; \
+	rm -f $$list || exit $$?; \
+	test -n "$(EXEEXT)" || exit 0; \
+	list=`for p in $$list; do echo "$$p"; done | sed 's/$(EXEEXT)$$//'`; \
+	echo " rm -f" $$list; \
+	rm -f $$list
 eaytest$(EXEEXT): $(eaytest_OBJECTS) $(eaytest_DEPENDENCIES) 
 	@rm -f eaytest$(EXEEXT)
 	$(LINK) $(eaytest_OBJECTS) $(eaytest_LDADD) $(LIBS)
@@ -506,11 +556,13 @@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/isakmp_quick.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/isakmp_unity.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/isakmp_xauth.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/kmpstat.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libracoon_la-kmpstat.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libracoon_la-misc.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libracoon_la-sockmisc.Plo@am__quote@
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libracoon_la-vmbuf.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/localconf.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/logger.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/main.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/misc.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/nattraversal.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/oakley.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pfkey.Po@am__quote@
@@ -532,51 +584,77 @@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/security.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/session.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/sha2.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/sockmisc.Plo@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/str2val.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/strnames.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/throttle.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/vendorid.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/vmbuf.Plo@am__quote@
 
 .c.o:
 @am__fastdepCC_TRUE@	$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@	mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(COMPILE) -c $<
 
 .c.obj:
 @am__fastdepCC_TRUE@	$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
-@am__fastdepCC_TRUE@	mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(COMPILE) -c `$(CYGPATH_W) '$<'`
 
 .c.lo:
 @am__fastdepCC_TRUE@	$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@	mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(LTCOMPILE) -c -o $@ $<
 
+libracoon_la-kmpstat.lo: kmpstat.c
+@am__fastdepCC_TRUE@	$(LIBTOOL)  --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libracoon_la_CFLAGS) $(CFLAGS) -MT libracoon_la-kmpstat.lo -MD -MP -MF $(DEPDIR)/libracoon_la-kmpstat.Tpo -c -o libracoon_la-kmpstat.lo `test -f 'kmpstat.c' || echo '$(srcdir)/'`kmpstat.c
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/libracoon_la-kmpstat.Tpo $(DEPDIR)/libracoon_la-kmpstat.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='kmpstat.c' object='libracoon_la-kmpstat.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(LIBTOOL)  --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libracoon_la_CFLAGS) $(CFLAGS) -c -o libracoon_la-kmpstat.lo `test -f 'kmpstat.c' || echo '$(srcdir)/'`kmpstat.c
+
+libracoon_la-vmbuf.lo: vmbuf.c
+@am__fastdepCC_TRUE@	$(LIBTOOL)  --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libracoon_la_CFLAGS) $(CFLAGS) -MT libracoon_la-vmbuf.lo -MD -MP -MF $(DEPDIR)/libracoon_la-vmbuf.Tpo -c -o libracoon_la-vmbuf.lo `test -f 'vmbuf.c' || echo '$(srcdir)/'`vmbuf.c
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/libracoon_la-vmbuf.Tpo $(DEPDIR)/libracoon_la-vmbuf.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='vmbuf.c' object='libracoon_la-vmbuf.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(LIBTOOL)  --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libracoon_la_CFLAGS) $(CFLAGS) -c -o libracoon_la-vmbuf.lo `test -f 'vmbuf.c' || echo '$(srcdir)/'`vmbuf.c
+
+libracoon_la-sockmisc.lo: sockmisc.c
+@am__fastdepCC_TRUE@	$(LIBTOOL)  --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libracoon_la_CFLAGS) $(CFLAGS) -MT libracoon_la-sockmisc.lo -MD -MP -MF $(DEPDIR)/libracoon_la-sockmisc.Tpo -c -o libracoon_la-sockmisc.lo `test -f 'sockmisc.c' || echo '$(srcdir)/'`sockmisc.c
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/libracoon_la-sockmisc.Tpo $(DEPDIR)/libracoon_la-sockmisc.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='sockmisc.c' object='libracoon_la-sockmisc.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(LIBTOOL)  --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libracoon_la_CFLAGS) $(CFLAGS) -c -o libracoon_la-sockmisc.lo `test -f 'sockmisc.c' || echo '$(srcdir)/'`sockmisc.c
+
+libracoon_la-misc.lo: misc.c
+@am__fastdepCC_TRUE@	$(LIBTOOL)  --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libracoon_la_CFLAGS) $(CFLAGS) -MT libracoon_la-misc.lo -MD -MP -MF $(DEPDIR)/libracoon_la-misc.Tpo -c -o libracoon_la-misc.lo `test -f 'misc.c' || echo '$(srcdir)/'`misc.c
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/libracoon_la-misc.Tpo $(DEPDIR)/libracoon_la-misc.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='misc.c' object='libracoon_la-misc.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(LIBTOOL)  --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(libracoon_la_CFLAGS) $(CFLAGS) -c -o libracoon_la-misc.lo `test -f 'misc.c' || echo '$(srcdir)/'`misc.c
+
 sha2.obj: missing/crypto/sha2/sha2.c
 @am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT sha2.obj -MD -MP -MF $(DEPDIR)/sha2.Tpo -c -o sha2.obj `if test -f 'missing/crypto/sha2/sha2.c'; then $(CYGPATH_W) 'missing/crypto/sha2/sha2.c'; else $(CYGPATH_W) '$(srcdir)/missing/crypto/sha2/sha2.c'; fi`
-@am__fastdepCC_TRUE@	mv -f $(DEPDIR)/sha2.Tpo $(DEPDIR)/sha2.Po
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/sha2.Tpo $(DEPDIR)/sha2.Po
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	source='missing/crypto/sha2/sha2.c' object='sha2.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o sha2.obj `if test -f 'missing/crypto/sha2/sha2.c'; then $(CYGPATH_W) 'missing/crypto/sha2/sha2.c'; else $(CYGPATH_W) '$(srcdir)/missing/crypto/sha2/sha2.c'; fi`
 
 rijndael-api-fst.obj: missing/crypto/rijndael/rijndael-api-fst.c
 @am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT rijndael-api-fst.obj -MD -MP -MF $(DEPDIR)/rijndael-api-fst.Tpo -c -o rijndael-api-fst.obj `if test -f 'missing/crypto/rijndael/rijndael-api-fst.c'; then $(CYGPATH_W) 'missing/crypto/rijndael/rijndael-api-fst.c'; else $(CYGPATH_W) '$(srcdir)/missing/crypto/rijndael/rijndael-api-fst.c'; fi`
-@am__fastdepCC_TRUE@	mv -f $(DEPDIR)/rijndael-api-fst.Tpo $(DEPDIR)/rijndael-api-fst.Po
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/rijndael-api-fst.Tpo $(DEPDIR)/rijndael-api-fst.Po
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	source='missing/crypto/rijndael/rijndael-api-fst.c' object='rijndael-api-fst.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o rijndael-api-fst.obj `if test -f 'missing/crypto/rijndael/rijndael-api-fst.c'; then $(CYGPATH_W) 'missing/crypto/rijndael/rijndael-api-fst.c'; else $(CYGPATH_W) '$(srcdir)/missing/crypto/rijndael/rijndael-api-fst.c'; fi`
 
 rijndael-alg-fst.obj: missing/crypto/rijndael/rijndael-alg-fst.c
 @am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT rijndael-alg-fst.obj -MD -MP -MF $(DEPDIR)/rijndael-alg-fst.Tpo -c -o rijndael-alg-fst.obj `if test -f 'missing/crypto/rijndael/rijndael-alg-fst.c'; then $(CYGPATH_W) 'missing/crypto/rijndael/rijndael-alg-fst.c'; else $(CYGPATH_W) '$(srcdir)/missing/crypto/rijndael/rijndael-alg-fst.c'; fi`
-@am__fastdepCC_TRUE@	mv -f $(DEPDIR)/rijndael-alg-fst.Tpo $(DEPDIR)/rijndael-alg-fst.Po
+@am__fastdepCC_TRUE@	$(am__mv) $(DEPDIR)/rijndael-alg-fst.Tpo $(DEPDIR)/rijndael-alg-fst.Po
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	source='missing/crypto/rijndael/rijndael-alg-fst.c' object='rijndael-alg-fst.obj' libtool=no @AMDEPBACKSLASH@
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o rijndael-alg-fst.obj `if test -f 'missing/crypto/rijndael/rijndael-alg-fst.c'; then $(CYGPATH_W) 'missing/crypto/rijndael/rijndael-alg-fst.c'; else $(CYGPATH_W) '$(srcdir)/missing/crypto/rijndael/rijndael-alg-fst.c'; fi`
@@ -592,127 +670,108 @@
 
 clean-libtool:
 	-rm -rf .libs _libs
-install-man5: $(man5_MANS) $(man_MANS)
+install-man5: $(man5_MANS)
 	@$(NORMAL_INSTALL)
 	test -z "$(man5dir)" || $(MKDIR_P) "$(DESTDIR)$(man5dir)"
-	@list='$(man5_MANS) $(dist_man5_MANS) $(nodist_man5_MANS)'; \
-	l2='$(man_MANS) $(dist_man_MANS) $(nodist_man_MANS)'; \
-	for i in $$l2; do \
-	  case "$$i" in \
-	    *.5*) list="$$list $$i" ;; \
-	  esac; \
+	@list='$(man5_MANS)'; test -n "$(man5dir)" || exit 0; \
+	{ for i in $$list; do echo "$$i"; done; \
+	} | while read p; do \
+	  if test -f $$p; then d=; else d="$(srcdir)/"; fi; \
+	  echo "$$d$$p"; echo "$$p"; \
+	done | \
+	sed -e 'n;s,.*/,,;p;h;s,.*\.,,;s,^[^5][0-9a-z]*$$,5,;x' \
+	      -e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,' | \
+	sed 'N;N;s,\n, ,g' | { \
+	list=; while read file base inst; do \
+	  if test "$$base" = "$$inst"; then list="$$list $$file"; else \
+	    echo " $(INSTALL_DATA) '$$file' '$(DESTDIR)$(man5dir)/$$inst'"; \
+	    $(INSTALL_DATA) "$$file" "$(DESTDIR)$(man5dir)/$$inst" || exit $$?; \
+	  fi; \
 	done; \
-	for i in $$list; do \
-	  if test -f $(srcdir)/$$i; then file=$(srcdir)/$$i; \
-	  else file=$$i; fi; \
-	  ext=`echo $$i | sed -e 's/^.*\\.//'`; \
-	  case "$$ext" in \
-	    5*) ;; \
-	    *) ext='5' ;; \
-	  esac; \
-	  inst=`echo $$i | sed -e 's/\\.[0-9a-z]*$$//'`; \
-	  inst=`echo $$inst | sed -e 's/^.*\///'`; \
-	  inst=`echo $$inst | sed '$(transform)'`.$$ext; \
-	  echo " $(INSTALL_DATA) '$$file' '$(DESTDIR)$(man5dir)/$$inst'"; \
-	  $(INSTALL_DATA) "$$file" "$(DESTDIR)$(man5dir)/$$inst"; \
-	done
+	for i in $$list; do echo "$$i"; done | $(am__base_list) | \
+	while read files; do \
+	  test -z "$$files" || { \
+	    echo " $(INSTALL_DATA) $$files '$(DESTDIR)$(man5dir)'"; \
+	    $(INSTALL_DATA) $$files "$(DESTDIR)$(man5dir)" || exit $$?; }; \
+	done; }
+
 uninstall-man5:
 	@$(NORMAL_UNINSTALL)
-	@list='$(man5_MANS) $(dist_man5_MANS) $(nodist_man5_MANS)'; \
-	l2='$(man_MANS) $(dist_man_MANS) $(nodist_man_MANS)'; \
-	for i in $$l2; do \
-	  case "$$i" in \
-	    *.5*) list="$$list $$i" ;; \
-	  esac; \
-	done; \
-	for i in $$list; do \
-	  ext=`echo $$i | sed -e 's/^.*\\.//'`; \
-	  case "$$ext" in \
-	    5*) ;; \
-	    *) ext='5' ;; \
-	  esac; \
-	  inst=`echo $$i | sed -e 's/\\.[0-9a-z]*$$//'`; \
-	  inst=`echo $$inst | sed -e 's/^.*\///'`; \
-	  inst=`echo $$inst | sed '$(transform)'`.$$ext; \
-	  echo " rm -f '$(DESTDIR)$(man5dir)/$$inst'"; \
-	  rm -f "$(DESTDIR)$(man5dir)/$$inst"; \
-	done
-install-man8: $(man8_MANS) $(man_MANS)
+	@list='$(man5_MANS)'; test -n "$(man5dir)" || exit 0; \
+	files=`{ for i in $$list; do echo "$$i"; done; \
+	} | sed -e 's,.*/,,;h;s,.*\.,,;s,^[^5][0-9a-z]*$$,5,;x' \
+	      -e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,'`; \
+	test -z "$$files" || { \
+	  echo " ( cd '$(DESTDIR)$(man5dir)' && rm -f" $$files ")"; \
+	  cd "$(DESTDIR)$(man5dir)" && rm -f $$files; }
+install-man8: $(man8_MANS)
 	@$(NORMAL_INSTALL)
 	test -z "$(man8dir)" || $(MKDIR_P) "$(DESTDIR)$(man8dir)"
-	@list='$(man8_MANS) $(dist_man8_MANS) $(nodist_man8_MANS)'; \
-	l2='$(man_MANS) $(dist_man_MANS) $(nodist_man_MANS)'; \
-	for i in $$l2; do \
-	  case "$$i" in \
-	    *.8*) list="$$list $$i" ;; \
-	  esac; \
+	@list='$(man8_MANS)'; test -n "$(man8dir)" || exit 0; \
+	{ for i in $$list; do echo "$$i"; done; \
+	} | while read p; do \
+	  if test -f $$p; then d=; else d="$(srcdir)/"; fi; \
+	  echo "$$d$$p"; echo "$$p"; \
+	done | \
+	sed -e 'n;s,.*/,,;p;h;s,.*\.,,;s,^[^8][0-9a-z]*$$,8,;x' \
+	      -e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,' | \
+	sed 'N;N;s,\n, ,g' | { \
+	list=; while read file base inst; do \
+	  if test "$$base" = "$$inst"; then list="$$list $$file"; else \
+	    echo " $(INSTALL_DATA) '$$file' '$(DESTDIR)$(man8dir)/$$inst'"; \
+	    $(INSTALL_DATA) "$$file" "$(DESTDIR)$(man8dir)/$$inst" || exit $$?; \
+	  fi; \
 	done; \
-	for i in $$list; do \
-	  if test -f $(srcdir)/$$i; then file=$(srcdir)/$$i; \
-	  else file=$$i; fi; \
-	  ext=`echo $$i | sed -e 's/^.*\\.//'`; \
-	  case "$$ext" in \
-	    8*) ;; \
-	    *) ext='8' ;; \
-	  esac; \
-	  inst=`echo $$i | sed -e 's/\\.[0-9a-z]*$$//'`; \
-	  inst=`echo $$inst | sed -e 's/^.*\///'`; \
-	  inst=`echo $$inst | sed '$(transform)'`.$$ext; \
-	  echo " $(INSTALL_DATA) '$$file' '$(DESTDIR)$(man8dir)/$$inst'"; \
-	  $(INSTALL_DATA) "$$file" "$(DESTDIR)$(man8dir)/$$inst"; \
-	done
+	for i in $$list; do echo "$$i"; done | $(am__base_list) | \
+	while read files; do \
+	  test -z "$$files" || { \
+	    echo " $(INSTALL_DATA) $$files '$(DESTDIR)$(man8dir)'"; \
+	    $(INSTALL_DATA) $$files "$(DESTDIR)$(man8dir)" || exit $$?; }; \
+	done; }
+
 uninstall-man8:
 	@$(NORMAL_UNINSTALL)
-	@list='$(man8_MANS) $(dist_man8_MANS) $(nodist_man8_MANS)'; \
-	l2='$(man_MANS) $(dist_man_MANS) $(nodist_man_MANS)'; \
-	for i in $$l2; do \
-	  case "$$i" in \
-	    *.8*) list="$$list $$i" ;; \
-	  esac; \
-	done; \
-	for i in $$list; do \
-	  ext=`echo $$i | sed -e 's/^.*\\.//'`; \
-	  case "$$ext" in \
-	    8*) ;; \
-	    *) ext='8' ;; \
-	  esac; \
-	  inst=`echo $$i | sed -e 's/\\.[0-9a-z]*$$//'`; \
-	  inst=`echo $$inst | sed -e 's/^.*\///'`; \
-	  inst=`echo $$inst | sed '$(transform)'`.$$ext; \
-	  echo " rm -f '$(DESTDIR)$(man8dir)/$$inst'"; \
-	  rm -f "$(DESTDIR)$(man8dir)/$$inst"; \
-	done
+	@list='$(man8_MANS)'; test -n "$(man8dir)" || exit 0; \
+	files=`{ for i in $$list; do echo "$$i"; done; \
+	} | sed -e 's,.*/,,;h;s,.*\.,,;s,^[^8][0-9a-z]*$$,8,;x' \
+	      -e 's,\.[0-9a-z]*$$,,;$(transform);G;s,\n,.,'`; \
+	test -z "$$files" || { \
+	  echo " ( cd '$(DESTDIR)$(man8dir)' && rm -f" $$files ")"; \
+	  cd "$(DESTDIR)$(man8dir)" && rm -f $$files; }
 install-include_racoonHEADERS: $(include_racoon_HEADERS)
 	@$(NORMAL_INSTALL)
 	test -z "$(include_racoondir)" || $(MKDIR_P) "$(DESTDIR)$(include_racoondir)"
-	@list='$(include_racoon_HEADERS)'; for p in $$list; do \
+	@list='$(include_racoon_HEADERS)'; test -n "$(include_racoondir)" || list=; \
+	for p in $$list; do \
 	  if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
-	  f=$(am__strip_dir) \
-	  echo " $(include_racoonHEADERS_INSTALL) '$$d$$p' '$(DESTDIR)$(include_racoondir)/$$f'"; \
-	  $(include_racoonHEADERS_INSTALL) "$$d$$p" "$(DESTDIR)$(include_racoondir)/$$f"; \
+	  echo "$$d$$p"; \
+	done | $(am__base_list) | \
+	while read files; do \
+	  echo " $(INSTALL_HEADER) $$files '$(DESTDIR)$(include_racoondir)'"; \
+	  $(INSTALL_HEADER) $$files "$(DESTDIR)$(include_racoondir)" || exit $$?; \
 	done
 
 uninstall-include_racoonHEADERS:
 	@$(NORMAL_UNINSTALL)
-	@list='$(include_racoon_HEADERS)'; for p in $$list; do \
-	  f=$(am__strip_dir) \
-	  echo " rm -f '$(DESTDIR)$(include_racoondir)/$$f'"; \
-	  rm -f "$(DESTDIR)$(include_racoondir)/$$f"; \
-	done
+	@list='$(include_racoon_HEADERS)'; test -n "$(include_racoondir)" || list=; \
+	files=`for p in $$list; do echo $$p; done | sed -e 's|^.*/||'`; \
+	test -n "$$files" || exit 0; \
+	echo " ( cd '$(DESTDIR)$(include_racoondir)' && rm -f" $$files ")"; \
+	cd "$(DESTDIR)$(include_racoondir)" && rm -f $$files
 
 ID: $(HEADERS) $(SOURCES) $(LISP) $(TAGS_FILES)
 	list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
 	unique=`for i in $$list; do \
 	    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
 	  done | \
-	  $(AWK) '{ files[$$0] = 1; nonemtpy = 1; } \
+	  $(AWK) '{ files[$$0] = 1; nonempty = 1; } \
 	      END { if (nonempty) { for (i in files) print i; }; }'`; \
 	mkid -fID $$unique
 tags: TAGS
 
 TAGS:  $(HEADERS) $(SOURCES)  $(TAGS_DEPENDENCIES) \
 		$(TAGS_FILES) $(LISP)
-	tags=; \
+	set x; \
 	here=`pwd`; \
 	list='$(SOURCES) $(HEADERS)  $(LISP) $(TAGS_FILES)'; \
 	unique=`for i in $$list; do \
@@ -720,37 +779,43 @@
 	  done | \
 	  $(AWK) '{ files[$$0] = 1; nonempty = 1; } \
 	      END { if (nonempty) { for (i in files) print i; }; }'`; \
-	if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
+	shift; \
+	if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
 	  test -n "$$unique" || unique=$$empty_fix; \
-	  $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
-	    $$tags $$unique; \
+	  if test $$# -gt 0; then \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      "$$@" $$unique; \
+	  else \
+	    $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
+	      $$unique; \
+	  fi; \
 	fi
 ctags: CTAGS
 CTAGS:  $(HEADERS) $(SOURCES)  $(TAGS_DEPENDENCIES) \
 		$(TAGS_FILES) $(LISP)
-	tags=; \
 	list='$(SOURCES) $(HEADERS)  $(LISP) $(TAGS_FILES)'; \
 	unique=`for i in $$list; do \
 	    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
 	  done | \
 	  $(AWK) '{ files[$$0] = 1; nonempty = 1; } \
 	      END { if (nonempty) { for (i in files) print i; }; }'`; \
-	test -z "$(CTAGS_ARGS)$$tags$$unique" \
+	test -z "$(CTAGS_ARGS)$$unique" \
 	  || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
-	     $$tags $$unique
+	     $$unique
 
 GTAGS:
 	here=`$(am__cd) $(top_builddir) && pwd` \
-	  && cd $(top_srcdir) \
-	  && gtags -i $(GTAGS_ARGS) $$here
+	  && $(am__cd) $(top_srcdir) \
+	  && gtags -i $(GTAGS_ARGS) "$$here"
 
 distclean-tags:
 	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
 
 check-TESTS: $(TESTS)
-	@failed=0; all=0; xfail=0; xpass=0; skip=0; ws='[	 ]'; \
+	@failed=0; all=0; xfail=0; xpass=0; skip=0; \
 	srcdir=$(srcdir); export srcdir; \
 	list=' $(TESTS) '; \
+	$(am__tty_colors); \
 	if test -n "$$list"; then \
 	  for tst in $$list; do \
 	    if test -f ./$$tst; then dir=./; \
@@ -759,49 +824,63 @@
 	    if $(TESTS_ENVIRONMENT) $${dir}$$tst; then \
 	      all=`expr $$all + 1`; \
 	      case " $(XFAIL_TESTS) " in \
-	      *$$ws$$tst$$ws*) \
+	      *[\ \	]$$tst[\ \	]*) \
 		xpass=`expr $$xpass + 1`; \
 		failed=`expr $$failed + 1`; \
-		echo "XPASS: $$tst"; \
+		col=$$red; res=XPASS; \
 	      ;; \
 	      *) \
-		echo "PASS: $$tst"; \
+		col=$$grn; res=PASS; \
 	      ;; \
 	      esac; \
 	    elif test $$? -ne 77; then \
 	      all=`expr $$all + 1`; \
 	      case " $(XFAIL_TESTS) " in \
-	      *$$ws$$tst$$ws*) \
+	      *[\ \	]$$tst[\ \	]*) \
 		xfail=`expr $$xfail + 1`; \
-		echo "XFAIL: $$tst"; \
+		col=$$lgn; res=XFAIL; \
 	      ;; \
 	      *) \
 		failed=`expr $$failed + 1`; \
-		echo "FAIL: $$tst"; \
+		col=$$red; res=FAIL; \
 	      ;; \
 	      esac; \
 	    else \
 	      skip=`expr $$skip + 1`; \
-	      echo "SKIP: $$tst"; \
+	      col=$$blu; res=SKIP; \
 	    fi; \
+	    echo "$${col}$$res$${std}: $$tst"; \
 	  done; \
+	  if test "$$all" -eq 1; then \
+	    tests="test"; \
+	    All=""; \
+	  else \
+	    tests="tests"; \
+	    All="All "; \
+	  fi; \
 	  if test "$$failed" -eq 0; then \
 	    if test "$$xfail" -eq 0; then \
-	      banner="All $$all tests passed"; \
+	      banner="$$All$$all $$tests passed"; \
 	    else \
-	      banner="All $$all tests behaved as expected ($$xfail expected failures)"; \
+	      if test "$$xfail" -eq 1; then failures=failure; else failures=failures; fi; \
+	      banner="$$All$$all $$tests behaved as expected ($$xfail expected $$failures)"; \
 	    fi; \
 	  else \
 	    if test "$$xpass" -eq 0; then \
-	      banner="$$failed of $$all tests failed"; \
+	      banner="$$failed of $$all $$tests failed"; \
 	    else \
-	      banner="$$failed of $$all tests did not behave as expected ($$xpass unexpected passes)"; \
+	      if test "$$xpass" -eq 1; then passes=pass; else passes=passes; fi; \
+	      banner="$$failed of $$all $$tests did not behave as expected ($$xpass unexpected $$passes)"; \
 	    fi; \
 	  fi; \
 	  dashes="$$banner"; \
 	  skipped=""; \
 	  if test "$$skip" -ne 0; then \
-	    skipped="($$skip tests were not run)"; \
+	    if test "$$skip" -eq 1; then \
+	      skipped="($$skip test was not run)"; \
+	    else \
+	      skipped="($$skip tests were not run)"; \
+	    fi; \
 	    test `echo "$$skipped" | wc -c` -le `echo "$$banner" | wc -c` || \
 	      dashes="$$skipped"; \
 	  fi; \
@@ -812,15 +891,32 @@
 	      dashes="$$report"; \
 	  fi; \
 	  dashes=`echo "$$dashes" | sed s/./=/g`; \
-	  echo "$$dashes"; \
+	  if test "$$failed" -eq 0; then \
+	    echo "$$grn$$dashes"; \
+	  else \
+	    echo "$$red$$dashes"; \
+	  fi; \
 	  echo "$$banner"; \
 	  test -z "$$skipped" || echo "$$skipped"; \
 	  test -z "$$report" || echo "$$report"; \
-	  echo "$$dashes"; \
+	  echo "$$dashes$$std"; \
 	  test "$$failed" -eq 0; \
 	else :; fi
 
 distdir: $(DISTFILES)
+	@list='$(MANS)'; if test -n "$$list"; then \
+	  list=`for p in $$list; do \
+	    if test -f $$p; then d=; else d="$(srcdir)/"; fi; \
+	    if test -f "$$d$$p"; then echo "$$d$$p"; else :; fi; done`; \
+	  if test -n "$$list" && \
+	    grep 'ab help2man is required to generate this page' $$list >/dev/null; then \
+	    echo "error: found man pages containing the \`missing help2man' replacement text:" >&2; \
+	    grep -l 'ab help2man is required to generate this page' $$list | sed 's/^/         /' >&2; \
+	    echo "       to fix them, install help2man, remove and regenerate the man pages;" >&2; \
+	    echo "       typically \`make maintainer-clean' will remove them" >&2; \
+	    exit 1; \
+	  else :; fi; \
+	else :; fi
 	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
 	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
 	list='$(DISTFILES)'; \
@@ -836,13 +932,17 @@
 	  if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
 	  if test -d $$d/$$file; then \
 	    dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
-	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
-	      cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
+	    if test -d "$(distdir)/$$file"; then \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
 	    fi; \
-	    cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
+	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
+	      cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
+	      find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
+	    fi; \
+	    cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
 	  else \
-	    test -f $(distdir)/$$file \
-	    || cp -p $$d/$$file $(distdir)/$$file \
+	    test -f "$(distdir)/$$file" \
+	    || cp -p $$d/$$file "$(distdir)/$$file" \
 	    || exit 1; \
 	  fi; \
 	done
@@ -876,6 +976,7 @@
 
 distclean-generic:
 	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
+	-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
 
 maintainer-clean-generic:
 	@echo "This command is intended for maintainers to use"
@@ -904,6 +1005,8 @@
 
 html: html-am
 
+html-am:
+
 info: info-am
 
 info-am:
@@ -912,19 +1015,29 @@
 
 install-dvi: install-dvi-am
 
+install-dvi-am:
+
 install-exec-am: install-exec-local install-libLTLIBRARIES \
 	install-sbinPROGRAMS
 
 install-html: install-html-am
 
+install-html-am:
+
 install-info: install-info-am
 
+install-info-am:
+
 install-man: install-man5 install-man8
 
 install-pdf: install-pdf-am
 
+install-pdf-am:
+
 install-ps: install-ps-am
 
+install-ps-am:
+
 installcheck-am:
 
 maintainer-clean: maintainer-clean-am
@@ -950,7 +1063,7 @@
 
 uninstall-man: uninstall-man5 uninstall-man8
 
-.MAKE: install-am install-strip
+.MAKE: all check check-am install install-am install-strip
 
 .PHONY: CTAGS GTAGS all all-am check check-TESTS check-am clean \
 	clean-generic clean-libLTLIBRARIES clean-libtool \
@@ -995,6 +1108,7 @@
 	$(COMPILE) -c $(srcdir)/missing/crypto/rijndael/$*.c
 sha2.o: $(srcdir)/missing/crypto/sha2/sha2.c
 	$(COMPILE) -c $(srcdir)/missing/crypto/sha2/$*.c
+
 # Tell versions [3.59,3.63) of GNU make to not export all variables.
 # Otherwise a system limit (for SysV at least) may be exceeded.
 .NOEXPORT:
diff --git a/src/racoon/admin.c b/src/racoon/admin.c
index b56dd2c..b0aad88 100644
--- a/src/racoon/admin.c
+++ b/src/racoon/admin.c
@@ -1,11 +1,11 @@
-/*	$NetBSD: admin.c,v 1.17.6.3 2009/04/20 13:32:57 tteras Exp $	*/
+/*	$NetBSD: admin.c,v 1.38 2010/12/08 07:38:35 tteras Exp $	*/
 
 /* Id: admin.c,v 1.25 2006/04/06 14:31:04 manubsd Exp */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -17,7 +17,7 @@
  * 3. Neither the name of the project nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -76,6 +76,7 @@
 #include "evt.h"
 #include "pfkey.h"
 #include "ipsec_doi.h"
+#include "policy.h"
 #include "admin.h"
 #include "admin_var.h"
 #include "isakmp_inf.h"
@@ -93,10 +94,12 @@
 
 static struct sockaddr_un sunaddr;
 static int admin_process __P((int, char *));
-static int admin_reply __P((int, struct admin_com *, vchar_t *));
+static int admin_reply __P((int, struct admin_com *, int, vchar_t *));
 
-int
-admin_handler()
+static int
+admin_handler(ctx, fd)
+	void *ctx;
+	int fd;
 {
 	int so2;
 	struct sockaddr_storage from;
@@ -112,6 +115,7 @@
 			strerror(errno));
 		return -1;
 	}
+	close_on_exec(so2);
 
 	/* get buffer length */
 	while ((len = recv(so2, (char *)&com, sizeof(com), MSG_PEEK)) < 0) {
@@ -147,22 +151,30 @@
 		goto end;
 	}
 
-	if (com.ac_cmd == ADMIN_RELOAD_CONF) {
-		/* reload does not work at all! */
-		signal_handler(SIGHUP);
-		goto end;
-	}
-
 	error = admin_process(so2, combuf);
 
-    end:
-	(void)close(so2);
+end:
+	if (error == -2) {
+		plog(LLV_DEBUG, LOCATION, NULL,
+			"[%d] admin connection established\n", so2);
+	} else {
+		(void)close(so2);
+	}
+
 	if (combuf)
 		racoon_free(combuf);
 
 	return error;
 }
 
+static int admin_ph1_delete_sa(struct ph1handle *iph1, void *arg)
+{
+	if (iph1->status >= PHASE1ST_ESTABLISHED)
+		isakmp_info_send_d1(iph1);
+	purge_remote(iph1);
+	return 0;
+}
+
 /*
  * main child's process.
  */
@@ -176,131 +188,140 @@
 	vchar_t *id = NULL;
 	vchar_t *key = NULL;
 	int idtype = 0;
-	int error = -1;
+	int error = 0, l_ac_errno = 0;
+	struct evt_listener_list *event_list = NULL;
 
-	com->ac_errno = 0;
+	if (com->ac_cmd & ADMIN_FLAG_VERSION)
+		com->ac_cmd &= ~ADMIN_FLAG_VERSION;
+	else
+		com->ac_version = 0;
 
 	switch (com->ac_cmd) {
 	case ADMIN_RELOAD_CONF:
-		/* don't entered because of proccessing it in other place. */
-		plog(LLV_ERROR, LOCATION, NULL, "should never reach here\n");
-		goto out;
+		signal_handler(SIGHUP);
+		break;
 
-	case ADMIN_SHOW_SCHED:
-	{
+	case ADMIN_SHOW_SCHED: {
 		caddr_t p = NULL;
 		int len;
 
-		com->ac_errno = -1;
-
-		if (sched_dump(&p, &len) == -1)
-			goto out2;
-
-		if ((buf = vmalloc(len)) == NULL)
-			goto out2;
-
-		memcpy(buf->v, p, len);
-
-		com->ac_errno = 0;
-out2:
-		racoon_free(p);
+		if (sched_dump(&p, &len) != -1) {
+			buf = vmalloc(len);
+			if (buf != NULL)
+				memcpy(buf->v, p, len);
+			else
+				l_ac_errno = ENOMEM;
+			racoon_free(p);
+		} else
+			l_ac_errno = ENOMEM;
 		break;
 	}
 
 	case ADMIN_SHOW_EVT:
-		/* It's not really an error, don't force racoonctl to quit */
-		if ((buf = evt_dump()) == NULL)
-			com->ac_errno = 0; 
+		if (com->ac_version == 0) {
+			buf = evt_dump();
+			l_ac_errno = 0;
+		}
 		break;
 
 	case ADMIN_SHOW_SA:
-	case ADMIN_FLUSH_SA:
-	    {
 		switch (com->ac_proto) {
 		case ADMIN_PROTO_ISAKMP:
-			switch (com->ac_cmd) {
-			case ADMIN_SHOW_SA:
-				buf = dumpph1();
+			buf = dumpph1();
+			if (buf == NULL)
+				l_ac_errno = ENOMEM;
+			break;
+		case ADMIN_PROTO_IPSEC:
+		case ADMIN_PROTO_AH:
+		case ADMIN_PROTO_ESP: {
+			u_int p;
+			p = admin2pfkey_proto(com->ac_proto);
+			if (p != -1) {
+				buf = pfkey_dump_sadb(p);
 				if (buf == NULL)
-					com->ac_errno = -1;
-				break;
-			case ADMIN_FLUSH_SA:
-				flushph1();
-				break;
-			}
+					l_ac_errno = ENOMEM;
+			} else
+				l_ac_errno = EINVAL;
+			break;
+		}
+		case ADMIN_PROTO_INTERNAL:
+		default:
+			l_ac_errno = ENOTSUP;
+			break;
+		}
+		break;
+
+	case ADMIN_GET_SA_CERT: {
+		struct admin_com_indexes *ndx;
+		struct sockaddr *src, *dst;
+		struct ph1handle *iph1;
+
+		ndx = (struct admin_com_indexes *) ((caddr_t)com + sizeof(*com));
+		src = (struct sockaddr *) &ndx->src;
+		dst = (struct sockaddr *) &ndx->dst;
+
+		if (com->ac_proto != ADMIN_PROTO_ISAKMP) {
+			l_ac_errno = ENOTSUP;
+			break;
+		}
+
+		iph1 = getph1byaddr(src, dst, 0);
+		if (iph1 == NULL) {
+			l_ac_errno = ENOENT;
+			break;
+		}
+
+		if (iph1->cert_p != NULL) {
+			vchar_t tmp;
+			tmp.v = iph1->cert_p->v + 1;
+			tmp.l = iph1->cert_p->l - 1;
+			buf = vdup(&tmp);
+		}
+		break;
+	}
+
+	case ADMIN_FLUSH_SA:
+		switch (com->ac_proto) {
+		case ADMIN_PROTO_ISAKMP:
+			flushph1();
 			break;
 		case ADMIN_PROTO_IPSEC:
 		case ADMIN_PROTO_AH:
 		case ADMIN_PROTO_ESP:
-			switch (com->ac_cmd) {
-			case ADMIN_SHOW_SA:
-			    {
-				u_int p;
-				p = admin2pfkey_proto(com->ac_proto);
-				if (p == -1)
-					goto out;
-				buf = pfkey_dump_sadb(p);
-				if (buf == NULL)
-					com->ac_errno = -1;
-			    }
-				break;
-			case ADMIN_FLUSH_SA:
-				pfkey_flush_sadb(com->ac_proto);
-				break;
-			}
+			pfkey_flush_sadb(com->ac_proto);
 			break;
-
 		case ADMIN_PROTO_INTERNAL:
-			switch (com->ac_cmd) {
-			case ADMIN_SHOW_SA:
-				buf = NULL; /*XXX dumpph2(&error);*/
-				if (buf == NULL)
-					com->ac_errno = error;
-				break;
-			case ADMIN_FLUSH_SA:
-				/*XXX flushph2();*/
-				com->ac_errno = 0;
-				break;
-			}
-			break;
-
+			/*XXX flushph2();*/
 		default:
-			/* ignore */
-			com->ac_errno = -1;
+			l_ac_errno = ENOTSUP;
+			break;
 		}
-	    }
 		break;
 
 	case ADMIN_DELETE_SA: {
-		struct ph1handle *iph1;
-		struct sockaddr *dst;
-		struct sockaddr *src;
 		char *loc, *rem;
+		struct ph1selector sel;
 
-		src = (struct sockaddr *)
+		memset(&sel, 0, sizeof(sel));
+		sel.local = (struct sockaddr *)
 			&((struct admin_com_indexes *)
 			    ((caddr_t)com + sizeof(*com)))->src;
-		dst = (struct sockaddr *)
+		sel.remote = (struct sockaddr *)
 			&((struct admin_com_indexes *)
 			    ((caddr_t)com + sizeof(*com)))->dst;
 
-		loc = racoon_strdup(saddrwop2str(src));
-		rem = racoon_strdup(saddrwop2str(dst));
+		loc = racoon_strdup(saddr2str(sel.local));
+		rem = racoon_strdup(saddr2str(sel.remote));
 		STRDUP_FATAL(loc);
 		STRDUP_FATAL(rem);
 
-		if ((iph1 = getph1byaddrwop(src, dst)) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "phase 1 for %s -> %s not found\n", loc, rem);
-		} else {
-			if (iph1->status == PHASE1ST_ESTABLISHED)
-				isakmp_info_send_d1(iph1);
-			purge_remote(iph1);
-		}
+		plog(LLV_INFO, LOCATION, NULL,
+		     "admin delete-sa %s %s\n", loc, rem);
+		enumph1(&sel, admin_ph1_delete_sa, NULL);
+		remcontacted(sel.remote);
 
 		racoon_free(loc);
 		racoon_free(rem);
-
 		break;
 	}
 
@@ -308,7 +329,7 @@
 	case ADMIN_LOGOUT_USER: {
 		struct ph1handle *iph1;
 		char user[LOGINLEN+1];
-		int found = 0, len = com->ac_len - sizeof(com);
+		int found = 0, len = com->ac_len - sizeof(*com);
 
 		if (len > LOGINLEN) {
 			plog(LLV_ERROR, LOCATION, NULL,
@@ -320,7 +341,7 @@
 		user[len] = 0;
 
 		found = purgeph1bylogin(user);
-		plog(LLV_INFO, LOCATION, NULL, 
+		plog(LLV_INFO, LOCATION, NULL,
 		    "deleted %d SA for user \"%s\"\n", found, user);
 
 		break;
@@ -339,22 +360,21 @@
 		rem = racoon_strdup(saddrwop2str(dst));
 		STRDUP_FATAL(rem);
 
-		plog(LLV_INFO, LOCATION, NULL, 
+		plog(LLV_INFO, LOCATION, NULL,
 		    "Flushing all SAs for peer %s\n", rem);
 
-		while ((iph1 = getph1bydstaddrwop(dst)) != NULL) {
+		while ((iph1 = getph1bydstaddr(dst)) != NULL) {
 			loc = racoon_strdup(saddrwop2str(iph1->local));
 			STRDUP_FATAL(loc);
 
-			if (iph1->status == PHASE1ST_ESTABLISHED)
+			if (iph1->status >= PHASE1ST_ESTABLISHED)
 				isakmp_info_send_d1(iph1);
 			purge_remote(iph1);
 
 			racoon_free(loc);
 		}
-		
-		racoon_free(rem);
 
+		racoon_free(rem);
 		break;
 	}
 
@@ -362,17 +382,15 @@
 		struct admin_com_psk *acp;
 		char *data;
 
-		com->ac_cmd = ADMIN_ESTABLISH_SA;
-
 		acp = (struct admin_com_psk *)
-		    ((char *)com + sizeof(*com) + 
+		    ((char *)com + sizeof(*com) +
 		    sizeof(struct admin_com_indexes));
 
 		idtype = acp->id_type;
 
 		if ((id = vmalloc(acp->id_len)) == NULL) {
 			plog(LLV_ERROR, LOCATION, NULL,
-			    "cannot allocate memory: %s\n", 
+			    "cannot allocate memory: %s\n",
 			    strerror(errno));
 			break;
 		}
@@ -381,7 +399,7 @@
 
 		if ((key = vmalloc(acp->key_len)) == NULL) {
 			plog(LLV_ERROR, LOCATION, NULL,
-			    "cannot allocate memory: %s\n", 
+			    "cannot allocate memory: %s\n",
 			    strerror(errno));
 			vfree(id);
 			id = NULL;
@@ -391,56 +409,57 @@
 		memcpy(key->v, data, key->l);
 	}
 	/* FALLTHROUGH */
-	case ADMIN_ESTABLISH_SA:
-	    {
+	case ADMIN_ESTABLISH_SA: {
+		struct admin_com_indexes *ndx;
 		struct sockaddr *dst;
 		struct sockaddr *src;
-		src = (struct sockaddr *)
-			&((struct admin_com_indexes *)
-			    ((caddr_t)com + sizeof(*com)))->src;
-		dst = (struct sockaddr *)
-			&((struct admin_com_indexes *)
-			    ((caddr_t)com + sizeof(*com)))->dst;
+		char *name = NULL;
+
+		ndx = (struct admin_com_indexes *) ((caddr_t)com + sizeof(*com));
+		src = (struct sockaddr *) &ndx->src;
+		dst = (struct sockaddr *) &ndx->dst;
+
+		if (com->ac_cmd == ADMIN_ESTABLISH_SA &&
+		    com->ac_len > sizeof(*com) + sizeof(*ndx))
+			name = (char *) ((caddr_t) ndx + sizeof(*ndx));
 
 		switch (com->ac_proto) {
 		case ADMIN_PROTO_ISAKMP: {
+			struct ph1handle *ph1;
 			struct remoteconf *rmconf;
-			struct sockaddr *remote = NULL;
-			struct sockaddr *local = NULL;
 			u_int16_t port;
 
-			com->ac_errno = -1;
+			l_ac_errno = -1;
+
+			/* connected already? */
+			ph1 = getph1byaddr(src, dst, 0);
+			if (ph1 != NULL) {
+				event_list = &ph1->evt_listeners;
+				if (ph1->status == PHASE1ST_ESTABLISHED)
+					l_ac_errno = EEXIST;
+				else
+					l_ac_errno = 0;
+				break;
+			}
 
 			/* search appropreate configuration */
-			rmconf = getrmconf(dst);
+			if (name == NULL)
+				rmconf = getrmconf(dst, 0);
+			else
+				rmconf = getrmconf_by_name(name);
 			if (rmconf == NULL) {
 				plog(LLV_ERROR, LOCATION, NULL,
 					"no configuration found "
 					"for %s\n", saddrwop2str(dst));
-				goto out1;
+				break;
 			}
 
-			/* get remote IP address and port number. */
-			if ((remote = dupsaddr(dst)) == NULL)
-				goto out1;
-
-			port = extract_port(rmconf->remote);
-			if (set_port(remote, port) == NULL)
-				goto out1;
-
-			/* get local address */
-			if ((local = dupsaddr(src)) == NULL)
-				goto out1;
-
-			port = getmyaddrsport(local);
-			if (set_port(local, port) == NULL)
-				goto out1;
-
 #ifdef ENABLE_HYBRID
+			/* XXX This overwrites rmconf information globally. */
 			/* Set the id and key */
 			if (id && key) {
 				if (xauth_rmconf_used(&rmconf->xauth) == -1)
-					goto out1;
+					break;
 
 				if (rmconf->xauth->login != NULL) {
 					vfree(rmconf->xauth->login);
@@ -455,43 +474,145 @@
 				rmconf->xauth->pass = key;
 			}
 #endif
- 
+
 			plog(LLV_INFO, LOCATION, NULL,
 				"accept a request to establish IKE-SA: "
-				"%s\n", saddrwop2str(remote));
+				"%s\n", saddrwop2str(dst));
 
 			/* begin ident mode */
-			if (isakmp_ph1begin_i(rmconf, remote, local) < 0)
-				goto out1;
+			ph1 = isakmp_ph1begin_i(rmconf, dst, src);
+			if (ph1 == NULL)
+				break;
 
-			com->ac_errno = 0;
-out1:
-			if (local != NULL)
-				racoon_free(local);
-			if (remote != NULL)
-				racoon_free(remote);
+			event_list = &ph1->evt_listeners;
+			l_ac_errno = 0;
 			break;
 		}
 		case ADMIN_PROTO_AH:
-		case ADMIN_PROTO_ESP:
+		case ADMIN_PROTO_ESP: {
+			struct ph2handle *iph2;
+			struct secpolicy *sp_out = NULL, *sp_in = NULL;
+			struct policyindex spidx;
+
+			l_ac_errno = -1;
+
+			/* got outbound policy */
+			memset(&spidx, 0, sizeof(spidx));
+			spidx.dir = IPSEC_DIR_OUTBOUND;
+			memcpy(&spidx.src, src, sizeof(spidx.src));
+			memcpy(&spidx.dst, dst, sizeof(spidx.dst));
+			spidx.prefs = ndx->prefs;
+			spidx.prefd = ndx->prefd;
+			spidx.ul_proto = ndx->ul_proto;
+
+			sp_out = getsp_r(&spidx);
+			if (sp_out) {
+				plog(LLV_DEBUG, LOCATION, NULL,
+					"suitable outbound SP found: %s.\n",
+					spidx2str(&sp_out->spidx));
+			} else {
+				l_ac_errno = ENOENT;
+				plog(LLV_NOTIFY, LOCATION, NULL,
+					"no outbound policy found: %s\n",
+					spidx2str(&spidx));
+				break;
+			}
+
+			iph2 = getph2byid(src, dst, sp_out->id);
+			if (iph2 != NULL) {
+				event_list = &iph2->evt_listeners;
+				if (iph2->status == PHASE2ST_ESTABLISHED)
+					l_ac_errno = EEXIST;
+				else
+					l_ac_errno = 0;
+				break;
+			}
+
+			/* get inbound policy */
+			memset(&spidx, 0, sizeof(spidx));
+			spidx.dir = IPSEC_DIR_INBOUND;
+			memcpy(&spidx.src, dst, sizeof(spidx.src));
+			memcpy(&spidx.dst, src, sizeof(spidx.dst));
+			spidx.prefs = ndx->prefd;
+			spidx.prefd = ndx->prefs;
+			spidx.ul_proto = ndx->ul_proto;
+
+			sp_in = getsp_r(&spidx);
+			if (sp_in) {
+				plog(LLV_DEBUG, LOCATION, NULL,
+					"suitable inbound SP found: %s.\n",
+					spidx2str(&sp_in->spidx));
+			} else {
+				l_ac_errno = ENOENT;
+				plog(LLV_NOTIFY, LOCATION, NULL,
+					"no inbound policy found: %s\n",
+				spidx2str(&spidx));
+				break;
+			}
+
+			/* allocate a phase 2 */
+			iph2 = newph2();
+			if (iph2 == NULL) {
+				plog(LLV_ERROR, LOCATION, NULL,
+					"failed to allocate phase2 entry.\n");
+				break;
+			}
+			iph2->side = INITIATOR;
+			iph2->satype = admin2pfkey_proto(com->ac_proto);
+			iph2->spid = sp_out->id;
+			iph2->seq = pk_getseq();
+			iph2->status = PHASE2ST_STATUS2;
+
+			/* set end addresses of SA */
+			iph2->sa_dst = dupsaddr(dst);
+			iph2->sa_src = dupsaddr(src);
+			iph2->dst = dupsaddr(dst);
+			iph2->src = dupsaddr(src);
+			if (iph2->sa_src == NULL || iph2->sa_dst == NULL ||
+			    iph2->dst == NULL || iph2->src == NULL) {
+				delph2(iph2);
+				break;
+			}
+			set_port(iph2->dst, 0);
+			set_port(iph2->src, 0);
+
+			if (isakmp_get_sainfo(iph2, sp_out, sp_in) < 0) {
+				delph2(iph2);
+				break;
+			}
+
+			insph2(iph2);
+			if (isakmp_post_acquire(iph2, NULL, FALSE) < 0) {
+				remph2(iph2);
+				delph2(iph2);
+				break;
+			}
+
+			event_list = &iph2->evt_listeners;
+			l_ac_errno = 0;
 			break;
+		}
 		default:
 			/* ignore */
-			com->ac_errno = -1;
+			l_ac_errno = ENOTSUP;
 		}
-	    }
 		break;
+	}
 
 	default:
 		plog(LLV_ERROR, LOCATION, NULL,
 			"invalid command: %d\n", com->ac_cmd);
-		com->ac_errno = -1;
+		l_ac_errno = ENOTSUP;
 	}
 
-	if ((error = admin_reply(so2, com, buf)) != 0)
+	if ((error = admin_reply(so2, com, l_ac_errno, buf)) != 0)
 		goto out;
 
-	error = 0;
+	/* start pushing events if so requested */
+	if ((l_ac_errno == 0) &&
+	    (com->ac_version >= 1) &&
+	    (com->ac_cmd == ADMIN_SHOW_EVT || event_list != NULL))
+		error = evt_subscribe(event_list, so2);
 out:
 	if (buf != NULL)
 		vfree(buf);
@@ -500,12 +621,13 @@
 }
 
 static int
-admin_reply(so, combuf, buf)
-	int so;
-	struct admin_com *combuf;
+admin_reply(so, req, l_ac_errno, buf)
+	int so, l_ac_errno;
+	struct admin_com *req;
 	vchar_t *buf;
 {
 	int tlen;
+	struct admin_com *combuf;
 	char *retbuf = NULL;
 
 	if (buf != NULL)
@@ -520,8 +642,17 @@
 		return -1;
 	}
 
-	memcpy(retbuf, combuf, sizeof(*combuf));
-	((struct admin_com *)retbuf)->ac_len = tlen;
+	combuf = (struct admin_com *) retbuf;
+	combuf->ac_len = (u_int16_t) tlen;
+	combuf->ac_cmd = req->ac_cmd & ~ADMIN_FLAG_VERSION;
+	if (tlen != (u_int32_t) combuf->ac_len &&
+	    l_ac_errno == 0) {
+		combuf->ac_len_high = tlen >> 16;
+		combuf->ac_cmd |= ADMIN_FLAG_LONG_REPLY;
+	} else {
+		combuf->ac_errno = l_ac_errno;
+	}
+	combuf->ac_proto = req->ac_proto;
 
 	if (buf != NULL)
 		memcpy(retbuf + sizeof(*combuf), buf->v, buf->l);
@@ -577,6 +708,7 @@
 			"socket: %s\n", strerror(errno));
 		return -1;
 	}
+	close_on_exec(lcconf->sock_admin);
 
 	unlink(sunaddr.sun_path);
 	if (bind(lcconf->sock_admin, (struct sockaddr *)&sunaddr,
@@ -589,17 +721,17 @@
 	}
 
 	if (chown(sunaddr.sun_path, adminsock_owner, adminsock_group) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "chown(%s, %d, %d): %s\n", 
-		    sunaddr.sun_path, adminsock_owner, 
+		plog(LLV_ERROR, LOCATION, NULL,
+		    "chown(%s, %d, %d): %s\n",
+		    sunaddr.sun_path, adminsock_owner,
 		    adminsock_group, strerror(errno));
 		(void)close(lcconf->sock_admin);
 		return -1;
 	}
 
 	if (chmod(sunaddr.sun_path, adminsock_mode) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "chmod(%s, 0%03o): %s\n", 
+		plog(LLV_ERROR, LOCATION, NULL,
+		    "chmod(%s, 0%03o): %s\n",
 		    sunaddr.sun_path, adminsock_mode, strerror(errno));
 		(void)close(lcconf->sock_admin);
 		return -1;
@@ -612,8 +744,10 @@
 		(void)close(lcconf->sock_admin);
 		return -1;
 	}
+
+	monitor_fd(lcconf->sock_admin, admin_handler, NULL, 0);
 	plog(LLV_DEBUG, LOCATION, NULL,
-		"open %s as racoon management.\n", sunaddr.sun_path);
+	     "open %s as racoon management.\n", sunaddr.sun_path);
 
 	return 0;
 }
@@ -621,8 +755,9 @@
 int
 admin_close()
 {
+	unmonitor_fd(lcconf->sock_admin);
 	close(lcconf->sock_admin);
 	return 0;
 }
-#endif
 
+#endif
diff --git a/src/racoon/admin.h b/src/racoon/admin.h
index cbc19e8..8cb9382 100644
--- a/src/racoon/admin.h
+++ b/src/racoon/admin.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: admin.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
+/*	$NetBSD: admin.h,v 1.8 2010/11/12 09:08:26 tteras Exp $	*/
 
 /* Id: admin.h,v 1.11 2005/06/19 22:37:47 manubsd Exp */
 
@@ -46,9 +46,22 @@
 struct admin_com {
 	u_int16_t ac_len;	/* total packet length including data */
 	u_int16_t ac_cmd;
-	int16_t ac_errno;
+	union {
+		int16_t ac_un_errno;
+		uint16_t ac_un_version;
+		uint16_t ac_un_len_high;
+	} u;
 	u_int16_t ac_proto;
 };
+#define ac_errno u.ac_un_errno
+#define ac_version u.ac_un_version
+#define ac_len_high u.ac_un_len_high
+
+/*
+ * Version field in request is valid.
+ */
+#define ADMIN_FLAG_VERSION	0x8000
+#define ADMIN_FLAG_LONG_REPLY	0x8000
 
 /*
  * No data follows as the data.
@@ -72,6 +85,8 @@
 #define ADMIN_ESTABLISH_SA	0x0202
 #define ADMIN_DELETE_ALL_SA_DST	0x0204	/* All SA for a given peer */
 
+#define ADMIN_GET_SA_CERT	0x0206
+
 /*
  * The admin_com_indexes and admin_com_psk follow, see below.
  */
diff --git a/src/racoon/admin_var.h b/src/racoon/admin_var.h
index 6d7ba81..f4471a3 100644
--- a/src/racoon/admin_var.h
+++ b/src/racoon/admin_var.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: admin_var.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
+/*	$NetBSD: admin_var.h,v 1.5 2008/12/23 14:03:12 tteras Exp $	*/
 
 /* Id: admin_var.h,v 1.7 2004/12/30 00:08:30 manubsd Exp */
 
@@ -34,7 +34,6 @@
 #ifndef _ADMIN_VAR_H
 #define _ADMIN_VAR_H
 
-extern int admin_handler __P((void));
 extern int admin_init __P((void));
 extern int admin_close __P((void));
 
diff --git a/src/racoon/backupsa.c b/src/racoon/backupsa.c
index 9496000..82d74ca 100644
--- a/src/racoon/backupsa.c
+++ b/src/racoon/backupsa.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: backupsa.c,v 1.8.4.1 2007/08/01 11:52:19 vanhu Exp $	*/
+/*	$NetBSD: backupsa.c,v 1.10 2010/04/02 15:15:00 christos Exp $	*/
 
 /*	$KAME: backupsa.c,v 1.16 2001/12/31 20:13:40 thorpej Exp $	*/
 
@@ -452,7 +452,7 @@
 	struct tm tm;
 	time_t t;
 	char *buf = "Nov 24 18:22:48 1986 ";
-	char *p;
+	const char *p;
 
 	memset(&tm, 0, sizeof(tm));
 	p = str2tmx(buf, &tm);
@@ -460,7 +460,8 @@
 	t = mktime(&tm);
 	if (t == -1)
 		printf("mktime failed.");
-	p = ctime(&t);
+	if ((p = ctime(&t)) == NULL)
+		p = "?";
 	printf("[%s]\n", p);
 
 	exit(0);
diff --git a/src/racoon/cfparse.h b/src/racoon/cfparse.h
index 2946b3e..bbf678a 100644
--- a/src/racoon/cfparse.h
+++ b/src/racoon/cfparse.h
@@ -1,24 +1,23 @@
-/* A Bison parser, made by GNU Bison 2.3.  */
+
+/* A Bison parser, made by GNU Bison 2.4.1.  */
 
 /* Skeleton interface for Bison's Yacc-like parsers in C
-
-   Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
+   
+      Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
    Free Software Foundation, Inc.
-
-   This program is free software; you can redistribute it and/or modify
+   
+   This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2, or (at your option)
-   any later version.
-
+   the Free Software Foundation, either version 3 of the License, or
+   (at your option) any later version.
+   
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-
+   
    You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 51 Franklin Street, Fifth Floor,
-   Boston, MA 02110-1301, USA.  */
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
 
 /* As a special exception, you may create a larger work that contains
    part or all of the Bison parser skeleton and distribute that work
@@ -29,10 +28,11 @@
    special exception, which will cause the skeleton and the resulting
    Bison output files to be licensed under the GNU General Public
    License without this special exception.
-
+   
    This special exception was added by the Free Software Foundation in
    version 2.2 of Bison.  */
 
+
 /* Tokens.  */
 #ifndef YYTOKENTYPE
 # define YYTOKENTYPE
@@ -46,161 +46,170 @@
      PATH = 262,
      PATHTYPE = 263,
      INCLUDE = 264,
-     IDENTIFIER = 265,
-     VENDORID = 266,
-     LOGGING = 267,
-     LOGLEV = 268,
-     PADDING = 269,
-     PAD_RANDOMIZE = 270,
-     PAD_RANDOMIZELEN = 271,
-     PAD_MAXLEN = 272,
-     PAD_STRICT = 273,
-     PAD_EXCLTAIL = 274,
-     LISTEN = 275,
-     X_ISAKMP = 276,
-     X_ISAKMP_NATT = 277,
-     X_ADMIN = 278,
-     STRICT_ADDRESS = 279,
-     ADMINSOCK = 280,
-     DISABLED = 281,
-     LDAPCFG = 282,
-     LDAP_HOST = 283,
-     LDAP_PORT = 284,
-     LDAP_PVER = 285,
-     LDAP_BASE = 286,
-     LDAP_BIND_DN = 287,
-     LDAP_BIND_PW = 288,
-     LDAP_SUBTREE = 289,
-     LDAP_ATTR_USER = 290,
-     LDAP_ATTR_ADDR = 291,
-     LDAP_ATTR_MASK = 292,
-     LDAP_ATTR_GROUP = 293,
-     LDAP_ATTR_MEMBER = 294,
-     MODECFG = 295,
-     CFG_NET4 = 296,
-     CFG_MASK4 = 297,
-     CFG_DNS4 = 298,
-     CFG_NBNS4 = 299,
-     CFG_DEFAULT_DOMAIN = 300,
-     CFG_AUTH_SOURCE = 301,
-     CFG_AUTH_GROUPS = 302,
-     CFG_SYSTEM = 303,
-     CFG_RADIUS = 304,
-     CFG_PAM = 305,
-     CFG_LDAP = 306,
-     CFG_LOCAL = 307,
-     CFG_NONE = 308,
-     CFG_GROUP_SOURCE = 309,
-     CFG_ACCOUNTING = 310,
-     CFG_CONF_SOURCE = 311,
-     CFG_MOTD = 312,
-     CFG_POOL_SIZE = 313,
-     CFG_AUTH_THROTTLE = 314,
-     CFG_SPLIT_NETWORK = 315,
-     CFG_SPLIT_LOCAL = 316,
-     CFG_SPLIT_INCLUDE = 317,
-     CFG_SPLIT_DNS = 318,
-     CFG_PFS_GROUP = 319,
-     CFG_SAVE_PASSWD = 320,
-     RETRY = 321,
-     RETRY_COUNTER = 322,
-     RETRY_INTERVAL = 323,
-     RETRY_PERSEND = 324,
-     RETRY_PHASE1 = 325,
-     RETRY_PHASE2 = 326,
-     NATT_KA = 327,
-     ALGORITHM_CLASS = 328,
-     ALGORITHMTYPE = 329,
-     STRENGTHTYPE = 330,
-     SAINFO = 331,
-     FROM = 332,
-     REMOTE = 333,
-     ANONYMOUS = 334,
-     INHERIT = 335,
-     EXCHANGE_MODE = 336,
-     EXCHANGETYPE = 337,
-     DOI = 338,
-     DOITYPE = 339,
-     SITUATION = 340,
-     SITUATIONTYPE = 341,
-     CERTIFICATE_TYPE = 342,
-     CERTTYPE = 343,
-     PEERS_CERTFILE = 344,
-     CA_TYPE = 345,
-     VERIFY_CERT = 346,
-     SEND_CERT = 347,
-     SEND_CR = 348,
-     IDENTIFIERTYPE = 349,
-     IDENTIFIERQUAL = 350,
-     MY_IDENTIFIER = 351,
-     PEERS_IDENTIFIER = 352,
-     VERIFY_IDENTIFIER = 353,
-     DNSSEC = 354,
-     CERT_X509 = 355,
-     CERT_PLAINRSA = 356,
-     NONCE_SIZE = 357,
-     DH_GROUP = 358,
-     KEEPALIVE = 359,
-     PASSIVE = 360,
-     INITIAL_CONTACT = 361,
-     NAT_TRAVERSAL = 362,
-     REMOTE_FORCE_LEVEL = 363,
-     PROPOSAL_CHECK = 364,
-     PROPOSAL_CHECK_LEVEL = 365,
-     GENERATE_POLICY = 366,
-     GENERATE_LEVEL = 367,
-     SUPPORT_PROXY = 368,
-     PROPOSAL = 369,
-     EXEC_PATH = 370,
-     EXEC_COMMAND = 371,
-     EXEC_SUCCESS = 372,
-     EXEC_FAILURE = 373,
-     GSS_ID = 374,
-     GSS_ID_ENC = 375,
-     GSS_ID_ENCTYPE = 376,
-     COMPLEX_BUNDLE = 377,
-     DPD = 378,
-     DPD_DELAY = 379,
-     DPD_RETRY = 380,
-     DPD_MAXFAIL = 381,
-     PH1ID = 382,
-     XAUTH_LOGIN = 383,
-     WEAK_PHASE1_CHECK = 384,
-     PREFIX = 385,
-     PORT = 386,
-     PORTANY = 387,
-     UL_PROTO = 388,
-     ANY = 389,
-     IKE_FRAG = 390,
-     ESP_FRAG = 391,
-     MODE_CFG = 392,
-     PFS_GROUP = 393,
-     LIFETIME = 394,
-     LIFETYPE_TIME = 395,
-     LIFETYPE_BYTE = 396,
-     STRENGTH = 397,
-     REMOTEID = 398,
-     SCRIPT = 399,
-     PHASE1_UP = 400,
-     PHASE1_DOWN = 401,
-     NUMBER = 402,
-     SWITCH = 403,
-     BOOLEAN = 404,
-     HEXSTRING = 405,
-     QUOTEDSTRING = 406,
-     ADDRSTRING = 407,
-     ADDRRANGE = 408,
-     UNITTYPE_BYTE = 409,
-     UNITTYPE_KBYTES = 410,
-     UNITTYPE_MBYTES = 411,
-     UNITTYPE_TBYTES = 412,
-     UNITTYPE_SEC = 413,
-     UNITTYPE_MIN = 414,
-     UNITTYPE_HOUR = 415,
-     EOS = 416,
-     BOC = 417,
-     EOC = 418,
-     COMMA = 419
+     PFKEY_BUFFER = 265,
+     LOGGING = 266,
+     LOGLEV = 267,
+     PADDING = 268,
+     PAD_RANDOMIZE = 269,
+     PAD_RANDOMIZELEN = 270,
+     PAD_MAXLEN = 271,
+     PAD_STRICT = 272,
+     PAD_EXCLTAIL = 273,
+     LISTEN = 274,
+     X_ISAKMP = 275,
+     X_ISAKMP_NATT = 276,
+     X_ADMIN = 277,
+     STRICT_ADDRESS = 278,
+     ADMINSOCK = 279,
+     DISABLED = 280,
+     LDAPCFG = 281,
+     LDAP_HOST = 282,
+     LDAP_PORT = 283,
+     LDAP_PVER = 284,
+     LDAP_BASE = 285,
+     LDAP_BIND_DN = 286,
+     LDAP_BIND_PW = 287,
+     LDAP_SUBTREE = 288,
+     LDAP_ATTR_USER = 289,
+     LDAP_ATTR_ADDR = 290,
+     LDAP_ATTR_MASK = 291,
+     LDAP_ATTR_GROUP = 292,
+     LDAP_ATTR_MEMBER = 293,
+     RADCFG = 294,
+     RAD_AUTH = 295,
+     RAD_ACCT = 296,
+     RAD_TIMEOUT = 297,
+     RAD_RETRIES = 298,
+     MODECFG = 299,
+     CFG_NET4 = 300,
+     CFG_MASK4 = 301,
+     CFG_DNS4 = 302,
+     CFG_NBNS4 = 303,
+     CFG_DEFAULT_DOMAIN = 304,
+     CFG_AUTH_SOURCE = 305,
+     CFG_AUTH_GROUPS = 306,
+     CFG_SYSTEM = 307,
+     CFG_RADIUS = 308,
+     CFG_PAM = 309,
+     CFG_LDAP = 310,
+     CFG_LOCAL = 311,
+     CFG_NONE = 312,
+     CFG_GROUP_SOURCE = 313,
+     CFG_ACCOUNTING = 314,
+     CFG_CONF_SOURCE = 315,
+     CFG_MOTD = 316,
+     CFG_POOL_SIZE = 317,
+     CFG_AUTH_THROTTLE = 318,
+     CFG_SPLIT_NETWORK = 319,
+     CFG_SPLIT_LOCAL = 320,
+     CFG_SPLIT_INCLUDE = 321,
+     CFG_SPLIT_DNS = 322,
+     CFG_PFS_GROUP = 323,
+     CFG_SAVE_PASSWD = 324,
+     RETRY = 325,
+     RETRY_COUNTER = 326,
+     RETRY_INTERVAL = 327,
+     RETRY_PERSEND = 328,
+     RETRY_PHASE1 = 329,
+     RETRY_PHASE2 = 330,
+     NATT_KA = 331,
+     ALGORITHM_CLASS = 332,
+     ALGORITHMTYPE = 333,
+     STRENGTHTYPE = 334,
+     SAINFO = 335,
+     FROM = 336,
+     REMOTE = 337,
+     ANONYMOUS = 338,
+     CLIENTADDR = 339,
+     INHERIT = 340,
+     REMOTE_ADDRESS = 341,
+     EXCHANGE_MODE = 342,
+     EXCHANGETYPE = 343,
+     DOI = 344,
+     DOITYPE = 345,
+     SITUATION = 346,
+     SITUATIONTYPE = 347,
+     CERTIFICATE_TYPE = 348,
+     CERTTYPE = 349,
+     PEERS_CERTFILE = 350,
+     CA_TYPE = 351,
+     VERIFY_CERT = 352,
+     SEND_CERT = 353,
+     SEND_CR = 354,
+     MATCH_EMPTY_CR = 355,
+     IDENTIFIERTYPE = 356,
+     IDENTIFIERQUAL = 357,
+     MY_IDENTIFIER = 358,
+     PEERS_IDENTIFIER = 359,
+     VERIFY_IDENTIFIER = 360,
+     DNSSEC = 361,
+     CERT_X509 = 362,
+     CERT_PLAINRSA = 363,
+     NONCE_SIZE = 364,
+     DH_GROUP = 365,
+     KEEPALIVE = 366,
+     PASSIVE = 367,
+     INITIAL_CONTACT = 368,
+     NAT_TRAVERSAL = 369,
+     REMOTE_FORCE_LEVEL = 370,
+     PROPOSAL_CHECK = 371,
+     PROPOSAL_CHECK_LEVEL = 372,
+     GENERATE_POLICY = 373,
+     GENERATE_LEVEL = 374,
+     SUPPORT_PROXY = 375,
+     PROPOSAL = 376,
+     EXEC_PATH = 377,
+     EXEC_COMMAND = 378,
+     EXEC_SUCCESS = 379,
+     EXEC_FAILURE = 380,
+     GSS_ID = 381,
+     GSS_ID_ENC = 382,
+     GSS_ID_ENCTYPE = 383,
+     COMPLEX_BUNDLE = 384,
+     DPD = 385,
+     DPD_DELAY = 386,
+     DPD_RETRY = 387,
+     DPD_MAXFAIL = 388,
+     PH1ID = 389,
+     XAUTH_LOGIN = 390,
+     WEAK_PHASE1_CHECK = 391,
+     REKEY = 392,
+     PREFIX = 393,
+     PORT = 394,
+     PORTANY = 395,
+     UL_PROTO = 396,
+     ANY = 397,
+     IKE_FRAG = 398,
+     ESP_FRAG = 399,
+     MODE_CFG = 400,
+     PFS_GROUP = 401,
+     LIFETIME = 402,
+     LIFETYPE_TIME = 403,
+     LIFETYPE_BYTE = 404,
+     STRENGTH = 405,
+     REMOTEID = 406,
+     SCRIPT = 407,
+     PHASE1_UP = 408,
+     PHASE1_DOWN = 409,
+     PHASE1_DEAD = 410,
+     NUMBER = 411,
+     SWITCH = 412,
+     BOOLEAN = 413,
+     HEXSTRING = 414,
+     QUOTEDSTRING = 415,
+     ADDRSTRING = 416,
+     ADDRRANGE = 417,
+     UNITTYPE_BYTE = 418,
+     UNITTYPE_KBYTES = 419,
+     UNITTYPE_MBYTES = 420,
+     UNITTYPE_TBYTES = 421,
+     UNITTYPE_SEC = 422,
+     UNITTYPE_MIN = 423,
+     UNITTYPE_HOUR = 424,
+     EOS = 425,
+     BOC = 426,
+     EOC = 427,
+     COMMA = 428
    };
 #endif
 /* Tokens.  */
@@ -211,182 +220,197 @@
 #define PATH 262
 #define PATHTYPE 263
 #define INCLUDE 264
-#define IDENTIFIER 265
-#define VENDORID 266
-#define LOGGING 267
-#define LOGLEV 268
-#define PADDING 269
-#define PAD_RANDOMIZE 270
-#define PAD_RANDOMIZELEN 271
-#define PAD_MAXLEN 272
-#define PAD_STRICT 273
-#define PAD_EXCLTAIL 274
-#define LISTEN 275
-#define X_ISAKMP 276
-#define X_ISAKMP_NATT 277
-#define X_ADMIN 278
-#define STRICT_ADDRESS 279
-#define ADMINSOCK 280
-#define DISABLED 281
-#define LDAPCFG 282
-#define LDAP_HOST 283
-#define LDAP_PORT 284
-#define LDAP_PVER 285
-#define LDAP_BASE 286
-#define LDAP_BIND_DN 287
-#define LDAP_BIND_PW 288
-#define LDAP_SUBTREE 289
-#define LDAP_ATTR_USER 290
-#define LDAP_ATTR_ADDR 291
-#define LDAP_ATTR_MASK 292
-#define LDAP_ATTR_GROUP 293
-#define LDAP_ATTR_MEMBER 294
-#define MODECFG 295
-#define CFG_NET4 296
-#define CFG_MASK4 297
-#define CFG_DNS4 298
-#define CFG_NBNS4 299
-#define CFG_DEFAULT_DOMAIN 300
-#define CFG_AUTH_SOURCE 301
-#define CFG_AUTH_GROUPS 302
-#define CFG_SYSTEM 303
-#define CFG_RADIUS 304
-#define CFG_PAM 305
-#define CFG_LDAP 306
-#define CFG_LOCAL 307
-#define CFG_NONE 308
-#define CFG_GROUP_SOURCE 309
-#define CFG_ACCOUNTING 310
-#define CFG_CONF_SOURCE 311
-#define CFG_MOTD 312
-#define CFG_POOL_SIZE 313
-#define CFG_AUTH_THROTTLE 314
-#define CFG_SPLIT_NETWORK 315
-#define CFG_SPLIT_LOCAL 316
-#define CFG_SPLIT_INCLUDE 317
-#define CFG_SPLIT_DNS 318
-#define CFG_PFS_GROUP 319
-#define CFG_SAVE_PASSWD 320
-#define RETRY 321
-#define RETRY_COUNTER 322
-#define RETRY_INTERVAL 323
-#define RETRY_PERSEND 324
-#define RETRY_PHASE1 325
-#define RETRY_PHASE2 326
-#define NATT_KA 327
-#define ALGORITHM_CLASS 328
-#define ALGORITHMTYPE 329
-#define STRENGTHTYPE 330
-#define SAINFO 331
-#define FROM 332
-#define REMOTE 333
-#define ANONYMOUS 334
-#define INHERIT 335
-#define EXCHANGE_MODE 336
-#define EXCHANGETYPE 337
-#define DOI 338
-#define DOITYPE 339
-#define SITUATION 340
-#define SITUATIONTYPE 341
-#define CERTIFICATE_TYPE 342
-#define CERTTYPE 343
-#define PEERS_CERTFILE 344
-#define CA_TYPE 345
-#define VERIFY_CERT 346
-#define SEND_CERT 347
-#define SEND_CR 348
-#define IDENTIFIERTYPE 349
-#define IDENTIFIERQUAL 350
-#define MY_IDENTIFIER 351
-#define PEERS_IDENTIFIER 352
-#define VERIFY_IDENTIFIER 353
-#define DNSSEC 354
-#define CERT_X509 355
-#define CERT_PLAINRSA 356
-#define NONCE_SIZE 357
-#define DH_GROUP 358
-#define KEEPALIVE 359
-#define PASSIVE 360
-#define INITIAL_CONTACT 361
-#define NAT_TRAVERSAL 362
-#define REMOTE_FORCE_LEVEL 363
-#define PROPOSAL_CHECK 364
-#define PROPOSAL_CHECK_LEVEL 365
-#define GENERATE_POLICY 366
-#define GENERATE_LEVEL 367
-#define SUPPORT_PROXY 368
-#define PROPOSAL 369
-#define EXEC_PATH 370
-#define EXEC_COMMAND 371
-#define EXEC_SUCCESS 372
-#define EXEC_FAILURE 373
-#define GSS_ID 374
-#define GSS_ID_ENC 375
-#define GSS_ID_ENCTYPE 376
-#define COMPLEX_BUNDLE 377
-#define DPD 378
-#define DPD_DELAY 379
-#define DPD_RETRY 380
-#define DPD_MAXFAIL 381
-#define PH1ID 382
-#define XAUTH_LOGIN 383
-#define WEAK_PHASE1_CHECK 384
-#define PREFIX 385
-#define PORT 386
-#define PORTANY 387
-#define UL_PROTO 388
-#define ANY 389
-#define IKE_FRAG 390
-#define ESP_FRAG 391
-#define MODE_CFG 392
-#define PFS_GROUP 393
-#define LIFETIME 394
-#define LIFETYPE_TIME 395
-#define LIFETYPE_BYTE 396
-#define STRENGTH 397
-#define REMOTEID 398
-#define SCRIPT 399
-#define PHASE1_UP 400
-#define PHASE1_DOWN 401
-#define NUMBER 402
-#define SWITCH 403
-#define BOOLEAN 404
-#define HEXSTRING 405
-#define QUOTEDSTRING 406
-#define ADDRSTRING 407
-#define ADDRRANGE 408
-#define UNITTYPE_BYTE 409
-#define UNITTYPE_KBYTES 410
-#define UNITTYPE_MBYTES 411
-#define UNITTYPE_TBYTES 412
-#define UNITTYPE_SEC 413
-#define UNITTYPE_MIN 414
-#define UNITTYPE_HOUR 415
-#define EOS 416
-#define BOC 417
-#define EOC 418
-#define COMMA 419
+#define PFKEY_BUFFER 265
+#define LOGGING 266
+#define LOGLEV 267
+#define PADDING 268
+#define PAD_RANDOMIZE 269
+#define PAD_RANDOMIZELEN 270
+#define PAD_MAXLEN 271
+#define PAD_STRICT 272
+#define PAD_EXCLTAIL 273
+#define LISTEN 274
+#define X_ISAKMP 275
+#define X_ISAKMP_NATT 276
+#define X_ADMIN 277
+#define STRICT_ADDRESS 278
+#define ADMINSOCK 279
+#define DISABLED 280
+#define LDAPCFG 281
+#define LDAP_HOST 282
+#define LDAP_PORT 283
+#define LDAP_PVER 284
+#define LDAP_BASE 285
+#define LDAP_BIND_DN 286
+#define LDAP_BIND_PW 287
+#define LDAP_SUBTREE 288
+#define LDAP_ATTR_USER 289
+#define LDAP_ATTR_ADDR 290
+#define LDAP_ATTR_MASK 291
+#define LDAP_ATTR_GROUP 292
+#define LDAP_ATTR_MEMBER 293
+#define RADCFG 294
+#define RAD_AUTH 295
+#define RAD_ACCT 296
+#define RAD_TIMEOUT 297
+#define RAD_RETRIES 298
+#define MODECFG 299
+#define CFG_NET4 300
+#define CFG_MASK4 301
+#define CFG_DNS4 302
+#define CFG_NBNS4 303
+#define CFG_DEFAULT_DOMAIN 304
+#define CFG_AUTH_SOURCE 305
+#define CFG_AUTH_GROUPS 306
+#define CFG_SYSTEM 307
+#define CFG_RADIUS 308
+#define CFG_PAM 309
+#define CFG_LDAP 310
+#define CFG_LOCAL 311
+#define CFG_NONE 312
+#define CFG_GROUP_SOURCE 313
+#define CFG_ACCOUNTING 314
+#define CFG_CONF_SOURCE 315
+#define CFG_MOTD 316
+#define CFG_POOL_SIZE 317
+#define CFG_AUTH_THROTTLE 318
+#define CFG_SPLIT_NETWORK 319
+#define CFG_SPLIT_LOCAL 320
+#define CFG_SPLIT_INCLUDE 321
+#define CFG_SPLIT_DNS 322
+#define CFG_PFS_GROUP 323
+#define CFG_SAVE_PASSWD 324
+#define RETRY 325
+#define RETRY_COUNTER 326
+#define RETRY_INTERVAL 327
+#define RETRY_PERSEND 328
+#define RETRY_PHASE1 329
+#define RETRY_PHASE2 330
+#define NATT_KA 331
+#define ALGORITHM_CLASS 332
+#define ALGORITHMTYPE 333
+#define STRENGTHTYPE 334
+#define SAINFO 335
+#define FROM 336
+#define REMOTE 337
+#define ANONYMOUS 338
+#define CLIENTADDR 339
+#define INHERIT 340
+#define REMOTE_ADDRESS 341
+#define EXCHANGE_MODE 342
+#define EXCHANGETYPE 343
+#define DOI 344
+#define DOITYPE 345
+#define SITUATION 346
+#define SITUATIONTYPE 347
+#define CERTIFICATE_TYPE 348
+#define CERTTYPE 349
+#define PEERS_CERTFILE 350
+#define CA_TYPE 351
+#define VERIFY_CERT 352
+#define SEND_CERT 353
+#define SEND_CR 354
+#define MATCH_EMPTY_CR 355
+#define IDENTIFIERTYPE 356
+#define IDENTIFIERQUAL 357
+#define MY_IDENTIFIER 358
+#define PEERS_IDENTIFIER 359
+#define VERIFY_IDENTIFIER 360
+#define DNSSEC 361
+#define CERT_X509 362
+#define CERT_PLAINRSA 363
+#define NONCE_SIZE 364
+#define DH_GROUP 365
+#define KEEPALIVE 366
+#define PASSIVE 367
+#define INITIAL_CONTACT 368
+#define NAT_TRAVERSAL 369
+#define REMOTE_FORCE_LEVEL 370
+#define PROPOSAL_CHECK 371
+#define PROPOSAL_CHECK_LEVEL 372
+#define GENERATE_POLICY 373
+#define GENERATE_LEVEL 374
+#define SUPPORT_PROXY 375
+#define PROPOSAL 376
+#define EXEC_PATH 377
+#define EXEC_COMMAND 378
+#define EXEC_SUCCESS 379
+#define EXEC_FAILURE 380
+#define GSS_ID 381
+#define GSS_ID_ENC 382
+#define GSS_ID_ENCTYPE 383
+#define COMPLEX_BUNDLE 384
+#define DPD 385
+#define DPD_DELAY 386
+#define DPD_RETRY 387
+#define DPD_MAXFAIL 388
+#define PH1ID 389
+#define XAUTH_LOGIN 390
+#define WEAK_PHASE1_CHECK 391
+#define REKEY 392
+#define PREFIX 393
+#define PORT 394
+#define PORTANY 395
+#define UL_PROTO 396
+#define ANY 397
+#define IKE_FRAG 398
+#define ESP_FRAG 399
+#define MODE_CFG 400
+#define PFS_GROUP 401
+#define LIFETIME 402
+#define LIFETYPE_TIME 403
+#define LIFETYPE_BYTE 404
+#define STRENGTH 405
+#define REMOTEID 406
+#define SCRIPT 407
+#define PHASE1_UP 408
+#define PHASE1_DOWN 409
+#define PHASE1_DEAD 410
+#define NUMBER 411
+#define SWITCH 412
+#define BOOLEAN 413
+#define HEXSTRING 414
+#define QUOTEDSTRING 415
+#define ADDRSTRING 416
+#define ADDRRANGE 417
+#define UNITTYPE_BYTE 418
+#define UNITTYPE_KBYTES 419
+#define UNITTYPE_MBYTES 420
+#define UNITTYPE_TBYTES 421
+#define UNITTYPE_SEC 422
+#define UNITTYPE_MIN 423
+#define UNITTYPE_HOUR 424
+#define EOS 425
+#define BOC 426
+#define EOC 427
+#define COMMA 428
 
 
 
 
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
-#line 174 "cfparse.y"
 {
+
+/* Line 1676 of yacc.c  */
+#line 177 "cfparse.y"
+
 	unsigned long num;
 	vchar_t *val;
 	struct remoteconf *rmconf;
 	struct sockaddr *saddr;
 	struct sainfoalg *alg;
-}
-/* Line 1489 of yacc.c.  */
-#line 385 "cfparse.h"
-	YYSTYPE;
+
+
+
+/* Line 1676 of yacc.c  */
+#line 408 "cfparse.h"
+} YYSTYPE;
+# define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
-# define YYSTYPE_IS_TRIVIAL 1
 #endif
 
 extern YYSTYPE yylval;
 
+
diff --git a/src/racoon/cfparse.y b/src/racoon/cfparse.y
index 540c400..12920d8 100644
--- a/src/racoon/cfparse.y
+++ b/src/racoon/cfparse.y
@@ -1,4 +1,4 @@
-/*	$NetBSD: cfparse.y,v 1.18.4.7 2008/07/21 20:45:32 tteras Exp $	*/
+/*	$NetBSD: cfparse.y,v 1.42 2011/03/14 15:50:36 vanhu Exp $	*/
 
 /* Id: cfparse.y,v 1.66 2006/08/22 18:17:17 manubsd Exp */
 
@@ -94,14 +94,7 @@
 #endif
 #include "vendorid.h"
 #include "rsalist.h"
-
-struct proposalspec {
-	time_t lifetime;		/* for isakmp/ipsec */
-	int lifebyte;			/* for isakmp/ipsec */
-	struct secprotospec *spspec;	/* the head is always current spec. */
-	struct proposalspec *next;	/* the tail is the most prefered. */
-	struct proposalspec *prev;
-};
+#include "crypto_openssl.h"
 
 struct secprotospec {
 	int prop_no;
@@ -120,7 +113,6 @@
 
 	struct secprotospec *next;	/* the tail is the most prefiered. */
 	struct secprotospec *prev;
-	struct proposalspec *back;
 };
 
 static int num2dhgroup[] = {
@@ -151,24 +143,35 @@
 static int cur_algclass;
 static int oldloglevel = LLV_BASE;
 
-static struct proposalspec *newprspec __P((void));
-static void insprspec __P((struct proposalspec *, struct proposalspec **));
 static struct secprotospec *newspspec __P((void));
-static void insspspec __P((struct secprotospec *, struct proposalspec **));
+static void insspspec __P((struct remoteconf *, struct secprotospec *));
+void dupspspec_list __P((struct remoteconf *dst, struct remoteconf *src));
+void flushspspec __P((struct remoteconf *));
 static void adminsock_conf __P((vchar_t *, vchar_t *, vchar_t *, int));
 
-static int set_isakmp_proposal
-	__P((struct remoteconf *, struct proposalspec *));
+static int set_isakmp_proposal __P((struct remoteconf *));
 static void clean_tmpalgtype __P((void));
 static int expand_isakmpspec __P((int, int, int *,
 	int, int, time_t, int, int, int, char *, struct remoteconf *));
-static int listen_addr __P((struct sockaddr *addr, int udp_encap));
 
 void freeetypes (struct etypes **etypes);
 
-#if 0
-static int fix_lifebyte __P((u_long));
-#endif
+static int load_x509(const char *file, char **filenameptr,
+		     vchar_t **certptr)
+{
+	char path[PATH_MAX];
+
+	getpathname(path, sizeof(path), LC_PATHTYPE_CERT, file);
+	*certptr = eay_get_x509cert(path);
+	if (*certptr == NULL)
+		return -1;
+
+	*filenameptr = racoon_strdup(file);
+	STRDUP_FATAL(*filenameptr);
+
+	return 0;
+}
+
 %}
 
 %union {
@@ -185,8 +188,8 @@
 %token PATH PATHTYPE
 	/* include */
 %token INCLUDE
-	/* self information */
-%token IDENTIFIER VENDORID
+	/* PFKEY_BUFFER */
+%token PFKEY_BUFFER
 	/* logging */
 %token LOGGING LOGLEV
 	/* padding */
@@ -196,6 +199,8 @@
 	/* ldap config */
 %token LDAPCFG LDAP_HOST LDAP_PORT LDAP_PVER LDAP_BASE LDAP_BIND_DN LDAP_BIND_PW LDAP_SUBTREE
 %token LDAP_ATTR_USER LDAP_ATTR_ADDR LDAP_ATTR_MASK LDAP_ATTR_GROUP LDAP_ATTR_MEMBER
+	/* radius config */
+%token RADCFG RAD_AUTH RAD_ACCT RAD_TIMEOUT RAD_RETRIES
 	/* modecfg */
 %token MODECFG CFG_NET4 CFG_MASK4 CFG_DNS4 CFG_NBNS4 CFG_DEFAULT_DOMAIN
 %token CFG_AUTH_SOURCE CFG_AUTH_GROUPS CFG_SYSTEM CFG_RADIUS CFG_PAM CFG_LDAP CFG_LOCAL CFG_NONE
@@ -211,10 +216,10 @@
 	/* sainfo */
 %token SAINFO FROM
 	/* remote */
-%token REMOTE ANONYMOUS INHERIT
+%token REMOTE ANONYMOUS CLIENTADDR INHERIT REMOTE_ADDRESS
 %token EXCHANGE_MODE EXCHANGETYPE DOI DOITYPE SITUATION SITUATIONTYPE
 %token CERTIFICATE_TYPE CERTTYPE PEERS_CERTFILE CA_TYPE
-%token VERIFY_CERT SEND_CERT SEND_CR
+%token VERIFY_CERT SEND_CERT SEND_CR MATCH_EMPTY_CR
 %token IDENTIFIERTYPE IDENTIFIERQUAL MY_IDENTIFIER 
 %token PEERS_IDENTIFIER VERIFY_IDENTIFIER
 %token DNSSEC CERT_X509 CERT_PLAINRSA
@@ -229,11 +234,12 @@
 %token DPD DPD_DELAY DPD_RETRY DPD_MAXFAIL
 %token PH1ID
 %token XAUTH_LOGIN WEAK_PHASE1_CHECK
+%token REKEY
 
 %token PREFIX PORT PORTANY UL_PROTO ANY IKE_FRAG ESP_FRAG MODE_CFG
 %token PFS_GROUP LIFETIME LIFETYPE_TIME LIFETYPE_BYTE STRENGTH REMOTEID
 
-%token SCRIPT PHASE1_UP PHASE1_DOWN
+%token SCRIPT PHASE1_UP PHASE1_DOWN PHASE1_DEAD
 
 %token NUMBER SWITCH BOOLEAN
 %token HEXSTRING QUOTEDSTRING ADDRSTRING ADDRRANGE
@@ -265,12 +271,13 @@
 	:	privsep_statement
 	|	path_statement
 	|	include_statement
+	|	pfkey_statement
 	|	gssenc_statement
-	|	identifier_statement
 	|	logging_statement
 	|	padding_statement
 	|	listen_statement
 	|	ldapcfg_statement
+	|	radcfg_statement
 	|	modecfg_statement
 	|	timer_statement
 	|	sainfo_statement
@@ -354,6 +361,13 @@
 		}
 	;
 
+    /* pfkey_buffer */
+pfkey_statement
+    :   PFKEY_BUFFER NUMBER EOS
+        {
+			lcconf->pfkey_buffer_size = $2;
+        }
+    ;
 	/* gss_id_enc */
 gssenc_statement
 	:	GSS_ID_ENC GSS_ID_ENCTYPE EOS
@@ -366,45 +380,12 @@
 		}
 	;
 
-	/* self information */
-identifier_statement
-	:	IDENTIFIER identifier_stmt
-	;
-identifier_stmt
-	:	VENDORID
-		{
-			/*XXX to be deleted */
-		}
-		QUOTEDSTRING EOS
-	|	IDENTIFIERTYPE QUOTEDSTRING
-		{
-			/*XXX to be deleted */
-			$2->l--;	/* nuke '\0' */
-			lcconf->ident[$1] = $2;
-			if (lcconf->ident[$1] == NULL) {
-				yyerror("failed to set my ident: %s",
-					strerror(errno));
-				return -1;
-			}
-		}
-		EOS
-	;
-
 	/* logging */
 logging_statement
 	:	LOGGING log_level EOS
 	;
 log_level
-	:	HEXSTRING
-		{
-			/*
-			 * XXX ignore it because this specification
-			 * will be obsoleted.
-			 */
-			yywarn("see racoon.conf(5), such a log specification will be obsoleted.");
-			vfree($1);
-		}
-	|	LOGLEV
+	:	LOGLEV
 		{
 			/*
 			 * set the loglevel to the value specified
@@ -443,23 +424,21 @@
 listen_stmt
 	:	X_ISAKMP ike_addrinfo_port
 		{
-			listen_addr ($2, 0);
+			myaddr_listen($2, FALSE);
+			racoon_free($2);
 		}
 		EOS
 	|	X_ISAKMP_NATT ike_addrinfo_port
 		{
 #ifdef ENABLE_NATT
-			listen_addr ($2, 1);
+			myaddr_listen($2, TRUE);
+			racoon_free($2);
 #else
+			racoon_free($2);
 			yyerror("NAT-T support not compiled in.");
 #endif
 		}
 		EOS
-	|	X_ADMIN
-		{
-			yyerror("admin directive is obsoleted.");
-		}
-		PORT EOS
 	|	ADMINSOCK QUOTEDSTRING QUOTEDSTRING QUOTEDSTRING NUMBER 
 		{
 #ifdef ENABLE_ADMINPORT
@@ -506,6 +485,122 @@
 	|	PORT		{ $$ = $1; }
 	;
 
+	/* radius configuration */
+radcfg_statement
+	:	RADCFG {
+#ifndef ENABLE_HYBRID
+			yyerror("racoon not configured with --enable-hybrid");
+			return -1;
+#endif
+#ifndef HAVE_LIBRADIUS
+			yyerror("racoon not configured with --with-libradius");
+			return -1;
+#endif
+#ifdef ENABLE_HYBRID
+#ifdef HAVE_LIBRADIUS
+			xauth_rad_config.timeout = 3;
+			xauth_rad_config.retries = 3;
+#endif
+#endif
+		} BOC radcfg_stmts EOC
+	;
+radcfg_stmts
+	:	/* nothing */
+	|	radcfg_stmts radcfg_stmt
+	;
+radcfg_stmt
+	:	RAD_AUTH QUOTEDSTRING QUOTEDSTRING
+		{
+#ifdef ENABLE_HYBRID
+#ifdef HAVE_LIBRADIUS
+			int i = xauth_rad_config.auth_server_count;
+			if (i == RADIUS_MAX_SERVERS) {
+				yyerror("maximum radius auth servers exceeded");
+				return -1;
+			}
+
+			xauth_rad_config.auth_server_list[i].host = vdup($2);
+			xauth_rad_config.auth_server_list[i].secret = vdup($3);
+			xauth_rad_config.auth_server_list[i].port = 0; // default port
+			xauth_rad_config.auth_server_count++;
+#endif
+#endif
+		}
+		EOS
+	|	RAD_AUTH QUOTEDSTRING NUMBER QUOTEDSTRING
+		{
+#ifdef ENABLE_HYBRID
+#ifdef HAVE_LIBRADIUS
+			int i = xauth_rad_config.auth_server_count;
+			if (i == RADIUS_MAX_SERVERS) {
+				yyerror("maximum radius auth servers exceeded");
+				return -1;
+			}
+
+			xauth_rad_config.auth_server_list[i].host = vdup($2);
+			xauth_rad_config.auth_server_list[i].secret = vdup($4);
+			xauth_rad_config.auth_server_list[i].port = $3;
+			xauth_rad_config.auth_server_count++;
+#endif
+#endif
+		}
+		EOS
+	|	RAD_ACCT QUOTEDSTRING QUOTEDSTRING
+		{
+#ifdef ENABLE_HYBRID
+#ifdef HAVE_LIBRADIUS
+			int i = xauth_rad_config.acct_server_count;
+			if (i == RADIUS_MAX_SERVERS) {
+				yyerror("maximum radius account servers exceeded");
+				return -1;
+			}
+
+			xauth_rad_config.acct_server_list[i].host = vdup($2);
+			xauth_rad_config.acct_server_list[i].secret = vdup($3);
+			xauth_rad_config.acct_server_list[i].port = 0; // default port
+			xauth_rad_config.acct_server_count++;
+#endif
+#endif
+		}
+		EOS
+	|	RAD_ACCT QUOTEDSTRING NUMBER QUOTEDSTRING
+		{
+#ifdef ENABLE_HYBRID
+#ifdef HAVE_LIBRADIUS
+			int i = xauth_rad_config.acct_server_count;
+			if (i == RADIUS_MAX_SERVERS) {
+				yyerror("maximum radius account servers exceeded");
+				return -1;
+			}
+
+			xauth_rad_config.acct_server_list[i].host = vdup($2);
+			xauth_rad_config.acct_server_list[i].secret = vdup($4);
+			xauth_rad_config.acct_server_list[i].port = $3;
+			xauth_rad_config.acct_server_count++;
+#endif
+#endif
+		}
+		EOS
+	|	RAD_TIMEOUT NUMBER
+		{
+#ifdef ENABLE_HYBRID
+#ifdef HAVE_LIBRADIUS
+			xauth_rad_config.timeout = $2;
+#endif
+#endif
+		}
+		EOS
+	|	RAD_RETRIES NUMBER
+		{
+#ifdef ENABLE_HYBRID
+#ifdef HAVE_LIBRADIUS
+			xauth_rad_config.retries = $2;
+#endif
+#endif
+		}
+		EOS
+	;
+
 	/* ldap configuration */
 ldapcfg_statement
 	:	LDAPCFG {
@@ -1015,12 +1110,16 @@
 
 			grouplist = racoon_realloc(icc->grouplist,
 					sizeof(char**)*(icc->groupcount+1));
-			if (grouplist == NULL)
+			if (grouplist == NULL) {
 				yyerror("unable to allocate auth group list");
+				return -1;
+			}
 
 			groupname = racoon_malloc($1->l+1);
-			if (groupname == NULL)
+			if (groupname == NULL) {
 				yyerror("unable to allocate auth group name");
+				return -1;
+			}
 
 			memcpy(groupname,$1->v,$1->l);
 			groupname[$1->l]=0;
@@ -1048,8 +1147,10 @@
 			if (!icc->splitdns_len)
 			{
 				icc->splitdns_list = racoon_malloc($1->l);
-				if(icc->splitdns_list == NULL)
+				if(icc->splitdns_list == NULL) {
 					yyerror("error allocating splitdns list buffer");
+					return -1;
+				}
 				memcpy(icc->splitdns_list,$1->v,$1->l);
 				icc->splitdns_len = $1->l;
 			}
@@ -1057,8 +1158,10 @@
 			{
 				int len = icc->splitdns_len + $1->l + 1;
 				icc->splitdns_list = racoon_realloc(icc->splitdns_list,len);
-				if(icc->splitdns_list == NULL)
+				if(icc->splitdns_list == NULL) {
 					yyerror("error allocating splitdns list buffer");
+					return -1;
+				}
 				icc->splitdns_list[icc->splitdns_len] = ',';
 				memcpy(icc->splitdns_list + icc->splitdns_len + 1, $1->v, $1->l);
 				icc->splitdns_len = len;
@@ -1154,12 +1257,16 @@
 			check = getsainfo(cur_sainfo->idsrc,
 					  cur_sainfo->iddst,
 					  cur_sainfo->id_i,
+					  NULL,
 					  cur_sainfo->remoteid);
-			if (check && (!check->idsrc && !cur_sainfo->idsrc)) {
+
+			if (check && ((check->idsrc != SAINFO_ANONYMOUS) &&
+				      (cur_sainfo->idsrc != SAINFO_ANONYMOUS))) {
 				yyerror("duplicated sainfo: %s",
 					sainfo2str(cur_sainfo));
 				return -1;
 			}
+
 			inssainfo(cur_sainfo);
 		}
 		EOC
@@ -1167,18 +1274,28 @@
 sainfo_name
 	:	ANONYMOUS
 		{
-			cur_sainfo->idsrc = NULL;
-			cur_sainfo->iddst = NULL;
+			cur_sainfo->idsrc = SAINFO_ANONYMOUS;
+			cur_sainfo->iddst = SAINFO_ANONYMOUS;
+		}
+	|	ANONYMOUS CLIENTADDR
+		{
+			cur_sainfo->idsrc = SAINFO_ANONYMOUS;
+			cur_sainfo->iddst = SAINFO_CLIENTADDR;
 		}
 	|	ANONYMOUS sainfo_id
 		{
-			cur_sainfo->idsrc = NULL;
+			cur_sainfo->idsrc = SAINFO_ANONYMOUS;
 			cur_sainfo->iddst = $2;
 		}
 	|	sainfo_id ANONYMOUS
 		{
 			cur_sainfo->idsrc = $1;
-			cur_sainfo->iddst = NULL;
+			cur_sainfo->iddst = SAINFO_ANONYMOUS;
+		}
+	|	sainfo_id CLIENTADDR
+		{
+			cur_sainfo->idsrc = $1;
+			cur_sainfo->iddst = SAINFO_CLIENTADDR;
 		}
 	|	sainfo_id sainfo_id
 		{
@@ -1407,16 +1524,6 @@
 			cur_algclass = $1;
 		}
 		algorithms EOS
-	|	IDENTIFIER IDENTIFIERTYPE
-		{
-			yyerror("it's deprecated to specify a identifier in phase 2");
-		}
-		EOS
-	|	MY_IDENTIFIER IDENTIFIERTYPE QUOTEDSTRING
-		{
-			yyerror("it's deprecated to specify a identifier in phase 2");
-		}
-		EOS
 	;
 
 algorithms
@@ -1507,36 +1614,82 @@
 
 	/* remote */
 remote_statement
-	:	REMOTE remote_index INHERIT remote_index
+	: REMOTE QUOTEDSTRING INHERIT QUOTEDSTRING
 		{
-			struct remoteconf *new;
-			struct proposalspec *prspec;
+			struct remoteconf *from, *new;
 
-			new = copyrmconf($4);
-			if (new == NULL) {
-				yyerror("failed to get remoteconf for %s.", saddr2str ($4));
+			if (getrmconf_by_name($2->v) != NULL) {
+				yyerror("named remoteconf \"%s\" already exists.");
 				return -1;
 			}
 
-			new->remote = $2;
-			new->inherited_from = getrmconf_strict($4, 1);
-			new->proposal = NULL;
-			new->prhead = NULL;
+			from = getrmconf_by_name($4->v);
+			if (from == NULL) {
+				yyerror("named parent remoteconf \"%s\" does not exist.",
+					$4->v);
+				return -1;
+			}
+
+			new = duprmconf_shallow(from);
+			if (new == NULL) {
+				yyerror("failed to duplicate remoteconf from \"%s\".",
+					$4->v);
+				return -1;
+			}
+
+			new->name = racoon_strdup($2->v);
 			cur_rmconf = new;
 
-			prspec = newprspec();
-			if (prspec == NULL || !cur_rmconf->inherited_from 
-				|| !cur_rmconf->inherited_from->proposal)
+			vfree($2);
+			vfree($4);
+		}
+		remote_specs_block
+	| REMOTE QUOTEDSTRING
+		{
+			struct remoteconf *new;
+
+			if (getrmconf_by_name($2->v) != NULL) {
+				yyerror("Named remoteconf \"%s\" already exists.");
 				return -1;
-			prspec->lifetime = cur_rmconf->inherited_from->proposal->lifetime;
-			prspec->lifebyte = cur_rmconf->inherited_from->proposal->lifebyte;
-			insprspec(prspec, &cur_rmconf->prhead);
+			}
+
+			new = newrmconf();
+			if (new == NULL) {
+				yyerror("failed to get new remoteconf.");
+				return -1;
+			}
+			new->name = racoon_strdup($2->v);
+			cur_rmconf = new;
+
+			vfree($2);
+		}
+		remote_specs_block
+	| REMOTE remote_index INHERIT remote_index
+		{
+			struct remoteconf *from, *new;
+
+			from = getrmconf($4, GETRMCONF_F_NO_ANONYMOUS);
+			if (from == NULL) {
+				yyerror("failed to get remoteconf for %s.",
+					saddr2str($4));
+				return -1;
+			}
+
+			new = duprmconf_shallow(from);
+			if (new == NULL) {
+				yyerror("failed to duplicate remoteconf from %s.",
+					saddr2str($4));
+				return -1;
+			}
+
+			racoon_free($4);
+			new->remote = $2;
+			cur_rmconf = new;
 		}
 		remote_specs_block
 	|	REMOTE remote_index
 		{
 			struct remoteconf *new;
-			struct proposalspec *prspec;
 
 			new = newrmconf();
 			if (new == NULL) {
@@ -1546,12 +1699,6 @@
 
 			new->remote = $2;
 			cur_rmconf = new;
-
-			prspec = newprspec();
-			if (prspec == NULL)
-				return -1;
-			prspec->lifetime = oakley_get_defaultlifetime();
-			insprspec(prspec, &cur_rmconf->prhead);
 		}
 		remote_specs_block
 	;
@@ -1568,7 +1715,6 @@
 			if (cur_rmconf->idvtype == IDTYPE_UNDEFINED)
 				cur_rmconf->idvtype = IDTYPE_ADDRESS;
 
-
 			if (cur_rmconf->idvtype == IDTYPE_ASN1DN) {
 				if (cur_rmconf->mycertfile) {
 					if (cur_rmconf->idv)
@@ -1583,17 +1729,24 @@
 					return -1;
 				}
 			}
-			
-			if (cur_rmconf->prhead->spspec == NULL
-				&& cur_rmconf->inherited_from
-				&& cur_rmconf->inherited_from->prhead) {
-				cur_rmconf->prhead->spspec = cur_rmconf->inherited_from->prhead->spspec;
+
+			if (duprmconf_finish(cur_rmconf))
+				return -1;
+
+#if 0
+			/* this pointer copy will never happen, because duprmconf_shallow
+			 * already copied all pointers.
+			 */
+			if (cur_rmconf->spspec == NULL &&
+			    cur_rmconf->inherited_from != NULL) {
+				cur_rmconf->spspec = cur_rmconf->inherited_from->spspec;
 			}
-			if (set_isakmp_proposal(cur_rmconf, cur_rmconf->prhead) != 0)
+#endif
+			if (set_isakmp_proposal(cur_rmconf) != 0)
 				return -1;
 
 			/* DH group settting if aggressive mode is there. */
-			if (check_etypeok(cur_rmconf, ISAKMP_ETYPE_AGG) != NULL) {
+			if (check_etypeok(cur_rmconf, (void*) ISAKMP_ETYPE_AGG)) {
 				struct isakmpsa *p;
 				int b = 0;
 
@@ -1648,7 +1801,16 @@
 	|	remote_specs remote_spec
 	;
 remote_spec
-	:	EXCHANGE_MODE
+	:	REMOTE_ADDRESS ike_addrinfo_port
+		{
+			if (cur_rmconf->remote != NULL) {
+				yyerror("remote_address already specified");
+				return -1;
+			}
+			cur_rmconf->remote = $2;
+		}
+		EOS
+	|	EXCHANGE_MODE
 		{
 			cur_rmconf->etypes = NULL;
 		}
@@ -1660,33 +1822,36 @@
 		{
 			yywarn("This directive without certtype will be removed!\n");
 			yywarn("Please use 'peers_certfile x509 \"%s\";' instead\n", $2->v);
-			cur_rmconf->getcert_method = ISAKMP_GETCERT_LOCALFILE;
 
-			if (cur_rmconf->peerscertfile != NULL)
-				racoon_free(cur_rmconf->peerscertfile);
-			cur_rmconf->peerscertfile = racoon_strdup($2->v);
-			STRDUP_FATAL(cur_rmconf->peerscertfile);
+			if (cur_rmconf->peerscert != NULL) {
+				yyerror("peers_certfile already defined\n");
+				return -1;
+			}
+
+			if (load_x509($2->v, &cur_rmconf->peerscertfile,
+				      &cur_rmconf->peerscert)) {
+				yyerror("failed to load certificate \"%s\"\n",
+					$2->v);
+				return -1;
+			}
+
 			vfree($2);
 		}
 		EOS
-	|	CA_TYPE CERT_X509 QUOTEDSTRING
-		{
-			cur_rmconf->cacerttype = $2;
-			cur_rmconf->getcacert_method = ISAKMP_GETCERT_LOCALFILE;
-			if (cur_rmconf->cacertfile != NULL)
-				racoon_free(cur_rmconf->cacertfile);
-			cur_rmconf->cacertfile = racoon_strdup($3->v);
-			STRDUP_FATAL(cur_rmconf->cacertfile);
-			vfree($3);
-		}
-		EOS
 	|	PEERS_CERTFILE CERT_X509 QUOTEDSTRING
 		{
-			cur_rmconf->getcert_method = ISAKMP_GETCERT_LOCALFILE;
-			if (cur_rmconf->peerscertfile != NULL)
-				racoon_free(cur_rmconf->peerscertfile);
-			cur_rmconf->peerscertfile = racoon_strdup($3->v);
-			STRDUP_FATAL(cur_rmconf->peerscertfile);
+			if (cur_rmconf->peerscert != NULL) {
+				yyerror("peers_certfile already defined\n");
+				return -1;
+			}
+
+			if (load_x509($3->v, &cur_rmconf->peerscertfile,
+				      &cur_rmconf->peerscert)) {
+				yyerror("failed to load certificate \"%s\"\n",
+					$3->v);
+				return -1;
+			}
+
 			vfree($3);
 		}
 		EOS
@@ -1695,37 +1860,66 @@
 			char path[MAXPATHLEN];
 			int ret = 0;
 
-			getpathname(path, sizeof(path),
-				LC_PATHTYPE_CERT, $3->v);
-			vfree($3);
-
-			if (cur_rmconf->getcert_method == ISAKMP_GETCERT_DNS) {
-				yyerror("Different peers_certfile method "
-					"already defined: %d!\n",
-					cur_rmconf->getcert_method);
+			if (cur_rmconf->peerscert != NULL) {
+				yyerror("peers_certfile already defined\n");
 				return -1;
 			}
-			cur_rmconf->getcert_method = ISAKMP_GETCERT_LOCALFILE;
-			if (rsa_parse_file(cur_rmconf->rsa_public, path, RSA_TYPE_PUBLIC)) {
+
+			cur_rmconf->peerscert = vmalloc(1);
+			if (cur_rmconf->peerscert == NULL) {
+				yyerror("failed to allocate peerscert");
+				return -1;
+			}
+			cur_rmconf->peerscert->v[0] = ISAKMP_CERT_PLAINRSA;
+
+			getpathname(path, sizeof(path),
+				    LC_PATHTYPE_CERT, $3->v);
+			if (rsa_parse_file(cur_rmconf->rsa_public, path,
+					   RSA_TYPE_PUBLIC)) {
 				yyerror("Couldn't parse keyfile.\n", path);
 				return -1;
 			}
-			plog(LLV_DEBUG, LOCATION, NULL, "Public PlainRSA keyfile parsed: %s\n", path);
+			plog(LLV_DEBUG, LOCATION, NULL,
+			     "Public PlainRSA keyfile parsed: %s\n", path);
+
+			vfree($3);
 		}
 		EOS
 	|	PEERS_CERTFILE DNSSEC
 		{
-			if (cur_rmconf->getcert_method) {
-				yyerror("Different peers_certfile method already defined!\n");
+			if (cur_rmconf->peerscert != NULL) {
+				yyerror("peers_certfile already defined\n");
 				return -1;
 			}
-			cur_rmconf->getcert_method = ISAKMP_GETCERT_DNS;
-			cur_rmconf->peerscertfile = NULL;
+			cur_rmconf->peerscert = vmalloc(1);
+			if (cur_rmconf->peerscert == NULL) {
+				yyerror("failed to allocate peerscert");
+				return -1;
+			}
+			cur_rmconf->peerscert->v[0] = ISAKMP_CERT_DNS;
+		}
+		EOS
+	|	CA_TYPE CERT_X509 QUOTEDSTRING
+		{
+			if (cur_rmconf->cacert != NULL) {
+				yyerror("ca_type already defined\n");
+				return -1;
+			}
+
+			if (load_x509($3->v, &cur_rmconf->cacertfile,
+				      &cur_rmconf->cacert)) {
+				yyerror("failed to load certificate \"%s\"\n",
+					$3->v);
+				return -1;
+			}
+
+			vfree($3);
 		}
 		EOS
 	|	VERIFY_CERT SWITCH { cur_rmconf->verify_cert = $2; } EOS
 	|	SEND_CERT SWITCH { cur_rmconf->send_cert = $2; } EOS
 	|	SEND_CR SWITCH { cur_rmconf->send_cr = $2; } EOS
+	|	MATCH_EMPTY_CR SWITCH { cur_rmconf->match_empty_cr = $2; } EOS
 	|	MY_IDENTIFIER IDENTIFIERTYPE identifierstring
 		{
 			if (set_identifier(&cur_rmconf->idv, $2, $3) != 0) {
@@ -1830,6 +2024,13 @@
 			cur_rmconf->script[SCRIPT_PHASE1_DOWN] = 
 			    script_path_add(vdup($2));
 		} EOS
+	|	SCRIPT QUOTEDSTRING PHASE1_DEAD { 
+			if (cur_rmconf->script[SCRIPT_PHASE1_DEAD] != NULL)
+				vfree(cur_rmconf->script[SCRIPT_PHASE1_DEAD]);
+
+			cur_rmconf->script[SCRIPT_PHASE1_DEAD] = 
+			    script_path_add(vdup($2));
+		} EOS
 	|	MODE_CFG SWITCH { cur_rmconf->mode_cfg = $2; } EOS
 	|	WEAK_PHASE1_CHECK SWITCH {
 			cur_rmconf->weak_phase1_check = $2;
@@ -1895,6 +2096,8 @@
 #endif
 		}
 		EOS
+	|	REKEY SWITCH { cur_rmconf->rekey = $2; } EOS
+	|	REKEY REMOTE_FORCE_LEVEL { cur_rmconf->rekey = REKEY_FORCE; } EOS
 	|	PH1ID NUMBER
 		{
 			cur_rmconf->ph1id = $2;
@@ -1902,7 +2105,7 @@
 		EOS
 	|	LIFETIME LIFETYPE_TIME NUMBER unittype_time
 		{
-			cur_rmconf->prhead->lifetime = $3 * $4;
+			cur_rmconf->lifetime = $3 * $4;
 		}
 		EOS
 	|	PROPOSAL_CHECK PROPOSAL_CHECK_LEVEL { cur_rmconf->pcheck_level = $2; } EOS
@@ -1914,8 +2117,8 @@
 #else
 			yywarn("the lifetime of bytes in phase 1 "
 				"will be ignored at the moment.");
-			cur_rmconf->prhead->lifebyte = fix_lifebyte($3 * $4);
-			if (cur_rmconf->prhead->lifebyte == 0)
+			cur_rmconf->lifebyte = fix_lifebyte($3 * $4);
+			if (cur_rmconf->lifebyte == 0)
 				return -1;
 #endif
 		}
@@ -1927,7 +2130,7 @@
 			spspec = newspspec();
 			if (spspec == NULL)
 				return -1;
-			insspspec(spspec, &cur_rmconf->prhead);
+			insspspec(cur_rmconf, spspec);
 		}
 		BOC isakmpproposal_specs EOC
 	;
@@ -1958,16 +2161,22 @@
 cert_spec
 	:	CERT_X509 QUOTEDSTRING QUOTEDSTRING
 		{
-			cur_rmconf->certtype = $1;
-			if (cur_rmconf->mycertfile != NULL)
-				racoon_free(cur_rmconf->mycertfile);
-			cur_rmconf->mycertfile = racoon_strdup($2->v);
-			STRDUP_FATAL(cur_rmconf->mycertfile);
-			vfree($2);
-			if (cur_rmconf->myprivfile != NULL)
-				racoon_free(cur_rmconf->myprivfile);
+			if (cur_rmconf->mycert != NULL) {
+				yyerror("certificate_type already defined\n");
+				return -1;
+			}
+
+			if (load_x509($2->v, &cur_rmconf->mycertfile,
+				      &cur_rmconf->mycert)) {
+				yyerror("failed to load certificate \"%s\"\n",
+					$2->v);
+				return -1;
+			}
+
 			cur_rmconf->myprivfile = racoon_strdup($3->v);
 			STRDUP_FATAL(cur_rmconf->myprivfile);
+
+			vfree($2);
 			vfree($3);
 		}
 		EOS
@@ -1976,19 +2185,31 @@
 			char path[MAXPATHLEN];
 			int ret = 0;
 
-			getpathname(path, sizeof(path),
-				LC_PATHTYPE_CERT, $2->v);
-			vfree($2);
+			if (cur_rmconf->mycert != NULL) {
+				yyerror("certificate_type already defined\n");
+				return -1;
+			}
 
-			cur_rmconf->certtype = $1;
+			cur_rmconf->mycert = vmalloc(1);
+			if (cur_rmconf->mycert == NULL) {
+				yyerror("failed to allocate mycert");
+				return -1;
+			}
+			cur_rmconf->mycert->v[0] = ISAKMP_CERT_PLAINRSA;
+
+			getpathname(path, sizeof(path),
+				    LC_PATHTYPE_CERT, $2->v);
 			cur_rmconf->send_cr = FALSE;
 			cur_rmconf->send_cert = FALSE;
 			cur_rmconf->verify_cert = FALSE;
-			if (rsa_parse_file(cur_rmconf->rsa_private, path, RSA_TYPE_PRIVATE)) {
+			if (rsa_parse_file(cur_rmconf->rsa_private, path,
+					   RSA_TYPE_PRIVATE)) {
 				yyerror("Couldn't parse keyfile.\n", path);
 				return -1;
 			}
-			plog(LLV_DEBUG, LOCATION, NULL, "Private PlainRSA keyfile parsed: %s\n", path);
+			plog(LLV_DEBUG, LOCATION, NULL,
+			     "Private PlainRSA keyfile parsed: %s\n", path);
+			vfree($2);
 		}
 		EOS
 	;
@@ -2022,13 +2243,9 @@
 	|	isakmpproposal_specs isakmpproposal_spec
 	;
 isakmpproposal_spec
-	:	STRENGTH
+	:	LIFETIME LIFETYPE_TIME NUMBER unittype_time
 		{
-			yyerror("strength directive is obsoleted.");
-		} STRENGTHTYPE EOS
-	|	LIFETIME LIFETYPE_TIME NUMBER unittype_time
-		{
-			cur_rmconf->prhead->spspec->lifetime = $3 * $4;
+			cur_rmconf->spspec->lifetime = $3 * $4;
 		}
 		EOS
 	|	LIFETIME LIFETYPE_BYTE NUMBER unittype_byte
@@ -2037,28 +2254,28 @@
 			yyerror("byte lifetime support is deprecated");
 			return -1;
 #else
-			cur_rmconf->prhead->spspec->lifebyte = fix_lifebyte($3 * $4);
-			if (cur_rmconf->prhead->spspec->lifebyte == 0)
+			cur_rmconf->spspec->lifebyte = fix_lifebyte($3 * $4);
+			if (cur_rmconf->spspec->lifebyte == 0)
 				return -1;
 #endif
 		}
 		EOS
 	|	DH_GROUP dh_group_num
 		{
-			cur_rmconf->prhead->spspec->algclass[algclass_isakmp_dh] = $2;
+			cur_rmconf->spspec->algclass[algclass_isakmp_dh] = $2;
 		}
 		EOS
 	|	GSS_ID QUOTEDSTRING
 		{
-			if (cur_rmconf->prhead->spspec->vendorid != VENDORID_GSSAPI) {
+			if (cur_rmconf->spspec->vendorid != VENDORID_GSSAPI) {
 				yyerror("wrong Vendor ID for gssapi_id");
 				return -1;
 			}
-			if (cur_rmconf->prhead->spspec->gssid != NULL)
-				racoon_free(cur_rmconf->prhead->spspec->gssid);
-			cur_rmconf->prhead->spspec->gssid = 
+			if (cur_rmconf->spspec->gssid != NULL)
+				racoon_free(cur_rmconf->spspec->gssid);
+			cur_rmconf->spspec->gssid =
 			    racoon_strdup($2->v);
-			STRDUP_FATAL(cur_rmconf->prhead->spspec->gssid);
+			STRDUP_FATAL(cur_rmconf->spspec->gssid);
 		}
 		EOS
 	|	ALGORITHM_CLASS ALGORITHMTYPE keylength
@@ -2090,7 +2307,7 @@
 				}
 #endif
 
-				cur_rmconf->prhead->spspec->algclass[algclass_isakmp_enc] = doi;
+				cur_rmconf->spspec->algclass[algclass_isakmp_enc] = doi;
 				defklen = default_keylen($1, $2);
 				if (defklen == 0) {
 					if ($3) {
@@ -2104,22 +2321,22 @@
 					}
 				}
 				if ($3)
-					cur_rmconf->prhead->spspec->encklen = $3;
+					cur_rmconf->spspec->encklen = $3;
 				else
-					cur_rmconf->prhead->spspec->encklen = defklen;
+					cur_rmconf->spspec->encklen = defklen;
 				break;
 			case algclass_isakmp_hash:
-				cur_rmconf->prhead->spspec->algclass[algclass_isakmp_hash] = doi;
+				cur_rmconf->spspec->algclass[algclass_isakmp_hash] = doi;
 				break;
 			case algclass_isakmp_ameth:
-				cur_rmconf->prhead->spspec->algclass[algclass_isakmp_ameth] = doi;
+				cur_rmconf->spspec->algclass[algclass_isakmp_ameth] = doi;
 				/*
 				 * We may have to set the Vendor ID for the
 				 * authentication method we're using.
 				 */
 				switch ($2) {
 				case algtype_gssapikrb:
-					if (cur_rmconf->prhead->spspec->vendorid !=
+					if (cur_rmconf->spspec->vendorid !=
 					    VENDORID_UNKNOWN) {
 						yyerror("Vendor ID mismatch "
 						    "for auth method");
@@ -2129,19 +2346,19 @@
 					 * For interoperability with Win2k,
 					 * we set the Vendor ID to "GSSAPI".
 					 */
-					cur_rmconf->prhead->spspec->vendorid =
+					cur_rmconf->spspec->vendorid =
 					    VENDORID_GSSAPI;
 					break;
 				case algtype_rsasig:
-					if (cur_rmconf->certtype == ISAKMP_CERT_PLAINRSA) {
+					if (oakley_get_certtype(cur_rmconf->peerscert) == ISAKMP_CERT_PLAINRSA) {
 						if (rsa_list_count(cur_rmconf->rsa_private) == 0) {
 							yyerror ("Private PlainRSA key not set. "
-								"Use directive 'certificate_type plainrsa ...'\n");
+								 "Use directive 'certificate_type plainrsa ...'\n");
 							return -1;
 						}
 						if (rsa_list_count(cur_rmconf->rsa_public) == 0) {
 							yyerror ("Public PlainRSA keys not set. "
-								"Use directive 'peers_certfile plainrsa ...'\n");
+								 "Use directive 'peers_certfile plainrsa ...'\n");
 							return -1;
 						}
 					}
@@ -2171,32 +2388,6 @@
 	;
 %%
 
-static struct proposalspec *
-newprspec()
-{
-	struct proposalspec *new;
-
-	new = racoon_calloc(1, sizeof(*new));
-	if (new == NULL)
-		yyerror("failed to allocate proposal");
-
-	return new;
-}
-
-/*
- * insert into head of list.
- */
-static void
-insprspec(prspec, head)
-	struct proposalspec *prspec;
-	struct proposalspec **head;
-{
-	if (*head != NULL)
-		(*head)->prev = prspec;
-	prspec->next = *head;
-	*head = prspec;
-}
-
 static struct secprotospec *
 newspspec()
 {
@@ -2224,44 +2415,113 @@
  * insert into head of list.
  */
 static void
-insspspec(spspec, head)
+insspspec(rmconf, spspec)
+	struct remoteconf *rmconf;
 	struct secprotospec *spspec;
-	struct proposalspec **head;
 {
-	spspec->back = *head;
+	if (rmconf->spspec != NULL)
+		rmconf->spspec->prev = spspec;
+	spspec->next = rmconf->spspec;
+	rmconf->spspec = spspec;
+}
 
-	if ((*head)->spspec != NULL)
-		(*head)->spspec->prev = spspec;
-	spspec->next = (*head)->spspec;
-	(*head)->spspec = spspec;
+static struct secprotospec *
+dupspspec(spspec)
+	struct secprotospec *spspec;
+{
+	struct secprotospec *new;
+
+	new = newspspec();
+	if (new == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL, 
+		    "dupspspec: malloc failed\n");
+		return NULL;
+	}
+	memcpy(new, spspec, sizeof(*new));
+
+	if (spspec->gssid) {
+		new->gssid = racoon_strdup(spspec->gssid);
+		STRDUP_FATAL(new->gssid);
+	}
+	if (spspec->remote) {
+		new->remote = racoon_malloc(sizeof(*new->remote));
+		if (new->remote == NULL) {
+			plog(LLV_ERROR, LOCATION, NULL, 
+			    "dupspspec: malloc failed (remote)\n");
+			return NULL;
+		}
+		memcpy(new->remote, spspec->remote, sizeof(*new->remote));
+	}
+
+	return new;
+}
+
+/*
+ * copy the whole list
+ */
+void
+dupspspec_list(dst, src)
+	struct remoteconf *dst, *src;
+{
+	struct secprotospec *p, *new, *last;
+
+	for(p = src->spspec, last = NULL; p; p = p->next, last = new) {
+		new = dupspspec(p);
+		if (new == NULL)
+			exit(1);
+
+		new->prev = last;
+		new->next = NULL; /* not necessary but clean */
+
+		if (last)
+			last->next = new;
+		else /* first element */
+			dst->spspec = new;
+
+	}
+}
+
+/*
+ * delete the whole list
+ */
+void
+flushspspec(rmconf)
+	struct remoteconf *rmconf;
+{
+	struct secprotospec *p;
+
+	while(rmconf->spspec != NULL) {
+		p = rmconf->spspec;
+		rmconf->spspec = p->next;
+		if (p->next != NULL)
+			p->next->prev = NULL; /* not necessary but clean */
+
+		if (p->gssid)
+			racoon_free(p->gssid);
+		if (p->remote)
+			racoon_free(p->remote);
+		racoon_free(p);
+	}
+	rmconf->spspec = NULL;
 }
 
 /* set final acceptable proposal */
 static int
-set_isakmp_proposal(rmconf, prspec)
+set_isakmp_proposal(rmconf)
 	struct remoteconf *rmconf;
-	struct proposalspec *prspec;
 {
-	struct proposalspec *p;
 	struct secprotospec *s;
 	int prop_no = 1; 
 	int trns_no = 1;
 	int32_t types[MAXALGCLASS];
 
-	p = prspec;
-	if (p->next != 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"multiple proposal definition.\n");
-		return -1;
-	}
-
 	/* mandatory check */
-	if (p->spspec == NULL) {
+	if (rmconf->spspec == NULL) {
 		yyerror("no remote specification found: %s.\n",
 			saddr2str(rmconf->remote));
 		return -1;
 	}
-	for (s = p->spspec; s != NULL; s = s->next) {
+	for (s = rmconf->spspec; s != NULL; s = s->next) {
 		/* XXX need more to check */
 		if (s->algclass[algclass_isakmp_enc] == 0) {
 			yyerror("encryption algorithm required.");
@@ -2282,16 +2542,16 @@
 	}
 
 	/* skip to last part */
-	for (s = p->spspec; s->next != NULL; s = s->next)
+	for (s = rmconf->spspec; s->next != NULL; s = s->next)
 		;
 
 	while (s != NULL) {
 		plog(LLV_DEBUG2, LOCATION, NULL,
 			"lifetime = %ld\n", (long)
-			(s->lifetime ? s->lifetime : p->lifetime));
+			(s->lifetime ? s->lifetime : rmconf->lifetime));
 		plog(LLV_DEBUG2, LOCATION, NULL,
 			"lifebyte = %d\n",
-			s->lifebyte ? s->lifebyte : p->lifebyte);
+			s->lifebyte ? s->lifebyte : rmconf->lifebyte);
 		plog(LLV_DEBUG2, LOCATION, NULL,
 			"encklen=%d\n", s->encklen);
 
@@ -2306,8 +2566,8 @@
 		clean_tmpalgtype();
 		trns_no = expand_isakmpspec(prop_no, trns_no, types,
 				algclass_isakmp_enc, algclass_isakmp_ameth + 1,
-				s->lifetime ? s->lifetime : p->lifetime,
-				s->lifebyte ? s->lifebyte : p->lifebyte,
+				s->lifetime ? s->lifetime : rmconf->lifetime,
+				s->lifebyte ? s->lifebyte : rmconf->lifebyte,
 				s->encklen, s->vendorid, s->gssid,
 				rmconf);
 		if (trns_no == -1) {
@@ -2412,11 +2672,7 @@
 			}
 			memcpy(new->gssid->v, gssid, new->gssid->l);
 			racoon_free(gssid);
-#ifdef ENABLE_HYBRID
-		} else if (rmconf->xauth == NULL) {
-#else
 		} else {
-#endif
 			/*
 			 * Allocate the default ID so that it gets put
 			 * into a GSS ID attribute during the Phase 1
@@ -2431,30 +2687,6 @@
 	return trns_no;
 }
 
-static int
-listen_addr (struct sockaddr *addr, int udp_encap)
-{
-	struct myaddrs *p;
-
-	p = newmyaddr();
-	if (p == NULL) {
-		yyerror("failed to allocate myaddrs");
-		return -1;
-	}
-	p->addr = addr;
-	if (p->addr == NULL) {
-		yyerror("failed to copy sockaddr ");
-		delmyaddr(p);
-		return -1;
-	}
-	p->udp_encap = udp_encap;
-
-	insmyaddr(p, &lcconf->myaddrs);
-
-	lcconf->autograbaddr = 0;
-	return 0;
-}
-
 #if 0
 /*
  * fix lifebyte.
@@ -2479,6 +2711,7 @@
 {
 	int error;
 
+	yyerrorcount = 0;
 	yycf_init_buffer();
 
 	if (yycf_switch_buffer(lcconf->racoon_conf) != 0) {
diff --git a/src/racoon/cftoken.l b/src/racoon/cftoken.l
index 9950d49..3042796 100644
--- a/src/racoon/cftoken.l
+++ b/src/racoon/cftoken.l
@@ -1,4 +1,4 @@
-/*	$NetBSD: cftoken.l,v 1.11.4.2 2007/09/03 18:07:29 mgrooms Exp $	*/
+/*	$NetBSD: cftoken.l,v 1.23 2011/02/02 15:21:34 vanhu Exp $	*/
 
 /* Id: cftoken.l,v 1.53 2006/08/22 18:17:17 manubsd Exp */
 
@@ -132,7 +132,7 @@
 decstring	{digit}+
 hexstring	0x{hexdigit}+
 
-%s S_INI S_PRIV S_PTH S_INF S_LOG S_PAD S_LST S_RTRY S_CFG S_LDAP
+%s S_INI S_PRIV S_PTH S_LOG S_PAD S_LST S_RTRY S_CFG S_LDAP S_RAD
 %s S_ALGST S_ALGCL
 %s S_SAINF S_SAINFS
 %s S_RMT S_RMTS S_RMTP
@@ -174,9 +174,8 @@
 	/* include */
 <S_INI>include		{ YYDB; return(INCLUDE); }
 
-	/* self information */
-<S_INI>identifier	{ BEGIN S_INF; YYDB; yywarn("it is obsoleted.  use \"my_identifier\" in each remote directives."); return(IDENTIFIER); }
-<S_INF>{semi}		{ BEGIN S_INI; return(EOS); }
+    /* pfkey_buffer */
+<S_INI>pfkey_buffer { YYDB; return(PFKEY_BUFFER); }
 
 	/* special */
 <S_INI>complex_bundle	{ YYDB; return(COMPLEX_BUNDLE); }
@@ -189,8 +188,6 @@
 <S_LOG>info		{ YYD; yylval.num = LLV_INFO; return(LOGLEV); }
 <S_LOG>debug		{ YYD; yylval.num = LLV_DEBUG; return(LOGLEV); }
 <S_LOG>debug2		{ YYD; yylval.num = LLV_DEBUG2; return(LOGLEV); }
-<S_LOG>debug3		{ YYD; yywarn("it is obsoleted.  use \"debug2\""); yylval.num = LLV_DEBUG2; return(LOGLEV); }
-<S_LOG>debug4		{ YYD; yywarn("it is obsoleted.  use \"debug2\""); yylval.num = LLV_DEBUG2; return(LOGLEV); }
 <S_LOG>{semi}		{ BEGIN S_INI; return(EOS); }
 
 	/* padding */
@@ -214,6 +211,15 @@
 <S_LST>strict_address	{ YYD; return(STRICT_ADDRESS); }
 <S_LST>{ecl}		{ BEGIN S_INI; return(EOC); }
 
+	/* radius config */
+<S_INI>radiuscfg	{ BEGIN S_RAD; YYDB; return(RADCFG); }
+<S_RAD>{bcl}		{ return(BOC); }
+<S_RAD>auth		{ YYD; return(RAD_AUTH); }
+<S_RAD>acct		{ YYD; return(RAD_ACCT); }
+<S_RAD>timeout		{ YYD; return(RAD_TIMEOUT); }
+<S_RAD>retries		{ YYD; return(RAD_RETRIES); }
+<S_RAD>{ecl}		{ BEGIN S_INI; return(EOC); }
+
 	/* ldap config */
 <S_INI>ldapcfg		{ BEGIN S_LDAP; YYDB; return(LDAPCFG); }
 <S_LDAP>{bcl}		{ return(BOC); }
@@ -277,6 +283,7 @@
 	/* sainfo */
 <S_INI>sainfo		{ BEGIN S_SAINF; YYDB; return(SAINFO); }
 <S_SAINF>anonymous	{ YYD; return(ANONYMOUS); }
+<S_SAINF>clientaddr	{ YYD; return(CLIENTADDR); }
 <S_SAINF>{blcl}any{elcl}	{ YYD; return(PORTANY); }
 <S_SAINF>any		{ YYD; return(ANY); }
 <S_SAINF>from		{ YYD; return(FROM); }
@@ -287,7 +294,6 @@
 <S_SAINFS>{ecl}		{ BEGIN S_INI; return(EOC); }
 <S_SAINFS>pfs_group	{ YYD; return(PFS_GROUP); }
 <S_SAINFS>remoteid	{ YYD; return(REMOTEID); }
-<S_SAINFS>identifier	{ YYD; yywarn("it is obsoleted.  use \"my_identifier\"."); return(IDENTIFIER); }
 <S_SAINFS>my_identifier	{ YYD; return(MY_IDENTIFIER); }
 <S_SAINFS>lifetime	{ YYD; return(LIFETIME); }
 <S_SAINFS>time		{ YYD; return(LIFETYPE_TIME); }
@@ -304,6 +310,7 @@
 	/* remote spec */
 <S_RMT>{bcl}		{ BEGIN S_RMTS; return(BOC); }
 <S_RMTS>{ecl}		{ BEGIN S_INI; return(EOC); }
+<S_RMTS>remote_address	{ YYD; return(REMOTE_ADDRESS); }
 <S_RMTS>exchange_mode	{ YYD; return(EXCHANGE_MODE); }
 <S_RMTS>{comma}		{ YYD; /* XXX ignored, but to be handled. */ ; }
 <S_RMTS>base		{ YYD; yylval.num = ISAKMP_ETYPE_BASE; return(EXCHANGETYPE); }
@@ -315,7 +322,6 @@
 <S_RMTS>identity_only	{ YYD; yylval.num = IPSECDOI_SIT_IDENTITY_ONLY; return(SITUATIONTYPE); }
 <S_RMTS>secrecy		{ YYD; yylval.num = IPSECDOI_SIT_SECRECY; return(SITUATIONTYPE); }
 <S_RMTS>integrity	{ YYD; yylval.num = IPSECDOI_SIT_INTEGRITY; return(SITUATIONTYPE); }
-<S_RMTS>identifier	{ YYD; yywarn("it is obsoleted.  use \"my_identifier\"."); return(IDENTIFIER); }
 <S_RMTS>my_identifier	{ YYD; return(MY_IDENTIFIER); }
 <S_RMTS>xauth_login	{ YYD; return(XAUTH_LOGIN); /* formerly identifier type login */ }
 <S_RMTS>peers_identifier	{ YYD; return(PEERS_IDENTIFIER); }
@@ -329,12 +335,12 @@
 <S_RMTS>verify_cert	{ YYD; return(VERIFY_CERT); }
 <S_RMTS>send_cert	{ YYD; return(SEND_CERT); }
 <S_RMTS>send_cr		{ YYD; return(SEND_CR); }
+<S_RMTS>match_empty_cr	{ YYD; return(MATCH_EMPTY_CR); }
 <S_RMTS>dh_group	{ YYD; return(DH_GROUP); }
 <S_RMTS>nonce_size	{ YYD; return(NONCE_SIZE); }
 <S_RMTS>generate_policy	{ YYD; return(GENERATE_POLICY); }
 <S_RMTS>unique		{ YYD; yylval.num = GENERATE_POLICY_UNIQUE; return(GENERATE_LEVEL); }
 <S_RMTS>require		{ YYD; yylval.num = GENERATE_POLICY_REQUIRE; return(GENERATE_LEVEL); }
-<S_RMTS>support_mip6	{ YYD; yywarn("it is obsoleted.  use \"support_proxy\"."); return(SUPPORT_PROXY); }
 <S_RMTS>support_proxy	{ YYD; return(SUPPORT_PROXY); }
 <S_RMTS>initial_contact	{ YYD; return(INITIAL_CONTACT); }
 <S_RMTS>nat_traversal	{ YYD; return(NAT_TRAVERSAL); }
@@ -359,8 +365,10 @@
 <S_RMTS>script		{ YYD; return(SCRIPT); }
 <S_RMTS>phase1_up	{ YYD; return(PHASE1_UP); }
 <S_RMTS>phase1_down	{ YYD; return(PHASE1_DOWN); }
+<S_RMTS>phase1_dead	{ YYD; return(PHASE1_DEAD); }
 <S_RMTS>mode_cfg	{ YYD; return(MODE_CFG); }
 <S_RMTS>weak_phase1_check { YYD; return(WEAK_PHASE1_CHECK); }
+<S_RMTS>rekey		{ YYD; return(REKEY); }
 	/* remote proposal */
 <S_RMTS>proposal	{ BEGIN S_RMTP; YYDB; return(PROPOSAL); }
 <S_RMTP>{bcl}		{ return(BOC); }
@@ -427,6 +435,7 @@
 icmp6		{ YYD; yylval.num = IPPROTO_ICMPV6; return(UL_PROTO); }
 tcp		{ YYD; yylval.num = IPPROTO_TCP; return(UL_PROTO); }
 udp		{ YYD; yylval.num = IPPROTO_UDP; return(UL_PROTO); }
+gre		{ YYD; yylval.num = IPPROTO_GRE; return(UL_PROTO); }
 
 	/* algorithm type */
 des_iv64	{ YYD; yylval.num = algtype_des_iv64;	return(ALGORITHMTYPE); }
@@ -543,14 +552,12 @@
 
 
 	/* identifier type */
-vendor_id	{ YYD; yywarn("it is obsoleted."); return(VENDORID); }
 user_fqdn	{ YYD; yylval.num = IDTYPE_USERFQDN; return(IDENTIFIERTYPE); }
 fqdn		{ YYD; yylval.num = IDTYPE_FQDN; return(IDENTIFIERTYPE); }
 keyid		{ YYD; yylval.num = IDTYPE_KEYID; return(IDENTIFIERTYPE); }
 address		{ YYD; yylval.num = IDTYPE_ADDRESS; return(IDENTIFIERTYPE); }
 subnet		{ YYD; yylval.num = IDTYPE_SUBNET; return(IDENTIFIERTYPE); }
 asn1dn		{ YYD; yylval.num = IDTYPE_ASN1DN; return(IDENTIFIERTYPE); }
-certname	{ YYD; yywarn("certname will be obsoleted in near future."); yylval.num = IDTYPE_ASN1DN; return(IDENTIFIERTYPE); }
 
 	/* identifier qualifier */
 tag		{ YYD; yylval.num = IDQUAL_TAG;  return(IDENTIFIERQUAL); }
@@ -573,7 +580,7 @@
 			char *bp;
 
 			YYD;
-			yylval.num = strtol(yytext, &bp, 10);
+			yylval.num = strtoul(yytext, &bp, 10);
 			return(NUMBER);
 		}
 
@@ -631,6 +638,10 @@
 
 <<EOF>>		{
 			yy_delete_buffer(YY_CURRENT_BUFFER);
+			fclose (incstack[incstackp].fp);
+			incstack[incstackp].fp = NULL;
+			racoon_free(incstack[incstackp].path);
+			incstack[incstackp].path = NULL;
 			incstackp--;
     nextfile:
 			if (incstack[incstackp].matchon <
diff --git a/src/racoon/crypto_openssl.c b/src/racoon/crypto_openssl.c
index b6e4c0d..f8a4db9 100644
--- a/src/racoon/crypto_openssl.c
+++ b/src/racoon/crypto_openssl.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: crypto_openssl.c,v 1.11.6.6 2009/04/29 10:50:25 tteras Exp $	*/
+/*	$NetBSD: crypto_openssl.c,v 1.20 2010/10/20 13:40:02 tteras Exp $	*/
 
 /* Id: crypto_openssl.c,v 1.47 2006/05/06 20:42:09 manubsd Exp */
 
@@ -113,6 +113,7 @@
 #include "crypto_openssl.h"
 #include "debug.h"
 #include "gcmalloc.h"
+#include "isakmp.h"
 
 /*
  * I hate to cast every parameter to des_xx into void *, but it is
@@ -136,9 +137,9 @@
 	int len;
 {
 	X509_NAME *name;
-	char *buf;
+	char *buf, *dst;
 	char *field, *value;
-	int i, j;
+	int i;
 	vchar_t *ret = NULL;
 	caddr_t p;
 
@@ -154,15 +155,38 @@
 
 	name = X509_NAME_new();
 
-	field = &buf[0];
+	dst = field = &buf[0];
 	value = NULL;
 	for (i = 0; i < len; i++) {
+		if (buf[i] == '\\') {
+			/* Escape characters specified in RFC 2253 */
+			if (i < len - 1 &&
+			    strchr("\\,=+<>#;", buf[i+1]) != NULL) {
+				*dst++ = buf[++i];
+				continue;
+			} else if (i < len - 2) {
+				/* RFC 2253 hexpair character escape */
+				long u;
+				char esc_str[3];
+				char *endptr;
+
+				esc_str[0] = buf[++i];
+				esc_str[1] = buf[++i];
+				esc_str[2] = '\0';
+				u = strtol(esc_str, &endptr, 16);
+				if (*endptr != '\0' || u < 0 || u > 255)
+					goto err;
+				*dst++ = u;
+				continue;
+			} else
+				goto err;
+		}
 		if (!value && buf[i] == '=') {
-			buf[i] = '\0';
-			value = &buf[i + 1];
+			*dst = '\0';
+			dst = value = &buf[i + 1];
 			continue;
 		} else if (buf[i] == ',' || buf[i] == '/') {
-			buf[i] = '\0';
+			*dst = '\0';
 
 			plog(LLV_DEBUG, LOCATION, NULL, "DN: %s=%s\n",
 			     field, value);
@@ -179,16 +203,16 @@
 				     "%s\n", eay_strerror());
 				goto err;
 			}
-			for (j = i + 1; j < len; j++) {
-				if (buf[j] != ' ')
-					break;
-			}
-			field = &buf[j];
+
+			while (i + 1 < len && buf[i + 1] == ' ') i++;
+			dst = field = &buf[i + 1];
 			value = NULL;
 			continue;
+		} else {
+			*dst++  = buf[i];
 		}
 	}
-	buf[len] = '\0';
+	*dst = '\0';
 
 	plog(LLV_DEBUG, LOCATION, NULL, "DN: %s=%s\n",
 	     field, value);
@@ -638,7 +662,7 @@
 }
 
 /*
- * get a subjectAltName from X509 certificate.
+ * get a subjectName from X509 certificate.
  */
 vchar_t *
 eay_get_x509asn1subjectname(cert)
@@ -649,8 +673,6 @@
 	vchar_t *name = NULL;
 	int len;
 
-	bp = (unsigned char *) cert->v;
-
 	x509 = mem2x509(cert);
 	if (x509 == NULL)
 		goto error;
@@ -784,6 +806,46 @@
 	return error;
 }
 
+/*
+ * get a issuerName from X509 certificate.
+ */
+vchar_t *
+eay_get_x509asn1issuername(cert)
+	vchar_t *cert;
+{
+	X509 *x509 = NULL;
+	u_char *bp;
+	vchar_t *name = NULL;
+	int len;
+
+	x509 = mem2x509(cert);
+	if (x509 == NULL)
+		goto error;
+
+	/* get the length of the name */
+	len = i2d_X509_NAME(x509->cert_info->issuer, NULL);
+	name = vmalloc(len);
+	if (name == NULL)
+		goto error;
+
+	/* get the name */
+	bp = (unsigned char *) name->v;
+	len = i2d_X509_NAME(x509->cert_info->issuer, &bp);
+
+	X509_free(x509);
+
+	return name;
+
+error:
+	plog(LLV_ERROR, LOCATION, NULL, "%s\n", eay_strerror());
+
+	if (name != NULL)
+		vfree(name);
+	if (x509 != NULL)
+		X509_free(x509);
+
+	return NULL;
+}
 
 /*
  * decode a X509 certificate and make a readable text terminated '\n'.
@@ -850,9 +912,9 @@
     {
 	u_char *bp;
 
-	bp = (unsigned char *) cert->v;
+	bp = (unsigned char *) cert->v + 1;
 
-	x509 = d2i_X509(NULL, (void *)&bp, cert->l);
+	x509 = d2i_X509(NULL, (void *)&bp, cert->l - 1);
     }
 #else
     {
@@ -862,7 +924,7 @@
 	bio = BIO_new(BIO_s_mem());
 	if (bio == NULL)
 		return NULL;
-	len = BIO_write(bio, cert->v, cert->l);
+	len = BIO_write(bio, cert->v + 1, cert->l - 1);
 	if (len == -1)
 		return NULL;
 	x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL);
@@ -912,12 +974,13 @@
 		return NULL;
 
 	len = i2d_X509(x509, NULL);
-	cert = vmalloc(len);
+	cert = vmalloc(len + 1);
 	if (cert == NULL) {
 		X509_free(x509);
 		return NULL;
 	}
-	bp = (unsigned char *) cert->v;
+	cert->v[0] = ISAKMP_CERT_X509SIGN;
+	bp = (unsigned char *) &cert->v[1];
 	error = i2d_X509(x509, &bp);
 	X509_free(x509);
 
@@ -943,17 +1006,12 @@
 	vchar_t *cert;
 {
 	X509 *x509;
-	u_char *bp;
 	EVP_PKEY *evp;
 	int res;
 
-	bp = (unsigned char *) cert->v;
-
-	x509 = d2i_X509(NULL, (void *)&bp, cert->l);
-	if (x509 == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "d2i_X509(): %s\n", eay_strerror());
+	x509 = mem2x509(cert);
+	if (x509 == NULL)
 		return -1;
-	}
 
 	evp = X509_get_pubkey(x509);
 	if (! evp) {
@@ -1807,6 +1865,42 @@
 	return (caddr_t)c;
 }
 
+static vchar_t *eay_hmac_one(key, data, type)
+	vchar_t *key, *data;
+	const EVP_MD *type;
+{
+	vchar_t *res;
+
+	if ((res = vmalloc(EVP_MD_size(type))) == 0)
+		return NULL;
+
+	if (!HMAC(type, (void *) key->v, key->l,
+		  (void *) data->v, data->l, (void *) res->v, NULL)) {
+		vfree(res);
+		return NULL;
+	}
+
+	return res;
+}
+
+static vchar_t *eay_digest_one(data, type)
+	vchar_t *data;
+	const EVP_MD *type;
+{
+	vchar_t *res;
+
+	if ((res = vmalloc(EVP_MD_size(type))) == 0)
+		return NULL;
+
+	if (!EVP_Digest((void *) data->v, data->l,
+			(void *) res->v, NULL, type, NULL)) {
+		vfree(res);
+		return NULL;
+	}
+
+	return res;
+}
+
 #ifdef WITH_SHA2
 /*
  * HMAC SHA2-512
@@ -1815,14 +1909,7 @@
 eay_hmacsha2_512_one(key, data)
 	vchar_t *key, *data;
 {
-	vchar_t *res;
-	caddr_t ctx;
-
-	ctx = eay_hmacsha2_512_init(key);
-	eay_hmacsha2_512_update(ctx, data);
-	res = eay_hmacsha2_512_final(ctx);
-
-	return(res);
+	return eay_hmac_one(key, data, EVP_sha2_512());
 }
 
 caddr_t
@@ -1872,14 +1959,7 @@
 eay_hmacsha2_384_one(key, data)
 	vchar_t *key, *data;
 {
-	vchar_t *res;
-	caddr_t ctx;
-
-	ctx = eay_hmacsha2_384_init(key);
-	eay_hmacsha2_384_update(ctx, data);
-	res = eay_hmacsha2_384_final(ctx);
-
-	return(res);
+	return eay_hmac_one(key, data, EVP_sha2_384());
 }
 
 caddr_t
@@ -1929,14 +2009,7 @@
 eay_hmacsha2_256_one(key, data)
 	vchar_t *key, *data;
 {
-	vchar_t *res;
-	caddr_t ctx;
-
-	ctx = eay_hmacsha2_256_init(key);
-	eay_hmacsha2_256_update(ctx, data);
-	res = eay_hmacsha2_256_final(ctx);
-
-	return(res);
+	return eay_hmac_one(key, data, EVP_sha2_256());
 }
 
 caddr_t
@@ -1987,14 +2060,7 @@
 eay_hmacsha1_one(key, data)
 	vchar_t *key, *data;
 {
-	vchar_t *res;
-	caddr_t ctx;
-
-	ctx = eay_hmacsha1_init(key);
-	eay_hmacsha1_update(ctx, data);
-	res = eay_hmacsha1_final(ctx);
-
-	return(res);
+	return eay_hmac_one(key, data, EVP_sha1());
 }
 
 caddr_t
@@ -2044,14 +2110,7 @@
 eay_hmacmd5_one(key, data)
 	vchar_t *key, *data;
 {
-	vchar_t *res;
-	caddr_t ctx;
-
-	ctx = eay_hmacmd5_init(key);
-	eay_hmacmd5_update(ctx, data);
-	res = eay_hmacmd5_final(ctx);
-
-	return(res);
+	return eay_hmac_one(key, data, EVP_md5());
 }
 
 caddr_t
@@ -2137,14 +2196,7 @@
 eay_sha2_512_one(data)
 	vchar_t *data;
 {
-	caddr_t ctx;
-	vchar_t *res;
-
-	ctx = eay_sha2_512_init();
-	eay_sha2_512_update(ctx, data);
-	res = eay_sha2_512_final(ctx);
-
-	return(res);
+	return eay_digest_one(data, EVP_sha512());
 }
 
 int
@@ -2197,14 +2249,7 @@
 eay_sha2_384_one(data)
 	vchar_t *data;
 {
-	caddr_t ctx;
-	vchar_t *res;
-
-	ctx = eay_sha2_384_init();
-	eay_sha2_384_update(ctx, data);
-	res = eay_sha2_384_final(ctx);
-
-	return(res);
+	return eay_digest_one(data, EVP_sha2_384());
 }
 
 int
@@ -2257,14 +2302,7 @@
 eay_sha2_256_one(data)
 	vchar_t *data;
 {
-	caddr_t ctx;
-	vchar_t *res;
-
-	ctx = eay_sha2_256_init();
-	eay_sha2_256_update(ctx, data);
-	res = eay_sha2_256_final(ctx);
-
-	return(res);
+	return eay_digest_one(data, EVP_sha2_256());
 }
 
 int
@@ -2316,14 +2354,7 @@
 eay_sha1_one(data)
 	vchar_t *data;
 {
-	caddr_t ctx;
-	vchar_t *res;
-
-	ctx = eay_sha1_init();
-	eay_sha1_update(ctx, data);
-	res = eay_sha1_final(ctx);
-
-	return(res);
+	return eay_digest_one(data, EVP_sha1());
 }
 
 int
@@ -2374,14 +2405,7 @@
 eay_md5_one(data)
 	vchar_t *data;
 {
-	caddr_t ctx;
-	vchar_t *res;
-
-	ctx = eay_md5_init();
-	eay_md5_update(ctx, data);
-	res = eay_md5_final(ctx);
-
-	return(res);
+	return eay_digest_one(data, EVP_md5());
 }
 
 int
diff --git a/src/racoon/crypto_openssl.h b/src/racoon/crypto_openssl.h
index 9a17de8..66fac73 100644
--- a/src/racoon/crypto_openssl.h
+++ b/src/racoon/crypto_openssl.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: crypto_openssl.h,v 1.5 2006/10/06 12:02:27 manu Exp $	*/
+/*	$NetBSD: crypto_openssl.h,v 1.7 2009/08/17 11:59:10 vanhu Exp $	*/
 
 /* Id: crypto_openssl.h,v 1.11 2004/11/13 11:28:01 manubsd Exp */
 
@@ -34,8 +34,6 @@
 #ifndef _CRYPTO_OPENSSL_H
 #define _CRYPTO_OPENSSL_H
 
-#include "crypto_openssl.h"
-
 #include <openssl/x509v3.h>
 #include <openssl/rsa.h>
 
@@ -55,6 +53,7 @@
 extern int eay_check_x509cert __P((vchar_t *, char *, char *, int));
 extern vchar_t *eay_get_x509asn1subjectname __P((vchar_t *));
 extern int eay_get_x509subjectaltname __P((vchar_t *, char **, int *, int));
+extern vchar_t * eay_get_x509asn1issuername __P((vchar_t *));
 extern char *eay_get_x509text __P((vchar_t *));
 extern vchar_t *eay_get_x509cert __P((char *));
 extern vchar_t *eay_get_x509sign __P((vchar_t *, vchar_t *));
diff --git a/src/racoon/debug.h b/src/racoon/debug.h
index 47c2641..4270b6a 100644
--- a/src/racoon/debug.h
+++ b/src/racoon/debug.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: debug.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
+/*	$NetBSD: debug.h,v 1.5 2008/12/23 14:03:12 tteras Exp $	*/
 
 /* Id: debug.h,v 1.3 2004/06/11 16:00:16 ludvigm Exp */
 
@@ -37,5 +37,6 @@
 /* define by main.c */
 extern int f_local;
 extern int vflag;
+extern int dump_config;
 
 #endif /* _DEBUG_H */
diff --git a/src/racoon/dnssec.c b/src/racoon/dnssec.c
index 1fc0bd1..d52a243 100644
--- a/src/racoon/dnssec.c
+++ b/src/racoon/dnssec.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: dnssec.c,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
+/*	$NetBSD: dnssec.c,v 1.5 2009/03/12 10:57:26 tteras Exp $	*/
 
 /*	$KAME: dnssec.c,v 1.2 2001/08/05 18:46:07 itojun Exp $	*/
 
@@ -55,11 +55,11 @@
 
 extern int h_errno;
 
-cert_t *
+vchar_t *
 dnssec_getcert(id)
 	vchar_t *id;
 {
-	cert_t *cert = NULL;
+	vchar_t *cert = NULL;
 	struct certinfo *res = NULL;
 	struct ipsecdoi_id_b *id_b;
 	int type;
@@ -116,39 +116,22 @@
 	}
 
 	/* create cert holder */
-	cert = oakley_newcert();
+	cert = vmalloc(res->ci_certlen + 1);
 	if (cert == NULL) {
 		plog(LLV_ERROR, LOCATION, NULL,
 			"failed to get cert buffer.\n");
 		goto err;
 	}
-	cert->pl = vmalloc(res->ci_certlen + 1);
-	if (cert->pl == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get cert buffer.\n");
-		goto err;
-	}
-	memcpy(cert->pl->v + 1, res->ci_cert, res->ci_certlen);
-	cert->pl->v[0] = type;
-	cert->cert.v = cert->pl->v + 1;
-	cert->cert.l = cert->pl->l - 1;
+	cert->v[0] = type;
+	memcpy(&cert->v[1], res->ci_cert, res->ci_certlen);
 
 	plog(LLV_DEBUG, LOCATION, NULL, "created CERT payload:\n");
-	plogdump(LLV_DEBUG, cert->pl->v, cert->pl->l);
-
-end:
-	if (res)
-		freecertinfo(res);
-
-	return cert;
+	plogdump(LLV_DEBUG, cert->v, cert->l);
 
 err:
 	if (name)
 		racoon_free(name);
-	if (cert) {
-		oakley_delcert(cert);
-		cert = NULL;
-	}
-
-	goto end;
+	if (res)
+		freecertinfo(res);
+	return cert;
 }
diff --git a/src/racoon/dnssec.h b/src/racoon/dnssec.h
index fb1c931..1a03d77 100644
--- a/src/racoon/dnssec.h
+++ b/src/racoon/dnssec.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: dnssec.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
+/*	$NetBSD: dnssec.h,v 1.5 2009/03/12 10:57:26 tteras Exp $	*/
 
 /* Id: dnssec.h,v 1.3 2004/06/11 16:00:16 ludvigm Exp */
 
@@ -34,6 +34,6 @@
 #ifndef _DNSSEC_H
 #define _DNSSEC_H
 
-extern cert_t *dnssec_getcert __P((vchar_t *));
+extern vchar_t *dnssec_getcert __P((vchar_t *));
 
 #endif /* _DNSSEC_H */
diff --git a/src/racoon/doc/FAQ b/src/racoon/doc/FAQ
index 0ab49f0..cf9c394 100644
--- a/src/racoon/doc/FAQ
+++ b/src/racoon/doc/FAQ
@@ -18,7 +18,7 @@
 
 A:
 	Configure both ends exactly the same.  With just a tiny little
-	differnce, you will be in trouble.
+	difference, you will be in trouble.
 
 Q: How to build racoon on my platform?
 
@@ -109,6 +109,6 @@
 Q: Other documents to look at?
 
 A:
-	http://www.netbsd.org/Documentation/network/ipsec/
+	http://www.NetBSD.org/docs/network/ipsec/
 	http://www.kame.net/
 	http://www.kame.net/newsletter/
diff --git a/src/racoon/doc/README.privsep b/src/racoon/doc/README.privsep
new file mode 100644
index 0000000..e01c820
--- /dev/null
+++ b/src/racoon/doc/README.privsep
@@ -0,0 +1,152 @@
+		Using Racoon with Privilege Separation
+		     Tue Mar 25 16:37:09 MDT 2008
+
+
+Racoon can run in a chroot'd environment.  When so instructed, it runs as two
+processes, one of which handles a small number of simple requests and runs as
+root in the full native filesystem, and another which runs as a less
+privileged user in a chroot'd environment and which handles all the other and
+very complex business of racoon.
+
+Because racoon does many complex things there are many opportunities for
+coding errors to lead to compromises and so this separation is important.  If
+someone breaks into your system using racoon and you have enabled privilege
+separation, they will find themselves in a very limited environment and unable
+to do much damage.  They may be able to alter the host's security associations
+or obtain the private keys stored on that system using file descriptors
+available to the unprivileged instance of racoon, and from there they will be
+able to alter security associations on other hosts in disruptive or dangerous
+ways if you have generate_policy enabled on those hosts.  But that's because
+in its current form generate_policy is itself dangerous and requires that you
+trust anyone with the credentials to use it.
+
+They will also be able to execute any scripts you have placed in the scripts
+directory, although racoon will prevent them from mis-using the traditional
+environment variables PATH, LD_LIBRARY_PATH, and IFS.  But if you have
+introduced vulnerabilities into your scripts you may want to re-visit them.
+The thing to watch for is blindly trusting the environment variables passed
+in by racoon - assume they could be set to anything by a malicious entity and
+check them for suitability before using them.
+
+All these possibilities are present when privilege separation is not enabled,
+and they are greatly reduced when it is enabled because the resources
+available to the attacker are less.
+
+*****
+
+The basic concept with racoon's privilege separation is that a minimal
+environment containing all the files racoon needs to operate - with the
+exception of private keys, scripts, and system-wide authentication services -
+is placed in a stripped-down copy of the original environment.  The private
+keys and scripts are left in the original environment where only the
+privileged instance of racoon will have access to them.
+
+Here are basic instructions for setting up racoon to run with privilege
+separation:
+
+
+First, create a user/group for racoon to run under.  For example, user:group
+ike:ike.  The account should not have a usable password or real home
+directory, so copy the general format of another system-services type account
+such as 'daemon'.
+
+You already have files in, e.g. /usr/local/etc/racoon - perhaps racoon.conf, a
+certs directory containing certificates, a scripts directory, and other
+miscellaneous files such as welcome messages.  Perform the following steps:
+
+cd /usr/local/etc/racoon
+mkdir root
+mv certs root
+mkdir certs
+mv root/certs/*.key certs
+
+If you want to be able to switch back and forth between using and not using
+privsep, do this too:
+
+cd /usr/local/etc/racoon/certs
+for i in ../root/certs/*
+do
+	ln -s $i .
+done
+
+Now root/certs contains certificates and certs contains the keys.  The idea is
+that the public certificates are in the chroot'd area
+(/usr/local/etc/racoon/root) and the keys are available only to the privileged
+instance of racoon.
+
+Move any other racoon configuration data into /usr/local/etc/racoon/root,
+with the exception of the scripts directory and racoon.conf.
+
+All the files in /usr/local/etc/racoon/root should be owned by root and the
+ike:ike user you created should not have write access to any directories or
+files (unless you are using something like 'path backupsa', but you get the
+idea).
+
+Create the device nodes:
+
+mkdir root/dev
+
+Do whatever your OS requires to populate the new dev directory with a
+minimal set of devices, e.g. mknod, MAKEDEV, or mount devfs...  In freebsd
+this is done by adding a line to /etc/fstab:
+
+devfs	/usr/local/etc/racoon/root/dev	devfs	rw		0	0
+
+and then adding a line like this to /etc/rc.conf:
+
+devfs_set_rulesets="/usr/local/etc/racoon/root/dev=devfsrules_basic"
+
+and then adding the following lines to /etc/devfs.rules:
+
+[devfsrules_basic=10]
+add include $devfsrules_hide_all
+add include $devfsrules_unhide_basic
+
+and then either rebooting or entering "mount -a && /etc/rc.d/devfs start".
+
+When done with that:
+
+mkdir -p root/usr/local/etc
+ln -s ../../../ root/usr/local/etc/racoon
+
+This dummy hierarchy keeps the config file consistent between both copies of
+racoon. Of course, you could actually put the certs directory and any other
+configuration data down in the hierarchy but I prefer to leave it at the root
+and link to it as shown.  You may end up with something like this:
+
+root# ls -FC /usr/local/etc/racoon/root
+certs/	dev/	usr/
+
+root# ls -l /usr/local/etc/racoon/root/usr/local/etc
+lrwxr-xr-x  1 root  wheel  9 Mar  7 22:13 racoon -> ../../../
+
+root# ls -FC /usr/local/etc/racoon/root/usr/local/etc/racoon/
+certs/	dev/	usr/
+
+Presumably your racoon.conf already contains something like:
+
+path certificate "/usr/local/etc/racoon/certs";
+path script "/usr/local/etc/racoon/scripts";
+
+If so, great. If not, add them. Then, finally, add the privsep section:
+
+privsep {
+	user "ike";
+	group "ike";
+	chroot "/usr/local/etc/racoon/root";
+}
+
+Apply the patches posted to the list and rebuild racoon (the patches will be
+incorporated into the release subsequent to the date of this memo, so if you
+use that or a later release you can skip this step).
+
+Restart racoon and hopefully things will work.  As of the date of this memo,
+re-loading the configuration file with racoonctl will not work with privsep
+enabled.  However, the problem is not insurmountable and if you figure it out
+let us know.
+
+I have not tested privsep with many of racoon's features such as XAUTH or
+scripts, so if you have trouble with them and work anything out please reply
+to the list so that your discoveries may be incorporated into this document.
+
+Last modified: $Date: 2008/03/28 04:18:52 $
diff --git a/src/racoon/eaytest.c b/src/racoon/eaytest.c
index 323ecef..1474bdc 100644
--- a/src/racoon/eaytest.c
+++ b/src/racoon/eaytest.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: eaytest.c,v 1.7.6.2 2008/07/15 00:55:48 mgrooms Exp $	*/
+/*	$NetBSD: eaytest.c,v 1.10 2010/01/17 23:02:48 wiz Exp $	*/
 
 /* Id: eaytest.c,v 1.22 2005/06/19 18:02:54 manubsd Exp */
 
@@ -572,6 +572,7 @@
 
 		n++;
 	}
+	closedir(dirp);
 
 	p = (char **)realloc(certs, (n + 1) * sizeof(certs));
 	if (p == NULL)
diff --git a/src/racoon/evt.c b/src/racoon/evt.c
index fc65b20..11d9695 100644
--- a/src/racoon/evt.c
+++ b/src/racoon/evt.c
@@ -1,9 +1,10 @@
-/*	$NetBSD: evt.c,v 1.5 2006/09/09 16:22:09 manu Exp $	*/
+/*	$NetBSD: evt.c,v 1.10 2010/10/21 06:15:28 tteras Exp $	*/
 
 /* Id: evt.c,v 1.5 2006/06/22 20:11:35 manubsd Exp */
 
 /*
  * Copyright (C) 2004 Emmanuel Dreyfus
+ * Copyright (C) 2008 Timo Teras
  * All rights reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
@@ -46,14 +47,55 @@
 #include "plog.h"
 #include "misc.h"
 #include "admin.h"
+#include "handler.h"
+#include "session.h"
 #include "gcmalloc.h"
 #include "evt.h"
+#include "var.h"
 
 #ifdef ENABLE_ADMINPORT
-struct evtlist evtlist = TAILQ_HEAD_INITIALIZER(evtlist);
-int evtlist_len = 0;
 
-void
+static EVT_LISTENER_LIST(evt_listeners);
+
+struct evt_message {
+	struct admin_com adm;
+	struct evt_async evt;
+};
+
+struct evt {
+	struct evtdump *dump;
+	TAILQ_ENTRY(evt) next;
+};
+
+TAILQ_HEAD(evtlist, evt);
+
+#define EVTLIST_MAX	32
+
+static struct evtlist evtlist = TAILQ_HEAD_INITIALIZER(evtlist);
+static int evtlist_len = 0;
+static int evtlist_inuse = 0;
+
+static struct {
+	int newtype, oldtype;
+} evttype_map[] = {
+	{ EVT_RACOON_QUIT,		EVTT_RACOON_QUIT },
+	{ EVT_PHASE1_UP,		EVTT_PHASE1_UP },
+	{ EVT_PHASE1_DOWN,		EVTT_PHASE1_DOWN },
+	{ EVT_PHASE1_NO_RESPONSE,	EVTT_PEER_NO_RESPONSE },
+	{ EVT_PHASE1_NO_PROPOSAL,	EVTT_PEERPH1_NOPROP },
+	{ EVT_PHASE1_AUTH_FAILED,	EVTT_PEERPH1AUTH_FAILED },
+	{ EVT_PHASE1_DPD_TIMEOUT,	EVTT_DPD_TIMEOUT },
+	{ EVT_PHASE1_PEER_DELETED,	EVTT_PEER_DELETE },
+	{ EVT_PHASE1_MODE_CFG,		EVTT_ISAKMP_CFG_DONE },
+	{ EVT_PHASE1_XAUTH_SUCCESS,	EVTT_XAUTH_SUCCESS },
+	{ EVT_PHASE1_XAUTH_FAILED,	EVTT_XAUTH_FAILED },
+	{ EVT_PHASE2_NO_PHASE1,		-1 },
+	{ EVT_PHASE2_UP,		EVTT_PHASE2_UP },
+	{ EVT_PHASE2_DOWN,		EVTT_PHASE2_DOWN },
+	{ EVT_PHASE2_NO_RESPONSE,	EVTT_PEER_NO_RESPONSE },
+};
+
+static void
 evt_push(src, dst, type, optdata)
 	struct sockaddr *src;
 	struct sockaddr *dst;
@@ -63,9 +105,21 @@
 	struct evtdump *evtdump;
 	struct evt *evt;
 	size_t len;
+	int i;
 
 	/* If admin socket is disabled, silently discard anything */
-	if (adminsock_path == NULL)
+	if (adminsock_path == NULL || !evtlist_inuse)
+		return;
+
+	/* Map the event type to old */
+	for (i = 0; i < sizeof(evttype_map) / sizeof(evttype_map[0]); i++)
+		if (evttype_map[i].newtype == type)
+			break;
+	if (i >= sizeof(evttype_map) / sizeof(evttype_map[0]))
+		return;
+
+	type = evttype_map[i].oldtype;
+	if (type < 0)
 		return;
 
 	/* If we are above the limit, don't record anything */
@@ -121,7 +175,7 @@
 	return;
 }
 
-struct evtdump *
+static struct evtdump *
 evt_pop(void) {
 	struct evtdump *evtdump;
 	struct evt *evt;
@@ -142,6 +196,12 @@
 	struct evtdump *evtdump;
 	vchar_t *buf = NULL;
 
+	if (!evtlist_inuse) {
+		evtlist_inuse = 1;
+		plog(LLV_ERROR, LOCATION, NULL,
+		     "evt_dump: deprecated event polling used\n");
+	}
+
 	if ((evtdump = evt_pop()) != NULL) {
 		if ((buf = vmalloc(evtdump->len)) == NULL) {
 			plog(LLV_ERROR, LOCATION, NULL, 
@@ -155,4 +215,185 @@
 	return buf;
 }
 
+static struct evt_message *
+evtmsg_create(type, optdata)
+	int type;
+	vchar_t *optdata;
+{
+	struct evt_message *e;
+	size_t len;
+
+	len = sizeof(struct evt_message);
+	if (optdata != NULL)
+		len += optdata->l;
+
+	if ((e = racoon_malloc(len)) == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL, "Cannot allocate event: %s\n",
+		     strerror(errno));
+		return NULL;
+	}
+
+	memset(e, 0, sizeof(struct evt_message));
+	e->adm.ac_len = len;
+	e->adm.ac_cmd = ADMIN_SHOW_EVT;
+	e->adm.ac_errno = 0;
+	e->adm.ac_proto = 0;
+	e->evt.ec_type = type;
+	time(&e->evt.ec_timestamp);
+	if (optdata != NULL)
+		memcpy(e + 1, optdata->v, optdata->l);
+
+	return e;
+}
+
+static void
+evt_unsubscribe(l)
+	struct evt_listener *l;
+{
+	plog(LLV_DEBUG, LOCATION, NULL,
+	     "[%d] admin connection released\n", l->fd);
+
+	LIST_REMOVE(l, ll_chain);
+	unmonitor_fd(l->fd);
+	close(l->fd);
+	racoon_free(l);
+}
+
+static int
+evt_unsubscribe_cb(ctx, fd)
+	void *ctx;
+	int fd;
+{
+	evt_unsubscribe((struct evt_listener *) ctx);
+	return 0;
+}
+
+static void
+evtmsg_broadcast(ll, e)
+	const struct evt_listener_list *ll;
+	struct evt_message *e;
+{
+	struct evt_listener *l, *nl;
+
+	for (l = LIST_FIRST(ll); l != NULL; l = nl) {
+		nl = LIST_NEXT(l, ll_chain);
+
+		if (send(l->fd, e, e->adm.ac_len, MSG_DONTWAIT) < 0) {
+			plog(LLV_DEBUG, LOCATION, NULL, "Cannot send event to fd: %s\n",
+				strerror(errno));
+			evt_unsubscribe(l);
+		}
+	}
+}
+
+void
+evt_generic(type, optdata)
+	int type;
+	vchar_t *optdata;
+{
+	struct evt_message *e;
+
+	if ((e = evtmsg_create(type, optdata)) == NULL)
+		return;
+
+	evtmsg_broadcast(&evt_listeners, e);
+	evt_push(&e->evt.ec_ph1src, &e->evt.ec_ph1dst, type, optdata);
+
+	racoon_free(e);
+}
+
+void
+evt_phase1(ph1, type, optdata)
+	const struct ph1handle *ph1;
+	int type;
+	vchar_t *optdata;
+{
+	struct evt_message *e;
+
+	if ((e = evtmsg_create(type, optdata)) == NULL)
+		return;
+
+	if (ph1->local)
+		memcpy(&e->evt.ec_ph1src, ph1->local, sysdep_sa_len(ph1->local));
+	if (ph1->remote)
+		memcpy(&e->evt.ec_ph1dst, ph1->remote, sysdep_sa_len(ph1->remote));
+
+	evtmsg_broadcast(&ph1->evt_listeners, e);
+	evtmsg_broadcast(&evt_listeners, e);
+	evt_push(&e->evt.ec_ph1src, &e->evt.ec_ph1dst, type, optdata);
+
+	racoon_free(e);
+}
+
+void
+evt_phase2(ph2, type, optdata)
+	const struct ph2handle *ph2;
+	int type;
+	vchar_t *optdata;
+{
+	struct evt_message *e;
+	struct ph1handle *ph1 = ph2->ph1;
+
+	if ((e = evtmsg_create(type, optdata)) == NULL)
+		return;
+
+	if (ph1) {
+		if (ph1->local)
+			memcpy(&e->evt.ec_ph1src, ph1->local, sysdep_sa_len(ph1->local));
+		if (ph1->remote)
+			memcpy(&e->evt.ec_ph1dst, ph1->remote, sysdep_sa_len(ph1->remote));
+	}
+	e->evt.ec_ph2msgid = ph2->msgid;
+
+	evtmsg_broadcast(&ph2->evt_listeners, e);
+	if (ph1)
+		evtmsg_broadcast(&ph1->evt_listeners, e);
+	evtmsg_broadcast(&evt_listeners, e);
+	evt_push(&e->evt.ec_ph1src, &e->evt.ec_ph1dst, type, optdata);
+
+	racoon_free(e);
+}
+
+int
+evt_subscribe(list, fd)
+	struct evt_listener_list *list;
+	int fd;
+{
+	struct evt_listener *l;
+
+	if ((l = racoon_malloc(sizeof(*l))) == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL,
+		     "Cannot allocate event listener: %s\n",
+		     strerror(errno));
+		return errno;
+	}
+
+	if (list == NULL)
+		list = &evt_listeners;
+
+	LIST_INSERT_HEAD(list, l, ll_chain);
+	l->fd = fd;
+	monitor_fd(l->fd, evt_unsubscribe_cb, l, 0);
+
+	plog(LLV_DEBUG, LOCATION, NULL,
+	     "[%d] admin connection is polling events\n", fd);
+
+	return -2;
+}
+
+void
+evt_list_init(list)
+	struct evt_listener_list *list;
+{
+	LIST_INIT(list);
+}
+
+void
+evt_list_cleanup(list)
+	struct evt_listener_list *list;
+{
+	while (!LIST_EMPTY(list))
+		evt_unsubscribe(LIST_FIRST(list));
+}
+
 #endif /* ENABLE_ADMINPORT */
diff --git a/src/racoon/evt.h b/src/racoon/evt.h
index 88ee366..42e14d7 100644
--- a/src/racoon/evt.h
+++ b/src/racoon/evt.h
@@ -1,9 +1,10 @@
-/*	$NetBSD: evt.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
+/*	$NetBSD: evt.h,v 1.7 2008/12/23 14:03:12 tteras Exp $	*/
 
 /* Id: evt.h,v 1.5 2006/01/19 10:24:09 fredsen Exp */
 
 /*
  * Copyright (C) 2004 Emmanuel Dreyfus
+ * Copyright (C) 2008 Timo Teras
  * All rights reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
@@ -34,6 +35,10 @@
 #ifndef _EVT_H
 #define _EVT_H
 
+/*
+ * Old style (deprecated) events which are polled.
+ */
+
 struct evtdump {
 	size_t len;	
 	struct sockaddr_storage src;
@@ -64,25 +69,78 @@
 #define EVTT_PEERPH1_NOPROP	14	/* NO_PROPOSAL_CHOSEN & friends */
 #define EVTT_NO_ISAKMP_CFG	15	/* no need to wait for mode_cfg */
 
-struct evt {
-	struct evtdump *dump;
-	TAILQ_ENTRY(evt) next;
+/*
+ * New style, asynchronous events.
+ */
+
+struct evt_async {
+	uint32_t ec_type;
+	time_t ec_timestamp;
+
+	struct sockaddr_storage ec_ph1src;
+	struct sockaddr_storage ec_ph1dst;
+	u_int32_t ec_ph2msgid;
+
+	/*
+	 * Optionnal list of struct isakmp_data
+	 * for type EVTT_ISAKMP_CFG_DONE
+	 */
 };
 
-TAILQ_HEAD(evtlist, evt);
+/* type */
+#define EVT_RACOON_QUIT			0x0001
 
-#define EVTLIST_MAX	32
+#define EVT_PHASE1_UP			0x0100
+#define EVT_PHASE1_DOWN			0x0101
+#define EVT_PHASE1_NO_RESPONSE		0x0102
+#define EVT_PHASE1_NO_PROPOSAL		0x0103
+#define EVT_PHASE1_AUTH_FAILED		0x0104
+#define EVT_PHASE1_DPD_TIMEOUT		0x0105
+#define EVT_PHASE1_PEER_DELETED		0x0106
+#define EVT_PHASE1_MODE_CFG		0x0107
+#define EVT_PHASE1_XAUTH_SUCCESS	0x0108
+#define EVT_PHASE1_XAUTH_FAILED		0x0109
+
+#define EVT_PHASE2_NO_PHASE1		0x0200
+#define EVT_PHASE2_UP			0x0201
+#define EVT_PHASE2_DOWN			0x0202
+#define EVT_PHASE2_NO_RESPONSE		0x0203
 
 #ifdef ENABLE_ADMINPORT
-struct evtdump *evt_pop(void);
-vchar_t *evt_dump(void);
-void evt_push(struct sockaddr *, struct sockaddr *, int, vchar_t *);
-#endif
 
-#ifdef ENABLE_ADMINPORT
-#define EVT_PUSH(src, dst, type, optdata) evt_push(src, dst, type, optdata);
+struct ph1handle;
+struct ph2handle;
+
+struct evt_listener {
+	LIST_ENTRY(evt_listener) ll_chain;
+	int fd;
+};
+LIST_HEAD(evt_listener_list, evt_listener);
+#define EVT_LISTENER_LIST(x) struct evt_listener_list x
+
+void evt_generic __P((int type, vchar_t *optdata));
+void evt_phase1 __P((const struct ph1handle *ph1, int type, vchar_t *optdata));
+void evt_phase2 __P((const struct ph2handle *ph2, int type, vchar_t *optdata));
+vchar_t *evt_dump __P((void));
+
+int  evt_subscribe __P((struct evt_listener_list *list, int fd));
+void evt_list_init __P((struct evt_listener_list *list));
+void evt_list_cleanup __P((struct evt_listener_list *list));
+
 #else
-#define EVT_PUSH(src, dst, type, optdata) ;
-#endif
+
+#define EVT_LISTENER_LIST(x)
+
+#define evt_generic(type, optdata) ;
+#define evt_phase1(ph1, type, optdata) ;
+#define evt_phase2(ph2, type, optdata) ;
+
+#define evt_subscribe(eventlist, fd) ;
+#define evt_list_init(eventlist) ;
+#define evt_list_cleanup(eventlist) ;
+#define evt_get_fdmask(nfds, fdset) nfds
+#define evt_handle_fdmask(fdset) ;
+
+#endif /* ENABLE_ADMINPORT */
 
 #endif /* _EVT_H */
diff --git a/src/racoon/grabmyaddr.c b/src/racoon/grabmyaddr.c
index 8155001..29b913c 100644
--- a/src/racoon/grabmyaddr.c
+++ b/src/racoon/grabmyaddr.c
@@ -1,9 +1,7 @@
-/*	$NetBSD: grabmyaddr.c,v 1.4.6.3 2008/06/18 07:30:18 mgrooms Exp $	*/
-
-/* Id: grabmyaddr.c,v 1.27 2006/04/06 16:27:05 manubsd Exp */
-
+/*	$NetBSD: grabmyaddr.c,v 1.28 2011/03/14 17:18:12 tteras Exp $	*/
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
+ * Copyright (C) 2008 Timo Teras <timo.teras@iki.fi>.
  * All rights reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
@@ -33,40 +31,32 @@
 
 #include "config.h"
 
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/socket.h>
-#include <sys/ioctl.h>
-
-#include <net/if.h>
-#if defined(__FreeBSD__) && __FreeBSD__ >= 3
-#include <net/if_var.h>
-#endif
-#if defined(__NetBSD__) || defined(__FreeBSD__) ||	\
-  (defined(__APPLE__) && defined(__MACH__))
-#include <netinet/in.h>
-#include <netinet6/in6_var.h>
-#endif
-#include <net/route.h>
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
 #include <errno.h>
-#ifdef HAVE_UNISTD_H
+#include <fcntl.h>
 #include <unistd.h>
-#endif
-#include <netdb.h>
-#ifdef HAVE_GETIFADDRS
-#include <ifaddrs.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/queue.h>
+#include <sys/socket.h>
+
+#ifdef __linux__
+#include <linux/netlink.h>
+#include <linux/rtnetlink.h>
+#define USE_NETLINK
+#else
+#include <net/route.h>
 #include <net/if.h>
-#endif 
+#include <net/if_dl.h>
+#include <sys/sysctl.h>
+#define USE_ROUTE
+#endif
 
 #include "var.h"
 #include "misc.h"
 #include "vmbuf.h"
 #include "plog.h"
 #include "sockmisc.h"
+#include "session.h"
 #include "debug.h"
 
 #include "localconf.h"
@@ -77,841 +67,803 @@
 #include "gcmalloc.h"
 #include "nattraversal.h"
 
-#ifdef __linux__
-#include <linux/types.h>
-#include <linux/rtnetlink.h>
-#ifndef HAVE_GETIFADDRS
-#define HAVE_GETIFADDRS
-#define NEED_LINUX_GETIFADDRS
-#endif
-#endif
+static int kernel_receive __P((void *ctx, int fd));
+static int kernel_open_socket __P((void));
+static void kernel_sync __P((void));
 
-#ifndef HAVE_GETIFADDRS
-static unsigned int if_maxindex __P((void));
-#endif
-static struct myaddrs *find_myaddr __P((struct myaddrs *, struct myaddrs *));
-static int suitable_ifaddr __P((const char *, const struct sockaddr *));
-#ifdef INET6
-static int suitable_ifaddr6 __P((const char *, const struct sockaddr *));
-#endif
-
-#ifdef NEED_LINUX_GETIFADDRS
-
-/* We could do this _much_ better. kame racoon in its current form
- * will esentially die at frequent changes of address configuration.
- */
-
-struct ifaddrs
-{
-	struct ifaddrs *ifa_next;
-	char		ifa_name[16];
-	int		ifa_ifindex;
-	struct sockaddr *ifa_addr;
-	struct sockaddr_storage ifa_addrbuf;
+struct myaddr {
+	LIST_ENTRY(myaddr) chain;
+	struct sockaddr_storage addr;
+	int fd;
+	int udp_encap;
 };
 
-static int parse_rtattr(struct rtattr *tb[], int max, struct rtattr *rta, int len)
+static LIST_HEAD(_myaddr_list_, myaddr) configured, opened;
+
+static void
+myaddr_delete(my)
+	struct myaddr *my;
 {
+	if (my->fd != -1)
+		isakmp_close(my->fd);
+	LIST_REMOVE(my, chain);
+	racoon_free(my);
+}
+
+static int
+myaddr_configured(addr)
+	struct sockaddr *addr;
+{
+	struct myaddr *cfg;
+
+	if (LIST_EMPTY(&configured))
+		return TRUE;
+
+	LIST_FOREACH(cfg, &configured, chain) {
+		if (cmpsaddr(addr, (struct sockaddr *) &cfg->addr) <= CMPSADDR_WILDPORT_MATCH)
+			return TRUE;
+	}
+
+	return FALSE;
+}
+
+static int
+myaddr_open(addr, udp_encap)
+	struct sockaddr *addr;
+	int udp_encap;
+{
+	struct myaddr *my;
+
+	/* Already open? */
+	LIST_FOREACH(my, &opened, chain) {
+		if (cmpsaddr(addr, (struct sockaddr *) &my->addr) <= CMPSADDR_WILDPORT_MATCH)
+			return TRUE;
+	}
+
+	my = racoon_calloc(1, sizeof(struct myaddr));
+	if (my == NULL)
+		return FALSE;
+
+	memcpy(&my->addr, addr, sysdep_sa_len(addr));
+	my->fd = isakmp_open(addr, udp_encap);
+	if (my->fd < 0) {
+		racoon_free(my);
+		return FALSE;
+	}
+	my->udp_encap = udp_encap;
+	LIST_INSERT_HEAD(&opened, my, chain);
+	return TRUE;
+}
+
+static int
+myaddr_open_all_configured(addr)
+	struct sockaddr *addr;
+{
+	/* create all configured, not already opened addresses */
+	struct myaddr *cfg, *my;
+
+	if (addr != NULL) {
+		switch (addr->sa_family) {
+		case AF_INET:
+#ifdef INET6
+		case AF_INET6:
+#endif
+			break;
+		default:
+			return FALSE;
+		}
+	}
+
+	LIST_FOREACH(cfg, &configured, chain) {
+		if (addr != NULL &&
+		    cmpsaddr(addr, (struct sockaddr *) &cfg->addr) > CMPSADDR_WILDPORT_MATCH)
+			continue;
+		if (!myaddr_open((struct sockaddr *) &cfg->addr, cfg->udp_encap))
+			return FALSE;
+	}
+	if (LIST_EMPTY(&configured)) {
+#ifdef ENABLE_HYBRID
+		/* Exclude any address we got through ISAKMP mode config */
+		if (exclude_cfg_addr(addr) == 0)
+			return FALSE;
+#endif
+		set_port(addr, lcconf->port_isakmp);
+		myaddr_open(addr, FALSE);
+#ifdef ENABLE_NATT
+		set_port(addr, lcconf->port_isakmp_natt);
+		myaddr_open(addr, TRUE);
+#endif
+	}
+	return TRUE;
+}
+
+static void
+myaddr_close_all_open(addr)
+	struct sockaddr *addr;
+{
+	/* delete all matching open sockets */
+	struct myaddr *my, *next;
+
+	for (my = LIST_FIRST(&opened); my; my = next) {
+		next = LIST_NEXT(my, chain);
+
+		if (cmpsaddr((struct sockaddr *) addr,
+			     (struct sockaddr *) &my->addr)
+		    <= CMPSADDR_WOP_MATCH)
+			myaddr_delete(my);
+	}
+}
+
+static void
+myaddr_flush_list(list)
+	struct _myaddr_list_ *list;
+{
+	struct myaddr *my, *next;
+
+	for (my = LIST_FIRST(list); my; my = next) {
+		next = LIST_NEXT(my, chain);
+		myaddr_delete(my);
+	}
+}
+
+void
+myaddr_flush()
+{
+	myaddr_flush_list(&configured);
+}
+
+int
+myaddr_listen(addr, udp_encap)
+	struct sockaddr *addr;
+	int udp_encap;
+{
+	struct myaddr *my;
+
+	if (sysdep_sa_len(addr) > sizeof(my->addr)) {
+		plog(LLV_ERROR, LOCATION, NULL,
+		     "sockaddr size larger than sockaddr_storage\n");
+		return -1;
+	}
+
+	my = racoon_calloc(1, sizeof(struct myaddr));
+	if (my == NULL)
+		return -1;
+
+	memcpy(&my->addr, addr, sysdep_sa_len(addr));
+	my->udp_encap = udp_encap;
+	my->fd = -1;
+	LIST_INSERT_HEAD(&configured, my, chain);
+
+	return 0;
+}
+
+void
+myaddr_sync()
+{
+	struct myaddr *my, *next;
+
+	if (!lcconf->strict_address) {
+		kernel_sync();
+
+		/* delete all existing listeners which are not configured */
+		for (my = LIST_FIRST(&opened); my; my = next) {
+			next = LIST_NEXT(my, chain);
+
+			if (!myaddr_configured((struct sockaddr *) &my->addr))
+				myaddr_delete(my);
+		}
+	}
+}
+
+int
+myaddr_getfd(addr)
+        struct sockaddr *addr;
+{
+	struct myaddr *my;
+
+	LIST_FOREACH(my, &opened, chain) {
+		if (cmpsaddr((struct sockaddr *) &my->addr, addr) <= CMPSADDR_WILDPORT_MATCH)
+			return my->fd;
+	}
+
+	return -1;
+}
+
+int
+myaddr_getsport(addr)
+	struct sockaddr *addr;
+{
+	struct myaddr *my;
+
+	LIST_FOREACH(my, &opened, chain) {
+		if (cmpsaddr((struct sockaddr *) &my->addr, addr) <= CMPSADDR_WILDPORT_MATCH)
+			return extract_port((struct sockaddr *) &my->addr);
+	}
+
+	return PORT_ISAKMP;
+}
+
+void
+myaddr_init_lists()
+{
+	LIST_INIT(&configured);
+	LIST_INIT(&opened);
+}
+
+int
+myaddr_init()
+{
+        if (!lcconf->strict_address) {
+		lcconf->rtsock = kernel_open_socket();
+		if (lcconf->rtsock < 0)
+			return -1;
+		monitor_fd(lcconf->rtsock, kernel_receive, NULL, 0);
+	} else {
+		lcconf->rtsock = -1;
+		if (!myaddr_open_all_configured(NULL))
+			return -1;
+	}
+	return 0;
+}
+
+void
+myaddr_close()
+{
+	myaddr_flush_list(&configured);
+	myaddr_flush_list(&opened);
+	if (lcconf->rtsock != -1) {
+		unmonitor_fd(lcconf->rtsock);
+		close(lcconf->rtsock);
+	}
+}
+
+#if defined(USE_NETLINK)
+
+static int netlink_fd = -1;
+
+#define NLMSG_TAIL(nmsg) \
+	((struct rtattr *) (((void *) (nmsg)) + NLMSG_ALIGN((nmsg)->nlmsg_len)))
+
+static void
+parse_rtattr(struct rtattr *tb[], int max, struct rtattr *rta, int len)
+{
+	memset(tb, 0, sizeof(struct rtattr *) * (max + 1));
 	while (RTA_OK(rta, len)) {
 		if (rta->rta_type <= max)
 			tb[rta->rta_type] = rta;
 		rta = RTA_NEXT(rta,len);
 	}
-	return 0;
 }
 
-static void recvaddrs(int fd, struct ifaddrs **ifa, __u32 seq)
+static int
+netlink_add_rtattr_l(struct nlmsghdr *n, int maxlen, int type,
+		     const void *data, int alen)
 {
-	char	buf[8192];
-	struct sockaddr_nl nladdr;
-	struct iovec iov = { buf, sizeof(buf) };
-	struct ifaddrmsg *m;
-	struct rtattr * rta_tb[IFA_MAX+1];
-	struct ifaddrs *I;
+	int len = RTA_LENGTH(alen);
+	struct rtattr *rta;
 
-	while (1) {
-		int status;
-		struct nlmsghdr *h;
+	if (NLMSG_ALIGN(n->nlmsg_len) + RTA_ALIGN(len) > maxlen)
+		return FALSE;
 
-		struct msghdr msg = {
-			(void*)&nladdr, sizeof(nladdr),
-			&iov,	1,
-			NULL,	0,
-			0
-		};
-
-		status = recvmsg(fd, &msg, 0);
-
-		if (status < 0)
-			continue;
-
-		if (status == 0)
-			return;
-
-		if (nladdr.nl_pid) /* Message not from kernel */
-			continue;
-
-		h = (struct nlmsghdr*)buf;
-		while (NLMSG_OK(h, status)) {
-			if (h->nlmsg_seq != seq)
-				goto skip_it;
-
-			if (h->nlmsg_type == NLMSG_DONE)
-				return;
-
-			if (h->nlmsg_type == NLMSG_ERROR)
-				return;
-
-			if (h->nlmsg_type != RTM_NEWADDR)
-				goto skip_it;
-
-			m = NLMSG_DATA(h);
-
-			if (m->ifa_family != AF_INET &&
-			    m->ifa_family != AF_INET6)
-				goto skip_it;
-
-			if (m->ifa_flags&IFA_F_TENTATIVE)
-				goto skip_it;
-
-			memset(rta_tb, 0, sizeof(rta_tb));
-			parse_rtattr(rta_tb, IFA_MAX, IFA_RTA(m), h->nlmsg_len - NLMSG_LENGTH(sizeof(*m)));
-
-			if (rta_tb[IFA_LOCAL] == NULL)
-				rta_tb[IFA_LOCAL] = rta_tb[IFA_ADDRESS];
-			if (rta_tb[IFA_LOCAL] == NULL)
-				goto skip_it;
-			
-			I = malloc(sizeof(struct ifaddrs));
-			if (!I)
-				return;
-			memset(I, 0, sizeof(*I));
-
-			I->ifa_ifindex = m->ifa_index;
-			I->ifa_addr = (struct sockaddr*)&I->ifa_addrbuf;
-			I->ifa_addr->sa_family = m->ifa_family;
-			if (m->ifa_family == AF_INET) {
-				struct sockaddr_in *sin = (void*)I->ifa_addr;
-				memcpy(&sin->sin_addr, RTA_DATA(rta_tb[IFA_LOCAL]), 4);
-			} else {
-				struct sockaddr_in6 *sin = (void*)I->ifa_addr;
-				memcpy(&sin->sin6_addr, RTA_DATA(rta_tb[IFA_LOCAL]), 16);
-				if (IN6_IS_ADDR_LINKLOCAL(&sin->sin6_addr))
-					sin->sin6_scope_id = I->ifa_ifindex;
-			}
-			I->ifa_next = *ifa;
-			*ifa = I;
-
-skip_it:
-			h = NLMSG_NEXT(h, status);
-		}
-		if (msg.msg_flags & MSG_TRUNC)
-			continue;
-	}
-	return;
+	rta = NLMSG_TAIL(n);
+	rta->rta_type = type;
+	rta->rta_len = len;
+	memcpy(RTA_DATA(rta), data, alen);
+	n->nlmsg_len = NLMSG_ALIGN(n->nlmsg_len) + RTA_ALIGN(len);
+	return TRUE;
 }
 
-static int getifaddrs(struct ifaddrs **ifa0)
+static int
+netlink_enumerate(fd, family, type)
+	int fd;
+	int family;
+	int type;
 {
 	struct {
 		struct nlmsghdr nlh;
 		struct rtgenmsg g;
 	} req;
-	struct sockaddr_nl nladdr;
-	static __u32 seq;
-	struct ifaddrs *i;
-	int fd;
+	struct sockaddr_nl addr;
+	static __u32 seq = 0;
 
-	fd = socket(PF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
-	if (fd < 0)
-		return -1;
+	memset(&addr, 0, sizeof(addr));
+	addr.nl_family = AF_NETLINK;
+
+	memset(&req, 0, sizeof(req));
+	req.nlh.nlmsg_len = sizeof(req);
+	req.nlh.nlmsg_type = type;
+	req.nlh.nlmsg_flags = NLM_F_ROOT | NLM_F_MATCH | NLM_F_REQUEST;
+	req.nlh.nlmsg_pid = 0;
+	req.nlh.nlmsg_seq = ++seq;
+	req.g.rtgen_family = family;
+
+	return sendto(fd, (void *) &req, sizeof(req), 0,
+		      (struct sockaddr *) &addr, sizeof(addr)) >= 0;
+}
+
+static void
+netlink_add_del_address(int add, struct sockaddr *saddr)
+{
+	plog(LLV_DEBUG, LOCATION, NULL,
+	     "Netlink: address %s %s\n",
+	     saddrwop2str((struct sockaddr *) saddr),
+	     add ? "added" : "deleted");
+
+	if (add)
+		myaddr_open_all_configured(saddr);
+	else
+		myaddr_close_all_open(saddr);
+}
+
+#ifdef INET6
+static int
+netlink_process_addr(struct nlmsghdr *h)
+{
+	struct sockaddr_storage addr;
+	struct ifaddrmsg *ifa;
+	struct rtattr *rta[IFA_MAX+1];
+	struct sockaddr_in6 *sin6;
+
+	ifa = NLMSG_DATA(h);
+	parse_rtattr(rta, IFA_MAX, IFA_RTA(ifa), IFA_PAYLOAD(h));
+
+	if (ifa->ifa_family != AF_INET6)
+		return 0;
+	if (ifa->ifa_flags & IFA_F_TENTATIVE)
+		return 0;
+	if (rta[IFA_LOCAL] == NULL)
+		rta[IFA_LOCAL] = rta[IFA_ADDRESS];
+	if (rta[IFA_LOCAL] == NULL)
+		return 0;
+
+	memset(&addr, 0, sizeof(addr));
+	addr.ss_family = ifa->ifa_family;
+	sin6 = (struct sockaddr_in6 *) &addr;
+	memcpy(&sin6->sin6_addr, RTA_DATA(rta[IFA_LOCAL]),
+		sizeof(sin6->sin6_addr));
+	if (!IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
+		return 0;
+	sin6->sin6_scope_id = ifa->ifa_index;
+
+	netlink_add_del_address(h->nlmsg_type == RTM_NEWADDR,
+				(struct sockaddr *) &addr);
+
+	return 0;
+}
+#endif
+
+static int
+netlink_route_is_local(int family, const unsigned char *addr, size_t addr_len)
+{
+	struct {
+		struct nlmsghdr n;
+		struct rtmsg    r;
+		char            buf[1024];
+	} req;
+	struct rtmsg *r = NLMSG_DATA(&req.n);
+	struct rtattr *rta[RTA_MAX+1];
+	struct sockaddr_nl nladdr;
+	ssize_t rlen;
+
+	memset(&req, 0, sizeof(req));
+	req.n.nlmsg_len = NLMSG_LENGTH(sizeof(struct rtmsg));
+	req.n.nlmsg_flags = NLM_F_REQUEST;
+	req.n.nlmsg_type = RTM_GETROUTE;
+	req.r.rtm_family = family;
+	netlink_add_rtattr_l(&req.n, sizeof(req), RTA_DST,
+			     addr, addr_len);
+	req.r.rtm_dst_len = addr_len * 8;
 
 	memset(&nladdr, 0, sizeof(nladdr));
 	nladdr.nl_family = AF_NETLINK;
 
-	req.nlh.nlmsg_len = sizeof(req);
-	req.nlh.nlmsg_type = RTM_GETADDR;
-	req.nlh.nlmsg_flags = NLM_F_ROOT|NLM_F_MATCH|NLM_F_REQUEST;
-	req.nlh.nlmsg_pid = 0;
-	req.nlh.nlmsg_seq = ++seq;
-	req.g.rtgen_family = AF_UNSPEC;
+	if (sendto(netlink_fd, &req, sizeof(req), 0,
+		   (struct sockaddr *) &nladdr, sizeof(nladdr)) < 0)
+		return 0;
+	rlen = recv(netlink_fd, &req, sizeof(req), 0);
+	if (rlen < 0)
+		return 0;
 
-	if (sendto(fd, (void*)&req, sizeof(req), 0, (struct sockaddr*)&nladdr, sizeof(nladdr)) < 0) {
+	return  req.n.nlmsg_type == RTM_NEWROUTE &&
+		req.r.rtm_type == RTN_LOCAL;
+}
+
+static int
+netlink_process_route(struct nlmsghdr *h)
+{
+	struct sockaddr_storage addr;
+	struct rtmsg *rtm;
+	struct rtattr *rta[RTA_MAX+1];
+	struct sockaddr_in *sin;
+#ifdef INET6
+	struct sockaddr_in6 *sin6;
+#endif
+
+	rtm = NLMSG_DATA(h);
+
+	/* local IP addresses get local route in the local table */
+	if (rtm->rtm_type != RTN_LOCAL ||
+	    rtm->rtm_table != RT_TABLE_LOCAL)
+		return 0;
+
+	parse_rtattr(rta, IFA_MAX, RTM_RTA(rtm), IFA_PAYLOAD(h));
+	if (rta[RTA_DST] == NULL)
+ 		return 0;
+
+	/* setup the socket address */
+	memset(&addr, 0, sizeof(addr));
+	addr.ss_family = rtm->rtm_family;
+	switch (rtm->rtm_family) {
+	case AF_INET:
+		sin = (struct sockaddr_in *) &addr;
+		memcpy(&sin->sin_addr, RTA_DATA(rta[RTA_DST]),
+			sizeof(sin->sin_addr));
+		break;
+#ifdef INET6
+	case AF_INET6:
+		sin6 = (struct sockaddr_in6 *) &addr;
+		memcpy(&sin6->sin6_addr, RTA_DATA(rta[RTA_DST]),
+			sizeof(sin6->sin6_addr));
+		/* Link-local addresses are handled with RTM_NEWADDR
+		 * notifications */
+		if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
+			return 0;
+		break;
+#endif
+	default:
+		return 0;
+	}
+
+	/* If local route was deleted, check if there is still local
+	 * route for the same IP on another interface */
+	if (h->nlmsg_type == RTM_DELROUTE &&
+	    netlink_route_is_local(rtm->rtm_family,
+				   RTA_DATA(rta[RTA_DST]),
+				   RTA_PAYLOAD(rta[RTA_DST]))) {
+		plog(LLV_DEBUG, LOCATION, NULL,
+			"Netlink: not deleting %s yet, it exists still\n",
+			saddrwop2str((struct sockaddr *) &addr));
+		return 0;
+	}
+
+	netlink_add_del_address(h->nlmsg_type == RTM_NEWROUTE,
+				(struct sockaddr *) &addr);
+	return 0;
+}
+
+static int
+netlink_process(struct nlmsghdr *h)
+{
+	switch (h->nlmsg_type) {
+#ifdef INET6
+	case RTM_NEWADDR:
+	case RTM_DELADDR:
+		return netlink_process_addr(h);
+#endif
+	case RTM_NEWROUTE:
+	case RTM_DELROUTE:
+		return netlink_process_route(h);
+	}
+	return 0;
+}
+
+static int
+kernel_receive(ctx, fd)
+	void *ctx;
+	int fd;
+{
+	struct sockaddr_nl nladdr;
+	struct iovec iov;
+	struct msghdr msg = {
+		.msg_name = &nladdr,
+		.msg_namelen = sizeof(nladdr),
+		.msg_iov = &iov,
+		.msg_iovlen = 1,
+	};
+	struct nlmsghdr *h;
+	int len, status;
+	char buf[16*1024];
+
+	iov.iov_base = buf;
+	while (1) {
+		iov.iov_len = sizeof(buf);
+		status = recvmsg(fd, &msg, MSG_DONTWAIT);
+		if (status < 0) {
+			if (errno == EINTR)
+				continue;
+			if (errno == EAGAIN)
+				return FALSE;
+			continue;
+		}
+		if (status == 0)
+			return FALSE;
+
+		h = (struct nlmsghdr *) buf;
+		while (NLMSG_OK(h, status)) {
+			netlink_process(h);
+			h = NLMSG_NEXT(h, status);
+		}
+	}
+
+	return TRUE;
+}
+
+static int
+netlink_open_socket()
+{
+	int fd;
+
+	fd = socket(PF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
+	if (fd < 0) {
+		plog(LLV_ERROR, LOCATION, NULL,
+			"socket(PF_NETLINK) failed: %s",
+			strerror(errno));
+		return -1;
+	}
+	close_on_exec(fd);
+	if (fcntl(fd, F_SETFL, O_NONBLOCK) == -1)
+		plog(LLV_WARNING, LOCATION, NULL,
+		     "failed to put socket in non-blocking mode\n");
+
+	return fd;
+}
+
+static int
+kernel_open_socket()
+{
+	struct sockaddr_nl nl;
+	int fd;
+
+	if (netlink_fd < 0) {
+		netlink_fd = netlink_open_socket();
+		if (netlink_fd < 0)
+			return -1;
+	}
+
+	fd = netlink_open_socket();
+	if (fd < 0)
+		return fd;
+
+	/* We monitor IPv4 addresses using RTMGRP_IPV4_ROUTE group
+	 * the get the RTN_LOCAL routes which are automatically added
+	 * by kernel. This is because:
+	 *  - Linux kernel has a bug that calling bind() immediately
+	 *    after IPv4 RTM_NEWADDR event can fail
+	 *  - if IP is configured in multiple interfaces, we get
+	 *    RTM_DELADDR for each of them. RTN_LOCAL gets deleted only
+	 *    after the last IP address is deconfigured.
+	 * The latter reason is also why I chose to use route
+	 * notifications for IPv6. However, we do need to use RTM_NEWADDR
+	 * for the link-local IPv6 addresses to get the interface index
+	 * that is needed in bind().
+	 */
+	memset(&nl, 0, sizeof(nl));
+	nl.nl_family = AF_NETLINK;
+	nl.nl_groups = RTMGRP_IPV4_ROUTE 
+#ifdef INET6
+			| RTMGRP_IPV6_IFADDR | RTMGRP_IPV6_ROUTE
+#endif
+			;
+	if (bind(fd, (struct sockaddr*) &nl, sizeof(nl)) < 0) {
+		plog(LLV_ERROR, LOCATION, NULL,
+		     "bind(PF_NETLINK) failed: %s\n",
+		     strerror(errno));
 		close(fd);
 		return -1;
 	}
-
-	*ifa0 = NULL;
-
-	recvaddrs(fd, ifa0, seq);
-
-	close(fd);
-
-	fd = socket(AF_INET, SOCK_DGRAM, 0);
-
-	for (i=*ifa0; i; i = i->ifa_next) {
-		struct ifreq ifr;
-		ifr.ifr_ifindex = i->ifa_ifindex;
-		ioctl(fd, SIOCGIFNAME, (void*)&ifr);
-		memcpy(i->ifa_name, ifr.ifr_name, 16);
-	}
-	close(fd);
-
-	return 0;
+	return fd;
 }
 
-static void freeifaddrs(struct ifaddrs *ifa0)
+static void
+kernel_sync()
 {
-        struct ifaddrs *i;
+	int fd = lcconf->rtsock;
 
-        while (ifa0) {
-                i = ifa0;
-                ifa0 = i->ifa_next;
-                free(i);
-        }
-}
-
-#endif
-
-#ifndef HAVE_GETIFADDRS
-static unsigned int
-if_maxindex()
-{
-	struct if_nameindex *p, *p0;
-	unsigned int max = 0;
-
-	p0 = if_nameindex();
-	for (p = p0; p && p->if_index && p->if_name; p++) {
-		if (max < p->if_index)
-			max = p->if_index;
-	}
-	if_freenameindex(p0);
-	return max;
-}
-#endif
-
-void
-clear_myaddr(db)
-	struct myaddrs **db;
-{
-	struct myaddrs *p;
-
-	while (*db) {
-		p = (*db)->next;
-		delmyaddr(*db);
-		*db = p;
-	}
-}
-  
-static struct myaddrs *
-find_myaddr(db, p)
-	struct myaddrs *db;
-	struct myaddrs *p;
-{
-	struct myaddrs *q;
-	char h1[NI_MAXHOST], h2[NI_MAXHOST];
-
-	if (getnameinfo(p->addr, sysdep_sa_len(p->addr), h1, sizeof(h1), NULL, 0,
-	    NI_NUMERICHOST | niflags) != 0)
-		return NULL;
-
-	for (q = db; q; q = q->next) {
-		if (p->addr->sa_family != q->addr->sa_family)
-			continue;
-		if (getnameinfo(q->addr, sysdep_sa_len(q->addr), h2, sizeof(h2),
-		    NULL, 0, NI_NUMERICHOST | niflags) != 0)
-			return NULL;
-		if (strcmp(h1, h2) == 0)
-			return q;
-	}
-
-	return NULL;
-}
-
-void
-grab_myaddrs()
-{
-#ifdef HAVE_GETIFADDRS
-	struct myaddrs *p, *q, *old;
-	struct ifaddrs *ifa0, *ifap;
-#ifdef INET6
-	struct sockaddr_in6 *sin6;
-#endif
-
-	char addr1[NI_MAXHOST];
-
-	if (getifaddrs(&ifa0)) {
+	/* refresh addresses */
+	if (!netlink_enumerate(fd, PF_UNSPEC, RTM_GETROUTE)) {
 		plog(LLV_ERROR, LOCATION, NULL,
-			"getifaddrs failed: %s\n", strerror(errno));
-		exit(1);
-		/*NOTREACHED*/
+		     "unable to enumerate addresses: %s\n",
+		     strerror(errno));
 	}
+	while (kernel_receive(NULL, fd) == TRUE);
 
-	old = lcconf->myaddrs;
-
-	for (ifap = ifa0; ifap; ifap = ifap->ifa_next) {
-		if (! ifap->ifa_addr)
-			continue;
-
-		if (ifap->ifa_addr->sa_family != AF_INET
 #ifdef INET6
-		 && ifap->ifa_addr->sa_family != AF_INET6
-#endif
-		)
-			continue;
-
-		if (!suitable_ifaddr(ifap->ifa_name, ifap->ifa_addr)) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"unsuitable address: %s %s\n",
-				ifap->ifa_name,
-				saddrwop2str(ifap->ifa_addr));
-			continue;
-		}
-
-		p = newmyaddr();
-		if (p == NULL) {
-			exit(1);
-			/*NOTREACHED*/
-		}
-		p->addr = dupsaddr(ifap->ifa_addr);
-		if (p->addr == NULL) {
-			exit(1);
-			/*NOTREACHED*/
-		}
-#ifdef INET6
-#ifdef __KAME__
-		if (ifap->ifa_addr->sa_family == AF_INET6) {
-			sin6 = (struct sockaddr_in6 *)p->addr;
-			if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)
-			 || IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
-				sin6->sin6_scope_id =
-					ntohs(*(u_int16_t *)&sin6->sin6_addr.s6_addr[2]);
-				sin6->sin6_addr.s6_addr[2] = 0;
-				sin6->sin6_addr.s6_addr[3] = 0;
-			}
-		}
-#else /* !__KAME__ */
-		if (ifap->ifa_addr->sa_family == AF_INET6) {
-			sin6 = (struct sockaddr_in6 *)p->addr;
-			if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)
-			 || IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
-				sin6->sin6_scope_id =
-					if_nametoindex(ifap->ifa_name);
-			}
-		}
-				
-#endif
-#endif
-		if (getnameinfo(p->addr, sysdep_sa_len(p->addr),
-				addr1, sizeof(addr1),
-				NULL, 0,
-				NI_NUMERICHOST | niflags))
-		strlcpy(addr1, "(invalid)", sizeof(addr1));
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"my interface: %s (%s)\n",
-			addr1, ifap->ifa_name);
-		q = find_myaddr(old, p);
-		if (q)
-			p->sock = q->sock;
-		else
-			p->sock = -1;
-		p->next = lcconf->myaddrs;
-		lcconf->myaddrs = p;
+	if (!netlink_enumerate(fd, PF_INET6, RTM_GETADDR)) {
+		plog(LLV_ERROR, LOCATION, NULL,
+		     "unable to enumerate addresses: %s\n",
+		     strerror(errno));
 	}
+	while (kernel_receive(NULL, fd) == TRUE);
+#endif
+}
 
-	freeifaddrs(ifa0);
+#elif defined(USE_ROUTE)
 
-	clear_myaddr(&old);
+#define ROUNDUP(a) \
+  ((a) > 0 ? (1 + (((a) - 1) | (sizeof(long) - 1))) : sizeof(long))
 
-#else /*!HAVE_GETIFADDRS*/
-	int s;
-	unsigned int maxif;
+#define SAROUNDUP(X)   ROUNDUP(((struct sockaddr *)(X))->sa_len)
+
+static size_t
+parse_address(start, end, dest)
+	caddr_t start;
+	caddr_t end;
+	struct sockaddr_storage *dest;
+{
 	int len;
-	struct ifreq *iflist;
-	struct ifconf ifconf;
-	struct ifreq *ifr, *ifr_end;
-	struct myaddrs *p, *q, *old;
-#ifdef INET6
-#ifdef __KAME__
-	struct sockaddr_in6 *sin6;
-#endif
-#endif
 
-	char addr1[NI_MAXHOST];
+	if (start >= end)
+		return 0;
 
-	maxif = if_maxindex() + 1;
-	len = maxif * sizeof(struct sockaddr_storage) * 4; /* guess guess */
+	len = SAROUNDUP(start);
+	if (start + len > end)
+		return end - start;
 
-	iflist = (struct ifreq *)racoon_malloc(len);
-	if (!iflist) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to allocate buffer\n");
-		exit(1);
-		/*NOTREACHED*/
-	}
+	if (dest != NULL && len <= sizeof(struct sockaddr_storage))
+		memcpy(dest, start, len);
 
-	if ((s = socket(PF_INET, SOCK_DGRAM, 0)) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"socket(SOCK_DGRAM) failed: %s\n",
-			strerror(errno));
-		exit(1);
-		/*NOTREACHED*/
-	}
-	memset(&ifconf, 0, sizeof(ifconf));
-	ifconf.ifc_req = iflist;
-	ifconf.ifc_len = len;
-	if (ioctl(s, SIOCGIFCONF, &ifconf) < 0) {
-		close(s);
-		plog(LLV_ERROR, LOCATION, NULL,
-			"ioctl(SIOCGIFCONF) failed: %s\n",
-			strerror(errno));
-		exit(1);
-		/*NOTREACHED*/
-	}
-	close(s);
-
-	old = lcconf->myaddrs;
-
-	/* Look for this interface in the list */
-	ifr_end = (struct ifreq *) (ifconf.ifc_buf + ifconf.ifc_len);
-
-#define _IFREQ_LEN(p) \
-  (sizeof((p)->ifr_name) + sysdep_sa_len(&(p)->ifr_addr) > sizeof(struct ifreq) \
-    ? sizeof((p)->ifr_name) + sysdep_sa_len(&(p)->ifr_addr) : sizeof(struct ifreq))
-
-	for (ifr = ifconf.ifc_req;
-	     ifr < ifr_end;
-	     ifr = (struct ifreq *)((caddr_t)ifr + _IFREQ_LEN(ifr))) {
-
-		switch (ifr->ifr_addr.sa_family) {
-		case AF_INET:
-#ifdef INET6
-		case AF_INET6:
-#endif
-			if (!suitable_ifaddr(ifr->ifr_name, &ifr->ifr_addr)) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"unsuitable address: %s %s\n",
-					ifr->ifr_name,
-					saddrwop2str(&ifr->ifr_addr));
-				continue;
-			}
-
-			p = newmyaddr();
-			if (p == NULL) {
-				exit(1);
-				/*NOTREACHED*/
-			}
-			p->addr = dupsaddr(&ifr->ifr_addr);
-			if (p->addr == NULL) {
-				exit(1);
-				/*NOTREACHED*/
-			}
-#ifdef INET6
-#ifdef __KAME__
-			sin6 = (struct sockaddr_in6 *)p->addr;
-			if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)
-			 || IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
-				sin6->sin6_scope_id =
-					ntohs(*(u_int16_t *)&sin6->sin6_addr.s6_addr[2]);
-				sin6->sin6_addr.s6_addr[2] = 0;
-				sin6->sin6_addr.s6_addr[3] = 0;
-			}
-#endif
-#endif
-			if (getnameinfo(p->addr, sysdep_sa_len(p->addr),
-					addr1, sizeof(addr1),
-					NULL, 0,
-					NI_NUMERICHOST | niflags))
-			strlcpy(addr1, "(invalid)", sizeof(addr1));
-			plog(LLV_DEBUG, LOCATION, NULL,
-				"my interface: %s (%s)\n",
-				addr1, ifr->ifr_name);
-			q = find_myaddr(old, p);
-			if (q)
-				p->sock = q->sock;
-			else
-				p->sock = -1;
-			p->next = lcconf->myaddrs;
-			lcconf->myaddrs = p;
-			break;
-		default:
-			break;
-		}
-	}
-
-	clear_myaddr(&old);
-
-	racoon_free(iflist);
-#endif /*HAVE_GETIFADDRS*/
+	return len;
 }
 
-/*
- * check the interface is suitable or not
- */
-static int
-suitable_ifaddr(ifname, ifaddr)
-	const char *ifname;
-	const struct sockaddr *ifaddr;
+static void
+parse_addresses(start, end, flags, addr)
+	caddr_t start;
+	caddr_t end;
+	int flags;
+	struct sockaddr_storage *addr;
 {
-#ifdef ENABLE_HYBRID
-	/* Exclude any address we got through ISAKMP mode config */
-	if (exclude_cfg_addr(ifaddr) == 0)
-		return 0;
-#endif
-	switch(ifaddr->sa_family) {
-	case AF_INET:
-		return 1;
-#ifdef INET6
-	case AF_INET6:
-		return suitable_ifaddr6(ifname, ifaddr);
-#endif
-	default:
-		return 0;
-	}
-	/*NOTREACHED*/
+	memset(addr, 0, sizeof(*addr));
+	if (flags & RTA_DST)
+		start += parse_address(start, end, NULL);
+	if (flags & RTA_GATEWAY)
+		start += parse_address(start, end, NULL);
+	if (flags & RTA_NETMASK)
+		start += parse_address(start, end, NULL);
+	if (flags & RTA_GENMASK)
+		start += parse_address(start, end, NULL);
+	if (flags & RTA_IFP)
+		start += parse_address(start, end, NULL);
+	if (flags & RTA_IFA)
+		start += parse_address(start, end, addr);
+	if (flags & RTA_AUTHOR)
+		start += parse_address(start, end, NULL);
+	if (flags & RTA_BRD)
+		start += parse_address(start, end, NULL);
 }
 
-#ifdef INET6
-static int
-suitable_ifaddr6(ifname, ifaddr)
-	const char *ifname;
-	const struct sockaddr *ifaddr;
+static void
+kernel_handle_message(msg)
+	caddr_t msg;
 {
-#ifndef __linux__
-	struct in6_ifreq ifr6;
-	int s;
-#endif
+	struct rt_msghdr *rtm = (struct rt_msghdr *) msg;
+	struct ifa_msghdr *ifa = (struct ifa_msghdr *) msg;
+	struct sockaddr_storage addr;
 
-	if (ifaddr->sa_family != AF_INET6)
-		return 0;
-
-#ifndef __linux__
-	s = socket(PF_INET6, SOCK_DGRAM, 0);
-	if (s == -1) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"socket(SOCK_DGRAM) failed:%s\n", strerror(errno));
-		return 0;
-	}
-
-	memset(&ifr6, 0, sizeof(ifr6));
-	strncpy(ifr6.ifr_name, ifname, strlen(ifname));
-
-	ifr6.ifr_addr = *(const struct sockaddr_in6 *)ifaddr;
-
-	if (ioctl(s, SIOCGIFAFLAG_IN6, &ifr6) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"ioctl(SIOCGIFAFLAG_IN6) failed:%s\n", strerror(errno));
-		close(s);
-		return 0;
-	}
-
-	close(s);
-
-	if (ifr6.ifr_ifru.ifru_flags6 & IN6_IFF_DUPLICATED
-	 || ifr6.ifr_ifru.ifru_flags6 & IN6_IFF_DETACHED
-	 || ifr6.ifr_ifru.ifru_flags6 & IN6_IFF_ANYCAST)
-		return 0;
-#endif
-
-	/* suitable */
-	return 1;
-}
-#endif
-
-int
-update_myaddrs()
-{
-#ifdef __linux__
-	char msg[BUFSIZ];
-	int len;
-	struct nlmsghdr *h = (void*)msg;
-	len = read(lcconf->rtsock, msg, sizeof(msg));
-	if (len < 0)
-		return errno == ENOBUFS;
-	if (len < sizeof(*h))
-		return 0;
-	if (h->nlmsg_pid) /* not from kernel! */
-		return 0;
-	if (h->nlmsg_type == RTM_NEWLINK)
-		return 0;
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"netlink signals update interface address list\n");
-	return 1;
-#else
-	char msg[BUFSIZ];
-	int len;
-	struct rt_msghdr *rtm;
-
-	len = read(lcconf->rtsock, msg, sizeof(msg));
-	if (len < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"read(PF_ROUTE) failed: %s\n",
-			strerror(errno));
-		return 0;
-	}
-	rtm = (struct rt_msghdr *)msg;
-	if (len < rtm->rtm_msglen) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"read(PF_ROUTE) short read\n");
-		return 0;
-	}
-	if (rtm->rtm_version != RTM_VERSION) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"routing socket version mismatch\n");
-		close(lcconf->rtsock);
-		lcconf->rtsock = -1;
-		return 0;
-	}
 	switch (rtm->rtm_type) {
 	case RTM_NEWADDR:
-	case RTM_DELADDR:
-	case RTM_DELETE:
-	case RTM_IFINFO:
+		parse_addresses(ifa + 1, msg + ifa->ifam_msglen,
+				ifa->ifam_addrs, &addr);
+		myaddr_open_all_configured((struct sockaddr *) &addr);
 		break;
+	case RTM_DELADDR:
+		parse_addresses(ifa + 1, msg + ifa->ifam_msglen,
+				ifa->ifam_addrs, &addr);
+		myaddr_close_all_open((struct sockaddr *) &addr);
+		break;
+	case RTM_ADD:
+	case RTM_DELETE:
+	case RTM_CHANGE:
 	case RTM_MISS:
-		/* ignore this message silently */
-		return 0;
-	default:
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"msg %d not interesting\n", rtm->rtm_type);
-		return 0;
-	}
-	/* XXX more filters here? */
-
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"caught rtm:%d, need update interface address list\n",
-		rtm->rtm_type);
-	return 1;
-#endif /* __linux__ */
-}
-
-/*
- * initialize default port for ISAKMP to send, if no "listen"
- * directive is specified in config file.
- *
- * DO NOT listen to wildcard addresses.  if you receive packets to
- * wildcard address, you'll be in trouble (DoS attack possible by
- * broadcast storm).
- */
-int
-autoconf_myaddrsport()
-{
-	struct myaddrs *p;
-	int n;
-
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"configuring default isakmp port.\n");
-
-#ifdef ENABLE_NATT
-	if (natt_enabled_in_rmconf ()) {
-		plog(LLV_NOTIFY, LOCATION, NULL, "NAT-T is enabled, autoconfiguring ports\n");
-		for (p = lcconf->myaddrs; p; p = p->next) {
-			struct myaddrs *new;
-			if (! p->udp_encap) {
-				new = dupmyaddr(p);
-				new->udp_encap = 1;
-			}
-		}
-	}
+	case RTM_IFINFO:
+#ifdef RTM_OIFINFO
+	case RTM_OIFINFO:
 #endif
-
-	for (p = lcconf->myaddrs, n = 0; p; p = p->next, n++) {
-		set_port (p->addr, p->udp_encap ? lcconf->port_isakmp_natt : lcconf->port_isakmp);
+#ifdef RTM_NEWMADDR
+	case RTM_NEWMADDR:
+	case RTM_DELMADDR:
+#endif
+#ifdef RTM_IFANNOUNCE
+	case RTM_IFANNOUNCE:
+#endif
+		break;
+	default:
+		plog(LLV_WARNING, LOCATION, NULL,
+		     "unrecognized route message with rtm_type: %d",
+		     rtm->rtm_type);
+		break;
 	}
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"%d addrs are configured successfully\n", n);
-
-	return 0;
 }
 
-/*
- * get a port number to which racoon binded.
- */
-u_short
-getmyaddrsport(local)
-	struct sockaddr *local;
+static int
+kernel_receive(ctx, fd)
+	void *ctx;
+	int fd;
 {
-	struct myaddrs *p, *bestmatch = NULL;
-	u_short bestmatch_port = PORT_ISAKMP;
+	char buf[16*1024];
+	struct rt_msghdr *rtm = (struct rt_msghdr *) buf;
+	int len;
 
-	/* get a relative port */
-	for (p = lcconf->myaddrs; p; p = p->next) {
-		if (!p->addr)
-			continue;
-		if (cmpsaddrwop(local, p->addr))
-			continue;
-
-		/* use first matching address regardless of port */
-		if (!bestmatch) {
-			bestmatch = p;
-			continue;
-		}
-
-		/* matching address with port PORT_ISAKMP */
-		if (extract_port(p->addr) == PORT_ISAKMP) {
-			bestmatch = p;
-			bestmatch_port = PORT_ISAKMP;
-		}
+	len = read(fd, &buf, sizeof(buf));
+	if (len <= 0) {
+		if (len < 0 && errno != EWOULDBLOCK && errno != EAGAIN)
+			plog(LLV_WARNING, LOCATION, NULL,
+			     "routing socket error: %s", strerror(errno));
+		return FALSE;
 	}
 
-	return bestmatch_port;
-}
-
-struct myaddrs *
-newmyaddr()
-{
-	struct myaddrs *new;
-
-	new = racoon_calloc(1, sizeof(*new));
-	if (new == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to allocate buffer for myaddrs.\n");
-		return NULL;
+	if (rtm->rtm_msglen != len) {
+		plog(LLV_WARNING, LOCATION, NULL,
+		     "kernel_receive: rtm->rtm_msglen %d, len %d, type %d\n",
+		     rtm->rtm_msglen, len, rtm->rtm_type);
+		return FALSE;
 	}
 
-	new->next = NULL;
-	new->addr = NULL;
-
-	return new;
+	kernel_handle_message(buf);
+	return TRUE;
 }
 
-struct myaddrs *
-dupmyaddr(struct myaddrs *old)
+static int
+kernel_open_socket()
 {
-	struct myaddrs *new;
+	int fd;
 
-	new = racoon_calloc(1, sizeof(*new));
-	if (new == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to allocate buffer for myaddrs.\n");
-		return NULL;
-	}
-
-	/* Copy the whole structure and set the differences.  */
-	memcpy (new, old, sizeof (*new));
-	new->addr = dupsaddr (old->addr);
-	if (new->addr == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to allocate buffer for myaddrs.\n");
-		racoon_free(new);
-		return NULL;
-	}
-	new->next = old->next;
-	old->next = new;
-
-	return new;
-}
-
-void
-insmyaddr(new, head)
-	struct myaddrs *new;
-	struct myaddrs **head;
-{
-	new->next = *head;
-	*head = new;
-}
-
-void
-delmyaddr(myaddr)
-	struct myaddrs *myaddr;
-{
-	if (myaddr->addr)
-		racoon_free(myaddr->addr);
-	racoon_free(myaddr);
-}
-
-int
-initmyaddr()
-{
-	/* initialize routing socket */
-	lcconf->rtsock = socket(PF_ROUTE, SOCK_RAW, PF_UNSPEC);
-	if (lcconf->rtsock < 0) {
+	fd = socket(PF_ROUTE, SOCK_RAW, 0);
+	if (fd < 0) {
 		plog(LLV_ERROR, LOCATION, NULL,
 			"socket(PF_ROUTE) failed: %s",
 			strerror(errno));
 		return -1;
 	}
+	close_on_exec(fd);
+	if (fcntl(fd, F_SETFL, O_NONBLOCK) == -1)
+		plog(LLV_WARNING, LOCATION, NULL,
+		     "failed to put socket in non-blocking mode\n");
 
-#ifdef __linux__
-   {
-	struct sockaddr_nl nl;
-	u_int addr_len;
-
-	memset(&nl, 0, sizeof(nl));
-	nl.nl_family = AF_NETLINK;
-	nl.nl_groups = RTMGRP_IPV4_IFADDR|RTMGRP_LINK|RTMGRP_IPV6_IFADDR;
-
-	if (bind(lcconf->rtsock, (struct sockaddr*)&nl, sizeof(nl)) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		     "bind(PF_NETLINK) failed: %s\n",
-		     strerror(errno));
-		return -1;
-	}
-	addr_len = sizeof(nl);
-	if (getsockname(lcconf->rtsock, (struct sockaddr*)&nl, &addr_len) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		     "getsockname(PF_NETLINK) failed: %s\n",
-		     strerror(errno));
-		return -1;
-	}
-   }
-#endif
-
-	if (lcconf->myaddrs == NULL && lcconf->autograbaddr == 1) {
-		grab_myaddrs();
-
-		if (autoconf_myaddrsport() < 0)
-			return -1;
-	}
-
-	return 0;
+	return fd;
 }
 
-/* select the socket to be sent */
-/* should implement other method. */
-int
-getsockmyaddr(my)
-	struct sockaddr *my;
+static void
+kernel_sync()
 {
-	struct myaddrs *p, *lastresort = NULL;
-#if defined(INET6) && defined(__linux__)
-	struct myaddrs *match_wo_scope_id = NULL;
-	int check_wo_scope_id = (my->sa_family == AF_INET6) && 
-		IN6_IS_ADDR_LINKLOCAL(&((struct sockaddr_in6 *)my)->sin6_addr);
-#endif
+	caddr_t ref, buf, end;
+	size_t bufsiz;
+	struct if_msghdr *ifm;
+	struct interface *ifp;
 
-	for (p = lcconf->myaddrs; p; p = p->next) {
-		if (p->addr == NULL)
-			continue;
-		if (my->sa_family == p->addr->sa_family) {
-			lastresort = p;
-		} else continue;
-		if (sysdep_sa_len(my) == sysdep_sa_len(p->addr)
-		 && memcmp(my, p->addr, sysdep_sa_len(my)) == 0) {
-			break;
-		}
-#if defined(INET6) && defined(__linux__)
-		if (check_wo_scope_id && IN6_IS_ADDR_LINKLOCAL(&((struct sockaddr_in6 *)p->addr)->sin6_addr) &&
-			/* XXX: this depends on sin6_scope_id to be last
-			 * item in struct sockaddr_in6 */
-			memcmp(my, p->addr, 
-				sysdep_sa_len(my) - sizeof(uint32_t)) == 0) {
-			match_wo_scope_id = p;
-		}
-#endif
-	}
-#if defined(INET6) && defined(__linux__)
-	if (!p)
-		p = match_wo_scope_id;
-#endif
-	if (!p)
-		p = lastresort;
-	if (!p) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"no socket matches address family %d\n",
-			my->sa_family);
-		return -1;
+#define MIBSIZ 6
+	int mib[MIBSIZ] = {
+		CTL_NET,
+		PF_ROUTE,
+		0,
+		0, /*  AF_INET & AF_INET6 */
+		NET_RT_IFLIST,
+		0
+	};
+
+	if (sysctl(mib, MIBSIZ, NULL, &bufsiz, NULL, 0) < 0) {
+		plog(LLV_WARNING, LOCATION, NULL,
+		     "sysctl() error: %s", strerror(errno));
+		return;
 	}
 
-	return p->sock;
+	ref = buf = racoon_malloc(bufsiz);
+
+	if (sysctl(mib, MIBSIZ, buf, &bufsiz, NULL, 0) >= 0) {
+		/* Parse both interfaces and addresses. */
+		for (end = buf + bufsiz; buf < end; buf += ifm->ifm_msglen) {
+			ifm = (struct if_msghdr *) buf;
+			kernel_handle_message(buf);
+		}
+	} else {
+		plog(LLV_WARNING, LOCATION, NULL,
+		     "sysctl() error: %s", strerror(errno));
+	}
+
+	racoon_free(ref);
 }
+
+#else
+
+#error No supported interface to monitor local addresses.
+
+#endif
diff --git a/src/racoon/grabmyaddr.h b/src/racoon/grabmyaddr.h
index ac74b46..a105d8f 100644
--- a/src/racoon/grabmyaddr.h
+++ b/src/racoon/grabmyaddr.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: grabmyaddr.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
+/*	$NetBSD: grabmyaddr.h,v 1.6 2009/04/21 18:38:32 tteras Exp $	*/
 
 /* Id: grabmyaddr.h,v 1.5 2004/06/11 16:00:16 ludvigm Exp */
 
@@ -34,23 +34,15 @@
 #ifndef _GRABMYADDR_H
 #define _GRABMYADDR_H
 
-struct myaddrs {
-	struct myaddrs *next;
-	struct sockaddr *addr;
-	int sock;
-	int udp_encap;
-};
+extern void myaddr_init_lists __P((void));
+extern int myaddr_init __P((void));
+extern void myaddr_close __P((void));
 
-extern void clear_myaddr __P((struct myaddrs **));
-extern void grab_myaddrs __P((void));
-extern int update_myaddrs __P((void));
-extern int autoconf_myaddrsport __P((void));
-extern u_short getmyaddrsport __P((struct sockaddr *));
-extern struct myaddrs *newmyaddr __P((void));
-extern struct myaddrs *dupmyaddr __P((struct myaddrs *));
-extern void insmyaddr __P((struct myaddrs *, struct myaddrs **));
-extern void delmyaddr __P((struct myaddrs *));
-extern int initmyaddr __P((void));
-extern int getsockmyaddr __P((struct sockaddr *));
+extern void myaddr_flush __P((void));
+extern int myaddr_listen __P((struct sockaddr *, int));
+extern void myaddr_sync __P((void));
+
+extern int myaddr_getfd __P((struct sockaddr *));
+extern int myaddr_getsport __P((struct sockaddr *));
 
 #endif /* _GRABMYADDR_H */
diff --git a/src/racoon/handler.c b/src/racoon/handler.c
index b643256..a795ee6 100644
--- a/src/racoon/handler.c
+++ b/src/racoon/handler.c
@@ -1,11 +1,11 @@
-/*	$NetBSD: handler.c,v 1.9.6.8 2009/04/20 13:25:27 tteras Exp $	*/
+/*	$NetBSD: handler.c,v 1.39 2011/03/14 17:18:12 tteras Exp $	*/
 
 /* Id: handler.c,v 1.28 2006/05/26 12:17:29 manubsd Exp */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -17,7 +17,7 @@
  * 3. Neither the name of the project nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -64,7 +64,7 @@
 #include "evt.h"
 #include "isakmp.h"
 #ifdef ENABLE_HYBRID
-#include "isakmp_xauth.h"  
+#include "isakmp_xauth.h"
 #include "isakmp_cfg.h"
 #endif
 #include "isakmp_inf.h"
@@ -85,10 +85,10 @@
 static LIST_HEAD(_ph2tree_, ph2handle) ph2tree;
 static LIST_HEAD(_ctdtree_, contacted) ctdtree;
 static LIST_HEAD(_rcptree_, recvdpkt) rcptree;
+static struct sched sc_sweep = SCHED_INITIALIZER();
 
 static void del_recvdpkt __P((struct recvdpkt *));
 static void rem_recvdpkt __P((struct recvdpkt *));
-static void sweep_recvdpkt __P((void *));
 
 /*
  * functions about management of the isakmp status table
@@ -100,6 +100,41 @@
 
 extern caddr_t val2str(const char *, size_t);
 
+/*
+ * Enumerate the Phase 1 tree.
+ * If enum_func() internally return a non-zero value,  this specific
+ * error value is returned. 0 is returned if everything went right.
+ *
+ * Note that it is ok for enum_func() to call insph1(). Those inserted
+ * Phase 1 will not interfere with current enumeration process.
+ */
+int
+enumph1(sel, enum_func, enum_arg)
+	struct ph1selector *sel;
+	int (* enum_func)(struct ph1handle *iph1, void *arg);
+	void *enum_arg;
+{
+	struct ph1handle *p;
+	int ret;
+
+	LIST_FOREACH(p, &ph1tree, chain) {
+		if (sel != NULL) {
+			if (sel->local != NULL &&
+			    cmpsaddr(sel->local, p->local) > CMPSADDR_WILDPORT_MATCH)
+				continue;
+
+			if (sel->remote != NULL &&
+			    cmpsaddr(sel->remote, p->remote) > CMPSADDR_WILDPORT_MATCH)
+				continue;
+		}
+
+		if ((ret = enum_func(p, enum_arg)) != 0)
+			return ret;
+	}
+
+	return 0;
+}
+
 struct ph1handle *
 getph1byindex(index)
 	isakmp_index *index;
@@ -107,7 +142,7 @@
 	struct ph1handle *p;
 
 	LIST_FOREACH(p, &ph1tree, chain) {
-		if (p->status == PHASE1ST_EXPIRED)
+		if (p->status >= PHASE1ST_EXPIRED)
 			continue;
 		if (memcmp(&p->index, index, sizeof(*index)) == 0)
 			return p;
@@ -127,7 +162,7 @@
 	struct ph1handle *p;
 
 	LIST_FOREACH(p, &ph1tree, chain) {
-		if (p->status == PHASE1ST_EXPIRED)
+		if (p->status >= PHASE1ST_EXPIRED)
 			continue;
 		if (memcmp(&p->index, index, sizeof(cookie_t)) == 0)
 			return p;
@@ -142,31 +177,57 @@
  * with phase 2's destinaion.
  */
 struct ph1handle *
-getph1byaddr(local, remote, established)
+getph1(ph1hint, local, remote, flags)
+	struct ph1handle *ph1hint;
 	struct sockaddr *local, *remote;
-	int established;
+	int flags;
 {
 	struct ph1handle *p;
 
-	plog(LLV_DEBUG2, LOCATION, NULL, "getph1byaddr: start\n");
+	plog(LLV_DEBUG2, LOCATION, NULL, "getph1: start\n");
 	plog(LLV_DEBUG2, LOCATION, NULL, "local: %s\n", saddr2str(local));
 	plog(LLV_DEBUG2, LOCATION, NULL, "remote: %s\n", saddr2str(remote));
 
 	LIST_FOREACH(p, &ph1tree, chain) {
-		if (p->status == PHASE1ST_EXPIRED)
+		if (p->status >= PHASE1ST_DYING)
 			continue;
+
 		plog(LLV_DEBUG2, LOCATION, NULL, "p->local: %s\n", saddr2str(p->local));
 		plog(LLV_DEBUG2, LOCATION, NULL, "p->remote: %s\n", saddr2str(p->remote));
 
-		if(established && p->status != PHASE1ST_ESTABLISHED){
-			plog(LLV_DEBUG2, LOCATION, NULL, "status %d, skipping\n", p->status);
+		if ((flags & GETPH1_F_ESTABLISHED) &&
+		    (p->status != PHASE1ST_ESTABLISHED)) {
+			plog(LLV_DEBUG2, LOCATION, NULL,
+			     "status %d, skipping\n", p->status);
 			continue;
 		}
-		if (CMPSADDR(local, p->local) == 0
-			&& CMPSADDR(remote, p->remote) == 0){
-			plog(LLV_DEBUG2, LOCATION, NULL, "matched\n");
-			return p;
+
+		if (local != NULL && cmpsaddr(local, p->local) == CMPSADDR_MISMATCH)
+			continue;
+
+		if (remote != NULL && cmpsaddr(remote, p->remote) == CMPSADDR_MISMATCH)
+			continue;
+
+		if (ph1hint != NULL) {
+			if (ph1hint->id && ph1hint->id->l && p->id && p->id->l &&
+			    (ph1hint->id->l != p->id->l ||
+			     memcmp(ph1hint->id->v, p->id->v, p->id->l) != 0)) {
+				plog(LLV_DEBUG2, LOCATION, NULL,
+				     "local identity does match hint\n");
+				continue;
+			}
+			if (ph1hint->id_p && ph1hint->id_p->l &&
+			    p->id_p && p->id_p->l &&
+			    (ph1hint->id_p->l != p->id_p->l ||
+			     memcmp(ph1hint->id_p->v, p->id_p->v, p->id_p->l) != 0)) {
+				plog(LLV_DEBUG2, LOCATION, NULL,
+				     "remote identity does match hint\n");
+				continue;
+			}
 		}
+
+		plog(LLV_DEBUG2, LOCATION, NULL, "matched\n");
+		return p;
 	}
 
 	plog(LLV_DEBUG2, LOCATION, NULL, "no match\n");
@@ -174,44 +235,78 @@
 	return NULL;
 }
 
-struct ph1handle *
-getph1byaddrwop(local, remote)
-	struct sockaddr *local, *remote;
+int
+resolveph1rmconf(iph1)
+	struct ph1handle *iph1;
 {
-	struct ph1handle *p;
+	struct remoteconf *rmconf;
 
-	LIST_FOREACH(p, &ph1tree, chain) {
-		if (p->status == PHASE1ST_EXPIRED)
-			continue;
-		if (cmpsaddrwop(local, p->local) == 0
-		 && cmpsaddrwop(remote, p->remote) == 0)
-			return p;
+	/* INITIATOR is always expected to know the exact rmconf. */
+	if (iph1->side == INITIATOR)
+		return 0;
+
+	rmconf = getrmconf_by_ph1(iph1);
+	if (rmconf == NULL)
+		return -1;
+	if (rmconf == RMCONF_ERR_MULTIPLE)
+		return 1;
+
+	if (iph1->rmconf != NULL) {
+		if (rmconf != iph1->rmconf) {
+			plog(LLV_ERROR, LOCATION, NULL,
+			     "unexpected rmconf switch; killing ph1\n");
+			return -1;
+		}
+	} else {
+		iph1->rmconf = rmconf;
 	}
 
-	return NULL;
+	return 0;
+}
+
+
+/*
+ * move phase2s from old_iph1 to new_iph1
+ */
+void
+migrate_ph12(old_iph1, new_iph1)
+	struct ph1handle *old_iph1, *new_iph1;
+{
+	struct ph2handle *p, *next;
+
+	/* Relocate phase2s to better phase1s or request a new phase1. */
+	for (p = LIST_FIRST(&old_iph1->ph2tree); p; p = next) {
+		next = LIST_NEXT(p, ph1bind);
+
+		if (p->status != PHASE2ST_ESTABLISHED)
+			continue;
+
+		unbindph12(p);
+		bindph12(new_iph1, p);
+	}
 }
 
 /*
- * search for isakmpsa handler by remote address.
- * don't use port number to search because this function search
- * with phase 2's destinaion.
+ * the iph1 is new, migrate all phase2s that belong to a dying or dead ph1
  */
-struct ph1handle *
-getph1bydstaddrwop(remote)
-	struct sockaddr *remote;
+void migrate_dying_ph12(iph1)
+	struct ph1handle *iph1;
 {
 	struct ph1handle *p;
 
 	LIST_FOREACH(p, &ph1tree, chain) {
-		if (p->status == PHASE1ST_EXPIRED)
+		if (p == iph1)
 			continue;
-		if (cmpsaddrwop(remote, p->remote) == 0)
-			return p;
-	}
+		if (p->status < PHASE1ST_DYING)
+			continue;
 
-	return NULL;
+		if (cmpsaddr(iph1->local, p->local) == CMPSADDR_MATCH
+		 && cmpsaddr(iph1->remote, p->remote) == CMPSADDR_MATCH)
+			migrate_ph12(p, iph1);
+	}
 }
 
+
 /*
  * dump isakmp-sa
  */
@@ -268,11 +363,10 @@
 
 #ifdef ENABLE_DPD
 	iph1->dpd_support = 0;
-	iph1->dpd_lastack = 0;
 	iph1->dpd_seq = 0;
 	iph1->dpd_fails = 0;
-	iph1->dpd_r_u = NULL;
 #endif
+	evt_list_init(&iph1->evt_listeners);
 
 	return iph1;
 }
@@ -289,8 +383,7 @@
 
 	/* SA down shell script hook */
 	script_hook(iph1, SCRIPT_PHASE1_DOWN);
-
-	EVT_PUSH(iph1->local, iph1->remote, EVTT_PHASE1_DOWN, NULL);
+	evt_list_cleanup(&iph1->evt_listeners);
 
 #ifdef ENABLE_NATT
 	if (iph1->natt_flags & NAT_KA_QUEUED)
@@ -308,8 +401,10 @@
 #endif
 
 #ifdef ENABLE_DPD
-	SCHED_KILL(iph1->dpd_r_u);
+	sched_cancel(&iph1->dpd_r_u);
 #endif
+	sched_cancel(&iph1->sce);
+	sched_cancel(&iph1->scr);
 
 	if (iph1->remote) {
 		racoon_free(iph1->remote);
@@ -325,13 +420,7 @@
 	}
 
 	VPTRINIT(iph1->authstr);
-
-	sched_scrub_param(iph1);
-	iph1->sce = NULL;
-	iph1->scr = NULL;
-
 	VPTRINIT(iph1->sendbuf);
-
 	VPTRINIT(iph1->dhpriv);
 	VPTRINIT(iph1->dhpub);
 	VPTRINIT(iph1->dhpub_p);
@@ -346,14 +435,10 @@
 	VPTRINIT(iph1->hash);
 	VPTRINIT(iph1->sig);
 	VPTRINIT(iph1->sig_p);
-	oakley_delcert(iph1->cert);
-	iph1->cert = NULL;
-	oakley_delcert(iph1->cert_p);
-	iph1->cert_p = NULL;
-	oakley_delcert(iph1->crl_p);
-	iph1->crl_p = NULL;
-	oakley_delcert(iph1->cr_p);
-	iph1->cr_p = NULL;
+	VPTRINIT(iph1->cert);
+	VPTRINIT(iph1->cert_p);
+	VPTRINIT(iph1->crl_p);
+	VPTRINIT(iph1->cr_p);
 	VPTRINIT(iph1->id);
 	VPTRINIT(iph1->id_p);
 
@@ -415,7 +500,7 @@
 		next = LIST_NEXT(p, chain);
 
 		/* send delete information */
-		if (p->status == PHASE1ST_ESTABLISHED) 
+		if (p->status >= PHASE1ST_ESTABLISHED)
 			isakmp_info_send_d1(p);
 
 		remph1(p);
@@ -429,26 +514,52 @@
 	LIST_INIT(&ph1tree);
 }
 
+int
+ph1_rekey_enabled(iph1)
+	struct ph1handle *iph1;
+{
+	if (iph1->rmconf == NULL)
+		return 0;
+	if (iph1->rmconf->rekey == REKEY_FORCE)
+		return 1;
+#ifdef ENABLE_DPD
+	if (iph1->rmconf->rekey == REKEY_ON && iph1->dpd_support &&
+	    iph1->rmconf->dpd_interval)
+		return 1;
+#endif
+	return 0;
+}
+
 /* %%% management phase 2 handler */
-/*
- * search ph2handle with policy id.
- */
-struct ph2handle *
-getph2byspid(spid)
-      u_int32_t spid;
+
+int
+enumph2(sel, enum_func, enum_arg)
+	struct ph2selector *sel;
+	int (*enum_func)(struct ph2handle *ph2, void *arg);
+	void *enum_arg;
 {
 	struct ph2handle *p;
+	int ret;
 
 	LIST_FOREACH(p, &ph2tree, chain) {
-		/*
-		 * there are ph2handle independent on policy
-		 * such like informational exchange.
-		 */
-		if (p->spid == spid)
-			return p;
+		if (sel != NULL) {
+			if (sel->spid != 0 && sel->spid != p->spid)
+				continue;
+
+			if (sel->src != NULL &&
+			    cmpsaddr(sel->src, p->src) != CMPSADDR_MATCH)
+				continue;
+
+			if (sel->dst != NULL &&
+			    cmpsaddr(sel->dst, p->dst) != CMPSADDR_MATCH)
+				continue;
+		}
+
+		if ((ret = enum_func(p, enum_arg)) != 0)
+			return ret;
 	}
 
-	return NULL;
+	return 0;
 }
 
 /*
@@ -478,7 +589,7 @@
 {
 	struct ph2handle *p;
 
-	LIST_FOREACH(p, &ph2tree, chain) {
+	LIST_FOREACH(p, &iph1->ph2tree, ph1bind) {
 		if (p->msgid == msgid && p->ph1 == iph1)
 			return p;
 	}
@@ -486,6 +597,15 @@
 	return NULL;
 }
 
+/* Note that src and dst are not the selectors of the SP
+ * but the source and destination addresses used for
+ * for SA negotiation (best example is tunnel mode SA
+ * where src and dst are the endpoints). There is at most
+ * a unique match because racoon does not support bundles
+ * which makes that there is at most a single established
+ * SA for a given spid. One could say that src and dst
+ * are in fact useless ...
+ */
 struct ph2handle *
 getph2byid(src, dst, spid)
 	struct sockaddr *src, *dst;
@@ -495,8 +615,8 @@
 
 	LIST_FOREACH(p, &ph2tree, chain) {
 		if (spid == p->spid &&
-		    CMPSADDR(src, p->src) == 0 &&
-		    CMPSADDR(dst, p->dst) == 0){
+		    cmpsaddr(src, p->src) <= CMPSADDR_WILDPORT_MATCH &&
+		    cmpsaddr(dst, p->dst) <= CMPSADDR_WILDPORT_MATCH){
 			/* Sanity check to detect zombie handlers
 			 * XXX Sould be done "somewhere" more interesting,
 			 * because we have lots of getph2byxxxx(), but this one
@@ -504,7 +624,7 @@
 			 */
 			if(p->status < PHASE2ST_ESTABLISHED &&
 			   p->retry_counter == 0
-			   && p->sce == NULL && p->scr == NULL){
+			   && p->sce.func == NULL && p->scr.func == NULL) {
 				plog(LLV_DEBUG, LOCATION, NULL,
 					 "Zombie ph2 found, expiring it\n");
 				isakmp_ph2expire(p);
@@ -523,8 +643,8 @@
 	struct ph2handle *p;
 
 	LIST_FOREACH(p, &ph2tree, chain) {
-		if (cmpsaddrstrict(src, p->src) == 0 &&
-		    cmpsaddrstrict(dst, p->dst) == 0)
+		if (cmpsaddr(src, p->src) <= CMPSADDR_WILDPORT_MATCH &&
+		    cmpsaddr(dst, p->dst) <= CMPSADDR_WILDPORT_MATCH)
 			return p;
 	}
 
@@ -582,6 +702,7 @@
 		return NULL;
 
 	iph2->status = PHASE1ST_SPAWN;
+	evt_list_init(&iph2->evt_listeners);
 
 	return iph2;
 }
@@ -595,9 +716,11 @@
 initph2(iph2)
 	struct ph2handle *iph2;
 {
-	sched_scrub_param(iph2);
-	iph2->sce = NULL;
-	iph2->scr = NULL;
+	evt_list_cleanup(&iph2->evt_listeners);
+	unbindph12(iph2);
+
+	sched_cancel(&iph2->sce);
+	sched_cancel(&iph2->scr);
 
 	VPTRINIT(iph2->sendbuf);
 	VPTRINIT(iph2->msg1);
@@ -642,6 +765,17 @@
 		oakley_delivm(iph2->ivm);
 		iph2->ivm = NULL;
 	}
+
+#ifdef ENABLE_NATT
+	if (iph2->natoa_src) {
+		racoon_free(iph2->natoa_src);
+		iph2->natoa_src = NULL;
+	}
+	if (iph2->natoa_dst) {
+		racoon_free(iph2->natoa_dst);
+		iph2->natoa_dst = NULL;
+	}
+#endif
 }
 
 /*
@@ -661,14 +795,24 @@
 		racoon_free(iph2->dst);
 		iph2->dst = NULL;
 	}
-	if (iph2->src_id) {
-	      racoon_free(iph2->src_id);
-	      iph2->src_id = NULL;
+	if (iph2->sa_src) {
+		racoon_free(iph2->sa_src);
+		iph2->sa_src = NULL;
 	}
-	if (iph2->dst_id) {
-	      racoon_free(iph2->dst_id);
-	      iph2->dst_id = NULL;
+	if (iph2->sa_dst) {
+		racoon_free(iph2->sa_dst);
+		iph2->sa_dst = NULL;
 	}
+#ifdef ENABLE_NATT
+	if (iph2->natoa_src) {
+		racoon_free(iph2->natoa_src);
+		iph2->natoa_src = NULL;
+	}
+	if (iph2->natoa_dst) {
+		racoon_free(iph2->natoa_dst);
+		iph2->natoa_dst = NULL;
+	}
+#endif
 
 	if (iph2->proposal) {
 		flushsaprop(iph2->proposal);
@@ -694,6 +838,7 @@
 remph2(iph2)
 	struct ph2handle *iph2;
 {
+	unbindph12(iph2);
 	LIST_REMOVE(iph2, chain);
 }
 
@@ -725,7 +870,6 @@
 		}
 
 		delete_spd(p, 0);
-		unbindph12(p);
 		remph2(p);
 		delph2(p);
 	}
@@ -763,7 +907,6 @@
 		}
 		continue;
  zap_it:
-		unbindph12(iph2);
 		remph2(iph2);
 		delph2(iph2);
 	}
@@ -775,7 +918,10 @@
 	struct ph1handle *iph1;
 	struct ph2handle *iph2;
 {
+	unbindph12(iph2);
+
 	iph2->ph1 = iph1;
+	iph1->ph2cnt++;
 	LIST_INSERT_HEAD(&iph1->ph2tree, iph2, ph1bind);
 }
 
@@ -784,8 +930,9 @@
 	struct ph2handle *iph2;
 {
 	if (iph2->ph1 != NULL) {
-		iph2->ph1 = NULL;
 		LIST_REMOVE(iph2, ph1bind);
+		iph2->ph1->ph2cnt--;
+		iph2->ph1 = NULL;
 	}
 }
 
@@ -800,7 +947,7 @@
 	struct contacted *p;
 
 	LIST_FOREACH(p, &ctdtree, chain) {
-		if (cmpsaddrstrict(remote, p->remote) == 0)
+		if (cmpsaddr(remote, p->remote) <= CMPSADDR_WILDPORT_MATCH)
 			return p;
 	}
 
@@ -835,6 +982,22 @@
 }
 
 void
+remcontacted(remote)
+	struct sockaddr *remote;
+{
+	struct contacted *p;
+
+	LIST_FOREACH(p, &ctdtree, chain) {
+		if (cmpsaddr(remote, p->remote) <= CMPSADDR_WILDPORT_MATCH) {
+			LIST_REMOVE(p, chain);
+			racoon_free(p->remote);
+			racoon_free(p);
+			break;
+		}
+	}	
+}
+
+void
 initctdtree()
 {
 	LIST_INIT(&ctdtree);
@@ -856,12 +1019,9 @@
 {
 	vchar_t *hash;
 	struct recvdpkt *r;
-	time_t t;
+	struct timeval now, diff;
 	int len, s;
 
-	/* set current time */
-	t = time(NULL);
-
 	hash = eay_md5_one(rbuf);
 	if (!hash) {
 		plog(LLV_ERROR, LOCATION, NULL,
@@ -882,7 +1042,7 @@
 	/*
 	 * the packet was processed before, but the remote address mismatches.
 	 */
-	if (cmpsaddrstrict(remote, r->remote) != 0)
+	if (cmpsaddr(remote, r->remote) != CMPSADDR_MATCH)
 		return 2;
 
 	/*
@@ -891,7 +1051,9 @@
 	 */
 
 	/* check the previous time to send */
-	if (t - r->time_send < 1) {
+	sched_get_monotonic_time(&now);
+	timersub(&now, &r->time_send, &diff);
+	if (diff.tv_sec == 0) {
 		plog(LLV_WARNING, LOCATION, NULL,
 			"the packet retransmitted in a short time from %s\n",
 			saddr2str(remote));
@@ -899,7 +1061,7 @@
 	}
 
 	/* select the socket to be sent */
-	s = getsockmyaddr(r->local);
+	s = myaddr_getfd(r->local);
 	if (s == -1)
 		return -1;
 
@@ -920,7 +1082,7 @@
 			"deleted the retransmission packet to %s.\n",
 			saddr2str(remote));
 	} else
-		r->time_send = t;
+		r->time_send = now;
 
 	return 1;
 }
@@ -977,8 +1139,7 @@
 	}
 
 	new->retry_counter = lcconf->retry_counter;
-	new->time_send = 0;
-	new->created = time(NULL);
+	sched_get_monotonic_time(&new->time_send);
 
 	LIST_INSERT_HEAD(&rcptree, new, chain);
 
@@ -1007,29 +1168,30 @@
 	LIST_REMOVE(r, chain);
 }
 
-void
+static void
 sweep_recvdpkt(dummy)
-	void *dummy;
+	struct sched *dummy;
 {
 	struct recvdpkt *r, *next;
-	time_t t, lt;
+	struct timeval now, diff, sweep;
 
-	/* set current time */
-	t = time(NULL);
+	sched_get_monotonic_time(&now);
 
-	/* set the lifetime of the retransmission */
-	lt = lcconf->retry_counter * lcconf->retry_interval;
+	/* calculate sweep time; delete entries older than this */
+	diff.tv_sec = lcconf->retry_counter * lcconf->retry_interval;
+	diff.tv_usec = 0;
+	timersub(&now, &diff, &sweep);
 
 	for (r = LIST_FIRST(&rcptree); r; r = next) {
 		next = LIST_NEXT(r, chain);
 
-		if (t - r->created > lt) {
+		if (timercmp(&r->time_send, &sweep, <)) {
 			rem_recvdpkt(r);
 			del_recvdpkt(r);
 		}
 	}
 
-	sched_new(lt, sweep_recvdpkt, NULL);
+	sched_schedule(&sc_sweep, diff.tv_sec, sweep_recvdpkt);
 }
 
 void
@@ -1039,11 +1201,11 @@
 
 	LIST_INIT(&rcptree);
 
-	sched_new(lt, sweep_recvdpkt, NULL);
+	sched_schedule(&sc_sweep, lt, sweep_recvdpkt);
 }
 
 #ifdef ENABLE_HYBRID
-/* 
+/*
  * Retruns 0 if the address was obtained by ISAKMP mode config, 1 otherwise
  * This should be in isakmp_cfg.c but ph1tree being private, it must be there
  */
@@ -1070,7 +1232,7 @@
 
 
 
-/* 
+/*
  * Reload conf code
  */
 static int revalidate_ph2(struct ph2handle *iph2){
@@ -1080,19 +1242,19 @@
 	struct saprop *approval;
 	struct ph1handle *iph1;
 
-	/* 
+	/*
 	 * Get the new sainfo using values of the old one
 	 */
 	if (iph2->sainfo != NULL) {
-		iph2->sainfo = getsainfo(iph2->sainfo->idsrc, 
+		iph2->sainfo = getsainfo(iph2->sainfo->idsrc,
 					  iph2->sainfo->iddst, iph2->sainfo->id_i,
-					  iph2->sainfo->remoteid);
+					  NULL, iph2->sainfo->remoteid);
 	}
 	approval = iph2->approval;
 	sainfo = iph2->sainfo;
 
 	if (sainfo == NULL) {
-		/* 
+		/*
 		 * Sainfo has been removed
 		 */
 		plog(LLV_DEBUG, LOCATION, NULL,
@@ -1107,7 +1269,7 @@
 		plog(LLV_DEBUG, LOCATION, NULL,
 			 "No approval found !\n");
 		return 0;
-	}	
+	}
 
 	/*
 	 * Don't care about proposals, should we do something ?
@@ -1206,7 +1368,7 @@
 	}
 
 	found = 0;
-	for (alg = sainfo->algs[algclass_ipsec_enc]; 
+	for (alg = sainfo->algs[algclass_ipsec_enc];
 	    (found == 0 && alg != NULL); alg = alg->next) {
 		plog(LLV_DEBUG, LOCATION, NULL,
 			 "Reload: next ph2 enc alg...\n");
@@ -1239,7 +1401,7 @@
 			break;
 
 		default:
-			plog(LLV_ERROR, LOCATION, NULL, 
+			plog(LLV_ERROR, LOCATION, NULL,
 			    "unexpected check_level\n");
 			continue;
 			break;
@@ -1263,7 +1425,7 @@
 }
 
 
-static void 
+static void
 remove_ph2(struct ph2handle *iph2)
 {
 	u_int32_t spis[2];
@@ -1289,7 +1451,6 @@
 		purge_ipsec_spi(iph2->dst, iph2->approval->head->proto_id,
 						spis, 2);
 	}else{
-		unbindph12(iph2);
 		remph2(iph2);
 		delph2(iph2);
 	}
@@ -1304,197 +1465,41 @@
 	plog(LLV_DEBUG, LOCATION, NULL,
 		 "Removing PH1...\n");
 
-	if (iph1->status == PHASE1ST_ESTABLISHED){
+	if (iph1->status == PHASE1ST_ESTABLISHED ||
+	    iph1->status == PHASE1ST_DYING) {
 		for (iph2 = LIST_FIRST(&iph1->ph2tree); iph2; iph2 = iph2_next) {
-			iph2_next = LIST_NEXT(iph2, chain);
+			iph2_next = LIST_NEXT(iph2, ph1bind);
 			remove_ph2(iph2);
 		}
 		isakmp_info_send_d1(iph1);
 	}
 	iph1->status = PHASE1ST_EXPIRED;
-	iph1->sce = sched_new(1, isakmp_ph1delete_stub, iph1);
+	/* directly call isakmp_ph1delete to avoid as possible a race
+	 * condition where we'll try to access iph1->rmconf after it has
+	 * freed
+	 */
+	isakmp_ph1delete(iph1);
 }
 
 
-static int revalidate_ph1tree_rmconf(void){
+static int revalidate_ph1tree_rmconf(void)
+{
 	struct ph1handle *p, *next;
-	struct remoteconf *newrmconf;
+	struct remoteconf *rmconf;
 
 	for (p = LIST_FIRST(&ph1tree); p; p = next) {
 		next = LIST_NEXT(p, chain);
 
-		if (p->status == PHASE1ST_EXPIRED)
+		if (p->status >= PHASE1ST_EXPIRED)
+			continue;
+		if (p->rmconf == NULL)
 			continue;
 
-		newrmconf=getrmconf(p->remote);
-		if(newrmconf == NULL){
-			p->rmconf = NULL;
+		rmconf = getrmconf_by_ph1(p);
+		if (rmconf == NULL || rmconf == RMCONF_ERR_MULTIPLE)
 			remove_ph1(p);
-		}else{
-			/* Do not free old rmconf, it is just a pointer to an entry in rmtree
-			 */
-			p->rmconf=newrmconf;
-			if(p->approval != NULL){
-				struct isakmpsa *tmpsa;
-
-				tmpsa=dupisakmpsa(p->approval);
-				if(tmpsa != NULL){
-					delisakmpsa(p->approval);
-					p->approval=tmpsa;
-					p->approval->rmconf=newrmconf;
-				}
-			}
-		}
-	}
-
-	return 1;
-}
-
-
-/* rmconf is already updated here
- */
-static int revalidate_ph1(struct ph1handle *iph1){
-	struct isakmpsa *p, *approval;
-	struct etypes *e;
-
-	if(iph1 == NULL ||
-	   iph1->approval == NULL ||
-		iph1->rmconf == NULL)
-		return 0;
-
-	approval=iph1->approval;
-
-	for (e = iph1->rmconf->etypes; e != NULL; e = e->next){
-		if (iph1->etype == e->type)
-			break;
-	}
-
-	if (e == NULL){
-		plog(LLV_DEBUG, LOCATION, NULL,
-			 "Reload: Exchange type mismatch\n");
-		return 0;
-	}
-
-	if (iph1->etype == ISAKMP_ETYPE_AGG &&
-	   approval->dh_group != iph1->rmconf->dh_group){
-		plog(LLV_DEBUG, LOCATION, NULL,
-			 "Reload: DH mismatch\n");
-		return 0;
-	}
-
-	for (p=iph1->rmconf->proposal; p != NULL; p=p->next){
-		plog(LLV_DEBUG, LOCATION, NULL,
-			 "Reload: Trying next proposal...\n");
-
-		if(approval->authmethod != p->authmethod){
-			plog(LLV_DEBUG, LOCATION, NULL,
-				 "Reload: Authmethod mismatch\n");
-			continue;
-		}
-
-		if(approval->enctype != p->enctype){
-			plog(LLV_DEBUG, LOCATION, NULL,
-				 "Reload: enctype mismatch\n");
-			continue;
-		}
-
-		switch (iph1->rmconf->pcheck_level) {
-		case PROP_CHECK_OBEY:
-			plog(LLV_DEBUG, LOCATION, NULL,
-				 "Reload: OBEY pcheck level, ok...\n");
-			return 1;
-			break;
-
-		case PROP_CHECK_CLAIM:
-			/* FALLTHROUGH */
-		case PROP_CHECK_STRICT:
-			if (approval->encklen < p->encklen) {
-				plog(LLV_DEBUG, LOCATION, NULL,
-					 "Reload: encklen mismatch\n");
-				continue;
-			}
-
-			if (approval->lifetime > p->lifetime) {
-				plog(LLV_DEBUG, LOCATION, NULL,
-					 "Reload: lifetime mismatch\n");
-				continue;
-			}
-
-#if 0
-			/* Lifebyte is deprecated, just ignore it
-			 */
-			if (approval->lifebyte > p->lifebyte) {
-				plog(LLV_DEBUG, LOCATION, NULL,
-					 "Reload: lifebyte mismatch\n");
-				continue;
-			}
-#endif
-			break;
-
-		case PROP_CHECK_EXACT:
-			if (approval->encklen != p->encklen) {
-				plog(LLV_DEBUG, LOCATION, NULL,
-					 "Reload: encklen mismatch\n");
-				continue;
-			}
-
-			if (approval->lifetime != p->lifetime) {
-				plog(LLV_DEBUG, LOCATION, NULL,
-					 "Reload: lifetime mismatch\n");
-				continue;
-			}
-
-#if 0
-			/* Lifebyte is deprecated, just ignore it
-			 */
-			if (approval->lifebyte != p->lifebyte) {
-				plog(LLV_DEBUG, LOCATION, NULL,
-					 "Reload: lifebyte mismatch\n");
-				continue;
-			}
-#endif
-			break;
-
-		default:
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "unexpected check_level\n");
-			continue;
-			break;
-		}
-
-		if (approval->hashtype != p->hashtype) {
-			plog(LLV_DEBUG, LOCATION, NULL,
-				 "Reload: hashtype mismatch\n");
-			continue;
-		}
-
-		if (iph1->etype != ISAKMP_ETYPE_AGG &&
-		    approval->dh_group != p->dh_group) {
-			plog(LLV_DEBUG, LOCATION, NULL,
-				 "Reload: dhgroup mismatch\n");
-			continue;
-		}
-
-		plog(LLV_DEBUG, LOCATION, NULL, "Reload: Conf ok\n");
-		return 1;
-	}
-
-	plog(LLV_DEBUG, LOCATION, NULL, "Reload: No valid conf found\n");
-	return 0;
-}
-
-
-static int revalidate_ph1tree(void){
-	struct ph1handle *p, *next;
-
-	for (p = LIST_FIRST(&ph1tree); p; p = next) {
-		next = LIST_NEXT(p, chain);
-
-		if (p->status == PHASE1ST_EXPIRED)
-			continue;
-
-		if(!revalidate_ph1(p))
-			remove_ph1(p);
+		else
+			p->rmconf = rmconf;
 	}
 
 	return 1;
@@ -1519,14 +1524,12 @@
 	return 1;
 }
 
-int 
+int
 revalidate_ph12(void)
 {
 
 	revalidate_ph1tree_rmconf();
-
 	revalidate_ph2tree();
-	revalidate_ph1tree();
 
 	return 1;
 }
@@ -1559,7 +1562,10 @@
 		if (p->mode_cfg == NULL)
 			continue;
 		if (strncmp(p->mode_cfg->login, login, LOGINLEN) == 0) {
-			if (p->status == PHASE1ST_ESTABLISHED)
+			if (p->status >= PHASE1ST_EXPIRED)
+				continue;
+
+			if (p->status >= PHASE1ST_ESTABLISHED)
 				isakmp_info_send_d1(p);
 			purge_remote(p);
 			found++;
diff --git a/src/racoon/handler.h b/src/racoon/handler.h
index a52dc6c..45d596e 100644
--- a/src/racoon/handler.h
+++ b/src/racoon/handler.h
@@ -1,11 +1,11 @@
-/*	$NetBSD: handler.h,v 1.9.6.1 2008/01/11 14:12:01 vanhu Exp $	*/
+/*	$NetBSD: handler.h,v 1.25 2010/11/17 10:40:41 tteras Exp $	*/
 
 /* Id: handler.h,v 1.19 2006/02/25 08:25:12 manubsd Exp */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -17,7 +17,7 @@
  * 3. Neither the name of the project nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -41,6 +41,8 @@
 
 #include "isakmp_var.h"
 #include "oakley.h"
+#include "schedule.h"
+#include "evt.h"
 
 /* Phase 1 handler */
 /*
@@ -93,8 +95,9 @@
 #define PHASE1ST_MSG3SENT		7
 #define PHASE1ST_MSG4RECEIVED		8
 #define PHASE1ST_ESTABLISHED		9
-#define PHASE1ST_EXPIRED		10
-#define PHASE1ST_MAX			11
+#define PHASE1ST_DYING			10
+#define PHASE1ST_EXPIRED		11
+#define PHASE1ST_MAX			12
 
 /* About address semantics in each case.
  *			initiator(addr=I)	responder(addr=R)
@@ -131,6 +134,7 @@
 	u_int8_t flags;			/* Flags */
 	u_int32_t msgid;		/* message id */
 
+	u_int32_t vendorid_mask;	/* bitmask of received supported vendor ids*/
 #ifdef ENABLE_NATT
 	struct ph1natt_options *natt_options;	/* Selected NAT-T IKE version */
 	u_int32_t natt_flags;		/* NAT-T related flags */
@@ -140,9 +144,9 @@
 	struct isakmp_frag_item *frag_chain;	/* Received fragments */
 #endif
 
-	struct sched *sce;		/* schedule for expire */
+	struct sched sce;		/* schedule for expire */
 
-	struct sched *scr;		/* schedule for resend */
+	struct sched scr;		/* schedule for resend */
 	int retry_counter;		/* for resend. */
 	vchar_t *sendbuf;		/* buffer for re-sending */
 
@@ -160,10 +164,10 @@
 	vchar_t *hash;			/* HASH minus general header */
 	vchar_t *sig;			/* SIG minus general header */
 	vchar_t *sig_p;			/* peer's SIG minus general header */
-	cert_t *cert;			/* CERT minus general header */
-	cert_t *cert_p;			/* peer's CERT minus general header */
-	cert_t *crl_p;			/* peer's CRL minus general header */
-	cert_t *cr_p;			/* peer's CR not including general */
+	vchar_t *cert;			/* CERT minus general header */
+	vchar_t *cert_p;		/* peer's CERT minus general header */
+	vchar_t *crl_p;			/* peer's CRL minus general header */
+	vchar_t *cr_p;			/* peer's CR not including general */
 	RSA *rsa;			/* my RSA key */
 	RSA *rsa_p;			/* peer's RSA key */
 	struct genlist *rsa_candidates;	/* possible candidates for peer's RSA key */
@@ -190,6 +194,7 @@
 	struct isakmp_pl_hash *pl_hash;	/* pointer to hash payload */
 
 	time_t created;			/* timestamp for establish */
+	int initial_contact_received;	/* set if initial contact received */
 #ifdef ENABLE_STATS
 	struct timeval start;
 	struct timeval end;
@@ -197,10 +202,10 @@
 
 #ifdef ENABLE_DPD
 	int		dpd_support;	/* Does remote supports DPD ? */
-	time_t		dpd_lastack;	/* Last ack received */
-	u_int16_t	dpd_seq;		/* DPD seq number to receive */
+	u_int32_t	dpd_last_ack;
+	u_int32_t	dpd_seq;		/* DPD seq number to receive */
 	u_int8_t	dpd_fails;		/* number of failures */
-	struct sched	*dpd_r_u;
+	struct sched	dpd_r_u;
 #endif
 
 	u_int32_t msgid2;		/* msgid counter for Phase 2 */
@@ -210,8 +215,14 @@
 	LIST_ENTRY(ph1handle) chain;
 #ifdef ENABLE_HYBRID
 	struct isakmp_cfg_state *mode_cfg;	/* ISAKMP mode config state */
-#endif       
+#endif
+	EVT_LISTENER_LIST(evt_listeners);
+};
 
+/* For limiting enumeration of ph1 tree */
+struct ph1selector {
+	struct sockaddr *local;
+	struct sockaddr *remote;
 };
 
 /* Phase 2 handler */
@@ -244,23 +255,44 @@
 #define PHASE2ST_MAX		11
 
 struct ph2handle {
-	struct sockaddr *src;		/* my address of SA. */
-	struct sockaddr *dst;		/* peer's address of SA. */
+	/* source and destination addresses used for IKE exchange. Might
+	 * differ from source and destination of SA. On the initiator,
+	 * they are tweaked if a hint is available in the SPD (set by
+	 * MIGRATE for instance). Otherwise they are the source and
+	 * destination of SA for transport mode and the tunnel endpoints
+	 * for tunnel mode */
+	struct sockaddr *src;
+	struct sockaddr *dst;
 
-		/*
-		 * copy ip address from ID payloads when ID type is ip address.
-		 * In other case, they must be null.
-		 */
-	struct sockaddr *src_id;
-	struct sockaddr *dst_id;
+	/* source and destination addresses of the SA in the case addresses
+	 * used for IKE exchanges (src and dst) do differ. On the initiator,
+	 * they are set (if needed) in pk_recvacquire(). On the responder,
+	 * they are _derived_ from the local and remote parameters of the
+	 * SP, if available. */
+	struct sockaddr *sa_src;
+	struct sockaddr *sa_dst;
+
+	/* Store our Phase 2 ID and the peer ID (ID minus general header).
+	 * On the initiator, they are set during ACQUIRE processing.
+	 * On the responder, they are set from the content of ID payload
+	 * in quick_r1recv(). Then, if they are of type address or
+	 * tunnel, they are compared to sainfo selectors.
+	 */
+	vchar_t *id;			/* ID minus gen header */
+	vchar_t *id_p;			/* peer's ID minus general header */
+
+#ifdef ENABLE_NATT
+	struct sockaddr *natoa_src;	/* peer's view of my address */
+	struct sockaddr *natoa_dst;	/* peer's view of his address */
+#endif
 
 	u_int32_t spid;			/* policy id by kernel */
 
 	int status;			/* ipsec sa status */
 	u_int8_t side;			/* INITIATOR or RESPONDER */
 
-	struct sched *sce;		/* schedule for expire */
-	struct sched *scr;		/* schedule for resend */
+	struct sched sce;		/* schedule for expire */
+	struct sched scr;		/* schedule for resend */
 	int retry_counter;		/* for resend. */
 	vchar_t *sendbuf;		/* buffer for re-sending */
 	vchar_t *msg1;			/* buffer for re-sending */
@@ -288,6 +320,8 @@
 	struct sainfo *sainfo;		/* place holder of sainfo */
 	struct saprop *proposal;	/* SA(s) proposal. */
 	struct saprop *approval;	/* SA(s) approved. */
+	u_int32_t lifetime_secs;	/* responder lifetime (seconds) */
+	u_int32_t lifetime_kb;		/* responder lifetime (kbytes) */
 	caddr_t spidx_gen;		/* policy from peer's proposal */
 
 	struct dhgroup *pfsgrp;		/* DH; prime number */
@@ -295,8 +329,6 @@
 	vchar_t *dhpub;			/* DH; public value */
 	vchar_t *dhpub_p;		/* DH; partner's public value */
 	vchar_t *dhgxy;			/* DH; shared secret */
-	vchar_t *id;			/* ID minus gen header */
-	vchar_t *id_p;			/* peer's ID minus general header */
 	vchar_t *nonce;			/* nonce value in phase 2 */
 	vchar_t *nonce_p;		/* partner's nonce value in phase 2 */
 
@@ -320,6 +352,14 @@
 
 	LIST_ENTRY(ph2handle) chain;
 	LIST_ENTRY(ph2handle) ph1bind;	/* chain to ph1handle */
+	EVT_LISTENER_LIST(evt_listeners);
+};
+
+/* For limiting enumeration of ph2 tree */
+struct ph2selector {
+	u_int32_t spid;
+	struct sockaddr *src;
+	struct sockaddr *dst;
 };
 
 /*
@@ -339,10 +379,7 @@
 	vchar_t *hash;			/* hash of the received packet */
 	vchar_t *sendbuf;		/* buffer for the response */
 	int retry_counter;		/* how many times to send */
-	time_t time_send;		/* timestamp to send a packet */
-	time_t created;			/* timestamp to create a queue */
-
-	struct sched *scr;		/* schedule for resend, may not used */
+	struct timeval time_send;	/* timestamp of previous send */
 
 	LIST_ENTRY(recvdpkt) chain;
 };
@@ -413,7 +450,7 @@
 	struct sockaddr_storage remote;
 	struct sockaddr_storage local;
 	u_int8_t version;
-	u_int8_t etype;	
+	u_int8_t etype;
 	time_t created;
 	int ph2cnt;
 };
@@ -425,25 +462,42 @@
 
 extern struct ph1handle *getph1byindex __P((isakmp_index *));
 extern struct ph1handle *getph1byindex0 __P((isakmp_index *));
-extern struct ph1handle *getph1byaddr __P((struct sockaddr *,
-										   struct sockaddr *, int));
-extern struct ph1handle *getph1byaddrwop __P((struct sockaddr *,
-	struct sockaddr *));
-extern struct ph1handle *getph1bydstaddrwop __P((struct sockaddr *));
+
+extern int enumph1 __P((struct ph1selector *ph1sel,
+			int (* enum_func)(struct ph1handle *iph1, void *arg),
+			void *enum_arg));
+
+#define GETPH1_F_ESTABLISHED		0x0001
+
+extern struct ph1handle *getph1 __P((struct ph1handle *ph1hint,
+				     struct sockaddr *local,
+				     struct sockaddr *remote,
+				     int flags));
+
+#define getph1byaddr(local, remote, est) \
+	getph1(NULL, local, remote, est ? GETPH1_F_ESTABLISHED : 0)
+#define getph1bydstaddr(remote) \
+	getph1(NULL, NULL, remote, 0)
+
 #ifdef ENABLE_HYBRID
 struct ph1handle *getph1bylogin __P((char *));
 int purgeph1bylogin __P((char *));
 #endif
+extern void migrate_ph12 __P((struct ph1handle *old_iph1, struct ph1handle *new_iph1));
+extern void migrate_dying_ph12 __P((struct ph1handle *iph1));
 extern vchar_t *dumpph1 __P((void));
 extern struct ph1handle *newph1 __P((void));
 extern void delph1 __P((struct ph1handle *));
 extern int insph1 __P((struct ph1handle *));
 extern void remph1 __P((struct ph1handle *));
+extern int resolveph1rmconf __P((struct ph1handle *));
 extern void flushph1 __P((void));
 extern void initph1tree __P((void));
+extern int ph1_rekey_enabled __P((struct ph1handle *));
 
-extern struct ph2handle *getph2byspidx __P((struct policyindex *));
-extern struct ph2handle *getph2byspid __P((u_int32_t));
+extern int enumph2 __P((struct ph2selector *ph2sel,
+			int (* enum_func)(struct ph2handle *iph2, void *arg),
+			void *enum_arg));
 extern struct ph2handle *getph2byseq __P((u_int32_t));
 extern struct ph2handle *getph2bysaddr __P((struct sockaddr *,
 	struct sockaddr *));
@@ -466,6 +520,7 @@
 
 extern struct contacted *getcontacted __P((struct sockaddr *));
 extern int inscontacted __P((struct sockaddr *));
+extern void remcontacted __P((struct sockaddr *));
 extern void initctdtree __P((void));
 
 extern int check_recvdpkt __P((struct sockaddr *,
diff --git a/src/racoon/ipsec_doi-0.7.3.c b/src/racoon/ipsec_doi-0.7.3.c
new file mode 100644
index 0000000..7ae9f67
--- /dev/null
+++ b/src/racoon/ipsec_doi-0.7.3.c
@@ -0,0 +1,5022 @@
+/*	$NetBSD: ipsec_doi.c,v 1.23.4.10 2009/06/19 07:32:52 tteras Exp $	*/
+
+/* Id: ipsec_doi.c,v 1.55 2006/08/17 09:20:41 vanhu Exp */
+
+/*
+ * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the project nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/socket.h>
+
+#include <netinet/in.h>
+
+#include PATH_IPSEC_H
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <errno.h>
+#include <netdb.h>
+#if TIME_WITH_SYS_TIME
+# include <sys/time.h>
+# include <time.h>
+#else
+# if HAVE_SYS_TIME_H
+#  include <sys/time.h>
+# else
+#  include <time.h>
+# endif
+#endif
+
+#include "var.h"
+#include "vmbuf.h"
+#include "misc.h"
+#include "plog.h"
+#include "debug.h"
+
+#include "cfparse_proto.h"
+#include "isakmp_var.h"
+#include "isakmp.h"
+#include "ipsec_doi.h"
+#include "oakley.h"
+#include "remoteconf.h"
+#include "localconf.h"
+#include "sockmisc.h"
+#include "handler.h"
+#include "policy.h"
+#include "algorithm.h"
+#include "sainfo.h"
+#include "proposal.h"
+#include "crypto_openssl.h"
+#include "strnames.h"
+#include "gcmalloc.h"
+
+#ifdef ENABLE_NATT
+#include "nattraversal.h"
+#endif
+#ifdef ENABLE_HYBRID
+static int switch_authmethod(int);
+#endif
+
+#ifdef HAVE_GSSAPI
+#include <iconv.h>
+#include "gssapi.h"
+#ifdef HAVE_ICONV_2ND_CONST
+#define __iconv_const const
+#else
+#define __iconv_const
+#endif
+#endif
+
+int verbose_proposal_check = 1;
+
+static vchar_t *get_ph1approval __P((struct ph1handle *, struct prop_pair **));
+static struct isakmpsa *get_ph1approvalx __P((struct prop_pair *,
+	struct isakmpsa *, struct isakmpsa *, int));
+static void print_ph1mismatched __P((struct prop_pair *, struct isakmpsa *));
+static int t2isakmpsa __P((struct isakmp_pl_t *, struct isakmpsa *));
+static int cmp_aproppair_i __P((struct prop_pair *, struct prop_pair *));
+static struct prop_pair *get_ph2approval __P((struct ph2handle *,
+	struct prop_pair **));
+static struct prop_pair *get_ph2approvalx __P((struct ph2handle *,
+	struct prop_pair *));
+static void free_proppair0 __P((struct prop_pair *));
+
+static int get_transform
+	__P((struct isakmp_pl_p *, struct prop_pair **, int *));
+static u_int32_t ipsecdoi_set_ld __P((vchar_t *));
+
+static int check_doi __P((u_int32_t));
+static int check_situation __P((u_int32_t));
+
+static int check_prot_main __P((int));
+static int check_prot_quick __P((int));
+static int (*check_protocol[]) __P((int)) = {
+	check_prot_main,	/* IPSECDOI_TYPE_PH1 */
+	check_prot_quick,	/* IPSECDOI_TYPE_PH2 */
+};
+
+static int check_spi_size __P((int, int));
+
+static int check_trns_isakmp __P((int));
+static int check_trns_ah __P((int));
+static int check_trns_esp __P((int));
+static int check_trns_ipcomp __P((int));
+static int (*check_transform[]) __P((int)) = {
+	0,
+	check_trns_isakmp,	/* IPSECDOI_PROTO_ISAKMP */
+	check_trns_ah,		/* IPSECDOI_PROTO_IPSEC_AH */
+	check_trns_esp,		/* IPSECDOI_PROTO_IPSEC_ESP */
+	check_trns_ipcomp,	/* IPSECDOI_PROTO_IPCOMP */
+};
+
+static int check_attr_isakmp __P((struct isakmp_pl_t *));
+static int check_attr_ah __P((struct isakmp_pl_t *));
+static int check_attr_esp __P((struct isakmp_pl_t *));
+static int check_attr_ipsec __P((int, struct isakmp_pl_t *));
+static int check_attr_ipcomp __P((struct isakmp_pl_t *));
+static int (*check_attributes[]) __P((struct isakmp_pl_t *)) = {
+	0,
+	check_attr_isakmp,	/* IPSECDOI_PROTO_ISAKMP */
+	check_attr_ah,		/* IPSECDOI_PROTO_IPSEC_AH */
+	check_attr_esp,		/* IPSECDOI_PROTO_IPSEC_ESP */
+	check_attr_ipcomp,	/* IPSECDOI_PROTO_IPCOMP */
+};
+
+static int setph1prop __P((struct isakmpsa *, caddr_t));
+static int setph1trns __P((struct isakmpsa *, caddr_t));
+static int setph1attr __P((struct isakmpsa *, caddr_t));
+static vchar_t *setph2proposal0 __P((const struct ph2handle *,
+	const struct saprop *, const struct saproto *));
+
+static vchar_t *getidval __P((int, vchar_t *));
+
+#ifdef HAVE_GSSAPI
+static struct isakmpsa *fixup_initiator_sa __P((struct isakmpsa *,
+	struct isakmpsa *));
+#endif
+
+/*%%%*/
+/*
+ * check phase 1 SA payload.
+ * make new SA payload to be replyed not including general header.
+ * the pointer to one of isakmpsa in proposal is set into iph1->approval.
+ * OUT:
+ *	positive: the pointer to new buffer of SA payload.
+ *		  network byte order.
+ *	NULL	: error occurd.
+ */
+int
+ipsecdoi_checkph1proposal(sa, iph1)
+	vchar_t *sa;
+	struct ph1handle *iph1;
+{
+	vchar_t *newsa;		/* new SA payload approved. */
+	struct prop_pair **pair;
+
+	/* get proposal pair */
+	pair = get_proppair(sa, IPSECDOI_TYPE_PH1);
+	if (pair == NULL)
+		return -1;
+
+	/* check and get one SA for use */
+	newsa = get_ph1approval(iph1, pair);
+	
+	free_proppair(pair);
+
+	if (newsa == NULL)
+		return -1;
+
+	iph1->sa_ret = newsa;
+
+	return 0;
+}
+
+/*
+ * acceptable check for remote configuration.
+ * return a new SA payload to be reply to peer.
+ */
+static vchar_t *
+get_ph1approval(iph1, pair)
+	struct ph1handle *iph1;
+	struct prop_pair **pair;
+{
+	vchar_t *newsa;
+	struct isakmpsa *sa, tsa;
+	struct prop_pair *s, *p;
+	int prophlen;
+	int i;
+
+	if (iph1->approval) {
+		delisakmpsa(iph1->approval);
+		iph1->approval = NULL;
+	}
+
+	for (i = 0; i < MAXPROPPAIRLEN; i++) {
+		if (pair[i] == NULL)
+			continue;
+		for (s = pair[i]; s; s = s->next) {
+			prophlen = 
+			    sizeof(struct isakmp_pl_p) + s->prop->spi_size;
+
+			/* compare proposal and select one */
+			for (p = s; p; p = p->tnext) {
+				if ((sa = get_ph1approvalx(p, 
+				    iph1->rmconf->proposal, &tsa, 
+				    iph1->rmconf->pcheck_level)) != NULL)
+					goto found;
+			}
+		}
+	}
+
+	/*
+	 * if there is no suitable proposal, racoon complains about all of
+	 * mismatched items in those proposal.
+	 */
+	if (verbose_proposal_check) {
+		for (i = 0; i < MAXPROPPAIRLEN; i++) {
+			if (pair[i] == NULL)
+				continue;
+			for (s = pair[i]; s; s = s->next) {
+				prophlen = sizeof(struct isakmp_pl_p)
+						+ s->prop->spi_size;
+				for (p = s; p; p = p->tnext) {
+					print_ph1mismatched(p,
+						iph1->rmconf->proposal);
+				}
+			}
+		}
+	}
+	plog(LLV_ERROR, LOCATION, NULL, "no suitable proposal found.\n");
+
+	return NULL;
+
+found:
+	plog(LLV_DEBUG, LOCATION, NULL, "an acceptable proposal found.\n");
+
+	/* check DH group settings */
+	if (sa->dhgrp) {
+		if (sa->dhgrp->prime && sa->dhgrp->gen1) {
+			/* it's ok */
+			goto saok;
+		}
+		plog(LLV_WARNING, LOCATION, NULL,
+			"invalid DH parameter found, use default.\n");
+		oakley_dhgrp_free(sa->dhgrp);
+		sa->dhgrp=NULL;
+	}
+
+	if (oakley_setdhgroup(sa->dh_group, &sa->dhgrp) == -1) {
+		sa->dhgrp = NULL;
+		racoon_free(sa);
+		return NULL;
+	}
+
+saok:
+#ifdef HAVE_GSSAPI
+	if (sa->gssid != NULL)
+		plog(LLV_DEBUG, LOCATION, NULL, "gss id in new sa '%.*s'\n",
+		    (int)sa->gssid->l, sa->gssid->v);
+	if (iph1-> side == INITIATOR) {
+		if (iph1->rmconf->proposal->gssid != NULL)
+			iph1->gi_i = vdup(iph1->rmconf->proposal->gssid);
+		if (tsa.gssid != NULL)
+			iph1->gi_r = vdup(tsa.gssid);
+		iph1->approval = fixup_initiator_sa(sa, &tsa);
+	} else {
+		if (tsa.gssid != NULL) {
+			iph1->gi_r = vdup(tsa.gssid);
+			iph1->gi_i = gssapi_get_id(iph1);
+			if (sa->gssid == NULL && iph1->gi_i != NULL)
+				sa->gssid = vdup(iph1->gi_i);
+		}
+		iph1->approval = sa;
+	}
+	if (iph1->gi_i != NULL)
+		plog(LLV_DEBUG, LOCATION, NULL, "GIi is %.*s\n",
+		    (int)iph1->gi_i->l, iph1->gi_i->v);
+	if (iph1->gi_r != NULL)
+		plog(LLV_DEBUG, LOCATION, NULL, "GIr is %.*s\n",
+		    (int)iph1->gi_r->l, iph1->gi_r->v);
+#else
+	iph1->approval = sa;
+#endif
+	if(iph1->approval) {
+		plog(LLV_DEBUG, LOCATION, NULL, "agreed on %s auth.\n",
+		    s_oakley_attr_method(iph1->approval->authmethod));
+	}
+
+	newsa = get_sabyproppair(p, iph1);
+	if (newsa == NULL){
+		delisakmpsa(iph1->approval);
+		iph1->approval = NULL;
+	}
+
+	return newsa;
+}
+
+/*
+ * compare peer's single proposal and all of my proposal.
+ * and select one if suiatable.
+ * p       : one of peer's proposal.
+ * proposal: my proposals.
+ */
+static struct isakmpsa *
+get_ph1approvalx(p, proposal, sap, check_level)
+	struct prop_pair *p;
+	struct isakmpsa *proposal, *sap;
+	int check_level;
+{
+	struct isakmp_pl_p *prop = p->prop;
+	struct isakmp_pl_t *trns = p->trns;
+	struct isakmpsa sa, *s, *tsap;
+	int authmethod;
+
+	plog(LLV_DEBUG, LOCATION, NULL,
+       		"prop#=%d, prot-id=%s, spi-size=%d, #trns=%d\n",
+		prop->p_no, s_ipsecdoi_proto(prop->proto_id),
+		prop->spi_size, prop->num_t);
+
+	plog(LLV_DEBUG, LOCATION, NULL,
+		"trns#=%d, trns-id=%s\n",
+		trns->t_no,
+		s_ipsecdoi_trns(prop->proto_id, trns->t_id));
+
+	tsap = sap != NULL ? sap : &sa;
+
+	memset(tsap, 0, sizeof(*tsap));
+	if (t2isakmpsa(trns, tsap) < 0)
+		return NULL;
+	for (s = proposal; s != NULL; s = s->next) {
+#ifdef ENABLE_HYBRID
+		authmethod = switch_authmethod(s->authmethod);
+#else
+		authmethod = s->authmethod;
+#endif
+		plog(LLV_DEBUG, LOCATION, NULL, "Compared: DB:Peer\n");
+		plog(LLV_DEBUG, LOCATION, NULL, "(lifetime = %ld:%ld)\n",
+			(long)s->lifetime, (long)tsap->lifetime);
+		plog(LLV_DEBUG, LOCATION, NULL, "(lifebyte = %zu:%zu)\n",
+			s->lifebyte, tsap->lifebyte);
+		plog(LLV_DEBUG, LOCATION, NULL, "enctype = %s:%s\n",
+			s_oakley_attr_v(OAKLEY_ATTR_ENC_ALG,
+					s->enctype),
+			s_oakley_attr_v(OAKLEY_ATTR_ENC_ALG,
+					tsap->enctype));
+		plog(LLV_DEBUG, LOCATION, NULL, "(encklen = %d:%d)\n",
+			s->encklen, tsap->encklen);
+		plog(LLV_DEBUG, LOCATION, NULL, "hashtype = %s:%s\n",
+			s_oakley_attr_v(OAKLEY_ATTR_HASH_ALG,
+					s->hashtype),
+			s_oakley_attr_v(OAKLEY_ATTR_HASH_ALG,
+					tsap->hashtype));
+		plog(LLV_DEBUG, LOCATION, NULL, "authmethod = %s:%s\n",
+			s_oakley_attr_v(OAKLEY_ATTR_AUTH_METHOD,
+					s->authmethod),
+			s_oakley_attr_v(OAKLEY_ATTR_AUTH_METHOD,
+					tsap->authmethod));
+		plog(LLV_DEBUG, LOCATION, NULL, "dh_group = %s:%s\n",
+			s_oakley_attr_v(OAKLEY_ATTR_GRP_DESC,
+					s->dh_group),
+			s_oakley_attr_v(OAKLEY_ATTR_GRP_DESC,
+					tsap->dh_group));
+#if 0
+		/* XXX to be considered ? */
+		if (tsap->lifebyte > s->lifebyte) ;
+#endif
+		/*
+		 * if responder side and peer's key length in proposal
+		 * is bigger than mine, it might be accepted.
+		 */
+		if(tsap->enctype == s->enctype &&
+		    tsap->authmethod == authmethod &&
+		    tsap->hashtype == s->hashtype &&
+		    tsap->dh_group == s->dh_group &&
+		    tsap->encklen == s->encklen) {
+			switch(check_level) {
+			case PROP_CHECK_OBEY:
+				goto found;
+				break;
+
+			case PROP_CHECK_STRICT:
+				if ((tsap->lifetime > s->lifetime) ||
+				    (tsap->lifebyte > s->lifebyte))
+					continue;
+				goto found;
+				break;
+
+			case PROP_CHECK_CLAIM:
+				if (tsap->lifetime < s->lifetime)
+					s->lifetime = tsap->lifetime;
+				if (tsap->lifebyte < s->lifebyte)
+					s->lifebyte = tsap->lifebyte;
+				goto found;
+				break;
+
+			case PROP_CHECK_EXACT:
+				if ((tsap->lifetime != s->lifetime) ||
+				    (tsap->lifebyte != s->lifebyte))
+					continue;
+				goto found;
+				break;
+
+			default:
+				plog(LLV_ERROR, LOCATION, NULL, 
+				    "Unexpected proposal_check value\n");
+				continue;
+				break;
+			}
+		}
+	}
+
+found:
+	if (tsap->dhgrp != NULL){
+		oakley_dhgrp_free(tsap->dhgrp);
+		tsap->dhgrp = NULL;
+	}
+
+	if ((s = dupisakmpsa(s)) != NULL) {
+		switch(check_level) {
+		case PROP_CHECK_OBEY:
+			s->lifetime = tsap->lifetime;
+			s->lifebyte = tsap->lifebyte;
+			break;
+
+		case PROP_CHECK_STRICT:
+			s->lifetime = tsap->lifetime;
+			s->lifebyte = tsap->lifebyte;
+			break;
+
+		case PROP_CHECK_CLAIM:
+			if (tsap->lifetime < s->lifetime)
+				s->lifetime = tsap->lifetime;
+			if (tsap->lifebyte < s->lifebyte)
+				s->lifebyte = tsap->lifebyte;
+			break;
+
+		default:
+			break;
+		}
+	}
+	return s;
+}
+
+/*
+ * print all of items in peer's proposal which are mismatched to my proposal.
+ * p       : one of peer's proposal.
+ * proposal: my proposals.
+ */
+static void
+print_ph1mismatched(p, proposal)
+	struct prop_pair *p;
+	struct isakmpsa *proposal;
+{
+	struct isakmpsa sa, *s;
+
+	memset(&sa, 0, sizeof(sa));
+	if (t2isakmpsa(p->trns, &sa) < 0)
+		return;
+	for (s = proposal; s ; s = s->next) {
+		if (sa.enctype != s->enctype) {
+			plog(LLV_ERROR, LOCATION, NULL,
+				"rejected enctype: "
+				"DB(prop#%d:trns#%d):Peer(prop#%d:trns#%d) = "
+				"%s:%s\n",
+				s->prop_no, s->trns_no,
+				p->prop->p_no, p->trns->t_no,
+				s_oakley_attr_v(OAKLEY_ATTR_ENC_ALG,
+					s->enctype),
+				s_oakley_attr_v(OAKLEY_ATTR_ENC_ALG,
+					sa.enctype));
+		}
+		if (sa.authmethod != s->authmethod) {
+			plog(LLV_ERROR, LOCATION, NULL,
+				"rejected authmethod: "
+				"DB(prop#%d:trns#%d):Peer(prop#%d:trns#%d) = "
+				"%s:%s\n",
+				s->prop_no, s->trns_no,
+				p->prop->p_no, p->trns->t_no,
+				s_oakley_attr_v(OAKLEY_ATTR_AUTH_METHOD,
+					s->authmethod),
+				s_oakley_attr_v(OAKLEY_ATTR_AUTH_METHOD,
+					sa.authmethod));
+		}
+		if (sa.hashtype != s->hashtype) {
+			plog(LLV_ERROR, LOCATION, NULL,
+				"rejected hashtype: "
+				"DB(prop#%d:trns#%d):Peer(prop#%d:trns#%d) = "
+				"%s:%s\n",
+				s->prop_no, s->trns_no,
+				p->prop->p_no, p->trns->t_no,
+				s_oakley_attr_v(OAKLEY_ATTR_HASH_ALG,
+					s->hashtype),
+				s_oakley_attr_v(OAKLEY_ATTR_HASH_ALG,
+					sa.hashtype));
+		}
+		if (sa.dh_group != s->dh_group) {
+			plog(LLV_ERROR, LOCATION, NULL,
+				"rejected dh_group: "
+				"DB(prop#%d:trns#%d):Peer(prop#%d:trns#%d) = "
+				"%s:%s\n",
+				s->prop_no, s->trns_no,
+				p->prop->p_no, p->trns->t_no,
+				s_oakley_attr_v(OAKLEY_ATTR_GRP_DESC,
+					s->dh_group),
+				s_oakley_attr_v(OAKLEY_ATTR_GRP_DESC,
+					sa.dh_group));
+		}
+	}
+
+	if (sa.dhgrp != NULL){
+		oakley_dhgrp_free(sa.dhgrp);
+		sa.dhgrp=NULL;
+	}
+}
+
+/*
+ * get ISAKMP data attributes
+ */
+static int
+t2isakmpsa(trns, sa)
+	struct isakmp_pl_t *trns;
+	struct isakmpsa *sa;
+{
+	struct isakmp_data *d, *prev;
+	int flag, type;
+	int error = -1;
+	int life_t;
+	int keylen = 0;
+	vchar_t *val = NULL;
+	int len, tlen;
+	u_char *p;
+
+	tlen = ntohs(trns->h.len) - sizeof(*trns);
+	prev = (struct isakmp_data *)NULL;
+	d = (struct isakmp_data *)(trns + 1);
+
+	/* default */
+	life_t = OAKLEY_ATTR_SA_LD_TYPE_DEFAULT;
+	sa->lifetime = OAKLEY_ATTR_SA_LD_SEC_DEFAULT;
+	sa->lifebyte = 0;
+	sa->dhgrp = racoon_calloc(1, sizeof(struct dhgroup));
+	if (!sa->dhgrp)
+		goto err;
+
+	while (tlen > 0) {
+
+		type = ntohs(d->type) & ~ISAKMP_GEN_MASK;
+		flag = ntohs(d->type) & ISAKMP_GEN_MASK;
+
+		plog(LLV_DEBUG, LOCATION, NULL,
+			"type=%s, flag=0x%04x, lorv=%s\n",
+			s_oakley_attr(type), flag,
+			s_oakley_attr_v(type, ntohs(d->lorv)));
+
+		/* get variable-sized item */
+		switch (type) {
+		case OAKLEY_ATTR_GRP_PI:
+		case OAKLEY_ATTR_GRP_GEN_ONE:
+		case OAKLEY_ATTR_GRP_GEN_TWO:
+		case OAKLEY_ATTR_GRP_CURVE_A:
+		case OAKLEY_ATTR_GRP_CURVE_B:
+		case OAKLEY_ATTR_SA_LD:
+		case OAKLEY_ATTR_GRP_ORDER:
+			if (flag) {	/*TV*/
+				len = 2;
+				p = (u_char *)&d->lorv;
+			} else {	/*TLV*/
+				len = ntohs(d->lorv);
+				p = (u_char *)(d + 1);
+			}
+			val = vmalloc(len);
+			if (!val)
+				return -1;
+			memcpy(val->v, p, len);
+			break;
+
+		default:
+			break;
+		}
+
+		switch (type) {
+		case OAKLEY_ATTR_ENC_ALG:
+			sa->enctype = (u_int16_t)ntohs(d->lorv);
+			break;
+
+		case OAKLEY_ATTR_HASH_ALG:
+			sa->hashtype = (u_int16_t)ntohs(d->lorv);
+			break;
+
+		case OAKLEY_ATTR_AUTH_METHOD:
+			sa->authmethod = ntohs(d->lorv);
+			break;
+
+		case OAKLEY_ATTR_GRP_DESC:
+			sa->dh_group = (u_int16_t)ntohs(d->lorv);
+			break;
+
+		case OAKLEY_ATTR_GRP_TYPE:
+		{
+			int type = (int)ntohs(d->lorv);
+			if (type == OAKLEY_ATTR_GRP_TYPE_MODP)
+				sa->dhgrp->type = type;
+			else
+				return -1;
+			break;
+		}
+		case OAKLEY_ATTR_GRP_PI:
+			sa->dhgrp->prime = val;
+			break;
+
+		case OAKLEY_ATTR_GRP_GEN_ONE:
+			vfree(val);
+			if (!flag)
+				sa->dhgrp->gen1 = ntohs(d->lorv);
+			else {
+				int len = ntohs(d->lorv);
+				sa->dhgrp->gen1 = 0;
+				if (len > 4)
+					return -1;
+				memcpy(&sa->dhgrp->gen1, d + 1, len);
+				sa->dhgrp->gen1 = ntohl(sa->dhgrp->gen1);
+			}
+			break;
+
+		case OAKLEY_ATTR_GRP_GEN_TWO:
+			vfree(val);
+			if (!flag)
+				sa->dhgrp->gen2 = ntohs(d->lorv);
+			else {
+				int len = ntohs(d->lorv);
+				sa->dhgrp->gen2 = 0;
+				if (len > 4)
+					return -1;
+				memcpy(&sa->dhgrp->gen2, d + 1, len);
+				sa->dhgrp->gen2 = ntohl(sa->dhgrp->gen2);
+			}
+			break;
+
+		case OAKLEY_ATTR_GRP_CURVE_A:
+			sa->dhgrp->curve_a = val;
+			break;
+
+		case OAKLEY_ATTR_GRP_CURVE_B:
+			sa->dhgrp->curve_b = val;
+			break;
+
+		case OAKLEY_ATTR_SA_LD_TYPE:
+		{
+			int type = (int)ntohs(d->lorv);
+			switch (type) {
+			case OAKLEY_ATTR_SA_LD_TYPE_SEC:
+			case OAKLEY_ATTR_SA_LD_TYPE_KB:
+				life_t = type;
+				break;
+			default:
+				life_t = OAKLEY_ATTR_SA_LD_TYPE_DEFAULT;
+				break;
+			}
+			break;
+		}
+		case OAKLEY_ATTR_SA_LD:
+			if (!prev
+			 || (ntohs(prev->type) & ~ISAKMP_GEN_MASK) !=
+					OAKLEY_ATTR_SA_LD_TYPE) {
+				plog(LLV_ERROR, LOCATION, NULL,
+				    "life duration must follow ltype\n");
+				break;
+			}
+
+			switch (life_t) {
+			case IPSECDOI_ATTR_SA_LD_TYPE_SEC:
+				sa->lifetime = ipsecdoi_set_ld(val);
+				vfree(val);
+				if (sa->lifetime == 0) {
+					plog(LLV_ERROR, LOCATION, NULL,
+						"invalid life duration.\n");
+					goto err;
+				}
+				break;
+			case IPSECDOI_ATTR_SA_LD_TYPE_KB:
+				sa->lifebyte = ipsecdoi_set_ld(val);
+				vfree(val);
+				if (sa->lifebyte == 0) {
+					plog(LLV_ERROR, LOCATION, NULL,
+						"invalid life duration.\n");
+					goto err;
+				}
+				break;
+			default:
+				vfree(val);
+				plog(LLV_ERROR, LOCATION, NULL,
+					"invalid life type: %d\n", life_t);
+				goto err;
+			}
+			break;
+
+		case OAKLEY_ATTR_KEY_LEN:
+		{
+			int len = ntohs(d->lorv);
+			if (len % 8 != 0) {
+				plog(LLV_ERROR, LOCATION, NULL,
+					"keylen %d: not multiple of 8\n",
+					len);
+				goto err;
+			}
+			sa->encklen = (u_int16_t)len;
+			keylen++;
+			break;
+		}
+		case OAKLEY_ATTR_PRF:
+		case OAKLEY_ATTR_FIELD_SIZE:
+			/* unsupported */
+			break;
+
+		case OAKLEY_ATTR_GRP_ORDER:
+			sa->dhgrp->order = val;
+			break;
+#ifdef HAVE_GSSAPI
+		case OAKLEY_ATTR_GSS_ID:
+		{
+			int error = -1;
+			iconv_t cd = (iconv_t) -1;
+			size_t srcleft, dstleft, rv;
+			__iconv_const char *src;
+			char *dst;
+			int len = ntohs(d->lorv);
+
+			/*
+			 * Older verions of racoon just placed the
+			 * ISO-Latin-1 string on the wire directly.
+			 * Check to see if we are configured to be
+			 * compatible with this behavior.
+			 */
+			if (lcconf->gss_id_enc == LC_GSSENC_LATIN1) {
+				if ((sa->gssid = vmalloc(len)) == NULL) {
+					plog(LLV_ERROR, LOCATION, NULL,
+					    "failed to allocate memory\n");
+					goto out;
+				}
+				memcpy(sa->gssid->v, d + 1, len);
+				plog(LLV_DEBUG, LOCATION, NULL,
+				    "received old-style gss "
+				    "id '%.*s' (len %zu)\n",
+				    (int)sa->gssid->l, sa->gssid->v, 
+				    sa->gssid->l);
+				error = 0;
+				goto out;
+			}
+
+			/*
+			 * For Windows 2000 compatibility, we expect
+			 * the GSS ID attribute on the wire to be
+			 * encoded in UTF-16LE.  Internally, we work
+			 * in ISO-Latin-1.  Therefore, we should need
+			 * 1/2 the specified length, which should always
+			 * be a multiple of 2 octets.
+			 */
+			cd = iconv_open("latin1", "utf-16le");
+			if (cd == (iconv_t) -1) {
+				plog(LLV_ERROR, LOCATION, NULL,
+				    "unable to initialize utf-16le -> latin1 "
+				    "conversion descriptor: %s\n",
+				    strerror(errno));
+				goto out;
+			}
+
+			if ((sa->gssid = vmalloc(len / 2)) == NULL) {
+				plog(LLV_ERROR, LOCATION, NULL,
+				    "failed to allocate memory\n");
+				goto out;
+			}
+
+			src = (__iconv_const char *)(d + 1);
+			srcleft = len;
+
+			dst = sa->gssid->v;
+			dstleft = len / 2;
+
+			rv = iconv(cd, (__iconv_const char **)&src, &srcleft, 
+				   &dst, &dstleft);
+			if (rv != 0) {
+				if (rv == -1) {
+					plog(LLV_ERROR, LOCATION, NULL,
+					    "unable to convert GSS ID from "
+					    "utf-16le -> latin1: %s\n",
+					    strerror(errno));
+				} else {
+					plog(LLV_ERROR, LOCATION, NULL,
+					    "%zd character%s in GSS ID cannot "
+					    "be represented in latin1\n",
+					    rv, rv == 1 ? "" : "s");
+				}
+				goto out;
+			}
+
+			/* XXX dstleft should always be 0; assert it? */
+			sa->gssid->l = (len / 2) - dstleft;
+
+			plog(LLV_DEBUG, LOCATION, NULL,
+			    "received gss id '%.*s' (len %zu)\n",
+			    (int)sa->gssid->l, sa->gssid->v, sa->gssid->l);
+
+			error = 0;
+out:
+			if (cd != (iconv_t)-1)
+				(void)iconv_close(cd);
+
+			if ((error != 0) && (sa->gssid != NULL)) {
+				vfree(sa->gssid);
+				sa->gssid = NULL;
+			}
+			break;
+		}
+#endif /* HAVE_GSSAPI */
+
+		default:
+			break;
+		}
+
+		prev = d;
+		if (flag) {
+			tlen -= sizeof(*d);
+			d = (struct isakmp_data *)((char *)d + sizeof(*d));
+		} else {
+			tlen -= (sizeof(*d) + ntohs(d->lorv));
+			d = (struct isakmp_data *)((char *)d + sizeof(*d) + ntohs(d->lorv));
+		}
+	}
+
+	/* key length must not be specified on some algorithms */
+	if (keylen) {
+		if (sa->enctype == OAKLEY_ATTR_ENC_ALG_DES
+#ifdef HAVE_OPENSSL_IDEA_H
+		 || sa->enctype == OAKLEY_ATTR_ENC_ALG_IDEA
+#endif
+		 || sa->enctype == OAKLEY_ATTR_ENC_ALG_3DES) {
+			plog(LLV_ERROR, LOCATION, NULL,
+				"keylen must not be specified "
+				"for encryption algorithm %d\n",
+				sa->enctype);
+			return -1;
+		}
+	}
+
+	return 0;
+err:
+	return error;
+}
+
+/*%%%*/
+/*
+ * check phase 2 SA payload and select single proposal.
+ * make new SA payload to be replyed not including general header.
+ * This function is called by responder only.
+ * OUT:
+ *	0: succeed.
+ *	-1: error occured.
+ */
+int
+ipsecdoi_selectph2proposal(iph2)
+	struct ph2handle *iph2;
+{
+	struct prop_pair **pair;
+	struct prop_pair *ret;
+
+	/* get proposal pair */
+	pair = get_proppair(iph2->sa, IPSECDOI_TYPE_PH2);
+	if (pair == NULL)
+		return -1;
+
+	/* check and select a proposal. */
+	ret = get_ph2approval(iph2, pair);
+	free_proppair(pair);
+	if (ret == NULL)
+		return -1;
+
+	/* make a SA to be replayed. */
+	/* SPI must be updated later. */
+	iph2->sa_ret = get_sabyproppair(ret, iph2->ph1);
+	free_proppair0(ret);
+	if (iph2->sa_ret == NULL)
+		return -1;
+
+	return 0;
+}
+
+/*
+ * check phase 2 SA payload returned from responder.
+ * This function is called by initiator only.
+ * OUT:
+ *	0: valid.
+ *	-1: invalid.
+ */
+int
+ipsecdoi_checkph2proposal(iph2)
+	struct ph2handle *iph2;
+{
+	struct prop_pair **rpair = NULL, **spair = NULL;
+	struct prop_pair *p;
+	int i, n, num;
+	int error = -1;
+	vchar_t *sa_ret = NULL;
+
+	/* get proposal pair of SA sent. */
+	spair = get_proppair(iph2->sa, IPSECDOI_TYPE_PH2);
+	if (spair == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL,
+			"failed to get prop pair.\n");
+		goto end;
+	}
+
+	/* XXX should check the number of transform */
+
+	/* get proposal pair of SA replayed */
+	rpair = get_proppair(iph2->sa_ret, IPSECDOI_TYPE_PH2);
+	if (rpair == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL,
+			"failed to get prop pair.\n");
+		goto end;
+	}
+
+	/* check proposal is only one ? */
+	n = 0;
+	num = 0;
+	for (i = 0; i < MAXPROPPAIRLEN; i++) {
+		if (rpair[i]) {
+			n = i;
+			num++;
+		}
+	}
+	if (num == 0) {
+		plog(LLV_ERROR, LOCATION, NULL,
+			"no proposal received.\n");
+		goto end;
+	}
+	if (num != 1) {
+		plog(LLV_ERROR, LOCATION, NULL,
+			"some proposals received.\n");
+		goto end;
+	}
+
+	if (spair[n] == NULL) {
+		plog(LLV_WARNING, LOCATION, NULL,
+			"invalid proposal number:%d received.\n", i);
+	}
+	
+
+	if (rpair[n]->tnext != NULL) {
+		plog(LLV_ERROR, LOCATION, NULL,
+			"multi transforms replyed.\n");
+		goto end;
+	}
+
+	if (cmp_aproppair_i(rpair[n], spair[n])) {
+		plog(LLV_ERROR, LOCATION, NULL,
+			"proposal mismathed.\n");
+		goto end;
+	}
+
+	/*
+	 * check and select a proposal.
+	 * ensure that there is no modification of the proposal by
+	 * cmp_aproppair_i()
+	 */
+	p = get_ph2approval(iph2, rpair);
+	if (p == NULL)
+		goto end;
+
+	/* make a SA to be replayed. */
+	sa_ret = iph2->sa_ret;
+	iph2->sa_ret = get_sabyproppair(p, iph2->ph1);
+	free_proppair0(p);
+	if (iph2->sa_ret == NULL)
+		goto end;
+
+	error = 0;
+
+end:
+	if (rpair)
+		free_proppair(rpair);
+	if (spair)
+		free_proppair(spair);
+	if (sa_ret)
+		vfree(sa_ret);
+
+	return error;
+}
+
+/*
+ * compare two prop_pair which is assumed to have same proposal number.
+ * the case of bundle or single SA, NOT multi transforms.
+ * a: a proposal that is multi protocols and single transform, usually replyed.
+ * b: a proposal that is multi protocols and multi transform, usually sent.
+ * NOTE: this function is for initiator.
+ * OUT
+ *	0: equal
+ *	1: not equal
+ * XXX cannot understand the comment!
+ */
+static int
+cmp_aproppair_i(a, b)
+	struct prop_pair *a, *b;
+{
+	struct prop_pair *p, *q, *r;
+	int len;
+
+	for (p = a, q = b; p && q; p = p->next, q = q->next) {
+		for (r = q; r; r = r->tnext) {
+			/* compare trns */
+			if (p->trns->t_no == r->trns->t_no)
+				break;
+		}
+		if (!r) {
+			/* no suitable transform found */
+			plog(LLV_ERROR, LOCATION, NULL,
+				"no suitable transform found.\n");
+			return -1;
+		}
+
+		/* compare prop */
+		if (p->prop->p_no != r->prop->p_no) {
+			plog(LLV_WARNING, LOCATION, NULL,
+				"proposal #%d mismatched, "
+				"expected #%d.\n",
+				r->prop->p_no, p->prop->p_no);
+			/*FALLTHROUGH*/
+		}
+
+		if (p->prop->proto_id != r->prop->proto_id) {
+			plog(LLV_ERROR, LOCATION, NULL,
+				"proto_id mismathed: my:%d peer:%d\n",
+				r->prop->proto_id, p->prop->proto_id);
+			return -1;
+		}
+
+		if (p->prop->spi_size != r->prop->spi_size) {
+			plog(LLV_ERROR, LOCATION, NULL,
+				"invalid spi size: %d.\n",
+				p->prop->spi_size);
+			return -1;
+		}
+
+		/* check #of transforms */
+		if (p->prop->num_t != 1) {
+			plog(LLV_WARNING, LOCATION, NULL,
+				"#of transform is %d, "
+				"but expected 1.\n", p->prop->num_t);
+			/*FALLTHROUGH*/
+		}
+
+		if (p->trns->t_id != r->trns->t_id) {
+			plog(LLV_WARNING, LOCATION, NULL,
+				"transform number has been modified.\n");
+			/*FALLTHROUGH*/
+		}
+		if (p->trns->reserved != r->trns->reserved) {
+			plog(LLV_WARNING, LOCATION, NULL,
+				"reserved field should be zero.\n");
+			/*FALLTHROUGH*/
+		}
+
+		/* compare attribute */
+		len = ntohs(r->trns->h.len) - sizeof(*p->trns);
+		if (memcmp(p->trns + 1, r->trns + 1, len) != 0) {
+			plog(LLV_WARNING, LOCATION, NULL,
+				"attribute has been modified.\n");
+			/*FALLTHROUGH*/
+		}
+	}
+	if ((p && !q) || (!p && q)) {
+		/* # of protocols mismatched */
+		plog(LLV_ERROR, LOCATION, NULL,
+			"#of protocols mismatched.\n");
+		return -1;
+	}
+
+	return 0;
+}
+
+/*
+ * acceptable check for policy configuration.
+ * return a new SA payload to be reply to peer.
+ */
+static struct prop_pair *
+get_ph2approval(iph2, pair)
+	struct ph2handle *iph2;
+	struct prop_pair **pair;
+{
+	struct prop_pair *ret;
+	int i;
+
+	iph2->approval = NULL;
+
+	plog(LLV_DEBUG, LOCATION, NULL,
+		"begin compare proposals.\n");
+
+	for (i = 0; i < MAXPROPPAIRLEN; i++) {
+		if (pair[i] == NULL)
+			continue;
+		plog(LLV_DEBUG, LOCATION, NULL,
+			"pair[%d]: %p\n", i, pair[i]);
+		print_proppair(LLV_DEBUG, pair[i]);;
+
+		/* compare proposal and select one */
+		ret = get_ph2approvalx(iph2, pair[i]);
+		if (ret != NULL) {
+			/* found */
+			return ret;
+		}
+	}
+
+	plog(LLV_ERROR, LOCATION, NULL, "no suitable policy found.\n");
+
+	return NULL;
+}
+
+/*
+ * compare my proposal and peers just one proposal.
+ * set a approval.
+ */
+static struct prop_pair *
+get_ph2approvalx(iph2, pp)
+	struct ph2handle *iph2;
+	struct prop_pair *pp;
+{
+	struct prop_pair *ret = NULL;
+	struct saprop *pr0, *pr = NULL;
+	struct saprop *q1, *q2;
+
+	pr0 = aproppair2saprop(pp);
+	if (pr0 == NULL)
+		return NULL;
+
+	for (q1 = pr0; q1; q1 = q1->next) {
+		for (q2 = iph2->proposal; q2; q2 = q2->next) {
+			plog(LLV_DEBUG, LOCATION, NULL,
+				"peer's single bundle:\n");
+			printsaprop0(LLV_DEBUG, q1);
+			plog(LLV_DEBUG, LOCATION, NULL,
+				"my single bundle:\n");
+			printsaprop0(LLV_DEBUG, q2);
+
+			pr = cmpsaprop_alloc(iph2->ph1, q1, q2, iph2->side);
+			if (pr != NULL)
+				goto found;
+
+			plog(LLV_ERROR, LOCATION, NULL,
+				"not matched\n");
+		}
+	}
+	/* no proposal matching */
+err:
+	flushsaprop(pr0);
+	return NULL;
+
+found:
+	flushsaprop(pr0);
+	plog(LLV_DEBUG, LOCATION, NULL, "matched\n");
+	iph2->approval = pr;
+
+    {
+	struct saproto *sp;
+	struct prop_pair *p, *x;
+	struct prop_pair *n = NULL;
+
+	ret = NULL;
+
+	for (p = pp; p; p = p->next) {
+		/*
+		 * find a proposal with matching proto_id.
+		 * we have analyzed validity already, in cmpsaprop_alloc().
+		 */
+		for (sp = pr->head; sp; sp = sp->next) {
+			if (sp->proto_id == p->prop->proto_id)
+				break;
+		}
+		if (!sp)
+			goto err;
+		if (sp->head->next)
+			goto err;	/* XXX */
+
+		for (x = p; x; x = x->tnext)
+			if (sp->head->trns_no == x->trns->t_no)
+				break;
+		if (!x)
+			goto err;	/* XXX */
+
+		n = racoon_calloc(1, sizeof(struct prop_pair));
+		if (n == NULL) {
+			plog(LLV_ERROR, LOCATION, NULL,
+				"failed to get buffer.\n");
+			goto err;
+		}
+
+		n->prop = x->prop;
+		n->trns = x->trns;
+
+		/* need to preserve the order */
+		for (x = ret; x && x->next; x = x->next)
+			;
+		if (x && x->prop == n->prop) {
+			for (/*nothing*/; x && x->tnext; x = x->tnext)
+				;
+			x->tnext = n;
+		} else {
+			if (x)
+				x->next = n;
+			else {
+				ret = n;
+			}
+		}
+
+		/* #of transforms should be updated ? */
+	}
+    }
+
+	return ret;
+}
+
+void
+free_proppair(pair)
+	struct prop_pair **pair;
+{
+	int i;
+
+	for (i = 0; i < MAXPROPPAIRLEN; i++) {
+		free_proppair0(pair[i]);
+		pair[i] = NULL;
+	}
+	racoon_free(pair);
+}
+
+static void
+free_proppair0(pair)
+	struct prop_pair *pair;
+{
+	struct prop_pair *p, *q, *r, *s;
+
+	p = pair;
+	while (p) {
+		q = p->next;
+		r = p;
+		while (r) {
+			s = r->tnext;
+			racoon_free(r);
+			r = s;
+		}
+		p = q;
+	}
+}
+
+/*
+ * get proposal pairs from SA payload.
+ * tiny check for proposal payload.
+ */
+struct prop_pair **
+get_proppair(sa, mode)
+	vchar_t *sa;
+	int mode;
+{
+	struct prop_pair **pair = NULL;
+	int num_p = 0;			/* number of proposal for use */
+	int tlen;
+	caddr_t bp;
+	int i;
+	struct ipsecdoi_sa_b *sab = (struct ipsecdoi_sa_b *)sa->v;
+
+	plog(LLV_DEBUG, LOCATION, NULL, "total SA len=%zu\n", sa->l);
+	plogdump(LLV_DEBUG, sa->v, sa->l);
+
+	/* check SA payload size */
+	if (sa->l < sizeof(*sab)) {
+		plog(LLV_ERROR, LOCATION, NULL,
+			"Invalid SA length = %zu.\n", sa->l);
+		goto bad;
+	}
+
+	/* check DOI */
+	if (check_doi(ntohl(sab->doi)) < 0)
+		goto bad;
+
+	/* check SITUATION */
+	if (check_situation(ntohl(sab->sit)) < 0)
+		goto bad;
+
+	pair = racoon_calloc(1, MAXPROPPAIRLEN * sizeof(*pair));
+	if (pair == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL,
+			"failed to get buffer.\n");
+		goto bad;
+	}
+	memset(pair, 0, sizeof(pair));
+
+	bp = (caddr_t)(sab + 1);
+	tlen = sa->l - sizeof(*sab);
+
+    {
+	struct isakmp_pl_p *prop;
+	int proplen;
+	vchar_t *pbuf = NULL;
+	struct isakmp_parse_t *pa;
+
+	pbuf = isakmp_parsewoh(ISAKMP_NPTYPE_P, (struct isakmp_gen *)bp, tlen);
+	if (pbuf == NULL)
+		goto bad;
+
+	for (pa = (struct isakmp_parse_t *)pbuf->v;
+	     pa->type != ISAKMP_NPTYPE_NONE;
+	     pa++) {
+		/* check the value of next payload */
+		if (pa->type != ISAKMP_NPTYPE_P) {
+			plog(LLV_ERROR, LOCATION, NULL,
+				"Invalid payload type=%u\n", pa->type);
+			vfree(pbuf);
+			goto bad;
+		}
+
+		prop = (struct isakmp_pl_p *)pa->ptr;
+		proplen = pa->len;
+
+		plog(LLV_DEBUG, LOCATION, NULL,
+			"proposal #%u len=%d\n", prop->p_no, proplen);
+
+		if (proplen == 0) {
+			plog(LLV_ERROR, LOCATION, NULL,
+				"invalid proposal with length %d\n", proplen);
+			vfree(pbuf);
+			goto bad;
+		}
+
+		/* check Protocol ID */
+		if (!check_protocol[mode]) {
+			plog(LLV_ERROR, LOCATION, NULL,
+				"unsupported mode %d\n", mode);
+			continue;
+		}
+
+		if (check_protocol[mode](prop->proto_id) < 0)
+			continue;
+
+		/* check SPI length when IKE. */
+		if (check_spi_size(prop->proto_id, prop->spi_size) < 0)
+			continue;
+
+		/* get transform */
+		if (get_transform(prop, pair, &num_p) < 0) {
+			vfree(pbuf);
+			goto bad;
+		}
+	}
+	vfree(pbuf);
+	pbuf = NULL;
+    }
+
+    {
+	int notrans, nprop;
+	struct prop_pair *p, *q;
+
+	/* check for proposals with no transforms */
+	for (i = 0; i < MAXPROPPAIRLEN; i++) {
+		if (!pair[i])
+			continue;
+
+		plog(LLV_DEBUG, LOCATION, NULL, "pair %d:\n", i);
+		print_proppair(LLV_DEBUG, pair[i]);
+
+		notrans = nprop = 0;
+		for (p = pair[i]; p; p = p->next) {
+			if (p->trns == NULL) {
+				notrans++;
+				break;
+			}
+			for (q = p; q; q = q->tnext)
+				nprop++;
+		}
+
+#if 0
+		/*
+		 * XXX at this moment, we cannot accept proposal group
+		 * with multiple proposals.  this should be fixed.
+		 */
+		if (pair[i]->next) {
+			plog(LLV_WARNING, LOCATION, NULL,
+				"proposal #%u ignored "
+				"(multiple proposal not supported)\n",
+				pair[i]->prop->p_no);
+			notrans++;
+		}
+#endif
+
+		if (notrans) {
+			for (p = pair[i]; p; p = q) {
+				q = p->next;
+				racoon_free(p);
+			}
+			pair[i] = NULL;
+			num_p--;
+		} else {
+			plog(LLV_DEBUG, LOCATION, NULL,
+				"proposal #%u: %d transform\n",
+				pair[i]->prop->p_no, nprop);
+		}
+	}
+    }
+
+	/* bark if no proposal is found. */
+	if (num_p <= 0) {
+		plog(LLV_ERROR, LOCATION, NULL,
+			"no Proposal found.\n");
+		goto bad;
+	}
+
+	return pair;
+bad:
+	if (pair != NULL)
+		racoon_free(pair);
+	return NULL;
+}
+
+/*
+ * check transform payload.
+ * OUT:
+ *	positive: return the pointer to the payload of valid transform.
+ *	0	: No valid transform found.
+ */
+static int
+get_transform(prop, pair, num_p)
+	struct isakmp_pl_p *prop;
+	struct prop_pair **pair;
+	int *num_p;
+{
+	int tlen; /* total length of all transform in a proposal */
+	caddr_t bp;
+	struct isakmp_pl_t *trns;
+	int trnslen;
+	vchar_t *pbuf = NULL;
+	struct isakmp_parse_t *pa;
+	struct prop_pair *p = NULL, *q;
+	int num_t;
+
+	bp = (caddr_t)prop + sizeof(struct isakmp_pl_p) + prop->spi_size;
+	tlen = ntohs(prop->h.len)
+		- (sizeof(struct isakmp_pl_p) + prop->spi_size);
+	pbuf = isakmp_parsewoh(ISAKMP_NPTYPE_T, (struct isakmp_gen *)bp, tlen);
+	if (pbuf == NULL)
+		return -1;
+
+	/* check and get transform for use */
+	num_t = 0;
+	for (pa = (struct isakmp_parse_t *)pbuf->v;
+	     pa->type != ISAKMP_NPTYPE_NONE;
+	     pa++) {
+
+		num_t++;
+
+		/* check the value of next payload */
+		if (pa->type != ISAKMP_NPTYPE_T) {
+			plog(LLV_ERROR, LOCATION, NULL,
+				"Invalid payload type=%u\n", pa->type);
+			break;
+		}
+
+		trns = (struct isakmp_pl_t *)pa->ptr;
+		trnslen = pa->len;
+
+		plog(LLV_DEBUG, LOCATION, NULL,
+			"transform #%u len=%u\n", trns->t_no, trnslen);
+
+		/* check transform ID */
+		if (prop->proto_id >= ARRAYLEN(check_transform)) {
+			plog(LLV_WARNING, LOCATION, NULL,
+				"unsupported proto_id %u\n",
+				prop->proto_id);
+			continue;
+		}
+		if (prop->proto_id >= ARRAYLEN(check_attributes)) {
+			plog(LLV_WARNING, LOCATION, NULL,
+				"unsupported proto_id %u\n",
+				prop->proto_id);
+			continue;
+		}
+
+		if (!check_transform[prop->proto_id]
+		 || !check_attributes[prop->proto_id]) {
+			plog(LLV_WARNING, LOCATION, NULL,
+				"unsupported proto_id %u\n",
+				prop->proto_id);
+			continue;
+		}
+		if (check_transform[prop->proto_id](trns->t_id) < 0)
+			continue;
+
+		/* check data attributes */
+		if (check_attributes[prop->proto_id](trns) != 0)
+			continue;
+
+		p = racoon_calloc(1, sizeof(*p));
+		if (p == NULL) {
+			plog(LLV_ERROR, LOCATION, NULL,
+				"failed to get buffer.\n");
+			vfree(pbuf);
+			return -1;
+		}
+		p->prop = prop;
+		p->trns = trns;
+
+		/* need to preserve the order */
+		for (q = pair[prop->p_no]; q && q->next; q = q->next)
+			;
+		if (q && q->prop == p->prop) {
+			for (/*nothing*/; q && q->tnext; q = q->tnext)
+				;
+			q->tnext = p;
+		} else {
+			if (q)
+				q->next = p;
+			else {
+				pair[prop->p_no] = p;
+				(*num_p)++;
+			}
+		}
+	}
+
+	vfree(pbuf);
+
+	return 0;
+}
+
+/*
+ * make a new SA payload from prop_pair.
+ * NOTE: this function make spi value clear.
+ */
+vchar_t *
+get_sabyproppair(pair, iph1)
+	struct prop_pair *pair;
+	struct ph1handle *iph1;
+{
+	vchar_t *newsa;
+	int newtlen;
+	u_int8_t *np_p = NULL;
+	struct prop_pair *p;
+	int prophlen, trnslen;
+	caddr_t bp;
+
+	newtlen = sizeof(struct ipsecdoi_sa_b);
+	for (p = pair; p; p = p->next) {
+		newtlen += sizeof(struct isakmp_pl_p);
+		newtlen += p->prop->spi_size;
+		newtlen += ntohs(p->trns->h.len);
+	}
+
+	newsa = vmalloc(newtlen);
+	if (newsa == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL, "failed to get newsa.\n");
+		return NULL;
+	}
+	bp = newsa->v;
+
+	((struct isakmp_gen *)bp)->len = htons(newtlen);
+
+	/* update some of values in SA header */
+	((struct ipsecdoi_sa_b *)bp)->doi = htonl(iph1->rmconf->doitype);
+	((struct ipsecdoi_sa_b *)bp)->sit = htonl(iph1->rmconf->sittype);
+	bp += sizeof(struct ipsecdoi_sa_b);
+
+	/* create proposal payloads */
+	for (p = pair; p; p = p->next) {
+		prophlen = sizeof(struct isakmp_pl_p)
+				+ p->prop->spi_size;
+		trnslen = ntohs(p->trns->h.len);
+
+		if (np_p)
+			*np_p = ISAKMP_NPTYPE_P;
+
+		/* create proposal */
+
+		memcpy(bp, p->prop, prophlen);
+		((struct isakmp_pl_p *)bp)->h.np = ISAKMP_NPTYPE_NONE;
+		((struct isakmp_pl_p *)bp)->h.len = htons(prophlen + trnslen);
+		((struct isakmp_pl_p *)bp)->num_t = 1;
+		np_p = &((struct isakmp_pl_p *)bp)->h.np;
+		memset(bp + sizeof(struct isakmp_pl_p), 0, p->prop->spi_size);
+		bp += prophlen;
+
+		/* create transform */
+		memcpy(bp, p->trns, trnslen);
+		((struct isakmp_pl_t *)bp)->h.np = ISAKMP_NPTYPE_NONE;
+		((struct isakmp_pl_t *)bp)->h.len = htons(trnslen);
+		bp += trnslen;
+	}
+
+	return newsa;
+}
+
+/*
+ * update responder's spi
+ */
+int
+ipsecdoi_updatespi(iph2)
+	struct ph2handle *iph2;
+{
+	struct prop_pair **pair, *p;
+	struct saprop *pp;
+	struct saproto *pr;
+	int i;
+	int error = -1;
+	u_int8_t *spi;
+
+	pair = get_proppair(iph2->sa_ret, IPSECDOI_TYPE_PH2);
+	if (pair == NULL)
+		return -1;
+	for (i = 0; i < MAXPROPPAIRLEN; i++) {
+		if (pair[i])
+			break;
+	}
+	if (i == MAXPROPPAIRLEN || pair[i]->tnext) {
+		/* multiple transform must be filtered by selectph2proposal.*/
+		goto end;
+	}
+
+	pp = iph2->approval;
+
+	/* create proposal payloads */
+	for (p = pair[i]; p; p = p->next) {
+		/*
+		 * find a proposal/transform with matching proto_id/t_id.
+		 * we have analyzed validity already, in cmpsaprop_alloc().
+		 */
+		for (pr = pp->head; pr; pr = pr->next) {
+			if (p->prop->proto_id == pr->proto_id &&
+			    p->trns->t_id == pr->head->trns_id) {
+				break;
+			}
+		}
+		if (!pr)
+			goto end;
+
+		/*
+		 * XXX SPI bits are left-filled, for use with IPComp.
+		 * we should be switching to variable-length spi field...
+		 */
+		spi = (u_int8_t *)&pr->spi;
+		spi += sizeof(pr->spi);
+		spi -= pr->spisize;
+		memcpy((caddr_t)p->prop + sizeof(*p->prop), spi, pr->spisize);
+	}
+
+	error = 0;
+end:
+	free_proppair(pair);
+	return error;
+}
+
+/*
+ * make a new SA payload from prop_pair.
+ */
+vchar_t *
+get_sabysaprop(pp0, sa0)
+	struct saprop *pp0;
+	vchar_t *sa0;
+{
+	struct prop_pair **pair = NULL;
+	vchar_t *newsa = NULL;
+	int newtlen;
+	u_int8_t *np_p = NULL;
+	struct prop_pair *p = NULL;
+	struct saprop *pp;
+	struct saproto *pr;
+	struct satrns *tr;
+	int prophlen, trnslen;
+	caddr_t bp;
+	int error = -1;
+
+	/* get proposal pair */
+	pair = get_proppair(sa0, IPSECDOI_TYPE_PH2);
+	if (pair == NULL)
+		goto out;
+
+	newtlen = sizeof(struct ipsecdoi_sa_b);
+	for (pp = pp0; pp; pp = pp->next) {
+
+		if (pair[pp->prop_no] == NULL)
+			goto out;
+
+		for (pr = pp->head; pr; pr = pr->next) {
+			newtlen += (sizeof(struct isakmp_pl_p)
+				+ pr->spisize);
+
+			for (tr = pr->head; tr; tr = tr->next) {
+				for (p = pair[pp->prop_no]; p; p = p->tnext) {
+					if (tr->trns_no == p->trns->t_no)
+						break;
+				}
+				if (p == NULL)
+					goto out;
+
+				newtlen += ntohs(p->trns->h.len);
+			}
+		}
+	}
+
+	newsa = vmalloc(newtlen);
+	if (newsa == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL, "failed to get newsa.\n");
+		goto out;
+	}
+	bp = newsa->v;
+
+	/* some of values of SA must be updated in the out of this function */
+	((struct isakmp_gen *)bp)->len = htons(newtlen);
+	bp += sizeof(struct ipsecdoi_sa_b);
+
+	/* create proposal payloads */
+	for (pp = pp0; pp; pp = pp->next) {
+
+		for (pr = pp->head; pr; pr = pr->next) {
+			prophlen = sizeof(struct isakmp_pl_p)
+					+ p->prop->spi_size;
+
+			for (tr = pr->head; tr; tr = tr->next) {
+				for (p = pair[pp->prop_no]; p; p = p->tnext) {
+					if (tr->trns_no == p->trns->t_no)
+						break;
+				}
+				if (p == NULL)
+					goto out;
+
+				trnslen = ntohs(p->trns->h.len);
+
+				if (np_p)
+					*np_p = ISAKMP_NPTYPE_P;
+
+				/* create proposal */
+
+				memcpy(bp, p->prop, prophlen);
+				((struct isakmp_pl_p *)bp)->h.np = ISAKMP_NPTYPE_NONE;
+				((struct isakmp_pl_p *)bp)->h.len = htons(prophlen + trnslen);
+				((struct isakmp_pl_p *)bp)->num_t = 1;
+				np_p = &((struct isakmp_pl_p *)bp)->h.np;
+				bp += prophlen;
+
+				/* create transform */
+				memcpy(bp, p->trns, trnslen);
+				((struct isakmp_pl_t *)bp)->h.np = ISAKMP_NPTYPE_NONE;
+				((struct isakmp_pl_t *)bp)->h.len = htons(trnslen);
+				bp += trnslen;
+			}
+		}
+	}
+
+	error = 0;
+out:
+	if (pair != NULL)
+		racoon_free(pair);
+
+	if (error != 0) {
+		if (newsa != NULL) {
+			vfree(newsa);
+			newsa = NULL;
+		}
+	}
+
+	return newsa;
+}
+
+/*
+ * If some error happens then return 0.  Although 0 means that lifetime is zero,
+ * such a value should not be accepted.
+ * Also 0 of lifebyte should not be included in a packet although 0 means not
+ * to care of it.
+ */
+static u_int32_t
+ipsecdoi_set_ld(buf)
+	vchar_t *buf;
+{
+	u_int32_t ld;
+
+	if (buf == 0)
+		return 0;
+
+	switch (buf->l) {
+	case 2:
+		ld = ntohs(*(u_int16_t *)buf->v);
+		break;
+	case 4:
+		ld = ntohl(*(u_int32_t *)buf->v);
+		break;
+	default:
+		plog(LLV_ERROR, LOCATION, NULL,
+			"length %zu of life duration "
+			"isn't supported.\n", buf->l);
+		return 0;
+	}
+
+	return ld;
+}
+
+/*%%%*/
+/*
+ * check DOI
+ */
+static int
+check_doi(doi)
+	u_int32_t doi;
+{
+	switch (doi) {
+	case IPSEC_DOI:
+		return 0;
+	default:
+		plog(LLV_ERROR, LOCATION, NULL,
+			"invalid value of DOI 0x%08x.\n", doi);
+		return -1;
+	}
+	/* NOT REACHED */
+}
+
+/*
+ * check situation
+ */
+static int
+check_situation(sit)
+	u_int32_t sit;
+{
+	switch (sit) {
+	case IPSECDOI_SIT_IDENTITY_ONLY:
+		return 0;
+
+	case IPSECDOI_SIT_SECRECY:
+	case IPSECDOI_SIT_INTEGRITY:
+		plog(LLV_ERROR, LOCATION, NULL,
+			"situation 0x%08x unsupported yet.\n", sit);
+		return -1;
+
+	default:
+		plog(LLV_ERROR, LOCATION, NULL,
+			"invalid situation 0x%08x.\n", sit);
+		return -1;
+	}
+	/* NOT REACHED */
+}
+
+/*
+ * check protocol id in main mode
+ */
+static int
+check_prot_main(proto_id)
+	int proto_id;
+{
+	switch (proto_id) {
+	case IPSECDOI_PROTO_ISAKMP:
+		return 0;
+
+	default:
+		plog(LLV_ERROR, LOCATION, NULL,
+			"Illegal protocol id=%u.\n", proto_id);
+		return -1;
+	}
+	/* NOT REACHED */
+}
+
+/*
+ * check protocol id in quick mode
+ */
+static int
+check_prot_quick(proto_id)
+	int proto_id;
+{
+	switch (proto_id) {
+	case IPSECDOI_PROTO_IPSEC_AH:
+	case IPSECDOI_PROTO_IPSEC_ESP:
+		return 0;
+
+	case IPSECDOI_PROTO_IPCOMP:
+		return 0;
+
+	default:
+		plog(LLV_ERROR, LOCATION, NULL,
+			"invalid protocol id %d.\n", proto_id);
+		return -1;
+	}
+	/* NOT REACHED */
+}
+
+static int
+check_spi_size(proto_id, size)
+	int proto_id, size;
+{
+	switch (proto_id) {
+	case IPSECDOI_PROTO_ISAKMP:
+		if (size != 0) {
+			/* WARNING */
+			plog(LLV_WARNING, LOCATION, NULL,
+				"SPI size isn't zero, but IKE proposal.\n");
+		}
+		return 0;
+
+	case IPSECDOI_PROTO_IPSEC_AH:
+	case IPSECDOI_PROTO_IPSEC_ESP:
+		if (size != 4) {
+			plog(LLV_ERROR, LOCATION, NULL,
+				"invalid SPI size=%d for IPSEC proposal.\n",
+				size);
+			return -1;
+		}
+		return 0;
+
+	case IPSECDOI_PROTO_IPCOMP:
+		if (size != 2 && size != 4) {
+			plog(LLV_ERROR, LOCATION, NULL,
+				"invalid SPI size=%d for IPCOMP proposal.\n",
+				size);
+			return -1;
+		}
+		return 0;
+
+	default:
+		/* ??? */
+		return -1;
+	}
+	/* NOT REACHED */
+}
+
+/*
+ * check transform ID in ISAKMP.
+ */
+static int
+check_trns_isakmp(t_id)
+	int t_id;
+{
+	switch (t_id) {
+	case IPSECDOI_KEY_IKE:
+		return 0;
+	default:
+		plog(LLV_ERROR, LOCATION, NULL,
+			"invalid transform-id=%u in proto_id=%u.\n",
+			t_id, IPSECDOI_KEY_IKE);
+		return -1;
+	}
+	/* NOT REACHED */
+}
+
+/*
+ * check transform ID in AH.
+ */
+static int
+check_trns_ah(t_id)
+	int t_id;
+{
+	switch (t_id) {
+	case IPSECDOI_AH_MD5:
+	case IPSECDOI_AH_SHA:
+	case IPSECDOI_AH_SHA256:
+	case IPSECDOI_AH_SHA384:
+	case IPSECDOI_AH_SHA512:
+		return 0;
+	case IPSECDOI_AH_DES:
+		plog(LLV_ERROR, LOCATION, NULL,
+			"not support transform-id=%u in AH.\n", t_id);
+		return -1;
+	default:
+		plog(LLV_ERROR, LOCATION, NULL,
+			"invalid transform-id=%u in AH.\n", t_id);
+		return -1;
+	}
+	/* NOT REACHED */
+}
+
+/*
+ * check transform ID in ESP.
+ */
+static int
+check_trns_esp(t_id)
+	int t_id;
+{
+	switch (t_id) {
+	case IPSECDOI_ESP_DES:
+	case IPSECDOI_ESP_3DES:
+	case IPSECDOI_ESP_NULL:
+	case IPSECDOI_ESP_RC5:
+	case IPSECDOI_ESP_CAST:
+	case IPSECDOI_ESP_BLOWFISH:
+	case IPSECDOI_ESP_AES:
+	case IPSECDOI_ESP_TWOFISH:
+	case IPSECDOI_ESP_CAMELLIA:
+		return 0;
+	case IPSECDOI_ESP_DES_IV32:
+	case IPSECDOI_ESP_DES_IV64:
+	case IPSECDOI_ESP_IDEA:
+	case IPSECDOI_ESP_3IDEA:
+	case IPSECDOI_ESP_RC4:
+		plog(LLV_ERROR, LOCATION, NULL,
+			"not support transform-id=%u in ESP.\n", t_id);
+		return -1;
+	default:
+		plog(LLV_ERROR, LOCATION, NULL,
+			"invalid transform-id=%u in ESP.\n", t_id);
+		return -1;
+	}
+	/* NOT REACHED */
+}
+
+/*
+ * check transform ID in IPCOMP.
+ */
+static int
+check_trns_ipcomp(t_id)
+	int t_id;
+{
+	switch (t_id) {
+	case IPSECDOI_IPCOMP_OUI:
+	case IPSECDOI_IPCOMP_DEFLATE:
+	case IPSECDOI_IPCOMP_LZS:
+		return 0;
+	default:
+		plog(LLV_ERROR, LOCATION, NULL,
+			"invalid transform-id=%u in IPCOMP.\n", t_id);
+		return -1;
+	}
+	/* NOT REACHED */
+}
+
+/*
+ * check data attributes in IKE.
+ */
+static int
+check_attr_isakmp(trns)
+	struct isakmp_pl_t *trns;
+{
+	struct isakmp_data *d;
+	int tlen;
+	int flag, type;
+	u_int16_t lorv;
+
+	tlen = ntohs(trns->h.len) - sizeof(struct isakmp_pl_t);
+	d = (struct isakmp_data *)((caddr_t)trns + sizeof(struct isakmp_pl_t));
+
+	while (tlen > 0) {
+		type = ntohs(d->type) & ~ISAKMP_GEN_MASK;
+		flag = ntohs(d->type) & ISAKMP_GEN_MASK;
+		lorv = ntohs(d->lorv);
+
+		plog(LLV_DEBUG, LOCATION, NULL,
+			"type=%s, flag=0x%04x, lorv=%s\n",
+			s_oakley_attr(type), flag,
+			s_oakley_attr_v(type, lorv));
+
+		/*
+		 * some of the attributes must be encoded in TV.
+		 * see RFC2409 Appendix A "Attribute Classes".
+		 */
+		switch (type) {
+		case OAKLEY_ATTR_ENC_ALG:
+		case OAKLEY_ATTR_HASH_ALG:
+		case OAKLEY_ATTR_AUTH_METHOD:
+		case OAKLEY_ATTR_GRP_DESC:
+		case OAKLEY_ATTR_GRP_TYPE:
+		case OAKLEY_ATTR_SA_LD_TYPE:
+		case OAKLEY_ATTR_PRF:
+		case OAKLEY_ATTR_KEY_LEN:
+		case OAKLEY_ATTR_FIELD_SIZE:
+			if (!flag) {	/* TLV*/
+				plog(LLV_ERROR, LOCATION, NULL,
+					"oakley attribute %d must be TV.\n",
+					type);
+				return -1;
+			}
+			break;
+		}
+
+		/* sanity check for TLV.  length must be specified. */
+		if (!flag && lorv == 0) {	/*TLV*/
+			plog(LLV_ERROR, LOCATION, NULL,
+				"invalid length %d for TLV attribute %d.\n",
+				lorv, type);
+			return -1;
+		}
+
+		switch (type) {
+		case OAKLEY_ATTR_ENC_ALG:
+			if (!alg_oakley_encdef_ok(lorv)) {
+				plog(LLV_ERROR, LOCATION, NULL,
+					"invalied encryption algorithm=%d.\n",
+					lorv);
+				return -1;
+			}
+			break;
+
+		case OAKLEY_ATTR_HASH_ALG:
+			if (!alg_oakley_hashdef_ok(lorv)) {
+				plog(LLV_ERROR, LOCATION, NULL,
+					"invalied hash algorithm=%d.\n",
+					lorv);
+				return -1;
+			}
+			break;
+
+		case OAKLEY_ATTR_AUTH_METHOD:
+			switch (lorv) {
+			case OAKLEY_ATTR_AUTH_METHOD_PSKEY:
+			case OAKLEY_ATTR_AUTH_METHOD_RSASIG:
+#ifdef ENABLE_HYBRID
+			case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
+			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I:
+#if 0 /* Clashes with OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB */
+			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I:
+#endif
+#endif
+			case OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB:
+				break;
+			case OAKLEY_ATTR_AUTH_METHOD_DSSSIG:
+#ifdef ENABLE_HYBRID
+			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
+			case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R:
+			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R:
+			case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
+			case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R:
+			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I:
+			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R:
+			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_I:
+			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_R:
+			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_I:
+			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_R:
+#endif
+			case OAKLEY_ATTR_AUTH_METHOD_RSAENC:
+			case OAKLEY_ATTR_AUTH_METHOD_RSAREV:
+				plog(LLV_ERROR, LOCATION, NULL,
+					"auth method %s isn't supported.\n",
+					s_oakley_attr_method(lorv));
+				return -1;
+			default:
+				plog(LLV_ERROR, LOCATION, NULL,
+					"invalid auth method %d.\n",
+					lorv);
+				return -1;
+			}
+			break;
+
+		case OAKLEY_ATTR_GRP_DESC:
+			if (!alg_oakley_dhdef_ok(lorv)) {
+				plog(LLV_ERROR, LOCATION, NULL,
+					"invalid DH group %d.\n",
+					lorv);
+				return -1;
+			}
+			break;
+
+		case OAKLEY_ATTR_GRP_TYPE:
+			switch (lorv) {
+			case OAKLEY_ATTR_GRP_TYPE_MODP:
+				break;
+			default:
+				plog(LLV_ERROR, LOCATION, NULL,
+					"unsupported DH group type %d.\n",
+					lorv);
+				return -1;
+			}
+			break;
+
+		case OAKLEY_ATTR_GRP_PI:
+		case OAKLEY_ATTR_GRP_GEN_ONE:
+			/* sanity checks? */
+			break;
+
+		case OAKLEY_ATTR_GRP_GEN_TWO:
+		case OAKLEY_ATTR_GRP_CURVE_A:
+		case OAKLEY_ATTR_GRP_CURVE_B:
+			plog(LLV_ERROR, LOCATION, NULL,
+				"attr type=%u isn't supported.\n", type);
+			return -1;
+
+		case OAKLEY_ATTR_SA_LD_TYPE:
+			switch (lorv) {
+			case OAKLEY_ATTR_SA_LD_TYPE_SEC:
+			case OAKLEY_ATTR_SA_LD_TYPE_KB:
+				break;
+			default:
+				plog(LLV_ERROR, LOCATION, NULL,
+					"invalid life type %d.\n", lorv);
+				return -1;
+			}
+			break;
+
+		case OAKLEY_ATTR_SA_LD:
+			/* should check the value */
+			break;
+
+		case OAKLEY_ATTR_PRF:
+		case OAKLEY_ATTR_KEY_LEN:
+			break;
+
+		case OAKLEY_ATTR_FIELD_SIZE:
+			plog(LLV_ERROR, LOCATION, NULL,
+				"attr type=%u isn't supported.\n", type);
+			return -1;
+
+		case OAKLEY_ATTR_GRP_ORDER:
+			break;
+
+		case OAKLEY_ATTR_GSS_ID:
+			break;
+
+		default:
+			plog(LLV_ERROR, LOCATION, NULL,
+				"invalid attribute type %d.\n", type);
+			return -1;
+		}
+
+		if (flag) {
+			tlen -= sizeof(*d);
+			d = (struct isakmp_data *)((char *)d
+				+ sizeof(*d));
+		} else {
+			tlen -= (sizeof(*d) + lorv);
+			d = (struct isakmp_data *)((char *)d
+				+ sizeof(*d) + lorv);
+		}
+	}
+
+	return 0;
+}
+
+/*
+ * check data attributes in IPSEC AH/ESP.
+ */
+static int
+check_attr_ah(trns)
+	struct isakmp_pl_t *trns;
+{
+	return check_attr_ipsec(IPSECDOI_PROTO_IPSEC_AH, trns);
+}
+
+static int
+check_attr_esp(trns)
+	struct isakmp_pl_t *trns;
+{
+	return check_attr_ipsec(IPSECDOI_PROTO_IPSEC_ESP, trns);
+}
+
+static int
+check_attr_ipsec(proto_id, trns)
+	int proto_id;
+	struct isakmp_pl_t *trns;
+{
+	struct isakmp_data *d;
+	int tlen;
+	int flag, type = 0;
+	u_int16_t lorv;
+	int attrseen[16];	/* XXX magic number */
+
+	tlen = ntohs(trns->h.len) - sizeof(struct isakmp_pl_t);
+	d = (struct isakmp_data *)((caddr_t)trns + sizeof(struct isakmp_pl_t));
+	memset(attrseen, 0, sizeof(attrseen));
+
+	while (tlen > 0) {
+		type = ntohs(d->type) & ~ISAKMP_GEN_MASK;
+		flag = ntohs(d->type) & ISAKMP_GEN_MASK;
+		lorv = ntohs(d->lorv);
+
+		plog(LLV_DEBUG, LOCATION, NULL,
+			"type=%s, flag=0x%04x, lorv=%s\n",
+			s_ipsecdoi_attr(type), flag,
+			s_ipsecdoi_attr_v(type, lorv));
+
+		if (type < sizeof(attrseen)/sizeof(attrseen[0]))
+			attrseen[type]++;
+
+		switch (type) {
+		case IPSECDOI_ATTR_ENC_MODE:
+			if (! flag) {
+				plog(LLV_ERROR, LOCATION, NULL,
+					"must be TV when ENC_MODE.\n");
+				return -1;
+			}
+
+			switch (lorv) {
+			case IPSECDOI_ATTR_ENC_MODE_TUNNEL:
+			case IPSECDOI_ATTR_ENC_MODE_TRNS:
+				break;
+#ifdef ENABLE_NATT
+			case IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC:
+			case IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC:
+			case IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_DRAFT:
+			case IPSECDOI_ATTR_ENC_MODE_UDPTRNS_DRAFT:
+				plog(LLV_DEBUG, LOCATION, NULL,
+				     "UDP encapsulation requested\n");
+				break;
+#endif
+			default:
+				plog(LLV_ERROR, LOCATION, NULL,
+					"invalid encryption mode=%u.\n",
+					lorv);
+				return -1;
+			}
+			break;
+
+		case IPSECDOI_ATTR_AUTH:
+			if (! flag) {
+				plog(LLV_ERROR, LOCATION, NULL,
+					"must be TV when AUTH.\n");
+				return -1;
+			}
+
+			switch (lorv) {
+			case IPSECDOI_ATTR_AUTH_HMAC_MD5:
+				if (proto_id == IPSECDOI_PROTO_IPSEC_AH &&
+				    trns->t_id != IPSECDOI_AH_MD5) {
+ahmismatch:
+					plog(LLV_ERROR, LOCATION, NULL,
+						"auth algorithm %u conflicts "
+						"with transform %u.\n",
+						lorv, trns->t_id);
+					return -1;
+				}
+				break;
+			case IPSECDOI_ATTR_AUTH_HMAC_SHA1:
+				if (proto_id == IPSECDOI_PROTO_IPSEC_AH) {
+					if (trns->t_id != IPSECDOI_AH_SHA)
+						goto ahmismatch;
+				}
+				break;
+ 			case IPSECDOI_ATTR_AUTH_HMAC_SHA2_256:
+ 				if (proto_id == IPSECDOI_PROTO_IPSEC_AH) {
+ 					if (trns->t_id != IPSECDOI_AH_SHA256)
+ 						goto ahmismatch;
+ 				}	
+ 				break;
+ 			case IPSECDOI_ATTR_AUTH_HMAC_SHA2_384:
+ 				if (proto_id == IPSECDOI_PROTO_IPSEC_AH) {
+ 					if (trns->t_id != IPSECDOI_AH_SHA384)
+ 						goto ahmismatch;
+ 				}
+ 				break;
+ 			case IPSECDOI_ATTR_AUTH_HMAC_SHA2_512:
+ 				if (proto_id == IPSECDOI_PROTO_IPSEC_AH) {
+ 					if (trns->t_id != IPSECDOI_AH_SHA512)
+ 					goto ahmismatch;
+ 				}
+ 				break;
+			case IPSECDOI_ATTR_AUTH_DES_MAC:
+			case IPSECDOI_ATTR_AUTH_KPDK:
+				plog(LLV_ERROR, LOCATION, NULL,
+					"auth algorithm %u isn't supported.\n",
+					lorv);
+				return -1;
+			default:
+				plog(LLV_ERROR, LOCATION, NULL,
+					"invalid auth algorithm=%u.\n",
+					lorv);
+				return -1;
+			}
+			break;
+
+		case IPSECDOI_ATTR_SA_LD_TYPE:
+			if (! flag) {
+				plog(LLV_ERROR, LOCATION, NULL,
+					"must be TV when LD_TYPE.\n");
+				return -1;
+			}
+
+			switch (lorv) {
+			case IPSECDOI_ATTR_SA_LD_TYPE_SEC:
+			case IPSECDOI_ATTR_SA_LD_TYPE_KB:
+				break;
+			default:
+				plog(LLV_ERROR, LOCATION, NULL,
+					"invalid life type %d.\n", lorv);
+				return -1;
+			}
+			break;
+
+		case IPSECDOI_ATTR_SA_LD:
+			if (flag) {
+				/* i.e. ISAKMP_GEN_TV */
+				plog(LLV_DEBUG, LOCATION, NULL,
+					"life duration was in TLV.\n");
+			} else {
+				/* i.e. ISAKMP_GEN_TLV */
+				if (lorv == 0) {
+					plog(LLV_ERROR, LOCATION, NULL,
+						"invalid length of LD\n");
+					return -1;
+				}
+			}
+			break;
+
+		case IPSECDOI_ATTR_GRP_DESC:
+			if (! flag) {
+				plog(LLV_ERROR, LOCATION, NULL,
+					"must be TV when GRP_DESC.\n");
+				return -1;
+			}
+
+			if (!alg_oakley_dhdef_ok(lorv)) {
+				plog(LLV_ERROR, LOCATION, NULL,
+					"invalid group description=%u.\n",
+					lorv);
+				return -1;
+			}
+			break;
+
+		case IPSECDOI_ATTR_KEY_LENGTH:
+			if (! flag) {
+				plog(LLV_ERROR, LOCATION, NULL,
+					"must be TV when KEY_LENGTH.\n");
+				return -1;
+			}
+			break;
+
+#ifdef HAVE_SECCTX
+		case IPSECDOI_ATTR_SECCTX:
+			if (flag) {
+				plog(LLV_ERROR, LOCATION, NULL,
+					"SECCTX must be in TLV.\n");
+				return -1;
+			}
+		break;
+#endif
+
+		case IPSECDOI_ATTR_KEY_ROUNDS:
+		case IPSECDOI_ATTR_COMP_DICT_SIZE:
+		case IPSECDOI_ATTR_COMP_PRIVALG:
+			plog(LLV_ERROR, LOCATION, NULL,
+				"attr type=%u isn't supported.\n", type);
+			return -1;
+
+		default:
+			plog(LLV_ERROR, LOCATION, NULL,
+				"invalid attribute type %d.\n", type);
+			return -1;
+		}
+
+		if (flag) {
+			tlen -= sizeof(*d);
+			d = (struct isakmp_data *)((char *)d
+				+ sizeof(*d));
+		} else {
+			tlen -= (sizeof(*d) + lorv);
+			d = (struct isakmp_data *)((caddr_t)d
+				+ sizeof(*d) + lorv);
+		}
+	}
+
+	if (proto_id == IPSECDOI_PROTO_IPSEC_AH &&
+	    !attrseen[IPSECDOI_ATTR_AUTH]) {
+		plog(LLV_ERROR, LOCATION, NULL,
+			"attr AUTH must be present for AH.\n");
+		return -1;
+	}
+
+	if (proto_id == IPSECDOI_PROTO_IPSEC_ESP &&
+	    trns->t_id == IPSECDOI_ESP_NULL &&
+	    !attrseen[IPSECDOI_ATTR_AUTH]) {
+		plog(LLV_ERROR, LOCATION, NULL,
+		    "attr AUTH must be present for ESP NULL encryption.\n");
+		return -1;
+	}
+
+	return 0;
+}
+
+static int
+check_attr_ipcomp(trns)
+	struct isakmp_pl_t *trns;
+{
+	struct isakmp_data *d;
+	int tlen;
+	int flag, type = 0;
+	u_int16_t lorv;
+	int attrseen[16];	/* XXX magic number */
+
+	tlen = ntohs(trns->h.len) - sizeof(struct isakmp_pl_t);
+	d = (struct isakmp_data *)((caddr_t)trns + sizeof(struct isakmp_pl_t));
+	memset(attrseen, 0, sizeof(attrseen));
+
+	while (tlen > 0) {
+		type = ntohs(d->type) & ~ISAKMP_GEN_MASK;
+		flag = ntohs(d->type) & ISAKMP_GEN_MASK;
+		lorv = ntohs(d->lorv);
+
+		plog(LLV_DEBUG, LOCATION, NULL,
+			"type=%d, flag=0x%04x, lorv=0x%04x\n",
+			type, flag, lorv);
+
+		if (type < sizeof(attrseen)/sizeof(attrseen[0]))
+			attrseen[type]++;
+
+		switch (type) {
+		case IPSECDOI_ATTR_ENC_MODE:
+			if (! flag) {
+				plog(LLV_ERROR, LOCATION, NULL,
+					"must be TV when ENC_MODE.\n");
+				return -1;
+			}
+
+			switch (lorv) {
+			case IPSECDOI_ATTR_ENC_MODE_TUNNEL:
+			case IPSECDOI_ATTR_ENC_MODE_TRNS:
+				break;
+#ifdef ENABLE_NATT
+			case IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC:
+			case IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC:
+			case IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_DRAFT:
+			case IPSECDOI_ATTR_ENC_MODE_UDPTRNS_DRAFT:
+				plog(LLV_DEBUG, LOCATION, NULL,
+				     "UDP encapsulation requested\n");
+				break;
+#endif
+			default:
+				plog(LLV_ERROR, LOCATION, NULL,
+					"invalid encryption mode=%u.\n",
+					lorv);
+				return -1;
+			}
+			break;
+
+		case IPSECDOI_ATTR_SA_LD_TYPE:
+			if (! flag) {
+				plog(LLV_ERROR, LOCATION, NULL,
+					"must be TV when LD_TYPE.\n");
+				return -1;
+			}
+
+			switch (lorv) {
+			case IPSECDOI_ATTR_SA_LD_TYPE_SEC:
+			case IPSECDOI_ATTR_SA_LD_TYPE_KB:
+				break;
+			default:
+				plog(LLV_ERROR, LOCATION, NULL,
+					"invalid life type %d.\n", lorv);
+				return -1;
+			}
+			break;
+
+		case IPSECDOI_ATTR_SA_LD:
+			if (flag) {
+				/* i.e. ISAKMP_GEN_TV */
+				plog(LLV_DEBUG, LOCATION, NULL,
+					"life duration was in TLV.\n");
+			} else {
+				/* i.e. ISAKMP_GEN_TLV */
+				if (lorv == 0) {
+					plog(LLV_ERROR, LOCATION, NULL,
+						"invalid length of LD\n");
+					return -1;
+				}
+			}
+			break;
+
+		case IPSECDOI_ATTR_GRP_DESC:
+			if (! flag) {
+				plog(LLV_ERROR, LOCATION, NULL,
+					"must be TV when GRP_DESC.\n");
+				return -1;
+			}
+
+			if (!alg_oakley_dhdef_ok(lorv)) {
+				plog(LLV_ERROR, LOCATION, NULL,
+					"invalid group description=%u.\n",
+					lorv);
+				return -1;
+			}
+			break;
+
+		case IPSECDOI_ATTR_AUTH:
+			plog(LLV_ERROR, LOCATION, NULL,
+				"invalid attr type=%u.\n", type);
+			return -1;
+
+		case IPSECDOI_ATTR_KEY_LENGTH:
+		case IPSECDOI_ATTR_KEY_ROUNDS:
+		case IPSECDOI_ATTR_COMP_DICT_SIZE:
+		case IPSECDOI_ATTR_COMP_PRIVALG:
+			plog(LLV_ERROR, LOCATION, NULL,
+				"attr type=%u isn't supported.\n", type);
+			return -1;
+
+		default:
+			plog(LLV_ERROR, LOCATION, NULL,
+				"invalid attribute type %d.\n", type);
+			return -1;
+		}
+
+		if (flag) {
+			tlen -= sizeof(*d);
+			d = (struct isakmp_data *)((char *)d
+				+ sizeof(*d));
+		} else {
+			tlen -= (sizeof(*d) + lorv);
+			d = (struct isakmp_data *)((caddr_t)d
+				+ sizeof(*d) + lorv);
+		}
+	}
+
+#if 0
+	if (proto_id == IPSECDOI_PROTO_IPCOMP &&
+	    !attrseen[IPSECDOI_ATTR_AUTH]) {
+		plog(LLV_ERROR, LOCATION, NULL,
+			"attr AUTH must be present for AH.\n", type);
+		return -1;
+	}
+#endif
+
+	return 0;
+}
+
+/* %%% */
+/*
+ * create phase1 proposal from remote configuration.
+ * NOT INCLUDING isakmp general header of SA payload
+ */
+vchar_t *
+ipsecdoi_setph1proposal(rmconf, props)
+	struct remoteconf *rmconf;
+	struct isakmpsa *props;
+{
+	vchar_t *mysa;
+	int sablen;
+
+	/* count total size of SA minus isakmp general header */
+	/* not including isakmp general header of SA payload */
+	sablen = sizeof(struct ipsecdoi_sa_b);
+	sablen += setph1prop(props, NULL);
+
+	mysa = vmalloc(sablen);
+	if (mysa == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL,
+			"failed to allocate my sa buffer\n");
+		return NULL;
+	}
+
+	/* create SA payload */
+	/* not including isakmp general header */
+	((struct ipsecdoi_sa_b *)mysa->v)->doi = htonl(rmconf->doitype);
+	((struct ipsecdoi_sa_b *)mysa->v)->sit = htonl(rmconf->sittype);
+
+	(void)setph1prop(props, mysa->v + sizeof(struct ipsecdoi_sa_b));
+
+	return mysa;
+}
+
+static int
+setph1prop(props, buf)
+	struct isakmpsa *props;
+	caddr_t buf;
+{
+	struct isakmp_pl_p *prop = NULL;
+	struct isakmpsa *s = NULL;
+	int proplen, trnslen;
+	u_int8_t *np_t; /* pointer next trns type in previous header */
+	int trns_num;
+	caddr_t p = buf;
+
+	proplen = sizeof(*prop);
+	if (buf) {
+		/* create proposal */
+		prop = (struct isakmp_pl_p *)p;
+		prop->h.np = ISAKMP_NPTYPE_NONE;
+		prop->p_no = props->prop_no;
+		prop->proto_id = IPSECDOI_PROTO_ISAKMP;
+		prop->spi_size = 0;
+		p += sizeof(*prop);
+	}
+
+	np_t = NULL;
+	trns_num = 0;
+
+	for (s = props; s != NULL; s = s->next) {
+		if (np_t)
+			*np_t = ISAKMP_NPTYPE_T;
+
+		trnslen = setph1trns(s, p);
+		proplen += trnslen;
+		if (buf) {
+			/* save buffer to pre-next payload */
+			np_t = &((struct isakmp_pl_t *)p)->h.np;
+			p += trnslen;
+
+			/* count up transform length */
+			trns_num++;
+		}
+	}
+
+	/* update proposal length */
+	if (buf) {
+		prop->h.len = htons(proplen);
+		prop->num_t = trns_num;
+	}
+
+	return proplen;
+}
+
+static int
+setph1trns(sa, buf)
+	struct isakmpsa *sa;
+	caddr_t buf;
+{
+	struct isakmp_pl_t *trns = NULL;
+	int trnslen, attrlen;
+	caddr_t p = buf;
+
+	trnslen = sizeof(*trns);
+	if (buf) {
+		/* create transform */
+		trns = (struct isakmp_pl_t *)p;
+		trns->h.np  = ISAKMP_NPTYPE_NONE;
+		trns->t_no  = sa->trns_no;
+		trns->t_id  = IPSECDOI_KEY_IKE;
+		p += sizeof(*trns);
+	}
+
+	attrlen = setph1attr(sa, p);
+	trnslen += attrlen;
+	if (buf)
+		p += attrlen;
+
+	if (buf)
+		trns->h.len = htons(trnslen);
+
+	return trnslen;
+}
+
+static int
+setph1attr(sa, buf)
+	struct isakmpsa *sa;
+	caddr_t buf;
+{
+	caddr_t p = buf;
+	int attrlen = 0;
+
+	if (sa->lifetime) {
+		u_int32_t lifetime = htonl((u_int32_t)sa->lifetime);
+
+		attrlen += sizeof(struct isakmp_data)
+			+ sizeof(struct isakmp_data);
+		if (sa->lifetime > 0xffff)
+			attrlen += sizeof(lifetime);
+		if (buf) {
+			p = isakmp_set_attr_l(p, OAKLEY_ATTR_SA_LD_TYPE,
+						OAKLEY_ATTR_SA_LD_TYPE_SEC);
+			if (sa->lifetime > 0xffff) {
+				p = isakmp_set_attr_v(p, OAKLEY_ATTR_SA_LD,
+						(caddr_t)&lifetime, 
+						sizeof(lifetime));
+			} else {
+				p = isakmp_set_attr_l(p, OAKLEY_ATTR_SA_LD,
+							sa->lifetime);
+			}
+		}
+	}
+
+	if (sa->lifebyte) {
+		u_int32_t lifebyte = htonl((u_int32_t)sa->lifebyte);
+		
+		attrlen += sizeof(struct isakmp_data)
+			+ sizeof(struct isakmp_data);
+		if (sa->lifebyte > 0xffff)
+			attrlen += sizeof(lifebyte);
+		if (buf) {
+			p = isakmp_set_attr_l(p, OAKLEY_ATTR_SA_LD_TYPE,
+						OAKLEY_ATTR_SA_LD_TYPE_KB);
+			if (sa->lifebyte > 0xffff) {
+				p = isakmp_set_attr_v(p, OAKLEY_ATTR_SA_LD,
+							(caddr_t)&lifebyte,
+							sizeof(lifebyte));
+			} else {
+				p = isakmp_set_attr_l(p, OAKLEY_ATTR_SA_LD,
+							sa->lifebyte);
+			}
+		}
+	}
+
+	if (sa->enctype) {
+		attrlen += sizeof(struct isakmp_data);
+		if (buf)
+			p = isakmp_set_attr_l(p, OAKLEY_ATTR_ENC_ALG, sa->enctype);
+	}
+	if (sa->encklen) {
+		attrlen += sizeof(struct isakmp_data);
+		if (buf)
+			p = isakmp_set_attr_l(p, OAKLEY_ATTR_KEY_LEN, sa->encklen);
+	}
+	if (sa->authmethod) {
+		int authmethod;
+
+#ifdef ENABLE_HYBRID
+		authmethod = switch_authmethod(sa->authmethod);
+#else
+		authmethod = sa->authmethod;
+#endif
+		attrlen += sizeof(struct isakmp_data);
+		if (buf)
+			p = isakmp_set_attr_l(p, OAKLEY_ATTR_AUTH_METHOD, authmethod);
+	}
+	if (sa->hashtype) {
+		attrlen += sizeof(struct isakmp_data);
+		if (buf)
+			p = isakmp_set_attr_l(p, OAKLEY_ATTR_HASH_ALG, sa->hashtype);
+	}
+	switch (sa->dh_group) {
+	case OAKLEY_ATTR_GRP_DESC_MODP768:
+	case OAKLEY_ATTR_GRP_DESC_MODP1024:
+	case OAKLEY_ATTR_GRP_DESC_MODP1536:
+	case OAKLEY_ATTR_GRP_DESC_MODP2048:
+	case OAKLEY_ATTR_GRP_DESC_MODP3072:
+	case OAKLEY_ATTR_GRP_DESC_MODP4096:
+	case OAKLEY_ATTR_GRP_DESC_MODP6144:
+	case OAKLEY_ATTR_GRP_DESC_MODP8192:
+		/* don't attach group type for known groups */
+		attrlen += sizeof(struct isakmp_data);
+		if (buf) {
+			p = isakmp_set_attr_l(p, OAKLEY_ATTR_GRP_DESC,
+				sa->dh_group);
+		}
+		break;
+	case OAKLEY_ATTR_GRP_DESC_EC2N155:
+	case OAKLEY_ATTR_GRP_DESC_EC2N185:
+		/* don't attach group type for known groups */
+		attrlen += sizeof(struct isakmp_data);
+		if (buf) {
+			p = isakmp_set_attr_l(p, OAKLEY_ATTR_GRP_TYPE,
+				OAKLEY_ATTR_GRP_TYPE_EC2N);
+		}
+		break;
+	case 0:
+	default:
+		break;
+	}
+
+#ifdef HAVE_GSSAPI
+	if (sa->authmethod == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB &&
+	    sa->gssid != NULL) {
+		attrlen += sizeof(struct isakmp_data);
+		/*
+		 * Older versions of racoon just placed the ISO-Latin-1
+		 * string on the wire directly.  Check to see if we are
+		 * configured to be compatible with this behavior.  Otherwise,
+		 * we encode the GSS ID as UTF-16LE for Windows 2000
+		 * compatibility, which requires twice the number of octets.
+		 */
+		if (lcconf->gss_id_enc == LC_GSSENC_LATIN1)
+			attrlen += sa->gssid->l;
+		else
+			attrlen += sa->gssid->l * 2;
+		if (buf) {
+			plog(LLV_DEBUG, LOCATION, NULL, "gss id attr: len %zu, "
+			    "val '%.*s'\n", sa->gssid->l, (int)sa->gssid->l,
+			    sa->gssid->v);
+			if (lcconf->gss_id_enc == LC_GSSENC_LATIN1) {
+				p = isakmp_set_attr_v(p, OAKLEY_ATTR_GSS_ID,
+					(caddr_t)sa->gssid->v,
+					sa->gssid->l);
+			} else {
+				size_t dstleft = sa->gssid->l * 2;
+				size_t srcleft = sa->gssid->l;
+				const char *src = (const char *)sa->gssid->v;
+				char *odst, *dst = racoon_malloc(dstleft);
+				iconv_t cd;
+				size_t rv;
+
+				cd = iconv_open("utf-16le", "latin1");
+				if (cd == (iconv_t) -1) {
+					plog(LLV_ERROR, LOCATION, NULL,
+					    "unable to initialize "
+					    "latin1 -> utf-16le "
+					    "converstion descriptor: %s\n",
+					    strerror(errno));
+					attrlen -= sa->gssid->l * 2;
+					goto gssid_done;
+				}
+				odst = dst;
+				rv = iconv(cd, (__iconv_const char **)&src, 
+				    &srcleft, &dst, &dstleft);
+				if (rv != 0) {
+					if (rv == -1) {
+						plog(LLV_ERROR, LOCATION, NULL,
+						    "unable to convert GSS ID "
+						    "from latin1 -> utf-16le: "
+						    "%s\n", strerror(errno));
+					} else {
+						/* should never happen */
+						plog(LLV_ERROR, LOCATION, NULL,
+						    "%zd character%s in GSS ID "
+						    "cannot be represented "
+						    "in utf-16le\n",
+						    rv, rv == 1 ? "" : "s");
+					}
+					(void) iconv_close(cd);
+					attrlen -= sa->gssid->l * 2;
+					goto gssid_done;
+				}
+				(void) iconv_close(cd);
+
+				/* XXX Check srcleft and dstleft? */
+
+				p = isakmp_set_attr_v(p, OAKLEY_ATTR_GSS_ID,
+					odst, sa->gssid->l * 2);
+
+				racoon_free(odst);
+			}
+		}
+	}
+ gssid_done:
+#endif /* HAVE_GSSAPI */
+
+	return attrlen;
+}
+
+static vchar_t *
+setph2proposal0(iph2, pp, pr)
+	const struct ph2handle *iph2;
+	const struct saprop *pp;
+	const struct saproto *pr;
+{
+	vchar_t *p;
+	struct isakmp_pl_p *prop;
+	struct isakmp_pl_t *trns;
+	struct satrns *tr;
+	int attrlen;
+	size_t trnsoff;
+	caddr_t x0, x;
+	u_int8_t *np_t; /* pointer next trns type in previous header */
+	const u_int8_t *spi;
+#ifdef HAVE_SECCTX
+	int truectxlen = 0;
+#endif
+
+	p = vmalloc(sizeof(*prop) + sizeof(pr->spi));
+	if (p == NULL)
+		return NULL;
+
+	/* create proposal */
+	prop = (struct isakmp_pl_p *)p->v;
+	prop->h.np = ISAKMP_NPTYPE_NONE;
+	prop->p_no = pp->prop_no;
+	prop->proto_id = pr->proto_id;
+	prop->num_t = 1;
+
+	spi = (const u_int8_t *)&pr->spi;
+	switch (pr->proto_id) {
+	case IPSECDOI_PROTO_IPCOMP:
+		/*
+		 * draft-shacham-ippcp-rfc2393bis-05.txt:
+		 * construct 16bit SPI (CPI).
+		 * XXX we may need to provide a configuration option to
+		 * generate 32bit SPI.  otherwise we cannot interoeprate
+		 * with nodes that uses 32bit SPI, in case we are initiator.
+		 */
+		prop->spi_size = sizeof(u_int16_t);
+		spi += sizeof(pr->spi) - sizeof(u_int16_t);
+		p->l -= sizeof(pr->spi);
+		p->l += sizeof(u_int16_t);
+		break;
+	default:
+		prop->spi_size = sizeof(pr->spi);
+		break;
+	}
+	memcpy(prop + 1, spi, prop->spi_size);
+
+	/* create transform */
+	trnsoff = sizeof(*prop) + prop->spi_size;
+	np_t = NULL;
+
+	for (tr = pr->head; tr; tr = tr->next) {
+	
+		switch (pr->proto_id) {
+		case IPSECDOI_PROTO_IPSEC_ESP:
+			/*
+			 * don't build a null encryption
+			 * with no authentication transform.
+			 */
+			if (tr->trns_id == IPSECDOI_ESP_NULL &&
+			    tr->authtype == IPSECDOI_ATTR_AUTH_NONE)
+				continue;
+			break;
+		}
+
+		if (np_t) {
+			*np_t = ISAKMP_NPTYPE_T;
+			prop->num_t++;
+		}
+
+		/* get attribute length */
+		attrlen = 0;
+		if (pp->lifetime) {
+			attrlen += sizeof(struct isakmp_data)
+				+ sizeof(struct isakmp_data);
+			if (pp->lifetime > 0xffff)
+				attrlen += sizeof(u_int32_t);
+		}
+		if (pp->lifebyte && pp->lifebyte != IPSECDOI_ATTR_SA_LD_KB_MAX) {
+			attrlen += sizeof(struct isakmp_data)
+				+ sizeof(struct isakmp_data);
+			if (pp->lifebyte > 0xffff)
+				attrlen += sizeof(u_int32_t);
+		}
+		attrlen += sizeof(struct isakmp_data);	/* enc mode */
+		if (tr->encklen)
+			attrlen += sizeof(struct isakmp_data);
+
+		switch (pr->proto_id) {
+		case IPSECDOI_PROTO_IPSEC_ESP:
+			/* non authentication mode ? */
+			if (tr->authtype != IPSECDOI_ATTR_AUTH_NONE)
+				attrlen += sizeof(struct isakmp_data);
+			break;
+		case IPSECDOI_PROTO_IPSEC_AH:
+			if (tr->authtype == IPSECDOI_ATTR_AUTH_NONE) {
+				plog(LLV_ERROR, LOCATION, NULL,
+					"no authentication algorithm found "
+					"but protocol is AH.\n");
+				vfree(p);
+				return NULL;
+			}
+			attrlen += sizeof(struct isakmp_data);
+			break;
+		case IPSECDOI_PROTO_IPCOMP:
+			break;
+		default:
+			plog(LLV_ERROR, LOCATION, NULL,
+				"invalid protocol: %d\n", pr->proto_id);
+			vfree(p);
+			return NULL;
+		}
+
+		if (alg_oakley_dhdef_ok(iph2->sainfo->pfs_group))
+			attrlen += sizeof(struct isakmp_data);
+
+#ifdef HAVE_SECCTX
+		/* ctx_str is defined as char ctx_str[MAX_CTXSTR_SIZ].
+		 * The string may be smaller than MAX_CTXSTR_SIZ.
+		 */
+		if (*pp->sctx.ctx_str) {
+			truectxlen = sizeof(struct security_ctx) -
+				     (MAX_CTXSTR_SIZE - pp->sctx.ctx_strlen);
+			attrlen += sizeof(struct isakmp_data) + truectxlen;
+		}
+#endif /* HAVE_SECCTX */
+
+		p = vrealloc(p, p->l + sizeof(*trns) + attrlen);
+		if (p == NULL)
+			return NULL;
+		prop = (struct isakmp_pl_p *)p->v;
+
+		/* set transform's values */
+		trns = (struct isakmp_pl_t *)(p->v + trnsoff);
+		trns->h.np  = ISAKMP_NPTYPE_NONE;
+		trns->t_no  = tr->trns_no;
+		trns->t_id  = tr->trns_id;
+
+		/* set attributes */
+		x = x0 = p->v + trnsoff + sizeof(*trns);
+
+		if (pp->lifetime) {
+			x = isakmp_set_attr_l(x, IPSECDOI_ATTR_SA_LD_TYPE,
+						IPSECDOI_ATTR_SA_LD_TYPE_SEC);
+			if (pp->lifetime > 0xffff) {
+				u_int32_t v = htonl((u_int32_t)pp->lifetime);
+				x = isakmp_set_attr_v(x, IPSECDOI_ATTR_SA_LD,
+							(caddr_t)&v, sizeof(v));
+			} else {
+				x = isakmp_set_attr_l(x, IPSECDOI_ATTR_SA_LD,
+							pp->lifetime);
+			}
+		}
+
+		if (pp->lifebyte && pp->lifebyte != IPSECDOI_ATTR_SA_LD_KB_MAX) {
+			x = isakmp_set_attr_l(x, IPSECDOI_ATTR_SA_LD_TYPE,
+						IPSECDOI_ATTR_SA_LD_TYPE_KB);
+			if (pp->lifebyte > 0xffff) {
+				u_int32_t v = htonl((u_int32_t)pp->lifebyte);
+				x = isakmp_set_attr_v(x, IPSECDOI_ATTR_SA_LD,
+							(caddr_t)&v, sizeof(v));
+			} else {
+				x = isakmp_set_attr_l(x, IPSECDOI_ATTR_SA_LD,
+							pp->lifebyte);
+			}
+		}
+
+		x = isakmp_set_attr_l(x, IPSECDOI_ATTR_ENC_MODE, pr->encmode);
+
+		if (tr->encklen)
+			x = isakmp_set_attr_l(x, IPSECDOI_ATTR_KEY_LENGTH, tr->encklen);
+
+		/* mandatory check has done above. */
+		if ((pr->proto_id == IPSECDOI_PROTO_IPSEC_ESP && tr->authtype != IPSECDOI_ATTR_AUTH_NONE)
+		 || pr->proto_id == IPSECDOI_PROTO_IPSEC_AH)
+			x = isakmp_set_attr_l(x, IPSECDOI_ATTR_AUTH, tr->authtype);
+
+		if (alg_oakley_dhdef_ok(iph2->sainfo->pfs_group))
+			x = isakmp_set_attr_l(x, IPSECDOI_ATTR_GRP_DESC,
+				iph2->sainfo->pfs_group);
+
+#ifdef HAVE_SECCTX
+		if (*pp->sctx.ctx_str) {
+			struct security_ctx secctx;
+			secctx = pp->sctx;
+			secctx.ctx_strlen = htons(pp->sctx.ctx_strlen);
+			x = isakmp_set_attr_v(x, IPSECDOI_ATTR_SECCTX,
+					     (caddr_t)&secctx, truectxlen);
+		}
+#endif
+		/* update length of this transform. */
+		trns = (struct isakmp_pl_t *)(p->v + trnsoff);
+		trns->h.len = htons(sizeof(*trns) + attrlen);
+
+		/* save buffer to pre-next payload */
+		np_t = &trns->h.np;
+
+		trnsoff += (sizeof(*trns) + attrlen);
+	}
+
+	if (np_t == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL,
+			"no suitable proposal was created.\n");
+		return NULL;
+	}
+
+	/* update length of this protocol. */
+	prop->h.len = htons(p->l);
+
+	return p;
+}
+
+/*
+ * create phase2 proposal from policy configuration.
+ * NOT INCLUDING isakmp general header of SA payload.
+ * This function is called by initiator only.
+ */
+int
+ipsecdoi_setph2proposal(iph2)
+	struct ph2handle *iph2;
+{
+	struct saprop *proposal, *a;
+	struct saproto *b = NULL;
+	vchar_t *q;
+	struct ipsecdoi_sa_b *sab;
+	struct isakmp_pl_p *prop;
+	size_t propoff;	/* for previous field of type of next payload. */
+
+	proposal = iph2->proposal;
+
+	iph2->sa = vmalloc(sizeof(*sab));
+	if (iph2->sa == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL,
+			"failed to allocate my sa buffer\n");
+		return -1;
+	}
+
+	/* create SA payload */
+	sab = (struct ipsecdoi_sa_b *)iph2->sa->v;
+	sab->doi = htonl(IPSEC_DOI);
+	sab->sit = htonl(IPSECDOI_SIT_IDENTITY_ONLY);	/* XXX configurable ? */
+
+	prop = NULL;
+	propoff = 0;
+	for (a = proposal; a; a = a->next) {
+		for (b = a->head; b; b = b->next) {
+#ifdef ENABLE_NATT
+			if (iph2->ph1->natt_flags & NAT_DETECTED) {
+			  int udp_diff = iph2->ph1->natt_options->mode_udp_diff;
+			  plog (LLV_INFO, LOCATION, NULL,
+				"NAT detected -> UDP encapsulation "
+				"(ENC_MODE %d->%d).\n",
+				b->encmode,
+				b->encmode+udp_diff);
+			  /* Tunnel -> UDP-Tunnel, Transport -> UDP_Transport */
+			  b->encmode += udp_diff;
+			  b->udp_encap = 1;
+			}
+#endif
+
+			q = setph2proposal0(iph2, a, b);
+			if (q == NULL) {
+				VPTRINIT(iph2->sa);
+				return -1;
+			}
+
+			iph2->sa = vrealloc(iph2->sa, iph2->sa->l + q->l);
+			if (iph2->sa == NULL) {
+				plog(LLV_ERROR, LOCATION, NULL,
+					"failed to allocate my sa buffer\n");
+				if (q)
+					vfree(q);
+				return -1;
+			}
+			memcpy(iph2->sa->v + iph2->sa->l - q->l, q->v, q->l);
+			if (propoff != 0) {
+				prop = (struct isakmp_pl_p *)(iph2->sa->v +
+					propoff);
+				prop->h.np = ISAKMP_NPTYPE_P;
+			}
+			propoff = iph2->sa->l - q->l;
+
+			vfree(q);
+		}
+	}
+
+	return 0;
+}
+
+/*
+ * return 1 if all of the given protocols are transport mode.
+ */
+int
+ipsecdoi_transportmode(pp)
+	struct saprop *pp;
+{
+	struct saproto *pr = NULL;
+
+	for (; pp; pp = pp->next) {
+		for (pr = pp->head; pr; pr = pr->next) {
+			if (pr->encmode != IPSECDOI_ATTR_ENC_MODE_TRNS)
+				return 0;
+		}
+	}
+
+	return 1;
+}
+
+int
+ipsecdoi_get_defaultlifetime()
+{
+	return IPSECDOI_ATTR_SA_LD_SEC_DEFAULT;
+}
+
+int
+ipsecdoi_checkalgtypes(proto_id, enc, auth, comp)
+	int proto_id, enc, auth, comp;
+{
+#define TMPALGTYPE2STR(n) s_algtype(algclass_ipsec_##n, n)
+	switch (proto_id) {
+	case IPSECDOI_PROTO_IPSEC_ESP:
+		if (enc == 0 || comp != 0) {
+			plog(LLV_ERROR, LOCATION, NULL,
+				"illegal algorithm defined "
+				"ESP enc=%s auth=%s comp=%s.\n",
+				TMPALGTYPE2STR(enc),
+				TMPALGTYPE2STR(auth),
+				TMPALGTYPE2STR(comp));
+			return -1;
+		}
+		break;
+	case IPSECDOI_PROTO_IPSEC_AH:
+		if (enc != 0 || auth == 0 || comp != 0) {
+			plog(LLV_ERROR, LOCATION, NULL,
+				"illegal algorithm defined "
+				"AH enc=%s auth=%s comp=%s.\n",
+				TMPALGTYPE2STR(enc),
+				TMPALGTYPE2STR(auth),
+				TMPALGTYPE2STR(comp));
+			return -1;
+		}
+		break;
+	case IPSECDOI_PROTO_IPCOMP:
+		if (enc != 0 || auth != 0 || comp == 0) {
+			plog(LLV_ERROR, LOCATION, NULL,
+				"illegal algorithm defined "
+				"IPcomp enc=%s auth=%s comp=%s.\n",
+				TMPALGTYPE2STR(enc),
+				TMPALGTYPE2STR(auth),
+				TMPALGTYPE2STR(comp));
+			return -1;
+		}
+		break;
+	default:
+		plog(LLV_ERROR, LOCATION, NULL,
+			"invalid ipsec protocol %d\n", proto_id);
+		return -1;
+	}
+#undef TMPALGTYPE2STR
+	return 0;
+}
+
+int
+ipproto2doi(proto)
+	int proto;
+{
+	switch (proto) {
+	case IPPROTO_AH:
+		return IPSECDOI_PROTO_IPSEC_AH;
+	case IPPROTO_ESP:
+		return IPSECDOI_PROTO_IPSEC_ESP;
+	case IPPROTO_IPCOMP:
+		return IPSECDOI_PROTO_IPCOMP;
+	}
+	return -1;	/* XXX */
+}
+
+int
+doi2ipproto(proto)
+	int proto;
+{
+	switch (proto) {
+	case IPSECDOI_PROTO_IPSEC_AH:
+		return IPPROTO_AH;
+	case IPSECDOI_PROTO_IPSEC_ESP:
+		return IPPROTO_ESP;
+	case IPSECDOI_PROTO_IPCOMP:
+		return IPPROTO_IPCOMP;
+	}
+	return -1;	/* XXX */
+}
+
+/*
+ * Check if a subnet id is valid for comparison
+ * with an address id ( address length mask )
+ * and compare them
+ * Return value
+ * =  0 for match
+ * =  1 for mismatch
+ */
+
+int
+ipsecdoi_subnetisaddr_v4( subnet, address )
+	const vchar_t *subnet;
+	const vchar_t *address;
+{
+	struct in_addr *mask;
+
+	if (address->l != sizeof(struct in_addr))
+		return 1;
+
+	if (subnet->l != (sizeof(struct in_addr)*2))
+		return 1;
+
+	mask = (struct in_addr*)(subnet->v + sizeof(struct in_addr));
+
+	if (mask->s_addr!=0xffffffff)
+		return 1;
+
+	return memcmp(subnet->v,address->v,address->l);
+}
+
+#ifdef INET6
+
+int
+ipsecdoi_subnetisaddr_v6( subnet, address )
+	const vchar_t *subnet;
+	const vchar_t *address;
+{
+	struct in6_addr *mask;
+	int i;
+
+	if (address->l != sizeof(struct in6_addr))
+		return 1;
+
+	if (subnet->l != (sizeof(struct in6_addr)*2))
+		return 1;
+
+	mask = (struct in6_addr*)(subnet->v + sizeof(struct in6_addr));
+
+	for (i=0; i<16; i++)
+		if(mask->s6_addr[i]!=0xff)
+			return 1;
+
+	return memcmp(subnet->v,address->v,address->l);
+}
+
+#endif
+
+/*
+ * Check and Compare two IDs
+ * - specify 0 for exact if wildcards are allowed
+ * Return value
+ * =  0 for match
+ * =  1 for misatch
+ * = -1 for integrity error
+ */
+
+int
+ipsecdoi_chkcmpids( idt, ids, exact )
+	const vchar_t *idt; /* id cmp target */
+	const vchar_t *ids; /* id cmp source */
+	int exact;
+{
+	struct ipsecdoi_id_b *id_bt;
+	struct ipsecdoi_id_b *id_bs;
+	vchar_t ident_t;
+	vchar_t ident_s;
+	int result;
+
+	/* handle wildcard IDs */
+
+	if (idt == NULL || ids == NULL)
+	{
+		if( !exact )
+		{
+			plog(LLV_DEBUG, LOCATION, NULL,
+				"check and compare ids : values matched (ANONYMOUS)\n" );
+			return 0;
+		}
+		else
+		{
+			plog(LLV_DEBUG, LOCATION, NULL,
+				"check and compare ids : value mismatch (ANONYMOUS)\n" );
+			return -1;
+		}
+	}
+
+	/* make sure the ids are of the same type */
+
+	id_bt = (struct ipsecdoi_id_b *) idt->v;
+	id_bs = (struct ipsecdoi_id_b *) ids->v;
+
+	ident_t.v = idt->v + sizeof(*id_bt);
+	ident_t.l = idt->l - sizeof(*id_bt);
+	ident_s.v = ids->v + sizeof(*id_bs);
+	ident_s.l = ids->l - sizeof(*id_bs);
+
+	if (id_bs->type != id_bt->type)
+	{
+		/*
+		 * special exception for comparing
+                 * address to subnet id types when
+                 * the netmask is address length
+                 */
+
+		if ((id_bs->type == IPSECDOI_ID_IPV4_ADDR)&&
+		    (id_bt->type == IPSECDOI_ID_IPV4_ADDR_SUBNET)) {
+			result = ipsecdoi_subnetisaddr_v4(&ident_t,&ident_s);
+			goto cmpid_result;
+		}
+
+		if ((id_bs->type == IPSECDOI_ID_IPV4_ADDR_SUBNET)&&
+		    (id_bt->type == IPSECDOI_ID_IPV4_ADDR)) {
+			result = ipsecdoi_subnetisaddr_v4(&ident_s,&ident_t);
+			goto cmpid_result;
+		}
+
+#ifdef INET6
+		if ((id_bs->type == IPSECDOI_ID_IPV6_ADDR)&&
+		    (id_bt->type == IPSECDOI_ID_IPV6_ADDR_SUBNET)) {
+			result = ipsecdoi_subnetisaddr_v6(&ident_t,&ident_s);
+			goto cmpid_result;
+		}
+
+		if ((id_bs->type == IPSECDOI_ID_IPV6_ADDR_SUBNET)&&
+		    (id_bt->type == IPSECDOI_ID_IPV6_ADDR)) {
+			result = ipsecdoi_subnetisaddr_v6(&ident_s,&ident_t);
+			goto cmpid_result;
+		}
+#endif
+		plog(LLV_DEBUG, LOCATION, NULL,
+			"check and compare ids : id type mismatch %s != %s\n",
+			s_ipsecdoi_ident(id_bs->type),
+			s_ipsecdoi_ident(id_bt->type));
+
+		return 1;
+	}
+
+	if(id_bs->proto_id != id_bt->proto_id){
+		plog(LLV_DEBUG, LOCATION, NULL,
+			"check and compare ids : proto_id mismatch %d != %d\n",
+			id_bs->proto_id, id_bt->proto_id);
+
+		return 1;
+	}
+
+	/* compare the ID data. */
+
+	switch (id_bt->type) {
+	        case IPSECDOI_ID_DER_ASN1_DN:
+        	case IPSECDOI_ID_DER_ASN1_GN:
+			/* compare asn1 ids */
+			result = eay_cmp_asn1dn(&ident_t, &ident_s);
+			goto cmpid_result;
+
+		case IPSECDOI_ID_IPV4_ADDR:
+			/* validate lengths */
+			if ((ident_t.l != sizeof(struct in_addr))||
+			    (ident_s.l != sizeof(struct in_addr)))
+				goto cmpid_invalid;
+			break;
+
+		case IPSECDOI_ID_IPV4_ADDR_SUBNET:
+		case IPSECDOI_ID_IPV4_ADDR_RANGE:
+			/* validate lengths */
+			if ((ident_t.l != (sizeof(struct in_addr)*2))||
+			    (ident_s.l != (sizeof(struct in_addr)*2)))
+				goto cmpid_invalid;
+			break;
+
+#ifdef INET6
+		case IPSECDOI_ID_IPV6_ADDR:
+			/* validate lengths */
+			if ((ident_t.l != sizeof(struct in6_addr))||
+			    (ident_s.l != sizeof(struct in6_addr)))
+				goto cmpid_invalid;
+			break;
+
+		case IPSECDOI_ID_IPV6_ADDR_SUBNET:
+		case IPSECDOI_ID_IPV6_ADDR_RANGE:
+			/* validate lengths */
+			if ((ident_t.l != (sizeof(struct in6_addr)*2))||
+			    (ident_s.l != (sizeof(struct in6_addr)*2)))
+				goto cmpid_invalid;
+			break;
+#endif
+		case IPSECDOI_ID_FQDN:
+		case IPSECDOI_ID_USER_FQDN:
+		case IPSECDOI_ID_KEY_ID:
+			break;
+
+		default:
+			plog(LLV_ERROR, LOCATION, NULL,
+				"Unhandled id type %i specified for comparison\n",
+				id_bt->type);
+			return -1;
+	}
+
+	/* validate matching data and length */
+	if (ident_t.l == ident_s.l)
+		result = memcmp(ident_t.v,ident_s.v,ident_t.l);
+	else
+		result = 1;
+
+cmpid_result:
+
+	/* debug level output */
+	if(loglevel >= LLV_DEBUG) {
+		char *idstrt = ipsecdoi_id2str(idt);
+		char *idstrs = ipsecdoi_id2str(ids);
+
+		if (!result)
+	 		plog(LLV_DEBUG, LOCATION, NULL,
+				"check and compare ids : values matched (%s)\n",
+				 s_ipsecdoi_ident(id_bs->type) );
+		else
+ 			plog(LLV_DEBUG, LOCATION, NULL,
+				"check and compare ids : value mismatch (%s)\n",
+				 s_ipsecdoi_ident(id_bs->type));
+
+		plog(LLV_DEBUG, LOCATION, NULL, "cmpid target: \'%s\'\n", idstrt );
+		plog(LLV_DEBUG, LOCATION, NULL, "cmpid source: \'%s\'\n", idstrs );
+
+		racoon_free(idstrs);
+		racoon_free(idstrt);
+	}
+
+	/* return result */
+	if( !result )
+		return 0;
+	else
+		return 1;
+
+cmpid_invalid:
+
+	/* id integrity error */
+	plog(LLV_DEBUG, LOCATION, NULL, "check and compare ids : %s integrity error\n",
+		s_ipsecdoi_ident(id_bs->type));
+	plog(LLV_DEBUG, LOCATION, NULL, "cmpid target: length = \'%zu\'\n", ident_t.l );
+	plog(LLV_DEBUG, LOCATION, NULL, "cmpid source: length = \'%zu\'\n", ident_s.l );
+
+	return -1;
+}
+
+/*
+ * check the following:
+ * - In main mode with pre-shared key, only address type can be used.
+ * - if proper type for phase 1 ?
+ * - if phase 1 ID payload conformed RFC2407 4.6.2.
+ *   (proto, port) must be (0, 0), (udp, 500) or (udp, [specified]).
+ * - if ID payload sent from peer is equal to the ID expected by me.
+ *
+ * both of "id" and "id_p" should be ID payload without general header,
+ */
+int
+ipsecdoi_checkid1(iph1)
+	struct ph1handle *iph1;
+{
+	struct ipsecdoi_id_b *id_b;
+	struct sockaddr *sa;
+	caddr_t sa1, sa2;
+
+	if (iph1->id_p == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL,
+			"invalid iph1 passed id_p == NULL\n");
+		return ISAKMP_INTERNAL_ERROR;
+	}
+	if (iph1->id_p->l < sizeof(*id_b)) {
+		plog(LLV_ERROR, LOCATION, NULL,
+			"invalid value passed as \"ident\" (len=%lu)\n",
+			(u_long)iph1->id_p->l);
+		return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
+	}
+
+	id_b = (struct ipsecdoi_id_b *)iph1->id_p->v;
+
+	/* In main mode with pre-shared key, only address type can be used. */
+	if (iph1->etype == ISAKMP_ETYPE_IDENT &&
+	    iph1->approval->authmethod == OAKLEY_ATTR_AUTH_METHOD_PSKEY) {
+		 if (id_b->type != IPSECDOI_ID_IPV4_ADDR
+		  && id_b->type != IPSECDOI_ID_IPV6_ADDR) {
+			plog(LLV_ERROR, LOCATION, NULL,
+				"Expecting IP address type in main mode, "
+				"but %s.\n", s_ipsecdoi_ident(id_b->type));
+			return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
+		}
+	}
+
+	/* if proper type for phase 1 ? */
+	switch (id_b->type) {
+	case IPSECDOI_ID_IPV4_ADDR_SUBNET:
+	case IPSECDOI_ID_IPV6_ADDR_SUBNET:
+	case IPSECDOI_ID_IPV4_ADDR_RANGE:
+	case IPSECDOI_ID_IPV6_ADDR_RANGE:
+		plog(LLV_WARNING, LOCATION, NULL,
+			"such ID type %s is not proper.\n",
+			s_ipsecdoi_ident(id_b->type));
+		/*FALLTHROUGH*/
+	}
+
+	/* if phase 1 ID payload conformed RFC2407 4.6.2. */
+	if (id_b->type == IPSECDOI_ID_IPV4_ADDR ||
+	    id_b->type == IPSECDOI_ID_IPV6_ADDR) {
+
+		if (id_b->proto_id == 0 && ntohs(id_b->port) != 0) {
+			plog(LLV_WARNING, LOCATION, NULL,
+				"protocol ID and Port mismatched. "
+				"proto_id:%d port:%d\n",
+				id_b->proto_id, ntohs(id_b->port));
+			/*FALLTHROUGH*/
+
+		} else if (id_b->proto_id == IPPROTO_UDP) {
+			/*
+			 * copmaring with expecting port.
+			 * always permit if port is equal to PORT_ISAKMP
+			 */
+			if (ntohs(id_b->port) != PORT_ISAKMP) {
+				u_int16_t port;
+
+				port = extract_port(iph1->remote);
+				if (ntohs(id_b->port) != port) {
+					plog(LLV_WARNING, LOCATION, NULL,
+						"port %d expected, but %d\n",
+						port, ntohs(id_b->port));
+					/*FALLTHROUGH*/
+				}
+			}
+		}
+	}
+
+	/* compare with the ID if specified. */
+	if (genlist_next(iph1->rmconf->idvl_p, 0)) {
+		vchar_t *ident0 = NULL;
+		vchar_t ident;
+		struct idspec *id;
+		struct genlist_entry *gpb;
+
+		for (id = genlist_next (iph1->rmconf->idvl_p, &gpb); id; id = genlist_next (0, &gpb)) {
+			/* check the type of both IDs */
+			if (id->idtype != doi2idtype(id_b->type))
+				continue;  /* ID type mismatch */
+			if (id->id == 0)
+				goto matched;
+
+			/* compare defined ID with the ID sent by peer. */
+			if (ident0 != NULL)
+				vfree(ident0);
+			ident0 = getidval(id->idtype, id->id);
+
+			switch (id->idtype) {
+			case IDTYPE_ASN1DN:
+				ident.v = iph1->id_p->v + sizeof(*id_b);
+				ident.l = iph1->id_p->l - sizeof(*id_b);
+				if (eay_cmp_asn1dn(ident0, &ident) == 0)
+					goto matched;
+				break;
+			case IDTYPE_ADDRESS:
+				sa = (struct sockaddr *)ident0->v;
+				sa2 = (caddr_t)(id_b + 1);
+				switch (sa->sa_family) {
+				case AF_INET:
+					if (iph1->id_p->l - sizeof(*id_b) != sizeof(struct in_addr))
+						continue;  /* ID value mismatch */
+					sa1 = (caddr_t)&((struct sockaddr_in *)sa)->sin_addr;
+					if (memcmp(sa1, sa2, sizeof(struct in_addr)) == 0)
+						goto matched;
+					break;
+#ifdef INET6
+				case AF_INET6:
+					if (iph1->id_p->l - sizeof(*id_b) != sizeof(struct in6_addr))
+						continue;  /* ID value mismatch */
+					sa1 = (caddr_t)&((struct sockaddr_in6 *)sa)->sin6_addr;
+					if (memcmp(sa1, sa2, sizeof(struct in6_addr)) == 0)
+						goto matched;
+					break;
+#endif
+				default:
+					break;
+				}
+				break;
+			default:
+				if (memcmp(ident0->v, id_b + 1, ident0->l) == 0)
+					goto matched;
+				break;
+			}
+		}
+		if (ident0 != NULL) {
+			vfree(ident0);
+			ident0 = NULL;
+		}
+		plog(LLV_WARNING, LOCATION, NULL, "No ID match.\n");
+		if (iph1->rmconf->verify_identifier)
+			return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
+matched: /* ID value match */
+		if (ident0 != NULL)
+			vfree(ident0);
+	}
+
+	return 0;
+}
+
+/*
+ * create ID payload for phase 1 and set into iph1->id.
+ * NOT INCLUDING isakmp general header.
+ * see, RFC2407 4.6.2.1
+ */
+int
+ipsecdoi_setid1(iph1)
+	struct ph1handle *iph1;
+{
+	vchar_t *ret = NULL;
+	struct ipsecdoi_id_b id_b;
+	vchar_t *ident = NULL;
+	struct sockaddr *ipid = NULL;
+
+	/* init */
+	id_b.proto_id = 0;
+	id_b.port = 0;
+	ident = NULL;
+
+	switch (iph1->rmconf->idvtype) {
+	case IDTYPE_FQDN:
+		id_b.type = IPSECDOI_ID_FQDN;
+		ident = getidval(iph1->rmconf->idvtype, iph1->rmconf->idv);
+		break;
+	case IDTYPE_USERFQDN:
+		id_b.type = IPSECDOI_ID_USER_FQDN;
+		ident = getidval(iph1->rmconf->idvtype, iph1->rmconf->idv);
+		break;
+	case IDTYPE_KEYID:
+		id_b.type = IPSECDOI_ID_KEY_ID;
+		ident = getidval(iph1->rmconf->idvtype, iph1->rmconf->idv);
+		break;
+	case IDTYPE_ASN1DN:
+		id_b.type = IPSECDOI_ID_DER_ASN1_DN;
+		if (iph1->rmconf->idv) {
+			/* XXX it must be encoded to asn1dn. */
+			ident = vdup(iph1->rmconf->idv);
+		} else {
+			if (oakley_getmycert(iph1) < 0) {
+				plog(LLV_ERROR, LOCATION, NULL,
+					"failed to get own CERT.\n");
+				goto err;
+			}
+			ident = eay_get_x509asn1subjectname(iph1->cert);
+		}
+		break;
+	case IDTYPE_ADDRESS:
+		/*
+		 * if the value of the id type was set by the configuration
+		 * file, then use it.  otherwise the value is get from local
+		 * ip address by using ike negotiation.
+		 */
+		if (iph1->rmconf->idv)
+			ipid = (struct sockaddr *)iph1->rmconf->idv->v;
+		/*FALLTHROUGH*/
+	default:
+	    {
+		int l;
+		caddr_t p;
+
+		if (ipid == NULL)
+			ipid = iph1->local;
+
+		/* use IP address */
+		switch (ipid->sa_family) {
+		case AF_INET:
+			id_b.type = IPSECDOI_ID_IPV4_ADDR;
+			l = sizeof(struct in_addr);
+			p = (caddr_t)&((struct sockaddr_in *)ipid)->sin_addr;
+			break;
+#ifdef INET6
+		case AF_INET6:
+			id_b.type = IPSECDOI_ID_IPV6_ADDR;
+			l = sizeof(struct in6_addr);
+			p = (caddr_t)&((struct sockaddr_in6 *)ipid)->sin6_addr;
+			break;
+#endif
+		default:
+			plog(LLV_ERROR, LOCATION, NULL,
+				"invalid address family.\n");
+			goto err;
+		}
+		id_b.proto_id = IPPROTO_UDP;
+		id_b.port = htons(PORT_ISAKMP);
+		ident = vmalloc(l);
+		if (!ident) {
+			plog(LLV_ERROR, LOCATION, NULL,
+				"failed to get ID buffer.\n");
+			return 0;
+		}
+		memcpy(ident->v, p, ident->l);
+	    }
+	}
+	if (!ident) {
+		plog(LLV_ERROR, LOCATION, NULL,
+			"failed to get ID buffer.\n");
+		return 0;
+	}
+
+	ret = vmalloc(sizeof(id_b) + ident->l);
+	if (ret == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL,
+			"failed to get ID buffer.\n");
+		goto err;
+	}
+
+	memcpy(ret->v, &id_b, sizeof(id_b));
+	memcpy(ret->v + sizeof(id_b), ident->v, ident->l);
+
+	iph1->id = ret;
+
+	plog(LLV_DEBUG, LOCATION, NULL,
+		"use ID type of %s\n", s_ipsecdoi_ident(id_b.type));
+	if (ident)
+		vfree(ident);
+	return 0;
+
+err:
+	if (ident)
+		vfree(ident);
+	plog(LLV_ERROR, LOCATION, NULL, "failed get my ID\n");
+	return -1;
+}
+
+static vchar_t *
+getidval(type, val)
+	int type;
+	vchar_t *val;
+{
+	vchar_t *new = NULL;
+
+	if (val)
+		new = vdup(val);
+	return new;
+}
+
+/* it's only called by cfparse.y. */
+int
+set_identifier(vpp, type, value)
+	vchar_t **vpp, *value;
+	int type;
+{
+	return set_identifier_qual(vpp, type, value, IDQUAL_UNSPEC);
+}
+
+int
+set_identifier_qual(vpp, type, value, qual)
+	vchar_t **vpp, *value;
+	int type;
+	int qual;
+{
+	vchar_t *new = NULL;
+
+	/* simply return if value is null. */
+	if (!value){
+		if( type == IDTYPE_FQDN || type == IDTYPE_USERFQDN){
+			plog(LLV_ERROR, LOCATION, NULL,
+				 "No %s\n", type == IDTYPE_FQDN ? "fqdn":"user fqdn");
+			return -1;
+		}
+		return 0;
+	}
+
+	switch (type) {
+	case IDTYPE_FQDN:
+	case IDTYPE_USERFQDN:
+		if(value->l <= 1){
+			plog(LLV_ERROR, LOCATION, NULL,
+				 "Empty %s\n", type == IDTYPE_FQDN ? "fqdn":"user fqdn");
+			return -1;
+		}
+		/* length is adjusted since QUOTEDSTRING teminates NULL. */
+		new = vmalloc(value->l - 1);
+		if (new == NULL)
+			return -1;
+		memcpy(new->v, value->v, new->l);
+		break;
+	case IDTYPE_KEYID:
+		/* 
+		 * If no qualifier is specified: IDQUAL_UNSPEC. It means
+		 * to use a file for backward compatibility sake. 
+		 */
+		switch(qual) {
+		case IDQUAL_FILE:
+		case IDQUAL_UNSPEC: {
+			FILE *fp;
+			char b[512];
+			int tlen, len;
+
+			fp = fopen(value->v, "r");
+			if (fp == NULL) {
+				plog(LLV_ERROR, LOCATION, NULL,
+					"can not open %s\n", value->v);
+				return -1;
+			}
+			tlen = 0;
+			while ((len = fread(b, 1, sizeof(b), fp)) != 0) {
+				new = vrealloc(new, tlen + len);
+				if (!new) {
+					fclose(fp);
+					return -1;
+				}
+				memcpy(new->v + tlen, b, len);
+				tlen += len;
+			}
+			fclose(fp);
+			break;
+		}
+
+		case IDQUAL_TAG:
+			new = vmalloc(value->l - 1);
+			if (new == NULL) {
+				plog(LLV_ERROR, LOCATION, NULL,
+					"can not allocate memory");
+				return -1;
+			}
+			memcpy(new->v, value->v, new->l);
+			break;
+
+		default:
+			plog(LLV_ERROR, LOCATION, NULL,
+				"unknown qualifier");
+			return -1;
+		}
+		break;
+	
+	case IDTYPE_ADDRESS: {
+		struct sockaddr *sa;
+
+		/* length is adjusted since QUOTEDSTRING teminates NULL. */
+		if (value->l == 0)
+			break;
+
+		sa = str2saddr(value->v, NULL);
+		if (sa == NULL) {
+			plog(LLV_ERROR, LOCATION, NULL,
+				"invalid ip address %s\n", value->v);
+			return -1;
+		}
+
+		new = vmalloc(sysdep_sa_len(sa));
+		if (new == NULL) {
+			racoon_free(sa);
+			return -1;
+		}
+		memcpy(new->v, sa, new->l);
+		racoon_free(sa);
+		break;
+	}
+	case IDTYPE_ASN1DN:
+		if (value->v[0] == '~')
+			/* Hex-encoded ASN1 strings */
+			new = eay_hex2asn1dn(value->v + 1, - 1);
+		else
+			/* DN encoded strings */
+			new = eay_str2asn1dn(value->v, value->l - 1);
+
+		if (new == NULL)
+			return -1;
+
+		if (loglevel >= LLV_DEBUG) {
+			X509_NAME *xn;
+			BIO *bio;
+			unsigned char *ptr = (unsigned char *) new->v, *buf;
+			size_t len;
+			char save;
+
+			xn = d2i_X509_NAME(NULL, (void *)&ptr, new->l);
+			bio = BIO_new(BIO_s_mem());
+			
+			X509_NAME_print_ex(bio, xn, 0, 0);
+			len = BIO_get_mem_data(bio, &ptr);
+			save = ptr[len];
+			ptr[len] = 0;
+			plog(LLV_DEBUG, LOCATION, NULL, "Parsed DN: %s\n", ptr);
+			ptr[len] = save;
+			X509_NAME_free(xn);
+			BIO_free(bio);
+		}
+
+		break;
+	}
+
+	*vpp = new;
+
+	return 0;
+}
+
+/*
+ * create ID payload for phase 2, and set into iph2->id and id_p.  There are
+ * NOT INCLUDING isakmp general header.
+ * this function is for initiator.  responder will get to copy from payload.
+ * responder ID type is always address type.
+ * see, RFC2407 4.6.2.1
+ */
+int
+ipsecdoi_setid2(iph2)
+	struct ph2handle *iph2;
+{
+	struct secpolicy *sp;
+
+	/* check there is phase 2 handler ? */
+	sp = getspbyspid(iph2->spid);
+	if (sp == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL,
+			"no policy found for spid:%u.\n", iph2->spid);
+		return -1;
+	}
+
+	iph2->id = ipsecdoi_sockaddr2id((struct sockaddr *)&sp->spidx.src,
+					sp->spidx.prefs, sp->spidx.ul_proto);
+	if (iph2->id == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL,
+			"failed to get ID for %s\n",
+			spidx2str(&sp->spidx));
+		return -1;
+	}
+	plog(LLV_DEBUG, LOCATION, NULL, "use local ID type %s\n",
+		s_ipsecdoi_ident(((struct ipsecdoi_id_b *)iph2->id->v)->type));
+
+	/* remote side */
+	iph2->id_p = ipsecdoi_sockaddr2id((struct sockaddr *)&sp->spidx.dst,
+				sp->spidx.prefd, sp->spidx.ul_proto);
+	if (iph2->id_p == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL,
+			"failed to get ID for %s\n",
+			spidx2str(&sp->spidx));
+		VPTRINIT(iph2->id);
+		return -1;
+	}
+	plog(LLV_DEBUG, LOCATION, NULL,
+		"use remote ID type %s\n",
+		s_ipsecdoi_ident(((struct ipsecdoi_id_b *)iph2->id_p->v)->type));
+
+	return 0;
+}
+
+/*
+ * set address type of ID.
+ * NOT INCLUDING general header.
+ */
+vchar_t *
+ipsecdoi_sockaddr2id(saddr, prefixlen, ul_proto)
+	struct sockaddr *saddr;
+	u_int prefixlen;
+	u_int ul_proto;
+{
+	vchar_t *new;
+	int type, len1, len2;
+	caddr_t sa;
+	u_short port;
+
+	/*
+	 * Q. When type is SUBNET, is it allowed to be ::1/128.
+	 * A. Yes. (consensus at bake-off)
+	 */
+	switch (saddr->sa_family) {
+	case AF_INET:
+		len1 = sizeof(struct in_addr);
+		if (prefixlen == (sizeof(struct in_addr) << 3)) {
+			type = IPSECDOI_ID_IPV4_ADDR;
+			len2 = 0;
+		} else {
+			type = IPSECDOI_ID_IPV4_ADDR_SUBNET;
+			len2 = sizeof(struct in_addr);
+		}
+		sa = (caddr_t)&((struct sockaddr_in *)(saddr))->sin_addr;
+		port = ((struct sockaddr_in *)(saddr))->sin_port;
+		break;
+#ifdef INET6
+	case AF_INET6:
+		len1 = sizeof(struct in6_addr);
+		if (prefixlen == (sizeof(struct in6_addr) << 3)) {
+			type = IPSECDOI_ID_IPV6_ADDR;
+			len2 = 0;
+		} else {
+			type = IPSECDOI_ID_IPV6_ADDR_SUBNET;
+			len2 = sizeof(struct in6_addr);
+		}
+		sa = (caddr_t)&((struct sockaddr_in6 *)(saddr))->sin6_addr;
+		port = ((struct sockaddr_in6 *)(saddr))->sin6_port;
+		break;
+#endif
+	default:
+		plog(LLV_ERROR, LOCATION, NULL,
+			"invalid family: %d.\n", saddr->sa_family);
+		return NULL;
+	}
+
+	/* get ID buffer */
+	new = vmalloc(sizeof(struct ipsecdoi_id_b) + len1 + len2);
+	if (new == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL,
+			"failed to get ID buffer.\n");
+		return NULL;
+	}
+
+	memset(new->v, 0, new->l);
+
+	/* set the part of header. */
+	((struct ipsecdoi_id_b *)new->v)->type = type;
+
+	/* set ul_proto and port */
+	/*
+	 * NOTE: we use both IPSEC_ULPROTO_ANY and IPSEC_PORT_ANY as wild card
+	 * because 0 means port number of 0.  Instead of 0, we use IPSEC_*_ANY.
+	 */
+	((struct ipsecdoi_id_b *)new->v)->proto_id =
+		ul_proto == IPSEC_ULPROTO_ANY ? 0 : ul_proto;
+	((struct ipsecdoi_id_b *)new->v)->port =
+		port == IPSEC_PORT_ANY ? 0 : port;
+	memcpy(new->v + sizeof(struct ipsecdoi_id_b), sa, len1);
+
+	/* set address */
+
+	/* set prefix */
+	if (len2) {
+		u_char *p = (unsigned char *) new->v + 
+			sizeof(struct ipsecdoi_id_b) + len1;
+		u_int bits = prefixlen;
+
+		while (bits >= 8) {
+			*p++ = 0xff;
+			bits -= 8;
+		}
+
+		if (bits > 0)
+			*p = ~((1 << (8 - bits)) - 1);
+	}
+
+	return new;
+}
+
+vchar_t *
+ipsecdoi_sockrange2id(laddr, haddr, ul_proto)
+	struct sockaddr *laddr, *haddr;
+	u_int ul_proto;
+{
+	vchar_t *new;
+	int type, len1, len2;
+	u_short port;
+
+	if (laddr->sa_family != haddr->sa_family) {
+	    plog(LLV_ERROR, LOCATION, NULL, "Address family mismatch\n");
+	    return NULL;
+	}
+
+	switch (laddr->sa_family) {
+	case AF_INET:
+	    type = IPSECDOI_ID_IPV4_ADDR_RANGE;
+	    len1 = sizeof(struct in_addr);
+	    len2 = sizeof(struct in_addr);
+	    break;
+#ifdef INET6
+	case AF_INET6:
+		type = IPSECDOI_ID_IPV6_ADDR_RANGE;
+		len1 = sizeof(struct in6_addr);
+		len2 = sizeof(struct in6_addr);
+		break;
+#endif
+	default:
+		plog(LLV_ERROR, LOCATION, NULL,
+			"invalid family: %d.\n", laddr->sa_family);
+		return NULL;
+	}
+
+	/* get ID buffer */
+	new = vmalloc(sizeof(struct ipsecdoi_id_b) + len1 + len2);
+	if (new == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL,
+			"failed to get ID buffer.\n");
+		return NULL;
+	}
+
+	memset(new->v, 0, new->l);
+	/* set the part of header. */
+	((struct ipsecdoi_id_b *)new->v)->type = type;
+
+	/* set ul_proto and port */
+	/*
+	 * NOTE: we use both IPSEC_ULPROTO_ANY and IPSEC_PORT_ANY as wild card
+	 * because 0 means port number of 0.  Instead of 0, we use IPSEC_*_ANY.
+	 */
+	((struct ipsecdoi_id_b *)new->v)->proto_id =
+		ul_proto == IPSEC_ULPROTO_ANY ? 0 : ul_proto;
+	port = ((struct sockaddr_in *)(laddr))->sin_port;
+	((struct ipsecdoi_id_b *)new->v)->port =
+		port == IPSEC_PORT_ANY ? 0 : port;
+	memcpy(new->v + sizeof(struct ipsecdoi_id_b), 
+	       (caddr_t)&((struct sockaddr_in *)(laddr))->sin_addr, 
+	       len1);
+	memcpy(new->v + sizeof(struct ipsecdoi_id_b) + len1, 
+	       (caddr_t)&((struct sockaddr_in *)haddr)->sin_addr,
+	       len2);
+	return new;
+}
+
+
+/*
+ * create sockaddr structure from ID payload (buf).
+ * buffers (saddr, prefixlen, ul_proto) must be allocated.
+ * see, RFC2407 4.6.2.1
+ */
+int
+ipsecdoi_id2sockaddr(buf, saddr, prefixlen, ul_proto)
+	vchar_t *buf;
+	struct sockaddr *saddr;
+	u_int8_t *prefixlen;
+	u_int16_t *ul_proto;
+{
+	struct ipsecdoi_id_b *id_b = (struct ipsecdoi_id_b *)buf->v;
+	u_int plen = 0;
+
+	/*
+	 * When a ID payload of subnet type with a IP address of full bit
+	 * masked, it has to be processed as host address.
+	 * e.g. below 2 type are same.
+	 *      type = ipv6 subnet, data = 2001::1/128
+	 *      type = ipv6 address, data = 2001::1
+	 */
+	switch (id_b->type) {
+	case IPSECDOI_ID_IPV4_ADDR:
+	case IPSECDOI_ID_IPV4_ADDR_SUBNET:
+#ifndef __linux__
+		saddr->sa_len = sizeof(struct sockaddr_in);
+#endif
+		saddr->sa_family = AF_INET;
+		((struct sockaddr_in *)saddr)->sin_port =
+			(id_b->port == 0
+				? IPSEC_PORT_ANY
+				: id_b->port);		/* see sockaddr2id() */
+		memcpy(&((struct sockaddr_in *)saddr)->sin_addr,
+			buf->v + sizeof(*id_b), sizeof(struct in_addr));
+		break;
+#ifdef INET6
+	case IPSECDOI_ID_IPV6_ADDR:
+	case IPSECDOI_ID_IPV6_ADDR_SUBNET:
+#ifndef __linux__
+		saddr->sa_len = sizeof(struct sockaddr_in6);
+#endif
+		saddr->sa_family = AF_INET6;
+		((struct sockaddr_in6 *)saddr)->sin6_port =
+			(id_b->port == 0
+				? IPSEC_PORT_ANY
+				: id_b->port);		/* see sockaddr2id() */
+		memcpy(&((struct sockaddr_in6 *)saddr)->sin6_addr,
+			buf->v + sizeof(*id_b), sizeof(struct in6_addr));
+		break;
+#endif
+	default:
+		do_plog(LLV_INFO, "XXXXXXXXXXXXXXXXXXXXXX error\n");
+		plog(LLV_ERROR, LOCATION, NULL,
+			"unsupported ID type %d\n", id_b->type);
+		return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
+	}
+
+	/* get prefix length */
+	switch (id_b->type) {
+	case IPSECDOI_ID_IPV4_ADDR:
+		plen = sizeof(struct in_addr) << 3;
+		break;
+#ifdef INET6
+	case IPSECDOI_ID_IPV6_ADDR:
+		plen = sizeof(struct in6_addr) << 3;
+		break;
+#endif
+	case IPSECDOI_ID_IPV4_ADDR_SUBNET:
+#ifdef INET6
+	case IPSECDOI_ID_IPV6_ADDR_SUBNET:
+#endif
+	    {
+		u_char *p;
+		u_int max;
+		int alen = sizeof(struct in_addr);
+
+		switch (id_b->type) {
+		case IPSECDOI_ID_IPV4_ADDR_SUBNET:
+			alen = sizeof(struct in_addr);
+			break;
+#ifdef INET6
+		case IPSECDOI_ID_IPV6_ADDR_SUBNET:
+			alen = sizeof(struct in6_addr);
+			break;
+#endif
+		}
+
+		/* sanity check */
+		if (buf->l < alen)
+			return ISAKMP_INTERNAL_ERROR;
+
+		/* get subnet mask length */
+		plen = 0;
+		max = alen <<3;
+
+		p = (unsigned char *) buf->v
+			+ sizeof(struct ipsecdoi_id_b)
+			+ alen;
+
+		for (; *p == 0xff; p++) {
+			plen += 8;
+			if (plen >= max)
+				break;
+		}
+
+		if (plen < max) {
+			u_int l = 0;
+			u_char b = ~(*p);
+
+			while (b) {
+				b >>= 1;
+				l++;
+			}
+
+			l = 8 - l;
+			plen += l;
+		}
+	    }
+		break;
+	}
+
+	*prefixlen = plen;
+	*ul_proto = id_b->proto_id == 0
+				? IPSEC_ULPROTO_ANY
+				: id_b->proto_id;	/* see sockaddr2id() */
+
+	return 0;
+}
+
+/*
+ * make printable string from ID payload except of general header.
+ */
+char *
+ipsecdoi_id2str(id)
+	const vchar_t *id;
+{
+#define BUFLEN 512
+	char * ret = NULL;
+	int len = 0;
+	char *dat;
+	static char buf[BUFLEN];
+	struct ipsecdoi_id_b *id_b = (struct ipsecdoi_id_b *)id->v;
+	struct sockaddr_storage saddr_storage;
+	struct sockaddr        *saddr;
+	struct sockaddr_in     *saddr_in;
+	struct sockaddr_in6    *saddr_in6;
+	u_int plen = 0;
+
+	saddr     = (struct sockaddr *)&saddr_storage;
+	saddr_in  = (struct sockaddr_in *)&saddr_storage;
+	saddr_in6 = (struct sockaddr_in6 *)&saddr_storage;
+
+	
+	switch (id_b->type) {
+	case IPSECDOI_ID_IPV4_ADDR:
+	case IPSECDOI_ID_IPV4_ADDR_SUBNET:
+	case IPSECDOI_ID_IPV4_ADDR_RANGE:
+
+#ifndef __linux__
+		saddr->sa_len = sizeof(struct sockaddr_in);
+#endif
+		saddr->sa_family = AF_INET;
+
+		saddr_in->sin_port = IPSEC_PORT_ANY;
+		memcpy(&saddr_in->sin_addr,
+			id->v + sizeof(*id_b), sizeof(struct in_addr));
+		break;
+#ifdef INET6
+	case IPSECDOI_ID_IPV6_ADDR:
+	case IPSECDOI_ID_IPV6_ADDR_SUBNET:
+	case IPSECDOI_ID_IPV6_ADDR_RANGE:
+
+#ifndef __linux__
+		saddr->sa_len = sizeof(struct sockaddr_in6);
+#endif
+		saddr->sa_family = AF_INET6;
+
+		saddr_in6->sin6_port = IPSEC_PORT_ANY;
+		memcpy(&saddr_in6->sin6_addr,
+			id->v + sizeof(*id_b), sizeof(struct in6_addr));
+		saddr_in6->sin6_scope_id =
+			(IN6_IS_ADDR_LINKLOCAL(&saddr_in6->sin6_addr)
+				? ((struct sockaddr_in6 *)id_b)->sin6_scope_id
+				: 0);
+		break;
+#endif
+	}
+
+	switch (id_b->type) {
+	case IPSECDOI_ID_IPV4_ADDR:
+#ifdef INET6
+	case IPSECDOI_ID_IPV6_ADDR:
+#endif
+		len = snprintf( buf, BUFLEN, "%s", saddrwop2str(saddr));
+		break;
+
+	case IPSECDOI_ID_IPV4_ADDR_SUBNET:
+#ifdef INET6
+	case IPSECDOI_ID_IPV6_ADDR_SUBNET:
+#endif
+	    {
+		u_char *p;
+		u_int max;
+		int alen = sizeof(struct in_addr);
+
+		switch (id_b->type) {
+		case IPSECDOI_ID_IPV4_ADDR_SUBNET:
+			alen = sizeof(struct in_addr);
+			break;
+#ifdef INET6
+		case IPSECDOI_ID_IPV6_ADDR_SUBNET:
+			alen = sizeof(struct in6_addr);
+			break;
+#endif
+		}
+
+		/* sanity check */
+		if (id->l < alen) {
+			len = 0;
+			break;
+		}
+
+		/* get subnet mask length */
+		plen = 0;
+		max = alen <<3;
+
+		p = (unsigned char *) id->v
+			+ sizeof(struct ipsecdoi_id_b)
+			+ alen;
+
+		for (; *p == 0xff; p++) {
+			plen += 8;
+			if (plen >= max)
+				break;
+		}
+
+		if (plen < max) {
+			u_int l = 0;
+			u_char b = ~(*p);
+
+			while (b) {
+				b >>= 1;
+				l++;
+			}
+
+			l = 8 - l;
+			plen += l;
+		}
+
+		len = snprintf( buf, BUFLEN, "%s/%i", saddrwop2str(saddr), plen);
+	    }
+		break;
+
+	case IPSECDOI_ID_IPV4_ADDR_RANGE:
+
+		len = snprintf( buf, BUFLEN, "%s-", saddrwop2str(saddr));
+
+#ifndef __linux__
+		saddr->sa_len = sizeof(struct sockaddr_in);
+#endif
+		saddr->sa_family = AF_INET;
+		saddr_in->sin_port = IPSEC_PORT_ANY;
+		memcpy(&saddr_in->sin_addr,
+			id->v + sizeof(*id_b) + sizeof(struct in_addr),
+			sizeof(struct in_addr));
+
+		len += snprintf( buf + len, BUFLEN - len, "%s", saddrwop2str(saddr));
+
+		break;
+
+#ifdef INET6
+	case IPSECDOI_ID_IPV6_ADDR_RANGE:
+
+		len = snprintf( buf, BUFLEN, "%s-", saddrwop2str(saddr));
+
+#ifndef __linux__
+		saddr->sa_len = sizeof(struct sockaddr_in6);
+#endif
+		saddr->sa_family = AF_INET6;
+		saddr_in6->sin6_port = IPSEC_PORT_ANY;
+		memcpy(&saddr_in6->sin6_addr,
+			id->v + sizeof(*id_b) + sizeof(struct in6_addr),
+			sizeof(struct in6_addr));
+		saddr_in6->sin6_scope_id =
+			(IN6_IS_ADDR_LINKLOCAL(&saddr_in6->sin6_addr)
+				? ((struct sockaddr_in6 *)id_b)->sin6_scope_id
+				: 0);
+
+		len += snprintf( buf + len, BUFLEN - len, "%s", saddrwop2str(saddr));
+
+		break;
+#endif
+
+	case IPSECDOI_ID_FQDN:
+	case IPSECDOI_ID_USER_FQDN:
+		len = id->l - sizeof(*id_b);
+		if (len > BUFLEN)
+			len = BUFLEN;
+		memcpy(buf, id->v + sizeof(*id_b), len);
+		break;
+
+	case IPSECDOI_ID_DER_ASN1_DN:
+	case IPSECDOI_ID_DER_ASN1_GN:
+	{
+		X509_NAME *xn = NULL;
+
+		dat = id->v + sizeof(*id_b);
+		len = id->l - sizeof(*id_b);
+
+		if (d2i_X509_NAME(&xn, (void*) &dat, len) != NULL) {
+			BIO *bio = BIO_new(BIO_s_mem());
+			X509_NAME_print_ex(bio, xn, 0, 0);
+			len = BIO_get_mem_data(bio, &dat);
+			if (len > BUFLEN)
+				len = BUFLEN;
+			memcpy(buf,dat,len);
+			BIO_free(bio);
+			X509_NAME_free(xn);
+		} else {
+			plog(LLV_ERROR, LOCATION, NULL,
+				"unable to extract asn1dn from id\n");
+
+			len = sprintf(buf, "<ASN1-DN>");
+		}
+
+		break;
+	}
+
+	/* currently unhandled id types */
+	case IPSECDOI_ID_KEY_ID:
+		len = sprintf( buf, "<KEY-ID>");
+		break;
+
+	default:
+		plog(LLV_ERROR, LOCATION, NULL,
+			"unknown ID type %d\n", id_b->type);
+	}
+
+	if (!len)
+		len = sprintf( buf, "<?>");
+
+	ret = racoon_malloc(len+1);
+	if (ret != NULL) {
+		memcpy(ret,buf,len);
+		ret[len]=0;
+	}
+
+	return ret;
+}
+
+/*
+ * set IPsec data attributes into a proposal.
+ * NOTE: MUST called per a transform.
+ */
+int
+ipsecdoi_t2satrns(t, pp, pr, tr)
+	struct isakmp_pl_t *t;
+	struct saprop *pp;
+	struct saproto *pr;
+	struct satrns *tr;
+{
+	struct isakmp_data *d, *prev;
+	int flag, type;
+	int error = -1;
+	int life_t;
+	int tlen;
+
+	tr->trns_no = t->t_no;
+	tr->trns_id = t->t_id;
+
+	tlen = ntohs(t->h.len) - sizeof(*t);
+	prev = (struct isakmp_data *)NULL;
+	d = (struct isakmp_data *)(t + 1);
+
+	/* default */
+	life_t = IPSECDOI_ATTR_SA_LD_TYPE_DEFAULT;
+	pp->lifetime = IPSECDOI_ATTR_SA_LD_SEC_DEFAULT;
+	pp->lifebyte = 0;
+	tr->authtype = IPSECDOI_ATTR_AUTH_NONE;
+
+	while (tlen > 0) {
+
+		type = ntohs(d->type) & ~ISAKMP_GEN_MASK;
+		flag = ntohs(d->type) & ISAKMP_GEN_MASK;
+
+		plog(LLV_DEBUG, LOCATION, NULL,
+			"type=%s, flag=0x%04x, lorv=%s\n",
+			s_ipsecdoi_attr(type), flag,
+			s_ipsecdoi_attr_v(type, ntohs(d->lorv)));
+
+		switch (type) {
+		case IPSECDOI_ATTR_SA_LD_TYPE:
+		{
+			int type = ntohs(d->lorv);
+			switch (type) {
+			case IPSECDOI_ATTR_SA_LD_TYPE_SEC:
+			case IPSECDOI_ATTR_SA_LD_TYPE_KB:
+				life_t = type;
+				break;
+			default:
+				plog(LLV_WARNING, LOCATION, NULL,
+					"invalid life duration type. "
+					"use default\n");
+				life_t = IPSECDOI_ATTR_SA_LD_TYPE_DEFAULT;
+				break;
+			}
+			break;
+		}
+		case IPSECDOI_ATTR_SA_LD:
+			if (prev == NULL
+			 || (ntohs(prev->type) & ~ISAKMP_GEN_MASK) !=
+					IPSECDOI_ATTR_SA_LD_TYPE) {
+				plog(LLV_ERROR, LOCATION, NULL,
+				    "life duration must follow ltype\n");
+				break;
+			}
+
+		    {
+			u_int32_t t;
+			vchar_t *ld_buf = NULL;
+
+			if (flag) {
+				/* i.e. ISAKMP_GEN_TV */
+				ld_buf = vmalloc(sizeof(d->lorv));
+				if (ld_buf == NULL) {
+					plog(LLV_ERROR, LOCATION, NULL,
+					    "failed to get LD buffer.\n");
+					goto end;
+				}
+				memcpy(ld_buf->v, &d->lorv, sizeof(d->lorv));
+			} else {
+				int len = ntohs(d->lorv);
+				/* i.e. ISAKMP_GEN_TLV */
+				ld_buf = vmalloc(len);
+				if (ld_buf == NULL) {
+					plog(LLV_ERROR, LOCATION, NULL,
+					    "failed to get LD buffer.\n");
+					goto end;
+				}
+				memcpy(ld_buf->v, d + 1, len);
+			}
+			switch (life_t) {
+			case IPSECDOI_ATTR_SA_LD_TYPE_SEC:
+				t = ipsecdoi_set_ld(ld_buf);
+				vfree(ld_buf);
+				if (t == 0) {
+					plog(LLV_ERROR, LOCATION, NULL,
+						"invalid life duration.\n");
+					goto end;
+				}
+				/* lifetime must be equal in a proposal. */
+				if (pp->lifetime == IPSECDOI_ATTR_SA_LD_SEC_DEFAULT)
+					pp->lifetime = t;
+				else if (pp->lifetime != t) {
+					plog(LLV_ERROR, LOCATION, NULL,
+						"lifetime mismatched "
+						"in a proposal, "
+						"prev:%ld curr:%u.\n",
+						(long)pp->lifetime, t);
+					goto end;
+				}
+				break;
+			case IPSECDOI_ATTR_SA_LD_TYPE_KB:
+				t = ipsecdoi_set_ld(ld_buf);
+				vfree(ld_buf);
+				if (t == 0) {
+					plog(LLV_ERROR, LOCATION, NULL,
+						"invalid life duration.\n");
+					goto end;
+				}
+				/* lifebyte must be equal in a proposal. */
+				if (pp->lifebyte == 0)
+					pp->lifebyte = t;
+				else if (pp->lifebyte != t) {
+					plog(LLV_ERROR, LOCATION, NULL,
+						"lifebyte mismatched "
+						"in a proposal, "
+						"prev:%d curr:%u.\n",
+						pp->lifebyte, t);
+					goto end;
+				}
+				break;
+			default:
+				vfree(ld_buf);
+				plog(LLV_ERROR, LOCATION, NULL,
+					"invalid life type: %d\n", life_t);
+				goto end;
+			}
+		    }
+			break;
+
+		case IPSECDOI_ATTR_GRP_DESC:
+			/*
+			 * RFC2407: 4.5 IPSEC Security Association Attributes
+			 *   Specifies the Oakley Group to be used in a PFS QM
+			 *   negotiation.  For a list of supported values, see
+			 *   Appendix A of [IKE].
+			 */
+			if (pp->pfs_group == 0)
+				pp->pfs_group = (u_int16_t)ntohs(d->lorv);
+			else if (pp->pfs_group != (u_int16_t)ntohs(d->lorv)) {
+				plog(LLV_ERROR, LOCATION, NULL,
+					"pfs_group mismatched "
+					"in a proposal.\n");
+				goto end;
+			}
+			break;
+
+		case IPSECDOI_ATTR_ENC_MODE:
+			if (pr->encmode &&
+			    pr->encmode != (u_int16_t)ntohs(d->lorv)) {
+				plog(LLV_ERROR, LOCATION, NULL,
+					"multiple encmode exist "
+					"in a transform.\n");
+				goto end;
+			}
+			pr->encmode = (u_int16_t)ntohs(d->lorv);
+			break;
+
+		case IPSECDOI_ATTR_AUTH:
+			if (tr->authtype != IPSECDOI_ATTR_AUTH_NONE) {
+				plog(LLV_ERROR, LOCATION, NULL,
+					"multiple authtype exist "
+					"in a transform.\n");
+				goto end;
+			}
+			tr->authtype = (u_int16_t)ntohs(d->lorv);
+			break;
+
+		case IPSECDOI_ATTR_KEY_LENGTH:
+			if (pr->proto_id != IPSECDOI_PROTO_IPSEC_ESP) {
+				plog(LLV_ERROR, LOCATION, NULL,
+					"key length defined but not ESP");
+				goto end;
+			}
+			tr->encklen = ntohs(d->lorv);
+			break;
+#ifdef HAVE_SECCTX
+		case IPSECDOI_ATTR_SECCTX:
+		{
+			int len = ntohs(d->lorv);
+			memcpy(&pp->sctx, d + 1, len);
+			pp->sctx.ctx_strlen = ntohs(pp->sctx.ctx_strlen);
+			break;
+		}
+#endif /* HAVE_SECCTX */
+		case IPSECDOI_ATTR_KEY_ROUNDS:
+		case IPSECDOI_ATTR_COMP_DICT_SIZE:
+		case IPSECDOI_ATTR_COMP_PRIVALG:
+		default:
+			break;
+		}
+
+		prev = d;
+		if (flag) {
+			tlen -= sizeof(*d);
+			d = (struct isakmp_data *)((char *)d + sizeof(*d));
+		} else {
+			tlen -= (sizeof(*d) + ntohs(d->lorv));
+			d = (struct isakmp_data *)((caddr_t)d + sizeof(*d) + ntohs(d->lorv));
+		}
+	}
+
+	error = 0;
+end:
+	return error;
+}
+
+int
+ipsecdoi_authalg2trnsid(alg)
+	int alg;
+{
+	switch (alg) {
+        case IPSECDOI_ATTR_AUTH_HMAC_MD5:
+		return IPSECDOI_AH_MD5;
+        case IPSECDOI_ATTR_AUTH_HMAC_SHA1:
+		return IPSECDOI_AH_SHA;
+	case IPSECDOI_ATTR_AUTH_HMAC_SHA2_256:
+		return IPSECDOI_AH_SHA256;
+	case IPSECDOI_ATTR_AUTH_HMAC_SHA2_384:
+		return IPSECDOI_AH_SHA384;
+	case IPSECDOI_ATTR_AUTH_HMAC_SHA2_512:
+		return IPSECDOI_AH_SHA512;
+        case IPSECDOI_ATTR_AUTH_DES_MAC:
+		return IPSECDOI_AH_DES;
+	case IPSECDOI_ATTR_AUTH_KPDK:
+		return IPSECDOI_AH_MD5;	/* XXX */
+	default:
+		plog(LLV_ERROR, LOCATION, NULL,
+			"invalid authentication algorithm:%d\n", alg);
+	}
+	return -1;
+}
+
+#ifdef HAVE_GSSAPI
+struct isakmpsa *
+fixup_initiator_sa(match, received)
+	struct isakmpsa *match, *received;
+{
+	if (received->gssid != NULL)
+		match->gssid = vdup(received->gssid);
+
+	return match;
+}
+#endif
+
+static int rm_idtype2doi[] = {
+	255,				/* IDTYPE_UNDEFINED, 0 */
+	IPSECDOI_ID_FQDN,		/* IDTYPE_FQDN, 1 */
+	IPSECDOI_ID_USER_FQDN,		/* IDTYPE_USERFQDN, 2 */
+	IPSECDOI_ID_KEY_ID,		/* IDTYPE_KEYID, 3 */
+	255,    /*			   IDTYPE_ADDRESS, 4 
+		 * it expands into 4 types by another function. */
+	IPSECDOI_ID_DER_ASN1_DN,	/* IDTYPE_ASN1DN, 5 */
+};
+
+/*
+ * convert idtype to DOI value.
+ * OUT	255  : NG
+ *	other: converted.
+ */
+int
+idtype2doi(idtype)
+	int idtype;
+{
+	if (ARRAYLEN(rm_idtype2doi) > idtype)
+		return rm_idtype2doi[idtype];
+	return 255;
+}
+
+int
+doi2idtype(doi)
+	int doi;
+{
+	switch(doi) {
+	case IPSECDOI_ID_FQDN:
+		return(IDTYPE_FQDN);
+	case IPSECDOI_ID_USER_FQDN:
+		return(IDTYPE_USERFQDN);
+	case IPSECDOI_ID_KEY_ID:
+		return(IDTYPE_KEYID);
+	case IPSECDOI_ID_DER_ASN1_DN:
+		return(IDTYPE_ASN1DN);
+	case IPSECDOI_ID_IPV4_ADDR:
+	case IPSECDOI_ID_IPV4_ADDR_SUBNET:
+	case IPSECDOI_ID_IPV6_ADDR:
+	case IPSECDOI_ID_IPV6_ADDR_SUBNET:
+		return(IDTYPE_ADDRESS);
+	default:
+		plog(LLV_WARNING, LOCATION, NULL,
+			"Inproper idtype:%s in this function.\n",
+			s_ipsecdoi_ident(doi));
+		return(IDTYPE_ADDRESS);	/* XXX */
+	}
+	/*NOTREACHED*/
+}
+
+#ifdef ENABLE_HYBRID
+static int
+switch_authmethod(authmethod)
+	int authmethod;
+{
+	switch(authmethod) {
+	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R:
+		authmethod = OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I;
+		break;
+	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R:
+		authmethod = OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I;
+		break;
+	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
+		authmethod = OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I;
+		break;
+	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R:
+		authmethod = OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I;
+		break;
+	/* Those are not implemented */
+	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R:
+		authmethod = OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I;
+		break;
+	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_R:
+		authmethod = OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_I;
+		break;
+	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_R:
+		authmethod = OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_I;
+		break;
+	default:
+		break;
+	}
+
+	return authmethod;
+}
+#endif
+
+/*
+ * parse responder-lifetime attributes from payload
+ */
+int
+ipsecdoi_parse_responder_lifetime(notify, lifetime_sec, lifetime_kb)
+	struct isakmp_pl_n *notify;
+	u_int32_t *lifetime_sec;
+	u_int32_t *lifetime_kb;
+{
+	struct isakmp_data *d;
+	int flag, type, tlen, ld_type = -1;
+	u_int16_t lorv;
+	u_int32_t value;
+
+	tlen = ntohs(notify->h.len) - sizeof(*notify) - notify->spi_size;
+        d = (struct isakmp_data *)((char *)(notify + 1) +
+		notify->spi_size);
+
+	while (tlen >= sizeof(struct isakmp_data)) {
+		type = ntohs(d->type) & ~ISAKMP_GEN_MASK;
+		flag = ntohs(d->type) & ISAKMP_GEN_MASK;
+		lorv = ntohs(d->lorv);
+
+		plog(LLV_DEBUG, LOCATION, NULL,
+			"type=%s, flag=0x%04x, lorv=%s\n",
+			s_ipsecdoi_attr(type), flag,
+			s_ipsecdoi_attr_v(type, lorv));
+
+		switch (type) {
+		case IPSECDOI_ATTR_SA_LD_TYPE:
+			if (! flag) {
+				plog(LLV_ERROR, LOCATION, NULL,
+					"must be TV when LD_TYPE.\n");
+				return -1;
+			}
+			ld_type = lorv;
+			break;
+		case IPSECDOI_ATTR_SA_LD:
+			if (flag)
+				value = lorv;
+			else if (lorv == 2)
+				value = ntohs(*(u_int16_t *)(d + 1));
+			else if (lorv == 4)
+				value = ntohl(*(u_int32_t *)(d + 1));
+			else {
+				plog(LLV_ERROR, LOCATION, NULL,
+					"payload length %d for lifetime "
+					"data length is unsupported.\n", lorv);
+				return -1;
+			}
+
+			switch (ld_type) {
+			case IPSECDOI_ATTR_SA_LD_TYPE_SEC:
+				if (lifetime_sec != NULL)
+					*lifetime_sec = value;
+				plog(LLV_INFO, LOCATION, NULL,
+					"received RESPONDER-LIFETIME: %d "
+					"seconds\n", value);
+				break;
+			case IPSECDOI_ATTR_SA_LD_TYPE_KB:
+				if (lifetime_kb != NULL)
+					*lifetime_kb = value;
+				plog(LLV_INFO, LOCATION, NULL,
+					"received RESPONDER-LIFETIME: %d "
+					"kbytes\n", value);
+				break;
+			default:
+				plog(LLV_ERROR, LOCATION, NULL,
+					"lifetime data received without "
+					"lifetime data type.\n");
+				return -1;
+			}
+			break;
+		}
+
+		if (flag) {
+			tlen -= sizeof(*d);
+			d = (struct isakmp_data *)((char *)d
+				+ sizeof(*d));
+		} else {
+			tlen -= (sizeof(*d) + lorv);
+			d = (struct isakmp_data *)((char *)d
+				+ sizeof(*d) + lorv);
+		}
+	}
+
+	return 0;
+}
diff --git a/src/racoon/ipsec_doi.c b/src/racoon/ipsec_doi.c
index d0d289b..5890314 100644
--- a/src/racoon/ipsec_doi.c
+++ b/src/racoon/ipsec_doi.c
@@ -1,11 +1,11 @@
-/*	$NetBSD: ipsec_doi.c,v 1.23.4.10 2009/06/19 07:32:52 tteras Exp $	*/
+/*	$NetBSD: ipsec_doi.c,v 1.46 2010/12/14 17:57:31 tteras Exp $	*/
 
 /* Id: ipsec_doi.c,v 1.55 2006/08/17 09:20:41 vanhu Exp */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -17,7 +17,7 @@
  * 3. Neither the name of the project nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -83,9 +83,6 @@
 #ifdef ENABLE_NATT
 #include "nattraversal.h"
 #endif
-#ifdef ENABLE_HYBRID
-static int switch_authmethod(int);
-#endif
 
 #ifdef HAVE_GSSAPI
 #include <iconv.h>
@@ -97,19 +94,19 @@
 #endif
 #endif
 
-int verbose_proposal_check = 1;
+static vchar_t *get_ph1approval __P((struct ph1handle *, u_int32_t, u_int32_t,
+				     struct prop_pair **));
+static int get_ph1approvalx __P((struct remoteconf *, void *));
 
-static vchar_t *get_ph1approval __P((struct ph1handle *, struct prop_pair **));
-static struct isakmpsa *get_ph1approvalx __P((struct prop_pair *,
-	struct isakmpsa *, struct isakmpsa *, int));
-static void print_ph1mismatched __P((struct prop_pair *, struct isakmpsa *));
-static int t2isakmpsa __P((struct isakmp_pl_t *, struct isakmpsa *));
+static int t2isakmpsa __P((struct isakmp_pl_t *, struct isakmpsa *, u_int32_t));
 static int cmp_aproppair_i __P((struct prop_pair *, struct prop_pair *));
 static struct prop_pair *get_ph2approval __P((struct ph2handle *,
 	struct prop_pair **));
 static struct prop_pair *get_ph2approvalx __P((struct ph2handle *,
 	struct prop_pair *));
 static void free_proppair0 __P((struct prop_pair *));
+static struct prop_pair ** get_proppair_and_doi_sit __P((vchar_t *, int,
+							 u_int32_t *, u_int32_t *));
 
 static int get_transform
 	__P((struct isakmp_pl_p *, struct prop_pair **, int *));
@@ -158,12 +155,10 @@
 static vchar_t *setph2proposal0 __P((const struct ph2handle *,
 	const struct saprop *, const struct saproto *));
 
-static vchar_t *getidval __P((int, vchar_t *));
-
-#ifdef HAVE_GSSAPI
-static struct isakmpsa *fixup_initiator_sa __P((struct isakmpsa *,
-	struct isakmpsa *));
-#endif
+struct ph1approvalx_ctx {
+	struct prop_pair *p;
+	struct isakmpsa *sa;
+};
 
 /*%%%*/
 /*
@@ -182,40 +177,82 @@
 {
 	vchar_t *newsa;		/* new SA payload approved. */
 	struct prop_pair **pair;
+	u_int32_t doitype, sittype;
 
 	/* get proposal pair */
-	pair = get_proppair(sa, IPSECDOI_TYPE_PH1);
+	pair = get_proppair_and_doi_sit(sa, IPSECDOI_TYPE_PH1,
+					&doitype, &sittype);
 	if (pair == NULL)
 		return -1;
 
 	/* check and get one SA for use */
-	newsa = get_ph1approval(iph1, pair);
-	
+	newsa = get_ph1approval(iph1, doitype, sittype, pair);
 	free_proppair(pair);
 
 	if (newsa == NULL)
 		return -1;
 
 	iph1->sa_ret = newsa;
-
 	return 0;
 }
 
+static void
+print_ph1proposal(pair, s)
+	struct prop_pair *pair;
+	struct isakmpsa *s;
+{
+	struct isakmp_pl_p *prop = pair->prop;
+	struct isakmp_pl_t *trns = pair->trns;
+
+	plog(LLV_DEBUG, LOCATION, NULL,
+	     "prop#=%d, prot-id=%s, spi-size=%d, #trns=%d\n",
+	     prop->p_no, s_ipsecdoi_proto(prop->proto_id),
+	     prop->spi_size, prop->num_t);
+	plog(LLV_DEBUG, LOCATION, NULL,
+	     "trns#=%d, trns-id=%s\n",
+	     trns->t_no, s_ipsecdoi_trns(prop->proto_id, trns->t_id));
+	plog(LLV_DEBUG, LOCATION, NULL,
+	     "  lifetime = %ld\n", (long) s->lifetime);
+	plog(LLV_DEBUG, LOCATION, NULL,
+	     "  lifebyte = %zu\n", s->lifebyte);
+	plog(LLV_DEBUG, LOCATION, NULL,
+	     "  enctype = %s\n",
+	     s_oakley_attr_v(OAKLEY_ATTR_ENC_ALG, s->enctype));
+	plog(LLV_DEBUG, LOCATION, NULL,
+	     "  encklen = %d\n", s->encklen);
+	plog(LLV_DEBUG, LOCATION, NULL,
+	     "  hashtype = %s\n",
+	     s_oakley_attr_v(OAKLEY_ATTR_HASH_ALG, s->hashtype));
+	plog(LLV_DEBUG, LOCATION, NULL,
+	     "  authmethod = %s\n",
+	     s_oakley_attr_v(OAKLEY_ATTR_AUTH_METHOD, s->authmethod));
+	plog(LLV_DEBUG, LOCATION, NULL,
+	     "  dh_group = %s\n",
+	     s_oakley_attr_v(OAKLEY_ATTR_GRP_DESC, s->dh_group));
+}
+
+
 /*
  * acceptable check for remote configuration.
  * return a new SA payload to be reply to peer.
  */
+
 static vchar_t *
-get_ph1approval(iph1, pair)
+get_ph1approval(iph1, doitype, sittype, pair)
 	struct ph1handle *iph1;
+	u_int32_t doitype, sittype;
 	struct prop_pair **pair;
 {
 	vchar_t *newsa;
-	struct isakmpsa *sa, tsa;
+	struct ph1approvalx_ctx ctx;
 	struct prop_pair *s, *p;
-	int prophlen;
+	struct rmconfselector rmsel;
+	struct isakmpsa *sa;
 	int i;
 
+	memset(&rmsel, 0, sizeof(rmsel));
+	rmsel.remote = iph1->remote;
+
 	if (iph1->approval) {
 		delisakmpsa(iph1->approval);
 		iph1->approval = NULL;
@@ -225,42 +262,35 @@
 		if (pair[i] == NULL)
 			continue;
 		for (s = pair[i]; s; s = s->next) {
-			prophlen = 
-			    sizeof(struct isakmp_pl_p) + s->prop->spi_size;
-
 			/* compare proposal and select one */
 			for (p = s; p; p = p->tnext) {
-				if ((sa = get_ph1approvalx(p, 
-				    iph1->rmconf->proposal, &tsa, 
-				    iph1->rmconf->pcheck_level)) != NULL)
-					goto found;
+				struct isakmp_pl_p *prop = p->prop;
+
+				sa = newisakmpsa();
+				ctx.p = p;
+				ctx.sa = sa;
+				if (t2isakmpsa(p->trns, sa,
+					       iph1->vendorid_mask) < 0)
+					continue;
+				print_ph1proposal(p, sa);
+				if (iph1->rmconf != NULL) {
+					if (get_ph1approvalx(iph1->rmconf, &ctx))
+						goto found;
+				} else {
+					if (enumrmconf(&rmsel, get_ph1approvalx, &ctx))
+						goto found;
+				}
+				delisakmpsa(sa);
 			}
 		}
 	}
 
-	/*
-	 * if there is no suitable proposal, racoon complains about all of
-	 * mismatched items in those proposal.
-	 */
-	if (verbose_proposal_check) {
-		for (i = 0; i < MAXPROPPAIRLEN; i++) {
-			if (pair[i] == NULL)
-				continue;
-			for (s = pair[i]; s; s = s->next) {
-				prophlen = sizeof(struct isakmp_pl_p)
-						+ s->prop->spi_size;
-				for (p = s; p; p = p->tnext) {
-					print_ph1mismatched(p,
-						iph1->rmconf->proposal);
-				}
-			}
-		}
-	}
 	plog(LLV_ERROR, LOCATION, NULL, "no suitable proposal found.\n");
 
 	return NULL;
 
 found:
+	sa = ctx.sa;
 	plog(LLV_DEBUG, LOCATION, NULL, "an acceptable proposal found.\n");
 
 	/* check DH group settings */
@@ -277,7 +307,7 @@
 
 	if (oakley_setdhgroup(sa->dh_group, &sa->dhgrp) == -1) {
 		sa->dhgrp = NULL;
-		racoon_free(sa);
+		delisakmpsa(sa);
 		return NULL;
 	}
 
@@ -286,20 +316,16 @@
 	if (sa->gssid != NULL)
 		plog(LLV_DEBUG, LOCATION, NULL, "gss id in new sa '%.*s'\n",
 		    (int)sa->gssid->l, sa->gssid->v);
-	if (iph1-> side == INITIATOR) {
+	if (iph1->side == INITIATOR) {
 		if (iph1->rmconf->proposal->gssid != NULL)
 			iph1->gi_i = vdup(iph1->rmconf->proposal->gssid);
-		if (tsa.gssid != NULL)
-			iph1->gi_r = vdup(tsa.gssid);
-		iph1->approval = fixup_initiator_sa(sa, &tsa);
+		if (sa->gssid != NULL)
+			iph1->gi_r = vdup(sa->gssid);
 	} else {
-		if (tsa.gssid != NULL) {
-			iph1->gi_r = vdup(tsa.gssid);
+		if (sa->gssid != NULL) {
+			iph1->gi_r = vdup(sa->gssid);
 			iph1->gi_i = gssapi_get_id(iph1);
-			if (sa->gssid == NULL && iph1->gi_i != NULL)
-				sa->gssid = vdup(iph1->gi_i);
 		}
-		iph1->approval = sa;
 	}
 	if (iph1->gi_i != NULL)
 		plog(LLV_DEBUG, LOCATION, NULL, "GIi is %.*s\n",
@@ -307,19 +333,15 @@
 	if (iph1->gi_r != NULL)
 		plog(LLV_DEBUG, LOCATION, NULL, "GIr is %.*s\n",
 		    (int)iph1->gi_r->l, iph1->gi_r->v);
-#else
-	iph1->approval = sa;
 #endif
-	if(iph1->approval) {
-		plog(LLV_DEBUG, LOCATION, NULL, "agreed on %s auth.\n",
-		    s_oakley_attr_method(iph1->approval->authmethod));
-	}
+	plog(LLV_DEBUG, LOCATION, NULL, "agreed on %s auth.\n",
+	     s_oakley_attr_method(sa->authmethod));
 
-	newsa = get_sabyproppair(p, iph1);
-	if (newsa == NULL){
-		delisakmpsa(iph1->approval);
-		iph1->approval = NULL;
-	}
+	newsa = get_sabyproppair(doitype, sittype, p);
+	if (newsa == NULL)
+		delisakmpsa(sa);
+	else
+		iph1->approval = sa;
 
 	return newsa;
 }
@@ -327,228 +349,57 @@
 /*
  * compare peer's single proposal and all of my proposal.
  * and select one if suiatable.
- * p       : one of peer's proposal.
- * proposal: my proposals.
  */
-static struct isakmpsa *
-get_ph1approvalx(p, proposal, sap, check_level)
-	struct prop_pair *p;
-	struct isakmpsa *proposal, *sap;
-	int check_level;
+static int
+get_ph1approvalx(rmconf, ctx)
+	struct remoteconf *rmconf;
+	void *ctx;
 {
-	struct isakmp_pl_p *prop = p->prop;
-	struct isakmp_pl_t *trns = p->trns;
-	struct isakmpsa sa, *s, *tsap;
-	int authmethod;
+	struct ph1approvalx_ctx *pctx = (struct ph1approvalx_ctx *) ctx;
+	struct isakmpsa *sa;
 
-	plog(LLV_DEBUG, LOCATION, NULL,
-       		"prop#=%d, prot-id=%s, spi-size=%d, #trns=%d\n",
-		prop->p_no, s_ipsecdoi_proto(prop->proto_id),
-		prop->spi_size, prop->num_t);
+	/* do the hard work */
+	sa = checkisakmpsa(rmconf->pcheck_level, pctx->sa, rmconf->proposal);
+	if (sa == NULL)
+		return 0;
 
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"trns#=%d, trns-id=%s\n",
-		trns->t_no,
-		s_ipsecdoi_trns(prop->proto_id, trns->t_id));
+	/* duplicate and modify the found SA to match proposal */
+	sa = dupisakmpsa(sa);
 
-	tsap = sap != NULL ? sap : &sa;
-
-	memset(tsap, 0, sizeof(*tsap));
-	if (t2isakmpsa(trns, tsap) < 0)
-		return NULL;
-	for (s = proposal; s != NULL; s = s->next) {
-#ifdef ENABLE_HYBRID
-		authmethod = switch_authmethod(s->authmethod);
-#else
-		authmethod = s->authmethod;
-#endif
-		plog(LLV_DEBUG, LOCATION, NULL, "Compared: DB:Peer\n");
-		plog(LLV_DEBUG, LOCATION, NULL, "(lifetime = %ld:%ld)\n",
-			(long)s->lifetime, (long)tsap->lifetime);
-		plog(LLV_DEBUG, LOCATION, NULL, "(lifebyte = %zu:%zu)\n",
-			s->lifebyte, tsap->lifebyte);
-		plog(LLV_DEBUG, LOCATION, NULL, "enctype = %s:%s\n",
-			s_oakley_attr_v(OAKLEY_ATTR_ENC_ALG,
-					s->enctype),
-			s_oakley_attr_v(OAKLEY_ATTR_ENC_ALG,
-					tsap->enctype));
-		plog(LLV_DEBUG, LOCATION, NULL, "(encklen = %d:%d)\n",
-			s->encklen, tsap->encklen);
-		plog(LLV_DEBUG, LOCATION, NULL, "hashtype = %s:%s\n",
-			s_oakley_attr_v(OAKLEY_ATTR_HASH_ALG,
-					s->hashtype),
-			s_oakley_attr_v(OAKLEY_ATTR_HASH_ALG,
-					tsap->hashtype));
-		plog(LLV_DEBUG, LOCATION, NULL, "authmethod = %s:%s\n",
-			s_oakley_attr_v(OAKLEY_ATTR_AUTH_METHOD,
-					s->authmethod),
-			s_oakley_attr_v(OAKLEY_ATTR_AUTH_METHOD,
-					tsap->authmethod));
-		plog(LLV_DEBUG, LOCATION, NULL, "dh_group = %s:%s\n",
-			s_oakley_attr_v(OAKLEY_ATTR_GRP_DESC,
-					s->dh_group),
-			s_oakley_attr_v(OAKLEY_ATTR_GRP_DESC,
-					tsap->dh_group));
-#if 0
-		/* XXX to be considered ? */
-		if (tsap->lifebyte > s->lifebyte) ;
-#endif
-		/*
-		 * if responder side and peer's key length in proposal
-		 * is bigger than mine, it might be accepted.
-		 */
-		if(tsap->enctype == s->enctype &&
-		    tsap->authmethod == authmethod &&
-		    tsap->hashtype == s->hashtype &&
-		    tsap->dh_group == s->dh_group &&
-		    tsap->encklen == s->encklen) {
-			switch(check_level) {
-			case PROP_CHECK_OBEY:
-				goto found;
-				break;
-
-			case PROP_CHECK_STRICT:
-				if ((tsap->lifetime > s->lifetime) ||
-				    (tsap->lifebyte > s->lifebyte))
-					continue;
-				goto found;
-				break;
-
-			case PROP_CHECK_CLAIM:
-				if (tsap->lifetime < s->lifetime)
-					s->lifetime = tsap->lifetime;
-				if (tsap->lifebyte < s->lifebyte)
-					s->lifebyte = tsap->lifebyte;
-				goto found;
-				break;
-
-			case PROP_CHECK_EXACT:
-				if ((tsap->lifetime != s->lifetime) ||
-				    (tsap->lifebyte != s->lifebyte))
-					continue;
-				goto found;
-				break;
-
-			default:
-				plog(LLV_ERROR, LOCATION, NULL, 
-				    "Unexpected proposal_check value\n");
-				continue;
-				break;
-			}
-		}
+	switch (rmconf->pcheck_level) {
+	case PROP_CHECK_OBEY:
+		sa->lifetime = pctx->sa->lifetime;
+		sa->lifebyte = pctx->sa->lifebyte;
+		sa->encklen = pctx->sa->encklen;
+		break;
+	case PROP_CHECK_CLAIM:
+	case PROP_CHECK_STRICT:
+		if (pctx->sa->lifetime < sa->lifetime)
+			sa->lifetime = pctx->sa->lifetime;
+		if (pctx->sa->lifebyte < sa->lifebyte)
+			sa->lifebyte = pctx->sa->lifebyte;
+		if (pctx->sa->encklen > sa->encklen)
+			sa->encklen = pctx->sa->encklen;
+		break;
+	default:
+		break;
 	}
 
-found:
-	if (tsap->dhgrp != NULL){
-		oakley_dhgrp_free(tsap->dhgrp);
-		tsap->dhgrp = NULL;
-	}
+	/* replace the proposal with our approval sa */
+	delisakmpsa(pctx->sa);
+	pctx->sa = sa;
 
-	if ((s = dupisakmpsa(s)) != NULL) {
-		switch(check_level) {
-		case PROP_CHECK_OBEY:
-			s->lifetime = tsap->lifetime;
-			s->lifebyte = tsap->lifebyte;
-			break;
-
-		case PROP_CHECK_STRICT:
-			s->lifetime = tsap->lifetime;
-			s->lifebyte = tsap->lifebyte;
-			break;
-
-		case PROP_CHECK_CLAIM:
-			if (tsap->lifetime < s->lifetime)
-				s->lifetime = tsap->lifetime;
-			if (tsap->lifebyte < s->lifebyte)
-				s->lifebyte = tsap->lifebyte;
-			break;
-
-		default:
-			break;
-		}
-	}
-	return s;
-}
-
-/*
- * print all of items in peer's proposal which are mismatched to my proposal.
- * p       : one of peer's proposal.
- * proposal: my proposals.
- */
-static void
-print_ph1mismatched(p, proposal)
-	struct prop_pair *p;
-	struct isakmpsa *proposal;
-{
-	struct isakmpsa sa, *s;
-
-	memset(&sa, 0, sizeof(sa));
-	if (t2isakmpsa(p->trns, &sa) < 0)
-		return;
-	for (s = proposal; s ; s = s->next) {
-		if (sa.enctype != s->enctype) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"rejected enctype: "
-				"DB(prop#%d:trns#%d):Peer(prop#%d:trns#%d) = "
-				"%s:%s\n",
-				s->prop_no, s->trns_no,
-				p->prop->p_no, p->trns->t_no,
-				s_oakley_attr_v(OAKLEY_ATTR_ENC_ALG,
-					s->enctype),
-				s_oakley_attr_v(OAKLEY_ATTR_ENC_ALG,
-					sa.enctype));
-		}
-		if (sa.authmethod != s->authmethod) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"rejected authmethod: "
-				"DB(prop#%d:trns#%d):Peer(prop#%d:trns#%d) = "
-				"%s:%s\n",
-				s->prop_no, s->trns_no,
-				p->prop->p_no, p->trns->t_no,
-				s_oakley_attr_v(OAKLEY_ATTR_AUTH_METHOD,
-					s->authmethod),
-				s_oakley_attr_v(OAKLEY_ATTR_AUTH_METHOD,
-					sa.authmethod));
-		}
-		if (sa.hashtype != s->hashtype) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"rejected hashtype: "
-				"DB(prop#%d:trns#%d):Peer(prop#%d:trns#%d) = "
-				"%s:%s\n",
-				s->prop_no, s->trns_no,
-				p->prop->p_no, p->trns->t_no,
-				s_oakley_attr_v(OAKLEY_ATTR_HASH_ALG,
-					s->hashtype),
-				s_oakley_attr_v(OAKLEY_ATTR_HASH_ALG,
-					sa.hashtype));
-		}
-		if (sa.dh_group != s->dh_group) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"rejected dh_group: "
-				"DB(prop#%d:trns#%d):Peer(prop#%d:trns#%d) = "
-				"%s:%s\n",
-				s->prop_no, s->trns_no,
-				p->prop->p_no, p->trns->t_no,
-				s_oakley_attr_v(OAKLEY_ATTR_GRP_DESC,
-					s->dh_group),
-				s_oakley_attr_v(OAKLEY_ATTR_GRP_DESC,
-					sa.dh_group));
-		}
-	}
-
-	if (sa.dhgrp != NULL){
-		oakley_dhgrp_free(sa.dhgrp);
-		sa.dhgrp=NULL;
-	}
+	return 1;
 }
 
 /*
  * get ISAKMP data attributes
  */
 static int
-t2isakmpsa(trns, sa)
+t2isakmpsa(trns, sa, vendorid_mask)
 	struct isakmp_pl_t *trns;
 	struct isakmpsa *sa;
+	u_int32_t vendorid_mask;
 {
 	struct isakmp_data *d, *prev;
 	int flag, type;
@@ -618,6 +469,11 @@
 
 		case OAKLEY_ATTR_AUTH_METHOD:
 			sa->authmethod = ntohs(d->lorv);
+#ifdef HAVE_GSSAPI
+			if (sa->authmethod == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB_REAL &&
+			    (vendorid_mask & VENDORID_GSSAPI_MASK))
+				sa->authmethod = OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB;
+#endif
 			break;
 
 		case OAKLEY_ATTR_GRP_DESC:
@@ -770,7 +626,7 @@
 				plog(LLV_DEBUG, LOCATION, NULL,
 				    "received old-style gss "
 				    "id '%.*s' (len %zu)\n",
-				    (int)sa->gssid->l, sa->gssid->v, 
+				    (int)sa->gssid->l, sa->gssid->v,
 				    sa->gssid->l);
 				error = 0;
 				goto out;
@@ -805,7 +661,7 @@
 			dst = sa->gssid->v;
 			dstleft = len / 2;
 
-			rv = iconv(cd, (__iconv_const char **)&src, &srcleft, 
+			rv = iconv(cd, (__iconv_const char **)&src, &srcleft,
 				   &dst, &dstleft);
 			if (rv != 0) {
 				if (rv == -1) {
@@ -891,9 +747,11 @@
 {
 	struct prop_pair **pair;
 	struct prop_pair *ret;
+	u_int32_t doitype, sittype;
 
 	/* get proposal pair */
-	pair = get_proppair(iph2->sa, IPSECDOI_TYPE_PH2);
+	pair = get_proppair_and_doi_sit(iph2->sa, IPSECDOI_TYPE_PH2,
+					&doitype, &sittype);
 	if (pair == NULL)
 		return -1;
 
@@ -905,7 +763,7 @@
 
 	/* make a SA to be replayed. */
 	/* SPI must be updated later. */
-	iph2->sa_ret = get_sabyproppair(ret, iph2->ph1);
+	iph2->sa_ret = get_sabyproppair(doitype, sittype, ret);
 	free_proppair0(ret);
 	if (iph2->sa_ret == NULL)
 		return -1;
@@ -929,9 +787,11 @@
 	int i, n, num;
 	int error = -1;
 	vchar_t *sa_ret = NULL;
+	u_int32_t doitype, sittype;
 
 	/* get proposal pair of SA sent. */
-	spair = get_proppair(iph2->sa, IPSECDOI_TYPE_PH2);
+	spair = get_proppair_and_doi_sit(iph2->sa, IPSECDOI_TYPE_PH2,
+					 &doitype, &sittype);
 	if (spair == NULL) {
 		plog(LLV_ERROR, LOCATION, NULL,
 			"failed to get prop pair.\n");
@@ -972,7 +832,7 @@
 		plog(LLV_WARNING, LOCATION, NULL,
 			"invalid proposal number:%d received.\n", i);
 	}
-	
+
 
 	if (rpair[n]->tnext != NULL) {
 		plog(LLV_ERROR, LOCATION, NULL,
@@ -997,7 +857,7 @@
 
 	/* make a SA to be replayed. */
 	sa_ret = iph2->sa_ret;
-	iph2->sa_ret = get_sabyproppair(p, iph2->ph1);
+	iph2->sa_ret = get_sabyproppair(doitype, sittype, p);
 	free_proppair0(p);
 	if (iph2->sa_ret == NULL)
 		goto end;
@@ -1282,10 +1142,11 @@
  * get proposal pairs from SA payload.
  * tiny check for proposal payload.
  */
-struct prop_pair **
-get_proppair(sa, mode)
+static struct prop_pair **
+get_proppair_and_doi_sit(sa, mode, doitype, sittype)
 	vchar_t *sa;
 	int mode;
+	u_int32_t *doitype, *sittype;
 {
 	struct prop_pair **pair = NULL;
 	int num_p = 0;			/* number of proposal for use */
@@ -1307,10 +1168,14 @@
 	/* check DOI */
 	if (check_doi(ntohl(sab->doi)) < 0)
 		goto bad;
+	if (doitype != NULL)
+		*doitype = ntohl(sab->doi);
 
 	/* check SITUATION */
 	if (check_situation(ntohl(sab->sit)) < 0)
 		goto bad;
+	if (sittype != NULL)
+		*sittype = ntohl(sab->sit);
 
 	pair = racoon_calloc(1, MAXPROPPAIRLEN * sizeof(*pair));
 	if (pair == NULL) {
@@ -1446,6 +1311,15 @@
 	return NULL;
 }
 
+struct prop_pair **
+get_proppair(sa, mode)
+	vchar_t *sa;
+	int mode;
+{
+	return get_proppair_and_doi_sit(sa, mode, NULL, NULL);
+}
+
+
 /*
  * check transform payload.
  * OUT:
@@ -1560,9 +1434,9 @@
  * NOTE: this function make spi value clear.
  */
 vchar_t *
-get_sabyproppair(pair, iph1)
+get_sabyproppair(doitype, sittype, pair)
+	u_int32_t doitype, sittype;
 	struct prop_pair *pair;
-	struct ph1handle *iph1;
 {
 	vchar_t *newsa;
 	int newtlen;
@@ -1588,8 +1462,8 @@
 	((struct isakmp_gen *)bp)->len = htons(newtlen);
 
 	/* update some of values in SA header */
-	((struct ipsecdoi_sa_b *)bp)->doi = htonl(iph1->rmconf->doitype);
-	((struct ipsecdoi_sa_b *)bp)->sit = htonl(iph1->rmconf->sittype);
+	((struct ipsecdoi_sa_b *)bp)->doi = htonl(doitype);
+	((struct ipsecdoi_sa_b *)bp)->sit = htonl(sittype);
 	bp += sizeof(struct ipsecdoi_sa_b);
 
 	/* create proposal payloads */
@@ -1824,6 +1698,96 @@
 	return ld;
 }
 
+/*
+ * parse responder-lifetime attributes from payload
+ */
+int
+ipsecdoi_parse_responder_lifetime(notify, lifetime_sec, lifetime_kb)
+	struct isakmp_pl_n *notify;
+	u_int32_t *lifetime_sec;
+	u_int32_t *lifetime_kb;
+{
+	struct isakmp_data *d;
+	int flag, type, tlen, ld_type = -1;
+	u_int16_t lorv;
+	u_int32_t value;
+
+	tlen = ntohs(notify->h.len) - sizeof(*notify) - notify->spi_size;
+        d = (struct isakmp_data *)((char *)(notify + 1) +
+		notify->spi_size);
+
+	while (tlen >= sizeof(struct isakmp_data)) {
+		type = ntohs(d->type) & ~ISAKMP_GEN_MASK;
+		flag = ntohs(d->type) & ISAKMP_GEN_MASK;
+		lorv = ntohs(d->lorv);
+
+		plog(LLV_DEBUG, LOCATION, NULL,
+			"type=%s, flag=0x%04x, lorv=%s\n",
+			s_ipsecdoi_attr(type), flag,
+			s_ipsecdoi_attr_v(type, lorv));
+
+		switch (type) {
+		case IPSECDOI_ATTR_SA_LD_TYPE:
+			if (! flag) {
+				plog(LLV_ERROR, LOCATION, NULL,
+					"must be TV when LD_TYPE.\n");
+				return -1;
+			}
+			ld_type = lorv;
+			break;
+		case IPSECDOI_ATTR_SA_LD:
+			if (flag)
+				value = lorv;
+			else if (lorv == 2)
+				value = ntohs(*(u_int16_t *)(d + 1));
+			else if (lorv == 4)
+				value = ntohl(*(u_int32_t *)(d + 1));
+			else {
+				plog(LLV_ERROR, LOCATION, NULL,
+					"payload length %d for lifetime "
+					"data length is unsupported.\n", lorv);
+				return -1;
+			}
+
+			switch (ld_type) {
+			case IPSECDOI_ATTR_SA_LD_TYPE_SEC:
+				if (lifetime_sec != NULL)
+					*lifetime_sec = value;
+				plog(LLV_INFO, LOCATION, NULL,
+					"received RESPONDER-LIFETIME: %d "
+					"seconds\n", value);
+				break;
+			case IPSECDOI_ATTR_SA_LD_TYPE_KB:
+				if (lifetime_kb != NULL)
+					*lifetime_kb = value;
+				plog(LLV_INFO, LOCATION, NULL,
+					"received RESPONDER-LIFETIME: %d "
+					"kbytes\n", value);
+				break;
+			default:
+				plog(LLV_ERROR, LOCATION, NULL,
+					"lifetime data received without "
+					"lifetime data type.\n");
+				return -1;
+			}
+			break;
+		}
+
+		if (flag) {
+			tlen -= sizeof(*d);
+			d = (struct isakmp_data *)((char *)d
+				+ sizeof(*d));
+		} else {
+			tlen -= (sizeof(*d) + lorv);
+			d = (struct isakmp_data *)((char *)d
+				+ sizeof(*d) + lorv);
+		}
+	}
+
+	return 0;
+}
+
+
 /*%%%*/
 /*
  * check DOI
@@ -2130,11 +2094,12 @@
 #ifdef ENABLE_HYBRID
 			case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
 			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I:
-#if 0 /* Clashes with OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB */
+#endif
+#if defined(ENABLE_HYBRID) || defined(HAVE_GSSAPI)
+				/* These two authentication method IDs overlap. */
 			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I:
+			/*case OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB:*/
 #endif
-#endif
-			case OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB:
 				break;
 			case OAKLEY_ATTR_AUTH_METHOD_DSSSIG:
 #ifdef ENABLE_HYBRID
@@ -2351,7 +2316,7 @@
  				if (proto_id == IPSECDOI_PROTO_IPSEC_AH) {
  					if (trns->t_id != IPSECDOI_AH_SHA256)
  						goto ahmismatch;
- 				}	
+ 				}
  				break;
  			case IPSECDOI_ATTR_AUTH_HMAC_SHA2_384:
  				if (proto_id == IPSECDOI_PROTO_IPSEC_AH) {
@@ -2638,7 +2603,8 @@
  * NOT INCLUDING isakmp general header of SA payload
  */
 vchar_t *
-ipsecdoi_setph1proposal(props)
+ipsecdoi_setph1proposal(rmconf, props)
+	struct remoteconf *rmconf;
 	struct isakmpsa *props;
 {
 	vchar_t *mysa;
@@ -2658,8 +2624,8 @@
 
 	/* create SA payload */
 	/* not including isakmp general header */
-	((struct ipsecdoi_sa_b *)mysa->v)->doi = htonl(props->rmconf->doitype);
-	((struct ipsecdoi_sa_b *)mysa->v)->sit = htonl(props->rmconf->sittype);
+	((struct ipsecdoi_sa_b *)mysa->v)->doi = htonl(rmconf->doitype);
+	((struct ipsecdoi_sa_b *)mysa->v)->sit = htonl(rmconf->sittype);
 
 	(void)setph1prop(props, mysa->v + sizeof(struct ipsecdoi_sa_b));
 
@@ -2767,7 +2733,7 @@
 						OAKLEY_ATTR_SA_LD_TYPE_SEC);
 			if (sa->lifetime > 0xffff) {
 				p = isakmp_set_attr_v(p, OAKLEY_ATTR_SA_LD,
-						(caddr_t)&lifetime, 
+						(caddr_t)&lifetime,
 						sizeof(lifetime));
 			} else {
 				p = isakmp_set_attr_l(p, OAKLEY_ATTR_SA_LD,
@@ -2778,7 +2744,7 @@
 
 	if (sa->lifebyte) {
 		u_int32_t lifebyte = htonl((u_int32_t)sa->lifebyte);
-		
+
 		attrlen += sizeof(struct isakmp_data)
 			+ sizeof(struct isakmp_data);
 		if (sa->lifebyte > 0xffff)
@@ -2810,11 +2776,8 @@
 	if (sa->authmethod) {
 		int authmethod;
 
-#ifdef ENABLE_HYBRID
-		authmethod = switch_authmethod(sa->authmethod);
-#else
-		authmethod = sa->authmethod;
-#endif
+		authmethod = isakmpsa_switch_authmethod(sa->authmethod);
+		authmethod &= 0xffff;
 		attrlen += sizeof(struct isakmp_data);
 		if (buf)
 			p = isakmp_set_attr_l(p, OAKLEY_ATTR_AUTH_METHOD, authmethod);
@@ -2896,7 +2859,7 @@
 					goto gssid_done;
 				}
 				odst = dst;
-				rv = iconv(cd, (__iconv_const char **)&src, 
+				rv = iconv(cd, (__iconv_const char **)&src,
 				    &srcleft, &dst, &dstleft);
 				if (rv != 0) {
 					if (rv == -1) {
@@ -2989,7 +2952,7 @@
 	np_t = NULL;
 
 	for (tr = pr->head; tr; tr = tr->next) {
-	
+
 		switch (pr->proto_id) {
 		case IPSECDOI_PROTO_IPSEC_ESP:
 			/*
@@ -3237,7 +3200,9 @@
 
 	for (; pp; pp = pp->next) {
 		for (pr = pp->head; pr; pr = pr->next) {
-			if (pr->encmode != IPSECDOI_ATTR_ENC_MODE_TRNS)
+			if (pr->encmode != IPSECDOI_ATTR_ENC_MODE_TRNS &&
+			    pr->encmode != IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC &&
+			    pr->encmode != IPSECDOI_ATTR_ENC_MODE_UDPTRNS_DRAFT)
 				return 0;
 		}
 	}
@@ -3597,8 +3562,6 @@
 	struct ph1handle *iph1;
 {
 	struct ipsecdoi_id_b *id_b;
-	struct sockaddr *sa;
-	caddr_t sa1, sa2;
 
 	if (iph1->id_p == NULL) {
 		plog(LLV_ERROR, LOCATION, NULL,
@@ -3614,7 +3577,6 @@
 
 	id_b = (struct ipsecdoi_id_b *)iph1->id_p->v;
 
-#ifndef ANDROID_PATCHED
 	/* In main mode with pre-shared key, only address type can be used. */
 	if (iph1->etype == ISAKMP_ETYPE_IDENT &&
 	    iph1->approval->authmethod == OAKLEY_ATTR_AUTH_METHOD_PSKEY) {
@@ -3626,7 +3588,6 @@
 			return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
 		}
 	}
-#endif
 
 	/* if proper type for phase 1 ? */
 	switch (id_b->type) {
@@ -3670,73 +3631,12 @@
 		}
 	}
 
-	/* compare with the ID if specified. */
-	if (genlist_next(iph1->rmconf->idvl_p, 0)) {
-		vchar_t *ident0 = NULL;
-		vchar_t ident;
-		struct idspec *id;
-		struct genlist_entry *gpb;
+	/* resolve remote configuration if not done yet */
+	if (resolveph1rmconf(iph1) < 0)
+		return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
 
-		for (id = genlist_next (iph1->rmconf->idvl_p, &gpb); id; id = genlist_next (0, &gpb)) {
-			/* check the type of both IDs */
-			if (id->idtype != doi2idtype(id_b->type))
-				continue;  /* ID type mismatch */
-			if (id->id == 0)
-				goto matched;
-
-			/* compare defined ID with the ID sent by peer. */
-			if (ident0 != NULL)
-				vfree(ident0);
-			ident0 = getidval(id->idtype, id->id);
-
-			switch (id->idtype) {
-			case IDTYPE_ASN1DN:
-				ident.v = iph1->id_p->v + sizeof(*id_b);
-				ident.l = iph1->id_p->l - sizeof(*id_b);
-				if (eay_cmp_asn1dn(ident0, &ident) == 0)
-					goto matched;
-				break;
-			case IDTYPE_ADDRESS:
-				sa = (struct sockaddr *)ident0->v;
-				sa2 = (caddr_t)(id_b + 1);
-				switch (sa->sa_family) {
-				case AF_INET:
-					if (iph1->id_p->l - sizeof(*id_b) != sizeof(struct in_addr))
-						continue;  /* ID value mismatch */
-					sa1 = (caddr_t)&((struct sockaddr_in *)sa)->sin_addr;
-					if (memcmp(sa1, sa2, sizeof(struct in_addr)) == 0)
-						goto matched;
-					break;
-#ifdef INET6
-				case AF_INET6:
-					if (iph1->id_p->l - sizeof(*id_b) != sizeof(struct in6_addr))
-						continue;  /* ID value mismatch */
-					sa1 = (caddr_t)&((struct sockaddr_in6 *)sa)->sin6_addr;
-					if (memcmp(sa1, sa2, sizeof(struct in6_addr)) == 0)
-						goto matched;
-					break;
-#endif
-				default:
-					break;
-				}
-				break;
-			default:
-				if (memcmp(ident0->v, id_b + 1, ident0->l) == 0)
-					goto matched;
-				break;
-			}
-		}
-		if (ident0 != NULL) {
-			vfree(ident0);
-			ident0 = NULL;
-		}
-		plog(LLV_WARNING, LOCATION, NULL, "No ID match.\n");
-		if (iph1->rmconf->verify_identifier)
-			return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
-matched: /* ID value match */
-		if (ident0 != NULL)
-			vfree(ident0);
-	}
+	if (iph1->rmconf == NULL)
+		return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
 
 	return 0;
 }
@@ -3763,15 +3663,15 @@
 	switch (iph1->rmconf->idvtype) {
 	case IDTYPE_FQDN:
 		id_b.type = IPSECDOI_ID_FQDN;
-		ident = getidval(iph1->rmconf->idvtype, iph1->rmconf->idv);
+		ident = vdup(iph1->rmconf->idv);
 		break;
 	case IDTYPE_USERFQDN:
 		id_b.type = IPSECDOI_ID_USER_FQDN;
-		ident = getidval(iph1->rmconf->idvtype, iph1->rmconf->idv);
+		ident = vdup(iph1->rmconf->idv);
 		break;
 	case IDTYPE_KEYID:
 		id_b.type = IPSECDOI_ID_KEY_ID;
-		ident = getidval(iph1->rmconf->idvtype, iph1->rmconf->idv);
+		ident = vdup(iph1->rmconf->idv);
 		break;
 	case IDTYPE_ASN1DN:
 		id_b.type = IPSECDOI_ID_DER_ASN1_DN;
@@ -3784,7 +3684,7 @@
 					"failed to get own CERT.\n");
 				goto err;
 			}
-			ident = eay_get_x509asn1subjectname(&iph1->cert->cert);
+			ident = eay_get_x509asn1subjectname(iph1->cert);
 		}
 		break;
 	case IDTYPE_ADDRESS:
@@ -3829,7 +3729,7 @@
 		if (!ident) {
 			plog(LLV_ERROR, LOCATION, NULL,
 				"failed to get ID buffer.\n");
-			return 0;
+			return -1;
 		}
 		memcpy(ident->v, p, ident->l);
 	    }
@@ -3837,7 +3737,7 @@
 	if (!ident) {
 		plog(LLV_ERROR, LOCATION, NULL,
 			"failed to get ID buffer.\n");
-		return 0;
+		return -1;
 	}
 
 	ret = vmalloc(sizeof(id_b) + ident->l);
@@ -3865,21 +3765,6 @@
 	return -1;
 }
 
-static vchar_t *
-getidval(type, val)
-	int type;
-	vchar_t *val;
-{
-	vchar_t *new = NULL;
-
-	if (val)
-		new = vdup(val);
-	else if (lcconf->ident[type])
-		new = vdup(lcconf->ident[type]);
-
-	return new;
-}
-
 /* it's only called by cfparse.y. */
 int
 set_identifier(vpp, type, value)
@@ -3922,9 +3807,9 @@
 		memcpy(new->v, value->v, new->l);
 		break;
 	case IDTYPE_KEYID:
-		/* 
+		/*
 		 * If no qualifier is specified: IDQUAL_UNSPEC. It means
-		 * to use a file for backward compatibility sake. 
+		 * to use a file for backward compatibility sake.
 		 */
 		switch(qual) {
 		case IDQUAL_FILE:
@@ -3969,7 +3854,7 @@
 			return -1;
 		}
 		break;
-	
+
 	case IDTYPE_ADDRESS: {
 		struct sockaddr *sa;
 
@@ -4013,7 +3898,7 @@
 
 			xn = d2i_X509_NAME(NULL, (void *)&ptr, new->l);
 			bio = BIO_new(BIO_s_mem());
-			
+
 			X509_NAME_print_ex(bio, xn, 0, 0);
 			len = BIO_get_mem_data(bio, &ptr);
 			save = ptr[len];
@@ -4053,8 +3938,25 @@
 		return -1;
 	}
 
-	iph2->id = ipsecdoi_sockaddr2id((struct sockaddr *)&sp->spidx.src,
-					sp->spidx.prefs, sp->spidx.ul_proto);
+	if (!ipsecdoi_transportmode(iph2->proposal))
+		iph2->id = ipsecdoi_sockaddr2id((struct sockaddr *)&sp->spidx.src,
+				sp->spidx.prefs, sp->spidx.ul_proto);
+	else if (iph2->sa_src != NULL) {
+		/* He have a specific hint indicating that the transport
+		 * mode SA will be negotiated using addresses that differ
+		 * with the one from the SA. We need to indicate that to
+		 * our peer by setting the SA address as ID.
+		 * This is typically the case for the bootstrapping of the
+		 * transport mode SA protecting BU/BA for MIPv6 traffic
+		 *
+		 * --arno*/
+		iph2->id = ipsecdoi_sockaddr2id(iph2->sa_src,
+						IPSECDOI_PREFIX_HOST,
+						sp->spidx.ul_proto);
+	} else
+		iph2->id = ipsecdoi_sockaddr2id(iph2->src, IPSECDOI_PREFIX_HOST,
+						sp->spidx.ul_proto);
+
 	if (iph2->id == NULL) {
 		plog(LLV_ERROR, LOCATION, NULL,
 			"failed to get ID for %s\n",
@@ -4065,8 +3967,18 @@
 		s_ipsecdoi_ident(((struct ipsecdoi_id_b *)iph2->id->v)->type));
 
 	/* remote side */
-	iph2->id_p = ipsecdoi_sockaddr2id((struct sockaddr *)&sp->spidx.dst,
+	if (!ipsecdoi_transportmode(iph2->proposal))
+		iph2->id_p = ipsecdoi_sockaddr2id((struct sockaddr *)&sp->spidx.dst,
 				sp->spidx.prefd, sp->spidx.ul_proto);
+	else if (iph2->sa_dst != NULL) {
+		/* See comment above for local side. */
+		iph2->id_p = ipsecdoi_sockaddr2id(iph2->sa_dst,
+						  IPSECDOI_PREFIX_HOST,
+						  sp->spidx.ul_proto);
+	} else
+		iph2->id_p = ipsecdoi_sockaddr2id(iph2->dst, IPSECDOI_PREFIX_HOST,
+			sp->spidx.ul_proto);
+
 	if (iph2->id_p == NULL) {
 		plog(LLV_ERROR, LOCATION, NULL,
 			"failed to get ID for %s\n",
@@ -4103,7 +4015,7 @@
 	switch (saddr->sa_family) {
 	case AF_INET:
 		len1 = sizeof(struct in_addr);
-		if (prefixlen == (sizeof(struct in_addr) << 3)) {
+		if (prefixlen >= (sizeof(struct in_addr) << 3)) {
 			type = IPSECDOI_ID_IPV4_ADDR;
 			len2 = 0;
 		} else {
@@ -4116,7 +4028,7 @@
 #ifdef INET6
 	case AF_INET6:
 		len1 = sizeof(struct in6_addr);
-		if (prefixlen == (sizeof(struct in6_addr) << 3)) {
+		if (prefixlen >= (sizeof(struct in6_addr) << 3)) {
 			type = IPSECDOI_ID_IPV6_ADDR;
 			len2 = 0;
 		} else {
@@ -4161,7 +4073,7 @@
 
 	/* set prefix */
 	if (len2) {
-		u_char *p = (unsigned char *) new->v + 
+		u_char *p = (unsigned char *) new->v +
 			sizeof(struct ipsecdoi_id_b) + len1;
 		u_int bits = prefixlen;
 
@@ -4232,10 +4144,10 @@
 	port = ((struct sockaddr_in *)(laddr))->sin_port;
 	((struct ipsecdoi_id_b *)new->v)->port =
 		port == IPSEC_PORT_ANY ? 0 : port;
-	memcpy(new->v + sizeof(struct ipsecdoi_id_b), 
-	       (caddr_t)&((struct sockaddr_in *)(laddr))->sin_addr, 
+	memcpy(new->v + sizeof(struct ipsecdoi_id_b),
+	       (caddr_t)&((struct sockaddr_in *)(laddr))->sin_addr,
 	       len1);
-	memcpy(new->v + sizeof(struct ipsecdoi_id_b) + len1, 
+	memcpy(new->v + sizeof(struct ipsecdoi_id_b) + len1,
 	       (caddr_t)&((struct sockaddr_in *)haddr)->sin_addr,
 	       len2);
 	return new;
@@ -4254,9 +4166,14 @@
 	u_int8_t *prefixlen;
 	u_int16_t *ul_proto;
 {
-	struct ipsecdoi_id_b *id_b = (struct ipsecdoi_id_b *)buf->v;
+	struct ipsecdoi_id_b *id_b = NULL;
 	u_int plen = 0;
 
+	if (buf == NULL)
+		return ISAKMP_INTERNAL_ERROR;
+
+	id_b = (struct ipsecdoi_id_b *)buf->v;
+
 	/*
 	 * When a ID payload of subnet type with a IP address of full bit
 	 * masked, it has to be processed as host address.
@@ -4291,6 +4208,11 @@
 				: id_b->port);		/* see sockaddr2id() */
 		memcpy(&((struct sockaddr_in6 *)saddr)->sin6_addr,
 			buf->v + sizeof(*id_b), sizeof(struct in6_addr));
+		((struct sockaddr_in6 *)saddr)->sin6_scope_id =
+			(IN6_IS_ADDR_LINKLOCAL(&((struct sockaddr_in6 *)saddr)->sin6_addr)
+				? ((struct sockaddr_in6 *)id_b)->sin6_scope_id
+				: 0);
+
 		break;
 #endif
 	default:
@@ -4384,29 +4306,20 @@
 	char *dat;
 	static char buf[BUFLEN];
 	struct ipsecdoi_id_b *id_b = (struct ipsecdoi_id_b *)id->v;
-	struct sockaddr_storage saddr_storage;
-	struct sockaddr        *saddr;
-	struct sockaddr_in     *saddr_in;
-	struct sockaddr_in6    *saddr_in6;
+	union sockaddr_any saddr;
 	u_int plen = 0;
 
-	saddr     = (struct sockaddr *)&saddr_storage;
-	saddr_in  = (struct sockaddr_in *)&saddr_storage;
-	saddr_in6 = (struct sockaddr_in6 *)&saddr_storage;
-
-	
 	switch (id_b->type) {
 	case IPSECDOI_ID_IPV4_ADDR:
 	case IPSECDOI_ID_IPV4_ADDR_SUBNET:
 	case IPSECDOI_ID_IPV4_ADDR_RANGE:
 
 #ifndef __linux__
-		saddr->sa_len = sizeof(struct sockaddr_in);
+		saddr.sa.sa_len = sizeof(struct sockaddr_in);
 #endif
-		saddr->sa_family = AF_INET;
-
-		saddr_in->sin_port = IPSEC_PORT_ANY;
-		memcpy(&saddr_in->sin_addr,
+		saddr.sa.sa_family = AF_INET;
+		saddr.sin.sin_port = IPSEC_PORT_ANY;
+		memcpy(&saddr.sin.sin_addr,
 			id->v + sizeof(*id_b), sizeof(struct in_addr));
 		break;
 #ifdef INET6
@@ -4415,15 +4328,14 @@
 	case IPSECDOI_ID_IPV6_ADDR_RANGE:
 
 #ifndef __linux__
-		saddr->sa_len = sizeof(struct sockaddr_in6);
+		saddr.sa.sa_len = sizeof(struct sockaddr_in6);
 #endif
-		saddr->sa_family = AF_INET6;
-
-		saddr_in6->sin6_port = IPSEC_PORT_ANY;
-		memcpy(&saddr_in6->sin6_addr,
+		saddr.sa.sa_family = AF_INET6;
+		saddr.sin6.sin6_port = IPSEC_PORT_ANY;
+		memcpy(&saddr.sin6.sin6_addr,
 			id->v + sizeof(*id_b), sizeof(struct in6_addr));
-		saddr_in6->sin6_scope_id =
-			(IN6_IS_ADDR_LINKLOCAL(&saddr_in6->sin6_addr)
+		saddr.sin6.sin6_scope_id =
+			(IN6_IS_ADDR_LINKLOCAL(&saddr.sin6.sin6_addr)
 				? ((struct sockaddr_in6 *)id_b)->sin6_scope_id
 				: 0);
 		break;
@@ -4435,7 +4347,7 @@
 #ifdef INET6
 	case IPSECDOI_ID_IPV6_ADDR:
 #endif
-		len = snprintf( buf, BUFLEN, "%s", saddrwop2str(saddr));
+		len = snprintf( buf, BUFLEN, "%s", saddrwop2str(&saddr.sa));
 		break;
 
 	case IPSECDOI_ID_IPV4_ADDR_SUBNET:
@@ -4491,47 +4403,44 @@
 			plen += l;
 		}
 
-		len = snprintf( buf, BUFLEN, "%s/%i", saddrwop2str(saddr), plen);
+		len = snprintf( buf, BUFLEN, "%s/%i", saddrwop2str(&saddr.sa), plen);
 	    }
 		break;
 
 	case IPSECDOI_ID_IPV4_ADDR_RANGE:
 
-		len = snprintf( buf, BUFLEN, "%s-", saddrwop2str(saddr));
+		len = snprintf( buf, BUFLEN, "%s-", saddrwop2str(&saddr.sa));
 
 #ifndef __linux__
-		saddr->sa_len = sizeof(struct sockaddr_in);
+		saddr.sa.sa_len = sizeof(struct sockaddr_in);
 #endif
-		saddr->sa_family = AF_INET;
-		saddr_in->sin_port = IPSEC_PORT_ANY;
-		memcpy(&saddr_in->sin_addr,
+		saddr.sa.sa_family = AF_INET;
+		saddr.sin.sin_port = IPSEC_PORT_ANY;
+		memcpy(&saddr.sin.sin_addr,
 			id->v + sizeof(*id_b) + sizeof(struct in_addr),
 			sizeof(struct in_addr));
 
-		len += snprintf( buf + len, BUFLEN - len, "%s", saddrwop2str(saddr));
-
+		len += snprintf(buf + len, BUFLEN - len, "%s", saddrwop2str(&saddr.sa));
 		break;
 
 #ifdef INET6
 	case IPSECDOI_ID_IPV6_ADDR_RANGE:
-
-		len = snprintf( buf, BUFLEN, "%s-", saddrwop2str(saddr));
+		len = snprintf( buf, BUFLEN, "%s-", saddrwop2str(&saddr.sa));
 
 #ifndef __linux__
-		saddr->sa_len = sizeof(struct sockaddr_in6);
+		saddr.sa.sa_len = sizeof(struct sockaddr_in6);
 #endif
-		saddr->sa_family = AF_INET6;
-		saddr_in6->sin6_port = IPSEC_PORT_ANY;
-		memcpy(&saddr_in6->sin6_addr,
+		saddr.sa.sa_family = AF_INET6;
+		saddr.sin6.sin6_port = IPSEC_PORT_ANY;
+		memcpy(&saddr.sin6.sin6_addr,
 			id->v + sizeof(*id_b) + sizeof(struct in6_addr),
 			sizeof(struct in6_addr));
-		saddr_in6->sin6_scope_id =
-			(IN6_IS_ADDR_LINKLOCAL(&saddr_in6->sin6_addr)
+		saddr.sin6.sin6_scope_id =
+			(IN6_IS_ADDR_LINKLOCAL(&saddr.sin6.sin6_addr)
 				? ((struct sockaddr_in6 *)id_b)->sin6_scope_id
 				: 0);
 
-		len += snprintf( buf + len, BUFLEN - len, "%s", saddrwop2str(saddr));
-
+		len += snprintf(buf + len, BUFLEN - len, "%s", saddrwop2str(&saddr.sa));
 		break;
 #endif
 
@@ -4836,24 +4745,12 @@
 	return -1;
 }
 
-#ifdef HAVE_GSSAPI
-struct isakmpsa *
-fixup_initiator_sa(match, received)
-	struct isakmpsa *match, *received;
-{
-	if (received->gssid != NULL)
-		match->gssid = vdup(received->gssid);
-
-	return match;
-}
-#endif
-
 static int rm_idtype2doi[] = {
 	255,				/* IDTYPE_UNDEFINED, 0 */
 	IPSECDOI_ID_FQDN,		/* IDTYPE_FQDN, 1 */
 	IPSECDOI_ID_USER_FQDN,		/* IDTYPE_USERFQDN, 2 */
 	IPSECDOI_ID_KEY_ID,		/* IDTYPE_KEYID, 3 */
-	255,    /*			   IDTYPE_ADDRESS, 4 
+	255,    /*			   IDTYPE_ADDRESS, 4
 		 * it expands into 4 types by another function. */
 	IPSECDOI_ID_DER_ASN1_DN,	/* IDTYPE_ASN1DN, 5 */
 };
@@ -4898,39 +4795,3 @@
 	}
 	/*NOTREACHED*/
 }
-
-#ifdef ENABLE_HYBRID
-static int
-switch_authmethod(authmethod)
-	int authmethod;
-{
-	switch(authmethod) {
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R:
-		authmethod = OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I;
-		break;
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R:
-		authmethod = OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I;
-		break;
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
-		authmethod = OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I;
-		break;
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R:
-		authmethod = OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I;
-		break;
-	/* Those are not implemented */
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R:
-		authmethod = OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I;
-		break;
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_R:
-		authmethod = OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_I;
-		break;
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_R:
-		authmethod = OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_I;
-		break;
-	default:
-		break;
-	}
-
-	return authmethod;
-}
-#endif
diff --git a/src/racoon/ipsec_doi.h b/src/racoon/ipsec_doi.h
index 21dd93d..19a861a 100644
--- a/src/racoon/ipsec_doi.h
+++ b/src/racoon/ipsec_doi.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: ipsec_doi.h,v 1.9 2006/12/09 05:52:57 manu Exp $	*/
+/*	$NetBSD: ipsec_doi.h,v 1.12 2009/03/12 10:57:26 tteras Exp $	*/
 
 /* Id: ipsec_doi.h,v 1.15 2006/08/11 16:06:30 vanhu Exp */
 
@@ -34,6 +34,8 @@
 #ifndef _IPSEC_DOI_H
 #define _IPSEC_DOI_H
 
+#include "isakmp.h"
+
 /* refered to RFC2407 */
 
 #define IPSEC_DOI 1
@@ -197,6 +199,12 @@
 #define IPSECDOI_TYPE_PH1	0
 #define IPSECDOI_TYPE_PH2	1
 
+/*
+ * Prefix that will make ipsecdoi_sockaddr2id() generate address type
+ * identities without knowning the exact length of address.
+ */
+#define IPSECDOI_PREFIX_HOST	0xff
+
 struct isakmpsa;
 struct ipsecdoi_pl_sa;
 struct saprop;
@@ -209,7 +217,11 @@
 extern int ipsecdoi_checkph2proposal __P((struct ph2handle *));
 
 extern struct prop_pair **get_proppair __P((vchar_t *, int));
+#ifdef ANDROID_PATCHED
 extern vchar_t *get_sabyproppair __P((struct prop_pair *, struct ph1handle *));
+#else
+extern vchar_t *get_sabyproppair __P((u_int32_t, u_int32_t, struct prop_pair *));
+#endif
 extern int ipsecdoi_updatespi __P((struct ph2handle *iph2));
 extern vchar_t *get_sabysaprop __P((struct saprop *, vchar_t *));
 extern int ipsecdoi_chkcmpids( const vchar_t *, const vchar_t *, int );
@@ -225,7 +237,8 @@
 extern vchar_t *ipsecdoi_sockrange2id __P((	struct sockaddr *,
 	struct sockaddr *, u_int));
 
-extern vchar_t *ipsecdoi_setph1proposal __P((struct isakmpsa *));
+extern vchar_t *ipsecdoi_setph1proposal __P((struct remoteconf *,
+					     struct isakmpsa *));
 extern int ipsecdoi_setph2proposal __P((struct ph2handle *));
 extern int ipsecdoi_transportmode __P((struct saprop *));
 extern int ipsecdoi_get_defaultlifetime __P((void));
@@ -239,5 +252,8 @@
 extern int idtype2doi __P((int));
 extern int doi2idtype __P((int));
 
+extern int ipsecdoi_parse_responder_lifetime __P((struct isakmp_pl_n *notify,
+	u_int32_t *lifetime_sec, u_int32_t *liftime_kb));
+
 
 #endif /* _IPSEC_DOI_H */
diff --git a/src/racoon/isakmp.c b/src/racoon/isakmp.c
index 12eb5a0..048ca71 100644
--- a/src/racoon/isakmp.c
+++ b/src/racoon/isakmp.c
@@ -1,11 +1,11 @@
-/*	$NetBSD: isakmp.c,v 1.20.6.13 2008/09/25 09:34:39 vanhu Exp $	*/
+/*	$NetBSD: isakmp.c,v 1.71 2011/03/15 13:20:14 vanhu Exp $	*/
 
 /* Id: isakmp.c,v 1.74 2006/05/07 21:32:59 manubsd Exp */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -17,7 +17,7 @@
  * 3. Neither the name of the project nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -72,6 +72,7 @@
 #include "plog.h"
 #include "sockmisc.h"
 #include "schedule.h"
+#include "session.h"
 #include "debug.h"
 
 #include "remoteconf.h"
@@ -88,6 +89,9 @@
 #include "pfkey.h"
 #include "crypto_openssl.h"
 #include "policy.h"
+#include "algorithm.h"
+#include "proposal.h"
+#include "sainfo.h"
 #include "isakmp_ident.h"
 #include "isakmp_agg.h"
 #include "isakmp_base.h"
@@ -116,9 +120,6 @@
 #  ifndef SOL_UDP
 #   define SOL_UDP 17
 #  endif
-#ifdef ANDROID_CHANGES
-#define __linux
-#endif
 # endif /* __linux__ */
 # if defined(__NetBSD__) || defined(__FreeBSD__) ||	\
   (defined(__APPLE__) && defined(__MACH__))
@@ -137,34 +138,34 @@
 static int (*ph1exchange[][2][PHASE1ST_MAX])
 	__P((struct ph1handle *, vchar_t *)) = {
  /* error */
- { {}, {}, },
+ { { 0 }, { 0 }, },
  /* Identity Protection exchange */
  {
   { nostate1, ident_i1send, nostate1, ident_i2recv, ident_i2send,
-    ident_i3recv, ident_i3send, ident_i4recv, ident_i4send, nostate1, },
+    ident_i3recv, ident_i3send, ident_i4recv, ident_i4send, nostate1, nostate1,},
   { nostate1, ident_r1recv, ident_r1send, ident_r2recv, ident_r2send,
-    ident_r3recv, ident_r3send, nostate1, nostate1, nostate1, },
+    ident_r3recv, ident_r3send, nostate1, nostate1, nostate1, nostate1, },
  },
  /* Aggressive exchange */
  {
   { nostate1, agg_i1send, nostate1, agg_i2recv, agg_i2send,
-    nostate1, nostate1, nostate1, nostate1, nostate1, },
+    nostate1, nostate1, nostate1, nostate1, nostate1, nostate1, },
   { nostate1, agg_r1recv, agg_r1send, agg_r2recv, agg_r2send,
-    nostate1, nostate1, nostate1, nostate1, nostate1, },
+    nostate1, nostate1, nostate1, nostate1, nostate1, nostate1, },
  },
  /* Base exchange */
  {
   { nostate1, base_i1send, nostate1, base_i2recv, base_i2send,
-    base_i3recv, base_i3send, nostate1, nostate1, nostate1, },
+    base_i3recv, base_i3send, nostate1, nostate1, nostate1, nostate1, },
   { nostate1, base_r1recv, base_r1send, base_r2recv, base_r2send,
-    nostate1, nostate1, nostate1, nostate1, nostate1, },
+    nostate1, nostate1, nostate1, nostate1, nostate1, nostate1, },
  },
 };
 
 static int (*ph2exchange[][2][PHASE2ST_MAX])
 	__P((struct ph2handle *, vchar_t *)) = {
  /* error */
- { {}, {}, },
+ { { 0 }, { 0 }, },
  /* Quick mode for IKE */
  {
   { nostate2, nostate2, quick_i1prep, nostate2, quick_i1send,
@@ -175,7 +176,7 @@
 };
 
 static u_char r_ck0[] = { 0,0,0,0,0,0,0,0 }; /* used to verify the r_ck. */
- 
+
 static int isakmp_main __P((vchar_t *, struct sockaddr *, struct sockaddr *));
 static int ph1_main __P((struct ph1handle *, vchar_t *));
 static int quick_main __P((struct ph2handle *, vchar_t *));
@@ -185,29 +186,35 @@
 static int isakmp_ph2begin_r __P((struct ph1handle *, vchar_t *));
 static int etypesw1 __P((int));
 static int etypesw2 __P((int));
+static int isakmp_ph1resend __P((struct ph1handle *));
+static int isakmp_ph2resend __P((struct ph2handle *));
+
 #ifdef ENABLE_FRAG
-static int frag_handler(struct ph1handle *, 
+static int frag_handler(struct ph1handle *,
     vchar_t *, struct sockaddr *, struct sockaddr *);
 #endif
 
 /*
  * isakmp packet handler
  */
-int
-isakmp_handler(so_isakmp)
+static int
+isakmp_handler(ctx, so_isakmp)
+        void *ctx;
 	int so_isakmp;
 {
 	struct isakmp isakmp;
 	union {
 		char		buf[sizeof (isakmp) + 4];
 		u_int32_t	non_esp[2];
-		char		lbuf[sizeof(struct udphdr) + 
+		struct		{
+				     struct udphdr udp;
 #ifdef __linux
-				     sizeof(struct iphdr) + 
+				     struct iphdr ip;
 #else
-				     sizeof(struct ip) + 
+				     struct ip ip;
 #endif
-				     sizeof(isakmp) + 4];
+				     char buf[sizeof(isakmp) + 4];
+				} lbuf;
 	} x;
 	struct sockaddr_storage remote;
 	struct sockaddr_storage local;
@@ -243,34 +250,25 @@
 
 	/* Lucent IKE in UDP encapsulation */
 	{
-		struct udphdr *udp;
 #ifdef __linux__
-		struct iphdr *ip;
-
-		udp = (struct udphdr *)&x.lbuf[0];
-		if (ntohs(udp->dest) == 501) {
-			ip = (struct iphdr *)(x.lbuf + sizeof(*udp));
-			extralen += sizeof(*udp) + ip->ihl;
+		if (ntohs(x.lbuf.udp.dest) == 501) {
+			extralen += sizeof(x.lbuf.udp) + x.lbuf.ip.ihl;
 		}
 #else
-		struct ip *ip;
-
-		udp = (struct udphdr *)&x.lbuf[0];
-		if (ntohs(udp->uh_dport) == 501) {
-			ip = (struct ip *)(x.lbuf + sizeof(*udp));
-			extralen += sizeof(*udp) + ip->ip_hl;
+		if (ntohs(x.lbuf.udp.uh_dport) == 501) {
+			extralen += sizeof(x.lbuf.udp) + x.lbuf.ip.ip_hl;
 		}
 #endif
-	}	
+	}
 
 #ifdef ENABLE_NATT
-	/* we don't know about portchange yet, 
+	/* we don't know about portchange yet,
 	   look for non-esp marker instead */
 	if (x.non_esp[0] == 0 && x.non_esp[1] != 0)
 		extralen = NON_ESP_MARKER_LEN;
 #endif
 
-	/* now we know if there is an extra non-esp 
+	/* now we know if there is an extra non-esp
 	   marker at the beginning or not */
 	memcpy ((char *)&isakmp, x.buf + extralen, sizeof (isakmp));
 
@@ -311,7 +309,7 @@
 		if ((len = recvfrom(so_isakmp, (char *)&isakmp, sizeof(isakmp),
 			    0, (struct sockaddr *)&remote, &remote_len)) < 0) {
 			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to receive isakmp packet: %s\n", 
+				"failed to receive isakmp packet: %s\n",
 				strerror (errno));
 		}
 		goto end;
@@ -334,11 +332,11 @@
 			(len - extralen));
 		goto end;
 	}
-	
+
 	memcpy (buf->v, tmpbuf->v + extralen, buf->l);
 
 	len -= extralen;
-	
+
 	if (len != buf->l) {
 		plog(LLV_ERROR, LOCATION, (struct sockaddr *)&remote,
 			"received invalid length (%d != %zu), why ?\n",
@@ -349,7 +347,7 @@
 	plog(LLV_DEBUG, LOCATION, NULL, "===\n");
 	plog(LLV_DEBUG, LOCATION, NULL,
 		"%d bytes message received %s\n",
-		len, saddr2str_fromto("from %s to %s", 
+		len, saddr2str_fromto("from %s to %s",
 			(struct sockaddr *)&remote,
 			(struct sockaddr *)&local));
 	plogdump(LLV_DEBUG, buf->v, buf->l);
@@ -386,8 +384,7 @@
 		vfree(tmpbuf);
 	if (buf != NULL)
 		vfree(buf);
-
-	return(error);
+	return error;
 }
 
 /*
@@ -471,8 +468,8 @@
 		/* Floating ports for NAT-T */
 		if (NATT_AVAILABLE(iph1) &&
 		    ! (iph1->natt_flags & NAT_PORTS_CHANGED) &&
-		    ((cmpsaddrstrict(iph1->remote, remote) != 0) ||
-		    (cmpsaddrstrict(iph1->local, local) != 0)))
+		    ((cmpsaddr(iph1->remote, remote) != CMPSADDR_MATCH) ||
+		     (cmpsaddr(iph1->local, local) != CMPSADDR_MATCH)))
 		{
 			/* prevent memory leak */
 			racoon_free(iph1->remote);
@@ -499,12 +496,12 @@
 			}
 
 			/* set the flag to prevent further port floating
-			   (FIXME: should we allow it? E.g. when the NAT gw 
+			   (FIXME: should we allow it? E.g. when the NAT gw
 			    is rebooted?) */
 			iph1->natt_flags |= NAT_PORTS_CHANGED | NAT_ADD_NON_ESP_MARKER;
-			
+
 			/* print some neat info */
-			plog (LLV_INFO, LOCATION, NULL, 
+			plog (LLV_INFO, LOCATION, NULL,
 			      "NAT-T: ports changed to: %s\n",
 			      saddr2str_fromto ("%s<->%s", iph1->remote, iph1->local));
 
@@ -513,7 +510,7 @@
 #endif
 
 		/* must be same addresses in one stream of a phase at least. */
-		if (cmpsaddrstrict(iph1->remote, remote) != 0) {
+		if (cmpsaddr(iph1->remote, remote) != CMPSADDR_MATCH) {
 			char *saddr_db, *saddr_act;
 
 			saddr_db = racoon_strdup(saddr2str(iph1->remote));
@@ -639,7 +636,7 @@
 					"exchange received.\n");
 				return -1;
 			}
-			if (cmpsaddrstrict(iph1->remote, remote) != 0) {
+			if (cmpsaddr(iph1->remote, remote) != CMPSADDR_MATCH) {
 				plog(LLV_WARNING, LOCATION, remote,
 					"remote address mismatched. "
 					"db=%s\n",
@@ -671,7 +668,7 @@
 			return -1;
 		}
 #ifdef ENABLE_HYBRID
-		/* Reinit the IVM if it's still there */		
+		/* Reinit the IVM if it's still there */
 		if (iph1->mode_cfg && iph1->mode_cfg->ivm) {
 			oakley_delivm(iph1->mode_cfg->ivm);
 			iph1->mode_cfg->ivm = NULL;
@@ -683,7 +680,8 @@
 #endif
 
 		/* check status of phase 1 whether negotiated or not. */
-		if (iph1->status != PHASE1ST_ESTABLISHED) {
+		if (iph1->status != PHASE1ST_ESTABLISHED &&
+		    iph1->status != PHASE1ST_DYING) {
 			plog(LLV_ERROR, LOCATION, remote,
 				"can't start the quick mode, "
 				"there is no valid ISAKMP-SA, %s\n",
@@ -715,7 +713,6 @@
 		if (quick_main(iph2, msg) < 0) {
 			plog(LLV_ERROR, LOCATION, iph1->remote,
 				"phase2 negotiation failed.\n");
-			unbindph12(iph2);
 			remph2(iph2);
 			delph2(iph2);
 			return -1;
@@ -756,7 +753,7 @@
 
 		isakmp_cfg_r(iph1, msg);
 		break;
-#endif	 
+#endif
 
 	case ISAKMP_ETYPE_NONE:
 	default:
@@ -783,7 +780,7 @@
 #endif
 
 	/* ignore a packet */
-	if (iph1->status == PHASE1ST_ESTABLISHED)
+	if (iph1->status >= PHASE1ST_ESTABLISHED)
 		return 0;
 
 #ifdef ENABLE_STATS
@@ -813,7 +810,8 @@
 
 		if (iph1->side == RESPONDER && iph1->status == PHASE1ST_START) {
 			plog(LLV_ERROR, LOCATION, iph1->remote,
-				"failed to pre-process packet.\n");
+				"failed to pre-process ph1 packet (side: %d, status %d).\n",
+				iph1->side, iph1->status);
 			return -1;
 		} else {
 			/* ignore the error and keep phase 1 handler */
@@ -825,7 +823,7 @@
 	/* free resend buffer */
 	if (iph1->sendbuf == NULL) {
 		plog(LLV_ERROR, LOCATION, NULL,
-			"no buffer found as sendbuf\n"); 
+			"no buffer found as sendbuf\n");
 		return -1;
 	}
 #endif
@@ -833,7 +831,7 @@
 	VPTRINIT(iph1->sendbuf);
 
 	/* turn off schedule */
-	SCHED_KILL(iph1->scr);
+	sched_cancel(&iph1->scr);
 
 	/* send */
 	plog(LLV_DEBUG, LOCATION, NULL, "===\n");
@@ -841,7 +839,8 @@
 			[iph1->side]
 			[iph1->status])(iph1, msg) != 0) {
 		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"failed to process packet.\n");
+			"failed to process ph1 packet (side: %d, status: %d).\n",
+			iph1->side, iph1->status);
 		return -1;
 	}
 
@@ -863,12 +862,23 @@
 		/* save created date. */
 		(void)time(&iph1->created);
 
+		/* migrate ph2s from dying ph1s */
+		migrate_dying_ph12(iph1);
+
 		/* add to the schedule to expire, and seve back pointer. */
-		iph1->sce = sched_new(iph1->approval->lifetime,
-		    isakmp_ph1expire_stub, iph1);
+		if (ph1_rekey_enabled(iph1)) {
+			sched_schedule(&iph1->sce,
+				       iph1->approval->lifetime *
+				       PFKEY_SOFT_LIFETIME_RATE / 100,
+				       isakmp_ph1dying_stub);
+		} else {
+			sched_schedule(&iph1->sce, iph1->approval->lifetime,
+				       isakmp_ph1expire_stub);
+		}
+
 #ifdef ENABLE_HYBRID
 		if (iph1->mode_cfg->flags & ISAKMP_CFG_VENDORID_XAUTH) {
-			switch(AUTHMETHOD(iph1)) {
+			switch (iph1->approval->authmethod) {
 			case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R:
 			case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R:
 			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
@@ -905,18 +915,20 @@
 				/* ignore */
 			}
 		}
+		if (iph1->initial_contact_received)
+			isakmp_info_recv_initialcontact(iph1, NULL);
 
 		log_ph1established(iph1);
 		plog(LLV_DEBUG, LOCATION, NULL, "===\n");
 
-		/* 
+		/*
 		 * SA up shell script hook: do it now,except if
 		 * ISAKMP mode config was requested. In the later
 		 * case it is done when we receive the configuration.
 		 */
 		if ((iph1->status == PHASE1ST_ESTABLISHED) &&
-		    !iph1->rmconf->mode_cfg) { 
-			switch (AUTHMETHOD(iph1)) {
+		    !iph1->rmconf->mode_cfg) {
+			switch (iph1->approval->authmethod) {
 #ifdef ENABLE_HYBRID
 			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
 			case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R:
@@ -974,7 +986,8 @@
 			    [iph2->status])(iph2, msg);
 	if (error != 0) {
 		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-			"failed to pre-process packet.\n");
+			"failed to pre-process ph2 packet (side: %d, status %d).\n",
+			iph2->side, iph2->status);
 		if (error == ISAKMP_INTERNAL_ERROR)
 			return 0;
 		isakmp_info_send_n1(iph2->ph1, error, NULL);
@@ -988,13 +1001,13 @@
 	/* free resend buffer */
 	if (iph2->sendbuf == NULL) {
 		plog(LLV_ERROR, LOCATION, NULL,
-			"no buffer found as sendbuf\n"); 
+			"no buffer found as sendbuf\n");
 		return -1;
 	}
 	VPTRINIT(iph2->sendbuf);
 
 	/* turn off schedule */
-	SCHED_KILL(iph2->scr);
+	sched_cancel(&iph2->scr);
 
 	/* send */
 	plog(LLV_DEBUG, LOCATION, NULL, "===\n");
@@ -1002,7 +1015,8 @@
 			[iph2->side]
 			[iph2->status])(iph2, msg) != 0) {
 		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-			"failed to process packet.\n");
+			"failed to process ph2 packet (side: %d, status: %d).\n",
+			iph2->side, iph2->status);
 		return -1;
 	}
 
@@ -1018,7 +1032,7 @@
 }
 
 /* new negotiation of phase 1 for initiator */
-int
+struct ph1handle *
 isakmp_ph1begin_i(rmconf, remote, local)
 	struct remoteconf *rmconf;
 	struct sockaddr *remote, *local;
@@ -1031,7 +1045,7 @@
 	/* get new entry to isakmp status table. */
 	iph1 = newph1();
 	if (iph1 == NULL)
-		return -1;
+		return NULL;
 
 	iph1->status = PHASE1ST_START;
 	iph1->rmconf = rmconf;
@@ -1046,7 +1060,7 @@
 #ifdef ENABLE_HYBRID
 	if ((iph1->mode_cfg = isakmp_cfg_mkstate()) == NULL) {
 		delph1(iph1);
-		return -1;
+		return NULL;
 	}
 #endif
 #ifdef ENABLE_FRAG
@@ -1062,7 +1076,7 @@
 	/* XXX copy remote address */
 	if (copy_ph1addresses(iph1, rmconf, remote, local) < 0) {
 		delph1(iph1);
-		return -1;
+		return NULL;
 	}
 
 	(void)insph1(iph1);
@@ -1098,7 +1112,7 @@
 		remph1(iph1);
 		delph1(iph1);
 
-		return -1;
+		return NULL;
 	}
 
 #ifdef ENABLE_STATS
@@ -1109,7 +1123,7 @@
 		timedelta(&start, &end));
 #endif
 
-	return 0;
+	return iph1;
 }
 
 /* new negotiation of phase 1 for responder */
@@ -1120,27 +1134,19 @@
 	u_int8_t etype;
 {
 	struct isakmp *isakmp = (struct isakmp *)msg->v;
-	struct remoteconf *rmconf;
 	struct ph1handle *iph1;
-	struct etypes *etypeok;
+	struct rmconfselector rmsel;
 #ifdef ENABLE_STATS
 	struct timeval start, end;
 #endif
 
-	/* look for my configuration */
-	rmconf = getrmconf(remote);
-	if (rmconf == NULL) {
+	/* check if this etype is allowed */
+	memset(&rmsel, 0, sizeof(rmsel));
+	rmsel.remote = remote;
+	if (enumrmconf(&rmsel, check_etypeok, (void *) (intptr_t) etype) == 0) {
 		plog(LLV_ERROR, LOCATION, remote,
-			"couldn't find "
-			"configuration.\n");
-		return -1;
-	}
-
-	/* check to be acceptable exchange type */
-	etypeok = check_etypeok(rmconf, etype);
-	if (etypeok == NULL) {
-		plog(LLV_ERROR, LOCATION, remote,
-			"not acceptable %s mode\n", s_isakmp_etype(etype));
+		     "exchange %s not allowed in any applicable rmconf.\n",
+		     s_isakmp_etype(etype));
 		return -1;
 	}
 
@@ -1151,10 +1157,9 @@
 
 	memcpy(&iph1->index.i_ck, &isakmp->i_ck, sizeof(iph1->index.i_ck));
 	iph1->status = PHASE1ST_START;
-	iph1->rmconf = rmconf;
 	iph1->flags = 0;
 	iph1->side = RESPONDER;
-	iph1->etype = etypeok->type;
+	iph1->etype = etype;
 	iph1->version = isakmp->v;
 	iph1->msgid = 0;
 #ifdef HAVE_GSSAPI
@@ -1181,8 +1186,9 @@
 		iph1->natt_flags |= (NAT_PORTS_CHANGED);
 #endif
 
-	/* copy remote address */
-	if (copy_ph1addresses(iph1, rmconf, remote, local) < 0) {
+	/* copy remote address; remote and local always contain
+	 * port numbers so rmconf is not needed */
+	if (copy_ph1addresses(iph1, NULL, remote, local) < 0) {
 		delph1(iph1);
 		return -1;
 	}
@@ -1218,7 +1224,8 @@
 			[iph1->side]
 			[iph1->status])(iph1, msg) < 0) {
 		plog(LLV_ERROR, LOCATION, remote,
-			"failed to process packet.\n");
+			"failed to process ph1 packet (side: %d, status: %d).\n",
+			iph1->side, iph1->status);
 		remph1(iph1);
 		delph1(iph1);
 		return -1;
@@ -1260,6 +1267,12 @@
 	}
 #endif
 
+	/* fixup ph2 ports for this ph1 */
+	if (extract_port(iph2->src) == 0)
+		set_port(iph2->src, extract_port(iph1->local));
+	if (extract_port(iph2->dst) == 0)
+		set_port(iph2->dst, extract_port(iph1->remote));
+
 	/* found ISAKMP-SA. */
 	plog(LLV_DEBUG, LOCATION, NULL, "===\n");
 	plog(LLV_DEBUG, LOCATION, NULL, "begin QUICK mode.\n");
@@ -1277,14 +1290,13 @@
 #ifdef ENABLE_STATS
 	gettimeofday(&iph2->start, NULL);
 #endif
-	/* found isakmp-sa */
-	bindph12(iph1, iph2);
+	if (iph2->status != PHASE2ST_EXPIRED) /* Phase 1 is already bound (ongoing rekeying) */
+		bindph12(iph1, iph2);
 	iph2->status = PHASE2ST_STATUS2;
 
 	if ((ph2exchange[etypesw2(ISAKMP_ETYPE_QUICK)]
 			 [iph2->side]
 			 [iph2->status])(iph2, NULL) < 0) {
-		unbindph12(iph2);
 		/* release ipsecsa handler due to internal error. */
 		remph2(iph2);
 		return -1;
@@ -1319,7 +1331,6 @@
 		return -1;
 	}
 
-	iph2->ph1 = iph1;
 	iph2->side = RESPONDER;
 	iph2->status = PHASE2ST_START;
 	iph2->flags = isakmp->flags;
@@ -1340,15 +1351,6 @@
 		delph2(iph2);
 		return -1;
 	}
-#if (!defined(ENABLE_NATT)) || (defined(BROKEN_NATT))
-	if (set_port(iph2->dst, 0) == NULL ||
-	    set_port(iph2->src, 0) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		     "invalid family: %d\n", iph2->dst->sa_family);
-		delph2(iph2);
-		return -1;
-	}
-#endif
 
 	/* add new entry to isakmp status table */
 	insph2(iph2);
@@ -1376,14 +1378,14 @@
 	                   [iph2->status])(iph2, msg);
 	if (error != 0) {
 		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"failed to pre-process packet.\n");
+			"failed to pre-process ph2 packet (side: %d, status: %d).\n",
+			iph2->side, iph2->status);
 		if (error != ISAKMP_INTERNAL_ERROR)
 			isakmp_info_send_n1(iph2->ph1, error, NULL);
 		/*
 		 * release handler because it's wrong that ph2handle is kept
 		 * after failed to check message for responder's.
 		 */
-		unbindph12(iph2);
 		remph2(iph2);
 		delph2(iph2);
 		return -1;
@@ -1395,7 +1397,8 @@
 			[iph2->side]
 			[iph2->status])(iph2, msg) < 0) {
 		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-			"failed to process packet.\n");
+			"failed to process ph2 packet (side: %d, status: %d).\n",
+			iph2->side, iph2->status);
 		/* don't release handler */
 		return -1;
 	}
@@ -1526,14 +1529,7 @@
 	initctdtree();
 	init_recvdpkt();
 
-	if (isakmp_open() < 0)
-		goto err;
-
-	return(0);
-
-err:
-	isakmp_close();
-	return(-1);
+	return 0;
 }
 
 /*
@@ -1572,211 +1568,172 @@
 
 /* open ISAKMP sockets. */
 int
-isakmp_open()
+isakmp_open(struct sockaddr *addr, int udp_encap)
 {
 	const int yes = 1;
-	int ifnum = 0, encap_ifnum = 0;
+	int ifnum = 0, encap_ifnum = 0, fd;
+	struct sockaddr_in *sin = (struct sockaddr_in *) addr;
 #ifdef INET6
+	struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *) addr;
 	int pktinfo;
 #endif
-	struct myaddrs *p;
-
-	for (p = lcconf->myaddrs; p; p = p->next) {
-		if (!p->addr)
-			continue;
-
-		/* warn if wildcard address - should we forbid this? */
-		switch (p->addr->sa_family) {
-		case AF_INET:
-			if (((struct sockaddr_in *)p->addr)->sin_addr.s_addr == 0)
-				plog(LLV_WARNING, LOCATION, NULL,
-					"listening to wildcard address,"
-					"broadcast IKE packet may kill you\n");
-			break;
-#ifdef INET6
-		case AF_INET6:
-			if (IN6_IS_ADDR_UNSPECIFIED(&((struct sockaddr_in6 *)p->addr)->sin6_addr))
-				plog(LLV_WARNING, LOCATION, NULL,
-					"listening to wildcard address, "
-					"broadcast IKE packet may kill you\n");
-			break;
-#endif
-		default:
-			plog(LLV_ERROR, LOCATION, NULL,
-				"unsupported address family %d\n",
-				lcconf->default_af);
-			goto err_and_next;
-		}
-
-#ifdef INET6
-		if (p->addr->sa_family == AF_INET6 &&
-		    IN6_IS_ADDR_MULTICAST(&((struct sockaddr_in6 *)
-					    p->addr)->sin6_addr))
-		{
-			plog(LLV_DEBUG, LOCATION, NULL, 
-				"Ignoring multicast address %s\n",
-				saddr2str(p->addr));
-				racoon_free(p->addr);
-				p->addr = NULL;
-			continue;
-		}
-#endif
-
-		if ((p->sock = socket(p->addr->sa_family, SOCK_DGRAM, 0)) < 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"socket (%s)\n", strerror(errno));
-			goto err_and_next;
-		}
-
-		if (fcntl(p->sock, F_SETFL, O_NONBLOCK) == -1)
-			plog(LLV_WARNING, LOCATION, NULL,
-				"failed to put socket in non-blocking mode\n");
-
-		/* receive my interface address on inbound packets. */
-		switch (p->addr->sa_family) {
-		case AF_INET:
-			if (setsockopt(p->sock, IPPROTO_IP,
-#ifdef __linux__
-				       IP_PKTINFO,
-#else
-				       IP_RECVDSTADDR,
-#endif
-					(const void *)&yes, sizeof(yes)) < 0) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"setsockopt IP_RECVDSTADDR (%s)\n", 
-					strerror(errno));
-				goto err_and_next;
-			}
-			break;
-#ifdef INET6
-		case AF_INET6:
-#ifdef INET6_ADVAPI
-#ifdef IPV6_RECVPKTINFO
-			pktinfo = IPV6_RECVPKTINFO;
-#else  /* old adv. API */
-			pktinfo = IPV6_PKTINFO;
-#endif /* IPV6_RECVPKTINFO */
-#else
-			pktinfo = IPV6_RECVDSTADDR;
-#endif
-			if (setsockopt(p->sock, IPPROTO_IPV6, pktinfo,
-					(const void *)&yes, sizeof(yes)) < 0)
-			{
-				plog(LLV_ERROR, LOCATION, NULL,
-					"setsockopt IPV6_RECVDSTADDR (%d):%s\n",
-					pktinfo, strerror(errno));
-				goto err_and_next;
-			}
-			break;
-#endif
-		}
-
-#ifdef IPV6_USE_MIN_MTU
-		if (p->addr->sa_family == AF_INET6 &&
-		    setsockopt(p->sock, IPPROTO_IPV6, IPV6_USE_MIN_MTU,
-		    (void *)&yes, sizeof(yes)) < 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "setsockopt IPV6_USE_MIN_MTU (%s)\n", 
-			    strerror(errno));
-			return -1;
-		}
-#endif
-
-		if (setsockopt_bypass(p->sock, p->addr->sa_family) < 0)
-			goto err_and_next;
-
-		if (bind(p->sock, p->addr, sysdep_sa_len(p->addr)) < 0) {
-			plog(LLV_ERROR, LOCATION, p->addr,
-				"failed to bind to address %s (%s).\n",
-				saddr2str(p->addr), strerror(errno));
-			close(p->sock);
-			goto err_and_next;
-		}
-
-		ifnum++;
-
-		plog(LLV_INFO, LOCATION, NULL,
-			"%s used as isakmp port (fd=%d)\n",
-			saddr2str(p->addr), p->sock);
-
 #ifdef ENABLE_NATT
-		if (p->addr->sa_family == AF_INET) {
-			int option = -1;
-
-
-			if(p->udp_encap)
-				option = UDP_ENCAP_ESPINUDP;
-#if defined(ENABLE_NATT_00) || defined(ENABLE_NATT_01)
-			else
-				option = UDP_ENCAP_ESPINUDP_NON_IKE;
+	int option = -1;
 #endif
-			if(option != -1){
-				if (setsockopt (p->sock, SOL_UDP, 
-				    UDP_ENCAP, &option, sizeof (option)) < 0) {
-					plog(LLV_WARNING, LOCATION, NULL,
-					    "setsockopt(%s): UDP_ENCAP %s\n",
-					    option == UDP_ENCAP_ESPINUDP ? "UDP_ENCAP_ESPINUDP" : "UDP_ENCAP_ESPINUDP_NON_IKE",
-						 strerror(errno));
-					goto skip_encap;
-				}
-				else {
-					plog(LLV_INFO, LOCATION, NULL,
-						 "%s used for NAT-T\n",
-						 saddr2str(p->addr));
-					encap_ifnum++;
-				}
-			}
-		}
-skip_encap:
-#endif
-		continue;
 
-	err_and_next:
-		racoon_free(p->addr);
-		p->addr = NULL;
-		if (! lcconf->autograbaddr && lcconf->strict_address)
+	/* warn if wildcard address - should we forbid this? */
+	switch (addr->sa_family) {
+	case AF_INET:
+		if (sin->sin_addr.s_addr == 0)
+			plog(LLV_WARNING, LOCATION, NULL,
+			     "listening to wildcard address,"
+			     "broadcast IKE packet may kill you\n");
+		break;
+#ifdef INET6
+	case AF_INET6:
+		if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
+			plog(LLV_DEBUG, LOCATION, NULL,
+			     "ignoring multicast address %s\n",
+			     saddr2str(addr));
 			return -1;
-		continue;
-	}
+		}
 
-	if (!ifnum) {
+		if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
+			plog(LLV_WARNING, LOCATION, NULL,
+			     "listening to wildcard address, "
+			     "broadcast IKE packet may kill you\n");
+		break;
+#endif
+	default:
 		plog(LLV_ERROR, LOCATION, NULL,
-			"no address could be bound.\n");
+		     "unsupported address family %d\n",
+		     addr->sa_family);
 		return -1;
 	}
 
-#ifdef ENABLE_NATT
-	if (natt_enabled_in_rmconf() && !encap_ifnum) {
-		plog(LLV_WARNING, LOCATION, NULL, 
-			"NAT-T is enabled in at least one remote{} section,\n");
-		plog(LLV_WARNING, LOCATION, NULL, 
-			"but no 'isakmp_natt' address was specified!\n");
+	if ((fd = privsep_socket(addr->sa_family, SOCK_DGRAM, 0)) < 0) {
+		plog(LLV_ERROR, LOCATION, NULL,
+		     "socket(%s)\n", strerror(errno));
+		return -1;
 	}
-#endif
+	close_on_exec(fd);
+	if (fcntl(fd, F_SETFL, O_NONBLOCK) == -1)
+		plog(LLV_WARNING, LOCATION, NULL,
+		     "failed to put socket in non-blocking mode\n");
 
-	return 0;
+	/* receive my interface address on inbound packets. */
+	switch (addr->sa_family) {
+	case AF_INET:
+		if (setsockopt(fd, IPPROTO_IP,
+#ifdef __linux__
+			       IP_PKTINFO,
+#else
+			       IP_RECVDSTADDR,
+#endif
+			       (const void *) &yes, sizeof(yes)) < 0) {
+			plog(LLV_ERROR, LOCATION, NULL,
+			     "setsockopt IP_RECVDSTADDR (%s)\n",
+			     strerror(errno));
+			goto err;
+		}
+
+#ifdef ENABLE_NATT
+		if (udp_encap)
+			option = UDP_ENCAP_ESPINUDP;
+#if defined(ENABLE_NATT_00) || defined(ENABLE_NATT_01)
+		else
+			option = UDP_ENCAP_ESPINUDP_NON_IKE;
+#endif
+		if (option == -1)
+			break;
+
+		if (setsockopt(fd, SOL_UDP,
+			       UDP_ENCAP, &option,
+			       sizeof(option)) < 0) {
+			plog(LLV_WARNING, LOCATION, NULL,
+			     "setsockopt(%s): UDP_ENCAP %s\n",
+			     option == UDP_ENCAP_ESPINUDP ? "UDP_ENCAP_ESPINUDP" : "UDP_ENCAP_ESPINUDP_NON_IKE",
+			     strerror(errno));
+		} else {
+			plog(LLV_INFO, LOCATION, NULL,
+			     "%s used for NAT-T\n",
+			     saddr2str(addr));
+		}
+#endif
+		break;
+
+#ifdef INET6
+	case AF_INET6:
+#if defined(INET6_ADVAPI)
+#ifdef IPV6_RECVPKTINFO
+		pktinfo = IPV6_RECVPKTINFO;
+#else  /* old adv. API */
+		pktinfo = IPV6_PKTINFO;
+#endif /* IPV6_RECVPKTINFO */
+#else
+		pktinfo = IPV6_RECVDSTADDR;
+#endif
+		if (setsockopt(fd, IPPROTO_IPV6, pktinfo,
+			       (const void *) &yes, sizeof(yes)) < 0) {
+			plog(LLV_ERROR, LOCATION, NULL,
+			     "setsockopt IPV6_RECVDSTADDR (%d):%s\n",
+			     pktinfo, strerror(errno));
+			goto err;
+		}
+
+#ifdef IPV6_USE_MIN_MTU
+		if (setsockopt(fd, IPPROTO_IPV6, IPV6_USE_MIN_MTU,
+			       (void *) &yes, sizeof(yes)) < 0) {
+			plog(LLV_ERROR, LOCATION, NULL,
+			     "setsockopt IPV6_USE_MIN_MTU (%s)\n",
+			     strerror(errno));
+			goto err;
+		}
+#endif
+		break;
+#endif
+	}
+
+	if (setsockopt(fd, SOL_SOCKET,
+#ifdef __linux__
+		       SO_REUSEADDR,
+#else
+		       SO_REUSEPORT,
+#endif
+		       (void *) &yes, sizeof(yes)) < 0) {
+		plog(LLV_ERROR, LOCATION, NULL,
+		     "failed to set REUSE flag on %s (%s).\n",
+		     saddr2str(addr), strerror(errno));
+		goto err;
+	}
+
+	if (setsockopt_bypass(fd, addr->sa_family) < 0)
+		goto err;
+
+	if (privsep_bind(fd, addr, sysdep_sa_len(addr)) < 0) {
+		plog(LLV_ERROR, LOCATION, addr,
+		     "failed to bind to address %s (%s).\n",
+		     saddr2str(addr), strerror(errno));
+		goto err;
+	}
+
+	plog(LLV_INFO, LOCATION, NULL,
+	     "%s used as isakmp port (fd=%d)\n",
+	     saddr2str(addr), fd);
+
+	monitor_fd(fd, isakmp_handler, NULL, 1);
+	return fd;
+
+err:
+	close(fd);
+	return -1;
 }
 
 void
-isakmp_close()
+isakmp_close(int fd)
 {
-#ifndef ANDROID_PATCHED
-	struct myaddrs *p, *next;
-
-	for (p = lcconf->myaddrs; p; p = next) {
-		next = p->next;
-
-		if (!p->addr) {
-			racoon_free(p);
-			continue;
-		}
-		close(p->sock);
-		racoon_free(p->addr);
-		racoon_free(p);
-	}
-
-	lcconf->myaddrs = NULL;
-#endif
+	unmonitor_fd(fd);
+	close(fd);
 }
 
 int
@@ -1798,23 +1755,23 @@
 		extralen = 0;
 
 #ifdef ENABLE_FRAG
-	/* 
+	/*
 	 * Do not add the non ESP marker for a packet that will
-	 * be fragmented. The non ESP marker should appear in 
+	 * be fragmented. The non ESP marker should appear in
 	 * all fragment's packets, but not in the fragmented packet
 	 */
-	if (iph1->frag && sbuf->l > ISAKMP_FRAG_MAXLEN) 
+	if (iph1->frag && sbuf->l > ISAKMP_FRAG_MAXLEN)
 		extralen = 0;
 #endif
 	if (extralen)
 		plog (LLV_DEBUG, LOCATION, NULL, "Adding NON-ESP marker\n");
 
-	/* If NAT-T port floating is in use, 4 zero bytes (non-ESP marker) 
-	   must added just before the packet itself. For this we must 
+	/* If NAT-T port floating is in use, 4 zero bytes (non-ESP marker)
+	   must added just before the packet itself. For this we must
 	   allocate a new buffer and release it at the end. */
 	if (extralen) {
 		if ((vbuf = vmalloc (sbuf->l + extralen)) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL, 
+			plog(LLV_ERROR, LOCATION, NULL,
 			    "vbuf allocation failed\n");
 			return -1;
 		}
@@ -1831,22 +1788,21 @@
 #endif
 
 	/* select the socket to be sent */
-	s = getsockmyaddr(iph1->local);
-	if (s == -1){
+	s = myaddr_getfd(iph1->local);
+	if (s == -1)
 		return -1;
-	}
 
-	plog (LLV_DEBUG, LOCATION, NULL, "%zu bytes %s\n", sbuf->l, 
+	plog (LLV_DEBUG, LOCATION, NULL, "%zu bytes %s\n", sbuf->l,
 	      saddr2str_fromto("from %s to %s", iph1->local, iph1->remote));
 
 #ifdef ENABLE_FRAG
 	if (iph1->frag && sbuf->l > ISAKMP_FRAG_MAXLEN) {
 		if (isakmp_sendfrags(iph1, sbuf) == -1) {
-			plog(LLV_ERROR, LOCATION, NULL, 
+			plog(LLV_ERROR, LOCATION, NULL,
 			    "isakmp_sendfrags failed\n");
 			return -1;
 		}
-	} else 
+	} else
 #endif
 	{
 		len = sendfromto(s, sbuf->v, sbuf->l,
@@ -1857,32 +1813,24 @@
 			return -1;
 		}
 	}
-	
+
 	return 0;
 }
 
 /* called from scheduler */
-void
+static void
 isakmp_ph1resend_stub(p)
-	void *p;
+	struct sched *p;
 {
-	struct ph1handle *iph1;
+	struct ph1handle *iph1 = container_of(p, struct ph1handle, scr);
 
-	iph1=(struct ph1handle *)p;
-	if(isakmp_ph1resend(iph1) < 0){
-		if(iph1->scr != NULL){
-			/* Should not happen...
-			 */
-			sched_kill(iph1->scr);
-			iph1->scr=NULL;
-		}
-
+	if (isakmp_ph1resend(iph1) < 0) {
 		remph1(iph1);
 		delph1(iph1);
 	}
 }
 
-int
+static int
 isakmp_ph1resend(iph1)
 	struct ph1handle *iph1;
 {
@@ -1892,8 +1840,9 @@
 		plog(LLV_ERROR, LOCATION, NULL,
 			"phase1 negotiation failed due to time up. %s\n",
 			isakmp_pindex(&iph1->index, iph1->msgid));
-		EVT_PUSH(iph1->local, iph1->remote, 
-		    EVTT_PEER_NO_RESPONSE, NULL);
+		/* XXX is the peer really "dead" here ??? */
+		script_hook(iph1, SCRIPT_PHASE1_DEAD);
+		evt_phase1(iph1, EVT_PHASE1_NO_RESPONSE, NULL);
 
 		return -1;
 	}
@@ -1902,8 +1851,7 @@
 		plog(LLV_ERROR, LOCATION, NULL,
 			 "phase1 negotiation failed due to send error. %s\n",
 			 isakmp_pindex(&iph1->index, iph1->msgid));
-		EVT_PUSH(iph1->local, iph1->remote, 
-				 EVTT_PEER_NO_RESPONSE, NULL);
+		evt_phase1(iph1, EVT_PHASE1_NO_RESPONSE, NULL);
 		return -1;
 	}
 
@@ -1913,35 +1861,40 @@
 
 	iph1->retry_counter--;
 
-	iph1->scr = sched_new(iph1->rmconf->retry_interval,
-		isakmp_ph1resend_stub, iph1);
+	sched_schedule(&iph1->scr, lcconf->retry_interval,
+		       isakmp_ph1resend_stub);
 
 	return 0;
 }
 
-/* called from scheduler */
-void
-isakmp_ph2resend_stub(p)
-	void *p;
+int
+isakmp_ph1send(iph1)
+	struct ph1handle *iph1;
 {
-	struct ph2handle *iph2;
+	iph1->retry_counter = lcconf->retry_counter;
+	return isakmp_ph1resend(iph1);
+}
 
-	iph2=(struct ph2handle *)p;
+/* called from scheduler */
+static void
+isakmp_ph2resend_stub(p)
+	struct sched *p;
+{
+	struct ph2handle *iph2 = container_of(p, struct ph2handle, scr);
 
-	if(isakmp_ph2resend(iph2) < 0){
-		unbindph12(iph2);
+	if (isakmp_ph2resend(iph2) < 0) {
 		remph2(iph2);
 		delph2(iph2);
 	}
 }
 
-int
+static int
 isakmp_ph2resend(iph2)
 	struct ph2handle *iph2;
 {
 	/* Note: NEVER do the unbind/rem/del here, it will be done by the caller or by the _stub function
 	 */
-	if (iph2->ph1->status == PHASE1ST_EXPIRED){
+	if (iph2->ph1->status >= PHASE1ST_EXPIRED) {
 		plog(LLV_ERROR, LOCATION, NULL,
 			"phase2 negotiation failed due to phase1 expired. %s\n",
 				isakmp_pindex(&iph2->ph1->index, iph2->msgid));
@@ -1952,7 +1905,7 @@
 		plog(LLV_ERROR, LOCATION, NULL,
 			"phase2 negotiation failed due to time up. %s\n",
 				isakmp_pindex(&iph2->ph1->index, iph2->msgid));
-		EVT_PUSH(iph2->src, iph2->dst, EVTT_PEER_NO_RESPONSE, NULL);
+		evt_phase2(iph2, EVT_PHASE2_NO_RESPONSE, NULL);
 		unbindph12(iph2);
 		return -1;
 	}
@@ -1961,8 +1914,7 @@
 		plog(LLV_ERROR, LOCATION, NULL,
 			"phase2 negotiation failed due to send error. %s\n",
 				isakmp_pindex(&iph2->ph1->index, iph2->msgid));
-		EVT_PUSH(iph2->src, iph2->dst, EVTT_PEER_NO_RESPONSE, NULL);
-
+		evt_phase2(iph2, EVT_PHASE2_NO_RESPONSE, NULL);
 		return -1;
 	}
 
@@ -1972,19 +1924,77 @@
 
 	iph2->retry_counter--;
 
-	iph2->scr = sched_new(iph2->ph1->rmconf->retry_interval,
-		isakmp_ph2resend_stub, iph2);
+	sched_schedule(&iph2->scr, lcconf->retry_interval,
+		       isakmp_ph2resend_stub);
 
 	return 0;
 }
 
+int
+isakmp_ph2send(iph2)
+	struct ph2handle *iph2;
+{
+	iph2->retry_counter = lcconf->retry_counter;
+	return isakmp_ph2resend(iph2);
+}
+
+/* called from scheduler */
+void
+isakmp_ph1dying_stub(p)
+	struct sched *p;
+{
+
+	isakmp_ph1dying(container_of(p, struct ph1handle, sce));
+}
+
+void
+isakmp_ph1dying(iph1)
+	struct ph1handle *iph1;
+{
+	struct ph1handle *new_iph1;
+	struct ph2handle *p;
+	struct remoteconf *rmconf;
+
+	if (iph1->status >= PHASE1ST_DYING)
+		return;
+
+	/* Going away in after a while... */
+	iph1->status = PHASE1ST_DYING;
+
+	/* Any fresh phase1s? */
+	new_iph1 = getph1(iph1, iph1->local, iph1->remote, 1);
+	if (new_iph1 == NULL) {
+		LIST_FOREACH(p, &iph1->ph2tree, ph1bind) {
+			if (p->status != PHASE2ST_ESTABLISHED)
+				continue;
+
+			plog(LLV_INFO, LOCATION, NULL,
+			     "renegotiating phase1 to %s due to "
+			     "active phase2\n",
+			     saddrwop2str(iph1->remote));
+
+			if (iph1->side == INITIATOR)
+				isakmp_ph1begin_i(iph1->rmconf, iph1->remote,
+						  iph1->local);
+
+			break;
+		}
+	} else {
+		migrate_ph12(iph1, new_iph1);
+	}
+
+	/* Schedule for expiration */
+	sched_schedule(&iph1->sce, iph1->approval->lifetime *
+		       (100 - PFKEY_SOFT_LIFETIME_RATE) / 100,
+		       isakmp_ph1expire_stub);
+}
+
 /* called from scheduler */
 void
 isakmp_ph1expire_stub(p)
-	void *p;
+	struct sched *p;
 {
-
-	isakmp_ph1expire((struct ph1handle *)p);
+	isakmp_ph1expire(container_of(p, struct ph1handle, sce));
 }
 
 void
@@ -1993,9 +2003,7 @@
 {
 	char *src, *dst;
 
-	SCHED_KILL(iph1->sce);
-
-	if(iph1->status != PHASE1ST_EXPIRED){
+	if (iph1->status < PHASE1ST_EXPIRED) {
 		src = racoon_strdup(saddr2str(iph1->local));
 		dst = racoon_strdup(saddr2str(iph1->remote));
 		STRDUP_FATAL(src);
@@ -2010,41 +2018,44 @@
 		iph1->status = PHASE1ST_EXPIRED;
 	}
 
-	/*
-	 * the phase1 deletion is postponed until there is no phase2.
-	 */
-	if (LIST_FIRST(&iph1->ph2tree) != NULL) {
-		iph1->sce = sched_new(1, isakmp_ph1expire_stub, iph1);
-		return;
-	}
-
-	iph1->sce = sched_new(1, isakmp_ph1delete_stub, iph1);
+	isakmp_ph1delete(iph1);
 }
 
 /* called from scheduler */
 void
 isakmp_ph1delete_stub(p)
-	void *p;
+	struct sched *p;
 {
 
-	isakmp_ph1delete((struct ph1handle *)p);
+	isakmp_ph1delete(container_of(p, struct ph1handle, sce));
 }
 
 void
 isakmp_ph1delete(iph1)
 	struct ph1handle *iph1;
 {
+	struct ph2handle *p, *next;
+	struct ph1handle *new_iph1;
 	char *src, *dst;
 
-	SCHED_KILL(iph1->sce);
+	/* Migrate established phase2s. Any fresh phase1s? */
+	new_iph1 = getph1(iph1, iph1->local, iph1->remote, 1);
+	if (new_iph1 != NULL)
+		migrate_ph12(iph1, new_iph1);
 
-	if (LIST_FIRST(&iph1->ph2tree) != NULL) {
-		iph1->sce = sched_new(1, isakmp_ph1delete_stub, iph1);
-		return;
+	/* Discard any left phase2s */
+	for (p = LIST_FIRST(&iph1->ph2tree); p; p = next) {
+		next = LIST_NEXT(p, ph1bind);
+		if (p->status == PHASE2ST_ESTABLISHED)
+			isakmp_info_send_d2(p);
+		/* remove all ph2 handles,
+		 * as ph1handle will be expired soon
+		 */
+		delete_spd(p, 1);
+		remph2(p);
+		delph2(p);
 	}
 
-	/* don't re-negosiation when the phase 1 SA expires. */
-
 	src = racoon_strdup(saddr2str(iph1->local));
 	dst = racoon_strdup(saddr2str(iph1->remote));
 	STRDUP_FATAL(src);
@@ -2053,14 +2064,16 @@
 	plog(LLV_INFO, LOCATION, NULL,
 		"ISAKMP-SA deleted %s-%s spi:%s\n",
 		src, dst, isakmp_pindex(&iph1->index, 0));
-	EVT_PUSH(iph1->local, iph1->remote, EVTT_PHASE1_DOWN, NULL);
+
+	evt_phase1(iph1, EVT_PHASE1_DOWN, NULL);
+	if (new_iph1 == NULL && ph1_rekey_enabled(iph1))
+		script_hook(iph1, SCRIPT_PHASE1_DEAD);
+
 	racoon_free(src);
 	racoon_free(dst);
 
 	remph1(iph1);
 	delph1(iph1);
-
-	return;
 }
 
 /* called from scheduler.
@@ -2071,10 +2084,10 @@
  */
 void
 isakmp_ph2expire_stub(p)
-	void *p;
+	struct sched *p;
 {
 
-	isakmp_ph2expire((struct ph2handle *)p);
+	isakmp_ph2expire(container_of(p, struct ph2handle, sce));
 }
 
 void
@@ -2083,8 +2096,6 @@
 {
 	char *src, *dst;
 
-	SCHED_KILL(iph2->sce);
-
 	src = racoon_strdup(saddrwop2str(iph2->src));
 	dst = racoon_strdup(saddrwop2str(iph2->dst));
 	STRDUP_FATAL(src);
@@ -2096,19 +2107,16 @@
 	racoon_free(dst);
 
 	iph2->status = PHASE2ST_EXPIRED;
-
-	iph2->sce = sched_new(1, isakmp_ph2delete_stub, iph2);
-
-	return;
+	sched_schedule(&iph2->sce, 1, isakmp_ph2delete_stub);
 }
 
 /* called from scheduler */
 void
 isakmp_ph2delete_stub(p)
-	void *p;
+	struct sched *p;
 {
 
-	isakmp_ph2delete((struct ph2handle *)p);
+	isakmp_ph2delete(container_of(p, struct ph2handle, sce));
 }
 
 void
@@ -2117,8 +2125,6 @@
 {
 	char *src, *dst;
 
-	SCHED_KILL(iph2->sce);
-
 	src = racoon_strdup(saddrwop2str(iph2->src));
 	dst = racoon_strdup(saddrwop2str(iph2->dst));
 	STRDUP_FATAL(src);
@@ -2129,7 +2135,6 @@
 	racoon_free(src);
 	racoon_free(dst);
 
-	unbindph12(iph2);
 	remph2(iph2);
 	delph2(iph2);
 
@@ -2144,25 +2149,39 @@
  * if phase1 has been finished, begin phase2.
  */
 int
-isakmp_post_acquire(iph2)
+isakmp_post_acquire(iph2, iph1hint, nopassive)
 	struct ph2handle *iph2;
+	struct ph1handle *iph1hint;
+	int nopassive;
 {
 	struct remoteconf *rmconf;
 	struct ph1handle *iph1 = NULL;
-	
+
 	plog(LLV_DEBUG, LOCATION, NULL, "in post_acquire\n");
 
-	/* search appropreate configuration with masking port. */
-	rmconf = getrmconf(iph2->dst);
-	if (rmconf == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"no configuration found for %s.\n",
-			saddrwop2str(iph2->dst));
-		return -1;
+	/* Search appropriate configuration with masking port. Note that
+	 * we always use iph2->dst, and not iph2->sa_dst.
+	 *
+	 * XXX One possible need for using iph2->sa_dst if not NULL would
+	 * be for selecting a remote configuration based on a stable
+	 * address of a mobile node (not a CoA provided by MIGRATE/KMADDRESS
+	 * as iph2->dst hint). This scenario would require additional changes,
+	 * so no need to bother yet. --arno */
+
+	if (iph1hint == NULL || iph1hint->rmconf == NULL) {
+		rmconf = getrmconf(iph2->dst, nopassive ? GETRMCONF_F_NO_PASSIVE : 0);
+		if (rmconf == NULL) {
+			plog(LLV_ERROR, LOCATION, NULL,
+				"no configuration found for %s.\n",
+				saddrwop2str(iph2->dst));
+			return -1;
+		}
+	} else {
+		rmconf = iph1hint->rmconf;
 	}
 
 	/* if passive mode, ignore the acquire message */
-	if (rmconf->passive) {
+	if (nopassive && rmconf->passive) {
 		plog(LLV_DEBUG, LOCATION, NULL,
 			"because of passive mode, "
 			"ignore the acquire message for %s.\n",
@@ -2170,38 +2189,25 @@
 		return 0;
 	}
 
-	/* 
-	 * Search isakmp status table by address and port 
-	 * If NAT-T is in use, consider null ports as a 
-	 * wildcard and use IKE ports instead.
+	/*
+	 * XXX Searching by IP addresses + ports might fail on
+	 * some cases, we should use the ISAKMP identity to search
+	 * matching ISAKMP.
 	 */
-#ifdef ENABLE_NATT
-	if (!extract_port(iph2->src) && !extract_port(iph2->dst)) {
-		if ((iph1 = getph1byaddrwop(iph2->src, iph2->dst)) != NULL) {
-			set_port(iph2->src, extract_port(iph1->local));
-			set_port(iph2->dst, extract_port(iph1->remote));
-		}
-	} else {
-		iph1 = getph1byaddr(iph2->src, iph2->dst, 0);
-	}
-#else
-	iph1 = getph1byaddr(iph2->src, iph2->dst, 0);
-#endif
+	iph1 = getph1(iph1hint, iph2->src, iph2->dst, 0);
 
 	/* no ISAKMP-SA found. */
 	if (iph1 == NULL) {
-		struct sched *sc;
-
 		iph2->retry_checkph1 = lcconf->retry_checkph1;
-		sc = sched_new(1, isakmp_chkph1there_stub, iph2);
+		sched_schedule(&iph2->sce, 1, isakmp_chkph1there_stub);
 		plog(LLV_INFO, LOCATION, NULL,
 			"IPsec-SA request for %s queued "
 			"due to no phase1 found.\n",
 			saddrwop2str(iph2->dst));
 
 		/* start phase 1 negotiation as a initiator. */
-		if (isakmp_ph1begin_i(rmconf, iph2->dst, iph2->src) < 0) {
-			SCHED_KILL(sc);
+		if (isakmp_ph1begin_i(rmconf, iph2->dst, iph2->src) == NULL) {
+			sched_cancel(&iph2->sce);
 			return -1;
 		}
 
@@ -2210,9 +2216,9 @@
 	}
 
 	/* found ISAKMP-SA, but on negotiation. */
-	if (iph1->status != PHASE1ST_ESTABLISHED) {
+	if (iph1->status < PHASE1ST_ESTABLISHED) {
 		iph2->retry_checkph1 = lcconf->retry_checkph1;
-		sched_new(1, isakmp_chkph1there_stub, iph2);
+		sched_schedule(&iph2->sce, 1, isakmp_chkph1there_stub);
 		plog(LLV_INFO, LOCATION, iph2->dst,
 			"request for establishing IPsec-SA was queued "
 			"due to no phase1 found.\n");
@@ -2233,6 +2239,69 @@
 	return 0;
 }
 
+int
+isakmp_get_sainfo(iph2, sp_out, sp_in)
+	struct ph2handle *iph2;
+	struct secpolicy *sp_out, *sp_in;
+{
+	struct remoteconf *conf;
+	uint32_t remoteid = 0;
+
+	plog(LLV_DEBUG, LOCATION, NULL,
+		"new acquire %s\n", spidx2str(&sp_out->spidx));
+
+	/* get sainfo */
+	{
+		vchar_t *idsrc, *iddst;
+
+		idsrc = ipsecdoi_sockaddr2id((struct sockaddr *)&sp_out->spidx.src,
+			sp_out->spidx.prefs, sp_out->spidx.ul_proto);
+		if (idsrc == NULL) {
+			plog(LLV_ERROR, LOCATION, NULL,
+				"failed to get ID for %s\n",
+				spidx2str(&sp_out->spidx));
+			return -1;
+		}
+		iddst = ipsecdoi_sockaddr2id((struct sockaddr *)&sp_out->spidx.dst,
+			sp_out->spidx.prefd, sp_out->spidx.ul_proto);
+		if (iddst == NULL) {
+			plog(LLV_ERROR, LOCATION, NULL,
+				"failed to get ID for %s\n",
+				spidx2str(&sp_out->spidx));
+			vfree(idsrc);
+			return -1;
+		}
+
+		conf = getrmconf(iph2->dst, 0);
+		if (conf != NULL)
+			remoteid = conf->ph1id;
+		else
+			plog(LLV_DEBUG, LOCATION, NULL, "Warning: no valid rmconf !\n");
+
+		iph2->sainfo = getsainfo(idsrc, iddst, NULL, NULL, remoteid);
+		vfree(idsrc);
+		vfree(iddst);
+		if (iph2->sainfo == NULL) {
+			plog(LLV_ERROR, LOCATION, NULL,
+				"failed to get sainfo.\n");
+			return -1;
+			/* XXX should use the algorithm list from register message */
+		}
+
+		plog(LLV_DEBUG, LOCATION, NULL,
+			"selected sainfo: %s\n", sainfo2str(iph2->sainfo));
+	}
+
+	if (set_proposal_from_policy(iph2, sp_out, sp_in) < 0) {
+		plog(LLV_ERROR, LOCATION, NULL,
+			"failed to create saprop.\n");
+		return -1;
+	}
+
+	return 0;
+}
+
+
 /*
  * receive GETSPI from kernel.
  */
@@ -2245,7 +2314,7 @@
 #endif
 
 	/* don't process it because there is no suitable phase1-sa. */
-	if (iph2->ph1->status == PHASE1ST_EXPIRED) {
+	if (iph2->ph1->status >= PHASE1ST_EXPIRED) {
 		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
 			"the negotiation is stopped, "
 			"because there is no suitable ISAKMP-SA.\n");
@@ -2273,9 +2342,9 @@
 /* called by scheduler */
 void
 isakmp_chkph1there_stub(p)
-	void *p;
+	struct sched *p;
 {
-	isakmp_chkph1there((struct ph2handle *)p);
+	isakmp_chkph1there(container_of(p, struct ph2handle, sce));
 }
 
 void
@@ -2297,33 +2366,14 @@
 		/* send acquire to kernel as error */
 		pk_sendeacquire(iph2);
 
-		unbindph12(iph2);
 		remph2(iph2);
 		delph2(iph2);
 
 		return;
 	}
 
-	/* 
-	 * Search isakmp status table by address and port 
-	 * If NAT-T is in use, consider null ports as a 
-	 * wildcard and use IKE ports instead.
-	 */
-#ifdef ENABLE_NATT
-	if (!extract_port(iph2->src) && !extract_port(iph2->dst)) {
-		plog(LLV_DEBUG2, LOCATION, NULL, "CHKPH1THERE: extract_port.\n");
-		if( (iph1 = getph1byaddrwop(iph2->src, iph2->dst)) != NULL){
-			plog(LLV_DEBUG2, LOCATION, NULL, "CHKPH1THERE: found a ph1 wop.\n");
-		}
-	} else {
-		plog(LLV_DEBUG2, LOCATION, NULL, "CHKPH1THERE: searching byaddr.\n");
-		iph1 = getph1byaddr(iph2->src, iph2->dst, 0);
-		if(iph1 != NULL)
-			plog(LLV_DEBUG2, LOCATION, NULL, "CHKPH1THERE: found byaddr.\n");
-	}
-#else
+	/* Search isakmp status table by address and port */
 	iph1 = getph1byaddr(iph2->src, iph2->dst, 0);
-#endif
 
 	/* XXX Even if ph1 as responder is there, should we not start
 	 * phase 2 negotiation ? */
@@ -2351,7 +2401,7 @@
 	plog(LLV_DEBUG2, LOCATION, NULL, "CHKPH1THERE: no established ph1 handler found\n");
 
 	/* no isakmp-sa found */
-	sched_new(1, isakmp_chkph1there_stub, iph2);
+	sched_schedule(&iph2->sce, 1, isakmp_chkph1there_stub);
 
 	return;
 }
@@ -2874,7 +2924,9 @@
 	 * respect content of "remote".
 	 */
 	if (extract_port(iph1->remote) == 0) {
-		port = extract_port(rmconf->remote);
+		port = 0;
+		if (rmconf != NULL)
+			port = extract_port(rmconf->remote);
 		if (port == 0)
 			port = PORT_ISAKMP;
 		set_port(iph1->remote, port);
@@ -2887,8 +2939,12 @@
 	if (iph1->local == NULL)
 		return -1;
 
-	if (extract_port(iph1->local) == 0)
+	if (extract_port(iph1->local) == 0) {
+		port = myaddr_getsport(iph1->local);
+		if (port == 0)
+			port = PORT_ISAKMP;
 		set_port(iph1->local, PORT_ISAKMP);
+	}
 
 #ifdef ENABLE_NATT
 	if (extract_port(iph1->local) == lcconf->port_isakmp_natt) {
@@ -2935,10 +2991,10 @@
 		"ISAKMP-SA established %s-%s spi:%s\n",
 		src, dst,
 		isakmp_pindex(&iph1->index, 0));
-	
-	EVT_PUSH(iph1->local, iph1->remote, EVTT_PHASE1_UP, NULL);
+
+	evt_phase1(iph1, EVT_PHASE1_UP, NULL);
 	if(!iph1->rmconf->mode_cfg)
-		EVT_PUSH(iph1->local, iph1->remote, EVTT_NO_ISAKMP_CFG, NULL);
+		evt_phase1(iph1, EVT_PHASE1_MODE_CFG, NULL);
 
 	racoon_free(src);
 	racoon_free(dst);
@@ -2947,7 +3003,8 @@
 }
 
 struct payload_list *
-isakmp_plist_append (struct payload_list *plist, vchar_t *payload, int payload_type)
+isakmp_plist_append_full (struct payload_list *plist, vchar_t *payload,
+			  u_int8_t payload_type, u_int8_t free_payload)
 {
 	if (! plist) {
 		plist = racoon_malloc (sizeof (struct payload_list));
@@ -2962,11 +3019,12 @@
 	plist->next = NULL;
 	plist->payload = payload;
 	plist->payload_type = payload_type;
+	plist->free_payload = free_payload;
 
 	return plist;
 }
 
-vchar_t * 
+vchar_t *
 isakmp_plist_set_all (struct payload_list **plist, struct ph1handle *iph1)
 {
 	struct payload_list *ptr = *plist, *first;
@@ -2977,7 +3035,7 @@
 	/* Seek to the first item.  */
 	while (ptr->prev) ptr = ptr->prev;
 	first = ptr;
-	
+
 	/* Compute the whole length.  */
 	while (ptr) {
 		tlen += ptr->payload->l + sizeof (struct isakmp_gen);
@@ -3002,6 +3060,8 @@
 		p = set_isakmp_payload (p, ptr->payload, ptr->next ? ptr->next->payload_type : ISAKMP_NPTYPE_NONE);
 		first = ptr;
 		ptr = ptr->next;
+		if (first->free_payload)
+			vfree(first->payload);
 		racoon_free (first);
 		/* ptr->prev = NULL; first = NULL; ... omitted.  */
 		n++;
@@ -3017,7 +3077,7 @@
 }
 
 #ifdef ENABLE_FRAG
-int 
+int
 frag_handler(iph1, msg, remote, local)
 	struct ph1handle *iph1;
 	vchar_t *msg;
@@ -3028,7 +3088,7 @@
 
 	if (isakmp_frag_extract(iph1, msg) == 1) {
 		if ((newmsg = isakmp_frag_reassembly(iph1)) == NULL) {
-			plog(LLV_ERROR, LOCATION, remote, 
+			plog(LLV_ERROR, LOCATION, remote,
 			    "Packet reassembly failed\n");
 			return -1;
 		}
@@ -3050,7 +3110,6 @@
 	char portstr[PORT_MAX];
 	char **envp = NULL;
 	int envc = 1;
-	struct sockaddr_in *sin;
 	char **c;
 
 	if (iph1 == NULL ||
@@ -3063,9 +3122,7 @@
 #endif
 
 	/* local address */
-	sin = (struct sockaddr_in *)iph1->local;
-	inet_ntop(sin->sin_family, &sin->sin_addr, addrstr, IP_MAX);
-	snprintf(portstr, PORT_MAX, "%d", ntohs(sin->sin_port));
+	GETNAMEINFO(iph1->local, addrstr, portstr);
 
 	if (script_env_append(&envp, &envc, "LOCAL_ADDR", addrstr) != 0) {
 		plog(LLV_ERROR, LOCATION, NULL, "Cannot set LOCAL_ADDR\n");
@@ -3079,9 +3136,7 @@
 
 	/* Peer address */
 	if (iph1->remote != NULL) {
-		sin = (struct sockaddr_in *)iph1->remote;
-		inet_ntop(sin->sin_family, &sin->sin_addr, addrstr, IP_MAX);
-		snprintf(portstr, PORT_MAX, "%d", ntohs(sin->sin_port));
+		GETNAMEINFO(iph1->remote, addrstr, portstr);
 
 		if (script_env_append(&envp, &envc, 
 		    "REMOTE_ADDR", addrstr) != 0) {
@@ -3098,6 +3153,16 @@
 		}
 	}
 
+	/* Peer identity. */
+	if (iph1->id_p != NULL) {
+		if (script_env_append(&envp, &envc, "REMOTE_ID",
+				      ipsecdoi_id2str(iph1->id_p)) != 0) {
+			plog(LLV_ERROR, LOCATION, NULL,
+			     "Cannot set REMOTE_ID\n");
+			goto out;
+		}
+	}
+
 	if (privsep_script_exec(iph1->rmconf->script[script]->v, 
 	    script, envp) != 0) 
 		plog(LLV_ERROR, LOCATION, NULL, 
@@ -3160,7 +3225,7 @@
 	argv[1] = script_names[name];
 	argv[2] = NULL;
 
-	switch (fork()) { 
+	switch (fork()) {
 	case 0:
 		execve(argv[0], argv, envp);
 		plog(LLV_ERROR, LOCATION, NULL,
@@ -3175,7 +3240,7 @@
 		break;
 	default:
 		break;
-	}	
+	}
 	return 0;
 
 }
@@ -3201,7 +3266,7 @@
 	iph1->status = PHASE1ST_EXPIRED;
 
 	/* Check if we have another, still valid, phase1 SA. */
-	new_iph1 = getph1byaddr(iph1->local, iph1->remote, 1);
+	new_iph1 = getph1(iph1, iph1->local, iph1->remote, GETPH1_F_ESTABLISHED);
 
 	/*
 	 * Delete all orphaned or binded to the deleting ph1handle phase2 SAs.
@@ -3240,6 +3305,7 @@
 			msg = next;
 			continue;
 		}
+		pk_fixup_sa_addresses(mhp);
 		src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]);
 		dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]);
 
@@ -3255,8 +3321,10 @@
 		 * Select only SAs where src == local and dst == remote (outgoing)
 		 * or src == remote and dst == local (incoming).
 		 */
-		if ((CMPSADDR(iph1->local, src) || CMPSADDR(iph1->remote, dst)) &&
-			(CMPSADDR(iph1->local, dst) || CMPSADDR(iph1->remote, src))) {
+		if ((cmpsaddr(iph1->local, src) != CMPSADDR_MATCH ||
+		     cmpsaddr(iph1->remote, dst) != CMPSADDR_MATCH) &&
+		    (cmpsaddr(iph1->local, dst) != CMPSADDR_MATCH ||
+		     cmpsaddr(iph1->remote, src) != CMPSADDR_MATCH)) {
 			msg = next;
 			continue;
 		}
@@ -3274,7 +3342,7 @@
 					ntohl(sa->sadb_sa_spi));
 			}else{
 
-				/* 
+				/*
 				 * If we have a new ph1, do not purge IPsec-SAs binded
 				 *  to a different ISAKMP-SA
 				 */
@@ -3286,7 +3354,7 @@
 				/* If the ph2handle is established, do not purge IPsec-SA */
 				if (iph2->status == PHASE2ST_ESTABLISHED ||
 					iph2->status == PHASE2ST_EXPIRED) {
-					
+
 					plog(LLV_INFO, LOCATION, NULL,
 						 "keeping IPsec-SA spi=%u - found valid ISAKMP-SA spi=%s.\n",
 						 ntohl(sa->sadb_sa_spi),
@@ -3297,7 +3365,7 @@
 			}
 		}
 
-		
+
 		pfkey_send_delete(lcconf->sock_pfkey,
 				  msg->sadb_msg_satype,
 				  IPSEC_MODE_ANY,
@@ -3306,7 +3374,6 @@
 		/* delete a relative phase 2 handle. */
 		if (iph2 != NULL) {
 			delete_spd(iph2, 0);
-			unbindph12(iph2);
 			remph2(iph2);
 			delph2(iph2);
 		}
@@ -3326,12 +3393,10 @@
 		 "purged ISAKMP-SA spi=%s.\n",
 		 isakmp_pindex(&(iph1->index), iph1->msgid));
 
-	SCHED_KILL(iph1->sce);
-
-	iph1->sce = sched_new(1, isakmp_ph1delete_stub, iph1);
+	isakmp_ph1delete(iph1);
 }
 
-void 
+void
 delete_spd(iph2, created)
 	struct ph2handle *iph2;
  	u_int64_t created;
@@ -3356,23 +3421,23 @@
 	dst = iph2->dst;
 
 	plog(LLV_INFO, LOCATION, NULL,
-		 "generated policy, deleting it.\n");
-		
+		 "deleting a generated policy.\n");
+
 	memset(&spidx, 0, sizeof(spidx));
 	iph2->spidx_gen = (caddr_t )&spidx;
-		
+
 	/* make inbound policy */
 	iph2->src = dst;
 	iph2->dst = src;
 	spidx.dir = IPSEC_DIR_INBOUND;
 	spidx.ul_proto = 0;
-		
-	/* 
+
+	/*
 	 * Note: code from get_proposal_r
 	 */
-		
+
 #define _XIDT(d) ((struct ipsecdoi_id_b *)(d)->v)->type
-		
+
 	/*
 	 * make destination address in spidx from either ID payload
 	 * or phase 1 address into a address in spidx.
@@ -3388,48 +3453,48 @@
 									 &spidx.prefd, &spidx.ul_proto);
 		if (error)
 			goto purge;
-			
+
 #ifdef INET6
 		/*
 		 * get scopeid from the SA address.
 		 * note that the phase 1 source address is used as
-		 * a destination address to search for a inbound 
+		 * a destination address to search for a inbound
 		 * policy entry because rcoon is responder.
 		 */
 		if (_XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR) {
-			if ((error = 
+			if ((error =
 				 setscopeid((struct sockaddr *)&spidx.dst,
 							iph2->src)) != 0)
 				goto purge;
 		}
 #endif
-			
+
 		if (_XIDT(iph2->id) == IPSECDOI_ID_IPV4_ADDR
 			|| _XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR)
 			idi2type = _XIDT(iph2->id);
-			
+
 	} else {
-			
+
 		plog(LLV_DEBUG, LOCATION, NULL,
 			 "get a destination address of SP index "
 			 "from phase1 address "
 			 "due to no ID payloads found "
 			 "OR because ID type is not address.\n");
-			
+
 		/*
-		 * copy the SOURCE address of IKE into the 
-		 * DESTINATION address of the key to search the 
+		 * copy the SOURCE address of IKE into the
+		 * DESTINATION address of the key to search the
 		 * SPD because the direction of policy is inbound.
 		 */
 		memcpy(&spidx.dst, iph2->src, sysdep_sa_len(iph2->src));
 		switch (spidx.dst.ss_family) {
 		case AF_INET:
-			spidx.prefd = 
+			spidx.prefd =
 				sizeof(struct in_addr) << 3;
 			break;
 #ifdef INET6
 		case AF_INET6:
-			spidx.prefd = 
+			spidx.prefd =
 				sizeof(struct in6_addr) << 3;
 			break;
 #endif
@@ -3438,8 +3503,8 @@
 			break;
 		}
 	}
-					
-	/* make source address in spidx */
+
+		/* make source address in spidx */
 	if (iph2->id_p != NULL
 		&& (_XIDT(iph2->id_p) == IPSECDOI_ID_IPV4_ADDR
 			|| _XIDT(iph2->id_p) == IPSECDOI_ID_IPV6_ADDR
@@ -3447,8 +3512,8 @@
 			|| _XIDT(iph2->id_p) == IPSECDOI_ID_IPV6_ADDR_SUBNET)) {
 		/* get a source address of inbound SA */
 		error = ipsecdoi_id2sockaddr(iph2->id_p,
-									 (struct sockaddr *)&spidx.src,
-									 &spidx.prefs, &spidx.ul_proto);
+					     (struct sockaddr *)&spidx.src,
+					     &spidx.prefs, &spidx.ul_proto);
 		if (error)
 			goto purge;
 
@@ -3458,7 +3523,7 @@
 		 * for more detail, see above of this function.
 		 */
 		if (_XIDT(iph2->id_p) == IPSECDOI_ID_IPV6_ADDR) {
-			error = 
+			error =
 				setscopeid((struct sockaddr *)&spidx.src,
 						   iph2->dst);
 			if (error)
@@ -3466,19 +3531,19 @@
 		}
 #endif
 
-		/* make id[src,dst] if both ID types are IP address and same */
+		/* make sa_[src,dst] if both ID types are IP address and same */
 		if (_XIDT(iph2->id_p) == idi2type
 			&& spidx.dst.ss_family == spidx.src.ss_family) {
-			iph2->src_id = 
+			iph2->sa_src =
 				dupsaddr((struct sockaddr *)&spidx.dst);
-			if (iph2->src_id == NULL) {
+			if (iph2->sa_src == NULL) {
 				plog(LLV_ERROR, LOCATION, NULL,
 					 "allocation failed\n");
 				goto purge;
 			}
-			iph2->dst_id = 
+			iph2->sa_dst =
 				dupsaddr((struct sockaddr *)&spidx.src);
-			if (iph2->dst_id == NULL) {
+			if (iph2->sa_dst == NULL) {
 				plog(LLV_ERROR, LOCATION, NULL,
 					 "allocation failed\n");
 				goto purge;
@@ -3496,12 +3561,12 @@
 		memcpy(&spidx.src, iph2->dst, sysdep_sa_len(iph2->dst));
 		switch (spidx.src.ss_family) {
 		case AF_INET:
-			spidx.prefs = 
+			spidx.prefs =
 				sizeof(struct in_addr) << 3;
 			break;
 #ifdef INET6
 		case AF_INET6:
-			spidx.prefs = 
+			spidx.prefs =
 				sizeof(struct in6_addr) << 3;
 			break;
 #endif
@@ -3539,7 +3604,7 @@
 	 */
 	if( created ){
 		struct secpolicy *p;
-		
+
 		p = getsp(&spidx);
 		if(p != NULL){
 			/* just do no test if p is NULL, because this probably just means
@@ -3604,7 +3669,7 @@
 	struct sockaddr *sp_addr0, *sa_addr0;
 {
 	struct sockaddr_in6 *sp_addr, *sa_addr;
-    
+
 	sp_addr = (struct sockaddr_in6 *)sp_addr0;
 	sa_addr = (struct sockaddr_in6 *)sa_addr0;
 
diff --git a/src/racoon/isakmp.h b/src/racoon/isakmp.h
index d0fd242..16986a9 100644
--- a/src/racoon/isakmp.h
+++ b/src/racoon/isakmp.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: isakmp.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
+/*	$NetBSD: isakmp.h,v 1.7 2009/05/20 07:54:50 vanhu Exp $	*/
 
 /* Id: isakmp.h,v 1.11 2005/04/25 22:19:39 manubsd Exp */
 
@@ -36,8 +36,8 @@
 
 /* refer to RFC 2408 */
 
-/* must include <netinet/in.h> first. */
-/* must include "isakmp_var.h" first. */
+#include <netinet/in.h>
+#include "isakmp_var.h"
 
 #define INITIATOR	0	/* synonym sender */
 #define RESPONDER	1	/* synonym receiver */
@@ -133,7 +133,7 @@
 /* Exchange Type */
 #define ISAKMP_ETYPE_NONE	0	/* NONE */
 #define ISAKMP_ETYPE_BASE	1	/* Base */
-#define ISAKMP_ETYPE_IDENT	2	/* Identity Proteciton */
+#define ISAKMP_ETYPE_IDENT	2	/* Identity Protection */
 #define ISAKMP_ETYPE_AUTH	3	/* Authentication Only */
 #define ISAKMP_ETYPE_AGG	4	/* Aggressive */
 #define ISAKMP_ETYPE_INFO	5	/* Informational */
@@ -270,11 +270,6 @@
 #define ISAKMP_CERT_X509ATTR	10
 #define ISAKMP_CERT_PLAINRSA	11
 
-/* the method to get peers certificate */
-#define ISAKMP_GETCERT_PAYLOAD		1
-#define ISAKMP_GETCERT_LOCALFILE	2
-#define ISAKMP_GETCERT_DNS		3
-
 /* 3.10 Certificate Request Payload */
 struct isakmp_pl_cr {
 	struct isakmp_gen h;
@@ -384,7 +379,8 @@
 struct payload_list {
 	struct payload_list	*next, *prev;
 	vchar_t			*payload;
-	int			payload_type;
+	u_int8_t		payload_type;
+	u_int8_t		free_payload;
 };
 
 
diff --git a/src/racoon/isakmp_agg.c b/src/racoon/isakmp_agg.c
index 0d43883..2e387fb 100644
--- a/src/racoon/isakmp_agg.c
+++ b/src/racoon/isakmp_agg.c
@@ -1,11 +1,11 @@
-/*	$NetBSD: isakmp_agg.c,v 1.9 2006/09/30 21:49:37 manu Exp $	*/
+/*	$NetBSD: isakmp_agg.c,v 1.16 2009/09/18 10:31:11 tteras Exp $	*/
 
 /* Id: isakmp_agg.c,v 1.28 2006/04/06 16:46:08 manubsd Exp */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -17,7 +17,7 @@
  * 3. Neither the name of the project nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -113,8 +113,6 @@
 	vchar_t *msg; /* must be null */
 {
 	struct payload_list *plist = NULL;
-	int need_cr = 0;
-	vchar_t *cr = NULL; 
 	int error = -1;
 #ifdef ENABLE_NATT
 	vchar_t *vid_natt[MAX_NATT_VID_COUNT] = { NULL };
@@ -135,7 +133,6 @@
 	vchar_t *vid_dpd = NULL;
 #endif
 
-
 	/* validity check */
 	if (msg != NULL) {
 		plog(LLV_ERROR, LOCATION, NULL,
@@ -157,7 +154,7 @@
 		goto end;
 
 	/* create SA payload for my proposal */
-	iph1->sa = ipsecdoi_setph1proposal(iph1->rmconf->proposal);
+	iph1->sa = ipsecdoi_setph1proposal(iph1->rmconf, iph1->rmconf->proposal);
 	if (iph1->sa == NULL)
 		goto end;
 
@@ -180,8 +177,8 @@
 
 #ifdef ENABLE_HYBRID
 	/* Do we need Xauth VID? */
-	switch (RMAUTHMETHOD(iph1)) {
-	case FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I:
+	switch (iph1->rmconf->proposal->authmethod) {
+	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I:
 	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
 	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
 	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I:
@@ -189,10 +186,10 @@
 	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_I:
 	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_I:
 		if ((vid_xauth = set_vendorid(VENDORID_XAUTH)) == NULL)
-			plog(LLV_ERROR, LOCATION, NULL, 
+			plog(LLV_ERROR, LOCATION, NULL,
 			     "Xauth vendor ID generation failed\n");
 		if ((vid_unity = set_vendorid(VENDORID_UNITY)) == NULL)
-			plog(LLV_ERROR, LOCATION, NULL, 
+			plog(LLV_ERROR, LOCATION, NULL,
 			     "Unity vendor ID generation failed\n");
 		break;
 	default:
@@ -209,26 +206,13 @@
 		if (vid_frag == NULL)
 			plog(LLV_ERROR, LOCATION, NULL,
 			    "Frag vendorID construction failed\n");
-	}		
-#endif
-
-	/* create CR if need */
-	if (iph1->rmconf->send_cr
-	 && oakley_needcr(iph1->rmconf->proposal->authmethod)
-	 && iph1->rmconf->peerscertfile == NULL) {
-		need_cr = 1;
-		cr = oakley_getcr(iph1);
-		if (cr == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to get cr buffer.\n");
-			goto end;
-		}
 	}
+#endif
 
 	plog(LLV_DEBUG, LOCATION, NULL, "authmethod is %s\n",
 		s_oakley_attr_method(iph1->rmconf->proposal->authmethod));
 #ifdef HAVE_GSSAPI
-	if (RMAUTHMETHOD(iph1) == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB)
+	if (iph1->rmconf->proposal->authmethod == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB)
 		gssapi_get_itoken(iph1, &len);
 #endif
 
@@ -245,33 +229,37 @@
 	plist = isakmp_plist_append(plist, iph1->id, ISAKMP_NPTYPE_ID);
 
 #ifdef HAVE_GSSAPI
-	if (RMAUTHMETHOD(iph1) == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB) {
-		gssapi_get_token_to_send(iph1, &gsstoken);
+	if (iph1->rmconf->proposal->authmethod == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB) {
+		if (gssapi_get_token_to_send(iph1, &gsstoken) < 0) {
+			plog(LLV_ERROR, LOCATION, NULL,
+			     "Failed to get gssapi token.\n");
+			goto end;
+		}
 		plist = isakmp_plist_append(plist, gsstoken, ISAKMP_NPTYPE_GSS);
 	}
 #endif
 	/* create isakmp CR payload */
-	if (need_cr)
-		plist = isakmp_plist_append(plist, cr, ISAKMP_NPTYPE_CR);
+	if (oakley_needcr(iph1->rmconf->proposal->authmethod))
+		plist = oakley_append_cr(plist, iph1);
 
 #ifdef ENABLE_FRAG
 	if (vid_frag)
 		plist = isakmp_plist_append(plist, vid_frag, ISAKMP_NPTYPE_VID);
 #endif
 #ifdef ENABLE_NATT
-	/* 
-	 * set VID payload for NAT-T if NAT-T 
-	 * support allowed in the config file 
+	/*
+	 * set VID payload for NAT-T if NAT-T
+	 * support allowed in the config file
 	 */
-	if (iph1->rmconf->nat_traversal) 
+	if (iph1->rmconf->nat_traversal)
 		plist = isakmp_plist_append_natt_vids(plist, vid_natt);
 #endif
 #ifdef ENABLE_HYBRID
 	if (vid_xauth)
-		plist = isakmp_plist_append(plist, 
+		plist = isakmp_plist_append(plist,
 		    vid_xauth, ISAKMP_NPTYPE_VID);
 	if (vid_unity)
-		plist = isakmp_plist_append(plist, 
+		plist = isakmp_plist_append(plist,
 		    vid_unity, ISAKMP_NPTYPE_VID);
 #endif
 #ifdef ENABLE_DPD
@@ -289,8 +277,7 @@
 #endif
 
 	/* send the packet, add to the schedule to resend */
-	iph1->retry_counter = iph1->rmconf->retry_counter;
-	if (isakmp_ph1resend(iph1) == -1)
+	if (isakmp_ph1send(iph1) == -1)
 		goto end;
 
 	iph1->status = PHASE1ST_MSG1SENT;
@@ -298,8 +285,6 @@
 	error = 0;
 
 end:
-	if (cr)
-		vfree(cr);
 #ifdef HAVE_GSSAPI
 	if (gsstoken)
 		vfree(gsstoken);
@@ -343,7 +328,6 @@
 	struct isakmp_parse_t *pa;
 	vchar_t *satmp = NULL;
 	int error = -1;
-	int vid_numeric;
 	int ptype;
 #ifdef ENABLE_HYBRID
 	vchar_t *unity_vid;
@@ -425,37 +409,12 @@
 				goto end;
 			break;
 		case ISAKMP_NPTYPE_VID:
-			vid_numeric = check_vendorid(pa->ptr);
-#ifdef ENABLE_NATT
-			if (iph1->rmconf->nat_traversal && 
-			    natt_vendorid(vid_numeric))
-				natt_handle_vendorid(iph1, vid_numeric);
-#endif
-#ifdef ENABLE_HYBRID
-			switch (vid_numeric) {
-			case VENDORID_XAUTH:
-				iph1->mode_cfg->flags |= 
-				    ISAKMP_CFG_VENDORID_XAUTH;
-				break;
-
-			case VENDORID_UNITY:
-				iph1->mode_cfg->flags |= 
-				    ISAKMP_CFG_VENDORID_UNITY;
-				break;
-			default:
-				break;
-			}
-#endif
-#ifdef ENABLE_DPD
-			if (vid_numeric == VENDORID_DPD && iph1->rmconf->dpd) {
-				iph1->dpd_support=1;
-				plog(LLV_DEBUG, LOCATION, NULL,
-					 "remote supports DPD\n");
-			}
-#endif
+			handle_vendorid(iph1, pa->ptr);
 			break;
 		case ISAKMP_NPTYPE_N:
-			isakmp_check_notify(pa->ptr, iph1);
+			isakmp_log_notify(iph1,
+				(struct isakmp_pl_n *) pa->ptr,
+				"aggressive exchange");
 			break;
 #ifdef HAVE_GSSAPI
 		case ISAKMP_NPTYPE_GSS:
@@ -529,7 +488,7 @@
 	if (NATT_AVAILABLE(iph1)) {
 		struct natd_payload *natd = NULL;
 		int natd_verified;
-		
+
 		plog(LLV_INFO, LOCATION, iph1->remote,
 		     "Selected NAT-T version: %s\n",
 		     vid_string_by_id(iph1->natt_options->version));
@@ -537,9 +496,9 @@
 		/* set both bits first so that we can clear them
 		   upon verifying hashes */
 		iph1->natt_flags |= NAT_DETECTED;
-                        
+
 		while ((natd = TAILQ_FIRST(&natd_tree)) != NULL) {
-			/* this function will clear appropriate bits bits 
+			/* this function will clear appropriate bits bits
 			   from iph1->natt_flags */
 			natd_verified = natt_compare_addr_hash (iph1,
 				natd->payload, natd->seq);
@@ -547,7 +506,7 @@
 			plog (LLV_INFO, LOCATION, NULL, "NAT-D payload #%d %s\n",
 				natd->seq - 1,
 				natd_verified ? "verified" : "doesn't match");
-			
+
 			vfree (natd->payload);
 
 			TAILQ_REMOVE(&natd_tree, natd, chain);
@@ -555,7 +514,7 @@
 		}
 
 		plog (LLV_INFO, LOCATION, NULL, "NAT %s %s%s\n",
-		      iph1->natt_flags & NAT_DETECTED ? 
+		      iph1->natt_flags & NAT_DETECTED ?
 		      		"detected:" : "not detected",
 		      iph1->natt_flags & NAT_DETECTED_ME ? "ME " : "",
 		      iph1->natt_flags & NAT_DETECTED_PEER ? "PEER" : "");
@@ -587,8 +546,7 @@
 			/* message printed inner oakley_validate_auth() */
 			goto end;
 		}
-		EVT_PUSH(iph1->local, iph1->remote, 
-		    EVTT_PEERPH1AUTH_FAILED, NULL);
+		evt_phase1(iph1, EVT_PHASE1_AUTH_FAILED, NULL);
 		isakmp_info_send_n1(iph1, ptype, NULL);
 		goto end;
 	}
@@ -616,13 +574,10 @@
 		VPTRINIT(iph1->dhpub_p);
 		VPTRINIT(iph1->nonce_p);
 		VPTRINIT(iph1->id_p);
-		oakley_delcert(iph1->cert_p);
-		iph1->cert_p = NULL;
-		oakley_delcert(iph1->crl_p);
-		iph1->crl_p = NULL;
+		VPTRINIT(iph1->cert_p);
+		VPTRINIT(iph1->crl_p);
 		VPTRINIT(iph1->sig_p);
-		oakley_delcert(iph1->cr_p);
-		iph1->cr_p = NULL;
+		VPTRINIT(iph1->cr_p);
 	}
 
 	return error;
@@ -669,15 +624,15 @@
 		goto end;
 	}
 
-	switch (AUTHMETHOD(iph1)) {
+	switch (iph1->approval->authmethod) {
 	case OAKLEY_ATTR_AUTH_METHOD_PSKEY:
 #ifdef ENABLE_HYBRID
-	case FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I:
+	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I:
 	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
 	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
-#endif  
+#endif
 		/* set HASH payload */
-		plist = isakmp_plist_append(plist, 
+		plist = isakmp_plist_append(plist,
 		    iph1->hash, ISAKMP_NPTYPE_HASH);
 		break;
 
@@ -700,11 +655,11 @@
 
 		/* add CERT payload if there */
 		if (need_cert)
-			plist = isakmp_plist_append(plist, 
-			    iph1->cert->pl, ISAKMP_NPTYPE_CERT);
+			plist = isakmp_plist_append(plist, iph1->cert,
+						    ISAKMP_NPTYPE_CERT);
 
 		/* add SIG payload */
-		plist = isakmp_plist_append(plist, 
+		plist = isakmp_plist_append(plist,
 		    iph1->sig, ISAKMP_NPTYPE_SIG);
 		break;
 
@@ -726,7 +681,7 @@
 			goto end;
 		}
 
-		plist = isakmp_plist_append(plist, 
+		plist = isakmp_plist_append(plist,
 		    gsshash, ISAKMP_NPTYPE_HASH);
 		break;
 #endif
@@ -737,26 +692,26 @@
 	if (NATT_AVAILABLE(iph1)) {
 		vchar_t *natd[2] = { NULL, NULL };
 
-		plog(LLV_INFO, LOCATION, 
+		plog(LLV_INFO, LOCATION,
 		    NULL, "Adding remote and local NAT-D payloads.\n");
 
 		if ((natd[0] = natt_hash_addr (iph1, iph1->remote)) == NULL) {
 			plog(LLV_ERROR, LOCATION, NULL,
-			    "NAT-D hashing failed for %s\n", 
+			    "NAT-D hashing failed for %s\n",
 			    saddr2str(iph1->remote));
 			goto end;
 		}
 
 		if ((natd[1] = natt_hash_addr (iph1, iph1->local)) == NULL) {
 			plog(LLV_ERROR, LOCATION, NULL,
-			    "NAT-D hashing failed for %s\n", 
+			    "NAT-D hashing failed for %s\n",
 			    saddr2str(iph1->local));
 			goto end;
 		}
 
-		plist = isakmp_plist_append(plist, 
+		plist = isakmp_plist_append(plist,
 		    natd[0], iph1->natt_options->payload_nat_d);
-		plist = isakmp_plist_append(plist, 
+		plist = isakmp_plist_append(plist,
 		    natd[1], iph1->natt_options->payload_nat_d);
 	}
 #endif
@@ -860,37 +815,7 @@
 				goto end;
 			break;
 		case ISAKMP_NPTYPE_VID:
-			vid_numeric = check_vendorid(pa->ptr);
-
-#ifdef ENABLE_NATT
-			if (iph1->rmconf->nat_traversal &&
-			    natt_vendorid(vid_numeric)) {
-				natt_handle_vendorid(iph1, vid_numeric);
-				break;
-			}
-#endif
-#ifdef ENABLE_HYBRID
-			switch (vid_numeric) {
-			case VENDORID_XAUTH:
-				iph1->mode_cfg->flags |= 
-				    ISAKMP_CFG_VENDORID_XAUTH;
-				break;
-
-			case VENDORID_UNITY:
-				iph1->mode_cfg->flags |= 
-				    ISAKMP_CFG_VENDORID_UNITY;
-				break;
-			default:
-				break;
-			}
-#endif
-#ifdef ENABLE_DPD
-			if (vid_numeric == VENDORID_DPD && iph1->rmconf->dpd) {
-				iph1->dpd_support=1;
-				plog(LLV_DEBUG, LOCATION, NULL,
-					 "remote supports DPD\n");
-			}
-#endif
+			vid_numeric = handle_vendorid(iph1, pa->ptr);
 #ifdef ENABLE_FRAG
 			if ((vid_numeric == VENDORID_FRAG) &&
 			    (vendorid_frag_cap(pa->ptr) & VENDORID_FRAG_AGG))
@@ -970,8 +895,7 @@
 		VPTRINIT(iph1->dhpub_p);
 		VPTRINIT(iph1->nonce_p);
 		VPTRINIT(iph1->id_p);
-		oakley_delcert(iph1->cr_p);
-		iph1->cr_p = NULL;
+		VPTRINIT(iph1->cr_p);
 	}
 
 	return error;
@@ -991,9 +915,7 @@
 	vchar_t *msg;
 {
 	struct payload_list *plist = NULL;
-	int need_cr = 0;
 	int need_cert = 0;
-	vchar_t *cr = NULL;
 	int error = -1;
 #ifdef ENABLE_HYBRID
 	vchar_t *xauth_vid = NULL;
@@ -1057,7 +979,7 @@
 		goto end;
 
 #ifdef HAVE_GSSAPI
-	if (RMAUTHMETHOD(iph1) == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB)
+	if (iph1->rmconf->proposal->authmethod == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB)
 		gssapi_get_rtoken(iph1, &gsslen);
 #endif
 
@@ -1073,19 +995,6 @@
 		goto end;
 	}
 
-	/* create CR if need */
-	if (iph1->rmconf->send_cr
-	 && oakley_needcr(iph1->approval->authmethod)
-	 && iph1->rmconf->peerscertfile == NULL) {
-		need_cr = 1;
-		cr = oakley_getcr(iph1);
-		if (cr == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to get cr buffer.\n");
-			goto end;
-		}
-	}
-
 #ifdef ENABLE_NATT
 	/* Has the peer announced NAT-T? */
 	if (NATT_AVAILABLE(iph1)) {
@@ -1124,35 +1033,34 @@
 	}
 #endif
 
-	switch (AUTHMETHOD(iph1)) {
+	switch (iph1->approval->authmethod) {
 	case OAKLEY_ATTR_AUTH_METHOD_PSKEY:
 #ifdef ENABLE_HYBRID
 	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
 #endif
 		/* set SA payload to reply */
-		plist = isakmp_plist_append(plist, 
+		plist = isakmp_plist_append(plist,
 		    iph1->sa_ret, ISAKMP_NPTYPE_SA);
 
 		/* create isakmp KE payload */
-		plist = isakmp_plist_append(plist, 
+		plist = isakmp_plist_append(plist,
 		    iph1->dhpub, ISAKMP_NPTYPE_KE);
 
 		/* create isakmp NONCE payload */
-		plist = isakmp_plist_append(plist, 
+		plist = isakmp_plist_append(plist,
 		    iph1->nonce, ISAKMP_NPTYPE_NONCE);
 
 		/* create isakmp ID payload */
-		plist = isakmp_plist_append(plist, 
+		plist = isakmp_plist_append(plist,
 		    iph1->id, ISAKMP_NPTYPE_ID);
 
 		/* create isakmp HASH payload */
-		plist = isakmp_plist_append(plist, 
+		plist = isakmp_plist_append(plist,
 		    iph1->hash, ISAKMP_NPTYPE_HASH);
 
 		/* create isakmp CR payload if needed */
-		if (need_cr)
-			plist = isakmp_plist_append(plist, 
-			    cr, ISAKMP_NPTYPE_CR);
+		if (oakley_needcr(iph1->approval->authmethod))
+			plist = oakley_append_cr(plist, iph1);
 		break;
 	case OAKLEY_ATTR_AUTH_METHOD_DSSSIG:
 	case OAKLEY_ATTR_AUTH_METHOD_RSASIG:
@@ -1174,34 +1082,33 @@
 			need_cert = 1;
 
 		/* set SA payload to reply */
-		plist = isakmp_plist_append(plist, 
+		plist = isakmp_plist_append(plist,
 		    iph1->sa_ret, ISAKMP_NPTYPE_SA);
 
 		/* create isakmp KE payload */
-		plist = isakmp_plist_append(plist, 
+		plist = isakmp_plist_append(plist,
 		    iph1->dhpub, ISAKMP_NPTYPE_KE);
 
 		/* create isakmp NONCE payload */
-		plist = isakmp_plist_append(plist, 
+		plist = isakmp_plist_append(plist,
 		    iph1->nonce, ISAKMP_NPTYPE_NONCE);
 
 		/* add ID payload */
-		plist = isakmp_plist_append(plist, 
+		plist = isakmp_plist_append(plist,
 		    iph1->id, ISAKMP_NPTYPE_ID);
 
 		/* add CERT payload if there */
 		if (need_cert)
-			plist = isakmp_plist_append(plist, 
-			    iph1->cert->pl, ISAKMP_NPTYPE_CERT);
+			plist = isakmp_plist_append(plist, iph1->cert,
+						    ISAKMP_NPTYPE_CERT);
 
 		/* add SIG payload */
-		plist = isakmp_plist_append(plist, 
+		plist = isakmp_plist_append(plist,
 		    iph1->sig, ISAKMP_NPTYPE_SIG);
 
 		/* create isakmp CR payload if needed */
-		if (need_cr)
-			plist = isakmp_plist_append(plist, 
-			    cr, ISAKMP_NPTYPE_CR);
+		if (oakley_needcr(iph1->approval->authmethod))
+			plist = oakley_append_cr(plist, iph1);
 		break;
 
 	case OAKLEY_ATTR_AUTH_METHOD_RSAENC:
@@ -1219,9 +1126,9 @@
 				plog(LLV_ERROR, LOCATION, NULL,
 					"failed to wrap hash\n");
 				/*
-				 * This is probably due to the GSS 
-				 * roundtrips not being finished yet. 
-				 * Return this error in the hope that 
+				 * This is probably due to the GSS
+				 * roundtrips not being finished yet.
+				 * Return this error in the hope that
 				 * a fallback to main mode will be done.
 				 */
 				isakmp_info_send_n1(iph1,
@@ -1229,8 +1136,8 @@
 				goto end;
 			}
 			if (iph1->approval->gssid != NULL)
-				gss_sa = 
-				    ipsecdoi_setph1proposal(iph1->approval);  
+				gss_sa = ipsecdoi_setph1proposal(iph1->rmconf,
+								 iph1->approval);
 			else
 				gss_sa = iph1->sa_ret;
 
@@ -1238,28 +1145,32 @@
 				free_gss_sa = 1;
 
 			/* set SA payload to reply */
-			plist = isakmp_plist_append(plist, 
+			plist = isakmp_plist_append(plist,
 			    gss_sa, ISAKMP_NPTYPE_SA);
 
 			/* create isakmp KE payload */
-			plist = isakmp_plist_append(plist, 
+			plist = isakmp_plist_append(plist,
 			    iph1->dhpub, ISAKMP_NPTYPE_KE);
 
 			/* create isakmp NONCE payload */
-			plist = isakmp_plist_append(plist, 
+			plist = isakmp_plist_append(plist,
 			    iph1->nonce, ISAKMP_NPTYPE_NONCE);
 
 			/* create isakmp ID payload */
-			plist = isakmp_plist_append(plist, 
+			plist = isakmp_plist_append(plist,
 			    iph1->id, ISAKMP_NPTYPE_ID);
 
 			/* create GSS payload */
-			gssapi_get_token_to_send(iph1, &gsstoken);
-			plist = isakmp_plist_append(plist, 
+			if (gssapi_get_token_to_send(iph1, &gsstoken) < 0) {
+				plog(LLV_ERROR, LOCATION, NULL,
+				    "Failed to get gssapi token.\n");
+				goto end;
+			}
+			plist = isakmp_plist_append(plist,
 			    gsstoken, ISAKMP_NPTYPE_GSS);
 
 			/* create isakmp HASH payload */
-			plist = isakmp_plist_append(plist, 
+			plist = isakmp_plist_append(plist,
 			    gsshash, ISAKMP_NPTYPE_HASH);
 
 			/* append vendor id, if needed */
@@ -1275,7 +1186,7 @@
 			    "Cannot create Xauth vendor ID\n");
 			goto end;
 		}
-		plist = isakmp_plist_append(plist, 
+		plist = isakmp_plist_append(plist,
 		    xauth_vid, ISAKMP_NPTYPE_VID);
 	}
 
@@ -1285,7 +1196,7 @@
 			    "Cannot create Unity vendor ID\n");
 			goto end;
 		}
-		plist = isakmp_plist_append(plist, 
+		plist = isakmp_plist_append(plist,
 		    unity_vid, ISAKMP_NPTYPE_VID);
 	}
 #endif
@@ -1318,8 +1229,7 @@
 #endif
 
 	/* send the packet, add to the schedule to resend */
-	iph1->retry_counter = iph1->rmconf->retry_counter;
-	if (isakmp_ph1resend(iph1) == -1)
+	if (isakmp_ph1send(iph1) == -1)
 		goto end;
 
 	/* the sending message is added to the received-list. */
@@ -1334,8 +1244,6 @@
 	error = 0;
 
 end:
-	if (cr)
-		vfree(cr);
 #ifdef ENABLE_HYBRID
 	if (xauth_vid)
 		vfree(xauth_vid);
@@ -1378,9 +1286,7 @@
 	vchar_t *msg = NULL;
 	vchar_t *pbuf = NULL;
 	struct isakmp_parse_t *pa;
-	int error = -1;
-	int ptype;
-
+	int error = -1, ptype;
 #ifdef ENABLE_NATT
 	int natd_seq = 0;
 #endif
@@ -1418,7 +1324,7 @@
 			iph1->pl_hash = (struct isakmp_pl_hash *)pa->ptr;
 			break;
 		case ISAKMP_NPTYPE_VID:
-			(void)check_vendorid(pa->ptr);
+			handle_vendorid(iph1, pa->ptr);
 			break;
 		case ISAKMP_NPTYPE_CERT:
 			if (oakley_savecert(iph1, pa->ptr) < 0)
@@ -1429,7 +1335,9 @@
 				goto end;
 			break;
 		case ISAKMP_NPTYPE_N:
-			isakmp_check_notify(pa->ptr, iph1);
+			isakmp_log_notify(iph1,
+				(struct isakmp_pl_n *) pa->ptr,
+				"aggressive exchange");
 			break;
 
 #ifdef ENABLE_NATT
@@ -1440,20 +1348,20 @@
 			{
 				vchar_t *natd_received = NULL;
 				int natd_verified;
-				
+
 				if (isakmp_p2ph (&natd_received, pa->ptr) < 0)
 					goto end;
-				
+
 				if (natd_seq == 0)
 					iph1->natt_flags |= NAT_DETECTED;
-				
+
 				natd_verified = natt_compare_addr_hash (iph1,
 					natd_received, natd_seq++);
-				
+
 				plog (LLV_INFO, LOCATION, NULL, "NAT-D payload #%d %s\n",
 					natd_seq - 1,
 					natd_verified ? "verified" : "doesn't match");
-				
+
 				vfree (natd_received);
 				break;
 			}
@@ -1473,7 +1381,7 @@
 #ifdef ENABLE_NATT
 	if (NATT_AVAILABLE(iph1))
 		plog (LLV_INFO, LOCATION, NULL, "NAT %s %s%s\n",
-		      iph1->natt_flags & NAT_DETECTED ? 
+		      iph1->natt_flags & NAT_DETECTED ?
 		      		"detected:" : "not detected",
 		      iph1->natt_flags & NAT_DETECTED_ME ? "ME " : "",
 		      iph1->natt_flags & NAT_DETECTED_PEER ? "PEER" : "");
@@ -1486,8 +1394,7 @@
 			/* message printed inner oakley_validate_auth() */
 			goto end;
 		}
-		EVT_PUSH(iph1->local, iph1->remote, 
-		    EVTT_PEERPH1AUTH_FAILED, NULL);
+		evt_phase1(iph1, EVT_PHASE1_AUTH_FAILED, NULL);
 		isakmp_info_send_n1(iph1, ptype, NULL);
 		goto end;
 	}
@@ -1502,10 +1409,8 @@
 	if (msg)
 		vfree(msg);
 	if (error) {
-		oakley_delcert(iph1->cert_p);
-		iph1->cert_p = NULL;
-		oakley_delcert(iph1->crl_p);
-		iph1->crl_p = NULL;
+		VPTRINIT(iph1->cert_p);
+		VPTRINIT(iph1->crl_p);
 		VPTRINIT(iph1->sig_p);
 	}
 
diff --git a/src/racoon/isakmp_base.c b/src/racoon/isakmp_base.c
index 3ac0b72..f37d51e 100644
--- a/src/racoon/isakmp_base.c
+++ b/src/racoon/isakmp_base.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: isakmp_base.c,v 1.7 2006/10/02 21:51:33 manu Exp $	*/
+/*	$NetBSD: isakmp_base.c,v 1.12 2009/03/12 10:57:26 tteras Exp $	*/
 
 /*	$KAME: isakmp_base.c,v 1.49 2003/11/13 02:30:20 sakane Exp $	*/
 
@@ -143,7 +143,8 @@
 		goto end;
 
 	/* create SA payload for my proposal */
-	iph1->sa = ipsecdoi_setph1proposal(iph1->rmconf->proposal);
+	iph1->sa = ipsecdoi_setph1proposal(iph1->rmconf,
+					   iph1->rmconf->proposal);
 	if (iph1->sa == NULL)
 		goto end;
 
@@ -154,8 +155,8 @@
 
 #ifdef ENABLE_HYBRID
         /* Do we need Xauth VID? */
-        switch (RMAUTHMETHOD(iph1)) {
-        case FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I:
+        switch (iph1->rmconf->proposal->authmethod) {
+        case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I:
         case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
         case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
         case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I:
@@ -250,8 +251,7 @@
 #endif
 
 	/* send the packet, add to the schedule to resend */
-	iph1->retry_counter = iph1->rmconf->retry_counter;
-	if (isakmp_ph1resend(iph1) == -1)
+	if (isakmp_ph1send(iph1) == -1)
 		goto end;
 
 	iph1->status = PHASE1ST_MSG1SENT;
@@ -297,7 +297,6 @@
 	struct isakmp_parse_t *pa;
 	vchar_t *satmp = NULL;
 	int error = -1;
-	int vid_numeric;
 #ifdef ENABLE_HYBRID
 	vchar_t *unity_vid;
 	vchar_t *xauth_vid;
@@ -342,34 +341,7 @@
 				goto end;
 			break;
 		case ISAKMP_NPTYPE_VID:
-			vid_numeric = check_vendorid(pa->ptr);
-#ifdef ENABLE_NATT
-			if (iph1->rmconf->nat_traversal && natt_vendorid(vid_numeric))
-			  natt_handle_vendorid(iph1, vid_numeric);
-#endif
-#ifdef ENABLE_HYBRID
-			switch (vid_numeric) {
-			case VENDORID_XAUTH:
-				iph1->mode_cfg->flags |=
-				    ISAKMP_CFG_VENDORID_XAUTH;
-				break;
-
-			case VENDORID_UNITY:
-				iph1->mode_cfg->flags |=
-				    ISAKMP_CFG_VENDORID_UNITY;
-				break;
-
-			default:
-				break;
-			}
-#endif
-#ifdef ENABLE_DPD
-			if (vid_numeric == VENDORID_DPD && iph1->rmconf->dpd) {
-				iph1->dpd_support=1;
-				plog(LLV_DEBUG, LOCATION, NULL,
-					 "remote supports DPD\n");
-			}
-#endif
+			handle_vendorid(iph1, pa->ptr);
 			break;
 		default:
 			/* don't send information, see ident_r1recv() */
@@ -462,7 +434,7 @@
 		goto end;
 
 	/* generate SKEYID to compute hash if not signature mode */
-	switch (AUTHMETHOD(iph1)) {
+	switch (iph1->approval->authmethod) {
 	case OAKLEY_ATTR_AUTH_METHOD_RSASIG:
 	case OAKLEY_ATTR_AUTH_METHOD_DSSSIG:
 #ifdef ENABLE_HYBRID
@@ -484,10 +456,10 @@
 	iph1->hash = oakley_ph1hash_base_i(iph1, GENERATE);
 	if (iph1->hash == NULL)
 		goto end;
-	switch (AUTHMETHOD(iph1)) {
+	switch (iph1->approval->authmethod) {
 	case OAKLEY_ATTR_AUTH_METHOD_PSKEY:
 #ifdef ENABLE_HYBRID
-	case FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I:
+	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I:
 	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
 	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
 #endif
@@ -521,16 +493,16 @@
 			need_cert = 1;
 
 		/* create isakmp KE payload */
-		plist = isakmp_plist_append(plist, 
-		    iph1->dhpub, ISAKMP_NPTYPE_KE);
+		plist = isakmp_plist_append(plist, iph1->dhpub,
+					    ISAKMP_NPTYPE_KE);
 
 		/* add CERT payload if there */
 		if (need_cert)
-			plist = isakmp_plist_append(plist, 
-			    iph1->cert->pl, ISAKMP_NPTYPE_CERT);
+			plist = isakmp_plist_append(plist,  iph1->cert,
+						    ISAKMP_NPTYPE_CERT);
 
 		/* add SIG payload */
-		plist = isakmp_plist_append(plist, 
+		plist = isakmp_plist_append(plist,
 		    iph1->sig, ISAKMP_NPTYPE_SIG);
 
 		break;
@@ -579,8 +551,7 @@
 #endif
 
 	/* send the packet, add to the schedule to resend */
-	iph1->retry_counter = iph1->rmconf->retry_counter;
-	if (isakmp_ph1resend(iph1) == -1)
+	if (isakmp_ph1send(iph1) == -1)
 		goto end;
 
 	/* the sending message is added to the received-list. */
@@ -614,8 +585,7 @@
 {
 	vchar_t *pbuf = NULL;
 	struct isakmp_parse_t *pa;
-	int error = -1;
-	int ptype;
+	int error = -1, ptype;
 #ifdef ENABLE_NATT
 	vchar_t	*natd_received;
 	int natd_seq = 0, natd_verified;
@@ -654,7 +624,7 @@
 				goto end;
 			break;
 		case ISAKMP_NPTYPE_VID:
-			(void)check_vendorid(pa->ptr);
+			handle_vendorid(iph1, pa->ptr);
 			break;
 
 #ifdef ENABLE_NATT
@@ -716,8 +686,7 @@
 			/* message printed inner oakley_validate_auth() */
 			goto end;
 		}
-		EVT_PUSH(iph1->local, iph1->remote, 
-		    EVTT_PEERPH1AUTH_FAILED, NULL);
+		evt_phase1(iph1, EVT_PHASE1_AUTH_FAILED, NULL);
 		isakmp_info_send_n1(iph1, ptype, NULL);
 		goto end;
 	}
@@ -728,7 +697,7 @@
 		goto end;
 
 	/* generate SKEYID to compute hash if signature mode */
-	switch (AUTHMETHOD(iph1)) {
+	switch (iph1->approval->authmethod) {
 	case OAKLEY_ATTR_AUTH_METHOD_RSASIG:
 	case OAKLEY_ATTR_AUTH_METHOD_DSSSIG:
 #ifdef ENABLE_HYBRID
@@ -769,10 +738,8 @@
 
 	if (error) {
 		VPTRINIT(iph1->dhpub_p);
-		oakley_delcert(iph1->cert_p);
-		iph1->cert_p = NULL;
-		oakley_delcert(iph1->crl_p);
-		iph1->crl_p = NULL;
+		VPTRINIT(iph1->cert_p);
+		VPTRINIT(iph1->crl_p);
 		VPTRINIT(iph1->sig_p);
 	}
 
@@ -829,9 +796,6 @@
 	}
 
 	/* validate the type of next payload */
-	/*
-	 * NOTE: XXX even if multiple VID, we'll silently ignore those.
-	 */
 	pbuf = isakmp_parse(msg);
 	if (pbuf == NULL)
 		goto end;
@@ -863,39 +827,12 @@
 				goto end;
 			break;
 		case ISAKMP_NPTYPE_VID:
-			vid_numeric = check_vendorid(pa->ptr);
-#ifdef ENABLE_NATT
-			if (iph1->rmconf->nat_traversal && natt_vendorid(vid_numeric))
-				natt_handle_vendorid(iph1, vid_numeric);
-#endif
+			vid_numeric = handle_vendorid(iph1, pa->ptr);
 #ifdef ENABLE_FRAG
 			if ((vid_numeric == VENDORID_FRAG) &&
 			    (vendorid_frag_cap(pa->ptr) & VENDORID_FRAG_BASE))
 				iph1->frag = 1;
 #endif
-#ifdef ENABLE_HYBRID
-			switch (vid_numeric) {
-			case VENDORID_XAUTH:
-				iph1->mode_cfg->flags |=
-				    ISAKMP_CFG_VENDORID_XAUTH;
-				break;
-
-			case VENDORID_UNITY:
-				iph1->mode_cfg->flags |=
-				    ISAKMP_CFG_VENDORID_UNITY;
-				break;
-
-			default:
-				break;
-			}
-#endif
-#ifdef ENABLE_DPD
-			if (vid_numeric == VENDORID_DPD && iph1->rmconf->dpd) {
-				iph1->dpd_support=1;
-				plog(LLV_DEBUG, LOCATION, NULL,
-					 "remote supports DPD\n");
-			}
-#endif 
 			break;
 		default:
 			/* don't send information, see ident_r1recv() */
@@ -1073,8 +1010,7 @@
 #endif
 
 	/* send the packet, add to the schedule to resend */
-	iph1->retry_counter = iph1->rmconf->retry_counter;
-	if (isakmp_ph1resend(iph1) == -1) {
+	if (isakmp_ph1send(iph1) == -1) {
 		iph1 = NULL;
 		goto end;
 	}
@@ -1130,8 +1066,7 @@
 {
 	vchar_t *pbuf = NULL;
 	struct isakmp_parse_t *pa;
-	int error = -1;
-	int ptype;
+	int error = -1, ptype;
 #ifdef ENABLE_NATT
 	int natd_seq = 0;
 #endif
@@ -1171,7 +1106,7 @@
 				goto end;
 			break;
 		case ISAKMP_NPTYPE_VID:
-			(void)check_vendorid(pa->ptr);
+			handle_vendorid(iph1, pa->ptr);
 			break;
 
 #ifdef ENABLE_NATT
@@ -1242,8 +1177,7 @@
 			/* message printed inner oakley_validate_auth() */
 			goto end;
 		}
-		EVT_PUSH(iph1->local, iph1->remote, 
-		    EVTT_PEERPH1AUTH_FAILED, NULL);
+		evt_phase1(iph1, EVT_PHASE1_AUTH_FAILED, NULL);
 		isakmp_info_send_n1(iph1, ptype, NULL);
 		goto end;
 	}
@@ -1258,10 +1192,8 @@
 
 	if (error) {
 		VPTRINIT(iph1->dhpub_p);
-		oakley_delcert(iph1->cert_p);
-		iph1->cert_p = NULL;
-		oakley_delcert(iph1->crl_p);
-		iph1->crl_p = NULL;
+		VPTRINIT(iph1->cert_p);
+		VPTRINIT(iph1->crl_p);
 		VPTRINIT(iph1->sig_p);
 	}
 
@@ -1294,7 +1226,7 @@
 
 	/* generate HASH to send */
 	plog(LLV_DEBUG, LOCATION, NULL, "generate HASH_I\n");
-	switch (AUTHMETHOD(iph1)) {
+	switch (iph1->approval->authmethod) {
 	case OAKLEY_ATTR_AUTH_METHOD_PSKEY:
 #ifdef ENABLE_HYBRID
 	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
@@ -1329,7 +1261,7 @@
 	if (iph1->hash == NULL)
 		goto end;
 
-	switch (AUTHMETHOD(iph1)) {
+	switch (iph1->approval->authmethod) {
 	case OAKLEY_ATTR_AUTH_METHOD_PSKEY:
 #ifdef ENABLE_HYBRID
 	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
@@ -1369,16 +1301,17 @@
 			need_cert = 1;
 
 		/* create isakmp KE payload */
-		plist = isakmp_plist_append(plist, 
-		    iph1->dhpub, ISAKMP_NPTYPE_KE);
+		plist = isakmp_plist_append(plist, iph1->dhpub,
+					    ISAKMP_NPTYPE_KE);
 
 		/* add CERT payload if there */
 		if (need_cert)
-			plist = isakmp_plist_append(plist, 
-			    iph1->cert->pl, ISAKMP_NPTYPE_CERT);
+			plist = isakmp_plist_append(plist, iph1->cert,
+						    ISAKMP_NPTYPE_CERT);
+
 		/* add SIG payload */
-		plist = isakmp_plist_append(plist, 
-		    iph1->sig, ISAKMP_NPTYPE_SIG);
+		plist = isakmp_plist_append(plist, iph1->sig,
+					    ISAKMP_NPTYPE_SIG);
 		break;
 #ifdef HAVE_GSSAPI
 	case OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB:
diff --git a/src/racoon/isakmp_cfg.c b/src/racoon/isakmp_cfg.c
index 52862c4..0ec30ee 100644
--- a/src/racoon/isakmp_cfg.c
+++ b/src/racoon/isakmp_cfg.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: isakmp_cfg.c,v 1.12.6.4 2008/11/27 15:25:20 vanhu Exp $	*/
+/*	$NetBSD: isakmp_cfg.c,v 1.24 2010/09/21 13:14:17 vanhu Exp $	*/
 
 /* Id: isakmp_cfg.c,v 1.55 2006/08/22 18:17:17 manubsd Exp */
 
@@ -38,7 +38,7 @@
 #include <sys/socket.h>
 #include <sys/queue.h>
 
-#include <utmp.h>
+#include <utmpx.h>
 #if defined(__APPLE__) && defined(__MACH__)
 #include <util.h>
 #endif
@@ -114,6 +114,8 @@
 #endif
 static vchar_t *isakmp_cfg_addr4(struct ph1handle *, 
 				 struct isakmp_data *, in_addr_t *);
+static vchar_t *isakmp_cfg_addrnet4(struct ph1handle *, 
+				 struct isakmp_data *, in_addr_t *, in_addr_t *);
 static void isakmp_cfg_getaddr4(struct isakmp_data *, struct in_addr *);
 static vchar_t *isakmp_cfg_addr4_list(struct ph1handle *,
 				      struct isakmp_data *, in_addr_t *, int);
@@ -446,8 +448,8 @@
 	
 	if ((iph1->status == PHASE1ST_ESTABLISHED) && 
 	    iph1->rmconf->mode_cfg) {
-		switch (AUTHMETHOD(iph1)) {
-		case FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I:
+		switch (iph1->approval->authmethod) {
+		case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I:
 		case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
 		/* Unimplemented */
 		case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I: 
@@ -473,8 +475,7 @@
 			    "Cannot allocate memory: %s\n", strerror(errno));
 		} else {
 			memcpy(buf->v, attrpl + 1, buf->l);
-			EVT_PUSH(iph1->local, iph1->remote, 
-			    EVTT_ISAKMP_CFG_DONE, buf);
+			evt_phase1(iph1, EVT_PHASE1_MODE_CFG, buf);
 			vfree(buf);
 		}
 	}
@@ -629,7 +630,7 @@
 	    ISAKMP_NPTYPE_ATTR, ISAKMP_FLAG_E, 0);
 
 	if (iph1->status == PHASE1ST_ESTABLISHED) {
-		switch (AUTHMETHOD(iph1)) {
+		switch (iph1->approval->authmethod) {
 		case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
 		case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R:
 		/* Unimplemented */
@@ -731,7 +732,8 @@
 	    ISAKMP_NPTYPE_ATTR, ISAKMP_FLAG_E, 0);
 
 	if (iph1->mode_cfg->flags & ISAKMP_CFG_DELETE_PH1) {
-		if (iph1->status == PHASE1ST_ESTABLISHED)
+		if (iph1->status == PHASE1ST_ESTABLISHED ||
+		    iph1->status == PHASE1ST_DYING)
 			isakmp_info_send_d1(iph1);
 		remph1(iph1);
 		delph1(iph1);
@@ -901,8 +903,15 @@
 		break;
 
 	case INTERNAL_IP4_SUBNET:
-		return isakmp_cfg_addr4(iph1, 
-		    attr, &isakmp_cfg_config.network4);
+		if(isakmp_cfg_config.splitnet_count > 0){
+			return isakmp_cfg_addrnet4(iph1, attr,
+						    &isakmp_cfg_config.splitnet_list->network.addr4.s_addr,
+						    &isakmp_cfg_config.splitnet_list->network.mask4.s_addr);
+		}else{
+			plog(LLV_INFO, LOCATION, NULL,
+			     "%s requested but no splitnet in configuration\n",
+			     s_isakmp_cfg_type(type));
+		}
 		break;
 
 	default:
@@ -1042,6 +1051,36 @@
 }
 
 static vchar_t *
+isakmp_cfg_addrnet4(iph1, attr, addr, mask)
+	struct ph1handle *iph1;
+	struct isakmp_data *attr;
+	in_addr_t *addr;
+	in_addr_t *mask;
+{
+	vchar_t *buffer;
+	struct isakmp_data *new;
+	size_t len;
+	in_addr_t netbuff[2];
+
+	len = sizeof(netbuff);
+	if ((buffer = vmalloc(sizeof(*attr) + len)) == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL, "Cannot allocate memory\n");
+		return NULL;
+	}
+
+	new = (struct isakmp_data *)buffer->v;
+
+	new->type = attr->type;
+	new->lorv = htons(len);
+	netbuff[0]=*addr;
+	netbuff[1]=*mask;
+	memcpy(new + 1, netbuff, len);
+	
+	return buffer;
+}
+
+
+static vchar_t *
 isakmp_cfg_addr4_list(iph1, attr, addr, nbr)
 	struct ph1handle *iph1;
 	struct isakmp_data *attr;
@@ -1127,7 +1166,7 @@
 	struct isakmp_cfg_state *ics = iph1->mode_cfg;
 
 	/* Check if phase 1 is established */
-	if ((iph1->status != PHASE1ST_ESTABLISHED) || 
+	if ((iph1->status < PHASE1ST_ESTABLISHED) ||
 	    (iph1->local == NULL) ||
 	    (iph1->remote == NULL)) {
 		plog(LLV_ERROR, LOCATION, NULL, 
@@ -1151,16 +1190,6 @@
 		goto end;
 	}
 
-#if (!defined(ENABLE_NATT)) || (defined(BROKEN_NATT))
-	if (set_port(iph2->dst, 0) == NULL ||
-	    set_port(iph2->src, 0) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		     "invalid family: %d\n", iph1->remote->sa_family);
-		delph2(iph2);
-		goto end;
-	}
-#endif
-	iph2->ph1 = iph1;
 	iph2->side = INITIATOR;
 	iph2->status = PHASE2ST_START;
 
@@ -1179,7 +1208,7 @@
 		}
 
 		/* generate HASH(1) */
-		hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, payload);
+		hash = oakley_compute_hash1(iph1, iph2->msgid, payload);
 		if (hash == NULL) {
 			delph2(iph2);
 			goto end;
@@ -1278,7 +1307,6 @@
 	if (iph2->sendbuf != NULL)
 		vfree(iph2->sendbuf);
 
-	unbindph12(iph2);
 	remph2(iph2);
 	delph2(iph2);
 end:
@@ -1492,24 +1520,6 @@
 	struct ph1handle *iph1;
 	int inout;
 {
-	/* For first time use, initialize Radius */
-	if (radius_acct_state == NULL) {
-		if ((radius_acct_state = rad_acct_open()) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "Cannot init librradius\n");
-			return -1;
-		}
-
-		if (rad_config(radius_acct_state, NULL) != 0) {
-			 plog(LLV_ERROR, LOCATION, NULL,
-			     "Cannot open librarius config file: %s\n",
-			     rad_strerror(radius_acct_state));
-			  rad_close(radius_acct_state);
-			  radius_acct_state = NULL;
-			  return -1;
-		}
-	}
-
 	if (rad_create_request(radius_acct_state, 
 	    RAD_ACCOUNTING_REQUEST) != 0) {
 		plog(LLV_ERROR, LOCATION, NULL,
@@ -1651,8 +1661,7 @@
 	int inout;
 {
 	int error = 0;
-	struct utmp ut;
-	char term[UT_LINESIZE];
+	struct utmpx ut;
 	char addr[NI_MAXHOST];
 	
 	if (usr == NULL || usr[0]=='\0') {
@@ -1661,36 +1670,33 @@
 		return -1;
 	}
 
-	sprintf(term, TERMSPEC, port);
+	memset(&ut, 0, sizeof ut);
+	gettimeofday((struct timeval *)&ut.ut_tv, NULL);
+	snprintf(ut.ut_id, sizeof ut.ut_id, TERMSPEC, port);
 
 	switch (inout) {
 	case ISAKMP_CFG_LOGIN:
-		strncpy(ut.ut_name, usr, UT_NAMESIZE);
-		ut.ut_name[UT_NAMESIZE - 1] = '\0';
-
-		strncpy(ut.ut_line, term, UT_LINESIZE);
-		ut.ut_line[UT_LINESIZE - 1] = '\0';
+		ut.ut_type = USER_PROCESS;
+		strncpy(ut.ut_user, usr, sizeof ut.ut_user);
 
 		GETNAMEINFO_NULL(raddr, addr);
-		strncpy(ut.ut_host, addr, UT_HOSTSIZE);
-		ut.ut_host[UT_HOSTSIZE - 1] = '\0';
+		strncpy(ut.ut_host, addr, sizeof ut.ut_host);
 
-		ut.ut_time = time(NULL);
- 
 		plog(LLV_INFO, LOCATION, NULL,
 			"Accounting : '%s' logging on '%s' from %s.\n",
-			ut.ut_name, ut.ut_line, ut.ut_host);
+			ut.ut_user, ut.ut_id, addr);
 
-		login(&ut);
+		pututxline(&ut);
 
 		break;
 	case ISAKMP_CFG_LOGOUT:	
+		ut.ut_type = DEAD_PROCESS;
 
 		plog(LLV_INFO, LOCATION, NULL,
 			"Accounting : '%s' unlogging from '%s'.\n",
-			usr, term);
+			usr, ut.ut_id);
 
-		logout(term);
+		pututxline(&ut);
 
 		break;
 	default:
@@ -1865,6 +1871,7 @@
 	char addrstr[IP_MAX];
 	char addrlist[IP_MAX * MAXNS + MAXNS];
 	char *splitlist = addrlist;
+	char *splitlist_cidr;
 	char defdom[MAXPATHLEN + 1];
 	int cidr, tmp;
 	char cidrstr[4];
@@ -2005,10 +2012,14 @@
 	}
 
 	/* Split networks */
-	if (iph1->mode_cfg->flags & ISAKMP_CFG_GOT_SPLIT_INCLUDE)
-		splitlist = splitnet_list_2str(iph1->mode_cfg->split_include);
-	else {
+	if (iph1->mode_cfg->flags & ISAKMP_CFG_GOT_SPLIT_INCLUDE) {
+		splitlist = 
+		    splitnet_list_2str(iph1->mode_cfg->split_include, NETMASK);
+		splitlist_cidr = 
+		    splitnet_list_2str(iph1->mode_cfg->split_include, CIDR);
+	} else {
 		splitlist = addrlist;
+		splitlist_cidr = addrlist;
 		addrlist[0] = '\0';
 	}
 
@@ -2016,13 +2027,25 @@
 		plog(LLV_ERROR, LOCATION, NULL, "Cannot set SPLIT_INCLUDE\n");
 		return -1;
 	}
+	if (script_env_append(envp, envc, 
+	    "SPLIT_INCLUDE_CIDR", splitlist_cidr) != 0) {
+		plog(LLV_ERROR, LOCATION, NULL,
+		     "Cannot set SPLIT_INCLUDE_CIDR\n");
+		return -1;
+	}
 	if (splitlist != addrlist)
 		racoon_free(splitlist);
+	if (splitlist_cidr != addrlist)
+		racoon_free(splitlist_cidr);
 
-	if (iph1->mode_cfg->flags & ISAKMP_CFG_GOT_SPLIT_LOCAL)
-		splitlist = splitnet_list_2str(iph1->mode_cfg->split_local);
-	else {
+	if (iph1->mode_cfg->flags & ISAKMP_CFG_GOT_SPLIT_LOCAL) {
+		splitlist =
+		    splitnet_list_2str(iph1->mode_cfg->split_local, NETMASK);
+		splitlist_cidr =
+		    splitnet_list_2str(iph1->mode_cfg->split_local, CIDR);
+	} else {
 		splitlist = addrlist;
+		splitlist_cidr = addrlist;
 		addrlist[0] = '\0';
 	}
 
@@ -2030,8 +2053,16 @@
 		plog(LLV_ERROR, LOCATION, NULL, "Cannot set SPLIT_LOCAL\n");
 		return -1;
 	}
+	if (script_env_append(envp, envc,
+	    "SPLIT_LOCAL_CIDR", splitlist_cidr) != 0) {
+		plog(LLV_ERROR, LOCATION, NULL,
+		     "Cannot set SPLIT_LOCAL_CIDR\n");
+		return -1;
+	}
 	if (splitlist != addrlist)
 		racoon_free(splitlist);
+	if (splitlist_cidr != addrlist)
+		racoon_free(splitlist_cidr);
 	
 	return 0;
 }
diff --git a/src/racoon/isakmp_frag.c b/src/racoon/isakmp_frag.c
index 6fac6a2..ebba34b 100644
--- a/src/racoon/isakmp_frag.c
+++ b/src/racoon/isakmp_frag.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: isakmp_frag.c,v 1.4.6.1 2009/04/22 11:25:35 tteras Exp $	*/
+/*	$NetBSD: isakmp_frag.c,v 1.5 2009/04/22 11:24:20 tteras Exp $	*/
 
 /* Id: isakmp_frag.c,v 1.4 2004/11/13 17:31:36 manubsd Exp */
 
diff --git a/src/racoon/isakmp_ident.c b/src/racoon/isakmp_ident.c
index 1e00dc4..a9c3a01 100644
--- a/src/racoon/isakmp_ident.c
+++ b/src/racoon/isakmp_ident.c
@@ -1,11 +1,11 @@
-/*	$NetBSD: isakmp_ident.c,v 1.6 2006/10/02 21:41:59 manu Exp $	*/
+/*	$NetBSD: isakmp_ident.c,v 1.13 2009/09/18 10:31:11 tteras Exp $	*/
 
 /* Id: isakmp_ident.c,v 1.21 2006/04/06 16:46:08 manubsd Exp */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -17,7 +17,7 @@
  * 3. Neither the name of the project nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -86,12 +86,13 @@
 #include "isakmp_xauth.h"
 #include "isakmp_cfg.h"
 #endif
-#ifdef ENABLE_FRAG 
+#ifdef ENABLE_FRAG
 #include "isakmp_frag.h"
 #endif
 
 static vchar_t *ident_ir2mx __P((struct ph1handle *));
 static vchar_t *ident_ir3mx __P((struct ph1handle *));
+static int ident_recv_n __P((struct ph1handle *, struct isakmp_gen *));
 
 /* %%%
  * begin Identity Protection Mode as initiator.
@@ -114,13 +115,13 @@
 	vchar_t *vid_natt[MAX_NATT_VID_COUNT] = { NULL };
 	int i;
 #endif
-#ifdef ENABLE_HYBRID  
+#ifdef ENABLE_HYBRID
 	vchar_t *vid_xauth = NULL;
 	vchar_t *vid_unity = NULL;
 #endif
-#ifdef ENABLE_FRAG 
+#ifdef ENABLE_FRAG
 	vchar_t *vid_frag = NULL;
-#endif 
+#endif
 #ifdef ENABLE_DPD
 	vchar_t *vid_dpd = NULL;
 #endif
@@ -141,7 +142,8 @@
 	isakmp_newcookie((caddr_t)&iph1->index, iph1->remote, iph1->local);
 
 	/* create SA payload for my proposal */
-	iph1->sa = ipsecdoi_setph1proposal(iph1->rmconf->proposal);
+	iph1->sa = ipsecdoi_setph1proposal(iph1->rmconf,
+					   iph1->rmconf->proposal);
 	if (iph1->sa == NULL)
 		goto end;
 
@@ -150,13 +152,13 @@
 
 #ifdef ENABLE_NATT
 	/* set VID payload for NAT-T if NAT-T support allowed in the config file */
-	if (iph1->rmconf->nat_traversal) 
+	if (iph1->rmconf->nat_traversal)
 		plist = isakmp_plist_append_natt_vids(plist, vid_natt);
 #endif
 #ifdef ENABLE_HYBRID
 	/* Do we need Xauth VID? */
-	switch (RMAUTHMETHOD(iph1)) {
-	case FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I:
+	switch (iph1->rmconf->proposal->authmethod) {
+	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I:
 	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
 	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
 	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I:
@@ -169,12 +171,12 @@
 		else
 			plist = isakmp_plist_append(plist,
 			    vid_xauth, ISAKMP_NPTYPE_VID);
-			
+
 		if ((vid_unity = set_vendorid(VENDORID_UNITY)) == NULL)
 			plog(LLV_ERROR, LOCATION, NULL,
 			     "Unity vendor ID generation failed\n");
 		else
-                	plist = isakmp_plist_append(plist,
+			plist = isakmp_plist_append(plist,
 			    vid_unity, ISAKMP_NPTYPE_VID);
 		break;
 	default:
@@ -189,7 +191,7 @@
 		} else {
 			vid_frag = isakmp_frag_addcap(vid_frag,
 			    VENDORID_FRAG_IDENT);
-			plist = isakmp_plist_append(plist, 
+			plist = isakmp_plist_append(plist,
 			    vid_frag, ISAKMP_NPTYPE_VID);
 		}
 	}
@@ -210,8 +212,7 @@
 #endif
 
 	/* send the packet, add to the schedule to resend */
-	iph1->retry_counter = iph1->rmconf->retry_counter;
-	if (isakmp_ph1resend(iph1) == -1)
+	if (isakmp_ph1send(iph1) == -1)
 		goto end;
 
 	iph1->status = PHASE1ST_MSG1SENT;
@@ -220,9 +221,9 @@
 
 end:
 #ifdef ENABLE_FRAG
-	if (vid_frag) 
+	if (vid_frag)
 		vfree(vid_frag);
-#endif  
+#endif
 #ifdef ENABLE_NATT
 	for (i = 0; i < MAX_NATT_VID_COUNT && vid_natt[i] != NULL; i++)
 		vfree(vid_natt[i]);
@@ -257,7 +258,6 @@
 	struct isakmp_parse_t *pa;
 	vchar_t *satmp = NULL;
 	int error = -1;
-	int vid_numeric;
 
 	/* validity check */
 	if (iph1->status != PHASE1ST_MSG1SENT) {
@@ -299,31 +299,7 @@
 
 		switch (pa->type) {
 		case ISAKMP_NPTYPE_VID:
-			vid_numeric = check_vendorid(pa->ptr);
-#ifdef ENABLE_NATT
-			if (iph1->rmconf->nat_traversal && natt_vendorid(vid_numeric))
-			  natt_handle_vendorid(iph1, vid_numeric);
-#endif
-#ifdef ENABLE_HYBRID
-			switch (vid_numeric) {
-			case VENDORID_XAUTH:
-				iph1->mode_cfg->flags |=
-				    ISAKMP_CFG_VENDORID_XAUTH;
-				break;
-	
-			case VENDORID_UNITY:
-				iph1->mode_cfg->flags |=
-				    ISAKMP_CFG_VENDORID_UNITY;
-				break;
-	
-			default:
-				break;
-			}
-#endif  
-#ifdef ENABLE_DPD
-			if (vid_numeric == VENDORID_DPD && iph1->rmconf->dpd)
-				iph1->dpd_support=1;
-#endif
+			handle_vendorid(iph1, pa->ptr);
 			break;
 		default:
 			/* don't send information, see ident_r1recv() */
@@ -401,7 +377,7 @@
 		goto end;
 
 #ifdef HAVE_GSSAPI
-	if (AUTHMETHOD(iph1) == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB &&
+	if (iph1->approval->authmethod == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB &&
 	    gssapi_get_itoken(iph1, NULL) < 0)
 		goto end;
 #endif
@@ -416,8 +392,7 @@
 #endif
 
 	/* send the packet, add to the schedule to resend */
-	iph1->retry_counter = iph1->rmconf->retry_counter;
-	if (isakmp_ph1resend(iph1) == -1)
+	if (isakmp_ph1send(iph1) == -1)
 		goto end;
 
 	/* the sending message is added to the received-list. */
@@ -485,7 +460,7 @@
 				goto end;
 			break;
 		case ISAKMP_NPTYPE_VID:
-			(void)check_vendorid(pa->ptr);
+			handle_vendorid(iph1, pa->ptr);
 			break;
 		case ISAKMP_NPTYPE_CR:
 			if (oakley_savecr(iph1, pa->ptr) < 0)
@@ -507,21 +482,21 @@
 				natd_received = NULL;
 				if (isakmp_p2ph (&natd_received, pa->ptr) < 0)
 					goto end;
-                        
+
 				/* set both bits first so that we can clear them
 				   upon verifying hashes */
 				if (natd_seq == 0)
 					iph1->natt_flags |= NAT_DETECTED;
-                        
-				/* this function will clear appropriate bits bits 
+
+				/* this function will clear appropriate bits bits
 				   from iph1->natt_flags */
 				natd_verified = natt_compare_addr_hash (iph1,
 					natd_received, natd_seq++);
-                        
+
 				plog (LLV_INFO, LOCATION, NULL, "NAT-D payload #%d %s\n",
 					natd_seq - 1,
 					natd_verified ? "verified" : "doesn't match");
-                        
+
 				vfree (natd_received);
 				break;
 			}
@@ -541,7 +516,7 @@
 #ifdef ENABLE_NATT
 	if (NATT_AVAILABLE(iph1)) {
 		plog (LLV_INFO, LOCATION, NULL, "NAT %s %s%s\n",
-		      iph1->natt_flags & NAT_DETECTED ? 
+		      iph1->natt_flags & NAT_DETECTED ?
 		      		"detected:" : "not detected",
 		      iph1->natt_flags & NAT_DETECTED_ME ? "ME " : "",
 		      iph1->natt_flags & NAT_DETECTED_PEER ? "PEER" : "");
@@ -577,8 +552,7 @@
 		VPTRINIT(iph1->dhpub_p);
 		VPTRINIT(iph1->nonce_p);
 		VPTRINIT(iph1->id_p);
-		oakley_delcert(iph1->cr_p);
-		iph1->cr_p = NULL;
+		VPTRINIT(iph1->cr_p);
 	}
 
 	return error;
@@ -630,7 +604,7 @@
 		goto end;
 
 #ifdef HAVE_GSSAPI
-	if (AUTHMETHOD(iph1) == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB &&
+	if (iph1->approval->authmethod == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB &&
 	    gssapi_more_tokens(iph1)) {
 		plog(LLV_DEBUG, LOCATION, NULL, "calling get_itoken\n");
 		if (gssapi_get_itoken(iph1, &len) < 0)
@@ -657,8 +631,7 @@
 		goto end;
 
 	/* send the packet, add to the schedule to resend */
-	iph1->retry_counter = iph1->rmconf->retry_counter;
-	if (isakmp_ph1resend(iph1) == -1)
+	if (isakmp_ph1send(iph1) == -1)
 		goto end;
 
 	/* the sending message is added to the received-list. */
@@ -754,10 +727,10 @@
 			break;
 #endif
 		case ISAKMP_NPTYPE_VID:
-			(void)check_vendorid(pa->ptr);
+			handle_vendorid(iph1, pa->ptr);
 			break;
 		case ISAKMP_NPTYPE_N:
-			isakmp_check_notify(pa->ptr, iph1);
+			ident_recv_n(iph1, pa->ptr);
 			break;
 		default:
 			/* don't send information, see ident_r1recv() */
@@ -788,8 +761,7 @@
 				/* msg printed inner oakley_validate_auth() */
 				goto end;
 			}
-			EVT_PUSH(iph1->local, iph1->remote, 
-			    EVTT_PEERPH1AUTH_FAILED, NULL);
+			evt_phase1(iph1, EVT_PHASE1_AUTH_FAILED, NULL);
 			isakmp_info_send_n1(iph1, type, NULL);
 			goto end;
 		}
@@ -812,7 +784,7 @@
 	 * If we got a GSS token, we need to this roundtrip again.
 	 */
 #ifdef HAVE_GSSAPI
-	iph1->status = gsstoken != 0 ? PHASE1ST_MSG3RECEIVED : 
+	iph1->status = gsstoken != 0 ? PHASE1ST_MSG3RECEIVED :
 	    PHASE1ST_MSG4RECEIVED;
 #else
 	iph1->status = PHASE1ST_MSG4RECEIVED;
@@ -832,10 +804,8 @@
 
 	if (error) {
 		VPTRINIT(iph1->id_p);
-		oakley_delcert(iph1->cert_p);
-		iph1->cert_p = NULL;
-		oakley_delcert(iph1->crl_p);
-		iph1->crl_p = NULL;
+		VPTRINIT(iph1->cert_p);
+		VPTRINIT(iph1->crl_p);
 		VPTRINIT(iph1->sig_p);
 	}
 
@@ -921,35 +891,11 @@
 
 		switch (pa->type) {
 		case ISAKMP_NPTYPE_VID:
-			vid_numeric = check_vendorid(pa->ptr);
-#ifdef ENABLE_NATT
-			if (iph1->rmconf->nat_traversal && natt_vendorid(vid_numeric))
-				natt_handle_vendorid(iph1, vid_numeric);
-#endif
+			vid_numeric = handle_vendorid(iph1, pa->ptr);
 #ifdef ENABLE_FRAG
 			if ((vid_numeric == VENDORID_FRAG) &&
 			    (vendorid_frag_cap(pa->ptr) & VENDORID_FRAG_IDENT))
 				iph1->frag = 1;
-#endif   
-#ifdef ENABLE_HYBRID
-			switch (vid_numeric) {
-			case VENDORID_XAUTH:
-				iph1->mode_cfg->flags |=
-				    ISAKMP_CFG_VENDORID_XAUTH;
-				break;
-		
-			case VENDORID_UNITY:
-				iph1->mode_cfg->flags |=
-				    ISAKMP_CFG_VENDORID_UNITY;
-				break;
-	
-			default:  
-				break;
-			}
-#endif
-#ifdef ENABLE_DPD
-			if (vid_numeric == VENDORID_DPD && iph1->rmconf->dpd)
-				iph1->dpd_support=1;
 #endif
 			break;
 		default:
@@ -1021,13 +967,13 @@
 #ifdef ENABLE_HYBRID
         vchar_t *vid_xauth = NULL;
         vchar_t *vid_unity = NULL;
-#endif  
+#endif
 #ifdef ENABLE_DPD
 	vchar_t *vid_dpd = NULL;
 #endif
-#ifdef ENABLE_FRAG          
+#ifdef ENABLE_FRAG
 	vchar_t *vid_frag = NULL;
-#endif 
+#endif
 
 	/* validity check */
 	if (iph1->status != PHASE1ST_MSG1RECEIVED) {
@@ -1041,10 +987,10 @@
 
 #ifdef HAVE_GSSAPI
 	if (iph1->approval->gssid != NULL) {
-		gss_sa = ipsecdoi_setph1proposal(iph1->approval);
+		gss_sa = ipsecdoi_setph1proposal(iph1->rmconf, iph1->approval);
 		if (gss_sa != iph1->sa_ret)
 			free_gss_sa = 1;
-	} else 
+	} else
 #endif
 		gss_sa = iph1->sa_ret;
 
@@ -1082,8 +1028,7 @@
 		plist = isakmp_plist_append(plist, vid_natt, ISAKMP_NPTYPE_VID);
 #endif
 #ifdef ENABLE_DPD
-	/* XXX only send DPD VID if remote sent it ? */
-	if(iph1->rmconf->dpd){
+	if (iph1->dpd_support) {
 		vid_dpd = set_vendorid(VENDORID_DPD);
 		if (vid_dpd != NULL)
 			plist = isakmp_plist_append(plist, vid_dpd, ISAKMP_NPTYPE_VID);
@@ -1099,7 +1044,7 @@
 			plog(LLV_ERROR, LOCATION, NULL,
 			    "Frag vendorID construction failed\n");
 		else
-			plist = isakmp_plist_append(plist, 
+			plist = isakmp_plist_append(plist,
 			     vid_frag, ISAKMP_NPTYPE_VID);
 	}
 #endif
@@ -1111,10 +1056,8 @@
 #endif
 
 	/* send the packet, add to the schedule to resend */
-	iph1->retry_counter = iph1->rmconf->retry_counter;
-	if (isakmp_ph1resend(iph1) == -1) {
+	if (isakmp_ph1send(iph1) == -1)
 		goto end;
-	}
 
 	/* the sending message is added to the received-list. */
 	if (add_recvdpkt(iph1->remote, iph1->local, iph1->sendbuf, msg) == -1) {
@@ -1203,7 +1146,7 @@
 				goto end;
 			break;
 		case ISAKMP_NPTYPE_VID:
-			(void)check_vendorid(pa->ptr);
+			handle_vendorid(iph1, pa->ptr);
 			break;
 		case ISAKMP_NPTYPE_CR:
 			plog(LLV_WARNING, LOCATION, iph1->remote,
@@ -1226,20 +1169,20 @@
 			{
 				vchar_t *natd_received = NULL;
 				int natd_verified;
-				
+
 				if (isakmp_p2ph (&natd_received, pa->ptr) < 0)
 					goto end;
-				
+
 				if (natd_seq == 0)
 					iph1->natt_flags |= NAT_DETECTED;
-				
+
 				natd_verified = natt_compare_addr_hash (iph1,
 					natd_received, natd_seq++);
-				
+
 				plog (LLV_INFO, LOCATION, NULL, "NAT-D payload #%d %s\n",
 					natd_seq - 1,
 					natd_verified ? "verified" : "doesn't match");
-				
+
 				vfree (natd_received);
 				break;
 			}
@@ -1259,7 +1202,7 @@
 #ifdef ENABLE_NATT
 	if (NATT_AVAILABLE(iph1))
 		plog (LLV_INFO, LOCATION, NULL, "NAT %s %s%s\n",
-		      iph1->natt_flags & NAT_DETECTED ? 
+		      iph1->natt_flags & NAT_DETECTED ?
 		      		"detected:" : "not detected",
 		      iph1->natt_flags & NAT_DETECTED_ME ? "ME " : "",
 		      iph1->natt_flags & NAT_DETECTED_PEER ? "PEER" : "");
@@ -1321,12 +1264,12 @@
 		goto end;
 
 	/* generate NONCE value */
-	iph1->nonce = eay_set_random(iph1->rmconf->nonce_size);
+	iph1->nonce = eay_set_random(RMCONF_NONCE_SIZE(iph1->rmconf));
 	if (iph1->nonce == NULL)
 		goto end;
 
 #ifdef HAVE_GSSAPI
-	if (AUTHMETHOD(iph1) == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB)
+	if (iph1->approval->authmethod == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB)
 		gssapi_get_rtoken(iph1, NULL);
 #endif
 
@@ -1340,8 +1283,7 @@
 #endif
 
 	/* send the packet, add to the schedule to resend */
-	iph1->retry_counter = iph1->rmconf->retry_counter;
-	if (isakmp_ph1resend(iph1) == -1)
+	if (isakmp_ph1send(iph1) == -1)
 		goto end;
 
 	/* the sending message is added to the received-list. */
@@ -1429,6 +1371,8 @@
 		case ISAKMP_NPTYPE_ID:
 			if (isakmp_p2ph(&iph1->id_p, pa->ptr) < 0)
 				goto end;
+			if (resolveph1rmconf(iph1) < 0)
+				goto end;
 			break;
 		case ISAKMP_NPTYPE_HASH:
 			iph1->pl_hash = (struct isakmp_pl_hash *)pa->ptr;
@@ -1453,10 +1397,10 @@
 			break;
 #endif
 		case ISAKMP_NPTYPE_VID:
-			(void)check_vendorid(pa->ptr);
+			handle_vendorid(iph1, pa->ptr);
 			break;
 		case ISAKMP_NPTYPE_N:
-			isakmp_check_notify(pa->ptr, iph1);
+			ident_recv_n(iph1, pa->ptr);
 			break;
 		default:
 			/* don't send information, see ident_r1recv() */
@@ -1473,7 +1417,7 @@
     {
 	int ng = 0;
 
-	switch (AUTHMETHOD(iph1)) {
+	switch (iph1->approval->authmethod) {
 	case OAKLEY_ATTR_AUTH_METHOD_PSKEY:
 #ifdef ENABLE_HYBRID
 	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
@@ -1537,8 +1481,7 @@
 				/* msg printed inner oakley_validate_auth() */
 				goto end;
 			}
-			EVT_PUSH(iph1->local, iph1->remote, 
-			    EVTT_PEERPH1AUTH_FAILED, NULL);
+			evt_phase1(iph1, EVT_PHASE1_AUTH_FAILED, NULL);
 			isakmp_info_send_n1(iph1, type, NULL);
 			goto end;
 		}
@@ -1583,13 +1526,10 @@
 
 	if (error) {
 		VPTRINIT(iph1->id_p);
-		oakley_delcert(iph1->cert_p);
-		iph1->cert_p = NULL;
-		oakley_delcert(iph1->crl_p);
-		iph1->crl_p = NULL;
+		VPTRINIT(iph1->cert_p);
+		VPTRINIT(iph1->crl_p);
 		VPTRINIT(iph1->sig_p);
-		oakley_delcert(iph1->cr_p);
-		iph1->cr_p = NULL;
+		VPTRINIT(iph1->cr_p);
 	}
 
 	return error;
@@ -1626,7 +1566,7 @@
 		goto end;
 
 #ifdef HAVE_GSSAPI
-	if (AUTHMETHOD(iph1) == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB &&
+	if (iph1->approval->authmethod == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB &&
 	    gssapi_more_tokens(iph1)) {
 		gssapi_get_rtoken(iph1, &len);
 		if (len != 0)
@@ -1694,8 +1634,6 @@
 {
 	vchar_t *buf = 0;
 	struct payload_list *plist = NULL;
-	int need_cr = 0;
-	vchar_t *cr = NULL;
 	vchar_t *vid = NULL;
 	int error = -1;
 #ifdef HAVE_GSSAPI
@@ -1705,23 +1643,14 @@
 	vchar_t *natd[2] = { NULL, NULL };
 #endif
 
-	/* create CR if need */
-	if (iph1->side == RESPONDER
-	 && iph1->rmconf->send_cr
-	 && oakley_needcr(iph1->approval->authmethod)
-	 && iph1->rmconf->peerscertfile == NULL) {
-		need_cr = 1;
-		cr = oakley_getcr(iph1);
-		if (cr == NULL) {
+#ifdef HAVE_GSSAPI
+	if (iph1->approval->authmethod == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB) {
+		if (gssapi_get_token_to_send(iph1, &gsstoken) < 0) {
 			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to get cr buffer.\n");
+			     "Failed to get gssapi token.\n");
 			goto end;
 		}
 	}
-
-#ifdef HAVE_GSSAPI
-	if (AUTHMETHOD(iph1) == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB)
-		gssapi_get_token_to_send(iph1, &gsstoken);
 #endif
 
 	/* create isakmp KE payload */
@@ -1731,7 +1660,7 @@
 	plist = isakmp_plist_append(plist, iph1->nonce, ISAKMP_NPTYPE_NONCE);
 
 #ifdef HAVE_GSSAPI
-	if (AUTHMETHOD(iph1) == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB)
+	if (iph1->approval->authmethod == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB)
 		plist = isakmp_plist_append(plist, gsstoken, ISAKMP_NPTYPE_GSS);
 #endif
 
@@ -1739,9 +1668,10 @@
 	if (vid)
 		plist = isakmp_plist_append(plist, vid, ISAKMP_NPTYPE_VID);
 
-	/* create isakmp CR payload if needed */
-	if (need_cr)
-		plist = isakmp_plist_append(plist, cr, ISAKMP_NPTYPE_CR);
+	/* create CR if need */
+	if (iph1->side == RESPONDER &&
+	    oakley_needcr(iph1->approval->authmethod))
+		plist = oakley_append_cr(plist, iph1);
 
 #ifdef ENABLE_NATT
 	/* generate and append NAT-D payloads */
@@ -1764,9 +1694,9 @@
 		plist = isakmp_plist_append(plist, natd[1], iph1->natt_options->payload_nat_d);
 	}
 #endif
-	
+
 	buf = isakmp_plist_set_all (&plist, iph1);
-	
+
 	error = 0;
 
 end:
@@ -1774,8 +1704,6 @@
 		vfree(buf);
 		buf = NULL;
 	}
-	if (cr)
-		vfree(cr);
 #ifdef HAVE_GSSAPI
 	if (gsstoken)
 		vfree(gsstoken);
@@ -1814,9 +1742,7 @@
 {
 	struct payload_list *plist = NULL;
 	vchar_t *buf = NULL, *new = NULL;
-	int need_cr = 0;
 	int need_cert = 0;
-	vchar_t *cr = NULL;
 	int error = -1;
 #ifdef HAVE_GSSAPI
 	int nptype;
@@ -1824,10 +1750,10 @@
 	vchar_t *gsshash = NULL;
 #endif
 
-	switch (AUTHMETHOD(iph1)) {
+	switch (iph1->approval->authmethod) {
 	case OAKLEY_ATTR_AUTH_METHOD_PSKEY:
 #ifdef ENABLE_HYBRID
-	case FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I:
+	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I:
 	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
 	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
 	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
@@ -1847,27 +1773,13 @@
 	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R:
 	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I:
 	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R:
-#endif 
+#endif
 		if (oakley_getmycert(iph1) < 0)
 			goto end;
 
 		if (oakley_getsign(iph1) < 0)
 			goto end;
 
-		/* create CR if need */
-		if (iph1->side == INITIATOR
-		 && iph1->rmconf->send_cr
-	 	 && oakley_needcr(iph1->approval->authmethod)
-		 && iph1->rmconf->peerscertfile == NULL) {
-			need_cr = 1;
-			cr = oakley_getcr(iph1);
-			if (cr == NULL) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"failed to get cr buffer.\n");
-				goto end;
-			}
-		}
-
 		if (iph1->cert != NULL && iph1->rmconf->send_cert)
 			need_cert = 1;
 
@@ -1876,13 +1788,15 @@
 
 		/* add CERT payload if there */
 		if (need_cert)
-			plist = isakmp_plist_append(plist, iph1->cert->pl, ISAKMP_NPTYPE_CERT);
+			plist = isakmp_plist_append(plist, iph1->cert,
+						    ISAKMP_NPTYPE_CERT);
 		/* add SIG payload */
 		plist = isakmp_plist_append(plist, iph1->sig, ISAKMP_NPTYPE_SIG);
 
 		/* create isakmp CR payload */
-		if (need_cr)
-			plist = isakmp_plist_append(plist, cr, ISAKMP_NPTYPE_CR);
+		if (iph1->side == INITIATOR &&
+		    oakley_needcr(iph1->approval->authmethod))
+			plist = oakley_append_cr(plist, iph1);
 		break;
 #ifdef HAVE_GSSAPI
 	case OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB:
@@ -1891,7 +1805,11 @@
 			if (gsshash == NULL)
 				goto end;
 		} else {
-			gssapi_get_token_to_send(iph1, &gsstoken);
+			if (gssapi_get_token_to_send(iph1, &gsstoken) < 0) {
+				plog(LLV_ERROR, LOCATION, NULL,
+					"Failed to get gssapi token.\n");
+				goto end;
+			}
 		}
 
 		if (!gssapi_id_sent(iph1)) {
@@ -1927,7 +1845,7 @@
 	}
 
 	buf = isakmp_plist_set_all (&plist, iph1);
-	
+
 #ifdef HAVE_PRINT_ISAKMP_C
 	isakmp_printpacket(buf, iph1->local, iph1->remote, 1);
 #endif
@@ -1948,8 +1866,6 @@
 	if (gsstoken)
 		vfree(gsstoken);
 #endif
-	if (cr)
-		vfree(cr);
 	if (error && buf != NULL) {
 		vfree(buf);
 		buf = NULL;
@@ -1957,3 +1873,28 @@
 
 	return buf;
 }
+
+/*
+ * handle a notification payload inside identity exchange.
+ * called only when the packet has been verified to be encrypted.
+ */
+static int
+ident_recv_n(iph1, gen)
+	struct ph1handle *iph1;
+	struct isakmp_gen *gen;
+{
+	struct isakmp_pl_n *notify = (struct isakmp_pl_n *) gen;
+	u_int type;
+
+	type = ntohs(notify->type);
+	switch (type) {
+	case ISAKMP_NTYPE_INITIAL_CONTACT:
+		iph1->initial_contact_received = TRUE;
+		break;
+	default:
+		isakmp_log_notify(iph1, notify, "identity exchange");
+		break;
+	}
+	return 0;
+}
+
diff --git a/src/racoon/isakmp_inf.c b/src/racoon/isakmp_inf.c
index 5f487d2..9bf81c6 100644
--- a/src/racoon/isakmp_inf.c
+++ b/src/racoon/isakmp_inf.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: isakmp_inf.c,v 1.14.4.17 2009/05/18 17:07:46 tteras Exp $	*/
+/*	$NetBSD: isakmp_inf.c,v 1.47 2011/03/15 13:20:14 vanhu Exp $	*/
 
 /* Id: isakmp_inf.c,v 1.44 2006/05/06 20:45:52 manubsd Exp */
 
@@ -107,11 +107,10 @@
 	struct isakmp_pl_ru *, u_int32_t));
 static int isakmp_info_recv_r_u_ack __P((struct ph1handle *,
 	struct isakmp_pl_ru *, u_int32_t));
-static void isakmp_info_send_r_u __P((void *));
+static void isakmp_info_send_r_u __P((struct sched *));
 #endif
 
 static void purge_isakmp_spi __P((int, isakmp_index *, size_t));
-static void info_recv_initialcontact __P((struct ph1handle *));
 
 /* %%%
  * Information Exchange
@@ -168,7 +167,8 @@
 	if (msg->l < sizeof(*isakmp) + sizeof(*gen)) {
 		plog(LLV_ERROR, LOCATION, NULL, 
 			"ignore information because the "
-			"message is way too short - %zu byte(s).\n", msg->l);
+			"message is way too short - %zu byte(s).\n",
+			msg->l);
 		goto end;
 	}
 
@@ -179,14 +179,15 @@
 	if (encrypted) {
 		if (isakmp->np != ISAKMP_NPTYPE_HASH) {
 			plog(LLV_ERROR, LOCATION, NULL,
-			    "ignore information because the"
+			    "ignore information because the "
 			    "message has no hash payload.\n");
 			goto end;
 		}
 
-		if (iph1->status != PHASE1ST_ESTABLISHED) {
+		if (iph1->status != PHASE1ST_ESTABLISHED &&
+		    iph1->status != PHASE1ST_DYING) {
 			plog(LLV_ERROR, LOCATION, NULL,
-			    "ignore information because ISAKMP-SA"
+			    "ignore information because ISAKMP-SA "
 			    "has not been established yet.\n");
 			goto end;
 		}
@@ -195,7 +196,8 @@
 		if (msg->l < sizeof(*isakmp) + ntohs(gen->len) + sizeof(*nd)) {
 			plog(LLV_ERROR, LOCATION, NULL, 
 				"ignore information because the "
-				"message is too short - %zu byte(s).\n", msg->l);
+				"message is too short - %zu byte(s).\n",
+				msg->l);
 			goto end;
 		}
 
@@ -323,6 +325,65 @@
 	return error;
 }
 
+
+/*
+ * log unhandled / unallowed Notification payload
+ */
+int
+isakmp_log_notify(iph1, notify, exchange)
+	struct ph1handle *iph1;
+	struct isakmp_pl_n *notify;
+	const char *exchange;
+{
+	u_int type;
+	char *nraw, *ndata, *nhex;
+	size_t l;
+
+	type = ntohs(notify->type);
+	if (ntohs(notify->h.len) < sizeof(*notify) + notify->spi_size) {
+		plog(LLV_ERROR, LOCATION, iph1->remote,
+			"invalid spi_size in %s notification in %s.\n",
+			s_isakmp_notify_msg(type), exchange);
+		return -1;
+	}
+
+	plog(LLV_ERROR, LOCATION, iph1->remote,
+		"notification %s received in %s.\n",
+		s_isakmp_notify_msg(type), exchange);
+
+	nraw = ((char*) notify) + sizeof(*notify) + notify->spi_size;
+	l = ntohs(notify->h.len) - sizeof(*notify) - notify->spi_size;
+	if (l > 0) {
+		if (type >= ISAKMP_NTYPE_MINERROR &&
+		    type <= ISAKMP_NTYPE_MAXERROR) {
+			ndata = binsanitize(nraw, l);
+			if (ndata != NULL) {
+				plog(LLV_ERROR, LOCATION, iph1->remote,
+					"error message: '%s'.\n",
+					ndata);
+				racoon_free(ndata);
+			} else {
+				plog(LLV_ERROR, LOCATION, iph1->remote,
+					"Cannot allocate memory\n");
+			}
+		} else {
+			nhex = val2str(nraw, l);
+			if (nhex != NULL) {
+				plog(LLV_ERROR, LOCATION, iph1->remote,
+					"notification payload: %s.\n",
+					nhex);
+				racoon_free(nhex);
+			} else {
+				plog(LLV_ERROR, LOCATION, iph1->remote,
+					"Cannot allocate memory\n");
+			}
+		}
+	}
+
+	return 0;
+}
+
+
 /*
  * handling of Notification payload
  */
@@ -334,13 +395,8 @@
 	int encrypted;
 {
 	u_int type;
-	vchar_t *pbuf;
-	char *nraw, *ndata;
-	size_t l;
-	char *spi;
 
 	type = ntohs(notify->type);
-
 	switch (type) {
 	case ISAKMP_NTYPE_CONNECTED:
 	case ISAKMP_NTYPE_RESPONDER_LIFETIME:
@@ -352,8 +408,7 @@
 		break;
 	case ISAKMP_NTYPE_INITIAL_CONTACT:
 		if (encrypted)
-			info_recv_initialcontact(iph1);
-			return 0;
+			return isakmp_info_recv_initialcontact(iph1, NULL);
 		break;
 #ifdef ENABLE_DPD
 	case ISAKMP_NTYPE_R_U_THERE:
@@ -367,76 +422,23 @@
 				(struct isakmp_pl_ru *)notify, msgid);
 		break;
 #endif
-	default:
-	    {
-		/* XXX there is a potential of dos attack. */
-		if(type >= ISAKMP_NTYPE_MINERROR &&
-		   type <= ISAKMP_NTYPE_MAXERROR) {
-			if (msgid == 0) {
-				/* don't think this realy deletes ph1 ? */
-				plog(LLV_ERROR, LOCATION, iph1->remote,
-					"delete phase1 handle.\n");
-				return -1;
-			} else {
-				if (getph2bymsgid(iph1, msgid) == NULL) {
-					plog(LLV_ERROR, LOCATION, iph1->remote,
-						"fatal %s notify messsage, "
-						"phase1 should be deleted.\n",
-						s_isakmp_notify_msg(type));
-				} else {
-					plog(LLV_ERROR, LOCATION, iph1->remote,
-						"fatal %s notify messsage, "
-						"phase2 should be deleted.\n",
-						s_isakmp_notify_msg(type));
-				}
-			}
-		} else {
-			plog(LLV_ERROR, LOCATION, iph1->remote,
-				"unhandled notify message %s, "
-				"no phase2 handle found.\n",
-				s_isakmp_notify_msg(type));
-		}
-	    }
-	    break;
 	}
 
-	/* get spi if specified and allocate */
-	if(notify->spi_size > 0) {
-		if (ntohs(notify->h.len) < sizeof(*notify) + notify->spi_size) {
-			plog(LLV_ERROR, LOCATION, iph1->remote,
-				"invalid spi_size in notification payload.\n");
-			return -1;
-		}
-		spi = val2str((char *)(notify + 1), notify->spi_size);
+	/* If we receive a error notification we should delete the related
+	 * phase1 / phase2 handle, and send an event to racoonctl.
+	 * However, since phase1 error notifications are not encrypted and
+	 * can not be authenticated, it would allow a DoS attack possibility
+	 * to handle them.
+	 * Phase2 error notifications should be encrypted, so we could handle
+	 * those, but it needs implementing (the old code didn't implement
+	 * that either).
+	 * So we are good to just log the messages here.
+	 */
+	if (encrypted)
+		isakmp_log_notify(iph1, notify, "informational exchange");
+	else
+		isakmp_log_notify(iph1, notify, "unencrypted informational exchange");
 
-		plog(LLV_DEBUG, LOCATION, iph1->remote,
-			"notification message %d:%s, "
-			"doi=%d proto_id=%d spi=%s(size=%d).\n",
-			type, s_isakmp_notify_msg(type),
-			ntohl(notify->doi), notify->proto_id, spi, notify->spi_size);
-
-		racoon_free(spi);
-	}
-
-	/* Send the message data to the logs */
-	if(type >= ISAKMP_NTYPE_MINERROR &&
-	   type <= ISAKMP_NTYPE_MAXERROR) {
-		l = ntohs(notify->h.len) - sizeof(*notify) - notify->spi_size;
-		if (l > 0) {
-			nraw = (char*)notify;	
-			nraw += sizeof(*notify) + notify->spi_size;
-			ndata = binsanitize(nraw, l);
-			if (ndata != NULL) {
-				plog(LLV_ERROR, LOCATION, iph1->remote,
-				    "Message: '%s'.\n", 
-				    ndata);
-				racoon_free(ndata);
-			} else {
-				plog(LLV_ERROR, LOCATION, iph1->remote,
-				    "Cannot allocate memory\n");
-			}
-		}
-	}
 	return 0;
 }
 
@@ -510,16 +512,16 @@
 		del_ph1=getph1byindex((isakmp_index *)(delete + 1));
 		if(del_ph1 != NULL){
 
-			EVT_PUSH(del_ph1->local, del_ph1->remote,
-			EVTT_PEERPH1_NOPROP, NULL);
-			if (del_ph1->scr)
-				SCHED_KILL(del_ph1->scr);
+			evt_phase1(iph1, EVT_PHASE1_PEER_DELETED, NULL);
+			sched_cancel(&del_ph1->scr);
 
 			/*
-			 * Do not delete IPsec SAs when receiving an IKE delete notification.
-			 * Just delete the IKE SA.
+			 * Delete also IPsec-SAs if rekeying is enabled.
 			 */
-			isakmp_ph1expire(del_ph1);
+			if (ph1_rekey_enabled(del_ph1))
+				purge_remote(del_ph1);
+			else
+				isakmp_ph1expire(del_ph1);
 		}
 		break;
 
@@ -532,8 +534,6 @@
 				delete->spi_size, delete->proto_id);
 			return 0;
 		}
-		EVT_PUSH(iph1->local, iph1->remote, 
-		    EVTT_PEER_DELETE, NULL);
 		purge_ipsec_spi(iph1->remote, delete->proto_id,
 		    (u_int32_t *)(delete + 1), num_spi);
 		break;
@@ -636,7 +636,7 @@
 	 * don't send delete information if there is no phase 1 handler.
 	 * It's nonsensical to negotiate phase 1 to send the information.
 	 */
-	iph1 = getph1byaddr(iph2->src, iph2->dst, 0);
+	iph1 = getph1byaddr(iph2->src, iph2->dst, 0); 
 	if (iph1 == NULL){
 		plog(LLV_DEBUG2, LOCATION, NULL,
 			 "No ph1 handler found, could not send DELETE_SA\n");
@@ -696,21 +696,12 @@
 	vchar_t *data;
 {
 	struct ph1handle *iph1 = NULL;
-	struct remoteconf *rmconf;
 	vchar_t *payload = NULL;
 	int tlen;
 	int error = -1;
 	struct isakmp_pl_n *n;
 	int spisiz = 0;		/* see below */
 
-	/* search appropreate configuration */
-	rmconf = getrmconf(remote);
-	if (rmconf == NULL) {
-		plog(LLV_ERROR, LOCATION, remote,
-			"no configuration found for peer address.\n");
-		goto end;
-	}
-
 	/* add new entry to isakmp status table. */
 	iph1 = newph1();
 	if (iph1 == NULL)
@@ -719,7 +710,6 @@
 	memcpy(&iph1->index.i_ck, &isakmp->i_ck, sizeof(cookie_t));
 	isakmp_newcookie((char *)&iph1->index.r_ck, remote, local);
 	iph1->status = PHASE1ST_START;
-	iph1->rmconf = rmconf;
 	iph1->side = INITIATOR;
 	iph1->version = isakmp->v;
 	iph1->flags = 0;
@@ -734,7 +724,7 @@
 #endif
 
 	/* copy remote address */
-	if (copy_ph1addresses(iph1, rmconf, remote, local) < 0)
+	if (copy_ph1addresses(iph1, NULL, remote, local) < 0)
 		goto end;
 
 	tlen = sizeof(*n) + spisiz;
@@ -911,16 +901,6 @@
 		delph2(iph2);
 		goto end;
 	}
-#if (!defined(ENABLE_NATT)) || (defined(BROKEN_NATT))
-	if (set_port(iph2->dst, 0) == NULL ||
-	    set_port(iph2->src, 0) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		     "invalid family: %d\n", iph1->remote->sa_family);
-		delph2(iph2);
-		goto end;
-	}
-#endif
-	iph2->ph1 = iph1;
 	iph2->side = INITIATOR;
 	iph2->status = PHASE2ST_START;
 	iph2->msgid = isakmp_newmsgid2(iph1);
@@ -934,7 +914,7 @@
 		}
 
 		/* generate HASH(1) */
-		hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, payload);
+		hash = oakley_compute_hash1(iph1, iph2->msgid, payload);
 		if (hash == NULL) {
 			delph2(iph2);
 			goto end;
@@ -1035,7 +1015,6 @@
 	return error;
 
 err:
-	unbindph12(iph2);
 	remph2(iph2);
 	delph2(iph2);
 	goto end;
@@ -1114,9 +1093,8 @@
 			s_ipsecdoi_proto(proto),
 			isakmp_pindex(&spi[i], 0));
 
-		SCHED_KILL(iph1->sce);
 		iph1->status = PHASE1ST_EXPIRED;
-		iph1->sce = sched_new(1, isakmp_ph1delete_stub, iph1);
+		isakmp_ph1delete(iph1);
 	}
 }
 
@@ -1138,10 +1116,6 @@
 	u_int64_t created;
 	size_t i;
 	caddr_t mhp[SADB_EXT_MAX + 1];
-#ifdef ENABLE_NATT
-	struct sadb_x_nat_t_type *natt_type;
-	struct sadb_x_nat_t_port *natt_port;
-#endif
 
 	plog(LLV_DEBUG2, LOCATION, NULL,
 		 "purge_ipsec_spi:\n");
@@ -1181,6 +1155,7 @@
 			msg = next;
 			continue;
 		}
+		pk_fixup_sa_addresses(mhp);
 		src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]);
 		dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]);
 		lt = (struct sadb_lifetime*)mhp[SADB_EXT_LIFETIME_HARD];
@@ -1194,25 +1169,7 @@
 			msg = next;
 			continue;
 		}
-#ifdef ENABLE_NATT
-		natt_type = (void *)mhp[SADB_X_EXT_NAT_T_TYPE];
-		if (natt_type && natt_type->sadb_x_nat_t_type_type) {
-			/* NAT-T is enabled for this SADB entry; copy
-			 * the ports from NAT-T extensions */
-			natt_port = (void *)mhp[SADB_X_EXT_NAT_T_SPORT];
-			if (extract_port(src) == 0 && natt_port != NULL)
-				set_port(src, ntohs(natt_port->sadb_x_nat_t_port_port));
 
-			natt_port = (void *)mhp[SADB_X_EXT_NAT_T_DPORT];
-			if (extract_port(dst) == 0 && natt_port != NULL)
-				set_port(dst, ntohs(natt_port->sadb_x_nat_t_port_port));
-		}else{
-			/* Force default UDP ports, so CMPSADDR will match SAs with NO encapsulation
-			 */
-			set_port(src, PORT_ISAKMP);
-			set_port(dst, PORT_ISAKMP);
-		}
-#endif
 		plog(LLV_DEBUG2, LOCATION, NULL, "src: %s\n", saddr2str(src));
 		plog(LLV_DEBUG2, LOCATION, NULL, "dst: %s\n", saddr2str(dst));
 
@@ -1220,20 +1177,11 @@
 
 		/* don't delete inbound SAs at the moment */
 		/* XXX should we remove SAs with opposite direction as well? */
-		if (CMPSADDR(dst0, dst)) {
+		if (cmpsaddr(dst0, dst) != CMPSADDR_MATCH) {
 			msg = next;
 			continue;
 		}
 
-#ifdef ENABLE_NATT
-		if (natt_type == NULL ||
-			! natt_type->sadb_x_nat_t_type_type) {
-			/* Set back port to 0 if it was forced to default UDP port
-			 */
-			set_port(src, 0);
-			set_port(dst, 0);
-		}
-#endif
 		for (i = 0; i < n; i++) {
 			plog(LLV_DEBUG, LOCATION, NULL,
 				"check spi(packet)=%u spi(db)=%u.\n",
@@ -1254,7 +1202,6 @@
 			iph2 = getph2bysaidx(src, dst, proto, spi[i]);
 			if(iph2 != NULL){
 				delete_spd(iph2, created);
-				unbindph12(iph2);
 				remph2(iph2);
 				delph2(iph2);
 			}
@@ -1273,15 +1220,17 @@
 }
 
 /*
- * delete all phase2 sa relatived to the destination address.
+ * delete all phase2 sa relatived to the destination address
+ * (except the phase2 within which the INITIAL-CONTACT was received).
  * Don't delete Phase 1 handlers on INITIAL-CONTACT, and don't ignore
  * an INITIAL-CONTACT if we have contacted the peer.  This matches the
  * Sun IKE behavior, and makes rekeying work much better when the peer
  * restarts.
  */
-static void
-info_recv_initialcontact(iph1)
+int
+isakmp_info_recv_initialcontact(iph1, protectedph2)
 	struct ph1handle *iph1;
+	struct ph2handle *protectedph2;
 {
 	vchar_t *buf = NULL;
 	struct sadb_msg *msg, *next, *end;
@@ -1294,8 +1243,10 @@
 	char *loc, *rem;
 #endif
 
+	plog(LLV_INFO, LOCATION, iph1->remote, "received INITIAL-CONTACT\n");
+
 	if (f_local)
-		return;
+		return 0;
 
 #if 0
 	loc = racoon_strdup(saddrwop2str(iph1->local));
@@ -1344,7 +1295,7 @@
 
 	racoon_free(loc);
 	racoon_free(rem);
-	return;
+	return 0;
 
  the_hard_way:
 	racoon_free(loc);
@@ -1355,43 +1306,39 @@
 	if (buf == NULL) {
 		plog(LLV_DEBUG, LOCATION, NULL,
 			"pfkey_dump_sadb returned nothing.\n");
-		return;
+		return 0;
 	}
 
 	msg = (struct sadb_msg *)buf->v;
 	end = (struct sadb_msg *)(buf->v + buf->l);
 
-	while (msg < end) {
+	for (; msg < end; msg = next) {
 		if ((msg->sadb_msg_len << 3) < sizeof(*msg))
 			break;
+
 		next = (struct sadb_msg *)((caddr_t)msg + (msg->sadb_msg_len << 3));
-		if (msg->sadb_msg_type != SADB_DUMP) {
-			msg = next;
+		if (msg->sadb_msg_type != SADB_DUMP)
 			continue;
-		}
 
 		if (pfkey_align(msg, mhp) || pfkey_check(mhp)) {
 			plog(LLV_ERROR, LOCATION, NULL,
 				"pfkey_check (%s)\n", ipsec_strerror());
-			msg = next;
 			continue;
 		}
 
 		if (mhp[SADB_EXT_SA] == NULL
 		 || mhp[SADB_EXT_ADDRESS_SRC] == NULL
-		 || mhp[SADB_EXT_ADDRESS_DST] == NULL) {
-			msg = next;
+		 || mhp[SADB_EXT_ADDRESS_DST] == NULL)
 			continue;
-		}
+
 		sa = (struct sadb_sa *)mhp[SADB_EXT_SA];
+		pk_fixup_sa_addresses(mhp);
 		src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]);
 		dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]);
 
 		if (sa->sadb_sa_state != SADB_SASTATE_MATURE
-		 && sa->sadb_sa_state != SADB_SASTATE_DYING) {
-			msg = next;
+		 && sa->sadb_sa_state != SADB_SASTATE_DYING)
 			continue;
-		}
 
 		/*
 		 * RFC2407 4.6.3.3 INITIAL-CONTACT is the message that
@@ -1401,39 +1348,18 @@
 		 * racoon only deletes SA which is matched both the
 		 * source address and the destination accress.
 		 */
-#ifdef ENABLE_NATT
-		/* 
-		 * XXX RFC 3947 says that whe MUST NOT use IP+port to find old SAs
-		 * from this peer !
-		 */
-		if(iph1->natt_flags & NAT_DETECTED){
-			if (CMPSADDR(iph1->local, src) == 0 &&
-				CMPSADDR(iph1->remote, dst) == 0)
-				;
-			else if (CMPSADDR(iph1->remote, src) == 0 &&
-					 CMPSADDR(iph1->local, dst) == 0)
-				;
-			else {
-				msg = next;
-				continue;
-			}
-		} else
-#endif
-		/* If there is no NAT-T, we don't have to check addr + port...
-		 * XXX what about a configuration with a remote peers which is not
-		 * NATed, but which NATs some other peers ?
-		 * Here, the INITIAl-CONTACT would also flush all those NATed peers !!
-		 */
-		if (cmpsaddrwop(iph1->local, src) == 0 &&
-		    cmpsaddrwop(iph1->remote, dst) == 0)
-			;
-		else if (cmpsaddrwop(iph1->remote, src) == 0 &&
-		    cmpsaddrwop(iph1->local, dst) == 0)
-			;
-		else {
-			msg = next;
+
+		/*
+		 * Check that the IP and port match. But this is not optimal,
+		 * since NAT-T can make the peer have multiple different
+		 * ports. Correct thing to do is delete all entries with
+                 * same identity. -TT
+                 */
+		if ((cmpsaddr(iph1->local, src) != CMPSADDR_MATCH ||
+		     cmpsaddr(iph1->remote, dst) != CMPSADDR_MATCH) &&
+		    (cmpsaddr(iph1->local, dst) != CMPSADDR_MATCH ||
+		     cmpsaddr(iph1->remote, src) != CMPSADDR_MATCH))
 			continue;
-		}
 
 		/*
 		 * Make sure this is an SATYPE that we manage.
@@ -1445,10 +1371,8 @@
 			    msg->sadb_msg_satype)
 				break;
 		}
-		if (i == pfkey_nsatypes) {
-			msg = next;
+		if (i == pfkey_nsatypes)
 			continue;
-		}
 
 		plog(LLV_INFO, LOCATION, NULL,
 			"purging spi=%u.\n", ntohl(sa->sadb_sa_spi));
@@ -1463,54 +1387,15 @@
 		 */
 		proto_id = pfkey2ipsecdoi_proto(msg->sadb_msg_satype);
 		iph2 = getph2bysaidx(src, dst, proto_id, sa->sadb_sa_spi);
-		if (iph2) {
+		if (iph2 && iph2 != protectedph2) {
 			delete_spd(iph2, 0);
-			unbindph12(iph2);
 			remph2(iph2);
 			delph2(iph2);
 		}
-
-		msg = next;
 	}
 
 	vfree(buf);
-}
-
-void
-isakmp_check_notify(gen, iph1)
-	struct isakmp_gen *gen;		/* points to Notify payload */
-	struct ph1handle *iph1;
-{
-	struct isakmp_pl_n *notify = (struct isakmp_pl_n *)gen;
-
-	plog(LLV_DEBUG, LOCATION, iph1->remote,
-		"Notify Message received\n");
-
-	switch (ntohs(notify->type)) {
-	case ISAKMP_NTYPE_CONNECTED:
-	case ISAKMP_NTYPE_RESPONDER_LIFETIME:
-	case ISAKMP_NTYPE_REPLAY_STATUS:
-	case ISAKMP_NTYPE_HEARTBEAT:
-#ifdef ENABLE_HYBRID
-	case ISAKMP_NTYPE_UNITY_HEARTBEAT:
-#endif
-		plog(LLV_WARNING, LOCATION, iph1->remote,
-			"ignore %s notification.\n",
-			s_isakmp_notify_msg(ntohs(notify->type)));
-		break;
-	case ISAKMP_NTYPE_INITIAL_CONTACT:
-		plog(LLV_WARNING, LOCATION, iph1->remote,
-			"ignore INITIAL-CONTACT notification, "
-			"because it is only accepted after phase1.\n");
-		break;
-	default:
-		isakmp_info_send_n1(iph1, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE, NULL);
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"received unknown notification type %s.\n",
-			s_isakmp_notify_msg(ntohs(notify->type)));
-	}
-
-	return;
+	return 0;
 }
 
 
@@ -1567,17 +1452,16 @@
 	struct isakmp_pl_ru *ru;
 	u_int32_t msgid;
 {
+	u_int32_t seq;
 
 	plog(LLV_DEBUG, LOCATION, iph1->remote,
 		 "DPD R-U-There-Ack received\n");
 
-	/* XXX Maintain window of acceptable sequence numbers ?
-	 * => ru->data <= iph2->dpd_seq &&
-	 *    ru->data >= iph2->dpd_seq - iph2->dpd_fails ? */
-	if (ntohl(ru->data) != iph1->dpd_seq-1) {
+	seq = ntohl(ru->data);
+	if (seq <= iph1->dpd_last_ack || seq > iph1->dpd_seq) {
 		plog(LLV_ERROR, LOCATION, iph1->remote,
-			 "Wrong DPD sequence number (%d, %d expected).\n", 
-			 ntohl(ru->data), iph1->dpd_seq-1);
+			 "Wrong DPD sequence number (%d; last_ack=%d, seq=%d).\n", 
+			 seq, iph1->dpd_last_ack, iph1->dpd_seq);
 		return 0;
 	}
 
@@ -1589,12 +1473,8 @@
 	}
 
 	iph1->dpd_fails = 0;
-
-	/* Useless ??? */
-	iph1->dpd_lastack = time(NULL);
-
-	SCHED_KILL(iph1->dpd_r_u);
-
+	iph1->dpd_last_ack = seq;
+	sched_cancel(&iph1->dpd_r_u);
 	isakmp_sched_r_u(iph1, 0);
 
 	plog(LLV_DEBUG, LOCATION, NULL, "received an R-U-THERE-ACK\n");
@@ -1609,10 +1489,10 @@
  * send DPD R-U-THERE payload in Informational exchange.
  */
 static void
-isakmp_info_send_r_u(arg)
-	void *arg;
+isakmp_info_send_r_u(sc)
+	struct sched *sc;
 {
-	struct ph1handle *iph1 = arg;
+	struct ph1handle *iph1 = container_of(sc, struct ph1handle, dpd_r_u);
 
 	/* create R-U-THERE payload */
 	struct isakmp_pl_ru *ru;
@@ -1622,7 +1502,14 @@
 
 	plog(LLV_DEBUG, LOCATION, iph1->remote, "DPD monitoring....\n");
 
-	iph1->dpd_r_u=NULL;
+	if (iph1->status == PHASE1ST_EXPIRED) {
+		/* This can happen after removing tunnels from the
+		 * config file and then reloading.
+		 * Such iph1 have rmconf=NULL, so return before the if
+		 * block below.
+		 */
+		return;
+	}
 
 	if (iph1->dpd_fails >= iph1->rmconf->dpd_maxfails) {
 
@@ -1630,7 +1517,8 @@
 			"DPD: remote (ISAKMP-SA spi=%s) seems to be dead.\n",
 			isakmp_pindex(&iph1->index, 0));
 
-		EVT_PUSH(iph1->local, iph1->remote, EVTT_DPD_TIMEOUT, NULL);
+		script_hook(iph1, SCRIPT_PHASE1_DEAD);
+		evt_phase1(iph1, EVT_PHASE1_DPD_TIMEOUT, NULL);
 		purge_remote(iph1);
 
 		/* Do not reschedule here: phase1 is deleted,
@@ -1659,12 +1547,13 @@
 	memcpy(ru->i_ck, iph1->index.i_ck, sizeof(cookie_t));
 	memcpy(ru->r_ck, iph1->index.r_ck, sizeof(cookie_t));
 
-	if (iph1->dpd_seq == 0){
+	if (iph1->dpd_seq == 0) {
 		/* generate a random seq which is not too big */
-		srand(time(NULL));
-		iph1->dpd_seq = rand() & 0x0fff;
+		iph1->dpd_seq = iph1->dpd_last_ack = rand() & 0x0fff;
 	}
 
+	iph1->dpd_seq++;
+	iph1->dpd_fails++;
 	ru->data = htonl(iph1->dpd_seq);
 
 	error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, 0);
@@ -1673,12 +1562,6 @@
 	plog(LLV_DEBUG, LOCATION, iph1->remote,
 		 "DPD R-U-There sent (%d)\n", error);
 
-	/* will be decreased if ACK received... */
-	iph1->dpd_fails++;
-
-	/* XXX should be increased only when ACKed ? */
-	iph1->dpd_seq++;
-
 	/* Reschedule the r_u_there with a short delay,
 	 * will be deleted/rescheduled if ACK received before */
 	isakmp_sched_r_u(iph1, 1);
@@ -1703,11 +1586,11 @@
 		return 0;
 
 	if(retry)
-		iph1->dpd_r_u = sched_new(iph1->rmconf->dpd_retry,
-								  isakmp_info_send_r_u, iph1);
+		sched_schedule(&iph1->dpd_r_u, iph1->rmconf->dpd_retry,
+			       isakmp_info_send_r_u);
 	else
-		iph1->dpd_r_u = sched_new(iph1->rmconf->dpd_interval,
-								  isakmp_info_send_r_u, iph1);
+		sched_schedule(&iph1->dpd_r_u, iph1->rmconf->dpd_interval,
+			       isakmp_info_send_r_u);
 
 	return 0;
 }
diff --git a/src/racoon/isakmp_inf.h b/src/racoon/isakmp_inf.h
index c7682d9..40cdc02 100644
--- a/src/racoon/isakmp_inf.h
+++ b/src/racoon/isakmp_inf.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: isakmp_inf.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
+/*	$NetBSD: isakmp_inf.h,v 1.5 2008/07/14 05:40:13 tteras Exp $	*/
 
 /* Id: isakmp_inf.h,v 1.6 2005/05/07 14:15:59 manubsd Exp */
 
@@ -48,7 +48,8 @@
 extern vchar_t * isakmp_add_pl_n __P((vchar_t *, u_int8_t **, int,
 	struct saproto *, vchar_t *));
 
-extern void isakmp_check_notify __P((struct isakmp_gen *, struct ph1handle *));
+extern int isakmp_log_notify __P((struct ph1handle *, struct isakmp_pl_n *, const char *exchange));
+extern int isakmp_info_recv_initialcontact __P((struct ph1handle *, struct ph2handle *));
 
 #ifdef ENABLE_DPD
 extern int isakmp_sched_r_u __P((struct ph1handle *, int));
diff --git a/src/racoon/isakmp_quick.c b/src/racoon/isakmp_quick.c
index 963438d..056e905 100644
--- a/src/racoon/isakmp_quick.c
+++ b/src/racoon/isakmp_quick.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: isakmp_quick.c,v 1.11.4.1 2007/08/01 11:52:21 vanhu Exp $	*/
+/*	$NetBSD: isakmp_quick.c,v 1.29 2011/03/14 17:18:13 tteras Exp $	*/
 
 /* Id: isakmp_quick.c,v 1.29 2006/08/22 18:17:17 manubsd Exp */
 
@@ -53,9 +53,6 @@
 #  include <time.h>
 # endif
 #endif
-#ifdef ENABLE_HYBRID
-#include <resolv.h>
-#endif
 
 #include PATH_IPSEC_H
 
@@ -87,10 +84,47 @@
 #include "admin.h"
 #include "strnames.h"
 
+#ifdef ENABLE_HYBRID
+#include <resolv.h>
+#include "isakmp_xauth.h"
+#include "isakmp_cfg.h"
+#endif
+
+#ifdef ENABLE_NATT
+#include "nattraversal.h"
+#endif
+
 /* quick mode */
 static vchar_t *quick_ir1mx __P((struct ph2handle *, vchar_t *, vchar_t *));
 static int get_sainfo_r __P((struct ph2handle *));
 static int get_proposal_r __P((struct ph2handle *));
+static int ph2_recv_n __P((struct ph2handle *, struct isakmp_gen *));
+static void quick_timeover_stub __P((struct sched *));
+static void quick_timeover __P((struct ph2handle *));
+
+/* called from scheduler */
+static void
+quick_timeover_stub(p)
+	struct sched *p;
+{
+	quick_timeover(container_of(p, struct ph2handle, sce));
+}
+
+static void
+quick_timeover(iph2)
+	struct ph2handle *iph2;
+{
+	plog(LLV_ERROR, LOCATION, NULL,
+		"%s give up to get IPsec-SA due to time up to wait.\n",
+		saddrwop2str(iph2->dst));
+
+	/* If initiator side, send error to kernel by SADB_ACQUIRE. */
+	if (iph2->side == INITIATOR)
+		pk_sendeacquire(iph2);
+
+	remph2(iph2);
+	delph2(iph2);
+}
 
 /* %%%
  * Quick Mode
@@ -131,8 +165,8 @@
 
 	plog(LLV_DEBUG, LOCATION, NULL, "pfkey getspi sent.\n");
 
-	iph2->sce = sched_new(lcconf->wait_ph2complete,
-		pfkey_timeover_stub, iph2);
+	sched_schedule(&iph2->sce, lcconf->wait_ph2complete,
+		       quick_timeover_stub);
 
 	error = 0;
 
@@ -142,7 +176,7 @@
 
 /*
  * send to responder
- * 	HDR*, HASH(1), SA, Ni [, KE ] [, IDi2, IDr2 ]
+ * 	HDR*, HASH(1), SA, Ni [, KE ] [, IDi2, IDr2 ] [, NAT-OAi, NAT-OAr ]
  */
 int
 quick_i1send(iph2, msg)
@@ -155,9 +189,14 @@
 	char *p;
 	int tlen;
 	int error = ISAKMP_INTERNAL_ERROR;
+	int natoa = ISAKMP_NPTYPE_NONE;
 	int pfsgroup, idci, idcr;
 	int np;
 	struct ipsecdoi_id_b *id, *id_p;
+#ifdef ENABLE_NATT
+	vchar_t *nat_oai = NULL;
+	vchar_t *nat_oar = NULL;
+#endif
 
 	/* validity check */
 	if (msg != NULL) {
@@ -217,17 +256,49 @@
 	 * - no MIP6 or proxy
 	 * - id payload suggests to encrypt all the traffic (no specific
 	 *   protocol type)
+	 * - SA endpoints and IKE addresses for the nego are the same
+	 *   (iph2->src/dst)
 	 */
 	id = (struct ipsecdoi_id_b *)iph2->id->v;
 	id_p = (struct ipsecdoi_id_b *)iph2->id_p->v;
-	if (id->proto_id == 0
-	 && id_p->proto_id == 0
-	 && iph2->ph1->rmconf->support_proxy == 0
-	 && ipsecdoi_transportmode(iph2->proposal)) {
+	if (id->proto_id == 0 &&
+	    id_p->proto_id == 0 &&
+	    iph2->ph1->rmconf->support_proxy == 0 &&
+	    iph2->sa_src == NULL && iph2->sa_dst == NULL &&
+	    ipsecdoi_transportmode(iph2->proposal)) {
 		idci = idcr = 0;
 	} else
 		idci = idcr = 1;
 
+#ifdef ENABLE_NATT
+	/*
+	 * RFC3947 5.2. if we propose UDP-Encapsulated-Transport
+	 * we should send NAT-OA
+	 */
+	if (ipsecdoi_transportmode(iph2->proposal)
+	 && (iph2->ph1->natt_flags & NAT_DETECTED)) {
+		natoa = iph2->ph1->natt_options->payload_nat_oa;
+
+		nat_oai = ipsecdoi_sockaddr2id(iph2->src,
+			IPSECDOI_PREFIX_HOST, IPSEC_ULPROTO_ANY);
+		nat_oar = ipsecdoi_sockaddr2id(iph2->dst,
+			IPSECDOI_PREFIX_HOST, IPSEC_ULPROTO_ANY);
+
+		if (nat_oai == NULL || nat_oar == NULL) {
+			plog(LLV_ERROR, LOCATION, NULL,
+				"failed to generate NAT-OA payload.\n");
+			goto end;
+		}
+
+		plog(LLV_DEBUG, LOCATION, NULL, "NAT-OAi:\n");
+		plogdump(LLV_DEBUG, nat_oai->v, nat_oai->l);
+		plog(LLV_DEBUG, LOCATION, NULL, "NAT-OAr:\n");
+		plogdump(LLV_DEBUG, nat_oar->v, nat_oar->l);
+	} else {
+		natoa = ISAKMP_NPTYPE_NONE;
+	}
+#endif
+
 	/* create SA;NONCE payload, and KE if need, and IDii, IDir. */
 	tlen = + sizeof(*gen) + iph2->sa->l
 		+ sizeof(*gen) + iph2->nonce->l;
@@ -237,6 +308,10 @@
 		tlen += sizeof(*gen) + iph2->id->l;
 	if (idcr)
 		tlen += sizeof(*gen) + iph2->id_p->l;
+#ifdef ENABLE_NATT
+	if (natoa != ISAKMP_NPTYPE_NONE)
+		tlen += 2 * sizeof(*gen) + nat_oai->l + nat_oar->l;
+#endif
 
 	body = vmalloc(tlen);
 	if (body == NULL) {
@@ -256,22 +331,30 @@
 	else if (idci || idcr)
 		np = ISAKMP_NPTYPE_ID;
 	else
-		np = ISAKMP_NPTYPE_NONE;
+		np = natoa;
 	p = set_isakmp_payload(p, iph2->nonce, np);
 
 	/* add KE payload if need. */
-	np = (idci || idcr) ? ISAKMP_NPTYPE_ID : ISAKMP_NPTYPE_NONE;
+	np = (idci || idcr) ? ISAKMP_NPTYPE_ID : natoa;
 	if (pfsgroup)
 		p = set_isakmp_payload(p, iph2->dhpub, np);
 
 	/* IDci */
-	np = (idcr) ? ISAKMP_NPTYPE_ID : ISAKMP_NPTYPE_NONE;
+	np = (idcr) ? ISAKMP_NPTYPE_ID : natoa;
 	if (idci)
 		p = set_isakmp_payload(p, iph2->id, np);
 
 	/* IDcr */
 	if (idcr)
-		p = set_isakmp_payload(p, iph2->id_p, ISAKMP_NPTYPE_NONE);
+		p = set_isakmp_payload(p, iph2->id_p, natoa);
+
+#ifdef ENABLE_NATT
+	/* NAT-OA */
+	if (natoa != ISAKMP_NPTYPE_NONE) {
+		p = set_isakmp_payload(p, nat_oai, natoa);
+		p = set_isakmp_payload(p, nat_oar, ISAKMP_NPTYPE_NONE);
+	}
+#endif
 
 	/* generate HASH(1) */
 	hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, body);
@@ -284,8 +367,7 @@
 		goto end;
 
 	/* send the packet, add to the schedule to resend */
-	iph2->retry_counter = iph2->ph1->rmconf->retry_counter;
-	if (isakmp_ph2resend(iph2) == -1)
+	if (isakmp_ph2send(iph2) == -1)
 		goto end;
 
 	/* change status of isakmp status entry */
@@ -298,13 +380,19 @@
 		vfree(body);
 	if (hash != NULL)
 		vfree(hash);
+#ifdef ENABLE_NATT
+	if (nat_oai != NULL)
+		vfree(nat_oai);
+	if (nat_oar != NULL)
+		vfree(nat_oar);
+#endif
 
 	return error;
 }
 
 /*
  * receive from responder
- * 	HDR*, HASH(2), SA, Nr [, KE ] [, IDi2, IDr2 ]
+ * 	HDR*, HASH(2), SA, Nr [, KE ] [, IDi2, IDr2 ] [, NAT-OAi, NAT-OAr ]
  */
 int
 quick_i2recv(iph2, msg0)
@@ -314,10 +402,11 @@
 	vchar_t *msg = NULL;
 	vchar_t *hbuf = NULL;	/* for hash computing. */
 	vchar_t *pbuf = NULL;	/* for payload parsing */
+	vchar_t *idci = NULL;
+	vchar_t *idcr = NULL;
 	struct isakmp_parse_t *pa;
 	struct isakmp *isakmp = (struct isakmp *)msg0->v;
 	struct isakmp_pl_hash *hash = NULL;
-	int f_id;
 	char *p;
 	int tlen;
 	int error = ISAKMP_INTERNAL_ERROR;
@@ -391,7 +480,6 @@
 	 * copy non-HASH payloads into hbuf, so that we can validate HASH.
 	 */
 	iph2->sa_ret = NULL;
-	f_id = 0;	/* flag to use checking ID */
 	tlen = 0;	/* count payload length except of HASH payload. */
 	for (; pa->type; pa++) {
 
@@ -407,54 +495,84 @@
 					"isn't supported.\n");
 				break;
 			}
-			if (isakmp_p2ph(&iph2->sa_ret, pa->ptr) < 0)
+			if (isakmp_p2ph(&iph2->sa_ret, pa->ptr) < 0) {
+				plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
+					"duplicate ISAKMP_NPTYPE_SA.\n");
 				goto end;
+			}
 			break;
 
 		case ISAKMP_NPTYPE_NONCE:
-			if (isakmp_p2ph(&iph2->nonce_p, pa->ptr) < 0)
+			if (isakmp_p2ph(&iph2->nonce_p, pa->ptr) < 0) {
+				plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
+					"duplicate ISAKMP_NPTYPE_NONCE.\n");
 				goto end;
+			}
 			break;
 
 		case ISAKMP_NPTYPE_KE:
-			if (isakmp_p2ph(&iph2->dhpub_p, pa->ptr) < 0)
+			if (isakmp_p2ph(&iph2->dhpub_p, pa->ptr) < 0) {
+				plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
+					"duplicate ISAKMP_NPTYPE_KE.\n");
 				goto end;
+			}
 			break;
 
 		case ISAKMP_NPTYPE_ID:
-		    {
-			vchar_t *vp;
-
-			/* check ID value */
-			if (f_id == 0) {
-				/* for IDci */
-				f_id = 1;
-				vp = iph2->id;
+			if (idci == NULL) {
+				if (isakmp_p2ph(&idci, pa->ptr) < 0)
+					goto end;
+			} else if (idcr == NULL) {
+				if (isakmp_p2ph(&idcr, pa->ptr) < 0)
+					goto end;
 			} else {
-				/* for IDcr */
-				vp = iph2->id_p;
-			}
-
-#ifndef ANDROID_PATCHED
-			if (memcmp(vp->v, (caddr_t)pa->ptr + sizeof(struct isakmp_gen), vp->l)) {
-
-				plog(LLV_ERROR, LOCATION, NULL,
-					"mismatched ID was returned.\n");
-				error = ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED;
+				plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
+					"too many ISAKMP_NPTYPE_ID payloads.\n");
 				goto end;
 			}
-#endif
-		    }
 			break;
 
 		case ISAKMP_NPTYPE_N:
-			isakmp_check_notify(pa->ptr, iph2->ph1);
+			ph2_recv_n(iph2, pa->ptr);
 			break;
 
 #ifdef ENABLE_NATT
 		case ISAKMP_NPTYPE_NATOA_DRAFT:
 		case ISAKMP_NPTYPE_NATOA_RFC:
-			/* Ignore original source/destination messages */
+		    {
+			struct sockaddr_storage addr;
+			struct sockaddr *daddr;
+			u_int8_t prefix;
+			u_int16_t ul_proto;
+			vchar_t *vp = NULL;
+
+			if (isakmp_p2ph(&vp, pa->ptr) < 0)
+				goto end;
+
+			error = ipsecdoi_id2sockaddr(vp,
+					(struct sockaddr *) &addr,
+					&prefix, &ul_proto);
+
+			vfree(vp);
+
+			if (error)
+				goto end;
+
+			daddr = dupsaddr((struct sockaddr *) &addr);
+			if (daddr == NULL)
+				goto end;
+
+			if (iph2->natoa_src == NULL)
+				iph2->natoa_src = daddr;
+			else if (iph2->natoa_dst == NULL)
+				iph2->natoa_dst = daddr;
+			else {
+				racoon_free(daddr);
+				plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
+					"too many ISAKMP_NPTYPE_NATOA payloads.\n");
+				goto end;
+			}
+		    }
 			break;
 #endif
 
@@ -480,6 +598,118 @@
 		goto end;
 	}
 
+#ifdef ANDROID_PATCHED
+        if (idcr != NULL) {
+                struct ipsecdoi_id_b *id_b = idcr->v;
+                if (id_b->type != IPSECDOI_ID_IPV4_ADDR &&
+                    id_b->type != IPSECDOI_ID_IPV4_ADDR_SUBNET &&
+                    id_b->type != IPSECDOI_ID_IPV6_ADDR &&
+                    id_b->type != IPSECDOI_ID_IPV6_ADDR_SUBNET) {
+                        vfree(idcr);
+                        idcr = NULL;
+                }
+        }
+#endif
+
+	/* identity check */
+	if (idci != NULL) {
+		struct sockaddr_storage proposed_addr, got_addr;
+		u_int8_t proposed_prefix, got_prefix;
+		u_int16_t proposed_ulproto, got_ulproto;
+
+		error = ipsecdoi_id2sockaddr(iph2->id,
+					(struct sockaddr *) &proposed_addr,
+					&proposed_prefix, &proposed_ulproto);
+		if (error)
+			goto end;
+
+		error = ipsecdoi_id2sockaddr(idci,
+					(struct sockaddr *) &got_addr,
+					&got_prefix, &got_ulproto);
+		if (error)
+			goto end;
+
+		if (proposed_prefix != got_prefix
+		 || proposed_ulproto != got_ulproto) {
+			plog(LLV_DEBUG, LOCATION, NULL,
+				"IDci prefix/ulproto does not match proposal.\n");
+			error = ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED;
+			goto end;
+		}
+#ifdef ENABLE_NATT
+		set_port(iph2->natoa_src,
+			 extract_port((struct sockaddr *) &proposed_addr));
+#endif
+
+		if (cmpsaddr((struct sockaddr *) &proposed_addr,
+			     (struct sockaddr *) &got_addr) == CMPSADDR_MATCH) {
+			plog(LLV_DEBUG, LOCATION, NULL,
+				"IDci matches proposal.\n");
+#ifdef ENABLE_NATT
+		} else if (iph2->natoa_src != NULL
+			&& cmpsaddr(iph2->natoa_src,
+				    (struct sockaddr *) &got_addr) == 0) {
+			plog(LLV_DEBUG, LOCATION, NULL,
+				"IDci matches NAT-OAi.\n");
+#endif
+#ifndef ANDROID_PATCHED
+		} else {
+			plog(LLV_ERROR, LOCATION, NULL,
+				"mismatched IDci was returned.\n");
+			error = ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED;
+			goto end;
+#endif
+		}
+	}
+	if (idcr != NULL) {
+		struct sockaddr_storage proposed_addr, got_addr;
+		u_int8_t proposed_prefix, got_prefix;
+		u_int16_t proposed_ulproto, got_ulproto;
+
+		error = ipsecdoi_id2sockaddr(iph2->id_p,
+					(struct sockaddr *) &proposed_addr,
+					&proposed_prefix, &proposed_ulproto);
+		if (error)
+			goto end;
+
+		error = ipsecdoi_id2sockaddr(idcr,
+					(struct sockaddr *) &got_addr,
+					&got_prefix, &got_ulproto);
+		if (error)
+			goto end;
+
+		if (proposed_prefix != got_prefix
+		 || proposed_ulproto != got_ulproto) {
+			plog(LLV_DEBUG, LOCATION, NULL,
+				"IDcr prefix/ulproto does not match proposal.\n");
+			error = ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED;
+			goto end;
+		}
+
+#ifdef ENABLE_NATT
+		set_port(iph2->natoa_dst,
+			 extract_port((struct sockaddr *) &proposed_addr));
+#endif
+
+		if (cmpsaddr((struct sockaddr *) &proposed_addr,
+			     (struct sockaddr *) &got_addr) == CMPSADDR_MATCH) {
+			plog(LLV_DEBUG, LOCATION, NULL,
+				"IDcr matches proposal.\n");
+#ifdef ENABLE_NATT
+		} else if (iph2->natoa_dst != NULL
+			&& cmpsaddr(iph2->natoa_dst,
+				    (struct sockaddr *) &got_addr) == CMPSADDR_MATCH) {
+			plog(LLV_DEBUG, LOCATION, NULL,
+				"IDcr matches NAT-OAr.\n");
+#endif
+		} else {
+			plog(LLV_ERROR, LOCATION, NULL,
+				"mismatched IDcr was returned.\n");
+			error = ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED;
+			goto end;
+		}
+	}
+
 	/* Fixed buffer for calculating HASH */
 	memcpy(hbuf->v, iph2->nonce->v, iph2->nonce->l);
 	plog(LLV_DEBUG, LOCATION, NULL,
@@ -516,6 +746,8 @@
 
 	/* validity check SA payload sent from responder */
 	if (ipsecdoi_checkph2proposal(iph2) < 0) {
+		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
+			"proposal check failed.\n");
 		error = ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN;
 		goto end;
 	}
@@ -532,6 +764,10 @@
 		vfree(pbuf);
 	if (msg)
 		vfree(msg);
+	if (idci)
+		vfree(idci);
+	if (idcr)
+		vfree(idcr);
 
 	if (error) {
 		VPTRINIT(iph2->sa_ret);
@@ -539,6 +775,16 @@
 		VPTRINIT(iph2->dhpub_p);
 		VPTRINIT(iph2->id);
 		VPTRINIT(iph2->id_p);
+#ifdef ENABLE_NATT
+		if (iph2->natoa_src) {
+			racoon_free(iph2->natoa_src);
+			iph2->natoa_src = NULL;
+		}
+		if (iph2->natoa_dst) {
+			racoon_free(iph2->natoa_dst);
+			iph2->natoa_dst = NULL;
+		}
+#endif
 	}
 
 	return error;
@@ -619,8 +865,7 @@
 	/* if there is commit bit, need resending */
 	if (ISSET(iph2->flags, ISAKMP_FLAG_C)) {
 		/* send the packet, add to the schedule to resend */
-		iph2->retry_counter = iph2->ph1->rmconf->retry_counter;
-		if (isakmp_ph2resend(iph2) == -1)
+		if (isakmp_ph2send(iph2) == -1)
 			goto end;
 	} else {
 		/* send the packet */
@@ -735,7 +980,7 @@
 				    "Ignoring multiples notifications\n");
 				break;
 			}
-			isakmp_check_notify(pa->ptr, iph2->ph1);
+			ph2_recv_n(iph2, pa->ptr);
 			notify = vmalloc(pa->len);
 			if (notify == NULL) {
 				plog(LLV_ERROR, LOCATION, NULL,
@@ -828,7 +1073,7 @@
 
 /*
  * receive from initiator
- * 	HDR*, HASH(1), SA, Ni [, KE ] [, IDi2, IDr2 ]
+ * 	HDR*, HASH(1), SA, Ni [, KE ] [, IDi2, IDr2 ] [, NAT-OAi, NAT-OAr ]
  */
 int
 quick_r1recv(iph2, msg0)
@@ -862,8 +1107,11 @@
 	}
 	/* decrypt packet */
 	msg = oakley_do_decrypt(iph2->ph1, msg0, iph2->ivm->iv, iph2->ivm->ive);
-	if (msg == NULL)
+	if (msg == NULL) {
+		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
+			"Packet decryption failed.\n");
 		goto end;
+	}
 
 	/* create buffer for using to validate HASH(1) */
 	/*
@@ -947,18 +1195,27 @@
 					"Multi SAs isn't supported.\n");
 				goto end;
 			}
-			if (isakmp_p2ph(&iph2->sa, pa->ptr) < 0)
+			if (isakmp_p2ph(&iph2->sa, pa->ptr) < 0) {
+				plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
+					"duplicate ISAKMP_NPTYPE_SA.\n");
 				goto end;
+			}
 			break;
 
 		case ISAKMP_NPTYPE_NONCE:
-			if (isakmp_p2ph(&iph2->nonce_p, pa->ptr) < 0)
+			if (isakmp_p2ph(&iph2->nonce_p, pa->ptr) < 0) {
+				plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
+					"duplicate ISAKMP_NPTYPE_NONCE.\n");
 				goto end;
+			}
 			break;
 
 		case ISAKMP_NPTYPE_KE:
-			if (isakmp_p2ph(&iph2->dhpub_p, pa->ptr) < 0)
+			if (isakmp_p2ph(&iph2->dhpub_p, pa->ptr) < 0) {
+				plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
+					"duplicate ISAKMP_NPTYPE_KE.\n");
 				goto end;
+			}
 			break;
 
 		case ISAKMP_NPTYPE_ID:
@@ -991,13 +1248,47 @@
 			break;
 
 		case ISAKMP_NPTYPE_N:
-			isakmp_check_notify(pa->ptr, iph2->ph1);
+			ph2_recv_n(iph2, pa->ptr);
 			break;
 
 #ifdef ENABLE_NATT
 		case ISAKMP_NPTYPE_NATOA_DRAFT:
 		case ISAKMP_NPTYPE_NATOA_RFC:
-			/* Ignore original source/destination messages */
+		    {
+			struct sockaddr_storage addr;
+			struct sockaddr *daddr;
+			u_int8_t prefix;
+			u_int16_t ul_proto;
+			vchar_t *vp = NULL;
+
+			if (isakmp_p2ph(&vp, pa->ptr) < 0)
+				goto end;
+
+			error = ipsecdoi_id2sockaddr(vp,
+					(struct sockaddr *) &addr,
+					&prefix, &ul_proto);
+
+			vfree(vp);
+
+			if (error)
+				goto end;
+
+			daddr = dupsaddr((struct sockaddr *) &addr);
+			if (daddr == NULL)
+				goto end;
+
+			if (iph2->natoa_dst == NULL)
+				iph2->natoa_dst = daddr;
+			else if (iph2->natoa_src == NULL)
+				iph2->natoa_src = daddr;
+			else {
+				racoon_free(daddr);
+				plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
+					"received too many NAT-OA payloads.\n");
+				error = ISAKMP_NTYPE_PAYLOAD_MALFORMED;
+				goto end;
+			}
+		    }
 			break;
 #endif
 
@@ -1080,12 +1371,15 @@
 			plog(LLV_ERROR, LOCATION, NULL,
 				"failed to generate a proposal template "
 				"from client's proposal.\n");
-			return ISAKMP_INTERNAL_ERROR;
+			error = ISAKMP_INTERNAL_ERROR;
+			goto end;
 		}
 		/*FALLTHROUGH*/
 	case 0:
 		/* select single proposal or reject it. */
 		if (ipsecdoi_selectph2proposal(iph2) < 0) {
+			plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
+				"no proposal chosen.\n");
 			error = ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN;
 			goto end;
 		}
@@ -1135,6 +1429,16 @@
 		VPTRINIT(iph2->dhpub_p);
 		VPTRINIT(iph2->id);
 		VPTRINIT(iph2->id_p);
+#ifdef ENABLE_NATT
+		if (iph2->natoa_src) {
+			racoon_free(iph2->natoa_src);
+			iph2->natoa_src = NULL;
+		}
+		if (iph2->natoa_dst) {
+			racoon_free(iph2->natoa_dst);
+			iph2->natoa_dst = NULL;
+		}
+#endif
 	}
 
 	return error;
@@ -1165,8 +1469,8 @@
 
 	plog(LLV_DEBUG, LOCATION, NULL, "pfkey getspi sent.\n");
 
-	iph2->sce = sched_new(lcconf->wait_ph2complete,
-		pfkey_timeover_stub, iph2);
+	sched_schedule(&iph2->sce, lcconf->wait_ph2complete,
+		       quick_timeover_stub);
 
 	error = 0;
 
@@ -1176,7 +1480,7 @@
 
 /*
  * send to initiator
- * 	HDR*, HASH(2), SA, Nr [, KE ] [, IDi2, IDr2 ]
+ * 	HDR*, HASH(2), SA, Nr [, KE ] [, IDi2, IDr2 ] [, NAT-OAi, NAT-OAr ]
  */
 int
 quick_r2send(iph2, msg)
@@ -1189,8 +1493,13 @@
 	char *p;
 	int tlen;
 	int error = ISAKMP_INTERNAL_ERROR;
+	int natoa = ISAKMP_NPTYPE_NONE;
 	int pfsgroup;
 	u_int8_t *np_p = NULL;
+#ifdef ENABLE_NATT
+	vchar_t *nat_oai = NULL;
+	vchar_t *nat_oar = NULL;
+#endif
 
 	/* validity check */
 	if (msg != NULL) {
@@ -1231,6 +1540,33 @@
 		}
 	}
 
+#ifdef ENABLE_NATT
+	/*
+	 * RFC3947 5.2. if we chose UDP-Encapsulated-Transport
+	 * we should send NAT-OA
+	 */
+	if (ipsecdoi_transportmode(iph2->proposal)
+	 && (iph2->ph1->natt_flags & NAT_DETECTED)) {
+		natoa = iph2->ph1->natt_options->payload_nat_oa;
+
+		nat_oai = ipsecdoi_sockaddr2id(iph2->dst,
+			IPSECDOI_PREFIX_HOST, IPSEC_ULPROTO_ANY);
+		nat_oar = ipsecdoi_sockaddr2id(iph2->src,
+			IPSECDOI_PREFIX_HOST, IPSEC_ULPROTO_ANY);
+
+		if (nat_oai == NULL || nat_oar == NULL) {
+			plog(LLV_ERROR, LOCATION, NULL,
+				"failed to generate NAT-OA payload.\n");
+			goto end;
+		}
+
+		plog(LLV_DEBUG, LOCATION, NULL, "NAT-OAi:\n");
+		plogdump(LLV_DEBUG, nat_oai->v, nat_oai->l);
+		plog(LLV_DEBUG, LOCATION, NULL, "NAT-OAr:\n");
+		plogdump(LLV_DEBUG, nat_oar->v, nat_oar->l);
+	}
+#endif
+
 	/* create SA;NONCE payload, and KE and ID if need */
 	tlen = sizeof(*gen) + iph2->sa_ret->l
 		+ sizeof(*gen) + iph2->nonce->l;
@@ -1239,6 +1575,10 @@
 	if (iph2->id_p != NULL)
 		tlen += (sizeof(*gen) + iph2->id_p->l
 			+ sizeof(*gen) + iph2->id->l);
+#ifdef ENABLE_NATT
+	if (natoa != ISAKMP_NPTYPE_NONE)
+		tlen += 2 * sizeof(*gen) + nat_oai->l + nat_oar->l;
+#endif
 
 	body = vmalloc(tlen);
 	if (body == NULL) { 
@@ -1258,14 +1598,14 @@
 				? ISAKMP_NPTYPE_KE
 				: (iph2->id_p != NULL
 					? ISAKMP_NPTYPE_ID
-					: ISAKMP_NPTYPE_NONE));
+					: natoa));
 
 	/* add KE payload if need. */
 	if (iph2->dhpub_p != NULL && pfsgroup != 0) {
 		np_p = &((struct isakmp_gen *)p)->np;	/* XXX */
 		p = set_isakmp_payload(p, iph2->dhpub,
 			(iph2->id_p == NULL)
-				? ISAKMP_NPTYPE_NONE
+				? natoa
 				: ISAKMP_NPTYPE_ID);
 	}
 
@@ -1275,9 +1615,17 @@
 		p = set_isakmp_payload(p, iph2->id_p, ISAKMP_NPTYPE_ID);
 		/* IDcr */
 		np_p = &((struct isakmp_gen *)p)->np;	/* XXX */
-		p = set_isakmp_payload(p, iph2->id, ISAKMP_NPTYPE_NONE);
+		p = set_isakmp_payload(p, iph2->id, natoa);
 	}
 
+#ifdef ENABLE_NATT
+	/* NAT-OA */
+	if (natoa != ISAKMP_NPTYPE_NONE) {
+		p = set_isakmp_payload(p, nat_oai, natoa);
+		p = set_isakmp_payload(p, nat_oar, ISAKMP_NPTYPE_NONE);
+	}
+#endif
+
 	/* add a RESPONDER-LIFETIME notify payload if needed */
     {
 	vchar_t *data = NULL;
@@ -1350,8 +1698,7 @@
 		goto end;
 
 	/* send the packet, add to the schedule to resend */
-	iph2->retry_counter = iph2->ph1->rmconf->retry_counter;
-	if (isakmp_ph2resend(iph2) == -1)
+	if (isakmp_ph2send(iph2) == -1)
 		goto end;
 
 	/* the sending message is added to the received-list. */
@@ -1371,6 +1718,12 @@
 		vfree(body);
 	if (hash != NULL)
 		vfree(hash);
+#ifdef ENABLE_NATT
+	if (nat_oai != NULL)
+		vfree(nat_oai);
+	if (nat_oar != NULL)
+		vfree(nat_oar);
+#endif
 
 	return error;
 }
@@ -1378,6 +1731,7 @@
 /*
  * receive from initiator
  * 	HDR*, HASH(3)
+
  */
 int
 quick_r3recv(iph2, msg0)
@@ -1421,7 +1775,7 @@
 			hash = (struct isakmp_pl_hash *)pa->ptr;
 			break;
 		case ISAKMP_NPTYPE_N:
-			isakmp_check_notify(pa->ptr, iph2->ph1);
+			ph2_recv_n(iph2, pa->ptr);
 			break;
 		default:
 			/* don't send information, see ident_r1recv() */
@@ -1802,25 +2156,11 @@
 get_sainfo_r(iph2)
 	struct ph2handle *iph2;
 {
-	vchar_t *idsrc = NULL, *iddst = NULL;
-	int prefixlen;
+	vchar_t *idsrc = NULL, *iddst = NULL, *client = NULL;
 	int error = ISAKMP_INTERNAL_ERROR;
-	int remoteid = 0;
 
 	if (iph2->id == NULL) {
-		switch (iph2->src->sa_family) {
-		case AF_INET:
-			prefixlen = sizeof(struct in_addr) << 3;
-			break;
-		case AF_INET6:
-			prefixlen = sizeof(struct in6_addr) << 3;
-			break;
-		default:
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid family: %d\n", iph2->src->sa_family);
-			goto end;
-		}
-		idsrc = ipsecdoi_sockaddr2id(iph2->src, prefixlen,
+		idsrc = ipsecdoi_sockaddr2id(iph2->src, IPSECDOI_PREFIX_HOST,
 					IPSEC_ULPROTO_ANY);
 	} else {
 		idsrc = vdup(iph2->id);
@@ -1832,19 +2172,7 @@
 	}
 
 	if (iph2->id_p == NULL) {
-		switch (iph2->dst->sa_family) {
-		case AF_INET:
-			prefixlen = sizeof(struct in_addr) << 3;
-			break;
-		case AF_INET6:
-			prefixlen = sizeof(struct in6_addr) << 3;
-			break;
-		default:
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid family: %d\n", iph2->dst->sa_family);
-			goto end;
-		}
-		iddst = ipsecdoi_sockaddr2id(iph2->dst, prefixlen,
+		iddst = ipsecdoi_sockaddr2id(iph2->dst, IPSECDOI_PREFIX_HOST,
 					IPSEC_ULPROTO_ANY);
 	} else {
 		iddst = vdup(iph2->id_p);
@@ -1855,19 +2183,34 @@
 		goto end;
 	}
 
-	{
-		struct remoteconf *conf;
-		conf = getrmconf(iph2->dst);
-		if (conf != NULL)
-			remoteid=conf->ph1id;
-		else{
-			plog(LLV_DEBUG, LOCATION, NULL, "Warning: no valid rmconf !\n");
-			remoteid=0;
+#ifdef ENABLE_HYBRID
+
+	/* clientaddr check : obtain modecfg address */
+	if (iph2->ph1->mode_cfg != NULL) {
+		if ((iph2->ph1->mode_cfg->flags & ISAKMP_CFG_ADDR4_EXTERN) ||
+		    (iph2->ph1->mode_cfg->flags & ISAKMP_CFG_ADDR4_LOCAL)){
+			struct sockaddr saddr;
+			saddr.sa_family = AF_INET;
+#ifndef __linux__
+			saddr.sa_len = sizeof(struct sockaddr_in);
+#endif
+			((struct sockaddr_in *)&saddr)->sin_port = IPSEC_PORT_ANY;
+			memcpy(&((struct sockaddr_in *)&saddr)->sin_addr, 
+				&iph2->ph1->mode_cfg->addr4, sizeof(struct in_addr));
+			client = ipsecdoi_sockaddr2id(&saddr, 32, IPSEC_ULPROTO_ANY);
 		}
-		
 	}
 
-	iph2->sainfo = getsainfo(idsrc, iddst, iph2->ph1->id_p, remoteid);
+	/* clientaddr check, fallback to peer address */
+	if (client == NULL)
+	{
+		client = ipsecdoi_sockaddr2id(iph2->dst, IPSECDOI_PREFIX_HOST,
+					IPSEC_ULPROTO_ANY);
+	}
+#endif
+
+	/* obtain a matching sainfo section */
+	iph2->sainfo = getsainfo(idsrc, iddst, iph2->ph1->id_p, client, iph2->ph1->rmconf->ph1id);
 	if (iph2->sainfo == NULL) {
 		plog(LLV_ERROR, LOCATION, NULL,
 			"failed to get sainfo.\n");
@@ -1890,6 +2233,8 @@
 		vfree(idsrc);
 	if (iddst)
 		vfree(iddst);
+	if (client)
+		vfree(client);
 
 	return error;
 }
@@ -1921,8 +2266,8 @@
 		return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
 	}
 
-	/* make sure if id[src,dst] is null. */
-	if (iph2->src_id || iph2->dst_id) {
+	/* make sure if sa_[src, dst] are null. */
+	if (iph2->sa_src || iph2->sa_dst) {
 		plog(LLV_ERROR, LOCATION, NULL,
 			"Why do ID[src,dst] exist already.\n");
 		return ISAKMP_INTERNAL_ERROR;
@@ -2026,29 +2371,45 @@
 		}
 #endif
 
-		/* make id[src,dst] if both ID types are IP address and same */
-		if (_XIDT(iph2->id_p) == idi2type
-		 && spidx.dst.ss_family == spidx.src.ss_family) {
-			iph2->src_id = dupsaddr((struct sockaddr *)&spidx.dst);
-			if (iph2->src_id  == NULL) {
-				plog(LLV_ERROR, LOCATION, NULL,
-				    "buffer allocation failed.\n");
-				return ISAKMP_INTERNAL_ERROR;
-			}
-			iph2->dst_id = dupsaddr((struct sockaddr *)&spidx.src);
-			if (iph2->dst_id  == NULL) {
-				plog(LLV_ERROR, LOCATION, NULL,
-				    "buffer allocation failed.\n");
-				return ISAKMP_INTERNAL_ERROR;
-			}
-		}
+		/* Before setting iph2->[sa_src, sa_dst] with the addresses
+		 * provided in ID payloads, we check:
+		 * - they are both addresses of same family
+		 * - sainfo has not been selected only based on ID payload
+		 *   information but also based on specific Phase 1
+		 *   credentials (iph2->sainfo->id_i is defined), i.e.
+		 *   local configuration _explicitly_ expect that user
+		 *   (e.g. from asn1dn "C=FR, ...") with those IDs) */
+		if (_XIDT(iph2->id_p) == idi2type &&
+		    spidx.dst.ss_family == spidx.src.ss_family &&
+		    iph2->sainfo && iph2->sainfo->id_i) {
 
+			iph2->sa_src = dupsaddr((struct sockaddr *)&spidx.dst);
+			if (iph2->sa_src  == NULL) {
+				plog(LLV_ERROR, LOCATION, NULL,
+				    "buffer allocation failed.\n");
+				return ISAKMP_INTERNAL_ERROR;
+			}
+
+			iph2->sa_dst = dupsaddr((struct sockaddr *)&spidx.src);
+			if (iph2->sa_dst  == NULL) {
+				plog(LLV_ERROR, LOCATION, NULL,
+				    "buffer allocation failed.\n");
+				return ISAKMP_INTERNAL_ERROR;
+			}
+		} else {
+			plog(LLV_DEBUG, LOCATION, NULL,
+			     "Either family (%d - %d), types (%d - %d) of ID "
+			     "from initiator differ or matching sainfo "
+			     "has no id_i defined for the peer. Not filling "
+			     "iph2->sa_src and iph2->sa_dst.\n",
+			     spidx.src.ss_family, spidx.dst.ss_family,
+			     _XIDT(iph2->id_p),idi2type);
+		}
 	} else {
 		plog(LLV_DEBUG, LOCATION, NULL,
-			"get a source address of SP index "
-			"from phase1 address "
-			"due to no ID payloads found "
-			"OR because ID type is not address.\n");
+		     "get a source address of SP index from Phase 1"
+		     "addresses due to no ID payloads found"
+		     "OR because ID type is not address.\n");
 
 		/* see above comment. */
 		memcpy(&spidx.src, iph2->dst, sysdep_sa_len(iph2->dst));
@@ -2070,7 +2431,7 @@
 #undef _XIDT
 
 	plog(LLV_DEBUG, LOCATION, NULL,
-		"get a src address from ID payload "
+		"get src address from ID payload "
 		"%s prefixlen=%u ul_proto=%u\n",
 		saddr2str((struct sockaddr *)&spidx.src),
 		spidx.prefs, spidx.ul_proto);
@@ -2184,6 +2545,76 @@
 	}
 #endif /* HAVE_SECCTX */
 
+	iph2->spid = sp_in->id;
+
+	return 0;
+}
+
+/*
+ * handle a notification payload inside phase2 exchange.
+ * phase2 is always encrypted, so it does not need to be checked
+ * for explicitely.
+ */
+static int
+ph2_recv_n(iph2, gen)
+	struct ph2handle *iph2;
+	struct isakmp_gen *gen;
+{
+	struct ph1handle *iph1 = iph2->ph1;
+	struct isakmp_pl_n *notify = (struct isakmp_pl_n *) gen;
+	u_int type;
+	int check_level;
+
+	type = ntohs(notify->type);
+	switch (type) {
+	case ISAKMP_NTYPE_CONNECTED:
+		break;
+	case ISAKMP_NTYPE_INITIAL_CONTACT:
+		return isakmp_info_recv_initialcontact(iph1, iph2);
+	case ISAKMP_NTYPE_RESPONDER_LIFETIME:
+		ipsecdoi_parse_responder_lifetime(notify,
+			&iph2->lifetime_secs, &iph2->lifetime_kb);
+
+		if (iph1 != NULL && iph1->rmconf != NULL) {
+			check_level = iph1->rmconf->pcheck_level;
+		} else {
+			if (iph1 != NULL)
+				plog(LLV_DEBUG, LOCATION, NULL,
+					"No phase1 rmconf found !\n");
+			else
+				plog(LLV_DEBUG, LOCATION, NULL,
+					"No phase1 found !\n");
+			check_level = PROP_CHECK_EXACT;
+		}
+
+		switch (check_level) {
+		case PROP_CHECK_OBEY:
+			break;
+		case PROP_CHECK_STRICT:
+		case PROP_CHECK_CLAIM:
+			if (iph2->sainfo == NULL
+			 || iph2->sainfo->lifetime <= iph2->lifetime_secs) {
+				plog(LLV_WARNING, LOCATION, NULL,
+					"RESPONDER-LIFETIME: lifetime mismatch\n");
+				iph2->lifetime_secs = 0;
+			}
+			break;
+		case PROP_CHECK_EXACT:
+			if (iph2->sainfo == NULL
+			 || iph2->sainfo->lifetime != iph2->lifetime_secs) {
+				plog(LLV_WARNING, LOCATION, NULL,
+					"RESPONDER-LIFETIME: lifetime mismatch\n");
+				iph2->lifetime_secs = 0;
+			}
+			break;
+		}
+		break;
+	default:
+		isakmp_log_notify(iph2->ph1, notify, "phase2 exchange");
+		isakmp_info_send_n2(iph2, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE,
+			NULL);
+		break;
+	}
 	return 0;
 }
 
diff --git a/src/racoon/isakmp_unity.c b/src/racoon/isakmp_unity.c
index 9873f59..a1bf793 100644
--- a/src/racoon/isakmp_unity.c
+++ b/src/racoon/isakmp_unity.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: isakmp_unity.c,v 1.7 2006/10/09 06:17:20 manu Exp $	*/
+/*	$NetBSD: isakmp_unity.c,v 1.9 2007/10/19 03:37:19 manu Exp $	*/
 
 /* Id: isakmp_unity.c,v 1.10 2006/07/31 04:49:23 manubsd Exp */
 
@@ -305,32 +305,41 @@
 	struct unity_network * network;
 	int *count;
 {
-	struct unity_netentry * newentry;
+	struct unity_netentry * nentry;
+
+	/*
+	 * search for network in current list
+	 * to avoid adding duplicates
+	 */
+	for (nentry = *list; nentry != NULL; nentry = nentry->next)
+		if (memcmp(&nentry->network, network,
+			   sizeof(struct unity_network)) == 0)
+			return 0;	/* it's a dupe */
 
 	/*
 	 * allocate new netentry and copy
-         * new splitnet network data
+	 * new splitnet network data
 	 */
-	newentry = (struct unity_netentry *)
+	nentry = (struct unity_netentry *)
 		racoon_malloc(sizeof(struct unity_netentry));
-	if (newentry == NULL)
+	if (nentry == NULL)
 		return -1;
 
-	memcpy(&newentry->network,network,
+	memcpy(&nentry->network,network,
 		sizeof(struct unity_network));
-	newentry->next = NULL;
+	nentry->next = NULL;
 
 	/*
 	 * locate the last netentry in our
 	 * splitnet list and add our entry
 	 */
 	if (*list == NULL)
-		*list = newentry;
+		*list = nentry;
 	else {
 		struct unity_netentry * tmpentry = *list;
 		while (tmpentry->next != NULL)
 			tmpentry = tmpentry->next;
-		tmpentry->next = newentry;
+		tmpentry->next = nentry;
 	}
 
 	(*count)++;
@@ -354,8 +363,9 @@
 	}
 }
 
-char * splitnet_list_2str(list)
+char * splitnet_list_2str(list, splitnet_ipaddr)
 	struct unity_netentry * list;
+	enum splinet_ipaddr splitnet_ipaddr;
 {
 	struct unity_netentry * netentry;
 	char tmp1[40];
@@ -389,8 +399,17 @@
 
 		inet_ntop(AF_INET, &netentry->network.addr4, tmp1, 40);
 		inet_ntop(AF_INET, &netentry->network.mask4, tmp2, 40);
+		if (splitnet_ipaddr == CIDR) {
+			uint32_t tmp3;
+			int cidrmask;
 
-		len += sprintf(str+len, "%s/%s ", tmp1, tmp2);
+			tmp3 = ntohl(netentry->network.mask4.s_addr);
+			for (cidrmask = 0; tmp3 != 0; cidrmask++)
+				tmp3 <<= 1;
+			len += sprintf(str+len, "%s/%d ", tmp1, cidrmask);
+		} else {
+			len += sprintf(str+len, "%s/%s ", tmp1, tmp2);
+		}
 
 		netentry = netentry->next;
 	}
diff --git a/src/racoon/isakmp_unity.h b/src/racoon/isakmp_unity.h
index b52f02c..3667d0d 100644
--- a/src/racoon/isakmp_unity.h
+++ b/src/racoon/isakmp_unity.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: isakmp_unity.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
+/*	$NetBSD: isakmp_unity.h,v 1.5 2007/10/19 03:37:19 manu Exp $	*/
 
 /*	$KAME$ */
 
@@ -31,6 +31,8 @@
  * SUCH DAMAGE.
  */
 
+enum splinet_ipaddr { NETMASK, CIDR }; 
+
 /* ISAKMP notifies specific to the Unity vendor Id */
 /* Sent during xauth if the user types his password too slowly */
 #define ISAKMP_NTYPE_UNITY_HEARTBEAT	40500
@@ -66,7 +68,7 @@
 
 int	splitnet_list_add(struct unity_netentry **, struct unity_network *, int *);
 void	splitnet_list_free(struct unity_netentry *, int *);
-char *	splitnet_list_2str(struct unity_netentry *);
+char *	splitnet_list_2str(struct unity_netentry *, enum splinet_ipaddr);
 
 vchar_t *isakmp_unity_req(struct ph1handle *, struct isakmp_data *);
 void isakmp_unity_reply(struct ph1handle *, struct isakmp_data *);
diff --git a/src/racoon/isakmp_var.h b/src/racoon/isakmp_var.h
index f4ef45d..09e4e7f 100644
--- a/src/racoon/isakmp_var.h
+++ b/src/racoon/isakmp_var.h
@@ -1,11 +1,11 @@
-/*	$NetBSD: isakmp_var.h,v 1.6.6.1 2007/02/20 09:08:49 vanhu Exp $	*/
+/*	$NetBSD: isakmp_var.h,v 1.17 2010/11/12 10:36:37 tteras Exp $	*/
 
 /* Id: isakmp_var.h,v 1.12 2005/05/07 14:45:31 manubsd Exp */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -17,7 +17,7 @@
  * 3. Neither the name of the project nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -35,6 +35,7 @@
 #define _ISAKMP_VAR_H
 
 #include "vmbuf.h"
+#include "policy.h"
 
 #define PORT_ISAKMP 500
 #define PORT_ISAKMP_NATT 4500
@@ -56,40 +57,39 @@
 struct ph1handle;
 struct ph2handle;
 struct remoteconf;
-struct isakmp_gen;
 struct ipsecdoi_pl_id;	/* XXX */
 struct isakmp_pl_ke;	/* XXX */
 struct isakmp_pl_nonce;	/* XXX */
 
-extern int isakmp_handler __P((int));
-extern int isakmp_ph1begin_i __P((struct remoteconf *, struct sockaddr *,
-	struct sockaddr *));
+extern struct ph1handle *isakmp_ph1begin_i __P((struct remoteconf *,
+	struct sockaddr *, struct sockaddr *));
 
 extern vchar_t *isakmp_parsewoh __P((int, struct isakmp_gen *, int));
 extern vchar_t *isakmp_parse __P((vchar_t *));
 
 extern int isakmp_init __P((void));
 extern const char *isakmp_pindex __P((const isakmp_index *, const u_int32_t));
-extern int isakmp_open __P((void));
-extern void isakmp_close __P((void));
+extern int isakmp_open __P((struct sockaddr *, int));
+extern void isakmp_close __P((int fd));
 extern int isakmp_send __P((struct ph1handle *, vchar_t *));
 
-extern void isakmp_ph1resend_stub __P((void *));
-extern int isakmp_ph1resend __P((struct ph1handle *));
-extern void isakmp_ph2resend_stub __P((void *));
-extern int isakmp_ph2resend __P((struct ph2handle *));
-extern void isakmp_ph1expire_stub __P((void *));
+extern int isakmp_ph1send __P((struct ph1handle *));
+extern int isakmp_ph2send __P((struct ph2handle *));
+extern void isakmp_ph1dying_stub __P((struct sched *));
+extern void isakmp_ph1dying __P((struct ph1handle *));
+extern void isakmp_ph1expire_stub __P((struct sched *));
 extern void isakmp_ph1expire __P((struct ph1handle *));
-extern void isakmp_ph1delete_stub __P((void *));
+extern void isakmp_ph1delete_stub __P((struct sched *));
 extern void isakmp_ph1delete __P((struct ph1handle *));
-extern void isakmp_ph2expire_stub __P((void *));
+extern void isakmp_ph2expire_stub __P((struct sched *));
 extern void isakmp_ph2expire __P((struct ph2handle *));
-extern void isakmp_ph2delete_stub __P((void *));
+extern void isakmp_ph2delete_stub __P((struct sched *));
 extern void isakmp_ph2delete __P((struct ph2handle *));
 
-extern int isakmp_post_acquire __P((struct ph2handle *));
+extern int isakmp_get_sainfo __P((struct ph2handle *, struct secpolicy *, struct secpolicy *));
+extern int isakmp_post_acquire __P((struct ph2handle *, struct ph1handle *, int));
 extern int isakmp_post_getspi __P((struct ph2handle *));
-extern void isakmp_chkph1there_stub __P((void *));
+extern void isakmp_chkph1there_stub __P((struct sched *));
 extern void isakmp_chkph1there __P((struct ph2handle *));
 
 extern caddr_t isakmp_set_attr_v __P((caddr_t, int, caddr_t, int));
@@ -106,8 +106,19 @@
 extern caddr_t set_isakmp_header2 __P((vchar_t *, struct ph2handle *, int));
 extern caddr_t set_isakmp_payload __P((caddr_t, vchar_t *, int));
 
-extern struct payload_list *isakmp_plist_append __P((struct payload_list *plist, 
-	vchar_t *payload, int payload_type));
+extern struct payload_list *isakmp_plist_append_full __P((
+	struct payload_list *plist, vchar_t *payload,
+	u_int8_t payload_type, u_int8_t free));
+
+static inline struct payload_list *isakmp_plist_append(plist, payload, payload_type)
+	struct payload_list *plist;
+	vchar_t *payload;
+	u_int8_t payload_type;
+{
+	return isakmp_plist_append_full(plist, payload, payload_type, 0);
+}
+
+
 extern vchar_t *isakmp_plist_set_all __P((struct payload_list **plist,
 	struct ph1handle *iph1));
 
@@ -120,7 +131,7 @@
 	struct remoteconf *, struct sockaddr *, struct sockaddr *));
 extern void log_ph1established __P((const struct ph1handle *));
 
-extern void script_hook __P((struct ph1handle *, int)); 
+extern void script_hook __P((struct ph1handle *, int));
 extern int script_env_append __P((char ***, int *, char *, char *));
 extern int script_exec __P((char *, int, char * const *));
 
@@ -129,4 +140,5 @@
 #ifdef INET6
 u_int32_t setscopeid __P((struct sockaddr *, struct sockaddr *));
 #endif
+
 #endif /* _ISAKMP_VAR_H */
diff --git a/src/racoon/isakmp_xauth.c b/src/racoon/isakmp_xauth.c
index 12e5ef6..853caaa 100644
--- a/src/racoon/isakmp_xauth.c
+++ b/src/racoon/isakmp_xauth.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: isakmp_xauth.c,v 1.11.6.2 2009/04/20 13:35:36 tteras Exp $	*/
+/*	$NetBSD: isakmp_xauth.c,v 1.22 2011/03/14 15:50:36 vanhu Exp $	*/
 
 /* Id: isakmp_xauth.c,v 1.38 2006/08/22 18:17:17 manubsd Exp */
 
@@ -40,6 +40,7 @@
 
 #include <netinet/in.h>
 
+#include <assert.h>
 #include <stdlib.h>
 #include <stdio.h>
 #include <string.h>
@@ -95,9 +96,9 @@
 
 #ifdef HAVE_LIBRADIUS
 #include <radlib.h>
-
 struct rad_handle *radius_auth_state = NULL;
 struct rad_handle *radius_acct_state = NULL;
+struct xauth_rad_config xauth_rad_config;
 #endif
 
 #ifdef HAVE_LIBPAM
@@ -129,7 +130,7 @@
 	size_t tlen;
 
 	/* Status checks */
-	if (iph1->status != PHASE1ST_ESTABLISHED) {
+	if (iph1->status < PHASE1ST_ESTABLISHED) {
 		plog(LLV_ERROR, LOCATION, NULL, 
 		    "Xauth request while phase 1 is not completed\n");
 		return;
@@ -311,7 +312,7 @@
 		 * On failure, throttle the connexion for the remote host
 		 * in order to make password attacks more difficult.
 		 */
-		throttle_delay = throttle_host(iph1->remote, res) - time(NULL);
+		throttle_delay = throttle_host(iph1->remote, res);
 		if (throttle_delay > 0) {
 			char *str;
 
@@ -329,7 +330,7 @@
 		if (throttle_delay != 0) {
 			struct xauth_reply_arg *xra;
 
-			if ((xra = racoon_malloc(sizeof(*xra))) == NULL) {
+			if ((xra = racoon_calloc(1, sizeof(*xra))) == NULL) {
 				plog(LLV_ERROR, LOCATION, NULL, 
 				    "malloc failed, bypass throttling\n");
 				return xauth_reply(iph1, port, id, res);
@@ -344,7 +345,8 @@
 			xra->port = port;
 			xra->id = id;
 			xra->res = res;
-			sched_new(throttle_delay, xauth_reply_stub, xra);
+			sched_schedule(&xra->sc, throttle_delay,
+				       xauth_reply_stub);
 		} else {
 			return xauth_reply(iph1, port, id, res);
 		}
@@ -354,10 +356,10 @@
 }
 
 void 
-xauth_reply_stub(args)
-	void *args;
+xauth_reply_stub(sc)
+	struct sched *sc;
 {
-	struct xauth_reply_arg *xra = (struct xauth_reply_arg *)args;
+	struct xauth_reply_arg *xra = container_of(sc, struct xauth_reply_arg, sc);
 	struct ph1handle *iph1;
 
 	if ((iph1 = getph1byindex(&xra->index)) != NULL)
@@ -367,7 +369,6 @@
 		    "Delayed Xauth reply: phase 1 no longer exists.\n"); 
 
 	racoon_free(xra);
-	return;
 }
 
 int
@@ -390,7 +391,7 @@
 		xst->status = XAUTHST_NOTYET;
 
 		/* Delete Phase 1 SA */
-		if (iph1->status == PHASE1ST_ESTABLISHED)
+		if (iph1->status >= PHASE1ST_ESTABLISHED)
 			isakmp_info_send_d1(iph1);
 		remph1(iph1);
 		delph1(iph1);
@@ -447,6 +448,31 @@
 
 #ifdef HAVE_LIBRADIUS
 int
+xauth_radius_init_conf(int free)
+{
+	/* free radius config resources */
+	if (free) {
+		int i;
+		for (i = 0; i < xauth_rad_config.auth_server_count; i++) {
+			vfree(xauth_rad_config.auth_server_list[i].host);
+			vfree(xauth_rad_config.auth_server_list[i].secret);
+		}
+		for (i = 0; i < xauth_rad_config.acct_server_count; i++) {
+			vfree(xauth_rad_config.acct_server_list[i].host);
+			vfree(xauth_rad_config.acct_server_list[i].secret);
+		}
+		if (radius_auth_state != NULL)
+			rad_close(radius_auth_state);
+		if (radius_acct_state != NULL)
+			rad_close(radius_acct_state);
+	}
+
+	/* initialize radius config */
+	memset(&xauth_rad_config, 0, sizeof(xauth_rad_config));
+	return 0;
+}
+
+int
 xauth_radius_init(void)
 {
 	/* For first time use, initialize Radius */
@@ -458,13 +484,35 @@
 			return -1;
 		}
 
-		if (rad_config(radius_auth_state, NULL) != 0) {
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "Cannot open librarius config file: %s\n", 
-			    rad_strerror(radius_auth_state));
-			rad_close(radius_auth_state);
-			radius_auth_state = NULL;
-			return -1;
+		int auth_count = xauth_rad_config.auth_server_count;
+		int auth_added = 0;
+		if (auth_count) {
+			int i;
+			for (i = 0; i < auth_count; i++) {
+				if(!rad_add_server(
+					radius_auth_state,
+					xauth_rad_config.auth_server_list[i].host->v,
+					xauth_rad_config.auth_server_list[i].port,
+					xauth_rad_config.auth_server_list[i].secret->v,
+					xauth_rad_config.timeout,
+					xauth_rad_config.retries ))
+					auth_added++;
+				else
+					plog(LLV_WARNING, LOCATION, NULL,
+						"could not add radius auth server %s\n",
+						xauth_rad_config.auth_server_list[i].host->v);
+			}
+		}
+
+		if (!auth_added) {
+			if (rad_config(radius_auth_state, NULL) != 0) {
+				plog(LLV_ERROR, LOCATION, NULL, 
+				    "Cannot open libradius config file: %s\n", 
+				    rad_strerror(radius_auth_state));
+				rad_close(radius_auth_state);
+				radius_auth_state = NULL;
+				return -1;
+			}
 		}
 	}
 
@@ -476,13 +524,35 @@
 			return -1;
 		}
 
-		if (rad_config(radius_acct_state, NULL) != 0) {
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "Cannot open librarius config file: %s\n", 
-			    rad_strerror(radius_acct_state));
-			rad_close(radius_acct_state);
-			radius_acct_state = NULL;
-			return -1;
+		int acct_count = xauth_rad_config.acct_server_count;
+		int acct_added = 0;
+		if (acct_count) {
+			int i;
+			for (i = 0; i < acct_count; i++) {
+				if(!rad_add_server(
+					radius_acct_state,
+					xauth_rad_config.acct_server_list[i].host->v,
+					xauth_rad_config.acct_server_list[i].port,
+					xauth_rad_config.acct_server_list[i].secret->v,
+					xauth_rad_config.timeout,
+					xauth_rad_config.retries ))
+					acct_added++;
+				else
+					plog(LLV_WARNING, LOCATION, NULL,
+						"could not add radius account server %s\n",
+						xauth_rad_config.acct_server_list[i].host->v);
+			}
+		}
+
+		if (!acct_added) {
+			if (rad_config(radius_acct_state, NULL) != 0) {
+				plog(LLV_ERROR, LOCATION, NULL, 
+				    "Cannot open libradius config file: %s\n", 
+				    rad_strerror(radius_acct_state));
+				rad_close(radius_acct_state);
+				radius_acct_state = NULL;
+				return -1;
+			}
 		}
 	}
 
@@ -670,7 +740,7 @@
 		    "cannot allocate memory: %s\n", strerror(errno)); 
 		goto out;
 	}
-	
+
 	if ((error = pam_set_item(pam, PAM_RHOST, remote)) != 0) {
 		plog(LLV_ERROR, LOCATION, NULL, 
 		    "pam_set_item failed: %s\n", 
@@ -678,6 +748,13 @@
 		goto out;
 	}
 
+	if ((error = pam_set_item(pam, PAM_RUSER, usr)) != 0) {
+		plog(LLV_ERROR, LOCATION, NULL, 
+		    "pam_set_item failed: %s\n", 
+		    pam_strerror(pam, error));
+		goto out;
+	}
+
 	PAM_usr = usr;
 	PAM_pwd = pwd;
 	error = pam_authenticate(pam, 0);
@@ -720,7 +797,7 @@
 
 #ifdef HAVE_LIBLDAP
 int 
-xauth_ldap_init(void)
+xauth_ldap_init_conf(void)
 {
 	int tmplen;
 	int error = -1;
@@ -1255,7 +1332,7 @@
 	 * status. It does it if the chose authmethod is using Xauth.
 	 * On the client side (roadwarrior), we don't check anything.
 	 */
-	switch (AUTHMETHOD(iph1)) {
+	switch (iph1->approval->authmethod) {
 	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R:
 	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R:
 	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
@@ -1546,9 +1623,9 @@
 		 * when running as a client (initiator).
 		 */
 		xst = &iph1->mode_cfg->xauth;
-		switch(AUTHMETHOD(iph1)) {
+		switch (iph1->approval->authmethod) {
 		case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
-		case FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I:
+		case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I:
 		case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I:
 		/* Not implemented ... */
 		case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
@@ -1568,13 +1645,11 @@
 			plog(LLV_ERROR, LOCATION, NULL, 
 			    "Xauth authentication failed\n");
 
-			EVT_PUSH(iph1->local, iph1->remote, 
-			    EVTT_XAUTH_FAILED, NULL);
+			evt_phase1(iph1, EVT_PHASE1_XAUTH_FAILED, NULL);
 
 			iph1->mode_cfg->flags |= ISAKMP_CFG_DELETE_PH1;
 		} else {
-			EVT_PUSH(iph1->local, iph1->remote, 
-			    EVTT_XAUTH_SUCCESS, NULL);
+			evt_phase1(iph1, EVT_PHASE1_XAUTH_SUCCESS, NULL);
 		}
 
 
@@ -1689,3 +1764,42 @@
 
 	return;
 }
+
+struct xauth_rmconf *
+xauth_rmconf_dup(xauth_rmconf)
+	struct xauth_rmconf *xauth_rmconf;
+{
+	struct xauth_rmconf *new;
+
+	if (xauth_rmconf != NULL) {
+		new = racoon_malloc(sizeof(*new));
+		if (new == NULL) {
+			plog(LLV_ERROR, LOCATION, NULL, 
+			    "xauth_rmconf_dup: malloc failed\n");
+			return NULL;
+		}
+
+		memcpy(new, xauth_rmconf, sizeof(*new));
+
+		if (xauth_rmconf->login != NULL) {
+			new->login = vdup(xauth_rmconf->login);
+			if (new->login == NULL) {
+				plog(LLV_ERROR, LOCATION, NULL, 
+				    "xauth_rmconf_dup: malloc failed (login)\n");
+				return NULL;
+			}
+		}
+		if (xauth_rmconf->pass != NULL) {
+			new->pass = vdup(xauth_rmconf->pass);
+			if (new->pass == NULL) {
+				plog(LLV_ERROR, LOCATION, NULL, 
+				    "xauth_rmconf_dup: malloc failed (password)\n");
+				return NULL;
+			}
+		}
+
+		return new;
+	}
+
+	return NULL;
+}
diff --git a/src/racoon/isakmp_xauth.h b/src/racoon/isakmp_xauth.h
index ebb5214..f9e778f 100644
--- a/src/racoon/isakmp_xauth.h
+++ b/src/racoon/isakmp_xauth.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: isakmp_xauth.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
+/*	$NetBSD: isakmp_xauth.h,v 1.7 2011/03/14 15:50:36 vanhu Exp $	*/
 
 /*	$KAME$ */
 
@@ -34,6 +34,8 @@
 #ifndef _ISAKMP_XAUTH_H
 #define _ISAKMP_XAUTH_H
 
+#include "schedule.h"
+
 /* ISAKMP mode config attribute types specific to the Xauth vendor ID */
 #define	XAUTH_TYPE                16520
 #define	XAUTH_USER_NAME           16521
@@ -90,6 +92,7 @@
 #define XAUTHST_OK	2
 
 struct xauth_reply_arg {
+	struct sched sc;
 	isakmp_index index;
 	int port;
 	int id;
@@ -107,20 +110,43 @@
 vchar_t *isakmp_xauth_req(struct ph1handle *, struct isakmp_data *);
 vchar_t *isakmp_xauth_set(struct ph1handle *, struct isakmp_data *);
 void xauth_rmstate(struct xauth_state *);
-void xauth_reply_stub(void *);
+void xauth_reply_stub(struct sched *);
 int xauth_reply(struct ph1handle *, int, int, int);
 int xauth_rmconf_used(struct xauth_rmconf **);
 void xauth_rmconf_delete(struct xauth_rmconf **);
-
-#ifdef HAVE_LIBRADIUS
-int xauth_login_radius(struct ph1handle *, char *, char *);
-int xauth_radius_init(void);
-#endif
+struct xauth_rmconf * xauth_rmconf_dup(struct xauth_rmconf *);
 
 #ifdef HAVE_LIBPAM
 int xauth_login_pam(int, struct sockaddr *, char *, char *);
 #endif
 
+#ifdef HAVE_LIBRADIUS
+
+#define RADIUS_MAX_SERVERS 5
+
+struct rad_serv {
+	vchar_t		*host;
+	int		port;
+	vchar_t		*secret;
+};
+
+struct xauth_rad_config {
+	struct rad_serv	auth_server_list[RADIUS_MAX_SERVERS];
+	int		auth_server_count;
+	struct rad_serv	acct_server_list[RADIUS_MAX_SERVERS];
+	int		acct_server_count;
+	int		timeout;
+	int		retries;
+};
+
+extern struct xauth_rad_config xauth_rad_config;
+
+int xauth_radius_init_conf(int free);
+int xauth_radius_init(void);
+int xauth_login_radius(struct ph1handle *, char *, char *);
+
+#endif
+
 #ifdef HAVE_LIBLDAP
 
 #define LDAP_DFLT_HOST		"localhost"
@@ -148,8 +174,9 @@
 
 extern struct xauth_ldap_config xauth_ldap_config;
 
-int xauth_ldap_init(void);
+int xauth_ldap_init_conf(void);
 int xauth_login_ldap(struct ph1handle *, char *, char *);
+
 #endif
 
 #endif /* _ISAKMP_XAUTH_H */
diff --git a/src/racoon/kmpstat.c b/src/racoon/kmpstat.c
index c59e43a..50c478d 100644
--- a/src/racoon/kmpstat.c
+++ b/src/racoon/kmpstat.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: kmpstat.c,v 1.4.6.2 2007/11/06 16:41:33 vanhu Exp $	*/
+/*	$NetBSD: kmpstat.c,v 1.7 2010/11/12 09:08:26 tteras Exp $	*/
 
 /*	$KAME: kmpstat.c,v 1.33 2004/08/16 08:20:28 itojun Exp $	*/
 
@@ -138,7 +138,7 @@
 {
 	struct admin_com h, *com;
 	caddr_t buf;
-	int len;
+	int len, rlen;
 	int l = 0;
 	caddr_t p;
 
@@ -153,19 +153,25 @@
 	if (len < sizeof(h))
 		goto bad1;
 
-	if (h.ac_errno) {
+	if (h.ac_errno && !(h.ac_cmd & ADMIN_FLAG_LONG_REPLY)) {
 		errno = h.ac_errno;
 		goto bad1;
 	}
 
+	/* real length */
+	if (h.ac_cmd & ADMIN_FLAG_LONG_REPLY)
+		rlen = ((u_int32_t)h.ac_len) + (((u_int32_t)h.ac_len_high) << 16);
+	else
+		rlen = h.ac_len;
+
 	/* allocate buffer */
-	if ((*combufp = vmalloc(h.ac_len)) == NULL)
+	if ((*combufp = vmalloc(rlen)) == NULL)
 		goto bad1;
 
 	/* read real message */
 	p = (*combufp)->v;
-	while (l < len) {
-		if ((len = recv(so, p, h.ac_len, 0)) < 0) {
+	while (l < rlen) {
+		if ((len = recv(so, p, rlen - l, 0)) < 0) {
 			perror("recv");
 			goto bad2;
 		}
diff --git a/src/racoon/localconf.c b/src/racoon/localconf.c
index ede1d9b..a512953 100644
--- a/src/racoon/localconf.c
+++ b/src/racoon/localconf.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: localconf.c,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
+/*	$NetBSD: localconf.c,v 1.7 2008/12/23 14:04:42 tteras Exp $	*/
 
 /*	$KAME: localconf.c,v 1.33 2001/08/09 07:32:19 sakane Exp $	*/
 
@@ -85,18 +85,14 @@
 	int i;
 
 	setdefault();
-	clear_myaddr(&lcconf->myaddrs);
+	myaddr_flush();
+
 	for (i = 0; i < LC_PATHTYPE_MAX; i++) {
 		if (lcconf->pathinfo[i]) {
 			racoon_free(lcconf->pathinfo[i]);
 			lcconf->pathinfo[i] = NULL;
 		}
 	}
-	for (i = 0; i < LC_IDENTTYPE_MAX; i++) {
-		if (lcconf->ident[i])
-			vfree(lcconf->ident[i]);
-		lcconf->ident[i] = NULL;
-	}
 }
 
 static void
@@ -105,7 +101,6 @@
 	lcconf->uid = 0;
 	lcconf->gid = 0;
 	lcconf->chroot = NULL;
-	lcconf->autograbaddr = 1;
 	lcconf->port_isakmp = PORT_ISAKMP;
 	lcconf->port_isakmp_natt = PORT_ISAKMP_NATT;
 	lcconf->default_af = AF_INET;
@@ -124,6 +119,7 @@
 	lcconf->complex_bundle = TRUE; /*XXX FALSE;*/
 	lcconf->gss_id_enc = LC_GSSENC_UTF16LE; /* Windows compatibility */
 	lcconf->natt_ka_interval = LC_DEFAULT_NATT_KA_INTERVAL;
+	lcconf->pfkey_buffer_size = LC_DEFAULT_PFKEY_BUFFER_SIZE;
 }
 
 /*
@@ -340,21 +336,12 @@
 	int f;
 {
 	static u_int16_t s_port_isakmp;
-#ifdef ENABLE_ADMINPORT
-	static u_int16_t s_port_admin;
-#endif
 
 	/* 0: save, 1: restore */
 	if (f) {
 		lcconf->port_isakmp = s_port_isakmp;
-#ifdef ENABLE_ADMINPORT
-		lcconf->port_admin = s_port_admin;
-#endif
 	} else {
 		s_port_isakmp = lcconf->port_isakmp;
-#ifdef ENABLE_ADMINPORT
-		s_port_admin = lcconf->port_admin;
-#endif
 	}
 }
 
diff --git a/src/racoon/localconf.h b/src/racoon/localconf.h
index f7cf33a..04ac8e4 100644
--- a/src/racoon/localconf.h
+++ b/src/racoon/localconf.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: localconf.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
+/*	$NetBSD: localconf.h,v 1.7 2008/12/23 14:04:42 tteras Exp $	*/
 
 /* Id: localconf.h,v 1.13 2005/11/06 18:13:18 monas Exp */
 
@@ -57,11 +57,10 @@
 #define LC_DEFAULT_RETRY_CHECKPH1	30
 #define LC_DEFAULT_WAIT_PH2COMPLETE	30
 #define LC_DEFAULT_NATT_KA_INTERVAL	20
+#define LC_DEFAULT_PFKEY_BUFFER_SIZE	0
 
 #define LC_DEFAULT_SECRETSIZE	16	/* 128 bits */
 
-#define LC_IDENTTYPE_MAX	5	/* XXX */
-
 #define	LC_GSSENC_UTF16LE	0	/* GSS ID in UTF-16LE */
 #define	LC_GSSENC_LATIN1	1	/* GSS ID in ISO-Latin-1 */
 #define	LC_GSSENC_MAX		2
@@ -74,18 +73,13 @@
 	char *chroot;			/* chroot path */
 	u_int16_t port_isakmp;		/* port for isakmp as default */
 	u_int16_t port_isakmp_natt;	/* port for NAT-T use */
-	u_int16_t port_admin;		/* port for admin */
 	int default_af;			/* default address family */
 
 	int sock_admin;
 	int sock_pfkey;
 	int rtsock;			/* routing socket */
 
-	int autograbaddr;
-	struct myaddrs *myaddrs;
-
 	char *pathinfo[LC_PATHTYPE_MAX];
-	vchar_t *ident[LC_IDENTTYPE_MAX]; /* base of Identifier payload. */
 
 	int pad_random;
 	int pad_randomlen;
@@ -118,6 +112,7 @@
 		 */
 
 	int gss_id_enc;			/* GSS ID encoding to use */
+	int pfkey_buffer_size;		/* Set socket buffer size for pfkey */
 };
 
 extern struct localconf *lcconf;
diff --git a/src/racoon/main.c b/src/racoon/main.c
index 094026e..ab71b3e 100644
--- a/src/racoon/main.c
+++ b/src/racoon/main.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: main.c,v 1.6.6.2 2008/11/27 15:25:26 vanhu Exp $	*/
+/*	$NetBSD: main.c,v 1.12 2009/01/26 18:13:06 tteras Exp $	*/
 
 /* Id: main.c,v 1.25 2006/06/20 20:31:34 manubsd Exp */
 
@@ -66,12 +66,6 @@
 
 #include "cfparse_proto.h"
 #include "isakmp_var.h"
-#ifdef ENABLE_HYBRID
-#include <resolv.h>
-#include "isakmp.h"
-#include "isakmp_xauth.h"
-#include "isakmp_cfg.h"
-#endif
 #include "remoteconf.h"
 #include "localconf.h"
 #include "session.h"
@@ -84,10 +78,10 @@
 
 #include "package_version.h"
 
+int dump_config = 0;	/* dump parsed config file. */
 int f_local = 0;	/* local test mode.  behave like a wall. */
 int vflag = 1;		/* for print-isakmp.c */
 static int loading_sa = 0;	/* install sa when racoon boots up. */
-static int dump_config = 0;	/* dump parsed config file. */
 
 #ifdef TOP_PACKAGE
 static char version[] = "@(#)" TOP_PACKAGE_STRING " (" TOP_PACKAGE_URL ")";
@@ -95,197 +89,77 @@
 static char version[] = "@(#) racoon / IPsec-tools";
 #endif /* TOP_PACKAGE */
 
-int main __P((int, char **));
-static void usage __P((void));
-static void parse __P((int, char **));
-#if 0
-static void cleanup_pidfile __P((void));
-#endif
-
-void
-usage()
+static void
+print_version()
 {
-	printf("usage: racoon [-BdFv%s] %s[-f (file)] [-l (file)] [-p (port)]\n",
+	printf("%s\n"
+	       "\n"
+	       "Compiled with:\n"
+	       "- %s (http://www.openssl.org/)\n"
 #ifdef INET6
-		"46",
-#else
-		"",
+	       "- IPv6 support\n"
+#endif
+#ifdef ENABLE_DPD
+	       "- Dead Peer Detection\n"
+#endif
+#ifdef ENABLE_FRAG
+	       "- IKE fragmentation\n"
+#endif
+#ifdef ENABLE_HYBRID
+	       "- Hybrid authentication\n"
+#endif
+#ifdef ENABLE_GSSAPI
+	       "- GSS-API authentication\n"
+#endif
+#ifdef ENABLE_NATT
+	       "- NAT Traversal\n"
+#endif
+#ifdef ENABLE_STATS
+	       "- Timing statistics\n"
 #endif
 #ifdef ENABLE_ADMINPORT
-		"[-a (port)] "
-#else
-		""
+	       "- Admin port\n"
 #endif
-		);
-	printf("   -B: install SA to the kernel from the file "
-		"specified by the configuration file.\n");
-	printf("   -d: debug level, more -d will generate more debug message.\n");
-	printf("   -C: dump parsed config file.\n");
-	printf("   -L: include location in debug messages\n");
-	printf("   -F: run in foreground, do not become daemon.\n");
-	printf("   -v: be more verbose\n");
-#ifdef INET6
-	printf("   -4: IPv4 mode.\n");
-	printf("   -6: IPv6 mode.\n");
+#ifdef HAVE_CLOCK_MONOTONIC
+	       "- Monotonic clock\n"
 #endif
-#ifdef ENABLE_ADMINPORT
-	printf("   -a: port number for admin port.\n");
-#endif
-	printf("   -f: pathname for configuration file.\n");
-	printf("   -l: pathname for log file.\n");
-	printf("   -p: port number for isakmp (default: %d).\n", PORT_ISAKMP);
-	printf("   -P: port number for NAT-T (default: %d).\n", PORT_ISAKMP_NATT);
-	exit(1);
-}
-
-int
-main(ac, av)
-	int ac;
-	char **av;
-{
-	int error;
-
-	if (geteuid() != 0) {
-		errx(1, "must be root to invoke this program.");
-		/* NOTREACHED*/
-	}
-
-	/*
-	 * Don't let anyone read files I write.  Although some files (such as
-	 * the PID file) can be other readable, we dare to use the global mask,
-	 * because racoon uses fopen(3), which can't specify the permission
-	 * at the creation time.
-	 */
-	umask(077);
-	if (umask(077) != 077) {
-		errx(1, "could not set umask");
-		/* NOTREACHED*/
-	}
-
-#ifdef DEBUG_RECORD_MALLOCATION
-	DRM_init();
-#endif
-
 #ifdef HAVE_SECCTX
-	init_avc();
+	       "- Security context\n"
 #endif
-	eay_init();
-	initlcconf();
-	initrmconf();
-	oakley_dhinit();
-	compute_vendorids();
-
-	parse(ac, av);
-
-	ploginit();
-
-	plog(LLV_INFO, LOCATION, NULL, "%s\n", version);
-	plog(LLV_INFO, LOCATION, NULL, "@(#)"
-	    "This product linked %s (http://www.openssl.org/)"
-	    "\n", eay_version());
-	plog(LLV_INFO, LOCATION, NULL, "Reading configuration from \"%s\"\n", 
-	    lcconf->racoon_conf);
-
-	if (pfkey_init() < 0) {
-		errx(1, "something error happened "
-			"while pfkey initializing.");
-		/* NOTREACHED*/
-	}
-
-#ifdef ENABLE_HYBRID
-	if (isakmp_cfg_init(ISAKMP_CFG_INIT_COLD))
-		errx(1, "could not initialize ISAKMP mode config structures");
-#endif
-
-#ifdef HAVE_LIBLDAP
-	if (xauth_ldap_init() != 0)
-		errx(1, "could not initialize libldap");
-#endif
-
-	/*
-	 * in order to prefer the parameters by command line,
-	 * saving some parameters before parsing configuration file.
-	 */
-	save_params();
-	error = cfparse();
-	if (error != 0)
-		errx(1, "failed to parse configuration file.");
-	restore_params();
-
-#ifdef ENABLE_HYBRID
-	if(isakmp_cfg_config.network4 && isakmp_cfg_config.pool_size == 0)
-		if ((error = isakmp_cfg_resize_pool(ISAKMP_CFG_MAX_CNX)) != 0)
-			return error;
-#endif
-
-	if (dump_config)
-		dumprmconf ();
-
-#ifdef HAVE_LIBRADIUS
-	if (xauth_radius_init() != 0) {
-		errx(1, "could not initialize libradius");
-		/* NOTREACHED*/
-	}
-#endif
-
-	/*
-	 * install SAs from the specified file.  If the file is not specified
-	 * by the configuration file, racoon will exit.
-	 */
-	if (loading_sa && !f_local) {
-		if (backupsa_from_file() != 0)
-			errx(1, "something error happened "
-				"SA recovering.");
-	}
-
-	if (f_foreground)
-		close(0);
-	else {
-		if (daemon(0, 0) < 0) {
-			errx(1, "failed to be daemon. (%s)",
-				strerror(errno));
-		}
-#ifndef __linux__
-		/*
-		 * In case somebody has started inetd manually, we need to
-		 * clear the logname, so that old servers run as root do not
-		 * get the user's logname..
-		 */
-		if (setlogin("") < 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"cannot clear logname: %s\n", strerror(errno));
-			/* no big deal if it fails.. */
-		}
-#endif
-		if (!f_local) {
-#if 0
-			if (atexit(cleanup_pidfile) < 0) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"cannot register pidfile cleanup");
-			}
-#endif
-		}
-	}
-
-	session();
-
+	       "\n",
+	       version,
+	       eay_version());
 	exit(0);
 }
 
-#if 0
 static void
-cleanup_pidfile()
+usage()
 {
-	pid_t p = getpid();
-
-	/* if it's not child process, clean everything */
-	if (racoon_pid == p) {
-		const char *pid_file = _PATH_VARRUN "racoon.pid";
-
-		(void) unlink(pid_file);
-	}
-}
+	printf("usage: racoon [-BdFv"
+#ifdef INET6
+		"46"
 #endif
+		"] [-f (file)] [-l (file)] [-p (port)] [-P (natt port)]\n"
+		"   -B: install SA to the kernel from the file "
+		"specified by the configuration file.\n"
+		"   -d: debug level, more -d will generate more debug message.\n"
+		"   -C: dump parsed config file.\n"
+		"   -L: include location in debug messages\n"
+		"   -F: run in foreground, do not become daemon.\n"
+		"   -v: be more verbose\n"
+		"   -V: print version and exit\n"
+#ifdef INET6
+		"   -4: IPv4 mode.\n"
+		"   -6: IPv6 mode.\n"
+#endif
+		"   -f: pathname for configuration file.\n"
+		"   -l: pathname for log file.\n"
+		"   -p: port number for isakmp (default: %d).\n"
+		"   -P: port number for NAT-T (default: %d).\n"
+		"\n",
+		PORT_ISAKMP, PORT_ISAKMP_NATT);
+	exit(1);
+}
 
 static void
 parse(ac, av)
@@ -305,7 +179,7 @@
 	else
 		pname = *av;
 
-	while ((c = getopt(ac, av, "dLFp:P:a:f:l:vZBC"
+	while ((c = getopt(ac, av, "dLFp:P:f:l:vVZBC"
 #ifdef YYDEBUG
 			"y"
 #endif
@@ -330,15 +204,6 @@
 		case 'P':
 			lcconf->port_isakmp_natt = atoi(optarg);
 			break;
-		case 'a':
-#ifdef ENABLE_ADMINPORT
-			lcconf->port_admin = atoi(optarg);
-			break;
-#else
-			fprintf(stderr, "%s: the option is disabled "
-			    "in the configuration\n", pname);
-			exit(1);
-#endif
 		case 'f':
 			lcconf->racoon_conf = optarg;
 			break;
@@ -348,6 +213,9 @@
 		case 'v':
 			vflag++;
 			break;
+		case 'V':
+			print_version();
+			break;
 		case 'Z':
 			/*
 			 * only local test.
@@ -393,6 +261,89 @@
 		usage();
 		/* NOTREACHED */
 	}
-
-	return;
 }
+
+int
+main(ac, av)
+	int ac;
+	char **av;
+{
+	int error;
+
+	initlcconf();
+	parse(ac, av);
+
+	if (geteuid() != 0) {
+		errx(1, "must be root to invoke this program.");
+		/* NOTREACHED*/
+	}
+
+	/*
+	 * Don't let anyone read files I write.  Although some files (such as
+	 * the PID file) can be other readable, we dare to use the global mask,
+	 * because racoon uses fopen(3), which can't specify the permission
+	 * at the creation time.
+	 */
+	umask(077);
+	if (umask(077) != 077) {
+		errx(1, "could not set umask");
+		/* NOTREACHED*/
+	}
+
+#ifdef DEBUG_RECORD_MALLOCATION
+	DRM_init();
+#endif
+
+#ifdef HAVE_SECCTX
+	init_avc();
+#endif
+	eay_init();
+	initrmconf();
+	oakley_dhinit();
+	compute_vendorids();
+
+	ploginit();
+
+	plog(LLV_INFO, LOCATION, NULL, "%s\n", version);
+	plog(LLV_INFO, LOCATION, NULL, "@(#)"
+	    "This product linked %s (http://www.openssl.org/)"
+	    "\n", eay_version());
+	plog(LLV_INFO, LOCATION, NULL, "Reading configuration from \"%s\"\n", 
+	    lcconf->racoon_conf);
+
+	/*
+	 * install SAs from the specified file.  If the file is not specified
+	 * by the configuration file, racoon will exit.
+	 */
+	if (loading_sa && !f_local) {
+		if (backupsa_from_file() != 0)
+			errx(1, "something error happened "
+				"SA recovering.");
+	}
+
+	if (f_foreground)
+		close(0);
+	else {
+		if (daemon(0, 0) < 0) {
+			errx(1, "failed to be daemon. (%s)",
+				strerror(errno));
+		}
+#ifndef __linux__
+		/*
+		 * In case somebody has started inetd manually, we need to
+		 * clear the logname, so that old servers run as root do not
+		 * get the user's logname..
+		 */
+		if (setlogin("") < 0) {
+			plog(LLV_ERROR, LOCATION, NULL,
+				"cannot clear logname: %s\n", strerror(errno));
+			/* no big deal if it fails.. */
+		}
+#endif
+	}
+
+	session();
+
+	return 0;
+}
+
diff --git a/src/racoon/misc.c b/src/racoon/misc.c
index 4daa0ed..91b8e77 100644
--- a/src/racoon/misc.c
+++ b/src/racoon/misc.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: misc.c,v 1.4.6.1 2008/07/15 00:55:48 mgrooms Exp $	*/
+/*	$NetBSD: misc.c,v 1.6 2008/07/15 00:47:09 mgrooms Exp $	*/
 
 /*	$KAME: misc.c,v 1.23 2001/08/16 14:37:29 itojun Exp $	*/
 
@@ -44,6 +44,7 @@
 #include <errno.h>
 #include <syslog.h>
 #include <ctype.h>
+#include <fcntl.h>
 
 #include "var.h"
 #include "misc.h"
@@ -154,6 +155,16 @@
 }
 
 /*
+ * set the close-on-exec flag for file descriptor fd.
+ */
+void
+close_on_exec(fd)
+	int fd;
+{
+	fcntl(fd, F_SETFD, FD_CLOEXEC);
+}
+
+/*
  * calculate the difference between two times.
  * t1: start
  * t2: end
diff --git a/src/racoon/misc.h b/src/racoon/misc.h
index 66e42b1..3e758d9 100644
--- a/src/racoon/misc.h
+++ b/src/racoon/misc.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: misc.h,v 1.4.6.1 2008/07/15 00:55:48 mgrooms Exp $	*/
+/*	$NetBSD: misc.h,v 1.6 2008/07/15 00:47:09 mgrooms Exp $	*/
 
 /* Id: misc.h,v 1.9 2006/04/06 14:00:06 manubsd Exp */
 
@@ -50,6 +50,7 @@
 struct timeval;
 extern double timedelta __P((struct timeval *, struct timeval *));
 char *strdup __P((const char *));
+extern void close_on_exec __P((int fd));
 
 #if defined(__APPLE__) && defined(__MACH__)
 #define RACOON_TAILQ_FOREACH_REVERSE(var, head, headname ,field)	\
diff --git a/src/racoon/nattraversal.c b/src/racoon/nattraversal.c
index 9fd4bcd..b04cc1b 100644
--- a/src/racoon/nattraversal.c
+++ b/src/racoon/nattraversal.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: nattraversal.c,v 1.6.6.2 2009/05/18 17:01:07 tteras Exp $	*/
+/*	$NetBSD: nattraversal.c,v 1.14 2011/03/14 17:18:13 tteras Exp $	*/
 
 /*
  * Copyright (C) 2004 SuSE Linux AG, Nuernberg, Germany.
@@ -77,6 +77,7 @@
 };
 
 static TAILQ_HEAD(_natt_ka_addrs, natt_ka_addrs) ka_tree;
+static struct sched sc_natt = SCHED_INITIALIZER();
 
 /*
  * check if the given vid is NAT-T.
@@ -126,10 +127,14 @@
   char *ptr;
   void *addr_ptr, *addr_port;
   size_t buf_size, addr_size;
+  int natt_force = 0;
+
+  if (iph1->rmconf != NULL && iph1->rmconf->nat_traversal == NATT_FORCE)
+	  natt_force = 1;
 
   plog (LLV_INFO, LOCATION, addr, "Hashing %s with algo #%d %s\n",
 	saddr2str(addr), iph1->approval->hashtype, 
-	(iph1->rmconf->nat_traversal == NATT_FORCE)?"(NAT-T forced)":"");
+	natt_force?"(NAT-T forced)":"");
   
   if (addr->sa_family == AF_INET) {
     addr_size = sizeof (struct in_addr);	/* IPv4 address */
@@ -163,7 +168,7 @@
   ptr += sizeof (cookie_t);
   
   /* Copy-in Address (or zeroes if NATT_FORCE) */
-  if (iph1->rmconf->nat_traversal == NATT_FORCE)
+  if (natt_force)
     memset (ptr, 0, addr_size);
   else
     memcpy (ptr, addr_ptr, addr_size);
@@ -186,7 +191,8 @@
   u_int32_t flag;
   int verified = 0;
 
-  if (iph1->rmconf->nat_traversal == NATT_FORCE)
+  if (iph1->rmconf != NULL &&
+      iph1->rmconf->nat_traversal == NATT_FORCE)
     return verified;
 
   if (natd_seq == 0) {
@@ -302,9 +308,28 @@
 	natt_keepalive_add_ph1 (iph1);
 }
 
+static int
+natt_is_enabled (struct remoteconf *rmconf, void *args)
+{
+  if (rmconf->nat_traversal)
+    return 1;
+  return 0;
+}
+
 void
 natt_handle_vendorid (struct ph1handle *iph1, int vid_numeric)
 {
+  if (iph1->rmconf == NULL) {
+    /* Check if any candidate remote conf allows nat-t */
+    struct rmconfselector rmconf;
+    rmconf_selector_from_ph1(&rmconf, iph1);
+    if (enumrmconf(&rmconf, natt_is_enabled, NULL) == 0)
+      return;
+  } else {
+    if (!iph1->rmconf->nat_traversal)
+      return;
+  }
+
   if (! iph1->natt_options)
     iph1->natt_options = racoon_calloc (1, sizeof (*iph1->natt_options));
 
@@ -330,7 +355,7 @@
 
 /* NAT keepalive functions */
 static void
-natt_keepalive_send (void *param)
+natt_keepalive_send (struct sched *param)
 {
   struct natt_ka_addrs	*ka, *next = NULL;
   char keepalive_packet[] = { 0xff };
@@ -340,7 +365,7 @@
   for (ka = TAILQ_FIRST(&ka_tree); ka; ka = next) {
     next = TAILQ_NEXT(ka, chain);
     
-    s = getsockmyaddr(ka->src);
+    s = myaddr_getfd(ka->src);
     if (s == -1) {
       natt_keepalive_delete(ka);
       continue;
@@ -354,7 +379,7 @@
 	   strerror (errno));
   }
   
-  sched_new (lcconf->natt_ka_interval, natt_keepalive_send, NULL);
+  sched_schedule (&sc_natt, lcconf->natt_ka_interval, natt_keepalive_send);
 }
 
 void
@@ -364,7 +389,7 @@
 
   /* To disable sending KAs set natt_ka_interval=0 */
   if (lcconf->natt_ka_interval > 0)
-    sched_new (lcconf->natt_ka_interval, natt_keepalive_send, NULL);
+    sched_schedule (&sc_natt, lcconf->natt_ka_interval, natt_keepalive_send);
 }
 
 int
@@ -373,8 +398,8 @@
   struct natt_ka_addrs *ka = NULL, *new_addr;
   
   TAILQ_FOREACH (ka, &ka_tree, chain) {
-    if (cmpsaddrstrict(ka->src, src) == 0 && 
-	cmpsaddrstrict(ka->dst, dst) == 0) {
+    if (cmpsaddr(ka->src, src) == CMPSADDR_MATCH &&
+	cmpsaddr(ka->dst, dst) == CMPSADDR_MATCH) {
       ka->in_use++;
       plog (LLV_INFO, LOCATION, NULL, "KA found: %s (in_use=%u)\n",
 	    saddr2str_fromto("%s->%s", src, dst), ka->in_use);
@@ -437,8 +462,8 @@
     plog (LLV_DEBUG, LOCATION, NULL, "KA tree dump: %s (in_use=%u)\n",
 	  saddr2str_fromto("%s->%s", src, dst), ka->in_use);
 
-    if (cmpsaddrstrict(ka->src, src) == 0 && 
-	cmpsaddrstrict(ka->dst, dst) == 0 &&
+    if (cmpsaddr(ka->src, src) == CMPSADDR_MATCH &&
+	cmpsaddr(ka->dst, dst) == CMPSADDR_MATCH &&
 	-- ka->in_use <= 0) {
 
       plog (LLV_DEBUG, LOCATION, NULL, "KA removing this one...\n");
@@ -451,16 +476,16 @@
   }
 }
 
-static struct remoteconf *
+static int
 natt_enabled_in_rmconf_stub (struct remoteconf *rmconf, void *data)
 {
-  return (rmconf->nat_traversal ? rmconf : NULL);
+  return rmconf->nat_traversal ? 1 : 0;
 }
 
 int
 natt_enabled_in_rmconf ()
 {
-  return foreachrmconf (natt_enabled_in_rmconf_stub, NULL) != NULL;
+  return enumrmconf(NULL, natt_enabled_in_rmconf_stub, NULL) != 0;
 }
 
 
diff --git a/src/racoon/nattraversal.h b/src/racoon/nattraversal.h
index cec5815..3b0b03b 100644
--- a/src/racoon/nattraversal.h
+++ b/src/racoon/nattraversal.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: nattraversal.h,v 1.6 2006/09/09 16:22:09 manu Exp $	*/
+/*	$NetBSD: nattraversal.h,v 1.7 2010/09/22 07:34:51 vanhu Exp $	*/
 
 /*
  * Copyright (C) 2004 SuSE Linux AG, Nuernberg, Germany.
@@ -42,12 +42,12 @@
 #define	NAT_KA_QUEUED		(1L<<4)
 #define	NAT_ADD_NON_ESP_MARKER	(1L<<5)
 
-#define	NATT_AVAILABLE(ph1)	((iph1)->natt_flags & NAT_ANNOUNCED)
+#define	NATT_AVAILABLE(_ph1)	((_ph1)->natt_flags & NAT_ANNOUNCED)
 
 #define	NAT_DETECTED	(NAT_DETECTED_ME | NAT_DETECTED_PEER)
 
 #define	NON_ESP_MARKER_LEN	sizeof(u_int32_t)
-#define	NON_ESP_MARKER_USE(iph1)	((iph1)->natt_flags & NAT_ADD_NON_ESP_MARKER)
+#define	NON_ESP_MARKER_USE(_ph1)	((_ph1)->natt_flags & NAT_ADD_NON_ESP_MARKER)
 
 /* These are the values from parsing "remote {}" 
    block of the config file. */
diff --git a/src/racoon/oakley.c b/src/racoon/oakley.c
index 183ac2f..4a106df 100644
--- a/src/racoon/oakley.c
+++ b/src/racoon/oakley.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: oakley.c,v 1.9.6.4 2009/08/13 09:18:45 vanhu Exp $	*/
+/*	$NetBSD: oakley.c,v 1.22 2011/03/17 14:42:58 vanhu Exp $	*/
 
 /* Id: oakley.c,v 1.32 2006/05/26 12:19:46 manubsd Exp */
 
@@ -123,13 +123,63 @@
 
 static int oakley_check_dh_pub __P((vchar_t *, vchar_t **));
 static int oakley_compute_keymat_x __P((struct ph2handle *, int, int));
-static int get_cert_fromlocal __P((struct ph1handle *, int));
-static int get_plainrsa_fromlocal __P((struct ph1handle *, int));
 static int oakley_check_certid __P((struct ph1handle *iph1));
 static int check_typeofcertname __P((int, int));
-static cert_t *save_certbuf __P((struct isakmp_gen *));
-static cert_t *save_certx509 __P((X509 *));
 static int oakley_padlen __P((int, int));
+static int get_plainrsa_fromlocal __P((struct ph1handle *, int));
+
+int oakley_get_certtype(cert)
+	vchar_t *cert;
+{
+	if (cert == NULL)
+		return ISAKMP_CERT_NONE;
+
+	return cert->v[0];
+}
+
+static vchar_t *
+dump_isakmp_payload(gen)
+	struct isakmp_gen *gen;
+{
+	vchar_t p;
+
+	if (ntohs(gen->len) <= sizeof(*gen)) {
+		plog(LLV_ERROR, LOCATION, NULL,
+		     "Len is too small !!.\n");
+		return NULL;
+	}
+
+	p.v = (caddr_t) (gen + 1);
+	p.l = ntohs(gen->len) - sizeof(*gen);
+
+	return vdup(&p);
+}
+
+static vchar_t *
+dump_x509(cert)
+	X509 *cert;
+{
+	vchar_t *pl;
+	u_char *bp;
+	int len;
+
+	len = i2d_X509(cert, NULL);
+
+	pl = vmalloc(len + 1);
+	if (pl == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL,
+		     "Failed to copy CERT from packet.\n");
+		return NULL;
+	}
+
+	pl->v[0] = ISAKMP_CERT_X509SIGN;
+	bp = (u_char *) &pl->v[1];
+	i2d_X509(cert, &bp);
+
+	return pl;
+}
+
+
 
 int
 oakley_get_defaultlifetime()
@@ -418,7 +468,7 @@
 	res = alg_oakley_hashdef_one(type, buf);
 	if (res == NULL) {
 		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid hash algoriym %d.\n", type);
+			"invalid hash algorithm %d.\n", type);
 		return NULL;
 	}
 
@@ -858,7 +908,7 @@
 		+ (sw == GENERATE ? iph1->id->l : iph1->id_p->l);
 
 #ifdef HAVE_GSSAPI
-	if (AUTHMETHOD(iph1) == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB) {
+	if (iph1->approval->authmethod == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB) {
 		if (iph1->gi_i != NULL && iph1->gi_r != NULL) {
 			bp = (sw == GENERATE ? iph1->gi_i : iph1->gi_r);
 			len += bp->l;
@@ -919,7 +969,7 @@
 	p += bp->l;
 
 #ifdef HAVE_GSSAPI
-	if (AUTHMETHOD(iph1) == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB) {
+	if (iph1->approval->authmethod == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB) {
 		if (iph1->gi_i != NULL && iph1->gi_r != NULL) {
 			bp = (sw == GENERATE ? iph1->gi_i : iph1->gi_r);
 			memcpy(p, bp->v, bp->l);
@@ -980,7 +1030,7 @@
 		return NULL;
 	}
 
-	switch (AUTHMETHOD(iph1)) {
+	switch (iph1->approval->authmethod) {
 	case OAKLEY_ATTR_AUTH_METHOD_PSKEY:
 	case OAKLEY_ATTR_AUTH_METHOD_RSAENC:
 	case OAKLEY_ATTR_AUTH_METHOD_RSAREV:
@@ -989,7 +1039,7 @@
 	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_R:
 	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_I:
 	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_R:
-	case FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I:
+	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I:
 	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
 #endif
 		if (iph1->skeyid == NULL) {
@@ -1121,7 +1171,7 @@
 		return NULL;
 	}
 
-	switch(AUTHMETHOD(iph1)) {
+	switch (iph1->approval->authmethod) {
 	case OAKLEY_ATTR_AUTH_METHOD_DSSSIG:
 	case OAKLEY_ATTR_AUTH_METHOD_RSASIG:
 #ifdef ENABLE_HYBRID
@@ -1133,7 +1183,7 @@
 	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R:
 	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I:
 	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R:
-	case FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I:
+	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I:
 #endif
 		break;
 	default:
@@ -1249,10 +1299,10 @@
 	gettimeofday(&start, NULL);
 #endif
 
-	switch (AUTHMETHOD(iph1)) {
+	switch (iph1->approval->authmethod) {
 	case OAKLEY_ATTR_AUTH_METHOD_PSKEY:
 #ifdef ENABLE_HYBRID
-	case FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I:
+	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I:
 	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
 #endif
 		/* validate HASH */
@@ -1265,7 +1315,7 @@
 			return ISAKMP_NTYPE_PAYLOAD_MALFORMED;
 		}
 #ifdef ENABLE_HYBRID
-		if (AUTHMETHOD(iph1) == FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I &&
+		if (iph1->approval->authmethod == OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I &&
 		    ((iph1->mode_cfg->flags & ISAKMP_CFG_VENDORID_XAUTH) == 0))
 		{
 			plog(LLV_ERROR, LOCATION, NULL, "No SIG was passed, "
@@ -1323,7 +1373,7 @@
 #endif
 	    {
 		int error = 0;
-		int certtype = 0;
+		int certtype;
 
 		/* validation */
 		if (iph1->id_p == NULL) {
@@ -1341,132 +1391,104 @@
 		plogdump(LLV_DEBUG, iph1->sig_p->v, iph1->sig_p->l);
 
 		/* get peer's cert */
-		switch (iph1->rmconf->getcert_method) {
-		case ISAKMP_GETCERT_PAYLOAD:
+		certtype = oakley_get_certtype(iph1->rmconf->peerscert);
+		switch (certtype) {
+		case ISAKMP_CERT_NONE:
+			/* expect to receive one from peer */
 			if (iph1->cert_p == NULL) {
 				plog(LLV_ERROR, LOCATION, NULL,
-					"no peer's CERT payload found.\n");
+				     "no peer's CERT payload found.\n");
 				return ISAKMP_INTERNAL_ERROR;
 			}
-			break;
-		case ISAKMP_GETCERT_LOCALFILE:
-			switch (iph1->rmconf->certtype) {
-				case ISAKMP_CERT_X509SIGN:
-					if (iph1->rmconf->peerscertfile == NULL) {
-						plog(LLV_ERROR, LOCATION, NULL,
-							"no peer's CERT file found.\n");
-						return ISAKMP_INTERNAL_ERROR;
-					}
+			/* verify the cert if needed */
+			if (!iph1->rmconf->verify_cert)
+				break;
 
-					/* don't use cached cert */
-					if (iph1->cert_p != NULL) {
-						oakley_delcert(iph1->cert_p);
-						iph1->cert_p = NULL;
-					}
+			switch (oakley_get_certtype(iph1->cert_p)) {
+			case ISAKMP_CERT_X509SIGN: {
+				char path[MAXPATHLEN];
+				char *ca;
 
-					error = get_cert_fromlocal(iph1, 0);
-#ifdef ANDROID_PATCHED
-					if (!error)
-						break;
-				default:
-					return ISAKMP_INTERNAL_ERROR;
-#else
-					break;
+				if (iph1->rmconf->cacertfile != NULL) {
+					getpathname(path, sizeof(path),
+						    LC_PATHTYPE_CERT,
+						    iph1->rmconf->cacertfile);
+					ca = path;
+				} else {
+					ca = NULL;
+				}
 
-				case ISAKMP_CERT_PLAINRSA:
-					error = get_plainrsa_fromlocal(iph1, 0);
-					break;
-			}
-			if (error)
-				return ISAKMP_INTERNAL_ERROR;
-			break;
-		case ISAKMP_GETCERT_DNS:
-			if (iph1->rmconf->peerscertfile != NULL) {
+				error = eay_check_x509cert(
+					iph1->cert_p,
+					lcconf->pathinfo[LC_PATHTYPE_CERT],
+					ca, 0);
+				break;
+				}
+			default:
 				plog(LLV_ERROR, LOCATION, NULL,
-					"why peer's CERT file is defined "
-					"though getcert method is dns ?\n");
+					"peers_cert certtype %d was not expected\n",
+					certtype);
 				return ISAKMP_INTERNAL_ERROR;
 			}
 
-			/* don't use cached cert */
+			if (error != 0) {
+				plog(LLV_ERROR, LOCATION, NULL,
+				     "the peer's certificate is not verified.\n");
+				return ISAKMP_NTYPE_INVALID_CERT_AUTHORITY;
+			}
+			break;
+		case ISAKMP_CERT_X509SIGN:
+			if (iph1->rmconf->peerscert == NULL) {
+				plog(LLV_ERROR, LOCATION, NULL,
+				     "no peer's CERT file found.\n");
+				return ISAKMP_INTERNAL_ERROR;
+			}
+			/* don't use received cert */
 			if (iph1->cert_p != NULL) {
-				oakley_delcert(iph1->cert_p);
+				vfree(iph1->cert_p);
+				iph1->cert_p = NULL;
+			}
+			/* copy from remoteconf instead */
+			iph1->cert_p = vdup(iph1->rmconf->peerscert);
+			break;
+#ifndef ANDROID_PATCHED
+		case ISAKMP_CERT_PLAINRSA:
+			if (get_plainrsa_fromlocal(iph1, 0))
+				return ISAKMP_INTERNAL_ERROR;
+			break;
+		case ISAKMP_CERT_DNS:
+			/* don't use received cert */
+			if (iph1->cert_p != NULL) {
+				vfree(iph1->cert_p);
 				iph1->cert_p = NULL;
 			}
 
 			iph1->cert_p = dnssec_getcert(iph1->id_p);
 			if (iph1->cert_p == NULL) {
 				plog(LLV_ERROR, LOCATION, NULL,
-					"no CERT RR found.\n");
+				     "no CERT RR found.\n");
 				return ISAKMP_INTERNAL_ERROR;
-#endif
 			}
 			break;
+#endif
 		default:
 			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid getcert_mothod: %d\n",
-				iph1->rmconf->getcert_method);
+			     "invalid certificate type: %d\n",
+			     oakley_get_certtype(iph1->rmconf->peerscert));
 			return ISAKMP_INTERNAL_ERROR;
 		}
 
 		/* compare ID payload and certificate name */
-		if (iph1->rmconf->verify_cert &&
-		    (error = oakley_check_certid(iph1)) != 0)
+		if ((error = oakley_check_certid(iph1)) != 0)
 			return error;
 
-		/* verify certificate */
-		if (iph1->rmconf->verify_cert
-		 && iph1->rmconf->getcert_method == ISAKMP_GETCERT_PAYLOAD) {
-			certtype = iph1->rmconf->certtype;
-#ifdef ENABLE_HYBRID
-			switch (AUTHMETHOD(iph1)) {
-			case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
-			case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
-				certtype = iph1->cert_p->type;
-				break;
-			default:
-				break;
-			}
-#endif
-			switch (certtype) {
-			case ISAKMP_CERT_X509SIGN: {
-				char path[MAXPATHLEN];
-				char *ca;
-
-				if (iph1->rmconf->cacertfile != NULL) {
-					getpathname(path, sizeof(path), 
-					    LC_PATHTYPE_CERT, 
-					    iph1->rmconf->cacertfile);
-					ca = path;
-				} else {
-					ca = NULL;
-				}
-
-				error = eay_check_x509cert(&iph1->cert_p->cert,
-					lcconf->pathinfo[LC_PATHTYPE_CERT], 
-					ca, 0);
-				break;
-			}
-			
-			default:
-				plog(LLV_ERROR, LOCATION, NULL,
-					"no supported certtype %d\n", certtype);
-				return ISAKMP_INTERNAL_ERROR;
-			}
-			if (error != 0) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"the peer's certificate is not verified.\n");
-				return ISAKMP_NTYPE_INVALID_CERT_AUTHORITY;
-			}
-		}
-	
-		/* Generate a warning if verify_cert == 0
-		 */
-		if (iph1->rmconf->verify_cert){
-			plog(LLV_DEBUG, LOCATION, NULL, "CERT validated\n");
-		}else{
+		/* Generate a warning if verify_cert */
+		if (iph1->rmconf->verify_cert) {
+			plog(LLV_DEBUG, LOCATION, NULL,
+			     "CERT validated\n");
+		} else {
 			plog(LLV_WARNING, LOCATION, NULL,
-				"CERT validation disabled by configuration\n");
+			     "CERT validation disabled by configuration\n");
 		}
 
 		/* compute hash */
@@ -1489,38 +1511,30 @@
 		if (my_hash == NULL)
 			return ISAKMP_INTERNAL_ERROR;
 
-
-		certtype = iph1->rmconf->certtype;
-#ifdef ENABLE_HYBRID
-		switch (AUTHMETHOD(iph1)) {
-		case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
-		case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
-			certtype = iph1->cert_p->type;
-			break;
-		default:
-			break;
-		}
-#endif
 		/* check signature */
+		certtype = oakley_get_certtype(iph1->cert_p);
+		if (certtype == ISAKMP_CERT_NONE)
+			certtype = oakley_get_certtype(iph1->rmconf->peerscert);
 		switch (certtype) {
 		case ISAKMP_CERT_X509SIGN:
 		case ISAKMP_CERT_DNS:
 			error = eay_check_x509sign(my_hash,
-					iph1->sig_p,
-					&iph1->cert_p->cert);
+						   iph1->sig_p,
+						   iph1->cert_p);
 			break;
 #ifndef ANDROID_PATCHED
 		case ISAKMP_CERT_PLAINRSA:
 			iph1->rsa_p = rsa_try_check_rsasign(my_hash,
 					iph1->sig_p, iph1->rsa_candidates);
 			error = iph1->rsa_p ? 0 : -1;
-
+			genlist_free(iph1->rsa_candidates, NULL);
+			iph1->rsa_candidates = NULL;
 			break;
 #endif
 		default:
 			plog(LLV_ERROR, LOCATION, NULL,
-				"no supported certtype %d\n",
-				certtype);
+			     "cannot check signature for certtype %d\n",
+			     certtype);
 			vfree(my_hash);
 			return ISAKMP_INTERNAL_ERROR;
 		}
@@ -1634,115 +1648,26 @@
 oakley_getmycert(iph1)
 	struct ph1handle *iph1;
 {
-	switch (iph1->rmconf->certtype) {
-		case ISAKMP_CERT_X509SIGN:
-			if (iph1->cert)
-				return 0;
-			return get_cert_fromlocal(iph1, 1);
-
-#ifndef ANDROID_PATCHED
-		case ISAKMP_CERT_PLAINRSA:
-			if (iph1->rsa)
-				return 0;
-			return get_plainrsa_fromlocal(iph1, 1);
-#endif
-
-		default:
-			plog(LLV_ERROR, LOCATION, NULL,
-			     "Unknown certtype #%d\n",
-			     iph1->rmconf->certtype);
-			return -1;
-	}
-
-}
-
-/*
- * get a CERT from local file.
- * IN:
- *	my != 0 my cert.
- *	my == 0 peer's cert.
- */
-static int
-get_cert_fromlocal(iph1, my)
-	struct ph1handle *iph1;
-	int my;
-{
-	char path[MAXPATHLEN];
-	vchar_t *cert = NULL;
-	cert_t **certpl;
-	char *certfile;
-	int error = -1;
-
-	if (my) {
-		certfile = iph1->rmconf->mycertfile;
-		certpl = &iph1->cert;
-	} else {
-		certfile = iph1->rmconf->peerscertfile;
-		certpl = &iph1->cert_p;
-	}
-	if (!certfile) {
-		plog(LLV_ERROR, LOCATION, NULL, "no CERT defined.\n");
-		return 0;
-	}
-
-	switch (iph1->rmconf->certtype) {
+	switch (oakley_get_certtype(iph1->rmconf->mycert)) {
 	case ISAKMP_CERT_X509SIGN:
-	case ISAKMP_CERT_DNS:
-		/* make public file name */
-		getpathname(path, sizeof(path), LC_PATHTYPE_CERT, certfile);
-		cert = eay_get_x509cert(path);
-		if (cert) {
-			char *p = NULL;
-			p = eay_get_x509text(cert);
-			plog(LLV_DEBUG, LOCATION, NULL, "%s", p ? p : "\n");
-			racoon_free(p);
-		};
+		if (iph1->cert)
+			return 0;
+		iph1->cert = vdup(iph1->rmconf->mycert);
 		break;
-
+#ifndef ANDROID_PATCHED
+	case ISAKMP_CERT_PLAINRSA:
+		if (iph1->rsa)
+			return 0;
+		return get_plainrsa_fromlocal(iph1, 1);
+#endif
 	default:
 		plog(LLV_ERROR, LOCATION, NULL,
-			"not supported certtype %d\n",
-			iph1->rmconf->certtype);
-		goto end;
+		     "Unknown certtype #%d\n",
+		     oakley_get_certtype(iph1->rmconf->mycert));
+		return -1;
 	}
 
-	if (!cert) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get %s CERT.\n",
-			my ? "my" : "peers");
-		goto end;
-	}
-
-	*certpl = oakley_newcert();
-	if (!*certpl) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get cert buffer.\n");
-		goto end;
-	}
-	(*certpl)->pl = vmalloc(cert->l + 1);
-	if ((*certpl)->pl == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get cert buffer\n");
-		oakley_delcert(*certpl);
-		*certpl = NULL;
-		goto end;
-	}
-	memcpy((*certpl)->pl->v + 1, cert->v, cert->l);
-	(*certpl)->pl->v[0] = iph1->rmconf->certtype;
-	(*certpl)->type = iph1->rmconf->certtype;
-	(*certpl)->cert.v = (*certpl)->pl->v + 1;
-	(*certpl)->cert.l = (*certpl)->pl->l - 1;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "created CERT payload:\n");
-	plogdump(LLV_DEBUG, (*certpl)->pl->v, (*certpl)->pl->l);
-
-	error = 0;
-
-end:
-	if (cert != NULL)
-		vfree(cert);
-
-	return error;
+	return 0;
 }
 
 #ifndef ANDROID_PATCHED
@@ -1808,7 +1733,7 @@
 	vchar_t *privkey = NULL;
 	int error = -1;
 
-	switch (iph1->rmconf->certtype) {
+	switch (oakley_get_certtype(iph1->rmconf->mycert)) {
 	case ISAKMP_CERT_X509SIGN:
 	case ISAKMP_CERT_DNS:
 		if (iph1->rmconf->myprivfile == NULL) {
@@ -1828,7 +1753,6 @@
 		}
 		plog(LLV_DEBUG2, LOCATION, NULL, "private key:\n");
 		plogdump(LLV_DEBUG2, privkey->v, privkey->l);
-
 		iph1->sig = eay_get_x509sign(iph1->hash, privkey);
 		break;
 #ifndef ANDROID_PATCHED
@@ -1839,7 +1763,7 @@
 	default:
 		plog(LLV_ERROR, LOCATION, NULL,
 		     "Unknown certtype #%d\n",
-		     iph1->rmconf->certtype);
+		     oakley_get_certtype(iph1->rmconf->mycert));
 		goto end;
 	}
 
@@ -1873,8 +1797,11 @@
 	int idlen, type;
 	int error;
 
+	if (iph1->rmconf == NULL || iph1->rmconf->verify_cert == FALSE)
+		return 0;
+
 	if (iph1->id_p == NULL || iph1->cert_p == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "no ID nor CERT found.\n");
+		plog(LLV_ERROR, LOCATION, iph1->remote, "no ID nor CERT found.\n");
 		return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
 	}
 
@@ -1883,27 +1810,30 @@
 
 	switch (id_b->type) {
 	case IPSECDOI_ID_DER_ASN1_DN:
-		name = eay_get_x509asn1subjectname(&iph1->cert_p->cert);
+		name = eay_get_x509asn1subjectname(iph1->cert_p);
 		if (!name) {
-			plog(LLV_ERROR, LOCATION, NULL,
+			plog(LLV_ERROR, LOCATION, iph1->remote,
 				"failed to get subjectName\n");
 			return ISAKMP_NTYPE_INVALID_CERTIFICATE;
 		}
 		if (idlen != name->l) {
-			plog(LLV_ERROR, LOCATION, NULL,
+			plog(LLV_ERROR, LOCATION, iph1->remote,
 				"Invalid ID length in phase 1.\n");
 			vfree(name);
 			return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
 		}
 		error = memcmp(id_b + 1, name->v, idlen);
-		vfree(name);
 		if (error != 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
+			plog(LLV_ERROR, LOCATION, iph1->remote,
 				"ID mismatched with ASN1 SubjectName.\n");
 			plogdump(LLV_DEBUG, id_b + 1, idlen);
 			plogdump(LLV_DEBUG, name->v, idlen);
-			return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
+			if (iph1->rmconf->verify_identifier) {
+				vfree(name);
+				return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
+			}
 		}
+		vfree(name);
 		return 0;
 	case IPSECDOI_ID_IPV4_ADDR:
 	case IPSECDOI_ID_IPV6_ADDR:
@@ -1918,7 +1848,7 @@
 		int pos;
 
 		for (pos = 1; ; pos++) {
-			if (eay_get_x509subjectaltname(&iph1->cert_p->cert,
+			if (eay_get_x509subjectaltname(iph1->cert_p,
 					&altname, &type, pos) !=0) {
 				plog(LLV_ERROR, LOCATION, NULL,
 					"failed to get subjectAltName\n");
@@ -1944,10 +1874,11 @@
 		hints.ai_socktype = SOCK_RAW;
 		hints.ai_flags = AI_NUMERICHOST;
 		error = getaddrinfo(altname, NULL, &hints, &res);
+		racoon_free(altname);
+		altname = NULL;
 		if (error != 0) {
 			plog(LLV_ERROR, LOCATION, NULL,
 				"no proper subjectAltName.\n");
-			racoon_free(altname);
 			return ISAKMP_NTYPE_INVALID_CERTIFICATE;
 		}
 		switch (res->ai_family) {
@@ -1962,7 +1893,6 @@
 		default:
 			plog(LLV_ERROR, LOCATION, NULL,
 				"family not supported: %d.\n", res->ai_family);
-			racoon_free(altname);
 			freeaddrinfo(res);
 			return ISAKMP_NTYPE_INVALID_CERTIFICATE;
 		}
@@ -1974,7 +1904,8 @@
 				"ID mismatched with subjectAltName.\n");
 			plogdump(LLV_DEBUG, id_b + 1, idlen);
 			plogdump(LLV_DEBUG, a, idlen);
-			return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
+			if (iph1->rmconf->verify_identifier)
+				return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
 		}
 		return 0;
 	}
@@ -1984,7 +1915,7 @@
 		int pos;
 
 		for (pos = 1; ; pos++) {
-			if (eay_get_x509subjectaltname(&iph1->cert_p->cert,
+			if (eay_get_x509subjectaltname(iph1->cert_p,
 					&altname, &type, pos) != 0){
 				plog(LLV_ERROR, LOCATION, NULL,
 					"failed to get subjectAltName\n");
@@ -2078,7 +2009,7 @@
 	struct ph1handle *iph1;
 	struct isakmp_gen *gen;
 {
-	cert_t **c;
+	vchar_t **c;
 	u_int8_t type;
 	STACK_OF(X509) *certs=NULL;
 	PKCS7 *p7;
@@ -2173,7 +2104,7 @@
 			     "Trying PKCS#7 cert %d.\n", i);
 
 			/* We'll just try each cert in turn */
-			*c = save_certx509(cert);
+			*c = dump_x509(cert);
 
 			if (!*c) {
 				plog(LLV_ERROR, LOCATION, NULL,
@@ -2185,19 +2116,18 @@
 			 * XXX If verify cert is disabled, we still just take
 			 * the first certificate....
 			 */
-			if(iph1->rmconf->verify_cert &&
-			   oakley_check_certid(iph1)) {
+			if (oakley_check_certid(iph1)) {
 				plog(LLV_DEBUG, LOCATION, NULL,
 				     "Discarding CERT: does not match ID.\n");
-				oakley_delcert((*c));
+				vfree((*c));
 				*c = NULL;
 				continue;
 			}
 
 			{
-				char *p = eay_get_x509text(&(*c)->cert);
+				char *p = eay_get_x509text(*c);
 				plog(LLV_DEBUG, LOCATION, NULL, "CERT saved:\n");
-				plogdump(LLV_DEBUG, (*c)->cert.v, (*c)->cert.l);
+				plogdump(LLV_DEBUG, (*c)->v, (*c)->l);
 				plog(LLV_DEBUG, LOCATION, NULL, "%s", 
 				     p ? p : "\n");
 				racoon_free(p);
@@ -2205,21 +2135,15 @@
 			break;
 		}
 		PKCS7_free(p7);
-
 	} else {
-		*c = save_certbuf(gen);
+		*c = dump_isakmp_payload(gen);
 		if (!*c) {
 			plog(LLV_ERROR, LOCATION, NULL,
 			     "Failed to get CERT buffer.\n");
 			return -1;
 		}
 
-		switch ((*c)->type) {
-		case ISAKMP_CERT_DNS:
-			plog(LLV_WARNING, LOCATION, NULL,
-			     "CERT payload is unnecessary in DNSSEC. "
-			     "ignore it.\n");
-			return 0;
+		switch (type) {
 		case ISAKMP_CERT_PGP:
 		case ISAKMP_CERT_X509SIGN:
 		case ISAKMP_CERT_KERBEROS:
@@ -2228,33 +2152,32 @@
 			 * XXX If verify cert is disabled, we still just take
 			 * the first certificate....
 			 */
-			if(iph1->rmconf->verify_cert &&
-			   oakley_check_certid(iph1)){
+			if (oakley_check_certid(iph1)){
 				plog(LLV_DEBUG, LOCATION, NULL,
 				     "Discarding CERT: does not match ID.\n");
-				oakley_delcert((*c));
+				vfree((*c));
 				*c = NULL;
 				return 0;
 			}
 
 			{
-				char *p = eay_get_x509text(&(*c)->cert);
+				char *p = eay_get_x509text(*c);
 				plog(LLV_DEBUG, LOCATION, NULL, "CERT saved:\n");
-				plogdump(LLV_DEBUG, (*c)->cert.v, (*c)->cert.l);
+				plogdump(LLV_DEBUG, (*c)->v, (*c)->l);
 				plog(LLV_DEBUG, LOCATION, NULL, "%s", p ? p : "\n");
 				racoon_free(p);
 			}
 			break;
 		case ISAKMP_CERT_CRL:
 			plog(LLV_DEBUG, LOCATION, NULL, "CRL saved:\n");
-			plogdump(LLV_DEBUG, (*c)->cert.v, (*c)->cert.l);
+			plogdump(LLV_DEBUG, (*c)->v, (*c)->l);
 			break;
 		case ISAKMP_CERT_X509KE:
 		case ISAKMP_CERT_X509ATTR:
 		case ISAKMP_CERT_ARL:
 		default:
 			/* XXX */
-			oakley_delcert((*c));
+			vfree(*c);
 			*c = NULL;
 			return 0;
 		}
@@ -2271,11 +2194,11 @@
 	struct ph1handle *iph1;
 	struct isakmp_gen *gen;
 {
-	cert_t **c;
+	vchar_t *cert;
+	vchar_t **c;
 	u_int8_t type;
 
 	type = *(u_int8_t *)(gen + 1) & 0xff;
-
 	switch (type) {
 	case ISAKMP_CERT_DNS:
 		plog(LLV_WARNING, LOCATION, NULL,
@@ -2301,119 +2224,109 @@
 		return -1;
 	}
 
-	*c = save_certbuf(gen);
-	if (!*c) {
+	/* Already found an acceptable CR? */
+	if (*c != NULL)
+		return 0;
+
+	cert = dump_isakmp_payload(gen);
+	if (cert == NULL) {
 		plog(LLV_ERROR, LOCATION, NULL,
 			"Failed to get CR buffer.\n");
 		return -1;
 	}
 
-	plog(LLV_DEBUG, LOCATION, NULL, "CR saved:\n");
-	plogdump(LLV_DEBUG, (*c)->cert.v, (*c)->cert.l);
+	plog(LLV_DEBUG, LOCATION, NULL, "CR received:\n");
+	plogdump(LLV_DEBUG, cert->v, cert->l);
 
+	*c = cert;
+	if (resolveph1rmconf(iph1) == 0) {
+		/* Found unique match */
+		plog(LLV_DEBUG, LOCATION, NULL, "CR saved.\n");
+	} else {
+		/* Still ambiguous or matches nothing, ignore this CR */
+		*c = NULL;
+		vfree(cert);
+	}
 	return 0;
 }
 
-static cert_t *
-save_certbuf(gen)
-	struct isakmp_gen *gen;
+/*
+ * Add a single CR.
+ */
+struct append_cr_ctx {
+	struct ph1handle *iph1;
+	struct payload_list *plist;
+};
+
+static int
+oakley_append_rmconf_cr(rmconf, ctx)
+	struct remoteconf *rmconf;
+	void *ctx;
 {
-	cert_t *new;
+	struct append_cr_ctx *actx = (struct append_cr_ctx *) ctx;
+	vchar_t *buf, *asn1dn = NULL;
+	int type;
 
-	if(ntohs(gen->len) <= sizeof(*gen)){
-		plog(LLV_ERROR, LOCATION, NULL,
-			 "Len is too small !!.\n");
-		return NULL;
+	/* Do we want to send CR about this? */
+	if (rmconf->send_cr == FALSE)
+		return 0;
+
+	if (rmconf->peerscert != NULL) {
+		type = oakley_get_certtype(rmconf->peerscert);
+		asn1dn = eay_get_x509asn1issuername(rmconf->peerscert);
+	} else if (rmconf->cacert != NULL) {
+		type = oakley_get_certtype(rmconf->cacert);
+		asn1dn = eay_get_x509asn1subjectname(rmconf->cacert);
+	} else
+		return 0;
+
+	if (asn1dn == NULL) {
+		plog(LLV_ERROR, LOCATION, actx->iph1->remote,
+		     "Failed to get CR ASN1 DN from certificate\n");
+		return 0;
 	}
 
-	new = oakley_newcert();
-	if (!new) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"Failed to get CERT buffer.\n");
-		return NULL;
-	}
+	buf = vmalloc(1 + asn1dn->l);
+	if (buf == NULL)
+		goto err;
 
-	new->pl = vmalloc(ntohs(gen->len) - sizeof(*gen));
-	if (new->pl == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"Failed to copy CERT from packet.\n");
-		oakley_delcert(new);
-		new = NULL;
-		return NULL;
-	}
-	memcpy(new->pl->v, gen + 1, new->pl->l);
-	new->type = new->pl->v[0] & 0xff;
-	new->cert.v = new->pl->v + 1;
-	new->cert.l = new->pl->l - 1;
+	buf->v[0] = type;
+	memcpy(&buf->v[1], asn1dn->v, asn1dn->l);
 
-	return new;
-}
+	plog(LLV_DEBUG, LOCATION, actx->iph1->remote,
+	     "appending CR: %s\n",
+	     s_isakmp_certtype(buf->v[0]));
+	plogdump(LLV_DEBUG, buf->v, buf->l);
 
-static cert_t *
-save_certx509(cert)
-	X509 *cert;
-{
-	cert_t *new;
-        int len;
-        u_char *bp;
+	actx->plist = isakmp_plist_append_full(actx->plist, buf, ISAKMP_NPTYPE_CR, 1);
 
-	new = oakley_newcert();
-	if (!new) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"Failed to get CERT buffer.\n");
-		return NULL;
-	}
-
-        len = i2d_X509(cert, NULL);
-	new->pl = vmalloc(len);
-	if (new->pl == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"Failed to copy CERT from packet.\n");
-		oakley_delcert(new);
-		new = NULL;
-		return NULL;
-	}
-        bp = (u_char *) new->pl->v;
-        len = i2d_X509(cert, &bp);
-	new->type = ISAKMP_CERT_X509SIGN;
-	new->cert.v = new->pl->v;
-	new->cert.l = new->pl->l;
-
-	return new;
+err:
+	vfree(asn1dn);
+	return 0;
 }
 
 /*
- * get my CR.
- * NOTE: No Certificate Authority field is included to CR payload at the
- * moment. Becuase any certificate authority are accepted without any check.
- * The section 3.10 in RFC2408 says that this field SHOULD not be included,
- * if there is no specific certificate authority requested.
+ * Append list of acceptable CRs.
+ * RFC2048 3.10
  */
-vchar_t *
-oakley_getcr(iph1)
+struct payload_list *
+oakley_append_cr(plist, iph1)
+	struct payload_list *plist;
 	struct ph1handle *iph1;
 {
-	vchar_t *buf;
+	struct append_cr_ctx ctx;
+	struct rmconfselector sel;
 
-	buf = vmalloc(1);
-	if (buf == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get cr buffer\n");
-		return NULL;
-	}
-	if(iph1->rmconf->certtype == ISAKMP_CERT_NONE) {
-		buf->v[0] = iph1->rmconf->cacerttype;
-		plog(LLV_DEBUG, LOCATION, NULL, "create my CR: NONE, using %s instead\n",
-		s_isakmp_certtype(iph1->rmconf->cacerttype));
+	ctx.iph1 = iph1;
+	ctx.plist = plist;
+	if (iph1->rmconf == NULL) {
+		rmconf_selector_from_ph1(&sel, iph1);
+		enumrmconf(&sel, oakley_append_rmconf_cr, &ctx);
 	} else {
-		buf->v[0] = iph1->rmconf->certtype;
-		plog(LLV_DEBUG, LOCATION, NULL, "create my CR: %s\n",
-		s_isakmp_certtype(iph1->rmconf->certtype));
+		oakley_append_rmconf_cr(iph1->rmconf, &ctx);
 	}
-	if (buf->l > 1)
-		plogdump(LLV_DEBUG, buf->v, buf->l);
 
-	return buf;
+	return ctx.plist;
 }
 
 /*
@@ -2423,17 +2336,20 @@
 oakley_checkcr(iph1)
 	struct ph1handle *iph1;
 {
+	int type;
+
 	if (iph1->cr_p == NULL)
 		return 0;
 
 	plog(LLV_DEBUG, LOCATION, iph1->remote,
 		"peer transmitted CR: %s\n",
-		s_isakmp_certtype(iph1->cr_p->type));
+		s_isakmp_certtype(oakley_get_certtype(iph1->cr_p)));
 
-	if (iph1->cr_p->type != iph1->rmconf->certtype) {
+	type = oakley_get_certtype(iph1->cr_p);
+	if (type != oakley_get_certtype(iph1->rmconf->mycert)) {
 		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"such a cert type isn't supported: %d\n",
-			(char)iph1->cr_p->type);
+		     "such a cert type isn't supported: %d\n",
+		     type);
 		return -1;
 	}
 
@@ -2482,10 +2398,10 @@
 	int error = -1;
 	
 	/* SKEYID */
-	switch (AUTHMETHOD(iph1)) {
+	switch (iph1->approval->authmethod) {
 	case OAKLEY_ATTR_AUTH_METHOD_PSKEY:
 #ifdef ENABLE_HYBRID
-	case FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I:
+	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I:
 	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
 #endif
 		if (iph1->etype != ISAKMP_ETYPE_IDENT) {
@@ -2748,7 +2664,7 @@
 					iph1->approval->encklen);
 	if (keylen == -1) {
 		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid encryption algoritym %d, "
+			"invalid encryption algorithm %d, "
 			"or invalid key length %d.\n",
 			iph1->approval->enctype,
 			iph1->approval->encklen);
@@ -2852,7 +2768,7 @@
 	if (iph1->approval->enctype > ARRAYLEN(oakley_encdef)
 	 || oakley_encdef[iph1->approval->enctype].weakkey == NULL) {
 		plog(LLV_ERROR, LOCATION, NULL,
-			"encryption algoritym %d isn't supported.\n",
+			"encryption algorithm %d isn't supported.\n",
 			iph1->approval->enctype);
 		goto end;
 	}
@@ -2872,36 +2788,6 @@
 	return error;
 }
 
-/* allocated new buffer for CERT */
-cert_t *
-oakley_newcert()
-{
-	cert_t *new;
-
-	new = racoon_calloc(1, sizeof(*new));
-	if (new == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get cert's buffer\n");
-		return NULL;
-	}
-
-	new->pl = NULL;
-
-	return new;
-}
-
-/* delete buffer for CERT */
-void
-oakley_delcert(cert)
-	cert_t *cert;
-{
-	if (!cert)
-		return;
-	if (cert->pl)
-		VPTRINIT(cert->pl);
-	racoon_free(cert);
-}
-
 /*
  * compute IV and set to ph1handle
  *	IV = hash(g^xi | g^xr)
@@ -2956,7 +2842,7 @@
 	newivm->iv->l = alg_oakley_encdef_blocklen(iph1->approval->enctype);
 	if (newivm->iv->l == -1) {
 		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid encryption algoriym %d.\n",
+			"invalid encryption algorithm %d.\n",
 			iph1->approval->enctype);
 		vfree(buf);
 		oakley_delivm(newivm);
@@ -3038,7 +2924,7 @@
 	newivm->iv->l = alg_oakley_encdef_blocklen(iph1->approval->enctype);
 	if (newivm->iv->l == -1) {
 		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid encryption algoriym %d.\n",
+			"invalid encryption algorithm %d.\n",
 			iph1->approval->enctype);
 		goto end;
 	}
@@ -3102,7 +2988,7 @@
 	blen = alg_oakley_encdef_blocklen(iph1->approval->enctype);
 	if (blen == -1) {
 		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid encryption algoriym %d.\n",
+			"invalid encryption algorithm %d.\n",
 			iph1->approval->enctype);
 		goto end;
 	}
@@ -3224,7 +3110,7 @@
 	blen = alg_oakley_encdef_blocklen(iph1->approval->enctype);
 	if (blen == -1) {
 		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid encryption algoriym %d.\n",
+			"invalid encryption algorithm %d.\n",
 			iph1->approval->enctype);
 		goto end;
 	}
diff --git a/src/racoon/oakley.h b/src/racoon/oakley.h
index a8dbbd2..f8cdb76 100644
--- a/src/racoon/oakley.h
+++ b/src/racoon/oakley.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: oakley.h,v 1.5 2006/10/06 12:02:27 manu Exp $	*/
+/*	$NetBSD: oakley.h,v 1.7 2009/03/12 10:57:26 tteras Exp $	*/
 
 /* Id: oakley.h,v 1.13 2005/05/30 20:12:43 fredsen Exp */
 
@@ -89,21 +89,18 @@
 #define OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_R	65010
 #endif
 
-					/*	65500 -> still private
-					 * to avoid clash with GSSAPI_KRB below 
-					 */
-#define FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I	65500
+/*
+ * The following are valid when the Vendor ID is one of
+ * the following:
+ *
+ *	MD5("A GSS-API Authentication Method for IKE")
+ *	MD5("GSSAPI") (recognized by Windows 2000)
+ *	MD5("MS NT5 ISAKMPOAKLEY") (sent by Windows 2000)
+ */
 
+#define OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB	(65001 + 0x10000)
+#define OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB_REAL	65001
 
-	/*
-	 * The following are valid when the Vendor ID is one of
-	 * the following:
-	 *
-	 *	MD5("A GSS-API Authentication Method for IKE")
-	 *	MD5("GSSAPI") (recognized by Windows 2000)
-	 *	MD5("MS NT5 ISAKMPOAKLEY") (sent by Windows 2000)
-	 */
-#define   OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB	65001
 #define OAKLEY_ATTR_GRP_DESC		4 /* B */
 #define   OAKLEY_ATTR_GRP_DESC_MODP768		1
 #define   OAKLEY_ATTR_GRP_DESC_MODP1024		2
@@ -163,13 +160,6 @@
 	vchar_t *order;
 };
 
-/* certificate holder */
-typedef struct cert_t_tag {
-	u_int8_t type;		/* type of CERT, must be same to pl->v[0]*/
-	vchar_t cert;		/* pointer to the CERT */
-	vchar_t *pl;		/* CERT payload minus isakmp general header */
-} cert_t;
-
 struct ph1handle;
 struct ph2handle;
 struct isakmp_ivm;
@@ -200,10 +190,13 @@
 extern vchar_t *oakley_ph1hash_base_i __P((struct ph1handle *, int));
 extern vchar_t *oakley_ph1hash_base_r __P((struct ph1handle *, int));
 
+extern int oakley_get_certtype __P((vchar_t *));
 extern int oakley_validate_auth __P((struct ph1handle *));
 extern int oakley_getmycert __P((struct ph1handle *));
 extern int oakley_getsign __P((struct ph1handle *));
 extern vchar_t *oakley_getcr __P((struct ph1handle *));
+extern struct payload_list *oakley_append_cr __P((struct payload_list *,
+						  struct ph1handle *));
 extern int oakley_checkcr __P((struct ph1handle *));
 extern int oakley_needcr __P((int));
 struct isakmp_gen;
@@ -214,8 +207,6 @@
 extern int oakley_skeyid_dae __P((struct ph1handle *));
 
 extern int oakley_compute_enckey __P((struct ph1handle *));
-extern cert_t *oakley_newcert __P((void));
-extern void oakley_delcert __P((cert_t *));
 extern int oakley_newiv __P((struct ph1handle *));
 extern struct isakmp_ivm *oakley_newiv2 __P((struct ph1handle *, u_int32_t));
 extern void oakley_delivm __P((struct isakmp_ivm *));
@@ -224,20 +215,4 @@
 extern vchar_t *oakley_do_encrypt __P((struct ph1handle *,
 	vchar_t *, vchar_t *, vchar_t *));
 
-#ifdef ENABLE_HYBRID
-#define AUTHMETHOD(iph1)						     \
-    (((iph1)->rmconf->xauth &&						     \
-    (iph1)->approval->authmethod == OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I) ? \
-	FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I : (iph1)->approval->authmethod)
-#define RMAUTHMETHOD(iph1)						     \
-    (((iph1)->rmconf->xauth &&						     \
-    (iph1)->rmconf->proposal->authmethod ==                                  \
-	OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I) ?                             \
-	FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I :                                  \
-	(iph1)->rmconf->proposal->authmethod)
-#else
-#define AUTHMETHOD(iph1) (iph1)->approval->authmethod
-#define RMAUTHMETHOD(iph1) (iph1)->rmconf->proposal->authmethod
-#endif /* ENABLE_HYBRID */
-
 #endif /* _OAKLEY_H */
diff --git a/src/racoon/pfkey.c b/src/racoon/pfkey.c
index e73acc8..e69cb94 100644
--- a/src/racoon/pfkey.c
+++ b/src/racoon/pfkey.c
@@ -1,11 +1,11 @@
-/*	$NetBSD: pfkey.c,v 1.18.4.5 2008/03/05 22:14:24 mgrooms Exp $	*/
+/*	$NetBSD: pfkey.c,v 1.57 2011/03/15 13:20:14 vanhu Exp $	*/
 
-/* $Id: pfkey.c,v 1.18.4.5 2008/03/05 22:14:24 mgrooms Exp $ */
+/* $Id: pfkey.c,v 1.57 2011/03/15 13:20:14 vanhu Exp $ */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -17,7 +17,7 @@
  * 3. Neither the name of the project nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -77,6 +77,7 @@
 #include "vmbuf.h"
 #include "plog.h"
 #include "sockmisc.h"
+#include "session.h"
 #include "debug.h"
 
 #include "schedule.h"
@@ -94,6 +95,7 @@
 #include "algorithm.h"
 #include "sainfo.h"
 #include "admin.h"
+#include "evt.h"
 #include "privsep.h"
 #include "strnames.h"
 #include "backupsa.h"
@@ -129,6 +131,9 @@
 static int pk_recvspdget __P((caddr_t *));
 static int pk_recvspddump __P((caddr_t *));
 static int pk_recvspdflush __P((caddr_t *));
+#if defined(SADB_X_MIGRATE) && defined(SADB_X_EXT_KMADDRESS)
+static int pk_recvmigrate __P((caddr_t *));
+#endif
 static struct sadb_msg *pk_recv __P((int, int *));
 
 static int (*pkrecvf[]) __P((caddr_t *)) = {
@@ -156,17 +161,21 @@
 pk_recvspdexpire,
 NULL,	/* SADB_X_SPDDELETE2 */
 NULL,	/* SADB_X_NAT_T_NEW_MAPPING */
+#if defined(SADB_X_MIGRATE) && defined(SADB_X_EXT_KMADDRESS)
+pk_recvmigrate,
+#else
 NULL,	/* SADB_X_MIGRATE */
+#endif
 #if (SADB_MAX > 24)
 #error "SADB extra message?"
 #endif
 };
 
-static int addnewsp __P((caddr_t *));
+static int addnewsp __P((caddr_t *, struct sockaddr *, struct sockaddr *));
 
 /* cope with old kame headers - ugly */
 #ifndef SADB_X_AALG_MD5
-#define SADB_X_AALG_MD5		SADB_AALG_MD5	
+#define SADB_X_AALG_MD5		SADB_AALG_MD5
 #endif
 #ifndef SADB_X_AALG_SHA
 #define SADB_X_AALG_SHA		SADB_AALG_SHA
@@ -192,8 +201,10 @@
  *	0: success
  *	-1: fail
  */
-int
-pfkey_handler()
+static int
+pfkey_handler(ctx, fd)
+	void *ctx;
+	int fd;
 {
 	struct sadb_msg *msg;
 	int len;
@@ -202,9 +213,16 @@
 
 	/* receive pfkey message. */
 	len = 0;
-	msg = (struct sadb_msg *)pk_recv(lcconf->sock_pfkey, &len);
+	msg = (struct sadb_msg *) pk_recv(fd, &len);
 	if (msg == NULL) {
 		if (len < 0) {
+		        /* do not report EAGAIN as error; well get
+		         * called from main loop later. and it's normal
+		         * when spd dump is received during reload and
+		         * this function is called in loop. */
+		        if (errno == EAGAIN)
+		                goto end;
+
 			plog(LLV_ERROR, LOCATION, NULL,
 				"failed to recv from pfkey (%s)\n",
 				strerror(errno));
@@ -215,7 +233,7 @@
 		}
 	}
 
-	plog(LLV_DEBUG, LOCATION, NULL, "get pfkey %s message\n",
+	plog(LLV_DEBUG, LOCATION, NULL, "got pfkey %s message\n",
 		s_pfkey_type(msg->sadb_msg_type));
 	plogdump(LLV_DEBUG2, msg, msg->sadb_msg_len << 3);
 
@@ -271,7 +289,7 @@
 	if ((pkrecvf[msg->sadb_msg_type])(mhp) < 0)
 		goto end;
 
-	error = 0;
+	error = 1;
 end:
 	if (msg)
 		racoon_free(msg);
@@ -285,20 +303,32 @@
 pfkey_dump_sadb(satype)
 	int satype;
 {
-	int s = -1;
+	int s;
 	vchar_t *buf = NULL;
 	pid_t pid = getpid();
 	struct sadb_msg *msg = NULL;
 	size_t bl, ml;
 	int len;
+	int bufsiz;
 
-	if ((s = privsep_pfkey_open()) < 0) {
+	if ((s = privsep_socket(PF_KEY, SOCK_RAW, PF_KEY_V2)) < 0) {
 		plog(LLV_ERROR, LOCATION, NULL,
 			"libipsec failed pfkey open: %s\n",
 			ipsec_strerror());
 		return NULL;
 	}
 
+	if ((bufsiz = pfkey_set_buffer_size(s, lcconf->pfkey_buffer_size)) < 0) {
+		plog(LLV_ERROR, LOCATION, NULL,
+		     "libipsec failed pfkey set buffer size to %d: %s\n",
+		     lcconf->pfkey_buffer_size, ipsec_strerror());
+		return NULL;
+	} else if (bufsiz < lcconf->pfkey_buffer_size) {
+		plog(LLV_WARNING, LOCATION, NULL,
+		     "pfkey socket receive buffer set to %dKB, instead of %d\n",
+		     bufsiz, lcconf->pfkey_buffer_size);
+	}
+
 	plog(LLV_DEBUG, LOCATION, NULL, "call pfkey_send_dump\n");
 	if (pfkey_send_dump(s, satype) < 0) {
 		plog(LLV_ERROR, LOCATION, NULL,
@@ -325,7 +355,7 @@
 			 "type %i, pid %i\n", msg->sadb_msg_type, msg->sadb_msg_pid);
 		    continue;
 		}
-		
+
 
 		ml = msg->sadb_msg_len << 3;
 		bl = buf ? buf->l : 0;
@@ -349,8 +379,7 @@
 done:
 	if (msg)
 		racoon_free(msg);
-	if (s >= 0)
-		privsep_pfkey_close(s);
+	close(s);
 	return buf;
 }
 
@@ -400,12 +429,25 @@
 pfkey_init()
 {
 	int i, reg_fail;
+	int bufsiz;
 
-	if ((lcconf->sock_pfkey = privsep_pfkey_open()) < 0) {
+	if ((lcconf->sock_pfkey = pfkey_open()) < 0) {
 		plog(LLV_ERROR, LOCATION, NULL,
 			"libipsec failed pfkey open (%s)\n", ipsec_strerror());
 		return -1;
 	}
+	if ((bufsiz = pfkey_set_buffer_size(lcconf->sock_pfkey,
+					    lcconf->pfkey_buffer_size)) < 0) {
+		plog(LLV_ERROR, LOCATION, NULL,
+		     "libipsec failed to set pfkey buffer size to %d (%s)\n",
+		     lcconf->pfkey_buffer_size, ipsec_strerror());
+		return -1;
+	} else if (bufsiz < lcconf->pfkey_buffer_size) {
+		plog(LLV_WARNING, LOCATION, NULL,
+		     "pfkey socket receive buffer set to %dKB, instead of %d\n",
+		     bufsiz, lcconf->pfkey_buffer_size);
+	}
+
 	if (fcntl(lcconf->sock_pfkey, F_SETFL, O_NONBLOCK) == -1)
 		plog(LLV_WARNING, LOCATION, NULL,
 		    "failed to set the pfkey socket to NONBLOCK\n");
@@ -447,6 +489,25 @@
 		return -1;
 	}
 #endif
+	monitor_fd(lcconf->sock_pfkey, pfkey_handler, NULL, 0);
+	return 0;
+}
+
+int
+pfkey_reload()
+{
+	flushsp();
+
+	if (pfkey_send_spddump(lcconf->sock_pfkey) < 0) {
+		plog(LLV_ERROR, LOCATION, NULL,
+			"libipsec sending spddump failed: %s\n",
+			ipsec_strerror());
+		return -1;
+	}
+
+	while (pfkey_handler(NULL, lcconf->sock_pfkey) > 0)
+		continue;
+
 	return 0;
 }
 
@@ -717,6 +778,29 @@
 	return res;
 }
 
+void
+pk_fixup_sa_addresses(mhp)
+	caddr_t *mhp;
+{
+	struct sockaddr *src, *dst;
+
+	src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]);
+	dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]);
+	set_port(src, PORT_ISAKMP);
+	set_port(dst, PORT_ISAKMP);
+
+#ifdef ENABLE_NATT
+	if (PFKEY_ADDR_X_NATTYPE(mhp[SADB_X_EXT_NAT_T_TYPE])) {
+		/* NAT-T is enabled for this SADB entry; copy
+		 * the ports from NAT-T extensions */
+		if(mhp[SADB_X_EXT_NAT_T_SPORT] != NULL)
+			set_port(src, PFKEY_ADDR_X_PORT(mhp[SADB_X_EXT_NAT_T_SPORT]));
+		if(mhp[SADB_X_EXT_NAT_T_DPORT] != NULL)
+			set_port(dst, PFKEY_ADDR_X_PORT(mhp[SADB_X_EXT_NAT_T_DPORT]));
+	}
+#endif
+}
+
 int
 pfkey_convertfromipsecdoi(proto_id, t_id, hashtype,
 		e_type, e_keylen, a_type, a_keylen, flags)
@@ -757,7 +841,7 @@
 			goto bad;
 		*a_keylen >>= 3;
 
-		if (t_id == IPSECDOI_ATTR_AUTH_HMAC_MD5 
+		if (t_id == IPSECDOI_ATTR_AUTH_HMAC_MD5
 		 && hashtype == IPSECDOI_ATTR_AUTH_KPDK) {
 			/* AH_MD5 + Auth(KPDK) = RFC1826 keyed-MD5 */
 			*a_type = SADB_X_AALG_MD5;
@@ -798,35 +882,6 @@
 	return -1;
 }
 
-/* called from scheduler */
-void
-pfkey_timeover_stub(p)
-	void *p;
-{
-
-	pfkey_timeover((struct ph2handle *)p);
-}
-
-void
-pfkey_timeover(iph2)
-	struct ph2handle *iph2;
-{
-	plog(LLV_ERROR, LOCATION, NULL,
-		"%s give up to get IPsec-SA due to time up to wait.\n",
-		saddrwop2str(iph2->dst));
-	SCHED_KILL(iph2->sce);
-
-	/* If initiator side, send error to kernel by SADB_ACQUIRE. */
-	if (iph2->side == INITIATOR)
-		pk_sendeacquire(iph2);
-
-	unbindph12(iph2);
-	remph2(iph2);
-	delph2(iph2);
-
-	return;
-}
-
 /*%%%*/
 /* send getspi message per ipsec protocol per remote address */
 /*
@@ -843,25 +898,28 @@
 	struct saprop *pp;
 	struct saproto *pr;
 	u_int32_t minspi, maxspi;
-	int proxy = 0;
+	u_int8_t natt_type = 0;
+	u_int16_t sport = 0, dport = 0;
 
-	if (iph2->side == INITIATOR) {
+	if (iph2->side == INITIATOR)
 		pp = iph2->proposal;
-		proxy = iph2->ph1->rmconf->support_proxy;
-	} else {
+	else
 		pp = iph2->approval;
-		if (iph2->sainfo && iph2->sainfo->id_i)
-			proxy = 1;
+
+	if (iph2->sa_src && iph2->sa_dst) {
+		/* MIPv6: Use SA addresses, not IKE ones */
+		src = dupsaddr(iph2->sa_src);
+		dst = dupsaddr(iph2->sa_dst);
+	} else {
+		/* Common case: SA addresses and IKE ones are the same */
+		src = dupsaddr(iph2->src);
+		dst = dupsaddr(iph2->dst);
 	}
 
-	/* for mobile IPv6 */
-	if (proxy && iph2->src_id && iph2->dst_id &&
-	    ipsecdoi_transportmode(pp)) {
-		src = iph2->src_id;
-		dst = iph2->dst_id;
-	} else {
-		src = iph2->src;
-		dst = iph2->dst;
+	if (src == NULL || dst == NULL) {
+		racoon_free(src);
+		racoon_free(dst);
+		return -1;
 	}
 
 	for (pr = pp->head; pr != NULL; pr = pr->next) {
@@ -871,6 +929,8 @@
 		if (satype == ~0) {
 			plog(LLV_ERROR, LOCATION, NULL,
 				"invalid proto_id %d\n", pr->proto_id);
+			racoon_free(src);
+			racoon_free(dst);
 			return -1;
 		}
 		/* this works around a bug in Linux kernel where it allocates 4 byte
@@ -887,30 +947,36 @@
 		if (mode == ~0) {
 			plog(LLV_ERROR, LOCATION, NULL,
 				"invalid encmode %d\n", pr->encmode);
+			racoon_free(src);
+			racoon_free(dst);
 			return -1;
 		}
 
 #ifdef ENABLE_NATT
-		/* XXX should we do a copy of src/dst for each pr ?
-		 */
-		if (! pr->udp_encap) {
-			/* Remove port information, that SA doesn't use it */
-			set_port(src, 0);
-			set_port(dst, 0);
+		if (pr->udp_encap) {
+			natt_type = iph2->ph1->natt_options->encaps_type;
+			sport=extract_port(src);
+			dport=extract_port(dst);
 		}
 #endif
+
 		plog(LLV_DEBUG, LOCATION, NULL, "call pfkey_send_getspi\n");
-		if (pfkey_send_getspi(
+		if (pfkey_send_getspi_nat(
 				lcconf->sock_pfkey,
 				satype,
 				mode,
 				dst,			/* src of SA */
 				src,			/* dst of SA */
+				natt_type,
+				dport,
+				sport,
 				minspi, maxspi,
 				pr->reqid_in, iph2->seq) < 0) {
 			plog(LLV_ERROR, LOCATION, NULL,
 				"ipseclib failed send getspi (%s)\n",
 				ipsec_strerror());
+			racoon_free(src);
+			racoon_free(dst);
 			return -1;
 		}
 		plog(LLV_DEBUG, LOCATION, NULL,
@@ -918,6 +984,8 @@
 			sadbsecas2str(dst, src, satype, 0, mode));
 	}
 
+	racoon_free(src);
+	racoon_free(dst);
 	return 0;
 }
 
@@ -925,13 +993,13 @@
  * receive GETSPI from kernel.
  */
 static int
-pk_recvgetspi(mhp) 
+pk_recvgetspi(mhp)
 	caddr_t *mhp;
 {
 	struct sadb_msg *msg;
 	struct sadb_sa *sa;
 	struct ph2handle *iph2;
-	struct sockaddr *dst;
+	struct sockaddr *src, *dst;
 	int proto_id;
 	int allspiok, notfound;
 	struct saprop *pp;
@@ -939,14 +1007,17 @@
 
 	/* validity check */
 	if (mhp[SADB_EXT_SA] == NULL
-	 || mhp[SADB_EXT_ADDRESS_DST] == NULL) {
+	 || mhp[SADB_EXT_ADDRESS_DST] == NULL
+	 || mhp[SADB_EXT_ADDRESS_SRC] == NULL) {
 		plog(LLV_ERROR, LOCATION, NULL,
 			"inappropriate sadb getspi message passed.\n");
 		return -1;
 	}
 	msg = (struct sadb_msg *)mhp[0];
 	sa = (struct sadb_sa *)mhp[SADB_EXT_SA];
+	pk_fixup_sa_addresses(mhp);
 	dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]); /* note SA dir */
+	src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]);
 
 	/* the message has to be processed or not ? */
 	if (msg->sadb_msg_pid != getpid()) {
@@ -986,7 +1057,7 @@
 			notfound = 0;
 			plog(LLV_DEBUG, LOCATION, NULL,
 				"pfkey GETSPI succeeded: %s\n",
-				sadbsecas2str(iph2->dst, iph2->src,
+				sadbsecas2str(dst, src,
 				    msg->sadb_msg_satype,
 				    sa->sadb_sa_spi,
 				    ipsecdoi2pfkey_mode(pr->encmode)));
@@ -998,7 +1069,7 @@
 	if (notfound) {
 		plog(LLV_ERROR, LOCATION, NULL,
 			"get spi for unknown address %s\n",
-			saddrwop2str(iph2->dst));
+			saddrwop2str(dst));
 		return -1;
 	}
 
@@ -1008,7 +1079,6 @@
 		if (isakmp_post_getspi(iph2) < 0) {
 			plog(LLV_ERROR, LOCATION, NULL,
 				"failed to start post getspi.\n");
-			unbindph12(iph2);
 			remph2(iph2);
 			delph2(iph2);
 			iph2 = NULL;
@@ -1028,34 +1098,38 @@
 {
 	struct saproto *pr;
 	struct pfkey_send_sa_args sa_args;
-	int proxy = 0;
 
 	/* sanity check */
 	if (iph2->approval == NULL) {
 		plog(LLV_ERROR, LOCATION, NULL,
 			"no approvaled SAs found.\n");
+		return -1;
 	}
 
-	if (iph2->side == INITIATOR)
-		proxy = iph2->ph1->rmconf->support_proxy;
-	else if (iph2->sainfo && iph2->sainfo->id_i)
-		proxy = 1;
-
 	/* fill in some needed for pfkey_send_update2 */
 	memset (&sa_args, 0, sizeof (sa_args));
 	sa_args.so = lcconf->sock_pfkey;
-	sa_args.l_addtime = iph2->approval->lifetime;
-	sa_args.seq = iph2->seq; 
+	if (iph2->lifetime_secs)
+		sa_args.l_addtime = iph2->lifetime_secs;
+	else
+		sa_args.l_addtime = iph2->approval->lifetime;
+	sa_args.seq = iph2->seq;
 	sa_args.wsize = 4;
 
-	/* for mobile IPv6 */
-	if (proxy && iph2->src_id && iph2->dst_id &&
-	    ipsecdoi_transportmode(iph2->approval)) {
-		sa_args.dst = iph2->src_id;
-		sa_args.src = iph2->dst_id;
+	if (iph2->sa_src && iph2->sa_dst) {
+		/* MIPv6: Use SA addresses, not IKE ones */
+		sa_args.dst = dupsaddr(iph2->sa_src);
+		sa_args.src = dupsaddr(iph2->sa_dst);
 	} else {
-		sa_args.dst = iph2->src;
-		sa_args.src = iph2->dst;
+		/* Common case: SA addresses and IKE ones are the same */
+		sa_args.dst = dupsaddr(iph2->src);
+		sa_args.src = dupsaddr(iph2->dst);
+	}
+
+	if (sa_args.src == NULL || sa_args.dst == NULL) {
+		racoon_free(sa_args.src);
+		racoon_free(sa_args.dst);
+		return -1;
 	}
 
 	for (pr = iph2->approval->head; pr != NULL; pr = pr->next) {
@@ -1064,6 +1138,8 @@
 		if (sa_args.satype == ~0) {
 			plog(LLV_ERROR, LOCATION, NULL,
 				"invalid proto_id %d\n", pr->proto_id);
+			racoon_free(sa_args.src);
+			racoon_free(sa_args.dst);
 			return -1;
 		}
 		else if (sa_args.satype == SADB_X_SATYPE_IPCOMP) {
@@ -1077,6 +1153,8 @@
 		if (sa_args.mode == ~0) {
 			plog(LLV_ERROR, LOCATION, NULL,
 				"invalid encmode %d\n", pr->encmode);
+			racoon_free(sa_args.src);
+			racoon_free(sa_args.dst);
 			return -1;
 		}
 #endif
@@ -1087,9 +1165,12 @@
 				pr->head->trns_id,
 				pr->head->authtype,
 				&sa_args.e_type, &sa_args.e_keylen,
-				&sa_args.a_type, &sa_args.a_keylen, 
-				&sa_args.flags) < 0)
+				&sa_args.a_type, &sa_args.a_keylen,
+				&sa_args.flags) < 0){
+			racoon_free(sa_args.src);
+			racoon_free(sa_args.dst);
 			return -1;
+		}
 
 #if 0
 		sa_args.l_bytes = iph2->approval->lifebyte * 1024,
@@ -1109,19 +1190,15 @@
 #ifdef ENABLE_NATT
 		if (pr->udp_encap) {
 			sa_args.l_natt_type = iph2->ph1->natt_options->encaps_type;
-			sa_args.l_natt_sport = extract_port (iph2->ph1->remote);
-			sa_args.l_natt_dport = extract_port (iph2->ph1->local);
-			sa_args.l_natt_oa = NULL;  // FIXME: Here comes OA!!!
+			sa_args.l_natt_sport = extract_port(iph2->ph1->remote);
+			sa_args.l_natt_dport = extract_port(iph2->ph1->local);
+			sa_args.l_natt_oa = iph2->natoa_src;
 #ifdef SADB_X_EXT_NAT_T_FRAG
 			sa_args.l_natt_frag = iph2->ph1->rmconf->esp_frag;
 #endif
-		} else {
-			/* Remove port information, that SA doesn't use it */
-			set_port(sa_args.src, 0);
-			set_port(sa_args.dst, 0);
 		}
-
 #endif
+
 		/* more info to fill in */
 		sa_args.spi = pr->spi;
 		sa_args.reqid = pr->reqid_in;
@@ -1132,6 +1209,8 @@
 			plog(LLV_ERROR, LOCATION, NULL,
 				"libipsec failed send update (%s)\n",
 				ipsec_strerror());
+			racoon_free(sa_args.src);
+			racoon_free(sa_args.dst);
 			return -1;
 		}
 
@@ -1145,11 +1224,11 @@
 		 * But it is impossible because there is not key in the
 		 * information from the kernel.
 		 */
-		
+
 		/* change some things before backing up */
 		sa_args.wsize = 4;
 		sa_args.l_bytes = iph2->approval->lifebyte * 1024;
-		
+
 		if (backupsa_to_file(&sa_args) < 0) {
 			plog(LLV_ERROR, LOCATION, NULL,
 				"backuped SA failed: %s\n",
@@ -1163,6 +1242,8 @@
 #endif
 	}
 
+	racoon_free(sa_args.src);
+	racoon_free(sa_args.dst);
 	return 0;
 }
 
@@ -1192,6 +1273,7 @@
 		return -1;
 	}
 	msg = (struct sadb_msg *)mhp[0];
+	pk_fixup_sa_addresses(mhp);
 	src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]);
 	dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]);
 	sa = (struct sadb_sa *)mhp[SADB_EXT_SA];
@@ -1246,14 +1328,14 @@
 			pr->ok = 1;
 			plog(LLV_DEBUG, LOCATION, NULL,
 				"pfkey UPDATE succeeded: %s\n",
-				sadbsecas2str(iph2->dst, iph2->src,
+				sadbsecas2str(dst, src,
 				    msg->sadb_msg_satype,
 				    sa->sadb_sa_spi,
 				    sa_mode));
 
 			plog(LLV_INFO, LOCATION, NULL,
 				"IPsec-SA established: %s\n",
-				sadbsecas2str(iph2->dst, iph2->src,
+				sadbsecas2str(dst, src,
 					msg->sadb_msg_satype, sa->sadb_sa_spi,
 					sa_mode));
 		}
@@ -1266,10 +1348,11 @@
 		return 0;
 
 	/* turn off the timer for calling pfkey_timeover() */
-	SCHED_KILL(iph2->sce);
-	
+	sched_cancel(&iph2->sce);
+
 	/* update status */
 	iph2->status = PHASE2ST_ESTABLISHED;
+	evt_phase2(iph2, EVT_PHASE2_UP, NULL);
 
 #ifdef ENABLE_STATS
 	gettimeofday(&iph2->end, NULL);
@@ -1277,29 +1360,15 @@
 		"phase2", "quick", timedelta(&iph2->start, &iph2->end));
 #endif
 
-	/* count up */
-	iph2->ph1->ph2cnt++;
-
 	/* turn off schedule */
-	SCHED_KILL(iph2->scr);
-
-	/* Force the update of ph2's ports, as there is at least one
-	 * situation where they'll mismatch with ph1's values
-	 */
-
-#ifdef ENABLE_NATT
-	set_port(iph2->src, extract_port(iph2->ph1->local));
-	set_port(iph2->dst, extract_port(iph2->ph1->remote));
-#endif
+	sched_cancel(&iph2->scr);
 
 	/*
 	 * since we are going to reuse the phase2 handler, we need to
 	 * remain it and refresh all the references between ph1 and ph2 to use.
 	 */
-	unbindph12(iph2);
-
-	iph2->sce = sched_new(iph2->approval->lifetime,
-	    isakmp_ph2expire_stub, iph2);
+	sched_schedule(&iph2->sce, iph2->approval->lifetime,
+		       isakmp_ph2expire_stub);
 
 	plog(LLV_DEBUG, LOCATION, NULL, "===\n");
 	return 0;
@@ -1313,7 +1382,6 @@
 	struct ph2handle *iph2;
 {
 	struct saproto *pr;
-	int proxy = 0;
 	struct pfkey_send_sa_args sa_args;
 
 	/* sanity check */
@@ -1323,26 +1391,30 @@
 		return -1;
 	}
 
-	if (iph2->side == INITIATOR)
-		proxy = iph2->ph1->rmconf->support_proxy;
-	else if (iph2->sainfo && iph2->sainfo->id_i)
-		proxy = 1;
-
 	/* fill in some needed for pfkey_send_update2 */
 	memset (&sa_args, 0, sizeof (sa_args));
 	sa_args.so = lcconf->sock_pfkey;
-	sa_args.l_addtime = iph2->approval->lifetime;
+	if (iph2->lifetime_secs)
+		sa_args.l_addtime = iph2->lifetime_secs;
+	else
+		sa_args.l_addtime = iph2->approval->lifetime;
 	sa_args.seq = iph2->seq;
 	sa_args.wsize = 4;
 
-	/* for mobile IPv6 */
-	if (proxy && iph2->src_id && iph2->dst_id &&
-	    ipsecdoi_transportmode(iph2->approval)) {
-		sa_args.src = iph2->src_id;
-		sa_args.dst = iph2->dst_id;
+	if (iph2->sa_src && iph2->sa_dst) {
+		/* MIPv6: Use SA addresses, not IKE ones */
+		sa_args.src = dupsaddr(iph2->sa_src);
+		sa_args.dst = dupsaddr(iph2->sa_dst);
 	} else {
-		sa_args.src = iph2->src;
-		sa_args.dst = iph2->dst;
+		/* Common case: SA addresses and IKE ones are the same */
+		sa_args.src = dupsaddr(iph2->src);
+		sa_args.dst = dupsaddr(iph2->dst);
+	}
+
+	if (sa_args.src == NULL || sa_args.dst == NULL) {
+		racoon_free(sa_args.src);
+		racoon_free(sa_args.dst);
+		return -1;
 	}
 
 	for (pr = iph2->approval->head; pr != NULL; pr = pr->next) {
@@ -1351,6 +1423,8 @@
 		if (sa_args.satype == ~0) {
 			plog(LLV_ERROR, LOCATION, NULL,
 				"invalid proto_id %d\n", pr->proto_id);
+			racoon_free(sa_args.src);
+			racoon_free(sa_args.dst);
 			return -1;
 		}
 		else if (sa_args.satype == SADB_X_SATYPE_IPCOMP) {
@@ -1364,6 +1438,8 @@
 		if (sa_args.mode == ~0) {
 			plog(LLV_ERROR, LOCATION, NULL,
 				"invalid encmode %d\n", pr->encmode);
+			racoon_free(sa_args.src);
+			racoon_free(sa_args.dst);
 			return -1;
 		}
 #endif
@@ -1375,9 +1451,12 @@
 				pr->head->trns_id,
 				pr->head->authtype,
 				&sa_args.e_type, &sa_args.e_keylen,
-				&sa_args.a_type, &sa_args.a_keylen, 
-				&sa_args.flags) < 0)
+				&sa_args.a_type, &sa_args.a_keylen,
+				&sa_args.flags) < 0){
+			racoon_free(sa_args.src);
+			racoon_free(sa_args.dst);
 			return -1;
+		}
 
 #if 0
 		sa_args.l_bytes = iph2->approval->lifebyte * 1024,
@@ -1402,22 +1481,12 @@
 			sa_args.l_natt_type = UDP_ENCAP_ESPINUDP;
 			sa_args.l_natt_sport = extract_port(iph2->ph1->local);
 			sa_args.l_natt_dport = extract_port(iph2->ph1->remote);
-			sa_args.l_natt_oa = NULL; // FIXME: Here comes OA!!!
+			sa_args.l_natt_oa = iph2->natoa_dst;
 #ifdef SADB_X_EXT_NAT_T_FRAG
 			sa_args.l_natt_frag = iph2->ph1->rmconf->esp_frag;
 #endif
-		} else {
-			/* Remove port information, that SA doesn't use it */
-			set_port(sa_args.src, 0);
-			set_port(sa_args.dst, 0);
 		}
-
-#else
-		/* Remove port information, it is not used without NAT-T */
-		set_port(sa_args.src, 0);
-		set_port(sa_args.dst, 0);
 #endif
-
 		/* more info to fill in */
 		sa_args.spi = pr->spi_p;
 		sa_args.reqid = pr->reqid_out;
@@ -1428,6 +1497,8 @@
 			plog(LLV_ERROR, LOCATION, NULL,
 				"libipsec failed send add (%s)\n",
 				ipsec_strerror());
+			racoon_free(sa_args.src);
+			racoon_free(sa_args.dst);
 			return -1;
 		}
 
@@ -1453,6 +1524,8 @@
 			sa_args.satype, sa_args.spi, sa_args.mode));
 #endif
 	}
+	racoon_free(sa_args.src);
+	racoon_free(sa_args.dst);
 	return 0;
 }
 
@@ -1480,6 +1553,7 @@
 		return -1;
 	}
 	msg = (struct sadb_msg *)mhp[0];
+	pk_fixup_sa_addresses(mhp);
 	src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]);
 	dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]);
 	sa = (struct sadb_sa *)mhp[SADB_EXT_SA];
@@ -1514,7 +1588,7 @@
 
 	plog(LLV_INFO, LOCATION, NULL,
 		"IPsec-SA established: %s\n",
-		sadbsecas2str(iph2->src, iph2->dst,
+		sadbsecas2str(src, dst,
 			msg->sadb_msg_satype, sa->sadb_sa_spi, sa_mode));
 
 	plog(LLV_DEBUG, LOCATION, NULL, "===\n");
@@ -1544,6 +1618,7 @@
 	}
 	msg = (struct sadb_msg *)mhp[0];
 	sa = (struct sadb_sa *)mhp[SADB_EXT_SA];
+	pk_fixup_sa_addresses(mhp);
 	src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]);
 	dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]);
 
@@ -1577,54 +1652,63 @@
 			    sa_mode));
 		return 0;
 	}
-	if (iph2->status != PHASE2ST_ESTABLISHED) {
+
+	/* resent expiry message? */
+	if (iph2->status > PHASE2ST_ESTABLISHED)
+		return 0;
+
+	/* still negotiating? */
+	if (iph2->status < PHASE2ST_ESTABLISHED) {
+		/* not a hard timeout? */
+		if (mhp[SADB_EXT_LIFETIME_HARD] == NULL)
+			return 0;
+
 		/*
-		 * If the status is not equal to PHASE2ST_ESTABLISHED,
-		 * racoon ignores this expire message.  There are two reason.
-		 * One is that the phase 2 probably starts because there is
-		 * a potential that racoon receives the acquire message
-		 * without receiving a expire message.  Another is that racoon
-		 * may receive the multiple expire messages from the kernel.
+		 * We were negotiating for that SA (w/o much success
+		 * from current status) and kernel has decided our time
+		 * is over trying (xfrm_larval_drop controls that and
+		 * is enabled by default on Linux >= 2.6.28 kernels).
 		 */
 		plog(LLV_WARNING, LOCATION, NULL,
-			"the expire message is received "
-			"but the handler has not been established.\n");
-		return 0;
+		     "PF_KEY EXPIRE message received from kernel for SA"
+		     " being negotiated. Stopping negotiation.\n");
 	}
 
-	/* turn off the timer for calling isakmp_ph2expire() */ 
-	SCHED_KILL(iph2->sce);
+	/* turn off the timer for calling isakmp_ph2expire() */
+	sched_cancel(&iph2->sce);
 
-	iph2->status = PHASE2ST_EXPIRED;
-
-	/* INITIATOR, begin phase 2 exchange. */
-	/* allocate buffer for status management of pfkey message */
-	if (iph2->side == INITIATOR) {
-
-		initph2(iph2);
+	if (iph2->status == PHASE2ST_ESTABLISHED &&
+	    iph2->side == INITIATOR) {
+		struct ph1handle *iph1hint;
+		/*
+		 * Active phase 2 expired and we were initiator.
+		 * Begin new phase 2 exchange, so we can keep on sending
+		 * traffic.
+		 */
 
 		/* update status for re-use */
+		iph1hint = iph2->ph1;
+		initph2(iph2);
 		iph2->status = PHASE2ST_STATUS2;
 
-		/* start isakmp initiation by using ident exchange */
-		if (isakmp_post_acquire(iph2) < 0) {
+		/* start quick exchange */
+		if (isakmp_post_acquire(iph2, iph1hint, FALSE) < 0) {
 			plog(LLV_ERROR, LOCATION, iph2->dst,
 				"failed to begin ipsec sa "
 				"re-negotication.\n");
-			unbindph12(iph2);
 			remph2(iph2);
 			delph2(iph2);
 			return -1;
 		}
 
 		return 0;
-		/*NOTREACHED*/
 	}
 
-	/* If not received SADB_EXPIRE, INITIATOR delete ph2handle. */
-	/* RESPONDER always delete ph2handle, keep silent.  RESPONDER doesn't
-	 * manage IPsec SA, so delete the list */
-	unbindph12(iph2);
+	/*
+	 * We are responder or the phase 2 was not established.
+	 * Just remove the ph2handle to reflect SADB.
+	 */
+	iph2->status = PHASE2ST_EXPIRED;
 	remph2(iph2);
 	delph2(iph2);
 
@@ -1638,17 +1722,15 @@
 	struct sadb_msg *msg;
 	struct sadb_x_policy *xpl;
 	struct secpolicy *sp_out = NULL, *sp_in = NULL;
-#define MAXNESTEDSA	5	/* XXX */
-	struct ph2handle *iph2[MAXNESTEDSA];
-	struct sockaddr *src, *dst;
-	int n;	/* # of phase 2 handler */
-	int remoteid=0;
+	struct ph2handle *iph2;
+	struct sockaddr *src, *dst;     /* IKE addresses (for exchanges) */
+	struct sockaddr *sp_src, *sp_dst;   /* SP addresses (selectors). */
+	struct sockaddr *sa_src = NULL, *sa_dst = NULL ; /* SA addresses */
 #ifdef HAVE_SECCTX
 	struct sadb_x_sec_ctx *m_sec_ctx;
 #endif /* HAVE_SECCTX */
 	struct policyindex spidx;
 
-
 	/* ignore this message because of local test mode. */
 	if (f_local)
 		return 0;
@@ -1664,8 +1746,11 @@
 	}
 	msg = (struct sadb_msg *)mhp[0];
 	xpl = (struct sadb_x_policy *)mhp[SADB_X_EXT_POLICY];
-	src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]);
-	dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]);
+	/* acquire does not have nat-t ports; so do not bother setting
+	 * the default port 500; just use the port zero for wildcard
+	 * matching the get a valid natted destination */
+	sp_src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]);
+	sp_dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]);
 
 #ifdef HAVE_SECCTX
 	m_sec_ctx = (struct sadb_x_sec_ctx *)mhp[SADB_X_EXT_SEC_CTX];
@@ -1673,7 +1758,7 @@
 	if (m_sec_ctx != NULL) {
 		plog(LLV_INFO, LOCATION, NULL, "security context doi: %u\n",
 		     m_sec_ctx->sadb_x_ctx_doi);
-		plog(LLV_INFO, LOCATION, NULL, 
+		plog(LLV_INFO, LOCATION, NULL,
 		     "security context algorithm: %u\n",
 		     m_sec_ctx->sadb_x_ctx_alg);
 		plog(LLV_INFO, LOCATION, NULL, "security context length: %u\n",
@@ -1690,50 +1775,81 @@
 		return 0;
 	}
 
-	/* ignore it if src is multicast address */
-    {
-	struct sockaddr *sa = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]);
-
-	if ((sa->sa_family == AF_INET
-	  && IN_MULTICAST(ntohl(((struct sockaddr_in *)sa)->sin_addr.s_addr)))
+	/* ignore it if src or dst are multicast addresses. */
+	if ((sp_dst->sa_family == AF_INET
+	  && IN_MULTICAST(ntohl(((struct sockaddr_in *)sp_dst)->sin_addr.s_addr)))
 #ifdef INET6
-	 || (sa->sa_family == AF_INET6
-	  && IN6_IS_ADDR_MULTICAST(&((struct sockaddr_in6 *)sa)->sin6_addr))
+	 || (sp_dst->sa_family == AF_INET6
+	  && IN6_IS_ADDR_MULTICAST(&((struct sockaddr_in6 *)sp_dst)->sin6_addr))
 #endif
 	) {
 		plog(LLV_DEBUG, LOCATION, NULL,
-			"ignore due to multicast address: %s.\n",
-			saddrwop2str(sa));
+			"ignore due to multicast destination address: %s.\n",
+			saddrwop2str(sp_dst));
 		return 0;
 	}
-    }
-   	
-    	/* ignore, if we do not listen on source address */
-	{
-		/* reasons behind:
-		 * - if we'll contact peer from address we do not listen -
-		 *   we will be unable to complete negotiation;
-		 * - if we'll negotiate using address we're listening -
-		 *   remote peer will send packets to address different
-		 *   than one in the policy, so kernel will drop them;
-		 * => therefore this acquire is not for us! --Aidas
-		 */
-		struct sockaddr *sa = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]);
-		struct myaddrs *p;
-		int do_listen = 0;
-		for (p = lcconf->myaddrs; p; p = p->next) {
-			if (!cmpsaddrwop(p->addr, sa)) {
-				do_listen = 1;
-				break;
-			}
-		}
 
-		if (!do_listen) {
-			plog(LLV_DEBUG, LOCATION, NULL,
-				"ignore because do not listen on source address : %s.\n",
-				saddrwop2str(sa));
-			return 0;
-		}
+	if ((sp_src->sa_family == AF_INET
+	  && IN_MULTICAST(ntohl(((struct sockaddr_in *)sp_src)->sin_addr.s_addr)))
+#ifdef INET6
+	 || (sp_src->sa_family == AF_INET6
+	  && IN6_IS_ADDR_MULTICAST(&((struct sockaddr_in6 *)sp_src)->sin6_addr))
+#endif
+	) {
+		plog(LLV_DEBUG, LOCATION, NULL,
+			"ignore due to multicast source address: %s.\n",
+			saddrwop2str(sp_src));
+		return 0;
+	}
+
+	/* search for proper policyindex */
+	sp_out = getspbyspid(xpl->sadb_x_policy_id);
+	if (sp_out == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL, "no policy found: id:%d.\n",
+			xpl->sadb_x_policy_id);
+		return -1;
+	}
+	plog(LLV_DEBUG, LOCATION, NULL,
+		"suitable outbound SP found: %s.\n", spidx2str(&sp_out->spidx));
+
+	/* Before going further, let first get the source and destination
+	 * address that would be used for IKE negotiation. The logic is:
+	 * - if SP from SPD image contains local and remote hints, we
+	 *   use them (provided by MIGRATE).
+	 * - otherwise, we use the ones from the ipsecrequest, which means:
+	 *   - the addresses from the request for transport mode
+	 *   - the endpoints addresses for tunnel mode
+	 *
+	 * Note that:
+	 * 1) racoon does not support negotiation of bundles which
+	 *    simplifies the lookup for the addresses in the ipsecrequest
+	 *    list, as we expect only one.
+	 * 2) We do source and destination parts all together and do not
+	 *    accept semi-defined information. This is just a decision,
+	 *    there might be needs.
+	 *
+	 * --arno
+	 */
+	if (sp_out->req && sp_out->req->saidx.mode == IPSEC_MODE_TUNNEL) {
+		/* For Tunnel mode, SA addresses are the endpoints */
+		src = (struct sockaddr *) &sp_out->req->saidx.src;
+		dst = (struct sockaddr *) &sp_out->req->saidx.dst;
+	} else {
+		/* Otherwise use requested addresses.
+		 *
+		 * We need to explicitly setup sa_src and sa_dst too,
+		 * since the SA ports are different from IKE port. And
+		 * src/dst ports will be overwritten when the matching
+		 * phase1 is found. */
+		src = sa_src = sp_src;
+		dst = sa_dst = sp_dst;
+	}
+	if (sp_out->local && sp_out->remote) {
+		/* hints available, let's use them */
+		sa_src = src;
+		sa_dst = dst;
+		src = (struct sockaddr *) sp_out->local;
+		dst = (struct sockaddr *) sp_out->remote;
 	}
 
 	/*
@@ -1746,27 +1862,25 @@
 	 *       has to prcesss such a acquire message because racoon may
 	 *       lost the expire message.
 	 */
-	iph2[0] = getph2byid(src, dst, xpl->sadb_x_policy_id);
-	if (iph2[0] != NULL) {
-		if (iph2[0]->status < PHASE2ST_ESTABLISHED) {
+	iph2 = getph2byid(src, dst, xpl->sadb_x_policy_id);
+	if (iph2 != NULL) {
+		if (iph2->status < PHASE2ST_ESTABLISHED) {
 			plog(LLV_DEBUG, LOCATION, NULL,
 				"ignore the acquire because ph2 found\n");
 			return -1;
 		}
-		if (iph2[0]->status == PHASE2ST_EXPIRED)
-			iph2[0] = NULL;
+		if (iph2->status == PHASE2ST_EXPIRED)
+			iph2 = NULL;
 		/*FALLTHROUGH*/
 	}
 
-	/* search for proper policyindex */
-	sp_out = getspbyspid(xpl->sadb_x_policy_id);
-	if (sp_out == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "no policy found: id:%d.\n",
-			xpl->sadb_x_policy_id);
-		return -1;
+	/* Check we are listening on source address. If not, ignore. */
+	if (myaddr_getsport(src) == -1) {
+		plog(LLV_DEBUG, LOCATION, NULL,
+		     "Not listening on source address %s. Ignoring ACQUIRE.\n",
+		     saddrwop2str(src));
+		return 0;
 	}
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"suitable outbound SP found: %s.\n", spidx2str(&sp_out->spidx));
 
 	/* get inbound policy */
     {
@@ -1802,119 +1916,67 @@
 	}
     }
 
-	memset(iph2, 0, MAXNESTEDSA);
-
-	n = 0;
-
 	/* allocate a phase 2 */
-	iph2[n] = newph2();
-	if (iph2[n] == NULL) {
+	iph2 = newph2();
+	if (iph2 == NULL) {
 		plog(LLV_ERROR, LOCATION, NULL,
 			"failed to allocate phase2 entry.\n");
 		return -1;
 	}
-	iph2[n]->side = INITIATOR;
-	iph2[n]->spid = xpl->sadb_x_policy_id;
-	iph2[n]->satype = msg->sadb_msg_satype;
-	iph2[n]->seq = msg->sadb_msg_seq;
-	iph2[n]->status = PHASE2ST_STATUS2;
+	iph2->side = INITIATOR;
+	iph2->spid = xpl->sadb_x_policy_id;
+	iph2->satype = msg->sadb_msg_satype;
+	iph2->seq = msg->sadb_msg_seq;
+	iph2->status = PHASE2ST_STATUS2;
 
-	/* set end addresses of SA */
-	iph2[n]->dst = dupsaddr(PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]));
-	if (iph2[n]->dst == NULL) {
-		delph2(iph2[n]);
+	/* set address used by IKE for the negotiation (might differ from
+	 * SA address, i.e. might not be tunnel endpoints or addresses
+	 * of transport mode SA) */
+	iph2->dst = dupsaddr(dst);
+	if (iph2->dst == NULL) {
+		delph2(iph2);
 		return -1;
 	}
-	iph2[n]->src = dupsaddr(PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]));
-	if (iph2[n]->src == NULL) {
-		delph2(iph2[n]);
+	iph2->src = dupsaddr(src);
+	if (iph2->src == NULL) {
+		delph2(iph2);
 		return -1;
 	}
 
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"new acquire %s\n", spidx2str(&sp_out->spidx));
-
-	/* get sainfo */
-    {
-	vchar_t *idsrc, *iddst;
-
-	idsrc = ipsecdoi_sockaddr2id((struct sockaddr *)&sp_out->spidx.src,
-				sp_out->spidx.prefs, sp_out->spidx.ul_proto);
-	if (idsrc == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get ID for %s\n",
-			spidx2str(&sp_out->spidx));
-		delph2(iph2[n]);
-		return -1;
-	}
-	iddst = ipsecdoi_sockaddr2id((struct sockaddr *)&sp_out->spidx.dst,
-				sp_out->spidx.prefd, sp_out->spidx.ul_proto);
-	if (iddst == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get ID for %s\n",
-			spidx2str(&sp_out->spidx));
-		vfree(idsrc);
-		delph2(iph2[n]);
-		return -1;
-	}
-	{
-		struct remoteconf *conf;
-		conf = getrmconf(iph2[n]->dst);
-		if (conf != NULL)
-			remoteid=conf->ph1id;
-		else{
-			plog(LLV_DEBUG, LOCATION, NULL, "Warning: no valid rmconf !\n");
-			remoteid=0;
-		}
-	}
-	iph2[n]->sainfo = getsainfo(idsrc, iddst, NULL, remoteid);
-	vfree(idsrc);
-	vfree(iddst);
-	if (iph2[n]->sainfo == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get sainfo.\n");
-		delph2(iph2[n]);
-		return -1;
-		/* XXX should use the algorithm list from register message */
+	/* If sa_src and sa_dst have been set, this mean we have to
+	 * set iph2->sa_src and iph2->sa_dst to provide the addresses
+	 * of the SA because iph2->src and iph2->dst are only the ones
+	 * used for the IKE exchanges. Those that need these addresses
+	 * are for instance pk_sendupdate() or pk_sendgetspi() */
+	if (sa_src) {
+		iph2->sa_src = dupsaddr(sa_src);
+		iph2->sa_dst = dupsaddr(sa_dst);
 	}
 
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"selected sainfo: %s\n", sainfo2str(iph2[n]->sainfo));
-    }
-
-	if (set_proposal_from_policy(iph2[n], sp_out, sp_in) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to create saprop.\n");
-		delph2(iph2[n]);
+	if (isakmp_get_sainfo(iph2, sp_out, sp_in) < 0) {
+		delph2(iph2);
 		return -1;
 	}
+
 #ifdef HAVE_SECCTX
 	if (m_sec_ctx) {
-		set_secctx_in_proposal(iph2[n], spidx);
+		set_secctx_in_proposal(iph2, spidx);
 	}
 #endif /* HAVE_SECCTX */
 
-	insph2(iph2[n]);
+	insph2(iph2);
 
 	/* start isakmp initiation by using ident exchange */
 	/* XXX should be looped if there are multiple phase 2 handler. */
-	if (isakmp_post_acquire(iph2[n]) < 0) {
+	if (isakmp_post_acquire(iph2, NULL, TRUE) < 0) {
 		plog(LLV_ERROR, LOCATION, NULL,
 			"failed to begin ipsec sa negotication.\n");
-		goto err;
+		remph2(iph2);
+		delph2(iph2);
+		return -1;
 	}
 
 	return 0;
-
-err:
-	while (n >= 0) {
-		unbindph12(iph2[n]);
-		remph2(iph2[n]);
-		delph2(iph2[n]);
-		iph2[n] = NULL;
-		n--;
-	}
-	return -1;
 }
 
 static int
@@ -1942,6 +2004,7 @@
 	}
 	msg = (struct sadb_msg *)mhp[0];
 	sa = (struct sadb_sa *)mhp[SADB_EXT_SA];
+	pk_fixup_sa_addresses(mhp);
 	src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]);
 	dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]);
 
@@ -1973,14 +2036,13 @@
 
 	plog(LLV_ERROR, LOCATION, NULL,
 		"pfkey DELETE received: %s\n",
-		sadbsecas2str(iph2->src, iph2->dst,
+		sadbsecas2str(src, dst,
 			msg->sadb_msg_satype, sa->sadb_sa_spi, IPSEC_MODE_ANY));
 
 	/* send delete information */
 	if (iph2->status == PHASE2ST_ESTABLISHED)
 		isakmp_info_send_d2(iph2);
 
-	unbindph12(iph2);
 	remph2(iph2);
 	delph2(iph2);
 
@@ -2014,6 +2076,7 @@
 	struct ph2handle *iph2;
 {
 	struct policyindex *spidx = (struct policyindex *)iph2->spidx_gen;
+	struct sockaddr *src = NULL, *dst = NULL;
 	struct sadb_x_policy *xpl;
 	struct sadb_x_ipsecrequest *xisr;
 	struct saproto *pr;
@@ -2032,11 +2095,19 @@
 	/* get policy buffer size */
 	policylen = sizeof(struct sadb_x_policy);
 	if (type != SADB_X_SPDDELETE) {
+		if (iph2->sa_src && iph2->sa_dst) {
+			src = iph2->sa_src; /* MIPv6: Use SA addresses, */
+			dst = iph2->sa_dst; /* not IKE ones             */
+		} else {
+			src = iph2->src; /* Common case: SA addresses */
+			dst = iph2->dst; /* and IKE ones are the same */
+		}
+
 		for (pr = iph2->approval->head; pr; pr = pr->next) {
 			xisrlen = sizeof(*xisr);
 			if (pr->encmode == IPSECDOI_ATTR_ENC_MODE_TUNNEL) {
-				xisrlen += (sysdep_sa_len(iph2->src)
-				          + sysdep_sa_len(iph2->dst));
+				xisrlen += (sysdep_sa_len(src) +
+					    sysdep_sa_len(dst));
 			}
 
 			policylen += PFKEY_ALIGN8(xisrlen);
@@ -2082,7 +2153,7 @@
 		p->sadb_x_ctx_len = spidx->sec_ctx.ctx_strlen;
 		p->sadb_x_ctx_doi = spidx->sec_ctx.ctx_doi;
 		p->sadb_x_ctx_alg = spidx->sec_ctx.ctx_alg;
- 
+
 		memcpy(p + 1,spidx->sec_ctx.ctx_str,spidx->sec_ctx.ctx_strlen);
 		len += ctxlen;
 	}
@@ -2121,7 +2192,7 @@
 			goto err;
 		}
 
-		/* 
+		/*
 		 * the policy level cannot be unique because the policy
 		 * is defined later than SA, so req_id cannot be bound to SA.
 		 */
@@ -2141,20 +2212,20 @@
 		if (pr->encmode == IPSECDOI_ATTR_ENC_MODE_TUNNEL) {
 			int src_len, dst_len;
 
-			src_len = sysdep_sa_len(iph2->src);
-			dst_len = sysdep_sa_len(iph2->dst);
+			src_len = sysdep_sa_len(src);
+			dst_len = sysdep_sa_len(dst);
 			xisrlen += src_len + dst_len;
 
-			memcpy(p, iph2->src, src_len);
+			memcpy(p, src, src_len);
 			p += src_len;
 
-			memcpy(p, iph2->dst, dst_len);
+			memcpy(p, dst, dst_len);
 			p += dst_len;
 		}
 
 		xisr->sadb_x_ipsecrequest_len = PFKEY_ALIGN8(xisrlen);
 		xisr = (struct sadb_x_ipsecrequest *)p;
-		
+
 	}
 	racoon_free(pr_rlist);
 
@@ -2219,10 +2290,12 @@
 {
 	struct sadb_address *saddr, *daddr;
 	struct sadb_x_policy *xpl;
- 	struct sadb_lifetime *lt;
+	struct sadb_lifetime *lt;
 	struct policyindex spidx;
 	struct secpolicy *sp;
- 	u_int64_t created;
+	struct sockaddr *local=NULL, *remote=NULL;
+	u_int64_t created;
+	int ret;
 
 	/* sanity check */
 	if (mhp[0] == NULL
@@ -2277,15 +2350,29 @@
 
 	sp = getsp(&spidx);
 	if (sp == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"such policy does not already exist: \"%s\"\n",
+		plog(LLV_DEBUG, LOCATION, NULL,
+			"this policy did not exist for removal: \"%s\"\n",
 			spidx2str(&spidx));
 	} else {
+		/* preserve hints before deleting the SP */
+		local = sp->local;
+		remote = sp->remote;
+		sp->local = NULL;
+		sp->remote = NULL;
+
 		remsp(sp);
 		delsp(sp);
 	}
 
-	if (addnewsp(mhp) < 0)
+	/* Add new SP (with old hints) */
+	ret = addnewsp(mhp, local, remote);
+
+	if (local != NULL)
+		racoon_free(local);
+	if (remote != NULL)
+		racoon_free(remote);
+
+	if (ret < 0)
 		return -1;
 
 	return 0;
@@ -2344,7 +2431,9 @@
 	struct sadb_lifetime *lt;
 	struct policyindex spidx;
 	struct secpolicy *sp;
+	struct sockaddr *local = NULL, *remote = NULL;
 	u_int64_t created;
+	int ret;
 
 	/* sanity check */
 	if (mhp[0] == NULL
@@ -2403,11 +2492,26 @@
 			"such policy already exists. "
 			"anyway replace it: %s\n",
 			spidx2str(&spidx));
+
+		/* preserve hints before deleting the SP */
+		local = sp->local;
+		remote = sp->remote;
+		sp->local = NULL;
+		sp->remote = NULL;
+
 		remsp(sp);
 		delsp(sp);
 	}
 
-	if (addnewsp(mhp) < 0)
+	/* Add new SP (with old hints) */
+	ret = addnewsp(mhp, local, remote);
+
+	if (local != NULL)
+		racoon_free(local);
+	if (remote != NULL)
+		racoon_free(remote);
+
+	if (ret < 0)
 		return -1;
 
 	return 0;
@@ -2628,7 +2732,9 @@
 	struct sadb_lifetime *lt;
 	struct policyindex spidx;
 	struct secpolicy *sp;
+	struct sockaddr *local=NULL, *remote=NULL;
 	u_int64_t created;
+	int ret;
 
 	/* sanity check */
 	if (mhp[0] == NULL) {
@@ -2637,7 +2743,6 @@
 		return -1;
 	}
 	msg = (struct sadb_msg *)mhp[0];
-
 	saddr = (struct sadb_address *)mhp[SADB_EXT_ADDRESS_SRC];
 	daddr = (struct sadb_address *)mhp[SADB_EXT_ADDRESS_DST];
 	xpl = (struct sadb_x_policy *)mhp[SADB_X_EXT_POLICY];
@@ -2692,11 +2797,26 @@
 			"such policy already exists. "
 			"anyway replace it: %s\n",
 			spidx2str(&spidx));
+
+		/* preserve hints before deleting the SP */
+		local = sp->local;
+		remote = sp->remote;
+		sp->local = NULL;
+		sp->remote = NULL;
+
 		remsp(sp);
 		delsp(sp);
 	}
 
-	if (addnewsp(mhp) < 0)
+	/* Add new SP (with old hints) */
+	ret = addnewsp(mhp, local, remote);
+
+	if (local != NULL)
+		racoon_free(local);
+	if (remote != NULL)
+		racoon_free(remote);
+
+	if (ret < 0)
 		return -1;
 
 	return 0;
@@ -2718,10 +2838,731 @@
 	return 0;
 }
 
+#if defined(SADB_X_MIGRATE) && defined(SADB_X_EXT_KMADDRESS)
+
+/* MIGRATE support (pk_recvmigrate() is the handler of MIGRATE message).
+ *
+ * pk_recvmigrate()
+ *   1) some preprocessing and checks
+ *   2) parsing of sadb_x_kmaddress extension
+ *   3) SP lookup using selectors and content of policy extension from MIGRATE
+ *   4) resolution of current local and remote IKE addresses
+ *   5) Use of addresses to get Phase 1 handler if any
+ *   6) Update of IKE addresses in Phase 1 (iph1->local and iph1->remote)
+ *   7) Update of IKE addresses in Phase 2 (iph2->src and iph2->dst)
+ *   8) Update of IKE addresses in SP (sp->local and sp->remote)
+ *   9) Loop on sadb_x_ipsecrequests pairs from MIGRATE
+ *      - update of associated ipsecrequests entries in sp->req (should be
+ *        only one as racoon does not support bundles), i.e. update of
+ *        tunnel endpoints when required.
+ *      - If tunnel mode endpoints have been updated, lookup of associated
+ *        Phase 2 handle to also update sa_src and sa_dst entries
+ *
+ * XXX Note that we do not support yet the update of SA addresses for transport
+ *     mode, but only the update of SA addresses for tunnel mode (endpoints).
+ *     Reasons are:
+ *      - there is no initial need for MIPv6
+ *      - racoon does not support bundles
+ *      - this would imply more work to deal with sainfo update (if feasible).
+ */
+
+/* Generic argument structure for migration callbacks */
+struct migrate_args {
+	struct sockaddr *local;
+	struct sockaddr *remote;
+};
+
+/*
+ * Update local and remote addresses of given Phase 1. Schedule removal
+ * if negotiation was going on and restart a one from updated address.
+ *
+ * -1 is returned on error. 0 if everything went right.
+ */
+static int
+migrate_ph1_ike_addresses(iph1, arg)
+        struct ph1handle *iph1;
+        void *arg;
+{
+	struct migrate_args *ma = (struct migrate_args *) arg;
+	struct remoteconf *rmconf;
+	u_int16_t port;
+
+	/* Already up-to-date? */
+	if (cmpsaddr(iph1->local, ma->local) == CMPSADDR_MATCH &&
+	    cmpsaddr(iph1->remote, ma->remote) == CMPSADDR_MATCH)
+		return 0;
+
+	if (iph1->status < PHASE1ST_ESTABLISHED) {
+		/* Bad luck! We received a MIGRATE *while* negotiating
+		 * Phase 1 (i.e. it was not established yet). If we act as
+		 * initiator we need to restart the negotiation. As
+		 * responder, our best bet is to update our addresses
+		 * and wait for the initiator to do something */
+		plog(LLV_WARNING, LOCATION, NULL, "MIGRATE received *during* "
+		     "Phase 1 negotiation (%s).\n",
+		     saddr2str_fromto("%s => %s", ma->local, ma->remote));
+
+		/* If we are not acting as initiator, let's just leave and
+		 * let the remote peer handle the restart */
+		rmconf = getrmconf(ma->remote, 0);
+		if (rmconf == NULL || !rmconf->passive) {
+			iph1->status = PHASE1ST_EXPIRED;
+			isakmp_ph1delete(iph1);
+
+			/* This is unlikely, but let's just check if a Phase 1
+			 * for the new addresses already exist */
+			if (getph1byaddr(ma->local, ma->remote, 0)) {
+				plog(LLV_WARNING, LOCATION, NULL, "No need "
+				     "to start a new Phase 1 negotiation. One "
+				     "already exists.\n");
+				return 0;
+			}
+
+			plog(LLV_WARNING, LOCATION, NULL, "As initiator, "
+			     "restarting it.\n");
+			 /* Note that the insertion of the new Phase 1 will not
+			  * interfere with the fact we are called from enumph1,
+			  * because it is inserted as first element. --arno */
+			isakmp_ph1begin_i(rmconf, ma->local, ma->remote);
+
+			return 0;
+		}
+	}
+
+	if (iph1->local != NULL) {
+		plog(LLV_DEBUG, LOCATION, NULL, "Migrating Phase 1 local "
+		     "address from %s\n",
+		     saddr2str_fromto("%s to %s", iph1->local, ma->local));
+		port = extract_port(iph1->local);
+		racoon_free(iph1->local);
+	} else
+		port = 0;
+
+	iph1->local = dupsaddr(ma->local);
+	if (iph1->local == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL, "unable to allocate "
+		     "Phase 1 local address.\n");
+		return -1;
+	}
+	set_port(iph1->local, port);
+
+	if (iph1->remote != NULL) {
+		plog(LLV_DEBUG, LOCATION, NULL, "Migrating Phase 1 remote "
+		     "address from %s\n",
+		     saddr2str_fromto("%s to %s", iph1->remote, ma->remote));
+		port = extract_port(iph1->remote);
+		racoon_free(iph1->remote);
+	} else
+		port = 0;
+
+	iph1->remote = dupsaddr(ma->remote);
+	if (iph1->remote == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL, "unable to allocate "
+		     "Phase 1 remote address.\n");
+		return -1;
+	}
+	set_port(iph1->remote, port);
+
+	return 0;
+}
+
+/* Update src and dst of all current Phase 2 handles.
+ * with provided local and remote addresses.
+ * Our intent is NOT to modify IPsec SA endpoints but IKE
+ * addresses so we need to take care to separate those if
+ * they are different. -1 is returned on error. 0 if everything
+ * went right.
+ *
+ * Note: we do not maintain port information as it is not
+ *       expected to be meaningful --arno
+ */
+static int
+migrate_ph2_ike_addresses(iph2, arg)
+	struct ph2handle *iph2;
+	void *arg;
+{
+	struct migrate_args *ma = (struct migrate_args *) arg;
+	struct ph1handle *iph1;
+
+	/* If Phase 2 has an associated Phase 1, migrate addresses */
+	if (iph2->ph1)
+		migrate_ph1_ike_addresses(iph2->ph1, arg);
+
+	/* Already up-to-date? */
+	if (cmpsaddr(iph2->src, ma->local) == CMPSADDR_MATCH &&
+	    cmpsaddr(iph2->dst, ma->remote) == CMPSADDR_MATCH)
+		return 0;
+
+	/* save src/dst as sa_src/sa_dst before rewriting */
+	if (iph2->sa_src == NULL && iph2->sa_dst == NULL) {
+		iph2->sa_src = iph2->src;
+		iph2->sa_dst = iph2->dst;
+		iph2->src = NULL;
+		iph2->dst = NULL;
+	}
+
+	if (iph2->src != NULL)
+		racoon_free(iph2->src);
+	iph2->src = dupsaddr(ma->local);
+	if (iph2->src == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL,
+		     "unable to allocate Phase 2 src address.\n");
+		return -1;
+	}
+
+	if (iph2->dst != NULL)
+		racoon_free(iph2->dst);
+	iph2->dst = dupsaddr(ma->remote);
+	if (iph2->dst == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL,
+		     "unable to allocate Phase 2 dst address.\n");
+		return -1;
+	}
+
+	return 0;
+}
+
+/* Consider existing Phase 2 handles with given spid and update their source
+ * and destination addresses for SA. As racoon does not support bundles, if
+ * we modify multiple occurrences, this probably imply rekeying has happened.
+ *
+ * Both addresses passed to the function are expected not to be NULL and of
+ * same family. -1 is returned on error. 0 if everything went right.
+ *
+ * Specific care is needed to support Phase 2 for which negotiation has
+ * already started but are which not yet established.
+ */
+static int
+migrate_ph2_sa_addresses(iph2, args)
+	struct ph2handle *iph2;
+	void *args;
+{
+	struct migrate_args *ma = (struct migrate_args *) args;
+
+	if (iph2->sa_src != NULL) {
+		racoon_free(iph2->sa_src);
+		iph2->sa_src = NULL;
+	}
+
+	if (iph2->sa_dst != NULL) {
+		racoon_free(iph2->sa_dst);
+		iph2->sa_dst = NULL;
+	}
+
+	iph2->sa_src = dupsaddr(ma->local);
+	if (iph2->sa_src == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL,
+		     "unable to allocate Phase 2 sa_src address.\n");
+		return -1;
+	}
+
+	iph2->sa_dst = dupsaddr(ma->remote);
+	if (iph2->sa_dst == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL,
+		     "unable to allocate Phase 2 sa_dst address.\n");
+		return -1;
+	}
+
+	if (iph2->status < PHASE2ST_ESTABLISHED) {
+		struct remoteconf *rmconf;
+		/* We were negotiating for that SA when we received the MIGRATE.
+		 * We cannot simply update the addresses and let the exchange
+		 * go on. We have to restart the whole negotiation if we are
+		 * the initiator. Otherwise (acting as responder), we just need
+		 * to delete our ph2handle and wait for the initiator to start
+		 * a new negotiation. */
+
+		if (iph2->ph1 && iph2->ph1->rmconf)
+			rmconf = iph2->ph1->rmconf;
+		else
+			rmconf = getrmconf(iph2->dst, 0);
+
+		if (rmconf && !rmconf->passive) {
+			struct ph1handle *iph1hint;
+
+			plog(LLV_WARNING, LOCATION, iph2->dst, "MIGRATE received "
+			     "*during* IPsec SA negotiation. As initiator, "
+			     "restarting it.\n");
+
+			/* Turn off expiration timer ...*/
+			sched_cancel(&iph2->sce);
+			iph2->status = PHASE2ST_EXPIRED;
+
+			/* ... clean Phase 2 handle ... */
+			iph1hint = iph2->ph1;
+			initph2(iph2);
+			iph2->status = PHASE2ST_STATUS2;
+
+			/* and start a new negotiation */
+			if (isakmp_post_acquire(iph2, iph1hint, FALSE) < 0) {
+				plog(LLV_ERROR, LOCATION, iph2->dst, "failed "
+				     "to begin IPsec SA renegotiation after "
+				     "MIGRATE reception.\n");
+				remph2(iph2);
+				delph2(iph2);
+				return -1;
+			}
+		} else {
+			plog(LLV_WARNING, LOCATION, iph2->dst, "MIGRATE received "
+			     "*during* IPsec SA negotiation. As responder, let's"
+			     "wait for the initiator to act.\n");
+
+			/* Simply schedule deletion */
+			isakmp_ph2expire(iph2);
+		}
+	}
+
+	return 0;
+}
+
+/* Update SP hints (local and remote addresses) for future IKE
+ * negotiations of SA associated with that SP. -1 is returned
+ * on error. 0 if everything went right.
+ *
+ * Note: we do not maintain port information as it is not
+ *       expected to be meaningful --arno
+ */
+static int
+migrate_sp_ike_addresses(sp, local, remote)
+        struct secpolicy *sp;
+        struct sockaddr *local, *remote;
+{
+	if (sp == NULL || local == NULL || remote == NULL)
+		return -1;
+
+	if (sp->local != NULL)
+		racoon_free(sp->local);
+
+	sp->local = dupsaddr(local);
+	if (sp->local == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL, "unable to allocate "
+		     "local hint for SP.\n");
+		return -1;
+	}
+
+	if (sp->remote != NULL)
+		racoon_free(sp->remote);
+
+	sp->remote = dupsaddr(remote);
+	if (sp->remote == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL, "unable to allocate "
+		     "remote hint for SP.\n");
+		return -1;
+	}
+
+	return 0;
+}
+
+/* Given current ipsecrequest (isr_cur) to be migrated in considered
+   tree, the function first checks that it matches the expected one
+   (xisr_old) provided in MIGRATE message and then updates the addresses
+   if it is tunnel mode (with content of xisr_new). Various other checks
+   are performed. For transport mode, structures are not modified, only
+   the checks are done. -1 is returned on error. */
+static int
+migrate_ph2_one_isr(spid, isr_cur, xisr_old, xisr_new)
+        u_int32_t spid;
+        struct ipsecrequest *isr_cur;
+	struct sadb_x_ipsecrequest *xisr_old, *xisr_new;
+{
+	struct secasindex *saidx = &isr_cur->saidx;
+	struct sockaddr *osaddr, *odaddr, *nsaddr, *ndaddr;
+	struct ph2selector ph2sel;
+	struct migrate_args ma;
+
+	/* First, check that mode and proto do match */
+	if (xisr_old->sadb_x_ipsecrequest_proto != saidx->proto ||
+	    xisr_old->sadb_x_ipsecrequest_mode != saidx->mode ||
+	    xisr_new->sadb_x_ipsecrequest_proto != saidx->proto ||
+	    xisr_new->sadb_x_ipsecrequest_mode != saidx->mode)
+		return -1;
+
+	/* Then, verify reqid if necessary */
+	if (isr_cur->saidx.reqid &&
+	    (xisr_old->sadb_x_ipsecrequest_reqid != IPSEC_LEVEL_UNIQUE ||
+	     xisr_new->sadb_x_ipsecrequest_reqid != IPSEC_LEVEL_UNIQUE ||
+	     isr_cur->saidx.reqid != xisr_old->sadb_x_ipsecrequest_reqid ||
+	     isr_cur->saidx.reqid != xisr_new->sadb_x_ipsecrequest_reqid))
+		return -1;
+
+	/* If not tunnel mode, our work is over */
+	if (saidx->mode != IPSEC_MODE_TUNNEL) {
+		plog(LLV_DEBUG, LOCATION, NULL, "SADB_X_MIGRATE: "
+		     "non tunnel mode isr, skipping SA address migration.\n");
+		return 0;
+	}
+
+	/* Tunnel mode: let's check addresses do match and then update them. */
+	osaddr = (struct sockaddr *)(xisr_old + 1);
+	odaddr = (struct sockaddr *)(((u_int8_t *)osaddr) + sysdep_sa_len(osaddr));
+	nsaddr = (struct sockaddr *)(xisr_new + 1);
+	ndaddr = (struct sockaddr *)(((u_int8_t *)nsaddr) + sysdep_sa_len(nsaddr));
+
+	/* Check family does match */
+	if (osaddr->sa_family != odaddr->sa_family ||
+	    nsaddr->sa_family != ndaddr->sa_family)
+		return -1;
+
+	/* Check family does match */
+	if (saidx->src.ss_family != osaddr->sa_family)
+		return -1;
+
+	/* We log IPv4 to IPv6 and IPv6 to IPv4 switches */
+	if (nsaddr->sa_family != osaddr->sa_family)
+		plog(LLV_INFO, LOCATION, NULL, "SADB_X_MIGRATE: "
+		     "changing address families (%d to %d) for endpoints.\n",
+		     osaddr->sa_family, nsaddr->sa_family);
+
+	if (cmpsaddr(osaddr, (struct sockaddr *) &saidx->src) != CMPSADDR_MATCH ||
+	    cmpsaddr(odaddr, (struct sockaddr *) &saidx->dst) != CMPSADDR_MATCH) {
+		plog(LLV_DEBUG, LOCATION, NULL, "SADB_X_MIGRATE: "
+		     "mismatch of addresses in saidx and xisr.\n");
+		return -1;
+	}
+
+	/* Excellent. Let's grab associated Phase 2 handle (if any)
+	 * and update its sa_src and sa_dst entries.  Note that we
+	 * make the assumption that racoon does not support bundles
+	 * and make the lookup using spid: we blindly update
+	 * sa_src and sa_dst for _all_ found Phase 2 handles */
+	memset(&ph2sel, 0, sizeof(ph2sel));
+	ph2sel.spid = spid;
+
+	memset(&ma, 0, sizeof(ma));
+	ma.local = nsaddr;
+	ma.remote = ndaddr;
+
+	if (enumph2(&ph2sel, migrate_ph2_sa_addresses, &ma) < 0)
+		return -1;
+
+	/* Now we can do the update of endpoints in secasindex */
+	memcpy(&saidx->src, nsaddr, sysdep_sa_len(nsaddr));
+	memcpy(&saidx->dst, ndaddr, sysdep_sa_len(ndaddr));
+
+	return 0;
+}
+
+/* Process the raw (unparsed yet) list of sadb_x_ipsecrequests of MIGRATE
+ * message. For each sadb_x_ipsecrequest pair (old followed by new),
+ * the corresponding ipsecrequest entry in the SP is updated. Associated
+ * existing Phase 2 handle is also updated (if any) */
+static int
+migrate_sp_isr_list(sp, xisr_list, xisr_list_len)
+        struct secpolicy *sp;
+	struct sadb_x_ipsecrequest *xisr_list;
+	int xisr_list_len;
+{
+	struct sadb_x_ipsecrequest *xisr_new, *xisr_old = xisr_list;
+	int xisr_old_len, xisr_new_len;
+	struct ipsecrequest *isr_cur;
+
+	isr_cur = sp->req; /* ipsecrequest list from from sp */
+
+	while (xisr_list_len > 0 && isr_cur != NULL) {
+		/* Get old xisr (length field is in bytes) */
+		xisr_old_len = xisr_old->sadb_x_ipsecrequest_len;
+		if (xisr_old_len < sizeof(*xisr_old) ||
+		    xisr_old_len + sizeof(*xisr_new) > xisr_list_len) {
+			plog(LLV_ERROR, LOCATION, NULL, "SADB_X_MIGRATE: "
+			     "invalid ipsecrequest length. Exiting.\n");
+			return -1;
+		}
+
+		/* Get new xisr with updated info */
+		xisr_new = (struct sadb_x_ipsecrequest *)(((u_int8_t *)xisr_old) + xisr_old_len);
+		xisr_new_len = xisr_new->sadb_x_ipsecrequest_len;
+		if (xisr_new_len < sizeof(*xisr_new) ||
+		    xisr_new_len + xisr_old_len > xisr_list_len) {
+			plog(LLV_ERROR, LOCATION, NULL, "SADB_X_MIGRATE: "
+			     "invalid ipsecrequest length. Exiting.\n");
+			return -1;
+		}
+
+		/* Start by migrating current ipsecrequest from SP */
+		if (migrate_ph2_one_isr(sp->id, isr_cur, xisr_old, xisr_new) == -1) {
+			plog(LLV_ERROR, LOCATION, NULL, "SADB_X_MIGRATE: "
+			     "Unable to match and migrate isr. Exiting.\n");
+			return -1;
+		}
+
+		/* Update pointers for next round */
+		xisr_list_len -= xisr_old_len + xisr_new_len;
+		xisr_old = (struct sadb_x_ipsecrequest *)(((u_int8_t *)xisr_new) +
+							  xisr_new_len);
+
+		isr_cur = isr_cur->next; /* Get next ipsecrequest from SP */
+	}
+
+	/* Check we had the same amount of pairs in the MIGRATE
+	   as the number of ipsecrequests in the SP */
+	if ((xisr_list_len != 0) || isr_cur != NULL) {
+		plog(LLV_ERROR, LOCATION, NULL, "SADB_X_MIGRATE: "
+		     "number of ipsecrequest does not match the one in SP.\n");
+		return -1;
+	}
+
+	return 0;
+}
+
+/* Parse sadb_x_kmaddress extension and make local and remote
+ * parameters point to the new addresses (zero copy). -1 is
+ * returned on error, meaning that addresses are not usable */
+static int
+parse_kmaddress(kmaddr, local, remote)
+        struct sadb_x_kmaddress *kmaddr;
+	struct sockaddr **local, **remote;
+{
+	int addrslen, local_len=0;
+	struct ph1handle *iph1;
+
+	if (kmaddr == NULL)
+		return -1;
+
+	/* Grab addresses in sadb_x_kmaddress extension */
+	addrslen = PFKEY_EXTLEN(kmaddr) - sizeof(*kmaddr);
+	if (addrslen < sizeof(struct sockaddr))
+		return -1;
+
+	*local = (struct sockaddr *)(kmaddr + 1);
+
+	switch ((*local)->sa_family) {
+	case AF_INET:
+		local_len = sizeof(struct sockaddr_in);
+		break;
+#ifdef INET6
+	case AF_INET6:
+		local_len = sizeof(struct sockaddr_in6);
+		break;
+#endif
+	default:
+		return -1;
+	}
+
+	if (addrslen != PFKEY_ALIGN8(2*local_len))
+		return -1;
+
+	*remote = (struct sockaddr *)(((u_int8_t *)(*local)) + local_len);
+
+	if ((*local)->sa_family != (*remote)->sa_family)
+		return -1;
+
+	return 0;
+}
+
+/* Handler of PF_KEY MIGRATE message. Helpers are above */
+static int
+pk_recvmigrate(mhp)
+	caddr_t *mhp;
+{
+	struct sadb_address *saddr, *daddr;
+	struct sockaddr *old_saddr, *new_saddr;
+	struct sockaddr *old_daddr, *new_daddr;
+	struct sockaddr *old_local, *old_remote;
+	struct sockaddr *local, *remote;
+	struct sadb_x_kmaddress *kmaddr;
+	struct sadb_x_policy *xpl;
+	struct sadb_x_ipsecrequest *xisr_list;
+	struct sadb_lifetime *lt;
+	struct policyindex spidx;
+	struct secpolicy *sp;
+	struct ipsecrequest *isr_cur;
+	struct secasindex *oldsaidx;
+	struct ph2handle *iph2;
+	struct ph1handle *iph1;
+	struct ph2selector ph2sel;
+	struct ph1selector ph1sel;
+	u_int32_t spid;
+	u_int64_t created;
+	int xisr_list_len;
+	int ulproto;
+	struct migrate_args ma;
+
+	/* Some sanity checks */
+
+	if (mhp[0] == NULL
+	 || mhp[SADB_EXT_ADDRESS_SRC] == NULL
+	 || mhp[SADB_EXT_ADDRESS_DST] == NULL
+	 || mhp[SADB_X_EXT_KMADDRESS] == NULL
+	 || mhp[SADB_X_EXT_POLICY] == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL,
+			"SADB_X_MIGRATE: invalid MIGRATE message received.\n");
+		return -1;
+	}
+	kmaddr = (struct sadb_x_kmaddress *)mhp[SADB_X_EXT_KMADDRESS];
+	saddr = (struct sadb_address *)mhp[SADB_EXT_ADDRESS_SRC];
+	daddr = (struct sadb_address *)mhp[SADB_EXT_ADDRESS_DST];
+	xpl = (struct sadb_x_policy *)mhp[SADB_X_EXT_POLICY];
+	lt = (struct sadb_lifetime*)mhp[SADB_EXT_LIFETIME_HARD];
+	if (lt != NULL)
+		created = lt->sadb_lifetime_addtime;
+	else
+		created = 0;
+
+	if (xpl->sadb_x_policy_type != IPSEC_POLICY_IPSEC) {
+		plog(LLV_WARNING, LOCATION, NULL,"SADB_X_MIGRATE: "
+		     "found non IPsec policy in MIGRATE message. Exiting.\n");
+		return -1;
+	}
+
+	if (PFKEY_EXTLEN(xpl) < sizeof(*xpl)) {
+		plog(LLV_ERROR, LOCATION, NULL, "SADB_X_MIGRATE: "
+		     "invalid size for sadb_x_policy. Exiting.\n");
+		return -1;
+	}
+
+	/* Some logging to help debbugging */
+	if (xpl->sadb_x_policy_dir == IPSEC_DIR_OUTBOUND)
+		plog(LLV_DEBUG, LOCATION, NULL,
+		     "SADB_X_MIGRATE: Outbound SA being migrated.\n");
+	else
+		plog(LLV_DEBUG, LOCATION, NULL,
+		     "SADB_X_MIGRATE: Inbound SA being migrated.\n");
+
+	/* validity check */
+	xisr_list = (struct sadb_x_ipsecrequest *)(xpl + 1);
+	xisr_list_len = PFKEY_EXTLEN(xpl) - sizeof(*xpl);
+	if (xisr_list_len < sizeof(*xisr_list)) {
+		plog(LLV_ERROR, LOCATION, NULL, "SADB_X_MIGRATE: "
+		     "invalid sadb_x_policy message length. Exiting.\n");
+		return -1;
+	}
+
+	if (parse_kmaddress(kmaddr, &local, &remote) == -1) {
+		plog(LLV_ERROR, LOCATION, NULL, "SADB_X_MIGRATE: "
+		     "invalid sadb_x_kmaddress extension. Exiting.\n");
+		return -1;
+	}
+
+	/* 0 means ANY */
+	if (saddr->sadb_address_proto == 0)
+		ulproto = IPSEC_ULPROTO_ANY;
+	else
+		ulproto = saddr->sadb_address_proto;
+
+#ifdef HAVE_PFKEY_POLICY_PRIORITY
+	KEY_SETSECSPIDX(xpl->sadb_x_policy_dir,
+			saddr + 1,
+			daddr + 1,
+			saddr->sadb_address_prefixlen,
+			daddr->sadb_address_prefixlen,
+			ulproto,
+			xpl->sadb_x_policy_priority,
+			created,
+			&spidx);
+#else
+	KEY_SETSECSPIDX(xpl->sadb_x_policy_dir,
+			saddr + 1,
+			daddr + 1,
+			saddr->sadb_address_prefixlen,
+			daddr->sadb_address_prefixlen,
+			ulproto,
+			created,
+			&spidx);
+#endif
+
+	/* Everything seems ok, let's get the SP.
+	 *
+	 * XXX We could also do the lookup using the spid from xpl.
+	 *     I don't know which one is better.  --arno */
+	sp = getsp(&spidx);
+	if (sp == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL,
+			"SADB_X_MIGRATE: Passed policy does not exist: %s\n",
+			spidx2str(&spidx));
+		return -1;
+	}
+
+	/* Get the best source and destination addresses used for IKE
+	 * negotiation, to find and migrate existing Phase 1 */
+	if (sp->local && sp->remote) {
+		/* hints available, let's use them */
+		old_local  = (struct sockaddr *)sp->local;
+		old_remote = (struct sockaddr *)sp->remote;
+	} else if (sp->req && sp->req->saidx.mode == IPSEC_MODE_TUNNEL) {
+		/* Tunnel mode and no hint, use endpoints */
+		old_local  = (struct sockaddr *)&sp->req->saidx.src;
+		old_remote = (struct sockaddr *)&sp->req->saidx.dst;
+	} else {
+		/* default, use selectors as fallback */
+		old_local  = (struct sockaddr *)&sp->spidx.src;
+		old_remote = (struct sockaddr *)&sp->spidx.dst;
+	}
+
+	/* We migrate all Phase 1 that match our old local and remote
+	 * addresses (no matter their state).
+	 *
+	 * XXX In fact, we should probably havea special treatment for
+	 * Phase 1 that are being established when we receive a MIGRATE.
+	 * This can happen if a movement occurs during the initial IKE
+	 * negotiation. In that case, I wonder if should restart the
+	 * negotiation from the new address or just update things like
+	 * we do it now.
+	 *
+	 * XXX while looking at getph1byaddr(), the comment at the
+	 * beginning of the function expects comparison to happen
+	 * without ports considerations but it uses CMPSADDR() which
+	 * relies either on cmpsaddrstrict() or cmpsaddrwop() based
+	 * on NAT-T support being activated. That make me wonder if I
+	 * should force ports to 0 (ANY) in local and remote values
+	 * used below.
+	 *
+	 * -- arno */
+
+	/* Apply callback data ...*/
+	memset(&ma, 0, sizeof(ma));
+	ma.local = local;
+	ma.remote = remote;
+
+	/* Fill phase1 match criteria ... */
+	memset(&ph1sel, 0, sizeof(ph1sel));
+	ph1sel.local = old_local;
+	ph1sel.remote = old_remote;
+
+
+	/* Have matching Phase 1 found and addresses updated. As this is a
+	 * time consuming task on a busy responder, and MIGRATE messages
+	 * are always sent for *both* inbound and outbound (and possibly
+	 * forward), we only do that for outbound SP. */
+	if (xpl->sadb_x_policy_dir == IPSEC_DIR_OUTBOUND &&
+	    enumph1(&ph1sel, migrate_ph1_ike_addresses, &ma) < 0) {
+		plog(LLV_ERROR, LOCATION, NULL, "SADB_X_MIGRATE: Unable "
+		     "to migrate Phase 1 addresses.\n");
+		return -1;
+	}
+
+	/* We can now update IKE addresses in Phase 2 handle. */
+	memset(&ph2sel, 0, sizeof(ph2sel));
+	ph2sel.spid = sp->id;
+	if (enumph2(&ph2sel, migrate_ph2_ike_addresses, &ma) < 0) {
+		plog(LLV_ERROR, LOCATION, NULL, "SADB_X_MIGRATE: Unable "
+		     "to migrate Phase 2 IKE addresses.\n");
+		return -1;
+	}
+
+	/* and _then_ in SP. */
+	if (migrate_sp_ike_addresses(sp, local, remote) < 0) {
+		plog(LLV_ERROR, LOCATION, NULL,
+		     "SADB_X_MIGRATE: Unable to migrate SP IKE addresses.\n");
+		return -1;
+	}
+
+	/* Loop on sadb_x_ipsecrequest list to possibly update sp->req
+	 * entries and associated live Phase 2 handles (their sa_src
+	 * and sa_dst) */
+	if (migrate_sp_isr_list(sp, xisr_list, xisr_list_len) < 0) {
+		plog(LLV_ERROR, LOCATION, NULL,
+		     "SADB_X_MIGRATE: Unable to migrate isr list.\n");
+		return -1;
+	}
+
+	return 0;
+}
+#endif
+
 #ifndef ANDROID_PATCHED
 
 /*
- * send error against acquire message to kenrel.
+ * send error against acquire message to kernel.
  */
 int
 pk_sendeacquire(iph2)
@@ -2759,8 +3600,8 @@
 #else
 
 int pk_sendeacquire(struct ph2handle *iph2)
-{
-	exit(1);
+{       
+        exit(1);
 }
 
 #endif
@@ -2787,8 +3628,8 @@
 		break;
 	case IPSECDOI_PROTO_IPCOMP:
 		plog(LLV_DEBUG, LOCATION, NULL,
-			"compression algorithm can not be checked "
-			"because sadb message doesn't support it.\n");
+			"no check of compression algorithm; "
+			"not supported in sadb message.\n");
 		return 0;
 	default:
 		plog(LLV_ERROR, LOCATION, NULL,
@@ -2848,6 +3689,11 @@
 		return NULL;
 
 	reallen = PFKEY_UNUNIT64(buf.sadb_msg_len);
+	if (reallen < sizeof(buf)) {
+		*lenp = -1;
+		errno = EIO;
+		return NULL;    /*fatal*/
+	}
 	if ((newmsg = racoon_calloc(1, reallen)) == NULL)
 		return NULL;
 
@@ -2880,8 +3726,9 @@
 }
 
 static int
-addnewsp(mhp)
+addnewsp(mhp, local, remote)
 	caddr_t *mhp;
+	struct sockaddr *local, *remote;
 {
 	struct secpolicy *new = NULL;
 	struct sadb_address *saddr, *daddr;
@@ -3090,6 +3937,12 @@
 	}
 #endif /* HAVE_SECCTX */
 
+	/* Set local and remote hints for that SP, if available */
+	if (local && remote) {
+		new->local = dupsaddr(local);
+		new->remote = dupsaddr(remote);
+	}
+
 	inssp(new);
 
 	return 0;
diff --git a/src/racoon/pfkey.h b/src/racoon/pfkey.h
index 547f94a..cfe111d 100644
--- a/src/racoon/pfkey.h
+++ b/src/racoon/pfkey.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: pfkey.h,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
+/*	$NetBSD: pfkey.h,v 1.8 2009/07/03 06:40:10 tteras Exp $	*/
 
 /* Id: pfkey.h,v 1.3 2004/06/11 16:00:17 ludvigm Exp */
 
@@ -42,16 +42,17 @@
 extern const struct pfkey_satype pfkey_satypes[];
 extern const int pfkey_nsatypes;
 
-extern int pfkey_handler __P((void));
 extern vchar_t *pfkey_dump_sadb __P((int));
 extern void pfkey_flush_sadb __P((u_int));
 extern int pfkey_init __P((void));
+extern int pfkey_reload __P((void));
 
 extern struct pfkey_st *pfkey_getpst __P((caddr_t *, int, int));
 
 extern int pk_checkalg __P((int, int, int));
 
 struct ph2handle;
+extern void pk_fixup_sa_addresses __P((caddr_t *mhp));
 extern int pk_sendgetspi __P((struct ph2handle *));
 extern int pk_sendupdate __P((struct ph2handle *));
 extern int pk_sendadd __P((struct ph2handle *));
@@ -60,9 +61,6 @@
 extern int pk_sendspdadd2 __P((struct ph2handle *));
 extern int pk_sendspddelete __P((struct ph2handle *));
 
-extern void pfkey_timeover_stub __P((void *));
-extern void pfkey_timeover __P((struct ph2handle *));
-
 extern u_int pfkey2ipsecdoi_proto __P((u_int));
 extern u_int ipsecdoi2pfkey_proto __P((u_int));
 extern u_int pfkey2ipsecdoi_mode __P((u_int));
diff --git a/src/racoon/plainrsa-gen.c b/src/racoon/plainrsa-gen.c
index 1bd5f67..cad1861 100644
--- a/src/racoon/plainrsa-gen.c
+++ b/src/racoon/plainrsa-gen.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: plainrsa-gen.c,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
+/*	$NetBSD: plainrsa-gen.c,v 1.6 2011/02/11 10:07:19 tteras Exp $	*/
 
 /* Id: plainrsa-gen.c,v 1.6 2005/04/21 09:08:40 monas Exp */
 /*
@@ -43,11 +43,13 @@
 #include <sys/stat.h>
 #include <sys/socket.h>
 #include <unistd.h>
+#include <fcntl.h>
 
 #include <openssl/bio.h>
 #include <openssl/bn.h>
 #include <openssl/err.h>
 #include <openssl/objects.h>
+#include <openssl/pem.h>
 #include <openssl/rsa.h>
 #include <openssl/evp.h>
 #ifdef HAVE_OPENSSL_ENGINE_H
@@ -72,6 +74,7 @@
 	fprintf(stderr, "  -b bits       Generate <bits> long RSA key (default=1024)\n");
 	fprintf(stderr, "  -e pubexp     Public exponent to use (default=0x3)\n");
 	fprintf(stderr, "  -f filename   Filename to store the key to (default=stdout)\n");
+	fprintf(stderr, "  -i filename   Input source for format conversion\n");
 	fprintf(stderr, "  -h            Help\n");
 	fprintf(stderr, "\n");
 	fprintf(stderr, "Report bugs to <ipsec-tools-devel@lists.sourceforge.net>\n");
@@ -82,7 +85,7 @@
  * See RFC 2065, section 3.5 for details about the output format.
  */
 vchar_t *
-mix_b64_pubkey(RSA *key)
+mix_b64_pubkey(const RSA *key)
 {
 	char *binbuf;
 	long binlen, ret;
@@ -116,17 +119,10 @@
 }
 
 int
-gen_rsa_key(FILE *fp, size_t bits, unsigned long exp)
+print_rsa_key(FILE *fp, const RSA *key)
 {
-	RSA *key;
 	vchar_t *pubkey64 = NULL;
 
-	key = RSA_generate_key(bits, exp, NULL, NULL);
-	if (!key) {
-		fprintf(stderr, "RSA_generate_key(): %s\n", eay_strerror());
-		return -1;
-	}
-	
 	pubkey64 = mix_b64_pubkey(key);
 	if (!pubkey64) {
 		fprintf(stderr, "mix_b64_pubkey(): %s\n", eay_strerror());
@@ -135,7 +131,7 @@
 	
 	fprintf(fp, "# : PUB 0s%s\n", pubkey64->v);
 	fprintf(fp, ": RSA\t{\n");
-	fprintf(fp, "\t# RSA %zu bits\n", bits);
+	fprintf(fp, "\t# RSA %d bits\n", BN_num_bits(key->n));
 	fprintf(fp, "\t# pubkey=0s%s\n", pubkey64->v);
 	fprintf(fp, "\tModulus: 0x%s\n", lowercase(BN_bn2hex(key->n)));
 	fprintf(fp, "\tPublicExponent: 0x%s\n", lowercase(BN_bn2hex(key->e)));
@@ -148,23 +144,92 @@
 	fprintf(fp, "  }\n");
 
 	vfree(pubkey64);
-
 	return 0;
 }
 
 int
+print_public_rsa_key(FILE *fp, const RSA *key)
+{
+	vchar_t *pubkey64 = NULL;
+
+	pubkey64 = mix_b64_pubkey(key);
+	if (!pubkey64) {
+		fprintf(stderr, "mix_b64_pubkey(): %s\n", eay_strerror());
+		return -1;
+	}
+	
+	fprintf(fp, ": PUB 0s%s\n", pubkey64->v);
+
+	vfree(pubkey64);
+	return 0;
+}
+
+int
+convert_rsa_key(FILE *fpout, FILE *fpin)
+{
+	int ret;
+	RSA *key = NULL;
+
+	key = PEM_read_RSAPrivateKey(fpin, NULL, NULL, NULL);
+	if (key) {
+		ret = print_rsa_key(fpout, key);
+		RSA_free(key);
+
+		return ret;
+	}
+	
+	rewind(fpin);
+
+	key = PEM_read_RSA_PUBKEY(fpin, NULL, NULL, NULL);
+	if (key) {
+		ret = print_public_rsa_key(fpout, key);
+		RSA_free(key);
+
+		return ret;
+	}
+
+	/* Implement parsing of input stream containing
+	 * private or public "plainrsa" formatted text.
+	 * Convert the result to PEM formatted output.
+	 *
+	 * This seemingly needs manual use of prsaparse().
+	 * An expert ought to do this. */
+
+	fprintf(stderr, "convert_rsa_key: %s\n", "Only conversion from PEM at this time");
+	return -1;
+}
+
+int
+gen_rsa_key(FILE *fp, size_t bits, unsigned long exp)
+{
+	int ret;
+	RSA *key;
+
+	key = RSA_generate_key(bits, exp, NULL, NULL);
+	if (!key) {
+		fprintf(stderr, "RSA_generate_key(): %s\n", eay_strerror());
+		return -1;
+	}
+	
+	ret = print_rsa_key(fp, key);
+	RSA_free(key);
+
+	return ret;
+}
+
+int
 main (int argc, char *argv[])
 {
-	FILE *fp = stdout;
+	FILE *fp = stdout, *fpin = NULL;
 	size_t bits = 1024;
 	unsigned int pubexp = 0x3;
 	struct stat st;
 	extern char *optarg;
 	extern int optind;
-	int c;
-	char *fname = NULL;
+	int c, fd = -1, fdin = -1;
+	char *fname = NULL, *finput = NULL;
 
-	while ((c = getopt(argc, argv, "e:b:f:h")) != -1)
+	while ((c = getopt(argc, argv, "e:b:f:i:h")) != -1)
 		switch (c) {
 			case 'e':
 				if (strncmp(optarg, "0x", 2) == 0)
@@ -178,31 +243,65 @@
 			case 'f':
 				fname = optarg;
 				break;
+			case 'i':
+				finput = optarg;
+				break;
 			case 'h':
 			default:
 				usage(argv[0]);
 		}
 
 	if (fname) {
-		if (stat(fname, &st) >= 0) {
-			fprintf(stderr, "%s: file exists! Please use a different name.\n", fname);
+		umask(0077);
+		/* Restrictive access due to private key material. */
+		fd = open(fname, O_WRONLY | O_CREAT | O_EXCL | O_NOFOLLOW, S_IRUSR | S_IWUSR);
+		if (fd < 0) {
+			if (errno == EEXIST)
+				fprintf(stderr, "%s: file exists! Please use a different name.\n", fname);
+			else
+				fprintf(stderr, "%s: %s\n", fname, strerror(errno));
+			exit(1);
+		}
+		fp = fdopen(fd, "w");
+		if (fp == NULL) {
+			fprintf(stderr, "%s: %s\n", fname, strerror(errno));
+			close(fd);
+			exit(1);
+		}
+	}
+
+	if (finput) {
+		/* Restrictive access once more. Do not be fooled by a link. */
+		fdin = open(finput, O_RDONLY | O_NOFOLLOW);
+		if (fdin < 0) {
+			if (errno == ELOOP)
+				fprintf(stderr, "%s: file is a link. Discarded for security.\n", fname);
+			if (fp)
+				fclose(fp);
+			exit(1);
+		}
+		fpin = fdopen(fdin, "r");
+		if (fpin == NULL) {
+			fprintf(stderr, "%s: %s\n", fname, strerror(errno));
+			close(fdin);
+			if (fp)
+				fclose(fp);
 			exit(1);
 		}
 
-		umask(0077);
-		fp = fopen(fname, "w");
-		if (fp == NULL) {
-			fprintf(stderr, "%s: %s\n", fname, strerror(errno));
-			exit(1);
-		}
 	}
 
 	ploginit();
 	eay_init();
 
-	gen_rsa_key(fp, bits, pubexp);
+	if (fpin)
+		convert_rsa_key(fp, fpin);
+	else
+		gen_rsa_key(fp, bits, pubexp);
 
 	fclose(fp);
+	if (fpin)
+		fclose(fpin);
 
 	return 0;
 }
diff --git a/src/racoon/plog.c b/src/racoon/plog.c
index 008260d..aebfed2 100644
--- a/src/racoon/plog.c
+++ b/src/racoon/plog.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: plog.c,v 1.4.6.2 2009/04/20 13:35:36 tteras Exp $	*/
+/*	$NetBSD: plog.c,v 1.7 2011/01/28 12:51:40 tteras Exp $	*/
 
 /* Id: plog.c,v 1.11 2006/06/20 09:57:31 vanhu Exp */
 
@@ -36,6 +36,7 @@
 #include <sys/types.h>
 #include <sys/param.h>
 
+#include <arpa/inet.h>
 #include <stdlib.h>
 #include <stdio.h>
 #include <string.h>
@@ -78,7 +79,7 @@
 static struct log *logp = NULL;
 static char *logfile = NULL;
 
-static char *plog_common __P((int, const char *, const char *));
+static char *plog_common __P((int, const char *, const char *, struct sockaddr *));
 
 static struct plogtags {
 	char *name;
@@ -94,11 +95,13 @@
 };
 
 static char *
-plog_common(pri, fmt, func)
+plog_common(pri, fmt, func, sa)
 	int pri;
 	const char *fmt, *func;
+	struct sockaddr *sa;
 {
 	static char buf[800];	/* XXX shoule be allocated every time ? */
+	void *addr;
 	char *p;
 	int reslen, len;
 
@@ -116,19 +119,43 @@
 		reslen -= len;
 	}
 
+	if (sa && reslen > 3) {
+		addr = NULL;
+		switch (sa->sa_family) {
+		case AF_INET:
+			addr = &((struct sockaddr_in*)sa)->sin_addr;
+			break;
+		case AF_INET6:
+			addr = &((struct sockaddr_in6*)sa)->sin6_addr;
+			break;
+		}
+		if (inet_ntop(sa->sa_family, addr, p + 1, reslen - 3) != NULL) {
+			*p++ = '[';
+			len = strlen(p);
+			p += len;
+			*p++ = ']';
+			*p++ = ' ';
+			reslen -= len + 3;
+		}
+	}
+
 	if (pri < ARRAYLEN(ptab)) {
 		len = snprintf(p, reslen, "%s: ", ptab[pri].name);
-		if (len >= 0 && len < reslen) {
-			p += len;
-			reslen -= len;
-		} else
-			*p = '\0';
+		p += len;
+		reslen -= len;
 	}
 
 	if (print_location)
-		snprintf(p, reslen, "%s: %s", func, fmt);
+		len = snprintf(p, reslen, "%s: %s", func, fmt);
 	else
-		snprintf(p, reslen, "%s", fmt);
+		len = snprintf(p, reslen, "%s", fmt);
+	p += len;
+	reslen -= len;
+
+	/* Force nul termination */
+	if (reslen == 0)
+		p[-1] = 0;
+
 #ifdef BROKEN_PRINTF
 	while ((p = strstr(buf,"%z")) != NULL)
 		p[1] = 'l';
@@ -157,7 +184,7 @@
 	if (pri > loglevel)
 		return;
 
-	newfmt = plog_common(pri, fmt, func);
+	newfmt = plog_common(pri, fmt, func, sa);
 
 	VA_COPY(ap_bak, ap);
 	
diff --git a/src/racoon/plog.h b/src/racoon/plog.h
index 4d9a93f..6c3ac12 100644
--- a/src/racoon/plog.h
+++ b/src/racoon/plog.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: plog.h,v 1.4.6.1 2007/11/06 16:41:27 vanhu Exp $	*/
+/*	$NetBSD: plog.h,v 1.5 2007/10/02 09:47:40 vanhu Exp $	*/
 
 /* Id: plog.h,v 1.7 2006/06/20 09:57:31 vanhu Exp */
 
diff --git a/src/racoon/policy.c b/src/racoon/policy.c
index 29a6818..4c00677 100644
--- a/src/racoon/policy.c
+++ b/src/racoon/policy.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: policy.c,v 1.6.4.1 2007/08/01 11:52:21 vanhu Exp $	*/
+/*	$NetBSD: policy.c,v 1.12 2011/03/14 17:18:13 tteras Exp $	*/
 
 /*	$KAME: policy.c,v 1.46 2001/11/16 04:08:10 sakane Exp $	*/
 
@@ -91,13 +91,17 @@
 	struct policyindex *spidx;
 {
 	struct secpolicy *p;
+	struct secpolicy *found = NULL;
 
 	for (p = TAILQ_FIRST(&sptree); p; p = TAILQ_NEXT(p, chain)) {
-		if (!cmpspidxwild(spidx, &p->spidx))
+		if (!cmpspidxstrict(spidx, &p->spidx))
 			return p;
+
+		if (!found && !cmpspidxwild(spidx, &p->spidx))
+			found = p;
 	}
 
-	return NULL;
+	return found;
 }
 #else
 struct secpolicy *
@@ -137,16 +141,18 @@
 		saddr2str(iph2->src));
 	plog(LLV_DEBUG, LOCATION, NULL, "src2: %s\n",
 		saddr2str((struct sockaddr *)&spidx->src));
-	if (cmpsaddrwop(iph2->src, (struct sockaddr *)&spidx->src)
-	 || spidx->prefs != prefixlen)
+
+	if (cmpsaddr(iph2->src, (struct sockaddr *) &spidx->src) != CMPSADDR_MATCH ||
+	    spidx->prefs != prefixlen)
 		return NULL;
 
 	plog(LLV_DEBUG, LOCATION, NULL, "dst1: %s\n",
 		saddr2str(iph2->dst));
 	plog(LLV_DEBUG, LOCATION, NULL, "dst2: %s\n",
 		saddr2str((struct sockaddr *)&spidx->dst));
-	if (cmpsaddrwop(iph2->dst, (struct sockaddr *)&spidx->dst)
-	 || spidx->prefd != prefixlen)
+
+	if (cmpsaddr(iph2->dst, (struct sockaddr *) &spidx->dst) != CMPSADDR_MATCH ||
+	    spidx->prefd != prefixlen)
 		return NULL;
 
 	plog(LLV_DEBUG, LOCATION, NULL, "looks to be transport mode\n");
@@ -194,11 +200,11 @@
 	 || a->ul_proto != b->ul_proto)
 		return 1;
 
-	if (cmpsaddrstrict((struct sockaddr *)&a->src,
-			   (struct sockaddr *)&b->src))
+	if (cmpsaddr((struct sockaddr *) &a->src,
+		     (struct sockaddr *) &b->src) != CMPSADDR_MATCH)
 		return 1;
-	if (cmpsaddrstrict((struct sockaddr *)&a->dst,
-			   (struct sockaddr *)&b->dst))
+	if (cmpsaddr((struct sockaddr *) &a->dst,
+		     (struct sockaddr *) &b->dst) != CMPSADDR_MATCH)
 		return 1;
 
 #ifdef HAVE_SECCTX
@@ -228,8 +234,7 @@
 	if (!(b->dir == IPSEC_DIR_ANY || a->dir == b->dir))
 		return 1;
 
-	if (!(a->ul_proto == IPSEC_ULPROTO_ANY ||
-	      b->ul_proto == IPSEC_ULPROTO_ANY ||
+	if (!(b->ul_proto == IPSEC_ULPROTO_ANY ||
 	      a->ul_proto == b->ul_proto))
 		return 1;
 
@@ -256,7 +261,7 @@
 		a, b->prefs, saddr2str((struct sockaddr *)&sa1));
 	plog(LLV_DEBUG, LOCATION, NULL, "%p masked with /%d: %s\n",
 		b, b->prefs, saddr2str((struct sockaddr *)&sa2));
-	if (cmpsaddrwild((struct sockaddr *)&sa1, (struct sockaddr *)&sa2))
+	if (cmpsaddr((struct sockaddr *)&sa1, (struct sockaddr *)&sa2) > CMPSADDR_WILDPORT_MATCH)
 		return 1;
 
 #ifndef __linux__
@@ -274,7 +279,7 @@
 		a, b->prefd, saddr2str((struct sockaddr *)&sa1));
 	plog(LLV_DEBUG, LOCATION, NULL, "%p masked with /%d: %s\n",
 		b, b->prefd, saddr2str((struct sockaddr *)&sa2));
-	if (cmpsaddrwild((struct sockaddr *)&sa1, (struct sockaddr *)&sa2))
+	if (cmpsaddr((struct sockaddr *)&sa1, (struct sockaddr *)&sa2) > CMPSADDR_WILDPORT_MATCH)
 		return 1;
 
 #ifdef HAVE_SECCTX
@@ -309,6 +314,11 @@
 		racoon_free(req);
 	}
 	
+	if (sp->local)
+		racoon_free(sp->local);
+	if (sp->remote)
+		racoon_free(sp->remote);
+
 	racoon_free(sp);
 }
 
diff --git a/src/racoon/policy.h b/src/racoon/policy.h
index 8c47451..ef7f923 100644
--- a/src/racoon/policy.h
+++ b/src/racoon/policy.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: policy.h,v 1.5.4.2 2007/06/07 20:34:19 manu Exp $	*/
+/*	$NetBSD: policy.h,v 1.8 2008/12/05 06:02:20 tteras Exp $	*/
 
 /* Id: policy.h,v 1.5 2004/06/11 16:00:17 ludvigm Exp */
 
@@ -82,6 +82,12 @@
 	struct ipsecrequest *req;
 				/* pointer to the ipsec request tree, */
 				/* if policy == IPSEC else this value == NULL.*/
+
+	/* MIPv6 needs to perform negotiation of SA using different addresses
+	 * than the endpoints of the SA (CoA for the source). In that case,
+	 * MIGRATE msg provides that info (before movement occurs on the MN) */
+	struct sockaddr *local;
+	struct sockaddr *remote;
 };
 
 /* Security Assocciation Index */
@@ -111,7 +117,7 @@
 #ifdef HAVE_PFKEY_POLICY_PRIORITY
 #define KEY_SETSECSPIDX(_dir, s, d, ps, pd, ulp, _priority, _created, idx)              \
 do {                                                                         \
-	memset((idx), 0, sizeof(struct policyindex));                        \
+	bzero((idx), sizeof(struct policyindex));                            \
 	(idx)->dir = (_dir);                                                 \
 	(idx)->prefs = (ps);                                                 \
 	(idx)->prefd = (pd);                                                 \
@@ -124,7 +130,7 @@
 #else
 #define KEY_SETSECSPIDX(_dir, s, d, ps, pd, ulp, _created, idx)              \
 do {                                                                         \
-	memset((idx), 0, sizeof(struct policyindex));                        \
+	bzero((idx), sizeof(struct policyindex));                            \
 	(idx)->dir = (_dir);                                                 \
 	(idx)->prefs = (ps);                                                 \
 	(idx)->prefd = (pd);                                                 \
diff --git a/src/racoon/privsep.c b/src/racoon/privsep.c
index 9e60b89..55a3908 100644
--- a/src/racoon/privsep.c
+++ b/src/racoon/privsep.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: privsep.c,v 1.6 2006/09/09 16:22:10 manu Exp $	*/
+/*	$NetBSD: privsep.c,v 1.21 2011/03/06 08:28:10 tteras Exp $	*/
 
 /* Id: privsep.c,v 1.15 2005/08/08 11:23:44 vanhu Exp */
 
@@ -42,15 +42,17 @@
 #include <signal.h>
 #include <pwd.h>
 
+#include <sys/types.h>
 #include <sys/socket.h>
 #include <sys/param.h>
 
+#include <netinet/in.h>
+
 #include "gcmalloc.h"
 #include "vmbuf.h"
 #include "misc.h"
 #include "plog.h"
 #include "var.h"
-#include "libpfkey.h"
 
 #include "crypto_openssl.h"
 #include "isakmp_var.h"
@@ -75,6 +77,28 @@
 static int unsafe_env(char *const *);
 static int unknown_name(int);
 static int unsafe_path(char *, int);
+static int rec_fd(int);
+static int send_fd(int, int);
+
+struct socket_args {
+	int domain;
+	int type;
+	int protocol;
+};
+
+struct sockopt_args {
+	int s;
+	int level;
+	int optname;
+	const void *optval;
+	socklen_t optlen;
+};
+
+struct bind_args {
+	int s;
+	const struct sockaddr *addr;
+	socklen_t addrlen;
+};
 
 static int
 privsep_send(sock, buf, len)
@@ -116,13 +140,19 @@
 	    sizeof(com), MSG_PEEK, NULL, NULL)) == -1) {
 		if (errno == EINTR)
 			continue;
+		if (errno == ECONNRESET)
+		    return -1;
 
 		plog(LLV_ERROR, LOCATION, NULL,
 		    "privsep_recv failed: %s\n",
 		    strerror(errno));
 		return -1;
 	}
-	
+
+	/* EOF, other side has closed. */
+	if (len == 0)
+	    return -1;
+
 	/* Check for short packets */
 	if (len < sizeof(com)) {
 		plog(LLV_ERROR, LOCATION, NULL,
@@ -142,6 +172,8 @@
 	    com.ac_len, 0, NULL, NULL)) == -1) {
 		if (errno == EINTR)
 			continue;
+		if (errno == ECONNRESET)
+		    return -1;
 		plog(LLV_ERROR, LOCATION, NULL,
 		    "failed to recv privsep command: %s\n", 
 		    strerror(errno));
@@ -174,7 +206,7 @@
 	/* 
 	 * When running privsep, certificate and script paths 
 	 * are mandatory, as they enable us to check path safety
-	 * in the privilegied instance
+	 * in the privileged instance
 	 */
 	if ((lcconf->pathinfo[LC_PATHTYPE_CERT] == NULL) ||
 	    (lcconf->pathinfo[LC_PATHTYPE_SCRIPT] == NULL)) {
@@ -183,7 +215,7 @@
 		return -1;
 	}
 
-	if (socketpair(PF_LOCAL, SOCK_DGRAM, 0, privsep_sock) != 0) {
+	if (socketpair(PF_LOCAL, SOCK_STREAM, 0, privsep_sock) != 0) {
 		plog(LLV_ERROR, LOCATION, NULL, 
 		    "Cannot allocate privsep_sock: %s\n", strerror(errno));
 		return -1;
@@ -197,6 +229,8 @@
 		break;
 
 	case 0: /* Child: drop privileges */
+		(void)close(privsep_sock[0]);
+
 		if (lcconf->chroot != NULL) {
 			if (chdir(lcconf->chroot) != 0) {
 				plog(LLV_ERROR, LOCATION, NULL, 
@@ -243,7 +277,7 @@
 		return 0;
 		break;
 
-	default: /* Parent: privilegied process */
+	default: /* Parent: privileged process */
 		break;
 	}
 
@@ -254,8 +288,6 @@
 	for (i = sysconf(_SC_OPEN_MAX); i > 0; i--) {
 		if (i == privsep_sock[0])
 			continue;
-		if (i == privsep_sock[1])
-			continue;
 		if ((f_foreground) && (i == 1))
 			continue;
 		(void)close(i);
@@ -265,16 +297,20 @@
 	ploginit();
 
 	plog(LLV_INFO, LOCATION, NULL, 
-	    "racoon privilegied process running with PID %d\n", getpid());
+	    "racoon privileged process running with PID %d\n", getpid());
 
-#ifdef __NetBSD__
+	plog(LLV_INFO, LOCATION, NULL,
+	    "racoon unprivileged process running with PID %d\n", child_pid);
+
+#if defined(__NetBSD__) || defined(__FreeBSD__)
 	setproctitle("[priv]");
 #endif
 	
-	/* 
-	 * Don't catch any signal 
+	/*
+	 * Don't catch any signal
 	 * This duplicate session:signals[], which is static...
 	 */
+	signal(SIGPIPE, SIG_IGN);
 	signal(SIGHUP, SIG_DFL);
 	signal(SIGINT, SIG_DFL);
 	signal(SIGTERM, SIG_DFL);
@@ -331,7 +367,7 @@
 		/* 
 		 * XXX Improvement: instead of returning the key, 
 		 * stuff eay_get_pkcs1privkey and eay_get_x509sign
-		 * together and sign the hash in the privilegied 
+		 * together and sign the hash in the privileged 
 		 * instance? 
 		 * pro: the key remains inaccessible to unpriv
 		 * con: a compromised unpriv racoon can still sign anything
@@ -503,6 +539,154 @@
 			break;
 		}
 
+		case PRIVSEP_SOCKET: {
+			struct socket_args socket_args;
+			int s;
+
+			/* Make sure the string is NULL terminated */
+			if (safety_check(combuf, 0) != 0)
+				break;
+
+			if (combuf->bufs.buflen[0] !=
+			    sizeof(struct socket_args)) {
+				plog(LLV_ERROR, LOCATION, NULL, 
+				    "privsep_socket: corrupted message\n");
+				goto out;
+			}
+			memcpy(&socket_args, bufs[0],
+			       sizeof(struct socket_args));
+
+			if (socket_args.domain != PF_INET &&
+			    socket_args.domain != PF_INET6) {
+				plog(LLV_ERROR, LOCATION, NULL, 
+				    "privsep_socket: "
+				     "unauthorized domain (%d)\n",
+				     socket_args.domain);
+				goto out;
+			}
+
+			if ((s = socket(socket_args.domain, socket_args.type,
+					socket_args.protocol)) == -1) {
+				reply->hdr.ac_errno = errno;
+				break;
+			}
+
+			if (send_fd(privsep_sock[0], s) < 0) {
+				plog(LLV_ERROR, LOCATION, NULL, 
+				     "privsep_socket: send_fd failed\n");
+				close(s);
+				goto out;
+			}
+
+			close(s);
+			break;
+		}
+
+		case PRIVSEP_BIND: {
+			struct bind_args bind_args;
+			int err, port = 0;
+
+			/* Make sure the string is NULL terminated */
+			if (safety_check(combuf, 0) != 0)
+				break;
+
+			if (combuf->bufs.buflen[0] !=
+			    sizeof(struct bind_args)) {
+				plog(LLV_ERROR, LOCATION, NULL, 
+				    "privsep_bind: corrupted message\n");
+				goto out;
+			}
+			memcpy(&bind_args, bufs[0], sizeof(struct bind_args));
+
+			if (combuf->bufs.buflen[1] != bind_args.addrlen) {
+				plog(LLV_ERROR, LOCATION, NULL, 
+				    "privsep_bind: corrupted message\n");
+				goto out;
+			}
+			bind_args.addr = (const struct sockaddr *)bufs[1];
+
+			if ((bind_args.s = rec_fd(privsep_sock[0])) < 0) {
+				plog(LLV_ERROR, LOCATION, NULL, 
+				     "privsep_bind: rec_fd failed\n");
+				goto out;
+			}
+
+			port = extract_port(bind_args.addr);
+			if (port != PORT_ISAKMP && port != PORT_ISAKMP_NATT &&
+			    port != lcconf->port_isakmp &&
+			    port != lcconf->port_isakmp_natt) {
+				plog(LLV_ERROR, LOCATION, NULL,
+				     "privsep_bind: "
+				     "unauthorized port (%d)\n",
+				     port);
+				close(bind_args.s);
+				goto out;
+			}
+
+			err = bind(bind_args.s, bind_args.addr,
+				   bind_args.addrlen);
+
+			if (err)
+				reply->hdr.ac_errno = errno;
+
+			close(bind_args.s);
+			break;
+		}
+
+		case PRIVSEP_SETSOCKOPTS: {
+			struct sockopt_args sockopt_args;
+			int err;
+
+			/* Make sure the string is NULL terminated */
+			if (safety_check(combuf, 0) != 0)
+				break;
+
+			if (combuf->bufs.buflen[0] !=
+			    sizeof(struct sockopt_args)) {
+				plog(LLV_ERROR, LOCATION, NULL, 
+				    "privsep_setsockopt: "
+				     "corrupted message\n");
+				goto out;
+			}
+			memcpy(&sockopt_args, bufs[0],
+			       sizeof(struct sockopt_args));
+
+			if (combuf->bufs.buflen[1] != sockopt_args.optlen) {
+				plog(LLV_ERROR, LOCATION, NULL, 
+				    "privsep_setsockopt: corrupted message\n");
+				goto out;
+			}
+			sockopt_args.optval = bufs[1];
+
+			if (sockopt_args.optname != 
+			    (sockopt_args.level == 
+			     IPPROTO_IP ? IP_IPSEC_POLICY :
+			     IPV6_IPSEC_POLICY)) {
+				plog(LLV_ERROR, LOCATION, NULL, 
+				    "privsep_setsockopt: "
+				     "unauthorized option (%d)\n",
+				     sockopt_args.optname);
+				goto out;
+			}
+
+			if ((sockopt_args.s = rec_fd(privsep_sock[0])) < 0) {
+				plog(LLV_ERROR, LOCATION, NULL, 
+				     "privsep_setsockopt: rec_fd failed\n");
+				goto out;
+			}
+
+			err = setsockopt(sockopt_args.s,
+					 sockopt_args.level,
+					 sockopt_args.optname,
+					 sockopt_args.optval,
+					 sockopt_args.optlen);
+			if (err)
+				reply->hdr.ac_errno = errno;
+
+			close(sockopt_args.s);
+			break;
+		}
+
 #ifdef ENABLE_HYBRID
 		case PRIVSEP_ACCOUNTING_SYSTEM: {
 			int pool_size;
@@ -687,14 +871,17 @@
 
 		/* This frees reply */
 		if (privsep_send(privsep_sock[0], 
-		    reply, reply->hdr.ac_len) != 0)
+		    reply, reply->hdr.ac_len) != 0) {
+			racoon_free(reply);
 			goto out;
+		}
 
 		racoon_free(combuf);
 	}
 
 out:
-	plog(LLV_INFO, LOCATION, NULL, "privsep exit\n");
+	plog(LLV_INFO, LOCATION, NULL, 
+	    "racoon privileged process %d terminated\n", getpid());
 	_exit(0);
 }
 
@@ -745,37 +932,6 @@
 	return NULL;
 }
 
-/*
- * No prigilege separation trick here, we just open PFKEY before
- * dropping root privs and we remember it later.
- */
-static int  pfkey_socket = -1;
-int
-privsep_pfkey_open(void)
-{
-	int ps;
-
-	if (pfkey_socket != -1)
-		return pfkey_socket;
-
-	ps = pfkey_open();
-	if (ps != -1)
-		pfkey_socket = ps;
-
-	return ps;
-}
-
-/*
- * Consequence of the above trickery: don't 
- * really close PFKEY as we never re-open it.
- */
-void
-privsep_pfkey_close(ps)
-	int ps;
-{
-	return;
-}
-
 int
 privsep_script_exec(script, name, envp)
 	char *script;
@@ -941,6 +1097,224 @@
 	return NULL;
 }
 
+/*
+ * Create a privileged socket.  On BSD systems a socket obtains special
+ * capabilities if it is created by root; setsockopt(IP_IPSEC_POLICY) will
+ * succeed but will be ineffective if performed on an unprivileged socket.
+ */
+int
+privsep_socket(domain, type, protocol)
+	int domain;
+	int type;
+	int protocol;
+{
+	struct privsep_com_msg *msg;
+	size_t len;
+	char *data;
+	struct socket_args socket_args;
+	int s, saved_errno = 0;
+
+	if (geteuid() == 0)
+		return socket(domain, type, protocol);
+
+	len = sizeof(*msg) + sizeof(socket_args);
+
+	if ((msg = racoon_malloc(len)) == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL, 
+		    "Cannot allocate memory: %s\n", strerror(errno));
+		return -1;
+	}
+	bzero(msg, len);
+	msg->hdr.ac_cmd = PRIVSEP_SOCKET;
+	msg->hdr.ac_len = len;
+
+	socket_args.domain = domain;
+	socket_args.type = type;
+	socket_args.protocol = protocol;
+
+	data = (char *)(msg + 1);
+	msg->bufs.buflen[0] = sizeof(socket_args);
+	memcpy(data, &socket_args, msg->bufs.buflen[0]);
+
+	/* frees msg */
+	if (privsep_send(privsep_sock[1], msg, len) != 0)
+		goto out;
+
+	/* Get the privileged socket descriptor from the privileged process. */
+	if ((s = rec_fd(privsep_sock[1])) == -1)
+		return -1;
+
+	if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
+		goto out;
+
+	if (msg->hdr.ac_errno != 0) {
+		errno = msg->hdr.ac_errno;
+		goto out;
+	}
+
+	racoon_free(msg);
+	return s;
+
+out:
+	racoon_free(msg);
+	return -1;
+}
+
+/*
+ * Bind() a socket to a port.  This works just like regular bind(), except that
+ * if you want to bind to the designated isakmp ports and you don't have the
+ * privilege to do so, it will ask a privileged process to do it.
+ */
+int
+privsep_bind(s, addr, addrlen)
+	int s;
+	const struct sockaddr *addr;
+	socklen_t addrlen;
+{
+	struct privsep_com_msg *msg;
+	size_t len;
+	char *data;
+	struct bind_args bind_args;
+	int err, saved_errno = 0;
+
+	err = bind(s, addr, addrlen);
+	if ((err == 0) || (saved_errno = errno) != EACCES || geteuid() == 0) {
+		if (saved_errno)
+			plog(LLV_ERROR, LOCATION, NULL,
+			     "privsep_bind (%s) = %d\n", strerror(saved_errno), err);
+		errno = saved_errno;
+		return err;
+	}
+
+	len = sizeof(*msg) + sizeof(bind_args) + addrlen;
+
+	if ((msg = racoon_malloc(len)) == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL, 
+		    "Cannot allocate memory: %s\n", strerror(errno));
+		return -1;
+	}
+	bzero(msg, len);
+	msg->hdr.ac_cmd = PRIVSEP_BIND;
+	msg->hdr.ac_len = len;
+
+	bind_args.s = -1;
+	bind_args.addr = NULL;
+	bind_args.addrlen = addrlen;
+
+	data = (char *)(msg + 1);
+	msg->bufs.buflen[0] = sizeof(bind_args);
+	memcpy(data, &bind_args, msg->bufs.buflen[0]);
+
+	data += msg->bufs.buflen[0];
+	msg->bufs.buflen[1] = addrlen;
+	memcpy(data, addr, addrlen);
+
+	/* frees msg */
+	if (privsep_send(privsep_sock[1], msg, len) != 0)
+		goto out;
+
+	/* Send the socket descriptor to the privileged process. */
+	if (send_fd(privsep_sock[1], s) < 0)
+		return -1;
+
+	if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
+		goto out;
+
+	if (msg->hdr.ac_errno != 0) {
+		errno = msg->hdr.ac_errno;
+		goto out;
+	}
+
+	racoon_free(msg);
+	return 0;
+
+out:
+	racoon_free(msg);
+	return -1;
+}
+
+/*
+ * Set socket options.  This works just like regular setsockopt(), except that
+ * if you want to change IP_IPSEC_POLICY or IPV6_IPSEC_POLICY and you don't
+ * have the privilege to do so, it will ask a privileged process to do it.
+ */
+int
+privsep_setsockopt(s, level, optname, optval, optlen)
+	int s;
+	int level;
+	int optname;
+	const void *optval;
+	socklen_t optlen;
+{
+	struct privsep_com_msg *msg;
+	size_t len;
+	char *data;
+	struct sockopt_args sockopt_args;
+	int err, saved_errno = 0;
+
+	if ((err = setsockopt(s, level, optname, optval, optlen) == 0) || 
+	    (saved_errno = errno) != EACCES ||
+	    geteuid() == 0) {
+		if (saved_errno)
+			plog(LLV_ERROR, LOCATION, NULL,
+			     "privsep_setsockopt (%s)\n",
+			     strerror(saved_errno));
+
+		errno = saved_errno;
+		return err;
+	}
+
+	len = sizeof(*msg) + sizeof(sockopt_args) + optlen;
+
+	if ((msg = racoon_malloc(len)) == NULL) {
+		plog(LLV_ERROR, LOCATION, NULL, 
+		    "Cannot allocate memory: %s\n", strerror(errno));
+		return -1;
+	}
+	bzero(msg, len);
+	msg->hdr.ac_cmd = PRIVSEP_SETSOCKOPTS;
+	msg->hdr.ac_len = len;
+
+	sockopt_args.s = -1;
+	sockopt_args.level = level;
+	sockopt_args.optname = optname;
+	sockopt_args.optval = NULL;
+	sockopt_args.optlen = optlen;
+
+	data = (char *)(msg + 1);
+	msg->bufs.buflen[0] = sizeof(sockopt_args);
+	memcpy(data, &sockopt_args, msg->bufs.buflen[0]);
+
+	data += msg->bufs.buflen[0];
+	msg->bufs.buflen[1] = optlen;
+	memcpy(data, optval, optlen);
+
+	/* frees msg */
+	if (privsep_send(privsep_sock[1], msg, len) != 0)
+		goto out;
+
+	if (send_fd(privsep_sock[1], s) < 0)
+		return -1;
+
+	if (privsep_recv(privsep_sock[1], &msg, &len) != 0) {
+	    plog(LLV_ERROR, LOCATION, NULL,
+		 "privsep_recv failed\n");
+		goto out;
+	}
+
+	if (msg->hdr.ac_errno != 0) {
+		errno = msg->hdr.ac_errno;
+		goto out;
+	}
+
+	racoon_free(msg);
+	return 0;
+
+out:
+	racoon_free(msg);
+	return -1;
+}
+
 #ifdef ENABLE_HYBRID
 int
 privsep_xauth_login_system(usr, pwd)
@@ -972,6 +1346,7 @@
 	msg->bufs.buflen[1] = strlen(pwd) + 1;
 	memcpy(data, pwd, msg->bufs.buflen[1]);
 	
+	/* frees msg */
 	if (privsep_send(privsep_sock[1], msg, len) != 0)
 		return -1;
 
@@ -1034,6 +1409,7 @@
 	data += msg->bufs.buflen[2];
 	memcpy(data, &inout, msg->bufs.buflen[3]);
 
+	/* frees msg */
 	if (privsep_send(privsep_sock[1], msg, len) != 0)
 		return -1;
 
@@ -1089,7 +1465,7 @@
 }
 
 /*
- * Filter unsafe environement variables
+ * Filter unsafe environment variables
  */
 static int
 unsafe_env(envp)
@@ -1110,7 +1486,7 @@
 	return 0;
 found:
 	plog(LLV_ERROR, LOCATION, NULL, 
-	    "privsep_script_exec: unsafe environement variable\n");
+	    "privsep_script_exec: unsafe environment variable\n");
 	return -1;
 }
 
@@ -1161,6 +1537,86 @@
 	return 0;
 }
 
+/* Receive a file descriptor through the argument socket */
+static int
+rec_fd(s)
+	int s;
+{
+	struct msghdr msg;
+	struct cmsghdr *cmsg;
+	int *fdptr;
+	int fd;
+	char cmsbuf[1024];
+	struct iovec iov;
+	char iobuf[1];
+
+	iov.iov_base = iobuf;
+	iov.iov_len = 1;
+
+	if (sizeof(cmsbuf) < CMSG_SPACE(sizeof(fd))) {
+		plog(LLV_ERROR, LOCATION, NULL, 
+		    "send_fd: buffer size too small\n");
+		return -1;
+	}
+	bzero(&msg, sizeof(msg));
+	msg.msg_name = NULL;
+	msg.msg_namelen = 0;
+	msg.msg_iov = &iov;
+	msg.msg_iovlen = 1;
+	msg.msg_control = cmsbuf;
+	msg.msg_controllen = CMSG_SPACE(sizeof(fd));
+
+	if (recvmsg(s, &msg, MSG_WAITALL) == -1)
+		return -1;
+
+	cmsg = CMSG_FIRSTHDR(&msg);
+	fdptr = (int *) CMSG_DATA(cmsg);
+	return fdptr[0];
+}
+
+/* Send the file descriptor fd through the argument socket s */
+static int
+send_fd(s, fd)
+	int s;
+	int fd;
+{
+	struct msghdr msg;
+	struct cmsghdr *cmsg;
+	char cmsbuf[1024];
+	struct iovec iov;
+	int *fdptr;
+
+	iov.iov_base = " ";
+	iov.iov_len = 1;
+
+	if (sizeof(cmsbuf) < CMSG_SPACE(sizeof(fd))) {
+		plog(LLV_ERROR, LOCATION, NULL, 
+		    "send_fd: buffer size too small\n");
+		return -1;
+	}
+	bzero(&msg, sizeof(msg));
+	msg.msg_name = NULL;
+	msg.msg_namelen = 0;
+	msg.msg_iov = &iov;
+	msg.msg_iovlen = 1;
+	msg.msg_control = cmsbuf;
+	msg.msg_controllen = CMSG_SPACE(sizeof(fd));
+	msg.msg_flags = 0;
+
+	cmsg = CMSG_FIRSTHDR(&msg);
+	cmsg->cmsg_level = SOL_SOCKET;
+	cmsg->cmsg_type = SCM_RIGHTS;
+	cmsg->cmsg_len = CMSG_LEN(sizeof(fd));
+	fdptr = (int *)CMSG_DATA(cmsg);
+	fdptr[0] = fd;
+	msg.msg_controllen = cmsg->cmsg_len;
+
+	if (sendmsg(s, &msg, 0) == -1)
+		return -1;
+
+	return 0;
+}
+
 #ifdef HAVE_LIBPAM
 int 
 privsep_accounting_pam(port, inout)
@@ -1202,6 +1658,7 @@
 	*inout_data = inout;
 	*pool_size_data = isakmp_cfg_config.pool_size;
 
+	/* frees msg */
 	if (privsep_send(privsep_sock[1], msg, len) != 0)
 		return -1;
 
@@ -1272,6 +1729,7 @@
 	data += msg->bufs.buflen[3];
 	memcpy(data, pwd, msg->bufs.buflen[4]);
 
+	/* frees msg */
 	if (privsep_send(privsep_sock[1], msg, len) != 0)
 		return -1;
 
@@ -1324,6 +1782,7 @@
 	data += msg->bufs.buflen[0];
 	memcpy(data, &isakmp_cfg_config.pool_size, msg->bufs.buflen[1]);
 
+	/* frees msg */
 	if (privsep_send(privsep_sock[1], msg, len) != 0)
 		return;
 
diff --git a/src/racoon/privsep.h b/src/racoon/privsep.h
index 0fa4363..732743c 100644
--- a/src/racoon/privsep.h
+++ b/src/racoon/privsep.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: privsep.h,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
+/*	$NetBSD: privsep.h,v 1.6 2008/12/08 06:00:54 tteras Exp $	*/
 
 /* Id: privsep.h,v 1.5 2005/06/07 12:22:11 fredsen Exp */
 
@@ -42,6 +42,9 @@
 #define PRIVSEP_XAUTH_LOGIN_PAM		0x0807	/* admin_com_bufs follows */
 #define PRIVSEP_CLEANUP_PAM		0x0808	/* admin_com_bufs follows */
 #define PRIVSEP_ACCOUNTING_SYSTEM	0x0809	/* admin_com_bufs follows */
+#define PRIVSEP_SETSOCKOPTS		0x080A	/* admin_com_bufs follows */
+#define PRIVSEP_BIND			0x080B	/* admin_com_bufs follows */
+#define PRIVSEP_SOCKET			0x080C	/* admin_com_bufs follows */
 
 #define PRIVSEP_NBUF_MAX 24
 #define PRIVSEP_BUFLEN_MAX 4096
@@ -58,9 +61,10 @@
 int privsep_init __P((void));
 
 vchar_t *privsep_eay_get_pkcs1privkey __P((char *));
-int privsep_pfkey_open __P((void));
-void privsep_pfkey_close __P((int));
 int privsep_script_exec __P((char *, int, char * const *));
+int privsep_setsockopt __P((int, int, int, const void *, socklen_t));
+int privsep_socket __P((int, int, int));
+int privsep_bind __P((int, const struct sockaddr *, socklen_t));
 vchar_t *privsep_getpsk __P((const char *, const int));
 int privsep_xauth_login_system __P((char *, char *));
 #ifdef HAVE_LIBPAM
diff --git a/src/racoon/proposal.c b/src/racoon/proposal.c
index 26c9274..33dd311 100644
--- a/src/racoon/proposal.c
+++ b/src/racoon/proposal.c
@@ -1,6 +1,6 @@
-/*	$NetBSD: proposal.c,v 1.13.4.2 2008/07/22 13:25:42 vanhu Exp $	*/
+/*	$NetBSD: proposal.c,v 1.17 2008/09/19 11:14:49 tteras Exp $	*/
 
-/* $Id: proposal.c,v 1.13.4.2 2008/07/22 13:25:42 vanhu Exp $ */
+/* $Id: proposal.c,v 1.17 2008/09/19 11:14:49 tteras Exp $ */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
@@ -1186,10 +1186,10 @@
 	 * make my proposal according as the client proposal.
 	 * XXX assumed there is only one proposal even if it's the SA bundle.
 	 */
-        for (i = 0; i < MAXPROPPAIRLEN; i++) {
-                if (pair[i] == NULL)
-                        continue;
-
+	for (i = 0; i < MAXPROPPAIRLEN; i++) {
+		if (pair[i] == NULL)
+			continue;
+		
 		if (pp_peer != NULL)
 			flushsaprop(pp_peer);
 
@@ -1226,8 +1226,6 @@
 
 		for (pr = pp_peer->head; pr; pr = pr->next)
 		{
-			struct remoteconf *conf;
-
 			newpr = newsaproto();
 			if (newpr == NULL)
 			{
@@ -1244,9 +1242,7 @@
 			newpr->reqid_in = 0;
 			newpr->reqid_out = 0;
 
-			conf = getrmconf(iph2->dst);
-			if (conf != NULL &&
-				conf->gen_policy == GENERATE_POLICY_UNIQUE){
+			if (iph2->ph1->rmconf->gen_policy == GENERATE_POLICY_UNIQUE){
 				newpr->reqid_in = g_nextreqid ;
 				newpr->reqid_out = g_nextreqid ++;
 				/* 
diff --git a/src/racoon/proposal.h b/src/racoon/proposal.h
index 60fc531..11fbab8 100644
--- a/src/racoon/proposal.h
+++ b/src/racoon/proposal.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: proposal.h,v 1.6 2006/12/09 05:52:57 manu Exp $	*/
+/*	$NetBSD: proposal.h,v 1.7 2010/02/09 23:05:16 wiz Exp $	*/
 
 /* Id: proposal.h,v 1.5 2004/06/11 16:00:17 ludvigm Exp */
 
@@ -88,7 +88,7 @@
 	int reqid_out;			/* request id (outbound) */
 	int reqid_in;			/* request id (inbound) */
 
-	int ok;				/* if 1, success to set SA in kenrel */
+	int ok;				/* if 1, success to set SA in kernel */
 
 	struct satrns *head;		/* header of transform */
 	struct saproto *next;		/* next protocol */
diff --git a/src/racoon/prsa_par.h b/src/racoon/prsa_par.h
index 3bdb11d..6e845d8 100644
--- a/src/racoon/prsa_par.h
+++ b/src/racoon/prsa_par.h
@@ -1,24 +1,23 @@
-/* A Bison parser, made by GNU Bison 2.3.  */
+
+/* A Bison parser, made by GNU Bison 2.4.1.  */
 
 /* Skeleton interface for Bison's Yacc-like parsers in C
-
-   Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
+   
+      Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
    Free Software Foundation, Inc.
-
-   This program is free software; you can redistribute it and/or modify
+   
+   This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2, or (at your option)
-   any later version.
-
+   the Free Software Foundation, either version 3 of the License, or
+   (at your option) any later version.
+   
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-
+   
    You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 51 Franklin Street, Fifth Floor,
-   Boston, MA 02110-1301, USA.  */
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
 
 /* As a special exception, you may create a larger work that contains
    part or all of the Bison parser skeleton and distribute that work
@@ -29,10 +28,11 @@
    special exception, which will cause the skeleton and the resulting
    Bison output files to be licensed under the GNU General Public
    License without this special exception.
-
+   
    This special exception was added by the Free Software Foundation in
    version 2.2 of Bison.  */
 
+
 /* Tokens.  */
 #ifndef YYTOKENTYPE
 # define YYTOKENTYPE
@@ -90,21 +90,27 @@
 
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
-#line 130 "prsa_par.y"
 {
+
+/* Line 1676 of yacc.c  */
+#line 130 "prsa_par.y"
+
 	BIGNUM *bn;
 	RSA *rsa;
 	char *chr;
 	long num;
 	struct netaddr *naddr;
-}
-/* Line 1489 of yacc.c.  */
-#line 103 "prsa_par.h"
-	YYSTYPE;
+
+
+
+/* Line 1676 of yacc.c  */
+#line 108 "prsa_par.h"
+} YYSTYPE;
+# define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
-# define YYSTYPE_IS_TRIVIAL 1
 #endif
 
 extern YYSTYPE prsalval;
 
+
diff --git a/src/racoon/prsa_par.y b/src/racoon/prsa_par.y
index f21a82b..1987e4d 100644
--- a/src/racoon/prsa_par.y
+++ b/src/racoon/prsa_par.y
@@ -1,4 +1,4 @@
-/*	$NetBSD: prsa_par.y,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
+/*	$NetBSD: prsa_par.y,v 1.6 2011/03/02 14:49:21 vanhu Exp $	*/
 
 /* Id: prsa_par.y,v 1.3 2004/11/08 12:04:23 ludvigm Exp */
 
@@ -211,6 +211,7 @@
 			YYABORT;
 		}
 		$$ = base64_pubkey2rsa($2);
+		free($2);
 	}
 	| TAG_PUB HEX
 	{
@@ -236,6 +237,7 @@
 	{
 		int err;
 		struct sockaddr_in *sap;
+		struct addrinfo hints, *res;
 		
 		if ($2 == -1) $2 = 32;
 		if ($2 < 0 || $2 > 32) {
@@ -245,12 +247,17 @@
 		$$ = calloc (sizeof(struct netaddr), 1);
 		$$->prefix = $2;
 		sap = (struct sockaddr_in *)(&$$->sa);
-		sap->sin_family = AF_INET;
-		err = inet_pton(AF_INET, $1, (struct in_addr*)(&sap->sin_addr));
-		if (err <= 0) {
-			prsaerror("inet_pton(%s): %s\n", $1, strerror(errno));
+		memset(&hints, 0, sizeof(hints));
+		hints.ai_family = AF_INET;
+		hints.ai_flags = AI_NUMERICHOST;
+		err = getaddrinfo($1, NULL, &hints, &res);
+		if (err < 0) {
+			prsaerror("getaddrinfo(%s): %s\n", $1, gai_strerror(err));
 			YYABORT;
 		}
+		memcpy(sap, res->ai_addr, res->ai_addrlen);
+		freeaddrinfo(res);
+		free($1);
 	}
 	;
 
@@ -259,6 +266,7 @@
 	{
 		int err;
 		struct sockaddr_in6 *sap;
+		struct addrinfo hints, *res;
 		
 		if ($2 == -1) $2 = 128;
 		if ($2 < 0 || $2 > 128) {
@@ -268,12 +276,17 @@
 		$$ = calloc (sizeof(struct netaddr), 1);
 		$$->prefix = $2;
 		sap = (struct sockaddr_in6 *)(&$$->sa);
-		sap->sin6_family = AF_INET6;
-		err = inet_pton(AF_INET6, $1, (struct in6_addr*)(&sap->sin6_addr));
-		if (err <= 0) {
-			prsaerror("inet_pton(%s): %s\n", $1, strerror(errno));
+		memset(&hints, 0, sizeof(hints));
+		hints.ai_family = AF_INET6;
+		hints.ai_flags = AI_NUMERICHOST;
+		err = getaddrinfo($1, NULL, &hints, &res);
+		if (err < 0) {
+			prsaerror("getaddrinfo(%s): %s\n", $1, gai_strerror(err));
 			YYABORT;
 		}
+		memcpy(sap, res->ai_addr, res->ai_addrlen);
+		freeaddrinfo(res);
+		free($1);
 	}
 	;
 
diff --git a/src/racoon/racoon.8 b/src/racoon/racoon.8
index a6d39d7..58fefdd 100644
--- a/src/racoon/racoon.8
+++ b/src/racoon/racoon.8
@@ -1,4 +1,4 @@
-.\"	$NetBSD: racoon.8,v 1.10 2006/09/09 16:22:10 manu Exp $
+.\"	$NetBSD: racoon.8,v 1.12 2009/01/24 10:42:31 wiz Exp $
 .\"
 .\" Id: racoon.8,v 1.4 2005/04/18 11:07:55 manubsd Exp
 .\"
@@ -29,7 +29,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd November 20, 2000
+.Dd January 23, 2009
 .Dt RACOON 8
 .Os
 .\"
@@ -40,7 +40,7 @@
 .Sh SYNOPSIS
 .Nm racoon
 .Bk -words
-.Op Fl 46BdFLv
+.Op Fl 46BdFLVv
 .Ek
 .Bk -words
 .Op Fl f Ar configfile
@@ -115,6 +115,8 @@
 Listen to the ISAKMP key exchange on port
 .Ar isakmp-port
 instead of the default port number, 500.
+.It Fl V
+Print racoon version and compilation options and exit.
 .It Fl v
 This flag causes the packet dump be more verbose, with higher
 debugging level.
diff --git a/src/racoon/racoon.conf.5 b/src/racoon/racoon.conf.5
index 9ddee80..70c7eda 100644
--- a/src/racoon/racoon.conf.5
+++ b/src/racoon/racoon.conf.5
@@ -1,4 +1,4 @@
-.\"	$NetBSD: racoon.conf.5,v 1.34.4.3 2007/09/03 18:07:29 mgrooms Exp $
+.\"	$NetBSD: racoon.conf.5,v 1.61 2010/06/22 20:51:04 wiz Exp $
 .\"
 .\"	Id: racoon.conf.5,v 1.54 2006/08/22 18:17:17 manubsd Exp
 .\"
@@ -29,7 +29,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd September 19, 2006
+.Dd June 22, 2010
 .Dt RACOON.CONF 5
 .Os
 .\"
@@ -152,7 +152,7 @@
 should switch.
 This can be a quoted user name or a numeric UID.
 .It Ic group Ar group ;
-The group the unprivilegied instance of
+The group the unprivileged instance of
 .Xr racoon 8 ,
 should switch.
 This can be a quoted group name or a numeric GID.
@@ -184,7 +184,8 @@
 .Ic certificate
 and
 .Ic script
-paths are mandatory. A
+paths are mandatory.
+A
 .Xr racoon 8
 restart is required if you want path changes to be taken into account.
 .Bl -tag -width Ds -compact
@@ -223,7 +224,8 @@
 Specifies file where to store PID of process.
 If path starts with
 .Pa /
-it is treated as an absolute path. Otherwise, it is treated as a relative 
+it is treated as an absolute path.
+Otherwise, it is treated as a relative
 path to the VARRUN directory specified at compilation time.
 Default is
 .Pa racoon.pid .
@@ -235,12 +237,6 @@
 Specifies other configuration files to be included.
 .El
 .\"
-.Ss Identifier Specification
-is obsolete.
-It must be defined at each
-.Ic remote
-directive.
-.\"
 .Ss Timer Specification
 .Bl -tag -width Ds -compact
 .It Ic timer { Ar statements Ic }
@@ -319,12 +315,14 @@
 .Ar owner ,
 and
 .Ar group
-values specify the socket path, owner, and group. They must be quoted.
+values specify the socket path, owner, and group.
+They must be quoted.
 The defaults are
 .Pa /var/racoon/racoon.sock ,
 UID 0, and GID 0.
 .Ar mode
-is the access mode in octal. The default is 0600.
+is the access mode in octal.
+The default is 0600.
 .It Ic adminsock disabled ;
 This directive tells racoon to not listen on the admin socket.
 .El
@@ -360,22 +358,66 @@
 .El
 .El
 .\"
+.Pp
+.Bl -tag -width Ds -compact
+.It Ic pfkey_buffer Ar kBytes
+Specifies the socket send/receive buffer size in kilobytes.
+Numerous kernel PF_KEY implementations have problems with dumping
+SAD/SDP with large amount of entries (this happens when 100s to
+1000s of tunnels are configured).
+.Pp
+The default value of 0 leaves everything at the OS-specific default value.
+If the default buffer size is greater than what is specified here racoon
+will not decrease it.
+.Pp
+This problem is known to be fixed in Linux 2.6.25 and later.
+.El
+.\"
 .Ss Remote Nodes Specifications
 .Bl -tag -width Ds -compact
-.It Xo
-.Ic remote ( Ar address | Ic anonymous )
-.Bq Bq Ar port
-.Bq Ic inherit Ar parent
-.Ic { Ar statements Ic }
-.Xc
+.It Ic remote Ar name Bo Ic inherit Ar parent_name Bc Ic { Ar statements Ic }
 Specifies the IKE phase 1 parameters for each remote node.
-The default port is 500.
-If
-.Ic anonymous
-is specified, the statements will apply to any peer that does not match a
-more specific
-.Ic remote
-directive.
+.Pp
+If connection is initiated using racoonctl, a unique match using the
+remote IP must be found or the remote block name has to be given.
+For received acquires (kernel notices traffic requiring a new SA) the
+remote IP and remoteid from matching sainfo block are used to decide
+the remoteblock.
+If no uniquely matching remoteblock is found using
+these criteria, no connection attempt is done.
+.Pp
+When acting as responder, racoon picks the first proposal that has one
+or more acceptable remote configurations.
+When determining if a remote
+specification is matching the following information is checked:
+.Bl -bullet -width Ds -compact
+.It
+The remote IP is checked against
+.Ic remote_address .
+.It
+ISAKMP exchange type is checked against
+.Ic exchange_mode .
+.It
+ISAKMP SA attributes must match a
+.Ic proposal
+block.
+.It
+The remote identity is matched against
+.Ic peers_identifier
+if
+.Ic verify_identifier
+is on.
+.It
+If a certificate request was received, it must match the issuer of
+.Ic "certificate_type x509"
+certificate.
+If certificate request without issuer name was sent, the
+.Ic match_empty_cr
+parameter specifies whether or not remote block matches.
+.El
+.Pp
+Similarly, NAT-T is enabled if any of the initial remote configuration
+candidates allow NAT-T.
 .Pp
 Sections with
 .Ic inherit Ar parent
@@ -393,6 +435,9 @@
 .Pp
 .Bl -tag -width Ds -compact
 .\"
+.It Ic remote_address Ar address ;
+Defines the IP address of the peer.
+.\"
 .It Ic exchange_mode ( main | aggressive | base ) ;
 Defines the exchange mode for phase 1 when racoon is the initiator.
 It also means the acceptable exchange mode when racoon is the responder.
@@ -408,14 +453,7 @@
 Means to use SIT_IDENTITY_ONLY as specified in RFC 2407.
 You can omit this statement.
 .\"
-.It Ic identifier Ar idtype ;
-This statment is obsolete. Instead, use
-.Ic my_identifier .
-.\"
-.It Xo
-.Ic my_identifier Bq Ar qualifier
-.Ar idtype ... ;
-.Xc
+.It Ic my_identifier Bo Ar qualifier Bc Ar idtype ... ;
 Specifies the identifier sent to the remote host
 and the type to use in the phase 1 negotiation.
 .Ic address, fqdn , user_fqdn , keyid ,
@@ -440,10 +478,7 @@
 The type is a USER_FQDN (user fully-qualified domain name).
 .It Ic my_identifier Ic fqdn Ar string ;
 The type is a FQDN (fully-qualified domain name).
-.It Xo
-.Ic my_identifier Ic keyid Bq Ic file
-.Ar file ;
-.Xc
+.It Ic my_identifier Ic keyid Bo Ic file Bc Ar file ;
 The type is a KEY_ID, read from the file.
 .It Ic my_identifier Ic keyid Ic tag Ar string ;
 The type is a KEY_ID, specified in the quoted string.
@@ -482,6 +517,13 @@
 identifier may specified as
 .Ic *
 to match any value (e.g. "C=XX, O=MyOrg, OU=*, CN=Mine").
+The format of the
+specification should correspond to RFC 2253; in particular, commas and certain
+other characters -
+.Ic ,=+\*[Lt]\*[Gt]#;
+- may be included in a name by preceeding them with a backslash "\e", and
+arbitrary characters may be inserted in a name with the "\enn" escape, where
+nn is the hex representation of the ascii value of the desired character.
 Alternative acceptable peer identifiers may be specified by repeating the
 .Ic peers_identifier
 statement.
@@ -509,7 +551,9 @@
 .Bl -tag -width Ds -compact
 .It Ic plain_rsa Ar privkeyfile ;
 .Ar privkeyfile
-means a file name of a private key generated by plainrsa-gen(8).  Required
+means a file name of a private key generated by
+.Xr plainrsa-gen 8 .
+Required
 for RSA authentication.
 .El
 .It Ic ca_type Ar cacertspec ;
@@ -553,16 +597,20 @@
 .Xr racoon 8
 will expect
 .Ar pubkeyfile
-to be the peer's public key that was generated
-by plainrsa-gen(8).
+to be the peer's public key that was generated by
+.Xr plainrsa-gen 8 .
 .\"
 .It Ic script Ar script Ic phase1_up
 .It Ic script Ar script Ic phase1_down
-Shell scripts that get executed when a phase 1 SA goes up or down.
-Both scripts get either
+.It Ic script Ar script Ic phase1_dead
+Shell scripts that get executed when a phase 1 SA goes up or down, or
+when it is detected as dead by DPD.
+All scripts get either
 .Ic phase1_up
-or
+,
 .Ic phase1_down
+or
+.Ic phase1_dead
 as first argument, and the following
 variables are set in their environment:
 .Bl -tag -width Ds -compact
@@ -574,6 +622,8 @@
 The remote address of the phase 1 SA.
 .It Ev REMOTE_PORT
 The remote port used for IKE for the phase 1 SA.
+.It Ev REMOTE_ID
+The remote identity received in IKE for the phase 1 SA.
 .El
 The following variables are only set if
 .Ic mode_cfg
@@ -604,6 +654,10 @@
 The space separated list of IPv4 addresses and masks (address slash mask)
 that define the networks to be considered local, and thus excluded from the
 tunnels ; obtained by ISAKMP mode config.
+.It SPLIT_INCLUDE_CIDR
+Same as SPLIT_INCLUDE, with netmasks in CIDR notation.
+.It SPLIT_LOCAL_CIDR
+Same as SPLIT_LOCAL, with netmasks in CIDR notation.
 .It DEFAULT_DOMAIN
 The DNS default domain name obtained by ISAKMP mode config.
 .El
@@ -617,16 +671,21 @@
 If you do not want to send a certificate request, set this to off.
 The default is on.
 .\"
+.It Ic match_empty_cr (on | off) ;
+Specifies whether this remote block is a valid match when a non-specific
+certificate request is received.
+The default is on.
+.\"
 .It Ic verify_cert (on | off) ;
 By default, the identifier sent by the remote host (as specified in its
 .Ic my_identifier
 statement) is compared with the credentials in the certificate
 used to authenticate the remote host as follows:
 .Bl -tag -width Ds -compact
-.It Type Ic asn1dn:
+.It Type Ic asn1dn :
 The entire certificate subject name is compared with the identifier,
 e.g. "C=XX, O=YY, ...".
-.It Type Ic address, fqdn, or user_fqdn:
+.It Type Ic address, fqdn, or user_fqdn :
 The certificate's subjectAltName is compared with the identifier.
 .El
 If the two do not match the negotiation will fail.
@@ -692,7 +751,7 @@
 It is useful for a server.
 .\"
 .It Ic proposal_check Ar level ;
-Specifies the action of lifetime length, key length and PFS of the phase 2
+Specifies the action of lifetime length, key length, and PFS of the phase 2
 selection on the responder side, and the action of lifetime check in
 phase 1.
 The default level is
@@ -812,6 +871,22 @@
 The default value is
 .Ic 5 .
 .\"
+.It Ic rekey (on | off | force) ;
+Enable automatic renegotiation of expired phase1 when there are non-dying
+phase2 SAs.
+Possible values are:
+.Bl -tag -width Ds -compact
+.It Ic force
+Rekeying is done unconditionally.
+.It Ic on
+Rekeying is done only if DPD monitoring is active.
+This is the default.
+.It Ic off
+No automatic rekeying.
+Do note that turning off automatic rekeying will
+result in inaccurate DPD monitoring.
+.El
+.\"
 .It Ic nonce_size Ar number ;
 define the byte size of nonce value.
 Racoon can send any value although
@@ -819,13 +894,11 @@
 The default size is 16 bytes.
 .\"
 .It Ic ph1id Ar number ;
-An optionnal number to identify the remote proposal and to link it
+An optional number to identify the remote proposal and to link it
 only with sainfos who have the same number.
 Defaults to 0.
 .\"
-.It Xo
-.Ic proposal { Ar sub-substatements Ic }
-.Xc
+.It Ic proposal { Ar sub-substatements Ic }
 .Bl -tag -width Ds -compact
 .\"
 .It Ic encryption_algorithm Ar algorithm ;
@@ -888,30 +961,35 @@
 command.
 .El
 .El
+.Pp
+.It Ic remote Po Ar address | Ic anonymous Pc Bo Bo Ar port Bc Bc \
+Bo Ic inherit Ar parent Bc Ic { Ar statements Ic }
+Deprecated format of specifying a remote block.
+This will be removed in future.
+It is a remnant from time when remote block was decided
+solely based on the peers IP address.
+.Pp
+This is equivalent to:
+.Bd -literal -offset
+remote "address" [inherit "parent-address"] {
+	remote_address address;
+}
+.Ed
 .El
 .\"
-.Ss Policy Specifications
-The policy directive is obsolete, policies are now in the SPD.
-.Xr racoon 8
-will obey the policy configured into the kernel by
-.Xr setkey 8 ,
-and will construct phase 2 proposals by combining
-.Ic sainfo
-specifications in
-.Nm ,
-and policies in the kernel.
-.\"
 .Ss Sainfo Specifications
 .Bl -tag -width Ds -compact
-.It Xo
-.Ic sainfo ( Ar source_id destination_id | Ar source_id Ic anonymous | Ic anonymous Ar destination_id | Ic anonymous ) [ from Ar idtype [ Ar string ] ] [ Ic group Ar string ]
-.Ic { Ar statements Ic }
-.Xc
-defines the parameters of the IKE phase 2 (IPsec-SA establishment).
-.Ar source_id
+.It Ic sainfo Po Ar local_id | Ic anonymous Pc \
+Po Ar remote_id | Ic clientaddr | Ic anonymous Pc \
+Bo Ic from Ar idtype Bo Ar string Bc Bc Bo Ic group Ar string Bc \
+Ic { Ar statements Ic }
+Defines the parameters of the IKE phase 2 (IPsec-SA establishment).
+.Pp
+The
+.Ar local_id
 and
-.Ar destination_id
-are constructed like:
+.Ar remote_id
+strings are constructed like:
 .Pp
 .Ic address Ar address
 .Bq Ic / Ar prefix
@@ -925,17 +1003,11 @@
 .Bq Ic [ Ar port ]
 .Ar ul_proto
 .Pp
-or
-.Pp
-.Ar idtype Ar string
-.Pp
-An id string should be expressed to match the exact value of an ID payload
-(source is the local end, destination is the remote end).
+An id string should be expressed to match the exact value of an ID payload.
 This is not like a filter rule.
 For example, if you define 3ffe:501:4819::/48 as
-.Ar source_id .
+.Ar local_id .
 3ffe:501:4819:1000:/64 will not match.
-.Pp
 In the case of a longest prefix (selecting a single host),
 .Ar address
 instructs to send ID type of ADDRESS while
@@ -943,7 +1015,24 @@
 instructs to send ID type of SUBNET.
 Otherwise, these instructions are identical.
 .Pp
-The group keyword allows an XAuth group membership check to be performed
+The
+.Ic anonymous
+keyword can be used to match any id.
+The
+.Ic clientaddr
+keyword can be used to match a remote id that is equal to either the peer
+ip address or the mode_cfg ip address (if assigned).
+This can be useful
+to restrict policy generation when racoon is acting as a client gateway
+for peers with dynamic ip addresses.
+.Pp
+The
+.Ic from
+keyword allows an sainfo to only match for peers that use a specific phase1
+id value during authentication.
+The
+.Ic group
+keyword allows an XAuth group membership check to be performed
 for this sainfo section.
 When the mode_cfg auth source is set to
 .Ic system
@@ -977,10 +1066,6 @@
 Sainfos will only be used if their remoteid matches the ph1id of the
 remote section used for phase 1.
 Defaults to 0, which is also the default for ph1id.
-.\"
-.It Ic my_identifier Ar idtype ... ;
-is obsolete.
-It does not make sense to specify an identifier in the phase 2.
 .El
 .\"
 .Pp
@@ -1037,7 +1122,7 @@
 .Ar level
 is one of following:
 .Ic error , warning , notify , info , debug
-and
+or
 .Ic debug2 .
 The default is
 .Ic info .
@@ -1091,8 +1176,10 @@
 means to use a RADIUS server.
 It works only if
 .Xr racoon 8
-was built with libradius support. Radius configuration is hanlded by
-.Xr radius.conf 5 .
+was built with libradius support.
+Radius configuration is handled by statements in the
+.Ic radiuscfg
+section.
 .Ar pam
 means to use PAM.
 It works only if
@@ -1102,8 +1189,8 @@
 means to use LDAP.
 It works only if
 .Xr racoon 8
-was built with libldap support. LDAP configuration is handled by
-statements in the
+was built with libldap support.
+LDAP configuration is handled by statements in the
 .Ic ldapcfg
 section.
 .It Ic auth_groups Ar "group1", ... ;
@@ -1111,7 +1198,7 @@
 When defined, the authenticating user must be a member of at least one
 group for Xauth to succeed.
 .It Ic group_source (system | ldap) ;
-Specifies the source for group validataion of users through Xauth.
+Specifies the source for group validation of users through Xauth.
 .Ar system
 means to use the Unix user database.
 This is the default.
@@ -1137,9 +1224,10 @@
 means to use a RADIUS server.
 It works only if
 .Xr racoon 8
-was built with libradius support and requires RADIUS authentiation.
-RADIUS configuration is handled by
-.Xr radius.conf 5 .
+was built with libradius support and requires RADIUS authentication.
+RADIUS configuration is handled by statements in the
+.Ic radiuscfg
+section.
 .Ar ldap
 means to use an LDAP server.
 It works only if
@@ -1164,8 +1252,9 @@
 It works only if
 .Xr racoon 8
 was built with libradius support and requires RADIUS authentication.
-RADIUS configuration is handled by
-.Xr radius.conf 5 .
+RADIUS configuration is handled by statements in the
+.Ic radiuscfg
+section.
 Specifying
 .Ar pam
 enables PAM accounting.
@@ -1198,12 +1287,13 @@
 .Ic dns4
 lines.
 .It Ic wins4 Ar addresses ;
-A list of IPv4 address for WINS servers. The keyword
+A list of IPv4 address for WINS servers.
+The keyword
 .It nbns4
 can also be used as an alias for
 .It wins4 .
 .It Ic split_network (include | local_lan) Ar network/mask, ...
-The network configuration to send, in cidr notation (e.g. 192.168.1.0/24).
+The network configuration to send, in CIDR notation (e.g. 192.168.1.0/24).
 If
 .Ic include
 is specified, the tunnel should be only used to encrypt the indicated
@@ -1255,11 +1345,11 @@
 The host name or ip address of the ldap server.
 The default is
 .Ic localhost .
-.It Ic port Ar number;
+.It Ic port Ar number ;
 The port that the ldap server is configured to listen on.
 The default is
 .Ic 389 .
-.It Ic base Ar distinguished name;
+.It Ic base Ar distinguished name ;
 The ldap search base.
 This option has no default value.
 .It Ic subtree (on | off) ;
@@ -1267,20 +1357,20 @@
 Otherwise, use the one level search scope.
 The default is
 .Ic off .
-.It Ic bind_dn Ar distinguised name;
-The user dn used to optionaly bind as before performing ldap search operations.
+.It Ic bind_dn Ar distinguished name ;
+The user dn used to optionally bind as before performing ldap search operations.
 If this option is not specified, anonymous binds are used.
-.It Ic bind_pw Ar string;
+.It Ic bind_pw Ar string ;
 The password used when binding as
 .Ic bind_dn .
-.It Ic attr_user Ar attribute name;
+.It Ic attr_user Ar attribute name ;
 The attribute used to specify a users name in an ldap directory.
 For example,
 if a user dn is "cn=jdoe,dc=my,dc=net" then the attribute would be "cn".
 The default value is
 .Ic cn .
-.It Ic attr_addr Ar attribute name;
-.It Ic attr_mask Ar attribute name;
+.It Ic attr_addr Ar attribute name ;
+.It Ic attr_mask Ar attribute name ;
 The attributes used to specify a users network address and subnet mask in an
 ldap directory.
 These values are forwarded during mode_cfg negotiation when
@@ -1289,18 +1379,54 @@
 .Ic racoon-address
 and
 .Ic racoon-netmask .
-.It Ic attr_group Ar attribute name;
+.It Ic attr_group Ar attribute name ;
 The attribute used to specify a group name in an ldap directory.
 For example,
 if a group dn is "cn=users,dc=my,dc=net" then the attribute would be "cn".
 The default value is
 .Ic cn .
-.It Ic attr_member Ar attribute name;
+.It Ic attr_member Ar attribute name ;
 The attribute used to specify group membership in an ldap directory.
 The default value is
 .Ic member .
 .El
 .El
+.Ss Radius configuration settings
+.Bl -tag -width Ds -compact
+.It Ic radiuscfg { Ar statements Ic }
+Defines the parameters that will be used to communicate with radius
+servers for
+.Ic xauth
+authentication.
+If radius is selected as the xauth authentication or accounting
+source and no servers are defined in this section, settings from
+the system
+.Xr radius.conf 5
+configuration file will be used instead.
+.Pp
+The following are valid statements:
+.Bl -tag -width Ds -compact
+.It Ic auth Ar (hostname | address) [port] sharedsecret ;
+The host name or ip address, optional port value and shared secret value
+of a radius authentication server.
+Up to 5 radius authentication servers
+may be specified using multiple lines.
+.It Ic acct Ar (hostname | address) [port] sharedsecret ;
+The host name or ip address, optional port value and shared secret value
+of a radius accounting server.
+Up to 5 radius accounting servers may be
+specified using multiple lines.
+.It Ic timeout Ar seconds ;
+The timeout for receiving replies from radius servers.
+The default is
+.Ic 3 .
+.It Ic retries Ar count ;
+The maximum number of repeated requests to make before giving up
+on a radius server.
+The default is
+.Ic 3 .
+.El
+.El
 .Ss Special directives
 .Bl -tag -width Ds -compact
 .It Ic complex_bundle (on | off) ;
diff --git a/src/racoon/racoonctl.8 b/src/racoon/racoonctl.8
index b27b188..697f3ed 100644
--- a/src/racoon/racoonctl.8
+++ b/src/racoon/racoonctl.8
@@ -1,4 +1,4 @@
-.\"	$NetBSD: racoonctl.8,v 1.13 2006/09/09 16:22:10 manu Exp $
+.\"	$NetBSD: racoonctl.8,v 1.22 2009/03/12 14:01:09 wiz Exp $
 .\"
 .\" Id: racoonctl.8,v 1.6 2006/05/07 21:32:59 manubsd Exp
 .\"
@@ -29,7 +29,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd November 16, 2004
+.Dd March 12, 2009
 .Dt RACOONCTL 8
 .Os
 .\"
@@ -39,34 +39,49 @@
 .\"
 .Sh SYNOPSIS
 .Nm
+.Op opts
 reload-config
 .Nm
+.Op opts
 show-schedule
 .Nm
-.Op Fl l Op Fl l
+.Op opts
 show-sa
 .Op isakmp|esp|ah|ipsec
 .Nm
+.Op opts
+get-sa-cert
+.Op inet|inet6
+.Ar src dst
+.Nm
+.Op opts
 flush-sa
 .Op isakmp|esp|ah|ipsec
 .Nm
+.Op opts
 delete-sa
 .Ar saopts
 .Nm
+.Op opts
 establish-sa
+.Op Fl w
+.Op Fl n Ar remoteconf
 .Op Fl u Ar identity
 .Ar saopts
 .Nm
+.Op opts
 vpn-connect
-.Op Fl u identity
+.Op Fl u Ar identity
 .Ar vpn_gateway
 .Nm
+.Op opts
 vpn-disconnect
 .Ar vpn_gateway
 .Nm
+.Op opts
 show-event
-.Op Fl l
 .Nm
+.Op opts
 logout-user
 .Ar login
 .\"
@@ -85,6 +100,19 @@
 .Xr racoon 8
 behavior, so do that with caution.
 .Pp
+The following general options are available:
+.Bl -tag -width Ds
+.It Fl d
+Debug mode.
+Hexdump sent admin port commands.
+.It Fl l
+Increase verbosity.
+Mainly for show-sa command.
+.It Fl s Ar socket
+Specify unix socket name used to connecting racoon.
+.El
+.\"
+.Pp
 The following commands are available:
 .Bl -tag -width Ds
 .It reload-config
@@ -99,33 +127,41 @@
 Use
 .Fl l
 to increase verbosity.
+.It get-sa-cert Oo inet|inet6 Oc Ar src dst
+Output the raw certificate that was used to authenticate the phase 1
+matching
+.Ar src
+and
+.Ar dst .
 .It flush-sa Op isakmp|esp|ah|ipsec
 is used to flush all SAs if no SA class is provided, or a class of SAs,
 either ISAKMP SAs, IPsec ESP SAs, IPsec AH SAs, or all IPsec SAs.
-.It Xo establish-sa
-.Oo Fl u Ar username
-.Oc Ar saopts
-.Xc
+.It establish-sa Oo Fl w Oc Oo Fl n Ar remoteconf Oc Oo Fl u Ar username \
+Oc Ar saopts
 Establish an SA, either an ISAKMP SA, IPsec ESP SA, or IPsec AH SA.
 The optional
 .Fl u Ar username
 can be used when establishing an ISAKMP SA while hybrid auth is in use.
+The exact remote block to use can be specified with
+.Fl n Ar remoteconf .
 .Nm
 will prompt you for the password associated with
 .Ar username
 and these credentials will be used in the Xauth exchange.
 .Pp
+Specifying
+.Fl w
+will make racoonctl wait until the SA is actually established or
+an error occurs.
+.Pp
 .Ar saopts
 has the following format:
 .Bl -tag -width Bl
 .It isakmp {inet|inet6} Ar src Ar dst
 .It {esp|ah} {inet|inet6} Ar src/prefixlen/port Ar dst/prefixlen/port
-{icmp|tcp|udp|any}
+{icmp|tcp|udp|gre|any}
 .El
-.It Xo vpn-connect
-.Oo Fl u Ar username
-.Oc Ar vpn_gateway
-.Xc
+.It vpn-connect Oo Fl u Ar username Oc Ar vpn_gateway
 This is a particular case of the previous command.
 It will establish an ISAKMP SA with
 .Ar vpn_gateway .
@@ -135,16 +171,9 @@
 This is a particular case of the previous command.
 It will kill all SAs associated with
 .Ar vpn_gateway .
-.It show-event Op Fl l
-Dump all events reported by
-.Xr racoon 8 ,
-then quit.
-The
-.Fl l
-flag causes
-.Nm
-to not stop once all the events have been read, but rather to loop
-awaiting and reporting new events.
+.It show-event
+Listen for all events reported by
+.Xr racoon 8 .
 .It logout-user Ar login
 Delete all SA established on behalf of the Xauth user
 .Ar login .
diff --git a/src/racoon/racoonctl.c b/src/racoon/racoonctl.c
index 1dd26f0..da28ecd 100644
--- a/src/racoon/racoonctl.c
+++ b/src/racoon/racoonctl.c
@@ -1,9 +1,10 @@
-/*	$NetBSD: racoonctl.c,v 1.7.6.2 2009/04/20 13:32:57 tteras Exp $	*/
+/*	$NetBSD: racoonctl.c,v 1.18 2010/11/12 09:08:26 tteras Exp $	*/
 
 /*	Id: racoonctl.c,v 1.11 2006/04/06 17:06:25 manubsd Exp */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
+ * Copyright (C) 2008 Timo Teras.
  * All rights reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
@@ -92,6 +93,7 @@
 static vchar_t *f_reload __P((int, char **));
 static vchar_t *f_getsched __P((int, char **));
 static vchar_t *f_getsa __P((int, char **));
+static vchar_t *f_getsacert __P((int, char **));
 static vchar_t *f_flushsa __P((int, char **));
 static vchar_t *f_deletesa __P((int, char **));
 static vchar_t *f_exchangesa __P((int, char **));
@@ -104,59 +106,59 @@
 
 struct cmd_tag {
 	vchar_t *(*func) __P((int, char **));
-	int cmd;
 	char *str;
 } cmdtab[] = {
-	{ f_reload,	ADMIN_RELOAD_CONF,	"reload-config" },
-	{ f_reload,	ADMIN_RELOAD_CONF,	"rc" },
-	{ f_getsched,	ADMIN_SHOW_SCHED,	"show-schedule" },
-	{ f_getsched,	ADMIN_SHOW_SCHED,	"sc" },
-	{ f_getsa,	ADMIN_SHOW_SA,		"show-sa" },
-	{ f_getsa,	ADMIN_SHOW_SA,		"ss" },
-	{ f_flushsa,	ADMIN_FLUSH_SA,		"flush-sa" },
-	{ f_flushsa,	ADMIN_FLUSH_SA,		"fs" },
-	{ f_deletesa,	ADMIN_DELETE_SA,	"delete-sa" },
-	{ f_deletesa,	ADMIN_DELETE_SA,	"ds" },
-	{ f_exchangesa,	ADMIN_ESTABLISH_SA,	"establish-sa" },
-	{ f_exchangesa,	ADMIN_ESTABLISH_SA,	"es" },
-	{ f_vpnc,	ADMIN_ESTABLISH_SA,	"vpn-connect" },
-	{ f_vpnc,	ADMIN_ESTABLISH_SA,	"vc" },
-	{ f_vpnd,	ADMIN_DELETE_ALL_SA_DST,"vpn-disconnect" },
-	{ f_vpnd,	ADMIN_DELETE_ALL_SA_DST,"vd" },
-	{ f_getevt,	ADMIN_SHOW_EVT,		"show-event" },
-	{ f_getevt,	ADMIN_SHOW_EVT,		"se" },
+	{ f_reload,	"reload-config" },
+	{ f_reload,	"rc" },
+	{ f_getsched,	"show-schedule" },
+	{ f_getsched,	"sc" },
+	{ f_getsa,	"show-sa" },
+	{ f_getsa,	"ss" },
+	{ f_getsacert,	"get-cert" },
+	{ f_getsacert,	"gc" },
+	{ f_flushsa,	"flush-sa" },
+	{ f_flushsa,	"fs" },
+	{ f_deletesa,	"delete-sa" },
+	{ f_deletesa,	"ds" },
+	{ f_exchangesa,	"establish-sa" },
+	{ f_exchangesa,	"es" },
+	{ f_vpnc,	"vpn-connect" },
+	{ f_vpnc,	"vc" },
+	{ f_vpnd,	"vpn-disconnect" },
+	{ f_vpnd,	"vd" },
+	{ f_getevt,	"show-event" },
+	{ f_getevt,	"se" },
 #ifdef ENABLE_HYBRID
-	{ f_logoutusr,	ADMIN_LOGOUT_USER,	"logout-user" },
-	{ f_logoutusr,	ADMIN_LOGOUT_USER,	"lu" },
+	{ f_logoutusr,	"logout-user" },
+	{ f_logoutusr,	"lu" },
 #endif
-	{ NULL, 0, NULL },
+	{ NULL, NULL },
 };
 
 struct evtmsg {
 	int type;
 	char *msg;
-	enum { UNSPEC, ERROR, INFO } level;
 } evtmsg[] = {
-	{ EVTT_PHASE1_UP, "Phase 1 established", INFO },
-	{ EVTT_PHASE1_DOWN, "Phase 1 deleted", INFO },
-	{ EVTT_XAUTH_SUCCESS, "Xauth exchange passed", INFO },
-	{ EVTT_ISAKMP_CFG_DONE, "ISAKMP mode config done", INFO },
-	{ EVTT_PHASE2_UP, "Phase 2 established", INFO },
-	{ EVTT_PHASE2_DOWN, "Phase 2 deleted", INFO },
-	{ EVTT_DPD_TIMEOUT, "Peer not reachable anymore", ERROR },
-	{ EVTT_PEER_NO_RESPONSE, "Peer not responding", ERROR },
-	{ EVTT_PEER_DELETE, "Peer terminated security association", ERROR },
-	{ EVTT_RACOON_QUIT, "Raccon terminated", ERROR },
-	{ EVTT_OVERFLOW, "Event queue overflow", ERROR },
-	{ EVTT_XAUTH_FAILED, "Xauth exchange failed", ERROR },
-	{ EVTT_PEERPH1AUTH_FAILED, "Peer failed phase 1 authentication "
-	    "(certificate problem?)", ERROR },
-	{ EVTT_PEERPH1_NOPROP, "Peer failed phase 1 initiation "
-	    "(proposal problem?)", ERROR },
-	{ 0, NULL, UNSPEC },
-	{ EVTT_NO_ISAKMP_CFG, "No need for ISAKMP mode config ", INFO },
+	{ EVT_RACOON_QUIT,		"Racoon terminated" },
+
+	{ EVT_PHASE1_UP,		"Phase 1 established" },
+	{ EVT_PHASE1_DOWN,		"Phase 1 deleted" },
+	{ EVT_PHASE1_NO_RESPONSE,	"Phase 1 error: peer not responding" },
+	{ EVT_PHASE1_NO_PROPOSAL,	"Phase 1 error: no proposal chosen" },
+	{ EVT_PHASE1_AUTH_FAILED,
+	  "Phase 1 error: authentication failed (bad certificate?)" },
+	{ EVT_PHASE1_DPD_TIMEOUT,	"Phase 1 error: dead peer detected" },
+	{ EVT_PHASE1_MODE_CFG,		"Phase 1 mode configuration done" },
+	{ EVT_PHASE1_XAUTH_SUCCESS,	"Phase 1 Xauth succeeded" },
+	{ EVT_PHASE1_XAUTH_FAILED,	"Phase 1 Xauth failed" },
+
+	{ EVT_PHASE2_NO_PHASE1,		"Phase 2 error: no suitable phase 1" },
+	{ EVT_PHASE2_UP,		"Phase 2 established" },
+	{ EVT_PHASE2_DOWN,		"Phase 2 deleted" },
+	{ EVT_PHASE2_NO_RESPONSE,	"Phase 2 error: no response" },
 };
 
+static vchar_t *get_proto_and_index __P((int, char **, u_int16_t *));
 static int get_proto __P((char *));
 static vchar_t *get_index __P((int, char **));
 static int get_family __P((char *));
@@ -184,6 +186,7 @@
 	{ IPPROTO_ICMP,	"icmp" },
 	{ IPPROTO_TCP,	"tcp" },
 	{ IPPROTO_UDP,	"udp" },
+	{ IPPROTO_GRE,	"gre" },
 	{ 0, NULL },
 };
 
@@ -193,31 +196,13 @@
 
 char *pname;
 int long_format = 0;
-
-#define EVTF_NONE		0x0000	/* Ignore any events */
-#define EVTF_LOOP		0x0001	/* Loop awaiting for new events */
-#define EVTF_CFG_STOP		0x0002	/* Stop after ISAKMP mode config */
-#define EVTF_CFG		0x0004	/* Print ISAKMP mode config info */
-#define EVTF_ALL		0x0008	/* Print any events */
-#define EVTF_PURGE		0x0010	/* Print all available events */
-#define EVTF_PH1DOWN_STOP	0x0020	/* Stop when phase 1 SA gets down */
-#define EVTF_PH1DOWN		0x0040	/* Print that phase 1 SA got down */
-#define EVTF_ERR		0x0080	/* Print any error */
-#define EVTF_ERR_STOP		0x0100	/* Stop on any error */
-
-int evt_filter = EVTF_NONE;
-time_t evt_start;
+int evt_quit_event = 0;
 
 void dump_isakmp_sa __P((char *, int));
 void dump_internal __P((char *, int));
 char *pindex_isakmp __P((isakmp_index *));
 void print_schedule __P((caddr_t, int));
-void print_evt __P((caddr_t, int));
-void print_cfg __P((caddr_t, int));
-void print_err __P((caddr_t, int));
-void print_ph1down __P((caddr_t, int));
-void print_ph1up __P((caddr_t, int));
-int evt_poll __P((void));
+void print_evt __P((struct evt_async *));
 char * fixed_addr __P((char *, char *, int));
 
 static void
@@ -225,14 +210,23 @@
 {
 	printf(
 "Usage:\n"
-"  %s reload-config\n"
-"  %s [-l [-l]] show-sa [protocol]\n"
-"  %s flush-sa [protocol]\n"
-"  %s delete-sa <saopts>\n"
-"  %s establish-sa [-u identity] <saopts>\n"
-"  %s vpn-connect [-u identity] vpn_gateway\n"
-"  %s vpn-disconnect vpn_gateway\n"
+"  %s [opts] reload-config\n"
+"  %s [opts] show-schedule\n"
+"  %s [opts] show-sa [protocol]\n"
+"  %s [opts] flush-sa [protocol]\n"
+"  %s [opts] delete-sa <saopts>\n"
+"  %s [opts] establish-sa [-u identity] [-n remoteconf] [-w] <saopts>\n"
+"  %s [opts] vpn-connect [-u identity] vpn_gateway\n"
+"  %s [opts] vpn-disconnect vpn_gateway\n"
+"  %s [opts] show-event\n"
+"  %s [opts] logout-user login\n"
 "\n"
+"General options:\n"
+"  -d		Debug: hexdump admin messages before sending\n"
+"  -l		Increase output verbosity (mainly for show-sa)\n"
+"  -s <socket>	Specify adminport socket to use (default: %s)\n"
+"\n"
+"Parameter specifications:\n"
 "    <protocol>: \"isakmp\", \"esp\" or \"ah\".\n"
 "        In the case of \"show-sa\" or \"flush-sa\", you can use \"ipsec\".\n"
 "\n"
@@ -240,8 +234,10 @@
 "            : {\"esp\",\"ah\"} <family> <src/prefixlen/port> <dst/prefixlen/port>\n"
 "                              <ul_proto>\n"
 "    <family>: \"inet\" or \"inet6\"\n"
-"    <ul_proto>: \"icmp\", \"tcp\", \"udp\" or \"any\"\n",
-	pname, pname, pname, pname, pname, pname, pname);
+"    <ul_proto>: \"icmp\", \"tcp\", \"udp\", \"gre\" or \"any\"\n"
+"\n",
+		pname, pname, pname, pname, pname, pname, pname, pname, pname, pname,
+		ADMINSOCK_PATH);
 }
 
 /*
@@ -312,54 +308,24 @@
 
 	vfree(combuf);
 
-	if (com_recv(&combuf) != 0)
-		goto bad;
-	if (handle_recv(combuf) != 0)
-		goto bad;
+	do {
+		if (com_recv(&combuf) != 0)
+			goto bad;
+		if (handle_recv(combuf) != 0)
+			goto bad;
+		vfree(combuf);
+	} while (evt_quit_event != 0);
 
-	vfree(combuf);
-
-	if (evt_filter != EVTF_NONE)
-		if (evt_poll() != 0)
-			goto bad;	
-	
+	close(so);
 	exit(0);
 
-    bad:
+bad:
+	close(so);
+	if (errno == EEXIST)
+		exit(0);
 	exit(1);
 }
 
-int
-evt_poll(void) {
-	struct timeval tv;
-	vchar_t *recvbuf;
-	vchar_t *sendbuf;
-
-	if ((sendbuf = f_getevt(0, NULL)) == NULL)
-		errx(1, "Cannot make combuf");
-
-
-	while (evt_filter & (EVTF_LOOP|EVTF_PURGE)) {
-		/* handle_recv closes the socket time, so open it each time */
-		com_init();
-
-		if (com_send(sendbuf) != 0)
-			errx(1, "Cannot send combuf");
-
-		if (com_recv(&recvbuf) == 0) {
-			handle_recv(recvbuf);
-			vfree(recvbuf);
-		}
-
-		tv.tv_sec = 0;
-		tv.tv_usec = 10;
-		(void)select(0, NULL, NULL, NULL, &tv);
-	}
-
-	vfree(sendbuf);
-	return 0;
-}
-
 /* %%% */
 /*
  * return command buffer.
@@ -394,61 +360,42 @@
 }
 
 static vchar_t *
-f_reload(ac, av)
-	int ac;
-	char **av;
+make_request(u_int16_t cmd, u_int16_t proto, size_t len)
 {
 	vchar_t *buf;
 	struct admin_com *head;
 
-	buf = vmalloc(sizeof(*head));
+	buf = vmalloc(sizeof(struct admin_com) + len);
 	if (buf == NULL)
 		errx(1, "not enough core");
 
-	head = (struct admin_com *)buf->v;
+	head = (struct admin_com *) buf->v;
 	head->ac_len = buf->l;
-	head->ac_cmd = ADMIN_RELOAD_CONF;
-	head->ac_errno = 0;
-	head->ac_proto = 0;
+	head->ac_cmd = ADMIN_FLAG_VERSION | cmd;
+	head->ac_version = 1;
+	head->ac_proto = proto;
 
 	return buf;
 }
 
 static vchar_t *
+f_reload(ac, av)
+	int ac;
+	char **av;
+{
+	return make_request(ADMIN_RELOAD_CONF, 0, 0);
+}
+
+static vchar_t *
 f_getevt(ac, av)
 	int ac;
 	char **av;
 {
-	vchar_t *buf;
-	struct admin_com *head;
-
-	/*
-	 * There are 3 ways of getting here
-	 * 1) racoonctl vc => evt_filter = (EVTF_LOOP|EVTF_CFG| ... )
-	 * 2) racoonctl es => evt_filter = EVTF_NONE
-	 * 3) racoonctl es -l => evt_filter = EVTF_LOOP
-	 * Catch the second case: show-event is here to purge all
-	 */
-	if (evt_filter == EVTF_NONE)
-		evt_filter = (EVTF_ALL|EVTF_PURGE);
-
-	if ((ac >= 1) && (strcmp(av[0], "-l") == 0))
-		evt_filter |= EVTF_LOOP;
-
-	if (ac >= 2)
+	evt_quit_event = -1;
+	if (ac >= 1)
 		errx(1, "too many arguments");
 
-	buf = vmalloc(sizeof(*head));
-	if (buf == NULL)
-		errx(1, "not enough core");
-
-	head = (struct admin_com *)buf->v;
-	head->ac_len = buf->l;
-	head->ac_cmd = ADMIN_SHOW_EVT;
-	head->ac_errno = 0;
-	head->ac_proto = 0;
-
-	return buf;
+	return make_request(ADMIN_SHOW_EVT, 0, 0);
 }
 
 static vchar_t *
@@ -456,20 +403,7 @@
 	int ac;
 	char **av;
 {
-	vchar_t *buf;
-	struct admin_com *head;
-
-	buf = vmalloc(sizeof(*head));
-	if (buf == NULL)
-		errx(1, "not enough core");
-
-	head = (struct admin_com *)buf->v;
-	head->ac_len = buf->l;
-	head->ac_cmd = ADMIN_SHOW_SCHED;
-	head->ac_errno = 0;
-	head->ac_proto = 0;
-
-	return buf;
+	return make_request(ADMIN_SHOW_SCHED, 0, 0);
 }
 
 static vchar_t *
@@ -477,8 +411,6 @@
 	int ac;
 	char **av;
 {
-	vchar_t *buf;
-	struct admin_com *head;
 	int proto;
 
 	/* need protocol */
@@ -488,15 +420,29 @@
 	if (proto == -1)
 		errx(1, "unknown protocol %s", *av);
 
-	buf = vmalloc(sizeof(*head));
-	if (buf == NULL)
-		errx(1, "not enough core");
+	return make_request(ADMIN_SHOW_SA, proto, 0);
+}
 
-	head = (struct admin_com *)buf->v;
-	head->ac_len = buf->l;
-	head->ac_cmd = ADMIN_SHOW_SA;
-	head->ac_errno = 0;
-	head->ac_proto = proto;
+static vchar_t *
+f_getsacert(ac, av)
+	int ac;
+	char **av;
+{
+	vchar_t *buf, *index;
+	struct admin_com_indexes *com;
+
+	index = get_index(ac, av);
+	if (index == NULL)
+		return NULL;
+
+	com = (struct admin_com_indexes *) index->v;
+	buf = make_request(ADMIN_GET_SA_CERT, ADMIN_PROTO_ISAKMP, index->l);
+	if (buf == NULL)
+		errx(1, "Cannot allocate buffer");
+
+	memcpy(buf->v+sizeof(struct admin_com), index->v, index->l);
+
+	vfree(index);
 
 	return buf;
 }
@@ -517,17 +463,7 @@
 	if (proto == -1)
 		errx(1, "unknown protocol %s", *av);
 
-	buf = vmalloc(sizeof(*head));
-	if (buf == NULL)
-		errx(1, "not enough core");
-
-	head = (struct admin_com *)buf->v;
-	head->ac_len = buf->l;
-	head->ac_cmd = ADMIN_FLUSH_SA;
-	head->ac_errno = 0;
-	head->ac_proto = proto;
-
-	return buf;
+	return make_request(ADMIN_FLUSH_SA, proto, 0);
 }
 
 static vchar_t *
@@ -536,7 +472,6 @@
 	char **av;
 {
 	vchar_t *buf, *index;
-	struct admin_com *head;
 	int proto;
 
 	/* need protocol */
@@ -566,17 +501,11 @@
 		return NULL;
 	}
 
-	buf = vmalloc(sizeof(*head) + index->l);
+	buf = make_request(ADMIN_DELETE_SA, proto, index->l);
 	if (buf == NULL)
 		goto out;
 
-	head = (struct admin_com *)buf->v;
-	head->ac_len = buf->l + index->l;
-	head->ac_cmd = ADMIN_DELETE_SA;
-	head->ac_errno = 0;
-	head->ac_proto = proto;
-
-	memcpy(buf->v+sizeof(*head), index->v, index->l);
+	memcpy(buf->v + sizeof(struct admin_com), index->v, index->l);
 
 out:
 	if (index != NULL)
@@ -591,47 +520,17 @@
 	char **av;
 {
 	vchar_t *buf, *index;
-	struct admin_com *head;
-	int proto;
+	u_int16_t proto;
 
-	/* need protocol */
-	if (ac < 1)
-		errx(1, "insufficient arguments");
-	proto = get_proto(*av);
-	if (proto == -1)
-		errx(1, "unknown protocol %s", *av);
-
-	/* get index(es) */
-	av++;
-	ac--;
-	switch (proto) {
-	case ADMIN_PROTO_ISAKMP:
-		index = get_index(ac, av);
-		if (index == NULL)
-			return NULL;
-		break;
-	case ADMIN_PROTO_AH:
-	case ADMIN_PROTO_ESP:
-		index = get_index(ac, av);
-		if (index == NULL)
-			return NULL;
-		break;
-	default:
-		errno = EPROTONOSUPPORT;
+	index = get_proto_and_index(ac, av, &proto);
+	if (index == NULL)
 		return NULL;
-	}
 
-	buf = vmalloc(sizeof(*head) + index->l);
+	buf = make_request(ADMIN_DELETE_ALL_SA_DST, proto, index->l);
 	if (buf == NULL)
 		goto out;
 
-	head = (struct admin_com *)buf->v;
-	head->ac_len = buf->l + index->l;
-	head->ac_cmd = ADMIN_DELETE_ALL_SA_DST;
-	head->ac_errno = 0;
-	head->ac_proto = proto;
-
-	memcpy(buf->v+sizeof(*head), index->v, index->l);
+	memcpy(buf->v+sizeof(struct admin_com), index->v, index->l);
 
 out:
 	if (index != NULL)
@@ -646,13 +545,14 @@
 	char **av;
 {
 	vchar_t *buf, *index;
-	struct admin_com *head;
-	int proto;
+	u_int16_t proto;
 	int cmd = ADMIN_ESTABLISH_SA;
 	size_t com_len = 0;
 	char *id = NULL;
 	char *key = NULL;
+	char *remoteconf = NULL;
 	struct admin_com_psk *acp;
+	int wait = 0;
 
 	if (ac < 1)
 		errx(1, "insufficient arguments");
@@ -673,48 +573,57 @@
 		ac -= 2;
 	}
 
-	/* need protocol */
-	if (ac < 1)
-		errx(1, "insufficient arguments");
-	if ((proto = get_proto(*av)) == -1)
-		errx(1, "unknown protocol %s", *av);
-
-	/* get index(es) */
-	av++;
-	ac--;
-	switch (proto) {
-	case ADMIN_PROTO_ISAKMP:
-		index = get_index(ac, av);
-		if (index == NULL)
-			return NULL;
-		break;
-	case ADMIN_PROTO_AH:
-	case ADMIN_PROTO_ESP:
-		index = get_index(ac, av);
-		if (index == NULL)
-			return NULL;
-		break;
-	default:
-		errno = EPROTONOSUPPORT;
-		return NULL;
+	if (ac >= 2 && strcmp(av[0], "-n") == 0) {
+		/* Remoteconf name */
+		remoteconf = av[1];
+		av += 2;
+		ac -= 2;
 	}
 
-	com_len += sizeof(*head) + index->l;
-	if ((buf = vmalloc(com_len)) == NULL)
+	if (ac >= 1 && strcmp(av[0], "-w") == 0) {
+		wait = 1;
+		av++;
+		ac--;
+	}
+
+	index = get_proto_and_index(ac, av, &proto);
+	if (index == NULL)
+		return NULL;
+
+	if (proto == ADMIN_PROTO_ISAKMP && cmd == ADMIN_ESTABLISH_SA &&
+	    remoteconf != NULL)
+		com_len += strlen(remoteconf) + 1;
+
+	if (wait) {
+		switch (proto) {
+		case ADMIN_PROTO_ISAKMP:
+			evt_quit_event = EVT_PHASE1_MODE_CFG;
+			break;
+		case ADMIN_PROTO_AH:
+		case ADMIN_PROTO_ESP:
+			evt_quit_event = EVT_PHASE2_UP;
+			break;
+		default:
+			errno = EPROTONOSUPPORT;
+			return NULL;
+		}
+	}
+
+	com_len += index->l;
+	buf = make_request(cmd, proto, com_len);
+	if (buf == NULL)
 		errx(1, "Cannot allocate buffer");
 
-	head = (struct admin_com *)buf->v;
-	head->ac_len = buf->l;
-	head->ac_cmd = cmd;
-	head->ac_errno = 0;
-	head->ac_proto = proto;
+	memcpy(buf->v+sizeof(struct admin_com), index->v, index->l);
 
-	memcpy(buf->v+sizeof(*head), index->v, index->l);
-
-	if (id && key) {
+	if (proto == ADMIN_PROTO_ISAKMP && cmd == ADMIN_ESTABLISH_SA &&
+	    remoteconf != NULL) {
+		strcpy(buf->v + sizeof(struct admin_com) + index->l,
+		       remoteconf);
+	} else if (id && key) {
 		char *data;
 		acp = (struct admin_com_psk *)
-		    (buf->v + sizeof(*head) + index->l);
+		    (buf->v + sizeof(struct admin_com) + index->l);
 
 		acp->id_type = IDTYPE_USERFQDN;
 		acp->id_len = strlen(id) + 1;
@@ -749,8 +658,7 @@
 	if (ac < 1)
 		errx(1, "insufficient arguments");
 
-	evt_filter = (EVTF_LOOP|EVTF_CFG|EVTF_CFG_STOP|EVTF_ERR|EVTF_ERR_STOP);
-	time(&evt_start);
+	evt_quit_event = EVT_PHASE1_MODE_CFG;
 	
 	/* Optional -u identity */
 	if (strcmp(av[0], "-u") == 0) {
@@ -765,7 +673,7 @@
 	}
 
 	if (ac < 1)
-		errx(1, "VPN gateway required");	
+		errx(1, "VPN gateway required");
 	if (ac > 1)
 		warnx("Extra arguments");
 
@@ -810,12 +718,11 @@
 	char *idx;
 
 	if (ac < 1)
-		errx(1, "VPN gateway required");	
+		errx(1, "VPN gateway required");
 	if (ac > 1)
 		warnx("Extra arguments");
 
-	evt_filter = 
-	    (EVTF_PH1DOWN|EVTF_PH1DOWN_STOP|EVTF_LOOP|EVTF_ERR|EVTF_ERR_STOP);
+	evt_quit_event = EVT_PHASE1_DOWN;
 
 	nav[nac++] = isakmp;
 	nav[nac++] = inet;
@@ -832,7 +739,6 @@
 	char **av;
 {
 	vchar_t *buf;
-	struct admin_com *head;
 	char *user;
 	size_t userlen;
 
@@ -844,22 +750,46 @@
 	if ((user == NULL) || (userlen > LOGINLEN))
 		errx(1, "bad login (too long?)");
 
-	buf = vmalloc(sizeof(*head) + userlen);
+	buf = make_request(ADMIN_LOGOUT_USER, 0, userlen);
 	if (buf == NULL)
 		return NULL;
 
-	head = (struct admin_com *)buf->v;
-	head->ac_len = buf->l;
-	head->ac_cmd = ADMIN_LOGOUT_USER;
-	head->ac_errno = 0;
-	head->ac_proto = 0;
-
-	strncpy((char *)(head + 1), user, userlen);
+	strncpy(buf->v + sizeof(struct admin_com), user, userlen);
 
 	return buf;
 }
 #endif /* ENABLE_HYBRID */
 
+static vchar_t *
+get_proto_and_index(ac, av, proto)
+	int ac;
+	char **av;
+	u_int16_t *proto;
+{
+	vchar_t *index = NULL;
+
+	/* need protocol */
+	if (ac < 1)
+		errx(1, "insufficient arguments");
+	*proto = get_proto(*av);
+	if (*proto == (u_int16_t) -1)
+		errx(1, "unknown protocol %s", *av);
+
+	/* get index(es) */
+	av++;
+	ac--;
+	switch (*proto) {
+	case ADMIN_PROTO_ISAKMP:
+	case ADMIN_PROTO_AH:
+	case ADMIN_PROTO_ESP:
+		index = get_index(ac, av);
+		break;
+	default:
+		errno = EPROTONOSUPPORT;
+		break;
+	}
+	return index;
+}
 
 static int
 get_proto(str)
@@ -1337,84 +1267,32 @@
 
 
 void
-print_evt(buf, len)
-	caddr_t buf;
-	int len;
+print_evt(evtdump)
+	struct evt_async *evtdump;
 {
-	struct evtdump *evtdump = (struct evtdump *)buf;
 	int i;
 	char *srcstr;
 	char *dststr;
 	
-	for (i = 0; evtmsg[i].msg; i++)
-		if (evtmsg[i].type == evtdump->type)
-			break;				
-	
-	if (evtmsg[i].msg == NULL) 
-		printf("Event %d: ", evtdump->type);
+	for (i = 0; i < sizeof(evtmsg) / sizeof(evtmsg[0]); i++)
+		if (evtmsg[i].type == evtdump->ec_type)
+			break;
+
+	if (evtmsg[i].msg == NULL)
+		printf("Event %d: ", evtdump->ec_type);
 	else
 		printf("%s : ", evtmsg[i].msg);
 
-	if ((srcstr = saddr2str((struct sockaddr *)&evtdump->src)) == NULL)
+	if ((srcstr = saddr2str((struct sockaddr *)&evtdump->ec_ph1src)) == NULL)
 		printf("unknown");
-	else 
+	else
 		printf("%s", srcstr);
 	printf(" -> ");
-	if ((dststr = saddr2str((struct sockaddr *)&evtdump->dst)) == NULL)
+	if ((dststr = saddr2str((struct sockaddr *)&evtdump->ec_ph1dst)) == NULL)
 		printf("unknown");
-	else 
+	else
 		printf("%s", dststr);
 	printf("\n");
-
-	return;
-}
-
-void
-print_err(buf, len)
-	caddr_t buf;
-	int len;
-{
-	struct evtdump *evtdump = (struct evtdump *)buf;
-	int i;
-	
-	
-	for (i = 0; evtmsg[i].msg; i++)
-		if (evtmsg[i].type == evtdump->type)
-			break;				
-
-	if (evtmsg[i].level != ERROR)
-		return;
-	
-	if (evtmsg[i].msg == NULL) 
-		printf("Error: Event %d\n", evtdump->type);
-	else
-		printf("Error: %s\n", evtmsg[i].msg);
-
-	if (evt_filter & EVTF_ERR_STOP)
-		evt_filter &= ~EVTF_LOOP;
-
-	return;
-}
-
-/*
- * Print a message when phase 1 SA goes down
- */
-void
-print_ph1down(buf, len)
-	caddr_t buf;
-	int len;
-{
-	struct evtdump *evtdump = (struct evtdump *)buf;
-	
-	if (evtdump->type != EVTT_PHASE1_DOWN)
-		return;
-
-	printf("VPN connexion terminated\n");
-
-	if (evt_filter & EVTF_PH1DOWN_STOP)
-		evt_filter &= ~EVTF_LOOP;
-	
-	return;
 }
 
 /*
@@ -1425,15 +1303,14 @@
 	caddr_t buf;
 	int len;
 {
-	struct evtdump *evtdump = (struct evtdump *)buf;
+	struct evt_async *evtdump = (struct evt_async *)buf;
 	struct isakmp_data *attr;
 	char *banner = NULL;
 	struct in_addr addr4;
 	
 	memset(&addr4, 0, sizeof(addr4));
 
-	if (evtdump->type != EVTT_ISAKMP_CFG_DONE && 
-	    evtdump->type != EVTT_NO_ISAKMP_CFG)
+	if (evtdump->ec_type != EVT_PHASE1_MODE_CFG)
 		return;
 
 	len -= sizeof(*evtdump);
@@ -1486,12 +1363,12 @@
 			    (n + sizeof(*attr) + ntohs(attr->lorv));
 		}
 	}
-	
-	if (evtdump->type == EVTT_ISAKMP_CFG_DONE)
+
+	if (len > 0)
 		printf("Bound to address %s\n", inet_ntoa(addr4));
 	else
 		printf("VPN connexion established\n");
-	
+
 	if (banner) {
 		struct winsize win;
 		int col = 0;
@@ -1508,13 +1385,8 @@
 		printf("\n");
 		racoon_free(banner);
 	}
-	
-	if (evt_filter & EVTF_CFG_STOP)
-		evt_filter &= ~EVTF_LOOP;
-	
-	return;
 }
-	
+
 
 char *
 fixed_addr(addr, port, len)
@@ -1549,49 +1421,54 @@
 handle_recv(combuf)
 	vchar_t *combuf;
 {
-        struct admin_com h, *com;
+        struct admin_com *com;
         caddr_t buf;
         int len;
 
 	com = (struct admin_com *)combuf->v;
-	len = com->ac_len - sizeof(*com);
+	if (com->ac_cmd & ADMIN_FLAG_LONG_REPLY)
+		len = ((u_int32_t)com->ac_len) + (((u_int32_t)com->ac_len_high) << 16);
+	else
+		len = com->ac_len;
+	len -= sizeof(*com);
 	buf = combuf->v + sizeof(*com);
 
-	switch (com->ac_cmd) {
+	switch (com->ac_cmd & ~ADMIN_FLAG_LONG_REPLY) {
 	case ADMIN_SHOW_SCHED:
 		print_schedule(buf, len);
 		break;
 
 	case ADMIN_SHOW_EVT: {
-		struct evtdump *evtdump;
+		struct evt_async *ec;
 
-		/* We got no event */
-		if (len == 0) {
-			/* If we were purging the queue, it is now done */
-			if (evt_filter & EVTF_PURGE)
-				evt_filter &= ~EVTF_PURGE;
+		/* We got no event? */
+		if (len == 0)
 			break;
+
+		if (len < sizeof(struct evt_async))
+			errx(1, "Short buffer\n");
+
+		ec = (struct evt_async *) buf;
+		if (evt_quit_event <= 0)
+			print_evt(ec);
+		else if (evt_quit_event == ec->ec_type) {
+			switch (ec->ec_type) {
+			case EVT_PHASE1_MODE_CFG:
+				print_cfg(ec, len);
+				break;
+			default:
+				print_evt(ec);
+				break;
+			}
+			evt_quit_event = 0;
 		}
-
-		if (len < sizeof(struct evtdump))
-			errx(1, "Short buffer\n");		
-
-		/* Toss outdated events */
-		evtdump = (struct evtdump *)buf;
-		if (evtdump->timestamp < evt_start)
-			break;
-
-		if (evt_filter & EVTF_ALL)
-			print_evt(buf, len);
-		if (evt_filter & EVTF_ERR)
-			print_err(buf, len);
-		if (evt_filter & EVTF_CFG)
-			print_cfg(buf, len);
-		if (evt_filter & EVTF_PH1DOWN)
-			print_ph1down(buf, len);
 		break;
 	}
 
+	case ADMIN_GET_SA_CERT:
+		fwrite(buf, len, 1, stdout);
+		break;
+
 	case ADMIN_SHOW_SA:
 	   {
 		switch (com->ac_proto) {
@@ -1645,10 +1522,8 @@
 		break;
 	}
 
-	close(so);
 	return 0;
 
-    bad:
-	close(so);
+bad:
 	return -1;
 }
diff --git a/src/racoon/remoteconf.c b/src/racoon/remoteconf.c
index c9c803f..74e386c 100644
--- a/src/racoon/remoteconf.c
+++ b/src/racoon/remoteconf.c
@@ -1,11 +1,11 @@
-/*	$NetBSD: remoteconf.c,v 1.9.4.2 2008/06/18 07:30:19 mgrooms Exp $	*/
+/*	$NetBSD: remoteconf.c,v 1.26 2011/03/14 15:50:36 vanhu Exp $	*/
 
 /* Id: remoteconf.c,v 1.38 2006/05/06 15:52:44 manubsd Exp */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -17,7 +17,7 @@
  * 3. Neither the name of the project nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -63,6 +63,7 @@
 #endif
 #include "isakmp.h"
 #include "ipsec_doi.h"
+#include "crypto_openssl.h"
 #include "oakley.h"
 #include "remoteconf.h"
 #include "localconf.h"
@@ -75,16 +76,307 @@
 #include "algorithm.h"
 #include "nattraversal.h"
 #include "isakmp_frag.h"
+#include "handler.h"
 #include "genlist.h"
+#include "rsalist.h"
 
-static TAILQ_HEAD(_rmtree, remoteconf) rmtree, rmtree_save, rmtree_tmp;
+typedef TAILQ_HEAD(_rmtree, remoteconf) remoteconf_tailq_head_t;
+static remoteconf_tailq_head_t rmtree, rmtree_save;
 
-/* 
+/*
  * Script hook names and script hook paths
  */
-char *script_names[SCRIPT_MAX + 1] = { "phase1_up", "phase1_down" };
+char *script_names[SCRIPT_MAX + 1] = {
+	"phase1_up", "phase1_down", "phase1_dead" };
 
 /*%%%*/
+
+int
+rmconf_match_identity(rmconf, id_p)
+	struct remoteconf *rmconf;
+	vchar_t *id_p;
+{
+	struct ipsecdoi_id_b *id_b = (struct ipsecdoi_id_b *) id_p->v;
+	struct sockaddr *sa;
+	caddr_t sa1, sa2;
+	vchar_t ident;
+	struct idspec *id;
+	struct genlist_entry *gpb;
+
+	/* compare with the ID if specified. */
+	if (!genlist_next(rmconf->idvl_p, 0))
+		return 0;
+
+	for (id = genlist_next(rmconf->idvl_p, &gpb); id; id = genlist_next(0, &gpb)) {
+		/* No ID specified in configuration, so it is ok */
+		if (id->id == 0)
+			return 0;
+
+		/* check the type of both IDs */
+		if (id->idtype != doi2idtype(id_b->type))
+			continue;  /* ID type mismatch */
+
+		/* compare defined ID with the ID sent by peer. */
+		switch (id->idtype) {
+		case IDTYPE_ASN1DN:
+			ident.v = id_p->v + sizeof(*id_b);
+			ident.l = id_p->l - sizeof(*id_b);
+			if (eay_cmp_asn1dn(id->id, &ident) == 0)
+				return 0;
+			break;
+		case IDTYPE_ADDRESS:
+			sa = (struct sockaddr *)id->id->v;
+			sa2 = (caddr_t)(id_b + 1);
+			switch (sa->sa_family) {
+			case AF_INET:
+				if (id_p->l - sizeof(*id_b) != sizeof(struct in_addr))
+					continue;  /* ID value mismatch */
+				sa1 = (caddr_t) &((struct sockaddr_in *)sa)->sin_addr;
+				if (memcmp(sa1, sa2, sizeof(struct in_addr)) == 0)
+					return 0;
+				break;
+#ifdef INET6
+			case AF_INET6:
+				if (id_p->l - sizeof(*id_b) != sizeof(struct in6_addr))
+					continue;  /* ID value mismatch */
+				sa1 = (caddr_t) &((struct sockaddr_in6 *)sa)->sin6_addr;
+				if (memcmp(sa1, sa2, sizeof(struct in6_addr)) == 0)
+					return 0;
+				break;
+#endif
+			default:
+				break;
+			}
+			break;
+		default:
+			if (memcmp(id->id->v, id_b + 1, id->id->l) == 0)
+				return 0;
+			break;
+		}
+	}
+
+	plog(LLV_WARNING, LOCATION, NULL, "No ID match.\n");
+	if (rmconf->verify_identifier)
+		return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
+
+	return 0;
+}
+
+static int
+rmconf_match_etype_and_approval(rmconf, etype, approval)
+	struct remoteconf *rmconf;
+	int etype;
+	struct isakmpsa *approval;
+{
+	struct isakmpsa *p;
+
+	if (check_etypeok(rmconf, (void *) (intptr_t) etype) == 0)
+		return ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN;
+
+	if (approval == NULL)
+		return 0;
+
+	if (etype == ISAKMP_ETYPE_AGG &&
+	    approval->dh_group != rmconf->dh_group)
+		return ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN;
+
+	if (checkisakmpsa(rmconf->pcheck_level, approval,
+			  rmconf->proposal) == NULL)
+		return ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN;
+
+	return 0;
+}
+
+enum rmconf_match_t {
+	MATCH_NONE		= 0,
+	MATCH_BASIC		= 0x0000001,
+	MATCH_ADDRESS		= 0x0000002,
+	MATCH_SA		= 0x0000004,
+	MATCH_IDENTITY		= 0x0000008,
+	MATCH_AUTH_IDENTITY	= 0x0000010,
+};
+
+static int
+rmconf_match_type(rmsel, rmconf)
+	struct rmconfselector *rmsel;
+	struct remoteconf *rmconf;
+{
+	int ret = MATCH_NONE, tmp;
+
+	/* No match at all: unwanted anonymous */
+	if ((rmsel->flags & GETRMCONF_F_NO_ANONYMOUS) &&
+	    rmconf->remote->sa_family == AF_UNSPEC){
+		plog(LLV_DEBUG2, LOCATION, rmsel->remote,
+		     "Not matched: Anonymous conf.\n");
+		return MATCH_NONE;
+	}
+
+	if ((rmsel->flags & GETRMCONF_F_NO_PASSIVE) && rmconf->passive){
+		plog(LLV_DEBUG2, LOCATION, rmsel->remote,
+		     "Not matched: passive conf.\n");
+		return MATCH_NONE;
+	}
+
+	ret |= MATCH_BASIC;
+
+	/* Check address */
+	if (rmsel->remote != NULL) {
+		if (rmconf->remote->sa_family != AF_UNSPEC) {
+			if (cmpsaddr(rmsel->remote, rmconf->remote) == CMPSADDR_MISMATCH){
+				plog(LLV_DEBUG2, LOCATION, rmsel->remote,
+				     "Not matched: address mismatch.\n");
+				return MATCH_NONE;
+			}
+
+			/* Address matched */
+			ret |= MATCH_ADDRESS;
+		}
+	}
+
+	/* Check etype and approval */
+	if (rmsel->etype != ISAKMP_ETYPE_NONE) {
+		tmp=rmconf_match_etype_and_approval(rmconf, rmsel->etype,
+						    rmsel->approval);
+		if (tmp != 0){
+			plog(LLV_DEBUG2, LOCATION, rmsel->remote,
+			     "Not matched: etype (%d)/approval mismatch (%d).\n", rmsel->etype, tmp);
+			return MATCH_NONE;
+		}
+		ret |= MATCH_SA;
+	}
+
+	/* Check identity */
+	if (rmsel->identity != NULL && rmconf->verify_identifier) {
+		if (rmconf_match_identity(rmconf, rmsel->identity) != 0){
+			plog(LLV_DEBUG2, LOCATION, rmsel->remote,
+			     "Not matched: identity mismatch.\n");
+			return MATCH_NONE;
+		}
+		ret |= MATCH_IDENTITY;
+	}
+
+	/* Check certificate request */
+	if (rmsel->certificate_request != NULL) {
+		if (oakley_get_certtype(rmsel->certificate_request) !=
+		    oakley_get_certtype(rmconf->mycert)){
+			plog(LLV_DEBUG2, LOCATION, rmsel->remote,
+			     "Not matched: cert type mismatch.\n");
+			return MATCH_NONE;
+		}
+
+		if (rmsel->certificate_request->l > 1) {
+			vchar_t *issuer;
+
+			issuer = eay_get_x509asn1issuername(rmconf->mycert);
+			if (rmsel->certificate_request->l - 1 != issuer->l ||
+			    memcmp(rmsel->certificate_request->v + 1,
+				   issuer->v, issuer->l) != 0) {
+				vfree(issuer);
+				plog(LLV_DEBUG2, LOCATION, rmsel->remote,
+				     "Not matched: cert issuer mismatch.\n");
+				return MATCH_NONE;
+			}
+			vfree(issuer);
+		} else {
+			if (!rmconf->match_empty_cr){
+				plog(LLV_DEBUG2, LOCATION, rmsel->remote,
+				     "Not matched: empty certificate request.\n");
+				return MATCH_NONE;
+			}
+		}
+
+		ret |= MATCH_AUTH_IDENTITY;
+	}
+
+	return ret;
+}
+
+void rmconf_selector_from_ph1(rmsel, iph1)
+	struct rmconfselector *rmsel;
+	struct ph1handle *iph1;
+{
+	memset(rmsel, 0, sizeof(*rmsel));
+	rmsel->flags = 0;
+	rmsel->remote = iph1->remote;
+	rmsel->etype = iph1->etype;
+	rmsel->approval = iph1->approval;
+	rmsel->identity = iph1->id_p;
+	rmsel->certificate_request = iph1->cr_p;
+}
+
+int
+enumrmconf(rmsel, enum_func, enum_arg)
+	struct rmconfselector *rmsel;
+	int (* enum_func)(struct remoteconf *rmconf, void *arg);
+	void *enum_arg;
+{
+	struct remoteconf *p;
+	int ret = 0;
+
+	RACOON_TAILQ_FOREACH_REVERSE(p, &rmtree, _rmtree, chain) {
+		plog(LLV_DEBUG2, LOCATION, rmsel->remote,
+		     "Checking remote conf \"%s\" %s.\n", p->name,
+		     p->remote->sa_family == AF_UNSPEC ?
+		     "anonymous" : saddr2str(p->remote));
+
+		if (rmsel != NULL) {
+			if (rmconf_match_type(rmsel, p) == MATCH_NONE){
+				plog(LLV_DEBUG2, LOCATION, rmsel->remote,
+				     "Not matched.\n");
+				continue;
+			}
+		}
+
+		plog(LLV_DEBUG2, LOCATION, NULL,
+		     "enumrmconf: \"%s\" matches.\n", p->name);
+
+		ret = (*enum_func)(p, enum_arg);
+		if (ret)
+			break;
+	}
+
+	return ret;
+}
+
+struct rmconf_find_context {
+	struct rmconfselector sel;
+
+	struct remoteconf *rmconf;
+	int match_type;
+	int num_found;
+};
+
+static int
+rmconf_find(rmconf, ctx)
+	struct remoteconf *rmconf;
+	void *ctx;
+{
+	struct rmconf_find_context *fctx = (struct rmconf_find_context *) ctx;
+	int match_type;
+
+	/* First matching remote conf? */
+	match_type = rmconf_match_type(&fctx->sel, rmconf);
+
+	if (fctx->rmconf != NULL) {
+		/* More ambiguous matches are ignored. */
+		if (match_type < fctx->match_type)
+			return 0;
+
+		if (match_type == fctx->match_type) {
+			/* Ambiguous match */
+			fctx->num_found++;
+			return 0;
+		}
+	}
+
+	/* More exact match found */
+	fctx->match_type = match_type;
+	fctx->num_found = 1;
+	fctx->rmconf = rmconf;
+
+	return 0;
+}
+
 /*
  * search remote configuration.
  * don't use port number to search if its value is either IPSEC_PORT_ANY.
@@ -93,76 +385,110 @@
  * OUT:	NULL:	NG
  *	Other:	remote configuration entry.
  */
+
 struct remoteconf *
-getrmconf_strict(remote, allow_anon)
+getrmconf(remote, flags)
 	struct sockaddr *remote;
-	int allow_anon;
+	int flags;
 {
-	struct remoteconf *p;
-	struct remoteconf *anon = NULL;
-	int withport;
-	char buf[NI_MAXHOST + NI_MAXSERV + 10];
-	char addr[NI_MAXHOST], port[NI_MAXSERV];
+	struct rmconf_find_context ctx;
+	int n = 0;
 
-	withport = 0;
+	memset(&ctx, 0, sizeof(ctx));
+	ctx.sel.flags = flags;
+	ctx.sel.remote = remote;
 
-#ifndef ENABLE_NATT
-	/* 
-	 * We never have ports set in our remote configurations, but when
-	 * NAT-T is enabled, the kernel can have policies with ports and
-	 * send us an acquire message for a destination that has a port set.
-	 * If we do this port check here, we don't find the remote config.
-	 *
-	 * In an ideal world, we would be able to have remote conf with
-	 * port, and the port could be a wildcard. That test could be used.
-	 */
-	if (remote->sa_family != AF_UNSPEC &&
-	    extract_port(remote) != IPSEC_PORT_ANY)
-		withport = 1;
-#endif /* ENABLE_NATT */
-
-	if (remote->sa_family == AF_UNSPEC)
-		snprintf (buf, sizeof(buf), "%s", "anonymous");
-	else {
-		GETNAMEINFO(remote, addr, port);
-		snprintf(buf, sizeof(buf), "%s%s%s%s", addr,
-			withport ? "[" : "",
-			withport ? port : "",
-			withport ? "]" : "");
+	if (enumrmconf(&ctx.sel, rmconf_find, &ctx) != 0) {
+		plog(LLV_ERROR, LOCATION, remote,
+		     "multiple exact configurations.\n");
+		return NULL;
 	}
 
-	TAILQ_FOREACH(p, &rmtree, chain) {
-		if ((remote->sa_family == AF_UNSPEC
-		     && remote->sa_family == p->remote->sa_family)
-		 || (!withport && cmpsaddrwop(remote, p->remote) == 0)
-		 || (withport && cmpsaddrstrict(remote, p->remote) == 0)) {
-			plog(LLV_DEBUG, LOCATION, NULL,
-				"configuration found for %s.\n", buf);
-			return p;
-		}
-
-		/* save the pointer to the anonymous configuration */
-		if (p->remote->sa_family == AF_UNSPEC)
-			anon = p;
+	if (ctx.rmconf == NULL) {
+		plog(LLV_DEBUG, LOCATION, remote,
+		     "no remote configuration found.\n");
+		return NULL;
 	}
 
-	if (allow_anon && anon != NULL) {
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"anonymous configuration selected for %s.\n", buf);
-		return anon;
+	if (ctx.num_found != 1) {
+		plog(LLV_DEBUG, LOCATION, remote,
+		     "multiple non-exact configurations found.\n");
+		return NULL;
 	}
 
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"no remote configuration found.\n");
+	plog(LLV_DEBUG, LOCATION, remote,
+	     "configuration \"%s\" selected.\n",
+	     ctx.rmconf->name);
 
-	return NULL;
+	return ctx.rmconf;
 }
 
 struct remoteconf *
-getrmconf(remote)
-	struct sockaddr *remote;
+getrmconf_by_ph1(iph1)
+	struct ph1handle *iph1;
 {
-	return getrmconf_strict(remote, 1);
+	struct rmconf_find_context ctx;
+
+	memset(&ctx, 0, sizeof(ctx));
+	rmconf_selector_from_ph1(&ctx.sel, iph1);
+	if (loglevel >= LLV_DEBUG) {
+		char *idstr = NULL;
+
+		if (iph1->id_p != NULL)
+			idstr = ipsecdoi_id2str(iph1->id_p);
+
+		plog(LLV_DEBUG, LOCATION, iph1->remote,
+			"getrmconf_by_ph1: remote %s, identity %s.\n",
+			saddr2str(iph1->remote), idstr ? idstr : "<any>");
+
+		if (idstr)
+			racoon_free(idstr);
+	}
+
+	if (enumrmconf(&ctx.sel, rmconf_find, &ctx) != 0) {
+		plog(LLV_ERROR, LOCATION, iph1->remote,
+		     "multiple exact configurations.\n");
+		return RMCONF_ERR_MULTIPLE;
+	}
+
+	if (ctx.rmconf == NULL) {
+		plog(LLV_DEBUG, LOCATION, iph1->remote,
+		     "no remote configuration found\n");
+		return NULL;
+	}
+
+	if (ctx.num_found != 1) {
+		plog(LLV_DEBUG, LOCATION, iph1->remote,
+		     "multiple non-exact configurations found.\n");
+		return RMCONF_ERR_MULTIPLE;
+	}
+
+	plog(LLV_DEBUG, LOCATION, iph1->remote,
+	     "configuration \"%s\" selected.\n",
+	     ctx.rmconf->name);
+
+	return ctx.rmconf;
+}
+
+struct remoteconf *
+getrmconf_by_name(name)
+	const char *name;
+{
+	struct remoteconf *p;
+
+	plog(LLV_DEBUG, LOCATION, NULL,
+	     "getrmconf_by_name: remote \"%s\".\n",
+	     name);
+
+	RACOON_TAILQ_FOREACH_REVERSE(p, &rmtree, _rmtree, chain) {
+		if (p->name == NULL)
+			continue;
+
+		if (strcmp(name, p->name) == 0)
+			return p;
+	}
+
+	return NULL;
 }
 
 struct remoteconf *
@@ -191,19 +517,14 @@
 	new->pcheck_level = PROP_CHECK_STRICT;
 	new->verify_identifier = FALSE;
 	new->verify_cert = TRUE;
-	new->getcert_method = ISAKMP_GETCERT_PAYLOAD;
-	new->getcacert_method = ISAKMP_GETCERT_LOCALFILE;
-	new->cacerttype = ISAKMP_CERT_X509SIGN;
-	new->certtype = ISAKMP_CERT_NONE;
 	new->cacertfile = NULL;
 	new->send_cert = TRUE;
 	new->send_cr = TRUE;
+	new->match_empty_cr = FALSE;
 	new->support_proxy = FALSE;
 	for (i = 0; i <= SCRIPT_MAX; i++)
 		new->script[i] = NULL;
 	new->gen_policy = FALSE;
-	new->retry_counter = lcconf->retry_counter;
-	new->retry_interval = lcconf->retry_interval;
 	new->nat_traversal = FALSE;
 	new->rsa_private = genlist_init();
 	new->rsa_public = genlist_init();
@@ -215,34 +536,21 @@
 	new->dpd_retry = 5;
 	new->dpd_maxfails = 5;
 
+	new->rekey = REKEY_ON;
+
 	new->weak_phase1_check = 0;
 
 #ifdef ENABLE_HYBRID
 	new->xauth = NULL;
 #endif
 
-	return new;
-}
-
-struct remoteconf *
-copyrmconf(remote)
-	struct sockaddr *remote;
-{
-	struct remoteconf *new, *old;
-
-	old = getrmconf_strict (remote, 0);
-	if (old == NULL) {
-		plog (LLV_ERROR, LOCATION, NULL,
-		      "Remote configuration for '%s' not found!\n",
-		      saddr2str (remote));
-		return NULL;
-	}
-
-	new = duprmconf (old);
+	new->lifetime = oakley_get_defaultlifetime();
 
 	return new;
 }
 
+#ifndef ANDROID_PATCHED
+
 void *
 dupidvl(entry, arg)
 	void *entry;
@@ -264,29 +572,147 @@
 	return NULL;
 }
 
+void *
+duprsa(entry, arg)
+	void *entry;
+	void *arg;
+{
+	struct rsa_key *new;
+
+	new = rsa_key_dup((struct rsa_key *)entry);
+	if (new == NULL)
+		return (void *) -1;
+	genlist_append(arg, new);
+
+	/* keep genlist_foreach going */
+	return NULL;
+}
+
+/* Creates shallow copy of a remote config. Used for "inherit" keyword. */
 struct remoteconf *
-duprmconf (rmconf)
+duprmconf_shallow (rmconf)
 	struct remoteconf *rmconf;
 {
 	struct remoteconf *new;
+	struct proposalspec *prspec;
 
 	new = racoon_calloc(1, sizeof(*new));
 	if (new == NULL)
 		return NULL;
-	memcpy (new, rmconf, sizeof (*new));
-	// FIXME: We should duplicate the proposal as well.
-	// This is now handled in the cfparse.y
-	// new->proposal = ...;
-	
-	/* duplicate dynamic structures */
-	if (new->etypes)
-		new->etypes=dupetypes(new->etypes);
-	new->idvl_p = genlist_init();
-	genlist_foreach(rmconf->idvl_p, dupidvl, new->idvl_p);
+
+	memcpy(new, rmconf, sizeof(*new));
+	new->name = NULL;
+	new->inherited_from = rmconf;
+
+	new->proposal = NULL; /* will be filled by set_isakmp_proposal() */
 
 	return new;
 }
 
+/* Copies pointer structures of an inherited remote config. 
+ * Used by "inherit" mechanism in a two step copy method, necessary to
+ * prevent both double free() and memory leak during config reload.
+ */
+int
+duprmconf_finish (new)
+	struct remoteconf *new;
+{
+	struct remoteconf *rmconf;
+	int i;
+
+	if (new->inherited_from == NULL)
+		return 0; /* nothing todo, no inheritance */
+
+	rmconf = new->inherited_from;
+
+	/* duplicate dynamic structures unless value overridden */
+	if (new->etypes != NULL && new->etypes == rmconf->etypes)
+		new->etypes = dupetypes(new->etypes);
+	if (new->idvl_p == rmconf->idvl_p) {
+		new->idvl_p = genlist_init();
+		genlist_foreach(rmconf->idvl_p, dupidvl, new->idvl_p);
+	}
+
+	if (new->rsa_private == rmconf->rsa_private) {
+		new->rsa_private = genlist_init();
+		genlist_foreach(rmconf->rsa_private, duprsa, new->rsa_private);
+	}
+	if (new->rsa_public == rmconf->rsa_public) {
+		new->rsa_public = genlist_init();
+		genlist_foreach(rmconf->rsa_public, duprsa, new->rsa_public);
+	}
+	if (new->remote != NULL && new->remote == rmconf->remote) {
+		new->remote = racoon_malloc(sizeof(*new->remote));
+		if (new->remote == NULL) {
+			plog(LLV_ERROR, LOCATION, NULL, 
+			    "duprmconf_finish: malloc failed (remote)\n");
+			exit(1);
+		}
+		memcpy(new->remote, rmconf->remote, sizeof(*new->remote));
+	}
+	if (new->spspec != NULL && new->spspec == rmconf->spspec) {
+		dupspspec_list(new, rmconf);
+	}
+
+	/* proposal has been deep copied already from spspec's, see
+	 * cfparse.y:set_isakmp_proposal, which in turn calls
+	 * cfparse.y:expand_isakmpspec where the copying happens.
+	 */
+
+#ifdef ENABLE_HYBRID
+	if (new->xauth != NULL && new->xauth == rmconf->xauth) {
+		new->xauth = xauth_rmconf_dup(new->xauth);
+		if (new->xauth == NULL)
+			exit(1);
+	}
+#endif
+
+        /* duplicate strings unless value overridden */ 
+	if (new->mycertfile != NULL && new->mycertfile == rmconf->mycertfile) { 
+		new->mycertfile = racoon_strdup(new->mycertfile); 
+		STRDUP_FATAL(new->mycertfile); 
+	} 
+	if (new->myprivfile != NULL && new->myprivfile == rmconf->myprivfile) { 
+		new->myprivfile = racoon_strdup(new->myprivfile); 
+		STRDUP_FATAL(new->myprivfile); 
+	} 
+	if (new->peerscertfile != NULL && new->peerscertfile == rmconf->peerscertfile) { 
+		new->peerscertfile = racoon_strdup(new->peerscertfile); 
+		STRDUP_FATAL(new->peerscertfile); 
+	} 
+	if (new->cacertfile != NULL && new->cacertfile == rmconf->cacertfile) { 
+		new->cacertfile = racoon_strdup(new->cacertfile); 
+		STRDUP_FATAL(new->cacertfile); 
+	} 
+	if (new->idv != NULL && new->idv == rmconf->idv) {
+		new->idv = vdup(new->idv); 
+		STRDUP_FATAL(new->idv); 
+	}
+	if (new->key != NULL && new->key == rmconf->key) {
+		new->key = vdup(new->key); 
+		STRDUP_FATAL(new->key); 
+	}
+	if (new->mycert != NULL && new->mycert == rmconf->mycert) {
+		new->mycert = vdup(new->mycert);
+		STRDUP_FATAL(new->mycert); 
+	}
+	if (new->peerscert != NULL && new->peerscert == rmconf->peerscert) {
+		new->peerscert = vdup(new->peerscert);
+		STRDUP_FATAL(new->peerscert); 
+	}
+	if (new->cacert != NULL && new->cacert == rmconf->cacert) {
+		new->cacert = vdup(new->cacert);
+		STRDUP_FATAL(new->cacert); 
+	}
+	for (i = 0; i <= SCRIPT_MAX; i++)
+		if (new->script[i] != NULL && new->script[i] == rmconf->script[i]) {
+			new->script[i] = vdup(new->script[i]);
+			STRDUP_FATAL(new->script[i]);
+		}
+
+	return 0;
+}
+
 static void
 idspec_free(void *data)
 {
@@ -298,6 +724,8 @@
 delrmconf(rmconf)
 	struct remoteconf *rmconf;
 {
+	int i;
+
 #ifdef ENABLE_HYBRID
 	if (rmconf->xauth)
 		xauth_rmconf_delete(&rmconf->xauth);
@@ -306,15 +734,55 @@
 		deletypes(rmconf->etypes);
 		rmconf->etypes=NULL;
 	}
+	if (rmconf->idv)
+		vfree(rmconf->idv);
+	if (rmconf->key)
+		vfree(rmconf->key);
 	if (rmconf->idvl_p)
 		genlist_free(rmconf->idvl_p, idspec_free);
 	if (rmconf->dhgrp)
 		oakley_dhgrp_free(rmconf->dhgrp);
 	if (rmconf->proposal)
 		delisakmpsa(rmconf->proposal);
+	flushspspec(rmconf);
+	if (rmconf->mycert)
+		vfree(rmconf->mycert);
+	if (rmconf->mycertfile)
+		racoon_free(rmconf->mycertfile);
+	if (rmconf->myprivfile)
+		racoon_free(rmconf->myprivfile);
+	if (rmconf->peerscert)
+		vfree(rmconf->peerscert);
+	if (rmconf->peerscertfile)
+		racoon_free(rmconf->peerscertfile);
+	if (rmconf->cacert)
+		vfree(rmconf->cacert);
+	if (rmconf->cacertfile)
+		racoon_free(rmconf->cacertfile);
+	if (rmconf->rsa_private)
+		genlist_free(rmconf->rsa_private, rsa_key_free);
+	if (rmconf->rsa_public)
+		genlist_free(rmconf->rsa_public, rsa_key_free);
+	if (rmconf->name)
+		racoon_free(rmconf->name);
+	if (rmconf->remote)
+		racoon_free(rmconf->remote);
+	for (i = 0; i <= SCRIPT_MAX; i++)
+		if (rmconf->script[i])
+			vfree(rmconf->script[i]);
+
 	racoon_free(rmconf);
 }
 
+#else
+
+void delrmconf(struct remoteconf *rmconf)
+{
+        exit(1);
+}
+
+#endif
+
 void
 delisakmpsa(sa)
 	struct isakmpsa *sa;
@@ -336,11 +804,11 @@
 {
 	struct etypes *new;
 
-	if (!orig) 
+	if (!orig)
 		return NULL;
 
 	new = racoon_malloc(sizeof(struct etypes));
-	if (new == NULL) 
+	if (new == NULL)
 		return NULL;
 
 	new->type = orig->type;
@@ -368,6 +836,14 @@
 insrmconf(new)
 	struct remoteconf *new;
 {
+	if (new->name == NULL) {
+		new->name = racoon_strdup(saddr2str(new->remote));
+	}
+	if (new->remote == NULL) {
+		new->remote = newsaddr(sizeof(struct sockaddr));
+		new->remote->sa_family = AF_UNSPEC;
+	}
+
 	TAILQ_INSERT_HEAD(&rmtree, new, chain);
 }
 
@@ -397,15 +873,17 @@
 }
 
 void
-save_rmconf()
+rmconf_start_reload()
 {
 	rmtree_save=rmtree;
 	initrmconf();
 }
 
 void
-save_rmconf_flush()
+rmconf_finish_reload()
 {
+	remoteconf_tailq_head_t rmtree_tmp;
+
 	rmtree_tmp=rmtree;
 	rmtree=rmtree_save;
 	flushrmconf();
@@ -416,19 +894,22 @@
 
 
 /* check exchange type to be acceptable */
-struct etypes *
-check_etypeok(rmconf, etype)
+int
+check_etypeok(rmconf, ctx)
 	struct remoteconf *rmconf;
-	u_int8_t etype;
+	void *ctx;
 {
+	u_int8_t etype = (u_int8_t) (intptr_t) ctx;
 	struct etypes *e;
 
 	for (e = rmconf->etypes; e != NULL; e = e->next) {
 		if (e->type == etype)
-			break;
+			return 1;
+		plog(LLV_DEBUG2, LOCATION, NULL,
+		     "Etype mismatch: got %d, expected %d.\n", e->type, etype);
 	}
 
-	return e;
+	return 0;
 }
 
 /*%%%*/
@@ -448,7 +929,6 @@
 	new->vendorid = VENDORID_UNKNOWN;
 
 	new->next = NULL;
-	new->rmconf = NULL;
 #ifdef HAVE_GSSAPI
 	new->gssid = NULL;
 #endif
@@ -466,8 +946,6 @@
 {
 	struct isakmpsa *p;
 
-	new->rmconf = rmconf;
-
 	if (rmconf->proposal == NULL) {
 		rmconf->proposal = new;
 		return;
@@ -476,21 +954,6 @@
 	for (p = rmconf->proposal; p->next != NULL; p = p->next)
 		;
 	p->next = new;
-
-	return;
-}
-
-struct remoteconf *
-foreachrmconf(rmconf_func_t rmconf_func, void *data)
-{
-  struct remoteconf *p, *ret = NULL;
-  RACOON_TAILQ_FOREACH_REVERSE(p, &rmtree, _rmtree, chain) {
-    ret = (*rmconf_func)(p, data);
-    if (ret)
-      break;
-  }
-
-  return ret;
 }
 
 static void *
@@ -507,7 +970,7 @@
 	return NULL;
 }
 
-static struct remoteconf *
+static int
 dump_rmconf_single (struct remoteconf *p, void *data)
 {
 	struct etypes *etype = p->etypes;
@@ -515,10 +978,11 @@
 	char buf[1024], *pbuf;
 
 	pbuf = buf;
-	pbuf += sprintf(pbuf, "remote %s", saddr2str(p->remote));
+
+	pbuf += sprintf(pbuf, "remote \"%s\"", p->name);
 	if (p->inherited_from)
-		pbuf += sprintf(pbuf, " inherit %s",
-				saddr2str(p->inherited_from->remote));
+		pbuf += sprintf(pbuf, " inherit \"%s\"",
+				p->inherited_from->name);
 	plog(LLV_INFO, LOCATION, NULL, "%s {\n", buf);
 	pbuf = buf;
 	pbuf += sprintf(pbuf, "\texchange_type ");
@@ -533,23 +997,30 @@
 	pbuf += sprintf(pbuf, "\tmy_identifier %s", s_idtype (p->idvtype));
 	if (p->idvtype == IDTYPE_ASN1DN) {
 		plog(LLV_INFO, LOCATION, NULL, "%s;\n", buf);
-		plog(LLV_INFO, LOCATION, NULL, "\tcertificate_type %s \"%s\" \"%s\";\n",
-			p->certtype == ISAKMP_CERT_X509SIGN ? "x509" : "*UNKNOWN*",
-			p->mycertfile, p->myprivfile);
-		switch (p->getcert_method) {
-		  case 0:
-		  	break;
-		  case ISAKMP_GETCERT_PAYLOAD:
-			plog(LLV_INFO, LOCATION, NULL, "\t/* peers certificate from payload */\n");
+		plog(LLV_INFO, LOCATION, NULL,
+		     "\tcertificate_type %s \"%s\" \"%s\";\n",
+		     oakley_get_certtype(p->mycert) == ISAKMP_CERT_X509SIGN
+		       ? "x509" : "*UNKNOWN*",
+		     p->mycertfile, p->myprivfile);
+
+		switch (oakley_get_certtype(p->peerscert)) {
+		case ISAKMP_CERT_NONE:
+			plog(LLV_INFO, LOCATION, NULL,
+			     "\t/* peers certificate from payload */\n");
 			break;
-		  case ISAKMP_GETCERT_LOCALFILE:
-			plog(LLV_INFO, LOCATION, NULL, "\tpeers_certfile \"%s\";\n", p->peerscertfile);
+		case ISAKMP_CERT_X509SIGN:
+			plog(LLV_INFO, LOCATION, NULL,
+			     "\tpeers_certfile \"%s\";\n", p->peerscertfile);
 			break;
-		  case ISAKMP_GETCERT_DNS:
-			plog(LLV_INFO, LOCATION, NULL, "\tpeer_certfile dnssec;\n");
+		case ISAKMP_CERT_DNS:
+			plog(LLV_INFO, LOCATION, NULL,
+			     "\tpeers_certfile dnssec;\n");
 			break;
-		  default:
-			plog(LLV_INFO, LOCATION, NULL, "\tpeers_certfile *UNKNOWN* (%d)\n", p->getcert_method);
+		default:
+			plog(LLV_INFO, LOCATION, NULL,
+			     "\tpeers_certfile *UNKNOWN* (%d)\n",
+			     oakley_get_certtype(p->peerscert));
+			break;
 		}
 	}
 	else {
@@ -559,10 +1030,14 @@
 		genlist_foreach(p->idvl_p, &dump_peers_identifiers, NULL);
 	}
 
+	plog(LLV_INFO, LOCATION, NULL, "\trekey %s;\n",
+		p->rekey == REKEY_FORCE ? "force" : s_switch (p->rekey));
 	plog(LLV_INFO, LOCATION, NULL, "\tsend_cert %s;\n",
 		s_switch (p->send_cert));
 	plog(LLV_INFO, LOCATION, NULL, "\tsend_cr %s;\n",
 		s_switch (p->send_cr));
+	plog(LLV_INFO, LOCATION, NULL, "\tmatch_empty_cr %s;\n",
+		s_switch (p->match_empty_cr));
 	plog(LLV_INFO, LOCATION, NULL, "\tverify_cert %s;\n",
 		s_switch (p->verify_cert));
 	plog(LLV_INFO, LOCATION, NULL, "\tverify_identifier %s;\n",
@@ -588,9 +1063,8 @@
 	while (prop) {
 		plog(LLV_INFO, LOCATION, NULL, "\n");
 		plog(LLV_INFO, LOCATION, NULL,
-			"\t/* prop_no=%d, trns_no=%d, rmconf=%s */\n",
-			prop->prop_no, prop->trns_no,
-			saddr2str(prop->rmconf->remote));
+			"\t/* prop_no=%d, trns_no=%d */\n",
+			prop->prop_no, prop->trns_no);
 		plog(LLV_INFO, LOCATION, NULL, "\tproposal {\n");
 		plog(LLV_INFO, LOCATION, NULL, "\t\tlifetime time %lu sec;\n",
 			(long)prop->lifetime);
@@ -598,11 +1072,11 @@
 			prop->lifebyte);
 		plog(LLV_INFO, LOCATION, NULL, "\t\tdh_group %s;\n",
 			alg_oakley_dhdef_name(prop->dh_group));
-		plog(LLV_INFO, LOCATION, NULL, "\t\tencryption_algorithm %s;\n", 
+		plog(LLV_INFO, LOCATION, NULL, "\t\tencryption_algorithm %s;\n",
 			alg_oakley_encdef_name(prop->enctype));
-		plog(LLV_INFO, LOCATION, NULL, "\t\thash_algorithm %s;\n", 
+		plog(LLV_INFO, LOCATION, NULL, "\t\thash_algorithm %s;\n",
 			alg_oakley_hashdef_name(prop->hashtype));
-		plog(LLV_INFO, LOCATION, NULL, "\t\tauthentication_method %s;\n", 
+		plog(LLV_INFO, LOCATION, NULL, "\t\tauthentication_method %s;\n",
 			alg_oakley_authdef_name(prop->authmethod));
 		plog(LLV_INFO, LOCATION, NULL, "\t}\n");
 		prop = prop->next;
@@ -610,13 +1084,13 @@
 	plog(LLV_INFO, LOCATION, NULL, "}\n");
 	plog(LLV_INFO, LOCATION, NULL, "\n");
 
-	return NULL;
+	return 0;
 }
 
 void
 dumprmconf()
 {
-	foreachrmconf (dump_rmconf_single, NULL);
+	enumrmconf(NULL, dump_rmconf_single, NULL);
 }
 
 struct idspec *
@@ -671,25 +1145,115 @@
 struct isakmpsa *
 dupisakmpsa(struct isakmpsa *sa)
 {
-	struct isakmpsa *res=NULL;
+	struct isakmpsa *res = NULL;
 
 	if(sa == NULL)
 		return NULL;
 
-	res=newisakmpsa();
+	res = newisakmpsa();
 	if(res == NULL)
 		return NULL;
 
-	*res=*sa;
+	*res = *sa;
 #ifdef HAVE_GSSAPI
-	/* XXX gssid
-	 */
+	if (sa->gssid != NULL)
+		res->gssid = vdup(sa->gssid);
 #endif
-	res->next=NULL;
+	res->next = NULL;
 
 	if(sa->dhgrp != NULL)
-		oakley_setdhgroup (sa->dh_group, &(res->dhgrp));
+		oakley_setdhgroup(sa->dh_group, &res->dhgrp);
 
 	return res;
 
 }
+
+#ifdef ENABLE_HYBRID
+int
+isakmpsa_switch_authmethod(authmethod)
+	int authmethod;
+{
+	switch(authmethod) {
+	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R:
+		authmethod = OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I;
+		break;
+	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R:
+		authmethod = OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I;
+		break;
+	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
+		authmethod = OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I;
+		break;
+	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R:
+		authmethod = OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I;
+		break;
+	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R:
+		authmethod = OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I;
+		break;
+	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_R:
+		authmethod = OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_I;
+		break;
+	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_R:
+		authmethod = OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_I;
+		break;
+	default:
+		break;
+	}
+
+	return authmethod;
+}
+#endif
+
+/*
+ * Given a proposed ISAKMP SA, and a list of acceptable
+ * ISAKMP SAs, it compares using pcheck_level policy and
+ * returns first match (if any).
+ */
+struct isakmpsa *
+checkisakmpsa(pcheck_level, proposal, acceptable)
+	int pcheck_level;
+	struct isakmpsa *proposal, *acceptable;
+{
+	struct isakmpsa *p;
+
+	for (p = acceptable; p != NULL; p = p->next){
+		plog(LLV_DEBUG2, LOCATION, NULL,
+		     "checkisakmpsa:\nauthmethod: %d / %d\n",
+		     isakmpsa_switch_authmethod(proposal->authmethod), isakmpsa_switch_authmethod(p->authmethod));
+		if (isakmpsa_switch_authmethod(proposal->authmethod) != isakmpsa_switch_authmethod(p->authmethod) ||
+		    proposal->enctype != p->enctype ||
+                    proposal->dh_group != p->dh_group ||
+		    proposal->hashtype != p->hashtype)
+			continue;
+
+		switch (pcheck_level) {
+		case PROP_CHECK_OBEY:
+			break;
+
+		case PROP_CHECK_CLAIM:
+		case PROP_CHECK_STRICT:
+			if (proposal->encklen < p->encklen ||
+#if 0
+			    proposal->lifebyte > p->lifebyte ||
+#endif
+			    proposal->lifetime > p->lifetime)
+				continue;
+			break;
+
+		case PROP_CHECK_EXACT:
+			if (proposal->encklen != p->encklen ||
+#if 0
+                            proposal->lifebyte != p->lifebyte ||
+#endif
+			    proposal->lifetime != p->lifetime)
+				continue;
+			break;
+
+		default:
+			continue;
+		}
+
+		return p;
+	}
+
+	return NULL;
+}
diff --git a/src/racoon/remoteconf.h b/src/racoon/remoteconf.h
index ca5945e..3ebe004 100644
--- a/src/racoon/remoteconf.h
+++ b/src/racoon/remoteconf.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: remoteconf.h,v 1.7 2006/10/03 08:01:56 vanhu Exp $	*/
+/*	$NetBSD: remoteconf.h,v 1.16 2011/03/14 15:50:36 vanhu Exp $	*/
 
 /* Id: remoteconf.h,v 1.26 2006/05/06 15:52:44 manubsd Exp */
 
@@ -43,95 +43,14 @@
 #include "isakmp_xauth.h"
 #endif
 
-struct proposalspec;
+struct ph1handle;
+struct secprotospec;
 
 struct etypes {
 	int type;
 	struct etypes *next;
 };
 
-/* Script hooks */
-#define SCRIPT_PHASE1_UP	0
-#define SCRIPT_PHASE1_DOWN	1
-#define SCRIPT_MAX		1
-extern char *script_names[SCRIPT_MAX + 1];
-
-struct remoteconf {
-	struct sockaddr *remote;	/* remote IP address */
-					/* if family is AF_UNSPEC, that is
-					 * for anonymous configuration. */
-
-	struct etypes *etypes;		/* exchange type list. the head
-					 * is a type to be sent first. */
-	int doitype;			/* doi type */
-	int sittype;			/* situation type */
-
-	int idvtype;			/* my identifier type */
-	vchar_t *idv;			/* my identifier */
-	vchar_t *key;			/* my pre-shared key */
-	struct genlist *idvl_p;         /* peer's identifiers list */
-
-	int certtype;			/* certificate type if need */
-	char *mycertfile;		/* file name of my certificate */
-	char *myprivfile;		/* file name of my private key file */
-	char *peerscertfile;		/* file name of peer's certifcate */
-	int getcert_method;		/* the way to get peer's certificate */
-	int cacerttype;			/* CA type is needed */
-	char *cacertfile;		/* file name of CA */
-	int getcacert_method;		/* the way to get the CA */
-	int send_cert;			/* send to CERT or not */
-	int send_cr;			/* send to CR or not */
-	int verify_cert;		/* verify a CERT strictly */
-	int verify_identifier;		/* vefify the peer's identifier */
-	int nonce_size;			/* the number of bytes of nonce */
-	int passive;			/* never initiate */
-	int ike_frag;			/* IKE fragmentation */
-	int esp_frag;			/* ESP fragmentation */
-	int mode_cfg;			/* Gets config through mode config */
-	int support_proxy;		/* support mip6/proxy */
-#define GENERATE_POLICY_NONE   0
-#define GENERATE_POLICY_REQUIRE        1
-#define GENERATE_POLICY_UNIQUE 2
-	int gen_policy;			/* generate policy if no policy found */
-	int ini_contact;		/* initial contact */
-	int pcheck_level;		/* level of propocl checking */
-	int nat_traversal;		/* NAT-Traversal */
-	vchar_t *script[SCRIPT_MAX + 1];/* script hooks paths */
-	int dh_group;			/* use it when only aggressive mode */
-	struct dhgroup *dhgrp;		/* use it when only aggressive mode */
-					/* above two can't be defined by user*/
-
-	int retry_counter;		/* times to retry. */
-	int retry_interval;		/* interval each retry. */
-				/* above 2 values are copied from localconf. */
-
-	int dpd;				/* Negociate DPD support ? */
-	int dpd_retry;			/* in seconds */
-	int dpd_interval;		/* in seconds */
-	int dpd_maxfails; 
-
-	int ph1id; /* ph1id to be matched with sainfo sections */
-
-	int weak_phase1_check;		/* act on unencrypted deletions ? */
-
-	struct isakmpsa *proposal;	/* proposal list */
-	struct remoteconf *inherited_from;	/* the original rmconf 
-						   from which this one 
-						   was inherited */
-	struct proposalspec *prhead;
-
-	struct genlist	*rsa_private,	/* lists of PlainRSA keys to use */
-			*rsa_public;
-
-#ifdef ENABLE_HYBRID
-	struct xauth_rmconf *xauth;
-#endif
-
-	TAILQ_ENTRY(remoteconf) chain;	/* next remote conf */
-};
-
-struct dhgroup;
-
 /* ISAKMP SA specification */
 struct isakmpsa {
 	int prop_no;
@@ -150,42 +69,170 @@
 	struct dhgroup *dhgrp;		/* don't use it if aggressive mode */
 
 	struct isakmpsa *next;		/* next transform */
-	struct remoteconf *rmconf;	/* backpointer to remoteconf */
 };
 
+/* Certificate information */
+struct rmconf_cert {
+	vchar_t *data;			/* certificate payload */
+	char *filename;			/* name of local file */
+};
+
+/* Script hooks */
+#define SCRIPT_PHASE1_UP	0
+#define SCRIPT_PHASE1_DOWN	1
+#define SCRIPT_PHASE1_DEAD	2
+#define SCRIPT_MAX		2
+extern char *script_names[SCRIPT_MAX + 1];
+
+struct remoteconf {
+	char *name;			/* remote configuration name */
+	struct sockaddr *remote;	/* remote IP address */
+					/* if family is AF_UNSPEC, that is
+					 * for anonymous configuration. */
+
+	struct etypes *etypes;		/* exchange type list. the head
+					 * is a type to be sent first. */
+	int doitype;			/* doi type */
+	int sittype;			/* situation type */
+
+	int idvtype;			/* my identifier type */
+	vchar_t *idv;			/* my identifier */
+	vchar_t *key;			/* my pre-shared key */
+	struct genlist *idvl_p;         /* peer's identifiers list */
+
+	char *myprivfile;		/* file name of my private key file */
+	char *mycertfile;		/* file name of my certificate */
+	vchar_t *mycert;		/* my certificate */
+	char *peerscertfile;		/* file name of peer's certifcate */
+	vchar_t *peerscert;		/* peer's certificate */
+	char *cacertfile;		/* file name of CA */
+	vchar_t *cacert;		/* CA certificate */
+
+	int send_cert;			/* send to CERT or not */
+	int send_cr;			/* send to CR or not */
+	int match_empty_cr;		/* does this match if CR is empty */
+	int verify_cert;		/* verify a CERT strictly */
+	int verify_identifier;		/* vefify the peer's identifier */
+	int nonce_size;			/* the number of bytes of nonce */
+	int passive;			/* never initiate */
+	int ike_frag;			/* IKE fragmentation */
+	int esp_frag;			/* ESP fragmentation */
+	int mode_cfg;			/* Gets config through mode config */
+	int support_proxy;		/* support mip6/proxy */
+#define GENERATE_POLICY_NONE	0
+#define GENERATE_POLICY_REQUIRE	1
+#define GENERATE_POLICY_UNIQUE	2
+	int gen_policy;			/* generate policy if no policy found */
+	int ini_contact;		/* initial contact */
+	int pcheck_level;		/* level of propocl checking */
+	int nat_traversal;		/* NAT-Traversal */
+	vchar_t *script[SCRIPT_MAX + 1];/* script hooks paths */
+	int dh_group;			/* use it when only aggressive mode */
+	struct dhgroup *dhgrp;		/* use it when only aggressive mode */
+					/* above two can't be defined by user*/
+
+	int dpd;				/* Negociate DPD support ? */
+	int dpd_retry;			/* in seconds */
+	int dpd_interval;		/* in seconds */
+	int dpd_maxfails;
+
+	int rekey;			/* rekey ph1 when active ph2s? */
+#define REKEY_OFF		FALSE
+#define REKEY_ON		TRUE
+#define REKEY_FORCE		2
+
+	uint32_t ph1id; /* ph1id to be matched with sainfo sections */
+
+	int weak_phase1_check;		/* act on unencrypted deletions ? */
+
+	struct isakmpsa *proposal;	/* proposal list */
+	struct remoteconf *inherited_from;	/* the original rmconf 
+						   from which this one 
+						   was inherited */
+
+	time_t lifetime;		/* for isakmp/ipsec */
+	int lifebyte;			/* for isakmp/ipsec */
+	struct secprotospec *spspec;	/* the head is always current spec. */
+
+	struct genlist	*rsa_private,	/* lists of PlainRSA keys to use */
+			*rsa_public;
+
+#ifdef ENABLE_HYBRID
+	struct xauth_rmconf *xauth;
+#endif
+
+	TAILQ_ENTRY(remoteconf) chain;	/* next remote conf */
+};
+
+#define RMCONF_NONCE_SIZE(rmconf) \
+	(rmconf != NULL ? rmconf->nonce_size : DEFAULT_NONCE_SIZE)
+
+struct dhgroup;
+
 struct idspec {
 	int idtype;                     /* identifier type */
 	vchar_t *id;                    /* identifier */
 };
 
-typedef struct remoteconf * (rmconf_func_t)(struct remoteconf *rmconf, void *data);
+struct rmconfselector {
+	int flags;
+	struct sockaddr *remote;
+	int etype;
+	struct isakmpsa *approval;
+	vchar_t *identity;
+	vchar_t *certificate_request;
+};
 
-extern struct remoteconf *getrmconf __P((struct sockaddr *));
-extern struct remoteconf *getrmconf_strict
-	__P((struct sockaddr *remote, int allow_anon));
-extern struct remoteconf *copyrmconf __P((struct sockaddr *));
+extern void rmconf_selector_from_ph1 __P((struct rmconfselector *rmsel,
+					  struct ph1handle *iph1));
+extern int enumrmconf __P((struct rmconfselector *rmsel,
+			   int (* enum_func)(struct remoteconf *rmconf, void *arg),
+			   void *enum_arg));
+
+#define GETRMCONF_F_NO_ANONYMOUS	0x0001
+#define GETRMCONF_F_NO_PASSIVE		0x0002
+
+#define RMCONF_ERR_MULTIPLE		((struct remoteconf *) -1)
+
+extern int rmconf_match_identity __P((struct remoteconf *rmconf,
+				      vchar_t *id_p));
+extern struct remoteconf *getrmconf __P((struct sockaddr *remote, int flags));
+extern struct remoteconf *getrmconf_by_ph1 __P((struct ph1handle *iph1));
+extern struct remoteconf *getrmconf_by_name __P((const char *name));
+
 extern struct remoteconf *newrmconf __P((void));
-extern struct remoteconf *duprmconf __P((struct remoteconf *));
+extern struct remoteconf *duprmconf_shallow __P((struct remoteconf *));
+extern int duprmconf_finish __P((struct remoteconf *));
 extern void delrmconf __P((struct remoteconf *));
-extern void delisakmpsa __P((struct isakmpsa *));
 extern void deletypes __P((struct etypes *));
 extern struct etypes * dupetypes __P((struct etypes *));
 extern void insrmconf __P((struct remoteconf *));
 extern void remrmconf __P((struct remoteconf *));
 extern void flushrmconf __P((void));
+extern void dupspspec_list __P((struct remoteconf *, struct remoteconf *));
+extern void flushspspec __P((struct remoteconf *));
 extern void initrmconf __P((void));
-extern void save_rmconf __P((void));
-extern void save_rmconf_flush __P((void));
+extern void rmconf_start_reload __P((void));
+extern void rmconf_finish_reload __P((void));
 
-extern struct etypes *check_etypeok
-	__P((struct remoteconf *, u_int8_t));
-extern struct remoteconf *foreachrmconf __P((rmconf_func_t rmconf_func,
-					     void *data));
+extern int check_etypeok __P((struct remoteconf *, void *));
 
 extern struct isakmpsa *newisakmpsa __P((void));
 extern struct isakmpsa *dupisakmpsa __P((struct isakmpsa *));
-
+extern void delisakmpsa __P((struct isakmpsa *));
 extern void insisakmpsa __P((struct isakmpsa *, struct remoteconf *));
+#ifdef ENABLE_HYBRID
+extern int isakmpsa_switch_authmethod __P((int authmethod));
+#else
+static inline int isakmpsa_switch_authmethod(int authmethod)
+{
+	return authmethod;
+}
+#endif
+extern struct isakmpsa * checkisakmpsa __P((int pcheck,
+					    struct isakmpsa *proposal,
+					    struct isakmpsa *acceptable));
+
 
 extern void dumprmconf __P((void));
 
diff --git a/src/racoon/rsalist.c b/src/racoon/rsalist.c
index 850aa4c..f152c82 100644
--- a/src/racoon/rsalist.c
+++ b/src/racoon/rsalist.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: rsalist.c,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
+/*	$NetBSD: rsalist.c,v 1.6 2011/03/14 15:50:36 vanhu Exp $	*/
 
 /* Id: rsalist.c,v 1.3 2004/11/08 12:04:23 ludvigm Exp */
 
@@ -88,6 +88,65 @@
 	return 0;
 }
 
+struct rsa_key *
+rsa_key_dup(struct rsa_key *key)
+{
+	struct rsa_key *new;
+
+	new = calloc(sizeof(struct rsa_key), 1);
+	if (new == NULL)
+		return NULL;
+
+	if (key->rsa) {
+		new->rsa = key->rsa->d != NULL ? RSAPrivateKey_dup(key->rsa) : RSAPublicKey_dup(key->rsa);
+		if (new->rsa == NULL)
+			goto dup_error;
+	}
+
+	if (key->src) {
+		new->src = malloc(sizeof(*new->src));
+		if (new->src == NULL)
+			goto dup_error;
+		memcpy(new->src, key->src, sizeof(*new->src));
+	}	
+	if (key->dst) {
+		new->dst = malloc(sizeof(*new->dst));
+		if (new->dst == NULL)
+			goto dup_error;
+		memcpy(new->dst, key->dst, sizeof(*new->dst));
+	}
+
+	return new;
+
+dup_error:
+	if (new->rsa != NULL)
+		RSA_free(new->rsa);
+	if (new->dst != NULL)
+		free(new->dst);
+	if (new->src != NULL)
+		free(new->src);
+
+	free(new);
+	return NULL;
+}
+
+void
+rsa_key_free(void *data)
+{
+	struct rsa_key *rsa_key;
+
+	
+	rsa_key = (struct rsa_key *)data;
+	if (rsa_key->src)
+		free(rsa_key->src);
+	if (rsa_key->dst)
+		free(rsa_key->dst);
+	if (rsa_key->rsa)
+		RSA_free(rsa_key->rsa);
+
+	free(rsa_key);
+}
+
 static void *
 rsa_key_dump_one(void *entry, void *arg)
 {
diff --git a/src/racoon/rsalist.h b/src/racoon/rsalist.h
index 911670f..bc6a8d9 100644
--- a/src/racoon/rsalist.h
+++ b/src/racoon/rsalist.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: rsalist.h,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
+/*	$NetBSD: rsalist.h,v 1.6 2011/03/14 15:50:36 vanhu Exp $	*/
 
 /* Id: rsalist.h,v 1.2 2004/07/12 20:43:51 ludvigm Exp */
 /*
@@ -53,6 +53,8 @@
 };
 
 int rsa_key_insert(struct genlist *list, struct netaddr *src, struct netaddr *dst, RSA *rsa);
+struct rsa_key *rsa_key_dup(struct rsa_key *key);
+void rsa_key_free(void *data);
 void rsa_key_dump(struct genlist *list);
 
 struct genlist *rsa_lookup_keys(struct ph1handle *iph1, int my);
diff --git a/src/racoon/sainfo.c b/src/racoon/sainfo.c
index afa0aac..b6577c2 100644
--- a/src/racoon/sainfo.c
+++ b/src/racoon/sainfo.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: sainfo.c,v 1.7.6.1 2007/08/01 11:52:22 vanhu Exp $	*/
+/*	$NetBSD: sainfo.c,v 1.14 2011/02/02 15:21:34 vanhu Exp $	*/
 
 /*	$KAME: sainfo.c,v 1.16 2003/06/27 07:32:39 sakane Exp $	*/
 
@@ -64,7 +64,8 @@
 #include "sainfo.h"
 #include "gcmalloc.h"
 
-static LIST_HEAD(_sitree, sainfo) sitree, sitree_save, sitree_tmp;
+typedef LIST_HEAD(_sitree, sainfo) sainfo_tailq_head_t;
+static sainfo_tailq_head_t sitree, sitree_save;
 
 /* %%%
  * modules for ipsec sa info
@@ -76,88 +77,112 @@
  * First pass is for sainfo from a specified peer, second for others.
  */
 struct sainfo *
-getsainfo(loc, rmt, peer, remoteid)
-	const vchar_t *loc, *rmt, *peer;
-	int remoteid;
+getsainfo(loc, rmt, peer, client, remoteid)
+	const vchar_t *loc, *rmt, *peer, *client;
+	uint32_t remoteid;
 {
 	struct sainfo *s = NULL;
-	struct sainfo *anonymous = NULL;
-	int pass = 1;
-
-	if (peer == NULL)
-		pass = 2;
 
 	/* debug level output */
 	if(loglevel >= LLV_DEBUG) {
 		char *dloc, *drmt, *dpeer, *dclient;
- 
+
 		if (loc == NULL)
 			dloc = strdup("ANONYMOUS");
 		else
 			dloc = ipsecdoi_id2str(loc);
- 
-		if (rmt == NULL)
+
+		if (rmt == SAINFO_ANONYMOUS)
 			drmt = strdup("ANONYMOUS");
+		else if (rmt == SAINFO_CLIENTADDR)
+			drmt = strdup("CLIENTADDR");
 		else
 			drmt = ipsecdoi_id2str(rmt);
- 
+
 		if (peer == NULL)
 			dpeer = strdup("NULL");
 		else
 			dpeer = ipsecdoi_id2str(peer);
- 
+
+		if (client == NULL)
+			dclient = strdup("NULL");
+		else
+			dclient = ipsecdoi_id2str(client);
+
 		plog(LLV_DEBUG, LOCATION, NULL,
-			"getsainfo params: loc=\'%s\', rmt=\'%s\', peer=\'%s\', id=%i\n",
-			dloc, drmt, dpeer, remoteid );
+			"getsainfo params: loc=\'%s\' rmt=\'%s\' peer=\'%s\' client=\'%s\' id=%u\n",
+			dloc, drmt, dpeer, dclient, remoteid );
  
                 racoon_free(dloc);
                 racoon_free(drmt);
                 racoon_free(dpeer);
+                racoon_free(dclient);
 	}
 
-    again:
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"getsainfo pass #%i\n", pass);
- 
 	LIST_FOREACH(s, &sitree, chain) {
 		const char *sainfostr = sainfo2str(s);
 		plog(LLV_DEBUG, LOCATION, NULL,
 			"evaluating sainfo: %s\n", sainfostr);
 
-		if(s->remoteid != remoteid)
-			continue;
-
-		if (s->id_i != NULL) {
-			if (pass == 2)
+		if(s->remoteid != remoteid) {
+			plog(LLV_DEBUG, LOCATION, NULL,
+				"remoteid mismatch: %u != %u\n",
+				s->remoteid, remoteid);
 				continue;
+		}
+
+		/* compare 'from' id value */
+		if (s->id_i != NULL)
 			if (ipsecdoi_chkcmpids(peer, s->id_i, 0))
 				continue;
-		} else if (pass == 1)
-			continue;
-		if (s->idsrc == NULL && s->iddst == NULL) {
-			anonymous = s;
+
+		/* compare ids - client */
+		if( s->iddst == SAINFO_CLIENTADDR ) {
+			/*
+			 * This sainfo section enforces client address
+			 * checking. Prevent match if the client value
+			 * ( modecfg or tunnel address ) is NULL.
+			 */
+
+			if (client == NULL)
+				continue;
+
+			if( rmt == SAINFO_CLIENTADDR ) {
+				/*
+				 * In the case where a supplied rmt value is
+				 * also SAINFO_CLIENTADDR, we are comparing
+				 * with another sainfo to check for duplicate.
+				 * Only compare the local values to determine
+				 * a match.
+				 */
+
+				 if (!ipsecdoi_chkcmpids(loc, s->idsrc, 0))
+					return s;
+			}
+			else {
+				/*
+				 * In the case where a supplied rmt value is
+				 * not SAINFO_CLIENTADDR, do a standard match
+				 * for local values and enforce that the rmt
+				 * id matches the client address value.
+				 */
+
+				if (!ipsecdoi_chkcmpids(loc, s->idsrc, 0) &&
+				    !ipsecdoi_chkcmpids(rmt, client, 0))
+					return s;
+			}
+
 			continue;
 		}
 
-		/* anonymous ? */
-		if (loc == NULL) {
-			if (anonymous != NULL)
-				break;
-			continue;
-		}
 
-		/* compare the ids */
+		/* compare ids - standard */
 		if (!ipsecdoi_chkcmpids(loc, s->idsrc, 0) &&
 		    !ipsecdoi_chkcmpids(rmt, s->iddst, 0))
 			return s;
 	}
 
-	if ((anonymous == NULL) && (pass == 1)) {
-		pass++;
-		goto again;
-	}
-
-	return anonymous;
+	return NULL;
 }
 
 struct sainfo *
@@ -186,7 +211,8 @@
 
 	if (si->idsrc)
 		vfree(si->idsrc);
-	if (si->iddst)
+	if (si->iddst != NULL &&
+		si->iddst != SAINFO_CLIENTADDR)
 		vfree(si->iddst);
 
 #ifdef ENABLE_HYBRID
@@ -197,11 +223,75 @@
 	racoon_free(si);
 }
 
+int prisainfo(s)
+	struct sainfo *s;
+{
+	/*
+	 * determine the matching priority
+	 * of an sainfo section
+	 */
+
+	int pri = 0;
+
+	if(s->remoteid)
+		pri += 3;
+
+	if(s->id_i)
+		pri += 3;
+
+	if(s->idsrc)
+		pri++;
+
+	if(s->iddst)
+		pri++;
+
+	return pri;
+}
+
 void
 inssainfo(new)
 	struct sainfo *new;
 {
-	LIST_INSERT_HEAD(&sitree, new, chain);
+	if(LIST_EMPTY(&sitree)) {
+
+		/* first in list */
+		LIST_INSERT_HEAD(&sitree, new, chain);
+	}
+	else {
+		int npri, spri;
+		struct sainfo *s, *n;
+
+		/*
+		 * insert our new sainfo section
+		 * into our list which is sorted
+		 * based on the match priority
+		 */
+
+		npri = prisainfo(new);
+
+		s = LIST_FIRST(&sitree);
+		while (1) {
+
+			spri = prisainfo(s);
+			n = LIST_NEXT(s, chain);
+
+			if(npri > spri)
+			{
+				/* higher priority */
+				LIST_INSERT_BEFORE(s, new, chain);
+				return;
+			}
+
+			if(n == NULL)
+			{
+				/* last in list */
+				LIST_INSERT_AFTER(s, new, chain);
+				return;
+			}
+
+			s = n;
+		}
+	}
 }
 
 void
@@ -276,13 +366,15 @@
 
         char *idloc = NULL, *idrmt = NULL, *id_i;
  
-        if (si->idsrc == NULL)
+        if (si->idsrc == SAINFO_ANONYMOUS)
                 idloc = strdup("ANONYMOUS");
         else
                 idloc = ipsecdoi_id2str(si->idsrc);
  
-        if (si->iddst == NULL)
+        if (si->iddst == SAINFO_ANONYMOUS)
                 idrmt = strdup("ANONYMOUS");
+	else if (si->iddst == SAINFO_CLIENTADDR)
+                idrmt = strdup("CLIENTADDR");
         else
                 idrmt = ipsecdoi_id2str(si->iddst);
  
@@ -291,7 +383,7 @@
         else
                 id_i = ipsecdoi_id2str(si->id_i);
  
-        snprintf(buf, 255, "loc=\'%s\', rmt=\'%s\', peer=\'%s\', id=%i",
+        snprintf(buf, 255, "loc=\'%s\', rmt=\'%s\', peer=\'%s\', id=%u",
 		idloc, idrmt, id_i, si->remoteid);
  
         racoon_free(idloc);
@@ -301,12 +393,14 @@
         return buf;
 }
 
-void save_sainfotree(void){
+void sainfo_start_reload(void){
 	sitree_save=sitree;
 	initsainfo();
 }
 
-void save_sainfotree_flush(void){
+void sainfo_finish_reload(void){
+	sainfo_tailq_head_t sitree_tmp;
+
 	sitree_tmp=sitree;
 	sitree=sitree_save;
 	flushsainfo();
diff --git a/src/racoon/sainfo.h b/src/racoon/sainfo.h
index 357da3f..e708cd6 100644
--- a/src/racoon/sainfo.h
+++ b/src/racoon/sainfo.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: sainfo.h,v 1.5 2006/10/03 08:01:56 vanhu Exp $	*/
+/*	$NetBSD: sainfo.h,v 1.8 2011/02/02 15:21:34 vanhu Exp $	*/
 
 /* Id: sainfo.h,v 1.5 2006/07/09 17:19:38 manubsd Exp */
 
@@ -36,6 +36,9 @@
 
 #include <sys/queue.h>
 
+#define SAINFO_ANONYMOUS	((void *)NULL)
+#define	SAINFO_CLIENTADDR	((void *)~0)
+
 /* SA info */
 struct sainfo {
 	vchar_t *idsrc;
@@ -44,6 +47,7 @@
 		 * idsrc and iddst are constructed body of ID payload.
 		 * that is (struct ipsecdoi_id_b) + ID value.
 		 * If idsrc == NULL, that is anonymous entry.
+		 * If idsrc == ~0, that is client address entry.
 		 */
 
 #ifdef ENABLE_HYBRID
@@ -56,7 +60,7 @@
 	vchar_t *id_i;		/* identifier of the authorized initiator */
 	struct sainfoalg *algs[MAXALGCLASS];
 
-	int remoteid;
+	uint32_t remoteid;
 
 	LIST_ENTRY(sainfo) chain;
 };
@@ -69,7 +73,7 @@
 };
 
 extern struct sainfo *getsainfo __P((const vchar_t *,
-	const vchar_t *, const vchar_t *, int));
+	const vchar_t *, const vchar_t *, const vchar_t *, uint32_t));
 extern struct sainfo *newsainfo __P((void));
 extern void delsainfo __P((struct sainfo *));
 extern void inssainfo __P((struct sainfo *));
@@ -81,8 +85,8 @@
 extern void inssainfoalg __P((struct sainfoalg **, struct sainfoalg *));
 extern const char * sainfo2str __P((const struct sainfo *));
 
-extern void save_sainfotree __P((void));
-extern void save_sainfotree_flush __P((void));
+extern void sainfo_start_reload __P((void));
+extern void sainfo_finish_reload __P((void));
 extern void save_sainfotree_restore __P((void));
 
 #endif /* _SAINFO_H */
diff --git a/src/racoon/samples/roadwarrior/client/phase1-down.sh b/src/racoon/samples/roadwarrior/client/phase1-down.sh
index 8edc187..92f2ba8 100755
--- a/src/racoon/samples/roadwarrior/client/phase1-down.sh
+++ b/src/racoon/samples/roadwarrior/client/phase1-down.sh
@@ -8,10 +8,10 @@
 
 case `uname -s` in
 NetBSD)
-	DEFAULT_GW=`netstat -rn | awk '($1 == "default"){print $2}'`
+	DEFAULT_GW=`netstat -finet -rn | awk '($1 == "default"){print $2; exit}'`
 	;;
 Linux)
-	DEFAULT_GW=`netstat -rn | awk '($1 == "0.0.0.0"){print $2}'`
+	DEFAULT_GW=`netstat --inet -rn | awk '($1 == "0.0.0.0"){print $2; exit}'`
 	;;
 esac
 
@@ -21,24 +21,29 @@
 echo "REMOTE_ADDR = ${REMOTE_ADDR}"
 echo "REMOTE_PORT = ${REMOTE_PORT}"
 echo "DEFAULT_GW = ${DEFAULT_GW}"
+echo "INTERNAL_NETMASK4 = ${INTERNAL_NETMASK4}"
 echo "INTERNAL_ADDR4 = ${INTERNAL_ADDR4}"
 echo "INTERNAL_DNS4 = ${INTERNAL_DNS4}"
 
 echo ${INTERNAL_ADDR4} | grep '[0-9]' > /dev/null || exit 0
+echo ${INTERNAL_NETMASK4} | grep '[0-9]' > /dev/null || exit 0
 echo ${DEFAULT_GW} | grep '[0-9]' > /dev/null || exit 0
 
-test -f /etc/resolv.conf.bak && cp /etc/resolv.conf.bak /etc/resolv.conf
+if [ -f /etc/resolv.conf.bak ]; then
+	rm -f /etc/resolv.conf
+	mv /etc/resolv.conf.bak /etc/resolv.conf
+fi
 
 case `uname -s` in
 NetBSD)
-	if=`netstat -rn|awk '($1 == "default"){print $7}'`
-	ifconfig ${if} delete ${INTERNAL_ADDR4}
+	if=`netstat -finet -rn|awk '($1 == "default"){print $7; exit}'`
 	route delete default
 	route delete ${REMOTE_ADDR}
+	ifconfig ${if} delete ${INTERNAL_ADDR4}
 	route add default ${DEFAULT_GW} -ifa ${LOCAL_ADDR}
 	;;
 Linux)
-	if=`netstat -rn|awk '($1 == "0.0.0.0"){print $8}'`
+	if=`netstat --inet -rn|awk '($1 == "0.0.0.0"){print $8; exit}'`
 	route delete default
 	route delete ${REMOTE_ADDR}
 	ifconfig ${if}:1 del ${INTERNAL_ADDR4}
@@ -54,13 +59,13 @@
 	;;
 esac
 
-# Use this for a NAT-T setup
-LOCAL="${LOCAL_ADDR}[${LOCAL_PORT}]"
-REMOTE="${REMOTE_ADDR}[${REMOTE_PORT}]"
-
-# Use this for a non NAT-T setup
-#LOCAL="${LOCAL_ADDR}"
-#REMOTE="${REMOTE_ADDR}"
+LOCAL="${LOCAL_ADDR}"
+REMOTE="${REMOTE_ADDR}"
+if [ "x${LOCAL_PORT}" != "x500" ]; then
+	# NAT-T setup
+	LOCAL="${LOCAL}[${LOCAL_PORT}]"
+	REMOTE="${REMOTE}[${REMOTE_PORT}]"
+fi
 
 echo "
 deleteall ${REMOTE_ADDR} ${LOCAL_ADDR} esp;
diff --git a/src/racoon/samples/roadwarrior/client/phase1-up.sh b/src/racoon/samples/roadwarrior/client/phase1-up.sh
index e45b648..9275811 100755
--- a/src/racoon/samples/roadwarrior/client/phase1-up.sh
+++ b/src/racoon/samples/roadwarrior/client/phase1-up.sh
@@ -7,10 +7,10 @@
 
 case `uname -s` in
 NetBSD)
-	DEFAULT_GW=`netstat -rn | awk '($1 == "default"){print $2}'`
+	DEFAULT_GW=`netstat -finet -rn | awk '($1 == "default"){print $2; exit}'`
 	;;
 Linux)
-	DEFAULT_GW=`netstat -rn | awk '($1 == "0.0.0.0"){print $2}'`
+	DEFAULT_GW=`netstat --inet -rn | awk '($1 == "0.0.0.0"){print $2; exit}'`
 	;;
 esac
 
@@ -21,25 +21,28 @@
 echo "REMOTE_PORT = ${REMOTE_PORT}"
 echo "DEFAULT_GW = ${DEFAULT_GW}"
 echo "INTERNAL_ADDR4 = ${INTERNAL_ADDR4}"
+echo "INTERNAL_NETMASK4 = ${INTERNAL_NETMASK4}"
 echo "INTERNAL_DNS4 = ${INTERNAL_DNS4}"
 
 echo ${INTERNAL_ADDR4} | grep '[0-9]' > /dev/null || exit 0
+echo ${INTERNAL_NETMASK4} | grep '[0-9]' > /dev/null || exit 0
 echo ${DEFAULT_GW} | grep '[0-9]' > /dev/null || exit 0
 
-test -f /etc/resolv.conf.bak || cp /etc/resolv.conf /etc/resolv.conf.bak
-echo "# Generated by racoon on `date`" > /etc/resolv.conf
+mv /etc/resolv.conf /etc/resolv.conf.bak
+( umask 22; touch /etc/resolv.conf )
+echo "# Generated by racoon on `date`" >> /etc/resolv.conf
 echo "nameserver ${INTERNAL_DNS4}" >> /etc/resolv.conf
 
 case `uname -s` in
 NetBSD)
-	if=`netstat -rn|awk '($1 == "default"){print $7}'`
+	if=`netstat -finet -rn|awk '($1 == "default"){print $7; exit}'`
 	ifconfig ${if} alias ${INTERNAL_ADDR4} netmask ${INTERNAL_NETMASK4}
 	route delete default
 	route add default ${DEFAULT_GW} -ifa ${INTERNAL_ADDR4}
 	route add ${REMOTE_ADDR} ${DEFAULT_GW}
 	;;
 Linux)
-	if=`netstat -rn|awk '($1 == "0.0.0.0"){print $8}'`
+	if=`netstat --inet -rn|awk '($1 == "0.0.0.0"){print $8; exit}'`
 	ifconfig ${if}:1 ${INTERNAL_ADDR4}      
 	route delete default
 	route add ${REMOTE_ADDR} gw ${DEFAULT_GW} dev ${if}
@@ -47,13 +50,13 @@
 	;;
 esac
 
-# Use this for a NAT-T setup
-LOCAL="${LOCAL_ADDR}[${LOCAL_PORT}]"
-REMOTE="${REMOTE_ADDR}[${REMOTE_PORT}]"
-
-# Use this for a non NAT-T setup
-#LOCAL="${LOCAL_ADDR}"
-#REMOTE="${REMOTE_ADDR}"
+LOCAL="${LOCAL_ADDR}"
+REMOTE="${REMOTE_ADDR}"
+if [ "x${LOCAL_PORT}" != "x500" ]; then
+	# NAT-T setup
+	LOCAL="${LOCAL}[${LOCAL_PORT}]"
+	REMOTE="${REMOTE}[${REMOTE_PORT}]"
+fi
 
 
 echo "
diff --git a/src/racoon/schedule.c b/src/racoon/schedule.c
index 04723c5..018f920 100644
--- a/src/racoon/schedule.c
+++ b/src/racoon/schedule.c
@@ -1,9 +1,10 @@
-/*	$NetBSD: schedule.c,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
+/*	$NetBSD: schedule.c,v 1.7 2009/01/23 09:10:13 tteras Exp $	*/
 
 /*	$KAME: schedule.c,v 1.19 2001/11/05 10:53:19 sakane Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
+ * Copyright (C) 2008 Timo Teras.
  * All rights reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
@@ -40,6 +41,7 @@
 #include <sys/socket.h>
 
 #include <stdlib.h>
+#include <unistd.h>
 #include <stdio.h>
 #include <string.h>
 #include <errno.h>
@@ -51,25 +53,46 @@
 #include "var.h"
 #include "gcmalloc.h"
 
-#define FIXY2038PROBLEM
-
 #ifndef TAILQ_FOREACH
 #define TAILQ_FOREACH(elm, head, field) \
         for (elm = TAILQ_FIRST(head); elm; elm = TAILQ_NEXT(elm, field))
 #endif
 
-static struct timeval timeout;
-
-#ifdef FIXY2038PROBLEM
-#define Y2038TIME_T	0x7fffffff
-static time_t launched;		/* time when the program launched. */
-static time_t deltaY2038;
-#endif
-
 static TAILQ_HEAD(_schedtree, sched) sctree;
 
-static void sched_add __P((struct sched *));
-static time_t current_time __P((void));
+void
+sched_get_monotonic_time(tv)
+	struct timeval *tv;
+{
+#ifdef HAVE_CLOCK_MONOTONIC
+	struct timespec ts;
+
+	clock_gettime(CLOCK_MONOTONIC, &ts);
+	tv->tv_sec = ts.tv_sec;
+	tv->tv_usec = ts.tv_nsec / 1000;
+#else
+	gettimeofday(tv, NULL);
+#endif
+}
+
+time_t
+sched_monotonic_to_time_t(tv, now)
+	struct timeval *tv, *now;
+{
+#ifdef HAVE_CLOCK_MONOTONIC
+	struct timeval mynow, res;
+
+	if (now == NULL) {
+		sched_get_monotonic_time(&mynow);
+		now = &mynow;
+	}
+	timersub(now, tv, &res);
+
+	return time(NULL) + res.tv_sec;
+#else
+	return tv->tv_sec;
+#endif
+}
 
 /*
  * schedule handler
@@ -80,42 +103,26 @@
 struct timeval *
 schedular()
 {
-	time_t now, delta;
-	struct sched *p, *next = NULL;
+	static struct timeval timeout;
+	struct timeval now;
+	struct sched *p;
 
-	now = current_time();
+	sched_get_monotonic_time(&now);
+	while (!TAILQ_EMPTY(&sctree) &&
+		timercmp(&TAILQ_FIRST(&sctree)->xtime, &now, <=)) {
+		void (*func)(struct sched *);
 
-        for (p = TAILQ_FIRST(&sctree); p; p = next) {
-		/* if the entry has been daed, remove it */
-		if (p->dead)
-			goto next_schedule;
-
-		/* if the time hasn't come, proceed to the next entry */
-		if (now < p->xtime) {
-			next = TAILQ_NEXT(p, chain);
-			continue;
-		}
-
-		/* mark it with dead. and call the function. */
-		p->dead = 1;
-		if (p->func != NULL)
-			(p->func)(p->param);
-
-	   next_schedule:
-		next = TAILQ_NEXT(p, chain);
-		TAILQ_REMOVE(&sctree, p, chain);
-		racoon_free(p);
+		p = TAILQ_FIRST(&sctree);
+		func = p->func;
+		sched_cancel(p);
+		func(p);
 	}
 
 	p = TAILQ_FIRST(&sctree);
 	if (p == NULL)
 		return NULL;
 
-	now = current_time();
-
-	delta = p->xtime - now;
-	timeout.tv_sec = delta < 0 ? 0 : delta;
-	timeout.tv_usec = 0;
+	timersub(&p->xtime, &now, &timeout);
 
 	return &timeout;
 }
@@ -123,101 +130,46 @@
 /*
  * add new schedule to schedule table.
  */
-struct sched *
-sched_new(tick, func, param)
+void
+sched_schedule(sc, tick, func)
+	struct sched *sc;
 	time_t tick;
-	void (*func) __P((void *));
-	void *param;
+	void (*func) __P((struct sched *));
 {
 	static long id = 1;
-	struct sched *new;
+	struct sched *p;
+	struct timeval now;
 
-	new = (struct sched *)racoon_malloc(sizeof(*new));
-	if (new == NULL)
-		return NULL;
+	sched_cancel(sc);
 
-	memset(new, 0, sizeof(*new));
-	new->func = func;
-	new->param = param;
-
-	new->id = id++;
-	time(&new->created);
-	new->tick = tick;
-
-	new->xtime = current_time() + tick;
-	new->dead = 0;
+	sc->func = func;
+	sc->id = id++;
+	sc->tick.tv_sec = tick;
+	sc->tick.tv_usec = 0;
+	sched_get_monotonic_time(&now);
+	timeradd(&now, &sc->tick, &sc->xtime);
 
 	/* add to schedule table */
-	sched_add(new);
-
-	return(new);
-}
-
-/* add new schedule to schedule table */
-static void
-sched_add(sc)
-	struct sched *sc;
-{
-	struct sched *p;
-
 	TAILQ_FOREACH(p, &sctree, chain) {
-		if (sc->xtime < p->xtime) {
-			TAILQ_INSERT_BEFORE(p, sc, chain);
-			return;
-		}
+		if (timercmp(&sc->xtime, &p->xtime, <))
+			break;
 	}
 	if (p == NULL)
 		TAILQ_INSERT_TAIL(&sctree, sc, chain);
-
-	return;
+	else
+		TAILQ_INSERT_BEFORE(p, sc, chain);
 }
 
-/* get current time.
- * if defined FIXY2038PROBLEM, base time is the time when called sched_init().
- * Otherwise, conform to time(3).
+/*
+ * cancel scheduled callback
  */
-static time_t
-current_time()
-{
-	time_t n;
-#ifdef FIXY2038PROBLEM
-	time_t t;
-
-	time(&n);
-	t = n - launched;
-	if (t < 0)
-		t += deltaY2038;
-
-	return t;
-#else
-	return time(&n);
-#endif
-}
-
 void
-sched_kill(sc)
+sched_cancel(sc)
 	struct sched *sc;
 {
-	sc->dead = 1;
-
-	return;
-}
-
-/* XXX this function is probably unnecessary. */
-void
-sched_scrub_param(param)
-	void *param;
-{
-	struct sched *sc;
-
-	TAILQ_FOREACH(sc, &sctree, chain) {
-		if (sc->param == param) {
-			if (!sc->dead) {
-				plog(LLV_DEBUG, LOCATION, NULL,
-				    "an undead schedule has been deleted.\n");
-			}
-			sched_kill(sc);
-		}
+	if (sc->func != NULL) {
+		TAILQ_REMOVE(&sctree, sc, chain);
+		sc->func = NULL;
 	}
 }
 
@@ -232,6 +184,7 @@
 	caddr_t new;
 	struct sched *p;
 	struct scheddump *dst;
+	struct timeval now, created;
 	int cnt = 0;
 
 	/* initialize */
@@ -252,12 +205,14 @@
 		return -1;
 	dst = (struct scheddump *)new;
 
-        p = TAILQ_FIRST(&sctree);
+	sched_get_monotonic_time(&now);
+	p = TAILQ_FIRST(&sctree);
 	while (p) {
-		dst->xtime = p->xtime;
+		timersub(&p->xtime, &p->tick, &created);
+		dst->xtime = p->xtime.tv_sec;
 		dst->id = p->id;
-		dst->created = p->created;
-		dst->tick = p->tick;
+		dst->created = sched_monotonic_to_time_t(&created, &now);
+		dst->tick = p->tick.tv_sec;
 
 		p = TAILQ_NEXT(p, chain);
 		if (p == NULL)
@@ -274,15 +229,7 @@
 void
 sched_init()
 {
-#ifdef FIXY2038PROBLEM
-	time(&launched);
-
-	deltaY2038 = Y2038TIME_T - launched;
-#endif
-
 	TAILQ_INIT(&sctree);
-
-	return;
 }
 
 #ifdef STEST
diff --git a/src/racoon/schedule.h b/src/racoon/schedule.h
index bd66593..228e677 100644
--- a/src/racoon/schedule.h
+++ b/src/racoon/schedule.h
@@ -1,9 +1,10 @@
-/*	$NetBSD: schedule.h,v 1.4.6.1 2007/03/21 14:29:48 vanhu Exp $	*/
+/*	$NetBSD: schedule.h,v 1.8 2009/08/17 12:00:53 vanhu Exp $	*/
 
 /* Id: schedule.h,v 1.5 2006/05/03 21:53:42 vanhu Exp */
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
+ * Copyright (C) 2008 Timo Teras.
  * All rights reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
@@ -34,39 +35,47 @@
 #ifndef _SCHEDULE_H
 #define _SCHEDULE_H
 
+#include <stddef.h>
+
 #include <sys/queue.h>
+#if TIME_WITH_SYS_TIME
+# include <sys/time.h>
+# include <time.h>
+#else
+# if HAVE_SYS_TIME_H
+#  include <sys/time.h>
+# else
+#  include <time.h>
+# endif
+#endif
 #include "gnuc.h"
 
+#ifndef offsetof
+#ifdef __compiler_offsetof
+#define offsetof(TYPE,MEMBER) __compiler_offsetof(TYPE,MEMBER)
+#else
+#define offsetof(TYPE, MEMBER) ((size_t) &((TYPE *)0)->MEMBER)
+#endif
+#endif
+
+#ifndef container_of
+#define container_of(ptr, type, member) ({                      \
+        const typeof( ((type *)0)->member ) *__mptr = (ptr);    \
+        (type *)( (char *)__mptr - offsetof(type,member) );})
+#endif
+
+
 /* scheduling table */
 /* the head is the nearest event. */
 struct sched {
-	time_t xtime;		/* event time which is as time(3). */
-				/*
-				 * if defined FIXY2038PROBLEM, this time
-				 * is from the time when called sched_init().
-				 */
-	void (*func) __P((void *)); /* call this function when timeout. */
-	void *param;		/* pointer to parameter */
-
-	int dead;		/* dead or alive */
-	long id;		/* for debug */
-	time_t created;		/* for debug */
-	time_t tick;		/* for debug */
-
+	void (*func) __P((struct sched *));	/* callback on timeout */
+	struct timeval xtime;			/* expiration time */
+	struct timeval tick;			/* relative timeout */
 	TAILQ_ENTRY(sched) chain;
+	long id;				/* for debug */
 };
 
-/* cancel schedule */
-#define SCHED_KILL(s)                                                          \
-do {                                                                           \
-	if(s != NULL){	   														\
-		sched_kill(s);                                                         \
-		s = NULL;                                                              \
-	}\
-} while(0)
-
-/* must be called after it's called from scheduler. */
-#define SCHED_INIT(s)	(s) = NULL
+#define SCHED_INITIALIZER() { NULL, }
 
 struct scheddump {
 	time_t xtime;
@@ -75,11 +84,16 @@
 	time_t tick;
 };
 
+time_t sched_monotonic_to_time_t __P((struct timeval *tv,
+				      struct timeval *now));
+void sched_get_monotonic_time __P((struct timeval *tv));
+
 struct timeval *schedular __P((void));
-struct sched *sched_new __P((time_t, void (*func) __P((void *)), void *));
-void sched_kill __P((struct sched *));
+void sched_schedule __P((struct sched *, time_t,
+			 void (*func) __P((struct sched *))));
+void sched_cancel __P((struct sched *));
+
 int sched_dump __P((caddr_t *, int *));
 void sched_init __P((void));
-void sched_scrub_param __P((void *));
 
 #endif /* _SCHEDULE_H */
diff --git a/src/racoon/session.c b/src/racoon/session.c
index 9db901d..85e29a3 100644
--- a/src/racoon/session.c
+++ b/src/racoon/session.c
@@ -1,11 +1,11 @@
-/*	$NetBSD: session.c,v 1.7.6.2 2007/08/01 11:52:22 vanhu Exp $	*/
+/*	$NetBSD: session.c,v 1.32 2011/03/02 15:09:16 vanhu Exp $	*/
 
 /*	$KAME: session.c,v 1.32 2003/09/24 02:01:17 jinmei Exp $	*/
 
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  * All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -17,7 +17,7 @@
  * 3. Neither the name of the project nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -59,6 +59,7 @@
 #include <signal.h>
 #include <sys/stat.h>
 #include <paths.h>
+#include <err.h>
 
 #include <netinet/in.h>
 #include <resolv.h>
@@ -77,6 +78,8 @@
 #include "evt.h"
 #include "cfparse_proto.h"
 #include "isakmp_var.h"
+#include "isakmp.h"
+#include "isakmp_var.h"
 #include "isakmp_xauth.h"
 #include "isakmp_cfg.h"
 #include "admin_var.h"
@@ -88,80 +91,174 @@
 #include "localconf.h"
 #include "remoteconf.h"
 #include "backupsa.h"
+#include "remoteconf.h"
 #ifdef ENABLE_NATT
 #include "nattraversal.h"
 #endif
 
-
 #include "algorithm.h" /* XXX ??? */
 
 #include "sainfo.h"
 
+struct fd_monitor {
+	int (*callback)(void *ctx, int fd);
+	void *ctx;
+	int prio;
+	int fd;
+	TAILQ_ENTRY(fd_monitor) chain;
+};
+
+#define NUM_PRIORITIES 2
+
 static void close_session __P((void));
-static void check_rtsock __P((void *));
 static void initfds __P((void));
 static void init_signal __P((void));
 static int set_signal __P((int sig, RETSIGTYPE (*func) __P((int))));
 static void check_sigreq __P((void));
-static void check_flushsa_stub __P((void *));
 static void check_flushsa __P((void));
 static int close_sockets __P((void));
 
-static fd_set mask0;
-static fd_set maskdying;
+static fd_set preset_mask, active_mask;
+static struct fd_monitor fd_monitors[FD_SETSIZE];
+static TAILQ_HEAD(fd_monitor_list, fd_monitor) fd_monitor_tree[NUM_PRIORITIES];
 static int nfds = 0;
+
 static volatile sig_atomic_t sigreq[NSIG + 1];
-static int dying = 0;
+static struct sched scflushsa = SCHED_INITIALIZER();
+
+void
+monitor_fd(int fd, int (*callback)(void *, int), void *ctx, int priority)
+{
+	if (fd < 0 || fd >= FD_SETSIZE) {
+		plog(LLV_ERROR, LOCATION, NULL, "fd_set overrun");
+		exit(1);
+	}
+
+	FD_SET(fd, &preset_mask);
+	if (fd > nfds)
+		nfds = fd;
+	if (priority <= 0)
+		priority = 0;
+	if (priority >= NUM_PRIORITIES)
+		priority = NUM_PRIORITIES - 1;
+
+	fd_monitors[fd].callback = callback;
+	fd_monitors[fd].ctx = ctx;
+	fd_monitors[fd].prio = priority;
+	fd_monitors[fd].fd = fd;
+	TAILQ_INSERT_TAIL(&fd_monitor_tree[priority],
+			  &fd_monitors[fd], chain);
+}
+
+void
+unmonitor_fd(int fd)
+{
+	if (fd < 0 || fd >= FD_SETSIZE) {
+		plog(LLV_ERROR, LOCATION, NULL, "fd_set overrun");
+		exit(1);
+	}
+
+	if (fd_monitors[fd].callback == NULL)
+		return;
+
+	FD_CLR(fd, &preset_mask);
+	FD_CLR(fd, &active_mask);
+	fd_monitors[fd].callback = NULL;
+	fd_monitors[fd].ctx = NULL;
+	TAILQ_REMOVE(&fd_monitor_tree[fd_monitors[fd].prio],
+		     &fd_monitors[fd], chain);
+}
 
 int
 session(void)
 {
-	fd_set rfds;
 	struct timeval *timeout;
 	int error;
-	struct myaddrs *p;
 	char pid_file[MAXPATHLEN];
 	FILE *fp;
 	pid_t racoon_pid = 0;
-	int i;
+	int i, count;
+	struct fd_monitor *fdm;
+
+	nfds = 0;
+	FD_ZERO(&preset_mask);
+
+	for (i = 0; i < NUM_PRIORITIES; i++)
+		TAILQ_INIT(&fd_monitor_tree[i]);
 
 	/* initialize schedular */
 	sched_init();
-
 	init_signal();
 
+	if (pfkey_init() < 0)
+		errx(1, "failed to initialize pfkey socket");
+
+	if (isakmp_init() < 0)
+		errx(1, "failed to initialize ISAKMP structures");
+
+#ifdef ENABLE_HYBRID
+	if (isakmp_cfg_init(ISAKMP_CFG_INIT_COLD))
+		errx(1, "could not initialize ISAKMP mode config structures");
+#endif
+
+#ifdef HAVE_LIBLDAP
+	if (xauth_ldap_init_conf() != 0)
+		errx(1, "could not initialize ldap config");
+#endif
+
+#ifdef HAVE_LIBRADIUS
+	if (xauth_radius_init_conf(0) != 0)
+		errx(1, "could not initialize radius config");
+#endif
+
+	myaddr_init_lists();
+
+	/*
+	 * in order to prefer the parameters by command line,
+	 * saving some parameters before parsing configuration file.
+	 */
+	save_params();
+	if (cfparse() != 0)
+		errx(1, "failed to parse configuration file.");
+	restore_params();
+
 #ifdef ENABLE_ADMINPORT
 	if (admin_init() < 0)
-		exit(1);
+		errx(1, "failed to initialize admin port socket");
 #endif
 
-	initmyaddr();
 
-	if (isakmp_init() < 0)
-		exit(1);
+#ifdef ENABLE_HYBRID
+	if(isakmp_cfg_config.network4 && isakmp_cfg_config.pool_size == 0)
+		if ((error = isakmp_cfg_resize_pool(ISAKMP_CFG_MAX_CNX)) != 0)
+			return error;
+#endif
 
-	initfds();
+	if (dump_config)
+		dumprmconf();
+
+#ifdef HAVE_LIBRADIUS
+	if (xauth_radius_init() != 0)
+		errx(1, "could not initialize libradius");
+#endif
+
+	if (myaddr_init() != 0)
+		errx(1, "failed to listen to configured addresses");
+	myaddr_sync();
 
 #ifdef ENABLE_NATT
 	natt_keepalive_init ();
 #endif
 
-	if (privsep_init() != 0)
-		exit(1);
-
-	for (i = 0; i <= NSIG; i++)
-		sigreq[i] = 0;
-
 	/* write .pid file */
-	racoon_pid = getpid();
-	if (lcconf->pathinfo[LC_PATHTYPE_PIDFILE] == NULL) 
+	if (lcconf->pathinfo[LC_PATHTYPE_PIDFILE] == NULL)
 		strlcpy(pid_file, _PATH_VARRUN "racoon.pid", MAXPATHLEN);
-	else if (lcconf->pathinfo[LC_PATHTYPE_PIDFILE][0] == '/') 
+	else if (lcconf->pathinfo[LC_PATHTYPE_PIDFILE][0] == '/')
 		strlcpy(pid_file, lcconf->pathinfo[LC_PATHTYPE_PIDFILE], MAXPATHLEN);
 	else {
 		strlcat(pid_file, _PATH_VARRUN, MAXPATHLEN);
 		strlcat(pid_file, lcconf->pathinfo[LC_PATHTYPE_PIDFILE], MAXPATHLEN);
-	} 
+	}
 	fp = fopen(pid_file, "w");
 	if (fp) {
 		if (fchmod(fileno(fp),
@@ -170,19 +267,26 @@
 			fclose(fp);
 			exit(1);
 		}
-		fprintf(fp, "%ld\n", (long)racoon_pid);
-		fclose(fp);
 	} else {
 		plog(LLV_ERROR, LOCATION, NULL,
 			"cannot open %s", pid_file);
 	}
 
-	while (1) {
-		if (dying)
-			rfds = maskdying;
-		else
-			rfds = mask0;
+	if (privsep_init() != 0)
+		exit(1);
 
+	/*
+	 * The fork()'ed privileged side will close its copy of fp.  We wait
+	 * until here to get the correct child pid.
+	 */
+	racoon_pid = getpid();
+	fprintf(fp, "%ld\n", (long)racoon_pid);
+	fclose(fp);
+
+	for (i = 0; i <= NSIG; i++)
+		sigreq[i] = 0;
+
+	while (1) {
 		/*
 		 * asynchronous requests via signal.
 		 * make sure to reset sigreq to 0.
@@ -192,7 +296,11 @@
 		/* scheduling */
 		timeout = schedular();
 
-		error = select(nfds, &rfds, (fd_set *)0, (fd_set *)0, timeout);
+		/* schedular can change select() mask, so we reset
+		 * the working copy here */
+		active_mask = preset_mask;
+
+		error = select(nfds + 1, &active_mask, NULL, NULL, timeout);
 		if (error < 0) {
 			switch (errno) {
 			case EINTR:
@@ -206,28 +314,24 @@
 			/*NOTREACHED*/
 		}
 
-#ifdef ENABLE_ADMINPORT
-		if ((lcconf->sock_admin != -1) &&
-		    (FD_ISSET(lcconf->sock_admin, &rfds)))
-			admin_handler();
-#endif
+		count = 0;
+		for (i = 0; i < NUM_PRIORITIES; i++) {
+			TAILQ_FOREACH(fdm, &fd_monitor_tree[i], chain) {
+				if (!FD_ISSET(fdm->fd, &active_mask))
+					continue;
 
-		for (p = lcconf->myaddrs; p; p = p->next) {
-			if (!p->addr)
-				continue;
-			if (FD_ISSET(p->sock, &rfds))
-				isakmp_handler(p->sock);
+				FD_CLR(fdm->fd, &active_mask);
+				if (fdm->callback != NULL) {
+					fdm->callback(fdm->ctx, fdm->fd);
+					count++;
+				} else
+					plog(LLV_ERROR, LOCATION, NULL,
+					"fd %d set, but no active callback\n", i);
+			}
+			if (count != 0)
+				break;
 		}
 
-		if (FD_ISSET(lcconf->sock_pfkey, &rfds))
-			pfkey_handler();
-
-		if (lcconf->rtsock >= 0 && FD_ISSET(lcconf->rtsock, &rfds)) {
-			if (update_myaddrs() && lcconf->autograbaddr)
-				check_rtsock(NULL);
-			else
-				initfds();
-		}
 	}
 }
 
@@ -235,84 +339,20 @@
 static void
 close_session()
 {
-#ifdef ENABLE_FASTQUIT
+	evt_generic(EVT_RACOON_QUIT, NULL);
+	pfkey_send_flush(lcconf->sock_pfkey, SADB_SATYPE_UNSPEC);
 	flushph2();
-#endif
 	flushph1();
+	flushrmconf();
+	flushsainfo();
 	close_sockets();
 	backupsa_clean();
 
-	plog(LLV_INFO, LOCATION, NULL, "racoon shutdown\n");
+	plog(LLV_INFO, LOCATION, NULL, "racoon process %d shutdown\n", getpid());
+
 	exit(0);
 }
 
-static void
-check_rtsock(unused)
-	void *unused;
-{
-	isakmp_close();
-	grab_myaddrs();
-	autoconf_myaddrsport();
-	isakmp_open();
-
-	/* initialize socket list again */
-	initfds();
-}
-
-static void
-initfds()
-{
-	struct myaddrs *p;
-
-	nfds = 0;
-
-	FD_ZERO(&mask0);
-	FD_ZERO(&maskdying);
-
-#ifdef ENABLE_ADMINPORT
-	if (lcconf->sock_admin != -1) {
-		if (lcconf->sock_admin >= FD_SETSIZE) {
-			plog(LLV_ERROR, LOCATION, NULL, "fd_set overrun\n");
-			exit(1);
-		}
-		FD_SET(lcconf->sock_admin, &mask0);
-		/* XXX should we listen on admin socket when dying ?
-		 */
-#if 0
-		FD_SET(lcconf->sock_admin, &maskdying);
-#endif
-		nfds = (nfds > lcconf->sock_admin ? nfds : lcconf->sock_admin);
-	}
-#endif
-	if (lcconf->sock_pfkey >= FD_SETSIZE) {
-		plog(LLV_ERROR, LOCATION, NULL, "fd_set overrun\n");
-		exit(1);
-	}
-	FD_SET(lcconf->sock_pfkey, &mask0);
-	FD_SET(lcconf->sock_pfkey, &maskdying);
-	nfds = (nfds > lcconf->sock_pfkey ? nfds : lcconf->sock_pfkey);
-	if (lcconf->rtsock >= 0) {
-		if (lcconf->rtsock >= FD_SETSIZE) {
-			plog(LLV_ERROR, LOCATION, NULL, "fd_set overrun\n");
-			exit(1);
-		}
-		FD_SET(lcconf->rtsock, &mask0);
-		nfds = (nfds > lcconf->rtsock ? nfds : lcconf->rtsock);
-	}
-
-	for (p = lcconf->myaddrs; p; p = p->next) {
-		if (!p->addr)
-			continue;
-		if (p->sock >= FD_SETSIZE) {
-			plog(LLV_ERROR, LOCATION, NULL, "fd_set overrun\n");
-			exit(1);
-		}
-		FD_SET(p->sock, &mask0);
-		nfds = (nfds > p->sock ? nfds : p->sock);
-	}
-	nfds++;
-}
-
 static int signals[] = {
 	SIGHUP,
 	SIGINT,
@@ -331,10 +371,7 @@
 signal_handler(sig)
 	int sig;
 {
-	/* Do not just set it to 1, because we may miss some signals by just setting
-	 * values to 0/1
-	 */
-	sigreq[sig]++;
+	sigreq[sig] = 1;
 }
 
 
@@ -345,27 +382,28 @@
 
 #ifdef ENABLE_HYBRID
 	if ((isakmp_cfg_init(ISAKMP_CFG_INIT_WARM)) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL, 
+		plog(LLV_ERROR, LOCATION, NULL,
 		    "ISAKMP mode config structure reset failed, "
 		    "not reloading\n");
 		return;
 	}
 #endif
 
-	save_sainfotree();
+	sainfo_start_reload();
 
 	/* TODO: save / restore / flush old lcconf (?) / rmtree
 	 */
-/*	initlcconf();*/ /* racoon_conf ? ! */
+	rmconf_start_reload();
 
-	save_rmconf();
-	initrmconf();
+#ifdef HAVE_LIBRADIUS
+	/* free and init radius configuration */
+	xauth_radius_init_conf(1);
+#endif
 
-	/* Do a part of pfkey_init() ?
-	 * SPD reload ?
-	 */
-	
+	pfkey_reload();
+
 	save_params();
+	flushlcconf();
 	error = cfparse();
 	if (error != 0){
 		plog(LLV_ERROR, LOCATION, NULL, "config reload failed\n");
@@ -374,19 +412,17 @@
 	}
 	restore_params();
 
-#if 0	
+#if 0
 	if (dump_config)
 		dumprmconf ();
 #endif
 
-	/* 
-	 * init_myaddr() ?
-	 * If running in privilege separation, do not reinitialize
-	 * the IKE listener, as we will not have the right to 
-	 * setsockopt(IP_IPSEC_POLICY). 
-	 */
-	if (geteuid() == 0)
-		check_rtsock(NULL);
+	myaddr_sync();
+
+#ifdef HAVE_LIBRADIUS
+	/* re-initialize radius state */
+	xauth_radius_init();
+#endif
 
 	/* Revalidate ph1 / ph2tree !!!
 	 * update ctdtree if removing some ph1 !
@@ -395,44 +431,33 @@
 	/* Update ctdtree ?
 	 */
 
-	save_sainfotree_flush();
-	save_rmconf_flush();
+	sainfo_finish_reload();
+	rmconf_finish_reload();
 }
 
 static void
 check_sigreq()
 {
-	int sig;
+	int sig, s;
 
-	/* 
-	 * XXX We are not able to tell if we got 
-	 * several time the same signal. This is
-	 * not a problem for the current code, 
-	 * but we shall remember this limitation.
-	 */
 	for (sig = 0; sig <= NSIG; sig++) {
 		if (sigreq[sig] == 0)
 			continue;
+		sigreq[sig] = 0;
 
-		sigreq[sig]--;
 		switch(sig) {
 		case 0:
 			return;
-			
-			/* Catch up childs, mainly scripts.
-			 */
+
 		case SIGCHLD:
-	    {
-			pid_t pid;
-			int s;
-			
-			pid = wait(&s);
-	    }
-		break;
+			/* Reap all pending children */
+			while (waitpid(-1, &s, WNOHANG) > 0)
+				;
+			break;
 
 #ifdef DEBUG_RECORD_MALLOCATION
-		/* 
-		 * XXX This operation is signal handler unsafe and may lead to 
+		/*
+		 * XXX This operation is signal handler unsafe and may lead to
 		 * crashes and security breaches: See Henning Brauer talk at
 		 * EuroBSDCon 2005. Do not run in production with this option
 		 * enabled.
@@ -448,108 +473,31 @@
 			break;
 
 		case SIGINT:
-		case SIGTERM:			
-			plog(LLV_INFO, LOCATION, NULL, 
+		case SIGTERM:
+			plog(LLV_INFO, LOCATION, NULL,
 			    "caught signal %d\n", sig);
-			EVT_PUSH(NULL, NULL, EVTT_RACOON_QUIT, NULL);
-			pfkey_send_flush(lcconf->sock_pfkey, 
-			    SADB_SATYPE_UNSPEC);
-#ifdef ENABLE_FASTQUIT
 			close_session();
-#else
-			sched_new(1, check_flushsa_stub, NULL);
-#endif
-			dying = 1;
 			break;
 
 		default:
-			plog(LLV_INFO, LOCATION, NULL, 
+			plog(LLV_INFO, LOCATION, NULL,
 			    "caught signal %d\n", sig);
 			break;
 		}
 	}
 }
 
-/*
- * waiting the termination of processing until sending DELETE message
- * for all inbound SA will complete.
- */
-static void
-check_flushsa_stub(p)
-	void *p;
-{
-
-	check_flushsa();
-}
-
-static void
-check_flushsa()
-{
-	vchar_t *buf;
-	struct sadb_msg *msg, *end, *next;
-	struct sadb_sa *sa;
-	caddr_t mhp[SADB_EXT_MAX + 1];
-	int n;
-
-	buf = pfkey_dump_sadb(SADB_SATYPE_UNSPEC);
-	if (buf == NULL) {
-		plog(LLV_DEBUG, LOCATION, NULL,
-		    "pfkey_dump_sadb: returned nothing.\n");
-		return;
-	}
-
-	msg = (struct sadb_msg *)buf->v;
-	end = (struct sadb_msg *)(buf->v + buf->l);
-
-	/* counting SA except of dead one. */
-	n = 0;
-	while (msg < end) {
-		if (PFKEY_UNUNIT64(msg->sadb_msg_len) < sizeof(*msg))
-			break;
-		next = (struct sadb_msg *)((caddr_t)msg + PFKEY_UNUNIT64(msg->sadb_msg_len));
-		if (msg->sadb_msg_type != SADB_DUMP) {
-			msg = next;
-			continue;
-		}
-
-		if (pfkey_align(msg, mhp) || pfkey_check(mhp)) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"pfkey_check (%s)\n", ipsec_strerror());
-			msg = next;
-			continue;
-		}
-
-		sa = (struct sadb_sa *)(mhp[SADB_EXT_SA]);
-		if (!sa) {
-			msg = next;
-			continue;
-		}
-
-		if (sa->sadb_sa_state != SADB_SASTATE_DEAD) {
-			n++;
-			msg = next;
-			continue;
-		}
-
-		msg = next;
-	}
-
-	if (buf != NULL)
-		vfree(buf);
-
-	if (n) {
-		sched_new(1, check_flushsa_stub, NULL);
-		return;
-	}
-
-	close_session();
-}
-
 static void
 init_signal()
 {
 	int i;
 
+	/*
+	 * Ignore SIGPIPE as we check the return value of system calls
+	 * that write to pipe-like fds.
+	 */
+	signal(SIGPIPE, SIG_IGN);
+
 	for (i = 0; signals[i] != 0; i++)
 		if (set_signal(signals[i], signal_handler) < 0) {
 			plog(LLV_ERROR, LOCATION, NULL,
@@ -582,7 +530,7 @@
 static int
 close_sockets()
 {
-	isakmp_close();
+	myaddr_close();
 	pfkey_close(lcconf->sock_pfkey);
 #ifdef ENABLE_ADMINPORT
 	(void)admin_close();
diff --git a/src/racoon/session.h b/src/racoon/session.h
index 58799ee..7764c62 100644
--- a/src/racoon/session.h
+++ b/src/racoon/session.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: session.h,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
+/*	$NetBSD: session.h,v 1.9 2010/10/21 06:15:28 tteras Exp $	*/
 
 /* Id: session.h,v 1.3 2004/06/11 16:00:17 ludvigm Exp */
 
@@ -37,4 +37,7 @@
 extern int session __P((void));
 extern RETSIGTYPE signal_handler __P((int));
 
+extern void monitor_fd __P((int fd, int (*callback)(void *, int), void *ctx, int priority));
+extern void unmonitor_fd __P((int fd));
+
 #endif /* _SESSION_H */
diff --git a/src/racoon/sockmisc.c b/src/racoon/sockmisc.c
index 16c949d..48bede1 100644
--- a/src/racoon/sockmisc.c
+++ b/src/racoon/sockmisc.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: sockmisc.c,v 1.8.6.1 2007/08/01 11:52:22 vanhu Exp $	*/
+/*	$NetBSD: sockmisc.c,v 1.19 2011/03/14 17:18:13 tteras Exp $	*/
 
 /* Id: sockmisc.c,v 1.24 2006/05/07 21:32:59 manubsd Exp */
 
@@ -56,117 +56,64 @@
 
 #include "var.h"
 #include "misc.h"
+#include "vmbuf.h"
 #include "plog.h"
 #include "sockmisc.h"
 #include "debug.h"
 #include "gcmalloc.h"
 #include "debugrm.h"
 #include "libpfkey.h"
+#include "isakmp_var.h"
 
-#ifndef IP_IPSEC_POLICY
-#define IP_IPSEC_POLICY 16	/* XXX: from linux/in.h */
-#endif
-
-#ifndef IPV6_IPSEC_POLICY
-#define IPV6_IPSEC_POLICY 34	/* XXX: from linux/???.h per
-				   "Tom Lendacky" <toml@us.ibm.com> */
+#ifdef NOUSE_PRIVSEP
+#define BIND bind
+#define SOCKET socket
+#define SETSOCKOPT setsockopt
+#else
+#include "admin.h"
+#include "privsep.h"
+#define BIND privsep_bind
+#define SOCKET privsep_socket
+#define SETSOCKOPT privsep_setsockopt
 #endif
 
 const int niflags = 0;
 
 /*
- * compare two sockaddr without port number.
- * OUT:	0: equal.
- *	1: not equal.
- */
-int
-cmpsaddrwop(addr1, addr2)
-	const struct sockaddr *addr1;
-	const struct sockaddr *addr2;
-{
-	caddr_t sa1, sa2;
-
-	if (addr1 == 0 && addr2 == 0)
-		return 0;
-	if (addr1 == 0 || addr2 == 0)
-		return 1;
-
-#ifdef __linux__
-	if (addr1->sa_family != addr2->sa_family)
-		return 1;
-#else
-	if (addr1->sa_len != addr2->sa_len
-	 || addr1->sa_family != addr2->sa_family)
-		return 1;
-
-#endif /* __linux__ */
-
-	switch (addr1->sa_family) {
-	case AF_INET:
-		sa1 = (caddr_t)&((struct sockaddr_in *)addr1)->sin_addr;
-		sa2 = (caddr_t)&((struct sockaddr_in *)addr2)->sin_addr;
-		if (memcmp(sa1, sa2, sizeof(struct in_addr)) != 0)
-			return 1;
-		break;
-#ifdef INET6
-	case AF_INET6:
-		sa1 = (caddr_t)&((struct sockaddr_in6 *)addr1)->sin6_addr;
-		sa2 = (caddr_t)&((struct sockaddr_in6 *)addr2)->sin6_addr;
-		if (memcmp(sa1, sa2, sizeof(struct in6_addr)) != 0)
-			return 1;
-		if (((struct sockaddr_in6 *)addr1)->sin6_scope_id !=
-		    ((struct sockaddr_in6 *)addr2)->sin6_scope_id)
-			return 1;
-		break;
-#endif
-	default:
-		return 1;
-	}
-
-	return 0;
-}
-
-/*
  * compare two sockaddr with port, taking care wildcard.
  * addr1 is a subject address, addr2 is in a database entry.
  * OUT:	0: equal.
  *	1: not equal.
  */
 int
-cmpsaddrwild(addr1, addr2)
+cmpsaddr(addr1, addr2)
 	const struct sockaddr *addr1;
 	const struct sockaddr *addr2;
 {
 	caddr_t sa1, sa2;
-	u_short port1, port2;
+	u_short port1 = IPSEC_PORT_ANY;
+	u_short port2 = IPSEC_PORT_ANY;
 
-	if (addr1 == 0 && addr2 == 0)
-		return 0;
-	if (addr1 == 0 || addr2 == 0)
-		return 1;
+	if (addr1 == NULL && addr2 == NULL)
+		return CMPSADDR_MATCH;
 
-#ifdef __linux__
-	if (addr1->sa_family != addr2->sa_family)
-		return 1;
-#else
-	if (addr1->sa_len != addr2->sa_len
-	 || addr1->sa_family != addr2->sa_family)
-		return 1;
+	if (addr1 == NULL || addr2 == NULL)
+		return CMPSADDR_MISMATCH;
 
-#endif /* __linux__ */
+	if (addr1->sa_family != addr2->sa_family ||
+	    sysdep_sa_len(addr1) != sysdep_sa_len(addr2))
+		return CMPSADDR_MISMATCH;
 
 	switch (addr1->sa_family) {
+	case AF_UNSPEC:
+		break;
 	case AF_INET:
 		sa1 = (caddr_t)&((struct sockaddr_in *)addr1)->sin_addr;
 		sa2 = (caddr_t)&((struct sockaddr_in *)addr2)->sin_addr;
 		port1 = ((struct sockaddr_in *)addr1)->sin_port;
 		port2 = ((struct sockaddr_in *)addr2)->sin_port;
-		if (!(port1 == IPSEC_PORT_ANY ||
-		      port2 == IPSEC_PORT_ANY ||
-		      port1 == port2))
-			return 1;
 		if (memcmp(sa1, sa2, sizeof(struct in_addr)) != 0)
-			return 1;
+			return CMPSADDR_MISMATCH;
 		break;
 #ifdef INET6
 	case AF_INET6:
@@ -174,89 +121,31 @@
 		sa2 = (caddr_t)&((struct sockaddr_in6 *)addr2)->sin6_addr;
 		port1 = ((struct sockaddr_in6 *)addr1)->sin6_port;
 		port2 = ((struct sockaddr_in6 *)addr2)->sin6_port;
-		if (!(port1 == IPSEC_PORT_ANY ||
-		      port2 == IPSEC_PORT_ANY ||
-		      port1 == port2))
-			return 1;
 		if (memcmp(sa1, sa2, sizeof(struct in6_addr)) != 0)
-			return 1;
+			return CMPSADDR_MISMATCH;
 		if (((struct sockaddr_in6 *)addr1)->sin6_scope_id !=
 		    ((struct sockaddr_in6 *)addr2)->sin6_scope_id)
-			return 1;
+			return CMPSADDR_MISMATCH;
 		break;
 #endif
 	default:
-		return 1;
+		return CMPSADDR_MISMATCH;
 	}
 
-	return 0;
-}
+	if (port1 == port2)
+		return CMPSADDR_MATCH;
 
-/*
- * compare two sockaddr with strict match on port.
- * OUT:	0: equal.
- *	1: not equal.
- */
-int
-cmpsaddrstrict(addr1, addr2)
-	const struct sockaddr *addr1;
-	const struct sockaddr *addr2;
-{
-	caddr_t sa1, sa2;
-	u_short port1, port2;
+	if (port1 == IPSEC_PORT_ANY ||
+	    port2 == IPSEC_PORT_ANY)
+		return CMPSADDR_WILDPORT_MATCH;
 
-	if (addr1 == 0 && addr2 == 0)
-		return 0;
-	if (addr1 == 0 || addr2 == 0)
-		return 1;
-
-#ifdef __linux__
-	if (addr1->sa_family != addr2->sa_family)
-		return 1;
-#else
-	if (addr1->sa_len != addr2->sa_len
-	 || addr1->sa_family != addr2->sa_family)
-		return 1;
-
-#endif /* __linux__ */
-
-	switch (addr1->sa_family) {
-	case AF_INET:
-		sa1 = (caddr_t)&((struct sockaddr_in *)addr1)->sin_addr;
-		sa2 = (caddr_t)&((struct sockaddr_in *)addr2)->sin_addr;
-		port1 = ((struct sockaddr_in *)addr1)->sin_port;
-		port2 = ((struct sockaddr_in *)addr2)->sin_port;
-		if (port1 != port2)
-			return 1;
-		if (memcmp(sa1, sa2, sizeof(struct in_addr)) != 0)
-			return 1;
-		break;
-#ifdef INET6
-	case AF_INET6:
-		sa1 = (caddr_t)&((struct sockaddr_in6 *)addr1)->sin6_addr;
-		sa2 = (caddr_t)&((struct sockaddr_in6 *)addr2)->sin6_addr;
-		port1 = ((struct sockaddr_in6 *)addr1)->sin6_port;
-		port2 = ((struct sockaddr_in6 *)addr2)->sin6_port;
-		if (port1 != port2)
-			return 1;
-		if (memcmp(sa1, sa2, sizeof(struct in6_addr)) != 0)
-			return 1;
-		if (((struct sockaddr_in6 *)addr1)->sin6_scope_id !=
-		    ((struct sockaddr_in6 *)addr2)->sin6_scope_id)
-			return 1;
-		break;
-#endif
-	default:
-		return 1;
-	}
-
-	return 0;
+	return CMPSADDR_WOP_MATCH;
 }
 
 #ifdef ANDROID_PATCHED
 
 struct sockaddr *getlocaladdr(struct sockaddr *remote)
-{
+{   
     struct sockaddr_storage local;
     socklen_t len = sysdep_sa_len(remote);
     int s = socket(remote->sa_family, SOCK_DGRAM, 0);
@@ -266,13 +155,12 @@
         return NULL;
     }
     close(s);
-    set_port((struct sockaddr *)&local, 0);
     return dupsaddr((struct sockaddr *)&local);
 }
 
 int recvfromto(int s, void *buf, size_t len, int flags, struct sockaddr *from,
                socklen_t *fromlen, struct sockaddr *to, unsigned int *tolen)
-{
+{   
     *tolen = sizeof(struct sockaddr_storage);
     if (getsockname(s, to, (socklen_t *)tolen) == -1) {
         return -1;
@@ -282,7 +170,7 @@
 
 int sendfromto(int s, const void *buf, size_t len, struct sockaddr *from,
                struct sockaddr *to, int count)
-{
+{   
     socklen_t tolen = sysdep_sa_len(to);
     int i;
     for (i = 0; i < count; ++i) {
@@ -294,7 +182,7 @@
 }
 
 int setsockopt_bypass(int s, int family)
-{
+{   
     struct sadb_x_policy p = {
         .sadb_x_policy_len = PFKEY_UNIT64(sizeof(struct sadb_x_policy)),
         .sadb_x_policy_exttype = SADB_X_EXT_POLICY,
@@ -315,7 +203,7 @@
     }
     return 0;
 }
-
+ 
 #else
 
 /* get local address against the destination. */
@@ -335,7 +223,7 @@
 	}
 	
 	/* get real interface received packet */
-	if ((s = socket(remote->sa_family, SOCK_DGRAM, 0)) < 0) {
+	if ((s = SOCKET(remote->sa_family, SOCK_DGRAM, 0)) < 0) {
 		plog(LLV_ERROR, LOCATION, NULL,
 			"socket (%s)\n", strerror(errno));
 		goto err;
@@ -382,8 +270,9 @@
 	u_int *tolen;
 {
 	int otolen;
-	u_int len;
-	struct sockaddr_storage ss;
+	socklen_t slen;
+	int len;
+	union sockaddr_any sa;
 	struct msghdr m;
 	struct cmsghdr *cm;
 	struct iovec iov[2];
@@ -396,8 +285,8 @@
 	struct sockaddr_in6 *sin6;
 #endif
 
-	len = sizeof(ss);
-	if (getsockname(s, (struct sockaddr *)&ss, &len) < 0) {
+	slen = sizeof(sa);
+	if (getsockname(s, &sa.sa, &slen) < 0) {
 		plog(LLV_ERROR, LOCATION, NULL,
 			"getsockname (%s)\n", strerror(errno));
 		return -1;
@@ -430,7 +319,7 @@
 			"cmsg %d %d\n", cm->cmsg_level, cm->cmsg_type);)
 #endif
 #if defined(INET6) && defined(INET6_ADVAPI)
-		if (ss.ss_family == AF_INET6
+		if (sa.sa.sa_family == AF_INET6
 		 && cm->cmsg_level == IPPROTO_IPV6
 		 && cm->cmsg_type == IPV6_PKTINFO
 		 && otolen >= sizeof(*sin6)) {
@@ -449,14 +338,13 @@
 				sin6->sin6_scope_id = pi->ipi6_ifindex;
 			else
 				sin6->sin6_scope_id = 0;
-			sin6->sin6_port =
-				((struct sockaddr_in6 *)&ss)->sin6_port;
+			sin6->sin6_port = sa.sin6.sin6_port;
 			otolen = -1;	/* "to" already set */
 			continue;
 		}
 #endif
 #ifdef __linux__
-		if (ss.ss_family == AF_INET
+		if (sa.sa.sa_family == AF_INET
 		 && cm->cmsg_level == IPPROTO_IP
 		 && cm->cmsg_type == IP_PKTINFO
 		 && otolen >= sizeof(sin)) {
@@ -467,14 +355,13 @@
 			sin->sin_family = AF_INET;
 			memcpy(&sin->sin_addr, &pi->ipi_addr,
 				sizeof(sin->sin_addr));
-			sin->sin_port =
-				((struct sockaddr_in *)&ss)->sin_port;
+			sin->sin_port = sa.sin.sin_port;
 			otolen = -1;	/* "to" already set */
 			continue;
 		}
 #endif
 #if defined(INET6) && defined(IPV6_RECVDSTADDR)
-		if (ss.ss_family == AF_INET6
+		if (sa.sa.sa_family == AF_INET6
 		      && cm->cmsg_level == IPPROTO_IPV6
 		      && cm->cmsg_type == IPV6_RECVDSTADDR
 		      && otolen >= sizeof(*sin6)) {
@@ -485,14 +372,13 @@
 			sin6->sin6_len = sizeof(*sin6);
 			memcpy(&sin6->sin6_addr, CMSG_DATA(cm),
 				sizeof(sin6->sin6_addr));
-			sin6->sin6_port =
-				((struct sockaddr_in6 *)&ss)->sin6_port;
+			sin6->sin6_port = sa.sin6.sin6_port;
 			otolen = -1;	/* "to" already set */
 			continue;
 		}
 #endif
 #ifndef __linux__
-		if (ss.ss_family == AF_INET
+		if (sa.sa.sa_family == AF_INET
 		 && cm->cmsg_level == IPPROTO_IP
 		 && cm->cmsg_type == IP_RECVDSTADDR
 		 && otolen >= sizeof(*sin)) {
@@ -503,7 +389,7 @@
 			sin->sin_len = sizeof(*sin);
 			memcpy(&sin->sin_addr, CMSG_DATA(cm),
 				sizeof(sin->sin_addr));
-			sin->sin_port = ((struct sockaddr_in *)&ss)->sin_port;
+			sin->sin_port = sa.sin.sin_port;
 			otolen = -1;	/* "to" already set */
 			continue;
 		}
@@ -523,7 +409,8 @@
 	struct sockaddr *dst;
 {
 	struct sockaddr_storage ss;
-	u_int len;
+	socklen_t slen;
+	int len = 0;
 	int i;
 
 	if (src->sa_family != dst->sa_family) {
@@ -532,8 +419,8 @@
 		return -1;
 	}
 
-	len = sizeof(ss);
-	if (getsockname(s, (struct sockaddr *)&ss, &len) < 0) {
+	slen = sizeof(ss);
+	if (getsockname(s, (struct sockaddr *)&ss, &slen) < 0) {
 		plog(LLV_ERROR, LOCATION, NULL,
 			"getsockname (%s)\n", strerror(errno));
 		return -1;
@@ -701,7 +588,7 @@
 			 * Better approach is to prepare bind'ed udp sockets for
 			 * each of the interface addresses.
 			 */
-			sendsock = socket(src->sa_family, SOCK_DGRAM, 0);
+			sendsock = SOCKET(src->sa_family, SOCK_DGRAM, 0);
 			if (sendsock < 0) {
 				plog(LLV_ERROR, LOCATION, NULL,
 					"socket (%s)\n", strerror(errno));
@@ -736,7 +623,8 @@
 				return -1;
 			}
 
-			if (bind(sendsock, (struct sockaddr *)src, sysdep_sa_len(src)) < 0) {
+			if (BIND(sendsock, (struct sockaddr *)src,
+				 sysdep_sa_len(src)) < 0) {
 				plog(LLV_ERROR, LOCATION, NULL,
 					"bind 1 (%s)\n", strerror(errno));
 				close(sendsock);
@@ -800,7 +688,7 @@
 			ipsec_strerror());
 		return -1;
 	}
-	if (setsockopt(so, level,
+	if (SETSOCKOPT(so, level,
 	               (level == IPPROTO_IP ?
 	                         IP_IPSEC_POLICY : IPV6_IPSEC_POLICY),
 	               buf, ipsec_get_policylen(buf)) < 0) {
@@ -819,7 +707,7 @@
 			ipsec_strerror());
 		return -1;
 	}
-	if (setsockopt(so, level,
+	if (SETSOCKOPT(so, level,
 	               (level == IPPROTO_IP ?
 	                         IP_IPSEC_POLICY : IPV6_IPSEC_POLICY),
 	               buf, ipsec_get_policylen(buf)) < 0) {
@@ -833,6 +721,8 @@
 	return 0;
 }
 
+#endif
+
 struct sockaddr *
 newsaddr(len)
 	int len;
@@ -858,8 +748,6 @@
 	return new;
 }
 
-#endif
-
 struct sockaddr *
 dupsaddr(src)
 	struct sockaddr *src;
@@ -1114,13 +1002,13 @@
 		free(a2);
 		free(a3);
 	}
-	if (cmpsaddrwop(&sa, &naddr->sa.sa) == 0)
+	if (cmpsaddr(&sa, &naddr->sa.sa) <= CMPSADDR_WOP_MATCH)
 		return naddr->prefix + port_score;
 
 	return -1;
 }
 
-/* Some usefull functions for sockaddr port manipulations. */
+/* Some useful functions for sockaddr port manipulations. */
 u_int16_t
 extract_port (const struct sockaddr *addr)
 {
@@ -1130,6 +1018,8 @@
     return port;
 
   switch (addr->sa_family) {
+    case AF_UNSPEC:
+      break;
     case AF_INET:
       port = ((struct sockaddr_in *)addr)->sin_port;
       break;
diff --git a/src/racoon/sockmisc.h b/src/racoon/sockmisc.h
index a035dec..67bfdaf 100644
--- a/src/racoon/sockmisc.h
+++ b/src/racoon/sockmisc.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: sockmisc.h,v 1.7 2006/09/09 16:22:10 manu Exp $	*/
+/*	$NetBSD: sockmisc.h,v 1.13 2011/03/14 17:18:13 tteras Exp $	*/
 
 /* Id: sockmisc.h,v 1.9 2005/10/05 16:55:41 manubsd Exp */
 
@@ -34,26 +34,34 @@
 #ifndef _SOCKMISC_H
 #define _SOCKMISC_H
 
+#ifndef IP_IPSEC_POLICY
+#define IP_IPSEC_POLICY 16	/* XXX: from linux/in.h */
+#endif
+
+#ifndef IPV6_IPSEC_POLICY
+#define IPV6_IPSEC_POLICY 34	/* XXX: from linux/???.h per
+				   "Tom Lendacky" <toml@us.ibm.com> */
+#endif
+
+union sockaddr_any {
+	struct sockaddr sa;
+	struct sockaddr_in sin;
+	struct sockaddr_in6 sin6;
+};
+
 struct netaddr {
-	union {
-		struct sockaddr sa;
-		struct sockaddr_in sin;
-		struct sockaddr_in6 sin6;
-	} sa;
+	union sockaddr_any sa;
 	unsigned long prefix;
 };
 
 extern const int niflags;
 
-extern int cmpsaddrwop __P((const struct sockaddr *, const struct sockaddr *));
-extern int cmpsaddrwild __P((const struct sockaddr *, const struct sockaddr *));
-extern int cmpsaddrstrict __P((const struct sockaddr *, const struct sockaddr *));
+#define CMPSADDR_MATCH		0
+#define CMPSADDR_WILDPORT_MATCH	1
+#define CMPSADDR_WOP_MATCH	2
+#define CMPSADDR_MISMATCH	3
 
-#ifdef ENABLE_NATT 
-#define CMPSADDR(saddr1, saddr2) cmpsaddrstrict((saddr1), (saddr2))
-#else 
-#define CMPSADDR(saddr1, saddr2) cmpsaddrwop((saddr1), (saddr2))
-#endif
+extern int cmpsaddr __P((const struct sockaddr *, const struct sockaddr *));
 
 extern struct sockaddr *getlocaladdr __P((struct sockaddr *));
 
@@ -81,7 +89,7 @@
 				      const struct netaddr *daddr));
 extern int naddr_score(const struct netaddr *naddr, const struct sockaddr *saddr);
 
-/* Some usefull functions for sockaddr port manipulations. */
+/* Some useful functions for sockaddr port manipulations. */
 extern u_int16_t extract_port __P((const struct sockaddr *addr));
 extern u_int16_t *set_port __P((struct sockaddr *addr, u_int16_t new_port));
 extern u_int16_t *get_port_ptr __P((struct sockaddr *addr));
diff --git a/src/racoon/strnames.c b/src/racoon/strnames.c
index fa5df0f..4906b33 100644
--- a/src/racoon/strnames.c
+++ b/src/racoon/strnames.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: strnames.c,v 1.7.6.1 2007/08/01 11:52:22 vanhu Exp $	*/
+/*	$NetBSD: strnames.c,v 1.9 2008/07/14 05:40:13 tteras Exp $	*/
 
 /*	$KAME: strnames.c,v 1.25 2003/11/13 10:53:26 itojun Exp $	*/
 
@@ -276,6 +276,8 @@
 { ISAKMP_NTYPE_RESPONDER_LIFETIME,	"RESPONDER-LIFETIME",		NULL },
 { ISAKMP_NTYPE_REPLAY_STATUS,		"REPLAY-STATUS",		NULL },
 { ISAKMP_NTYPE_INITIAL_CONTACT,		"INITIAL-CONTACT",		NULL },
+{ ISAKMP_NTYPE_R_U_THERE,		"R-U-THERE",			NULL },
+{ ISAKMP_NTYPE_R_U_THERE_ACK,		"R-U-THERE-ACK",		NULL },
 #ifdef ENABLE_HYBRID
 { ISAKMP_NTYPE_UNITY_HEARTBEAT,		"HEARTBEAT (Unity)",		NULL },
 #endif
diff --git a/src/racoon/throttle.c b/src/racoon/throttle.c
index cd7de1f..84a2d6b 100644
--- a/src/racoon/throttle.c
+++ b/src/racoon/throttle.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: throttle.c,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
+/*	$NetBSD: throttle.c,v 1.7 2011/03/14 17:18:13 tteras Exp $	*/
 
 /* Id: throttle.c,v 1.5 2006/04/05 20:54:50 manubsd Exp */
 
@@ -33,23 +33,10 @@
 
 #include "config.h"
 
-#include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#if TIME_WITH_SYS_TIME
-# include <sys/time.h>
-# include <time.h> 
-#else 
-# if HAVE_SYS_TIME_H
-#  include <sys/time.h>
-# else
-#  include <time.h>
-# endif 
-#endif
 #include <sys/param.h>
 #include <sys/queue.h>
-#include <sys/socket.h>
-
 #include <netinet/in.h>
 #include <resolv.h>
 
@@ -58,21 +45,21 @@
 #include "plog.h"
 #include "throttle.h"
 #include "sockmisc.h"
-#include "libpfkey.h"
 #include "isakmp_var.h"
 #include "isakmp.h"
 #include "isakmp_xauth.h"
 #include "isakmp_cfg.h"
 #include "gcmalloc.h"
 
-struct throttle_list throttle_list = TAILQ_HEAD_INITIALIZER(throttle_list);
-
+static struct throttle_list throttle_list =
+	TAILQ_HEAD_INITIALIZER(throttle_list);
 
 struct throttle_entry *
 throttle_add(addr)
 	struct sockaddr *addr;
 {
 	struct throttle_entry *te;
+	struct timeval now, penalty;
 	size_t len;
 
 	len = sizeof(*te) 
@@ -82,7 +69,11 @@
 	if ((te = racoon_malloc(len)) == NULL)
 		return NULL;
 
-	te->penalty = time(NULL) + isakmp_cfg_config.auth_throttle;
+	sched_get_monotonic_time(&now);
+	penalty.tv_sec = isakmp_cfg_config.auth_throttle;
+	penalty.tv_usec = 0;
+	timeradd(&now, &penalty, &te->penalty_ends);
+
 	memcpy(&te->host, addr, sysdep_sa_len(addr));
 	TAILQ_INSERT_HEAD(&throttle_list, te, next);
 
@@ -95,26 +86,25 @@
 	int authfail;
 {
 	struct throttle_entry *te;
+	struct timeval now, res;
 	int found = 0;
-	time_t now;
 
 	if (isakmp_cfg_config.auth_throttle == 0)
 		return 0;
 
-	now = time(NULL);
-
+	sched_get_monotonic_time(&now);
 restart:
 	RACOON_TAILQ_FOREACH_REVERSE(te, &throttle_list, throttle_list, next) {
-	  /*
-	   * Remove outdated entries 
-	   */
-		if (te->penalty < now) {
+		/*
+		 * Remove outdated entries
+		 */
+		if (timercmp(&te->penalty_ends, &now, <)) {
 			TAILQ_REMOVE(&throttle_list, te, next);
 			racoon_free(te);
 			goto restart;
 		}
-			
-		if (cmpsaddrwop(addr, (struct sockaddr *)&te->host) == 0) {
+
+		if (cmpsaddr(addr, (struct sockaddr *) &te->host) <= CMPSADDR_WOP_MATCH) {
 			found = 1;
 			break;
 		}
@@ -130,8 +120,7 @@
 			if ((te = throttle_add(addr)) == NULL) {
 				plog(LLV_ERROR, LOCATION, NULL, 
 				    "Throttle insertion failed\n");
-				return (time(NULL) 
-				    + isakmp_cfg_config.auth_throttle);
+				return isakmp_cfg_config.auth_throttle;
 			}
 		}
 		return 0;
@@ -140,19 +129,21 @@
 		 * We had a match and auth failed, increase penalty.
 		 */
 		if (authfail) {
-			time_t remaining;
-			time_t new;
+			struct timeval remaining, penalty;
 
-			remaining = te->penalty - now;
-			new = remaining + isakmp_cfg_config.auth_throttle;
-
-			if (new > THROTTLE_PENALTY_MAX)
-				new = THROTTLE_PENALTY_MAX;
-
-			te->penalty = now + new;
+			timersub(&te->penalty_ends, &now, &remaining);
+			penalty.tv_sec = isakmp_cfg_config.auth_throttle;
+			penalty.tv_usec = 0;
+			timeradd(&penalty, &remaining, &res);
+			if (res.tv_sec >= THROTTLE_PENALTY_MAX) {
+				res.tv_sec = THROTTLE_PENALTY_MAX;
+				res.tv_usec = 0;
+			}
+			timeradd(&now, &res, &te->penalty_ends);
 		}
 	}
-	
-	return te->penalty;
+
+	timersub(&te->penalty_ends, &now, &res);
+	return res.tv_sec;
 }
 
diff --git a/src/racoon/throttle.h b/src/racoon/throttle.h
index baa9af5..54a8ed1 100644
--- a/src/racoon/throttle.h
+++ b/src/racoon/throttle.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: throttle.h,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
+/*	$NetBSD: throttle.h,v 1.5 2009/01/23 08:25:07 tteras Exp $	*/
 
 /* Id: throttle.h,v 1.1 2004/11/30 00:46:09 manubsd Exp */
 
@@ -34,8 +34,10 @@
 #ifndef _THROTTLE_H
 #define _THROTTLE_H
 
+#include "schedule.h"
+
 struct throttle_entry {
-	int penalty;
+	struct timeval penalty_ends;
 	TAILQ_ENTRY(throttle_entry) next;
 	struct sockaddr_storage host;
 };
diff --git a/src/racoon/var.h b/src/racoon/var.h
index 8abb1c2..2946a9f 100644
--- a/src/racoon/var.h
+++ b/src/racoon/var.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: var.h,v 1.4.6.1 2007/06/06 15:36:38 vanhu Exp $	*/
+/*	$NetBSD: var.h,v 1.5 2007/06/06 15:37:15 vanhu Exp $	*/
 
 /* Id: var.h,v 1.6 2004/11/20 16:16:59 monas Exp */
 
diff --git a/src/racoon/vendorid.c b/src/racoon/vendorid.c
index 82ddfe4..81297bd 100644
--- a/src/racoon/vendorid.c
+++ b/src/racoon/vendorid.c
@@ -1,4 +1,4 @@
-/*	$NetBSD: vendorid.c,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
+/*	$NetBSD: vendorid.c,v 1.8 2009/09/01 12:22:09 tteras Exp $	*/
 
 /* Id: vendorid.c,v 1.10 2006/02/22 16:10:21 vanhu Exp */
 
@@ -53,6 +53,16 @@
 #include "isakmp.h"
 #include "vendorid.h"
 #include "crypto_openssl.h"
+#include "handler.h"
+#include "remoteconf.h"
+#ifdef ENABLE_NATT
+#include "nattraversal.h"
+#endif
+#ifdef ENABLE_HYBRID
+#include <resolv.h>
+#include "isakmp_xauth.h"
+#include "isakmp_cfg.h"
+#endif
 
 static struct vendor_id all_vendor_ids[] = {
 { VENDORID_IPSEC_TOOLS, "IPSec-Tools" },
@@ -205,7 +215,7 @@
  *
  * gen ... points to Vendor ID payload.
  */
-int
+static int
 check_vendorid(struct isakmp_gen *gen)
 {
 	vchar_t vid, *vidhash;
@@ -238,6 +248,44 @@
 	return (VENDORID_UNKNOWN);
 }
 
+int
+handle_vendorid(struct ph1handle *iph1, struct isakmp_gen *gen)
+{
+	int vid_numeric;
+
+	vid_numeric = check_vendorid(gen);
+	if (vid_numeric == VENDORID_UNKNOWN)
+		return vid_numeric;
+
+	iph1->vendorid_mask |= BIT(vid_numeric);
+
+#ifdef ENABLE_NATT
+	if (natt_vendorid(vid_numeric))
+		natt_handle_vendorid(iph1, vid_numeric);
+#endif
+#ifdef ENABLE_HYBRID
+	switch (vid_numeric) {
+	case VENDORID_XAUTH:
+		iph1->mode_cfg->flags |= ISAKMP_CFG_VENDORID_XAUTH;
+		break;
+	case VENDORID_UNITY:
+		iph1->mode_cfg->flags |= ISAKMP_CFG_VENDORID_UNITY;
+		break;
+	default:
+		break;
+	}
+#endif
+#ifdef ENABLE_DPD
+	if (vid_numeric == VENDORID_DPD &&
+	    (iph1->rmconf == NULL || iph1->rmconf->dpd)) {
+		iph1->dpd_support = 1;
+		plog(LLV_DEBUG, LOCATION, NULL, "remote supports DPD\n");
+	}
+#endif
+
+	return vid_numeric;
+}
+
 static vchar_t * 
 vendorid_fixup(vendorid, vidhash)
 	int vendorid;		 
diff --git a/src/racoon/vendorid.h b/src/racoon/vendorid.h
index 7e2dcda..1774575 100644
--- a/src/racoon/vendorid.h
+++ b/src/racoon/vendorid.h
@@ -1,4 +1,4 @@
-/*	$NetBSD: vendorid.h,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
+/*	$NetBSD: vendorid.h,v 1.6 2009/01/23 08:06:56 tteras Exp $	*/
 
 /* Id: vendorid.h,v 1.11 2006/02/17 14:09:10 vanhu Exp */
 
@@ -34,25 +34,26 @@
 #ifndef _VENDORID_H
 #define _VENDORID_H
 
-/* The unknown vendor ID. */
-#define	VENDORID_UNKNOWN	-1
+#ifndef BIT
+#define BIT(x) (1 << (x))
+#endif
 
+/* The unknown vendor ID. */
+#define VENDORID_UNKNOWN	-1
 
 /* Our default vendor ID. */
-#define	VENDORID_DEFAULT	VENDORID_IPSEC_TOOLS
+#define VENDORID_DEFAULT	VENDORID_IPSEC_TOOLS
 
-#define	VENDORID_IPSEC_TOOLS 0		
+#define VENDORID_IPSEC_TOOLS	0
 
-/*
- * Refer to draft-ietf-ipsec-isakmp-gss-auth-06.txt.
- */
-#define	VENDORID_GSSAPI_LONG	1
-#define	VENDORID_GSSAPI		2
-#define	VENDORID_MS_NT5		3
-#define	VENDOR_SUPPORTS_GSSAPI(x)					\
-	((x) == VENDORID_GSSAPI_LONG ||					\
-	 (x) == VENDORID_GSSAPI ||					\
-	 (x) == VENDORID_MS_NT5)
+/* Refer to draft-ietf-ipsec-isakmp-gss-auth-06.txt. */
+#define VENDORID_GSSAPI_LONG	1
+#define VENDORID_GSSAPI		2
+#define VENDORID_MS_NT5		3
+
+#define VENDORID_GSSAPI_MASK	(BIT(VENDORID_GSSAPI_LONG) | \
+				 BIT(VENDORID_GSSAPI) | \
+				 BIT(VENDORID_MS_NT5))
 
 /* NAT-T support */
 #define VENDORID_NATT_00	4
@@ -70,8 +71,7 @@
 #define VENDORID_NATT_FIRST	VENDORID_NATT_00
 #define VENDORID_NATT_LAST	VENDORID_NATT_RFC
 
-
-#define MAX_NATT_VID_COUNT	(VENDORID_NATT_LAST - VENDORID_NATT_FIRST + 1 )
+#define MAX_NATT_VID_COUNT	(VENDORID_NATT_LAST - VENDORID_NATT_FIRST + 1)
 
 /* Hybrid auth */
 #define VENDORID_XAUTH		15
@@ -88,8 +88,7 @@
  * XXX: do some cleanup to have separate lists for "real" vendors (to complete)
  * and "features" VendorIDs
  */
-#define	VENDORID_KAME		19
-
+#define VENDORID_KAME		19
 
 struct vendor_id {
 	int		id;
@@ -98,7 +97,7 @@
 };
 
 vchar_t *set_vendorid __P((int));
-int check_vendorid __P((struct isakmp_gen *));
+int handle_vendorid __P((struct ph1handle *, struct isakmp_gen *));
 
 void compute_vendorids __P((void));
 const char *vid_string_by_id __P((int id));