diff --git a/Android.bp b/Android.bp
index 0ed452d..c4e2761 100644
--- a/Android.bp
+++ b/Android.bp
@@ -50,80 +50,6 @@
     ],
 }
 
-cc_binary {
-    name: "racoon",
-
-    srcs: [
-        "src/racoon/algorithm.c",
-        "src/racoon/crypto_openssl.c",
-        "src/racoon/genlist.c",
-        "src/racoon/handler.c",
-        "src/racoon/isakmp.c",
-        "src/racoon/isakmp_agg.c",
-        "src/racoon/isakmp_base.c",
-        "src/racoon/isakmp_cfg.c",
-        "src/racoon/isakmp_frag.c",
-        "src/racoon/isakmp_ident.c",
-        "src/racoon/isakmp_inf.c",
-        "src/racoon/isakmp_newg.c",
-        "src/racoon/isakmp_quick.c",
-        "src/racoon/isakmp_unity.c",
-        "src/racoon/isakmp_xauth.c",
-        "src/racoon/ipsec_doi.c",
-        "src/racoon/nattraversal.c",
-        "src/racoon/oakley.c",
-        "src/racoon/pfkey.c",
-        "src/racoon/policy.c",
-        "src/racoon/proposal.c",
-        "src/racoon/remoteconf.c",
-        "src/racoon/schedule.c",
-        "src/racoon/sockmisc.c",
-        "src/racoon/str2val.c",
-        "src/racoon/strnames.c",
-        "src/racoon/vendorid.c",
-        "src/racoon/vmbuf.c",
-        "main.c",
-        "setup.c",
-    ],
-
-    local_include_dirs: [
-        "src/include-glibc",
-        "src/racoon",
-        "src/racoon/missing",
-    ],
-
-    static_libs: ["libipsec"],
-
-    shared_libs: [
-        "libcutils",
-        "liblog",
-        "libcrypto",
-        "libkeystore-engine",
-        "libnetd_client",
-    ],
-
-    cflags: [
-        "-DANDROID_CHANGES",
-        "-DHAVE_CONFIG_H",
-        "-D_BSD_SOURCE=1",
-
-        "-Wno-sign-compare",
-        "-Wno-missing-field-initializers",
-        "-Wno-unused-parameter",
-        "-Wno-pointer-sign",
-        "-Werror",
-
-        // Turn off unused XXX warnings. Should be removed/fixed when syncing with upstream. b/18523687, b/18632512
-        "-Wno-unused-variable",
-        "-Wno-unused-but-set-variable",
-        "-Wno-unused-function",
-        "-Wno-unused-label",
-        "-Wno-unused-value",
-    ],
-
-    init_rc: ["racoon.rc"],
-}
-
 cc_library_static {
     name: "libipsec",
 
diff --git a/Makefile b/Makefile
deleted file mode 100644
index d8c417f..0000000
--- a/Makefile
+++ /dev/null
@@ -1,35 +0,0 @@
-all:
-	gcc -O3 -Wall -o racoon -I. -Isrc/include-glibc -Isrc/libipsec \
-	-Isrc/racoon -Isrc/racoon/missing -DHAVE_CONFIG_H -lcrypto \
-	src/libipsec/pfkey.c \
-	src/libipsec/ipsec_strerror.c \
-	src/racoon/algorithm.c \
-	src/racoon/crypto_openssl.c \
-	src/racoon/genlist.c \
-	src/racoon/handler.c \
-	src/racoon/isakmp.c \
-	src/racoon/isakmp_agg.c \
-	src/racoon/isakmp_base.c \
-	src/racoon/isakmp_cfg.c \
-	src/racoon/isakmp_frag.c \
-	src/racoon/isakmp_ident.c \
-	src/racoon/isakmp_inf.c \
-	src/racoon/isakmp_newg.c \
-	src/racoon/isakmp_quick.c \
-	src/racoon/isakmp_unity.c \
-	src/racoon/isakmp_xauth.c \
-	src/racoon/ipsec_doi.c \
-	src/racoon/nattraversal.c \
-	src/racoon/oakley.c \
-	src/racoon/pfkey.c \
-	src/racoon/policy.c \
-	src/racoon/proposal.c \
-	src/racoon/remoteconf.c \
-	src/racoon/schedule.c \
-	src/racoon/sockmisc.c \
-	src/racoon/str2val.c \
-	src/racoon/strnames.c \
-	src/racoon/vendorid.c \
-	src/racoon/vmbuf.c \
-	main.c \
-	setup.c
diff --git a/README b/README
index 2e4f90a..e366133 100644
--- a/README
+++ b/README
@@ -6,7 +6,6 @@
 
 	- libipsec, a PF_KEYv2 library
 	- setkey, a tool to directly manipulate policies and SAs
-	- racoon, an IKEv1 keying daemon
 
 IPsec-tools were ported to Linux from the KAME project 
 (http://www.kame.net) by Derek Atkins  <derek@ihtfp.com>.
diff --git a/main.c b/main.c
deleted file mode 100644
index 63862c5..0000000
--- a/main.c
+++ /dev/null
@@ -1,243 +0,0 @@
-/*
- * Copyright (C) 2011 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <stdarg.h>
-#include <signal.h>
-#include <poll.h>
-#include <unistd.h>
-
-#include "config.h"
-#include "gcmalloc.h"
-#include "schedule.h"
-#include "plog.h"
-
-#ifdef ANDROID_CHANGES
-
-#include <string.h>
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <sys/ioctl.h>
-#include <sys/stat.h>
-#include <fcntl.h>
-#include <errno.h>
-#include <linux/if.h>
-#include <linux/if_tun.h>
-
-#include <android/log.h>
-#include <cutils/sockets.h>
-#include <private/android_filesystem_config.h>
-
-static void notify_death()
-{
-    creat("/data/misc/vpn/abort", 0);
-}
-
-static int android_get_control_and_arguments(int *argc, char ***argv)
-{
-    static char *args[32];
-    int control;
-    int i;
-
-    atexit(notify_death);
-
-    if ((i = android_get_control_socket("racoon")) == -1) {
-        return -1;
-    }
-    do_plog(LLV_DEBUG, "Waiting for control socket");
-    if (listen(i, 1) == -1 || (control = accept(i, NULL, 0)) == -1) {
-        do_plog(LLV_ERROR, "Cannot get control socket");
-        exit(1);
-    }
-    close(i);
-    fcntl(control, F_SETFD, FD_CLOEXEC);
-
-    args[0] = (*argv)[0];
-    for (i = 1; i < 32; ++i) {
-        unsigned char bytes[2];
-        if (recv(control, &bytes[0], 1, 0) != 1 ||
-                recv(control, &bytes[1], 1, 0) != 1) {
-            do_plog(LLV_ERROR, "Cannot get argument length");
-            exit(1);
-        } else {
-            int length = bytes[0] << 8 | bytes[1];
-            int offset = 0;
-
-            if (length == 0xFFFF) {
-                break;
-            }
-            args[i] = malloc(length + 1);
-            while (offset < length) {
-                int n = recv(control, &args[i][offset], length - offset, 0);
-                if (n > 0) {
-                    offset += n;
-                } else {
-                    do_plog(LLV_ERROR, "Cannot get argument value");
-                    exit(1);
-                }
-            }
-            args[i][length] = 0;
-        }
-    }
-    do_plog(LLV_DEBUG, "Received %d arguments", i - 1);
-
-    *argc = i;
-    *argv = args;
-    return control;
-}
-
-const char *android_hook(char **envp)
-{
-    struct ifreq ifr = {.ifr_flags = IFF_TUN};
-    int tun = open("/dev/tun", 0);
-
-    /* Android does not support INTERNAL_WINS4_LIST, so we just use it. */
-    while (*envp && strncmp(*envp, "INTERNAL_WINS4_LIST=", 20)) {
-        ++envp;
-    }
-    if (!*envp) {
-        do_plog(LLV_ERROR, "Cannot find environment variable\n");
-        exit(1);
-    }
-    if (ioctl(tun, TUNSETIFF, &ifr)) {
-        do_plog(LLV_ERROR, "Cannot allocate TUN: %s\n", strerror(errno));
-        exit(1);
-    }
-    sprintf(*envp, "INTERFACE=%s", ifr.ifr_name);
-    return "/system/bin/ip-up-vpn";
-}
-
-#endif
-
-extern void setup(int argc, char **argv);
-extern void shutdown_session();
-
-static int monitors;
-static void (*callbacks[10])(int fd);
-static struct pollfd pollfds[10];
-
-char *pname;
-
-static void terminate(int signal)
-{
-    exit(1);
-}
-
-static void terminated()
-{
-    do_plog(LLV_INFO, "Bye\n");
-}
-
-void monitor_fd(int fd, void (*callback)(int))
-{
-    if (fd < 0 || monitors == 10) {
-        do_plog(LLV_ERROR, "Cannot monitor fd");
-        exit(1);
-    }
-    callbacks[monitors] = callback;
-    pollfds[monitors].fd = fd;
-    pollfds[monitors].events = callback ? POLLIN : 0;
-    ++monitors;
-}
-
-int main(int argc, char **argv)
-{
-#ifdef ANDROID_CHANGES
-    int control = android_get_control_and_arguments(&argc, &argv);
-
-    if (control != -1) {
-        pname = "%p";
-        monitor_fd(control, NULL);
-    }
-#endif
-
-    do_plog(LLV_INFO, "ipsec-tools 0.7.3 (http://ipsec-tools.sf.net)\n");
-
-    signal(SIGHUP, terminate);
-    signal(SIGINT, terminate);
-    signal(SIGTERM, terminate);
-    signal(SIGPIPE, SIG_IGN);
-    atexit(terminated);
-
-    setup(argc, argv);
-
-#ifdef ANDROID_CHANGES
-    shutdown(control, SHUT_WR);
-#endif
-
-    while (1) {
-        struct timeval *tv = schedular();
-        int timeout = tv->tv_sec * 1000 + tv->tv_usec / 1000 + 1;
-
-        if (poll(pollfds, monitors, timeout) > 0) {
-            int i;
-            for (i = 0; i < monitors; ++i) {
-                if (pollfds[i].revents & POLLHUP) {
-                    do_plog(LLV_INFO, "Connection is closed\n", pollfds[i].fd);
-                    shutdown_session();
-
-                    /* Wait for few seconds to consume late messages. */
-                    sleep(5);
-                    exit(1);
-                }
-                if (pollfds[i].revents & POLLIN) {
-                    callbacks[i](pollfds[i].fd);
-                }
-            }
-        }
-    }
-
-    return 0;
-}
-
-/* plog.h */
-
-void do_plog(int level, char *format, ...)
-{
-    if (level >= 0 && level <= 5) {
-#ifdef ANDROID_CHANGES
-        static int levels[6] = {
-            ANDROID_LOG_ERROR, ANDROID_LOG_WARN, ANDROID_LOG_INFO,
-            ANDROID_LOG_INFO, ANDROID_LOG_DEBUG, ANDROID_LOG_VERBOSE
-        };
-        va_list ap;
-        va_start(ap, format);
-        __android_log_vprint(levels[level], "racoon", format, ap);
-        va_end(ap);
-#else
-        static char *levels = "EWNIDV";
-        fprintf(stderr, "%c: ", levels[level]);
-        va_list ap;
-        va_start(ap, format);
-        vfprintf(stderr, format, ap);
-        va_end(ap);
-#endif
-    }
-}
-
-char *binsanitize(char *data, size_t length)
-{
-    char *output = racoon_malloc(length + 1);
-    if (output) {
-        size_t i;
-        for (i = 0; i < length; ++i) {
-            output[i] = (data[i] < ' ' || data[i] > '~') ? '?' : data[i];
-        }
-        output[length] = '\0';
-    }
-    return output;
-}
diff --git a/racoon.rc b/racoon.rc
deleted file mode 100644
index fdb8823..0000000
--- a/racoon.rc
+++ /dev/null
@@ -1,9 +0,0 @@
-service racoon /system/bin/racoon
-    class main
-    socket racoon stream 600 system system
-    # IKE uses UDP port 500.
-    user vpn
-    group vpn inet
-    capabilities NET_ADMIN NET_BIND_SERVICE NET_RAW
-    disabled
-    oneshot
diff --git a/setup.c b/setup.c
deleted file mode 100644
index 9cbe2f9..0000000
--- a/setup.c
+++ /dev/null
@@ -1,708 +0,0 @@
-/*
- * Copyright (C) 2011 The Android Open Source Project
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-#include <sys/param.h>
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <netinet/in.h>
-#include <netinet/ip.h>
-#include <netdb.h>
-#include <fcntl.h>
-
-#include "config.h"
-#include "gcmalloc.h"
-#include "libpfkey.h"
-#include "var.h"
-#include "isakmp_var.h"
-#include "isakmp.h"
-#include "isakmp_xauth.h"
-#include "vmbuf.h"
-#include "crypto_openssl.h"
-#include "oakley.h"
-#include "ipsec_doi.h"
-#include "algorithm.h"
-#include "vendorid.h"
-#include "schedule.h"
-#include "pfkey.h"
-#include "nattraversal.h"
-#include "proposal.h"
-#include "sainfo.h"
-#include "localconf.h"
-#include "remoteconf.h"
-#include "sockmisc.h"
-#include "grabmyaddr.h"
-#include "plog.h"
-#include "admin.h"
-#include "privsep.h"
-#include "throttle.h"
-#include "misc.h"
-#include "handler.h"
-
-static struct localconf localconf;
-static struct sainfo sainfo;
-static char *pre_shared_key;
-
-static struct sockaddr *targets[2];
-static struct sockaddr *source;
-static struct myaddrs myaddrs[2];
-
-struct localconf *lcconf = &localconf;
-int f_local = 0;
-
-/*****************************************************************************/
-
-static void add_sainfo_algorithm(int class, int algorithm, int length)
-{
-    struct sainfoalg *p = calloc(1, sizeof(struct sainfoalg));
-    p->alg = algorithm;
-    p->encklen = length;
-
-    if (!sainfo.algs[class]) {
-        sainfo.algs[class] = p;
-    } else {
-        struct sainfoalg *q = sainfo.algs[class];
-        while (q->next) {
-            q = q->next;
-        }
-        q->next = p;
-    }
-}
-
-static void add_sainfo() {
-    if (pk_checkalg(algclass_ipsec_auth, algtype_hmac_sha2_512, 0) == 0) {
-        add_sainfo_algorithm(algclass_ipsec_auth, IPSECDOI_ATTR_AUTH_HMAC_SHA2_512, 0);
-    } else {
-        do_plog(LLV_WARNING, "Kernel does not support SHA512, not enabling\n");
-    }
-    if (pk_checkalg(algclass_ipsec_auth, algtype_hmac_sha2_384, 0) == 0) {
-        add_sainfo_algorithm(algclass_ipsec_auth, IPSECDOI_ATTR_AUTH_HMAC_SHA2_384, 0);
-    } else {
-        do_plog(LLV_WARNING, "Kernel does not support SHA384, not enabling\n");
-    }
-    add_sainfo_algorithm(algclass_ipsec_auth, IPSECDOI_ATTR_AUTH_HMAC_SHA1, 0);
-    add_sainfo_algorithm(algclass_ipsec_auth, IPSECDOI_ATTR_AUTH_HMAC_SHA2_256, 0);
-    add_sainfo_algorithm(algclass_ipsec_auth, IPSECDOI_ATTR_AUTH_HMAC_MD5, 0);
-    add_sainfo_algorithm(algclass_ipsec_enc, IPSECDOI_ESP_AES, 256);
-    add_sainfo_algorithm(algclass_ipsec_enc, IPSECDOI_ESP_AES, 128);
-    add_sainfo_algorithm(algclass_ipsec_enc, IPSECDOI_ESP_3DES, 0);
-    add_sainfo_algorithm(algclass_ipsec_enc, IPSECDOI_ESP_DES, 0);
-}
-
-static void set_globals(char *server)
-{
-    struct addrinfo hints = {
-        .ai_flags = AI_NUMERICSERV,
-#ifndef INET6
-        .ai_family = AF_INET,
-#else
-        .ai_family = AF_UNSPEC,
-#endif
-        .ai_socktype = SOCK_DGRAM,
-    };
-    struct addrinfo *info;
-
-    if (getaddrinfo(server, "500", &hints, &info) != 0) {
-        do_plog(LLV_ERROR, "Cannot resolve address: %s\n", server);
-        exit(1);
-    }
-    if (info->ai_next) {
-        do_plog(LLV_WARNING, "Found multiple addresses. Use the first one.\n");
-    }
-    targets[0] = dupsaddr(info->ai_addr);
-    freeaddrinfo(info);
-
-    source = getlocaladdr(targets[0]);
-    if (!source) {
-        do_plog(LLV_ERROR, "Cannot get local address\n");
-        exit(1);
-    }
-    set_port(targets[0], 0);
-    set_port(source, 0);
-
-    myaddrs[0].addr = dupsaddr(source);
-    set_port(myaddrs[0].addr, PORT_ISAKMP);
-    myaddrs[0].sock = -1;
-#ifdef ENABLE_NATT
-    myaddrs[0].next = &myaddrs[1];
-    myaddrs[1].addr = dupsaddr(myaddrs[0].addr);
-    set_port(myaddrs[1].addr, PORT_ISAKMP_NATT);
-    myaddrs[1].sock = -1;
-    myaddrs[1].udp_encap = 1;
-#endif
-
-    localconf.myaddrs = &myaddrs[0];
-    localconf.port_isakmp = PORT_ISAKMP;
-    localconf.port_isakmp_natt = PORT_ISAKMP_NATT;
-    localconf.default_af = AF_INET;
-    localconf.pathinfo[LC_PATHTYPE_CERT] = "./";
-    localconf.pad_random = LC_DEFAULT_PAD_RANDOM;
-    localconf.pad_randomlen = LC_DEFAULT_PAD_RANDOM;
-    localconf.pad_strict = LC_DEFAULT_PAD_STRICT;
-    localconf.pad_excltail = LC_DEFAULT_PAD_EXCLTAIL;
-    localconf.retry_counter = 10;
-    localconf.retry_interval = 3;
-    localconf.count_persend = LC_DEFAULT_COUNT_PERSEND;
-    localconf.secret_size = LC_DEFAULT_SECRETSIZE;
-    localconf.retry_checkph1 = LC_DEFAULT_RETRY_CHECKPH1;
-    localconf.wait_ph2complete = LC_DEFAULT_WAIT_PH2COMPLETE;
-    localconf.natt_ka_interval = LC_DEFAULT_NATT_KA_INTERVAL;
-
-    sainfo.lifetime = IPSECDOI_ATTR_SA_LD_SEC_DEFAULT;
-    sainfo.lifebyte = IPSECDOI_ATTR_SA_LD_KB_MAX;
-
-    memset(script_names, 0, sizeof(script_names));
-}
-
-/*****************************************************************************/
-
-static int policy_match(struct sadb_address *address)
-{
-    if (address) {
-        struct sockaddr *addr = PFKEY_ADDR_SADDR(address);
-        return !cmpsaddrwop(addr, targets[0]) || !cmpsaddrwop(addr, targets[1]);
-    }
-    return 0;
-}
-
-/* flush; spdflush; */
-static void flush()
-{
-    struct sadb_msg *p;
-    int replies = 0;
-    int key = pfkey_open();
-
-    if (pfkey_send_dump(key, SADB_SATYPE_UNSPEC) <= 0 ||
-        pfkey_send_spddump(key) <= 0) {
-        do_plog(LLV_ERROR, "Cannot dump SAD and SPD\n");
-        exit(1);
-    }
-
-    for (p = NULL; replies < 2 && (p = pfkey_recv(key)) != NULL; free(p)) {
-        caddr_t q[SADB_EXT_MAX + 1];
-
-        if (p->sadb_msg_type != SADB_DUMP &&
-            p->sadb_msg_type != SADB_X_SPDDUMP) {
-            continue;
-        }
-        replies += !p->sadb_msg_seq;
-
-        if (p->sadb_msg_errno || pfkey_align(p, q) || pfkey_check(q)) {
-            continue;
-        }
-        if (policy_match((struct sadb_address *)q[SADB_EXT_ADDRESS_SRC]) ||
-            policy_match((struct sadb_address *)q[SADB_EXT_ADDRESS_DST])) {
-            p->sadb_msg_type = (p->sadb_msg_type == SADB_DUMP) ?
-                               SADB_DELETE : SADB_X_SPDDELETE;
-            p->sadb_msg_reserved = 0;
-            p->sadb_msg_seq = 0;
-            pfkey_send(key, p, PFKEY_UNUNIT64(p->sadb_msg_len));
-        }
-    }
-
-    pfkey_close(key);
-}
-
-/* spdadd src dst protocol -P out ipsec esp/transport//require;
- * spdadd dst src protocol -P in  ipsec esp/transport//require;
- * or
- * spdadd src any protocol -P out ipsec esp/tunnel/local-remote/require;
- * spdadd any src protocol -P in  ipsec esp/tunnel/remote-local/require; */
-static void spdadd(struct sockaddr *src, struct sockaddr *dst,
-        int protocol, struct sockaddr *local, struct sockaddr *remote)
-{
-    struct __attribute__((packed)) {
-        struct sadb_x_policy p;
-        struct sadb_x_ipsecrequest q;
-        char addresses[sizeof(struct sockaddr_storage) * 2];
-    } policy;
-
-    struct sockaddr_storage any = {
-#ifndef __linux__
-        .ss_len = src->sa_len,
-#endif
-        .ss_family = src->sa_family,
-    };
-
-    int src_prefix = (src->sa_family == AF_INET) ? 32 : 128;
-    int dst_prefix = src_prefix;
-    int length = 0;
-    int key;
-
-    /* Fill values for outbound policy. */
-    memset(&policy, 0, sizeof(policy));
-    policy.p.sadb_x_policy_exttype = SADB_X_EXT_POLICY;
-    policy.p.sadb_x_policy_type = IPSEC_POLICY_IPSEC;
-    policy.p.sadb_x_policy_dir = IPSEC_DIR_OUTBOUND;
-#ifdef HAVE_PFKEY_POLICY_PRIORITY
-    policy.p.sadb_x_policy_priority = PRIORITY_DEFAULT;
-#endif
-    policy.q.sadb_x_ipsecrequest_proto = IPPROTO_ESP;
-    policy.q.sadb_x_ipsecrequest_mode = IPSEC_MODE_TRANSPORT;
-    policy.q.sadb_x_ipsecrequest_level = IPSEC_LEVEL_REQUIRE;
-
-    /* Deal with tunnel mode. */
-    if (!dst) {
-        int size = sysdep_sa_len(local);
-        memcpy(policy.addresses, local, size);
-        memcpy(&policy.addresses[size], remote, size);
-        length += size + size;
-
-        policy.q.sadb_x_ipsecrequest_mode = IPSEC_MODE_TUNNEL;
-        dst = (struct sockaddr *)&any;
-        dst_prefix = 0;
-
-        /* Also use the source address to filter policies. */
-        targets[1] = dupsaddr(src);
-    }
-
-    /* Fix lengths. */
-    length += sizeof(policy.q);
-    policy.q.sadb_x_ipsecrequest_len = length;
-    length += sizeof(policy.p);
-    policy.p.sadb_x_policy_len = PFKEY_UNIT64(length);
-
-    /* Always do a flush before adding new policies. */
-    flush();
-
-    /* Set outbound policy. */
-    key = pfkey_open();
-    if (pfkey_send_spdadd(key, src, src_prefix, dst, dst_prefix, protocol,
-            (caddr_t)&policy, length, 0) <= 0) {
-        do_plog(LLV_ERROR, "Cannot set outbound policy\n");
-        exit(1);
-    }
-
-    /* Flip values for inbound policy. */
-    policy.p.sadb_x_policy_dir = IPSEC_DIR_INBOUND;
-    if (!dst_prefix) {
-        int size = sysdep_sa_len(local);
-        memcpy(policy.addresses, remote, size);
-        memcpy(&policy.addresses[size], local, size);
-    }
-
-    /* Set inbound policy. */
-    if (pfkey_send_spdadd(key, dst, dst_prefix, src, src_prefix, protocol,
-            (caddr_t)&policy, length, 0) <= 0) {
-        do_plog(LLV_ERROR, "Cannot set inbound policy\n");
-        exit(1);
-    }
-
-    pfkey_close(key);
-    atexit(flush);
-}
-
-/*****************************************************************************/
-
-static void add_proposal(struct remoteconf *remoteconf,
-        int auth, int hash, int encryption, int length)
-{
-    struct isakmpsa *p = racoon_calloc(1, sizeof(struct isakmpsa));
-    p->prop_no = 1;
-    p->lifetime = OAKLEY_ATTR_SA_LD_SEC_DEFAULT;
-    p->enctype = encryption;
-    p->encklen = length;
-    p->authmethod = auth;
-    p->hashtype = hash;
-    p->dh_group = OAKLEY_ATTR_GRP_DESC_MODP1024;
-    p->vendorid = VENDORID_UNKNOWN;
-    p->rmconf = remoteconf;
-
-    if (!remoteconf->proposal) {
-      p->trns_no = 1;
-      remoteconf->proposal = p;
-    } else {
-        struct isakmpsa *q = remoteconf->proposal;
-        while (q->next) {
-            q = q->next;
-        }
-        p->trns_no = q->trns_no + 1;
-        q->next = p;
-    }
-}
-
-static vchar_t *strtovchar(char *string)
-{
-    vchar_t *vchar = string ? vmalloc(strlen(string) + 1) : NULL;
-    if (vchar) {
-        memcpy(vchar->v, string, vchar->l);
-        vchar->l -= 1;
-    }
-    return vchar;
-}
-
-static void set_pre_shared_key(struct remoteconf *remoteconf,
-        char *identifier, char *key)
-{
-    pre_shared_key = key;
-    if (identifier[0]) {
-        remoteconf->idv = strtovchar(identifier);
-        remoteconf->etypes->type = ISAKMP_ETYPE_AGG;
-
-        remoteconf->idvtype = IDTYPE_KEYID;
-        if (strchr(identifier, '.')) {
-            remoteconf->idvtype = IDTYPE_FQDN;
-            if (strchr(identifier, '@')) {
-                remoteconf->idvtype = IDTYPE_USERFQDN;
-            }
-        }
-    }
-}
-
-static void set_certificates(struct remoteconf *remoteconf,
-        char *user_private_key, char *user_certificate,
-        char *ca_certificate, char *server_certificate)
-{
-    remoteconf->myprivfile = user_private_key;
-    remoteconf->mycertfile = user_certificate;
-    if (user_certificate) {
-        remoteconf->idvtype = IDTYPE_ASN1DN;
-    }
-    if (!ca_certificate[0]) {
-        remoteconf->verify_cert = FALSE;
-    } else {
-        remoteconf->cacertfile = ca_certificate;
-    }
-    if (server_certificate[0]) {
-        remoteconf->peerscertfile = server_certificate;
-        remoteconf->getcert_method = ISAKMP_GETCERT_LOCALFILE;
-    }
-}
-
-#ifdef ENABLE_HYBRID
-
-static void set_xauth_and_more(struct remoteconf *remoteconf,
-        char *username, char *password, char *phase1_up, char *script_arg)
-{
-    struct xauth_rmconf *xauth = racoon_calloc(1, sizeof(struct xauth_rmconf));
-    xauth->login = strtovchar(username);
-    xauth->login->l += 1;
-    xauth->pass = strtovchar(password);
-    // Unlike the code that reads login, the code that reads pass does not
-    // strip trailing nulls, so don't add one here.
-    remoteconf->xauth = xauth;
-    remoteconf->mode_cfg = TRUE;
-    remoteconf->script[SCRIPT_PHASE1_UP] = strtovchar(phase1_up);
-    script_names[SCRIPT_PHASE1_UP] = script_arg;
-}
-
-#endif
-
-extern void monitor_fd(int fd, void (*callback)(int));
-
-void add_isakmp_handler(int fd, const char *interface)
-{
-    if (setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE,
-            interface, strlen(interface))) {
-        do_plog(LLV_WARNING, "Cannot bind socket to %s\n", interface);
-    }
-    monitor_fd(fd, (void *)isakmp_handler);
-}
-
-void setup(int argc, char **argv)
-{
-    struct remoteconf *remoteconf = NULL;
-    int auth;
-
-    if (argc > 2) {
-        set_globals(argv[2]);
-
-        /* Initialize everything else. */
-        eay_init();
-        initrmconf();
-        oakley_dhinit();
-        compute_vendorids();
-        sched_init();
-        if (pfkey_init() < 0 || isakmp_init() < 0) {
-            exit(1);
-        }
-        add_sainfo();
-        monitor_fd(localconf.sock_pfkey, (void *)pfkey_handler);
-        add_isakmp_handler(myaddrs[0].sock, argv[1]);
-
-#ifdef ENABLE_NATT
-        add_isakmp_handler(myaddrs[1].sock, argv[1]);
-        natt_keepalive_init();
-#endif
-
-        /* Create remote configuration. */
-        remoteconf = newrmconf();
-        remoteconf->etypes = racoon_calloc(1, sizeof(struct etypes));
-        remoteconf->etypes->type = ISAKMP_ETYPE_IDENT;
-        remoteconf->idvtype = IDTYPE_ADDRESS;
-        remoteconf->ike_frag = TRUE;
-        remoteconf->pcheck_level = PROP_CHECK_CLAIM;
-        remoteconf->certtype = ISAKMP_CERT_X509SIGN;
-        remoteconf->gen_policy = TRUE;
-        remoteconf->nat_traversal = TRUE;
-        remoteconf->dh_group = OAKLEY_ATTR_GRP_DESC_MODP1024;
-        remoteconf->script[SCRIPT_PHASE1_UP] = strtovchar("");
-        remoteconf->script[SCRIPT_PHASE1_DOWN] = strtovchar("");
-        oakley_setdhgroup(remoteconf->dh_group, &remoteconf->dhgrp);
-        remoteconf->remote = dupsaddr(targets[0]);
-    }
-
-    /* Set authentication method and credentials. */
-    if (argc == 7 && !strcmp(argv[3], "udppsk")) {
-        set_pre_shared_key(remoteconf, argv[4], argv[5]);
-        auth = OAKLEY_ATTR_AUTH_METHOD_PSKEY;
-
-        set_port(targets[0], atoi(argv[6]));
-        spdadd(source, targets[0], IPPROTO_UDP, NULL, NULL);
-    } else if (argc == 9 && !strcmp(argv[3], "udprsa")) {
-        set_certificates(remoteconf, argv[4], argv[5], argv[6], argv[7]);
-        auth = OAKLEY_ATTR_AUTH_METHOD_RSASIG;
-
-        set_port(targets[0], atoi(argv[8]));
-        spdadd(source, targets[0], IPPROTO_UDP, NULL, NULL);
-#ifdef ENABLE_HYBRID
-    } else if (argc == 10 && !strcmp(argv[3], "xauthpsk")) {
-        set_pre_shared_key(remoteconf, argv[4], argv[5]);
-        set_xauth_and_more(remoteconf, argv[6], argv[7], argv[8], argv[9]);
-        auth = OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I;
-    } else if (argc == 12 && !strcmp(argv[3], "xauthrsa")) {
-        set_certificates(remoteconf, argv[4], argv[5], argv[6], argv[7]);
-        set_xauth_and_more(remoteconf, argv[8], argv[9], argv[10], argv[11]);
-        auth = OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I;
-    } else if (argc == 10 && !strcmp(argv[3], "hybridrsa")) {
-        set_certificates(remoteconf, NULL, NULL, argv[4], argv[5]);
-        set_xauth_and_more(remoteconf, argv[6], argv[7], argv[8], argv[9]);
-        auth = OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I;
-#endif
-    } else {
-        printf("Usage: %s <interface> <server> [...], where [...] can be:\n"
-                " udppsk    <identifier> <pre-shared-key> <port>; \n"
-                " udprsa    <user-private-key> <user-certificate> \\\n"
-                "           <ca-certificate> <server-certificate> <port>;\n"
-#ifdef ENABLE_HYBRID
-                " xauthpsk  <identifier> <pre-shared-key> \\\n"
-                "           <username> <password> <phase1-up> <script-arg>;\n"
-                " xauthrsa  <user-private-key> <user-certificate> \\\n"
-                "           <ca-certificate> <server-certificate> \\\n"
-                "           <username> <password> <phase1-up> <script-arg>;\n"
-                " hybridrsa <ca-certificate> <server-certificate> \\\n"
-                "           <username> <password> <phase1-up> <script-arg>;\n"
-#endif
-                "", argv[0]);
-        exit(0);
-    }
-
-    /* Add proposals. */
-    add_proposal(remoteconf, auth,
-            OAKLEY_ATTR_HASH_ALG_SHA2_384, OAKLEY_ATTR_ENC_ALG_AES, 256);
-    add_proposal(remoteconf, auth,
-            OAKLEY_ATTR_HASH_ALG_SHA2_256, OAKLEY_ATTR_ENC_ALG_AES, 256);
-    // VPNs to openswan breaks when SHA2_512 is used as the first proposal.
-    // openswan supports SHA2_256 or lower hash alg. With this add_proposal
-    // order, openswan picks SHA2_256 and others pick SHA2_384
-    add_proposal(remoteconf, auth,
-            OAKLEY_ATTR_HASH_ALG_SHA2_512, OAKLEY_ATTR_ENC_ALG_AES, 256);
-    add_proposal(remoteconf, auth,
-            OAKLEY_ATTR_HASH_ALG_SHA, OAKLEY_ATTR_ENC_ALG_AES, 256);
-    add_proposal(remoteconf, auth,
-            OAKLEY_ATTR_HASH_ALG_MD5, OAKLEY_ATTR_ENC_ALG_AES, 256);
-    add_proposal(remoteconf, auth,
-            OAKLEY_ATTR_HASH_ALG_SHA2_512, OAKLEY_ATTR_ENC_ALG_AES, 128);
-    add_proposal(remoteconf, auth,
-            OAKLEY_ATTR_HASH_ALG_SHA2_384, OAKLEY_ATTR_ENC_ALG_AES, 128);
-    add_proposal(remoteconf, auth,
-            OAKLEY_ATTR_HASH_ALG_SHA2_256, OAKLEY_ATTR_ENC_ALG_AES, 128);
-    add_proposal(remoteconf, auth,
-            OAKLEY_ATTR_HASH_ALG_SHA, OAKLEY_ATTR_ENC_ALG_AES, 128);
-    add_proposal(remoteconf, auth,
-            OAKLEY_ATTR_HASH_ALG_MD5, OAKLEY_ATTR_ENC_ALG_AES, 128);
-    add_proposal(remoteconf, auth,
-            OAKLEY_ATTR_HASH_ALG_SHA2_256, OAKLEY_ATTR_ENC_ALG_3DES, 0);
-    add_proposal(remoteconf, auth,
-            OAKLEY_ATTR_HASH_ALG_SHA, OAKLEY_ATTR_ENC_ALG_3DES, 0);
-    add_proposal(remoteconf, auth,
-            OAKLEY_ATTR_HASH_ALG_MD5, OAKLEY_ATTR_ENC_ALG_3DES, 0);
-    add_proposal(remoteconf, auth,
-            OAKLEY_ATTR_HASH_ALG_SHA2_256, OAKLEY_ATTR_ENC_ALG_DES, 0);
-    add_proposal(remoteconf, auth,
-            OAKLEY_ATTR_HASH_ALG_SHA, OAKLEY_ATTR_ENC_ALG_DES, 0);
-    add_proposal(remoteconf, auth,
-            OAKLEY_ATTR_HASH_ALG_MD5, OAKLEY_ATTR_ENC_ALG_DES, 0);
-
-    /* Install remote configuration. */
-    insrmconf(remoteconf);
-
-    /* Start phase 1 negotiation for xauth. */
-    if (remoteconf->xauth) {
-        isakmp_ph1begin_i(remoteconf, remoteconf->remote, source);
-    }
-}
-
-/*****************************************************************************/
-
-/* localconf.h */
-
-vchar_t *getpskbyaddr(struct sockaddr *addr)
-{
-    return strtovchar(pre_shared_key);
-}
-
-vchar_t *getpskbyname(vchar_t *name)
-{
-    return NULL;
-}
-
-void getpathname(char *path, int length, int type, const char *name)
-{
-    if (pname) {
-        snprintf(path, length, pname, name);
-    } else {
-        strncpy(path, name, length);
-    }
-    path[length - 1] = '\0';
-}
-
-/* grabmyaddr.h */
-
-int myaddr_getsport(struct sockaddr *addr)
-{
-    return 0;
-}
-
-int getsockmyaddr(struct sockaddr *addr)
-{
-#ifdef ENABLE_NATT
-    if (!cmpsaddrstrict(addr, myaddrs[1].addr)) {
-        return myaddrs[1].sock;
-    }
-#endif
-    if (!cmpsaddrwop(addr, myaddrs[0].addr)) {
-        return myaddrs[0].sock;
-    }
-    return -1;
-}
-
-/* privsep.h */
-
-int privsep_pfkey_open()
-{
-    return pfkey_open();
-}
-
-void privsep_pfkey_close(int key)
-{
-    pfkey_close(key);
-}
-
-vchar_t *privsep_eay_get_pkcs1privkey(char *file)
-{
-    return eay_get_pkcs1privkey(file);
-}
-
-static char *get_env(char * const *envp, char *key)
-{
-    int length = strlen(key);
-    while (*envp && (strncmp(*envp, key, length) || (*envp)[length] != '=')) {
-        ++envp;
-    }
-    return *envp ? &(*envp)[length + 1] : "";
-}
-
-static int skip_script = 0;
-extern const char *android_hook(char **envp);
-
-int privsep_script_exec(char *script, int name, char * const *envp)
-{
-    if (skip_script) {
-        return 0;
-    }
-    skip_script = 1;
-
-    if (name == SCRIPT_PHASE1_DOWN) {
-        exit(1);
-    }
-    if (script_names[SCRIPT_PHASE1_UP]) {
-        /* Racoon ignores INTERNAL_IP6_ADDRESS, so we only do IPv4. */
-        struct sockaddr *addr4 = str2saddr(get_env(envp, "INTERNAL_ADDR4"),
-                NULL);
-        struct sockaddr *local = str2saddr(get_env(envp, "LOCAL_ADDR"),
-                get_env(envp, "LOCAL_PORT"));
-        struct sockaddr *remote = str2saddr(get_env(envp, "REMOTE_ADDR"),
-                get_env(envp, "REMOTE_PORT"));
-
-        if (addr4 && local && remote) {
-#ifdef ANDROID_CHANGES
-            if (pname) {
-                script = (char *)android_hook((char **)envp);
-            }
-#endif
-            spdadd(addr4, NULL, IPPROTO_IP, local, remote);
-        } else {
-            do_plog(LLV_ERROR, "Cannot get parameters for SPD policy.\n");
-            exit(1);
-        }
-
-        racoon_free(addr4);
-        racoon_free(local);
-        racoon_free(remote);
-        return script_exec(script, name, envp);
-    }
-    return 0;
-}
-
-int privsep_accounting_system(int port, struct sockaddr *addr,
-        char *user, int status)
-{
-    return 0;
-}
-
-int privsep_xauth_login_system(char *user, char *password)
-{
-    return -1;
-}
-
-/* misc.h */
-
-int racoon_hexdump(const void *data, size_t length)
-{
-    return 0;
-}
-
-/* sainfo.h */
-
-struct sainfo *getsainfo(const vchar_t *src, const vchar_t *dst,
-        const vchar_t *peer, int remoteid)
-{
-    return &sainfo;
-}
-
-const char *sainfo2str(const struct sainfo *si)
-{
-    return "*";
-}
-
-/* throttle.h */
-
-int throttle_host(struct sockaddr *addr, int fail)
-{
-    return 0;
-}
-
-void shutdown_session()
-{
-    flushph2();
-    flushph1();
-    isakmp_close();
-    pfkey_close(localconf.sock_pfkey);
-}
diff --git a/src/racoon/MODULE_LICENSE_BSD b/src/racoon/MODULE_LICENSE_BSD
deleted file mode 100644
index e69de29..0000000
--- a/src/racoon/MODULE_LICENSE_BSD
+++ /dev/null
diff --git a/src/racoon/Makefile.am b/src/racoon/Makefile.am
deleted file mode 100644
index 202a18e..0000000
--- a/src/racoon/Makefile.am
+++ /dev/null
@@ -1,127 +0,0 @@
-# Id: Makefile.am,v 1.23 2005/07/01 08:57:50 manubsd Exp
-
-sbin_PROGRAMS = racoon racoonctl plainrsa-gen
-noinst_PROGRAMS = eaytest
-include_racoon_HEADERS = racoonctl.h var.h vmbuf.h misc.h gcmalloc.h admin.h \
-	schedule.h sockmisc.h vmbuf.h isakmp_var.h isakmp.h isakmp_xauth.h \
-	isakmp_cfg.h isakmp_unity.h ipsec_doi.h evt.h
-lib_LTLIBRARIES = libracoon.la
-
-adminsockdir=${localstatedir}/racoon
-
-BUILT_SOURCES = cfparse.h prsa_par.h
-INCLUDES = -I${srcdir}/../libipsec 
-AM_CFLAGS = -D_GNU_SOURCE @GLIBC_BUGS@ -DSYSCONFDIR=\"${sysconfdir}\" \
-	-DADMINPORTDIR=\"${adminsockdir}\"
-AM_LDFLAGS = @EXTRA_CRYPTO@ -lcrypto
-AM_YFLAGS = -d ${$*_YFLAGS}
-AM_LFLAGS = ${$*_LFLAGS}
-
-prsa_par_YFLAGS = -p prsa
-prsa_tok_LFLAGS = -Pprsa -olex.yy.c
-
-MISSING_ALGOS = \
-	missing/crypto/sha2/sha2.c \
-	missing/crypto/rijndael/rijndael-api-fst.c \
-	missing/crypto/rijndael/rijndael-alg-fst.c
-
-racoon_SOURCES = \
-	main.c session.c isakmp.c handler.c \
-	isakmp_ident.c isakmp_agg.c isakmp_base.c \
-	isakmp_quick.c isakmp_inf.c isakmp_newg.c \
-	gssapi.c dnssec.c getcertsbyname.c privsep.c \
-	pfkey.c admin.c evt.c ipsec_doi.c oakley.c grabmyaddr.c vendorid.c \
-	policy.c localconf.c remoteconf.c crypto_openssl.c algorithm.c \
-	proposal.c sainfo.c strnames.c \
-	plog.c logger.c schedule.c str2val.c \
-	safefile.c backupsa.c genlist.c rsalist.c \
-	cftoken.l cfparse.y prsa_tok.l prsa_par.y 
-EXTRA_racoon_SOURCES = isakmp_xauth.c isakmp_cfg.c isakmp_unity.c throttle.c \
-	isakmp_frag.c nattraversal.c security.c $(MISSING_ALGOS)
-racoon_LDADD = $(CRYPTOBJS) $(HYBRID_OBJS) $(NATT_OBJS) $(FRAG_OBJS) $(LEXLIB) \
-	 $(SECCTX_OBJS) vmbuf.o sockmisc.o misc.o ../libipsec/libipsec.la
-racoon_DEPENDENCIES = \
-	$(CRYPTOBJS) $(HYBRID_OBJS) $(NATT_OBJS) $(FRAG_OBJS) $(SECCTX_OBJS) \
-	vmbuf.o sockmisc.o misc.o
-
-racoonctl_SOURCES = racoonctl.c str2val.c 
-racoonctl_LDADD = libracoon.la ../libipsec/libipsec.la 
-
-libracoon_la_SOURCES = kmpstat.c vmbuf.c sockmisc.c misc.c
-
-plainrsa_gen_SOURCES = plainrsa-gen.c plog.c \
-	crypto_openssl.c logger.c 
-EXTRA_plainrsa_gen_SOURCES = $(MISSING_ALGOS)
-plainrsa_gen_LDADD = $(CRYPTOBJS) vmbuf.o misc.o
-plainrsa_gen_DEPENDENCIES = $(CRYPTOBJS) vmbuf.o misc.o
-
-eaytest_SOURCES = eaytest.c plog.c logger.c
-EXTRA_eaytest_SOURCES = missing/crypto/sha2/sha2.c
-eaytest_LDADD =	crypto_openssl_test.o vmbuf.o str2val.o misc_noplog.o \
-	$(CRYPTOBJS)
-eaytest_DEPENDENCIES = crypto_openssl_test.o vmbuf.o str2val.o \
-	misc_noplog.o $(CRYPTOBJS)
-
-noinst_HEADERS = \
-	admin.h           dnssec.h      isakmp_base.h   oakley.h      session.h \
-	admin_var.h       dump.h        isakmp_ident.h  pfkey.h       sockmisc.h \
-	algorithm.h       gcmalloc.h    isakmp_inf.h    plog.h        str2val.h \
-	backupsa.h        gnuc.h        isakmp_newg.h   policy.h      strnames.h \
-	grabmyaddr.h      isakmp_quick.h  proposal.h    var.h         evt.h \
-	gssapi.h          isakmp_var.h	vendorid.h      nattraversal.h\
-	crypto_openssl.h  handler.h     localconf.h     remoteconf.h  vmbuf.h \
-	debug.h           ipsec_doi.h   logger.h        safefile.h \
-	debugrm.h         isakmp.h      misc.h          sainfo.h \
-	dhgroup.h         isakmp_agg.h  netdb_dnssec.h  schedule.h \
-	isakmp_cfg.h      isakmp_xauth.h isakmp_unity.h isakmp_frag.h \
-	throttle.h	  privsep.h \
-	cfparse_proto.h	  cftoken_proto.h genlist.h     rsalist.h \
-	missing/crypto/sha2/sha2.h missing/crypto/rijndael/rijndael_local.h \
-	missing/crypto/rijndael/rijndael-api-fst.h \
-	missing/crypto/rijndael/rijndael-alg-fst.h \
-	missing/crypto/rijndael/rijndael.h
-
-man5_MANS = racoon.conf.5
-man8_MANS = racoon.8 racoonctl.8 plainrsa-gen.8
-
-EXTRA_DIST = \
-   ${man5_MANS} ${man8_MANS} \
-   missing/crypto/rijndael/boxes-fst.dat \
-   doc/FAQ doc/README.certificate doc/README.gssapi doc/README.plainrsa \
-   contrib/sp.pl stats.pl \
-   samples/psk.txt.sample  samples/racoon.conf.sample \
-   samples/psk.txt.in samples/racoon.conf.in \
-   samples/racoon.conf.sample-gssapi samples/racoon.conf.sample-natt \
-   samples/racoon.conf.sample-inherit samples/racoon.conf.sample-plainrsa \
-   samples/roadwarrior/README \
-   samples/roadwarrior/client/phase1-down.sh \
-   samples/roadwarrior/client/phase1-up.sh \
-   samples/roadwarrior/client/racoon.conf \
-   samples/roadwarrior/server/racoon.conf \
-   samples/roadwarrior/server/racoon.conf-radius
-
-TESTS = eaytest
-
-install-exec-local:
-	${mkinstalldirs} $(DESTDIR)${adminsockdir}
-
-# special object rules
-crypto_openssl_test.o: crypto_openssl.c
-	$(COMPILE) -DEAYDEBUG -o crypto_openssl_test.o -c $(srcdir)/crypto_openssl.c
-
-misc_noplog.o: misc.c
-	$(COMPILE) -DNOUSE_PLOG -o misc_noplog.o -c $(srcdir)/misc.c
-
-# missing/*.c
-strdup.o:	$(srcdir)/missing/strdup.c
-	$(COMPILE) -c $(srcdir)/missing/$*.c
-getaddrinfo.o:	$(srcdir)/missing/getaddrinfo.c
-	$(COMPILE) -c $(srcdir)/missing/$*.c
-getnameinfo.o:	$(srcdir)/missing/getnameinfo.c
-	$(COMPILE) -c $(srcdir)/missing/$*.c
-rijndael-api-fst.o: $(srcdir)/missing/crypto/rijndael/rijndael-api-fst.c
-	$(COMPILE) -c $(srcdir)/missing/crypto/rijndael/$*.c
-rijndael-alg-fst.o: $(srcdir)/missing/crypto/rijndael/rijndael-alg-fst.c
-	$(COMPILE) -c $(srcdir)/missing/crypto/rijndael/$*.c
-sha2.o: $(srcdir)/missing/crypto/sha2/sha2.c
-	$(COMPILE) -c $(srcdir)/missing/crypto/sha2/$*.c
diff --git a/src/racoon/Makefile.in b/src/racoon/Makefile.in
deleted file mode 100644
index 47e997b..0000000
--- a/src/racoon/Makefile.in
+++ /dev/null
@@ -1,1000 +0,0 @@
-# Makefile.in generated by automake 1.10.1 from Makefile.am.
-# @configure_input@
-
-# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
-# 2003, 2004, 2005, 2006, 2007, 2008  Free Software Foundation, Inc.
-# This Makefile.in is free software; the Free Software Foundation
-# gives unlimited permission to copy and/or distribute it,
-# with or without modifications, as long as this notice is preserved.
-
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
-# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
-# PARTICULAR PURPOSE.
-
-@SET_MAKE@
-
-# Id: Makefile.am,v 1.23 2005/07/01 08:57:50 manubsd Exp
-
-
-
-VPATH = @srcdir@
-pkgdatadir = $(datadir)/@PACKAGE@
-pkglibdir = $(libdir)/@PACKAGE@
-pkgincludedir = $(includedir)/@PACKAGE@
-am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
-install_sh_DATA = $(install_sh) -c -m 644
-install_sh_PROGRAM = $(install_sh) -c
-install_sh_SCRIPT = $(install_sh) -c
-INSTALL_HEADER = $(INSTALL_DATA)
-transform = $(program_transform_name)
-NORMAL_INSTALL = :
-PRE_INSTALL = :
-POST_INSTALL = :
-NORMAL_UNINSTALL = :
-PRE_UNINSTALL = :
-POST_UNINSTALL = :
-build_triplet = @build@
-host_triplet = @host@
-sbin_PROGRAMS = racoon$(EXEEXT) racoonctl$(EXEEXT) \
-	plainrsa-gen$(EXEEXT)
-noinst_PROGRAMS = eaytest$(EXEEXT)
-TESTS = eaytest$(EXEEXT)
-subdir = src/racoon
-DIST_COMMON = $(include_racoon_HEADERS) $(noinst_HEADERS) \
-	$(srcdir)/Makefile.am $(srcdir)/Makefile.in TODO cfparse.c \
-	cfparse.h cftoken.c prsa_par.c prsa_par.h prsa_tok.c
-ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
-am__aclocal_m4_deps = $(top_srcdir)/acracoon.m4 \
-	$(top_srcdir)/configure.ac
-am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
-	$(ACLOCAL_M4)
-mkinstalldirs = $(install_sh) -d
-CONFIG_HEADER = $(top_builddir)/config.h
-CONFIG_CLEAN_FILES =
-am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
-am__vpath_adj = case $$p in \
-    $(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
-    *) f=$$p;; \
-  esac;
-am__strip_dir = `echo $$p | sed -e 's|^.*/||'`;
-am__installdirs = "$(DESTDIR)$(libdir)" "$(DESTDIR)$(sbindir)" \
-	"$(DESTDIR)$(man5dir)" "$(DESTDIR)$(man8dir)" \
-	"$(DESTDIR)$(include_racoondir)"
-libLTLIBRARIES_INSTALL = $(INSTALL)
-LTLIBRARIES = $(lib_LTLIBRARIES)
-libracoon_la_LIBADD =
-am_libracoon_la_OBJECTS = kmpstat.lo vmbuf.lo sockmisc.lo misc.lo
-libracoon_la_OBJECTS = $(am_libracoon_la_OBJECTS)
-sbinPROGRAMS_INSTALL = $(INSTALL_PROGRAM)
-PROGRAMS = $(noinst_PROGRAMS) $(sbin_PROGRAMS)
-am_eaytest_OBJECTS = eaytest.$(OBJEXT) plog.$(OBJEXT) logger.$(OBJEXT)
-eaytest_OBJECTS = $(am_eaytest_OBJECTS)
-am__DEPENDENCIES_1 =
-am_plainrsa_gen_OBJECTS = plainrsa-gen.$(OBJEXT) plog.$(OBJEXT) \
-	crypto_openssl.$(OBJEXT) logger.$(OBJEXT)
-plainrsa_gen_OBJECTS = $(am_plainrsa_gen_OBJECTS)
-am_racoon_OBJECTS = main.$(OBJEXT) session.$(OBJEXT) isakmp.$(OBJEXT) \
-	handler.$(OBJEXT) isakmp_ident.$(OBJEXT) isakmp_agg.$(OBJEXT) \
-	isakmp_base.$(OBJEXT) isakmp_quick.$(OBJEXT) \
-	isakmp_inf.$(OBJEXT) isakmp_newg.$(OBJEXT) gssapi.$(OBJEXT) \
-	dnssec.$(OBJEXT) getcertsbyname.$(OBJEXT) privsep.$(OBJEXT) \
-	pfkey.$(OBJEXT) admin.$(OBJEXT) evt.$(OBJEXT) \
-	ipsec_doi.$(OBJEXT) oakley.$(OBJEXT) grabmyaddr.$(OBJEXT) \
-	vendorid.$(OBJEXT) policy.$(OBJEXT) localconf.$(OBJEXT) \
-	remoteconf.$(OBJEXT) crypto_openssl.$(OBJEXT) \
-	algorithm.$(OBJEXT) proposal.$(OBJEXT) sainfo.$(OBJEXT) \
-	strnames.$(OBJEXT) plog.$(OBJEXT) logger.$(OBJEXT) \
-	schedule.$(OBJEXT) str2val.$(OBJEXT) safefile.$(OBJEXT) \
-	backupsa.$(OBJEXT) genlist.$(OBJEXT) rsalist.$(OBJEXT) \
-	cftoken.$(OBJEXT) cfparse.$(OBJEXT) prsa_tok.$(OBJEXT) \
-	prsa_par.$(OBJEXT)
-racoon_OBJECTS = $(am_racoon_OBJECTS)
-am_racoonctl_OBJECTS = racoonctl.$(OBJEXT) str2val.$(OBJEXT)
-racoonctl_OBJECTS = $(am_racoonctl_OBJECTS)
-racoonctl_DEPENDENCIES = libracoon.la ../libipsec/libipsec.la
-DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)
-depcomp = $(SHELL) $(top_srcdir)/depcomp
-am__depfiles_maybe = depfiles
-COMPILE = $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) \
-	$(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
-LTCOMPILE = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
-	--mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) \
-	$(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS)
-CCLD = $(CC)
-LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
-	--mode=link $(CCLD) $(AM_CFLAGS) $(CFLAGS) $(AM_LDFLAGS) \
-	$(LDFLAGS) -o $@
-LEXCOMPILE = $(LEX) $(LFLAGS) $(AM_LFLAGS)
-LTLEXCOMPILE = $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
-	--mode=compile $(LEX) $(LFLAGS) $(AM_LFLAGS)
-YLWRAP = $(top_srcdir)/ylwrap
-YACCCOMPILE = $(YACC) $(YFLAGS) $(AM_YFLAGS)
-LTYACCCOMPILE = $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) \
-	--mode=compile $(YACC) $(YFLAGS) $(AM_YFLAGS)
-SOURCES = $(libracoon_la_SOURCES) $(eaytest_SOURCES) \
-	$(EXTRA_eaytest_SOURCES) $(plainrsa_gen_SOURCES) \
-	$(EXTRA_plainrsa_gen_SOURCES) $(racoon_SOURCES) \
-	$(EXTRA_racoon_SOURCES) $(racoonctl_SOURCES)
-DIST_SOURCES = $(libracoon_la_SOURCES) $(eaytest_SOURCES) \
-	$(EXTRA_eaytest_SOURCES) $(plainrsa_gen_SOURCES) \
-	$(EXTRA_plainrsa_gen_SOURCES) $(racoon_SOURCES) \
-	$(EXTRA_racoon_SOURCES) $(racoonctl_SOURCES)
-man5dir = $(mandir)/man5
-man8dir = $(mandir)/man8
-NROFF = nroff
-MANS = $(man5_MANS) $(man8_MANS)
-include_racoonHEADERS_INSTALL = $(INSTALL_HEADER)
-HEADERS = $(include_racoon_HEADERS) $(noinst_HEADERS)
-ETAGS = etags
-CTAGS = ctags
-DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
-ACLOCAL = @ACLOCAL@
-AMTAR = @AMTAR@
-AR = @AR@
-AUTOCONF = @AUTOCONF@
-AUTOHEADER = @AUTOHEADER@
-AUTOMAKE = @AUTOMAKE@
-AWK = @AWK@
-CC = @CC@
-CCDEPMODE = @CCDEPMODE@
-CFLAGS = @CFLAGS@
-CONFIGURE_AMFLAGS = @CONFIGURE_AMFLAGS@
-CPP = @CPP@
-CPPFLAGS = @CPPFLAGS@
-CRYPTOBJS = @CRYPTOBJS@
-CXX = @CXX@
-CXXCPP = @CXXCPP@
-CXXDEPMODE = @CXXDEPMODE@
-CXXFLAGS = @CXXFLAGS@
-CYGPATH_W = @CYGPATH_W@
-DEFS = @DEFS@
-DEPDIR = @DEPDIR@
-DSYMUTIL = @DSYMUTIL@
-ECHO = @ECHO@
-ECHO_C = @ECHO_C@
-ECHO_N = @ECHO_N@
-ECHO_T = @ECHO_T@
-EGREP = @EGREP@
-EXEEXT = @EXEEXT@
-EXTRA_CRYPTO = @EXTRA_CRYPTO@
-F77 = @F77@
-FFLAGS = @FFLAGS@
-FRAG_OBJS = @FRAG_OBJS@
-GLIBC_BUGS = @GLIBC_BUGS@
-GREP = @GREP@
-HYBRID_OBJS = @HYBRID_OBJS@
-INCLUDE_GLIBC = @INCLUDE_GLIBC@
-INSTALL = @INSTALL@
-INSTALL_DATA = @INSTALL_DATA@
-INSTALL_OPTS = @INSTALL_OPTS@
-INSTALL_PROGRAM = @INSTALL_PROGRAM@
-INSTALL_SCRIPT = @INSTALL_SCRIPT@
-INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
-KERNEL_INCLUDE = @KERNEL_INCLUDE@
-KRB5_CONFIG = @KRB5_CONFIG@
-LDFLAGS = @LDFLAGS@
-LEX = @LEX@
-LEXLIB = @LEXLIB@
-LEX_OUTPUT_ROOT = @LEX_OUTPUT_ROOT@
-LIBOBJS = @LIBOBJS@
-LIBS = @LIBS@
-LIBTOOL = @LIBTOOL@
-LN_S = @LN_S@
-LTLIBOBJS = @LTLIBOBJS@
-MAKEINFO = @MAKEINFO@
-MKDIR_P = @MKDIR_P@
-NATT_OBJS = @NATT_OBJS@
-NMEDIT = @NMEDIT@
-OBJEXT = @OBJEXT@
-PACKAGE = @PACKAGE@
-PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
-PACKAGE_NAME = @PACKAGE_NAME@
-PACKAGE_STRING = @PACKAGE_STRING@
-PACKAGE_TARNAME = @PACKAGE_TARNAME@
-PACKAGE_VERSION = @PACKAGE_VERSION@
-PATH_SEPARATOR = @PATH_SEPARATOR@
-RANLIB = @RANLIB@
-RPM = @RPM@
-SECCTX_OBJS = @SECCTX_OBJS@
-SED = @SED@
-SET_MAKE = @SET_MAKE@
-SHELL = @SHELL@
-STRIP = @STRIP@
-VERSION = @VERSION@
-YACC = @YACC@
-YFLAGS = @YFLAGS@
-abs_builddir = @abs_builddir@
-abs_srcdir = @abs_srcdir@
-abs_top_builddir = @abs_top_builddir@
-abs_top_srcdir = @abs_top_srcdir@
-ac_ct_CC = @ac_ct_CC@
-ac_ct_CXX = @ac_ct_CXX@
-ac_ct_F77 = @ac_ct_F77@
-am__include = @am__include@
-am__leading_dot = @am__leading_dot@
-am__quote = @am__quote@
-am__tar = @am__tar@
-am__untar = @am__untar@
-bindir = @bindir@
-build = @build@
-build_alias = @build_alias@
-build_cpu = @build_cpu@
-build_os = @build_os@
-build_vendor = @build_vendor@
-builddir = @builddir@
-datadir = @datadir@
-datarootdir = @datarootdir@
-docdir = @docdir@
-dvidir = @dvidir@
-exec_prefix = @exec_prefix@
-host = @host@
-host_alias = @host_alias@
-host_cpu = @host_cpu@
-host_os = @host_os@
-host_vendor = @host_vendor@
-htmldir = @htmldir@
-include_racoondir = @include_racoondir@
-includedir = @includedir@
-infodir = @infodir@
-install_sh = @install_sh@
-libdir = @libdir@
-libexecdir = @libexecdir@
-localedir = @localedir@
-localstatedir = @localstatedir@
-mandir = @mandir@
-mkdir_p = @mkdir_p@
-oldincludedir = @oldincludedir@
-pdfdir = @pdfdir@
-prefix = @prefix@
-program_transform_name = @program_transform_name@
-psdir = @psdir@
-sbindir = @sbindir@
-sharedstatedir = @sharedstatedir@
-srcdir = @srcdir@
-sysconfdir = @sysconfdir@
-target_alias = @target_alias@
-top_builddir = @top_builddir@
-top_srcdir = @top_srcdir@
-include_racoon_HEADERS = racoonctl.h var.h vmbuf.h misc.h gcmalloc.h admin.h \
-	schedule.h sockmisc.h vmbuf.h isakmp_var.h isakmp.h isakmp_xauth.h \
-	isakmp_cfg.h isakmp_unity.h ipsec_doi.h evt.h
-
-lib_LTLIBRARIES = libracoon.la
-adminsockdir = ${localstatedir}/racoon
-BUILT_SOURCES = cfparse.h prsa_par.h
-INCLUDES = -I${srcdir}/../libipsec 
-AM_CFLAGS = -D_GNU_SOURCE @GLIBC_BUGS@ -DSYSCONFDIR=\"${sysconfdir}\" \
-	-DADMINPORTDIR=\"${adminsockdir}\"
-
-AM_LDFLAGS = @EXTRA_CRYPTO@ -lcrypto
-AM_YFLAGS = -d ${$*_YFLAGS}
-AM_LFLAGS = ${$*_LFLAGS}
-prsa_par_YFLAGS = -p prsa
-prsa_tok_LFLAGS = -Pprsa -olex.yy.c
-MISSING_ALGOS = \
-	missing/crypto/sha2/sha2.c \
-	missing/crypto/rijndael/rijndael-api-fst.c \
-	missing/crypto/rijndael/rijndael-alg-fst.c
-
-racoon_SOURCES = \
-	main.c session.c isakmp.c handler.c \
-	isakmp_ident.c isakmp_agg.c isakmp_base.c \
-	isakmp_quick.c isakmp_inf.c isakmp_newg.c \
-	gssapi.c dnssec.c getcertsbyname.c privsep.c \
-	pfkey.c admin.c evt.c ipsec_doi.c oakley.c grabmyaddr.c vendorid.c \
-	policy.c localconf.c remoteconf.c crypto_openssl.c algorithm.c \
-	proposal.c sainfo.c strnames.c \
-	plog.c logger.c schedule.c str2val.c \
-	safefile.c backupsa.c genlist.c rsalist.c \
-	cftoken.l cfparse.y prsa_tok.l prsa_par.y 
-
-EXTRA_racoon_SOURCES = isakmp_xauth.c isakmp_cfg.c isakmp_unity.c throttle.c \
-	isakmp_frag.c nattraversal.c security.c $(MISSING_ALGOS)
-
-racoon_LDADD = $(CRYPTOBJS) $(HYBRID_OBJS) $(NATT_OBJS) $(FRAG_OBJS) $(LEXLIB) \
-	 $(SECCTX_OBJS) vmbuf.o sockmisc.o misc.o ../libipsec/libipsec.la
-
-racoon_DEPENDENCIES = \
-	$(CRYPTOBJS) $(HYBRID_OBJS) $(NATT_OBJS) $(FRAG_OBJS) $(SECCTX_OBJS) \
-	vmbuf.o sockmisc.o misc.o
-
-racoonctl_SOURCES = racoonctl.c str2val.c 
-racoonctl_LDADD = libracoon.la ../libipsec/libipsec.la 
-libracoon_la_SOURCES = kmpstat.c vmbuf.c sockmisc.c misc.c
-plainrsa_gen_SOURCES = plainrsa-gen.c plog.c \
-	crypto_openssl.c logger.c 
-
-EXTRA_plainrsa_gen_SOURCES = $(MISSING_ALGOS)
-plainrsa_gen_LDADD = $(CRYPTOBJS) vmbuf.o misc.o
-plainrsa_gen_DEPENDENCIES = $(CRYPTOBJS) vmbuf.o misc.o
-eaytest_SOURCES = eaytest.c plog.c logger.c
-EXTRA_eaytest_SOURCES = missing/crypto/sha2/sha2.c
-eaytest_LDADD = crypto_openssl_test.o vmbuf.o str2val.o misc_noplog.o \
-	$(CRYPTOBJS)
-
-eaytest_DEPENDENCIES = crypto_openssl_test.o vmbuf.o str2val.o \
-	misc_noplog.o $(CRYPTOBJS)
-
-noinst_HEADERS = \
-	admin.h           dnssec.h      isakmp_base.h   oakley.h      session.h \
-	admin_var.h       dump.h        isakmp_ident.h  pfkey.h       sockmisc.h \
-	algorithm.h       gcmalloc.h    isakmp_inf.h    plog.h        str2val.h \
-	backupsa.h        gnuc.h        isakmp_newg.h   policy.h      strnames.h \
-	grabmyaddr.h      isakmp_quick.h  proposal.h    var.h         evt.h \
-	gssapi.h          isakmp_var.h	vendorid.h      nattraversal.h\
-	crypto_openssl.h  handler.h     localconf.h     remoteconf.h  vmbuf.h \
-	debug.h           ipsec_doi.h   logger.h        safefile.h \
-	debugrm.h         isakmp.h      misc.h          sainfo.h \
-	dhgroup.h         isakmp_agg.h  netdb_dnssec.h  schedule.h \
-	isakmp_cfg.h      isakmp_xauth.h isakmp_unity.h isakmp_frag.h \
-	throttle.h	  privsep.h \
-	cfparse_proto.h	  cftoken_proto.h genlist.h     rsalist.h \
-	missing/crypto/sha2/sha2.h missing/crypto/rijndael/rijndael_local.h \
-	missing/crypto/rijndael/rijndael-api-fst.h \
-	missing/crypto/rijndael/rijndael-alg-fst.h \
-	missing/crypto/rijndael/rijndael.h
-
-man5_MANS = racoon.conf.5
-man8_MANS = racoon.8 racoonctl.8 plainrsa-gen.8
-EXTRA_DIST = \
-   ${man5_MANS} ${man8_MANS} \
-   missing/crypto/rijndael/boxes-fst.dat \
-   doc/FAQ doc/README.certificate doc/README.gssapi doc/README.plainrsa \
-   contrib/sp.pl stats.pl \
-   samples/psk.txt.sample  samples/racoon.conf.sample \
-   samples/psk.txt.in samples/racoon.conf.in \
-   samples/racoon.conf.sample-gssapi samples/racoon.conf.sample-natt \
-   samples/racoon.conf.sample-inherit samples/racoon.conf.sample-plainrsa \
-   samples/roadwarrior/README \
-   samples/roadwarrior/client/phase1-down.sh \
-   samples/roadwarrior/client/phase1-up.sh \
-   samples/roadwarrior/client/racoon.conf \
-   samples/roadwarrior/server/racoon.conf \
-   samples/roadwarrior/server/racoon.conf-radius
-
-all: $(BUILT_SOURCES)
-	$(MAKE) $(AM_MAKEFLAGS) all-am
-
-.SUFFIXES:
-.SUFFIXES: .c .l .lo .o .obj .y
-$(srcdir)/Makefile.in:  $(srcdir)/Makefile.am  $(am__configure_deps)
-	@for dep in $?; do \
-	  case '$(am__configure_deps)' in \
-	    *$$dep*) \
-	      cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh \
-		&& exit 0; \
-	      exit 1;; \
-	  esac; \
-	done; \
-	echo ' cd $(top_srcdir) && $(AUTOMAKE) --foreign  src/racoon/Makefile'; \
-	cd $(top_srcdir) && \
-	  $(AUTOMAKE) --foreign  src/racoon/Makefile
-.PRECIOUS: Makefile
-Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
-	@case '$?' in \
-	  *config.status*) \
-	    cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
-	  *) \
-	    echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
-	    cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
-	esac;
-
-$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
-	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
-
-$(top_srcdir)/configure:  $(am__configure_deps)
-	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
-$(ACLOCAL_M4):  $(am__aclocal_m4_deps)
-	cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
-install-libLTLIBRARIES: $(lib_LTLIBRARIES)
-	@$(NORMAL_INSTALL)
-	test -z "$(libdir)" || $(MKDIR_P) "$(DESTDIR)$(libdir)"
-	@list='$(lib_LTLIBRARIES)'; for p in $$list; do \
-	  if test -f $$p; then \
-	    f=$(am__strip_dir) \
-	    echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(libLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) '$$p' '$(DESTDIR)$(libdir)/$$f'"; \
-	    $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(libLTLIBRARIES_INSTALL) $(INSTALL_STRIP_FLAG) "$$p" "$(DESTDIR)$(libdir)/$$f"; \
-	  else :; fi; \
-	done
-
-uninstall-libLTLIBRARIES:
-	@$(NORMAL_UNINSTALL)
-	@list='$(lib_LTLIBRARIES)'; for p in $$list; do \
-	  p=$(am__strip_dir) \
-	  echo " $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f '$(DESTDIR)$(libdir)/$$p'"; \
-	  $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=uninstall rm -f "$(DESTDIR)$(libdir)/$$p"; \
-	done
-
-clean-libLTLIBRARIES:
-	-test -z "$(lib_LTLIBRARIES)" || rm -f $(lib_LTLIBRARIES)
-	@list='$(lib_LTLIBRARIES)'; for p in $$list; do \
-	  dir="`echo $$p | sed -e 's|/[^/]*$$||'`"; \
-	  test "$$dir" != "$$p" || dir=.; \
-	  echo "rm -f \"$${dir}/so_locations\""; \
-	  rm -f "$${dir}/so_locations"; \
-	done
-libracoon.la: $(libracoon_la_OBJECTS) $(libracoon_la_DEPENDENCIES) 
-	$(LINK) -rpath $(libdir) $(libracoon_la_OBJECTS) $(libracoon_la_LIBADD) $(LIBS)
-
-clean-noinstPROGRAMS:
-	@list='$(noinst_PROGRAMS)'; for p in $$list; do \
-	  f=`echo $$p|sed 's/$(EXEEXT)$$//'`; \
-	  echo " rm -f $$p $$f"; \
-	  rm -f $$p $$f ; \
-	done
-install-sbinPROGRAMS: $(sbin_PROGRAMS)
-	@$(NORMAL_INSTALL)
-	test -z "$(sbindir)" || $(MKDIR_P) "$(DESTDIR)$(sbindir)"
-	@list='$(sbin_PROGRAMS)'; for p in $$list; do \
-	  p1=`echo $$p|sed 's/$(EXEEXT)$$//'`; \
-	  if test -f $$p \
-	     || test -f $$p1 \
-	  ; then \
-	    f=`echo "$$p1" | sed 's,^.*/,,;$(transform);s/$$/$(EXEEXT)/'`; \
-	   echo " $(INSTALL_PROGRAM_ENV) $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(sbinPROGRAMS_INSTALL) '$$p' '$(DESTDIR)$(sbindir)/$$f'"; \
-	   $(INSTALL_PROGRAM_ENV) $(LIBTOOL) $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=install $(sbinPROGRAMS_INSTALL) "$$p" "$(DESTDIR)$(sbindir)/$$f" || exit 1; \
-	  else :; fi; \
-	done
-
-uninstall-sbinPROGRAMS:
-	@$(NORMAL_UNINSTALL)
-	@list='$(sbin_PROGRAMS)'; for p in $$list; do \
-	  f=`echo "$$p" | sed 's,^.*/,,;s/$(EXEEXT)$$//;$(transform);s/$$/$(EXEEXT)/'`; \
-	  echo " rm -f '$(DESTDIR)$(sbindir)/$$f'"; \
-	  rm -f "$(DESTDIR)$(sbindir)/$$f"; \
-	done
-
-clean-sbinPROGRAMS:
-	@list='$(sbin_PROGRAMS)'; for p in $$list; do \
-	  f=`echo $$p|sed 's/$(EXEEXT)$$//'`; \
-	  echo " rm -f $$p $$f"; \
-	  rm -f $$p $$f ; \
-	done
-eaytest$(EXEEXT): $(eaytest_OBJECTS) $(eaytest_DEPENDENCIES) 
-	@rm -f eaytest$(EXEEXT)
-	$(LINK) $(eaytest_OBJECTS) $(eaytest_LDADD) $(LIBS)
-plainrsa-gen$(EXEEXT): $(plainrsa_gen_OBJECTS) $(plainrsa_gen_DEPENDENCIES) 
-	@rm -f plainrsa-gen$(EXEEXT)
-	$(LINK) $(plainrsa_gen_OBJECTS) $(plainrsa_gen_LDADD) $(LIBS)
-cfparse.h: cfparse.c
-	@if test ! -f $@; then \
-	  rm -f cfparse.c; \
-	  $(MAKE) $(AM_MAKEFLAGS) cfparse.c; \
-	else :; fi
-prsa_par.h: prsa_par.c
-	@if test ! -f $@; then \
-	  rm -f prsa_par.c; \
-	  $(MAKE) $(AM_MAKEFLAGS) prsa_par.c; \
-	else :; fi
-racoon$(EXEEXT): $(racoon_OBJECTS) $(racoon_DEPENDENCIES) 
-	@rm -f racoon$(EXEEXT)
-	$(LINK) $(racoon_OBJECTS) $(racoon_LDADD) $(LIBS)
-racoonctl$(EXEEXT): $(racoonctl_OBJECTS) $(racoonctl_DEPENDENCIES) 
-	@rm -f racoonctl$(EXEEXT)
-	$(LINK) $(racoonctl_OBJECTS) $(racoonctl_LDADD) $(LIBS)
-
-mostlyclean-compile:
-	-rm -f *.$(OBJEXT)
-
-distclean-compile:
-	-rm -f *.tab.c
-
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/admin.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/algorithm.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/backupsa.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/cfparse.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/cftoken.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/crypto_openssl.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/dnssec.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/eaytest.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/evt.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/genlist.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/getcertsbyname.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/grabmyaddr.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/gssapi.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/handler.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ipsec_doi.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/isakmp.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/isakmp_agg.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/isakmp_base.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/isakmp_cfg.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/isakmp_frag.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/isakmp_ident.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/isakmp_inf.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/isakmp_newg.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/isakmp_quick.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/isakmp_unity.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/isakmp_xauth.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/kmpstat.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/localconf.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/logger.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/main.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/misc.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/nattraversal.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/oakley.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/pfkey.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/plainrsa-gen.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/plog.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/policy.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/privsep.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/proposal.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/prsa_par.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/prsa_tok.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/racoonctl.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/remoteconf.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/rijndael-alg-fst.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/rijndael-api-fst.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/rsalist.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/safefile.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/sainfo.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/schedule.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/security.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/session.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/sha2.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/sockmisc.Plo@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/str2val.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/strnames.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/throttle.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/vendorid.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/vmbuf.Plo@am__quote@
-
-.c.o:
-@am__fastdepCC_TRUE@	$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@	mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(COMPILE) -c $<
-
-.c.obj:
-@am__fastdepCC_TRUE@	$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ `$(CYGPATH_W) '$<'`
-@am__fastdepCC_TRUE@	mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='$<' object='$@' libtool=no @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(COMPILE) -c `$(CYGPATH_W) '$<'`
-
-.c.lo:
-@am__fastdepCC_TRUE@	$(LTCOMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
-@am__fastdepCC_TRUE@	mv -f $(DEPDIR)/$*.Tpo $(DEPDIR)/$*.Plo
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='$<' object='$@' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(LTCOMPILE) -c -o $@ $<
-
-sha2.obj: missing/crypto/sha2/sha2.c
-@am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT sha2.obj -MD -MP -MF $(DEPDIR)/sha2.Tpo -c -o sha2.obj `if test -f 'missing/crypto/sha2/sha2.c'; then $(CYGPATH_W) 'missing/crypto/sha2/sha2.c'; else $(CYGPATH_W) '$(srcdir)/missing/crypto/sha2/sha2.c'; fi`
-@am__fastdepCC_TRUE@	mv -f $(DEPDIR)/sha2.Tpo $(DEPDIR)/sha2.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='missing/crypto/sha2/sha2.c' object='sha2.obj' libtool=no @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o sha2.obj `if test -f 'missing/crypto/sha2/sha2.c'; then $(CYGPATH_W) 'missing/crypto/sha2/sha2.c'; else $(CYGPATH_W) '$(srcdir)/missing/crypto/sha2/sha2.c'; fi`
-
-rijndael-api-fst.obj: missing/crypto/rijndael/rijndael-api-fst.c
-@am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT rijndael-api-fst.obj -MD -MP -MF $(DEPDIR)/rijndael-api-fst.Tpo -c -o rijndael-api-fst.obj `if test -f 'missing/crypto/rijndael/rijndael-api-fst.c'; then $(CYGPATH_W) 'missing/crypto/rijndael/rijndael-api-fst.c'; else $(CYGPATH_W) '$(srcdir)/missing/crypto/rijndael/rijndael-api-fst.c'; fi`
-@am__fastdepCC_TRUE@	mv -f $(DEPDIR)/rijndael-api-fst.Tpo $(DEPDIR)/rijndael-api-fst.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='missing/crypto/rijndael/rijndael-api-fst.c' object='rijndael-api-fst.obj' libtool=no @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o rijndael-api-fst.obj `if test -f 'missing/crypto/rijndael/rijndael-api-fst.c'; then $(CYGPATH_W) 'missing/crypto/rijndael/rijndael-api-fst.c'; else $(CYGPATH_W) '$(srcdir)/missing/crypto/rijndael/rijndael-api-fst.c'; fi`
-
-rijndael-alg-fst.obj: missing/crypto/rijndael/rijndael-alg-fst.c
-@am__fastdepCC_TRUE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT rijndael-alg-fst.obj -MD -MP -MF $(DEPDIR)/rijndael-alg-fst.Tpo -c -o rijndael-alg-fst.obj `if test -f 'missing/crypto/rijndael/rijndael-alg-fst.c'; then $(CYGPATH_W) 'missing/crypto/rijndael/rijndael-alg-fst.c'; else $(CYGPATH_W) '$(srcdir)/missing/crypto/rijndael/rijndael-alg-fst.c'; fi`
-@am__fastdepCC_TRUE@	mv -f $(DEPDIR)/rijndael-alg-fst.Tpo $(DEPDIR)/rijndael-alg-fst.Po
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	source='missing/crypto/rijndael/rijndael-alg-fst.c' object='rijndael-alg-fst.obj' libtool=no @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(AM_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o rijndael-alg-fst.obj `if test -f 'missing/crypto/rijndael/rijndael-alg-fst.c'; then $(CYGPATH_W) 'missing/crypto/rijndael/rijndael-alg-fst.c'; else $(CYGPATH_W) '$(srcdir)/missing/crypto/rijndael/rijndael-alg-fst.c'; fi`
-
-.l.c:
-	$(am__skiplex) $(SHELL) $(YLWRAP) $< $(LEX_OUTPUT_ROOT).c $@ -- $(LEXCOMPILE)
-
-.y.c:
-	$(am__skipyacc) $(SHELL) $(YLWRAP) $< y.tab.c $@ y.tab.h $*.h y.output $*.output -- $(YACCCOMPILE)
-
-mostlyclean-libtool:
-	-rm -f *.lo
-
-clean-libtool:
-	-rm -rf .libs _libs
-install-man5: $(man5_MANS) $(man_MANS)
-	@$(NORMAL_INSTALL)
-	test -z "$(man5dir)" || $(MKDIR_P) "$(DESTDIR)$(man5dir)"
-	@list='$(man5_MANS) $(dist_man5_MANS) $(nodist_man5_MANS)'; \
-	l2='$(man_MANS) $(dist_man_MANS) $(nodist_man_MANS)'; \
-	for i in $$l2; do \
-	  case "$$i" in \
-	    *.5*) list="$$list $$i" ;; \
-	  esac; \
-	done; \
-	for i in $$list; do \
-	  if test -f $(srcdir)/$$i; then file=$(srcdir)/$$i; \
-	  else file=$$i; fi; \
-	  ext=`echo $$i | sed -e 's/^.*\\.//'`; \
-	  case "$$ext" in \
-	    5*) ;; \
-	    *) ext='5' ;; \
-	  esac; \
-	  inst=`echo $$i | sed -e 's/\\.[0-9a-z]*$$//'`; \
-	  inst=`echo $$inst | sed -e 's/^.*\///'`; \
-	  inst=`echo $$inst | sed '$(transform)'`.$$ext; \
-	  echo " $(INSTALL_DATA) '$$file' '$(DESTDIR)$(man5dir)/$$inst'"; \
-	  $(INSTALL_DATA) "$$file" "$(DESTDIR)$(man5dir)/$$inst"; \
-	done
-uninstall-man5:
-	@$(NORMAL_UNINSTALL)
-	@list='$(man5_MANS) $(dist_man5_MANS) $(nodist_man5_MANS)'; \
-	l2='$(man_MANS) $(dist_man_MANS) $(nodist_man_MANS)'; \
-	for i in $$l2; do \
-	  case "$$i" in \
-	    *.5*) list="$$list $$i" ;; \
-	  esac; \
-	done; \
-	for i in $$list; do \
-	  ext=`echo $$i | sed -e 's/^.*\\.//'`; \
-	  case "$$ext" in \
-	    5*) ;; \
-	    *) ext='5' ;; \
-	  esac; \
-	  inst=`echo $$i | sed -e 's/\\.[0-9a-z]*$$//'`; \
-	  inst=`echo $$inst | sed -e 's/^.*\///'`; \
-	  inst=`echo $$inst | sed '$(transform)'`.$$ext; \
-	  echo " rm -f '$(DESTDIR)$(man5dir)/$$inst'"; \
-	  rm -f "$(DESTDIR)$(man5dir)/$$inst"; \
-	done
-install-man8: $(man8_MANS) $(man_MANS)
-	@$(NORMAL_INSTALL)
-	test -z "$(man8dir)" || $(MKDIR_P) "$(DESTDIR)$(man8dir)"
-	@list='$(man8_MANS) $(dist_man8_MANS) $(nodist_man8_MANS)'; \
-	l2='$(man_MANS) $(dist_man_MANS) $(nodist_man_MANS)'; \
-	for i in $$l2; do \
-	  case "$$i" in \
-	    *.8*) list="$$list $$i" ;; \
-	  esac; \
-	done; \
-	for i in $$list; do \
-	  if test -f $(srcdir)/$$i; then file=$(srcdir)/$$i; \
-	  else file=$$i; fi; \
-	  ext=`echo $$i | sed -e 's/^.*\\.//'`; \
-	  case "$$ext" in \
-	    8*) ;; \
-	    *) ext='8' ;; \
-	  esac; \
-	  inst=`echo $$i | sed -e 's/\\.[0-9a-z]*$$//'`; \
-	  inst=`echo $$inst | sed -e 's/^.*\///'`; \
-	  inst=`echo $$inst | sed '$(transform)'`.$$ext; \
-	  echo " $(INSTALL_DATA) '$$file' '$(DESTDIR)$(man8dir)/$$inst'"; \
-	  $(INSTALL_DATA) "$$file" "$(DESTDIR)$(man8dir)/$$inst"; \
-	done
-uninstall-man8:
-	@$(NORMAL_UNINSTALL)
-	@list='$(man8_MANS) $(dist_man8_MANS) $(nodist_man8_MANS)'; \
-	l2='$(man_MANS) $(dist_man_MANS) $(nodist_man_MANS)'; \
-	for i in $$l2; do \
-	  case "$$i" in \
-	    *.8*) list="$$list $$i" ;; \
-	  esac; \
-	done; \
-	for i in $$list; do \
-	  ext=`echo $$i | sed -e 's/^.*\\.//'`; \
-	  case "$$ext" in \
-	    8*) ;; \
-	    *) ext='8' ;; \
-	  esac; \
-	  inst=`echo $$i | sed -e 's/\\.[0-9a-z]*$$//'`; \
-	  inst=`echo $$inst | sed -e 's/^.*\///'`; \
-	  inst=`echo $$inst | sed '$(transform)'`.$$ext; \
-	  echo " rm -f '$(DESTDIR)$(man8dir)/$$inst'"; \
-	  rm -f "$(DESTDIR)$(man8dir)/$$inst"; \
-	done
-install-include_racoonHEADERS: $(include_racoon_HEADERS)
-	@$(NORMAL_INSTALL)
-	test -z "$(include_racoondir)" || $(MKDIR_P) "$(DESTDIR)$(include_racoondir)"
-	@list='$(include_racoon_HEADERS)'; for p in $$list; do \
-	  if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
-	  f=$(am__strip_dir) \
-	  echo " $(include_racoonHEADERS_INSTALL) '$$d$$p' '$(DESTDIR)$(include_racoondir)/$$f'"; \
-	  $(include_racoonHEADERS_INSTALL) "$$d$$p" "$(DESTDIR)$(include_racoondir)/$$f"; \
-	done
-
-uninstall-include_racoonHEADERS:
-	@$(NORMAL_UNINSTALL)
-	@list='$(include_racoon_HEADERS)'; for p in $$list; do \
-	  f=$(am__strip_dir) \
-	  echo " rm -f '$(DESTDIR)$(include_racoondir)/$$f'"; \
-	  rm -f "$(DESTDIR)$(include_racoondir)/$$f"; \
-	done
-
-ID: $(HEADERS) $(SOURCES) $(LISP) $(TAGS_FILES)
-	list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
-	unique=`for i in $$list; do \
-	    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
-	  done | \
-	  $(AWK) '{ files[$$0] = 1; nonemtpy = 1; } \
-	      END { if (nonempty) { for (i in files) print i; }; }'`; \
-	mkid -fID $$unique
-tags: TAGS
-
-TAGS:  $(HEADERS) $(SOURCES)  $(TAGS_DEPENDENCIES) \
-		$(TAGS_FILES) $(LISP)
-	tags=; \
-	here=`pwd`; \
-	list='$(SOURCES) $(HEADERS)  $(LISP) $(TAGS_FILES)'; \
-	unique=`for i in $$list; do \
-	    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
-	  done | \
-	  $(AWK) '{ files[$$0] = 1; nonempty = 1; } \
-	      END { if (nonempty) { for (i in files) print i; }; }'`; \
-	if test -z "$(ETAGS_ARGS)$$tags$$unique"; then :; else \
-	  test -n "$$unique" || unique=$$empty_fix; \
-	  $(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
-	    $$tags $$unique; \
-	fi
-ctags: CTAGS
-CTAGS:  $(HEADERS) $(SOURCES)  $(TAGS_DEPENDENCIES) \
-		$(TAGS_FILES) $(LISP)
-	tags=; \
-	list='$(SOURCES) $(HEADERS)  $(LISP) $(TAGS_FILES)'; \
-	unique=`for i in $$list; do \
-	    if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
-	  done | \
-	  $(AWK) '{ files[$$0] = 1; nonempty = 1; } \
-	      END { if (nonempty) { for (i in files) print i; }; }'`; \
-	test -z "$(CTAGS_ARGS)$$tags$$unique" \
-	  || $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
-	     $$tags $$unique
-
-GTAGS:
-	here=`$(am__cd) $(top_builddir) && pwd` \
-	  && cd $(top_srcdir) \
-	  && gtags -i $(GTAGS_ARGS) $$here
-
-distclean-tags:
-	-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
-
-check-TESTS: $(TESTS)
-	@failed=0; all=0; xfail=0; xpass=0; skip=0; ws='[	 ]'; \
-	srcdir=$(srcdir); export srcdir; \
-	list=' $(TESTS) '; \
-	if test -n "$$list"; then \
-	  for tst in $$list; do \
-	    if test -f ./$$tst; then dir=./; \
-	    elif test -f $$tst; then dir=; \
-	    else dir="$(srcdir)/"; fi; \
-	    if $(TESTS_ENVIRONMENT) $${dir}$$tst; then \
-	      all=`expr $$all + 1`; \
-	      case " $(XFAIL_TESTS) " in \
-	      *$$ws$$tst$$ws*) \
-		xpass=`expr $$xpass + 1`; \
-		failed=`expr $$failed + 1`; \
-		echo "XPASS: $$tst"; \
-	      ;; \
-	      *) \
-		echo "PASS: $$tst"; \
-	      ;; \
-	      esac; \
-	    elif test $$? -ne 77; then \
-	      all=`expr $$all + 1`; \
-	      case " $(XFAIL_TESTS) " in \
-	      *$$ws$$tst$$ws*) \
-		xfail=`expr $$xfail + 1`; \
-		echo "XFAIL: $$tst"; \
-	      ;; \
-	      *) \
-		failed=`expr $$failed + 1`; \
-		echo "FAIL: $$tst"; \
-	      ;; \
-	      esac; \
-	    else \
-	      skip=`expr $$skip + 1`; \
-	      echo "SKIP: $$tst"; \
-	    fi; \
-	  done; \
-	  if test "$$failed" -eq 0; then \
-	    if test "$$xfail" -eq 0; then \
-	      banner="All $$all tests passed"; \
-	    else \
-	      banner="All $$all tests behaved as expected ($$xfail expected failures)"; \
-	    fi; \
-	  else \
-	    if test "$$xpass" -eq 0; then \
-	      banner="$$failed of $$all tests failed"; \
-	    else \
-	      banner="$$failed of $$all tests did not behave as expected ($$xpass unexpected passes)"; \
-	    fi; \
-	  fi; \
-	  dashes="$$banner"; \
-	  skipped=""; \
-	  if test "$$skip" -ne 0; then \
-	    skipped="($$skip tests were not run)"; \
-	    test `echo "$$skipped" | wc -c` -le `echo "$$banner" | wc -c` || \
-	      dashes="$$skipped"; \
-	  fi; \
-	  report=""; \
-	  if test "$$failed" -ne 0 && test -n "$(PACKAGE_BUGREPORT)"; then \
-	    report="Please report to $(PACKAGE_BUGREPORT)"; \
-	    test `echo "$$report" | wc -c` -le `echo "$$banner" | wc -c` || \
-	      dashes="$$report"; \
-	  fi; \
-	  dashes=`echo "$$dashes" | sed s/./=/g`; \
-	  echo "$$dashes"; \
-	  echo "$$banner"; \
-	  test -z "$$skipped" || echo "$$skipped"; \
-	  test -z "$$report" || echo "$$report"; \
-	  echo "$$dashes"; \
-	  test "$$failed" -eq 0; \
-	else :; fi
-
-distdir: $(DISTFILES)
-	@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
-	topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
-	list='$(DISTFILES)'; \
-	  dist_files=`for file in $$list; do echo $$file; done | \
-	  sed -e "s|^$$srcdirstrip/||;t" \
-	      -e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
-	case $$dist_files in \
-	  */*) $(MKDIR_P) `echo "$$dist_files" | \
-			   sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
-			   sort -u` ;; \
-	esac; \
-	for file in $$dist_files; do \
-	  if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
-	  if test -d $$d/$$file; then \
-	    dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
-	    if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
-	      cp -pR $(srcdir)/$$file $(distdir)$$dir || exit 1; \
-	    fi; \
-	    cp -pR $$d/$$file $(distdir)$$dir || exit 1; \
-	  else \
-	    test -f $(distdir)/$$file \
-	    || cp -p $$d/$$file $(distdir)/$$file \
-	    || exit 1; \
-	  fi; \
-	done
-check-am: all-am
-	$(MAKE) $(AM_MAKEFLAGS) check-TESTS
-check: $(BUILT_SOURCES)
-	$(MAKE) $(AM_MAKEFLAGS) check-am
-all-am: Makefile $(LTLIBRARIES) $(PROGRAMS) $(MANS) $(HEADERS)
-installdirs:
-	for dir in "$(DESTDIR)$(libdir)" "$(DESTDIR)$(sbindir)" "$(DESTDIR)$(man5dir)" "$(DESTDIR)$(man8dir)" "$(DESTDIR)$(include_racoondir)"; do \
-	  test -z "$$dir" || $(MKDIR_P) "$$dir"; \
-	done
-install: $(BUILT_SOURCES)
-	$(MAKE) $(AM_MAKEFLAGS) install-am
-install-exec: install-exec-am
-install-data: install-data-am
-uninstall: uninstall-am
-
-install-am: all-am
-	@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
-
-installcheck: installcheck-am
-install-strip:
-	$(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
-	  install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
-	  `test -z '$(STRIP)' || \
-	    echo "INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'"` install
-mostlyclean-generic:
-
-clean-generic:
-
-distclean-generic:
-	-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
-
-maintainer-clean-generic:
-	@echo "This command is intended for maintainers to use"
-	@echo "it deletes files that may require special tools to rebuild."
-	-rm -f cfparse.c
-	-rm -f cfparse.h
-	-rm -f cftoken.c
-	-rm -f prsa_par.c
-	-rm -f prsa_par.h
-	-rm -f prsa_tok.c
-	-test -z "$(BUILT_SOURCES)" || rm -f $(BUILT_SOURCES)
-clean: clean-am
-
-clean-am: clean-generic clean-libLTLIBRARIES clean-libtool \
-	clean-noinstPROGRAMS clean-sbinPROGRAMS mostlyclean-am
-
-distclean: distclean-am
-	-rm -rf ./$(DEPDIR)
-	-rm -f Makefile
-distclean-am: clean-am distclean-compile distclean-generic \
-	distclean-tags
-
-dvi: dvi-am
-
-dvi-am:
-
-html: html-am
-
-info: info-am
-
-info-am:
-
-install-data-am: install-include_racoonHEADERS install-man
-
-install-dvi: install-dvi-am
-
-install-exec-am: install-exec-local install-libLTLIBRARIES \
-	install-sbinPROGRAMS
-
-install-html: install-html-am
-
-install-info: install-info-am
-
-install-man: install-man5 install-man8
-
-install-pdf: install-pdf-am
-
-install-ps: install-ps-am
-
-installcheck-am:
-
-maintainer-clean: maintainer-clean-am
-	-rm -rf ./$(DEPDIR)
-	-rm -f Makefile
-maintainer-clean-am: distclean-am maintainer-clean-generic
-
-mostlyclean: mostlyclean-am
-
-mostlyclean-am: mostlyclean-compile mostlyclean-generic \
-	mostlyclean-libtool
-
-pdf: pdf-am
-
-pdf-am:
-
-ps: ps-am
-
-ps-am:
-
-uninstall-am: uninstall-include_racoonHEADERS uninstall-libLTLIBRARIES \
-	uninstall-man uninstall-sbinPROGRAMS
-
-uninstall-man: uninstall-man5 uninstall-man8
-
-.MAKE: install-am install-strip
-
-.PHONY: CTAGS GTAGS all all-am check check-TESTS check-am clean \
-	clean-generic clean-libLTLIBRARIES clean-libtool \
-	clean-noinstPROGRAMS clean-sbinPROGRAMS ctags distclean \
-	distclean-compile distclean-generic distclean-libtool \
-	distclean-tags distdir dvi dvi-am html html-am info info-am \
-	install install-am install-data install-data-am install-dvi \
-	install-dvi-am install-exec install-exec-am install-exec-local \
-	install-html install-html-am install-include_racoonHEADERS \
-	install-info install-info-am install-libLTLIBRARIES \
-	install-man install-man5 install-man8 install-pdf \
-	install-pdf-am install-ps install-ps-am install-sbinPROGRAMS \
-	install-strip installcheck installcheck-am installdirs \
-	maintainer-clean maintainer-clean-generic mostlyclean \
-	mostlyclean-compile mostlyclean-generic mostlyclean-libtool \
-	pdf pdf-am ps ps-am tags uninstall uninstall-am \
-	uninstall-include_racoonHEADERS uninstall-libLTLIBRARIES \
-	uninstall-man uninstall-man5 uninstall-man8 \
-	uninstall-sbinPROGRAMS
-
-
-install-exec-local:
-	${mkinstalldirs} $(DESTDIR)${adminsockdir}
-
-# special object rules
-crypto_openssl_test.o: crypto_openssl.c
-	$(COMPILE) -DEAYDEBUG -o crypto_openssl_test.o -c $(srcdir)/crypto_openssl.c
-
-misc_noplog.o: misc.c
-	$(COMPILE) -DNOUSE_PLOG -o misc_noplog.o -c $(srcdir)/misc.c
-
-# missing/*.c
-strdup.o:	$(srcdir)/missing/strdup.c
-	$(COMPILE) -c $(srcdir)/missing/$*.c
-getaddrinfo.o:	$(srcdir)/missing/getaddrinfo.c
-	$(COMPILE) -c $(srcdir)/missing/$*.c
-getnameinfo.o:	$(srcdir)/missing/getnameinfo.c
-	$(COMPILE) -c $(srcdir)/missing/$*.c
-rijndael-api-fst.o: $(srcdir)/missing/crypto/rijndael/rijndael-api-fst.c
-	$(COMPILE) -c $(srcdir)/missing/crypto/rijndael/$*.c
-rijndael-alg-fst.o: $(srcdir)/missing/crypto/rijndael/rijndael-alg-fst.c
-	$(COMPILE) -c $(srcdir)/missing/crypto/rijndael/$*.c
-sha2.o: $(srcdir)/missing/crypto/sha2/sha2.c
-	$(COMPILE) -c $(srcdir)/missing/crypto/sha2/$*.c
-# Tell versions [3.59,3.63) of GNU make to not export all variables.
-# Otherwise a system limit (for SysV at least) may be exceeded.
-.NOEXPORT:
diff --git a/src/racoon/NOTICE b/src/racoon/NOTICE
deleted file mode 100644
index b07098f..0000000
--- a/src/racoon/NOTICE
+++ /dev/null
@@ -1,325 +0,0 @@
-Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions
-are met:
-1. Redistributions of source code must retain the above copyright
-   notice, this list of conditions and the following disclaimer.
-2. Redistributions in binary form must reproduce the above copyright
-   notice, this list of conditions and the following disclaimer in the
-   documentation and/or other materials provided with the distribution.
-3. Neither the name of the project nor the names of its contributors
-   may be used to endorse or promote products derived from this software
-   without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
-FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGE.
-
-
-
-Copyright (C) 2004 Emmanuel Dreyfus
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions
-are met:
-1. Redistributions of source code must retain the above copyright
-   notice, this list of conditions and the following disclaimer.
-2. Redistributions in binary form must reproduce the above copyright
-   notice, this list of conditions and the following disclaimer in the
-   documentation and/or other materials provided with the distribution.
-3. Neither the name of the project nor the names of its contributors
-   may be used to endorse or promote products derived from this software
-   without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
-FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGE.
-
-
-
-Copyright (C) 2004-2006 Emmanuel Dreyfus
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions
-are met:
-1. Redistributions of source code must retain the above copyright
-   notice, this list of conditions and the following disclaimer.
-2. Redistributions in binary form must reproduce the above copyright
-   notice, this list of conditions and the following disclaimer in the
-   documentation and/or other materials provided with the distribution.
-3. Neither the name of the project nor the names of its contributors
-   may be used to endorse or promote products derived from this software
-   without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
-FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGE.
-
-
-
-Copyright (C) 2000 WIDE Project.
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions
-are met:
-1. Redistributions of source code must retain the above copyright
-   notice, this list of conditions and the following disclaimer.
-2. Redistributions in binary form must reproduce the above copyright
-   notice, this list of conditions and the following disclaimer in the
-   documentation and/or other materials provided with the distribution.
-3. Neither the name of the project nor the names of its contributors
-   may be used to endorse or promote products derived from this software
-   without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
-FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGE.
-
-
-Copyright (C) 2004-2005 Emmanuel Dreyfus
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions
-are met:
-1. Redistributions of source code must retain the above copyright
-   notice, this list of conditions and the following disclaimer.
-2. Redistributions in binary form must reproduce the above copyright
-   notice, this list of conditions and the following disclaimer in the
-   documentation and/or other materials provided with the distribution.
-3. Neither the name of the project nor the names of its contributors
-   may be used to endorse or promote products derived from this software
-   without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
-FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGE.
-
-
-
-Copyright (C) 2000, 2001 WIDE Project.
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions
-are met:
-1. Redistributions of source code must retain the above copyright
-   notice, this list of conditions and the following disclaimer.
-2. Redistributions in binary form must reproduce the above copyright
-   notice, this list of conditions and the following disclaimer in the
-   documentation and/or other materials provided with the distribution.
-3. Neither the name of the project nor the names of its contributors
-   may be used to endorse or promote products derived from this software
-   without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
-FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGE.
-
-
-
-Copyright (C) 2004 SuSE Linux AG, Nuernberg, Germany.
-Contributed by: Michal Ludvig <mludvig@suse.cz>, SUSE Labs
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions
-are met:
-1. Redistributions of source code must retain the above copyright
-   notice, this list of conditions and the following disclaimer.
-2. Redistributions in binary form must reproduce the above copyright
-   notice, this list of conditions and the following disclaimer in the
-   documentation and/or other materials provided with the distribution.
-3. Neither the name of the project nor the names of its contributors
-   may be used to endorse or promote products derived from this software
-   without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
-FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGE.
-
-
-
-Copyright (C) 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002 and 2003 WIDE Project.
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions
-are met:
-1. Redistributions of source code must retain the above copyright
-   notice, this list of conditions and the following disclaimer.
-2. Redistributions in binary form must reproduce the above copyright
-   notice, this list of conditions and the following disclaimer in the
-   documentation and/or other materials provided with the distribution.
-3. Neither the name of the project nor the names of its contributors
-   may be used to endorse or promote products derived from this software
-   without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
-FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGE.
-
-
-
-Copyright 2000 Wasabi Systems, Inc.
-All rights reserved.
-
-This software was written by Frank van der Linden of Wasabi Systems
-for Zembu Labs, Inc. http://www.zembu.com/
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions
-are met:
-1. Redistributions of source code must retain the above copyright
-   notice, this list of conditions and the following disclaimer.
-2. Redistributions in binary form must reproduce the above copyright
-   notice, this list of conditions and the following disclaimer in the
-   documentation and/or other materials provided with the distribution.
-3. The name of Wasabi Systems, Inc. may not be used to endorse
-   or promote products derived from this software without specific prior
-   written permission.
-
-THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
-TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL WASABI SYSTEMS, INC
-BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
-CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-POSSIBILITY OF SUCH DAMAGE.
-
-
-
-Copyright (C) 2005 International Business Machines Corporation
-Copyright (c) 2005 by Trusted Computer Solutions, Inc.
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions
-are met:
-1. Redistributions of source code must retain the above copyright
-   notice, this list of conditions and the following disclaimer.
-2. Redistributions in binary form must reproduce the above copyright
-   notice, this list of conditions and the following disclaimer in the
-   documentation and/or other materials provided with the distribution.
-3. Neither the name of the project nor the names of its contributors
-   may be used to endorse or promote products derived from this software
-   without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
-FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGE.
-
-
-
-sha2.h
-
-Version 1.0.0beta1
-
-Written by Aaron D. Gifford <me@aarongifford.com>
-
-Copyright 2000 Aaron D. Gifford.  All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions
-are met:
-1. Redistributions of source code must retain the above copyright
-   notice, this list of conditions and the following disclaimer.
-2. Redistributions in binary form must reproduce the above copyright
-   notice, this list of conditions and the following disclaimer in the
-   documentation and/or other materials provided with the distribution.
-3. Neither the name of the copyright holder nor the names of contributors
-   may be used to endorse or promote products derived from this software
-   without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) AND CONTRIBUTOR(S) ``AS IS'' AND
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR(S) OR CONTRIBUTOR(S) BE LIABLE
-FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGE.
diff --git a/src/racoon/TODO b/src/racoon/TODO
deleted file mode 100644
index 1507167..0000000
--- a/src/racoon/TODO
+++ /dev/null
@@ -1,131 +0,0 @@
-$KAME: TODO,v 1.36 2001/09/19 09:41:39 sakane Exp $
-
-Please send any questions or bug reports to snap-users@kame.net.
-
-TODO list
-
-URGENT
-o The documents for users convenience.
-o split log file based on client.  printf-like config directive, i.e.
-  "logfile racoon.%s.log", should be useful here.
-  -> beware of possible security issue, don't use sprintf() directly!
-     make validation before giving a string to sprintf().
-o save decrypted IKE packet in tcpdump format
-o IPComp SA with wellknown CPI in CPI field.  how to handle it?
-o better rekey
-
-MUST
-o multiple certificate payload handling.
-o To consider the use with certificate infrastructure.  PXIX ???
-o kmstat should be improved.
-o Informational Exchange processing properly.
-o require less configuration.  phase 2 is easier (as kernel presents racoon
-  some hints), phase 1 is harder.  for example,
-  - grab phase 2 lifetime and algorith configuration from sadb_comb payloads in
-    ACQUIRE message.
-  - give reasonable default behavior when no configuration file is present.
-  - difficult items:
-	how to guess a reasonable phase 1 SA lifetime
-		(hardcoded default?  guess from phase 2 lifetime?)
-	guess what kind of ID payload to use
-	guess what kind of authentication to be used
-	guess phase 1 DH group (for aggressive mode, we cannot negotiate it)
-	guess if we need phase 2 PFS or not (we cannot negotiate it. so
-		we may need to pick from "no PFS" or "same as phase 1 DH group")
-	guess how we should negotiate lifetime
-		(is "strict" a reasonable default?)
-	guess which mode to use for phase 1 negotiation (is main mode useful?
-		is base mode popular enough?)
-o more acceptable check.
-
-SHOULD
-o psk.txt should be a database? (psk.db?)  psk_mkdb?
-o Dynamically retry to exchange and resend the packet per nodes.
-o To make the list of supported algorithm by sadb_supported payload
-  in the SADB_REGISTER message which happens asynchronously.
-o fix the structure of ph2handle.
-  We can handle the below case.
-
-  node A                            node B
-    +--------------SA1----------------+
-    +--------------SA2----------------+
-
-  at node A:
-  kernel
-    acquire(A-B) ------> ph2handle(A=B) -----> ph1handle
-                              |
-                            policy
-                             A=B
-                             A=B
-
-  But we can not handle the below case because there is no x?handle.
-
-  node A                            node B                           node C
-    +--------------SA1----------------+
-    +------------------------------------------------SA2---------------+
-
-  at node A:
-  kernel
-    acquire(A-C) ---+---> x?handle ---+---> ph2handle(A=B) -------> ph1handle
-                    |        |        |
-    acquire(A-B) ---+      policy     +---> ph2handle(A=C) -------> ph1handle
-                            A=B
-                            A=C
-
-o consistency of function name.
-o deep copy configuration entry to hander.  It's easy to reload configuration.
-o don't keep to hold keymat values, do it ?
-o local address's field in isakmpsa handler must be kicked out to rmconf.
-o responder policy and initiator policy should be separated.
-o for lifetime and key length, something like this should be useful.
-  - propose N
-  - accept between X and Y
-o wildcard "accept any proposal" policy should be allowed.
-o replay prevention
-  - limited total number of session
-  - limited session per peer
-  - number of proposal
-o full support for variable length SPI.  quickhack support for IPComp is done.
-
-MAY
-o Effective code.
-o interaction between IKE/IPsec and socket layer.
-  at this moment, IKE/IPsec failure is modeled as total packet loss to other
-  part of network subsystem, including socket layer.  this presents the
-  following behaviors:
-  - annoyingly long timeouts on tcp connection attempt, and IKE failure;
-    need to wait till tcp socket timeouts.
-  - blackhole if there's mismatching SAs.
-  we may be able to give socket layer some feedback from IKE/IPsec layer.
-  still not sure if those make sense or not.
-  for example:
-  - send PRU_HOSTDEAD to sockets if IKE negotiation failed
-    (sys/netkey/key.c:key_acquire2)
-    to do this, we need to remember which ACQUIRE was caused by which socket,
-    possibly into larval SAs.
-  - PRU_QUENCH on "no SA found on output"
-  - kick tcp retransmission timer on first SA establishment
-o IKE daemon should handle situations where peer does not run IKE daemon
-  (UDP port unreach for port 500) better.
-  should use connected UDP sockets for sending IKE datagrams.
-o rate-limit log messages from kernel IPsec errors, like "no SA found".
-
-TO BE TESTED.
-o IKE retransmit behavior
-	see, draft-*-ipsec-rekeying*.txt
-o Reboot recovery (peer reboot losing it's security associations)
-	see, draft-*-ipsec-rekeying*.txt
-o Scenarios
-	- End-to-End transport long lived security associations
-	  (over night, data transfer >1Gb) with frequent dynamic rekey
-	- End-to-GW tunnel long lived security associations
-	  (over night, data transfer >1Gb) with frequent dynamic rekey
-	- Policy change events while under SA load
-	- End-to-End SA through IPsec tunnels, initiation both ways
-	- Client End-to-End through client-to-GW tunnel SA, initiate from
-	  client for tunnel, then initiation both ways for end-to-end
-	- Client-to-GW transport SA for secure management
-o behavior to receive multiple auth method proposals and AND proposal
-
-and to be written many many.
-
diff --git a/src/racoon/admin.c b/src/racoon/admin.c
deleted file mode 100644
index b56dd2c..0000000
--- a/src/racoon/admin.c
+++ /dev/null
@@ -1,628 +0,0 @@
-/*	$NetBSD: admin.c,v 1.17.6.3 2009/04/20 13:32:57 tteras Exp $	*/
-
-/* Id: admin.c,v 1.25 2006/04/06 14:31:04 manubsd Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/socket.h>
-#include <sys/signal.h>
-#include <sys/stat.h>
-#include <sys/un.h>
-
-#include <net/pfkeyv2.h>
-
-#include <netinet/in.h>
-#include PATH_IPSEC_H
-
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-#include <netdb.h>
-#ifdef HAVE_UNISTD_H
-#include <unistd.h>
-#endif
-#ifdef ENABLE_HYBRID
-#include <resolv.h>
-#endif
-
-#include "var.h"
-#include "misc.h"
-#include "vmbuf.h"
-#include "plog.h"
-#include "sockmisc.h"
-#include "debug.h"
-
-#include "schedule.h"
-#include "localconf.h"
-#include "remoteconf.h"
-#include "grabmyaddr.h"
-#include "isakmp_var.h"
-#include "isakmp.h"
-#include "oakley.h"
-#include "handler.h"
-#include "evt.h"
-#include "pfkey.h"
-#include "ipsec_doi.h"
-#include "admin.h"
-#include "admin_var.h"
-#include "isakmp_inf.h"
-#ifdef ENABLE_HYBRID
-#include "isakmp_cfg.h"
-#endif
-#include "session.h"
-#include "gcmalloc.h"
-
-#ifdef ENABLE_ADMINPORT
-char *adminsock_path = ADMINSOCK_PATH;
-uid_t adminsock_owner = 0;
-gid_t adminsock_group = 0;
-mode_t adminsock_mode = 0600;
-
-static struct sockaddr_un sunaddr;
-static int admin_process __P((int, char *));
-static int admin_reply __P((int, struct admin_com *, vchar_t *));
-
-int
-admin_handler()
-{
-	int so2;
-	struct sockaddr_storage from;
-	socklen_t fromlen = sizeof(from);
-	struct admin_com com;
-	char *combuf = NULL;
-	int len, error = -1;
-
-	so2 = accept(lcconf->sock_admin, (struct sockaddr *)&from, &fromlen);
-	if (so2 < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to accept admin command: %s\n",
-			strerror(errno));
-		return -1;
-	}
-
-	/* get buffer length */
-	while ((len = recv(so2, (char *)&com, sizeof(com), MSG_PEEK)) < 0) {
-		if (errno == EINTR)
-			continue;
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to recv admin command: %s\n",
-			strerror(errno));
-		goto end;
-	}
-
-	/* sanity check */
-	if (len < sizeof(com)) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid header length of admin command\n");
-		goto end;
-	}
-
-	/* get buffer to receive */
-	if ((combuf = racoon_malloc(com.ac_len)) == 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to alloc buffer for admin command\n");
-		goto end;
-	}
-
-	/* get real data */
-	while ((len = recv(so2, combuf, com.ac_len, 0)) < 0) {
-		if (errno == EINTR)
-			continue;
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to recv admin command: %s\n",
-			strerror(errno));
-		goto end;
-	}
-
-	if (com.ac_cmd == ADMIN_RELOAD_CONF) {
-		/* reload does not work at all! */
-		signal_handler(SIGHUP);
-		goto end;
-	}
-
-	error = admin_process(so2, combuf);
-
-    end:
-	(void)close(so2);
-	if (combuf)
-		racoon_free(combuf);
-
-	return error;
-}
-
-/*
- * main child's process.
- */
-static int
-admin_process(so2, combuf)
-	int so2;
-	char *combuf;
-{
-	struct admin_com *com = (struct admin_com *)combuf;
-	vchar_t *buf = NULL;
-	vchar_t *id = NULL;
-	vchar_t *key = NULL;
-	int idtype = 0;
-	int error = -1;
-
-	com->ac_errno = 0;
-
-	switch (com->ac_cmd) {
-	case ADMIN_RELOAD_CONF:
-		/* don't entered because of proccessing it in other place. */
-		plog(LLV_ERROR, LOCATION, NULL, "should never reach here\n");
-		goto out;
-
-	case ADMIN_SHOW_SCHED:
-	{
-		caddr_t p = NULL;
-		int len;
-
-		com->ac_errno = -1;
-
-		if (sched_dump(&p, &len) == -1)
-			goto out2;
-
-		if ((buf = vmalloc(len)) == NULL)
-			goto out2;
-
-		memcpy(buf->v, p, len);
-
-		com->ac_errno = 0;
-out2:
-		racoon_free(p);
-		break;
-	}
-
-	case ADMIN_SHOW_EVT:
-		/* It's not really an error, don't force racoonctl to quit */
-		if ((buf = evt_dump()) == NULL)
-			com->ac_errno = 0; 
-		break;
-
-	case ADMIN_SHOW_SA:
-	case ADMIN_FLUSH_SA:
-	    {
-		switch (com->ac_proto) {
-		case ADMIN_PROTO_ISAKMP:
-			switch (com->ac_cmd) {
-			case ADMIN_SHOW_SA:
-				buf = dumpph1();
-				if (buf == NULL)
-					com->ac_errno = -1;
-				break;
-			case ADMIN_FLUSH_SA:
-				flushph1();
-				break;
-			}
-			break;
-		case ADMIN_PROTO_IPSEC:
-		case ADMIN_PROTO_AH:
-		case ADMIN_PROTO_ESP:
-			switch (com->ac_cmd) {
-			case ADMIN_SHOW_SA:
-			    {
-				u_int p;
-				p = admin2pfkey_proto(com->ac_proto);
-				if (p == -1)
-					goto out;
-				buf = pfkey_dump_sadb(p);
-				if (buf == NULL)
-					com->ac_errno = -1;
-			    }
-				break;
-			case ADMIN_FLUSH_SA:
-				pfkey_flush_sadb(com->ac_proto);
-				break;
-			}
-			break;
-
-		case ADMIN_PROTO_INTERNAL:
-			switch (com->ac_cmd) {
-			case ADMIN_SHOW_SA:
-				buf = NULL; /*XXX dumpph2(&error);*/
-				if (buf == NULL)
-					com->ac_errno = error;
-				break;
-			case ADMIN_FLUSH_SA:
-				/*XXX flushph2();*/
-				com->ac_errno = 0;
-				break;
-			}
-			break;
-
-		default:
-			/* ignore */
-			com->ac_errno = -1;
-		}
-	    }
-		break;
-
-	case ADMIN_DELETE_SA: {
-		struct ph1handle *iph1;
-		struct sockaddr *dst;
-		struct sockaddr *src;
-		char *loc, *rem;
-
-		src = (struct sockaddr *)
-			&((struct admin_com_indexes *)
-			    ((caddr_t)com + sizeof(*com)))->src;
-		dst = (struct sockaddr *)
-			&((struct admin_com_indexes *)
-			    ((caddr_t)com + sizeof(*com)))->dst;
-
-		loc = racoon_strdup(saddrwop2str(src));
-		rem = racoon_strdup(saddrwop2str(dst));
-		STRDUP_FATAL(loc);
-		STRDUP_FATAL(rem);
-
-		if ((iph1 = getph1byaddrwop(src, dst)) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "phase 1 for %s -> %s not found\n", loc, rem);
-		} else {
-			if (iph1->status == PHASE1ST_ESTABLISHED)
-				isakmp_info_send_d1(iph1);
-			purge_remote(iph1);
-		}
-
-		racoon_free(loc);
-		racoon_free(rem);
-
-		break;
-	}
-
-#ifdef ENABLE_HYBRID
-	case ADMIN_LOGOUT_USER: {
-		struct ph1handle *iph1;
-		char user[LOGINLEN+1];
-		int found = 0, len = com->ac_len - sizeof(com);
-
-		if (len > LOGINLEN) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "malformed message (login too long)\n");
-			break;
-		}
-
-		memcpy(user, (char *)(com + 1), len);
-		user[len] = 0;
-
-		found = purgeph1bylogin(user);
-		plog(LLV_INFO, LOCATION, NULL, 
-		    "deleted %d SA for user \"%s\"\n", found, user);
-
-		break;
-	}
-#endif
-
-	case ADMIN_DELETE_ALL_SA_DST: {
-		struct ph1handle *iph1;
-		struct sockaddr *dst;
-		char *loc, *rem;
-
-		dst = (struct sockaddr *)
-			&((struct admin_com_indexes *)
-			    ((caddr_t)com + sizeof(*com)))->dst;
-
-		rem = racoon_strdup(saddrwop2str(dst));
-		STRDUP_FATAL(rem);
-
-		plog(LLV_INFO, LOCATION, NULL, 
-		    "Flushing all SAs for peer %s\n", rem);
-
-		while ((iph1 = getph1bydstaddrwop(dst)) != NULL) {
-			loc = racoon_strdup(saddrwop2str(iph1->local));
-			STRDUP_FATAL(loc);
-
-			if (iph1->status == PHASE1ST_ESTABLISHED)
-				isakmp_info_send_d1(iph1);
-			purge_remote(iph1);
-
-			racoon_free(loc);
-		}
-		
-		racoon_free(rem);
-
-		break;
-	}
-
-	case ADMIN_ESTABLISH_SA_PSK: {
-		struct admin_com_psk *acp;
-		char *data;
-
-		com->ac_cmd = ADMIN_ESTABLISH_SA;
-
-		acp = (struct admin_com_psk *)
-		    ((char *)com + sizeof(*com) + 
-		    sizeof(struct admin_com_indexes));
-
-		idtype = acp->id_type;
-
-		if ((id = vmalloc(acp->id_len)) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "cannot allocate memory: %s\n", 
-			    strerror(errno));
-			break;
-		}
-		data = (char *)(acp + 1);
-		memcpy(id->v, data, id->l);
-
-		if ((key = vmalloc(acp->key_len)) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "cannot allocate memory: %s\n", 
-			    strerror(errno));
-			vfree(id);
-			id = NULL;
-			break;
-		}
-		data = (char *)(data + acp->id_len);
-		memcpy(key->v, data, key->l);
-	}
-	/* FALLTHROUGH */
-	case ADMIN_ESTABLISH_SA:
-	    {
-		struct sockaddr *dst;
-		struct sockaddr *src;
-		src = (struct sockaddr *)
-			&((struct admin_com_indexes *)
-			    ((caddr_t)com + sizeof(*com)))->src;
-		dst = (struct sockaddr *)
-			&((struct admin_com_indexes *)
-			    ((caddr_t)com + sizeof(*com)))->dst;
-
-		switch (com->ac_proto) {
-		case ADMIN_PROTO_ISAKMP: {
-			struct remoteconf *rmconf;
-			struct sockaddr *remote = NULL;
-			struct sockaddr *local = NULL;
-			u_int16_t port;
-
-			com->ac_errno = -1;
-
-			/* search appropreate configuration */
-			rmconf = getrmconf(dst);
-			if (rmconf == NULL) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"no configuration found "
-					"for %s\n", saddrwop2str(dst));
-				goto out1;
-			}
-
-			/* get remote IP address and port number. */
-			if ((remote = dupsaddr(dst)) == NULL)
-				goto out1;
-
-			port = extract_port(rmconf->remote);
-			if (set_port(remote, port) == NULL)
-				goto out1;
-
-			/* get local address */
-			if ((local = dupsaddr(src)) == NULL)
-				goto out1;
-
-			port = getmyaddrsport(local);
-			if (set_port(local, port) == NULL)
-				goto out1;
-
-#ifdef ENABLE_HYBRID
-			/* Set the id and key */
-			if (id && key) {
-				if (xauth_rmconf_used(&rmconf->xauth) == -1)
-					goto out1;
-
-				if (rmconf->xauth->login != NULL) {
-					vfree(rmconf->xauth->login);
-					rmconf->xauth->login = NULL;
-				}
-				if (rmconf->xauth->pass != NULL) {
-					vfree(rmconf->xauth->pass);
-					rmconf->xauth->pass = NULL;
-				}
-
-				rmconf->xauth->login = id;
-				rmconf->xauth->pass = key;
-			}
-#endif
- 
-			plog(LLV_INFO, LOCATION, NULL,
-				"accept a request to establish IKE-SA: "
-				"%s\n", saddrwop2str(remote));
-
-			/* begin ident mode */
-			if (isakmp_ph1begin_i(rmconf, remote, local) < 0)
-				goto out1;
-
-			com->ac_errno = 0;
-out1:
-			if (local != NULL)
-				racoon_free(local);
-			if (remote != NULL)
-				racoon_free(remote);
-			break;
-		}
-		case ADMIN_PROTO_AH:
-		case ADMIN_PROTO_ESP:
-			break;
-		default:
-			/* ignore */
-			com->ac_errno = -1;
-		}
-	    }
-		break;
-
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid command: %d\n", com->ac_cmd);
-		com->ac_errno = -1;
-	}
-
-	if ((error = admin_reply(so2, com, buf)) != 0)
-		goto out;
-
-	error = 0;
-out:
-	if (buf != NULL)
-		vfree(buf);
-
-	return error;
-}
-
-static int
-admin_reply(so, combuf, buf)
-	int so;
-	struct admin_com *combuf;
-	vchar_t *buf;
-{
-	int tlen;
-	char *retbuf = NULL;
-
-	if (buf != NULL)
-		tlen = sizeof(*combuf) + buf->l;
-	else
-		tlen = sizeof(*combuf);
-
-	retbuf = racoon_calloc(1, tlen);
-	if (retbuf == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to allocate admin buffer\n");
-		return -1;
-	}
-
-	memcpy(retbuf, combuf, sizeof(*combuf));
-	((struct admin_com *)retbuf)->ac_len = tlen;
-
-	if (buf != NULL)
-		memcpy(retbuf + sizeof(*combuf), buf->v, buf->l);
-
-	tlen = send(so, retbuf, tlen, 0);
-	racoon_free(retbuf);
-	if (tlen < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to send admin command: %s\n",
-			strerror(errno));
-		return -1;
-	}
-
-	return 0;
-}
-
-/* ADMIN_PROTO -> SADB_SATYPE */
-int
-admin2pfkey_proto(proto)
-	u_int proto;
-{
-	switch (proto) {
-	case ADMIN_PROTO_IPSEC:
-		return SADB_SATYPE_UNSPEC;
-	case ADMIN_PROTO_AH:
-		return SADB_SATYPE_AH;
-	case ADMIN_PROTO_ESP:
-		return SADB_SATYPE_ESP;
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"unsupported proto for admin: %d\n", proto);
-		return -1;
-	}
-	/*NOTREACHED*/
-}
-
-int
-admin_init()
-{
-	if (adminsock_path == NULL) {
-		lcconf->sock_admin = -1;
-		return 0;
-	}
-
-	memset(&sunaddr, 0, sizeof(sunaddr));
-	sunaddr.sun_family = AF_UNIX;
-	snprintf(sunaddr.sun_path, sizeof(sunaddr.sun_path),
-		"%s", adminsock_path);
-
-	lcconf->sock_admin = socket(AF_UNIX, SOCK_STREAM, 0);
-	if (lcconf->sock_admin == -1) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"socket: %s\n", strerror(errno));
-		return -1;
-	}
-
-	unlink(sunaddr.sun_path);
-	if (bind(lcconf->sock_admin, (struct sockaddr *)&sunaddr,
-			sizeof(sunaddr)) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"bind(sockname:%s): %s\n",
-			sunaddr.sun_path, strerror(errno));
-		(void)close(lcconf->sock_admin);
-		return -1;
-	}
-
-	if (chown(sunaddr.sun_path, adminsock_owner, adminsock_group) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "chown(%s, %d, %d): %s\n", 
-		    sunaddr.sun_path, adminsock_owner, 
-		    adminsock_group, strerror(errno));
-		(void)close(lcconf->sock_admin);
-		return -1;
-	}
-
-	if (chmod(sunaddr.sun_path, adminsock_mode) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "chmod(%s, 0%03o): %s\n", 
-		    sunaddr.sun_path, adminsock_mode, strerror(errno));
-		(void)close(lcconf->sock_admin);
-		return -1;
-	}
-
-	if (listen(lcconf->sock_admin, 5) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"listen(sockname:%s): %s\n",
-			sunaddr.sun_path, strerror(errno));
-		(void)close(lcconf->sock_admin);
-		return -1;
-	}
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"open %s as racoon management.\n", sunaddr.sun_path);
-
-	return 0;
-}
-
-int
-admin_close()
-{
-	close(lcconf->sock_admin);
-	return 0;
-}
-#endif
-
diff --git a/src/racoon/admin.h b/src/racoon/admin.h
deleted file mode 100644
index cbc19e8..0000000
--- a/src/racoon/admin.h
+++ /dev/null
@@ -1,114 +0,0 @@
-/*	$NetBSD: admin.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/* Id: admin.h,v 1.11 2005/06/19 22:37:47 manubsd Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _ADMIN_H
-#define _ADMIN_H
-
-#define ADMINSOCK_PATH ADMINPORTDIR "/racoon.sock"
-
-extern char *adminsock_path;
-extern uid_t adminsock_owner;
-extern gid_t adminsock_group;
-extern mode_t adminsock_mode;
-
-/* command for administration. */
-/* NOTE: host byte order. */
-struct admin_com {
-	u_int16_t ac_len;	/* total packet length including data */
-	u_int16_t ac_cmd;
-	int16_t ac_errno;
-	u_int16_t ac_proto;
-};
-
-/*
- * No data follows as the data.
- * These don't use proto field.
- */
-#define ADMIN_RELOAD_CONF	0x0001
-#define ADMIN_SHOW_SCHED	0x0002
-#define ADMIN_SHOW_EVT		0x0003
-
-/*
- * No data follows as the data.
- * These use proto field.
- */
-#define ADMIN_SHOW_SA		0x0101
-#define ADMIN_FLUSH_SA		0x0102
-
-/*
- * The admin_com_indexes follows, see below.
- */
-#define ADMIN_DELETE_SA		0x0201
-#define ADMIN_ESTABLISH_SA	0x0202
-#define ADMIN_DELETE_ALL_SA_DST	0x0204	/* All SA for a given peer */
-
-/*
- * The admin_com_indexes and admin_com_psk follow, see below.
- */
-#define ADMIN_ESTABLISH_SA_PSK	0x0203
-
-/*
- * user login follows
- */
-#define ADMIN_LOGOUT_USER	0x0205  /* Delete SA for a given Xauth user */
-
-/*
- * Range 0x08xx is reserved for privilege separation, see privsep.h 
- */
-
-/* the value of proto */
-#define ADMIN_PROTO_ISAKMP	0x01ff
-#define ADMIN_PROTO_IPSEC	0x02ff
-#define ADMIN_PROTO_AH		0x0201
-#define ADMIN_PROTO_ESP		0x0202
-#define ADMIN_PROTO_INTERNAL	0x0301
-
-struct admin_com_indexes {
-	u_int8_t prefs;
-	u_int8_t prefd;
-	u_int8_t ul_proto;
-	u_int8_t reserved;
-	struct sockaddr_storage src;
-	struct sockaddr_storage dst;
-};
-
-struct admin_com_psk { 
-	int id_type;
-	size_t id_len;
-	size_t key_len;
-	/* Followed by id and key */
-}; 
-
-extern int admin2pfkey_proto __P((u_int));
-
-#endif /* _ADMIN_H */
diff --git a/src/racoon/admin_var.h b/src/racoon/admin_var.h
deleted file mode 100644
index 6d7ba81..0000000
--- a/src/racoon/admin_var.h
+++ /dev/null
@@ -1,41 +0,0 @@
-/*	$NetBSD: admin_var.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/* Id: admin_var.h,v 1.7 2004/12/30 00:08:30 manubsd Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _ADMIN_VAR_H
-#define _ADMIN_VAR_H
-
-extern int admin_handler __P((void));
-extern int admin_init __P((void));
-extern int admin_close __P((void));
-
-#endif /* _ADMIN_VAR_H */
diff --git a/src/racoon/algorithm.c b/src/racoon/algorithm.c
deleted file mode 100644
index 3fd50f6..0000000
--- a/src/racoon/algorithm.c
+++ /dev/null
@@ -1,957 +0,0 @@
-/*	$NetBSD: algorithm.c,v 1.8 2006/10/06 12:02:27 manu Exp $	*/
-
-/* Id: algorithm.c,v 1.15 2006/05/23 20:23:09 manubsd Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/param.h>
-#include <sys/types.h>
-#include <stdlib.h>
-
-#include "var.h"
-#include "misc.h"
-#include "vmbuf.h"
-#include "plog.h"
-#include "debug.h"
-
-#include "crypto_openssl.h"
-#include "dhgroup.h"
-#include "algorithm.h"
-#include "oakley.h"
-#include "isakmp_var.h"
-#include "isakmp.h"
-#include "ipsec_doi.h"
-#include "gcmalloc.h"
-
-static struct hash_algorithm oakley_hashdef[] = {
-{ "md5",	algtype_md5,		OAKLEY_ATTR_HASH_ALG_MD5,
-		eay_md5_init,		eay_md5_update,
-		eay_md5_final,		eay_md5_hashlen,
-		eay_md5_one, },
-{ "sha1",	algtype_sha1,		OAKLEY_ATTR_HASH_ALG_SHA,
-		eay_sha1_init,		eay_sha1_update,
-		eay_sha1_final,		eay_sha1_hashlen,
-		eay_sha1_one, },
-#ifdef WITH_SHA2
-{ "sha2_256",	algtype_sha2_256,	OAKLEY_ATTR_HASH_ALG_SHA2_256,
-		eay_sha2_256_init,	eay_sha2_256_update,
-		eay_sha2_256_final,	eay_sha2_256_hashlen,
-		eay_sha2_256_one, },
-{ "sha2_384",	algtype_sha2_384,	OAKLEY_ATTR_HASH_ALG_SHA2_384,
-		eay_sha2_384_init,	eay_sha2_384_update,
-		eay_sha2_384_final,	eay_sha2_384_hashlen,
-		eay_sha2_384_one, },
-{ "sha2_512",	algtype_sha2_512,	OAKLEY_ATTR_HASH_ALG_SHA2_512,
-		eay_sha2_512_init,	eay_sha2_512_update,
-		eay_sha2_512_final,	eay_sha2_512_hashlen,
-		eay_sha2_512_one, },
-#endif
-};
-
-static struct hmac_algorithm oakley_hmacdef[] = {
-{ "hmac_md5",	algtype_md5,		OAKLEY_ATTR_HASH_ALG_MD5,
-		eay_hmacmd5_init,	eay_hmacmd5_update,
-		eay_hmacmd5_final,	NULL,
-		eay_hmacmd5_one, },
-{ "hmac_sha1",	algtype_sha1,		OAKLEY_ATTR_HASH_ALG_SHA,
-		eay_hmacsha1_init,	eay_hmacsha1_update,
-		eay_hmacsha1_final,	NULL,
-		eay_hmacsha1_one, },
-#ifdef WITH_SHA2
-{ "hmac_sha2_256",	algtype_sha2_256,	OAKLEY_ATTR_HASH_ALG_SHA2_256,
-		eay_hmacsha2_256_init,	eay_hmacsha2_256_update,
-		eay_hmacsha2_256_final,	NULL,
-		eay_hmacsha2_256_one, },
-{ "hmac_sha2_384",	algtype_sha2_384,	OAKLEY_ATTR_HASH_ALG_SHA2_384,
-		eay_hmacsha2_384_init,	eay_hmacsha2_384_update,
-		eay_hmacsha2_384_final,	NULL,
-		eay_hmacsha2_384_one, },
-{ "hmac_sha2_512",	algtype_sha2_512,	OAKLEY_ATTR_HASH_ALG_SHA2_512,
-		eay_hmacsha2_512_init,	eay_hmacsha2_512_update,
-		eay_hmacsha2_512_final,	NULL,
-		eay_hmacsha2_512_one, },
-#endif
-};
-
-static struct enc_algorithm oakley_encdef[] = {
-{ "des",	algtype_des,		OAKLEY_ATTR_ENC_ALG_DES,	8,
-		eay_des_encrypt,	eay_des_decrypt,
-		eay_des_weakkey,	eay_des_keylen, },
-#ifdef HAVE_OPENSSL_IDEA_H
-{ "idea",	algtype_idea,		OAKLEY_ATTR_ENC_ALG_IDEA,	8,
-		eay_idea_encrypt,	eay_idea_decrypt,
-		eay_idea_weakkey,	eay_idea_keylen, },
-#endif
-{ "blowfish",	algtype_blowfish,	OAKLEY_ATTR_ENC_ALG_BLOWFISH,	8,
-		eay_bf_encrypt,		eay_bf_decrypt,
-		eay_bf_weakkey,		eay_bf_keylen, },
-#ifdef HAVE_OPENSSL_RC5_H
-{ "rc5",	algtype_rc5,		OAKLEY_ATTR_ENC_ALG_RC5,	8,
-		eay_rc5_encrypt,	eay_rc5_decrypt,
-		eay_rc5_weakkey,	eay_rc5_keylen, },
-#endif
-{ "3des",	algtype_3des,		OAKLEY_ATTR_ENC_ALG_3DES,	8,
-		eay_3des_encrypt,	eay_3des_decrypt,
-		eay_3des_weakkey,	eay_3des_keylen, },
-{ "cast",	algtype_cast128,	OAKLEY_ATTR_ENC_ALG_CAST,	8,
-		eay_cast_encrypt,	eay_cast_decrypt,
-		eay_cast_weakkey,	eay_cast_keylen, },
-{ "aes",	algtype_aes,	OAKLEY_ATTR_ENC_ALG_AES,	16,
-		eay_aes_encrypt,	eay_aes_decrypt,
-		eay_aes_weakkey,	eay_aes_keylen, },
-#ifdef HAVE_OPENSSL_CAMELLIA_H
-{ "camellia",	algtype_camellia,	OAKLEY_ATTR_ENC_ALG_CAMELLIA,	16,
-		eay_camellia_encrypt,	eay_camellia_decrypt,
-		eay_camellia_weakkey,	eay_camellia_keylen, },
-#endif
-};
-
-static struct enc_algorithm ipsec_encdef[] = {
-{ "des-iv64",	algtype_des_iv64,	IPSECDOI_ESP_DES_IV64,		8,
-		NULL,			NULL,
-		NULL,			eay_des_keylen, },
-{ "des",	algtype_des,		IPSECDOI_ESP_DES,		8,
-		NULL,			NULL,
-		NULL,			eay_des_keylen, },
-{ "3des",	algtype_3des,		IPSECDOI_ESP_3DES,		8,
-		NULL,			NULL,
-		NULL,			eay_3des_keylen, },
-#ifdef HAVE_OPENSSL_RC5_H
-{ "rc5",	algtype_rc5,		IPSECDOI_ESP_RC5,		8,
-		NULL,			NULL,
-		NULL,			eay_rc5_keylen, },
-#endif
-{ "cast",	algtype_cast128,	IPSECDOI_ESP_CAST,		8,
-		NULL,			NULL,
-		NULL,			eay_cast_keylen, },
-{ "blowfish",	algtype_blowfish,	IPSECDOI_ESP_BLOWFISH,		8,
-		NULL,			NULL,
-		NULL,			eay_bf_keylen, },
-{ "des-iv32",	algtype_des_iv32,	IPSECDOI_ESP_DES_IV32,		8,
-		NULL,			NULL,
-		NULL,			eay_des_keylen, },
-{ "null",	algtype_null_enc,	IPSECDOI_ESP_NULL,		8,
-		NULL,			NULL,
-		NULL,			eay_null_keylen, },
-{ "aes",	algtype_aes,		IPSECDOI_ESP_AES,		16,
-		NULL,			NULL,
-		NULL,			eay_aes_keylen, },
-{ "twofish",	algtype_twofish,	IPSECDOI_ESP_TWOFISH,		16,
-		NULL,			NULL,
-		NULL,			eay_twofish_keylen, },
-#ifdef HAVE_OPENSSL_IDEA_H
-{ "3idea",	algtype_3idea,		IPSECDOI_ESP_3IDEA,		8,
-		NULL,			NULL,
-		NULL,			NULL, },
-{ "idea",	algtype_idea,		IPSECDOI_ESP_IDEA,		8,
-		NULL,			NULL,
-		NULL,			NULL, },
-#endif
-{ "rc4",	algtype_rc4,		IPSECDOI_ESP_RC4,		8,
-		NULL,			NULL,
-		NULL,			NULL, },
-#ifdef HAVE_OPENSSL_CAMELLIA_H
-{ "camellia",	algtype_camellia,	IPSECDOI_ESP_CAMELLIA,		16,
-		NULL,			NULL,
-		NULL,			eay_camellia_keylen, },
-#endif
-};
-
-static struct hmac_algorithm ipsec_hmacdef[] = {
-{ "md5",	algtype_hmac_md5,	IPSECDOI_ATTR_AUTH_HMAC_MD5,
-		NULL,			NULL,
-		NULL,			eay_md5_hashlen,
-		NULL, },
-{ "sha1",	algtype_hmac_sha1,	IPSECDOI_ATTR_AUTH_HMAC_SHA1,
-		NULL,			NULL,
-		NULL,			eay_sha1_hashlen,
-		NULL, },
-{ "kpdk",	algtype_kpdk,		IPSECDOI_ATTR_AUTH_KPDK,
-		NULL,			NULL,
-		NULL,			eay_kpdk_hashlen,
-		NULL, },
-{ "null",	algtype_non_auth,	IPSECDOI_ATTR_AUTH_NONE,
-		NULL,			NULL,
-		NULL,			eay_null_hashlen,
-		NULL, },
-#ifdef WITH_SHA2
-{ "hmac_sha2_256",	algtype_hmac_sha2_256,IPSECDOI_ATTR_AUTH_HMAC_SHA2_256,
-		NULL,			NULL,
-		NULL,			eay_sha2_256_hashlen,
-		NULL, },
-{ "hmac_sha2_384",	algtype_hmac_sha2_384,IPSECDOI_ATTR_AUTH_HMAC_SHA2_384,
-		NULL,			NULL,
-		NULL,			eay_sha2_384_hashlen,
-		NULL, },
-{ "hmac_sha2_512",	algtype_hmac_sha2_512,IPSECDOI_ATTR_AUTH_HMAC_SHA2_512,
-		NULL,			NULL,
-		NULL,			eay_sha2_512_hashlen,
-		NULL, },
-#endif
-};
-
-static struct misc_algorithm ipsec_compdef[] = {
-{ "oui",	algtype_oui,		IPSECDOI_IPCOMP_OUI, },
-{ "deflate",	algtype_deflate,	IPSECDOI_IPCOMP_DEFLATE, },
-{ "lzs",	algtype_lzs,		IPSECDOI_IPCOMP_LZS, },
-};
-
-/*
- * In case of asymetric modes (hybrid xauth), what's racoon mode of
- * operations ; it seems that the proposal should always use the
- * initiator half (unless a server initiates a connection, which is
- * not handled, and probably not useful).
- */
-static struct misc_algorithm oakley_authdef[] = {
-{ "pre_shared_key",	algtype_psk,	OAKLEY_ATTR_AUTH_METHOD_PSKEY, },
-{ "dsssig",		algtype_dsssig,	OAKLEY_ATTR_AUTH_METHOD_DSSSIG, },
-{ "rsasig",		algtype_rsasig,	OAKLEY_ATTR_AUTH_METHOD_RSASIG, },
-{ "rsaenc",		algtype_rsaenc,	OAKLEY_ATTR_AUTH_METHOD_RSAENC, },
-{ "rsarev",		algtype_rsarev,	OAKLEY_ATTR_AUTH_METHOD_RSAREV, },
-
-{ "gssapi_krb",		algtype_gssapikrb,
-    OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB, },
-
-#ifdef ENABLE_HYBRID
-{ "hybrid_rsa_server",	algtype_hybrid_rsa_s,	
-    OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R, },
-
-{ "hybrid_dss_server",	algtype_hybrid_dss_s,	
-    OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R, },
-
-{ "xauth_psk_server", 	algtype_xauth_psk_s,	
-    OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R, },
-
-{ "xauth_rsa_server", 	algtype_xauth_rsa_s,	
-    OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R, },
-
-{ "hybrid_rsa_client",	algtype_hybrid_rsa_c,	
-    OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I, },
-
-{ "hybrid_dss_client",	algtype_hybrid_dss_c,	
-    OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I, },
-
-{ "xauth_psk_client",	algtype_xauth_psk_c,	
-    OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I, },
-
-{ "xauth_rsa_client",	algtype_xauth_rsa_c,	
-    OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I, },
-#endif
-};
-
-static struct dh_algorithm oakley_dhdef[] = {
-{ "modp768",	algtype_modp768,	OAKLEY_ATTR_GRP_DESC_MODP768,
-		&dh_modp768, },
-{ "modp1024",	algtype_modp1024,	OAKLEY_ATTR_GRP_DESC_MODP1024,
-		&dh_modp1024, },
-{ "modp1536",	algtype_modp1536,	OAKLEY_ATTR_GRP_DESC_MODP1536,
-		&dh_modp1536, },
-{ "modp2048",	algtype_modp2048,	OAKLEY_ATTR_GRP_DESC_MODP2048,
-		&dh_modp2048, },
-{ "modp3072",	algtype_modp3072,	OAKLEY_ATTR_GRP_DESC_MODP3072,
-		&dh_modp3072, },
-{ "modp4096",	algtype_modp4096,	OAKLEY_ATTR_GRP_DESC_MODP4096,
-		&dh_modp4096, },
-{ "modp6144",	algtype_modp6144,	OAKLEY_ATTR_GRP_DESC_MODP6144,
-		&dh_modp6144, },
-{ "modp8192",	algtype_modp8192,	OAKLEY_ATTR_GRP_DESC_MODP8192,
-		&dh_modp8192, },
-};
-
-static struct hash_algorithm *alg_oakley_hashdef __P((int));
-static struct hmac_algorithm *alg_oakley_hmacdef __P((int));
-static struct enc_algorithm *alg_oakley_encdef __P((int));
-static struct enc_algorithm *alg_ipsec_encdef __P((int));
-static struct hmac_algorithm *alg_ipsec_hmacdef __P((int));
-static struct dh_algorithm *alg_oakley_dhdef __P((int));
-
-/* oakley hash algorithm */
-static struct hash_algorithm *
-alg_oakley_hashdef(doi)
-	int doi;
-{
-	int i;
-
-	for (i = 0; i < ARRAYLEN(oakley_hashdef); i++)
-		if (doi == oakley_hashdef[i].doi) {
-			plog(LLV_DEBUG, LOCATION, NULL, "hash(%s)\n",
-				oakley_hashdef[i].name);
-			return &oakley_hashdef[i];
-		}
-	return NULL;
-}
-
-int
-alg_oakley_hashdef_ok(doi)
-	int doi;
-{
-	struct hash_algorithm *f;
-
-	f = alg_oakley_hashdef(doi);
-	if (f == NULL)
-		return 0;
-
-	return 1;
-}
-
-int
-alg_oakley_hashdef_doi(type)
-	int type;
-{
-	int i, res = -1;
-
-	for (i = 0; i < ARRAYLEN(oakley_hashdef); i++)
-		if (type == oakley_hashdef[i].type) {
-			res = oakley_hashdef[i].doi;
-			break;
-		}
-	return res;
-}
-
-int
-alg_oakley_hashdef_hashlen(doi)
-	int doi;
-{
-	struct hash_algorithm *f;
-
-	f = alg_oakley_hashdef(doi);
-	if (f == NULL || f->hashlen == NULL)
-		return 0;
-
-	return (f->hashlen)();
-}
-
-const char *
-alg_oakley_hashdef_name (doi)
-	int doi;
-{
-	struct hash_algorithm *f;
-
-	f = alg_oakley_hashdef(doi);
-	if (f == NULL)
-		return "*UNKNOWN*";
-
-	return f->name;
-}
-
-vchar_t *
-alg_oakley_hashdef_one(doi, buf)
-	int doi;
-	vchar_t *buf;
-{
-	struct hash_algorithm *f;
-
-	f = alg_oakley_hashdef(doi);
-	if (f == NULL || f->hashlen == NULL)
-		return NULL;
-
-	return (f->one)(buf);
-}
-
-/* oakley hmac algorithm */
-static struct hmac_algorithm *
-alg_oakley_hmacdef(doi)
-	int doi;
-{
-	int i;
-
-	for (i = 0; i < ARRAYLEN(oakley_hmacdef); i++)
-		if (doi == oakley_hmacdef[i].doi) {
-			plog(LLV_DEBUG, LOCATION, NULL, "hmac(%s)\n",
-				oakley_hmacdef[i].name);
-			return &oakley_hmacdef[i];
-		}
-	return NULL;
-}
-
-int
-alg_oakley_hmacdef_doi(type)
-	int type;
-{
-	int i, res = -1;
-
-	for (i = 0; i < ARRAYLEN(oakley_hmacdef); i++)
-		if (type == oakley_hmacdef[i].type) {
-			res = oakley_hmacdef[i].doi;
-			break;
-		}
-	return res;
-}
-
-vchar_t *
-alg_oakley_hmacdef_one(doi, key, buf)
-	int doi;
-	vchar_t *key, *buf;
-{
-	struct hmac_algorithm *f;
-	vchar_t *res;
-#ifdef ENABLE_STATS
-	struct timeval start, end;
-#endif
-
-	f = alg_oakley_hmacdef(doi);
-	if (f == NULL || f->one == NULL)
-		return NULL;
-
-#ifdef ENABLE_STATS
-	gettimeofday(&start, NULL);
-#endif
-
-	res = (f->one)(key, buf);
-
-#ifdef ENABLE_STATS
-	gettimeofday(&end, NULL);
-	syslog(LOG_NOTICE, "%s(%s size=%zu): %8.6f", __func__,
-		f->name, buf->l, timedelta(&start, &end));
-#endif
-
-	return res;
-}
-
-/* oakley encryption algorithm */
-static struct enc_algorithm *
-alg_oakley_encdef(doi)
-	int doi;
-{
-	int i;
-
-	for (i = 0; i < ARRAYLEN(oakley_encdef); i++)
-		if (doi == oakley_encdef[i].doi) {
-			plog(LLV_DEBUG, LOCATION, NULL, "encryption(%s)\n",
-				oakley_encdef[i].name);
-			return &oakley_encdef[i];
-		}
-	return NULL;
-}
-
-int
-alg_oakley_encdef_ok(doi)
-	int doi;
-{
-	struct enc_algorithm *f;
-
-	f = alg_oakley_encdef(doi);
-	if (f == NULL)
-		return 0;
-
-	return 1;
-}
-
-int
-alg_oakley_encdef_doi(type)
-	int type;
-{
-	int i, res = -1;
-
-	for (i = 0; i < ARRAYLEN(oakley_encdef); i++)
-		if (type == oakley_encdef[i].type) {
-			res = oakley_encdef[i].doi;
-			break;
-		}
-	return res;
-}
-
-int
-alg_oakley_encdef_keylen(doi, len)
-	int doi, len;
-{
-	struct enc_algorithm *f;
-
-	f = alg_oakley_encdef(doi);
-	if (f == NULL || f->keylen == NULL)
-		return -1;
-
-	return (f->keylen)(len);
-}
-
-int
-alg_oakley_encdef_blocklen(doi)
-	int doi;
-{
-	struct enc_algorithm *f;
-
-	f = alg_oakley_encdef(doi);
-	if (f == NULL)
-		return -1;
-
-	return f->blocklen;
-}
-
-const char *
-alg_oakley_encdef_name (doi)
-	int doi;
-{
-	struct enc_algorithm *f;
-
-	f = alg_oakley_encdef(doi);
-	if (f == NULL)
-		return "*UNKNOWN*";
-
-	return f->name;
-}
-
-vchar_t *
-alg_oakley_encdef_decrypt(doi, buf, key, iv)
-	int doi;
-	vchar_t *buf, *key, *iv;
-{
-	vchar_t *res;
-	struct enc_algorithm *f;
-#ifdef ENABLE_STATS
-	struct timeval start, end;
-#endif
-
-	f = alg_oakley_encdef(doi);
-	if (f == NULL || f->decrypt == NULL)
-		return NULL;
-
-#ifdef ENABLE_STATS
-	gettimeofday(&start, NULL);
-#endif
-
-	res = (f->decrypt)(buf, key, iv);
-
-#ifdef ENABLE_STATS
-	gettimeofday(&end, NULL);
-	syslog(LOG_NOTICE, "%s(%s klen=%zu size=%zu): %8.6f", __func__,
-		f->name, key->l << 3, buf->l, timedelta(&start, &end));
-#endif
-	return res;
-}
-
-vchar_t *
-alg_oakley_encdef_encrypt(doi, buf, key, iv)
-	int doi;
-	vchar_t *buf, *key, *iv;
-{
-	vchar_t *res;
-	struct enc_algorithm *f;
-#ifdef ENABLE_STATS
-	struct timeval start, end;
-#endif
-
-	f = alg_oakley_encdef(doi);
-	if (f == NULL || f->encrypt == NULL)
-		return NULL;
-
-#ifdef ENABLE_STATS
-	gettimeofday(&start, NULL);
-#endif
-
-	res = (f->encrypt)(buf, key, iv);
-
-#ifdef ENABLE_STATS
-	gettimeofday(&end, NULL);
-	syslog(LOG_NOTICE, "%s(%s klen=%zu size=%zu): %8.6f", __func__,
-		f->name, key->l << 3, buf->l, timedelta(&start, &end));
-#endif
-	return res;
-}
-
-/* ipsec encryption algorithm */
-static struct enc_algorithm *
-alg_ipsec_encdef(doi)
-	int doi;
-{
-	int i;
-
-	for (i = 0; i < ARRAYLEN(ipsec_encdef); i++)
-		if (doi == ipsec_encdef[i].doi) {
-			plog(LLV_DEBUG, LOCATION, NULL, "encryption(%s)\n",
-				ipsec_encdef[i].name);
-			return &ipsec_encdef[i];
-		}
-	return NULL;
-}
-
-int
-alg_ipsec_encdef_doi(type)
-	int type;
-{
-	int i, res = -1;
-
-	for (i = 0; i < ARRAYLEN(ipsec_encdef); i++)
-		if (type == ipsec_encdef[i].type) {
-			res = ipsec_encdef[i].doi;
-			break;
-		}
-	return res;
-}
-
-int
-alg_ipsec_encdef_keylen(doi, len)
-	int doi, len;
-{
-	struct enc_algorithm *f;
-
-	f = alg_ipsec_encdef(doi);
-	if (f == NULL || f->keylen == NULL)
-		return -1;
-
-	return (f->keylen)(len);
-}
-
-/* ipsec hmac algorithm */
-static struct hmac_algorithm *
-alg_ipsec_hmacdef(doi)
-	int doi;
-{
-	int i;
-
-	for (i = 0; i < ARRAYLEN(ipsec_hmacdef); i++)
-		if (doi == ipsec_hmacdef[i].doi) {
-			plog(LLV_DEBUG, LOCATION, NULL, "hmac(%s)\n",
-				ipsec_hmacdef[i].name);
-			return &ipsec_hmacdef[i];
-		}
-	return NULL;
-}
-
-int
-alg_ipsec_hmacdef_doi(type)
-	int type;
-{
-	int i, res = -1;
-
-	for (i = 0; i < ARRAYLEN(ipsec_hmacdef); i++)
-		if (type == ipsec_hmacdef[i].type) {
-			res = ipsec_hmacdef[i].doi;
-			break;
-		}
-	return res;
-}
-
-int
-alg_ipsec_hmacdef_hashlen(doi)
-	int doi;
-{
-	struct hmac_algorithm *f;
-
-	f = alg_ipsec_hmacdef(doi);
-	if (f == NULL || f->hashlen == NULL)
-		return -1;
-
-	return (f->hashlen)();
-}
-
-/* ip compression */
-int
-alg_ipsec_compdef_doi(type)
-	int type;
-{
-	int i, res = -1;
-
-	for (i = 0; i < ARRAYLEN(ipsec_compdef); i++)
-		if (type == ipsec_compdef[i].type) {
-			res = ipsec_compdef[i].doi;
-			break;
-		}
-	return res;
-}
-
-/* dh algorithm */
-static struct dh_algorithm *
-alg_oakley_dhdef(doi)
-	int doi;
-{
-	int i;
-
-	for (i = 0; i < ARRAYLEN(oakley_dhdef); i++)
-		if (doi == oakley_dhdef[i].doi) {
-			plog(LLV_DEBUG, LOCATION, NULL, "hmac(%s)\n",
-				oakley_dhdef[i].name);
-			return &oakley_dhdef[i];
-		}
-	return NULL;
-}
-
-int
-alg_oakley_dhdef_ok(doi)
-	int doi;
-{
-	struct dh_algorithm *f;
-
-	f = alg_oakley_dhdef(doi);
-	if (f == NULL)
-		return 0;
-
-	return 1;
-}
-
-int
-alg_oakley_dhdef_doi(type)
-	int type;
-{
-	int i, res = -1;
-
-	for (i = 0; i < ARRAYLEN(oakley_dhdef); i++)
-		if (type == oakley_dhdef[i].type) {
-			res = oakley_dhdef[i].doi;
-			break;
-		}
-	return res;
-}
-
-struct dhgroup *
-alg_oakley_dhdef_group(doi)
-	int doi;
-{
-	struct dh_algorithm *f;
-
-	f = alg_oakley_dhdef(doi);
-	if (f == NULL || f->dhgroup == NULL)
-		return NULL;
-
-	return f->dhgroup;
-}
-
-const char *
-alg_oakley_dhdef_name (doi)
-	int doi;
-{
-	struct dh_algorithm *f;
-	
-	f = alg_oakley_dhdef(doi);
-	if (f == NULL)
-		return "*UNKNOWN*";
-	return f->name;
-}
-
-/* authentication method */
-int
-alg_oakley_authdef_doi(type)
-	int type;
-{
-	int i, res = -1;
-
-	for (i = 0; i < ARRAYLEN(oakley_authdef); i++)
-		if (type == oakley_authdef[i].type) {
-			res = oakley_authdef[i].doi;
-			break;
-		}
-	return res;
-}
-
-const char *
-alg_oakley_authdef_name (doi)
-	int doi;
-{
-	int i;
-
-	for (i = 0; i < ARRAYLEN(oakley_authdef); i++)
-		if (doi == oakley_authdef[i].doi) {
-			return oakley_authdef[i].name;
-		}
-	return "*UNKNOWN*";
-}
-
-/*
- * give the default key length
- * OUT:	-1:		NG
- *	0:		fixed key cipher, key length not allowed
- *	positive:	default key length
- */
-int
-default_keylen(class, type)
-	int class, type;
-{
-
-	switch (class) {
-	case algclass_isakmp_enc:
-	case algclass_ipsec_enc:
-		break;
-	default:
-		return 0;
-	}
-
-	switch (type) {
-	case algtype_blowfish:
-	case algtype_rc5:
-	case algtype_cast128:
-	case algtype_aes:
-	case algtype_twofish:
-	case algtype_camellia:
-		return 128;
-	default:
-		return 0;
-	}
-}
-
-/*
- * check key length
- * OUT:	-1:	NG
- *	0:	OK
- */
-int
-check_keylen(class, type, len)
-	int class, type, len;
-{
-	int badrange;
-
-	switch (class) {
-	case algclass_isakmp_enc:
-	case algclass_ipsec_enc:
-		break;
-	default:
-		/* unknown class, punt */
-		plog(LLV_ERROR, LOCATION, NULL,
-			"unknown algclass %d\n", class);
-		return -1;
-	}
-
-	/* key length must be multiple of 8 bytes - RFC2451 2.2 */
-	switch (type) {
-	case algtype_blowfish:
-	case algtype_rc5:
-	case algtype_cast128:
-	case algtype_aes:
-	case algtype_twofish:
-	case algtype_camellia:
-		if (len % 8 != 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"key length %d is not multiple of 8\n", len);
-			return -1;
-		}
-		break;
-	}
-
-	/* key length range */
-	badrange = 0;
-	switch (type) {
-	case algtype_blowfish:
-		if (len < 40 || 448 < len)
-			badrange++;
-		break;
-	case algtype_rc5:
-		if (len < 40 || 2040 < len)
-			badrange++;
-		break;
-	case algtype_cast128:
-		if (len < 40 || 128 < len)
-			badrange++;
-		break;
-	case algtype_aes:
-		if (!(len == 128 || len == 192 || len == 256))
-			badrange++;
-		break;
-	case algtype_twofish:
-		if (len < 40 || 256 < len)
-			badrange++;
-		break;
-	case algtype_camellia:
-		if (!(len == 128 || len == 192 || len == 256))
-			badrange++;
-		break;
-	default:
-		if (len) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"key length is not allowed");
-			return -1;
-		}
-		break;
-	}
-	if (badrange) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"key length out of range\n");
-		return -1;
-	}
-
-	return 0;
-}
-
-/*
- * convert algorithm type to DOI value.
- * OUT	-1   : NG
- *	other: converted.
- */
-int
-algtype2doi(class, type)
-	int class, type;
-{
-	int res = -1;
-
-	switch (class) {
-	case algclass_ipsec_enc:
-		res = alg_ipsec_encdef_doi(type);
-		break;
-	case algclass_ipsec_auth:
-		res = alg_ipsec_hmacdef_doi(type);
-		break;
-	case algclass_ipsec_comp:
-		res = alg_ipsec_compdef_doi(type);
-		break;
-	case algclass_isakmp_enc:
-		res =  alg_oakley_encdef_doi(type);
-		break;
-	case algclass_isakmp_hash:
-		res = alg_oakley_hashdef_doi(type);
-		break;
-	case algclass_isakmp_dh:
-		res = alg_oakley_dhdef_doi(type);
-		break;
-	case algclass_isakmp_ameth:
-		res = alg_oakley_authdef_doi(type);
-		break;
-	}
-	return res;
-}
-
-/*
- * convert algorithm class to DOI value.
- * OUT	-1   : NG
- *	other: converted.
- */
-int
-algclass2doi(class)
-	int class;
-{
-	switch (class) {
-	case algclass_ipsec_enc:
-		return IPSECDOI_PROTO_IPSEC_ESP;
-	case algclass_ipsec_auth:
-		return IPSECDOI_ATTR_AUTH;
-	case algclass_ipsec_comp:
-		return IPSECDOI_PROTO_IPCOMP;
-	case algclass_isakmp_enc:
-		return OAKLEY_ATTR_ENC_ALG;
-	case algclass_isakmp_hash:
-		return OAKLEY_ATTR_HASH_ALG;
-	case algclass_isakmp_dh:
-		return OAKLEY_ATTR_GRP_DESC;
-	case algclass_isakmp_ameth:
-		return OAKLEY_ATTR_AUTH_METHOD;
-	default:
-		return -1;
-	}
-	/*NOTREACHED*/
-	return -1;
-}
diff --git a/src/racoon/algorithm.h b/src/racoon/algorithm.h
deleted file mode 100644
index 8b631b6..0000000
--- a/src/racoon/algorithm.h
+++ /dev/null
@@ -1,216 +0,0 @@
-/*	$NetBSD: algorithm.h,v 1.5 2006/10/06 12:02:27 manu Exp $	*/
-
-/* Id: algorithm.h,v 1.10 2005/04/09 16:25:23 manubsd Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _ALGORITHM_H
-#define _ALGORITHM_H
-
-#include <gnuc.h>
-
-/* algorithm class */
-enum {
-	algclass_ipsec_enc,
-	algclass_ipsec_auth,
-	algclass_ipsec_comp,
-	algclass_isakmp_enc,
-	algclass_isakmp_hash,
-	algclass_isakmp_dh,
-	algclass_isakmp_ameth,	/* authentication method. */
-#define MAXALGCLASS	7
-};
-
-#define ALG_DEFAULT_KEYLEN	64
-
-#define ALGTYPE_NOTHING		0
-
-/* algorithm type */
-enum algtype {
-	algtype_nothing = 0,
-
-	/* enc */
-	algtype_des_iv64,
-	algtype_des,
-	algtype_3des,
-	algtype_rc5,
-	algtype_idea,
-	algtype_cast128,
-	algtype_blowfish,
-	algtype_3idea,
-	algtype_des_iv32,
-	algtype_rc4,
-	algtype_null_enc,
-	algtype_aes,
-	algtype_twofish,
-	algtype_camellia,
-
-	/* ipsec auth */
-	algtype_hmac_md5,
-	algtype_hmac_sha1,
-	algtype_des_mac,
-	algtype_kpdk,
-	algtype_non_auth,
-	algtype_hmac_sha2_256,
-	algtype_hmac_sha2_384,
-	algtype_hmac_sha2_512,
-
-	/* ipcomp */
-	algtype_oui,
-	algtype_deflate,
-	algtype_lzs,
-
-	/* hash */
-	algtype_md5,
-	algtype_sha1,
-	algtype_tiger,
-	algtype_sha2_256,
-	algtype_sha2_384,
-	algtype_sha2_512,
-
-	/* dh_group */
-	algtype_modp768,
-	algtype_modp1024,
-	algtype_ec2n155,
-	algtype_ec2n185,
-	algtype_modp1536,
-	algtype_modp2048,
-	algtype_modp3072,
-	algtype_modp4096,
-	algtype_modp6144,
-	algtype_modp8192,
-
-	/* authentication method. */
-	algtype_psk,
-	algtype_dsssig,
-	algtype_rsasig,
-	algtype_rsaenc,
-	algtype_rsarev,
-	algtype_gssapikrb,
-#ifdef ENABLE_HYBRID
-	algtype_hybrid_rsa_s,
-	algtype_hybrid_dss_s,
-	algtype_hybrid_rsa_c,
-	algtype_hybrid_dss_c,
-	algtype_xauth_psk_s,
-	algtype_xauth_psk_c,
-	algtype_xauth_rsa_s,
-	algtype_xauth_rsa_c,
-#endif
-};
-
-struct hmac_algorithm {
-	char *name;
-	int type;
-	int doi;
-	caddr_t (*init) __P((vchar_t *));
-	void (*update) __P((caddr_t, vchar_t *));
-	vchar_t *(*final) __P((caddr_t));
-	int (*hashlen) __P((void));
-	vchar_t *(*one) __P((vchar_t *, vchar_t *));
-};
-
-struct hash_algorithm {
-	char *name;
-	int type;
-	int doi;
-	caddr_t (*init) __P((void));
-	void (*update) __P((caddr_t, vchar_t *));
-	vchar_t *(*final) __P((caddr_t));
-	int (*hashlen) __P((void));
-	vchar_t *(*one) __P((vchar_t *));
-};
-
-struct enc_algorithm {
-	char *name;
-	int type;
-	int doi;
-	int blocklen;
-	vchar_t *(*encrypt) __P((vchar_t *, vchar_t *, vchar_t *));
-	vchar_t *(*decrypt) __P((vchar_t *, vchar_t *, vchar_t *));
-	int (*weakkey) __P((vchar_t *));
-	int (*keylen) __P((int));
-};
-
-/* dh group */
-struct dh_algorithm {
-	char *name;
-	int type;
-	int doi;
-	struct dhgroup *dhgroup;
-};
-
-/* ipcomp, auth meth, dh group */
-struct misc_algorithm {
-	char *name;
-	int type;
-	int doi;
-};
-
-extern int alg_oakley_hashdef_ok __P((int));
-extern int alg_oakley_hashdef_doi __P((int));
-extern int alg_oakley_hashdef_hashlen __P((int));
-extern vchar_t *alg_oakley_hashdef_one __P((int, vchar_t *));
-
-extern int alg_oakley_hmacdef_doi __P((int));
-extern vchar_t *alg_oakley_hmacdef_one __P((int, vchar_t *, vchar_t *));
-
-extern int alg_oakley_encdef_ok __P((int));
-extern int alg_oakley_encdef_doi __P((int));
-extern int alg_oakley_encdef_keylen __P((int, int));
-extern int alg_oakley_encdef_blocklen __P((int));
-extern vchar_t *alg_oakley_encdef_decrypt __P((int, vchar_t *, vchar_t *, vchar_t *));
-extern vchar_t *alg_oakley_encdef_encrypt __P((int, vchar_t *, vchar_t *, vchar_t *));
-
-extern int alg_ipsec_encdef_doi __P((int));
-extern int alg_ipsec_encdef_keylen __P((int, int));
-
-extern int alg_ipsec_hmacdef_doi __P((int));
-extern int alg_ipsec_hmacdef_hashlen __P((int));
-
-extern int alg_ipsec_compdef_doi __P((int));
-
-extern int alg_oakley_dhdef_doi __P((int));
-extern int alg_oakley_dhdef_ok __P((int));
-extern struct dhgroup *alg_oakley_dhdef_group __P((int));
-
-extern int alg_oakley_authdef_doi __P((int));
-
-extern int default_keylen __P((int, int));
-extern int check_keylen __P((int, int, int));
-extern int algtype2doi __P((int, int));
-extern int algclass2doi __P((int));
-
-extern const char *alg_oakley_encdef_name __P((int));
-extern const char *alg_oakley_hashdef_name __P((int));
-extern const char *alg_oakley_dhdef_name __P((int));
-extern const char *alg_oakley_authdef_name __P((int));
-
-#endif /* _ALGORITHM_H */
diff --git a/src/racoon/backupsa.c b/src/racoon/backupsa.c
deleted file mode 100644
index 9496000..0000000
--- a/src/racoon/backupsa.c
+++ /dev/null
@@ -1,468 +0,0 @@
-/*	$NetBSD: backupsa.c,v 1.8.4.1 2007/08/01 11:52:19 vanhu Exp $	*/
-
-/*	$KAME: backupsa.c,v 1.16 2001/12/31 20:13:40 thorpej Exp $	*/
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/socket.h>
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <ctype.h>
-
-#include <netinet/in.h>
-#include PATH_IPSEC_H
-
-#if TIME_WITH_SYS_TIME
-# include <sys/time.h>
-# include <time.h>
-#else
-# if HAVE_SYS_TIME_H
-#  include <sys/time.h>
-# else
-#  include <time.h>
-# endif
-#endif
-
-#include "var.h"
-#include "misc.h"
-#include "vmbuf.h"
-#include "str2val.h"
-#include "plog.h"
-#include "debug.h"
-
-#include "localconf.h"
-#include "sockmisc.h"
-#include "safefile.h"
-#include "backupsa.h"
-#include "libpfkey.h"
-
-/*
- * (time string)%(sa parameter)
- * (time string) := ex. Nov 24 18:22:48 1986
- * (sa parameter) :=
- *    src dst satype spi mode reqid wsize \
- *    e_type e_keylen a_type a_keylen flags \
- *    l_alloc l_bytes l_addtime l_usetime seq keymat
- */
-static char *format = "%b %d %T %Y";	/* time format */
-static char *strmon[12] = {
-        "Jan", "Feb", "Mar", "Apr", "May", "Jun",
-        "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"
-};
-
-static char *str2tmx __P((char *, struct tm *));
-static int str2num __P((char *, int));
-
-/*
- * output the sa parameter.
- */
-int
-backupsa_to_file(sa_args)
-	struct pfkey_send_sa_args *sa_args;
-{
-	char buf[1024];
-	struct tm *tm;
-	time_t t;
-	char *p, *k;
-	int len, l, i;
-	FILE *fp;
-
-	p = buf;
-	len = sizeof(buf);
-
-	t = time(NULL);
-	tm = localtime(&t);
-	l = strftime(p, len, format, tm);
-	p += l;
-	len -= l;
-	if (len < 0)
-		goto err;
-
-	l = snprintf(p, len, "%%");
-	if (l < 0 || l >= len)
-		goto err;
-	p += l;
-	len -= l;
-	if (len < 0)
-		goto err;
-
-        i = getnameinfo(sa_args->src, sysdep_sa_len(sa_args->src), p, len, NULL, 0, NIFLAGS);
-	if (i != 0)
-		goto err;
-	l = strlen(p);
-	p += l;
-	len -= l;
-	if (len < 0)
-		goto err;
-
-	l = snprintf(p, len, " ");
-	if (l < 0 || l >= len)
-		goto err;
-	p += l;
-	len -= l;
-	if (len < 0)
-		goto err;
-
-        i = getnameinfo(sa_args->dst, sysdep_sa_len(sa_args->dst), p, len, NULL, 0, NIFLAGS);
-	if (i != 0)
-		goto err;
-	l = strlen(p);
-	p += l;
-	len -= l;
-	if (len < 0)
-		goto err;
-
-	l = snprintf(p, len,
-		" %u %lu %u %u %u "
-		"%u %u %u %u %u "
-		"%u %llu %llu %llu %u",
-		sa_args->satype, (unsigned long)ntohl(sa_args->spi), 
-		sa_args->mode, sa_args->reqid, sa_args->wsize, sa_args->e_type, 
-		sa_args->e_keylen, sa_args->a_type, sa_args->a_keylen, 
-		sa_args->flags, sa_args->l_alloc, 
-		(unsigned long long)sa_args->l_bytes, 
-		(unsigned long long)sa_args->l_addtime, 
-		(unsigned long long)sa_args->l_usetime, sa_args->seq);
-
-	if (l < 0 || l >= len)
-		goto err;
-	p += l;
-	len -= l;
-	if (len < 0)
-		goto err;
-
-	k = val2str(sa_args->keymat, sa_args->e_keylen + sa_args->a_keylen);
-	l = snprintf(p, len, " %s", k);
-	racoon_free(k);
-	if (l < 0 || l >= len)
-		goto err;
-	p += l;
-	len -= l;
-	if (len < 0)
-		goto err;
-
-	/* open the file and write the SA parameter */
-	if (safefile(lcconf->pathinfo[LC_PATHTYPE_BACKUPSA], 1) != 0 ||
-	    (fp = fopen(lcconf->pathinfo[LC_PATHTYPE_BACKUPSA], "a")) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to open the backup file %s.\n",
-			lcconf->pathinfo[LC_PATHTYPE_BACKUPSA]);
-		return -1;
-	}
-	fprintf(fp, "%s\n", buf);
-	fclose(fp);
-
-	return 0;
-
-err:
-	plog(LLV_ERROR, LOCATION, NULL,
-		"SA cannot be saved to a file.\n");
-	return -1;
-}
-
-int
-backupsa_from_file()
-{
-	FILE *fp;
-	char buf[512];
-	struct tm tm;
-	time_t created, current;
-	char *p, *q;
-	size_t keymatlen;
-	int line;
-	struct pfkey_send_sa_args sa_args;
-
-	memset(&sa_args, 0, sizeof(sa_args));
-
-	if (safefile(lcconf->pathinfo[LC_PATHTYPE_BACKUPSA], 1) == 0)
-		fp = fopen(lcconf->pathinfo[LC_PATHTYPE_BACKUPSA], "r");
-	else
-		fp = NULL;
-	if (fp == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to open the backup file %s.\n",
-			lcconf->pathinfo[LC_PATHTYPE_BACKUPSA]);
-		return -1;
-	}
-
-	current = time(NULL);
-
-	for(line = 1; fgets(buf, sizeof(buf), fp) != NULL; line++) {
-		/* comment line */
-		if (buf[0] == '#')
-			continue;
-
-		memset(&tm, 0, sizeof(tm));
-		p = str2tmx(buf, &tm);
-		if (*p != '%') {
-	err:
-			plog(LLV_ERROR, LOCATION, NULL,
-				"illegal format line#%d in %s: %s\n",
-				line, lcconf->pathinfo[LC_PATHTYPE_BACKUPSA], 
-				buf);
-			goto next;
-		}
-		created = mktime(&tm);
-		p++;
-
-		for (q = p; *q != '\0' && !isspace((int)*q); q++)
-			;
-		*q = '\0';
-		if ((sa_args.src = str2saddr(p, NULL)) == NULL)
-			goto next;
-		p = q + 1;
-
-		for (q = p; *q != '\0' && !isspace((int)*q); q++)
-			;
-		*q = '\0';
-		if ((sa_args.dst = str2saddr(p, NULL)) == NULL)
-			goto next;
-		p = q + 1;
-
-#define GETNEXTNUM(value, function) 				\
-do { 								\
-	char *y; 						\
-	for (q = p; *q != '\0' && !isspace((int)*q); q++) 	\
-		; 						\
-	*q = '\0'; 						\
-	(value) = function(p, &y, 10); 				\
-	if ((value) == 0 && *y != '\0') 			\
-		goto next; 					\
-	p = q + 1; 						\
-} while (/*CONSTCOND*/0);
-
-		GETNEXTNUM(sa_args.satype, strtoul);
-		GETNEXTNUM(sa_args.spi, strtoul);
-		sa_args.spi = ntohl(sa_args.spi);
-		GETNEXTNUM(sa_args.mode, strtoul);
-		GETNEXTNUM(sa_args.reqid, strtoul);
-		GETNEXTNUM(sa_args.wsize, strtoul);
-		GETNEXTNUM(sa_args.e_type, strtoul);
-		GETNEXTNUM(sa_args.e_keylen, strtoul);
-		GETNEXTNUM(sa_args.a_type, strtoul);
-		GETNEXTNUM(sa_args.a_keylen, strtoul);
-		GETNEXTNUM(sa_args.flags, strtoul);
-		GETNEXTNUM(sa_args.l_alloc, strtoul);
-		GETNEXTNUM(sa_args.l_bytes, strtouq);
-		GETNEXTNUM(sa_args.l_addtime, strtouq);
-		GETNEXTNUM(sa_args.l_usetime, strtouq);
-		GETNEXTNUM(sa_args.seq, strtoul);
-
-#undef GETNEXTNUM
-
-		sa_args.keymat = str2val(p, 16, &keymatlen);
-		if (sa_args.keymat == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"illegal format(keymat) line#%d in %s: %s\n",
-				line, lcconf->pathinfo[LC_PATHTYPE_BACKUPSA], 
-				buf);
-			goto next;
-		}
-
-		if (created + sa_args.l_addtime < current) {
-			plog(LLV_DEBUG, LOCATION, NULL,
-				"ignore this line#%d in %s due to expiration\n",
-				line, lcconf->pathinfo[LC_PATHTYPE_BACKUPSA]);
-			goto next;
-		}
-		sa_args.l_addtime -= current - created;
-
-		if (pfkey_send_add2(&sa_args) < 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"restore SA failed line#%d in %s: %s\n",
-				line, lcconf->pathinfo[LC_PATHTYPE_BACKUPSA], 
-				ipsec_strerror());
-		}
-
-next:
-	 	if (sa_args.src != NULL) {
-			racoon_free(sa_args.src);
-			sa_args.src = NULL;
-		}
-		if (sa_args.dst != NULL) {
-			racoon_free(sa_args.dst);
-			sa_args.dst = NULL;
-		}
-		if (sa_args.keymat != NULL) {
-			racoon_free(sa_args.keymat);
-			sa_args.keymat = NULL;
-		}
-	}
-
-	fclose(fp);
-
-	/*
-	 * There is a possibility that an abnormal system down will happen
-	 * again before new negotiation will be started.  so racoon clears
-	 * the backup file here.  it's ok that old SAs are remained in the
-	 * file.  any old SA will not be installed because racoon checks the
-	 * lifetime and compare with current time.
-	 */
-
-	return 0;
-}
-
-int
-backupsa_clean()
-{
-	FILE *fp;
-
-	/* simply return if the file is not defined. */
-	if (!lcconf->pathinfo[LC_PATHTYPE_BACKUPSA])
-		return 0;
-
-	fp = fopen(lcconf->pathinfo[LC_PATHTYPE_BACKUPSA], "w+");
-	if (fp == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to clean the backup file %s.\n",
-			lcconf->pathinfo[LC_PATHTYPE_BACKUPSA]);
-		return -1;
-	}
-	fclose(fp);
-	return 0;
-}
-
-/*
- * convert fixed string into the tm structure.
- * The fixed string is like 'Nov 24 18:22:48 1986'.
- * static char *format = "%b %d %T %Y";
- */
-static char *
-str2tmx(char *p, struct tm *tm)
-{
-	int i, len;
-
-	/* Month */
-        for (i = 0; i < sizeof(strmon)/sizeof(strmon[0]); i++) {
-		if (strncasecmp(p, strmon[i], strlen(strmon[i])) == 0) {
-			tm->tm_mon = i;
-			break;
-		}
-	}
-	if (i == sizeof(strmon)/sizeof(strmon[0]))
-		return 0;
-	p += strlen(strmon[i]);
-	if (*p++ != ' ')
-		return 0;
-
-	/* Day */
-	len = 2;
-	tm->tm_mday = str2num(p, len);
-	if (tm->tm_mday == -1 || tm->tm_mday > 31)
-		return 0;
-	p += len;
-	if (*p++ != ' ')
-		return 0;
-
-	/* Hour */
-	len = 2;
-	tm->tm_hour = str2num(p, len);
-	if (tm->tm_hour == -1 || tm->tm_hour > 24)
-		return 0;
-	p += len;
-	if (*p++ != ':')
-		return 0;
-
-	/* Min */
-	len = 2;
-	tm->tm_min = str2num(p, len);
-	if (tm->tm_min == -1 || tm->tm_min > 60)
-		return 0;
-	p += len;
-	if (*p++ != ':')
-		return 0;
-
-	/* Sec */
-	len = 2;
-	tm->tm_sec = str2num(p, len);
-	if (tm->tm_sec == -1 || tm->tm_sec > 60)
-		return 0;
-	p += len;
-	if (*p++ != ' ')
-		return 0;
-
-	/* Year */
-	len = 4;
-	tm->tm_year = str2num(p, len);
-	if (tm->tm_year == -1 || tm->tm_year < 1900)
-		return 0;
-	tm->tm_year -= 1900;
-	p += len;
-
-	return p;
-}
-
-static int
-str2num(p, len)
-	char *p;
-	int len;
-{
-	int res, i;
-
-	res = 0;
-        for (i = len; i > 0; i--) {
-		if (!isdigit((int)*p))
-			return -1;
-		res *= 10;
-		res += *p - '0';
-		p++;
-	}
-
-	return res;
-}
-
-#ifdef TEST
-#include <stdio.h>
-int
-main()
-{
-	struct tm tm;
-	time_t t;
-	char *buf = "Nov 24 18:22:48 1986 ";
-	char *p;
-
-	memset(&tm, 0, sizeof(tm));
-	p = str2tmx(buf, &tm);
-	printf("[%x]\n", *p);
-	t = mktime(&tm);
-	if (t == -1)
-		printf("mktime failed.");
-	p = ctime(&t);
-	printf("[%s]\n", p);
-
-	exit(0);
-}
-#endif
diff --git a/src/racoon/backupsa.h b/src/racoon/backupsa.h
deleted file mode 100644
index e563791..0000000
--- a/src/racoon/backupsa.h
+++ /dev/null
@@ -1,41 +0,0 @@
-/*	$NetBSD: backupsa.h,v 1.5 2006/12/09 05:52:57 manu Exp $	*/
-
-/* Id: backupsa.h,v 1.3 2004/06/11 16:00:15 ludvigm Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _BACKUPSA_H
-#define _BACKUPSA_H
-
-extern int backupsa_to_file __P((struct pfkey_send_sa_args *));
-extern int backupsa_from_file __P((void));
-extern int backupsa_clean __P((void));
-
-#endif /* _BACKUPSA_H */
diff --git a/src/racoon/cfparse.h b/src/racoon/cfparse.h
deleted file mode 100644
index 2946b3e..0000000
--- a/src/racoon/cfparse.h
+++ /dev/null
@@ -1,392 +0,0 @@
-/* A Bison parser, made by GNU Bison 2.3.  */
-
-/* Skeleton interface for Bison's Yacc-like parsers in C
-
-   Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
-   Free Software Foundation, Inc.
-
-   This program is free software; you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2, or (at your option)
-   any later version.
-
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   GNU General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 51 Franklin Street, Fifth Floor,
-   Boston, MA 02110-1301, USA.  */
-
-/* As a special exception, you may create a larger work that contains
-   part or all of the Bison parser skeleton and distribute that work
-   under terms of your choice, so long as that work isn't itself a
-   parser generator using the skeleton or a modified version thereof
-   as a parser skeleton.  Alternatively, if you modify or redistribute
-   the parser skeleton itself, you may (at your option) remove this
-   special exception, which will cause the skeleton and the resulting
-   Bison output files to be licensed under the GNU General Public
-   License without this special exception.
-
-   This special exception was added by the Free Software Foundation in
-   version 2.2 of Bison.  */
-
-/* Tokens.  */
-#ifndef YYTOKENTYPE
-# define YYTOKENTYPE
-   /* Put the tokens into the symbol table, so that GDB and other debuggers
-      know about them.  */
-   enum yytokentype {
-     PRIVSEP = 258,
-     USER = 259,
-     GROUP = 260,
-     CHROOT = 261,
-     PATH = 262,
-     PATHTYPE = 263,
-     INCLUDE = 264,
-     IDENTIFIER = 265,
-     VENDORID = 266,
-     LOGGING = 267,
-     LOGLEV = 268,
-     PADDING = 269,
-     PAD_RANDOMIZE = 270,
-     PAD_RANDOMIZELEN = 271,
-     PAD_MAXLEN = 272,
-     PAD_STRICT = 273,
-     PAD_EXCLTAIL = 274,
-     LISTEN = 275,
-     X_ISAKMP = 276,
-     X_ISAKMP_NATT = 277,
-     X_ADMIN = 278,
-     STRICT_ADDRESS = 279,
-     ADMINSOCK = 280,
-     DISABLED = 281,
-     LDAPCFG = 282,
-     LDAP_HOST = 283,
-     LDAP_PORT = 284,
-     LDAP_PVER = 285,
-     LDAP_BASE = 286,
-     LDAP_BIND_DN = 287,
-     LDAP_BIND_PW = 288,
-     LDAP_SUBTREE = 289,
-     LDAP_ATTR_USER = 290,
-     LDAP_ATTR_ADDR = 291,
-     LDAP_ATTR_MASK = 292,
-     LDAP_ATTR_GROUP = 293,
-     LDAP_ATTR_MEMBER = 294,
-     MODECFG = 295,
-     CFG_NET4 = 296,
-     CFG_MASK4 = 297,
-     CFG_DNS4 = 298,
-     CFG_NBNS4 = 299,
-     CFG_DEFAULT_DOMAIN = 300,
-     CFG_AUTH_SOURCE = 301,
-     CFG_AUTH_GROUPS = 302,
-     CFG_SYSTEM = 303,
-     CFG_RADIUS = 304,
-     CFG_PAM = 305,
-     CFG_LDAP = 306,
-     CFG_LOCAL = 307,
-     CFG_NONE = 308,
-     CFG_GROUP_SOURCE = 309,
-     CFG_ACCOUNTING = 310,
-     CFG_CONF_SOURCE = 311,
-     CFG_MOTD = 312,
-     CFG_POOL_SIZE = 313,
-     CFG_AUTH_THROTTLE = 314,
-     CFG_SPLIT_NETWORK = 315,
-     CFG_SPLIT_LOCAL = 316,
-     CFG_SPLIT_INCLUDE = 317,
-     CFG_SPLIT_DNS = 318,
-     CFG_PFS_GROUP = 319,
-     CFG_SAVE_PASSWD = 320,
-     RETRY = 321,
-     RETRY_COUNTER = 322,
-     RETRY_INTERVAL = 323,
-     RETRY_PERSEND = 324,
-     RETRY_PHASE1 = 325,
-     RETRY_PHASE2 = 326,
-     NATT_KA = 327,
-     ALGORITHM_CLASS = 328,
-     ALGORITHMTYPE = 329,
-     STRENGTHTYPE = 330,
-     SAINFO = 331,
-     FROM = 332,
-     REMOTE = 333,
-     ANONYMOUS = 334,
-     INHERIT = 335,
-     EXCHANGE_MODE = 336,
-     EXCHANGETYPE = 337,
-     DOI = 338,
-     DOITYPE = 339,
-     SITUATION = 340,
-     SITUATIONTYPE = 341,
-     CERTIFICATE_TYPE = 342,
-     CERTTYPE = 343,
-     PEERS_CERTFILE = 344,
-     CA_TYPE = 345,
-     VERIFY_CERT = 346,
-     SEND_CERT = 347,
-     SEND_CR = 348,
-     IDENTIFIERTYPE = 349,
-     IDENTIFIERQUAL = 350,
-     MY_IDENTIFIER = 351,
-     PEERS_IDENTIFIER = 352,
-     VERIFY_IDENTIFIER = 353,
-     DNSSEC = 354,
-     CERT_X509 = 355,
-     CERT_PLAINRSA = 356,
-     NONCE_SIZE = 357,
-     DH_GROUP = 358,
-     KEEPALIVE = 359,
-     PASSIVE = 360,
-     INITIAL_CONTACT = 361,
-     NAT_TRAVERSAL = 362,
-     REMOTE_FORCE_LEVEL = 363,
-     PROPOSAL_CHECK = 364,
-     PROPOSAL_CHECK_LEVEL = 365,
-     GENERATE_POLICY = 366,
-     GENERATE_LEVEL = 367,
-     SUPPORT_PROXY = 368,
-     PROPOSAL = 369,
-     EXEC_PATH = 370,
-     EXEC_COMMAND = 371,
-     EXEC_SUCCESS = 372,
-     EXEC_FAILURE = 373,
-     GSS_ID = 374,
-     GSS_ID_ENC = 375,
-     GSS_ID_ENCTYPE = 376,
-     COMPLEX_BUNDLE = 377,
-     DPD = 378,
-     DPD_DELAY = 379,
-     DPD_RETRY = 380,
-     DPD_MAXFAIL = 381,
-     PH1ID = 382,
-     XAUTH_LOGIN = 383,
-     WEAK_PHASE1_CHECK = 384,
-     PREFIX = 385,
-     PORT = 386,
-     PORTANY = 387,
-     UL_PROTO = 388,
-     ANY = 389,
-     IKE_FRAG = 390,
-     ESP_FRAG = 391,
-     MODE_CFG = 392,
-     PFS_GROUP = 393,
-     LIFETIME = 394,
-     LIFETYPE_TIME = 395,
-     LIFETYPE_BYTE = 396,
-     STRENGTH = 397,
-     REMOTEID = 398,
-     SCRIPT = 399,
-     PHASE1_UP = 400,
-     PHASE1_DOWN = 401,
-     NUMBER = 402,
-     SWITCH = 403,
-     BOOLEAN = 404,
-     HEXSTRING = 405,
-     QUOTEDSTRING = 406,
-     ADDRSTRING = 407,
-     ADDRRANGE = 408,
-     UNITTYPE_BYTE = 409,
-     UNITTYPE_KBYTES = 410,
-     UNITTYPE_MBYTES = 411,
-     UNITTYPE_TBYTES = 412,
-     UNITTYPE_SEC = 413,
-     UNITTYPE_MIN = 414,
-     UNITTYPE_HOUR = 415,
-     EOS = 416,
-     BOC = 417,
-     EOC = 418,
-     COMMA = 419
-   };
-#endif
-/* Tokens.  */
-#define PRIVSEP 258
-#define USER 259
-#define GROUP 260
-#define CHROOT 261
-#define PATH 262
-#define PATHTYPE 263
-#define INCLUDE 264
-#define IDENTIFIER 265
-#define VENDORID 266
-#define LOGGING 267
-#define LOGLEV 268
-#define PADDING 269
-#define PAD_RANDOMIZE 270
-#define PAD_RANDOMIZELEN 271
-#define PAD_MAXLEN 272
-#define PAD_STRICT 273
-#define PAD_EXCLTAIL 274
-#define LISTEN 275
-#define X_ISAKMP 276
-#define X_ISAKMP_NATT 277
-#define X_ADMIN 278
-#define STRICT_ADDRESS 279
-#define ADMINSOCK 280
-#define DISABLED 281
-#define LDAPCFG 282
-#define LDAP_HOST 283
-#define LDAP_PORT 284
-#define LDAP_PVER 285
-#define LDAP_BASE 286
-#define LDAP_BIND_DN 287
-#define LDAP_BIND_PW 288
-#define LDAP_SUBTREE 289
-#define LDAP_ATTR_USER 290
-#define LDAP_ATTR_ADDR 291
-#define LDAP_ATTR_MASK 292
-#define LDAP_ATTR_GROUP 293
-#define LDAP_ATTR_MEMBER 294
-#define MODECFG 295
-#define CFG_NET4 296
-#define CFG_MASK4 297
-#define CFG_DNS4 298
-#define CFG_NBNS4 299
-#define CFG_DEFAULT_DOMAIN 300
-#define CFG_AUTH_SOURCE 301
-#define CFG_AUTH_GROUPS 302
-#define CFG_SYSTEM 303
-#define CFG_RADIUS 304
-#define CFG_PAM 305
-#define CFG_LDAP 306
-#define CFG_LOCAL 307
-#define CFG_NONE 308
-#define CFG_GROUP_SOURCE 309
-#define CFG_ACCOUNTING 310
-#define CFG_CONF_SOURCE 311
-#define CFG_MOTD 312
-#define CFG_POOL_SIZE 313
-#define CFG_AUTH_THROTTLE 314
-#define CFG_SPLIT_NETWORK 315
-#define CFG_SPLIT_LOCAL 316
-#define CFG_SPLIT_INCLUDE 317
-#define CFG_SPLIT_DNS 318
-#define CFG_PFS_GROUP 319
-#define CFG_SAVE_PASSWD 320
-#define RETRY 321
-#define RETRY_COUNTER 322
-#define RETRY_INTERVAL 323
-#define RETRY_PERSEND 324
-#define RETRY_PHASE1 325
-#define RETRY_PHASE2 326
-#define NATT_KA 327
-#define ALGORITHM_CLASS 328
-#define ALGORITHMTYPE 329
-#define STRENGTHTYPE 330
-#define SAINFO 331
-#define FROM 332
-#define REMOTE 333
-#define ANONYMOUS 334
-#define INHERIT 335
-#define EXCHANGE_MODE 336
-#define EXCHANGETYPE 337
-#define DOI 338
-#define DOITYPE 339
-#define SITUATION 340
-#define SITUATIONTYPE 341
-#define CERTIFICATE_TYPE 342
-#define CERTTYPE 343
-#define PEERS_CERTFILE 344
-#define CA_TYPE 345
-#define VERIFY_CERT 346
-#define SEND_CERT 347
-#define SEND_CR 348
-#define IDENTIFIERTYPE 349
-#define IDENTIFIERQUAL 350
-#define MY_IDENTIFIER 351
-#define PEERS_IDENTIFIER 352
-#define VERIFY_IDENTIFIER 353
-#define DNSSEC 354
-#define CERT_X509 355
-#define CERT_PLAINRSA 356
-#define NONCE_SIZE 357
-#define DH_GROUP 358
-#define KEEPALIVE 359
-#define PASSIVE 360
-#define INITIAL_CONTACT 361
-#define NAT_TRAVERSAL 362
-#define REMOTE_FORCE_LEVEL 363
-#define PROPOSAL_CHECK 364
-#define PROPOSAL_CHECK_LEVEL 365
-#define GENERATE_POLICY 366
-#define GENERATE_LEVEL 367
-#define SUPPORT_PROXY 368
-#define PROPOSAL 369
-#define EXEC_PATH 370
-#define EXEC_COMMAND 371
-#define EXEC_SUCCESS 372
-#define EXEC_FAILURE 373
-#define GSS_ID 374
-#define GSS_ID_ENC 375
-#define GSS_ID_ENCTYPE 376
-#define COMPLEX_BUNDLE 377
-#define DPD 378
-#define DPD_DELAY 379
-#define DPD_RETRY 380
-#define DPD_MAXFAIL 381
-#define PH1ID 382
-#define XAUTH_LOGIN 383
-#define WEAK_PHASE1_CHECK 384
-#define PREFIX 385
-#define PORT 386
-#define PORTANY 387
-#define UL_PROTO 388
-#define ANY 389
-#define IKE_FRAG 390
-#define ESP_FRAG 391
-#define MODE_CFG 392
-#define PFS_GROUP 393
-#define LIFETIME 394
-#define LIFETYPE_TIME 395
-#define LIFETYPE_BYTE 396
-#define STRENGTH 397
-#define REMOTEID 398
-#define SCRIPT 399
-#define PHASE1_UP 400
-#define PHASE1_DOWN 401
-#define NUMBER 402
-#define SWITCH 403
-#define BOOLEAN 404
-#define HEXSTRING 405
-#define QUOTEDSTRING 406
-#define ADDRSTRING 407
-#define ADDRRANGE 408
-#define UNITTYPE_BYTE 409
-#define UNITTYPE_KBYTES 410
-#define UNITTYPE_MBYTES 411
-#define UNITTYPE_TBYTES 412
-#define UNITTYPE_SEC 413
-#define UNITTYPE_MIN 414
-#define UNITTYPE_HOUR 415
-#define EOS 416
-#define BOC 417
-#define EOC 418
-#define COMMA 419
-
-
-
-
-#if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
-typedef union YYSTYPE
-#line 174 "cfparse.y"
-{
-	unsigned long num;
-	vchar_t *val;
-	struct remoteconf *rmconf;
-	struct sockaddr *saddr;
-	struct sainfoalg *alg;
-}
-/* Line 1489 of yacc.c.  */
-#line 385 "cfparse.h"
-	YYSTYPE;
-# define yystype YYSTYPE /* obsolescent; will be withdrawn */
-# define YYSTYPE_IS_DECLARED 1
-# define YYSTYPE_IS_TRIVIAL 1
-#endif
-
-extern YYSTYPE yylval;
-
diff --git a/src/racoon/cfparse.y b/src/racoon/cfparse.y
deleted file mode 100644
index 540c400..0000000
--- a/src/racoon/cfparse.y
+++ /dev/null
@@ -1,2599 +0,0 @@
-/*	$NetBSD: cfparse.y,v 1.18.4.7 2008/07/21 20:45:32 tteras Exp $	*/
-
-/* Id: cfparse.y,v 1.66 2006/08/22 18:17:17 manubsd Exp */
-
-%{
-/*
- * Copyright (C) 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002 and 2003 WIDE Project.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/queue.h>
-#include <sys/socket.h>
-
-#include <netinet/in.h>
-#include PATH_IPSEC_H
-
-#ifdef ENABLE_HYBRID
-#include <arpa/inet.h>
-#endif
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-#include <netdb.h>
-#include <pwd.h>
-#include <grp.h>
-
-#include "var.h"
-#include "misc.h"
-#include "vmbuf.h"
-#include "plog.h"
-#include "sockmisc.h"
-#include "str2val.h"
-#include "genlist.h"
-#include "debug.h"
-
-#include "admin.h"
-#include "privsep.h"
-#include "cfparse_proto.h"
-#include "cftoken_proto.h"
-#include "algorithm.h"
-#include "localconf.h"
-#include "policy.h"
-#include "sainfo.h"
-#include "oakley.h"
-#include "pfkey.h"
-#include "remoteconf.h"
-#include "grabmyaddr.h"
-#include "isakmp_var.h"
-#include "handler.h"
-#include "isakmp.h"
-#include "nattraversal.h"
-#include "isakmp_frag.h"
-#ifdef ENABLE_HYBRID
-#include "resolv.h"
-#include "isakmp_unity.h"
-#include "isakmp_xauth.h"
-#include "isakmp_cfg.h"
-#endif
-#include "ipsec_doi.h"
-#include "strnames.h"
-#include "gcmalloc.h"
-#ifdef HAVE_GSSAPI
-#include "gssapi.h"
-#endif
-#include "vendorid.h"
-#include "rsalist.h"
-
-struct proposalspec {
-	time_t lifetime;		/* for isakmp/ipsec */
-	int lifebyte;			/* for isakmp/ipsec */
-	struct secprotospec *spspec;	/* the head is always current spec. */
-	struct proposalspec *next;	/* the tail is the most prefered. */
-	struct proposalspec *prev;
-};
-
-struct secprotospec {
-	int prop_no;
-	int trns_no;
-	int strength;		/* for isakmp/ipsec */
-	int encklen;		/* for isakmp/ipsec */
-	time_t lifetime;	/* for isakmp */
-	int lifebyte;		/* for isakmp */
-	int proto_id;		/* for ipsec (isakmp?) */
-	int ipsec_level;	/* for ipsec */
-	int encmode;		/* for ipsec */
-	int vendorid;		/* for isakmp */
-	char *gssid;
-	struct sockaddr *remote;
-	int algclass[MAXALGCLASS];
-
-	struct secprotospec *next;	/* the tail is the most prefiered. */
-	struct secprotospec *prev;
-	struct proposalspec *back;
-};
-
-static int num2dhgroup[] = {
-	0,
-	OAKLEY_ATTR_GRP_DESC_MODP768,
-	OAKLEY_ATTR_GRP_DESC_MODP1024,
-	OAKLEY_ATTR_GRP_DESC_EC2N155,
-	OAKLEY_ATTR_GRP_DESC_EC2N185,
-	OAKLEY_ATTR_GRP_DESC_MODP1536,
-	0,
-	0,
-	0,
-	0,
-	0,
-	0,
-	0,
-	0,
-	OAKLEY_ATTR_GRP_DESC_MODP2048,
-	OAKLEY_ATTR_GRP_DESC_MODP3072,
-	OAKLEY_ATTR_GRP_DESC_MODP4096,
-	OAKLEY_ATTR_GRP_DESC_MODP6144,
-	OAKLEY_ATTR_GRP_DESC_MODP8192
-};
-
-static struct remoteconf *cur_rmconf;
-static int tmpalgtype[MAXALGCLASS];
-static struct sainfo *cur_sainfo;
-static int cur_algclass;
-static int oldloglevel = LLV_BASE;
-
-static struct proposalspec *newprspec __P((void));
-static void insprspec __P((struct proposalspec *, struct proposalspec **));
-static struct secprotospec *newspspec __P((void));
-static void insspspec __P((struct secprotospec *, struct proposalspec **));
-static void adminsock_conf __P((vchar_t *, vchar_t *, vchar_t *, int));
-
-static int set_isakmp_proposal
-	__P((struct remoteconf *, struct proposalspec *));
-static void clean_tmpalgtype __P((void));
-static int expand_isakmpspec __P((int, int, int *,
-	int, int, time_t, int, int, int, char *, struct remoteconf *));
-static int listen_addr __P((struct sockaddr *addr, int udp_encap));
-
-void freeetypes (struct etypes **etypes);
-
-#if 0
-static int fix_lifebyte __P((u_long));
-#endif
-%}
-
-%union {
-	unsigned long num;
-	vchar_t *val;
-	struct remoteconf *rmconf;
-	struct sockaddr *saddr;
-	struct sainfoalg *alg;
-}
-
-	/* privsep */
-%token PRIVSEP USER GROUP CHROOT
-	/* path */
-%token PATH PATHTYPE
-	/* include */
-%token INCLUDE
-	/* self information */
-%token IDENTIFIER VENDORID
-	/* logging */
-%token LOGGING LOGLEV
-	/* padding */
-%token PADDING PAD_RANDOMIZE PAD_RANDOMIZELEN PAD_MAXLEN PAD_STRICT PAD_EXCLTAIL
-	/* listen */
-%token LISTEN X_ISAKMP X_ISAKMP_NATT X_ADMIN STRICT_ADDRESS ADMINSOCK DISABLED
-	/* ldap config */
-%token LDAPCFG LDAP_HOST LDAP_PORT LDAP_PVER LDAP_BASE LDAP_BIND_DN LDAP_BIND_PW LDAP_SUBTREE
-%token LDAP_ATTR_USER LDAP_ATTR_ADDR LDAP_ATTR_MASK LDAP_ATTR_GROUP LDAP_ATTR_MEMBER
-	/* modecfg */
-%token MODECFG CFG_NET4 CFG_MASK4 CFG_DNS4 CFG_NBNS4 CFG_DEFAULT_DOMAIN
-%token CFG_AUTH_SOURCE CFG_AUTH_GROUPS CFG_SYSTEM CFG_RADIUS CFG_PAM CFG_LDAP CFG_LOCAL CFG_NONE
-%token CFG_GROUP_SOURCE CFG_ACCOUNTING CFG_CONF_SOURCE CFG_MOTD CFG_POOL_SIZE CFG_AUTH_THROTTLE
-%token CFG_SPLIT_NETWORK CFG_SPLIT_LOCAL CFG_SPLIT_INCLUDE CFG_SPLIT_DNS
-%token CFG_PFS_GROUP CFG_SAVE_PASSWD
-
-	/* timer */
-%token RETRY RETRY_COUNTER RETRY_INTERVAL RETRY_PERSEND
-%token RETRY_PHASE1 RETRY_PHASE2 NATT_KA
-	/* algorithm */
-%token ALGORITHM_CLASS ALGORITHMTYPE STRENGTHTYPE
-	/* sainfo */
-%token SAINFO FROM
-	/* remote */
-%token REMOTE ANONYMOUS INHERIT
-%token EXCHANGE_MODE EXCHANGETYPE DOI DOITYPE SITUATION SITUATIONTYPE
-%token CERTIFICATE_TYPE CERTTYPE PEERS_CERTFILE CA_TYPE
-%token VERIFY_CERT SEND_CERT SEND_CR
-%token IDENTIFIERTYPE IDENTIFIERQUAL MY_IDENTIFIER 
-%token PEERS_IDENTIFIER VERIFY_IDENTIFIER
-%token DNSSEC CERT_X509 CERT_PLAINRSA
-%token NONCE_SIZE DH_GROUP KEEPALIVE PASSIVE INITIAL_CONTACT
-%token NAT_TRAVERSAL REMOTE_FORCE_LEVEL
-%token PROPOSAL_CHECK PROPOSAL_CHECK_LEVEL
-%token GENERATE_POLICY GENERATE_LEVEL SUPPORT_PROXY
-%token PROPOSAL
-%token EXEC_PATH EXEC_COMMAND EXEC_SUCCESS EXEC_FAILURE
-%token GSS_ID GSS_ID_ENC GSS_ID_ENCTYPE
-%token COMPLEX_BUNDLE
-%token DPD DPD_DELAY DPD_RETRY DPD_MAXFAIL
-%token PH1ID
-%token XAUTH_LOGIN WEAK_PHASE1_CHECK
-
-%token PREFIX PORT PORTANY UL_PROTO ANY IKE_FRAG ESP_FRAG MODE_CFG
-%token PFS_GROUP LIFETIME LIFETYPE_TIME LIFETYPE_BYTE STRENGTH REMOTEID
-
-%token SCRIPT PHASE1_UP PHASE1_DOWN
-
-%token NUMBER SWITCH BOOLEAN
-%token HEXSTRING QUOTEDSTRING ADDRSTRING ADDRRANGE
-%token UNITTYPE_BYTE UNITTYPE_KBYTES UNITTYPE_MBYTES UNITTYPE_TBYTES
-%token UNITTYPE_SEC UNITTYPE_MIN UNITTYPE_HOUR
-%token EOS BOC EOC COMMA
-
-%type <num> NUMBER BOOLEAN SWITCH keylength
-%type <num> PATHTYPE IDENTIFIERTYPE IDENTIFIERQUAL LOGLEV GSS_ID_ENCTYPE 
-%type <num> ALGORITHM_CLASS dh_group_num
-%type <num> ALGORITHMTYPE STRENGTHTYPE
-%type <num> PREFIX prefix PORT port ike_port
-%type <num> ul_proto UL_PROTO
-%type <num> EXCHANGETYPE DOITYPE SITUATIONTYPE
-%type <num> CERTTYPE CERT_X509 CERT_PLAINRSA PROPOSAL_CHECK_LEVEL REMOTE_FORCE_LEVEL GENERATE_LEVEL
-%type <num> unittype_time unittype_byte
-%type <val> QUOTEDSTRING HEXSTRING ADDRSTRING ADDRRANGE sainfo_id
-%type <val> identifierstring
-%type <saddr> remote_index ike_addrinfo_port
-%type <alg> algorithm
-
-%%
-
-statements
-	:	/* nothing */
-	|	statements statement
-	;
-statement
-	:	privsep_statement
-	|	path_statement
-	|	include_statement
-	|	gssenc_statement
-	|	identifier_statement
-	|	logging_statement
-	|	padding_statement
-	|	listen_statement
-	|	ldapcfg_statement
-	|	modecfg_statement
-	|	timer_statement
-	|	sainfo_statement
-	|	remote_statement
-	|	special_statement
-	;
-
-	/* privsep */
-privsep_statement
-	:	PRIVSEP BOC privsep_stmts EOC
-	;
-privsep_stmts
-	:	/* nothing */
-	|	privsep_stmts privsep_stmt
-	;
-privsep_stmt
-	:	USER QUOTEDSTRING
-		{
-			struct passwd *pw;
-
-			if ((pw = getpwnam($2->v)) == NULL) {
-				yyerror("unknown user \"%s\"", $2->v);
-				return -1;
-			}
-			lcconf->uid = pw->pw_uid;
-		} 
-		EOS
-	|	USER NUMBER { lcconf->uid = $2; } EOS
-	|	GROUP QUOTEDSTRING
-		{
-			struct group *gr;
-
-			if ((gr = getgrnam($2->v)) == NULL) {
-				yyerror("unknown group \"%s\"", $2->v);
-				return -1;
-			}
-			lcconf->gid = gr->gr_gid;
-		}
-		EOS
-	|	GROUP NUMBER { lcconf->gid = $2; } EOS
-	|	CHROOT QUOTEDSTRING { lcconf->chroot = $2->v; } EOS
-	;
-
-	/* path */
-path_statement
-	:	PATH PATHTYPE QUOTEDSTRING
-		{
-			if ($2 >= LC_PATHTYPE_MAX) {
-				yyerror("invalid path type %d", $2);
-				return -1;
-			}
-
-			/* free old pathinfo */
-			if (lcconf->pathinfo[$2])
-				racoon_free(lcconf->pathinfo[$2]);
-
-			/* set new pathinfo */
-			lcconf->pathinfo[$2] = racoon_strdup($3->v);
-			STRDUP_FATAL(lcconf->pathinfo[$2]);
-			vfree($3);
-		}
-		EOS
-	;
-
-	/* special */
-special_statement
-	:	COMPLEX_BUNDLE SWITCH { lcconf->complex_bundle = $2; } EOS
-	;
-
-	/* include */
-include_statement
-	:	INCLUDE QUOTEDSTRING EOS
-		{
-			char path[MAXPATHLEN];
-
-			getpathname(path, sizeof(path),
-				LC_PATHTYPE_INCLUDE, $2->v);
-			vfree($2);
-			if (yycf_switch_buffer(path) != 0)
-				return -1;
-		}
-	;
-
-	/* gss_id_enc */
-gssenc_statement
-	:	GSS_ID_ENC GSS_ID_ENCTYPE EOS
-		{
-			if ($2 >= LC_GSSENC_MAX) {
-				yyerror("invalid GSS ID encoding %d", $2);
-				return -1;
-			}
-			lcconf->gss_id_enc = $2;
-		}
-	;
-
-	/* self information */
-identifier_statement
-	:	IDENTIFIER identifier_stmt
-	;
-identifier_stmt
-	:	VENDORID
-		{
-			/*XXX to be deleted */
-		}
-		QUOTEDSTRING EOS
-	|	IDENTIFIERTYPE QUOTEDSTRING
-		{
-			/*XXX to be deleted */
-			$2->l--;	/* nuke '\0' */
-			lcconf->ident[$1] = $2;
-			if (lcconf->ident[$1] == NULL) {
-				yyerror("failed to set my ident: %s",
-					strerror(errno));
-				return -1;
-			}
-		}
-		EOS
-	;
-
-	/* logging */
-logging_statement
-	:	LOGGING log_level EOS
-	;
-log_level
-	:	HEXSTRING
-		{
-			/*
-			 * XXX ignore it because this specification
-			 * will be obsoleted.
-			 */
-			yywarn("see racoon.conf(5), such a log specification will be obsoleted.");
-			vfree($1);
-		}
-	|	LOGLEV
-		{
-			/*
-			 * set the loglevel to the value specified
-			 * in the configuration file plus the number
-			 * of -d options specified on the command line
-			 */
-			loglevel += $1 - oldloglevel;
-			oldloglevel = $1;
-		}
-	;
-
-	/* padding */
-padding_statement
-	:	PADDING BOC padding_stmts EOC
-	;
-padding_stmts
-	:	/* nothing */
-	|	padding_stmts padding_stmt
-	;
-padding_stmt
-	:	PAD_RANDOMIZE SWITCH { lcconf->pad_random = $2; } EOS
-	|	PAD_RANDOMIZELEN SWITCH { lcconf->pad_randomlen = $2; } EOS
-	|	PAD_MAXLEN NUMBER { lcconf->pad_maxsize = $2; } EOS
-	|	PAD_STRICT SWITCH { lcconf->pad_strict = $2; } EOS
-	|	PAD_EXCLTAIL SWITCH { lcconf->pad_excltail = $2; } EOS
-	;
-
-	/* listen */
-listen_statement
-	:	LISTEN BOC listen_stmts EOC
-	;
-listen_stmts
-	:	/* nothing */
-	|	listen_stmts listen_stmt
-	;
-listen_stmt
-	:	X_ISAKMP ike_addrinfo_port
-		{
-			listen_addr ($2, 0);
-		}
-		EOS
-	|	X_ISAKMP_NATT ike_addrinfo_port
-		{
-#ifdef ENABLE_NATT
-			listen_addr ($2, 1);
-#else
-			yyerror("NAT-T support not compiled in.");
-#endif
-		}
-		EOS
-	|	X_ADMIN
-		{
-			yyerror("admin directive is obsoleted.");
-		}
-		PORT EOS
-	|	ADMINSOCK QUOTEDSTRING QUOTEDSTRING QUOTEDSTRING NUMBER 
-		{
-#ifdef ENABLE_ADMINPORT
-			adminsock_conf($2, $3, $4, $5);
-#else
-			yywarn("admin port support not compiled in");
-#endif
-		}
-		EOS
-	|	ADMINSOCK QUOTEDSTRING
-		{
-#ifdef ENABLE_ADMINPORT
-			adminsock_conf($2, NULL, NULL, -1);
-#else
-			yywarn("admin port support not compiled in");
-#endif
-		}
-		EOS
-	|	ADMINSOCK DISABLED
-		{
-#ifdef ENABLE_ADMINPORT
-			adminsock_path = NULL;
-#else
-			yywarn("admin port support not compiled in");
-#endif
-		}
-		EOS
-	|	STRICT_ADDRESS { lcconf->strict_address = TRUE; } EOS
-	;
-ike_addrinfo_port
-	:	ADDRSTRING ike_port
-		{
-			char portbuf[10];
-
-			snprintf(portbuf, sizeof(portbuf), "%ld", $2);
-			$$ = str2saddr($1->v, portbuf);
-			vfree($1);
-			if (!$$)
-				return -1;
-		}
-	;
-ike_port
-	:	/* nothing */	{ $$ = PORT_ISAKMP; }
-	|	PORT		{ $$ = $1; }
-	;
-
-	/* ldap configuration */
-ldapcfg_statement
-	:	LDAPCFG {
-#ifndef ENABLE_HYBRID
-			yyerror("racoon not configured with --enable-hybrid");
-			return -1;
-#endif
-#ifndef HAVE_LIBLDAP
-			yyerror("racoon not configured with --with-libldap");
-			return -1;
-#endif
-		} BOC ldapcfg_stmts EOC
-	;
-ldapcfg_stmts
-	:	/* nothing */
-	|	ldapcfg_stmts ldapcfg_stmt
-	;
-ldapcfg_stmt
-	:	LDAP_PVER NUMBER
-		{
-#ifdef ENABLE_HYBRID
-#ifdef HAVE_LIBLDAP
-			if (($2<2)||($2>3))
-				yyerror("invalid ldap protocol version (2|3)");
-			xauth_ldap_config.pver = $2;
-#endif
-#endif
-		}
-		EOS
-	|	LDAP_HOST QUOTEDSTRING
-		{
-#ifdef ENABLE_HYBRID
-#ifdef HAVE_LIBLDAP
-			if (xauth_ldap_config.host != NULL)
-				vfree(xauth_ldap_config.host);
-			xauth_ldap_config.host = vdup($2);
-#endif
-#endif
-		}
-		EOS
-	|	LDAP_PORT NUMBER
-		{
-#ifdef ENABLE_HYBRID
-#ifdef HAVE_LIBLDAP
-			xauth_ldap_config.port = $2;
-#endif
-#endif
-		}
-		EOS
-	|	LDAP_BASE QUOTEDSTRING
-		{
-#ifdef ENABLE_HYBRID
-#ifdef HAVE_LIBLDAP
-			if (xauth_ldap_config.base != NULL)
-				vfree(xauth_ldap_config.base);
-			xauth_ldap_config.base = vdup($2);
-#endif
-#endif
-		}
-		EOS
-	|	LDAP_SUBTREE SWITCH
-		{
-#ifdef ENABLE_HYBRID
-#ifdef HAVE_LIBLDAP
-			xauth_ldap_config.subtree = $2;
-#endif
-#endif
-		}
-		EOS
-	|	LDAP_BIND_DN QUOTEDSTRING
-		{
-#ifdef ENABLE_HYBRID
-#ifdef HAVE_LIBLDAP
-			if (xauth_ldap_config.bind_dn != NULL)
-				vfree(xauth_ldap_config.bind_dn);
-			xauth_ldap_config.bind_dn = vdup($2);
-#endif
-#endif
-		}
-		EOS
-	|	LDAP_BIND_PW QUOTEDSTRING
-		{
-#ifdef ENABLE_HYBRID
-#ifdef HAVE_LIBLDAP
-			if (xauth_ldap_config.bind_pw != NULL)
-				vfree(xauth_ldap_config.bind_pw);
-			xauth_ldap_config.bind_pw = vdup($2);
-#endif
-#endif
-		}
-		EOS
-	|	LDAP_ATTR_USER QUOTEDSTRING
-		{
-#ifdef ENABLE_HYBRID
-#ifdef HAVE_LIBLDAP
-			if (xauth_ldap_config.attr_user != NULL)
-				vfree(xauth_ldap_config.attr_user);
-			xauth_ldap_config.attr_user = vdup($2);
-#endif
-#endif
-		}
-		EOS
-	|	LDAP_ATTR_ADDR QUOTEDSTRING
-		{
-#ifdef ENABLE_HYBRID
-#ifdef HAVE_LIBLDAP
-			if (xauth_ldap_config.attr_addr != NULL)
-				vfree(xauth_ldap_config.attr_addr);
-			xauth_ldap_config.attr_addr = vdup($2);
-#endif
-#endif
-		}
-		EOS
-	|	LDAP_ATTR_MASK QUOTEDSTRING
-		{
-#ifdef ENABLE_HYBRID
-#ifdef HAVE_LIBLDAP
-			if (xauth_ldap_config.attr_mask != NULL)
-				vfree(xauth_ldap_config.attr_mask);
-			xauth_ldap_config.attr_mask = vdup($2);
-#endif
-#endif
-		}
-		EOS
-	|	LDAP_ATTR_GROUP QUOTEDSTRING
-		{
-#ifdef ENABLE_HYBRID
-#ifdef HAVE_LIBLDAP
-			if (xauth_ldap_config.attr_group != NULL)
-				vfree(xauth_ldap_config.attr_group);
-			xauth_ldap_config.attr_group = vdup($2);
-#endif
-#endif
-		}
-		EOS
-	|	LDAP_ATTR_MEMBER QUOTEDSTRING
-		{
-#ifdef ENABLE_HYBRID
-#ifdef HAVE_LIBLDAP
-			if (xauth_ldap_config.attr_member != NULL)
-				vfree(xauth_ldap_config.attr_member);
-			xauth_ldap_config.attr_member = vdup($2);
-#endif
-#endif
-		}
-		EOS
-	;
-
-	/* modecfg */
-modecfg_statement
-	:	MODECFG BOC modecfg_stmts EOC
-	;
-modecfg_stmts
-	:	/* nothing */
-	|	modecfg_stmts modecfg_stmt
-	;
-modecfg_stmt
-	:	CFG_NET4 ADDRSTRING
-		{
-#ifdef ENABLE_HYBRID
-			if (inet_pton(AF_INET, $2->v,
-			     &isakmp_cfg_config.network4) != 1)
-				yyerror("bad IPv4 network address.");
-#else
-			yyerror("racoon not configured with --enable-hybrid");
-#endif
-		}
-		EOS
-	|	CFG_MASK4 ADDRSTRING
-		{
-#ifdef ENABLE_HYBRID
-			if (inet_pton(AF_INET, $2->v,
-			    &isakmp_cfg_config.netmask4) != 1)
-				yyerror("bad IPv4 netmask address.");
-#else
-			yyerror("racoon not configured with --enable-hybrid");
-#endif
-		}
-		EOS
-	|	CFG_DNS4 addrdnslist
-		EOS
-	|	CFG_NBNS4 addrwinslist
-		EOS
-	|	CFG_SPLIT_NETWORK CFG_SPLIT_LOCAL splitnetlist
-		{
-#ifdef ENABLE_HYBRID
-			isakmp_cfg_config.splitnet_type = UNITY_LOCAL_LAN;
-#else
-			yyerror("racoon not configured with --enable-hybrid");
-#endif
-		}
-		EOS
-	|	CFG_SPLIT_NETWORK CFG_SPLIT_INCLUDE splitnetlist
-		{
-#ifdef ENABLE_HYBRID
-			isakmp_cfg_config.splitnet_type = UNITY_SPLIT_INCLUDE;
-#else
-			yyerror("racoon not configured with --enable-hybrid");
-#endif
-		}
-		EOS
-	|	CFG_SPLIT_DNS splitdnslist
-		{
-#ifndef ENABLE_HYBRID
-			yyerror("racoon not configured with --enable-hybrid");
-#endif
-		}
-		EOS
-	|	CFG_DEFAULT_DOMAIN QUOTEDSTRING
-		{
-#ifdef ENABLE_HYBRID
-			strncpy(&isakmp_cfg_config.default_domain[0], 
-			    $2->v, MAXPATHLEN);
-			isakmp_cfg_config.default_domain[MAXPATHLEN] = '\0';
-			vfree($2);
-#else
-			yyerror("racoon not configured with --enable-hybrid");
-#endif
-		}
-		EOS
-	|	CFG_AUTH_SOURCE CFG_SYSTEM
-		{
-#ifdef ENABLE_HYBRID
-			isakmp_cfg_config.authsource = ISAKMP_CFG_AUTH_SYSTEM;
-#else
-			yyerror("racoon not configured with --enable-hybrid");
-#endif
-		}
-		EOS
-	|	CFG_AUTH_SOURCE CFG_RADIUS
-		{
-#ifdef ENABLE_HYBRID
-#ifdef HAVE_LIBRADIUS
-			isakmp_cfg_config.authsource = ISAKMP_CFG_AUTH_RADIUS;
-#else /* HAVE_LIBRADIUS */
-			yyerror("racoon not configured with --with-libradius");
-#endif /* HAVE_LIBRADIUS */
-#else /* ENABLE_HYBRID */
-			yyerror("racoon not configured with --enable-hybrid");
-#endif /* ENABLE_HYBRID */
-		}
-		EOS
-	|	CFG_AUTH_SOURCE CFG_PAM
-		{
-#ifdef ENABLE_HYBRID
-#ifdef HAVE_LIBPAM
-			isakmp_cfg_config.authsource = ISAKMP_CFG_AUTH_PAM;
-#else /* HAVE_LIBPAM */
-			yyerror("racoon not configured with --with-libpam");
-#endif /* HAVE_LIBPAM */
-#else /* ENABLE_HYBRID */
-			yyerror("racoon not configured with --enable-hybrid");
-#endif /* ENABLE_HYBRID */
-		}
-		EOS
-	|	CFG_AUTH_SOURCE CFG_LDAP
-		{
-#ifdef ENABLE_HYBRID
-#ifdef HAVE_LIBLDAP
-			isakmp_cfg_config.authsource = ISAKMP_CFG_AUTH_LDAP;
-#else /* HAVE_LIBLDAP */
-			yyerror("racoon not configured with --with-libldap");
-#endif /* HAVE_LIBLDAP */
-#else /* ENABLE_HYBRID */
-			yyerror("racoon not configured with --enable-hybrid");
-#endif /* ENABLE_HYBRID */
-		}
-		EOS
-	|	CFG_AUTH_GROUPS authgrouplist
-		{
-#ifndef ENABLE_HYBRID
-			yyerror("racoon not configured with --enable-hybrid");
-#endif
-		}
-		EOS
-	|	CFG_GROUP_SOURCE CFG_SYSTEM
-		{
-#ifdef ENABLE_HYBRID
-			isakmp_cfg_config.groupsource = ISAKMP_CFG_GROUP_SYSTEM;
-#else
-			yyerror("racoon not configured with --enable-hybrid");
-#endif
-		}
-		EOS
-	|	CFG_GROUP_SOURCE CFG_LDAP
-		{
-#ifdef ENABLE_HYBRID
-#ifdef HAVE_LIBLDAP
-			isakmp_cfg_config.groupsource = ISAKMP_CFG_GROUP_LDAP;
-#else /* HAVE_LIBLDAP */
-			yyerror("racoon not configured with --with-libldap");
-#endif /* HAVE_LIBLDAP */
-#else /* ENABLE_HYBRID */
-			yyerror("racoon not configured with --enable-hybrid");
-#endif /* ENABLE_HYBRID */
-		}
-		EOS
-	|	CFG_ACCOUNTING CFG_NONE
-		{
-#ifdef ENABLE_HYBRID
-			isakmp_cfg_config.accounting = ISAKMP_CFG_ACCT_NONE;
-#else
-			yyerror("racoon not configured with --enable-hybrid");
-#endif
-		}
-		EOS
-	|	CFG_ACCOUNTING CFG_SYSTEM
-		{
-#ifdef ENABLE_HYBRID
-			isakmp_cfg_config.accounting = ISAKMP_CFG_ACCT_SYSTEM;
-#else
-			yyerror("racoon not configured with --enable-hybrid");
-#endif
-		}
-		EOS
-	|	CFG_ACCOUNTING CFG_RADIUS
-		{
-#ifdef ENABLE_HYBRID
-#ifdef HAVE_LIBRADIUS
-			isakmp_cfg_config.accounting = ISAKMP_CFG_ACCT_RADIUS;
-#else /* HAVE_LIBRADIUS */
-			yyerror("racoon not configured with --with-libradius");
-#endif /* HAVE_LIBRADIUS */
-#else /* ENABLE_HYBRID */
-			yyerror("racoon not configured with --enable-hybrid");
-#endif /* ENABLE_HYBRID */
-		}
-		EOS
-	|	CFG_ACCOUNTING CFG_PAM
-		{
-#ifdef ENABLE_HYBRID
-#ifdef HAVE_LIBPAM
-			isakmp_cfg_config.accounting = ISAKMP_CFG_ACCT_PAM;
-#else /* HAVE_LIBPAM */
-			yyerror("racoon not configured with --with-libpam");
-#endif /* HAVE_LIBPAM */
-#else /* ENABLE_HYBRID */
-			yyerror("racoon not configured with --enable-hybrid");
-#endif /* ENABLE_HYBRID */
-		}
-		EOS
-	|	CFG_POOL_SIZE NUMBER
-		{
-#ifdef ENABLE_HYBRID
-			if (isakmp_cfg_resize_pool($2) != 0)
-				yyerror("cannot allocate memory for pool");
-#else /* ENABLE_HYBRID */
-			yyerror("racoon not configured with --enable-hybrid");
-#endif /* ENABLE_HYBRID */
-		}
-		EOS
-	|	CFG_PFS_GROUP NUMBER
-		{
-#ifdef ENABLE_HYBRID
-			isakmp_cfg_config.pfs_group = $2;
-#else /* ENABLE_HYBRID */
-			yyerror("racoon not configured with --enable-hybrid");
-#endif /* ENABLE_HYBRID */
-		}
-		EOS
-	|	CFG_SAVE_PASSWD SWITCH
-		{
-#ifdef ENABLE_HYBRID
-			isakmp_cfg_config.save_passwd = $2;
-#else /* ENABLE_HYBRID */
-			yyerror("racoon not configured with --enable-hybrid");
-#endif /* ENABLE_HYBRID */
-		}
-		EOS
-	|	CFG_AUTH_THROTTLE NUMBER
-		{
-#ifdef ENABLE_HYBRID
-			isakmp_cfg_config.auth_throttle = $2;
-#else /* ENABLE_HYBRID */
-			yyerror("racoon not configured with --enable-hybrid");
-#endif /* ENABLE_HYBRID */
-		}
-		EOS
-	|	CFG_CONF_SOURCE CFG_LOCAL
-		{
-#ifdef ENABLE_HYBRID
-			isakmp_cfg_config.confsource = ISAKMP_CFG_CONF_LOCAL;
-#else /* ENABLE_HYBRID */
-			yyerror("racoon not configured with --enable-hybrid");
-#endif /* ENABLE_HYBRID */
-		}
-		EOS
-	|	CFG_CONF_SOURCE CFG_RADIUS
-		{
-#ifdef ENABLE_HYBRID
-#ifdef HAVE_LIBRADIUS
-			isakmp_cfg_config.confsource = ISAKMP_CFG_CONF_RADIUS;
-#else /* HAVE_LIBRADIUS */
-			yyerror("racoon not configured with --with-libradius");
-#endif /* HAVE_LIBRADIUS */
-#else /* ENABLE_HYBRID */
-			yyerror("racoon not configured with --enable-hybrid");
-#endif /* ENABLE_HYBRID */
-		}
-		EOS
-	|	CFG_CONF_SOURCE CFG_LDAP
-		{
-#ifdef ENABLE_HYBRID
-#ifdef HAVE_LIBLDAP
-			isakmp_cfg_config.confsource = ISAKMP_CFG_CONF_LDAP;
-#else /* HAVE_LIBLDAP */
-			yyerror("racoon not configured with --with-libldap");
-#endif /* HAVE_LIBLDAP */
-#else /* ENABLE_HYBRID */
-			yyerror("racoon not configured with --enable-hybrid");
-#endif /* ENABLE_HYBRID */
-		}
-		EOS
-	|	CFG_MOTD QUOTEDSTRING
-		{
-#ifdef ENABLE_HYBRID
-			strncpy(&isakmp_cfg_config.motd[0], $2->v, MAXPATHLEN);
-			isakmp_cfg_config.motd[MAXPATHLEN] = '\0';
-			vfree($2);
-#else
-			yyerror("racoon not configured with --enable-hybrid");
-#endif
-		}
-		EOS
-	;
-
-addrdnslist
-	:	addrdns
-	|	addrdns COMMA addrdnslist
-	;
-addrdns
-	:	ADDRSTRING
-		{
-#ifdef ENABLE_HYBRID
-			struct isakmp_cfg_config *icc = &isakmp_cfg_config;
-
-			if (icc->dns4_index > MAXNS)
-				yyerror("No more than %d DNS", MAXNS);
-			if (inet_pton(AF_INET, $1->v,
-			    &icc->dns4[icc->dns4_index++]) != 1)
-				yyerror("bad IPv4 DNS address.");
-#else
-			yyerror("racoon not configured with --enable-hybrid");
-#endif
-		}
-	;
-
-addrwinslist
-	:	addrwins
-	|	addrwins COMMA addrwinslist
-	;
-addrwins
-	:	ADDRSTRING
-		{
-#ifdef ENABLE_HYBRID
-			struct isakmp_cfg_config *icc = &isakmp_cfg_config;
-
-			if (icc->nbns4_index > MAXWINS)
-				yyerror("No more than %d WINS", MAXWINS);
-			if (inet_pton(AF_INET, $1->v,
-			    &icc->nbns4[icc->nbns4_index++]) != 1)
-				yyerror("bad IPv4 WINS address.");
-#else
-			yyerror("racoon not configured with --enable-hybrid");
-#endif
-		}
-	;
-
-splitnetlist
-	:	splitnet
-	|	splitnetlist COMMA splitnet
-	;
-splitnet
-	:	ADDRSTRING PREFIX
-		{
-#ifdef ENABLE_HYBRID
-			struct isakmp_cfg_config *icc = &isakmp_cfg_config;
-			struct unity_network network;
-			memset(&network,0,sizeof(network));
-
-			if (inet_pton(AF_INET, $1->v, &network.addr4) != 1)
-				yyerror("bad IPv4 SPLIT address.");
-
-			/* Turn $2 (the prefix) into a subnet mask */
-			network.mask4.s_addr = ($2) ? htonl(~((1 << (32 - $2)) - 1)) : 0;
-
-			/* add the network to our list */ 
-			if (splitnet_list_add(&icc->splitnet_list, &network,&icc->splitnet_count))
-				yyerror("Unable to allocate split network");
-#else
-			yyerror("racoon not configured with --enable-hybrid");
-#endif
-		}
-	;
-
-authgrouplist
-	:	authgroup
-	|	authgroup COMMA authgrouplist
-	;
-authgroup
-	:	QUOTEDSTRING
-		{
-#ifdef ENABLE_HYBRID
-			char * groupname = NULL;
-			char ** grouplist = NULL;
-			struct isakmp_cfg_config *icc = &isakmp_cfg_config;
-
-			grouplist = racoon_realloc(icc->grouplist,
-					sizeof(char**)*(icc->groupcount+1));
-			if (grouplist == NULL)
-				yyerror("unable to allocate auth group list");
-
-			groupname = racoon_malloc($1->l+1);
-			if (groupname == NULL)
-				yyerror("unable to allocate auth group name");
-
-			memcpy(groupname,$1->v,$1->l);
-			groupname[$1->l]=0;
-			grouplist[icc->groupcount]=groupname;
-			icc->grouplist = grouplist;
-			icc->groupcount++;
-
-			vfree($1);
-#else
-			yyerror("racoon not configured with --enable-hybrid");
-#endif
-		}
-	;
-
-splitdnslist
-	:	splitdns
-	|	splitdns COMMA splitdnslist
-	;
-splitdns
-	:	QUOTEDSTRING
-		{
-#ifdef ENABLE_HYBRID
-			struct isakmp_cfg_config *icc = &isakmp_cfg_config;
-
-			if (!icc->splitdns_len)
-			{
-				icc->splitdns_list = racoon_malloc($1->l);
-				if(icc->splitdns_list == NULL)
-					yyerror("error allocating splitdns list buffer");
-				memcpy(icc->splitdns_list,$1->v,$1->l);
-				icc->splitdns_len = $1->l;
-			}
-			else
-			{
-				int len = icc->splitdns_len + $1->l + 1;
-				icc->splitdns_list = racoon_realloc(icc->splitdns_list,len);
-				if(icc->splitdns_list == NULL)
-					yyerror("error allocating splitdns list buffer");
-				icc->splitdns_list[icc->splitdns_len] = ',';
-				memcpy(icc->splitdns_list + icc->splitdns_len + 1, $1->v, $1->l);
-				icc->splitdns_len = len;
-			}
-			vfree($1);
-#else
-			yyerror("racoon not configured with --enable-hybrid");
-#endif
-		}
-	;
-
-
-	/* timer */
-timer_statement
-	:	RETRY BOC timer_stmts EOC
-	;
-timer_stmts
-	:	/* nothing */
-	|	timer_stmts timer_stmt
-	;
-timer_stmt
-	:	RETRY_COUNTER NUMBER
-		{
-			lcconf->retry_counter = $2;
-		}
-		EOS
-	|	RETRY_INTERVAL NUMBER unittype_time
-		{
-			lcconf->retry_interval = $2 * $3;
-		}
-		EOS
-	|	RETRY_PERSEND NUMBER
-		{
-			lcconf->count_persend = $2;
-		}
-		EOS
-	|	RETRY_PHASE1 NUMBER unittype_time
-		{
-			lcconf->retry_checkph1 = $2 * $3;
-		}
-		EOS
-	|	RETRY_PHASE2 NUMBER unittype_time
-		{
-			lcconf->wait_ph2complete = $2 * $3;
-		}
-		EOS
-	|	NATT_KA NUMBER unittype_time
-		{
-#ifdef ENABLE_NATT
-        		if (libipsec_opt & LIBIPSEC_OPT_NATT)
-				lcconf->natt_ka_interval = $2 * $3;
-			else
-                		yyerror("libipsec lacks NAT-T support");
-#else
-			yyerror("NAT-T support not compiled in.");
-#endif
-		}
-		EOS
-	;
-
-	/* sainfo */
-sainfo_statement
-	:	SAINFO
-		{
-			cur_sainfo = newsainfo();
-			if (cur_sainfo == NULL) {
-				yyerror("failed to allocate sainfo");
-				return -1;
-			}
-		}
-		sainfo_name sainfo_param BOC sainfo_specs
-		{
-			struct sainfo *check;
-
-			/* default */
-			if (cur_sainfo->algs[algclass_ipsec_enc] == 0) {
-				yyerror("no encryption algorithm at %s",
-					sainfo2str(cur_sainfo));
-				return -1;
-			}
-			if (cur_sainfo->algs[algclass_ipsec_auth] == 0) {
-				yyerror("no authentication algorithm at %s",
-					sainfo2str(cur_sainfo));
-				return -1;
-			}
-			if (cur_sainfo->algs[algclass_ipsec_comp] == 0) {
-				yyerror("no compression algorithm at %s",
-					sainfo2str(cur_sainfo));
-				return -1;
-			}
-
-			/* duplicate check */
-			check = getsainfo(cur_sainfo->idsrc,
-					  cur_sainfo->iddst,
-					  cur_sainfo->id_i,
-					  cur_sainfo->remoteid);
-			if (check && (!check->idsrc && !cur_sainfo->idsrc)) {
-				yyerror("duplicated sainfo: %s",
-					sainfo2str(cur_sainfo));
-				return -1;
-			}
-			inssainfo(cur_sainfo);
-		}
-		EOC
-	;
-sainfo_name
-	:	ANONYMOUS
-		{
-			cur_sainfo->idsrc = NULL;
-			cur_sainfo->iddst = NULL;
-		}
-	|	ANONYMOUS sainfo_id
-		{
-			cur_sainfo->idsrc = NULL;
-			cur_sainfo->iddst = $2;
-		}
-	|	sainfo_id ANONYMOUS
-		{
-			cur_sainfo->idsrc = $1;
-			cur_sainfo->iddst = NULL;
-		}
-	|	sainfo_id sainfo_id
-		{
-			cur_sainfo->idsrc = $1;
-			cur_sainfo->iddst = $2;
-		}
-	;
-sainfo_id
-	:	IDENTIFIERTYPE ADDRSTRING prefix port ul_proto
-		{
-			char portbuf[10];
-			struct sockaddr *saddr;
-
-			if (($5 == IPPROTO_ICMP || $5 == IPPROTO_ICMPV6)
-			 && ($4 != IPSEC_PORT_ANY || $4 != IPSEC_PORT_ANY)) {
-				yyerror("port number must be \"any\".");
-				return -1;
-			}
-
-			snprintf(portbuf, sizeof(portbuf), "%lu", $4);
-			saddr = str2saddr($2->v, portbuf);
-			vfree($2);
-			if (saddr == NULL)
-				return -1;
-
-			switch (saddr->sa_family) {
-			case AF_INET:
-				if ($5 == IPPROTO_ICMPV6) {
-					yyerror("upper layer protocol mismatched.\n");
-					racoon_free(saddr);
-					return -1;
-				}
-				$$ = ipsecdoi_sockaddr2id(saddr,
-										  $3 == ~0 ? (sizeof(struct in_addr) << 3): $3,
-										  $5);
-				break;
-#ifdef INET6
-			case AF_INET6:
-				if ($5 == IPPROTO_ICMP) {
-					yyerror("upper layer protocol mismatched.\n");
-					racoon_free(saddr);
-					return -1;
-				}
-				$$ = ipsecdoi_sockaddr2id(saddr, 
-										  $3 == ~0 ? (sizeof(struct in6_addr) << 3): $3,
-										  $5);
-				break;
-#endif
-			default:
-				yyerror("invalid family: %d", saddr->sa_family);
-				$$ = NULL;
-				break;
-			}
-			racoon_free(saddr);
-			if ($$ == NULL)
-				return -1;
-		}
-	|	IDENTIFIERTYPE ADDRSTRING ADDRRANGE prefix port ul_proto
-		{
-			char portbuf[10];
-			struct sockaddr *laddr = NULL, *haddr = NULL;
-			char *cur = NULL;
-
-			if (($6 == IPPROTO_ICMP || $6 == IPPROTO_ICMPV6)
-			 && ($5 != IPSEC_PORT_ANY || $5 != IPSEC_PORT_ANY)) {
-				yyerror("port number must be \"any\".");
-				return -1;
-			}
-
-			snprintf(portbuf, sizeof(portbuf), "%lu", $5);
-			
-			laddr = str2saddr($2->v, portbuf);
-			if (laddr == NULL) {
-			    return -1;
-			}
-			vfree($2);
-			haddr = str2saddr($3->v, portbuf);
-			if (haddr == NULL) {
-			    racoon_free(laddr);
-			    return -1;
-			}
-			vfree($3);
-
-			switch (laddr->sa_family) {
-			case AF_INET:
-				if ($6 == IPPROTO_ICMPV6) {
-				    yyerror("upper layer protocol mismatched.\n");
-				    if (laddr)
-					racoon_free(laddr);
-				    if (haddr)
-					racoon_free(haddr);
-				    return -1;
-				}
-                                $$ = ipsecdoi_sockrange2id(laddr, haddr, 
-							   $6);
-				break;
-#ifdef INET6
-			case AF_INET6:
-				if ($6 == IPPROTO_ICMP) {
-					yyerror("upper layer protocol mismatched.\n");
-					if (laddr)
-					    racoon_free(laddr);
-					if (haddr)
-					    racoon_free(haddr);
-					return -1;
-				}
-				$$ = ipsecdoi_sockrange2id(laddr, haddr, 
-							       $6);
-				break;
-#endif
-			default:
-				yyerror("invalid family: %d", laddr->sa_family);
-				$$ = NULL;
-				break;
-			}
-			if (laddr)
-			    racoon_free(laddr);
-			if (haddr)
-			    racoon_free(haddr);
-			if ($$ == NULL)
-				return -1;
-		}
-	|	IDENTIFIERTYPE QUOTEDSTRING
-		{
-			struct ipsecdoi_id_b *id_b;
-
-			if ($1 == IDTYPE_ASN1DN) {
-				yyerror("id type forbidden: %d", $1);
-				$$ = NULL;
-				return -1;
-			}
-
-			$2->l--;
-
-			$$ = vmalloc(sizeof(*id_b) + $2->l);
-			if ($$ == NULL) {
-				yyerror("failed to allocate identifier");
-				return -1;
-			}
-
-			id_b = (struct ipsecdoi_id_b *)$$->v;
-			id_b->type = idtype2doi($1);
-
-			id_b->proto_id = 0;
-			id_b->port = 0;
-
-			memcpy($$->v + sizeof(*id_b), $2->v, $2->l);
-		}
-	;
-sainfo_param
-	:	/* nothing */
-		{
-			cur_sainfo->id_i = NULL;
-		}
-	|	FROM IDENTIFIERTYPE identifierstring
-		{
-			struct ipsecdoi_id_b *id_b;
-			vchar_t *idv;
-
-			if (set_identifier(&idv, $2, $3) != 0) {
-				yyerror("failed to set identifer.\n");
-				return -1;
-			}
-			cur_sainfo->id_i = vmalloc(sizeof(*id_b) + idv->l);
-			if (cur_sainfo->id_i == NULL) {
-				yyerror("failed to allocate identifier");
-				return -1;
-			}
-
-			id_b = (struct ipsecdoi_id_b *)cur_sainfo->id_i->v;
-			id_b->type = idtype2doi($2);
-
-			id_b->proto_id = 0;
-			id_b->port = 0;
-
-			memcpy(cur_sainfo->id_i->v + sizeof(*id_b),
-			       idv->v, idv->l);
-			vfree(idv);
-		}
-	|	GROUP QUOTEDSTRING
-		{
-#ifdef ENABLE_HYBRID
-			if ((cur_sainfo->group = vdup($2)) == NULL) {
-				yyerror("failed to set sainfo xauth group.\n");
-				return -1;
-			}
-#else
-			yyerror("racoon not configured with --enable-hybrid");
-			return -1;
-#endif
- 		}
-	;
-sainfo_specs
-	:	/* nothing */
-	|	sainfo_specs sainfo_spec
-	;
-sainfo_spec
-	:	PFS_GROUP dh_group_num
-		{
-			cur_sainfo->pfs_group = $2;
-		}
-		EOS
-	|	REMOTEID NUMBER
-		{
-			cur_sainfo->remoteid = $2;
-		}
-		EOS
-	|	LIFETIME LIFETYPE_TIME NUMBER unittype_time
-		{
-			cur_sainfo->lifetime = $3 * $4;
-		}
-		EOS
-	|	LIFETIME LIFETYPE_BYTE NUMBER unittype_byte
-		{
-#if 1
-			yyerror("byte lifetime support is deprecated");
-			return -1;
-#else
-			cur_sainfo->lifebyte = fix_lifebyte($3 * $4);
-			if (cur_sainfo->lifebyte == 0)
-				return -1;
-#endif
-		}
-		EOS
-	|	ALGORITHM_CLASS {
-			cur_algclass = $1;
-		}
-		algorithms EOS
-	|	IDENTIFIER IDENTIFIERTYPE
-		{
-			yyerror("it's deprecated to specify a identifier in phase 2");
-		}
-		EOS
-	|	MY_IDENTIFIER IDENTIFIERTYPE QUOTEDSTRING
-		{
-			yyerror("it's deprecated to specify a identifier in phase 2");
-		}
-		EOS
-	;
-
-algorithms
-	:	algorithm
-		{
-			inssainfoalg(&cur_sainfo->algs[cur_algclass], $1);
-		}
-	|	algorithm
-		{
-			inssainfoalg(&cur_sainfo->algs[cur_algclass], $1);
-		}
-		COMMA algorithms
-	;
-algorithm
-	:	ALGORITHMTYPE keylength
-		{
-			int defklen;
-
-			$$ = newsainfoalg();
-			if ($$ == NULL) {
-				yyerror("failed to get algorithm allocation");
-				return -1;
-			}
-
-			$$->alg = algtype2doi(cur_algclass, $1);
-			if ($$->alg == -1) {
-				yyerror("algorithm mismatched");
-				racoon_free($$);
-				$$ = NULL;
-				return -1;
-			}
-
-			defklen = default_keylen(cur_algclass, $1);
-			if (defklen == 0) {
-				if ($2) {
-					yyerror("keylen not allowed");
-					racoon_free($$);
-					$$ = NULL;
-					return -1;
-				}
-			} else {
-				if ($2 && check_keylen(cur_algclass, $1, $2) < 0) {
-					yyerror("invalid keylen %d", $2);
-					racoon_free($$);
-					$$ = NULL;
-					return -1;
-				}
-			}
-
-			if ($2)
-				$$->encklen = $2;
-			else
-				$$->encklen = defklen;
-
-			/* check if it's supported algorithm by kernel */
-			if (!(cur_algclass == algclass_ipsec_auth && $1 == algtype_non_auth)
-			 && pk_checkalg(cur_algclass, $1, $$->encklen)) {
-				int a = algclass2doi(cur_algclass);
-				int b = algtype2doi(cur_algclass, $1);
-				if (a == IPSECDOI_ATTR_AUTH)
-					a = IPSECDOI_PROTO_IPSEC_AH;
-				yyerror("algorithm %s not supported by the kernel (missing module?)",
-					s_ipsecdoi_trns(a, b));
-				racoon_free($$);
-				$$ = NULL;
-				return -1;
-			}
-		}
-	;
-prefix
-	:	/* nothing */ { $$ = ~0; }
-	|	PREFIX { $$ = $1; }
-	;
-port
-	:	/* nothing */ { $$ = IPSEC_PORT_ANY; }
-	|	PORT { $$ = $1; }
-	|	PORTANY { $$ = IPSEC_PORT_ANY; }
-	;
-ul_proto
-	:	NUMBER { $$ = $1; }
-	|	UL_PROTO { $$ = $1; }
-	|	ANY { $$ = IPSEC_ULPROTO_ANY; }
-	;
-keylength
-	:	/* nothing */ { $$ = 0; }
-	|	NUMBER { $$ = $1; }
-	;
-
-	/* remote */
-remote_statement
-	:	REMOTE remote_index INHERIT remote_index
-		{
-			struct remoteconf *new;
-			struct proposalspec *prspec;
-
-			new = copyrmconf($4);
-			if (new == NULL) {
-				yyerror("failed to get remoteconf for %s.", saddr2str ($4));
-				return -1;
-			}
-
-			new->remote = $2;
-			new->inherited_from = getrmconf_strict($4, 1);
-			new->proposal = NULL;
-			new->prhead = NULL;
-			cur_rmconf = new;
-
-			prspec = newprspec();
-			if (prspec == NULL || !cur_rmconf->inherited_from 
-				|| !cur_rmconf->inherited_from->proposal)
-				return -1;
-			prspec->lifetime = cur_rmconf->inherited_from->proposal->lifetime;
-			prspec->lifebyte = cur_rmconf->inherited_from->proposal->lifebyte;
-			insprspec(prspec, &cur_rmconf->prhead);
-		}
-		remote_specs_block
-	|	REMOTE remote_index
-		{
-			struct remoteconf *new;
-			struct proposalspec *prspec;
-
-			new = newrmconf();
-			if (new == NULL) {
-				yyerror("failed to get new remoteconf.");
-				return -1;
-			}
-
-			new->remote = $2;
-			cur_rmconf = new;
-
-			prspec = newprspec();
-			if (prspec == NULL)
-				return -1;
-			prspec->lifetime = oakley_get_defaultlifetime();
-			insprspec(prspec, &cur_rmconf->prhead);
-		}
-		remote_specs_block
-	;
-
-remote_specs_block
-	:	BOC remote_specs EOC
-		{
-			/* check a exchange mode */
-			if (cur_rmconf->etypes == NULL) {
-				yyerror("no exchange mode specified.\n");
-				return -1;
-			}
-
-			if (cur_rmconf->idvtype == IDTYPE_UNDEFINED)
-				cur_rmconf->idvtype = IDTYPE_ADDRESS;
-
-
-			if (cur_rmconf->idvtype == IDTYPE_ASN1DN) {
-				if (cur_rmconf->mycertfile) {
-					if (cur_rmconf->idv)
-						yywarn("Both CERT and ASN1 ID "
-						       "are set. Hope this is OK.\n");
-					/* TODO: Preparse the DN here */
-				} else if (cur_rmconf->idv) {
-					/* OK, using asn1dn without X.509. */
-				} else {
-					yyerror("ASN1 ID not specified "
-						"and no CERT defined!\n");
-					return -1;
-				}
-			}
-			
-			if (cur_rmconf->prhead->spspec == NULL
-				&& cur_rmconf->inherited_from
-				&& cur_rmconf->inherited_from->prhead) {
-				cur_rmconf->prhead->spspec = cur_rmconf->inherited_from->prhead->spspec;
-			}
-			if (set_isakmp_proposal(cur_rmconf, cur_rmconf->prhead) != 0)
-				return -1;
-
-			/* DH group settting if aggressive mode is there. */
-			if (check_etypeok(cur_rmconf, ISAKMP_ETYPE_AGG) != NULL) {
-				struct isakmpsa *p;
-				int b = 0;
-
-				/* DH group */
-				for (p = cur_rmconf->proposal; p; p = p->next) {
-					if (b == 0 || (b && b == p->dh_group)) {
-						b = p->dh_group;
-						continue;
-					}
-					yyerror("DH group must be equal "
-						"in all proposals "
-						"when aggressive mode is "
-						"used.\n");
-					return -1;
-				}
-				cur_rmconf->dh_group = b;
-
-				if (cur_rmconf->dh_group == 0) {
-					yyerror("DH group must be set in the proposal.\n");
-					return -1;
-				}
-
-				/* DH group settting if PFS is required. */
-				if (oakley_setdhgroup(cur_rmconf->dh_group,
-						&cur_rmconf->dhgrp) < 0) {
-					yyerror("failed to set DH value.\n");
-					return -1;
-				}
-			}
-
-			insrmconf(cur_rmconf);
-		}
-	;
-remote_index
-	:	ANONYMOUS ike_port
-		{
-			$$ = newsaddr(sizeof(struct sockaddr));
-			$$->sa_family = AF_UNSPEC;
-			((struct sockaddr_in *)$$)->sin_port = htons($2);
-		}
-	|	ike_addrinfo_port
-		{
-			$$ = $1;
-			if ($$ == NULL) {
-				yyerror("failed to allocate sockaddr");
-				return -1;
-			}
-		}
-	;
-remote_specs
-	:	/* nothing */
-	|	remote_specs remote_spec
-	;
-remote_spec
-	:	EXCHANGE_MODE
-		{
-			cur_rmconf->etypes = NULL;
-		}
-		exchange_types EOS
-	|	DOI DOITYPE { cur_rmconf->doitype = $2; } EOS
-	|	SITUATION SITUATIONTYPE { cur_rmconf->sittype = $2; } EOS
-	|	CERTIFICATE_TYPE cert_spec
-	|	PEERS_CERTFILE QUOTEDSTRING
-		{
-			yywarn("This directive without certtype will be removed!\n");
-			yywarn("Please use 'peers_certfile x509 \"%s\";' instead\n", $2->v);
-			cur_rmconf->getcert_method = ISAKMP_GETCERT_LOCALFILE;
-
-			if (cur_rmconf->peerscertfile != NULL)
-				racoon_free(cur_rmconf->peerscertfile);
-			cur_rmconf->peerscertfile = racoon_strdup($2->v);
-			STRDUP_FATAL(cur_rmconf->peerscertfile);
-			vfree($2);
-		}
-		EOS
-	|	CA_TYPE CERT_X509 QUOTEDSTRING
-		{
-			cur_rmconf->cacerttype = $2;
-			cur_rmconf->getcacert_method = ISAKMP_GETCERT_LOCALFILE;
-			if (cur_rmconf->cacertfile != NULL)
-				racoon_free(cur_rmconf->cacertfile);
-			cur_rmconf->cacertfile = racoon_strdup($3->v);
-			STRDUP_FATAL(cur_rmconf->cacertfile);
-			vfree($3);
-		}
-		EOS
-	|	PEERS_CERTFILE CERT_X509 QUOTEDSTRING
-		{
-			cur_rmconf->getcert_method = ISAKMP_GETCERT_LOCALFILE;
-			if (cur_rmconf->peerscertfile != NULL)
-				racoon_free(cur_rmconf->peerscertfile);
-			cur_rmconf->peerscertfile = racoon_strdup($3->v);
-			STRDUP_FATAL(cur_rmconf->peerscertfile);
-			vfree($3);
-		}
-		EOS
-	|	PEERS_CERTFILE CERT_PLAINRSA QUOTEDSTRING
-		{
-			char path[MAXPATHLEN];
-			int ret = 0;
-
-			getpathname(path, sizeof(path),
-				LC_PATHTYPE_CERT, $3->v);
-			vfree($3);
-
-			if (cur_rmconf->getcert_method == ISAKMP_GETCERT_DNS) {
-				yyerror("Different peers_certfile method "
-					"already defined: %d!\n",
-					cur_rmconf->getcert_method);
-				return -1;
-			}
-			cur_rmconf->getcert_method = ISAKMP_GETCERT_LOCALFILE;
-			if (rsa_parse_file(cur_rmconf->rsa_public, path, RSA_TYPE_PUBLIC)) {
-				yyerror("Couldn't parse keyfile.\n", path);
-				return -1;
-			}
-			plog(LLV_DEBUG, LOCATION, NULL, "Public PlainRSA keyfile parsed: %s\n", path);
-		}
-		EOS
-	|	PEERS_CERTFILE DNSSEC
-		{
-			if (cur_rmconf->getcert_method) {
-				yyerror("Different peers_certfile method already defined!\n");
-				return -1;
-			}
-			cur_rmconf->getcert_method = ISAKMP_GETCERT_DNS;
-			cur_rmconf->peerscertfile = NULL;
-		}
-		EOS
-	|	VERIFY_CERT SWITCH { cur_rmconf->verify_cert = $2; } EOS
-	|	SEND_CERT SWITCH { cur_rmconf->send_cert = $2; } EOS
-	|	SEND_CR SWITCH { cur_rmconf->send_cr = $2; } EOS
-	|	MY_IDENTIFIER IDENTIFIERTYPE identifierstring
-		{
-			if (set_identifier(&cur_rmconf->idv, $2, $3) != 0) {
-				yyerror("failed to set identifer.\n");
-				return -1;
-			}
-			cur_rmconf->idvtype = $2;
-		}
-		EOS
-	|	MY_IDENTIFIER IDENTIFIERTYPE IDENTIFIERQUAL identifierstring
-		{
-			if (set_identifier_qual(&cur_rmconf->idv, $2, $4, $3) != 0) {
-				yyerror("failed to set identifer.\n");
-				return -1;
-			}
-			cur_rmconf->idvtype = $2;
-		}
-		EOS
-	|	XAUTH_LOGIN identifierstring
-		{
-#ifdef ENABLE_HYBRID
-			/* formerly identifier type login */
-			if (xauth_rmconf_used(&cur_rmconf->xauth) == -1) {
-				yyerror("failed to allocate xauth state\n");
-				return -1;
-			}
-			if ((cur_rmconf->xauth->login = vdup($2)) == NULL) {
-				yyerror("failed to set identifer.\n");
-				return -1;
-			}
-#else
-			yyerror("racoon not configured with --enable-hybrid");
-#endif
-		}
-		EOS
-	|	PEERS_IDENTIFIER IDENTIFIERTYPE identifierstring
-		{
-			struct idspec  *id;
-			id = newidspec();
-			if (id == NULL) {
-				yyerror("failed to allocate idspec");
-				return -1;
-			}
-			if (set_identifier(&id->id, $2, $3) != 0) {
-				yyerror("failed to set identifer.\n");
-				racoon_free(id);
-				return -1;
-			}
-			id->idtype = $2;
-			genlist_append (cur_rmconf->idvl_p, id);
-		}
-		EOS
-	|	PEERS_IDENTIFIER IDENTIFIERTYPE IDENTIFIERQUAL identifierstring
-		{
-			struct idspec  *id;
-			id = newidspec();
-			if (id == NULL) {
-				yyerror("failed to allocate idspec");
-				return -1;
-			}
-			if (set_identifier_qual(&id->id, $2, $4, $3) != 0) {
-				yyerror("failed to set identifer.\n");
-				racoon_free(id);
-				return -1;
-			}
-			id->idtype = $2;
-			genlist_append (cur_rmconf->idvl_p, id);
-		}
-		EOS
-	|	VERIFY_IDENTIFIER SWITCH { cur_rmconf->verify_identifier = $2; } EOS
-	|	NONCE_SIZE NUMBER { cur_rmconf->nonce_size = $2; } EOS
-	|	DH_GROUP
-		{
-			yyerror("dh_group cannot be defined here.");
-			return -1;
-		}
-		dh_group_num EOS
-	|	PASSIVE SWITCH { cur_rmconf->passive = $2; } EOS
-	|	IKE_FRAG SWITCH { cur_rmconf->ike_frag = $2; } EOS
-	|	IKE_FRAG REMOTE_FORCE_LEVEL { cur_rmconf->ike_frag = ISAKMP_FRAG_FORCE; } EOS
-	|	ESP_FRAG NUMBER { 
-#ifdef SADB_X_EXT_NAT_T_FRAG
-        		if (libipsec_opt & LIBIPSEC_OPT_FRAG)
-				cur_rmconf->esp_frag = $2; 
-			else
-                		yywarn("libipsec lacks IKE frag support");
-#else
-			yywarn("Your kernel does not support esp_frag");
-#endif
-		} EOS
-	|	SCRIPT QUOTEDSTRING PHASE1_UP { 
-			if (cur_rmconf->script[SCRIPT_PHASE1_UP] != NULL)
-				vfree(cur_rmconf->script[SCRIPT_PHASE1_UP]);
-
-			cur_rmconf->script[SCRIPT_PHASE1_UP] = 
-			    script_path_add(vdup($2));
-		} EOS
-	|	SCRIPT QUOTEDSTRING PHASE1_DOWN { 
-			if (cur_rmconf->script[SCRIPT_PHASE1_DOWN] != NULL)
-				vfree(cur_rmconf->script[SCRIPT_PHASE1_DOWN]);
-
-			cur_rmconf->script[SCRIPT_PHASE1_DOWN] = 
-			    script_path_add(vdup($2));
-		} EOS
-	|	MODE_CFG SWITCH { cur_rmconf->mode_cfg = $2; } EOS
-	|	WEAK_PHASE1_CHECK SWITCH {
-			cur_rmconf->weak_phase1_check = $2;
-		} EOS
-	|	GENERATE_POLICY SWITCH { cur_rmconf->gen_policy = $2; } EOS
-	|	GENERATE_POLICY GENERATE_LEVEL { cur_rmconf->gen_policy = $2; } EOS
-	|	SUPPORT_PROXY SWITCH { cur_rmconf->support_proxy = $2; } EOS
-	|	INITIAL_CONTACT SWITCH { cur_rmconf->ini_contact = $2; } EOS
-	|	NAT_TRAVERSAL SWITCH
-		{
-#ifdef ENABLE_NATT
-        		if (libipsec_opt & LIBIPSEC_OPT_NATT)
-				cur_rmconf->nat_traversal = $2;
-			else
-                		yyerror("libipsec lacks NAT-T support");
-#else
-			yyerror("NAT-T support not compiled in.");
-#endif
-		} EOS
-	|	NAT_TRAVERSAL REMOTE_FORCE_LEVEL
-		{
-#ifdef ENABLE_NATT
-			if (libipsec_opt & LIBIPSEC_OPT_NATT)
-				cur_rmconf->nat_traversal = NATT_FORCE;
-			else
-                		yyerror("libipsec lacks NAT-T support");
-#else
-			yyerror("NAT-T support not compiled in.");
-#endif
-		} EOS
-	|	DPD SWITCH
-		{
-#ifdef ENABLE_DPD
-			cur_rmconf->dpd = $2;
-#else
-			yyerror("DPD support not compiled in.");
-#endif
-		} EOS
-	|	DPD_DELAY NUMBER
-		{
-#ifdef ENABLE_DPD
-			cur_rmconf->dpd_interval = $2;
-#else
-			yyerror("DPD support not compiled in.");
-#endif
-		}
-		EOS
-	|	DPD_RETRY NUMBER
-		{
-#ifdef ENABLE_DPD
-			cur_rmconf->dpd_retry = $2;
-#else
-			yyerror("DPD support not compiled in.");
-#endif
-		}
-		EOS
-	|	DPD_MAXFAIL NUMBER
-		{
-#ifdef ENABLE_DPD
-			cur_rmconf->dpd_maxfails = $2;
-#else
-			yyerror("DPD support not compiled in.");
-#endif
-		}
-		EOS
-	|	PH1ID NUMBER
-		{
-			cur_rmconf->ph1id = $2;
-		}
-		EOS
-	|	LIFETIME LIFETYPE_TIME NUMBER unittype_time
-		{
-			cur_rmconf->prhead->lifetime = $3 * $4;
-		}
-		EOS
-	|	PROPOSAL_CHECK PROPOSAL_CHECK_LEVEL { cur_rmconf->pcheck_level = $2; } EOS
-	|	LIFETIME LIFETYPE_BYTE NUMBER unittype_byte
-		{
-#if 1
-			yyerror("byte lifetime support is deprecated in Phase1");
-			return -1;
-#else
-			yywarn("the lifetime of bytes in phase 1 "
-				"will be ignored at the moment.");
-			cur_rmconf->prhead->lifebyte = fix_lifebyte($3 * $4);
-			if (cur_rmconf->prhead->lifebyte == 0)
-				return -1;
-#endif
-		}
-		EOS
-	|	PROPOSAL
-		{
-			struct secprotospec *spspec;
-
-			spspec = newspspec();
-			if (spspec == NULL)
-				return -1;
-			insspspec(spspec, &cur_rmconf->prhead);
-		}
-		BOC isakmpproposal_specs EOC
-	;
-exchange_types
-	:	/* nothing */
-	|	exchange_types EXCHANGETYPE
-		{
-			struct etypes *new;
-			new = racoon_malloc(sizeof(struct etypes));
-			if (new == NULL) {
-				yyerror("failed to allocate etypes");
-				return -1;
-			}
-			new->type = $2;
-			new->next = NULL;
-			if (cur_rmconf->etypes == NULL)
-				cur_rmconf->etypes = new;
-			else {
-				struct etypes *p;
-				for (p = cur_rmconf->etypes;
-				     p->next != NULL;
-				     p = p->next)
-					;
-				p->next = new;
-			}
-		}
-	;
-cert_spec
-	:	CERT_X509 QUOTEDSTRING QUOTEDSTRING
-		{
-			cur_rmconf->certtype = $1;
-			if (cur_rmconf->mycertfile != NULL)
-				racoon_free(cur_rmconf->mycertfile);
-			cur_rmconf->mycertfile = racoon_strdup($2->v);
-			STRDUP_FATAL(cur_rmconf->mycertfile);
-			vfree($2);
-			if (cur_rmconf->myprivfile != NULL)
-				racoon_free(cur_rmconf->myprivfile);
-			cur_rmconf->myprivfile = racoon_strdup($3->v);
-			STRDUP_FATAL(cur_rmconf->myprivfile);
-			vfree($3);
-		}
-		EOS
-	|	CERT_PLAINRSA QUOTEDSTRING
-		{
-			char path[MAXPATHLEN];
-			int ret = 0;
-
-			getpathname(path, sizeof(path),
-				LC_PATHTYPE_CERT, $2->v);
-			vfree($2);
-
-			cur_rmconf->certtype = $1;
-			cur_rmconf->send_cr = FALSE;
-			cur_rmconf->send_cert = FALSE;
-			cur_rmconf->verify_cert = FALSE;
-			if (rsa_parse_file(cur_rmconf->rsa_private, path, RSA_TYPE_PRIVATE)) {
-				yyerror("Couldn't parse keyfile.\n", path);
-				return -1;
-			}
-			plog(LLV_DEBUG, LOCATION, NULL, "Private PlainRSA keyfile parsed: %s\n", path);
-		}
-		EOS
-	;
-dh_group_num
-	:	ALGORITHMTYPE
-		{
-			$$ = algtype2doi(algclass_isakmp_dh, $1);
-			if ($$ == -1) {
-				yyerror("must be DH group");
-				return -1;
-			}
-		}
-	|	NUMBER
-		{
-			if (ARRAYLEN(num2dhgroup) > $1 && num2dhgroup[$1] != 0) {
-				$$ = num2dhgroup[$1];
-			} else {
-				yyerror("must be DH group");
-				$$ = 0;
-				return -1;
-			}
-		}
-	;
-identifierstring
-	:	/* nothing */ { $$ = NULL; }
-	|	ADDRSTRING { $$ = $1; }
-	|	QUOTEDSTRING { $$ = $1; }
-	;
-isakmpproposal_specs
-	:	/* nothing */
-	|	isakmpproposal_specs isakmpproposal_spec
-	;
-isakmpproposal_spec
-	:	STRENGTH
-		{
-			yyerror("strength directive is obsoleted.");
-		} STRENGTHTYPE EOS
-	|	LIFETIME LIFETYPE_TIME NUMBER unittype_time
-		{
-			cur_rmconf->prhead->spspec->lifetime = $3 * $4;
-		}
-		EOS
-	|	LIFETIME LIFETYPE_BYTE NUMBER unittype_byte
-		{
-#if 1
-			yyerror("byte lifetime support is deprecated");
-			return -1;
-#else
-			cur_rmconf->prhead->spspec->lifebyte = fix_lifebyte($3 * $4);
-			if (cur_rmconf->prhead->spspec->lifebyte == 0)
-				return -1;
-#endif
-		}
-		EOS
-	|	DH_GROUP dh_group_num
-		{
-			cur_rmconf->prhead->spspec->algclass[algclass_isakmp_dh] = $2;
-		}
-		EOS
-	|	GSS_ID QUOTEDSTRING
-		{
-			if (cur_rmconf->prhead->spspec->vendorid != VENDORID_GSSAPI) {
-				yyerror("wrong Vendor ID for gssapi_id");
-				return -1;
-			}
-			if (cur_rmconf->prhead->spspec->gssid != NULL)
-				racoon_free(cur_rmconf->prhead->spspec->gssid);
-			cur_rmconf->prhead->spspec->gssid = 
-			    racoon_strdup($2->v);
-			STRDUP_FATAL(cur_rmconf->prhead->spspec->gssid);
-		}
-		EOS
-	|	ALGORITHM_CLASS ALGORITHMTYPE keylength
-		{
-			int doi;
-			int defklen;
-
-			doi = algtype2doi($1, $2);
-			if (doi == -1) {
-				yyerror("algorithm mismatched 1");
-				return -1;
-			}
-
-			switch ($1) {
-			case algclass_isakmp_enc:
-			/* reject suppressed algorithms */
-#ifndef HAVE_OPENSSL_RC5_H
-				if ($2 == algtype_rc5) {
-					yyerror("algorithm %s not supported",
-					    s_attr_isakmp_enc(doi));
-					return -1;
-				}
-#endif
-#ifndef HAVE_OPENSSL_IDEA_H
-				if ($2 == algtype_idea) {
-					yyerror("algorithm %s not supported",
-					    s_attr_isakmp_enc(doi));
-					return -1;
-				}
-#endif
-
-				cur_rmconf->prhead->spspec->algclass[algclass_isakmp_enc] = doi;
-				defklen = default_keylen($1, $2);
-				if (defklen == 0) {
-					if ($3) {
-						yyerror("keylen not allowed");
-						return -1;
-					}
-				} else {
-					if ($3 && check_keylen($1, $2, $3) < 0) {
-						yyerror("invalid keylen %d", $3);
-						return -1;
-					}
-				}
-				if ($3)
-					cur_rmconf->prhead->spspec->encklen = $3;
-				else
-					cur_rmconf->prhead->spspec->encklen = defklen;
-				break;
-			case algclass_isakmp_hash:
-				cur_rmconf->prhead->spspec->algclass[algclass_isakmp_hash] = doi;
-				break;
-			case algclass_isakmp_ameth:
-				cur_rmconf->prhead->spspec->algclass[algclass_isakmp_ameth] = doi;
-				/*
-				 * We may have to set the Vendor ID for the
-				 * authentication method we're using.
-				 */
-				switch ($2) {
-				case algtype_gssapikrb:
-					if (cur_rmconf->prhead->spspec->vendorid !=
-					    VENDORID_UNKNOWN) {
-						yyerror("Vendor ID mismatch "
-						    "for auth method");
-						return -1;
-					}
-					/*
-					 * For interoperability with Win2k,
-					 * we set the Vendor ID to "GSSAPI".
-					 */
-					cur_rmconf->prhead->spspec->vendorid =
-					    VENDORID_GSSAPI;
-					break;
-				case algtype_rsasig:
-					if (cur_rmconf->certtype == ISAKMP_CERT_PLAINRSA) {
-						if (rsa_list_count(cur_rmconf->rsa_private) == 0) {
-							yyerror ("Private PlainRSA key not set. "
-								"Use directive 'certificate_type plainrsa ...'\n");
-							return -1;
-						}
-						if (rsa_list_count(cur_rmconf->rsa_public) == 0) {
-							yyerror ("Public PlainRSA keys not set. "
-								"Use directive 'peers_certfile plainrsa ...'\n");
-							return -1;
-						}
-					}
-					break;
-				default:
-					break;
-				}
-				break;
-			default:
-				yyerror("algorithm mismatched 2");
-				return -1;
-			}
-		}
-		EOS
-	;
-
-unittype_time
-	:	UNITTYPE_SEC	{ $$ = 1; }
-	|	UNITTYPE_MIN	{ $$ = 60; }
-	|	UNITTYPE_HOUR	{ $$ = (60 * 60); }
-	;
-unittype_byte
-	:	UNITTYPE_BYTE	{ $$ = 1; }
-	|	UNITTYPE_KBYTES	{ $$ = 1024; }
-	|	UNITTYPE_MBYTES	{ $$ = (1024 * 1024); }
-	|	UNITTYPE_TBYTES	{ $$ = (1024 * 1024 * 1024); }
-	;
-%%
-
-static struct proposalspec *
-newprspec()
-{
-	struct proposalspec *new;
-
-	new = racoon_calloc(1, sizeof(*new));
-	if (new == NULL)
-		yyerror("failed to allocate proposal");
-
-	return new;
-}
-
-/*
- * insert into head of list.
- */
-static void
-insprspec(prspec, head)
-	struct proposalspec *prspec;
-	struct proposalspec **head;
-{
-	if (*head != NULL)
-		(*head)->prev = prspec;
-	prspec->next = *head;
-	*head = prspec;
-}
-
-static struct secprotospec *
-newspspec()
-{
-	struct secprotospec *new;
-
-	new = racoon_calloc(1, sizeof(*new));
-	if (new == NULL) {
-		yyerror("failed to allocate spproto");
-		return NULL;
-	}
-
-	new->encklen = 0;	/*XXX*/
-
-	/*
-	 * Default to "uknown" vendor -- we will override this
-	 * as necessary.  When we send a Vendor ID payload, an
-	 * "unknown" will be translated to a KAME/racoon ID.
-	 */
-	new->vendorid = VENDORID_UNKNOWN;
-
-	return new;
-}
-
-/*
- * insert into head of list.
- */
-static void
-insspspec(spspec, head)
-	struct secprotospec *spspec;
-	struct proposalspec **head;
-{
-	spspec->back = *head;
-
-	if ((*head)->spspec != NULL)
-		(*head)->spspec->prev = spspec;
-	spspec->next = (*head)->spspec;
-	(*head)->spspec = spspec;
-}
-
-/* set final acceptable proposal */
-static int
-set_isakmp_proposal(rmconf, prspec)
-	struct remoteconf *rmconf;
-	struct proposalspec *prspec;
-{
-	struct proposalspec *p;
-	struct secprotospec *s;
-	int prop_no = 1; 
-	int trns_no = 1;
-	int32_t types[MAXALGCLASS];
-
-	p = prspec;
-	if (p->next != 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"multiple proposal definition.\n");
-		return -1;
-	}
-
-	/* mandatory check */
-	if (p->spspec == NULL) {
-		yyerror("no remote specification found: %s.\n",
-			saddr2str(rmconf->remote));
-		return -1;
-	}
-	for (s = p->spspec; s != NULL; s = s->next) {
-		/* XXX need more to check */
-		if (s->algclass[algclass_isakmp_enc] == 0) {
-			yyerror("encryption algorithm required.");
-			return -1;
-		}
-		if (s->algclass[algclass_isakmp_hash] == 0) {
-			yyerror("hash algorithm required.");
-			return -1;
-		}
-		if (s->algclass[algclass_isakmp_dh] == 0) {
-			yyerror("DH group required.");
-			return -1;
-		}
-		if (s->algclass[algclass_isakmp_ameth] == 0) {
-			yyerror("authentication method required.");
-			return -1;
-		}
-	}
-
-	/* skip to last part */
-	for (s = p->spspec; s->next != NULL; s = s->next)
-		;
-
-	while (s != NULL) {
-		plog(LLV_DEBUG2, LOCATION, NULL,
-			"lifetime = %ld\n", (long)
-			(s->lifetime ? s->lifetime : p->lifetime));
-		plog(LLV_DEBUG2, LOCATION, NULL,
-			"lifebyte = %d\n",
-			s->lifebyte ? s->lifebyte : p->lifebyte);
-		plog(LLV_DEBUG2, LOCATION, NULL,
-			"encklen=%d\n", s->encklen);
-
-		memset(types, 0, ARRAYLEN(types));
-		types[algclass_isakmp_enc] = s->algclass[algclass_isakmp_enc];
-		types[algclass_isakmp_hash] = s->algclass[algclass_isakmp_hash];
-		types[algclass_isakmp_dh] = s->algclass[algclass_isakmp_dh];
-		types[algclass_isakmp_ameth] =
-		    s->algclass[algclass_isakmp_ameth];
-
-		/* expanding spspec */
-		clean_tmpalgtype();
-		trns_no = expand_isakmpspec(prop_no, trns_no, types,
-				algclass_isakmp_enc, algclass_isakmp_ameth + 1,
-				s->lifetime ? s->lifetime : p->lifetime,
-				s->lifebyte ? s->lifebyte : p->lifebyte,
-				s->encklen, s->vendorid, s->gssid,
-				rmconf);
-		if (trns_no == -1) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to expand isakmp proposal.\n");
-			return -1;
-		}
-
-		s = s->prev;
-	}
-
-	if (rmconf->proposal == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"no proposal found.\n");
-		return -1;
-	}
-
-	return 0;
-}
-
-static void
-clean_tmpalgtype()
-{
-	int i;
-	for (i = 0; i < MAXALGCLASS; i++)
-		tmpalgtype[i] = 0;	/* means algorithm undefined. */
-}
-
-static int
-expand_isakmpspec(prop_no, trns_no, types,
-		class, last, lifetime, lifebyte, encklen, vendorid, gssid,
-		rmconf)
-	int prop_no, trns_no;
-	int *types, class, last;
-	time_t lifetime;
-	int lifebyte;
-	int encklen;
-	int vendorid;
-	char *gssid;
-	struct remoteconf *rmconf;
-{
-	struct isakmpsa *new;
-
-	/* debugging */
-    {
-	int j;
-	char tb[10];
-	plog(LLV_DEBUG2, LOCATION, NULL,
-		"p:%d t:%d\n", prop_no, trns_no);
-	for (j = class; j < MAXALGCLASS; j++) {
-		snprintf(tb, sizeof(tb), "%d", types[j]);
-		plog(LLV_DEBUG2, LOCATION, NULL,
-			"%s%s%s%s\n",
-			s_algtype(j, types[j]),
-			types[j] ? "(" : "",
-			tb[0] == '0' ? "" : tb,
-			types[j] ? ")" : "");
-	}
-	plog(LLV_DEBUG2, LOCATION, NULL, "\n");
-    }
-
-#define TMPALGTYPE2STR(n) \
-	s_algtype(algclass_isakmp_##n, types[algclass_isakmp_##n])
-		/* check mandatory values */
-		if (types[algclass_isakmp_enc] == 0
-		 || types[algclass_isakmp_ameth] == 0
-		 || types[algclass_isakmp_hash] == 0
-		 || types[algclass_isakmp_dh] == 0) {
-			yyerror("few definition of algorithm "
-				"enc=%s ameth=%s hash=%s dhgroup=%s.\n",
-				TMPALGTYPE2STR(enc),
-				TMPALGTYPE2STR(ameth),
-				TMPALGTYPE2STR(hash),
-				TMPALGTYPE2STR(dh));
-			return -1;
-		}
-#undef TMPALGTYPE2STR
-
-	/* set new sa */
-	new = newisakmpsa();
-	if (new == NULL) {
-		yyerror("failed to allocate isakmp sa");
-		return -1;
-	}
-	new->prop_no = prop_no;
-	new->trns_no = trns_no++;
-	new->lifetime = lifetime;
-	new->lifebyte = lifebyte;
-	new->enctype = types[algclass_isakmp_enc];
-	new->encklen = encklen;
-	new->authmethod = types[algclass_isakmp_ameth];
-	new->hashtype = types[algclass_isakmp_hash];
-	new->dh_group = types[algclass_isakmp_dh];
-	new->vendorid = vendorid;
-#ifdef HAVE_GSSAPI
-	if (new->authmethod == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB) {
-		if (gssid != NULL) {
-			if ((new->gssid = vmalloc(strlen(gssid))) == NULL) {
-				racoon_free(new);
-				yyerror("failed to allocate gssid");
-				return -1;
-			}
-			memcpy(new->gssid->v, gssid, new->gssid->l);
-			racoon_free(gssid);
-#ifdef ENABLE_HYBRID
-		} else if (rmconf->xauth == NULL) {
-#else
-		} else {
-#endif
-			/*
-			 * Allocate the default ID so that it gets put
-			 * into a GSS ID attribute during the Phase 1
-			 * exchange.
-			 */
-			new->gssid = gssapi_get_default_gss_id();
-		}
-	}
-#endif
-	insisakmpsa(new, rmconf);
-
-	return trns_no;
-}
-
-static int
-listen_addr (struct sockaddr *addr, int udp_encap)
-{
-	struct myaddrs *p;
-
-	p = newmyaddr();
-	if (p == NULL) {
-		yyerror("failed to allocate myaddrs");
-		return -1;
-	}
-	p->addr = addr;
-	if (p->addr == NULL) {
-		yyerror("failed to copy sockaddr ");
-		delmyaddr(p);
-		return -1;
-	}
-	p->udp_encap = udp_encap;
-
-	insmyaddr(p, &lcconf->myaddrs);
-
-	lcconf->autograbaddr = 0;
-	return 0;
-}
-
-#if 0
-/*
- * fix lifebyte.
- * Must be more than 1024B because its unit is kilobytes.
- * That is defined RFC2407.
- */
-static int
-fix_lifebyte(t)
-	unsigned long t;
-{
-	if (t < 1024) {
-		yyerror("byte size should be more than 1024B.");
-		return 0;
-	}
-
-	return(t / 1024);
-}
-#endif
-
-int
-cfparse()
-{
-	int error;
-
-	yycf_init_buffer();
-
-	if (yycf_switch_buffer(lcconf->racoon_conf) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "could not read configuration file \"%s\"\n", 
-		    lcconf->racoon_conf);
-		return -1;
-	}
-
-	error = yyparse();
-	if (error != 0) {
-		if (yyerrorcount) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"fatal parse failure (%d errors)\n",
-				yyerrorcount);
-		} else {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"fatal parse failure.\n");
-		}
-		return -1;
-	}
-
-	if (error == 0 && yyerrorcount) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"parse error is nothing, but yyerrorcount is %d.\n",
-				yyerrorcount);
-		exit(1);
-	}
-
-	yycf_clean_buffer();
-
-	plog(LLV_DEBUG2, LOCATION, NULL, "parse successed.\n");
-
-	return 0;
-}
-
-int
-cfreparse()
-{
-	flushph2();
-	flushph1();
-	flushrmconf();
-	flushsainfo();
-	clean_tmpalgtype();
-	return(cfparse());
-}
-
-#ifdef ENABLE_ADMINPORT
-static void
-adminsock_conf(path, owner, group, mode_dec)
-	vchar_t *path;
-	vchar_t *owner;
-	vchar_t *group;
-	int mode_dec;
-{
-	struct passwd *pw = NULL;
-	struct group *gr = NULL;
-	mode_t mode = 0;
-	uid_t uid;
-	gid_t gid;
-	int isnum;
-
-	adminsock_path = path->v;
-
-	if (owner == NULL)
-		return;
-
-	errno = 0;
-	uid = atoi(owner->v);
-	isnum = !errno;
-	if (((pw = getpwnam(owner->v)) == NULL) && !isnum)
-		yyerror("User \"%s\" does not exist", owner->v);
-
-	if (pw)
-		adminsock_owner = pw->pw_uid;
-	else
-		adminsock_owner = uid;
-
-	if (group == NULL)
-		return;
-
-	errno = 0;
-	gid = atoi(group->v);
-	isnum = !errno;
-	if (((gr = getgrnam(group->v)) == NULL) && !isnum)
-		yyerror("Group \"%s\" does not exist", group->v);
-
-	if (gr)
-		adminsock_group = gr->gr_gid;
-	else
-		adminsock_group = gid;
-
-	if (mode_dec == -1)
-		return;
-
-	if (mode_dec > 777)
-		yyerror("Mode 0%03o is invalid", mode_dec);
-	if (mode_dec >= 400) { mode += 0400; mode_dec -= 400; }
-	if (mode_dec >= 200) { mode += 0200; mode_dec -= 200; }
-	if (mode_dec >= 100) { mode += 0200; mode_dec -= 100; }
-
-	if (mode_dec > 77)
-		yyerror("Mode 0%03o is invalid", mode_dec);
-	if (mode_dec >= 40) { mode += 040; mode_dec -= 40; }
-	if (mode_dec >= 20) { mode += 020; mode_dec -= 20; }
-	if (mode_dec >= 10) { mode += 020; mode_dec -= 10; }
-
-	if (mode_dec > 7)
-		yyerror("Mode 0%03o is invalid", mode_dec);
-	if (mode_dec >= 4) { mode += 04; mode_dec -= 4; }
-	if (mode_dec >= 2) { mode += 02; mode_dec -= 2; }
-	if (mode_dec >= 1) { mode += 02; mode_dec -= 1; }
-	
-	adminsock_mode = mode;
-
-	return;
-}
-#endif
diff --git a/src/racoon/cfparse_proto.h b/src/racoon/cfparse_proto.h
deleted file mode 100644
index 139520c..0000000
--- a/src/racoon/cfparse_proto.h
+++ /dev/null
@@ -1,42 +0,0 @@
-/*	$NetBSD: cfparse_proto.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/* Id: cfparse_proto.h,v 1.3 2004/06/11 16:00:15 ludvigm Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _CFPARSE_PROTO_H
-#define _CFPARSE_PROTO_H
-
-/* cfparse.y */
-extern int yyparse __P((void));
-extern int cfparse __P((void));
-extern int cfreparse __P((void));
-
-#endif /* _CFPARSE_PROTO_H */
diff --git a/src/racoon/cftoken.l b/src/racoon/cftoken.l
deleted file mode 100644
index 9950d49..0000000
--- a/src/racoon/cftoken.l
+++ /dev/null
@@ -1,795 +0,0 @@
-/*	$NetBSD: cftoken.l,v 1.11.4.2 2007/09/03 18:07:29 mgrooms Exp $	*/
-
-/* Id: cftoken.l,v 1.53 2006/08/22 18:17:17 manubsd Exp */
-
-%{
-/*
- * Copyright (C) 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002 and 2003 WIDE Project.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/socket.h>
-
-#include <netinet/in.h>
-#include PATH_IPSEC_H
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-#include <limits.h>
-#include <ctype.h>
-#include <glob.h>
-#ifdef HAVE_STDARG_H
-#include <stdarg.h>
-#else
-#include <varargs.h>
-#endif
-
-#include "var.h"
-#include "misc.h"
-#include "vmbuf.h"
-#include "plog.h"
-#include "debug.h"
-
-#include "algorithm.h"
-#include "cfparse_proto.h"
-#include "cftoken_proto.h"
-#include "localconf.h"
-#include "oakley.h"
-#include "isakmp_var.h"
-#include "isakmp.h"
-#include "ipsec_doi.h"
-#include "policy.h"
-#include "proposal.h"
-#include "remoteconf.h"
-#ifdef GC
-#include "gcmalloc.h"
-#endif
-
-#include "cfparse.h"
-
-int yyerrorcount = 0;
-
-#if defined(YIPS_DEBUG)
-#  define YYDB plog(LLV_DEBUG2, LOCATION, NULL,                                \
-		"begin <%d>%s\n", yy_start, yytext);
-#  define YYD {                                                                \
-	plog(LLV_DEBUG2, LOCATION, NULL, "<%d>%s",                             \
-	    yy_start, loglevel >= LLV_DEBUG2 ? "\n" : "");                     \
-}
-#else
-#  define YYDB
-#  define YYD
-#endif /* defined(YIPS_DEBUG) */
-
-#define MAX_INCLUDE_DEPTH 10
-
-static struct include_stack {
-	char *path;
-	FILE *fp;
-	YY_BUFFER_STATE prevstate;
-	int lineno;
-	glob_t matches;
-	int matchon;
-} incstack[MAX_INCLUDE_DEPTH];
-static int incstackp = 0;
-
-static int yy_first_time = 1;
-%}
-
-/* common seciton */
-nl		\n
-ws		[ \t]+
-digit		[0-9]
-letter		[A-Za-z]
-hexdigit	[0-9A-Fa-f]
-/*octet		(([01]?{digit}?{digit})|((2([0-4]{digit}))|(25[0-5]))) */
-special		[()+\|\?\*]
-comma		\,
-dot		\.
-slash		\/
-bcl		\{
-ecl		\}
-blcl		\[
-elcl		\]
-hyphen          \-
-percent		\%
-semi		\;
-comment		\#.*
-ccomment	"/*"
-bracketstring	\<[^>]*\>
-quotedstring	\"[^"]*\"
-addrstring	[a-fA-F0-9:]([a-fA-F0-9:\.]*|[a-fA-F0-9:\.]*%[a-zA-Z0-9]*)
-decstring	{digit}+
-hexstring	0x{hexdigit}+
-
-%s S_INI S_PRIV S_PTH S_INF S_LOG S_PAD S_LST S_RTRY S_CFG S_LDAP
-%s S_ALGST S_ALGCL
-%s S_SAINF S_SAINFS
-%s S_RMT S_RMTS S_RMTP
-%s S_SA
-%s S_GSSENC
-
-%%
-%{
-	if (yy_first_time) {
-		BEGIN S_INI;
-		yy_first_time = 0;
-	}
-%}
-
-	/* privsep */
-<S_INI>privsep		{ BEGIN S_PRIV; YYDB; return(PRIVSEP); }
-<S_PRIV>{bcl}		{ return(BOC); }
-<S_PRIV>user		{ YYD; return(USER); }
-<S_PRIV>group		{ YYD; return(GROUP); }
-<S_PRIV>chroot		{ YYD; return(CHROOT); }
-<S_PRIV>{ecl}		{ BEGIN S_INI; return(EOC); }
-
-	/* path */
-<S_INI>path		{ BEGIN S_PTH; YYDB; return(PATH); }
-<S_PTH>include		{ YYD; yylval.num = LC_PATHTYPE_INCLUDE;
-				return(PATHTYPE); }
-<S_PTH>pre_shared_key	{ YYD; yylval.num = LC_PATHTYPE_PSK;
-				return(PATHTYPE); }
-<S_PTH>certificate	{ YYD; yylval.num = LC_PATHTYPE_CERT;
-				return(PATHTYPE); }
-<S_PTH>script		{ YYD; yylval.num = LC_PATHTYPE_SCRIPT;
-				return(PATHTYPE); }
-<S_PTH>backupsa		{ YYD; yylval.num = LC_PATHTYPE_BACKUPSA;
-				return(PATHTYPE); }
-<S_PTH>pidfile		{ YYD; yylval.num = LC_PATHTYPE_PIDFILE;
-				return(PATHTYPE); }
-<S_PTH>{semi}		{ BEGIN S_INI; YYDB; return(EOS); }
-
-	/* include */
-<S_INI>include		{ YYDB; return(INCLUDE); }
-
-	/* self information */
-<S_INI>identifier	{ BEGIN S_INF; YYDB; yywarn("it is obsoleted.  use \"my_identifier\" in each remote directives."); return(IDENTIFIER); }
-<S_INF>{semi}		{ BEGIN S_INI; return(EOS); }
-
-	/* special */
-<S_INI>complex_bundle	{ YYDB; return(COMPLEX_BUNDLE); }
-
-	/* logging */
-<S_INI>log		{ BEGIN S_LOG; YYDB; return(LOGGING); }
-<S_LOG>error		{ YYD; yylval.num = LLV_ERROR; return(LOGLEV); }
-<S_LOG>warning		{ YYD; yylval.num = LLV_WARNING; return(LOGLEV); }
-<S_LOG>notify		{ YYD; yylval.num = LLV_NOTIFY; return(LOGLEV); }
-<S_LOG>info		{ YYD; yylval.num = LLV_INFO; return(LOGLEV); }
-<S_LOG>debug		{ YYD; yylval.num = LLV_DEBUG; return(LOGLEV); }
-<S_LOG>debug2		{ YYD; yylval.num = LLV_DEBUG2; return(LOGLEV); }
-<S_LOG>debug3		{ YYD; yywarn("it is obsoleted.  use \"debug2\""); yylval.num = LLV_DEBUG2; return(LOGLEV); }
-<S_LOG>debug4		{ YYD; yywarn("it is obsoleted.  use \"debug2\""); yylval.num = LLV_DEBUG2; return(LOGLEV); }
-<S_LOG>{semi}		{ BEGIN S_INI; return(EOS); }
-
-	/* padding */
-<S_INI>padding		{ BEGIN S_PAD; YYDB; return(PADDING); }
-<S_PAD>{bcl}		{ return(BOC); }
-<S_PAD>randomize	{ YYD; return(PAD_RANDOMIZE); }
-<S_PAD>randomize_length	{ YYD; return(PAD_RANDOMIZELEN); }
-<S_PAD>maximum_length	{ YYD; return(PAD_MAXLEN); }
-<S_PAD>strict_check	{ YYD; return(PAD_STRICT); }
-<S_PAD>exclusive_tail	{ YYD; return(PAD_EXCLTAIL); }
-<S_PAD>{ecl}		{ BEGIN S_INI; return(EOC); }
-
-	/* listen */
-<S_INI>listen		{ BEGIN S_LST; YYDB; return(LISTEN); }
-<S_LST>{bcl}		{ return(BOC); }
-<S_LST>isakmp		{ YYD; return(X_ISAKMP); }
-<S_LST>isakmp_natt	{ YYD; return(X_ISAKMP_NATT); }
-<S_LST>admin		{ YYD; return(X_ADMIN); }
-<S_LST>adminsock	{ YYD; return(ADMINSOCK); }
-<S_LST>disabled		{ YYD; return(DISABLED); }
-<S_LST>strict_address	{ YYD; return(STRICT_ADDRESS); }
-<S_LST>{ecl}		{ BEGIN S_INI; return(EOC); }
-
-	/* ldap config */
-<S_INI>ldapcfg		{ BEGIN S_LDAP; YYDB; return(LDAPCFG); }
-<S_LDAP>{bcl}		{ return(BOC); }
-<S_LDAP>version		{ YYD; return(LDAP_PVER); }
-<S_LDAP>host		{ YYD; return(LDAP_HOST); }
-<S_LDAP>port		{ YYD; return(LDAP_PORT); }
-<S_LDAP>base		{ YYD; return(LDAP_BASE); }
-<S_LDAP>subtree		{ YYD; return(LDAP_SUBTREE); }
-<S_LDAP>bind_dn		{ YYD; return(LDAP_BIND_DN); }
-<S_LDAP>bind_pw		{ YYD; return(LDAP_BIND_PW); }
-<S_LDAP>attr_user	{ YYD; return(LDAP_ATTR_USER); }
-<S_LDAP>attr_addr	{ YYD; return(LDAP_ATTR_ADDR); }
-<S_LDAP>attr_mask	{ YYD; return(LDAP_ATTR_MASK); }
-<S_LDAP>attr_group	{ YYD; return(LDAP_ATTR_GROUP); }
-<S_LDAP>attr_member	{ YYD; return(LDAP_ATTR_MEMBER); }
-<S_LDAP>{ecl}		{ BEGIN S_INI; return(EOC); }
-
-	/* mode_cfg */
-<S_INI>mode_cfg		{ BEGIN S_CFG; YYDB; return(MODECFG); }
-<S_CFG>{bcl}		{ return(BOC); }
-<S_CFG>network4		{ YYD; return(CFG_NET4); }
-<S_CFG>netmask4		{ YYD; return(CFG_MASK4); }
-<S_CFG>dns4		{ YYD; return(CFG_DNS4); }
-<S_CFG>nbns4		{ YYD; return(CFG_NBNS4); }
-<S_CFG>wins4		{ YYD; return(CFG_NBNS4); }
-<S_CFG>default_domain	{ YYD; return(CFG_DEFAULT_DOMAIN); }
-<S_CFG>auth_source	{ YYD; return(CFG_AUTH_SOURCE); }
-<S_CFG>auth_groups	{ YYD; return(CFG_AUTH_GROUPS); }
-<S_CFG>group_source	{ YYD; return(CFG_GROUP_SOURCE); }
-<S_CFG>conf_source	{ YYD; return(CFG_CONF_SOURCE); }
-<S_CFG>accounting	{ YYD; return(CFG_ACCOUNTING); }
-<S_CFG>system		{ YYD; return(CFG_SYSTEM); }
-<S_CFG>local		{ YYD; return(CFG_LOCAL); }
-<S_CFG>none		{ YYD; return(CFG_NONE); }
-<S_CFG>radius		{ YYD; return(CFG_RADIUS); }
-<S_CFG>pam		{ YYD; return(CFG_PAM); }
-<S_CFG>ldap		{ YYD; return(CFG_LDAP); }
-<S_CFG>pool_size	{ YYD; return(CFG_POOL_SIZE); }
-<S_CFG>banner		{ YYD; return(CFG_MOTD); }
-<S_CFG>auth_throttle	{ YYD; return(CFG_AUTH_THROTTLE); }
-<S_CFG>split_network	{ YYD; return(CFG_SPLIT_NETWORK); }
-<S_CFG>local_lan	{ YYD; return(CFG_SPLIT_LOCAL); }
-<S_CFG>include		{ YYD; return(CFG_SPLIT_INCLUDE); }
-<S_CFG>split_dns	{ YYD; return(CFG_SPLIT_DNS); }
-<S_CFG>pfs_group	{ YYD; return(CFG_PFS_GROUP); }
-<S_CFG>save_passwd	{ YYD; return(CFG_SAVE_PASSWD); }
-<S_CFG>{comma}		{ YYD; return(COMMA); }
-<S_CFG>{ecl}		{ BEGIN S_INI; return(EOC); }
-
-	/* timer */
-<S_INI>timer		{ BEGIN S_RTRY; YYDB; return(RETRY); }
-<S_RTRY>{bcl}		{ return(BOC); }
-<S_RTRY>counter		{ YYD; return(RETRY_COUNTER); }
-<S_RTRY>interval	{ YYD; return(RETRY_INTERVAL); }
-<S_RTRY>persend		{ YYD; return(RETRY_PERSEND); }
-<S_RTRY>phase1		{ YYD; return(RETRY_PHASE1); }
-<S_RTRY>phase2		{ YYD; return(RETRY_PHASE2); }
-<S_RTRY>natt_keepalive	{ YYD; return(NATT_KA); }
-<S_RTRY>{ecl}		{ BEGIN S_INI; return(EOC); }
-
-	/* sainfo */
-<S_INI>sainfo		{ BEGIN S_SAINF; YYDB; return(SAINFO); }
-<S_SAINF>anonymous	{ YYD; return(ANONYMOUS); }
-<S_SAINF>{blcl}any{elcl}	{ YYD; return(PORTANY); }
-<S_SAINF>any		{ YYD; return(ANY); }
-<S_SAINF>from		{ YYD; return(FROM); }
-<S_SAINF>group		{ YYD; return(GROUP); }
-	/* sainfo spec */
-<S_SAINF>{bcl}		{ BEGIN S_SAINFS; return(BOC); }
-<S_SAINF>{semi}		{ BEGIN S_INI; return(EOS); }
-<S_SAINFS>{ecl}		{ BEGIN S_INI; return(EOC); }
-<S_SAINFS>pfs_group	{ YYD; return(PFS_GROUP); }
-<S_SAINFS>remoteid	{ YYD; return(REMOTEID); }
-<S_SAINFS>identifier	{ YYD; yywarn("it is obsoleted.  use \"my_identifier\"."); return(IDENTIFIER); }
-<S_SAINFS>my_identifier	{ YYD; return(MY_IDENTIFIER); }
-<S_SAINFS>lifetime	{ YYD; return(LIFETIME); }
-<S_SAINFS>time		{ YYD; return(LIFETYPE_TIME); }
-<S_SAINFS>byte		{ YYD; return(LIFETYPE_BYTE); }
-<S_SAINFS>encryption_algorithm { YYD; yylval.num = algclass_ipsec_enc; return(ALGORITHM_CLASS); }
-<S_SAINFS>authentication_algorithm { YYD; yylval.num = algclass_ipsec_auth; return(ALGORITHM_CLASS); }
-<S_SAINFS>compression_algorithm	{ YYD; yylval.num = algclass_ipsec_comp; return(ALGORITHM_CLASS); }
-<S_SAINFS>{comma}	{ YYD; return(COMMA); }
-
-	/* remote */
-<S_INI>remote		{ BEGIN S_RMT; YYDB; return(REMOTE); }
-<S_RMT>anonymous	{ YYD; return(ANONYMOUS); }
-<S_RMT>inherit		{ YYD; return(INHERIT); }
-	/* remote spec */
-<S_RMT>{bcl}		{ BEGIN S_RMTS; return(BOC); }
-<S_RMTS>{ecl}		{ BEGIN S_INI; return(EOC); }
-<S_RMTS>exchange_mode	{ YYD; return(EXCHANGE_MODE); }
-<S_RMTS>{comma}		{ YYD; /* XXX ignored, but to be handled. */ ; }
-<S_RMTS>base		{ YYD; yylval.num = ISAKMP_ETYPE_BASE; return(EXCHANGETYPE); }
-<S_RMTS>main		{ YYD; yylval.num = ISAKMP_ETYPE_IDENT; return(EXCHANGETYPE); }
-<S_RMTS>aggressive	{ YYD; yylval.num = ISAKMP_ETYPE_AGG; return(EXCHANGETYPE); }
-<S_RMTS>doi		{ YYD; return(DOI); }
-<S_RMTS>ipsec_doi	{ YYD; yylval.num = IPSEC_DOI; return(DOITYPE); }
-<S_RMTS>situation	{ YYD; return(SITUATION); }
-<S_RMTS>identity_only	{ YYD; yylval.num = IPSECDOI_SIT_IDENTITY_ONLY; return(SITUATIONTYPE); }
-<S_RMTS>secrecy		{ YYD; yylval.num = IPSECDOI_SIT_SECRECY; return(SITUATIONTYPE); }
-<S_RMTS>integrity	{ YYD; yylval.num = IPSECDOI_SIT_INTEGRITY; return(SITUATIONTYPE); }
-<S_RMTS>identifier	{ YYD; yywarn("it is obsoleted.  use \"my_identifier\"."); return(IDENTIFIER); }
-<S_RMTS>my_identifier	{ YYD; return(MY_IDENTIFIER); }
-<S_RMTS>xauth_login	{ YYD; return(XAUTH_LOGIN); /* formerly identifier type login */ }
-<S_RMTS>peers_identifier	{ YYD; return(PEERS_IDENTIFIER); }
-<S_RMTS>verify_identifier	{ YYD; return(VERIFY_IDENTIFIER); }
-<S_RMTS>certificate_type	{ YYD; return(CERTIFICATE_TYPE); }
-<S_RMTS>ca_type		{ YYD; return(CA_TYPE); }
-<S_RMTS>x509		{ YYD; yylval.num = ISAKMP_CERT_X509SIGN; return(CERT_X509); }
-<S_RMTS>plain_rsa	{ YYD; yylval.num = ISAKMP_CERT_PLAINRSA; return(CERT_PLAINRSA); }
-<S_RMTS>peers_certfile	{ YYD; return(PEERS_CERTFILE); }
-<S_RMTS>dnssec		{ YYD; return(DNSSEC); }
-<S_RMTS>verify_cert	{ YYD; return(VERIFY_CERT); }
-<S_RMTS>send_cert	{ YYD; return(SEND_CERT); }
-<S_RMTS>send_cr		{ YYD; return(SEND_CR); }
-<S_RMTS>dh_group	{ YYD; return(DH_GROUP); }
-<S_RMTS>nonce_size	{ YYD; return(NONCE_SIZE); }
-<S_RMTS>generate_policy	{ YYD; return(GENERATE_POLICY); }
-<S_RMTS>unique		{ YYD; yylval.num = GENERATE_POLICY_UNIQUE; return(GENERATE_LEVEL); }
-<S_RMTS>require		{ YYD; yylval.num = GENERATE_POLICY_REQUIRE; return(GENERATE_LEVEL); }
-<S_RMTS>support_mip6	{ YYD; yywarn("it is obsoleted.  use \"support_proxy\"."); return(SUPPORT_PROXY); }
-<S_RMTS>support_proxy	{ YYD; return(SUPPORT_PROXY); }
-<S_RMTS>initial_contact	{ YYD; return(INITIAL_CONTACT); }
-<S_RMTS>nat_traversal	{ YYD; return(NAT_TRAVERSAL); }
-<S_RMTS>force		{ YYD; return(REMOTE_FORCE_LEVEL); }
-<S_RMTS>proposal_check	{ YYD; return(PROPOSAL_CHECK); }
-<S_RMTS>obey		{ YYD; yylval.num = PROP_CHECK_OBEY; return(PROPOSAL_CHECK_LEVEL); }
-<S_RMTS>strict		{ YYD; yylval.num = PROP_CHECK_STRICT; return(PROPOSAL_CHECK_LEVEL); }
-<S_RMTS>exact		{ YYD; yylval.num = PROP_CHECK_EXACT; return(PROPOSAL_CHECK_LEVEL); }
-<S_RMTS>claim		{ YYD; yylval.num = PROP_CHECK_CLAIM; return(PROPOSAL_CHECK_LEVEL); }
-<S_RMTS>keepalive	{ YYD; return(KEEPALIVE); }
-<S_RMTS>passive		{ YYD; return(PASSIVE); }
-<S_RMTS>lifetime	{ YYD; return(LIFETIME); }
-<S_RMTS>time		{ YYD; return(LIFETYPE_TIME); }
-<S_RMTS>byte		{ YYD; return(LIFETYPE_BYTE); }
-<S_RMTS>dpd			{ YYD; return(DPD); }
-<S_RMTS>dpd_delay	{ YYD; return(DPD_DELAY); }
-<S_RMTS>dpd_retry	{ YYD; return(DPD_RETRY); }
-<S_RMTS>dpd_maxfail	{ YYD; return(DPD_MAXFAIL); }
-<S_RMTS>ph1id		{ YYD; return(PH1ID); }
-<S_RMTS>ike_frag	{ YYD; return(IKE_FRAG); }
-<S_RMTS>esp_frag	{ YYD; return(ESP_FRAG); }
-<S_RMTS>script		{ YYD; return(SCRIPT); }
-<S_RMTS>phase1_up	{ YYD; return(PHASE1_UP); }
-<S_RMTS>phase1_down	{ YYD; return(PHASE1_DOWN); }
-<S_RMTS>mode_cfg	{ YYD; return(MODE_CFG); }
-<S_RMTS>weak_phase1_check { YYD; return(WEAK_PHASE1_CHECK); }
-	/* remote proposal */
-<S_RMTS>proposal	{ BEGIN S_RMTP; YYDB; return(PROPOSAL); }
-<S_RMTP>{bcl}		{ return(BOC); }
-<S_RMTP>{ecl}		{ BEGIN S_RMTS; return(EOC); }
-<S_RMTP>lifetime	{ YYD; return(LIFETIME); }
-<S_RMTP>time		{ YYD; return(LIFETYPE_TIME); }
-<S_RMTP>byte		{ YYD; return(LIFETYPE_BYTE); }
-<S_RMTP>encryption_algorithm { YYD; yylval.num = algclass_isakmp_enc; return(ALGORITHM_CLASS); }
-<S_RMTP>authentication_method { YYD; yylval.num = algclass_isakmp_ameth; return(ALGORITHM_CLASS); }
-<S_RMTP>hash_algorithm	{ YYD; yylval.num = algclass_isakmp_hash; return(ALGORITHM_CLASS); }
-<S_RMTP>dh_group	{ YYD; return(DH_GROUP); }
-<S_RMTP>gss_id		{ YYD; return(GSS_ID); }
-<S_RMTP>gssapi_id	{ YYD; return(GSS_ID); } /* for back compatibility */
-
-	/* GSS ID encoding type (global) */
-<S_INI>gss_id_enc	{ BEGIN S_GSSENC; YYDB; return(GSS_ID_ENC); }
-<S_GSSENC>latin1	{ YYD; yylval.num = LC_GSSENC_LATIN1;
-				return(GSS_ID_ENCTYPE); }
-<S_GSSENC>utf-16le	{ YYD; yylval.num = LC_GSSENC_UTF16LE;
-				return(GSS_ID_ENCTYPE); }
-<S_GSSENC>{semi}	{ BEGIN S_INI; YYDB; return(EOS); }
-
-	/* parameter */
-on		{ YYD; yylval.num = TRUE; return(SWITCH); }
-off		{ YYD; yylval.num = FALSE; return(SWITCH); }
-
-	/* prefix */
-{slash}{digit}{1,3} {
-			YYD;
-			yytext++;
-			yylval.num = atoi(yytext);
-			return(PREFIX);
-		}
-
-	/* port number */
-{blcl}{decstring}{elcl}	{
-			char *p = yytext;
-			YYD;
-			while (*++p != ']') ;
-			*p = 0;
-			yytext++;
-			yylval.num = atoi(yytext);
-			return(PORT);
-		}
-
-	/* address range */
-{hyphen}{addrstring} {
-                        YYD;
-                        yytext++;
-			yylval.val = vmalloc(yyleng + 1);
-			if (yylval.val == NULL) {
-				yyerror("vmalloc failed");
-				return -1;
-			}
-			memcpy(yylval.val->v, yytext, yylval.val->l);
-                        return(ADDRRANGE);
-                } 
-
-	/* upper protocol */
-esp		{ YYD; yylval.num = IPPROTO_ESP; return(UL_PROTO); }
-ah		{ YYD; yylval.num = IPPROTO_AH; return(UL_PROTO); }
-ipcomp		{ YYD; yylval.num = IPPROTO_IPCOMP; return(UL_PROTO); }
-icmp		{ YYD; yylval.num = IPPROTO_ICMP; return(UL_PROTO); }
-icmp6		{ YYD; yylval.num = IPPROTO_ICMPV6; return(UL_PROTO); }
-tcp		{ YYD; yylval.num = IPPROTO_TCP; return(UL_PROTO); }
-udp		{ YYD; yylval.num = IPPROTO_UDP; return(UL_PROTO); }
-
-	/* algorithm type */
-des_iv64	{ YYD; yylval.num = algtype_des_iv64;	return(ALGORITHMTYPE); }
-des		{ YYD; yylval.num = algtype_des;	return(ALGORITHMTYPE); }
-3des		{ YYD; yylval.num = algtype_3des;	return(ALGORITHMTYPE); }
-rc5		{ YYD; yylval.num = algtype_rc5;	return(ALGORITHMTYPE); }
-idea 		{ YYD; yylval.num = algtype_idea;	return(ALGORITHMTYPE); }
-cast128		{ YYD; yylval.num = algtype_cast128;	return(ALGORITHMTYPE); }
-blowfish	{ YYD; yylval.num = algtype_blowfish;	return(ALGORITHMTYPE); }
-3idea		{ YYD; yylval.num = algtype_3idea;	return(ALGORITHMTYPE); }
-des_iv32	{ YYD; yylval.num = algtype_des_iv32;	return(ALGORITHMTYPE); }
-rc4 		{ YYD; yylval.num = algtype_rc4;	return(ALGORITHMTYPE); }
-null_enc	{ YYD; yylval.num = algtype_null_enc;	return(ALGORITHMTYPE); }
-null		{ YYD; yylval.num = algtype_null_enc;	return(ALGORITHMTYPE); }
-aes		{ YYD; yylval.num = algtype_aes;	return(ALGORITHMTYPE); }
-rijndael	{ YYD; yylval.num = algtype_aes;	return(ALGORITHMTYPE); }
-twofish		{ YYD; yylval.num = algtype_twofish;	return(ALGORITHMTYPE); }
-camellia	{ YYD; yylval.num = algtype_camellia;	return(ALGORITHMTYPE); }
-non_auth	{ YYD; yylval.num = algtype_non_auth;	return(ALGORITHMTYPE); }
-hmac_md5	{ YYD; yylval.num = algtype_hmac_md5;	return(ALGORITHMTYPE); }
-hmac_sha1	{ YYD; yylval.num = algtype_hmac_sha1;	return(ALGORITHMTYPE); }
-hmac_sha2_256	{ YYD; yylval.num = algtype_hmac_sha2_256;	return(ALGORITHMTYPE); }
-hmac_sha256	{ YYD; yylval.num = algtype_hmac_sha2_256;	return(ALGORITHMTYPE); }
-hmac_sha2_384	{ YYD; yylval.num = algtype_hmac_sha2_384;	return(ALGORITHMTYPE); }
-hmac_sha384	{ YYD; yylval.num = algtype_hmac_sha2_384;	return(ALGORITHMTYPE); }
-hmac_sha2_512	{ YYD; yylval.num = algtype_hmac_sha2_512;	return(ALGORITHMTYPE); }
-hmac_sha512	{ YYD; yylval.num = algtype_hmac_sha2_512;	return(ALGORITHMTYPE); }
-des_mac		{ YYD; yylval.num = algtype_des_mac;	return(ALGORITHMTYPE); }
-kpdk		{ YYD; yylval.num = algtype_kpdk;	return(ALGORITHMTYPE); }
-md5		{ YYD; yylval.num = algtype_md5;	return(ALGORITHMTYPE); }
-sha1		{ YYD; yylval.num = algtype_sha1;	return(ALGORITHMTYPE); }
-tiger		{ YYD; yylval.num = algtype_tiger;	return(ALGORITHMTYPE); }
-sha2_256	{ YYD; yylval.num = algtype_sha2_256;	return(ALGORITHMTYPE); }
-sha256		{ YYD; yylval.num = algtype_sha2_256;	return(ALGORITHMTYPE); }
-sha2_384	{ YYD; yylval.num = algtype_sha2_384;	return(ALGORITHMTYPE); }
-sha384		{ YYD; yylval.num = algtype_sha2_384;	return(ALGORITHMTYPE); }
-sha2_512	{ YYD; yylval.num = algtype_sha2_512;	return(ALGORITHMTYPE); }
-sha512		{ YYD; yylval.num = algtype_sha2_512;	return(ALGORITHMTYPE); }
-oui		{ YYD; yylval.num = algtype_oui;	return(ALGORITHMTYPE); }
-deflate		{ YYD; yylval.num = algtype_deflate;	return(ALGORITHMTYPE); }
-lzs		{ YYD; yylval.num = algtype_lzs;	return(ALGORITHMTYPE); }
-modp768		{ YYD; yylval.num = algtype_modp768;	return(ALGORITHMTYPE); }
-modp1024	{ YYD; yylval.num = algtype_modp1024;	return(ALGORITHMTYPE); }
-modp1536	{ YYD; yylval.num = algtype_modp1536;	return(ALGORITHMTYPE); }
-ec2n155		{ YYD; yylval.num = algtype_ec2n155;	return(ALGORITHMTYPE); }
-ec2n185		{ YYD; yylval.num = algtype_ec2n185;	return(ALGORITHMTYPE); }
-modp2048	{ YYD; yylval.num = algtype_modp2048;	return(ALGORITHMTYPE); }
-modp3072	{ YYD; yylval.num = algtype_modp3072;	return(ALGORITHMTYPE); }
-modp4096	{ YYD; yylval.num = algtype_modp4096;	return(ALGORITHMTYPE); }
-modp6144	{ YYD; yylval.num = algtype_modp6144;	return(ALGORITHMTYPE); }
-modp8192	{ YYD; yylval.num = algtype_modp8192;	return(ALGORITHMTYPE); }
-pre_shared_key	{ YYD; yylval.num = algtype_psk;	return(ALGORITHMTYPE); }
-rsasig		{ YYD; yylval.num = algtype_rsasig;	return(ALGORITHMTYPE); }
-dsssig		{ YYD; yylval.num = algtype_dsssig;	return(ALGORITHMTYPE); }
-rsaenc		{ YYD; yylval.num = algtype_rsaenc;	return(ALGORITHMTYPE); }
-rsarev		{ YYD; yylval.num = algtype_rsarev;	return(ALGORITHMTYPE); }
-gssapi_krb	{ YYD; yylval.num = algtype_gssapikrb;	return(ALGORITHMTYPE); }
-hybrid_rsa_server {
-#ifdef ENABLE_HYBRID
-	YYD; yylval.num = algtype_hybrid_rsa_s; return(ALGORITHMTYPE);
-#else
-	yyerror("racoon not configured with --enable-hybrid");
-#endif
-}
-hybrid_dss_server {
-#ifdef ENABLE_HYBRID
-	YYD; yylval.num = algtype_hybrid_dss_s; return(ALGORITHMTYPE);
-#else
-	yyerror("racoon not configured with --enable-hybrid");
-#endif
-}
-hybrid_rsa_client {
-#ifdef ENABLE_HYBRID
-	YYD; yylval.num = algtype_hybrid_rsa_c; return(ALGORITHMTYPE);
-#else
-	yyerror("racoon not configured with --enable-hybrid");
-#endif
-}
-hybrid_dss_client {
-#ifdef ENABLE_HYBRID
-	YYD; yylval.num = algtype_hybrid_dss_c; return(ALGORITHMTYPE);
-#else
-	yyerror("racoon not configured with --enable-hybrid");
-#endif
-}
-xauth_psk_server {
-#ifdef ENABLE_HYBRID
-	YYD; yylval.num = algtype_xauth_psk_s; return(ALGORITHMTYPE);
-#else
-	yyerror("racoon not configured with --enable-hybrid");
-#endif
-}
-xauth_psk_client {
-#ifdef ENABLE_HYBRID
-	YYD; yylval.num = algtype_xauth_psk_c; return(ALGORITHMTYPE);
-#else
-	yyerror("racoon not configured with --enable-hybrid");
-#endif
-}
-xauth_rsa_server {
-#ifdef ENABLE_HYBRID
-	YYD; yylval.num = algtype_xauth_rsa_s; return(ALGORITHMTYPE);
-#else
-	yyerror("racoon not configured with --enable-hybrid");
-#endif
-}
-xauth_rsa_client {
-#ifdef ENABLE_HYBRID
-	YYD; yylval.num = algtype_xauth_rsa_c; return(ALGORITHMTYPE);
-#else
-	yyerror("racoon not configured with --enable-hybrid");
-#endif
-}
-
-
-	/* identifier type */
-vendor_id	{ YYD; yywarn("it is obsoleted."); return(VENDORID); }
-user_fqdn	{ YYD; yylval.num = IDTYPE_USERFQDN; return(IDENTIFIERTYPE); }
-fqdn		{ YYD; yylval.num = IDTYPE_FQDN; return(IDENTIFIERTYPE); }
-keyid		{ YYD; yylval.num = IDTYPE_KEYID; return(IDENTIFIERTYPE); }
-address		{ YYD; yylval.num = IDTYPE_ADDRESS; return(IDENTIFIERTYPE); }
-subnet		{ YYD; yylval.num = IDTYPE_SUBNET; return(IDENTIFIERTYPE); }
-asn1dn		{ YYD; yylval.num = IDTYPE_ASN1DN; return(IDENTIFIERTYPE); }
-certname	{ YYD; yywarn("certname will be obsoleted in near future."); yylval.num = IDTYPE_ASN1DN; return(IDENTIFIERTYPE); }
-
-	/* identifier qualifier */
-tag		{ YYD; yylval.num = IDQUAL_TAG;  return(IDENTIFIERQUAL); }
-file		{ YYD; yylval.num = IDQUAL_FILE; return(IDENTIFIERQUAL); }
-
-	/* units */
-B|byte|bytes		{ YYD; return(UNITTYPE_BYTE); }
-KB			{ YYD; return(UNITTYPE_KBYTES); }
-MB			{ YYD; return(UNITTYPE_MBYTES); }
-TB			{ YYD; return(UNITTYPE_TBYTES); }
-sec|secs|second|seconds	{ YYD; return(UNITTYPE_SEC); }
-min|mins|minute|minutes	{ YYD; return(UNITTYPE_MIN); }
-hour|hours		{ YYD; return(UNITTYPE_HOUR); }
-
-	/* boolean */
-yes		{ YYD; yylval.num = TRUE; return(BOOLEAN); }
-no		{ YYD; yylval.num = FALSE; return(BOOLEAN); }
-
-{decstring}	{
-			char *bp;
-
-			YYD;
-			yylval.num = strtol(yytext, &bp, 10);
-			return(NUMBER);
-		}
-
-{hexstring}	{
-			char *p;
-
-			YYD; 
-			yylval.val = vmalloc(yyleng + (yyleng & 1) + 1);
-			if (yylval.val == NULL) {
-				yyerror("vmalloc failed");
-				return -1;
-			}
-
-			p = yylval.val->v;
-			*p++ = '0';
-			*p++ = 'x';
-
-			/* fixed string if length is odd. */
-			if (yyleng & 1)
-				*p++ = '0';
-			memcpy(p, &yytext[2], yyleng - 1);
-
-			return(HEXSTRING);
-		}
-
-{quotedstring}	{
-			char *p = yytext;
-
-			YYD;
-			while (*++p != '"') ;
-			*p = '\0';
-
-			yylval.val = vmalloc(yyleng - 1);
-			if (yylval.val == NULL) {
-				yyerror("vmalloc failed");
-				return -1;
-			}
-			memcpy(yylval.val->v, &yytext[1], yylval.val->l);
-
-			return(QUOTEDSTRING);
-		}
-
-{addrstring}	{
-			YYD;
-
-			yylval.val = vmalloc(yyleng + 1);
-			if (yylval.val == NULL) {
-				yyerror("vmalloc failed");
-				return -1;
-			}
-			memcpy(yylval.val->v, yytext, yylval.val->l);
-
-			return(ADDRSTRING);
-		}
-
-<<EOF>>		{
-			yy_delete_buffer(YY_CURRENT_BUFFER);
-			incstackp--;
-    nextfile:
-			if (incstack[incstackp].matchon <
-			    incstack[incstackp].matches.gl_pathc) {
-				char* filepath = incstack[incstackp].matches.gl_pathv[incstack[incstackp].matchon];
-				incstack[incstackp].matchon++;
-				incstackp++;
-				if (yycf_set_buffer(filepath) != 0) {
-					incstackp--;
-					goto nextfile;
-				}
-				yy_switch_to_buffer(yy_create_buffer(yyin, YY_BUF_SIZE));
-				BEGIN(S_INI);
-			} else {
-				globfree(&incstack[incstackp].matches);
-				if (incstackp == 0)
-					yyterminate();
-				else
-					yy_switch_to_buffer(incstack[incstackp].prevstate);
-			}
-		}
-
-	/* ... */
-{ws}		{ ; }
-{nl}		{ incstack[incstackp].lineno++; }
-{comment}	{ YYD; }
-{semi}		{ return(EOS); }
-.		{ yymore(); }
-
-%%
-
-void
-yyerror(char *s, ...)
-{
-	char fmt[512];
-
-	va_list ap;
-#ifdef HAVE_STDARG_H
-	va_start(ap, s);
-#else
-	va_start(ap);
-#endif
-	snprintf(fmt, sizeof(fmt), "%s:%d: \"%s\" %s\n",
-		incstack[incstackp].path, incstack[incstackp].lineno,
-		yytext, s);
-	plogv(LLV_ERROR, LOCATION, NULL, fmt, ap);
-	va_end(ap);
-
-	yyerrorcount++;
-}
-
-void
-yywarn(char *s, ...)
-{
-	char fmt[512];
-
-	va_list ap;
-#ifdef HAVE_STDARG_H
-	va_start(ap, s);
-#else
-	va_start(ap);
-#endif
-	snprintf(fmt, sizeof(fmt), "%s:%d: \"%s\" %s\n",
-		incstack[incstackp].path, incstack[incstackp].lineno,
-		yytext, s);
-	plogv(LLV_WARNING, LOCATION, NULL, fmt, ap);
-	va_end(ap);
-}
-
-int
-yycf_switch_buffer(path)
-	char *path;
-{
-	char *filepath = NULL;
-
-	/* got the include file name */
-	if (incstackp >= MAX_INCLUDE_DEPTH) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"Includes nested too deeply");
-		return -1;
-	}
-
-	if (glob(path, GLOB_TILDE, NULL, &incstack[incstackp].matches) != 0 ||
-	    incstack[incstackp].matches.gl_pathc == 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"glob found no matches for path \"%s\"\n", path);
-		return -1;
-	}
-	incstack[incstackp].matchon = 0;
-	incstack[incstackp].prevstate = YY_CURRENT_BUFFER;
-
-    nextmatch:
-	if (incstack[incstackp].matchon >= incstack[incstackp].matches.gl_pathc)
-		return -1;
-	filepath =
-	    incstack[incstackp].matches.gl_pathv[incstack[incstackp].matchon];
-	incstack[incstackp].matchon++;
-	incstackp++;
-
-	if (yycf_set_buffer(filepath) != 0) {
-	      incstackp--;
-	      goto nextmatch;
-	}
-
-	yy_switch_to_buffer(yy_create_buffer(yyin, YY_BUF_SIZE));
-
-	BEGIN(S_INI);
-
-	return 0;
-}
-
-int
-yycf_set_buffer(path)
-	char *path;
-{
-	yyin = fopen(path, "r");
-	if (yyin == NULL) {
-		fprintf(stderr, "failed to open file %s (%s)\n",
-			path, strerror(errno));
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to open file %s (%s)\n",
-			path, strerror(errno));
-		return -1;
-	}
-
-	/* initialize */
-	incstack[incstackp].fp = yyin;
-	if (incstack[incstackp].path != NULL)
-		racoon_free(incstack[incstackp].path);
-	incstack[incstackp].path = racoon_strdup(path);
-	STRDUP_FATAL(incstack[incstackp].path);
-	incstack[incstackp].lineno = 1;
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"reading config file %s\n", path);
-
-	return 0;
-}
-
-void
-yycf_init_buffer()
-{
-	int i;
-
-	for (i = 0; i < MAX_INCLUDE_DEPTH; i++)
-		memset(&incstack[i], 0, sizeof(incstack[i]));
-	incstackp = 0;
-}
-
-void
-yycf_clean_buffer()
-{
-	int i;
-
-	for (i = 0; i < MAX_INCLUDE_DEPTH; i++) {
-		if (incstack[i].path != NULL) {
-			fclose(incstack[i].fp);
-			racoon_free(incstack[i].path);
-			incstack[i].path = NULL;
-		}
-	}
-}
-
diff --git a/src/racoon/cftoken_proto.h b/src/racoon/cftoken_proto.h
deleted file mode 100644
index 41cb939..0000000
--- a/src/racoon/cftoken_proto.h
+++ /dev/null
@@ -1,48 +0,0 @@
-/*	$NetBSD: cftoken_proto.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/* Id: cftoken_proto.h,v 1.3 2004/06/11 16:00:15 ludvigm Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _CFTOKEN_PROTO_H
-#define _CFTOKEN_PROTO_H
-
-extern int yyerrorcount;
-
-extern int yylex __P((void));
-extern void yyerror __P((char *, ...));
-extern void yywarn __P((char *, ...));
-
-extern int yycf_switch_buffer __P((char *));
-extern int yycf_set_buffer __P((char *));
-extern void yycf_init_buffer __P((void));
-extern void yycf_clean_buffer __P((void));
-
-#endif /* _CFTOKEN_PROTO_H */
diff --git a/src/racoon/contrib/sp.pl b/src/racoon/contrib/sp.pl
deleted file mode 100644
index d1f9caf..0000000
--- a/src/racoon/contrib/sp.pl
+++ /dev/null
@@ -1,21 +0,0 @@
-#! /usr/pkg/bin/perl
-
-die "insufficient arguments" if (scalar(@ARGV) < 2);
-$src = $ARGV[0];
-$dst = $ARGV[1];
-$mode = 'transport';
-if (scalar(@ARGV) > 2) {
-	$mode = $ARGV[2];
-}
-
-open(OUT, "|setkey -c");
-if ($mode eq 'transport') {
-	print STDERR "install esp transport mode: $src -> $dst\n";
-	print OUT "spdadd $src $dst any -P out ipsec esp/transport//require;\n";
-	print OUT "spdadd $dst $src any -P in ipsec esp/transport//require;\n";
-} elsif ($mode eq 'delete') {
-	print STDERR "delete policy: $src -> $dst\n";
-	print OUT "spddelete $src $dst any -P out;\n";
-	print OUT "spddelete $dst $src any -P in;\n";
-}
-close(OUT);
diff --git a/src/racoon/crypto_openssl.c b/src/racoon/crypto_openssl.c
deleted file mode 100644
index b34b6dd..0000000
--- a/src/racoon/crypto_openssl.c
+++ /dev/null
@@ -1,2852 +0,0 @@
-/*	$NetBSD: crypto_openssl.c,v 1.11.6.6 2009/04/29 10:50:25 tteras Exp $	*/
-
-/* Id: crypto_openssl.c,v 1.47 2006/05/06 20:42:09 manubsd Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <limits.h>
-#include <string.h>
-
-/* get openssl/ssleay version number */
-#include <openssl/opensslv.h>
-
-#if !defined(OPENSSL_VERSION_NUMBER) || (OPENSSL_VERSION_NUMBER < 0x0090602fL)
-#error OpenSSL version 0.9.6 or later required.
-#endif
-
-#include <openssl/pem.h>
-#include <openssl/evp.h>
-#include <openssl/x509.h>
-#include <openssl/x509v3.h>
-#include <openssl/x509_vfy.h>
-#include <openssl/bn.h>
-#include <openssl/dh.h>
-#include <openssl/md5.h>
-#include <openssl/sha.h>
-#include <openssl/hmac.h>
-#include <openssl/des.h>
-#include <openssl/crypto.h>
-#ifdef HAVE_OPENSSL_ENGINE_H
-#include <openssl/engine.h>
-#endif
-#ifndef ANDROID_CHANGES
-#include <openssl/blowfish.h>
-#include <openssl/cast.h>
-#else
-#define EVP_bf_cbc()    NULL
-#define EVP_cast5_cbc() NULL
-#endif
-#include <openssl/err.h>
-#ifdef HAVE_OPENSSL_RC5_H
-#include <openssl/rc5.h>
-#endif
-#ifdef HAVE_OPENSSL_IDEA_H
-#include <openssl/idea.h>
-#endif
-#if defined(HAVE_OPENSSL_AES_H)
-#include <openssl/aes.h>
-#elif defined(HAVE_OPENSSL_RIJNDAEL_H)
-#include <openssl/rijndael.h>
-#else
-#include "crypto/rijndael/rijndael-api-fst.h"
-#endif
-#if defined(HAVE_OPENSSL_CAMELLIA_H)
-#include <openssl/camellia.h>
-#endif
-#ifdef WITH_SHA2
-#ifdef HAVE_OPENSSL_SHA2_H
-#include <openssl/sha2.h>
-#else
-#include "crypto/sha2/sha2.h"
-#endif
-#endif
-#include "plog.h"
-
-/* 0.9.7 stuff? */
-#if OPENSSL_VERSION_NUMBER < 0x0090700fL
-typedef STACK_OF(GENERAL_NAME) GENERAL_NAMES;
-#else
-#define USE_NEW_DES_API
-#endif
-
-#define OpenSSL_BUG()	do { plog(LLV_ERROR, LOCATION, NULL, "OpenSSL function failed\n"); } while(0)
-
-#include "var.h"
-#include "misc.h"
-#include "vmbuf.h"
-#include "plog.h"
-#include "crypto_openssl.h"
-#include "debug.h"
-#include "gcmalloc.h"
-
-#if defined(OPENSSL_IS_BORINGSSL)
-/* HMAC_cleanup is deprecated wrapper in OpenSSL and has been removed in
- * BoringSSL. */
-#define HMAC_cleanup(ctx) HMAC_CTX_cleanup(ctx)
-#endif
-
-/*
- * I hate to cast every parameter to des_xx into void *, but it is
- * necessary for SSLeay/OpenSSL portability.  It sucks.
- */
-
-static int cb_check_cert_local __P((int, X509_STORE_CTX *));
-static int cb_check_cert_remote __P((int, X509_STORE_CTX *));
-static X509 *mem2x509 __P((vchar_t *));
-
-static caddr_t eay_hmac_init __P((vchar_t *, const EVP_MD *));
-
-/* X509 Certificate */
-/*
- * convert the string of the subject name into DER
- * e.g. str = "C=JP, ST=Kanagawa";
- */
-vchar_t *
-eay_str2asn1dn(str, len)
-	const char *str;
-	int len;
-{
-	X509_NAME *name;
-	char *buf;
-	char *field, *value;
-	int i, j;
-	vchar_t *ret = NULL;
-	caddr_t p;
-
-	if (len == -1)
-		len = strlen(str);
-
-	buf = racoon_malloc(len + 1);
-	if (!buf) {
-		plog(LLV_WARNING, LOCATION, NULL,"failed to allocate buffer\n");
-		return NULL;
-	}
-	memcpy(buf, str, len);
-
-	name = X509_NAME_new();
-
-	field = &buf[0];
-	value = NULL;
-	for (i = 0; i < len; i++) {
-		if (!value && buf[i] == '=') {
-			buf[i] = '\0';
-			value = &buf[i + 1];
-			continue;
-		} else if (buf[i] == ',' || buf[i] == '/') {
-			buf[i] = '\0';
-
-			plog(LLV_DEBUG, LOCATION, NULL, "DN: %s=%s\n",
-			     field, value);
-
-			if (!value) goto err;
-			if (!X509_NAME_add_entry_by_txt(name, field,
-					(value[0] == '*' && value[1] == 0) ? 
-						V_ASN1_PRINTABLESTRING : MBSTRING_ASC,
-					(unsigned char *) value, -1, -1, 0)) {
-				plog(LLV_ERROR, LOCATION, NULL, 
-				     "Invalid DN field: %s=%s\n",
-				     field, value);
-				plog(LLV_ERROR, LOCATION, NULL, 
-				     "%s\n", eay_strerror());
-				goto err;
-			}
-			for (j = i + 1; j < len; j++) {
-				if (buf[j] != ' ')
-					break;
-			}
-			field = &buf[j];
-			value = NULL;
-			continue;
-		}
-	}
-	buf[len] = '\0';
-
-	plog(LLV_DEBUG, LOCATION, NULL, "DN: %s=%s\n",
-	     field, value);
-
-	if (!value) goto err;
-	if (!X509_NAME_add_entry_by_txt(name, field,
-			(value[0] == '*' && value[1] == 0) ? 
-				V_ASN1_PRINTABLESTRING : MBSTRING_ASC,
-			(unsigned char *) value, -1, -1, 0)) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		     "Invalid DN field: %s=%s\n",
-		     field, value);
-		plog(LLV_ERROR, LOCATION, NULL, 
-		     "%s\n", eay_strerror());
-		goto err;
-	}
-
-	i = i2d_X509_NAME(name, NULL);
-	if (!i)
-		goto err;
-	ret = vmalloc(i);
-	if (!ret)
-		goto err;
-	p = ret->v;
-	i = i2d_X509_NAME(name, (void *)&p);
-	if (!i)
-		goto err;
-
-	return ret;
-
-    err:
-	if (buf)
-		racoon_free(buf);
-	if (name)
-		X509_NAME_free(name);
-	if (ret)
-		vfree(ret);
-	return NULL;
-}
-
-/*
- * convert the hex string of the subject name into DER
- */
-vchar_t *
-eay_hex2asn1dn(const char *hex, int len)
-{
-	BIGNUM *bn = BN_new();
-	char *binbuf;
-	size_t binlen;
-	vchar_t *ret = NULL;
-	
-	if (len == -1)
-		len = strlen(hex);
-
-	if (BN_hex2bn(&bn, hex) != len) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		     "conversion of Hex-encoded ASN1 string to binary failed: %s\n",
-		     eay_strerror());
-		goto out;
-	}
-	
-	binlen = BN_num_bytes(bn);
-	ret = vmalloc(binlen);
-	if (!ret) {
-		plog(LLV_WARNING, LOCATION, NULL,"failed to allocate buffer\n");
-		return NULL;
-	}
-	binbuf = ret->v;
-
-	BN_bn2bin(bn, (unsigned char *) binbuf);
-
-out:
-	BN_free(bn);
-
-	return ret;
-}
-
-/*
- * The following are derived from code in crypto/x509/x509_cmp.c
- * in OpenSSL0.9.7c:
- * X509_NAME_wildcmp() adds wildcard matching to the original
- * X509_NAME_cmp(), nocase_cmp() and nocase_spacenorm_cmp() are as is.
- */
-#include <ctype.h>
-/* Case insensitive string comparision */
-static int nocase_cmp(const ASN1_STRING *a, const ASN1_STRING *b)
-{
-	int i;
-
-	int a_length = ASN1_STRING_length(a);
-	int b_length = ASN1_STRING_length(b);
-	if (a_length != b_length)
-		return (a_length - b_length);
-
-	const unsigned char *a_data = ASN1_STRING_get0_data(a);
-	const unsigned char *b_data = ASN1_STRING_get0_data(b);
-	for (i=0; i<a_length; i++)
-	{
-		int ca, cb;
-
-		ca = tolower(a_data[i]);
-		cb = tolower(b_data[i]);
-
-		if (ca != cb)
-			return(ca-cb);
-	}
-	return 0;
-}
-
-/* Case insensitive string comparision with space normalization 
- * Space normalization - ignore leading, trailing spaces, 
- *       multiple spaces between characters are replaced by single space  
- */
-static int nocase_spacenorm_cmp(const ASN1_STRING *a, const ASN1_STRING *b)
-{
-	const unsigned char *pa = NULL, *pb = NULL;
-	int la, lb;
-	
-	la = ASN1_STRING_length(a);
-	lb = ASN1_STRING_length(b);
-	pa = ASN1_STRING_get0_data(a);
-	pb = ASN1_STRING_get0_data(b);
-
-	/* skip leading spaces */
-	while (la > 0 && isspace(*pa))
-	{
-		la--;
-		pa++;
-	}
-	while (lb > 0 && isspace(*pb))
-	{
-		lb--;
-		pb++;
-	}
-
-	/* skip trailing spaces */
-	while (la > 0 && isspace(pa[la-1]))
-		la--;
-	while (lb > 0 && isspace(pb[lb-1]))
-		lb--;
-
-	/* compare strings with space normalization */
-	while (la > 0 && lb > 0)
-	{
-		int ca, cb;
-
-		/* compare character */
-		ca = tolower(*pa);
-		cb = tolower(*pb);
-		if (ca != cb)
-			return (ca - cb);
-
-		pa++; pb++;
-		la--; lb--;
-
-		if (la <= 0 || lb <= 0)
-			break;
-
-		/* is white space next character ? */
-		if (isspace(*pa) && isspace(*pb))
-		{
-			/* skip remaining white spaces */
-			while (la > 0 && isspace(*pa))
-			{
-				la--;
-				pa++;
-			}
-			while (lb > 0 && isspace(*pb))
-			{
-				lb--;
-				pb++;
-			}
-		}
-	}
-	if (la > 0 || lb > 0)
-		return la - lb;
-
-	return 0;
-}
-
-static int X509_NAME_wildcmp(const X509_NAME *a, const X509_NAME *b)
-{
-    int i,j;
-    X509_NAME_ENTRY *na,*nb;
-
-    if (X509_NAME_entry_count(a)
-	!= X509_NAME_entry_count(b))
-	    return X509_NAME_entry_count(a)
-	      -X509_NAME_entry_count(b);
-    for (i=X509_NAME_entry_count(a)-1; i>=0; i--)
-    {
-	    na=X509_NAME_get_entry(a,i);
-	    nb=X509_NAME_get_entry(b,i);
-	    j=OBJ_cmp(X509_NAME_ENTRY_get_object(na),X509_NAME_ENTRY_get_object(nb));
-	    if (j) return(j);
-	    const ASN1_STRING *na_value=X509_NAME_ENTRY_get_data(na);
-	    const ASN1_STRING *nb_value=X509_NAME_ENTRY_get_data(nb);
-	    if ((ASN1_STRING_length(na_value) == 1 && ASN1_STRING_get0_data(na_value)[0] == '*')
-	     || (ASN1_STRING_length(nb_value) == 1 && ASN1_STRING_get0_data(nb_value)[0] == '*'))
-		    continue;
-	    j=ASN1_STRING_type(na_value)-ASN1_STRING_type(nb_value);
-	    if (j) return(j);
-	    if (ASN1_STRING_type(na_value) == V_ASN1_PRINTABLESTRING)
-		    j=nocase_spacenorm_cmp(na_value, nb_value);
-	    else if (ASN1_STRING_type(na_value) == V_ASN1_IA5STRING
-		    && OBJ_obj2nid(X509_NAME_ENTRY_get_object(na)) == NID_pkcs9_emailAddress)
-		    j=nocase_cmp(na_value, nb_value);
-	    else
-		    {
-		    j=ASN1_STRING_length(na_value)-ASN1_STRING_length(nb_value);
-		    if (j) return(j);
-		    j=memcmp(ASN1_STRING_get0_data(na_value),ASN1_STRING_get0_data(nb_value),
-			    ASN1_STRING_length(na_value));
-		    }
-	    if (j) return(j);
-	    j=X509_NAME_ENTRY_set(na)-X509_NAME_ENTRY_set(nb);
-	    if (j) return(j);
-    }
-
-    return(0);
-}
-
-/*
- * compare two subjectNames.
- * OUT:        0: equal
- *	positive:
- *	      -1: other error.
- */
-int
-eay_cmp_asn1dn(n1, n2)
-	vchar_t *n1, *n2;
-{
-	X509_NAME *a = NULL, *b = NULL;
-	caddr_t p;
-	int i = -1;
-
-	p = n1->v;
-	if (!d2i_X509_NAME(&a, (void *)&p, n1->l))
-		goto end;
-	p = n2->v;
-	if (!d2i_X509_NAME(&b, (void *)&p, n2->l))
-		goto end;
-
-	i = X509_NAME_wildcmp(a, b);
-
-    end:
-	if (a)
-		X509_NAME_free(a);
-	if (b)
-		X509_NAME_free(b);
-	return i;
-}
-
-#ifdef ANDROID_CHANGES
-
-static BIO *BIO_from_android(char *path)
-{       
-	void *data;
-	if (sscanf(path, pname, &data) == 1) {
-		return BIO_new_mem_buf(data, -1);
-	}
-	return NULL;
-}
-
-#endif
-
-/*
- * this functions is derived from apps/verify.c in OpenSSL0.9.5
- */
-int
-eay_check_x509cert(cert, CApath, CAfile, local)
-	vchar_t *cert;
-	char *CApath;
-	char *CAfile;
-	int local;
-{
-	X509_STORE *cert_ctx = NULL;
-	X509_LOOKUP *lookup = NULL;
-	X509 *x509 = NULL;
-	X509_STORE_CTX *csc;
-	int error = -1;
-
-	cert_ctx = X509_STORE_new();
-	if (cert_ctx == NULL)
-		goto end;
-
-	if (local)
-		X509_STORE_set_verify_cb_func(cert_ctx, cb_check_cert_local);
-	else 
-		X509_STORE_set_verify_cb_func(cert_ctx, cb_check_cert_remote);
-
-#ifdef ANDROID_CHANGES
-	if (pname) {
-		BIO *bio = BIO_from_android(CAfile);
-		STACK_OF(X509_INFO) *stack;
-		X509_INFO *info;
-		int i;
-
-		if (!bio) {
-			goto end;
-		}
-		stack = PEM_X509_INFO_read_bio(bio, NULL, NULL, NULL);
-		BIO_free(bio);
-		if (!stack) {
-			goto end;
-		}
-		for (i = 0; i < sk_X509_INFO_num(stack); ++i) {
-			info = sk_X509_INFO_value(stack, i);
-			if (info->x509) {
-				X509_STORE_add_cert(cert_ctx, info->x509);
-			}
-			if (info->crl) {
-				X509_STORE_add_crl(cert_ctx, info->crl);
-			}
-		}
-		sk_X509_INFO_pop_free(stack, X509_INFO_free);
-	} else {
-#endif
-	lookup = X509_STORE_add_lookup(cert_ctx, X509_LOOKUP_file());
-	if (lookup == NULL)
-		goto end;
-
-	X509_LOOKUP_load_file(lookup, CAfile, 
-	    (CAfile == NULL) ? X509_FILETYPE_DEFAULT : X509_FILETYPE_PEM);
-
-	lookup = X509_STORE_add_lookup(cert_ctx, X509_LOOKUP_hash_dir());
-	if (lookup == NULL)
-		goto end;
-	error = X509_LOOKUP_add_dir(lookup, CApath, X509_FILETYPE_PEM);
-	if(!error) {
-		error = -1;
-		goto end;
-	}
-	error = -1;	/* initialized */
-#ifdef ANDROID_CHANGES
-	}
-#endif
-
-	/* read the certificate to be verified */
-	x509 = mem2x509(cert);
-	if (x509 == NULL)
-		goto end;
-
-	csc = X509_STORE_CTX_new();
-	if (csc == NULL)
-		goto end;
-	X509_STORE_CTX_init(csc, cert_ctx, x509, NULL);
-#if OPENSSL_VERSION_NUMBER >= 0x00907000L
-	X509_STORE_CTX_set_flags (csc, X509_V_FLAG_CRL_CHECK);
-	X509_STORE_CTX_set_flags (csc, X509_V_FLAG_CRL_CHECK_ALL);
-#endif
-	error = X509_verify_cert(csc);
-	X509_STORE_CTX_free(csc);
-
-	/*
-	 * if x509_verify_cert() is successful then the value of error is
-	 * set non-zero.
-	 */
-	error = error ? 0 : -1;
-
-end:
-	if (error)
-		plog(LLV_WARNING, LOCATION, NULL,"%s\n", eay_strerror());
-	if (cert_ctx != NULL)
-		X509_STORE_free(cert_ctx);
-	if (x509 != NULL)
-		X509_free(x509);
-
-	return(error);
-}
-
-/*
- * callback function for verifing certificate.
- * this function is derived from cb() in openssl/apps/s_server.c
- */
-static int
-cb_check_cert_local(ok, ctx)
-	int ok;
-	X509_STORE_CTX *ctx;
-{
-	char buf[256];
-	int log_tag;
-
-	if (!ok) {
-		X509_NAME_oneline(
-				X509_get_subject_name(X509_STORE_CTX_get_current_cert(ctx)),
-				buf,
-				256);
-		/*
-		 * since we are just checking the certificates, it is
-		 * ok if they are self signed. But we should still warn
-		 * the user.
- 		 */
-		int error = X509_STORE_CTX_get_error(ctx);
-		switch (error) {
-		case X509_V_ERR_CERT_HAS_EXPIRED:
-		case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
-		case X509_V_ERR_INVALID_CA:
-		case X509_V_ERR_PATH_LENGTH_EXCEEDED:
-		case X509_V_ERR_INVALID_PURPOSE:
-		case X509_V_ERR_UNABLE_TO_GET_CRL:
-			ok = 1;
-			log_tag = LLV_WARNING;
-			break;
-		default:
-			log_tag = LLV_ERROR;
-		}
-		plog(log_tag, LOCATION, NULL,
-			"%s(%d) at depth:%d SubjectName:%s\n",
-			X509_verify_cert_error_string(error),
-			error,
-			X509_STORE_CTX_get_error_depth(ctx),
-			buf);
-	}
-	ERR_clear_error();
-
-	return ok;
-}
-
-/*
- * callback function for verifing remote certificates.
- * this function is derived from cb() in openssl/apps/s_server.c
- */
-static int
-cb_check_cert_remote(ok, ctx)
-	int ok;
-	X509_STORE_CTX *ctx;
-{
-	char buf[256];
-	int log_tag;
-
-	if (!ok) {
-		X509_NAME_oneline(
-				X509_get_subject_name(X509_STORE_CTX_get_current_cert(ctx)),
-				buf,
-				256);
-		int error = X509_STORE_CTX_get_error(ctx);
-		switch (error) {
-		case X509_V_ERR_UNABLE_TO_GET_CRL:
-			ok = 1;
-			log_tag = LLV_WARNING;
-			break;
-		default:
-			log_tag = LLV_ERROR;
-		}
-		plog(log_tag, LOCATION, NULL,
-			"%s(%d) at depth:%d SubjectName:%s\n",
-			X509_verify_cert_error_string(error),
-			error,
-			X509_STORE_CTX_get_error_depth(ctx),
-			buf);
-	}
-	ERR_clear_error();
-
-	return ok;
-}
-
-/*
- * get a subjectAltName from X509 certificate.
- */
-vchar_t *
-eay_get_x509asn1subjectname(cert)
-	vchar_t *cert;
-{
-	X509 *x509 = NULL;
-	u_char *bp;
-	vchar_t *name = NULL;
-	int len;
-
-	bp = (unsigned char *) cert->v;
-
-	x509 = mem2x509(cert);
-	if (x509 == NULL)
-		goto error;
-
-	/* get the length of the name */
-	len = i2d_X509_NAME(X509_get_subject_name(x509), NULL);
-	name = vmalloc(len);
-	if (!name)
-		goto error;
-	/* get the name */
-	bp = (unsigned char *) name->v;
-	len = i2d_X509_NAME(X509_get_subject_name(x509), &bp);
-
-	X509_free(x509);
-
-	return name;
-
-error:
-	plog(LLV_ERROR, LOCATION, NULL, "%s\n", eay_strerror());
-
-	if (name != NULL) 
-		vfree(name);
-
-	if (x509 != NULL)
-		X509_free(x509);
-
-	return NULL;
-}
-
-/*
- * get the subjectAltName from X509 certificate.
- * the name must be terminated by '\0'.
- */
-int
-eay_get_x509subjectaltname(cert, altname, type, pos)
-	vchar_t *cert;
-	char **altname;
-	int *type;
-	int pos;
-{
-	X509 *x509 = NULL;
-	GENERAL_NAMES *gens = NULL;
-	GENERAL_NAME *gen;
-	int len;
-	int error = -1;
-
-	*altname = NULL;
-	*type = GENT_OTHERNAME;
-
-	x509 = mem2x509(cert);
-	if (x509 == NULL)
-		goto end;
-
-	gens = X509_get_ext_d2i(x509, NID_subject_alt_name, NULL, NULL);
-	if (gens == NULL)
-		goto end;
-
-	/* there is no data at "pos" */
-	if (pos > sk_GENERAL_NAME_num(gens))
-		goto end;
-
-	gen = sk_GENERAL_NAME_value(gens, pos - 1);
-
-	/* read DNSName / Email */
-	if (gen->type == GEN_DNS	||
-		gen->type == GEN_EMAIL	||
-		gen->type == GEN_URI )
-	{
-		/* make sure if the data is terminated by '\0'. */
-		if (ASN1_STRING_get0_data(gen->d.ia5)[ASN1_STRING_length(gen->d.ia5)] != '\0')
-		{
-			plog(LLV_ERROR, LOCATION, NULL,
-				 "data is not terminated by NUL.");
-			racoon_hexdump(ASN1_STRING_get0_data(gen->d.ia5), ASN1_STRING_length(gen->d.ia5) + 1);
-			goto end;
-		}
-		
-		len = ASN1_STRING_length(gen->d.ia5) + 1;
-		*altname = racoon_malloc(len);
-		if (!*altname)
-			goto end;
-		
-		strlcpy(*altname, (const char *) ASN1_STRING_get0_data(gen->d.ia5), len);
-		*type = gen->type;
-		error = 0;
-	}
-	/* read IP address */
-	else if (gen->type == GEN_IPADD)
-	{
-		const unsigned char *ip;
-		
-		/* only support IPv4 */
-		if (ASN1_STRING_length(gen->d.ip) != 4)
-			goto end;
-		
-		/* convert Octet String to String
-		 * XXX ???????
-		 */
-		/*i2d_ASN1_OCTET_STRING(gen->d.ip,&ip);*/
-		ip = ASN1_STRING_get0_data(gen->d.ip);
-
-		/* XXX Magic, enough for an IPv4 address
-		 */
-		*altname = racoon_malloc(20);
-		if (!*altname)
-			goto end;
-		
-		sprintf(*altname, "%u.%u.%u.%u", ip[0], ip[1], ip[2], ip[3]);
-		*type = gen->type;
-		error = 0;
-	}
-	/* XXX other possible types ?
-	 * For now, error will be -1 if unsupported type
-	 */
-
-end:
-	if (error) {
-		if (*altname) {
-			racoon_free(*altname);
-			*altname = NULL;
-		}
-		plog(LLV_ERROR, LOCATION, NULL, "%s\n", eay_strerror());
-	}
-	if (x509)
-		X509_free(x509);
-	if (gens)
-		/* free the whole stack. */
-		sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
-
-	return error;
-}
-
-
-/*
- * decode a X509 certificate and make a readable text terminated '\n'.
- * return the buffer allocated, so must free it later.
- */
-char *
-eay_get_x509text(cert)
-	vchar_t *cert;
-{
-	X509 *x509 = NULL;
-	BIO *bio = NULL;
-	char *text = NULL;
-	u_char *bp = NULL;
-	int len = 0;
-	int error = -1;
-
-	x509 = mem2x509(cert);
-	if (x509 == NULL)
-		goto end;
-
-	bio = BIO_new(BIO_s_mem());
-	if (bio == NULL)
-		goto end;
-
-	error = X509_print(bio, x509);
-	if (error != 1) {
-		error = -1;
-		goto end;
-	}
-
-#if defined(ANDROID_CHANGES)
-	len = BIO_get_mem_data(bio, (char**) &bp);
-#else
-	len = BIO_get_mem_data(bio, &bp);
-#endif
-	text = racoon_malloc(len + 1);
-	if (text == NULL)
-		goto end;
-	memcpy(text, bp, len);
-	text[len] = '\0';
-
-	error = 0;
-
-    end:
-	if (error) {
-		if (text) {
-			racoon_free(text);
-			text = NULL;
-		}
-		plog(LLV_ERROR, LOCATION, NULL, "%s\n", eay_strerror());
-	}
-	if (bio)
-		BIO_free(bio);
-	if (x509)
-		X509_free(x509);
-
-	return text;
-}
-
-/* get X509 structure from buffer. */
-static X509 *
-mem2x509(cert)
-	vchar_t *cert;
-{
-	X509 *x509;
-
-#ifndef EAYDEBUG
-    {
-	u_char *bp;
-
-	bp = (unsigned char *) cert->v;
-
-	x509 = d2i_X509(NULL, (void *)&bp, cert->l);
-    }
-#else
-    {
-	BIO *bio;
-	int len;
-
-	bio = BIO_new(BIO_s_mem());
-	if (bio == NULL)
-		return NULL;
-	len = BIO_write(bio, cert->v, cert->l);
-	if (len == -1)
-		return NULL;
-	x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL);
-	BIO_free(bio);
-    }
-#endif
-	return x509;
-}
-
-/*
- * get a X509 certificate from local file.
- * a certificate must be PEM format.
- * Input:
- *	path to a certificate.
- * Output:
- *	NULL if error occured
- *	other is the cert.
- */
-vchar_t *
-eay_get_x509cert(path)
-	char *path;
-{
-	FILE *fp;
-	X509 *x509;
-	vchar_t *cert;
-	u_char *bp;
-	int len;
-	int error;
-
-#ifdef ANDROID_CHANGES
-	if (pname) {
-		BIO *bio = BIO_from_android(path);
-		if (!bio) {
-			return NULL;
-		}
-		x509 = PEM_read_bio_X509(bio, NULL, NULL, NULL);
-		BIO_free(bio);
-	} else {
-#endif
-	/* Read private key */
-	fp = fopen(path, "r");
-	if (fp == NULL)
-		return NULL;
-	x509 = PEM_read_X509(fp, NULL, NULL, NULL);
-	fclose (fp);
-#ifdef ANDROID_CHANGES
-	}
-#endif
-
-	if (x509 == NULL)
-		return NULL;
-
-	len = i2d_X509(x509, NULL);
-	cert = vmalloc(len);
-	if (cert == NULL) {
-		X509_free(x509);
-		return NULL;
-	}
-	bp = (unsigned char *) cert->v;
-	error = i2d_X509(x509, &bp);
-	X509_free(x509);
-
-	if (error == 0) {
-		vfree(cert);
-		return NULL;
-	}
-
-	return cert;
-}
-
-/*
- * check a X509 signature
- *	XXX: to be get hash type from my cert ?
- *		to be handled EVP_dss().
- * OUT: return -1 when error.
- *	0
- */
-int
-eay_check_x509sign(source, sig, cert)
-	vchar_t *source;
-	vchar_t *sig;
-	vchar_t *cert;
-{
-	X509 *x509;
-	u_char *bp;
-	EVP_PKEY *evp;
-	int res;
-
-	bp = (unsigned char *) cert->v;
-
-	x509 = d2i_X509(NULL, (void *)&bp, cert->l);
-	if (x509 == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "d2i_X509(): %s\n", eay_strerror());
-		return -1;
-	}
-
-	evp = X509_get_pubkey(x509);
-	if (! evp) {
-		plog(LLV_ERROR, LOCATION, NULL, "X509_get_pubkey(): %s\n", eay_strerror());
-		X509_free(x509);
-		return -1;
-	}
-
-	res = eay_rsa_verify(source, sig, EVP_PKEY_get0_RSA(evp));
-
-	EVP_PKEY_free(evp);
-	X509_free(x509);
-
-	return res;
-}
-
-/*
- * check RSA signature
- * OUT: return -1 when error.
- *	0 on success
- */
-int
-eay_check_rsasign(source, sig, rsa)
-	vchar_t *source;
-	vchar_t *sig;
-	RSA *rsa;
-{
-	return eay_rsa_verify(source, sig, rsa);
-}
-
-/*
- * get PKCS#1 Private Key of PEM format from local file.
- */
-vchar_t *
-eay_get_pkcs1privkey(path)
-	char *path;
-{
-	FILE *fp;
-	EVP_PKEY *evp = NULL;
-	vchar_t *pkey = NULL;
-	u_char *bp;
-	int pkeylen;
-	int error = -1;
-
-#ifdef ANDROID_CHANGES
-	if (pname) {
-		BIO *bio = BIO_from_android(path);
-		if (!bio) {
-			return NULL;
-		}
-		evp = PEM_read_bio_PrivateKey(bio, NULL, NULL, NULL);
-		BIO_free(bio);
-	} else {
-#endif
-	/* Read private key */
-	fp = fopen(path, "r");
-	if (fp == NULL)
-		return NULL;
-
-	evp = PEM_read_PrivateKey(fp, NULL, NULL, NULL);
-
-	fclose (fp);
-#ifdef ANDROID_CHANGES
-	}
-#endif
-
-	if (evp == NULL)
-		return NULL;
-
-	pkeylen = i2d_PrivateKey(evp, NULL);
-	if (pkeylen == 0)
-		goto end;
-	pkey = vmalloc(pkeylen);
-	if (pkey == NULL)
-		goto end;
-	bp = (unsigned char *) pkey->v;
-	pkeylen = i2d_PrivateKey(evp, &bp);
-	if (pkeylen == 0)
-		goto end;
-
-	error = 0;
-
-end:
-	if (evp != NULL)
-		EVP_PKEY_free(evp);
-	if (error != 0 && pkey != NULL) {
-		vfree(pkey);
-		pkey = NULL;
-	}
-
-	return pkey;
-}
-
-/*
- * get PKCS#1 Public Key of PEM format from local file.
- */
-vchar_t *
-eay_get_pkcs1pubkey(path)
-	char *path;
-{
-	FILE *fp;
-	EVP_PKEY *evp = NULL;
-	vchar_t *pkey = NULL;
-	X509 *x509 = NULL;
-	u_char *bp;
-	int pkeylen;
-	int error = -1;
-
-	/* Read private key */
-	fp = fopen(path, "r");
-	if (fp == NULL)
-		return NULL;
-
-	x509 = PEM_read_X509(fp, NULL, NULL, NULL);
-
-	fclose (fp);
-
-	if (x509 == NULL)
-		return NULL;
-  
-	/* Get public key - eay */
-	evp = X509_get_pubkey(x509);
-	if (evp == NULL)
-		return NULL;
-
-	pkeylen = i2d_PublicKey(evp, NULL);
-	if (pkeylen == 0)
-		goto end;
-	pkey = vmalloc(pkeylen);
-	if (pkey == NULL)
-		goto end;
-	bp = (unsigned char *) pkey->v;
-	pkeylen = i2d_PublicKey(evp, &bp);
-	if (pkeylen == 0)
-		goto end;
-
-	error = 0;
-end:
-	if (evp != NULL)
-		EVP_PKEY_free(evp);
-	if (error != 0 && pkey != NULL) {
-		vfree(pkey);
-		pkey = NULL;
-	}
-
-	return pkey;
-}
-
-vchar_t *
-eay_get_x509sign(src, privkey)
-	vchar_t *src, *privkey;
-{
-	EVP_PKEY *evp;
-	u_char *bp = (unsigned char *) privkey->v;
-	vchar_t *sig = NULL;
-	int len;
-	int pad = RSA_PKCS1_PADDING;
-
-	/* XXX to be handled EVP_PKEY_DSA */
-	evp = d2i_PrivateKey(EVP_PKEY_RSA, NULL, (void *)&bp, privkey->l);
-	if (evp == NULL)
-		return NULL;
-
-	sig = eay_rsa_sign(src, EVP_PKEY_get0_RSA(evp));
-
-	EVP_PKEY_free(evp);
-
-	return sig;
-}
-
-vchar_t *
-eay_get_rsasign(src, rsa)
-	vchar_t *src;
-	RSA *rsa;
-{
-	return eay_rsa_sign(src, rsa);
-}
-
-vchar_t *
-eay_rsa_sign(vchar_t *src, RSA *rsa)
-{
-	int len;
-	vchar_t *sig = NULL;
-	int pad = RSA_PKCS1_PADDING;
-
-	len = RSA_size(rsa);
-
-	sig = vmalloc(len);
-	if (sig == NULL)
-		return NULL;
-
-	len = RSA_private_encrypt(src->l, (unsigned char *) src->v, 
-			(unsigned char *) sig->v, rsa, pad);
-
-	if (len == 0 || len != sig->l) {
-		vfree(sig);
-		sig = NULL;
-	}
-
-	return sig;
-}
-
-int
-eay_rsa_verify(src, sig, rsa)
-	vchar_t *src, *sig;
-	RSA *rsa;
-{
-	vchar_t *xbuf = NULL;
-	int pad = RSA_PKCS1_PADDING;
-	int len = 0;
-	int error;
-
-	len = RSA_size(rsa);
-	xbuf = vmalloc(len);
-	if (xbuf == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "%s\n", eay_strerror());
-		return -1;
-	}
-
-	len = RSA_public_decrypt(sig->l, (unsigned char *) sig->v, 
-			(unsigned char *) xbuf->v, rsa, pad);
-	if (len == 0 || len != src->l) {
-		plog(LLV_ERROR, LOCATION, NULL, "%s\n", eay_strerror());
-		vfree(xbuf);
-		return -1;
-	}
-
-	error = memcmp(src->v, xbuf->v, src->l);
-	vfree(xbuf);
-	if (error != 0)
-		return -1;
-
-	return 0;
-}
-
-/*
- * get error string
- * MUST load ERR_load_crypto_strings() first.
- */
-char *
-eay_strerror()
-{
-	static char ebuf[512];
-	int len = 0, n;
-	unsigned long l;
-	char buf[200];
-	const char *file, *data;
-	int line, flags;
-	unsigned long es;
-
-#if defined(ANDROID_CHANGES)
-	es = 0;
-#else
-	es = CRYPTO_thread_id();
-#endif
-
-	while ((l = ERR_get_error_line_data(&file, &line, &data, &flags)) != 0){
-		n = snprintf(ebuf + len, sizeof(ebuf) - len,
-				"%lu:%s:%s:%d:%s ",
-				es, ERR_error_string(l, buf), file, line,
-				(flags & ERR_TXT_STRING) ? data : "");
-		if (n < 0 || n >= sizeof(ebuf) - len)
-			break;
-		len += n;
-		if (sizeof(ebuf) < len)
-			break;
-	}
-
-	return ebuf;
-}
-
-vchar_t *
-evp_crypt(vchar_t *data, vchar_t *key, vchar_t *iv, const EVP_CIPHER *e, int enc)
-{
-	vchar_t *res;
-	EVP_CIPHER_CTX ctx;
-
-	if (!e)
-		return NULL;
-
-	if (data->l % EVP_CIPHER_block_size(e))
-		return NULL;
-
-	if ((res = vmalloc(data->l)) == NULL)
-		return NULL;
-
-	EVP_CIPHER_CTX_init(&ctx);
-
-#if !defined(OPENSSL_IS_BORINGSSL)
-	switch(EVP_CIPHER_nid(e)){
-	case NID_bf_cbc:
-	case NID_bf_ecb:
-	case NID_bf_cfb64:
-	case NID_bf_ofb64:
-	case NID_cast5_cbc:
-	case NID_cast5_ecb:
-	case NID_cast5_cfb64:
-	case NID_cast5_ofb64:
-		/* XXX: can we do that also for algos with a fixed key size ?
-		 */
-		/* init context without key/iv
-         */
-        if (!EVP_CipherInit(&ctx, e, NULL, NULL, enc))
-        {
-            OpenSSL_BUG();
-            vfree(res);
-            return NULL;
-        }
-		
-        /* update key size
-         */
-        if (!EVP_CIPHER_CTX_set_key_length(&ctx, key->l))
-        {
-            OpenSSL_BUG();
-            vfree(res);
-            return NULL;
-        }
-
-        /* finalize context init with desired key size
-         */
-        if (!EVP_CipherInit(&ctx, NULL, (u_char *) key->v,
-							(u_char *) iv->v, enc))
-        {
-            OpenSSL_BUG();
-            vfree(res);
-            return NULL;
-		}
-		break;
-	default:
-#endif  /* OPENSSL_IS_BORINGSSL */
-		if (!EVP_CipherInit(&ctx, e, (u_char *) key->v, 
-							(u_char *) iv->v, enc)) {
-			OpenSSL_BUG();
-			vfree(res);
-			return NULL;
-		}
-#if !defined(OPENSSL_IS_BORINGSSL)
-	}
-#endif
-
-	/* disable openssl padding */
-	EVP_CIPHER_CTX_set_padding(&ctx, 0); 
-	
-	if (!EVP_Cipher(&ctx, (u_char *) res->v, (u_char *) data->v, data->l)) {
-		OpenSSL_BUG();
-		vfree(res);
-		return NULL;
-	}
-
-	EVP_CIPHER_CTX_cleanup(&ctx);
-
-	return res;
-}
-
-int
-evp_weakkey(vchar_t *key, const EVP_CIPHER *e)
-{
-	return 0;
-}
-
-int
-evp_keylen(int len, const EVP_CIPHER *e)
-{
-	if (!e)
-		return -1;
-	/* EVP functions return lengths in bytes, ipsec-tools
-	 * uses lengths in bits, therefore conversion is required. --AK
-	 */
-	if (len != 0 && len != (EVP_CIPHER_key_length(e) << 3))
-		return -1;
-	
-	return EVP_CIPHER_key_length(e) << 3;
-}
-
-/*
- * DES-CBC
- */
-vchar_t *
-eay_des_encrypt(data, key, iv)
-	vchar_t *data, *key, *iv;
-{
-	return evp_crypt(data, key, iv, EVP_des_cbc(), 1);
-}
-
-vchar_t *
-eay_des_decrypt(data, key, iv)
-	vchar_t *data, *key, *iv;
-{
-	return evp_crypt(data, key, iv, EVP_des_cbc(), 0);
-}
-
-#if defined(OPENSSL_IS_BORINGSSL)
-/* BoringSSL doesn't implement DES_is_weak_key because the concept is nonsense.
- * Thankfully, ipsec-tools never actually uses the result of this function. */
-static int
-DES_is_weak_key(const DES_cblock *key)
-{
-	return 0;
-}
-#endif  /* OPENSSL_IS_BORINGSSL */
-
-int
-eay_des_weakkey(key)
-	vchar_t *key;
-{
-#ifdef USE_NEW_DES_API
-	return DES_is_weak_key((void *)key->v);
-#else
-	return des_is_weak_key((void *)key->v);
-#endif
-}
-
-int
-eay_des_keylen(len)
-	int len;
-{
-	return evp_keylen(len, EVP_des_cbc());
-}
-
-#ifdef HAVE_OPENSSL_IDEA_H
-/*
- * IDEA-CBC
- */
-vchar_t *
-eay_idea_encrypt(data, key, iv)
-	vchar_t *data, *key, *iv;
-{
-	vchar_t *res;
-	IDEA_KEY_SCHEDULE ks;
-
-	idea_set_encrypt_key((unsigned char *)key->v, &ks);
-
-	/* allocate buffer for result */
-	if ((res = vmalloc(data->l)) == NULL)
-		return NULL;
-
-	/* decryption data */
-	idea_cbc_encrypt((unsigned char *)data->v, (unsigned char *)res->v, data->l,
-			&ks, (unsigned char *)iv->v, IDEA_ENCRYPT);
-
-	return res;
-}
-
-vchar_t *
-eay_idea_decrypt(data, key, iv)
-	vchar_t *data, *key, *iv;
-{
-	vchar_t *res;
-	IDEA_KEY_SCHEDULE ks, dks;
-
-	idea_set_encrypt_key((unsigned char *)key->v, &ks);
-	idea_set_decrypt_key(&ks, &dks);
-
-	/* allocate buffer for result */
-	if ((res = vmalloc(data->l)) == NULL)
-		return NULL;
-
-	/* decryption data */
-	idea_cbc_encrypt((unsigned char *)data->v, (unsigned char *)res->v, data->l,
-			&dks, (unsigned char *)iv->v, IDEA_DECRYPT);
-
-	return res;
-}
-
-int
-eay_idea_weakkey(key)
-	vchar_t *key;
-{
-	return 0;       /* XXX */
-}
-
-int
-eay_idea_keylen(len)
-	int len;
-{
-	if (len != 0 && len != 128)
-		return -1;
-	return 128;
-}
-#endif
-
-/*
- * BLOWFISH-CBC
- */
-vchar_t *
-eay_bf_encrypt(data, key, iv)
-	vchar_t *data, *key, *iv;
-{
-	return evp_crypt(data, key, iv, EVP_bf_cbc(), 1);
-}
-
-vchar_t *
-eay_bf_decrypt(data, key, iv)
-	vchar_t *data, *key, *iv;
-{
-	return evp_crypt(data, key, iv, EVP_bf_cbc(), 0);
-}
-
-int
-eay_bf_weakkey(key)
-	vchar_t *key;
-{
-	return 0;	/* XXX to be done. refer to RFC 2451 */
-}
-
-int
-eay_bf_keylen(len)
-	int len;
-{
-	if (len == 0)
-		return 448;
-	if (len < 40 || len > 448)
-		return -1;
-	return len;
-}
-
-#ifdef HAVE_OPENSSL_RC5_H
-/*
- * RC5-CBC
- */
-vchar_t *
-eay_rc5_encrypt(data, key, iv)
-	vchar_t *data, *key, *iv;
-{
-	vchar_t *res;
-	RC5_32_KEY ks;
-
-	/* in RFC 2451, there is information about the number of round. */
-	RC5_32_set_key(&ks, key->l, (unsigned char *)key->v, 16);
-
-	/* allocate buffer for result */
-	if ((res = vmalloc(data->l)) == NULL)
-		return NULL;
-
-	/* decryption data */
-	RC5_32_cbc_encrypt((unsigned char *)data->v, (unsigned char *)res->v, data->l,
-		&ks, (unsigned char *)iv->v, RC5_ENCRYPT);
-
-	return res;
-}
-
-vchar_t *
-eay_rc5_decrypt(data, key, iv)
-	vchar_t *data, *key, *iv;
-{
-	vchar_t *res;
-	RC5_32_KEY ks;
-
-	/* in RFC 2451, there is information about the number of round. */
-	RC5_32_set_key(&ks, key->l, (unsigned char *)key->v, 16);
-
-	/* allocate buffer for result */
-	if ((res = vmalloc(data->l)) == NULL)
-		return NULL;
-
-	/* decryption data */
-	RC5_32_cbc_encrypt((unsigned char *)data->v, (unsigned char *)res->v, data->l,
-		&ks, (unsigned char *)iv->v, RC5_DECRYPT);
-
-	return res;
-}
-
-int
-eay_rc5_weakkey(key)
-	vchar_t *key;
-{
-	return 0;       /* No known weak keys when used with 16 rounds. */
-
-}
-
-int
-eay_rc5_keylen(len)
-	int len;
-{
-	if (len == 0)
-		return 128;
-	if (len < 40 || len > 2040)
-		return -1;
-	return len;
-}
-#endif
-
-/*
- * 3DES-CBC
- */
-vchar_t *
-eay_3des_encrypt(data, key, iv)
-	vchar_t *data, *key, *iv;
-{
-	return evp_crypt(data, key, iv, EVP_des_ede3_cbc(), 1);
-}
-
-vchar_t *
-eay_3des_decrypt(data, key, iv)
-	vchar_t *data, *key, *iv;
-{
-	return evp_crypt(data, key, iv, EVP_des_ede3_cbc(), 0);
-}
-
-int
-eay_3des_weakkey(key)
-	vchar_t *key;
-{
-#ifdef USE_NEW_DES_API
-	return (DES_is_weak_key((void *)key->v) ||
-	    DES_is_weak_key((void *)(key->v + 8)) ||
-	    DES_is_weak_key((void *)(key->v + 16)));
-#else
-	if (key->l < 24)
-		return 0;
-
-	return (des_is_weak_key((void *)key->v) ||
-	    des_is_weak_key((void *)(key->v + 8)) ||
-	    des_is_weak_key((void *)(key->v + 16)));
-#endif
-}
-
-int
-eay_3des_keylen(len)
-	int len;
-{
-	if (len != 0 && len != 192)
-		return -1;
-	return 192;
-}
-
-/*
- * CAST-CBC
- */
-vchar_t *
-eay_cast_encrypt(data, key, iv)
-	vchar_t *data, *key, *iv;
-{
-	return evp_crypt(data, key, iv, EVP_cast5_cbc(), 1);
-}
-
-vchar_t *
-eay_cast_decrypt(data, key, iv)
-	vchar_t *data, *key, *iv;
-{
-	return evp_crypt(data, key, iv, EVP_cast5_cbc(), 0);
-}
-
-int
-eay_cast_weakkey(key)
-	vchar_t *key;
-{
-	return 0;	/* No known weak keys. */
-}
-
-int
-eay_cast_keylen(len)
-	int len;
-{
-	if (len == 0)
-		return 128;
-	if (len < 40 || len > 128)
-		return -1;
-	return len;
-}
-
-/*
- * AES(RIJNDAEL)-CBC
- */
-#ifndef HAVE_OPENSSL_AES_H
-vchar_t *
-eay_aes_encrypt(data, key, iv)
-	vchar_t *data, *key, *iv;
-{
-	vchar_t *res;
-	keyInstance k;
-	cipherInstance c;
-
-	memset(&k, 0, sizeof(k));
-	if (rijndael_makeKey(&k, DIR_ENCRYPT, key->l << 3, key->v) < 0)
-		return NULL;
-
-	/* allocate buffer for result */
-	if ((res = vmalloc(data->l)) == NULL)
-		return NULL;
-
-	/* encryption data */
-	memset(&c, 0, sizeof(c));
-	if (rijndael_cipherInit(&c, MODE_CBC, iv->v) < 0){
-		vfree(res);
-		return NULL;
-	}
-	if (rijndael_blockEncrypt(&c, &k, data->v, data->l << 3, res->v) < 0){
-		vfree(res);
-		return NULL;
-	}
-
-	return res;
-}
-
-vchar_t *
-eay_aes_decrypt(data, key, iv)
-	vchar_t *data, *key, *iv;
-{
-	vchar_t *res;
-	keyInstance k;
-	cipherInstance c;
-
-	memset(&k, 0, sizeof(k));
-	if (rijndael_makeKey(&k, DIR_DECRYPT, key->l << 3, key->v) < 0)
-		return NULL;
-
-	/* allocate buffer for result */
-	if ((res = vmalloc(data->l)) == NULL)
-		return NULL;
-
-	/* decryption data */
-	memset(&c, 0, sizeof(c));
-	if (rijndael_cipherInit(&c, MODE_CBC, iv->v) < 0){
-		vfree(res);
-		return NULL;
-	}
-	if (rijndael_blockDecrypt(&c, &k, data->v, data->l << 3, res->v) < 0){
-		vfree(res);
-		return NULL;
-	}
-
-	return res;
-}
-#else
-static inline const EVP_CIPHER *
-aes_evp_by_keylen(int keylen)
-{
-	switch(keylen) {
-		case 16:
-		case 128:
-			return EVP_aes_128_cbc();
-#if !defined(ANDROID_CHANGES)
-		case 24:
-		case 192:
-			return EVP_aes_192_cbc();
-#endif
-		case 32:
-		case 256:
-			return EVP_aes_256_cbc();
-		default:
-			return NULL;
-	}
-}
-
-vchar_t *
-eay_aes_encrypt(data, key, iv)
-       vchar_t *data, *key, *iv;
-{
-	return evp_crypt(data, key, iv, aes_evp_by_keylen(key->l), 1);
-}
-
-vchar_t *
-eay_aes_decrypt(data, key, iv)
-       vchar_t *data, *key, *iv;
-{
-	return evp_crypt(data, key, iv, aes_evp_by_keylen(key->l), 0);
-}
-#endif
-
-int
-eay_aes_weakkey(key)
-	vchar_t *key;
-{
-	return 0;
-}
-
-int
-eay_aes_keylen(len)
-	int len;
-{
-	if (len == 0)
-		return 128;
-	if (len != 128 && len != 192 && len != 256)
-		return -1;
-	return len;
-}
-
-#if defined(HAVE_OPENSSL_CAMELLIA_H)
-/*
- * CAMELLIA-CBC
- */
-static inline const EVP_CIPHER *
-camellia_evp_by_keylen(int keylen)
-{
-	switch(keylen) {
-		case 16:
-		case 128:
-			return EVP_camellia_128_cbc();
-		case 24:
-		case 192:
-			return EVP_camellia_192_cbc();
-		case 32:
-		case 256:
-			return EVP_camellia_256_cbc();
-		default:
-			return NULL;
-	}
-}
-
-vchar_t *
-eay_camellia_encrypt(data, key, iv)
-       vchar_t *data, *key, *iv;
-{
-	return evp_crypt(data, key, iv, camellia_evp_by_keylen(key->l), 1);
-}
-
-vchar_t *
-eay_camellia_decrypt(data, key, iv)
-       vchar_t *data, *key, *iv;
-{
-	return evp_crypt(data, key, iv, camellia_evp_by_keylen(key->l), 0);
-}
-
-int
-eay_camellia_weakkey(key)
-	vchar_t *key;
-{
-	return 0;
-}
-
-int
-eay_camellia_keylen(len)
-	int len;
-{
-	if (len == 0)
-		return 128;
-	if (len != 128 && len != 192 && len != 256)
-		return -1;
-	return len;
-}
-
-#endif
-
-/* for ipsec part */
-int
-eay_null_hashlen()
-{
-	return 0;
-}
-
-int
-eay_kpdk_hashlen()
-{
-	return 0;
-}
-
-int
-eay_twofish_keylen(len)
-	int len;
-{
-	if (len < 0 || len > 256)
-		return -1;
-	return len;
-}
-
-int
-eay_null_keylen(len)
-	int len;
-{
-	return 0;
-}
-
-/*
- * HMAC functions
- */
-static caddr_t
-eay_hmac_init(key, md)
-	vchar_t *key;
-	const EVP_MD *md;
-{
-	HMAC_CTX *c = racoon_malloc(sizeof(*c));
-
-	HMAC_Init(c, key->v, key->l, md);
-
-	return (caddr_t)c;
-}
-
-#ifdef WITH_SHA2
-/*
- * HMAC SHA2-512
- */
-vchar_t *
-eay_hmacsha2_512_one(key, data)
-	vchar_t *key, *data;
-{
-	vchar_t *res;
-	caddr_t ctx;
-
-	ctx = eay_hmacsha2_512_init(key);
-	eay_hmacsha2_512_update(ctx, data);
-	res = eay_hmacsha2_512_final(ctx);
-
-	return(res);
-}
-
-caddr_t
-eay_hmacsha2_512_init(key)
-	vchar_t *key;
-{
-	return eay_hmac_init(key, EVP_sha2_512());
-}
-
-void
-eay_hmacsha2_512_update(c, data)
-	caddr_t c;
-	vchar_t *data;
-{
-	HMAC_Update((HMAC_CTX *)c, (unsigned char *) data->v, data->l);
-}
-
-vchar_t *
-eay_hmacsha2_512_final(c)
-	caddr_t c;
-{
-	vchar_t *res;
-	unsigned int l;
-
-	if ((res = vmalloc(SHA512_DIGEST_LENGTH)) == 0)
-		return NULL;
-
-	HMAC_Final((HMAC_CTX *)c, (unsigned char *) res->v, &l);
-	res->l = l;
-	HMAC_cleanup((HMAC_CTX *)c);
-	(void)racoon_free(c);
-
-	if (SHA512_DIGEST_LENGTH != res->l) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"hmac sha2_512 length mismatch %zd.\n", res->l);
-		vfree(res);
-		return NULL;
-	}
-
-	return(res);
-}
-
-/*
- * HMAC SHA2-384
- */
-vchar_t *
-eay_hmacsha2_384_one(key, data)
-	vchar_t *key, *data;
-{
-	vchar_t *res;
-	caddr_t ctx;
-
-	ctx = eay_hmacsha2_384_init(key);
-	eay_hmacsha2_384_update(ctx, data);
-	res = eay_hmacsha2_384_final(ctx);
-
-	return(res);
-}
-
-caddr_t
-eay_hmacsha2_384_init(key)
-	vchar_t *key;
-{
-	return eay_hmac_init(key, EVP_sha2_384());
-}
-
-void
-eay_hmacsha2_384_update(c, data)
-	caddr_t c;
-	vchar_t *data;
-{
-	HMAC_Update((HMAC_CTX *)c, (unsigned char *) data->v, data->l);
-}
-
-vchar_t *
-eay_hmacsha2_384_final(c)
-	caddr_t c;
-{
-	vchar_t *res;
-	unsigned int l;
-
-	if ((res = vmalloc(SHA384_DIGEST_LENGTH)) == 0)
-		return NULL;
-
-	HMAC_Final((HMAC_CTX *)c, (unsigned char *) res->v, &l);
-	res->l = l;
-	HMAC_cleanup((HMAC_CTX *)c);
-	(void)racoon_free(c);
-
-	if (SHA384_DIGEST_LENGTH != res->l) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"hmac sha2_384 length mismatch %zd.\n", res->l);
-		vfree(res);
-		return NULL;
-	}
-
-	return(res);
-}
-
-/*
- * HMAC SHA2-256
- */
-vchar_t *
-eay_hmacsha2_256_one(key, data)
-	vchar_t *key, *data;
-{
-	vchar_t *res;
-	caddr_t ctx;
-
-	ctx = eay_hmacsha2_256_init(key);
-	eay_hmacsha2_256_update(ctx, data);
-	res = eay_hmacsha2_256_final(ctx);
-
-	return(res);
-}
-
-caddr_t
-eay_hmacsha2_256_init(key)
-	vchar_t *key;
-{
-	return eay_hmac_init(key, EVP_sha2_256());
-}
-
-void
-eay_hmacsha2_256_update(c, data)
-	caddr_t c;
-	vchar_t *data;
-{
-	HMAC_Update((HMAC_CTX *)c, (unsigned char *) data->v, data->l);
-}
-
-vchar_t *
-eay_hmacsha2_256_final(c)
-	caddr_t c;
-{
-	vchar_t *res;
-	unsigned int l;
-
-	if ((res = vmalloc(SHA256_DIGEST_LENGTH)) == 0)
-		return NULL;
-
-	HMAC_Final((HMAC_CTX *)c, (unsigned char *) res->v, &l);
-	res->l = l;
-	HMAC_cleanup((HMAC_CTX *)c);
-	(void)racoon_free(c);
-
-	if (SHA256_DIGEST_LENGTH != res->l) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"hmac sha2_256 length mismatch %zd.\n", res->l);
-		vfree(res);
-		return NULL;
-	}
-
-	return(res);
-}
-#endif	/* WITH_SHA2 */
-
-/*
- * HMAC SHA1
- */
-vchar_t *
-eay_hmacsha1_one(key, data)
-	vchar_t *key, *data;
-{
-	vchar_t *res;
-	caddr_t ctx;
-
-	ctx = eay_hmacsha1_init(key);
-	eay_hmacsha1_update(ctx, data);
-	res = eay_hmacsha1_final(ctx);
-
-	return(res);
-}
-
-caddr_t
-eay_hmacsha1_init(key)
-	vchar_t *key;
-{
-	return eay_hmac_init(key, EVP_sha1());
-}
-
-void
-eay_hmacsha1_update(c, data)
-	caddr_t c;
-	vchar_t *data;
-{
-	HMAC_Update((HMAC_CTX *)c, (unsigned char *) data->v, data->l);
-}
-
-vchar_t *
-eay_hmacsha1_final(c)
-	caddr_t c;
-{
-	vchar_t *res;
-	unsigned int l;
-
-	if ((res = vmalloc(SHA_DIGEST_LENGTH)) == 0)
-		return NULL;
-
-	HMAC_Final((HMAC_CTX *)c, (unsigned char *) res->v, &l);
-	res->l = l;
-	HMAC_cleanup((HMAC_CTX *)c);
-	(void)racoon_free(c);
-
-	if (SHA_DIGEST_LENGTH != res->l) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"hmac sha1 length mismatch %zd.\n", res->l);
-		vfree(res);
-		return NULL;
-	}
-
-	return(res);
-}
-
-/*
- * HMAC MD5
- */
-vchar_t *
-eay_hmacmd5_one(key, data)
-	vchar_t *key, *data;
-{
-	vchar_t *res;
-	caddr_t ctx;
-
-	ctx = eay_hmacmd5_init(key);
-	eay_hmacmd5_update(ctx, data);
-	res = eay_hmacmd5_final(ctx);
-
-	return(res);
-}
-
-caddr_t
-eay_hmacmd5_init(key)
-	vchar_t *key;
-{
-	return eay_hmac_init(key, EVP_md5());
-}
-
-void
-eay_hmacmd5_update(c, data)
-	caddr_t c;
-	vchar_t *data;
-{
-	HMAC_Update((HMAC_CTX *)c, (unsigned char *) data->v, data->l);
-}
-
-vchar_t *
-eay_hmacmd5_final(c)
-	caddr_t c;
-{
-	vchar_t *res;
-	unsigned int l;
-
-	if ((res = vmalloc(MD5_DIGEST_LENGTH)) == 0)
-		return NULL;
-
-	HMAC_Final((HMAC_CTX *)c, (unsigned char *) res->v, &l);
-	res->l = l;
-	HMAC_cleanup((HMAC_CTX *)c);
-	(void)racoon_free(c);
-
-	if (MD5_DIGEST_LENGTH != res->l) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"hmac md5 length mismatch %zd.\n", res->l);
-		vfree(res);
-		return NULL;
-	}
-
-	return(res);
-}
-
-#ifdef WITH_SHA2
-/*
- * SHA2-512 functions
- */
-caddr_t
-eay_sha2_512_init()
-{
-	SHA512_CTX *c = racoon_malloc(sizeof(*c));
-
-	SHA512_Init(c);
-
-	return((caddr_t)c);
-}
-
-void
-eay_sha2_512_update(c, data)
-	caddr_t c;
-	vchar_t *data;
-{
-	SHA512_Update((SHA512_CTX *)c, (unsigned char *) data->v, data->l);
-
-	return;
-}
-
-vchar_t *
-eay_sha2_512_final(c)
-	caddr_t c;
-{
-	vchar_t *res;
-
-	if ((res = vmalloc(SHA512_DIGEST_LENGTH)) == 0)
-		return(0);
-
-	SHA512_Final((unsigned char *) res->v, (SHA512_CTX *)c);
-	(void)racoon_free(c);
-
-	return(res);
-}
-
-vchar_t *
-eay_sha2_512_one(data)
-	vchar_t *data;
-{
-	caddr_t ctx;
-	vchar_t *res;
-
-	ctx = eay_sha2_512_init();
-	eay_sha2_512_update(ctx, data);
-	res = eay_sha2_512_final(ctx);
-
-	return(res);
-}
-
-int
-eay_sha2_512_hashlen()
-{
-	return SHA512_DIGEST_LENGTH << 3;
-}
-#endif
-
-#ifdef WITH_SHA2
-/*
- * SHA2-384 functions
- */
-caddr_t
-eay_sha2_384_init()
-{
-	SHA384_CTX *c = racoon_malloc(sizeof(*c));
-
-	SHA384_Init(c);
-
-	return((caddr_t)c);
-}
-
-void
-eay_sha2_384_update(c, data)
-	caddr_t c;
-	vchar_t *data;
-{
-	SHA384_Update((SHA384_CTX *)c, (unsigned char *) data->v, data->l);
-
-	return;
-}
-
-vchar_t *
-eay_sha2_384_final(c)
-	caddr_t c;
-{
-	vchar_t *res;
-
-	if ((res = vmalloc(SHA384_DIGEST_LENGTH)) == 0)
-		return(0);
-
-	SHA384_Final((unsigned char *) res->v, (SHA384_CTX *)c);
-	(void)racoon_free(c);
-
-	return(res);
-}
-
-vchar_t *
-eay_sha2_384_one(data)
-	vchar_t *data;
-{
-	caddr_t ctx;
-	vchar_t *res;
-
-	ctx = eay_sha2_384_init();
-	eay_sha2_384_update(ctx, data);
-	res = eay_sha2_384_final(ctx);
-
-	return(res);
-}
-
-int
-eay_sha2_384_hashlen()
-{
-	return SHA384_DIGEST_LENGTH << 3;
-}
-#endif
-
-#ifdef WITH_SHA2
-/*
- * SHA2-256 functions
- */
-caddr_t
-eay_sha2_256_init()
-{
-	SHA256_CTX *c = racoon_malloc(sizeof(*c));
-
-	SHA256_Init(c);
-
-	return((caddr_t)c);
-}
-
-void
-eay_sha2_256_update(c, data)
-	caddr_t c;
-	vchar_t *data;
-{
-	SHA256_Update((SHA256_CTX *)c, (unsigned char *) data->v, data->l);
-
-	return;
-}
-
-vchar_t *
-eay_sha2_256_final(c)
-	caddr_t c;
-{
-	vchar_t *res;
-
-	if ((res = vmalloc(SHA256_DIGEST_LENGTH)) == 0)
-		return(0);
-
-	SHA256_Final((unsigned char *) res->v, (SHA256_CTX *)c);
-	(void)racoon_free(c);
-
-	return(res);
-}
-
-vchar_t *
-eay_sha2_256_one(data)
-	vchar_t *data;
-{
-	caddr_t ctx;
-	vchar_t *res;
-
-	ctx = eay_sha2_256_init();
-	eay_sha2_256_update(ctx, data);
-	res = eay_sha2_256_final(ctx);
-
-	return(res);
-}
-
-int
-eay_sha2_256_hashlen()
-{
-	return SHA256_DIGEST_LENGTH << 3;
-}
-#endif
-
-/*
- * SHA functions
- */
-caddr_t
-eay_sha1_init()
-{
-	SHA_CTX *c = racoon_malloc(sizeof(*c));
-
-	SHA1_Init(c);
-
-	return((caddr_t)c);
-}
-
-void
-eay_sha1_update(c, data)
-	caddr_t c;
-	vchar_t *data;
-{
-	SHA1_Update((SHA_CTX *)c, data->v, data->l);
-
-	return;
-}
-
-vchar_t *
-eay_sha1_final(c)
-	caddr_t c;
-{
-	vchar_t *res;
-
-	if ((res = vmalloc(SHA_DIGEST_LENGTH)) == 0)
-		return(0);
-
-	SHA1_Final((unsigned char *) res->v, (SHA_CTX *)c);
-	(void)racoon_free(c);
-
-	return(res);
-}
-
-vchar_t *
-eay_sha1_one(data)
-	vchar_t *data;
-{
-	caddr_t ctx;
-	vchar_t *res;
-
-	ctx = eay_sha1_init();
-	eay_sha1_update(ctx, data);
-	res = eay_sha1_final(ctx);
-
-	return(res);
-}
-
-int
-eay_sha1_hashlen()
-{
-	return SHA_DIGEST_LENGTH << 3;
-}
-
-/*
- * MD5 functions
- */
-caddr_t
-eay_md5_init()
-{
-	MD5_CTX *c = racoon_malloc(sizeof(*c));
-
-	MD5_Init(c);
-
-	return((caddr_t)c);
-}
-
-void
-eay_md5_update(c, data)
-	caddr_t c;
-	vchar_t *data;
-{
-	MD5_Update((MD5_CTX *)c, data->v, data->l);
-
-	return;
-}
-
-vchar_t *
-eay_md5_final(c)
-	caddr_t c;
-{
-	vchar_t *res;
-
-	if ((res = vmalloc(MD5_DIGEST_LENGTH)) == 0)
-		return(0);
-
-	MD5_Final((unsigned char *) res->v, (MD5_CTX *)c);
-	(void)racoon_free(c);
-
-	return(res);
-}
-
-vchar_t *
-eay_md5_one(data)
-	vchar_t *data;
-{
-	caddr_t ctx;
-	vchar_t *res;
-
-	ctx = eay_md5_init();
-	eay_md5_update(ctx, data);
-	res = eay_md5_final(ctx);
-
-	return(res);
-}
-
-int
-eay_md5_hashlen()
-{
-	return MD5_DIGEST_LENGTH << 3;
-}
-
-/*
- * eay_set_random
- *   size: number of bytes.
- */
-vchar_t *
-eay_set_random(size)
-	u_int32_t size;
-{
-	BIGNUM *r = NULL;
-	vchar_t *res = 0;
-
-	if ((r = BN_new()) == NULL)
-		goto end;
-	BN_rand(r, size * 8, 0, 0);
-	eay_bn2v(&res, r);
-
-end:
-	if (r)
-		BN_free(r);
-	return(res);
-}
-
-/* DH */
-int
-eay_dh_generate(prime, g, publen, pub, priv)
-	vchar_t *prime, **pub, **priv;
-	u_int publen;
-	u_int32_t g;
-{
-	BIGNUM *p = NULL, *g_bn = NULL;
-	DH *dh = NULL;
-	int error = -1;
-
-	/* initialize */
-	/* pre-process to generate number */
-	if (eay_v2bn(&p, prime) < 0)
-		goto end;
-
-	if ((dh = DH_new()) == NULL)
-		goto end;
-	if ((g_bn = BN_new()) == NULL)
-		goto end;
-	if (!BN_set_word(g_bn, g))
-		goto end;
-	if (!DH_set0_pqg(dh, p, NULL, g_bn))
-		goto end;
-	/* DH_set0_pqg takes ownership on success. */
-	p = NULL;
-	g_bn = NULL;
-
-	if (publen != 0) {
-		DH_set_length(dh, publen);
-	}
-
-	/* generate public and private number */
-	if (!DH_generate_key(dh))
-		goto end;
-
-	/* copy results to buffers */
-	if (eay_bn2v(pub, DH_get0_pub_key(dh)) < 0)
-		goto end;
-	if (eay_bn2v(priv, DH_get0_priv_key(dh)) < 0) {
-		vfree(*pub);
-		goto end;
-	}
-
-	error = 0;
-
-end:
-	if (dh != NULL)
-		DH_free(dh);
-	if (p != NULL)
-		BN_free(p);
-	if (g_bn != NULL)
-		BN_free(g_bn);
-	return(error);
-}
-
-int
-eay_dh_compute(prime, g, pub, priv, pub2, key)
-	vchar_t *prime, *pub, *priv, *pub2, **key;
-	u_int32_t g;
-{
-	BIGNUM *dh_pub = NULL;
-	BIGNUM *dh_pub2 = NULL;
-	BIGNUM *dh_priv = NULL;
-	BIGNUM *dh_p = NULL;
-	BIGNUM *dh_g = NULL;
-	DH *dh = NULL;
-	int l;
-	unsigned char *v = NULL;
-	int error = -1;
-
-	/* make public number to compute */
-	if (eay_v2bn(&dh_pub2, pub2) < 0)
-		goto end;
-
-	/* make DH structure */
-	if ((dh = DH_new()) == NULL)
-		goto end;
-	if (eay_v2bn(&dh_p, prime) < 0)
-		goto end;
-	if (eay_v2bn(&dh_pub, pub) < 0)
-		goto end;
-	if (eay_v2bn(&dh_priv, priv) < 0)
-		goto end;
-	DH_set_length(dh, pub2->l * 8);
-
-	if ((dh_g = BN_new()) == NULL)
-		goto end;
-	if (!BN_set_word(dh_g, g))
-		goto end;
-	if (!DH_set0_pqg(dh, dh_p, NULL, dh_g))
-		goto end;
-	/* DH_set0_pqg takes ownership on success. */
-	dh_p = NULL;
-	dh_g = NULL;
-	if (!DH_set0_key(dh, dh_pub, dh_priv))
-		goto end;
-	/* DH_set0_key takes ownership on success. */
-	dh_pub = NULL;
-	dh_priv = NULL;
-
-	if ((v = racoon_calloc(prime->l, sizeof(u_char))) == NULL)
-		goto end;
-	if ((l = DH_compute_key(v, dh_pub2, dh)) == -1)
-		goto end;
-	memcpy((*key)->v + (prime->l - l), v, l);
-
-	error = 0;
-
-end:
-	if (dh_pub != NULL)
-		BN_free(dh_pub);
-	if (dh_pub2 != NULL)
-		BN_free(dh_pub2);
-	if (dh_priv != NULL)
-		BN_free(dh_priv);
-	if (dh_p != NULL)
-		BN_free(dh_p);
-	if (dh_g != NULL)
-		BN_free(dh_g);
-	if (dh != NULL)
-		DH_free(dh);
-	if (v != NULL)
-		racoon_free(v);
-	return(error);
-}
-
-/*
- * convert vchar_t <-> BIGNUM.
- *
- * vchar_t: unit is u_char, network endian, most significant byte first.
- * BIGNUM: unit is BN_ULONG, each of BN_ULONG is in host endian,
- *	least significant BN_ULONG must come first.
- *
- * hex value of "0x3ffe050104" is represented as follows:
- *	vchar_t: 3f fe 05 01 04
- *	BIGNUM (BN_ULONG = u_int8_t): 04 01 05 fe 3f
- *	BIGNUM (BN_ULONG = u_int16_t): 0x0104 0xfe05 0x003f
- *	BIGNUM (BN_ULONG = u_int32_t_t): 0xfe050104 0x0000003f
- */
-int
-eay_v2bn(bn, var)
-	BIGNUM **bn;
-	vchar_t *var;
-{
-	if ((*bn = BN_bin2bn((unsigned char *) var->v, var->l, NULL)) == NULL)
-		return -1;
-
-	return 0;
-}
-
-int
-eay_bn2v(var, bn)
-	vchar_t **var;
-	const BIGNUM *bn;
-{
-#if defined(ANDROID_CHANGES)
-	*var = vmalloc(BN_num_bytes(bn));
-#else
-	*var = vmalloc(bn->top * BN_BYTES);
-#endif
-	if (*var == NULL)
-		return(-1);
-
-	(*var)->l = BN_bn2bin(bn, (unsigned char *) (*var)->v);
-
-	return 0;
-}
-
-void
-eay_init()
-{
-	OpenSSL_add_all_algorithms();
-	ERR_load_crypto_strings();
-#ifdef HAVE_OPENSSL_ENGINE_H
-	ENGINE_load_builtin_engines();
-	ENGINE_register_all_complete();
-#endif
-}
-
-vchar_t *
-base64_decode(char *in, long inlen)
-{
-#if defined(OPENSSL_IS_BORINGSSL)
-	vchar_t *res;
-	size_t decoded_size;
-
-	if (!EVP_DecodedLength(&decoded_size, inlen)) {
-		return NULL;
-	}
-	res = vmalloc(decoded_size);
-	if (res == NULL) {
-		return NULL;
-	}
-	if (!EVP_DecodeBase64((uint8_t*) res->v, &res->l, decoded_size, (uint8_t*) in, inlen)) {
-		vfree(res);
-		return NULL;
-	}
-	return res;
-#else
-	BIO *bio=NULL, *b64=NULL;
-	vchar_t *res = NULL;
-	char *outb;
-	long outlen;
-
-	outb = malloc(inlen * 2);
-	if (outb == NULL)
-		goto out;
-	bio = BIO_new_mem_buf(in, inlen);
-	b64 = BIO_new(BIO_f_base64());
-	BIO_set_flags(b64, BIO_FLAGS_BASE64_NO_NL);
-	bio = BIO_push(b64, bio);
-
-	outlen = BIO_read(bio, outb, inlen * 2);
-	if (outlen <= 0) {
-		plog(LLV_ERROR, LOCATION, NULL, "%s\n", eay_strerror());
-		goto out;
-	}
-
-	res = vmalloc(outlen);
-	if (!res)
-		goto out;
-
-	memcpy(res->v, outb, outlen);
-
-out:
-	if (outb)
-		free(outb);
-	if (bio)
-		BIO_free_all(bio);
-
-	return res;
-#endif
-}
-
-vchar_t *
-base64_encode(char *in, long inlen)
-{
-#if defined(OPENSSL_IS_BORINGSSL)
-	vchar_t *res;
-	size_t encoded_size;
-
-	if (!EVP_EncodedLength(&encoded_size, inlen)) {
-		return NULL;
-	}
-	res = vmalloc(encoded_size+1);
-	if (res == NULL) {
-		return NULL;
-	}
-	EVP_EncodeBlock((uint8_t*) res->v, (uint8_t*) in, inlen);
-	res->v[encoded_size] = 0;
-	return res;
-#else
-	BIO *bio=NULL, *b64=NULL;
-	char *ptr;
-	long plen = -1;
-	vchar_t *res = NULL;
-
-	bio = BIO_new(BIO_s_mem());
-	b64 = BIO_new(BIO_f_base64());
-	BIO_set_flags(b64, BIO_FLAGS_BASE64_NO_NL);
-	bio = BIO_push(b64, bio);
-
-	BIO_write(bio, in, inlen);
-	BIO_flush(bio);
-
-	plen = BIO_get_mem_data(bio, &ptr);
-	res = vmalloc(plen+1);
-	if (!res)
-		goto out;
-	
-	memcpy (res->v, ptr, plen);
-	res->v[plen] = '\0';
-
-out:	
-	if (bio)
-		BIO_free_all(bio);
-
-	return res;
-#endif
-}
-
-static RSA *
-binbuf_pubkey2rsa(vchar_t *binbuf)
-{
-	BIGNUM *exp, *mod;
-	RSA *rsa_pub = NULL;
-
-	if (binbuf->v[0] > binbuf->l - 1) {
-		plog(LLV_ERROR, LOCATION, NULL, "Plain RSA pubkey format error: decoded string doesn't make sense.\n");
-		goto out;
-	}
-
-	exp = BN_bin2bn((unsigned char *) (binbuf->v + 1), binbuf->v[0], NULL);
-	mod = BN_bin2bn((unsigned char *) (binbuf->v + binbuf->v[0] + 1), 
-			binbuf->l - binbuf->v[0] - 1, NULL);
-	rsa_pub = RSA_new();
-
-	if (!exp || !mod || !rsa_pub || !RSA_set0_key(rsa_pub, mod, exp, NULL)) {
-		plog(LLV_ERROR, LOCATION, NULL, "Plain RSA pubkey parsing error: %s\n", eay_strerror());
-		if (exp)
-			BN_free(exp);
-		if (mod)
-			BN_free(exp);
-		if (rsa_pub)
-			RSA_free(rsa_pub);
-		rsa_pub = NULL;
-		goto out;
-	}
-	/* RSA_set0_key takes ownership of mod and exp on success. */
-	
-out:
-	return rsa_pub;
-}
-
-RSA *
-base64_pubkey2rsa(char *in)
-{
-	BIGNUM *exp, *mod;
-	RSA *rsa_pub = NULL;
-	vchar_t *binbuf;
-
-	if (strncmp(in, "0s", 2) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL, "Plain RSA pubkey format error: doesn't start with '0s'\n");
-		return NULL;
-	}
-
-	binbuf = base64_decode(in + 2, strlen(in + 2));
-	if (!binbuf) {
-		plog(LLV_ERROR, LOCATION, NULL, "Plain RSA pubkey format error: Base64 decoding failed.\n");
-		return NULL;
-	}
-	
-	if (binbuf->v[0] > binbuf->l - 1) {
-		plog(LLV_ERROR, LOCATION, NULL, "Plain RSA pubkey format error: decoded string doesn't make sense.\n");
-		goto out;
-	}
-
-	rsa_pub = binbuf_pubkey2rsa(binbuf);
-
-out:
-	if (binbuf)
-		vfree(binbuf);
-
-	return rsa_pub;
-}
-
-RSA *
-bignum_pubkey2rsa(BIGNUM *in)
-{
-	RSA *rsa_pub = NULL;
-	vchar_t *binbuf;
-
-	binbuf = vmalloc(BN_num_bytes(in));
-	if (!binbuf) {
-		plog(LLV_ERROR, LOCATION, NULL, "Plain RSA pubkey conversion: memory allocation failed..\n");
-		return NULL;
-	}
-	
-	BN_bn2bin(in, (unsigned char *) binbuf->v);
-
-	rsa_pub = binbuf_pubkey2rsa(binbuf);
-
-out:
-	if (binbuf)
-		vfree(binbuf);
-
-	return rsa_pub;
-}
-
-u_int32_t
-eay_random()
-{
-	u_int32_t result;
-	vchar_t *vrand;
-
-	vrand = eay_set_random(sizeof(result));
-	memcpy(&result, vrand->v, sizeof(result));
-	vfree(vrand);
-
-	return result;
-}
-
-const char *
-eay_version()
-{
-#if defined(OPENSSL_IS_BORINGSSL)
-	return "(BoringSSL)";
-#else
-	return SSLeay_version(SSLEAY_VERSION);
-#endif
-}
diff --git a/src/racoon/crypto_openssl.h b/src/racoon/crypto_openssl.h
deleted file mode 100644
index 983ffe5..0000000
--- a/src/racoon/crypto_openssl.h
+++ /dev/null
@@ -1,234 +0,0 @@
-/*	$NetBSD: crypto_openssl.h,v 1.5 2006/10/06 12:02:27 manu Exp $	*/
-
-/* Id: crypto_openssl.h,v 1.11 2004/11/13 11:28:01 manubsd Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _CRYPTO_OPENSSL_H
-#define _CRYPTO_OPENSSL_H
-
-#include "crypto_openssl.h"
-
-#include <openssl/x509v3.h>
-#include <openssl/rsa.h>
-
-#define GENT_OTHERNAME	GEN_OTHERNAME
-#define GENT_EMAIL	GEN_EMAIL
-#define GENT_DNS	GEN_DNS
-#define GENT_X400	GEN_X400
-#define GENT_DIRNAME	GEN_DIRNAME
-#define GENT_EDIPARTY	GEN_EDIPARTY
-#define GENT_URI	GEN_URI
-#define GENT_IPADD	GEN_IPADD
-#define GENT_RID	GEN_RID
-
-extern vchar_t *eay_str2asn1dn __P((const char *, int));
-extern vchar_t *eay_hex2asn1dn __P((const char *, int));
-extern int eay_cmp_asn1dn __P((vchar_t *, vchar_t *));
-extern int eay_check_x509cert __P((vchar_t *, char *, char *, int));
-extern vchar_t *eay_get_x509asn1subjectname __P((vchar_t *));
-extern int eay_get_x509subjectaltname __P((vchar_t *, char **, int *, int));
-extern char *eay_get_x509text __P((vchar_t *));
-extern vchar_t *eay_get_x509cert __P((char *));
-extern vchar_t *eay_get_x509sign __P((vchar_t *, vchar_t *));
-extern int eay_check_x509sign __P((vchar_t *, vchar_t *, vchar_t *));
-
-extern int eay_check_rsasign __P((vchar_t *, vchar_t *, RSA *));
-extern vchar_t *eay_get_rsasign __P((vchar_t *, RSA *));
-
-/* RSA */
-extern vchar_t *eay_rsa_sign __P((vchar_t *, RSA *));
-extern int eay_rsa_verify __P((vchar_t *, vchar_t *, RSA *));
-
-/* ASN.1 */
-extern vchar_t *eay_get_pkcs1privkey __P((char *));
-extern vchar_t *eay_get_pkcs1pubkey __P((char *));
-
-/* string error */
-extern char *eay_strerror __P((void));
-
-/* OpenSSL initialization */
-extern void eay_init __P((void));
-
-/* Generic EVP */
-extern vchar_t *evp_crypt __P((vchar_t *data, vchar_t *key, vchar_t *iv,
-			       const EVP_CIPHER *e, int enc));
-extern int evp_weakkey __P((vchar_t *key, const EVP_CIPHER *e));
-extern int evp_keylen __P((int len, const EVP_CIPHER *e));
-
-/* DES */
-extern vchar_t *eay_des_encrypt __P((vchar_t *, vchar_t *, vchar_t *));
-extern vchar_t *eay_des_decrypt __P((vchar_t *, vchar_t *, vchar_t *));
-extern int eay_des_weakkey __P((vchar_t *));
-extern int eay_des_keylen __P((int));
-
-/* IDEA */
-extern vchar_t *eay_idea_encrypt __P((vchar_t *, vchar_t *, vchar_t *));
-extern vchar_t *eay_idea_decrypt __P((vchar_t *, vchar_t *, vchar_t *));
-extern int eay_idea_weakkey __P((vchar_t *));
-extern int eay_idea_keylen __P((int));
-
-/* blowfish */
-extern vchar_t *eay_bf_encrypt __P((vchar_t *, vchar_t *, vchar_t *));
-extern vchar_t *eay_bf_decrypt __P((vchar_t *, vchar_t *, vchar_t *));
-extern int eay_bf_weakkey __P((vchar_t *));
-extern int eay_bf_keylen __P((int));
-
-/* RC5 */
-extern vchar_t *eay_rc5_encrypt __P((vchar_t *, vchar_t *, vchar_t *));
-extern vchar_t *eay_rc5_decrypt __P((vchar_t *, vchar_t *, vchar_t *));
-extern int eay_rc5_weakkey __P((vchar_t *));
-extern int eay_rc5_keylen __P((int));
-
-/* 3DES */
-extern vchar_t *eay_3des_encrypt __P((vchar_t *, vchar_t *, vchar_t *));
-extern vchar_t *eay_3des_decrypt __P((vchar_t *, vchar_t *, vchar_t *));
-extern int eay_3des_weakkey __P((vchar_t *));
-extern int eay_3des_keylen __P((int));
-
-/* CAST */
-extern vchar_t *eay_cast_encrypt __P((vchar_t *, vchar_t *, vchar_t *));
-extern vchar_t *eay_cast_decrypt __P((vchar_t *, vchar_t *, vchar_t *));
-extern int eay_cast_weakkey __P((vchar_t *));
-extern int eay_cast_keylen __P((int));
-
-/* AES(RIJNDAEL) */
-extern vchar_t *eay_aes_encrypt __P((vchar_t *, vchar_t *, vchar_t *));
-extern vchar_t *eay_aes_decrypt __P((vchar_t *, vchar_t *, vchar_t *));
-extern int eay_aes_weakkey __P((vchar_t *));
-extern int eay_aes_keylen __P((int));
-
-#if defined(HAVE_OPENSSL_CAMELLIA_H)
-/* Camellia */
-extern vchar_t *eay_camellia_encrypt __P((vchar_t *, vchar_t *, vchar_t *));
-extern vchar_t *eay_camellia_decrypt __P((vchar_t *, vchar_t *, vchar_t *));
-extern int eay_camellia_weakkey __P((vchar_t *));
-extern int eay_camellia_keylen __P((int));
-#endif
-
-/* misc */
-extern int eay_null_keylen __P((int));
-extern int eay_null_hashlen __P((void));
-extern int eay_kpdk_hashlen __P((void));
-extern int eay_twofish_keylen __P((int));
-
-/* hash */
-#if defined(WITH_SHA2)
-/* HMAC SHA2 */
-extern vchar_t *eay_hmacsha2_512_one __P((vchar_t *, vchar_t *));
-extern caddr_t eay_hmacsha2_512_init __P((vchar_t *));
-extern void eay_hmacsha2_512_update __P((caddr_t, vchar_t *));
-extern vchar_t *eay_hmacsha2_512_final __P((caddr_t));
-extern vchar_t *eay_hmacsha2_384_one __P((vchar_t *, vchar_t *));
-extern caddr_t eay_hmacsha2_384_init __P((vchar_t *));
-extern void eay_hmacsha2_384_update __P((caddr_t, vchar_t *));
-extern vchar_t *eay_hmacsha2_384_final __P((caddr_t));
-extern vchar_t *eay_hmacsha2_256_one __P((vchar_t *, vchar_t *));
-extern caddr_t eay_hmacsha2_256_init __P((vchar_t *));
-extern void eay_hmacsha2_256_update __P((caddr_t, vchar_t *));
-extern vchar_t *eay_hmacsha2_256_final __P((caddr_t));
-#endif
-/* HMAC SHA1 */
-extern vchar_t *eay_hmacsha1_one __P((vchar_t *, vchar_t *));
-extern caddr_t eay_hmacsha1_init __P((vchar_t *));
-extern void eay_hmacsha1_update __P((caddr_t, vchar_t *));
-extern vchar_t *eay_hmacsha1_final __P((caddr_t));
-/* HMAC MD5 */
-extern vchar_t *eay_hmacmd5_one __P((vchar_t *, vchar_t *));
-extern caddr_t eay_hmacmd5_init __P((vchar_t *));
-extern void eay_hmacmd5_update __P((caddr_t, vchar_t *));
-extern vchar_t *eay_hmacmd5_final __P((caddr_t));
-
-#if defined(WITH_SHA2)
-/* SHA2 functions */
-extern caddr_t eay_sha2_512_init __P((void));
-extern void eay_sha2_512_update __P((caddr_t, vchar_t *));
-extern vchar_t *eay_sha2_512_final __P((caddr_t));
-extern vchar_t *eay_sha2_512_one __P((vchar_t *));
-#endif
-extern int eay_sha2_512_hashlen __P((void));
-
-#if defined(WITH_SHA2)
-extern caddr_t eay_sha2_384_init __P((void));
-extern void eay_sha2_384_update __P((caddr_t, vchar_t *));
-extern vchar_t *eay_sha2_384_final __P((caddr_t));
-extern vchar_t *eay_sha2_384_one __P((vchar_t *));
-#endif
-extern int eay_sha2_384_hashlen __P((void));
-
-#if defined(WITH_SHA2)
-extern caddr_t eay_sha2_256_init __P((void));
-extern void eay_sha2_256_update __P((caddr_t, vchar_t *));
-extern vchar_t *eay_sha2_256_final __P((caddr_t));
-extern vchar_t *eay_sha2_256_one __P((vchar_t *));
-#endif
-extern int eay_sha2_256_hashlen __P((void));
-
-/* SHA functions */
-extern caddr_t eay_sha1_init __P((void));
-extern void eay_sha1_update __P((caddr_t, vchar_t *));
-extern vchar_t *eay_sha1_final __P((caddr_t));
-extern vchar_t *eay_sha1_one __P((vchar_t *));
-extern int eay_sha1_hashlen __P((void));
-
-/* MD5 functions */
-extern caddr_t eay_md5_init __P((void));
-extern void eay_md5_update __P((caddr_t, vchar_t *));
-extern vchar_t *eay_md5_final __P((caddr_t));
-extern vchar_t *eay_md5_one __P((vchar_t *));
-extern int eay_md5_hashlen __P((void));
-
-/* RNG */
-extern vchar_t *eay_set_random __P((u_int32_t));
-extern u_int32_t eay_random __P((void));
-
-/* DH */
-extern int eay_dh_generate __P((vchar_t *, u_int32_t, u_int, vchar_t **, vchar_t **));
-extern int eay_dh_compute __P((vchar_t *, u_int32_t, vchar_t *, vchar_t *, vchar_t *, vchar_t **));
-
-/* Base 64 */
-vchar_t *base64_encode(char *in, long inlen);
-vchar_t *base64_decode(char *in, long inlen);
-
-RSA *base64_pubkey2rsa(char *in);
-RSA *bignum_pubkey2rsa(BIGNUM *in);
-
-/* misc */
-extern int eay_revbnl __P((vchar_t *));
-#include <openssl/bn.h>
-extern int eay_v2bn __P((BIGNUM **, vchar_t *));
-extern int eay_bn2v __P((vchar_t **, const BIGNUM *));
-
-extern const char *eay_version __P((void));
-
-#define CBC_BLOCKLEN 8
-#define IPSEC_ENCRYPTKEYLEN 8
-
-#endif /* _CRYPTO_OPENSSL_H */
diff --git a/src/racoon/debug.h b/src/racoon/debug.h
deleted file mode 100644
index 47c2641..0000000
--- a/src/racoon/debug.h
+++ /dev/null
@@ -1,41 +0,0 @@
-/*	$NetBSD: debug.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/* Id: debug.h,v 1.3 2004/06/11 16:00:16 ludvigm Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _DEBUG_H
-#define _DEBUG_H
-
-/* define by main.c */
-extern int f_local;
-extern int vflag;
-
-#endif /* _DEBUG_H */
diff --git a/src/racoon/debugrm.h b/src/racoon/debugrm.h
deleted file mode 100644
index 6a2f411..0000000
--- a/src/racoon/debugrm.h
+++ /dev/null
@@ -1,102 +0,0 @@
-/*	$NetBSD: debugrm.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/* Id: debugrm.h,v 1.4 2006/04/06 14:00:06 manubsd Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _DEBUGRM_H
-#define _DEBUGRM_H
-
-#define DRMDUMPFILE	"/var/tmp/debugrm.dump"
-
-#ifdef NONEED_DRM
-#ifndef racoon_malloc
-#define	racoon_malloc(sz)	malloc((sz))
-#endif
-#ifndef racoon_calloc
-#define	racoon_calloc(cnt, sz)	calloc((cnt), (sz))
-#endif
-#ifndef racoon_realloc
-#define	racoon_realloc(old, sz)	realloc((old), (sz))
-#endif
-#ifndef racoon_free
-#define	racoon_free(p)		free((p))
-#endif
-#ifndef racoon_strdup
-#define	racoon_strdup(p)	strdup((p))
-#endif
-#else /*!NONEED_DRM*/
-#ifndef racoon_malloc
-#define	racoon_malloc(sz)	\
-	DRM_malloc(__FILE__, __LINE__, __func__, (sz))
-#endif
-#ifndef racoon_calloc
-#define	racoon_calloc(cnt, sz)	\
-	DRM_calloc(__FILE__, __LINE__, __func__, (cnt), (sz))
-#endif
-#ifndef racoon_realloc
-#define	racoon_realloc(old, sz)	\
-	DRM_realloc(__FILE__, __LINE__, __func__, (old), (sz))
-#endif
-#ifndef racoon_free
-#define	racoon_free(p)		\
-	DRM_free(__FILE__, __LINE__, __func__, (p))
-#endif
-#ifndef racoon_strdup
-#define	racoon_strdup(p)	\
-	DRM_strdup(__FILE__, __LINE__, __func__, (p))
-#endif
-#endif /*NONEED_DRM*/
-
-extern void DRM_init __P((void));
-extern void DRM_dump __P((void));
-extern void *DRM_malloc __P((char *, int, char *, size_t));
-extern void *DRM_calloc __P((char *, int, char *, size_t, size_t));
-extern void *DRM_realloc __P((char *, int, char *, void *, size_t));
-extern void DRM_free __P((char *, int, char *, void *));
-extern char *DRM_strdup __P((char *, int, char *, const char *));
-
-#ifndef NONEED_DRM
-#define	vmalloc(sz)	\
-	DRM_vmalloc(__FILE__, __LINE__, __func__, (sz))
-#define	vdup(old)	\
-	DRM_vdup(__FILE__, __LINE__, __func__, (old))
-#define	vrealloc(old, sz)	\
-	DRM_vrealloc(__FILE__, __LINE__, __func__, (old), (sz))
-#define	vfree(p)		\
-	DRM_vfree(__FILE__, __LINE__, __func__, (p))
-#endif
-
-extern void *DRM_vmalloc __P((char *, int, char *, size_t));
-extern void *DRM_vrealloc __P((char *, int, char *, void *, size_t));
-extern void DRM_vfree __P((char *, int, char *, void *));
-extern void *DRM_vdup __P((char *, int, char *, void *));
-
-#endif /* _DEBUGRM_H */
diff --git a/src/racoon/dhgroup.h b/src/racoon/dhgroup.h
deleted file mode 100644
index 54d7eeb..0000000
--- a/src/racoon/dhgroup.h
+++ /dev/null
@@ -1,205 +0,0 @@
-/*	$NetBSD: dhgroup.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/* Id: dhgroup.h,v 1.3 2004/06/11 16:00:16 ludvigm Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _DHGROUP_H
-#define _DHGROUP_H
-
-#define OAKLEY_PRIME_MODP768 \
-	"FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1" \
-	"29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD" \
-	"EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245" \
-	"E485B576 625E7EC6 F44C42E9 A63A3620 FFFFFFFF FFFFFFFF"
-
-#define OAKLEY_PRIME_MODP1024 \
-	"FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1" \
-	"29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD" \
-	"EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245" \
-	"E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED" \
-	"EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE65381" \
-	"FFFFFFFF FFFFFFFF"
-
-#define OAKLEY_PRIME_MODP1536 \
-	"FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1" \
-	"29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD" \
-	"EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245" \
-	"E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED" \
-	"EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE45B3D" \
-	"C2007CB8 A163BF05 98DA4836 1C55D39A 69163FA8 FD24CF5F" \
-	"83655D23 DCA3AD96 1C62F356 208552BB 9ED52907 7096966D" \
-	"670C354E 4ABC9804 F1746C08 CA237327 FFFFFFFF FFFFFFFF"
-
-/* RFC 3526 */
-#define OAKLEY_PRIME_MODP2048 \
-	"FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1" \
-	"29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD" \
-	"EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245" \
-	"E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED" \
-	"EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE45B3D" \
-	"C2007CB8 A163BF05 98DA4836 1C55D39A 69163FA8 FD24CF5F" \
-	"83655D23 DCA3AD96 1C62F356 208552BB 9ED52907 7096966D" \
-	"670C354E 4ABC9804 F1746C08 CA18217C 32905E46 2E36CE3B" \
-	"E39E772C 180E8603 9B2783A2 EC07A28F B5C55DF0 6F4C52C9" \
-	"DE2BCBF6 95581718 3995497C EA956AE5 15D22618 98FA0510" \
-	"15728E5A 8AACAA68 FFFFFFFF FFFFFFFF"
-
-#define OAKLEY_PRIME_MODP3072 \
-	"FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1" \
-	"29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD" \
-	"EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245" \
-	"E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED" \
-	"EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE45B3D" \
-	"C2007CB8 A163BF05 98DA4836 1C55D39A 69163FA8 FD24CF5F" \
-	"83655D23 DCA3AD96 1C62F356 208552BB 9ED52907 7096966D" \
-	"670C354E 4ABC9804 F1746C08 CA18217C 32905E46 2E36CE3B" \
-	"E39E772C 180E8603 9B2783A2 EC07A28F B5C55DF0 6F4C52C9" \
-	"DE2BCBF6 95581718 3995497C EA956AE5 15D22618 98FA0510" \
-	"15728E5A 8AAAC42D AD33170D 04507A33 A85521AB DF1CBA64" \
-	"ECFB8504 58DBEF0A 8AEA7157 5D060C7D B3970F85 A6E1E4C7" \
-	"ABF5AE8C DB0933D7 1E8C94E0 4A25619D CEE3D226 1AD2EE6B" \
-	"F12FFA06 D98A0864 D8760273 3EC86A64 521F2B18 177B200C" \
-	"BBE11757 7A615D6C 770988C0 BAD946E2 08E24FA0 74E5AB31" \
-	"43DB5BFC E0FD108E 4B82D120 A93AD2CA FFFFFFFF FFFFFFFF"
-
-#define OAKLEY_PRIME_MODP4096 \
-	"FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1" \
-	"29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD" \
-	"EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245" \
-	"E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED" \
-	"EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE45B3D" \
-	"C2007CB8 A163BF05 98DA4836 1C55D39A 69163FA8 FD24CF5F" \
-	"83655D23 DCA3AD96 1C62F356 208552BB 9ED52907 7096966D" \
-	"670C354E 4ABC9804 F1746C08 CA18217C 32905E46 2E36CE3B" \
-	"E39E772C 180E8603 9B2783A2 EC07A28F B5C55DF0 6F4C52C9" \
-	"DE2BCBF6 95581718 3995497C EA956AE5 15D22618 98FA0510" \
-	"15728E5A 8AAAC42D AD33170D 04507A33 A85521AB DF1CBA64" \
-	"ECFB8504 58DBEF0A 8AEA7157 5D060C7D B3970F85 A6E1E4C7" \
-	"ABF5AE8C DB0933D7 1E8C94E0 4A25619D CEE3D226 1AD2EE6B" \
-	"F12FFA06 D98A0864 D8760273 3EC86A64 521F2B18 177B200C" \
-	"BBE11757 7A615D6C 770988C0 BAD946E2 08E24FA0 74E5AB31" \
-	"43DB5BFC E0FD108E 4B82D120 A9210801 1A723C12 A787E6D7" \
-	"88719A10 BDBA5B26 99C32718 6AF4E23C 1A946834 B6150BDA" \
-	"2583E9CA 2AD44CE8 DBBBC2DB 04DE8EF9 2E8EFC14 1FBECAA6" \
-	"287C5947 4E6BC05D 99B2964F A090C3A2 233BA186 515BE7ED" \
-	"1F612970 CEE2D7AF B81BDD76 2170481C D0069127 D5B05AA9" \
-	"93B4EA98 8D8FDDC1 86FFB7DC 90A6C08F 4DF435C9 34063199" \
-	"FFFFFFFF FFFFFFFF"
-
-#define OAKLEY_PRIME_MODP6144 \
-	"FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1" \
-	"29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD" \
-	"EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245" \
-	"E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED" \
-	"EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE45B3D" \
-	"C2007CB8 A163BF05 98DA4836 1C55D39A 69163FA8 FD24CF5F" \
-	"83655D23 DCA3AD96 1C62F356 208552BB 9ED52907 7096966D" \
-	"670C354E 4ABC9804 F1746C08 CA18217C 32905E46 2E36CE3B" \
-	"E39E772C 180E8603 9B2783A2 EC07A28F B5C55DF0 6F4C52C9" \
-	"DE2BCBF6 95581718 3995497C EA956AE5 15D22618 98FA0510" \
-	"15728E5A 8AAAC42D AD33170D 04507A33 A85521AB DF1CBA64" \
-	"ECFB8504 58DBEF0A 8AEA7157 5D060C7D B3970F85 A6E1E4C7" \
-	"ABF5AE8C DB0933D7 1E8C94E0 4A25619D CEE3D226 1AD2EE6B" \
-	"F12FFA06 D98A0864 D8760273 3EC86A64 521F2B18 177B200C" \
-	"BBE11757 7A615D6C 770988C0 BAD946E2 08E24FA0 74E5AB31" \
-	"43DB5BFC E0FD108E 4B82D120 A9210801 1A723C12 A787E6D7" \
-	"88719A10 BDBA5B26 99C32718 6AF4E23C 1A946834 B6150BDA" \
-	"2583E9CA 2AD44CE8 DBBBC2DB 04DE8EF9 2E8EFC14 1FBECAA6" \
-	"287C5947 4E6BC05D 99B2964F A090C3A2 233BA186 515BE7ED" \
-	"1F612970 CEE2D7AF B81BDD76 2170481C D0069127 D5B05AA9" \
-	"93B4EA98 8D8FDDC1 86FFB7DC 90A6C08F 4DF435C9 34028492" \
-	"36C3FAB4 D27C7026 C1D4DCB2 602646DE C9751E76 3DBA37BD" \
-	"F8FF9406 AD9E530E E5DB382F 413001AE B06A53ED 9027D831" \
-	"179727B0 865A8918 DA3EDBEB CF9B14ED 44CE6CBA CED4BB1B" \
-	"DB7F1447 E6CC254B 33205151 2BD7AF42 6FB8F401 378CD2BF" \
-	"5983CA01 C64B92EC F032EA15 D1721D03 F482D7CE 6E74FEF6" \
-	"D55E702F 46980C82 B5A84031 900B1C9E 59E7C97F BEC7E8F3" \
-	"23A97A7E 36CC88BE 0F1D45B7 FF585AC5 4BD407B2 2B4154AA" \
-	"CC8F6D7E BF48E1D8 14CC5ED2 0F8037E0 A79715EE F29BE328" \
-	"06A1D58B B7C5DA76 F550AA3D 8A1FBFF0 EB19CCB1 A313D55C" \
-	"DA56C9EC 2EF29632 387FE8D7 6E3C0468 043E8F66 3F4860EE" \
-	"12BF2D5B 0B7474D6 E694F91E 6DCC4024 FFFFFFFF FFFFFFFF"
-
-#define OAKLEY_PRIME_MODP8192 \
-	"FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1" \
-	"29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD" \
-	"EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245" \
-	"E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED" \
-	"EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE45B3D" \
-	"C2007CB8 A163BF05 98DA4836 1C55D39A 69163FA8 FD24CF5F" \
-	"83655D23 DCA3AD96 1C62F356 208552BB 9ED52907 7096966D" \
-	"670C354E 4ABC9804 F1746C08 CA18217C 32905E46 2E36CE3B" \
-	"E39E772C 180E8603 9B2783A2 EC07A28F B5C55DF0 6F4C52C9" \
-	"DE2BCBF6 95581718 3995497C EA956AE5 15D22618 98FA0510" \
-	"15728E5A 8AAAC42D AD33170D 04507A33 A85521AB DF1CBA64" \
-	"ECFB8504 58DBEF0A 8AEA7157 5D060C7D B3970F85 A6E1E4C7" \
-	"ABF5AE8C DB0933D7 1E8C94E0 4A25619D CEE3D226 1AD2EE6B" \
-	"F12FFA06 D98A0864 D8760273 3EC86A64 521F2B18 177B200C" \
-	"BBE11757 7A615D6C 770988C0 BAD946E2 08E24FA0 74E5AB31" \
-	"43DB5BFC E0FD108E 4B82D120 A9210801 1A723C12 A787E6D7" \
-	"88719A10 BDBA5B26 99C32718 6AF4E23C 1A946834 B6150BDA" \
-	"2583E9CA 2AD44CE8 DBBBC2DB 04DE8EF9 2E8EFC14 1FBECAA6" \
-	"287C5947 4E6BC05D 99B2964F A090C3A2 233BA186 515BE7ED" \
-	"1F612970 CEE2D7AF B81BDD76 2170481C D0069127 D5B05AA9" \
-	"93B4EA98 8D8FDDC1 86FFB7DC 90A6C08F 4DF435C9 34028492" \
-	"36C3FAB4 D27C7026 C1D4DCB2 602646DE C9751E76 3DBA37BD" \
-	"F8FF9406 AD9E530E E5DB382F 413001AE B06A53ED 9027D831" \
-	"179727B0 865A8918 DA3EDBEB CF9B14ED 44CE6CBA CED4BB1B" \
-	"DB7F1447 E6CC254B 33205151 2BD7AF42 6FB8F401 378CD2BF" \
-	"5983CA01 C64B92EC F032EA15 D1721D03 F482D7CE 6E74FEF6" \
-	"D55E702F 46980C82 B5A84031 900B1C9E 59E7C97F BEC7E8F3" \
-	"23A97A7E 36CC88BE 0F1D45B7 FF585AC5 4BD407B2 2B4154AA" \
-	"CC8F6D7E BF48E1D8 14CC5ED2 0F8037E0 A79715EE F29BE328" \
-	"06A1D58B B7C5DA76 F550AA3D 8A1FBFF0 EB19CCB1 A313D55C" \
-	"DA56C9EC 2EF29632 387FE8D7 6E3C0468 043E8F66 3F4860EE" \
-	"12BF2D5B 0B7474D6 E694F91E 6DBE1159 74A3926F 12FEE5E4" \
-	"38777CB6 A932DF8C D8BEC4D0 73B931BA 3BC832B6 8D9DD300" \
-	"741FA7BF 8AFC47ED 2576F693 6BA42466 3AAB639C 5AE4F568" \
-	"3423B474 2BF1C978 238F16CB E39D652D E3FDB8BE FC848AD9" \
-	"22222E04 A4037C07 13EB57A8 1A23F0C7 3473FC64 6CEA306B" \
-	"4BCBC886 2F8385DD FA9D4B7F A2C087E8 79683303 ED5BDD3A" \
-	"062B3CF5 B3A278A6 6D2A13F8 3F44F82D DF310EE0 74AB6A36" \
-	"4597E899 A0255DC1 64F31CC5 0846851D F9AB4819 5DED7EA1" \
-	"B1D510BD 7EE74D73 FAF36BC3 1ECFA268 359046F4 EB879F92" \
-	"4009438B 481C6CD7 889A002E D5EE382B C9190DA6 FC026E47" \
-	"9558E447 5677E9AA 9E3050E2 765694DF C81F56E8 80B96E71" \
-	"60C980DD 98EDD3DF FFFFFFFF FFFFFFFF"
-
-extern struct dhgroup dh_modp768;
-extern struct dhgroup dh_modp1024;
-extern struct dhgroup dh_modp1536;
-extern struct dhgroup dh_modp2048;
-extern struct dhgroup dh_modp3072;
-extern struct dhgroup dh_modp4096;
-extern struct dhgroup dh_modp6144;
-extern struct dhgroup dh_modp8192;
-
-#endif /* _DHGROUP_H */
diff --git a/src/racoon/dnssec.c b/src/racoon/dnssec.c
deleted file mode 100644
index 1fc0bd1..0000000
--- a/src/racoon/dnssec.c
+++ /dev/null
@@ -1,154 +0,0 @@
-/*	$NetBSD: dnssec.c,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/*	$KAME: dnssec.c,v 1.2 2001/08/05 18:46:07 itojun Exp $	*/
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-#include <stdlib.h>
-#include <string.h>
-
-#include "var.h"
-#include "vmbuf.h"
-#include "misc.h"
-#include "plog.h"
-#include "debug.h"
-
-#include "isakmp_var.h"
-#include "isakmp.h"
-#include "ipsec_doi.h"
-#include "oakley.h"
-#include "netdb_dnssec.h"
-#include "strnames.h"
-#include "dnssec.h"
-#include "gcmalloc.h"
-
-extern int h_errno;
-
-cert_t *
-dnssec_getcert(id)
-	vchar_t *id;
-{
-	cert_t *cert = NULL;
-	struct certinfo *res = NULL;
-	struct ipsecdoi_id_b *id_b;
-	int type;
-	char *name = NULL;
-	int namelen;
-	int error;
-
-	id_b = (struct ipsecdoi_id_b *)id->v;
-
-	namelen = id->l - sizeof(*id_b);
-	name = racoon_malloc(namelen + 1);
-	if (!name) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get buffer.\n");
-		return NULL;
-	}
-	memcpy(name, id_b + 1, namelen);
-	name[namelen] = '\0';
-
-	switch (id_b->type) {
-	case IPSECDOI_ID_FQDN:
-		error = getcertsbyname(name, &res);
-		if (error != 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"getcertsbyname(\"%s\") failed.\n", name);
-			goto err;
-		}
-		break;
-	case IPSECDOI_ID_IPV4_ADDR:
-	case IPSECDOI_ID_IPV6_ADDR:
-		/* XXX should be processed to query PTR ? */
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"inpropper ID type passed %s "
-			"though getcert method is dnssec.\n",
-			s_ipsecdoi_ident(id_b->type));
-		goto err;
-	}
-
-	/* check response */
-	if (res->ci_next != NULL) {
-		plog(LLV_WARNING, LOCATION, NULL,
-			"not supported multiple CERT RR.\n");
-	}
-	switch (res->ci_type) {
-	case DNSSEC_TYPE_PKIX:
-		/* XXX is it enough condition to set this type ? */
-		type = ISAKMP_CERT_X509SIGN;
-		break;
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"not supported CERT RR type %d.\n", res->ci_type);
-		goto err;
-	}
-
-	/* create cert holder */
-	cert = oakley_newcert();
-	if (cert == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get cert buffer.\n");
-		goto err;
-	}
-	cert->pl = vmalloc(res->ci_certlen + 1);
-	if (cert->pl == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get cert buffer.\n");
-		goto err;
-	}
-	memcpy(cert->pl->v + 1, res->ci_cert, res->ci_certlen);
-	cert->pl->v[0] = type;
-	cert->cert.v = cert->pl->v + 1;
-	cert->cert.l = cert->pl->l - 1;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "created CERT payload:\n");
-	plogdump(LLV_DEBUG, cert->pl->v, cert->pl->l);
-
-end:
-	if (res)
-		freecertinfo(res);
-
-	return cert;
-
-err:
-	if (name)
-		racoon_free(name);
-	if (cert) {
-		oakley_delcert(cert);
-		cert = NULL;
-	}
-
-	goto end;
-}
diff --git a/src/racoon/dnssec.h b/src/racoon/dnssec.h
deleted file mode 100644
index fb1c931..0000000
--- a/src/racoon/dnssec.h
+++ /dev/null
@@ -1,39 +0,0 @@
-/*	$NetBSD: dnssec.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/* Id: dnssec.h,v 1.3 2004/06/11 16:00:16 ludvigm Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _DNSSEC_H
-#define _DNSSEC_H
-
-extern cert_t *dnssec_getcert __P((vchar_t *));
-
-#endif /* _DNSSEC_H */
diff --git a/src/racoon/doc/FAQ b/src/racoon/doc/FAQ
deleted file mode 100644
index 0ab49f0..0000000
--- a/src/racoon/doc/FAQ
+++ /dev/null
@@ -1,114 +0,0 @@
-This document is derived from the KAME racoon FAQ. Some answers do not
-apply to ipsec-tools (they are obsolete or not up to date). They are
-tagged [KAME]
-
-Q: With what other IKE/IPsec implementation racoon is known to be interoperable?
-
-A: [KAME]
-	See "IMPLEMENTATION" document supplied with KAME kit, or:
-	http://www.kame.net/dev/cvsweb.cgi/kame/IMPLEMENTATION
-	As we have tested/got test reports in the past, and our end and
-	the other end may have changed their implemenations, we are not sure
-	if we can interoperate with them today (we hope them to interoperate,
-	but we are not sure).
-	Also note that, IKE interoperability highly depends on configuration
-	on both ends.  You must configure both ends exactly the same.
-
-Q: How can I make racoon interoperate with <IKE/IPsec implementation>?
-
-A:
-	Configure both ends exactly the same.  With just a tiny little
-	differnce, you will be in trouble.
-
-Q: How to build racoon on my platform?
-
-A: 
-	As usual: configure && make && make install
-	ipsec-tools is also available as a package in the NetBSD pkgsrc
-
-Q: Describe me the options to "configure".
-
-A:
-	--enable-adminport:
-		Lets racoon to listen to racoon admin port, which is to
-		be contacted by racoonctl(8).
-	--enable-natt:
-		Enable NAT-Traversal. This needs kernel support, which is
-		available on Linux. On NetBSD, NAT-Traversal kernel support
-		has not been integrated yet, you can get it from here:
-		http://ipsec-tools.sourceforge.net/netbsd_nat-t.diff
-		If you live in a country where software patents are legal,
-		using NAT-Traversal might infringe a patent. 
-	--enable-broken-natt:
-		When ipsec-tools is built with --enable-natt, racoon 
-		sets IKE ports in SAD and SPD so that the kernel is 
-		able to ditinguish peers hidden behind the same NAT.
-		Some kernel will not cope with that ports. Use that
-		option to force the ports to 0 in SAD ans SPD. Of 
-		course this means that you cannot have multiple peers
-		behind the same NAT.
-	--enable-frag:
-		Enable IKE fragmentation, which is a workaround for 
-		broken routers that drop fragmented packets
-	--enable-hybrid:
-		Enable hybrid authentication, and ISAKMP mode config and
-		Xauth as well. Note that plain Xauth (without hybrid auth)
-		is not implemented.
-	--with-libradius:
-		Enable the use of RADIUS with hybrid authentication on the
-		server side. RADIUS is used for authentication, configuration
-		and accounting.
-	--with-libpam:
-		Enable the use of PAM with hybrid authentication on the 
-		server side. PAM can be used for authentication and accounting.
-	--enable-gssapi:
-		Enable GSS-API, for Kerberos V support.
-	--enable-stats:	
-		Enable statistics logging function.
-	--enable-samode-unspec:	
-		Enable to use unspecified a mode of SA.
-	--enable-ipv6:
-		Enable IPv6 support.
-	--with-kernel-headers:
-		Supply the location of Linux kernel headers.
-	--with-readline:
-		Support readline input (yes by default).
-	--with-openssl:
-		Specify OpenSSL directory.
-	--sysconfdir:
-		Where racoon config file goes. Default is /etc, which means
-		that racoon will look for /etc/racoon.conf
-	--localstatedir:
-		Where is the directory where racoon stores the control socket
-		(when using --enable-adminport). Default is /var, which 
-		means racoon will use /var/racoon/racoon.sock
-	--prefix:
-		Where racoon gets installed. 
-
-Q: How can I get help?
-
-A: 
-	Always identify your operating system platforms, the versions you are
-	using (like "ipsec-tools-0.5"), and information to repeat the
-	problem.  The more revelant information you supply, the better your 
-	chances of getting help are. Useful informations include, depending
-	of the problem: 
-	- version identification
-	- trace from racoon, taken by "racoon -d 0xffffffff"
-		(maximum debug level)
-	- configuration file you are using
-	- probabaly, tcpdump trace
-	http://orange.kame.net/dev/send-pr.html has the guideline.
-
-	If your question is not confidential, send your questions to:
-	<ipsec-tools-devel@lists.sourceforge.net>
-
-	If your question is confidential, send your questions to:
-	<ipsec-tools-core@lists.sourceforge.net>
-
-Q: Other documents to look at?
-
-A:
-	http://www.netbsd.org/Documentation/network/ipsec/
-	http://www.kame.net/
-	http://www.kame.net/newsletter/
diff --git a/src/racoon/doc/README.certificate b/src/racoon/doc/README.certificate
deleted file mode 100644
index a8bbfa2..0000000
--- a/src/racoon/doc/README.certificate
+++ /dev/null
@@ -1 +0,0 @@
-See http://www.kame.net/newsletter/20001119b/
diff --git a/src/racoon/doc/README.gssapi b/src/racoon/doc/README.gssapi
deleted file mode 100644
index 9cb3fbb..0000000
--- a/src/racoon/doc/README.gssapi
+++ /dev/null
@@ -1,106 +0,0 @@
-The gss-api authentication mechanism implementation for racoon was
-based on the ietf draft draft-ietf-ipsec-isakmp-gss-auth-06.txt.
-
-The implementation uses the Heimdal gss-api library, i.e. gss-api
-on top of Kerberos 5. The Heimdal gss-api library had to be modified
-to meet the requirements of using gss-api in a daemon. More specifically,
-the gss_acquire_cred() call did not work for other cases than
-GSS_C_NO_CREDENTIAL ("use default creds"). Daemons are often started
-as root, and have no Kerberos 5 credentials, so racoon explicitly
-needs to acquire its credentials. The usual method (already used
-by login authentication daemons) in these situations is to add
-a set of special credentials to be used. For example, authentication
-by daemons concerned with login credentials, uses 'host/fqdn' as
-its credential, where fqdn is the hostname on the interface that
-is being used. These special credentials need to be extracted into
-a local keytab from the kdc. The default value used in racoon
-is 'ike/fqdn', but it can be overridden in the racoon config file.
-
-The modification to the Heimdal gss-api library implements the
-mechanism above. If a credential other than GSS_C_NO_CREDENTIAL
-is specified to gss_acquire_cred(), it first looks in the default
-credential cache if it its principal matches the desired credential.
-If not, it extracts it from the default keytab file, and stores
-it in a memory-based credential cache, part of the gss credential
-structure.
-
-
-
-The modifcations to racoon itself are as follows:
-
-	* The racoon.conf config file accepts a new keyword, "gssapi_id",
-	  to be used inside a proposal specification. It specifies
-	  a string (a Kerberos 5 principal in this case), specifying the
-	  credential that racoon will try to acquire. The default value
-	  is 'ike/fqdn', where fqdn is the hostname for the interface
-	  being used for the exchange. If the id is not specified, no
-	  GSS endpoint attribute will be specified in the first SA sent.
-	  However, if the initiator does specify a GSS endpoint attribute,
-	  racoon will always respond with its own GSS endpoint name
-	  in the SA (the default one if not specified by this option).
-
-	* The racoon.conf file accepts "gssapi_krb" as authentication
-	  method inside a proposal specification. The number used
-	  for this method is 65001, which is a temporary number as
-	  specified in the draft.
-
-	* The cftoken.l and cfparse.y source files were modified to
-	  pick up the configuration options. The original sources
-	  stored algorithms in bitmask, which unfortunately meant
-	  that the maximum value was 32, clearly not enough for 65001.
-	  After consulting with the author (sakane@kame.net), it turned
-	  out that method was a leftover, and no longer needed. I replaced
-	  it with plain integers.
-
-	* The gss-api specific code was concentrated as much as possible
-	  in gssapi.c and gssapi.h. The code to call functions defined
-	  in these files is conditional on HAVE_GSSAPI, except for the
-	  config scan code. Specifying this flag on the compiler commandline
-	  is conditional on the --enable-gssapi option to the configure
-	  script.
-
-	* Racoon seems to want to send accepted SA proposals back to
-	  the initiator in a verbatim fashion, leaving no room to
-	  insert the (variable-length) GSS endpoint name attribute.
-	  I worked around this by re-assembling the extracted SA
-	  into a new SA if the gssapi_krb method is used, and the
-	  initiator sent the name attribute. This scheme should
-	  possibly be re-examined by the racoon maintainers, storing
-	  the SAs (the transformations, to be more precise) in a different
-	  fashion to allow for variable-length attributes to be
-	  re-inserted would be a good change, but I considered it to be
-	  beyond the scope of this project.
-
-	* The various state functions for aggressive and main mode
-	  (in isakmp_agg.c and isakmp_ident.c respectively) were
-	  changed to conditionally change their behavior if the
-	  gssapi_krb method is specified.
-
-
-This implementation tried to follow the specification in the ietf draft
-as close as possible. However, it has not been tested against other
-IKE daemon implementations. The only other one I know of is Windows 2000,
-and it has some caveats. I attempted to be Windows 2000 compatible.
-Should racoon be tried against Windows 2000, the gssapi_id option in
-the config file must be used, as Windows 2000 expects the GSS endpoint
-name to be sent at all times. I have my doubts as to the W2K compatibility,
-because the spec describes the GSS endpoint name sent by W2K as
-an unicode string 'xxx@domain', which doesn't seem to match the
-required standard for gss-api + kerberos 5 (i.e. I am fairly certain
-that such a string will be rejected by the Heimdal gss-api library, as it
-is not a valid Kerberos 5 principal).
-
-With the Heimdal gss-api implementation, the gssapi_krb authentication
-method will only work in main mode. Aggressive mode does not allow
-for the extra round-trips needed by gss_init_sec_context and
-gss_accept_sec_context when mutual authentication is requested.
-The draft specifies that the a fallback should be done to main mode,
-through the return of INVALID-EXCHANGE-TYPE if it turns out that
-the gss-api mechanisms needs more roundtrips. This is implemented.
-Unfortunately, racoon does not seem to properly fall back to
-its next mode, and this is not specific to the gssapi_krb method.
-So, to avoid problems, only specify main mode in the config file.
-
-
-	-- Frank van der Linden <fvdl@wasabisystems.com>
-
diff --git a/src/racoon/doc/README.plainrsa b/src/racoon/doc/README.plainrsa
deleted file mode 100644
index 36de09c..0000000
--- a/src/racoon/doc/README.plainrsa
+++ /dev/null
@@ -1,109 +0,0 @@
-HOW-TO use plainrsa auth, contributed by Simon Chang <simonychang@gmail.com>
-
-Before you begin, you should understand that the RSA authentication
-mechanism hinges upon the idea of a split cryptographic key:  one used
-by the public, the other readable only to you.  Any data that is
-encrypted by a public key can be decrypted only by the corresponding
-private key, so that the private key user can be assured that the
-content of the transmission has not been examined by unauthorized
-parties.  Similarly, any data encrypted by the private key can be
-decrypted by the public key so that the public knows that this
-transmission came from this user and nobody else (this idea is called
-non-repudiation).  Also, the longer the key length, the more difficult
-it would be for potential attacker to conduct brute-force discovery of
-the keys.  So, what all this means for the security administrator is
-that the setup needs a pair of reasonably long keys for each host that
-wishes to authenticate in this manner.
-
-With this in mind, it should be relatively straightforward to set up
-RSA authentication.  For the purpose of this document, we assume that
-we are setting up RSA authentication between two networked hosts
-called Boston and Chicago.  Unless otherwise noted, all steps should
-be performed on both hosts with corresponding key names.  Here are the
-steps:
-
-1)  Included in each default installation of ipsec-tools is a binary
-called plainrsa-gen.  This executable is used to generate a pair of
-RSA keys for the host.  There are only two parameters that you should
-be concerned about: -b, which sets the number of bits for the keys,
-and -f, which specifies the output file for plainrsa-gen to send the
-results.  On an ordinary Pentium-II with 128 MB of RAM, it takes only
-seconds to generate keys that are 2048 bits long, and only slightly
-longer to generate 4096-bit keys.  Either key length should be
-sufficient; any longer key length actually reduces performance and
-does not increase security significantly.  You should therefore run it
-as:
-
-	plainrsa-gen -b 2048 -f /var/tmp/boston.keys
-
-2)  When the process completes, you should have a text file that
-includes both public and private keys.  GUARD THIS FILE CAREFULLY,
-because once a private key is compromised it is no longer any good,
-and you must generate a new pair from scratch.  Reading the file
-itself, you should see several very long lines of alphanumeric data.
-The only line you should be concerned with is the line towards the top
-of the output file that begins with "# pubkey=0sAQPAmBdT/" or
-something to that effect.  This line is your public key, which should
-be made available to the other host that you are setting up.  Copy
-this line to a separate file called "boston.pub" and change the
-beginning of the line so that it reads ": PUB 0sAQPAmBdT/".
-Alternatively, you can also grab the first line of the boston.keys
-file and uncomment the line so that it reads the same as above.  Now
-rename the file you generated initially to "boston.priv".
-
-3)  You should now have two files, boston.priv and boston.pub
-(chicago.priv and chicago.pub on Chicago).  The first file contains
-your private key and the second file your public key.  Next you should
-find a way to get the public key over to the other host involved.
-Boston should have (1) its own key pair, and (2) Chicago's public key
-ONLY.  Do not copy Chicago's private key over to Boston, because (a)
-it is not necessary, and (b) you would now have two potential places
-for losing control of your private key.
-
-4)  You should now configure the racoon.conf configuration file for
-each host to (a) turn on RSA authentication, and (b) designate each
-host's private key and the remote host(s)'s public key(s).  Take all
-your keys and place it in one directory and use the global directive
-"path certificate" to specify the location of the keys.  This step is
-especially important if you are running racoon with privilege
-separation, because if racoon cannot find the keys inside the
-directory you have just specified it will fail the authentication
-process.  So, write the directive like the following:
-
-	path certificate "/etc/racoon";
-
-Next, you need to specify the host's own private key and the public
-keys of all the remote peers involved. For your local private key and 
-remote public key(s), you should use the following directives:
-
-	certificate_type plain_rsa "/etc/racoon/boston.priv";
-	peers_certfile plain_rsa "/etc/racoon/chicago.pub";
-
-Notice the option "plain_rsa" for both directives.
-
-Finally, under the "proposal" statement section, you should specify
-the "rsasig" option for "authentication_method".
-
-5)  You have finished configuring the host for RSA authentication.
-Now use racoonctl to reload the configuration or simply restart the
-machine and you should be all set.
-
-TROUBLESHOOTING
-
-In the event that the hosts fail to communicate, first go back to the
-instructions above and make sure that:
-
-1)  You have placed all the keys in the directory that is specified by
-the "path certificate" directive.  Keep in mind that privilege
-separation will force racoon to look into that directory and nowhere
-else.
-2)  You have specified correctly the host's own private key and the
-remote peer's public key.
-3)  You have specified the "rsasig" method for authentication in the
-proposal statement.
-
-If you run into any further problems, you should try to use "racoon
--v" to debug the setup, and send a copy of the debug messages to the
-mailing list so that we can help you determine what the problem is.
-
-Last modified: $Date: 2006/12/10 05:51:14 $
diff --git a/src/racoon/dump.h b/src/racoon/dump.h
deleted file mode 100644
index 3e8a5df..0000000
--- a/src/racoon/dump.h
+++ /dev/null
@@ -1,41 +0,0 @@
-/*	$NetBSD: dump.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/* Id: dump.h,v 1.3 2004/06/11 16:00:16 ludvigm Exp */
-
-/*
- * Copyright (C) 2000 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _DUMP_H
-#define _DUMP_H
-
-extern int isakmp_dump_open __P((char *));
-extern int isakmp_dump_close __P((void));
-extern int isakmp_dump __P((vchar_t *, struct sockaddr *, struct sockaddr *));
-
-#endif /* _DUMP_H */
diff --git a/src/racoon/eaytest.c b/src/racoon/eaytest.c
deleted file mode 100644
index 323ecef..0000000
--- a/src/racoon/eaytest.c
+++ /dev/null
@@ -1,1068 +0,0 @@
-/*	$NetBSD: eaytest.c,v 1.7.6.2 2008/07/15 00:55:48 mgrooms Exp $	*/
-
-/* Id: eaytest.c,v 1.22 2005/06/19 18:02:54 manubsd Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <sys/socket.h>
-
-#include <netinet/in.h>
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <limits.h>
-#include <dirent.h>
-#include <fcntl.h>
-#include <unistd.h>
-#include <err.h>
-
-#include <openssl/bio.h>
-#include <openssl/pem.h>
-
-#include "var.h"
-#include "vmbuf.h"
-#include "misc.h"
-#include "debug.h"
-#include "str2val.h"
-#include "plog.h"
-
-#include "oakley.h"
-#include "dhgroup.h"
-#include "crypto_openssl.h"
-#include "gnuc.h"
-
-#include "package_version.h"
-
-#define PVDUMP(var) racoon_hexdump((var)->v, (var)->l)
-
-/*#define CERTTEST_BROKEN */
-
-/* prototype */
-
-static vchar_t *pem_read_buf __P((char *));
-void Usage __P((void));
-
-int rsatest __P((int, char **));
-int ciphertest __P((int, char **));
-int hmactest __P((int, char **));
-int sha1test __P((int, char **));
-int md5test __P((int, char **));
-int dhtest __P((int, char **));
-int bntest __P((int, char **));
-#ifndef CERTTEST_BROKEN
-static char **getcerts __P((char *));
-int certtest __P((int, char **));
-#endif
-
-/* test */
-
-static int
-rsa_verify_with_pubkey(src, sig, pubkey_txt)
-	vchar_t *src, *sig;
-	char *pubkey_txt;
-{
-	BIO *bio;
-	EVP_PKEY *evp;
-	int error;
-
-	bio = BIO_new_mem_buf(pubkey_txt, strlen(pubkey_txt));
-	evp = PEM_read_bio_PUBKEY(bio, NULL, NULL, NULL);
-	if (! evp) {
-		printf ("PEM_read_PUBKEY(): %s\n", eay_strerror());
-		return -1;
-	}
-	error = eay_check_rsasign(src, sig, evp->pkey.rsa);
-
-	return error;
-}
-
-int
-rsatest(ac, av)
-	int ac;
-	char **av;
-{
-	char *text = "this is test.";
-	vchar_t src;
-	vchar_t *priv, *sig;
-	int loglevel_saved;
-
-	char *pkcs1 =
-"-----BEGIN RSA PRIVATE KEY-----\n"
-"MIICXQIBAAKBgQChe5/Fzk9SA0vCKBOcu9jBcLb9oLv50PeuEfQojhakY+OH8A3Q\n"
-"M8A0qIDG6uhTNGPvzCWb/+mKeOB48n5HJpLxlDFyP3kyd2yXHIZ/MN8g1nh4FsB0\n"
-"iTkk8QUCJkkan6FCOBrIeLEsGA5AdodzuR+khnCMt8vO+NFHZYKAQeynyQIDAQAB\n"
-"AoGAOfDcnCHxjhDGrwyoNNWl6Yqi7hAtQm67YAbrH14UO7nnmxAENM9MyNgpFLaW\n"
-"07v5m8IZQIcradcDXAJOUwNBN8E06UflwEYCaScIwndvr5UpVlN3e2NC6Wyg2yC7\n"
-"GarxQput3zj35XNR5bK42UneU0H6zDxpHWqI1SwE+ToAHu0CQQDNl9gUJTpg0L09\n"
-"HkbE5jeb8bA5I20nKqBOBP0v5tnzpwu41umQwk9I7Ru0ucD7j+DW4k8otadW+FnI\n"
-"G1M1MpSjAkEAyRMt4bN8otfpOpsOQWzw4jQtouohOxRFCrQTntHhU20PrQnQLZWs\n"
-"pOVzqCjRytYtkPEUA1z8QK5gGcVPcOQsowJBALmt2rwPB1NrEo5Bat7noO+Zb3Ob\n"
-"WDiYWeE8xkHd95gDlSWiC53ur9aINo6ZeP556jGIgL+el/yHHecJLrQL84sCQH48\n"
-"zUxq/C/cb++8UzneJGlPqusiJNTLiAENR1gpmlZfHT1c8Nb9phMsfu0vG29GAfuC\n"
-"bzchVLljALCNQK+2gRMCQQCNIgN+R9mRWZhFAcC1sq++YnuSBlw4VwdL/fd1Yg9e\n"
-"Ul+U98yPl/NXt8Rs4TRBFcOZjkFI8xv0hQtevTgTmgz+\n"
-"-----END RSA PRIVATE KEY-----\n\n";
-	char *pubkey =
-"-----BEGIN PUBLIC KEY-----\n"
-"MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQChe5/Fzk9SA0vCKBOcu9jBcLb9\n"
-"oLv50PeuEfQojhakY+OH8A3QM8A0qIDG6uhTNGPvzCWb/+mKeOB48n5HJpLxlDFy\n"
-"P3kyd2yXHIZ/MN8g1nh4FsB0iTkk8QUCJkkan6FCOBrIeLEsGA5AdodzuR+khnCM\n"
-"t8vO+NFHZYKAQeynyQIDAQAB\n"
-"-----END PUBLIC KEY-----\n\n";
-	char *pubkey_wrong = 
-"-----BEGIN PUBLIC KEY-----\n"
-"MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwDncG2tSokRBhK8la1mO\n"
-"QnUpxg6KvpoFUjEyRiIE1GRap5V6jCCEOmA9ZAz4Oa/97oxewwMWtchIxSBZVCia\n"
-"H9oGasbOFzrtSR+MKl6Cb/Ow3Fu+PKbHTsnfTk/nOOWyaQh91PRD7fdwHe8L9P7w\n"
-"2kFPmDW6+RNKIR4OErhXf1O0eSShPe0TO3vx43O7dWqhmh3Kgr4Jq7zAGqHtwu0B\n"
-"RFZnmsocOnVZb2yAHndp51/Mk1H37ThHwN7qMx7RqrS3ru3XtchpJd9IQJPBIRfY\n"
-"VYQ68u5ix/Z80Y6VkRf0qnAvel8B6D3N3Zyq5u7G60PfvvtCybeMn7nVrSMxqMW/\n"
-"xwIDAQAB\n"
-"-----END PUBLIC KEY-----\n\n";
-
-	printf ("%s", pkcs1);
-	printf ("%s", pubkey);
-	priv = pem_read_buf(pkcs1);
-
-	src.v = text;
-	src.l = strlen(text);
-
-	/* sign */
-	sig = eay_get_x509sign(&src, priv);
-	if (sig == NULL) {
-		printf("sign failed. %s\n", eay_strerror());
-		return -1;
-	}
-
-	printf("RSA signed data.\n");
-	PVDUMP(sig);
-
-	printf("Verification with correct pubkey: ");
-	if (rsa_verify_with_pubkey (&src, sig, pubkey) != 0) {
-		printf ("Failed.\n");
-		return -1;
-	}
-	else
-		printf ("Verified. Good.\n");
-
-	loglevel_saved = loglevel;
-	loglevel = 0;
-	printf("Verification with wrong pubkey: ");
-	if (rsa_verify_with_pubkey (&src, sig, pubkey_wrong) != 0)
-		printf ("Not verified. Good.\n");
-	else {
-		printf ("Verified. This is bad...\n");
-		loglevel = loglevel_saved;
-		return -1;
-	}
-	loglevel = loglevel_saved;
-
-	return 0;
-}
-
-static vchar_t *
-pem_read_buf(buf)
-	char *buf;
-{
-	BIO *bio;
-	char *nm = NULL, *header = NULL;
-	unsigned char *data = NULL;
-	long len;
-	vchar_t *ret;
-	int error;
-
-	bio = BIO_new_mem_buf(buf, strlen(buf));
-	error = PEM_read_bio(bio, &nm, &header, &data, &len);
-	if (error == 0)
-		errx(1, "%s", eay_strerror());
-	ret = vmalloc(len);
-	if (ret == NULL)
-		err(1, "vmalloc");
-	memcpy(ret->v, data, len);
-
-	return ret;
-}
-
-#ifndef CERTTEST_BROKEN
-int
-certtest(ac, av)
-	int ac;
-	char **av;
-{
-	char *certpath;
-	char **certs;
-	int type;
-	int error;
-
-	printf("\n**Test for Certificate.**\n");
-
-    {
-	vchar_t *asn1dn = NULL, asn1dn0;
-#ifdef ORIG_DN
-	char dnstr[] = "C=JP, ST=Kanagawa, L=Fujisawa, O=WIDE Project, OU=KAME Project, CN=Shoichi Sakane/Email=sakane@kame.net";
-	char *dnstr_w1 = NULL;
-	char *dnstr_w2 = NULL;
-	char dn0[] = {
-		0x30,0x81,0x9a,0x31,0x0b,0x30,0x09,0x06,
-		0x03,0x55,0x04,0x06,0x13,0x02,0x4a,0x50,
-		0x31,0x11,0x30,0x0f,0x06,0x03,0x55,0x04,
-		0x08,0x13,0x08,0x4b,0x61,0x6e,0x61,0x67,
-		0x61,0x77,0x61,0x31,0x11,0x30,0x0f,0x06,
-		0x03,0x55,0x04,0x07,0x13,0x08,0x46,0x75,
-		0x6a,0x69,0x73,0x61,0x77,0x61,0x31,0x15,
-		0x30,0x13,0x06,0x03,0x55,0x04,0x0a,0x13,
-		0x0c,0x57,0x49,0x44,0x45,0x20,0x50,0x72,
-		0x6f,0x6a,0x65,0x63,0x74,0x31,0x15,0x30,
-		0x13,0x06,0x03,0x55,0x04,0x0b,0x13,0x0c,
-		0x4b,0x41,0x4d,0x45,0x20,0x50,0x72,0x6f,
-		0x6a,0x65,0x63,0x74,0x31,0x17,0x30,0x15,
-		0x06,0x03,0x55,0x04,0x03,0x13,0x0e,0x53,
-		0x68,0x6f,0x69,0x63,0x68,0x69,0x20,0x53,
-		0x61,0x6b,0x61,0x6e,0x65,0x31,0x1e,0x30,
-		0x1c,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,
-		0x0d,0x01,0x09,0x01,
-		0x0c,	/* <== XXX */
-		0x0f,0x73,0x61,
-		0x6b,0x61,0x6e,0x65,0x40,0x6b,0x61,0x6d,
-		0x65,0x2e,0x6e,0x65,0x74,
-	};
-#else /* not ORIG_DN */
-	char dnstr[] = "C=JP, ST=Kanagawa, L=Fujisawa, O=WIDE Project, OU=KAME Project, CN=Shoichi Sakane";
-	char dnstr_w1[] = "C=JP, ST=Kanagawa, L=Fujisawa, O=WIDE Project, OU=*, CN=Shoichi Sakane";
-	char dnstr_w2[] = "C=JP, ST=Kanagawa, L=Fujisawa, O=WIDE Project, OU=KAME Project, CN=*";
-	char dn0[] = {
-		0x30,0x7a,0x31,0x0b,0x30,0x09,0x06,0x03,
-		0x55,0x04,0x06,0x13,0x02,0x4a,0x50,0x31,
-		0x11,0x30,0x0f,0x06,0x03,0x55,0x04,0x08,
-		0x13,0x08,0x4b,0x61,0x6e,0x61,0x67,0x61,
-		0x77,0x61,0x31,0x11,0x30,0x0f,0x06,0x03,
-		0x55,0x04,0x07,0x13,0x08,0x46,0x75,0x6a,
-		0x69,0x73,0x61,0x77,0x61,0x31,0x15,0x30,
-		0x13,0x06,0x03,0x55,0x04,0x0a,0x13,0x0c,
-		0x57,0x49,0x44,0x45,0x20,0x50,0x72,0x6f,
-		0x6a,0x65,0x63,0x74,0x31,0x15,0x30,0x13,
-		0x06,0x03,0x55,0x04,0x0b,0x13,0x0c,0x4b,
-		0x41,0x4d,0x45,0x20,0x50,0x72,0x6f,0x6a,
-		0x65,0x63,0x74,0x31,0x17,0x30,0x15,0x06,
-		0x03,0x55,0x04,0x03,0x13,0x0e,0x53,0x68,
-		0x6f,0x69,0x63,0x68,0x69,0x20,0x53,0x61,
-		0x6b,0x61,0x6e,0x65,
-	};
-#endif /* ORIG_DN */
-
-	printf("check to convert the string into subjectName.\n");
-	printf("%s\n", dnstr);
-
-	asn1dn0.v = dn0;
-	asn1dn0.l = sizeof(dn0);
-
-	asn1dn = eay_str2asn1dn(dnstr, strlen(dnstr));
-	if (asn1dn == NULL || asn1dn->l != asn1dn0.l)
-#ifdef OUTPUT_VALID_ASN1DN
-	{
-		unsigned char *cp; int  i;
-		printf("asn1dn length mismatched (%zu != %zu).\n", asn1dn ? asn1dn->l : -1, asn1dn0.l);
-		for (cp = asn1dn->v, i = 0; i < asn1dn->l; i++)
-		    printf ("0x%02x,", *cp++);
-		exit (1);
-	}
-#else
-		errx(1, "asn1dn length mismatched (%zu != %zu).\n", asn1dn ? asn1dn->l : -1, asn1dn0.l);
-#endif
-
-	/*
-	 * NOTE: The value pointed by "<==" above is different from the
-	 * return of eay_str2asn1dn().  but eay_cmp_asn1dn() can distinguish
-	 * both of the names are same name.
-	 */
-	if (eay_cmp_asn1dn(&asn1dn0,  asn1dn))
-		errx(1, "asn1dn mismatched.\n");
-	vfree(asn1dn);
-
-	printf("exact match: succeed.\n");
-
-	if (dnstr_w1 != NULL) {
-		asn1dn = eay_str2asn1dn(dnstr_w1, strlen(dnstr_w1));
-		if (asn1dn == NULL || asn1dn->l == asn1dn0.l)
-			errx(1, "asn1dn length wrong for wildcard 1\n");
-		if (eay_cmp_asn1dn(&asn1dn0,  asn1dn))
-			errx(1, "asn1dn mismatched for wildcard 1.\n");
-		vfree(asn1dn);
-		printf("wildcard 1 match: succeed.\n");
-	}
-
-	if (dnstr_w1 != NULL) {
-		asn1dn = eay_str2asn1dn(dnstr_w2, strlen(dnstr_w2));
-		if (asn1dn == NULL || asn1dn->l == asn1dn0.l)
-			errx(1, "asn1dn length wrong for wildcard 2\n");
-		if (eay_cmp_asn1dn(&asn1dn0,  asn1dn))
-			errx(1, "asn1dn mismatched for wildcard 2.\n");
-		vfree(asn1dn);
-		printf("wildcard 2 match: succeed.\n");
-	}
-
-    }
-	eay_init();
-
-	/* get certs */
-	if (ac > 1) {
-		certpath = *(av + 1);
-		certs = getcerts(certpath);
-	} else {
-#ifdef ORIG_DN
-		printf("\nCAUTION: These certificates are probably invalid "
-			"on your environment because you don't have their "
-			"issuer's certs in your environment.\n\n");
-
-		certpath = "/usr/local/openssl/certs";
-		certs = getcerts(NULL);
-#else
-		printf("\nWARNING: The main certificates are probably invalid "
-			"on your environment\nbecause you don't have their "
-			"issuer's certs in your environment\nso not doing "
-			"this test.\n\n");
-		return (0);
-#endif
-	}
-
-	while (*certs != NULL) {
-
-		vchar_t c;
-		char *str;
-		vchar_t *vstr;
-
-		printf("===CERT===\n");
-
-		c.v = *certs;
-		c.l = strlen(*certs);
-
-		/* print text */
-		str = eay_get_x509text(&c);
-		printf("%s", str);
-		racoon_free(str);
-
-		/* print ASN.1 of subject name */
-		vstr = eay_get_x509asn1subjectname(&c);
-		if (!vstr)
-			return 0;
-		PVDUMP(vstr);
-		printf("\n");
-		vfree(vstr);
-
-		/* print subject alt name */
-	    {
-		int pos;
-		for (pos = 1; ; pos++) {
-			error = eay_get_x509subjectaltname(&c, &str, &type, pos);
-			if (error) {
-				printf("no subjectaltname found.\n");
-				break;
-			}
-			if (!str)
-				break;
-			printf("SubjectAltName: %d: %s\n", type, str);
-			racoon_free(str);
-		}
-	    }
-
-		/* NULL => name of the certificate file */
-		error = eay_check_x509cert(&c, certpath, NULL, 1);
-		if (error)
-			printf("ERROR: cert is invalid.\n");
-		printf("\n");
-
-		certs++;
-	}
-	return 0;
-}
-
-static char **
-getcerts(path)
-	char *path;
-{
-	char **certs = NULL, **p;
-	DIR *dirp;
-	struct dirent *dp;
-	struct stat sb;
-	char buf[512];
-	int len;
-	int n;
-	int fd;
-
-	static char *samplecerts[] = {
-/* self signed */
-"-----BEGIN CERTIFICATE-----\n"
-"MIICpTCCAg4CAQAwDQYJKoZIhvcNAQEEBQAwgZoxCzAJBgNVBAYTAkpQMREwDwYD\n"
-"VQQIEwhLYW5hZ2F3YTERMA8GA1UEBxMIRnVqaXNhd2ExFTATBgNVBAoTDFdJREUg\n"
-"UHJvamVjdDEVMBMGA1UECxMMS0FNRSBQcm9qZWN0MRcwFQYDVQQDEw5TaG9pY2hp\n"
-"IFNha2FuZTEeMBwGCSqGSIb3DQEJARYPc2FrYW5lQGthbWUubmV0MB4XDTAwMDgy\n"
-"NDAxMzc0NFoXDTAwMDkyMzAxMzc0NFowgZoxCzAJBgNVBAYTAkpQMREwDwYDVQQI\n"
-"EwhLYW5hZ2F3YTERMA8GA1UEBxMIRnVqaXNhd2ExFTATBgNVBAoTDFdJREUgUHJv\n"
-"amVjdDEVMBMGA1UECxMMS0FNRSBQcm9qZWN0MRcwFQYDVQQDEw5TaG9pY2hpIFNh\n"
-"a2FuZTEeMBwGCSqGSIb3DQEJARYPc2FrYW5lQGthbWUubmV0MIGfMA0GCSqGSIb3\n"
-"DQEBAQUAA4GNADCBiQKBgQCpIQG/H3zn4czAmPBcbkDrYxE1A9vcpghpib3Of0Op\n"
-"SsiWIBOyIMiVAzK/I/JotWp3Vdn5fzGp/7DGAbWXAALas2xHkNmTMPpu6qhmNQ57\n"
-"kJHZHal24mgc1hwbrI9fb5olvIexx9a1riNPnKMRVHzXYizsyMbf+lJJmZ8QFhWN\n"
-"twIDAQABMA0GCSqGSIb3DQEBBAUAA4GBACKs6X/BYycuHI3iop403R3XWMHHnNBN\n"
-"5XTHVWiWgR1cMWkq/dp51gn+nPftpdAaYGpqGkiHGhZcXLoBaX9uON3p+7av+sQN\n"
-"plXwnvUf2Zsgu+fojskS0gKcDlYiq1O8TOaBgJouFZgr1q6PiYjVEJGogAP28+HN\n"
-"M4o+GBFbFoqK\n"
-"-----END CERTIFICATE-----\n\n",
-/* signed by SSH testing CA + CA1 + CA2 */
-"-----BEGIN X509 CERTIFICATE-----\n"
-"MIICtTCCAj+gAwIBAgIEOaR8NjANBgkqhkiG9w0BAQUFADBjMQswCQYDVQQGEwJG\n"
-"STEkMCIGA1UEChMbU1NIIENvbW11bmljYXRpb25zIFNlY3VyaXR5MREwDwYDVQQL\n"
-"EwhXZWIgdGVzdDEbMBkGA1UEAxMSVGVzdCBDQSAxIHN1YiBjYSAyMB4XDTAwMDgy\n"
-"NDAwMDAwMFoXDTAwMTAwMTAwMDAwMFowgZoxCzAJBgNVBAYTAkpQMREwDwYDVQQI\n"
-"EwhLYW5hZ2F3YTERMA8GA1UEBxMIRnVqaXNhd2ExFTATBgNVBAoTDFdJREUgUHJv\n"
-"amVjdDEVMBMGA1UECxMMS0FNRSBQcm9qZWN0MRcwFQYDVQQDEw5TaG9pY2hpIFNh\n"
-"a2FuZTEeMBwGCSqGSIb3DQEJAQwPc2FrYW5lQGthbWUubmV0MIGfMA0GCSqGSIb3\n"
-"DQEBAQUAA4GNADCBiQKBgQCpIQG/H3zn4czAmPBcbkDrYxE1A9vcpghpib3Of0Op\n"
-"SsiWIBOyIMiVAzK/I/JotWp3Vdn5fzGp/7DGAbWXAALas2xHkNmTMPpu6qhmNQ57\n"
-"kJHZHal24mgc1hwbrI9fb5olvIexx9a1riNPnKMRVHzXYizsyMbf+lJJmZ8QFhWN\n"
-"twIDAQABo18wXTALBgNVHQ8EBAMCBaAwGgYDVR0RBBMwEYEPc2FrYW5lQGthbWUu\n"
-"bmV0MDIGA1UdHwQrMCkwJ6AloCOGIWh0dHA6Ly9sZGFwLnNzaC5maS9jcmxzL2Nh\n"
-"MS0yLmNybDANBgkqhkiG9w0BAQUFAANhADtaqual41OWshF/rwCTuR6zySBJysGp\n"
-"+qjkp5efCiYKhAu1L4WXlMsV/SNdzspui5tHasPBvUw8gzFsU/VW/B2zuQZkimf1\n"
-"u6ZPjUb/vt8vLOPScP5MeH7xrTk9iigsqQ==\n"
-"-----END X509 CERTIFICATE-----\n\n",
-/* VP100 */
-"-----BEGIN CERTIFICATE-----\n"
-"MIICXzCCAcigAwIBAgIEOXGBIzANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJG\n"
-"STEkMCIGA1UEChMbU1NIIENvbW11bmljYXRpb25zIFNlY3VyaXR5MREwDwYDVQQL\n"
-"EwhXZWIgdGVzdDESMBAGA1UEAxMJVGVzdCBDQSAxMB4XDTAwMDcxNjAwMDAwMFoX\n"
-"DTAwMDkwMTAwMDAwMFowNTELMAkGA1UEBhMCanAxETAPBgNVBAoTCHRhaGl0ZXN0\n"
-"MRMwEQYDVQQDEwpmdXJ1a2F3YS0xMIGdMA0GCSqGSIb3DQEBAQUAA4GLADCBhwKB\n"
-"gQDUmI2RaAuoLvtRDbASwRhbkj/Oq0BBIKgAqbFknc/EanJSQwZQu82gD88nf7gG\n"
-"VEioWmKPLDuEjz5JCuM+k5f7HYHI1wWmz1KFr7UA+avZm4Kp6YKnhuH7soZp7kBL\n"
-"hTiZEpL0jdmCWLW3ZXoro55rmPrBsCd+bt8VU6tRZm5dUwIBKaNZMFcwCwYDVR0P\n"
-"BAQDAgWgMBYGA1UdEQQPMA2CBVZQMTAwhwQKFIaFMDAGA1UdHwQpMCcwJaAjoCGG\n"
-"H2h0dHA6Ly9sZGFwLnNzaC5maS9jcmxzL2NhMS5jcmwwDQYJKoZIhvcNAQEFBQAD\n"
-"gYEAKJ/2Co/KYW65mwpGG3CBvsoRL8xyUMHGt6gQpFLHiiHuAdix1ADTL6uoFuYi\n"
-"4sE5omQm1wKVv2ZhS03zDtUfKoVEv0HZ7IY3AU/FZT/M5gQvbt43Dki/ma3ock2I\n"
-"PPhbLsvXm+GCVh3jvkYGk1zr7VERVeTPtmT+hW63lcxfFp4=\n"
-"-----END CERTIFICATE-----\n\n",
-/* IKED */
-"-----BEGIN CERTIFICATE-----\n"
-"MIIEFTCCA7+gAwIBAgIKYU5X6AAAAAAACTANBgkqhkiG9w0BAQUFADCBljEpMCcG\n"
-"CSqGSIb3DQEJARYaeS13YXRhbmFAc2RsLmhpdGFjaGkuY28uanAxCzAJBgNVBAYT\n"
-"AkpQMREwDwYDVQQIEwhLQU5BR0FXQTERMA8GA1UEBxMIWW9rb2hhbWExEDAOBgNV\n"
-"BAoTB0hJVEFDSEkxDDAKBgNVBAsTA1NETDEWMBQGA1UEAxMNSVBzZWMgVGVzdCBD\n"
-"QTAeFw0wMDA3MTUwMjUxNDdaFw0wMTA3MTUwMzAxNDdaMEUxCzAJBgNVBAYTAkpQ\n"
-"MREwDwYDVQQIEwhLQU5BR0FXQTEQMA4GA1UEChMHSElUQUNISTERMA8GA1UEAxMI\n"
-"V0FUQU5BQkUwXDANBgkqhkiG9w0BAQEFAANLADBIAkEA6Wja5A7Ldzrtx+rMWHEB\n"
-"Cyt+/ZoG0qdFQbuuUiU1vOSq+1f+ZSCYAdTq13Lrr6Xfz3jDVFEZLPID9PSTFwq+\n"
-"yQIDAQABo4ICPTCCAjkwDgYDVR0PAQH/BAQDAgTwMBMGA1UdJQQMMAoGCCsGAQUF\n"
-"CAICMB0GA1UdDgQWBBTkv7/MH5Ra+S1zBAmnUIH5w8ZTUTCB0gYDVR0jBIHKMIHH\n"
-"gBQsF2qoaTl5F3GFLKrttaxPJ8j4faGBnKSBmTCBljEpMCcGCSqGSIb3DQEJARYa\n"
-"eS13YXRhbmFAc2RsLmhpdGFjaGkuY28uanAxCzAJBgNVBAYTAkpQMREwDwYDVQQI\n"
-"EwhLQU5BR0FXQTERMA8GA1UEBxMIWW9rb2hhbWExEDAOBgNVBAoTB0hJVEFDSEkx\n"
-"DDAKBgNVBAsTA1NETDEWMBQGA1UEAxMNSVBzZWMgVGVzdCBDQYIQeccIf4GYDIBA\n"
-"rS6HSUt8XjB7BgNVHR8EdDByMDagNKAyhjBodHRwOi8vZmxvcmEyMjAvQ2VydEVu\n"
-"cm9sbC9JUHNlYyUyMFRlc3QlMjBDQS5jcmwwOKA2oDSGMmZpbGU6Ly9cXGZsb3Jh\n"
-"MjIwXENlcnRFbnJvbGxcSVBzZWMlMjBUZXN0JTIwQ0EuY3JsMIGgBggrBgEFBQcB\n"
-"AQSBkzCBkDBFBggrBgEFBQcwAoY5aHR0cDovL2Zsb3JhMjIwL0NlcnRFbnJvbGwv\n"
-"ZmxvcmEyMjBfSVBzZWMlMjBUZXN0JTIwQ0EuY3J0MEcGCCsGAQUFBzAChjtmaWxl\n"
-"Oi8vXFxmbG9yYTIyMFxDZXJ0RW5yb2xsXGZsb3JhMjIwX0lQc2VjJTIwVGVzdCUy\n"
-"MENBLmNydDANBgkqhkiG9w0BAQUFAANBAG8yZAWHb6g3zba453Hw5loojVDZO6fD\n"
-"9lCsyaxeo9/+7x1JEEcdZ6qL7KKqe7ZBwza+hIN0ITkp2WEWo22gTz4=\n"
-"-----END CERTIFICATE-----\n\n",
-/* From Entrust */
-"-----BEGIN CERTIFICATE-----\n"
-"MIIDXTCCAsagAwIBAgIEOb6khTANBgkqhkiG9w0BAQUFADA4MQswCQYDVQQGEwJV\n"
-"UzEQMA4GA1UEChMHRW50cnVzdDEXMBUGA1UECxMOVlBOIEludGVyb3AgUk8wHhcN\n"
-"MDAwOTE4MjMwMDM3WhcNMDMwOTE4MjMzMDM3WjBTMQswCQYDVQQGEwJVUzEQMA4G\n"
-"A1UEChMHRW50cnVzdDEXMBUGA1UECxMOVlBOIEludGVyb3AgUk8xGTAXBgNVBAMT\n"
-"EFNob2ljaGkgU2FrYW5lIDIwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAKj3\n"
-"eXSt1qXxFXzpa265B/NQYk5BZN7pNJg0tlTKBTVV3UgpQ92Bx5DoNfZh11oIv0Sw\n"
-"6YnG5p9F9ma36U9HDoD3hVTjAvQKy4ssCsnU1y6v5XOU1QvYQo6UTzgsXUTaIau4\n"
-"Lrccl+nyoiNzy3lG51tLR8CxuA+3OOAK9xPjszClAgMBAAGjggFXMIIBUzBABgNV\n"
-"HREEOTA3gQ9zYWthbmVAa2FtZS5uZXSHBM6vIHWCHjIwNi0xNzUtMzItMTE3LnZw\n"
-"bndvcmtzaG9wLmNvbTATBgNVHSUEDDAKBggrBgEFBQgCAjALBgNVHQ8EBAMCAKAw\n"
-"KwYDVR0QBCQwIoAPMjAwMDA5MTgyMzAwMzdagQ8yMDAyMTAyNTExMzAzN1owWgYD\n"
-"VR0fBFMwUTBPoE2gS6RJMEcxCzAJBgNVBAYTAlVTMRAwDgYDVQQKEwdFbnRydXN0\n"
-"MRcwFQYDVQQLEw5WUE4gSW50ZXJvcCBSTzENMAsGA1UEAxMEQ1JMMTAfBgNVHSME\n"
-"GDAWgBTzVmhu0tBoWKwkZE5mXpooE9630DAdBgNVHQ4EFgQUEgBHPtXggJqei5Xz\n"
-"92CrWXTJxfAwCQYDVR0TBAIwADAZBgkqhkiG9n0HQQAEDDAKGwRWNS4wAwIEsDAN\n"
-"BgkqhkiG9w0BAQUFAAOBgQCIFriNGMUE8GH5LuDrTJfA8uGx8vLy2seljuo694TR\n"
-"et/ojp9QnfOJ1PF9iAdGaEaSLfkwhY4fZNZzxic5HBoHLeo9BXLP7i7FByXjvOZC\n"
-"Y8++0dC8NVvendIILcJBM5nbDq1TqIbb8K3SP80XhO5JLVJkoZiQftAMjo0peZPO\n"
-"EQ==\n"
-"-----END CERTIFICATE-----\n\n",
-	NULL,
-	};
-
-	if (path == NULL)
-		return (char **)&samplecerts;
-
-	stat(path, &sb);
-	if (!(sb.st_mode & S_IFDIR)) {
-		printf("ERROR: %s is not directory.\n", path);
-		exit(0);
-	}
-
-	dirp = opendir(path);
-	if (dirp == NULL) {
-		printf("opendir failed.\n");
-		exit(0);
-	}
-
-	n = 0;
-	while ((dp = readdir(dirp)) != NULL) {
-		if (dp->d_type != DT_REG)
-			continue;
-		if (strcmp(dp->d_name + strlen(dp->d_name) - 4, "cert"))
-			continue;
-		snprintf(buf, sizeof(buf), "%s/%s", path, dp->d_name);
-		stat(buf, &sb);
-
-		p = (char **)realloc(certs, (n + 1) * sizeof(certs));
-		if (p == NULL)
-			err(1, "realloc");
-		certs = p;
-
-		certs[n] = malloc(sb.st_size + 1);
-		if (certs[n] == NULL)
-			err(1, "malloc");
-
-		fd = open(buf, O_RDONLY);
-		if (fd == -1)
-			err(1, "open");
-		len = read(fd, certs[n], sb.st_size);
-		if (len == -1)
-			err(1, "read");
-		if (len != sb.st_size)
-			errx(1, "read: length mismatch");
-		certs[n][sb.st_size] = '\0';
-		close(fd);
-
-		printf("%s: %d\n", dp->d_name, (int)sb.st_size);
-
-		n++;
-	}
-
-	p = (char **)realloc(certs, (n + 1) * sizeof(certs));
-	if (p == NULL)
-		err(1, "realloc");
-	certs = p;
-	certs[n] = NULL;
-
-	return certs;
-}
-#endif /* CERTTEST_BROKEN */
-
-typedef vchar_t* (eay_func) (vchar_t *, vchar_t *, vchar_t *);
-
-static int 
-ciphertest_1 (const char *name,
-	      vchar_t *data,
-	      size_t data_align,
-	      vchar_t *key,
-	      size_t min_keysize,
-	      vchar_t *iv0,
-	      size_t iv_length,
-	      eay_func encrypt,
-	      eay_func decrypt)
-{
-	int padlen;
-	vchar_t *buf, *iv, *res1, *res2;
-	iv = vmalloc(iv_length);
-	
-	printf("Test for cipher %s\n", name);
-	printf("data:\n");
-	PVDUMP(data);
-
-	if (data_align <= 1 || (data->l % data_align) == 0)
-	  padlen = 0;
-	else
-	  padlen = data_align - data->l % data_align;
-
-	buf = vmalloc(data->l + padlen);
-	memcpy(buf->v, data->v, data->l);
-
-	memcpy(iv->v, iv0->v, iv_length);
-	res1 = (encrypt)(buf, key, iv);
-	if (res1 == NULL) {
-		printf("%s encryption failed.\n", name);
-		return -1;
-	}
-	printf("encrypted:\n");
-	PVDUMP(res1);
-
-	memcpy(iv->v, iv0->v, iv_length);
-	res2 = (decrypt)(res1, key, iv);
-	if (res2 == NULL) {
-		printf("%s decryption failed.\n", name);
-		return -1;
-	}
-	printf("decrypted:\n");
-	PVDUMP(res2);
-
-	if (memcmp(data->v, res2->v, data->l)) {
-		printf("XXXX NG (%s) XXXX\n", name);
-		return -1;
-	}
-	else
-		printf("%s cipher verified.\n", name);
-	vfree(res1);
-	vfree(res2);
-	vfree(buf);
-	vfree(iv);
-
-	return 0;
-}
-
-int
-ciphertest(ac, av)
-	int ac;
-	char **av;
-{
-	vchar_t data;
-	vchar_t key;
-	vchar_t iv0;
-
-	printf("\n**Testing CIPHERS**\n");
-
-	data.v = str2val("\
-06000017 03000000 73616b61 6e65406b 616d652e 6e657409 0002c104 308202b8 \
-04f05a90 \
-	", 16, &data.l);
-	key.v = str2val("f59bd70f 81b9b9cc 2a32c7fd 229a4b37", 16, &key.l);
-	iv0.v = str2val("26b68c90 9467b4ab 7ec29fa0 0b696b55", 16, &iv0.l);
-
-	if (ciphertest_1 ("DES", 
-			  &data, 8, 
-			  &key, 8, 
-			  &iv0, 8, 
-			  eay_des_encrypt, eay_des_decrypt) < 0)
-	  return -1;
-	
-	if (ciphertest_1 ("3DES",
-			  &data, 8,
-			  &key, 24,
-			  &iv0, 8,
-			  eay_3des_encrypt, eay_3des_decrypt) < 0)
-	  return -1;
-	
-	if (ciphertest_1 ("AES",
-			  &data, 16,
-			  &key, key.l,
-			  &iv0, 16,
-			  eay_aes_encrypt, eay_aes_decrypt) < 0)
-	  return -1;
-
-	if (ciphertest_1 ("BLOWFISH",
-			  &data, 8,
-			  &key, key.l,
-			  &iv0, 8,
-			  eay_bf_encrypt, eay_bf_decrypt) < 0)
-	  return -1;
-
-	if (ciphertest_1 ("CAST",
-			  &data, 8,
-			  &key, key.l,
-			  &iv0, 8,
-			  eay_cast_encrypt, eay_cast_decrypt) < 0)
-	  return -1;
-	
-#ifdef HAVE_OPENSSL_IDEA_H
-	if (ciphertest_1 ("IDEA",
-			  &data, 8,
-			  &key, key.l,
-			  &iv0, 8,
-			  eay_idea_encrypt, eay_idea_decrypt) < 0)
-	  return -1;
-#endif
-
-#ifdef HAVE_OPENSSL_RC5_H
-	if (ciphertest_1 ("RC5",
-			  &data, 8,
-			  &key, key.l,
-			  &iv0, 8,
-			  eay_rc5_encrypt, eay_rc5_decrypt) < 0)
-	  return -1;
-#endif
-#if defined(HAVE_OPENSSL_CAMELLIA_H)
-	if (ciphertest_1 ("CAMELLIA",
-			  &data, 16,
-			  &key, key.l,
-			  &iv0, 16,
-			  eay_camellia_encrypt, eay_camellia_decrypt) < 0)
-	  return -1;
-#endif
-	return 0;
-}
-
-int
-hmactest(ac, av)
-	int ac;
-	char **av;
-{
-	char *keyword = "hehehe test secret!";
-	char *object  = "d7e6a6c1876ef0488bb74958b9fee94e";
-	char *object1 = "d7e6a6c1876ef048";
-	char *object2 =                 "8bb74958b9fee94e";
-	char *r_hmd5  = "5702d7d1 fd1bfc7e 210fc9fa cda7d02c";
-	char *r_hsha1 = "309999aa 9779a43e ebdea839 1b4e7ee1 d8646874";
-#ifdef WITH_SHA2
-	char *r_hsha2 = "d47262d8 a5b6f39d d8686939 411b3e79 ed2e27f9 2c4ea89f dd0a06ae 0c0aa396";
-#endif
-	vchar_t *key, *data, *data1, *data2, *res;
-	vchar_t mod;
-	caddr_t ctx;
-
-#ifdef WITH_SHA2
-	printf("\n**Test for HMAC MD5, SHA1, and SHA256.**\n");
-#else
-	printf("\n**Test for HMAC MD5 & SHA1.**\n");
-#endif
-
-	key = vmalloc(strlen(keyword));
-	memcpy(key->v, keyword, key->l);
-
-	data = vmalloc(strlen(object));
-	data1 = vmalloc(strlen(object1));
-	data2 = vmalloc(strlen(object2));
-	memcpy(data->v, object, data->l);
-	memcpy(data1->v, object1, data1->l);
-	memcpy(data2->v, object2, data2->l);
-
-	/* HMAC MD5 */
-	printf("HMAC MD5 by eay_hmacmd5_one()\n");
-	res = eay_hmacmd5_one(key, data);
-	PVDUMP(res);
-	mod.v = str2val(r_hmd5, 16, &mod.l);
-	if (memcmp(res->v, mod.v, mod.l)) {
-		printf(" XXX NG XXX\n");
-		return -1;
-	}
-	free(mod.v);
-	vfree(res);
-
-	/* HMAC MD5 */
-	printf("HMAC MD5 by eay_hmacmd5_xxx()\n");
-	ctx = eay_hmacmd5_init(key);
-	eay_hmacmd5_update(ctx, data1);
-	eay_hmacmd5_update(ctx, data2);
-	res = eay_hmacmd5_final(ctx);
-	PVDUMP(res);
-	mod.v = str2val(r_hmd5, 16, &mod.l);
-	if (memcmp(res->v, mod.v, mod.l)) {
-		printf(" XXX NG XXX\n");
-		return -1;
-	}
-	free(mod.v);
-	vfree(res);
-
-	/* HMAC SHA1 */
-	printf("HMAC SHA1 by eay_hmacsha1_one()\n");
-	res = eay_hmacsha1_one(key, data);
-	PVDUMP(res);
-	mod.v = str2val(r_hsha1, 16, &mod.l);
-	if (memcmp(res->v, mod.v, mod.l)) {
-		printf(" XXX NG XXX\n");
-		return -1;
-	}
-	free(mod.v);
-	vfree(res);
-
-	/* HMAC SHA1 */
-	printf("HMAC SHA1 by eay_hmacsha1_xxx()\n");
-	ctx = eay_hmacsha1_init(key);
-	eay_hmacsha1_update(ctx, data1);
-	eay_hmacsha1_update(ctx, data2);
-	res = eay_hmacsha1_final(ctx);
-	PVDUMP(res);
-	mod.v = str2val(r_hsha1, 16, &mod.l);
-	if (memcmp(res->v, mod.v, mod.l)) {
-		printf(" XXX NG XXX\n");
-		return -1;
-	}
-	free(mod.v);
-	vfree(res);
-
-#ifdef WITH_SHA2
-	/* HMAC SHA2 */
-	printf("HMAC SHA2 by eay_hmacsha2_256_one()\n");
-	res = eay_hmacsha2_256_one(key, data);
-	PVDUMP(res);
-	mod.v = str2val(r_hsha2, 16, &mod.l);
-	if (memcmp(res->v, mod.v, mod.l)) {
-		printf(" XXX NG XXX\n");
-		return -1;
-	}
-	free(mod.v);
-	vfree(res);
-#endif
-
-	vfree(data);
-	vfree(data1);
-	vfree(data2);
-	vfree(key);
-
-	return 0;
-}
-
-int
-sha1test(ac, av)
-	int ac;
-	char **av;
-{
-	char *word1 = "1234567890", *word2 = "12345678901234567890";
-	caddr_t ctx;
-	vchar_t *buf, *res;
-
-	printf("\n**Test for SHA1.**\n");
-
-	ctx = eay_sha1_init();
-	buf = vmalloc(strlen(word1));
-	memcpy(buf->v, word1, buf->l);
-	eay_sha1_update(ctx, buf);
-	eay_sha1_update(ctx, buf);
-	res = eay_sha1_final(ctx);
-	PVDUMP(res);
-	vfree(res);
-	vfree(buf);
-
-	ctx = eay_sha1_init();
-	buf = vmalloc(strlen(word2));
-	memcpy(buf->v, word2, buf->l);
-	eay_sha1_update(ctx, buf);
-	res = eay_sha1_final(ctx);
-	PVDUMP(res);
-	vfree(res);
-
-	res = eay_sha1_one(buf);
-	PVDUMP(res);
-	vfree(res);
-	vfree(buf);
-
-	return 0;
-}
-
-int
-md5test(ac, av)
-	int ac;
-	char **av;
-{
-	char *word1 = "1234567890", *word2 = "12345678901234567890";
-	caddr_t ctx;
-	vchar_t *buf, *res;
-
-	printf("\n**Test for MD5.**\n");
-
-	ctx = eay_md5_init();
-	buf = vmalloc(strlen(word1));
-	memcpy(buf->v, word1, buf->l);
-	eay_md5_update(ctx, buf);
-	eay_md5_update(ctx, buf);
-	res = eay_md5_final(ctx);
-	PVDUMP(res);
-	vfree(res);
-	vfree(buf);
-
-	ctx = eay_md5_init();
-	buf = vmalloc(strlen(word2));
-	memcpy(buf->v, word2, buf->l);
-	eay_md5_update(ctx, buf);
-	res = eay_md5_final(ctx);
-	PVDUMP(res);
-	vfree(res);
-
-	res = eay_md5_one(buf);
-	PVDUMP(res);
-	vfree(res);
-	vfree(buf);
-
-	return 0;
-}
-
-int
-dhtest(ac, av)
-	int ac;
-	char **av;
-{
-	static struct {
-		char *name;
-		char *p;
-	} px[] = {
-		{ "modp768",	OAKLEY_PRIME_MODP768, },
-		{ "modp1024",	OAKLEY_PRIME_MODP1024, },
-		{ "modp1536",	OAKLEY_PRIME_MODP1536, },
-		{ "modp2048",	OAKLEY_PRIME_MODP2048, },
-		{ "modp3072",	OAKLEY_PRIME_MODP3072, },
-		{ "modp4096",	OAKLEY_PRIME_MODP4096, },
-		{ "modp6144",	OAKLEY_PRIME_MODP6144, },
-		{ "modp8192",	OAKLEY_PRIME_MODP8192, },
-	};
-	vchar_t p1, *pub1, *priv1, *gxy1;
-	vchar_t p2, *pub2, *priv2, *gxy2;
-	int i;
-
-	printf("\n**Test for DH.**\n");
-
-	for (i = 0; i < sizeof(px)/sizeof(px[0]); i++) {
-		printf("\n**Test for DH %s.**\n", px[i].name);
-
-		p1.v = str2val(px[i].p, 16, &p1.l);
-		p2.v = str2val(px[i].p, 16, &p2.l);
-		printf("prime number = \n"); PVDUMP(&p1);
-
-		if (eay_dh_generate(&p1, 2, 96, &pub1, &priv1) < 0) {
-			printf("error\n");
-			return -1;
-		}
-		printf("private key for user 1 = \n"); PVDUMP(priv1);
-		printf("public key for user 1  = \n"); PVDUMP(pub1);
-
-		if (eay_dh_generate(&p2, 2, 96, &pub2, &priv2) < 0) {
-			printf("error\n");
-			return -1;
-		}
-		printf("private key for user 2 = \n"); PVDUMP(priv2);
-		printf("public key for user 2  = \n"); PVDUMP(pub2);
-
-		/* process to generate key for user 1 */
-		gxy1 = vmalloc(p1.l);
-		memset(gxy1->v, 0, gxy1->l);
-		eay_dh_compute(&p1, 2, pub1, priv1, pub2, &gxy1);
-		printf("sharing gxy1 of user 1 = \n"); PVDUMP(gxy1);
-
-		/* process to generate key for user 2 */
-		gxy2 = vmalloc(p1.l);
-		memset(gxy2->v, 0, gxy2->l);
-		eay_dh_compute(&p2, 2, pub2, priv2, pub1, &gxy2);
-		printf("sharing gxy2 of user 2 = \n"); PVDUMP(gxy2);
-
-		if (memcmp(gxy1->v, gxy2->v, gxy1->l)) {
-			printf("ERROR: sharing gxy mismatched.\n");
-			return -1;
-		}
-
-		vfree(pub1);
-		vfree(pub2);
-		vfree(priv1);
-		vfree(priv2);
-		vfree(gxy1);
-		vfree(gxy2);
-	}
-
-	return 0;
-}
-
-int
-bntest(ac, av)
-	int ac;
-	char **av;
-{
-	vchar_t *rn;
-
-	printf("\n**Test for generate a random number.**\n");
-
-	rn = eay_set_random((u_int32_t)96);
-	PVDUMP(rn);
-	vfree(rn);
-
-	return 0;
-}
-
-struct {
-	char *name;
-	int (*func) __P((int, char **));
-} func[] = {
-	{ "random", bntest, },
-	{ "dh", dhtest, },
-	{ "md5", md5test, },
-	{ "sha1", sha1test, },
-	{ "hmac", hmactest, },
-	{ "cipher", ciphertest, },
-#ifndef CERTTEST_BROKEN
-	{ "cert", certtest, },
-#endif
-	{ "rsa", rsatest, },
-};
-
-int
-main(ac, av)
-	int ac;
-	char **av;
-{
-	int i;
-	int len = sizeof(func)/sizeof(func[0]);
-
-	f_foreground = 1;
-	ploginit();
-
-	printf ("\nTestsuite of the %s\nlinked with %s\n\n", TOP_PACKAGE_STRING, eay_version());
-
-	if (strcmp(*av, "-h") == 0)
-		Usage();
-
-	ac--;
-	av++;
-
-	for (i = 0; i < len; i++) {
-		if ((ac == 0) || (strcmp(*av, func[i].name) == 0)) {
-			if ((func[i].func)(ac, av) != 0) {
-				printf ("\n!!!!! Test '%s' failed. !!!!!\n\n", func[i].name);
-				exit(1);
-			}
-			if (ac)
-				break;
-		}
-	}
-	if (ac && i == len)
-		Usage();
-
-	printf ("\n===== All tests passed =====\n\n");
-	exit(0);
-}
-
-void
-Usage()
-{
-	int i;
-	int len = sizeof(func)/sizeof(func[0]);
-
-	printf("Usage: eaytest [");
-	for (i = 0; i < len; i++)
-		printf("%s%s", func[i].name, (i<len-1)?"|":"");
-	printf("]\n");
-#ifndef CERTTEST_BROKEN
-	printf("       eaytest cert [cert_directory]\n");
-#endif
-	exit(1);
-}
-
diff --git a/src/racoon/evt.c b/src/racoon/evt.c
deleted file mode 100644
index fc65b20..0000000
--- a/src/racoon/evt.c
+++ /dev/null
@@ -1,158 +0,0 @@
-/*	$NetBSD: evt.c,v 1.5 2006/09/09 16:22:09 manu Exp $	*/
-
-/* Id: evt.c,v 1.5 2006/06/22 20:11:35 manubsd Exp */
-
-/*
- * Copyright (C) 2004 Emmanuel Dreyfus
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <errno.h>
-#include <string.h>
-#include <stdio.h>
-#include <time.h>
-#include <unistd.h>
-#include <stdlib.h>
-#include <sys/queue.h>
-#include <sys/socket.h>
-
-#include "vmbuf.h"
-#include "plog.h"
-#include "misc.h"
-#include "admin.h"
-#include "gcmalloc.h"
-#include "evt.h"
-
-#ifdef ENABLE_ADMINPORT
-struct evtlist evtlist = TAILQ_HEAD_INITIALIZER(evtlist);
-int evtlist_len = 0;
-
-void
-evt_push(src, dst, type, optdata)
-	struct sockaddr *src;
-	struct sockaddr *dst;
-	int type;
-	vchar_t *optdata;
-{
-	struct evtdump *evtdump;
-	struct evt *evt;
-	size_t len;
-
-	/* If admin socket is disabled, silently discard anything */
-	if (adminsock_path == NULL)
-		return;
-
-	/* If we are above the limit, don't record anything */
-	if (evtlist_len > EVTLIST_MAX) {
-		plog(LLV_DEBUG, LOCATION, NULL, 
-		    "Cannot record event: event queue overflowed\n");
-		return;
-	}
-
-	/* If we hit the limit, record an overflow event instead */
-	if (evtlist_len == EVTLIST_MAX) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "Cannot record event: event queue overflow\n");
-		src = NULL;
-		dst = NULL;
-		type = EVTT_OVERFLOW;
-		optdata = NULL;
-	}
-
-	len = sizeof(*evtdump);
-	if (optdata)
-		len += optdata->l;
-
-	if ((evtdump = racoon_malloc(len)) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "Cannot record event: %s\n",
-		    strerror(errno));
-		return;
-	}
-
-	if ((evt = racoon_malloc(sizeof(*evt))) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "Cannot record event: %s\n",
-		    strerror(errno));
-		racoon_free(evtdump);
-		return;
-	}
-
-	if (src)
-		memcpy(&evtdump->src, src, sysdep_sa_len(src));
-	if (dst)
-		memcpy(&evtdump->dst, dst, sysdep_sa_len(dst));
-	evtdump->len = len;
-	evtdump->type = type;
-	time(&evtdump->timestamp);
-
-	if (optdata)
-		memcpy(evtdump + 1, optdata->v, optdata->l);
-
-	evt->dump = evtdump;
-	TAILQ_INSERT_TAIL(&evtlist, evt, next);
-
-	evtlist_len++;
-
-	return;
-}
-
-struct evtdump *
-evt_pop(void) {
-	struct evtdump *evtdump;
-	struct evt *evt;
-
-	if ((evt = TAILQ_FIRST(&evtlist)) == NULL)
-		return NULL;
-
-	evtdump = evt->dump;
-	TAILQ_REMOVE(&evtlist, evt, next);
-	racoon_free(evt);
-	evtlist_len--;
-
-	return evtdump;
-}
-
-vchar_t *
-evt_dump(void) {
-	struct evtdump *evtdump;
-	vchar_t *buf = NULL;
-
-	if ((evtdump = evt_pop()) != NULL) {
-		if ((buf = vmalloc(evtdump->len)) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "evt_dump failed: %s\n", strerror(errno));
-			return NULL;
-		}
-		memcpy(buf->v, evtdump, evtdump->len);	
-		racoon_free(evtdump);
-	}
-
-	return buf;
-}
-
-#endif /* ENABLE_ADMINPORT */
diff --git a/src/racoon/evt.h b/src/racoon/evt.h
deleted file mode 100644
index 88ee366..0000000
--- a/src/racoon/evt.h
+++ /dev/null
@@ -1,88 +0,0 @@
-/*	$NetBSD: evt.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/* Id: evt.h,v 1.5 2006/01/19 10:24:09 fredsen Exp */
-
-/*
- * Copyright (C) 2004 Emmanuel Dreyfus
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _EVT_H
-#define _EVT_H
-
-struct evtdump {
-	size_t len;	
-	struct sockaddr_storage src;
-	struct sockaddr_storage dst;
-	time_t timestamp;
-	int type;
-	/* 
-	 * Optionnal list of struct isakmp_data 
-	 * for type EVTT_ISAKMP_CFG_DONE
-	 */
-};
-
-/* type */
-#define EVTT_UNSEPC		0
-#define EVTT_PHASE1_UP		1
-#define EVTT_PHASE1_DOWN	2
-#define EVTT_XAUTH_SUCCESS	3
-#define EVTT_ISAKMP_CFG_DONE	4
-#define EVTT_PHASE2_UP		5
-#define EVTT_PHASE2_DOWN	6
-#define EVTT_DPD_TIMEOUT	7
-#define EVTT_PEER_NO_RESPONSE	8
-#define EVTT_PEER_DELETE	9
-#define EVTT_RACOON_QUIT	10
-#define EVTT_XAUTH_FAILED	11
-#define EVTT_OVERFLOW		12	/* Event queue overflowed */
-#define EVTT_PEERPH1AUTH_FAILED	13
-#define EVTT_PEERPH1_NOPROP	14	/* NO_PROPOSAL_CHOSEN & friends */
-#define EVTT_NO_ISAKMP_CFG	15	/* no need to wait for mode_cfg */
-
-struct evt {
-	struct evtdump *dump;
-	TAILQ_ENTRY(evt) next;
-};
-
-TAILQ_HEAD(evtlist, evt);
-
-#define EVTLIST_MAX	32
-
-#ifdef ENABLE_ADMINPORT
-struct evtdump *evt_pop(void);
-vchar_t *evt_dump(void);
-void evt_push(struct sockaddr *, struct sockaddr *, int, vchar_t *);
-#endif
-
-#ifdef ENABLE_ADMINPORT
-#define EVT_PUSH(src, dst, type, optdata) evt_push(src, dst, type, optdata);
-#else
-#define EVT_PUSH(src, dst, type, optdata) ;
-#endif
-
-#endif /* _EVT_H */
diff --git a/src/racoon/gcmalloc.h b/src/racoon/gcmalloc.h
deleted file mode 100644
index acdf7fa..0000000
--- a/src/racoon/gcmalloc.h
+++ /dev/null
@@ -1,127 +0,0 @@
-/*	$NetBSD: gcmalloc.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/*	$KAME: gcmalloc.h,v 1.4 2001/11/16 04:34:57 sakane Exp $	*/
-
-/*
- * Copyright (C) 2000, 2001 WIDE Project.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-/*
- * Debugging malloc glue for Racoon.
- */
-
-#ifndef _GCMALLOC_H_DEFINED
-#define _GCMALLOC_H_DEFINED
-
-/* ElectricFence needs no special handling. */
-
-/*
- * Boehm-GC provides GC_malloc(), GC_realloc(), GC_free() functions,
- * but not the traditional entry points.  So what we do is provide  
- * malloc(), calloc(), realloc(), and free() entry points in the main
- * program and letting the linker do the rest.
- */
-#ifdef GC
-#define GC_DEBUG
-#include <gc.h>
-
-#ifdef RACOON_MAIN_PROGRAM
-void *
-malloc(size_t size)
-{
-
-	return (GC_MALLOC(size));
-}
-
-void *
-calloc(size_t number, size_t size)
-{
-
-	/* GC_malloc() clears the storage. */
-	return (GC_MALLOC(number * size));
-}
-
-void *
-realloc(void *ptr, size_t size)
-{
-
-	return (GC_REALLOC(ptr, size));
-}
-
-void
-free(void *ptr)
-{
-
-	GC_FREE(ptr);
-}
-
-char *
-strdup(const char *str)
-{
-
-	return (GC_STRDUP(str));
-}
-#endif /* RACOON_MAIN_PROGRAM */
-
-#define	racoon_malloc(sz)	GC_debug_malloc(sz, GC_EXTRAS)
-#define	racoon_calloc(cnt, sz)	GC_debug_malloc(cnt * sz, GC_EXTRAS)
-#define	racoon_realloc(old, sz)	GC_debug_realloc(old, sz, GC_EXTRAS)
-#define	racoon_free(p)		GC_debug_free(p)
-#define	racoon_strdup(str)	GC_debug_strdup(str)
-
-#endif /* GC */
-
-/*
- * Dmalloc only requires that you pull in a header file and link
- * against libdmalloc.
- */
-#ifdef DMALLOC
-#include <dmalloc.h>
-#endif /* DMALLOC */
-
-#ifdef DEBUG_RECORD_MALLOCATION
-#include <debugrm.h>
-#else
-#ifndef racoon_malloc
-#define	racoon_malloc(sz)	malloc((sz))
-#endif
-#ifndef racoon_calloc
-#define	racoon_calloc(cnt, sz)	calloc((cnt), (sz))
-#endif
-#ifndef racoon_realloc
-#define	racoon_realloc(old, sz)	realloc((old), (sz))
-#endif
-#ifndef racoon_free
-#define	racoon_free(p)		free((p))
-#endif
-#ifndef racoon_strdup
-#define	racoon_strdup(s)	strdup((s))
-#endif
-#endif /* DEBUG_RECORD_MALLOCATION */
-
-#endif /* _GCMALLOC_H_DEFINED */
diff --git a/src/racoon/genlist.c b/src/racoon/genlist.c
deleted file mode 100644
index b5204c0..0000000
--- a/src/racoon/genlist.c
+++ /dev/null
@@ -1,174 +0,0 @@
-/*	$NetBSD: genlist.c,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/* Id: genlist.c,v 1.2 2004/07/12 20:43:50 ludvigm Exp */
-
-/*
- * Copyright (C) 2004 SuSE Linux AG, Nuernberg, Germany.
- * Contributed by: Michal Ludvig <mludvig@suse.cz>, SUSE Labs
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <sys/queue.h>
-
-#include "genlist.h"
-
-struct genlist *
-genlist_init (void)
-{
-	struct genlist *new = calloc(sizeof(struct genlist), 1);
-	TAILQ_INIT(new);
-	return new;
-}
-
-struct genlist_entry *
-genlist_insert (struct genlist *head, void *data)
-{
-	struct genlist_entry *entry = calloc(sizeof(struct genlist_entry), 1);
-	entry->data = data;
-	TAILQ_INSERT_HEAD(head, entry, chain);
-	return entry;
-}
-
-struct genlist_entry *
-genlist_append (struct genlist *head, void *data)
-{
-	struct genlist_entry *entry = calloc(sizeof(struct genlist_entry), 1);
-	entry->data = data;
-	TAILQ_INSERT_TAIL(head, entry, chain);
-	return entry;
-}
-
-void *
-genlist_foreach (struct genlist *head, genlist_func_t func, void *arg)
-{
-	struct genlist_entry *p;
-	void *ret = NULL;
-	TAILQ_FOREACH(p, head, chain) {
-		ret = (*func)(p->data, arg);
-		if (ret)
-			break;
-	}
-
-	return ret;
-}
-
-void *
-genlist_next (struct genlist *head, struct genlist_entry **buf)
-{
-	struct genlist_entry *p;
-
-	if (head)
-		p = TAILQ_FIRST(head);
-	else
-		p = (buf && *buf) ? TAILQ_NEXT(*buf, chain) : NULL;
-	if (buf)
-		*buf = p;
-	return (p ? p->data : NULL);
-}
-
-void
-genlist_free (struct genlist *head, genlist_freedata_t func)
-{
-	struct genlist_entry *p;
-
-	while ((p = TAILQ_LAST(head, genlist)) != NULL) {
-		TAILQ_REMOVE(head, p, chain);
-		if (func)
-			func(p->data);
-		free(p);
-	}
-	free(head);
-}
-
-
-#if 0
-/* Here comes the example... */
-struct conf {
-	struct genlist	*l1, *l2;
-};
-
-void *
-print_entry(void *entry, void *arg)
-{
-	if (!entry)
-		return NULL;
-	printf("%s\n", (char *)entry);
-	return NULL;
-}
-
-void
-dump_list(struct genlist *head)
-{
-	genlist_foreach(head, print_entry, NULL);
-}
-
-void
-free_data(void *data)
-{
-	printf ("removing %s\n", (char *)data);
-}
-
-int main()
-{
-	struct conf *cf;
-	char *cp;
-	struct genlist_entry *gpb;
-
-	cf = calloc(sizeof(struct conf), 1);
-	cf->l1 = genlist_init();
-	cf->l2 = genlist_init();
-	
-	genlist_insert(cf->l1, "Ahoj");
-	genlist_insert(cf->l1, "Cau");
-	genlist_insert(cf->l1, "Nazdar");
-	genlist_insert(cf->l1, "Te buch");
-
-	genlist_append(cf->l2, "Curak");
-	genlist_append(cf->l2, "Kozy");
-	genlist_append(cf->l2, "Pica");
-	genlist_append(cf->l2, "Prdel");
-
-	printf("List 2\n");
-	dump_list(cf->l2);
-	printf("\nList 1\n");
-	dump_list(cf->l1);
-
-	printf("\nList 2 - using genlist_next()\n");
-	for (cp = genlist_next (cf->l2, &gpb); cp; cp = genlist_next (0, &gpb))
-	    printf("%s\n", cp);
-
-	printf("\nFreeing List 1\n");
-	/* the data here isn't actually alloc'd so we would really call
-	 * genlist_free (cf->l1, 0);    but to illustrate the idea */
-	genlist_free (cf->l1, free_data);
-	cf->l1 = 0;
-
-	return 0;
-}
-#endif
diff --git a/src/racoon/genlist.h b/src/racoon/genlist.h
deleted file mode 100644
index ee15392..0000000
--- a/src/racoon/genlist.h
+++ /dev/null
@@ -1,82 +0,0 @@
-/*	$NetBSD: genlist.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/* Id: genlist.h,v 1.2 2004/07/12 20:43:50 ludvigm Exp */
-
-/*
- * Copyright (C) 2004 SuSE Linux AG, Nuernberg, Germany.
- * Contributed by: Michal Ludvig <mludvig@suse.cz>, SUSE Labs
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _GENLIST_H
-#define _GENLIST_H
-
-#include <sys/queue.h>
-
-/* See the bottom of genlist.c for example use. */
-
-/* This declares 'struct genlist' */
-TAILQ_HEAD(genlist, genlist_entry);
-
-/* This is where the data are actually stored. */
-struct genlist_entry {
-	void *data;
-	TAILQ_ENTRY(genlist_entry) chain;
-};
-
-/* This function returns an initialized list head. */
-struct genlist *genlist_init (void);
-
-/* Insert an entry at the beginning/end og the list. */
-struct genlist_entry *genlist_insert (struct genlist *head, void *data);
-struct genlist_entry *genlist_append (struct genlist *head, void *data);
-
-/* Create a function with this prototype for use with genlist_foreach().
- * See genlist_foreach() description below for details. */
-typedef void *(genlist_func_t)(void *entry, void *arg);
-
-/* Traverse the list and call 'func' for each entry.  As long as func() returns
- * NULL the list traversal continues, once it returns non-NULL (usually the
- * 'entry' arg), the list traversal exits and the return value is returned
- * further from genlist_foreach(). Optional 'arg' may be passed to func(), e.g.
- * for some lookup purposes, etc. */
-void *genlist_foreach (struct genlist *head, genlist_func_t func, void *arg);
-
-/* Get first entry in list if head is not NULL, otherwise get next
- * entry based on saved position in list from previous call as stored in buf.
- * If buf is NULL no position is saved */
-void *genlist_next (struct genlist *head, struct genlist_entry **buf);
-
-/* Create a function with this prototype for use with genlist_free()
- * to free any storage associated with genlist_entry.data */
-typedef void (genlist_freedata_t)(void *entry);
-
-/* Free all storage associated with list at head using func to free any
- * alloc()d data in data field of genlist_entry */
-void genlist_free (struct genlist *head, genlist_freedata_t func);
-
-#endif /* _GENLIST_H */
diff --git a/src/racoon/getcertsbyname.c b/src/racoon/getcertsbyname.c
deleted file mode 100644
index 1ce7c62..0000000
--- a/src/racoon/getcertsbyname.c
+++ /dev/null
@@ -1,418 +0,0 @@
-/*	$NetBSD: getcertsbyname.c,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/*	$KAME: getcertsbyname.c,v 1.7 2001/11/16 04:12:59 sakane Exp $	*/
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/socket.h>
-
-#include <netinet/in.h>
-#include <arpa/nameser.h>
-#if (defined(__APPLE__) && defined(__MACH__))
-# include <nameser8_compat.h>
-#endif
-#include <resolv.h>
-#ifdef HAVE_LWRES_GETRRSETBYNAME
-#include <lwres/netdb.h>
-#include <lwres/lwres.h>
-#else
-#include <netdb.h>
-#endif
-#include <stdlib.h>
-#include <string.h>
-#include <errno.h>
-
-#ifdef DNSSEC_DEBUG
-#include <stdio.h>
-#include <strings.h>
-#endif
-
-#include "netdb_dnssec.h"
-
-/* XXX should it use ci_errno to hold errno instead of h_errno ? */
-extern int h_errno;
-
-static struct certinfo *getnewci __P((int, int, int, int, int, 
-			unsigned char *));
-
-static struct certinfo *
-getnewci(qtype, keytag, algorithm, flags, certlen, cert)
-	int qtype, keytag, algorithm, flags, certlen;
-	unsigned char *cert;
-{
-	struct certinfo *res;
-
-	res = malloc(sizeof(*res));
-	if (!res)
-		return NULL;
-
-	memset(res, 0, sizeof(*res));
-	res->ci_type = qtype;
-	res->ci_keytag = keytag;
-	res->ci_algorithm = algorithm;
-	res->ci_flags = flags;
-	res->ci_certlen = certlen;
-	res->ci_cert = malloc(certlen);
-	if (!res->ci_cert) {
-		free(res);
-		return NULL;
-	}
-	memcpy(res->ci_cert, cert, certlen);
-
-	return res;
-}
-
-void
-freecertinfo(ci)
-	struct certinfo *ci;
-{
-	struct certinfo *next;
-
-	do {
-		next = ci->ci_next;
-		if (ci->ci_cert)
-			free(ci->ci_cert);
-		free(ci);
-		ci = next;
-	} while (ci);
-}
-
-/*
- * get CERT RR by FQDN and create certinfo structure chain.
- */
-#ifdef HAVE_LWRES_GETRRSETBYNAME
-#define getrrsetbyname lwres_getrrsetbyname
-#define freerrset lwres_freerrset
-#define hstrerror lwres_hstrerror
-#endif
-#if defined(HAVE_LWRES_GETRRSETBYNAME) || defined(AHVE_GETRRSETBYNAME)
-int
-getcertsbyname(name, res)
-	char *name;
-	struct certinfo **res;
-{
-	int rdlength;
-	char *cp;
-	int type, keytag, algorithm;
-	struct certinfo head, *cur;
-	struct rrsetinfo *rr = NULL;
-	int i;
-	int error = -1;
-
-	/* initialize res */
-	*res = NULL;
-
-	memset(&head, 0, sizeof(head));
-	cur = &head;
-
-	error = getrrsetbyname(name, C_IN, T_CERT, 0, &rr);
-	if (error) {
-#ifdef DNSSEC_DEBUG
-		printf("getrrsetbyname: %s\n", hstrerror(error));
-#endif
-		h_errno = NO_RECOVERY;
-		goto end;
-	}
-
-	if (rr->rri_rdclass != C_IN
-	 || rr->rri_rdtype != T_CERT
-	 || rr->rri_nrdatas == 0) {
-#ifdef DNSSEC_DEBUG
-		printf("getrrsetbyname: %s", hstrerror(error));
-#endif
-		h_errno = NO_RECOVERY;
-		goto end;
-	}
-#ifdef DNSSEC_DEBUG
-	if (!(rr->rri_flags & LWRDATA_VALIDATED))
-		printf("rr is not valid");
-#endif
-
-	for (i = 0; i < rr->rri_nrdatas; i++) {
-		rdlength = rr->rri_rdatas[i].rdi_length;
-		cp = rr->rri_rdatas[i].rdi_data;
-
-		GETSHORT(type, cp);	/* type */
-		rdlength -= INT16SZ;
-		GETSHORT(keytag, cp);	/* key tag */
-		rdlength -= INT16SZ;
-		algorithm = *cp++;	/* algorithm */
-		rdlength -= 1;
-
-#ifdef DNSSEC_DEBUG
-		printf("type=%d keytag=%d alg=%d len=%d\n",
-			type, keytag, algorithm, rdlength);
-#endif
-
-		/* create new certinfo */
-		cur->ci_next = getnewci(type, keytag, algorithm,
-					rr->rri_flags, rdlength, cp);
-		if (!cur->ci_next) {
-#ifdef DNSSEC_DEBUG
-			printf("getnewci: %s", strerror(errno));
-#endif
-			h_errno = NO_RECOVERY;
-			goto end;
-		}
-		cur = cur->ci_next;
-	}
-
-	*res = head.ci_next;
-	error = 0;
-
-end:
-	if (rr)
-		freerrset(rr);
-	if (error && head.ci_next)
-		freecertinfo(head.ci_next);
-
-	return error;
-}
-#else	/*!HAVE_LWRES_GETRRSETBYNAME*/
-int
-getcertsbyname(name, res)
-	char *name;
-	struct certinfo **res;
-{
-	unsigned char *answer = NULL, *p;
-	int buflen, anslen, len;
-	HEADER *hp;
-	int qdcount, ancount, rdlength;
-	unsigned char *cp, *eom;
-	char hostbuf[1024];	/* XXX */
-	int qtype, qclass, keytag, algorithm;
-	struct certinfo head, *cur;
-	int error = -1;
-
-	/* initialize res */
-	*res = NULL;
-
-	memset(&head, 0, sizeof(head));
-	cur = &head;
-
-	/* get CERT RR */
-	buflen = 512;
-	do {
-
-		buflen *= 2;
-		p = realloc(answer, buflen);
-		if (!p) {
-#ifdef DNSSEC_DEBUG
-			printf("realloc: %s", strerror(errno));
-#endif
-			h_errno = NO_RECOVERY;
-			goto end;
-		}
-		answer = p;
-
-		anslen = res_query(name,  C_IN, T_CERT, answer, buflen);
-		if (anslen == -1)
-			goto end;
-
-	} while (buflen < anslen);
-
-#ifdef DNSSEC_DEBUG
-	printf("get a DNS packet len=%d\n", anslen);
-#endif
-
-	/* parse CERT RR */
-	eom = answer + anslen;
-
-	hp = (HEADER *)answer;
-	qdcount = ntohs(hp->qdcount);
-	ancount = ntohs(hp->ancount);
-
-	/* question section */
-	if (qdcount != 1) {
-#ifdef DNSSEC_DEBUG
-		printf("query count is not 1.\n");
-#endif
-		h_errno = NO_RECOVERY;
-		goto end;
-	}
-	cp = (unsigned char *)(hp + 1);
-	len = dn_expand(answer, eom, cp, hostbuf, sizeof(hostbuf));
-	if (len < 0) {
-#ifdef DNSSEC_DEBUG
-		printf("dn_expand failed.\n");
-#endif
-		goto end;
-	}
-	cp += len;
-	GETSHORT(qtype, cp);		/* QTYPE */
-	GETSHORT(qclass, cp);		/* QCLASS */
-
-	/* answer section */
-	while (ancount-- && cp < eom) {
-		len = dn_expand(answer, eom, cp, hostbuf, sizeof(hostbuf));
-		if (len < 0) {
-#ifdef DNSSEC_DEBUG
-			printf("dn_expand failed.\n");
-#endif
-			goto end;
-		}
-		cp += len;
-		GETSHORT(qtype, cp);	/* TYPE */
-		GETSHORT(qclass, cp);	/* CLASS */
-		cp += INT32SZ;		/* TTL */
-		GETSHORT(rdlength, cp);	/* RDLENGTH */
-
-		/* CERT RR */
-		if (qtype != T_CERT) {
-#ifdef DNSSEC_DEBUG
-			printf("not T_CERT\n");
-#endif
-			h_errno = NO_RECOVERY;
-			goto end;
-		}
-		GETSHORT(qtype, cp);	/* type */
-		rdlength -= INT16SZ;
-		GETSHORT(keytag, cp);	/* key tag */
-		rdlength -= INT16SZ;
-		algorithm = *cp++;	/* algorithm */
-		rdlength -= 1;
-		if (cp + rdlength > eom) {
-#ifdef DNSSEC_DEBUG
-			printf("rdlength is too long.\n");
-#endif
-			h_errno = NO_RECOVERY;
-			goto end;
-		}
-#ifdef DNSSEC_DEBUG
-		printf("type=%d keytag=%d alg=%d len=%d\n",
-			qtype, keytag, algorithm, rdlength);
-#endif
-
-		/* create new certinfo */
-		cur->ci_next = getnewci(qtype, keytag, algorithm,
-					0, rdlength, cp);
-		if (!cur->ci_next) {
-#ifdef DNSSEC_DEBUG
-			printf("getnewci: %s", strerror(errno));
-#endif
-			h_errno = NO_RECOVERY;
-			goto end;
-		}
-		cur = cur->ci_next;
-
-		cp += rdlength;
-	}
-
-	*res = head.ci_next;
-	error = 0;
-
-end:
-	if (answer)
-		free(answer);
-	if (error && head.ci_next)
-		freecertinfo(head.ci_next);
-
-	return error;
-}
-#endif
-
-#ifdef DNSSEC_DEBUG
-int
-b64encode(p, len)
-	char *p;
-	int len;
-{
-	static const char b64t[] =
-		"ABCDEFGHIJKLMNOPQRSTUVWXYZ"
-		"abcdefghijklmnopqrstuvwxyz"
-		"0123456789+/=";
-
-	while (len > 2) {
-                printf("%c", b64t[(p[0] >> 2) & 0x3f]);
-                printf("%c", b64t[((p[0] << 4) & 0x30) | ((p[1] >> 4) & 0x0f)]);
-                printf("%c", b64t[((p[1] << 2) & 0x3c) | ((p[2] >> 6) & 0x03)]);
-                printf("%c", b64t[p[2] & 0x3f]);
-		len -= 3;
-		p += 3;
-	}
-
-	if (len == 2) {
-                printf("%c", b64t[(p[0] >> 2) & 0x3f]);
-                printf("%c", b64t[((p[0] << 4) & 0x30)| ((p[1] >> 4) & 0x0f)]);
-                printf("%c", b64t[((p[1] << 2) & 0x3c)]);
-                printf("%c", '=');
-        } else if (len == 1) {
-                printf("%c", b64t[(p[0] >> 2) & 0x3f]);
-                printf("%c", b64t[((p[0] << 4) & 0x30)]);
-                printf("%c", '=');
-                printf("%c", '=');
-	}
-
-	return 0;
-}
-
-int
-main(ac, av)
-	int ac;
-	char **av;
-{
-	struct certinfo *res, *p;
-	int i;
-
-	if (ac < 2) {
-		printf("Usage: a.out (FQDN)\n");
-		exit(1);
-	}
-
-	i = getcertsbyname(*(av + 1), &res);
-	if (i != 0) {
-		herror("getcertsbyname");
-		exit(1);
-	}
-	printf("getcertsbyname succeeded.\n");
-
-	i = 0;
-	for (p = res; p; p = p->ci_next) {
-		printf("certinfo[%d]:\n", i);
-		printf("\tci_type=%d\n", p->ci_type);
-		printf("\tci_keytag=%d\n", p->ci_keytag);
-		printf("\tci_algorithm=%d\n", p->ci_algorithm);
-		printf("\tci_flags=%d\n", p->ci_flags);
-		printf("\tci_certlen=%d\n", p->ci_certlen);
-		printf("\tci_cert: ");
-		b64encode(p->ci_cert, p->ci_certlen);
-		printf("\n");
-		i++;
-	}
-
-	freecertinfo(res);
-
-	exit(0);
-}
-#endif
diff --git a/src/racoon/gnuc.h b/src/racoon/gnuc.h
deleted file mode 100644
index 8537ad2..0000000
--- a/src/racoon/gnuc.h
+++ /dev/null
@@ -1,46 +0,0 @@
-/*	$NetBSD: gnuc.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/* Id: gnuc.h,v 1.4 2004/11/18 15:14:44 ludvigm Exp */
-
-/* Define __P() macro, if necessary */
-#undef __P
-#ifndef __P
-#if __STDC__
-#define __P(protos) protos
-#else
-#define __P(protos) ()
-#endif
-#endif
-
-/* inline foo */
-#ifdef __GNUC__
-#define inline __inline
-#else
-#define inline
-#endif
-
-/*
- * Handle new and old "dead" routine prototypes
- *
- * For example:
- *
- *	__dead void foo(void) __attribute__((volatile));
- *
- */
-#ifdef __GNUC__
-#ifndef __dead
-#define __dead volatile
-#endif
-#if __GNUC__ < 2  || (__GNUC__ == 2 && __GNUC_MINOR__ < 5)
-#ifndef __attribute__
-#define __attribute__(args)
-#endif
-#endif
-#else
-#ifndef __dead
-#define __dead
-#endif
-#ifndef __attribute__
-#define __attribute__(args)
-#endif
-#endif
diff --git a/src/racoon/grabmyaddr.c b/src/racoon/grabmyaddr.c
deleted file mode 100644
index dae4690..0000000
--- a/src/racoon/grabmyaddr.c
+++ /dev/null
@@ -1,938 +0,0 @@
-/*	$NetBSD: grabmyaddr.c,v 1.4.6.3 2008/06/18 07:30:18 mgrooms Exp $	*/
-
-/* Id: grabmyaddr.c,v 1.27 2006/04/06 16:27:05 manubsd Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/socket.h>
-#include <sys/ioctl.h>
-
-#include <net/if.h>
-#if defined(__FreeBSD__) && __FreeBSD__ >= 3
-#include <net/if_var.h>
-#endif
-#if defined(__NetBSD__) || defined(__FreeBSD__) ||	\
-  (defined(__APPLE__) && defined(__MACH__))
-#include <netinet/in.h>
-#include <netinet6/in6_var.h>
-#endif
-#include <net/route.h>
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-#ifdef HAVE_UNISTD_H
-#include <unistd.h>
-#endif
-#include <netdb.h>
-#ifdef HAVE_GETIFADDRS
-#include <ifaddrs.h>
-#include <net/if.h>
-#endif 
-
-#include "var.h"
-#include "misc.h"
-#include "vmbuf.h"
-#include "plog.h"
-#include "sockmisc.h"
-#include "debug.h"
-
-#include "localconf.h"
-#include "handler.h"
-#include "grabmyaddr.h"
-#include "sockmisc.h"
-#include "isakmp_var.h"
-#include "gcmalloc.h"
-#include "nattraversal.h"
-
-#ifdef __linux__
-#include <linux/types.h>
-#include <linux/rtnetlink.h>
-#ifndef HAVE_GETIFADDRS
-#define HAVE_GETIFADDRS
-#define NEED_LINUX_GETIFADDRS
-#endif
-#endif
-
-#ifdef ANDROID_CHANGES
-#include "NetdClient.h"
-#endif
-
-#ifndef HAVE_GETIFADDRS
-static unsigned int if_maxindex __P((void));
-#endif
-static struct myaddrs *find_myaddr __P((struct myaddrs *, struct myaddrs *));
-static int suitable_ifaddr __P((const char *, const struct sockaddr *));
-#ifdef INET6
-static int suitable_ifaddr6 __P((const char *, const struct sockaddr *));
-#endif
-
-#ifdef NEED_LINUX_GETIFADDRS
-
-/* We could do this _much_ better. kame racoon in its current form
- * will esentially die at frequent changes of address configuration.
- */
-
-struct ifaddrs
-{
-	struct ifaddrs *ifa_next;
-	char		ifa_name[16];
-	int		ifa_ifindex;
-	struct sockaddr *ifa_addr;
-	struct sockaddr_storage ifa_addrbuf;
-};
-
-static int parse_rtattr(struct rtattr *tb[], int max, struct rtattr *rta, int len)
-{
-	while (RTA_OK(rta, len)) {
-		if (rta->rta_type <= max)
-			tb[rta->rta_type] = rta;
-		rta = RTA_NEXT(rta,len);
-	}
-	return 0;
-}
-
-static void recvaddrs(int fd, struct ifaddrs **ifa, __u32 seq)
-{
-	char	buf[8192];
-	struct sockaddr_nl nladdr;
-	struct iovec iov = { buf, sizeof(buf) };
-	struct ifaddrmsg *m;
-	struct rtattr * rta_tb[IFA_MAX+1];
-	struct ifaddrs *I;
-
-	while (1) {
-		int status;
-		struct nlmsghdr *h;
-
-		struct msghdr msg = {
-			(void*)&nladdr, sizeof(nladdr),
-			&iov,	1,
-			NULL,	0,
-			0
-		};
-
-		status = recvmsg(fd, &msg, 0);
-
-		if (status < 0)
-			continue;
-
-		if (status == 0)
-			return;
-
-		if (nladdr.nl_pid) /* Message not from kernel */
-			continue;
-
-		h = (struct nlmsghdr*)buf;
-		while (NLMSG_OK(h, status)) {
-			if (h->nlmsg_seq != seq)
-				goto skip_it;
-
-			if (h->nlmsg_type == NLMSG_DONE)
-				return;
-
-			if (h->nlmsg_type == NLMSG_ERROR)
-				return;
-
-			if (h->nlmsg_type != RTM_NEWADDR)
-				goto skip_it;
-
-			m = NLMSG_DATA(h);
-
-			if (m->ifa_family != AF_INET &&
-			    m->ifa_family != AF_INET6)
-				goto skip_it;
-
-			if (m->ifa_flags&IFA_F_TENTATIVE)
-				goto skip_it;
-
-			memset(rta_tb, 0, sizeof(rta_tb));
-			parse_rtattr(rta_tb, IFA_MAX, IFA_RTA(m), h->nlmsg_len - NLMSG_LENGTH(sizeof(*m)));
-
-			if (rta_tb[IFA_LOCAL] == NULL)
-				rta_tb[IFA_LOCAL] = rta_tb[IFA_ADDRESS];
-			if (rta_tb[IFA_LOCAL] == NULL)
-				goto skip_it;
-			
-			I = malloc(sizeof(struct ifaddrs));
-			if (!I)
-				return;
-			memset(I, 0, sizeof(*I));
-
-			I->ifa_ifindex = m->ifa_index;
-			I->ifa_addr = (struct sockaddr*)&I->ifa_addrbuf;
-			I->ifa_addr->sa_family = m->ifa_family;
-			if (m->ifa_family == AF_INET) {
-				struct sockaddr_in *sin = (void*)I->ifa_addr;
-				memcpy(&sin->sin_addr, RTA_DATA(rta_tb[IFA_LOCAL]), 4);
-			} else {
-				struct sockaddr_in6 *sin = (void*)I->ifa_addr;
-				memcpy(&sin->sin6_addr, RTA_DATA(rta_tb[IFA_LOCAL]), 16);
-				if (IN6_IS_ADDR_LINKLOCAL(&sin->sin6_addr))
-					sin->sin6_scope_id = I->ifa_ifindex;
-			}
-			I->ifa_next = *ifa;
-			*ifa = I;
-
-skip_it:
-			h = NLMSG_NEXT(h, status);
-		}
-		if (msg.msg_flags & MSG_TRUNC)
-			continue;
-	}
-	return;
-}
-
-static int getifaddrs(struct ifaddrs **ifa0)
-{
-	struct {
-		struct nlmsghdr nlh;
-		struct rtgenmsg g;
-	} req;
-	struct sockaddr_nl nladdr;
-	static __u32 seq;
-	struct ifaddrs *i;
-	int fd;
-
-	fd = socket(PF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
-	if (fd < 0)
-		return -1;
-
-	memset(&nladdr, 0, sizeof(nladdr));
-	nladdr.nl_family = AF_NETLINK;
-
-	req.nlh.nlmsg_len = sizeof(req);
-	req.nlh.nlmsg_type = RTM_GETADDR;
-	req.nlh.nlmsg_flags = NLM_F_ROOT|NLM_F_MATCH|NLM_F_REQUEST;
-	req.nlh.nlmsg_pid = 0;
-	req.nlh.nlmsg_seq = ++seq;
-	req.g.rtgen_family = AF_UNSPEC;
-
-	if (sendto(fd, (void*)&req, sizeof(req), 0, (struct sockaddr*)&nladdr, sizeof(nladdr)) < 0) {
-		close(fd);
-		return -1;
-	}
-
-	*ifa0 = NULL;
-
-	recvaddrs(fd, ifa0, seq);
-
-	close(fd);
-
-	fd = socket(AF_INET, SOCK_DGRAM, 0);
-
-	for (i=*ifa0; i; i = i->ifa_next) {
-		struct ifreq ifr;
-		ifr.ifr_ifindex = i->ifa_ifindex;
-		ioctl(fd, SIOCGIFNAME, (void*)&ifr);
-		memcpy(i->ifa_name, ifr.ifr_name, 16);
-	}
-	close(fd);
-
-	return 0;
-}
-
-static void freeifaddrs(struct ifaddrs *ifa0)
-{
-        struct ifaddrs *i;
-
-        while (ifa0) {
-                i = ifa0;
-                ifa0 = i->ifa_next;
-                free(i);
-        }
-}
-
-#endif
-
-#ifndef HAVE_GETIFADDRS
-static unsigned int
-if_maxindex()
-{
-	struct if_nameindex *p, *p0;
-	unsigned int max = 0;
-
-	p0 = if_nameindex();
-	for (p = p0; p && p->if_index && p->if_name; p++) {
-		if (max < p->if_index)
-			max = p->if_index;
-	}
-	if_freenameindex(p0);
-	return max;
-}
-#endif
-
-void
-clear_myaddr(db)
-	struct myaddrs **db;
-{
-	struct myaddrs *p;
-
-	while (*db) {
-		p = (*db)->next;
-		delmyaddr(*db);
-		*db = p;
-	}
-}
-  
-static struct myaddrs *
-find_myaddr(db, p)
-	struct myaddrs *db;
-	struct myaddrs *p;
-{
-	struct myaddrs *q;
-	char h1[NI_MAXHOST], h2[NI_MAXHOST];
-
-	if (getnameinfo(p->addr, sysdep_sa_len(p->addr), h1, sizeof(h1), NULL, 0,
-	    NI_NUMERICHOST | niflags) != 0)
-		return NULL;
-
-	for (q = db; q; q = q->next) {
-		if (p->addr->sa_family != q->addr->sa_family)
-			continue;
-		if (getnameinfo(q->addr, sysdep_sa_len(q->addr), h2, sizeof(h2),
-		    NULL, 0, NI_NUMERICHOST | niflags) != 0)
-			return NULL;
-		if (strcmp(h1, h2) == 0)
-			return q;
-	}
-
-	return NULL;
-}
-
-void
-grab_myaddrs()
-{
-#ifdef HAVE_GETIFADDRS
-	struct myaddrs *p, *q, *old;
-	struct ifaddrs *ifa0, *ifap;
-#ifdef INET6
-	struct sockaddr_in6 *sin6;
-#endif
-
-	char addr1[NI_MAXHOST];
-
-	if (getifaddrs(&ifa0)) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"getifaddrs failed: %s\n", strerror(errno));
-		exit(1);
-		/*NOTREACHED*/
-	}
-
-	old = lcconf->myaddrs;
-
-	for (ifap = ifa0; ifap; ifap = ifap->ifa_next) {
-		if (! ifap->ifa_addr)
-			continue;
-
-		if (ifap->ifa_addr->sa_family != AF_INET
-#ifdef INET6
-		 && ifap->ifa_addr->sa_family != AF_INET6
-#endif
-		)
-			continue;
-
-		if (!suitable_ifaddr(ifap->ifa_name, ifap->ifa_addr)) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"unsuitable address: %s %s\n",
-				ifap->ifa_name,
-				saddrwop2str(ifap->ifa_addr));
-			continue;
-		}
-
-		p = newmyaddr();
-		if (p == NULL) {
-			exit(1);
-			/*NOTREACHED*/
-		}
-		p->addr = dupsaddr(ifap->ifa_addr);
-		if (p->addr == NULL) {
-			exit(1);
-			/*NOTREACHED*/
-		}
-#ifdef INET6
-#ifdef __KAME__
-		if (ifap->ifa_addr->sa_family == AF_INET6) {
-			sin6 = (struct sockaddr_in6 *)p->addr;
-			if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)
-			 || IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
-				sin6->sin6_scope_id =
-					ntohs(*(u_int16_t *)&sin6->sin6_addr.s6_addr[2]);
-				sin6->sin6_addr.s6_addr[2] = 0;
-				sin6->sin6_addr.s6_addr[3] = 0;
-			}
-		}
-#else /* !__KAME__ */
-		if (ifap->ifa_addr->sa_family == AF_INET6) {
-			sin6 = (struct sockaddr_in6 *)p->addr;
-			if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)
-			 || IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
-				sin6->sin6_scope_id =
-					if_nametoindex(ifap->ifa_name);
-			}
-		}
-				
-#endif
-#endif
-		if (getnameinfo(p->addr, sysdep_sa_len(p->addr),
-				addr1, sizeof(addr1),
-				NULL, 0,
-				NI_NUMERICHOST | niflags))
-		strlcpy(addr1, "(invalid)", sizeof(addr1));
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"my interface: %s (%s)\n",
-			addr1, ifap->ifa_name);
-		q = find_myaddr(old, p);
-#ifdef ANDROID_CHANGES
-		if (q) {
-			protectFromVpn(q->sock);
-		}
-#endif
-		if (q)
-			p->sock = q->sock;
-		else
-			p->sock = -1;
-		p->next = lcconf->myaddrs;
-		lcconf->myaddrs = p;
-	}
-
-	freeifaddrs(ifa0);
-
-	clear_myaddr(&old);
-
-#else /*!HAVE_GETIFADDRS*/
-	int s;
-	unsigned int maxif;
-	int len;
-	struct ifreq *iflist;
-	struct ifconf ifconf;
-	struct ifreq *ifr, *ifr_end;
-	struct myaddrs *p, *q, *old;
-#ifdef INET6
-#ifdef __KAME__
-	struct sockaddr_in6 *sin6;
-#endif
-#endif
-
-	char addr1[NI_MAXHOST];
-
-	maxif = if_maxindex() + 1;
-	len = maxif * sizeof(struct sockaddr_storage) * 4; /* guess guess */
-
-	iflist = (struct ifreq *)racoon_malloc(len);
-	if (!iflist) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to allocate buffer\n");
-		exit(1);
-		/*NOTREACHED*/
-	}
-
-	if ((s = socket(PF_INET, SOCK_DGRAM, 0)) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"socket(SOCK_DGRAM) failed: %s\n",
-			strerror(errno));
-		exit(1);
-		/*NOTREACHED*/
-	}
-#ifdef ANDROID_CHANGES
-	protectFromVpn(s);
-#endif
-
-	memset(&ifconf, 0, sizeof(ifconf));
-	ifconf.ifc_req = iflist;
-	ifconf.ifc_len = len;
-	if (ioctl(s, SIOCGIFCONF, &ifconf) < 0) {
-		close(s);
-		plog(LLV_ERROR, LOCATION, NULL,
-			"ioctl(SIOCGIFCONF) failed: %s\n",
-			strerror(errno));
-		exit(1);
-		/*NOTREACHED*/
-	}
-	close(s);
-
-	old = lcconf->myaddrs;
-
-	/* Look for this interface in the list */
-	ifr_end = (struct ifreq *) (ifconf.ifc_buf + ifconf.ifc_len);
-
-#define _IFREQ_LEN(p) \
-  (sizeof((p)->ifr_name) + sysdep_sa_len(&(p)->ifr_addr) > sizeof(struct ifreq) \
-    ? sizeof((p)->ifr_name) + sysdep_sa_len(&(p)->ifr_addr) : sizeof(struct ifreq))
-
-	for (ifr = ifconf.ifc_req;
-	     ifr < ifr_end;
-	     ifr = (struct ifreq *)((caddr_t)ifr + _IFREQ_LEN(ifr))) {
-
-		switch (ifr->ifr_addr.sa_family) {
-		case AF_INET:
-#ifdef INET6
-		case AF_INET6:
-#endif
-			if (!suitable_ifaddr(ifr->ifr_name, &ifr->ifr_addr)) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"unsuitable address: %s %s\n",
-					ifr->ifr_name,
-					saddrwop2str(&ifr->ifr_addr));
-				continue;
-			}
-
-			p = newmyaddr();
-			if (p == NULL) {
-				exit(1);
-				/*NOTREACHED*/
-			}
-			p->addr = dupsaddr(&ifr->ifr_addr);
-			if (p->addr == NULL) {
-				exit(1);
-				/*NOTREACHED*/
-			}
-#ifdef INET6
-#ifdef __KAME__
-			sin6 = (struct sockaddr_in6 *)p->addr;
-			if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)
-			 || IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
-				sin6->sin6_scope_id =
-					ntohs(*(u_int16_t *)&sin6->sin6_addr.s6_addr[2]);
-				sin6->sin6_addr.s6_addr[2] = 0;
-				sin6->sin6_addr.s6_addr[3] = 0;
-			}
-#endif
-#endif
-			if (getnameinfo(p->addr, sysdep_sa_len(p->addr),
-					addr1, sizeof(addr1),
-					NULL, 0,
-					NI_NUMERICHOST | niflags))
-			strlcpy(addr1, "(invalid)", sizeof(addr1));
-			plog(LLV_DEBUG, LOCATION, NULL,
-				"my interface: %s (%s)\n",
-				addr1, ifr->ifr_name);
-			q = find_myaddr(old, p);
-#ifdef ANDROID_CHANGES
-			if (q) {
-				protectFromVpn(q->sock);
-			}
-#endif
-			if (q)
-				p->sock = q->sock;
-			else
-				p->sock = -1;
-			p->next = lcconf->myaddrs;
-			lcconf->myaddrs = p;
-			break;
-		default:
-			break;
-		}
-	}
-
-	clear_myaddr(&old);
-
-	racoon_free(iflist);
-#endif /*HAVE_GETIFADDRS*/
-}
-
-/*
- * check the interface is suitable or not
- */
-static int
-suitable_ifaddr(ifname, ifaddr)
-	const char *ifname;
-	const struct sockaddr *ifaddr;
-{
-#ifdef ENABLE_HYBRID
-	/* Exclude any address we got through ISAKMP mode config */
-	if (exclude_cfg_addr(ifaddr) == 0)
-		return 0;
-#endif
-	switch(ifaddr->sa_family) {
-	case AF_INET:
-		return 1;
-#ifdef INET6
-	case AF_INET6:
-		return suitable_ifaddr6(ifname, ifaddr);
-#endif
-	default:
-		return 0;
-	}
-	/*NOTREACHED*/
-}
-
-#ifdef INET6
-static int
-suitable_ifaddr6(ifname, ifaddr)
-	const char *ifname;
-	const struct sockaddr *ifaddr;
-{
-#ifndef __linux__
-	struct in6_ifreq ifr6;
-	int s;
-#endif
-
-	if (ifaddr->sa_family != AF_INET6)
-		return 0;
-
-#ifndef __linux__
-	s = socket(PF_INET6, SOCK_DGRAM, 0);
-	if (s == -1) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"socket(SOCK_DGRAM) failed:%s\n", strerror(errno));
-		return 0;
-	}
-#ifdef ANDROID_CHANGES
-	protectFromVpn(s);
-#endif
-
-	memset(&ifr6, 0, sizeof(ifr6));
-	strncpy(ifr6.ifr_name, ifname, strlen(ifname));
-
-	ifr6.ifr_addr = *(const struct sockaddr_in6 *)ifaddr;
-
-	if (ioctl(s, SIOCGIFAFLAG_IN6, &ifr6) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"ioctl(SIOCGIFAFLAG_IN6) failed:%s\n", strerror(errno));
-		close(s);
-		return 0;
-	}
-
-	close(s);
-
-	if (ifr6.ifr_ifru.ifru_flags6 & IN6_IFF_DUPLICATED
-	 || ifr6.ifr_ifru.ifru_flags6 & IN6_IFF_DETACHED
-	 || ifr6.ifr_ifru.ifru_flags6 & IN6_IFF_ANYCAST)
-		return 0;
-#endif
-
-	/* suitable */
-	return 1;
-}
-#endif
-
-int
-update_myaddrs()
-{
-#ifdef __linux__
-	char msg[BUFSIZ];
-	int len;
-	struct nlmsghdr *h = (void*)msg;
-	len = read(lcconf->rtsock, msg, sizeof(msg));
-	if (len < 0)
-		return errno == ENOBUFS;
-	if (len < sizeof(*h))
-		return 0;
-	if (h->nlmsg_pid) /* not from kernel! */
-		return 0;
-	if (h->nlmsg_type == RTM_NEWLINK)
-		return 0;
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"netlink signals update interface address list\n");
-	return 1;
-#else
-	char msg[BUFSIZ];
-	int len;
-	struct rt_msghdr *rtm;
-
-	len = read(lcconf->rtsock, msg, sizeof(msg));
-	if (len < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"read(PF_ROUTE) failed: %s\n",
-			strerror(errno));
-		return 0;
-	}
-	rtm = (struct rt_msghdr *)msg;
-	if (len < rtm->rtm_msglen) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"read(PF_ROUTE) short read\n");
-		return 0;
-	}
-	if (rtm->rtm_version != RTM_VERSION) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"routing socket version mismatch\n");
-		close(lcconf->rtsock);
-		lcconf->rtsock = -1;
-		return 0;
-	}
-	switch (rtm->rtm_type) {
-	case RTM_NEWADDR:
-	case RTM_DELADDR:
-	case RTM_DELETE:
-	case RTM_IFINFO:
-		break;
-	case RTM_MISS:
-		/* ignore this message silently */
-		return 0;
-	default:
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"msg %d not interesting\n", rtm->rtm_type);
-		return 0;
-	}
-	/* XXX more filters here? */
-
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"caught rtm:%d, need update interface address list\n",
-		rtm->rtm_type);
-	return 1;
-#endif /* __linux__ */
-}
-
-/*
- * initialize default port for ISAKMP to send, if no "listen"
- * directive is specified in config file.
- *
- * DO NOT listen to wildcard addresses.  if you receive packets to
- * wildcard address, you'll be in trouble (DoS attack possible by
- * broadcast storm).
- */
-int
-autoconf_myaddrsport()
-{
-	struct myaddrs *p;
-	int n;
-
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"configuring default isakmp port.\n");
-
-#ifdef ENABLE_NATT
-	if (natt_enabled_in_rmconf ()) {
-		plog(LLV_NOTIFY, LOCATION, NULL, "NAT-T is enabled, autoconfiguring ports\n");
-		for (p = lcconf->myaddrs; p; p = p->next) {
-			struct myaddrs *new;
-			if (! p->udp_encap) {
-				new = dupmyaddr(p);
-				new->udp_encap = 1;
-			}
-		}
-	}
-#endif
-
-	for (p = lcconf->myaddrs, n = 0; p; p = p->next, n++) {
-		set_port (p->addr, p->udp_encap ? lcconf->port_isakmp_natt : lcconf->port_isakmp);
-	}
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"%d addrs are configured successfully\n", n);
-
-	return 0;
-}
-
-/*
- * get a port number to which racoon binded.
- */
-u_short
-getmyaddrsport(local)
-	struct sockaddr *local;
-{
-	struct myaddrs *p, *bestmatch = NULL;
-	u_short bestmatch_port = PORT_ISAKMP;
-
-	/* get a relative port */
-	for (p = lcconf->myaddrs; p; p = p->next) {
-		if (!p->addr)
-			continue;
-		if (cmpsaddrwop(local, p->addr))
-			continue;
-
-		/* use first matching address regardless of port */
-		if (!bestmatch) {
-			bestmatch = p;
-			continue;
-		}
-
-		/* matching address with port PORT_ISAKMP */
-		if (extract_port(p->addr) == PORT_ISAKMP) {
-			bestmatch = p;
-			bestmatch_port = PORT_ISAKMP;
-		}
-	}
-
-	return bestmatch_port;
-}
-
-struct myaddrs *
-newmyaddr()
-{
-	struct myaddrs *new;
-
-	new = racoon_calloc(1, sizeof(*new));
-	if (new == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to allocate buffer for myaddrs.\n");
-		return NULL;
-	}
-
-	new->next = NULL;
-	new->addr = NULL;
-
-	return new;
-}
-
-struct myaddrs *
-dupmyaddr(struct myaddrs *old)
-{
-	struct myaddrs *new;
-
-	new = racoon_calloc(1, sizeof(*new));
-	if (new == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to allocate buffer for myaddrs.\n");
-		return NULL;
-	}
-
-	/* Copy the whole structure and set the differences.  */
-	memcpy (new, old, sizeof (*new));
-	new->addr = dupsaddr (old->addr);
-	if (new->addr == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to allocate buffer for myaddrs.\n");
-		racoon_free(new);
-		return NULL;
-	}
-	new->next = old->next;
-	old->next = new;
-
-	return new;
-}
-
-void
-insmyaddr(new, head)
-	struct myaddrs *new;
-	struct myaddrs **head;
-{
-	new->next = *head;
-	*head = new;
-}
-
-void
-delmyaddr(myaddr)
-	struct myaddrs *myaddr;
-{
-	if (myaddr->addr)
-		racoon_free(myaddr->addr);
-	racoon_free(myaddr);
-}
-
-int
-initmyaddr()
-{
-	/* initialize routing socket */
-	lcconf->rtsock = socket(PF_ROUTE, SOCK_RAW, PF_UNSPEC);
-	if (lcconf->rtsock < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"socket(PF_ROUTE) failed: %s",
-			strerror(errno));
-		return -1;
-	}
-
-#ifdef __linux__
-   {
-	struct sockaddr_nl nl;
-	u_int addr_len;
-
-	memset(&nl, 0, sizeof(nl));
-	nl.nl_family = AF_NETLINK;
-	nl.nl_groups = RTMGRP_IPV4_IFADDR|RTMGRP_LINK|RTMGRP_IPV6_IFADDR;
-
-	if (bind(lcconf->rtsock, (struct sockaddr*)&nl, sizeof(nl)) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		     "bind(PF_NETLINK) failed: %s\n",
-		     strerror(errno));
-		return -1;
-	}
-	addr_len = sizeof(nl);
-	if (getsockname(lcconf->rtsock, (struct sockaddr*)&nl, &addr_len) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		     "getsockname(PF_NETLINK) failed: %s\n",
-		     strerror(errno));
-		return -1;
-	}
-   }
-#endif
-
-	if (lcconf->myaddrs == NULL && lcconf->autograbaddr == 1) {
-		grab_myaddrs();
-
-		if (autoconf_myaddrsport() < 0)
-			return -1;
-	}
-
-	return 0;
-}
-
-/* select the socket to be sent */
-/* should implement other method. */
-int
-getsockmyaddr(my)
-	struct sockaddr *my;
-{
-	struct myaddrs *p, *lastresort = NULL;
-#if defined(INET6) && defined(__linux__)
-	struct myaddrs *match_wo_scope_id = NULL;
-	int check_wo_scope_id = (my->sa_family == AF_INET6) && 
-		IN6_IS_ADDR_LINKLOCAL(&((struct sockaddr_in6 *)my)->sin6_addr);
-#endif
-
-	for (p = lcconf->myaddrs; p; p = p->next) {
-		if (p->addr == NULL)
-			continue;
-		if (my->sa_family == p->addr->sa_family) {
-			lastresort = p;
-		} else continue;
-		if (sysdep_sa_len(my) == sysdep_sa_len(p->addr)
-		 && memcmp(my, p->addr, sysdep_sa_len(my)) == 0) {
-			break;
-		}
-#if defined(INET6) && defined(__linux__)
-		if (check_wo_scope_id && IN6_IS_ADDR_LINKLOCAL(&((struct sockaddr_in6 *)p->addr)->sin6_addr) &&
-			/* XXX: this depends on sin6_scope_id to be last
-			 * item in struct sockaddr_in6 */
-			memcmp(my, p->addr, 
-				sysdep_sa_len(my) - sizeof(uint32_t)) == 0) {
-			match_wo_scope_id = p;
-		}
-#endif
-	}
-#if defined(INET6) && defined(__linux__)
-	if (!p)
-		p = match_wo_scope_id;
-#endif
-	if (!p)
-		p = lastresort;
-	if (!p) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"no socket matches address family %d\n",
-			my->sa_family);
-		return -1;
-	}
-
-	return p->sock;
-}
diff --git a/src/racoon/grabmyaddr.h b/src/racoon/grabmyaddr.h
deleted file mode 100644
index ac74b46..0000000
--- a/src/racoon/grabmyaddr.h
+++ /dev/null
@@ -1,56 +0,0 @@
-/*	$NetBSD: grabmyaddr.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/* Id: grabmyaddr.h,v 1.5 2004/06/11 16:00:16 ludvigm Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _GRABMYADDR_H
-#define _GRABMYADDR_H
-
-struct myaddrs {
-	struct myaddrs *next;
-	struct sockaddr *addr;
-	int sock;
-	int udp_encap;
-};
-
-extern void clear_myaddr __P((struct myaddrs **));
-extern void grab_myaddrs __P((void));
-extern int update_myaddrs __P((void));
-extern int autoconf_myaddrsport __P((void));
-extern u_short getmyaddrsport __P((struct sockaddr *));
-extern struct myaddrs *newmyaddr __P((void));
-extern struct myaddrs *dupmyaddr __P((struct myaddrs *));
-extern void insmyaddr __P((struct myaddrs *, struct myaddrs **));
-extern void delmyaddr __P((struct myaddrs *));
-extern int initmyaddr __P((void));
-extern int getsockmyaddr __P((struct sockaddr *));
-
-#endif /* _GRABMYADDR_H */
diff --git a/src/racoon/gssapi.c b/src/racoon/gssapi.c
deleted file mode 100644
index e64b201..0000000
--- a/src/racoon/gssapi.c
+++ /dev/null
@@ -1,749 +0,0 @@
-/*	$NetBSD: gssapi.c,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/*	$KAME: gssapi.c,v 1.19 2001/04/03 15:51:55 thorpej Exp $	*/
-
-/*
- * Copyright 2000 Wasabi Systems, Inc.
- * All rights reserved.
- *
- * This software was written by Frank van der Linden of Wasabi Systems
- * for Zembu Labs, Inc. http://www.zembu.com/
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. The name of Wasabi Systems, Inc. may not be used to endorse
- *    or promote products derived from this software without specific prior
- *    written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
- * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL WASABI SYSTEMS, INC
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#ifdef HAVE_GSSAPI
-
-#include <sys/types.h>
-#include <sys/queue.h>
-#include <sys/socket.h>
-#include <netdb.h>
-#include <unistd.h>
-
-#include <stdlib.h>
-#include <string.h>
-#include <errno.h>
-
-#include "var.h"
-#include "misc.h"
-#include "vmbuf.h"
-#include "plog.h"
-#include "sockmisc.h"
-#include "schedule.h"
-#include "debug.h"
-
-#include "localconf.h"
-#include "remoteconf.h"
-#include "isakmp_var.h"
-#include "isakmp.h"
-#include "oakley.h"
-#include "handler.h"
-#include "ipsec_doi.h"
-#include "crypto_openssl.h"
-#include "pfkey.h"
-#include "isakmp_ident.h"
-#include "isakmp_inf.h"
-#include "vendorid.h"
-#include "gcmalloc.h"
-
-#include "gssapi.h"
-
-static void
-gssapi_error(OM_uint32 status_code, const char *where,
-	     const char *fmt, ...)
-{
-	OM_uint32 message_context, maj_stat, min_stat;
-	gss_buffer_desc status_string;
-	va_list ap;
-
-	va_start(ap, fmt);
-	plogv(LLV_ERROR, where, NULL, fmt, ap);
-	va_end(ap);
-
-	message_context = 0;
-
-	do {
-		maj_stat = gss_display_status(&min_stat, status_code,
-		    GSS_C_MECH_CODE, GSS_C_NO_OID, &message_context,
-		    &status_string);
-		if (GSS_ERROR(maj_stat))
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "UNABLE TO GET GSSAPI ERROR CODE\n");
-		else {
-			plog(LLV_ERROR, where, NULL,
-			    "%s\n", (char *)status_string.value);
-			gss_release_buffer(&min_stat, &status_string);
-		}
-	} while (message_context != 0);
-}
-
-/*
- * vmbufs and gss_buffer_descs are really just the same on NetBSD, but
- * this is to be portable.
- */
-static int
-gssapi_vm2gssbuf(vchar_t *vmbuf, gss_buffer_t gsstoken)
-{
-
-	gsstoken->value = racoon_malloc(vmbuf->l);
-	if (gsstoken->value == NULL)
-		return -1;
-	memcpy(gsstoken->value, vmbuf->v, vmbuf->l);
-	gsstoken->length = vmbuf->l;
-
-	return 0;
-}
-
-static int
-gssapi_gss2vmbuf(gss_buffer_t gsstoken, vchar_t **vmbuf)
-{
-
-	*vmbuf = vmalloc(gsstoken->length);
-	if (*vmbuf == NULL)
-		return -1;
-	memcpy((*vmbuf)->v, gsstoken->value, gsstoken->length);
-	(*vmbuf)->l = gsstoken->length;
-
-	return 0;
-}
-
-vchar_t *
-gssapi_get_default_gss_id(void)
-{
-	char name[NI_MAXHOST];
-	vchar_t *gssid;
-
-	if (gethostname(name, sizeof(name)) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL, "gethostname failed: %s\n",
-		    strerror(errno));
-		return (NULL);
-	}
-	name[sizeof(name) - 1] = '\0';
-
-	gssid = racoon_malloc(sizeof(*gssid));
-	gssid->l = asprintf(&gssid->v, "%s/%s", GSSAPI_DEF_NAME, name);
-
-	return (gssid);
-}
-
-static int
-gssapi_get_default_name(struct ph1handle *iph1, int remote, gss_name_t *service)
-{
-	char name[NI_MAXHOST];
-	struct sockaddr *sa;
-	char* buf = NULL;
-	gss_buffer_desc name_token;
-	OM_uint32 min_stat, maj_stat;
-
-	sa = remote ? iph1->remote : iph1->local;
-
-	if (getnameinfo(sa, sysdep_sa_len(sa), name, NI_MAXHOST, NULL, 0, 0) != 0)
-		return -1;
-
-	name_token.length = asprintf(&buf, "%s@%s", GSSAPI_DEF_NAME, name);
-	name_token.value = buf;
-
-	maj_stat = gss_import_name(&min_stat, &name_token,
-	    GSS_C_NT_HOSTBASED_SERVICE, service);
-	if (GSS_ERROR(maj_stat)) {
-		gssapi_error(min_stat, LOCATION, "import name\n");
-		maj_stat = gss_release_buffer(&min_stat, &name_token);
-		if (GSS_ERROR(maj_stat))
-			gssapi_error(min_stat, LOCATION, "release name_token");
-		return -1;
-	}
-	maj_stat = gss_release_buffer(&min_stat, &name_token);
-	if (GSS_ERROR(maj_stat))
-		gssapi_error(min_stat, LOCATION, "release name_token");
-
-	return 0;
-}
-
-static int
-gssapi_init(struct ph1handle *iph1)
-{
-	struct gssapi_ph1_state *gps;
-	gss_buffer_desc id_token, cred_token;
-	gss_buffer_t cred = &cred_token;
-	gss_name_t princ, canon_princ;
-	OM_uint32 maj_stat, min_stat;
-
-	gps = racoon_calloc(1, sizeof (struct gssapi_ph1_state));
-	if (gps == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "racoon_calloc failed\n");
-		return -1;
-	}
-	gps->gss_context = GSS_C_NO_CONTEXT;
-	gps->gss_cred = GSS_C_NO_CREDENTIAL;
-
-	gssapi_set_state(iph1, gps);
-
-	if (iph1->rmconf->proposal->gssid != NULL) {
-		id_token.length = iph1->rmconf->proposal->gssid->l;
-		id_token.value = iph1->rmconf->proposal->gssid->v;
-		maj_stat = gss_import_name(&min_stat, &id_token, GSS_C_NO_OID,
-		    &princ);
-		if (GSS_ERROR(maj_stat)) {
-			gssapi_error(min_stat, LOCATION, "import name\n");
-			gssapi_free_state(iph1);
-			return -1;
-		}
-	} else
-		gssapi_get_default_name(iph1, 0, &princ);
-
-	maj_stat = gss_canonicalize_name(&min_stat, princ, GSS_C_NO_OID,
-	    &canon_princ);
-	if (GSS_ERROR(maj_stat)) {
-		gssapi_error(min_stat, LOCATION, "canonicalize name\n");
-		maj_stat = gss_release_name(&min_stat, &princ);
-		if (GSS_ERROR(maj_stat))
-			gssapi_error(min_stat, LOCATION, "release princ\n");
-		gssapi_free_state(iph1);
-		return -1;
-	}
-	maj_stat = gss_release_name(&min_stat, &princ);
-	if (GSS_ERROR(maj_stat))
-		gssapi_error(min_stat, LOCATION, "release princ\n");
-
-	maj_stat = gss_export_name(&min_stat, canon_princ, cred);
-	if (GSS_ERROR(maj_stat)) {
-		gssapi_error(min_stat, LOCATION, "export name\n");
-		maj_stat = gss_release_name(&min_stat, &canon_princ);
-		if (GSS_ERROR(maj_stat))
-			gssapi_error(min_stat, LOCATION,
-			    "release canon_princ\n");
-		gssapi_free_state(iph1);
-		return -1;
-	}
-
-#if 0
-	/*
-	 * XXXJRT Did this debug message ever work?  This is a GSS name
-	 * blob at this point.
-	 */
-	plog(LLV_DEBUG, LOCATION, NULL, "will try to acquire '%.*s' creds\n",
-	    cred->length, cred->value);
-#endif
-
-	maj_stat = gss_release_buffer(&min_stat, cred);
-	if (GSS_ERROR(maj_stat))
-		gssapi_error(min_stat, LOCATION, "release cred buffer\n");
-
-	maj_stat = gss_acquire_cred(&min_stat, canon_princ, GSS_C_INDEFINITE,
-	    GSS_C_NO_OID_SET, GSS_C_BOTH, &gps->gss_cred, NULL, NULL);
-	if (GSS_ERROR(maj_stat)) {
-		gssapi_error(min_stat, LOCATION, "acquire cred\n");
-		maj_stat = gss_release_name(&min_stat, &canon_princ);
-		if (GSS_ERROR(maj_stat))
-			gssapi_error(min_stat, LOCATION,
-			    "release canon_princ\n");
-		gssapi_free_state(iph1);
-		return -1;
-	}
-	maj_stat = gss_release_name(&min_stat, &canon_princ);
-	if (GSS_ERROR(maj_stat))
-		gssapi_error(min_stat, LOCATION, "release canon_princ\n");
-
-	return 0;
-}
-
-int
-gssapi_get_itoken(struct ph1handle *iph1, int *lenp)
-{
-	struct gssapi_ph1_state *gps;
-	gss_buffer_desc empty, name_token;
-	gss_buffer_t itoken, rtoken, dummy;
-	OM_uint32 maj_stat, min_stat;
-	gss_name_t partner;
-
-	if (gssapi_get_state(iph1) == NULL && gssapi_init(iph1) < 0)
-		return -1;
-
-	gps = gssapi_get_state(iph1);
-
-	empty.length = 0;
-	empty.value = NULL;
-	dummy = &empty;
-
-	if (iph1->approval != NULL && iph1->approval->gssid != NULL) {
-		plog(LLV_DEBUG, LOCATION, NULL,
-		    "using provided service '%.*s'\n",
-		    (int)iph1->approval->gssid->l, iph1->approval->gssid->v);
-		name_token.length = iph1->approval->gssid->l;
-		name_token.value = iph1->approval->gssid->v;
-		maj_stat = gss_import_name(&min_stat, &name_token,
-		    GSS_C_NO_OID, &partner);
-		if (GSS_ERROR(maj_stat)) {
-			gssapi_error(min_stat, LOCATION, "import of %.*s\n",
-			    name_token.length, name_token.value);
-			return -1;
-		}
-	} else
-		if (gssapi_get_default_name(iph1, 1, &partner) < 0)
-			return -1;
-
-	rtoken = gps->gsscnt_p == 0 ? dummy : &gps->gss_p[gps->gsscnt_p - 1];
-	itoken = &gps->gss[gps->gsscnt];
-
-	gps->gss_status = gss_init_sec_context(&min_stat, gps->gss_cred,
-	    &gps->gss_context, partner, GSS_C_NO_OID,
-	    GSS_C_MUTUAL_FLAG | GSS_C_SEQUENCE_FLAG |
-		GSS_C_CONF_FLAG | GSS_C_INTEG_FLAG,
-	    0, GSS_C_NO_CHANNEL_BINDINGS, rtoken, NULL,
-	    itoken, NULL, NULL);
-
-	if (GSS_ERROR(gps->gss_status)) {
-		gssapi_error(min_stat, LOCATION, "init_sec_context\n");
-		maj_stat = gss_release_name(&min_stat, &partner);
-		if (GSS_ERROR(maj_stat))
-			gssapi_error(min_stat, LOCATION, "release name\n");
-		return -1;
-	}
-	maj_stat = gss_release_name(&min_stat, &partner);
-	if (GSS_ERROR(maj_stat))
-		gssapi_error(min_stat, LOCATION, "release name\n");
-
-	plog(LLV_DEBUG, LOCATION, NULL, "gss_init_sec_context status %x\n",
-	    gps->gss_status);
-
-	if (lenp)
-		*lenp = itoken->length;
-
-	if (itoken->length != 0)
-		gps->gsscnt++;
-
-	return 0;
-}
-
-/*
- * Call gss_accept_context, with token just read from the wire.
- */
-int
-gssapi_get_rtoken(struct ph1handle *iph1, int *lenp)
-{
-	struct gssapi_ph1_state *gps;
-	gss_buffer_desc name_token;
-	gss_buffer_t itoken, rtoken;
-	OM_uint32 min_stat, maj_stat;
-	gss_name_t client_name;
-
-	if (gssapi_get_state(iph1) == NULL && gssapi_init(iph1) < 0)
-		return -1;
-
-	gps = gssapi_get_state(iph1);
-
-	rtoken = &gps->gss_p[gps->gsscnt_p - 1];
-	itoken = &gps->gss[gps->gsscnt];
-
-	gps->gss_status = gss_accept_sec_context(&min_stat, &gps->gss_context,
-	    gps->gss_cred, rtoken, GSS_C_NO_CHANNEL_BINDINGS, &client_name,
-	    NULL, itoken, NULL, NULL, NULL);
-
-	if (GSS_ERROR(gps->gss_status)) {
-		gssapi_error(min_stat, LOCATION, "accept_sec_context\n");
-		return -1;
-	}
-
-	maj_stat = gss_display_name(&min_stat, client_name, &name_token, NULL);
-	if (GSS_ERROR(maj_stat)) {
-		gssapi_error(min_stat, LOCATION, "gss_display_name\n");
-		maj_stat = gss_release_name(&min_stat, &client_name);
-		if (GSS_ERROR(maj_stat))
-			gssapi_error(min_stat, LOCATION,
-			    "release client_name\n");
-		return -1;
-	}
-	maj_stat = gss_release_name(&min_stat, &client_name);
-	if (GSS_ERROR(maj_stat))
-		gssapi_error(min_stat, LOCATION, "release client_name\n");
-
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"gss_accept_sec_context: other side is %s\n",
-		(char *)name_token.value);
-	maj_stat = gss_release_buffer(&min_stat, &name_token);
-	if (GSS_ERROR(maj_stat))
-		gssapi_error(min_stat, LOCATION, "release name buffer\n");
-
-	if (itoken->length != 0)
-		gps->gsscnt++;
-
-	if (lenp)
-		*lenp = itoken->length;
-
-	return 0;
-}
-
-int
-gssapi_save_received_token(struct ph1handle *iph1, vchar_t *token)
-{
-	struct gssapi_ph1_state *gps;
-	gss_buffer_t gsstoken;
-	int ret;
-
-	if (gssapi_get_state(iph1) == NULL && gssapi_init(iph1) < 0)
-		return -1;
-
-	gps = gssapi_get_state(iph1);
-
-	gsstoken = &gps->gss_p[gps->gsscnt_p];
-
-	ret = gssapi_vm2gssbuf(token, gsstoken);
-	if (ret < 0)
-		return ret;
-	gps->gsscnt_p++;
-
-	return 0;
-}
-
-int
-gssapi_get_token_to_send(struct ph1handle *iph1, vchar_t **token)
-{
-	struct gssapi_ph1_state *gps;
-	gss_buffer_t gsstoken;
-	int ret;
-
-	gps = gssapi_get_state(iph1);
-	if (gps == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "gssapi not yet initialized?\n");
-		return -1;
-	}
-	gsstoken = &gps->gss[gps->gsscnt - 1];
-	ret = gssapi_gss2vmbuf(gsstoken, token);
-	if (ret < 0)
-		return ret;
-
-	return 0;
-}
-
-int
-gssapi_get_itokens(struct ph1handle *iph1, vchar_t **tokens)
-{
-	struct gssapi_ph1_state *gps;
-	int len, i;
-	vchar_t *toks;
-	char *p;
-
-	gps = gssapi_get_state(iph1);
-	if (gps == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "gssapi not yet initialized?\n");
-		return -1;
-	}
-
-	for (i = len = 0; i < gps->gsscnt; i++)
-		len += gps->gss[i].length;
-
-	toks = vmalloc(len);
-	if (toks == 0)
-		return -1;
-	p = (char *)toks->v;
-	for (i = 0; i < gps->gsscnt; i++) {
-		memcpy(p, gps->gss[i].value, gps->gss[i].length);
-		p += gps->gss[i].length;
-	}
-
-	*tokens = toks;
-
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"%d itokens of length %zu\n", gps->gsscnt, (*tokens)->l);
-
-	return 0;
-}
-
-int
-gssapi_get_rtokens(struct ph1handle *iph1, vchar_t **tokens)
-{
-	struct gssapi_ph1_state *gps;
-	int len, i;
-	vchar_t *toks;
-	char *p;
-
-	gps = gssapi_get_state(iph1);
-	if (gps == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "gssapi not yet initialized?\n");
-		return -1;
-	}
-
-	if (gssapi_more_tokens(iph1)) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "gssapi roundtrips not complete\n");
-		return -1;
-	}
-
-	for (i = len = 0; i < gps->gsscnt_p; i++)
-		len += gps->gss_p[i].length;
-
-	toks = vmalloc(len);
-	if (toks == 0)
-		return -1;
-	p = (char *)toks->v;
-	for (i = 0; i < gps->gsscnt_p; i++) {
-		memcpy(p, gps->gss_p[i].value, gps->gss_p[i].length);
-		p += gps->gss_p[i].length;
-	}
-
-	*tokens = toks;
-
-	return 0;
-}
-
-vchar_t *
-gssapi_wraphash(struct ph1handle *iph1)
-{
-	struct gssapi_ph1_state *gps;
-	OM_uint32 maj_stat, min_stat;
-	gss_buffer_desc hash_in_buf, hash_out_buf;
-	gss_buffer_t hash_in = &hash_in_buf, hash_out = &hash_out_buf;
-	vchar_t *outbuf;
-
-	gps = gssapi_get_state(iph1);
-	if (gps == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "gssapi not yet initialized?\n");
-		return NULL;
-	}
-
-	if (gssapi_more_tokens(iph1)) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "gssapi roundtrips not complete\n");
-		return NULL;
-	}
-
-	if (gssapi_vm2gssbuf(iph1->hash, hash_in) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL, "vm2gssbuf failed\n");
-		return NULL;
-	}
-
-	maj_stat = gss_wrap(&min_stat, gps->gss_context, 1, GSS_C_QOP_DEFAULT,
-	    hash_in, NULL, hash_out);
-	if (GSS_ERROR(maj_stat)) {
-		gssapi_error(min_stat, LOCATION, "wrapping hash value\n");
-		maj_stat = gss_release_buffer(&min_stat, hash_in);
-		if (GSS_ERROR(maj_stat))
-			gssapi_error(min_stat, LOCATION,
-			    "release hash_in buffer\n");
-		return NULL;
-	}
-
-	plog(LLV_DEBUG, LOCATION, NULL, "wrapped HASH, ilen %zu olen %zu\n",
-	    hash_in->length, hash_out->length);
-
-	maj_stat = gss_release_buffer(&min_stat, hash_in);
-	if (GSS_ERROR(maj_stat))
-		gssapi_error(min_stat, LOCATION, "release hash_in buffer\n");
-
-	if (gssapi_gss2vmbuf(hash_out, &outbuf) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL, "gss2vmbuf failed\n");
-		maj_stat = gss_release_buffer(&min_stat, hash_out);
-		if (GSS_ERROR(maj_stat))
-			gssapi_error(min_stat, LOCATION,
-			    "release hash_out buffer\n");
-		return NULL;
-	}
-	maj_stat = gss_release_buffer(&min_stat, hash_out);
-	if (GSS_ERROR(maj_stat))
-		gssapi_error(min_stat, LOCATION, "release hash_out buffer\n");
-
-	return outbuf;
-}
-
-vchar_t *
-gssapi_unwraphash(struct ph1handle *iph1)
-{
-	struct gssapi_ph1_state *gps;
-	OM_uint32 maj_stat, min_stat;
-	gss_buffer_desc hashbuf, hash_outbuf;
-	gss_buffer_t hash_in = &hashbuf, hash_out = &hash_outbuf;
-	vchar_t *outbuf;
-
-	gps = gssapi_get_state(iph1);
-	if (gps == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "gssapi not yet initialized?\n");
-		return NULL;
-	}
-
-
-	hashbuf.length = ntohs(iph1->pl_hash->h.len) - sizeof(*iph1->pl_hash);
-	hashbuf.value = (char *)(iph1->pl_hash + 1);
-
-	plog(LLV_DEBUG, LOCATION, NULL, "unwrapping HASH of len %zu\n",
-	    hashbuf.length);
-
-	maj_stat = gss_unwrap(&min_stat, gps->gss_context, hash_in, hash_out,
-	    NULL, NULL);
-	if (GSS_ERROR(maj_stat)) {
-		gssapi_error(min_stat, LOCATION, "unwrapping hash value\n");
-		return NULL;
-	}
-
-	if (gssapi_gss2vmbuf(hash_out, &outbuf) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL, "gss2vmbuf failed\n");
-		maj_stat = gss_release_buffer(&min_stat, hash_out);
-		if (GSS_ERROR(maj_stat))
-			gssapi_error(min_stat, LOCATION,
-			    "release hash_out buffer\n");
-		return NULL;
-	}
-	maj_stat = gss_release_buffer(&min_stat, hash_out);
-	if (GSS_ERROR(maj_stat))
-		gssapi_error(min_stat, LOCATION, "release hash_out buffer\n");
-
-	return outbuf;
-}
-
-void
-gssapi_set_id_sent(struct ph1handle *iph1)
-{
-	struct gssapi_ph1_state *gps;
-
-	gps = gssapi_get_state(iph1);
-
-	gps->gss_flags |= GSSFLAG_ID_SENT;
-}
-
-int
-gssapi_id_sent(struct ph1handle *iph1)
-{
-	struct gssapi_ph1_state *gps;
-
-	gps = gssapi_get_state(iph1);
-
-	return (gps->gss_flags & GSSFLAG_ID_SENT) != 0;
-}
-
-void
-gssapi_set_id_rcvd(struct ph1handle *iph1)
-{
-	struct gssapi_ph1_state *gps;
-
-	gps = gssapi_get_state(iph1);
-
-	gps->gss_flags |= GSSFLAG_ID_RCVD;
-}
-
-int
-gssapi_id_rcvd(struct ph1handle *iph1)
-{
-	struct gssapi_ph1_state *gps;
-
-	gps = gssapi_get_state(iph1);
-
-	return (gps->gss_flags & GSSFLAG_ID_RCVD) != 0;
-}
-
-void
-gssapi_free_state(struct ph1handle *iph1)
-{
-	struct gssapi_ph1_state *gps;
-	OM_uint32 maj_stat, min_stat;
-
-	gps = gssapi_get_state(iph1);
-
-	if (gps == NULL)
-		return;
-
-	gssapi_set_state(iph1, NULL);
-
-	if (gps->gss_cred != GSS_C_NO_CREDENTIAL) {
-		maj_stat = gss_release_cred(&min_stat, &gps->gss_cred);
-		if (GSS_ERROR(maj_stat))
-			gssapi_error(min_stat, LOCATION,
-			    "releasing credentials\n");
-	}
-	racoon_free(gps);
-}
-
-vchar_t *
-gssapi_get_id(struct ph1handle *iph1)
-{
-	gss_buffer_desc id_buffer;
-	gss_buffer_t id = &id_buffer;
-	gss_name_t defname, canon_name;
-	OM_uint32 min_stat, maj_stat;
-	vchar_t *vmbuf;
-
-	if (iph1->rmconf->proposal->gssid != NULL)
-		return (vdup(iph1->rmconf->proposal->gssid));
-
-	if (gssapi_get_default_name(iph1, 0, &defname) < 0)
-		return NULL;
-
-	maj_stat = gss_canonicalize_name(&min_stat, defname, GSS_C_NO_OID,
-	    &canon_name);
-	if (GSS_ERROR(maj_stat)) {
-		gssapi_error(min_stat, LOCATION, "canonicalize name\n");
-		maj_stat = gss_release_name(&min_stat, &defname);
-		if (GSS_ERROR(maj_stat))
-			gssapi_error(min_stat, LOCATION,
-			    "release default name\n");
-		return NULL;
-	}
-	maj_stat = gss_release_name(&min_stat, &defname);
-	if (GSS_ERROR(maj_stat))
-		gssapi_error(min_stat, LOCATION, "release default name\n");
-
-	maj_stat = gss_export_name(&min_stat, canon_name, id);
-	if (GSS_ERROR(maj_stat)) {
-		gssapi_error(min_stat, LOCATION, "export name\n");
-		maj_stat = gss_release_name(&min_stat, &canon_name);
-		if (GSS_ERROR(maj_stat))
-			gssapi_error(min_stat, LOCATION,
-			    "release canonical name\n");
-		return NULL;
-	}
-	maj_stat = gss_release_name(&min_stat, &canon_name);
-	if (GSS_ERROR(maj_stat))
-		gssapi_error(min_stat, LOCATION, "release canonical name\n");
-
-#if 0
-	/*
-	 * XXXJRT Did this debug message ever work?  This is a GSS name
-	 * blob at this point.
-	 */
-	plog(LLV_DEBUG, LOCATION, NULL, "will try to acquire '%.*s' creds\n",
-	    id->length, id->value);
-#endif
-
-	if (gssapi_gss2vmbuf(id, &vmbuf) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL, "gss2vmbuf failed\n");
-		maj_stat = gss_release_buffer(&min_stat, id);
-		if (GSS_ERROR(maj_stat))
-			gssapi_error(min_stat, LOCATION, "release id buffer\n");
-		return NULL;
-	}
-	maj_stat = gss_release_buffer(&min_stat, id);
-	if (GSS_ERROR(maj_stat))
-		gssapi_error(min_stat, LOCATION, "release id buffer\n");
-
-	return vmbuf;
-}
-#else
-int __gssapi_dUmMy;
-#endif
diff --git a/src/racoon/gssapi.h b/src/racoon/gssapi.h
deleted file mode 100644
index 25c6c48..0000000
--- a/src/racoon/gssapi.h
+++ /dev/null
@@ -1,91 +0,0 @@
-/*	$NetBSD: gssapi.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/* Id: gssapi.h,v 1.5 2005/02/11 06:59:01 manubsd Exp */
-
-/*
- * Copyright 2000 Wasabi Systems, Inc.
- * All rights reserved.
- *
- * This software was written by Frank van der Linden of Wasabi Systems
- * for Zembu Labs, Inc. http://www.zembu.com/
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. The name of Wasabi Systems, Inc. may not be used to endorse
- *    or promote products derived from this software without specific prior
- *    written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
- * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL WASABI SYSTEMS, INC
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifdef __FreeBSD__
-#include "/usr/include/gssapi.h"
-#else
-#include <gssapi/gssapi.h>
-#endif
-
-#define GSSAPI_DEF_NAME         "host"
-
-struct ph1handle;
-struct isakmpsa;
-
-struct gssapi_ph1_state {
-	int gsscnt;			/* # of token we're working on */
-	int gsscnt_p;			/* # of token we're working on */
-
-	gss_buffer_desc gss[3];		/* gss-api tokens. */
-					/* NOTE: XXX this restricts the max # */
-					/* to 3. More should never happen */
-
-	gss_buffer_desc gss_p[3];
-
-	gss_ctx_id_t gss_context;	/* context for gss_init_sec_context */
-
-	OM_uint32 gss_status;		/* retval from gss_init_sec_context */
-	gss_cred_id_t gss_cred;		/* acquired credentials */
-
-	int gss_flags;
-#define GSSFLAG_ID_SENT		0x0001
-#define GSSFLAG_ID_RCVD		0x0001
-};
-
-#define	gssapi_get_state(ph)						\
-	((struct gssapi_ph1_state *)((ph)->gssapi_state))
-
-#define	gssapi_set_state(ph, st)					\
-	(ph)->gssapi_state = (st)
-
-#define	gssapi_more_tokens(ph)						\
-	((gssapi_get_state(ph)->gss_status & GSS_S_CONTINUE_NEEDED) != 0)
-
-int gssapi_get_itoken __P((struct ph1handle *, int *));
-int gssapi_get_rtoken __P((struct ph1handle *, int *));
-int gssapi_save_received_token __P((struct ph1handle *, vchar_t *));
-int gssapi_get_token_to_send __P((struct ph1handle *, vchar_t **));
-int gssapi_get_itokens __P((struct ph1handle *, vchar_t **));
-int gssapi_get_rtokens __P((struct ph1handle *, vchar_t **));
-vchar_t *gssapi_wraphash __P((struct ph1handle *));
-vchar_t *gssapi_unwraphash __P((struct ph1handle *));
-void gssapi_set_id_sent __P((struct ph1handle *));
-int gssapi_id_sent __P((struct ph1handle *));
-void gssapi_set_id_rcvd __P((struct ph1handle *));
-int gssapi_id_rcvd __P((struct ph1handle *));
-void gssapi_free_state __P((struct ph1handle *));
-vchar_t *gssapi_get_id __P((struct ph1handle *));
-vchar_t *gssapi_get_default_gss_id __P((void));
diff --git a/src/racoon/handler.c b/src/racoon/handler.c
deleted file mode 100644
index b643256..0000000
--- a/src/racoon/handler.c
+++ /dev/null
@@ -1,1571 +0,0 @@
-/*	$NetBSD: handler.c,v 1.9.6.8 2009/04/20 13:25:27 tteras Exp $	*/
-
-/* Id: handler.c,v 1.28 2006/05/26 12:17:29 manubsd Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/socket.h>
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <time.h>
-#include <errno.h>
-
-#include "var.h"
-#include "misc.h"
-#include "vmbuf.h"
-#include "plog.h"
-#include "sockmisc.h"
-#include "debug.h"
-
-#ifdef ENABLE_HYBRID
-#include <resolv.h>
-#endif
-
-#include "schedule.h"
-#include "grabmyaddr.h"
-#include "algorithm.h"
-#include "crypto_openssl.h"
-#include "policy.h"
-#include "proposal.h"
-#include "isakmp_var.h"
-#include "evt.h"
-#include "isakmp.h"
-#ifdef ENABLE_HYBRID
-#include "isakmp_xauth.h"  
-#include "isakmp_cfg.h"
-#endif
-#include "isakmp_inf.h"
-#include "oakley.h"
-#include "remoteconf.h"
-#include "localconf.h"
-#include "handler.h"
-#include "gcmalloc.h"
-#include "nattraversal.h"
-
-#include "sainfo.h"
-
-#ifdef HAVE_GSSAPI
-#include "gssapi.h"
-#endif
-
-static LIST_HEAD(_ph1tree_, ph1handle) ph1tree;
-static LIST_HEAD(_ph2tree_, ph2handle) ph2tree;
-static LIST_HEAD(_ctdtree_, contacted) ctdtree;
-static LIST_HEAD(_rcptree_, recvdpkt) rcptree;
-
-static void del_recvdpkt __P((struct recvdpkt *));
-static void rem_recvdpkt __P((struct recvdpkt *));
-static void sweep_recvdpkt __P((void *));
-
-/*
- * functions about management of the isakmp status table
- */
-/* %%% management phase 1 handler */
-/*
- * search for isakmpsa handler with isakmp index.
- */
-
-extern caddr_t val2str(const char *, size_t);
-
-struct ph1handle *
-getph1byindex(index)
-	isakmp_index *index;
-{
-	struct ph1handle *p;
-
-	LIST_FOREACH(p, &ph1tree, chain) {
-		if (p->status == PHASE1ST_EXPIRED)
-			continue;
-		if (memcmp(&p->index, index, sizeof(*index)) == 0)
-			return p;
-	}
-
-	return NULL;
-}
-
-
-/*
- * search for isakmp handler by i_ck in index.
- */
-struct ph1handle *
-getph1byindex0(index)
-	isakmp_index *index;
-{
-	struct ph1handle *p;
-
-	LIST_FOREACH(p, &ph1tree, chain) {
-		if (p->status == PHASE1ST_EXPIRED)
-			continue;
-		if (memcmp(&p->index, index, sizeof(cookie_t)) == 0)
-			return p;
-	}
-
-	return NULL;
-}
-
-/*
- * search for isakmpsa handler by source and remote address.
- * don't use port number to search because this function search
- * with phase 2's destinaion.
- */
-struct ph1handle *
-getph1byaddr(local, remote, established)
-	struct sockaddr *local, *remote;
-	int established;
-{
-	struct ph1handle *p;
-
-	plog(LLV_DEBUG2, LOCATION, NULL, "getph1byaddr: start\n");
-	plog(LLV_DEBUG2, LOCATION, NULL, "local: %s\n", saddr2str(local));
-	plog(LLV_DEBUG2, LOCATION, NULL, "remote: %s\n", saddr2str(remote));
-
-	LIST_FOREACH(p, &ph1tree, chain) {
-		if (p->status == PHASE1ST_EXPIRED)
-			continue;
-		plog(LLV_DEBUG2, LOCATION, NULL, "p->local: %s\n", saddr2str(p->local));
-		plog(LLV_DEBUG2, LOCATION, NULL, "p->remote: %s\n", saddr2str(p->remote));
-
-		if(established && p->status != PHASE1ST_ESTABLISHED){
-			plog(LLV_DEBUG2, LOCATION, NULL, "status %d, skipping\n", p->status);
-			continue;
-		}
-		if (CMPSADDR(local, p->local) == 0
-			&& CMPSADDR(remote, p->remote) == 0){
-			plog(LLV_DEBUG2, LOCATION, NULL, "matched\n");
-			return p;
-		}
-	}
-
-	plog(LLV_DEBUG2, LOCATION, NULL, "no match\n");
-
-	return NULL;
-}
-
-struct ph1handle *
-getph1byaddrwop(local, remote)
-	struct sockaddr *local, *remote;
-{
-	struct ph1handle *p;
-
-	LIST_FOREACH(p, &ph1tree, chain) {
-		if (p->status == PHASE1ST_EXPIRED)
-			continue;
-		if (cmpsaddrwop(local, p->local) == 0
-		 && cmpsaddrwop(remote, p->remote) == 0)
-			return p;
-	}
-
-	return NULL;
-}
-
-/*
- * search for isakmpsa handler by remote address.
- * don't use port number to search because this function search
- * with phase 2's destinaion.
- */
-struct ph1handle *
-getph1bydstaddrwop(remote)
-	struct sockaddr *remote;
-{
-	struct ph1handle *p;
-
-	LIST_FOREACH(p, &ph1tree, chain) {
-		if (p->status == PHASE1ST_EXPIRED)
-			continue;
-		if (cmpsaddrwop(remote, p->remote) == 0)
-			return p;
-	}
-
-	return NULL;
-}
-
-/*
- * dump isakmp-sa
- */
-vchar_t *
-dumpph1()
-{
-	struct ph1handle *iph1;
-	struct ph1dump *pd;
-	int cnt = 0;
-	vchar_t *buf;
-
-	/* get length of buffer */
-	LIST_FOREACH(iph1, &ph1tree, chain)
-		cnt++;
-
-	buf = vmalloc(cnt * sizeof(struct ph1dump));
-	if (buf == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get buffer\n");
-		return NULL;
-	}
-	pd = (struct ph1dump *)buf->v;
-
-	LIST_FOREACH(iph1, &ph1tree, chain) {
-		memcpy(&pd->index, &iph1->index, sizeof(iph1->index));
-		pd->status = iph1->status;
-		pd->side = iph1->side;
-		memcpy(&pd->remote, iph1->remote, sysdep_sa_len(iph1->remote));
-		memcpy(&pd->local, iph1->local, sysdep_sa_len(iph1->local));
-		pd->version = iph1->version;
-		pd->etype = iph1->etype;
-		pd->created = iph1->created;
-		pd->ph2cnt = iph1->ph2cnt;
-		pd++;
-	}
-
-	return buf;
-}
-
-/*
- * create new isakmp Phase 1 status record to handle isakmp in Phase1
- */
-struct ph1handle *
-newph1()
-{
-	struct ph1handle *iph1;
-
-	/* create new iph1 */
-	iph1 = racoon_calloc(1, sizeof(*iph1));
-	if (iph1 == NULL)
-		return NULL;
-
-	iph1->status = PHASE1ST_SPAWN;
-
-#ifdef ENABLE_DPD
-	iph1->dpd_support = 0;
-	iph1->dpd_lastack = 0;
-	iph1->dpd_seq = 0;
-	iph1->dpd_fails = 0;
-	iph1->dpd_r_u = NULL;
-#endif
-
-	return iph1;
-}
-
-/*
- * delete new isakmp Phase 1 status record to handle isakmp in Phase1
- */
-void
-delph1(iph1)
-	struct ph1handle *iph1;
-{
-	if (iph1 == NULL)
-		return;
-
-	/* SA down shell script hook */
-	script_hook(iph1, SCRIPT_PHASE1_DOWN);
-
-	EVT_PUSH(iph1->local, iph1->remote, EVTT_PHASE1_DOWN, NULL);
-
-#ifdef ENABLE_NATT
-	if (iph1->natt_flags & NAT_KA_QUEUED)
-		natt_keepalive_remove (iph1->local, iph1->remote);
-
-	if (iph1->natt_options) {
-		racoon_free(iph1->natt_options);
-		iph1->natt_options = NULL;
-	}
-#endif
-
-#ifdef ENABLE_HYBRID
-	if (iph1->mode_cfg)
-		isakmp_cfg_rmstate(iph1);
-#endif
-
-#ifdef ENABLE_DPD
-	SCHED_KILL(iph1->dpd_r_u);
-#endif
-
-	if (iph1->remote) {
-		racoon_free(iph1->remote);
-		iph1->remote = NULL;
-	}
-	if (iph1->local) {
-		racoon_free(iph1->local);
-		iph1->local = NULL;
-	}
-	if (iph1->approval) {
-		delisakmpsa(iph1->approval);
-		iph1->approval = NULL;
-	}
-
-	VPTRINIT(iph1->authstr);
-
-	sched_scrub_param(iph1);
-	iph1->sce = NULL;
-	iph1->scr = NULL;
-
-	VPTRINIT(iph1->sendbuf);
-
-	VPTRINIT(iph1->dhpriv);
-	VPTRINIT(iph1->dhpub);
-	VPTRINIT(iph1->dhpub_p);
-	VPTRINIT(iph1->dhgxy);
-	VPTRINIT(iph1->nonce);
-	VPTRINIT(iph1->nonce_p);
-	VPTRINIT(iph1->skeyid);
-	VPTRINIT(iph1->skeyid_d);
-	VPTRINIT(iph1->skeyid_a);
-	VPTRINIT(iph1->skeyid_e);
-	VPTRINIT(iph1->key);
-	VPTRINIT(iph1->hash);
-	VPTRINIT(iph1->sig);
-	VPTRINIT(iph1->sig_p);
-	oakley_delcert(iph1->cert);
-	iph1->cert = NULL;
-	oakley_delcert(iph1->cert_p);
-	iph1->cert_p = NULL;
-	oakley_delcert(iph1->crl_p);
-	iph1->crl_p = NULL;
-	oakley_delcert(iph1->cr_p);
-	iph1->cr_p = NULL;
-	VPTRINIT(iph1->id);
-	VPTRINIT(iph1->id_p);
-
-	if(iph1->approval != NULL)
-		delisakmpsa(iph1->approval);
-
-	if (iph1->ivm) {
-		oakley_delivm(iph1->ivm);
-		iph1->ivm = NULL;
-	}
-
-	VPTRINIT(iph1->sa);
-	VPTRINIT(iph1->sa_ret);
-
-#ifdef HAVE_GSSAPI
-	VPTRINIT(iph1->gi_i);
-	VPTRINIT(iph1->gi_r);
-
-	gssapi_free_state(iph1);
-#endif
-
-	racoon_free(iph1);
-}
-
-/*
- * create new isakmp Phase 1 status record to handle isakmp in Phase1
- */
-int
-insph1(iph1)
-	struct ph1handle *iph1;
-{
-	/* validity check */
-	if (iph1->remote == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid isakmp SA handler. no remote address.\n");
-		return -1;
-	}
-	LIST_INSERT_HEAD(&ph1tree, iph1, chain);
-
-	return 0;
-}
-
-void
-remph1(iph1)
-	struct ph1handle *iph1;
-{
-	LIST_REMOVE(iph1, chain);
-}
-
-/*
- * flush isakmp-sa
- */
-void
-flushph1()
-{
-	struct ph1handle *p, *next;
-
-	for (p = LIST_FIRST(&ph1tree); p; p = next) {
-		next = LIST_NEXT(p, chain);
-
-		/* send delete information */
-		if (p->status == PHASE1ST_ESTABLISHED) 
-			isakmp_info_send_d1(p);
-
-		remph1(p);
-		delph1(p);
-	}
-}
-
-void
-initph1tree()
-{
-	LIST_INIT(&ph1tree);
-}
-
-/* %%% management phase 2 handler */
-/*
- * search ph2handle with policy id.
- */
-struct ph2handle *
-getph2byspid(spid)
-      u_int32_t spid;
-{
-	struct ph2handle *p;
-
-	LIST_FOREACH(p, &ph2tree, chain) {
-		/*
-		 * there are ph2handle independent on policy
-		 * such like informational exchange.
-		 */
-		if (p->spid == spid)
-			return p;
-	}
-
-	return NULL;
-}
-
-/*
- * search ph2handle with sequence number.
- */
-struct ph2handle *
-getph2byseq(seq)
-	u_int32_t seq;
-{
-	struct ph2handle *p;
-
-	LIST_FOREACH(p, &ph2tree, chain) {
-		if (p->seq == seq)
-			return p;
-	}
-
-	return NULL;
-}
-
-/*
- * search ph2handle with message id.
- */
-struct ph2handle *
-getph2bymsgid(iph1, msgid)
-	struct ph1handle *iph1;
-	u_int32_t msgid;
-{
-	struct ph2handle *p;
-
-	LIST_FOREACH(p, &ph2tree, chain) {
-		if (p->msgid == msgid && p->ph1 == iph1)
-			return p;
-	}
-
-	return NULL;
-}
-
-struct ph2handle *
-getph2byid(src, dst, spid)
-	struct sockaddr *src, *dst;
-	u_int32_t spid;
-{
-	struct ph2handle *p;
-
-	LIST_FOREACH(p, &ph2tree, chain) {
-		if (spid == p->spid &&
-		    CMPSADDR(src, p->src) == 0 &&
-		    CMPSADDR(dst, p->dst) == 0){
-			/* Sanity check to detect zombie handlers
-			 * XXX Sould be done "somewhere" more interesting,
-			 * because we have lots of getph2byxxxx(), but this one
-			 * is called by pk_recvacquire(), so is the most important.
-			 */
-			if(p->status < PHASE2ST_ESTABLISHED &&
-			   p->retry_counter == 0
-			   && p->sce == NULL && p->scr == NULL){
-				plog(LLV_DEBUG, LOCATION, NULL,
-					 "Zombie ph2 found, expiring it\n");
-				isakmp_ph2expire(p);
-			}else
-				return p;
-		}
-	}
-
-	return NULL;
-}
-
-struct ph2handle *
-getph2bysaddr(src, dst)
-	struct sockaddr *src, *dst;
-{
-	struct ph2handle *p;
-
-	LIST_FOREACH(p, &ph2tree, chain) {
-		if (cmpsaddrstrict(src, p->src) == 0 &&
-		    cmpsaddrstrict(dst, p->dst) == 0)
-			return p;
-	}
-
-	return NULL;
-}
-
-/*
- * call by pk_recvexpire().
- */
-struct ph2handle *
-getph2bysaidx(src, dst, proto_id, spi)
-	struct sockaddr *src, *dst;
-	u_int proto_id;
-	u_int32_t spi;
-{
-	struct ph2handle *iph2;
-	struct saproto *pr;
-
-	LIST_FOREACH(iph2, &ph2tree, chain) {
-		if (iph2->proposal == NULL && iph2->approval == NULL)
-			continue;
-		if (iph2->approval != NULL) {
-			for (pr = iph2->approval->head; pr != NULL;
-			     pr = pr->next) {
-				if (proto_id != pr->proto_id)
-					break;
-				if (spi == pr->spi || spi == pr->spi_p)
-					return iph2;
-			}
-		} else if (iph2->proposal != NULL) {
-			for (pr = iph2->proposal->head; pr != NULL;
-			     pr = pr->next) {
-				if (proto_id != pr->proto_id)
-					break;
-				if (spi == pr->spi)
-					return iph2;
-			}
-		}
-	}
-
-	return NULL;
-}
-
-/*
- * create new isakmp Phase 2 status record to handle isakmp in Phase2
- */
-struct ph2handle *
-newph2()
-{
-	struct ph2handle *iph2 = NULL;
-
-	/* create new iph2 */
-	iph2 = racoon_calloc(1, sizeof(*iph2));
-	if (iph2 == NULL)
-		return NULL;
-
-	iph2->status = PHASE1ST_SPAWN;
-
-	return iph2;
-}
-
-/*
- * initialize ph2handle
- * NOTE: don't initialize src/dst.
- *       SPI in the proposal is cleared.
- */
-void
-initph2(iph2)
-	struct ph2handle *iph2;
-{
-	sched_scrub_param(iph2);
-	iph2->sce = NULL;
-	iph2->scr = NULL;
-
-	VPTRINIT(iph2->sendbuf);
-	VPTRINIT(iph2->msg1);
-
-	/* clear spi, keep variables in the proposal */
-	if (iph2->proposal) {
-		struct saproto *pr;
-		for (pr = iph2->proposal->head; pr != NULL; pr = pr->next)
-			pr->spi = 0;
-	}
-
-	/* clear approval */
-	if (iph2->approval) {
-		flushsaprop(iph2->approval);
-		iph2->approval = NULL;
-	}
-
-	/* clear the generated policy */
-	if (iph2->spidx_gen) {
-		delsp_bothdir((struct policyindex *)iph2->spidx_gen);
-		racoon_free(iph2->spidx_gen);
-		iph2->spidx_gen = NULL;
-	}
-
-	if (iph2->pfsgrp) {
-		oakley_dhgrp_free(iph2->pfsgrp);
-		iph2->pfsgrp = NULL;
-	}
-
-	VPTRINIT(iph2->dhpriv);
-	VPTRINIT(iph2->dhpub);
-	VPTRINIT(iph2->dhpub_p);
-	VPTRINIT(iph2->dhgxy);
-	VPTRINIT(iph2->id);
-	VPTRINIT(iph2->id_p);
-	VPTRINIT(iph2->nonce);
-	VPTRINIT(iph2->nonce_p);
-	VPTRINIT(iph2->sa);
-	VPTRINIT(iph2->sa_ret);
-
-	if (iph2->ivm) {
-		oakley_delivm(iph2->ivm);
-		iph2->ivm = NULL;
-	}
-}
-
-/*
- * delete new isakmp Phase 2 status record to handle isakmp in Phase2
- */
-void
-delph2(iph2)
-	struct ph2handle *iph2;
-{
-	initph2(iph2);
-
-	if (iph2->src) {
-		racoon_free(iph2->src);
-		iph2->src = NULL;
-	}
-	if (iph2->dst) {
-		racoon_free(iph2->dst);
-		iph2->dst = NULL;
-	}
-	if (iph2->src_id) {
-	      racoon_free(iph2->src_id);
-	      iph2->src_id = NULL;
-	}
-	if (iph2->dst_id) {
-	      racoon_free(iph2->dst_id);
-	      iph2->dst_id = NULL;
-	}
-
-	if (iph2->proposal) {
-		flushsaprop(iph2->proposal);
-		iph2->proposal = NULL;
-	}
-
-	racoon_free(iph2);
-}
-
-/*
- * create new isakmp Phase 2 status record to handle isakmp in Phase2
- */
-int
-insph2(iph2)
-	struct ph2handle *iph2;
-{
-	LIST_INSERT_HEAD(&ph2tree, iph2, chain);
-
-	return 0;
-}
-
-void
-remph2(iph2)
-	struct ph2handle *iph2;
-{
-	LIST_REMOVE(iph2, chain);
-}
-
-void
-initph2tree()
-{
-	LIST_INIT(&ph2tree);
-}
-
-void
-flushph2()
-{
-	struct ph2handle *p, *next;
-
-	plog(LLV_DEBUG2, LOCATION, NULL,
-		 "flushing all ph2 handlers...\n");
-
-	for (p = LIST_FIRST(&ph2tree); p; p = next) {
-		next = LIST_NEXT(p, chain);
-
-		/* send delete information */
-		if (p->status == PHASE2ST_ESTABLISHED){
-			plog(LLV_DEBUG2, LOCATION, NULL,
-				 "got a ph2 handler to flush...\n");
-			isakmp_info_send_d2(p);
-		}else{
-			plog(LLV_DEBUG2, LOCATION, NULL,
-				 "skipping ph2 handler (state %d)\n", p->status);
-		}
-
-		delete_spd(p, 0);
-		unbindph12(p);
-		remph2(p);
-		delph2(p);
-	}
-}
-
-/*
- * Delete all Phase 2 handlers for this src/dst/proto.  This
- * is used during INITIAL-CONTACT processing (so no need to
- * send a message to the peer).
- */
-void
-deleteallph2(src, dst, proto_id)
-	struct sockaddr *src, *dst;
-	u_int proto_id;
-{
-	struct ph2handle *iph2, *next;
-	struct saproto *pr;
-
-	for (iph2 = LIST_FIRST(&ph2tree); iph2 != NULL; iph2 = next) {
-		next = LIST_NEXT(iph2, chain);
-		if (iph2->proposal == NULL && iph2->approval == NULL)
-			continue;
-		if (iph2->approval != NULL) {
-			for (pr = iph2->approval->head; pr != NULL;
-			     pr = pr->next) {
-				if (proto_id == pr->proto_id)
-					goto zap_it;
-			}
-		} else if (iph2->proposal != NULL) {
-			for (pr = iph2->proposal->head; pr != NULL;
-			     pr = pr->next) {
-				if (proto_id == pr->proto_id)
-					goto zap_it;
-			}
-		}
-		continue;
- zap_it:
-		unbindph12(iph2);
-		remph2(iph2);
-		delph2(iph2);
-	}
-}
-
-/* %%% */
-void
-bindph12(iph1, iph2)
-	struct ph1handle *iph1;
-	struct ph2handle *iph2;
-{
-	iph2->ph1 = iph1;
-	LIST_INSERT_HEAD(&iph1->ph2tree, iph2, ph1bind);
-}
-
-void
-unbindph12(iph2)
-	struct ph2handle *iph2;
-{
-	if (iph2->ph1 != NULL) {
-		iph2->ph1 = NULL;
-		LIST_REMOVE(iph2, ph1bind);
-	}
-}
-
-/* %%% management contacted list */
-/*
- * search contacted list.
- */
-struct contacted *
-getcontacted(remote)
-	struct sockaddr *remote;
-{
-	struct contacted *p;
-
-	LIST_FOREACH(p, &ctdtree, chain) {
-		if (cmpsaddrstrict(remote, p->remote) == 0)
-			return p;
-	}
-
-	return NULL;
-}
-
-/*
- * create new isakmp Phase 2 status record to handle isakmp in Phase2
- */
-int
-inscontacted(remote)
-	struct sockaddr *remote;
-{
-	struct contacted *new;
-
-	/* create new iph2 */
-	new = racoon_calloc(1, sizeof(*new));
-	if (new == NULL)
-		return -1;
-
-	new->remote = dupsaddr(remote);
-	if (new->remote == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to allocate buffer.\n");
-		racoon_free(new);
-		return -1;
-	}
-
-	LIST_INSERT_HEAD(&ctdtree, new, chain);
-
-	return 0;
-}
-
-void
-initctdtree()
-{
-	LIST_INIT(&ctdtree);
-}
-
-/*
- * check the response has been sent to the peer.  when not, simply reply
- * the buffered packet to the peer.
- * OUT:
- *	 0:	the packet is received at the first time.
- *	 1:	the packet was processed before.
- *	 2:	the packet was processed before, but the address mismatches.
- *	-1:	error happened.
- */
-int
-check_recvdpkt(remote, local, rbuf)
-	struct sockaddr *remote, *local;
-	vchar_t *rbuf;
-{
-	vchar_t *hash;
-	struct recvdpkt *r;
-	time_t t;
-	int len, s;
-
-	/* set current time */
-	t = time(NULL);
-
-	hash = eay_md5_one(rbuf);
-	if (!hash) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to allocate buffer.\n");
-		return -1;
-	}
-
-	LIST_FOREACH(r, &rcptree, chain) {
-		if (memcmp(hash->v, r->hash->v, r->hash->l) == 0)
-			break;
-	}
-	vfree(hash);
-
-	/* this is the first time to receive the packet */
-	if (r == NULL)
-		return 0;
-
-	/*
-	 * the packet was processed before, but the remote address mismatches.
-	 */
-	if (cmpsaddrstrict(remote, r->remote) != 0)
-		return 2;
-
-	/*
-	 * it should not check the local address because the packet
-	 * may arrive at other interface.
-	 */
-
-	/* check the previous time to send */
-	if (t - r->time_send < 1) {
-		plog(LLV_WARNING, LOCATION, NULL,
-			"the packet retransmitted in a short time from %s\n",
-			saddr2str(remote));
-		/*XXX should it be error ? */
-	}
-
-	/* select the socket to be sent */
-	s = getsockmyaddr(r->local);
-	if (s == -1)
-		return -1;
-
-	/* resend the packet if needed */
-	len = sendfromto(s, r->sendbuf->v, r->sendbuf->l,
-			r->local, r->remote, lcconf->count_persend);
-	if (len == -1) {
-		plog(LLV_ERROR, LOCATION, NULL, "sendfromto failed\n");
-		return -1;
-	}
-
-	/* check the retry counter */
-	r->retry_counter--;
-	if (r->retry_counter <= 0) {
-		rem_recvdpkt(r);
-		del_recvdpkt(r);
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"deleted the retransmission packet to %s.\n",
-			saddr2str(remote));
-	} else
-		r->time_send = t;
-
-	return 1;
-}
-
-/*
- * adding a hash of received packet into the received list.
- */
-int
-add_recvdpkt(remote, local, sbuf, rbuf)
-	struct sockaddr *remote, *local;
-	vchar_t *sbuf, *rbuf;
-{
-	struct recvdpkt *new = NULL;
-
-	if (lcconf->retry_counter == 0) {
-		/* no need to add it */
-		return 0;
-	}
-
-	new = racoon_calloc(1, sizeof(*new));
-	if (!new) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to allocate buffer.\n");
-		return -1;
-	}
-
-	new->hash = eay_md5_one(rbuf);
-	if (!new->hash) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to allocate buffer.\n");
-		del_recvdpkt(new);
-		return -1;
-	}
-	new->remote = dupsaddr(remote);
-	if (new->remote == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to allocate buffer.\n");
-		del_recvdpkt(new);
-		return -1;
-	}
-	new->local = dupsaddr(local);
-	if (new->local == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to allocate buffer.\n");
-		del_recvdpkt(new);
-		return -1;
-	}
-	new->sendbuf = vdup(sbuf);
-	if (new->sendbuf == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to allocate buffer.\n");
-		del_recvdpkt(new);
-		return -1;
-	}
-
-	new->retry_counter = lcconf->retry_counter;
-	new->time_send = 0;
-	new->created = time(NULL);
-
-	LIST_INSERT_HEAD(&rcptree, new, chain);
-
-	return 0;
-}
-
-void
-del_recvdpkt(r)
-	struct recvdpkt *r;
-{
-	if (r->remote)
-		racoon_free(r->remote);
-	if (r->local)
-		racoon_free(r->local);
-	if (r->hash)
-		vfree(r->hash);
-	if (r->sendbuf)
-		vfree(r->sendbuf);
-	racoon_free(r);
-}
-
-void
-rem_recvdpkt(r)
-	struct recvdpkt *r;
-{
-	LIST_REMOVE(r, chain);
-}
-
-void
-sweep_recvdpkt(dummy)
-	void *dummy;
-{
-	struct recvdpkt *r, *next;
-	time_t t, lt;
-
-	/* set current time */
-	t = time(NULL);
-
-	/* set the lifetime of the retransmission */
-	lt = lcconf->retry_counter * lcconf->retry_interval;
-
-	for (r = LIST_FIRST(&rcptree); r; r = next) {
-		next = LIST_NEXT(r, chain);
-
-		if (t - r->created > lt) {
-			rem_recvdpkt(r);
-			del_recvdpkt(r);
-		}
-	}
-
-	sched_new(lt, sweep_recvdpkt, NULL);
-}
-
-void
-init_recvdpkt()
-{
-	time_t lt = lcconf->retry_counter * lcconf->retry_interval;
-
-	LIST_INIT(&rcptree);
-
-	sched_new(lt, sweep_recvdpkt, NULL);
-}
-
-#ifdef ENABLE_HYBRID
-/* 
- * Retruns 0 if the address was obtained by ISAKMP mode config, 1 otherwise
- * This should be in isakmp_cfg.c but ph1tree being private, it must be there
- */
-int
-exclude_cfg_addr(addr)
-	const struct sockaddr *addr;
-{
-	struct ph1handle *p;
-	struct sockaddr_in *sin;
-
-	LIST_FOREACH(p, &ph1tree, chain) {
-		if ((p->mode_cfg != NULL) &&
-		    (p->mode_cfg->flags & ISAKMP_CFG_GOT_ADDR4) &&
-		    (addr->sa_family == AF_INET)) {
-			sin = (struct sockaddr_in *)addr;
-			if (sin->sin_addr.s_addr == p->mode_cfg->addr4.s_addr)
-				return 0;
-		}
-	}
-
-	return 1;
-}
-#endif
-
-
-
-/* 
- * Reload conf code
- */
-static int revalidate_ph2(struct ph2handle *iph2){
-	struct sainfoalg *alg;
-	int found, check_level;
-	struct sainfo *sainfo;
-	struct saprop *approval;
-	struct ph1handle *iph1;
-
-	/* 
-	 * Get the new sainfo using values of the old one
-	 */
-	if (iph2->sainfo != NULL) {
-		iph2->sainfo = getsainfo(iph2->sainfo->idsrc, 
-					  iph2->sainfo->iddst, iph2->sainfo->id_i,
-					  iph2->sainfo->remoteid);
-	}
-	approval = iph2->approval;
-	sainfo = iph2->sainfo;
-
-	if (sainfo == NULL) {
-		/* 
-		 * Sainfo has been removed
-		 */
-		plog(LLV_DEBUG, LOCATION, NULL,
-			 "Reload: No sainfo for ph2\n");
-		return 0;
-	}
-
-	if (approval == NULL) {
-		/*
-		 * XXX why do we have a NULL approval sometimes ???
-		 */
-		plog(LLV_DEBUG, LOCATION, NULL,
-			 "No approval found !\n");
-		return 0;
-	}	
-
-	/*
-	 * Don't care about proposals, should we do something ?
-	 * We have to keep iph2->proposal valid at least for initiator,
-	 * for pk_sendgetspi()
-	 */
-
-	plog(LLV_DEBUG, LOCATION, NULL, "active single bundle:\n");
-	printsaprop0(LLV_DEBUG, approval);
-
-	/*
-	 * Validate approval against sainfo
-	 * Note: we must have an updated ph1->rmconf before doing that,
-	 * we'll set check_level to EXACT if we don't have a ph1
-	 * XXX try tu find the new remote section to get the new check level ?
-	 * XXX lifebyte
-	 */
-	if (iph2->ph1 != NULL)
-		iph1=iph2->ph1;
-	else
-		iph1=getph1byaddr(iph2->src, iph2->dst, 0);
-
-	if(iph1 != NULL && iph1->rmconf != NULL) {
-		check_level = iph1->rmconf->pcheck_level;
-	} else {
-		if(iph1 != NULL)
-			plog(LLV_DEBUG, LOCATION, NULL, "No phase1 rmconf found !\n");
-		else
-			plog(LLV_DEBUG, LOCATION, NULL, "No phase1 found !\n");
-		check_level = PROP_CHECK_EXACT;
-	}
-
-	switch (check_level) {
-	case PROP_CHECK_OBEY:
-		plog(LLV_DEBUG, LOCATION, NULL,
-			 "Reload: OBEY for ph2, ok\n");
-		return 1;
-		break;
-
-	case PROP_CHECK_STRICT:
-		/* FALLTHROUGH */
-	case PROP_CHECK_CLAIM:
-		if (sainfo->lifetime < approval->lifetime) {
-			plog(LLV_DEBUG, LOCATION, NULL,
-				 "Reload: lifetime mismatch\n");
-			return 0;
-		}
-
-#if 0
-		/* Lifebyte is deprecated, just ignore it
-		 */
-		if (sainfo->lifebyte < approval->lifebyte) {
-			plog(LLV_DEBUG, LOCATION, NULL,
-				 "Reload: lifebyte mismatch\n");
-			return 0;
-		}
-#endif
-
-		if (sainfo->pfs_group &&
-		   sainfo->pfs_group != approval->pfs_group) {
-			plog(LLV_DEBUG, LOCATION, NULL,
-				 "Reload: PFS group mismatch\n");
-			return 0;
-		}
-		break;
-
-	case PROP_CHECK_EXACT:
-		if (sainfo->lifetime != approval->lifetime ||
-#if 0
-			/* Lifebyte is deprecated, just ignore it
-			 */
-		    sainfo->lifebyte != approval->lifebyte ||
-#endif
-		    sainfo->pfs_group != iph2->approval->pfs_group) {
-			plog(LLV_DEBUG, LOCATION, NULL,
-			    "Reload: lifetime | pfs mismatch\n");
-			return 0;
-		}
-		break;
-
-	default:
-		plog(LLV_DEBUG, LOCATION, NULL,
-			 "Reload: Shouldn't be here !\n");
-		return 0;
-		break;
-	}
-
-	for (alg = sainfo->algs[algclass_ipsec_auth]; alg; alg = alg->next) {
-		if (alg->alg == approval->head->head->authtype)
-			break;
-	}
-	if (alg == NULL) {
-		plog(LLV_DEBUG, LOCATION, NULL,
-			 "Reload: alg == NULL (auth)\n");
-		return 0;
-	}
-
-	found = 0;
-	for (alg = sainfo->algs[algclass_ipsec_enc]; 
-	    (found == 0 && alg != NULL); alg = alg->next) {
-		plog(LLV_DEBUG, LOCATION, NULL,
-			 "Reload: next ph2 enc alg...\n");
-
-		if (alg->alg != approval->head->head->trns_id){
-			plog(LLV_DEBUG, LOCATION, NULL,
-				 "Reload: encmode mismatch (%d / %d)\n",
-				 alg->alg, approval->head->head->trns_id);
-			continue;
-		}
-
-		switch (check_level){
-		/* PROP_CHECK_STRICT cannot happen here */
-		case PROP_CHECK_EXACT:
-			if (alg->encklen != approval->head->head->encklen) {
-				plog(LLV_DEBUG, LOCATION, NULL,
-					 "Reload: enclen mismatch\n");
-				continue;
-			}
-			break;
-
-		case PROP_CHECK_CLAIM:
-			/* FALLTHROUGH */
-		case PROP_CHECK_STRICT:
-			if (alg->encklen > approval->head->head->encklen) {
-				plog(LLV_DEBUG, LOCATION, NULL,
-					 "Reload: enclen mismatch\n");
-				continue;
-			}
-			break;
-
-		default:
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "unexpected check_level\n");
-			continue;
-			break;
-		}
-		found = 1;
-	}
-
-	if (!found){
-		plog(LLV_DEBUG, LOCATION, NULL,
-			 "Reload: No valid enc\n");
-		return 0;
-	}
-
-	/*
-	 * XXX comp
-	 */
-	plog(LLV_DEBUG, LOCATION, NULL,
-		 "Reload: ph2 check ok\n");
-
-	return 1;
-}
-
-
-static void 
-remove_ph2(struct ph2handle *iph2)
-{
-	u_int32_t spis[2];
-
-	if(iph2 == NULL)
-		return;
-
-	plog(LLV_DEBUG, LOCATION, NULL,
-		 "Deleting a Ph2...\n");
-
-	if (iph2->status == PHASE2ST_ESTABLISHED)
-		isakmp_info_send_d2(iph2);
-
-	if(iph2->approval != NULL && iph2->approval->head != NULL){
-		spis[0]=iph2->approval->head->spi;
-		spis[1]=iph2->approval->head->spi_p;
-
-		/* purge_ipsec_spi() will do all the work:
-		 * - delete SPIs in kernel
-		 * - delete generated SPD
-		 * - unbind / rem / del ph2
-		 */
-		purge_ipsec_spi(iph2->dst, iph2->approval->head->proto_id,
-						spis, 2);
-	}else{
-		unbindph12(iph2);
-		remph2(iph2);
-		delph2(iph2);
-	}
-}
-
-static void remove_ph1(struct ph1handle *iph1){
-	struct ph2handle *iph2, *iph2_next;
-
-	if(iph1 == NULL)
-		return;
-
-	plog(LLV_DEBUG, LOCATION, NULL,
-		 "Removing PH1...\n");
-
-	if (iph1->status == PHASE1ST_ESTABLISHED){
-		for (iph2 = LIST_FIRST(&iph1->ph2tree); iph2; iph2 = iph2_next) {
-			iph2_next = LIST_NEXT(iph2, chain);
-			remove_ph2(iph2);
-		}
-		isakmp_info_send_d1(iph1);
-	}
-	iph1->status = PHASE1ST_EXPIRED;
-	iph1->sce = sched_new(1, isakmp_ph1delete_stub, iph1);
-}
-
-
-static int revalidate_ph1tree_rmconf(void){
-	struct ph1handle *p, *next;
-	struct remoteconf *newrmconf;
-
-	for (p = LIST_FIRST(&ph1tree); p; p = next) {
-		next = LIST_NEXT(p, chain);
-
-		if (p->status == PHASE1ST_EXPIRED)
-			continue;
-
-		newrmconf=getrmconf(p->remote);
-		if(newrmconf == NULL){
-			p->rmconf = NULL;
-			remove_ph1(p);
-		}else{
-			/* Do not free old rmconf, it is just a pointer to an entry in rmtree
-			 */
-			p->rmconf=newrmconf;
-			if(p->approval != NULL){
-				struct isakmpsa *tmpsa;
-
-				tmpsa=dupisakmpsa(p->approval);
-				if(tmpsa != NULL){
-					delisakmpsa(p->approval);
-					p->approval=tmpsa;
-					p->approval->rmconf=newrmconf;
-				}
-			}
-		}
-	}
-
-	return 1;
-}
-
-
-/* rmconf is already updated here
- */
-static int revalidate_ph1(struct ph1handle *iph1){
-	struct isakmpsa *p, *approval;
-	struct etypes *e;
-
-	if(iph1 == NULL ||
-	   iph1->approval == NULL ||
-		iph1->rmconf == NULL)
-		return 0;
-
-	approval=iph1->approval;
-
-	for (e = iph1->rmconf->etypes; e != NULL; e = e->next){
-		if (iph1->etype == e->type)
-			break;
-	}
-
-	if (e == NULL){
-		plog(LLV_DEBUG, LOCATION, NULL,
-			 "Reload: Exchange type mismatch\n");
-		return 0;
-	}
-
-	if (iph1->etype == ISAKMP_ETYPE_AGG &&
-	   approval->dh_group != iph1->rmconf->dh_group){
-		plog(LLV_DEBUG, LOCATION, NULL,
-			 "Reload: DH mismatch\n");
-		return 0;
-	}
-
-	for (p=iph1->rmconf->proposal; p != NULL; p=p->next){
-		plog(LLV_DEBUG, LOCATION, NULL,
-			 "Reload: Trying next proposal...\n");
-
-		if(approval->authmethod != p->authmethod){
-			plog(LLV_DEBUG, LOCATION, NULL,
-				 "Reload: Authmethod mismatch\n");
-			continue;
-		}
-
-		if(approval->enctype != p->enctype){
-			plog(LLV_DEBUG, LOCATION, NULL,
-				 "Reload: enctype mismatch\n");
-			continue;
-		}
-
-		switch (iph1->rmconf->pcheck_level) {
-		case PROP_CHECK_OBEY:
-			plog(LLV_DEBUG, LOCATION, NULL,
-				 "Reload: OBEY pcheck level, ok...\n");
-			return 1;
-			break;
-
-		case PROP_CHECK_CLAIM:
-			/* FALLTHROUGH */
-		case PROP_CHECK_STRICT:
-			if (approval->encklen < p->encklen) {
-				plog(LLV_DEBUG, LOCATION, NULL,
-					 "Reload: encklen mismatch\n");
-				continue;
-			}
-
-			if (approval->lifetime > p->lifetime) {
-				plog(LLV_DEBUG, LOCATION, NULL,
-					 "Reload: lifetime mismatch\n");
-				continue;
-			}
-
-#if 0
-			/* Lifebyte is deprecated, just ignore it
-			 */
-			if (approval->lifebyte > p->lifebyte) {
-				plog(LLV_DEBUG, LOCATION, NULL,
-					 "Reload: lifebyte mismatch\n");
-				continue;
-			}
-#endif
-			break;
-
-		case PROP_CHECK_EXACT:
-			if (approval->encklen != p->encklen) {
-				plog(LLV_DEBUG, LOCATION, NULL,
-					 "Reload: encklen mismatch\n");
-				continue;
-			}
-
-			if (approval->lifetime != p->lifetime) {
-				plog(LLV_DEBUG, LOCATION, NULL,
-					 "Reload: lifetime mismatch\n");
-				continue;
-			}
-
-#if 0
-			/* Lifebyte is deprecated, just ignore it
-			 */
-			if (approval->lifebyte != p->lifebyte) {
-				plog(LLV_DEBUG, LOCATION, NULL,
-					 "Reload: lifebyte mismatch\n");
-				continue;
-			}
-#endif
-			break;
-
-		default:
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "unexpected check_level\n");
-			continue;
-			break;
-		}
-
-		if (approval->hashtype != p->hashtype) {
-			plog(LLV_DEBUG, LOCATION, NULL,
-				 "Reload: hashtype mismatch\n");
-			continue;
-		}
-
-		if (iph1->etype != ISAKMP_ETYPE_AGG &&
-		    approval->dh_group != p->dh_group) {
-			plog(LLV_DEBUG, LOCATION, NULL,
-				 "Reload: dhgroup mismatch\n");
-			continue;
-		}
-
-		plog(LLV_DEBUG, LOCATION, NULL, "Reload: Conf ok\n");
-		return 1;
-	}
-
-	plog(LLV_DEBUG, LOCATION, NULL, "Reload: No valid conf found\n");
-	return 0;
-}
-
-
-static int revalidate_ph1tree(void){
-	struct ph1handle *p, *next;
-
-	for (p = LIST_FIRST(&ph1tree); p; p = next) {
-		next = LIST_NEXT(p, chain);
-
-		if (p->status == PHASE1ST_EXPIRED)
-			continue;
-
-		if(!revalidate_ph1(p))
-			remove_ph1(p);
-	}
-
-	return 1;
-}
-
-static int revalidate_ph2tree(void){
-	struct ph2handle *p, *next;
-
-	for (p = LIST_FIRST(&ph2tree); p; p = next) {
-		next = LIST_NEXT(p, chain);
-
-		if (p->status == PHASE2ST_EXPIRED)
-			continue;
-
-		if(!revalidate_ph2(p)){
-			plog(LLV_DEBUG, LOCATION, NULL,
-				 "PH2 not validated, removing it\n");
-			remove_ph2(p);
-		}
-	}
-
-	return 1;
-}
-
-int 
-revalidate_ph12(void)
-{
-
-	revalidate_ph1tree_rmconf();
-
-	revalidate_ph2tree();
-	revalidate_ph1tree();
-
-	return 1;
-}
-
-#ifdef ENABLE_HYBRID
-struct ph1handle *
-getph1bylogin(login)
-	char *login;
-{
-	struct ph1handle *p;
-
-	LIST_FOREACH(p, &ph1tree, chain) {
-		if (p->mode_cfg == NULL)
-			continue;
-		if (strncmp(p->mode_cfg->login, login, LOGINLEN) == 0)
-			return p;
-	}
-
-	return NULL;
-}
-
-int
-purgeph1bylogin(login)
-	char *login;
-{
-	struct ph1handle *p;
-	int found = 0;
-
-	LIST_FOREACH(p, &ph1tree, chain) {
-		if (p->mode_cfg == NULL)
-			continue;
-		if (strncmp(p->mode_cfg->login, login, LOGINLEN) == 0) {
-			if (p->status == PHASE1ST_ESTABLISHED)
-				isakmp_info_send_d1(p);
-			purge_remote(p);
-			found++;
-		}
-	}
-
-	return found;
-}
-#endif
diff --git a/src/racoon/handler.h b/src/racoon/handler.h
deleted file mode 100644
index a52dc6c..0000000
--- a/src/racoon/handler.h
+++ /dev/null
@@ -1,483 +0,0 @@
-/*	$NetBSD: handler.h,v 1.9.6.1 2008/01/11 14:12:01 vanhu Exp $	*/
-
-/* Id: handler.h,v 1.19 2006/02/25 08:25:12 manubsd Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _HANDLER_H
-#define _HANDLER_H
-
-#include <sys/queue.h>
-#include <openssl/rsa.h>
-
-#include <sys/time.h>
-
-#include "isakmp_var.h"
-#include "oakley.h"
-
-/* Phase 1 handler */
-/*
- * main mode:
- *      initiator               responder
- *  0   (---)                   (---)
- *  1   start                   start (1st msg received)
- *  2   (---)                   1st valid msg received
- *  3   1st msg sent	        1st msg sent
- *  4   1st valid msg received  2st valid msg received
- *  5   2nd msg sent            2nd msg sent
- *  6   2nd valid msg received  3rd valid msg received
- *  7   3rd msg sent            3rd msg sent
- *  8   3rd valid msg received  (---)
- *  9   SA established          SA established
- *
- * aggressive mode:
- *      initiator               responder
- *  0   (---)                   (---)
- *  1   start                   start (1st msg received)
- *  2   (---)                   1st valid msg received
- *  3   1st msg sent	        1st msg sent
- *  4   1st valid msg received  2st valid msg received
- *  5   (---)                   (---)
- *  6   (---)                   (---)
- *  7   (---)                   (---)
- *  8   (---)                   (---)
- *  9   SA established          SA established
- *
- * base mode:
- *      initiator               responder
- *  0   (---)                   (---)
- *  1   start                   start (1st msg received)
- *  2   (---)                   1st valid msg received
- *  3   1st msg sent	        1st msg sent
- *  4   1st valid msg received  2st valid msg received
- *  5   2nd msg sent            (---)
- *  6   (---)                   (---)
- *  7   (---)                   (---)
- *  8   (---)                   (---)
- *  9   SA established          SA established
- */
-#define PHASE1ST_SPAWN			0
-#define PHASE1ST_START			1
-#define PHASE1ST_MSG1RECEIVED		2
-#define PHASE1ST_MSG1SENT		3
-#define PHASE1ST_MSG2RECEIVED		4
-#define PHASE1ST_MSG2SENT		5
-#define PHASE1ST_MSG3RECEIVED		6
-#define PHASE1ST_MSG3SENT		7
-#define PHASE1ST_MSG4RECEIVED		8
-#define PHASE1ST_ESTABLISHED		9
-#define PHASE1ST_EXPIRED		10
-#define PHASE1ST_MAX			11
-
-/* About address semantics in each case.
- *			initiator(addr=I)	responder(addr=R)
- *			src	dst		src	dst
- *			(local)	(remote)	(local)	(remote)
- * phase 1 handler	I	R		R	I
- * phase 2 handler	I	R		R	I
- * getspi msg		R	I		I	R
- * acquire msg		I	R
- * ID payload		I	R		I	R
- */
-#ifdef ENABLE_HYBRID
-struct isakmp_cfg_state;
-#endif
-struct ph1handle {
-	isakmp_index index;
-
-	int status;			/* status of this SA */
-	int side;			/* INITIATOR or RESPONDER */
-
-	struct sockaddr *remote;	/* remote address to negosiate ph1 */
-	struct sockaddr *local;		/* local address to negosiate ph1 */
-			/* XXX copy from rmconf due to anonymous configuration.
-			 * If anonymous will be forbidden, we do delete them. */
-
-	struct remoteconf *rmconf;	/* pointer to remote configuration */
-
-	struct isakmpsa *approval;	/* pointer to SA(s) approved. */
-	vchar_t *authstr;		/* place holder of string for auth. */
-					/* for example pre-shared key */
-
-	u_int8_t version;		/* ISAKMP version */
-	u_int8_t etype;			/* Exchange type actually for use */
-	u_int8_t flags;			/* Flags */
-	u_int32_t msgid;		/* message id */
-
-#ifdef ENABLE_NATT
-	struct ph1natt_options *natt_options;	/* Selected NAT-T IKE version */
-	u_int32_t natt_flags;		/* NAT-T related flags */
-#endif
-#ifdef ENABLE_FRAG
-	int frag;			/* IKE phase 1 fragmentation */
-	struct isakmp_frag_item *frag_chain;	/* Received fragments */
-#endif
-
-	struct sched *sce;		/* schedule for expire */
-
-	struct sched *scr;		/* schedule for resend */
-	int retry_counter;		/* for resend. */
-	vchar_t *sendbuf;		/* buffer for re-sending */
-
-	vchar_t *dhpriv;		/* DH; private value */
-	vchar_t *dhpub;			/* DH; public value */
-	vchar_t *dhpub_p;		/* DH; partner's public value */
-	vchar_t *dhgxy;			/* DH; shared secret */
-	vchar_t *nonce;			/* nonce value */
-	vchar_t *nonce_p;		/* partner's nonce value */
-	vchar_t *skeyid;		/* SKEYID */
-	vchar_t *skeyid_d;		/* SKEYID_d */
-	vchar_t *skeyid_a;		/* SKEYID_a, i.e. hash */
-	vchar_t *skeyid_e;		/* SKEYID_e, i.e. encryption */
-	vchar_t *key;			/* cipher key */
-	vchar_t *hash;			/* HASH minus general header */
-	vchar_t *sig;			/* SIG minus general header */
-	vchar_t *sig_p;			/* peer's SIG minus general header */
-	cert_t *cert;			/* CERT minus general header */
-	cert_t *cert_p;			/* peer's CERT minus general header */
-	cert_t *crl_p;			/* peer's CRL minus general header */
-	cert_t *cr_p;			/* peer's CR not including general */
-	RSA *rsa;			/* my RSA key */
-	RSA *rsa_p;			/* peer's RSA key */
-	struct genlist *rsa_candidates;	/* possible candidates for peer's RSA key */
-	vchar_t *id;			/* ID minus gen header */
-	vchar_t *id_p;			/* partner's ID minus general header */
-					/* i.e. struct ipsecdoi_id_b*. */
-	struct isakmp_ivm *ivm;		/* IVs */
-
-	vchar_t *sa;			/* whole SA payload to send/to be sent*/
-					/* to calculate HASH */
-					/* NOT INCLUDING general header. */
-
-	vchar_t *sa_ret;		/* SA payload to reply/to be replyed */
-					/* NOT INCLUDING general header. */
-					/* NOTE: Should be release after use. */
-
-#ifdef HAVE_GSSAPI
-	void *gssapi_state;		/* GSS-API specific state. */
-					/* Allocated when needed */
-	vchar_t *gi_i;			/* optional initiator GSS id */
-	vchar_t *gi_r;			/* optional responder GSS id */
-#endif
-
-	struct isakmp_pl_hash *pl_hash;	/* pointer to hash payload */
-
-	time_t created;			/* timestamp for establish */
-#ifdef ENABLE_STATS
-	struct timeval start;
-	struct timeval end;
-#endif
-
-#ifdef ENABLE_DPD
-	int		dpd_support;	/* Does remote supports DPD ? */
-	time_t		dpd_lastack;	/* Last ack received */
-	u_int16_t	dpd_seq;		/* DPD seq number to receive */
-	u_int8_t	dpd_fails;		/* number of failures */
-	struct sched	*dpd_r_u;
-#endif
-
-	u_int32_t msgid2;		/* msgid counter for Phase 2 */
-	int ph2cnt;	/* the number which is negotiated by this phase 1 */
-	LIST_HEAD(_ph2ofph1_, ph2handle) ph2tree;
-
-	LIST_ENTRY(ph1handle) chain;
-#ifdef ENABLE_HYBRID
-	struct isakmp_cfg_state *mode_cfg;	/* ISAKMP mode config state */
-#endif       
-
-};
-
-/* Phase 2 handler */
-/* allocated per a SA or SA bundles of a pair of peer's IP addresses. */
-/*
- *      initiator               responder
- *  0   (---)                   (---)
- *  1   start                   start (1st msg received)
- *  2   acquire msg get         1st valid msg received
- *  3   getspi request sent     getspi request sent
- *  4   getspi done             getspi done
- *  5   1st msg sent            1st msg sent
- *  6   1st valid msg received  2nd valid msg received
- *  7   (commit bit)            (commit bit)
- *  8   SAs added               SAs added
- *  9   SAs established         SAs established
- * 10   SAs expired             SAs expired
- */
-#define PHASE2ST_SPAWN		0
-#define PHASE2ST_START		1
-#define PHASE2ST_STATUS2	2
-#define PHASE2ST_GETSPISENT	3
-#define PHASE2ST_GETSPIDONE	4
-#define PHASE2ST_MSG1SENT	5
-#define PHASE2ST_STATUS6	6
-#define PHASE2ST_COMMIT		7
-#define PHASE2ST_ADDSA		8
-#define PHASE2ST_ESTABLISHED	9
-#define PHASE2ST_EXPIRED	10
-#define PHASE2ST_MAX		11
-
-struct ph2handle {
-	struct sockaddr *src;		/* my address of SA. */
-	struct sockaddr *dst;		/* peer's address of SA. */
-
-		/*
-		 * copy ip address from ID payloads when ID type is ip address.
-		 * In other case, they must be null.
-		 */
-	struct sockaddr *src_id;
-	struct sockaddr *dst_id;
-
-	u_int32_t spid;			/* policy id by kernel */
-
-	int status;			/* ipsec sa status */
-	u_int8_t side;			/* INITIATOR or RESPONDER */
-
-	struct sched *sce;		/* schedule for expire */
-	struct sched *scr;		/* schedule for resend */
-	int retry_counter;		/* for resend. */
-	vchar_t *sendbuf;		/* buffer for re-sending */
-	vchar_t *msg1;			/* buffer for re-sending */
-				/* used for responder's first message */
-
-	int retry_checkph1;		/* counter to wait phase 1 finished. */
-					/* NOTE: actually it's timer. */
-
-	u_int32_t seq;			/* sequence number used by PF_KEY */
-			/*
-			 * NOTE: In responder side, we can't identify each SAs
-			 * with same destination address for example, when
-			 * socket based SA is required.  So we set a identifier
-			 * number to "seq", and sent kernel by pfkey.
-			 */
-	u_int8_t satype;		/* satype in PF_KEY */
-			/*
-			 * saved satype in the original PF_KEY request from
-			 * the kernel in order to reply a error.
-			 */
-
-	u_int8_t flags;			/* Flags for phase 2 */
-	u_int32_t msgid;		/* msgid for phase 2 */
-
-	struct sainfo *sainfo;		/* place holder of sainfo */
-	struct saprop *proposal;	/* SA(s) proposal. */
-	struct saprop *approval;	/* SA(s) approved. */
-	caddr_t spidx_gen;		/* policy from peer's proposal */
-
-	struct dhgroup *pfsgrp;		/* DH; prime number */
-	vchar_t *dhpriv;		/* DH; private value */
-	vchar_t *dhpub;			/* DH; public value */
-	vchar_t *dhpub_p;		/* DH; partner's public value */
-	vchar_t *dhgxy;			/* DH; shared secret */
-	vchar_t *id;			/* ID minus gen header */
-	vchar_t *id_p;			/* peer's ID minus general header */
-	vchar_t *nonce;			/* nonce value in phase 2 */
-	vchar_t *nonce_p;		/* partner's nonce value in phase 2 */
-
-	vchar_t *sa;			/* whole SA payload to send/to be sent*/
-					/* to calculate HASH */
-					/* NOT INCLUDING general header. */
-
-	vchar_t *sa_ret;		/* SA payload to reply/to be replyed */
-					/* NOT INCLUDING general header. */
-					/* NOTE: Should be release after use. */
-
-	struct isakmp_ivm *ivm;		/* IVs */
-
-	int generated_spidx;	/* mark handlers whith generated policy */
-
-#ifdef ENABLE_STATS
-	struct timeval start;
-	struct timeval end;
-#endif
-	struct ph1handle *ph1;	/* back pointer to isakmp status */
-
-	LIST_ENTRY(ph2handle) chain;
-	LIST_ENTRY(ph2handle) ph1bind;	/* chain to ph1handle */
-};
-
-/*
- * for handling initial contact.
- */
-struct contacted {
-	struct sockaddr *remote;	/* remote address to negosiate ph1 */
-	LIST_ENTRY(contacted) chain;
-};
-
-/*
- * for checking a packet retransmited.
- */
-struct recvdpkt {
-	struct sockaddr *remote;	/* the remote address */
-	struct sockaddr *local;		/* the local address */
-	vchar_t *hash;			/* hash of the received packet */
-	vchar_t *sendbuf;		/* buffer for the response */
-	int retry_counter;		/* how many times to send */
-	time_t time_send;		/* timestamp to send a packet */
-	time_t created;			/* timestamp to create a queue */
-
-	struct sched *scr;		/* schedule for resend, may not used */
-
-	LIST_ENTRY(recvdpkt) chain;
-};
-
-/* for parsing ISAKMP header. */
-struct isakmp_parse_t {
-	u_char type;		/* payload type of mine */
-	int len;		/* ntohs(ptr->len) */
-	struct isakmp_gen *ptr;
-};
-
-/*
- * for IV management.
- *
- * - normal case
- * initiator                                     responder
- * -------------------------                     --------------------------
- * initialize iv(A), ive(A).                     initialize iv(A), ive(A).
- * encode by ive(A).
- * save to iv(B).            ---[packet(B)]-->   save to ive(B).
- *                                               decode by iv(A).
- *                                               packet consistency.
- *                                               sync iv(B) with ive(B).
- *                                               check auth, integrity.
- *                                               encode by ive(B).
- * save to ive(C).          <--[packet(C)]---    save to iv(C).
- * decoded by iv(B).
- *      :
- *
- * - In the case that a error is found while cipher processing,
- * initiator                                     responder
- * -------------------------                     --------------------------
- * initialize iv(A), ive(A).                     initialize iv(A), ive(A).
- * encode by ive(A).
- * save to iv(B).            ---[packet(B)]-->   save to ive(B).
- *                                               decode by iv(A).
- *                                               packet consistency.
- *                                               sync iv(B) with ive(B).
- *                                               check auth, integrity.
- *                                               error found.
- *                                               create notify.
- *                                               get ive2(X) from iv(B).
- *                                               encode by ive2(X).
- * get iv2(X) from iv(B).   <--[packet(Y)]---    save to iv2(Y).
- * save to ive2(Y).
- * decoded by iv2(X).
- *      :
- *
- * The reason why the responder synchronizes iv with ive after checking the
- * packet consistency is that it is required to leave the IV for decoding
- * packet.  Because there is a potential of error while checking the packet
- * consistency.  Also the reason why that is before authentication and
- * integirty check is that the IV for informational exchange has to be made
- * by the IV which is after packet decoded and checking the packet consistency.
- * Otherwise IV mismatched happens between the intitiator and the responder.
- */
-struct isakmp_ivm {
-	vchar_t *iv;	/* for decoding packet */
-			/* if phase 1, it's for computing phase2 iv */
-	vchar_t *ive;	/* for encoding packet */
-};
-
-/* for dumping */
-struct ph1dump {
-	isakmp_index index;
-	int status;
-	int side;
-	struct sockaddr_storage remote;
-	struct sockaddr_storage local;
-	u_int8_t version;
-	u_int8_t etype;	
-	time_t created;
-	int ph2cnt;
-};
-
-struct sockaddr;
-struct ph1handle;
-struct ph2handle;
-struct policyindex;
-
-extern struct ph1handle *getph1byindex __P((isakmp_index *));
-extern struct ph1handle *getph1byindex0 __P((isakmp_index *));
-extern struct ph1handle *getph1byaddr __P((struct sockaddr *,
-										   struct sockaddr *, int));
-extern struct ph1handle *getph1byaddrwop __P((struct sockaddr *,
-	struct sockaddr *));
-extern struct ph1handle *getph1bydstaddrwop __P((struct sockaddr *));
-#ifdef ENABLE_HYBRID
-struct ph1handle *getph1bylogin __P((char *));
-int purgeph1bylogin __P((char *));
-#endif
-extern vchar_t *dumpph1 __P((void));
-extern struct ph1handle *newph1 __P((void));
-extern void delph1 __P((struct ph1handle *));
-extern int insph1 __P((struct ph1handle *));
-extern void remph1 __P((struct ph1handle *));
-extern void flushph1 __P((void));
-extern void initph1tree __P((void));
-
-extern struct ph2handle *getph2byspidx __P((struct policyindex *));
-extern struct ph2handle *getph2byspid __P((u_int32_t));
-extern struct ph2handle *getph2byseq __P((u_int32_t));
-extern struct ph2handle *getph2bysaddr __P((struct sockaddr *,
-	struct sockaddr *));
-extern struct ph2handle *getph2bymsgid __P((struct ph1handle *, u_int32_t));
-extern struct ph2handle *getph2byid __P((struct sockaddr *,
-	struct sockaddr *, u_int32_t));
-extern struct ph2handle *getph2bysaidx __P((struct sockaddr *,
-	struct sockaddr *, u_int, u_int32_t));
-extern struct ph2handle *newph2 __P((void));
-extern void initph2 __P((struct ph2handle *));
-extern void delph2 __P((struct ph2handle *));
-extern int insph2 __P((struct ph2handle *));
-extern void remph2 __P((struct ph2handle *));
-extern void flushph2 __P((void));
-extern void deleteallph2 __P((struct sockaddr *, struct sockaddr *, u_int));
-extern void initph2tree __P((void));
-
-extern void bindph12 __P((struct ph1handle *, struct ph2handle *));
-extern void unbindph12 __P((struct ph2handle *));
-
-extern struct contacted *getcontacted __P((struct sockaddr *));
-extern int inscontacted __P((struct sockaddr *));
-extern void initctdtree __P((void));
-
-extern int check_recvdpkt __P((struct sockaddr *,
-	struct sockaddr *, vchar_t *));
-extern int add_recvdpkt __P((struct sockaddr *, struct sockaddr *,
-	vchar_t *, vchar_t *));
-extern void init_recvdpkt __P((void));
-
-#ifdef ENABLE_HYBRID
-extern int exclude_cfg_addr __P((const struct sockaddr *));
-#endif
-
-extern int revalidate_ph12(void);
-
-#endif /* _HANDLER_H */
diff --git a/src/racoon/ipsec_doi.c b/src/racoon/ipsec_doi.c
deleted file mode 100644
index 9a59135..0000000
--- a/src/racoon/ipsec_doi.c
+++ /dev/null
@@ -1,4949 +0,0 @@
-/*	$NetBSD: ipsec_doi.c,v 1.23.4.10 2009/06/19 07:32:52 tteras Exp $	*/
-
-/* Id: ipsec_doi.c,v 1.55 2006/08/17 09:20:41 vanhu Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/socket.h>
-
-#include <netinet/in.h>
-
-#include PATH_IPSEC_H
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-#include <netdb.h>
-#if TIME_WITH_SYS_TIME
-# include <sys/time.h>
-# include <time.h>
-#else
-# if HAVE_SYS_TIME_H
-#  include <sys/time.h>
-# else
-#  include <time.h>
-# endif
-#endif
-
-#include "var.h"
-#include "vmbuf.h"
-#include "misc.h"
-#include "plog.h"
-#include "debug.h"
-
-#include "cfparse_proto.h"
-#include "isakmp_var.h"
-#include "isakmp.h"
-#include "ipsec_doi.h"
-#include "oakley.h"
-#include "remoteconf.h"
-#include "localconf.h"
-#include "sockmisc.h"
-#include "handler.h"
-#include "policy.h"
-#include "algorithm.h"
-#include "sainfo.h"
-#include "proposal.h"
-#include "crypto_openssl.h"
-#include "strnames.h"
-#include "gcmalloc.h"
-
-#ifdef ENABLE_NATT
-#include "nattraversal.h"
-#endif
-#ifdef ENABLE_HYBRID
-static int switch_authmethod(int);
-#endif
-
-#ifdef HAVE_GSSAPI
-#include <iconv.h>
-#include "gssapi.h"
-#ifdef HAVE_ICONV_2ND_CONST
-#define __iconv_const const
-#else
-#define __iconv_const
-#endif
-#endif
-
-int verbose_proposal_check = 1;
-
-static vchar_t *get_ph1approval __P((struct ph1handle *, struct prop_pair **));
-static struct isakmpsa *get_ph1approvalx __P((struct prop_pair *,
-	struct isakmpsa *, struct isakmpsa *, int));
-static void print_ph1mismatched __P((struct prop_pair *, struct isakmpsa *));
-static int t2isakmpsa __P((struct isakmp_pl_t *, struct isakmpsa *));
-static int cmp_aproppair_i __P((struct prop_pair *, struct prop_pair *));
-static struct prop_pair *get_ph2approval __P((struct ph2handle *,
-	struct prop_pair **));
-static struct prop_pair *get_ph2approvalx __P((struct ph2handle *,
-	struct prop_pair *));
-static void free_proppair0 __P((struct prop_pair *));
-
-static int get_transform
-	__P((struct isakmp_pl_p *, struct prop_pair **, int *));
-static u_int32_t ipsecdoi_set_ld __P((vchar_t *));
-
-static int check_doi __P((u_int32_t));
-static int check_situation __P((u_int32_t));
-
-static int check_prot_main __P((int));
-static int check_prot_quick __P((int));
-static int (*check_protocol[]) __P((int)) = {
-	check_prot_main,	/* IPSECDOI_TYPE_PH1 */
-	check_prot_quick,	/* IPSECDOI_TYPE_PH2 */
-};
-
-static int check_spi_size __P((int, int));
-
-static int check_trns_isakmp __P((int));
-static int check_trns_ah __P((int));
-static int check_trns_esp __P((int));
-static int check_trns_ipcomp __P((int));
-static int (*check_transform[]) __P((int)) = {
-	0,
-	check_trns_isakmp,	/* IPSECDOI_PROTO_ISAKMP */
-	check_trns_ah,		/* IPSECDOI_PROTO_IPSEC_AH */
-	check_trns_esp,		/* IPSECDOI_PROTO_IPSEC_ESP */
-	check_trns_ipcomp,	/* IPSECDOI_PROTO_IPCOMP */
-};
-
-static int check_attr_isakmp __P((struct isakmp_pl_t *));
-static int check_attr_ah __P((struct isakmp_pl_t *));
-static int check_attr_esp __P((struct isakmp_pl_t *));
-static int check_attr_ipsec __P((int, struct isakmp_pl_t *));
-static int check_attr_ipcomp __P((struct isakmp_pl_t *));
-static int (*check_attributes[]) __P((struct isakmp_pl_t *)) = {
-	0,
-	check_attr_isakmp,	/* IPSECDOI_PROTO_ISAKMP */
-	check_attr_ah,		/* IPSECDOI_PROTO_IPSEC_AH */
-	check_attr_esp,		/* IPSECDOI_PROTO_IPSEC_ESP */
-	check_attr_ipcomp,	/* IPSECDOI_PROTO_IPCOMP */
-};
-
-static int setph1prop __P((struct isakmpsa *, caddr_t));
-static int setph1trns __P((struct isakmpsa *, caddr_t));
-static int setph1attr __P((struct isakmpsa *, caddr_t));
-static vchar_t *setph2proposal0 __P((const struct ph2handle *,
-	const struct saprop *, const struct saproto *));
-
-static vchar_t *getidval __P((int, vchar_t *));
-
-#ifdef HAVE_GSSAPI
-static struct isakmpsa *fixup_initiator_sa __P((struct isakmpsa *,
-	struct isakmpsa *));
-#endif
-
-/*%%%*/
-/*
- * check phase 1 SA payload.
- * make new SA payload to be replyed not including general header.
- * the pointer to one of isakmpsa in proposal is set into iph1->approval.
- * OUT:
- *	positive: the pointer to new buffer of SA payload.
- *		  network byte order.
- *	NULL	: error occurd.
- */
-int
-ipsecdoi_checkph1proposal(sa, iph1)
-	vchar_t *sa;
-	struct ph1handle *iph1;
-{
-	vchar_t *newsa;		/* new SA payload approved. */
-	struct prop_pair **pair;
-
-	/* get proposal pair */
-	pair = get_proppair(sa, IPSECDOI_TYPE_PH1);
-	if (pair == NULL)
-		return -1;
-
-	/* check and get one SA for use */
-	newsa = get_ph1approval(iph1, pair);
-	
-	free_proppair(pair);
-
-	if (newsa == NULL)
-		return -1;
-
-	iph1->sa_ret = newsa;
-
-	return 0;
-}
-
-/*
- * acceptable check for remote configuration.
- * return a new SA payload to be reply to peer.
- */
-static vchar_t *
-get_ph1approval(iph1, pair)
-	struct ph1handle *iph1;
-	struct prop_pair **pair;
-{
-	vchar_t *newsa;
-	struct isakmpsa *sa, tsa;
-	struct prop_pair *s, *p;
-	int prophlen;
-	int i;
-
-	if (iph1->approval) {
-		delisakmpsa(iph1->approval);
-		iph1->approval = NULL;
-	}
-
-	for (i = 0; i < MAXPROPPAIRLEN; i++) {
-		if (pair[i] == NULL)
-			continue;
-		for (s = pair[i]; s; s = s->next) {
-			prophlen = 
-			    sizeof(struct isakmp_pl_p) + s->prop->spi_size;
-
-			/* compare proposal and select one */
-			for (p = s; p; p = p->tnext) {
-				if ((sa = get_ph1approvalx(p, 
-				    iph1->rmconf->proposal, &tsa, 
-				    iph1->rmconf->pcheck_level)) != NULL)
-					goto found;
-			}
-		}
-	}
-
-	/*
-	 * if there is no suitable proposal, racoon complains about all of
-	 * mismatched items in those proposal.
-	 */
-	if (verbose_proposal_check) {
-		for (i = 0; i < MAXPROPPAIRLEN; i++) {
-			if (pair[i] == NULL)
-				continue;
-			for (s = pair[i]; s; s = s->next) {
-				prophlen = sizeof(struct isakmp_pl_p)
-						+ s->prop->spi_size;
-				for (p = s; p; p = p->tnext) {
-					print_ph1mismatched(p,
-						iph1->rmconf->proposal);
-				}
-			}
-		}
-	}
-	plog(LLV_ERROR, LOCATION, NULL, "no suitable proposal found.\n");
-
-	return NULL;
-
-found:
-	plog(LLV_DEBUG, LOCATION, NULL, "an acceptable proposal found.\n");
-
-	/* check DH group settings */
-	if (sa->dhgrp) {
-		if (sa->dhgrp->prime && sa->dhgrp->gen1) {
-			/* it's ok */
-			goto saok;
-		}
-		plog(LLV_WARNING, LOCATION, NULL,
-			"invalid DH parameter found, use default.\n");
-		oakley_dhgrp_free(sa->dhgrp);
-		sa->dhgrp=NULL;
-	}
-
-	if (oakley_setdhgroup(sa->dh_group, &sa->dhgrp) == -1) {
-		sa->dhgrp = NULL;
-		racoon_free(sa);
-		return NULL;
-	}
-
-saok:
-#ifdef HAVE_GSSAPI
-	if (sa->gssid != NULL)
-		plog(LLV_DEBUG, LOCATION, NULL, "gss id in new sa '%.*s'\n",
-		    (int)sa->gssid->l, sa->gssid->v);
-	if (iph1-> side == INITIATOR) {
-		if (iph1->rmconf->proposal->gssid != NULL)
-			iph1->gi_i = vdup(iph1->rmconf->proposal->gssid);
-		if (tsa.gssid != NULL)
-			iph1->gi_r = vdup(tsa.gssid);
-		iph1->approval = fixup_initiator_sa(sa, &tsa);
-	} else {
-		if (tsa.gssid != NULL) {
-			iph1->gi_r = vdup(tsa.gssid);
-			iph1->gi_i = gssapi_get_id(iph1);
-			if (sa->gssid == NULL && iph1->gi_i != NULL)
-				sa->gssid = vdup(iph1->gi_i);
-		}
-		iph1->approval = sa;
-	}
-	if (iph1->gi_i != NULL)
-		plog(LLV_DEBUG, LOCATION, NULL, "GIi is %.*s\n",
-		    (int)iph1->gi_i->l, iph1->gi_i->v);
-	if (iph1->gi_r != NULL)
-		plog(LLV_DEBUG, LOCATION, NULL, "GIr is %.*s\n",
-		    (int)iph1->gi_r->l, iph1->gi_r->v);
-#else
-	iph1->approval = sa;
-#endif
-	if(iph1->approval) {
-		plog(LLV_DEBUG, LOCATION, NULL, "agreed on %s auth.\n",
-		    s_oakley_attr_method(iph1->approval->authmethod));
-	}
-
-	newsa = get_sabyproppair(p, iph1);
-	if (newsa == NULL){
-		delisakmpsa(iph1->approval);
-		iph1->approval = NULL;
-	}
-
-	return newsa;
-}
-
-/*
- * compare peer's single proposal and all of my proposal.
- * and select one if suiatable.
- * p       : one of peer's proposal.
- * proposal: my proposals.
- */
-static struct isakmpsa *
-get_ph1approvalx(p, proposal, sap, check_level)
-	struct prop_pair *p;
-	struct isakmpsa *proposal, *sap;
-	int check_level;
-{
-	struct isakmp_pl_p *prop = p->prop;
-	struct isakmp_pl_t *trns = p->trns;
-	struct isakmpsa sa, *s, *tsap;
-	int authmethod;
-
-	plog(LLV_DEBUG, LOCATION, NULL,
-       		"prop#=%d, prot-id=%s, spi-size=%d, #trns=%d\n",
-		prop->p_no, s_ipsecdoi_proto(prop->proto_id),
-		prop->spi_size, prop->num_t);
-
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"trns#=%d, trns-id=%s\n",
-		trns->t_no,
-		s_ipsecdoi_trns(prop->proto_id, trns->t_id));
-
-	tsap = sap != NULL ? sap : &sa;
-
-	memset(tsap, 0, sizeof(*tsap));
-	if (t2isakmpsa(trns, tsap) < 0)
-		return NULL;
-	for (s = proposal; s != NULL; s = s->next) {
-#ifdef ENABLE_HYBRID
-		authmethod = switch_authmethod(s->authmethod);
-#else
-		authmethod = s->authmethod;
-#endif
-		plog(LLV_DEBUG, LOCATION, NULL, "Compared: DB:Peer\n");
-		plog(LLV_DEBUG, LOCATION, NULL, "(lifetime = %ld:%ld)\n",
-			(long)s->lifetime, (long)tsap->lifetime);
-		plog(LLV_DEBUG, LOCATION, NULL, "(lifebyte = %zu:%zu)\n",
-			s->lifebyte, tsap->lifebyte);
-		plog(LLV_DEBUG, LOCATION, NULL, "enctype = %s:%s\n",
-			s_oakley_attr_v(OAKLEY_ATTR_ENC_ALG,
-					s->enctype),
-			s_oakley_attr_v(OAKLEY_ATTR_ENC_ALG,
-					tsap->enctype));
-		plog(LLV_DEBUG, LOCATION, NULL, "(encklen = %d:%d)\n",
-			s->encklen, tsap->encklen);
-		plog(LLV_DEBUG, LOCATION, NULL, "hashtype = %s:%s\n",
-			s_oakley_attr_v(OAKLEY_ATTR_HASH_ALG,
-					s->hashtype),
-			s_oakley_attr_v(OAKLEY_ATTR_HASH_ALG,
-					tsap->hashtype));
-		plog(LLV_DEBUG, LOCATION, NULL, "authmethod = %s:%s\n",
-			s_oakley_attr_v(OAKLEY_ATTR_AUTH_METHOD,
-					s->authmethod),
-			s_oakley_attr_v(OAKLEY_ATTR_AUTH_METHOD,
-					tsap->authmethod));
-		plog(LLV_DEBUG, LOCATION, NULL, "dh_group = %s:%s\n",
-			s_oakley_attr_v(OAKLEY_ATTR_GRP_DESC,
-					s->dh_group),
-			s_oakley_attr_v(OAKLEY_ATTR_GRP_DESC,
-					tsap->dh_group));
-#if 0
-		/* XXX to be considered ? */
-		if (tsap->lifebyte > s->lifebyte) ;
-#endif
-		/*
-		 * if responder side and peer's key length in proposal
-		 * is bigger than mine, it might be accepted.
-		 */
-		if(tsap->enctype == s->enctype &&
-		    tsap->authmethod == authmethod &&
-		    tsap->hashtype == s->hashtype &&
-		    tsap->dh_group == s->dh_group &&
-		    tsap->encklen == s->encklen) {
-			switch(check_level) {
-			case PROP_CHECK_OBEY:
-				goto found;
-				break;
-
-			case PROP_CHECK_STRICT:
-				if ((tsap->lifetime > s->lifetime) ||
-				    (tsap->lifebyte > s->lifebyte))
-					continue;
-				goto found;
-				break;
-
-			case PROP_CHECK_CLAIM:
-				if (tsap->lifetime < s->lifetime)
-					s->lifetime = tsap->lifetime;
-				if (tsap->lifebyte < s->lifebyte)
-					s->lifebyte = tsap->lifebyte;
-				goto found;
-				break;
-
-			case PROP_CHECK_EXACT:
-				if ((tsap->lifetime != s->lifetime) ||
-				    (tsap->lifebyte != s->lifebyte))
-					continue;
-				goto found;
-				break;
-
-			default:
-				plog(LLV_ERROR, LOCATION, NULL, 
-				    "Unexpected proposal_check value\n");
-				continue;
-				break;
-			}
-		}
-	}
-
-found:
-	if (tsap->dhgrp != NULL){
-		oakley_dhgrp_free(tsap->dhgrp);
-		tsap->dhgrp = NULL;
-	}
-
-	if ((s = dupisakmpsa(s)) != NULL) {
-		switch(check_level) {
-		case PROP_CHECK_OBEY:
-			s->lifetime = tsap->lifetime;
-			s->lifebyte = tsap->lifebyte;
-			break;
-
-		case PROP_CHECK_STRICT:
-			s->lifetime = tsap->lifetime;
-			s->lifebyte = tsap->lifebyte;
-			break;
-
-		case PROP_CHECK_CLAIM:
-			if (tsap->lifetime < s->lifetime)
-				s->lifetime = tsap->lifetime;
-			if (tsap->lifebyte < s->lifebyte)
-				s->lifebyte = tsap->lifebyte;
-			break;
-
-		default:
-			break;
-		}
-	}
-	return s;
-}
-
-/*
- * print all of items in peer's proposal which are mismatched to my proposal.
- * p       : one of peer's proposal.
- * proposal: my proposals.
- */
-static void
-print_ph1mismatched(p, proposal)
-	struct prop_pair *p;
-	struct isakmpsa *proposal;
-{
-	struct isakmpsa sa, *s;
-
-	memset(&sa, 0, sizeof(sa));
-	if (t2isakmpsa(p->trns, &sa) < 0)
-		return;
-	for (s = proposal; s ; s = s->next) {
-		if (sa.enctype != s->enctype) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"rejected enctype: "
-				"DB(prop#%d:trns#%d):Peer(prop#%d:trns#%d) = "
-				"%s:%s\n",
-				s->prop_no, s->trns_no,
-				p->prop->p_no, p->trns->t_no,
-				s_oakley_attr_v(OAKLEY_ATTR_ENC_ALG,
-					s->enctype),
-				s_oakley_attr_v(OAKLEY_ATTR_ENC_ALG,
-					sa.enctype));
-		}
-		if (sa.authmethod != s->authmethod) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"rejected authmethod: "
-				"DB(prop#%d:trns#%d):Peer(prop#%d:trns#%d) = "
-				"%s:%s\n",
-				s->prop_no, s->trns_no,
-				p->prop->p_no, p->trns->t_no,
-				s_oakley_attr_v(OAKLEY_ATTR_AUTH_METHOD,
-					s->authmethod),
-				s_oakley_attr_v(OAKLEY_ATTR_AUTH_METHOD,
-					sa.authmethod));
-		}
-		if (sa.hashtype != s->hashtype) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"rejected hashtype: "
-				"DB(prop#%d:trns#%d):Peer(prop#%d:trns#%d) = "
-				"%s:%s\n",
-				s->prop_no, s->trns_no,
-				p->prop->p_no, p->trns->t_no,
-				s_oakley_attr_v(OAKLEY_ATTR_HASH_ALG,
-					s->hashtype),
-				s_oakley_attr_v(OAKLEY_ATTR_HASH_ALG,
-					sa.hashtype));
-		}
-		if (sa.dh_group != s->dh_group) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"rejected dh_group: "
-				"DB(prop#%d:trns#%d):Peer(prop#%d:trns#%d) = "
-				"%s:%s\n",
-				s->prop_no, s->trns_no,
-				p->prop->p_no, p->trns->t_no,
-				s_oakley_attr_v(OAKLEY_ATTR_GRP_DESC,
-					s->dh_group),
-				s_oakley_attr_v(OAKLEY_ATTR_GRP_DESC,
-					sa.dh_group));
-		}
-	}
-
-	if (sa.dhgrp != NULL){
-		oakley_dhgrp_free(sa.dhgrp);
-		sa.dhgrp=NULL;
-	}
-}
-
-/*
- * get ISAKMP data attributes
- */
-static int
-t2isakmpsa(trns, sa)
-	struct isakmp_pl_t *trns;
-	struct isakmpsa *sa;
-{
-	struct isakmp_data *d, *prev;
-	int flag, type;
-	int error = -1;
-	int life_t;
-	int keylen = 0;
-	vchar_t *val = NULL;
-	int len, tlen;
-	u_char *p;
-
-	tlen = ntohs(trns->h.len) - sizeof(*trns);
-	prev = (struct isakmp_data *)NULL;
-	d = (struct isakmp_data *)(trns + 1);
-
-	/* default */
-	life_t = OAKLEY_ATTR_SA_LD_TYPE_DEFAULT;
-	sa->lifetime = OAKLEY_ATTR_SA_LD_SEC_DEFAULT;
-	sa->lifebyte = 0;
-	sa->dhgrp = racoon_calloc(1, sizeof(struct dhgroup));
-	if (!sa->dhgrp)
-		goto err;
-
-	while (tlen > 0) {
-
-		type = ntohs(d->type) & ~ISAKMP_GEN_MASK;
-		flag = ntohs(d->type) & ISAKMP_GEN_MASK;
-
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"type=%s, flag=0x%04x, lorv=%s\n",
-			s_oakley_attr(type), flag,
-			s_oakley_attr_v(type, ntohs(d->lorv)));
-
-		/* get variable-sized item */
-		switch (type) {
-		case OAKLEY_ATTR_GRP_PI:
-		case OAKLEY_ATTR_GRP_GEN_ONE:
-		case OAKLEY_ATTR_GRP_GEN_TWO:
-		case OAKLEY_ATTR_GRP_CURVE_A:
-		case OAKLEY_ATTR_GRP_CURVE_B:
-		case OAKLEY_ATTR_SA_LD:
-		case OAKLEY_ATTR_GRP_ORDER:
-			if (flag) {	/*TV*/
-				len = 2;
-				p = (u_char *)&d->lorv;
-			} else {	/*TLV*/
-				len = ntohs(d->lorv);
-				p = (u_char *)(d + 1);
-			}
-			val = vmalloc(len);
-			if (!val)
-				return -1;
-			memcpy(val->v, p, len);
-			break;
-
-		default:
-			break;
-		}
-
-		switch (type) {
-		case OAKLEY_ATTR_ENC_ALG:
-			sa->enctype = (u_int16_t)ntohs(d->lorv);
-			break;
-
-		case OAKLEY_ATTR_HASH_ALG:
-			sa->hashtype = (u_int16_t)ntohs(d->lorv);
-			break;
-
-		case OAKLEY_ATTR_AUTH_METHOD:
-			sa->authmethod = ntohs(d->lorv);
-			break;
-
-		case OAKLEY_ATTR_GRP_DESC:
-			sa->dh_group = (u_int16_t)ntohs(d->lorv);
-			break;
-
-		case OAKLEY_ATTR_GRP_TYPE:
-		{
-			int type = (int)ntohs(d->lorv);
-			if (type == OAKLEY_ATTR_GRP_TYPE_MODP)
-				sa->dhgrp->type = type;
-			else
-				return -1;
-			break;
-		}
-		case OAKLEY_ATTR_GRP_PI:
-			sa->dhgrp->prime = val;
-			break;
-
-		case OAKLEY_ATTR_GRP_GEN_ONE:
-			vfree(val);
-			if (!flag)
-				sa->dhgrp->gen1 = ntohs(d->lorv);
-			else {
-				int len = ntohs(d->lorv);
-				sa->dhgrp->gen1 = 0;
-				if (len > 4)
-					return -1;
-				memcpy(&sa->dhgrp->gen1, d + 1, len);
-				sa->dhgrp->gen1 = ntohl(sa->dhgrp->gen1);
-			}
-			break;
-
-		case OAKLEY_ATTR_GRP_GEN_TWO:
-			vfree(val);
-			if (!flag)
-				sa->dhgrp->gen2 = ntohs(d->lorv);
-			else {
-				int len = ntohs(d->lorv);
-				sa->dhgrp->gen2 = 0;
-				if (len > 4)
-					return -1;
-				memcpy(&sa->dhgrp->gen2, d + 1, len);
-				sa->dhgrp->gen2 = ntohl(sa->dhgrp->gen2);
-			}
-			break;
-
-		case OAKLEY_ATTR_GRP_CURVE_A:
-			sa->dhgrp->curve_a = val;
-			break;
-
-		case OAKLEY_ATTR_GRP_CURVE_B:
-			sa->dhgrp->curve_b = val;
-			break;
-
-		case OAKLEY_ATTR_SA_LD_TYPE:
-		{
-			int type = (int)ntohs(d->lorv);
-			switch (type) {
-			case OAKLEY_ATTR_SA_LD_TYPE_SEC:
-			case OAKLEY_ATTR_SA_LD_TYPE_KB:
-				life_t = type;
-				break;
-			default:
-				life_t = OAKLEY_ATTR_SA_LD_TYPE_DEFAULT;
-				break;
-			}
-			break;
-		}
-		case OAKLEY_ATTR_SA_LD:
-			if (!prev
-			 || (ntohs(prev->type) & ~ISAKMP_GEN_MASK) !=
-					OAKLEY_ATTR_SA_LD_TYPE) {
-				plog(LLV_ERROR, LOCATION, NULL,
-				    "life duration must follow ltype\n");
-				break;
-			}
-
-			switch (life_t) {
-			case IPSECDOI_ATTR_SA_LD_TYPE_SEC:
-				sa->lifetime = ipsecdoi_set_ld(val);
-				vfree(val);
-				if (sa->lifetime == 0) {
-					plog(LLV_ERROR, LOCATION, NULL,
-						"invalid life duration.\n");
-					goto err;
-				}
-				break;
-			case IPSECDOI_ATTR_SA_LD_TYPE_KB:
-				sa->lifebyte = ipsecdoi_set_ld(val);
-				vfree(val);
-				if (sa->lifebyte == 0) {
-					plog(LLV_ERROR, LOCATION, NULL,
-						"invalid life duration.\n");
-					goto err;
-				}
-				break;
-			default:
-				vfree(val);
-				plog(LLV_ERROR, LOCATION, NULL,
-					"invalid life type: %d\n", life_t);
-				goto err;
-			}
-			break;
-
-		case OAKLEY_ATTR_KEY_LEN:
-		{
-			int len = ntohs(d->lorv);
-			if (len % 8 != 0) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"keylen %d: not multiple of 8\n",
-					len);
-				goto err;
-			}
-			sa->encklen = (u_int16_t)len;
-			keylen++;
-			break;
-		}
-		case OAKLEY_ATTR_PRF:
-		case OAKLEY_ATTR_FIELD_SIZE:
-			/* unsupported */
-			break;
-
-		case OAKLEY_ATTR_GRP_ORDER:
-			sa->dhgrp->order = val;
-			break;
-#ifdef HAVE_GSSAPI
-		case OAKLEY_ATTR_GSS_ID:
-		{
-			int error = -1;
-			iconv_t cd = (iconv_t) -1;
-			size_t srcleft, dstleft, rv;
-			__iconv_const char *src;
-			char *dst;
-			int len = ntohs(d->lorv);
-
-			/*
-			 * Older verions of racoon just placed the
-			 * ISO-Latin-1 string on the wire directly.
-			 * Check to see if we are configured to be
-			 * compatible with this behavior.
-			 */
-			if (lcconf->gss_id_enc == LC_GSSENC_LATIN1) {
-				if ((sa->gssid = vmalloc(len)) == NULL) {
-					plog(LLV_ERROR, LOCATION, NULL,
-					    "failed to allocate memory\n");
-					goto out;
-				}
-				memcpy(sa->gssid->v, d + 1, len);
-				plog(LLV_DEBUG, LOCATION, NULL,
-				    "received old-style gss "
-				    "id '%.*s' (len %zu)\n",
-				    (int)sa->gssid->l, sa->gssid->v, 
-				    sa->gssid->l);
-				error = 0;
-				goto out;
-			}
-
-			/*
-			 * For Windows 2000 compatibility, we expect
-			 * the GSS ID attribute on the wire to be
-			 * encoded in UTF-16LE.  Internally, we work
-			 * in ISO-Latin-1.  Therefore, we should need
-			 * 1/2 the specified length, which should always
-			 * be a multiple of 2 octets.
-			 */
-			cd = iconv_open("latin1", "utf-16le");
-			if (cd == (iconv_t) -1) {
-				plog(LLV_ERROR, LOCATION, NULL,
-				    "unable to initialize utf-16le -> latin1 "
-				    "conversion descriptor: %s\n",
-				    strerror(errno));
-				goto out;
-			}
-
-			if ((sa->gssid = vmalloc(len / 2)) == NULL) {
-				plog(LLV_ERROR, LOCATION, NULL,
-				    "failed to allocate memory\n");
-				goto out;
-			}
-
-			src = (__iconv_const char *)(d + 1);
-			srcleft = len;
-
-			dst = sa->gssid->v;
-			dstleft = len / 2;
-
-			rv = iconv(cd, (__iconv_const char **)&src, &srcleft, 
-				   &dst, &dstleft);
-			if (rv != 0) {
-				if (rv == -1) {
-					plog(LLV_ERROR, LOCATION, NULL,
-					    "unable to convert GSS ID from "
-					    "utf-16le -> latin1: %s\n",
-					    strerror(errno));
-				} else {
-					plog(LLV_ERROR, LOCATION, NULL,
-					    "%zd character%s in GSS ID cannot "
-					    "be represented in latin1\n",
-					    rv, rv == 1 ? "" : "s");
-				}
-				goto out;
-			}
-
-			/* XXX dstleft should always be 0; assert it? */
-			sa->gssid->l = (len / 2) - dstleft;
-
-			plog(LLV_DEBUG, LOCATION, NULL,
-			    "received gss id '%.*s' (len %zu)\n",
-			    (int)sa->gssid->l, sa->gssid->v, sa->gssid->l);
-
-			error = 0;
-out:
-			if (cd != (iconv_t)-1)
-				(void)iconv_close(cd);
-
-			if ((error != 0) && (sa->gssid != NULL)) {
-				vfree(sa->gssid);
-				sa->gssid = NULL;
-			}
-			break;
-		}
-#endif /* HAVE_GSSAPI */
-
-		default:
-			break;
-		}
-
-		prev = d;
-		if (flag) {
-			tlen -= sizeof(*d);
-			d = (struct isakmp_data *)((char *)d + sizeof(*d));
-		} else {
-			tlen -= (sizeof(*d) + ntohs(d->lorv));
-			d = (struct isakmp_data *)((char *)d + sizeof(*d) + ntohs(d->lorv));
-		}
-	}
-
-	/* key length must not be specified on some algorithms */
-	if (keylen) {
-		if (sa->enctype == OAKLEY_ATTR_ENC_ALG_DES
-#ifdef HAVE_OPENSSL_IDEA_H
-		 || sa->enctype == OAKLEY_ATTR_ENC_ALG_IDEA
-#endif
-		 || sa->enctype == OAKLEY_ATTR_ENC_ALG_3DES) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"keylen must not be specified "
-				"for encryption algorithm %d\n",
-				sa->enctype);
-			return -1;
-		}
-	}
-
-	return 0;
-err:
-	return error;
-}
-
-/*%%%*/
-/*
- * check phase 2 SA payload and select single proposal.
- * make new SA payload to be replyed not including general header.
- * This function is called by responder only.
- * OUT:
- *	0: succeed.
- *	-1: error occured.
- */
-int
-ipsecdoi_selectph2proposal(iph2)
-	struct ph2handle *iph2;
-{
-	struct prop_pair **pair;
-	struct prop_pair *ret;
-
-	/* get proposal pair */
-	pair = get_proppair(iph2->sa, IPSECDOI_TYPE_PH2);
-	if (pair == NULL)
-		return -1;
-
-	/* check and select a proposal. */
-	ret = get_ph2approval(iph2, pair);
-	free_proppair(pair);
-	if (ret == NULL)
-		return -1;
-
-	/* make a SA to be replayed. */
-	/* SPI must be updated later. */
-	iph2->sa_ret = get_sabyproppair(ret, iph2->ph1);
-	free_proppair0(ret);
-	if (iph2->sa_ret == NULL)
-		return -1;
-
-	return 0;
-}
-
-/*
- * check phase 2 SA payload returned from responder.
- * This function is called by initiator only.
- * OUT:
- *	0: valid.
- *	-1: invalid.
- */
-int
-ipsecdoi_checkph2proposal(iph2)
-	struct ph2handle *iph2;
-{
-	struct prop_pair **rpair = NULL, **spair = NULL;
-	struct prop_pair *p;
-	int i, n, num;
-	int error = -1;
-	vchar_t *sa_ret = NULL;
-
-	/* get proposal pair of SA sent. */
-	spair = get_proppair(iph2->sa, IPSECDOI_TYPE_PH2);
-	if (spair == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get prop pair.\n");
-		goto end;
-	}
-
-	/* XXX should check the number of transform */
-
-	/* get proposal pair of SA replayed */
-	rpair = get_proppair(iph2->sa_ret, IPSECDOI_TYPE_PH2);
-	if (rpair == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get prop pair.\n");
-		goto end;
-	}
-
-	/* check proposal is only one ? */
-	n = 0;
-	num = 0;
-	for (i = 0; i < MAXPROPPAIRLEN; i++) {
-		if (rpair[i]) {
-			n = i;
-			num++;
-		}
-	}
-	if (num == 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"no proposal received.\n");
-		goto end;
-	}
-	if (num != 1) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"some proposals received.\n");
-		goto end;
-	}
-
-	if (spair[n] == NULL) {
-		plog(LLV_WARNING, LOCATION, NULL,
-			"invalid proposal number:%d received.\n", i);
-	}
-	
-
-	if (rpair[n]->tnext != NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"multi transforms replyed.\n");
-		goto end;
-	}
-
-	if (cmp_aproppair_i(rpair[n], spair[n])) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"proposal mismathed.\n");
-		goto end;
-	}
-
-	/*
-	 * check and select a proposal.
-	 * ensure that there is no modification of the proposal by
-	 * cmp_aproppair_i()
-	 */
-	p = get_ph2approval(iph2, rpair);
-	if (p == NULL)
-		goto end;
-
-	/* make a SA to be replayed. */
-	sa_ret = iph2->sa_ret;
-	iph2->sa_ret = get_sabyproppair(p, iph2->ph1);
-	free_proppair0(p);
-	if (iph2->sa_ret == NULL)
-		goto end;
-
-	error = 0;
-
-end:
-	if (rpair)
-		free_proppair(rpair);
-	if (spair)
-		free_proppair(spair);
-	if (sa_ret)
-		vfree(sa_ret);
-
-	return error;
-}
-
-/*
- * compare two prop_pair which is assumed to have same proposal number.
- * the case of bundle or single SA, NOT multi transforms.
- * a: a proposal that is multi protocols and single transform, usually replyed.
- * b: a proposal that is multi protocols and multi transform, usually sent.
- * NOTE: this function is for initiator.
- * OUT
- *	0: equal
- *	1: not equal
- * XXX cannot understand the comment!
- */
-static int
-cmp_aproppair_i(a, b)
-	struct prop_pair *a, *b;
-{
-	struct prop_pair *p, *q, *r;
-	int len;
-
-	for (p = a, q = b; p && q; p = p->next, q = q->next) {
-		for (r = q; r; r = r->tnext) {
-			/* compare trns */
-			if (p->trns->t_no == r->trns->t_no)
-				break;
-		}
-		if (!r) {
-			/* no suitable transform found */
-			plog(LLV_ERROR, LOCATION, NULL,
-				"no suitable transform found.\n");
-			return -1;
-		}
-
-		/* compare prop */
-		if (p->prop->p_no != r->prop->p_no) {
-			plog(LLV_WARNING, LOCATION, NULL,
-				"proposal #%d mismatched, "
-				"expected #%d.\n",
-				r->prop->p_no, p->prop->p_no);
-			/*FALLTHROUGH*/
-		}
-
-		if (p->prop->proto_id != r->prop->proto_id) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"proto_id mismathed: my:%d peer:%d\n",
-				r->prop->proto_id, p->prop->proto_id);
-			return -1;
-		}
-
-		if (p->prop->spi_size != r->prop->spi_size) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid spi size: %d.\n",
-				p->prop->spi_size);
-			return -1;
-		}
-
-		/* check #of transforms */
-		if (p->prop->num_t != 1) {
-			plog(LLV_WARNING, LOCATION, NULL,
-				"#of transform is %d, "
-				"but expected 1.\n", p->prop->num_t);
-			/*FALLTHROUGH*/
-		}
-
-		if (p->trns->t_id != r->trns->t_id) {
-			plog(LLV_WARNING, LOCATION, NULL,
-				"transform number has been modified.\n");
-			/*FALLTHROUGH*/
-		}
-		if (p->trns->reserved != r->trns->reserved) {
-			plog(LLV_WARNING, LOCATION, NULL,
-				"reserved field should be zero.\n");
-			/*FALLTHROUGH*/
-		}
-
-		/* compare attribute */
-		len = ntohs(r->trns->h.len) - sizeof(*p->trns);
-		if (memcmp(p->trns + 1, r->trns + 1, len) != 0) {
-			plog(LLV_WARNING, LOCATION, NULL,
-				"attribute has been modified.\n");
-			/*FALLTHROUGH*/
-		}
-	}
-	if ((p && !q) || (!p && q)) {
-		/* # of protocols mismatched */
-		plog(LLV_ERROR, LOCATION, NULL,
-			"#of protocols mismatched.\n");
-		return -1;
-	}
-
-	return 0;
-}
-
-/*
- * acceptable check for policy configuration.
- * return a new SA payload to be reply to peer.
- */
-static struct prop_pair *
-get_ph2approval(iph2, pair)
-	struct ph2handle *iph2;
-	struct prop_pair **pair;
-{
-	struct prop_pair *ret;
-	int i;
-
-	iph2->approval = NULL;
-
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"begin compare proposals.\n");
-
-	for (i = 0; i < MAXPROPPAIRLEN; i++) {
-		if (pair[i] == NULL)
-			continue;
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"pair[%d]: %p\n", i, pair[i]);
-		print_proppair(LLV_DEBUG, pair[i]);;
-
-		/* compare proposal and select one */
-		ret = get_ph2approvalx(iph2, pair[i]);
-		if (ret != NULL) {
-			/* found */
-			return ret;
-		}
-	}
-
-	plog(LLV_ERROR, LOCATION, NULL, "no suitable policy found.\n");
-
-	return NULL;
-}
-
-/*
- * compare my proposal and peers just one proposal.
- * set a approval.
- */
-static struct prop_pair *
-get_ph2approvalx(iph2, pp)
-	struct ph2handle *iph2;
-	struct prop_pair *pp;
-{
-	struct prop_pair *ret = NULL;
-	struct saprop *pr0, *pr = NULL;
-	struct saprop *q1, *q2;
-
-	pr0 = aproppair2saprop(pp);
-	if (pr0 == NULL)
-		return NULL;
-
-	for (q1 = pr0; q1; q1 = q1->next) {
-		for (q2 = iph2->proposal; q2; q2 = q2->next) {
-			plog(LLV_DEBUG, LOCATION, NULL,
-				"peer's single bundle:\n");
-			printsaprop0(LLV_DEBUG, q1);
-			plog(LLV_DEBUG, LOCATION, NULL,
-				"my single bundle:\n");
-			printsaprop0(LLV_DEBUG, q2);
-
-			pr = cmpsaprop_alloc(iph2->ph1, q1, q2, iph2->side);
-			if (pr != NULL)
-				goto found;
-
-			plog(LLV_ERROR, LOCATION, NULL,
-				"not matched\n");
-		}
-	}
-	/* no proposal matching */
-err:
-	flushsaprop(pr0);
-	return NULL;
-
-found:
-	flushsaprop(pr0);
-	plog(LLV_DEBUG, LOCATION, NULL, "matched\n");
-	iph2->approval = pr;
-
-    {
-	struct saproto *sp;
-	struct prop_pair *p, *x;
-	struct prop_pair *n = NULL;
-
-	ret = NULL;
-
-	for (p = pp; p; p = p->next) {
-		/*
-		 * find a proposal with matching proto_id.
-		 * we have analyzed validity already, in cmpsaprop_alloc().
-		 */
-		for (sp = pr->head; sp; sp = sp->next) {
-			if (sp->proto_id == p->prop->proto_id)
-				break;
-		}
-		if (!sp)
-			goto err;
-		if (sp->head->next)
-			goto err;	/* XXX */
-
-		for (x = p; x; x = x->tnext)
-			if (sp->head->trns_no == x->trns->t_no)
-				break;
-		if (!x)
-			goto err;	/* XXX */
-
-		n = racoon_calloc(1, sizeof(struct prop_pair));
-		if (n == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to get buffer.\n");
-			goto err;
-		}
-
-		n->prop = x->prop;
-		n->trns = x->trns;
-
-		/* need to preserve the order */
-		for (x = ret; x && x->next; x = x->next)
-			;
-		if (x && x->prop == n->prop) {
-			for (/*nothing*/; x && x->tnext; x = x->tnext)
-				;
-			x->tnext = n;
-		} else {
-			if (x)
-				x->next = n;
-			else {
-				ret = n;
-			}
-		}
-
-		/* #of transforms should be updated ? */
-	}
-    }
-
-	return ret;
-}
-
-void
-free_proppair(pair)
-	struct prop_pair **pair;
-{
-	int i;
-
-	for (i = 0; i < MAXPROPPAIRLEN; i++) {
-		free_proppair0(pair[i]);
-		pair[i] = NULL;
-	}
-	racoon_free(pair);
-}
-
-static void
-free_proppair0(pair)
-	struct prop_pair *pair;
-{
-	struct prop_pair *p, *q, *r, *s;
-
-	p = pair;
-	while (p) {
-		q = p->next;
-		r = p;
-		while (r) {
-			s = r->tnext;
-			racoon_free(r);
-			r = s;
-		}
-		p = q;
-	}
-}
-
-/*
- * get proposal pairs from SA payload.
- * tiny check for proposal payload.
- */
-struct prop_pair **
-get_proppair(sa, mode)
-	vchar_t *sa;
-	int mode;
-{
-	struct prop_pair **pair = NULL;
-	int num_p = 0;			/* number of proposal for use */
-	int tlen;
-	caddr_t bp;
-	int i;
-	struct ipsecdoi_sa_b *sab = (struct ipsecdoi_sa_b *)sa->v;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "total SA len=%zu\n", sa->l);
-	plogdump(LLV_DEBUG, sa->v, sa->l);
-
-	/* check SA payload size */
-	if (sa->l < sizeof(*sab)) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"Invalid SA length = %zu.\n", sa->l);
-		goto bad;
-	}
-
-	/* check DOI */
-	if (check_doi(ntohl(sab->doi)) < 0)
-		goto bad;
-
-	/* check SITUATION */
-	if (check_situation(ntohl(sab->sit)) < 0)
-		goto bad;
-
-	pair = racoon_calloc(1, MAXPROPPAIRLEN * sizeof(*pair));
-	if (pair == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get buffer.\n");
-		goto bad;
-	}
-#if defined(ANDROID_CHANGES)
-	memset(pair, 0, MAXPROPPAIRLEN * sizeof(*pair));
-#else
-	memset(pair, 0, sizeof(pair));
-#endif
-
-	bp = (caddr_t)(sab + 1);
-	tlen = sa->l - sizeof(*sab);
-
-    {
-	struct isakmp_pl_p *prop;
-	int proplen;
-	vchar_t *pbuf = NULL;
-	struct isakmp_parse_t *pa;
-
-	pbuf = isakmp_parsewoh(ISAKMP_NPTYPE_P, (struct isakmp_gen *)bp, tlen);
-	if (pbuf == NULL)
-		goto bad;
-
-	for (pa = (struct isakmp_parse_t *)pbuf->v;
-	     pa->type != ISAKMP_NPTYPE_NONE;
-	     pa++) {
-		/* check the value of next payload */
-		if (pa->type != ISAKMP_NPTYPE_P) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"Invalid payload type=%u\n", pa->type);
-			vfree(pbuf);
-			goto bad;
-		}
-
-		prop = (struct isakmp_pl_p *)pa->ptr;
-		proplen = pa->len;
-
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"proposal #%u len=%d\n", prop->p_no, proplen);
-
-		if (proplen == 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid proposal with length %d\n", proplen);
-			vfree(pbuf);
-			goto bad;
-		}
-
-		/* check Protocol ID */
-		if (!check_protocol[mode]) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"unsupported mode %d\n", mode);
-			continue;
-		}
-
-		if (check_protocol[mode](prop->proto_id) < 0)
-			continue;
-
-		/* check SPI length when IKE. */
-		if (check_spi_size(prop->proto_id, prop->spi_size) < 0)
-			continue;
-
-		/* get transform */
-		if (get_transform(prop, pair, &num_p) < 0) {
-			vfree(pbuf);
-			goto bad;
-		}
-	}
-	vfree(pbuf);
-	pbuf = NULL;
-    }
-
-    {
-	int notrans, nprop;
-	struct prop_pair *p, *q;
-
-	/* check for proposals with no transforms */
-	for (i = 0; i < MAXPROPPAIRLEN; i++) {
-		if (!pair[i])
-			continue;
-
-		plog(LLV_DEBUG, LOCATION, NULL, "pair %d:\n", i);
-		print_proppair(LLV_DEBUG, pair[i]);
-
-		notrans = nprop = 0;
-		for (p = pair[i]; p; p = p->next) {
-			if (p->trns == NULL) {
-				notrans++;
-				break;
-			}
-			for (q = p; q; q = q->tnext)
-				nprop++;
-		}
-
-#if 0
-		/*
-		 * XXX at this moment, we cannot accept proposal group
-		 * with multiple proposals.  this should be fixed.
-		 */
-		if (pair[i]->next) {
-			plog(LLV_WARNING, LOCATION, NULL,
-				"proposal #%u ignored "
-				"(multiple proposal not supported)\n",
-				pair[i]->prop->p_no);
-			notrans++;
-		}
-#endif
-
-		if (notrans) {
-			for (p = pair[i]; p; p = q) {
-				q = p->next;
-				racoon_free(p);
-			}
-			pair[i] = NULL;
-			num_p--;
-		} else {
-			plog(LLV_DEBUG, LOCATION, NULL,
-				"proposal #%u: %d transform\n",
-				pair[i]->prop->p_no, nprop);
-		}
-	}
-    }
-
-	/* bark if no proposal is found. */
-	if (num_p <= 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"no Proposal found.\n");
-		goto bad;
-	}
-
-	return pair;
-bad:
-	if (pair != NULL)
-		racoon_free(pair);
-	return NULL;
-}
-
-/*
- * check transform payload.
- * OUT:
- *	positive: return the pointer to the payload of valid transform.
- *	0	: No valid transform found.
- */
-static int
-get_transform(prop, pair, num_p)
-	struct isakmp_pl_p *prop;
-	struct prop_pair **pair;
-	int *num_p;
-{
-	int tlen; /* total length of all transform in a proposal */
-	caddr_t bp;
-	struct isakmp_pl_t *trns;
-	int trnslen;
-	vchar_t *pbuf = NULL;
-	struct isakmp_parse_t *pa;
-	struct prop_pair *p = NULL, *q;
-	int num_t;
-
-	bp = (caddr_t)prop + sizeof(struct isakmp_pl_p) + prop->spi_size;
-	tlen = ntohs(prop->h.len)
-		- (sizeof(struct isakmp_pl_p) + prop->spi_size);
-	pbuf = isakmp_parsewoh(ISAKMP_NPTYPE_T, (struct isakmp_gen *)bp, tlen);
-	if (pbuf == NULL)
-		return -1;
-
-	/* check and get transform for use */
-	num_t = 0;
-	for (pa = (struct isakmp_parse_t *)pbuf->v;
-	     pa->type != ISAKMP_NPTYPE_NONE;
-	     pa++) {
-
-		num_t++;
-
-		/* check the value of next payload */
-		if (pa->type != ISAKMP_NPTYPE_T) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"Invalid payload type=%u\n", pa->type);
-			break;
-		}
-
-		trns = (struct isakmp_pl_t *)pa->ptr;
-		trnslen = pa->len;
-
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"transform #%u len=%u\n", trns->t_no, trnslen);
-
-		/* check transform ID */
-		if (prop->proto_id >= ARRAYLEN(check_transform)) {
-			plog(LLV_WARNING, LOCATION, NULL,
-				"unsupported proto_id %u\n",
-				prop->proto_id);
-			continue;
-		}
-		if (prop->proto_id >= ARRAYLEN(check_attributes)) {
-			plog(LLV_WARNING, LOCATION, NULL,
-				"unsupported proto_id %u\n",
-				prop->proto_id);
-			continue;
-		}
-
-		if (!check_transform[prop->proto_id]
-		 || !check_attributes[prop->proto_id]) {
-			plog(LLV_WARNING, LOCATION, NULL,
-				"unsupported proto_id %u\n",
-				prop->proto_id);
-			continue;
-		}
-		if (check_transform[prop->proto_id](trns->t_id) < 0)
-			continue;
-
-		/* check data attributes */
-		if (check_attributes[prop->proto_id](trns) != 0)
-			continue;
-
-		p = racoon_calloc(1, sizeof(*p));
-		if (p == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to get buffer.\n");
-			vfree(pbuf);
-			return -1;
-		}
-		p->prop = prop;
-		p->trns = trns;
-
-		/* need to preserve the order */
-		for (q = pair[prop->p_no]; q && q->next; q = q->next)
-			;
-		if (q && q->prop == p->prop) {
-			for (/*nothing*/; q && q->tnext; q = q->tnext)
-				;
-			q->tnext = p;
-		} else {
-			if (q)
-				q->next = p;
-			else {
-				pair[prop->p_no] = p;
-				(*num_p)++;
-			}
-		}
-	}
-
-	vfree(pbuf);
-
-	return 0;
-}
-
-/*
- * make a new SA payload from prop_pair.
- * NOTE: this function make spi value clear.
- */
-vchar_t *
-get_sabyproppair(pair, iph1)
-	struct prop_pair *pair;
-	struct ph1handle *iph1;
-{
-	vchar_t *newsa;
-	int newtlen;
-	u_int8_t *np_p = NULL;
-	struct prop_pair *p;
-	int prophlen, trnslen;
-	caddr_t bp;
-
-	newtlen = sizeof(struct ipsecdoi_sa_b);
-	for (p = pair; p; p = p->next) {
-		newtlen += sizeof(struct isakmp_pl_p);
-		newtlen += p->prop->spi_size;
-		newtlen += ntohs(p->trns->h.len);
-	}
-
-	newsa = vmalloc(newtlen);
-	if (newsa == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "failed to get newsa.\n");
-		return NULL;
-	}
-	bp = newsa->v;
-
-	((struct isakmp_gen *)bp)->len = htons(newtlen);
-
-	/* update some of values in SA header */
-	((struct ipsecdoi_sa_b *)bp)->doi = htonl(iph1->rmconf->doitype);
-	((struct ipsecdoi_sa_b *)bp)->sit = htonl(iph1->rmconf->sittype);
-	bp += sizeof(struct ipsecdoi_sa_b);
-
-	/* create proposal payloads */
-	for (p = pair; p; p = p->next) {
-		prophlen = sizeof(struct isakmp_pl_p)
-				+ p->prop->spi_size;
-		trnslen = ntohs(p->trns->h.len);
-
-		if (np_p)
-			*np_p = ISAKMP_NPTYPE_P;
-
-		/* create proposal */
-
-		memcpy(bp, p->prop, prophlen);
-		((struct isakmp_pl_p *)bp)->h.np = ISAKMP_NPTYPE_NONE;
-		((struct isakmp_pl_p *)bp)->h.len = htons(prophlen + trnslen);
-		((struct isakmp_pl_p *)bp)->num_t = 1;
-		np_p = &((struct isakmp_pl_p *)bp)->h.np;
-		memset(bp + sizeof(struct isakmp_pl_p), 0, p->prop->spi_size);
-		bp += prophlen;
-
-		/* create transform */
-		memcpy(bp, p->trns, trnslen);
-		((struct isakmp_pl_t *)bp)->h.np = ISAKMP_NPTYPE_NONE;
-		((struct isakmp_pl_t *)bp)->h.len = htons(trnslen);
-		bp += trnslen;
-	}
-
-	return newsa;
-}
-
-/*
- * update responder's spi
- */
-int
-ipsecdoi_updatespi(iph2)
-	struct ph2handle *iph2;
-{
-	struct prop_pair **pair, *p;
-	struct saprop *pp;
-	struct saproto *pr;
-	int i;
-	int error = -1;
-	u_int8_t *spi;
-
-	pair = get_proppair(iph2->sa_ret, IPSECDOI_TYPE_PH2);
-	if (pair == NULL)
-		return -1;
-	for (i = 0; i < MAXPROPPAIRLEN; i++) {
-		if (pair[i])
-			break;
-	}
-	if (i == MAXPROPPAIRLEN || pair[i]->tnext) {
-		/* multiple transform must be filtered by selectph2proposal.*/
-		goto end;
-	}
-
-	pp = iph2->approval;
-
-	/* create proposal payloads */
-	for (p = pair[i]; p; p = p->next) {
-		/*
-		 * find a proposal/transform with matching proto_id/t_id.
-		 * we have analyzed validity already, in cmpsaprop_alloc().
-		 */
-		for (pr = pp->head; pr; pr = pr->next) {
-			if (p->prop->proto_id == pr->proto_id &&
-			    p->trns->t_id == pr->head->trns_id) {
-				break;
-			}
-		}
-		if (!pr)
-			goto end;
-
-		/*
-		 * XXX SPI bits are left-filled, for use with IPComp.
-		 * we should be switching to variable-length spi field...
-		 */
-		spi = (u_int8_t *)&pr->spi;
-		spi += sizeof(pr->spi);
-		spi -= pr->spisize;
-		memcpy((caddr_t)p->prop + sizeof(*p->prop), spi, pr->spisize);
-	}
-
-	error = 0;
-end:
-	free_proppair(pair);
-	return error;
-}
-
-/*
- * make a new SA payload from prop_pair.
- */
-vchar_t *
-get_sabysaprop(pp0, sa0)
-	struct saprop *pp0;
-	vchar_t *sa0;
-{
-	struct prop_pair **pair = NULL;
-	vchar_t *newsa = NULL;
-	int newtlen;
-	u_int8_t *np_p = NULL;
-	struct prop_pair *p = NULL;
-	struct saprop *pp;
-	struct saproto *pr;
-	struct satrns *tr;
-	int prophlen, trnslen;
-	caddr_t bp;
-	int error = -1;
-
-	/* get proposal pair */
-	pair = get_proppair(sa0, IPSECDOI_TYPE_PH2);
-	if (pair == NULL)
-		goto out;
-
-	newtlen = sizeof(struct ipsecdoi_sa_b);
-	for (pp = pp0; pp; pp = pp->next) {
-
-		if (pair[pp->prop_no] == NULL)
-			goto out;
-
-		for (pr = pp->head; pr; pr = pr->next) {
-			newtlen += (sizeof(struct isakmp_pl_p)
-				+ pr->spisize);
-
-			for (tr = pr->head; tr; tr = tr->next) {
-				for (p = pair[pp->prop_no]; p; p = p->tnext) {
-					if (tr->trns_no == p->trns->t_no)
-						break;
-				}
-				if (p == NULL)
-					goto out;
-
-				newtlen += ntohs(p->trns->h.len);
-			}
-		}
-	}
-
-	newsa = vmalloc(newtlen);
-	if (newsa == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "failed to get newsa.\n");
-		goto out;
-	}
-	bp = newsa->v;
-
-	/* some of values of SA must be updated in the out of this function */
-	((struct isakmp_gen *)bp)->len = htons(newtlen);
-	bp += sizeof(struct ipsecdoi_sa_b);
-
-	/* create proposal payloads */
-	for (pp = pp0; pp; pp = pp->next) {
-
-		for (pr = pp->head; pr; pr = pr->next) {
-			prophlen = sizeof(struct isakmp_pl_p)
-					+ p->prop->spi_size;
-
-			for (tr = pr->head; tr; tr = tr->next) {
-				for (p = pair[pp->prop_no]; p; p = p->tnext) {
-					if (tr->trns_no == p->trns->t_no)
-						break;
-				}
-				if (p == NULL)
-					goto out;
-
-				trnslen = ntohs(p->trns->h.len);
-
-				if (np_p)
-					*np_p = ISAKMP_NPTYPE_P;
-
-				/* create proposal */
-
-				memcpy(bp, p->prop, prophlen);
-				((struct isakmp_pl_p *)bp)->h.np = ISAKMP_NPTYPE_NONE;
-				((struct isakmp_pl_p *)bp)->h.len = htons(prophlen + trnslen);
-				((struct isakmp_pl_p *)bp)->num_t = 1;
-				np_p = &((struct isakmp_pl_p *)bp)->h.np;
-				bp += prophlen;
-
-				/* create transform */
-				memcpy(bp, p->trns, trnslen);
-				((struct isakmp_pl_t *)bp)->h.np = ISAKMP_NPTYPE_NONE;
-				((struct isakmp_pl_t *)bp)->h.len = htons(trnslen);
-				bp += trnslen;
-			}
-		}
-	}
-
-	error = 0;
-out:
-	if (pair != NULL)
-		racoon_free(pair);
-
-	if (error != 0) {
-		if (newsa != NULL) {
-			vfree(newsa);
-			newsa = NULL;
-		}
-	}
-
-	return newsa;
-}
-
-/*
- * If some error happens then return 0.  Although 0 means that lifetime is zero,
- * such a value should not be accepted.
- * Also 0 of lifebyte should not be included in a packet although 0 means not
- * to care of it.
- */
-static u_int32_t
-ipsecdoi_set_ld(buf)
-	vchar_t *buf;
-{
-	u_int32_t ld;
-
-	if (buf == 0)
-		return 0;
-
-	switch (buf->l) {
-	case 2:
-		ld = ntohs(*(u_int16_t *)buf->v);
-		break;
-	case 4:
-		ld = ntohl(*(u_int32_t *)buf->v);
-		break;
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"length %zu of life duration "
-			"isn't supported.\n", buf->l);
-		return 0;
-	}
-
-	return ld;
-}
-
-/*%%%*/
-/*
- * check DOI
- */
-static int
-check_doi(doi)
-	u_int32_t doi;
-{
-	switch (doi) {
-	case IPSEC_DOI:
-		return 0;
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid value of DOI 0x%08x.\n", doi);
-		return -1;
-	}
-	/* NOT REACHED */
-}
-
-/*
- * check situation
- */
-static int
-check_situation(sit)
-	u_int32_t sit;
-{
-	switch (sit) {
-	case IPSECDOI_SIT_IDENTITY_ONLY:
-		return 0;
-
-	case IPSECDOI_SIT_SECRECY:
-	case IPSECDOI_SIT_INTEGRITY:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"situation 0x%08x unsupported yet.\n", sit);
-		return -1;
-
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid situation 0x%08x.\n", sit);
-		return -1;
-	}
-	/* NOT REACHED */
-}
-
-/*
- * check protocol id in main mode
- */
-static int
-check_prot_main(proto_id)
-	int proto_id;
-{
-	switch (proto_id) {
-	case IPSECDOI_PROTO_ISAKMP:
-		return 0;
-
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"Illegal protocol id=%u.\n", proto_id);
-		return -1;
-	}
-	/* NOT REACHED */
-}
-
-/*
- * check protocol id in quick mode
- */
-static int
-check_prot_quick(proto_id)
-	int proto_id;
-{
-	switch (proto_id) {
-	case IPSECDOI_PROTO_IPSEC_AH:
-	case IPSECDOI_PROTO_IPSEC_ESP:
-		return 0;
-
-	case IPSECDOI_PROTO_IPCOMP:
-		return 0;
-
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid protocol id %d.\n", proto_id);
-		return -1;
-	}
-	/* NOT REACHED */
-}
-
-static int
-check_spi_size(proto_id, size)
-	int proto_id, size;
-{
-	switch (proto_id) {
-	case IPSECDOI_PROTO_ISAKMP:
-		if (size != 0) {
-			/* WARNING */
-			plog(LLV_WARNING, LOCATION, NULL,
-				"SPI size isn't zero, but IKE proposal.\n");
-		}
-		return 0;
-
-	case IPSECDOI_PROTO_IPSEC_AH:
-	case IPSECDOI_PROTO_IPSEC_ESP:
-		if (size != 4) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid SPI size=%d for IPSEC proposal.\n",
-				size);
-			return -1;
-		}
-		return 0;
-
-	case IPSECDOI_PROTO_IPCOMP:
-		if (size != 2 && size != 4) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid SPI size=%d for IPCOMP proposal.\n",
-				size);
-			return -1;
-		}
-		return 0;
-
-	default:
-		/* ??? */
-		return -1;
-	}
-	/* NOT REACHED */
-}
-
-/*
- * check transform ID in ISAKMP.
- */
-static int
-check_trns_isakmp(t_id)
-	int t_id;
-{
-	switch (t_id) {
-	case IPSECDOI_KEY_IKE:
-		return 0;
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid transform-id=%u in proto_id=%u.\n",
-			t_id, IPSECDOI_KEY_IKE);
-		return -1;
-	}
-	/* NOT REACHED */
-}
-
-/*
- * check transform ID in AH.
- */
-static int
-check_trns_ah(t_id)
-	int t_id;
-{
-	switch (t_id) {
-	case IPSECDOI_AH_MD5:
-	case IPSECDOI_AH_SHA:
-	case IPSECDOI_AH_SHA256:
-	case IPSECDOI_AH_SHA384:
-	case IPSECDOI_AH_SHA512:
-		return 0;
-	case IPSECDOI_AH_DES:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"not support transform-id=%u in AH.\n", t_id);
-		return -1;
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid transform-id=%u in AH.\n", t_id);
-		return -1;
-	}
-	/* NOT REACHED */
-}
-
-/*
- * check transform ID in ESP.
- */
-static int
-check_trns_esp(t_id)
-	int t_id;
-{
-	switch (t_id) {
-	case IPSECDOI_ESP_DES:
-	case IPSECDOI_ESP_3DES:
-	case IPSECDOI_ESP_NULL:
-	case IPSECDOI_ESP_RC5:
-	case IPSECDOI_ESP_CAST:
-	case IPSECDOI_ESP_BLOWFISH:
-	case IPSECDOI_ESP_AES:
-	case IPSECDOI_ESP_TWOFISH:
-	case IPSECDOI_ESP_CAMELLIA:
-		return 0;
-	case IPSECDOI_ESP_DES_IV32:
-	case IPSECDOI_ESP_DES_IV64:
-	case IPSECDOI_ESP_IDEA:
-	case IPSECDOI_ESP_3IDEA:
-	case IPSECDOI_ESP_RC4:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"not support transform-id=%u in ESP.\n", t_id);
-		return -1;
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid transform-id=%u in ESP.\n", t_id);
-		return -1;
-	}
-	/* NOT REACHED */
-}
-
-/*
- * check transform ID in IPCOMP.
- */
-static int
-check_trns_ipcomp(t_id)
-	int t_id;
-{
-	switch (t_id) {
-	case IPSECDOI_IPCOMP_OUI:
-	case IPSECDOI_IPCOMP_DEFLATE:
-	case IPSECDOI_IPCOMP_LZS:
-		return 0;
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid transform-id=%u in IPCOMP.\n", t_id);
-		return -1;
-	}
-	/* NOT REACHED */
-}
-
-/*
- * check data attributes in IKE.
- */
-static int
-check_attr_isakmp(trns)
-	struct isakmp_pl_t *trns;
-{
-	struct isakmp_data *d;
-	int tlen;
-	int flag, type;
-	u_int16_t lorv;
-
-	tlen = ntohs(trns->h.len) - sizeof(struct isakmp_pl_t);
-	d = (struct isakmp_data *)((caddr_t)trns + sizeof(struct isakmp_pl_t));
-
-	while (tlen > 0) {
-		type = ntohs(d->type) & ~ISAKMP_GEN_MASK;
-		flag = ntohs(d->type) & ISAKMP_GEN_MASK;
-		lorv = ntohs(d->lorv);
-
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"type=%s, flag=0x%04x, lorv=%s\n",
-			s_oakley_attr(type), flag,
-			s_oakley_attr_v(type, lorv));
-
-		/*
-		 * some of the attributes must be encoded in TV.
-		 * see RFC2409 Appendix A "Attribute Classes".
-		 */
-		switch (type) {
-		case OAKLEY_ATTR_ENC_ALG:
-		case OAKLEY_ATTR_HASH_ALG:
-		case OAKLEY_ATTR_AUTH_METHOD:
-		case OAKLEY_ATTR_GRP_DESC:
-		case OAKLEY_ATTR_GRP_TYPE:
-		case OAKLEY_ATTR_SA_LD_TYPE:
-		case OAKLEY_ATTR_PRF:
-		case OAKLEY_ATTR_KEY_LEN:
-		case OAKLEY_ATTR_FIELD_SIZE:
-			if (!flag) {	/* TLV*/
-				plog(LLV_ERROR, LOCATION, NULL,
-					"oakley attribute %d must be TV.\n",
-					type);
-				return -1;
-			}
-			break;
-		}
-
-		/* sanity check for TLV.  length must be specified. */
-		if (!flag && lorv == 0) {	/*TLV*/
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid length %d for TLV attribute %d.\n",
-				lorv, type);
-			return -1;
-		}
-
-		switch (type) {
-		case OAKLEY_ATTR_ENC_ALG:
-			if (!alg_oakley_encdef_ok(lorv)) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"invalied encryption algorithm=%d.\n",
-					lorv);
-				return -1;
-			}
-			break;
-
-		case OAKLEY_ATTR_HASH_ALG:
-			if (!alg_oakley_hashdef_ok(lorv)) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"invalied hash algorithm=%d.\n",
-					lorv);
-				return -1;
-			}
-			break;
-
-		case OAKLEY_ATTR_AUTH_METHOD:
-			switch (lorv) {
-			case OAKLEY_ATTR_AUTH_METHOD_PSKEY:
-			case OAKLEY_ATTR_AUTH_METHOD_RSASIG:
-#ifdef ENABLE_HYBRID
-			case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
-			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I:
-#if 0 /* Clashes with OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB */
-			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I:
-#endif
-#endif
-			case OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB:
-				break;
-			case OAKLEY_ATTR_AUTH_METHOD_DSSSIG:
-#ifdef ENABLE_HYBRID
-			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
-			case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R:
-			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R:
-			case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
-			case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R:
-			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I:
-			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R:
-			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_I:
-			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_R:
-			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_I:
-			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_R:
-#endif
-			case OAKLEY_ATTR_AUTH_METHOD_RSAENC:
-			case OAKLEY_ATTR_AUTH_METHOD_RSAREV:
-				plog(LLV_ERROR, LOCATION, NULL,
-					"auth method %s isn't supported.\n",
-					s_oakley_attr_method(lorv));
-				return -1;
-			default:
-				plog(LLV_ERROR, LOCATION, NULL,
-					"invalid auth method %d.\n",
-					lorv);
-				return -1;
-			}
-			break;
-
-		case OAKLEY_ATTR_GRP_DESC:
-			if (!alg_oakley_dhdef_ok(lorv)) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"invalid DH group %d.\n",
-					lorv);
-				return -1;
-			}
-			break;
-
-		case OAKLEY_ATTR_GRP_TYPE:
-			switch (lorv) {
-			case OAKLEY_ATTR_GRP_TYPE_MODP:
-				break;
-			default:
-				plog(LLV_ERROR, LOCATION, NULL,
-					"unsupported DH group type %d.\n",
-					lorv);
-				return -1;
-			}
-			break;
-
-		case OAKLEY_ATTR_GRP_PI:
-		case OAKLEY_ATTR_GRP_GEN_ONE:
-			/* sanity checks? */
-			break;
-
-		case OAKLEY_ATTR_GRP_GEN_TWO:
-		case OAKLEY_ATTR_GRP_CURVE_A:
-		case OAKLEY_ATTR_GRP_CURVE_B:
-			plog(LLV_ERROR, LOCATION, NULL,
-				"attr type=%u isn't supported.\n", type);
-			return -1;
-
-		case OAKLEY_ATTR_SA_LD_TYPE:
-			switch (lorv) {
-			case OAKLEY_ATTR_SA_LD_TYPE_SEC:
-			case OAKLEY_ATTR_SA_LD_TYPE_KB:
-				break;
-			default:
-				plog(LLV_ERROR, LOCATION, NULL,
-					"invalid life type %d.\n", lorv);
-				return -1;
-			}
-			break;
-
-		case OAKLEY_ATTR_SA_LD:
-			/* should check the value */
-			break;
-
-		case OAKLEY_ATTR_PRF:
-		case OAKLEY_ATTR_KEY_LEN:
-			break;
-
-		case OAKLEY_ATTR_FIELD_SIZE:
-			plog(LLV_ERROR, LOCATION, NULL,
-				"attr type=%u isn't supported.\n", type);
-			return -1;
-
-		case OAKLEY_ATTR_GRP_ORDER:
-			break;
-
-		case OAKLEY_ATTR_GSS_ID:
-			break;
-
-		default:
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid attribute type %d.\n", type);
-			return -1;
-		}
-
-		if (flag) {
-			tlen -= sizeof(*d);
-			d = (struct isakmp_data *)((char *)d
-				+ sizeof(*d));
-		} else {
-			tlen -= (sizeof(*d) + lorv);
-			d = (struct isakmp_data *)((char *)d
-				+ sizeof(*d) + lorv);
-		}
-	}
-
-	return 0;
-}
-
-/*
- * check data attributes in IPSEC AH/ESP.
- */
-static int
-check_attr_ah(trns)
-	struct isakmp_pl_t *trns;
-{
-	return check_attr_ipsec(IPSECDOI_PROTO_IPSEC_AH, trns);
-}
-
-static int
-check_attr_esp(trns)
-	struct isakmp_pl_t *trns;
-{
-	return check_attr_ipsec(IPSECDOI_PROTO_IPSEC_ESP, trns);
-}
-
-static int
-check_attr_ipsec(proto_id, trns)
-	int proto_id;
-	struct isakmp_pl_t *trns;
-{
-	struct isakmp_data *d;
-	int tlen;
-	int flag, type = 0;
-	u_int16_t lorv;
-	int attrseen[16];	/* XXX magic number */
-
-	tlen = ntohs(trns->h.len) - sizeof(struct isakmp_pl_t);
-	d = (struct isakmp_data *)((caddr_t)trns + sizeof(struct isakmp_pl_t));
-	memset(attrseen, 0, sizeof(attrseen));
-
-	while (tlen > 0) {
-		type = ntohs(d->type) & ~ISAKMP_GEN_MASK;
-		flag = ntohs(d->type) & ISAKMP_GEN_MASK;
-		lorv = ntohs(d->lorv);
-
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"type=%s, flag=0x%04x, lorv=%s\n",
-			s_ipsecdoi_attr(type), flag,
-			s_ipsecdoi_attr_v(type, lorv));
-
-		if (type < sizeof(attrseen)/sizeof(attrseen[0]))
-			attrseen[type]++;
-
-		switch (type) {
-		case IPSECDOI_ATTR_ENC_MODE:
-			if (! flag) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"must be TV when ENC_MODE.\n");
-				return -1;
-			}
-
-			switch (lorv) {
-			case IPSECDOI_ATTR_ENC_MODE_TUNNEL:
-			case IPSECDOI_ATTR_ENC_MODE_TRNS:
-				break;
-#ifdef ENABLE_NATT
-			case IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC:
-			case IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC:
-			case IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_DRAFT:
-			case IPSECDOI_ATTR_ENC_MODE_UDPTRNS_DRAFT:
-				plog(LLV_DEBUG, LOCATION, NULL,
-				     "UDP encapsulation requested\n");
-				break;
-#endif
-			default:
-				plog(LLV_ERROR, LOCATION, NULL,
-					"invalid encryption mode=%u.\n",
-					lorv);
-				return -1;
-			}
-			break;
-
-		case IPSECDOI_ATTR_AUTH:
-			if (! flag) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"must be TV when AUTH.\n");
-				return -1;
-			}
-
-			switch (lorv) {
-			case IPSECDOI_ATTR_AUTH_HMAC_MD5:
-				if (proto_id == IPSECDOI_PROTO_IPSEC_AH &&
-				    trns->t_id != IPSECDOI_AH_MD5) {
-ahmismatch:
-					plog(LLV_ERROR, LOCATION, NULL,
-						"auth algorithm %u conflicts "
-						"with transform %u.\n",
-						lorv, trns->t_id);
-					return -1;
-				}
-				break;
-			case IPSECDOI_ATTR_AUTH_HMAC_SHA1:
-				if (proto_id == IPSECDOI_PROTO_IPSEC_AH) {
-					if (trns->t_id != IPSECDOI_AH_SHA)
-						goto ahmismatch;
-				}
-				break;
- 			case IPSECDOI_ATTR_AUTH_HMAC_SHA2_256:
- 				if (proto_id == IPSECDOI_PROTO_IPSEC_AH) {
- 					if (trns->t_id != IPSECDOI_AH_SHA256)
- 						goto ahmismatch;
- 				}	
- 				break;
- 			case IPSECDOI_ATTR_AUTH_HMAC_SHA2_384:
- 				if (proto_id == IPSECDOI_PROTO_IPSEC_AH) {
- 					if (trns->t_id != IPSECDOI_AH_SHA384)
- 						goto ahmismatch;
- 				}
- 				break;
- 			case IPSECDOI_ATTR_AUTH_HMAC_SHA2_512:
- 				if (proto_id == IPSECDOI_PROTO_IPSEC_AH) {
- 					if (trns->t_id != IPSECDOI_AH_SHA512)
- 					goto ahmismatch;
- 				}
- 				break;
-			case IPSECDOI_ATTR_AUTH_DES_MAC:
-			case IPSECDOI_ATTR_AUTH_KPDK:
-				plog(LLV_ERROR, LOCATION, NULL,
-					"auth algorithm %u isn't supported.\n",
-					lorv);
-				return -1;
-			default:
-				plog(LLV_ERROR, LOCATION, NULL,
-					"invalid auth algorithm=%u.\n",
-					lorv);
-				return -1;
-			}
-			break;
-
-		case IPSECDOI_ATTR_SA_LD_TYPE:
-			if (! flag) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"must be TV when LD_TYPE.\n");
-				return -1;
-			}
-
-			switch (lorv) {
-			case IPSECDOI_ATTR_SA_LD_TYPE_SEC:
-			case IPSECDOI_ATTR_SA_LD_TYPE_KB:
-				break;
-			default:
-				plog(LLV_ERROR, LOCATION, NULL,
-					"invalid life type %d.\n", lorv);
-				return -1;
-			}
-			break;
-
-		case IPSECDOI_ATTR_SA_LD:
-			if (flag) {
-				/* i.e. ISAKMP_GEN_TV */
-				plog(LLV_DEBUG, LOCATION, NULL,
-					"life duration was in TLV.\n");
-			} else {
-				/* i.e. ISAKMP_GEN_TLV */
-				if (lorv == 0) {
-					plog(LLV_ERROR, LOCATION, NULL,
-						"invalid length of LD\n");
-					return -1;
-				}
-			}
-			break;
-
-		case IPSECDOI_ATTR_GRP_DESC:
-			if (! flag) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"must be TV when GRP_DESC.\n");
-				return -1;
-			}
-
-			if (!alg_oakley_dhdef_ok(lorv)) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"invalid group description=%u.\n",
-					lorv);
-				return -1;
-			}
-			break;
-
-		case IPSECDOI_ATTR_KEY_LENGTH:
-			if (! flag) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"must be TV when KEY_LENGTH.\n");
-				return -1;
-			}
-			break;
-
-#ifdef HAVE_SECCTX
-		case IPSECDOI_ATTR_SECCTX:
-			if (flag) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"SECCTX must be in TLV.\n");
-				return -1;
-			}
-		break;
-#endif
-
-		case IPSECDOI_ATTR_KEY_ROUNDS:
-		case IPSECDOI_ATTR_COMP_DICT_SIZE:
-		case IPSECDOI_ATTR_COMP_PRIVALG:
-			plog(LLV_ERROR, LOCATION, NULL,
-				"attr type=%u isn't supported.\n", type);
-			return -1;
-
-		default:
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid attribute type %d.\n", type);
-			return -1;
-		}
-
-		if (flag) {
-			tlen -= sizeof(*d);
-			d = (struct isakmp_data *)((char *)d
-				+ sizeof(*d));
-		} else {
-			tlen -= (sizeof(*d) + lorv);
-			d = (struct isakmp_data *)((caddr_t)d
-				+ sizeof(*d) + lorv);
-		}
-	}
-
-	if (proto_id == IPSECDOI_PROTO_IPSEC_AH &&
-	    !attrseen[IPSECDOI_ATTR_AUTH]) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"attr AUTH must be present for AH.\n");
-		return -1;
-	}
-
-	if (proto_id == IPSECDOI_PROTO_IPSEC_ESP &&
-	    trns->t_id == IPSECDOI_ESP_NULL &&
-	    !attrseen[IPSECDOI_ATTR_AUTH]) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "attr AUTH must be present for ESP NULL encryption.\n");
-		return -1;
-	}
-
-	return 0;
-}
-
-static int
-check_attr_ipcomp(trns)
-	struct isakmp_pl_t *trns;
-{
-	struct isakmp_data *d;
-	int tlen;
-	int flag, type = 0;
-	u_int16_t lorv;
-	int attrseen[16];	/* XXX magic number */
-
-	tlen = ntohs(trns->h.len) - sizeof(struct isakmp_pl_t);
-	d = (struct isakmp_data *)((caddr_t)trns + sizeof(struct isakmp_pl_t));
-	memset(attrseen, 0, sizeof(attrseen));
-
-	while (tlen > 0) {
-		type = ntohs(d->type) & ~ISAKMP_GEN_MASK;
-		flag = ntohs(d->type) & ISAKMP_GEN_MASK;
-		lorv = ntohs(d->lorv);
-
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"type=%d, flag=0x%04x, lorv=0x%04x\n",
-			type, flag, lorv);
-
-		if (type < sizeof(attrseen)/sizeof(attrseen[0]))
-			attrseen[type]++;
-
-		switch (type) {
-		case IPSECDOI_ATTR_ENC_MODE:
-			if (! flag) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"must be TV when ENC_MODE.\n");
-				return -1;
-			}
-
-			switch (lorv) {
-			case IPSECDOI_ATTR_ENC_MODE_TUNNEL:
-			case IPSECDOI_ATTR_ENC_MODE_TRNS:
-				break;
-#ifdef ENABLE_NATT
-			case IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC:
-			case IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC:
-			case IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_DRAFT:
-			case IPSECDOI_ATTR_ENC_MODE_UDPTRNS_DRAFT:
-				plog(LLV_DEBUG, LOCATION, NULL,
-				     "UDP encapsulation requested\n");
-				break;
-#endif
-			default:
-				plog(LLV_ERROR, LOCATION, NULL,
-					"invalid encryption mode=%u.\n",
-					lorv);
-				return -1;
-			}
-			break;
-
-		case IPSECDOI_ATTR_SA_LD_TYPE:
-			if (! flag) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"must be TV when LD_TYPE.\n");
-				return -1;
-			}
-
-			switch (lorv) {
-			case IPSECDOI_ATTR_SA_LD_TYPE_SEC:
-			case IPSECDOI_ATTR_SA_LD_TYPE_KB:
-				break;
-			default:
-				plog(LLV_ERROR, LOCATION, NULL,
-					"invalid life type %d.\n", lorv);
-				return -1;
-			}
-			break;
-
-		case IPSECDOI_ATTR_SA_LD:
-			if (flag) {
-				/* i.e. ISAKMP_GEN_TV */
-				plog(LLV_DEBUG, LOCATION, NULL,
-					"life duration was in TLV.\n");
-			} else {
-				/* i.e. ISAKMP_GEN_TLV */
-				if (lorv == 0) {
-					plog(LLV_ERROR, LOCATION, NULL,
-						"invalid length of LD\n");
-					return -1;
-				}
-			}
-			break;
-
-		case IPSECDOI_ATTR_GRP_DESC:
-			if (! flag) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"must be TV when GRP_DESC.\n");
-				return -1;
-			}
-
-			if (!alg_oakley_dhdef_ok(lorv)) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"invalid group description=%u.\n",
-					lorv);
-				return -1;
-			}
-			break;
-
-		case IPSECDOI_ATTR_AUTH:
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid attr type=%u.\n", type);
-			return -1;
-
-		case IPSECDOI_ATTR_KEY_LENGTH:
-		case IPSECDOI_ATTR_KEY_ROUNDS:
-		case IPSECDOI_ATTR_COMP_DICT_SIZE:
-		case IPSECDOI_ATTR_COMP_PRIVALG:
-			plog(LLV_ERROR, LOCATION, NULL,
-				"attr type=%u isn't supported.\n", type);
-			return -1;
-
-		default:
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid attribute type %d.\n", type);
-			return -1;
-		}
-
-		if (flag) {
-			tlen -= sizeof(*d);
-			d = (struct isakmp_data *)((char *)d
-				+ sizeof(*d));
-		} else {
-			tlen -= (sizeof(*d) + lorv);
-			d = (struct isakmp_data *)((caddr_t)d
-				+ sizeof(*d) + lorv);
-		}
-	}
-
-#if 0
-	if (proto_id == IPSECDOI_PROTO_IPCOMP &&
-	    !attrseen[IPSECDOI_ATTR_AUTH]) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"attr AUTH must be present for AH.\n", type);
-		return -1;
-	}
-#endif
-
-	return 0;
-}
-
-/* %%% */
-/*
- * create phase1 proposal from remote configuration.
- * NOT INCLUDING isakmp general header of SA payload
- */
-vchar_t *
-ipsecdoi_setph1proposal(props)
-	struct isakmpsa *props;
-{
-	vchar_t *mysa;
-	int sablen;
-
-	/* count total size of SA minus isakmp general header */
-	/* not including isakmp general header of SA payload */
-	sablen = sizeof(struct ipsecdoi_sa_b);
-	sablen += setph1prop(props, NULL);
-
-	mysa = vmalloc(sablen);
-	if (mysa == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to allocate my sa buffer\n");
-		return NULL;
-	}
-
-	/* create SA payload */
-	/* not including isakmp general header */
-	((struct ipsecdoi_sa_b *)mysa->v)->doi = htonl(props->rmconf->doitype);
-	((struct ipsecdoi_sa_b *)mysa->v)->sit = htonl(props->rmconf->sittype);
-
-	(void)setph1prop(props, mysa->v + sizeof(struct ipsecdoi_sa_b));
-
-	return mysa;
-}
-
-static int
-setph1prop(props, buf)
-	struct isakmpsa *props;
-	caddr_t buf;
-{
-	struct isakmp_pl_p *prop = NULL;
-	struct isakmpsa *s = NULL;
-	int proplen, trnslen;
-	u_int8_t *np_t; /* pointer next trns type in previous header */
-	int trns_num;
-	caddr_t p = buf;
-
-	proplen = sizeof(*prop);
-	if (buf) {
-		/* create proposal */
-		prop = (struct isakmp_pl_p *)p;
-		prop->h.np = ISAKMP_NPTYPE_NONE;
-		prop->p_no = props->prop_no;
-		prop->proto_id = IPSECDOI_PROTO_ISAKMP;
-		prop->spi_size = 0;
-		p += sizeof(*prop);
-	}
-
-	np_t = NULL;
-	trns_num = 0;
-
-	for (s = props; s != NULL; s = s->next) {
-		if (np_t)
-			*np_t = ISAKMP_NPTYPE_T;
-
-		trnslen = setph1trns(s, p);
-		proplen += trnslen;
-		if (buf) {
-			/* save buffer to pre-next payload */
-			np_t = &((struct isakmp_pl_t *)p)->h.np;
-			p += trnslen;
-
-			/* count up transform length */
-			trns_num++;
-		}
-	}
-
-	/* update proposal length */
-	if (buf) {
-		prop->h.len = htons(proplen);
-		prop->num_t = trns_num;
-	}
-
-	return proplen;
-}
-
-static int
-setph1trns(sa, buf)
-	struct isakmpsa *sa;
-	caddr_t buf;
-{
-	struct isakmp_pl_t *trns = NULL;
-	int trnslen, attrlen;
-	caddr_t p = buf;
-
-	trnslen = sizeof(*trns);
-	if (buf) {
-		/* create transform */
-		trns = (struct isakmp_pl_t *)p;
-		trns->h.np  = ISAKMP_NPTYPE_NONE;
-		trns->t_no  = sa->trns_no;
-		trns->t_id  = IPSECDOI_KEY_IKE;
-		p += sizeof(*trns);
-	}
-
-	attrlen = setph1attr(sa, p);
-	trnslen += attrlen;
-	if (buf)
-		p += attrlen;
-
-	if (buf)
-		trns->h.len = htons(trnslen);
-
-	return trnslen;
-}
-
-static int
-setph1attr(sa, buf)
-	struct isakmpsa *sa;
-	caddr_t buf;
-{
-	caddr_t p = buf;
-	int attrlen = 0;
-
-	if (sa->lifetime) {
-		u_int32_t lifetime = htonl((u_int32_t)sa->lifetime);
-
-		attrlen += sizeof(struct isakmp_data)
-			+ sizeof(struct isakmp_data);
-		if (sa->lifetime > 0xffff)
-			attrlen += sizeof(lifetime);
-		if (buf) {
-			p = isakmp_set_attr_l(p, OAKLEY_ATTR_SA_LD_TYPE,
-						OAKLEY_ATTR_SA_LD_TYPE_SEC);
-			if (sa->lifetime > 0xffff) {
-				p = isakmp_set_attr_v(p, OAKLEY_ATTR_SA_LD,
-						(caddr_t)&lifetime, 
-						sizeof(lifetime));
-			} else {
-				p = isakmp_set_attr_l(p, OAKLEY_ATTR_SA_LD,
-							sa->lifetime);
-			}
-		}
-	}
-
-	if (sa->lifebyte) {
-		u_int32_t lifebyte = htonl((u_int32_t)sa->lifebyte);
-		
-		attrlen += sizeof(struct isakmp_data)
-			+ sizeof(struct isakmp_data);
-		if (sa->lifebyte > 0xffff)
-			attrlen += sizeof(lifebyte);
-		if (buf) {
-			p = isakmp_set_attr_l(p, OAKLEY_ATTR_SA_LD_TYPE,
-						OAKLEY_ATTR_SA_LD_TYPE_KB);
-			if (sa->lifebyte > 0xffff) {
-				p = isakmp_set_attr_v(p, OAKLEY_ATTR_SA_LD,
-							(caddr_t)&lifebyte,
-							sizeof(lifebyte));
-			} else {
-				p = isakmp_set_attr_l(p, OAKLEY_ATTR_SA_LD,
-							sa->lifebyte);
-			}
-		}
-	}
-
-	if (sa->enctype) {
-		attrlen += sizeof(struct isakmp_data);
-		if (buf)
-			p = isakmp_set_attr_l(p, OAKLEY_ATTR_ENC_ALG, sa->enctype);
-	}
-	if (sa->encklen) {
-		attrlen += sizeof(struct isakmp_data);
-		if (buf)
-			p = isakmp_set_attr_l(p, OAKLEY_ATTR_KEY_LEN, sa->encklen);
-	}
-	if (sa->authmethod) {
-		int authmethod;
-
-#ifdef ENABLE_HYBRID
-		authmethod = switch_authmethod(sa->authmethod);
-#else
-		authmethod = sa->authmethod;
-#endif
-		attrlen += sizeof(struct isakmp_data);
-		if (buf)
-			p = isakmp_set_attr_l(p, OAKLEY_ATTR_AUTH_METHOD, authmethod);
-	}
-	if (sa->hashtype) {
-		attrlen += sizeof(struct isakmp_data);
-		if (buf)
-			p = isakmp_set_attr_l(p, OAKLEY_ATTR_HASH_ALG, sa->hashtype);
-	}
-	switch (sa->dh_group) {
-	case OAKLEY_ATTR_GRP_DESC_MODP768:
-	case OAKLEY_ATTR_GRP_DESC_MODP1024:
-	case OAKLEY_ATTR_GRP_DESC_MODP1536:
-	case OAKLEY_ATTR_GRP_DESC_MODP2048:
-	case OAKLEY_ATTR_GRP_DESC_MODP3072:
-	case OAKLEY_ATTR_GRP_DESC_MODP4096:
-	case OAKLEY_ATTR_GRP_DESC_MODP6144:
-	case OAKLEY_ATTR_GRP_DESC_MODP8192:
-		/* don't attach group type for known groups */
-		attrlen += sizeof(struct isakmp_data);
-		if (buf) {
-			p = isakmp_set_attr_l(p, OAKLEY_ATTR_GRP_DESC,
-				sa->dh_group);
-		}
-		break;
-	case OAKLEY_ATTR_GRP_DESC_EC2N155:
-	case OAKLEY_ATTR_GRP_DESC_EC2N185:
-		/* don't attach group type for known groups */
-		attrlen += sizeof(struct isakmp_data);
-		if (buf) {
-			p = isakmp_set_attr_l(p, OAKLEY_ATTR_GRP_TYPE,
-				OAKLEY_ATTR_GRP_TYPE_EC2N);
-		}
-		break;
-	case 0:
-	default:
-		break;
-	}
-
-#ifdef HAVE_GSSAPI
-	if (sa->authmethod == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB &&
-	    sa->gssid != NULL) {
-		attrlen += sizeof(struct isakmp_data);
-		/*
-		 * Older versions of racoon just placed the ISO-Latin-1
-		 * string on the wire directly.  Check to see if we are
-		 * configured to be compatible with this behavior.  Otherwise,
-		 * we encode the GSS ID as UTF-16LE for Windows 2000
-		 * compatibility, which requires twice the number of octets.
-		 */
-		if (lcconf->gss_id_enc == LC_GSSENC_LATIN1)
-			attrlen += sa->gssid->l;
-		else
-			attrlen += sa->gssid->l * 2;
-		if (buf) {
-			plog(LLV_DEBUG, LOCATION, NULL, "gss id attr: len %zu, "
-			    "val '%.*s'\n", sa->gssid->l, (int)sa->gssid->l,
-			    sa->gssid->v);
-			if (lcconf->gss_id_enc == LC_GSSENC_LATIN1) {
-				p = isakmp_set_attr_v(p, OAKLEY_ATTR_GSS_ID,
-					(caddr_t)sa->gssid->v,
-					sa->gssid->l);
-			} else {
-				size_t dstleft = sa->gssid->l * 2;
-				size_t srcleft = sa->gssid->l;
-				const char *src = (const char *)sa->gssid->v;
-				char *odst, *dst = racoon_malloc(dstleft);
-				iconv_t cd;
-				size_t rv;
-
-				cd = iconv_open("utf-16le", "latin1");
-				if (cd == (iconv_t) -1) {
-					plog(LLV_ERROR, LOCATION, NULL,
-					    "unable to initialize "
-					    "latin1 -> utf-16le "
-					    "converstion descriptor: %s\n",
-					    strerror(errno));
-					attrlen -= sa->gssid->l * 2;
-					goto gssid_done;
-				}
-				odst = dst;
-				rv = iconv(cd, (__iconv_const char **)&src, 
-				    &srcleft, &dst, &dstleft);
-				if (rv != 0) {
-					if (rv == -1) {
-						plog(LLV_ERROR, LOCATION, NULL,
-						    "unable to convert GSS ID "
-						    "from latin1 -> utf-16le: "
-						    "%s\n", strerror(errno));
-					} else {
-						/* should never happen */
-						plog(LLV_ERROR, LOCATION, NULL,
-						    "%zd character%s in GSS ID "
-						    "cannot be represented "
-						    "in utf-16le\n",
-						    rv, rv == 1 ? "" : "s");
-					}
-					(void) iconv_close(cd);
-					attrlen -= sa->gssid->l * 2;
-					goto gssid_done;
-				}
-				(void) iconv_close(cd);
-
-				/* XXX Check srcleft and dstleft? */
-
-				p = isakmp_set_attr_v(p, OAKLEY_ATTR_GSS_ID,
-					odst, sa->gssid->l * 2);
-
-				racoon_free(odst);
-			}
-		}
-	}
- gssid_done:
-#endif /* HAVE_GSSAPI */
-
-	return attrlen;
-}
-
-static vchar_t *
-setph2proposal0(iph2, pp, pr)
-	const struct ph2handle *iph2;
-	const struct saprop *pp;
-	const struct saproto *pr;
-{
-	vchar_t *p;
-	struct isakmp_pl_p *prop;
-	struct isakmp_pl_t *trns;
-	struct satrns *tr;
-	int attrlen;
-	size_t trnsoff;
-	caddr_t x0, x;
-	u_int8_t *np_t; /* pointer next trns type in previous header */
-	const u_int8_t *spi;
-#ifdef HAVE_SECCTX
-	int truectxlen = 0;
-#endif
-
-	p = vmalloc(sizeof(*prop) + sizeof(pr->spi));
-	if (p == NULL)
-		return NULL;
-
-	/* create proposal */
-	prop = (struct isakmp_pl_p *)p->v;
-	prop->h.np = ISAKMP_NPTYPE_NONE;
-	prop->p_no = pp->prop_no;
-	prop->proto_id = pr->proto_id;
-	prop->num_t = 1;
-
-	spi = (const u_int8_t *)&pr->spi;
-	switch (pr->proto_id) {
-	case IPSECDOI_PROTO_IPCOMP:
-		/*
-		 * draft-shacham-ippcp-rfc2393bis-05.txt:
-		 * construct 16bit SPI (CPI).
-		 * XXX we may need to provide a configuration option to
-		 * generate 32bit SPI.  otherwise we cannot interoeprate
-		 * with nodes that uses 32bit SPI, in case we are initiator.
-		 */
-		prop->spi_size = sizeof(u_int16_t);
-		spi += sizeof(pr->spi) - sizeof(u_int16_t);
-		p->l -= sizeof(pr->spi);
-		p->l += sizeof(u_int16_t);
-		break;
-	default:
-		prop->spi_size = sizeof(pr->spi);
-		break;
-	}
-	memcpy(prop + 1, spi, prop->spi_size);
-
-	/* create transform */
-	trnsoff = sizeof(*prop) + prop->spi_size;
-	np_t = NULL;
-
-	for (tr = pr->head; tr; tr = tr->next) {
-	
-		switch (pr->proto_id) {
-		case IPSECDOI_PROTO_IPSEC_ESP:
-			/*
-			 * don't build a null encryption
-			 * with no authentication transform.
-			 */
-			if (tr->trns_id == IPSECDOI_ESP_NULL &&
-			    tr->authtype == IPSECDOI_ATTR_AUTH_NONE)
-				continue;
-			break;
-		}
-
-		if (np_t) {
-			*np_t = ISAKMP_NPTYPE_T;
-			prop->num_t++;
-		}
-
-		/* get attribute length */
-		attrlen = 0;
-		if (pp->lifetime) {
-			attrlen += sizeof(struct isakmp_data)
-				+ sizeof(struct isakmp_data);
-			if (pp->lifetime > 0xffff)
-				attrlen += sizeof(u_int32_t);
-		}
-		if (pp->lifebyte && pp->lifebyte != IPSECDOI_ATTR_SA_LD_KB_MAX) {
-			attrlen += sizeof(struct isakmp_data)
-				+ sizeof(struct isakmp_data);
-			if (pp->lifebyte > 0xffff)
-				attrlen += sizeof(u_int32_t);
-		}
-		attrlen += sizeof(struct isakmp_data);	/* enc mode */
-		if (tr->encklen)
-			attrlen += sizeof(struct isakmp_data);
-
-		switch (pr->proto_id) {
-		case IPSECDOI_PROTO_IPSEC_ESP:
-			/* non authentication mode ? */
-			if (tr->authtype != IPSECDOI_ATTR_AUTH_NONE)
-				attrlen += sizeof(struct isakmp_data);
-			break;
-		case IPSECDOI_PROTO_IPSEC_AH:
-			if (tr->authtype == IPSECDOI_ATTR_AUTH_NONE) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"no authentication algorithm found "
-					"but protocol is AH.\n");
-				vfree(p);
-				return NULL;
-			}
-			attrlen += sizeof(struct isakmp_data);
-			break;
-		case IPSECDOI_PROTO_IPCOMP:
-			break;
-		default:
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid protocol: %d\n", pr->proto_id);
-			vfree(p);
-			return NULL;
-		}
-
-		if (alg_oakley_dhdef_ok(iph2->sainfo->pfs_group))
-			attrlen += sizeof(struct isakmp_data);
-
-#ifdef HAVE_SECCTX
-		/* ctx_str is defined as char ctx_str[MAX_CTXSTR_SIZ].
-		 * The string may be smaller than MAX_CTXSTR_SIZ.
-		 */
-		if (*pp->sctx.ctx_str) {
-			truectxlen = sizeof(struct security_ctx) -
-				     (MAX_CTXSTR_SIZE - pp->sctx.ctx_strlen);
-			attrlen += sizeof(struct isakmp_data) + truectxlen;
-		}
-#endif /* HAVE_SECCTX */
-
-		p = vrealloc(p, p->l + sizeof(*trns) + attrlen);
-		if (p == NULL)
-			return NULL;
-		prop = (struct isakmp_pl_p *)p->v;
-
-		/* set transform's values */
-		trns = (struct isakmp_pl_t *)(p->v + trnsoff);
-		trns->h.np  = ISAKMP_NPTYPE_NONE;
-		trns->t_no  = tr->trns_no;
-		trns->t_id  = tr->trns_id;
-
-		/* set attributes */
-		x = x0 = p->v + trnsoff + sizeof(*trns);
-
-		if (pp->lifetime) {
-			x = isakmp_set_attr_l(x, IPSECDOI_ATTR_SA_LD_TYPE,
-						IPSECDOI_ATTR_SA_LD_TYPE_SEC);
-			if (pp->lifetime > 0xffff) {
-				u_int32_t v = htonl((u_int32_t)pp->lifetime);
-				x = isakmp_set_attr_v(x, IPSECDOI_ATTR_SA_LD,
-							(caddr_t)&v, sizeof(v));
-			} else {
-				x = isakmp_set_attr_l(x, IPSECDOI_ATTR_SA_LD,
-							pp->lifetime);
-			}
-		}
-
-		if (pp->lifebyte && pp->lifebyte != IPSECDOI_ATTR_SA_LD_KB_MAX) {
-			x = isakmp_set_attr_l(x, IPSECDOI_ATTR_SA_LD_TYPE,
-						IPSECDOI_ATTR_SA_LD_TYPE_KB);
-			if (pp->lifebyte > 0xffff) {
-				u_int32_t v = htonl((u_int32_t)pp->lifebyte);
-				x = isakmp_set_attr_v(x, IPSECDOI_ATTR_SA_LD,
-							(caddr_t)&v, sizeof(v));
-			} else {
-				x = isakmp_set_attr_l(x, IPSECDOI_ATTR_SA_LD,
-							pp->lifebyte);
-			}
-		}
-
-		x = isakmp_set_attr_l(x, IPSECDOI_ATTR_ENC_MODE, pr->encmode);
-
-		if (tr->encklen)
-			x = isakmp_set_attr_l(x, IPSECDOI_ATTR_KEY_LENGTH, tr->encklen);
-
-		/* mandatory check has done above. */
-		if ((pr->proto_id == IPSECDOI_PROTO_IPSEC_ESP && tr->authtype != IPSECDOI_ATTR_AUTH_NONE)
-		 || pr->proto_id == IPSECDOI_PROTO_IPSEC_AH)
-			x = isakmp_set_attr_l(x, IPSECDOI_ATTR_AUTH, tr->authtype);
-
-		if (alg_oakley_dhdef_ok(iph2->sainfo->pfs_group))
-			x = isakmp_set_attr_l(x, IPSECDOI_ATTR_GRP_DESC,
-				iph2->sainfo->pfs_group);
-
-#ifdef HAVE_SECCTX
-		if (*pp->sctx.ctx_str) {
-			struct security_ctx secctx;
-			secctx = pp->sctx;
-			secctx.ctx_strlen = htons(pp->sctx.ctx_strlen);
-			x = isakmp_set_attr_v(x, IPSECDOI_ATTR_SECCTX,
-					     (caddr_t)&secctx, truectxlen);
-		}
-#endif
-		/* update length of this transform. */
-		trns = (struct isakmp_pl_t *)(p->v + trnsoff);
-		trns->h.len = htons(sizeof(*trns) + attrlen);
-
-		/* save buffer to pre-next payload */
-		np_t = &trns->h.np;
-
-		trnsoff += (sizeof(*trns) + attrlen);
-	}
-
-	if (np_t == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"no suitable proposal was created.\n");
-		return NULL;
-	}
-
-	/* update length of this protocol. */
-	prop->h.len = htons(p->l);
-
-	return p;
-}
-
-/*
- * create phase2 proposal from policy configuration.
- * NOT INCLUDING isakmp general header of SA payload.
- * This function is called by initiator only.
- */
-int
-ipsecdoi_setph2proposal(iph2)
-	struct ph2handle *iph2;
-{
-	struct saprop *proposal, *a;
-	struct saproto *b = NULL;
-	vchar_t *q;
-	struct ipsecdoi_sa_b *sab;
-	struct isakmp_pl_p *prop;
-	size_t propoff;	/* for previous field of type of next payload. */
-
-	proposal = iph2->proposal;
-
-	iph2->sa = vmalloc(sizeof(*sab));
-	if (iph2->sa == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to allocate my sa buffer\n");
-		return -1;
-	}
-
-	/* create SA payload */
-	sab = (struct ipsecdoi_sa_b *)iph2->sa->v;
-	sab->doi = htonl(IPSEC_DOI);
-	sab->sit = htonl(IPSECDOI_SIT_IDENTITY_ONLY);	/* XXX configurable ? */
-
-	prop = NULL;
-	propoff = 0;
-	for (a = proposal; a; a = a->next) {
-		for (b = a->head; b; b = b->next) {
-#ifdef ENABLE_NATT
-			if (iph2->ph1->natt_flags & NAT_DETECTED) {
-			  int udp_diff = iph2->ph1->natt_options->mode_udp_diff;
-			  plog (LLV_INFO, LOCATION, NULL,
-				"NAT detected -> UDP encapsulation "
-				"(ENC_MODE %d->%d).\n",
-				b->encmode,
-				b->encmode+udp_diff);
-			  /* Tunnel -> UDP-Tunnel, Transport -> UDP_Transport */
-			  b->encmode += udp_diff;
-			  b->udp_encap = 1;
-			}
-#endif
-
-			q = setph2proposal0(iph2, a, b);
-			if (q == NULL) {
-				VPTRINIT(iph2->sa);
-				return -1;
-			}
-
-			iph2->sa = vrealloc(iph2->sa, iph2->sa->l + q->l);
-			if (iph2->sa == NULL) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"failed to allocate my sa buffer\n");
-				if (q)
-					vfree(q);
-				return -1;
-			}
-			memcpy(iph2->sa->v + iph2->sa->l - q->l, q->v, q->l);
-			if (propoff != 0) {
-				prop = (struct isakmp_pl_p *)(iph2->sa->v +
-					propoff);
-				prop->h.np = ISAKMP_NPTYPE_P;
-			}
-			propoff = iph2->sa->l - q->l;
-
-			vfree(q);
-		}
-	}
-
-	return 0;
-}
-
-/*
- * return 1 if all of the given protocols are transport mode.
- */
-int
-ipsecdoi_transportmode(pp)
-	struct saprop *pp;
-{
-	struct saproto *pr = NULL;
-
-	for (; pp; pp = pp->next) {
-		for (pr = pp->head; pr; pr = pr->next) {
-			if (pr->encmode != IPSECDOI_ATTR_ENC_MODE_TRNS)
-				return 0;
-		}
-	}
-
-	return 1;
-}
-
-int
-ipsecdoi_get_defaultlifetime()
-{
-	return IPSECDOI_ATTR_SA_LD_SEC_DEFAULT;
-}
-
-int
-ipsecdoi_checkalgtypes(proto_id, enc, auth, comp)
-	int proto_id, enc, auth, comp;
-{
-#define TMPALGTYPE2STR(n) s_algtype(algclass_ipsec_##n, n)
-	switch (proto_id) {
-	case IPSECDOI_PROTO_IPSEC_ESP:
-		if (enc == 0 || comp != 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"illegal algorithm defined "
-				"ESP enc=%s auth=%s comp=%s.\n",
-				TMPALGTYPE2STR(enc),
-				TMPALGTYPE2STR(auth),
-				TMPALGTYPE2STR(comp));
-			return -1;
-		}
-		break;
-	case IPSECDOI_PROTO_IPSEC_AH:
-		if (enc != 0 || auth == 0 || comp != 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"illegal algorithm defined "
-				"AH enc=%s auth=%s comp=%s.\n",
-				TMPALGTYPE2STR(enc),
-				TMPALGTYPE2STR(auth),
-				TMPALGTYPE2STR(comp));
-			return -1;
-		}
-		break;
-	case IPSECDOI_PROTO_IPCOMP:
-		if (enc != 0 || auth != 0 || comp == 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"illegal algorithm defined "
-				"IPcomp enc=%s auth=%s comp=%s.\n",
-				TMPALGTYPE2STR(enc),
-				TMPALGTYPE2STR(auth),
-				TMPALGTYPE2STR(comp));
-			return -1;
-		}
-		break;
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid ipsec protocol %d\n", proto_id);
-		return -1;
-	}
-#undef TMPALGTYPE2STR
-	return 0;
-}
-
-int
-ipproto2doi(proto)
-	int proto;
-{
-	switch (proto) {
-	case IPPROTO_AH:
-		return IPSECDOI_PROTO_IPSEC_AH;
-	case IPPROTO_ESP:
-		return IPSECDOI_PROTO_IPSEC_ESP;
-	case IPPROTO_IPCOMP:
-		return IPSECDOI_PROTO_IPCOMP;
-	}
-	return -1;	/* XXX */
-}
-
-int
-doi2ipproto(proto)
-	int proto;
-{
-	switch (proto) {
-	case IPSECDOI_PROTO_IPSEC_AH:
-		return IPPROTO_AH;
-	case IPSECDOI_PROTO_IPSEC_ESP:
-		return IPPROTO_ESP;
-	case IPSECDOI_PROTO_IPCOMP:
-		return IPPROTO_IPCOMP;
-	}
-	return -1;	/* XXX */
-}
-
-/*
- * Check if a subnet id is valid for comparison
- * with an address id ( address length mask )
- * and compare them
- * Return value
- * =  0 for match
- * =  1 for mismatch
- */
-
-int
-ipsecdoi_subnetisaddr_v4( subnet, address )
-	const vchar_t *subnet;
-	const vchar_t *address;
-{
-	struct in_addr *mask;
-
-	if (address->l != sizeof(struct in_addr))
-		return 1;
-
-	if (subnet->l != (sizeof(struct in_addr)*2))
-		return 1;
-
-	mask = (struct in_addr*)(subnet->v + sizeof(struct in_addr));
-
-	if (mask->s_addr!=0xffffffff)
-		return 1;
-
-	return memcmp(subnet->v,address->v,address->l);
-}
-
-#ifdef INET6
-
-int
-ipsecdoi_subnetisaddr_v6( subnet, address )
-	const vchar_t *subnet;
-	const vchar_t *address;
-{
-	struct in6_addr *mask;
-	int i;
-
-	if (address->l != sizeof(struct in6_addr))
-		return 1;
-
-	if (subnet->l != (sizeof(struct in6_addr)*2))
-		return 1;
-
-	mask = (struct in6_addr*)(subnet->v + sizeof(struct in6_addr));
-
-	for (i=0; i<16; i++)
-		if(mask->s6_addr[i]!=0xff)
-			return 1;
-
-	return memcmp(subnet->v,address->v,address->l);
-}
-
-#endif
-
-/*
- * Check and Compare two IDs
- * - specify 0 for exact if wildcards are allowed
- * Return value
- * =  0 for match
- * =  1 for misatch
- * = -1 for integrity error
- */
-
-int
-ipsecdoi_chkcmpids( idt, ids, exact )
-	const vchar_t *idt; /* id cmp target */
-	const vchar_t *ids; /* id cmp source */
-	int exact;
-{
-	struct ipsecdoi_id_b *id_bt;
-	struct ipsecdoi_id_b *id_bs;
-	vchar_t ident_t;
-	vchar_t ident_s;
-	int result;
-
-	/* handle wildcard IDs */
-
-	if (idt == NULL || ids == NULL)
-	{
-		if( !exact )
-		{
-			plog(LLV_DEBUG, LOCATION, NULL,
-				"check and compare ids : values matched (ANONYMOUS)\n" );
-			return 0;
-		}
-		else
-		{
-			plog(LLV_DEBUG, LOCATION, NULL,
-				"check and compare ids : value mismatch (ANONYMOUS)\n" );
-			return -1;
-		}
-	}
-
-	/* make sure the ids are of the same type */
-
-	id_bt = (struct ipsecdoi_id_b *) idt->v;
-	id_bs = (struct ipsecdoi_id_b *) ids->v;
-
-	ident_t.v = idt->v + sizeof(*id_bt);
-	ident_t.l = idt->l - sizeof(*id_bt);
-	ident_s.v = ids->v + sizeof(*id_bs);
-	ident_s.l = ids->l - sizeof(*id_bs);
-
-	if (id_bs->type != id_bt->type)
-	{
-		/*
-		 * special exception for comparing
-                 * address to subnet id types when
-                 * the netmask is address length
-                 */
-
-		if ((id_bs->type == IPSECDOI_ID_IPV4_ADDR)&&
-		    (id_bt->type == IPSECDOI_ID_IPV4_ADDR_SUBNET)) {
-			result = ipsecdoi_subnetisaddr_v4(&ident_t,&ident_s);
-			goto cmpid_result;
-		}
-
-		if ((id_bs->type == IPSECDOI_ID_IPV4_ADDR_SUBNET)&&
-		    (id_bt->type == IPSECDOI_ID_IPV4_ADDR)) {
-			result = ipsecdoi_subnetisaddr_v4(&ident_s,&ident_t);
-			goto cmpid_result;
-		}
-
-#ifdef INET6
-		if ((id_bs->type == IPSECDOI_ID_IPV6_ADDR)&&
-		    (id_bt->type == IPSECDOI_ID_IPV6_ADDR_SUBNET)) {
-			result = ipsecdoi_subnetisaddr_v6(&ident_t,&ident_s);
-			goto cmpid_result;
-		}
-
-		if ((id_bs->type == IPSECDOI_ID_IPV6_ADDR_SUBNET)&&
-		    (id_bt->type == IPSECDOI_ID_IPV6_ADDR)) {
-			result = ipsecdoi_subnetisaddr_v6(&ident_s,&ident_t);
-			goto cmpid_result;
-		}
-#endif
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"check and compare ids : id type mismatch %s != %s\n",
-			s_ipsecdoi_ident(id_bs->type),
-			s_ipsecdoi_ident(id_bt->type));
-
-		return 1;
-	}
-
-	if(id_bs->proto_id != id_bt->proto_id){
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"check and compare ids : proto_id mismatch %d != %d\n",
-			id_bs->proto_id, id_bt->proto_id);
-
-		return 1;
-	}
-
-	/* compare the ID data. */
-
-	switch (id_bt->type) {
-	        case IPSECDOI_ID_DER_ASN1_DN:
-        	case IPSECDOI_ID_DER_ASN1_GN:
-			/* compare asn1 ids */
-			result = eay_cmp_asn1dn(&ident_t, &ident_s);
-			goto cmpid_result;
-
-		case IPSECDOI_ID_IPV4_ADDR:
-			/* validate lengths */
-			if ((ident_t.l != sizeof(struct in_addr))||
-			    (ident_s.l != sizeof(struct in_addr)))
-				goto cmpid_invalid;
-			break;
-
-		case IPSECDOI_ID_IPV4_ADDR_SUBNET:
-		case IPSECDOI_ID_IPV4_ADDR_RANGE:
-			/* validate lengths */
-			if ((ident_t.l != (sizeof(struct in_addr)*2))||
-			    (ident_s.l != (sizeof(struct in_addr)*2)))
-				goto cmpid_invalid;
-			break;
-
-#ifdef INET6
-		case IPSECDOI_ID_IPV6_ADDR:
-			/* validate lengths */
-			if ((ident_t.l != sizeof(struct in6_addr))||
-			    (ident_s.l != sizeof(struct in6_addr)))
-				goto cmpid_invalid;
-			break;
-
-		case IPSECDOI_ID_IPV6_ADDR_SUBNET:
-		case IPSECDOI_ID_IPV6_ADDR_RANGE:
-			/* validate lengths */
-			if ((ident_t.l != (sizeof(struct in6_addr)*2))||
-			    (ident_s.l != (sizeof(struct in6_addr)*2)))
-				goto cmpid_invalid;
-			break;
-#endif
-		case IPSECDOI_ID_FQDN:
-		case IPSECDOI_ID_USER_FQDN:
-		case IPSECDOI_ID_KEY_ID:
-			break;
-
-		default:
-			plog(LLV_ERROR, LOCATION, NULL,
-				"Unhandled id type %i specified for comparison\n",
-				id_bt->type);
-			return -1;
-	}
-
-	/* validate matching data and length */
-	if (ident_t.l == ident_s.l)
-		result = memcmp(ident_t.v,ident_s.v,ident_t.l);
-	else
-		result = 1;
-
-cmpid_result:
-
-	/* debug level output */
-	if(loglevel >= LLV_DEBUG) {
-		char *idstrt = ipsecdoi_id2str(idt);
-		char *idstrs = ipsecdoi_id2str(ids);
-
-		if (!result)
-	 		plog(LLV_DEBUG, LOCATION, NULL,
-				"check and compare ids : values matched (%s)\n",
-				 s_ipsecdoi_ident(id_bs->type) );
-		else
- 			plog(LLV_DEBUG, LOCATION, NULL,
-				"check and compare ids : value mismatch (%s)\n",
-				 s_ipsecdoi_ident(id_bs->type));
-
-		plog(LLV_DEBUG, LOCATION, NULL, "cmpid target: \'%s\'\n", idstrt );
-		plog(LLV_DEBUG, LOCATION, NULL, "cmpid source: \'%s\'\n", idstrs );
-
-		racoon_free(idstrs);
-		racoon_free(idstrt);
-	}
-
-	/* return result */
-	if( !result )
-		return 0;
-	else
-		return 1;
-
-cmpid_invalid:
-
-	/* id integrity error */
-	plog(LLV_DEBUG, LOCATION, NULL, "check and compare ids : %s integrity error\n",
-		s_ipsecdoi_ident(id_bs->type));
-	plog(LLV_DEBUG, LOCATION, NULL, "cmpid target: length = \'%zu\'\n", ident_t.l );
-	plog(LLV_DEBUG, LOCATION, NULL, "cmpid source: length = \'%zu\'\n", ident_s.l );
-
-	return -1;
-}
-
-/*
- * check the following:
- * - In main mode with pre-shared key, only address type can be used.
- * - if proper type for phase 1 ?
- * - if phase 1 ID payload conformed RFC2407 4.6.2.
- *   (proto, port) must be (0, 0), (udp, 500) or (udp, [specified]).
- * - if ID payload sent from peer is equal to the ID expected by me.
- *
- * both of "id" and "id_p" should be ID payload without general header,
- */
-int
-ipsecdoi_checkid1(iph1)
-	struct ph1handle *iph1;
-{
-	struct ipsecdoi_id_b *id_b;
-	struct sockaddr *sa;
-	caddr_t sa1, sa2;
-
-	if (iph1->id_p == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid iph1 passed id_p == NULL\n");
-		return ISAKMP_INTERNAL_ERROR;
-	}
-	if (iph1->id_p->l < sizeof(*id_b)) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid value passed as \"ident\" (len=%lu)\n",
-			(u_long)iph1->id_p->l);
-		return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
-	}
-
-	id_b = (struct ipsecdoi_id_b *)iph1->id_p->v;
-
-#ifndef ANDROID_PATCHED
-	/* In main mode with pre-shared key, only address type can be used. */
-	if (iph1->etype == ISAKMP_ETYPE_IDENT &&
-	    iph1->approval->authmethod == OAKLEY_ATTR_AUTH_METHOD_PSKEY) {
-		 if (id_b->type != IPSECDOI_ID_IPV4_ADDR
-		  && id_b->type != IPSECDOI_ID_IPV6_ADDR) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"Expecting IP address type in main mode, "
-				"but %s.\n", s_ipsecdoi_ident(id_b->type));
-			return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
-		}
-	}
-#endif
-
-	/* if proper type for phase 1 ? */
-	switch (id_b->type) {
-	case IPSECDOI_ID_IPV4_ADDR_SUBNET:
-	case IPSECDOI_ID_IPV6_ADDR_SUBNET:
-	case IPSECDOI_ID_IPV4_ADDR_RANGE:
-	case IPSECDOI_ID_IPV6_ADDR_RANGE:
-		plog(LLV_WARNING, LOCATION, NULL,
-			"such ID type %s is not proper.\n",
-			s_ipsecdoi_ident(id_b->type));
-		/*FALLTHROUGH*/
-	}
-
-	/* if phase 1 ID payload conformed RFC2407 4.6.2. */
-	if (id_b->type == IPSECDOI_ID_IPV4_ADDR ||
-	    id_b->type == IPSECDOI_ID_IPV6_ADDR) {
-
-		if (id_b->proto_id == 0 && ntohs(id_b->port) != 0) {
-			plog(LLV_WARNING, LOCATION, NULL,
-				"protocol ID and Port mismatched. "
-				"proto_id:%d port:%d\n",
-				id_b->proto_id, ntohs(id_b->port));
-			/*FALLTHROUGH*/
-
-		} else if (id_b->proto_id == IPPROTO_UDP) {
-			/*
-			 * copmaring with expecting port.
-			 * always permit if port is equal to PORT_ISAKMP
-			 */
-			if (ntohs(id_b->port) != PORT_ISAKMP) {
-				u_int16_t port;
-
-				port = extract_port(iph1->remote);
-				if (ntohs(id_b->port) != port) {
-					plog(LLV_WARNING, LOCATION, NULL,
-						"port %d expected, but %d\n",
-						port, ntohs(id_b->port));
-					/*FALLTHROUGH*/
-				}
-			}
-		}
-	}
-
-	/* compare with the ID if specified. */
-	if (genlist_next(iph1->rmconf->idvl_p, 0)) {
-		vchar_t *ident0 = NULL;
-		vchar_t ident;
-		struct idspec *id;
-		struct genlist_entry *gpb;
-
-		for (id = genlist_next (iph1->rmconf->idvl_p, &gpb); id; id = genlist_next (0, &gpb)) {
-			/* check the type of both IDs */
-			if (id->idtype != doi2idtype(id_b->type))
-				continue;  /* ID type mismatch */
-			if (id->id == 0)
-				goto matched;
-
-			/* compare defined ID with the ID sent by peer. */
-			if (ident0 != NULL)
-				vfree(ident0);
-			ident0 = getidval(id->idtype, id->id);
-
-			switch (id->idtype) {
-			case IDTYPE_ASN1DN:
-				ident.v = iph1->id_p->v + sizeof(*id_b);
-				ident.l = iph1->id_p->l - sizeof(*id_b);
-				if (eay_cmp_asn1dn(ident0, &ident) == 0)
-					goto matched;
-				break;
-			case IDTYPE_ADDRESS:
-				sa = (struct sockaddr *)ident0->v;
-				sa2 = (caddr_t)(id_b + 1);
-				switch (sa->sa_family) {
-				case AF_INET:
-					if (iph1->id_p->l - sizeof(*id_b) != sizeof(struct in_addr))
-						continue;  /* ID value mismatch */
-					sa1 = (caddr_t)&((struct sockaddr_in *)sa)->sin_addr;
-					if (memcmp(sa1, sa2, sizeof(struct in_addr)) == 0)
-						goto matched;
-					break;
-#ifdef INET6
-				case AF_INET6:
-					if (iph1->id_p->l - sizeof(*id_b) != sizeof(struct in6_addr))
-						continue;  /* ID value mismatch */
-					sa1 = (caddr_t)&((struct sockaddr_in6 *)sa)->sin6_addr;
-					if (memcmp(sa1, sa2, sizeof(struct in6_addr)) == 0)
-						goto matched;
-					break;
-#endif
-				default:
-					break;
-				}
-				break;
-			default:
-				if (memcmp(ident0->v, id_b + 1, ident0->l) == 0)
-					goto matched;
-				break;
-			}
-		}
-		if (ident0 != NULL) {
-			vfree(ident0);
-			ident0 = NULL;
-		}
-		plog(LLV_WARNING, LOCATION, NULL, "No ID match.\n");
-		if (iph1->rmconf->verify_identifier)
-			return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
-matched: /* ID value match */
-		if (ident0 != NULL)
-			vfree(ident0);
-	}
-
-	return 0;
-}
-
-/*
- * create ID payload for phase 1 and set into iph1->id.
- * NOT INCLUDING isakmp general header.
- * see, RFC2407 4.6.2.1
- */
-int
-ipsecdoi_setid1(iph1)
-	struct ph1handle *iph1;
-{
-	vchar_t *ret = NULL;
-	struct ipsecdoi_id_b id_b;
-	vchar_t *ident = NULL;
-	struct sockaddr *ipid = NULL;
-
-	/* init */
-	id_b.proto_id = 0;
-	id_b.port = 0;
-	ident = NULL;
-
-	switch (iph1->rmconf->idvtype) {
-	case IDTYPE_FQDN:
-		id_b.type = IPSECDOI_ID_FQDN;
-		ident = getidval(iph1->rmconf->idvtype, iph1->rmconf->idv);
-		break;
-	case IDTYPE_USERFQDN:
-		id_b.type = IPSECDOI_ID_USER_FQDN;
-		ident = getidval(iph1->rmconf->idvtype, iph1->rmconf->idv);
-		break;
-	case IDTYPE_KEYID:
-		id_b.type = IPSECDOI_ID_KEY_ID;
-		ident = getidval(iph1->rmconf->idvtype, iph1->rmconf->idv);
-		break;
-	case IDTYPE_ASN1DN:
-		id_b.type = IPSECDOI_ID_DER_ASN1_DN;
-		if (iph1->rmconf->idv) {
-			/* XXX it must be encoded to asn1dn. */
-			ident = vdup(iph1->rmconf->idv);
-		} else {
-			if (oakley_getmycert(iph1) < 0) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"failed to get own CERT.\n");
-				goto err;
-			}
-			ident = eay_get_x509asn1subjectname(&iph1->cert->cert);
-		}
-		break;
-	case IDTYPE_ADDRESS:
-		/*
-		 * if the value of the id type was set by the configuration
-		 * file, then use it.  otherwise the value is get from local
-		 * ip address by using ike negotiation.
-		 */
-		if (iph1->rmconf->idv)
-			ipid = (struct sockaddr *)iph1->rmconf->idv->v;
-		/*FALLTHROUGH*/
-	default:
-	    {
-		int l;
-		caddr_t p;
-
-		if (ipid == NULL)
-			ipid = iph1->local;
-
-		/* use IP address */
-		switch (ipid->sa_family) {
-		case AF_INET:
-			id_b.type = IPSECDOI_ID_IPV4_ADDR;
-			l = sizeof(struct in_addr);
-			p = (caddr_t)&((struct sockaddr_in *)ipid)->sin_addr;
-			break;
-#ifdef INET6
-		case AF_INET6:
-			id_b.type = IPSECDOI_ID_IPV6_ADDR;
-			l = sizeof(struct in6_addr);
-			p = (caddr_t)&((struct sockaddr_in6 *)ipid)->sin6_addr;
-			break;
-#endif
-		default:
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid address family.\n");
-			goto err;
-		}
-		id_b.proto_id = IPPROTO_UDP;
-		id_b.port = htons(PORT_ISAKMP);
-		ident = vmalloc(l);
-		if (!ident) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to get ID buffer.\n");
-			return 0;
-		}
-		memcpy(ident->v, p, ident->l);
-	    }
-	}
-	if (!ident) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get ID buffer.\n");
-		return 0;
-	}
-
-	ret = vmalloc(sizeof(id_b) + ident->l);
-	if (ret == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get ID buffer.\n");
-		goto err;
-	}
-
-	memcpy(ret->v, &id_b, sizeof(id_b));
-	memcpy(ret->v + sizeof(id_b), ident->v, ident->l);
-
-	iph1->id = ret;
-
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"use ID type of %s\n", s_ipsecdoi_ident(id_b.type));
-	if (ident)
-		vfree(ident);
-	return 0;
-
-err:
-	if (ident)
-		vfree(ident);
-	plog(LLV_ERROR, LOCATION, NULL, "failed get my ID\n");
-	return -1;
-}
-
-static vchar_t *
-getidval(type, val)
-	int type;
-	vchar_t *val;
-{
-	vchar_t *new = NULL;
-
-	if (val)
-		new = vdup(val);
-	else if (lcconf->ident[type])
-		new = vdup(lcconf->ident[type]);
-
-	return new;
-}
-
-/* it's only called by cfparse.y. */
-int
-set_identifier(vpp, type, value)
-	vchar_t **vpp, *value;
-	int type;
-{
-	return set_identifier_qual(vpp, type, value, IDQUAL_UNSPEC);
-}
-
-int
-set_identifier_qual(vpp, type, value, qual)
-	vchar_t **vpp, *value;
-	int type;
-	int qual;
-{
-	vchar_t *new = NULL;
-
-	/* simply return if value is null. */
-	if (!value){
-		if( type == IDTYPE_FQDN || type == IDTYPE_USERFQDN){
-			plog(LLV_ERROR, LOCATION, NULL,
-				 "No %s\n", type == IDTYPE_FQDN ? "fqdn":"user fqdn");
-			return -1;
-		}
-		return 0;
-	}
-
-	switch (type) {
-	case IDTYPE_FQDN:
-	case IDTYPE_USERFQDN:
-		if(value->l <= 1){
-			plog(LLV_ERROR, LOCATION, NULL,
-				 "Empty %s\n", type == IDTYPE_FQDN ? "fqdn":"user fqdn");
-			return -1;
-		}
-		/* length is adjusted since QUOTEDSTRING teminates NULL. */
-		new = vmalloc(value->l - 1);
-		if (new == NULL)
-			return -1;
-		memcpy(new->v, value->v, new->l);
-		break;
-	case IDTYPE_KEYID:
-		/* 
-		 * If no qualifier is specified: IDQUAL_UNSPEC. It means
-		 * to use a file for backward compatibility sake. 
-		 */
-		switch(qual) {
-		case IDQUAL_FILE:
-		case IDQUAL_UNSPEC: {
-			FILE *fp;
-			char b[512];
-			int tlen, len;
-
-			fp = fopen(value->v, "r");
-			if (fp == NULL) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"can not open %s\n", value->v);
-				return -1;
-			}
-			tlen = 0;
-			while ((len = fread(b, 1, sizeof(b), fp)) != 0) {
-				new = vrealloc(new, tlen + len);
-				if (!new) {
-					fclose(fp);
-					return -1;
-				}
-				memcpy(new->v + tlen, b, len);
-				tlen += len;
-			}
-			break;
-		}
-
-		case IDQUAL_TAG:
-			new = vmalloc(value->l - 1);
-			if (new == NULL) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"can not allocate memory");
-				return -1;
-			}
-			memcpy(new->v, value->v, new->l);
-			break;
-
-		default:
-			plog(LLV_ERROR, LOCATION, NULL,
-				"unknown qualifier");
-			return -1;
-		}
-		break;
-	
-	case IDTYPE_ADDRESS: {
-		struct sockaddr *sa;
-
-		/* length is adjusted since QUOTEDSTRING teminates NULL. */
-		if (value->l == 0)
-			break;
-
-		sa = str2saddr(value->v, NULL);
-		if (sa == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid ip address %s\n", value->v);
-			return -1;
-		}
-
-		new = vmalloc(sysdep_sa_len(sa));
-		if (new == NULL) {
-			racoon_free(sa);
-			return -1;
-		}
-		memcpy(new->v, sa, new->l);
-		racoon_free(sa);
-		break;
-	}
-	case IDTYPE_ASN1DN:
-		if (value->v[0] == '~')
-			/* Hex-encoded ASN1 strings */
-			new = eay_hex2asn1dn(value->v + 1, - 1);
-		else
-			/* DN encoded strings */
-			new = eay_str2asn1dn(value->v, value->l - 1);
-
-		if (new == NULL)
-			return -1;
-
-		if (loglevel >= LLV_DEBUG) {
-			X509_NAME *xn;
-			BIO *bio;
-			unsigned char *ptr = (unsigned char *) new->v, *buf;
-			size_t len;
-#if defined(ANDROID_CHANGES)
-			char *bio_contents;
-#else
-			char save;
-#endif
-
-			xn = d2i_X509_NAME(NULL, (void *)&ptr, new->l);
-			bio = BIO_new(BIO_s_mem());
-			
-			X509_NAME_print_ex(bio, xn, 0, 0);
-#if defined(ANDROID_CHANGES)
-			BIO_write(bio, "\x00", 1);
-			BIO_get_mem_data(bio, &bio_contents);
-			plog(LLV_DEBUG, LOCATION, NULL, "Parsed DN: %s\n", bio_contents);
-#else
-			len = BIO_get_mem_data(bio, &ptr);
-			save = ptr[len];
-			ptr[len] = 0;
-			plog(LLV_DEBUG, LOCATION, NULL, "Parsed DN: %s\n", ptr);
-			ptr[len] = save;
-#endif
-			X509_NAME_free(xn);
-			BIO_free(bio);
-		}
-
-		break;
-	}
-
-	*vpp = new;
-
-	return 0;
-}
-
-/*
- * create ID payload for phase 2, and set into iph2->id and id_p.  There are
- * NOT INCLUDING isakmp general header.
- * this function is for initiator.  responder will get to copy from payload.
- * responder ID type is always address type.
- * see, RFC2407 4.6.2.1
- */
-int
-ipsecdoi_setid2(iph2)
-	struct ph2handle *iph2;
-{
-	struct secpolicy *sp;
-
-	/* check there is phase 2 handler ? */
-	sp = getspbyspid(iph2->spid);
-	if (sp == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"no policy found for spid:%u.\n", iph2->spid);
-		return -1;
-	}
-
-	iph2->id = ipsecdoi_sockaddr2id((struct sockaddr *)&sp->spidx.src,
-					sp->spidx.prefs, sp->spidx.ul_proto);
-	if (iph2->id == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get ID for %s\n",
-			spidx2str(&sp->spidx));
-		return -1;
-	}
-	plog(LLV_DEBUG, LOCATION, NULL, "use local ID type %s\n",
-		s_ipsecdoi_ident(((struct ipsecdoi_id_b *)iph2->id->v)->type));
-
-	/* remote side */
-	iph2->id_p = ipsecdoi_sockaddr2id((struct sockaddr *)&sp->spidx.dst,
-				sp->spidx.prefd, sp->spidx.ul_proto);
-	if (iph2->id_p == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get ID for %s\n",
-			spidx2str(&sp->spidx));
-		VPTRINIT(iph2->id);
-		return -1;
-	}
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"use remote ID type %s\n",
-		s_ipsecdoi_ident(((struct ipsecdoi_id_b *)iph2->id_p->v)->type));
-
-	return 0;
-}
-
-/*
- * set address type of ID.
- * NOT INCLUDING general header.
- */
-vchar_t *
-ipsecdoi_sockaddr2id(saddr, prefixlen, ul_proto)
-	struct sockaddr *saddr;
-	u_int prefixlen;
-	u_int ul_proto;
-{
-	vchar_t *new;
-	int type, len1, len2;
-	caddr_t sa;
-	u_short port;
-
-	/*
-	 * Q. When type is SUBNET, is it allowed to be ::1/128.
-	 * A. Yes. (consensus at bake-off)
-	 */
-	switch (saddr->sa_family) {
-	case AF_INET:
-		len1 = sizeof(struct in_addr);
-		if (prefixlen == (sizeof(struct in_addr) << 3)) {
-			type = IPSECDOI_ID_IPV4_ADDR;
-			len2 = 0;
-		} else {
-			type = IPSECDOI_ID_IPV4_ADDR_SUBNET;
-			len2 = sizeof(struct in_addr);
-		}
-		sa = (caddr_t)&((struct sockaddr_in *)(saddr))->sin_addr;
-		port = ((struct sockaddr_in *)(saddr))->sin_port;
-		break;
-#ifdef INET6
-	case AF_INET6:
-		len1 = sizeof(struct in6_addr);
-		if (prefixlen == (sizeof(struct in6_addr) << 3)) {
-			type = IPSECDOI_ID_IPV6_ADDR;
-			len2 = 0;
-		} else {
-			type = IPSECDOI_ID_IPV6_ADDR_SUBNET;
-			len2 = sizeof(struct in6_addr);
-		}
-		sa = (caddr_t)&((struct sockaddr_in6 *)(saddr))->sin6_addr;
-		port = ((struct sockaddr_in6 *)(saddr))->sin6_port;
-		break;
-#endif
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid family: %d.\n", saddr->sa_family);
-		return NULL;
-	}
-
-	/* get ID buffer */
-	new = vmalloc(sizeof(struct ipsecdoi_id_b) + len1 + len2);
-	if (new == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get ID buffer.\n");
-		return NULL;
-	}
-
-	memset(new->v, 0, new->l);
-
-	/* set the part of header. */
-	((struct ipsecdoi_id_b *)new->v)->type = type;
-
-	/* set ul_proto and port */
-	/*
-	 * NOTE: we use both IPSEC_ULPROTO_ANY and IPSEC_PORT_ANY as wild card
-	 * because 0 means port number of 0.  Instead of 0, we use IPSEC_*_ANY.
-	 */
-	((struct ipsecdoi_id_b *)new->v)->proto_id =
-		ul_proto == IPSEC_ULPROTO_ANY ? 0 : ul_proto;
-	((struct ipsecdoi_id_b *)new->v)->port =
-		port == IPSEC_PORT_ANY ? 0 : port;
-	memcpy(new->v + sizeof(struct ipsecdoi_id_b), sa, len1);
-
-	/* set address */
-
-	/* set prefix */
-	if (len2) {
-		u_char *p = (unsigned char *) new->v + 
-			sizeof(struct ipsecdoi_id_b) + len1;
-		u_int bits = prefixlen;
-
-		while (bits >= 8) {
-			*p++ = 0xff;
-			bits -= 8;
-		}
-
-		if (bits > 0)
-			*p = ~((1 << (8 - bits)) - 1);
-	}
-
-	return new;
-}
-
-vchar_t *
-ipsecdoi_sockrange2id(laddr, haddr, ul_proto)
-	struct sockaddr *laddr, *haddr;
-	u_int ul_proto;
-{
-	vchar_t *new;
-	int type, len1, len2;
-	u_short port;
-
-	if (laddr->sa_family != haddr->sa_family) {
-	    plog(LLV_ERROR, LOCATION, NULL, "Address family mismatch\n");
-	    return NULL;
-	}
-
-	switch (laddr->sa_family) {
-	case AF_INET:
-	    type = IPSECDOI_ID_IPV4_ADDR_RANGE;
-	    len1 = sizeof(struct in_addr);
-	    len2 = sizeof(struct in_addr);
-	    break;
-#ifdef INET6
-	case AF_INET6:
-		type = IPSECDOI_ID_IPV6_ADDR_RANGE;
-		len1 = sizeof(struct in6_addr);
-		len2 = sizeof(struct in6_addr);
-		break;
-#endif
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid family: %d.\n", laddr->sa_family);
-		return NULL;
-	}
-
-	/* get ID buffer */
-	new = vmalloc(sizeof(struct ipsecdoi_id_b) + len1 + len2);
-	if (new == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get ID buffer.\n");
-		return NULL;
-	}
-
-	memset(new->v, 0, new->l);
-	/* set the part of header. */
-	((struct ipsecdoi_id_b *)new->v)->type = type;
-
-	/* set ul_proto and port */
-	/*
-	 * NOTE: we use both IPSEC_ULPROTO_ANY and IPSEC_PORT_ANY as wild card
-	 * because 0 means port number of 0.  Instead of 0, we use IPSEC_*_ANY.
-	 */
-	((struct ipsecdoi_id_b *)new->v)->proto_id =
-		ul_proto == IPSEC_ULPROTO_ANY ? 0 : ul_proto;
-	port = ((struct sockaddr_in *)(laddr))->sin_port;
-	((struct ipsecdoi_id_b *)new->v)->port =
-		port == IPSEC_PORT_ANY ? 0 : port;
-	memcpy(new->v + sizeof(struct ipsecdoi_id_b), 
-	       (caddr_t)&((struct sockaddr_in *)(laddr))->sin_addr, 
-	       len1);
-	memcpy(new->v + sizeof(struct ipsecdoi_id_b) + len1, 
-	       (caddr_t)&((struct sockaddr_in *)haddr)->sin_addr,
-	       len2);
-	return new;
-}
-
-
-/*
- * create sockaddr structure from ID payload (buf).
- * buffers (saddr, prefixlen, ul_proto) must be allocated.
- * see, RFC2407 4.6.2.1
- */
-int
-ipsecdoi_id2sockaddr(buf, saddr, prefixlen, ul_proto)
-	vchar_t *buf;
-	struct sockaddr *saddr;
-	u_int8_t *prefixlen;
-	u_int16_t *ul_proto;
-{
-	struct ipsecdoi_id_b *id_b = (struct ipsecdoi_id_b *)buf->v;
-	u_int plen = 0;
-
-	/*
-	 * When a ID payload of subnet type with a IP address of full bit
-	 * masked, it has to be processed as host address.
-	 * e.g. below 2 type are same.
-	 *      type = ipv6 subnet, data = 2001::1/128
-	 *      type = ipv6 address, data = 2001::1
-	 */
-	switch (id_b->type) {
-	case IPSECDOI_ID_IPV4_ADDR:
-	case IPSECDOI_ID_IPV4_ADDR_SUBNET:
-#ifndef __linux__
-		saddr->sa_len = sizeof(struct sockaddr_in);
-#endif
-		saddr->sa_family = AF_INET;
-		((struct sockaddr_in *)saddr)->sin_port =
-			(id_b->port == 0
-				? IPSEC_PORT_ANY
-				: id_b->port);		/* see sockaddr2id() */
-		memcpy(&((struct sockaddr_in *)saddr)->sin_addr,
-			buf->v + sizeof(*id_b), sizeof(struct in_addr));
-		break;
-#ifdef INET6
-	case IPSECDOI_ID_IPV6_ADDR:
-	case IPSECDOI_ID_IPV6_ADDR_SUBNET:
-#ifndef __linux__
-		saddr->sa_len = sizeof(struct sockaddr_in6);
-#endif
-		saddr->sa_family = AF_INET6;
-		((struct sockaddr_in6 *)saddr)->sin6_port =
-			(id_b->port == 0
-				? IPSEC_PORT_ANY
-				: id_b->port);		/* see sockaddr2id() */
-		memcpy(&((struct sockaddr_in6 *)saddr)->sin6_addr,
-			buf->v + sizeof(*id_b), sizeof(struct in6_addr));
-		break;
-#endif
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"unsupported ID type %d\n", id_b->type);
-		return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
-	}
-
-	/* get prefix length */
-	switch (id_b->type) {
-	case IPSECDOI_ID_IPV4_ADDR:
-		plen = sizeof(struct in_addr) << 3;
-		break;
-#ifdef INET6
-	case IPSECDOI_ID_IPV6_ADDR:
-		plen = sizeof(struct in6_addr) << 3;
-		break;
-#endif
-	case IPSECDOI_ID_IPV4_ADDR_SUBNET:
-#ifdef INET6
-	case IPSECDOI_ID_IPV6_ADDR_SUBNET:
-#endif
-	    {
-		u_char *p;
-		u_int max;
-		int alen = sizeof(struct in_addr);
-
-		switch (id_b->type) {
-		case IPSECDOI_ID_IPV4_ADDR_SUBNET:
-			alen = sizeof(struct in_addr);
-			break;
-#ifdef INET6
-		case IPSECDOI_ID_IPV6_ADDR_SUBNET:
-			alen = sizeof(struct in6_addr);
-			break;
-#endif
-		}
-
-		/* sanity check */
-		if (buf->l < alen)
-			return ISAKMP_INTERNAL_ERROR;
-
-		/* get subnet mask length */
-		plen = 0;
-		max = alen <<3;
-
-		p = (unsigned char *) buf->v
-			+ sizeof(struct ipsecdoi_id_b)
-			+ alen;
-
-		for (; *p == 0xff; p++) {
-			plen += 8;
-			if (plen >= max)
-				break;
-		}
-
-		if (plen < max) {
-			u_int l = 0;
-			u_char b = ~(*p);
-
-			while (b) {
-				b >>= 1;
-				l++;
-			}
-
-			l = 8 - l;
-			plen += l;
-		}
-	    }
-		break;
-	}
-
-	*prefixlen = plen;
-	*ul_proto = id_b->proto_id == 0
-				? IPSEC_ULPROTO_ANY
-				: id_b->proto_id;	/* see sockaddr2id() */
-
-	return 0;
-}
-
-/*
- * make printable string from ID payload except of general header.
- */
-char *
-ipsecdoi_id2str(id)
-	const vchar_t *id;
-{
-#define BUFLEN 512
-	char * ret = NULL;
-	int len = 0;
-	char *dat;
-	static char buf[BUFLEN];
-	struct ipsecdoi_id_b *id_b = (struct ipsecdoi_id_b *)id->v;
-	struct sockaddr_storage saddr_storage;
-	struct sockaddr        *saddr;
-	struct sockaddr_in     *saddr_in;
-	struct sockaddr_in6    *saddr_in6;
-	u_int plen = 0;
-
-	saddr     = (struct sockaddr *)&saddr_storage;
-	saddr_in  = (struct sockaddr_in *)&saddr_storage;
-	saddr_in6 = (struct sockaddr_in6 *)&saddr_storage;
-
-	
-	switch (id_b->type) {
-	case IPSECDOI_ID_IPV4_ADDR:
-	case IPSECDOI_ID_IPV4_ADDR_SUBNET:
-	case IPSECDOI_ID_IPV4_ADDR_RANGE:
-
-#ifndef __linux__
-		saddr->sa_len = sizeof(struct sockaddr_in);
-#endif
-		saddr->sa_family = AF_INET;
-
-		saddr_in->sin_port = IPSEC_PORT_ANY;
-		memcpy(&saddr_in->sin_addr,
-			id->v + sizeof(*id_b), sizeof(struct in_addr));
-		break;
-#ifdef INET6
-	case IPSECDOI_ID_IPV6_ADDR:
-	case IPSECDOI_ID_IPV6_ADDR_SUBNET:
-	case IPSECDOI_ID_IPV6_ADDR_RANGE:
-
-#ifndef __linux__
-		saddr->sa_len = sizeof(struct sockaddr_in6);
-#endif
-		saddr->sa_family = AF_INET6;
-
-		saddr_in6->sin6_port = IPSEC_PORT_ANY;
-		memcpy(&saddr_in6->sin6_addr,
-			id->v + sizeof(*id_b), sizeof(struct in6_addr));
-		saddr_in6->sin6_scope_id =
-			(IN6_IS_ADDR_LINKLOCAL(&saddr_in6->sin6_addr)
-				? ((struct sockaddr_in6 *)id_b)->sin6_scope_id
-				: 0);
-		break;
-#endif
-	}
-
-	switch (id_b->type) {
-	case IPSECDOI_ID_IPV4_ADDR:
-#ifdef INET6
-	case IPSECDOI_ID_IPV6_ADDR:
-#endif
-		len = snprintf( buf, BUFLEN, "%s", saddrwop2str(saddr));
-		break;
-
-	case IPSECDOI_ID_IPV4_ADDR_SUBNET:
-#ifdef INET6
-	case IPSECDOI_ID_IPV6_ADDR_SUBNET:
-#endif
-	    {
-		u_char *p;
-		u_int max;
-		int alen = sizeof(struct in_addr);
-
-		switch (id_b->type) {
-		case IPSECDOI_ID_IPV4_ADDR_SUBNET:
-			alen = sizeof(struct in_addr);
-			break;
-#ifdef INET6
-		case IPSECDOI_ID_IPV6_ADDR_SUBNET:
-			alen = sizeof(struct in6_addr);
-			break;
-#endif
-		}
-
-		/* sanity check */
-		if (id->l < alen) {
-			len = 0;
-			break;
-		}
-
-		/* get subnet mask length */
-		plen = 0;
-		max = alen <<3;
-
-		p = (unsigned char *) id->v
-			+ sizeof(struct ipsecdoi_id_b)
-			+ alen;
-
-		for (; *p == 0xff; p++) {
-			plen += 8;
-			if (plen >= max)
-				break;
-		}
-
-		if (plen < max) {
-			u_int l = 0;
-			u_char b = ~(*p);
-
-			while (b) {
-				b >>= 1;
-				l++;
-			}
-
-			l = 8 - l;
-			plen += l;
-		}
-
-		len = snprintf( buf, BUFLEN, "%s/%i", saddrwop2str(saddr), plen);
-	    }
-		break;
-
-	case IPSECDOI_ID_IPV4_ADDR_RANGE:
-
-		len = snprintf( buf, BUFLEN, "%s-", saddrwop2str(saddr));
-
-#ifndef __linux__
-		saddr->sa_len = sizeof(struct sockaddr_in);
-#endif
-		saddr->sa_family = AF_INET;
-		saddr_in->sin_port = IPSEC_PORT_ANY;
-		memcpy(&saddr_in->sin_addr,
-			id->v + sizeof(*id_b) + sizeof(struct in_addr),
-			sizeof(struct in_addr));
-
-		len += snprintf( buf + len, BUFLEN - len, "%s", saddrwop2str(saddr));
-
-		break;
-
-#ifdef INET6
-	case IPSECDOI_ID_IPV6_ADDR_RANGE:
-
-		len = snprintf( buf, BUFLEN, "%s-", saddrwop2str(saddr));
-
-#ifndef __linux__
-		saddr->sa_len = sizeof(struct sockaddr_in6);
-#endif
-		saddr->sa_family = AF_INET6;
-		saddr_in6->sin6_port = IPSEC_PORT_ANY;
-		memcpy(&saddr_in6->sin6_addr,
-			id->v + sizeof(*id_b) + sizeof(struct in6_addr),
-			sizeof(struct in6_addr));
-		saddr_in6->sin6_scope_id =
-			(IN6_IS_ADDR_LINKLOCAL(&saddr_in6->sin6_addr)
-				? ((struct sockaddr_in6 *)id_b)->sin6_scope_id
-				: 0);
-
-		len += snprintf( buf + len, BUFLEN - len, "%s", saddrwop2str(saddr));
-
-		break;
-#endif
-
-	case IPSECDOI_ID_FQDN:
-	case IPSECDOI_ID_USER_FQDN:
-		len = id->l - sizeof(*id_b);
-		if (len > BUFLEN)
-			len = BUFLEN;
-		memcpy(buf, id->v + sizeof(*id_b), len);
-		break;
-
-	case IPSECDOI_ID_DER_ASN1_DN:
-	case IPSECDOI_ID_DER_ASN1_GN:
-	{
-		X509_NAME *xn = NULL;
-
-		dat = id->v + sizeof(*id_b);
-		len = id->l - sizeof(*id_b);
-
-		if (d2i_X509_NAME(&xn, (void*) &dat, len) != NULL) {
-			BIO *bio = BIO_new(BIO_s_mem());
-			X509_NAME_print_ex(bio, xn, 0, 0);
-			len = BIO_get_mem_data(bio, &dat);
-			if (len > BUFLEN)
-				len = BUFLEN;
-			memcpy(buf,dat,len);
-			BIO_free(bio);
-			X509_NAME_free(xn);
-		} else {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"unable to extract asn1dn from id\n");
-
-			len = sprintf(buf, "<ASN1-DN>");
-		}
-
-		break;
-	}
-
-	/* currently unhandled id types */
-	case IPSECDOI_ID_KEY_ID:
-		len = sprintf( buf, "<KEY-ID>");
-		break;
-
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"unknown ID type %d\n", id_b->type);
-	}
-
-	if (!len)
-		len = sprintf( buf, "<?>");
-
-	ret = racoon_malloc(len+1);
-	if (ret != NULL) {
-		memcpy(ret,buf,len);
-		ret[len]=0;
-	}
-
-	return ret;
-}
-
-/*
- * set IPsec data attributes into a proposal.
- * NOTE: MUST called per a transform.
- */
-int
-ipsecdoi_t2satrns(t, pp, pr, tr)
-	struct isakmp_pl_t *t;
-	struct saprop *pp;
-	struct saproto *pr;
-	struct satrns *tr;
-{
-	struct isakmp_data *d, *prev;
-	int flag, type;
-	int error = -1;
-	int life_t;
-	int tlen;
-
-	tr->trns_no = t->t_no;
-	tr->trns_id = t->t_id;
-
-	tlen = ntohs(t->h.len) - sizeof(*t);
-	prev = (struct isakmp_data *)NULL;
-	d = (struct isakmp_data *)(t + 1);
-
-	/* default */
-	life_t = IPSECDOI_ATTR_SA_LD_TYPE_DEFAULT;
-	pp->lifetime = IPSECDOI_ATTR_SA_LD_SEC_DEFAULT;
-	pp->lifebyte = 0;
-	tr->authtype = IPSECDOI_ATTR_AUTH_NONE;
-
-	while (tlen > 0) {
-
-		type = ntohs(d->type) & ~ISAKMP_GEN_MASK;
-		flag = ntohs(d->type) & ISAKMP_GEN_MASK;
-
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"type=%s, flag=0x%04x, lorv=%s\n",
-			s_ipsecdoi_attr(type), flag,
-			s_ipsecdoi_attr_v(type, ntohs(d->lorv)));
-
-		switch (type) {
-		case IPSECDOI_ATTR_SA_LD_TYPE:
-		{
-			int type = ntohs(d->lorv);
-			switch (type) {
-			case IPSECDOI_ATTR_SA_LD_TYPE_SEC:
-			case IPSECDOI_ATTR_SA_LD_TYPE_KB:
-				life_t = type;
-				break;
-			default:
-				plog(LLV_WARNING, LOCATION, NULL,
-					"invalid life duration type. "
-					"use default\n");
-				life_t = IPSECDOI_ATTR_SA_LD_TYPE_DEFAULT;
-				break;
-			}
-			break;
-		}
-		case IPSECDOI_ATTR_SA_LD:
-			if (prev == NULL
-			 || (ntohs(prev->type) & ~ISAKMP_GEN_MASK) !=
-					IPSECDOI_ATTR_SA_LD_TYPE) {
-				plog(LLV_ERROR, LOCATION, NULL,
-				    "life duration must follow ltype\n");
-				break;
-			}
-
-		    {
-			u_int32_t t;
-			vchar_t *ld_buf = NULL;
-
-			if (flag) {
-				/* i.e. ISAKMP_GEN_TV */
-				ld_buf = vmalloc(sizeof(d->lorv));
-				if (ld_buf == NULL) {
-					plog(LLV_ERROR, LOCATION, NULL,
-					    "failed to get LD buffer.\n");
-					goto end;
-				}
-				memcpy(ld_buf->v, &d->lorv, sizeof(d->lorv));
-			} else {
-				int len = ntohs(d->lorv);
-				/* i.e. ISAKMP_GEN_TLV */
-				ld_buf = vmalloc(len);
-				if (ld_buf == NULL) {
-					plog(LLV_ERROR, LOCATION, NULL,
-					    "failed to get LD buffer.\n");
-					goto end;
-				}
-				memcpy(ld_buf->v, d + 1, len);
-			}
-			switch (life_t) {
-			case IPSECDOI_ATTR_SA_LD_TYPE_SEC:
-				t = ipsecdoi_set_ld(ld_buf);
-				vfree(ld_buf);
-				if (t == 0) {
-					plog(LLV_ERROR, LOCATION, NULL,
-						"invalid life duration.\n");
-					goto end;
-				}
-				/* lifetime must be equal in a proposal. */
-				if (pp->lifetime == IPSECDOI_ATTR_SA_LD_SEC_DEFAULT)
-					pp->lifetime = t;
-				else if (pp->lifetime != t) {
-					plog(LLV_ERROR, LOCATION, NULL,
-						"lifetime mismatched "
-						"in a proposal, "
-						"prev:%ld curr:%u.\n",
-						(long)pp->lifetime, t);
-					goto end;
-				}
-				break;
-			case IPSECDOI_ATTR_SA_LD_TYPE_KB:
-				t = ipsecdoi_set_ld(ld_buf);
-				vfree(ld_buf);
-				if (t == 0) {
-					plog(LLV_ERROR, LOCATION, NULL,
-						"invalid life duration.\n");
-					goto end;
-				}
-				/* lifebyte must be equal in a proposal. */
-				if (pp->lifebyte == 0)
-					pp->lifebyte = t;
-				else if (pp->lifebyte != t) {
-					plog(LLV_ERROR, LOCATION, NULL,
-						"lifebyte mismatched "
-						"in a proposal, "
-						"prev:%d curr:%u.\n",
-						pp->lifebyte, t);
-					goto end;
-				}
-				break;
-			default:
-				vfree(ld_buf);
-				plog(LLV_ERROR, LOCATION, NULL,
-					"invalid life type: %d\n", life_t);
-				goto end;
-			}
-		    }
-			break;
-
-		case IPSECDOI_ATTR_GRP_DESC:
-			/*
-			 * RFC2407: 4.5 IPSEC Security Association Attributes
-			 *   Specifies the Oakley Group to be used in a PFS QM
-			 *   negotiation.  For a list of supported values, see
-			 *   Appendix A of [IKE].
-			 */
-			if (pp->pfs_group == 0)
-				pp->pfs_group = (u_int16_t)ntohs(d->lorv);
-			else if (pp->pfs_group != (u_int16_t)ntohs(d->lorv)) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"pfs_group mismatched "
-					"in a proposal.\n");
-				goto end;
-			}
-			break;
-
-		case IPSECDOI_ATTR_ENC_MODE:
-			if (pr->encmode &&
-			    pr->encmode != (u_int16_t)ntohs(d->lorv)) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"multiple encmode exist "
-					"in a transform.\n");
-				goto end;
-			}
-			pr->encmode = (u_int16_t)ntohs(d->lorv);
-			break;
-
-		case IPSECDOI_ATTR_AUTH:
-			if (tr->authtype != IPSECDOI_ATTR_AUTH_NONE) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"multiple authtype exist "
-					"in a transform.\n");
-				goto end;
-			}
-			tr->authtype = (u_int16_t)ntohs(d->lorv);
-			break;
-
-		case IPSECDOI_ATTR_KEY_LENGTH:
-			if (pr->proto_id != IPSECDOI_PROTO_IPSEC_ESP) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"key length defined but not ESP");
-				goto end;
-			}
-			tr->encklen = ntohs(d->lorv);
-			break;
-#ifdef HAVE_SECCTX
-		case IPSECDOI_ATTR_SECCTX:
-		{
-			int len = ntohs(d->lorv);
-			memcpy(&pp->sctx, d + 1, len);
-			pp->sctx.ctx_strlen = ntohs(pp->sctx.ctx_strlen);
-			break;
-		}
-#endif /* HAVE_SECCTX */
-		case IPSECDOI_ATTR_KEY_ROUNDS:
-		case IPSECDOI_ATTR_COMP_DICT_SIZE:
-		case IPSECDOI_ATTR_COMP_PRIVALG:
-		default:
-			break;
-		}
-
-		prev = d;
-		if (flag) {
-			tlen -= sizeof(*d);
-			d = (struct isakmp_data *)((char *)d + sizeof(*d));
-		} else {
-			tlen -= (sizeof(*d) + ntohs(d->lorv));
-			d = (struct isakmp_data *)((caddr_t)d + sizeof(*d) + ntohs(d->lorv));
-		}
-	}
-
-	error = 0;
-end:
-	return error;
-}
-
-int
-ipsecdoi_authalg2trnsid(alg)
-	int alg;
-{
-	switch (alg) {
-        case IPSECDOI_ATTR_AUTH_HMAC_MD5:
-		return IPSECDOI_AH_MD5;
-        case IPSECDOI_ATTR_AUTH_HMAC_SHA1:
-		return IPSECDOI_AH_SHA;
-	case IPSECDOI_ATTR_AUTH_HMAC_SHA2_256:
-		return IPSECDOI_AH_SHA256;
-	case IPSECDOI_ATTR_AUTH_HMAC_SHA2_384:
-		return IPSECDOI_AH_SHA384;
-	case IPSECDOI_ATTR_AUTH_HMAC_SHA2_512:
-		return IPSECDOI_AH_SHA512;
-        case IPSECDOI_ATTR_AUTH_DES_MAC:
-		return IPSECDOI_AH_DES;
-	case IPSECDOI_ATTR_AUTH_KPDK:
-		return IPSECDOI_AH_MD5;	/* XXX */
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid authentication algorithm:%d\n", alg);
-	}
-	return -1;
-}
-
-#ifdef HAVE_GSSAPI
-struct isakmpsa *
-fixup_initiator_sa(match, received)
-	struct isakmpsa *match, *received;
-{
-	if (received->gssid != NULL)
-		match->gssid = vdup(received->gssid);
-
-	return match;
-}
-#endif
-
-static int rm_idtype2doi[] = {
-	255,				/* IDTYPE_UNDEFINED, 0 */
-	IPSECDOI_ID_FQDN,		/* IDTYPE_FQDN, 1 */
-	IPSECDOI_ID_USER_FQDN,		/* IDTYPE_USERFQDN, 2 */
-	IPSECDOI_ID_KEY_ID,		/* IDTYPE_KEYID, 3 */
-	255,    /*			   IDTYPE_ADDRESS, 4 
-		 * it expands into 4 types by another function. */
-	IPSECDOI_ID_DER_ASN1_DN,	/* IDTYPE_ASN1DN, 5 */
-};
-
-/*
- * convert idtype to DOI value.
- * OUT	255  : NG
- *	other: converted.
- */
-int
-idtype2doi(idtype)
-	int idtype;
-{
-	if (ARRAYLEN(rm_idtype2doi) > idtype)
-		return rm_idtype2doi[idtype];
-	return 255;
-}
-
-int
-doi2idtype(doi)
-	int doi;
-{
-	switch(doi) {
-	case IPSECDOI_ID_FQDN:
-		return(IDTYPE_FQDN);
-	case IPSECDOI_ID_USER_FQDN:
-		return(IDTYPE_USERFQDN);
-	case IPSECDOI_ID_KEY_ID:
-		return(IDTYPE_KEYID);
-	case IPSECDOI_ID_DER_ASN1_DN:
-		return(IDTYPE_ASN1DN);
-	case IPSECDOI_ID_IPV4_ADDR:
-	case IPSECDOI_ID_IPV4_ADDR_SUBNET:
-	case IPSECDOI_ID_IPV6_ADDR:
-	case IPSECDOI_ID_IPV6_ADDR_SUBNET:
-		return(IDTYPE_ADDRESS);
-	default:
-		plog(LLV_WARNING, LOCATION, NULL,
-			"Inproper idtype:%s in this function.\n",
-			s_ipsecdoi_ident(doi));
-		return(IDTYPE_ADDRESS);	/* XXX */
-	}
-	/*NOTREACHED*/
-}
-
-#ifdef ENABLE_HYBRID
-static int
-switch_authmethod(authmethod)
-	int authmethod;
-{
-	switch(authmethod) {
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R:
-		authmethod = OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I;
-		break;
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R:
-		authmethod = OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I;
-		break;
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
-		authmethod = OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I;
-		break;
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R:
-		authmethod = OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I;
-		break;
-	/* Those are not implemented */
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R:
-		authmethod = OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I;
-		break;
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_R:
-		authmethod = OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_I;
-		break;
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_R:
-		authmethod = OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_I;
-		break;
-	default:
-		break;
-	}
-
-	return authmethod;
-}
-#endif
diff --git a/src/racoon/ipsec_doi.h b/src/racoon/ipsec_doi.h
deleted file mode 100644
index 21dd93d..0000000
--- a/src/racoon/ipsec_doi.h
+++ /dev/null
@@ -1,243 +0,0 @@
-/*	$NetBSD: ipsec_doi.h,v 1.9 2006/12/09 05:52:57 manu Exp $	*/
-
-/* Id: ipsec_doi.h,v 1.15 2006/08/11 16:06:30 vanhu Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _IPSEC_DOI_H
-#define _IPSEC_DOI_H
-
-/* refered to RFC2407 */
-
-#define IPSEC_DOI 1
-
-/* 4.2 IPSEC Situation Definition */
-#define IPSECDOI_SIT_IDENTITY_ONLY           0x00000001
-#define IPSECDOI_SIT_SECRECY                 0x00000002
-#define IPSECDOI_SIT_INTEGRITY               0x00000004
-
-/* 4.4.1 IPSEC Security Protocol Identifiers */
-  /* 4.4.2 IPSEC ISAKMP Transform Values */
-#define IPSECDOI_PROTO_ISAKMP                        1
-#define   IPSECDOI_KEY_IKE                             1
-
-/* 4.4.1 IPSEC Security Protocol Identifiers */
-#define IPSECDOI_PROTO_IPSEC_AH                      2
-  /* 4.4.3 IPSEC AH Transform Values */
-#define   IPSECDOI_AH_MD5                              2
-#define   IPSECDOI_AH_SHA                              3
-#define   IPSECDOI_AH_DES                              4
-#define   IPSECDOI_AH_SHA256                           5
-#define   IPSECDOI_AH_SHA384                           6
-#define   IPSECDOI_AH_SHA512                           7
-
-/* 4.4.1 IPSEC Security Protocol Identifiers */
-#define IPSECDOI_PROTO_IPSEC_ESP                     3
-  /* 4.4.4 IPSEC ESP Transform Identifiers */
-#define   IPSECDOI_ESP_DES_IV64				1
-#define   IPSECDOI_ESP_DES				2
-#define   IPSECDOI_ESP_3DES				3
-#define   IPSECDOI_ESP_RC5				4
-#define   IPSECDOI_ESP_IDEA				5
-#define   IPSECDOI_ESP_CAST				6
-#define   IPSECDOI_ESP_BLOWFISH				7
-#define   IPSECDOI_ESP_3IDEA				8
-#define   IPSECDOI_ESP_DES_IV32				9
-#define   IPSECDOI_ESP_RC4				10
-#define   IPSECDOI_ESP_NULL				11
-#define   IPSECDOI_ESP_AES				12
-#define   IPSECDOI_ESP_CAMELLIA				22
-#if 1
-  /* draft-ietf-ipsec-ciph-aes-cbc-00.txt */
-#define   IPSECDOI_ESP_TWOFISH				253
-#else
-  /* SSH uses these value for now */
-#define   IPSECDOI_ESP_TWOFISH				250
-#endif
-
-/* 4.4.1 IPSEC Security Protocol Identifiers */
-#define IPSECDOI_PROTO_IPCOMP                        4
-  /* 4.4.5 IPSEC IPCOMP Transform Identifiers */
-#define   IPSECDOI_IPCOMP_OUI				1
-#define   IPSECDOI_IPCOMP_DEFLATE			2
-#define   IPSECDOI_IPCOMP_LZS				3
-
-/* 4.5 IPSEC Security Association Attributes */
-/* NOTE: default value is not included in a packet. */
-#define IPSECDOI_ATTR_SA_LD_TYPE              1 /* B */
-#define   IPSECDOI_ATTR_SA_LD_TYPE_DEFAULT      1
-#define   IPSECDOI_ATTR_SA_LD_TYPE_SEC          1
-#define   IPSECDOI_ATTR_SA_LD_TYPE_KB           2
-#define   IPSECDOI_ATTR_SA_LD_TYPE_MAX          3
-#define IPSECDOI_ATTR_SA_LD                   2 /* V */
-#define   IPSECDOI_ATTR_SA_LD_SEC_DEFAULT      28800 /* 8 hours */
-#define   IPSECDOI_ATTR_SA_LD_KB_MAX  (~(1 << ((sizeof(int) << 3) - 1)))
-#define IPSECDOI_ATTR_GRP_DESC                3 /* B */
-#define IPSECDOI_ATTR_ENC_MODE                4 /* B */
-	/* default value: host dependent */
-#define   IPSECDOI_ATTR_ENC_MODE_ANY            0	/* NOTE:internal use */
-#define   IPSECDOI_ATTR_ENC_MODE_TUNNEL         1
-#define   IPSECDOI_ATTR_ENC_MODE_TRNS           2
-
-/* NAT-T draft-ietf-ipsec-nat-t-ike-05 and later */
-#define   IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC	3
-#define   IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC	4
-
-/* NAT-T up to draft-ietf-ipsec-nat-t-ike-04 */
-#define   IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_DRAFT	61443
-#define   IPSECDOI_ATTR_ENC_MODE_UDPTRNS_DRAFT		61444
-
-#define IPSECDOI_ATTR_AUTH                    5 /* B */
-	/* 0 means not to use authentication. */
-#define   IPSECDOI_ATTR_AUTH_HMAC_MD5           1
-#define   IPSECDOI_ATTR_AUTH_HMAC_SHA1          2
-#define   IPSECDOI_ATTR_AUTH_DES_MAC            3
-#define   IPSECDOI_ATTR_AUTH_KPDK               4 /*RFC-1826(Key/Pad/Data/Key)*/
-#define   IPSECDOI_ATTR_AUTH_HMAC_SHA2_256      5
-#define   IPSECDOI_ATTR_AUTH_HMAC_SHA2_384      6
-#define   IPSECDOI_ATTR_AUTH_HMAC_SHA2_512      7
-#define   IPSECDOI_ATTR_AUTH_NONE               254	/* NOTE:internal use */
-	/*
-	 * When negotiating ESP without authentication, the Auth
-	 * Algorithm attribute MUST NOT be included in the proposal.
-	 * When negotiating ESP without confidentiality, the Auth
-	 * Algorithm attribute MUST be included in the proposal and
-	 * the ESP transform ID must be ESP_NULL.
-	*/
-#define IPSECDOI_ATTR_KEY_LENGTH              6 /* B */
-#define IPSECDOI_ATTR_KEY_ROUNDS              7 /* B */
-#define IPSECDOI_ATTR_COMP_DICT_SIZE          8 /* B */
-#define IPSECDOI_ATTR_COMP_PRIVALG            9 /* V */
-
-#ifdef HAVE_SECCTX
-#define IPSECDOI_ATTR_SECCTX		     10 /* V */
-#endif
-
-/* 4.6.1 Security Association Payload */
-struct ipsecdoi_pl_sa {
-	struct isakmp_gen h;
-	struct ipsecdoi_sa_b {
-		u_int32_t doi; /* Domain of Interpretation */
-		u_int32_t sit; /* Situation */
-	} b;
-	/* followed by Leveled Domain Identifier and so on. */
-} __attribute__((__packed__));
-
-struct ipsecdoi_secrecy_h {
-	u_int16_t len;
-	u_int16_t reserved;
-	/* followed by the value */
-} __attribute__((__packed__));
-
-/* 4.6.2 Identification Payload Content */
-struct ipsecdoi_pl_id {
-	struct isakmp_gen h;
-	struct ipsecdoi_id_b {
-		u_int8_t type;		/* ID Type */
-		u_int8_t proto_id;	/* Protocol ID */
-		u_int16_t port;		/* Port */
-	} b;
-	/* followed by Identification Data */
-} __attribute__((__packed__));
-
-#define IPSECDOI_ID_IPV4_ADDR                        1
-#define IPSECDOI_ID_FQDN                             2
-#define IPSECDOI_ID_USER_FQDN                        3
-#define IPSECDOI_ID_IPV4_ADDR_SUBNET                 4
-#define IPSECDOI_ID_IPV6_ADDR                        5
-#define IPSECDOI_ID_IPV6_ADDR_SUBNET                 6
-#define IPSECDOI_ID_IPV4_ADDR_RANGE                  7
-#define IPSECDOI_ID_IPV6_ADDR_RANGE                  8
-#define IPSECDOI_ID_DER_ASN1_DN                      9
-#define IPSECDOI_ID_DER_ASN1_GN                      10
-#define IPSECDOI_ID_KEY_ID                           11
-
-/* compressing doi type, it's internal use. */
-#define IDTYPE_UNDEFINED	0
-#define IDTYPE_FQDN		1
-#define IDTYPE_USERFQDN		2
-#define IDTYPE_KEYID		3
-#define IDTYPE_ADDRESS		4
-#define IDTYPE_ASN1DN		5
-#define IDTYPE_SUBNET		6
-
-/* qualifiers for KEYID (and maybe others) */
-#define IDQUAL_UNSPEC		0
-#define IDQUAL_FILE		1
-#define IDQUAL_TAG		2
-
-/* The use for checking proposal payload. This is not exchange type. */
-#define IPSECDOI_TYPE_PH1	0
-#define IPSECDOI_TYPE_PH2	1
-
-struct isakmpsa;
-struct ipsecdoi_pl_sa;
-struct saprop;
-struct saproto;
-struct satrns;
-struct prop_pair;
-
-extern int ipsecdoi_checkph1proposal __P((vchar_t *, struct ph1handle *));
-extern int ipsecdoi_selectph2proposal __P((struct ph2handle *));
-extern int ipsecdoi_checkph2proposal __P((struct ph2handle *));
-
-extern struct prop_pair **get_proppair __P((vchar_t *, int));
-extern vchar_t *get_sabyproppair __P((struct prop_pair *, struct ph1handle *));
-extern int ipsecdoi_updatespi __P((struct ph2handle *iph2));
-extern vchar_t *get_sabysaprop __P((struct saprop *, vchar_t *));
-extern int ipsecdoi_chkcmpids( const vchar_t *, const vchar_t *, int );
-extern int ipsecdoi_checkid1 __P((struct ph1handle *));
-extern int ipsecdoi_setid1 __P((struct ph1handle *));
-extern int set_identifier __P((vchar_t **, int, vchar_t *));
-extern int set_identifier_qual __P((vchar_t **, int, vchar_t *, int));
-extern int ipsecdoi_setid2 __P((struct ph2handle *));
-extern vchar_t *ipsecdoi_sockaddr2id __P((struct sockaddr *, u_int, u_int));
-extern int ipsecdoi_id2sockaddr __P((vchar_t *, struct sockaddr *,
-	u_int8_t *, u_int16_t *));
-extern char *ipsecdoi_id2str __P((const vchar_t *));
-extern vchar_t *ipsecdoi_sockrange2id __P((	struct sockaddr *,
-	struct sockaddr *, u_int));
-
-extern vchar_t *ipsecdoi_setph1proposal __P((struct isakmpsa *));
-extern int ipsecdoi_setph2proposal __P((struct ph2handle *));
-extern int ipsecdoi_transportmode __P((struct saprop *));
-extern int ipsecdoi_get_defaultlifetime __P((void));
-extern int ipsecdoi_checkalgtypes __P((int, int, int, int));
-extern int ipproto2doi __P((int));
-extern int doi2ipproto __P((int));
-
-extern int ipsecdoi_t2satrns __P((struct isakmp_pl_t *,
-	struct saprop *, struct saproto *, struct satrns *));
-extern int ipsecdoi_authalg2trnsid __P((int));
-extern int idtype2doi __P((int));
-extern int doi2idtype __P((int));
-
-
-#endif /* _IPSEC_DOI_H */
diff --git a/src/racoon/isakmp.c b/src/racoon/isakmp.c
deleted file mode 100644
index b9fc5ee..0000000
--- a/src/racoon/isakmp.c
+++ /dev/null
@@ -1,3643 +0,0 @@
-/*	$NetBSD: isakmp.c,v 1.20.6.13 2008/09/25 09:34:39 vanhu Exp $	*/
-
-/* Id: isakmp.c,v 1.74 2006/05/07 21:32:59 manubsd Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/socket.h>
-#include <sys/queue.h>
-
-#include <netinet/in.h>
-#include <arpa/inet.h>
-
-#include PATH_IPSEC_H
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-#if TIME_WITH_SYS_TIME
-# include <sys/time.h>
-# include <time.h>
-#else
-# if HAVE_SYS_TIME_H
-#  include <sys/time.h>
-# else
-#  include <time.h>
-# endif
-#endif
-#include <netdb.h>
-#ifdef HAVE_UNISTD_H
-#include <unistd.h>
-#endif
-#include <ctype.h>
-#ifdef ENABLE_HYBRID
-#include <resolv.h>
-#endif
-
-#include "var.h"
-#include "misc.h"
-#include "vmbuf.h"
-#include "plog.h"
-#include "sockmisc.h"
-#include "schedule.h"
-#include "debug.h"
-
-#include "remoteconf.h"
-#include "localconf.h"
-#include "grabmyaddr.h"
-#include "admin.h"
-#include "privsep.h"
-#include "isakmp_var.h"
-#include "isakmp.h"
-#include "oakley.h"
-#include "evt.h"
-#include "handler.h"
-#include "ipsec_doi.h"
-#include "pfkey.h"
-#include "crypto_openssl.h"
-#include "policy.h"
-#include "isakmp_ident.h"
-#include "isakmp_agg.h"
-#include "isakmp_base.h"
-#include "isakmp_quick.h"
-#include "isakmp_inf.h"
-#include "isakmp_newg.h"
-#ifdef ENABLE_HYBRID
-#include "vendorid.h"
-#include "isakmp_xauth.h"
-#include "isakmp_unity.h"
-#include "isakmp_cfg.h"
-#endif
-#ifdef ENABLE_FRAG
-#include "isakmp_frag.h"
-#endif
-#include "strnames.h"
-
-#include <fcntl.h>
-
-#ifdef ENABLE_NATT
-# include "nattraversal.h"
-#endif
-# ifdef __linux__
-#  include <linux/udp.h>
-#  include <linux/ip.h>
-#  ifndef SOL_UDP
-#   define SOL_UDP 17
-#  endif
-#if defined(__ANDROID__)
-#include <netinet/udp.h>
-#endif
-# endif /* __linux__ */
-# if defined(__NetBSD__) || defined(__FreeBSD__) ||	\
-  (defined(__APPLE__) && defined(__MACH__))
-#  include <netinet/in.h>
-#  include <netinet/udp.h>
-#  include <netinet/in_systm.h>
-#  include <netinet/ip.h>
-#  define SOL_UDP IPPROTO_UDP
-# endif /* __NetBSD__ / __FreeBSD__ */
-
-#ifdef ANDROID_CHANGES
-#include "NetdClient.h"
-#endif
-
-static int nostate1 __P((struct ph1handle *, vchar_t *));
-static int nostate2 __P((struct ph2handle *, vchar_t *));
-
-extern caddr_t val2str(const char *, size_t);
-
-static int (*ph1exchange[][2][PHASE1ST_MAX])
-	__P((struct ph1handle *, vchar_t *)) = {
- /* error */
- { {}, {}, },
- /* Identity Protection exchange */
- {
-  { nostate1, ident_i1send, nostate1, ident_i2recv, ident_i2send,
-    ident_i3recv, ident_i3send, ident_i4recv, ident_i4send, nostate1, },
-  { nostate1, ident_r1recv, ident_r1send, ident_r2recv, ident_r2send,
-    ident_r3recv, ident_r3send, nostate1, nostate1, nostate1, },
- },
- /* Aggressive exchange */
- {
-  { nostate1, agg_i1send, nostate1, agg_i2recv, agg_i2send,
-    nostate1, nostate1, nostate1, nostate1, nostate1, },
-  { nostate1, agg_r1recv, agg_r1send, agg_r2recv, agg_r2send,
-    nostate1, nostate1, nostate1, nostate1, nostate1, },
- },
- /* Base exchange */
- {
-  { nostate1, base_i1send, nostate1, base_i2recv, base_i2send,
-    base_i3recv, base_i3send, nostate1, nostate1, nostate1, },
-  { nostate1, base_r1recv, base_r1send, base_r2recv, base_r2send,
-    nostate1, nostate1, nostate1, nostate1, nostate1, },
- },
-};
-
-static int (*ph2exchange[][2][PHASE2ST_MAX])
-	__P((struct ph2handle *, vchar_t *)) = {
- /* error */
- { {}, {}, },
- /* Quick mode for IKE */
- {
-  { nostate2, nostate2, quick_i1prep, nostate2, quick_i1send,
-    quick_i2recv, quick_i2send, quick_i3recv, nostate2, nostate2, },
-  { nostate2, quick_r1recv, quick_r1prep, nostate2, quick_r2send,
-    quick_r3recv, quick_r3prep, quick_r3send, nostate2, nostate2, }
- },
-};
-
-static u_char r_ck0[] = { 0,0,0,0,0,0,0,0 }; /* used to verify the r_ck. */
- 
-static int isakmp_main __P((vchar_t *, struct sockaddr *, struct sockaddr *));
-static int ph1_main __P((struct ph1handle *, vchar_t *));
-static int quick_main __P((struct ph2handle *, vchar_t *));
-static int isakmp_ph1begin_r __P((vchar_t *,
-	struct sockaddr *, struct sockaddr *, u_int8_t));
-static int isakmp_ph2begin_i __P((struct ph1handle *, struct ph2handle *));
-static int isakmp_ph2begin_r __P((struct ph1handle *, vchar_t *));
-static int etypesw1 __P((int));
-static int etypesw2 __P((int));
-#ifdef ENABLE_FRAG
-static int frag_handler(struct ph1handle *, 
-    vchar_t *, struct sockaddr *, struct sockaddr *);
-#endif
-
-/*
- * isakmp packet handler
- */
-int
-isakmp_handler(so_isakmp)
-	int so_isakmp;
-{
-	struct isakmp isakmp;
-	union {
-		char		buf[sizeof (isakmp) + 4];
-		u_int32_t	non_esp[2];
-		char		lbuf[sizeof(struct udphdr) + 
-#ifdef __linux
-				     sizeof(struct iphdr) + 
-#else
-				     sizeof(struct ip) + 
-#endif
-				     sizeof(isakmp) + 4];
-	} x;
-	struct sockaddr_storage remote;
-	struct sockaddr_storage local;
-	unsigned int remote_len = sizeof(remote);
-	unsigned int local_len = sizeof(local);
-	int len = 0, extralen = 0;
-	vchar_t *buf = NULL, *tmpbuf = NULL;
-	int error = -1, res;
-
-	/* read message by MSG_PEEK */
-	while ((len = recvfromto(so_isakmp, x.buf, sizeof(x),
-		    MSG_PEEK, (struct sockaddr *)&remote, &remote_len,
-		    (struct sockaddr *)&local, &local_len)) < 0) {
-		if (errno == EINTR)
-			continue;
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to receive isakmp packet: %s\n",
-			strerror (errno));
-		goto end;
-	}
-
-	/* keep-alive packet - ignore */
-	if (len == 1 && (x.buf[0]&0xff) == 0xff) {
-		/* Pull the keep-alive packet */
-		if ((len = recvfrom(so_isakmp, (char *)x.buf, 1,
-		    0, (struct sockaddr *)&remote, &remote_len)) != 1) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "failed to receive keep alive packet: %s\n",
-			    strerror (errno));
-		}
-		goto end;
-	}
-
-	/* Lucent IKE in UDP encapsulation */
-	{
-		struct udphdr *udp;
-#ifdef __linux__
-		struct iphdr *ip;
-
-		udp = (struct udphdr *)&x.lbuf[0];
-		if (ntohs(udp->dest) == 501) {
-			ip = (struct iphdr *)(x.lbuf + sizeof(*udp));
-			extralen += sizeof(*udp) + ip->ihl;
-		}
-#else
-		struct ip *ip;
-
-		udp = (struct udphdr *)&x.lbuf[0];
-		if (ntohs(udp->uh_dport) == 501) {
-			ip = (struct ip *)(x.lbuf + sizeof(*udp));
-			extralen += sizeof(*udp) + ip->ip_hl;
-		}
-#endif
-	}	
-
-#ifdef ENABLE_NATT
-	/* we don't know about portchange yet, 
-	   look for non-esp marker instead */
-	if (x.non_esp[0] == 0 && x.non_esp[1] != 0)
-		extralen = NON_ESP_MARKER_LEN;
-#endif
-
-	/* now we know if there is an extra non-esp 
-	   marker at the beginning or not */
-	memcpy ((char *)&isakmp, x.buf + extralen, sizeof (isakmp));
-
-	/* check isakmp header length, as well as sanity of header length */
-	if (len < sizeof(isakmp) || ntohl(isakmp.len) < sizeof(isakmp)) {
-		plog(LLV_ERROR, LOCATION, (struct sockaddr *)&remote,
-			"packet shorter than isakmp header size (%u, %u, %zu)\n",
-			len, ntohl(isakmp.len), sizeof(isakmp));
-		/* dummy receive */
-		if ((len = recvfrom(so_isakmp, (char *)&isakmp, sizeof(isakmp),
-			    0, (struct sockaddr *)&remote, &remote_len)) < 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to receive isakmp packet: %s\n",
-				strerror (errno));
-		}
-		goto end;
-	}
-
-	/* reject it if the size is tooooo big. */
-	if (ntohl(isakmp.len) > 0xffff) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"the length in the isakmp header is too big.\n");
-		if ((len = recvfrom(so_isakmp, (char *)&isakmp, sizeof(isakmp),
-			    0, (struct sockaddr *)&remote, &remote_len)) < 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to receive isakmp packet: %s\n",
-				strerror (errno));
-		}
-		goto end;
-	}
-
-	/* read real message */
-	if ((tmpbuf = vmalloc(ntohl(isakmp.len) + extralen)) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to allocate reading buffer (%u Bytes)\n",
-			ntohl(isakmp.len) + extralen);
-		/* dummy receive */
-		if ((len = recvfrom(so_isakmp, (char *)&isakmp, sizeof(isakmp),
-			    0, (struct sockaddr *)&remote, &remote_len)) < 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to receive isakmp packet: %s\n", 
-				strerror (errno));
-		}
-		goto end;
-	}
-
-	while ((len = recvfromto(so_isakmp, (char *)tmpbuf->v, tmpbuf->l,
-	                    0, (struct sockaddr *)&remote, &remote_len,
-	                    (struct sockaddr *)&local, &local_len)) < 0) {
-		if (errno == EINTR)
-			continue;
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to receive isakmp packet: %s\n",
-			strerror (errno));
-		goto end;
-	}
-
-	if ((buf = vmalloc(len - extralen)) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to allocate reading buffer (%u Bytes)\n",
-			(len - extralen));
-		goto end;
-	}
-	
-	memcpy (buf->v, tmpbuf->v + extralen, buf->l);
-
-	len -= extralen;
-	
-	if (len != buf->l) {
-		plog(LLV_ERROR, LOCATION, (struct sockaddr *)&remote,
-			"received invalid length (%d != %zu), why ?\n",
-			len, buf->l);
-		goto end;
-	}
-
-	plog(LLV_DEBUG, LOCATION, NULL, "===\n");
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"%d bytes message received %s\n",
-		len, saddr2str_fromto("from %s to %s", 
-			(struct sockaddr *)&remote,
-			(struct sockaddr *)&local));
-	plogdump(LLV_DEBUG, buf->v, buf->l);
-
-	/* avoid packets with malicious port/address */
-	if (extract_port((struct sockaddr *)&remote) == 0) {
-		plog(LLV_ERROR, LOCATION, (struct sockaddr *)&remote,
-			"src port == 0 (valid as UDP but not with IKE)\n");
-		goto end;
-	}
-
-	/* XXX: check sender whether to be allowed or not to accept */
-
-	/* XXX: I don't know how to check isakmp half connection attack. */
-
-	/* simply reply if the packet was processed. */
-	res=check_recvdpkt((struct sockaddr *)&remote,(struct sockaddr *)&local, buf);
-	if (res) {
-		plog(LLV_NOTIFY, LOCATION, NULL,
-			"the packet is retransmitted by %s (%d).\n",
-			 saddr2str((struct sockaddr *)&remote), res);
-		error = 0;
-		goto end;
-	}
-
-	/* isakmp main routine */
-	if (isakmp_main(buf, (struct sockaddr *)&remote,
-			(struct sockaddr *)&local) != 0) goto end;
-
-	error = 0;
-
-end:
-	if (tmpbuf != NULL)
-		vfree(tmpbuf);
-	if (buf != NULL)
-		vfree(buf);
-
-	return(error);
-}
-
-/*
- * main processing to handle isakmp payload
- */
-static int
-isakmp_main(msg, remote, local)
-	vchar_t *msg;
-	struct sockaddr *remote, *local;
-{
-	struct isakmp *isakmp = (struct isakmp *)msg->v;
-	isakmp_index *index = (isakmp_index *)isakmp;
-	u_int32_t msgid = isakmp->msgid;
-	struct ph1handle *iph1;
-
-#ifdef HAVE_PRINT_ISAKMP_C
-	isakmp_printpacket(msg, remote, local, 0);
-#endif
-
-	/* the initiator's cookie must not be zero */
-	if (memcmp(&isakmp->i_ck, r_ck0, sizeof(cookie_t)) == 0) {
-		plog(LLV_ERROR, LOCATION, remote,
-			"malformed cookie received.\n");
-		return -1;
-	}
-
-	/* Check the Major and Minor Version fields. */
-	/*
-	 * XXX Is is right to check version here ?
-	 * I think it may no be here because the version depends
-	 * on exchange status.
-	 */
-	if (isakmp->v < ISAKMP_VERSION_NUMBER) {
-		if (ISAKMP_GETMAJORV(isakmp->v) < ISAKMP_MAJOR_VERSION) {
-			plog(LLV_ERROR, LOCATION, remote,
-				"invalid major version %d.\n",
-				ISAKMP_GETMAJORV(isakmp->v));
-			return -1;
-		}
-#if ISAKMP_MINOR_VERSION > 0
-		if (ISAKMP_GETMINORV(isakmp->v) < ISAKMP_MINOR_VERSION) {
-			plog(LLV_ERROR, LOCATION, remote,
-				"invalid minor version %d.\n",
-				ISAKMP_GETMINORV(isakmp->v));
-			return -1;
-		}
-#endif
-	}
-
-	/* check the Flags field. */
-	/* XXX How is the exclusive check, E and A ? */
-	if (isakmp->flags & ~(ISAKMP_FLAG_E | ISAKMP_FLAG_C | ISAKMP_FLAG_A)) {
-		plog(LLV_ERROR, LOCATION, remote,
-			"invalid flag 0x%02x.\n", isakmp->flags);
-		return -1;
-	}
-
-	/* ignore commit bit. */
-	if (ISSET(isakmp->flags, ISAKMP_FLAG_C)) {
-		if (isakmp->msgid == 0) {
-			isakmp_info_send_nx(isakmp, remote, local,
-				ISAKMP_NTYPE_INVALID_FLAGS, NULL);
-			plog(LLV_ERROR, LOCATION, remote,
-				"Commit bit on phase1 forbidden.\n");
-			return -1;
-		}
-	}
-
-	iph1 = getph1byindex(index);
-	if (iph1 != NULL) {
-		/* validity check */
-		if (memcmp(&isakmp->r_ck, r_ck0, sizeof(cookie_t)) == 0 &&
-		    iph1->side == INITIATOR) {
-			plog(LLV_DEBUG, LOCATION, remote,
-				"malformed cookie received or "
-				"the initiator's cookies collide.\n");
-			return -1;
-		}
-
-#ifdef ENABLE_NATT
-		/* Floating ports for NAT-T */
-		if (NATT_AVAILABLE(iph1) &&
-		    ! (iph1->natt_flags & NAT_PORTS_CHANGED) &&
-		    ((cmpsaddrstrict(iph1->remote, remote) != 0) ||
-		    (cmpsaddrstrict(iph1->local, local) != 0)))
-		{
-			/* prevent memory leak */
-			racoon_free(iph1->remote);
-			racoon_free(iph1->local);
-			iph1->remote = NULL;
-			iph1->local = NULL;
-
-			/* copy-in new addresses */
-			iph1->remote = dupsaddr(remote);
-			if (iph1->remote == NULL) {
-           			plog(LLV_ERROR, LOCATION, iph1->remote,
-				   "phase1 failed: dupsaddr failed.\n");
-				remph1(iph1);
-				delph1(iph1);
-				return -1;
-			}
-			iph1->local = dupsaddr(local);
-			if (iph1->local == NULL) {
-           			plog(LLV_ERROR, LOCATION, iph1->remote,
-				   "phase1 failed: dupsaddr failed.\n");
-				remph1(iph1);
-				delph1(iph1);
-				return -1;
-			}
-
-			/* set the flag to prevent further port floating
-			   (FIXME: should we allow it? E.g. when the NAT gw 
-			    is rebooted?) */
-			iph1->natt_flags |= NAT_PORTS_CHANGED | NAT_ADD_NON_ESP_MARKER;
-			
-			/* print some neat info */
-			plog (LLV_INFO, LOCATION, NULL, 
-			      "NAT-T: ports changed to: %s\n",
-			      saddr2str_fromto ("%s<->%s", iph1->remote, iph1->local));
-
-			natt_keepalive_add_ph1 (iph1);
-		}
-#endif
-
-		/* must be same addresses in one stream of a phase at least. */
-		if (cmpsaddrstrict(iph1->remote, remote) != 0) {
-			char *saddr_db, *saddr_act;
-
-			saddr_db = racoon_strdup(saddr2str(iph1->remote));
-			saddr_act = racoon_strdup(saddr2str(remote));
-			STRDUP_FATAL(saddr_db);
-			STRDUP_FATAL(saddr_act);
-
-			plog(LLV_WARNING, LOCATION, remote,
-				"remote address mismatched. db=%s, act=%s\n",
-				saddr_db, saddr_act);
-
-			racoon_free(saddr_db);
-			racoon_free(saddr_act);
-		}
-
-		/*
-		 * don't check of exchange type here because other type will be
-		 * with same index, for example, informational exchange.
-		 */
-
-		/* XXX more acceptable check */
-	}
-
-	switch (isakmp->etype) {
-	case ISAKMP_ETYPE_IDENT:
-	case ISAKMP_ETYPE_AGG:
-	case ISAKMP_ETYPE_BASE:
-		/* phase 1 validity check */
-		if (isakmp->msgid != 0) {
-			plog(LLV_ERROR, LOCATION, remote,
-				"message id should be zero in phase1.\n");
-			return -1;
-		}
-
-		/* search for isakmp status record of phase 1 */
-		if (iph1 == NULL) {
-			/*
-			 * the packet must be the 1st message from a initiator
-			 * or the 2nd message from the responder.
-			 */
-
-			/* search for phase1 handle by index without r_ck */
-			iph1 = getph1byindex0(index);
-			if (iph1 == NULL) {
-				/*it must be the 1st message from a initiator.*/
-				if (memcmp(&isakmp->r_ck, r_ck0,
-					sizeof(cookie_t)) != 0) {
-
-					plog(LLV_DEBUG, LOCATION, remote,
-						"malformed cookie received "
-						"or the spi expired.\n");
-					return -1;
-				}
-
-				/* it must be responder's 1st exchange. */
-				if (isakmp_ph1begin_r(msg, remote, local,
-					isakmp->etype) < 0)
-					return -1;
-				break;
-
-				/*NOTREACHED*/
-			}
-
-			/* it must be the 2nd message from the responder. */
-			if (iph1->side != INITIATOR) {
-				plog(LLV_DEBUG, LOCATION, remote,
-					"malformed cookie received. "
-					"it has to be as the initiator.  %s\n",
-					isakmp_pindex(&iph1->index, 0));
-				return -1;
-			}
-		}
-
-		/*
-		 * Don't delete phase 1 handler when the exchange type
-		 * in handler is not equal to packet's one because of no
-		 * authencication completed.
-		 */
-		if (iph1->etype != isakmp->etype) {
-			plog(LLV_ERROR, LOCATION, iph1->remote,
-				"exchange type is mismatched: "
-				"db=%s packet=%s, ignore it.\n",
-				s_isakmp_etype(iph1->etype),
-				s_isakmp_etype(isakmp->etype));
-			return -1;
-		}
-
-#ifdef ENABLE_FRAG
-		if (isakmp->np == ISAKMP_NPTYPE_FRAG)
-			return frag_handler(iph1, msg, remote, local);
-#endif
-
-		/* call main process of phase 1 */
-		if (ph1_main(iph1, msg) < 0) {
-			plog(LLV_ERROR, LOCATION, iph1->remote,
-				"phase1 negotiation failed.\n");
-			remph1(iph1);
-			delph1(iph1);
-			return -1;
-		}
-		break;
-
-	case ISAKMP_ETYPE_AUTH:
-		plog(LLV_INFO, LOCATION, remote,
-			"unsupported exchange %d received.\n",
-			isakmp->etype);
-		break;
-
-	case ISAKMP_ETYPE_INFO:
-	case ISAKMP_ETYPE_ACKINFO:
-		/*
-		 * iph1 must be present for Information message.
-		 * if iph1 is null then trying to get the phase1 status
-		 * as the packet from responder againt initiator's 1st
-		 * exchange in phase 1.
-		 * NOTE: We think such informational exchange should be ignored.
-		 */
-		if (iph1 == NULL) {
-			iph1 = getph1byindex0(index);
-			if (iph1 == NULL) {
-				plog(LLV_ERROR, LOCATION, remote,
-					"unknown Informational "
-					"exchange received.\n");
-				return -1;
-			}
-			if (cmpsaddrstrict(iph1->remote, remote) != 0) {
-				plog(LLV_WARNING, LOCATION, remote,
-					"remote address mismatched. "
-					"db=%s\n",
-					saddr2str(iph1->remote));
-			}
-		}
-
-#ifdef ENABLE_FRAG
-		if (isakmp->np == ISAKMP_NPTYPE_FRAG)
-			return frag_handler(iph1, msg, remote, local);
-#endif
-
-		if (isakmp_info_recv(iph1, msg) < 0)
-			return -1;
-		break;
-
-	case ISAKMP_ETYPE_QUICK:
-	{
-		struct ph2handle *iph2;
-
-		if (iph1 == NULL) {
-			isakmp_info_send_nx(isakmp, remote, local,
-				ISAKMP_NTYPE_INVALID_COOKIE, NULL);
-			plog(LLV_ERROR, LOCATION, remote,
-				"can't start the quick mode, "
-				"there is no ISAKMP-SA, %s\n",
-				isakmp_pindex((isakmp_index *)&isakmp->i_ck,
-					isakmp->msgid));
-			return -1;
-		}
-#ifdef ENABLE_HYBRID
-		/* Reinit the IVM if it's still there */		
-		if (iph1->mode_cfg && iph1->mode_cfg->ivm) {
-			oakley_delivm(iph1->mode_cfg->ivm);
-			iph1->mode_cfg->ivm = NULL;
-		}
-#endif
-#ifdef ENABLE_FRAG
-		if (isakmp->np == ISAKMP_NPTYPE_FRAG)
-			return frag_handler(iph1, msg, remote, local);
-#endif
-
-		/* check status of phase 1 whether negotiated or not. */
-		if (iph1->status != PHASE1ST_ESTABLISHED) {
-			plog(LLV_ERROR, LOCATION, remote,
-				"can't start the quick mode, "
-				"there is no valid ISAKMP-SA, %s\n",
-				isakmp_pindex(&iph1->index, iph1->msgid));
-			return -1;
-		}
-
-		/* search isakmp phase 2 stauts record. */
-		iph2 = getph2bymsgid(iph1, msgid);
-		if (iph2 == NULL) {
-			/* it must be new negotiation as responder */
-			if (isakmp_ph2begin_r(iph1, msg) < 0)
-				return -1;
-			return 0;
-			/*NOTREACHED*/
-		}
-
-		/* commit bit. */
-		/* XXX
-		 * we keep to set commit bit during negotiation.
-		 * When SA is configured, bit will be reset.
-		 * XXX
-		 * don't initiate commit bit.  should be fixed in the future.
-		 */
-		if (ISSET(isakmp->flags, ISAKMP_FLAG_C))
-			iph2->flags |= ISAKMP_FLAG_C;
-
-		/* call main process of quick mode */
-		if (quick_main(iph2, msg) < 0) {
-			plog(LLV_ERROR, LOCATION, iph1->remote,
-				"phase2 negotiation failed.\n");
-			unbindph12(iph2);
-			remph2(iph2);
-			delph2(iph2);
-			return -1;
-		}
-	}
-		break;
-
-	case ISAKMP_ETYPE_NEWGRP:
-		if (iph1 == NULL) {
-			plog(LLV_ERROR, LOCATION, remote,
-				"Unknown new group mode exchange, "
-				"there is no ISAKMP-SA.\n");
-			return -1;
-		}
-
-#ifdef ENABLE_FRAG
-		if (isakmp->np == ISAKMP_NPTYPE_FRAG)
-			return frag_handler(iph1, msg, remote, local);
-#endif
-
-		isakmp_newgroup_r(iph1, msg);
-		break;
-
-#ifdef ENABLE_HYBRID
-	case ISAKMP_ETYPE_CFG:
-		if (iph1 == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			     "mode config %d from %s, "
-			     "but we have no ISAKMP-SA.\n",
-			     isakmp->etype, saddr2str(remote));
-			return -1;
-		}
-
-#ifdef ENABLE_FRAG
-		if (isakmp->np == ISAKMP_NPTYPE_FRAG)
-			return frag_handler(iph1, msg, remote, local);
-#endif
-
-		isakmp_cfg_r(iph1, msg);
-		break;
-#endif	 
-
-	case ISAKMP_ETYPE_NONE:
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"Invalid exchange type %d from %s.\n",
-			isakmp->etype, saddr2str(remote));
-		return -1;
-	}
-
-	return 0;
-}
-
-/*
- * main function of phase 1.
- */
-static int
-ph1_main(iph1, msg)
-	struct ph1handle *iph1;
-	vchar_t *msg;
-{
-	int error;
-#ifdef ENABLE_STATS
-	struct timeval start, end;
-#endif
-
-	/* ignore a packet */
-	if (iph1->status == PHASE1ST_ESTABLISHED)
-		return 0;
-
-#ifdef ENABLE_STATS
-	gettimeofday(&start, NULL);
-#endif
-	/* receive */
-	if (ph1exchange[etypesw1(iph1->etype)]
-		       [iph1->side]
-		       [iph1->status] == NULL) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"why isn't the function defined.\n");
-		return -1;
-	}
-	error = (ph1exchange[etypesw1(iph1->etype)]
-			    [iph1->side]
-			    [iph1->status])(iph1, msg);
-	if (error != 0) {
-
-		/* XXX
-		 * When an invalid packet is received on phase1, it should
-		 * be selected to process this packet.  That is to respond
-		 * with a notify and delete phase 1 handler, OR not to respond
-		 * and keep phase 1 handler. However, in PHASE1ST_START when
-		 * acting as RESPONDER we must not keep phase 1 handler or else
-		 * it will stay forever.
-		 */
-
-		if (iph1->side == RESPONDER && iph1->status == PHASE1ST_START) {
-			plog(LLV_ERROR, LOCATION, iph1->remote,
-				"failed to pre-process packet.\n");
-			return -1;
-		} else {
-			/* ignore the error and keep phase 1 handler */
-			return 0;
-		}
-	}
-
-#ifndef ENABLE_FRAG
-	/* free resend buffer */
-	if (iph1->sendbuf == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"no buffer found as sendbuf\n"); 
-		return -1;
-	}
-#endif
-
-	VPTRINIT(iph1->sendbuf);
-
-	/* turn off schedule */
-	SCHED_KILL(iph1->scr);
-
-	/* send */
-	plog(LLV_DEBUG, LOCATION, NULL, "===\n");
-	if ((ph1exchange[etypesw1(iph1->etype)]
-			[iph1->side]
-			[iph1->status])(iph1, msg) != 0) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"failed to process packet.\n");
-		return -1;
-	}
-
-#ifdef ENABLE_STATS
-	gettimeofday(&end, NULL);
-	syslog(LOG_NOTICE, "%s(%s): %8.6f",
-		"phase1", s_isakmp_state(iph1->etype, iph1->side, iph1->status),
-		timedelta(&start, &end));
-#endif
-	if (iph1->status == PHASE1ST_ESTABLISHED) {
-
-#ifdef ENABLE_STATS
-		gettimeofday(&iph1->end, NULL);
-		syslog(LOG_NOTICE, "%s(%s): %8.6f",
-			"phase1", s_isakmp_etype(iph1->etype),
-			timedelta(&iph1->start, &iph1->end));
-#endif
-
-		/* save created date. */
-		(void)time(&iph1->created);
-
-		/* add to the schedule to expire, and seve back pointer. */
-		iph1->sce = sched_new(iph1->approval->lifetime,
-		    isakmp_ph1expire_stub, iph1);
-#ifdef ENABLE_HYBRID
-		if (iph1->mode_cfg->flags & ISAKMP_CFG_VENDORID_XAUTH) {
-			switch(AUTHMETHOD(iph1)) {
-			case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R:
-			case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R:
-			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
-			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R:
-			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R:
-			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_R:
-			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_R:
-				xauth_sendreq(iph1);
-				/* XXX Don't process INITIAL_CONTACT */
-				iph1->rmconf->ini_contact = 0;
-				break;
-			default:
-				break;
-			}
-		}
-#endif
-#ifdef ENABLE_DPD
-		/* Schedule the r_u_there.... */
-		if(iph1->dpd_support && iph1->rmconf->dpd_interval)
-			isakmp_sched_r_u(iph1, 0);
-#endif
-
-		/* INITIAL-CONTACT processing */
-		/* don't anything if local test mode. */
-		if (!f_local
-		 && iph1->rmconf->ini_contact && !getcontacted(iph1->remote)) {
-			/* send INITIAL-CONTACT */
-			isakmp_info_send_n1(iph1,
-					ISAKMP_NTYPE_INITIAL_CONTACT, NULL);
-			/* insert a node into contacted list. */
-			if (inscontacted(iph1->remote) == -1) {
-				plog(LLV_ERROR, LOCATION, iph1->remote,
-					"failed to add contacted list.\n");
-				/* ignore */
-			}
-		}
-
-		log_ph1established(iph1);
-		plog(LLV_DEBUG, LOCATION, NULL, "===\n");
-
-		/* 
-		 * SA up shell script hook: do it now,except if
-		 * ISAKMP mode config was requested. In the later
-		 * case it is done when we receive the configuration.
-		 */
-		if ((iph1->status == PHASE1ST_ESTABLISHED) &&
-		    !iph1->rmconf->mode_cfg) { 
-			switch (AUTHMETHOD(iph1)) {
-#ifdef ENABLE_HYBRID
-			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
-			case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R:
-			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R:
-			/* Unimplemeted... */
-			case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R:
-			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R:
-			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_R:
-			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_R:
-				break;
-#endif
-			default:
-				script_hook(iph1, SCRIPT_PHASE1_UP);
-				break;
-			}
-		}
-	}
-
-	return 0;
-}
-
-/*
- * main function of quick mode.
- */
-static int
-quick_main(iph2, msg)
-	struct ph2handle *iph2;
-	vchar_t *msg;
-{
-	struct isakmp *isakmp = (struct isakmp *)msg->v;
-	int error;
-#ifdef ENABLE_STATS
-	struct timeval start, end;
-#endif
-
-	/* ignore a packet */
-	if (iph2->status == PHASE2ST_ESTABLISHED
-	 || iph2->status == PHASE2ST_GETSPISENT)
-		return 0;
-
-#ifdef ENABLE_STATS
-	gettimeofday(&start, NULL);
-#endif
-
-	/* receive */
-	if (ph2exchange[etypesw2(isakmp->etype)]
-		       [iph2->side]
-		       [iph2->status] == NULL) {
-		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-			"why isn't the function defined.\n");
-		return -1;
-	}
-	error = (ph2exchange[etypesw2(isakmp->etype)]
-			    [iph2->side]
-			    [iph2->status])(iph2, msg);
-	if (error != 0) {
-		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-			"failed to pre-process packet.\n");
-		if (error == ISAKMP_INTERNAL_ERROR)
-			return 0;
-		isakmp_info_send_n1(iph2->ph1, error, NULL);
-		return -1;
-	}
-
-	/* when using commit bit, status will be reached here. */
-	if (iph2->status == PHASE2ST_ADDSA)
-		return 0;
-
-	/* free resend buffer */
-	if (iph2->sendbuf == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"no buffer found as sendbuf\n"); 
-		return -1;
-	}
-	VPTRINIT(iph2->sendbuf);
-
-	/* turn off schedule */
-	SCHED_KILL(iph2->scr);
-
-	/* send */
-	plog(LLV_DEBUG, LOCATION, NULL, "===\n");
-	if ((ph2exchange[etypesw2(isakmp->etype)]
-			[iph2->side]
-			[iph2->status])(iph2, msg) != 0) {
-		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-			"failed to process packet.\n");
-		return -1;
-	}
-
-#ifdef ENABLE_STATS
-	gettimeofday(&end, NULL);
-	syslog(LOG_NOTICE, "%s(%s): %8.6f",
-		"phase2",
-		s_isakmp_state(ISAKMP_ETYPE_QUICK, iph2->side, iph2->status),
-		timedelta(&start, &end));
-#endif
-
-	return 0;
-}
-
-/* new negotiation of phase 1 for initiator */
-int
-isakmp_ph1begin_i(rmconf, remote, local)
-	struct remoteconf *rmconf;
-	struct sockaddr *remote, *local;
-{
-	struct ph1handle *iph1;
-#ifdef ENABLE_STATS
-	struct timeval start, end;
-#endif
-
-	/* get new entry to isakmp status table. */
-	iph1 = newph1();
-	if (iph1 == NULL)
-		return -1;
-
-	iph1->status = PHASE1ST_START;
-	iph1->rmconf = rmconf;
-	iph1->side = INITIATOR;
-	iph1->version = ISAKMP_VERSION_NUMBER;
-	iph1->msgid = 0;
-	iph1->flags = 0;
-	iph1->ph2cnt = 0;
-#ifdef HAVE_GSSAPI
-	iph1->gssapi_state = NULL;
-#endif
-#ifdef ENABLE_HYBRID
-	if ((iph1->mode_cfg = isakmp_cfg_mkstate()) == NULL) {
-		delph1(iph1);
-		return -1;
-	}
-#endif
-#ifdef ENABLE_FRAG
-
-	if(rmconf->ike_frag == ISAKMP_FRAG_FORCE)
-		iph1->frag = 1;
-	else
-		iph1->frag = 0;
-	iph1->frag_chain = NULL;
-#endif
-	iph1->approval = NULL;
-
-	/* XXX copy remote address */
-	if (copy_ph1addresses(iph1, rmconf, remote, local) < 0) {
-		delph1(iph1);
-		return -1;
-	}
-
-	(void)insph1(iph1);
-
-	/* start phase 1 exchange */
-	iph1->etype = rmconf->etypes->type;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "===\n");
-    {
-	char *a;
-
-	a = racoon_strdup(saddr2str(iph1->local));
-	STRDUP_FATAL(a);
-
-	plog(LLV_INFO, LOCATION, NULL,
-		"initiate new phase 1 negotiation: %s<=>%s\n",
-		a, saddr2str(iph1->remote));
-	racoon_free(a);
-    }
-	plog(LLV_INFO, LOCATION, NULL,
-		"begin %s mode.\n",
-		s_isakmp_etype(iph1->etype));
-
-#ifdef ENABLE_STATS
-	gettimeofday(&iph1->start, NULL);
-	gettimeofday(&start, NULL);
-#endif
-	/* start exchange */
-	if ((ph1exchange[etypesw1(iph1->etype)]
-			[iph1->side]
-			[iph1->status])(iph1, NULL) != 0) {
-		/* failed to start phase 1 negotiation */
-		remph1(iph1);
-		delph1(iph1);
-
-		return -1;
-	}
-
-#ifdef ENABLE_STATS
-	gettimeofday(&end, NULL);
-	syslog(LOG_NOTICE, "%s(%s): %8.6f",
-		"phase1",
-		s_isakmp_state(iph1->etype, iph1->side, iph1->status),
-		timedelta(&start, &end));
-#endif
-
-	return 0;
-}
-
-/* new negotiation of phase 1 for responder */
-static int
-isakmp_ph1begin_r(vchar_t *msg, struct sockaddr *remote,
-                  struct sockaddr *local, u_int8_t etype)
-{
-	struct isakmp *isakmp = (struct isakmp *)msg->v;
-	struct remoteconf *rmconf;
-	struct ph1handle *iph1;
-	struct etypes *etypeok;
-#ifdef ENABLE_STATS
-	struct timeval start, end;
-#endif
-
-	/* look for my configuration */
-	rmconf = getrmconf(remote);
-	if (rmconf == NULL) {
-		plog(LLV_ERROR, LOCATION, remote,
-			"couldn't find "
-			"configuration.\n");
-		return -1;
-	}
-
-	/* check to be acceptable exchange type */
-	etypeok = check_etypeok(rmconf, etype);
-	if (etypeok == NULL) {
-		plog(LLV_ERROR, LOCATION, remote,
-			"not acceptable %s mode\n", s_isakmp_etype(etype));
-		return -1;
-	}
-
-	/* get new entry to isakmp status table. */
-	iph1 = newph1();
-	if (iph1 == NULL)
-		return -1;
-
-	memcpy(&iph1->index.i_ck, &isakmp->i_ck, sizeof(iph1->index.i_ck));
-	iph1->status = PHASE1ST_START;
-	iph1->rmconf = rmconf;
-	iph1->flags = 0;
-	iph1->side = RESPONDER;
-	iph1->etype = etypeok->type;
-	iph1->version = isakmp->v;
-	iph1->msgid = 0;
-#ifdef HAVE_GSSAPI
-	iph1->gssapi_state = NULL;
-#endif
-#ifdef ENABLE_HYBRID
-	if ((iph1->mode_cfg = isakmp_cfg_mkstate()) == NULL) {
-		delph1(iph1);
-		return -1;
-	}
-#endif
-#ifdef ENABLE_FRAG
-	iph1->frag = 0;
-	iph1->frag_chain = NULL;
-#endif
-	iph1->approval = NULL;
-
-#ifdef ENABLE_NATT
-	/* RFC3947 says that we MUST accept new phases1 on NAT-T floated port.
-	 * We have to setup this flag now to correctly generate the first reply.
-	 * Don't know if a better check could be done for that ?
-	 */
-	if(extract_port(local) == lcconf->port_isakmp_natt)
-		iph1->natt_flags |= (NAT_PORTS_CHANGED);
-#endif
-
-	/* copy remote address */
-	if (copy_ph1addresses(iph1, rmconf, remote, local) < 0) {
-		delph1(iph1);
-		return -1;
-	}
-	(void)insph1(iph1);
-
-	plog(LLV_DEBUG, LOCATION, NULL, "===\n");
-    {
-	char *a;
-
-	a = racoon_strdup(saddr2str(iph1->local));
-	STRDUP_FATAL(a);
-
-	plog(LLV_INFO, LOCATION, NULL,
-		"respond new phase 1 negotiation: %s<=>%s\n",
-		a, saddr2str(iph1->remote));
-	racoon_free(a);
-    }
-	plog(LLV_INFO, LOCATION, NULL,
-		"begin %s mode.\n", s_isakmp_etype(etype));
-
-#ifdef ENABLE_STATS
-	gettimeofday(&iph1->start, NULL);
-	gettimeofday(&start, NULL);
-#endif
-
-#ifndef ENABLE_FRAG
-
-	/* start exchange */
-	if ((ph1exchange[etypesw1(iph1->etype)]
-	                [iph1->side]
-	                [iph1->status])(iph1, msg) < 0
-	 || (ph1exchange[etypesw1(iph1->etype)]
-			[iph1->side]
-			[iph1->status])(iph1, msg) < 0) {
-		plog(LLV_ERROR, LOCATION, remote,
-			"failed to process packet.\n");
-		remph1(iph1);
-		delph1(iph1);
-		return -1;
-	}
-
-#ifdef ENABLE_STATS
-	gettimeofday(&end, NULL);
-	syslog(LOG_NOTICE, "%s(%s): %8.6f",
-		"phase1",
-		s_isakmp_state(iph1->etype, iph1->side, iph1->status),
-		timedelta(&start, &end));
-#endif
-
-	return 0;
-
-#else /* ENABLE_FRAG */
-
-	/* now that we have a phase1 handle, feed back into our
-	 * main receive function to catch fragmented packets
-	 */
-
-	return isakmp_main(msg, remote, local);
-
-#endif /* ENABLE_FRAG */
-
-}
-
-/* new negotiation of phase 2 for initiator */
-static int
-isakmp_ph2begin_i(iph1, iph2)
-	struct ph1handle *iph1;
-	struct ph2handle *iph2;
-{
-#ifdef ENABLE_HYBRID
-	if (xauth_check(iph1) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "Attempt to start phase 2 whereas Xauth failed\n");
-		return -1;
-	}
-#endif
-
-	/* found ISAKMP-SA. */
-	plog(LLV_DEBUG, LOCATION, NULL, "===\n");
-	plog(LLV_DEBUG, LOCATION, NULL, "begin QUICK mode.\n");
-    {
-	char *a;
-	a = racoon_strdup(saddr2str(iph2->src));
-	STRDUP_FATAL(a);
-
-	plog(LLV_INFO, LOCATION, NULL,
-		"initiate new phase 2 negotiation: %s<=>%s\n",
-		a, saddr2str(iph2->dst));
-	racoon_free(a);
-    }
-
-#ifdef ENABLE_STATS
-	gettimeofday(&iph2->start, NULL);
-#endif
-	/* found isakmp-sa */
-	bindph12(iph1, iph2);
-	iph2->status = PHASE2ST_STATUS2;
-
-	if ((ph2exchange[etypesw2(ISAKMP_ETYPE_QUICK)]
-			 [iph2->side]
-			 [iph2->status])(iph2, NULL) < 0) {
-		unbindph12(iph2);
-		/* release ipsecsa handler due to internal error. */
-		remph2(iph2);
-		return -1;
-	}
-	return 0;
-}
-
-/* new negotiation of phase 2 for responder */
-static int
-isakmp_ph2begin_r(iph1, msg)
-	struct ph1handle *iph1;
-	vchar_t *msg;
-{
-	struct isakmp *isakmp = (struct isakmp *)msg->v;
-	struct ph2handle *iph2 = 0;
-	int error;
-#ifdef ENABLE_STATS
-	struct timeval start, end;
-#endif
-#ifdef ENABLE_HYBRID
-	if (xauth_check(iph1) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "Attempt to start phase 2 whereas Xauth failed\n");
-		return -1;
-	}
-#endif
-
-	iph2 = newph2();
-	if (iph2 == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to allocate phase2 entry.\n");
-		return -1;
-	}
-
-	iph2->ph1 = iph1;
-	iph2->side = RESPONDER;
-	iph2->status = PHASE2ST_START;
-	iph2->flags = isakmp->flags;
-	iph2->msgid = isakmp->msgid;
-	iph2->seq = pk_getseq();
-	iph2->ivm = oakley_newiv2(iph1, iph2->msgid);
-	if (iph2->ivm == NULL) {
-		delph2(iph2);
-		return -1;
-	}
-	iph2->dst = dupsaddr(iph1->remote);	/* XXX should be considered */
-	if (iph2->dst == NULL) {
-		delph2(iph2);
-		return -1;
-	}
-	iph2->src = dupsaddr(iph1->local);	/* XXX should be considered */
-	if (iph2->src == NULL) {
-		delph2(iph2);
-		return -1;
-	}
-#if (!defined(ENABLE_NATT)) || (defined(BROKEN_NATT))
-	if (set_port(iph2->dst, 0) == NULL ||
-	    set_port(iph2->src, 0) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		     "invalid family: %d\n", iph2->dst->sa_family);
-		delph2(iph2);
-		return -1;
-	}
-#endif
-
-	/* add new entry to isakmp status table */
-	insph2(iph2);
-	bindph12(iph1, iph2);
-
-	plog(LLV_DEBUG, LOCATION, NULL, "===\n");
-    {
-	char *a;
-
-	a = racoon_strdup(saddr2str(iph2->src));
-	STRDUP_FATAL(a);
-
-	plog(LLV_INFO, LOCATION, NULL,
-		"respond new phase 2 negotiation: %s<=>%s\n",
-		a, saddr2str(iph2->dst));
-	racoon_free(a);
-    }
-
-#ifdef ENABLE_STATS
-	gettimeofday(&start, NULL);
-#endif
-
-	error = (ph2exchange[etypesw2(ISAKMP_ETYPE_QUICK)]
-	                   [iph2->side]
-	                   [iph2->status])(iph2, msg);
-	if (error != 0) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"failed to pre-process packet.\n");
-		if (error != ISAKMP_INTERNAL_ERROR)
-			isakmp_info_send_n1(iph2->ph1, error, NULL);
-		/*
-		 * release handler because it's wrong that ph2handle is kept
-		 * after failed to check message for responder's.
-		 */
-		unbindph12(iph2);
-		remph2(iph2);
-		delph2(iph2);
-		return -1;
-	}
-
-	/* send */
-	plog(LLV_DEBUG, LOCATION, NULL, "===\n");
-	if ((ph2exchange[etypesw2(isakmp->etype)]
-			[iph2->side]
-			[iph2->status])(iph2, msg) < 0) {
-		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-			"failed to process packet.\n");
-		/* don't release handler */
-		return -1;
-	}
-#ifdef ENABLE_STATS
-	gettimeofday(&end, NULL);
-	syslog(LOG_NOTICE, "%s(%s): %8.6f",
-		"phase2",
-		s_isakmp_state(ISAKMP_ETYPE_QUICK, iph2->side, iph2->status),
-		timedelta(&start, &end));
-#endif
-
-	return 0;
-}
-
-/*
- * parse ISAKMP payloads, without ISAKMP base header.
- */
-vchar_t *
-isakmp_parsewoh(np0, gen, len)
-	int np0;
-	struct isakmp_gen *gen;
-	int len;
-{
-	u_char np = np0 & 0xff;
-	int tlen, plen;
-	vchar_t *result;
-	struct isakmp_parse_t *p, *ep;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "begin.\n");
-
-	/*
-	 * 5 is a magic number, but any value larger than 2 should be fine
-	 * as we do vrealloc() in the following loop.
-	 */
-	result = vmalloc(sizeof(struct isakmp_parse_t) * 5);
-	if (result == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get buffer.\n");
-		return NULL;
-	}
-	p = (struct isakmp_parse_t *)result->v;
-	ep = (struct isakmp_parse_t *)(result->v + result->l - sizeof(*ep));
-
-	tlen = len;
-
-	/* parse through general headers */
-	while (0 < tlen && np != ISAKMP_NPTYPE_NONE) {
-		if (tlen <= sizeof(struct isakmp_gen)) {
-			/* don't send information, see isakmp_ident_r1() */
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid length of payload\n");
-			vfree(result);
-			return NULL;
-		}
-
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"seen nptype=%u(%s)\n", np, s_isakmp_nptype(np));
-
-		p->type = np;
-		p->len = ntohs(gen->len);
-		if (p->len < sizeof(struct isakmp_gen) || p->len > tlen) {
-			plog(LLV_DEBUG, LOCATION, NULL,
-				"invalid length of payload\n");
-			vfree(result);
-			return NULL;
-		}
-		p->ptr = gen;
-		p++;
-		if (ep <= p) {
-			int off;
-
-			off = p - (struct isakmp_parse_t *)result->v;
-			result = vrealloc(result, result->l * 2);
-			if (result == NULL) {
-				plog(LLV_DEBUG, LOCATION, NULL,
-					"failed to realloc buffer.\n");
-				vfree(result);
-				return NULL;
-			}
-			ep = (struct isakmp_parse_t *)
-				(result->v + result->l - sizeof(*ep));
-			p = (struct isakmp_parse_t *)result->v;
-			p += off;
-		}
-
-		np = gen->np;
-		plen = ntohs(gen->len);
-		gen = (struct isakmp_gen *)((caddr_t)gen + plen);
-		tlen -= plen;
-	}
-	p->type = ISAKMP_NPTYPE_NONE;
-	p->len = 0;
-	p->ptr = NULL;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "succeed.\n");
-
-	return result;
-}
-
-/*
- * parse ISAKMP payloads, including ISAKMP base header.
- */
-vchar_t *
-isakmp_parse(buf)
-	vchar_t *buf;
-{
-	struct isakmp *isakmp = (struct isakmp *)buf->v;
-	struct isakmp_gen *gen;
-	int tlen;
-	vchar_t *result;
-	u_char np;
-
-	np = isakmp->np;
-	gen = (struct isakmp_gen *)(buf->v + sizeof(*isakmp));
-	tlen = buf->l - sizeof(struct isakmp);
-	result = isakmp_parsewoh(np, gen, tlen);
-
-	return result;
-}
-
-/* %%% */
-int
-isakmp_init()
-{
-	/* initialize a isakmp status table */
-	initph1tree();
-	initph2tree();
-	initctdtree();
-	init_recvdpkt();
-
-	if (isakmp_open() < 0)
-		goto err;
-
-	return(0);
-
-err:
-	isakmp_close();
-	return(-1);
-}
-
-/*
- * make strings containing i_cookie + r_cookie + msgid
- */
-const char *
-isakmp_pindex(index, msgid)
-	const isakmp_index *index;
-	const u_int32_t msgid;
-{
-	static char buf[64];
-	const u_char *p;
-	int i, j;
-
-	memset(buf, 0, sizeof(buf));
-
-	/* copy index */
-	p = (const u_char *)index;
-	for (j = 0, i = 0; i < sizeof(isakmp_index); i++) {
-		snprintf((char *)&buf[j], sizeof(buf) - j, "%02x", p[i]);
-		j += 2;
-		switch (i) {
-		case 7:
-			buf[j++] = ':';
-		}
-	}
-
-	if (msgid == 0)
-		return buf;
-
-	/* copy msgid */
-	snprintf((char *)&buf[j], sizeof(buf) - j, ":%08x", ntohs(msgid));
-
-	return buf;
-}
-
-/* open ISAKMP sockets. */
-int
-isakmp_open()
-{
-	const int yes = 1;
-	int ifnum = 0, encap_ifnum = 0;
-#ifdef INET6
-	int pktinfo;
-#endif
-	struct myaddrs *p;
-
-	for (p = lcconf->myaddrs; p; p = p->next) {
-		if (!p->addr)
-			continue;
-
-		/* warn if wildcard address - should we forbid this? */
-		switch (p->addr->sa_family) {
-		case AF_INET:
-			if (((struct sockaddr_in *)p->addr)->sin_addr.s_addr == 0)
-				plog(LLV_WARNING, LOCATION, NULL,
-					"listening to wildcard address,"
-					"broadcast IKE packet may kill you\n");
-			break;
-#ifdef INET6
-		case AF_INET6:
-			if (IN6_IS_ADDR_UNSPECIFIED(&((struct sockaddr_in6 *)p->addr)->sin6_addr))
-				plog(LLV_WARNING, LOCATION, NULL,
-					"listening to wildcard address, "
-					"broadcast IKE packet may kill you\n");
-			break;
-#endif
-		default:
-			plog(LLV_ERROR, LOCATION, NULL,
-				"unsupported address family %d\n",
-				lcconf->default_af);
-			goto err_and_next;
-		}
-
-#ifdef INET6
-		if (p->addr->sa_family == AF_INET6 &&
-		    IN6_IS_ADDR_MULTICAST(&((struct sockaddr_in6 *)
-					    p->addr)->sin6_addr))
-		{
-			plog(LLV_DEBUG, LOCATION, NULL, 
-				"Ignoring multicast address %s\n",
-				saddr2str(p->addr));
-				racoon_free(p->addr);
-				p->addr = NULL;
-			continue;
-		}
-#endif
-
-		if ((p->sock = socket(p->addr->sa_family, SOCK_DGRAM, 0)) < 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"socket (%s)\n", strerror(errno));
-			goto err_and_next;
-		}
-#ifdef ANDROID_CHANGES
-		protectFromVpn(p->sock);
-#endif
-
-		if (fcntl(p->sock, F_SETFL, O_NONBLOCK) == -1)
-			plog(LLV_WARNING, LOCATION, NULL,
-				"failed to put socket in non-blocking mode\n");
-
-		/* receive my interface address on inbound packets. */
-		switch (p->addr->sa_family) {
-		case AF_INET:
-			if (setsockopt(p->sock, IPPROTO_IP,
-#ifdef __linux__
-				       IP_PKTINFO,
-#else
-				       IP_RECVDSTADDR,
-#endif
-					(const void *)&yes, sizeof(yes)) < 0) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"setsockopt IP_RECVDSTADDR (%s)\n", 
-					strerror(errno));
-				goto err_and_next;
-			}
-			break;
-#ifdef INET6
-		case AF_INET6:
-#ifdef INET6_ADVAPI
-#ifdef IPV6_RECVPKTINFO
-			pktinfo = IPV6_RECVPKTINFO;
-#else  /* old adv. API */
-			pktinfo = IPV6_PKTINFO;
-#endif /* IPV6_RECVPKTINFO */
-#else
-			pktinfo = IPV6_RECVDSTADDR;
-#endif
-			if (setsockopt(p->sock, IPPROTO_IPV6, pktinfo,
-					(const void *)&yes, sizeof(yes)) < 0)
-			{
-				plog(LLV_ERROR, LOCATION, NULL,
-					"setsockopt IPV6_RECVDSTADDR (%d):%s\n",
-					pktinfo, strerror(errno));
-				goto err_and_next;
-			}
-			break;
-#endif
-		}
-
-#ifdef IPV6_USE_MIN_MTU
-		if (p->addr->sa_family == AF_INET6 &&
-		    setsockopt(p->sock, IPPROTO_IPV6, IPV6_USE_MIN_MTU,
-		    (void *)&yes, sizeof(yes)) < 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "setsockopt IPV6_USE_MIN_MTU (%s)\n", 
-			    strerror(errno));
-			return -1;
-		}
-#endif
-
-		if (setsockopt_bypass(p->sock, p->addr->sa_family) < 0)
-			goto err_and_next;
-
-		if (bind(p->sock, p->addr, sysdep_sa_len(p->addr)) < 0) {
-			plog(LLV_ERROR, LOCATION, p->addr,
-				"failed to bind to address %s (%s).\n",
-				saddr2str(p->addr), strerror(errno));
-			close(p->sock);
-			goto err_and_next;
-		}
-
-		ifnum++;
-
-		plog(LLV_INFO, LOCATION, NULL,
-			"%s used as isakmp port (fd=%d)\n",
-			saddr2str(p->addr), p->sock);
-
-#ifdef ENABLE_NATT
-		if (p->addr->sa_family == AF_INET) {
-			int option = -1;
-
-
-			if(p->udp_encap)
-				option = UDP_ENCAP_ESPINUDP;
-#if defined(ENABLE_NATT_00) || defined(ENABLE_NATT_01)
-			else
-				option = UDP_ENCAP_ESPINUDP_NON_IKE;
-#endif
-			if(option != -1){
-				if (setsockopt (p->sock, SOL_UDP, 
-				    UDP_ENCAP, &option, sizeof (option)) < 0) {
-					plog(LLV_WARNING, LOCATION, NULL,
-					    "setsockopt(%s): UDP_ENCAP %s\n",
-					    option == UDP_ENCAP_ESPINUDP ? "UDP_ENCAP_ESPINUDP" : "UDP_ENCAP_ESPINUDP_NON_IKE",
-						 strerror(errno));
-					goto skip_encap;
-				}
-				else {
-					plog(LLV_INFO, LOCATION, NULL,
-						 "%s used for NAT-T\n",
-						 saddr2str(p->addr));
-					encap_ifnum++;
-				}
-			}
-		}
-skip_encap:
-#endif
-		continue;
-
-	err_and_next:
-		racoon_free(p->addr);
-		p->addr = NULL;
-		if (! lcconf->autograbaddr && lcconf->strict_address)
-			return -1;
-		continue;
-	}
-
-	if (!ifnum) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"no address could be bound.\n");
-		return -1;
-	}
-
-#ifdef ENABLE_NATT
-	if (natt_enabled_in_rmconf() && !encap_ifnum) {
-		plog(LLV_WARNING, LOCATION, NULL, 
-			"NAT-T is enabled in at least one remote{} section,\n");
-		plog(LLV_WARNING, LOCATION, NULL, 
-			"but no 'isakmp_natt' address was specified!\n");
-	}
-#endif
-
-	return 0;
-}
-
-void
-isakmp_close()
-{
-#ifndef ANDROID_PATCHED
-	struct myaddrs *p, *next;
-
-	for (p = lcconf->myaddrs; p; p = next) {
-		next = p->next;
-
-		if (!p->addr) {
-			racoon_free(p);
-			continue;
-		}
-		close(p->sock);
-		racoon_free(p->addr);
-		racoon_free(p);
-	}
-
-	lcconf->myaddrs = NULL;
-#endif
-}
-
-int
-isakmp_send(iph1, sbuf)
-	struct ph1handle *iph1;
-	vchar_t *sbuf;
-{
-	int len = 0;
-	int s;
-	vchar_t *vbuf = NULL, swap;
-
-#ifdef ENABLE_NATT
-	size_t extralen = NON_ESP_MARKER_USE(iph1) ? NON_ESP_MARKER_LEN : 0;
-
-	/* Check if NON_ESP_MARKER_LEN is already there (happens when resending packets)
-	 */
-	if(extralen == NON_ESP_MARKER_LEN &&
-	   *(u_int32_t *)sbuf->v == 0)
-		extralen = 0;
-
-#ifdef ENABLE_FRAG
-	/* 
-	 * Do not add the non ESP marker for a packet that will
-	 * be fragmented. The non ESP marker should appear in 
-	 * all fragment's packets, but not in the fragmented packet
-	 */
-	if (iph1->frag && sbuf->l > ISAKMP_FRAG_MAXLEN) 
-		extralen = 0;
-#endif
-	if (extralen)
-		plog (LLV_DEBUG, LOCATION, NULL, "Adding NON-ESP marker\n");
-
-	/* If NAT-T port floating is in use, 4 zero bytes (non-ESP marker) 
-	   must added just before the packet itself. For this we must 
-	   allocate a new buffer and release it at the end. */
-	if (extralen) {
-		if ((vbuf = vmalloc (sbuf->l + extralen)) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "vbuf allocation failed\n");
-			return -1;
-		}
-		*(u_int32_t *)vbuf->v = 0;
-		memcpy (vbuf->v + extralen, sbuf->v, sbuf->l);
-		/* ensures that the modified buffer will be sent back to the caller, so
-		 * add_recvdpkt() will add the correct buffer
-		 */
-		swap = *sbuf;
-		*sbuf = *vbuf;
-		*vbuf = swap;
-		vfree(vbuf);
-	}
-#endif
-
-	/* select the socket to be sent */
-	s = getsockmyaddr(iph1->local);
-	if (s == -1){
-		return -1;
-	}
-
-	plog (LLV_DEBUG, LOCATION, NULL, "%zu bytes %s\n", sbuf->l, 
-	      saddr2str_fromto("from %s to %s", iph1->local, iph1->remote));
-
-#ifdef ENABLE_FRAG
-	if (iph1->frag && sbuf->l > ISAKMP_FRAG_MAXLEN) {
-		if (isakmp_sendfrags(iph1, sbuf) == -1) {
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "isakmp_sendfrags failed\n");
-			return -1;
-		}
-	} else 
-#endif
-	{
-		len = sendfromto(s, sbuf->v, sbuf->l,
-		    iph1->local, iph1->remote, lcconf->count_persend);
-
-		if (len == -1) {
-			plog(LLV_ERROR, LOCATION, NULL, "sendfromto failed\n");
-			return -1;
-		}
-	}
-	
-	return 0;
-}
-
-/* called from scheduler */
-void
-isakmp_ph1resend_stub(p)
-	void *p;
-{
-	struct ph1handle *iph1;
-
-	iph1=(struct ph1handle *)p;
-	if(isakmp_ph1resend(iph1) < 0){
-		if(iph1->scr != NULL){
-			/* Should not happen...
-			 */
-			sched_kill(iph1->scr);
-			iph1->scr=NULL;
-		}
-
-		remph1(iph1);
-		delph1(iph1);
-	}
-}
-
-int
-isakmp_ph1resend(iph1)
-	struct ph1handle *iph1;
-{
-	/* Note: NEVER do the rem/del here, it will be done by the caller or by the _stub function
-	 */
-	if (iph1->retry_counter <= 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"phase1 negotiation failed due to time up. %s\n",
-			isakmp_pindex(&iph1->index, iph1->msgid));
-		EVT_PUSH(iph1->local, iph1->remote, 
-		    EVTT_PEER_NO_RESPONSE, NULL);
-
-		return -1;
-	}
-
-	if (isakmp_send(iph1, iph1->sendbuf) < 0){
-		plog(LLV_ERROR, LOCATION, NULL,
-			 "phase1 negotiation failed due to send error. %s\n",
-			 isakmp_pindex(&iph1->index, iph1->msgid));
-		EVT_PUSH(iph1->local, iph1->remote, 
-				 EVTT_PEER_NO_RESPONSE, NULL);
-		return -1;
-	}
-
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"resend phase1 packet %s\n",
-		isakmp_pindex(&iph1->index, iph1->msgid));
-
-	iph1->retry_counter--;
-
-	iph1->scr = sched_new(iph1->rmconf->retry_interval,
-		isakmp_ph1resend_stub, iph1);
-
-	return 0;
-}
-
-/* called from scheduler */
-void
-isakmp_ph2resend_stub(p)
-	void *p;
-{
-	struct ph2handle *iph2;
-
-	iph2=(struct ph2handle *)p;
-
-	if(isakmp_ph2resend(iph2) < 0){
-		unbindph12(iph2);
-		remph2(iph2);
-		delph2(iph2);
-	}
-}
-
-int
-isakmp_ph2resend(iph2)
-	struct ph2handle *iph2;
-{
-	/* Note: NEVER do the unbind/rem/del here, it will be done by the caller or by the _stub function
-	 */
-	if (iph2->ph1->status == PHASE1ST_EXPIRED){
-		plog(LLV_ERROR, LOCATION, NULL,
-			"phase2 negotiation failed due to phase1 expired. %s\n",
-				isakmp_pindex(&iph2->ph1->index, iph2->msgid));
-		return -1;
-	}
-
-	if (iph2->retry_counter <= 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"phase2 negotiation failed due to time up. %s\n",
-				isakmp_pindex(&iph2->ph1->index, iph2->msgid));
-		EVT_PUSH(iph2->src, iph2->dst, EVTT_PEER_NO_RESPONSE, NULL);
-		unbindph12(iph2);
-		return -1;
-	}
-
-	if (isakmp_send(iph2->ph1, iph2->sendbuf) < 0){
-		plog(LLV_ERROR, LOCATION, NULL,
-			"phase2 negotiation failed due to send error. %s\n",
-				isakmp_pindex(&iph2->ph1->index, iph2->msgid));
-		EVT_PUSH(iph2->src, iph2->dst, EVTT_PEER_NO_RESPONSE, NULL);
-
-		return -1;
-	}
-
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"resend phase2 packet %s\n",
-		isakmp_pindex(&iph2->ph1->index, iph2->msgid));
-
-	iph2->retry_counter--;
-
-	iph2->scr = sched_new(iph2->ph1->rmconf->retry_interval,
-		isakmp_ph2resend_stub, iph2);
-
-	return 0;
-}
-
-/* called from scheduler */
-void
-isakmp_ph1expire_stub(p)
-	void *p;
-{
-
-	isakmp_ph1expire((struct ph1handle *)p);
-}
-
-void
-isakmp_ph1expire(iph1)
-	struct ph1handle *iph1;
-{
-	char *src, *dst;
-
-	SCHED_KILL(iph1->sce);
-
-	if(iph1->status != PHASE1ST_EXPIRED){
-		src = racoon_strdup(saddr2str(iph1->local));
-		dst = racoon_strdup(saddr2str(iph1->remote));
-		STRDUP_FATAL(src);
-		STRDUP_FATAL(dst);
-
-		plog(LLV_INFO, LOCATION, NULL,
-			 "ISAKMP-SA expired %s-%s spi:%s\n",
-			 src, dst,
-			 isakmp_pindex(&iph1->index, 0));
-		racoon_free(src);
-		racoon_free(dst);
-		iph1->status = PHASE1ST_EXPIRED;
-	}
-
-	/*
-	 * the phase1 deletion is postponed until there is no phase2.
-	 */
-	if (LIST_FIRST(&iph1->ph2tree) != NULL) {
-		iph1->sce = sched_new(1, isakmp_ph1expire_stub, iph1);
-		return;
-	}
-
-	iph1->sce = sched_new(1, isakmp_ph1delete_stub, iph1);
-}
-
-/* called from scheduler */
-void
-isakmp_ph1delete_stub(p)
-	void *p;
-{
-
-	isakmp_ph1delete((struct ph1handle *)p);
-}
-
-void
-isakmp_ph1delete(iph1)
-	struct ph1handle *iph1;
-{
-	char *src, *dst;
-
-	SCHED_KILL(iph1->sce);
-
-	if (LIST_FIRST(&iph1->ph2tree) != NULL) {
-		iph1->sce = sched_new(1, isakmp_ph1delete_stub, iph1);
-		return;
-	}
-
-	/* don't re-negosiation when the phase 1 SA expires. */
-
-	src = racoon_strdup(saddr2str(iph1->local));
-	dst = racoon_strdup(saddr2str(iph1->remote));
-	STRDUP_FATAL(src);
-	STRDUP_FATAL(dst);
-
-	plog(LLV_INFO, LOCATION, NULL,
-		"ISAKMP-SA deleted %s-%s spi:%s\n",
-		src, dst, isakmp_pindex(&iph1->index, 0));
-	EVT_PUSH(iph1->local, iph1->remote, EVTT_PHASE1_DOWN, NULL);
-	racoon_free(src);
-	racoon_free(dst);
-
-	remph1(iph1);
-	delph1(iph1);
-
-	return;
-}
-
-/* called from scheduler.
- * this function will call only isakmp_ph2delete().
- * phase 2 handler remain forever if kernel doesn't cry a expire of phase 2 SA
- * by something cause.  That's why this function is called after phase 2 SA
- * expires in the userland.
- */
-void
-isakmp_ph2expire_stub(p)
-	void *p;
-{
-
-	isakmp_ph2expire((struct ph2handle *)p);
-}
-
-void
-isakmp_ph2expire(iph2)
-	struct ph2handle *iph2;
-{
-	char *src, *dst;
-
-	SCHED_KILL(iph2->sce);
-
-	src = racoon_strdup(saddrwop2str(iph2->src));
-	dst = racoon_strdup(saddrwop2str(iph2->dst));
-	STRDUP_FATAL(src);
-	STRDUP_FATAL(dst);
-
-	plog(LLV_INFO, LOCATION, NULL,
-		"phase2 sa expired %s-%s\n", src, dst);
-	racoon_free(src);
-	racoon_free(dst);
-
-	iph2->status = PHASE2ST_EXPIRED;
-
-	iph2->sce = sched_new(1, isakmp_ph2delete_stub, iph2);
-
-	return;
-}
-
-/* called from scheduler */
-void
-isakmp_ph2delete_stub(p)
-	void *p;
-{
-
-	isakmp_ph2delete((struct ph2handle *)p);
-}
-
-void
-isakmp_ph2delete(iph2)
-	struct ph2handle *iph2;
-{
-	char *src, *dst;
-
-	SCHED_KILL(iph2->sce);
-
-	src = racoon_strdup(saddrwop2str(iph2->src));
-	dst = racoon_strdup(saddrwop2str(iph2->dst));
-	STRDUP_FATAL(src);
-	STRDUP_FATAL(dst);
-
-	plog(LLV_INFO, LOCATION, NULL,
-		"phase2 sa deleted %s-%s\n", src, dst);
-	racoon_free(src);
-	racoon_free(dst);
-
-	unbindph12(iph2);
-	remph2(iph2);
-	delph2(iph2);
-
-	return;
-}
-
-/* %%%
- * Interface between PF_KEYv2 and ISAKMP
- */
-/*
- * receive ACQUIRE from kernel, and begin either phase1 or phase2.
- * if phase1 has been finished, begin phase2.
- */
-int
-isakmp_post_acquire(iph2)
-	struct ph2handle *iph2;
-{
-	struct remoteconf *rmconf;
-	struct ph1handle *iph1 = NULL;
-	
-	plog(LLV_DEBUG, LOCATION, NULL, "in post_acquire\n");
-
-	/* search appropreate configuration with masking port. */
-	rmconf = getrmconf(iph2->dst);
-	if (rmconf == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"no configuration found for %s.\n",
-			saddrwop2str(iph2->dst));
-		return -1;
-	}
-
-	/* if passive mode, ignore the acquire message */
-	if (rmconf->passive) {
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"because of passive mode, "
-			"ignore the acquire message for %s.\n",
-			saddrwop2str(iph2->dst));
-		return 0;
-	}
-
-	/* 
-	 * Search isakmp status table by address and port 
-	 * If NAT-T is in use, consider null ports as a 
-	 * wildcard and use IKE ports instead.
-	 */
-#ifdef ENABLE_NATT
-	if (!extract_port(iph2->src) && !extract_port(iph2->dst)) {
-		if ((iph1 = getph1byaddrwop(iph2->src, iph2->dst)) != NULL) {
-			set_port(iph2->src, extract_port(iph1->local));
-			set_port(iph2->dst, extract_port(iph1->remote));
-		}
-	} else {
-		iph1 = getph1byaddr(iph2->src, iph2->dst, 0);
-	}
-#else
-	iph1 = getph1byaddr(iph2->src, iph2->dst, 0);
-#endif
-
-	/* no ISAKMP-SA found. */
-	if (iph1 == NULL) {
-		struct sched *sc;
-
-		iph2->retry_checkph1 = lcconf->retry_checkph1;
-		sc = sched_new(1, isakmp_chkph1there_stub, iph2);
-		plog(LLV_INFO, LOCATION, NULL,
-			"IPsec-SA request for %s queued "
-			"due to no phase1 found.\n",
-			saddrwop2str(iph2->dst));
-
-		/* start phase 1 negotiation as a initiator. */
-		if (isakmp_ph1begin_i(rmconf, iph2->dst, iph2->src) < 0) {
-			SCHED_KILL(sc);
-			return -1;
-		}
-
-		return 0;
-		/*NOTREACHED*/
-	}
-
-	/* found ISAKMP-SA, but on negotiation. */
-	if (iph1->status != PHASE1ST_ESTABLISHED) {
-		iph2->retry_checkph1 = lcconf->retry_checkph1;
-		sched_new(1, isakmp_chkph1there_stub, iph2);
-		plog(LLV_INFO, LOCATION, iph2->dst,
-			"request for establishing IPsec-SA was queued "
-			"due to no phase1 found.\n");
-		return 0;
-		/*NOTREACHED*/
-	}
-
-	/* found established ISAKMP-SA */
-	/* i.e. iph1->status == PHASE1ST_ESTABLISHED */
-
-	/* found ISAKMP-SA. */
-	plog(LLV_DEBUG, LOCATION, NULL, "begin QUICK mode.\n");
-
-	/* begin quick mode */
-	if (isakmp_ph2begin_i(iph1, iph2))
-		return -1;
-
-	return 0;
-}
-
-/*
- * receive GETSPI from kernel.
- */
-int
-isakmp_post_getspi(iph2)
-	struct ph2handle *iph2;
-{
-#ifdef ENABLE_STATS
-	struct timeval start, end;
-#endif
-
-	/* don't process it because there is no suitable phase1-sa. */
-	if (iph2->ph1->status == PHASE1ST_EXPIRED) {
-		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-			"the negotiation is stopped, "
-			"because there is no suitable ISAKMP-SA.\n");
-		return -1;
-	}
-
-#ifdef ENABLE_STATS
-	gettimeofday(&start, NULL);
-#endif
-	if ((ph2exchange[etypesw2(ISAKMP_ETYPE_QUICK)]
-	                [iph2->side]
-	                [iph2->status])(iph2, NULL) != 0)
-		return -1;
-#ifdef ENABLE_STATS
-	gettimeofday(&end, NULL);
-	syslog(LOG_NOTICE, "%s(%s): %8.6f",
-		"phase2",
-		s_isakmp_state(ISAKMP_ETYPE_QUICK, iph2->side, iph2->status),
-		timedelta(&start, &end));
-#endif
-
-	return 0;
-}
-
-/* called by scheduler */
-void
-isakmp_chkph1there_stub(p)
-	void *p;
-{
-	isakmp_chkph1there((struct ph2handle *)p);
-}
-
-void
-isakmp_chkph1there(iph2)
-	struct ph2handle *iph2;
-{
-	struct ph1handle *iph1;
-
-	iph2->retry_checkph1--;
-	if (iph2->retry_checkph1 < 0) {
-		plog(LLV_ERROR, LOCATION, iph2->dst,
-			"phase2 negotiation failed "
-			"due to time up waiting for phase1. %s\n",
-			sadbsecas2str(iph2->dst, iph2->src,
-				iph2->satype, 0, 0));
-		plog(LLV_INFO, LOCATION, NULL,
-			"delete phase 2 handler.\n");
-
-		/* send acquire to kernel as error */
-		pk_sendeacquire(iph2);
-
-		unbindph12(iph2);
-		remph2(iph2);
-		delph2(iph2);
-
-		return;
-	}
-
-	/* 
-	 * Search isakmp status table by address and port 
-	 * If NAT-T is in use, consider null ports as a 
-	 * wildcard and use IKE ports instead.
-	 */
-#ifdef ENABLE_NATT
-	if (!extract_port(iph2->src) && !extract_port(iph2->dst)) {
-		plog(LLV_DEBUG2, LOCATION, NULL, "CHKPH1THERE: extract_port.\n");
-		if( (iph1 = getph1byaddrwop(iph2->src, iph2->dst)) != NULL){
-			plog(LLV_DEBUG2, LOCATION, NULL, "CHKPH1THERE: found a ph1 wop.\n");
-		}
-	} else {
-		plog(LLV_DEBUG2, LOCATION, NULL, "CHKPH1THERE: searching byaddr.\n");
-		iph1 = getph1byaddr(iph2->src, iph2->dst, 0);
-		if(iph1 != NULL)
-			plog(LLV_DEBUG2, LOCATION, NULL, "CHKPH1THERE: found byaddr.\n");
-	}
-#else
-	iph1 = getph1byaddr(iph2->src, iph2->dst, 0);
-#endif
-
-	/* XXX Even if ph1 as responder is there, should we not start
-	 * phase 2 negotiation ? */
-	if (iph1 != NULL
-	 && iph1->status == PHASE1ST_ESTABLISHED) {
-		/* found isakmp-sa */
-
-		plog(LLV_DEBUG2, LOCATION, NULL, "CHKPH1THERE: got a ph1 handler, setting ports.\n");
-		plog(LLV_DEBUG2, LOCATION, NULL, "iph1->local: %s\n", saddr2str(iph1->local));
-		plog(LLV_DEBUG2, LOCATION, NULL, "iph1->remote: %s\n", saddr2str(iph1->remote));
-		plog(LLV_DEBUG2, LOCATION, NULL, "before:\n");
-		plog(LLV_DEBUG2, LOCATION, NULL, "src: %s\n", saddr2str(iph2->src));
-		plog(LLV_DEBUG2, LOCATION, NULL, "dst: %s\n", saddr2str(iph2->dst));
-		set_port(iph2->src, extract_port(iph1->local));
-		set_port(iph2->dst, extract_port(iph1->remote));
-		plog(LLV_DEBUG2, LOCATION, NULL, "After:\n");
-		plog(LLV_DEBUG2, LOCATION, NULL, "src: %s\n", saddr2str(iph2->src));
-		plog(LLV_DEBUG2, LOCATION, NULL, "dst: %s\n", saddr2str(iph2->dst));
-
-		/* begin quick mode */
-		(void)isakmp_ph2begin_i(iph1, iph2);
-		return;
-	}
-
-	plog(LLV_DEBUG2, LOCATION, NULL, "CHKPH1THERE: no established ph1 handler found\n");
-
-	/* no isakmp-sa found */
-	sched_new(1, isakmp_chkph1there_stub, iph2);
-
-	return;
-}
-
-/* copy variable data into ALLOCATED buffer. */
-caddr_t
-isakmp_set_attr_v(buf, type, val, len)
-	caddr_t buf;
-	int type;
-	caddr_t val;
-	int len;
-{
-	struct isakmp_data *data;
-
-	data = (struct isakmp_data *)buf;
-	data->type = htons((u_int16_t)type | ISAKMP_GEN_TLV);
-	data->lorv = htons((u_int16_t)len);
-	memcpy(data + 1, val, len);
-
-	return buf + sizeof(*data) + len;
-}
-
-/* copy fixed length data into ALLOCATED buffer. */
-caddr_t
-isakmp_set_attr_l(buf, type, val)
-	caddr_t buf;
-	int type;
-	u_int32_t val;
-{
-	struct isakmp_data *data;
-
-	data = (struct isakmp_data *)buf;
-	data->type = htons((u_int16_t)type | ISAKMP_GEN_TV);
-	data->lorv = htons((u_int16_t)val);
-
-	return buf + sizeof(*data);
-}
-
-/* add a variable data attribute to the buffer by reallocating it. */
-vchar_t *
-isakmp_add_attr_v(buf0, type, val, len)
-	vchar_t *buf0;
-	int type;
-	caddr_t val;
-	int len;
-{
-	vchar_t *buf = NULL;
-	struct isakmp_data *data;
-	int tlen;
-	int oldlen = 0;
-
-	tlen = sizeof(*data) + len;
-
-	if (buf0) {
-		oldlen = buf0->l;
-		buf = vrealloc(buf0, oldlen + tlen);
-	} else
-		buf = vmalloc(tlen);
-	if (!buf) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get a attribute buffer.\n");
-		return NULL;
-	}
-
-	data = (struct isakmp_data *)(buf->v + oldlen);
-	data->type = htons((u_int16_t)type | ISAKMP_GEN_TLV);
-	data->lorv = htons((u_int16_t)len);
-	memcpy(data + 1, val, len);
-
-	return buf;
-}
-
-/* add a fixed data attribute to the buffer by reallocating it. */
-vchar_t *
-isakmp_add_attr_l(buf0, type, val)
-	vchar_t *buf0;
-	int type;
-	u_int32_t val;
-{
-	vchar_t *buf = NULL;
-	struct isakmp_data *data;
-	int tlen;
-	int oldlen = 0;
-
-	tlen = sizeof(*data);
-
-	if (buf0) {
-		oldlen = buf0->l;
-		buf = vrealloc(buf0, oldlen + tlen);
-	} else
-		buf = vmalloc(tlen);
-	if (!buf) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get a attribute buffer.\n");
-		return NULL;
-	}
-
-	data = (struct isakmp_data *)(buf->v + oldlen);
-	data->type = htons((u_int16_t)type | ISAKMP_GEN_TV);
-	data->lorv = htons((u_int16_t)val);
-
-	return buf;
-}
-
-/*
- * calculate cookie and set.
- */
-int
-isakmp_newcookie(place, remote, local)
-	caddr_t place;
-	struct sockaddr *remote;
-	struct sockaddr *local;
-{
-	vchar_t *buf = NULL, *buf2 = NULL;
-	char *p;
-	int blen;
-	int alen;
-	caddr_t sa1, sa2;
-	time_t t;
-	int error = -1;
-	u_short port;
-
-
-	if (remote->sa_family != local->sa_family) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"address family mismatch, remote:%d local:%d\n",
-			remote->sa_family, local->sa_family);
-		goto end;
-	}
-	switch (remote->sa_family) {
-	case AF_INET:
-		alen = sizeof(struct in_addr);
-		sa1 = (caddr_t)&((struct sockaddr_in *)remote)->sin_addr;
-		sa2 = (caddr_t)&((struct sockaddr_in *)local)->sin_addr;
-		break;
-#ifdef INET6
-	case AF_INET6:
-		alen = sizeof(struct in6_addr);
-		sa1 = (caddr_t)&((struct sockaddr_in6 *)remote)->sin6_addr;
-		sa2 = (caddr_t)&((struct sockaddr_in6 *)local)->sin6_addr;
-		break;
-#endif
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid family: %d\n", remote->sa_family);
-		goto end;
-	}
-	blen = (alen + sizeof(u_short)) * 2
-		+ sizeof(time_t) + lcconf->secret_size;
-	buf = vmalloc(blen);
-	if (buf == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get a cookie.\n");
-		goto end;
-	}
-	p = buf->v;
-
-	/* copy my address */
-	memcpy(p, sa1, alen);
-	p += alen;
-	port = ((struct sockaddr_in *)remote)->sin_port;
-	memcpy(p, &port, sizeof(u_short));
-	p += sizeof(u_short);
-
-	/* copy target address */
-	memcpy(p, sa2, alen);
-	p += alen;
-	port = ((struct sockaddr_in *)local)->sin_port;
-	memcpy(p, &port, sizeof(u_short));
-	p += sizeof(u_short);
-
-	/* copy time */
-	t = time(0);
-	memcpy(p, (caddr_t)&t, sizeof(t));
-	p += sizeof(t);
-
-	/* copy random value */
-	buf2 = eay_set_random(lcconf->secret_size);
-	if (buf2 == NULL)
-		goto end;
-	memcpy(p, buf2->v, lcconf->secret_size);
-	p += lcconf->secret_size;
-	vfree(buf2);
-
-	buf2 = eay_sha1_one(buf);
-	memcpy(place, buf2->v, sizeof(cookie_t));
-
-	sa1 = val2str(place, sizeof (cookie_t));
-	plog(LLV_DEBUG, LOCATION, NULL, "new cookie:\n%s\n", sa1);
-	racoon_free(sa1);
-
-	error = 0;
-end:
-	if (buf != NULL)
-		vfree(buf);
-	if (buf2 != NULL)
-		vfree(buf2);
-	return error;
-}
-
-/*
- * save partner's(payload) data into phhandle.
- */
-int
-isakmp_p2ph(buf, gen)
-	vchar_t **buf;
-	struct isakmp_gen *gen;
-{
-	/* XXX to be checked in each functions for logging. */
-	if (*buf) {
-		plog(LLV_WARNING, LOCATION, NULL,
-			"ignore this payload, same payload type exist.\n");
-		return -1;
-	}
-
-	*buf = vmalloc(ntohs(gen->len) - sizeof(*gen));
-	if (*buf == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get buffer.\n");
-		return -1;
-	}
-	memcpy((*buf)->v, gen + 1, (*buf)->l);
-
-	return 0;
-}
-
-u_int32_t
-isakmp_newmsgid2(iph1)
-	struct ph1handle *iph1;
-{
-	u_int32_t msgid2;
-
-	do {
-		msgid2 = eay_random();
-	} while (getph2bymsgid(iph1, msgid2));
-
-	return msgid2;
-}
-
-/*
- * set values into allocated buffer of isakmp header for phase 1
- */
-static caddr_t
-set_isakmp_header(vbuf, iph1, nptype, etype, flags, msgid)
-	vchar_t *vbuf;
-	struct ph1handle *iph1;
-	int nptype;
-	u_int8_t etype;
-	u_int8_t flags;
-	u_int32_t msgid;
-{
-	struct isakmp *isakmp;
-
-	if (vbuf->l < sizeof(*isakmp))
-		return NULL;
-
-	isakmp = (struct isakmp *)vbuf->v;
-
-	memcpy(&isakmp->i_ck, &iph1->index.i_ck, sizeof(cookie_t));
-	memcpy(&isakmp->r_ck, &iph1->index.r_ck, sizeof(cookie_t));
-	isakmp->np = nptype;
-	isakmp->v = iph1->version;
-	isakmp->etype = etype;
-	isakmp->flags = flags;
-	isakmp->msgid = msgid;
-	isakmp->len = htonl(vbuf->l);
-
-	return vbuf->v + sizeof(*isakmp);
-}
-
-/*
- * set values into allocated buffer of isakmp header for phase 1
- */
-caddr_t
-set_isakmp_header1(vbuf, iph1, nptype)
-	vchar_t *vbuf;
-	struct ph1handle *iph1;
-	int nptype;
-{
-	return set_isakmp_header (vbuf, iph1, nptype, iph1->etype, iph1->flags, iph1->msgid);
-}
-
-/*
- * set values into allocated buffer of isakmp header for phase 2
- */
-caddr_t
-set_isakmp_header2(vbuf, iph2, nptype)
-	vchar_t *vbuf;
-	struct ph2handle *iph2;
-	int nptype;
-{
-	return set_isakmp_header (vbuf, iph2->ph1, nptype, ISAKMP_ETYPE_QUICK, iph2->flags, iph2->msgid);
-}
-
-/*
- * set values into allocated buffer of isakmp payload.
- */
-caddr_t
-set_isakmp_payload(buf, src, nptype)
-	caddr_t buf;
-	vchar_t *src;
-	int nptype;
-{
-	struct isakmp_gen *gen;
-	caddr_t p = buf;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "add payload of len %zu, next type %d\n",
-	    src->l, nptype);
-
-	gen = (struct isakmp_gen *)p;
-	gen->np = nptype;
-	gen->len = htons(sizeof(*gen) + src->l);
-	p += sizeof(*gen);
-	memcpy(p, src->v, src->l);
-	p += src->l;
-
-	return p;
-}
-
-static int
-etypesw1(etype)
-	int etype;
-{
-	switch (etype) {
-	case ISAKMP_ETYPE_IDENT:
-		return 1;
-	case ISAKMP_ETYPE_AGG:
-		return 2;
-	case ISAKMP_ETYPE_BASE:
-		return 3;
-	default:
-		return 0;
-	}
-	/*NOTREACHED*/
-}
-
-static int
-etypesw2(etype)
-	int etype;
-{
-	switch (etype) {
-	case ISAKMP_ETYPE_QUICK:
-		return 1;
-	default:
-		return 0;
-	}
-	/*NOTREACHED*/
-}
-
-#ifdef HAVE_PRINT_ISAKMP_C
-/* for print-isakmp.c */
-char *snapend;
-extern void isakmp_print __P((const u_char *, u_int, const u_char *));
-
-char *getname __P((const u_char *));
-#ifdef INET6
-char *getname6 __P((const u_char *));
-#endif
-int safeputchar __P((int));
-
-/*
- * Return a name for the IP address pointed to by ap.  This address
- * is assumed to be in network byte order.
- */
-char *
-getname(ap)
-	const u_char *ap;
-{
-	struct sockaddr_in addr;
-	static char ntop_buf[NI_MAXHOST];
-
-	memset(&addr, 0, sizeof(addr));
-#ifndef __linux__
-	addr.sin_len = sizeof(struct sockaddr_in);
-#endif
-	addr.sin_family = AF_INET;
-	memcpy(&addr.sin_addr, ap, sizeof(addr.sin_addr));
-	if (getnameinfo((struct sockaddr *)&addr, sizeof(addr),
-			ntop_buf, sizeof(ntop_buf), NULL, 0,
-			NI_NUMERICHOST | niflags))
-		strlcpy(ntop_buf, "?", sizeof(ntop_buf));
-
-	return ntop_buf;
-}
-
-#ifdef INET6
-/*
- * Return a name for the IP6 address pointed to by ap.  This address
- * is assumed to be in network byte order.
- */
-char *
-getname6(ap)
-	const u_char *ap;
-{
-	struct sockaddr_in6 addr;
-	static char ntop_buf[NI_MAXHOST];
-
-	memset(&addr, 0, sizeof(addr));
-	addr.sin6_len = sizeof(struct sockaddr_in6);
-	addr.sin6_family = AF_INET6;
-	memcpy(&addr.sin6_addr, ap, sizeof(addr.sin6_addr));
-	if (getnameinfo((struct sockaddr *)&addr, addr.sin6_len,
-			ntop_buf, sizeof(ntop_buf), NULL, 0,
-			NI_NUMERICHOST | niflags))
-		strlcpy(ntop_buf, "?", sizeof(ntop_buf));
-
-	return ntop_buf;
-}
-#endif /* INET6 */
-
-int
-safeputchar(c)
-	int c;
-{
-	unsigned char ch;
-
-	ch = (unsigned char)(c & 0xff);
-	if (c < 0x80 && isprint(c))
-		return printf("%c", c & 0xff);
-	else
-		return printf("\\%03o", c & 0xff);
-}
-
-void
-isakmp_printpacket(msg, from, my, decoded)
-	vchar_t *msg;
-	struct sockaddr *from;
-	struct sockaddr *my;
-	int decoded;
-{
-#ifdef YIPS_DEBUG
-	struct timeval tv;
-	int s;
-	char hostbuf[NI_MAXHOST];
-	char portbuf[NI_MAXSERV];
-	struct isakmp *isakmp;
-	vchar_t *buf;
-#endif
-
-	if (loglevel < LLV_DEBUG)
-		return;
-
-#ifdef YIPS_DEBUG
-	plog(LLV_DEBUG, LOCATION, NULL, "begin.\n");
-
-	gettimeofday(&tv, NULL);
-	s = tv.tv_sec % 3600;
-	printf("%02d:%02d.%06u ", s / 60, s % 60, (u_int32_t)tv.tv_usec);
-
-	if (from) {
-		if (getnameinfo(from, sysdep_sa_len(from), hostbuf, sizeof(hostbuf),
-				portbuf, sizeof(portbuf),
-				NI_NUMERICHOST | NI_NUMERICSERV | niflags)) {
-			strlcpy(hostbuf, "?", sizeof(hostbuf));
-			strlcpy(portbuf, "?", sizeof(portbuf));
-		}
-		printf("%s:%s", hostbuf, portbuf);
-	} else
-		printf("?");
-	printf(" -> ");
-	if (my) {
-		if (getnameinfo(my, sysdep_sa_len(my), hostbuf, sizeof(hostbuf),
-				portbuf, sizeof(portbuf),
-				NI_NUMERICHOST | NI_NUMERICSERV | niflags)) {
-			strlcpy(hostbuf, "?", sizeof(hostbuf));
-			strlcpy(portbuf, "?", sizeof(portbuf));
-		}
-		printf("%s:%s", hostbuf, portbuf);
-	} else
-		printf("?");
-	printf(": ");
-
-	buf = vdup(msg);
-	if (!buf) {
-		printf("(malloc fail)\n");
-		return;
-	}
-	if (decoded) {
-		isakmp = (struct isakmp *)buf->v;
-		if (isakmp->flags & ISAKMP_FLAG_E) {
-#if 0
-			int pad;
-			pad = *(u_char *)(buf->v + buf->l - 1);
-			if (buf->l < pad && 2 < vflag)
-				printf("(wrong padding)");
-#endif
-			isakmp->flags &= ~ISAKMP_FLAG_E;
-		}
-	}
-
-	snapend = buf->v + buf->l;
-	isakmp_print(buf->v, buf->l, NULL);
-	vfree(buf);
-	printf("\n");
-	fflush(stdout);
-
-	return;
-#endif
-}
-#endif /*HAVE_PRINT_ISAKMP_C*/
-
-int
-copy_ph1addresses(iph1, rmconf, remote, local)
-	struct ph1handle *iph1;
-	struct remoteconf *rmconf;
-	struct sockaddr *remote, *local;
-{
-	u_int16_t port;
-
-	/* address portion must be grabbed from real remote address "remote" */
-	iph1->remote = dupsaddr(remote);
-	if (iph1->remote == NULL)
-		return -1;
-
-	/*
-	 * if remote has no port # (in case of initiator - from ACQUIRE msg)
-	 * - if remote.conf specifies port #, use that
-	 * - if remote.conf does not, use 500
-	 * if remote has port # (in case of responder - from recvfrom(2))
-	 * respect content of "remote".
-	 */
-	if (extract_port(iph1->remote) == 0) {
-		port = extract_port(rmconf->remote);
-		if (port == 0)
-			port = PORT_ISAKMP;
-		set_port(iph1->remote, port);
-	}
-
-	if (local == NULL)
-		iph1->local = getlocaladdr(iph1->remote);
-	else
-		iph1->local = dupsaddr(local);
-	if (iph1->local == NULL)
-		return -1;
-
-	if (extract_port(iph1->local) == 0)
-		set_port(iph1->local, PORT_ISAKMP);
-
-#ifdef ENABLE_NATT
-	if (extract_port(iph1->local) == lcconf->port_isakmp_natt) {
-		plog(LLV_DEBUG, LOCATION, NULL, "Marking ports as changed\n");
-		iph1->natt_flags |= NAT_ADD_NON_ESP_MARKER;
-	}
-#endif
-
-	return 0;
-}
-
-static int
-nostate1(iph1, msg)
-	struct ph1handle *iph1;
-	vchar_t *msg;
-{
-	plog(LLV_ERROR, LOCATION, iph1->remote, "wrong state %u.\n",
-			iph1->status);
-	return -1;
-}
-
-static int
-nostate2(iph2, msg)
-	struct ph2handle *iph2;
-	vchar_t *msg;
-{
-	plog(LLV_ERROR, LOCATION, iph2->ph1->remote, "wrong state %u.\n",
-		iph2->status);
-	return -1;
-}
-
-void
-log_ph1established(iph1)
-	const struct ph1handle *iph1;
-{
-	char *src, *dst;
-
-	src = racoon_strdup(saddr2str(iph1->local));
-	dst = racoon_strdup(saddr2str(iph1->remote));
-	STRDUP_FATAL(src);
-	STRDUP_FATAL(dst);
-
-	plog(LLV_INFO, LOCATION, NULL,
-		"ISAKMP-SA established %s-%s spi:%s\n",
-		src, dst,
-		isakmp_pindex(&iph1->index, 0));
-	
-	EVT_PUSH(iph1->local, iph1->remote, EVTT_PHASE1_UP, NULL);
-	if(!iph1->rmconf->mode_cfg) {
-		EVT_PUSH(iph1->local, iph1->remote, EVTT_NO_ISAKMP_CFG, NULL);
-	}
-
-	racoon_free(src);
-	racoon_free(dst);
-
-	return;
-}
-
-struct payload_list *
-isakmp_plist_append (struct payload_list *plist, vchar_t *payload, int payload_type)
-{
-	if (! plist) {
-		plist = racoon_malloc (sizeof (struct payload_list));
-		plist->prev = NULL;
-	}
-	else {
-		plist->next = racoon_malloc (sizeof (struct payload_list));
-		plist->next->prev = plist;
-		plist = plist->next;
-	}
-
-	plist->next = NULL;
-	plist->payload = payload;
-	plist->payload_type = payload_type;
-
-	return plist;
-}
-
-vchar_t * 
-isakmp_plist_set_all (struct payload_list **plist, struct ph1handle *iph1)
-{
-	struct payload_list *ptr = *plist, *first;
-	size_t tlen = sizeof (struct isakmp), n = 0;
-	vchar_t *buf = NULL;
-	char *p;
-
-	/* Seek to the first item.  */
-	while (ptr->prev) ptr = ptr->prev;
-	first = ptr;
-	
-	/* Compute the whole length.  */
-	while (ptr) {
-		tlen += ptr->payload->l + sizeof (struct isakmp_gen);
-		ptr = ptr->next;
-	}
-
-	buf = vmalloc(tlen);
-	if (buf == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get buffer to send.\n");
-		goto end;
-	}
-
-	ptr = first;
-
-	p = set_isakmp_header1(buf, iph1, ptr->payload_type);
-	if (p == NULL)
-		goto end;
-
-	while (ptr)
-	{
-		p = set_isakmp_payload (p, ptr->payload, ptr->next ? ptr->next->payload_type : ISAKMP_NPTYPE_NONE);
-		first = ptr;
-		ptr = ptr->next;
-		racoon_free (first);
-		/* ptr->prev = NULL; first = NULL; ... omitted.  */
-		n++;
-	}
-
-	*plist = NULL;
-
-	return buf;
-end:
-	if (buf != NULL)
-		vfree(buf);
-	return NULL;
-}
-
-#ifdef ENABLE_FRAG
-int 
-frag_handler(iph1, msg, remote, local)
-	struct ph1handle *iph1;
-	vchar_t *msg;
-	struct sockaddr *remote;
-	struct sockaddr *local;
-{
-	vchar_t *newmsg;
-
-	if (isakmp_frag_extract(iph1, msg) == 1) {
-		if ((newmsg = isakmp_frag_reassembly(iph1)) == NULL) {
-			plog(LLV_ERROR, LOCATION, remote, 
-			    "Packet reassembly failed\n");
-			return -1;
-		}
-		return isakmp_main(newmsg, remote, local);
-	}
-
-	return 0;
-}
-#endif
-
-void
-script_hook(iph1, script)
-	struct ph1handle *iph1;
-	int script;
-{
-#define IP_MAX 40
-#define PORT_MAX 6
-	char addrstr[IP_MAX];
-	char portstr[PORT_MAX];
-	char **envp = NULL;
-	int envc = 1;
-	struct sockaddr_in *sin;
-	char **c;
-
-	if (iph1 == NULL ||
-		iph1->rmconf == NULL ||
-		iph1->rmconf->script[script] == NULL)
-		return;
-
-#ifdef ENABLE_HYBRID
-	(void)isakmp_cfg_setenv(iph1, &envp, &envc);
-#endif
-
-	/* local address */
-	sin = (struct sockaddr_in *)iph1->local;
-	inet_ntop(sin->sin_family, &sin->sin_addr, addrstr, IP_MAX);
-	snprintf(portstr, PORT_MAX, "%d", ntohs(sin->sin_port));
-
-	if (script_env_append(&envp, &envc, "LOCAL_ADDR", addrstr) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL, "Cannot set LOCAL_ADDR\n");
-		goto out;
-	}
-
-	if (script_env_append(&envp, &envc, "LOCAL_PORT", portstr) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL, "Cannot set LOCAL_PORT\n");
-		goto out;
-	}
-
-	/* Peer address */
-	if (iph1->remote != NULL) {
-		sin = (struct sockaddr_in *)iph1->remote;
-		inet_ntop(sin->sin_family, &sin->sin_addr, addrstr, IP_MAX);
-		snprintf(portstr, PORT_MAX, "%d", ntohs(sin->sin_port));
-
-		if (script_env_append(&envp, &envc, 
-		    "REMOTE_ADDR", addrstr) != 0) {
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "Cannot set REMOTE_ADDR\n");
-			goto out;
-		}
-
-		if (script_env_append(&envp, &envc, 
-		    "REMOTE_PORT", portstr) != 0) {
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "Cannot set REMOTEL_PORT\n");
-			goto out;
-		}
-	}
-
-	if (privsep_script_exec(iph1->rmconf->script[script]->v, 
-	    script, envp) != 0) 
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "Script %s execution failed\n", script_names[script]);
-
-out:
-	for (c = envp; *c; c++)
-		racoon_free(*c);
-
-	racoon_free(envp);
-
-	return;
-}
-
-int
-script_env_append(envp, envc, name, value)
-	char ***envp;
-	int *envc;
-	char *name;
-	char *value;
-{
-	char *envitem;
-	char **newenvp;
-	int newenvc;
-
-	if (value == NULL) {
-	        value = "";
-	}
-
-	envitem = racoon_malloc(strlen(name) + 1 + strlen(value) + 1);
-	if (envitem == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "Cannot allocate memory: %s\n", strerror(errno));
-		return -1;
-	}
-	sprintf(envitem, "%s=%s", name, value);
-
-	newenvc = (*envc) + 1;
-	newenvp = racoon_realloc(*envp, newenvc * sizeof(char *));
-	if (newenvp == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "Cannot allocate memory: %s\n", strerror(errno));
-		racoon_free(envitem);
-		return -1;
-	}
-
-	newenvp[newenvc - 2] = envitem;
-	newenvp[newenvc - 1] = NULL;
-
-	*envp = newenvp;
-	*envc = newenvc;
-	return 0;
-}
-
-int
-script_exec(script, name, envp)
-	char *script;
-	int name;
-	char *const envp[];
-{
-	char *argv[] = { NULL, NULL, NULL };
-
-	argv[0] = script;
-	argv[1] = script_names[name];
-	argv[2] = NULL;
-
-	switch (fork()) { 
-	case 0:
-		execve(argv[0], argv, envp);
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "execve(\"%s\") failed: %s\n",
-		    argv[0], strerror(errno));
-		_exit(1);
-		break;
-	case -1:
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "Cannot fork: %s\n", strerror(errno));
-		return -1;
-		break;
-	default:
-		break;
-	}	
-	return 0;
-
-}
-
-void
-purge_remote(iph1)
-	struct ph1handle *iph1;
-{
-	vchar_t *buf = NULL;
-	struct sadb_msg *msg, *next, *end;
-	struct sadb_sa *sa;
-	struct sockaddr *src, *dst;
-	caddr_t mhp[SADB_EXT_MAX + 1];
-	u_int proto_id;
-	struct ph2handle *iph2;
-	struct ph1handle *new_iph1;
-
-	plog(LLV_INFO, LOCATION, NULL,
-		 "purging ISAKMP-SA spi=%s.\n",
-		 isakmp_pindex(&(iph1->index), iph1->msgid));
-
-	/* Mark as expired. */
-	iph1->status = PHASE1ST_EXPIRED;
-
-	/* Check if we have another, still valid, phase1 SA. */
-	new_iph1 = getph1byaddr(iph1->local, iph1->remote, 1);
-
-	/*
-	 * Delete all orphaned or binded to the deleting ph1handle phase2 SAs.
-	 * Keep all others phase2 SAs.
-	 */
-	buf = pfkey_dump_sadb(SADB_SATYPE_UNSPEC);
-	if (buf == NULL) {
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"pfkey_dump_sadb returned nothing.\n");
-		return;
-	}
-
-	msg = (struct sadb_msg *)buf->v;
-	end = (struct sadb_msg *)(buf->v + buf->l);
-
-	while (msg < end) {
-		if ((msg->sadb_msg_len << 3) < sizeof(*msg))
-			break;
-		next = (struct sadb_msg *)((caddr_t)msg + (msg->sadb_msg_len << 3));
-		if (msg->sadb_msg_type != SADB_DUMP) {
-			msg = next;
-			continue;
-		}
-
-		if (pfkey_align(msg, mhp) || pfkey_check(mhp)) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"pfkey_check (%s)\n", ipsec_strerror());
-			msg = next;
-			continue;
-		}
-
-		sa = (struct sadb_sa *)(mhp[SADB_EXT_SA]);
-		if (!sa ||
-		    !mhp[SADB_EXT_ADDRESS_SRC] ||
-		    !mhp[SADB_EXT_ADDRESS_DST]) {
-			msg = next;
-			continue;
-		}
-		src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]);
-		dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]);
-
-		if (sa->sadb_sa_state != SADB_SASTATE_LARVAL &&
-		    sa->sadb_sa_state != SADB_SASTATE_MATURE &&
-		    sa->sadb_sa_state != SADB_SASTATE_DYING) {
-			msg = next;
-			continue;
-		}
-
-		/*
-		 * check in/outbound SAs.
-		 * Select only SAs where src == local and dst == remote (outgoing)
-		 * or src == remote and dst == local (incoming).
-		 */
-		if ((CMPSADDR(iph1->local, src) || CMPSADDR(iph1->remote, dst)) &&
-			(CMPSADDR(iph1->local, dst) || CMPSADDR(iph1->remote, src))) {
-			msg = next;
-			continue;
-		}
-
-		proto_id = pfkey2ipsecdoi_proto(msg->sadb_msg_satype);
-		iph2 = getph2bysaidx(src, dst, proto_id, sa->sadb_sa_spi);
-
-		/* Check if there is another valid ISAKMP-SA */
-		if (new_iph1 != NULL) {
-
-			if (iph2 == NULL) {
-				/* No handler... still send a pfkey_delete message, but log this !*/
-				plog(LLV_INFO, LOCATION, NULL,
-					"Unknown IPsec-SA spi=%u, hmmmm?\n",
-					ntohl(sa->sadb_sa_spi));
-			}else{
-
-				/* 
-				 * If we have a new ph1, do not purge IPsec-SAs binded
-				 *  to a different ISAKMP-SA
-				 */
-				if (iph2->ph1 != NULL && iph2->ph1 != iph1){
-					msg = next;
-					continue;
-				}
-
-				/* If the ph2handle is established, do not purge IPsec-SA */
-				if (iph2->status == PHASE2ST_ESTABLISHED ||
-					iph2->status == PHASE2ST_EXPIRED) {
-					
-					plog(LLV_INFO, LOCATION, NULL,
-						 "keeping IPsec-SA spi=%u - found valid ISAKMP-SA spi=%s.\n",
-						 ntohl(sa->sadb_sa_spi),
-						 isakmp_pindex(&(new_iph1->index), new_iph1->msgid));
-					msg = next;
-					continue;
-				}
-			}
-		}
-
-		
-		pfkey_send_delete(lcconf->sock_pfkey,
-				  msg->sadb_msg_satype,
-				  IPSEC_MODE_ANY,
-				  src, dst, sa->sadb_sa_spi);
-
-		/* delete a relative phase 2 handle. */
-		if (iph2 != NULL) {
-			delete_spd(iph2, 0);
-			unbindph12(iph2);
-			remph2(iph2);
-			delph2(iph2);
-		}
-
-		plog(LLV_INFO, LOCATION, NULL,
-			 "purged IPsec-SA spi=%u.\n",
-			 ntohl(sa->sadb_sa_spi));
-
-		msg = next;
-	}
-
-	if (buf)
-		vfree(buf);
-
-	/* Mark the phase1 handler as EXPIRED */
-	plog(LLV_INFO, LOCATION, NULL,
-		 "purged ISAKMP-SA spi=%s.\n",
-		 isakmp_pindex(&(iph1->index), iph1->msgid));
-
-	SCHED_KILL(iph1->sce);
-
-	iph1->sce = sched_new(1, isakmp_ph1delete_stub, iph1);
-}
-
-void 
-delete_spd(iph2, created)
-	struct ph2handle *iph2;
- 	u_int64_t created;
-{
-	struct policyindex spidx;
-	struct sockaddr_storage addr;
-	u_int8_t pref;
-	struct sockaddr *src;
-	struct sockaddr *dst;
-	int error;
-	int idi2type = 0;/* switch whether copy IDs into id[src,dst]. */
-
-	if (iph2 == NULL)
-		return;
-
-	/* Delete the SPD entry if we generated it
-	 */
-	if (! iph2->generated_spidx )
-		return;
-
-	src = iph2->src;
-	dst = iph2->dst;
-
-	plog(LLV_INFO, LOCATION, NULL,
-		 "generated policy, deleting it.\n");
-		
-	memset(&spidx, 0, sizeof(spidx));
-	iph2->spidx_gen = (caddr_t )&spidx;
-		
-	/* make inbound policy */
-	iph2->src = dst;
-	iph2->dst = src;
-	spidx.dir = IPSEC_DIR_INBOUND;
-	spidx.ul_proto = 0;
-		
-	/* 
-	 * Note: code from get_proposal_r
-	 */
-		
-#define _XIDT(d) ((struct ipsecdoi_id_b *)(d)->v)->type
-		
-	/*
-	 * make destination address in spidx from either ID payload
-	 * or phase 1 address into a address in spidx.
-	 */
-	if (iph2->id != NULL
-		&& (_XIDT(iph2->id) == IPSECDOI_ID_IPV4_ADDR
-			|| _XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR
-			|| _XIDT(iph2->id) == IPSECDOI_ID_IPV4_ADDR_SUBNET
-			|| _XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR_SUBNET)) {
-		/* get a destination address of a policy */
-		error = ipsecdoi_id2sockaddr(iph2->id,
-									 (struct sockaddr *)&spidx.dst,
-									 &spidx.prefd, &spidx.ul_proto);
-		if (error)
-			goto purge;
-			
-#ifdef INET6
-		/*
-		 * get scopeid from the SA address.
-		 * note that the phase 1 source address is used as
-		 * a destination address to search for a inbound 
-		 * policy entry because rcoon is responder.
-		 */
-		if (_XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR) {
-			if ((error = 
-				 setscopeid((struct sockaddr *)&spidx.dst,
-							iph2->src)) != 0)
-				goto purge;
-		}
-#endif
-			
-		if (_XIDT(iph2->id) == IPSECDOI_ID_IPV4_ADDR
-			|| _XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR)
-			idi2type = _XIDT(iph2->id);
-			
-	} else {
-			
-		plog(LLV_DEBUG, LOCATION, NULL,
-			 "get a destination address of SP index "
-			 "from phase1 address "
-			 "due to no ID payloads found "
-			 "OR because ID type is not address.\n");
-			
-		/*
-		 * copy the SOURCE address of IKE into the 
-		 * DESTINATION address of the key to search the 
-		 * SPD because the direction of policy is inbound.
-		 */
-		memcpy(&spidx.dst, iph2->src, sysdep_sa_len(iph2->src));
-		switch (spidx.dst.ss_family) {
-		case AF_INET:
-			spidx.prefd = 
-				sizeof(struct in_addr) << 3;
-			break;
-#ifdef INET6
-		case AF_INET6:
-			spidx.prefd = 
-				sizeof(struct in6_addr) << 3;
-			break;
-#endif
-		default:
-			spidx.prefd = 0;
-			break;
-		}
-	}
-					
-	/* make source address in spidx */
-	if (iph2->id_p != NULL
-		&& (_XIDT(iph2->id_p) == IPSECDOI_ID_IPV4_ADDR
-			|| _XIDT(iph2->id_p) == IPSECDOI_ID_IPV6_ADDR
-			|| _XIDT(iph2->id_p) == IPSECDOI_ID_IPV4_ADDR_SUBNET
-			|| _XIDT(iph2->id_p) == IPSECDOI_ID_IPV6_ADDR_SUBNET)) {
-		/* get a source address of inbound SA */
-		error = ipsecdoi_id2sockaddr(iph2->id_p,
-									 (struct sockaddr *)&spidx.src,
-									 &spidx.prefs, &spidx.ul_proto);
-		if (error)
-			goto purge;
-
-#ifdef INET6
-		/*
-		 * get scopeid from the SA address.
-		 * for more detail, see above of this function.
-		 */
-		if (_XIDT(iph2->id_p) == IPSECDOI_ID_IPV6_ADDR) {
-			error = 
-				setscopeid((struct sockaddr *)&spidx.src,
-						   iph2->dst);
-			if (error)
-				goto purge;
-		}
-#endif
-
-		/* make id[src,dst] if both ID types are IP address and same */
-		if (_XIDT(iph2->id_p) == idi2type
-			&& spidx.dst.ss_family == spidx.src.ss_family) {
-			iph2->src_id = 
-				dupsaddr((struct sockaddr *)&spidx.dst);
-			if (iph2->src_id == NULL) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					 "allocation failed\n");
-				goto purge;
-			}
-			iph2->dst_id = 
-				dupsaddr((struct sockaddr *)&spidx.src);
-			if (iph2->dst_id == NULL) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					 "allocation failed\n");
-				goto purge;
-			}
-		}
-
-	} else {
-		plog(LLV_DEBUG, LOCATION, NULL,
-			 "get a source address of SP index "
-			 "from phase1 address "
-			 "due to no ID payloads found "
-			 "OR because ID type is not address.\n");
-
-		/* see above comment. */
-		memcpy(&spidx.src, iph2->dst, sysdep_sa_len(iph2->dst));
-		switch (spidx.src.ss_family) {
-		case AF_INET:
-			spidx.prefs = 
-				sizeof(struct in_addr) << 3;
-			break;
-#ifdef INET6
-		case AF_INET6:
-			spidx.prefs = 
-				sizeof(struct in6_addr) << 3;
-			break;
-#endif
-		default:
-			spidx.prefs = 0;
-			break;
-		}
-	}
-
-#undef _XIDT
-
-	plog(LLV_DEBUG, LOCATION, NULL,
-		 "get a src address from ID payload "
-		 "%s prefixlen=%u ul_proto=%u\n",
-		 saddr2str((struct sockaddr *)&spidx.src),
-		 spidx.prefs, spidx.ul_proto);
-	plog(LLV_DEBUG, LOCATION, NULL,
-		 "get dst address from ID payload "
-		 "%s prefixlen=%u ul_proto=%u\n",
-		 saddr2str((struct sockaddr *)&spidx.dst),
-		 spidx.prefd, spidx.ul_proto);
-
-	/*
-	 * convert the ul_proto if it is 0
-	 * because 0 in ID payload means a wild card.
-	 */
-	if (spidx.ul_proto == 0)
-		spidx.ul_proto = IPSEC_ULPROTO_ANY;
-
-#undef _XIDT
-
-	/* Check if the generated SPD has the same timestamp as the SA.
-	 * If timestamps are different, this means that the SPD entry has been
-	 * refreshed by another SA, and should NOT be deleted with the current SA.
-	 */
-	if( created ){
-		struct secpolicy *p;
-		
-		p = getsp(&spidx);
-		if(p != NULL){
-			/* just do no test if p is NULL, because this probably just means
-			 * that the policy has already be deleted for some reason.
-			 */
-			if(p->spidx.created != created)
-				goto purge;
-		}
-	}
-
-	/* End of code from get_proposal_r
-	 */
-
-	if (pk_sendspddelete(iph2) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			 "pfkey spddelete(inbound) failed.\n");
-	}else{
-		plog(LLV_DEBUG, LOCATION, NULL,
-			 "pfkey spddelete(inbound) sent.\n");
-	}
-
-#ifdef HAVE_POLICY_FWD
-	/* make forward policy if required */
-	if (tunnel_mode_prop(iph2->approval)) {
-		spidx.dir = IPSEC_DIR_FWD;
-		if (pk_sendspddelete(iph2) < 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				 "pfkey spddelete(forward) failed.\n");
-		}else{
-			plog(LLV_DEBUG, LOCATION, NULL,
-				 "pfkey spddelete(forward) sent.\n");
-		}
-	}
-#endif
-
-	/* make outbound policy */
-	iph2->src = src;
-	iph2->dst = dst;
-	spidx.dir = IPSEC_DIR_OUTBOUND;
-	addr = spidx.src;
-	spidx.src = spidx.dst;
-	spidx.dst = addr;
-	pref = spidx.prefs;
-	spidx.prefs = spidx.prefd;
-	spidx.prefd = pref;
-
-	if (pk_sendspddelete(iph2) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			 "pfkey spddelete(outbound) failed.\n");
-	}else{
-		plog(LLV_DEBUG, LOCATION, NULL,
-			 "pfkey spddelete(outbound) sent.\n");
-	}
-purge:
-	iph2->spidx_gen=NULL;
-}
-
-
-#ifdef INET6
-u_int32_t
-setscopeid(sp_addr0, sa_addr0)
-	struct sockaddr *sp_addr0, *sa_addr0;
-{
-	struct sockaddr_in6 *sp_addr, *sa_addr;
-    
-	sp_addr = (struct sockaddr_in6 *)sp_addr0;
-	sa_addr = (struct sockaddr_in6 *)sa_addr0;
-
-	if (!IN6_IS_ADDR_LINKLOCAL(&sp_addr->sin6_addr)
-	 && !IN6_IS_ADDR_SITELOCAL(&sp_addr->sin6_addr)
-	 && !IN6_IS_ADDR_MULTICAST(&sp_addr->sin6_addr))
-		return 0;
-
-	/* this check should not be here ? */
-	if (sa_addr->sin6_family != AF_INET6) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"can't get scope ID: family mismatch\n");
-		return -1;
-	}
-
-	if (!IN6_IS_ADDR_LINKLOCAL(&sa_addr->sin6_addr)) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"scope ID is not supported except of lladdr.\n");
-		return -1;
-	}
-
-	sp_addr->sin6_scope_id = sa_addr->sin6_scope_id;
-
-	return 0;
-}
-#endif
diff --git a/src/racoon/isakmp.h b/src/racoon/isakmp.h
deleted file mode 100644
index d0fd242..0000000
--- a/src/racoon/isakmp.h
+++ /dev/null
@@ -1,429 +0,0 @@
-/*	$NetBSD: isakmp.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/* Id: isakmp.h,v 1.11 2005/04/25 22:19:39 manubsd Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _ISAKMP_H
-#define _ISAKMP_H
-
-/* refer to RFC 2408 */
-
-/* must include <netinet/in.h> first. */
-/* must include "isakmp_var.h" first. */
-
-#define INITIATOR	0	/* synonym sender */
-#define RESPONDER	1	/* synonym receiver */
-
-#define GENERATE	1
-#define VALIDATE	0
-
-/* 3.1 ISAKMP Header Format
-         0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-        !                          Initiator                            !
-        !                            Cookie                             !
-        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-        !                          Responder                            !
-        !                            Cookie                             !
-        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-        !  Next Payload ! MjVer ! MnVer ! Exchange Type !     Flags     !
-        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-        !                          Message ID                           !
-        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-        !                            Length                             !
-        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-*/
-struct isakmp {
-	cookie_t i_ck;		/* Initiator Cookie */
-	cookie_t r_ck;		/* Responder Cookie */
-	u_int8_t np;		/* Next Payload Type */
-	u_int8_t v;
-	u_int8_t etype;		/* Exchange Type */
-	u_int8_t flags;		/* Flags */
-	u_int32_t msgid;
-	u_int32_t len;		/* Length */
-} __attribute__((__packed__));
-
-/* Next Payload Type */
-#define ISAKMP_NPTYPE_NONE	0	/* NONE*/
-#define ISAKMP_NPTYPE_SA	1	/* Security Association */
-#define ISAKMP_NPTYPE_P		2	/* Proposal */
-#define ISAKMP_NPTYPE_T		3	/* Transform */
-#define ISAKMP_NPTYPE_KE	4	/* Key Exchange */
-#define ISAKMP_NPTYPE_ID	5	/* Identification */
-#define ISAKMP_NPTYPE_CERT	6	/* Certificate */
-#define ISAKMP_NPTYPE_CR	7	/* Certificate Request */
-#define ISAKMP_NPTYPE_HASH	8	/* Hash */
-#define ISAKMP_NPTYPE_SIG	9	/* Signature */
-#define ISAKMP_NPTYPE_NONCE	10	/* Nonce */
-#define ISAKMP_NPTYPE_N		11	/* Notification */
-#define ISAKMP_NPTYPE_D		12	/* Delete */
-#define ISAKMP_NPTYPE_VID	13	/* Vendor ID */
-#define ISAKMP_NPTYPE_ATTR	14	/* Attribute */
-
-
-/* NAT-T draft-ietf-ipsec-nat-t-ike-05 and later */
-/* XXX conflicts with values assigned to RFC 3547 */
-#define ISAKMP_NPTYPE_NATD_BADDRAFT		15	/* NAT Discovery */
-#define ISAKMP_NPTYPE_NATOA_BADDRAFT	16	/* NAT Original Address */
-
-
-/* NAT-T RFC */
-#define ISAKMP_NPTYPE_NATD_RFC	20	/* NAT Discovery */
-#define ISAKMP_NPTYPE_NATOA_RFC	21	/* NAT Original Address */
-
-/* NAT-T up to draft-ietf-ipsec-nat-t-ike-04 */
-#define ISAKMP_NPTYPE_NATD_DRAFT	130	/* NAT Discovery */
-#define ISAKMP_NPTYPE_NATOA_DRAFT	131	/* NAT Original Address */
-
-/* Frag does not seems to be documented */
-#define ISAKMP_NPTYPE_FRAG	132	/* IKE fragmentation payload */
-
-#define ISAKMP_NPTYPE_MAX	17
-			/*	128 - 255 Private Use */
-
-/*
- * The following are valid when the Vendor ID is one of the
- * following:
- *
- *	MD5("A GSS-API Authentication Method for IKE")
- *	MD5("GSSAPI") (recognized by Windows 2000)
- *	MD5("MS NT5 ISAKMPOAKLEY") (sent by Windows 2000)
- *
- * See draft-ietf-ipsec-isakmp-gss-auth-06.txt.
- */
-#define ISAKMP_NPTYPE_GSS	129	/* GSS token */
-
-#define ISAKMP_MAJOR_VERSION	1
-#define ISAKMP_MINOR_VERSION	0
-#define ISAKMP_VERSION_NUMBER	0x10
-#define ISAKMP_GETMAJORV(v)	(((v) & 0xf0) >> 4)
-#define ISAKMP_SETMAJORV(v, m)	((v) = ((v) & 0x0f) | (((m) << 4) & 0xf0))
-#define ISAKMP_GETMINORV(v)	((v) & 0x0f)
-#define ISAKMP_SETMINORV(v, m)	((v) = ((v) & 0xf0) | ((m) & 0x0f))
-
-/* Exchange Type */
-#define ISAKMP_ETYPE_NONE	0	/* NONE */
-#define ISAKMP_ETYPE_BASE	1	/* Base */
-#define ISAKMP_ETYPE_IDENT	2	/* Identity Proteciton */
-#define ISAKMP_ETYPE_AUTH	3	/* Authentication Only */
-#define ISAKMP_ETYPE_AGG	4	/* Aggressive */
-#define ISAKMP_ETYPE_INFO	5	/* Informational */
-#define ISAKMP_ETYPE_CFG	6	/* Mode config */
-/* Additional Exchange Type */
-#define ISAKMP_ETYPE_QUICK	32	/* Quick Mode */
-#define ISAKMP_ETYPE_NEWGRP	33	/* New group Mode */
-#define ISAKMP_ETYPE_ACKINFO	34	/* Acknowledged Informational */
-
-/* Flags */
-#define ISAKMP_FLAG_E 0x01 /* Encryption Bit */
-#define ISAKMP_FLAG_C 0x02 /* Commit Bit */
-#define ISAKMP_FLAG_A 0x04 /* Authentication Only Bit */
-
-/* 3.2 Payload Generic Header
-         0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-        ! Next Payload  !   RESERVED    !         Payload Length        !
-        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-*/
-struct isakmp_gen {
-	u_int8_t np;		/* Next Payload */
-	u_int8_t reserved;	/* RESERVED, unused, must set to 0 */
-	u_int16_t len;		/* Payload Length */
-} __attribute__((__packed__));
-
-/* 3.3 Data Attributes
-         0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
-        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-        !A!       Attribute Type        !    AF=0  Attribute Length     !
-        !F!                             !    AF=1  Attribute Value      !
-        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-        .                   AF=0  Attribute Value                       .
-        .                   AF=1  Not Transmitted                       .
-        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-*/
-struct isakmp_data {
-	u_int16_t type;		/* defined by DOI-spec, and Attribute Format */
-	u_int16_t lorv;		/* if f equal 1, Attribute Length */
-				/* if f equal 0, Attribute Value */
-	/* if f equal 1, Attribute Value */
-} __attribute__((__packed__));
-#define ISAKMP_GEN_TLV 0x0000
-#define ISAKMP_GEN_TV  0x8000
-	/* mask for type of attribute format */
-#define ISAKMP_GEN_MASK 0x8000
-
-#if 0
-/* MAY NOT be used, because of being defined in ipsec-doi. */
-/* 3.4 Security Association Payload */
-struct isakmp_pl_sa {
-	struct isakmp_gen h;
-	u_int32_t doi;		/* Domain of Interpretation */
-	u_int32_t sit;		/* Situation */
-} __attribute__((__packed__));
-#endif
-
-/* 3.5 Proposal Payload */
-	/*
-	The value of the next payload field MUST only contain the value "2"
-	or "0".  If there are additional Proposal payloads in the message,
-	then this field will be 2.  If the current Proposal payload is the
-	last within the security association proposal, then this field will
-	be 0.
-	*/
-struct isakmp_pl_p {
-	struct isakmp_gen h;
-	u_int8_t p_no;		/* Proposal # */
-	u_int8_t proto_id;	/* Protocol */
-	u_int8_t spi_size;	/* SPI Size */
-	u_int8_t num_t;		/* Number of Transforms */
-	/* SPI */
-} __attribute__((__packed__));
-
-/* 3.6 Transform Payload */
-	/*
-	The value of the next payload field MUST only contain the value "3"
-	or "0".  If there are additional Transform payloads in the proposal,
-	then this field will be 3.  If the current Transform payload is the
-	last within the proposal, then this field will be 0.
-	*/
-struct isakmp_pl_t {
-	struct isakmp_gen h;
-	u_int8_t t_no;		/* Transform # */
-	u_int8_t t_id;		/* Transform-Id */
-	u_int16_t reserved;	/* RESERVED2 */
-	/* SA Attributes */
-} __attribute__((__packed__));
-
-/* 3.7 Key Exchange Payload */
-struct isakmp_pl_ke {
-	struct isakmp_gen h;
-	/* Key Exchange Data */
-} __attribute__((__packed__));
-
-#if 0
-/* NOTE: MUST NOT use because of being defined in ipsec-doi instead them. */
-/* 3.8 Identification Payload */
-struct isakmp_pl_id {
-	struct isakmp_gen h;
-	union {
-		u_int8_t id_type;	/* ID Type */
-		u_int32_t doi_data;	/* DOI Specific ID Data */
-	} d;
-	/* Identification Data */
-} __attribute__((__packed__));
-/* A.4 ISAKMP Identification Type Values */
-#define ISAKMP_ID_IPV4_ADDR		0
-#define ISAKMP_ID_IPV4_ADDR_SUBNET	1
-#define ISAKMP_ID_IPV6_ADDR		2
-#define ISAKMP_ID_IPV6_ADDR_SUBNET	3
-#endif
-
-/* 3.9 Certificate Payload */
-struct isakmp_pl_cert {
-	struct isakmp_gen h;
-	/*
-	 * Encoding type of 1 octet follows immediately,
-	 * variable length CERT data follows encoding type.
-	 */
-} __attribute__((__packed__));
-
-/* Certificate Type */
-#define ISAKMP_CERT_NONE	0
-#define ISAKMP_CERT_PKCS7	1
-#define ISAKMP_CERT_PGP		2
-#define ISAKMP_CERT_DNS		3
-#define ISAKMP_CERT_X509SIGN	4
-#define ISAKMP_CERT_X509KE	5
-#define ISAKMP_CERT_KERBEROS	6
-#define ISAKMP_CERT_CRL		7
-#define ISAKMP_CERT_ARL		8
-#define ISAKMP_CERT_SPKI	9
-#define ISAKMP_CERT_X509ATTR	10
-#define ISAKMP_CERT_PLAINRSA	11
-
-/* the method to get peers certificate */
-#define ISAKMP_GETCERT_PAYLOAD		1
-#define ISAKMP_GETCERT_LOCALFILE	2
-#define ISAKMP_GETCERT_DNS		3
-
-/* 3.10 Certificate Request Payload */
-struct isakmp_pl_cr {
-	struct isakmp_gen h;
-	u_int8_t num_cert; /* # Cert. Types */
-	/*
-	Certificate Types (variable length)
-	  -- Contains a list of the types of certificates requested,
-	  sorted in order of preference.  Each individual certificate
-	  type is 1 octet.  This field is NOT required.
-	*/
-	/* # Certificate Authorities (1 octet) */
-	/* Certificate Authorities (variable length) */
-} __attribute__((__packed__));
-
-/* 3.11 Hash Payload */
-struct isakmp_pl_hash {
-	struct isakmp_gen h;
-	/* Hash Data */
-} __attribute__((__packed__));
-
-/* 3.12 Signature Payload */
-struct isakmp_pl_sig {
-	struct isakmp_gen h;
-	/* Signature Data */
-} __attribute__((__packed__));
-
-/* 3.13 Nonce Payload */
-struct isakmp_pl_nonce {
-	struct isakmp_gen h;
-	/* Nonce Data */
-} __attribute__((__packed__));
-
-/* 3.14 Notification Payload */
-struct isakmp_pl_n {
-	struct isakmp_gen h;
-	u_int32_t doi;		/* Domain of Interpretation */
-	u_int8_t proto_id;	/* Protocol-ID */
-	u_int8_t spi_size;	/* SPI Size */
-	u_int16_t type;		/* Notify Message Type */
-	/* SPI */
-	/* Notification Data */
-} __attribute__((__packed__));
-
-/* 3.14.1 Notify Message Types */
-/* NOTIFY MESSAGES - ERROR TYPES */
-#define ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE	1
-#define ISAKMP_NTYPE_DOI_NOT_SUPPORTED		2
-#define ISAKMP_NTYPE_SITUATION_NOT_SUPPORTED	3
-#define ISAKMP_NTYPE_INVALID_COOKIE		4
-#define ISAKMP_NTYPE_INVALID_MAJOR_VERSION	5
-#define ISAKMP_NTYPE_INVALID_MINOR_VERSION	6
-#define ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE	7
-#define ISAKMP_NTYPE_INVALID_FLAGS		8
-#define ISAKMP_NTYPE_INVALID_MESSAGE_ID		9
-#define ISAKMP_NTYPE_INVALID_PROTOCOL_ID	10
-#define ISAKMP_NTYPE_INVALID_SPI		11
-#define ISAKMP_NTYPE_INVALID_TRANSFORM_ID	12
-#define ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED	13
-#define ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN		14
-#define ISAKMP_NTYPE_BAD_PROPOSAL_SYNTAX	15
-#define ISAKMP_NTYPE_PAYLOAD_MALFORMED		16
-#define ISAKMP_NTYPE_INVALID_KEY_INFORMATION	17
-#define ISAKMP_NTYPE_INVALID_ID_INFORMATION	18
-#define ISAKMP_NTYPE_INVALID_CERT_ENCODING	19
-#define ISAKMP_NTYPE_INVALID_CERTIFICATE	20
-#define ISAKMP_NTYPE_BAD_CERT_REQUEST_SYNTAX	21
-#define ISAKMP_NTYPE_INVALID_CERT_AUTHORITY	22
-#define ISAKMP_NTYPE_INVALID_HASH_INFORMATION	23
-#define ISAKMP_NTYPE_AUTHENTICATION_FAILED	24
-#define ISAKMP_NTYPE_INVALID_SIGNATURE		25
-#define ISAKMP_NTYPE_ADDRESS_NOTIFICATION	26
-#define ISAKMP_NTYPE_NOTIFY_SA_LIFETIME		27
-#define ISAKMP_NTYPE_CERTIFICATE_UNAVAILABLE	28
-#define ISAKMP_NTYPE_UNSUPPORTED_EXCHANGE_TYPE	29
-#define ISAKMP_NTYPE_UNEQUAL_PAYLOAD_LENGTHS	30
-#define ISAKMP_NTYPE_MINERROR			1
-#define ISAKMP_NTYPE_MAXERROR			16383
-/* NOTIFY MESSAGES - STATUS TYPES */
-#define ISAKMP_NTYPE_CONNECTED			16384
-/* 4.6.3 IPSEC DOI Notify Message Types */
-#define ISAKMP_NTYPE_RESPONDER_LIFETIME		24576
-#define ISAKMP_NTYPE_REPLAY_STATUS		24577
-#define ISAKMP_NTYPE_INITIAL_CONTACT		24578
-
-/* DPD */
-#define ISAKMP_NTYPE_R_U_THERE			36136
-#define ISAKMP_NTYPE_R_U_THERE_ACK		36137
-
-#define ISAKMP_NTYPE_HEARTBEAT			40503
-
-/* using only to log */
-#define ISAKMP_LOG_RETRY_LIMIT_REACHED		65530
-
-/* XXX means internal error but it's not reserved by any drafts... */
-#define ISAKMP_INTERNAL_ERROR			-1
-
-/* 3.15 Delete Payload */
-struct isakmp_pl_d {
-	struct isakmp_gen h;
-	u_int32_t doi;		/* Domain of Interpretation */
-	u_int8_t proto_id;	/* Protocol-Id */
-	u_int8_t spi_size;	/* SPI Size */
-	u_int16_t num_spi;	/* # of SPIs */
-	/* SPI(es) */
-} __attribute__((__packed__));
-
-struct payload_list {
-	struct payload_list	*next, *prev;
-	vchar_t			*payload;
-	int			payload_type;
-};
-
-
-/* See draft-ietf-ipsec-isakmp-mode-cfg-04.txt, 3.2 */
-struct isakmp_pl_attr {
-	struct isakmp_gen h;
-	u_int8_t type;		/* Exchange type */
-	u_int8_t res2;
-	u_int16_t id;		/* Per transaction id */
-} __attribute__((__packed__));
-            
-/* Exchange type */
-#define ISAKMP_CFG_REQUEST	1
-#define ISAKMP_CFG_REPLY	2
-#define ISAKMP_CFG_SET		3
-#define ISAKMP_CFG_ACK		4
-
-/* IKE fragmentation payload */
-struct isakmp_frag {
-	u_int16_t unknown0;	/* always set to zero? */
-	u_int16_t len;
-	u_int16_t unknown1;	/* always set to 1? */
-	u_int8_t index;
-	u_int8_t flags;
-} __attribute__((__packed__)); 
-
-/* flags */
-#define ISAKMP_FRAG_LAST	1
-
-/* DPD R-U-THERE / R-U-THERE-ACK Payload */
-struct isakmp_pl_ru {
-	struct isakmp_gen h;
-	u_int32_t doi;		/* Domain of Interpretation */
-	u_int8_t proto_id;	/* Protocol-Id */
-	u_int8_t spi_size;	/* SPI Size */
-	u_int16_t type;		/* Notify type */
-	cookie_t  i_ck;	/* Initiator Cookie */
-	cookie_t r_ck;	/* Responder cookie*/
-	u_int32_t data;		/* Notification data */
-} __attribute__((__packed__));
-
-#endif /* _ISAKMP_H */
diff --git a/src/racoon/isakmp_agg.c b/src/racoon/isakmp_agg.c
deleted file mode 100644
index d9b89d9..0000000
--- a/src/racoon/isakmp_agg.c
+++ /dev/null
@@ -1,1489 +0,0 @@
-/*	$NetBSD: isakmp_agg.c,v 1.9 2006/09/30 21:49:37 manu Exp $	*/
-
-/* Id: isakmp_agg.c,v 1.28 2006/04/06 16:46:08 manubsd Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-/* Aggressive Exchange (Aggressive Mode) */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-#if TIME_WITH_SYS_TIME
-# include <sys/time.h>
-# include <time.h>
-#else
-# if HAVE_SYS_TIME_H
-#  include <sys/time.h>
-# else
-#  include <time.h>
-# endif
-#endif
-
-#include "var.h"
-#include "misc.h"
-#include "vmbuf.h"
-#include "plog.h"
-#include "sockmisc.h"
-#include "schedule.h"
-#include "debug.h"
-
-#ifdef ENABLE_HYBRID
-#include <resolv.h>
-#endif
-
-#include "localconf.h"
-#include "remoteconf.h"
-#include "isakmp_var.h"
-#include "isakmp.h"
-#include "evt.h"
-#include "oakley.h"
-#include "handler.h"
-#include "ipsec_doi.h"
-#include "crypto_openssl.h"
-#include "pfkey.h"
-#include "isakmp_agg.h"
-#include "isakmp_inf.h"
-#ifdef ENABLE_HYBRID
-#include "isakmp_xauth.h"
-#include "isakmp_cfg.h"
-#endif
-#ifdef ENABLE_FRAG
-#include "isakmp_frag.h"
-#endif
-#include "vendorid.h"
-#include "strnames.h"
-
-#ifdef ENABLE_NATT
-#include "nattraversal.h"
-#endif
-
-#ifdef HAVE_GSSAPI
-#include "gssapi.h"
-#endif
-
-/*
- * begin Aggressive Mode as initiator.
- */
-/*
- * send to responder
- * 	psk: HDR, SA, KE, Ni, IDi1
- * 	sig: HDR, SA, KE, Ni, IDi1 [, CR ]
- *   gssapi: HDR, SA, KE, Ni, IDi1, GSSi
- * 	rsa: HDR, SA, [ HASH(1),] KE, <IDi1_b>Pubkey_r, <Ni_b>Pubkey_r
- * 	rev: HDR, SA, [ HASH(1),] <Ni_b>Pubkey_r, <KE_b>Ke_i,
- * 	     <IDii_b>Ke_i [, <Cert-I_b>Ke_i ]
- */
-int
-agg_i1send(iph1, msg)
-	struct ph1handle *iph1;
-	vchar_t *msg; /* must be null */
-{
-	struct payload_list *plist = NULL;
-	int need_cr = 0;
-	vchar_t *cr = NULL; 
-	int error = -1;
-#ifdef ENABLE_NATT
-	vchar_t *vid_natt[MAX_NATT_VID_COUNT] = { NULL };
-	int i;
-#endif
-#ifdef ENABLE_HYBRID
-	vchar_t *vid_xauth = NULL;
-	vchar_t *vid_unity = NULL;
-#endif
-#ifdef ENABLE_FRAG
-	vchar_t *vid_frag = NULL;
-#endif
-#ifdef HAVE_GSSAPI
-	vchar_t *gsstoken = NULL;
-	int len;
-#endif
-#ifdef ENABLE_DPD
-	vchar_t *vid_dpd = NULL;
-#endif
-
-
-	/* validity check */
-	if (msg != NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"msg has to be NULL in this function.\n");
-		goto end;
-	}
-	if (iph1->status != PHASE1ST_START) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph1->status);
-		goto end;
-	}
-
-	/* create isakmp index */
-	memset(&iph1->index, 0, sizeof(iph1->index));
-	isakmp_newcookie((caddr_t)&iph1->index, iph1->remote, iph1->local);
-
-	/* make ID payload into isakmp status */
-	if (ipsecdoi_setid1(iph1) < 0)
-		goto end;
-
-	/* create SA payload for my proposal */
-	iph1->sa = ipsecdoi_setph1proposal(iph1->rmconf->proposal);
-	if (iph1->sa == NULL)
-		goto end;
-
-	/* consistency check of proposals */
-	if (iph1->rmconf->dhgrp == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"configuration failure about DH group.\n");
-		goto end;
-	}
-
-	/* generate DH public value */
-	if (oakley_dh_generate(iph1->rmconf->dhgrp,
-				&iph1->dhpub, &iph1->dhpriv) < 0)
-		goto end;
-
-	/* generate NONCE value */
-	iph1->nonce = eay_set_random(iph1->rmconf->nonce_size);
-	if (iph1->nonce == NULL)
-		goto end;
-
-#ifdef ENABLE_HYBRID
-	/* Do we need Xauth VID? */
-	switch (RMAUTHMETHOD(iph1)) {
-	case FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_I:
-		if ((vid_xauth = set_vendorid(VENDORID_XAUTH)) == NULL)
-			plog(LLV_ERROR, LOCATION, NULL, 
-			     "Xauth vendor ID generation failed\n");
-		if ((vid_unity = set_vendorid(VENDORID_UNITY)) == NULL)
-			plog(LLV_ERROR, LOCATION, NULL, 
-			     "Unity vendor ID generation failed\n");
-		break;
-	default:
-		break;
-	}
-#endif
-
-#ifdef ENABLE_FRAG
-	if (iph1->rmconf->ike_frag) {
-		vid_frag = set_vendorid(VENDORID_FRAG);
-		if (vid_frag != NULL)
-			vid_frag = isakmp_frag_addcap(vid_frag,
-			    VENDORID_FRAG_AGG);
-		if (vid_frag == NULL)
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "Frag vendorID construction failed\n");
-	}		
-#endif
-
-	/* create CR if need */
-	if (iph1->rmconf->send_cr
-	 && oakley_needcr(iph1->rmconf->proposal->authmethod)
-	 && iph1->rmconf->peerscertfile == NULL) {
-		need_cr = 1;
-		cr = oakley_getcr(iph1);
-		if (cr == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to get cr buffer.\n");
-			goto end;
-		}
-	}
-
-	plog(LLV_DEBUG, LOCATION, NULL, "authmethod is %s\n",
-		s_oakley_attr_method(iph1->rmconf->proposal->authmethod));
-#ifdef HAVE_GSSAPI
-	if (RMAUTHMETHOD(iph1) == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB)
-		gssapi_get_itoken(iph1, &len);
-#endif
-
-	/* set SA payload to propose */
-	plist = isakmp_plist_append(plist, iph1->sa, ISAKMP_NPTYPE_SA);
-
-	/* create isakmp KE payload */
-	plist = isakmp_plist_append(plist, iph1->dhpub, ISAKMP_NPTYPE_KE);
-
-	/* create isakmp NONCE payload */
-	plist = isakmp_plist_append(plist, iph1->nonce, ISAKMP_NPTYPE_NONCE);
-
-	/* create isakmp ID payload */
-	plist = isakmp_plist_append(plist, iph1->id, ISAKMP_NPTYPE_ID);
-
-#ifdef HAVE_GSSAPI
-	if (RMAUTHMETHOD(iph1) == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB) {
-		gssapi_get_token_to_send(iph1, &gsstoken);
-		plist = isakmp_plist_append(plist, gsstoken, ISAKMP_NPTYPE_GSS);
-	}
-#endif
-	/* create isakmp CR payload */
-	if (need_cr)
-		plist = isakmp_plist_append(plist, cr, ISAKMP_NPTYPE_CR);
-
-#ifdef ENABLE_FRAG
-	if (vid_frag)
-		plist = isakmp_plist_append(plist, vid_frag, ISAKMP_NPTYPE_VID);
-#endif
-#ifdef ENABLE_NATT
-	/* 
-	 * set VID payload for NAT-T if NAT-T 
-	 * support allowed in the config file 
-	 */
-	if (iph1->rmconf->nat_traversal) 
-		plist = isakmp_plist_append_natt_vids(plist, vid_natt);
-#endif
-#ifdef ENABLE_HYBRID
-	if (vid_xauth)
-		plist = isakmp_plist_append(plist, 
-		    vid_xauth, ISAKMP_NPTYPE_VID);
-	if (vid_unity)
-		plist = isakmp_plist_append(plist, 
-		    vid_unity, ISAKMP_NPTYPE_VID);
-#endif
-#ifdef ENABLE_DPD
-	if(iph1->rmconf->dpd){
-		vid_dpd = set_vendorid(VENDORID_DPD);
-		if (vid_dpd != NULL)
-			plist = isakmp_plist_append(plist, vid_dpd, ISAKMP_NPTYPE_VID);
-	}
-#endif
-
-	iph1->sendbuf = isakmp_plist_set_all (&plist, iph1);
-
-#ifdef HAVE_PRINT_ISAKMP_C
-	isakmp_printpacket(iph1->sendbuf, iph1->local, iph1->remote, 0);
-#endif
-
-	/* send the packet, add to the schedule to resend */
-	iph1->retry_counter = iph1->rmconf->retry_counter;
-	if (isakmp_ph1resend(iph1) == -1)
-		goto end;
-
-	iph1->status = PHASE1ST_MSG1SENT;
-
-	error = 0;
-
-end:
-	if (cr)
-		vfree(cr);
-#ifdef HAVE_GSSAPI
-	if (gsstoken)
-		vfree(gsstoken);
-#endif
-#ifdef ENABLE_FRAG
-	if (vid_frag)
-		vfree(vid_frag);
-#endif
-#ifdef ENABLE_NATT
-	for (i = 0; i < MAX_NATT_VID_COUNT && vid_natt[i] != NULL; i++)
-		vfree(vid_natt[i]);
-#endif
-#ifdef ENABLE_HYBRID
-	if (vid_xauth != NULL)
-		vfree(vid_xauth);
-	if (vid_unity != NULL)
-		vfree(vid_unity);
-#endif
-#ifdef ENABLE_DPD
-	if (vid_dpd != NULL)
-		vfree(vid_dpd);
-#endif
-
-	return error;
-}
-
-/*
- * receive from responder
- * 	psk: HDR, SA, KE, Nr, IDr1, HASH_R
- * 	sig: HDR, SA, KE, Nr, IDr1, [ CR, ] [ CERT, ] SIG_R
- *   gssapi: HDR, SA, KE, Nr, IDr1, GSSr, HASH_R
- * 	rsa: HDR, SA, KE, <IDr1_b>PubKey_i, <Nr_b>PubKey_i, HASH_R
- * 	rev: HDR, SA, <Nr_b>PubKey_i, <KE_b>Ke_r, <IDir_b>Ke_r, HASH_R
- */
-int
-agg_i2recv(iph1, msg)
-	struct ph1handle *iph1;
-	vchar_t *msg;
-{
-	vchar_t *pbuf = NULL;
-	struct isakmp_parse_t *pa;
-	vchar_t *satmp = NULL;
-	int error = -1;
-	int vid_numeric;
-	int ptype;
-#ifdef ENABLE_HYBRID
-	vchar_t *unity_vid;
-	vchar_t *xauth_vid;
-#endif
-#ifdef HAVE_GSSAPI
-	vchar_t *gsstoken = NULL;
-#endif
-
-#ifdef ENABLE_NATT
-	int natd_seq = 0;
-	struct natd_payload {
-		int seq;
-		vchar_t *payload;
-		TAILQ_ENTRY(natd_payload) chain;
-	};
-	TAILQ_HEAD(_natd_payload, natd_payload) natd_tree;
-	TAILQ_INIT(&natd_tree);
-#endif
-
-	/* validity check */
-	if (iph1->status != PHASE1ST_MSG1SENT) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph1->status);
-		goto end;
-	}
-
-	/* validate the type of next payload */
-	pbuf = isakmp_parse(msg);
-	if (pbuf == NULL)
-		goto end;
-	pa = (struct isakmp_parse_t *)pbuf->v;
-
-	iph1->pl_hash = NULL;
-
-	/* SA payload is fixed postion */
-	if (pa->type != ISAKMP_NPTYPE_SA) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"received invalid next payload type %d, "
-			"expecting %d.\n",
-			pa->type, ISAKMP_NPTYPE_SA);
-		goto end;
-	}
-
-	if (isakmp_p2ph(&satmp, pa->ptr) < 0)
-		goto end;
-	pa++;
-
-	for (/*nothing*/;
-	     pa->type != ISAKMP_NPTYPE_NONE;
-	     pa++) {
-
-		switch (pa->type) {
-		case ISAKMP_NPTYPE_KE:
-			if (isakmp_p2ph(&iph1->dhpub_p, pa->ptr) < 0)
-				goto end;
-			break;
-		case ISAKMP_NPTYPE_NONCE:
-			if (isakmp_p2ph(&iph1->nonce_p, pa->ptr) < 0)
-				goto end;
-			break;
-		case ISAKMP_NPTYPE_ID:
-			if (isakmp_p2ph(&iph1->id_p, pa->ptr) < 0)
-				goto end;
-			break;
-		case ISAKMP_NPTYPE_HASH:
-			iph1->pl_hash = (struct isakmp_pl_hash *)pa->ptr;
-			break;
-		case ISAKMP_NPTYPE_CR:
-			if (oakley_savecr(iph1, pa->ptr) < 0)
-				goto end;
-			break;
-		case ISAKMP_NPTYPE_CERT:
-			if (oakley_savecert(iph1, pa->ptr) < 0)
-				goto end;
-			break;
-		case ISAKMP_NPTYPE_SIG:
-			if (isakmp_p2ph(&iph1->sig_p, pa->ptr) < 0)
-				goto end;
-			break;
-		case ISAKMP_NPTYPE_VID:
-			handle_vendorid(iph1, pa->ptr);
-			break;
-		case ISAKMP_NPTYPE_N:
-			isakmp_check_notify(pa->ptr, iph1);
-			break;
-#ifdef HAVE_GSSAPI
-		case ISAKMP_NPTYPE_GSS:
-			if (isakmp_p2ph(&gsstoken, pa->ptr) < 0)
-				goto end;
-			gssapi_save_received_token(iph1, gsstoken);
-			break;
-#endif
-
-#ifdef ENABLE_NATT
-		case ISAKMP_NPTYPE_NATD_DRAFT:
-		case ISAKMP_NPTYPE_NATD_RFC:
-			if (NATT_AVAILABLE(iph1) && iph1->natt_options != NULL &&
-			    pa->type == iph1->natt_options->payload_nat_d) {
-				struct natd_payload *natd;
-				natd = (struct natd_payload *)racoon_malloc(sizeof(*natd));
-				if (!natd)
-					goto end;
-
-				natd->payload = NULL;
-
-				if (isakmp_p2ph (&natd->payload, pa->ptr) < 0)
-					goto end;
-
-				natd->seq = natd_seq++;
-
-				TAILQ_INSERT_TAIL(&natd_tree, natd, chain);
-				break;
-			}
-			/* passthrough to default... */
-#endif
-
-		default:
-			/* don't send information, see isakmp_ident_r1() */
-			plog(LLV_ERROR, LOCATION, iph1->remote,
-				"ignore the packet, "
-				"received unexpecting payload type %d.\n",
-				pa->type);
-			goto end;
-		}
-	}
-
-	/* payload existency check */
-	if (iph1->dhpub_p == NULL || iph1->nonce_p == NULL) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"few isakmp message received.\n");
-		goto end;
-	}
-
-	/* verify identifier */
-	if (ipsecdoi_checkid1(iph1) != 0) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"invalid ID payload.\n");
-		goto end;
-	}
-
-	/* check SA payload and set approval SA for use */
-	if (ipsecdoi_checkph1proposal(satmp, iph1) < 0) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"failed to get valid proposal.\n");
-		/* XXX send information */
-		goto end;
-	}
-	VPTRINIT(iph1->sa_ret);
-
-	/* fix isakmp index */
-	memcpy(&iph1->index.r_ck, &((struct isakmp *)msg->v)->r_ck,
-		sizeof(cookie_t));
-
-#ifdef ENABLE_NATT
-	if (NATT_AVAILABLE(iph1)) {
-		struct natd_payload *natd = NULL;
-		int natd_verified;
-		
-		plog(LLV_INFO, LOCATION, iph1->remote,
-		     "Selected NAT-T version: %s\n",
-		     vid_string_by_id(iph1->natt_options->version));
-
-		/* set both bits first so that we can clear them
-		   upon verifying hashes */
-		iph1->natt_flags |= NAT_DETECTED;
-                        
-		while ((natd = TAILQ_FIRST(&natd_tree)) != NULL) {
-			/* this function will clear appropriate bits bits 
-			   from iph1->natt_flags */
-			natd_verified = natt_compare_addr_hash (iph1,
-				natd->payload, natd->seq);
-
-			plog (LLV_INFO, LOCATION, NULL, "NAT-D payload #%d %s\n",
-				natd->seq - 1,
-				natd_verified ? "verified" : "doesn't match");
-			
-			vfree (natd->payload);
-
-			TAILQ_REMOVE(&natd_tree, natd, chain);
-			racoon_free (natd);
-		}
-
-		plog (LLV_INFO, LOCATION, NULL, "NAT %s %s%s\n",
-		      iph1->natt_flags & NAT_DETECTED ? 
-		      		"detected:" : "not detected",
-		      iph1->natt_flags & NAT_DETECTED_ME ? "ME " : "",
-		      iph1->natt_flags & NAT_DETECTED_PEER ? "PEER" : "");
-
-		if (iph1->natt_flags & NAT_DETECTED)
-			natt_float_ports (iph1);
-	}
-#endif
-
-	/* compute sharing secret of DH */
-	if (oakley_dh_compute(iph1->rmconf->dhgrp, iph1->dhpub,
-				iph1->dhpriv, iph1->dhpub_p, &iph1->dhgxy) < 0)
-		goto end;
-
-	/* generate SKEYIDs & IV & final cipher key */
-	if (oakley_skeyid(iph1) < 0)
-		goto end;
-	if (oakley_skeyid_dae(iph1) < 0)
-		goto end;
-	if (oakley_compute_enckey(iph1) < 0)
-		goto end;
-	if (oakley_newiv(iph1) < 0)
-		goto end;
-
-	/* validate authentication value */
-	ptype = oakley_validate_auth(iph1);
-	if (ptype != 0) {
-		if (ptype == -1) {
-			/* message printed inner oakley_validate_auth() */
-			goto end;
-		}
-		EVT_PUSH(iph1->local, iph1->remote, 
-		    EVTT_PEERPH1AUTH_FAILED, NULL);
-		isakmp_info_send_n1(iph1, ptype, NULL);
-		goto end;
-	}
-
-	if (oakley_checkcr(iph1) < 0) {
-		/* Ignore this error in order to be interoperability. */
-		;
-	}
-
-	/* change status of isakmp status entry */
-	iph1->status = PHASE1ST_MSG2RECEIVED;
-
-	error = 0;
-
-end:
-#ifdef HAVE_GSSAPI
-	if (gsstoken)
-		vfree(gsstoken);
-#endif
-	if (pbuf)
-		vfree(pbuf);
-	if (satmp)
-		vfree(satmp);
-	if (error) {
-		VPTRINIT(iph1->dhpub_p);
-		VPTRINIT(iph1->nonce_p);
-		VPTRINIT(iph1->id_p);
-		oakley_delcert(iph1->cert_p);
-		iph1->cert_p = NULL;
-		oakley_delcert(iph1->crl_p);
-		iph1->crl_p = NULL;
-		VPTRINIT(iph1->sig_p);
-		oakley_delcert(iph1->cr_p);
-		iph1->cr_p = NULL;
-	}
-
-	return error;
-}
-
-/*
- * send to responder
- * 	psk: HDR, HASH_I
- *   gssapi: HDR, HASH_I
- * 	sig: HDR, [ CERT, ] SIG_I
- * 	rsa: HDR, HASH_I
- * 	rev: HDR, HASH_I
- */
-int
-agg_i2send(iph1, msg)
-	struct ph1handle *iph1;
-	vchar_t *msg;
-{
-	struct payload_list *plist = NULL;
-	int need_cert = 0;
-	int error = -1;
-	vchar_t *gsshash = NULL;
-
-	/* validity check */
-	if (iph1->status != PHASE1ST_MSG2RECEIVED) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph1->status);
-		goto end;
-	}
-
-	/* generate HASH to send */
-	plog(LLV_DEBUG, LOCATION, NULL, "generate HASH_I\n");
-	iph1->hash = oakley_ph1hash_common(iph1, GENERATE);
-	if (iph1->hash == NULL) {
-#ifdef HAVE_GSSAPI
-		if (gssapi_more_tokens(iph1) &&
-#ifdef ENABLE_HYBRID
-		    !iph1->rmconf->xauth &&
-#endif
-		    1)
-			isakmp_info_send_n1(iph1,
-			    ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE, NULL);
-#endif
-		goto end;
-	}
-
-	switch (AUTHMETHOD(iph1)) {
-	case OAKLEY_ATTR_AUTH_METHOD_PSKEY:
-#ifdef ENABLE_HYBRID
-	case FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
-#endif  
-		/* set HASH payload */
-		plist = isakmp_plist_append(plist, 
-		    iph1->hash, ISAKMP_NPTYPE_HASH);
-		break;
-
-	case OAKLEY_ATTR_AUTH_METHOD_DSSSIG:
-	case OAKLEY_ATTR_AUTH_METHOD_RSASIG:
-#ifdef ENABLE_HYBRID
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I:
-#endif
-		/* XXX if there is CR or not ? */
-
-		if (oakley_getmycert(iph1) < 0)
-			goto end;
-
-		if (oakley_getsign(iph1) < 0)
-			goto end;
-
-		if (iph1->cert != NULL && iph1->rmconf->send_cert)
-			need_cert = 1;
-
-		/* add CERT payload if there */
-		if (need_cert)
-			plist = isakmp_plist_append(plist, 
-			    iph1->cert->pl, ISAKMP_NPTYPE_CERT);
-
-		/* add SIG payload */
-		plist = isakmp_plist_append(plist, 
-		    iph1->sig, ISAKMP_NPTYPE_SIG);
-		break;
-
-	case OAKLEY_ATTR_AUTH_METHOD_RSAENC:
-	case OAKLEY_ATTR_AUTH_METHOD_RSAREV:
-#ifdef ENABLE_HYBRID
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_I:
-#endif
-		break;
-#ifdef HAVE_GSSAPI
-	case OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB:
-		gsshash = gssapi_wraphash(iph1);
-		if (gsshash == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to wrap hash\n");
-			isakmp_info_send_n1(iph1,
-				ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE, NULL);
-			goto end;
-		}
-
-		plist = isakmp_plist_append(plist, 
-		    gsshash, ISAKMP_NPTYPE_HASH);
-		break;
-#endif
-	}
-
-#ifdef ENABLE_NATT
-	/* generate NAT-D payloads */
-	if (NATT_AVAILABLE(iph1)) {
-		vchar_t *natd[2] = { NULL, NULL };
-
-		plog(LLV_INFO, LOCATION, 
-		    NULL, "Adding remote and local NAT-D payloads.\n");
-
-		if ((natd[0] = natt_hash_addr (iph1, iph1->remote)) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "NAT-D hashing failed for %s\n", 
-			    saddr2str(iph1->remote));
-			goto end;
-		}
-
-		if ((natd[1] = natt_hash_addr (iph1, iph1->local)) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "NAT-D hashing failed for %s\n", 
-			    saddr2str(iph1->local));
-			goto end;
-		}
-
-		plist = isakmp_plist_append(plist, 
-		    natd[0], iph1->natt_options->payload_nat_d);
-		plist = isakmp_plist_append(plist, 
-		    natd[1], iph1->natt_options->payload_nat_d);
-	}
-#endif
-
-	iph1->sendbuf = isakmp_plist_set_all (&plist, iph1);
-
-#ifdef HAVE_PRINT_ISAKMP_C
-	isakmp_printpacket(iph1->sendbuf, iph1->local, iph1->remote, 0);
-#endif
-
-	/* send to responder */
-	if (isakmp_send(iph1, iph1->sendbuf) < 0)
-		goto end;
-
-	/* the sending message is added to the received-list. */
-	if (add_recvdpkt(iph1->remote, iph1->local, iph1->sendbuf, msg) == -1) {
-		plog(LLV_ERROR , LOCATION, NULL,
-			"failed to add a response packet to the tree.\n");
-		goto end;
-	}
-
-	/* set encryption flag */
-	iph1->flags |= ISAKMP_FLAG_E;
-
-	iph1->status = PHASE1ST_ESTABLISHED;
-
-	error = 0;
-
-end:
-	if (gsshash)
-		vfree(gsshash);
-	return error;
-}
-
-/*
- * receive from initiator
- * 	psk: HDR, SA, KE, Ni, IDi1
- * 	sig: HDR, SA, KE, Ni, IDi1 [, CR ]
- *   gssapi: HDR, SA, KE, Ni, IDi1 , GSSi
- * 	rsa: HDR, SA, [ HASH(1),] KE, <IDi1_b>Pubkey_r, <Ni_b>Pubkey_r
- * 	rev: HDR, SA, [ HASH(1),] <Ni_b>Pubkey_r, <KE_b>Ke_i,
- * 	     <IDii_b>Ke_i [, <Cert-I_b>Ke_i ]
- */
-int
-agg_r1recv(iph1, msg)
-	struct ph1handle *iph1;
-	vchar_t *msg;
-{
-	int error = -1;
-	vchar_t *pbuf = NULL;
-	struct isakmp_parse_t *pa;
-	int vid_numeric;
-#ifdef HAVE_GSSAPI
-	vchar_t *gsstoken = NULL;
-#endif
-
-	/* validity check */
-	if (iph1->status != PHASE1ST_START) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph1->status);
-		goto end;
-	}
-
-	/* validate the type of next payload */
-	pbuf = isakmp_parse(msg);
-	if (pbuf == NULL)
-		goto end;
-	pa = (struct isakmp_parse_t *)pbuf->v;
-
-	/* SA payload is fixed postion */
-	if (pa->type != ISAKMP_NPTYPE_SA) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"received invalid next payload type %d, "
-			"expecting %d.\n",
-			pa->type, ISAKMP_NPTYPE_SA);
-		goto end;
-	}
-	if (isakmp_p2ph(&iph1->sa, pa->ptr) < 0)
-		goto end;
-	pa++;
-
-	for (/*nothing*/;
-	     pa->type != ISAKMP_NPTYPE_NONE;
-	     pa++) {
-
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"received payload of type %s\n",
-			s_isakmp_nptype(pa->type));
-
-		switch (pa->type) {
-		case ISAKMP_NPTYPE_KE:
-			if (isakmp_p2ph(&iph1->dhpub_p, pa->ptr) < 0)
-				goto end;
-			break;
-		case ISAKMP_NPTYPE_NONCE:
-			if (isakmp_p2ph(&iph1->nonce_p, pa->ptr) < 0)
-				goto end;
-			break;
-		case ISAKMP_NPTYPE_ID:
-			if (isakmp_p2ph(&iph1->id_p, pa->ptr) < 0)
-				goto end;
-			break;
-		case ISAKMP_NPTYPE_VID:
-			vid_numeric = handle_vendorid(iph1, pa->ptr);
-#ifdef ENABLE_FRAG
-			if ((vid_numeric == VENDORID_FRAG) &&
-			    (vendorid_frag_cap(pa->ptr) & VENDORID_FRAG_AGG))
-				iph1->frag = 1;
-#endif
-			break;
-
-		case ISAKMP_NPTYPE_CR:
-			if (oakley_savecr(iph1, pa->ptr) < 0)
-				goto end;
-			break;
-
-#ifdef HAVE_GSSAPI
-		case ISAKMP_NPTYPE_GSS:
-			if (isakmp_p2ph(&gsstoken, pa->ptr) < 0)
-				goto end;
-			gssapi_save_received_token(iph1, gsstoken);
-			break;
-#endif
-		default:
-			/* don't send information, see isakmp_ident_r1() */
-			plog(LLV_ERROR, LOCATION, iph1->remote,
-				"ignore the packet, "
-				"received unexpecting payload type %d.\n",
-				pa->type);
-			goto end;
-		}
-	}
-
-	/* payload existency check */
-	if (iph1->dhpub_p == NULL || iph1->nonce_p == NULL) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"few isakmp message received.\n");
-		goto end;
-	}
-
-	/* verify identifier */
-	if (ipsecdoi_checkid1(iph1) != 0) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"invalid ID payload.\n");
-		goto end;
-	}
-
-#ifdef ENABLE_NATT
-	if (NATT_AVAILABLE(iph1))
-		plog(LLV_INFO, LOCATION, iph1->remote,
-		     "Selected NAT-T version: %s\n",
-		     vid_string_by_id(iph1->natt_options->version));
-#endif
-
-	/* check SA payload and set approval SA for use */
-	if (ipsecdoi_checkph1proposal(iph1->sa, iph1) < 0) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"failed to get valid proposal.\n");
-		/* XXX send information */
-		goto end;
-	}
-
-	if (oakley_checkcr(iph1) < 0) {
-		/* Ignore this error in order to be interoperability. */
-		;
-	}
-
-	iph1->status = PHASE1ST_MSG1RECEIVED;
-
-	error = 0;
-
-end:
-#ifdef HAVE_GSSAPI
-	if (gsstoken)
-		vfree(gsstoken);
-#endif
-	if (pbuf)
-		vfree(pbuf);
-	if (error) {
-		VPTRINIT(iph1->sa);
-		VPTRINIT(iph1->dhpub_p);
-		VPTRINIT(iph1->nonce_p);
-		VPTRINIT(iph1->id_p);
-		oakley_delcert(iph1->cr_p);
-		iph1->cr_p = NULL;
-	}
-
-	return error;
-}
-
-/*
- * send to initiator
- * 	psk: HDR, SA, KE, Nr, IDr1, HASH_R
- * 	sig: HDR, SA, KE, Nr, IDr1, [ CR, ] [ CERT, ] SIG_R
- *   gssapi: HDR, SA, KE, Nr, IDr1, GSSr, HASH_R
- * 	rsa: HDR, SA, KE, <IDr1_b>PubKey_i, <Nr_b>PubKey_i, HASH_R
- * 	rev: HDR, SA, <Nr_b>PubKey_i, <KE_b>Ke_r, <IDir_b>Ke_r, HASH_R
- */
-int
-agg_r1send(iph1, msg)
-	struct ph1handle *iph1;
-	vchar_t *msg;
-{
-	struct payload_list *plist = NULL;
-	int need_cr = 0;
-	int need_cert = 0;
-	vchar_t *cr = NULL;
-	int error = -1;
-#ifdef ENABLE_HYBRID
-	vchar_t *xauth_vid = NULL;
-	vchar_t *unity_vid = NULL;
-#endif
-#ifdef ENABLE_NATT
-	vchar_t *vid_natt = NULL;
-	vchar_t *natd[2] = { NULL, NULL };
-#endif
-#ifdef ENABLE_DPD
-	vchar_t *vid_dpd = NULL;
-#endif
-#ifdef ENABLE_FRAG
-	vchar_t *vid_frag = NULL;
-#endif
-
-#ifdef HAVE_GSSAPI
-	int gsslen;
-	vchar_t *gsstoken = NULL, *gsshash = NULL;
-	vchar_t *gss_sa = NULL;
-	int free_gss_sa = 0;
-#endif
-
-	/* validity check */
-	if (iph1->status != PHASE1ST_MSG1RECEIVED) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph1->status);
-		goto end;
-	}
-
-	/* set responder's cookie */
-	isakmp_newcookie((caddr_t)&iph1->index.r_ck, iph1->remote, iph1->local);
-
-	/* make ID payload into isakmp status */
-	if (ipsecdoi_setid1(iph1) < 0)
-		goto end;
-
-	/* generate DH public value */
-	if (oakley_dh_generate(iph1->rmconf->dhgrp,
-				&iph1->dhpub, &iph1->dhpriv) < 0)
-		goto end;
-
-	/* generate NONCE value */
-	iph1->nonce = eay_set_random(iph1->rmconf->nonce_size);
-	if (iph1->nonce == NULL)
-		goto end;
-
-	/* compute sharing secret of DH */
-	if (oakley_dh_compute(iph1->approval->dhgrp, iph1->dhpub,
-				iph1->dhpriv, iph1->dhpub_p, &iph1->dhgxy) < 0)
-		goto end;
-
-	/* generate SKEYIDs & IV & final cipher key */
-	if (oakley_skeyid(iph1) < 0)
-		goto end;
-	if (oakley_skeyid_dae(iph1) < 0)
-		goto end;
-	if (oakley_compute_enckey(iph1) < 0)
-		goto end;
-	if (oakley_newiv(iph1) < 0)
-		goto end;
-
-#ifdef HAVE_GSSAPI
-	if (RMAUTHMETHOD(iph1) == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB)
-		gssapi_get_rtoken(iph1, &gsslen);
-#endif
-
-	/* generate HASH to send */
-	plog(LLV_DEBUG, LOCATION, NULL, "generate HASH_R\n");
-	iph1->hash = oakley_ph1hash_common(iph1, GENERATE);
-	if (iph1->hash == NULL) {
-#ifdef HAVE_GSSAPI
-		if (gssapi_more_tokens(iph1))
-			isakmp_info_send_n1(iph1,
-			    ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE, NULL);
-#endif
-		goto end;
-	}
-
-	/* create CR if need */
-	if (iph1->rmconf->send_cr
-	 && oakley_needcr(iph1->approval->authmethod)
-	 && iph1->rmconf->peerscertfile == NULL) {
-		need_cr = 1;
-		cr = oakley_getcr(iph1);
-		if (cr == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to get cr buffer.\n");
-			goto end;
-		}
-	}
-
-#ifdef ENABLE_NATT
-	/* Has the peer announced NAT-T? */
-	if (NATT_AVAILABLE(iph1)) {
-	  	/* set chosen VID */
-		vid_natt = set_vendorid(iph1->natt_options->version);
-
-		/* generate NAT-D payloads */
-		plog (LLV_INFO, LOCATION, NULL, "Adding remote and local NAT-D payloads.\n");
-		if ((natd[0] = natt_hash_addr (iph1, iph1->remote)) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"NAT-D hashing failed for %s\n", saddr2str(iph1->remote));
-			goto end;
-		}
-
-		if ((natd[1] = natt_hash_addr (iph1, iph1->local)) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"NAT-D hashing failed for %s\n", saddr2str(iph1->local));
-			goto end;
-		}
-	}
-#endif
-#ifdef ENABLE_DPD
-	/* Only send DPD support if remote announced DPD and if DPD support is active */
-	if (iph1->dpd_support && iph1->rmconf->dpd)
-		vid_dpd = set_vendorid(VENDORID_DPD);
-#endif
-#ifdef ENABLE_FRAG
-	if (iph1->frag) {
-		vid_frag = set_vendorid(VENDORID_FRAG);
-		if (vid_frag != NULL)
-			vid_frag = isakmp_frag_addcap(vid_frag,
-			    VENDORID_FRAG_AGG);
-		if (vid_frag == NULL)
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "Frag vendorID construction failed\n");
-	}
-#endif
-
-	switch (AUTHMETHOD(iph1)) {
-	case OAKLEY_ATTR_AUTH_METHOD_PSKEY:
-#ifdef ENABLE_HYBRID
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
-#endif
-		/* set SA payload to reply */
-		plist = isakmp_plist_append(plist, 
-		    iph1->sa_ret, ISAKMP_NPTYPE_SA);
-
-		/* create isakmp KE payload */
-		plist = isakmp_plist_append(plist, 
-		    iph1->dhpub, ISAKMP_NPTYPE_KE);
-
-		/* create isakmp NONCE payload */
-		plist = isakmp_plist_append(plist, 
-		    iph1->nonce, ISAKMP_NPTYPE_NONCE);
-
-		/* create isakmp ID payload */
-		plist = isakmp_plist_append(plist, 
-		    iph1->id, ISAKMP_NPTYPE_ID);
-
-		/* create isakmp HASH payload */
-		plist = isakmp_plist_append(plist, 
-		    iph1->hash, ISAKMP_NPTYPE_HASH);
-
-		/* create isakmp CR payload if needed */
-		if (need_cr)
-			plist = isakmp_plist_append(plist, 
-			    cr, ISAKMP_NPTYPE_CR);
-		break;
-	case OAKLEY_ATTR_AUTH_METHOD_DSSSIG:
-	case OAKLEY_ATTR_AUTH_METHOD_RSASIG:
-#ifdef ENABLE_HYBRID
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R:
-#endif
-		/* XXX if there is CR or not ? */
-
-		if (oakley_getmycert(iph1) < 0)
-			goto end;
-
-		if (oakley_getsign(iph1) < 0)
-			goto end;
-
-		if (iph1->cert != NULL && iph1->rmconf->send_cert)
-			need_cert = 1;
-
-		/* set SA payload to reply */
-		plist = isakmp_plist_append(plist, 
-		    iph1->sa_ret, ISAKMP_NPTYPE_SA);
-
-		/* create isakmp KE payload */
-		plist = isakmp_plist_append(plist, 
-		    iph1->dhpub, ISAKMP_NPTYPE_KE);
-
-		/* create isakmp NONCE payload */
-		plist = isakmp_plist_append(plist, 
-		    iph1->nonce, ISAKMP_NPTYPE_NONCE);
-
-		/* add ID payload */
-		plist = isakmp_plist_append(plist, 
-		    iph1->id, ISAKMP_NPTYPE_ID);
-
-		/* add CERT payload if there */
-		if (need_cert)
-			plist = isakmp_plist_append(plist, 
-			    iph1->cert->pl, ISAKMP_NPTYPE_CERT);
-
-		/* add SIG payload */
-		plist = isakmp_plist_append(plist, 
-		    iph1->sig, ISAKMP_NPTYPE_SIG);
-
-		/* create isakmp CR payload if needed */
-		if (need_cr)
-			plist = isakmp_plist_append(plist, 
-			    cr, ISAKMP_NPTYPE_CR);
-		break;
-
-	case OAKLEY_ATTR_AUTH_METHOD_RSAENC:
-	case OAKLEY_ATTR_AUTH_METHOD_RSAREV:
-#ifdef ENABLE_HYBRID
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_R:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_R:
-#endif
-		break;
-#ifdef HAVE_GSSAPI
-	case OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB:
-			/* create buffer to send isakmp payload */
-			gsshash = gssapi_wraphash(iph1);
-			if (gsshash == NULL) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"failed to wrap hash\n");
-				/*
-				 * This is probably due to the GSS 
-				 * roundtrips not being finished yet. 
-				 * Return this error in the hope that 
-				 * a fallback to main mode will be done.
-				 */
-				isakmp_info_send_n1(iph1,
-				    ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE, NULL);
-				goto end;
-			}
-			if (iph1->approval->gssid != NULL)
-				gss_sa = 
-				    ipsecdoi_setph1proposal(iph1->approval);  
-			else
-				gss_sa = iph1->sa_ret;
-
-			if (gss_sa != iph1->sa_ret)
-				free_gss_sa = 1;
-
-			/* set SA payload to reply */
-			plist = isakmp_plist_append(plist, 
-			    gss_sa, ISAKMP_NPTYPE_SA);
-
-			/* create isakmp KE payload */
-			plist = isakmp_plist_append(plist, 
-			    iph1->dhpub, ISAKMP_NPTYPE_KE);
-
-			/* create isakmp NONCE payload */
-			plist = isakmp_plist_append(plist, 
-			    iph1->nonce, ISAKMP_NPTYPE_NONCE);
-
-			/* create isakmp ID payload */
-			plist = isakmp_plist_append(plist, 
-			    iph1->id, ISAKMP_NPTYPE_ID);
-
-			/* create GSS payload */
-			gssapi_get_token_to_send(iph1, &gsstoken);
-			plist = isakmp_plist_append(plist, 
-			    gsstoken, ISAKMP_NPTYPE_GSS);
-
-			/* create isakmp HASH payload */
-			plist = isakmp_plist_append(plist, 
-			    gsshash, ISAKMP_NPTYPE_HASH);
-
-			/* append vendor id, if needed */
-			break;
-#endif
-	}
-
-#ifdef ENABLE_HYBRID
-	if (iph1->mode_cfg->flags & ISAKMP_CFG_VENDORID_XAUTH) {
-		plog (LLV_INFO, LOCATION, NULL, "Adding xauth VID payload.\n");
-		if ((xauth_vid = set_vendorid(VENDORID_XAUTH)) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "Cannot create Xauth vendor ID\n");
-			goto end;
-		}
-		plist = isakmp_plist_append(plist, 
-		    xauth_vid, ISAKMP_NPTYPE_VID);
-	}
-
-	if (iph1->mode_cfg->flags & ISAKMP_CFG_VENDORID_UNITY) {
-		if ((unity_vid = set_vendorid(VENDORID_UNITY)) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "Cannot create Unity vendor ID\n");
-			goto end;
-		}
-		plist = isakmp_plist_append(plist, 
-		    unity_vid, ISAKMP_NPTYPE_VID);
-	}
-#endif
-
-#ifdef ENABLE_NATT
-	/* append NAT-T payloads */
-	if (vid_natt) {
-		/* chosen VID */
-		plist = isakmp_plist_append(plist, vid_natt, ISAKMP_NPTYPE_VID);
-		/* NAT-D */
-		plist = isakmp_plist_append(plist, natd[0], iph1->natt_options->payload_nat_d);
-		plist = isakmp_plist_append(plist, natd[1], iph1->natt_options->payload_nat_d);
-	}
-#endif
-
-#ifdef ENABLE_FRAG
-	if (vid_frag)
-		plist = isakmp_plist_append(plist, vid_frag, ISAKMP_NPTYPE_VID);
-#endif
-
-#ifdef ENABLE_DPD
-	if (vid_dpd)
-		plist = isakmp_plist_append(plist, vid_dpd, ISAKMP_NPTYPE_VID);
-#endif
-
-	iph1->sendbuf = isakmp_plist_set_all (&plist, iph1);
-
-#ifdef HAVE_PRINT_ISAKMP_C
-	isakmp_printpacket(iph1->sendbuf, iph1->local, iph1->remote, 1);
-#endif
-
-	/* send the packet, add to the schedule to resend */
-	iph1->retry_counter = iph1->rmconf->retry_counter;
-	if (isakmp_ph1resend(iph1) == -1)
-		goto end;
-
-	/* the sending message is added to the received-list. */
-	if (add_recvdpkt(iph1->remote, iph1->local, iph1->sendbuf, msg) == -1) {
-		plog(LLV_ERROR , LOCATION, NULL,
-			"failed to add a response packet to the tree.\n");
-		goto end;
-	}
-
-	iph1->status = PHASE1ST_MSG1SENT;
-
-	error = 0;
-
-end:
-	if (cr)
-		vfree(cr);
-#ifdef ENABLE_HYBRID
-	if (xauth_vid)
-		vfree(xauth_vid);
-	if (unity_vid)
-		vfree(unity_vid);
-#endif
-#ifdef HAVE_GSSAPI
-	if (gsstoken)
-		vfree(gsstoken);
-	if (gsshash)
-		vfree(gsshash);
-	if (free_gss_sa)
-		vfree(gss_sa);
-#endif
-#ifdef ENABLE_DPD
-	if (vid_dpd)
-		vfree(vid_dpd);
-#endif
-#ifdef ENABLE_FRAG
-	if (vid_frag)
-		vfree(vid_frag);
-#endif
-
-	return error;
-}
-
-/*
- * receive from initiator
- * 	psk: HDR, HASH_I
- *   gssapi: HDR, HASH_I
- * 	sig: HDR, [ CERT, ] SIG_I
- * 	rsa: HDR, HASH_I
- * 	rev: HDR, HASH_I
- */
-int
-agg_r2recv(iph1, msg0)
-	struct ph1handle *iph1;
-	vchar_t *msg0;
-{
-	vchar_t *msg = NULL;
-	vchar_t *pbuf = NULL;
-	struct isakmp_parse_t *pa;
-	int error = -1;
-	int ptype;
-
-#ifdef ENABLE_NATT
-	int natd_seq = 0;
-#endif
-
-	/* validity check */
-	if (iph1->status != PHASE1ST_MSG1SENT) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph1->status);
-		goto end;
-	}
-
-	/* decrypting if need. */
-	/* XXX configurable ? */
-	if (ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E)) {
-		msg = oakley_do_decrypt(iph1, msg0,
-					iph1->ivm->iv, iph1->ivm->ive);
-		if (msg == NULL)
-			goto end;
-	} else
-		msg = vdup(msg0);
-
-	/* validate the type of next payload */
-	pbuf = isakmp_parse(msg);
-	if (pbuf == NULL)
-		goto end;
-
-	iph1->pl_hash = NULL;
-
-	for (pa = (struct isakmp_parse_t *)pbuf->v;
-	     pa->type != ISAKMP_NPTYPE_NONE;
-	     pa++) {
-
-		switch (pa->type) {
-		case ISAKMP_NPTYPE_HASH:
-			iph1->pl_hash = (struct isakmp_pl_hash *)pa->ptr;
-			break;
-		case ISAKMP_NPTYPE_VID:
-			handle_vendorid(iph1, pa->ptr);
-			break;
-		case ISAKMP_NPTYPE_CERT:
-			if (oakley_savecert(iph1, pa->ptr) < 0)
-				goto end;
-			break;
-		case ISAKMP_NPTYPE_SIG:
-			if (isakmp_p2ph(&iph1->sig_p, pa->ptr) < 0)
-				goto end;
-			break;
-		case ISAKMP_NPTYPE_N:
-			isakmp_check_notify(pa->ptr, iph1);
-			break;
-
-#ifdef ENABLE_NATT
-		case ISAKMP_NPTYPE_NATD_DRAFT:
-		case ISAKMP_NPTYPE_NATD_RFC:
-			if (NATT_AVAILABLE(iph1) && iph1->natt_options != NULL &&
-				pa->type == iph1->natt_options->payload_nat_d)
-			{
-				vchar_t *natd_received = NULL;
-				int natd_verified;
-				
-				if (isakmp_p2ph (&natd_received, pa->ptr) < 0)
-					goto end;
-				
-				if (natd_seq == 0)
-					iph1->natt_flags |= NAT_DETECTED;
-				
-				natd_verified = natt_compare_addr_hash (iph1,
-					natd_received, natd_seq++);
-				
-				plog (LLV_INFO, LOCATION, NULL, "NAT-D payload #%d %s\n",
-					natd_seq - 1,
-					natd_verified ? "verified" : "doesn't match");
-				
-				vfree (natd_received);
-				break;
-			}
-			/* passthrough to default... */
-#endif
-
-		default:
-			/* don't send information, see isakmp_ident_r1() */
-			plog(LLV_ERROR, LOCATION, iph1->remote,
-				"ignore the packet, "
-				"received unexpecting payload type %d.\n",
-				pa->type);
-			goto end;
-		}
-	}
-
-#ifdef ENABLE_NATT
-	if (NATT_AVAILABLE(iph1))
-		plog (LLV_INFO, LOCATION, NULL, "NAT %s %s%s\n",
-		      iph1->natt_flags & NAT_DETECTED ? 
-		      		"detected:" : "not detected",
-		      iph1->natt_flags & NAT_DETECTED_ME ? "ME " : "",
-		      iph1->natt_flags & NAT_DETECTED_PEER ? "PEER" : "");
-#endif
-
-	/* validate authentication value */
-	ptype = oakley_validate_auth(iph1);
-	if (ptype != 0) {
-		if (ptype == -1) {
-			/* message printed inner oakley_validate_auth() */
-			goto end;
-		}
-		EVT_PUSH(iph1->local, iph1->remote, 
-		    EVTT_PEERPH1AUTH_FAILED, NULL);
-		isakmp_info_send_n1(iph1, ptype, NULL);
-		goto end;
-	}
-
-	iph1->status = PHASE1ST_MSG2RECEIVED;
-
-	error = 0;
-
-end:
-	if (pbuf)
-		vfree(pbuf);
-	if (msg)
-		vfree(msg);
-	if (error) {
-		oakley_delcert(iph1->cert_p);
-		iph1->cert_p = NULL;
-		oakley_delcert(iph1->crl_p);
-		iph1->crl_p = NULL;
-		VPTRINIT(iph1->sig_p);
-	}
-
-	return error;
-}
-
-/*
- * status update and establish isakmp sa.
- */
-int
-agg_r2send(iph1, msg)
-	struct ph1handle *iph1;
-	vchar_t *msg;
-{
-	int error = -1;
-
-	/* validity check */
-	if (iph1->status != PHASE1ST_MSG2RECEIVED) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph1->status);
-		goto end;
-	}
-
-	/* IV synchronized when packet encrypted. */
-	/* see handler.h about IV synchronization. */
-	if (ISSET(((struct isakmp *)msg->v)->flags, ISAKMP_FLAG_E))
-		memcpy(iph1->ivm->iv->v, iph1->ivm->ive->v, iph1->ivm->iv->l);
-
-	/* set encryption flag */
-	iph1->flags |= ISAKMP_FLAG_E;
-
-	iph1->status = PHASE1ST_ESTABLISHED;
-
-	error = 0;
-
-end:
-	return error;
-}
diff --git a/src/racoon/isakmp_agg.h b/src/racoon/isakmp_agg.h
deleted file mode 100644
index 89645eb..0000000
--- a/src/racoon/isakmp_agg.h
+++ /dev/null
@@ -1,46 +0,0 @@
-/*	$NetBSD: isakmp_agg.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/* Id: isakmp_agg.h,v 1.3 2004/06/11 16:00:16 ludvigm Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _ISAKMP_AGG_H
-#define _ISAKMP_AGG_H
-
-extern int agg_i1send __P((struct ph1handle *, vchar_t *));
-extern int agg_i2recv __P((struct ph1handle *, vchar_t *));
-extern int agg_i2send __P((struct ph1handle *, vchar_t *));
-
-extern int agg_r1recv __P((struct ph1handle *, vchar_t *));
-extern int agg_r1send __P((struct ph1handle *, vchar_t *));
-extern int agg_r2recv __P((struct ph1handle *, vchar_t *));
-extern int agg_r2send __P((struct ph1handle *, vchar_t *));
-
-#endif /* _ISAKMP_AGG_H */
diff --git a/src/racoon/isakmp_base.c b/src/racoon/isakmp_base.c
deleted file mode 100644
index 308c3e3..0000000
--- a/src/racoon/isakmp_base.c
+++ /dev/null
@@ -1,1407 +0,0 @@
-/*	$NetBSD: isakmp_base.c,v 1.7 2006/10/02 21:51:33 manu Exp $	*/
-
-/*	$KAME: isakmp_base.c,v 1.49 2003/11/13 02:30:20 sakane Exp $	*/
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-/* Base Exchange (Base Mode) */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-#if TIME_WITH_SYS_TIME
-# include <sys/time.h>
-# include <time.h>
-#else
-# if HAVE_SYS_TIME_H
-#  include <sys/time.h>
-# else
-#  include <time.h>
-# endif
-#endif
-
-#include "var.h"
-#include "misc.h"
-#include "vmbuf.h"
-#include "plog.h"
-#include "sockmisc.h"
-#include "schedule.h"
-#include "debug.h"
-
-#ifdef ENABLE_HYBRID
-#include <resolv.h>
-#endif
-
-#include "localconf.h"
-#include "remoteconf.h"
-#include "isakmp_var.h"
-#include "isakmp.h"
-#include "evt.h"
-#include "oakley.h"
-#include "handler.h"
-#include "ipsec_doi.h"
-#include "crypto_openssl.h"
-#include "pfkey.h"
-#include "isakmp_base.h"
-#include "isakmp_inf.h"
-#include "vendorid.h"
-#ifdef ENABLE_NATT
-#include "nattraversal.h"
-#endif
-#ifdef ENABLE_FRAG
-#include "isakmp_frag.h"
-#endif
-#ifdef ENABLE_HYBRID
-#include "isakmp_xauth.h"
-#include "isakmp_cfg.h"
-#endif
-
-/* %%%
- * begin Identity Protection Mode as initiator.
- */
-/*
- * send to responder
- * 	psk: HDR, SA, Idii, Ni_b
- * 	sig: HDR, SA, Idii, Ni_b
- * 	rsa: HDR, SA, [HASH(1),] <IDii_b>Pubkey_r, <Ni_b>Pubkey_r
- * 	rev: HDR, SA, [HASH(1),] <Ni_b>Pubkey_r, <IDii_b>Ke_i
- */
-int
-base_i1send(iph1, msg)
-	struct ph1handle *iph1;
-	vchar_t *msg; /* must be null */
-{
-	struct payload_list *plist = NULL;
-	int error = -1;
-#ifdef ENABLE_NATT
-	vchar_t *vid_natt[MAX_NATT_VID_COUNT] = { NULL };
-	int i, vid_natt_i = 0;
-#endif
-#ifdef ENABLE_FRAG
-	vchar_t *vid_frag = NULL;
-#endif
-#ifdef ENABLE_HYBRID
-	vchar_t *vid_xauth = NULL;
-	vchar_t *vid_unity = NULL;
-#endif
-#ifdef ENABLE_DPD
-	vchar_t *vid_dpd = NULL;
-#endif
-
-
-	/* validity check */
-	if (msg != NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"msg has to be NULL in this function.\n");
-		goto end;
-	}
-	if (iph1->status != PHASE1ST_START) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph1->status);
-		goto end;
-	}
-
-	/* create isakmp index */
-	memset(&iph1->index, 0, sizeof(iph1->index));
-	isakmp_newcookie((caddr_t)&iph1->index, iph1->remote, iph1->local);
-
-	/* make ID payload into isakmp status */
-	if (ipsecdoi_setid1(iph1) < 0)
-		goto end;
-
-	/* create SA payload for my proposal */
-	iph1->sa = ipsecdoi_setph1proposal(iph1->rmconf->proposal);
-	if (iph1->sa == NULL)
-		goto end;
-
-	/* generate NONCE value */
-	iph1->nonce = eay_set_random(iph1->rmconf->nonce_size);
-	if (iph1->nonce == NULL)
-		goto end;
-
-#ifdef ENABLE_HYBRID
-        /* Do we need Xauth VID? */
-        switch (RMAUTHMETHOD(iph1)) {
-        case FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I:
-        case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
-        case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
-        case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I:
-        case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I:
-        case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_I:
-        case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_I:
-                if ((vid_xauth = set_vendorid(VENDORID_XAUTH)) == NULL)
-                        plog(LLV_ERROR, LOCATION, NULL,
-                             "Xauth vendor ID generation failed\n");
-
-                if ((vid_unity = set_vendorid(VENDORID_UNITY)) == NULL)
-                        plog(LLV_ERROR, LOCATION, NULL,
-                             "Unity vendor ID generation failed\n");
-                break;
-        default:
-                break;
-        }
-#endif
-#ifdef ENABLE_FRAG
-	if (iph1->rmconf->ike_frag) {
-		vid_frag = set_vendorid(VENDORID_FRAG);
-		if (vid_frag != NULL)
-			vid_frag = isakmp_frag_addcap(vid_frag, 
-			    VENDORID_FRAG_BASE);
-		if (vid_frag == NULL)
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "Frag vendorID construction failed\n");
-	}
-#endif
-#ifdef ENABLE_NATT
-	/* Is NAT-T support allowed in the config file? */
-	if (iph1->rmconf->nat_traversal) {
-		/* Advertise NAT-T capability */
-		memset (vid_natt, 0, sizeof (vid_natt));
-#ifdef VENDORID_NATT_00
-		if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_00)) != NULL)
-			vid_natt_i++;
-#endif
-#ifdef VENDORID_NATT_02
-		if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_02)) != NULL)
-			vid_natt_i++;
-#endif
-#ifdef VENDORID_NATT_02_N
-		if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_02_N)) != NULL)
-			vid_natt_i++;
-#endif
-#ifdef VENDORID_NATT_RFC
-		if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_RFC)) != NULL)
-			vid_natt_i++;
-#endif
-	}
-#endif
-
-	/* set SA payload to propose */
-	plist = isakmp_plist_append(plist, iph1->sa, ISAKMP_NPTYPE_SA);
-
-	/* create isakmp ID payload */
-	plist = isakmp_plist_append(plist, iph1->id, ISAKMP_NPTYPE_ID);
-
-	/* create isakmp NONCE payload */
-	plist = isakmp_plist_append(plist, iph1->nonce, ISAKMP_NPTYPE_NONCE);
-
-#ifdef ENABLE_FRAG
-	if (vid_frag)
-		plist = isakmp_plist_append(plist, vid_frag, ISAKMP_NPTYPE_VID);
-#endif
-#ifdef ENABLE_HYBRID
-	if (vid_xauth)
-		plist = isakmp_plist_append(plist, 
-		    vid_xauth, ISAKMP_NPTYPE_VID);
-	if (vid_unity)
-		plist = isakmp_plist_append(plist, 
-		    vid_unity, ISAKMP_NPTYPE_VID);
-#endif
-#ifdef ENABLE_DPD
-	if (iph1->rmconf->dpd) {
-		vid_dpd = set_vendorid(VENDORID_DPD);
-		if (vid_dpd != NULL)
-			plist = isakmp_plist_append(plist, vid_dpd, ISAKMP_NPTYPE_VID); 
-	}
-#endif  
-#ifdef ENABLE_NATT
-	/* set VID payload for NAT-T */
-	for (i = 0; i < vid_natt_i; i++)
-		plist = isakmp_plist_append(plist, vid_natt[i], ISAKMP_NPTYPE_VID);
-#endif
-	iph1->sendbuf = isakmp_plist_set_all (&plist, iph1);
-
-
-#ifdef HAVE_PRINT_ISAKMP_C
-	isakmp_printpacket(iph1->sendbuf, iph1->local, iph1->remote, 0);
-#endif
-
-	/* send the packet, add to the schedule to resend */
-	iph1->retry_counter = iph1->rmconf->retry_counter;
-	if (isakmp_ph1resend(iph1) == -1)
-		goto end;
-
-	iph1->status = PHASE1ST_MSG1SENT;
-
-	error = 0;
-
-end:
-#ifdef ENABLE_FRAG
-	if (vid_frag)
-		vfree(vid_frag);
-#endif 
-#ifdef ENABLE_NATT
-	for (i = 0; i < vid_natt_i; i++)
-		vfree(vid_natt[i]);
-#endif
-#ifdef ENABLE_HYBRID    
-	if (vid_xauth != NULL)
-		vfree(vid_xauth);
-	if (vid_unity != NULL) 
-		vfree(vid_unity);
-#endif 
-#ifdef ENABLE_DPD
-	if (vid_dpd != NULL)    
-		vfree(vid_dpd);
-#endif     
-
-	return error;
-}
-
-/*
- * receive from responder
- * 	psk: HDR, SA, Idir, Nr_b
- * 	sig: HDR, SA, Idir, Nr_b, [ CR ]
- * 	rsa: HDR, SA, <IDir_b>PubKey_i, <Nr_b>PubKey_i
- * 	rev: HDR, SA, <Nr_b>PubKey_i, <IDir_b>Ke_r
- */
-int
-base_i2recv(iph1, msg)
-	struct ph1handle *iph1;
-	vchar_t *msg;
-{
-	vchar_t *pbuf = NULL;
-	struct isakmp_parse_t *pa;
-	vchar_t *satmp = NULL;
-	int error = -1;
-	int vid_numeric;
-#ifdef ENABLE_HYBRID
-	vchar_t *unity_vid;
-	vchar_t *xauth_vid;
-#endif
-
-	/* validity check */
-	if (iph1->status != PHASE1ST_MSG1SENT) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph1->status);
-		goto end;
-	}
-
-	/* validate the type of next payload */
-	pbuf = isakmp_parse(msg);
-	if (pbuf == NULL)
-		goto end;
-	pa = (struct isakmp_parse_t *)pbuf->v;
-
-	/* SA payload is fixed postion */
-	if (pa->type != ISAKMP_NPTYPE_SA) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"received invalid next payload type %d, "
-			"expecting %d.\n",
-			pa->type, ISAKMP_NPTYPE_SA);
-		goto end;
-	}
-	if (isakmp_p2ph(&satmp, pa->ptr) < 0)
-		goto end;
-	pa++;
-
-	for (/*nothing*/;
-	     pa->type != ISAKMP_NPTYPE_NONE;
-	     pa++) {
-
-		switch (pa->type) {
-		case ISAKMP_NPTYPE_NONCE:
-			if (isakmp_p2ph(&iph1->nonce_p, pa->ptr) < 0)
-				goto end;
-			break;
-		case ISAKMP_NPTYPE_ID:
-			if (isakmp_p2ph(&iph1->id_p, pa->ptr) < 0)
-				goto end;
-			break;
-		case ISAKMP_NPTYPE_VID:
-			handle_vendorid(iph1, pa->ptr);
-			break;
-		default:
-			/* don't send information, see ident_r1recv() */
-			plog(LLV_ERROR, LOCATION, iph1->remote,
-				"ignore the packet, "
-				"received unexpecting payload type %d.\n",
-				pa->type);
-			goto end;
-		}
-	}
-
-	if (iph1->nonce_p == NULL || iph1->id_p == NULL) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"few isakmp message received.\n");
-		goto end;
-	}
-
-	/* verify identifier */
-	if (ipsecdoi_checkid1(iph1) != 0) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"invalid ID payload.\n");
-		goto end;
-	}
-
-#ifdef ENABLE_NATT
-	if (NATT_AVAILABLE(iph1))
-		plog(LLV_INFO, LOCATION, iph1->remote,
-		     "Selected NAT-T version: %s\n",
-		     vid_string_by_id(iph1->natt_options->version));
-#endif
-
-	/* check SA payload and set approval SA for use */
-	if (ipsecdoi_checkph1proposal(satmp, iph1) < 0) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"failed to get valid proposal.\n");
-		/* XXX send information */
-		goto end;
-	}
-	VPTRINIT(iph1->sa_ret);
-
-	iph1->status = PHASE1ST_MSG2RECEIVED;
-
-	error = 0;
-
-end:
-	if (pbuf)
-		vfree(pbuf);
-	if (satmp)
-		vfree(satmp);
-
-	if (error) {
-		VPTRINIT(iph1->nonce_p);
-		VPTRINIT(iph1->id_p);
-	}
-
-	return error;
-}
-
-/*
- * send to responder
- * 	psk: HDR, KE, HASH_I
- * 	sig: HDR, KE, [ CR, ] [CERT,] SIG_I
- * 	rsa: HDR, KE, HASH_I
- * 	rev: HDR, <KE>Ke_i, HASH_I
- */
-int
-base_i2send(iph1, msg)
-	struct ph1handle *iph1;
-	vchar_t *msg;
-{
-	struct payload_list *plist = NULL;
-	vchar_t *vid = NULL;
-	int need_cert = 0;
-	int error = -1;
-
-	/* validity check */
-	if (iph1->status != PHASE1ST_MSG2RECEIVED) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph1->status);
-		goto end;
-	}
-
-	/* fix isakmp index */
-	memcpy(&iph1->index.r_ck, &((struct isakmp *)msg->v)->r_ck,
-		sizeof(cookie_t));
-
-	/* generate DH public value */
-	if (oakley_dh_generate(iph1->approval->dhgrp,
-				&iph1->dhpub, &iph1->dhpriv) < 0)
-		goto end;
-
-	/* generate SKEYID to compute hash if not signature mode */
-	switch (AUTHMETHOD(iph1)) {
-	case OAKLEY_ATTR_AUTH_METHOD_RSASIG:
-	case OAKLEY_ATTR_AUTH_METHOD_DSSSIG:
-#ifdef ENABLE_HYBRID
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
-#endif
-		break;
-	default:
-		if (oakley_skeyid(iph1) < 0)
-			goto end;
-		break;
-	}
-
-	/* generate HASH to send */
-	plog(LLV_DEBUG, LOCATION, NULL, "generate HASH_I\n");
-	iph1->hash = oakley_ph1hash_base_i(iph1, GENERATE);
-	if (iph1->hash == NULL)
-		goto end;
-	switch (AUTHMETHOD(iph1)) {
-	case OAKLEY_ATTR_AUTH_METHOD_PSKEY:
-#ifdef ENABLE_HYBRID
-	case FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
-#endif
-		vid = set_vendorid(iph1->approval->vendorid);
-
-		/* create isakmp KE payload */
-		plist = isakmp_plist_append(plist, iph1->dhpub, ISAKMP_NPTYPE_KE);
-
-		/* create isakmp HASH payload */
-		plist = isakmp_plist_append(plist, iph1->hash, ISAKMP_NPTYPE_HASH);
-
-		/* append vendor id, if needed */
-		if (vid)
-			plist = isakmp_plist_append(plist, vid, ISAKMP_NPTYPE_VID);
-		break;
-	case OAKLEY_ATTR_AUTH_METHOD_DSSSIG:
-	case OAKLEY_ATTR_AUTH_METHOD_RSASIG:
-#ifdef ENABLE_HYBRID
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I:
-#endif
-		/* XXX if there is CR or not ? */
-
-		if (oakley_getmycert(iph1) < 0)
-			goto end;
-
-		if (oakley_getsign(iph1) < 0)
-			goto end;
-
-		if (iph1->cert && iph1->rmconf->send_cert)
-			need_cert = 1;
-
-		/* create isakmp KE payload */
-		plist = isakmp_plist_append(plist, 
-		    iph1->dhpub, ISAKMP_NPTYPE_KE);
-
-		/* add CERT payload if there */
-		if (need_cert)
-			plist = isakmp_plist_append(plist, 
-			    iph1->cert->pl, ISAKMP_NPTYPE_CERT);
-
-		/* add SIG payload */
-		plist = isakmp_plist_append(plist, 
-		    iph1->sig, ISAKMP_NPTYPE_SIG);
-
-		break;
-#ifdef HAVE_GSSAPI
-	case OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB:
-		/* ... */
-		break;
-#endif
-	case OAKLEY_ATTR_AUTH_METHOD_RSAENC:
-	case OAKLEY_ATTR_AUTH_METHOD_RSAREV:
-#ifdef ENABLE_HYBRID
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_I:
-#endif
-		break;
-	}
-
-#ifdef ENABLE_NATT
-	/* generate NAT-D payloads */
-	if (NATT_AVAILABLE(iph1))
-	{
-		vchar_t *natd[2] = { NULL, NULL };
-
-		plog (LLV_INFO, LOCATION, NULL, "Adding remote and local NAT-D payloads.\n");
-		if ((natd[0] = natt_hash_addr (iph1, iph1->remote)) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"NAT-D hashing failed for %s\n", saddr2str(iph1->remote));
-			goto end;
-		}
-
-		if ((natd[1] = natt_hash_addr (iph1, iph1->local)) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"NAT-D hashing failed for %s\n", saddr2str(iph1->local));
-			goto end;
-		}
-
-		plist = isakmp_plist_append(plist, natd[0], iph1->natt_options->payload_nat_d);
-		plist = isakmp_plist_append(plist, natd[1], iph1->natt_options->payload_nat_d);
-	}
-#endif
-
-	iph1->sendbuf = isakmp_plist_set_all (&plist, iph1);
-
-#ifdef HAVE_PRINT_ISAKMP_C
-	isakmp_printpacket(iph1->sendbuf, iph1->local, iph1->remote, 0);
-#endif
-
-	/* send the packet, add to the schedule to resend */
-	iph1->retry_counter = iph1->rmconf->retry_counter;
-	if (isakmp_ph1resend(iph1) == -1)
-		goto end;
-
-	/* the sending message is added to the received-list. */
-	if (add_recvdpkt(iph1->remote, iph1->local, iph1->sendbuf, msg) == -1) {
-		plog(LLV_ERROR , LOCATION, NULL,
-			"failed to add a response packet to the tree.\n");
-		goto end;
-	}
-
-	iph1->status = PHASE1ST_MSG2SENT;
-
-	error = 0;
-
-end:
-	if (vid)
-		vfree(vid);
-	return error;
-}
-
-/*
- * receive from responder
- * 	psk: HDR, KE, HASH_R
- * 	sig: HDR, KE, [CERT,] SIG_R
- * 	rsa: HDR, KE, HASH_R
- * 	rev: HDR, <KE>_Ke_r, HASH_R
- */
-int
-base_i3recv(iph1, msg)
-	struct ph1handle *iph1;
-	vchar_t *msg;
-{
-	vchar_t *pbuf = NULL;
-	struct isakmp_parse_t *pa;
-	int error = -1;
-	int ptype;
-#ifdef ENABLE_NATT
-	vchar_t	*natd_received;
-	int natd_seq = 0, natd_verified;
-#endif
-
-	/* validity check */
-	if (iph1->status != PHASE1ST_MSG2SENT) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph1->status);
-		goto end;
-	}
-
-	/* validate the type of next payload */
-	pbuf = isakmp_parse(msg);
-	if (pbuf == NULL)
-		goto end;
-
-	for (pa = (struct isakmp_parse_t *)pbuf->v;
-	     pa->type != ISAKMP_NPTYPE_NONE;
-	     pa++) {
-
-		switch (pa->type) {
-		case ISAKMP_NPTYPE_KE:
-			if (isakmp_p2ph(&iph1->dhpub_p, pa->ptr) < 0)
-				goto end;
-			break;
-		case ISAKMP_NPTYPE_HASH:
-			iph1->pl_hash = (struct isakmp_pl_hash *)pa->ptr;
-			break;
-		case ISAKMP_NPTYPE_CERT:
-			if (oakley_savecert(iph1, pa->ptr) < 0)
-				goto end;
-			break;
-		case ISAKMP_NPTYPE_SIG:
-			if (isakmp_p2ph(&iph1->sig_p, pa->ptr) < 0)
-				goto end;
-			break;
-		case ISAKMP_NPTYPE_VID:
-			handle_vendorid(iph1, pa->ptr);
-			break;
-
-#ifdef ENABLE_NATT
-		case ISAKMP_NPTYPE_NATD_DRAFT:
-		case ISAKMP_NPTYPE_NATD_RFC:
-			if (NATT_AVAILABLE(iph1) && iph1->natt_options &&
-			    pa->type == iph1->natt_options->payload_nat_d) {
-				natd_received = NULL;
-				if (isakmp_p2ph (&natd_received, pa->ptr) < 0)
-					goto end;
-                        
-				/* set both bits first so that we can clear them
-				   upon verifying hashes */
-				if (natd_seq == 0)
-					iph1->natt_flags |= NAT_DETECTED;
-                        
-				/* this function will clear appropriate bits bits 
-				   from iph1->natt_flags */
-				natd_verified = natt_compare_addr_hash (iph1,
-					natd_received, natd_seq++);
-                        
-				plog (LLV_INFO, LOCATION, NULL, "NAT-D payload #%d %s\n",
-					natd_seq - 1,
-					natd_verified ? "verified" : "doesn't match");
-                        
-				vfree (natd_received);
-				break;
-			}
-			/* passthrough to default... */
-#endif
-
-		default:
-			/* don't send information, see ident_r1recv() */
-			plog(LLV_ERROR, LOCATION, iph1->remote,
-				"ignore the packet, "
-				"received unexpecting payload type %d.\n",
-				pa->type);
-			goto end;
-		}
-	}
-
-#ifdef ENABLE_NATT
-	if (NATT_AVAILABLE(iph1)) {
-		plog (LLV_INFO, LOCATION, NULL, "NAT %s %s%s\n",
-		      iph1->natt_flags & NAT_DETECTED ? 
-		      		"detected:" : "not detected",
-		      iph1->natt_flags & NAT_DETECTED_ME ? "ME " : "",
-		      iph1->natt_flags & NAT_DETECTED_PEER ? "PEER" : "");
-		if (iph1->natt_flags & NAT_DETECTED)
-			natt_float_ports (iph1);
-	}
-#endif
-
-	/* payload existency check */
-	/* validate authentication value */
-	ptype = oakley_validate_auth(iph1);
-	if (ptype != 0) {
-		if (ptype == -1) {
-			/* message printed inner oakley_validate_auth() */
-			goto end;
-		}
-		EVT_PUSH(iph1->local, iph1->remote, 
-		    EVTT_PEERPH1AUTH_FAILED, NULL);
-		isakmp_info_send_n1(iph1, ptype, NULL);
-		goto end;
-	}
-
-	/* compute sharing secret of DH */
-	if (oakley_dh_compute(iph1->approval->dhgrp, iph1->dhpub,
-				iph1->dhpriv, iph1->dhpub_p, &iph1->dhgxy) < 0)
-		goto end;
-
-	/* generate SKEYID to compute hash if signature mode */
-	switch (AUTHMETHOD(iph1)) {
-	case OAKLEY_ATTR_AUTH_METHOD_RSASIG:
-	case OAKLEY_ATTR_AUTH_METHOD_DSSSIG:
-#ifdef ENABLE_HYBRID
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
-#endif
-		if (oakley_skeyid(iph1) < 0)
-			goto end;
-		break;
-	default:
-		break;
-	}
-
-	/* generate SKEYIDs & IV & final cipher key */
-	if (oakley_skeyid_dae(iph1) < 0)
-		goto end;
-	if (oakley_compute_enckey(iph1) < 0)
-		goto end;
-	if (oakley_newiv(iph1) < 0)
-		goto end;
-
-	/* see handler.h about IV synchronization. */
-	memcpy(iph1->ivm->iv->v, iph1->ivm->ive->v, iph1->ivm->iv->l);
-
-	/* set encryption flag */
-	iph1->flags |= ISAKMP_FLAG_E;
-
-	iph1->status = PHASE1ST_MSG3RECEIVED;
-
-	error = 0;
-
-end:
-	if (pbuf)
-		vfree(pbuf);
-
-	if (error) {
-		VPTRINIT(iph1->dhpub_p);
-		oakley_delcert(iph1->cert_p);
-		iph1->cert_p = NULL;
-		oakley_delcert(iph1->crl_p);
-		iph1->crl_p = NULL;
-		VPTRINIT(iph1->sig_p);
-	}
-
-	return error;
-}
-
-/*
- * status update and establish isakmp sa.
- */
-int
-base_i3send(iph1, msg)
-	struct ph1handle *iph1;
-	vchar_t *msg;
-{
-	int error = -1;
-
-	/* validity check */
-	if (iph1->status != PHASE1ST_MSG3RECEIVED) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph1->status);
-		goto end;
-	}
-
-	iph1->status = PHASE1ST_ESTABLISHED;
-
-	error = 0;
-
-end:
-	return error;
-}
-
-/*
- * receive from initiator
- * 	psk: HDR, SA, Idii, Ni_b
- * 	sig: HDR, SA, Idii, Ni_b
- * 	rsa: HDR, SA, [HASH(1),] <IDii_b>Pubkey_r, <Ni_b>Pubkey_r
- * 	rev: HDR, SA, [HASH(1),] <Ni_b>Pubkey_r, <IDii_b>Ke_i
- */
-int
-base_r1recv(iph1, msg)
-	struct ph1handle *iph1;
-	vchar_t *msg;
-{
-	vchar_t *pbuf = NULL;
-	struct isakmp_parse_t *pa;
-	int error = -1;
-	int vid_numeric;
-
-	/* validity check */
-	if (iph1->status != PHASE1ST_START) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph1->status);
-		goto end;
-	}
-
-	/* validate the type of next payload */
-	/*
-	 * NOTE: XXX even if multiple VID, we'll silently ignore those.
-	 */
-	pbuf = isakmp_parse(msg);
-	if (pbuf == NULL)
-		goto end;
-	pa = (struct isakmp_parse_t *)pbuf->v;
-
-	/* check the position of SA payload */
-	if (pa->type != ISAKMP_NPTYPE_SA) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"received invalid next payload type %d, "
-			"expecting %d.\n",
-			pa->type, ISAKMP_NPTYPE_SA);
-		goto end;
-	}
-	if (isakmp_p2ph(&iph1->sa, pa->ptr) < 0)
-		goto end;
-	pa++;
-
-	for (/*nothing*/;
-	     pa->type != ISAKMP_NPTYPE_NONE;
-	     pa++) {
-
-		switch (pa->type) {
-		case ISAKMP_NPTYPE_NONCE:
-			if (isakmp_p2ph(&iph1->nonce_p, pa->ptr) < 0)
-				goto end;
-			break;
-		case ISAKMP_NPTYPE_ID:
-			if (isakmp_p2ph(&iph1->id_p, pa->ptr) < 0)
-				goto end;
-			break;
-		case ISAKMP_NPTYPE_VID:
-			vid_numeric = handle_vendorid(iph1, pa->ptr);
-#ifdef ENABLE_FRAG
-			if ((vid_numeric == VENDORID_FRAG) &&
-			    (vendorid_frag_cap(pa->ptr) & VENDORID_FRAG_BASE))
-				iph1->frag = 1;
-#endif
-			break;
-		default:
-			/* don't send information, see ident_r1recv() */
-			plog(LLV_ERROR, LOCATION, iph1->remote,
-				"ignore the packet, "
-				"received unexpecting payload type %d.\n",
-				pa->type);
-			goto end;
-		}
-	}
-
-	if (iph1->nonce_p == NULL || iph1->id_p == NULL) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"few isakmp message received.\n");
-		goto end;
-	}
-
-	/* verify identifier */
-	if (ipsecdoi_checkid1(iph1) != 0) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"invalid ID payload.\n");
-		goto end;
-	}
-
-#ifdef ENABLE_NATT
-	if (NATT_AVAILABLE(iph1))
-		plog(LLV_INFO, LOCATION, iph1->remote,
-		     "Selected NAT-T version: %s\n",
-		     vid_string_by_id(iph1->natt_options->version));
-#endif
-
-	/* check SA payload and set approval SA for use */
-	if (ipsecdoi_checkph1proposal(iph1->sa, iph1) < 0) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"failed to get valid proposal.\n");
-		/* XXX send information */
-		goto end;
-	}
-
-	iph1->status = PHASE1ST_MSG1RECEIVED;
-
-	error = 0;
-
-end:
-	if (pbuf)
-		vfree(pbuf);
-
-	if (error) {
-		VPTRINIT(iph1->sa);
-		VPTRINIT(iph1->nonce_p);
-		VPTRINIT(iph1->id_p);
-	}
-
-	return error;
-}
-
-/*
- * send to initiator
- * 	psk: HDR, SA, Idir, Nr_b
- * 	sig: HDR, SA, Idir, Nr_b, [ CR ]
- * 	rsa: HDR, SA, <IDir_b>PubKey_i, <Nr_b>PubKey_i
- * 	rev: HDR, SA, <Nr_b>PubKey_i, <IDir_b>Ke_r
- */
-int
-base_r1send(iph1, msg)
-	struct ph1handle *iph1;
-	vchar_t *msg;
-{
-	struct payload_list *plist = NULL;
-	int error = -1;
-#ifdef ENABLE_NATT
-	vchar_t *vid_natt = NULL;
-#endif
-#ifdef ENABLE_HYBRID    
-        vchar_t *vid_xauth = NULL;
-        vchar_t *vid_unity = NULL;
-#endif  
-#ifdef ENABLE_FRAG
-	vchar_t *vid_frag = NULL;
-#endif
-#ifdef ENABLE_DPD
-	vchar_t *vid_dpd = NULL;
-#endif  
-
-	/* validity check */
-	if (iph1->status != PHASE1ST_MSG1RECEIVED) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph1->status);
-		goto end;
-	}
-
-	/* set responder's cookie */
-	isakmp_newcookie((caddr_t)&iph1->index.r_ck, iph1->remote, iph1->local);
-
-	/* make ID payload into isakmp status */
-	if (ipsecdoi_setid1(iph1) < 0)
-		goto end;
-
-	/* generate NONCE value */
-	iph1->nonce = eay_set_random(iph1->rmconf->nonce_size);
-	if (iph1->nonce == NULL)
-		goto end;
-
-	/* set SA payload to reply */
-	plist = isakmp_plist_append(plist, iph1->sa_ret, ISAKMP_NPTYPE_SA);
-
-	/* create isakmp ID payload */
-	plist = isakmp_plist_append(plist, iph1->id, ISAKMP_NPTYPE_ID);
-
-	/* create isakmp NONCE payload */
-	plist = isakmp_plist_append(plist, iph1->nonce, ISAKMP_NPTYPE_NONCE);
-
-#ifdef ENABLE_NATT
-	/* has the peer announced nat-t? */
-	if (NATT_AVAILABLE(iph1))
-		vid_natt = set_vendorid(iph1->natt_options->version);
-	if (vid_natt)
-		plist = isakmp_plist_append(plist, vid_natt, ISAKMP_NPTYPE_VID);
-#endif
-#ifdef ENABLE_HYBRID
-	if (iph1->mode_cfg->flags & ISAKMP_CFG_VENDORID_XAUTH) {
-		plog (LLV_INFO, LOCATION, NULL, "Adding xauth VID payload.\n");
-		if ((vid_xauth = set_vendorid(VENDORID_XAUTH)) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "Cannot create Xauth vendor ID\n");
-			goto end;
-		}
-		plist = isakmp_plist_append(plist,
-		    vid_xauth, ISAKMP_NPTYPE_VID);
-	}
-
-	if (iph1->mode_cfg->flags & ISAKMP_CFG_VENDORID_UNITY) {
-		if ((vid_unity = set_vendorid(VENDORID_UNITY)) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "Cannot create Unity vendor ID\n");
-			goto end;
-		}
-		plist = isakmp_plist_append(plist,
-		    vid_unity, ISAKMP_NPTYPE_VID);
-	}
-#endif
-#ifdef ENABLE_DPD
-	/* 
-	 * Only send DPD support if remote announced DPD 
-	 * and if DPD support is active 
-	 */
-	if (iph1->dpd_support && iph1->rmconf->dpd) {
-		if ((vid_dpd = set_vendorid(VENDORID_DPD)) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "DPD vendorID construction failed\n");
-		} else {
-			plist = isakmp_plist_append(plist, vid_dpd,
-			    ISAKMP_NPTYPE_VID);
-		}
-	}
-#endif
-#ifdef ENABLE_FRAG
-	if (iph1->rmconf->ike_frag) {
-		if ((vid_frag = set_vendorid(VENDORID_FRAG)) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "Frag vendorID construction failed\n");
-		} else {
-			vid_frag = isakmp_frag_addcap(vid_frag,
-			    VENDORID_FRAG_BASE);
-			plist = isakmp_plist_append(plist,
-			    vid_frag, ISAKMP_NPTYPE_VID);
-		}
-	}
-#endif
-
-	iph1->sendbuf = isakmp_plist_set_all (&plist, iph1);
-
-#ifdef HAVE_PRINT_ISAKMP_C
-	isakmp_printpacket(iph1->sendbuf, iph1->local, iph1->remote, 0);
-#endif
-
-	/* send the packet, add to the schedule to resend */
-	iph1->retry_counter = iph1->rmconf->retry_counter;
-	if (isakmp_ph1resend(iph1) == -1) {
-		iph1 = NULL;
-		goto end;
-	}
-
-	/* the sending message is added to the received-list. */
-	if (add_recvdpkt(iph1->remote, iph1->local, iph1->sendbuf, msg) == -1) {
-		plog(LLV_ERROR , LOCATION, NULL,
-			"failed to add a response packet to the tree.\n");
-		goto end;
-	}
-
-	iph1->status = PHASE1ST_MSG1SENT;
-
-	error = 0;
-
-end:
-#ifdef ENABLE_NATT
-	if (vid_natt)
-		vfree(vid_natt);
-#endif
-#ifdef ENABLE_HYBRID    
-	if (vid_xauth != NULL)
-		vfree(vid_xauth);
-	if (vid_unity != NULL)
-		vfree(vid_unity);
-#endif    
-#ifdef ENABLE_FRAG
-	if (vid_frag)
-		vfree(vid_frag);
-#endif
-#ifdef ENABLE_DPD
-	if (vid_dpd)
-		vfree(vid_dpd);
-#endif
-
-	if (iph1 != NULL)
-		VPTRINIT(iph1->sa_ret);
-
-	return error;
-}
-
-/*
- * receive from initiator
- * 	psk: HDR, KE, HASH_I
- * 	sig: HDR, KE, [ CR, ] [CERT,] SIG_I
- * 	rsa: HDR, KE, HASH_I
- * 	rev: HDR, <KE>Ke_i, HASH_I
- */
-int
-base_r2recv(iph1, msg)
-	struct ph1handle *iph1;
-	vchar_t *msg;
-{
-	vchar_t *pbuf = NULL;
-	struct isakmp_parse_t *pa;
-	int error = -1;
-	int ptype;
-#ifdef ENABLE_NATT
-	int natd_seq = 0;
-#endif
-
-	/* validity check */
-	if (iph1->status != PHASE1ST_MSG1SENT) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph1->status);
-		goto end;
-	}
-
-	/* validate the type of next payload */
-	pbuf = isakmp_parse(msg);
-	if (pbuf == NULL)
-		goto end;
-
-	iph1->pl_hash = NULL;
-
-	for (pa = (struct isakmp_parse_t *)pbuf->v;
-	     pa->type != ISAKMP_NPTYPE_NONE;
-	     pa++) {
-
-		switch (pa->type) {
-		case ISAKMP_NPTYPE_KE:
-			if (isakmp_p2ph(&iph1->dhpub_p, pa->ptr) < 0)
-				goto end;
-			break;
-		case ISAKMP_NPTYPE_HASH:
-			iph1->pl_hash = (struct isakmp_pl_hash *)pa->ptr;
-			break;
-		case ISAKMP_NPTYPE_CERT:
-			if (oakley_savecert(iph1, pa->ptr) < 0)
-				goto end;
-			break;
-		case ISAKMP_NPTYPE_SIG:
-			if (isakmp_p2ph(&iph1->sig_p, pa->ptr) < 0)
-				goto end;
-			break;
-		case ISAKMP_NPTYPE_VID:
-			handle_vendorid(iph1, pa->ptr);
-			break;
-
-#ifdef ENABLE_NATT
-		case ISAKMP_NPTYPE_NATD_DRAFT:
-		case ISAKMP_NPTYPE_NATD_RFC:
-			if (pa->type == iph1->natt_options->payload_nat_d)
-			{
-				vchar_t *natd_received = NULL;
-				int natd_verified;
-				
-				if (isakmp_p2ph (&natd_received, pa->ptr) < 0)
-					goto end;
-				
-				if (natd_seq == 0)
-					iph1->natt_flags |= NAT_DETECTED;
-				
-				natd_verified = natt_compare_addr_hash (iph1,
-					natd_received, natd_seq++);
-				
-				plog (LLV_INFO, LOCATION, NULL, "NAT-D payload #%d %s\n",
-					natd_seq - 1,
-					natd_verified ? "verified" : "doesn't match");
-				
-				vfree (natd_received);
-				break;
-			}
-			/* passthrough to default... */
-#endif
-
-		default:
-			/* don't send information, see ident_r1recv() */
-			plog(LLV_ERROR, LOCATION, iph1->remote,
-				"ignore the packet, "
-				"received unexpecting payload type %d.\n",
-				pa->type);
-			goto end;
-		}
-	}
-
-	/* generate DH public value */
-	if (oakley_dh_generate(iph1->approval->dhgrp,
-				&iph1->dhpub, &iph1->dhpriv) < 0)
-		goto end;
-
-	/* compute sharing secret of DH */
-	if (oakley_dh_compute(iph1->approval->dhgrp, iph1->dhpub,
-				iph1->dhpriv, iph1->dhpub_p, &iph1->dhgxy) < 0)
-		goto end;
-
-	/* generate SKEYID */
-	if (oakley_skeyid(iph1) < 0)
-		goto end;
-
-#ifdef ENABLE_NATT
-	if (NATT_AVAILABLE(iph1))
-		plog (LLV_INFO, LOCATION, NULL, "NAT %s %s%s\n",
-		      iph1->natt_flags & NAT_DETECTED ? 
-		      		"detected:" : "not detected",
-		      iph1->natt_flags & NAT_DETECTED_ME ? "ME " : "",
-		      iph1->natt_flags & NAT_DETECTED_PEER ? "PEER" : "");
-#endif
-
-	/* payload existency check */
-	/* validate authentication value */
-	ptype = oakley_validate_auth(iph1);
-	if (ptype != 0) {
-		if (ptype == -1) {
-			/* message printed inner oakley_validate_auth() */
-			goto end;
-		}
-		EVT_PUSH(iph1->local, iph1->remote, 
-		    EVTT_PEERPH1AUTH_FAILED, NULL);
-		isakmp_info_send_n1(iph1, ptype, NULL);
-		goto end;
-	}
-
-	iph1->status = PHASE1ST_MSG2RECEIVED;
-
-	error = 0;
-
-end:
-	if (pbuf)
-		vfree(pbuf);
-
-	if (error) {
-		VPTRINIT(iph1->dhpub_p);
-		oakley_delcert(iph1->cert_p);
-		iph1->cert_p = NULL;
-		oakley_delcert(iph1->crl_p);
-		iph1->crl_p = NULL;
-		VPTRINIT(iph1->sig_p);
-	}
-
-	return error;
-}
-
-/*
- * send to initiator
- * 	psk: HDR, KE, HASH_R
- * 	sig: HDR, KE, [CERT,] SIG_R
- * 	rsa: HDR, KE, HASH_R
- * 	rev: HDR, <KE>_Ke_r, HASH_R
- */
-int
-base_r2send(iph1, msg)
-	struct ph1handle *iph1;
-	vchar_t *msg;
-{
-	struct payload_list *plist = NULL;
-	vchar_t *vid = NULL;
-	int need_cert = 0;
-	int error = -1;
-
-	/* validity check */
-	if (iph1->status != PHASE1ST_MSG2RECEIVED) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph1->status);
-		goto end;
-	}
-
-	/* generate HASH to send */
-	plog(LLV_DEBUG, LOCATION, NULL, "generate HASH_I\n");
-	switch (AUTHMETHOD(iph1)) {
-	case OAKLEY_ATTR_AUTH_METHOD_PSKEY:
-#ifdef ENABLE_HYBRID
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
-#endif
-	case OAKLEY_ATTR_AUTH_METHOD_RSAENC:
-	case OAKLEY_ATTR_AUTH_METHOD_RSAREV:
-#ifdef ENABLE_HYBRID
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_R:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_R:
-#endif
-		iph1->hash = oakley_ph1hash_common(iph1, GENERATE);
-		break;
-	case OAKLEY_ATTR_AUTH_METHOD_DSSSIG:
-	case OAKLEY_ATTR_AUTH_METHOD_RSASIG:
-#ifdef ENABLE_HYBRID
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R:
-#endif
-#ifdef HAVE_GSSAPI
-	case OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB:
-#endif
-		iph1->hash = oakley_ph1hash_base_r(iph1, GENERATE);
-		break;
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid authentication method %d\n",
-			iph1->approval->authmethod);
-		goto end; 
-	}
-	if (iph1->hash == NULL)
-		goto end;
-
-	switch (AUTHMETHOD(iph1)) {
-	case OAKLEY_ATTR_AUTH_METHOD_PSKEY:
-#ifdef ENABLE_HYBRID
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
-#endif
-		vid = set_vendorid(iph1->approval->vendorid);
-
-		/* create isakmp KE payload */
-		plist = isakmp_plist_append(plist, 
-		    iph1->dhpub, ISAKMP_NPTYPE_KE);
-
-		/* create isakmp HASH payload */
-		plist = isakmp_plist_append(plist, 
-		    iph1->hash, ISAKMP_NPTYPE_HASH);
-
-		/* append vendor id, if needed */
-		if (vid)
-			plist = isakmp_plist_append(plist, 
-			    vid, ISAKMP_NPTYPE_VID);
-		break;
-	case OAKLEY_ATTR_AUTH_METHOD_DSSSIG:
-	case OAKLEY_ATTR_AUTH_METHOD_RSASIG:
-#ifdef ENABLE_HYBRID
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R:
-#endif
-		/* XXX if there is CR or not ? */
-
-		if (oakley_getmycert(iph1) < 0)
-			goto end;
-
-		if (oakley_getsign(iph1) < 0)
-			goto end;
-
-		if (iph1->cert && iph1->rmconf->send_cert)
-			need_cert = 1;
-
-		/* create isakmp KE payload */
-		plist = isakmp_plist_append(plist, 
-		    iph1->dhpub, ISAKMP_NPTYPE_KE);
-
-		/* add CERT payload if there */
-		if (need_cert)
-			plist = isakmp_plist_append(plist, 
-			    iph1->cert->pl, ISAKMP_NPTYPE_CERT);
-		/* add SIG payload */
-		plist = isakmp_plist_append(plist, 
-		    iph1->sig, ISAKMP_NPTYPE_SIG);
-		break;
-#ifdef HAVE_GSSAPI
-	case OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB:
-		/* ... */
-		break;
-#endif
-	case OAKLEY_ATTR_AUTH_METHOD_RSAENC:
-	case OAKLEY_ATTR_AUTH_METHOD_RSAREV:
-#ifdef ENABLE_HYBRID
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_R:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_R:
-#endif
-		break;
-	}
-
-#ifdef ENABLE_NATT
-	/* generate NAT-D payloads */
-	if (NATT_AVAILABLE(iph1)) {
-		vchar_t *natd[2] = { NULL, NULL };
-
-		plog(LLV_INFO, LOCATION, 
-		    NULL, "Adding remote and local NAT-D payloads.\n");
-		if ((natd[0] = natt_hash_addr(iph1, iph1->remote)) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "NAT-D hashing failed for %s\n", 
-			    saddr2str(iph1->remote));
-			goto end;
-		}
-
-		if ((natd[1] = natt_hash_addr(iph1, iph1->local)) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "NAT-D hashing failed for %s\n", 
-			    saddr2str(iph1->local));
-			goto end;
-		}
-
-		plist = isakmp_plist_append(plist, 
-		    natd[0], iph1->natt_options->payload_nat_d);
-		plist = isakmp_plist_append(plist, 
-		    natd[1], iph1->natt_options->payload_nat_d);
-	}
-#endif
-
-	iph1->sendbuf = isakmp_plist_set_all(&plist, iph1);
-
-#ifdef HAVE_PRINT_ISAKMP_C
-	isakmp_printpacket(iph1->sendbuf, iph1->local, iph1->remote, 0);
-#endif
-
-	/* send HDR;KE;NONCE to responder */
-	if (isakmp_send(iph1, iph1->sendbuf) < 0)
-		goto end;
-
-	/* the sending message is added to the received-list. */
-	if (add_recvdpkt(iph1->remote, iph1->local, iph1->sendbuf, msg) == -1) {
-		plog(LLV_ERROR , LOCATION, NULL,
-			"failed to add a response packet to the tree.\n");
-		goto end;
-	}
-
-	/* generate SKEYIDs & IV & final cipher key */
-	if (oakley_skeyid_dae(iph1) < 0)
-		goto end;
-	if (oakley_compute_enckey(iph1) < 0)
-		goto end;
-	if (oakley_newiv(iph1) < 0)
-		goto end;
-
-	/* set encryption flag */
-	iph1->flags |= ISAKMP_FLAG_E;
-
-	iph1->status = PHASE1ST_ESTABLISHED;
-
-	error = 0;
-
-end:
-	if (vid)
-		vfree(vid);
-	return error;
-}
diff --git a/src/racoon/isakmp_base.h b/src/racoon/isakmp_base.h
deleted file mode 100644
index 560880e..0000000
--- a/src/racoon/isakmp_base.h
+++ /dev/null
@@ -1,48 +0,0 @@
-/*	$NetBSD: isakmp_base.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/* Id: isakmp_base.h,v 1.3 2004/06/11 16:00:16 ludvigm Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _ISAKMP_BASE_H
-#define _ISAKMP_BASE_H
-
-extern int base_i1send __P((struct ph1handle *, vchar_t *));
-extern int base_i2recv __P((struct ph1handle *, vchar_t *));
-extern int base_i2send __P((struct ph1handle *, vchar_t *));
-extern int base_i3recv __P((struct ph1handle *, vchar_t *));
-extern int base_i3send __P((struct ph1handle *, vchar_t *));
-
-extern int base_r1recv __P((struct ph1handle *, vchar_t *));
-extern int base_r1send __P((struct ph1handle *, vchar_t *));
-extern int base_r2recv __P((struct ph1handle *, vchar_t *));
-extern int base_r2send __P((struct ph1handle *, vchar_t *));
-
-#endif /* _ISAKMP_BASE_H */
diff --git a/src/racoon/isakmp_cfg.c b/src/racoon/isakmp_cfg.c
deleted file mode 100644
index fa127dc..0000000
--- a/src/racoon/isakmp_cfg.c
+++ /dev/null
@@ -1,2194 +0,0 @@
-/*	$NetBSD: isakmp_cfg.c,v 1.12.6.4 2008/11/27 15:25:20 vanhu Exp $	*/
-
-/* Id: isakmp_cfg.c,v 1.55 2006/08/22 18:17:17 manubsd Exp */
-
-/*
- * Copyright (C) 2004-2006 Emmanuel Dreyfus
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/socket.h>
-#include <sys/queue.h>
-
-#ifndef ANDROID_PATCHED
-#include <utmp.h>
-#endif
-#if defined(__APPLE__) && defined(__MACH__)
-#include <util.h>
-#endif
-
-#ifdef __FreeBSD__
-# include <libutil.h>
-#endif
-#ifdef __NetBSD__
-#  include <util.h>
-#endif
-
-#include <netinet/in.h>
-#include <arpa/inet.h>
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-#if TIME_WITH_SYS_TIME
-# include <sys/time.h>
-# include <time.h>
-#else
-# if HAVE_SYS_TIME_H
-#  include <sys/time.h>
-# else
-#  include <time.h>
-# endif
-#endif
-#include <netdb.h>
-#ifdef HAVE_UNISTD_H
-#include <unistd.h>
-#endif
-#if HAVE_STDINT_H
-#include <stdint.h>
-#endif
-#include <ctype.h>
-#include <resolv.h>
-
-#ifdef HAVE_LIBRADIUS
-#include <sys/utsname.h>
-#include <radlib.h>
-#endif
-
-#include "var.h"
-#include "misc.h"
-#include "vmbuf.h"
-#include "plog.h"
-#include "sockmisc.h"
-#include "schedule.h"
-#include "debug.h"
-
-#include "isakmp_var.h"
-#include "isakmp.h"
-#include "handler.h"
-#include "evt.h"
-#include "throttle.h"
-#include "remoteconf.h"
-#include "crypto_openssl.h"
-#include "isakmp_inf.h"
-#include "isakmp_xauth.h"
-#include "isakmp_unity.h"
-#include "isakmp_cfg.h"
-#include "strnames.h"
-#include "admin.h"
-#include "privsep.h"
-
-struct isakmp_cfg_config isakmp_cfg_config;
-
-static vchar_t *buffer_cat(vchar_t *s, vchar_t *append);
-static vchar_t *isakmp_cfg_net(struct ph1handle *, struct isakmp_data *);
-#if 0
-static vchar_t *isakmp_cfg_void(struct ph1handle *, struct isakmp_data *);
-#endif
-static vchar_t *isakmp_cfg_addr4(struct ph1handle *, 
-				 struct isakmp_data *, in_addr_t *);
-static void isakmp_cfg_getaddr4(struct isakmp_data *, struct in_addr *);
-static vchar_t *isakmp_cfg_addr4_list(struct ph1handle *,
-				      struct isakmp_data *, in_addr_t *, int);
-static void isakmp_cfg_appendaddr4(struct isakmp_data *, 
-				   struct in_addr *, int *, int);
-static void isakmp_cfg_getstring(struct isakmp_data *,char *);
-void isakmp_cfg_iplist_to_str(char *, int, void *, int);
-
-#define ISAKMP_CFG_LOGIN	1
-#define ISAKMP_CFG_LOGOUT	2
-static int isakmp_cfg_accounting(struct ph1handle *, int);
-#ifdef HAVE_LIBRADIUS
-static int isakmp_cfg_accounting_radius(struct ph1handle *, int);
-#endif
-
-/* 
- * Handle an ISAKMP config mode packet
- * We expect HDR, HASH, ATTR
- */
-void
-isakmp_cfg_r(iph1, msg)
-	struct ph1handle *iph1;
-	vchar_t *msg;
-{
-	struct isakmp *packet;
-	struct isakmp_gen *ph;
-	int tlen;
-	char *npp;
-	int np;
-	vchar_t *dmsg;
-	struct isakmp_ivm *ivm;
-
-	/* Check that the packet is long enough to have a header */
-	if (msg->l < sizeof(*packet)) {
-	     plog(LLV_ERROR, LOCATION, NULL, "Unexpected short packet\n");
-	     return;
-	}
-
-	packet = (struct isakmp *)msg->v;
-
-	/* Is it encrypted? It should be encrypted */
-	if ((packet->flags & ISAKMP_FLAG_E) == 0) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "User credentials sent in cleartext!\n");
-		return;
-	}
-
-	/* 
-	 * Decrypt the packet. If this is the beginning of a new
-	 * exchange, reinitialize the IV
-	 */
-	if (iph1->mode_cfg->ivm == NULL ||
-	    iph1->mode_cfg->last_msgid != packet->msgid )
-		iph1->mode_cfg->ivm = 
-		    isakmp_cfg_newiv(iph1, packet->msgid);
-	ivm = iph1->mode_cfg->ivm;
-
-	dmsg = oakley_do_decrypt(iph1, msg, ivm->iv, ivm->ive);
-	if (dmsg == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "failed to decrypt message\n");
-		return;
-	}
-
-	plog(LLV_DEBUG, LOCATION, NULL, "MODE_CFG packet\n");
-	plogdump(LLV_DEBUG, dmsg->v, dmsg->l);
-
-	/* Now work with the decrypted packet */
-	packet = (struct isakmp *)dmsg->v;
-	tlen = dmsg->l - sizeof(*packet);
-	ph = (struct isakmp_gen *)(packet + 1);
-
-	np = packet->np;
-	while ((tlen > 0) && (np != ISAKMP_NPTYPE_NONE)) {
-		/* Check that the payload header fits in the packet */
-		if (tlen < sizeof(*ph)) {
-			 plog(LLV_WARNING, LOCATION, NULL, 
-			      "Short payload header\n");
-			 goto out;
-		}
-
-		/* Check that the payload fits in the packet */
-		if (tlen < ntohs(ph->len)) {
-			plog(LLV_WARNING, LOCATION, NULL, 
-			      "Short payload\n");
-			goto out;
-		}
-		
-		plog(LLV_DEBUG, LOCATION, NULL, "Seen payload %d\n", np);
-		plogdump(LLV_DEBUG, ph, ntohs(ph->len));
-
-		switch(np) {
-		case ISAKMP_NPTYPE_HASH: {
-			vchar_t *check;
-			vchar_t *payload;
-			size_t plen;
-			struct isakmp_gen *nph;
-
-			plen = ntohs(ph->len);
-			nph = (struct isakmp_gen *)((char *)ph + plen);
-			plen = ntohs(nph->len);
-
-			if ((payload = vmalloc(plen)) == NULL) {
-				plog(LLV_ERROR, LOCATION, NULL, 
-				    "Cannot allocate memory\n");
-				goto out;
-			}
-			memcpy(payload->v, nph, plen);
-
-			if ((check = oakley_compute_hash1(iph1, 
-			    packet->msgid, payload)) == NULL) {
-				plog(LLV_ERROR, LOCATION, NULL, 
-				    "Cannot compute hash\n");
-				vfree(payload);
-				goto out;
-			}
-
-			if (memcmp(ph + 1, check->v, check->l) != 0) {
-				plog(LLV_ERROR, LOCATION, NULL, 
-				    "Hash verification failed\n");
-				vfree(payload);
-				vfree(check);
-				goto out;
-			}
-			vfree(payload);
-			vfree(check);
-			break;
-		}
-		case ISAKMP_NPTYPE_ATTR: {
-			struct isakmp_pl_attr *attrpl;
-
-			attrpl = (struct isakmp_pl_attr *)ph;
-			isakmp_cfg_attr_r(iph1, packet->msgid, attrpl);
-
-			break;
-		}
-		default:
-			 plog(LLV_WARNING, LOCATION, NULL, 
-			      "Unexpected next payload %d\n", np);
-			 /* Skip to the next payload */
-			 break;
-		}
-
-		/* Move to the next payload */
-		np = ph->np;
-		tlen -= ntohs(ph->len);
-		npp = (char *)ph;
-		ph = (struct isakmp_gen *)(npp + ntohs(ph->len));
-	}
-
-out:
-	vfree(dmsg);
-}
-
-int
-isakmp_cfg_attr_r(iph1, msgid, attrpl) 
-	struct ph1handle *iph1;
-	u_int32_t msgid;
-	struct isakmp_pl_attr *attrpl;
-{
-	int type = attrpl->type;
-
-	plog(LLV_DEBUG, LOCATION, NULL,
-	     "Configuration exchange type %s\n", s_isakmp_cfg_ptype(type));
-	switch (type) {
-	case ISAKMP_CFG_ACK:
-		/* ignore, but this is the time to reinit the IV */
-		oakley_delivm(iph1->mode_cfg->ivm);
-		iph1->mode_cfg->ivm = NULL;
-		return 0;
-		break;
-
-	case ISAKMP_CFG_REPLY:
-		return isakmp_cfg_reply(iph1, attrpl);
-		break;
-
-	case ISAKMP_CFG_REQUEST:
-		iph1->msgid = msgid;
-		return isakmp_cfg_request(iph1, attrpl);
-		break;
-
-	case ISAKMP_CFG_SET:
-		iph1->msgid = msgid;
-		return isakmp_cfg_set(iph1, attrpl);
-		break;
-
-	default:
-		plog(LLV_WARNING, LOCATION, NULL,
-		     "Unepected configuration exchange type %d\n", type);
-		return -1;
-		break;
-	}
-
-	return 0;
-}
-
-int
-isakmp_cfg_reply(iph1, attrpl)
-	struct ph1handle *iph1;
-	struct isakmp_pl_attr *attrpl;
-{
-	struct isakmp_data *attr;
-	int tlen;
-	size_t alen;
-	char *npp;
-	int type;
-	struct sockaddr_in *sin;
-	int error;
-
-	tlen = ntohs(attrpl->h.len);
-	attr = (struct isakmp_data *)(attrpl + 1);
-	tlen -= sizeof(*attrpl);
-	
-	while (tlen > 0) {
-		type = ntohs(attr->type);
-
-		/* Handle short attributes */
-		if ((type & ISAKMP_GEN_MASK) == ISAKMP_GEN_TV) {
-			type &= ~ISAKMP_GEN_MASK;
-
-			plog(LLV_DEBUG, LOCATION, NULL,
-			     "Short attribute %s = %d\n", 
-			     s_isakmp_cfg_type(type), ntohs(attr->lorv));
-
-			switch (type) {
-			case XAUTH_TYPE:
-				if ((error = xauth_attr_reply(iph1, 
-				    attr, ntohs(attrpl->id))) != 0)
-					return error;
-				break;
-
-			default:
-				plog(LLV_WARNING, LOCATION, NULL,
-				     "Ignored short attribute %s\n",
-				     s_isakmp_cfg_type(type));
-				break;
-			}
-
-			tlen -= sizeof(*attr);
-			attr++;
-			continue;
-		}
-
-		type = ntohs(attr->type);
-		alen = ntohs(attr->lorv);
-
-		/* Check that the attribute fit in the packet */
-		if (tlen < alen) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			     "Short attribute %s\n",
-			     s_isakmp_cfg_type(type));
-			return -1;
-		}
-
-		plog(LLV_DEBUG, LOCATION, NULL,
-		     "Attribute %s, len %zu\n", 
-		     s_isakmp_cfg_type(type), alen);
-
-		switch(type) {
-		case XAUTH_TYPE:
-		case XAUTH_USER_NAME:
-		case XAUTH_USER_PASSWORD:
-		case XAUTH_PASSCODE:
-		case XAUTH_MESSAGE:
-		case XAUTH_CHALLENGE:
-		case XAUTH_DOMAIN:
-		case XAUTH_STATUS:
-		case XAUTH_NEXT_PIN:
-		case XAUTH_ANSWER:
-			if ((error = xauth_attr_reply(iph1, 
-			    attr, ntohs(attrpl->id))) != 0)
-				return error;
-			break;
-		case INTERNAL_IP4_ADDRESS:
-			isakmp_cfg_getaddr4(attr, &iph1->mode_cfg->addr4);
-			iph1->mode_cfg->flags |= ISAKMP_CFG_GOT_ADDR4;
-			break;
-		case INTERNAL_IP4_NETMASK:
-			isakmp_cfg_getaddr4(attr, &iph1->mode_cfg->mask4);
-			iph1->mode_cfg->flags |= ISAKMP_CFG_GOT_MASK4;
-			break;
-		case INTERNAL_IP4_DNS:
-			isakmp_cfg_appendaddr4(attr, 
-			    &iph1->mode_cfg->dns4[iph1->mode_cfg->dns4_index],
-			    &iph1->mode_cfg->dns4_index, MAXNS);
-			iph1->mode_cfg->flags |= ISAKMP_CFG_GOT_DNS4;
-			break;
-		case INTERNAL_IP4_NBNS:
-			isakmp_cfg_appendaddr4(attr, 
-			    &iph1->mode_cfg->wins4[iph1->mode_cfg->wins4_index],
-			    &iph1->mode_cfg->wins4_index, MAXNS);
-			iph1->mode_cfg->flags |= ISAKMP_CFG_GOT_WINS4;
-			break;
-		case UNITY_DEF_DOMAIN:
-			isakmp_cfg_getstring(attr, 
-			    iph1->mode_cfg->default_domain);
-			iph1->mode_cfg->flags |= ISAKMP_CFG_GOT_DEFAULT_DOMAIN;
-			break;
-		case UNITY_SPLIT_INCLUDE:
-		case UNITY_LOCAL_LAN:
-		case UNITY_SPLITDNS_NAME:
-		case UNITY_BANNER:
-		case UNITY_SAVE_PASSWD:
-		case UNITY_NATT_PORT:
-		case UNITY_PFS:
-		case UNITY_FW_TYPE:
-		case UNITY_BACKUP_SERVERS:
-		case UNITY_DDNS_HOSTNAME:
-			isakmp_unity_reply(iph1, attr);
-			break;
-		case INTERNAL_IP4_SUBNET:
-		case INTERNAL_ADDRESS_EXPIRY:
-		default:
-			plog(LLV_WARNING, LOCATION, NULL,
-			     "Ignored attribute %s\n",
-			     s_isakmp_cfg_type(type));
-			break;
-		}
-
-		npp = (char *)attr;
-		attr = (struct isakmp_data *)(npp + sizeof(*attr) + alen);
-		tlen -= (sizeof(*attr) + alen);
-	}
-
-	/* 
-	 * Call the SA up script hook now that we have the configuration
-	 * It is done at the end of phase 1 if ISAKMP mode config is not
-	 * requested.
-	 */
-	
-	if ((iph1->status == PHASE1ST_ESTABLISHED) && 
-	    iph1->rmconf->mode_cfg) {
-		switch (AUTHMETHOD(iph1)) {
-		case FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I:
-		case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
-		/* Unimplemented */
-		case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I: 
-		case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I: 
-		case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I:
-		case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_I: 
-		case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_I: 
-			script_hook(iph1, SCRIPT_PHASE1_UP);
-			break;
-		default:
-			break;
-		}
-	}
-		
-
-#ifdef ENABLE_ADMINPORT
-	{
-		vchar_t *buf;
-
-		alen = ntohs(attrpl->h.len) - sizeof(*attrpl);
-		if ((buf = vmalloc(alen)) == NULL) {
-			plog(LLV_WARNING, LOCATION, NULL, 
-			    "Cannot allocate memory: %s\n", strerror(errno));
-		} else {
-			memcpy(buf->v, attrpl + 1, buf->l);
-			EVT_PUSH(iph1->local, iph1->remote, 
-			    EVTT_ISAKMP_CFG_DONE, buf);
-			vfree(buf);
-		}
-	}
-#endif
-
-	return 0;
-}
-
-int
-isakmp_cfg_request(iph1, attrpl)
-	struct ph1handle *iph1;
-	struct isakmp_pl_attr *attrpl;
-{
-	struct isakmp_data *attr;
-	int tlen;
-	size_t alen;
-	char *npp;
-	vchar_t *payload;
-	struct isakmp_pl_attr *reply;
-	vchar_t *reply_attr;
-	int type;
-	int error = -1;
-
-	if ((payload = vmalloc(sizeof(*reply))) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "Cannot allocate memory\n");
-		return -1;
-	}
-	memset(payload->v, 0, sizeof(*reply));
-
-	tlen = ntohs(attrpl->h.len);
-	attr = (struct isakmp_data *)(attrpl + 1);
-	tlen -= sizeof(*attrpl);
-	
-	while (tlen > 0) {
-		reply_attr = NULL;
-		type = ntohs(attr->type);
-
-		/* Handle short attributes */
-		if ((type & ISAKMP_GEN_MASK) == ISAKMP_GEN_TV) {
-			type &= ~ISAKMP_GEN_MASK;
-
-			plog(LLV_DEBUG, LOCATION, NULL,
-			     "Short attribute %s = %d\n", 
-			     s_isakmp_cfg_type(type), ntohs(attr->lorv));
-
-			switch (type) {
-			case XAUTH_TYPE:
-				reply_attr = isakmp_xauth_req(iph1, attr);
-				break;
-			default:
-				plog(LLV_WARNING, LOCATION, NULL,
-				     "Ignored short attribute %s\n",
-				     s_isakmp_cfg_type(type));
-				break;
-			}
-
-			tlen -= sizeof(*attr);
-			attr++;
-
-			if (reply_attr != NULL) {
-				payload = buffer_cat(payload, reply_attr);
-				vfree(reply_attr);
-			}
-
-			continue;
-		}
-
-		type = ntohs(attr->type);
-		alen = ntohs(attr->lorv);
-
-		/* Check that the attribute fit in the packet */
-		if (tlen < alen) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			     "Short attribute %s\n",
-			     s_isakmp_cfg_type(type));
-			goto end;
-		}
-
-		plog(LLV_DEBUG, LOCATION, NULL,
-		     "Attribute %s, len %zu\n",
-		     s_isakmp_cfg_type(type), alen);
-
-		switch(type) {
-		case INTERNAL_IP4_ADDRESS:
-		case INTERNAL_IP4_NETMASK:
-		case INTERNAL_IP4_DNS:
-		case INTERNAL_IP4_NBNS:
-		case INTERNAL_IP4_SUBNET:
-			reply_attr = isakmp_cfg_net(iph1, attr);
-			break;
-
-		case XAUTH_TYPE:
-		case XAUTH_USER_NAME:
-		case XAUTH_USER_PASSWORD:
-		case XAUTH_PASSCODE:
-		case XAUTH_MESSAGE:
-		case XAUTH_CHALLENGE:
-		case XAUTH_DOMAIN:
-		case XAUTH_STATUS:
-		case XAUTH_NEXT_PIN:
-		case XAUTH_ANSWER:
-			reply_attr = isakmp_xauth_req(iph1, attr);
-			break;
-
-		case APPLICATION_VERSION:
-			reply_attr = isakmp_cfg_string(iph1, 
-			    attr, ISAKMP_CFG_RACOON_VERSION);
-			break;
-
-		case UNITY_BANNER:
-		case UNITY_PFS:
-		case UNITY_SAVE_PASSWD:
-		case UNITY_DEF_DOMAIN:
-		case UNITY_DDNS_HOSTNAME:
-		case UNITY_FW_TYPE:
-		case UNITY_SPLITDNS_NAME:
-		case UNITY_SPLIT_INCLUDE:
-		case UNITY_LOCAL_LAN:
-		case UNITY_NATT_PORT:
-		case UNITY_BACKUP_SERVERS:
-			reply_attr = isakmp_unity_req(iph1, attr);
-			break;
-
-		case INTERNAL_ADDRESS_EXPIRY:
-		default:
-			plog(LLV_WARNING, LOCATION, NULL,
-			     "Ignored attribute %s\n",
-			     s_isakmp_cfg_type(type));
-			break;
-		}
-
-		npp = (char *)attr;
-		attr = (struct isakmp_data *)(npp + sizeof(*attr) + alen);
-		tlen -= (sizeof(*attr) + alen);
-
-		if (reply_attr != NULL) {
-			payload = buffer_cat(payload, reply_attr);
-			vfree(reply_attr);
-		}
-
-	}
-
-	reply = (struct isakmp_pl_attr *)payload->v;
-	reply->h.len = htons(payload->l);
-	reply->type = ISAKMP_CFG_REPLY;
-	reply->id = attrpl->id;
-
-	plog(LLV_DEBUG, LOCATION, NULL, 
-		    "Sending MODE_CFG REPLY\n");
-
-	error = isakmp_cfg_send(iph1, payload, 
-	    ISAKMP_NPTYPE_ATTR, ISAKMP_FLAG_E, 0);
-
-	if (iph1->status == PHASE1ST_ESTABLISHED) {
-		switch (AUTHMETHOD(iph1)) {
-		case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
-		case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R:
-		/* Unimplemented */
-		case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R: 
-		case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R: 
-		case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R:
-		case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_R: 
-		case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_R: 
-			script_hook(iph1, SCRIPT_PHASE1_UP);
-			break;
-		default:
-			break;
-		}
-	}
-	
-end:
-	vfree(payload);
-
-	return error;
-}
-
-int
-isakmp_cfg_set(iph1, attrpl)
-	struct ph1handle *iph1;
-	struct isakmp_pl_attr *attrpl;
-{
-	struct isakmp_data *attr;
-	int tlen;
-	size_t alen;
-	char *npp;
-	vchar_t *payload;
-	struct isakmp_pl_attr *reply;
-	vchar_t *reply_attr;
-	int type;
-	int error = -1;
-
-	if ((payload = vmalloc(sizeof(*reply))) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "Cannot allocate memory\n");
-		return -1;
-	}
-	memset(payload->v, 0, sizeof(*reply));
-
-	tlen = ntohs(attrpl->h.len);
-	attr = (struct isakmp_data *)(attrpl + 1);
-	tlen -= sizeof(*attrpl);
-	
-	/* 
-	 * We should send ack for the attributes we accepted 
-	 */
-	while (tlen > 0) {
-		reply_attr = NULL;
-		type = ntohs(attr->type);
-
-		plog(LLV_DEBUG, LOCATION, NULL,
-		     "Attribute %s\n", 
-		     s_isakmp_cfg_type(type & ~ISAKMP_GEN_MASK));
-		
-		switch (type & ~ISAKMP_GEN_MASK) {
-		case XAUTH_STATUS:
-			reply_attr = isakmp_xauth_set(iph1, attr);
-			break;
-		default:
-			plog(LLV_DEBUG, LOCATION, NULL,
-			     "Unexpected SET attribute %s\n", 
-		     	     s_isakmp_cfg_type(type & ~ISAKMP_GEN_MASK));
-			break;
-		}
-
-		if (reply_attr != NULL) {
-			payload = buffer_cat(payload, reply_attr);
-			vfree(reply_attr);
-		}
-
-		/* 
-		 * Move to next attribute. If we run out of the packet, 
-		 * tlen becomes negative and we exit. 
-		 */
-		if ((type & ISAKMP_GEN_MASK) == ISAKMP_GEN_TV) {
-			tlen -= sizeof(*attr);
-			attr++;
-		} else {
-			alen = ntohs(attr->lorv);
-			tlen -= (sizeof(*attr) + alen);
-			npp = (char *)attr;
-			attr = (struct isakmp_data *)
-			    (npp + sizeof(*attr) + alen);
-		}
-	}
-
-	reply = (struct isakmp_pl_attr *)payload->v;
-	reply->h.len = htons(payload->l);
-	reply->type = ISAKMP_CFG_ACK;
-	reply->id = attrpl->id;
-
-	plog(LLV_DEBUG, LOCATION, NULL,
-		     "Sending MODE_CFG ACK\n");
-
-	error = isakmp_cfg_send(iph1, payload, 
-	    ISAKMP_NPTYPE_ATTR, ISAKMP_FLAG_E, 0);
-
-	if (iph1->mode_cfg->flags & ISAKMP_CFG_DELETE_PH1) {
-		if (iph1->status == PHASE1ST_ESTABLISHED)
-			isakmp_info_send_d1(iph1);
-		remph1(iph1);
-		delph1(iph1);
-		iph1 = NULL;
-	}
-end:
-	vfree(payload);
-
-	/* 
-	 * If required, request ISAKMP mode config information
-	 */
-	if ((iph1 != NULL) && (iph1->rmconf->mode_cfg) && (error == 0))
-		error = isakmp_cfg_getconfig(iph1);
-
-	return error;
-}
-
-
-static vchar_t *
-buffer_cat(s, append)
-	vchar_t *s;
-	vchar_t *append;
-{
-	vchar_t *new;
-
-	new = vmalloc(s->l + append->l);
-	if (new == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "Cannot allocate memory\n");
-		return s;
-	}
-
-	memcpy(new->v, s->v, s->l);
-	memcpy(new->v + s->l, append->v, append->l);
-
-	vfree(s);
-	return new;
-}
-
-static vchar_t *
-isakmp_cfg_net(iph1, attr)
-	struct ph1handle *iph1;
-	struct isakmp_data *attr;
-{
-	int type;
-	int confsource;
-	in_addr_t addr4;
-
-	type = ntohs(attr->type);
-
-	/* 
-	 * Don't give an address to a peer that did not succeed Xauth
-	 */
-	if (xauth_check(iph1) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "Attempt to start phase config whereas Xauth failed\n");
-		return NULL;
-	}
-
-	confsource = isakmp_cfg_config.confsource;
-	/*
-	 * If we have to fall back to a local
-	 * configuration source, we will jump
-	 * back to this point.
-	 */
-retry_source:
-
-	switch(type) {
-	case INTERNAL_IP4_ADDRESS:
-		switch(confsource) {
-#ifdef HAVE_LIBLDAP
-		case ISAKMP_CFG_CONF_LDAP:
-			if (iph1->mode_cfg->flags & ISAKMP_CFG_ADDR4_EXTERN)
-			    break;
-			plog(LLV_INFO, LOCATION, NULL, 
-			    "No IP from LDAP, using local pool\n");
-			/* FALLTHROUGH */
-			confsource = ISAKMP_CFG_CONF_LOCAL;
-			goto retry_source;
-#endif
-#ifdef HAVE_LIBRADIUS
-		case ISAKMP_CFG_CONF_RADIUS:
-			if ((iph1->mode_cfg->flags & ISAKMP_CFG_ADDR4_EXTERN)
-			    && (iph1->mode_cfg->addr4.s_addr != htonl(-2)))
-			    /*
-			     * -2 is 255.255.255.254, RADIUS uses that
-			     * to instruct the NAS to use a local pool
-			     */
-			    break;
-			plog(LLV_INFO, LOCATION, NULL, 
-			    "No IP from RADIUS, using local pool\n");
-			/* FALLTHROUGH */
-			confsource = ISAKMP_CFG_CONF_LOCAL;
-			goto retry_source;
-#endif
-		case ISAKMP_CFG_CONF_LOCAL:
-			if (isakmp_cfg_getport(iph1) == -1) {
-				plog(LLV_ERROR, LOCATION, NULL, 
-				    "Port pool depleted\n");
-				break;
-			}
-
-			iph1->mode_cfg->addr4.s_addr = 
-			    htonl(ntohl(isakmp_cfg_config.network4) 
-			    + iph1->mode_cfg->port);
-			iph1->mode_cfg->flags |= ISAKMP_CFG_ADDR4_LOCAL;
-			break;
-
-		default:
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "Unexpected confsource\n");
-		}
-			
-		if (isakmp_cfg_accounting(iph1, ISAKMP_CFG_LOGIN) != 0)
-			plog(LLV_ERROR, LOCATION, NULL, "Accounting failed\n");
-
-		return isakmp_cfg_addr4(iph1, 
-		    attr, &iph1->mode_cfg->addr4.s_addr);
-		break;
-
-	case INTERNAL_IP4_NETMASK:
-		switch(confsource) {
-#ifdef HAVE_LIBLDAP
-		case ISAKMP_CFG_CONF_LDAP:
-			if (iph1->mode_cfg->flags & ISAKMP_CFG_MASK4_EXTERN)
-				break;
-			plog(LLV_INFO, LOCATION, NULL, 
-			    "No mask from LDAP, using local pool\n");
-			/* FALLTHROUGH */
-			confsource = ISAKMP_CFG_CONF_LOCAL;
-			goto retry_source;
-#endif
-#ifdef HAVE_LIBRADIUS
-		case ISAKMP_CFG_CONF_RADIUS:
-			if (iph1->mode_cfg->flags & ISAKMP_CFG_MASK4_EXTERN)
-				break;
-			plog(LLV_INFO, LOCATION, NULL, 
-			    "No mask from RADIUS, using local pool\n");
-			/* FALLTHROUGH */
-			confsource = ISAKMP_CFG_CONF_LOCAL;
-			goto retry_source;
-#endif
-		case ISAKMP_CFG_CONF_LOCAL:
-			iph1->mode_cfg->mask4.s_addr 
-			    = isakmp_cfg_config.netmask4;
-			iph1->mode_cfg->flags |= ISAKMP_CFG_MASK4_LOCAL;
-			break;
-
-		default:
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "Unexpected confsource\n");
-		}
-		return isakmp_cfg_addr4(iph1, attr, 
-		    &iph1->mode_cfg->mask4.s_addr);
-		break;
-
-	case INTERNAL_IP4_DNS:
-		return isakmp_cfg_addr4_list(iph1, 
-		    attr, &isakmp_cfg_config.dns4[0], 
-		    isakmp_cfg_config.dns4_index);
-		break;
-
-	case INTERNAL_IP4_NBNS:
-		return isakmp_cfg_addr4_list(iph1, 
-		    attr, &isakmp_cfg_config.nbns4[0], 
-		    isakmp_cfg_config.nbns4_index);
-		break;
-
-	case INTERNAL_IP4_SUBNET:
-		return isakmp_cfg_addr4(iph1, 
-		    attr, &isakmp_cfg_config.network4);
-		break;
-
-	default:
-		plog(LLV_ERROR, LOCATION, NULL, "Unexpected type %d\n", type);
-		break;
-	}
-	return NULL;
-}
-
-#if 0
-static vchar_t *
-isakmp_cfg_void(iph1, attr)
-	struct ph1handle *iph1;
-	struct isakmp_data *attr;
-{
-	vchar_t *buffer;
-	struct isakmp_data *new;
-
-	if ((buffer = vmalloc(sizeof(*attr))) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "Cannot allocate memory\n");
-		return NULL;
-	}
-
-	new = (struct isakmp_data *)buffer->v;
-
-	new->type = attr->type;
-	new->lorv = htons(0);
-
-	return buffer;
-}
-#endif
-
-vchar_t *
-isakmp_cfg_copy(iph1, attr)
-	struct ph1handle *iph1;
-	struct isakmp_data *attr;
-{
-	vchar_t *buffer;
-	size_t len = 0;
-
-	if ((ntohs(attr->type) & ISAKMP_GEN_MASK) == ISAKMP_GEN_TLV)
-		len = ntohs(attr->lorv);
-
-	if ((buffer = vmalloc(sizeof(*attr) + len)) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "Cannot allocate memory\n");
-		return NULL;
-	}
-
-	memcpy(buffer->v, attr, sizeof(*attr) + ntohs(attr->lorv));
-
-	return buffer;
-}
-
-vchar_t *
-isakmp_cfg_short(iph1, attr, value)
-	struct ph1handle *iph1;
-	struct isakmp_data *attr;
-	int value;
-{
-	vchar_t *buffer;
-	struct isakmp_data *new;
-	int type;
-
-	if ((buffer = vmalloc(sizeof(*attr))) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "Cannot allocate memory\n");
-		return NULL;
-	}
-
-	new = (struct isakmp_data *)buffer->v;
-	type = ntohs(attr->type) & ~ISAKMP_GEN_MASK;
-
-	new->type = htons(type | ISAKMP_GEN_TV);
-	new->lorv = htons(value);
-
-	return buffer;
-}
-
-vchar_t *
-isakmp_cfg_varlen(iph1, attr, string, len)
-	struct ph1handle *iph1;
-	struct isakmp_data *attr;
-	char *string;
-	size_t len;
-{
-	vchar_t *buffer;
-	struct isakmp_data *new;
-	char *data;
-
-	if ((buffer = vmalloc(sizeof(*attr) + len)) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "Cannot allocate memory\n");
-		return NULL;
-	}
-
-	new = (struct isakmp_data *)buffer->v;
-
-	new->type = attr->type;
-	new->lorv = htons(len);
-	data = (char *)(new + 1);
-
-	memcpy(data, string, len);
-	
-	return buffer;
-}
-vchar_t *
-isakmp_cfg_string(iph1, attr, string)
-	struct ph1handle *iph1;
-	struct isakmp_data *attr;
-	char *string;
-{
-	size_t len = strlen(string);
-	return isakmp_cfg_varlen(iph1, attr, string, len);
-}
-
-static vchar_t *
-isakmp_cfg_addr4(iph1, attr, addr)
-	struct ph1handle *iph1;
-	struct isakmp_data *attr;
-	in_addr_t *addr;
-{
-	vchar_t *buffer;
-	struct isakmp_data *new;
-	size_t len;
-
-	len = sizeof(*addr);
-	if ((buffer = vmalloc(sizeof(*attr) + len)) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "Cannot allocate memory\n");
-		return NULL;
-	}
-
-	new = (struct isakmp_data *)buffer->v;
-
-	new->type = attr->type;
-	new->lorv = htons(len);
-	memcpy(new + 1, addr, len);
-	
-	return buffer;
-}
-
-static vchar_t *
-isakmp_cfg_addr4_list(iph1, attr, addr, nbr)
-	struct ph1handle *iph1;
-	struct isakmp_data *attr;
-	in_addr_t *addr;
-	int nbr;
-{
-	int error = -1;
-	vchar_t *buffer = NULL;
-	vchar_t *bufone = NULL;
-	struct isakmp_data *new;
-	size_t len;
-	int i;
-
-	len = sizeof(*addr);
-	if ((buffer = vmalloc(0)) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "Cannot allocate memory\n");
-		goto out;
-	}
-	for(i = 0; i < nbr; i++) {
-		if ((bufone = vmalloc(sizeof(*attr) + len)) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "Cannot allocate memory\n");
-			goto out;
-		}
-		new = (struct isakmp_data *)bufone->v;
-		new->type = attr->type;
-		new->lorv = htons(len);
-		memcpy(new + 1, &addr[i], len);
-		new += (len + sizeof(*attr));
-		buffer = buffer_cat(buffer, bufone);
-		vfree(bufone);
-	}
-
-	error = 0;
-
-out:
-	if ((error != 0) && (buffer != NULL)) {
-		vfree(buffer);
-		buffer = NULL;
-	}
-
-	return buffer;
-}
-
-struct isakmp_ivm *
-isakmp_cfg_newiv(iph1, msgid)
-	struct ph1handle *iph1;
-	u_int32_t msgid;
-{
-	struct isakmp_cfg_state *ics = iph1->mode_cfg;
-
-	if (ics == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "isakmp_cfg_newiv called without mode config state\n");
-		return NULL;
-	}
-
-	if (ics->ivm != NULL)
-		oakley_delivm(ics->ivm);
-
-	ics->ivm = oakley_newiv2(iph1, msgid);
-	ics->last_msgid = msgid;
-
-	return ics->ivm;
-}
-
-/* Derived from isakmp_info_send_common */
-int
-isakmp_cfg_send(iph1, payload, np, flags, new_exchange)
-	struct ph1handle *iph1;
-	vchar_t *payload;
-	u_int32_t np;
-	int flags;
-	int new_exchange;
-{
-	struct ph2handle *iph2 = NULL;
-	vchar_t *hash = NULL;
-	struct isakmp *isakmp;
-	struct isakmp_gen *gen;
-	char *p;
-	int tlen;
-	int error = -1;
-	struct isakmp_cfg_state *ics = iph1->mode_cfg;
-
-	/* Check if phase 1 is established */
-	if ((iph1->status != PHASE1ST_ESTABLISHED) || 
-	    (iph1->local == NULL) ||
-	    (iph1->remote == NULL)) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "ISAKMP mode config exchange with immature phase 1\n");
-		goto end;
-	}
-
-	/* add new entry to isakmp status table */
-	iph2 = newph2();
-	if (iph2 == NULL)
-		goto end;
-
-	iph2->dst = dupsaddr(iph1->remote);
-	if (iph2->dst == NULL) {
-		delph2(iph2);
-		goto end;
-	}
-	iph2->src = dupsaddr(iph1->local);
-	if (iph2->src == NULL) {
-		delph2(iph2);
-		goto end;
-	}
-
-#if (!defined(ENABLE_NATT)) || (defined(BROKEN_NATT))
-	if (set_port(iph2->dst, 0) == NULL ||
-	    set_port(iph2->src, 0) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		     "invalid family: %d\n", iph1->remote->sa_family);
-		delph2(iph2);
-		goto end;
-	}
-#endif
-	iph2->ph1 = iph1;
-	iph2->side = INITIATOR;
-	iph2->status = PHASE2ST_START;
-
-	if (new_exchange)
-		iph2->msgid = isakmp_newmsgid2(iph1);
-	else
-		iph2->msgid = iph1->msgid;
-
-	/* get IV and HASH(1) if skeyid_a was generated. */
-	if (iph1->skeyid_a != NULL) {
-		if (new_exchange) {
-			if (isakmp_cfg_newiv(iph1, iph2->msgid) == NULL) {
-				delph2(iph2);
-				goto end;
-			}
-		}
-
-		/* generate HASH(1) */
-		hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, payload);
-		if (hash == NULL) {
-			delph2(iph2);
-			goto end;
-		}
-
-		/* initialized total buffer length */
-		tlen = hash->l;
-		tlen += sizeof(*gen);
-	} else {
-		/* IKE-SA is not established */
-		hash = NULL;
-
-		/* initialized total buffer length */
-		tlen = 0;
-	}
-	if ((flags & ISAKMP_FLAG_A) == 0)
-		iph2->flags = (hash == NULL ? 0 : ISAKMP_FLAG_E);
-	else
-		iph2->flags = (hash == NULL ? 0 : ISAKMP_FLAG_A);
-
-	insph2(iph2);
-	bindph12(iph1, iph2);
-
-	tlen += sizeof(*isakmp) + payload->l;
-
-	/* create buffer for isakmp payload */
-	iph2->sendbuf = vmalloc(tlen);
-	if (iph2->sendbuf == NULL) { 
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get buffer to send.\n");
-		goto err;
-	}
-
-	/* create isakmp header */
-	isakmp = (struct isakmp *)iph2->sendbuf->v;
-	memcpy(&isakmp->i_ck, &iph1->index.i_ck, sizeof(cookie_t));
-	memcpy(&isakmp->r_ck, &iph1->index.r_ck, sizeof(cookie_t));
-	isakmp->np = hash == NULL ? (np & 0xff) : ISAKMP_NPTYPE_HASH;
-	isakmp->v = iph1->version;
-	isakmp->etype = ISAKMP_ETYPE_CFG;
-	isakmp->flags = iph2->flags;
-	memcpy(&isakmp->msgid, &iph2->msgid, sizeof(isakmp->msgid));
-	isakmp->len = htonl(tlen);
-	p = (char *)(isakmp + 1);
-
-	/* create HASH payload */
-	if (hash != NULL) {
-		gen = (struct isakmp_gen *)p;
-		gen->np = np & 0xff;
-		gen->len = htons(sizeof(*gen) + hash->l);
-		p += sizeof(*gen);
-		memcpy(p, hash->v, hash->l);
-		p += hash->l;
-	}
-
-	/* add payload */
-	memcpy(p, payload->v, payload->l);
-	p += payload->l;
-
-#ifdef HAVE_PRINT_ISAKMP_C
-	isakmp_printpacket(iph2->sendbuf, iph1->local, iph1->remote, 1);
-#endif
-	
-	plog(LLV_DEBUG, LOCATION, NULL, "MODE_CFG packet to send\n");
-	plogdump(LLV_DEBUG, iph2->sendbuf->v, iph2->sendbuf->l);
-
-	/* encoding */
-	if (ISSET(isakmp->flags, ISAKMP_FLAG_E)) {
-		vchar_t *tmp;
-
-		tmp = oakley_do_encrypt(iph2->ph1, iph2->sendbuf, 
-			ics->ivm->ive, ics->ivm->iv);
-		VPTRINIT(iph2->sendbuf);
-		if (tmp == NULL)
-			goto err;
-		iph2->sendbuf = tmp;
-	}
-
-	/* HDR*, HASH(1), ATTR */
-	if (isakmp_send(iph2->ph1, iph2->sendbuf) < 0) {
-		VPTRINIT(iph2->sendbuf);
-		goto err;
-	}
-
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"sendto mode config %s.\n", s_isakmp_nptype(np));
-
-	/*
-	 * XXX We might need to resend the message...
-	 */
-
-	error = 0;
-	VPTRINIT(iph2->sendbuf);
-
-err:
-	if (iph2->sendbuf != NULL)
-		vfree(iph2->sendbuf);
-
-	unbindph12(iph2);
-	remph2(iph2);
-	delph2(iph2);
-end:
-	if (hash)
-		vfree(hash);
-	return error;
-}
-
-
-void 
-isakmp_cfg_rmstate(iph1)
-	struct ph1handle *iph1;
-{
-	struct isakmp_cfg_state *state = iph1->mode_cfg;
-
-	if (isakmp_cfg_accounting(iph1, ISAKMP_CFG_LOGOUT) != 0)
-		plog(LLV_ERROR, LOCATION, NULL, "Accounting failed\n");
-
-	if (state->flags & ISAKMP_CFG_PORT_ALLOCATED)
-		isakmp_cfg_putport(iph1, state->port);	
-
-	/* Delete the IV if it's still there */
-	if(iph1->mode_cfg->ivm) {
-		oakley_delivm(iph1->mode_cfg->ivm);
-		iph1->mode_cfg->ivm = NULL;
-	}
-
-	/* Free any allocated splitnet lists */
-	if(iph1->mode_cfg->split_include != NULL)
-		splitnet_list_free(iph1->mode_cfg->split_include,
-			&iph1->mode_cfg->include_count);
-	if(iph1->mode_cfg->split_local != NULL)
-		splitnet_list_free(iph1->mode_cfg->split_local,
-			&iph1->mode_cfg->local_count);
-
-	xauth_rmstate(&state->xauth);
-
-	racoon_free(state);
-	iph1->mode_cfg = NULL;
-
-	return;
-}
-
-struct isakmp_cfg_state *
-isakmp_cfg_mkstate(void) 
-{
-	struct isakmp_cfg_state *state;
-
-	if ((state = racoon_malloc(sizeof(*state))) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "Cannot allocate memory for mode config state\n");
-		return NULL;
-	}
-	memset(state, 0, sizeof(*state));
-
-	return state;
-}
-
-int 
-isakmp_cfg_getport(iph1)
-	struct ph1handle *iph1;
-{
-	unsigned int i;
-	size_t size = isakmp_cfg_config.pool_size;
-
-	if (iph1->mode_cfg->flags & ISAKMP_CFG_PORT_ALLOCATED)
-		return iph1->mode_cfg->port;
-
-	if (isakmp_cfg_config.port_pool == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "isakmp_cfg_config.port_pool == NULL\n");
-		return -1;
-	}
-
-	for (i = 0; i < size; i++) {
-		if (isakmp_cfg_config.port_pool[i].used == 0)
-			break;
-	}
-
-	if (i == size) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "No more addresses available\n");
-			return -1;
-	}
-
-	isakmp_cfg_config.port_pool[i].used = 1;
-
-	plog(LLV_INFO, LOCATION, NULL, "Using port %d\n", i);
-
-	iph1->mode_cfg->flags |= ISAKMP_CFG_PORT_ALLOCATED;
-	iph1->mode_cfg->port = i;
-
-	return i;
-}
-
-int 
-isakmp_cfg_putport(iph1, index)
-	struct ph1handle *iph1;
-	unsigned int index;
-{
-	if (isakmp_cfg_config.port_pool == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "isakmp_cfg_config.port_pool == NULL\n");
-		return -1;
-	}
-
-	if (isakmp_cfg_config.port_pool[index].used == 0) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "Attempt to release an unallocated address (port %d)\n",
-		    index);
-		return -1;
-	}
-
-#ifdef HAVE_LIBPAM
-	/* Cleanup PAM status associated with the port */
-	if (isakmp_cfg_config.authsource == ISAKMP_CFG_AUTH_PAM)
-		privsep_cleanup_pam(index);
-#endif
-	isakmp_cfg_config.port_pool[index].used = 0;
-	iph1->mode_cfg->flags &= ISAKMP_CFG_PORT_ALLOCATED;
-
-	plog(LLV_INFO, LOCATION, NULL, "Released port %d\n", index);
-
-	return 0;
-}
-
-#ifdef HAVE_LIBPAM
-void
-cleanup_pam(port)
-	int port;
-{
-	if (isakmp_cfg_config.port_pool[port].pam != NULL) {
-		pam_end(isakmp_cfg_config.port_pool[port].pam, PAM_SUCCESS);
-		isakmp_cfg_config.port_pool[port].pam = NULL;
-	}
-
-	return;
-}
-#endif
-
-/* Accounting, only for RADIUS or PAM */
-static int
-isakmp_cfg_accounting(iph1, inout)
-	struct ph1handle *iph1;
-	int inout;
-{
-#ifdef HAVE_LIBPAM
-	if (isakmp_cfg_config.accounting == ISAKMP_CFG_ACCT_PAM)
-		return privsep_accounting_pam(iph1->mode_cfg->port, 
-		    inout);
-#endif 
-#ifdef HAVE_LIBRADIUS
-	if (isakmp_cfg_config.accounting == ISAKMP_CFG_ACCT_RADIUS)
-		return isakmp_cfg_accounting_radius(iph1, inout);
-#endif
-	if (isakmp_cfg_config.accounting == ISAKMP_CFG_ACCT_SYSTEM)
-		return privsep_accounting_system(iph1->mode_cfg->port,
-			iph1->remote, iph1->mode_cfg->login, inout);
-	return 0;
-}
-
-#ifdef HAVE_LIBPAM
-int 
-isakmp_cfg_accounting_pam(port, inout)
-	int port;
-	int inout;
-{
-	int error = 0;
-	pam_handle_t *pam;
-
-	if (isakmp_cfg_config.port_pool == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "isakmp_cfg_config.port_pool == NULL\n");
-		return -1;
-	}
-	
-	pam = isakmp_cfg_config.port_pool[port].pam;
-	if (pam == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "pam handle is NULL\n");
-		return -1;
-	}
-
-	switch (inout) {
-	case ISAKMP_CFG_LOGIN:
-		error = pam_open_session(pam, 0);
-		break;
-	case ISAKMP_CFG_LOGOUT:
-		error = pam_close_session(pam, 0);
-		pam_end(pam, error);
-		isakmp_cfg_config.port_pool[port].pam = NULL;
-		break;
-	default:
-		plog(LLV_ERROR, LOCATION, NULL, "Unepected inout\n");
-		break;
-	}
-	
-	if (error != 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "pam_open_session/pam_close_session failed: %s\n",
-		    pam_strerror(pam, error)); 
-		return -1;
-        }
-
-	return 0;
-}
-#endif /* HAVE_LIBPAM */
-
-#ifdef HAVE_LIBRADIUS
-static int
-isakmp_cfg_accounting_radius(iph1, inout)
-	struct ph1handle *iph1;
-	int inout;
-{
-	/* For first time use, initialize Radius */
-	if (radius_acct_state == NULL) {
-		if ((radius_acct_state = rad_acct_open()) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "Cannot init librradius\n");
-			return -1;
-		}
-
-		if (rad_config(radius_acct_state, NULL) != 0) {
-			 plog(LLV_ERROR, LOCATION, NULL,
-			     "Cannot open librarius config file: %s\n",
-			     rad_strerror(radius_acct_state));
-			  rad_close(radius_acct_state);
-			  radius_acct_state = NULL;
-			  return -1;
-		}
-	}
-
-	if (rad_create_request(radius_acct_state, 
-	    RAD_ACCOUNTING_REQUEST) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "rad_create_request failed: %s\n",
-		    rad_strerror(radius_acct_state));
-		return -1;
-	}
-
-	if (rad_put_string(radius_acct_state, RAD_USER_NAME, 
-	    iph1->mode_cfg->login) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "rad_put_string failed: %s\n",
-		    rad_strerror(radius_acct_state));
-		return -1;
-	}
-
-	switch (inout) {
-	case ISAKMP_CFG_LOGIN:
-		inout = RAD_START;
-		break;
-	case ISAKMP_CFG_LOGOUT:
-		inout = RAD_STOP;
-		break;
-	default:
-		plog(LLV_ERROR, LOCATION, NULL, "Unepected inout\n");
-		break;
-	}
-
-	if (rad_put_addr(radius_acct_state, 
-	    RAD_FRAMED_IP_ADDRESS, iph1->mode_cfg->addr4) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "rad_put_addr failed: %s\n",
-		    rad_strerror(radius_acct_state));
-		return -1;
-	}
-
-	if (rad_put_addr(radius_acct_state, 
-	    RAD_LOGIN_IP_HOST, iph1->mode_cfg->addr4) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "rad_put_addr failed: %s\n",
-		    rad_strerror(radius_acct_state));
-		return -1;
-	}
-
-	if (rad_put_int(radius_acct_state, RAD_ACCT_STATUS_TYPE, inout) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "rad_put_int failed: %s\n",
-		    rad_strerror(radius_acct_state));
-		return -1;
-	}
-
-	if (isakmp_cfg_radius_common(radius_acct_state, 
-	    iph1->mode_cfg->port) != 0)
-		return -1;
-
-	if (rad_send_request(radius_acct_state) != RAD_ACCOUNTING_RESPONSE) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "rad_send_request failed: %s\n",
-		    rad_strerror(radius_acct_state));
-		return -1;
-	}
-
-	return 0;
-}
-#endif /* HAVE_LIBRADIUS */
-
-/*
- * Attributes common to all RADIUS requests
- */
-#ifdef HAVE_LIBRADIUS
-int
-isakmp_cfg_radius_common(radius_state, port)
-	struct rad_handle *radius_state;
-	int port;
-{ 
-	struct utsname name;
-	static struct hostent *host = NULL;
-	struct in_addr nas_addr;
-
-	/* 
-	 * Find our own IP by resolving our nodename
-	 */
-	if (host == NULL) {
-		if (uname(&name) != 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "uname failed: %s\n", strerror(errno));
-			return -1;
-		}
-
-		if ((host = gethostbyname(name.nodename)) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "gethostbyname failed: %s\n", strerror(errno));
-			return -1;
-		}
-	}
-
-	memcpy(&nas_addr, host->h_addr, sizeof(nas_addr));
-	if (rad_put_addr(radius_state, RAD_NAS_IP_ADDRESS, nas_addr) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "rad_put_addr failed: %s\n",
-		    rad_strerror(radius_state));
-		return -1;
-	}
-
-	if (rad_put_int(radius_state, RAD_NAS_PORT, port) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "rad_put_int failed: %s\n",
-		    rad_strerror(radius_state));
-		return -1;
-	}
-
-	if (rad_put_int(radius_state, RAD_NAS_PORT_TYPE, RAD_VIRTUAL) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "rad_put_int failed: %s\n",
-		    rad_strerror(radius_state));
-		return -1;
-	}
-
-	if (rad_put_int(radius_state, RAD_SERVICE_TYPE, RAD_FRAMED) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "rad_put_int failed: %s\n",
-		    rad_strerror(radius_state));
-		return -1;
-	}
-	
-	return 0;
-}
-#endif
-
-#ifndef ANDROID_PATCHED
-
-/*
-	Logs the user into the utmp system files.
-*/
-
-int
-isakmp_cfg_accounting_system(port, raddr, usr, inout)
-	int port;
-	struct sockaddr *raddr;
-	char *usr;
-	int inout;
-{
-	int error = 0;
-	struct utmp ut;
-	char term[UT_LINESIZE];
-	char addr[NI_MAXHOST];
-	
-	if (usr == NULL || usr[0]=='\0') {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"system accounting : no login found\n");
-		return -1;
-	}
-
-	sprintf(term, TERMSPEC, port);
-
-	switch (inout) {
-	case ISAKMP_CFG_LOGIN:
-		strncpy(ut.ut_name, usr, UT_NAMESIZE);
-		ut.ut_name[UT_NAMESIZE - 1] = '\0';
-
-		strncpy(ut.ut_line, term, UT_LINESIZE);
-		ut.ut_line[UT_LINESIZE - 1] = '\0';
-
-		GETNAMEINFO_NULL(raddr, addr);
-		strncpy(ut.ut_host, addr, UT_HOSTSIZE);
-		ut.ut_host[UT_HOSTSIZE - 1] = '\0';
-
-		ut.ut_time = time(NULL);
- 
-		plog(LLV_INFO, LOCATION, NULL,
-			"Accounting : '%s' logging on '%s' from %s.\n",
-			ut.ut_name, ut.ut_line, ut.ut_host);
-
-		login(&ut);
-
-		break;
-	case ISAKMP_CFG_LOGOUT:	
-
-		plog(LLV_INFO, LOCATION, NULL,
-			"Accounting : '%s' unlogging from '%s'.\n",
-			usr, term);
-
-		logout(term);
-
-		break;
-	default:
-		plog(LLV_ERROR, LOCATION, NULL, "Unepected inout\n");
-		break;
-	}
-
-	return 0;
-}
-	
-#endif
-
-int 
-isakmp_cfg_getconfig(iph1)
-	struct ph1handle *iph1;
-{
-	vchar_t *buffer;
-	struct isakmp_pl_attr *attrpl;
-	struct isakmp_data *attr;
-	size_t len;
-	int error;
-	int attrcount;
-	int i;
-	int attrlist[] = {
-		INTERNAL_IP4_ADDRESS,
-		INTERNAL_IP4_NETMASK,
-		INTERNAL_IP4_DNS,
-		INTERNAL_IP4_NBNS,
-		UNITY_BANNER,
-		UNITY_DEF_DOMAIN,
-		UNITY_SPLITDNS_NAME,
-		UNITY_SPLIT_INCLUDE,
-		UNITY_LOCAL_LAN,
-		APPLICATION_VERSION,
-	};
-
-	attrcount = sizeof(attrlist) / sizeof(*attrlist);
-	len = sizeof(*attrpl) + sizeof(*attr) * attrcount;
-	    
-	if ((buffer = vmalloc(len)) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "Cannot allocate memory\n");
-		return -1;
-	}
-
-	attrpl = (struct isakmp_pl_attr *)buffer->v;
-	attrpl->h.len = htons(len);
-	attrpl->type = ISAKMP_CFG_REQUEST;
-	attrpl->id = htons((u_int16_t)(eay_random() & 0xffff));
-
-	attr = (struct isakmp_data *)(attrpl + 1);
-
-	for (i = 0; i < attrcount; i++) {
-		attr->type = htons(attrlist[i]);
-		attr->lorv = htons(0);
-		attr++;
-	}
-
-	plog(LLV_DEBUG, LOCATION, NULL, 
-		    "Sending MODE_CFG REQUEST\n");
-
-	error = isakmp_cfg_send(iph1, buffer,
-	    ISAKMP_NPTYPE_ATTR, ISAKMP_FLAG_E, 1);
-
-	vfree(buffer);
-
-	return error;
-}
-
-static void
-isakmp_cfg_getaddr4(attr, ip)
-	struct isakmp_data *attr;
-	struct in_addr *ip;
-{
-	size_t alen = ntohs(attr->lorv);
-	in_addr_t *addr;
-
-	if (alen != sizeof(*ip)) {
-		plog(LLV_ERROR, LOCATION, NULL, "Bad IPv4 address len\n");
-		return;
-	}
-
-	addr = (in_addr_t *)(attr + 1);
-	ip->s_addr = *addr;
-
-	return;
-}
-
-static void
-isakmp_cfg_appendaddr4(attr, ip, num, max)
-	struct isakmp_data *attr;
-	struct in_addr *ip;
-	int *num;
-	int max;
-{
-	size_t alen = ntohs(attr->lorv);
-	in_addr_t *addr;
-
-	if (alen != sizeof(*ip)) {
-		plog(LLV_ERROR, LOCATION, NULL, "Bad IPv4 address len\n");
-		return;
-	}
-	if (*num == max) {
-		plog(LLV_ERROR, LOCATION, NULL, "Too many addresses given\n");
-		return;
-	}
-
-	addr = (in_addr_t *)(attr + 1);
-	ip->s_addr = *addr;
-	(*num)++;
-
-	return;
-}
-
-static void
-isakmp_cfg_getstring(attr, str)
-	struct isakmp_data *attr;
-	char *str;
-{
-	size_t alen = ntohs(attr->lorv);
-	char *src;
-	src = (char *)(attr + 1);
-
-	memcpy(str, src, (alen > MAXPATHLEN ? MAXPATHLEN : alen));
-
-	return;
-}
-
-#define IP_MAX 40
-
-void
-isakmp_cfg_iplist_to_str(dest, count, addr, withmask)
-	char *dest;
-	int count;
-	void *addr;
-	int withmask;
-{
-	int i;
-	int p;
-	int l;
-	struct unity_network tmp;
-	for(i = 0, p = 0; i < count; i++) {
-		if(withmask == 1)
-			l = sizeof(struct unity_network);
-		else
-			l = sizeof(struct in_addr);
-		memcpy(&tmp, addr, l);
-#if defined(ANDROID_CHANGES)
-		addr = ((uint8_t*) addr) + l;
-#else
-		addr += l;
-#endif
-		if((uint32_t)tmp.addr4.s_addr == 0)
-			break;
-	
-		inet_ntop(AF_INET, &tmp.addr4, dest + p, IP_MAX);
-		p += strlen(dest + p);
-		if(withmask == 1) {
-			dest[p] = '/';
-			p++;
-			inet_ntop(AF_INET, &tmp.mask4, dest + p, IP_MAX);
-			p += strlen(dest + p);
-		}
-		dest[p] = ' ';
-		p++;
-	}
-	if(p > 0)
-		dest[p-1] = '\0';
-	else
-		dest[0] = '\0';
-}
-
-int
-isakmp_cfg_setenv(iph1, envp, envc)
-	struct ph1handle *iph1; 
-	char ***envp;
-	int *envc;
-{
-	char addrstr[IP_MAX];
-	char addrlist[IP_MAX * MAXNS + MAXNS];
-	char *splitlist = addrlist;
-	char *splitlist_cidr;
-	char defdom[MAXPATHLEN + 1];
-	int cidr, tmp;
-	char cidrstr[4];
-	int i, p;
-	int test;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "Starting a script.\n");
-
-	/* 
-	 * Internal IPv4 address, either if 
-	 * we are a client or a server.
-	 */
-	if ((iph1->mode_cfg->flags & ISAKMP_CFG_GOT_ADDR4) ||
-#ifdef HAVE_LIBLDAP
-	    (iph1->mode_cfg->flags & ISAKMP_CFG_ADDR4_EXTERN) ||
-#endif
-#ifdef HAVE_LIBRADIUS
-	    (iph1->mode_cfg->flags & ISAKMP_CFG_ADDR4_EXTERN) ||
-#endif
-	    (iph1->mode_cfg->flags & ISAKMP_CFG_ADDR4_LOCAL)) {
-		inet_ntop(AF_INET, &iph1->mode_cfg->addr4, 
-		    addrstr, IP_MAX);
-	} else
-		addrstr[0] = '\0';
-
-	if (script_env_append(envp, envc, "INTERNAL_ADDR4", addrstr) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL, "Cannot set INTERNAL_ADDR4\n");
-		return -1;
-	}
-
-	if (iph1->mode_cfg->xauth.authdata.generic.usr != NULL) {
-		if (script_env_append(envp, envc, "XAUTH_USER", 
-		    iph1->mode_cfg->xauth.authdata.generic.usr) != 0) {
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "Cannot set XAUTH_USER\n");
-			return -1;
-		}
-	}
-
-	/* Internal IPv4 mask */
-	if (iph1->mode_cfg->flags & ISAKMP_CFG_GOT_MASK4) 
-		inet_ntop(AF_INET, &iph1->mode_cfg->mask4, 
-		    addrstr, IP_MAX);
-	else
-		addrstr[0] = '\0';
-
-	/* 	
-	 * During several releases, documentation adverised INTERNAL_NETMASK4
-	 * while code was using INTERNAL_MASK4. We now do both.
-	 */
-
-	if (script_env_append(envp, envc, "INTERNAL_MASK4", addrstr) != 0) { 
-		plog(LLV_ERROR, LOCATION, NULL, "Cannot set INTERNAL_MASK4\n");
-		return -1;
-	}
-
-	if (script_env_append(envp, envc, "INTERNAL_NETMASK4", addrstr) != 0) { 
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "Cannot set INTERNAL_NETMASK4\n");
-		return -1;
-	}
-
-	tmp = ntohl(iph1->mode_cfg->mask4.s_addr);
-	for (cidr = 0; tmp != 0; cidr++)
-		tmp <<= 1;
-	snprintf(cidrstr, 3, "%d", cidr);
-
-	if (script_env_append(envp, envc, "INTERNAL_CIDR4", cidrstr) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL, "Cannot set INTERNAL_CIDR4\n");
-		return -1;
-	}
-
-	/* Internal IPv4 DNS */
-	if (iph1->mode_cfg->flags & ISAKMP_CFG_GOT_DNS4) {
-		/* First Internal IPv4 DNS (for compatibilty with older code */
-		inet_ntop(AF_INET, &iph1->mode_cfg->dns4[0], 
-		    addrstr, IP_MAX);
-
-		/* Internal IPv4 DNS - all */
-		isakmp_cfg_iplist_to_str(addrlist, iph1->mode_cfg->dns4_index,
-			(void *)iph1->mode_cfg->dns4, 0);
-	} else {
-		addrstr[0] = '\0';
-		addrlist[0] = '\0';
-	}
-
-	if (script_env_append(envp, envc, "INTERNAL_DNS4", addrstr) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL, "Cannot set INTERNAL_DNS4\n");
-		return -1;
-	}
-	if (script_env_append(envp, envc, "INTERNAL_DNS4_LIST", addrlist) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "Cannot set INTERNAL_DNS4_LIST\n");
-		return -1;
-	}
-	
-	/* Internal IPv4 WINS */
-	if (iph1->mode_cfg->flags & ISAKMP_CFG_GOT_WINS4) {
-		/* 
-		 * First Internal IPv4 WINS 
-		 * (for compatibilty with older code 
-		 */
-		inet_ntop(AF_INET, &iph1->mode_cfg->wins4[0], 
-		    addrstr, IP_MAX);
-
-		/* Internal IPv4 WINS - all */
-		isakmp_cfg_iplist_to_str(addrlist, iph1->mode_cfg->wins4_index,
-			(void *)iph1->mode_cfg->wins4, 0);
-	} else {
-		addrstr[0] = '\0';
-		addrlist[0] = '\0';
-	}
-
-	if (script_env_append(envp, envc, "INTERNAL_WINS4", addrstr) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "Cannot set INTERNAL_WINS4\n");
-		return -1;
-	}
-	if (script_env_append(envp, envc, 
-	    "INTERNAL_WINS4_LIST", addrlist) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "Cannot set INTERNAL_WINS4_LIST\n");
-		return -1;
-	}
-
-	/* Deault domain */
-	if(iph1->mode_cfg->flags & ISAKMP_CFG_GOT_DEFAULT_DOMAIN) 
-		strncpy(defdom, 
-		    iph1->mode_cfg->default_domain, 
-		    MAXPATHLEN + 1);
-	else
-		defdom[0] = '\0';
-	
-	if (script_env_append(envp, envc, "DEFAULT_DOMAIN", defdom) != 0) { 
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "Cannot set DEFAULT_DOMAIN\n");
-		return -1;
-	}
-
-	/* Split networks */
-	if (iph1->mode_cfg->flags & ISAKMP_CFG_GOT_SPLIT_INCLUDE) {
-		splitlist =
-		    splitnet_list_2str(iph1->mode_cfg->split_include, NETMASK);
-		splitlist_cidr =
-		    splitnet_list_2str(iph1->mode_cfg->split_include, CIDR);
-	} else {
-		splitlist = addrlist;
-		splitlist_cidr = addrlist;
-		addrlist[0] = '\0';
-	}
-
-	if (script_env_append(envp, envc, "SPLIT_INCLUDE", splitlist) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL, "Cannot set SPLIT_INCLUDE\n");
-		return -1;
-	}
-	if (script_env_append(envp, envc,
-	    "SPLIT_INCLUDE_CIDR", splitlist_cidr) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		     "Cannot set SPLIT_INCLUDE_CIDR\n");
-		return -1;
-	}
-	if (splitlist != addrlist)
-		racoon_free(splitlist);
-	if (splitlist_cidr != addrlist)
-		racoon_free(splitlist_cidr);
-
-	if (iph1->mode_cfg->flags & ISAKMP_CFG_GOT_SPLIT_LOCAL) {
-		splitlist =
-		    splitnet_list_2str(iph1->mode_cfg->split_local, NETMASK);
-		splitlist_cidr =
-		    splitnet_list_2str(iph1->mode_cfg->split_local, CIDR);
-	} else {
-		splitlist = addrlist;
-		splitlist_cidr = addrlist;
-		addrlist[0] = '\0';
-	}
-
-	if (script_env_append(envp, envc, "SPLIT_LOCAL", splitlist) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL, "Cannot set SPLIT_LOCAL\n");
-		return -1;
-	}
-	if (script_env_append(envp, envc,
-	    "SPLIT_LOCAL_CIDR", splitlist_cidr) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		     "Cannot set SPLIT_LOCAL_CIDR\n");
-		return -1;
-	}
-	if (splitlist != addrlist)
-		racoon_free(splitlist);
-	if (splitlist_cidr != addrlist)
-		racoon_free(splitlist_cidr);
-
-	return 0;
-}
-
-int
-isakmp_cfg_resize_pool(size)
-	int size;
-{
-	struct isakmp_cfg_port *new_pool;
-	size_t len;
-	int i;
-
-	if (size == isakmp_cfg_config.pool_size)
-		return 0;
-
-	plog(LLV_INFO, LOCATION, NULL,
-	    "Resize address pool from %zu to %d\n",
-	    isakmp_cfg_config.pool_size, size);
-
-	/* If a pool already exists, check if we can shrink it */
-	if ((isakmp_cfg_config.port_pool != NULL) &&
-	    (size < isakmp_cfg_config.pool_size)) {
-		for (i = isakmp_cfg_config.pool_size-1; i >= size; --i) {
-			if (isakmp_cfg_config.port_pool[i].used) {
-				plog(LLV_ERROR, LOCATION, NULL, 
-				    "resize pool from %zu to %d impossible "
-				    "port %d is in use\n", 
-				    isakmp_cfg_config.pool_size, size, i);
-				size = i;
-				break;
-			}	
-		}
-	}
-
-	len = size * sizeof(*isakmp_cfg_config.port_pool);
-	new_pool = racoon_realloc(isakmp_cfg_config.port_pool, len);
-	if (new_pool == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "resize pool from %zu to %d impossible: %s",
-		    isakmp_cfg_config.pool_size, size, strerror(errno));
-		return -1;
-	}
-
-	/* If size increase, intialize correctly the new records */
-	if (size > isakmp_cfg_config.pool_size) {
-		size_t unit;
-		size_t old_size;
-
-		unit =  sizeof(*isakmp_cfg_config.port_pool);
-		old_size = isakmp_cfg_config.pool_size;
-
-		bzero((char *)new_pool + (old_size * unit), 
-		    (size - old_size) * unit);
-	}
-
-	isakmp_cfg_config.port_pool = new_pool;
-	isakmp_cfg_config.pool_size = size;
-
-	return 0;
-}
-
-int
-isakmp_cfg_init(cold) 
-	int cold;
-{
-	int i;
-	int error;
-
-	isakmp_cfg_config.network4 = (in_addr_t)0x00000000;
-	isakmp_cfg_config.netmask4 = (in_addr_t)0x00000000;
-	for (i = 0; i < MAXNS; i++)
-		isakmp_cfg_config.dns4[i] = (in_addr_t)0x00000000;
-	isakmp_cfg_config.dns4_index = 0;
-	for (i = 0; i < MAXWINS; i++)
-		isakmp_cfg_config.nbns4[i] = (in_addr_t)0x00000000;
-	isakmp_cfg_config.nbns4_index = 0;
-	if (cold == ISAKMP_CFG_INIT_COLD)
-		isakmp_cfg_config.port_pool = NULL;
-	isakmp_cfg_config.authsource = ISAKMP_CFG_AUTH_SYSTEM;
-	isakmp_cfg_config.groupsource = ISAKMP_CFG_GROUP_SYSTEM;
-	if (cold == ISAKMP_CFG_INIT_COLD) {
-		if (isakmp_cfg_config.grouplist != NULL) {
-			for (i = 0; i < isakmp_cfg_config.groupcount; i++)
-				racoon_free(isakmp_cfg_config.grouplist[i]);
-			racoon_free(isakmp_cfg_config.grouplist);
-		}
-	}
-	isakmp_cfg_config.grouplist = NULL;
-	isakmp_cfg_config.groupcount = 0;
-	isakmp_cfg_config.confsource = ISAKMP_CFG_CONF_LOCAL;
-	isakmp_cfg_config.accounting = ISAKMP_CFG_ACCT_NONE;
-	if (cold == ISAKMP_CFG_INIT_COLD)
-		isakmp_cfg_config.pool_size = 0;
-	isakmp_cfg_config.auth_throttle = THROTTLE_PENALTY;
-	strlcpy(isakmp_cfg_config.default_domain, ISAKMP_CFG_DEFAULT_DOMAIN,
-	    MAXPATHLEN);
-	strlcpy(isakmp_cfg_config.motd, ISAKMP_CFG_MOTD, MAXPATHLEN);
-
-	if (cold != ISAKMP_CFG_INIT_COLD )
-		if (isakmp_cfg_config.splitnet_list != NULL)
-			splitnet_list_free(isakmp_cfg_config.splitnet_list,
-				&isakmp_cfg_config.splitnet_count);
-	isakmp_cfg_config.splitnet_list = NULL;
-	isakmp_cfg_config.splitnet_count = 0;
-	isakmp_cfg_config.splitnet_type = 0;
-
-	isakmp_cfg_config.pfs_group = 0;
-	isakmp_cfg_config.save_passwd = 0;
-
-	if (cold != ISAKMP_CFG_INIT_COLD )
-		if (isakmp_cfg_config.splitdns_list != NULL)
-			racoon_free(isakmp_cfg_config.splitdns_list);
-	isakmp_cfg_config.splitdns_list = NULL;
-	isakmp_cfg_config.splitdns_len = 0;
-
-#if 0
-	if (cold == ISAKMP_CFG_INIT_COLD) {
-		if ((error = isakmp_cfg_resize_pool(ISAKMP_CFG_MAX_CNX)) != 0)
-			return error;
-	}
-#endif
-
-	return 0;
-}
-
diff --git a/src/racoon/isakmp_cfg.h b/src/racoon/isakmp_cfg.h
deleted file mode 100644
index 253a17f..0000000
--- a/src/racoon/isakmp_cfg.h
+++ /dev/null
@@ -1,229 +0,0 @@
-/*	$NetBSD: isakmp_cfg.h,v 1.6 2006/09/09 16:22:09 manu Exp $	*/
-
-/*	$KAME$ */
-
-/*
- * Copyright (C) 2004 Emmanuel Dreyfus
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifdef HAVE_LIBPAM
-#include <security/pam_appl.h>
-#endif
-
-#ifdef ANDROID_PATCHED
-#include <arpa/inet.h>
-#ifndef MAXNS
-#define MAXNS 2
-#endif
-#endif
-
-/* 
- * XXX don't forget to update 
- * src/racoon/handler.c:exclude_cfg_addr()
- * if you add IPv6 capability
- */
-
-/* Attribute types */
-#define INTERNAL_IP4_ADDRESS        1
-#define INTERNAL_IP4_NETMASK        2
-#define INTERNAL_IP4_DNS            3
-#define INTERNAL_IP4_NBNS           4
-#define INTERNAL_ADDRESS_EXPIRY     5
-#define INTERNAL_IP4_DHCP           6
-#define APPLICATION_VERSION         7
-#define INTERNAL_IP6_ADDRESS        8
-#define INTERNAL_IP6_NETMASK        9
-#define INTERNAL_IP6_DNS           10
-#define INTERNAL_IP6_NBNS          11
-#define INTERNAL_IP6_DHCP          12
-#define INTERNAL_IP4_SUBNET        13
-#define SUPPORTED_ATTRIBUTES       14
-#define INTERNAL_IP6_SUBNET        15
-
-/* For APPLICATION_VERSION */
-#define ISAKMP_CFG_RACOON_VERSION "racoon / IPsec-tools"
-
-/* For the wins servers -- XXX find the value somewhere ? */
-#define MAXWINS 4
-
-/* 
- * Global configuration for ISAKMP mode confiration address allocation 
- * Read from the mode_cfg section of racoon.conf
- */
-struct isakmp_cfg_port {
-	char	used;
-#ifdef HAVE_LIBPAM
-	pam_handle_t *pam;
-#endif
-};
-
-struct isakmp_cfg_config {
-	in_addr_t		network4;
-	in_addr_t		netmask4;
-	in_addr_t		dns4[MAXNS];
-	int			dns4_index;
-	in_addr_t		nbns4[MAXWINS];
-	int			nbns4_index;
-	struct isakmp_cfg_port 	*port_pool;
-	int			authsource;
-	int			groupsource;
-	char			**grouplist;
-	int			groupcount;
-	int			confsource;
-	int			accounting;
-	size_t			pool_size;
-	int			auth_throttle;
-	/* XXX move this to a unity specific sub-structure */
-	char			default_domain[MAXPATHLEN + 1];
-	char			motd[MAXPATHLEN + 1];
-	struct unity_netentry	*splitnet_list;
-	int			splitnet_count;
-	int			splitnet_type;
-	char 			*splitdns_list;
-	int			splitdns_len;
-	int			pfs_group;
-	int			save_passwd;
-};
-
-/* For utmp updating */
-#define TERMSPEC	"vpn%d"
-
-/* For authsource */
-#define ISAKMP_CFG_AUTH_SYSTEM	0
-#define ISAKMP_CFG_AUTH_RADIUS	1
-#define ISAKMP_CFG_AUTH_PAM	2
-#define ISAKMP_CFG_AUTH_LDAP	4
-
-/* For groupsource */
-#define ISAKMP_CFG_GROUP_SYSTEM	0
-#define ISAKMP_CFG_GROUP_LDAP	1
-
-/* For confsource */
-#define ISAKMP_CFG_CONF_LOCAL	0
-#define ISAKMP_CFG_CONF_RADIUS	1
-#define ISAKMP_CFG_CONF_LDAP	2
-
-/* For accounting */
-#define ISAKMP_CFG_ACCT_NONE	0
-#define ISAKMP_CFG_ACCT_RADIUS	1
-#define ISAKMP_CFG_ACCT_PAM	2
-#define ISAKMP_CFG_ACCT_LDAP	3
-#define ISAKMP_CFG_ACCT_SYSTEM	4
-
-/* For pool_size */
-#define ISAKMP_CFG_MAX_CNX	255
-
-/* For motd */
-#define ISAKMP_CFG_MOTD	"/etc/motd"
-
-/* For default domain */
-#define ISAKMP_CFG_DEFAULT_DOMAIN ""
-
-extern struct isakmp_cfg_config isakmp_cfg_config;
-
-/*
- * ISAKMP mode config state 
- */
-#define LOGINLEN 31
-struct isakmp_cfg_state {
-	int flags;			/* See below */
-	unsigned int port;		/* address index */
-	char login[LOGINLEN + 1];	/* login */
-	struct in_addr addr4;		/* IPv4 address */
-	struct in_addr mask4;		/* IPv4 netmask */
-	struct in_addr dns4[MAXNS];	/* IPv4 DNS (when client only) */
-	int dns4_index;			/* Number of IPv4 DNS (client only) */
-	struct in_addr wins4[MAXWINS];	/* IPv4 WINS (when client only) */
-	int wins4_index;		/* Number of IPv4 WINS (client only) */
-	char default_domain[MAXPATHLEN + 1];	/* Default domain recieved */
-	struct unity_netentry 
-	    *split_include; 		/* UNITY_SPLIT_INCLUDE */
-	int include_count;		/* Number of SPLIT_INCLUDES */
-	struct unity_netentry 
-	    *split_local;		/* UNITY_LOCAL_LAN */
-	int local_count;		/* Number of SPLIT_LOCAL */
-	struct xauth_state xauth;	/* Xauth state, if revelant */		
-	struct isakmp_ivm *ivm;		/* XXX Use iph1's ivm? */
-	u_int32_t last_msgid;           /* Last message-ID */
-};
-
-/* flags */
-#define ISAKMP_CFG_VENDORID_XAUTH	0x01	/* Supports Xauth */
-#define ISAKMP_CFG_VENDORID_UNITY	0x02	/* Cisco Unity compliant */
-#define ISAKMP_CFG_PORT_ALLOCATED	0x04	/* Port allocated */
-#define ISAKMP_CFG_ADDR4_EXTERN		0x08	/* Address from external config  */
-#define ISAKMP_CFG_MASK4_EXTERN		0x10	/* Netmask from external config */
-#define ISAKMP_CFG_ADDR4_LOCAL		0x20	/* Address from local pool */
-#define ISAKMP_CFG_MASK4_LOCAL		0x40	/* Netmask from local pool */
-#define ISAKMP_CFG_GOT_ADDR4		0x80	/* Client got address */
-#define ISAKMP_CFG_GOT_MASK4		0x100	/* Client got mask */
-#define ISAKMP_CFG_GOT_DNS4		0x200	/* Client got DNS */
-#define ISAKMP_CFG_GOT_WINS4		0x400	/* Client got WINS */
-#define ISAKMP_CFG_DELETE_PH1		0x800	/* phase 1 should be deleted */
-#define ISAKMP_CFG_GOT_DEFAULT_DOMAIN	0x1000	/* Client got default domain */
-#define ISAKMP_CFG_GOT_SPLIT_INCLUDE	0x2000	/* Client got a split network config */
-#define ISAKMP_CFG_GOT_SPLIT_LOCAL	0x4000	/* Client got a split LAN config */
-
-struct isakmp_pl_attr;
-struct ph1handle;
-struct isakmp_ivm;
-void isakmp_cfg_r(struct ph1handle *, vchar_t *);
-int isakmp_cfg_attr_r(struct ph1handle *, u_int32_t, struct isakmp_pl_attr *);
-int isakmp_cfg_reply(struct ph1handle *, struct isakmp_pl_attr *);
-int isakmp_cfg_request(struct ph1handle *, struct isakmp_pl_attr *);
-int isakmp_cfg_set(struct ph1handle *, struct isakmp_pl_attr *);
-int isakmp_cfg_send(struct ph1handle *, vchar_t *, u_int32_t, int, int);
-struct isakmp_ivm *isakmp_cfg_newiv(struct ph1handle *, u_int32_t);
-void isakmp_cfg_rmstate(struct ph1handle *);
-struct isakmp_cfg_state *isakmp_cfg_mkstate(void);
-vchar_t *isakmp_cfg_copy(struct ph1handle *, struct isakmp_data *);
-vchar_t *isakmp_cfg_short(struct ph1handle *, struct isakmp_data *, int);
-vchar_t *isakmp_cfg_varlen(struct ph1handle *, struct isakmp_data *, char *, size_t);
-vchar_t *isakmp_cfg_string(struct ph1handle *, struct isakmp_data *, char *);
-int isakmp_cfg_getconfig(struct ph1handle *);
-int isakmp_cfg_setenv(struct ph1handle *, char ***, int *);
-
-int isakmp_cfg_resize_pool(int);
-int isakmp_cfg_getport(struct ph1handle *);
-int isakmp_cfg_putport(struct ph1handle *, unsigned int);
-int isakmp_cfg_init(int);
-#define ISAKMP_CFG_INIT_COLD	1
-#define ISAKMP_CFG_INIT_WARM	0
-
-#ifdef HAVE_LIBRADIUS
-struct rad_handle;
-extern struct rad_handle *radius_acct_state;
-int isakmp_cfg_radius_common(struct rad_handle *, int); 
-#endif
-
-#ifdef HAVE_LIBPAM
-int isakmp_cfg_accounting_pam(int, int);
-void cleanup_pam(int);
-#endif
-
-int isakmp_cfg_accounting_system(int, struct sockaddr *, char *, int);
diff --git a/src/racoon/isakmp_frag.c b/src/racoon/isakmp_frag.c
deleted file mode 100644
index 6fac6a2..0000000
--- a/src/racoon/isakmp_frag.c
+++ /dev/null
@@ -1,356 +0,0 @@
-/*	$NetBSD: isakmp_frag.c,v 1.4.6.1 2009/04/22 11:25:35 tteras Exp $	*/
-
-/* Id: isakmp_frag.c,v 1.4 2004/11/13 17:31:36 manubsd Exp */
-
-/*
- * Copyright (C) 2004 Emmanuel Dreyfus
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/socket.h>
-#include <sys/queue.h>
-
-#include <netinet/in.h>
-#include <arpa/inet.h>
-
-#include <openssl/md5.h> 
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <fcntl.h>
-#include <string.h>
-#include <errno.h>
-#if TIME_WITH_SYS_TIME
-# include <sys/time.h>
-# include <time.h>
-#else
-# if HAVE_SYS_TIME_H
-#  include <sys/time.h>
-# else
-#  include <time.h>
-# endif
-#endif
-#include <netdb.h>
-#ifdef HAVE_UNISTD_H
-#include <unistd.h>
-#endif
-#include <ctype.h>
-
-#include "var.h"
-#include "misc.h"
-#include "vmbuf.h"
-#include "plog.h"
-#include "sockmisc.h"
-#include "schedule.h"
-#include "debug.h"
-
-#include "isakmp_var.h"
-#include "isakmp.h"
-#include "handler.h"
-#include "isakmp_frag.h"
-#include "strnames.h"
-
-int
-isakmp_sendfrags(iph1, buf) 
-	struct ph1handle *iph1;
-	vchar_t *buf;
-{
-	struct isakmp *hdr;
-	struct isakmp_frag *fraghdr;
-	caddr_t data;
-	caddr_t sdata;
-	size_t datalen;
-	size_t max_datalen;
-	size_t fraglen;
-	vchar_t *frag;
-	unsigned int trailer;
-	unsigned int fragnum = 0;
-	size_t len;
-	int etype;
-
-	/*
-	 * Catch the exchange type for later: the fragments and the
-	 * fragmented packet must have the same exchange type.
-	 */
-	hdr = (struct isakmp *)buf->v;
-	etype = hdr->etype;
-
-	/*
-	 * We want to send a a packet smaller than ISAKMP_FRAG_MAXLEN
-	 * First compute the maximum data length that will fit in it
-	 */
-	max_datalen = ISAKMP_FRAG_MAXLEN - 
-	    (sizeof(*hdr) + sizeof(*fraghdr) + sizeof(trailer));
-
-	sdata = buf->v;
-	len = buf->l;
-
-	while (len > 0) {
-		fragnum++;
-
-		if (len > max_datalen)
-			datalen = max_datalen;
-		else
-			datalen = len;
-
-		fraglen = sizeof(*hdr) 
-			+ sizeof(*fraghdr) 
-			+ datalen;
-
-		if ((frag = vmalloc(fraglen)) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "Cannot allocate memory\n");
-			return -1;
-		}
-
-		set_isakmp_header1(frag, iph1, ISAKMP_NPTYPE_FRAG);
-		hdr = (struct isakmp *)frag->v;
-		hdr->etype = etype;
-
-		fraghdr = (struct isakmp_frag *)(hdr + 1);
-		fraghdr->unknown0 = htons(0);
-		fraghdr->len = htons(fraglen - sizeof(*hdr));
-		fraghdr->unknown1 = htons(1);
-		fraghdr->index = fragnum;
-		if (len == datalen)
-			fraghdr->flags = ISAKMP_FRAG_LAST;
-		else
-			fraghdr->flags = 0;
-
-		data = (caddr_t)(fraghdr + 1);
-		memcpy(data, sdata, datalen);
-
-		if (isakmp_send(iph1, frag) < 0) {
-			plog(LLV_ERROR, LOCATION, NULL, "isakmp_send failed\n");
-			return -1;
-		}
-
-		vfree(frag);
-
-		len -= datalen;
-		sdata += datalen;
-	}
-		
-	return fragnum;
-}
-
-unsigned int 
-vendorid_frag_cap(gen)
-	struct isakmp_gen *gen;
-{
-	int *hp;
-
-	hp = (int *)(gen + 1);
-
-	return ntohl(hp[MD5_DIGEST_LENGTH / sizeof(*hp)]);
-}
-
-int 
-isakmp_frag_extract(iph1, msg)
-	struct ph1handle *iph1;
-	vchar_t *msg;
-{
-	struct isakmp *isakmp;
-	struct isakmp_frag *frag;
-	struct isakmp_frag_item *item;
-	vchar_t *buf;
-	size_t len;
-	int last_frag = 0;
-	char *data;
-	int i;
-
-	if (msg->l < sizeof(*isakmp) + sizeof(*frag)) {
-		plog(LLV_ERROR, LOCATION, NULL, "Message too short\n");
-		return -1;
-	}
-
-	isakmp = (struct isakmp *)msg->v;
-	frag = (struct isakmp_frag *)(isakmp + 1);
-
-	/* 
-	 * frag->len is the frag payload data plus the frag payload header,
-	 * whose size is sizeof(*frag) 
-	 */
-	if (msg->l < sizeof(*isakmp) + ntohs(frag->len) ||
-	    ntohs(frag->len) < sizeof(*frag) + 1) {
-		plog(LLV_ERROR, LOCATION, NULL, "Fragment too short\n");
-		return -1;
-	}
-
-	if ((buf = vmalloc(ntohs(frag->len) - sizeof(*frag))) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "Cannot allocate memory\n");
-		return -1;
-	}
-
-	if ((item = racoon_malloc(sizeof(*item))) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "Cannot allocate memory\n");
-		vfree(buf);
-		return -1;
-	}
-
-	data = (char *)(frag + 1);
-	memcpy(buf->v, data, buf->l);
-
-	item->frag_num = frag->index;
-	item->frag_last = (frag->flags & ISAKMP_FRAG_LAST);
-	item->frag_next = NULL;
-	item->frag_packet = buf;
-
-	/* Look for the last frag while inserting the new item in the chain */
-	if (item->frag_last)
-		last_frag = item->frag_num;
-
-	if (iph1->frag_chain == NULL) {
-		iph1->frag_chain = item;
-	} else {
-		struct isakmp_frag_item *current;
-
-		current = iph1->frag_chain;
-		while (current->frag_next) {
-			if (current->frag_last)
-				last_frag = item->frag_num;
-			current = current->frag_next;
-		}
-		current->frag_next = item;
-	}
-
-	/* If we saw the last frag, check if the chain is complete */
-	if (last_frag != 0) {
-		for (i = 1; i <= last_frag; i++) {
-			item = iph1->frag_chain;
-			do {
-				if (item->frag_num == i)
-					break;
-				item = item->frag_next;
-			} while (item != NULL);
-
-			if (item == NULL) /* Not found */
-				break;
-		}
-
-		if (item != NULL) /* It is complete */
-			return 1;
-	}
-		
-	return 0;
-}
-
-vchar_t *
-isakmp_frag_reassembly(iph1)
-	struct ph1handle *iph1;
-{
-	struct isakmp_frag_item *item;
-	size_t len = 0;
-	vchar_t *buf = NULL;
-	int frag_count = 0;
-	int i;
-	char *data;
-
-	if ((item = iph1->frag_chain) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "No fragment to reassemble\n");
-		goto out;
-	}
-
-	do {
-		frag_count++;
-		len += item->frag_packet->l;
-		item = item->frag_next;
-	} while (item != NULL);
-	
-	if ((buf = vmalloc(len)) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "Cannot allocate memory\n");
-		goto out;
-	}
-	data = buf->v;
-
-	for (i = 1; i <= frag_count; i++) {
-		item = iph1->frag_chain;
-		do {
-			if (item->frag_num == i)
-				break;
-			item = item->frag_next;
-		} while (item != NULL);
-
-		if (item == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "Missing fragment #%d\n", i);
-			vfree(buf);
-			buf = NULL;
-			goto out;
-		}
-		memcpy(data, item->frag_packet->v, item->frag_packet->l);
-		data += item->frag_packet->l;
-	}
-
-out:
-	item = iph1->frag_chain;		
-	do {
-		struct isakmp_frag_item *next_item;
-
-		next_item = item->frag_next;
-
-		vfree(item->frag_packet);
-		racoon_free(item);
-
-		item = next_item;
-	} while (item != NULL);
-
-	iph1->frag_chain = NULL;
-
-	return buf;
-}
-
-vchar_t *
-isakmp_frag_addcap(buf, cap)
-	vchar_t *buf;
-	int cap;
-{
-	int *capp;
-	size_t len;
-
-	/* If the capability has not been added, add room now */
-	len = buf->l;
-	if (len == MD5_DIGEST_LENGTH) {
-		if ((buf = vrealloc(buf, len + sizeof(cap))) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "Cannot allocate memory\n");
-			return NULL;
-		}
-		capp = (int *)(buf->v + len);
-		*capp = htonl(0);
-	}
-
-	capp = (int *)(buf->v + MD5_DIGEST_LENGTH);
-	*capp |= htonl(cap);
-
-	return buf;
-}
-
diff --git a/src/racoon/isakmp_frag.h b/src/racoon/isakmp_frag.h
deleted file mode 100644
index f2d4c33..0000000
--- a/src/racoon/isakmp_frag.h
+++ /dev/null
@@ -1,58 +0,0 @@
-/*	$NetBSD: isakmp_frag.h,v 1.5 2006/09/18 20:32:40 manu Exp $	*/
-
-/*	Id: isakmp_frag.h,v 1.3 2005/04/09 16:25:24 manubsd Exp */
-
-/*
- * Copyright (C) 2004 Emmanuel Dreyfus 
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-/* These are the values from parsing "remote {}"
-   block of the config file. */
-#define ISAKMP_FRAG_OFF		FLASE   /* = 0 */
-#define ISAKMP_FRAG_ON		TRUE    /* = 1 */
-#define ISAKMP_FRAG_FORCE	2
-
-/* IKE fragmentation capabilities */
-#define VENDORID_FRAG_IDENT 	0x80000000
-#define VENDORID_FRAG_BASE 	0x40000000
-#define VENDORID_FRAG_AGG 	0x80000000
-
-#define ISAKMP_FRAG_MAXLEN 552
-
-struct isakmp_frag_item {
-	int	frag_num;
-	int	frag_last;
-	struct isakmp_frag_item *frag_next;
-	vchar_t *frag_packet;
-};
-
-int isakmp_sendfrags(struct ph1handle *, vchar_t *);
-unsigned int vendorid_frag_cap(struct isakmp_gen *);
-int isakmp_frag_extract(struct ph1handle *, vchar_t *);
-vchar_t *isakmp_frag_reassembly(struct ph1handle *);
-vchar_t *isakmp_frag_addcap(vchar_t *, int);
diff --git a/src/racoon/isakmp_ident.c b/src/racoon/isakmp_ident.c
deleted file mode 100644
index c3f71b3..0000000
--- a/src/racoon/isakmp_ident.c
+++ /dev/null
@@ -1,1911 +0,0 @@
-/*	$NetBSD: isakmp_ident.c,v 1.6 2006/10/02 21:41:59 manu Exp $	*/
-
-/* Id: isakmp_ident.c,v 1.21 2006/04/06 16:46:08 manubsd Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-/* Identity Protecion Exchange (Main Mode) */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-#if TIME_WITH_SYS_TIME
-# include <sys/time.h>
-# include <time.h>
-#else
-# if HAVE_SYS_TIME_H
-#  include <sys/time.h>
-# else
-#  include <time.h>
-# endif
-#endif
-
-#include "var.h"
-#include "misc.h"
-#include "vmbuf.h"
-#include "plog.h"
-#include "sockmisc.h"
-#include "schedule.h"
-#include "debug.h"
-
-#include "localconf.h"
-#include "remoteconf.h"
-#include "isakmp_var.h"
-#include "isakmp.h"
-#include "evt.h"
-#include "oakley.h"
-#include "handler.h"
-#include "ipsec_doi.h"
-#include "crypto_openssl.h"
-#include "pfkey.h"
-#include "isakmp_ident.h"
-#include "isakmp_inf.h"
-#include "vendorid.h"
-
-#ifdef ENABLE_NATT
-#include "nattraversal.h"
-#endif
-#ifdef HAVE_GSSAPI
-#include "gssapi.h"
-#endif
-#ifdef ENABLE_HYBRID
-#include <resolv.h>
-#include "isakmp_xauth.h"
-#include "isakmp_cfg.h"
-#endif
-#ifdef ENABLE_FRAG 
-#include "isakmp_frag.h"
-#endif
-
-static vchar_t *ident_ir2mx __P((struct ph1handle *));
-static vchar_t *ident_ir3mx __P((struct ph1handle *));
-
-/* %%%
- * begin Identity Protection Mode as initiator.
- */
-/*
- * send to responder
- * 	psk: HDR, SA
- * 	sig: HDR, SA
- * 	rsa: HDR, SA
- * 	rev: HDR, SA
- */
-int
-ident_i1send(iph1, msg)
-	struct ph1handle *iph1;
-	vchar_t *msg; /* must be null */
-{
-	struct payload_list *plist = NULL;
-	int error = -1;
-#ifdef ENABLE_NATT
-	vchar_t *vid_natt[MAX_NATT_VID_COUNT] = { NULL };
-	int i;
-#endif
-#ifdef ENABLE_HYBRID  
-	vchar_t *vid_xauth = NULL;
-	vchar_t *vid_unity = NULL;
-#endif
-#ifdef ENABLE_FRAG 
-	vchar_t *vid_frag = NULL;
-#endif 
-#ifdef ENABLE_DPD
-	vchar_t *vid_dpd = NULL;
-#endif
-	/* validity check */
-	if (msg != NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"msg has to be NULL in this function.\n");
-		goto end;
-	}
-	if (iph1->status != PHASE1ST_START) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph1->status);
-		goto end;
-	}
-
-	/* create isakmp index */
-	memset(&iph1->index, 0, sizeof(iph1->index));
-	isakmp_newcookie((caddr_t)&iph1->index, iph1->remote, iph1->local);
-
-	/* create SA payload for my proposal */
-	iph1->sa = ipsecdoi_setph1proposal(iph1->rmconf->proposal);
-	if (iph1->sa == NULL)
-		goto end;
-
-	/* set SA payload to propose */
-	plist = isakmp_plist_append(plist, iph1->sa, ISAKMP_NPTYPE_SA);
-
-#ifdef ENABLE_NATT
-	/* set VID payload for NAT-T if NAT-T support allowed in the config file */
-	if (iph1->rmconf->nat_traversal) 
-		plist = isakmp_plist_append_natt_vids(plist, vid_natt);
-#endif
-#ifdef ENABLE_HYBRID
-	/* Do we need Xauth VID? */
-	switch (RMAUTHMETHOD(iph1)) {
-	case FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_I:
-		if ((vid_xauth = set_vendorid(VENDORID_XAUTH)) == NULL)
-			plog(LLV_ERROR, LOCATION, NULL,
-			     "Xauth vendor ID generation failed\n");
-		else
-			plist = isakmp_plist_append(plist,
-			    vid_xauth, ISAKMP_NPTYPE_VID);
-			
-		if ((vid_unity = set_vendorid(VENDORID_UNITY)) == NULL)
-			plog(LLV_ERROR, LOCATION, NULL,
-			     "Unity vendor ID generation failed\n");
-		else
-                	plist = isakmp_plist_append(plist,
-			    vid_unity, ISAKMP_NPTYPE_VID);
-		break;
-	default:
-		break;
-	}
-#endif
-#ifdef ENABLE_FRAG
-	if (iph1->rmconf->ike_frag) {
-		if ((vid_frag = set_vendorid(VENDORID_FRAG)) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "Frag vendorID construction failed\n");
-		} else {
-			vid_frag = isakmp_frag_addcap(vid_frag,
-			    VENDORID_FRAG_IDENT);
-			plist = isakmp_plist_append(plist, 
-			    vid_frag, ISAKMP_NPTYPE_VID);
-		}
-	}
-#endif
-#ifdef ENABLE_DPD
-	if(iph1->rmconf->dpd){
-		vid_dpd = set_vendorid(VENDORID_DPD);
-		if (vid_dpd != NULL)
-			plist = isakmp_plist_append(plist, vid_dpd,
-			    ISAKMP_NPTYPE_VID);
-	}
-#endif
-
-	iph1->sendbuf = isakmp_plist_set_all (&plist, iph1);
-
-#ifdef HAVE_PRINT_ISAKMP_C
-	isakmp_printpacket(iph1->sendbuf, iph1->local, iph1->remote, 0);
-#endif
-
-	/* send the packet, add to the schedule to resend */
-	iph1->retry_counter = iph1->rmconf->retry_counter;
-	if (isakmp_ph1resend(iph1) == -1)
-		goto end;
-
-	iph1->status = PHASE1ST_MSG1SENT;
-
-	error = 0;
-
-end:
-#ifdef ENABLE_FRAG
-	if (vid_frag) 
-		vfree(vid_frag);
-#endif  
-#ifdef ENABLE_NATT
-	for (i = 0; i < MAX_NATT_VID_COUNT && vid_natt[i] != NULL; i++)
-		vfree(vid_natt[i]);
-#endif
-#ifdef ENABLE_HYBRID
-	if (vid_xauth != NULL)
-		vfree(vid_xauth);
-	if (vid_unity != NULL)
-		vfree(vid_unity);
-#endif
-#ifdef ENABLE_DPD
-	if (vid_dpd != NULL)
-		vfree(vid_dpd);
-#endif
-
-	return error;
-}
-
-/*
- * receive from responder
- * 	psk: HDR, SA
- * 	sig: HDR, SA
- * 	rsa: HDR, SA
- * 	rev: HDR, SA
- */
-int
-ident_i2recv(iph1, msg)
-	struct ph1handle *iph1;
-	vchar_t *msg;
-{
-	vchar_t *pbuf = NULL;
-	struct isakmp_parse_t *pa;
-	vchar_t *satmp = NULL;
-	int error = -1;
-	int vid_numeric;
-
-	/* validity check */
-	if (iph1->status != PHASE1ST_MSG1SENT) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph1->status);
-		goto end;
-	}
-
-	/* validate the type of next payload */
-	/*
-	 * NOTE: RedCreek(as responder) attaches N[responder-lifetime] here,
-	 *	if proposal-lifetime > lifetime-redcreek-wants.
-	 *	(see doi-08 4.5.4)
-	 *	=> According to the seciton 4.6.3 in RFC 2407, This is illegal.
-	 * NOTE: we do not really care about ordering of VID and N.
-	 *	does it matters?
-	 * NOTE: even if there's multiple VID/N, we'll ignore them.
-	 */
-	pbuf = isakmp_parse(msg);
-	if (pbuf == NULL)
-		goto end;
-	pa = (struct isakmp_parse_t *)pbuf->v;
-
-	/* SA payload is fixed postion */
-	if (pa->type != ISAKMP_NPTYPE_SA) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"received invalid next payload type %d, "
-			"expecting %d.\n",
-			pa->type, ISAKMP_NPTYPE_SA);
-		goto end;
-	}
-	if (isakmp_p2ph(&satmp, pa->ptr) < 0)
-		goto end;
-	pa++;
-
-	for (/*nothing*/;
-	     pa->type != ISAKMP_NPTYPE_NONE;
-	     pa++) {
-
-		switch (pa->type) {
-		case ISAKMP_NPTYPE_VID:
-			handle_vendorid(iph1, pa->ptr);
-			break;
-		default:
-			/* don't send information, see ident_r1recv() */
-			plog(LLV_ERROR, LOCATION, iph1->remote,
-				"ignore the packet, "
-				"received unexpecting payload type %d.\n",
-				pa->type);
-			goto end;
-		}
-	}
-
-#ifdef ENABLE_NATT
-	if (NATT_AVAILABLE(iph1))
-		plog(LLV_INFO, LOCATION, iph1->remote,
-		     "Selected NAT-T version: %s\n",
-		     vid_string_by_id(iph1->natt_options->version));
-#endif
-
-	/* check SA payload and set approval SA for use */
-	if (ipsecdoi_checkph1proposal(satmp, iph1) < 0) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"failed to get valid proposal.\n");
-		/* XXX send information */
-		goto end;
-	}
-	VPTRINIT(iph1->sa_ret);
-
-	iph1->status = PHASE1ST_MSG2RECEIVED;
-
-	error = 0;
-
-end:
-	if (pbuf)
-		vfree(pbuf);
-	if (satmp)
-		vfree(satmp);
-	return error;
-}
-
-/*
- * send to responder
- * 	psk: HDR, KE, Ni
- * 	sig: HDR, KE, Ni
- *   gssapi: HDR, KE, Ni, GSSi
- * 	rsa: HDR, KE, [ HASH(1), ] <IDi1_b>PubKey_r, <Ni_b>PubKey_r
- * 	rev: HDR, [ HASH(1), ] <Ni_b>Pubkey_r, <KE_b>Ke_i,
- * 	          <IDi1_b>Ke_i, [<<Cert-I_b>Ke_i]
- */
-int
-ident_i2send(iph1, msg)
-	struct ph1handle *iph1;
-	vchar_t *msg;
-{
-	int error = -1;
-
-	/* validity check */
-	if (iph1->status != PHASE1ST_MSG2RECEIVED) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph1->status);
-		goto end;
-	}
-
-	/* fix isakmp index */
-	memcpy(&iph1->index.r_ck, &((struct isakmp *)msg->v)->r_ck,
-		sizeof(cookie_t));
-
-	/* generate DH public value */
-	if (oakley_dh_generate(iph1->approval->dhgrp,
-				&iph1->dhpub, &iph1->dhpriv) < 0)
-		goto end;
-
-	/* generate NONCE value */
-	iph1->nonce = eay_set_random(iph1->rmconf->nonce_size);
-	if (iph1->nonce == NULL)
-		goto end;
-
-#ifdef HAVE_GSSAPI
-	if (AUTHMETHOD(iph1) == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB &&
-	    gssapi_get_itoken(iph1, NULL) < 0)
-		goto end;
-#endif
-
-	/* create buffer to send isakmp payload */
-	iph1->sendbuf = ident_ir2mx(iph1);
-	if (iph1->sendbuf == NULL)
-		goto end;
-
-#ifdef HAVE_PRINT_ISAKMP_C
-	isakmp_printpacket(iph1->sendbuf, iph1->local, iph1->remote, 0);
-#endif
-
-	/* send the packet, add to the schedule to resend */
-	iph1->retry_counter = iph1->rmconf->retry_counter;
-	if (isakmp_ph1resend(iph1) == -1)
-		goto end;
-
-	/* the sending message is added to the received-list. */
-	if (add_recvdpkt(iph1->remote, iph1->local, iph1->sendbuf, msg) == -1) {
-		plog(LLV_ERROR , LOCATION, NULL,
-			"failed to add a response packet to the tree.\n");
-		goto end;
-	}
-
-	iph1->status = PHASE1ST_MSG2SENT;
-
-	error = 0;
-
-end:
-	return error;
-}
-
-/*
- * receive from responder
- * 	psk: HDR, KE, Nr
- * 	sig: HDR, KE, Nr [, CR ]
- *   gssapi: HDR, KE, Nr, GSSr
- * 	rsa: HDR, KE, <IDr1_b>PubKey_i, <Nr_b>PubKey_i
- * 	rev: HDR, <Nr_b>PubKey_i, <KE_b>Ke_r, <IDr1_b>Ke_r,
- */
-int
-ident_i3recv(iph1, msg)
-	struct ph1handle *iph1;
-	vchar_t *msg;
-{
-	vchar_t *pbuf = NULL;
-	struct isakmp_parse_t *pa;
-	int error = -1;
-#ifdef HAVE_GSSAPI
-	vchar_t *gsstoken = NULL;
-#endif
-#ifdef ENABLE_NATT
-	vchar_t	*natd_received;
-	int natd_seq = 0, natd_verified;
-#endif
-
-	/* validity check */
-	if (iph1->status != PHASE1ST_MSG2SENT) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph1->status);
-		goto end;
-	}
-
-	/* validate the type of next payload */
-	pbuf = isakmp_parse(msg);
-	if (pbuf == NULL)
-		goto end;
-
-	for (pa = (struct isakmp_parse_t *)pbuf->v;
-	     pa->type != ISAKMP_NPTYPE_NONE;
-	     pa++) {
-
-		switch (pa->type) {
-		case ISAKMP_NPTYPE_KE:
-			if (isakmp_p2ph(&iph1->dhpub_p, pa->ptr) < 0)
-				goto end;
-			break;
-		case ISAKMP_NPTYPE_NONCE:
-			if (isakmp_p2ph(&iph1->nonce_p, pa->ptr) < 0)
-				goto end;
-			break;
-		case ISAKMP_NPTYPE_VID:
-			handle_vendorid(iph1, pa->ptr);
-			break;
-		case ISAKMP_NPTYPE_CR:
-			if (oakley_savecr(iph1, pa->ptr) < 0)
-				goto end;
-			break;
-#ifdef HAVE_GSSAPI
-		case ISAKMP_NPTYPE_GSS:
-			if (isakmp_p2ph(&gsstoken, pa->ptr) < 0)
-				goto end;
-			gssapi_save_received_token(iph1, gsstoken);
-			break;
-#endif
-
-#ifdef ENABLE_NATT
-		case ISAKMP_NPTYPE_NATD_DRAFT:
-		case ISAKMP_NPTYPE_NATD_RFC:
-			if (NATT_AVAILABLE(iph1) && iph1->natt_options != NULL &&
-			    pa->type == iph1->natt_options->payload_nat_d) {
-				natd_received = NULL;
-				if (isakmp_p2ph (&natd_received, pa->ptr) < 0)
-					goto end;
-                        
-				/* set both bits first so that we can clear them
-				   upon verifying hashes */
-				if (natd_seq == 0)
-					iph1->natt_flags |= NAT_DETECTED;
-                        
-				/* this function will clear appropriate bits bits 
-				   from iph1->natt_flags */
-				natd_verified = natt_compare_addr_hash (iph1,
-					natd_received, natd_seq++);
-                        
-				plog (LLV_INFO, LOCATION, NULL, "NAT-D payload #%d %s\n",
-					natd_seq - 1,
-					natd_verified ? "verified" : "doesn't match");
-                        
-				vfree (natd_received);
-				break;
-			}
-			/* passthrough to default... */
-#endif
-
-		default:
-			/* don't send information, see ident_r1recv() */
-			plog(LLV_ERROR, LOCATION, iph1->remote,
-				"ignore the packet, "
-				"received unexpecting payload type %d.\n",
-				pa->type);
-			goto end;
-		}
-	}
-
-#ifdef ENABLE_NATT
-	if (NATT_AVAILABLE(iph1)) {
-		plog (LLV_INFO, LOCATION, NULL, "NAT %s %s%s\n",
-		      iph1->natt_flags & NAT_DETECTED ? 
-		      		"detected:" : "not detected",
-		      iph1->natt_flags & NAT_DETECTED_ME ? "ME " : "",
-		      iph1->natt_flags & NAT_DETECTED_PEER ? "PEER" : "");
-		if (iph1->natt_flags & NAT_DETECTED)
-			natt_float_ports (iph1);
-	}
-#endif
-
-	/* payload existency check */
-	if (iph1->dhpub_p == NULL || iph1->nonce_p == NULL) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"few isakmp message received.\n");
-		goto end;
-	}
-
-	if (oakley_checkcr(iph1) < 0) {
-		/* Ignore this error in order to be interoperability. */
-		;
-	}
-
-	iph1->status = PHASE1ST_MSG3RECEIVED;
-
-	error = 0;
-
-end:
-#ifdef HAVE_GSSAPI
-	if (gsstoken)
-		vfree(gsstoken);
-#endif
-	if (pbuf)
-		vfree(pbuf);
-	if (error) {
-		VPTRINIT(iph1->dhpub_p);
-		VPTRINIT(iph1->nonce_p);
-		VPTRINIT(iph1->id_p);
-		oakley_delcert(iph1->cr_p);
-		iph1->cr_p = NULL;
-	}
-
-	return error;
-}
-
-/*
- * send to responder
- * 	psk: HDR*, IDi1, HASH_I
- * 	sig: HDR*, IDi1, [ CR, ] [ CERT, ] SIG_I
- *   gssapi: HDR*, IDi1, < Gssi(n) | HASH_I >
- * 	rsa: HDR*, HASH_I
- * 	rev: HDR*, HASH_I
- */
-int
-ident_i3send(iph1, msg0)
-	struct ph1handle *iph1;
-	vchar_t *msg0;
-{
-	int error = -1;
-	int dohash = 1;
-#ifdef HAVE_GSSAPI
-	int len;
-#endif
-
-	/* validity check */
-	if (iph1->status != PHASE1ST_MSG3RECEIVED) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph1->status);
-		goto end;
-	}
-
-	/* compute sharing secret of DH */
-	if (oakley_dh_compute(iph1->approval->dhgrp, iph1->dhpub,
-				iph1->dhpriv, iph1->dhpub_p, &iph1->dhgxy) < 0)
-		goto end;
-
-	/* generate SKEYIDs & IV & final cipher key */
-	if (oakley_skeyid(iph1) < 0)
-		goto end;
-	if (oakley_skeyid_dae(iph1) < 0)
-		goto end;
-	if (oakley_compute_enckey(iph1) < 0)
-		goto end;
-	if (oakley_newiv(iph1) < 0)
-		goto end;
-
-	/* make ID payload into isakmp status */
-	if (ipsecdoi_setid1(iph1) < 0)
-		goto end;
-
-#ifdef HAVE_GSSAPI
-	if (AUTHMETHOD(iph1) == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB &&
-	    gssapi_more_tokens(iph1)) {
-		plog(LLV_DEBUG, LOCATION, NULL, "calling get_itoken\n");
-		if (gssapi_get_itoken(iph1, &len) < 0)
-			goto end;
-		if (len != 0)
-			dohash = 0;
-	}
-#endif
-
-	/* generate HASH to send */
-	if (dohash) {
-		iph1->hash = oakley_ph1hash_common(iph1, GENERATE);
-		if (iph1->hash == NULL)
-			goto end;
-	} else
-		iph1->hash = NULL;
-
-	/* set encryption flag */
-	iph1->flags |= ISAKMP_FLAG_E;
-
-	/* create HDR;ID;HASH payload */
-	iph1->sendbuf = ident_ir3mx(iph1);
-	if (iph1->sendbuf == NULL)
-		goto end;
-
-	/* send the packet, add to the schedule to resend */
-	iph1->retry_counter = iph1->rmconf->retry_counter;
-	if (isakmp_ph1resend(iph1) == -1)
-		goto end;
-
-	/* the sending message is added to the received-list. */
-	if (add_recvdpkt(iph1->remote, iph1->local, iph1->sendbuf, msg0) == -1) {
-		plog(LLV_ERROR , LOCATION, NULL,
-			"failed to add a response packet to the tree.\n");
-		goto end;
-	}
-
-	/* see handler.h about IV synchronization. */
-	memcpy(iph1->ivm->ive->v, iph1->ivm->iv->v, iph1->ivm->iv->l);
-
-	iph1->status = PHASE1ST_MSG3SENT;
-
-	error = 0;
-
-end:
-	return error;
-}
-
-/*
- * receive from responder
- * 	psk: HDR*, IDr1, HASH_R
- * 	sig: HDR*, IDr1, [ CERT, ] SIG_R
- *   gssapi: HDR*, IDr1, < GSSr(n) | HASH_R >
- * 	rsa: HDR*, HASH_R
- * 	rev: HDR*, HASH_R
- */
-int
-ident_i4recv(iph1, msg0)
-	struct ph1handle *iph1;
-	vchar_t *msg0;
-{
-	vchar_t *pbuf = NULL;
-	struct isakmp_parse_t *pa;
-	vchar_t *msg = NULL;
-	int error = -1;
-	int type;
-#ifdef HAVE_GSSAPI
-	vchar_t *gsstoken = NULL;
-#endif
-
-	/* validity check */
-	if (iph1->status != PHASE1ST_MSG3SENT) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph1->status);
-		goto end;
-	}
-
-	/* decrypting */
-	if (!ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E)) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"ignore the packet, "
-			"expecting the packet encrypted.\n");
-		goto end;
-	}
-	msg = oakley_do_decrypt(iph1, msg0, iph1->ivm->iv, iph1->ivm->ive);
-	if (msg == NULL)
-		goto end;
-
-	/* validate the type of next payload */
-	pbuf = isakmp_parse(msg);
-	if (pbuf == NULL)
-		goto end;
-
-	iph1->pl_hash = NULL;
-
-	for (pa = (struct isakmp_parse_t *)pbuf->v;
-	     pa->type != ISAKMP_NPTYPE_NONE;
-	     pa++) {
-
-		switch (pa->type) {
-		case ISAKMP_NPTYPE_ID:
-			if (isakmp_p2ph(&iph1->id_p, pa->ptr) < 0)
-				goto end;
-			break;
-		case ISAKMP_NPTYPE_HASH:
-			iph1->pl_hash = (struct isakmp_pl_hash *)pa->ptr;
-			break;
-		case ISAKMP_NPTYPE_CERT:
-			if (oakley_savecert(iph1, pa->ptr) < 0)
-				goto end;
-			break;
-		case ISAKMP_NPTYPE_SIG:
-			if (isakmp_p2ph(&iph1->sig_p, pa->ptr) < 0)
-				goto end;
-			break;
-#ifdef HAVE_GSSAPI
-		case ISAKMP_NPTYPE_GSS:
-			if (isakmp_p2ph(&gsstoken, pa->ptr) < 0)
-				goto end;
-			gssapi_save_received_token(iph1, gsstoken);
-			break;
-#endif
-		case ISAKMP_NPTYPE_VID:
-			handle_vendorid(iph1, pa->ptr);
-			break;
-		case ISAKMP_NPTYPE_N:
-			isakmp_check_notify(pa->ptr, iph1);
-			break;
-		default:
-			/* don't send information, see ident_r1recv() */
-			plog(LLV_ERROR, LOCATION, iph1->remote,
-				"ignore the packet, "
-				"received unexpecting payload type %d.\n",
-				pa->type);
-			goto end;
-		}
-	}
-
-	/* payload existency check */
-
-	/* verify identifier */
-	if (ipsecdoi_checkid1(iph1) != 0) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"invalid ID payload.\n");
-		goto end;
-	}
-
-	/* validate authentication value */
-#ifdef HAVE_GSSAPI
-	if (gsstoken == NULL) {
-#endif
-		type = oakley_validate_auth(iph1);
-		if (type != 0) {
-			if (type == -1) {
-				/* msg printed inner oakley_validate_auth() */
-				goto end;
-			}
-			EVT_PUSH(iph1->local, iph1->remote, 
-			    EVTT_PEERPH1AUTH_FAILED, NULL);
-			isakmp_info_send_n1(iph1, type, NULL);
-			goto end;
-		}
-#ifdef HAVE_GSSAPI
-	}
-#endif
-
-	/*
-	 * XXX: Should we do compare two addresses, ph1handle's and ID
-	 * payload's.
-	 */
-
-	plog(LLV_DEBUG, LOCATION, iph1->remote, "peer's ID:");
-	plogdump(LLV_DEBUG, iph1->id_p->v, iph1->id_p->l);
-
-	/* see handler.h about IV synchronization. */
-	memcpy(iph1->ivm->iv->v, iph1->ivm->ive->v, iph1->ivm->ive->l);
-
-	/*
-	 * If we got a GSS token, we need to this roundtrip again.
-	 */
-#ifdef HAVE_GSSAPI
-	iph1->status = gsstoken != 0 ? PHASE1ST_MSG3RECEIVED : 
-	    PHASE1ST_MSG4RECEIVED;
-#else
-	iph1->status = PHASE1ST_MSG4RECEIVED;
-#endif
-
-	error = 0;
-
-end:
-	if (pbuf)
-		vfree(pbuf);
-	if (msg)
-		vfree(msg);
-#ifdef HAVE_GSSAPI
-	if (gsstoken)
-		vfree(gsstoken);
-#endif
-
-	if (error) {
-		VPTRINIT(iph1->id_p);
-		oakley_delcert(iph1->cert_p);
-		iph1->cert_p = NULL;
-		oakley_delcert(iph1->crl_p);
-		iph1->crl_p = NULL;
-		VPTRINIT(iph1->sig_p);
-	}
-
-	return error;
-}
-
-/*
- * status update and establish isakmp sa.
- */
-int
-ident_i4send(iph1, msg)
-	struct ph1handle *iph1;
-	vchar_t *msg;
-{
-	int error = -1;
-
-	/* validity check */
-	if (iph1->status != PHASE1ST_MSG4RECEIVED) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph1->status);
-		goto end;
-	}
-
-	/* see handler.h about IV synchronization. */
-	memcpy(iph1->ivm->iv->v, iph1->ivm->ive->v, iph1->ivm->iv->l);
-
-	iph1->status = PHASE1ST_ESTABLISHED;
-
-	error = 0;
-
-end:
-	return error;
-}
-
-/*
- * receive from initiator
- * 	psk: HDR, SA
- * 	sig: HDR, SA
- * 	rsa: HDR, SA
- * 	rev: HDR, SA
- */
-int
-ident_r1recv(iph1, msg)
-	struct ph1handle *iph1;
-	vchar_t *msg;
-{
-	vchar_t *pbuf = NULL;
-	struct isakmp_parse_t *pa;
-	int error = -1;
-	int vid_numeric;
-
-	/* validity check */
-	if (iph1->status != PHASE1ST_START) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph1->status);
-		goto end;
-	}
-
-	/* validate the type of next payload */
-	/*
-	 * NOTE: XXX even if multiple VID, we'll silently ignore those.
-	 */
-	pbuf = isakmp_parse(msg);
-	if (pbuf == NULL)
-		goto end;
-	pa = (struct isakmp_parse_t *)pbuf->v;
-
-	/* check the position of SA payload */
-	if (pa->type != ISAKMP_NPTYPE_SA) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"received invalid next payload type %d, "
-			"expecting %d.\n",
-			pa->type, ISAKMP_NPTYPE_SA);
-		goto end;
-	}
-	if (isakmp_p2ph(&iph1->sa, pa->ptr) < 0)
-		goto end;
-	pa++;
-
-	for (/*nothing*/;
-	     pa->type != ISAKMP_NPTYPE_NONE;
-	     pa++) {
-
-		switch (pa->type) {
-		case ISAKMP_NPTYPE_VID:
-			vid_numeric = handle_vendorid(iph1, pa->ptr);
-#ifdef ENABLE_FRAG
-			if ((vid_numeric == VENDORID_FRAG) &&
-			    (vendorid_frag_cap(pa->ptr) & VENDORID_FRAG_IDENT))
-				iph1->frag = 1;
-#endif   
-			break;
-		default:
-			/*
-			 * We don't send information to the peer even
-			 * if we received malformed packet.  Because we
-			 * can't distinguish the malformed packet and
-			 * the re-sent packet.  And we do same behavior
-			 * when we expect encrypted packet.
-			 */
-			plog(LLV_ERROR, LOCATION, iph1->remote,
-				"ignore the packet, "
-				"received unexpecting payload type %d.\n",
-				pa->type);
-			goto end;
-		}
-	}
-
-#ifdef ENABLE_NATT
-	if (NATT_AVAILABLE(iph1))
-		plog(LLV_INFO, LOCATION, iph1->remote,
-		     "Selected NAT-T version: %s\n",
-		     vid_string_by_id(iph1->natt_options->version));
-#endif
-
-	/* check SA payload and set approval SA for use */
-	if (ipsecdoi_checkph1proposal(iph1->sa, iph1) < 0) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"failed to get valid proposal.\n");
-		/* XXX send information */
-		goto end;
-	}
-
-	iph1->status = PHASE1ST_MSG1RECEIVED;
-
-	error = 0;
-
-end:
-	if (pbuf)
-		vfree(pbuf);
-	if (error) {
-		VPTRINIT(iph1->sa);
-	}
-
-	return error;
-}
-
-/*
- * send to initiator
- * 	psk: HDR, SA
- * 	sig: HDR, SA
- * 	rsa: HDR, SA
- * 	rev: HDR, SA
- */
-int
-ident_r1send(iph1, msg)
-	struct ph1handle *iph1;
-	vchar_t *msg;
-{
-	struct payload_list *plist = NULL;
-	int error = -1;
-	vchar_t *gss_sa = NULL;
-#ifdef HAVE_GSSAPI
-	int free_gss_sa = 0;
-#endif
-#ifdef ENABLE_NATT
-	vchar_t *vid_natt = NULL;
-#endif
-#ifdef ENABLE_HYBRID
-        vchar_t *vid_xauth = NULL;
-        vchar_t *vid_unity = NULL;
-#endif  
-#ifdef ENABLE_DPD
-	vchar_t *vid_dpd = NULL;
-#endif
-#ifdef ENABLE_FRAG          
-	vchar_t *vid_frag = NULL;
-#endif 
-
-	/* validity check */
-	if (iph1->status != PHASE1ST_MSG1RECEIVED) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph1->status);
-		goto end;
-	}
-
-	/* set responder's cookie */
-	isakmp_newcookie((caddr_t)&iph1->index.r_ck, iph1->remote, iph1->local);
-
-#ifdef HAVE_GSSAPI
-	if (iph1->approval->gssid != NULL) {
-		gss_sa = ipsecdoi_setph1proposal(iph1->approval);
-		if (gss_sa != iph1->sa_ret)
-			free_gss_sa = 1;
-	} else 
-#endif
-		gss_sa = iph1->sa_ret;
-
-	/* set SA payload to reply */
-	plist = isakmp_plist_append(plist, gss_sa, ISAKMP_NPTYPE_SA);
-
-#ifdef ENABLE_HYBRID
-	if (iph1->mode_cfg->flags & ISAKMP_CFG_VENDORID_XAUTH) {
-		plog (LLV_INFO, LOCATION, NULL, "Adding xauth VID payload.\n");
-		if ((vid_xauth = set_vendorid(VENDORID_XAUTH)) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "Cannot create Xauth vendor ID\n");
-			goto end;
-		}
-		plist = isakmp_plist_append(plist,
-		    vid_xauth, ISAKMP_NPTYPE_VID);
-	}
-
-	if (iph1->mode_cfg->flags & ISAKMP_CFG_VENDORID_UNITY) {
-		if ((vid_unity = set_vendorid(VENDORID_UNITY)) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "Cannot create Unity vendor ID\n");
-			goto end;
-		}
-		plist = isakmp_plist_append(plist,
-		    vid_unity, ISAKMP_NPTYPE_VID);
-	}
-#endif
-#ifdef ENABLE_NATT
-	/* Has the peer announced NAT-T? */
-	if (NATT_AVAILABLE(iph1))
-		vid_natt = set_vendorid(iph1->natt_options->version);
-
-	if (vid_natt)
-		plist = isakmp_plist_append(plist, vid_natt, ISAKMP_NPTYPE_VID);
-#endif
-#ifdef ENABLE_DPD
-	/* XXX only send DPD VID if remote sent it ? */
-	if(iph1->rmconf->dpd){
-		vid_dpd = set_vendorid(VENDORID_DPD);
-		if (vid_dpd != NULL)
-			plist = isakmp_plist_append(plist, vid_dpd, ISAKMP_NPTYPE_VID);
-	}
-#endif
-#ifdef ENABLE_FRAG
-	if (iph1->frag) {
-		vid_frag = set_vendorid(VENDORID_FRAG);
-		if (vid_frag != NULL)
-			vid_frag = isakmp_frag_addcap(vid_frag,
-			    VENDORID_FRAG_IDENT);
-		if (vid_frag == NULL)
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "Frag vendorID construction failed\n");
-		else
-			plist = isakmp_plist_append(plist, 
-			     vid_frag, ISAKMP_NPTYPE_VID);
-	}
-#endif
-
-	iph1->sendbuf = isakmp_plist_set_all (&plist, iph1);
-
-#ifdef HAVE_PRINT_ISAKMP_C
-	isakmp_printpacket(iph1->sendbuf, iph1->local, iph1->remote, 0);
-#endif
-
-	/* send the packet, add to the schedule to resend */
-	iph1->retry_counter = iph1->rmconf->retry_counter;
-	if (isakmp_ph1resend(iph1) == -1) {
-		goto end;
-	}
-
-	/* the sending message is added to the received-list. */
-	if (add_recvdpkt(iph1->remote, iph1->local, iph1->sendbuf, msg) == -1) {
-		plog(LLV_ERROR , LOCATION, NULL,
-			"failed to add a response packet to the tree.\n");
-		goto end;
-	}
-
-	iph1->status = PHASE1ST_MSG1SENT;
-
-	error = 0;
-
-end:
-#ifdef HAVE_GSSAPI
-	if (free_gss_sa)
-		vfree(gss_sa);
-#endif
-#ifdef ENABLE_NATT
-	if (vid_natt)
-		vfree(vid_natt);
-#endif
-#ifdef ENABLE_HYBRID
-	if (vid_xauth != NULL)
-		vfree(vid_xauth);
-	if (vid_unity != NULL)
-		vfree(vid_unity);
-#endif
-#ifdef ENABLE_DPD
-	if (vid_dpd != NULL)
-		vfree(vid_dpd);
-#endif
-#ifdef ENABLE_FRAG
-	if (vid_frag != NULL)
-		vfree(vid_frag);
-#endif
-
-	return error;
-}
-
-/*
- * receive from initiator
- * 	psk: HDR, KE, Ni
- * 	sig: HDR, KE, Ni
- *   gssapi: HDR, KE, Ni, GSSi
- * 	rsa: HDR, KE, [ HASH(1), ] <IDi1_b>PubKey_r, <Ni_b>PubKey_r
- * 	rev: HDR, [ HASH(1), ] <Ni_b>Pubkey_r, <KE_b>Ke_i,
- * 	          <IDi1_b>Ke_i, [<<Cert-I_b>Ke_i]
- */
-int
-ident_r2recv(iph1, msg)
-	struct ph1handle *iph1;
-	vchar_t *msg;
-{
-	vchar_t *pbuf = NULL;
-	struct isakmp_parse_t *pa;
-	int error = -1;
-#ifdef HAVE_GSSAPI
-	vchar_t *gsstoken = NULL;
-#endif
-#ifdef ENABLE_NATT
-	int natd_seq = 0;
-#endif
-
-	/* validity check */
-	if (iph1->status != PHASE1ST_MSG1SENT) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph1->status);
-		goto end;
-	}
-
-	/* validate the type of next payload */
-	pbuf = isakmp_parse(msg);
-	if (pbuf == NULL)
-		goto end;
-
-	for (pa = (struct isakmp_parse_t *)pbuf->v;
-	     pa->type != ISAKMP_NPTYPE_NONE;
-	     pa++) {
-		switch (pa->type) {
-		case ISAKMP_NPTYPE_KE:
-			if (isakmp_p2ph(&iph1->dhpub_p, pa->ptr) < 0)
-				goto end;
-			break;
-		case ISAKMP_NPTYPE_NONCE:
-			if (isakmp_p2ph(&iph1->nonce_p, pa->ptr) < 0)
-				goto end;
-			break;
-		case ISAKMP_NPTYPE_VID:
-			handle_vendorid(iph1, pa->ptr);
-			break;
-		case ISAKMP_NPTYPE_CR:
-			plog(LLV_WARNING, LOCATION, iph1->remote,
-				"CR received, ignore it. "
-				"It should be in other exchange.\n");
-			break;
-#ifdef HAVE_GSSAPI
-		case ISAKMP_NPTYPE_GSS:
-			if (isakmp_p2ph(&gsstoken, pa->ptr) < 0)
-				goto end;
-			gssapi_save_received_token(iph1, gsstoken);
-			break;
-#endif
-
-#ifdef ENABLE_NATT
-		case ISAKMP_NPTYPE_NATD_DRAFT:
-		case ISAKMP_NPTYPE_NATD_RFC:
-			if (NATT_AVAILABLE(iph1) && iph1->natt_options != NULL &&
-				pa->type == iph1->natt_options->payload_nat_d)
-			{
-				vchar_t *natd_received = NULL;
-				int natd_verified;
-				
-				if (isakmp_p2ph (&natd_received, pa->ptr) < 0)
-					goto end;
-				
-				if (natd_seq == 0)
-					iph1->natt_flags |= NAT_DETECTED;
-				
-				natd_verified = natt_compare_addr_hash (iph1,
-					natd_received, natd_seq++);
-				
-				plog (LLV_INFO, LOCATION, NULL, "NAT-D payload #%d %s\n",
-					natd_seq - 1,
-					natd_verified ? "verified" : "doesn't match");
-				
-				vfree (natd_received);
-				break;
-			}
-			/* passthrough to default... */
-#endif
-
-		default:
-			/* don't send information, see ident_r1recv() */
-			plog(LLV_ERROR, LOCATION, iph1->remote,
-				"ignore the packet, "
-				"received unexpecting payload type %d.\n",
-				pa->type);
-			goto end;
-		}
-	}
-
-#ifdef ENABLE_NATT
-	if (NATT_AVAILABLE(iph1))
-		plog (LLV_INFO, LOCATION, NULL, "NAT %s %s%s\n",
-		      iph1->natt_flags & NAT_DETECTED ? 
-		      		"detected:" : "not detected",
-		      iph1->natt_flags & NAT_DETECTED_ME ? "ME " : "",
-		      iph1->natt_flags & NAT_DETECTED_PEER ? "PEER" : "");
-#endif
-
-	/* payload existency check */
-	if (iph1->dhpub_p == NULL || iph1->nonce_p == NULL) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"few isakmp message received.\n");
-		goto end;
-	}
-
-	iph1->status = PHASE1ST_MSG2RECEIVED;
-
-	error = 0;
-
-end:
-	if (pbuf)
-		vfree(pbuf);
-#ifdef HAVE_GSSAPI
-	if (gsstoken)
-		vfree(gsstoken);
-#endif
-
-	if (error) {
-		VPTRINIT(iph1->dhpub_p);
-		VPTRINIT(iph1->nonce_p);
-		VPTRINIT(iph1->id_p);
-	}
-
-	return error;
-}
-
-/*
- * send to initiator
- * 	psk: HDR, KE, Nr
- * 	sig: HDR, KE, Nr [, CR ]
- *   gssapi: HDR, KE, Nr, GSSr
- * 	rsa: HDR, KE, <IDr1_b>PubKey_i, <Nr_b>PubKey_i
- * 	rev: HDR, <Nr_b>PubKey_i, <KE_b>Ke_r, <IDr1_b>Ke_r,
- */
-int
-ident_r2send(iph1, msg)
-	struct ph1handle *iph1;
-	vchar_t *msg;
-{
-	int error = -1;
-
-	/* validity check */
-	if (iph1->status != PHASE1ST_MSG2RECEIVED) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph1->status);
-		goto end;
-	}
-
-	/* generate DH public value */
-	if (oakley_dh_generate(iph1->approval->dhgrp,
-				&iph1->dhpub, &iph1->dhpriv) < 0)
-		goto end;
-
-	/* generate NONCE value */
-	iph1->nonce = eay_set_random(iph1->rmconf->nonce_size);
-	if (iph1->nonce == NULL)
-		goto end;
-
-#ifdef HAVE_GSSAPI
-	if (AUTHMETHOD(iph1) == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB)
-		gssapi_get_rtoken(iph1, NULL);
-#endif
-
-	/* create HDR;KE;NONCE payload */
-	iph1->sendbuf = ident_ir2mx(iph1);
-	if (iph1->sendbuf == NULL)
-		goto end;
-
-#ifdef HAVE_PRINT_ISAKMP_C
-	isakmp_printpacket(iph1->sendbuf, iph1->local, iph1->remote, 0);
-#endif
-
-	/* send the packet, add to the schedule to resend */
-	iph1->retry_counter = iph1->rmconf->retry_counter;
-	if (isakmp_ph1resend(iph1) == -1)
-		goto end;
-
-	/* the sending message is added to the received-list. */
-	if (add_recvdpkt(iph1->remote, iph1->local, iph1->sendbuf, msg) == -1) {
-		plog(LLV_ERROR , LOCATION, NULL,
-			"failed to add a response packet to the tree.\n");
-		goto end;
-	}
-
-	/* compute sharing secret of DH */
-	if (oakley_dh_compute(iph1->approval->dhgrp, iph1->dhpub,
-				iph1->dhpriv, iph1->dhpub_p, &iph1->dhgxy) < 0)
-		goto end;
-
-	/* generate SKEYIDs & IV & final cipher key */
-	if (oakley_skeyid(iph1) < 0)
-		goto end;
-	if (oakley_skeyid_dae(iph1) < 0)
-		goto end;
-	if (oakley_compute_enckey(iph1) < 0)
-		goto end;
-	if (oakley_newiv(iph1) < 0)
-		goto end;
-
-	iph1->status = PHASE1ST_MSG2SENT;
-
-	error = 0;
-
-end:
-	return error;
-}
-
-/*
- * receive from initiator
- * 	psk: HDR*, IDi1, HASH_I
- * 	sig: HDR*, IDi1, [ CR, ] [ CERT, ] SIG_I
- *   gssapi: HDR*, [ IDi1, ] < GSSi(n) | HASH_I >
- * 	rsa: HDR*, HASH_I
- * 	rev: HDR*, HASH_I
- */
-int
-ident_r3recv(iph1, msg0)
-	struct ph1handle *iph1;
-	vchar_t *msg0;
-{
-	vchar_t *msg = NULL;
-	vchar_t *pbuf = NULL;
-	struct isakmp_parse_t *pa;
-	int error = -1;
-	int type;
-#ifdef HAVE_GSSAPI
-	vchar_t *gsstoken = NULL;
-#endif
-
-	/* validity check */
-	if (iph1->status != PHASE1ST_MSG2SENT) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph1->status);
-		goto end;
-	}
-
-	/* decrypting */
-	if (!ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E)) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"reject the packet, "
-			"expecting the packet encrypted.\n");
-		goto end;
-	}
-	msg = oakley_do_decrypt(iph1, msg0, iph1->ivm->iv, iph1->ivm->ive);
-	if (msg == NULL)
-		goto end;
-
-	/* validate the type of next payload */
-	pbuf = isakmp_parse(msg);
-	if (pbuf == NULL)
-		goto end;
-
-	iph1->pl_hash = NULL;
-
-	for (pa = (struct isakmp_parse_t *)pbuf->v;
-	     pa->type != ISAKMP_NPTYPE_NONE;
-	     pa++) {
-
-		switch (pa->type) {
-		case ISAKMP_NPTYPE_ID:
-			if (isakmp_p2ph(&iph1->id_p, pa->ptr) < 0)
-				goto end;
-			break;
-		case ISAKMP_NPTYPE_HASH:
-			iph1->pl_hash = (struct isakmp_pl_hash *)pa->ptr;
-			break;
-		case ISAKMP_NPTYPE_CR:
-			if (oakley_savecr(iph1, pa->ptr) < 0)
-				goto end;
-			break;
-		case ISAKMP_NPTYPE_CERT:
-			if (oakley_savecert(iph1, pa->ptr) < 0)
-				goto end;
-			break;
-		case ISAKMP_NPTYPE_SIG:
-			if (isakmp_p2ph(&iph1->sig_p, pa->ptr) < 0)
-				goto end;
-			break;
-#ifdef HAVE_GSSAPI
-		case ISAKMP_NPTYPE_GSS:
-			if (isakmp_p2ph(&gsstoken, pa->ptr) < 0)
-				goto end;
-			gssapi_save_received_token(iph1, gsstoken);
-			break;
-#endif
-		case ISAKMP_NPTYPE_VID:
-			handle_vendorid(iph1, pa->ptr);
-			break;
-		case ISAKMP_NPTYPE_N:
-			isakmp_check_notify(pa->ptr, iph1);
-			break;
-		default:
-			/* don't send information, see ident_r1recv() */
-			plog(LLV_ERROR, LOCATION, iph1->remote,
-				"ignore the packet, "
-				"received unexpecting payload type %d.\n",
-				pa->type);
-			goto end;
-		}
-	}
-
-	/* payload existency check */
-	/* XXX same as ident_i4recv(), should be merged. */
-    {
-	int ng = 0;
-
-	switch (AUTHMETHOD(iph1)) {
-	case OAKLEY_ATTR_AUTH_METHOD_PSKEY:
-#ifdef ENABLE_HYBRID
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R:
-#endif
-		if (iph1->id_p == NULL || iph1->pl_hash == NULL)
-			ng++;
-		break;
-	case OAKLEY_ATTR_AUTH_METHOD_DSSSIG:
-	case OAKLEY_ATTR_AUTH_METHOD_RSASIG:
-#ifdef ENABLE_HYBRID
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R:
-#endif
-		if (iph1->id_p == NULL || iph1->sig_p == NULL)
-			ng++;
-		break;
-	case OAKLEY_ATTR_AUTH_METHOD_RSAENC:
-	case OAKLEY_ATTR_AUTH_METHOD_RSAREV:
-#ifdef ENABLE_HYBRID
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_R:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_R:
-#endif
-		if (iph1->pl_hash == NULL)
-			ng++;
-		break;
-#ifdef HAVE_GSSAPI
-	case OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB:
-		if (gsstoken == NULL && iph1->pl_hash == NULL)
-			ng++;
-		break;
-#endif
-	default:
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"invalid authmethod %d why ?\n",
-			iph1->approval->authmethod);
-		goto end;
-	}
-	if (ng) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"few isakmp message received.\n");
-		goto end;
-	}
-    }
-
-	/* verify identifier */
-	if (ipsecdoi_checkid1(iph1) != 0) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"invalid ID payload.\n");
-		goto end;
-	}
-
-	/* validate authentication value */
-#ifdef HAVE_GSSAPI
-	if (gsstoken == NULL) {
-#endif
-		type = oakley_validate_auth(iph1);
-		if (type != 0) {
-			if (type == -1) {
-				/* msg printed inner oakley_validate_auth() */
-				goto end;
-			}
-			EVT_PUSH(iph1->local, iph1->remote, 
-			    EVTT_PEERPH1AUTH_FAILED, NULL);
-			isakmp_info_send_n1(iph1, type, NULL);
-			goto end;
-		}
-#ifdef HAVE_GSSAPI
-	}
-#endif
-
-	if (oakley_checkcr(iph1) < 0) {
-		/* Ignore this error in order to be interoperability. */
-		;
-	}
-
-	/*
-	 * XXX: Should we do compare two addresses, ph1handle's and ID
-	 * payload's.
-	 */
-
-	plog(LLV_DEBUG, LOCATION, iph1->remote, "peer's ID\n");
-	plogdump(LLV_DEBUG, iph1->id_p->v, iph1->id_p->l);
-
-	/* see handler.h about IV synchronization. */
-	memcpy(iph1->ivm->iv->v, iph1->ivm->ive->v, iph1->ivm->ive->l);
-
-#ifdef HAVE_GSSAPI
-	iph1->status = gsstoken != NULL ? PHASE1ST_MSG2RECEIVED :
-	    PHASE1ST_MSG3RECEIVED;
-#else
-	iph1->status = PHASE1ST_MSG3RECEIVED;
-#endif
-
-	error = 0;
-
-end:
-	if (pbuf)
-		vfree(pbuf);
-	if (msg)
-		vfree(msg);
-#ifdef HAVE_GSSAPI
-	if (gsstoken)
-		vfree(gsstoken);
-#endif
-
-	if (error) {
-		VPTRINIT(iph1->id_p);
-		oakley_delcert(iph1->cert_p);
-		iph1->cert_p = NULL;
-		oakley_delcert(iph1->crl_p);
-		iph1->crl_p = NULL;
-		VPTRINIT(iph1->sig_p);
-		oakley_delcert(iph1->cr_p);
-		iph1->cr_p = NULL;
-	}
-
-	return error;
-}
-
-/*
- * send to initiator
- * 	psk: HDR*, IDr1, HASH_R
- * 	sig: HDR*, IDr1, [ CERT, ] SIG_R
- *   gssapi: HDR*, IDr1, < GSSr(n) | HASH_R >
- * 	rsa: HDR*, HASH_R
- * 	rev: HDR*, HASH_R
- */
-int
-ident_r3send(iph1, msg)
-	struct ph1handle *iph1;
-	vchar_t *msg;
-{
-	int error = -1;
-	int dohash = 1;
-#ifdef HAVE_GSSAPI
-	int len;
-#endif
-
-	/* validity check */
-	if (iph1->status != PHASE1ST_MSG3RECEIVED) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph1->status);
-		goto end;
-	}
-
-	/* make ID payload into isakmp status */
-	if (ipsecdoi_setid1(iph1) < 0)
-		goto end;
-
-#ifdef HAVE_GSSAPI
-	if (AUTHMETHOD(iph1) == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB &&
-	    gssapi_more_tokens(iph1)) {
-		gssapi_get_rtoken(iph1, &len);
-		if (len != 0)
-			dohash = 0;
-	}
-#endif
-
-	if (dohash) {
-		/* generate HASH to send */
-		plog(LLV_DEBUG, LOCATION, NULL, "generate HASH_R\n");
-		iph1->hash = oakley_ph1hash_common(iph1, GENERATE);
-		if (iph1->hash == NULL)
-			goto end;
-	} else
-		iph1->hash = NULL;
-
-	/* set encryption flag */
-	iph1->flags |= ISAKMP_FLAG_E;
-
-	/* create HDR;ID;HASH payload */
-	iph1->sendbuf = ident_ir3mx(iph1);
-	if (iph1->sendbuf == NULL)
-		goto end;
-
-	/* send HDR;ID;HASH to responder */
-	if (isakmp_send(iph1, iph1->sendbuf) < 0)
-		goto end;
-
-	/* the sending message is added to the received-list. */
-	if (add_recvdpkt(iph1->remote, iph1->local, iph1->sendbuf, msg) == -1) {
-		plog(LLV_ERROR , LOCATION, NULL,
-			"failed to add a response packet to the tree.\n");
-		goto end;
-	}
-
-	/* see handler.h about IV synchronization. */
-	memcpy(iph1->ivm->ive->v, iph1->ivm->iv->v, iph1->ivm->iv->l);
-
-	iph1->status = PHASE1ST_ESTABLISHED;
-
-	error = 0;
-
-end:
-
-	return error;
-}
-
-/*
- * This is used in main mode for:
- * initiator's 3rd exchange send to responder
- * 	psk: HDR, KE, Ni
- * 	sig: HDR, KE, Ni
- * 	rsa: HDR, KE, [ HASH(1), ] <IDi1_b>PubKey_r, <Ni_b>PubKey_r
- * 	rev: HDR, [ HASH(1), ] <Ni_b>Pubkey_r, <KE_b>Ke_i,
- * 	          <IDi1_b>Ke_i, [<<Cert-I_b>Ke_i]
- * responders 2nd exchnage send to initiator
- * 	psk: HDR, KE, Nr
- * 	sig: HDR, KE, Nr [, CR ]
- * 	rsa: HDR, KE, <IDr1_b>PubKey_i, <Nr_b>PubKey_i
- * 	rev: HDR, <Nr_b>PubKey_i, <KE_b>Ke_r, <IDr1_b>Ke_r,
- */
-static vchar_t *
-ident_ir2mx(iph1)
-	struct ph1handle *iph1;
-{
-	vchar_t *buf = 0;
-	struct payload_list *plist = NULL;
-	int need_cr = 0;
-	vchar_t *cr = NULL;
-	vchar_t *vid = NULL;
-	int error = -1;
-#ifdef HAVE_GSSAPI
-	vchar_t *gsstoken = NULL;
-#endif
-#ifdef ENABLE_NATT
-	vchar_t *natd[2] = { NULL, NULL };
-#endif
-
-	/* create CR if need */
-	if (iph1->side == RESPONDER
-	 && iph1->rmconf->send_cr
-	 && oakley_needcr(iph1->approval->authmethod)
-	 && iph1->rmconf->peerscertfile == NULL) {
-		need_cr = 1;
-		cr = oakley_getcr(iph1);
-		if (cr == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to get cr buffer.\n");
-			goto end;
-		}
-	}
-
-#ifdef HAVE_GSSAPI
-	if (AUTHMETHOD(iph1) == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB)
-		gssapi_get_token_to_send(iph1, &gsstoken);
-#endif
-
-	/* create isakmp KE payload */
-	plist = isakmp_plist_append(plist, iph1->dhpub, ISAKMP_NPTYPE_KE);
-
-	/* create isakmp NONCE payload */
-	plist = isakmp_plist_append(plist, iph1->nonce, ISAKMP_NPTYPE_NONCE);
-
-#ifdef HAVE_GSSAPI
-	if (AUTHMETHOD(iph1) == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB)
-		plist = isakmp_plist_append(plist, gsstoken, ISAKMP_NPTYPE_GSS);
-#endif
-
-	/* append vendor id, if needed */
-	if (vid)
-		plist = isakmp_plist_append(plist, vid, ISAKMP_NPTYPE_VID);
-
-	/* create isakmp CR payload if needed */
-	if (need_cr)
-		plist = isakmp_plist_append(plist, cr, ISAKMP_NPTYPE_CR);
-
-#ifdef ENABLE_NATT
-	/* generate and append NAT-D payloads */
-	if (NATT_AVAILABLE(iph1) && iph1->status == PHASE1ST_MSG2RECEIVED)
-	{
-		if ((natd[0] = natt_hash_addr (iph1, iph1->remote)) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"NAT-D hashing failed for %s\n", saddr2str(iph1->remote));
-			goto end;
-		}
-
-		if ((natd[1] = natt_hash_addr (iph1, iph1->local)) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"NAT-D hashing failed for %s\n", saddr2str(iph1->local));
-			goto end;
-		}
-
-		plog (LLV_INFO, LOCATION, NULL, "Adding remote and local NAT-D payloads.\n");
-		plist = isakmp_plist_append(plist, natd[0], iph1->natt_options->payload_nat_d);
-		plist = isakmp_plist_append(plist, natd[1], iph1->natt_options->payload_nat_d);
-	}
-#endif
-	
-	buf = isakmp_plist_set_all (&plist, iph1);
-	
-	error = 0;
-
-end:
-	if (error && buf != NULL) {
-		vfree(buf);
-		buf = NULL;
-	}
-	if (cr)
-		vfree(cr);
-#ifdef HAVE_GSSAPI
-	if (gsstoken)
-		vfree(gsstoken);
-#endif
-	if (vid)
-		vfree(vid);
-
-#ifdef ENABLE_NATT
-	if (natd[0])
-		vfree(natd[0]);
-	if (natd[1])
-		vfree(natd[1]);
-#endif
-
-	return buf;
-}
-
-/*
- * This is used in main mode for:
- * initiator's 4th exchange send to responder
- * 	psk: HDR*, IDi1, HASH_I
- * 	sig: HDR*, IDi1, [ CR, ] [ CERT, ] SIG_I
- *   gssapi: HDR*, [ IDi1, ] < GSSi(n) | HASH_I >
- * 	rsa: HDR*, HASH_I
- * 	rev: HDR*, HASH_I
- * responders 3rd exchnage send to initiator
- * 	psk: HDR*, IDr1, HASH_R
- * 	sig: HDR*, IDr1, [ CERT, ] SIG_R
- *   gssapi: HDR*, [ IDr1, ] < GSSr(n) | HASH_R >
- * 	rsa: HDR*, HASH_R
- * 	rev: HDR*, HASH_R
- */
-static vchar_t *
-ident_ir3mx(iph1)
-	struct ph1handle *iph1;
-{
-	struct payload_list *plist = NULL;
-	vchar_t *buf = NULL, *new = NULL;
-	int need_cr = 0;
-	int need_cert = 0;
-	vchar_t *cr = NULL;
-	int error = -1;
-#ifdef HAVE_GSSAPI
-	int nptype;
-	vchar_t *gsstoken = NULL;
-	vchar_t *gsshash = NULL;
-#endif
-
-	switch (AUTHMETHOD(iph1)) {
-	case OAKLEY_ATTR_AUTH_METHOD_PSKEY:
-#ifdef ENABLE_HYBRID
-	case FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
-#endif
-		/* create isakmp ID payload */
-		plist = isakmp_plist_append(plist, iph1->id, ISAKMP_NPTYPE_ID);
-
-		/* create isakmp HASH payload */
-		plist = isakmp_plist_append(plist, iph1->hash, ISAKMP_NPTYPE_HASH);
-		break;
-	case OAKLEY_ATTR_AUTH_METHOD_DSSSIG:
-	case OAKLEY_ATTR_AUTH_METHOD_RSASIG:
-#ifdef ENABLE_HYBRID
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R:
-#endif 
-		if (oakley_getmycert(iph1) < 0)
-			goto end;
-
-		if (oakley_getsign(iph1) < 0)
-			goto end;
-
-		/* create CR if need */
-		if (iph1->side == INITIATOR
-		 && iph1->rmconf->send_cr
-	 	 && oakley_needcr(iph1->approval->authmethod)
-		 && iph1->rmconf->peerscertfile == NULL) {
-			need_cr = 1;
-			cr = oakley_getcr(iph1);
-			if (cr == NULL) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"failed to get cr buffer.\n");
-				goto end;
-			}
-		}
-
-		if (iph1->cert != NULL && iph1->rmconf->send_cert)
-			need_cert = 1;
-
-		/* add ID payload */
-		plist = isakmp_plist_append(plist, iph1->id, ISAKMP_NPTYPE_ID);
-
-		/* add CERT payload if there */
-		if (need_cert)
-			plist = isakmp_plist_append(plist, iph1->cert->pl, ISAKMP_NPTYPE_CERT);
-		/* add SIG payload */
-		plist = isakmp_plist_append(plist, iph1->sig, ISAKMP_NPTYPE_SIG);
-
-		/* create isakmp CR payload */
-		if (need_cr)
-			plist = isakmp_plist_append(plist, cr, ISAKMP_NPTYPE_CR);
-		break;
-#ifdef HAVE_GSSAPI
-	case OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB:
-		if (iph1->hash != NULL) {
-			gsshash = gssapi_wraphash(iph1);
-			if (gsshash == NULL)
-				goto end;
-		} else {
-			gssapi_get_token_to_send(iph1, &gsstoken);
-		}
-
-		if (!gssapi_id_sent(iph1)) {
-			/* create isakmp ID payload */
-			plist = isakmp_plist_append(plist, iph1->id, ISAKMP_NPTYPE_ID);
-			gssapi_set_id_sent(iph1);
-		}
-
-		if (iph1->hash != NULL)
-			/* create isakmp HASH payload */
-			plist = isakmp_plist_append(plist, gsshash, ISAKMP_NPTYPE_HASH);
-		else
-			plist = isakmp_plist_append(plist, gsstoken, ISAKMP_NPTYPE_GSS);
-		break;
-#endif
-	case OAKLEY_ATTR_AUTH_METHOD_RSAENC:
-	case OAKLEY_ATTR_AUTH_METHOD_RSAREV:
-#ifdef ENABLE_HYBRID
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_R:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_R:
-#endif
-		plog(LLV_ERROR, LOCATION, NULL,
-			"not supported authentication type %d\n",
-			iph1->approval->authmethod);
-		goto end;
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid authentication type %d\n",
-			iph1->approval->authmethod);
-		goto end;
-	}
-
-	buf = isakmp_plist_set_all (&plist, iph1);
-	
-#ifdef HAVE_PRINT_ISAKMP_C
-	isakmp_printpacket(buf, iph1->local, iph1->remote, 1);
-#endif
-
-	/* encoding */
-	new = oakley_do_encrypt(iph1, buf, iph1->ivm->ive, iph1->ivm->iv);
-	if (new == NULL)
-		goto end;
-
-	vfree(buf);
-
-	buf = new;
-
-	error = 0;
-
-end:
-#ifdef HAVE_GSSAPI
-	if (gsstoken)
-		vfree(gsstoken);
-#endif
-	if (cr)
-		vfree(cr);
-	if (error && buf != NULL) {
-		vfree(buf);
-		buf = NULL;
-	}
-
-	return buf;
-}
diff --git a/src/racoon/isakmp_ident.h b/src/racoon/isakmp_ident.h
deleted file mode 100644
index ea5595d..0000000
--- a/src/racoon/isakmp_ident.h
+++ /dev/null
@@ -1,52 +0,0 @@
-/*	$NetBSD: isakmp_ident.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/* Id: isakmp_ident.h,v 1.3 2004/06/11 16:00:16 ludvigm Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _ISAKMP_IDENT_H
-#define _ISAKMP_IDENT_H
-
-extern int ident_i1send __P((struct ph1handle *, vchar_t *));
-extern int ident_i2recv __P((struct ph1handle *, vchar_t *));
-extern int ident_i2send __P((struct ph1handle *, vchar_t *));
-extern int ident_i3recv __P((struct ph1handle *, vchar_t *));
-extern int ident_i3send __P((struct ph1handle *, vchar_t *));
-extern int ident_i4recv __P((struct ph1handle *, vchar_t *));
-extern int ident_i4send __P((struct ph1handle *, vchar_t *));
-
-extern int ident_r1recv __P((struct ph1handle *, vchar_t *));
-extern int ident_r1send __P((struct ph1handle *, vchar_t *));
-extern int ident_r2recv __P((struct ph1handle *, vchar_t *));
-extern int ident_r2send __P((struct ph1handle *, vchar_t *));
-extern int ident_r3recv __P((struct ph1handle *, vchar_t *));
-extern int ident_r3send __P((struct ph1handle *, vchar_t *));
-
-#endif /* _ISAKMP_IDENT_H */
diff --git a/src/racoon/isakmp_inf.c b/src/racoon/isakmp_inf.c
deleted file mode 100644
index 5f487d2..0000000
--- a/src/racoon/isakmp_inf.c
+++ /dev/null
@@ -1,1714 +0,0 @@
-/*	$NetBSD: isakmp_inf.c,v 1.14.4.17 2009/05/18 17:07:46 tteras Exp $	*/
-
-/* Id: isakmp_inf.c,v 1.44 2006/05/06 20:45:52 manubsd Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/socket.h>
-
-#include <net/pfkeyv2.h>
-#include <netinet/in.h>
-#include <sys/queue.h>
-#include PATH_IPSEC_H
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-#if TIME_WITH_SYS_TIME
-# include <sys/time.h>
-# include <time.h>
-#else
-# if HAVE_SYS_TIME_H
-#  include <sys/time.h>
-# else
-#  include <time.h>
-# endif
-#endif
-#ifdef ENABLE_HYBRID
-#include <resolv.h>
-#endif
-
-#include "libpfkey.h"
-
-#include "var.h"
-#include "vmbuf.h"
-#include "schedule.h"
-#include "str2val.h"
-#include "misc.h"
-#include "plog.h"
-#include "debug.h"
-
-#include "localconf.h"
-#include "remoteconf.h"
-#include "sockmisc.h"
-#include "handler.h"
-#include "policy.h"
-#include "proposal.h"
-#include "isakmp_var.h"
-#include "evt.h"
-#include "isakmp.h"
-#ifdef ENABLE_HYBRID
-#include "isakmp_xauth.h"
-#include "isakmp_unity.h"
-#include "isakmp_cfg.h" 
-#endif
-#include "isakmp_inf.h"
-#include "oakley.h"
-#include "ipsec_doi.h"
-#include "crypto_openssl.h"
-#include "pfkey.h"
-#include "policy.h"
-#include "algorithm.h"
-#include "proposal.h"
-#include "admin.h"
-#include "strnames.h"
-#ifdef ENABLE_NATT
-#include "nattraversal.h"
-#endif
-
-/* information exchange */
-static int isakmp_info_recv_n (struct ph1handle *, struct isakmp_pl_n *, u_int32_t, int);
-static int isakmp_info_recv_d (struct ph1handle *, struct isakmp_pl_d *, u_int32_t, int);
-
-#ifdef ENABLE_DPD
-static int isakmp_info_recv_r_u __P((struct ph1handle *,
-	struct isakmp_pl_ru *, u_int32_t));
-static int isakmp_info_recv_r_u_ack __P((struct ph1handle *,
-	struct isakmp_pl_ru *, u_int32_t));
-static void isakmp_info_send_r_u __P((void *));
-#endif
-
-static void purge_isakmp_spi __P((int, isakmp_index *, size_t));
-static void info_recv_initialcontact __P((struct ph1handle *));
-
-/* %%%
- * Information Exchange
- */
-/*
- * receive Information
- */
-int
-isakmp_info_recv(iph1, msg0)
-	struct ph1handle *iph1;
-	vchar_t *msg0;
-{
-	vchar_t *msg = NULL;
-	vchar_t *pbuf = NULL;
-	u_int32_t msgid = 0;
-	int error = -1;
-	struct isakmp *isakmp;
-	struct isakmp_gen *gen;
-	struct isakmp_parse_t *pa, *pap;
-	void *p;
-	vchar_t *hash, *payload;
-	struct isakmp_gen *nd;
-	u_int8_t np;
-	int encrypted;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "receive Information.\n");
-
-	encrypted = ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E);
-	msgid = ((struct isakmp *)msg0->v)->msgid;
-
-	/* Use new IV to decrypt Informational message. */
-	if (encrypted) {
-		struct isakmp_ivm *ivm;
-
-		if (iph1->ivm == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL, "iph1->ivm == NULL\n");
-			return -1;
-		}
-
-		/* compute IV */
-		ivm = oakley_newiv2(iph1, ((struct isakmp *)msg0->v)->msgid);
-		if (ivm == NULL)
-			return -1;
-
-		msg = oakley_do_decrypt(iph1, msg0, ivm->iv, ivm->ive);
-		oakley_delivm(ivm);
-		if (msg == NULL)
-			return -1;
-
-	} else
-		msg = vdup(msg0);
-
-	/* Safety check */
-	if (msg->l < sizeof(*isakmp) + sizeof(*gen)) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-			"ignore information because the "
-			"message is way too short - %zu byte(s).\n", msg->l);
-		goto end;
-	}
-
-	isakmp = (struct isakmp *)msg->v;
-	gen = (struct isakmp_gen *)((caddr_t)isakmp + sizeof(struct isakmp));
-	np = gen->np;
-
-	if (encrypted) {
-		if (isakmp->np != ISAKMP_NPTYPE_HASH) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "ignore information because the"
-			    "message has no hash payload.\n");
-			goto end;
-		}
-
-		if (iph1->status != PHASE1ST_ESTABLISHED) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "ignore information because ISAKMP-SA"
-			    "has not been established yet.\n");
-			goto end;
-		}
-		
-		/* Safety check */
-		if (msg->l < sizeof(*isakmp) + ntohs(gen->len) + sizeof(*nd)) {
-			plog(LLV_ERROR, LOCATION, NULL, 
-				"ignore information because the "
-				"message is too short - %zu byte(s).\n", msg->l);
-			goto end;
-		}
-
-		p = (caddr_t) gen + sizeof(struct isakmp_gen);
-		nd = (struct isakmp_gen *) ((caddr_t) gen + ntohs(gen->len));
-
-		/* nd length check */
-		if (ntohs(nd->len) > msg->l - (sizeof(struct isakmp) +
-		    ntohs(gen->len))) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				 "too long payload length (broken message?)\n");
-			goto end;
-		}
-
-		if (ntohs(nd->len) < sizeof(*nd)) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"too short payload length (broken message?)\n");
-			goto end;
-		}
-
-		payload = vmalloc(ntohs(nd->len));
-		if (payload == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "cannot allocate memory\n");
-			goto end;
-		}
-
-		memcpy(payload->v, (caddr_t) nd, ntohs(nd->len));
-
-		/* compute HASH */
-		hash = oakley_compute_hash1(iph1, isakmp->msgid, payload);
-		if (hash == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "cannot compute hash\n");
-
-			vfree(payload);
-			goto end;
-		}
-		
-		if (ntohs(gen->len) - sizeof(struct isakmp_gen) != hash->l) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "ignore information due to hash length mismatch\n");
-
-			vfree(hash);
-			vfree(payload);
-			goto end;
-		}
-
-		if (memcmp(p, hash->v, hash->l) != 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "ignore information due to hash mismatch\n");
-
-			vfree(hash);
-			vfree(payload);
-			goto end;
-		}
-
-		plog(LLV_DEBUG, LOCATION, NULL, "hash validated.\n");
-
-		vfree(hash);
-		vfree(payload);
-	} else {
-		/* make sure the packet was encrypted after the beginning of phase 1. */
-		switch (iph1->etype) {
-		case ISAKMP_ETYPE_AGG:
-		case ISAKMP_ETYPE_BASE:
-		case ISAKMP_ETYPE_IDENT:
-			if ((iph1->side == INITIATOR && iph1->status < PHASE1ST_MSG3SENT)
-			 || (iph1->side == RESPONDER && iph1->status < PHASE1ST_MSG2SENT)) {
-				break;
-			}
-			/*FALLTHRU*/
-		default:
-			plog(LLV_ERROR, LOCATION, iph1->remote,
-				"%s message must be encrypted\n",
-				s_isakmp_nptype(np));
-			error = 0;
-			goto end;
-		}
-	}
-
-	if (!(pbuf = isakmp_parse(msg))) {
-		error = -1;
-		goto end;
-	}
-
-	error = 0;
-	for (pa = (struct isakmp_parse_t *)pbuf->v; pa->type; pa++) {
-		switch (pa->type) {
-		case ISAKMP_NPTYPE_HASH:
-			/* Handled above */
-			break;
-		case ISAKMP_NPTYPE_N:
-			error = isakmp_info_recv_n(iph1,
-				(struct isakmp_pl_n *)pa->ptr,
-				msgid, encrypted);
-			break;
-		case ISAKMP_NPTYPE_D:
-			error = isakmp_info_recv_d(iph1,
-				(struct isakmp_pl_d *)pa->ptr,
-				msgid, encrypted);
-			break;
-		case ISAKMP_NPTYPE_NONCE:
-			/* XXX to be 6.4.2 ike-01.txt */
-			/* XXX IV is to be synchronized. */
-			plog(LLV_ERROR, LOCATION, iph1->remote,
-				"ignore Acknowledged Informational\n");
-			break;
-		default:
-			/* don't send information, see isakmp_ident_r1() */
-			error = 0;
-			plog(LLV_ERROR, LOCATION, iph1->remote,
-				"reject the packet, "
-				"received unexpected payload type %s.\n",
-				s_isakmp_nptype(gen->np));
-		}
-		if (error < 0)
-			break;
-	}
-    end:
-	if (msg != NULL)
-		vfree(msg);
-	if (pbuf != NULL)
-		vfree(pbuf);
-	return error;
-}
-
-/*
- * handling of Notification payload
- */
-static int
-isakmp_info_recv_n(iph1, notify, msgid, encrypted)
-	struct ph1handle *iph1;
-	struct isakmp_pl_n *notify;
-	u_int32_t msgid;
-	int encrypted;
-{
-	u_int type;
-	vchar_t *pbuf;
-	char *nraw, *ndata;
-	size_t l;
-	char *spi;
-
-	type = ntohs(notify->type);
-
-	switch (type) {
-	case ISAKMP_NTYPE_CONNECTED:
-	case ISAKMP_NTYPE_RESPONDER_LIFETIME:
-	case ISAKMP_NTYPE_REPLAY_STATUS:
-#ifdef ENABLE_HYBRID
-	case ISAKMP_NTYPE_UNITY_HEARTBEAT:
-#endif
-		/* do something */
-		break;
-	case ISAKMP_NTYPE_INITIAL_CONTACT:
-		if (encrypted)
-			info_recv_initialcontact(iph1);
-			return 0;
-		break;
-#ifdef ENABLE_DPD
-	case ISAKMP_NTYPE_R_U_THERE:
-		if (encrypted)
-			return isakmp_info_recv_r_u(iph1,
-				(struct isakmp_pl_ru *)notify, msgid);
-		break;
-	case ISAKMP_NTYPE_R_U_THERE_ACK:
-		if (encrypted)
-			return isakmp_info_recv_r_u_ack(iph1,
-				(struct isakmp_pl_ru *)notify, msgid);
-		break;
-#endif
-	default:
-	    {
-		/* XXX there is a potential of dos attack. */
-		if(type >= ISAKMP_NTYPE_MINERROR &&
-		   type <= ISAKMP_NTYPE_MAXERROR) {
-			if (msgid == 0) {
-				/* don't think this realy deletes ph1 ? */
-				plog(LLV_ERROR, LOCATION, iph1->remote,
-					"delete phase1 handle.\n");
-				return -1;
-			} else {
-				if (getph2bymsgid(iph1, msgid) == NULL) {
-					plog(LLV_ERROR, LOCATION, iph1->remote,
-						"fatal %s notify messsage, "
-						"phase1 should be deleted.\n",
-						s_isakmp_notify_msg(type));
-				} else {
-					plog(LLV_ERROR, LOCATION, iph1->remote,
-						"fatal %s notify messsage, "
-						"phase2 should be deleted.\n",
-						s_isakmp_notify_msg(type));
-				}
-			}
-		} else {
-			plog(LLV_ERROR, LOCATION, iph1->remote,
-				"unhandled notify message %s, "
-				"no phase2 handle found.\n",
-				s_isakmp_notify_msg(type));
-		}
-	    }
-	    break;
-	}
-
-	/* get spi if specified and allocate */
-	if(notify->spi_size > 0) {
-		if (ntohs(notify->h.len) < sizeof(*notify) + notify->spi_size) {
-			plog(LLV_ERROR, LOCATION, iph1->remote,
-				"invalid spi_size in notification payload.\n");
-			return -1;
-		}
-		spi = val2str((char *)(notify + 1), notify->spi_size);
-
-		plog(LLV_DEBUG, LOCATION, iph1->remote,
-			"notification message %d:%s, "
-			"doi=%d proto_id=%d spi=%s(size=%d).\n",
-			type, s_isakmp_notify_msg(type),
-			ntohl(notify->doi), notify->proto_id, spi, notify->spi_size);
-
-		racoon_free(spi);
-	}
-
-	/* Send the message data to the logs */
-	if(type >= ISAKMP_NTYPE_MINERROR &&
-	   type <= ISAKMP_NTYPE_MAXERROR) {
-		l = ntohs(notify->h.len) - sizeof(*notify) - notify->spi_size;
-		if (l > 0) {
-			nraw = (char*)notify;	
-			nraw += sizeof(*notify) + notify->spi_size;
-			ndata = binsanitize(nraw, l);
-			if (ndata != NULL) {
-				plog(LLV_ERROR, LOCATION, iph1->remote,
-				    "Message: '%s'.\n", 
-				    ndata);
-				racoon_free(ndata);
-			} else {
-				plog(LLV_ERROR, LOCATION, iph1->remote,
-				    "Cannot allocate memory\n");
-			}
-		}
-	}
-	return 0;
-}
-
-/*
- * handling of Deletion payload
- */
-static int
-isakmp_info_recv_d(iph1, delete, msgid, encrypted)
-	struct ph1handle *iph1;
-	struct isakmp_pl_d *delete;
-	u_int32_t msgid;
-	int encrypted;
-{
-	int tlen, num_spi;
-	vchar_t *pbuf;
-	int protected = 0;
-	struct ph1handle *del_ph1;
-	struct ph2handle *iph2;
-	union {
-		u_int32_t spi32;
-		u_int16_t spi16[2];
-	} spi;
-
-	if (ntohl(delete->doi) != IPSEC_DOI) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"delete payload with invalid doi:%d.\n",
-			ntohl(delete->doi));
-#ifdef ENABLE_HYBRID
-		/*
-		 * At deconnexion time, Cisco VPN client does this
-		 * with a zero DOI. Don't give up in that situation.
-		 */
-		if (((iph1->mode_cfg->flags &
-		    ISAKMP_CFG_VENDORID_UNITY) == 0) || (delete->doi != 0))
-			return 0;
-#else
-		return 0;
-#endif
-	}
-
-	num_spi = ntohs(delete->num_spi);
-	tlen = ntohs(delete->h.len) - sizeof(struct isakmp_pl_d);
-
-	if (tlen != num_spi * delete->spi_size) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"deletion payload with invalid length.\n");
-		return 0;
-	}
-
-	plog(LLV_DEBUG, LOCATION, iph1->remote,
-		"delete payload for protocol %s\n",
-		s_ipsecdoi_proto(delete->proto_id));
-
-	if(!iph1->rmconf->weak_phase1_check && !encrypted) {
-		plog(LLV_WARNING, LOCATION, iph1->remote,
-			"Ignoring unencrypted delete payload "
-			"(check the weak_phase1_check option)\n");
-		return 0;
-	}
-
-	switch (delete->proto_id) {
-	case IPSECDOI_PROTO_ISAKMP:
-		if (delete->spi_size != sizeof(isakmp_index)) {
-			plog(LLV_ERROR, LOCATION, iph1->remote,
-				"delete payload with strange spi "
-				"size %d(proto_id:%d)\n",
-				delete->spi_size, delete->proto_id);
-			return 0;
-		}
-
-		del_ph1=getph1byindex((isakmp_index *)(delete + 1));
-		if(del_ph1 != NULL){
-
-			EVT_PUSH(del_ph1->local, del_ph1->remote,
-			EVTT_PEERPH1_NOPROP, NULL);
-			if (del_ph1->scr)
-				SCHED_KILL(del_ph1->scr);
-
-			/*
-			 * Do not delete IPsec SAs when receiving an IKE delete notification.
-			 * Just delete the IKE SA.
-			 */
-			isakmp_ph1expire(del_ph1);
-		}
-		break;
-
-	case IPSECDOI_PROTO_IPSEC_AH:
-	case IPSECDOI_PROTO_IPSEC_ESP:
-		if (delete->spi_size != sizeof(u_int32_t)) {
-			plog(LLV_ERROR, LOCATION, iph1->remote,
-				"delete payload with strange spi "
-				"size %d(proto_id:%d)\n",
-				delete->spi_size, delete->proto_id);
-			return 0;
-		}
-		EVT_PUSH(iph1->local, iph1->remote, 
-		    EVTT_PEER_DELETE, NULL);
-		purge_ipsec_spi(iph1->remote, delete->proto_id,
-		    (u_int32_t *)(delete + 1), num_spi);
-		break;
-
-	case IPSECDOI_PROTO_IPCOMP:
-		/* need to handle both 16bit/32bit SPI */
-		memset(&spi, 0, sizeof(spi));
-		if (delete->spi_size == sizeof(spi.spi16[1])) {
-			memcpy(&spi.spi16[1], delete + 1,
-			    sizeof(spi.spi16[1]));
-		} else if (delete->spi_size == sizeof(spi.spi32))
-			memcpy(&spi.spi32, delete + 1, sizeof(spi.spi32));
-		else {
-			plog(LLV_ERROR, LOCATION, iph1->remote,
-				"delete payload with strange spi "
-				"size %d(proto_id:%d)\n",
-				delete->spi_size, delete->proto_id);
-			return 0;
-		}
-		purge_ipsec_spi(iph1->remote, delete->proto_id,
-		    &spi.spi32, num_spi);
-		break;
-
-	default:
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"deletion message received, "
-			"invalid proto_id: %d\n",
-			delete->proto_id);
-		return 0;
-	}
-
-	plog(LLV_DEBUG, LOCATION, NULL, "purged SAs.\n");
-
-	return 0;
-}
-
-/*
- * send Delete payload (for ISAKMP SA) in Informational exchange.
- */
-int
-isakmp_info_send_d1(iph1)
-	struct ph1handle *iph1;
-{
-	struct isakmp_pl_d *d;
-	vchar_t *payload = NULL;
-	int tlen;
-	int error = 0;
-
-	if (iph1->status != PHASE2ST_ESTABLISHED)
-		return 0;
-
-	/* create delete payload */
-
-	/* send SPIs of inbound SAs. */
-	/* XXX should send outbound SAs's ? */
-	tlen = sizeof(*d) + sizeof(isakmp_index);
-	payload = vmalloc(tlen);
-	if (payload == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-			"failed to get buffer for payload.\n");
-		return errno;
-	}
-
-	d = (struct isakmp_pl_d *)payload->v;
-	d->h.np = ISAKMP_NPTYPE_NONE;
-	d->h.len = htons(tlen);
-	d->doi = htonl(IPSEC_DOI);
-	d->proto_id = IPSECDOI_PROTO_ISAKMP;
-	d->spi_size = sizeof(isakmp_index);
-	d->num_spi = htons(1);
-	memcpy(d + 1, &iph1->index, sizeof(isakmp_index));
-
-	error = isakmp_info_send_common(iph1, payload,
-					ISAKMP_NPTYPE_D, 0);
-	vfree(payload);
-
-	return error;
-}
-
-/*
- * send Delete payload (for IPsec SA) in Informational exchange, based on
- * pfkey msg.  It sends always single SPI.
- */
-int
-isakmp_info_send_d2(iph2)
-	struct ph2handle *iph2;
-{
-	struct ph1handle *iph1;
-	struct saproto *pr;
-	struct isakmp_pl_d *d;
-	vchar_t *payload = NULL;
-	int tlen;
-	int error = 0;
-	u_int8_t *spi;
-
-	if (iph2->status != PHASE2ST_ESTABLISHED)
-		return 0;
-
-	/*
-	 * don't send delete information if there is no phase 1 handler.
-	 * It's nonsensical to negotiate phase 1 to send the information.
-	 */
-	iph1 = getph1byaddr(iph2->src, iph2->dst, 0);
-	if (iph1 == NULL){
-		plog(LLV_DEBUG2, LOCATION, NULL,
-			 "No ph1 handler found, could not send DELETE_SA\n");
-		return 0;
-	}
-
-	/* create delete payload */
-	for (pr = iph2->approval->head; pr != NULL; pr = pr->next) {
-
-		/* send SPIs of inbound SAs. */
-		/*
-		 * XXX should I send outbound SAs's ?
-		 * I send inbound SAs's SPI only at the moment because I can't
-		 * decode any more if peer send encoded packet without aware of
-		 * deletion of SA.  Outbound SAs don't come under the situation.
-		 */
-		tlen = sizeof(*d) + pr->spisize;
-		payload = vmalloc(tlen);
-		if (payload == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL, 
-				"failed to get buffer for payload.\n");
-			return errno;
-		}
-
-		d = (struct isakmp_pl_d *)payload->v;
-		d->h.np = ISAKMP_NPTYPE_NONE;
-		d->h.len = htons(tlen);
-		d->doi = htonl(IPSEC_DOI);
-		d->proto_id = pr->proto_id;
-		d->spi_size = pr->spisize;
-		d->num_spi = htons(1);
-		/*
-		 * XXX SPI bits are left-filled, for use with IPComp.
-		 * we should be switching to variable-length spi field...
-		 */
-		spi = (u_int8_t *)&pr->spi;
-		spi += sizeof(pr->spi);
-		spi -= pr->spisize;
-		memcpy(d + 1, spi, pr->spisize);
-
-		error = isakmp_info_send_common(iph1, payload,
-						ISAKMP_NPTYPE_D, 0);
-		vfree(payload);
-	}
-
-	return error;
-}
-
-/*
- * send Notification payload (for without ISAKMP SA) in Informational exchange
- */
-int
-isakmp_info_send_nx(isakmp, remote, local, type, data)
-	struct isakmp *isakmp;
-	struct sockaddr *remote, *local;
-	int type;
-	vchar_t *data;
-{
-	struct ph1handle *iph1 = NULL;
-	struct remoteconf *rmconf;
-	vchar_t *payload = NULL;
-	int tlen;
-	int error = -1;
-	struct isakmp_pl_n *n;
-	int spisiz = 0;		/* see below */
-
-	/* search appropreate configuration */
-	rmconf = getrmconf(remote);
-	if (rmconf == NULL) {
-		plog(LLV_ERROR, LOCATION, remote,
-			"no configuration found for peer address.\n");
-		goto end;
-	}
-
-	/* add new entry to isakmp status table. */
-	iph1 = newph1();
-	if (iph1 == NULL)
-		return -1;
-
-	memcpy(&iph1->index.i_ck, &isakmp->i_ck, sizeof(cookie_t));
-	isakmp_newcookie((char *)&iph1->index.r_ck, remote, local);
-	iph1->status = PHASE1ST_START;
-	iph1->rmconf = rmconf;
-	iph1->side = INITIATOR;
-	iph1->version = isakmp->v;
-	iph1->flags = 0;
-	iph1->msgid = 0;	/* XXX */
-#ifdef ENABLE_HYBRID
-	if ((iph1->mode_cfg = isakmp_cfg_mkstate()) == NULL)
-		goto end;
-#endif
-#ifdef ENABLE_FRAG
-	iph1->frag = 0;
-	iph1->frag_chain = NULL;
-#endif
-
-	/* copy remote address */
-	if (copy_ph1addresses(iph1, rmconf, remote, local) < 0)
-		goto end;
-
-	tlen = sizeof(*n) + spisiz;
-	if (data)
-		tlen += data->l;
-	payload = vmalloc(tlen);
-	if (payload == NULL) { 
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get buffer to send.\n");
-		goto end;
-	}
-
-	n = (struct isakmp_pl_n *)payload->v;
-	n->h.np = ISAKMP_NPTYPE_NONE;
-	n->h.len = htons(tlen);
-	n->doi = htonl(IPSEC_DOI);
-	n->proto_id = IPSECDOI_KEY_IKE;
-	n->spi_size = spisiz;
-	n->type = htons(type);
-	if (spisiz)
-		memset(n + 1, 0, spisiz);	/* XXX spisiz is always 0 */
-	if (data)
-		memcpy((caddr_t)(n + 1) + spisiz, data->v, data->l);
-
-	error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, 0);
-	vfree(payload);
-
-    end:
-	if (iph1 != NULL)
-		delph1(iph1);
-
-	return error;
-}
-
-/*
- * send Notification payload (for ISAKMP SA) in Informational exchange
- */
-int
-isakmp_info_send_n1(iph1, type, data)
-	struct ph1handle *iph1;
-	int type;
-	vchar_t *data;
-{
-	vchar_t *payload = NULL;
-	int tlen;
-	int error = 0;
-	struct isakmp_pl_n *n;
-	int spisiz;
-
-	/*
-	 * note on SPI size: which description is correct?  I have chosen
-	 * this to be 0.
-	 *
-	 * RFC2408 3.1, 2nd paragraph says: ISAKMP SA is identified by
-	 * Initiator/Responder cookie and SPI has no meaning, SPI size = 0.
-	 * RFC2408 3.1, first paragraph on page 40: ISAKMP SA is identified
-	 * by cookie and SPI has no meaning, 0 <= SPI size <= 16.
-	 * RFC2407 4.6.3.3, INITIAL-CONTACT is required to set to 16.
-	 */
-	if (type == ISAKMP_NTYPE_INITIAL_CONTACT)
-		spisiz = sizeof(isakmp_index);
-	else
-		spisiz = 0;
-
-	tlen = sizeof(*n) + spisiz;
-	if (data)
-		tlen += data->l;
-	payload = vmalloc(tlen);
-	if (payload == NULL) { 
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get buffer to send.\n");
-		return errno;
-	}
-
-	n = (struct isakmp_pl_n *)payload->v;
-	n->h.np = ISAKMP_NPTYPE_NONE;
-	n->h.len = htons(tlen);
-	n->doi = htonl(iph1->rmconf->doitype);
-	n->proto_id = IPSECDOI_PROTO_ISAKMP; /* XXX to be configurable ? */
-	n->spi_size = spisiz;
-	n->type = htons(type);
-	if (spisiz)
-		memcpy(n + 1, &iph1->index, sizeof(isakmp_index));
-	if (data)
-		memcpy((caddr_t)(n + 1) + spisiz, data->v, data->l);
-
-	error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, iph1->flags);
-	vfree(payload);
-
-	return error;
-}
-
-/*
- * send Notification payload (for IPsec SA) in Informational exchange
- */
-int
-isakmp_info_send_n2(iph2, type, data)
-	struct ph2handle *iph2;
-	int type;
-	vchar_t *data;
-{
-	struct ph1handle *iph1 = iph2->ph1;
-	vchar_t *payload = NULL;
-	int tlen;
-	int error = 0;
-	struct isakmp_pl_n *n;
-	struct saproto *pr;
-
-	if (!iph2->approval)
-		return EINVAL;
-
-	pr = iph2->approval->head;
-
-	/* XXX must be get proper spi */
-	tlen = sizeof(*n) + pr->spisize;
-	if (data)
-		tlen += data->l;
-	payload = vmalloc(tlen);
-	if (payload == NULL) { 
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get buffer to send.\n");
-		return errno;
-	}
-
-	n = (struct isakmp_pl_n *)payload->v;
-	n->h.np = ISAKMP_NPTYPE_NONE;
-	n->h.len = htons(tlen);
-	n->doi = htonl(IPSEC_DOI);		/* IPSEC DOI (1) */
-	n->proto_id = pr->proto_id;		/* IPSEC AH/ESP/whatever*/
-	n->spi_size = pr->spisize;
-	n->type = htons(type);
-	*(u_int32_t *)(n + 1) = pr->spi;
-	if (data)
-		memcpy((caddr_t)(n + 1) + pr->spisize, data->v, data->l);
-
-	iph2->flags |= ISAKMP_FLAG_E;	/* XXX Should we do FLAG_A ? */
-	error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, iph2->flags);
-	vfree(payload);
-
-	return error;
-}
-
-/*
- * send Information
- * When ph1->skeyid_a == NULL, send message without encoding.
- */
-int
-isakmp_info_send_common(iph1, payload, np, flags)
-	struct ph1handle *iph1;
-	vchar_t *payload;
-	u_int32_t np;
-	int flags;
-{
-	struct ph2handle *iph2 = NULL;
-	vchar_t *hash = NULL;
-	struct isakmp *isakmp;
-	struct isakmp_gen *gen;
-	char *p;
-	int tlen;
-	int error = -1;
-
-	/* add new entry to isakmp status table */
-	iph2 = newph2();
-	if (iph2 == NULL)
-		goto end;
-
-	iph2->dst = dupsaddr(iph1->remote);
-	if (iph2->dst == NULL) {
-		delph2(iph2);
-		goto end;
-	}
-	iph2->src = dupsaddr(iph1->local);
-	if (iph2->src == NULL) {
-		delph2(iph2);
-		goto end;
-	}
-#if (!defined(ENABLE_NATT)) || (defined(BROKEN_NATT))
-	if (set_port(iph2->dst, 0) == NULL ||
-	    set_port(iph2->src, 0) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		     "invalid family: %d\n", iph1->remote->sa_family);
-		delph2(iph2);
-		goto end;
-	}
-#endif
-	iph2->ph1 = iph1;
-	iph2->side = INITIATOR;
-	iph2->status = PHASE2ST_START;
-	iph2->msgid = isakmp_newmsgid2(iph1);
-
-	/* get IV and HASH(1) if skeyid_a was generated. */
-	if (iph1->skeyid_a != NULL) {
-		iph2->ivm = oakley_newiv2(iph1, iph2->msgid);
-		if (iph2->ivm == NULL) {
-			delph2(iph2);
-			goto end;
-		}
-
-		/* generate HASH(1) */
-		hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, payload);
-		if (hash == NULL) {
-			delph2(iph2);
-			goto end;
-		}
-
-		/* initialized total buffer length */
-		tlen = hash->l;
-		tlen += sizeof(*gen);
-	} else {
-		/* IKE-SA is not established */
-		hash = NULL;
-
-		/* initialized total buffer length */
-		tlen = 0;
-	}
-	if ((flags & ISAKMP_FLAG_A) == 0)
-		iph2->flags = (hash == NULL ? 0 : ISAKMP_FLAG_E);
-	else
-		iph2->flags = (hash == NULL ? 0 : ISAKMP_FLAG_A);
-
-	insph2(iph2);
-	bindph12(iph1, iph2);
-
-	tlen += sizeof(*isakmp) + payload->l;
-
-	/* create buffer for isakmp payload */
-	iph2->sendbuf = vmalloc(tlen);
-	if (iph2->sendbuf == NULL) { 
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get buffer to send.\n");
-		goto err;
-	}
-
-	/* create isakmp header */
-	isakmp = (struct isakmp *)iph2->sendbuf->v;
-	memcpy(&isakmp->i_ck, &iph1->index.i_ck, sizeof(cookie_t));
-	memcpy(&isakmp->r_ck, &iph1->index.r_ck, sizeof(cookie_t));
-	isakmp->np = hash == NULL ? (np & 0xff) : ISAKMP_NPTYPE_HASH;
-	isakmp->v = iph1->version;
-	isakmp->etype = ISAKMP_ETYPE_INFO;
-	isakmp->flags = iph2->flags;
-	memcpy(&isakmp->msgid, &iph2->msgid, sizeof(isakmp->msgid));
-	isakmp->len   = htonl(tlen);
-	p = (char *)(isakmp + 1);
-
-	/* create HASH payload */
-	if (hash != NULL) {
-		gen = (struct isakmp_gen *)p;
-		gen->np = np & 0xff;
-		gen->len = htons(sizeof(*gen) + hash->l);
-		p += sizeof(*gen);
-		memcpy(p, hash->v, hash->l);
-		p += hash->l;
-	}
-
-	/* add payload */
-	memcpy(p, payload->v, payload->l);
-	p += payload->l;
-
-#ifdef HAVE_PRINT_ISAKMP_C
-	isakmp_printpacket(iph2->sendbuf, iph1->local, iph1->remote, 1);
-#endif
-
-	/* encoding */
-	if (ISSET(isakmp->flags, ISAKMP_FLAG_E)) {
-		vchar_t *tmp;
-
-		tmp = oakley_do_encrypt(iph2->ph1, iph2->sendbuf, iph2->ivm->ive,
-				iph2->ivm->iv);
-		VPTRINIT(iph2->sendbuf);
-		if (tmp == NULL)
-			goto err;
-		iph2->sendbuf = tmp;
-	}
-
-	/* HDR*, HASH(1), N */
-	if (isakmp_send(iph2->ph1, iph2->sendbuf) < 0) {
-		VPTRINIT(iph2->sendbuf);
-		goto err;
-	}
-
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"sendto Information %s.\n", s_isakmp_nptype(np));
-
-	/*
-	 * don't resend notify message because peer can use Acknowledged
-	 * Informational if peer requires the reply of the notify message.
-	 */
-
-	/* XXX If Acknowledged Informational required, don't delete ph2handle */
-	error = 0;
-	VPTRINIT(iph2->sendbuf);
-	goto err;	/* XXX */
-
-end:
-	if (hash)
-		vfree(hash);
-	return error;
-
-err:
-	unbindph12(iph2);
-	remph2(iph2);
-	delph2(iph2);
-	goto end;
-}
-
-/*
- * add a notify payload to buffer by reallocating buffer.
- * If buf == NULL, the function only create a notify payload.
- *
- * XXX Which is SPI to be included, inbound or outbound ?
- */
-vchar_t *
-isakmp_add_pl_n(buf0, np_p, type, pr, data)
-	vchar_t *buf0;
-	u_int8_t **np_p;
-	int type;
-	struct saproto *pr;
-	vchar_t *data;
-{
-	vchar_t *buf = NULL;
-	struct isakmp_pl_n *n;
-	int tlen;
-	int oldlen = 0;
-
-	if (*np_p)
-		**np_p = ISAKMP_NPTYPE_N;
-
-	tlen = sizeof(*n) + pr->spisize;
-
-	if (data)
-		tlen += data->l;
-	if (buf0) {
-		oldlen = buf0->l;
-		buf = vrealloc(buf0, buf0->l + tlen);
-	} else
-		buf = vmalloc(tlen);
-	if (!buf) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get a payload buffer.\n");
-		return NULL;
-	}
-
-	n = (struct isakmp_pl_n *)(buf->v + oldlen);
-	n->h.np = ISAKMP_NPTYPE_NONE;
-	n->h.len = htons(tlen);
-	n->doi = htonl(IPSEC_DOI);		/* IPSEC DOI (1) */
-	n->proto_id = pr->proto_id;		/* IPSEC AH/ESP/whatever*/
-	n->spi_size = pr->spisize;
-	n->type = htons(type);
-	*(u_int32_t *)(n + 1) = pr->spi;	/* XXX */
-	if (data)
-		memcpy((caddr_t)(n + 1) + pr->spisize, data->v, data->l);
-
-	/* save the pointer of next payload type */
-	*np_p = &n->h.np;
-
-	return buf;
-}
-
-static void
-purge_isakmp_spi(proto, spi, n)
-	int proto;
-	isakmp_index *spi;	/*network byteorder*/
-	size_t n;
-{
-	struct ph1handle *iph1;
-	size_t i;
-
-	for (i = 0; i < n; i++) {
-		iph1 = getph1byindex(&spi[i]);
-		if (!iph1)
-			continue;
-
-		plog(LLV_INFO, LOCATION, NULL,
-			"purged ISAKMP-SA proto_id=%s spi=%s.\n",
-			s_ipsecdoi_proto(proto),
-			isakmp_pindex(&spi[i], 0));
-
-		SCHED_KILL(iph1->sce);
-		iph1->status = PHASE1ST_EXPIRED;
-		iph1->sce = sched_new(1, isakmp_ph1delete_stub, iph1);
-	}
-}
-
-
-
-void
-purge_ipsec_spi(dst0, proto, spi, n)
-	struct sockaddr *dst0;
-	int proto;
-	u_int32_t *spi;	/*network byteorder*/
-	size_t n;
-{
-	vchar_t *buf = NULL;
-	struct sadb_msg *msg, *next, *end;
-	struct sadb_sa *sa;
-	struct sadb_lifetime *lt;
-	struct sockaddr *src, *dst;
-	struct ph2handle *iph2;
-	u_int64_t created;
-	size_t i;
-	caddr_t mhp[SADB_EXT_MAX + 1];
-#ifdef ENABLE_NATT
-	struct sadb_x_nat_t_type *natt_type;
-	struct sadb_x_nat_t_port *natt_port;
-#endif
-
-	plog(LLV_DEBUG2, LOCATION, NULL,
-		 "purge_ipsec_spi:\n");
-	plog(LLV_DEBUG2, LOCATION, NULL, "dst0: %s\n", saddr2str(dst0));
-	plog(LLV_DEBUG2, LOCATION, NULL, "SPI: %08X\n", ntohl(spi[0]));
-
-	buf = pfkey_dump_sadb(ipsecdoi2pfkey_proto(proto));
-	if (buf == NULL) {
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"pfkey_dump_sadb returned nothing.\n");
-		return;
-	}
-
-	msg = (struct sadb_msg *)buf->v;
-	end = (struct sadb_msg *)(buf->v + buf->l);
-
-	while (msg < end) {
-		if ((msg->sadb_msg_len << 3) < sizeof(*msg))
-			break;
-		next = (struct sadb_msg *)((caddr_t)msg + (msg->sadb_msg_len << 3));
-		if (msg->sadb_msg_type != SADB_DUMP) {
-			msg = next;
-			continue;
-		}
-
-		if (pfkey_align(msg, mhp) || pfkey_check(mhp)) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"pfkey_check (%s)\n", ipsec_strerror());
-			msg = next;
-			continue;
-		}
-
-		sa = (struct sadb_sa *)(mhp[SADB_EXT_SA]);
-		if (!sa
-		 || !mhp[SADB_EXT_ADDRESS_SRC]
-		 || !mhp[SADB_EXT_ADDRESS_DST]) {
-			msg = next;
-			continue;
-		}
-		src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]);
-		dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]);
-		lt = (struct sadb_lifetime*)mhp[SADB_EXT_LIFETIME_HARD];
-		if(lt != NULL)
-			created = lt->sadb_lifetime_addtime;
-		else
-			created = 0;
-
-		if (sa->sadb_sa_state != SADB_SASTATE_MATURE
-		 && sa->sadb_sa_state != SADB_SASTATE_DYING) {
-			msg = next;
-			continue;
-		}
-#ifdef ENABLE_NATT
-		natt_type = (void *)mhp[SADB_X_EXT_NAT_T_TYPE];
-		if (natt_type && natt_type->sadb_x_nat_t_type_type) {
-			/* NAT-T is enabled for this SADB entry; copy
-			 * the ports from NAT-T extensions */
-			natt_port = (void *)mhp[SADB_X_EXT_NAT_T_SPORT];
-			if (extract_port(src) == 0 && natt_port != NULL)
-				set_port(src, ntohs(natt_port->sadb_x_nat_t_port_port));
-
-			natt_port = (void *)mhp[SADB_X_EXT_NAT_T_DPORT];
-			if (extract_port(dst) == 0 && natt_port != NULL)
-				set_port(dst, ntohs(natt_port->sadb_x_nat_t_port_port));
-		}else{
-			/* Force default UDP ports, so CMPSADDR will match SAs with NO encapsulation
-			 */
-			set_port(src, PORT_ISAKMP);
-			set_port(dst, PORT_ISAKMP);
-		}
-#endif
-		plog(LLV_DEBUG2, LOCATION, NULL, "src: %s\n", saddr2str(src));
-		plog(LLV_DEBUG2, LOCATION, NULL, "dst: %s\n", saddr2str(dst));
-
-		/* XXX n^2 algorithm, inefficient */
-
-		/* don't delete inbound SAs at the moment */
-		/* XXX should we remove SAs with opposite direction as well? */
-		if (CMPSADDR(dst0, dst)) {
-			msg = next;
-			continue;
-		}
-
-#ifdef ENABLE_NATT
-		if (natt_type == NULL ||
-			! natt_type->sadb_x_nat_t_type_type) {
-			/* Set back port to 0 if it was forced to default UDP port
-			 */
-			set_port(src, 0);
-			set_port(dst, 0);
-		}
-#endif
-		for (i = 0; i < n; i++) {
-			plog(LLV_DEBUG, LOCATION, NULL,
-				"check spi(packet)=%u spi(db)=%u.\n",
-				ntohl(spi[i]), ntohl(sa->sadb_sa_spi));
-			if (spi[i] != sa->sadb_sa_spi)
-				continue;
-
-			pfkey_send_delete(lcconf->sock_pfkey,
-				msg->sadb_msg_satype,
-				IPSEC_MODE_ANY,
-				src, dst, sa->sadb_sa_spi);
-
-			/*
-			 * delete a relative phase 2 handler.
-			 * continue to process if no relative phase 2 handler
-			 * exists.
-			 */
-			iph2 = getph2bysaidx(src, dst, proto, spi[i]);
-			if(iph2 != NULL){
-				delete_spd(iph2, created);
-				unbindph12(iph2);
-				remph2(iph2);
-				delph2(iph2);
-			}
-
-			plog(LLV_INFO, LOCATION, NULL,
-				"purged IPsec-SA proto_id=%s spi=%u.\n",
-				s_ipsecdoi_proto(proto),
-				ntohl(spi[i]));
-		}
-
-		msg = next;
-	}
-
-	if (buf)
-		vfree(buf);
-}
-
-/*
- * delete all phase2 sa relatived to the destination address.
- * Don't delete Phase 1 handlers on INITIAL-CONTACT, and don't ignore
- * an INITIAL-CONTACT if we have contacted the peer.  This matches the
- * Sun IKE behavior, and makes rekeying work much better when the peer
- * restarts.
- */
-static void
-info_recv_initialcontact(iph1)
-	struct ph1handle *iph1;
-{
-	vchar_t *buf = NULL;
-	struct sadb_msg *msg, *next, *end;
-	struct sadb_sa *sa;
-	struct sockaddr *src, *dst;
-	caddr_t mhp[SADB_EXT_MAX + 1];
-	int proto_id, i;
-	struct ph2handle *iph2;
-#if 0
-	char *loc, *rem;
-#endif
-
-	if (f_local)
-		return;
-
-#if 0
-	loc = racoon_strdup(saddrwop2str(iph1->local));
-	rem = racoon_strdup(saddrwop2str(iph1->remote));
-	STRDUP_FATAL(loc);
-	STRDUP_FATAL(rem);
-
-	/*
-	 * Purge all IPSEC-SAs for the peer.  We can do this
-	 * the easy way (using a PF_KEY SADB_DELETE extension)
-	 * or we can do it the hard way.
-	 */
-	for (i = 0; i < pfkey_nsatypes; i++) {
-		proto_id = pfkey2ipsecdoi_proto(pfkey_satypes[i].ps_satype);
-
-		plog(LLV_INFO, LOCATION, NULL,
-		    "purging %s SAs for %s -> %s\n",
-		    pfkey_satypes[i].ps_name, loc, rem);
-		if (pfkey_send_delete_all(lcconf->sock_pfkey,
-		    pfkey_satypes[i].ps_satype, IPSEC_MODE_ANY,
-		    iph1->local, iph1->remote) == -1) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "delete_all %s -> %s failed for %s (%s)\n",
-			    loc, rem,
-			    pfkey_satypes[i].ps_name, ipsec_strerror());
-			goto the_hard_way;
-		}
-
-		deleteallph2(iph1->local, iph1->remote, proto_id);
-
-		plog(LLV_INFO, LOCATION, NULL,
-		    "purging %s SAs for %s -> %s\n",
-		    pfkey_satypes[i].ps_name, rem, loc);
-		if (pfkey_send_delete_all(lcconf->sock_pfkey,
-		    pfkey_satypes[i].ps_satype, IPSEC_MODE_ANY,
-		    iph1->remote, iph1->local) == -1) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "delete_all %s -> %s failed for %s (%s)\n",
-			    rem, loc,
-			    pfkey_satypes[i].ps_name, ipsec_strerror());
-			goto the_hard_way;
-		}
-
-		deleteallph2(iph1->remote, iph1->local, proto_id);
-	}
-
-	racoon_free(loc);
-	racoon_free(rem);
-	return;
-
- the_hard_way:
-	racoon_free(loc);
-	racoon_free(rem);
-#endif
-
-	buf = pfkey_dump_sadb(SADB_SATYPE_UNSPEC);
-	if (buf == NULL) {
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"pfkey_dump_sadb returned nothing.\n");
-		return;
-	}
-
-	msg = (struct sadb_msg *)buf->v;
-	end = (struct sadb_msg *)(buf->v + buf->l);
-
-	while (msg < end) {
-		if ((msg->sadb_msg_len << 3) < sizeof(*msg))
-			break;
-		next = (struct sadb_msg *)((caddr_t)msg + (msg->sadb_msg_len << 3));
-		if (msg->sadb_msg_type != SADB_DUMP) {
-			msg = next;
-			continue;
-		}
-
-		if (pfkey_align(msg, mhp) || pfkey_check(mhp)) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"pfkey_check (%s)\n", ipsec_strerror());
-			msg = next;
-			continue;
-		}
-
-		if (mhp[SADB_EXT_SA] == NULL
-		 || mhp[SADB_EXT_ADDRESS_SRC] == NULL
-		 || mhp[SADB_EXT_ADDRESS_DST] == NULL) {
-			msg = next;
-			continue;
-		}
-		sa = (struct sadb_sa *)mhp[SADB_EXT_SA];
-		src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]);
-		dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]);
-
-		if (sa->sadb_sa_state != SADB_SASTATE_MATURE
-		 && sa->sadb_sa_state != SADB_SASTATE_DYING) {
-			msg = next;
-			continue;
-		}
-
-		/*
-		 * RFC2407 4.6.3.3 INITIAL-CONTACT is the message that
-		 * announces the sender of the message was rebooted.
-		 * it is interpreted to delete all SAs which source address
-		 * is the sender of the message.
-		 * racoon only deletes SA which is matched both the
-		 * source address and the destination accress.
-		 */
-#ifdef ENABLE_NATT
-		/* 
-		 * XXX RFC 3947 says that whe MUST NOT use IP+port to find old SAs
-		 * from this peer !
-		 */
-		if(iph1->natt_flags & NAT_DETECTED){
-			if (CMPSADDR(iph1->local, src) == 0 &&
-				CMPSADDR(iph1->remote, dst) == 0)
-				;
-			else if (CMPSADDR(iph1->remote, src) == 0 &&
-					 CMPSADDR(iph1->local, dst) == 0)
-				;
-			else {
-				msg = next;
-				continue;
-			}
-		} else
-#endif
-		/* If there is no NAT-T, we don't have to check addr + port...
-		 * XXX what about a configuration with a remote peers which is not
-		 * NATed, but which NATs some other peers ?
-		 * Here, the INITIAl-CONTACT would also flush all those NATed peers !!
-		 */
-		if (cmpsaddrwop(iph1->local, src) == 0 &&
-		    cmpsaddrwop(iph1->remote, dst) == 0)
-			;
-		else if (cmpsaddrwop(iph1->remote, src) == 0 &&
-		    cmpsaddrwop(iph1->local, dst) == 0)
-			;
-		else {
-			msg = next;
-			continue;
-		}
-
-		/*
-		 * Make sure this is an SATYPE that we manage.
-		 * This is gross; too bad we couldn't do it the
-		 * easy way.
-		 */
-		for (i = 0; i < pfkey_nsatypes; i++) {
-			if (pfkey_satypes[i].ps_satype ==
-			    msg->sadb_msg_satype)
-				break;
-		}
-		if (i == pfkey_nsatypes) {
-			msg = next;
-			continue;
-		}
-
-		plog(LLV_INFO, LOCATION, NULL,
-			"purging spi=%u.\n", ntohl(sa->sadb_sa_spi));
-		pfkey_send_delete(lcconf->sock_pfkey,
-			msg->sadb_msg_satype,
-			IPSEC_MODE_ANY, src, dst, sa->sadb_sa_spi);
-
-		/*
-		 * delete a relative phase 2 handler.
-		 * continue to process if no relative phase 2 handler
-		 * exists.
-		 */
-		proto_id = pfkey2ipsecdoi_proto(msg->sadb_msg_satype);
-		iph2 = getph2bysaidx(src, dst, proto_id, sa->sadb_sa_spi);
-		if (iph2) {
-			delete_spd(iph2, 0);
-			unbindph12(iph2);
-			remph2(iph2);
-			delph2(iph2);
-		}
-
-		msg = next;
-	}
-
-	vfree(buf);
-}
-
-void
-isakmp_check_notify(gen, iph1)
-	struct isakmp_gen *gen;		/* points to Notify payload */
-	struct ph1handle *iph1;
-{
-	struct isakmp_pl_n *notify = (struct isakmp_pl_n *)gen;
-
-	plog(LLV_DEBUG, LOCATION, iph1->remote,
-		"Notify Message received\n");
-
-	switch (ntohs(notify->type)) {
-	case ISAKMP_NTYPE_CONNECTED:
-	case ISAKMP_NTYPE_RESPONDER_LIFETIME:
-	case ISAKMP_NTYPE_REPLAY_STATUS:
-	case ISAKMP_NTYPE_HEARTBEAT:
-#ifdef ENABLE_HYBRID
-	case ISAKMP_NTYPE_UNITY_HEARTBEAT:
-#endif
-		plog(LLV_WARNING, LOCATION, iph1->remote,
-			"ignore %s notification.\n",
-			s_isakmp_notify_msg(ntohs(notify->type)));
-		break;
-	case ISAKMP_NTYPE_INITIAL_CONTACT:
-		plog(LLV_WARNING, LOCATION, iph1->remote,
-			"ignore INITIAL-CONTACT notification, "
-			"because it is only accepted after phase1.\n");
-		break;
-	default:
-		isakmp_info_send_n1(iph1, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE, NULL);
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"received unknown notification type %s.\n",
-			s_isakmp_notify_msg(ntohs(notify->type)));
-	}
-
-	return;
-}
-
-
-#ifdef ENABLE_DPD
-static int
-isakmp_info_recv_r_u (iph1, ru, msgid)
-	struct ph1handle *iph1;
-	struct isakmp_pl_ru *ru;
-	u_int32_t msgid;
-{
-	struct isakmp_pl_ru *ru_ack;
-	vchar_t *payload = NULL;
-	int tlen;
-	int error = 0;
-
-	plog(LLV_DEBUG, LOCATION, iph1->remote,
-		 "DPD R-U-There received\n");
-
-	/* XXX should compare cookies with iph1->index?
-	   Or is this already done by calling function?  */
-	tlen = sizeof(*ru_ack);
-	payload = vmalloc(tlen);
-	if (payload == NULL) { 
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get buffer to send.\n");
-		return errno;
-	}
-
-	ru_ack = (struct isakmp_pl_ru *)payload->v;
-	ru_ack->h.np = ISAKMP_NPTYPE_NONE;
-	ru_ack->h.len = htons(tlen);
-	ru_ack->doi = htonl(IPSEC_DOI);
-	ru_ack->type = htons(ISAKMP_NTYPE_R_U_THERE_ACK);
-	ru_ack->proto_id = IPSECDOI_PROTO_ISAKMP; /* XXX ? */
-	ru_ack->spi_size = sizeof(isakmp_index);
-	memcpy(ru_ack->i_ck, ru->i_ck, sizeof(cookie_t));
-	memcpy(ru_ack->r_ck, ru->r_ck, sizeof(cookie_t));	
-	ru_ack->data = ru->data;
-
-	/* XXX Should we do FLAG_A ?  */
-	error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N,
-					ISAKMP_FLAG_E);
-	vfree(payload);
-
-	plog(LLV_DEBUG, LOCATION, NULL, "received a valid R-U-THERE, ACK sent\n");
-
-	/* Should we mark tunnel as active ? */
-	return error;
-}
-
-static int
-isakmp_info_recv_r_u_ack (iph1, ru, msgid)
-	struct ph1handle *iph1;
-	struct isakmp_pl_ru *ru;
-	u_int32_t msgid;
-{
-
-	plog(LLV_DEBUG, LOCATION, iph1->remote,
-		 "DPD R-U-There-Ack received\n");
-
-	/* XXX Maintain window of acceptable sequence numbers ?
-	 * => ru->data <= iph2->dpd_seq &&
-	 *    ru->data >= iph2->dpd_seq - iph2->dpd_fails ? */
-	if (ntohl(ru->data) != iph1->dpd_seq-1) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			 "Wrong DPD sequence number (%d, %d expected).\n", 
-			 ntohl(ru->data), iph1->dpd_seq-1);
-		return 0;
-	}
-
-	if (memcmp(ru->i_ck, iph1->index.i_ck, sizeof(cookie_t)) ||
-	    memcmp(ru->r_ck, iph1->index.r_ck, sizeof(cookie_t))) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			 "Cookie mismatch in DPD ACK!.\n");
-		return 0;
-	}
-
-	iph1->dpd_fails = 0;
-
-	/* Useless ??? */
-	iph1->dpd_lastack = time(NULL);
-
-	SCHED_KILL(iph1->dpd_r_u);
-
-	isakmp_sched_r_u(iph1, 0);
-
-	plog(LLV_DEBUG, LOCATION, NULL, "received an R-U-THERE-ACK\n");
-
-	return 0;
-}
-
-
-
-
-/*
- * send DPD R-U-THERE payload in Informational exchange.
- */
-static void
-isakmp_info_send_r_u(arg)
-	void *arg;
-{
-	struct ph1handle *iph1 = arg;
-
-	/* create R-U-THERE payload */
-	struct isakmp_pl_ru *ru;
-	vchar_t *payload = NULL;
-	int tlen;
-	int error = 0;
-
-	plog(LLV_DEBUG, LOCATION, iph1->remote, "DPD monitoring....\n");
-
-	iph1->dpd_r_u=NULL;
-
-	if (iph1->dpd_fails >= iph1->rmconf->dpd_maxfails) {
-
-		plog(LLV_INFO, LOCATION, iph1->remote,
-			"DPD: remote (ISAKMP-SA spi=%s) seems to be dead.\n",
-			isakmp_pindex(&iph1->index, 0));
-
-		EVT_PUSH(iph1->local, iph1->remote, EVTT_DPD_TIMEOUT, NULL);
-		purge_remote(iph1);
-
-		/* Do not reschedule here: phase1 is deleted,
-		 * DPD will be reactivated when a new ph1 will be negociated
-		 */
-		return;
-	}
-
-	/* TODO: check recent activity to avoid useless sends... */
-
-	tlen = sizeof(*ru);
-	payload = vmalloc(tlen);
-	if (payload == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-			 "failed to get buffer for payload.\n");
-		return;
-	}
-	ru = (struct isakmp_pl_ru *)payload->v;
-	ru->h.np = ISAKMP_NPTYPE_NONE;
-	ru->h.len = htons(tlen);
-	ru->doi = htonl(IPSEC_DOI);
-	ru->type = htons(ISAKMP_NTYPE_R_U_THERE);
-	ru->proto_id = IPSECDOI_PROTO_ISAKMP; /* XXX ?*/
-	ru->spi_size = sizeof(isakmp_index);
-
-	memcpy(ru->i_ck, iph1->index.i_ck, sizeof(cookie_t));
-	memcpy(ru->r_ck, iph1->index.r_ck, sizeof(cookie_t));
-
-	if (iph1->dpd_seq == 0){
-		/* generate a random seq which is not too big */
-		srand(time(NULL));
-		iph1->dpd_seq = rand() & 0x0fff;
-	}
-
-	ru->data = htonl(iph1->dpd_seq);
-
-	error = isakmp_info_send_common(iph1, payload, ISAKMP_NPTYPE_N, 0);
-	vfree(payload);
-
-	plog(LLV_DEBUG, LOCATION, iph1->remote,
-		 "DPD R-U-There sent (%d)\n", error);
-
-	/* will be decreased if ACK received... */
-	iph1->dpd_fails++;
-
-	/* XXX should be increased only when ACKed ? */
-	iph1->dpd_seq++;
-
-	/* Reschedule the r_u_there with a short delay,
-	 * will be deleted/rescheduled if ACK received before */
-	isakmp_sched_r_u(iph1, 1);
-
-	plog(LLV_DEBUG, LOCATION, iph1->remote,
-		 "rescheduling send_r_u (%d).\n", iph1->rmconf->dpd_retry);
-}
-
-/* Schedule a new R-U-THERE */
-int
-isakmp_sched_r_u(iph1, retry)
-	struct ph1handle *iph1;
-	int retry;
-{
-	if(iph1 == NULL ||
-	   iph1->rmconf == NULL)
-		return 1;
-
-
-	if(iph1->dpd_support == 0 ||
-	   iph1->rmconf->dpd_interval == 0)
-		return 0;
-
-	if(retry)
-		iph1->dpd_r_u = sched_new(iph1->rmconf->dpd_retry,
-								  isakmp_info_send_r_u, iph1);
-	else
-		iph1->dpd_r_u = sched_new(iph1->rmconf->dpd_interval,
-								  isakmp_info_send_r_u, iph1);
-
-	return 0;
-}
-#endif
diff --git a/src/racoon/isakmp_inf.h b/src/racoon/isakmp_inf.h
deleted file mode 100644
index c7682d9..0000000
--- a/src/racoon/isakmp_inf.h
+++ /dev/null
@@ -1,60 +0,0 @@
-/*	$NetBSD: isakmp_inf.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/* Id: isakmp_inf.h,v 1.6 2005/05/07 14:15:59 manubsd Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _ISAKMP_INF_H
-#define _ISAKMP_INF_H
-
-struct saproto;
-extern int isakmp_info_recv __P((struct ph1handle *, vchar_t *));
-extern int isakmp_info_send_d1 __P((struct ph1handle *));
-extern int isakmp_info_send_d2 __P((struct ph2handle *));
-extern int isakmp_info_send_nx __P((struct isakmp *,
-	struct sockaddr *, struct sockaddr *, int, vchar_t *));
-extern int isakmp_info_send_n1 __P((struct ph1handle *, int, vchar_t *));
-extern int isakmp_info_send_n2 __P((struct ph2handle *, int, vchar_t *));
-extern int isakmp_info_send_common __P((struct ph1handle *,
-	vchar_t *, u_int32_t, int));
-
-extern vchar_t * isakmp_add_pl_n __P((vchar_t *, u_int8_t **, int,
-	struct saproto *, vchar_t *));
-
-extern void isakmp_check_notify __P((struct isakmp_gen *, struct ph1handle *));
-
-#ifdef ENABLE_DPD
-extern int isakmp_sched_r_u __P((struct ph1handle *, int));
-#endif
-
-extern void purge_ipsec_spi __P((struct sockaddr *, int,	u_int32_t *, size_t));
-extern int tunnel_mode_prop __P((struct saprop *));
-
-#endif /* _ISAKMP_INF_H */
diff --git a/src/racoon/isakmp_newg.c b/src/racoon/isakmp_newg.c
deleted file mode 100644
index 85b91b9..0000000
--- a/src/racoon/isakmp_newg.c
+++ /dev/null
@@ -1,232 +0,0 @@
-/*	$NetBSD: isakmp_newg.c,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/*	$KAME: isakmp_newg.c,v 1.10 2002/09/27 05:55:52 itojun Exp $	*/
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-
-#include "var.h"
-#include "misc.h"
-#include "vmbuf.h"
-#include "plog.h"
-#include "sockmisc.h"
-#include "debug.h"
-
-#include "schedule.h"
-#include "cfparse_proto.h"
-#include "isakmp_var.h"
-#include "isakmp.h"
-#include "isakmp_newg.h"
-#include "oakley.h"
-#include "ipsec_doi.h"
-#include "crypto_openssl.h"
-#include "handler.h"
-#include "pfkey.h"
-#include "admin.h"
-#include "str2val.h"
-#include "vendorid.h"
-
-/*
- * New group mode as responder
- */
-int
-isakmp_newgroup_r(iph1, msg)
-	struct ph1handle *iph1;
-	vchar_t *msg;
-{
-#if 0
-	struct isakmp *isakmp = (struct isakmp *)msg->v;
-	struct isakmp_pl_hash *hash = NULL;
-	struct isakmp_pl_sa *sa = NULL;
-	int error = -1;
-	vchar_t *buf;
-	struct oakley_sa *osa;
-	int len;
-
-	/* validate the type of next payload */
-	/*
-	 * ISAKMP_ETYPE_NEWGRP,
-	 * ISAKMP_NPTYPE_HASH, (ISAKMP_NPTYPE_VID), ISAKMP_NPTYPE_SA,
-	 * ISAKMP_NPTYPE_NONE
-	 */
-    {
-	vchar_t *pbuf = NULL;
-	struct isakmp_parse_t *pa;
-
-	if ((pbuf = isakmp_parse(msg)) == NULL)
-		goto end;
-
-	for (pa = (struct isakmp_parse_t *)pbuf->v;
-	     pa->type != ISAKMP_NPTYPE_NONE;
-	     pa++) {
-
-		switch (pa->type) {
-		case ISAKMP_NPTYPE_HASH:
-			if (hash) {
-				isakmp_info_send_n1(iph1, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE, NULL);
-				plog(LLV_ERROR, LOCATION, iph1->remote,
-					"received multiple payload type %d.\n",
-					pa->type);
-				vfree(pbuf);
-				goto end;
-			}
-			hash = (struct isakmp_pl_hash *)pa->ptr;
-			break;
-		case ISAKMP_NPTYPE_SA:
-			if (sa) {
-				isakmp_info_send_n1(iph1, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE, NULL);
-				plog(LLV_ERROR, LOCATION, iph1->remote,
-					"received multiple payload type %d.\n",
-					pa->type);
-				vfree(pbuf);
-				goto end;
-			}
-			sa = (struct isakmp_pl_sa *)pa->ptr;
-			break;
-		case ISAKMP_NPTYPE_VID:
-			handle_vendorid(iph1, pa->ptr);
-			break;
-		default:
-			isakmp_info_send_n1(iph1, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE, NULL);
-			plog(LLV_ERROR, LOCATION, iph1->remote,
-				"ignore the packet, "
-				"received unexpecting payload type %d.\n",
-				pa->type);
-			vfree(pbuf);
-			goto end;
-		}
-	}
-	vfree(pbuf);
-
-	if (!hash || !sa) {
-		isakmp_info_send_n1(iph1, ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE, NULL);
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"no HASH, or no SA payload.\n");
-		goto end;
-	}
-    }
-
-	/* validate HASH */
-    {
-	char *r_hash;
-	vchar_t *my_hash = NULL;
-	int result;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "validate HASH\n");
-
-	len = sizeof(isakmp->msgid) + ntohs(sa->h.len);
-	buf = vmalloc(len);
-	if (buf == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get buffer to send.\n");
-		goto end;
-	}
-	memcpy(buf->v, &isakmp->msgid, sizeof(isakmp->msgid));
-	memcpy(buf->v + sizeof(isakmp->msgid), sa, ntohs(sa->h.len));
-
-	plog(LLV_DEBUG, LOCATION, NULL, "hash source\n");
-	plogdump(LLV_DEBUG, buf->v, buf->l);
-
-	my_hash = isakmp_prf(iph1->skeyid_a, buf, iph1);
-	vfree(buf);
-	if (my_hash == NULL)
-		goto end;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "hash result\n");
-	plogdump(LLV_DEBUG, my_hash->v, my_hash->l);
-
-	r_hash = (char *)hash + sizeof(*hash);
-
-	plog(LLV_DEBUG, LOCATION, NULL, "original hash\n"));
-	plogdump(LLV_DEBUG, r_hash, ntohs(hash->h.len) - sizeof(*hash)));
-
-	result = memcmp(my_hash->v, r_hash, my_hash->l);
-	vfree(my_hash);
-
-	if (result) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"HASH mismatch.\n");
-		isakmp_info_send_n1(iph1, ISAKMP_NTYPE_INVALID_HASH_INFORMATION, NULL);
-		goto end;
-	}
-    }
-
-	/* check SA payload and get new one for use */
-	buf = ipsecdoi_get_proposal((struct ipsecdoi_sa *)sa,
-					OAKLEY_NEWGROUP_MODE);
-	if (buf == NULL) {
-		isakmp_info_send_n1(iph1, ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED, NULL);
-		goto end;
-	}
-
-	/* save sa parameters */
-	osa = ipsecdoi_get_oakley(buf);
-	if (osa == NULL) {
-		isakmp_info_send_n1(iph1, ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED, NULL);
-		goto end;
-	}
-	vfree(buf);
-
-	switch (osa->dhgrp) {
-	case OAKLEY_ATTR_GRP_DESC_MODP768:
-	case OAKLEY_ATTR_GRP_DESC_MODP1024:
-	case OAKLEY_ATTR_GRP_DESC_MODP1536:
-		/*XXX*/
-	default:
-		isakmp_info_send_n1(iph1, ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED, NULL);
-		plog(LLV_ERROR, LOCATION, NULL,
-			"dh group %d isn't supported.\n", osa->dhgrp);
-		goto end;
-	}
-
-	plog(LLV_INFO, LOCATION, iph1->remote,
-		"got new dh group %s.\n", isakmp_pindex(&iph1->index, 0));
-
-	error = 0;
-
-end:
-	if (error) {
-		if (iph1 != NULL)
-			(void)isakmp_free_ph1(iph1);
-	}
-	return error;
-#endif
-	return 0;
-}
-
diff --git a/src/racoon/isakmp_newg.h b/src/racoon/isakmp_newg.h
deleted file mode 100644
index 1562c41..0000000
--- a/src/racoon/isakmp_newg.h
+++ /dev/null
@@ -1,39 +0,0 @@
-/*	$NetBSD: isakmp_newg.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/* Id: isakmp_newg.h,v 1.3 2004/06/11 16:00:16 ludvigm Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _ISAKMP_NEWG_H
-#define _ISAKMP_NEWG_H
-
-extern int isakmp_newgroup_r __P((struct ph1handle *, vchar_t *));
-
-#endif /* _ISAKMP_NEWG_H */
diff --git a/src/racoon/isakmp_quick.c b/src/racoon/isakmp_quick.c
deleted file mode 100644
index 963438d..0000000
--- a/src/racoon/isakmp_quick.c
+++ /dev/null
@@ -1,2189 +0,0 @@
-/*	$NetBSD: isakmp_quick.c,v 1.11.4.1 2007/08/01 11:52:21 vanhu Exp $	*/
-
-/* Id: isakmp_quick.c,v 1.29 2006/08/22 18:17:17 manubsd Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/socket.h>
-
-#include <netinet/in.h>
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-#if TIME_WITH_SYS_TIME
-# include <sys/time.h>
-# include <time.h>
-#else
-# if HAVE_SYS_TIME_H
-#  include <sys/time.h>
-# else
-#  include <time.h>
-# endif
-#endif
-#ifdef ENABLE_HYBRID
-#include <resolv.h>
-#endif
-
-#include PATH_IPSEC_H
-
-#include "var.h"
-#include "vmbuf.h"
-#include "schedule.h"
-#include "misc.h"
-#include "plog.h"
-#include "debug.h"
-
-#include "localconf.h"
-#include "remoteconf.h"
-#include "handler.h"
-#include "policy.h"
-#include "proposal.h"
-#include "isakmp_var.h"
-#include "isakmp.h"
-#include "isakmp_inf.h"
-#include "isakmp_quick.h"
-#include "oakley.h"
-#include "ipsec_doi.h"
-#include "crypto_openssl.h"
-#include "pfkey.h"
-#include "policy.h"
-#include "algorithm.h"
-#include "sockmisc.h"
-#include "proposal.h"
-#include "sainfo.h"
-#include "admin.h"
-#include "strnames.h"
-
-/* quick mode */
-static vchar_t *quick_ir1mx __P((struct ph2handle *, vchar_t *, vchar_t *));
-static int get_sainfo_r __P((struct ph2handle *));
-static int get_proposal_r __P((struct ph2handle *));
-
-/* %%%
- * Quick Mode
- */
-/*
- * begin Quick Mode as initiator.  send pfkey getspi message to kernel.
- */
-int
-quick_i1prep(iph2, msg)
-	struct ph2handle *iph2;
-	vchar_t *msg; /* must be null pointer */
-{
-	int error = ISAKMP_INTERNAL_ERROR;
-
-	/* validity check */
-	if (iph2->status != PHASE2ST_STATUS2) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph2->status);
-		goto end;
-	}
-
-	iph2->msgid = isakmp_newmsgid2(iph2->ph1);
-	iph2->ivm = oakley_newiv2(iph2->ph1, iph2->msgid);
-	if (iph2->ivm == NULL)
-		return 0;
-
-	iph2->status = PHASE2ST_GETSPISENT;
-
-	/* don't anything if local test mode. */
-	if (f_local) {
-		error = 0;
-		goto end;
-	}
-
-	/* send getspi message */
-	if (pk_sendgetspi(iph2) < 0)
-		goto end;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "pfkey getspi sent.\n");
-
-	iph2->sce = sched_new(lcconf->wait_ph2complete,
-		pfkey_timeover_stub, iph2);
-
-	error = 0;
-
-end:
-	return error;
-}
-
-/*
- * send to responder
- * 	HDR*, HASH(1), SA, Ni [, KE ] [, IDi2, IDr2 ]
- */
-int
-quick_i1send(iph2, msg)
-	struct ph2handle *iph2;
-	vchar_t *msg; /* must be null pointer */
-{
-	vchar_t *body = NULL;
-	vchar_t *hash = NULL;
-	struct isakmp_gen *gen;
-	char *p;
-	int tlen;
-	int error = ISAKMP_INTERNAL_ERROR;
-	int pfsgroup, idci, idcr;
-	int np;
-	struct ipsecdoi_id_b *id, *id_p;
-
-	/* validity check */
-	if (msg != NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"msg has to be NULL in this function.\n");
-		goto end;
-	}
-	if (iph2->status != PHASE2ST_GETSPIDONE) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph2->status);
-		goto end;
-	}
-
-	/* create SA payload for my proposal */
-	if (ipsecdoi_setph2proposal(iph2) < 0)
-		goto end;
-
-	/* generate NONCE value */
-	iph2->nonce = eay_set_random(iph2->ph1->rmconf->nonce_size);
-	if (iph2->nonce == NULL)
-		goto end;
-
-	/*
-	 * DH value calculation is kicked out into cfparse.y.
-	 * because pfs group can not be negotiated, it's only to be checked
-	 * acceptable.
-	 */
-	/* generate KE value if need */
-	pfsgroup = iph2->proposal->pfs_group;
-	if (pfsgroup) {
-		/* DH group settting if PFS is required. */
-		if (oakley_setdhgroup(pfsgroup, &iph2->pfsgrp) < 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to set DH value.\n");
-			goto end;
-		}
-		if (oakley_dh_generate(iph2->pfsgrp,
-				&iph2->dhpub, &iph2->dhpriv) < 0) {
-			goto end;
-		}
-	}
-
-	/* generate ID value */
-	if (ipsecdoi_setid2(iph2) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get ID.\n");
-		goto end;
-	}
-	plog(LLV_DEBUG, LOCATION, NULL, "IDci:\n");
-	plogdump(LLV_DEBUG, iph2->id->v, iph2->id->l);
-	plog(LLV_DEBUG, LOCATION, NULL, "IDcr:\n");
-	plogdump(LLV_DEBUG, iph2->id_p->v, iph2->id_p->l);
-
-	/*
-	 * we do not attach IDci nor IDcr, under the following condition:
-	 * - all proposals are transport mode
-	 * - no MIP6 or proxy
-	 * - id payload suggests to encrypt all the traffic (no specific
-	 *   protocol type)
-	 */
-	id = (struct ipsecdoi_id_b *)iph2->id->v;
-	id_p = (struct ipsecdoi_id_b *)iph2->id_p->v;
-	if (id->proto_id == 0
-	 && id_p->proto_id == 0
-	 && iph2->ph1->rmconf->support_proxy == 0
-	 && ipsecdoi_transportmode(iph2->proposal)) {
-		idci = idcr = 0;
-	} else
-		idci = idcr = 1;
-
-	/* create SA;NONCE payload, and KE if need, and IDii, IDir. */
-	tlen = + sizeof(*gen) + iph2->sa->l
-		+ sizeof(*gen) + iph2->nonce->l;
-	if (pfsgroup)
-		tlen += (sizeof(*gen) + iph2->dhpub->l);
-	if (idci)
-		tlen += sizeof(*gen) + iph2->id->l;
-	if (idcr)
-		tlen += sizeof(*gen) + iph2->id_p->l;
-
-	body = vmalloc(tlen);
-	if (body == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get buffer to send.\n");
-		goto end;
-	}
-
-	p = body->v;
-
-	/* add SA payload */
-	p = set_isakmp_payload(p, iph2->sa, ISAKMP_NPTYPE_NONCE);
-
-	/* add NONCE payload */
-	if (pfsgroup)
-		np = ISAKMP_NPTYPE_KE;
-	else if (idci || idcr)
-		np = ISAKMP_NPTYPE_ID;
-	else
-		np = ISAKMP_NPTYPE_NONE;
-	p = set_isakmp_payload(p, iph2->nonce, np);
-
-	/* add KE payload if need. */
-	np = (idci || idcr) ? ISAKMP_NPTYPE_ID : ISAKMP_NPTYPE_NONE;
-	if (pfsgroup)
-		p = set_isakmp_payload(p, iph2->dhpub, np);
-
-	/* IDci */
-	np = (idcr) ? ISAKMP_NPTYPE_ID : ISAKMP_NPTYPE_NONE;
-	if (idci)
-		p = set_isakmp_payload(p, iph2->id, np);
-
-	/* IDcr */
-	if (idcr)
-		p = set_isakmp_payload(p, iph2->id_p, ISAKMP_NPTYPE_NONE);
-
-	/* generate HASH(1) */
-	hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, body);
-	if (hash == NULL)
-		goto end;
-
-	/* send isakmp payload */
-	iph2->sendbuf = quick_ir1mx(iph2, body, hash);
-	if (iph2->sendbuf == NULL)
-		goto end;
-
-	/* send the packet, add to the schedule to resend */
-	iph2->retry_counter = iph2->ph1->rmconf->retry_counter;
-	if (isakmp_ph2resend(iph2) == -1)
-		goto end;
-
-	/* change status of isakmp status entry */
-	iph2->status = PHASE2ST_MSG1SENT;
-
-	error = 0;
-
-end:
-	if (body != NULL)
-		vfree(body);
-	if (hash != NULL)
-		vfree(hash);
-
-	return error;
-}
-
-/*
- * receive from responder
- * 	HDR*, HASH(2), SA, Nr [, KE ] [, IDi2, IDr2 ]
- */
-int
-quick_i2recv(iph2, msg0)
-	struct ph2handle *iph2;
-	vchar_t *msg0;
-{
-	vchar_t *msg = NULL;
-	vchar_t *hbuf = NULL;	/* for hash computing. */
-	vchar_t *pbuf = NULL;	/* for payload parsing */
-	struct isakmp_parse_t *pa;
-	struct isakmp *isakmp = (struct isakmp *)msg0->v;
-	struct isakmp_pl_hash *hash = NULL;
-	int f_id;
-	char *p;
-	int tlen;
-	int error = ISAKMP_INTERNAL_ERROR;
-
-	/* validity check */
-	if (iph2->status != PHASE2ST_MSG1SENT) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph2->status);
-		goto end;
-	}
-
-	/* decrypt packet */
-	if (!ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E)) {
-		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-			"Packet wasn't encrypted.\n");
-		goto end;
-	}
-	msg = oakley_do_decrypt(iph2->ph1, msg0, iph2->ivm->iv, iph2->ivm->ive);
-	if (msg == NULL)
-		goto end;
-
-	/* create buffer for validating HASH(2) */
-	/*
-	 * ordering rule:
-	 *	1. the first one must be HASH
-	 *	2. the second one must be SA (added in isakmp-oakley-05!)
-	 *	3. two IDs must be considered as IDci, then IDcr
-	 */
-	pbuf = isakmp_parse(msg);
-	if (pbuf == NULL)
-		goto end;
-	pa = (struct isakmp_parse_t *)pbuf->v;
-
-	/* HASH payload is fixed postion */
-	if (pa->type != ISAKMP_NPTYPE_HASH) {
-		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-			"received invalid next payload type %d, "
-			"expecting %d.\n",
-			pa->type, ISAKMP_NPTYPE_HASH);
-		goto end;
-	}
-	hash = (struct isakmp_pl_hash *)pa->ptr;
-	pa++;
-
-	/*
-	 * this restriction was introduced in isakmp-oakley-05.
-	 * we do not check this for backward compatibility.
-	 * TODO: command line/config file option to enable/disable this code
-	 */
-	/* HASH payload is fixed postion */
-	if (pa->type != ISAKMP_NPTYPE_SA) {
-		plog(LLV_WARNING, LOCATION, iph2->ph1->remote,
-			"received invalid next payload type %d, "
-			"expecting %d.\n",
-			pa->type, ISAKMP_NPTYPE_HASH);
-	}
-
-	/* allocate buffer for computing HASH(2) */
-	tlen = iph2->nonce->l
-		+ ntohl(isakmp->len) - sizeof(*isakmp);
-	hbuf = vmalloc(tlen);
-	if (hbuf == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get hash buffer.\n");
-		goto end;
-	}
-	p = hbuf->v + iph2->nonce->l;	/* retain the space for Ni_b */
-
-	/*
-	 * parse the payloads.
-	 * copy non-HASH payloads into hbuf, so that we can validate HASH.
-	 */
-	iph2->sa_ret = NULL;
-	f_id = 0;	/* flag to use checking ID */
-	tlen = 0;	/* count payload length except of HASH payload. */
-	for (; pa->type; pa++) {
-
-		/* copy to buffer for HASH */
-		/* Don't modify the payload */
-		memcpy(p, pa->ptr, pa->len);
-
-		switch (pa->type) {
-		case ISAKMP_NPTYPE_SA:
-			if (iph2->sa_ret != NULL) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"Ignored, multiple SA "
-					"isn't supported.\n");
-				break;
-			}
-			if (isakmp_p2ph(&iph2->sa_ret, pa->ptr) < 0)
-				goto end;
-			break;
-
-		case ISAKMP_NPTYPE_NONCE:
-			if (isakmp_p2ph(&iph2->nonce_p, pa->ptr) < 0)
-				goto end;
-			break;
-
-		case ISAKMP_NPTYPE_KE:
-			if (isakmp_p2ph(&iph2->dhpub_p, pa->ptr) < 0)
-				goto end;
-			break;
-
-		case ISAKMP_NPTYPE_ID:
-		    {
-			vchar_t *vp;
-
-			/* check ID value */
-			if (f_id == 0) {
-				/* for IDci */
-				f_id = 1;
-				vp = iph2->id;
-			} else {
-				/* for IDcr */
-				vp = iph2->id_p;
-			}
-
-#ifndef ANDROID_PATCHED
-			if (memcmp(vp->v, (caddr_t)pa->ptr + sizeof(struct isakmp_gen), vp->l)) {
-
-				plog(LLV_ERROR, LOCATION, NULL,
-					"mismatched ID was returned.\n");
-				error = ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED;
-				goto end;
-			}
-#endif
-		    }
-			break;
-
-		case ISAKMP_NPTYPE_N:
-			isakmp_check_notify(pa->ptr, iph2->ph1);
-			break;
-
-#ifdef ENABLE_NATT
-		case ISAKMP_NPTYPE_NATOA_DRAFT:
-		case ISAKMP_NPTYPE_NATOA_RFC:
-			/* Ignore original source/destination messages */
-			break;
-#endif
-
-		default:
-			/* don't send information, see ident_r1recv() */
-			plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-				"ignore the packet, "
-				"received unexpecting payload type %d.\n",
-				pa->type);
-			goto end;
-		}
-
-		p += pa->len;
-
-		/* compute true length of payload. */
-		tlen += pa->len;
-	}
-
-	/* payload existency check */
-	if (hash == NULL || iph2->sa_ret == NULL || iph2->nonce_p == NULL) {
-		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-			"few isakmp message received.\n");
-		goto end;
-	}
-
-	/* Fixed buffer for calculating HASH */
-	memcpy(hbuf->v, iph2->nonce->v, iph2->nonce->l);
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"HASH allocated:hbuf->l=%zu actual:tlen=%zu\n",
-		hbuf->l, tlen + iph2->nonce->l);
-	/* adjust buffer length for HASH */
-	hbuf->l = iph2->nonce->l + tlen;
-
-	/* validate HASH(2) */
-    {
-	char *r_hash;
-	vchar_t *my_hash = NULL;
-	int result;
-
-	r_hash = (char *)hash + sizeof(*hash);
-
-	plog(LLV_DEBUG, LOCATION, NULL, "HASH(2) received:");
-	plogdump(LLV_DEBUG, r_hash, ntohs(hash->h.len) - sizeof(*hash));
-
-	my_hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, hbuf);
-	if (my_hash == NULL)
-		goto end;
-
-	result = memcmp(my_hash->v, r_hash, my_hash->l);
-	vfree(my_hash);
-
-	if (result) {
-		plog(LLV_DEBUG, LOCATION, iph2->ph1->remote,
-			"HASH(2) mismatch.\n");
-		error = ISAKMP_NTYPE_INVALID_HASH_INFORMATION;
-		goto end;
-	}
-    }
-
-	/* validity check SA payload sent from responder */
-	if (ipsecdoi_checkph2proposal(iph2) < 0) {
-		error = ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN;
-		goto end;
-	}
-
-	/* change status of isakmp status entry */
-	iph2->status = PHASE2ST_STATUS6;
-
-	error = 0;
-
-end:
-	if (hbuf)
-		vfree(hbuf);
-	if (pbuf)
-		vfree(pbuf);
-	if (msg)
-		vfree(msg);
-
-	if (error) {
-		VPTRINIT(iph2->sa_ret);
-		VPTRINIT(iph2->nonce_p);
-		VPTRINIT(iph2->dhpub_p);
-		VPTRINIT(iph2->id);
-		VPTRINIT(iph2->id_p);
-	}
-
-	return error;
-}
-
-/*
- * send to responder
- * 	HDR*, HASH(3)
- */
-int
-quick_i2send(iph2, msg0)
-	struct ph2handle *iph2;
-	vchar_t *msg0;
-{
-	vchar_t *msg = NULL;
-	vchar_t *buf = NULL;
-	vchar_t *hash = NULL;
-	char *p = NULL;
-	int tlen;
-	int error = ISAKMP_INTERNAL_ERROR;
-
-	/* validity check */
-	if (iph2->status != PHASE2ST_STATUS6) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph2->status);
-		goto end;
-	}
-
-	/* generate HASH(3) */
-    {
-	vchar_t *tmp = NULL;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "HASH(3) generate\n");
-
-	tmp = vmalloc(iph2->nonce->l + iph2->nonce_p->l);
-	if (tmp == NULL) { 
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get hash buffer.\n");
-		goto end;
-	}
-	memcpy(tmp->v, iph2->nonce->v, iph2->nonce->l);
-	memcpy(tmp->v + iph2->nonce->l, iph2->nonce_p->v, iph2->nonce_p->l);
-
-	hash = oakley_compute_hash3(iph2->ph1, iph2->msgid, tmp);
-	vfree(tmp);
-
-	if (hash == NULL)
-		goto end;
-    }
-
-	/* create buffer for isakmp payload */
-	tlen = sizeof(struct isakmp)
-		+ sizeof(struct isakmp_gen) + hash->l;
-	buf = vmalloc(tlen);
-	if (buf == NULL) { 
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get buffer to send.\n");
-		goto end;
-	}
-
-	/* create isakmp header */
-	p = set_isakmp_header2(buf, iph2, ISAKMP_NPTYPE_HASH);
-	if (p == NULL)
-		goto end;
-
-	/* add HASH(3) payload */
-	p = set_isakmp_payload(p, hash, ISAKMP_NPTYPE_NONE);
-
-#ifdef HAVE_PRINT_ISAKMP_C
-	isakmp_printpacket(buf, iph2->ph1->local, iph2->ph1->remote, 1);
-#endif
-
-	/* encoding */
-	iph2->sendbuf = oakley_do_encrypt(iph2->ph1, buf, iph2->ivm->ive, iph2->ivm->iv);
-	if (iph2->sendbuf == NULL)
-		goto end;
-
-	/* if there is commit bit, need resending */
-	if (ISSET(iph2->flags, ISAKMP_FLAG_C)) {
-		/* send the packet, add to the schedule to resend */
-		iph2->retry_counter = iph2->ph1->rmconf->retry_counter;
-		if (isakmp_ph2resend(iph2) == -1)
-			goto end;
-	} else {
-		/* send the packet */
-		if (isakmp_send(iph2->ph1, iph2->sendbuf) < 0)
-			goto end;
-	}
-
-	/* the sending message is added to the received-list. */
-	if (add_recvdpkt(iph2->ph1->remote, iph2->ph1->local,
-			iph2->sendbuf, msg0) == -1) {
-		plog(LLV_ERROR , LOCATION, NULL,
-			"failed to add a response packet to the tree.\n");
-		goto end;
-	}
-
-	/* compute both of KEYMATs */
-	if (oakley_compute_keymat(iph2, INITIATOR) < 0)
-		goto end;
-
-	iph2->status = PHASE2ST_ADDSA;
-
-	/* don't anything if local test mode. */
-	if (f_local) {
-		error = 0;
-		goto end;
-	}
-
-	/* if there is commit bit don't set up SA now. */
-	if (ISSET(iph2->flags, ISAKMP_FLAG_C)) {
-		iph2->status = PHASE2ST_COMMIT;
-		error = 0;
-		goto end;
-	}
-
-	/* Do UPDATE for initiator */
-	plog(LLV_DEBUG, LOCATION, NULL, "call pk_sendupdate\n");
-	if (pk_sendupdate(iph2) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL, "pfkey update failed.\n");
-		goto end;
-	}
-	plog(LLV_DEBUG, LOCATION, NULL, "pfkey update sent.\n");
-
-	/* Do ADD for responder */
-	if (pk_sendadd(iph2) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL, "pfkey add failed.\n");
-		goto end;
-	}
-	plog(LLV_DEBUG, LOCATION, NULL, "pfkey add sent.\n");
-
-	error = 0;
-
-end:
-	if (buf != NULL)
-		vfree(buf);
-	if (msg != NULL)
-		vfree(msg);
-	if (hash != NULL)
-		vfree(hash);
-
-	return error;
-}
-
-/*
- * receive from responder
- * 	HDR#*, HASH(4), notify
- */
-int
-quick_i3recv(iph2, msg0)
-	struct ph2handle *iph2;
-	vchar_t *msg0;
-{
-	vchar_t *msg = NULL;
-	vchar_t *pbuf = NULL;	/* for payload parsing */
-	struct isakmp_parse_t *pa;
-	struct isakmp_pl_hash *hash = NULL;
-	vchar_t *notify = NULL;
-	int error = ISAKMP_INTERNAL_ERROR;
-
-	/* validity check */
-	if (iph2->status != PHASE2ST_COMMIT) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph2->status);
-		goto end;
-	}
-
-	/* decrypt packet */
-	if (!ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E)) {
-		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-			"Packet wasn't encrypted.\n");
-		goto end;
-	}
-	msg = oakley_do_decrypt(iph2->ph1, msg0, iph2->ivm->iv, iph2->ivm->ive);
-	if (msg == NULL)
-		goto end;
-
-	/* validate the type of next payload */
-	pbuf = isakmp_parse(msg);
-	if (pbuf == NULL)
-		goto end;
-
-	for (pa = (struct isakmp_parse_t *)pbuf->v;
-	     pa->type != ISAKMP_NPTYPE_NONE;
-	     pa++) {
-
-		switch (pa->type) {
-		case ISAKMP_NPTYPE_HASH:
-			hash = (struct isakmp_pl_hash *)pa->ptr;
-			break;
-		case ISAKMP_NPTYPE_N:
-			if (notify != NULL) {
-				plog(LLV_WARNING, LOCATION, NULL,
-				    "Ignoring multiples notifications\n");
-				break;
-			}
-			isakmp_check_notify(pa->ptr, iph2->ph1);
-			notify = vmalloc(pa->len);
-			if (notify == NULL) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"failed to get notify buffer.\n");
-				goto end;
-			}
-			memcpy(notify->v, pa->ptr, notify->l);
-			break;
-		default:
-			/* don't send information, see ident_r1recv() */
-			plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-				"ignore the packet, "
-				"received unexpecting payload type %d.\n",
-				pa->type);
-			goto end;
-		}
-	}
-
-	/* payload existency check */
-	if (hash == NULL) {
-		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-			"few isakmp message received.\n");
-		goto end;
-	}
-
-	/* validate HASH(4) */
-    {
-	char *r_hash;
-	vchar_t *my_hash = NULL;
-	vchar_t *tmp = NULL;
-	int result;
-
-	r_hash = (char *)hash + sizeof(*hash);
-
-	plog(LLV_DEBUG, LOCATION, NULL, "HASH(4) validate:");
-	plogdump(LLV_DEBUG, r_hash, ntohs(hash->h.len) - sizeof(*hash));
-
-	my_hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, notify);
-	vfree(tmp);
-	if (my_hash == NULL)
-		goto end;
-
-	result = memcmp(my_hash->v, r_hash, my_hash->l);
-	vfree(my_hash);
-
-	if (result) {
-		plog(LLV_DEBUG, LOCATION, iph2->ph1->remote,
-			"HASH(4) mismatch.\n");
-		error = ISAKMP_NTYPE_INVALID_HASH_INFORMATION;
-		goto end;
-	}
-    }
-
-	iph2->status = PHASE2ST_ADDSA;
-	iph2->flags ^= ISAKMP_FLAG_C;	/* reset bit */
-
-	/* don't anything if local test mode. */
-	if (f_local) {
-		error = 0;
-		goto end;
-	}
-
-	/* Do UPDATE for initiator */
-	plog(LLV_DEBUG, LOCATION, NULL, "call pk_sendupdate\n");
-	if (pk_sendupdate(iph2) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL, "pfkey update failed.\n");
-		goto end;
-	}
-	plog(LLV_DEBUG, LOCATION, NULL, "pfkey update sent.\n");
-
-	/* Do ADD for responder */
-	if (pk_sendadd(iph2) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL, "pfkey add failed.\n");
-		goto end;
-	}
-	plog(LLV_DEBUG, LOCATION, NULL, "pfkey add sent.\n");
-
-	error = 0;
-
-end:
-	if (msg != NULL)
-		vfree(msg);
-	if (pbuf != NULL)
-		vfree(pbuf);
-	if (notify != NULL)
-		vfree(notify);
-
-	return error;
-}
-
-/*
- * receive from initiator
- * 	HDR*, HASH(1), SA, Ni [, KE ] [, IDi2, IDr2 ]
- */
-int
-quick_r1recv(iph2, msg0)
-	struct ph2handle *iph2;
-	vchar_t *msg0;
-{
-	vchar_t *msg = NULL;
-	vchar_t *hbuf = NULL;	/* for hash computing. */
-	vchar_t *pbuf = NULL;	/* for payload parsing */
-	struct isakmp_parse_t *pa;
-	struct isakmp *isakmp = (struct isakmp *)msg0->v;
-	struct isakmp_pl_hash *hash = NULL;
-	char *p;
-	int tlen;
-	int f_id_order;	/* for ID payload detection */
-	int error = ISAKMP_INTERNAL_ERROR;
-
-	/* validity check */
-	if (iph2->status != PHASE2ST_START) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph2->status);
-		goto end;
-	}
-
-	/* decrypting */
-	if (!ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E)) {
-		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-			"Packet wasn't encrypted.\n");
-		error = ISAKMP_NTYPE_PAYLOAD_MALFORMED;
-		goto end;
-	}
-	/* decrypt packet */
-	msg = oakley_do_decrypt(iph2->ph1, msg0, iph2->ivm->iv, iph2->ivm->ive);
-	if (msg == NULL)
-		goto end;
-
-	/* create buffer for using to validate HASH(1) */
-	/*
-	 * ordering rule:
-	 *	1. the first one must be HASH
-	 *	2. the second one must be SA (added in isakmp-oakley-05!)
-	 *	3. two IDs must be considered as IDci, then IDcr
-	 */
-	pbuf = isakmp_parse(msg);
-	if (pbuf == NULL)
-		goto end;
-	pa = (struct isakmp_parse_t *)pbuf->v;
-
-	/* HASH payload is fixed postion */
-	if (pa->type != ISAKMP_NPTYPE_HASH) {
-		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-			"received invalid next payload type %d, "
-			"expecting %d.\n",
-			pa->type, ISAKMP_NPTYPE_HASH);
-		error = ISAKMP_NTYPE_BAD_PROPOSAL_SYNTAX;
-		goto end;
-	}
-	hash = (struct isakmp_pl_hash *)pa->ptr;
-	pa++;
-
-	/*
-	 * this restriction was introduced in isakmp-oakley-05.
-	 * we do not check this for backward compatibility.
-	 * TODO: command line/config file option to enable/disable this code
-	 */
-	/* HASH payload is fixed postion */
-	if (pa->type != ISAKMP_NPTYPE_SA) {
-		plog(LLV_WARNING, LOCATION, iph2->ph1->remote,
-			"received invalid next payload type %d, "
-			"expecting %d.\n",
-			pa->type, ISAKMP_NPTYPE_SA);
-		error = ISAKMP_NTYPE_BAD_PROPOSAL_SYNTAX;
-	}
-
-	/* allocate buffer for computing HASH(1) */
-	tlen = ntohl(isakmp->len) - sizeof(*isakmp);
-	hbuf = vmalloc(tlen);
-	if (hbuf == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get hash buffer.\n");
-		goto end;
-	}
-	p = hbuf->v;
-
-	/*
-	 * parse the payloads.
-	 * copy non-HASH payloads into hbuf, so that we can validate HASH.
-	 */
-	iph2->sa = NULL;	/* we don't support multi SAs. */
-	iph2->nonce_p = NULL;
-	iph2->dhpub_p = NULL;
-	iph2->id_p = NULL;
-	iph2->id = NULL;
-	tlen = 0;	/* count payload length except of HASH payload. */
-
-	/*
-	 * IDi2 MUST be immediatelly followed by IDr2.  We allowed the
-	 * illegal case, but logged.  First ID payload is to be IDi2.
-	 * And next ID payload is to be IDr2.
-	 */
-	f_id_order = 0;
-
-	for (; pa->type; pa++) {
-
-		/* copy to buffer for HASH */
-		/* Don't modify the payload */
-		memcpy(p, pa->ptr, pa->len);
-
-		if (pa->type != ISAKMP_NPTYPE_ID)
-			f_id_order = 0;
-
-		switch (pa->type) {
-		case ISAKMP_NPTYPE_SA:
-			if (iph2->sa != NULL) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"Multi SAs isn't supported.\n");
-				goto end;
-			}
-			if (isakmp_p2ph(&iph2->sa, pa->ptr) < 0)
-				goto end;
-			break;
-
-		case ISAKMP_NPTYPE_NONCE:
-			if (isakmp_p2ph(&iph2->nonce_p, pa->ptr) < 0)
-				goto end;
-			break;
-
-		case ISAKMP_NPTYPE_KE:
-			if (isakmp_p2ph(&iph2->dhpub_p, pa->ptr) < 0)
-				goto end;
-			break;
-
-		case ISAKMP_NPTYPE_ID:
-			if (iph2->id_p == NULL) {
-				/* for IDci */
-				f_id_order++;
-
-				if (isakmp_p2ph(&iph2->id_p, pa->ptr) < 0)
-					goto end;
-
-			} else if (iph2->id == NULL) {
-				/* for IDcr */
-				if (f_id_order == 0) {
-					plog(LLV_ERROR, LOCATION, NULL,
-						"IDr2 payload is not "
-						"immediatelly followed "
-						"by IDi2. We allowed.\n");
-					/* XXX we allowed in this case. */
-				}
-
-				if (isakmp_p2ph(&iph2->id, pa->ptr) < 0)
-					goto end;
-			} else {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"received too many ID payloads.\n");
-				plogdump(LLV_ERROR, iph2->id->v, iph2->id->l);
-				error = ISAKMP_NTYPE_INVALID_ID_INFORMATION;
-				goto end;
-			}
-			break;
-
-		case ISAKMP_NPTYPE_N:
-			isakmp_check_notify(pa->ptr, iph2->ph1);
-			break;
-
-#ifdef ENABLE_NATT
-		case ISAKMP_NPTYPE_NATOA_DRAFT:
-		case ISAKMP_NPTYPE_NATOA_RFC:
-			/* Ignore original source/destination messages */
-			break;
-#endif
-
-		default:
-			plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-				"ignore the packet, "
-				"received unexpecting payload type %d.\n",
-				pa->type);
-			error = ISAKMP_NTYPE_PAYLOAD_MALFORMED;
-			goto end;
-		}
-
-		p += pa->len;
-
-		/* compute true length of payload. */
-		tlen += pa->len;
-	}
-
-	/* payload existency check */
-	if (hash == NULL || iph2->sa == NULL || iph2->nonce_p == NULL) {
-		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-			"few isakmp message received.\n");
-		error = ISAKMP_NTYPE_PAYLOAD_MALFORMED;
-		goto end;
-	}
-
-	if (iph2->id_p) {
-		plog(LLV_DEBUG, LOCATION, NULL, "received IDci2:");
-		plogdump(LLV_DEBUG, iph2->id_p->v, iph2->id_p->l);
-	}
-	if (iph2->id) {
-		plog(LLV_DEBUG, LOCATION, NULL, "received IDcr2:");
-		plogdump(LLV_DEBUG, iph2->id->v, iph2->id->l);
-	}
-
-	/* adjust buffer length for HASH */
-	hbuf->l = tlen;
-
-	/* validate HASH(1) */
-    {
-	char *r_hash;
-	vchar_t *my_hash = NULL;
-	int result;
-
-	r_hash = (caddr_t)hash + sizeof(*hash);
-
-	plog(LLV_DEBUG, LOCATION, NULL, "HASH(1) validate:");
-	plogdump(LLV_DEBUG, r_hash, ntohs(hash->h.len) - sizeof(*hash));
-
-	my_hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, hbuf);
-	if (my_hash == NULL)
-		goto end;
-
-	result = memcmp(my_hash->v, r_hash, my_hash->l);
-	vfree(my_hash);
-
-	if (result) {
-		plog(LLV_DEBUG, LOCATION, iph2->ph1->remote,
-			"HASH(1) mismatch.\n");
-		error = ISAKMP_NTYPE_INVALID_HASH_INFORMATION;
-		goto end;
-	}
-    }
-
-	/* get sainfo */
-	error = get_sainfo_r(iph2);
-	if (error) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get sainfo.\n");
-		goto end;
-	}
-
-
-	/* check the existence of ID payload and create responder's proposal */
-	error = get_proposal_r(iph2);
-	switch (error) {
-	case -2:
-		/* generate a policy template from peer's proposal */
-		if (set_proposal_from_proposal(iph2)) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to generate a proposal template "
-				"from client's proposal.\n");
-			return ISAKMP_INTERNAL_ERROR;
-		}
-		/*FALLTHROUGH*/
-	case 0:
-		/* select single proposal or reject it. */
-		if (ipsecdoi_selectph2proposal(iph2) < 0) {
-			error = ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN;
-			goto end;
-		}
-		break;
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get proposal for responder.\n");
-		goto end;
-	}
-
-	/* check KE and attribute of PFS */
-	if (iph2->dhpub_p != NULL && iph2->approval->pfs_group == 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"no PFS is specified, but peer sends KE.\n");
-		error = ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN;
-		goto end;
-	}
-	if (iph2->dhpub_p == NULL && iph2->approval->pfs_group != 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"PFS is specified, but peer doesn't sends KE.\n");
-		error = ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN;
-		goto end;
-	}
-
-	/*
-	 * save the packet from the initiator in order to resend the
-	 * responder's first packet against this packet.
-	 */
-	iph2->msg1 = vdup(msg0);
-
-	/* change status of isakmp status entry */
-	iph2->status = PHASE2ST_STATUS2;
-
-	error = 0;
-
-end:
-	if (hbuf)
-		vfree(hbuf);
-	if (msg)
-		vfree(msg);
-	if (pbuf)
-		vfree(pbuf);
-
-	if (error) {
-		VPTRINIT(iph2->sa);
-		VPTRINIT(iph2->nonce_p);
-		VPTRINIT(iph2->dhpub_p);
-		VPTRINIT(iph2->id);
-		VPTRINIT(iph2->id_p);
-	}
-
-	return error;
-}
-
-/*
- * call pfkey_getspi.
- */
-int
-quick_r1prep(iph2, msg)
-	struct ph2handle *iph2;
-	vchar_t *msg;
-{
-	int error = ISAKMP_INTERNAL_ERROR;
-
-	/* validity check */
-	if (iph2->status != PHASE2ST_STATUS2) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph2->status);
-		goto end;
-	}
-
-	iph2->status = PHASE2ST_GETSPISENT;
-
-	/* send getspi message */
-	if (pk_sendgetspi(iph2) < 0)
-		goto end;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "pfkey getspi sent.\n");
-
-	iph2->sce = sched_new(lcconf->wait_ph2complete,
-		pfkey_timeover_stub, iph2);
-
-	error = 0;
-
-end:
-	return error;
-}
-
-/*
- * send to initiator
- * 	HDR*, HASH(2), SA, Nr [, KE ] [, IDi2, IDr2 ]
- */
-int
-quick_r2send(iph2, msg)
-	struct ph2handle *iph2;
-	vchar_t *msg;
-{
-	vchar_t *body = NULL;
-	vchar_t *hash = NULL;
-	struct isakmp_gen *gen;
-	char *p;
-	int tlen;
-	int error = ISAKMP_INTERNAL_ERROR;
-	int pfsgroup;
-	u_int8_t *np_p = NULL;
-
-	/* validity check */
-	if (msg != NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"msg has to be NULL in this function.\n");
-		goto end;
-	}
-	if (iph2->status != PHASE2ST_GETSPIDONE) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph2->status);
-		goto end;
-	}
-
-	/* update responders SPI */
-	if (ipsecdoi_updatespi(iph2) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL, "failed to update spi.\n");
-		goto end;
-	}
-
-	/* generate NONCE value */
-	iph2->nonce = eay_set_random(iph2->ph1->rmconf->nonce_size);
-	if (iph2->nonce == NULL)
-		goto end;
-
-	/* generate KE value if need */
-	pfsgroup = iph2->approval->pfs_group;
-	if (iph2->dhpub_p != NULL && pfsgroup != 0) {
-		/* DH group settting if PFS is required. */
-		if (oakley_setdhgroup(pfsgroup, &iph2->pfsgrp) < 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to set DH value.\n");
-			goto end;
-		}
-		/* generate DH public value */
-		if (oakley_dh_generate(iph2->pfsgrp,
-				&iph2->dhpub, &iph2->dhpriv) < 0) {
-			goto end;
-		}
-	}
-
-	/* create SA;NONCE payload, and KE and ID if need */
-	tlen = sizeof(*gen) + iph2->sa_ret->l
-		+ sizeof(*gen) + iph2->nonce->l;
-	if (iph2->dhpub_p != NULL && pfsgroup != 0)
-		tlen += (sizeof(*gen) + iph2->dhpub->l);
-	if (iph2->id_p != NULL)
-		tlen += (sizeof(*gen) + iph2->id_p->l
-			+ sizeof(*gen) + iph2->id->l);
-
-	body = vmalloc(tlen);
-	if (body == NULL) { 
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get buffer to send.\n");
-		goto end;
-	}
-	p = body->v;
-
-	/* make SA payload */ 
-	p = set_isakmp_payload(body->v, iph2->sa_ret, ISAKMP_NPTYPE_NONCE);
-
-	/* add NONCE payload */
-	np_p = &((struct isakmp_gen *)p)->np;	/* XXX */
-	p = set_isakmp_payload(p, iph2->nonce,
-		(iph2->dhpub_p != NULL && pfsgroup != 0)
-				? ISAKMP_NPTYPE_KE
-				: (iph2->id_p != NULL
-					? ISAKMP_NPTYPE_ID
-					: ISAKMP_NPTYPE_NONE));
-
-	/* add KE payload if need. */
-	if (iph2->dhpub_p != NULL && pfsgroup != 0) {
-		np_p = &((struct isakmp_gen *)p)->np;	/* XXX */
-		p = set_isakmp_payload(p, iph2->dhpub,
-			(iph2->id_p == NULL)
-				? ISAKMP_NPTYPE_NONE
-				: ISAKMP_NPTYPE_ID);
-	}
-
-	/* add ID payloads received. */
-	if (iph2->id_p != NULL) {
-		/* IDci */
-		p = set_isakmp_payload(p, iph2->id_p, ISAKMP_NPTYPE_ID);
-		/* IDcr */
-		np_p = &((struct isakmp_gen *)p)->np;	/* XXX */
-		p = set_isakmp_payload(p, iph2->id, ISAKMP_NPTYPE_NONE);
-	}
-
-	/* add a RESPONDER-LIFETIME notify payload if needed */
-    {
-	vchar_t *data = NULL;
-	struct saprop *pp = iph2->approval;
-	struct saproto *pr;
-
-	if (pp->claim & IPSECDOI_ATTR_SA_LD_TYPE_SEC) {
-		u_int32_t v = htonl((u_int32_t)pp->lifetime);
-		data = isakmp_add_attr_l(data, IPSECDOI_ATTR_SA_LD_TYPE,
-					IPSECDOI_ATTR_SA_LD_TYPE_SEC);
-		if (!data)
-			goto end;
-		data = isakmp_add_attr_v(data, IPSECDOI_ATTR_SA_LD,
-					(caddr_t)&v, sizeof(v));
-		if (!data)
-			goto end;
-	}
-	if (pp->claim & IPSECDOI_ATTR_SA_LD_TYPE_KB) {
-		u_int32_t v = htonl((u_int32_t)pp->lifebyte);
-		data = isakmp_add_attr_l(data, IPSECDOI_ATTR_SA_LD_TYPE,
-					IPSECDOI_ATTR_SA_LD_TYPE_KB);
-		if (!data)
-			goto end;
-		data = isakmp_add_attr_v(data, IPSECDOI_ATTR_SA_LD,
-					(caddr_t)&v, sizeof(v));
-		if (!data)
-			goto end;
-	}
-
-	/*
-	 * XXX Is there only single RESPONDER-LIFETIME payload in a IKE message
-	 * in the case of SA bundle ?
-	 */
-	if (data) {
-		for (pr = pp->head; pr; pr = pr->next) {
-			body = isakmp_add_pl_n(body, &np_p,
-					ISAKMP_NTYPE_RESPONDER_LIFETIME, pr, data);
-			if (!body) {
-				vfree(data);
-				return error;	/* XXX */
-			}
-		}
-		vfree(data);
-	}
-    }
-
-	/* generate HASH(2) */
-    {
-	vchar_t *tmp;
-
-	tmp = vmalloc(iph2->nonce_p->l + body->l);
-	if (tmp == NULL) { 
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get hash buffer.\n");
-		goto end;
-	}
-	memcpy(tmp->v, iph2->nonce_p->v, iph2->nonce_p->l);
-	memcpy(tmp->v + iph2->nonce_p->l, body->v, body->l);
-
-	hash = oakley_compute_hash1(iph2->ph1, iph2->msgid, tmp);
-	vfree(tmp);
-
-	if (hash == NULL)
-		goto end;
-    }
-
-	/* send isakmp payload */
-	iph2->sendbuf = quick_ir1mx(iph2, body, hash);
-	if (iph2->sendbuf == NULL)
-		goto end;
-
-	/* send the packet, add to the schedule to resend */
-	iph2->retry_counter = iph2->ph1->rmconf->retry_counter;
-	if (isakmp_ph2resend(iph2) == -1)
-		goto end;
-
-	/* the sending message is added to the received-list. */
-	if (add_recvdpkt(iph2->ph1->remote, iph2->ph1->local, iph2->sendbuf, iph2->msg1) == -1) {
-		plog(LLV_ERROR , LOCATION, NULL,
-			"failed to add a response packet to the tree.\n");
-		goto end;
-	}
-
-	/* change status of isakmp status entry */
-	iph2->status = PHASE2ST_MSG1SENT;
-
-	error = 0;
-
-end:
-	if (body != NULL)
-		vfree(body);
-	if (hash != NULL)
-		vfree(hash);
-
-	return error;
-}
-
-/*
- * receive from initiator
- * 	HDR*, HASH(3)
- */
-int
-quick_r3recv(iph2, msg0)
-	struct ph2handle *iph2;
-	vchar_t *msg0;
-{
-	vchar_t *msg = NULL;
-	vchar_t *pbuf = NULL;	/* for payload parsing */
-	struct isakmp_parse_t *pa;
-	struct isakmp_pl_hash *hash = NULL;
-	int error = ISAKMP_INTERNAL_ERROR;
-
-	/* validity check */
-	if (iph2->status != PHASE2ST_MSG1SENT) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph2->status);
-		goto end;
-	}
-
-	/* decrypt packet */
-	if (!ISSET(((struct isakmp *)msg0->v)->flags, ISAKMP_FLAG_E)) {
-		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-			"Packet wasn't encrypted.\n");
-		goto end;
-	}
-	msg = oakley_do_decrypt(iph2->ph1, msg0, iph2->ivm->iv, iph2->ivm->ive);
-	if (msg == NULL)
-		goto end;
-
-	/* validate the type of next payload */
-	pbuf = isakmp_parse(msg);
-	if (pbuf == NULL)
-		goto end;
-
-	for (pa = (struct isakmp_parse_t *)pbuf->v;
-	     pa->type != ISAKMP_NPTYPE_NONE;
-	     pa++) {
-
-		switch (pa->type) {
-		case ISAKMP_NPTYPE_HASH:
-			hash = (struct isakmp_pl_hash *)pa->ptr;
-			break;
-		case ISAKMP_NPTYPE_N:
-			isakmp_check_notify(pa->ptr, iph2->ph1);
-			break;
-		default:
-			/* don't send information, see ident_r1recv() */
-			plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-				"ignore the packet, "
-				"received unexpecting payload type %d.\n",
-				pa->type);
-			goto end;
-		}
-	}
-
-	/* payload existency check */
-	if (hash == NULL) {
-		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-			"few isakmp message received.\n");
-		goto end;
-	}
-
-	/* validate HASH(3) */
-	/* HASH(3) = prf(SKEYID_a, 0 | M-ID | Ni_b | Nr_b) */
-    {
-	char *r_hash;
-	vchar_t *my_hash = NULL;
-	vchar_t *tmp = NULL;
-	int result;
-
-	r_hash = (char *)hash + sizeof(*hash);
-
-	plog(LLV_DEBUG, LOCATION, NULL, "HASH(3) validate:");
-	plogdump(LLV_DEBUG, r_hash, ntohs(hash->h.len) - sizeof(*hash));
-
-	tmp = vmalloc(iph2->nonce_p->l + iph2->nonce->l);
-	if (tmp == NULL) { 
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get hash buffer.\n");
-		goto end;
-	}
-	memcpy(tmp->v, iph2->nonce_p->v, iph2->nonce_p->l);
-	memcpy(tmp->v + iph2->nonce_p->l, iph2->nonce->v, iph2->nonce->l);
-
-	my_hash = oakley_compute_hash3(iph2->ph1, iph2->msgid, tmp);
-	vfree(tmp);
-	if (my_hash == NULL)
-		goto end;
-
-	result = memcmp(my_hash->v, r_hash, my_hash->l);
-	vfree(my_hash);
-
-	if (result) {
-		plog(LLV_ERROR, LOCATION, iph2->ph1->remote,
-			"HASH(3) mismatch.\n");
-		error = ISAKMP_NTYPE_INVALID_HASH_INFORMATION;
-		goto end;
-	}
-    }
-
-	/* if there is commit bit, don't set up SA now. */
-	if (ISSET(iph2->flags, ISAKMP_FLAG_C)) {
-		iph2->status = PHASE2ST_COMMIT;
-	} else
-		iph2->status = PHASE2ST_STATUS6;
-
-	error = 0;
-
-end:
-	if (pbuf != NULL)
-		vfree(pbuf);
-	if (msg != NULL)
-		vfree(msg);
-
-	return error;
-}
-
-/*
- * send to initiator
- * 	HDR#*, HASH(4), notify
- */
-int
-quick_r3send(iph2, msg0)
-	struct ph2handle *iph2;
-	vchar_t *msg0;
-{
-	vchar_t *buf = NULL;
-	vchar_t *myhash = NULL;
-	struct isakmp_pl_n *n;
-	vchar_t *notify = NULL;
-	char *p;
-	int tlen;
-	int error = ISAKMP_INTERNAL_ERROR;
-
-	/* validity check */
-	if (iph2->status != PHASE2ST_COMMIT) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph2->status);
-		goto end;
-	}
-
-	/* generate HASH(4) */
-	/* XXX What can I do in the case of multiple different SA */
-	plog(LLV_DEBUG, LOCATION, NULL, "HASH(4) generate\n");
-
-	/* XXX What should I do if there are multiple SAs ? */
-	tlen = sizeof(struct isakmp_pl_n) + iph2->approval->head->spisize;
-	notify = vmalloc(tlen);
-	if (notify == NULL) { 
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get notify buffer.\n");
-		goto end;
-	}
-	n = (struct isakmp_pl_n *)notify->v;
-	n->h.np = ISAKMP_NPTYPE_NONE;
-	n->h.len = htons(tlen);
-	n->doi = htonl(IPSEC_DOI);
-	n->proto_id = iph2->approval->head->proto_id;
-	n->spi_size = sizeof(iph2->approval->head->spisize);
-	n->type = htons(ISAKMP_NTYPE_CONNECTED);
-	memcpy(n + 1, &iph2->approval->head->spi, iph2->approval->head->spisize);
-
-	myhash = oakley_compute_hash1(iph2->ph1, iph2->msgid, notify);
-	if (myhash == NULL)
-		goto end;
-
-	/* create buffer for isakmp payload */
-	tlen = sizeof(struct isakmp)
-		+ sizeof(struct isakmp_gen) + myhash->l
-		+ notify->l;
-	buf = vmalloc(tlen);
-	if (buf == NULL) { 
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get buffer to send.\n");
-		goto end;
-	}
-
-	/* create isakmp header */
-	p = set_isakmp_header2(buf, iph2, ISAKMP_NPTYPE_HASH);
-	if (p == NULL)
-		goto end;
-
-	/* add HASH(4) payload */
-	p = set_isakmp_payload(p, myhash, ISAKMP_NPTYPE_N);
-
-	/* add notify payload */
-	memcpy(p, notify->v, notify->l);
-
-#ifdef HAVE_PRINT_ISAKMP_C
-	isakmp_printpacket(buf, iph2->ph1->local, iph2->ph1->remote, 1);
-#endif
-
-	/* encoding */
-	iph2->sendbuf = oakley_do_encrypt(iph2->ph1, buf, iph2->ivm->ive, iph2->ivm->iv);
-	if (iph2->sendbuf == NULL)
-		goto end;
-
-	/* send the packet */
-	if (isakmp_send(iph2->ph1, iph2->sendbuf) < 0)
-		goto end;
-
-	/* the sending message is added to the received-list. */
-	if (add_recvdpkt(iph2->ph1->remote, iph2->ph1->local, iph2->sendbuf, msg0) == -1) {
-		plog(LLV_ERROR , LOCATION, NULL,
-			"failed to add a response packet to the tree.\n");
-		goto end;
-	}
-
-	iph2->status = PHASE2ST_COMMIT;
-
-	error = 0;
-
-end:
-	if (buf != NULL)
-		vfree(buf);
-	if (myhash != NULL)
-		vfree(myhash);
-	if (notify != NULL)
-		vfree(notify);
-
-	return error;
-}
-
-int
-tunnel_mode_prop(p)
-	struct saprop *p;
-{
-	struct saproto *pr;
-
-	for (pr = p->head; pr; pr = pr->next)
-		if (pr->encmode == IPSECDOI_ATTR_ENC_MODE_TUNNEL)
-			return 1;
-	return 0;
-}
-
-/*
- * set SA to kernel.
- */
-int
-quick_r3prep(iph2, msg0)
-	struct ph2handle *iph2;
-	vchar_t *msg0;
-{
-	int error = ISAKMP_INTERNAL_ERROR;
-
-	/* validity check */
-	if (iph2->status != PHASE2ST_STATUS6) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatched %d.\n", iph2->status);
-		goto end;
-	}
-
-	/* compute both of KEYMATs */
-	if (oakley_compute_keymat(iph2, RESPONDER) < 0)
-		goto end;
-
-	iph2->status = PHASE2ST_ADDSA;
-	iph2->flags ^= ISAKMP_FLAG_C;	/* reset bit */
-
-	/* don't anything if local test mode. */
-	if (f_local) {
-		error = 0;
-		goto end;
-	}
-
-	/* Do UPDATE as responder */
-	plog(LLV_DEBUG, LOCATION, NULL, "call pk_sendupdate\n");
-	if (pk_sendupdate(iph2) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL, "pfkey update failed.\n");
-		goto end;
-	}
-	plog(LLV_DEBUG, LOCATION, NULL, "pfkey update sent.\n");
-
-	/* Do ADD for responder */
-	if (pk_sendadd(iph2) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL, "pfkey add failed.\n");
-		goto end;
-	}
-	plog(LLV_DEBUG, LOCATION, NULL, "pfkey add sent.\n");
-
-	/*
-	 * set policies into SPD if the policy is generated
-	 * from peer's policy.
-	 */
-	if (iph2->spidx_gen) {
-
-		struct policyindex *spidx;
-		struct sockaddr_storage addr;
-		u_int8_t pref;
-		struct sockaddr *src = iph2->src;
-		struct sockaddr *dst = iph2->dst;
-
-		/* make inbound policy */
-		iph2->src = dst;
-		iph2->dst = src;
-		if (pk_sendspdupdate2(iph2) < 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"pfkey spdupdate2(inbound) failed.\n");
-			goto end;
-		}
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"pfkey spdupdate2(inbound) sent.\n");
-
-		spidx = (struct policyindex *)iph2->spidx_gen;
-#ifdef HAVE_POLICY_FWD
-		/* make forward policy if required */
-		if (tunnel_mode_prop(iph2->approval)) {
-			spidx->dir = IPSEC_DIR_FWD;
-			if (pk_sendspdupdate2(iph2) < 0) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"pfkey spdupdate2(forward) failed.\n");
-				goto end;
-			}
-			plog(LLV_DEBUG, LOCATION, NULL,
-				"pfkey spdupdate2(forward) sent.\n");
-		}
-#endif
-
-		/* make outbound policy */
-		iph2->src = src;
-		iph2->dst = dst;
-		spidx->dir = IPSEC_DIR_OUTBOUND;
-		addr = spidx->src;
-		spidx->src = spidx->dst;
-		spidx->dst = addr;
-		pref = spidx->prefs;
-		spidx->prefs = spidx->prefd;
-		spidx->prefd = pref;
-
-		if (pk_sendspdupdate2(iph2) < 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"pfkey spdupdate2(outbound) failed.\n");
-			goto end;
-		}
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"pfkey spdupdate2(outbound) sent.\n");
-
-		/* spidx_gen is unnecessary any more */
-		delsp_bothdir((struct policyindex *)iph2->spidx_gen);
-		racoon_free(iph2->spidx_gen);
-		iph2->spidx_gen = NULL;
-		iph2->generated_spidx=1;
-	}
-
-	error = 0;
-
-end:
-	return error;
-}
-
-/*
- * create HASH, body (SA, NONCE) payload with isakmp header.
- */
-static vchar_t *
-quick_ir1mx(iph2, body, hash)
-	struct ph2handle *iph2;
-	vchar_t *body, *hash;
-{
-	struct isakmp *isakmp;
-	vchar_t *buf = NULL, *new = NULL;
-	char *p;
-	int tlen;
-	struct isakmp_gen *gen;
-	int error = ISAKMP_INTERNAL_ERROR;
-
-	/* create buffer for isakmp payload */
-	tlen = sizeof(*isakmp)
-		+ sizeof(*gen) + hash->l
-		+ body->l;
-	buf = vmalloc(tlen);
-	if (buf == NULL) { 
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get buffer to send.\n");
-		goto end;
-	}
-
-	/* re-set encryption flag, for serurity. */
-	iph2->flags |= ISAKMP_FLAG_E;
-
-	/* set isakmp header */
-	p = set_isakmp_header2(buf, iph2, ISAKMP_NPTYPE_HASH);
-	if (p == NULL)
-		goto end;
-
-	/* add HASH payload */
-	/* XXX is next type always SA ? */
-	p = set_isakmp_payload(p, hash, ISAKMP_NPTYPE_SA);
-
-	/* add body payload */
-	memcpy(p, body->v, body->l);
-
-#ifdef HAVE_PRINT_ISAKMP_C
-	isakmp_printpacket(buf, iph2->ph1->local, iph2->ph1->remote, 1);
-#endif
-
-	/* encoding */
-	new = oakley_do_encrypt(iph2->ph1, buf, iph2->ivm->ive, iph2->ivm->iv);
-	
-	if (new == NULL)
-		goto end;
-
-	vfree(buf);
-
-	buf = new;
-
-	error = 0;
-
-end:
-	if (error && buf != NULL) {
-		vfree(buf);
-		buf = NULL;
-	}
-
-	return buf;
-}
-
-/*
- * get remote's sainfo.
- * NOTE: this function is for responder.
- */
-static int
-get_sainfo_r(iph2)
-	struct ph2handle *iph2;
-{
-	vchar_t *idsrc = NULL, *iddst = NULL;
-	int prefixlen;
-	int error = ISAKMP_INTERNAL_ERROR;
-	int remoteid = 0;
-
-	if (iph2->id == NULL) {
-		switch (iph2->src->sa_family) {
-		case AF_INET:
-			prefixlen = sizeof(struct in_addr) << 3;
-			break;
-		case AF_INET6:
-			prefixlen = sizeof(struct in6_addr) << 3;
-			break;
-		default:
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid family: %d\n", iph2->src->sa_family);
-			goto end;
-		}
-		idsrc = ipsecdoi_sockaddr2id(iph2->src, prefixlen,
-					IPSEC_ULPROTO_ANY);
-	} else {
-		idsrc = vdup(iph2->id);
-	}
-	if (idsrc == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to set ID for source.\n");
-		goto end;
-	}
-
-	if (iph2->id_p == NULL) {
-		switch (iph2->dst->sa_family) {
-		case AF_INET:
-			prefixlen = sizeof(struct in_addr) << 3;
-			break;
-		case AF_INET6:
-			prefixlen = sizeof(struct in6_addr) << 3;
-			break;
-		default:
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid family: %d\n", iph2->dst->sa_family);
-			goto end;
-		}
-		iddst = ipsecdoi_sockaddr2id(iph2->dst, prefixlen,
-					IPSEC_ULPROTO_ANY);
-	} else {
-		iddst = vdup(iph2->id_p);
-	}
-	if (iddst == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to set ID for destination.\n");
-		goto end;
-	}
-
-	{
-		struct remoteconf *conf;
-		conf = getrmconf(iph2->dst);
-		if (conf != NULL)
-			remoteid=conf->ph1id;
-		else{
-			plog(LLV_DEBUG, LOCATION, NULL, "Warning: no valid rmconf !\n");
-			remoteid=0;
-		}
-		
-	}
-
-	iph2->sainfo = getsainfo(idsrc, iddst, iph2->ph1->id_p, remoteid);
-	if (iph2->sainfo == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get sainfo.\n");
-		goto end;
-	}
-
-#ifdef ENABLE_HYBRID
-	/* xauth group inclusion check */
-	if (iph2->sainfo->group != NULL)
-		if(group_check(iph2->ph1,&iph2->sainfo->group->v,1))
-			goto end;
-#endif
-
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"selected sainfo: %s\n", sainfo2str(iph2->sainfo));
-
-	error = 0;
-end:
-	if (idsrc)
-		vfree(idsrc);
-	if (iddst)
-		vfree(iddst);
-
-	return error;
-}
-
-/*
- * Copy both IP addresses in ID payloads into [src,dst]_id if both ID types
- * are IP address and same address family.
- * Then get remote's policy from SPD copied from kernel.
- * If the type of ID payload is address or subnet type, then the index is
- * made from the payload.  If there is no ID payload, or the type of ID
- * payload is NOT address type, then the index is made from the address
- * pair of phase 1.
- * NOTE: This function is only for responder.
- */
-static int
-get_proposal_r(iph2)
-	struct ph2handle *iph2;
-{
-	struct policyindex spidx;
-	struct secpolicy *sp_in, *sp_out;
-	int idi2type = 0;	/* switch whether copy IDs into id[src,dst]. */
-	int error = ISAKMP_INTERNAL_ERROR;
-
-	/* check the existence of ID payload */
-	if ((iph2->id_p != NULL && iph2->id == NULL)
-	 || (iph2->id_p == NULL && iph2->id != NULL)) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"Both IDs wasn't found in payload.\n");
-		return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
-	}
-
-	/* make sure if id[src,dst] is null. */
-	if (iph2->src_id || iph2->dst_id) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"Why do ID[src,dst] exist already.\n");
-		return ISAKMP_INTERNAL_ERROR;
-	}
-
-	memset(&spidx, 0, sizeof(spidx));
-
-#define _XIDT(d) ((struct ipsecdoi_id_b *)(d)->v)->type
-
-	/* make a spidx; a key to search SPD */
-	spidx.dir = IPSEC_DIR_INBOUND;
-	spidx.ul_proto = 0;
-
-	/*
-	 * make destination address in spidx from either ID payload
-	 * or phase 1 address into a address in spidx.
-	 */
-	if (iph2->id != NULL
-	 && (_XIDT(iph2->id) == IPSECDOI_ID_IPV4_ADDR
-	  || _XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR
-	  || _XIDT(iph2->id) == IPSECDOI_ID_IPV4_ADDR_SUBNET
-	  || _XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR_SUBNET)) {
-		/* get a destination address of a policy */
-		error = ipsecdoi_id2sockaddr(iph2->id,
-				(struct sockaddr *)&spidx.dst,
-				&spidx.prefd, &spidx.ul_proto);
-		if (error)
-			return error;
-
-#ifdef INET6
-		/*
-		 * get scopeid from the SA address.
-		 * note that the phase 1 source address is used as
-		 * a destination address to search for a inbound policy entry
-		 * because rcoon is responder.
-		 */
-		if (_XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR) {
-			error = setscopeid((struct sockaddr *)&spidx.dst,
-			                    iph2->src);
-			if (error)
-				return error;
-		}
-#endif
-
-		if (_XIDT(iph2->id) == IPSECDOI_ID_IPV4_ADDR
-		 || _XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR)
-			idi2type = _XIDT(iph2->id);
-
-	} else {
-
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"get a destination address of SP index "
-			"from phase1 address "
-			"due to no ID payloads found "
-			"OR because ID type is not address.\n");
-
-		/*
-		 * copy the SOURCE address of IKE into the DESTINATION address
-		 * of the key to search the SPD because the direction of policy
-		 * is inbound.
-		 */
-		memcpy(&spidx.dst, iph2->src, sysdep_sa_len(iph2->src));
-		switch (spidx.dst.ss_family) {
-		case AF_INET:
-			spidx.prefd = sizeof(struct in_addr) << 3;
-			break;
-#ifdef INET6
-		case AF_INET6:
-			spidx.prefd = sizeof(struct in6_addr) << 3;
-			break;
-#endif
-		default:
-			spidx.prefd = 0;
-			break;
-		}
-	}
-
-	/* make source address in spidx */
-	if (iph2->id_p != NULL
-	 && (_XIDT(iph2->id_p) == IPSECDOI_ID_IPV4_ADDR
-	  || _XIDT(iph2->id_p) == IPSECDOI_ID_IPV6_ADDR
-	  || _XIDT(iph2->id_p) == IPSECDOI_ID_IPV4_ADDR_SUBNET
-	  || _XIDT(iph2->id_p) == IPSECDOI_ID_IPV6_ADDR_SUBNET)) {
-		/* get a source address of inbound SA */
-		error = ipsecdoi_id2sockaddr(iph2->id_p,
-				(struct sockaddr *)&spidx.src,
-				&spidx.prefs, &spidx.ul_proto);
-		if (error)
-			return error;
-
-#ifdef INET6
-		/*
-		 * get scopeid from the SA address.
-		 * for more detail, see above of this function.
-		 */
-		if (_XIDT(iph2->id_p) == IPSECDOI_ID_IPV6_ADDR) {
-			error = setscopeid((struct sockaddr *)&spidx.src,
-			                    iph2->dst);
-			if (error)
-				return error;
-		}
-#endif
-
-		/* make id[src,dst] if both ID types are IP address and same */
-		if (_XIDT(iph2->id_p) == idi2type
-		 && spidx.dst.ss_family == spidx.src.ss_family) {
-			iph2->src_id = dupsaddr((struct sockaddr *)&spidx.dst);
-			if (iph2->src_id  == NULL) {
-				plog(LLV_ERROR, LOCATION, NULL,
-				    "buffer allocation failed.\n");
-				return ISAKMP_INTERNAL_ERROR;
-			}
-			iph2->dst_id = dupsaddr((struct sockaddr *)&spidx.src);
-			if (iph2->dst_id  == NULL) {
-				plog(LLV_ERROR, LOCATION, NULL,
-				    "buffer allocation failed.\n");
-				return ISAKMP_INTERNAL_ERROR;
-			}
-		}
-
-	} else {
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"get a source address of SP index "
-			"from phase1 address "
-			"due to no ID payloads found "
-			"OR because ID type is not address.\n");
-
-		/* see above comment. */
-		memcpy(&spidx.src, iph2->dst, sysdep_sa_len(iph2->dst));
-		switch (spidx.src.ss_family) {
-		case AF_INET:
-			spidx.prefs = sizeof(struct in_addr) << 3;
-			break;
-#ifdef INET6
-		case AF_INET6:
-			spidx.prefs = sizeof(struct in6_addr) << 3;
-			break;
-#endif
-		default:
-			spidx.prefs = 0;
-			break;
-		}
-	}
-
-#undef _XIDT
-
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"get a src address from ID payload "
-		"%s prefixlen=%u ul_proto=%u\n",
-		saddr2str((struct sockaddr *)&spidx.src),
-		spidx.prefs, spidx.ul_proto);
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"get dst address from ID payload "
-		"%s prefixlen=%u ul_proto=%u\n",
-		saddr2str((struct sockaddr *)&spidx.dst),
-		spidx.prefd, spidx.ul_proto);
-
-	/*
-	 * convert the ul_proto if it is 0
-	 * because 0 in ID payload means a wild card.
-	 */
-	if (spidx.ul_proto == 0)
-		spidx.ul_proto = IPSEC_ULPROTO_ANY;
-
-#ifdef HAVE_SECCTX
-	/*
-	 * Need to use security context in spidx to ensure the correct
-	 * policy is selected. The only way to get the security context
-	 * is to look into the proposal sent by peer ahead of time.
-	 */
-	if (get_security_context(iph2->sa, &spidx)) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		     "error occurred trying to get security context.\n");
-		return ISAKMP_INTERNAL_ERROR;
-	}
-#endif /* HAVE_SECCTX */
-
-	/* get inbound policy */
-	sp_in = getsp_r(&spidx);
-	if (sp_in == NULL) {
-		if (iph2->ph1->rmconf->gen_policy) {
-			plog(LLV_INFO, LOCATION, NULL,
-				"no policy found, "
-				"try to generate the policy : %s\n",
-				spidx2str(&spidx));
-			iph2->spidx_gen = racoon_malloc(sizeof(spidx));
-			if (!iph2->spidx_gen) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"buffer allocation failed.\n");
-				return ISAKMP_INTERNAL_ERROR;
-			}
-			memcpy(iph2->spidx_gen, &spidx, sizeof(spidx));
-			return -2;	/* special value */
-		}
-		plog(LLV_ERROR, LOCATION, NULL,
-			"no policy found: %s\n", spidx2str(&spidx));
-		return ISAKMP_INTERNAL_ERROR;
-	}
-	/* Refresh existing generated policies
-	 */
-	if (iph2->ph1->rmconf->gen_policy) {
-		plog(LLV_INFO, LOCATION, NULL,
-			 "Update the generated policy : %s\n",
-			 spidx2str(&spidx));
-		iph2->spidx_gen = racoon_malloc(sizeof(spidx));
-		if (!iph2->spidx_gen) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				 "buffer allocation failed.\n");
-			return ISAKMP_INTERNAL_ERROR;
-		}
-		memcpy(iph2->spidx_gen, &spidx, sizeof(spidx));
-	}
-
-	/* get outbound policy */
-    {
-	struct sockaddr_storage addr;
-	u_int8_t pref;
-
-	spidx.dir = IPSEC_DIR_OUTBOUND;
-	addr = spidx.src;
-	spidx.src = spidx.dst;
-	spidx.dst = addr;
-	pref = spidx.prefs;
-	spidx.prefs = spidx.prefd;
-	spidx.prefd = pref;
-
-	sp_out = getsp_r(&spidx);
-	if (!sp_out) {
-		plog(LLV_WARNING, LOCATION, NULL,
-			"no outbound policy found: %s\n",
-			spidx2str(&spidx));
-	}
-    }
-
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"suitable SP found:%s\n", spidx2str(&spidx));
-
-	/*
-	 * In the responder side, the inbound policy should be using IPsec.
-	 * outbound policy is not checked currently.
-	 */
-	if (sp_in->policy != IPSEC_POLICY_IPSEC) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"policy found, but no IPsec required: %s\n",
-			spidx2str(&spidx));
-		return ISAKMP_INTERNAL_ERROR;
-	}
-
-	/* set new proposal derived from a policy into the iph2->proposal. */
-	if (set_proposal_from_policy(iph2, sp_in, sp_out) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to create saprop.\n");
-		return ISAKMP_INTERNAL_ERROR;
-	}
-
-#ifdef HAVE_SECCTX
-	if (spidx.sec_ctx.ctx_str) {
-		set_secctx_in_proposal(iph2, spidx);
-	}
-#endif /* HAVE_SECCTX */
-
-	return 0;
-}
-
diff --git a/src/racoon/isakmp_quick.h b/src/racoon/isakmp_quick.h
deleted file mode 100644
index 71eeecf..0000000
--- a/src/racoon/isakmp_quick.h
+++ /dev/null
@@ -1,50 +0,0 @@
-/*	$NetBSD: isakmp_quick.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/* Id: isakmp_quick.h,v 1.3 2004/06/11 16:00:16 ludvigm Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _ISAKMP_QUICK_H
-#define _ISAKMP_QUICK_H
-
-extern int quick_i1prep __P((struct ph2handle *, vchar_t *));
-extern int quick_i1send __P((struct ph2handle *, vchar_t *));
-extern int quick_i2recv __P((struct ph2handle *, vchar_t *));
-extern int quick_i2send __P((struct ph2handle *, vchar_t *));
-extern int quick_i3recv __P((struct ph2handle *, vchar_t *));
-
-extern int quick_r1recv __P((struct ph2handle *, vchar_t *));
-extern int quick_r1prep __P((struct ph2handle *, vchar_t *));
-extern int quick_r2send __P((struct ph2handle *, vchar_t *));
-extern int quick_r3recv __P((struct ph2handle *, vchar_t *));
-extern int quick_r3send __P((struct ph2handle *, vchar_t *));
-extern int quick_r3prep __P((struct ph2handle *, vchar_t *));
-
-#endif /* _ISAKMP_QUICK_H */
diff --git a/src/racoon/isakmp_unity.c b/src/racoon/isakmp_unity.c
deleted file mode 100644
index 7a332e3..0000000
--- a/src/racoon/isakmp_unity.c
+++ /dev/null
@@ -1,411 +0,0 @@
-/*	$NetBSD: isakmp_unity.c,v 1.7 2006/10/09 06:17:20 manu Exp $	*/
-
-/* Id: isakmp_unity.c,v 1.10 2006/07/31 04:49:23 manubsd Exp */
-
-/*
- * Copyright (C) 2004 Emmanuel Dreyfus
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/socket.h>
-#include <sys/queue.h>
-
-#include <netinet/in.h>
-#include <arpa/inet.h>
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <fcntl.h>
-#include <string.h>
-#include <errno.h>
-#if TIME_WITH_SYS_TIME
-# include <sys/time.h>
-# include <time.h>
-#else
-# if HAVE_SYS_TIME_H
-#  include <sys/time.h>
-# else
-#  include <time.h>
-# endif
-#endif
-#include <netdb.h>
-#ifdef HAVE_UNISTD_H
-#include <unistd.h>
-#endif
-#include <ctype.h>
-#include <resolv.h>
-
-#include "var.h"
-#include "misc.h"
-#include "vmbuf.h"
-#include "plog.h"
-#include "sockmisc.h"
-#include "schedule.h"
-#include "debug.h"
-
-#include "isakmp_var.h"
-#include "isakmp.h"
-#include "handler.h"
-#include "isakmp_xauth.h"
-#include "isakmp_unity.h"
-#include "isakmp_cfg.h"
-#include "strnames.h"
-
-static vchar_t *isakmp_cfg_split(struct ph1handle *, 
-    struct isakmp_data *, struct unity_netentry*,int);
-
-vchar_t *
-isakmp_unity_req(iph1, attr)
-	struct ph1handle *iph1;
-	struct isakmp_data *attr;
-{
-	int type;
-	vchar_t *reply_attr = NULL;
-
-	if ((iph1->mode_cfg->flags & ISAKMP_CFG_VENDORID_UNITY) == 0) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "Unity mode config request but the peer "
-		    "did not declare itself as  unity compliant\n");
-		return NULL;
-	}
-
-	type = ntohs(attr->type);
-
-	/* Handle short attributes */
-	if ((type & ISAKMP_GEN_MASK) == ISAKMP_GEN_TV) {
-		type &= ~ISAKMP_GEN_MASK;
-
-		plog(LLV_DEBUG, LOCATION, NULL,
-		     "Short attribute %s = %d\n", 
-		     s_isakmp_cfg_type(type), ntohs(attr->lorv));
-
-		switch (type) {
-		default:
-			plog(LLV_DEBUG, LOCATION, NULL,
-			     "Ignored short attribute %s\n",
-			     s_isakmp_cfg_type(type));
-			break;
-		}
-
-		return reply_attr;
-	}
-
-	switch(type) {
-	case UNITY_BANNER: {
-#define MAXMOTD 65536
-		char buf[MAXMOTD + 1];
-		int fd;
-		char *filename = &isakmp_cfg_config.motd[0];
-		int len;
-
-		if ((fd = open(filename, O_RDONLY, 0)) == -1) {
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "Cannot open \"%s\"\n", filename);
-			return NULL;
-		}
-
-		if ((len = read(fd, buf, MAXMOTD)) == -1) {
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "Cannot read \"%s\"\n", filename);
-			close(fd);
-			return NULL;
-		}
-		close(fd);
-
-		buf[len] = '\0';
-		reply_attr = isakmp_cfg_string(iph1, attr, buf);
-
-		break;
-	}
-
-	case UNITY_PFS:
-		reply_attr = isakmp_cfg_short(iph1, attr, 
-		    isakmp_cfg_config.pfs_group);
-		break;
-
-	case UNITY_SAVE_PASSWD:
-		reply_attr = isakmp_cfg_short(iph1, attr, 
-		    isakmp_cfg_config.save_passwd);
-		break;
-
-	case UNITY_DDNS_HOSTNAME:
-		reply_attr = isakmp_cfg_copy(iph1, attr);
-		break;
-
-	case UNITY_DEF_DOMAIN:
-		reply_attr = isakmp_cfg_string(iph1, 
-		    attr, isakmp_cfg_config.default_domain);
-		break;
-
-	case UNITY_SPLIT_INCLUDE:
-		if(isakmp_cfg_config.splitnet_type == UNITY_SPLIT_INCLUDE)
-			reply_attr = isakmp_cfg_split(iph1, attr,
-			isakmp_cfg_config.splitnet_list,
-			isakmp_cfg_config.splitnet_count);
-		else
-			return NULL;
-		break;
-	case UNITY_LOCAL_LAN:
-		if(isakmp_cfg_config.splitnet_type == UNITY_LOCAL_LAN)
-			reply_attr = isakmp_cfg_split(iph1, attr,
-			isakmp_cfg_config.splitnet_list,
-			isakmp_cfg_config.splitnet_count);
-		else
-			return NULL;
-		break;
-	case UNITY_SPLITDNS_NAME:
-		reply_attr = isakmp_cfg_varlen(iph1, attr,
-				isakmp_cfg_config.splitdns_list,
-				isakmp_cfg_config.splitdns_len);
-		break;
-	case UNITY_FW_TYPE:
-	case UNITY_NATT_PORT:
-	case UNITY_BACKUP_SERVERS:
-	default:
-		plog(LLV_DEBUG, LOCATION, NULL,
-		     "Ignored attribute %s\n", s_isakmp_cfg_type(type));
-		return NULL;
-		break;
-	}
-
-	return reply_attr;
-}
-
-void
-isakmp_unity_reply(iph1, attr)
-	struct ph1handle *iph1;
-	struct isakmp_data *attr;
-{
-	int type = ntohs(attr->type);
-	int alen = ntohs(attr->lorv);
-
-	struct unity_network *network = (struct unity_network *)(attr + 1);
-	int index = 0;
-	int count = 0;
-
-	switch(type) {
-	case UNITY_SPLIT_INCLUDE:
-	{
-		if (alen)
-			count = alen / sizeof(struct unity_network);
-
-		for(;index < count; index++)
-			splitnet_list_add(
-				&iph1->mode_cfg->split_include,
-				&network[index],
-				&iph1->mode_cfg->include_count);
-
-		iph1->mode_cfg->flags |= ISAKMP_CFG_GOT_SPLIT_INCLUDE;
-		break;
-	}
-	case UNITY_LOCAL_LAN:
-	{
-		if (alen)
-			count = alen / sizeof(struct unity_network);
-
-		for(;index < count; index++)
-			splitnet_list_add(
-				&iph1->mode_cfg->split_local,
-				&network[index],
-				&iph1->mode_cfg->local_count);
-
-		iph1->mode_cfg->flags |= ISAKMP_CFG_GOT_SPLIT_LOCAL;
-		break;
-	}
-	case UNITY_SPLITDNS_NAME:
-	case UNITY_BANNER:
-	case UNITY_SAVE_PASSWD:
-	case UNITY_NATT_PORT:
-	case UNITY_PFS:
-	case UNITY_FW_TYPE:
-	case UNITY_BACKUP_SERVERS:
-	case UNITY_DDNS_HOSTNAME:
-	default:
-		plog(LLV_WARNING, LOCATION, NULL,
-		     "Ignored attribute %s\n",
-		     s_isakmp_cfg_type(type));
-		break;
-	}
-	return;
-}
-
-static vchar_t *
-isakmp_cfg_split(iph1, attr, netentry, count)
-	struct ph1handle *iph1;
-	struct isakmp_data *attr;
-	struct unity_netentry *netentry;
-	int count;
-{
-	vchar_t *buffer;
-	struct isakmp_data *new;
-	struct unity_network * network;
-	size_t len;
-	int index = 0;
-
-	char tmp1[40];
-	char tmp2[40];
-
-	len = sizeof(struct unity_network) * count;
-	if ((buffer = vmalloc(sizeof(*attr) + len)) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "Cannot allocate memory\n");
-		return NULL;
-	}
-
-	new = (struct isakmp_data *)buffer->v;
-	new->type = attr->type;
-	new->lorv = htons(len);
-
-	network = (struct unity_network *)(new + 1);
-	for (; index < count; index++) {
-
-		memcpy(&network[index],
-			&netentry->network,
-			sizeof(struct unity_network));
-
-		inet_ntop(AF_INET, &netentry->network.addr4, tmp1, 40);
-		inet_ntop(AF_INET, &netentry->network.mask4, tmp2, 40);
-		plog(LLV_DEBUG, LOCATION, NULL, "splitnet: %s/%s\n", tmp1, tmp2);
-
-		netentry = netentry->next;
-	}
-
-	return buffer;
-}
-
-int  splitnet_list_add(list, network, count)
-	struct unity_netentry ** list;
-	struct unity_network * network;
-	int *count;
-{
-	struct unity_netentry * newentry;
-
-	/*
-	 * allocate new netentry and copy
-         * new splitnet network data
-	 */
-	newentry = (struct unity_netentry *)
-		racoon_malloc(sizeof(struct unity_netentry));
-	if (newentry == NULL)
-		return -1;
-
-	memcpy(&newentry->network,network,
-		sizeof(struct unity_network));
-	newentry->next = NULL;
-
-	/*
-	 * locate the last netentry in our
-	 * splitnet list and add our entry
-	 */
-	if (*list == NULL)
-		*list = newentry;
-	else {
-		struct unity_netentry * tmpentry = *list;
-		while (tmpentry->next != NULL)
-			tmpentry = tmpentry->next;
-		tmpentry->next = newentry;
-	}
-
-	(*count)++;
-
-	return 0;
-}
-
-void splitnet_list_free(list, count)
-	struct unity_netentry * list;
-	int *count;
-{
-	struct unity_netentry * netentry = list;
-	struct unity_netentry * delentry;
-
-	*count = 0;
-
-	while (netentry != NULL) {
-		delentry = netentry;
-		netentry = netentry->next;
-		racoon_free(delentry);
-	}
-}
-
-char * splitnet_list_2str(list, splitnet_ipaddr)
-	struct unity_netentry * list;
-	enum splinet_ipaddr splitnet_ipaddr;
-{
-	struct unity_netentry * netentry;
-	char tmp1[40];
-	char tmp2[40];
-	char * str;
-	int len;
-
-	/* determine string length */
-	len = 1;
-	netentry = list;
-	while (netentry != NULL) {
-
-		inet_ntop(AF_INET, &netentry->network.addr4, tmp1, 40);
-		inet_ntop(AF_INET, &netentry->network.mask4, tmp2, 40);
-		len += strlen(tmp1);
-		len += strlen(tmp2);
-		len += 2;
-
-		netentry = netentry->next;
-	}
-
-	/* allocate network list string */
-	str = racoon_malloc(len);
-	if (str == NULL)
-		return NULL;
-
-	/* create network list string */
-	len = 0;
-	netentry = list;
-	while (netentry != NULL) {
-
-		inet_ntop(AF_INET, &netentry->network.addr4, tmp1, 40);
-		inet_ntop(AF_INET, &netentry->network.mask4, tmp2, 40);
-		if (splitnet_ipaddr == CIDR) {
-			uint32_t tmp3;
-			int cidrmask;
-
-			tmp3 = ntohl(netentry->network.mask4.s_addr);
-			for (cidrmask = 0; tmp3 != 0; cidrmask++)
-				tmp3 <<= 1;
-			len += sprintf(str+len, "%s/%d ", tmp1, cidrmask);
-		} else {
-			len += sprintf(str+len, "%s/%s ", tmp1, tmp2);
-		}
-
-		netentry = netentry->next;
-	}
-
-	str[len]=0;
-
-	return str;
-}
diff --git a/src/racoon/isakmp_unity.h b/src/racoon/isakmp_unity.h
deleted file mode 100644
index f564197..0000000
--- a/src/racoon/isakmp_unity.h
+++ /dev/null
@@ -1,74 +0,0 @@
-/*	$NetBSD: isakmp_unity.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/*	$KAME$ */
-
-/*
- * Copyright (C) 2004 Emmanuel Dreyfus 
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-enum splinet_ipaddr { NETMASK, CIDR };
-
-/* ISAKMP notifies specific to the Unity vendor Id */
-/* Sent during xauth if the user types his password too slowly */
-#define ISAKMP_NTYPE_UNITY_HEARTBEAT	40500
-
-/* ISAKMP mode config attributes specific to the Unity vendor Id */
-#define UNITY_BANNER		28672
-#define UNITY_SAVE_PASSWD	28673
-#define UNITY_DEF_DOMAIN	28674
-#define UNITY_SPLITDNS_NAME	28675
-#define UNITY_SPLIT_INCLUDE	28676
-#define UNITY_NATT_PORT		28677
-#define UNITY_LOCAL_LAN		28678
-#define UNITY_PFS		28679
-#define UNITY_FW_TYPE		28680
-#define UNITY_BACKUP_SERVERS	28681
-#define UNITY_DDNS_HOSTNAME	28682
-
-/*
- * Unity adress/mask lists
- * XXX : the padding is probably there for something !
- */
-        
-struct unity_network {
-	struct in_addr addr4;
-	struct in_addr mask4;
-	char padding[6];
-} __attribute__((__packed__));
-        
-struct unity_netentry {
-	struct unity_network    network;       
-	struct unity_netentry   *next;
-};
-
-int	splitnet_list_add(struct unity_netentry **, struct unity_network *, int *);
-void	splitnet_list_free(struct unity_netentry *, int *);
-char *	splitnet_list_2str(struct unity_netentry *, enum splinet_ipaddr);
-
-vchar_t *isakmp_unity_req(struct ph1handle *, struct isakmp_data *);
-void isakmp_unity_reply(struct ph1handle *, struct isakmp_data *);
diff --git a/src/racoon/isakmp_var.h b/src/racoon/isakmp_var.h
deleted file mode 100644
index f4ef45d..0000000
--- a/src/racoon/isakmp_var.h
+++ /dev/null
@@ -1,132 +0,0 @@
-/*	$NetBSD: isakmp_var.h,v 1.6.6.1 2007/02/20 09:08:49 vanhu Exp $	*/
-
-/* Id: isakmp_var.h,v 1.12 2005/05/07 14:45:31 manubsd Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _ISAKMP_VAR_H
-#define _ISAKMP_VAR_H
-
-#include "vmbuf.h"
-
-#define PORT_ISAKMP 500
-#define PORT_ISAKMP_NATT 4500
-
-#define DEFAULT_NONCE_SIZE	16
-
-typedef u_char cookie_t[8];
-typedef u_char msgid_t[4];
-
-typedef struct { /* i_cookie + r_cookie */
-	cookie_t i_ck;
-	cookie_t r_ck;
-} isakmp_index;
-
-struct isakmp_gen;
-struct sched;
-
-struct sockaddr;
-struct ph1handle;
-struct ph2handle;
-struct remoteconf;
-struct isakmp_gen;
-struct ipsecdoi_pl_id;	/* XXX */
-struct isakmp_pl_ke;	/* XXX */
-struct isakmp_pl_nonce;	/* XXX */
-
-extern int isakmp_handler __P((int));
-extern int isakmp_ph1begin_i __P((struct remoteconf *, struct sockaddr *,
-	struct sockaddr *));
-
-extern vchar_t *isakmp_parsewoh __P((int, struct isakmp_gen *, int));
-extern vchar_t *isakmp_parse __P((vchar_t *));
-
-extern int isakmp_init __P((void));
-extern const char *isakmp_pindex __P((const isakmp_index *, const u_int32_t));
-extern int isakmp_open __P((void));
-extern void isakmp_close __P((void));
-extern int isakmp_send __P((struct ph1handle *, vchar_t *));
-
-extern void isakmp_ph1resend_stub __P((void *));
-extern int isakmp_ph1resend __P((struct ph1handle *));
-extern void isakmp_ph2resend_stub __P((void *));
-extern int isakmp_ph2resend __P((struct ph2handle *));
-extern void isakmp_ph1expire_stub __P((void *));
-extern void isakmp_ph1expire __P((struct ph1handle *));
-extern void isakmp_ph1delete_stub __P((void *));
-extern void isakmp_ph1delete __P((struct ph1handle *));
-extern void isakmp_ph2expire_stub __P((void *));
-extern void isakmp_ph2expire __P((struct ph2handle *));
-extern void isakmp_ph2delete_stub __P((void *));
-extern void isakmp_ph2delete __P((struct ph2handle *));
-
-extern int isakmp_post_acquire __P((struct ph2handle *));
-extern int isakmp_post_getspi __P((struct ph2handle *));
-extern void isakmp_chkph1there_stub __P((void *));
-extern void isakmp_chkph1there __P((struct ph2handle *));
-
-extern caddr_t isakmp_set_attr_v __P((caddr_t, int, caddr_t, int));
-extern caddr_t isakmp_set_attr_l __P((caddr_t, int, u_int32_t));
-extern vchar_t *isakmp_add_attr_v __P((vchar_t *, int, caddr_t, int));
-extern vchar_t *isakmp_add_attr_l __P((vchar_t *, int, u_int32_t));
-
-extern int isakmp_newcookie __P((caddr_t, struct sockaddr *, struct sockaddr *));
-
-extern int isakmp_p2ph __P((vchar_t **, struct isakmp_gen *));
-
-extern u_int32_t isakmp_newmsgid2 __P((struct ph1handle *));
-extern caddr_t set_isakmp_header1 __P((vchar_t *, struct ph1handle *, int));
-extern caddr_t set_isakmp_header2 __P((vchar_t *, struct ph2handle *, int));
-extern caddr_t set_isakmp_payload __P((caddr_t, vchar_t *, int));
-
-extern struct payload_list *isakmp_plist_append __P((struct payload_list *plist, 
-	vchar_t *payload, int payload_type));
-extern vchar_t *isakmp_plist_set_all __P((struct payload_list **plist,
-	struct ph1handle *iph1));
-
-#ifdef HAVE_PRINT_ISAKMP_C
-extern void isakmp_printpacket __P((vchar_t *, struct sockaddr *,
-	struct sockaddr *, int));
-#endif
-
-extern int copy_ph1addresses __P(( struct ph1handle *,
-	struct remoteconf *, struct sockaddr *, struct sockaddr *));
-extern void log_ph1established __P((const struct ph1handle *));
-
-extern void script_hook __P((struct ph1handle *, int)); 
-extern int script_env_append __P((char ***, int *, char *, char *));
-extern int script_exec __P((char *, int, char * const *));
-
-void purge_remote __P((struct ph1handle *));
-void delete_spd __P((struct ph2handle *, u_int64_t));
-#ifdef INET6
-u_int32_t setscopeid __P((struct sockaddr *, struct sockaddr *));
-#endif
-#endif /* _ISAKMP_VAR_H */
diff --git a/src/racoon/isakmp_xauth.c b/src/racoon/isakmp_xauth.c
deleted file mode 100644
index 3f62587..0000000
--- a/src/racoon/isakmp_xauth.c
+++ /dev/null
@@ -1,1704 +0,0 @@
-/*	$NetBSD: isakmp_xauth.c,v 1.11.6.2 2009/04/20 13:35:36 tteras Exp $	*/
-
-/* Id: isakmp_xauth.c,v 1.38 2006/08/22 18:17:17 manubsd Exp */
-
-/*
- * Copyright (C) 2004-2005 Emmanuel Dreyfus
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/socket.h>
-#include <sys/queue.h>
-
-#include <netinet/in.h>
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-#include <pwd.h>
-#include <grp.h>
-#if TIME_WITH_SYS_TIME
-# include <sys/time.h>
-# include <time.h>
-#else
-# if HAVE_SYS_TIME_H
-#  include <sys/time.h>
-# else
-#  include <time.h>
-# endif
-#endif
-#include <netdb.h>
-#ifdef HAVE_UNISTD_H
-#include <unistd.h>
-#endif
-#include <ctype.h>
-#include <resolv.h>
-
-#ifdef HAVE_SHADOW_H
-#include <shadow.h>
-#endif
-
-#include "var.h"
-#include "misc.h"
-#include "vmbuf.h"
-#include "plog.h"
-#include "sockmisc.h"
-#include "schedule.h"
-#include "debug.h"
-
-#include "crypto_openssl.h"
-#include "isakmp_var.h"
-#include "isakmp.h"
-#include "admin.h"
-#include "privsep.h"
-#include "evt.h"
-#include "handler.h"
-#include "throttle.h"
-#include "remoteconf.h"
-#include "isakmp_inf.h"
-#include "isakmp_xauth.h"
-#include "isakmp_unity.h"
-#include "isakmp_cfg.h"
-#include "strnames.h"
-#include "ipsec_doi.h"
-#include "remoteconf.h"
-#include "localconf.h"
-
-#ifdef HAVE_LIBRADIUS
-#include <radlib.h>
-
-struct rad_handle *radius_auth_state = NULL;
-struct rad_handle *radius_acct_state = NULL;
-#endif
-
-#ifdef HAVE_LIBPAM
-#include <security/pam_appl.h>
-
-static char *PAM_usr = NULL;
-static char *PAM_pwd = NULL;
-static int PAM_conv(int, const struct pam_message **, 
-    struct pam_response **, void *);
-static struct pam_conv PAM_chat = { &PAM_conv, NULL };
-#endif
-
-#ifdef HAVE_LIBLDAP
-#include "ldap.h"
-#include <arpa/inet.h>
-struct xauth_ldap_config xauth_ldap_config;
-#endif
-
-void 
-xauth_sendreq(iph1)
-	struct ph1handle *iph1;
-{
-	vchar_t *buffer;
-	struct isakmp_pl_attr *attr;
-	struct isakmp_data *typeattr;
-	struct isakmp_data *usrattr;
-	struct isakmp_data *pwdattr;
-	struct xauth_state *xst = &iph1->mode_cfg->xauth;
-	size_t tlen;
-
-	/* Status checks */
-	if (iph1->status != PHASE1ST_ESTABLISHED) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "Xauth request while phase 1 is not completed\n");
-		return;
-	}
-
-	if (xst->status != XAUTHST_NOTYET) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "Xauth request whith Xauth state %d\n", xst->status);
-		return;
-	}
-
-	plog(LLV_INFO, LOCATION, NULL, "Sending Xauth request\n");
-
-	tlen = sizeof(*attr) +
-	       + sizeof(*typeattr) +
-	       + sizeof(*usrattr) +
-	       + sizeof(*pwdattr);
-	
-	if ((buffer = vmalloc(tlen)) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "Cannot allocate buffer\n");
-		return;
-	}
-	
-	attr = (struct isakmp_pl_attr *)buffer->v;
-	memset(attr, 0, tlen);
-
-	attr->h.len = htons(tlen);
-	attr->type = ISAKMP_CFG_REQUEST;
-	attr->id = htons(eay_random());
-
-	typeattr = (struct isakmp_data *)(attr + 1);
-	typeattr->type = htons(XAUTH_TYPE | ISAKMP_GEN_TV);
-	typeattr->lorv = htons(XAUTH_TYPE_GENERIC);
-
-	usrattr = (struct isakmp_data *)(typeattr + 1);
-	usrattr->type = htons(XAUTH_USER_NAME | ISAKMP_GEN_TLV);
-	usrattr->lorv = htons(0);
-
-	pwdattr = (struct isakmp_data *)(usrattr + 1);
-	pwdattr->type = htons(XAUTH_USER_PASSWORD | ISAKMP_GEN_TLV);
-	pwdattr->lorv = htons(0);
-
-	isakmp_cfg_send(iph1, buffer, 
-	    ISAKMP_NPTYPE_ATTR, ISAKMP_FLAG_E, 1);
-	
-	vfree(buffer);
-
-	xst->status = XAUTHST_REQSENT;
-
-	return;
-}
-
-int
-xauth_attr_reply(iph1, attr, id)
-	struct ph1handle *iph1;
-	struct isakmp_data *attr;
-	int id;
-{
-	char **outlet = NULL;
-	size_t alen = 0;
-	int type;
-	struct xauth_state *xst = &iph1->mode_cfg->xauth;
-
-	if ((iph1->mode_cfg->flags & ISAKMP_CFG_VENDORID_XAUTH) == 0) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "Xauth reply but peer did not declare "
-		    "itself as Xauth capable\n");
-		return -1;
-	}
-
-	if (xst->status != XAUTHST_REQSENT) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "Xauth reply while Xauth state is %d\n", xst->status);
-		return -1;
-	}
-
-	type = ntohs(attr->type) & ~ISAKMP_GEN_MASK;
-	switch (type) {
-	case XAUTH_TYPE:
-		switch (ntohs(attr->lorv)) {
-		case XAUTH_TYPE_GENERIC:
-			xst->authtype = XAUTH_TYPE_GENERIC;
-			break;
-		default:
-			plog(LLV_WARNING, LOCATION, NULL, 
-			    "Unexpected authentication type %d\n", 
-			    ntohs(type));
-			return -1;
-		}
-		break;
-
-	case XAUTH_USER_NAME:
-		outlet = &xst->authdata.generic.usr;
-		break;
-
-	case XAUTH_USER_PASSWORD:
-		outlet = &xst->authdata.generic.pwd; 
-		break;
-
-	default:
-		plog(LLV_WARNING, LOCATION, NULL, 
-		    "ignored Xauth attribute %d\n", type);
-		break;
-	}
-
-	if (outlet != NULL) {
-		alen = ntohs(attr->lorv);
-
-		if ((*outlet = racoon_malloc(alen + 1)) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "Cannot allocate memory for Xauth Data\n");
-			return -1;
-		}
-
-		memcpy(*outlet, attr + 1, alen);
-		(*outlet)[alen] = '\0';
-		outlet = NULL;
-	}
-
-	
-	if ((xst->authdata.generic.usr != NULL) &&
-	   (xst->authdata.generic.pwd != NULL)) {
-		int port;
-		int res;
-		char *usr = xst->authdata.generic.usr;
-		char *pwd = xst->authdata.generic.pwd;
-		time_t throttle_delay = 0;
-
-#if 0	/* Real debug, don't do that at home */
-		plog(LLV_DEBUG, LOCATION, NULL, 
-		    "Got username \"%s\", password \"%s\"\n", usr, pwd);
-#endif
-		strncpy(iph1->mode_cfg->login, usr, LOGINLEN);
-		iph1->mode_cfg->login[LOGINLEN] = '\0';
-
-		res = -1;
-		if ((port = isakmp_cfg_getport(iph1)) == -1) {
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "Port pool depleted\n");
-			goto skip_auth;
-		}	
-
-		switch (isakmp_cfg_config.authsource) {
-		case ISAKMP_CFG_AUTH_SYSTEM:
-			res = privsep_xauth_login_system(usr, pwd);
-			break;
-#ifdef HAVE_LIBRADIUS
-		case ISAKMP_CFG_AUTH_RADIUS:
-			res = xauth_login_radius(iph1, usr, pwd);
-			break;
-#endif
-#ifdef HAVE_LIBPAM
-		case ISAKMP_CFG_AUTH_PAM:
-			res = privsep_xauth_login_pam(iph1->mode_cfg->port, 
-			    iph1->remote, usr, pwd);
-			break;
-#endif
-#ifdef HAVE_LIBLDAP
-		case ISAKMP_CFG_AUTH_LDAP:
-			res = xauth_login_ldap(iph1, usr, pwd);
-			break;
-#endif
-		default:
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "Unexpected authentication source\n");
-			res = -1;
-			break;
-		}
-
-		/*
-		 * Optional group authentication
-		 */
-		if (!res && (isakmp_cfg_config.groupcount))
-			res = group_check(iph1,
-				isakmp_cfg_config.grouplist,
-				isakmp_cfg_config.groupcount);
-
-		/*
-		 * On failure, throttle the connexion for the remote host
-		 * in order to make password attacks more difficult.
-		 */
-		throttle_delay = throttle_host(iph1->remote, res) - time(NULL);
-		if (throttle_delay > 0) {
-			char *str;
-
-			str = saddrwop2str(iph1->remote);
-
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "Throttling in action for %s: delay %lds\n",
-			    str, (unsigned long)throttle_delay);
-			res = -1;
-		} else {
-			throttle_delay = 0;
-		}
-
-skip_auth:
-		if (throttle_delay != 0) {
-			struct xauth_reply_arg *xra;
-
-			if ((xra = racoon_malloc(sizeof(*xra))) == NULL) {
-				plog(LLV_ERROR, LOCATION, NULL, 
-				    "malloc failed, bypass throttling\n");
-				return xauth_reply(iph1, port, id, res);
-			}
-
-			/*
-			 * We need to store the ph1, but it might have
-			 * disapeared when xauth_reply is called, so
-			 * store the index instead.
-			 */
-			xra->index = iph1->index;
-			xra->port = port;
-			xra->id = id;
-			xra->res = res;
-			sched_new(throttle_delay, xauth_reply_stub, xra);
-		} else {
-			return xauth_reply(iph1, port, id, res);
-		}
-	}
-
-	return 0;
-}
-
-void 
-xauth_reply_stub(args)
-	void *args;
-{
-	struct xauth_reply_arg *xra = (struct xauth_reply_arg *)args;
-	struct ph1handle *iph1;
-
-	if ((iph1 = getph1byindex(&xra->index)) != NULL)
-		(void)xauth_reply(iph1, xra->port, xra->id, xra->res);
-	else
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "Delayed Xauth reply: phase 1 no longer exists.\n"); 
-
-	racoon_free(xra);
-	return;
-}
-
-int
-xauth_reply(iph1, port, id, res)
-	struct ph1handle *iph1;
-	int port;
-	int id;
-#if defined(ANDROID_CHANGES)
-	int res;
-#endif
-{
-	struct xauth_state *xst = &iph1->mode_cfg->xauth;
-	char *usr = xst->authdata.generic.usr;
-
-	if (res != 0) {
-		if (port != -1)
-			isakmp_cfg_putport(iph1, port);
-
-		plog(LLV_INFO, LOCATION, NULL, 
-		    "login failed for user \"%s\"\n", usr);
-		
-		xauth_sendstatus(iph1, XAUTH_STATUS_FAIL, id);
-		xst->status = XAUTHST_NOTYET;
-
-		/* Delete Phase 1 SA */
-		if (iph1->status == PHASE1ST_ESTABLISHED)
-			isakmp_info_send_d1(iph1);
-		remph1(iph1);
-		delph1(iph1);
-
-		return -1;
-	}
-
-	xst->status = XAUTHST_OK;
-	plog(LLV_INFO, LOCATION, NULL, 
-	    "login succeeded for user \"%s\"\n", usr);
-
-	xauth_sendstatus(iph1, XAUTH_STATUS_OK, id);
-
-	return 0;
-}
-
-void
-xauth_sendstatus(iph1, status, id)
-	struct ph1handle *iph1;
-	int status;
-	int id;
-{
-	vchar_t *buffer;
-	struct isakmp_pl_attr *attr;
-	struct isakmp_data *stattr;
-	size_t tlen;
-
-	tlen = sizeof(*attr) +
-	       + sizeof(*stattr); 
-	
-	if ((buffer = vmalloc(tlen)) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "Cannot allocate buffer\n");
-		return;
-	}
-	
-	attr = (struct isakmp_pl_attr *)buffer->v;
-	memset(attr, 0, tlen);
-
-	attr->h.len = htons(tlen);
-	attr->type = ISAKMP_CFG_SET;
-	attr->id = htons(id);
-
-	stattr = (struct isakmp_data *)(attr + 1);
-	stattr->type = htons(XAUTH_STATUS | ISAKMP_GEN_TV);
-	stattr->lorv = htons(status);
-
-	isakmp_cfg_send(iph1, buffer, 
-	    ISAKMP_NPTYPE_ATTR, ISAKMP_FLAG_E, 1);
-	
-	vfree(buffer);
-
-	return;	
-}
-
-#ifdef HAVE_LIBRADIUS
-int
-xauth_radius_init(void)
-{
-	/* For first time use, initialize Radius */
-	if ((isakmp_cfg_config.authsource == ISAKMP_CFG_AUTH_RADIUS) &&
-	    (radius_auth_state == NULL)) {
-		if ((radius_auth_state = rad_auth_open()) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "Cannot init libradius\n");
-			return -1;
-		}
-
-		if (rad_config(radius_auth_state, NULL) != 0) {
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "Cannot open librarius config file: %s\n", 
-			    rad_strerror(radius_auth_state));
-			rad_close(radius_auth_state);
-			radius_auth_state = NULL;
-			return -1;
-		}
-	}
-
-	if ((isakmp_cfg_config.accounting == ISAKMP_CFG_ACCT_RADIUS) &&
-	    (radius_acct_state == NULL)) {
-		if ((radius_acct_state = rad_acct_open()) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "Cannot init libradius\n");
-			return -1;
-		}
-
-		if (rad_config(radius_acct_state, NULL) != 0) {
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "Cannot open librarius config file: %s\n", 
-			    rad_strerror(radius_acct_state));
-			rad_close(radius_acct_state);
-			radius_acct_state = NULL;
-			return -1;
-		}
-	}
-
-	return 0;
-}
-
-int
-xauth_login_radius(iph1, usr, pwd)
-	struct ph1handle *iph1;
-	char *usr;
-	char *pwd;
-{
-	int res;
-	const void *data;
-	size_t len;
-	int type;
-
-	if (rad_create_request(radius_auth_state, RAD_ACCESS_REQUEST) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "rad_create_request failed: %s\n", 
-		    rad_strerror(radius_auth_state));
-		return -1;
-	}
-	
-	if (rad_put_string(radius_auth_state, RAD_USER_NAME, usr) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "rad_put_string failed: %s\n", 
-		    rad_strerror(radius_auth_state));
-		return -1;
-	}
-
-	if (rad_put_string(radius_auth_state, RAD_USER_PASSWORD, pwd) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "rad_put_string failed: %s\n", 
-		    rad_strerror(radius_auth_state));
-		return -1;
-	}
-
-	if (isakmp_cfg_radius_common(radius_auth_state, iph1->mode_cfg->port) != 0)
-		return -1;
-
-	switch (res = rad_send_request(radius_auth_state)) {
-	case RAD_ACCESS_ACCEPT:
-		while ((type = rad_get_attr(radius_auth_state, &data, &len)) != 0) {
-			switch (type) {
-			case RAD_FRAMED_IP_ADDRESS:
-				iph1->mode_cfg->addr4 = rad_cvt_addr(data);
-				iph1->mode_cfg->flags 
-				    |= ISAKMP_CFG_ADDR4_EXTERN;
-				break;
-
-			case RAD_FRAMED_IP_NETMASK:
-				iph1->mode_cfg->mask4 = rad_cvt_addr(data);
-				iph1->mode_cfg->flags 
-				    |= ISAKMP_CFG_MASK4_EXTERN;
-				break;
-
-			default:
-				plog(LLV_INFO, LOCATION, NULL,
-				    "Unexpected attribute: %d\n", type);
-				break;
-			}
-		}
-
-		return 0;
-		break;
-
-	case RAD_ACCESS_REJECT:
-		return -1;
-		break;
-
-	case -1:
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "rad_send_request failed: %s\n", 
-		    rad_strerror(radius_auth_state));
-		return -1;
-		break;
-	default:
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "rad_send_request returned %d\n", res);
-		return -1;
-		break;
-	}
-
-	return -1;
-}
-#endif
-
-#ifdef HAVE_LIBPAM
-static int 
-PAM_conv(msg_count, msg, rsp, dontcare)
-	int msg_count;
-	const struct pam_message **msg;
-	struct pam_response **rsp;
-	void *dontcare;
-{
-	int i;
-	int replies = 0;
-	struct pam_response *reply = NULL;
-
-	if ((reply = racoon_malloc(sizeof(*reply) * msg_count)) == NULL) 
-		return PAM_CONV_ERR;
-	bzero(reply, sizeof(*reply) * msg_count);
-
-	for (i = 0; i < msg_count; i++) {
-		switch (msg[i]->msg_style) {
-		case PAM_PROMPT_ECHO_ON:
-			/* Send the username, libpam frees resp */
-			reply[i].resp_retcode = PAM_SUCCESS;
-			if ((reply[i].resp = strdup(PAM_usr)) == NULL) {
-				plog(LLV_ERROR, LOCATION, 
-				    NULL, "strdup failed\n");
-				exit(1);
-			}
-			break;
-
-		case PAM_PROMPT_ECHO_OFF:
-			/* Send the password, libpam frees resp */
-			reply[i].resp_retcode = PAM_SUCCESS;
-			if ((reply[i].resp = strdup(PAM_pwd)) == NULL) {
-				plog(LLV_ERROR, LOCATION, 
-				    NULL, "strdup failed\n");
-				exit(1);
-			}
-			break;
-
-		case PAM_TEXT_INFO:
-		case PAM_ERROR_MSG:
-			reply[i].resp_retcode = PAM_SUCCESS;
-			reply[i].resp = NULL;
-			break;
-
-		default:
-			if (reply != NULL)
-				racoon_free(reply);
-			return PAM_CONV_ERR;
-			break;
-		}
-	}
-
-	if (reply != NULL)
-		*rsp = reply;
-
-	return PAM_SUCCESS;
-}
-
-int
-xauth_login_pam(port, raddr, usr, pwd)
-	int port;
-	struct sockaddr *raddr;
-	char *usr;
-	char *pwd;
-{
-	int error;
-	int res;
-	const void *data;
-	size_t len;
-	int type;
-	char *remote = NULL;
-	pam_handle_t *pam = NULL;
-
-	if (isakmp_cfg_config.port_pool == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "isakmp_cfg_config.port_pool == NULL\n");
-		return -1;
-	}
-
-	if ((error = pam_start("racoon", usr, 
-	    &PAM_chat, &isakmp_cfg_config.port_pool[port].pam)) != 0) {
-		if (isakmp_cfg_config.port_pool[port].pam == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL, "pam_start failed\n");
-			return -1;
-		} else {
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "pam_start failed: %s\n", 
-			    pam_strerror(isakmp_cfg_config.port_pool[port].pam,
-			    error));
-			goto out;
-		}
-	}
-	pam = isakmp_cfg_config.port_pool[port].pam;
-
-	if ((remote = strdup(saddrwop2str(raddr))) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "cannot allocate memory: %s\n", strerror(errno)); 
-		goto out;
-	}
-	
-	if ((error = pam_set_item(pam, PAM_RHOST, remote)) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "pam_set_item failed: %s\n", 
-		    pam_strerror(pam, error));
-		goto out;
-	}
-
-	PAM_usr = usr;
-	PAM_pwd = pwd;
-	error = pam_authenticate(pam, 0);
-	PAM_usr = NULL;
-	PAM_pwd = NULL;
-	if (error != 0) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "pam_authenticate failed: %s\n", 
-		    pam_strerror(pam, error));
-		goto out;
-	}
-
-	if ((error = pam_acct_mgmt(pam, 0)) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "pam_acct_mgmt failed: %s\n", 
-		    pam_strerror(pam, error));
-		goto out;
-	}
-
-	if ((error = pam_setcred(pam, 0)) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "pam_setcred failed: %s\n", 
-		    pam_strerror(pam, error));
-		goto out;
-	}
-
-	if (remote != NULL)
-		free(remote);
-
-	return 0;
-
-out:
-	pam_end(pam, error);
-	isakmp_cfg_config.port_pool[port].pam = NULL;
-	if (remote != NULL)
-		free(remote);
-	return -1;
-}
-#endif
-
-#ifdef HAVE_LIBLDAP
-int 
-xauth_ldap_init(void)
-{
-	int tmplen;
-	int error = -1;
-
-	xauth_ldap_config.pver = 3;
-	xauth_ldap_config.host = NULL;
-	xauth_ldap_config.port = LDAP_PORT;
-	xauth_ldap_config.base = NULL;
-	xauth_ldap_config.subtree = 0;
-	xauth_ldap_config.bind_dn = NULL;
-	xauth_ldap_config.bind_pw = NULL;
-	xauth_ldap_config.auth_type = LDAP_AUTH_SIMPLE;
-	xauth_ldap_config.attr_user = NULL;
-	xauth_ldap_config.attr_addr = NULL;
-	xauth_ldap_config.attr_mask = NULL;
-	xauth_ldap_config.attr_group = NULL;
-	xauth_ldap_config.attr_member = NULL;
-
-	/* set default host */
-	tmplen = strlen(LDAP_DFLT_HOST);
-	xauth_ldap_config.host = vmalloc(tmplen);
-	if (xauth_ldap_config.host == NULL)
-		goto out;
-	memcpy(xauth_ldap_config.host->v, LDAP_DFLT_HOST, tmplen);
-
-	/* set default user naming attribute */
-	tmplen = strlen(LDAP_DFLT_USER);
-	xauth_ldap_config.attr_user = vmalloc(tmplen);
-	if (xauth_ldap_config.attr_user == NULL)
-		goto out;	
-	memcpy(xauth_ldap_config.attr_user->v, LDAP_DFLT_USER, tmplen);
-
-	/* set default address attribute */
-	tmplen = strlen(LDAP_DFLT_ADDR);
-	xauth_ldap_config.attr_addr = vmalloc(tmplen);
-	if (xauth_ldap_config.attr_addr == NULL)
-		goto out;
-	memcpy(xauth_ldap_config.attr_addr->v, LDAP_DFLT_ADDR, tmplen);
-
-	/* set default netmask attribute */
-	tmplen = strlen(LDAP_DFLT_MASK);
-	xauth_ldap_config.attr_mask = vmalloc(tmplen);
-	if (xauth_ldap_config.attr_mask == NULL)
-		goto out;
-	memcpy(xauth_ldap_config.attr_mask->v, LDAP_DFLT_MASK, tmplen);
-
-	/* set default group naming attribute */
-	tmplen = strlen(LDAP_DFLT_GROUP);
-	xauth_ldap_config.attr_group = vmalloc(tmplen);
-	if (xauth_ldap_config.attr_group == NULL)
-		goto out;
-	memcpy(xauth_ldap_config.attr_group->v, LDAP_DFLT_GROUP, tmplen);
-
-	/* set default member attribute */
-	tmplen = strlen(LDAP_DFLT_MEMBER);
-	xauth_ldap_config.attr_member = vmalloc(tmplen);
-	if (xauth_ldap_config.attr_member == NULL)
-		goto out;
-	memcpy(xauth_ldap_config.attr_member->v, LDAP_DFLT_MEMBER, tmplen);
-
-	error = 0;
-out:
-	if (error != 0)
-		plog(LLV_ERROR, LOCATION, NULL, "cannot allocate memory\n");
-
-	return error;
-}
-
-int
-xauth_login_ldap(iph1, usr, pwd)
-	struct ph1handle *iph1;
-	char *usr;
-	char *pwd;
-{
-	int rtn = -1;
-	int res = -1;
-	LDAP *ld = NULL;
-	LDAPMessage *lr = NULL;
-	LDAPMessage *le = NULL;
-	struct berval cred;
-	struct berval **bv = NULL;
-	struct timeval timeout;
-	char *init = NULL;
-	char *filter = NULL;
-	char *atlist[3];
-	char *basedn = NULL;
-	char *userdn = NULL;
-	int tmplen = 0;
-	int ecount = 0;
-	int scope = LDAP_SCOPE_ONE;
-
-	atlist[0] = NULL;
-	atlist[1] = NULL;
-	atlist[2] = NULL;
-
-	/* build our initialization url */
-	tmplen = strlen("ldap://:") + 17;
-	tmplen += strlen(xauth_ldap_config.host->v);
-	init = racoon_malloc(tmplen);
-	if (init == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"unable to alloc ldap init url\n");
-		goto ldap_end;
-	}
-	sprintf(init,"ldap://%s:%d",
-		xauth_ldap_config.host->v,
-		xauth_ldap_config.port );
-
-	/* initialize the ldap handle */
-	res = ldap_initialize(&ld, init);
-	if (res != LDAP_SUCCESS) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"ldap_initialize failed: %s\n",
-			ldap_err2string(res));
-		goto ldap_end;
-	}
-
-	/* initialize the protocol version */
-	ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION,
-		&xauth_ldap_config.pver);
-
-	/*
-	 * attempt to bind to the ldap server.
-         * default to anonymous bind unless a
-	 * user dn and password has been
-	 * specified in our configuration
-         */
-	if ((xauth_ldap_config.bind_dn != NULL)&&
-	    (xauth_ldap_config.bind_pw != NULL))
-	{
-		cred.bv_val = xauth_ldap_config.bind_pw->v;
-		cred.bv_len = strlen( cred.bv_val );
-		res = ldap_sasl_bind_s(ld,
-			xauth_ldap_config.bind_dn->v, NULL, &cred,
-			NULL, NULL, NULL);
-	}
-	else
-	{
-		res = ldap_sasl_bind_s(ld,
-			NULL, NULL, NULL,
-			NULL, NULL, NULL);
-	}
-	
-	if (res!=LDAP_SUCCESS) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"ldap_sasl_bind_s (search) failed: %s\n",
-			ldap_err2string(res));
-		goto ldap_end;
-	}
-
-	/* build an ldap user search filter */
-	tmplen = strlen(xauth_ldap_config.attr_user->v);
-	tmplen += 1;
-	tmplen += strlen(usr);
-	tmplen += 1;
-	filter = racoon_malloc(tmplen);
-	if (filter == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"unable to alloc ldap search filter buffer\n");
-		goto ldap_end;
-	}
-	sprintf(filter, "%s=%s",
-		xauth_ldap_config.attr_user->v, usr);
-
-	/* build our return attribute list */
-	tmplen = strlen(xauth_ldap_config.attr_addr->v) + 1;
-	atlist[0] = racoon_malloc(tmplen);
-	tmplen = strlen(xauth_ldap_config.attr_mask->v) + 1;
-	atlist[1] = racoon_malloc(tmplen);
-	if ((atlist[0] == NULL)||(atlist[1] == NULL)) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"unable to alloc ldap attrib list buffer\n");
-		goto ldap_end;
-	}
-	strcpy(atlist[0],xauth_ldap_config.attr_addr->v);
-	strcpy(atlist[1],xauth_ldap_config.attr_mask->v);
-
-	/* attempt to locate the user dn */
-	if (xauth_ldap_config.base != NULL)
-		basedn = xauth_ldap_config.base->v;
-	if (xauth_ldap_config.subtree)
-		scope = LDAP_SCOPE_SUBTREE;
-	timeout.tv_sec = 15;
-	timeout.tv_usec = 0;
-	res = ldap_search_ext_s(ld, basedn, scope,
-		filter, atlist, 0, NULL, NULL,
-		&timeout, 2, &lr);
-	if (res != LDAP_SUCCESS) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"ldap_search_ext_s failed: %s\n",
-			ldap_err2string(res));
-		goto ldap_end;
-	}
-
-	/* check the number of ldap entries returned */
-	ecount = ldap_count_entries(ld, lr);
-	if (ecount < 1) {
-		plog(LLV_WARNING, LOCATION, NULL, 
-			"no ldap results for filter \'%s\'\n", 
-			 filter);
-		goto ldap_end;
-	}
-	if (ecount > 1) {
-		plog(LLV_WARNING, LOCATION, NULL, 
-			"multiple (%i) ldap results for filter \'%s\'\n", 
-			ecount, filter);
-	}
-
-	/* obtain the dn from the first result */
-	le = ldap_first_entry(ld, lr);
-	if (le == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"ldap_first_entry failed: invalid entry returned\n");
-		goto ldap_end;
-	}
-	userdn = ldap_get_dn(ld, le);
-	if (userdn == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"ldap_get_dn failed: invalid string returned\n");
-		goto ldap_end;
-	}
-
-	/* cache the user dn in the xauth state */
-	iph1->mode_cfg->xauth.udn = racoon_malloc(strlen(userdn)+1);
-	strcpy(iph1->mode_cfg->xauth.udn,userdn);
-
-	/* retrieve modecfg address */
-	bv = ldap_get_values_len(ld, le, xauth_ldap_config.attr_addr->v);
-	if (bv != NULL)	{
-		char tmpaddr[16];
-		/* sanity check for address value */
-		if ((bv[0]->bv_len < 7)||(bv[0]->bv_len > 15)) {
-			plog(LLV_DEBUG, LOCATION, NULL,
-				"ldap returned invalid modecfg address\n");
-			ldap_value_free_len(bv);
-			goto ldap_end;
-		}
-		memcpy(tmpaddr,bv[0]->bv_val,bv[0]->bv_len);
-		tmpaddr[bv[0]->bv_len]=0;
-		iph1->mode_cfg->addr4.s_addr = inet_addr(tmpaddr);
-		iph1->mode_cfg->flags |= ISAKMP_CFG_ADDR4_EXTERN;
-		plog(LLV_INFO, LOCATION, NULL,
-			"ldap returned modecfg address %s\n", tmpaddr);
-		ldap_value_free_len(bv);
-	}
-
-	/* retrieve modecfg netmask */
-	bv = ldap_get_values_len(ld, le, xauth_ldap_config.attr_mask->v);
-	if (bv != NULL)	{
-		char tmpmask[16];
-		/* sanity check for netmask value */
-		if ((bv[0]->bv_len < 7)||(bv[0]->bv_len > 15)) {
-			plog(LLV_DEBUG, LOCATION, NULL,
-				"ldap returned invalid modecfg netmask\n");
-			ldap_value_free_len(bv);
-			goto ldap_end;
-		}
-		memcpy(tmpmask,bv[0]->bv_val,bv[0]->bv_len);
-		tmpmask[bv[0]->bv_len]=0;
-		iph1->mode_cfg->mask4.s_addr = inet_addr(tmpmask);
-		iph1->mode_cfg->flags |= ISAKMP_CFG_MASK4_EXTERN;
-		plog(LLV_INFO, LOCATION, NULL,
-			"ldap returned modecfg netmask %s\n", tmpmask);
-		ldap_value_free_len(bv);
-	}
-
-	/*
-	 * finally, use the dn and the xauth
-	 * password to check the users given
-	 * credentials by attempting to bind
-	 * to the ldap server
-	 */
-	plog(LLV_INFO, LOCATION, NULL,
-		"attempting ldap bind for dn \'%s\'\n", userdn);
-	cred.bv_val = pwd;
-	cred.bv_len = strlen( cred.bv_val );
-	res = ldap_sasl_bind_s(ld,
-		userdn, NULL, &cred,
-		NULL, NULL, NULL);
-        if(res==LDAP_SUCCESS)
-		rtn = 0;
-
-ldap_end:
-
-	/* free ldap resources */
-	if (userdn != NULL)
-		ldap_memfree(userdn);
-	if (atlist[0] != NULL)
-		racoon_free(atlist[0]);
-	if (atlist[1] != NULL)
-		racoon_free(atlist[1]);
-	if (filter != NULL)
-		racoon_free(filter);
-	if (lr != NULL)
-		ldap_msgfree(lr);
-	if (init != NULL)
-		racoon_free(init);
-
-	ldap_unbind_ext_s(ld, NULL, NULL);
-
-	return rtn;
-}
-
-int
-xauth_group_ldap(udn, grp)
-	char * udn;
-	char * grp;
-{
-	int rtn = -1;
-	int res = -1;
-	LDAP *ld = NULL;
-	LDAPMessage *lr = NULL;
-	LDAPMessage *le = NULL;
-	struct berval cred;
-	struct timeval timeout;
-	char *init = NULL;
-	char *filter = NULL;
-	char *basedn = NULL;
-	char *groupdn = NULL;
-	int tmplen = 0;
-	int ecount = 0;
-	int scope = LDAP_SCOPE_ONE;
-
-	/* build our initialization url */
-	tmplen = strlen("ldap://:") + 17;
-	tmplen += strlen(xauth_ldap_config.host->v);
-	init = racoon_malloc(tmplen);
-	if (init == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"unable to alloc ldap init url\n");
-		goto ldap_group_end;
-	}
-	sprintf(init,"ldap://%s:%d",
-		xauth_ldap_config.host->v,
-		xauth_ldap_config.port );
-
-	/* initialize the ldap handle */
-	res = ldap_initialize(&ld, init);
-	if (res != LDAP_SUCCESS) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"ldap_initialize failed: %s\n",
-			ldap_err2string(res));
-		goto ldap_group_end;
-	}
-
-	/* initialize the protocol version */
-	ldap_set_option(ld, LDAP_OPT_PROTOCOL_VERSION,
-		&xauth_ldap_config.pver);
-
-	/*
-	 * attempt to bind to the ldap server.
-         * default to anonymous bind unless a
-	 * user dn and password has been
-	 * specified in our configuration
-         */
-	if ((xauth_ldap_config.bind_dn != NULL)&&
-	    (xauth_ldap_config.bind_pw != NULL))
-	{
-		cred.bv_val = xauth_ldap_config.bind_pw->v;
-		cred.bv_len = strlen( cred.bv_val );
-		res = ldap_sasl_bind_s(ld,
-			xauth_ldap_config.bind_dn->v, NULL, &cred,
-			NULL, NULL, NULL);
-	}
-	else
-	{
-		res = ldap_sasl_bind_s(ld,
-			NULL, NULL, NULL,
-			NULL, NULL, NULL);
-	}
-
-	if (res!=LDAP_SUCCESS) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"ldap_sasl_bind_s (search) failed: %s\n",
-			ldap_err2string(res));
-		goto ldap_group_end;
-	}
-
-	/* build an ldap group search filter */
-	tmplen = strlen("(&(=)(=))") + 1;
-	tmplen += strlen(xauth_ldap_config.attr_group->v);
-	tmplen += strlen(grp);
-	tmplen += strlen(xauth_ldap_config.attr_member->v);
-	tmplen += strlen(udn);
-	filter = racoon_malloc(tmplen);
-	if (filter == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"unable to alloc ldap search filter buffer\n");
-		goto ldap_group_end;
-	}
-	sprintf(filter, "(&(%s=%s)(%s=%s))",
-		xauth_ldap_config.attr_group->v, grp,
-		xauth_ldap_config.attr_member->v, udn);
-
-	/* attempt to locate the group dn */
-	if (xauth_ldap_config.base != NULL)
-		basedn = xauth_ldap_config.base->v;
-	if (xauth_ldap_config.subtree)
-		scope = LDAP_SCOPE_SUBTREE;
-	timeout.tv_sec = 15;
-	timeout.tv_usec = 0;
-	res = ldap_search_ext_s(ld, basedn, scope,
-		filter, NULL, 0, NULL, NULL,
-		&timeout, 2, &lr);
-	if (res != LDAP_SUCCESS) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"ldap_search_ext_s failed: %s\n",
-			ldap_err2string(res));
-		goto ldap_group_end;
-	}
-
-	/* check the number of ldap entries returned */
-	ecount = ldap_count_entries(ld, lr);
-	if (ecount < 1) {
-		plog(LLV_WARNING, LOCATION, NULL, 
-			"no ldap results for filter \'%s\'\n", 
-			 filter);
-		goto ldap_group_end;
-	}
-
-	/* success */
-	rtn = 0;
-
-	/* obtain the dn from the first result */
-	le = ldap_first_entry(ld, lr);
-	if (le == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"ldap_first_entry failed: invalid entry returned\n");
-		goto ldap_group_end;
-	}
-	groupdn = ldap_get_dn(ld, le);
-	if (groupdn == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"ldap_get_dn failed: invalid string returned\n");
-		goto ldap_group_end;
-	}
-
-	plog(LLV_INFO, LOCATION, NULL,
-		"ldap membership group returned \'%s\'\n", groupdn);
-ldap_group_end:
-
-	/* free ldap resources */
-	if (groupdn != NULL)
-		ldap_memfree(groupdn);
-	if (filter != NULL)
-		racoon_free(filter);
-	if (lr != NULL)
-		ldap_msgfree(lr);
-	if (init != NULL)
-		racoon_free(init);
-
-	ldap_unbind_ext_s(ld, NULL, NULL);
-
-	return rtn;
-}
-
-#endif
-
-#ifndef ANDROID_PATCHED
-
-int
-xauth_login_system(usr, pwd)
-	char *usr;
-	char *pwd;
-{
-	struct passwd *pw;
-	char *cryptpwd;
-	char *syscryptpwd;
-#ifdef HAVE_SHADOW_H
-	struct spwd *spw;
-
-	if ((spw = getspnam(usr)) == NULL)
-		return -1;
-
-	syscryptpwd = spw->sp_pwdp;
-#endif
-
-	if ((pw = getpwnam(usr)) == NULL)
-		return -1;
-
-#ifndef HAVE_SHADOW_H
-	syscryptpwd = pw->pw_passwd;
-#endif
-
-	/* No root login. Ever. */
-	if (pw->pw_uid == 0)
-		return -1;
-
-	if ((cryptpwd = crypt(pwd, syscryptpwd)) == NULL)
-		return -1;
-
-	if (strcmp(cryptpwd, syscryptpwd) == 0)
-		return 0;
-
-	return -1;
-}
-
-#endif
-
-int
-xauth_group_system(usr, grp)
-	char * usr;
-	char * grp;
-{
-	struct group * gr;
-	char * member;
-	int index = 0;
-
-	gr = getgrnam(grp);
-	if (gr == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"the system group name \'%s\' is unknown\n",
-			grp);
-		return -1;
-	}
-
-	while ((member = gr->gr_mem[index++])!=NULL) {
-		if (!strcmp(member,usr)) {
-			plog(LLV_INFO, LOCATION, NULL,
-		                "membership validated\n");
-			return 0;
-		}
-	}
-
-	return -1;
-}
-
-int 
-xauth_check(iph1)
-	struct ph1handle *iph1;
-{
-	struct xauth_state *xst = &iph1->mode_cfg->xauth;
-
-	/* 
- 	 * Only the server side (edge device) really check for Xauth 
-	 * status. It does it if the chose authmethod is using Xauth.
-	 * On the client side (roadwarrior), we don't check anything.
-	 */
-	switch (AUTHMETHOD(iph1)) {
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
-	/* The following are not yet implemented */
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_R:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_R:
-		if ((iph1->mode_cfg->flags & ISAKMP_CFG_VENDORID_XAUTH) == 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "Hybrid auth negotiated but peer did not "
-			    "announced as Xauth capable\n");
-			return -1;
-		}
-
-		if (xst->status != XAUTHST_OK) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "Hybrid auth negotiated but peer did not "
-			    "succeed Xauth exchange\n");
-			return -1;
-		}
-
-		return 0;
-		break;
-	default:
-		return 0;
-		break;
-	}
-
-	return 0;
-}
-
-int
-group_check(iph1, grp_list, grp_count)
-	struct ph1handle *iph1;
-	char **grp_list;
-	int grp_count;
-{
-	int res = -1;
-	int grp_index = 0;
-	char * usr = NULL;
-
-	/* check for presence of modecfg data */
-
-	if(iph1->mode_cfg == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"xauth group specified but modecfg not found\n");
-		return res;
-	}
-
-	/* loop through our group list */
-
-	for(; grp_index < grp_count; grp_index++) {
-
-		/* check for presence of xauth data */
-
-		usr = iph1->mode_cfg->xauth.authdata.generic.usr;
-
-		if(usr == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"xauth group specified but xauth not found\n");
-			return res;
-		}
-
-		/* call appropriate group validation funtion */
-
-		switch (isakmp_cfg_config.groupsource) {
-
-			case ISAKMP_CFG_GROUP_SYSTEM:
-				res = xauth_group_system(
-					usr,
-					grp_list[grp_index]);
-				break;
-
-#ifdef HAVE_LIBLDAP
-			case ISAKMP_CFG_GROUP_LDAP:
-				res = xauth_group_ldap(
-					iph1->mode_cfg->xauth.udn,
-					grp_list[grp_index]);
-				break;
-#endif
-
-			default:
-				/* we should never get here */
-				plog(LLV_ERROR, LOCATION, NULL,
-				    "Unknown group auth source\n");
-				break;
-		}
-
-		if( !res ) {
-			plog(LLV_INFO, LOCATION, NULL,
-				"user \"%s\" is a member of group \"%s\"\n",
-				usr,
-				grp_list[grp_index]);
-			break;
-		} else {
-			plog(LLV_INFO, LOCATION, NULL,
-				"user \"%s\" is not a member of group \"%s\"\n",
-				usr,
-				grp_list[grp_index]);
-		}
-	}
-
-	return res;
-}
-
-vchar_t *
-isakmp_xauth_req(iph1, attr)
-	struct ph1handle *iph1;
-	struct isakmp_data *attr;
-{
-	int type;
-	size_t dlen = 0;
-	int ashort = 0;
-	int value = 0;
-	vchar_t *buffer = NULL;
-	char *mraw = NULL, *mdata;
-	char *data;
-	vchar_t *usr = NULL;
-	vchar_t *pwd = NULL;
-	size_t skip = 0;
-	int freepwd = 0;
-
-	if ((iph1->mode_cfg->flags & ISAKMP_CFG_VENDORID_XAUTH) == 0) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "Xauth mode config request but peer "
-		    "did not declare itself as Xauth capable\n");
-		return NULL;
-	}
-
-	type = ntohs(attr->type) & ~ISAKMP_GEN_MASK;
-
-	/* Sanity checks */
-	switch(type) {
-	case XAUTH_TYPE:
-		if ((ntohs(attr->type) & ISAKMP_GEN_TV) == 0) {
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "Unexpected long XAUTH_TYPE attribute\n");
-			return NULL;
-		}
-		if (ntohs(attr->lorv) != XAUTH_TYPE_GENERIC) {
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "Unsupported Xauth authentication %d\n", 
-			    ntohs(attr->lorv));
-			return NULL;
-		}
-		ashort = 1;
-		dlen = 0;
-		value = XAUTH_TYPE_GENERIC;
-		break;
-
-	case XAUTH_USER_NAME:
-		if (!iph1->rmconf->xauth || !iph1->rmconf->xauth->login) {
-			plog(LLV_ERROR, LOCATION, NULL, "Xauth performed "
-			    "with no login supplied\n");
-			return NULL;
-		}
-
-		dlen = iph1->rmconf->xauth->login->l - 1;
-		iph1->rmconf->xauth->state |= XAUTH_SENT_USERNAME;
-		break;
-
-#ifdef ANDROID_PATCHED
-        case XAUTH_PASSCODE:
-#endif  
-	case XAUTH_USER_PASSWORD:
-		if (!iph1->rmconf->xauth || !iph1->rmconf->xauth->login)
-			return NULL;
-
-		skip = sizeof(struct ipsecdoi_id_b);
-		usr = vmalloc(iph1->rmconf->xauth->login->l - 1 + skip);
-		if (usr == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "Cannot allocate memory\n");
-			return NULL;
-		}
-		memset(usr->v, 0, skip);
-		memcpy(usr->v + skip, 
-		    iph1->rmconf->xauth->login->v, 
-		    iph1->rmconf->xauth->login->l - 1);
-
-		if (iph1->rmconf->xauth->pass) {
-			/* A key given through racoonctl */
-			pwd = iph1->rmconf->xauth->pass;
-		} else {
-			if ((pwd = getpskbyname(usr)) == NULL) {
-				plog(LLV_ERROR, LOCATION, NULL, 
-				    "No password was found for login %s\n", 
-				    iph1->rmconf->xauth->login->v);
-				vfree(usr);
-				return NULL;
-			}
-			/* We have to free it before returning */
-			freepwd = 1;
-		}
-		vfree(usr);
-
-		iph1->rmconf->xauth->state |= XAUTH_SENT_PASSWORD;
-		dlen = pwd->l;
-
-		break;
-	case XAUTH_MESSAGE:
-		if ((ntohs(attr->type) & ISAKMP_GEN_TV) == 0) {
-			dlen = ntohs(attr->lorv);
-			if (dlen > 0) {
-				mraw = (char*)(attr + 1);
-				mdata = binsanitize(mraw, dlen);
-				if (mdata == NULL) {
-					plog(LLV_ERROR, LOCATION, iph1->remote,
-					    "Cannot allocate memory\n");
-					return NULL;
-				}
-				plog(LLV_NOTIFY,LOCATION, iph1->remote,
-					"XAUTH Message: '%s'.\n",
-					mdata);
-				racoon_free(mdata);
-			}
-		}
-		return NULL;
-	default:
-		plog(LLV_WARNING, LOCATION, NULL,
-		    "Ignored attribute %s\n", s_isakmp_cfg_type(type));
-		return NULL;
-		break;
-	}
-
-	if ((buffer = vmalloc(sizeof(*attr) + dlen)) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "Cannot allocate memory\n");
-		goto out;
-	}
-
-	attr = (struct isakmp_data *)buffer->v;
-	if (ashort) {
-		attr->type = htons(type | ISAKMP_GEN_TV);
-		attr->lorv = htons(value);
-		goto out;
-	}
-
-	attr->type = htons(type | ISAKMP_GEN_TLV);
-	attr->lorv = htons(dlen);
-	data = (char *)(attr + 1);
-
-	switch(type) {
-	case XAUTH_USER_NAME:
-		/* 
-		 * iph1->rmconf->xauth->login->v is valid, 
-		 * we just checked it in the previous switch case 
-		 */
-		memcpy(data, iph1->rmconf->xauth->login->v, dlen);
-		break;
-#ifdef ANDROID_PATCHED
-        case XAUTH_PASSCODE:
-#endif  
-	case XAUTH_USER_PASSWORD:
-		memcpy(data, pwd->v, dlen);
-		break;
-	default:
-		break;
-	}
-
-out:
-	if (freepwd)
-		vfree(pwd);
-
-	return buffer;
-}
-
-vchar_t *
-isakmp_xauth_set(iph1, attr)
-	struct ph1handle *iph1;
-	struct isakmp_data *attr;
-{
-	int type;
-	vchar_t *buffer = NULL;
-	char *data;
-	struct xauth_state *xst;
-	size_t dlen = 0;
-	char* mraw = NULL, *mdata;
-
-	if ((iph1->mode_cfg->flags & ISAKMP_CFG_VENDORID_XAUTH) == 0) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "Xauth mode config set but peer "
-		    "did not declare itself as Xauth capable\n");
-		return NULL;
-	}
-
-	type = ntohs(attr->type) & ~ISAKMP_GEN_MASK;
-
-	switch(type) {
-	case XAUTH_STATUS:
-		/* 
-		 * We should only receive ISAKMP mode_cfg SET XAUTH_STATUS
-		 * when running as a client (initiator).
-		 */
-		xst = &iph1->mode_cfg->xauth;
-		switch(AUTHMETHOD(iph1)) {
-		case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
-		case FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I:
-		case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I:
-		/* Not implemented ... */
-		case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
-		case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I:
-		case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_I:
-		case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_I:
-			break;
-		default:
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "Unexpected XAUTH_STATUS_OK\n");
-			return NULL;
-			break;
-		}
-
-		/* If we got a failure, delete iph1 */
-		if (ntohs(attr->lorv) != XAUTH_STATUS_OK) {
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "Xauth authentication failed\n");
-
-			EVT_PUSH(iph1->local, iph1->remote, 
-			    EVTT_XAUTH_FAILED, NULL);
-
-			iph1->mode_cfg->flags |= ISAKMP_CFG_DELETE_PH1;
-		} else {
-			EVT_PUSH(iph1->local, iph1->remote, 
-			    EVTT_XAUTH_SUCCESS, NULL);
-		}
-
-
-		/* We acknowledge it */
-		break;
-	case XAUTH_MESSAGE:
-		if ((ntohs(attr->type) & ISAKMP_GEN_TV) == 0) {
-			dlen = ntohs(attr->lorv);
-			if (dlen > 0) {
-				mraw = (char*)(attr + 1);
-				mdata = binsanitize(mraw, dlen);
-				if (mdata == NULL) {
-					plog(LLV_ERROR, LOCATION, iph1->remote,
-					    "Cannot allocate memory\n");
-					return NULL;
-				}
-				plog(LLV_NOTIFY,LOCATION, iph1->remote,
-					"XAUTH Message: '%s'.\n",
-					mdata);
-				racoon_free(mdata);
-			}
-		}
-
-	default:
-		plog(LLV_WARNING, LOCATION, NULL,
-		    "Ignored attribute %s\n", s_isakmp_cfg_type(type));
-		return NULL;
-		break;
-	}
-
-	if ((buffer = vmalloc(sizeof(*attr))) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "Cannot allocate memory\n");
-		return NULL;
-	}
-
-	attr = (struct isakmp_data *)buffer->v;
-	attr->type = htons(type | ISAKMP_GEN_TV);
-	attr->lorv = htons(0);
-
-	return buffer;
-}
-
-
-void 
-xauth_rmstate(xst)
-	struct xauth_state *xst;
-{
-	switch (xst->authtype) {
-	case XAUTH_TYPE_GENERIC:
-		if (xst->authdata.generic.usr)
-			racoon_free(xst->authdata.generic.usr);
-
-		if (xst->authdata.generic.pwd)
-			racoon_free(xst->authdata.generic.pwd);
-
-		break;
-
-	case XAUTH_TYPE_CHAP:
-	case XAUTH_TYPE_OTP:
-	case XAUTH_TYPE_SKEY:
-		plog(LLV_WARNING, LOCATION, NULL, 
-		    "Unsupported authtype %d\n", xst->authtype);
-		break;
-
-	default:
-		plog(LLV_WARNING, LOCATION, NULL, 
-		    "Unexpected authtype %d\n", xst->authtype);
-		break;
-	}
-
-#ifdef HAVE_LIBLDAP
-	if (xst->udn != NULL)
-		racoon_free(xst->udn);
-#endif
-	return;
-}
-
-int
-xauth_rmconf_used(xauth_rmconf)
-	struct xauth_rmconf **xauth_rmconf;
-{
-	if (*xauth_rmconf == NULL) {
-		*xauth_rmconf = racoon_malloc(sizeof(**xauth_rmconf));
-		if (*xauth_rmconf == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "xauth_rmconf_used: malloc failed\n");
-			return -1;
-		}
-
-		(*xauth_rmconf)->login = NULL;
-		(*xauth_rmconf)->pass = NULL;
-		(*xauth_rmconf)->state = 0;
-	}
-
-	return 0;
-}
-
-void 
-xauth_rmconf_delete(xauth_rmconf)
-	struct xauth_rmconf **xauth_rmconf;
-{
-	if (*xauth_rmconf != NULL) { 
-		if ((*xauth_rmconf)->login != NULL)
-			vfree((*xauth_rmconf)->login);
-		if ((*xauth_rmconf)->pass != NULL)
-			vfree((*xauth_rmconf)->pass);
-
-		racoon_free(*xauth_rmconf);
-		*xauth_rmconf = NULL;
-	}
-
-	return;
-}
diff --git a/src/racoon/isakmp_xauth.h b/src/racoon/isakmp_xauth.h
deleted file mode 100644
index ebb5214..0000000
--- a/src/racoon/isakmp_xauth.h
+++ /dev/null
@@ -1,155 +0,0 @@
-/*	$NetBSD: isakmp_xauth.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/*	$KAME$ */
-
-/*
- * Copyright (C) 2004 Emmanuel Dreyfus 
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _ISAKMP_XAUTH_H
-#define _ISAKMP_XAUTH_H
-
-/* ISAKMP mode config attribute types specific to the Xauth vendor ID */
-#define	XAUTH_TYPE                16520
-#define	XAUTH_USER_NAME           16521
-#define	XAUTH_USER_PASSWORD       16522
-#define	XAUTH_PASSCODE            16523
-#define	XAUTH_MESSAGE             16524
-#define	XAUTH_CHALLENGE           16525
-#define	XAUTH_DOMAIN              16526
-#define	XAUTH_STATUS              16527
-#define	XAUTH_NEXT_PIN            16528
-#define	XAUTH_ANSWER              16529
-
-/* Types for XAUTH_TYPE */
-#define	XAUTH_TYPE_GENERIC 	0
-#define	XAUTH_TYPE_CHAP    	1
-#define	XAUTH_TYPE_OTP     	2
-#define	XAUTH_TYPE_SKEY    	3
-
-/* Values for XAUTH_STATUS */
-#define	XAUTH_STATUS_FAIL       0
-#define	XAUTH_STATUS_OK         1
-
-/* For phase 1 Xauth status */
-struct xauth_state {
-	int status; /* authentication status, used only on server side */
-	int vendorid;
-	int authtype;
-	union {
-		struct authgeneric {
-			char *usr;
-			char *pwd;
-		} generic;
-	} authdata;
-#ifdef HAVE_LIBLDAP
-	char *udn; /* ldap user dn */
-#endif
-};
-
-/* What's been sent */
-#define XAUTH_SENT_USERNAME 1
-#define XAUTH_SENT_PASSWORD 2
-#define XAUTH_SENT_EVERYTHING (XAUTH_SENT_USERNAME | XAUTH_SENT_PASSWORD)
-
-/* For rmconf Xauth data */
-struct xauth_rmconf {
-	vchar_t *login;	/* xauth login */
-	vchar_t *pass;	/* xauth password */
-	int state;      /* what's been sent */
-};
-
-/* status */
-#define XAUTHST_NOTYET	0
-#define XAUTHST_REQSENT	1
-#define XAUTHST_OK	2
-
-struct xauth_reply_arg {
-	isakmp_index index;
-	int port;
-	int id;
-	int res;
-};
-
-struct ph1handle;
-struct isakmp_data;
-void xauth_sendreq(struct ph1handle *);
-int xauth_attr_reply(struct ph1handle *, struct isakmp_data *, int);
-int xauth_login_system(char *, char *);
-void xauth_sendstatus(struct ph1handle *, int, int);
-int xauth_check(struct ph1handle *);
-int group_check(struct ph1handle *, char **, int);
-vchar_t *isakmp_xauth_req(struct ph1handle *, struct isakmp_data *);
-vchar_t *isakmp_xauth_set(struct ph1handle *, struct isakmp_data *);
-void xauth_rmstate(struct xauth_state *);
-void xauth_reply_stub(void *);
-int xauth_reply(struct ph1handle *, int, int, int);
-int xauth_rmconf_used(struct xauth_rmconf **);
-void xauth_rmconf_delete(struct xauth_rmconf **);
-
-#ifdef HAVE_LIBRADIUS
-int xauth_login_radius(struct ph1handle *, char *, char *);
-int xauth_radius_init(void);
-#endif
-
-#ifdef HAVE_LIBPAM
-int xauth_login_pam(int, struct sockaddr *, char *, char *);
-#endif
-
-#ifdef HAVE_LIBLDAP
-
-#define LDAP_DFLT_HOST		"localhost"
-#define LDAP_DFLT_USER		"cn"
-#define LDAP_DFLT_ADDR		"racoon-address"
-#define LDAP_DFLT_MASK		"racoon-netmask"
-#define LDAP_DFLT_GROUP		"cn"
-#define LDAP_DFLT_MEMBER	"member"
-
-struct xauth_ldap_config {
-	int		pver;
-	vchar_t 	*host;
-	int		port;
-	vchar_t		*base;
-	int		subtree;
-	vchar_t		*bind_dn;
-	vchar_t		*bind_pw;
-	int		auth_type;
-	vchar_t		*attr_user;
-	vchar_t		*attr_addr;
-	vchar_t		*attr_mask;
-	vchar_t		*attr_group;
-	vchar_t		*attr_member;
-};
-
-extern struct xauth_ldap_config xauth_ldap_config;
-
-int xauth_ldap_init(void);
-int xauth_login_ldap(struct ph1handle *, char *, char *);
-#endif
-
-#endif /* _ISAKMP_XAUTH_H */
diff --git a/src/racoon/kmpstat.c b/src/racoon/kmpstat.c
deleted file mode 100644
index c59e43a..0000000
--- a/src/racoon/kmpstat.c
+++ /dev/null
@@ -1,227 +0,0 @@
-/*	$NetBSD: kmpstat.c,v 1.4.6.2 2007/11/06 16:41:33 vanhu Exp $	*/
-
-/*	$KAME: kmpstat.c,v 1.33 2004/08/16 08:20:28 itojun Exp $	*/
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/socket.h>
-#include <sys/un.h>
-
-#include <netinet/in.h>
-#include <arpa/inet.h>
-#include <net/pfkeyv2.h>
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-#if TIME_WITH_SYS_TIME
-# include <sys/time.h>
-# include <time.h>
-#else
-# if HAVE_SYS_TIME_H
-#  include <sys/time.h>
-# else
-#  include <time.h>
-# endif
-#endif
-#include <netdb.h>
-#ifdef HAVE_UNISTD_H
-#include <unistd.h>
-#endif
-#include <err.h>
-#include <sys/ioctl.h> 
-#include <resolv.h>
-
-#include "libpfkey.h"
-
-#include "var.h"
-#include "misc.h"
-#include "vmbuf.h"
-#include "plog.h"
-#include "debug.h"
-#include "sockmisc.h"
-
-#include "racoonctl.h"
-#include "admin.h"
-#include "schedule.h"
-#include "isakmp_var.h"
-#include "isakmp.h"
-#include "isakmp_xauth.h"
-#include "isakmp_var.h"
-#include "isakmp_cfg.h"
-#include "oakley.h"
-#include "handler.h"
-#include "pfkey.h"
-#include "admin.h"
-#include "evt.h"
-#include "admin_var.h"
-#include "ipsec_doi.h"
-
-u_int32_t racoonctl_interface = RACOONCTL_INTERFACE;
-u_int32_t racoonctl_interface_major = RACOONCTL_INTERFACE_MAJOR;
-
-static int so;
-u_int32_t loglevel = 0;
-
-int
-com_init()
-{
-	struct sockaddr_un name;
-
-	memset(&name, 0, sizeof(name));
-	name.sun_family = AF_UNIX;
-	snprintf(name.sun_path, sizeof(name.sun_path),
-		"%s", adminsock_path);
-
-	so = socket(AF_UNIX, SOCK_STREAM, 0);
-	if (so < 0)
-		return -1;
-
-	if (connect(so, (struct sockaddr *)&name, sizeof(name)) < 0) {
-		(void)close(so);
-		return -1;
-	}
-
-	return 0;
-}
-
-int
-com_send(combuf)
-	vchar_t *combuf;
-{
-	int len;
-
-	if ((len = send(so, combuf->v, combuf->l, 0)) == -1) {
-		perror("send");
-		(void)close(so);
-		return -1;
-	}
-
-	return 0;
-}
-
-int
-com_recv(combufp) 
-	vchar_t **combufp;
-{
-	struct admin_com h, *com;
-	caddr_t buf;
-	int len;
-	int l = 0;
-	caddr_t p;
-
-	if (combufp == NULL)
-		return -1;
-
-	/* receive by PEEK */ 
-	if ((len = recv(so, &h, sizeof(h), MSG_PEEK)) == -1)
-		goto bad1;
-
-	/* sanity check */
-	if (len < sizeof(h))
-		goto bad1;
-
-	if (h.ac_errno) {
-		errno = h.ac_errno;
-		goto bad1;
-	}
-
-	/* allocate buffer */
-	if ((*combufp = vmalloc(h.ac_len)) == NULL)
-		goto bad1;
-
-	/* read real message */
-	p = (*combufp)->v;
-	while (l < len) {
-		if ((len = recv(so, p, h.ac_len, 0)) < 0) {
-			perror("recv");
-			goto bad2;
-		}
-		l += len;
-		p += len;
-	}
-	
-	return 0;
-
-bad2:
-	vfree(*combufp);
-bad1:
-	*combufp = NULL;
-	return -1;
-}
-
-/*
- * Dumb plog functions (used by sockmisc.c) 
- */
-void
-_plog(int pri, const char *func, struct sockaddr *sa, const char *fmt, ...)
-{
-	va_list ap;
-
-	va_start(ap, fmt);
-	vprintf(fmt, ap);
-	va_end(ap);
-}
-
-void
-plogdump(pri, data, len) 
-	int pri;
-	void *data;
-	size_t len;
-{
-	return;
-}
-
-struct sockaddr *
-get_sockaddr(family, name, port)
-	int family;
-	char *name, *port;
-{
-	struct addrinfo hint, *ai;
-	int error;
-
-	memset(&hint, 0, sizeof(hint));
-	hint.ai_family = PF_UNSPEC;
-	hint.ai_family = family;
-	hint.ai_socktype = SOCK_STREAM;
-
-	error = getaddrinfo(name, port, &hint, &ai);
-	if (error != 0) {
-		printf("%s: %s/%s\n", gai_strerror(error), name, port);
-		return NULL;
-	}
-
-	return ai->ai_addr;
-}
diff --git a/src/racoon/localconf.c b/src/racoon/localconf.c
deleted file mode 100644
index ede1d9b..0000000
--- a/src/racoon/localconf.c
+++ /dev/null
@@ -1,371 +0,0 @@
-/*	$NetBSD: localconf.c,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/*	$KAME: localconf.c,v 1.33 2001/08/09 07:32:19 sakane Exp $	*/
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-#include <ctype.h>
-#include <err.h>
-
-#include "var.h"
-#include "misc.h"
-#include "vmbuf.h"
-#include "plog.h"
-#include "debug.h"
-
-#include "localconf.h"
-#include "algorithm.h"
-#include "admin.h"
-#include "privsep.h"
-#include "isakmp_var.h"
-#include "isakmp.h"
-#include "ipsec_doi.h"
-#include "grabmyaddr.h"
-#include "vendorid.h"
-#include "str2val.h"
-#include "safefile.h"
-#include "admin.h"
-#include "gcmalloc.h"
-
-struct localconf *lcconf;
-
-static void setdefault __P((void));
-
-void
-initlcconf()
-{
-	lcconf = racoon_calloc(1, sizeof(*lcconf));
-	if (lcconf == NULL)
-		errx(1, "failed to allocate local conf.");
-
-	setdefault();
-
-	lcconf->racoon_conf = LC_DEFAULT_CF;
-}
-
-void
-flushlcconf()
-{
-	int i;
-
-	setdefault();
-	clear_myaddr(&lcconf->myaddrs);
-	for (i = 0; i < LC_PATHTYPE_MAX; i++) {
-		if (lcconf->pathinfo[i]) {
-			racoon_free(lcconf->pathinfo[i]);
-			lcconf->pathinfo[i] = NULL;
-		}
-	}
-	for (i = 0; i < LC_IDENTTYPE_MAX; i++) {
-		if (lcconf->ident[i])
-			vfree(lcconf->ident[i]);
-		lcconf->ident[i] = NULL;
-	}
-}
-
-static void
-setdefault()
-{
-	lcconf->uid = 0;
-	lcconf->gid = 0;
-	lcconf->chroot = NULL;
-	lcconf->autograbaddr = 1;
-	lcconf->port_isakmp = PORT_ISAKMP;
-	lcconf->port_isakmp_natt = PORT_ISAKMP_NATT;
-	lcconf->default_af = AF_INET;
-	lcconf->pad_random = LC_DEFAULT_PAD_RANDOM;
-	lcconf->pad_randomlen = LC_DEFAULT_PAD_RANDOMLEN;
-	lcconf->pad_maxsize = LC_DEFAULT_PAD_MAXSIZE;
-	lcconf->pad_strict = LC_DEFAULT_PAD_STRICT;
-	lcconf->pad_excltail = LC_DEFAULT_PAD_EXCLTAIL;
-	lcconf->retry_counter = LC_DEFAULT_RETRY_COUNTER;
-	lcconf->retry_interval = LC_DEFAULT_RETRY_INTERVAL;
-	lcconf->count_persend = LC_DEFAULT_COUNT_PERSEND;
-	lcconf->secret_size = LC_DEFAULT_SECRETSIZE;
-	lcconf->retry_checkph1 = LC_DEFAULT_RETRY_CHECKPH1;
-	lcconf->wait_ph2complete = LC_DEFAULT_WAIT_PH2COMPLETE;
-	lcconf->strict_address = FALSE;
-	lcconf->complex_bundle = TRUE; /*XXX FALSE;*/
-	lcconf->gss_id_enc = LC_GSSENC_UTF16LE; /* Windows compatibility */
-	lcconf->natt_ka_interval = LC_DEFAULT_NATT_KA_INTERVAL;
-}
-
-/*
- * get PSK by string.
- */
-vchar_t *
-getpskbyname(id0)
-	vchar_t *id0;
-{
-	char *id;
-	vchar_t *key = NULL;
-
-	id = racoon_calloc(1, 1 + id0->l - sizeof(struct ipsecdoi_id_b));
-	if (id == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get psk buffer.\n");
-		goto end;
-	}
-	memcpy(id, id0->v + sizeof(struct ipsecdoi_id_b),
-		id0->l - sizeof(struct ipsecdoi_id_b));
-	id[id0->l - sizeof(struct ipsecdoi_id_b)] = '\0';
-
-	key = privsep_getpsk(id, id0->l - sizeof(struct ipsecdoi_id_b));
-
-end:
-	if (id)
-		racoon_free(id);
-	return key;
-}
-
-/*
- * get PSK by address.
- */
-vchar_t *
-getpskbyaddr(remote)
-	struct sockaddr *remote;
-{
-	vchar_t *key = NULL;
-	char addr[NI_MAXHOST], port[NI_MAXSERV];
-
-	GETNAMEINFO(remote, addr, port);
-
-	key = privsep_getpsk(addr, strlen(addr));
-
-	return key;
-}
-
-vchar_t *
-getpsk(str, len)
-	const char *str;
-	const int len;
-{
-	FILE *fp;
-	char buf[1024];	/* XXX how is variable length ? */
-	vchar_t *key = NULL;
-	char *p, *q;
-	size_t keylen;
-	char *k = NULL;
-
-	if (safefile(lcconf->pathinfo[LC_PATHTYPE_PSK], 1) == 0)
-		fp = fopen(lcconf->pathinfo[LC_PATHTYPE_PSK], "r");
-	else
-		fp = NULL;
-	if (fp == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to open pre_share_key file %s\n",
-			lcconf->pathinfo[LC_PATHTYPE_PSK]);
-		return NULL;
-	}
-
-	while (fgets(buf, sizeof(buf), fp) != NULL) {
-		/* comment line */
-		if (buf[0] == '#')
-			continue;
-
-		/* search the end of 1st string. */
-		for (p = buf; *p != '\0' && !isspace((int)*p); p++)
-			;
-		if (*p == '\0')
-			continue;	/* no 2nd parameter */
-		*p = '\0';
-		/* search the 1st of 2nd string. */
-		while (isspace((int)*++p))
-			;
-		if (*p == '\0')
-			continue;	/* no 2nd parameter */
-		p--;
-		if (strncmp(buf, str, len) == 0 && buf[len] == '\0') {
-			p++;
-			keylen = 0;
-			for (q = p; *q != '\0' && *q != '\n'; q++)
-				keylen++;
-			*q = '\0';
-
-			/* fix key if hex string */
-			if (strncmp(p, "0x", 2) == 0) {
-				k = str2val(p + 2, 16, &keylen);
-				if (k == NULL) {
-					plog(LLV_ERROR, LOCATION, NULL,
-						"failed to get psk buffer.\n");
-					goto end;
-				}
-				p = k;
-			}
-
-			key = vmalloc(keylen);
-			if (key == NULL) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"failed to allocate key buffer.\n");
-				goto end;
-			}
-			memcpy(key->v, p, key->l);
-			if (k)
-				racoon_free(k);
-			goto end;
-		}
-	}
-
-end:
-	fclose(fp);
-	return key;
-}
-
-/*
- * get a file name of a type specified.
- */
-void
-getpathname(path, len, type, name)
-	char *path;
-	int len, type;
-	const char *name;
-{
-	snprintf(path, len, "%s%s%s", 
-		name[0] == '/' ? "" : lcconf->pathinfo[type],
-		name[0] == '/' ? "" : "/",
-		name);
-
-	plog(LLV_DEBUG, LOCATION, NULL, "filename: %s\n", path);
-}
-
-#if 0 /* DELETEIT */
-static int lc_doi2idtype[] = {
-	-1,
-	-1,
-	LC_IDENTTYPE_FQDN,
-	LC_IDENTTYPE_USERFQDN,
-	-1,
-	-1,
-	-1,
-	-1,
-	-1,
-	LC_IDENTTYPE_CERTNAME,
-	-1,
-	LC_IDENTTYPE_KEYID,
-};
-
-/*
- * convert DOI value to idtype
- * OUT	-1   : NG
- *	other: converted.
- */
-int
-doi2idtype(idtype)
-	int idtype;
-{
-	if (ARRAYLEN(lc_doi2idtype) > idtype)
-		return lc_doi2idtype[idtype];
-	return -1;
-}
-#endif
-
-static int lc_sittype2doi[] = {
-	IPSECDOI_SIT_IDENTITY_ONLY,
-	IPSECDOI_SIT_SECRECY,
-	IPSECDOI_SIT_INTEGRITY,
-};
-
-/*
- * convert sittype to DOI value.
- * OUT	-1   : NG
- *	other: converted.
- */
-int
-sittype2doi(sittype)
-	int sittype;
-{
-	if (ARRAYLEN(lc_sittype2doi) > sittype)
-		return lc_sittype2doi[sittype];
-	return -1;
-}
-
-static int lc_doitype2doi[] = {
-	IPSEC_DOI,
-};
-
-/*
- * convert doitype to DOI value.
- * OUT	-1   : NG
- *	other: converted.
- */
-int
-doitype2doi(doitype)
-	int doitype;
-{
-	if (ARRAYLEN(lc_doitype2doi) > doitype)
-		return lc_doitype2doi[doitype];
-	return -1;
-}
-
-
-
-static void
-saverestore_params(f)
-	int f;
-{
-	static u_int16_t s_port_isakmp;
-#ifdef ENABLE_ADMINPORT
-	static u_int16_t s_port_admin;
-#endif
-
-	/* 0: save, 1: restore */
-	if (f) {
-		lcconf->port_isakmp = s_port_isakmp;
-#ifdef ENABLE_ADMINPORT
-		lcconf->port_admin = s_port_admin;
-#endif
-	} else {
-		s_port_isakmp = lcconf->port_isakmp;
-#ifdef ENABLE_ADMINPORT
-		s_port_admin = lcconf->port_admin;
-#endif
-	}
-}
-
-void
-restore_params()
-{
-	saverestore_params(1);
-}
-
-void
-save_params()
-{
-	saverestore_params(0);
-}
diff --git a/src/racoon/localconf.h b/src/racoon/localconf.h
deleted file mode 100644
index f7cf33a..0000000
--- a/src/racoon/localconf.h
+++ /dev/null
@@ -1,137 +0,0 @@
-/*	$NetBSD: localconf.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/* Id: localconf.h,v 1.13 2005/11/06 18:13:18 monas Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _LOCALCONF_H
-#define _LOCALCONF_H
-
-/* local configuration */
-
-#define LC_DEFAULT_CF	SYSCONFDIR "/racoon.conf"
-
-#define LC_PATHTYPE_INCLUDE	0
-#define LC_PATHTYPE_PSK		1
-#define LC_PATHTYPE_CERT	2
-#define LC_PATHTYPE_BACKUPSA	3
-#define LC_PATHTYPE_SCRIPT	4
-#define LC_PATHTYPE_PIDFILE	5
-#define LC_PATHTYPE_MAX		6
-
-#define LC_DEFAULT_PAD_MAXSIZE		20
-#define LC_DEFAULT_PAD_RANDOM		TRUE
-#define LC_DEFAULT_PAD_RANDOMLEN	FALSE
-#define LC_DEFAULT_PAD_STRICT		FALSE
-#define LC_DEFAULT_PAD_EXCLTAIL		TRUE
-#define LC_DEFAULT_RETRY_COUNTER	5
-#define LC_DEFAULT_RETRY_INTERVAL	10
-#define LC_DEFAULT_COUNT_PERSEND	1
-#define LC_DEFAULT_RETRY_CHECKPH1	30
-#define LC_DEFAULT_WAIT_PH2COMPLETE	30
-#define LC_DEFAULT_NATT_KA_INTERVAL	20
-
-#define LC_DEFAULT_SECRETSIZE	16	/* 128 bits */
-
-#define LC_IDENTTYPE_MAX	5	/* XXX */
-
-#define	LC_GSSENC_UTF16LE	0	/* GSS ID in UTF-16LE */
-#define	LC_GSSENC_LATIN1	1	/* GSS ID in ISO-Latin-1 */
-#define	LC_GSSENC_MAX		2
-
-struct localconf {
-	char *racoon_conf;		/* configuration filename */
-
-	uid_t uid;
-	gid_t gid;
-	char *chroot;			/* chroot path */
-	u_int16_t port_isakmp;		/* port for isakmp as default */
-	u_int16_t port_isakmp_natt;	/* port for NAT-T use */
-	u_int16_t port_admin;		/* port for admin */
-	int default_af;			/* default address family */
-
-	int sock_admin;
-	int sock_pfkey;
-	int rtsock;			/* routing socket */
-
-	int autograbaddr;
-	struct myaddrs *myaddrs;
-
-	char *pathinfo[LC_PATHTYPE_MAX];
-	vchar_t *ident[LC_IDENTTYPE_MAX]; /* base of Identifier payload. */
-
-	int pad_random;
-	int pad_randomlen;
-	int pad_maxsize;
-	int pad_strict;
-	int pad_excltail;
-
-	int retry_counter;		/* times to retry. */
-	int retry_interval;		/* interval each retry. */
-	int count_persend;		/* the number of packets each retry. */
-				/* above 3 values are copied into a handler. */
-
-	int retry_checkph1;
-	int wait_ph2complete;
-
-	int natt_ka_interval;		/* NAT-T keepalive interval. */
-
-	int secret_size;
-	int strict_address;		/* strictly check addresses. */
-
-	int complex_bundle;
-		/*
-		 * If we want to make a packet "IP2 AH ESP IP1 ULP",
-		 * the SPD in KAME expresses AH transport + ESP tunnel.
-		 * So racoon sent the proposal contained such the order.
-		 * But lots of implementation interprets AH tunnel + ESP
-		 * tunnel in this case.  racoon has changed the format,
-		 * usually uses this format.  If the option, 'complex_bundle'
-		 * is enable, racoon uses old format.
-		 */
-
-	int gss_id_enc;			/* GSS ID encoding to use */
-};
-
-extern struct localconf *lcconf;
-
-extern void initlcconf __P((void));
-extern void flushlcconf __P((void));
-extern vchar_t *getpskbyname __P((vchar_t *));
-extern vchar_t *getpskbyaddr __P((struct sockaddr *));
-extern void getpathname __P((char *, int, int, const char *));
-extern int sittype2doi __P((int));
-extern int doitype2doi __P((int));
-extern vchar_t *getpsk __P((const char *, const int)); 
-
-extern void restore_params __P((void));
-extern void save_params __P((void));
-
-#endif /* _LOCALCONF_H */
diff --git a/src/racoon/logger.c b/src/racoon/logger.c
deleted file mode 100644
index 06991cc..0000000
--- a/src/racoon/logger.c
+++ /dev/null
@@ -1,262 +0,0 @@
-/*	$NetBSD: logger.c,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/*	$KAME: logger.c,v 1.9 2002/09/03 14:37:03 itojun Exp $	*/
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-#ifdef HAVE_STDARG_H
-#include <stdarg.h>
-#else
-#include <varargs.h>
-#endif
-#if TIME_WITH_SYS_TIME
-# include <sys/time.h>
-# include <time.h>
-#else
-# if HAVE_SYS_TIME_H
-#  include <sys/time.h>
-# else
-#  include <time.h>
-# endif
-#endif
-
-#include "logger.h"
-#include "var.h"
-#include "gcmalloc.h"
-
-struct log *
-log_open(siz, fname)
-	size_t siz;
-	char *fname;
-{
-	struct log *p;
-
-	p = (struct log *)racoon_malloc(sizeof(*p));
-	if (p == NULL)
-		return NULL;
-	memset(p, 0, sizeof(*p));
-
-	p->buf = (char **)racoon_malloc(sizeof(char *) * siz);
-	if (p->buf == NULL) {
-		racoon_free(p);
-		return NULL;
-	}
-	memset(p->buf, 0, sizeof(char *) * siz);
-
-	p->tbuf = (time_t *)racoon_malloc(sizeof(time_t *) * siz);
-	if (p->tbuf == NULL) {
-		racoon_free(p->buf);
-		racoon_free(p);
-		return NULL;
-	}
-	memset(p->tbuf, 0, sizeof(time_t *) * siz);
-
-	p->siz = siz;
-	if (fname)
-		p->fname = racoon_strdup(fname);
-
-	return p;
-}
-
-/*
- * append string to ring buffer.
- * string must be \n-terminated (since we add timestamps).
- * even if not, we'll add \n to avoid formatting mistake (see log_close()).
- */
-void
-log_add(p, str)
-	struct log *p;
-	char *str;
-{
-	/* syslog if p->fname == NULL? */
-	if (p->buf[p->head])
-		racoon_free(p->buf[p->head]);
-	p->buf[p->head] = racoon_strdup(str);
-	p->tbuf[p->head] = time(NULL);
-	p->head++;
-	p->head %= p->siz;
-}
-
-/*
- * write out string to the log file, as is.
- * \n-termination is up to the caller.  if you don't add \n, the file
- * format may be broken.
- */
-int
-log_print(p, str)
-	struct log *p;
-	char *str;
-{
-	FILE *fp;
-
-	if (p->fname == NULL)
-		return -1;	/*XXX syslog?*/
-	fp = fopen(p->fname, "a");
-	if (fp == NULL)
-		return -1;
-	fprintf(fp, "%s", str);
-	fclose(fp);
-
-	return 0;
-}
-
-int
-log_vprint(struct log *p, const char *fmt, ...)
-{
-	va_list ap;
-
-	FILE *fp;
-
-	if (p->fname == NULL)
-		return -1;	/*XXX syslog?*/
-	fp = fopen(p->fname, "a");
-	if (fp == NULL)
-		return -1;
-	va_start(ap, fmt);
-	vfprintf(fp, fmt, ap);
-	va_end(ap);
-
-	fclose(fp);
-
-	return 0;
-}
-
-int
-log_vaprint(struct log *p, const char *fmt, va_list ap)
-{
-	FILE *fp;
-
-	if (p->fname == NULL)
-		return -1;	/*XXX syslog?*/
-	fp = fopen(p->fname, "a");
-	if (fp == NULL)
-		return -1;
-	vfprintf(fp, fmt, ap);
-	fclose(fp);
-
-	return 0;
-}
-
-/*
- * write out content of ring buffer, and reclaim the log structure
- */
-int
-log_close(p)
-	struct log *p;
-{
-	FILE *fp;
-	int i, j;
-	char ts[256];
-	struct tm *tm;
-
-	if (p->fname == NULL)
-		goto nowrite;
-	fp = fopen(p->fname, "a");
-	if (fp == NULL)
-		goto nowrite;
-
-	for (i = 0; i < p->siz; i++) {
-		j = (p->head + i) % p->siz;
-		if (p->buf[j]) {
-			tm = localtime(&p->tbuf[j]);
-			strftime(ts, sizeof(ts), "%B %d %T", tm);
-			fprintf(fp, "%s: %s\n", ts, p->buf[j]);
-			if (*(p->buf[j] + strlen(p->buf[j]) - 1) != '\n')
-				fprintf(fp, "\n");
-		}
-	}
-	fclose(fp);
-
-nowrite:
-	log_free(p);
-	return 0;
-}
-
-void
-log_free(p)
-	struct log *p;
-{
-	int i;
-
-	for (i = 0; i < p->siz; i++)
-		racoon_free(p->buf[i]);
-	racoon_free(p->buf);
-	racoon_free(p->tbuf);
-	if (p->fname)
-		racoon_free(p->fname);
-	racoon_free(p);
-}
-
-#ifdef TEST
-struct log *l;
-
-void
-vatest(const char *fmt, ...)
-{
-	va_list ap;
-	va_start(ap, fmt);
-	log_vaprint(l, fmt, ap);
-	va_end(ap);
-}
-
-int
-main(argc, argv)
-	int argc;
-	char **argv;
-{
-	int i;
-
-	l = log_open(30, "/tmp/hoge");
-	if (l == NULL)
-		errx(1, "hoge");
-
-	for (i = 0; i < 50; i++) {
-		log_add(l, "foo");
-		log_add(l, "baa");
-		log_add(l, "baz");
-	}
-	log_print(l, "hoge\n");
-	log_vprint(l, "hoge %s\n", "this is test");
-	vatest("%s %s\n", "this is", "vprint test");
-	abort();
-	log_free(l);
-}
-
-#endif
-
diff --git a/src/racoon/logger.h b/src/racoon/logger.h
deleted file mode 100644
index 3fd3e94..0000000
--- a/src/racoon/logger.h
+++ /dev/null
@@ -1,53 +0,0 @@
-/*	$NetBSD: logger.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/* Id: logger.h,v 1.3 2004/06/11 16:00:16 ludvigm Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _LOGGER_H
-#define _LOGGER_H
-
-struct log {
-	int head;
-	int siz;
-	char **buf;
-	time_t *tbuf;
-	char *fname;
-};
-
-extern struct log *log_open __P((size_t, char *));
-extern void log_add __P((struct log *, char *));
-extern int log_print __P((struct log *, char *));
-extern int log_vprint __P((struct log *, const char *, ...));
-extern int log_vaprint __P((struct log *, const char *, va_list));
-extern int log_close __P((struct log *));
-extern void log_free __P((struct log *));
-
-#endif /* _LOGGER_H */
diff --git a/src/racoon/main.c b/src/racoon/main.c
deleted file mode 100644
index 094026e..0000000
--- a/src/racoon/main.c
+++ /dev/null
@@ -1,398 +0,0 @@
-/*	$NetBSD: main.c,v 1.6.6.2 2008/11/27 15:25:26 vanhu Exp $	*/
-
-/* Id: main.c,v 1.25 2006/06/20 20:31:34 manubsd Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/socket.h>
-#include <sys/stat.h>
-
-#include <netinet/in.h>
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-#include <limits.h>
-#ifdef HAVE_UNISTD_H
-#include <unistd.h>
-#endif
-#include <paths.h>
-#include <err.h>
-
-/*
- * If we're using a debugging malloc library, this may define our
- * wrapper stubs.
- */
-#define	RACOON_MAIN_PROGRAM
-#include "gcmalloc.h"
-
-#include "var.h"
-#include "misc.h"
-#include "vmbuf.h"
-#include "plog.h"
-#include "debug.h"
-
-#include "cfparse_proto.h"
-#include "isakmp_var.h"
-#ifdef ENABLE_HYBRID
-#include <resolv.h>
-#include "isakmp.h"
-#include "isakmp_xauth.h"
-#include "isakmp_cfg.h"
-#endif
-#include "remoteconf.h"
-#include "localconf.h"
-#include "session.h"
-#include "oakley.h"
-#include "pfkey.h"
-#include "policy.h"
-#include "crypto_openssl.h"
-#include "backupsa.h"
-#include "vendorid.h"
-
-#include "package_version.h"
-
-int f_local = 0;	/* local test mode.  behave like a wall. */
-int vflag = 1;		/* for print-isakmp.c */
-static int loading_sa = 0;	/* install sa when racoon boots up. */
-static int dump_config = 0;	/* dump parsed config file. */
-
-#ifdef TOP_PACKAGE
-static char version[] = "@(#)" TOP_PACKAGE_STRING " (" TOP_PACKAGE_URL ")";
-#else /* TOP_PACKAGE */
-static char version[] = "@(#) racoon / IPsec-tools";
-#endif /* TOP_PACKAGE */
-
-int main __P((int, char **));
-static void usage __P((void));
-static void parse __P((int, char **));
-#if 0
-static void cleanup_pidfile __P((void));
-#endif
-
-void
-usage()
-{
-	printf("usage: racoon [-BdFv%s] %s[-f (file)] [-l (file)] [-p (port)]\n",
-#ifdef INET6
-		"46",
-#else
-		"",
-#endif
-#ifdef ENABLE_ADMINPORT
-		"[-a (port)] "
-#else
-		""
-#endif
-		);
-	printf("   -B: install SA to the kernel from the file "
-		"specified by the configuration file.\n");
-	printf("   -d: debug level, more -d will generate more debug message.\n");
-	printf("   -C: dump parsed config file.\n");
-	printf("   -L: include location in debug messages\n");
-	printf("   -F: run in foreground, do not become daemon.\n");
-	printf("   -v: be more verbose\n");
-#ifdef INET6
-	printf("   -4: IPv4 mode.\n");
-	printf("   -6: IPv6 mode.\n");
-#endif
-#ifdef ENABLE_ADMINPORT
-	printf("   -a: port number for admin port.\n");
-#endif
-	printf("   -f: pathname for configuration file.\n");
-	printf("   -l: pathname for log file.\n");
-	printf("   -p: port number for isakmp (default: %d).\n", PORT_ISAKMP);
-	printf("   -P: port number for NAT-T (default: %d).\n", PORT_ISAKMP_NATT);
-	exit(1);
-}
-
-int
-main(ac, av)
-	int ac;
-	char **av;
-{
-	int error;
-
-	if (geteuid() != 0) {
-		errx(1, "must be root to invoke this program.");
-		/* NOTREACHED*/
-	}
-
-	/*
-	 * Don't let anyone read files I write.  Although some files (such as
-	 * the PID file) can be other readable, we dare to use the global mask,
-	 * because racoon uses fopen(3), which can't specify the permission
-	 * at the creation time.
-	 */
-	umask(077);
-	if (umask(077) != 077) {
-		errx(1, "could not set umask");
-		/* NOTREACHED*/
-	}
-
-#ifdef DEBUG_RECORD_MALLOCATION
-	DRM_init();
-#endif
-
-#ifdef HAVE_SECCTX
-	init_avc();
-#endif
-	eay_init();
-	initlcconf();
-	initrmconf();
-	oakley_dhinit();
-	compute_vendorids();
-
-	parse(ac, av);
-
-	ploginit();
-
-	plog(LLV_INFO, LOCATION, NULL, "%s\n", version);
-	plog(LLV_INFO, LOCATION, NULL, "@(#)"
-	    "This product linked %s (http://www.openssl.org/)"
-	    "\n", eay_version());
-	plog(LLV_INFO, LOCATION, NULL, "Reading configuration from \"%s\"\n", 
-	    lcconf->racoon_conf);
-
-	if (pfkey_init() < 0) {
-		errx(1, "something error happened "
-			"while pfkey initializing.");
-		/* NOTREACHED*/
-	}
-
-#ifdef ENABLE_HYBRID
-	if (isakmp_cfg_init(ISAKMP_CFG_INIT_COLD))
-		errx(1, "could not initialize ISAKMP mode config structures");
-#endif
-
-#ifdef HAVE_LIBLDAP
-	if (xauth_ldap_init() != 0)
-		errx(1, "could not initialize libldap");
-#endif
-
-	/*
-	 * in order to prefer the parameters by command line,
-	 * saving some parameters before parsing configuration file.
-	 */
-	save_params();
-	error = cfparse();
-	if (error != 0)
-		errx(1, "failed to parse configuration file.");
-	restore_params();
-
-#ifdef ENABLE_HYBRID
-	if(isakmp_cfg_config.network4 && isakmp_cfg_config.pool_size == 0)
-		if ((error = isakmp_cfg_resize_pool(ISAKMP_CFG_MAX_CNX)) != 0)
-			return error;
-#endif
-
-	if (dump_config)
-		dumprmconf ();
-
-#ifdef HAVE_LIBRADIUS
-	if (xauth_radius_init() != 0) {
-		errx(1, "could not initialize libradius");
-		/* NOTREACHED*/
-	}
-#endif
-
-	/*
-	 * install SAs from the specified file.  If the file is not specified
-	 * by the configuration file, racoon will exit.
-	 */
-	if (loading_sa && !f_local) {
-		if (backupsa_from_file() != 0)
-			errx(1, "something error happened "
-				"SA recovering.");
-	}
-
-	if (f_foreground)
-		close(0);
-	else {
-		if (daemon(0, 0) < 0) {
-			errx(1, "failed to be daemon. (%s)",
-				strerror(errno));
-		}
-#ifndef __linux__
-		/*
-		 * In case somebody has started inetd manually, we need to
-		 * clear the logname, so that old servers run as root do not
-		 * get the user's logname..
-		 */
-		if (setlogin("") < 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"cannot clear logname: %s\n", strerror(errno));
-			/* no big deal if it fails.. */
-		}
-#endif
-		if (!f_local) {
-#if 0
-			if (atexit(cleanup_pidfile) < 0) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"cannot register pidfile cleanup");
-			}
-#endif
-		}
-	}
-
-	session();
-
-	exit(0);
-}
-
-#if 0
-static void
-cleanup_pidfile()
-{
-	pid_t p = getpid();
-
-	/* if it's not child process, clean everything */
-	if (racoon_pid == p) {
-		const char *pid_file = _PATH_VARRUN "racoon.pid";
-
-		(void) unlink(pid_file);
-	}
-}
-#endif
-
-static void
-parse(ac, av)
-	int ac;
-	char **av;
-{
-	extern char *optarg;
-	extern int optind;
-	int c;
-#ifdef YYDEBUG
-	extern int yydebug;
-#endif
-
-	pname = strrchr(*av, '/');
-	if (pname)
-		pname++;
-	else
-		pname = *av;
-
-	while ((c = getopt(ac, av, "dLFp:P:a:f:l:vZBC"
-#ifdef YYDEBUG
-			"y"
-#endif
-#ifdef INET6
-			"46"
-#endif
-			)) != -1) {
-		switch (c) {
-		case 'd':
-			loglevel++;
-			break;
-		case 'L':
-			print_location = 1;
-			break;
-		case 'F':
-			printf("Foreground mode.\n");
-			f_foreground = 1;
-			break;
-		case 'p':
-			lcconf->port_isakmp = atoi(optarg);
-			break;
-		case 'P':
-			lcconf->port_isakmp_natt = atoi(optarg);
-			break;
-		case 'a':
-#ifdef ENABLE_ADMINPORT
-			lcconf->port_admin = atoi(optarg);
-			break;
-#else
-			fprintf(stderr, "%s: the option is disabled "
-			    "in the configuration\n", pname);
-			exit(1);
-#endif
-		case 'f':
-			lcconf->racoon_conf = optarg;
-			break;
-		case 'l':
-			plogset(optarg);
-			break;
-		case 'v':
-			vflag++;
-			break;
-		case 'Z':
-			/*
-			 * only local test.
-			 * To specify -Z option and to choice a appropriate
-			 * port number for ISAKMP, you can launch some racoons
-			 * on the local host for debug.
-			 * pk_sendadd() on initiator side is always failed
-			 * even if this flag is used.  Because there is same
-			 * spi in the SAD which is inserted by pk_sendgetspi()
-			 * on responder side.
-			 */
-			printf("Local test mode.\n");
-			f_local = 1;
-			break;
-#ifdef YYDEBUG
-		case 'y':
-			yydebug = 1;
-			break;
-#endif
-#ifdef INET6
-		case '4':
-			lcconf->default_af = AF_INET;
-			break;
-		case '6':
-			lcconf->default_af = AF_INET6;
-			break;
-#endif
-		case 'B':
-			loading_sa++;
-			break;
-		case 'C':
-			dump_config++;
-			break;
-		default:
-			usage();
-			/* NOTREACHED */
-		}
-	}
-	ac -= optind;
-	av += optind;
-
-	if (ac != 0) {
-		usage();
-		/* NOTREACHED */
-	}
-
-	return;
-}
diff --git a/src/racoon/misc.c b/src/racoon/misc.c
deleted file mode 100644
index 18a4f19..0000000
--- a/src/racoon/misc.c
+++ /dev/null
@@ -1,171 +0,0 @@
-/*	$NetBSD: misc.c,v 1.4.6.1 2008/07/15 00:55:48 mgrooms Exp $	*/
-
-/*	$KAME: misc.c,v 1.23 2001/08/16 14:37:29 itojun Exp $	*/
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/stat.h>
-#include <sys/time.h>
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-#include <syslog.h>
-#include <ctype.h>
-
-#include "var.h"
-#include "misc.h"
-#include "debug.h"
-
-#if 0
-static int bindump __P((void *, size_t));
-
-static int
-bindump(buf0, len)
-        void *buf0;
-        size_t len;
-{
-	unsigned char *buf = (unsigned char *)buf0;
-	size_t i;
-
-	for (i = 0; i < len; i++) {
-		if ((buf[i] & 0x80) || !isprint(buf[i]))
-			printf("\\x%x", buf[i]);
-		else
-			printf("%c", buf[i]);
-	}
-	printf("\n");
-
-	return 0;
-}
-#endif
-
-int
-racoon_hexdump(buf0, len)
-	const void *buf0;
-	size_t len;
-{
-	const unsigned char *buf = buf0;
-	size_t i;
-
-	for (i = 0; i < len; i++) {
-		if (i != 0 && i % 32 == 0)
-			printf("\n");
-		if (i % 4 == 0)
-			printf(" ");
-		printf("%02x", buf[i]);
-	}
-	printf("\n");
-
-	return 0;
-}
-
-char *
-bit2str(n, bl)
-	int n, bl;
-{
-#define MAXBITLEN 128
-	static char b[MAXBITLEN + 1];
-	int i;
-
-	if (bl > MAXBITLEN)
-		return "Failed to convert.";	/* NG */
-	memset(b, '0', bl);
-	b[bl] = '\0';
-
-	for (i = 0; i < bl; i++) {
-		if (n & (1 << i))
-			b[bl - 1 - i] = '1';
-	}
-
-	return b;
-}
-
-const char *
-debug_location(file, line, func)
-	const char *file;
-	int line;
-	const char *func;
-{
-	static char buf[1024];
-	const char *p;
-
-	/* truncate pathname */
-	p = strrchr(file, '/');
-	if (p)
-		p++;
-	else
-		p = file;
-
-	if (func)
-		snprintf(buf, sizeof(buf), "%s:%d:%s()", p, line, func);
-	else
-		snprintf(buf, sizeof(buf), "%s:%d", p, line);
-
-	return buf;
-}
-
-/*
- * get file size.
- * -1: error occured.
- */
-int
-getfsize(path)
-	char *path;
-{
-        struct stat st;
-
-        if (stat(path, &st) != 0)
-                return -1;
-        else
-                return st.st_size;
-}
-
-/*
- * calculate the difference between two times.
- * t1: start
- * t2: end
- */
-double
-timedelta(t1, t2)
-	struct timeval *t1, *t2;
-{
-	if (t2->tv_usec >= t1->tv_usec)
-		return t2->tv_sec - t1->tv_sec +
-			(double)(t2->tv_usec - t1->tv_usec) / 1000000;
-
-	return t2->tv_sec - t1->tv_sec - 1 +
-		(double)(1000000 + t2->tv_usec - t1->tv_usec) / 1000000;
-}
diff --git a/src/racoon/misc.h b/src/racoon/misc.h
deleted file mode 100644
index 4979802..0000000
--- a/src/racoon/misc.h
+++ /dev/null
@@ -1,77 +0,0 @@
-/*	$NetBSD: misc.h,v 1.4.6.1 2008/07/15 00:55:48 mgrooms Exp $	*/
-
-/* Id: misc.h,v 1.9 2006/04/06 14:00:06 manubsd Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _MISC_H
-#define _MISC_H
-
-#define BIT2STR(b) bit2str(b, sizeof(b)<<3)
-
-#ifdef HAVE_FUNC_MACRO
-#define LOCATION        debug_location(__FILE__, __LINE__, __func__)
-#else
-#define LOCATION        debug_location(__FILE__, __LINE__, NULL)
-#endif
-
-extern int racoon_hexdump __P((const void *, size_t));
-extern char *bit2str __P((int, int));
-extern void *get_newbuf __P((void *, size_t));
-extern const char *debug_location __P((const char *, int, const char *));
-extern int getfsize __P((char *));
-struct timeval;
-extern double timedelta __P((struct timeval *, struct timeval *));
-char *strdup __P((const char *));
-
-#if defined(__APPLE__) && defined(__MACH__)
-#define RACOON_TAILQ_FOREACH_REVERSE(var, head, headname ,field)	\
-  TAILQ_FOREACH_REVERSE(var, head, field, headname)
-#else
-#define RACOON_TAILQ_FOREACH_REVERSE(var, head, headname ,field)	\
-    TAILQ_FOREACH_REVERSE(var, head, headname, field)
-#endif
-
-#ifndef HAVE_STRLCPY
-#define strlcpy(d,s,l) (strncpy(d,s,l), (d)[(l)-1] = '\0')
-#endif
-
-#ifndef HAVE_STRLCAT
-#define strlcat(d,s,l) strncat(d,s,(l)-strlen(d)-1)
-#endif
-
-#define STRDUP_FATAL(x) if (x == NULL) {			\
-	plog(LLV_ERROR, LOCATION, NULL, "strdup failed\n");	\
-	exit(1);						\
-}
-
-#include "libpfkey.h"
-
-#endif /* _MISC_H */
diff --git a/src/racoon/missing/crypto/rijndael/boxes-fst.dat b/src/racoon/missing/crypto/rijndael/boxes-fst.dat
deleted file mode 100644
index 28d15d3..0000000
--- a/src/racoon/missing/crypto/rijndael/boxes-fst.dat
+++ /dev/null
@@ -1,957 +0,0 @@
-/*	$KAME: boxes-fst.dat,v 1.1.1.1 2001/08/08 09:56:27 sakane Exp $	*/
-
-const word8 S[256] = {
- 99, 124, 119, 123, 242, 107, 111, 197,  48,   1, 103,  43, 254, 215, 171, 118, 
-202, 130, 201, 125, 250,  89,  71, 240, 173, 212, 162, 175, 156, 164, 114, 192, 
-183, 253, 147,  38,  54,  63, 247, 204,  52, 165, 229, 241, 113, 216,  49,  21, 
-  4, 199,  35, 195,  24, 150,   5, 154,   7,  18, 128, 226, 235,  39, 178, 117, 
-  9, 131,  44,  26,  27, 110,  90, 160,  82,  59, 214, 179,  41, 227,  47, 132, 
- 83, 209,   0, 237,  32, 252, 177,  91, 106, 203, 190,  57,  74,  76,  88, 207, 
-208, 239, 170, 251,  67,  77,  51, 133,  69, 249,   2, 127,  80,  60, 159, 168, 
- 81, 163,  64, 143, 146, 157,  56, 245, 188, 182, 218,  33,  16, 255, 243, 210, 
-205,  12,  19, 236,  95, 151,  68,  23, 196, 167, 126,  61, 100,  93,  25, 115, 
- 96, 129,  79, 220,  34,  42, 144, 136,  70, 238, 184,  20, 222,  94,  11, 219, 
-224,  50,  58,  10,  73,   6,  36,  92, 194, 211, 172,  98, 145, 149, 228, 121, 
-231, 200,  55, 109, 141, 213,  78, 169, 108,  86, 244, 234, 101, 122, 174,   8, 
-186, 120,  37,  46,  28, 166, 180, 198, 232, 221, 116,  31,  75, 189, 139, 138, 
-112,  62, 181, 102,  72,   3, 246,  14,  97,  53,  87, 185, 134, 193,  29, 158, 
-225, 248, 152,  17, 105, 217, 142, 148, 155,  30, 135, 233, 206,  85,  40, 223, 
-140, 161, 137,  13, 191, 230,  66, 104,  65, 153,  45,  15, 176,  84, 187,  22
-};
-
-#ifdef INTERMEDIATE_VALUE_KAT
-static const word8 Si[256] = {
- 82,   9, 106, 213,  48,  54, 165,  56, 191,  64, 163, 158, 129, 243, 215, 251, 
-124, 227,  57, 130, 155,  47, 255, 135,  52, 142,  67,  68, 196, 222, 233, 203, 
- 84, 123, 148,  50, 166, 194,  35,  61, 238,  76, 149,  11,  66, 250, 195,  78, 
-  8,  46, 161, 102,  40, 217,  36, 178, 118,  91, 162,  73, 109, 139, 209,  37, 
-114, 248, 246, 100, 134, 104, 152,  22, 212, 164,  92, 204,  93, 101, 182, 146, 
-108, 112,  72,  80, 253, 237, 185, 218,  94,  21,  70,  87, 167, 141, 157, 132, 
-144, 216, 171,   0, 140, 188, 211,  10, 247, 228,  88,   5, 184, 179,  69,   6, 
-208,  44,  30, 143, 202,  63,  15,   2, 193, 175, 189,   3,   1,  19, 138, 107, 
- 58, 145,  17,  65,  79, 103, 220, 234, 151, 242, 207, 206, 240, 180, 230, 115, 
-150, 172, 116,  34, 231, 173,  53, 133, 226, 249,  55, 232,  28, 117, 223, 110, 
- 71, 241,  26, 113,  29,  41, 197, 137, 111, 183,  98,  14, 170,  24, 190,  27, 
-252,  86,  62,  75, 198, 210, 121,  32, 154, 219, 192, 254, 120, 205,  90, 244, 
- 31, 221, 168,  51, 136,   7, 199,  49, 177,  18,  16,  89,  39, 128, 236,  95, 
- 96,  81, 127, 169,  25, 181,  74,  13,  45, 229, 122, 159, 147, 201, 156, 239, 
-160, 224,  59,  77, 174,  42, 245, 176, 200, 235, 187,  60, 131,  83, 153,  97, 
- 23,  43,   4, 126, 186, 119, 214,  38, 225, 105,  20,  99,  85,  33,  12, 125
-};
-#endif /* INTERMEDIATE_VALUE_KAT */
-
-union xtab {
-	word32	xt32[256];
-	word8	xt8[256][4];
-};
-
-static const union xtab xT1 = {
-	.xt8 = {
-{0xc6,0x63,0x63,0xa5}, {0xf8,0x7c,0x7c,0x84}, {0xee,0x77,0x77,0x99}, {0xf6,0x7b,0x7b,0x8d},
-{0xff,0xf2,0xf2,0x0d}, {0xd6,0x6b,0x6b,0xbd}, {0xde,0x6f,0x6f,0xb1}, {0x91,0xc5,0xc5,0x54},
-{0x60,0x30,0x30,0x50}, {0x02,0x01,0x01,0x03}, {0xce,0x67,0x67,0xa9}, {0x56,0x2b,0x2b,0x7d},
-{0xe7,0xfe,0xfe,0x19}, {0xb5,0xd7,0xd7,0x62}, {0x4d,0xab,0xab,0xe6}, {0xec,0x76,0x76,0x9a},
-{0x8f,0xca,0xca,0x45}, {0x1f,0x82,0x82,0x9d}, {0x89,0xc9,0xc9,0x40}, {0xfa,0x7d,0x7d,0x87},
-{0xef,0xfa,0xfa,0x15}, {0xb2,0x59,0x59,0xeb}, {0x8e,0x47,0x47,0xc9}, {0xfb,0xf0,0xf0,0x0b},
-{0x41,0xad,0xad,0xec}, {0xb3,0xd4,0xd4,0x67}, {0x5f,0xa2,0xa2,0xfd}, {0x45,0xaf,0xaf,0xea},
-{0x23,0x9c,0x9c,0xbf}, {0x53,0xa4,0xa4,0xf7}, {0xe4,0x72,0x72,0x96}, {0x9b,0xc0,0xc0,0x5b},
-{0x75,0xb7,0xb7,0xc2}, {0xe1,0xfd,0xfd,0x1c}, {0x3d,0x93,0x93,0xae}, {0x4c,0x26,0x26,0x6a},
-{0x6c,0x36,0x36,0x5a}, {0x7e,0x3f,0x3f,0x41}, {0xf5,0xf7,0xf7,0x02}, {0x83,0xcc,0xcc,0x4f},
-{0x68,0x34,0x34,0x5c}, {0x51,0xa5,0xa5,0xf4}, {0xd1,0xe5,0xe5,0x34}, {0xf9,0xf1,0xf1,0x08},
-{0xe2,0x71,0x71,0x93}, {0xab,0xd8,0xd8,0x73}, {0x62,0x31,0x31,0x53}, {0x2a,0x15,0x15,0x3f},
-{0x08,0x04,0x04,0x0c}, {0x95,0xc7,0xc7,0x52}, {0x46,0x23,0x23,0x65}, {0x9d,0xc3,0xc3,0x5e},
-{0x30,0x18,0x18,0x28}, {0x37,0x96,0x96,0xa1}, {0x0a,0x05,0x05,0x0f}, {0x2f,0x9a,0x9a,0xb5},
-{0x0e,0x07,0x07,0x09}, {0x24,0x12,0x12,0x36}, {0x1b,0x80,0x80,0x9b}, {0xdf,0xe2,0xe2,0x3d},
-{0xcd,0xeb,0xeb,0x26}, {0x4e,0x27,0x27,0x69}, {0x7f,0xb2,0xb2,0xcd}, {0xea,0x75,0x75,0x9f},
-{0x12,0x09,0x09,0x1b}, {0x1d,0x83,0x83,0x9e}, {0x58,0x2c,0x2c,0x74}, {0x34,0x1a,0x1a,0x2e},
-{0x36,0x1b,0x1b,0x2d}, {0xdc,0x6e,0x6e,0xb2}, {0xb4,0x5a,0x5a,0xee}, {0x5b,0xa0,0xa0,0xfb},
-{0xa4,0x52,0x52,0xf6}, {0x76,0x3b,0x3b,0x4d}, {0xb7,0xd6,0xd6,0x61}, {0x7d,0xb3,0xb3,0xce},
-{0x52,0x29,0x29,0x7b}, {0xdd,0xe3,0xe3,0x3e}, {0x5e,0x2f,0x2f,0x71}, {0x13,0x84,0x84,0x97},
-{0xa6,0x53,0x53,0xf5}, {0xb9,0xd1,0xd1,0x68}, {0x00,0x00,0x00,0x00}, {0xc1,0xed,0xed,0x2c},
-{0x40,0x20,0x20,0x60}, {0xe3,0xfc,0xfc,0x1f}, {0x79,0xb1,0xb1,0xc8}, {0xb6,0x5b,0x5b,0xed},
-{0xd4,0x6a,0x6a,0xbe}, {0x8d,0xcb,0xcb,0x46}, {0x67,0xbe,0xbe,0xd9}, {0x72,0x39,0x39,0x4b},
-{0x94,0x4a,0x4a,0xde}, {0x98,0x4c,0x4c,0xd4}, {0xb0,0x58,0x58,0xe8}, {0x85,0xcf,0xcf,0x4a},
-{0xbb,0xd0,0xd0,0x6b}, {0xc5,0xef,0xef,0x2a}, {0x4f,0xaa,0xaa,0xe5}, {0xed,0xfb,0xfb,0x16},
-{0x86,0x43,0x43,0xc5}, {0x9a,0x4d,0x4d,0xd7}, {0x66,0x33,0x33,0x55}, {0x11,0x85,0x85,0x94},
-{0x8a,0x45,0x45,0xcf}, {0xe9,0xf9,0xf9,0x10}, {0x04,0x02,0x02,0x06}, {0xfe,0x7f,0x7f,0x81},
-{0xa0,0x50,0x50,0xf0}, {0x78,0x3c,0x3c,0x44}, {0x25,0x9f,0x9f,0xba}, {0x4b,0xa8,0xa8,0xe3},
-{0xa2,0x51,0x51,0xf3}, {0x5d,0xa3,0xa3,0xfe}, {0x80,0x40,0x40,0xc0}, {0x05,0x8f,0x8f,0x8a},
-{0x3f,0x92,0x92,0xad}, {0x21,0x9d,0x9d,0xbc}, {0x70,0x38,0x38,0x48}, {0xf1,0xf5,0xf5,0x04},
-{0x63,0xbc,0xbc,0xdf}, {0x77,0xb6,0xb6,0xc1}, {0xaf,0xda,0xda,0x75}, {0x42,0x21,0x21,0x63},
-{0x20,0x10,0x10,0x30}, {0xe5,0xff,0xff,0x1a}, {0xfd,0xf3,0xf3,0x0e}, {0xbf,0xd2,0xd2,0x6d},
-{0x81,0xcd,0xcd,0x4c}, {0x18,0x0c,0x0c,0x14}, {0x26,0x13,0x13,0x35}, {0xc3,0xec,0xec,0x2f},
-{0xbe,0x5f,0x5f,0xe1}, {0x35,0x97,0x97,0xa2}, {0x88,0x44,0x44,0xcc}, {0x2e,0x17,0x17,0x39},
-{0x93,0xc4,0xc4,0x57}, {0x55,0xa7,0xa7,0xf2}, {0xfc,0x7e,0x7e,0x82}, {0x7a,0x3d,0x3d,0x47},
-{0xc8,0x64,0x64,0xac}, {0xba,0x5d,0x5d,0xe7}, {0x32,0x19,0x19,0x2b}, {0xe6,0x73,0x73,0x95},
-{0xc0,0x60,0x60,0xa0}, {0x19,0x81,0x81,0x98}, {0x9e,0x4f,0x4f,0xd1}, {0xa3,0xdc,0xdc,0x7f},
-{0x44,0x22,0x22,0x66}, {0x54,0x2a,0x2a,0x7e}, {0x3b,0x90,0x90,0xab}, {0x0b,0x88,0x88,0x83},
-{0x8c,0x46,0x46,0xca}, {0xc7,0xee,0xee,0x29}, {0x6b,0xb8,0xb8,0xd3}, {0x28,0x14,0x14,0x3c},
-{0xa7,0xde,0xde,0x79}, {0xbc,0x5e,0x5e,0xe2}, {0x16,0x0b,0x0b,0x1d}, {0xad,0xdb,0xdb,0x76},
-{0xdb,0xe0,0xe0,0x3b}, {0x64,0x32,0x32,0x56}, {0x74,0x3a,0x3a,0x4e}, {0x14,0x0a,0x0a,0x1e},
-{0x92,0x49,0x49,0xdb}, {0x0c,0x06,0x06,0x0a}, {0x48,0x24,0x24,0x6c}, {0xb8,0x5c,0x5c,0xe4},
-{0x9f,0xc2,0xc2,0x5d}, {0xbd,0xd3,0xd3,0x6e}, {0x43,0xac,0xac,0xef}, {0xc4,0x62,0x62,0xa6},
-{0x39,0x91,0x91,0xa8}, {0x31,0x95,0x95,0xa4}, {0xd3,0xe4,0xe4,0x37}, {0xf2,0x79,0x79,0x8b},
-{0xd5,0xe7,0xe7,0x32}, {0x8b,0xc8,0xc8,0x43}, {0x6e,0x37,0x37,0x59}, {0xda,0x6d,0x6d,0xb7},
-{0x01,0x8d,0x8d,0x8c}, {0xb1,0xd5,0xd5,0x64}, {0x9c,0x4e,0x4e,0xd2}, {0x49,0xa9,0xa9,0xe0},
-{0xd8,0x6c,0x6c,0xb4}, {0xac,0x56,0x56,0xfa}, {0xf3,0xf4,0xf4,0x07}, {0xcf,0xea,0xea,0x25},
-{0xca,0x65,0x65,0xaf}, {0xf4,0x7a,0x7a,0x8e}, {0x47,0xae,0xae,0xe9}, {0x10,0x08,0x08,0x18},
-{0x6f,0xba,0xba,0xd5}, {0xf0,0x78,0x78,0x88}, {0x4a,0x25,0x25,0x6f}, {0x5c,0x2e,0x2e,0x72},
-{0x38,0x1c,0x1c,0x24}, {0x57,0xa6,0xa6,0xf1}, {0x73,0xb4,0xb4,0xc7}, {0x97,0xc6,0xc6,0x51},
-{0xcb,0xe8,0xe8,0x23}, {0xa1,0xdd,0xdd,0x7c}, {0xe8,0x74,0x74,0x9c}, {0x3e,0x1f,0x1f,0x21},
-{0x96,0x4b,0x4b,0xdd}, {0x61,0xbd,0xbd,0xdc}, {0x0d,0x8b,0x8b,0x86}, {0x0f,0x8a,0x8a,0x85},
-{0xe0,0x70,0x70,0x90}, {0x7c,0x3e,0x3e,0x42}, {0x71,0xb5,0xb5,0xc4}, {0xcc,0x66,0x66,0xaa},
-{0x90,0x48,0x48,0xd8}, {0x06,0x03,0x03,0x05}, {0xf7,0xf6,0xf6,0x01}, {0x1c,0x0e,0x0e,0x12},
-{0xc2,0x61,0x61,0xa3}, {0x6a,0x35,0x35,0x5f}, {0xae,0x57,0x57,0xf9}, {0x69,0xb9,0xb9,0xd0},
-{0x17,0x86,0x86,0x91}, {0x99,0xc1,0xc1,0x58}, {0x3a,0x1d,0x1d,0x27}, {0x27,0x9e,0x9e,0xb9},
-{0xd9,0xe1,0xe1,0x38}, {0xeb,0xf8,0xf8,0x13}, {0x2b,0x98,0x98,0xb3}, {0x22,0x11,0x11,0x33},
-{0xd2,0x69,0x69,0xbb}, {0xa9,0xd9,0xd9,0x70}, {0x07,0x8e,0x8e,0x89}, {0x33,0x94,0x94,0xa7},
-{0x2d,0x9b,0x9b,0xb6}, {0x3c,0x1e,0x1e,0x22}, {0x15,0x87,0x87,0x92}, {0xc9,0xe9,0xe9,0x20},
-{0x87,0xce,0xce,0x49}, {0xaa,0x55,0x55,0xff}, {0x50,0x28,0x28,0x78}, {0xa5,0xdf,0xdf,0x7a},
-{0x03,0x8c,0x8c,0x8f}, {0x59,0xa1,0xa1,0xf8}, {0x09,0x89,0x89,0x80}, {0x1a,0x0d,0x0d,0x17},
-{0x65,0xbf,0xbf,0xda}, {0xd7,0xe6,0xe6,0x31}, {0x84,0x42,0x42,0xc6}, {0xd0,0x68,0x68,0xb8},
-{0x82,0x41,0x41,0xc3}, {0x29,0x99,0x99,0xb0}, {0x5a,0x2d,0x2d,0x77}, {0x1e,0x0f,0x0f,0x11},
-{0x7b,0xb0,0xb0,0xcb}, {0xa8,0x54,0x54,0xfc}, {0x6d,0xbb,0xbb,0xd6}, {0x2c,0x16,0x16,0x3a}
-	}
-};
-#define	T1	xT1.xt8
-
-static const union xtab xT2 = {
-	.xt8 = {
-{0xa5,0xc6,0x63,0x63}, {0x84,0xf8,0x7c,0x7c}, {0x99,0xee,0x77,0x77}, {0x8d,0xf6,0x7b,0x7b},
-{0x0d,0xff,0xf2,0xf2}, {0xbd,0xd6,0x6b,0x6b}, {0xb1,0xde,0x6f,0x6f}, {0x54,0x91,0xc5,0xc5},
-{0x50,0x60,0x30,0x30}, {0x03,0x02,0x01,0x01}, {0xa9,0xce,0x67,0x67}, {0x7d,0x56,0x2b,0x2b},
-{0x19,0xe7,0xfe,0xfe}, {0x62,0xb5,0xd7,0xd7}, {0xe6,0x4d,0xab,0xab}, {0x9a,0xec,0x76,0x76},
-{0x45,0x8f,0xca,0xca}, {0x9d,0x1f,0x82,0x82}, {0x40,0x89,0xc9,0xc9}, {0x87,0xfa,0x7d,0x7d},
-{0x15,0xef,0xfa,0xfa}, {0xeb,0xb2,0x59,0x59}, {0xc9,0x8e,0x47,0x47}, {0x0b,0xfb,0xf0,0xf0},
-{0xec,0x41,0xad,0xad}, {0x67,0xb3,0xd4,0xd4}, {0xfd,0x5f,0xa2,0xa2}, {0xea,0x45,0xaf,0xaf},
-{0xbf,0x23,0x9c,0x9c}, {0xf7,0x53,0xa4,0xa4}, {0x96,0xe4,0x72,0x72}, {0x5b,0x9b,0xc0,0xc0},
-{0xc2,0x75,0xb7,0xb7}, {0x1c,0xe1,0xfd,0xfd}, {0xae,0x3d,0x93,0x93}, {0x6a,0x4c,0x26,0x26},
-{0x5a,0x6c,0x36,0x36}, {0x41,0x7e,0x3f,0x3f}, {0x02,0xf5,0xf7,0xf7}, {0x4f,0x83,0xcc,0xcc},
-{0x5c,0x68,0x34,0x34}, {0xf4,0x51,0xa5,0xa5}, {0x34,0xd1,0xe5,0xe5}, {0x08,0xf9,0xf1,0xf1},
-{0x93,0xe2,0x71,0x71}, {0x73,0xab,0xd8,0xd8}, {0x53,0x62,0x31,0x31}, {0x3f,0x2a,0x15,0x15},
-{0x0c,0x08,0x04,0x04}, {0x52,0x95,0xc7,0xc7}, {0x65,0x46,0x23,0x23}, {0x5e,0x9d,0xc3,0xc3},
-{0x28,0x30,0x18,0x18}, {0xa1,0x37,0x96,0x96}, {0x0f,0x0a,0x05,0x05}, {0xb5,0x2f,0x9a,0x9a},
-{0x09,0x0e,0x07,0x07}, {0x36,0x24,0x12,0x12}, {0x9b,0x1b,0x80,0x80}, {0x3d,0xdf,0xe2,0xe2},
-{0x26,0xcd,0xeb,0xeb}, {0x69,0x4e,0x27,0x27}, {0xcd,0x7f,0xb2,0xb2}, {0x9f,0xea,0x75,0x75},
-{0x1b,0x12,0x09,0x09}, {0x9e,0x1d,0x83,0x83}, {0x74,0x58,0x2c,0x2c}, {0x2e,0x34,0x1a,0x1a},
-{0x2d,0x36,0x1b,0x1b}, {0xb2,0xdc,0x6e,0x6e}, {0xee,0xb4,0x5a,0x5a}, {0xfb,0x5b,0xa0,0xa0},
-{0xf6,0xa4,0x52,0x52}, {0x4d,0x76,0x3b,0x3b}, {0x61,0xb7,0xd6,0xd6}, {0xce,0x7d,0xb3,0xb3},
-{0x7b,0x52,0x29,0x29}, {0x3e,0xdd,0xe3,0xe3}, {0x71,0x5e,0x2f,0x2f}, {0x97,0x13,0x84,0x84},
-{0xf5,0xa6,0x53,0x53}, {0x68,0xb9,0xd1,0xd1}, {0x00,0x00,0x00,0x00}, {0x2c,0xc1,0xed,0xed},
-{0x60,0x40,0x20,0x20}, {0x1f,0xe3,0xfc,0xfc}, {0xc8,0x79,0xb1,0xb1}, {0xed,0xb6,0x5b,0x5b},
-{0xbe,0xd4,0x6a,0x6a}, {0x46,0x8d,0xcb,0xcb}, {0xd9,0x67,0xbe,0xbe}, {0x4b,0x72,0x39,0x39},
-{0xde,0x94,0x4a,0x4a}, {0xd4,0x98,0x4c,0x4c}, {0xe8,0xb0,0x58,0x58}, {0x4a,0x85,0xcf,0xcf},
-{0x6b,0xbb,0xd0,0xd0}, {0x2a,0xc5,0xef,0xef}, {0xe5,0x4f,0xaa,0xaa}, {0x16,0xed,0xfb,0xfb},
-{0xc5,0x86,0x43,0x43}, {0xd7,0x9a,0x4d,0x4d}, {0x55,0x66,0x33,0x33}, {0x94,0x11,0x85,0x85},
-{0xcf,0x8a,0x45,0x45}, {0x10,0xe9,0xf9,0xf9}, {0x06,0x04,0x02,0x02}, {0x81,0xfe,0x7f,0x7f},
-{0xf0,0xa0,0x50,0x50}, {0x44,0x78,0x3c,0x3c}, {0xba,0x25,0x9f,0x9f}, {0xe3,0x4b,0xa8,0xa8},
-{0xf3,0xa2,0x51,0x51}, {0xfe,0x5d,0xa3,0xa3}, {0xc0,0x80,0x40,0x40}, {0x8a,0x05,0x8f,0x8f},
-{0xad,0x3f,0x92,0x92}, {0xbc,0x21,0x9d,0x9d}, {0x48,0x70,0x38,0x38}, {0x04,0xf1,0xf5,0xf5},
-{0xdf,0x63,0xbc,0xbc}, {0xc1,0x77,0xb6,0xb6}, {0x75,0xaf,0xda,0xda}, {0x63,0x42,0x21,0x21},
-{0x30,0x20,0x10,0x10}, {0x1a,0xe5,0xff,0xff}, {0x0e,0xfd,0xf3,0xf3}, {0x6d,0xbf,0xd2,0xd2},
-{0x4c,0x81,0xcd,0xcd}, {0x14,0x18,0x0c,0x0c}, {0x35,0x26,0x13,0x13}, {0x2f,0xc3,0xec,0xec},
-{0xe1,0xbe,0x5f,0x5f}, {0xa2,0x35,0x97,0x97}, {0xcc,0x88,0x44,0x44}, {0x39,0x2e,0x17,0x17},
-{0x57,0x93,0xc4,0xc4}, {0xf2,0x55,0xa7,0xa7}, {0x82,0xfc,0x7e,0x7e}, {0x47,0x7a,0x3d,0x3d},
-{0xac,0xc8,0x64,0x64}, {0xe7,0xba,0x5d,0x5d}, {0x2b,0x32,0x19,0x19}, {0x95,0xe6,0x73,0x73},
-{0xa0,0xc0,0x60,0x60}, {0x98,0x19,0x81,0x81}, {0xd1,0x9e,0x4f,0x4f}, {0x7f,0xa3,0xdc,0xdc},
-{0x66,0x44,0x22,0x22}, {0x7e,0x54,0x2a,0x2a}, {0xab,0x3b,0x90,0x90}, {0x83,0x0b,0x88,0x88},
-{0xca,0x8c,0x46,0x46}, {0x29,0xc7,0xee,0xee}, {0xd3,0x6b,0xb8,0xb8}, {0x3c,0x28,0x14,0x14},
-{0x79,0xa7,0xde,0xde}, {0xe2,0xbc,0x5e,0x5e}, {0x1d,0x16,0x0b,0x0b}, {0x76,0xad,0xdb,0xdb},
-{0x3b,0xdb,0xe0,0xe0}, {0x56,0x64,0x32,0x32}, {0x4e,0x74,0x3a,0x3a}, {0x1e,0x14,0x0a,0x0a},
-{0xdb,0x92,0x49,0x49}, {0x0a,0x0c,0x06,0x06}, {0x6c,0x48,0x24,0x24}, {0xe4,0xb8,0x5c,0x5c},
-{0x5d,0x9f,0xc2,0xc2}, {0x6e,0xbd,0xd3,0xd3}, {0xef,0x43,0xac,0xac}, {0xa6,0xc4,0x62,0x62},
-{0xa8,0x39,0x91,0x91}, {0xa4,0x31,0x95,0x95}, {0x37,0xd3,0xe4,0xe4}, {0x8b,0xf2,0x79,0x79},
-{0x32,0xd5,0xe7,0xe7}, {0x43,0x8b,0xc8,0xc8}, {0x59,0x6e,0x37,0x37}, {0xb7,0xda,0x6d,0x6d},
-{0x8c,0x01,0x8d,0x8d}, {0x64,0xb1,0xd5,0xd5}, {0xd2,0x9c,0x4e,0x4e}, {0xe0,0x49,0xa9,0xa9},
-{0xb4,0xd8,0x6c,0x6c}, {0xfa,0xac,0x56,0x56}, {0x07,0xf3,0xf4,0xf4}, {0x25,0xcf,0xea,0xea},
-{0xaf,0xca,0x65,0x65}, {0x8e,0xf4,0x7a,0x7a}, {0xe9,0x47,0xae,0xae}, {0x18,0x10,0x08,0x08},
-{0xd5,0x6f,0xba,0xba}, {0x88,0xf0,0x78,0x78}, {0x6f,0x4a,0x25,0x25}, {0x72,0x5c,0x2e,0x2e},
-{0x24,0x38,0x1c,0x1c}, {0xf1,0x57,0xa6,0xa6}, {0xc7,0x73,0xb4,0xb4}, {0x51,0x97,0xc6,0xc6},
-{0x23,0xcb,0xe8,0xe8}, {0x7c,0xa1,0xdd,0xdd}, {0x9c,0xe8,0x74,0x74}, {0x21,0x3e,0x1f,0x1f},
-{0xdd,0x96,0x4b,0x4b}, {0xdc,0x61,0xbd,0xbd}, {0x86,0x0d,0x8b,0x8b}, {0x85,0x0f,0x8a,0x8a},
-{0x90,0xe0,0x70,0x70}, {0x42,0x7c,0x3e,0x3e}, {0xc4,0x71,0xb5,0xb5}, {0xaa,0xcc,0x66,0x66},
-{0xd8,0x90,0x48,0x48}, {0x05,0x06,0x03,0x03}, {0x01,0xf7,0xf6,0xf6}, {0x12,0x1c,0x0e,0x0e},
-{0xa3,0xc2,0x61,0x61}, {0x5f,0x6a,0x35,0x35}, {0xf9,0xae,0x57,0x57}, {0xd0,0x69,0xb9,0xb9},
-{0x91,0x17,0x86,0x86}, {0x58,0x99,0xc1,0xc1}, {0x27,0x3a,0x1d,0x1d}, {0xb9,0x27,0x9e,0x9e},
-{0x38,0xd9,0xe1,0xe1}, {0x13,0xeb,0xf8,0xf8}, {0xb3,0x2b,0x98,0x98}, {0x33,0x22,0x11,0x11},
-{0xbb,0xd2,0x69,0x69}, {0x70,0xa9,0xd9,0xd9}, {0x89,0x07,0x8e,0x8e}, {0xa7,0x33,0x94,0x94},
-{0xb6,0x2d,0x9b,0x9b}, {0x22,0x3c,0x1e,0x1e}, {0x92,0x15,0x87,0x87}, {0x20,0xc9,0xe9,0xe9},
-{0x49,0x87,0xce,0xce}, {0xff,0xaa,0x55,0x55}, {0x78,0x50,0x28,0x28}, {0x7a,0xa5,0xdf,0xdf},
-{0x8f,0x03,0x8c,0x8c}, {0xf8,0x59,0xa1,0xa1}, {0x80,0x09,0x89,0x89}, {0x17,0x1a,0x0d,0x0d},
-{0xda,0x65,0xbf,0xbf}, {0x31,0xd7,0xe6,0xe6}, {0xc6,0x84,0x42,0x42}, {0xb8,0xd0,0x68,0x68},
-{0xc3,0x82,0x41,0x41}, {0xb0,0x29,0x99,0x99}, {0x77,0x5a,0x2d,0x2d}, {0x11,0x1e,0x0f,0x0f},
-{0xcb,0x7b,0xb0,0xb0}, {0xfc,0xa8,0x54,0x54}, {0xd6,0x6d,0xbb,0xbb}, {0x3a,0x2c,0x16,0x16}
-	}
-};
-#define	T2	xT2.xt8
-
-static const union xtab xT3 = {
-	.xt8 = {
-{0x63,0xa5,0xc6,0x63}, {0x7c,0x84,0xf8,0x7c}, {0x77,0x99,0xee,0x77}, {0x7b,0x8d,0xf6,0x7b},
-{0xf2,0x0d,0xff,0xf2}, {0x6b,0xbd,0xd6,0x6b}, {0x6f,0xb1,0xde,0x6f}, {0xc5,0x54,0x91,0xc5},
-{0x30,0x50,0x60,0x30}, {0x01,0x03,0x02,0x01}, {0x67,0xa9,0xce,0x67}, {0x2b,0x7d,0x56,0x2b},
-{0xfe,0x19,0xe7,0xfe}, {0xd7,0x62,0xb5,0xd7}, {0xab,0xe6,0x4d,0xab}, {0x76,0x9a,0xec,0x76},
-{0xca,0x45,0x8f,0xca}, {0x82,0x9d,0x1f,0x82}, {0xc9,0x40,0x89,0xc9}, {0x7d,0x87,0xfa,0x7d},
-{0xfa,0x15,0xef,0xfa}, {0x59,0xeb,0xb2,0x59}, {0x47,0xc9,0x8e,0x47}, {0xf0,0x0b,0xfb,0xf0},
-{0xad,0xec,0x41,0xad}, {0xd4,0x67,0xb3,0xd4}, {0xa2,0xfd,0x5f,0xa2}, {0xaf,0xea,0x45,0xaf},
-{0x9c,0xbf,0x23,0x9c}, {0xa4,0xf7,0x53,0xa4}, {0x72,0x96,0xe4,0x72}, {0xc0,0x5b,0x9b,0xc0},
-{0xb7,0xc2,0x75,0xb7}, {0xfd,0x1c,0xe1,0xfd}, {0x93,0xae,0x3d,0x93}, {0x26,0x6a,0x4c,0x26},
-{0x36,0x5a,0x6c,0x36}, {0x3f,0x41,0x7e,0x3f}, {0xf7,0x02,0xf5,0xf7}, {0xcc,0x4f,0x83,0xcc},
-{0x34,0x5c,0x68,0x34}, {0xa5,0xf4,0x51,0xa5}, {0xe5,0x34,0xd1,0xe5}, {0xf1,0x08,0xf9,0xf1},
-{0x71,0x93,0xe2,0x71}, {0xd8,0x73,0xab,0xd8}, {0x31,0x53,0x62,0x31}, {0x15,0x3f,0x2a,0x15},
-{0x04,0x0c,0x08,0x04}, {0xc7,0x52,0x95,0xc7}, {0x23,0x65,0x46,0x23}, {0xc3,0x5e,0x9d,0xc3},
-{0x18,0x28,0x30,0x18}, {0x96,0xa1,0x37,0x96}, {0x05,0x0f,0x0a,0x05}, {0x9a,0xb5,0x2f,0x9a},
-{0x07,0x09,0x0e,0x07}, {0x12,0x36,0x24,0x12}, {0x80,0x9b,0x1b,0x80}, {0xe2,0x3d,0xdf,0xe2},
-{0xeb,0x26,0xcd,0xeb}, {0x27,0x69,0x4e,0x27}, {0xb2,0xcd,0x7f,0xb2}, {0x75,0x9f,0xea,0x75},
-{0x09,0x1b,0x12,0x09}, {0x83,0x9e,0x1d,0x83}, {0x2c,0x74,0x58,0x2c}, {0x1a,0x2e,0x34,0x1a},
-{0x1b,0x2d,0x36,0x1b}, {0x6e,0xb2,0xdc,0x6e}, {0x5a,0xee,0xb4,0x5a}, {0xa0,0xfb,0x5b,0xa0},
-{0x52,0xf6,0xa4,0x52}, {0x3b,0x4d,0x76,0x3b}, {0xd6,0x61,0xb7,0xd6}, {0xb3,0xce,0x7d,0xb3},
-{0x29,0x7b,0x52,0x29}, {0xe3,0x3e,0xdd,0xe3}, {0x2f,0x71,0x5e,0x2f}, {0x84,0x97,0x13,0x84},
-{0x53,0xf5,0xa6,0x53}, {0xd1,0x68,0xb9,0xd1}, {0x00,0x00,0x00,0x00}, {0xed,0x2c,0xc1,0xed},
-{0x20,0x60,0x40,0x20}, {0xfc,0x1f,0xe3,0xfc}, {0xb1,0xc8,0x79,0xb1}, {0x5b,0xed,0xb6,0x5b},
-{0x6a,0xbe,0xd4,0x6a}, {0xcb,0x46,0x8d,0xcb}, {0xbe,0xd9,0x67,0xbe}, {0x39,0x4b,0x72,0x39},
-{0x4a,0xde,0x94,0x4a}, {0x4c,0xd4,0x98,0x4c}, {0x58,0xe8,0xb0,0x58}, {0xcf,0x4a,0x85,0xcf},
-{0xd0,0x6b,0xbb,0xd0}, {0xef,0x2a,0xc5,0xef}, {0xaa,0xe5,0x4f,0xaa}, {0xfb,0x16,0xed,0xfb},
-{0x43,0xc5,0x86,0x43}, {0x4d,0xd7,0x9a,0x4d}, {0x33,0x55,0x66,0x33}, {0x85,0x94,0x11,0x85},
-{0x45,0xcf,0x8a,0x45}, {0xf9,0x10,0xe9,0xf9}, {0x02,0x06,0x04,0x02}, {0x7f,0x81,0xfe,0x7f},
-{0x50,0xf0,0xa0,0x50}, {0x3c,0x44,0x78,0x3c}, {0x9f,0xba,0x25,0x9f}, {0xa8,0xe3,0x4b,0xa8},
-{0x51,0xf3,0xa2,0x51}, {0xa3,0xfe,0x5d,0xa3}, {0x40,0xc0,0x80,0x40}, {0x8f,0x8a,0x05,0x8f},
-{0x92,0xad,0x3f,0x92}, {0x9d,0xbc,0x21,0x9d}, {0x38,0x48,0x70,0x38}, {0xf5,0x04,0xf1,0xf5},
-{0xbc,0xdf,0x63,0xbc}, {0xb6,0xc1,0x77,0xb6}, {0xda,0x75,0xaf,0xda}, {0x21,0x63,0x42,0x21},
-{0x10,0x30,0x20,0x10}, {0xff,0x1a,0xe5,0xff}, {0xf3,0x0e,0xfd,0xf3}, {0xd2,0x6d,0xbf,0xd2},
-{0xcd,0x4c,0x81,0xcd}, {0x0c,0x14,0x18,0x0c}, {0x13,0x35,0x26,0x13}, {0xec,0x2f,0xc3,0xec},
-{0x5f,0xe1,0xbe,0x5f}, {0x97,0xa2,0x35,0x97}, {0x44,0xcc,0x88,0x44}, {0x17,0x39,0x2e,0x17},
-{0xc4,0x57,0x93,0xc4}, {0xa7,0xf2,0x55,0xa7}, {0x7e,0x82,0xfc,0x7e}, {0x3d,0x47,0x7a,0x3d},
-{0x64,0xac,0xc8,0x64}, {0x5d,0xe7,0xba,0x5d}, {0x19,0x2b,0x32,0x19}, {0x73,0x95,0xe6,0x73},
-{0x60,0xa0,0xc0,0x60}, {0x81,0x98,0x19,0x81}, {0x4f,0xd1,0x9e,0x4f}, {0xdc,0x7f,0xa3,0xdc},
-{0x22,0x66,0x44,0x22}, {0x2a,0x7e,0x54,0x2a}, {0x90,0xab,0x3b,0x90}, {0x88,0x83,0x0b,0x88},
-{0x46,0xca,0x8c,0x46}, {0xee,0x29,0xc7,0xee}, {0xb8,0xd3,0x6b,0xb8}, {0x14,0x3c,0x28,0x14},
-{0xde,0x79,0xa7,0xde}, {0x5e,0xe2,0xbc,0x5e}, {0x0b,0x1d,0x16,0x0b}, {0xdb,0x76,0xad,0xdb},
-{0xe0,0x3b,0xdb,0xe0}, {0x32,0x56,0x64,0x32}, {0x3a,0x4e,0x74,0x3a}, {0x0a,0x1e,0x14,0x0a},
-{0x49,0xdb,0x92,0x49}, {0x06,0x0a,0x0c,0x06}, {0x24,0x6c,0x48,0x24}, {0x5c,0xe4,0xb8,0x5c},
-{0xc2,0x5d,0x9f,0xc2}, {0xd3,0x6e,0xbd,0xd3}, {0xac,0xef,0x43,0xac}, {0x62,0xa6,0xc4,0x62},
-{0x91,0xa8,0x39,0x91}, {0x95,0xa4,0x31,0x95}, {0xe4,0x37,0xd3,0xe4}, {0x79,0x8b,0xf2,0x79},
-{0xe7,0x32,0xd5,0xe7}, {0xc8,0x43,0x8b,0xc8}, {0x37,0x59,0x6e,0x37}, {0x6d,0xb7,0xda,0x6d},
-{0x8d,0x8c,0x01,0x8d}, {0xd5,0x64,0xb1,0xd5}, {0x4e,0xd2,0x9c,0x4e}, {0xa9,0xe0,0x49,0xa9},
-{0x6c,0xb4,0xd8,0x6c}, {0x56,0xfa,0xac,0x56}, {0xf4,0x07,0xf3,0xf4}, {0xea,0x25,0xcf,0xea},
-{0x65,0xaf,0xca,0x65}, {0x7a,0x8e,0xf4,0x7a}, {0xae,0xe9,0x47,0xae}, {0x08,0x18,0x10,0x08},
-{0xba,0xd5,0x6f,0xba}, {0x78,0x88,0xf0,0x78}, {0x25,0x6f,0x4a,0x25}, {0x2e,0x72,0x5c,0x2e},
-{0x1c,0x24,0x38,0x1c}, {0xa6,0xf1,0x57,0xa6}, {0xb4,0xc7,0x73,0xb4}, {0xc6,0x51,0x97,0xc6},
-{0xe8,0x23,0xcb,0xe8}, {0xdd,0x7c,0xa1,0xdd}, {0x74,0x9c,0xe8,0x74}, {0x1f,0x21,0x3e,0x1f},
-{0x4b,0xdd,0x96,0x4b}, {0xbd,0xdc,0x61,0xbd}, {0x8b,0x86,0x0d,0x8b}, {0x8a,0x85,0x0f,0x8a},
-{0x70,0x90,0xe0,0x70}, {0x3e,0x42,0x7c,0x3e}, {0xb5,0xc4,0x71,0xb5}, {0x66,0xaa,0xcc,0x66},
-{0x48,0xd8,0x90,0x48}, {0x03,0x05,0x06,0x03}, {0xf6,0x01,0xf7,0xf6}, {0x0e,0x12,0x1c,0x0e},
-{0x61,0xa3,0xc2,0x61}, {0x35,0x5f,0x6a,0x35}, {0x57,0xf9,0xae,0x57}, {0xb9,0xd0,0x69,0xb9},
-{0x86,0x91,0x17,0x86}, {0xc1,0x58,0x99,0xc1}, {0x1d,0x27,0x3a,0x1d}, {0x9e,0xb9,0x27,0x9e},
-{0xe1,0x38,0xd9,0xe1}, {0xf8,0x13,0xeb,0xf8}, {0x98,0xb3,0x2b,0x98}, {0x11,0x33,0x22,0x11},
-{0x69,0xbb,0xd2,0x69}, {0xd9,0x70,0xa9,0xd9}, {0x8e,0x89,0x07,0x8e}, {0x94,0xa7,0x33,0x94},
-{0x9b,0xb6,0x2d,0x9b}, {0x1e,0x22,0x3c,0x1e}, {0x87,0x92,0x15,0x87}, {0xe9,0x20,0xc9,0xe9},
-{0xce,0x49,0x87,0xce}, {0x55,0xff,0xaa,0x55}, {0x28,0x78,0x50,0x28}, {0xdf,0x7a,0xa5,0xdf},
-{0x8c,0x8f,0x03,0x8c}, {0xa1,0xf8,0x59,0xa1}, {0x89,0x80,0x09,0x89}, {0x0d,0x17,0x1a,0x0d},
-{0xbf,0xda,0x65,0xbf}, {0xe6,0x31,0xd7,0xe6}, {0x42,0xc6,0x84,0x42}, {0x68,0xb8,0xd0,0x68},
-{0x41,0xc3,0x82,0x41}, {0x99,0xb0,0x29,0x99}, {0x2d,0x77,0x5a,0x2d}, {0x0f,0x11,0x1e,0x0f},
-{0xb0,0xcb,0x7b,0xb0}, {0x54,0xfc,0xa8,0x54}, {0xbb,0xd6,0x6d,0xbb}, {0x16,0x3a,0x2c,0x16}
-	}
-};
-#define	T3	xT3.xt8
-
-static const union xtab xT4 = {
-	.xt8 = {
-{0x63,0x63,0xa5,0xc6}, {0x7c,0x7c,0x84,0xf8}, {0x77,0x77,0x99,0xee}, {0x7b,0x7b,0x8d,0xf6},
-{0xf2,0xf2,0x0d,0xff}, {0x6b,0x6b,0xbd,0xd6}, {0x6f,0x6f,0xb1,0xde}, {0xc5,0xc5,0x54,0x91},
-{0x30,0x30,0x50,0x60}, {0x01,0x01,0x03,0x02}, {0x67,0x67,0xa9,0xce}, {0x2b,0x2b,0x7d,0x56},
-{0xfe,0xfe,0x19,0xe7}, {0xd7,0xd7,0x62,0xb5}, {0xab,0xab,0xe6,0x4d}, {0x76,0x76,0x9a,0xec},
-{0xca,0xca,0x45,0x8f}, {0x82,0x82,0x9d,0x1f}, {0xc9,0xc9,0x40,0x89}, {0x7d,0x7d,0x87,0xfa},
-{0xfa,0xfa,0x15,0xef}, {0x59,0x59,0xeb,0xb2}, {0x47,0x47,0xc9,0x8e}, {0xf0,0xf0,0x0b,0xfb},
-{0xad,0xad,0xec,0x41}, {0xd4,0xd4,0x67,0xb3}, {0xa2,0xa2,0xfd,0x5f}, {0xaf,0xaf,0xea,0x45},
-{0x9c,0x9c,0xbf,0x23}, {0xa4,0xa4,0xf7,0x53}, {0x72,0x72,0x96,0xe4}, {0xc0,0xc0,0x5b,0x9b},
-{0xb7,0xb7,0xc2,0x75}, {0xfd,0xfd,0x1c,0xe1}, {0x93,0x93,0xae,0x3d}, {0x26,0x26,0x6a,0x4c},
-{0x36,0x36,0x5a,0x6c}, {0x3f,0x3f,0x41,0x7e}, {0xf7,0xf7,0x02,0xf5}, {0xcc,0xcc,0x4f,0x83},
-{0x34,0x34,0x5c,0x68}, {0xa5,0xa5,0xf4,0x51}, {0xe5,0xe5,0x34,0xd1}, {0xf1,0xf1,0x08,0xf9},
-{0x71,0x71,0x93,0xe2}, {0xd8,0xd8,0x73,0xab}, {0x31,0x31,0x53,0x62}, {0x15,0x15,0x3f,0x2a},
-{0x04,0x04,0x0c,0x08}, {0xc7,0xc7,0x52,0x95}, {0x23,0x23,0x65,0x46}, {0xc3,0xc3,0x5e,0x9d},
-{0x18,0x18,0x28,0x30}, {0x96,0x96,0xa1,0x37}, {0x05,0x05,0x0f,0x0a}, {0x9a,0x9a,0xb5,0x2f},
-{0x07,0x07,0x09,0x0e}, {0x12,0x12,0x36,0x24}, {0x80,0x80,0x9b,0x1b}, {0xe2,0xe2,0x3d,0xdf},
-{0xeb,0xeb,0x26,0xcd}, {0x27,0x27,0x69,0x4e}, {0xb2,0xb2,0xcd,0x7f}, {0x75,0x75,0x9f,0xea},
-{0x09,0x09,0x1b,0x12}, {0x83,0x83,0x9e,0x1d}, {0x2c,0x2c,0x74,0x58}, {0x1a,0x1a,0x2e,0x34},
-{0x1b,0x1b,0x2d,0x36}, {0x6e,0x6e,0xb2,0xdc}, {0x5a,0x5a,0xee,0xb4}, {0xa0,0xa0,0xfb,0x5b},
-{0x52,0x52,0xf6,0xa4}, {0x3b,0x3b,0x4d,0x76}, {0xd6,0xd6,0x61,0xb7}, {0xb3,0xb3,0xce,0x7d},
-{0x29,0x29,0x7b,0x52}, {0xe3,0xe3,0x3e,0xdd}, {0x2f,0x2f,0x71,0x5e}, {0x84,0x84,0x97,0x13},
-{0x53,0x53,0xf5,0xa6}, {0xd1,0xd1,0x68,0xb9}, {0x00,0x00,0x00,0x00}, {0xed,0xed,0x2c,0xc1},
-{0x20,0x20,0x60,0x40}, {0xfc,0xfc,0x1f,0xe3}, {0xb1,0xb1,0xc8,0x79}, {0x5b,0x5b,0xed,0xb6},
-{0x6a,0x6a,0xbe,0xd4}, {0xcb,0xcb,0x46,0x8d}, {0xbe,0xbe,0xd9,0x67}, {0x39,0x39,0x4b,0x72},
-{0x4a,0x4a,0xde,0x94}, {0x4c,0x4c,0xd4,0x98}, {0x58,0x58,0xe8,0xb0}, {0xcf,0xcf,0x4a,0x85},
-{0xd0,0xd0,0x6b,0xbb}, {0xef,0xef,0x2a,0xc5}, {0xaa,0xaa,0xe5,0x4f}, {0xfb,0xfb,0x16,0xed},
-{0x43,0x43,0xc5,0x86}, {0x4d,0x4d,0xd7,0x9a}, {0x33,0x33,0x55,0x66}, {0x85,0x85,0x94,0x11},
-{0x45,0x45,0xcf,0x8a}, {0xf9,0xf9,0x10,0xe9}, {0x02,0x02,0x06,0x04}, {0x7f,0x7f,0x81,0xfe},
-{0x50,0x50,0xf0,0xa0}, {0x3c,0x3c,0x44,0x78}, {0x9f,0x9f,0xba,0x25}, {0xa8,0xa8,0xe3,0x4b},
-{0x51,0x51,0xf3,0xa2}, {0xa3,0xa3,0xfe,0x5d}, {0x40,0x40,0xc0,0x80}, {0x8f,0x8f,0x8a,0x05},
-{0x92,0x92,0xad,0x3f}, {0x9d,0x9d,0xbc,0x21}, {0x38,0x38,0x48,0x70}, {0xf5,0xf5,0x04,0xf1},
-{0xbc,0xbc,0xdf,0x63}, {0xb6,0xb6,0xc1,0x77}, {0xda,0xda,0x75,0xaf}, {0x21,0x21,0x63,0x42},
-{0x10,0x10,0x30,0x20}, {0xff,0xff,0x1a,0xe5}, {0xf3,0xf3,0x0e,0xfd}, {0xd2,0xd2,0x6d,0xbf},
-{0xcd,0xcd,0x4c,0x81}, {0x0c,0x0c,0x14,0x18}, {0x13,0x13,0x35,0x26}, {0xec,0xec,0x2f,0xc3},
-{0x5f,0x5f,0xe1,0xbe}, {0x97,0x97,0xa2,0x35}, {0x44,0x44,0xcc,0x88}, {0x17,0x17,0x39,0x2e},
-{0xc4,0xc4,0x57,0x93}, {0xa7,0xa7,0xf2,0x55}, {0x7e,0x7e,0x82,0xfc}, {0x3d,0x3d,0x47,0x7a},
-{0x64,0x64,0xac,0xc8}, {0x5d,0x5d,0xe7,0xba}, {0x19,0x19,0x2b,0x32}, {0x73,0x73,0x95,0xe6},
-{0x60,0x60,0xa0,0xc0}, {0x81,0x81,0x98,0x19}, {0x4f,0x4f,0xd1,0x9e}, {0xdc,0xdc,0x7f,0xa3},
-{0x22,0x22,0x66,0x44}, {0x2a,0x2a,0x7e,0x54}, {0x90,0x90,0xab,0x3b}, {0x88,0x88,0x83,0x0b},
-{0x46,0x46,0xca,0x8c}, {0xee,0xee,0x29,0xc7}, {0xb8,0xb8,0xd3,0x6b}, {0x14,0x14,0x3c,0x28},
-{0xde,0xde,0x79,0xa7}, {0x5e,0x5e,0xe2,0xbc}, {0x0b,0x0b,0x1d,0x16}, {0xdb,0xdb,0x76,0xad},
-{0xe0,0xe0,0x3b,0xdb}, {0x32,0x32,0x56,0x64}, {0x3a,0x3a,0x4e,0x74}, {0x0a,0x0a,0x1e,0x14},
-{0x49,0x49,0xdb,0x92}, {0x06,0x06,0x0a,0x0c}, {0x24,0x24,0x6c,0x48}, {0x5c,0x5c,0xe4,0xb8},
-{0xc2,0xc2,0x5d,0x9f}, {0xd3,0xd3,0x6e,0xbd}, {0xac,0xac,0xef,0x43}, {0x62,0x62,0xa6,0xc4},
-{0x91,0x91,0xa8,0x39}, {0x95,0x95,0xa4,0x31}, {0xe4,0xe4,0x37,0xd3}, {0x79,0x79,0x8b,0xf2},
-{0xe7,0xe7,0x32,0xd5}, {0xc8,0xc8,0x43,0x8b}, {0x37,0x37,0x59,0x6e}, {0x6d,0x6d,0xb7,0xda},
-{0x8d,0x8d,0x8c,0x01}, {0xd5,0xd5,0x64,0xb1}, {0x4e,0x4e,0xd2,0x9c}, {0xa9,0xa9,0xe0,0x49},
-{0x6c,0x6c,0xb4,0xd8}, {0x56,0x56,0xfa,0xac}, {0xf4,0xf4,0x07,0xf3}, {0xea,0xea,0x25,0xcf},
-{0x65,0x65,0xaf,0xca}, {0x7a,0x7a,0x8e,0xf4}, {0xae,0xae,0xe9,0x47}, {0x08,0x08,0x18,0x10},
-{0xba,0xba,0xd5,0x6f}, {0x78,0x78,0x88,0xf0}, {0x25,0x25,0x6f,0x4a}, {0x2e,0x2e,0x72,0x5c},
-{0x1c,0x1c,0x24,0x38}, {0xa6,0xa6,0xf1,0x57}, {0xb4,0xb4,0xc7,0x73}, {0xc6,0xc6,0x51,0x97},
-{0xe8,0xe8,0x23,0xcb}, {0xdd,0xdd,0x7c,0xa1}, {0x74,0x74,0x9c,0xe8}, {0x1f,0x1f,0x21,0x3e},
-{0x4b,0x4b,0xdd,0x96}, {0xbd,0xbd,0xdc,0x61}, {0x8b,0x8b,0x86,0x0d}, {0x8a,0x8a,0x85,0x0f},
-{0x70,0x70,0x90,0xe0}, {0x3e,0x3e,0x42,0x7c}, {0xb5,0xb5,0xc4,0x71}, {0x66,0x66,0xaa,0xcc},
-{0x48,0x48,0xd8,0x90}, {0x03,0x03,0x05,0x06}, {0xf6,0xf6,0x01,0xf7}, {0x0e,0x0e,0x12,0x1c},
-{0x61,0x61,0xa3,0xc2}, {0x35,0x35,0x5f,0x6a}, {0x57,0x57,0xf9,0xae}, {0xb9,0xb9,0xd0,0x69},
-{0x86,0x86,0x91,0x17}, {0xc1,0xc1,0x58,0x99}, {0x1d,0x1d,0x27,0x3a}, {0x9e,0x9e,0xb9,0x27},
-{0xe1,0xe1,0x38,0xd9}, {0xf8,0xf8,0x13,0xeb}, {0x98,0x98,0xb3,0x2b}, {0x11,0x11,0x33,0x22},
-{0x69,0x69,0xbb,0xd2}, {0xd9,0xd9,0x70,0xa9}, {0x8e,0x8e,0x89,0x07}, {0x94,0x94,0xa7,0x33},
-{0x9b,0x9b,0xb6,0x2d}, {0x1e,0x1e,0x22,0x3c}, {0x87,0x87,0x92,0x15}, {0xe9,0xe9,0x20,0xc9},
-{0xce,0xce,0x49,0x87}, {0x55,0x55,0xff,0xaa}, {0x28,0x28,0x78,0x50}, {0xdf,0xdf,0x7a,0xa5},
-{0x8c,0x8c,0x8f,0x03}, {0xa1,0xa1,0xf8,0x59}, {0x89,0x89,0x80,0x09}, {0x0d,0x0d,0x17,0x1a},
-{0xbf,0xbf,0xda,0x65}, {0xe6,0xe6,0x31,0xd7}, {0x42,0x42,0xc6,0x84}, {0x68,0x68,0xb8,0xd0},
-{0x41,0x41,0xc3,0x82}, {0x99,0x99,0xb0,0x29}, {0x2d,0x2d,0x77,0x5a}, {0x0f,0x0f,0x11,0x1e},
-{0xb0,0xb0,0xcb,0x7b}, {0x54,0x54,0xfc,0xa8}, {0xbb,0xbb,0xd6,0x6d}, {0x16,0x16,0x3a,0x2c}
-	}
-};
-#define	T4	xT4.xt8
-
-static const union xtab xT5 = {
-	.xt8 = {
-{0x51,0xf4,0xa7,0x50}, {0x7e,0x41,0x65,0x53}, {0x1a,0x17,0xa4,0xc3}, {0x3a,0x27,0x5e,0x96},
-{0x3b,0xab,0x6b,0xcb}, {0x1f,0x9d,0x45,0xf1}, {0xac,0xfa,0x58,0xab}, {0x4b,0xe3,0x03,0x93},
-{0x20,0x30,0xfa,0x55}, {0xad,0x76,0x6d,0xf6}, {0x88,0xcc,0x76,0x91}, {0xf5,0x02,0x4c,0x25},
-{0x4f,0xe5,0xd7,0xfc}, {0xc5,0x2a,0xcb,0xd7}, {0x26,0x35,0x44,0x80}, {0xb5,0x62,0xa3,0x8f},
-{0xde,0xb1,0x5a,0x49}, {0x25,0xba,0x1b,0x67}, {0x45,0xea,0x0e,0x98}, {0x5d,0xfe,0xc0,0xe1},
-{0xc3,0x2f,0x75,0x02}, {0x81,0x4c,0xf0,0x12}, {0x8d,0x46,0x97,0xa3}, {0x6b,0xd3,0xf9,0xc6},
-{0x03,0x8f,0x5f,0xe7}, {0x15,0x92,0x9c,0x95}, {0xbf,0x6d,0x7a,0xeb}, {0x95,0x52,0x59,0xda},
-{0xd4,0xbe,0x83,0x2d}, {0x58,0x74,0x21,0xd3}, {0x49,0xe0,0x69,0x29}, {0x8e,0xc9,0xc8,0x44},
-{0x75,0xc2,0x89,0x6a}, {0xf4,0x8e,0x79,0x78}, {0x99,0x58,0x3e,0x6b}, {0x27,0xb9,0x71,0xdd},
-{0xbe,0xe1,0x4f,0xb6}, {0xf0,0x88,0xad,0x17}, {0xc9,0x20,0xac,0x66}, {0x7d,0xce,0x3a,0xb4},
-{0x63,0xdf,0x4a,0x18}, {0xe5,0x1a,0x31,0x82}, {0x97,0x51,0x33,0x60}, {0x62,0x53,0x7f,0x45},
-{0xb1,0x64,0x77,0xe0}, {0xbb,0x6b,0xae,0x84}, {0xfe,0x81,0xa0,0x1c}, {0xf9,0x08,0x2b,0x94},
-{0x70,0x48,0x68,0x58}, {0x8f,0x45,0xfd,0x19}, {0x94,0xde,0x6c,0x87}, {0x52,0x7b,0xf8,0xb7},
-{0xab,0x73,0xd3,0x23}, {0x72,0x4b,0x02,0xe2}, {0xe3,0x1f,0x8f,0x57}, {0x66,0x55,0xab,0x2a},
-{0xb2,0xeb,0x28,0x07}, {0x2f,0xb5,0xc2,0x03}, {0x86,0xc5,0x7b,0x9a}, {0xd3,0x37,0x08,0xa5},
-{0x30,0x28,0x87,0xf2}, {0x23,0xbf,0xa5,0xb2}, {0x02,0x03,0x6a,0xba}, {0xed,0x16,0x82,0x5c},
-{0x8a,0xcf,0x1c,0x2b}, {0xa7,0x79,0xb4,0x92}, {0xf3,0x07,0xf2,0xf0}, {0x4e,0x69,0xe2,0xa1},
-{0x65,0xda,0xf4,0xcd}, {0x06,0x05,0xbe,0xd5}, {0xd1,0x34,0x62,0x1f}, {0xc4,0xa6,0xfe,0x8a},
-{0x34,0x2e,0x53,0x9d}, {0xa2,0xf3,0x55,0xa0}, {0x05,0x8a,0xe1,0x32}, {0xa4,0xf6,0xeb,0x75},
-{0x0b,0x83,0xec,0x39}, {0x40,0x60,0xef,0xaa}, {0x5e,0x71,0x9f,0x06}, {0xbd,0x6e,0x10,0x51},
-{0x3e,0x21,0x8a,0xf9}, {0x96,0xdd,0x06,0x3d}, {0xdd,0x3e,0x05,0xae}, {0x4d,0xe6,0xbd,0x46},
-{0x91,0x54,0x8d,0xb5}, {0x71,0xc4,0x5d,0x05}, {0x04,0x06,0xd4,0x6f}, {0x60,0x50,0x15,0xff},
-{0x19,0x98,0xfb,0x24}, {0xd6,0xbd,0xe9,0x97}, {0x89,0x40,0x43,0xcc}, {0x67,0xd9,0x9e,0x77},
-{0xb0,0xe8,0x42,0xbd}, {0x07,0x89,0x8b,0x88}, {0xe7,0x19,0x5b,0x38}, {0x79,0xc8,0xee,0xdb},
-{0xa1,0x7c,0x0a,0x47}, {0x7c,0x42,0x0f,0xe9}, {0xf8,0x84,0x1e,0xc9}, {0x00,0x00,0x00,0x00},
-{0x09,0x80,0x86,0x83}, {0x32,0x2b,0xed,0x48}, {0x1e,0x11,0x70,0xac}, {0x6c,0x5a,0x72,0x4e},
-{0xfd,0x0e,0xff,0xfb}, {0x0f,0x85,0x38,0x56}, {0x3d,0xae,0xd5,0x1e}, {0x36,0x2d,0x39,0x27},
-{0x0a,0x0f,0xd9,0x64}, {0x68,0x5c,0xa6,0x21}, {0x9b,0x5b,0x54,0xd1}, {0x24,0x36,0x2e,0x3a},
-{0x0c,0x0a,0x67,0xb1}, {0x93,0x57,0xe7,0x0f}, {0xb4,0xee,0x96,0xd2}, {0x1b,0x9b,0x91,0x9e},
-{0x80,0xc0,0xc5,0x4f}, {0x61,0xdc,0x20,0xa2}, {0x5a,0x77,0x4b,0x69}, {0x1c,0x12,0x1a,0x16},
-{0xe2,0x93,0xba,0x0a}, {0xc0,0xa0,0x2a,0xe5}, {0x3c,0x22,0xe0,0x43}, {0x12,0x1b,0x17,0x1d},
-{0x0e,0x09,0x0d,0x0b}, {0xf2,0x8b,0xc7,0xad}, {0x2d,0xb6,0xa8,0xb9}, {0x14,0x1e,0xa9,0xc8},
-{0x57,0xf1,0x19,0x85}, {0xaf,0x75,0x07,0x4c}, {0xee,0x99,0xdd,0xbb}, {0xa3,0x7f,0x60,0xfd},
-{0xf7,0x01,0x26,0x9f}, {0x5c,0x72,0xf5,0xbc}, {0x44,0x66,0x3b,0xc5}, {0x5b,0xfb,0x7e,0x34},
-{0x8b,0x43,0x29,0x76}, {0xcb,0x23,0xc6,0xdc}, {0xb6,0xed,0xfc,0x68}, {0xb8,0xe4,0xf1,0x63},
-{0xd7,0x31,0xdc,0xca}, {0x42,0x63,0x85,0x10}, {0x13,0x97,0x22,0x40}, {0x84,0xc6,0x11,0x20},
-{0x85,0x4a,0x24,0x7d}, {0xd2,0xbb,0x3d,0xf8}, {0xae,0xf9,0x32,0x11}, {0xc7,0x29,0xa1,0x6d},
-{0x1d,0x9e,0x2f,0x4b}, {0xdc,0xb2,0x30,0xf3}, {0x0d,0x86,0x52,0xec}, {0x77,0xc1,0xe3,0xd0},
-{0x2b,0xb3,0x16,0x6c}, {0xa9,0x70,0xb9,0x99}, {0x11,0x94,0x48,0xfa}, {0x47,0xe9,0x64,0x22},
-{0xa8,0xfc,0x8c,0xc4}, {0xa0,0xf0,0x3f,0x1a}, {0x56,0x7d,0x2c,0xd8}, {0x22,0x33,0x90,0xef},
-{0x87,0x49,0x4e,0xc7}, {0xd9,0x38,0xd1,0xc1}, {0x8c,0xca,0xa2,0xfe}, {0x98,0xd4,0x0b,0x36},
-{0xa6,0xf5,0x81,0xcf}, {0xa5,0x7a,0xde,0x28}, {0xda,0xb7,0x8e,0x26}, {0x3f,0xad,0xbf,0xa4},
-{0x2c,0x3a,0x9d,0xe4}, {0x50,0x78,0x92,0x0d}, {0x6a,0x5f,0xcc,0x9b}, {0x54,0x7e,0x46,0x62},
-{0xf6,0x8d,0x13,0xc2}, {0x90,0xd8,0xb8,0xe8}, {0x2e,0x39,0xf7,0x5e}, {0x82,0xc3,0xaf,0xf5},
-{0x9f,0x5d,0x80,0xbe}, {0x69,0xd0,0x93,0x7c}, {0x6f,0xd5,0x2d,0xa9}, {0xcf,0x25,0x12,0xb3},
-{0xc8,0xac,0x99,0x3b}, {0x10,0x18,0x7d,0xa7}, {0xe8,0x9c,0x63,0x6e}, {0xdb,0x3b,0xbb,0x7b},
-{0xcd,0x26,0x78,0x09}, {0x6e,0x59,0x18,0xf4}, {0xec,0x9a,0xb7,0x01}, {0x83,0x4f,0x9a,0xa8},
-{0xe6,0x95,0x6e,0x65}, {0xaa,0xff,0xe6,0x7e}, {0x21,0xbc,0xcf,0x08}, {0xef,0x15,0xe8,0xe6},
-{0xba,0xe7,0x9b,0xd9}, {0x4a,0x6f,0x36,0xce}, {0xea,0x9f,0x09,0xd4}, {0x29,0xb0,0x7c,0xd6},
-{0x31,0xa4,0xb2,0xaf}, {0x2a,0x3f,0x23,0x31}, {0xc6,0xa5,0x94,0x30}, {0x35,0xa2,0x66,0xc0},
-{0x74,0x4e,0xbc,0x37}, {0xfc,0x82,0xca,0xa6}, {0xe0,0x90,0xd0,0xb0}, {0x33,0xa7,0xd8,0x15},
-{0xf1,0x04,0x98,0x4a}, {0x41,0xec,0xda,0xf7}, {0x7f,0xcd,0x50,0x0e}, {0x17,0x91,0xf6,0x2f},
-{0x76,0x4d,0xd6,0x8d}, {0x43,0xef,0xb0,0x4d}, {0xcc,0xaa,0x4d,0x54}, {0xe4,0x96,0x04,0xdf},
-{0x9e,0xd1,0xb5,0xe3}, {0x4c,0x6a,0x88,0x1b}, {0xc1,0x2c,0x1f,0xb8}, {0x46,0x65,0x51,0x7f},
-{0x9d,0x5e,0xea,0x04}, {0x01,0x8c,0x35,0x5d}, {0xfa,0x87,0x74,0x73}, {0xfb,0x0b,0x41,0x2e},
-{0xb3,0x67,0x1d,0x5a}, {0x92,0xdb,0xd2,0x52}, {0xe9,0x10,0x56,0x33}, {0x6d,0xd6,0x47,0x13},
-{0x9a,0xd7,0x61,0x8c}, {0x37,0xa1,0x0c,0x7a}, {0x59,0xf8,0x14,0x8e}, {0xeb,0x13,0x3c,0x89},
-{0xce,0xa9,0x27,0xee}, {0xb7,0x61,0xc9,0x35}, {0xe1,0x1c,0xe5,0xed}, {0x7a,0x47,0xb1,0x3c},
-{0x9c,0xd2,0xdf,0x59}, {0x55,0xf2,0x73,0x3f}, {0x18,0x14,0xce,0x79}, {0x73,0xc7,0x37,0xbf},
-{0x53,0xf7,0xcd,0xea}, {0x5f,0xfd,0xaa,0x5b}, {0xdf,0x3d,0x6f,0x14}, {0x78,0x44,0xdb,0x86},
-{0xca,0xaf,0xf3,0x81}, {0xb9,0x68,0xc4,0x3e}, {0x38,0x24,0x34,0x2c}, {0xc2,0xa3,0x40,0x5f},
-{0x16,0x1d,0xc3,0x72}, {0xbc,0xe2,0x25,0x0c}, {0x28,0x3c,0x49,0x8b}, {0xff,0x0d,0x95,0x41},
-{0x39,0xa8,0x01,0x71}, {0x08,0x0c,0xb3,0xde}, {0xd8,0xb4,0xe4,0x9c}, {0x64,0x56,0xc1,0x90},
-{0x7b,0xcb,0x84,0x61}, {0xd5,0x32,0xb6,0x70}, {0x48,0x6c,0x5c,0x74}, {0xd0,0xb8,0x57,0x42}
-	}
-};
-#define	T5	xT5.xt8
-
-static const union xtab xT6 = {
-	.xt8 = {
-{0x50,0x51,0xf4,0xa7}, {0x53,0x7e,0x41,0x65}, {0xc3,0x1a,0x17,0xa4}, {0x96,0x3a,0x27,0x5e},
-{0xcb,0x3b,0xab,0x6b}, {0xf1,0x1f,0x9d,0x45}, {0xab,0xac,0xfa,0x58}, {0x93,0x4b,0xe3,0x03},
-{0x55,0x20,0x30,0xfa}, {0xf6,0xad,0x76,0x6d}, {0x91,0x88,0xcc,0x76}, {0x25,0xf5,0x02,0x4c},
-{0xfc,0x4f,0xe5,0xd7}, {0xd7,0xc5,0x2a,0xcb}, {0x80,0x26,0x35,0x44}, {0x8f,0xb5,0x62,0xa3},
-{0x49,0xde,0xb1,0x5a}, {0x67,0x25,0xba,0x1b}, {0x98,0x45,0xea,0x0e}, {0xe1,0x5d,0xfe,0xc0},
-{0x02,0xc3,0x2f,0x75}, {0x12,0x81,0x4c,0xf0}, {0xa3,0x8d,0x46,0x97}, {0xc6,0x6b,0xd3,0xf9},
-{0xe7,0x03,0x8f,0x5f}, {0x95,0x15,0x92,0x9c}, {0xeb,0xbf,0x6d,0x7a}, {0xda,0x95,0x52,0x59},
-{0x2d,0xd4,0xbe,0x83}, {0xd3,0x58,0x74,0x21}, {0x29,0x49,0xe0,0x69}, {0x44,0x8e,0xc9,0xc8},
-{0x6a,0x75,0xc2,0x89}, {0x78,0xf4,0x8e,0x79}, {0x6b,0x99,0x58,0x3e}, {0xdd,0x27,0xb9,0x71},
-{0xb6,0xbe,0xe1,0x4f}, {0x17,0xf0,0x88,0xad}, {0x66,0xc9,0x20,0xac}, {0xb4,0x7d,0xce,0x3a},
-{0x18,0x63,0xdf,0x4a}, {0x82,0xe5,0x1a,0x31}, {0x60,0x97,0x51,0x33}, {0x45,0x62,0x53,0x7f},
-{0xe0,0xb1,0x64,0x77}, {0x84,0xbb,0x6b,0xae}, {0x1c,0xfe,0x81,0xa0}, {0x94,0xf9,0x08,0x2b},
-{0x58,0x70,0x48,0x68}, {0x19,0x8f,0x45,0xfd}, {0x87,0x94,0xde,0x6c}, {0xb7,0x52,0x7b,0xf8},
-{0x23,0xab,0x73,0xd3}, {0xe2,0x72,0x4b,0x02}, {0x57,0xe3,0x1f,0x8f}, {0x2a,0x66,0x55,0xab},
-{0x07,0xb2,0xeb,0x28}, {0x03,0x2f,0xb5,0xc2}, {0x9a,0x86,0xc5,0x7b}, {0xa5,0xd3,0x37,0x08},
-{0xf2,0x30,0x28,0x87}, {0xb2,0x23,0xbf,0xa5}, {0xba,0x02,0x03,0x6a}, {0x5c,0xed,0x16,0x82},
-{0x2b,0x8a,0xcf,0x1c}, {0x92,0xa7,0x79,0xb4}, {0xf0,0xf3,0x07,0xf2}, {0xa1,0x4e,0x69,0xe2},
-{0xcd,0x65,0xda,0xf4}, {0xd5,0x06,0x05,0xbe}, {0x1f,0xd1,0x34,0x62}, {0x8a,0xc4,0xa6,0xfe},
-{0x9d,0x34,0x2e,0x53}, {0xa0,0xa2,0xf3,0x55}, {0x32,0x05,0x8a,0xe1}, {0x75,0xa4,0xf6,0xeb},
-{0x39,0x0b,0x83,0xec}, {0xaa,0x40,0x60,0xef}, {0x06,0x5e,0x71,0x9f}, {0x51,0xbd,0x6e,0x10},
-{0xf9,0x3e,0x21,0x8a}, {0x3d,0x96,0xdd,0x06}, {0xae,0xdd,0x3e,0x05}, {0x46,0x4d,0xe6,0xbd},
-{0xb5,0x91,0x54,0x8d}, {0x05,0x71,0xc4,0x5d}, {0x6f,0x04,0x06,0xd4}, {0xff,0x60,0x50,0x15},
-{0x24,0x19,0x98,0xfb}, {0x97,0xd6,0xbd,0xe9}, {0xcc,0x89,0x40,0x43}, {0x77,0x67,0xd9,0x9e},
-{0xbd,0xb0,0xe8,0x42}, {0x88,0x07,0x89,0x8b}, {0x38,0xe7,0x19,0x5b}, {0xdb,0x79,0xc8,0xee},
-{0x47,0xa1,0x7c,0x0a}, {0xe9,0x7c,0x42,0x0f}, {0xc9,0xf8,0x84,0x1e}, {0x00,0x00,0x00,0x00},
-{0x83,0x09,0x80,0x86}, {0x48,0x32,0x2b,0xed}, {0xac,0x1e,0x11,0x70}, {0x4e,0x6c,0x5a,0x72},
-{0xfb,0xfd,0x0e,0xff}, {0x56,0x0f,0x85,0x38}, {0x1e,0x3d,0xae,0xd5}, {0x27,0x36,0x2d,0x39},
-{0x64,0x0a,0x0f,0xd9}, {0x21,0x68,0x5c,0xa6}, {0xd1,0x9b,0x5b,0x54}, {0x3a,0x24,0x36,0x2e},
-{0xb1,0x0c,0x0a,0x67}, {0x0f,0x93,0x57,0xe7}, {0xd2,0xb4,0xee,0x96}, {0x9e,0x1b,0x9b,0x91},
-{0x4f,0x80,0xc0,0xc5}, {0xa2,0x61,0xdc,0x20}, {0x69,0x5a,0x77,0x4b}, {0x16,0x1c,0x12,0x1a},
-{0x0a,0xe2,0x93,0xba}, {0xe5,0xc0,0xa0,0x2a}, {0x43,0x3c,0x22,0xe0}, {0x1d,0x12,0x1b,0x17},
-{0x0b,0x0e,0x09,0x0d}, {0xad,0xf2,0x8b,0xc7}, {0xb9,0x2d,0xb6,0xa8}, {0xc8,0x14,0x1e,0xa9},
-{0x85,0x57,0xf1,0x19}, {0x4c,0xaf,0x75,0x07}, {0xbb,0xee,0x99,0xdd}, {0xfd,0xa3,0x7f,0x60},
-{0x9f,0xf7,0x01,0x26}, {0xbc,0x5c,0x72,0xf5}, {0xc5,0x44,0x66,0x3b}, {0x34,0x5b,0xfb,0x7e},
-{0x76,0x8b,0x43,0x29}, {0xdc,0xcb,0x23,0xc6}, {0x68,0xb6,0xed,0xfc}, {0x63,0xb8,0xe4,0xf1},
-{0xca,0xd7,0x31,0xdc}, {0x10,0x42,0x63,0x85}, {0x40,0x13,0x97,0x22}, {0x20,0x84,0xc6,0x11},
-{0x7d,0x85,0x4a,0x24}, {0xf8,0xd2,0xbb,0x3d}, {0x11,0xae,0xf9,0x32}, {0x6d,0xc7,0x29,0xa1},
-{0x4b,0x1d,0x9e,0x2f}, {0xf3,0xdc,0xb2,0x30}, {0xec,0x0d,0x86,0x52}, {0xd0,0x77,0xc1,0xe3},
-{0x6c,0x2b,0xb3,0x16}, {0x99,0xa9,0x70,0xb9}, {0xfa,0x11,0x94,0x48}, {0x22,0x47,0xe9,0x64},
-{0xc4,0xa8,0xfc,0x8c}, {0x1a,0xa0,0xf0,0x3f}, {0xd8,0x56,0x7d,0x2c}, {0xef,0x22,0x33,0x90},
-{0xc7,0x87,0x49,0x4e}, {0xc1,0xd9,0x38,0xd1}, {0xfe,0x8c,0xca,0xa2}, {0x36,0x98,0xd4,0x0b},
-{0xcf,0xa6,0xf5,0x81}, {0x28,0xa5,0x7a,0xde}, {0x26,0xda,0xb7,0x8e}, {0xa4,0x3f,0xad,0xbf},
-{0xe4,0x2c,0x3a,0x9d}, {0x0d,0x50,0x78,0x92}, {0x9b,0x6a,0x5f,0xcc}, {0x62,0x54,0x7e,0x46},
-{0xc2,0xf6,0x8d,0x13}, {0xe8,0x90,0xd8,0xb8}, {0x5e,0x2e,0x39,0xf7}, {0xf5,0x82,0xc3,0xaf},
-{0xbe,0x9f,0x5d,0x80}, {0x7c,0x69,0xd0,0x93}, {0xa9,0x6f,0xd5,0x2d}, {0xb3,0xcf,0x25,0x12},
-{0x3b,0xc8,0xac,0x99}, {0xa7,0x10,0x18,0x7d}, {0x6e,0xe8,0x9c,0x63}, {0x7b,0xdb,0x3b,0xbb},
-{0x09,0xcd,0x26,0x78}, {0xf4,0x6e,0x59,0x18}, {0x01,0xec,0x9a,0xb7}, {0xa8,0x83,0x4f,0x9a},
-{0x65,0xe6,0x95,0x6e}, {0x7e,0xaa,0xff,0xe6}, {0x08,0x21,0xbc,0xcf}, {0xe6,0xef,0x15,0xe8},
-{0xd9,0xba,0xe7,0x9b}, {0xce,0x4a,0x6f,0x36}, {0xd4,0xea,0x9f,0x09}, {0xd6,0x29,0xb0,0x7c},
-{0xaf,0x31,0xa4,0xb2}, {0x31,0x2a,0x3f,0x23}, {0x30,0xc6,0xa5,0x94}, {0xc0,0x35,0xa2,0x66},
-{0x37,0x74,0x4e,0xbc}, {0xa6,0xfc,0x82,0xca}, {0xb0,0xe0,0x90,0xd0}, {0x15,0x33,0xa7,0xd8},
-{0x4a,0xf1,0x04,0x98}, {0xf7,0x41,0xec,0xda}, {0x0e,0x7f,0xcd,0x50}, {0x2f,0x17,0x91,0xf6},
-{0x8d,0x76,0x4d,0xd6}, {0x4d,0x43,0xef,0xb0}, {0x54,0xcc,0xaa,0x4d}, {0xdf,0xe4,0x96,0x04},
-{0xe3,0x9e,0xd1,0xb5}, {0x1b,0x4c,0x6a,0x88}, {0xb8,0xc1,0x2c,0x1f}, {0x7f,0x46,0x65,0x51},
-{0x04,0x9d,0x5e,0xea}, {0x5d,0x01,0x8c,0x35}, {0x73,0xfa,0x87,0x74}, {0x2e,0xfb,0x0b,0x41},
-{0x5a,0xb3,0x67,0x1d}, {0x52,0x92,0xdb,0xd2}, {0x33,0xe9,0x10,0x56}, {0x13,0x6d,0xd6,0x47},
-{0x8c,0x9a,0xd7,0x61}, {0x7a,0x37,0xa1,0x0c}, {0x8e,0x59,0xf8,0x14}, {0x89,0xeb,0x13,0x3c},
-{0xee,0xce,0xa9,0x27}, {0x35,0xb7,0x61,0xc9}, {0xed,0xe1,0x1c,0xe5}, {0x3c,0x7a,0x47,0xb1},
-{0x59,0x9c,0xd2,0xdf}, {0x3f,0x55,0xf2,0x73}, {0x79,0x18,0x14,0xce}, {0xbf,0x73,0xc7,0x37},
-{0xea,0x53,0xf7,0xcd}, {0x5b,0x5f,0xfd,0xaa}, {0x14,0xdf,0x3d,0x6f}, {0x86,0x78,0x44,0xdb},
-{0x81,0xca,0xaf,0xf3}, {0x3e,0xb9,0x68,0xc4}, {0x2c,0x38,0x24,0x34}, {0x5f,0xc2,0xa3,0x40},
-{0x72,0x16,0x1d,0xc3}, {0x0c,0xbc,0xe2,0x25}, {0x8b,0x28,0x3c,0x49}, {0x41,0xff,0x0d,0x95},
-{0x71,0x39,0xa8,0x01}, {0xde,0x08,0x0c,0xb3}, {0x9c,0xd8,0xb4,0xe4}, {0x90,0x64,0x56,0xc1},
-{0x61,0x7b,0xcb,0x84}, {0x70,0xd5,0x32,0xb6}, {0x74,0x48,0x6c,0x5c}, {0x42,0xd0,0xb8,0x57}
-	}
-};
-#define	T6	xT6.xt8
-
-static const union xtab xT7 = {
-	.xt8 = {
-{0xa7,0x50,0x51,0xf4}, {0x65,0x53,0x7e,0x41}, {0xa4,0xc3,0x1a,0x17}, {0x5e,0x96,0x3a,0x27},
-{0x6b,0xcb,0x3b,0xab}, {0x45,0xf1,0x1f,0x9d}, {0x58,0xab,0xac,0xfa}, {0x03,0x93,0x4b,0xe3},
-{0xfa,0x55,0x20,0x30}, {0x6d,0xf6,0xad,0x76}, {0x76,0x91,0x88,0xcc}, {0x4c,0x25,0xf5,0x02},
-{0xd7,0xfc,0x4f,0xe5}, {0xcb,0xd7,0xc5,0x2a}, {0x44,0x80,0x26,0x35}, {0xa3,0x8f,0xb5,0x62},
-{0x5a,0x49,0xde,0xb1}, {0x1b,0x67,0x25,0xba}, {0x0e,0x98,0x45,0xea}, {0xc0,0xe1,0x5d,0xfe},
-{0x75,0x02,0xc3,0x2f}, {0xf0,0x12,0x81,0x4c}, {0x97,0xa3,0x8d,0x46}, {0xf9,0xc6,0x6b,0xd3},
-{0x5f,0xe7,0x03,0x8f}, {0x9c,0x95,0x15,0x92}, {0x7a,0xeb,0xbf,0x6d}, {0x59,0xda,0x95,0x52},
-{0x83,0x2d,0xd4,0xbe}, {0x21,0xd3,0x58,0x74}, {0x69,0x29,0x49,0xe0}, {0xc8,0x44,0x8e,0xc9},
-{0x89,0x6a,0x75,0xc2}, {0x79,0x78,0xf4,0x8e}, {0x3e,0x6b,0x99,0x58}, {0x71,0xdd,0x27,0xb9},
-{0x4f,0xb6,0xbe,0xe1}, {0xad,0x17,0xf0,0x88}, {0xac,0x66,0xc9,0x20}, {0x3a,0xb4,0x7d,0xce},
-{0x4a,0x18,0x63,0xdf}, {0x31,0x82,0xe5,0x1a}, {0x33,0x60,0x97,0x51}, {0x7f,0x45,0x62,0x53},
-{0x77,0xe0,0xb1,0x64}, {0xae,0x84,0xbb,0x6b}, {0xa0,0x1c,0xfe,0x81}, {0x2b,0x94,0xf9,0x08},
-{0x68,0x58,0x70,0x48}, {0xfd,0x19,0x8f,0x45}, {0x6c,0x87,0x94,0xde}, {0xf8,0xb7,0x52,0x7b},
-{0xd3,0x23,0xab,0x73}, {0x02,0xe2,0x72,0x4b}, {0x8f,0x57,0xe3,0x1f}, {0xab,0x2a,0x66,0x55},
-{0x28,0x07,0xb2,0xeb}, {0xc2,0x03,0x2f,0xb5}, {0x7b,0x9a,0x86,0xc5}, {0x08,0xa5,0xd3,0x37},
-{0x87,0xf2,0x30,0x28}, {0xa5,0xb2,0x23,0xbf}, {0x6a,0xba,0x02,0x03}, {0x82,0x5c,0xed,0x16},
-{0x1c,0x2b,0x8a,0xcf}, {0xb4,0x92,0xa7,0x79}, {0xf2,0xf0,0xf3,0x07}, {0xe2,0xa1,0x4e,0x69},
-{0xf4,0xcd,0x65,0xda}, {0xbe,0xd5,0x06,0x05}, {0x62,0x1f,0xd1,0x34}, {0xfe,0x8a,0xc4,0xa6},
-{0x53,0x9d,0x34,0x2e}, {0x55,0xa0,0xa2,0xf3}, {0xe1,0x32,0x05,0x8a}, {0xeb,0x75,0xa4,0xf6},
-{0xec,0x39,0x0b,0x83}, {0xef,0xaa,0x40,0x60}, {0x9f,0x06,0x5e,0x71}, {0x10,0x51,0xbd,0x6e},
-{0x8a,0xf9,0x3e,0x21}, {0x06,0x3d,0x96,0xdd}, {0x05,0xae,0xdd,0x3e}, {0xbd,0x46,0x4d,0xe6},
-{0x8d,0xb5,0x91,0x54}, {0x5d,0x05,0x71,0xc4}, {0xd4,0x6f,0x04,0x06}, {0x15,0xff,0x60,0x50},
-{0xfb,0x24,0x19,0x98}, {0xe9,0x97,0xd6,0xbd}, {0x43,0xcc,0x89,0x40}, {0x9e,0x77,0x67,0xd9},
-{0x42,0xbd,0xb0,0xe8}, {0x8b,0x88,0x07,0x89}, {0x5b,0x38,0xe7,0x19}, {0xee,0xdb,0x79,0xc8},
-{0x0a,0x47,0xa1,0x7c}, {0x0f,0xe9,0x7c,0x42}, {0x1e,0xc9,0xf8,0x84}, {0x00,0x00,0x00,0x00},
-{0x86,0x83,0x09,0x80}, {0xed,0x48,0x32,0x2b}, {0x70,0xac,0x1e,0x11}, {0x72,0x4e,0x6c,0x5a},
-{0xff,0xfb,0xfd,0x0e}, {0x38,0x56,0x0f,0x85}, {0xd5,0x1e,0x3d,0xae}, {0x39,0x27,0x36,0x2d},
-{0xd9,0x64,0x0a,0x0f}, {0xa6,0x21,0x68,0x5c}, {0x54,0xd1,0x9b,0x5b}, {0x2e,0x3a,0x24,0x36},
-{0x67,0xb1,0x0c,0x0a}, {0xe7,0x0f,0x93,0x57}, {0x96,0xd2,0xb4,0xee}, {0x91,0x9e,0x1b,0x9b},
-{0xc5,0x4f,0x80,0xc0}, {0x20,0xa2,0x61,0xdc}, {0x4b,0x69,0x5a,0x77}, {0x1a,0x16,0x1c,0x12},
-{0xba,0x0a,0xe2,0x93}, {0x2a,0xe5,0xc0,0xa0}, {0xe0,0x43,0x3c,0x22}, {0x17,0x1d,0x12,0x1b},
-{0x0d,0x0b,0x0e,0x09}, {0xc7,0xad,0xf2,0x8b}, {0xa8,0xb9,0x2d,0xb6}, {0xa9,0xc8,0x14,0x1e},
-{0x19,0x85,0x57,0xf1}, {0x07,0x4c,0xaf,0x75}, {0xdd,0xbb,0xee,0x99}, {0x60,0xfd,0xa3,0x7f},
-{0x26,0x9f,0xf7,0x01}, {0xf5,0xbc,0x5c,0x72}, {0x3b,0xc5,0x44,0x66}, {0x7e,0x34,0x5b,0xfb},
-{0x29,0x76,0x8b,0x43}, {0xc6,0xdc,0xcb,0x23}, {0xfc,0x68,0xb6,0xed}, {0xf1,0x63,0xb8,0xe4},
-{0xdc,0xca,0xd7,0x31}, {0x85,0x10,0x42,0x63}, {0x22,0x40,0x13,0x97}, {0x11,0x20,0x84,0xc6},
-{0x24,0x7d,0x85,0x4a}, {0x3d,0xf8,0xd2,0xbb}, {0x32,0x11,0xae,0xf9}, {0xa1,0x6d,0xc7,0x29},
-{0x2f,0x4b,0x1d,0x9e}, {0x30,0xf3,0xdc,0xb2}, {0x52,0xec,0x0d,0x86}, {0xe3,0xd0,0x77,0xc1},
-{0x16,0x6c,0x2b,0xb3}, {0xb9,0x99,0xa9,0x70}, {0x48,0xfa,0x11,0x94}, {0x64,0x22,0x47,0xe9},
-{0x8c,0xc4,0xa8,0xfc}, {0x3f,0x1a,0xa0,0xf0}, {0x2c,0xd8,0x56,0x7d}, {0x90,0xef,0x22,0x33},
-{0x4e,0xc7,0x87,0x49}, {0xd1,0xc1,0xd9,0x38}, {0xa2,0xfe,0x8c,0xca}, {0x0b,0x36,0x98,0xd4},
-{0x81,0xcf,0xa6,0xf5}, {0xde,0x28,0xa5,0x7a}, {0x8e,0x26,0xda,0xb7}, {0xbf,0xa4,0x3f,0xad},
-{0x9d,0xe4,0x2c,0x3a}, {0x92,0x0d,0x50,0x78}, {0xcc,0x9b,0x6a,0x5f}, {0x46,0x62,0x54,0x7e},
-{0x13,0xc2,0xf6,0x8d}, {0xb8,0xe8,0x90,0xd8}, {0xf7,0x5e,0x2e,0x39}, {0xaf,0xf5,0x82,0xc3},
-{0x80,0xbe,0x9f,0x5d}, {0x93,0x7c,0x69,0xd0}, {0x2d,0xa9,0x6f,0xd5}, {0x12,0xb3,0xcf,0x25},
-{0x99,0x3b,0xc8,0xac}, {0x7d,0xa7,0x10,0x18}, {0x63,0x6e,0xe8,0x9c}, {0xbb,0x7b,0xdb,0x3b},
-{0x78,0x09,0xcd,0x26}, {0x18,0xf4,0x6e,0x59}, {0xb7,0x01,0xec,0x9a}, {0x9a,0xa8,0x83,0x4f},
-{0x6e,0x65,0xe6,0x95}, {0xe6,0x7e,0xaa,0xff}, {0xcf,0x08,0x21,0xbc}, {0xe8,0xe6,0xef,0x15},
-{0x9b,0xd9,0xba,0xe7}, {0x36,0xce,0x4a,0x6f}, {0x09,0xd4,0xea,0x9f}, {0x7c,0xd6,0x29,0xb0},
-{0xb2,0xaf,0x31,0xa4}, {0x23,0x31,0x2a,0x3f}, {0x94,0x30,0xc6,0xa5}, {0x66,0xc0,0x35,0xa2},
-{0xbc,0x37,0x74,0x4e}, {0xca,0xa6,0xfc,0x82}, {0xd0,0xb0,0xe0,0x90}, {0xd8,0x15,0x33,0xa7},
-{0x98,0x4a,0xf1,0x04}, {0xda,0xf7,0x41,0xec}, {0x50,0x0e,0x7f,0xcd}, {0xf6,0x2f,0x17,0x91},
-{0xd6,0x8d,0x76,0x4d}, {0xb0,0x4d,0x43,0xef}, {0x4d,0x54,0xcc,0xaa}, {0x04,0xdf,0xe4,0x96},
-{0xb5,0xe3,0x9e,0xd1}, {0x88,0x1b,0x4c,0x6a}, {0x1f,0xb8,0xc1,0x2c}, {0x51,0x7f,0x46,0x65},
-{0xea,0x04,0x9d,0x5e}, {0x35,0x5d,0x01,0x8c}, {0x74,0x73,0xfa,0x87}, {0x41,0x2e,0xfb,0x0b},
-{0x1d,0x5a,0xb3,0x67}, {0xd2,0x52,0x92,0xdb}, {0x56,0x33,0xe9,0x10}, {0x47,0x13,0x6d,0xd6},
-{0x61,0x8c,0x9a,0xd7}, {0x0c,0x7a,0x37,0xa1}, {0x14,0x8e,0x59,0xf8}, {0x3c,0x89,0xeb,0x13},
-{0x27,0xee,0xce,0xa9}, {0xc9,0x35,0xb7,0x61}, {0xe5,0xed,0xe1,0x1c}, {0xb1,0x3c,0x7a,0x47},
-{0xdf,0x59,0x9c,0xd2}, {0x73,0x3f,0x55,0xf2}, {0xce,0x79,0x18,0x14}, {0x37,0xbf,0x73,0xc7},
-{0xcd,0xea,0x53,0xf7}, {0xaa,0x5b,0x5f,0xfd}, {0x6f,0x14,0xdf,0x3d}, {0xdb,0x86,0x78,0x44},
-{0xf3,0x81,0xca,0xaf}, {0xc4,0x3e,0xb9,0x68}, {0x34,0x2c,0x38,0x24}, {0x40,0x5f,0xc2,0xa3},
-{0xc3,0x72,0x16,0x1d}, {0x25,0x0c,0xbc,0xe2}, {0x49,0x8b,0x28,0x3c}, {0x95,0x41,0xff,0x0d},
-{0x01,0x71,0x39,0xa8}, {0xb3,0xde,0x08,0x0c}, {0xe4,0x9c,0xd8,0xb4}, {0xc1,0x90,0x64,0x56},
-{0x84,0x61,0x7b,0xcb}, {0xb6,0x70,0xd5,0x32}, {0x5c,0x74,0x48,0x6c}, {0x57,0x42,0xd0,0xb8}
-	}
-};
-#define	T7	xT7.xt8
-
-static const union xtab xT8 = {
-	.xt8 = {
-{0xf4,0xa7,0x50,0x51}, {0x41,0x65,0x53,0x7e}, {0x17,0xa4,0xc3,0x1a}, {0x27,0x5e,0x96,0x3a},
-{0xab,0x6b,0xcb,0x3b}, {0x9d,0x45,0xf1,0x1f}, {0xfa,0x58,0xab,0xac}, {0xe3,0x03,0x93,0x4b},
-{0x30,0xfa,0x55,0x20}, {0x76,0x6d,0xf6,0xad}, {0xcc,0x76,0x91,0x88}, {0x02,0x4c,0x25,0xf5},
-{0xe5,0xd7,0xfc,0x4f}, {0x2a,0xcb,0xd7,0xc5}, {0x35,0x44,0x80,0x26}, {0x62,0xa3,0x8f,0xb5},
-{0xb1,0x5a,0x49,0xde}, {0xba,0x1b,0x67,0x25}, {0xea,0x0e,0x98,0x45}, {0xfe,0xc0,0xe1,0x5d},
-{0x2f,0x75,0x02,0xc3}, {0x4c,0xf0,0x12,0x81}, {0x46,0x97,0xa3,0x8d}, {0xd3,0xf9,0xc6,0x6b},
-{0x8f,0x5f,0xe7,0x03}, {0x92,0x9c,0x95,0x15}, {0x6d,0x7a,0xeb,0xbf}, {0x52,0x59,0xda,0x95},
-{0xbe,0x83,0x2d,0xd4}, {0x74,0x21,0xd3,0x58}, {0xe0,0x69,0x29,0x49}, {0xc9,0xc8,0x44,0x8e},
-{0xc2,0x89,0x6a,0x75}, {0x8e,0x79,0x78,0xf4}, {0x58,0x3e,0x6b,0x99}, {0xb9,0x71,0xdd,0x27},
-{0xe1,0x4f,0xb6,0xbe}, {0x88,0xad,0x17,0xf0}, {0x20,0xac,0x66,0xc9}, {0xce,0x3a,0xb4,0x7d},
-{0xdf,0x4a,0x18,0x63}, {0x1a,0x31,0x82,0xe5}, {0x51,0x33,0x60,0x97}, {0x53,0x7f,0x45,0x62},
-{0x64,0x77,0xe0,0xb1}, {0x6b,0xae,0x84,0xbb}, {0x81,0xa0,0x1c,0xfe}, {0x08,0x2b,0x94,0xf9},
-{0x48,0x68,0x58,0x70}, {0x45,0xfd,0x19,0x8f}, {0xde,0x6c,0x87,0x94}, {0x7b,0xf8,0xb7,0x52},
-{0x73,0xd3,0x23,0xab}, {0x4b,0x02,0xe2,0x72}, {0x1f,0x8f,0x57,0xe3}, {0x55,0xab,0x2a,0x66},
-{0xeb,0x28,0x07,0xb2}, {0xb5,0xc2,0x03,0x2f}, {0xc5,0x7b,0x9a,0x86}, {0x37,0x08,0xa5,0xd3},
-{0x28,0x87,0xf2,0x30}, {0xbf,0xa5,0xb2,0x23}, {0x03,0x6a,0xba,0x02}, {0x16,0x82,0x5c,0xed},
-{0xcf,0x1c,0x2b,0x8a}, {0x79,0xb4,0x92,0xa7}, {0x07,0xf2,0xf0,0xf3}, {0x69,0xe2,0xa1,0x4e},
-{0xda,0xf4,0xcd,0x65}, {0x05,0xbe,0xd5,0x06}, {0x34,0x62,0x1f,0xd1}, {0xa6,0xfe,0x8a,0xc4},
-{0x2e,0x53,0x9d,0x34}, {0xf3,0x55,0xa0,0xa2}, {0x8a,0xe1,0x32,0x05}, {0xf6,0xeb,0x75,0xa4},
-{0x83,0xec,0x39,0x0b}, {0x60,0xef,0xaa,0x40}, {0x71,0x9f,0x06,0x5e}, {0x6e,0x10,0x51,0xbd},
-{0x21,0x8a,0xf9,0x3e}, {0xdd,0x06,0x3d,0x96}, {0x3e,0x05,0xae,0xdd}, {0xe6,0xbd,0x46,0x4d},
-{0x54,0x8d,0xb5,0x91}, {0xc4,0x5d,0x05,0x71}, {0x06,0xd4,0x6f,0x04}, {0x50,0x15,0xff,0x60},
-{0x98,0xfb,0x24,0x19}, {0xbd,0xe9,0x97,0xd6}, {0x40,0x43,0xcc,0x89}, {0xd9,0x9e,0x77,0x67},
-{0xe8,0x42,0xbd,0xb0}, {0x89,0x8b,0x88,0x07}, {0x19,0x5b,0x38,0xe7}, {0xc8,0xee,0xdb,0x79},
-{0x7c,0x0a,0x47,0xa1}, {0x42,0x0f,0xe9,0x7c}, {0x84,0x1e,0xc9,0xf8}, {0x00,0x00,0x00,0x00},
-{0x80,0x86,0x83,0x09}, {0x2b,0xed,0x48,0x32}, {0x11,0x70,0xac,0x1e}, {0x5a,0x72,0x4e,0x6c},
-{0x0e,0xff,0xfb,0xfd}, {0x85,0x38,0x56,0x0f}, {0xae,0xd5,0x1e,0x3d}, {0x2d,0x39,0x27,0x36},
-{0x0f,0xd9,0x64,0x0a}, {0x5c,0xa6,0x21,0x68}, {0x5b,0x54,0xd1,0x9b}, {0x36,0x2e,0x3a,0x24},
-{0x0a,0x67,0xb1,0x0c}, {0x57,0xe7,0x0f,0x93}, {0xee,0x96,0xd2,0xb4}, {0x9b,0x91,0x9e,0x1b},
-{0xc0,0xc5,0x4f,0x80}, {0xdc,0x20,0xa2,0x61}, {0x77,0x4b,0x69,0x5a}, {0x12,0x1a,0x16,0x1c},
-{0x93,0xba,0x0a,0xe2}, {0xa0,0x2a,0xe5,0xc0}, {0x22,0xe0,0x43,0x3c}, {0x1b,0x17,0x1d,0x12},
-{0x09,0x0d,0x0b,0x0e}, {0x8b,0xc7,0xad,0xf2}, {0xb6,0xa8,0xb9,0x2d}, {0x1e,0xa9,0xc8,0x14},
-{0xf1,0x19,0x85,0x57}, {0x75,0x07,0x4c,0xaf}, {0x99,0xdd,0xbb,0xee}, {0x7f,0x60,0xfd,0xa3},
-{0x01,0x26,0x9f,0xf7}, {0x72,0xf5,0xbc,0x5c}, {0x66,0x3b,0xc5,0x44}, {0xfb,0x7e,0x34,0x5b},
-{0x43,0x29,0x76,0x8b}, {0x23,0xc6,0xdc,0xcb}, {0xed,0xfc,0x68,0xb6}, {0xe4,0xf1,0x63,0xb8},
-{0x31,0xdc,0xca,0xd7}, {0x63,0x85,0x10,0x42}, {0x97,0x22,0x40,0x13}, {0xc6,0x11,0x20,0x84},
-{0x4a,0x24,0x7d,0x85}, {0xbb,0x3d,0xf8,0xd2}, {0xf9,0x32,0x11,0xae}, {0x29,0xa1,0x6d,0xc7},
-{0x9e,0x2f,0x4b,0x1d}, {0xb2,0x30,0xf3,0xdc}, {0x86,0x52,0xec,0x0d}, {0xc1,0xe3,0xd0,0x77},
-{0xb3,0x16,0x6c,0x2b}, {0x70,0xb9,0x99,0xa9}, {0x94,0x48,0xfa,0x11}, {0xe9,0x64,0x22,0x47},
-{0xfc,0x8c,0xc4,0xa8}, {0xf0,0x3f,0x1a,0xa0}, {0x7d,0x2c,0xd8,0x56}, {0x33,0x90,0xef,0x22},
-{0x49,0x4e,0xc7,0x87}, {0x38,0xd1,0xc1,0xd9}, {0xca,0xa2,0xfe,0x8c}, {0xd4,0x0b,0x36,0x98},
-{0xf5,0x81,0xcf,0xa6}, {0x7a,0xde,0x28,0xa5}, {0xb7,0x8e,0x26,0xda}, {0xad,0xbf,0xa4,0x3f},
-{0x3a,0x9d,0xe4,0x2c}, {0x78,0x92,0x0d,0x50}, {0x5f,0xcc,0x9b,0x6a}, {0x7e,0x46,0x62,0x54},
-{0x8d,0x13,0xc2,0xf6}, {0xd8,0xb8,0xe8,0x90}, {0x39,0xf7,0x5e,0x2e}, {0xc3,0xaf,0xf5,0x82},
-{0x5d,0x80,0xbe,0x9f}, {0xd0,0x93,0x7c,0x69}, {0xd5,0x2d,0xa9,0x6f}, {0x25,0x12,0xb3,0xcf},
-{0xac,0x99,0x3b,0xc8}, {0x18,0x7d,0xa7,0x10}, {0x9c,0x63,0x6e,0xe8}, {0x3b,0xbb,0x7b,0xdb},
-{0x26,0x78,0x09,0xcd}, {0x59,0x18,0xf4,0x6e}, {0x9a,0xb7,0x01,0xec}, {0x4f,0x9a,0xa8,0x83},
-{0x95,0x6e,0x65,0xe6}, {0xff,0xe6,0x7e,0xaa}, {0xbc,0xcf,0x08,0x21}, {0x15,0xe8,0xe6,0xef},
-{0xe7,0x9b,0xd9,0xba}, {0x6f,0x36,0xce,0x4a}, {0x9f,0x09,0xd4,0xea}, {0xb0,0x7c,0xd6,0x29},
-{0xa4,0xb2,0xaf,0x31}, {0x3f,0x23,0x31,0x2a}, {0xa5,0x94,0x30,0xc6}, {0xa2,0x66,0xc0,0x35},
-{0x4e,0xbc,0x37,0x74}, {0x82,0xca,0xa6,0xfc}, {0x90,0xd0,0xb0,0xe0}, {0xa7,0xd8,0x15,0x33},
-{0x04,0x98,0x4a,0xf1}, {0xec,0xda,0xf7,0x41}, {0xcd,0x50,0x0e,0x7f}, {0x91,0xf6,0x2f,0x17},
-{0x4d,0xd6,0x8d,0x76}, {0xef,0xb0,0x4d,0x43}, {0xaa,0x4d,0x54,0xcc}, {0x96,0x04,0xdf,0xe4},
-{0xd1,0xb5,0xe3,0x9e}, {0x6a,0x88,0x1b,0x4c}, {0x2c,0x1f,0xb8,0xc1}, {0x65,0x51,0x7f,0x46},
-{0x5e,0xea,0x04,0x9d}, {0x8c,0x35,0x5d,0x01}, {0x87,0x74,0x73,0xfa}, {0x0b,0x41,0x2e,0xfb},
-{0x67,0x1d,0x5a,0xb3}, {0xdb,0xd2,0x52,0x92}, {0x10,0x56,0x33,0xe9}, {0xd6,0x47,0x13,0x6d},
-{0xd7,0x61,0x8c,0x9a}, {0xa1,0x0c,0x7a,0x37}, {0xf8,0x14,0x8e,0x59}, {0x13,0x3c,0x89,0xeb},
-{0xa9,0x27,0xee,0xce}, {0x61,0xc9,0x35,0xb7}, {0x1c,0xe5,0xed,0xe1}, {0x47,0xb1,0x3c,0x7a},
-{0xd2,0xdf,0x59,0x9c}, {0xf2,0x73,0x3f,0x55}, {0x14,0xce,0x79,0x18}, {0xc7,0x37,0xbf,0x73},
-{0xf7,0xcd,0xea,0x53}, {0xfd,0xaa,0x5b,0x5f}, {0x3d,0x6f,0x14,0xdf}, {0x44,0xdb,0x86,0x78},
-{0xaf,0xf3,0x81,0xca}, {0x68,0xc4,0x3e,0xb9}, {0x24,0x34,0x2c,0x38}, {0xa3,0x40,0x5f,0xc2},
-{0x1d,0xc3,0x72,0x16}, {0xe2,0x25,0x0c,0xbc}, {0x3c,0x49,0x8b,0x28}, {0x0d,0x95,0x41,0xff},
-{0xa8,0x01,0x71,0x39}, {0x0c,0xb3,0xde,0x08}, {0xb4,0xe4,0x9c,0xd8}, {0x56,0xc1,0x90,0x64},
-{0xcb,0x84,0x61,0x7b}, {0x32,0xb6,0x70,0xd5}, {0x6c,0x5c,0x74,0x48}, {0xb8,0x57,0x42,0xd0}
-	}
-};
-#define	T8	xT8.xt8
-
-static const word8 S5[256] = {
-0x52,0x09,0x6a,0xd5,
-0x30,0x36,0xa5,0x38,
-0xbf,0x40,0xa3,0x9e,
-0x81,0xf3,0xd7,0xfb,
-0x7c,0xe3,0x39,0x82,
-0x9b,0x2f,0xff,0x87,
-0x34,0x8e,0x43,0x44,
-0xc4,0xde,0xe9,0xcb,
-0x54,0x7b,0x94,0x32,
-0xa6,0xc2,0x23,0x3d,
-0xee,0x4c,0x95,0x0b,
-0x42,0xfa,0xc3,0x4e,
-0x08,0x2e,0xa1,0x66,
-0x28,0xd9,0x24,0xb2,
-0x76,0x5b,0xa2,0x49,
-0x6d,0x8b,0xd1,0x25,
-0x72,0xf8,0xf6,0x64,
-0x86,0x68,0x98,0x16,
-0xd4,0xa4,0x5c,0xcc,
-0x5d,0x65,0xb6,0x92,
-0x6c,0x70,0x48,0x50,
-0xfd,0xed,0xb9,0xda,
-0x5e,0x15,0x46,0x57,
-0xa7,0x8d,0x9d,0x84,
-0x90,0xd8,0xab,0x00,
-0x8c,0xbc,0xd3,0x0a,
-0xf7,0xe4,0x58,0x05,
-0xb8,0xb3,0x45,0x06,
-0xd0,0x2c,0x1e,0x8f,
-0xca,0x3f,0x0f,0x02,
-0xc1,0xaf,0xbd,0x03,
-0x01,0x13,0x8a,0x6b,
-0x3a,0x91,0x11,0x41,
-0x4f,0x67,0xdc,0xea,
-0x97,0xf2,0xcf,0xce,
-0xf0,0xb4,0xe6,0x73,
-0x96,0xac,0x74,0x22,
-0xe7,0xad,0x35,0x85,
-0xe2,0xf9,0x37,0xe8,
-0x1c,0x75,0xdf,0x6e,
-0x47,0xf1,0x1a,0x71,
-0x1d,0x29,0xc5,0x89,
-0x6f,0xb7,0x62,0x0e,
-0xaa,0x18,0xbe,0x1b,
-0xfc,0x56,0x3e,0x4b,
-0xc6,0xd2,0x79,0x20,
-0x9a,0xdb,0xc0,0xfe,
-0x78,0xcd,0x5a,0xf4,
-0x1f,0xdd,0xa8,0x33,
-0x88,0x07,0xc7,0x31,
-0xb1,0x12,0x10,0x59,
-0x27,0x80,0xec,0x5f,
-0x60,0x51,0x7f,0xa9,
-0x19,0xb5,0x4a,0x0d,
-0x2d,0xe5,0x7a,0x9f,
-0x93,0xc9,0x9c,0xef,
-0xa0,0xe0,0x3b,0x4d,
-0xae,0x2a,0xf5,0xb0,
-0xc8,0xeb,0xbb,0x3c,
-0x83,0x53,0x99,0x61,
-0x17,0x2b,0x04,0x7e,
-0xba,0x77,0xd6,0x26,
-0xe1,0x69,0x14,0x63,
-0x55,0x21,0x0c,0x7d
-};
-
-static const union xtab xU1 = {
-	.xt8 = {
-{0x00,0x00,0x00,0x00}, {0x0e,0x09,0x0d,0x0b}, {0x1c,0x12,0x1a,0x16}, {0x12,0x1b,0x17,0x1d},
-{0x38,0x24,0x34,0x2c}, {0x36,0x2d,0x39,0x27}, {0x24,0x36,0x2e,0x3a}, {0x2a,0x3f,0x23,0x31},
-{0x70,0x48,0x68,0x58}, {0x7e,0x41,0x65,0x53}, {0x6c,0x5a,0x72,0x4e}, {0x62,0x53,0x7f,0x45},
-{0x48,0x6c,0x5c,0x74}, {0x46,0x65,0x51,0x7f}, {0x54,0x7e,0x46,0x62}, {0x5a,0x77,0x4b,0x69},
-{0xe0,0x90,0xd0,0xb0}, {0xee,0x99,0xdd,0xbb}, {0xfc,0x82,0xca,0xa6}, {0xf2,0x8b,0xc7,0xad},
-{0xd8,0xb4,0xe4,0x9c}, {0xd6,0xbd,0xe9,0x97}, {0xc4,0xa6,0xfe,0x8a}, {0xca,0xaf,0xf3,0x81},
-{0x90,0xd8,0xb8,0xe8}, {0x9e,0xd1,0xb5,0xe3}, {0x8c,0xca,0xa2,0xfe}, {0x82,0xc3,0xaf,0xf5},
-{0xa8,0xfc,0x8c,0xc4}, {0xa6,0xf5,0x81,0xcf}, {0xb4,0xee,0x96,0xd2}, {0xba,0xe7,0x9b,0xd9},
-{0xdb,0x3b,0xbb,0x7b}, {0xd5,0x32,0xb6,0x70}, {0xc7,0x29,0xa1,0x6d}, {0xc9,0x20,0xac,0x66},
-{0xe3,0x1f,0x8f,0x57}, {0xed,0x16,0x82,0x5c}, {0xff,0x0d,0x95,0x41}, {0xf1,0x04,0x98,0x4a},
-{0xab,0x73,0xd3,0x23}, {0xa5,0x7a,0xde,0x28}, {0xb7,0x61,0xc9,0x35}, {0xb9,0x68,0xc4,0x3e},
-{0x93,0x57,0xe7,0x0f}, {0x9d,0x5e,0xea,0x04}, {0x8f,0x45,0xfd,0x19}, {0x81,0x4c,0xf0,0x12},
-{0x3b,0xab,0x6b,0xcb}, {0x35,0xa2,0x66,0xc0}, {0x27,0xb9,0x71,0xdd}, {0x29,0xb0,0x7c,0xd6},
-{0x03,0x8f,0x5f,0xe7}, {0x0d,0x86,0x52,0xec}, {0x1f,0x9d,0x45,0xf1}, {0x11,0x94,0x48,0xfa},
-{0x4b,0xe3,0x03,0x93}, {0x45,0xea,0x0e,0x98}, {0x57,0xf1,0x19,0x85}, {0x59,0xf8,0x14,0x8e},
-{0x73,0xc7,0x37,0xbf}, {0x7d,0xce,0x3a,0xb4}, {0x6f,0xd5,0x2d,0xa9}, {0x61,0xdc,0x20,0xa2},
-{0xad,0x76,0x6d,0xf6}, {0xa3,0x7f,0x60,0xfd}, {0xb1,0x64,0x77,0xe0}, {0xbf,0x6d,0x7a,0xeb},
-{0x95,0x52,0x59,0xda}, {0x9b,0x5b,0x54,0xd1}, {0x89,0x40,0x43,0xcc}, {0x87,0x49,0x4e,0xc7},
-{0xdd,0x3e,0x05,0xae}, {0xd3,0x37,0x08,0xa5}, {0xc1,0x2c,0x1f,0xb8}, {0xcf,0x25,0x12,0xb3},
-{0xe5,0x1a,0x31,0x82}, {0xeb,0x13,0x3c,0x89}, {0xf9,0x08,0x2b,0x94}, {0xf7,0x01,0x26,0x9f},
-{0x4d,0xe6,0xbd,0x46}, {0x43,0xef,0xb0,0x4d}, {0x51,0xf4,0xa7,0x50}, {0x5f,0xfd,0xaa,0x5b},
-{0x75,0xc2,0x89,0x6a}, {0x7b,0xcb,0x84,0x61}, {0x69,0xd0,0x93,0x7c}, {0x67,0xd9,0x9e,0x77},
-{0x3d,0xae,0xd5,0x1e}, {0x33,0xa7,0xd8,0x15}, {0x21,0xbc,0xcf,0x08}, {0x2f,0xb5,0xc2,0x03},
-{0x05,0x8a,0xe1,0x32}, {0x0b,0x83,0xec,0x39}, {0x19,0x98,0xfb,0x24}, {0x17,0x91,0xf6,0x2f},
-{0x76,0x4d,0xd6,0x8d}, {0x78,0x44,0xdb,0x86}, {0x6a,0x5f,0xcc,0x9b}, {0x64,0x56,0xc1,0x90},
-{0x4e,0x69,0xe2,0xa1}, {0x40,0x60,0xef,0xaa}, {0x52,0x7b,0xf8,0xb7}, {0x5c,0x72,0xf5,0xbc},
-{0x06,0x05,0xbe,0xd5}, {0x08,0x0c,0xb3,0xde}, {0x1a,0x17,0xa4,0xc3}, {0x14,0x1e,0xa9,0xc8},
-{0x3e,0x21,0x8a,0xf9}, {0x30,0x28,0x87,0xf2}, {0x22,0x33,0x90,0xef}, {0x2c,0x3a,0x9d,0xe4},
-{0x96,0xdd,0x06,0x3d}, {0x98,0xd4,0x0b,0x36}, {0x8a,0xcf,0x1c,0x2b}, {0x84,0xc6,0x11,0x20},
-{0xae,0xf9,0x32,0x11}, {0xa0,0xf0,0x3f,0x1a}, {0xb2,0xeb,0x28,0x07}, {0xbc,0xe2,0x25,0x0c},
-{0xe6,0x95,0x6e,0x65}, {0xe8,0x9c,0x63,0x6e}, {0xfa,0x87,0x74,0x73}, {0xf4,0x8e,0x79,0x78},
-{0xde,0xb1,0x5a,0x49}, {0xd0,0xb8,0x57,0x42}, {0xc2,0xa3,0x40,0x5f}, {0xcc,0xaa,0x4d,0x54},
-{0x41,0xec,0xda,0xf7}, {0x4f,0xe5,0xd7,0xfc}, {0x5d,0xfe,0xc0,0xe1}, {0x53,0xf7,0xcd,0xea},
-{0x79,0xc8,0xee,0xdb}, {0x77,0xc1,0xe3,0xd0}, {0x65,0xda,0xf4,0xcd}, {0x6b,0xd3,0xf9,0xc6},
-{0x31,0xa4,0xb2,0xaf}, {0x3f,0xad,0xbf,0xa4}, {0x2d,0xb6,0xa8,0xb9}, {0x23,0xbf,0xa5,0xb2},
-{0x09,0x80,0x86,0x83}, {0x07,0x89,0x8b,0x88}, {0x15,0x92,0x9c,0x95}, {0x1b,0x9b,0x91,0x9e},
-{0xa1,0x7c,0x0a,0x47}, {0xaf,0x75,0x07,0x4c}, {0xbd,0x6e,0x10,0x51}, {0xb3,0x67,0x1d,0x5a},
-{0x99,0x58,0x3e,0x6b}, {0x97,0x51,0x33,0x60}, {0x85,0x4a,0x24,0x7d}, {0x8b,0x43,0x29,0x76},
-{0xd1,0x34,0x62,0x1f}, {0xdf,0x3d,0x6f,0x14}, {0xcd,0x26,0x78,0x09}, {0xc3,0x2f,0x75,0x02},
-{0xe9,0x10,0x56,0x33}, {0xe7,0x19,0x5b,0x38}, {0xf5,0x02,0x4c,0x25}, {0xfb,0x0b,0x41,0x2e},
-{0x9a,0xd7,0x61,0x8c}, {0x94,0xde,0x6c,0x87}, {0x86,0xc5,0x7b,0x9a}, {0x88,0xcc,0x76,0x91},
-{0xa2,0xf3,0x55,0xa0}, {0xac,0xfa,0x58,0xab}, {0xbe,0xe1,0x4f,0xb6}, {0xb0,0xe8,0x42,0xbd},
-{0xea,0x9f,0x09,0xd4}, {0xe4,0x96,0x04,0xdf}, {0xf6,0x8d,0x13,0xc2}, {0xf8,0x84,0x1e,0xc9},
-{0xd2,0xbb,0x3d,0xf8}, {0xdc,0xb2,0x30,0xf3}, {0xce,0xa9,0x27,0xee}, {0xc0,0xa0,0x2a,0xe5},
-{0x7a,0x47,0xb1,0x3c}, {0x74,0x4e,0xbc,0x37}, {0x66,0x55,0xab,0x2a}, {0x68,0x5c,0xa6,0x21},
-{0x42,0x63,0x85,0x10}, {0x4c,0x6a,0x88,0x1b}, {0x5e,0x71,0x9f,0x06}, {0x50,0x78,0x92,0x0d},
-{0x0a,0x0f,0xd9,0x64}, {0x04,0x06,0xd4,0x6f}, {0x16,0x1d,0xc3,0x72}, {0x18,0x14,0xce,0x79},
-{0x32,0x2b,0xed,0x48}, {0x3c,0x22,0xe0,0x43}, {0x2e,0x39,0xf7,0x5e}, {0x20,0x30,0xfa,0x55},
-{0xec,0x9a,0xb7,0x01}, {0xe2,0x93,0xba,0x0a}, {0xf0,0x88,0xad,0x17}, {0xfe,0x81,0xa0,0x1c},
-{0xd4,0xbe,0x83,0x2d}, {0xda,0xb7,0x8e,0x26}, {0xc8,0xac,0x99,0x3b}, {0xc6,0xa5,0x94,0x30},
-{0x9c,0xd2,0xdf,0x59}, {0x92,0xdb,0xd2,0x52}, {0x80,0xc0,0xc5,0x4f}, {0x8e,0xc9,0xc8,0x44},
-{0xa4,0xf6,0xeb,0x75}, {0xaa,0xff,0xe6,0x7e}, {0xb8,0xe4,0xf1,0x63}, {0xb6,0xed,0xfc,0x68},
-{0x0c,0x0a,0x67,0xb1}, {0x02,0x03,0x6a,0xba}, {0x10,0x18,0x7d,0xa7}, {0x1e,0x11,0x70,0xac},
-{0x34,0x2e,0x53,0x9d}, {0x3a,0x27,0x5e,0x96}, {0x28,0x3c,0x49,0x8b}, {0x26,0x35,0x44,0x80},
-{0x7c,0x42,0x0f,0xe9}, {0x72,0x4b,0x02,0xe2}, {0x60,0x50,0x15,0xff}, {0x6e,0x59,0x18,0xf4},
-{0x44,0x66,0x3b,0xc5}, {0x4a,0x6f,0x36,0xce}, {0x58,0x74,0x21,0xd3}, {0x56,0x7d,0x2c,0xd8},
-{0x37,0xa1,0x0c,0x7a}, {0x39,0xa8,0x01,0x71}, {0x2b,0xb3,0x16,0x6c}, {0x25,0xba,0x1b,0x67},
-{0x0f,0x85,0x38,0x56}, {0x01,0x8c,0x35,0x5d}, {0x13,0x97,0x22,0x40}, {0x1d,0x9e,0x2f,0x4b},
-{0x47,0xe9,0x64,0x22}, {0x49,0xe0,0x69,0x29}, {0x5b,0xfb,0x7e,0x34}, {0x55,0xf2,0x73,0x3f},
-{0x7f,0xcd,0x50,0x0e}, {0x71,0xc4,0x5d,0x05}, {0x63,0xdf,0x4a,0x18}, {0x6d,0xd6,0x47,0x13},
-{0xd7,0x31,0xdc,0xca}, {0xd9,0x38,0xd1,0xc1}, {0xcb,0x23,0xc6,0xdc}, {0xc5,0x2a,0xcb,0xd7},
-{0xef,0x15,0xe8,0xe6}, {0xe1,0x1c,0xe5,0xed}, {0xf3,0x07,0xf2,0xf0}, {0xfd,0x0e,0xff,0xfb},
-{0xa7,0x79,0xb4,0x92}, {0xa9,0x70,0xb9,0x99}, {0xbb,0x6b,0xae,0x84}, {0xb5,0x62,0xa3,0x8f},
-{0x9f,0x5d,0x80,0xbe}, {0x91,0x54,0x8d,0xb5}, {0x83,0x4f,0x9a,0xa8}, {0x8d,0x46,0x97,0xa3}
-	}
-};
-#define	U1	xU1.xt8
-
-static const union xtab xU2 = {
-	.xt8 = {
-{0x00,0x00,0x00,0x00}, {0x0b,0x0e,0x09,0x0d}, {0x16,0x1c,0x12,0x1a}, {0x1d,0x12,0x1b,0x17},
-{0x2c,0x38,0x24,0x34}, {0x27,0x36,0x2d,0x39}, {0x3a,0x24,0x36,0x2e}, {0x31,0x2a,0x3f,0x23},
-{0x58,0x70,0x48,0x68}, {0x53,0x7e,0x41,0x65}, {0x4e,0x6c,0x5a,0x72}, {0x45,0x62,0x53,0x7f},
-{0x74,0x48,0x6c,0x5c}, {0x7f,0x46,0x65,0x51}, {0x62,0x54,0x7e,0x46}, {0x69,0x5a,0x77,0x4b},
-{0xb0,0xe0,0x90,0xd0}, {0xbb,0xee,0x99,0xdd}, {0xa6,0xfc,0x82,0xca}, {0xad,0xf2,0x8b,0xc7},
-{0x9c,0xd8,0xb4,0xe4}, {0x97,0xd6,0xbd,0xe9}, {0x8a,0xc4,0xa6,0xfe}, {0x81,0xca,0xaf,0xf3},
-{0xe8,0x90,0xd8,0xb8}, {0xe3,0x9e,0xd1,0xb5}, {0xfe,0x8c,0xca,0xa2}, {0xf5,0x82,0xc3,0xaf},
-{0xc4,0xa8,0xfc,0x8c}, {0xcf,0xa6,0xf5,0x81}, {0xd2,0xb4,0xee,0x96}, {0xd9,0xba,0xe7,0x9b},
-{0x7b,0xdb,0x3b,0xbb}, {0x70,0xd5,0x32,0xb6}, {0x6d,0xc7,0x29,0xa1}, {0x66,0xc9,0x20,0xac},
-{0x57,0xe3,0x1f,0x8f}, {0x5c,0xed,0x16,0x82}, {0x41,0xff,0x0d,0x95}, {0x4a,0xf1,0x04,0x98},
-{0x23,0xab,0x73,0xd3}, {0x28,0xa5,0x7a,0xde}, {0x35,0xb7,0x61,0xc9}, {0x3e,0xb9,0x68,0xc4},
-{0x0f,0x93,0x57,0xe7}, {0x04,0x9d,0x5e,0xea}, {0x19,0x8f,0x45,0xfd}, {0x12,0x81,0x4c,0xf0},
-{0xcb,0x3b,0xab,0x6b}, {0xc0,0x35,0xa2,0x66}, {0xdd,0x27,0xb9,0x71}, {0xd6,0x29,0xb0,0x7c},
-{0xe7,0x03,0x8f,0x5f}, {0xec,0x0d,0x86,0x52}, {0xf1,0x1f,0x9d,0x45}, {0xfa,0x11,0x94,0x48},
-{0x93,0x4b,0xe3,0x03}, {0x98,0x45,0xea,0x0e}, {0x85,0x57,0xf1,0x19}, {0x8e,0x59,0xf8,0x14},
-{0xbf,0x73,0xc7,0x37}, {0xb4,0x7d,0xce,0x3a}, {0xa9,0x6f,0xd5,0x2d}, {0xa2,0x61,0xdc,0x20},
-{0xf6,0xad,0x76,0x6d}, {0xfd,0xa3,0x7f,0x60}, {0xe0,0xb1,0x64,0x77}, {0xeb,0xbf,0x6d,0x7a},
-{0xda,0x95,0x52,0x59}, {0xd1,0x9b,0x5b,0x54}, {0xcc,0x89,0x40,0x43}, {0xc7,0x87,0x49,0x4e},
-{0xae,0xdd,0x3e,0x05}, {0xa5,0xd3,0x37,0x08}, {0xb8,0xc1,0x2c,0x1f}, {0xb3,0xcf,0x25,0x12},
-{0x82,0xe5,0x1a,0x31}, {0x89,0xeb,0x13,0x3c}, {0x94,0xf9,0x08,0x2b}, {0x9f,0xf7,0x01,0x26},
-{0x46,0x4d,0xe6,0xbd}, {0x4d,0x43,0xef,0xb0}, {0x50,0x51,0xf4,0xa7}, {0x5b,0x5f,0xfd,0xaa},
-{0x6a,0x75,0xc2,0x89}, {0x61,0x7b,0xcb,0x84}, {0x7c,0x69,0xd0,0x93}, {0x77,0x67,0xd9,0x9e},
-{0x1e,0x3d,0xae,0xd5}, {0x15,0x33,0xa7,0xd8}, {0x08,0x21,0xbc,0xcf}, {0x03,0x2f,0xb5,0xc2},
-{0x32,0x05,0x8a,0xe1}, {0x39,0x0b,0x83,0xec}, {0x24,0x19,0x98,0xfb}, {0x2f,0x17,0x91,0xf6},
-{0x8d,0x76,0x4d,0xd6}, {0x86,0x78,0x44,0xdb}, {0x9b,0x6a,0x5f,0xcc}, {0x90,0x64,0x56,0xc1},
-{0xa1,0x4e,0x69,0xe2}, {0xaa,0x40,0x60,0xef}, {0xb7,0x52,0x7b,0xf8}, {0xbc,0x5c,0x72,0xf5},
-{0xd5,0x06,0x05,0xbe}, {0xde,0x08,0x0c,0xb3}, {0xc3,0x1a,0x17,0xa4}, {0xc8,0x14,0x1e,0xa9},
-{0xf9,0x3e,0x21,0x8a}, {0xf2,0x30,0x28,0x87}, {0xef,0x22,0x33,0x90}, {0xe4,0x2c,0x3a,0x9d},
-{0x3d,0x96,0xdd,0x06}, {0x36,0x98,0xd4,0x0b}, {0x2b,0x8a,0xcf,0x1c}, {0x20,0x84,0xc6,0x11},
-{0x11,0xae,0xf9,0x32}, {0x1a,0xa0,0xf0,0x3f}, {0x07,0xb2,0xeb,0x28}, {0x0c,0xbc,0xe2,0x25},
-{0x65,0xe6,0x95,0x6e}, {0x6e,0xe8,0x9c,0x63}, {0x73,0xfa,0x87,0x74}, {0x78,0xf4,0x8e,0x79},
-{0x49,0xde,0xb1,0x5a}, {0x42,0xd0,0xb8,0x57}, {0x5f,0xc2,0xa3,0x40}, {0x54,0xcc,0xaa,0x4d},
-{0xf7,0x41,0xec,0xda}, {0xfc,0x4f,0xe5,0xd7}, {0xe1,0x5d,0xfe,0xc0}, {0xea,0x53,0xf7,0xcd},
-{0xdb,0x79,0xc8,0xee}, {0xd0,0x77,0xc1,0xe3}, {0xcd,0x65,0xda,0xf4}, {0xc6,0x6b,0xd3,0xf9},
-{0xaf,0x31,0xa4,0xb2}, {0xa4,0x3f,0xad,0xbf}, {0xb9,0x2d,0xb6,0xa8}, {0xb2,0x23,0xbf,0xa5},
-{0x83,0x09,0x80,0x86}, {0x88,0x07,0x89,0x8b}, {0x95,0x15,0x92,0x9c}, {0x9e,0x1b,0x9b,0x91},
-{0x47,0xa1,0x7c,0x0a}, {0x4c,0xaf,0x75,0x07}, {0x51,0xbd,0x6e,0x10}, {0x5a,0xb3,0x67,0x1d},
-{0x6b,0x99,0x58,0x3e}, {0x60,0x97,0x51,0x33}, {0x7d,0x85,0x4a,0x24}, {0x76,0x8b,0x43,0x29},
-{0x1f,0xd1,0x34,0x62}, {0x14,0xdf,0x3d,0x6f}, {0x09,0xcd,0x26,0x78}, {0x02,0xc3,0x2f,0x75},
-{0x33,0xe9,0x10,0x56}, {0x38,0xe7,0x19,0x5b}, {0x25,0xf5,0x02,0x4c}, {0x2e,0xfb,0x0b,0x41},
-{0x8c,0x9a,0xd7,0x61}, {0x87,0x94,0xde,0x6c}, {0x9a,0x86,0xc5,0x7b}, {0x91,0x88,0xcc,0x76},
-{0xa0,0xa2,0xf3,0x55}, {0xab,0xac,0xfa,0x58}, {0xb6,0xbe,0xe1,0x4f}, {0xbd,0xb0,0xe8,0x42},
-{0xd4,0xea,0x9f,0x09}, {0xdf,0xe4,0x96,0x04}, {0xc2,0xf6,0x8d,0x13}, {0xc9,0xf8,0x84,0x1e},
-{0xf8,0xd2,0xbb,0x3d}, {0xf3,0xdc,0xb2,0x30}, {0xee,0xce,0xa9,0x27}, {0xe5,0xc0,0xa0,0x2a},
-{0x3c,0x7a,0x47,0xb1}, {0x37,0x74,0x4e,0xbc}, {0x2a,0x66,0x55,0xab}, {0x21,0x68,0x5c,0xa6},
-{0x10,0x42,0x63,0x85}, {0x1b,0x4c,0x6a,0x88}, {0x06,0x5e,0x71,0x9f}, {0x0d,0x50,0x78,0x92},
-{0x64,0x0a,0x0f,0xd9}, {0x6f,0x04,0x06,0xd4}, {0x72,0x16,0x1d,0xc3}, {0x79,0x18,0x14,0xce},
-{0x48,0x32,0x2b,0xed}, {0x43,0x3c,0x22,0xe0}, {0x5e,0x2e,0x39,0xf7}, {0x55,0x20,0x30,0xfa},
-{0x01,0xec,0x9a,0xb7}, {0x0a,0xe2,0x93,0xba}, {0x17,0xf0,0x88,0xad}, {0x1c,0xfe,0x81,0xa0},
-{0x2d,0xd4,0xbe,0x83}, {0x26,0xda,0xb7,0x8e}, {0x3b,0xc8,0xac,0x99}, {0x30,0xc6,0xa5,0x94},
-{0x59,0x9c,0xd2,0xdf}, {0x52,0x92,0xdb,0xd2}, {0x4f,0x80,0xc0,0xc5}, {0x44,0x8e,0xc9,0xc8},
-{0x75,0xa4,0xf6,0xeb}, {0x7e,0xaa,0xff,0xe6}, {0x63,0xb8,0xe4,0xf1}, {0x68,0xb6,0xed,0xfc},
-{0xb1,0x0c,0x0a,0x67}, {0xba,0x02,0x03,0x6a}, {0xa7,0x10,0x18,0x7d}, {0xac,0x1e,0x11,0x70},
-{0x9d,0x34,0x2e,0x53}, {0x96,0x3a,0x27,0x5e}, {0x8b,0x28,0x3c,0x49}, {0x80,0x26,0x35,0x44},
-{0xe9,0x7c,0x42,0x0f}, {0xe2,0x72,0x4b,0x02}, {0xff,0x60,0x50,0x15}, {0xf4,0x6e,0x59,0x18},
-{0xc5,0x44,0x66,0x3b}, {0xce,0x4a,0x6f,0x36}, {0xd3,0x58,0x74,0x21}, {0xd8,0x56,0x7d,0x2c},
-{0x7a,0x37,0xa1,0x0c}, {0x71,0x39,0xa8,0x01}, {0x6c,0x2b,0xb3,0x16}, {0x67,0x25,0xba,0x1b},
-{0x56,0x0f,0x85,0x38}, {0x5d,0x01,0x8c,0x35}, {0x40,0x13,0x97,0x22}, {0x4b,0x1d,0x9e,0x2f},
-{0x22,0x47,0xe9,0x64}, {0x29,0x49,0xe0,0x69}, {0x34,0x5b,0xfb,0x7e}, {0x3f,0x55,0xf2,0x73},
-{0x0e,0x7f,0xcd,0x50}, {0x05,0x71,0xc4,0x5d}, {0x18,0x63,0xdf,0x4a}, {0x13,0x6d,0xd6,0x47},
-{0xca,0xd7,0x31,0xdc}, {0xc1,0xd9,0x38,0xd1}, {0xdc,0xcb,0x23,0xc6}, {0xd7,0xc5,0x2a,0xcb},
-{0xe6,0xef,0x15,0xe8}, {0xed,0xe1,0x1c,0xe5}, {0xf0,0xf3,0x07,0xf2}, {0xfb,0xfd,0x0e,0xff},
-{0x92,0xa7,0x79,0xb4}, {0x99,0xa9,0x70,0xb9}, {0x84,0xbb,0x6b,0xae}, {0x8f,0xb5,0x62,0xa3},
-{0xbe,0x9f,0x5d,0x80}, {0xb5,0x91,0x54,0x8d}, {0xa8,0x83,0x4f,0x9a}, {0xa3,0x8d,0x46,0x97}
-	}
-};
-#define	U2	xU2.xt8
-
-static const union xtab xU3 = {
-	.xt8 = {
-{0x00,0x00,0x00,0x00}, {0x0d,0x0b,0x0e,0x09}, {0x1a,0x16,0x1c,0x12}, {0x17,0x1d,0x12,0x1b},
-{0x34,0x2c,0x38,0x24}, {0x39,0x27,0x36,0x2d}, {0x2e,0x3a,0x24,0x36}, {0x23,0x31,0x2a,0x3f},
-{0x68,0x58,0x70,0x48}, {0x65,0x53,0x7e,0x41}, {0x72,0x4e,0x6c,0x5a}, {0x7f,0x45,0x62,0x53},
-{0x5c,0x74,0x48,0x6c}, {0x51,0x7f,0x46,0x65}, {0x46,0x62,0x54,0x7e}, {0x4b,0x69,0x5a,0x77},
-{0xd0,0xb0,0xe0,0x90}, {0xdd,0xbb,0xee,0x99}, {0xca,0xa6,0xfc,0x82}, {0xc7,0xad,0xf2,0x8b},
-{0xe4,0x9c,0xd8,0xb4}, {0xe9,0x97,0xd6,0xbd}, {0xfe,0x8a,0xc4,0xa6}, {0xf3,0x81,0xca,0xaf},
-{0xb8,0xe8,0x90,0xd8}, {0xb5,0xe3,0x9e,0xd1}, {0xa2,0xfe,0x8c,0xca}, {0xaf,0xf5,0x82,0xc3},
-{0x8c,0xc4,0xa8,0xfc}, {0x81,0xcf,0xa6,0xf5}, {0x96,0xd2,0xb4,0xee}, {0x9b,0xd9,0xba,0xe7},
-{0xbb,0x7b,0xdb,0x3b}, {0xb6,0x70,0xd5,0x32}, {0xa1,0x6d,0xc7,0x29}, {0xac,0x66,0xc9,0x20},
-{0x8f,0x57,0xe3,0x1f}, {0x82,0x5c,0xed,0x16}, {0x95,0x41,0xff,0x0d}, {0x98,0x4a,0xf1,0x04},
-{0xd3,0x23,0xab,0x73}, {0xde,0x28,0xa5,0x7a}, {0xc9,0x35,0xb7,0x61}, {0xc4,0x3e,0xb9,0x68},
-{0xe7,0x0f,0x93,0x57}, {0xea,0x04,0x9d,0x5e}, {0xfd,0x19,0x8f,0x45}, {0xf0,0x12,0x81,0x4c},
-{0x6b,0xcb,0x3b,0xab}, {0x66,0xc0,0x35,0xa2}, {0x71,0xdd,0x27,0xb9}, {0x7c,0xd6,0x29,0xb0},
-{0x5f,0xe7,0x03,0x8f}, {0x52,0xec,0x0d,0x86}, {0x45,0xf1,0x1f,0x9d}, {0x48,0xfa,0x11,0x94},
-{0x03,0x93,0x4b,0xe3}, {0x0e,0x98,0x45,0xea}, {0x19,0x85,0x57,0xf1}, {0x14,0x8e,0x59,0xf8},
-{0x37,0xbf,0x73,0xc7}, {0x3a,0xb4,0x7d,0xce}, {0x2d,0xa9,0x6f,0xd5}, {0x20,0xa2,0x61,0xdc},
-{0x6d,0xf6,0xad,0x76}, {0x60,0xfd,0xa3,0x7f}, {0x77,0xe0,0xb1,0x64}, {0x7a,0xeb,0xbf,0x6d},
-{0x59,0xda,0x95,0x52}, {0x54,0xd1,0x9b,0x5b}, {0x43,0xcc,0x89,0x40}, {0x4e,0xc7,0x87,0x49},
-{0x05,0xae,0xdd,0x3e}, {0x08,0xa5,0xd3,0x37}, {0x1f,0xb8,0xc1,0x2c}, {0x12,0xb3,0xcf,0x25},
-{0x31,0x82,0xe5,0x1a}, {0x3c,0x89,0xeb,0x13}, {0x2b,0x94,0xf9,0x08}, {0x26,0x9f,0xf7,0x01},
-{0xbd,0x46,0x4d,0xe6}, {0xb0,0x4d,0x43,0xef}, {0xa7,0x50,0x51,0xf4}, {0xaa,0x5b,0x5f,0xfd},
-{0x89,0x6a,0x75,0xc2}, {0x84,0x61,0x7b,0xcb}, {0x93,0x7c,0x69,0xd0}, {0x9e,0x77,0x67,0xd9},
-{0xd5,0x1e,0x3d,0xae}, {0xd8,0x15,0x33,0xa7}, {0xcf,0x08,0x21,0xbc}, {0xc2,0x03,0x2f,0xb5},
-{0xe1,0x32,0x05,0x8a}, {0xec,0x39,0x0b,0x83}, {0xfb,0x24,0x19,0x98}, {0xf6,0x2f,0x17,0x91},
-{0xd6,0x8d,0x76,0x4d}, {0xdb,0x86,0x78,0x44}, {0xcc,0x9b,0x6a,0x5f}, {0xc1,0x90,0x64,0x56},
-{0xe2,0xa1,0x4e,0x69}, {0xef,0xaa,0x40,0x60}, {0xf8,0xb7,0x52,0x7b}, {0xf5,0xbc,0x5c,0x72},
-{0xbe,0xd5,0x06,0x05}, {0xb3,0xde,0x08,0x0c}, {0xa4,0xc3,0x1a,0x17}, {0xa9,0xc8,0x14,0x1e},
-{0x8a,0xf9,0x3e,0x21}, {0x87,0xf2,0x30,0x28}, {0x90,0xef,0x22,0x33}, {0x9d,0xe4,0x2c,0x3a},
-{0x06,0x3d,0x96,0xdd}, {0x0b,0x36,0x98,0xd4}, {0x1c,0x2b,0x8a,0xcf}, {0x11,0x20,0x84,0xc6},
-{0x32,0x11,0xae,0xf9}, {0x3f,0x1a,0xa0,0xf0}, {0x28,0x07,0xb2,0xeb}, {0x25,0x0c,0xbc,0xe2},
-{0x6e,0x65,0xe6,0x95}, {0x63,0x6e,0xe8,0x9c}, {0x74,0x73,0xfa,0x87}, {0x79,0x78,0xf4,0x8e},
-{0x5a,0x49,0xde,0xb1}, {0x57,0x42,0xd0,0xb8}, {0x40,0x5f,0xc2,0xa3}, {0x4d,0x54,0xcc,0xaa},
-{0xda,0xf7,0x41,0xec}, {0xd7,0xfc,0x4f,0xe5}, {0xc0,0xe1,0x5d,0xfe}, {0xcd,0xea,0x53,0xf7},
-{0xee,0xdb,0x79,0xc8}, {0xe3,0xd0,0x77,0xc1}, {0xf4,0xcd,0x65,0xda}, {0xf9,0xc6,0x6b,0xd3},
-{0xb2,0xaf,0x31,0xa4}, {0xbf,0xa4,0x3f,0xad}, {0xa8,0xb9,0x2d,0xb6}, {0xa5,0xb2,0x23,0xbf},
-{0x86,0x83,0x09,0x80}, {0x8b,0x88,0x07,0x89}, {0x9c,0x95,0x15,0x92}, {0x91,0x9e,0x1b,0x9b},
-{0x0a,0x47,0xa1,0x7c}, {0x07,0x4c,0xaf,0x75}, {0x10,0x51,0xbd,0x6e}, {0x1d,0x5a,0xb3,0x67},
-{0x3e,0x6b,0x99,0x58}, {0x33,0x60,0x97,0x51}, {0x24,0x7d,0x85,0x4a}, {0x29,0x76,0x8b,0x43},
-{0x62,0x1f,0xd1,0x34}, {0x6f,0x14,0xdf,0x3d}, {0x78,0x09,0xcd,0x26}, {0x75,0x02,0xc3,0x2f},
-{0x56,0x33,0xe9,0x10}, {0x5b,0x38,0xe7,0x19}, {0x4c,0x25,0xf5,0x02}, {0x41,0x2e,0xfb,0x0b},
-{0x61,0x8c,0x9a,0xd7}, {0x6c,0x87,0x94,0xde}, {0x7b,0x9a,0x86,0xc5}, {0x76,0x91,0x88,0xcc},
-{0x55,0xa0,0xa2,0xf3}, {0x58,0xab,0xac,0xfa}, {0x4f,0xb6,0xbe,0xe1}, {0x42,0xbd,0xb0,0xe8},
-{0x09,0xd4,0xea,0x9f}, {0x04,0xdf,0xe4,0x96}, {0x13,0xc2,0xf6,0x8d}, {0x1e,0xc9,0xf8,0x84},
-{0x3d,0xf8,0xd2,0xbb}, {0x30,0xf3,0xdc,0xb2}, {0x27,0xee,0xce,0xa9}, {0x2a,0xe5,0xc0,0xa0},
-{0xb1,0x3c,0x7a,0x47}, {0xbc,0x37,0x74,0x4e}, {0xab,0x2a,0x66,0x55}, {0xa6,0x21,0x68,0x5c},
-{0x85,0x10,0x42,0x63}, {0x88,0x1b,0x4c,0x6a}, {0x9f,0x06,0x5e,0x71}, {0x92,0x0d,0x50,0x78},
-{0xd9,0x64,0x0a,0x0f}, {0xd4,0x6f,0x04,0x06}, {0xc3,0x72,0x16,0x1d}, {0xce,0x79,0x18,0x14},
-{0xed,0x48,0x32,0x2b}, {0xe0,0x43,0x3c,0x22}, {0xf7,0x5e,0x2e,0x39}, {0xfa,0x55,0x20,0x30},
-{0xb7,0x01,0xec,0x9a}, {0xba,0x0a,0xe2,0x93}, {0xad,0x17,0xf0,0x88}, {0xa0,0x1c,0xfe,0x81},
-{0x83,0x2d,0xd4,0xbe}, {0x8e,0x26,0xda,0xb7}, {0x99,0x3b,0xc8,0xac}, {0x94,0x30,0xc6,0xa5},
-{0xdf,0x59,0x9c,0xd2}, {0xd2,0x52,0x92,0xdb}, {0xc5,0x4f,0x80,0xc0}, {0xc8,0x44,0x8e,0xc9},
-{0xeb,0x75,0xa4,0xf6}, {0xe6,0x7e,0xaa,0xff}, {0xf1,0x63,0xb8,0xe4}, {0xfc,0x68,0xb6,0xed},
-{0x67,0xb1,0x0c,0x0a}, {0x6a,0xba,0x02,0x03}, {0x7d,0xa7,0x10,0x18}, {0x70,0xac,0x1e,0x11},
-{0x53,0x9d,0x34,0x2e}, {0x5e,0x96,0x3a,0x27}, {0x49,0x8b,0x28,0x3c}, {0x44,0x80,0x26,0x35},
-{0x0f,0xe9,0x7c,0x42}, {0x02,0xe2,0x72,0x4b}, {0x15,0xff,0x60,0x50}, {0x18,0xf4,0x6e,0x59},
-{0x3b,0xc5,0x44,0x66}, {0x36,0xce,0x4a,0x6f}, {0x21,0xd3,0x58,0x74}, {0x2c,0xd8,0x56,0x7d},
-{0x0c,0x7a,0x37,0xa1}, {0x01,0x71,0x39,0xa8}, {0x16,0x6c,0x2b,0xb3}, {0x1b,0x67,0x25,0xba},
-{0x38,0x56,0x0f,0x85}, {0x35,0x5d,0x01,0x8c}, {0x22,0x40,0x13,0x97}, {0x2f,0x4b,0x1d,0x9e},
-{0x64,0x22,0x47,0xe9}, {0x69,0x29,0x49,0xe0}, {0x7e,0x34,0x5b,0xfb}, {0x73,0x3f,0x55,0xf2},
-{0x50,0x0e,0x7f,0xcd}, {0x5d,0x05,0x71,0xc4}, {0x4a,0x18,0x63,0xdf}, {0x47,0x13,0x6d,0xd6},
-{0xdc,0xca,0xd7,0x31}, {0xd1,0xc1,0xd9,0x38}, {0xc6,0xdc,0xcb,0x23}, {0xcb,0xd7,0xc5,0x2a},
-{0xe8,0xe6,0xef,0x15}, {0xe5,0xed,0xe1,0x1c}, {0xf2,0xf0,0xf3,0x07}, {0xff,0xfb,0xfd,0x0e},
-{0xb4,0x92,0xa7,0x79}, {0xb9,0x99,0xa9,0x70}, {0xae,0x84,0xbb,0x6b}, {0xa3,0x8f,0xb5,0x62},
-{0x80,0xbe,0x9f,0x5d}, {0x8d,0xb5,0x91,0x54}, {0x9a,0xa8,0x83,0x4f}, {0x97,0xa3,0x8d,0x46}
-	}
-};
-#define	U3	xU3.xt8
-
-static const union xtab xU4 = {
-	.xt8 = {
-{0x00,0x00,0x00,0x00}, {0x09,0x0d,0x0b,0x0e}, {0x12,0x1a,0x16,0x1c}, {0x1b,0x17,0x1d,0x12},
-{0x24,0x34,0x2c,0x38}, {0x2d,0x39,0x27,0x36}, {0x36,0x2e,0x3a,0x24}, {0x3f,0x23,0x31,0x2a},
-{0x48,0x68,0x58,0x70}, {0x41,0x65,0x53,0x7e}, {0x5a,0x72,0x4e,0x6c}, {0x53,0x7f,0x45,0x62},
-{0x6c,0x5c,0x74,0x48}, {0x65,0x51,0x7f,0x46}, {0x7e,0x46,0x62,0x54}, {0x77,0x4b,0x69,0x5a},
-{0x90,0xd0,0xb0,0xe0}, {0x99,0xdd,0xbb,0xee}, {0x82,0xca,0xa6,0xfc}, {0x8b,0xc7,0xad,0xf2},
-{0xb4,0xe4,0x9c,0xd8}, {0xbd,0xe9,0x97,0xd6}, {0xa6,0xfe,0x8a,0xc4}, {0xaf,0xf3,0x81,0xca},
-{0xd8,0xb8,0xe8,0x90}, {0xd1,0xb5,0xe3,0x9e}, {0xca,0xa2,0xfe,0x8c}, {0xc3,0xaf,0xf5,0x82},
-{0xfc,0x8c,0xc4,0xa8}, {0xf5,0x81,0xcf,0xa6}, {0xee,0x96,0xd2,0xb4}, {0xe7,0x9b,0xd9,0xba},
-{0x3b,0xbb,0x7b,0xdb}, {0x32,0xb6,0x70,0xd5}, {0x29,0xa1,0x6d,0xc7}, {0x20,0xac,0x66,0xc9},
-{0x1f,0x8f,0x57,0xe3}, {0x16,0x82,0x5c,0xed}, {0x0d,0x95,0x41,0xff}, {0x04,0x98,0x4a,0xf1},
-{0x73,0xd3,0x23,0xab}, {0x7a,0xde,0x28,0xa5}, {0x61,0xc9,0x35,0xb7}, {0x68,0xc4,0x3e,0xb9},
-{0x57,0xe7,0x0f,0x93}, {0x5e,0xea,0x04,0x9d}, {0x45,0xfd,0x19,0x8f}, {0x4c,0xf0,0x12,0x81},
-{0xab,0x6b,0xcb,0x3b}, {0xa2,0x66,0xc0,0x35}, {0xb9,0x71,0xdd,0x27}, {0xb0,0x7c,0xd6,0x29},
-{0x8f,0x5f,0xe7,0x03}, {0x86,0x52,0xec,0x0d}, {0x9d,0x45,0xf1,0x1f}, {0x94,0x48,0xfa,0x11},
-{0xe3,0x03,0x93,0x4b}, {0xea,0x0e,0x98,0x45}, {0xf1,0x19,0x85,0x57}, {0xf8,0x14,0x8e,0x59},
-{0xc7,0x37,0xbf,0x73}, {0xce,0x3a,0xb4,0x7d}, {0xd5,0x2d,0xa9,0x6f}, {0xdc,0x20,0xa2,0x61},
-{0x76,0x6d,0xf6,0xad}, {0x7f,0x60,0xfd,0xa3}, {0x64,0x77,0xe0,0xb1}, {0x6d,0x7a,0xeb,0xbf},
-{0x52,0x59,0xda,0x95}, {0x5b,0x54,0xd1,0x9b}, {0x40,0x43,0xcc,0x89}, {0x49,0x4e,0xc7,0x87},
-{0x3e,0x05,0xae,0xdd}, {0x37,0x08,0xa5,0xd3}, {0x2c,0x1f,0xb8,0xc1}, {0x25,0x12,0xb3,0xcf},
-{0x1a,0x31,0x82,0xe5}, {0x13,0x3c,0x89,0xeb}, {0x08,0x2b,0x94,0xf9}, {0x01,0x26,0x9f,0xf7},
-{0xe6,0xbd,0x46,0x4d}, {0xef,0xb0,0x4d,0x43}, {0xf4,0xa7,0x50,0x51}, {0xfd,0xaa,0x5b,0x5f},
-{0xc2,0x89,0x6a,0x75}, {0xcb,0x84,0x61,0x7b}, {0xd0,0x93,0x7c,0x69}, {0xd9,0x9e,0x77,0x67},
-{0xae,0xd5,0x1e,0x3d}, {0xa7,0xd8,0x15,0x33}, {0xbc,0xcf,0x08,0x21}, {0xb5,0xc2,0x03,0x2f},
-{0x8a,0xe1,0x32,0x05}, {0x83,0xec,0x39,0x0b}, {0x98,0xfb,0x24,0x19}, {0x91,0xf6,0x2f,0x17},
-{0x4d,0xd6,0x8d,0x76}, {0x44,0xdb,0x86,0x78}, {0x5f,0xcc,0x9b,0x6a}, {0x56,0xc1,0x90,0x64},
-{0x69,0xe2,0xa1,0x4e}, {0x60,0xef,0xaa,0x40}, {0x7b,0xf8,0xb7,0x52}, {0x72,0xf5,0xbc,0x5c},
-{0x05,0xbe,0xd5,0x06}, {0x0c,0xb3,0xde,0x08}, {0x17,0xa4,0xc3,0x1a}, {0x1e,0xa9,0xc8,0x14},
-{0x21,0x8a,0xf9,0x3e}, {0x28,0x87,0xf2,0x30}, {0x33,0x90,0xef,0x22}, {0x3a,0x9d,0xe4,0x2c},
-{0xdd,0x06,0x3d,0x96}, {0xd4,0x0b,0x36,0x98}, {0xcf,0x1c,0x2b,0x8a}, {0xc6,0x11,0x20,0x84},
-{0xf9,0x32,0x11,0xae}, {0xf0,0x3f,0x1a,0xa0}, {0xeb,0x28,0x07,0xb2}, {0xe2,0x25,0x0c,0xbc},
-{0x95,0x6e,0x65,0xe6}, {0x9c,0x63,0x6e,0xe8}, {0x87,0x74,0x73,0xfa}, {0x8e,0x79,0x78,0xf4},
-{0xb1,0x5a,0x49,0xde}, {0xb8,0x57,0x42,0xd0}, {0xa3,0x40,0x5f,0xc2}, {0xaa,0x4d,0x54,0xcc},
-{0xec,0xda,0xf7,0x41}, {0xe5,0xd7,0xfc,0x4f}, {0xfe,0xc0,0xe1,0x5d}, {0xf7,0xcd,0xea,0x53},
-{0xc8,0xee,0xdb,0x79}, {0xc1,0xe3,0xd0,0x77}, {0xda,0xf4,0xcd,0x65}, {0xd3,0xf9,0xc6,0x6b},
-{0xa4,0xb2,0xaf,0x31}, {0xad,0xbf,0xa4,0x3f}, {0xb6,0xa8,0xb9,0x2d}, {0xbf,0xa5,0xb2,0x23},
-{0x80,0x86,0x83,0x09}, {0x89,0x8b,0x88,0x07}, {0x92,0x9c,0x95,0x15}, {0x9b,0x91,0x9e,0x1b},
-{0x7c,0x0a,0x47,0xa1}, {0x75,0x07,0x4c,0xaf}, {0x6e,0x10,0x51,0xbd}, {0x67,0x1d,0x5a,0xb3},
-{0x58,0x3e,0x6b,0x99}, {0x51,0x33,0x60,0x97}, {0x4a,0x24,0x7d,0x85}, {0x43,0x29,0x76,0x8b},
-{0x34,0x62,0x1f,0xd1}, {0x3d,0x6f,0x14,0xdf}, {0x26,0x78,0x09,0xcd}, {0x2f,0x75,0x02,0xc3},
-{0x10,0x56,0x33,0xe9}, {0x19,0x5b,0x38,0xe7}, {0x02,0x4c,0x25,0xf5}, {0x0b,0x41,0x2e,0xfb},
-{0xd7,0x61,0x8c,0x9a}, {0xde,0x6c,0x87,0x94}, {0xc5,0x7b,0x9a,0x86}, {0xcc,0x76,0x91,0x88},
-{0xf3,0x55,0xa0,0xa2}, {0xfa,0x58,0xab,0xac}, {0xe1,0x4f,0xb6,0xbe}, {0xe8,0x42,0xbd,0xb0},
-{0x9f,0x09,0xd4,0xea}, {0x96,0x04,0xdf,0xe4}, {0x8d,0x13,0xc2,0xf6}, {0x84,0x1e,0xc9,0xf8},
-{0xbb,0x3d,0xf8,0xd2}, {0xb2,0x30,0xf3,0xdc}, {0xa9,0x27,0xee,0xce}, {0xa0,0x2a,0xe5,0xc0},
-{0x47,0xb1,0x3c,0x7a}, {0x4e,0xbc,0x37,0x74}, {0x55,0xab,0x2a,0x66}, {0x5c,0xa6,0x21,0x68},
-{0x63,0x85,0x10,0x42}, {0x6a,0x88,0x1b,0x4c}, {0x71,0x9f,0x06,0x5e}, {0x78,0x92,0x0d,0x50},
-{0x0f,0xd9,0x64,0x0a}, {0x06,0xd4,0x6f,0x04}, {0x1d,0xc3,0x72,0x16}, {0x14,0xce,0x79,0x18},
-{0x2b,0xed,0x48,0x32}, {0x22,0xe0,0x43,0x3c}, {0x39,0xf7,0x5e,0x2e}, {0x30,0xfa,0x55,0x20},
-{0x9a,0xb7,0x01,0xec}, {0x93,0xba,0x0a,0xe2}, {0x88,0xad,0x17,0xf0}, {0x81,0xa0,0x1c,0xfe},
-{0xbe,0x83,0x2d,0xd4}, {0xb7,0x8e,0x26,0xda}, {0xac,0x99,0x3b,0xc8}, {0xa5,0x94,0x30,0xc6},
-{0xd2,0xdf,0x59,0x9c}, {0xdb,0xd2,0x52,0x92}, {0xc0,0xc5,0x4f,0x80}, {0xc9,0xc8,0x44,0x8e},
-{0xf6,0xeb,0x75,0xa4}, {0xff,0xe6,0x7e,0xaa}, {0xe4,0xf1,0x63,0xb8}, {0xed,0xfc,0x68,0xb6},
-{0x0a,0x67,0xb1,0x0c}, {0x03,0x6a,0xba,0x02}, {0x18,0x7d,0xa7,0x10}, {0x11,0x70,0xac,0x1e},
-{0x2e,0x53,0x9d,0x34}, {0x27,0x5e,0x96,0x3a}, {0x3c,0x49,0x8b,0x28}, {0x35,0x44,0x80,0x26},
-{0x42,0x0f,0xe9,0x7c}, {0x4b,0x02,0xe2,0x72}, {0x50,0x15,0xff,0x60}, {0x59,0x18,0xf4,0x6e},
-{0x66,0x3b,0xc5,0x44}, {0x6f,0x36,0xce,0x4a}, {0x74,0x21,0xd3,0x58}, {0x7d,0x2c,0xd8,0x56},
-{0xa1,0x0c,0x7a,0x37}, {0xa8,0x01,0x71,0x39}, {0xb3,0x16,0x6c,0x2b}, {0xba,0x1b,0x67,0x25},
-{0x85,0x38,0x56,0x0f}, {0x8c,0x35,0x5d,0x01}, {0x97,0x22,0x40,0x13}, {0x9e,0x2f,0x4b,0x1d},
-{0xe9,0x64,0x22,0x47}, {0xe0,0x69,0x29,0x49}, {0xfb,0x7e,0x34,0x5b}, {0xf2,0x73,0x3f,0x55},
-{0xcd,0x50,0x0e,0x7f}, {0xc4,0x5d,0x05,0x71}, {0xdf,0x4a,0x18,0x63}, {0xd6,0x47,0x13,0x6d},
-{0x31,0xdc,0xca,0xd7}, {0x38,0xd1,0xc1,0xd9}, {0x23,0xc6,0xdc,0xcb}, {0x2a,0xcb,0xd7,0xc5},
-{0x15,0xe8,0xe6,0xef}, {0x1c,0xe5,0xed,0xe1}, {0x07,0xf2,0xf0,0xf3}, {0x0e,0xff,0xfb,0xfd},
-{0x79,0xb4,0x92,0xa7}, {0x70,0xb9,0x99,0xa9}, {0x6b,0xae,0x84,0xbb}, {0x62,0xa3,0x8f,0xb5},
-{0x5d,0x80,0xbe,0x9f}, {0x54,0x8d,0xb5,0x91}, {0x4f,0x9a,0xa8,0x83}, {0x46,0x97,0xa3,0x8d}
-	}
-};
-#define	U4	xU4.xt8
-
-static const word32 rcon[30] = { 
-  0x01,0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef, 0xc5, 0x91
-};
diff --git a/src/racoon/missing/crypto/rijndael/rijndael-alg-fst.c b/src/racoon/missing/crypto/rijndael/rijndael-alg-fst.c
deleted file mode 100644
index 7e48d44..0000000
--- a/src/racoon/missing/crypto/rijndael/rijndael-alg-fst.c
+++ /dev/null
@@ -1,496 +0,0 @@
-/*	$NetBSD: rijndael-alg-fst.c,v 1.4 2006/09/09 16:22:36 manu Exp $	*/
-
-/*	$KAME: rijndael-alg-fst.c,v 1.1.1.1 2001/08/08 09:56:23 sakane Exp $	*/
-
-/*
- * rijndael-alg-fst.c   v2.3   April '2000
- *
- * Optimised ANSI C code
- *
- * authors: v1.0: Antoon Bosselaers
- *          v2.0: Vincent Rijmen
- *          v2.3: Paulo Barreto
- *
- * This code is placed in the public domain.
- */
-
-#include "config.h"
-
-#include <sys/cdefs.h>
-#include <sys/types.h>
-#ifdef _KERNEL
-#include <sys/systm.h>
-#else
-#include <string.h>
-#endif
-#include <crypto/rijndael/rijndael-alg-fst.h>
-#include <crypto/rijndael/rijndael_local.h>
-
-#include <crypto/rijndael/boxes-fst.dat>
-
-#include <err.h>
-#define bcopy(a, b, c) memcpy((b), (a), (c))
-#define bzero(a, b) memset((a), 0, (b))
-#define panic(a) err(1, (a))
-
-int rijndaelKeySched(word8 k[MAXKC][4], word8 W[MAXROUNDS+1][4][4], int ROUNDS) {
-	/* Calculate the necessary round keys
-	 * The number of calculations depends on keyBits and blockBits
-	 */ 
-	int j, r, t, rconpointer = 0;
-	union {
-		word8	x8[MAXKC][4];
-		word32	x32[MAXKC];
-	} xtk;
-#define	tk	xtk.x8
-	int KC = ROUNDS - 6;
-
-	for (j = KC-1; j >= 0; j--) {
-		*((word32*)tk[j]) = *((word32*)k[j]);
-	}
-	r = 0;
-	t = 0;
-	/* copy values into round key array */
-	for (j = 0; (j < KC) && (r < ROUNDS + 1); ) {
-		for (; (j < KC) && (t < 4); j++, t++) {
-			*((word32*)W[r][t]) = *((word32*)tk[j]);
-		}
-		if (t == 4) {
-			r++;
-			t = 0;
-		}
-	}
-		
-	while (r < ROUNDS + 1) { /* while not enough round key material calculated */
-		/* calculate new values */
-		tk[0][0] ^= S[tk[KC-1][1]];
-		tk[0][1] ^= S[tk[KC-1][2]];
-		tk[0][2] ^= S[tk[KC-1][3]];
-		tk[0][3] ^= S[tk[KC-1][0]];
-		tk[0][0] ^= rcon[rconpointer++];
-
-		if (KC != 8) {
-			for (j = 1; j < KC; j++) {
-				*((word32*)tk[j]) ^= *((word32*)tk[j-1]);
-			}
-		} else {
-			for (j = 1; j < KC/2; j++) {
-				*((word32*)tk[j]) ^= *((word32*)tk[j-1]);
-			}
-			tk[KC/2][0] ^= S[tk[KC/2 - 1][0]];
-			tk[KC/2][1] ^= S[tk[KC/2 - 1][1]];
-			tk[KC/2][2] ^= S[tk[KC/2 - 1][2]];
-			tk[KC/2][3] ^= S[tk[KC/2 - 1][3]];
-			for (j = KC/2 + 1; j < KC; j++) {
-				*((word32*)tk[j]) ^= *((word32*)tk[j-1]);
-			}
-		}
-		/* copy values into round key array */
-		for (j = 0; (j < KC) && (r < ROUNDS + 1); ) {
-			for (; (j < KC) && (t < 4); j++, t++) {
-				*((word32*)W[r][t]) = *((word32*)tk[j]);
-			}
-			if (t == 4) {
-				r++;
-				t = 0;
-			}
-		}
-	}		
-	return 0;
-#undef tk
-}
-
-int rijndaelKeyEncToDec(word8 W[MAXROUNDS+1][4][4], int ROUNDS) {
-	int r;
-	word8 *w;
-
-	for (r = 1; r < ROUNDS; r++) {
-		w = W[r][0];
-		*((word32*)w) =
-			  *((const word32*)U1[w[0]])
-			^ *((const word32*)U2[w[1]])
-			^ *((const word32*)U3[w[2]])
-			^ *((const word32*)U4[w[3]]);
-
-		w = W[r][1];
-		*((word32*)w) =
-			  *((const word32*)U1[w[0]])
-			^ *((const word32*)U2[w[1]])
-			^ *((const word32*)U3[w[2]])
-			^ *((const word32*)U4[w[3]]);
-
-		w = W[r][2];
-		*((word32*)w) =
-			  *((const word32*)U1[w[0]])
-			^ *((const word32*)U2[w[1]])
-			^ *((const word32*)U3[w[2]])
-			^ *((const word32*)U4[w[3]]);
-
-		w = W[r][3];
-		*((word32*)w) =
-			  *((const word32*)U1[w[0]])
-			^ *((const word32*)U2[w[1]])
-			^ *((const word32*)U3[w[2]])
-			^ *((const word32*)U4[w[3]]);
-	}
-	return 0;
-}	
-
-/**
- * Encrypt a single block. 
- */
-int rijndaelEncrypt(word8 in[16], word8 out[16], word8 rk[MAXROUNDS+1][4][4], int ROUNDS) {
-	int r;
-	union {
-		word8	x8[16];
-		word32	x32[4];
-	} xa, xb;
-#define	a	xa.x8
-#define	b	xb.x8
-	union {
-		word8	x8[4][4];
-		word32	x32[4];
-	} xtemp;
-#define	temp	xtemp.x8
-
-    memcpy(a, in, sizeof a);
-
-    *((word32*)temp[0]) = *((word32*)(a   )) ^ *((word32*)rk[0][0]);
-    *((word32*)temp[1]) = *((word32*)(a+ 4)) ^ *((word32*)rk[0][1]);
-    *((word32*)temp[2]) = *((word32*)(a+ 8)) ^ *((word32*)rk[0][2]);
-    *((word32*)temp[3]) = *((word32*)(a+12)) ^ *((word32*)rk[0][3]);
-    *((word32*)(b    )) = *((const word32*)T1[temp[0][0]])
-					^ *((const word32*)T2[temp[1][1]])
-					^ *((const word32*)T3[temp[2][2]]) 
-					^ *((const word32*)T4[temp[3][3]]);
-    *((word32*)(b + 4)) = *((const word32*)T1[temp[1][0]])
-					^ *((const word32*)T2[temp[2][1]])
-					^ *((const word32*)T3[temp[3][2]]) 
-					^ *((const word32*)T4[temp[0][3]]);
-    *((word32*)(b + 8)) = *((const word32*)T1[temp[2][0]])
-					^ *((const word32*)T2[temp[3][1]])
-					^ *((const word32*)T3[temp[0][2]]) 
-					^ *((const word32*)T4[temp[1][3]]);
-    *((word32*)(b +12)) = *((const word32*)T1[temp[3][0]])
-					^ *((const word32*)T2[temp[0][1]])
-					^ *((const word32*)T3[temp[1][2]]) 
-					^ *((const word32*)T4[temp[2][3]]);
-	for (r = 1; r < ROUNDS-1; r++) {
-		*((word32*)temp[0]) = *((word32*)(b   )) ^ *((word32*)rk[r][0]);
-		*((word32*)temp[1]) = *((word32*)(b+ 4)) ^ *((word32*)rk[r][1]);
-		*((word32*)temp[2]) = *((word32*)(b+ 8)) ^ *((word32*)rk[r][2]);
-		*((word32*)temp[3]) = *((word32*)(b+12)) ^ *((word32*)rk[r][3]);
-
-		*((word32*)(b    )) = *((const word32*)T1[temp[0][0]])
-					^ *((const word32*)T2[temp[1][1]])
-					^ *((const word32*)T3[temp[2][2]]) 
-					^ *((const word32*)T4[temp[3][3]]);
-		*((word32*)(b + 4)) = *((const word32*)T1[temp[1][0]])
-					^ *((const word32*)T2[temp[2][1]])
-					^ *((const word32*)T3[temp[3][2]]) 
-					^ *((const word32*)T4[temp[0][3]]);
-		*((word32*)(b + 8)) = *((const word32*)T1[temp[2][0]])
-					^ *((const word32*)T2[temp[3][1]])
-					^ *((const word32*)T3[temp[0][2]]) 
-					^ *((const word32*)T4[temp[1][3]]);
-		*((word32*)(b +12)) = *((const word32*)T1[temp[3][0]])
-					^ *((const word32*)T2[temp[0][1]])
-					^ *((const word32*)T3[temp[1][2]]) 
-					^ *((const word32*)T4[temp[2][3]]);
-	}
-	/* last round is special */   
-	*((word32*)temp[0]) = *((word32*)(b   )) ^ *((word32*)rk[ROUNDS-1][0]);
-	*((word32*)temp[1]) = *((word32*)(b+ 4)) ^ *((word32*)rk[ROUNDS-1][1]);
-	*((word32*)temp[2]) = *((word32*)(b+ 8)) ^ *((word32*)rk[ROUNDS-1][2]);
-	*((word32*)temp[3]) = *((word32*)(b+12)) ^ *((word32*)rk[ROUNDS-1][3]);
-	b[ 0] = T1[temp[0][0]][1];
-	b[ 1] = T1[temp[1][1]][1];
-	b[ 2] = T1[temp[2][2]][1];
-	b[ 3] = T1[temp[3][3]][1];
-	b[ 4] = T1[temp[1][0]][1];
-	b[ 5] = T1[temp[2][1]][1];
-	b[ 6] = T1[temp[3][2]][1];
-	b[ 7] = T1[temp[0][3]][1];
-	b[ 8] = T1[temp[2][0]][1];
-	b[ 9] = T1[temp[3][1]][1];
-	b[10] = T1[temp[0][2]][1];
-	b[11] = T1[temp[1][3]][1];
-	b[12] = T1[temp[3][0]][1];
-	b[13] = T1[temp[0][1]][1];
-	b[14] = T1[temp[1][2]][1];
-	b[15] = T1[temp[2][3]][1];
-	*((word32*)(b   )) ^= *((word32*)rk[ROUNDS][0]);
-	*((word32*)(b+ 4)) ^= *((word32*)rk[ROUNDS][1]);
-	*((word32*)(b+ 8)) ^= *((word32*)rk[ROUNDS][2]);
-	*((word32*)(b+12)) ^= *((word32*)rk[ROUNDS][3]);
-
-	memcpy(out, b, sizeof b /* XXX out */);
-
-	return 0;
-#undef a
-#undef b
-#undef temp
-}
-
-#ifdef INTERMEDIATE_VALUE_KAT
-/**
- * Encrypt only a certain number of rounds.
- * Only used in the Intermediate Value Known Answer Test.
- */
-int rijndaelEncryptRound(word8 a[4][4], word8 rk[MAXROUNDS+1][4][4], int ROUNDS, int rounds) {
-	int r;
-	word8 temp[4][4];
-
-	/* make number of rounds sane */
-	if (rounds > ROUNDS) {
-		rounds = ROUNDS;
-	}
-
-	*((word32*)a[0]) = *((word32*)a[0]) ^ *((word32*)rk[0][0]);
-	*((word32*)a[1]) = *((word32*)a[1]) ^ *((word32*)rk[0][1]);
-	*((word32*)a[2]) = *((word32*)a[2]) ^ *((word32*)rk[0][2]);
-	*((word32*)a[3]) = *((word32*)a[3]) ^ *((word32*)rk[0][3]);
-
-	for (r = 1; (r <= rounds) && (r < ROUNDS); r++) {
-		*((word32*)temp[0]) = *((const word32*)T1[a[0][0]])
-					   ^ *((const word32*)T2[a[1][1]])
-					   ^ *((const word32*)T3[a[2][2]]) 
-					   ^ *((const word32*)T4[a[3][3]]);
-		*((word32*)temp[1]) = *((const word32*)T1[a[1][0]])
-					   ^ *((const word32*)T2[a[2][1]])
-					   ^ *((const word32*)T3[a[3][2]]) 
-					   ^ *((const word32*)T4[a[0][3]]);
-		*((word32*)temp[2]) = *((const word32*)T1[a[2][0]])
-					   ^ *((const word32*)T2[a[3][1]])
-					   ^ *((const word32*)T3[a[0][2]]) 
-					   ^ *((const word32*)T4[a[1][3]]);
-		*((word32*)temp[3]) = *((const word32*)T1[a[3][0]])
-					   ^ *((const word32*)T2[a[0][1]])
-					   ^ *((const word32*)T3[a[1][2]]) 
-					   ^ *((const word32*)T4[a[2][3]]);
-		*((word32*)a[0]) = *((word32*)temp[0]) ^ *((word32*)rk[r][0]);
-		*((word32*)a[1]) = *((word32*)temp[1]) ^ *((word32*)rk[r][1]);
-		*((word32*)a[2]) = *((word32*)temp[2]) ^ *((word32*)rk[r][2]);
-		*((word32*)a[3]) = *((word32*)temp[3]) ^ *((word32*)rk[r][3]);
-	}
-	if (rounds == ROUNDS) {
-	   	/* last round is special */   
-	   	temp[0][0] = T1[a[0][0]][1];
-	   	temp[0][1] = T1[a[1][1]][1];
-	   	temp[0][2] = T1[a[2][2]][1]; 
-	   	temp[0][3] = T1[a[3][3]][1];
-	   	temp[1][0] = T1[a[1][0]][1];
-	   	temp[1][1] = T1[a[2][1]][1];
-	   	temp[1][2] = T1[a[3][2]][1]; 
-	   	temp[1][3] = T1[a[0][3]][1];
-	   	temp[2][0] = T1[a[2][0]][1];
-	   	temp[2][1] = T1[a[3][1]][1];
-	   	temp[2][2] = T1[a[0][2]][1]; 
-	   	temp[2][3] = T1[a[1][3]][1];
-	   	temp[3][0] = T1[a[3][0]][1];
-	   	temp[3][1] = T1[a[0][1]][1];
-	   	temp[3][2] = T1[a[1][2]][1]; 
-	   	temp[3][3] = T1[a[2][3]][1];
-		*((word32*)a[0]) = *((word32*)temp[0]) ^ *((word32*)rk[ROUNDS][0]);
-		*((word32*)a[1]) = *((word32*)temp[1]) ^ *((word32*)rk[ROUNDS][1]);
-		*((word32*)a[2]) = *((word32*)temp[2]) ^ *((word32*)rk[ROUNDS][2]);
-		*((word32*)a[3]) = *((word32*)temp[3]) ^ *((word32*)rk[ROUNDS][3]);
-	}
-
-	return 0;
-}   
-#endif /* INTERMEDIATE_VALUE_KAT */
-
-/**
- * Decrypt a single block.
- */
-int rijndaelDecrypt(word8 in[16], word8 out[16], word8 rk[MAXROUNDS+1][4][4], int ROUNDS) {
-	int r;
-	union {
-		word8	x8[16];
-		word32	x32[4];
-	} xa, xb;
-#define	a	xa.x8
-#define	b	xb.x8
-	union {
-		word8	x8[4][4];
-		word32	x32[4];
-	} xtemp;
-#define	temp	xtemp.x8
-	
-    memcpy(a, in, sizeof a);
-
-    *((word32*)temp[0]) = *((word32*)(a   )) ^ *((word32*)rk[ROUNDS][0]);
-    *((word32*)temp[1]) = *((word32*)(a+ 4)) ^ *((word32*)rk[ROUNDS][1]);
-    *((word32*)temp[2]) = *((word32*)(a+ 8)) ^ *((word32*)rk[ROUNDS][2]);
-    *((word32*)temp[3]) = *((word32*)(a+12)) ^ *((word32*)rk[ROUNDS][3]);
-
-    *((word32*)(b   )) = *((const word32*)T5[temp[0][0]])
-           ^ *((const word32*)T6[temp[3][1]])
-           ^ *((const word32*)T7[temp[2][2]]) 
-           ^ *((const word32*)T8[temp[1][3]]);
-	*((word32*)(b+ 4)) = *((const word32*)T5[temp[1][0]])
-           ^ *((const word32*)T6[temp[0][1]])
-           ^ *((const word32*)T7[temp[3][2]]) 
-           ^ *((const word32*)T8[temp[2][3]]);
-	*((word32*)(b+ 8)) = *((const word32*)T5[temp[2][0]])
-           ^ *((const word32*)T6[temp[1][1]])
-           ^ *((const word32*)T7[temp[0][2]]) 
-           ^ *((const word32*)T8[temp[3][3]]);
-	*((word32*)(b+12)) = *((const word32*)T5[temp[3][0]])
-           ^ *((const word32*)T6[temp[2][1]])
-           ^ *((const word32*)T7[temp[1][2]]) 
-           ^ *((const word32*)T8[temp[0][3]]);
-	for (r = ROUNDS-1; r > 1; r--) {
-		*((word32*)temp[0]) = *((word32*)(b   )) ^ *((word32*)rk[r][0]);
-		*((word32*)temp[1]) = *((word32*)(b+ 4)) ^ *((word32*)rk[r][1]);
-		*((word32*)temp[2]) = *((word32*)(b+ 8)) ^ *((word32*)rk[r][2]);
-		*((word32*)temp[3]) = *((word32*)(b+12)) ^ *((word32*)rk[r][3]);
-		*((word32*)(b   )) = *((const word32*)T5[temp[0][0]])
-		   ^ *((const word32*)T6[temp[3][1]])
-		   ^ *((const word32*)T7[temp[2][2]]) 
-		   ^ *((const word32*)T8[temp[1][3]]);
-		*((word32*)(b+ 4)) = *((const word32*)T5[temp[1][0]])
-		   ^ *((const word32*)T6[temp[0][1]])
-		   ^ *((const word32*)T7[temp[3][2]]) 
-		   ^ *((const word32*)T8[temp[2][3]]);
-		*((word32*)(b+ 8)) = *((const word32*)T5[temp[2][0]])
-		   ^ *((const word32*)T6[temp[1][1]])
-		   ^ *((const word32*)T7[temp[0][2]]) 
-		   ^ *((const word32*)T8[temp[3][3]]);
-		*((word32*)(b+12)) = *((const word32*)T5[temp[3][0]])
-		   ^ *((const word32*)T6[temp[2][1]])
-		   ^ *((const word32*)T7[temp[1][2]]) 
-		   ^ *((const word32*)T8[temp[0][3]]);
-	}
-	/* last round is special */   
-	*((word32*)temp[0]) = *((word32*)(b   )) ^ *((word32*)rk[1][0]);
-	*((word32*)temp[1]) = *((word32*)(b+ 4)) ^ *((word32*)rk[1][1]);
-	*((word32*)temp[2]) = *((word32*)(b+ 8)) ^ *((word32*)rk[1][2]);
-	*((word32*)temp[3]) = *((word32*)(b+12)) ^ *((word32*)rk[1][3]);
-	b[ 0] = S5[temp[0][0]];
-	b[ 1] = S5[temp[3][1]];
-	b[ 2] = S5[temp[2][2]];
-	b[ 3] = S5[temp[1][3]];
-	b[ 4] = S5[temp[1][0]];
-	b[ 5] = S5[temp[0][1]];
-	b[ 6] = S5[temp[3][2]];
-	b[ 7] = S5[temp[2][3]];
-	b[ 8] = S5[temp[2][0]];
-	b[ 9] = S5[temp[1][1]];
-	b[10] = S5[temp[0][2]];
-	b[11] = S5[temp[3][3]];
-	b[12] = S5[temp[3][0]];
-	b[13] = S5[temp[2][1]];
-	b[14] = S5[temp[1][2]];
-	b[15] = S5[temp[0][3]];
-	*((word32*)(b   )) ^= *((word32*)rk[0][0]);
-	*((word32*)(b+ 4)) ^= *((word32*)rk[0][1]);
-	*((word32*)(b+ 8)) ^= *((word32*)rk[0][2]);
-	*((word32*)(b+12)) ^= *((word32*)rk[0][3]);
-
-	memcpy(out, b, sizeof b /* XXX out */);
-
-	return 0;
-#undef a
-#undef b
-#undef temp
-}
-
-
-#ifdef INTERMEDIATE_VALUE_KAT
-/**
- * Decrypt only a certain number of rounds.
- * Only used in the Intermediate Value Known Answer Test.
- * Operations rearranged such that the intermediate values
- * of decryption correspond with the intermediate values
- * of encryption.
- */
-int rijndaelDecryptRound(word8 a[4][4], word8 rk[MAXROUNDS+1][4][4], int ROUNDS, int rounds) {
-	int r, i;
-	word8 temp[4], shift;
-
-	/* make number of rounds sane */
-	if (rounds > ROUNDS) {
-		rounds = ROUNDS;
-	}
-    /* first round is special: */
-	*(word32 *)a[0] ^= *(word32 *)rk[ROUNDS][0];
-	*(word32 *)a[1] ^= *(word32 *)rk[ROUNDS][1];
-	*(word32 *)a[2] ^= *(word32 *)rk[ROUNDS][2];
-	*(word32 *)a[3] ^= *(word32 *)rk[ROUNDS][3];
-	for (i = 0; i < 4; i++) {
-		a[i][0] = Si[a[i][0]];
-		a[i][1] = Si[a[i][1]];
-		a[i][2] = Si[a[i][2]];
-		a[i][3] = Si[a[i][3]];
-	}
-	for (i = 1; i < 4; i++) {
-		shift = (4 - i) & 3;
-		temp[0] = a[(0 + shift) & 3][i];
-		temp[1] = a[(1 + shift) & 3][i];
-		temp[2] = a[(2 + shift) & 3][i];
-		temp[3] = a[(3 + shift) & 3][i];
-		a[0][i] = temp[0];
-		a[1][i] = temp[1];
-		a[2][i] = temp[2];
-		a[3][i] = temp[3];
-	}
-	/* ROUNDS-1 ordinary rounds */
-	for (r = ROUNDS-1; r > rounds; r--) {
-		*(word32 *)a[0] ^= *(word32 *)rk[r][0];
-		*(word32 *)a[1] ^= *(word32 *)rk[r][1];
-		*(word32 *)a[2] ^= *(word32 *)rk[r][2];
-		*(word32 *)a[3] ^= *(word32 *)rk[r][3];
-
-		*((word32*)a[0]) =
-			  *((const word32*)U1[a[0][0]])
-			^ *((const word32*)U2[a[0][1]])
-			^ *((const word32*)U3[a[0][2]])
-			^ *((const word32*)U4[a[0][3]]);
-
-		*((word32*)a[1]) =
-			  *((const word32*)U1[a[1][0]])
-			^ *((const word32*)U2[a[1][1]])
-			^ *((const word32*)U3[a[1][2]])
-			^ *((const word32*)U4[a[1][3]]);
-
-		*((word32*)a[2]) =
-			  *((const word32*)U1[a[2][0]])
-			^ *((const word32*)U2[a[2][1]])
-			^ *((const word32*)U3[a[2][2]])
-			^ *((const word32*)U4[a[2][3]]);
-
-		*((word32*)a[3]) =
-			  *((const word32*)U1[a[3][0]])
-			^ *((const word32*)U2[a[3][1]])
-			^ *((const word32*)U3[a[3][2]])
-			^ *((const word32*)U4[a[3][3]]);
-		for (i = 0; i < 4; i++) {
-			a[i][0] = Si[a[i][0]];
-			a[i][1] = Si[a[i][1]];
-			a[i][2] = Si[a[i][2]];
-			a[i][3] = Si[a[i][3]];
-		}
-		for (i = 1; i < 4; i++) {
-			shift = (4 - i) & 3;
-			temp[0] = a[(0 + shift) & 3][i];
-			temp[1] = a[(1 + shift) & 3][i];
-			temp[2] = a[(2 + shift) & 3][i];
-			temp[3] = a[(3 + shift) & 3][i];
-			a[0][i] = temp[0];
-			a[1][i] = temp[1];
-			a[2][i] = temp[2];
-			a[3][i] = temp[3];
-		}
-	}
-	if (rounds == 0) {
-		/* End with the extra key addition */	
-		*(word32 *)a[0] ^= *(word32 *)rk[0][0];
-		*(word32 *)a[1] ^= *(word32 *)rk[0][1];
-		*(word32 *)a[2] ^= *(word32 *)rk[0][2];
-		*(word32 *)a[3] ^= *(word32 *)rk[0][3];
-	}    
-	return 0;
-}
-#endif /* INTERMEDIATE_VALUE_KAT */
diff --git a/src/racoon/missing/crypto/rijndael/rijndael-alg-fst.h b/src/racoon/missing/crypto/rijndael/rijndael-alg-fst.h
deleted file mode 100644
index 4afeca1..0000000
--- a/src/racoon/missing/crypto/rijndael/rijndael-alg-fst.h
+++ /dev/null
@@ -1,35 +0,0 @@
-/*	$NetBSD: rijndael-alg-fst.h,v 1.4 2006/09/09 16:22:36 manu Exp $	*/
-
-/*	$KAME: rijndael-alg-fst.h,v 1.1.1.1 2001/08/08 09:56:23 sakane Exp $	*/
-
-/*
- * rijndael-alg-fst.h   v2.3   April '2000
- *
- * Optimised ANSI C code
- *
- * #define INTERMEDIATE_VALUE_KAT to generate the Intermediate Value Known Answer Test.
- */
-
-#ifndef __RIJNDAEL_ALG_FST_H
-#define __RIJNDAEL_ALG_FST_H
-
-#define RIJNDAEL_MAXKC			(256/32)
-#define RIJNDAEL_MAXROUNDS		14
-
-int rijndaelKeySched(u_int8_t k[RIJNDAEL_MAXKC][4], u_int8_t rk[RIJNDAEL_MAXROUNDS+1][4][4], int ROUNDS);
-
-int rijndaelKeyEncToDec(u_int8_t W[RIJNDAEL_MAXROUNDS+1][4][4], int ROUNDS);
-
-int rijndaelEncrypt(u_int8_t a[16], u_int8_t b[16], u_int8_t rk[RIJNDAEL_MAXROUNDS+1][4][4], int ROUNDS);
-
-#ifdef INTERMEDIATE_VALUE_KAT
-int rijndaelEncryptRound(u_int8_t a[4][4], u_int8_t rk[RIJNDAEL_MAXROUNDS+1][4][4], int ROUNDS, int rounds);
-#endif /* INTERMEDIATE_VALUE_KAT */
-
-int rijndaelDecrypt(u_int8_t a[16], u_int8_t b[16], u_int8_t rk[RIJNDAEL_MAXROUNDS+1][4][4], int ROUNDS);
-
-#ifdef INTERMEDIATE_VALUE_KAT
-int rijndaelDecryptRound(u_int8_t a[4][4], u_int8_t rk[RIJNDAEL_MAXROUNDS+1][4][4], int ROUNDS, int rounds);
-#endif /* INTERMEDIATE_VALUE_KAT */
-
-#endif /* __RIJNDAEL_ALG_FST_H */
diff --git a/src/racoon/missing/crypto/rijndael/rijndael-api-fst.c b/src/racoon/missing/crypto/rijndael/rijndael-api-fst.c
deleted file mode 100644
index 9b6f5fe..0000000
--- a/src/racoon/missing/crypto/rijndael/rijndael-api-fst.c
+++ /dev/null
@@ -1,494 +0,0 @@
-/*	$NetBSD: rijndael-api-fst.c,v 1.4 2006/09/09 16:22:36 manu Exp $	*/
-
-/*	$KAME: rijndael-api-fst.c,v 1.8 2002/11/18 23:32:54 itojun Exp $	*/
-
-/*
- * rijndael-api-fst.c   v2.3   April '2000
- *
- * Optimised ANSI C code
- *
- * authors: v1.0: Antoon Bosselaers
- *          v2.0: Vincent Rijmen
- *          v2.1: Vincent Rijmen
- *          v2.2: Vincent Rijmen
- *          v2.3: Paulo Barreto
- *          v2.4: Vincent Rijmen
- *
- * This code is placed in the public domain.
- */
-
-#include "config.h"
-
-#include <sys/param.h>
-#include <sys/types.h>
-#ifdef _KERNEL
-#include <sys/time.h>
-#include <sys/systm.h>
-#else
-#include <string.h>
-#endif
-#include <crypto/rijndael/rijndael-alg-fst.h>
-#include <crypto/rijndael/rijndael-api-fst.h>
-#include <crypto/rijndael/rijndael_local.h>
-
-#include <err.h>
-#define bcopy(a, b, c) memcpy(b, a, c)
-#define bzero(a, b) memset(a, 0, b)
-#define panic(a) err(1, (a))
-
-int rijndael_makeKey(keyInstance *key, BYTE direction, int keyLen, char *keyMaterial) {
-	word8 k[MAXKC][4];
-	int i;
-	char *keyMat;
-	
-	if (key == NULL) {
-		return BAD_KEY_INSTANCE;
-	}
-
-	if ((direction == DIR_ENCRYPT) || (direction == DIR_DECRYPT)) {
-		key->direction = direction;
-	} else {
-		return BAD_KEY_DIR;
-	}
-
-	if ((keyLen == 128) || (keyLen == 192) || (keyLen == 256)) { 
-		key->keyLen = keyLen;
-	} else {
-		return BAD_KEY_MAT;
-	}
-
-	if (keyMaterial != NULL) {
-		bcopy(keyMaterial, key->keyMaterial, keyLen/8);
-	}
-
-	key->ROUNDS = keyLen/32 + 6;
-
-	/* initialize key schedule: */
-	keyMat = key->keyMaterial;
-	for (i = 0; i < key->keyLen/8; i++) {
-		k[i >> 2][i & 3] = (word8)keyMat[i]; 
-	}
-	rijndaelKeySched(k, key->keySched, key->ROUNDS);
-	if (direction == DIR_DECRYPT) {
-		rijndaelKeyEncToDec(key->keySched, key->ROUNDS);
-	}
-
-	return TRUE;
-}
-
-int rijndael_cipherInit(cipherInstance *cipher, BYTE mode, char *IV) {
-	if ((mode == MODE_ECB) || (mode == MODE_CBC) || (mode == MODE_CFB1)) {
-		cipher->mode = mode;
-	} else {
-		return BAD_CIPHER_MODE;
-	}
-	if (IV != NULL) {
-		bcopy(IV, cipher->IV, MAX_IV_SIZE);
-	} else {
-		bzero(cipher->IV, MAX_IV_SIZE);
-	}
-	return TRUE;
-}
-
-int rijndael_blockEncrypt(cipherInstance *cipher, keyInstance *key,
-		BYTE *input, int inputLen, BYTE *outBuffer) {
-	int i, k, numBlocks;
-	word8 block[16], iv[4][4];
-
-	if (cipher == NULL ||
-		key == NULL ||
-		key->direction == DIR_DECRYPT) {
-		return BAD_CIPHER_STATE;
-	}
-	if (input == NULL || inputLen <= 0) {
-		return 0; /* nothing to do */
-	}
-
-	numBlocks = inputLen/128;
-	
-	switch (cipher->mode) {
-	case MODE_ECB: 
-		for (i = numBlocks; i > 0; i--) {
-			rijndaelEncrypt(input, outBuffer, key->keySched, key->ROUNDS);
-			input += 16;
-			outBuffer += 16;
-		}
-		break;
-		
-	case MODE_CBC:
-#if 1 /*STRICT_ALIGN*/
-		bcopy(cipher->IV, block, 16);
-		bcopy(input, iv, 16);
-		((word32*)block)[0] ^= ((word32*)iv)[0];
-		((word32*)block)[1] ^= ((word32*)iv)[1];
-		((word32*)block)[2] ^= ((word32*)iv)[2];
-		((word32*)block)[3] ^= ((word32*)iv)[3];
-#else
-		((word32*)block)[0] = ((word32*)cipher->IV)[0] ^ ((word32*)input)[0];
-		((word32*)block)[1] = ((word32*)cipher->IV)[1] ^ ((word32*)input)[1];
-		((word32*)block)[2] = ((word32*)cipher->IV)[2] ^ ((word32*)input)[2];
-		((word32*)block)[3] = ((word32*)cipher->IV)[3] ^ ((word32*)input)[3];
-#endif
-		rijndaelEncrypt(block, outBuffer, key->keySched, key->ROUNDS);
-		input += 16;
-		for (i = numBlocks - 1; i > 0; i--) {
-#if 1 /*STRICT_ALIGN*/
-			bcopy(outBuffer, block, 16);
-			bcopy(input, iv, 16);
-			((word32*)block)[0] ^= ((word32*)iv)[0];
-			((word32*)block)[1] ^= ((word32*)iv)[1];
-			((word32*)block)[2] ^= ((word32*)iv)[2];
-			((word32*)block)[3] ^= ((word32*)iv)[3];
-#else
-			((word32*)block)[0] = ((word32*)outBuffer)[0] ^ ((word32*)input)[0];
-			((word32*)block)[1] = ((word32*)outBuffer)[1] ^ ((word32*)input)[1];
-			((word32*)block)[2] = ((word32*)outBuffer)[2] ^ ((word32*)input)[2];
-			((word32*)block)[3] = ((word32*)outBuffer)[3] ^ ((word32*)input)[3];
-#endif
-			outBuffer += 16;
-			rijndaelEncrypt(block, outBuffer, key->keySched, key->ROUNDS);
-			input += 16;
-		}
-		break;
-	
-	case MODE_CFB1:
-#if 1 /*STRICT_ALIGN*/
-		bcopy(cipher->IV, iv, 16); 
-#else  /* !STRICT_ALIGN */
-		*((word32*)iv[0]) = *((word32*)(cipher->IV   ));
-		*((word32*)iv[1]) = *((word32*)(cipher->IV+ 4));
-		*((word32*)iv[2]) = *((word32*)(cipher->IV+ 8));
-		*((word32*)iv[3]) = *((word32*)(cipher->IV+12));
-#endif /* ?STRICT_ALIGN */
-		for (i = numBlocks; i > 0; i--) {
-			for (k = 0; k < 128; k++) {
-				*((word32*) block    ) = *((word32*)iv[0]);
-				*((word32*)(block+ 4)) = *((word32*)iv[1]);
-				*((word32*)(block+ 8)) = *((word32*)iv[2]);
-				*((word32*)(block+12)) = *((word32*)iv[3]);
-				rijndaelEncrypt(block, block, key->keySched, key->ROUNDS);
-				outBuffer[k/8] ^= (block[0] & 0x80) >> (k & 7);
-				iv[0][0] = (iv[0][0] << 1) | (iv[0][1] >> 7);
-				iv[0][1] = (iv[0][1] << 1) | (iv[0][2] >> 7);
-				iv[0][2] = (iv[0][2] << 1) | (iv[0][3] >> 7);
-				iv[0][3] = (iv[0][3] << 1) | (iv[1][0] >> 7);
-				iv[1][0] = (iv[1][0] << 1) | (iv[1][1] >> 7);
-				iv[1][1] = (iv[1][1] << 1) | (iv[1][2] >> 7);
-				iv[1][2] = (iv[1][2] << 1) | (iv[1][3] >> 7);
-				iv[1][3] = (iv[1][3] << 1) | (iv[2][0] >> 7);
-				iv[2][0] = (iv[2][0] << 1) | (iv[2][1] >> 7);
-				iv[2][1] = (iv[2][1] << 1) | (iv[2][2] >> 7);
-				iv[2][2] = (iv[2][2] << 1) | (iv[2][3] >> 7);
-				iv[2][3] = (iv[2][3] << 1) | (iv[3][0] >> 7);
-				iv[3][0] = (iv[3][0] << 1) | (iv[3][1] >> 7);
-				iv[3][1] = (iv[3][1] << 1) | (iv[3][2] >> 7);
-				iv[3][2] = (iv[3][2] << 1) | (iv[3][3] >> 7);
-				iv[3][3] = (iv[3][3] << 1) | ((outBuffer[k/8] >> (7-(k&7))) & 1);
-			}
-		}
-		break;
-	
-	default:
-		return BAD_CIPHER_STATE;
-	}
-	
-	return 128*numBlocks;
-}
-
-/**
- * Encrypt data partitioned in octets, using RFC 2040-like padding.
- *
- * @param   input           data to be encrypted (octet sequence)
- * @param   inputOctets		input length in octets (not bits)
- * @param   outBuffer       encrypted output data
- *
- * @return	length in octets (not bits) of the encrypted output buffer.
- */
-int rijndael_padEncrypt(cipherInstance *cipher, keyInstance *key,
-		BYTE *input, int inputOctets, BYTE *outBuffer) {
-	int i, numBlocks, padLen;
-	word8 block[16], *iv, *cp;
-
-	if (cipher == NULL ||
-		key == NULL ||
-		key->direction == DIR_DECRYPT) {
-		return BAD_CIPHER_STATE;
-	}
-	if (input == NULL || inputOctets <= 0) {
-		return 0; /* nothing to do */
-	}
-
-	numBlocks = inputOctets/16;
-
-	switch (cipher->mode) {
-	case MODE_ECB: 
-		for (i = numBlocks; i > 0; i--) {
-			rijndaelEncrypt(input, outBuffer, key->keySched, key->ROUNDS);
-			input += 16;
-			outBuffer += 16;
-		}
-		padLen = 16 - (inputOctets - 16*numBlocks);
-		if (padLen <= 0 || padLen > 16)
-			panic("rijndael_padEncrypt(ECB)");
-		bcopy(input, block, 16 - padLen);
-		for (cp = block + 16 - padLen; cp < block + 16; cp++)
-			*cp = padLen;
-		rijndaelEncrypt(block, outBuffer, key->keySched, key->ROUNDS);
-		break;
-
-	case MODE_CBC:
-		iv = cipher->IV;
-		for (i = numBlocks; i > 0; i--) {
-			((word32*)block)[0] = ((word32*)input)[0] ^ ((word32*)iv)[0];
-			((word32*)block)[1] = ((word32*)input)[1] ^ ((word32*)iv)[1];
-			((word32*)block)[2] = ((word32*)input)[2] ^ ((word32*)iv)[2];
-			((word32*)block)[3] = ((word32*)input)[3] ^ ((word32*)iv)[3];
-			rijndaelEncrypt(block, outBuffer, key->keySched, key->ROUNDS);
-			iv = outBuffer;
-			input += 16;
-			outBuffer += 16;
-		}
-		padLen = 16 - (inputOctets - 16*numBlocks);
-		if (padLen <= 0 || padLen > 16)
-			panic("rijndael_padEncrypt(CBC)");
-		for (i = 0; i < 16 - padLen; i++) {
-			block[i] = input[i] ^ iv[i];
-		}
-		for (i = 16 - padLen; i < 16; i++) {
-			block[i] = (BYTE)padLen ^ iv[i];
-		}
-		rijndaelEncrypt(block, outBuffer, key->keySched, key->ROUNDS);
-		break;
-
-	default:
-		return BAD_CIPHER_STATE;
-	}
-
-	return 16*(numBlocks + 1);
-}
-
-int rijndael_blockDecrypt(cipherInstance *cipher, keyInstance *key,
-		BYTE *input, int inputLen, BYTE *outBuffer) {
-	int i, k, numBlocks;
-	word8 block[16], iv[4][4];
-
-	if (cipher == NULL ||
-		key == NULL ||
-		(cipher->mode != MODE_CFB1 && key->direction == DIR_ENCRYPT)) {
-		return BAD_CIPHER_STATE;
-	}
-	if (input == NULL || inputLen <= 0) {
-		return 0; /* nothing to do */
-	}
-
-	numBlocks = inputLen/128;
-
-	switch (cipher->mode) {
-	case MODE_ECB: 
-		for (i = numBlocks; i > 0; i--) { 
-			rijndaelDecrypt(input, outBuffer, key->keySched, key->ROUNDS);
-			input += 16;
-			outBuffer += 16;
-		}
-		break;
-		
-	case MODE_CBC:
-#if 1 /*STRICT_ALIGN */
-		bcopy(cipher->IV, iv, 16); 
-#else
-		*((word32*)iv[0]) = *((word32*)(cipher->IV   ));
-		*((word32*)iv[1]) = *((word32*)(cipher->IV+ 4));
-		*((word32*)iv[2]) = *((word32*)(cipher->IV+ 8));
-		*((word32*)iv[3]) = *((word32*)(cipher->IV+12));
-#endif
-		for (i = numBlocks; i > 0; i--) {
-			rijndaelDecrypt(input, block, key->keySched, key->ROUNDS);
-			((word32*)block)[0] ^= *((word32*)iv[0]);
-			((word32*)block)[1] ^= *((word32*)iv[1]);
-			((word32*)block)[2] ^= *((word32*)iv[2]);
-			((word32*)block)[3] ^= *((word32*)iv[3]);
-#if 1 /*STRICT_ALIGN*/
-			bcopy(input, iv, 16);
-			bcopy(block, outBuffer, 16);
-#else
-			*((word32*)iv[0]) = ((word32*)input)[0]; ((word32*)outBuffer)[0] = ((word32*)block)[0];
-			*((word32*)iv[1]) = ((word32*)input)[1]; ((word32*)outBuffer)[1] = ((word32*)block)[1];
-			*((word32*)iv[2]) = ((word32*)input)[2]; ((word32*)outBuffer)[2] = ((word32*)block)[2];
-			*((word32*)iv[3]) = ((word32*)input)[3]; ((word32*)outBuffer)[3] = ((word32*)block)[3];
-#endif
-			input += 16;
-			outBuffer += 16;
-		}
-		break;
-	
-	case MODE_CFB1:
-#if 1 /*STRICT_ALIGN */
-		bcopy(cipher->IV, iv, 16); 
-#else
-		*((word32*)iv[0]) = *((word32*)(cipher->IV));
-		*((word32*)iv[1]) = *((word32*)(cipher->IV+ 4));
-		*((word32*)iv[2]) = *((word32*)(cipher->IV+ 8));
-		*((word32*)iv[3]) = *((word32*)(cipher->IV+12));
-#endif
-		for (i = numBlocks; i > 0; i--) {
-			for (k = 0; k < 128; k++) {
-				*((word32*) block    ) = *((word32*)iv[0]);
-				*((word32*)(block+ 4)) = *((word32*)iv[1]);
-				*((word32*)(block+ 8)) = *((word32*)iv[2]);
-				*((word32*)(block+12)) = *((word32*)iv[3]);
-				rijndaelEncrypt(block, block, key->keySched, key->ROUNDS);
-				iv[0][0] = (iv[0][0] << 1) | (iv[0][1] >> 7);
-				iv[0][1] = (iv[0][1] << 1) | (iv[0][2] >> 7);
-				iv[0][2] = (iv[0][2] << 1) | (iv[0][3] >> 7);
-				iv[0][3] = (iv[0][3] << 1) | (iv[1][0] >> 7);
-				iv[1][0] = (iv[1][0] << 1) | (iv[1][1] >> 7);
-				iv[1][1] = (iv[1][1] << 1) | (iv[1][2] >> 7);
-				iv[1][2] = (iv[1][2] << 1) | (iv[1][3] >> 7);
-				iv[1][3] = (iv[1][3] << 1) | (iv[2][0] >> 7);
-				iv[2][0] = (iv[2][0] << 1) | (iv[2][1] >> 7);
-				iv[2][1] = (iv[2][1] << 1) | (iv[2][2] >> 7);
-				iv[2][2] = (iv[2][2] << 1) | (iv[2][3] >> 7);
-				iv[2][3] = (iv[2][3] << 1) | (iv[3][0] >> 7);
-				iv[3][0] = (iv[3][0] << 1) | (iv[3][1] >> 7);
-				iv[3][1] = (iv[3][1] << 1) | (iv[3][2] >> 7);
-				iv[3][2] = (iv[3][2] << 1) | (iv[3][3] >> 7);
-				iv[3][3] = (iv[3][3] << 1) | ((input[k/8] >> (7-(k&7))) & 1);
-				outBuffer[k/8] ^= (block[0] & 0x80) >> (k & 7);
-			}
-		}
-		break;
-
-	default:
-		return BAD_CIPHER_STATE;
-	}
-	
-	return 128*numBlocks;
-}
-
-int rijndael_padDecrypt(cipherInstance *cipher, keyInstance *key,
-		BYTE *input, int inputOctets, BYTE *outBuffer) {
-	int i, numBlocks, padLen;
-	word8 block[16];
-	word32 iv[4];
-
-	if (cipher == NULL ||
-		key == NULL ||
-		key->direction == DIR_ENCRYPT) {
-		return BAD_CIPHER_STATE;
-	}
-	if (input == NULL || inputOctets <= 0) {
-		return 0; /* nothing to do */
-	}
-	if (inputOctets % 16 != 0) {
-		return BAD_DATA;
-	}
-
-	numBlocks = inputOctets/16;
-
-	switch (cipher->mode) {
-	case MODE_ECB:
-		/* all blocks but last */
-		for (i = numBlocks - 1; i > 0; i--) { 
-			rijndaelDecrypt(input, outBuffer, key->keySched, key->ROUNDS);
-			input += 16;
-			outBuffer += 16;
-		}
-		/* last block */
-		rijndaelDecrypt(input, block, key->keySched, key->ROUNDS);
-		padLen = block[15];
-		if (padLen >= 16) {
-			return BAD_DATA;
-		}
-		for (i = 16 - padLen; i < 16; i++) {
-			if (block[i] != padLen) {
-				return BAD_DATA;
-			}
-		}
-		bcopy(block, outBuffer, 16 - padLen);
-		break;
-		
-	case MODE_CBC:
-		bcopy(cipher->IV, iv, 16);
-		/* all blocks but last */
-		for (i = numBlocks - 1; i > 0; i--) {
-			rijndaelDecrypt(input, block, key->keySched, key->ROUNDS);
-			((word32*)block)[0] ^= iv[0];
-			((word32*)block)[1] ^= iv[1];
-			((word32*)block)[2] ^= iv[2];
-			((word32*)block)[3] ^= iv[3];
-			bcopy(input, iv, 16);
-			bcopy(block, outBuffer, 16);
-			input += 16;
-			outBuffer += 16;
-		}
-		/* last block */
-		rijndaelDecrypt(input, block, key->keySched, key->ROUNDS);
-		((word32*)block)[0] ^= iv[0];
-		((word32*)block)[1] ^= iv[1];
-		((word32*)block)[2] ^= iv[2];
-		((word32*)block)[3] ^= iv[3];
-		padLen = block[15];
-		if (padLen <= 0 || padLen > 16) {
-			return BAD_DATA;
-		}
-		for (i = 16 - padLen; i < 16; i++) {
-			if (block[i] != padLen) {
-				return BAD_DATA;
-			}
-		}
-		bcopy(block, outBuffer, 16 - padLen);
-		break;
-	
-	default:
-		return BAD_CIPHER_STATE;
-	}
-	
-	return 16*numBlocks - padLen;
-}
-
-#ifdef INTERMEDIATE_VALUE_KAT
-/**
- *	cipherUpdateRounds:
- *
- *	Encrypts/Decrypts exactly one full block a specified number of rounds.
- *	Only used in the Intermediate Value Known Answer Test.	
- *
- *	Returns:
- *		TRUE - on success
- *		BAD_CIPHER_STATE - cipher in bad state (e.g., not initialized)
- */
-int rijndael_cipherUpdateRounds(cipherInstance *cipher, keyInstance *key,
-		BYTE *input, int inputLen, BYTE *outBuffer, int rounds) {
-	int j;
-	word8 block[4][4];
-
-	if (cipher == NULL || key == NULL) {
-		return BAD_CIPHER_STATE;
-	}
-
-	for (j = 3; j >= 0; j--) {
-		/* parse input stream into rectangular array */
-  		*((word32*)block[j]) = *((word32*)(input+4*j));
-	}
-
-	switch (key->direction) {
-	case DIR_ENCRYPT:
-		rijndaelEncryptRound(block, key->keySched, key->ROUNDS, rounds);
-		break;
-		
-	case DIR_DECRYPT:
-		rijndaelDecryptRound(block, key->keySched, key->ROUNDS, rounds);
-		break;
-		
-	default:
-		return BAD_KEY_DIR;
-	} 
-
-	for (j = 3; j >= 0; j--) {
-		/* parse rectangular array into output ciphertext bytes */
-		*((word32*)(outBuffer+4*j)) = *((word32*)block[j]);
-	}
-	
-	return TRUE;
-}
-#endif /* INTERMEDIATE_VALUE_KAT */
diff --git a/src/racoon/missing/crypto/rijndael/rijndael-api-fst.h b/src/racoon/missing/crypto/rijndael/rijndael-api-fst.h
deleted file mode 100644
index 1d76a21..0000000
--- a/src/racoon/missing/crypto/rijndael/rijndael-api-fst.h
+++ /dev/null
@@ -1,105 +0,0 @@
-/*	$NetBSD: rijndael-api-fst.h,v 1.4 2006/09/09 16:22:36 manu Exp $	*/
-
-/*	$KAME: rijndael-api-fst.h,v 1.1.1.1 2001/08/08 09:56:27 sakane Exp $	*/
-
-/*
- * rijndael-api-fst.h   v2.3   April '2000
- *
- * Optimised ANSI C code
- *
- * #define INTERMEDIATE_VALUE_KAT to generate the Intermediate Value Known Answer Test.
- */
-
-#ifndef __RIJNDAEL_API_FST_H
-#define __RIJNDAEL_API_FST_H
-
-#include <crypto/rijndael/rijndael-alg-fst.h>
-
-/*  Defines:
-	Add any additional defines you need
-*/
-
-#define     DIR_ENCRYPT           0 /*  Are we encrpyting?  */
-#define     DIR_DECRYPT           1 /*  Are we decrpyting?  */
-#define     MODE_ECB              1 /*  Are we ciphering in ECB mode?   */
-#define     MODE_CBC              2 /*  Are we ciphering in CBC mode?   */
-#define     MODE_CFB1             3 /*  Are we ciphering in 1-bit CFB mode? */
-#define     TRUE                  1
-#define     FALSE                 0
-#define     BITSPERBLOCK        128 /* Default number of bits in a cipher block */
-
-/*  Error Codes - CHANGE POSSIBLE: inclusion of additional error codes  */
-#define     BAD_KEY_DIR          -1 /*  Key direction is invalid, e.g., unknown value */
-#define     BAD_KEY_MAT          -2 /*  Key material not of correct length */
-#define     BAD_KEY_INSTANCE     -3 /*  Key passed is not valid */
-#define     BAD_CIPHER_MODE      -4 /*  Params struct passed to cipherInit invalid */
-#define     BAD_CIPHER_STATE     -5 /*  Cipher in wrong state (e.g., not initialized) */
-#define     BAD_BLOCK_LENGTH     -6
-#define     BAD_CIPHER_INSTANCE  -7
-#define     BAD_DATA             -8 /*  Data contents are invalid, e.g., invalid padding */
-#define     BAD_OTHER            -9 /*  Unknown error */
-
-/*  CHANGE POSSIBLE:  inclusion of algorithm specific defines  */
-#define     MAX_KEY_SIZE         64 /* # of ASCII char's needed to represent a key */
-#define     MAX_IV_SIZE          16 /* # bytes needed to represent an IV  */
-
-/*  Typedefs:
-
-	Typedef'ed data storage elements.  Add any algorithm specific 
-parameters at the bottom of the structs as appropriate.
-*/
-
-/*  The structure for key information */
-typedef struct {
-    u_int8_t  direction;            /* Key used for encrypting or decrypting? */
-    int   keyLen;                   /* Length of the key  */
-    char  keyMaterial[MAX_KEY_SIZE+1];  /* Raw key data in ASCII, e.g., user input or KAT values */
-        /*  The following parameters are algorithm dependent, replace or add as necessary  */
-	int   ROUNDS;                   /* key-length-dependent number of rounds */
-    int   blockLen;                 /* block length */
-    union {
-    	u_int8_t xkS8[RIJNDAEL_MAXROUNDS+1][4][4];	/* key schedule		*/
-    	u_int32_t xkS32[RIJNDAEL_MAXROUNDS+1][4];	/* key schedule		*/
-    } xKeySched;
-#define	keySched	xKeySched.xkS8
-} keyInstance;
-
-/*  The structure for cipher information */
-typedef struct {                    /* changed order of the components */
-    u_int8_t mode;                  /* MODE_ECB, MODE_CBC, or MODE_CFB1 */
-    u_int8_t IV[MAX_IV_SIZE];       /* A possible Initialization Vector for ciphering */
-        /*  Add any algorithm specific parameters needed here  */
-    int   blockLen;                 /* Sample: Handles non-128 bit block sizes (if available) */
-} cipherInstance;
-
-/*  Function prototypes  */
-/*  CHANGED: nothing
-	TODO: implement the following extensions to setup 192-bit and 256-bit block lengths:
-        makeKeyEx():    parameter blockLen added
-                        -- this parameter is absolutely necessary if you want to
-                        setup the round keys in a variable block length setting 
-	    cipherInitEx(): parameter blockLen added (for obvious reasons)		
- */
-
-int rijndael_makeKey(keyInstance *key, u_int8_t direction, int keyLen, char *keyMaterial);
-
-int rijndael_cipherInit(cipherInstance *cipher, u_int8_t mode, char *IV);
-
-int rijndael_blockEncrypt(cipherInstance *cipher, keyInstance *key,
-        u_int8_t *input, int inputLen, u_int8_t *outBuffer);
-
-int rijndael_padEncrypt(cipherInstance *cipher, keyInstance *key,
-		u_int8_t *input, int inputOctets, u_int8_t *outBuffer);
-
-int rijndael_blockDecrypt(cipherInstance *cipher, keyInstance *key,
-        u_int8_t *input, int inputLen, u_int8_t *outBuffer);
-
-int rijndael_padDecrypt(cipherInstance *cipher, keyInstance *key,
-		u_int8_t *input, int inputOctets, u_int8_t *outBuffer);
-
-#ifdef INTERMEDIATE_VALUE_KAT
-int rijndael_cipherUpdateRounds(cipherInstance *cipher, keyInstance *key,
-        u_int8_t *input, int inputLen, u_int8_t *outBuffer, int Rounds);
-#endif /* INTERMEDIATE_VALUE_KAT */
-
-#endif /*  __RIJNDAEL_API_FST_H */
diff --git a/src/racoon/missing/crypto/rijndael/rijndael.h b/src/racoon/missing/crypto/rijndael/rijndael.h
deleted file mode 100644
index 59c3077..0000000
--- a/src/racoon/missing/crypto/rijndael/rijndael.h
+++ /dev/null
@@ -1,5 +0,0 @@
-/*	$NetBSD: rijndael.h,v 1.4 2006/09/09 16:22:36 manu Exp $	*/
-
-/*	$KAME: rijndael.h,v 1.1.1.1 2001/08/08 09:56:27 sakane Exp $	*/
-
-#include <crypto/rijndael/rijndael-api-fst.h>
diff --git a/src/racoon/missing/crypto/rijndael/rijndael_local.h b/src/racoon/missing/crypto/rijndael/rijndael_local.h
deleted file mode 100644
index e446378..0000000
--- a/src/racoon/missing/crypto/rijndael/rijndael_local.h
+++ /dev/null
@@ -1,12 +0,0 @@
-/*	$NetBSD: rijndael_local.h,v 1.4 2006/09/09 16:22:36 manu Exp $	*/
-
-/*	$KAME: rijndael_local.h,v 1.1.1.1 2001/08/08 09:56:27 sakane Exp $	*/
-
-/* the file should not be used from outside */
-typedef u_int8_t		BYTE;
-typedef u_int8_t		word8;	
-typedef u_int16_t		word16;	
-typedef u_int32_t		word32;
-
-#define MAXKC		RIJNDAEL_MAXKC
-#define MAXROUNDS	RIJNDAEL_MAXROUNDS
diff --git a/src/racoon/missing/crypto/sha2/sha2.c b/src/racoon/missing/crypto/sha2/sha2.c
deleted file mode 100644
index cfde829..0000000
--- a/src/racoon/missing/crypto/sha2/sha2.c
+++ /dev/null
@@ -1,1201 +0,0 @@
-/*	$NetBSD: sha2.c,v 1.4 2006/09/09 16:22:36 manu Exp $	*/
-
-/* Id: sha2.c,v 1.6 2004/09/21 14:35:25 ludvigm Exp */
-
-/*
- * sha2.c
- *
- * Version 1.0.0beta1
- *
- * Written by Aaron D. Gifford <me@aarongifford.com>
- *
- * Copyright 2000 Aaron D. Gifford.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the copyright holder nor the names of contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) AND CONTRIBUTOR(S) ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR(S) OR CONTRIBUTOR(S) BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/time.h>
-#ifndef __linux__
-#include <machine/endian.h>
-#endif
-#include <crypto/sha2/sha2.h>
-#include <openssl/evp.h>
-
-/* get openssl/ssleay version number */
-#include <openssl/opensslv.h>
-
-#include <err.h>
-#include <string.h>
-#define bcopy(a, b, c) memcpy((b), (a), (c))
-#define bzero(a, b) memset((a), 0, (b))
-#define panic(a) err(1, (a))
-
-#if OPENSSL_VERSION_NUMBER >= 0x00907000L
-#define HAVE_EVP_097
-#endif
-
-/*
- * ASSERT NOTE:
- * Some sanity checking code is included using assert().  On my FreeBSD
- * system, this additional code can be removed by compiling with NDEBUG
- * defined.  Check your own systems manpage on assert() to see how to
- * compile WITHOUT the sanity checking code on your system.
- *
- * UNROLLED TRANSFORM LOOP NOTE:
- * You can define SHA2_UNROLL_TRANSFORM to use the unrolled transform
- * loop version for the hash transform rounds (defined using macros
- * later in this file).  Either define on the command line, for example:
- *
- *   cc -DSHA2_UNROLL_TRANSFORM -o sha2 sha2.c sha2prog.c
- *
- * or define below:
- *
- *   #define SHA2_UNROLL_TRANSFORM
- *
- */
-
-#define assert(x)
-
-
-/*** SHA-256/384/512 Machine Architecture Definitions *****************/
-/*
- * BYTE_ORDER NOTE:
- *
- * Please make sure that your system defines BYTE_ORDER.  If your
- * architecture is little-endian, make sure it also defines
- * LITTLE_ENDIAN and that the two (BYTE_ORDER and LITTLE_ENDIAN) are
- * equivilent.
- *
- * If your system does not define the above, then you can do so by
- * hand like this:
- *
- *   #define LITTLE_ENDIAN 1234
- *   #define BIG_ENDIAN    4321
- *
- * And for little-endian machines, add:
- *
- *   #define BYTE_ORDER LITTLE_ENDIAN 
- *
- * Or for big-endian machines:
- *
- *   #define BYTE_ORDER BIG_ENDIAN
- *
- * The FreeBSD machine this was written on defines BYTE_ORDER
- * appropriately by including <sys/types.h> (which in turn includes
- * <machine/endian.h> where the appropriate definitions are actually
- * made).
- */
-#if !defined(BYTE_ORDER) || (BYTE_ORDER != LITTLE_ENDIAN && BYTE_ORDER != BIG_ENDIAN)
-#error Define BYTE_ORDER to be equal to either LITTLE_ENDIAN or BIG_ENDIAN
-#endif
-
-/*
- * Define the followingsha2_* types to types of the correct length on
- * the native archtecture.   Most BSD systems and Linux define u_intXX_t
- * types.  Machines with very recent ANSI C headers, can use the
- * uintXX_t definintions from inttypes.h by defining SHA2_USE_INTTYPES_H
- * during compile or in the sha.h header file.
- *
- * Machines that support neither u_intXX_t nor inttypes.h's uintXX_t
- * will need to define these three typedefs below (and the appropriate
- * ones in sha.h too) by hand according to their system architecture.
- *
- * Thank you, Jun-ichiro itojun Hagino, for suggesting using u_intXX_t
- * types and pointing out recent ANSI C support for uintXX_t in inttypes.h.
- */
-#if 0 /*def SHA2_USE_INTTYPES_H*/
-
-typedef uint8_t  sha2_byte;	/* Exactly 1 byte */
-typedef uint32_t sha2_word32;	/* Exactly 4 bytes */
-typedef uint64_t sha2_word64;	/* Exactly 8 bytes */
-
-#else /* SHA2_USE_INTTYPES_H */
-
-typedef u_int8_t  sha2_byte;	/* Exactly 1 byte */
-typedef u_int32_t sha2_word32;	/* Exactly 4 bytes */
-typedef u_int64_t sha2_word64;	/* Exactly 8 bytes */
-
-#endif /* SHA2_USE_INTTYPES_H */
-
-
-/*** SHA-256/384/512 Various Length Definitions ***********************/
-/* NOTE: Most of these are in sha2.h */
-#define SHA256_SHORT_BLOCK_LENGTH	(SHA256_BLOCK_LENGTH - 8)
-#define SHA384_SHORT_BLOCK_LENGTH	(SHA384_BLOCK_LENGTH - 16)
-#define SHA512_SHORT_BLOCK_LENGTH	(SHA512_BLOCK_LENGTH - 16)
-
-
-/*** ENDIAN REVERSAL MACROS *******************************************/
-#if BYTE_ORDER == LITTLE_ENDIAN
-#define REVERSE32(w,x)	{ \
-	sha2_word32 tmp = (w); \
-	tmp = (tmp >> 16) | (tmp << 16); \
-	(x) = ((tmp & 0xff00ff00UL) >> 8) | ((tmp & 0x00ff00ffUL) << 8); \
-}
-#define REVERSE64(w,x)	{ \
-	sha2_word64 tmp = (w); \
-	tmp = (tmp >> 32) | (tmp << 32); \
-	tmp = ((tmp & 0xff00ff00ff00ff00ULL) >> 8) | \
-	      ((tmp & 0x00ff00ff00ff00ffULL) << 8); \
-	(x) = ((tmp & 0xffff0000ffff0000ULL) >> 16) | \
-	      ((tmp & 0x0000ffff0000ffffULL) << 16); \
-}
-#endif /* BYTE_ORDER == LITTLE_ENDIAN */
-
-/*
- * Macro for incrementally adding the unsigned 64-bit integer n to the
- * unsigned 128-bit integer (represented using a two-element array of
- * 64-bit words):
- */
-#define ADDINC128(w,n)	{ \
-	(w)[0] += (sha2_word64)(n); \
-	if ((w)[0] < (n)) { \
-		(w)[1]++; \
-	} \
-}
-
-/*** THE SIX LOGICAL FUNCTIONS ****************************************/
-/*
- * Bit shifting and rotation (used by the six SHA-XYZ logical functions:
- *
- *   NOTE:  The naming of R and S appears backwards here (R is a SHIFT and
- *   S is a ROTATION) because the SHA-256/384/512 description document
- *   (see http://csrc.nist.gov/cryptval/shs/sha256-384-512.pdf) uses this
- *   same "backwards" definition.
- */
-/* Shift-right (used in SHA-256, SHA-384, and SHA-512): */
-#define R(b,x) 		((x) >> (b))
-/* 32-bit Rotate-right (used in SHA-256): */
-#define S32(b,x)	(((x) >> (b)) | ((x) << (32 - (b))))
-/* 64-bit Rotate-right (used in SHA-384 and SHA-512): */
-#define S64(b,x)	(((x) >> (b)) | ((x) << (64 - (b))))
-
-/* Two of six logical functions used in SHA-256, SHA-384, and SHA-512: */
-#define Ch(x,y,z)	(((x) & (y)) ^ ((~(x)) & (z)))
-#define Maj(x,y,z)	(((x) & (y)) ^ ((x) & (z)) ^ ((y) & (z)))
-
-/* Four of six logical functions used in SHA-256: */
-#define Sigma0_256(x)	(S32(2,  (x)) ^ S32(13, (x)) ^ S32(22, (x)))
-#define Sigma1_256(x)	(S32(6,  (x)) ^ S32(11, (x)) ^ S32(25, (x)))
-#define sigma0_256(x)	(S32(7,  (x)) ^ S32(18, (x)) ^ R(3 ,   (x)))
-#define sigma1_256(x)	(S32(17, (x)) ^ S32(19, (x)) ^ R(10,   (x)))
-
-/* Four of six logical functions used in SHA-384 and SHA-512: */
-#define Sigma0_512(x)	(S64(28, (x)) ^ S64(34, (x)) ^ S64(39, (x)))
-#define Sigma1_512(x)	(S64(14, (x)) ^ S64(18, (x)) ^ S64(41, (x)))
-#define sigma0_512(x)	(S64( 1, (x)) ^ S64( 8, (x)) ^ R( 7,   (x)))
-#define sigma1_512(x)	(S64(19, (x)) ^ S64(61, (x)) ^ R( 6,   (x)))
-
-/*** INTERNAL FUNCTION PROTOTYPES *************************************/
-/* NOTE: These should not be accessed directly from outside this
- * library -- they are intended for private internal visibility/use
- * only.
- */
-void SHA512_Last(SHA512_CTX*);
-void SHA256_Transform(SHA256_CTX*, const sha2_word32*);
-void SHA512_Transform(SHA512_CTX*, const sha2_word64*);
-
-
-/*** SHA-XYZ INITIAL HASH VALUES AND CONSTANTS ************************/
-/* Hash constant words K for SHA-256: */
-const static sha2_word32 K256[64] = {
-	0x428a2f98UL, 0x71374491UL, 0xb5c0fbcfUL, 0xe9b5dba5UL,
-	0x3956c25bUL, 0x59f111f1UL, 0x923f82a4UL, 0xab1c5ed5UL,
-	0xd807aa98UL, 0x12835b01UL, 0x243185beUL, 0x550c7dc3UL,
-	0x72be5d74UL, 0x80deb1feUL, 0x9bdc06a7UL, 0xc19bf174UL,
-	0xe49b69c1UL, 0xefbe4786UL, 0x0fc19dc6UL, 0x240ca1ccUL,
-	0x2de92c6fUL, 0x4a7484aaUL, 0x5cb0a9dcUL, 0x76f988daUL,
-	0x983e5152UL, 0xa831c66dUL, 0xb00327c8UL, 0xbf597fc7UL,
-	0xc6e00bf3UL, 0xd5a79147UL, 0x06ca6351UL, 0x14292967UL,
-	0x27b70a85UL, 0x2e1b2138UL, 0x4d2c6dfcUL, 0x53380d13UL,
-	0x650a7354UL, 0x766a0abbUL, 0x81c2c92eUL, 0x92722c85UL,
-	0xa2bfe8a1UL, 0xa81a664bUL, 0xc24b8b70UL, 0xc76c51a3UL,
-	0xd192e819UL, 0xd6990624UL, 0xf40e3585UL, 0x106aa070UL,
-	0x19a4c116UL, 0x1e376c08UL, 0x2748774cUL, 0x34b0bcb5UL,
-	0x391c0cb3UL, 0x4ed8aa4aUL, 0x5b9cca4fUL, 0x682e6ff3UL,
-	0x748f82eeUL, 0x78a5636fUL, 0x84c87814UL, 0x8cc70208UL,
-	0x90befffaUL, 0xa4506cebUL, 0xbef9a3f7UL, 0xc67178f2UL
-};
-
-/* Initial hash value H for SHA-256: */
-const static sha2_word32 sha256_initial_hash_value[8] = {
-	0x6a09e667UL,
-	0xbb67ae85UL,
-	0x3c6ef372UL,
-	0xa54ff53aUL,
-	0x510e527fUL,
-	0x9b05688cUL,
-	0x1f83d9abUL,
-	0x5be0cd19UL
-};
-
-/* Hash constant words K for SHA-384 and SHA-512: */
-const static sha2_word64 K512[80] = {
-	0x428a2f98d728ae22ULL, 0x7137449123ef65cdULL,
-	0xb5c0fbcfec4d3b2fULL, 0xe9b5dba58189dbbcULL,
-	0x3956c25bf348b538ULL, 0x59f111f1b605d019ULL,
-	0x923f82a4af194f9bULL, 0xab1c5ed5da6d8118ULL,
-	0xd807aa98a3030242ULL, 0x12835b0145706fbeULL,
-	0x243185be4ee4b28cULL, 0x550c7dc3d5ffb4e2ULL,
-	0x72be5d74f27b896fULL, 0x80deb1fe3b1696b1ULL,
-	0x9bdc06a725c71235ULL, 0xc19bf174cf692694ULL,
-	0xe49b69c19ef14ad2ULL, 0xefbe4786384f25e3ULL,
-	0x0fc19dc68b8cd5b5ULL, 0x240ca1cc77ac9c65ULL,
-	0x2de92c6f592b0275ULL, 0x4a7484aa6ea6e483ULL,
-	0x5cb0a9dcbd41fbd4ULL, 0x76f988da831153b5ULL,
-	0x983e5152ee66dfabULL, 0xa831c66d2db43210ULL,
-	0xb00327c898fb213fULL, 0xbf597fc7beef0ee4ULL,
-	0xc6e00bf33da88fc2ULL, 0xd5a79147930aa725ULL,
-	0x06ca6351e003826fULL, 0x142929670a0e6e70ULL,
-	0x27b70a8546d22ffcULL, 0x2e1b21385c26c926ULL,
-	0x4d2c6dfc5ac42aedULL, 0x53380d139d95b3dfULL,
-	0x650a73548baf63deULL, 0x766a0abb3c77b2a8ULL,
-	0x81c2c92e47edaee6ULL, 0x92722c851482353bULL,
-	0xa2bfe8a14cf10364ULL, 0xa81a664bbc423001ULL,
-	0xc24b8b70d0f89791ULL, 0xc76c51a30654be30ULL,
-	0xd192e819d6ef5218ULL, 0xd69906245565a910ULL,
-	0xf40e35855771202aULL, 0x106aa07032bbd1b8ULL,
-	0x19a4c116b8d2d0c8ULL, 0x1e376c085141ab53ULL,
-	0x2748774cdf8eeb99ULL, 0x34b0bcb5e19b48a8ULL,
-	0x391c0cb3c5c95a63ULL, 0x4ed8aa4ae3418acbULL,
-	0x5b9cca4f7763e373ULL, 0x682e6ff3d6b2b8a3ULL,
-	0x748f82ee5defb2fcULL, 0x78a5636f43172f60ULL,
-	0x84c87814a1f0ab72ULL, 0x8cc702081a6439ecULL,
-	0x90befffa23631e28ULL, 0xa4506cebde82bde9ULL,
-	0xbef9a3f7b2c67915ULL, 0xc67178f2e372532bULL,
-	0xca273eceea26619cULL, 0xd186b8c721c0c207ULL,
-	0xeada7dd6cde0eb1eULL, 0xf57d4f7fee6ed178ULL,
-	0x06f067aa72176fbaULL, 0x0a637dc5a2c898a6ULL,
-	0x113f9804bef90daeULL, 0x1b710b35131c471bULL,
-	0x28db77f523047d84ULL, 0x32caab7b40c72493ULL,
-	0x3c9ebe0a15c9bebcULL, 0x431d67c49c100d4cULL,
-	0x4cc5d4becb3e42b6ULL, 0x597f299cfc657e2aULL,
-	0x5fcb6fab3ad6faecULL, 0x6c44198c4a475817ULL
-};
-
-/* Initial hash value H for SHA-384 */
-const static sha2_word64 sha384_initial_hash_value[8] = {
-	0xcbbb9d5dc1059ed8ULL,
-	0x629a292a367cd507ULL,
-	0x9159015a3070dd17ULL,
-	0x152fecd8f70e5939ULL,
-	0x67332667ffc00b31ULL,
-	0x8eb44a8768581511ULL,
-	0xdb0c2e0d64f98fa7ULL,
-	0x47b5481dbefa4fa4ULL
-};
-
-/* Initial hash value H for SHA-512 */
-const static sha2_word64 sha512_initial_hash_value[8] = {
-	0x6a09e667f3bcc908ULL,
-	0xbb67ae8584caa73bULL,
-	0x3c6ef372fe94f82bULL,
-	0xa54ff53a5f1d36f1ULL,
-	0x510e527fade682d1ULL,
-	0x9b05688c2b3e6c1fULL,
-	0x1f83d9abfb41bd6bULL,
-	0x5be0cd19137e2179ULL
-};
-
-/*
- * Constant used by SHA256/384/512_End() functions for converting the
- * digest to a readable hexadecimal character string:
- */
-static const char *sha2_hex_digits = "0123456789abcdef";
-
-
-/*** SHA-256: *********************************************************/
-void SHA256_Init(SHA256_CTX* context) {
-	if (context == (SHA256_CTX*)0) {
-		return;
-	}
-	bcopy(sha256_initial_hash_value, context->state, SHA256_DIGEST_LENGTH);
-	bzero(context->buffer, SHA256_BLOCK_LENGTH);
-	context->bitcount = 0;
-}
-
-#ifdef SHA2_UNROLL_TRANSFORM
-
-/* Unrolled SHA-256 round macros: */
-
-#if BYTE_ORDER == LITTLE_ENDIAN
-
-#define ROUND256_0_TO_15(a,b,c,d,e,f,g,h)	\
-	REVERSE32(*data++, W256[j]); \
-	T1 = (h) + Sigma1_256(e) + Ch((e), (f), (g)) + \
-             K256[j] + W256[j]; \
-	(d) += T1; \
-	(h) = T1 + Sigma0_256(a) + Maj((a), (b), (c)); \
-	j++
-
-
-#else /* BYTE_ORDER == LITTLE_ENDIAN */
-
-#define ROUND256_0_TO_15(a,b,c,d,e,f,g,h)	\
-	T1 = (h) + Sigma1_256(e) + Ch((e), (f), (g)) + \
-	     K256[j] + (W256[j] = *data++); \
-	(d) += T1; \
-	(h) = T1 + Sigma0_256(a) + Maj((a), (b), (c)); \
-	j++
-
-#endif /* BYTE_ORDER == LITTLE_ENDIAN */
-
-#define ROUND256(a,b,c,d,e,f,g,h)	\
-	s0 = W256[(j+1)&0x0f]; \
-	s0 = sigma0_256(s0); \
-	s1 = W256[(j+14)&0x0f]; \
-	s1 = sigma1_256(s1); \
-	T1 = (h) + Sigma1_256(e) + Ch((e), (f), (g)) + K256[j] + \
-	     (W256[j&0x0f] += s1 + W256[(j+9)&0x0f] + s0); \
-	(d) += T1; \
-	(h) = T1 + Sigma0_256(a) + Maj((a), (b), (c)); \
-	j++
-
-void SHA256_Transform(SHA256_CTX* context, const sha2_word32* data) {
-	sha2_word32	a, b, c, d, e, f, g, h, s0, s1;
-	sha2_word32	T1, *W256;
-	int		j;
-
-	W256 = (sha2_word32*)context->buffer;
-
-	/* Initialize registers with the prev. intermediate value */
-	a = context->state[0];
-	b = context->state[1];
-	c = context->state[2];
-	d = context->state[3];
-	e = context->state[4];
-	f = context->state[5];
-	g = context->state[6];
-	h = context->state[7];
-
-	j = 0;
-	do {
-		/* Rounds 0 to 15 (unrolled): */
-		ROUND256_0_TO_15(a,b,c,d,e,f,g,h);
-		ROUND256_0_TO_15(h,a,b,c,d,e,f,g);
-		ROUND256_0_TO_15(g,h,a,b,c,d,e,f);
-		ROUND256_0_TO_15(f,g,h,a,b,c,d,e);
-		ROUND256_0_TO_15(e,f,g,h,a,b,c,d);
-		ROUND256_0_TO_15(d,e,f,g,h,a,b,c);
-		ROUND256_0_TO_15(c,d,e,f,g,h,a,b);
-		ROUND256_0_TO_15(b,c,d,e,f,g,h,a);
-	} while (j < 16);
-
-	/* Now for the remaining rounds to 64: */
-	do {
-		ROUND256(a,b,c,d,e,f,g,h);
-		ROUND256(h,a,b,c,d,e,f,g);
-		ROUND256(g,h,a,b,c,d,e,f);
-		ROUND256(f,g,h,a,b,c,d,e);
-		ROUND256(e,f,g,h,a,b,c,d);
-		ROUND256(d,e,f,g,h,a,b,c);
-		ROUND256(c,d,e,f,g,h,a,b);
-		ROUND256(b,c,d,e,f,g,h,a);
-	} while (j < 64);
-
-	/* Compute the current intermediate hash value */
-	context->state[0] += a;
-	context->state[1] += b;
-	context->state[2] += c;
-	context->state[3] += d;
-	context->state[4] += e;
-	context->state[5] += f;
-	context->state[6] += g;
-	context->state[7] += h;
-
-	/* Clean up */
-	a = b = c = d = e = f = g = h = T1 = 0;
-}
-
-#else /* SHA2_UNROLL_TRANSFORM */
-
-void SHA256_Transform(SHA256_CTX* context, const sha2_word32* data) {
-	sha2_word32	a, b, c, d, e, f, g, h, s0, s1;
-	sha2_word32	T1, T2, *W256;
-	int		j;
-
-	W256 = (sha2_word32*)context->buffer;
-
-	/* Initialize registers with the prev. intermediate value */
-	a = context->state[0];
-	b = context->state[1];
-	c = context->state[2];
-	d = context->state[3];
-	e = context->state[4];
-	f = context->state[5];
-	g = context->state[6];
-	h = context->state[7];
-
-	j = 0;
-	do {
-#if BYTE_ORDER == LITTLE_ENDIAN
-		/* Copy data while converting to host byte order */
-		REVERSE32(*data++,W256[j]);
-		/* Apply the SHA-256 compression function to update a..h */
-		T1 = h + Sigma1_256(e) + Ch(e, f, g) + K256[j] + W256[j];
-#else /* BYTE_ORDER == LITTLE_ENDIAN */
-		/* Apply the SHA-256 compression function to update a..h with copy */
-		T1 = h + Sigma1_256(e) + Ch(e, f, g) + K256[j] + (W256[j] = *data++);
-#endif /* BYTE_ORDER == LITTLE_ENDIAN */
-		T2 = Sigma0_256(a) + Maj(a, b, c);
-		h = g;
-		g = f;
-		f = e;
-		e = d + T1;
-		d = c;
-		c = b;
-		b = a;
-		a = T1 + T2;
-
-		j++;
-	} while (j < 16);
-
-	do {
-		/* Part of the message block expansion: */
-		s0 = W256[(j+1)&0x0f];
-		s0 = sigma0_256(s0);
-		s1 = W256[(j+14)&0x0f];	
-		s1 = sigma1_256(s1);
-
-		/* Apply the SHA-256 compression function to update a..h */
-		T1 = h + Sigma1_256(e) + Ch(e, f, g) + K256[j] + 
-		     (W256[j&0x0f] += s1 + W256[(j+9)&0x0f] + s0);
-		T2 = Sigma0_256(a) + Maj(a, b, c);
-		h = g;
-		g = f;
-		f = e;
-		e = d + T1;
-		d = c;
-		c = b;
-		b = a;
-		a = T1 + T2;
-
-		j++;
-	} while (j < 64);
-
-	/* Compute the current intermediate hash value */
-	context->state[0] += a;
-	context->state[1] += b;
-	context->state[2] += c;
-	context->state[3] += d;
-	context->state[4] += e;
-	context->state[5] += f;
-	context->state[6] += g;
-	context->state[7] += h;
-
-	/* Clean up */
-	a = b = c = d = e = f = g = h = T1 = T2 = 0;
-}
-
-#endif /* SHA2_UNROLL_TRANSFORM */
-
-void SHA256_Update(SHA256_CTX* context, const sha2_byte *data, size_t len) {
-	unsigned int	freespace, usedspace;
-
-	if (len == 0) {
-		/* Calling with no data is valid - we do nothing */
-		return;
-	}
-
-	/* Sanity check: */
-	assert(context != (SHA256_CTX*)0 && data != (sha2_byte*)0);
-
-	usedspace = (context->bitcount >> 3) % SHA256_BLOCK_LENGTH;
-	if (usedspace > 0) {
-		/* Calculate how much free space is available in the buffer */
-		freespace = SHA256_BLOCK_LENGTH - usedspace;
-
-		if (len >= freespace) {
-			/* Fill the buffer completely and process it */
-			bcopy(data, &context->buffer[usedspace], freespace);
-			context->bitcount += freespace << 3;
-			len -= freespace;
-			data += freespace;
-			SHA256_Transform(context, (sha2_word32*)context->buffer);
-		} else {
-			/* The buffer is not yet full */
-			bcopy(data, &context->buffer[usedspace], len);
-			context->bitcount += len << 3;
-			/* Clean up: */
-			usedspace = freespace = 0;
-			return;
-		}
-	}
-	while (len >= SHA256_BLOCK_LENGTH) {
-		/* Process as many complete blocks as we can */
-		SHA256_Transform(context, (const sha2_word32*)data);
-		context->bitcount += SHA256_BLOCK_LENGTH << 3;
-		len -= SHA256_BLOCK_LENGTH;
-		data += SHA256_BLOCK_LENGTH;
-	}
-	if (len > 0) {
-		/* There's left-overs, so save 'em */
-		bcopy(data, context->buffer, len);
-		context->bitcount += len << 3;
-	}
-	/* Clean up: */
-	usedspace = freespace = 0;
-}
-
-void SHA256_Final(sha2_byte digest[], SHA256_CTX* context) {
-	sha2_word32	*d = (sha2_word32*)digest;
-	unsigned int	usedspace;
-
-	/* Sanity check: */
-	assert(context != (SHA256_CTX*)0);
-
-	/* If no digest buffer is passed, we don't bother doing this: */
-	if (digest != (sha2_byte*)0) {
-		usedspace = (context->bitcount >> 3) % SHA256_BLOCK_LENGTH;
-#if BYTE_ORDER == LITTLE_ENDIAN
-		/* Convert FROM host byte order */
-		REVERSE64(context->bitcount,context->bitcount);
-#endif
-		if (usedspace > 0) {
-			/* Begin padding with a 1 bit: */
-			context->buffer[usedspace++] = 0x80;
-
-			if (usedspace <= SHA256_SHORT_BLOCK_LENGTH) {
-				/* Set-up for the last transform: */
-				bzero(&context->buffer[usedspace], SHA256_SHORT_BLOCK_LENGTH - usedspace);
-			} else {
-				if (usedspace < SHA256_BLOCK_LENGTH) {
-					bzero(&context->buffer[usedspace], SHA256_BLOCK_LENGTH - usedspace);
-				}
-				/* Do second-to-last transform: */
-				SHA256_Transform(context, (sha2_word32*)context->buffer);
-
-				/* And set-up for the last transform: */
-				bzero(context->buffer, SHA256_SHORT_BLOCK_LENGTH);
-			}
-		} else {
-			/* Set-up for the last transform: */
-			bzero(context->buffer, SHA256_SHORT_BLOCK_LENGTH);
-
-			/* Begin padding with a 1 bit: */
-			*context->buffer = 0x80;
-		}
-		/* Set the bit count: */
-		*(sha2_word64*)&context->buffer[SHA256_SHORT_BLOCK_LENGTH] = context->bitcount;
-
-		/* Final transform: */
-		SHA256_Transform(context, (sha2_word32*)context->buffer);
-
-#if BYTE_ORDER == LITTLE_ENDIAN
-		{
-			/* Convert TO host byte order */
-			int	j;
-			for (j = 0; j < 8; j++) {
-				REVERSE32(context->state[j],context->state[j]);
-				*d++ = context->state[j];
-			}
-		}
-#else
-		bcopy(context->state, d, SHA256_DIGEST_LENGTH);
-#endif
-	}
-
-	/* Clean up state data: */
-	bzero(context, sizeof(*context));
-	usedspace = 0;
-}
-
-char *SHA256_End(SHA256_CTX* context, char buffer[]) {
-	sha2_byte	digest[SHA256_DIGEST_LENGTH], *d = digest;
-	int		i;
-
-	/* Sanity check: */
-	assert(context != (SHA256_CTX*)0);
-
-	if (buffer != (char*)0) {
-		SHA256_Final(digest, context);
-
-		for (i = 0; i < SHA256_DIGEST_LENGTH; i++) {
-			*buffer++ = sha2_hex_digits[(*d & 0xf0) >> 4];
-			*buffer++ = sha2_hex_digits[*d & 0x0f];
-			d++;
-		}
-		*buffer = (char)0;
-	} else {
-		bzero(context, sizeof(*context));
-	}
-	bzero(digest, SHA256_DIGEST_LENGTH);
-	return buffer;
-}
-
-char* SHA256_Data(const sha2_byte* data, size_t len, char digest[SHA256_DIGEST_STRING_LENGTH]) {
-	SHA256_CTX	context;
-
-	SHA256_Init(&context);
-	SHA256_Update(&context, data, len);
-	return SHA256_End(&context, digest);
-}
-
-
-/*** SHA-512: *********************************************************/
-void SHA512_Init(SHA512_CTX* context) {
-	if (context == (SHA512_CTX*)0) {
-		return;
-	}
-	bcopy(sha512_initial_hash_value, context->state, SHA512_DIGEST_LENGTH);
-	bzero(context->buffer, SHA512_BLOCK_LENGTH);
-	context->bitcount[0] = context->bitcount[1] =  0;
-}
-
-#ifdef SHA2_UNROLL_TRANSFORM
-
-/* Unrolled SHA-512 round macros: */
-#if BYTE_ORDER == LITTLE_ENDIAN
-
-#define ROUND512_0_TO_15(a,b,c,d,e,f,g,h)	\
-	REVERSE64(*data++, W512[j]); \
-	T1 = (h) + Sigma1_512(e) + Ch((e), (f), (g)) + \
-             K512[j] + W512[j]; \
-	(d) += T1, \
-	(h) = T1 + Sigma0_512(a) + Maj((a), (b), (c)), \
-	j++
-
-
-#else /* BYTE_ORDER == LITTLE_ENDIAN */
-
-#define ROUND512_0_TO_15(a,b,c,d,e,f,g,h)	\
-	T1 = (h) + Sigma1_512(e) + Ch((e), (f), (g)) + \
-             K512[j] + (W512[j] = *data++); \
-	(d) += T1; \
-	(h) = T1 + Sigma0_512(a) + Maj((a), (b), (c)); \
-	j++
-
-#endif /* BYTE_ORDER == LITTLE_ENDIAN */
-
-#define ROUND512(a,b,c,d,e,f,g,h)	\
-	s0 = W512[(j+1)&0x0f]; \
-	s0 = sigma0_512(s0); \
-	s1 = W512[(j+14)&0x0f]; \
-	s1 = sigma1_512(s1); \
-	T1 = (h) + Sigma1_512(e) + Ch((e), (f), (g)) + K512[j] + \
-             (W512[j&0x0f] += s1 + W512[(j+9)&0x0f] + s0); \
-	(d) += T1; \
-	(h) = T1 + Sigma0_512(a) + Maj((a), (b), (c)); \
-	j++
-
-void SHA512_Transform(SHA512_CTX* context, const sha2_word64* data) {
-	sha2_word64	a, b, c, d, e, f, g, h, s0, s1;
-	sha2_word64	T1, *W512 = (sha2_word64*)context->buffer;
-	int		j;
-
-	/* Initialize registers with the prev. intermediate value */
-	a = context->state[0];
-	b = context->state[1];
-	c = context->state[2];
-	d = context->state[3];
-	e = context->state[4];
-	f = context->state[5];
-	g = context->state[6];
-	h = context->state[7];
-
-	j = 0;
-	do {
-		ROUND512_0_TO_15(a,b,c,d,e,f,g,h);
-		ROUND512_0_TO_15(h,a,b,c,d,e,f,g);
-		ROUND512_0_TO_15(g,h,a,b,c,d,e,f);
-		ROUND512_0_TO_15(f,g,h,a,b,c,d,e);
-		ROUND512_0_TO_15(e,f,g,h,a,b,c,d);
-		ROUND512_0_TO_15(d,e,f,g,h,a,b,c);
-		ROUND512_0_TO_15(c,d,e,f,g,h,a,b);
-		ROUND512_0_TO_15(b,c,d,e,f,g,h,a);
-	} while (j < 16);
-
-	/* Now for the remaining rounds up to 79: */
-	do {
-		ROUND512(a,b,c,d,e,f,g,h);
-		ROUND512(h,a,b,c,d,e,f,g);
-		ROUND512(g,h,a,b,c,d,e,f);
-		ROUND512(f,g,h,a,b,c,d,e);
-		ROUND512(e,f,g,h,a,b,c,d);
-		ROUND512(d,e,f,g,h,a,b,c);
-		ROUND512(c,d,e,f,g,h,a,b);
-		ROUND512(b,c,d,e,f,g,h,a);
-	} while (j < 80);
-
-	/* Compute the current intermediate hash value */
-	context->state[0] += a;
-	context->state[1] += b;
-	context->state[2] += c;
-	context->state[3] += d;
-	context->state[4] += e;
-	context->state[5] += f;
-	context->state[6] += g;
-	context->state[7] += h;
-
-	/* Clean up */
-	a = b = c = d = e = f = g = h = T1 = 0;
-}
-
-#else /* SHA2_UNROLL_TRANSFORM */
-
-void SHA512_Transform(SHA512_CTX* context, const sha2_word64* data) {
-	sha2_word64	a, b, c, d, e, f, g, h, s0, s1;
-	sha2_word64	T1, T2, *W512 = (sha2_word64*)context->buffer;
-	int		j;
-
-	/* Initialize registers with the prev. intermediate value */
-	a = context->state[0];
-	b = context->state[1];
-	c = context->state[2];
-	d = context->state[3];
-	e = context->state[4];
-	f = context->state[5];
-	g = context->state[6];
-	h = context->state[7];
-
-	j = 0;
-	do {
-#if BYTE_ORDER == LITTLE_ENDIAN
-		/* Convert TO host byte order */
-		REVERSE64(*data++, W512[j]);
-		/* Apply the SHA-512 compression function to update a..h */
-		T1 = h + Sigma1_512(e) + Ch(e, f, g) + K512[j] + W512[j];
-#else /* BYTE_ORDER == LITTLE_ENDIAN */
-		/* Apply the SHA-512 compression function to update a..h with copy */
-		T1 = h + Sigma1_512(e) + Ch(e, f, g) + K512[j] + (W512[j] = *data++);
-#endif /* BYTE_ORDER == LITTLE_ENDIAN */
-		T2 = Sigma0_512(a) + Maj(a, b, c);
-		h = g;
-		g = f;
-		f = e;
-		e = d + T1;
-		d = c;
-		c = b;
-		b = a;
-		a = T1 + T2;
-
-		j++;
-	} while (j < 16);
-
-	do {
-		/* Part of the message block expansion: */
-		s0 = W512[(j+1)&0x0f];
-		s0 = sigma0_512(s0);
-		s1 = W512[(j+14)&0x0f];
-		s1 =  sigma1_512(s1);
-
-		/* Apply the SHA-512 compression function to update a..h */
-		T1 = h + Sigma1_512(e) + Ch(e, f, g) + K512[j] +
-		     (W512[j&0x0f] += s1 + W512[(j+9)&0x0f] + s0);
-		T2 = Sigma0_512(a) + Maj(a, b, c);
-		h = g;
-		g = f;
-		f = e;
-		e = d + T1;
-		d = c;
-		c = b;
-		b = a;
-		a = T1 + T2;
-
-		j++;
-	} while (j < 80);
-
-	/* Compute the current intermediate hash value */
-	context->state[0] += a;
-	context->state[1] += b;
-	context->state[2] += c;
-	context->state[3] += d;
-	context->state[4] += e;
-	context->state[5] += f;
-	context->state[6] += g;
-	context->state[7] += h;
-
-	/* Clean up */
-	a = b = c = d = e = f = g = h = T1 = T2 = 0;
-}
-
-#endif /* SHA2_UNROLL_TRANSFORM */
-
-void SHA512_Update(SHA512_CTX* context, const sha2_byte *data, size_t len) {
-	unsigned int	freespace, usedspace;
-
-	if (len == 0) {
-		/* Calling with no data is valid - we do nothing */
-		return;
-	}
-
-	/* Sanity check: */
-	assert(context != (SHA512_CTX*)0 && data != (sha2_byte*)0);
-
-	usedspace = (context->bitcount[0] >> 3) % SHA512_BLOCK_LENGTH;
-	if (usedspace > 0) {
-		/* Calculate how much free space is available in the buffer */
-		freespace = SHA512_BLOCK_LENGTH - usedspace;
-
-		if (len >= freespace) {
-			/* Fill the buffer completely and process it */
-			bcopy(data, &context->buffer[usedspace], freespace);
-			ADDINC128(context->bitcount, freespace << 3);
-			len -= freespace;
-			data += freespace;
-			SHA512_Transform(context, (sha2_word64*)context->buffer);
-		} else {
-			/* The buffer is not yet full */
-			bcopy(data, &context->buffer[usedspace], len);
-			ADDINC128(context->bitcount, len << 3);
-			/* Clean up: */
-			usedspace = freespace = 0;
-			return;
-		}
-	}
-	while (len >= SHA512_BLOCK_LENGTH) {
-		/* Process as many complete blocks as we can */
-		SHA512_Transform(context, (const sha2_word64*)data);
-		ADDINC128(context->bitcount, SHA512_BLOCK_LENGTH << 3);
-		len -= SHA512_BLOCK_LENGTH;
-		data += SHA512_BLOCK_LENGTH;
-	}
-	if (len > 0) {
-		/* There's left-overs, so save 'em */
-		bcopy(data, context->buffer, len);
-		ADDINC128(context->bitcount, len << 3);
-	}
-	/* Clean up: */
-	usedspace = freespace = 0;
-}
-
-void SHA512_Last(SHA512_CTX* context) {
-	unsigned int	usedspace;
-
-	usedspace = (context->bitcount[0] >> 3) % SHA512_BLOCK_LENGTH;
-#if BYTE_ORDER == LITTLE_ENDIAN
-	/* Convert FROM host byte order */
-	REVERSE64(context->bitcount[0],context->bitcount[0]);
-	REVERSE64(context->bitcount[1],context->bitcount[1]);
-#endif
-	if (usedspace > 0) {
-		/* Begin padding with a 1 bit: */
-		context->buffer[usedspace++] = 0x80;
-
-		if (usedspace <= SHA512_SHORT_BLOCK_LENGTH) {
-			/* Set-up for the last transform: */
-			bzero(&context->buffer[usedspace], SHA512_SHORT_BLOCK_LENGTH - usedspace);
-		} else {
-			if (usedspace < SHA512_BLOCK_LENGTH) {
-				bzero(&context->buffer[usedspace], SHA512_BLOCK_LENGTH - usedspace);
-			}
-			/* Do second-to-last transform: */
-			SHA512_Transform(context, (sha2_word64*)context->buffer);
-
-			/* And set-up for the last transform: */
-			bzero(context->buffer, SHA512_BLOCK_LENGTH - 2);
-		}
-	} else {
-		/* Prepare for final transform: */
-		bzero(context->buffer, SHA512_SHORT_BLOCK_LENGTH);
-
-		/* Begin padding with a 1 bit: */
-		*context->buffer = 0x80;
-	}
-	/* Store the length of input data (in bits): */
-	*(sha2_word64*)&context->buffer[SHA512_SHORT_BLOCK_LENGTH] = context->bitcount[1];
-	*(sha2_word64*)&context->buffer[SHA512_SHORT_BLOCK_LENGTH+8] = context->bitcount[0];
-
-	/* Final transform: */
-	SHA512_Transform(context, (sha2_word64*)context->buffer);
-}
-
-void SHA512_Final(sha2_byte digest[], SHA512_CTX* context) {
-	sha2_word64	*d = (sha2_word64*)digest;
-
-	/* Sanity check: */
-	assert(context != (SHA512_CTX*)0);
-
-	/* If no digest buffer is passed, we don't bother doing this: */
-	if (digest != (sha2_byte*)0) {
-		SHA512_Last(context);
-
-		/* Save the hash data for output: */
-#if BYTE_ORDER == LITTLE_ENDIAN
-		{
-			/* Convert TO host byte order */
-			int	j;
-			for (j = 0; j < 8; j++) {
-				REVERSE64(context->state[j],context->state[j]);
-				*d++ = context->state[j];
-			}
-		}
-#else
-		bcopy(context->state, d, SHA512_DIGEST_LENGTH);
-#endif
-	}
-
-	/* Zero out state data */
-	bzero(context, sizeof(*context));
-}
-
-char *SHA512_End(SHA512_CTX* context, char buffer[]) {
-	sha2_byte	digest[SHA512_DIGEST_LENGTH], *d = digest;
-	int		i;
-
-	/* Sanity check: */
-	assert(context != (SHA512_CTX*)0);
-
-	if (buffer != (char*)0) {
-		SHA512_Final(digest, context);
-
-		for (i = 0; i < SHA512_DIGEST_LENGTH; i++) {
-			*buffer++ = sha2_hex_digits[(*d & 0xf0) >> 4];
-			*buffer++ = sha2_hex_digits[*d & 0x0f];
-			d++;
-		}
-		*buffer = (char)0;
-	} else {
-		bzero(context, sizeof(*context));
-	}
-	bzero(digest, SHA512_DIGEST_LENGTH);
-	return buffer;
-}
-
-char* SHA512_Data(const sha2_byte* data, size_t len, char digest[SHA512_DIGEST_STRING_LENGTH]) {
-	SHA512_CTX	context;
-
-	SHA512_Init(&context);
-	SHA512_Update(&context, data, len);
-	return SHA512_End(&context, digest);
-}
-
-
-/*** SHA-384: *********************************************************/
-void SHA384_Init(SHA384_CTX* context) {
-	if (context == (SHA384_CTX*)0) {
-		return;
-	}
-	bcopy(sha384_initial_hash_value, context->state, SHA512_DIGEST_LENGTH);
-	bzero(context->buffer, SHA384_BLOCK_LENGTH);
-	context->bitcount[0] = context->bitcount[1] = 0;
-}
-
-void SHA384_Update(SHA384_CTX* context, const sha2_byte* data, size_t len) {
-	SHA512_Update((SHA512_CTX*)context, data, len);
-}
-
-void SHA384_Final(sha2_byte digest[], SHA384_CTX* context) {
-	sha2_word64	*d = (sha2_word64*)digest;
-
-	/* Sanity check: */
-	assert(context != (SHA384_CTX*)0);
-
-	/* If no digest buffer is passed, we don't bother doing this: */
-	if (digest != (sha2_byte*)0) {
-		SHA512_Last((SHA512_CTX*)context);
-
-		/* Save the hash data for output: */
-#if BYTE_ORDER == LITTLE_ENDIAN
-		{
-			/* Convert TO host byte order */
-			int	j;
-			for (j = 0; j < 6; j++) {
-				REVERSE64(context->state[j],context->state[j]);
-				*d++ = context->state[j];
-			}
-		}
-#else
-		bcopy(context->state, d, SHA384_DIGEST_LENGTH);
-#endif
-	}
-
-	/* Zero out state data */
-	bzero(context, sizeof(*context));
-}
-
-char *SHA384_End(SHA384_CTX* context, char buffer[]) {
-	sha2_byte	digest[SHA384_DIGEST_LENGTH], *d = digest;
-	int		i;
-
-	/* Sanity check: */
-	assert(context != (SHA384_CTX*)0);
-
-	if (buffer != (char*)0) {
-		SHA384_Final(digest, context);
-
-		for (i = 0; i < SHA384_DIGEST_LENGTH; i++) {
-			*buffer++ = sha2_hex_digits[(*d & 0xf0) >> 4];
-			*buffer++ = sha2_hex_digits[*d & 0x0f];
-			d++;
-		}
-		*buffer = (char)0;
-	} else {
-		bzero(context, sizeof(*context));
-	}
-	bzero(digest, SHA384_DIGEST_LENGTH);
-	return buffer;
-}
-
-char* SHA384_Data(const sha2_byte* data, size_t len, char digest[SHA384_DIGEST_STRING_LENGTH]) {
-	SHA384_CTX	context;
-
-	SHA384_Init(&context);
-	SHA384_Update(&context, data, len);
-	return SHA384_End(&context, digest);
-}
-
-/*glue*/
-#ifdef HAVE_EVP_097
-
-/* SHA256 */
-#define data(ctx) ((SHA256_CTX *)(ctx)->md_data)
-static int sha256_init(EVP_MD_CTX *ctx)
-{
-  SHA256_Init(data(ctx));
-  return 1;
-}
-static int sha256_update(EVP_MD_CTX *ctx, const void *data, unsigned long count)
-{
-  SHA256_Update(data(ctx), data, count);
-  return 1;
-}
-static int sha256_final(EVP_MD_CTX *ctx, unsigned char *md)
-{
-  SHA256_Final(md, data(ctx));
-  return 1;
-}
-#undef data
-
-/* SHA384 */
-#define data(ctx) ((SHA384_CTX *)(ctx)->md_data)
-static int sha384_init(EVP_MD_CTX *ctx)
-{
-  SHA384_Init(data(ctx));
-  return 1;
-}
-static int sha384_update(EVP_MD_CTX *ctx, const void *data, unsigned long count)
-{
-  SHA384_Update(data(ctx), data, count);
-  return 1;
-}
-static int sha384_final(EVP_MD_CTX *ctx, unsigned char *md)
-{
-  SHA384_Final(md, data(ctx));
-  return 1;
-}
-#undef data
-
-/* SHA512 */
-#define data(ctx) ((SHA512_CTX *)(ctx)->md_data)
-static int sha512_init(EVP_MD_CTX *ctx)
-{
-  SHA512_Init(data(ctx));
-  return 1;
-}
-static int sha512_update(EVP_MD_CTX *ctx, const void *data, unsigned long count)
-{
-  SHA512_Update(data(ctx), data, count);
-  return 1;
-}
-static int sha512_final(EVP_MD_CTX *ctx, unsigned char *md)
-{
-  SHA512_Final(md, data(ctx));
-  return 1;
-}
-#undef data
-#endif
-
-static struct env_md_st sha2_256_md = {
-	0, /*NID_sha1*/
-	0, /*NID_sha1WithRSAEncryption*/
-	SHA256_DIGEST_LENGTH,
-#ifdef HAVE_EVP_097
-	0,			/* flags */
-	sha256_init,
-	sha256_update,
-	sha256_final,
-	NULL,			/* copy */
-	NULL,			/* cleanup */
-#else
-	SHA256_Init,
-	SHA256_Update,
-	SHA256_Final,
-#endif
-	NULL, NULL, {0, 0, 0, 0},
-	SHA256_BLOCK_LENGTH,
-	sizeof(struct env_md_st *) + sizeof(SHA256_CTX),
-};
-
-struct env_md_st *EVP_sha2_256(void)
-{
-	return(&sha2_256_md);
-}
-
-static struct env_md_st sha2_384_md = {
-	0, /*NID_sha1*/
-	0, /*NID_sha1WithRSAEncryption*/
-	SHA384_DIGEST_LENGTH,
-#ifdef HAVE_EVP_097
-	0,			/* flags */
-	sha384_init,
-	sha384_update,
-	sha384_final,
-	NULL,			/* copy */
-	NULL,			/* cleanup */
-#else
-	SHA384_Init,
-	SHA384_Update,
-	SHA384_Final,
-#endif
-	NULL, NULL, {0, 0, 0, 0},
-	SHA384_BLOCK_LENGTH,
-	sizeof(struct env_md_st *) + sizeof(SHA384_CTX),
-};
-
-struct env_md_st *EVP_sha2_384(void)
-{
-	return(&sha2_384_md);
-}
-
-static struct env_md_st sha2_512_md = {
-	0, /*NID_sha1*/
-	0, /*NID_sha1WithRSAEncryption*/
-	SHA512_DIGEST_LENGTH,
-#ifdef HAVE_EVP_097
-	0,			/* flags */
-	sha512_init,
-	sha512_update,
-	sha512_final,
-	NULL,			/* copy */
-	NULL,			/* cleanup */
-#else
-	SHA512_Init,
-	SHA512_Update,
-	SHA512_Final,
-#endif
-	NULL, NULL, {0, 0, 0, 0}, /*EVP_PKEY_RSA_method*/
-	SHA512_BLOCK_LENGTH,
-	sizeof(struct env_md_st *) + sizeof(SHA512_CTX),
-};
-
-struct env_md_st *EVP_sha2_512(void)
-{
-	return(&sha2_512_md);
-}
diff --git a/src/racoon/missing/crypto/sha2/sha2.h b/src/racoon/missing/crypto/sha2/sha2.h
deleted file mode 100644
index 42bcc2a..0000000
--- a/src/racoon/missing/crypto/sha2/sha2.h
+++ /dev/null
@@ -1,161 +0,0 @@
-/*	$NetBSD: sha2.h,v 1.4 2006/09/09 16:22:36 manu Exp $	*/
-
-/*	$KAME: sha2.h,v 1.2 2001/08/08 22:09:27 sakane Exp $	*/
-
-/*
- * sha2.h
- *
- * Version 1.0.0beta1
- *
- * Written by Aaron D. Gifford <me@aarongifford.com>
- *
- * Copyright 2000 Aaron D. Gifford.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the copyright holder nor the names of contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) AND CONTRIBUTOR(S) ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR(S) OR CONTRIBUTOR(S) BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- *
- */
-
-#ifndef __SHA2_H__
-#define __SHA2_H__
-
-#ifdef __cplusplus
-extern "C" {
-#endif
-
-
-/*** SHA-256/384/512 Various Length Definitions ***********************/
-#define SHA256_BLOCK_LENGTH		64
-#define SHA256_DIGEST_LENGTH		32
-#define SHA256_DIGEST_STRING_LENGTH	(SHA256_DIGEST_LENGTH * 2 + 1)
-#define SHA384_BLOCK_LENGTH		128
-#define SHA384_DIGEST_LENGTH		48
-#define SHA384_DIGEST_STRING_LENGTH	(SHA384_DIGEST_LENGTH * 2 + 1)
-#define SHA512_BLOCK_LENGTH		128
-#define SHA512_DIGEST_LENGTH		64
-#define SHA512_DIGEST_STRING_LENGTH	(SHA512_DIGEST_LENGTH * 2 + 1)
-
-
-/*** SHA-256/384/512 Context Structures *******************************/
-/* NOTE: If your architecture does not define either u_intXX_t types or
- * uintXX_t (from inttypes.h), you may need to define things by hand
- * for your system:
- */
-#if 0
-typedef unsigned char u_int8_t;		/* 1-byte  (8-bits)  */
-typedef unsigned int u_int32_t;		/* 4-bytes (32-bits) */
-typedef unsigned long long u_int64_t;	/* 8-bytes (64-bits) */
-#endif
-
-#ifndef HAVE_SHA2_IN_SHA_H
-/*
- * Most BSD systems already define u_intXX_t types, as does Linux.
- * Some systems, however, like Compaq's Tru64 Unix instead can use
- * uintXX_t types defined by very recent ANSI C standards and included
- * in the file:
- *
- *   #include <inttypes.h>
- *
- * If you choose to use <inttypes.h> then please define: 
- *
- *   #define SHA2_USE_INTTYPES_H
- *
- * Or on the command line during compile:
- *
- *   cc -DSHA2_USE_INTTYPES_H ...
- */
-#if 0 /*def SHA2_USE_INTTYPES_H*/
-
-typedef struct _SHA256_CTX {
-	uint32_t	state[8];
-	uint64_t	bitcount;
-	uint8_t	buffer[SHA256_BLOCK_LENGTH];
-} SHA256_CTX;
-typedef struct _SHA512_CTX {
-	uint64_t	state[8];
-	uint64_t	bitcount[2];
-	uint8_t	buffer[SHA512_BLOCK_LENGTH];
-} SHA512_CTX;
-
-#else /* SHA2_USE_INTTYPES_H */
-
-typedef struct _SHA256_CTX {
-	u_int32_t	state[8];
-	u_int64_t	bitcount;
-	u_int8_t	buffer[SHA256_BLOCK_LENGTH];
-} SHA256_CTX;
-typedef struct _SHA512_CTX {
-	u_int64_t	state[8];
-	u_int64_t	bitcount[2];
-	u_int8_t	buffer[SHA512_BLOCK_LENGTH];
-} SHA512_CTX;
-
-#endif /* SHA2_USE_INTTYPES_H */
-#endif /* HAVE_SHA2_IN_SHA_H */
-
-typedef SHA512_CTX SHA384_CTX;
-
-
-/*** SHA-256/384/512 Function Prototypes ******************************/
-
-#ifndef HAVE_SHA2_IN_SHA_H
-void SHA256_Init __P((SHA256_CTX *));
-void SHA256_Update __P((SHA256_CTX*, const u_int8_t*, size_t));
-void SHA256_Final __P((u_int8_t[SHA256_DIGEST_LENGTH], SHA256_CTX*));
-#endif /* HAVE_SHA2_IN_SHA_H */
-char* SHA256_End __P((SHA256_CTX*, char[SHA256_DIGEST_STRING_LENGTH]));
-char* SHA256_Data __P((const u_int8_t*, size_t, char[SHA256_DIGEST_STRING_LENGTH]));
-
-#ifndef HAVE_SHA2_IN_SHA_H
-void SHA384_Init __P((SHA384_CTX*));
-void SHA384_Update __P((SHA384_CTX*, const u_int8_t*, size_t));
-void SHA384_Final __P((u_int8_t[SHA384_DIGEST_LENGTH], SHA384_CTX*));
-#endif /* HAVE_SHA2_IN_SHA_H */
-char* SHA384_End __P((SHA384_CTX*, char[SHA384_DIGEST_STRING_LENGTH]));
-char* SHA384_Data __P((const u_int8_t*, size_t, char[SHA384_DIGEST_STRING_LENGTH]));
-
-#ifndef HAVE_SHA2_IN_SHA_H
-void SHA512_Init __P((SHA512_CTX*));
-void SHA512_Update __P((SHA512_CTX*, const u_int8_t*, size_t));
-void SHA512_Final __P((u_int8_t[SHA512_DIGEST_LENGTH], SHA512_CTX*));
-#endif /* HAVE_SHA2_IN_SHA_H */
-char* SHA512_End __P((SHA512_CTX*, char[SHA512_DIGEST_STRING_LENGTH]));
-char* SHA512_Data __P((const u_int8_t*, size_t, char[SHA512_DIGEST_STRING_LENGTH]));
-
-struct env_md_st *EVP_sha2_256 __P((void));
-struct env_md_st *EVP_sha2_384 __P((void));
-struct env_md_st *EVP_sha2_512 __P((void));
-
-#ifdef HAVE_SHA2_IN_SHA_H
-#define EVP_sha2_256 EVP_sha256
-#define EVP_sha2_384 EVP_sha384
-#define EVP_sha2_512 EVP_sha512
-#endif
-
-#ifdef	__cplusplus
-}
-#endif /* __cplusplus */
-
-#endif /* __SHA2_H__ */
-
diff --git a/src/racoon/nattraversal.c b/src/racoon/nattraversal.c
deleted file mode 100644
index 9fd4bcd..0000000
--- a/src/racoon/nattraversal.c
+++ /dev/null
@@ -1,528 +0,0 @@
-/*	$NetBSD: nattraversal.c,v 1.6.6.2 2009/05/18 17:01:07 tteras Exp $	*/
-
-/*
- * Copyright (C) 2004 SuSE Linux AG, Nuernberg, Germany.
- * Contributed by: Michal Ludvig <mludvig@suse.cz>, SUSE Labs
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-
-#ifdef __linux__
-#include <linux/udp.h>
-#endif
-#if defined(__NetBSD__) || defined (__FreeBSD__)
-#include <netinet/udp.h>
-#endif
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-#include <ctype.h>
-
-#include "var.h"
-#include "misc.h"
-#include "vmbuf.h"
-#include "plog.h"
-#include "debug.h"
-
-#include "localconf.h"
-#include "remoteconf.h"
-#include "sockmisc.h"
-#include "isakmp_var.h"
-#include "isakmp.h"
-#include "oakley.h"
-#include "ipsec_doi.h"
-#include "vendorid.h"
-#include "handler.h"
-#include "crypto_openssl.h"
-#include "schedule.h"
-#include "nattraversal.h"
-#include "grabmyaddr.h"
-
-struct natt_ka_addrs {
-  struct sockaddr	*src;
-  struct sockaddr	*dst;
-  unsigned		in_use;
-
-  TAILQ_ENTRY(natt_ka_addrs) chain;
-};
-
-static TAILQ_HEAD(_natt_ka_addrs, natt_ka_addrs) ka_tree;
-
-/*
- * check if the given vid is NAT-T.
- */
-int
-natt_vendorid (int vid)
-{
-  return (
-#ifdef ENABLE_NATT_00
-	  vid == VENDORID_NATT_00 ||
-#endif
-#ifdef ENABLE_NATT_01
-	  vid == VENDORID_NATT_01 ||
-#endif
-#ifdef ENABLE_NATT_02
-	  vid == VENDORID_NATT_02 ||
-	  vid == VENDORID_NATT_02_N ||
-#endif
-#ifdef ENABLE_NATT_03
-	  vid == VENDORID_NATT_03 ||
-#endif
-#ifdef ENABLE_NATT_04
-	  vid == VENDORID_NATT_04 ||
-#endif
-#ifdef ENABLE_NATT_05
-	  vid == VENDORID_NATT_05 ||
-#endif
-#ifdef ENABLE_NATT_06
-	  vid == VENDORID_NATT_06 ||
-#endif
-#ifdef ENABLE_NATT_07
-	  vid == VENDORID_NATT_07 ||
-#endif
-#ifdef ENABLE_NATT_08
-	  vid == VENDORID_NATT_08 ||
-#endif
-	  /* Always enable NATT RFC if ENABLE_NATT
-	   */
-	  vid == VENDORID_NATT_RFC);
-}
-
-vchar_t *
-natt_hash_addr (struct ph1handle *iph1, struct sockaddr *addr)
-{
-  vchar_t *natd;
-  vchar_t *buf;
-  char *ptr;
-  void *addr_ptr, *addr_port;
-  size_t buf_size, addr_size;
-
-  plog (LLV_INFO, LOCATION, addr, "Hashing %s with algo #%d %s\n",
-	saddr2str(addr), iph1->approval->hashtype, 
-	(iph1->rmconf->nat_traversal == NATT_FORCE)?"(NAT-T forced)":"");
-  
-  if (addr->sa_family == AF_INET) {
-    addr_size = sizeof (struct in_addr);	/* IPv4 address */
-    addr_ptr = &((struct sockaddr_in *)addr)->sin_addr;
-    addr_port = &((struct sockaddr_in *)addr)->sin_port;
-  }
-  else if (addr->sa_family == AF_INET6) {
-    addr_size = sizeof (struct in6_addr);	/* IPv6 address */
-    addr_ptr = &((struct sockaddr_in6 *)addr)->sin6_addr;
-    addr_port = &((struct sockaddr_in6 *)addr)->sin6_port;
-  }
-  else {
-    plog (LLV_ERROR, LOCATION, addr, "Unsupported address family #0x%x\n", addr->sa_family);
-    return NULL;
-  }
-
-  buf_size = 2 * sizeof (cookie_t);	/* CKY-I + CKY+R */
-  buf_size += addr_size + 2;	/* Address + Port */
-  
-  if ((buf = vmalloc (buf_size)) == NULL)
-    return NULL;
-
-  ptr = buf->v;
-  
-  /* Copy-in CKY-I */
-  memcpy (ptr, iph1->index.i_ck, sizeof (cookie_t));
-  ptr += sizeof (cookie_t);
-  
-  /* Copy-in CKY-I */
-  memcpy (ptr, iph1->index.r_ck, sizeof (cookie_t));
-  ptr += sizeof (cookie_t);
-  
-  /* Copy-in Address (or zeroes if NATT_FORCE) */
-  if (iph1->rmconf->nat_traversal == NATT_FORCE)
-    memset (ptr, 0, addr_size);
-  else
-    memcpy (ptr, addr_ptr, addr_size);
-  ptr += addr_size;
-
-  /* Copy-in Port number */
-  memcpy (ptr, addr_port, 2);
-
-  natd = oakley_hash (buf, iph1);
-  vfree(buf);
-
-  return natd;
-}
-
-int 
-natt_compare_addr_hash (struct ph1handle *iph1, vchar_t *natd_received,
-			int natd_seq)
-{
-  vchar_t *natd_computed;
-  u_int32_t flag;
-  int verified = 0;
-
-  if (iph1->rmconf->nat_traversal == NATT_FORCE)
-    return verified;
-
-  if (natd_seq == 0) {
-    natd_computed = natt_hash_addr (iph1, iph1->local);
-    flag = NAT_DETECTED_ME;
-  }
-  else {
-    natd_computed = natt_hash_addr (iph1, iph1->remote);
-    flag = NAT_DETECTED_PEER;
-  }
-
-  if (natd_computed == NULL) {
-	plog(LLV_ERROR, LOCATION, NULL, "natd_computed allocation failed\n");
-	return verified; /* XXX should abort */
-  }
-
-  if (natd_received->l == natd_computed->l &&
-      memcmp (natd_received->v, natd_computed->v, natd_received->l) == 0) {
-    iph1->natt_flags &= ~flag;
-    verified = 1;
-  }
-
-  vfree (natd_computed);
-
-  return verified;
-}
-
-int
-natt_udp_encap (int encmode)
-{
-  return (encmode == IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC || 
-	  encmode == IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC ||
-	  encmode == IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_DRAFT ||
-	  encmode == IPSECDOI_ATTR_ENC_MODE_UDPTRNS_DRAFT);
-}
-
-int
-natt_fill_options (struct ph1natt_options *opts, int version)
-{
-  if (! opts)
-    return -1;
-
-  opts->version = version;
-
-  switch (version) {
-    case VENDORID_NATT_00:
-    case VENDORID_NATT_01:
-      opts->float_port = 0; /* No port floating for those drafts */
-      opts->payload_nat_d = ISAKMP_NPTYPE_NATD_DRAFT;
-      opts->payload_nat_oa = ISAKMP_NPTYPE_NATOA_DRAFT;
-      opts->mode_udp_tunnel = IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_DRAFT;
-      opts->mode_udp_transport = IPSECDOI_ATTR_ENC_MODE_UDPTRNS_DRAFT;
-      opts->encaps_type = UDP_ENCAP_ESPINUDP_NON_IKE;
-		break;
-
-    case VENDORID_NATT_02:
-    case VENDORID_NATT_02_N:
-    case VENDORID_NATT_03:
-      opts->float_port = lcconf->port_isakmp_natt;
-      opts->payload_nat_d = ISAKMP_NPTYPE_NATD_DRAFT;
-      opts->payload_nat_oa = ISAKMP_NPTYPE_NATOA_DRAFT;
-      opts->mode_udp_tunnel = IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_DRAFT;
-      opts->mode_udp_transport = IPSECDOI_ATTR_ENC_MODE_UDPTRNS_DRAFT;
-      opts->encaps_type = UDP_ENCAP_ESPINUDP;
-      break;
-    case VENDORID_NATT_04:
-    case VENDORID_NATT_05:
-    case VENDORID_NATT_06:
-    case VENDORID_NATT_07:
-    case VENDORID_NATT_08:
-      opts->float_port = lcconf->port_isakmp_natt;
-      opts->payload_nat_d = ISAKMP_NPTYPE_NATD_BADDRAFT;
-      opts->payload_nat_oa = ISAKMP_NPTYPE_NATOA_BADDRAFT;
-      opts->mode_udp_tunnel = IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC;
-      opts->mode_udp_transport = IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC;
-      opts->encaps_type = UDP_ENCAP_ESPINUDP;
-      break;
-    case VENDORID_NATT_RFC:
-      opts->float_port = lcconf->port_isakmp_natt;
-      opts->payload_nat_d = ISAKMP_NPTYPE_NATD_RFC;
-      opts->payload_nat_oa = ISAKMP_NPTYPE_NATOA_RFC;
-      opts->mode_udp_tunnel = IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC;
-      opts->mode_udp_transport = IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC;
-      opts->encaps_type = UDP_ENCAP_ESPINUDP;
-	  break;
-    default:
-      plog(LLV_ERROR, LOCATION, NULL, 
-	   "unsupported NAT-T version: %s\n",
-	   vid_string_by_id(version));
-      return -1;
-  }
- 
-  opts->mode_udp_diff = opts->mode_udp_tunnel - IPSECDOI_ATTR_ENC_MODE_TUNNEL;
-
-  return 0;
-}
-
-void
-natt_float_ports (struct ph1handle *iph1)
-{
-	if (! (iph1->natt_flags & NAT_DETECTED) )
-		return;
-	if (! iph1->natt_options->float_port){
-		/* Drafts 00 / 01, just schedule keepalive */
-		natt_keepalive_add_ph1 (iph1);
-		return;
-	}
-	
-	set_port (iph1->local, iph1->natt_options->float_port);
-	set_port (iph1->remote, iph1->natt_options->float_port);
-	iph1->natt_flags |= NAT_PORTS_CHANGED | NAT_ADD_NON_ESP_MARKER;
-	
-	natt_keepalive_add_ph1 (iph1);
-}
-
-void
-natt_handle_vendorid (struct ph1handle *iph1, int vid_numeric)
-{
-  if (! iph1->natt_options)
-    iph1->natt_options = racoon_calloc (1, sizeof (*iph1->natt_options));
-
-  if (! iph1->natt_options) {
-    plog (LLV_ERROR, LOCATION, NULL,
-	  "Allocating memory for natt_options failed!\n");
-    return;
-  }
-  
-  if (iph1->natt_options->version < vid_numeric)
-    if (natt_fill_options (iph1->natt_options, vid_numeric) == 0)
-      iph1->natt_flags |= NAT_ANNOUNCED;
-}
-
-static void
-natt_keepalive_delete (struct natt_ka_addrs *ka)
-{
-  TAILQ_REMOVE (&ka_tree, ka, chain);
-  racoon_free (ka->src);
-  racoon_free (ka->dst);
-  racoon_free (ka);
-}
-
-/* NAT keepalive functions */
-static void
-natt_keepalive_send (void *param)
-{
-  struct natt_ka_addrs	*ka, *next = NULL;
-  char keepalive_packet[] = { 0xff };
-  size_t len;
-  int s;
-
-  for (ka = TAILQ_FIRST(&ka_tree); ka; ka = next) {
-    next = TAILQ_NEXT(ka, chain);
-    
-    s = getsockmyaddr(ka->src);
-    if (s == -1) {
-      natt_keepalive_delete(ka);
-      continue;
-    }
-    plog (LLV_DEBUG, LOCATION, NULL, "KA: %s\n", 
-	  saddr2str_fromto("%s->%s", ka->src, ka->dst));
-    len = sendfromto(s, keepalive_packet, sizeof (keepalive_packet),
-		     ka->src, ka->dst, 1);
-    if (len == -1)
-      plog(LLV_ERROR, LOCATION, NULL, "KA: sendfromto failed: %s\n",
-	   strerror (errno));
-  }
-  
-  sched_new (lcconf->natt_ka_interval, natt_keepalive_send, NULL);
-}
-
-void
-natt_keepalive_init (void)
-{
-  TAILQ_INIT(&ka_tree);
-
-  /* To disable sending KAs set natt_ka_interval=0 */
-  if (lcconf->natt_ka_interval > 0)
-    sched_new (lcconf->natt_ka_interval, natt_keepalive_send, NULL);
-}
-
-int
-natt_keepalive_add (struct sockaddr *src, struct sockaddr *dst)
-{
-  struct natt_ka_addrs *ka = NULL, *new_addr;
-  
-  TAILQ_FOREACH (ka, &ka_tree, chain) {
-    if (cmpsaddrstrict(ka->src, src) == 0 && 
-	cmpsaddrstrict(ka->dst, dst) == 0) {
-      ka->in_use++;
-      plog (LLV_INFO, LOCATION, NULL, "KA found: %s (in_use=%u)\n",
-	    saddr2str_fromto("%s->%s", src, dst), ka->in_use);
-      return 0;
-    }
-  }
-
-  plog (LLV_INFO, LOCATION, NULL, "KA list add: %s\n", saddr2str_fromto("%s->%s", src, dst));
-
-  new_addr = (struct natt_ka_addrs *)racoon_malloc(sizeof(*new_addr));
-  if (! new_addr) {
-    plog (LLV_ERROR, LOCATION, NULL, "Can't allocate new KA list item\n");
-    return -1;
-  }
-
-  if ((new_addr->src = dupsaddr(src)) == NULL) {
-	racoon_free(new_addr);
-    	plog (LLV_ERROR, LOCATION, NULL, "Can't allocate new KA list item\n");
-	return -1;
-  }
-  if ((new_addr->dst = dupsaddr(dst)) == NULL) {
-	racoon_free(new_addr);
-    	plog (LLV_ERROR, LOCATION, NULL, "Can't allocate new KA list item\n");
-	return -1;
-  }
-  new_addr->in_use = 1;
-  TAILQ_INSERT_TAIL(&ka_tree, new_addr, chain);
-
-  return 0;
-}
-
-int
-natt_keepalive_add_ph1 (struct ph1handle *iph1)
-{
-  int ret = 0;
-  
-  /* Should only the NATed host send keepalives?
-     If yes, add '(iph1->natt_flags & NAT_DETECTED_ME)'
-     to the following condition. */
-  if (iph1->natt_flags & NAT_DETECTED &&
-      ! (iph1->natt_flags & NAT_KA_QUEUED)) {
-    ret = natt_keepalive_add (iph1->local, iph1->remote);
-    if (ret == 0)
-      iph1->natt_flags |= NAT_KA_QUEUED;
-  }
-
-  return ret;
-}
-
-void
-natt_keepalive_remove (struct sockaddr *src, struct sockaddr *dst)
-{
-  struct natt_ka_addrs *ka, *next = NULL;
-
-  plog (LLV_INFO, LOCATION, NULL, "KA remove: %s\n", saddr2str_fromto("%s->%s", src, dst));
-
-  for (ka = TAILQ_FIRST(&ka_tree); ka; ka = next) {
-    next = TAILQ_NEXT(ka, chain);
- 
-    plog (LLV_DEBUG, LOCATION, NULL, "KA tree dump: %s (in_use=%u)\n",
-	  saddr2str_fromto("%s->%s", src, dst), ka->in_use);
-
-    if (cmpsaddrstrict(ka->src, src) == 0 && 
-	cmpsaddrstrict(ka->dst, dst) == 0 &&
-	-- ka->in_use <= 0) {
-
-      plog (LLV_DEBUG, LOCATION, NULL, "KA removing this one...\n");
-
-      natt_keepalive_delete (ka);
-      /* Should we break here? Every pair of addresses should 
-         be inserted only once, but who knows :-) Lets traverse 
-	 the whole list... */
-    }
-  }
-}
-
-static struct remoteconf *
-natt_enabled_in_rmconf_stub (struct remoteconf *rmconf, void *data)
-{
-  return (rmconf->nat_traversal ? rmconf : NULL);
-}
-
-int
-natt_enabled_in_rmconf ()
-{
-  return foreachrmconf (natt_enabled_in_rmconf_stub, NULL) != NULL;
-}
-
-
-struct payload_list *
-isakmp_plist_append_natt_vids (struct payload_list *plist, vchar_t *vid_natt[MAX_NATT_VID_COUNT]){
-	int i, vid_natt_i = 0;
-
-	if(vid_natt == NULL)
-		return NULL;
-
-	for (i = 0; i < MAX_NATT_VID_COUNT; i++)
-		vid_natt[i]=NULL;
-	
-	/* Puts the olders VIDs last, as some implementations may choose the first
-	 * NATT VID given
-	 */
-
-	/* Always set RFC VID
-	 */
-	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_RFC)) != NULL)
-		vid_natt_i++;
-#ifdef ENABLE_NATT_08
-	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_08)) != NULL)
-		vid_natt_i++;
-#endif
-#ifdef ENABLE_NATT_07
-	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_07)) != NULL)
-		vid_natt_i++;
-#endif
-#ifdef ENABLE_NATT_06
-	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_06)) != NULL)
-		vid_natt_i++;
-#endif
-#ifdef ENABLE_NATT_05
-	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_05)) != NULL)
-		vid_natt_i++;
-#endif
-#ifdef ENABLE_NATT_04
-	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_04)) != NULL)
-		vid_natt_i++;
-#endif
-#ifdef ENABLE_NATT_03
-	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_03)) != NULL)
-		vid_natt_i++;
-#endif
-#ifdef ENABLE_NATT_02
-	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_02)) != NULL)
-		vid_natt_i++;
-	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_02_N)) != NULL)
-		vid_natt_i++;
-#endif
-#ifdef ENABLE_NATT_01
-	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_01)) != NULL)
-		vid_natt_i++;
-#endif
-#ifdef ENABLE_NATT_00
-	if ((vid_natt[vid_natt_i] = set_vendorid(VENDORID_NATT_00)) != NULL)
-		vid_natt_i++;
-#endif
-	/* set VID payload for NAT-T */
-	for (i = 0; i < vid_natt_i; i++)
-		plist = isakmp_plist_append(plist, vid_natt[i], ISAKMP_NPTYPE_VID);
-	
-	return plist;
-}
diff --git a/src/racoon/nattraversal.h b/src/racoon/nattraversal.h
deleted file mode 100644
index cec5815..0000000
--- a/src/racoon/nattraversal.h
+++ /dev/null
@@ -1,99 +0,0 @@
-/*	$NetBSD: nattraversal.h,v 1.6 2006/09/09 16:22:09 manu Exp $	*/
-
-/*
- * Copyright (C) 2004 SuSE Linux AG, Nuernberg, Germany.
- * Contributed by: Michal Ludvig <mludvig@suse.cz>, SUSE Labs
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _NATTRAVERSAL_H
-#define _NATTRAVERSAL_H
-
-#include "vendorid.h"
-
-#define	NAT_ANNOUNCED		(1L<<0)
-#define	NAT_DETECTED_ME		(1L<<1)
-#define	NAT_DETECTED_PEER	(1L<<2)
-#define	NAT_PORTS_CHANGED	(1L<<3)
-#define	NAT_KA_QUEUED		(1L<<4)
-#define	NAT_ADD_NON_ESP_MARKER	(1L<<5)
-
-#define	NATT_AVAILABLE(ph1)	((iph1)->natt_flags & NAT_ANNOUNCED)
-
-#define	NAT_DETECTED	(NAT_DETECTED_ME | NAT_DETECTED_PEER)
-
-#define	NON_ESP_MARKER_LEN	sizeof(u_int32_t)
-#define	NON_ESP_MARKER_USE(iph1)	((iph1)->natt_flags & NAT_ADD_NON_ESP_MARKER)
-
-/* These are the values from parsing "remote {}" 
-   block of the config file. */
-#define NATT_OFF	FLASE	/* = 0 */
-#define NATT_ON		TRUE	/* = 1 */
-#define NATT_FORCE	2
-
-struct ph1natt_options {
-  int		version;
-  u_int16_t	float_port;
-  u_int16_t	mode_udp_tunnel;
-  u_int16_t	mode_udp_transport;
-  u_int16_t	encaps_type; /* ESPINUDP / ESPINUDP_NON_IKE */
-  u_int16_t	mode_udp_diff;
-  u_int16_t	payload_nat_d;
-  u_int16_t	payload_nat_oa;
-};
-
-struct ph2natt {
-  u_int8_t	type;
-  u_int16_t	sport;
-  u_int16_t	dport;
-  struct sockaddr	*oa;
-  u_int16_t	frag;
-};
-
-int natt_vendorid (int vid);
-vchar_t *natt_hash_addr (struct ph1handle *iph1, struct sockaddr *addr);
-int natt_compare_addr_hash (struct ph1handle *iph1, vchar_t *natd_received, int natd_seq);
-int natt_udp_encap (int encmode);
-int natt_fill_options (struct ph1natt_options *opts, int version);
-void natt_float_ports (struct ph1handle *iph1);
-void natt_handle_vendorid (struct ph1handle *iph1, int vid_numeric);
-
-
-struct payload_list *
-isakmp_plist_append_natt_vids (struct payload_list *plist, vchar_t *vid_natt[MAX_NATT_VID_COUNT]);
-
-
-/* NAT keepalive functions */
-void natt_keepalive_init (void);
-int natt_keepalive_add (struct sockaddr *src, struct sockaddr *dst);
-int natt_keepalive_add_ph1 (struct ph1handle *iph1);
-void natt_keepalive_remove (struct sockaddr *src, struct sockaddr *dst);
-
-/* Walk through all rmconfigs and tell if NAT-T is enabled in at least one. */
-int natt_enabled_in_rmconf (void);
-
-#endif /* _NATTRAVERSAL_H */
diff --git a/src/racoon/netdb_dnssec.h b/src/racoon/netdb_dnssec.h
deleted file mode 100644
index a11209d..0000000
--- a/src/racoon/netdb_dnssec.h
+++ /dev/null
@@ -1,74 +0,0 @@
-/*	$NetBSD: netdb_dnssec.h,v 1.4 2006/09/09 16:22:09 manu Exp $	*/
-
-/* Id: netdb_dnssec.h,v 1.3 2004/06/11 16:00:17 ludvigm Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _NETDB_DNSSEC_H
-#define _NETDB_DNSSEC_H
-
-#ifndef T_CERT
-#define T_CERT	37		/* defined by RFC2538 section 2 */
-#endif
-
-/* RFC2538 section 2.1 */
-#define DNSSEC_TYPE_PKIX	1
-#define DNSSEC_TYPE_SPKI	2
-#define DNSSEC_TYPE_PGP		3
-#define DNSSEC_TYPE_URI		4
-#define DNSSEC_TYPE_OID		5
-
-/* RFC2535 section 3.2 */
-#define DNSSEC_ALG_RSAMD5	1
-#define DNSSEC_ALG_DH		2
-#define DNSSEC_ALG_DSA		3
-#define DNSSEC_ALG_ECC		4
-#define DNSSEC_ALG_PRIVATEDNS	5
-#define DNSSEC_ALG_PRIVATEOID	6
-
-/*
- * Structures returned by network data base library.  All addresses are
- * supplied in host order, and returned in network order (suitable for
- * use in system calls).
- */
-struct certinfo {
-	int ci_type;			/* certificate type */
-	int ci_keytag;			/* keytag */
-	int ci_algorithm;		/* algorithm */
-	int ci_flags;			/* currently, 1:valid or 0:uncertain */
-	size_t ci_certlen;		/* length of certificate */
-	char *ci_cert;			/* certificate */
-	struct certinfo *ci_next;	/* next structure */
-};
-
-extern void freecertinfo __P((struct certinfo *));
-extern int getcertsbyname __P((char *, struct certinfo **));
-
-#endif /* _NETDB_DNSSEC_H */
diff --git a/src/racoon/oakley.c b/src/racoon/oakley.c
deleted file mode 100644
index 5b6ad46..0000000
--- a/src/racoon/oakley.c
+++ /dev/null
@@ -1,3429 +0,0 @@
-/*	$NetBSD: oakley.c,v 1.9.6.4 2009/08/13 09:18:45 vanhu Exp $	*/
-
-/* Id: oakley.c,v 1.32 2006/05/26 12:19:46 manubsd Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/socket.h>	/* XXX for subjectaltname */
-#include <netinet/in.h>	/* XXX for subjectaltname */
-
-#include <openssl/x509.h>
-#include <openssl/err.h>
-
-#if !defined(OPENSSL_IS_BORINGSSL)
-#include <openssl/engine.h>
-#include <openssl/pkcs7.h>
-#else
-#include <openssl/bytestring.h>
-#endif
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-
-#if TIME_WITH_SYS_TIME
-# include <sys/time.h>
-# include <time.h>
-#else
-# if HAVE_SYS_TIME_H
-#  include <sys/time.h>
-# else
-#  include <time.h>
-# endif
-#endif
-#ifdef ENABLE_HYBRID
-#include <resolv.h>
-#endif
-
-#include "var.h"
-#include "misc.h"
-#include "vmbuf.h"
-#include "str2val.h"
-#include "plog.h"
-#include "debug.h"
-
-#include "isakmp_var.h"
-#include "isakmp.h"
-#ifdef ENABLE_HYBRID
-#include "isakmp_xauth.h"
-#include "isakmp_cfg.h" 
-#endif                
-#include "oakley.h"
-#include "admin.h"
-#include "privsep.h"
-#include "localconf.h"
-#include "remoteconf.h"
-#include "policy.h"
-#include "handler.h"
-#include "ipsec_doi.h"
-#include "algorithm.h"
-#include "dhgroup.h"
-#include "sainfo.h"
-#include "proposal.h"
-#include "crypto_openssl.h"
-#include "dnssec.h"
-#include "sockmisc.h"
-#include "strnames.h"
-#include "gcmalloc.h"
-#include "rsalist.h"
-
-#ifdef HAVE_GSSAPI
-#include "gssapi.h"
-#endif
-
-#define OUTBOUND_SA	0
-#define INBOUND_SA	1
-
-#define INITDHVAL(a, s, d, t)                                                  \
-do {                                                                           \
-	vchar_t buf;                                                           \
-	buf.v = str2val((s), 16, &buf.l);                                      \
-	memset(&a, 0, sizeof(struct dhgroup));                                 \
-	a.type = (t);                                                          \
-	a.prime = vdup(&buf);                                                  \
-	a.gen1 = 2;                                                            \
-	a.gen2 = 0;                                                            \
-	racoon_free(buf.v);                                                    \
-} while(0);
-
-struct dhgroup dh_modp768;
-struct dhgroup dh_modp1024;
-struct dhgroup dh_modp1536;
-struct dhgroup dh_modp2048;
-struct dhgroup dh_modp3072;
-struct dhgroup dh_modp4096;
-struct dhgroup dh_modp6144;
-struct dhgroup dh_modp8192;
-
-
-static int oakley_check_dh_pub __P((vchar_t *, vchar_t **));
-static int oakley_compute_keymat_x __P((struct ph2handle *, int, int));
-static int get_cert_fromlocal __P((struct ph1handle *, int));
-static int get_plainrsa_fromlocal __P((struct ph1handle *, int));
-static int oakley_check_certid __P((struct ph1handle *iph1));
-static int check_typeofcertname __P((int, int));
-static cert_t *save_certbuf __P((struct isakmp_gen *));
-static cert_t *save_certx509 __P((X509 *));
-static int oakley_padlen __P((int, int));
-
-int
-oakley_get_defaultlifetime()
-{
-	return OAKLEY_ATTR_SA_LD_SEC_DEFAULT;
-}
-
-int
-oakley_dhinit()
-{
-	/* set DH MODP */
-	INITDHVAL(dh_modp768, OAKLEY_PRIME_MODP768,
-		OAKLEY_ATTR_GRP_DESC_MODP768, OAKLEY_ATTR_GRP_TYPE_MODP);
-	INITDHVAL(dh_modp1024, OAKLEY_PRIME_MODP1024,
-		OAKLEY_ATTR_GRP_DESC_MODP1024, OAKLEY_ATTR_GRP_TYPE_MODP);
-	INITDHVAL(dh_modp1536, OAKLEY_PRIME_MODP1536,
-		OAKLEY_ATTR_GRP_DESC_MODP1536, OAKLEY_ATTR_GRP_TYPE_MODP);
-	INITDHVAL(dh_modp2048, OAKLEY_PRIME_MODP2048,
-		OAKLEY_ATTR_GRP_DESC_MODP2048, OAKLEY_ATTR_GRP_TYPE_MODP);
-	INITDHVAL(dh_modp3072, OAKLEY_PRIME_MODP3072,
-		OAKLEY_ATTR_GRP_DESC_MODP3072, OAKLEY_ATTR_GRP_TYPE_MODP);
-	INITDHVAL(dh_modp4096, OAKLEY_PRIME_MODP4096,
-		OAKLEY_ATTR_GRP_DESC_MODP4096, OAKLEY_ATTR_GRP_TYPE_MODP);
-	INITDHVAL(dh_modp6144, OAKLEY_PRIME_MODP6144,
-		OAKLEY_ATTR_GRP_DESC_MODP6144, OAKLEY_ATTR_GRP_TYPE_MODP);
-	INITDHVAL(dh_modp8192, OAKLEY_PRIME_MODP8192,
-		OAKLEY_ATTR_GRP_DESC_MODP8192, OAKLEY_ATTR_GRP_TYPE_MODP);
-
-	return 0;
-}
-
-void
-oakley_dhgrp_free(dhgrp)
-	struct dhgroup *dhgrp;
-{
-	if (dhgrp->prime)
-		vfree(dhgrp->prime);
-	if (dhgrp->curve_a)
-		vfree(dhgrp->curve_a);
-	if (dhgrp->curve_b)
-		vfree(dhgrp->curve_b);
-	if (dhgrp->order)
-		vfree(dhgrp->order);
-	racoon_free(dhgrp);
-}
-
-/*
- * RFC2409 5
- * The length of the Diffie-Hellman public value MUST be equal to the
- * length of the prime modulus over which the exponentiation was
- * performed, prepending zero bits to the value if necessary.
- */
-static int
-oakley_check_dh_pub(prime, pub0)
-	vchar_t *prime, **pub0;
-{
-	vchar_t *tmp;
-	vchar_t *pub = *pub0;
-
-	if (prime->l == pub->l)
-		return 0;
-
-	if (prime->l < pub->l) {
-		/* what should i do ? */
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid public information was generated.\n");
-		return -1;
-	}
-
-	/* prime->l > pub->l */
-	tmp = vmalloc(prime->l);
-	if (tmp == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get DH buffer.\n");
-		return -1;
-	}
-	memcpy(tmp->v + prime->l - pub->l, pub->v, pub->l);
-
-	vfree(*pub0);
-	*pub0 = tmp;
-
-	return 0;
-}
-
-/*
- * compute sharing secret of DH
- * IN:	*dh, *pub, *priv, *pub_p
- * OUT: **gxy
- */
-int
-oakley_dh_compute(dh, pub, priv, pub_p, gxy)
-	const struct dhgroup *dh;
-	vchar_t *pub, *priv, *pub_p, **gxy;
-{
-#ifdef ENABLE_STATS
-	struct timeval start, end;
-#endif
-	if ((*gxy = vmalloc(dh->prime->l)) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get DH buffer.\n");
-		return -1;
-	}
-
-#ifdef ENABLE_STATS
-	gettimeofday(&start, NULL);
-#endif
-	switch (dh->type) {
-	case OAKLEY_ATTR_GRP_TYPE_MODP:
-		if (eay_dh_compute(dh->prime, dh->gen1, pub, priv, pub_p, gxy) < 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to compute dh value.\n");
-			return -1;
-		}
-		break;
-	case OAKLEY_ATTR_GRP_TYPE_ECP:
-	case OAKLEY_ATTR_GRP_TYPE_EC2N:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"dh type %d isn't supported.\n", dh->type);
-		return -1;
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid dh type %d.\n", dh->type);
-		return -1;
-	}
-
-#ifdef ENABLE_STATS
-	gettimeofday(&end, NULL);
-	syslog(LOG_NOTICE, "%s(%s%zu): %8.6f", __func__,
-		s_attr_isakmp_group(dh->type), dh->prime->l << 3,
-		timedelta(&start, &end));
-#endif
-
-	plog(LLV_DEBUG, LOCATION, NULL, "compute DH's shared.\n");
-	plogdump(LLV_DEBUG, (*gxy)->v, (*gxy)->l);
-
-	return 0;
-}
-
-/*
- * generate values of DH
- * IN:	*dh
- * OUT: **pub, **priv
- */
-int
-oakley_dh_generate(dh, pub, priv)
-	const struct dhgroup *dh;
-	vchar_t **pub, **priv;
-{
-#ifdef ENABLE_STATS
-	struct timeval start, end;
-	gettimeofday(&start, NULL);
-#endif
-	switch (dh->type) {
-	case OAKLEY_ATTR_GRP_TYPE_MODP:
-		if (eay_dh_generate(dh->prime, dh->gen1, dh->gen2, pub, priv) < 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to compute dh value.\n");
-			return -1;
-		}
-		break;
-
-	case OAKLEY_ATTR_GRP_TYPE_ECP:
-	case OAKLEY_ATTR_GRP_TYPE_EC2N:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"dh type %d isn't supported.\n", dh->type);
-		return -1;
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid dh type %d.\n", dh->type);
-		return -1;
-	}
-
-#ifdef ENABLE_STATS
-	gettimeofday(&end, NULL);
-	syslog(LOG_NOTICE, "%s(%s%zu): %8.6f", __func__,
-		s_attr_isakmp_group(dh->type), dh->prime->l << 3,
-		timedelta(&start, &end));
-#endif
-
-	if (oakley_check_dh_pub(dh->prime, pub) != 0)
-		return -1;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "compute DH's private.\n");
-	plogdump(LLV_DEBUG, (*priv)->v, (*priv)->l);
-	plog(LLV_DEBUG, LOCATION, NULL, "compute DH's public.\n");
-	plogdump(LLV_DEBUG, (*pub)->v, (*pub)->l);
-
-	return 0;
-}
-
-/*
- * copy pre-defined dhgroup values.
- */
-int
-oakley_setdhgroup(group, dhgrp)
-	int group;
-	struct dhgroup **dhgrp;
-{
-	struct dhgroup *g;
-
-	*dhgrp = NULL;	/* just make sure, initialize */
-
-	g = alg_oakley_dhdef_group(group);
-	if (g == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid DH parameter grp=%d.\n", group);
-		return -1;
-	}
-
-	if (!g->type || !g->prime || !g->gen1) {
-		/* unsuported */
-		plog(LLV_ERROR, LOCATION, NULL,
-			"unsupported DH parameters grp=%d.\n", group);
-		return -1;
-	}
-
-	*dhgrp = racoon_calloc(1, sizeof(struct dhgroup));
-	if (*dhgrp == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get DH buffer.\n");
-		return 0;
-	}
-
-	/* set defined dh vlaues */
-	memcpy(*dhgrp, g, sizeof(*g));
-	(*dhgrp)->prime = vdup(g->prime);
-
-	return 0;
-}
-
-/*
- * PRF
- *
- * NOTE: we do not support prf with different input/output bitwidth,
- * so we do not implement RFC2409 Appendix B (DOORAK-MAC example) in
- * oakley_compute_keymat().  If you add support for such prf function,
- * modify oakley_compute_keymat() accordingly.
- */
-vchar_t *
-oakley_prf(key, buf, iph1)
-	vchar_t *key, *buf;
-	struct ph1handle *iph1;
-{
-	vchar_t *res = NULL;
-	int type;
-
-	if (iph1->approval == NULL) {
-		/*
-		 * it's before negotiating hash algorithm.
-		 * We use md5 as default.
-		 */
-		type = OAKLEY_ATTR_HASH_ALG_MD5;
-	} else
-		type = iph1->approval->hashtype;
-
-	res = alg_oakley_hmacdef_one(type, key, buf);
-	if (res == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid hmac algorithm %d.\n", type);
-		return NULL;
-	}
-
-	return res;
-}
-
-/*
- * hash
- */
-vchar_t *
-oakley_hash(buf, iph1)
-	vchar_t *buf;
-	struct ph1handle *iph1;
-{
-	vchar_t *res = NULL;
-	int type;
-
-	if (iph1->approval == NULL) {
-		/*
-		 * it's before negotiating hash algorithm.
-		 * We use md5 as default.
-		 */
-		type = OAKLEY_ATTR_HASH_ALG_MD5;
-	} else
-		type = iph1->approval->hashtype;
-
-	res = alg_oakley_hashdef_one(type, buf);
-	if (res == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid hash algoriym %d.\n", type);
-		return NULL;
-	}
-
-	return res;
-}
-
-/*
- * compute KEYMAT
- *   see seciton 5.5 Phase 2 - Quick Mode in isakmp-oakley-05.
- */
-int
-oakley_compute_keymat(iph2, side)
-	struct ph2handle *iph2;
-	int side;
-{
-	int error = -1;
-
-	/* compute sharing secret of DH when PFS */
-	if (iph2->approval->pfs_group && iph2->dhpub_p) {
-		if (oakley_dh_compute(iph2->pfsgrp, iph2->dhpub,
-				iph2->dhpriv, iph2->dhpub_p, &iph2->dhgxy) < 0)
-			goto end;
-	}
-
-	/* compute keymat */
-	if (oakley_compute_keymat_x(iph2, side, INBOUND_SA) < 0
-	 || oakley_compute_keymat_x(iph2, side, OUTBOUND_SA) < 0)
-		goto end;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "KEYMAT computed.\n");
-
-	error = 0;
-
-end:
-	return error;
-}
-
-/*
- * compute KEYMAT.
- * KEYMAT = prf(SKEYID_d, protocol | SPI | Ni_b | Nr_b).
- * If PFS is desired and KE payloads were exchanged,
- *   KEYMAT = prf(SKEYID_d, g(qm)^xy | protocol | SPI | Ni_b | Nr_b)
- *
- * NOTE: we do not support prf with different input/output bitwidth,
- * so we do not implement RFC2409 Appendix B (DOORAK-MAC example).
- */
-static int
-oakley_compute_keymat_x(iph2, side, sa_dir)
-	struct ph2handle *iph2;
-	int side;
-	int sa_dir;
-{
-	vchar_t *buf = NULL, *res = NULL, *bp;
-	char *p;
-	int len;
-	int error = -1;
-	int pfs = 0;
-	int dupkeymat;	/* generate K[1-dupkeymat] */
-	struct saproto *pr;
-	struct satrns *tr;
-	int encklen, authklen, l;
-
-	pfs = ((iph2->approval->pfs_group && iph2->dhgxy) ? 1 : 0);
-	
-	len = pfs ? iph2->dhgxy->l : 0;
-	len += (1
-		+ sizeof(u_int32_t)	/* XXX SPI size */
-		+ iph2->nonce->l
-		+ iph2->nonce_p->l);
-	buf = vmalloc(len);
-	if (buf == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get keymat buffer.\n");
-		goto end;
-	}
-
-	for (pr = iph2->approval->head; pr != NULL; pr = pr->next) {
-		p = buf->v;
-
-		/* if PFS */
-		if (pfs) {
-			memcpy(p, iph2->dhgxy->v, iph2->dhgxy->l);
-			p += iph2->dhgxy->l;
-		}
-
-		p[0] = pr->proto_id;
-		p += 1;
-
-		memcpy(p, (sa_dir == INBOUND_SA ? &pr->spi : &pr->spi_p),
-			sizeof(pr->spi));
-		p += sizeof(pr->spi);
-
-		bp = (side == INITIATOR ? iph2->nonce : iph2->nonce_p);
-		memcpy(p, bp->v, bp->l);
-		p += bp->l;
-
-		bp = (side == INITIATOR ? iph2->nonce_p : iph2->nonce);
-		memcpy(p, bp->v, bp->l);
-		p += bp->l;
-
-		/* compute IV */
-		plog(LLV_DEBUG, LOCATION, NULL, "KEYMAT compute with\n");
-		plogdump(LLV_DEBUG, buf->v, buf->l);
-
-		/* res = K1 */
-		res = oakley_prf(iph2->ph1->skeyid_d, buf, iph2->ph1);
-		if (res == NULL)
-			goto end;
-
-		/* compute key length needed */
-		encklen = authklen = 0;
-		switch (pr->proto_id) {
-		case IPSECDOI_PROTO_IPSEC_ESP:
-			for (tr = pr->head; tr; tr = tr->next) {
-				l = alg_ipsec_encdef_keylen(tr->trns_id,
-				    tr->encklen);
-				if (l > encklen)
-					encklen = l;
-
-				l = alg_ipsec_hmacdef_hashlen(tr->authtype);
-				if (l > authklen)
-					authklen = l;
-			}
-			break;
-		case IPSECDOI_PROTO_IPSEC_AH:
-			for (tr = pr->head; tr; tr = tr->next) {
-				l = alg_ipsec_hmacdef_hashlen(tr->trns_id);
-				if (l > authklen)
-					authklen = l;
-			}
-			break;
-		default:
-			break;
-		}
-		plog(LLV_DEBUG, LOCATION, NULL, "encklen=%d authklen=%d\n",
-			encklen, authklen);
-
-		dupkeymat = (encklen + authklen) / 8 / res->l;
-		dupkeymat += 2;	/* safety mergin */
-		if (dupkeymat < 3)
-			dupkeymat = 3;
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"generating %zu bits of key (dupkeymat=%d)\n",
-			dupkeymat * 8 * res->l, dupkeymat);
-		if (0 < --dupkeymat) {
-			vchar_t *prev = res;	/* K(n-1) */
-			vchar_t *seed = NULL;	/* seed for Kn */
-			size_t l;
-
-			/*
-			 * generating long key (isakmp-oakley-08 5.5)
-			 *   KEYMAT = K1 | K2 | K3 | ...
-			 * where
-			 *   src = [ g(qm)^xy | ] protocol | SPI | Ni_b | Nr_b
-			 *   K1 = prf(SKEYID_d, src)
-			 *   K2 = prf(SKEYID_d, K1 | src)
-			 *   K3 = prf(SKEYID_d, K2 | src)
-			 *   Kn = prf(SKEYID_d, K(n-1) | src)
-			 */
-			plog(LLV_DEBUG, LOCATION, NULL,
-				"generating K1...K%d for KEYMAT.\n",
-				dupkeymat + 1);
-
-			seed = vmalloc(prev->l + buf->l);
-			if (seed == NULL) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"failed to get keymat buffer.\n");
-				if (prev && prev != res)
-					vfree(prev);
-				goto end;
-			}
-
-			while (dupkeymat--) {
-				vchar_t *this = NULL;	/* Kn */
-				int update_prev;
-
-				memcpy(seed->v, prev->v, prev->l);
-				memcpy(seed->v + prev->l, buf->v, buf->l);
-				this = oakley_prf(iph2->ph1->skeyid_d, seed,
-							iph2->ph1);
-				if (!this) {
-					plog(LLV_ERROR, LOCATION, NULL,
-						"oakley_prf memory overflow\n");
-					if (prev && prev != res)
-						vfree(prev);
-					vfree(this);
-					vfree(seed);
-					goto end;
-				}
-
-				update_prev = (prev && prev == res) ? 1 : 0;
-
-				l = res->l;
-				res = vrealloc(res, l + this->l);
-
-				if (update_prev)
-					prev = res;
-
-				if (res == NULL) {
-					plog(LLV_ERROR, LOCATION, NULL,
-						"failed to get keymat buffer.\n");
-					if (prev && prev != res)
-						vfree(prev);
-					vfree(this);
-					vfree(seed);
-					goto end;
-				}
-				memcpy(res->v + l, this->v, this->l);
-
-				if (prev && prev != res)
-					vfree(prev);
-				prev = this;
-				this = NULL;
-			}
-
-			if (prev && prev != res)
-				vfree(prev);
-			vfree(seed);
-		}
-
-		plogdump(LLV_DEBUG, res->v, res->l);
-
-		if (sa_dir == INBOUND_SA)
-			pr->keymat = res;
-		else
-			pr->keymat_p = res;
-		res = NULL;
-	}
-
-	error = 0;
-
-end:
-	if (error) {
-		for (pr = iph2->approval->head; pr != NULL; pr = pr->next) {
-			if (pr->keymat) {
-				vfree(pr->keymat);
-				pr->keymat = NULL;
-			}
-			if (pr->keymat_p) {
-				vfree(pr->keymat_p);
-				pr->keymat_p = NULL;
-			}
-		}
-	}
-
-	if (buf != NULL)
-		vfree(buf);
-	if (res)
-		vfree(res);
-
-	return error;
-}
-
-#if notyet
-/*
- * NOTE: Must terminate by NULL.
- */
-vchar_t *
-oakley_compute_hashx(struct ph1handle *iph1, ...)
-{
-	vchar_t *buf, *res;
-	vchar_t *s;
-	caddr_t p;
-	int len;
-
-	va_list ap;
-
-	/* get buffer length */
-	va_start(ap, iph1);
-	len = 0;
-        while ((s = va_arg(ap, vchar_t *)) != NULL) {
-		len += s->l
-        }
-	va_end(ap);
-
-	buf = vmalloc(len);
-	if (buf == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get hash buffer\n");
-		return NULL;
-	}
-
-	/* set buffer */
-	va_start(ap, iph1);
-	p = buf->v;
-        while ((s = va_arg(ap, char *)) != NULL) {
-		memcpy(p, s->v, s->l);
-		p += s->l;
-	}
-	va_end(ap);
-
-	plog(LLV_DEBUG, LOCATION, NULL, "HASH with: \n");
-	plogdump(LLV_DEBUG, buf->v, buf->l);
-
-	/* compute HASH */
-	res = oakley_prf(iph1->skeyid_a, buf, iph1);
-	vfree(buf);
-	if (res == NULL)
-		return NULL;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "HASH computed:\n");
-	plogdump(LLV_DEBUG, res->v, res->l);
-
-	return res;
-}
-#endif
-
-/*
- * compute HASH(3) prf(SKEYID_a, 0 | M-ID | Ni_b | Nr_b)
- *   see seciton 5.5 Phase 2 - Quick Mode in isakmp-oakley-05.
- */
-vchar_t *
-oakley_compute_hash3(iph1, msgid, body)
-	struct ph1handle *iph1;
-	u_int32_t msgid;
-	vchar_t *body;
-{
-	vchar_t *buf = 0, *res = 0;
-	int len;
-	int error = -1;
-
-	/* create buffer */
-	len = 1 + sizeof(u_int32_t) + body->l;
-	buf = vmalloc(len);
-	if (buf == NULL) {
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"failed to get hash buffer\n");
-		goto end;
-	}
-
-	buf->v[0] = 0;
-
-	memcpy(buf->v + 1, (char *)&msgid, sizeof(msgid));
-
-	memcpy(buf->v + 1 + sizeof(u_int32_t), body->v, body->l);
-
-	plog(LLV_DEBUG, LOCATION, NULL, "HASH with: \n");
-	plogdump(LLV_DEBUG, buf->v, buf->l);
-
-	/* compute HASH */
-	res = oakley_prf(iph1->skeyid_a, buf, iph1);
-	if (res == NULL)
-		goto end;
-
-	error = 0;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "HASH computed:\n");
-	plogdump(LLV_DEBUG, res->v, res->l);
-
-end:
-	if (buf != NULL)
-		vfree(buf);
-	return res;
-}
-
-/*
- * compute HASH type of prf(SKEYID_a, M-ID | buffer)
- *	e.g.
- *	for quick mode HASH(1):
- *		prf(SKEYID_a, M-ID | SA | Ni [ | KE ] [ | IDci | IDcr ])
- *	for quick mode HASH(2):
- *		prf(SKEYID_a, M-ID | Ni_b | SA | Nr [ | KE ] [ | IDci | IDcr ])
- *	for Informational exchange:
- *		prf(SKEYID_a, M-ID | N/D)
- */
-vchar_t *
-oakley_compute_hash1(iph1, msgid, body)
-	struct ph1handle *iph1;
-	u_int32_t msgid;
-	vchar_t *body;
-{
-	vchar_t *buf = NULL, *res = NULL;
-	char *p;
-	int len;
-	int error = -1;
-
-	/* create buffer */
-	len = sizeof(u_int32_t) + body->l;
-	buf = vmalloc(len);
-	if (buf == NULL) {
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"failed to get hash buffer\n");
-		goto end;
-	}
-
-	p = buf->v;
-
-	memcpy(buf->v, (char *)&msgid, sizeof(msgid));
-	p += sizeof(u_int32_t);
-
-	memcpy(p, body->v, body->l);
-
-	plog(LLV_DEBUG, LOCATION, NULL, "HASH with:\n");
-	plogdump(LLV_DEBUG, buf->v, buf->l);
-
-	/* compute HASH */
-	res = oakley_prf(iph1->skeyid_a, buf, iph1);
-	if (res == NULL)
-		goto end;
-
-	error = 0;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "HASH computed:\n");
-	plogdump(LLV_DEBUG, res->v, res->l);
-
-end:
-	if (buf != NULL)
-		vfree(buf);
-	return res;
-}
-
-/*
- * compute phase1 HASH
- * main/aggressive
- *   I-digest = prf(SKEYID, g^i | g^r | CKY-I | CKY-R | SAi_b | ID_i1_b)
- *   R-digest = prf(SKEYID, g^r | g^i | CKY-R | CKY-I | SAi_b | ID_r1_b)
- * for gssapi, also include all GSS tokens, and call gss_wrap on the result
- */
-vchar_t *
-oakley_ph1hash_common(iph1, sw)
-	struct ph1handle *iph1;
-	int sw;
-{
-	vchar_t *buf = NULL, *res = NULL, *bp;
-	char *p, *bp2;
-	int len, bl;
-	int error = -1;
-#ifdef HAVE_GSSAPI
-	vchar_t *gsstokens = NULL;
-#endif
-
-	/* create buffer */
-	len = iph1->dhpub->l
-		+ iph1->dhpub_p->l
-		+ sizeof(cookie_t) * 2
-		+ iph1->sa->l
-		+ (sw == GENERATE ? iph1->id->l : iph1->id_p->l);
-
-#ifdef HAVE_GSSAPI
-	if (AUTHMETHOD(iph1) == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB) {
-		if (iph1->gi_i != NULL && iph1->gi_r != NULL) {
-			bp = (sw == GENERATE ? iph1->gi_i : iph1->gi_r);
-			len += bp->l;
-		}
-		if (sw == GENERATE)
-			gssapi_get_itokens(iph1, &gsstokens);
-		else
-			gssapi_get_rtokens(iph1, &gsstokens);
-		if (gsstokens == NULL)
-			return NULL;
-		len += gsstokens->l;
-	}
-#endif
-
-	buf = vmalloc(len);
-	if (buf == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get hash buffer\n");
-		goto end;
-	}
-
-	p = buf->v;
-
-	bp = (sw == GENERATE ? iph1->dhpub : iph1->dhpub_p);
-	memcpy(p, bp->v, bp->l);
-	p += bp->l;
-
-	bp = (sw == GENERATE ? iph1->dhpub_p : iph1->dhpub);
-	memcpy(p, bp->v, bp->l);
-	p += bp->l;
-
-	if (iph1->side == INITIATOR)
-		bp2 = (sw == GENERATE ?
-		      (char *)&iph1->index.i_ck : (char *)&iph1->index.r_ck);
-	else
-		bp2 = (sw == GENERATE ?
-		      (char *)&iph1->index.r_ck : (char *)&iph1->index.i_ck);
-	bl = sizeof(cookie_t);
-	memcpy(p, bp2, bl);
-	p += bl;
-
-	if (iph1->side == INITIATOR)
-		bp2 = (sw == GENERATE ?
-		      (char *)&iph1->index.r_ck : (char *)&iph1->index.i_ck);
-	else
-		bp2 = (sw == GENERATE ?
-		      (char *)&iph1->index.i_ck : (char *)&iph1->index.r_ck);
-	bl = sizeof(cookie_t);
-	memcpy(p, bp2, bl);
-	p += bl;
-
-	bp = iph1->sa;
-	memcpy(p, bp->v, bp->l);
-	p += bp->l;
-
-	bp = (sw == GENERATE ? iph1->id : iph1->id_p);
-	memcpy(p, bp->v, bp->l);
-	p += bp->l;
-
-#ifdef HAVE_GSSAPI
-	if (AUTHMETHOD(iph1) == OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB) {
-		if (iph1->gi_i != NULL && iph1->gi_r != NULL) {
-			bp = (sw == GENERATE ? iph1->gi_i : iph1->gi_r);
-			memcpy(p, bp->v, bp->l);
-			p += bp->l;
-		}
-		memcpy(p, gsstokens->v, gsstokens->l);
-		p += gsstokens->l;
-	}
-#endif
-
-	plog(LLV_DEBUG, LOCATION, NULL, "HASH with:\n");
-	plogdump(LLV_DEBUG, buf->v, buf->l);
-
-	/* compute HASH */
-	res = oakley_prf(iph1->skeyid, buf, iph1);
-	if (res == NULL)
-		goto end;
-
-	error = 0;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "HASH (%s) computed:\n",
-		iph1->side == INITIATOR ? "init" : "resp");
-	plogdump(LLV_DEBUG, res->v, res->l);
-
-end:
-	if (buf != NULL)
-		vfree(buf);
-#ifdef HAVE_GSSAPI
-	if (gsstokens != NULL)
-		vfree(gsstokens);
-#endif
-	return res;
-}
-
-/*
- * compute HASH_I on base mode.
- * base:psk,rsa
- *   HASH_I = prf(SKEYID, g^xi | CKY-I | CKY-R | SAi_b | IDii_b)
- * base:sig
- *   HASH_I = prf(hash(Ni_b | Nr_b), g^xi | CKY-I | CKY-R | SAi_b | IDii_b)
- */
-vchar_t *
-oakley_ph1hash_base_i(iph1, sw)
-	struct ph1handle *iph1;
-	int sw;
-{
-	vchar_t *buf = NULL, *res = NULL, *bp;
-	vchar_t *hashkey = NULL;
-	vchar_t *hash = NULL;	/* for signature mode */
-	char *p;
-	int len;
-	int error = -1;
-
-	/* sanity check */
-	if (iph1->etype != ISAKMP_ETYPE_BASE) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid etype for this hash function\n");
-		return NULL;
-	}
-
-	switch (AUTHMETHOD(iph1)) {
-	case OAKLEY_ATTR_AUTH_METHOD_PSKEY:
-	case OAKLEY_ATTR_AUTH_METHOD_RSAENC:
-	case OAKLEY_ATTR_AUTH_METHOD_RSAREV:
-#ifdef ENABLE_HYBRID
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_R:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_R:
-	case FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
-#endif
-		if (iph1->skeyid == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL, "no SKEYID found.\n");
-			return NULL;
-		}
-		hashkey = iph1->skeyid;
-		break;
-
-	case OAKLEY_ATTR_AUTH_METHOD_DSSSIG:
-	case OAKLEY_ATTR_AUTH_METHOD_RSASIG:
-#ifdef HAVE_GSSAPI
-	case OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB:
-#endif
-#ifdef ENABLE_HYBRID
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R:
-#endif
-		/* make hash for seed */
-		len = iph1->nonce->l + iph1->nonce_p->l;
-		buf = vmalloc(len);
-		if (buf == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to get hash buffer\n");
-			goto end;
-		}
-		p = buf->v;
-
-		bp = (sw == GENERATE ? iph1->nonce_p : iph1->nonce);
-		memcpy(p, bp->v, bp->l);
-		p += bp->l;
-
-		bp = (sw == GENERATE ? iph1->nonce : iph1->nonce_p);
-		memcpy(p, bp->v, bp->l);
-		p += bp->l;
-
-		hash = oakley_hash(buf, iph1);
-		if (hash == NULL)
-			goto end;
-		vfree(buf);
-		buf = NULL;
-
-		hashkey = hash;
-		break;
-
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"not supported authentication method %d\n",
-			iph1->approval->authmethod);
-		return NULL;
-
-	}
-
-	len = (sw == GENERATE ? iph1->dhpub->l : iph1->dhpub_p->l)
-		+ sizeof(cookie_t) * 2
-		+ iph1->sa->l
-		+ (sw == GENERATE ? iph1->id->l : iph1->id_p->l);
-	buf = vmalloc(len);
-	if (buf == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get hash buffer\n");
-		goto end;
-	}
-	p = buf->v;
-
-	bp = (sw == GENERATE ? iph1->dhpub : iph1->dhpub_p);
-	memcpy(p, bp->v, bp->l);
-	p += bp->l;
-
-	memcpy(p, &iph1->index.i_ck, sizeof(cookie_t));
-	p += sizeof(cookie_t);
-	memcpy(p, &iph1->index.r_ck, sizeof(cookie_t));
-	p += sizeof(cookie_t);
-
-	memcpy(p, iph1->sa->v, iph1->sa->l);
-	p += iph1->sa->l;
-
-	bp = (sw == GENERATE ? iph1->id : iph1->id_p);
-	memcpy(p, bp->v, bp->l);
-	p += bp->l;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "HASH_I with:\n");
-	plogdump(LLV_DEBUG, buf->v, buf->l);
-
-	/* compute HASH */
-	res = oakley_prf(hashkey, buf, iph1);
-	if (res == NULL)
-		goto end;
-
-	error = 0;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "HASH_I computed:\n");
-	plogdump(LLV_DEBUG, res->v, res->l);
-
-end:
-	if (hash != NULL)
-		vfree(hash);
-	if (buf != NULL)
-		vfree(buf);
-	return res;
-}
-
-/*
- * compute HASH_R on base mode for signature method.
- * base:
- * HASH_R = prf(hash(Ni_b | Nr_b), g^xi | g^xr | CKY-I | CKY-R | SAi_b | IDii_b)
- */
-vchar_t *
-oakley_ph1hash_base_r(iph1, sw)
-	struct ph1handle *iph1;
-	int sw;
-{
-	vchar_t *buf = NULL, *res = NULL, *bp;
-	vchar_t *hash = NULL;
-	char *p;
-	int len;
-	int error = -1;
-
-	/* sanity check */
-	if (iph1->etype != ISAKMP_ETYPE_BASE) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid etype for this hash function\n");
-		return NULL;
-	}
-
-	switch(AUTHMETHOD(iph1)) {
-	case OAKLEY_ATTR_AUTH_METHOD_DSSSIG:
-	case OAKLEY_ATTR_AUTH_METHOD_RSASIG:
-#ifdef ENABLE_HYBRID
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R:
-	case FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I:
-#endif
-		break;
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"not supported authentication method %d\n",
-			iph1->approval->authmethod);
-		return NULL;
-		break;
-	}
-
-	/* make hash for seed */
-	len = iph1->nonce->l + iph1->nonce_p->l;
-	buf = vmalloc(len);
-	if (buf == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get hash buffer\n");
-		goto end;
-	}
-	p = buf->v;
-
-	bp = (sw == GENERATE ? iph1->nonce_p : iph1->nonce);
-	memcpy(p, bp->v, bp->l);
-	p += bp->l;
-
-	bp = (sw == GENERATE ? iph1->nonce : iph1->nonce_p);
-	memcpy(p, bp->v, bp->l);
-	p += bp->l;
-
-	hash = oakley_hash(buf, iph1);
-	if (hash == NULL)
-		goto end;
-	vfree(buf);
-	buf = NULL;
-
-	/* make really hash */
-	len = (sw == GENERATE ? iph1->dhpub_p->l : iph1->dhpub->l)
-		+ (sw == GENERATE ? iph1->dhpub->l : iph1->dhpub_p->l)
-		+ sizeof(cookie_t) * 2
-		+ iph1->sa->l
-		+ (sw == GENERATE ? iph1->id_p->l : iph1->id->l);
-	buf = vmalloc(len);
-	if (buf == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get hash buffer\n");
-		goto end;
-	}
-	p = buf->v;
-
-
-	bp = (sw == GENERATE ? iph1->dhpub_p : iph1->dhpub);
-	memcpy(p, bp->v, bp->l);
-	p += bp->l;
-
-	bp = (sw == GENERATE ? iph1->dhpub : iph1->dhpub_p);
-	memcpy(p, bp->v, bp->l);
-	p += bp->l;
-
-	memcpy(p, &iph1->index.i_ck, sizeof(cookie_t));
-	p += sizeof(cookie_t);
-	memcpy(p, &iph1->index.r_ck, sizeof(cookie_t));
-	p += sizeof(cookie_t);
-
-	memcpy(p, iph1->sa->v, iph1->sa->l);
-	p += iph1->sa->l;
-
-	bp = (sw == GENERATE ? iph1->id_p : iph1->id);
-	memcpy(p, bp->v, bp->l);
-	p += bp->l;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "HASH_R with:\n");
-	plogdump(LLV_DEBUG, buf->v, buf->l);
-
-	/* compute HASH */
-	res = oakley_prf(hash, buf, iph1);
-	if (res == NULL)
-		goto end;
-
-	error = 0;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "HASH_R computed:\n");
-	plogdump(LLV_DEBUG, res->v, res->l);
-
-end:
-	if (buf != NULL)
-		vfree(buf);
-	if (hash)
-		vfree(hash);
-	return res;
-}
-
-/*
- * compute each authentication method in phase 1.
- * OUT:
- *	0:	OK
- *	-1:	error
- *	other:	error to be reply with notification.
- *	        the value is notification type.
- */
-int
-oakley_validate_auth(iph1)
-	struct ph1handle *iph1;
-{
-	vchar_t *my_hash = NULL;
-	int result;
-#ifdef HAVE_GSSAPI
-	vchar_t *gsshash = NULL;
-#endif
-#ifdef ENABLE_STATS
-	struct timeval start, end;
-#endif
-
-#ifdef ENABLE_STATS
-	gettimeofday(&start, NULL);
-#endif
-
-	switch (AUTHMETHOD(iph1)) {
-	case OAKLEY_ATTR_AUTH_METHOD_PSKEY:
-#ifdef ENABLE_HYBRID
-	case FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
-#endif
-		/* validate HASH */
-	    {
-		char *r_hash;
-
-		if (iph1->id_p == NULL || iph1->pl_hash == NULL) {
-			plog(LLV_ERROR, LOCATION, iph1->remote,
-				"few isakmp message received.\n");
-			return ISAKMP_NTYPE_PAYLOAD_MALFORMED;
-		}
-#ifdef ENABLE_HYBRID
-		if (AUTHMETHOD(iph1) == FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I &&
-		    ((iph1->mode_cfg->flags & ISAKMP_CFG_VENDORID_XAUTH) == 0))
-		{
-			plog(LLV_ERROR, LOCATION, NULL, "No SIG was passed, "
-			    "hybrid auth is enabled, "
-			    "but peer is no Xauth compliant\n");
-			return ISAKMP_NTYPE_SITUATION_NOT_SUPPORTED;
-			break;
-		}
-#endif
-		r_hash = (caddr_t)(iph1->pl_hash + 1);
-
-		plog(LLV_DEBUG, LOCATION, NULL, "HASH received:\n");
-		plogdump(LLV_DEBUG, r_hash,
-			ntohs(iph1->pl_hash->h.len) - sizeof(*iph1->pl_hash));
-
-		switch (iph1->etype) {
-		case ISAKMP_ETYPE_IDENT:
-		case ISAKMP_ETYPE_AGG:
-			my_hash = oakley_ph1hash_common(iph1, VALIDATE);
-			break;
-		case ISAKMP_ETYPE_BASE:
-			if (iph1->side == INITIATOR)
-				my_hash = oakley_ph1hash_common(iph1, VALIDATE);
-			else
-				my_hash = oakley_ph1hash_base_i(iph1, VALIDATE);
-			break;
-		default:
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid etype %d\n", iph1->etype);
-			return ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE;
-		}
-		if (my_hash == NULL)
-			return ISAKMP_INTERNAL_ERROR;
-
-		result = memcmp(my_hash->v, r_hash, my_hash->l);
-		vfree(my_hash);
-
-		if (result) {
-			plog(LLV_ERROR, LOCATION, NULL, "HASH mismatched\n");
-			return ISAKMP_NTYPE_INVALID_HASH_INFORMATION;
-		}
-
-		plog(LLV_DEBUG, LOCATION, NULL, "HASH for PSK validated.\n");
-	    }
-		break;
-	case OAKLEY_ATTR_AUTH_METHOD_DSSSIG:
-	case OAKLEY_ATTR_AUTH_METHOD_RSASIG:
-#ifdef ENABLE_HYBRID
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R:
-#endif
-	    {
-		int error = 0;
-		int certtype = 0;
-
-		/* validation */
-		if (iph1->id_p == NULL) {
-			plog(LLV_ERROR, LOCATION, iph1->remote,
-				"no ID payload was passed.\n");
-			return ISAKMP_NTYPE_PAYLOAD_MALFORMED;
-		}
-		if (iph1->sig_p == NULL) {
-			plog(LLV_ERROR, LOCATION, iph1->remote,
-				"no SIG payload was passed.\n");
-			return ISAKMP_NTYPE_PAYLOAD_MALFORMED;
-		}
-
-		plog(LLV_DEBUG, LOCATION, NULL, "SIGN passed:\n");
-		plogdump(LLV_DEBUG, iph1->sig_p->v, iph1->sig_p->l);
-
-		/* get peer's cert */
-		switch (iph1->rmconf->getcert_method) {
-		case ISAKMP_GETCERT_PAYLOAD:
-			if (iph1->cert_p == NULL) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"no peer's CERT payload found.\n");
-				return ISAKMP_INTERNAL_ERROR;
-			}
-			break;
-		case ISAKMP_GETCERT_LOCALFILE:
-			switch (iph1->rmconf->certtype) {
-				case ISAKMP_CERT_X509SIGN:
-					if (iph1->rmconf->peerscertfile == NULL) {
-						plog(LLV_ERROR, LOCATION, NULL,
-							"no peer's CERT file found.\n");
-						return ISAKMP_INTERNAL_ERROR;
-					}
-
-					/* don't use cached cert */
-					if (iph1->cert_p != NULL) {
-						oakley_delcert(iph1->cert_p);
-						iph1->cert_p = NULL;
-					}
-
-					error = get_cert_fromlocal(iph1, 0);
-#ifdef ANDROID_PATCHED
-					if (!error)
-						break;
-				default:
-					return ISAKMP_INTERNAL_ERROR;
-#else
-					break;
-
-				case ISAKMP_CERT_PLAINRSA:
-					error = get_plainrsa_fromlocal(iph1, 0);
-					break;
-			}
-			if (error)
-				return ISAKMP_INTERNAL_ERROR;
-			break;
-		case ISAKMP_GETCERT_DNS:
-			if (iph1->rmconf->peerscertfile != NULL) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"why peer's CERT file is defined "
-					"though getcert method is dns ?\n");
-				return ISAKMP_INTERNAL_ERROR;
-			}
-
-			/* don't use cached cert */
-			if (iph1->cert_p != NULL) {
-				oakley_delcert(iph1->cert_p);
-				iph1->cert_p = NULL;
-			}
-
-			iph1->cert_p = dnssec_getcert(iph1->id_p);
-			if (iph1->cert_p == NULL) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"no CERT RR found.\n");
-				return ISAKMP_INTERNAL_ERROR;
-#endif
-			}
-			break;
-		default:
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid getcert_mothod: %d\n",
-				iph1->rmconf->getcert_method);
-			return ISAKMP_INTERNAL_ERROR;
-		}
-
-		/* compare ID payload and certificate name */
-		if (iph1->rmconf->verify_cert &&
-		    (error = oakley_check_certid(iph1)) != 0)
-			return error;
-
-		/* verify certificate */
-		if (iph1->rmconf->verify_cert
-		 && iph1->rmconf->getcert_method == ISAKMP_GETCERT_PAYLOAD) {
-			certtype = iph1->rmconf->certtype;
-#ifdef ENABLE_HYBRID
-			switch (AUTHMETHOD(iph1)) {
-			case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
-			case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
-				certtype = iph1->cert_p->type;
-				break;
-			default:
-				break;
-			}
-#endif
-			switch (certtype) {
-			case ISAKMP_CERT_X509SIGN: {
-				char path[MAXPATHLEN];
-				char *ca;
-
-				if (iph1->rmconf->cacertfile != NULL) {
-					getpathname(path, sizeof(path), 
-					    LC_PATHTYPE_CERT, 
-					    iph1->rmconf->cacertfile);
-					ca = path;
-				} else {
-					ca = NULL;
-				}
-
-				error = eay_check_x509cert(&iph1->cert_p->cert,
-					lcconf->pathinfo[LC_PATHTYPE_CERT], 
-					ca, 0);
-				break;
-			}
-			
-			default:
-				plog(LLV_ERROR, LOCATION, NULL,
-					"no supported certtype %d\n", certtype);
-				return ISAKMP_INTERNAL_ERROR;
-			}
-			if (error != 0) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"the peer's certificate is not verified.\n");
-				return ISAKMP_NTYPE_INVALID_CERT_AUTHORITY;
-			}
-		}
-	
-		/* Generate a warning if verify_cert == 0
-		 */
-		if (iph1->rmconf->verify_cert){
-			plog(LLV_DEBUG, LOCATION, NULL, "CERT validated\n");
-		}else{
-			plog(LLV_WARNING, LOCATION, NULL,
-				"CERT validation disabled by configuration\n");
-		}
-
-		/* compute hash */
-		switch (iph1->etype) {
-		case ISAKMP_ETYPE_IDENT:
-		case ISAKMP_ETYPE_AGG:
-			my_hash = oakley_ph1hash_common(iph1, VALIDATE);
-			break;
-		case ISAKMP_ETYPE_BASE:
-			if (iph1->side == INITIATOR)
-				my_hash = oakley_ph1hash_base_r(iph1, VALIDATE);
-			else
-				my_hash = oakley_ph1hash_base_i(iph1, VALIDATE);
-			break;
-		default:
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid etype %d\n", iph1->etype);
-			return ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE;
-		}
-		if (my_hash == NULL)
-			return ISAKMP_INTERNAL_ERROR;
-
-
-		certtype = iph1->rmconf->certtype;
-#ifdef ENABLE_HYBRID
-		switch (AUTHMETHOD(iph1)) {
-		case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
-		case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
-			certtype = iph1->cert_p->type;
-			break;
-		default:
-			break;
-		}
-#endif
-		/* check signature */
-		switch (certtype) {
-		case ISAKMP_CERT_X509SIGN:
-		case ISAKMP_CERT_DNS:
-			error = eay_check_x509sign(my_hash,
-					iph1->sig_p,
-					&iph1->cert_p->cert);
-			break;
-#ifndef ANDROID_PATCHED
-		case ISAKMP_CERT_PLAINRSA:
-			iph1->rsa_p = rsa_try_check_rsasign(my_hash,
-					iph1->sig_p, iph1->rsa_candidates);
-			error = iph1->rsa_p ? 0 : -1;
-
-			break;
-#endif
-		default:
-			plog(LLV_ERROR, LOCATION, NULL,
-				"no supported certtype %d\n",
-				certtype);
-			vfree(my_hash);
-			return ISAKMP_INTERNAL_ERROR;
-		}
-
-		vfree(my_hash);
-		if (error != 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"Invalid SIG.\n");
-			return ISAKMP_NTYPE_INVALID_SIGNATURE;
-		}
-		plog(LLV_DEBUG, LOCATION, NULL, "SIG authenticated\n");
-	    }
-		break;
-#ifdef ENABLE_HYBRID
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R:
-	    {
-		if ((iph1->mode_cfg->flags & ISAKMP_CFG_VENDORID_XAUTH) == 0) {
-			plog(LLV_ERROR, LOCATION, NULL, "No SIG was passed, "
-			    "hybrid auth is enabled, "
-			    "but peer is no Xauth compliant\n");
-			return ISAKMP_NTYPE_SITUATION_NOT_SUPPORTED;
-			break;
-		}
-		plog(LLV_INFO, LOCATION, NULL, "No SIG was passed, "
-		    "but hybrid auth is enabled\n");
-
-		return 0;
-		break;
-	    }
-#endif
-#ifdef HAVE_GSSAPI
-	case OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB:
-		/* check if we're not into XAUTH_PSKEY_I instead */
-#ifdef ENABLE_HYBRID
-		if (iph1->rmconf->xauth)
-			break;
-#endif
-		switch (iph1->etype) {
-		case ISAKMP_ETYPE_IDENT:
-		case ISAKMP_ETYPE_AGG:
-			my_hash = oakley_ph1hash_common(iph1, VALIDATE);
-			break;
-		default:
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid etype %d\n", iph1->etype);
-			return ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE;
-		}
-
-		if (my_hash == NULL) {
-			if (gssapi_more_tokens(iph1))
-				return ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE;
-			else
-				return ISAKMP_NTYPE_INVALID_HASH_INFORMATION;
-		}
-
-		gsshash = gssapi_unwraphash(iph1);
-		if (gsshash == NULL) {
-			vfree(my_hash);
-			return ISAKMP_NTYPE_INVALID_HASH_INFORMATION;
-		}
-
-		result = memcmp(my_hash->v, gsshash->v, my_hash->l);
-		vfree(my_hash);
-		vfree(gsshash);
-
-		if (result) {
-			plog(LLV_ERROR, LOCATION, NULL, "HASH mismatched\n");
-			return ISAKMP_NTYPE_INVALID_HASH_INFORMATION;
-		}
-		plog(LLV_DEBUG, LOCATION, NULL, "hash compared OK\n");
-		break;
-#endif
-	case OAKLEY_ATTR_AUTH_METHOD_RSAENC:
-	case OAKLEY_ATTR_AUTH_METHOD_RSAREV:
-#ifdef ENABLE_HYBRID
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_R:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_R:
-#endif
-		if (iph1->id_p == NULL || iph1->pl_hash == NULL) {
-			plog(LLV_ERROR, LOCATION, iph1->remote,
-				"few isakmp message received.\n");
-			return ISAKMP_NTYPE_PAYLOAD_MALFORMED;
-		}
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"not supported authmethod type %s\n",
-			s_oakley_attr_method(iph1->approval->authmethod));
-		return ISAKMP_INTERNAL_ERROR;
-	default:
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"invalid authmethod %d why ?\n",
-			iph1->approval->authmethod);
-		return ISAKMP_INTERNAL_ERROR;
-	}
-#ifdef ENABLE_STATS
-	gettimeofday(&end, NULL);
-	syslog(LOG_NOTICE, "%s(%s): %8.6f", __func__,
-		s_oakley_attr_method(iph1->approval->authmethod),
-		timedelta(&start, &end));
-#endif
-
-	return 0;
-}
-
-/* get my certificate
- * NOTE: include certificate type.
- */
-int
-oakley_getmycert(iph1)
-	struct ph1handle *iph1;
-{
-	switch (iph1->rmconf->certtype) {
-		case ISAKMP_CERT_X509SIGN:
-			if (iph1->cert)
-				return 0;
-			return get_cert_fromlocal(iph1, 1);
-
-#ifndef ANDROID_PATCHED
-		case ISAKMP_CERT_PLAINRSA:
-			if (iph1->rsa)
-				return 0;
-			return get_plainrsa_fromlocal(iph1, 1);
-#endif
-
-		default:
-			plog(LLV_ERROR, LOCATION, NULL,
-			     "Unknown certtype #%d\n",
-			     iph1->rmconf->certtype);
-			return -1;
-	}
-
-}
-
-/*
- * get a CERT from local file.
- * IN:
- *	my != 0 my cert.
- *	my == 0 peer's cert.
- */
-static int
-get_cert_fromlocal(iph1, my)
-	struct ph1handle *iph1;
-	int my;
-{
-	char path[MAXPATHLEN];
-	vchar_t *cert = NULL;
-	cert_t **certpl;
-	char *certfile;
-	int error = -1;
-
-	if (my) {
-		certfile = iph1->rmconf->mycertfile;
-		certpl = &iph1->cert;
-	} else {
-		certfile = iph1->rmconf->peerscertfile;
-		certpl = &iph1->cert_p;
-	}
-	if (!certfile) {
-		plog(LLV_ERROR, LOCATION, NULL, "no CERT defined.\n");
-		return 0;
-	}
-
-	switch (iph1->rmconf->certtype) {
-	case ISAKMP_CERT_X509SIGN:
-	case ISAKMP_CERT_DNS:
-		/* make public file name */
-		getpathname(path, sizeof(path), LC_PATHTYPE_CERT, certfile);
-		cert = eay_get_x509cert(path);
-		if (cert) {
-			char *p = NULL;
-			p = eay_get_x509text(cert);
-			plog(LLV_DEBUG, LOCATION, NULL, "%s", p ? p : "\n");
-			racoon_free(p);
-		};
-		break;
-
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"not supported certtype %d\n",
-			iph1->rmconf->certtype);
-		goto end;
-	}
-
-	if (!cert) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get %s CERT.\n",
-			my ? "my" : "peers");
-		goto end;
-	}
-
-	*certpl = oakley_newcert();
-	if (!*certpl) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get cert buffer.\n");
-		goto end;
-	}
-	(*certpl)->pl = vmalloc(cert->l + 1);
-	if ((*certpl)->pl == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get cert buffer\n");
-		oakley_delcert(*certpl);
-		*certpl = NULL;
-		goto end;
-	}
-	memcpy((*certpl)->pl->v + 1, cert->v, cert->l);
-	(*certpl)->pl->v[0] = iph1->rmconf->certtype;
-	(*certpl)->type = iph1->rmconf->certtype;
-	(*certpl)->cert.v = (*certpl)->pl->v + 1;
-	(*certpl)->cert.l = (*certpl)->pl->l - 1;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "created CERT payload:\n");
-	plogdump(LLV_DEBUG, (*certpl)->pl->v, (*certpl)->pl->l);
-
-	error = 0;
-
-end:
-	if (cert != NULL)
-		vfree(cert);
-
-	return error;
-}
-
-#ifndef ANDROID_PATCHED
-static int
-get_plainrsa_fromlocal(iph1, my)
-	struct ph1handle *iph1;
-	int my;
-{
-	char path[MAXPATHLEN];
-	vchar_t *cert = NULL;
-	char *certfile;
-	int error = -1;
-
-	iph1->rsa_candidates = rsa_lookup_keys(iph1, my);
-	if (!iph1->rsa_candidates || 
-	    rsa_list_count(iph1->rsa_candidates) == 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"%s RSA key not found for %s\n",
-			my ? "Private" : "Public",
-			saddr2str_fromto("%s <-> %s", 
-			iph1->local, iph1->remote));
-		goto end;
-	}
-
-	if (my && rsa_list_count(iph1->rsa_candidates) > 1) {
-		plog(LLV_WARNING, LOCATION, NULL,
-			"More than one (=%lu) private "
-			"PlainRSA key found for %s\n",
-			rsa_list_count(iph1->rsa_candidates),
-			saddr2str_fromto("%s <-> %s", 
-			iph1->local, iph1->remote));
-		plog(LLV_WARNING, LOCATION, NULL,
-			"This may have unpredictable results, "
-			"i.e. wrong key could be used!\n");
-		plog(LLV_WARNING, LOCATION, NULL,
-			"Consider using only one single private "
-			"key for all peers...\n");
-	}
-	if (my) {
-		iph1->rsa = ((struct rsa_key *)
-		    genlist_next(iph1->rsa_candidates, NULL))->rsa;
-
-		genlist_free(iph1->rsa_candidates, NULL);
-		iph1->rsa_candidates = NULL;
-
-		if (iph1->rsa == NULL)
-			goto end;
-	}
-
-	error = 0;
-
-end:
-	return error;
-}
-#endif
-
-#ifdef ANDROID_CHANGES
-
-#if defined(OPENSSL_IS_BORINGSSL)
-/* EVP_PKEY_from_keystore is from system/security/keystore-engine. */
-extern EVP_PKEY* EVP_PKEY_from_keystore(const char *key_id);
-#endif
-
-static vchar_t* keystore_sign(vchar_t* src, const char* path) {
-	vchar_t* sig = NULL;
-	EVP_PKEY *evp = NULL;
-
-#if !defined(OPENSSL_IS_BORINGSSL)
-	ENGINE *engine = ENGINE_by_id("keystore");
-	if (!engine) {
-		return NULL;
-	}
-	if (!ENGINE_init(engine)) {
-		ENGINE_free(engine);
-		return NULL;
-	}
-#endif
-
-	const char *key_id;
-	if (sscanf(path, pname, &key_id) != 1) {
-		do_plog(LLV_ERROR, "couldn't read private key info\n");
-		goto out;
-	}
-
-#if !defined(OPENSSL_IS_BORINGSSL)
-	evp = ENGINE_load_private_key(engine, key_id, NULL, NULL);
-#else
-	evp = EVP_PKEY_from_keystore(key_id);
-#endif
-	if (!evp) {
-		do_plog(LLV_ERROR, "couldn't retrieve private key");
-		ERR_remove_thread_state(NULL);
-		goto out;
-	}
-
-	if (EVP_PKEY_id(evp) == EVP_PKEY_RSA) {
-		sig = eay_rsa_sign(src, EVP_PKEY_get0_RSA(evp));
-	}
-
-out:
-	if (evp) {
-		EVP_PKEY_free(evp);
-	}
-
-#if !defined(OPENSSL_IS_BORINGSSL)
-	ENGINE_finish(engine);
-	ENGINE_free(engine);
-#endif
-
-	return sig;
-}
-#endif
-
-/* get signature */
-int
-oakley_getsign(iph1)
-	struct ph1handle *iph1;
-{
-	char path[MAXPATHLEN];
-	vchar_t *privkey = NULL;
-	int error = -1;
-
-	switch (iph1->rmconf->certtype) {
-	case ISAKMP_CERT_X509SIGN:
-	case ISAKMP_CERT_DNS:
-		if (iph1->rmconf->myprivfile == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL, "no cert defined.\n");
-			goto end;
-		}
-
-		/* make private file name */
-		getpathname(path, sizeof(path),
-			LC_PATHTYPE_CERT,
-			iph1->rmconf->myprivfile);
-#ifdef ANDROID_CHANGES
-		iph1->sig = keystore_sign(iph1->hash, path);
-#else
-		privkey = privsep_eay_get_pkcs1privkey(path);
-		if (privkey == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to get private key.\n");
-			goto end;
-		}
-		plog(LLV_DEBUG2, LOCATION, NULL, "private key:\n");
-		plogdump(LLV_DEBUG2, privkey->v, privkey->l);
-
-		iph1->sig = eay_get_x509sign(iph1->hash, privkey);
-#endif
-		break;
-#ifndef ANDROID_PATCHED
-	case ISAKMP_CERT_PLAINRSA:
-		iph1->sig = eay_get_rsasign(iph1->hash, iph1->rsa);
-		break;
-#endif
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-		     "Unknown certtype #%d\n",
-		     iph1->rmconf->certtype);
-		goto end;
-	}
-
-	if (iph1->sig == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "failed to sign.\n");
-		goto end;
-	}
-
-	plog(LLV_DEBUG, LOCATION, NULL, "SIGN computed:\n");
-	plogdump(LLV_DEBUG, iph1->sig->v, iph1->sig->l);
-
-	error = 0;
-
-end:
-	if (privkey != NULL)
-		vfree(privkey);
-
-	return error;
-}
-
-/*
- * compare certificate name and ID value.
- */
-static int
-oakley_check_certid(iph1)
-	struct ph1handle *iph1;
-{
-	struct ipsecdoi_id_b *id_b;
-	vchar_t *name = NULL;
-	char *altname = NULL;
-	int idlen, type;
-	int error;
-
-	if (iph1->id_p == NULL || iph1->cert_p == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "no ID nor CERT found.\n");
-		return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
-	}
-
-	id_b = (struct ipsecdoi_id_b *)iph1->id_p->v;
-	idlen = iph1->id_p->l - sizeof(*id_b);
-
-	switch (id_b->type) {
-	case IPSECDOI_ID_DER_ASN1_DN:
-		name = eay_get_x509asn1subjectname(&iph1->cert_p->cert);
-		if (!name) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to get subjectName\n");
-			return ISAKMP_NTYPE_INVALID_CERTIFICATE;
-		}
-		if (idlen != name->l) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"Invalid ID length in phase 1.\n");
-			vfree(name);
-			return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
-		}
-		error = memcmp(id_b + 1, name->v, idlen);
-		vfree(name);
-		if (error != 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"ID mismatched with ASN1 SubjectName.\n");
-			plogdump(LLV_DEBUG, id_b + 1, idlen);
-			plogdump(LLV_DEBUG, name->v, idlen);
-			return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
-		}
-		return 0;
-	case IPSECDOI_ID_IPV4_ADDR:
-	case IPSECDOI_ID_IPV6_ADDR:
-	{
-		/*
-		 * converting to binary from string because openssl return
-		 * a string even if object is a binary.
-		 * XXX fix it !  access by ASN.1 directly without.
-		 */
-		struct addrinfo hints, *res;
-		caddr_t a = NULL;
-		int pos;
-
-		for (pos = 1; ; pos++) {
-			if (eay_get_x509subjectaltname(&iph1->cert_p->cert,
-					&altname, &type, pos) !=0) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"failed to get subjectAltName\n");
-				return ISAKMP_NTYPE_INVALID_CERTIFICATE;
-			}
-
-			/* it's the end condition of the loop. */
-			if (!altname) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"no proper subjectAltName.\n");
-				return ISAKMP_NTYPE_INVALID_CERTIFICATE;
-			}
-
-			if (check_typeofcertname(id_b->type, type) == 0)
-				break;
-
-			/* next name */
-			racoon_free(altname);
-			altname = NULL;
-		}
-		memset(&hints, 0, sizeof(hints));
-		hints.ai_family = PF_UNSPEC;
-		hints.ai_socktype = SOCK_RAW;
-		hints.ai_flags = AI_NUMERICHOST;
-		error = getaddrinfo(altname, NULL, &hints, &res);
-		if (error != 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"no proper subjectAltName.\n");
-			racoon_free(altname);
-			return ISAKMP_NTYPE_INVALID_CERTIFICATE;
-		}
-		switch (res->ai_family) {
-		case AF_INET:
-			a = (caddr_t)&((struct sockaddr_in *)res->ai_addr)->sin_addr.s_addr;
-			break;
-#ifdef INET6
-		case AF_INET6:
-			a = (caddr_t)&((struct sockaddr_in6 *)res->ai_addr)->sin6_addr.s6_addr;
-			break;
-#endif
-		default:
-			plog(LLV_ERROR, LOCATION, NULL,
-				"family not supported: %d.\n", res->ai_family);
-			racoon_free(altname);
-			freeaddrinfo(res);
-			return ISAKMP_NTYPE_INVALID_CERTIFICATE;
-		}
-		error = memcmp(id_b + 1, a, idlen);
-		freeaddrinfo(res);
-		vfree(name);
-		if (error != 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"ID mismatched with subjectAltName.\n");
-			plogdump(LLV_DEBUG, id_b + 1, idlen);
-			plogdump(LLV_DEBUG, a, idlen);
-			return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
-		}
-		return 0;
-	}
-	case IPSECDOI_ID_FQDN:
-	case IPSECDOI_ID_USER_FQDN:
-	{
-		int pos;
-
-		for (pos = 1; ; pos++) {
-			if (eay_get_x509subjectaltname(&iph1->cert_p->cert,
-					&altname, &type, pos) != 0){
-				plog(LLV_ERROR, LOCATION, NULL,
-					"failed to get subjectAltName\n");
-				return ISAKMP_NTYPE_INVALID_CERTIFICATE;
-			}
-
-			/* it's the end condition of the loop. */
-			if (!altname) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"no proper subjectAltName.\n");
-				return ISAKMP_NTYPE_INVALID_CERTIFICATE;
-			}
-
-			if (check_typeofcertname(id_b->type, type) == 0)
-				break;
-
-			/* next name */
-			racoon_free(altname);
-			altname = NULL;
-		}
-		if (idlen != strlen(altname)) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"Invalid ID length in phase 1.\n");
-			racoon_free(altname);
-			return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
-		}
-		if (check_typeofcertname(id_b->type, type) != 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"ID type mismatched. ID: %s CERT: %s.\n",
-				s_ipsecdoi_ident(id_b->type),
-				s_ipsecdoi_ident(type));
-			racoon_free(altname);
-			return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
-		}
-		error = memcmp(id_b + 1, altname, idlen);
-		if (error) {
-			plog(LLV_ERROR, LOCATION, NULL, "ID mismatched.\n");
-			plogdump(LLV_DEBUG, id_b + 1, idlen);
-			plogdump(LLV_DEBUG, altname, idlen);
-			racoon_free(altname);
-			return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
-		}
-		racoon_free(altname);
-		return 0;
-	}
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"Inpropper ID type passed: %s.\n",
-			s_ipsecdoi_ident(id_b->type));
-		return ISAKMP_NTYPE_INVALID_ID_INFORMATION;
-	}
-	/*NOTREACHED*/
-}
-
-static int
-check_typeofcertname(doi, genid)
-	int doi, genid;
-{
-	switch (doi) {
-	case IPSECDOI_ID_IPV4_ADDR:
-	case IPSECDOI_ID_IPV4_ADDR_SUBNET:
-	case IPSECDOI_ID_IPV6_ADDR:
-	case IPSECDOI_ID_IPV6_ADDR_SUBNET:
-	case IPSECDOI_ID_IPV4_ADDR_RANGE:
-	case IPSECDOI_ID_IPV6_ADDR_RANGE:
-		if (genid != GENT_IPADD)
-			return -1;
-		return 0;
-	case IPSECDOI_ID_FQDN:
-		if (genid != GENT_DNS)
-			return -1;
-		return 0;
-	case IPSECDOI_ID_USER_FQDN:
-		if (genid != GENT_EMAIL)
-			return -1;
-		return 0;
-	case IPSECDOI_ID_DER_ASN1_DN: /* should not be passed to this function*/
-	case IPSECDOI_ID_DER_ASN1_GN:
-	case IPSECDOI_ID_KEY_ID:
-	default:
-		return -1;
-	}
-	/*NOTREACHED*/
-}
-
-/*
- * save certificate including certificate type.
- */
-int
-oakley_savecert(iph1, gen)
-	struct ph1handle *iph1;
-	struct isakmp_gen *gen;
-{
-	cert_t **c;
-	u_int8_t type;
-	STACK_OF(X509) *certs=NULL;
-#if !defined(OPENSSL_IS_BORINGSSL)
-	PKCS7 *p7;
-#endif
-
-	type = *(u_int8_t *)(gen + 1) & 0xff;
-
-	switch (type) {
-	case ISAKMP_CERT_DNS:
-		plog(LLV_WARNING, LOCATION, NULL,
-			"CERT payload is unnecessary in DNSSEC. "
-			"ignore this CERT payload.\n");
-		return 0;
-	case ISAKMP_CERT_PKCS7:
-	case ISAKMP_CERT_PGP:
-	case ISAKMP_CERT_X509SIGN:
-	case ISAKMP_CERT_KERBEROS:
-	case ISAKMP_CERT_SPKI:
-		c = &iph1->cert_p;
-		break;
-	case ISAKMP_CERT_CRL:
-		c = &iph1->crl_p;
-		break;
-	case ISAKMP_CERT_X509KE:
-	case ISAKMP_CERT_X509ATTR:
-	case ISAKMP_CERT_ARL:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"No supported such CERT type %d\n", type);
-		return -1;
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"Invalid CERT type %d\n", type);
-		return -1;
-	}
-
-	/* XXX choice the 1th cert, ignore after the cert. */ 
-	/* XXX should be processed. */
-	if (*c) {
-		plog(LLV_WARNING, LOCATION, NULL,
-			"ignore 2nd CERT payload.\n");
-		return 0;
-	}
-
-	if (type == ISAKMP_CERT_PKCS7) {
-		u_char *bp;
-#if defined(OPENSSL_IS_BORINGSSL)
-		size_t i;
-		STACK_OF(X509) *certs = sk_X509_new_null();
-		CBS cbs;
-#else
-		int i;
-#endif
-
-		/* Skip the header */
-		bp = (u_char *)(gen + 1);
-		/* And the first byte is the certificate type, 
-		 * we know that already
-		 */
-		bp++;
-#if defined(OPENSSL_IS_BORINGSSL)
-		CBS_init(&cbs, bp, ntohs(gen->len) - sizeof(*gen) - 1);
-		if (!PKCS7_get_certificates(certs, &cbs)) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			     "Failed to parse PKCS#7 CERT.\n");
-			sk_X509_pop_free(certs, X509_free);
-			return -1;
-		}
-
-		if (sk_X509_num(certs) == 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			     "CERT PKCS#7 bundle contains no certs.\n");
-			sk_X509_pop_free(certs, X509_free);
-			return -1;
-		}
-#else
-		p7 = d2i_PKCS7(NULL, (void *)&bp,
-		    ntohs(gen->len) - sizeof(*gen) - 1);
-
-		if (!p7) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			     "Failed to parse PKCS#7 CERT.\n");
-			return -1;
-		}
-
-		/* Copied this from the openssl pkcs7 application;
-		 * there"s little by way of documentation for any of
-		 * it. I can only presume it"s correct.
-		 */
-		
-		i = OBJ_obj2nid(p7->type);
-		switch (i) {
-		case NID_pkcs7_signed:
-			certs=p7->d.sign->cert;
-			break;
-		case NID_pkcs7_signedAndEnveloped:
-			certs=p7->d.signed_and_enveloped->cert;
-			break;
-		default:
-			 break;
-		}
-
-		if (!certs) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			     "CERT PKCS#7 bundle contains no certs.\n");
-			PKCS7_free(p7);
-			return -1;
-		}
-#endif
-
-		for (i = 0; i < sk_X509_num(certs); i++) {
-			int len;
-			u_char *bp;
-			X509 *cert = sk_X509_value(certs,i);
-
-			plog(LLV_DEBUG, LOCATION, NULL, 
-			     "Trying PKCS#7 cert %d.\n", i);
-
-			/* We'll just try each cert in turn */
-			*c = save_certx509(cert);
-
-			if (!*c) {
-				plog(LLV_ERROR, LOCATION, NULL,
-				     "Failed to get CERT buffer.\n");
-				continue;
-			}
-
-			/* Ignore cert if it doesn't match identity
-			 * XXX If verify cert is disabled, we still just take
-			 * the first certificate....
-			 */
-			if(iph1->rmconf->verify_cert &&
-			   oakley_check_certid(iph1)) {
-				plog(LLV_DEBUG, LOCATION, NULL,
-				     "Discarding CERT: does not match ID.\n");
-				oakley_delcert((*c));
-				*c = NULL;
-				continue;
-			}
-
-			{
-				char *p = eay_get_x509text(&(*c)->cert);
-				plog(LLV_DEBUG, LOCATION, NULL, "CERT saved:\n");
-				plogdump(LLV_DEBUG, (*c)->cert.v, (*c)->cert.l);
-				plog(LLV_DEBUG, LOCATION, NULL, "%s", 
-				     p ? p : "\n");
-				racoon_free(p);
-			}
-			break;
-		}
-
-#if defined(OPENSSL_IS_BORINGSSL)
-		sk_X509_pop_free(certs, X509_free);
-#else
-		PKCS7_free(p7);
-#endif
-
-	} else {
-		*c = save_certbuf(gen);
-		if (!*c) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			     "Failed to get CERT buffer.\n");
-			return -1;
-		}
-
-		switch ((*c)->type) {
-		case ISAKMP_CERT_DNS:
-			plog(LLV_WARNING, LOCATION, NULL,
-			     "CERT payload is unnecessary in DNSSEC. "
-			     "ignore it.\n");
-			return 0;
-		case ISAKMP_CERT_PGP:
-		case ISAKMP_CERT_X509SIGN:
-		case ISAKMP_CERT_KERBEROS:
-		case ISAKMP_CERT_SPKI:
-			/* Ignore cert if it doesn't match identity
-			 * XXX If verify cert is disabled, we still just take
-			 * the first certificate....
-			 */
-			if(iph1->rmconf->verify_cert &&
-			   oakley_check_certid(iph1)){
-				plog(LLV_DEBUG, LOCATION, NULL,
-				     "Discarding CERT: does not match ID.\n");
-				oakley_delcert((*c));
-				*c = NULL;
-				return 0;
-			}
-
-			{
-				char *p = eay_get_x509text(&(*c)->cert);
-				plog(LLV_DEBUG, LOCATION, NULL, "CERT saved:\n");
-				plogdump(LLV_DEBUG, (*c)->cert.v, (*c)->cert.l);
-				plog(LLV_DEBUG, LOCATION, NULL, "%s", p ? p : "\n");
-				racoon_free(p);
-			}
-			break;
-		case ISAKMP_CERT_CRL:
-			plog(LLV_DEBUG, LOCATION, NULL, "CRL saved:\n");
-			plogdump(LLV_DEBUG, (*c)->cert.v, (*c)->cert.l);
-			break;
-		case ISAKMP_CERT_X509KE:
-		case ISAKMP_CERT_X509ATTR:
-		case ISAKMP_CERT_ARL:
-		default:
-			/* XXX */
-			oakley_delcert((*c));
-			*c = NULL;
-			return 0;
-		}
-	}
-	
-	return 0;
-}
-
-/*
- * save certificate including certificate type.
- */
-int
-oakley_savecr(iph1, gen)
-	struct ph1handle *iph1;
-	struct isakmp_gen *gen;
-{
-	cert_t **c;
-	u_int8_t type;
-
-	type = *(u_int8_t *)(gen + 1) & 0xff;
-
-	switch (type) {
-	case ISAKMP_CERT_DNS:
-		plog(LLV_WARNING, LOCATION, NULL,
-			"CERT payload is unnecessary in DNSSEC\n");
-		/*FALLTHRU*/
-	case ISAKMP_CERT_PKCS7:
-	case ISAKMP_CERT_PGP:
-	case ISAKMP_CERT_X509SIGN:
-	case ISAKMP_CERT_KERBEROS:
-	case ISAKMP_CERT_SPKI:
-		c = &iph1->cr_p;
-		break;
-	case ISAKMP_CERT_X509KE:
-	case ISAKMP_CERT_X509ATTR:
-	case ISAKMP_CERT_ARL:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"No supported such CR type %d\n", type);
-		return -1;
-	case ISAKMP_CERT_CRL:
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"Invalid CR type %d\n", type);
-		return -1;
-	}
-
-	*c = save_certbuf(gen);
-	if (!*c) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"Failed to get CR buffer.\n");
-		return -1;
-	}
-
-	plog(LLV_DEBUG, LOCATION, NULL, "CR saved:\n");
-	plogdump(LLV_DEBUG, (*c)->cert.v, (*c)->cert.l);
-
-	return 0;
-}
-
-static cert_t *
-save_certbuf(gen)
-	struct isakmp_gen *gen;
-{
-	cert_t *new;
-
-	if(ntohs(gen->len) <= sizeof(*gen)){
-		plog(LLV_ERROR, LOCATION, NULL,
-			 "Len is too small !!.\n");
-		return NULL;
-	}
-
-	new = oakley_newcert();
-	if (!new) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"Failed to get CERT buffer.\n");
-		return NULL;
-	}
-
-	new->pl = vmalloc(ntohs(gen->len) - sizeof(*gen));
-	if (new->pl == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"Failed to copy CERT from packet.\n");
-		oakley_delcert(new);
-		new = NULL;
-		return NULL;
-	}
-	memcpy(new->pl->v, gen + 1, new->pl->l);
-	new->type = new->pl->v[0] & 0xff;
-	new->cert.v = new->pl->v + 1;
-	new->cert.l = new->pl->l - 1;
-
-	return new;
-}
-
-static cert_t *
-save_certx509(cert)
-	X509 *cert;
-{
-	cert_t *new;
-        int len;
-        u_char *bp;
-
-	new = oakley_newcert();
-	if (!new) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"Failed to get CERT buffer.\n");
-		return NULL;
-	}
-
-        len = i2d_X509(cert, NULL);
-	new->pl = vmalloc(len);
-	if (new->pl == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"Failed to copy CERT from packet.\n");
-		oakley_delcert(new);
-		new = NULL;
-		return NULL;
-	}
-        bp = (u_char *) new->pl->v;
-        len = i2d_X509(cert, &bp);
-	new->type = ISAKMP_CERT_X509SIGN;
-	new->cert.v = new->pl->v;
-	new->cert.l = new->pl->l;
-
-	return new;
-}
-
-/*
- * get my CR.
- * NOTE: No Certificate Authority field is included to CR payload at the
- * moment. Becuase any certificate authority are accepted without any check.
- * The section 3.10 in RFC2408 says that this field SHOULD not be included,
- * if there is no specific certificate authority requested.
- */
-vchar_t *
-oakley_getcr(iph1)
-	struct ph1handle *iph1;
-{
-	vchar_t *buf;
-
-	buf = vmalloc(1);
-	if (buf == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get cr buffer\n");
-		return NULL;
-	}
-	if(iph1->rmconf->certtype == ISAKMP_CERT_NONE) {
-		buf->v[0] = iph1->rmconf->cacerttype;
-		plog(LLV_DEBUG, LOCATION, NULL, "create my CR: NONE, using %s instead\n",
-		s_isakmp_certtype(iph1->rmconf->cacerttype));
-	} else {
-		buf->v[0] = iph1->rmconf->certtype;
-		plog(LLV_DEBUG, LOCATION, NULL, "create my CR: %s\n",
-		s_isakmp_certtype(iph1->rmconf->certtype));
-	}
-	if (buf->l > 1) {
-		plogdump(LLV_DEBUG, buf->v, buf->l);
-	}
-
-	return buf;
-}
-
-/*
- * check peer's CR.
- */
-int
-oakley_checkcr(iph1)
-	struct ph1handle *iph1;
-{
-	if (iph1->cr_p == NULL)
-		return 0;
-
-	plog(LLV_DEBUG, LOCATION, iph1->remote,
-		"peer transmitted CR: %s\n",
-		s_isakmp_certtype(iph1->cr_p->type));
-
-	if (iph1->cr_p->type != iph1->rmconf->certtype) {
-		plog(LLV_ERROR, LOCATION, iph1->remote,
-			"such a cert type isn't supported: %d\n",
-			(char)iph1->cr_p->type);
-		return -1;
-	}
-
-	return 0;
-}
-
-/*
- * check to need CR payload.
- */
-int
-oakley_needcr(type)
-	int type;
-{
-	switch (type) {
-	case OAKLEY_ATTR_AUTH_METHOD_DSSSIG:
-	case OAKLEY_ATTR_AUTH_METHOD_RSASIG:
-#ifdef ENABLE_HYBRID
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R:
-#endif
-		return 1;
-	default:
-		return 0;
-	}
-	/*NOTREACHED*/
-}
-
-/*
- * compute SKEYID
- * see seciton 5. Exchanges in RFC 2409
- * psk: SKEYID = prf(pre-shared-key, Ni_b | Nr_b)
- * sig: SKEYID = prf(Ni_b | Nr_b, g^ir)
- * enc: SKEYID = prf(H(Ni_b | Nr_b), CKY-I | CKY-R)
- */
-int
-oakley_skeyid(iph1)
-	struct ph1handle *iph1;
-{
-	vchar_t *buf = NULL, *bp;
-	char *p;
-	int len;
-	int error = -1;
-	
-	/* SKEYID */
-	switch (AUTHMETHOD(iph1)) {
-	case OAKLEY_ATTR_AUTH_METHOD_PSKEY:
-#ifdef ENABLE_HYBRID
-	case FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
-#endif
-		if (iph1->etype != ISAKMP_ETYPE_IDENT) {
-			iph1->authstr = getpskbyname(iph1->id_p);
-			if (iph1->authstr == NULL) {
-				if (iph1->rmconf->verify_identifier) {
-					plog(LLV_ERROR, LOCATION, iph1->remote,
-						"couldn't find the pskey.\n");
-					goto end;
-				}
-				plog(LLV_NOTIFY, LOCATION, iph1->remote,
-					"couldn't find the proper pskey, "
-					"try to get one by the peer's address.\n");
-			}
-		}
-		if (iph1->authstr == NULL) {
-			/*
-			 * If the exchange type is the main mode or if it's
-			 * failed to get the psk by ID, racoon try to get
-			 * the psk by remote IP address.
-			 * It may be nonsense.
-			 */
-			iph1->authstr = getpskbyaddr(iph1->remote);
-			if (iph1->authstr == NULL) {
-				plog(LLV_ERROR, LOCATION, iph1->remote,
-					"couldn't find the pskey for %s.\n",
-					saddrwop2str(iph1->remote));
-				goto end;
-			}
-		}
-		plog(LLV_DEBUG, LOCATION, NULL, "the psk found.\n");
-		/* should be secret PSK */
-		plog(LLV_DEBUG2, LOCATION, NULL, "psk: ");
-		plogdump(LLV_DEBUG2, iph1->authstr->v, iph1->authstr->l);
-
-		len = iph1->nonce->l + iph1->nonce_p->l;
-		buf = vmalloc(len);
-		if (buf == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to get skeyid buffer\n");
-			goto end;
-		}
-		p = buf->v;
-
-		bp = (iph1->side == INITIATOR ? iph1->nonce : iph1->nonce_p);
-		plog(LLV_DEBUG, LOCATION, NULL, "nonce 1: ");
-		plogdump(LLV_DEBUG, bp->v, bp->l);
-		memcpy(p, bp->v, bp->l);
-		p += bp->l;
-
-		bp = (iph1->side == INITIATOR ? iph1->nonce_p : iph1->nonce);
-		plog(LLV_DEBUG, LOCATION, NULL, "nonce 2: ");
-		plogdump(LLV_DEBUG, bp->v, bp->l);
-		memcpy(p, bp->v, bp->l);
-		p += bp->l;
-
-		iph1->skeyid = oakley_prf(iph1->authstr, buf, iph1);
-		if (iph1->skeyid == NULL)
-			goto end;
-		break;
-
-	case OAKLEY_ATTR_AUTH_METHOD_DSSSIG:
-	case OAKLEY_ATTR_AUTH_METHOD_RSASIG:
-#ifdef ENABLE_HYBRID
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R:
-	case OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R:
-#endif
-#ifdef HAVE_GSSAPI
-	case OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB:
-#endif
-		len = iph1->nonce->l + iph1->nonce_p->l;
-		buf = vmalloc(len);
-		if (buf == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to get nonce buffer\n");
-			goto end;
-		}
-		p = buf->v;
-
-		bp = (iph1->side == INITIATOR ? iph1->nonce : iph1->nonce_p);
-		plog(LLV_DEBUG, LOCATION, NULL, "nonce1: ");
-		plogdump(LLV_DEBUG, bp->v, bp->l);
-		memcpy(p, bp->v, bp->l);
-		p += bp->l;
-
-		bp = (iph1->side == INITIATOR ? iph1->nonce_p : iph1->nonce);
-		plog(LLV_DEBUG, LOCATION, NULL, "nonce2: ");
-		plogdump(LLV_DEBUG, bp->v, bp->l);
-		memcpy(p, bp->v, bp->l);
-		p += bp->l;
-
-		iph1->skeyid = oakley_prf(buf, iph1->dhgxy, iph1);
-		if (iph1->skeyid == NULL)
-			goto end;
-		break;
-	case OAKLEY_ATTR_AUTH_METHOD_RSAENC:
-	case OAKLEY_ATTR_AUTH_METHOD_RSAREV:
-#ifdef ENABLE_HYBRID
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_R:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_I:
-	case OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_R:
-#endif
-		plog(LLV_WARNING, LOCATION, NULL,
-			"not supported authentication method %s\n",
-			s_oakley_attr_method(iph1->approval->authmethod));
-		goto end;
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid authentication method %d\n",
-			iph1->approval->authmethod);
-		goto end;
-	}
-
-	plog(LLV_DEBUG, LOCATION, NULL, "SKEYID computed:\n");
-	plogdump(LLV_DEBUG, iph1->skeyid->v, iph1->skeyid->l);
-
-	error = 0;
-
-end:
-	if (buf != NULL)
-		vfree(buf);
-	return error;
-}
-
-/*
- * compute SKEYID_[dae]
- * see seciton 5. Exchanges in RFC 2409
- * SKEYID_d = prf(SKEYID, g^ir | CKY-I | CKY-R | 0)
- * SKEYID_a = prf(SKEYID, SKEYID_d | g^ir | CKY-I | CKY-R | 1)
- * SKEYID_e = prf(SKEYID, SKEYID_a | g^ir | CKY-I | CKY-R | 2)
- */
-int
-oakley_skeyid_dae(iph1)
-	struct ph1handle *iph1;
-{
-	vchar_t *buf = NULL;
-	char *p;
-	int len;
-	int error = -1;
-
-	if (iph1->skeyid == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "no SKEYID found.\n");
-		goto end;
-	}
-
-	/* SKEYID D */
-	/* SKEYID_d = prf(SKEYID, g^xy | CKY-I | CKY-R | 0) */
-	len = iph1->dhgxy->l + sizeof(cookie_t) * 2 + 1;
-	buf = vmalloc(len);
-	if (buf == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get skeyid buffer\n");
-		goto end;
-	}
-	p = buf->v;
-
-	memcpy(p, iph1->dhgxy->v, iph1->dhgxy->l);
-	p += iph1->dhgxy->l;
-	memcpy(p, (caddr_t)&iph1->index.i_ck, sizeof(cookie_t));
-	p += sizeof(cookie_t);
-	memcpy(p, (caddr_t)&iph1->index.r_ck, sizeof(cookie_t));
-	p += sizeof(cookie_t);
-	*p = 0;
-	iph1->skeyid_d = oakley_prf(iph1->skeyid, buf, iph1);
-	if (iph1->skeyid_d == NULL)
-		goto end;
-
-	vfree(buf);
-	buf = NULL;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "SKEYID_d computed:\n");
-	plogdump(LLV_DEBUG, iph1->skeyid_d->v, iph1->skeyid_d->l);
-
-	/* SKEYID A */
-	/* SKEYID_a = prf(SKEYID, SKEYID_d | g^xy | CKY-I | CKY-R | 1) */
-	len = iph1->skeyid_d->l + iph1->dhgxy->l + sizeof(cookie_t) * 2 + 1;
-	buf = vmalloc(len);
-	if (buf == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get skeyid buffer\n");
-		goto end;
-	}
-	p = buf->v;
-	memcpy(p, iph1->skeyid_d->v, iph1->skeyid_d->l);
-	p += iph1->skeyid_d->l;
-	memcpy(p, iph1->dhgxy->v, iph1->dhgxy->l);
-	p += iph1->dhgxy->l;
-	memcpy(p, (caddr_t)&iph1->index.i_ck, sizeof(cookie_t));
-	p += sizeof(cookie_t);
-	memcpy(p, (caddr_t)&iph1->index.r_ck, sizeof(cookie_t));
-	p += sizeof(cookie_t);
-	*p = 1;
-	iph1->skeyid_a = oakley_prf(iph1->skeyid, buf, iph1);
-	if (iph1->skeyid_a == NULL)
-		goto end;
-
-	vfree(buf);
-	buf = NULL;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "SKEYID_a computed:\n");
-	plogdump(LLV_DEBUG, iph1->skeyid_a->v, iph1->skeyid_a->l);
-
-	/* SKEYID E */
-	/* SKEYID_e = prf(SKEYID, SKEYID_a | g^xy | CKY-I | CKY-R | 2) */
-	len = iph1->skeyid_a->l + iph1->dhgxy->l + sizeof(cookie_t) * 2 + 1;
-	buf = vmalloc(len);
-	if (buf == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get skeyid buffer\n");
-		goto end;
-	}
-	p = buf->v;
-	memcpy(p, iph1->skeyid_a->v, iph1->skeyid_a->l);
-	p += iph1->skeyid_a->l;
-	memcpy(p, iph1->dhgxy->v, iph1->dhgxy->l);
-	p += iph1->dhgxy->l;
-	memcpy(p, (caddr_t)&iph1->index.i_ck, sizeof(cookie_t));
-	p += sizeof(cookie_t);
-	memcpy(p, (caddr_t)&iph1->index.r_ck, sizeof(cookie_t));
-	p += sizeof(cookie_t);
-	*p = 2;
-	iph1->skeyid_e = oakley_prf(iph1->skeyid, buf, iph1);
-	if (iph1->skeyid_e == NULL)
-		goto end;
-
-	vfree(buf);
-	buf = NULL;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "SKEYID_e computed:\n");
-	plogdump(LLV_DEBUG, iph1->skeyid_e->v, iph1->skeyid_e->l);
-
-	error = 0;
-
-end:
-	if (buf != NULL)
-		vfree(buf);
-	return error;
-}
-
-/*
- * compute final encryption key.
- * see Appendix B.
- */
-int
-oakley_compute_enckey(iph1)
-	struct ph1handle *iph1;
-{
-	u_int keylen, prflen;
-	int error = -1;
-
-	/* RFC2409 p39 */
-	keylen = alg_oakley_encdef_keylen(iph1->approval->enctype,
-					iph1->approval->encklen);
-	if (keylen == -1) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid encryption algoritym %d, "
-			"or invalid key length %d.\n",
-			iph1->approval->enctype,
-			iph1->approval->encklen);
-		goto end;
-	}
-	iph1->key = vmalloc(keylen >> 3);
-	if (iph1->key == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get key buffer\n");
-		goto end;
-	}
-
-	/* set prf length */
-	prflen = alg_oakley_hashdef_hashlen(iph1->approval->hashtype);
-	if (prflen == -1) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid hash type %d.\n", iph1->approval->hashtype);
-		goto end;
-	}
-
-	/* see isakmp-oakley-08 5.3. */
-	if (iph1->key->l <= iph1->skeyid_e->l) {
-		/*
-		 * if length(Ka) <= length(SKEYID_e)
-		 *	Ka = first length(K) bit of SKEYID_e
-		 */
-		memcpy(iph1->key->v, iph1->skeyid_e->v, iph1->key->l);
-	} else {
-		vchar_t *buf = NULL, *res = NULL;
-		u_char *p, *ep;
-		int cplen;
-		int subkey;
-
-		/*
-		 * otherwise,
-		 *	Ka = K1 | K2 | K3
-		 * where
-		 *	K1 = prf(SKEYID_e, 0)
-		 *	K2 = prf(SKEYID_e, K1)
-		 *	K3 = prf(SKEYID_e, K2)
-		 */
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"len(SKEYID_e) < len(Ka) (%zu < %zu), "
-			"generating long key (Ka = K1 | K2 | ...)\n",
-			iph1->skeyid_e->l, iph1->key->l);
-
-		if ((buf = vmalloc(prflen >> 3)) == 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to get key buffer\n");
-			goto end;
-		}
-		p = (u_char *)iph1->key->v;
-		ep = p + iph1->key->l;
-
-		subkey = 1;
-		while (p < ep) {
-			if (p == (u_char *)iph1->key->v) {
-				/* just for computing K1 */
-				buf->v[0] = 0;
-				buf->l = 1;
-			}
-			res = oakley_prf(iph1->skeyid_e, buf, iph1);
-			if (res == NULL) {
-				vfree(buf);
-				goto end;
-			}
-			plog(LLV_DEBUG, LOCATION, NULL,
-				"compute intermediate encryption key K%d\n",
-				subkey);
-			plogdump(LLV_DEBUG, buf->v, buf->l);
-			plogdump(LLV_DEBUG, res->v, res->l);
-
-			cplen = (res->l < ep - p) ? res->l : ep - p;
-			memcpy(p, res->v, cplen);
-			p += cplen;
-
-			buf->l = prflen >> 3;	/* to cancel K1 speciality */
-			if (res->l != buf->l) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"internal error: res->l=%zu buf->l=%zu\n",
-					res->l, buf->l);
-				vfree(res);
-				vfree(buf);
-				goto end;
-			}
-			memcpy(buf->v, res->v, res->l);
-			vfree(res);
-			subkey++;
-		}
-
-		vfree(buf);
-	}
-
-	/*
-	 * don't check any weak key or not.
-	 * draft-ietf-ipsec-ike-01.txt Appendix B.
-	 * draft-ietf-ipsec-ciph-aes-cbc-00.txt Section 2.3.
-	 */
-#if 0
-	/* weakkey check */
-	if (iph1->approval->enctype > ARRAYLEN(oakley_encdef)
-	 || oakley_encdef[iph1->approval->enctype].weakkey == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"encryption algoritym %d isn't supported.\n",
-			iph1->approval->enctype);
-		goto end;
-	}
-	if ((oakley_encdef[iph1->approval->enctype].weakkey)(iph1->key)) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"weakkey was generated.\n");
-		goto end;
-	}
-#endif
-
-	plog(LLV_DEBUG, LOCATION, NULL, "final encryption key computed:\n");
-	plogdump(LLV_DEBUG, iph1->key->v, iph1->key->l);
-
-	error = 0;
-
-end:
-	return error;
-}
-
-/* allocated new buffer for CERT */
-cert_t *
-oakley_newcert()
-{
-	cert_t *new;
-
-	new = racoon_calloc(1, sizeof(*new));
-	if (new == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get cert's buffer\n");
-		return NULL;
-	}
-
-	new->pl = NULL;
-
-	return new;
-}
-
-/* delete buffer for CERT */
-void
-oakley_delcert(cert)
-	cert_t *cert;
-{
-	if (!cert)
-		return;
-	if (cert->pl)
-		VPTRINIT(cert->pl);
-	racoon_free(cert);
-}
-
-/*
- * compute IV and set to ph1handle
- *	IV = hash(g^xi | g^xr)
- * see 4.1 Phase 1 state in draft-ietf-ipsec-ike.
- */
-int
-oakley_newiv(iph1)
-	struct ph1handle *iph1;
-{
-	struct isakmp_ivm *newivm = NULL;
-	vchar_t *buf = NULL, *bp;
-	char *p;
-	int len;
-
-	/* create buffer */
-	len = iph1->dhpub->l + iph1->dhpub_p->l;
-	buf = vmalloc(len);
-	if (buf == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get iv buffer\n");
-		return -1;
-	}
-
-	p = buf->v;
-
-	bp = (iph1->side == INITIATOR ? iph1->dhpub : iph1->dhpub_p);
-	memcpy(p, bp->v, bp->l);
-	p += bp->l;
-
-	bp = (iph1->side == INITIATOR ? iph1->dhpub_p : iph1->dhpub);
-	memcpy(p, bp->v, bp->l);
-	p += bp->l;
-
-	/* allocate IVm */
-	newivm = racoon_calloc(1, sizeof(struct isakmp_ivm));
-	if (newivm == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get iv buffer\n");
-		vfree(buf);
-		return -1;
-	}
-
-	/* compute IV */
-	newivm->iv = oakley_hash(buf, iph1);
-	if (newivm->iv == NULL) {
-		vfree(buf);
-		oakley_delivm(newivm);
-		return -1;
-	}
-
-	/* adjust length of iv */
-	newivm->iv->l = alg_oakley_encdef_blocklen(iph1->approval->enctype);
-	if (newivm->iv->l == -1) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid encryption algoriym %d.\n",
-			iph1->approval->enctype);
-		vfree(buf);
-		oakley_delivm(newivm);
-		return -1;
-	}
-
-	/* create buffer to save iv */
-	if ((newivm->ive = vdup(newivm->iv)) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"vdup (%s)\n", strerror(errno));
-		vfree(buf);
-		oakley_delivm(newivm);
-		return -1;
-	}
-
-	vfree(buf);
-
-	plog(LLV_DEBUG, LOCATION, NULL, "IV computed:\n");
-	plogdump(LLV_DEBUG, newivm->iv->v, newivm->iv->l);
-
-	iph1->ivm = newivm;
-
-	return 0;
-}
-
-/*
- * compute IV for the payload after phase 1.
- * It's not limited for phase 2.
- * if pahse 1 was encrypted.
- *	IV = hash(last CBC block of Phase 1 | M-ID)
- * if phase 1 was not encrypted.
- *	IV = hash(phase 1 IV | M-ID)
- * see 4.2 Phase 2 state in draft-ietf-ipsec-ike.
- */
-struct isakmp_ivm *
-oakley_newiv2(iph1, msgid)
-	struct ph1handle *iph1;
-	u_int32_t msgid;
-{
-	struct isakmp_ivm *newivm = NULL;
-	vchar_t *buf = NULL;
-	char *p;
-	int len;
-	int error = -1;
-
-	/* create buffer */
-	len = iph1->ivm->iv->l + sizeof(msgid_t);
-	buf = vmalloc(len);
-	if (buf == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get iv buffer\n");
-		goto end;
-	}
-
-	p = buf->v;
-
-	memcpy(p, iph1->ivm->iv->v, iph1->ivm->iv->l);
-	p += iph1->ivm->iv->l;
-
-	memcpy(p, &msgid, sizeof(msgid));
-
-	plog(LLV_DEBUG, LOCATION, NULL, "compute IV for phase2\n");
-	plog(LLV_DEBUG, LOCATION, NULL, "phase1 last IV:\n");
-	plogdump(LLV_DEBUG, buf->v, buf->l);
-
-	/* allocate IVm */
-	newivm = racoon_calloc(1, sizeof(struct isakmp_ivm));
-	if (newivm == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get iv buffer\n");
-		goto end;
-	}
-
-	/* compute IV */
-	if ((newivm->iv = oakley_hash(buf, iph1)) == NULL)
-		goto end;
-
-	/* adjust length of iv */
-	newivm->iv->l = alg_oakley_encdef_blocklen(iph1->approval->enctype);
-	if (newivm->iv->l == -1) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid encryption algoriym %d.\n",
-			iph1->approval->enctype);
-		goto end;
-	}
-
-	/* create buffer to save new iv */
-	if ((newivm->ive = vdup(newivm->iv)) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "vdup (%s)\n", strerror(errno));
-		goto end;
-	}
-
-	error = 0;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "phase2 IV computed:\n");
-	plogdump(LLV_DEBUG, newivm->iv->v, newivm->iv->l);
-
-end:
-	if (error && newivm != NULL){
-		oakley_delivm(newivm);
-		newivm=NULL;
-	}
-	if (buf != NULL)
-		vfree(buf);
-	return newivm;
-}
-
-void
-oakley_delivm(ivm)
-	struct isakmp_ivm *ivm;
-{
-	if (ivm == NULL)
-		return;
-
-	if (ivm->iv != NULL)
-		vfree(ivm->iv);
-	if (ivm->ive != NULL)
-		vfree(ivm->ive);
-	racoon_free(ivm);
-	plog(LLV_DEBUG, LOCATION, NULL, "IV freed\n");
-
-	return;
-}
-
-/*
- * decrypt packet.
- *   save new iv and old iv.
- */
-vchar_t *
-oakley_do_decrypt(iph1, msg, ivdp, ivep)
-	struct ph1handle *iph1;
-	vchar_t *msg, *ivdp, *ivep;
-{
-	vchar_t *buf = NULL, *new = NULL;
-	char *pl;
-	int len;
-	u_int8_t padlen;
-	int blen;
-	int error = -1;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "begin decryption.\n");
-
-	blen = alg_oakley_encdef_blocklen(iph1->approval->enctype);
-	if (blen == -1) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid encryption algoriym %d.\n",
-			iph1->approval->enctype);
-		goto end;
-	}
-
-	/* save IV for next, but not sync. */
-	memset(ivep->v, 0, ivep->l);
-	memcpy(ivep->v, (caddr_t)&msg->v[msg->l - blen], blen);
-
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"IV was saved for next processing:\n");
-	plogdump(LLV_DEBUG, ivep->v, ivep->l);
-
-	pl = msg->v + sizeof(struct isakmp);
-
-	len = msg->l - sizeof(struct isakmp);
-
-	/* create buffer */
-	buf = vmalloc(len);
-	if (buf == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get buffer to decrypt.\n");
-		goto end;
-	}
-	memcpy(buf->v, pl, len);
-
-	/* do decrypt */
-	new = alg_oakley_encdef_decrypt(iph1->approval->enctype,
-					buf, iph1->key, ivdp);
-	if (new == NULL || new->v == NULL || new->l == 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"decryption %d failed.\n", iph1->approval->enctype);
-		goto end;
-	}
-	plog(LLV_DEBUG, LOCATION, NULL, "with key:\n");
-	plogdump(LLV_DEBUG, iph1->key->v, iph1->key->l);
-
-	vfree(buf);
-	buf = NULL;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "decrypted payload by IV:\n");
-	plogdump(LLV_DEBUG, ivdp->v, ivdp->l);
-
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"decrypted payload, but not trimed.\n");
-	plogdump(LLV_DEBUG, new->v, new->l);
-
-	/* get padding length */
-	if (lcconf->pad_excltail)
-		padlen = new->v[new->l - 1] + 1;
-	else
-		padlen = new->v[new->l - 1];
-	plog(LLV_DEBUG, LOCATION, NULL, "padding len=%u\n", padlen);
-
-	/* trim padding */
-	if (lcconf->pad_strict) {
-		if (padlen > new->l) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalied padding len=%u, buflen=%zu.\n",
-				padlen, new->l);
-			plogdump(LLV_ERROR, new->v, new->l);
-			goto end;
-		}
-		new->l -= padlen;
-		plog(LLV_DEBUG, LOCATION, NULL, "trimmed padding\n");
-	} else {
-		plog(LLV_DEBUG, LOCATION, NULL, "skip to trim padding.\n");
-	}
-
-	/* create new buffer */
-	len = sizeof(struct isakmp) + new->l;
-	buf = vmalloc(len);
-	if (buf == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get buffer to decrypt.\n");
-		goto end;
-	}
-	memcpy(buf->v, msg->v, sizeof(struct isakmp));
-	memcpy(buf->v + sizeof(struct isakmp), new->v, new->l);
-	((struct isakmp *)buf->v)->len = htonl(buf->l);
-
-	plog(LLV_DEBUG, LOCATION, NULL, "decrypted.\n");
-	plogdump(LLV_DEBUG, buf->v, buf->l);
-
-#ifdef HAVE_PRINT_ISAKMP_C
-	isakmp_printpacket(buf, iph1->remote, iph1->local, 1);
-#endif
-
-	error = 0;
-
-end:
-	if (error && buf != NULL) {
-		vfree(buf);
-		buf = NULL;
-	}
-	if (new != NULL)
-		vfree(new);
-
-	return buf;
-}
-
-/*
- * encrypt packet.
- */
-vchar_t *
-oakley_do_encrypt(iph1, msg, ivep, ivp)
-	struct ph1handle *iph1;
-	vchar_t *msg, *ivep, *ivp;
-{
-	vchar_t *buf = 0, *new = 0;
-	char *pl;
-	int len;
-	u_int padlen;
-	int blen;
-	int error = -1;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "begin encryption.\n");
-
-	/* set cbc block length */
-	blen = alg_oakley_encdef_blocklen(iph1->approval->enctype);
-	if (blen == -1) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid encryption algoriym %d.\n",
-			iph1->approval->enctype);
-		goto end;
-	}
-
-	pl = msg->v + sizeof(struct isakmp);
-	len = msg->l - sizeof(struct isakmp);
-
-	/* add padding */
-	padlen = oakley_padlen(len, blen);
-	plog(LLV_DEBUG, LOCATION, NULL, "pad length = %u\n", padlen);
-
-	/* create buffer */
-	buf = vmalloc(len + padlen);
-	if (buf == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get buffer to encrypt.\n");
-		goto end;
-	}
-        if (padlen) {
-                int i;
-		char *p = &buf->v[len];
-		if (lcconf->pad_random) {
-			for (i = 0; i < padlen; i++)
-				*p++ = eay_random() & 0xff;
-		}
-        }
-        memcpy(buf->v, pl, len);
-
-	/* make pad into tail */
-	if (lcconf->pad_excltail)
-		buf->v[len + padlen - 1] = padlen - 1;
-	else
-		buf->v[len + padlen - 1] = padlen;
-
-	plogdump(LLV_DEBUG, buf->v, buf->l);
-
-	/* do encrypt */
-	new = alg_oakley_encdef_encrypt(iph1->approval->enctype,
-					buf, iph1->key, ivep);
-	if (new == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"encryption %d failed.\n", iph1->approval->enctype);
-		goto end;
-	}
-	plog(LLV_DEBUG, LOCATION, NULL, "with key:\n");
-	plogdump(LLV_DEBUG, iph1->key->v, iph1->key->l);
-
-	vfree(buf);
-	buf = NULL;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "encrypted payload by IV:\n");
-	plogdump(LLV_DEBUG, ivep->v, ivep->l);
-
-	/* save IV for next */
-	memset(ivp->v, 0, ivp->l);
-	memcpy(ivp->v, (caddr_t)&new->v[new->l - blen], blen);
-
-	plog(LLV_DEBUG, LOCATION, NULL, "save IV for next:\n");
-	plogdump(LLV_DEBUG, ivp->v, ivp->l);
-
-	/* create new buffer */
-	len = sizeof(struct isakmp) + new->l;
-	buf = vmalloc(len);
-	if (buf == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get buffer to encrypt.\n");
-		goto end;
-	}
-	memcpy(buf->v, msg->v, sizeof(struct isakmp));
-	memcpy(buf->v + sizeof(struct isakmp), new->v, new->l);
-	((struct isakmp *)buf->v)->len = htonl(buf->l);
-
-	error = 0;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "encrypted.\n");
-
-end:
-	if (error && buf != NULL) {
-		vfree(buf);
-		buf = NULL;
-	}
-	if (new != NULL)
-		vfree(new);
-
-	return buf;
-}
-
-/* culculate padding length */
-static int
-oakley_padlen(len, base)
-	int len, base;
-{
-	int padlen;
-
-	padlen = base - len % base;
-
-	if (lcconf->pad_randomlen)
-		padlen += ((eay_random() % (lcconf->pad_maxsize + 1) + 1) *
-		    base);
-
-	return padlen;
-}
-
diff --git a/src/racoon/oakley.h b/src/racoon/oakley.h
deleted file mode 100644
index a8dbbd2..0000000
--- a/src/racoon/oakley.h
+++ /dev/null
@@ -1,243 +0,0 @@
-/*	$NetBSD: oakley.h,v 1.5 2006/10/06 12:02:27 manu Exp $	*/
-
-/* Id: oakley.h,v 1.13 2005/05/30 20:12:43 fredsen Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _OAKLEY_H
-#define _OAKLEY_H
-
-#include "vmbuf.h"
-
-/* refer to RFC 2409 */
-
-/* Attribute Classes */
-#define OAKLEY_ATTR_ENC_ALG		1 /* B */
-#define   OAKLEY_ATTR_ENC_ALG_DES		1
-#define   OAKLEY_ATTR_ENC_ALG_IDEA		2
-#define   OAKLEY_ATTR_ENC_ALG_BLOWFISH		3
-#define   OAKLEY_ATTR_ENC_ALG_RC5		4
-#define   OAKLEY_ATTR_ENC_ALG_3DES		5
-#define   OAKLEY_ATTR_ENC_ALG_CAST		6
-#define   OAKLEY_ATTR_ENC_ALG_AES		7
-#define   OAKLEY_ATTR_ENC_ALG_CAMELLIA		8	
-					/*	65001 - 65535 Private Use */
-#define OAKLEY_ATTR_HASH_ALG		2 /* B */
-#define   OAKLEY_ATTR_HASH_ALG_MD5		1
-#define   OAKLEY_ATTR_HASH_ALG_SHA		2
-#define   OAKLEY_ATTR_HASH_ALG_TIGER		3
-#if defined(WITH_SHA2)
-#define   OAKLEY_ATTR_HASH_ALG_SHA2_256		4
-#define   OAKLEY_ATTR_HASH_ALG_SHA2_384		5
-#define   OAKLEY_ATTR_HASH_ALG_SHA2_512		6
-#endif
-					/*	65001 - 65535 Private Use */
-#define OAKLEY_ATTR_AUTH_METHOD		3 /* B */
-#define   OAKLEY_ATTR_AUTH_METHOD_PSKEY		1
-#define   OAKLEY_ATTR_AUTH_METHOD_DSSSIG	2
-#define   OAKLEY_ATTR_AUTH_METHOD_RSASIG	3
-#define   OAKLEY_ATTR_AUTH_METHOD_RSAENC	4
-#define   OAKLEY_ATTR_AUTH_METHOD_RSAREV	5
-#define   OAKLEY_ATTR_AUTH_METHOD_EGENC		6
-#define   OAKLEY_ATTR_AUTH_METHOD_EGREV		7
-	/* Hybrid Auth */
-#ifdef ENABLE_HYBRID    
-#define   OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I	64221
-#define	  OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R	64222
-#define   OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I	64223
-#define   OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R	64224
-
-					/*	65001 - 65535 Private Use */
-
-        /* Plain Xauth */
-#define OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I	65001
-#define OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R	65002
-#define OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_I	65003
-#define OAKLEY_ATTR_AUTH_METHOD_XAUTH_DSSSIG_R	65004
-#define OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I	65005
-#define OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R	65006
-#define OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_I	65007
-#define OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAENC_R	65008
-#define OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_I	65009
-#define OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSAREV_R	65010
-#endif
-
-					/*	65500 -> still private
-					 * to avoid clash with GSSAPI_KRB below 
-					 */
-#define FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I	65500
-
-
-	/*
-	 * The following are valid when the Vendor ID is one of
-	 * the following:
-	 *
-	 *	MD5("A GSS-API Authentication Method for IKE")
-	 *	MD5("GSSAPI") (recognized by Windows 2000)
-	 *	MD5("MS NT5 ISAKMPOAKLEY") (sent by Windows 2000)
-	 */
-#define   OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB	65001
-#define OAKLEY_ATTR_GRP_DESC		4 /* B */
-#define   OAKLEY_ATTR_GRP_DESC_MODP768		1
-#define   OAKLEY_ATTR_GRP_DESC_MODP1024		2
-#define   OAKLEY_ATTR_GRP_DESC_EC2N155		3
-#define   OAKLEY_ATTR_GRP_DESC_EC2N185		4
-#define   OAKLEY_ATTR_GRP_DESC_MODP1536		5
-#define   OAKLEY_ATTR_GRP_DESC_MODP2048		14
-#define   OAKLEY_ATTR_GRP_DESC_MODP3072		15
-#define   OAKLEY_ATTR_GRP_DESC_MODP4096		16
-#define   OAKLEY_ATTR_GRP_DESC_MODP6144		17
-#define   OAKLEY_ATTR_GRP_DESC_MODP8192		18
-					/*	32768 - 65535 Private Use */
-#define OAKLEY_ATTR_GRP_TYPE		5 /* B */
-#define   OAKLEY_ATTR_GRP_TYPE_MODP		1
-#define   OAKLEY_ATTR_GRP_TYPE_ECP		2
-#define   OAKLEY_ATTR_GRP_TYPE_EC2N		3
-					/*	65001 - 65535 Private Use */
-#define OAKLEY_ATTR_GRP_PI		6 /* V */
-#define OAKLEY_ATTR_GRP_GEN_ONE		7 /* V */
-#define OAKLEY_ATTR_GRP_GEN_TWO		8 /* V */
-#define OAKLEY_ATTR_GRP_CURVE_A		9 /* V */
-#define OAKLEY_ATTR_GRP_CURVE_B		10 /* V */
-#define OAKLEY_ATTR_SA_LD_TYPE		11 /* B */
-#define   OAKLEY_ATTR_SA_LD_TYPE_DEFAULT	1
-#define   OAKLEY_ATTR_SA_LD_TYPE_SEC		1
-#define   OAKLEY_ATTR_SA_LD_TYPE_KB		2
-#define   OAKLEY_ATTR_SA_LD_TYPE_MAX		3
-					/*	65001 - 65535 Private Use */
-#define OAKLEY_ATTR_SA_LD		12 /* V */
-#define   OAKLEY_ATTR_SA_LD_SEC_DEFAULT		28800 /* 8 hours */
-#define OAKLEY_ATTR_PRF			13 /* B */
-#define OAKLEY_ATTR_KEY_LEN		14 /* B */
-#define OAKLEY_ATTR_FIELD_SIZE		15 /* B */
-#define OAKLEY_ATTR_GRP_ORDER		16 /* V */
-#define OAKLEY_ATTR_BLOCK_SIZE		17 /* B */
-				/*	16384 - 32767 Private Use */
-
-	/*
-	 * The following are valid when the Vendor ID is one of
-	 * the following:
-	 *
-	 *	MD5("A GSS-API Authentication Method for IKE")
-	 *	MD5("GSSAPI") (recognized by Windows 2000)
-	 *	MD5("MS NT5 ISAKMPOAKLEY") (sent by Windows 2000)
-	 */
-#define OAKLEY_ATTR_GSS_ID		16384
-
-#define MAXPADLWORD	20
-
-struct dhgroup {
-	int type;
-	vchar_t *prime;
-	int gen1;
-	int gen2;
-	vchar_t *curve_a;
-	vchar_t *curve_b;
-	vchar_t *order;
-};
-
-/* certificate holder */
-typedef struct cert_t_tag {
-	u_int8_t type;		/* type of CERT, must be same to pl->v[0]*/
-	vchar_t cert;		/* pointer to the CERT */
-	vchar_t *pl;		/* CERT payload minus isakmp general header */
-} cert_t;
-
-struct ph1handle;
-struct ph2handle;
-struct isakmp_ivm;
-
-extern int oakley_get_defaultlifetime __P((void));
-
-extern int oakley_dhinit __P((void));
-extern void oakley_dhgrp_free __P((struct dhgroup *));
-extern int oakley_dh_compute __P((const struct dhgroup *,
-	vchar_t *, vchar_t *, vchar_t *, vchar_t **));
-extern int oakley_dh_generate __P((const struct dhgroup *,
-	vchar_t **, vchar_t **));
-extern int oakley_setdhgroup __P((int, struct dhgroup **));
-
-extern vchar_t *oakley_prf __P((vchar_t *, vchar_t *, struct ph1handle *));
-extern vchar_t *oakley_hash __P((vchar_t *, struct ph1handle *));
-
-extern int oakley_compute_keymat __P((struct ph2handle *, int));
-
-#if notyet
-extern vchar_t *oakley_compute_hashx __P((void));
-#endif
-extern vchar_t *oakley_compute_hash3 __P((struct ph1handle *,
-	u_int32_t, vchar_t *));
-extern vchar_t *oakley_compute_hash1 __P((struct ph1handle *,
-	u_int32_t, vchar_t *));
-extern vchar_t *oakley_ph1hash_common __P((struct ph1handle *, int));
-extern vchar_t *oakley_ph1hash_base_i __P((struct ph1handle *, int));
-extern vchar_t *oakley_ph1hash_base_r __P((struct ph1handle *, int));
-
-extern int oakley_validate_auth __P((struct ph1handle *));
-extern int oakley_getmycert __P((struct ph1handle *));
-extern int oakley_getsign __P((struct ph1handle *));
-extern vchar_t *oakley_getcr __P((struct ph1handle *));
-extern int oakley_checkcr __P((struct ph1handle *));
-extern int oakley_needcr __P((int));
-struct isakmp_gen;
-extern int oakley_savecert __P((struct ph1handle *, struct isakmp_gen *));
-extern int oakley_savecr __P((struct ph1handle *, struct isakmp_gen *));
-
-extern int oakley_skeyid __P((struct ph1handle *));
-extern int oakley_skeyid_dae __P((struct ph1handle *));
-
-extern int oakley_compute_enckey __P((struct ph1handle *));
-extern cert_t *oakley_newcert __P((void));
-extern void oakley_delcert __P((cert_t *));
-extern int oakley_newiv __P((struct ph1handle *));
-extern struct isakmp_ivm *oakley_newiv2 __P((struct ph1handle *, u_int32_t));
-extern void oakley_delivm __P((struct isakmp_ivm *));
-extern vchar_t *oakley_do_decrypt __P((struct ph1handle *,
-	vchar_t *, vchar_t *, vchar_t *));
-extern vchar_t *oakley_do_encrypt __P((struct ph1handle *,
-	vchar_t *, vchar_t *, vchar_t *));
-
-#ifdef ENABLE_HYBRID
-#define AUTHMETHOD(iph1)						     \
-    (((iph1)->rmconf->xauth &&						     \
-    (iph1)->approval->authmethod == OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I) ? \
-	FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I : (iph1)->approval->authmethod)
-#define RMAUTHMETHOD(iph1)						     \
-    (((iph1)->rmconf->xauth &&						     \
-    (iph1)->rmconf->proposal->authmethod ==                                  \
-	OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I) ?                             \
-	FICTIVE_AUTH_METHOD_XAUTH_PSKEY_I :                                  \
-	(iph1)->rmconf->proposal->authmethod)
-#else
-#define AUTHMETHOD(iph1) (iph1)->approval->authmethod
-#define RMAUTHMETHOD(iph1) (iph1)->rmconf->proposal->authmethod
-#endif /* ENABLE_HYBRID */
-
-#endif /* _OAKLEY_H */
diff --git a/src/racoon/pfkey.c b/src/racoon/pfkey.c
deleted file mode 100644
index e73acc8..0000000
--- a/src/racoon/pfkey.c
+++ /dev/null
@@ -1,3157 +0,0 @@
-/*	$NetBSD: pfkey.c,v 1.18.4.5 2008/03/05 22:14:24 mgrooms Exp $	*/
-
-/* $Id: pfkey.c,v 1.18.4.5 2008/03/05 22:14:24 mgrooms Exp $ */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <stdlib.h>
-#include <string.h>
-#include <stdio.h>
-#include <netdb.h>
-#include <errno.h>
-#ifdef HAVE_UNISTD_H
-#include <unistd.h>
-#endif
-#include <netdb.h>
-#include <netinet/in.h>
-#include <arpa/inet.h>
-
-#ifdef ENABLE_NATT
-# ifdef __linux__
-#  include <linux/udp.h>
-# endif
-# if defined(__NetBSD__) || defined(__FreeBSD__) ||	\
-  (defined(__APPLE__) && defined(__MACH__))
-#  include <netinet/udp.h>
-# endif
-#endif
-
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/socket.h>
-#include <sys/queue.h>
-#ifndef ANDROID_CHANGES
-#include <sys/sysctl.h>
-#endif
-
-#include <net/route.h>
-#include <net/pfkeyv2.h>
-
-#include <netinet/in.h>
-#include PATH_IPSEC_H
-#include <fcntl.h>
-
-#include "libpfkey.h"
-
-#include "var.h"
-#include "misc.h"
-#include "vmbuf.h"
-#include "plog.h"
-#include "sockmisc.h"
-#include "debug.h"
-
-#include "schedule.h"
-#include "localconf.h"
-#include "remoteconf.h"
-#include "handler.h"
-#include "policy.h"
-#include "proposal.h"
-#include "isakmp_var.h"
-#include "isakmp.h"
-#include "isakmp_inf.h"
-#include "ipsec_doi.h"
-#include "oakley.h"
-#include "pfkey.h"
-#include "algorithm.h"
-#include "sainfo.h"
-#include "admin.h"
-#include "privsep.h"
-#include "strnames.h"
-#include "backupsa.h"
-#include "gcmalloc.h"
-#include "nattraversal.h"
-#include "crypto_openssl.h"
-#include "grabmyaddr.h"
-
-#if defined(SADB_X_EALG_RIJNDAELCBC) && !defined(SADB_X_EALG_AESCBC)
-#define SADB_X_EALG_AESCBC  SADB_X_EALG_RIJNDAELCBC
-#endif
-
-/* prototype */
-static u_int ipsecdoi2pfkey_aalg __P((u_int));
-static u_int ipsecdoi2pfkey_ealg __P((u_int));
-static u_int ipsecdoi2pfkey_calg __P((u_int));
-static u_int ipsecdoi2pfkey_alg __P((u_int, u_int));
-static u_int keylen_aalg __P((u_int));
-static u_int keylen_ealg __P((u_int, int));
-
-static int pk_recvgetspi __P((caddr_t *));
-static int pk_recvupdate __P((caddr_t *));
-static int pk_recvadd __P((caddr_t *));
-static int pk_recvdelete __P((caddr_t *));
-static int pk_recvacquire __P((caddr_t *));
-static int pk_recvexpire __P((caddr_t *));
-static int pk_recvflush __P((caddr_t *));
-static int getsadbpolicy __P((caddr_t *, int *, int, struct ph2handle *));
-static int pk_recvspdupdate __P((caddr_t *));
-static int pk_recvspdadd __P((caddr_t *));
-static int pk_recvspddelete __P((caddr_t *));
-static int pk_recvspdexpire __P((caddr_t *));
-static int pk_recvspdget __P((caddr_t *));
-static int pk_recvspddump __P((caddr_t *));
-static int pk_recvspdflush __P((caddr_t *));
-static struct sadb_msg *pk_recv __P((int, int *));
-
-static int (*pkrecvf[]) __P((caddr_t *)) = {
-NULL,
-pk_recvgetspi,
-pk_recvupdate,
-pk_recvadd,
-pk_recvdelete,
-NULL,	/* SADB_GET */
-pk_recvacquire,
-NULL,	/* SABD_REGISTER */
-pk_recvexpire,
-pk_recvflush,
-NULL,	/* SADB_DUMP */
-NULL,	/* SADB_X_PROMISC */
-NULL,	/* SADB_X_PCHANGE */
-pk_recvspdupdate,
-pk_recvspdadd,
-pk_recvspddelete,
-pk_recvspdget,
-NULL,	/* SADB_X_SPDACQUIRE */
-pk_recvspddump,
-pk_recvspdflush,
-NULL,	/* SADB_X_SPDSETIDX */
-pk_recvspdexpire,
-NULL,	/* SADB_X_SPDDELETE2 */
-NULL,	/* SADB_X_NAT_T_NEW_MAPPING */
-NULL,	/* SADB_X_MIGRATE */
-#if (SADB_MAX > 24)
-#error "SADB extra message?"
-#endif
-};
-
-static int addnewsp __P((caddr_t *));
-
-/* cope with old kame headers - ugly */
-#ifndef SADB_X_AALG_MD5
-#define SADB_X_AALG_MD5		SADB_AALG_MD5	
-#endif
-#ifndef SADB_X_AALG_SHA
-#define SADB_X_AALG_SHA		SADB_AALG_SHA
-#endif
-#ifndef SADB_X_AALG_NULL
-#define SADB_X_AALG_NULL	SADB_AALG_NULL
-#endif
-
-#ifndef SADB_X_EALG_BLOWFISHCBC
-#define SADB_X_EALG_BLOWFISHCBC	SADB_EALG_BLOWFISHCBC
-#endif
-#ifndef SADB_X_EALG_CAST128CBC
-#define SADB_X_EALG_CAST128CBC	SADB_EALG_CAST128CBC
-#endif
-#ifndef SADB_X_EALG_RC5CBC
-#ifdef SADB_EALG_RC5CBC
-#define SADB_X_EALG_RC5CBC	SADB_EALG_RC5CBC
-#endif
-#endif
-
-/*
- * PF_KEY packet handler
- *	0: success
- *	-1: fail
- */
-int
-pfkey_handler()
-{
-	struct sadb_msg *msg;
-	int len;
-	caddr_t mhp[SADB_EXT_MAX + 1];
-	int error = -1;
-
-	/* receive pfkey message. */
-	len = 0;
-	msg = (struct sadb_msg *)pk_recv(lcconf->sock_pfkey, &len);
-	if (msg == NULL) {
-		if (len < 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to recv from pfkey (%s)\n",
-				strerror(errno));
-			goto end;
-		} else {
-			/* short message - msg not ready */
-			return 0;
-		}
-	}
-
-	plog(LLV_DEBUG, LOCATION, NULL, "get pfkey %s message\n",
-		s_pfkey_type(msg->sadb_msg_type));
-	plogdump(LLV_DEBUG2, msg, msg->sadb_msg_len << 3);
-
-	/* validity check */
-	if (msg->sadb_msg_errno) {
-		int pri;
-
-		/* when SPD is empty, treat the state as no error. */
-		if (msg->sadb_msg_type == SADB_X_SPDDUMP &&
-		    msg->sadb_msg_errno == ENOENT)
-			pri = LLV_DEBUG;
-		else
-			pri = LLV_ERROR;
-
-		plog(pri, LOCATION, NULL,
-			"pfkey %s failed: %s\n",
-			s_pfkey_type(msg->sadb_msg_type),
-			strerror(msg->sadb_msg_errno));
-
-		goto end;
-	}
-
-	/* check pfkey message. */
-	if (pfkey_align(msg, mhp)) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"libipsec failed pfkey align (%s)\n",
-			ipsec_strerror());
-		goto end;
-	}
-	if (pfkey_check(mhp)) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"libipsec failed pfkey check (%s)\n",
-			ipsec_strerror());
-		goto end;
-	}
-	msg = (struct sadb_msg *)mhp[0];
-
-	/* safety check */
-	if (msg->sadb_msg_type >= ARRAYLEN(pkrecvf)) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"unknown PF_KEY message type=%u\n",
-			msg->sadb_msg_type);
-		goto end;
-	}
-
-	if (pkrecvf[msg->sadb_msg_type] == NULL) {
-		plog(LLV_INFO, LOCATION, NULL,
-			"unsupported PF_KEY message %s\n",
-			s_pfkey_type(msg->sadb_msg_type));
-		goto end;
-	}
-
-	if ((pkrecvf[msg->sadb_msg_type])(mhp) < 0)
-		goto end;
-
-	error = 0;
-end:
-	if (msg)
-		racoon_free(msg);
-	return(error);
-}
-
-/*
- * dump SADB
- */
-vchar_t *
-pfkey_dump_sadb(satype)
-	int satype;
-{
-	int s = -1;
-	vchar_t *buf = NULL;
-	pid_t pid = getpid();
-	struct sadb_msg *msg = NULL;
-	size_t bl, ml;
-	int len;
-
-	if ((s = privsep_pfkey_open()) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"libipsec failed pfkey open: %s\n",
-			ipsec_strerror());
-		return NULL;
-	}
-
-	plog(LLV_DEBUG, LOCATION, NULL, "call pfkey_send_dump\n");
-	if (pfkey_send_dump(s, satype) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"libipsec failed dump: %s\n", ipsec_strerror());
-		goto fail;
-	}
-
-	while (1) {
-		if (msg)
-			racoon_free(msg);
-		msg = pk_recv(s, &len);
-		if (msg == NULL) {
-			if (len < 0)
-				goto done;
-			else
-				continue;
-		}
-
-		if (msg->sadb_msg_type != SADB_DUMP || msg->sadb_msg_pid != pid)
-		{
-		    plog(LLV_DEBUG, LOCATION, NULL,
-			 "discarding non-sadb dump msg %p, our pid=%i\n", msg, pid);
-		    plog(LLV_DEBUG, LOCATION, NULL,
-			 "type %i, pid %i\n", msg->sadb_msg_type, msg->sadb_msg_pid);
-		    continue;
-		}
-		
-
-		ml = msg->sadb_msg_len << 3;
-		bl = buf ? buf->l : 0;
-		buf = vrealloc(buf, bl + ml);
-		if (buf == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to reallocate buffer to dump.\n");
-			goto fail;
-		}
-		memcpy(buf->v + bl, msg, ml);
-
-		if (msg->sadb_msg_seq == 0)
-			break;
-	}
-	goto done;
-
-fail:
-	if (buf)
-		vfree(buf);
-	buf = NULL;
-done:
-	if (msg)
-		racoon_free(msg);
-	if (s >= 0)
-		privsep_pfkey_close(s);
-	return buf;
-}
-
-#ifdef ENABLE_ADMINPORT
-/*
- * flush SADB
- */
-void
-pfkey_flush_sadb(proto)
-	u_int proto;
-{
-	int satype;
-
-	/* convert to SADB_SATYPE */
-	if ((satype = admin2pfkey_proto(proto)) < 0)
-		return;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "call pfkey_send_flush\n");
-	if (pfkey_send_flush(lcconf->sock_pfkey, satype) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"libipsec failed send flush (%s)\n", ipsec_strerror());
-		return;
-	}
-
-	return;
-}
-#endif
-
-/*
- * These are the SATYPEs that we manage.  We register to get
- * PF_KEY messages related to these SATYPEs, and we also use
- * this list to determine which SATYPEs to delete SAs for when
- * we receive an INITIAL-CONTACT.
- */
-const struct pfkey_satype pfkey_satypes[] = {
-	{ SADB_SATYPE_AH,	"AH" },
-	{ SADB_SATYPE_ESP,	"ESP" },
-	{ SADB_X_SATYPE_IPCOMP,	"IPCOMP" },
-};
-const int pfkey_nsatypes =
-    sizeof(pfkey_satypes) / sizeof(pfkey_satypes[0]);
-
-/*
- * PF_KEY initialization
- */
-int
-pfkey_init()
-{
-	int i, reg_fail;
-
-	if ((lcconf->sock_pfkey = privsep_pfkey_open()) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"libipsec failed pfkey open (%s)\n", ipsec_strerror());
-		return -1;
-	}
-	if (fcntl(lcconf->sock_pfkey, F_SETFL, O_NONBLOCK) == -1)
-		plog(LLV_WARNING, LOCATION, NULL,
-		    "failed to set the pfkey socket to NONBLOCK\n");
-
-	for (i = 0, reg_fail = 0; i < pfkey_nsatypes; i++) {
-		plog(LLV_DEBUG, LOCATION, NULL,
-		    "call pfkey_send_register for %s\n",
-		    pfkey_satypes[i].ps_name);
-		if (pfkey_send_register(lcconf->sock_pfkey,
-					pfkey_satypes[i].ps_satype) < 0 ||
-		    pfkey_recv_register(lcconf->sock_pfkey) < 0) {
-			plog(LLV_WARNING, LOCATION, NULL,
-			    "failed to register %s (%s)\n",
-			    pfkey_satypes[i].ps_name,
-			    ipsec_strerror());
-			reg_fail++;
-		}
-	}
-
-	if (reg_fail == pfkey_nsatypes) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to regist any protocol.\n");
-		pfkey_close(lcconf->sock_pfkey);
-		return -1;
-	}
-
-	initsp();
-
-	if (pfkey_send_spddump(lcconf->sock_pfkey) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"libipsec sending spddump failed: %s\n",
-			ipsec_strerror());
-		pfkey_close(lcconf->sock_pfkey);
-		return -1;
-	}
-#if 0
-	if (pfkey_promisc_toggle(1) < 0) {
-		pfkey_close(lcconf->sock_pfkey);
-		return -1;
-	}
-#endif
-	return 0;
-}
-
-/* %%% for conversion */
-/* IPSECDOI_ATTR_AUTH -> SADB_AALG */
-static u_int
-ipsecdoi2pfkey_aalg(hashtype)
-	u_int hashtype;
-{
-	switch (hashtype) {
-	case IPSECDOI_ATTR_AUTH_HMAC_MD5:
-		return SADB_AALG_MD5HMAC;
-	case IPSECDOI_ATTR_AUTH_HMAC_SHA1:
-		return SADB_AALG_SHA1HMAC;
-	case IPSECDOI_ATTR_AUTH_HMAC_SHA2_256:
-#if (defined SADB_X_AALG_SHA2_256) && !defined(SADB_X_AALG_SHA2_256HMAC)
-		return SADB_X_AALG_SHA2_256;
-#else
-		return SADB_X_AALG_SHA2_256HMAC;
-#endif
-	case IPSECDOI_ATTR_AUTH_HMAC_SHA2_384:
-#if (defined SADB_X_AALG_SHA2_384) && !defined(SADB_X_AALG_SHA2_384HMAC)
-		return SADB_X_AALG_SHA2_384;
-#else
-		return SADB_X_AALG_SHA2_384HMAC;
-#endif
-	case IPSECDOI_ATTR_AUTH_HMAC_SHA2_512:
-#if (defined SADB_X_AALG_SHA2_512) && !defined(SADB_X_AALG_SHA2_512HMAC)
-		return SADB_X_AALG_SHA2_512;
-#else
-		return SADB_X_AALG_SHA2_512HMAC;
-#endif
-	case IPSECDOI_ATTR_AUTH_KPDK:		/* need special care */
-		return SADB_AALG_NONE;
-
-	/* not supported */
-	case IPSECDOI_ATTR_AUTH_DES_MAC:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"Not supported hash type: %u\n", hashtype);
-		return ~0;
-
-	case 0: /* reserved */
-	default:
-		return SADB_AALG_NONE;
-
-		plog(LLV_ERROR, LOCATION, NULL,
-			"Invalid hash type: %u\n", hashtype);
-		return ~0;
-	}
-	/*NOTREACHED*/
-}
-
-/* IPSECDOI_ESP -> SADB_EALG */
-static u_int
-ipsecdoi2pfkey_ealg(t_id)
-	u_int t_id;
-{
-	switch (t_id) {
-	case IPSECDOI_ESP_DES_IV64:		/* sa_flags |= SADB_X_EXT_OLD */
-		return SADB_EALG_DESCBC;
-	case IPSECDOI_ESP_DES:
-		return SADB_EALG_DESCBC;
-	case IPSECDOI_ESP_3DES:
-		return SADB_EALG_3DESCBC;
-#ifdef SADB_X_EALG_RC5CBC
-	case IPSECDOI_ESP_RC5:
-		return SADB_X_EALG_RC5CBC;
-#endif
-	case IPSECDOI_ESP_CAST:
-		return SADB_X_EALG_CAST128CBC;
-	case IPSECDOI_ESP_BLOWFISH:
-		return SADB_X_EALG_BLOWFISHCBC;
-	case IPSECDOI_ESP_DES_IV32:	/* flags |= (SADB_X_EXT_OLD|
-							SADB_X_EXT_IV4B)*/
-		return SADB_EALG_DESCBC;
-	case IPSECDOI_ESP_NULL:
-		return SADB_EALG_NULL;
-#ifdef SADB_X_EALG_AESCBC
-	case IPSECDOI_ESP_AES:
-		return SADB_X_EALG_AESCBC;
-#endif
-#ifdef SADB_X_EALG_TWOFISHCBC
-	case IPSECDOI_ESP_TWOFISH:
-		return SADB_X_EALG_TWOFISHCBC;
-#endif
-#ifdef SADB_X_EALG_CAMELLIACBC
-	case IPSECDOI_ESP_CAMELLIA:
-		return SADB_X_EALG_CAMELLIACBC;
-#endif
-
-	/* not supported */
-	case IPSECDOI_ESP_3IDEA:
-	case IPSECDOI_ESP_IDEA:
-	case IPSECDOI_ESP_RC4:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"Not supported transform: %u\n", t_id);
-		return ~0;
-
-	case 0: /* reserved */
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"Invalid transform id: %u\n", t_id);
-		return ~0;
-	}
-	/*NOTREACHED*/
-}
-
-/* IPCOMP -> SADB_CALG */
-static u_int
-ipsecdoi2pfkey_calg(t_id)
-	u_int t_id;
-{
-	switch (t_id) {
-	case IPSECDOI_IPCOMP_OUI:
-		return SADB_X_CALG_OUI;
-	case IPSECDOI_IPCOMP_DEFLATE:
-		return SADB_X_CALG_DEFLATE;
-	case IPSECDOI_IPCOMP_LZS:
-		return SADB_X_CALG_LZS;
-
-	case 0: /* reserved */
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"Invalid transform id: %u\n", t_id);
-		return ~0;
-	}
-	/*NOTREACHED*/
-}
-
-/* IPSECDOI_PROTO -> SADB_SATYPE */
-u_int
-ipsecdoi2pfkey_proto(proto)
-	u_int proto;
-{
-	switch (proto) {
-	case IPSECDOI_PROTO_IPSEC_AH:
-		return SADB_SATYPE_AH;
-	case IPSECDOI_PROTO_IPSEC_ESP:
-		return SADB_SATYPE_ESP;
-	case IPSECDOI_PROTO_IPCOMP:
-		return SADB_X_SATYPE_IPCOMP;
-
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"Invalid ipsec_doi proto: %u\n", proto);
-		return ~0;
-	}
-	/*NOTREACHED*/
-}
-
-static u_int
-ipsecdoi2pfkey_alg(algclass, type)
-	u_int algclass, type;
-{
-	switch (algclass) {
-	case IPSECDOI_ATTR_AUTH:
-		return ipsecdoi2pfkey_aalg(type);
-	case IPSECDOI_PROTO_IPSEC_ESP:
-		return ipsecdoi2pfkey_ealg(type);
-	case IPSECDOI_PROTO_IPCOMP:
-		return ipsecdoi2pfkey_calg(type);
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"Invalid ipsec_doi algclass: %u\n", algclass);
-		return ~0;
-	}
-	/*NOTREACHED*/
-}
-
-/* SADB_SATYPE -> IPSECDOI_PROTO */
-u_int
-pfkey2ipsecdoi_proto(satype)
-	u_int satype;
-{
-	switch (satype) {
-	case SADB_SATYPE_AH:
-		return IPSECDOI_PROTO_IPSEC_AH;
-	case SADB_SATYPE_ESP:
-		return IPSECDOI_PROTO_IPSEC_ESP;
-	case SADB_X_SATYPE_IPCOMP:
-		return IPSECDOI_PROTO_IPCOMP;
-
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"Invalid pfkey proto: %u\n", satype);
-		return ~0;
-	}
-	/*NOTREACHED*/
-}
-
-/* IPSECDOI_ATTR_ENC_MODE -> IPSEC_MODE */
-u_int
-ipsecdoi2pfkey_mode(mode)
-	u_int mode;
-{
-	switch (mode) {
-	case IPSECDOI_ATTR_ENC_MODE_TUNNEL:
-#ifdef ENABLE_NATT
-	case IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC:
-	case IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_DRAFT:
-#endif
-		return IPSEC_MODE_TUNNEL;
-	case IPSECDOI_ATTR_ENC_MODE_TRNS:
-#ifdef ENABLE_NATT
-	case IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC:
-	case IPSECDOI_ATTR_ENC_MODE_UDPTRNS_DRAFT:
-#endif
-		return IPSEC_MODE_TRANSPORT;
-	default:
-		plog(LLV_ERROR, LOCATION, NULL, "Invalid mode type: %u\n", mode);
-		return ~0;
-	}
-	/*NOTREACHED*/
-}
-
-/* IPSECDOI_ATTR_ENC_MODE -> IPSEC_MODE */
-u_int
-pfkey2ipsecdoi_mode(mode)
-	u_int mode;
-{
-	switch (mode) {
-	case IPSEC_MODE_TUNNEL:
-		return IPSECDOI_ATTR_ENC_MODE_TUNNEL;
-	case IPSEC_MODE_TRANSPORT:
-		return IPSECDOI_ATTR_ENC_MODE_TRNS;
-	case IPSEC_MODE_ANY:
-		return IPSECDOI_ATTR_ENC_MODE_ANY;
-	default:
-		plog(LLV_ERROR, LOCATION, NULL, "Invalid mode type: %u\n", mode);
-		return ~0;
-	}
-	/*NOTREACHED*/
-}
-
-/* default key length for encryption algorithm */
-static u_int
-keylen_aalg(hashtype)
-	u_int hashtype;
-{
-	int res;
-
-	if (hashtype == 0)
-		return SADB_AALG_NONE;
-
-	res = alg_ipsec_hmacdef_hashlen(hashtype);
-	if (res == -1) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid hmac algorithm %u.\n", hashtype);
-		return ~0;
-	}
-	return res;
-}
-
-/* default key length for encryption algorithm */
-static u_int
-keylen_ealg(enctype, encklen)
-	u_int enctype;
-	int encklen;
-{
-	int res;
-
-	res = alg_ipsec_encdef_keylen(enctype, encklen);
-	if (res == -1) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid encryption algorithm %u.\n", enctype);
-		return ~0;
-	}
-	return res;
-}
-
-int
-pfkey_convertfromipsecdoi(proto_id, t_id, hashtype,
-		e_type, e_keylen, a_type, a_keylen, flags)
-	u_int proto_id;
-	u_int t_id;
-	u_int hashtype;
-	u_int *e_type;
-	u_int *e_keylen;
-	u_int *a_type;
-	u_int *a_keylen;
-	u_int *flags;
-{
-	*flags = 0;
-	switch (proto_id) {
-	case IPSECDOI_PROTO_IPSEC_ESP:
-		if ((*e_type = ipsecdoi2pfkey_ealg(t_id)) == ~0)
-			goto bad;
-		if ((*e_keylen = keylen_ealg(t_id, *e_keylen)) == ~0)
-			goto bad;
-		*e_keylen >>= 3;
-
-		if ((*a_type = ipsecdoi2pfkey_aalg(hashtype)) == ~0)
-			goto bad;
-		if ((*a_keylen = keylen_aalg(hashtype)) == ~0)
-			goto bad;
-		*a_keylen >>= 3;
-
-		if (*e_type == SADB_EALG_NONE) {
-			plog(LLV_ERROR, LOCATION, NULL, "no ESP algorithm.\n");
-			goto bad;
-		}
-		break;
-
-	case IPSECDOI_PROTO_IPSEC_AH:
-		if ((*a_type = ipsecdoi2pfkey_aalg(hashtype)) == ~0)
-			goto bad;
-		if ((*a_keylen = keylen_aalg(hashtype)) == ~0)
-			goto bad;
-		*a_keylen >>= 3;
-
-		if (t_id == IPSECDOI_ATTR_AUTH_HMAC_MD5 
-		 && hashtype == IPSECDOI_ATTR_AUTH_KPDK) {
-			/* AH_MD5 + Auth(KPDK) = RFC1826 keyed-MD5 */
-			*a_type = SADB_X_AALG_MD5;
-			*flags |= SADB_X_EXT_OLD;
-		}
-		*e_type = SADB_EALG_NONE;
-		*e_keylen = 0;
-		if (*a_type == SADB_AALG_NONE) {
-			plog(LLV_ERROR, LOCATION, NULL, "no AH algorithm.\n");
-			goto bad;
-		}
-		break;
-
-	case IPSECDOI_PROTO_IPCOMP:
-		if ((*e_type = ipsecdoi2pfkey_calg(t_id)) == ~0)
-			goto bad;
-		*e_keylen = 0;
-
-		*flags = SADB_X_EXT_RAWCPI;
-
-		*a_type = SADB_AALG_NONE;
-		*a_keylen = 0;
-		if (*e_type == SADB_X_CALG_NONE) {
-			plog(LLV_ERROR, LOCATION, NULL, "no IPCOMP algorithm.\n");
-			goto bad;
-		}
-		break;
-
-	default:
-		plog(LLV_ERROR, LOCATION, NULL, "unknown IPsec protocol.\n");
-		goto bad;
-	}
-
-	return 0;
-
-    bad:
-	errno = EINVAL;
-	return -1;
-}
-
-/* called from scheduler */
-void
-pfkey_timeover_stub(p)
-	void *p;
-{
-
-	pfkey_timeover((struct ph2handle *)p);
-}
-
-void
-pfkey_timeover(iph2)
-	struct ph2handle *iph2;
-{
-	plog(LLV_ERROR, LOCATION, NULL,
-		"%s give up to get IPsec-SA due to time up to wait.\n",
-		saddrwop2str(iph2->dst));
-	SCHED_KILL(iph2->sce);
-
-	/* If initiator side, send error to kernel by SADB_ACQUIRE. */
-	if (iph2->side == INITIATOR)
-		pk_sendeacquire(iph2);
-
-	unbindph12(iph2);
-	remph2(iph2);
-	delph2(iph2);
-
-	return;
-}
-
-/*%%%*/
-/* send getspi message per ipsec protocol per remote address */
-/*
- * the local address and remote address in ph1handle are dealed
- * with destination address and source address respectively.
- * Because SPI is decided by responder.
- */
-int
-pk_sendgetspi(iph2)
-	struct ph2handle *iph2;
-{
-	struct sockaddr *src = NULL, *dst = NULL;
-	u_int satype, mode;
-	struct saprop *pp;
-	struct saproto *pr;
-	u_int32_t minspi, maxspi;
-	int proxy = 0;
-
-	if (iph2->side == INITIATOR) {
-		pp = iph2->proposal;
-		proxy = iph2->ph1->rmconf->support_proxy;
-	} else {
-		pp = iph2->approval;
-		if (iph2->sainfo && iph2->sainfo->id_i)
-			proxy = 1;
-	}
-
-	/* for mobile IPv6 */
-	if (proxy && iph2->src_id && iph2->dst_id &&
-	    ipsecdoi_transportmode(pp)) {
-		src = iph2->src_id;
-		dst = iph2->dst_id;
-	} else {
-		src = iph2->src;
-		dst = iph2->dst;
-	}
-
-	for (pr = pp->head; pr != NULL; pr = pr->next) {
-
-		/* validity check */
-		satype = ipsecdoi2pfkey_proto(pr->proto_id);
-		if (satype == ~0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid proto_id %d\n", pr->proto_id);
-			return -1;
-		}
-		/* this works around a bug in Linux kernel where it allocates 4 byte
-		   spi's for IPCOMP */
-		else if (satype == SADB_X_SATYPE_IPCOMP) {
-			minspi = 0x100;
-			maxspi = 0xffff;
-		}
-		else {
-			minspi = 0;
-			maxspi = 0;
-		}
-		mode = ipsecdoi2pfkey_mode(pr->encmode);
-		if (mode == ~0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid encmode %d\n", pr->encmode);
-			return -1;
-		}
-
-#ifdef ENABLE_NATT
-		/* XXX should we do a copy of src/dst for each pr ?
-		 */
-		if (! pr->udp_encap) {
-			/* Remove port information, that SA doesn't use it */
-			set_port(src, 0);
-			set_port(dst, 0);
-		}
-#endif
-		plog(LLV_DEBUG, LOCATION, NULL, "call pfkey_send_getspi\n");
-		if (pfkey_send_getspi(
-				lcconf->sock_pfkey,
-				satype,
-				mode,
-				dst,			/* src of SA */
-				src,			/* dst of SA */
-				minspi, maxspi,
-				pr->reqid_in, iph2->seq) < 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"ipseclib failed send getspi (%s)\n",
-				ipsec_strerror());
-			return -1;
-		}
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"pfkey GETSPI sent: %s\n",
-			sadbsecas2str(dst, src, satype, 0, mode));
-	}
-
-	return 0;
-}
-
-/*
- * receive GETSPI from kernel.
- */
-static int
-pk_recvgetspi(mhp) 
-	caddr_t *mhp;
-{
-	struct sadb_msg *msg;
-	struct sadb_sa *sa;
-	struct ph2handle *iph2;
-	struct sockaddr *dst;
-	int proto_id;
-	int allspiok, notfound;
-	struct saprop *pp;
-	struct saproto *pr;
-
-	/* validity check */
-	if (mhp[SADB_EXT_SA] == NULL
-	 || mhp[SADB_EXT_ADDRESS_DST] == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"inappropriate sadb getspi message passed.\n");
-		return -1;
-	}
-	msg = (struct sadb_msg *)mhp[0];
-	sa = (struct sadb_sa *)mhp[SADB_EXT_SA];
-	dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]); /* note SA dir */
-
-	/* the message has to be processed or not ? */
-	if (msg->sadb_msg_pid != getpid()) {
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"%s message is not interesting "
-			"because pid %d is not mine.\n",
-			s_pfkey_type(msg->sadb_msg_type),
-			msg->sadb_msg_pid);
-		return -1;
-	}
-
-	iph2 = getph2byseq(msg->sadb_msg_seq);
-	if (iph2 == NULL) {
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"seq %d of %s message not interesting.\n",
-			msg->sadb_msg_seq,
-			s_pfkey_type(msg->sadb_msg_type));
-		return -1;
-	}
-
-	if (iph2->status != PHASE2ST_GETSPISENT) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatch (db:%d msg:%d)\n",
-			iph2->status, PHASE2ST_GETSPISENT);
-		return -1;
-	}
-
-	/* set SPI, and check to get all spi whether or not */
-	allspiok = 1;
-	notfound = 1;
-	proto_id = pfkey2ipsecdoi_proto(msg->sadb_msg_satype);
-	pp = iph2->side == INITIATOR ? iph2->proposal : iph2->approval;
-
-	for (pr = pp->head; pr != NULL; pr = pr->next) {
-		if (pr->proto_id == proto_id && pr->spi == 0) {
-			pr->spi = sa->sadb_sa_spi;
-			notfound = 0;
-			plog(LLV_DEBUG, LOCATION, NULL,
-				"pfkey GETSPI succeeded: %s\n",
-				sadbsecas2str(iph2->dst, iph2->src,
-				    msg->sadb_msg_satype,
-				    sa->sadb_sa_spi,
-				    ipsecdoi2pfkey_mode(pr->encmode)));
-		}
-		if (pr->spi == 0)
-			allspiok = 0;	/* not get all spi */
-	}
-
-	if (notfound) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"get spi for unknown address %s\n",
-			saddrwop2str(iph2->dst));
-		return -1;
-	}
-
-	if (allspiok) {
-		/* update status */
-		iph2->status = PHASE2ST_GETSPIDONE;
-		if (isakmp_post_getspi(iph2) < 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to start post getspi.\n");
-			unbindph12(iph2);
-			remph2(iph2);
-			delph2(iph2);
-			iph2 = NULL;
-			return -1;
-		}
-	}
-
-	return 0;
-}
-
-/*
- * set inbound SA
- */
-int
-pk_sendupdate(iph2)
-	struct ph2handle *iph2;
-{
-	struct saproto *pr;
-	struct pfkey_send_sa_args sa_args;
-	int proxy = 0;
-
-	/* sanity check */
-	if (iph2->approval == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"no approvaled SAs found.\n");
-	}
-
-	if (iph2->side == INITIATOR)
-		proxy = iph2->ph1->rmconf->support_proxy;
-	else if (iph2->sainfo && iph2->sainfo->id_i)
-		proxy = 1;
-
-	/* fill in some needed for pfkey_send_update2 */
-	memset (&sa_args, 0, sizeof (sa_args));
-	sa_args.so = lcconf->sock_pfkey;
-	sa_args.l_addtime = iph2->approval->lifetime;
-	sa_args.seq = iph2->seq; 
-	sa_args.wsize = 4;
-
-	/* for mobile IPv6 */
-	if (proxy && iph2->src_id && iph2->dst_id &&
-	    ipsecdoi_transportmode(iph2->approval)) {
-		sa_args.dst = iph2->src_id;
-		sa_args.src = iph2->dst_id;
-	} else {
-		sa_args.dst = iph2->src;
-		sa_args.src = iph2->dst;
-	}
-
-	for (pr = iph2->approval->head; pr != NULL; pr = pr->next) {
-		/* validity check */
-		sa_args.satype = ipsecdoi2pfkey_proto(pr->proto_id);
-		if (sa_args.satype == ~0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid proto_id %d\n", pr->proto_id);
-			return -1;
-		}
-		else if (sa_args.satype == SADB_X_SATYPE_IPCOMP) {
-			/* IPCOMP has no replay window */
-			sa_args.wsize = 0;
-		}
-#ifdef ENABLE_SAMODE_UNSPECIFIED
-		sa_args.mode = IPSEC_MODE_ANY;
-#else
-		sa_args.mode = ipsecdoi2pfkey_mode(pr->encmode);
-		if (sa_args.mode == ~0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid encmode %d\n", pr->encmode);
-			return -1;
-		}
-#endif
-		/* set algorithm type and key length */
-		sa_args.e_keylen = pr->head->encklen;
-		if (pfkey_convertfromipsecdoi(
-				pr->proto_id,
-				pr->head->trns_id,
-				pr->head->authtype,
-				&sa_args.e_type, &sa_args.e_keylen,
-				&sa_args.a_type, &sa_args.a_keylen, 
-				&sa_args.flags) < 0)
-			return -1;
-
-#if 0
-		sa_args.l_bytes = iph2->approval->lifebyte * 1024,
-#else
-		sa_args.l_bytes = 0;
-#endif
-
-#ifdef HAVE_SECCTX
-		if (*iph2->approval->sctx.ctx_str) {
-			sa_args.ctxdoi = iph2->approval->sctx.ctx_doi;
-			sa_args.ctxalg = iph2->approval->sctx.ctx_alg;
-			sa_args.ctxstrlen = iph2->approval->sctx.ctx_strlen;
-			sa_args.ctxstr = iph2->approval->sctx.ctx_str;
-		}
-#endif /* HAVE_SECCTX */
-
-#ifdef ENABLE_NATT
-		if (pr->udp_encap) {
-			sa_args.l_natt_type = iph2->ph1->natt_options->encaps_type;
-			sa_args.l_natt_sport = extract_port (iph2->ph1->remote);
-			sa_args.l_natt_dport = extract_port (iph2->ph1->local);
-			sa_args.l_natt_oa = NULL;  // FIXME: Here comes OA!!!
-#ifdef SADB_X_EXT_NAT_T_FRAG
-			sa_args.l_natt_frag = iph2->ph1->rmconf->esp_frag;
-#endif
-		} else {
-			/* Remove port information, that SA doesn't use it */
-			set_port(sa_args.src, 0);
-			set_port(sa_args.dst, 0);
-		}
-
-#endif
-		/* more info to fill in */
-		sa_args.spi = pr->spi;
-		sa_args.reqid = pr->reqid_in;
-		sa_args.keymat = pr->keymat->v;
-
-		plog(LLV_DEBUG, LOCATION, NULL, "call pfkey_send_update2\n");
-		if (pfkey_send_update2(&sa_args) < 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"libipsec failed send update (%s)\n",
-				ipsec_strerror());
-			return -1;
-		}
-
-#ifndef ANDROID_PATCHED
-		if (!lcconf->pathinfo[LC_PATHTYPE_BACKUPSA])
-			continue;
-
-		/*
-		 * It maybe good idea to call backupsa_to_file() after
-		 * racoon will receive the sadb_update messages.
-		 * But it is impossible because there is not key in the
-		 * information from the kernel.
-		 */
-		
-		/* change some things before backing up */
-		sa_args.wsize = 4;
-		sa_args.l_bytes = iph2->approval->lifebyte * 1024;
-		
-		if (backupsa_to_file(&sa_args) < 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"backuped SA failed: %s\n",
-				sadbsecas2str(sa_args.src, sa_args.dst,
-				sa_args.satype, sa_args.spi, sa_args.mode));
-		}
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"backuped SA: %s\n",
-			sadbsecas2str(sa_args.src, sa_args.dst,
-			sa_args.satype, sa_args.spi, sa_args.mode));
-#endif
-	}
-
-	return 0;
-}
-
-static int
-pk_recvupdate(mhp)
-	caddr_t *mhp;
-{
-	struct sadb_msg *msg;
-	struct sadb_sa *sa;
-	struct sockaddr *src, *dst;
-	struct ph2handle *iph2;
-	u_int proto_id, encmode, sa_mode;
-	int incomplete = 0;
-	struct saproto *pr;
-
-	/* ignore this message because of local test mode. */
-	if (f_local)
-		return 0;
-
-	/* sanity check */
-	if (mhp[0] == NULL
-	 || mhp[SADB_EXT_SA] == NULL
-	 || mhp[SADB_EXT_ADDRESS_SRC] == NULL
-	 || mhp[SADB_EXT_ADDRESS_DST] == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"inappropriate sadb update message passed.\n");
-		return -1;
-	}
-	msg = (struct sadb_msg *)mhp[0];
-	src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]);
-	dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]);
-	sa = (struct sadb_sa *)mhp[SADB_EXT_SA];
-
-	sa_mode = mhp[SADB_X_EXT_SA2] == NULL
-		? IPSEC_MODE_ANY
-		: ((struct sadb_x_sa2 *)mhp[SADB_X_EXT_SA2])->sadb_x_sa2_mode;
-
-	/* the message has to be processed or not ? */
-	if (msg->sadb_msg_pid != getpid()) {
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"%s message is not interesting "
-			"because pid %d is not mine.\n",
-			s_pfkey_type(msg->sadb_msg_type),
-			msg->sadb_msg_pid);
-		return -1;
-	}
-
-	iph2 = getph2byseq(msg->sadb_msg_seq);
-	if (iph2 == NULL) {
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"seq %d of %s message not interesting.\n",
-			msg->sadb_msg_seq,
-			s_pfkey_type(msg->sadb_msg_type));
-		return -1;
-	}
-
-	if (iph2->status != PHASE2ST_ADDSA) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"status mismatch (db:%d msg:%d)\n",
-			iph2->status, PHASE2ST_ADDSA);
-		return -1;
-	}
-
-	/* check to complete all keys ? */
-	for (pr = iph2->approval->head; pr != NULL; pr = pr->next) {
-		proto_id = pfkey2ipsecdoi_proto(msg->sadb_msg_satype);
-		if (proto_id == ~0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid proto_id %d\n", msg->sadb_msg_satype);
-			return -1;
-		}
-		encmode = pfkey2ipsecdoi_mode(sa_mode);
-		if (encmode == ~0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid encmode %d\n", sa_mode);
-			return -1;
-		}
-
-		if (pr->proto_id == proto_id
-		 && pr->spi == sa->sadb_sa_spi) {
-			pr->ok = 1;
-			plog(LLV_DEBUG, LOCATION, NULL,
-				"pfkey UPDATE succeeded: %s\n",
-				sadbsecas2str(iph2->dst, iph2->src,
-				    msg->sadb_msg_satype,
-				    sa->sadb_sa_spi,
-				    sa_mode));
-
-			plog(LLV_INFO, LOCATION, NULL,
-				"IPsec-SA established: %s\n",
-				sadbsecas2str(iph2->dst, iph2->src,
-					msg->sadb_msg_satype, sa->sadb_sa_spi,
-					sa_mode));
-		}
-
-		if (pr->ok == 0)
-			incomplete = 1;
-	}
-
-	if (incomplete)
-		return 0;
-
-	/* turn off the timer for calling pfkey_timeover() */
-	SCHED_KILL(iph2->sce);
-	
-	/* update status */
-	iph2->status = PHASE2ST_ESTABLISHED;
-
-#ifdef ENABLE_STATS
-	gettimeofday(&iph2->end, NULL);
-	syslog(LOG_NOTICE, "%s(%s): %8.6f",
-		"phase2", "quick", timedelta(&iph2->start, &iph2->end));
-#endif
-
-	/* count up */
-	iph2->ph1->ph2cnt++;
-
-	/* turn off schedule */
-	SCHED_KILL(iph2->scr);
-
-	/* Force the update of ph2's ports, as there is at least one
-	 * situation where they'll mismatch with ph1's values
-	 */
-
-#ifdef ENABLE_NATT
-	set_port(iph2->src, extract_port(iph2->ph1->local));
-	set_port(iph2->dst, extract_port(iph2->ph1->remote));
-#endif
-
-	/*
-	 * since we are going to reuse the phase2 handler, we need to
-	 * remain it and refresh all the references between ph1 and ph2 to use.
-	 */
-	unbindph12(iph2);
-
-	iph2->sce = sched_new(iph2->approval->lifetime,
-	    isakmp_ph2expire_stub, iph2);
-
-	plog(LLV_DEBUG, LOCATION, NULL, "===\n");
-	return 0;
-}
-
-/*
- * set outbound SA
- */
-int
-pk_sendadd(iph2)
-	struct ph2handle *iph2;
-{
-	struct saproto *pr;
-	int proxy = 0;
-	struct pfkey_send_sa_args sa_args;
-
-	/* sanity check */
-	if (iph2->approval == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"no approvaled SAs found.\n");
-		return -1;
-	}
-
-	if (iph2->side == INITIATOR)
-		proxy = iph2->ph1->rmconf->support_proxy;
-	else if (iph2->sainfo && iph2->sainfo->id_i)
-		proxy = 1;
-
-	/* fill in some needed for pfkey_send_update2 */
-	memset (&sa_args, 0, sizeof (sa_args));
-	sa_args.so = lcconf->sock_pfkey;
-	sa_args.l_addtime = iph2->approval->lifetime;
-	sa_args.seq = iph2->seq;
-	sa_args.wsize = 4;
-
-	/* for mobile IPv6 */
-	if (proxy && iph2->src_id && iph2->dst_id &&
-	    ipsecdoi_transportmode(iph2->approval)) {
-		sa_args.src = iph2->src_id;
-		sa_args.dst = iph2->dst_id;
-	} else {
-		sa_args.src = iph2->src;
-		sa_args.dst = iph2->dst;
-	}
-
-	for (pr = iph2->approval->head; pr != NULL; pr = pr->next) {
-		/* validity check */
-		sa_args.satype = ipsecdoi2pfkey_proto(pr->proto_id);
-		if (sa_args.satype == ~0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid proto_id %d\n", pr->proto_id);
-			return -1;
-		}
-		else if (sa_args.satype == SADB_X_SATYPE_IPCOMP) {
-			/* no replay window for IPCOMP */
-			sa_args.wsize = 0;
-		}
-#ifdef ENABLE_SAMODE_UNSPECIFIED
-		sa_args.mode = IPSEC_MODE_ANY;
-#else
-		sa_args.mode = ipsecdoi2pfkey_mode(pr->encmode);
-		if (sa_args.mode == ~0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid encmode %d\n", pr->encmode);
-			return -1;
-		}
-#endif
-
-		/* set algorithm type and key length */
-		sa_args.e_keylen = pr->head->encklen;
-		if (pfkey_convertfromipsecdoi(
-				pr->proto_id,
-				pr->head->trns_id,
-				pr->head->authtype,
-				&sa_args.e_type, &sa_args.e_keylen,
-				&sa_args.a_type, &sa_args.a_keylen, 
-				&sa_args.flags) < 0)
-			return -1;
-
-#if 0
-		sa_args.l_bytes = iph2->approval->lifebyte * 1024,
-#else
-		sa_args.l_bytes = 0;
-#endif
-
-#ifdef HAVE_SECCTX
-		if (*iph2->approval->sctx.ctx_str) {
-			sa_args.ctxdoi = iph2->approval->sctx.ctx_doi;
-			sa_args.ctxalg = iph2->approval->sctx.ctx_alg;
-			sa_args.ctxstrlen = iph2->approval->sctx.ctx_strlen;
-			sa_args.ctxstr = iph2->approval->sctx.ctx_str;
-		}
-#endif /* HAVE_SECCTX */
-
-#ifdef ENABLE_NATT
-		plog(LLV_DEBUG, LOCATION, NULL, "call pfkey_send_add2 "
-		    "(NAT flavor)\n");
-
-		if (pr->udp_encap) {
-			sa_args.l_natt_type = UDP_ENCAP_ESPINUDP;
-			sa_args.l_natt_sport = extract_port(iph2->ph1->local);
-			sa_args.l_natt_dport = extract_port(iph2->ph1->remote);
-			sa_args.l_natt_oa = NULL; // FIXME: Here comes OA!!!
-#ifdef SADB_X_EXT_NAT_T_FRAG
-			sa_args.l_natt_frag = iph2->ph1->rmconf->esp_frag;
-#endif
-		} else {
-			/* Remove port information, that SA doesn't use it */
-			set_port(sa_args.src, 0);
-			set_port(sa_args.dst, 0);
-		}
-
-#else
-		/* Remove port information, it is not used without NAT-T */
-		set_port(sa_args.src, 0);
-		set_port(sa_args.dst, 0);
-#endif
-
-		/* more info to fill in */
-		sa_args.spi = pr->spi_p;
-		sa_args.reqid = pr->reqid_out;
-		sa_args.keymat = pr->keymat_p->v;
-
-		plog(LLV_DEBUG, LOCATION, NULL, "call pfkey_send_add2\n");
-		if (pfkey_send_add2(&sa_args) < 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"libipsec failed send add (%s)\n",
-				ipsec_strerror());
-			return -1;
-		}
-
-#ifndef ANDROID_PATCHED
-		if (!lcconf->pathinfo[LC_PATHTYPE_BACKUPSA])
-			continue;
-
-		/*
-		 * It maybe good idea to call backupsa_to_file() after
-		 * racoon will receive the sadb_update messages.
-		 * But it is impossible because there is not key in the
-		 * information from the kernel.
-		 */
-		if (backupsa_to_file(&sa_args) < 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"backuped SA failed: %s\n",
-				sadbsecas2str(sa_args.src, sa_args.dst,
-				sa_args.satype, sa_args.spi, sa_args.mode));
-		}
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"backuped SA: %s\n",
-			sadbsecas2str(sa_args.src, sa_args.dst,
-			sa_args.satype, sa_args.spi, sa_args.mode));
-#endif
-	}
-	return 0;
-}
-
-static int
-pk_recvadd(mhp)
-	caddr_t *mhp;
-{
-	struct sadb_msg *msg;
-	struct sadb_sa *sa;
-	struct sockaddr *src, *dst;
-	struct ph2handle *iph2;
-	u_int sa_mode;
-
-	/* ignore this message because of local test mode. */
-	if (f_local)
-		return 0;
-
-	/* sanity check */
-	if (mhp[0] == NULL
-	 || mhp[SADB_EXT_SA] == NULL
-	 || mhp[SADB_EXT_ADDRESS_SRC] == NULL
-	 || mhp[SADB_EXT_ADDRESS_DST] == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"inappropriate sadb add message passed.\n");
-		return -1;
-	}
-	msg = (struct sadb_msg *)mhp[0];
-	src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]);
-	dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]);
-	sa = (struct sadb_sa *)mhp[SADB_EXT_SA];
-
-	sa_mode = mhp[SADB_X_EXT_SA2] == NULL
-		? IPSEC_MODE_ANY
-		: ((struct sadb_x_sa2 *)mhp[SADB_X_EXT_SA2])->sadb_x_sa2_mode;
-
-	/* the message has to be processed or not ? */
-	if (msg->sadb_msg_pid != getpid()) {
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"%s message is not interesting "
-			"because pid %d is not mine.\n",
-			s_pfkey_type(msg->sadb_msg_type),
-			msg->sadb_msg_pid);
-		return -1;
-	}
-
-	iph2 = getph2byseq(msg->sadb_msg_seq);
-	if (iph2 == NULL) {
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"seq %d of %s message not interesting.\n",
-			msg->sadb_msg_seq,
-			s_pfkey_type(msg->sadb_msg_type));
-		return -1;
-	}
-
-	/*
-	 * NOTE don't update any status of phase2 handle
-	 * because they must be updated by SADB_UPDATE message
-	 */
-
-	plog(LLV_INFO, LOCATION, NULL,
-		"IPsec-SA established: %s\n",
-		sadbsecas2str(iph2->src, iph2->dst,
-			msg->sadb_msg_satype, sa->sadb_sa_spi, sa_mode));
-
-	plog(LLV_DEBUG, LOCATION, NULL, "===\n");
-	return 0;
-}
-
-static int
-pk_recvexpire(mhp)
-	caddr_t *mhp;
-{
-	struct sadb_msg *msg;
-	struct sadb_sa *sa;
-	struct sockaddr *src, *dst;
-	struct ph2handle *iph2;
-	u_int proto_id, sa_mode;
-
-	/* sanity check */
-	if (mhp[0] == NULL
-	 || mhp[SADB_EXT_SA] == NULL
-	 || mhp[SADB_EXT_ADDRESS_SRC] == NULL
-	 || mhp[SADB_EXT_ADDRESS_DST] == NULL
-	 || (mhp[SADB_EXT_LIFETIME_HARD] != NULL
-	  && mhp[SADB_EXT_LIFETIME_SOFT] != NULL)) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"inappropriate sadb expire message passed.\n");
-		return -1;
-	}
-	msg = (struct sadb_msg *)mhp[0];
-	sa = (struct sadb_sa *)mhp[SADB_EXT_SA];
-	src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]);
-	dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]);
-
-	sa_mode = mhp[SADB_X_EXT_SA2] == NULL
-		? IPSEC_MODE_ANY
-		: ((struct sadb_x_sa2 *)mhp[SADB_X_EXT_SA2])->sadb_x_sa2_mode;
-
-	proto_id = pfkey2ipsecdoi_proto(msg->sadb_msg_satype);
-	if (proto_id == ~0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid proto_id %d\n", msg->sadb_msg_satype);
-		return -1;
-	}
-
-	plog(LLV_INFO, LOCATION, NULL,
-		"IPsec-SA expired: %s\n",
-		sadbsecas2str(src, dst,
-			msg->sadb_msg_satype, sa->sadb_sa_spi, sa_mode));
-
-	iph2 = getph2bysaidx(src, dst, proto_id, sa->sadb_sa_spi);
-	if (iph2 == NULL) {
-		/*
-		 * Ignore it because two expire messages are come up.
-		 * phase2 handler has been deleted already when 2nd message
-		 * is received.
-		 */
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"no such a SA found: %s\n",
-			sadbsecas2str(src, dst,
-			    msg->sadb_msg_satype, sa->sadb_sa_spi,
-			    sa_mode));
-		return 0;
-	}
-	if (iph2->status != PHASE2ST_ESTABLISHED) {
-		/*
-		 * If the status is not equal to PHASE2ST_ESTABLISHED,
-		 * racoon ignores this expire message.  There are two reason.
-		 * One is that the phase 2 probably starts because there is
-		 * a potential that racoon receives the acquire message
-		 * without receiving a expire message.  Another is that racoon
-		 * may receive the multiple expire messages from the kernel.
-		 */
-		plog(LLV_WARNING, LOCATION, NULL,
-			"the expire message is received "
-			"but the handler has not been established.\n");
-		return 0;
-	}
-
-	/* turn off the timer for calling isakmp_ph2expire() */ 
-	SCHED_KILL(iph2->sce);
-
-	iph2->status = PHASE2ST_EXPIRED;
-
-	/* INITIATOR, begin phase 2 exchange. */
-	/* allocate buffer for status management of pfkey message */
-	if (iph2->side == INITIATOR) {
-
-		initph2(iph2);
-
-		/* update status for re-use */
-		iph2->status = PHASE2ST_STATUS2;
-
-		/* start isakmp initiation by using ident exchange */
-		if (isakmp_post_acquire(iph2) < 0) {
-			plog(LLV_ERROR, LOCATION, iph2->dst,
-				"failed to begin ipsec sa "
-				"re-negotication.\n");
-			unbindph12(iph2);
-			remph2(iph2);
-			delph2(iph2);
-			return -1;
-		}
-
-		return 0;
-		/*NOTREACHED*/
-	}
-
-	/* If not received SADB_EXPIRE, INITIATOR delete ph2handle. */
-	/* RESPONDER always delete ph2handle, keep silent.  RESPONDER doesn't
-	 * manage IPsec SA, so delete the list */
-	unbindph12(iph2);
-	remph2(iph2);
-	delph2(iph2);
-
-	return 0;
-}
-
-static int
-pk_recvacquire(mhp)
-	caddr_t *mhp;
-{
-	struct sadb_msg *msg;
-	struct sadb_x_policy *xpl;
-	struct secpolicy *sp_out = NULL, *sp_in = NULL;
-#define MAXNESTEDSA	5	/* XXX */
-	struct ph2handle *iph2[MAXNESTEDSA];
-	struct sockaddr *src, *dst;
-	int n;	/* # of phase 2 handler */
-	int remoteid=0;
-#ifdef HAVE_SECCTX
-	struct sadb_x_sec_ctx *m_sec_ctx;
-#endif /* HAVE_SECCTX */
-	struct policyindex spidx;
-
-
-	/* ignore this message because of local test mode. */
-	if (f_local)
-		return 0;
-
-	/* sanity check */
-	if (mhp[0] == NULL
-	 || mhp[SADB_EXT_ADDRESS_SRC] == NULL
-	 || mhp[SADB_EXT_ADDRESS_DST] == NULL
-	 || mhp[SADB_X_EXT_POLICY] == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"inappropriate sadb acquire message passed.\n");
-		return -1;
-	}
-	msg = (struct sadb_msg *)mhp[0];
-	xpl = (struct sadb_x_policy *)mhp[SADB_X_EXT_POLICY];
-	src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]);
-	dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]);
-
-#ifdef HAVE_SECCTX
-	m_sec_ctx = (struct sadb_x_sec_ctx *)mhp[SADB_X_EXT_SEC_CTX];
-
-	if (m_sec_ctx != NULL) {
-		plog(LLV_INFO, LOCATION, NULL, "security context doi: %u\n",
-		     m_sec_ctx->sadb_x_ctx_doi);
-		plog(LLV_INFO, LOCATION, NULL, 
-		     "security context algorithm: %u\n",
-		     m_sec_ctx->sadb_x_ctx_alg);
-		plog(LLV_INFO, LOCATION, NULL, "security context length: %u\n",
-		     m_sec_ctx->sadb_x_ctx_len);
-		plog(LLV_INFO, LOCATION, NULL, "security context: %s\n",
-		     ((char *)m_sec_ctx + sizeof(struct sadb_x_sec_ctx)));
-	}
-#endif /* HAVE_SECCTX */
-
-	/* ignore if type is not IPSEC_POLICY_IPSEC */
-	if (xpl->sadb_x_policy_type != IPSEC_POLICY_IPSEC) {
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"ignore ACQUIRE message. type is not IPsec.\n");
-		return 0;
-	}
-
-	/* ignore it if src is multicast address */
-    {
-	struct sockaddr *sa = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]);
-
-	if ((sa->sa_family == AF_INET
-	  && IN_MULTICAST(ntohl(((struct sockaddr_in *)sa)->sin_addr.s_addr)))
-#ifdef INET6
-	 || (sa->sa_family == AF_INET6
-	  && IN6_IS_ADDR_MULTICAST(&((struct sockaddr_in6 *)sa)->sin6_addr))
-#endif
-	) {
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"ignore due to multicast address: %s.\n",
-			saddrwop2str(sa));
-		return 0;
-	}
-    }
-   	
-    	/* ignore, if we do not listen on source address */
-	{
-		/* reasons behind:
-		 * - if we'll contact peer from address we do not listen -
-		 *   we will be unable to complete negotiation;
-		 * - if we'll negotiate using address we're listening -
-		 *   remote peer will send packets to address different
-		 *   than one in the policy, so kernel will drop them;
-		 * => therefore this acquire is not for us! --Aidas
-		 */
-		struct sockaddr *sa = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]);
-		struct myaddrs *p;
-		int do_listen = 0;
-		for (p = lcconf->myaddrs; p; p = p->next) {
-			if (!cmpsaddrwop(p->addr, sa)) {
-				do_listen = 1;
-				break;
-			}
-		}
-
-		if (!do_listen) {
-			plog(LLV_DEBUG, LOCATION, NULL,
-				"ignore because do not listen on source address : %s.\n",
-				saddrwop2str(sa));
-			return 0;
-		}
-	}
-
-	/*
-	 * If there is a phase 2 handler against the policy identifier in
-	 * the acquire message, and if
-	 *    1. its state is less than PHASE2ST_ESTABLISHED, then racoon
-	 *       should ignore such a acquire message because the phase 2
-	 *       is just negotiating.
-	 *    2. its state is equal to PHASE2ST_ESTABLISHED, then racoon
-	 *       has to prcesss such a acquire message because racoon may
-	 *       lost the expire message.
-	 */
-	iph2[0] = getph2byid(src, dst, xpl->sadb_x_policy_id);
-	if (iph2[0] != NULL) {
-		if (iph2[0]->status < PHASE2ST_ESTABLISHED) {
-			plog(LLV_DEBUG, LOCATION, NULL,
-				"ignore the acquire because ph2 found\n");
-			return -1;
-		}
-		if (iph2[0]->status == PHASE2ST_EXPIRED)
-			iph2[0] = NULL;
-		/*FALLTHROUGH*/
-	}
-
-	/* search for proper policyindex */
-	sp_out = getspbyspid(xpl->sadb_x_policy_id);
-	if (sp_out == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "no policy found: id:%d.\n",
-			xpl->sadb_x_policy_id);
-		return -1;
-	}
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"suitable outbound SP found: %s.\n", spidx2str(&sp_out->spidx));
-
-	/* get inbound policy */
-    {
-
-	memset(&spidx, 0, sizeof(spidx));
-	spidx.dir = IPSEC_DIR_INBOUND;
-	memcpy(&spidx.src, &sp_out->spidx.dst, sizeof(spidx.src));
-	memcpy(&spidx.dst, &sp_out->spidx.src, sizeof(spidx.dst));
-	spidx.prefs = sp_out->spidx.prefd;
-	spidx.prefd = sp_out->spidx.prefs;
-	spidx.ul_proto = sp_out->spidx.ul_proto;
-
-#ifdef HAVE_SECCTX
-	if (m_sec_ctx) {
-		spidx.sec_ctx.ctx_doi = m_sec_ctx->sadb_x_ctx_doi;
-		spidx.sec_ctx.ctx_alg = m_sec_ctx->sadb_x_ctx_alg;
-		spidx.sec_ctx.ctx_strlen = m_sec_ctx->sadb_x_ctx_len;
-		memcpy(spidx.sec_ctx.ctx_str,
-		      ((char *)m_sec_ctx + sizeof(struct sadb_x_sec_ctx)),
-		      spidx.sec_ctx.ctx_strlen);
-	}
-#endif /* HAVE_SECCTX */
-
-	sp_in = getsp(&spidx);
-	if (sp_in) {
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"suitable inbound SP found: %s.\n",
-			spidx2str(&sp_in->spidx));
-	} else {
-		plog(LLV_NOTIFY, LOCATION, NULL,
-			"no in-bound policy found: %s\n",
-			spidx2str(&spidx));
-	}
-    }
-
-	memset(iph2, 0, MAXNESTEDSA);
-
-	n = 0;
-
-	/* allocate a phase 2 */
-	iph2[n] = newph2();
-	if (iph2[n] == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to allocate phase2 entry.\n");
-		return -1;
-	}
-	iph2[n]->side = INITIATOR;
-	iph2[n]->spid = xpl->sadb_x_policy_id;
-	iph2[n]->satype = msg->sadb_msg_satype;
-	iph2[n]->seq = msg->sadb_msg_seq;
-	iph2[n]->status = PHASE2ST_STATUS2;
-
-	/* set end addresses of SA */
-	iph2[n]->dst = dupsaddr(PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]));
-	if (iph2[n]->dst == NULL) {
-		delph2(iph2[n]);
-		return -1;
-	}
-	iph2[n]->src = dupsaddr(PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]));
-	if (iph2[n]->src == NULL) {
-		delph2(iph2[n]);
-		return -1;
-	}
-
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"new acquire %s\n", spidx2str(&sp_out->spidx));
-
-	/* get sainfo */
-    {
-	vchar_t *idsrc, *iddst;
-
-	idsrc = ipsecdoi_sockaddr2id((struct sockaddr *)&sp_out->spidx.src,
-				sp_out->spidx.prefs, sp_out->spidx.ul_proto);
-	if (idsrc == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get ID for %s\n",
-			spidx2str(&sp_out->spidx));
-		delph2(iph2[n]);
-		return -1;
-	}
-	iddst = ipsecdoi_sockaddr2id((struct sockaddr *)&sp_out->spidx.dst,
-				sp_out->spidx.prefd, sp_out->spidx.ul_proto);
-	if (iddst == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get ID for %s\n",
-			spidx2str(&sp_out->spidx));
-		vfree(idsrc);
-		delph2(iph2[n]);
-		return -1;
-	}
-	{
-		struct remoteconf *conf;
-		conf = getrmconf(iph2[n]->dst);
-		if (conf != NULL)
-			remoteid=conf->ph1id;
-		else{
-			plog(LLV_DEBUG, LOCATION, NULL, "Warning: no valid rmconf !\n");
-			remoteid=0;
-		}
-	}
-	iph2[n]->sainfo = getsainfo(idsrc, iddst, NULL, remoteid);
-	vfree(idsrc);
-	vfree(iddst);
-	if (iph2[n]->sainfo == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get sainfo.\n");
-		delph2(iph2[n]);
-		return -1;
-		/* XXX should use the algorithm list from register message */
-	}
-
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"selected sainfo: %s\n", sainfo2str(iph2[n]->sainfo));
-    }
-
-	if (set_proposal_from_policy(iph2[n], sp_out, sp_in) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to create saprop.\n");
-		delph2(iph2[n]);
-		return -1;
-	}
-#ifdef HAVE_SECCTX
-	if (m_sec_ctx) {
-		set_secctx_in_proposal(iph2[n], spidx);
-	}
-#endif /* HAVE_SECCTX */
-
-	insph2(iph2[n]);
-
-	/* start isakmp initiation by using ident exchange */
-	/* XXX should be looped if there are multiple phase 2 handler. */
-	if (isakmp_post_acquire(iph2[n]) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to begin ipsec sa negotication.\n");
-		goto err;
-	}
-
-	return 0;
-
-err:
-	while (n >= 0) {
-		unbindph12(iph2[n]);
-		remph2(iph2[n]);
-		delph2(iph2[n]);
-		iph2[n] = NULL;
-		n--;
-	}
-	return -1;
-}
-
-static int
-pk_recvdelete(mhp)
-	caddr_t *mhp;
-{
-	struct sadb_msg *msg;
-	struct sadb_sa *sa;
-	struct sockaddr *src, *dst;
-	struct ph2handle *iph2 = NULL;
-	u_int proto_id;
-
-	/* ignore this message because of local test mode. */
-	if (f_local)
-		return 0;
-
-	/* sanity check */
-	if (mhp[0] == NULL
-	 || mhp[SADB_EXT_SA] == NULL
-	 || mhp[SADB_EXT_ADDRESS_SRC] == NULL
-	 || mhp[SADB_EXT_ADDRESS_DST] == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"inappropriate sadb delete message passed.\n");
-		return -1;
-	}
-	msg = (struct sadb_msg *)mhp[0];
-	sa = (struct sadb_sa *)mhp[SADB_EXT_SA];
-	src = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_SRC]);
-	dst = PFKEY_ADDR_SADDR(mhp[SADB_EXT_ADDRESS_DST]);
-
-	/* the message has to be processed or not ? */
-	if (msg->sadb_msg_pid == getpid()) {
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"%s message is not interesting "
-			"because the message was originated by me.\n",
-			s_pfkey_type(msg->sadb_msg_type));
-		return -1;
-	}
-
-	proto_id = pfkey2ipsecdoi_proto(msg->sadb_msg_satype);
-	if (proto_id == ~0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid proto_id %d\n", msg->sadb_msg_satype);
-		return -1;
-	}
-
-	iph2 = getph2bysaidx(src, dst, proto_id, sa->sadb_sa_spi);
-	if (iph2 == NULL) {
-		/* ignore */
-		plog(LLV_ERROR, LOCATION, NULL,
-			"no iph2 found: %s\n",
-			sadbsecas2str(src, dst, msg->sadb_msg_satype,
-				sa->sadb_sa_spi, IPSEC_MODE_ANY));
-		return 0;
-	}
-
-	plog(LLV_ERROR, LOCATION, NULL,
-		"pfkey DELETE received: %s\n",
-		sadbsecas2str(iph2->src, iph2->dst,
-			msg->sadb_msg_satype, sa->sadb_sa_spi, IPSEC_MODE_ANY));
-
-	/* send delete information */
-	if (iph2->status == PHASE2ST_ESTABLISHED)
-		isakmp_info_send_d2(iph2);
-
-	unbindph12(iph2);
-	remph2(iph2);
-	delph2(iph2);
-
-	return 0;
-}
-
-static int
-pk_recvflush(mhp)
-	caddr_t *mhp;
-{
-	/* ignore this message because of local test mode. */
-	if (f_local)
-		return 0;
-
-	/* sanity check */
-	if (mhp[0] == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"inappropriate sadb flush message passed.\n");
-		return -1;
-	}
-
-	flushph2();
-
-	return 0;
-}
-
-static int
-getsadbpolicy(policy0, policylen0, type, iph2)
-	caddr_t *policy0;
-	int *policylen0, type;
-	struct ph2handle *iph2;
-{
-	struct policyindex *spidx = (struct policyindex *)iph2->spidx_gen;
-	struct sadb_x_policy *xpl;
-	struct sadb_x_ipsecrequest *xisr;
-	struct saproto *pr;
-	struct saproto **pr_rlist;
-	int rlist_len = 0;
-	caddr_t policy, p;
-	int policylen;
-	int xisrlen;
-	u_int satype, mode;
-	int len = 0;
-#ifdef HAVE_SECCTX
-	int ctxlen = 0;
-#endif /* HAVE_SECCTX */
-
-
-	/* get policy buffer size */
-	policylen = sizeof(struct sadb_x_policy);
-	if (type != SADB_X_SPDDELETE) {
-		for (pr = iph2->approval->head; pr; pr = pr->next) {
-			xisrlen = sizeof(*xisr);
-			if (pr->encmode == IPSECDOI_ATTR_ENC_MODE_TUNNEL) {
-				xisrlen += (sysdep_sa_len(iph2->src)
-				          + sysdep_sa_len(iph2->dst));
-			}
-
-			policylen += PFKEY_ALIGN8(xisrlen);
-		}
-	}
-
-#ifdef HAVE_SECCTX
-	if (*spidx->sec_ctx.ctx_str) {
-		ctxlen = sizeof(struct sadb_x_sec_ctx)
-				+ PFKEY_ALIGN8(spidx->sec_ctx.ctx_strlen);
-		policylen += ctxlen;
-	}
-#endif /* HAVE_SECCTX */
-
-	/* make policy structure */
-	policy = racoon_malloc(policylen);
-	memset((void*)policy, 0xcd, policylen);
-	if (!policy) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"buffer allocation failed.\n");
-		return -1;
-	}
-
-	xpl = (struct sadb_x_policy *)policy;
-	xpl->sadb_x_policy_len = PFKEY_UNIT64(policylen);
-	xpl->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
-	xpl->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
-	xpl->sadb_x_policy_dir = spidx->dir;
-	xpl->sadb_x_policy_id = 0;
-#ifdef HAVE_PFKEY_POLICY_PRIORITY
-	xpl->sadb_x_policy_priority = PRIORITY_DEFAULT;
-#endif
-	len++;
-
-#ifdef HAVE_SECCTX
-	if (*spidx->sec_ctx.ctx_str) {
-		struct sadb_x_sec_ctx *p;
-
-		p = (struct sadb_x_sec_ctx *)(xpl + len);
-		memset(p, 0, ctxlen);
-		p->sadb_x_sec_len = PFKEY_UNIT64(ctxlen);
-		p->sadb_x_sec_exttype = SADB_X_EXT_SEC_CTX;
-		p->sadb_x_ctx_len = spidx->sec_ctx.ctx_strlen;
-		p->sadb_x_ctx_doi = spidx->sec_ctx.ctx_doi;
-		p->sadb_x_ctx_alg = spidx->sec_ctx.ctx_alg;
- 
-		memcpy(p + 1,spidx->sec_ctx.ctx_str,spidx->sec_ctx.ctx_strlen);
-		len += ctxlen;
-	}
-#endif /* HAVE_SECCTX */
-
-	/* no need to append policy information any more if type is SPDDELETE */
-	if (type == SADB_X_SPDDELETE)
-		goto end;
-
-	xisr = (struct sadb_x_ipsecrequest *)(xpl + len);
-
-	/* The order of things is reversed for use in add policy messages */
-	for (pr = iph2->approval->head; pr; pr = pr->next) rlist_len++;
-	pr_rlist = racoon_malloc((rlist_len+1)*sizeof(struct saproto*));
-	if (!pr_rlist) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"buffer allocation failed.\n");
-		return -1;
-	}
-	pr_rlist[rlist_len--] = NULL;
-	for (pr = iph2->approval->head; pr; pr = pr->next) pr_rlist[rlist_len--] = pr;
-	rlist_len = 0;
-
-	for (pr = pr_rlist[rlist_len++]; pr; pr = pr_rlist[rlist_len++]) {
-
-		satype = doi2ipproto(pr->proto_id);
-		if (satype == ~0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid proto_id %d\n", pr->proto_id);
-			goto err;
-		}
-		mode = ipsecdoi2pfkey_mode(pr->encmode);
-		if (mode == ~0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid encmode %d\n", pr->encmode);
-			goto err;
-		}
-
-		/* 
-		 * the policy level cannot be unique because the policy
-		 * is defined later than SA, so req_id cannot be bound to SA.
-		 */
-		xisr->sadb_x_ipsecrequest_proto = satype;
-		xisr->sadb_x_ipsecrequest_mode = mode;
-		if(iph2->proposal->head->reqid_in > 0){
-			xisr->sadb_x_ipsecrequest_level = IPSEC_LEVEL_UNIQUE;
-			xisr->sadb_x_ipsecrequest_reqid = iph2->proposal->head->reqid_in;
-		}else{
-			xisr->sadb_x_ipsecrequest_level = IPSEC_LEVEL_REQUIRE;
-			xisr->sadb_x_ipsecrequest_reqid = 0;
-		}
-		p = (caddr_t)(xisr + 1);
-
-		xisrlen = sizeof(*xisr);
-
-		if (pr->encmode == IPSECDOI_ATTR_ENC_MODE_TUNNEL) {
-			int src_len, dst_len;
-
-			src_len = sysdep_sa_len(iph2->src);
-			dst_len = sysdep_sa_len(iph2->dst);
-			xisrlen += src_len + dst_len;
-
-			memcpy(p, iph2->src, src_len);
-			p += src_len;
-
-			memcpy(p, iph2->dst, dst_len);
-			p += dst_len;
-		}
-
-		xisr->sadb_x_ipsecrequest_len = PFKEY_ALIGN8(xisrlen);
-		xisr = (struct sadb_x_ipsecrequest *)p;
-		
-	}
-	racoon_free(pr_rlist);
-
-end:
-	*policy0 = policy;
-	*policylen0 = policylen;
-
-	return 0;
-
-err:
-	if (policy)
-		racoon_free(policy);
-	if (pr_rlist) racoon_free(pr_rlist);
-
-	return -1;
-}
-
-int
-pk_sendspdupdate2(iph2)
-	struct ph2handle *iph2;
-{
-	struct policyindex *spidx = (struct policyindex *)iph2->spidx_gen;
-	caddr_t policy = NULL;
-	int policylen = 0;
-	u_int64_t ltime, vtime;
-
-	ltime = iph2->approval->lifetime;
-	vtime = 0;
-
-	if (getsadbpolicy(&policy, &policylen, SADB_X_SPDUPDATE, iph2)) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"getting sadb policy failed.\n");
-		return -1;
-	}
-
-	if (pfkey_send_spdupdate2(
-			lcconf->sock_pfkey,
-			(struct sockaddr *)&spidx->src,
-			spidx->prefs,
-			(struct sockaddr *)&spidx->dst,
-			spidx->prefd,
-			spidx->ul_proto,
-			ltime, vtime,
-			policy, policylen, 0) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"libipsec failed send spdupdate2 (%s)\n",
-			ipsec_strerror());
-		goto end;
-	}
-	plog(LLV_DEBUG, LOCATION, NULL, "call pfkey_send_spdupdate2\n");
-
-end:
-	if (policy)
-		racoon_free(policy);
-
-	return 0;
-}
-
-static int
-pk_recvspdupdate(mhp)
-	caddr_t *mhp;
-{
-	struct sadb_address *saddr, *daddr;
-	struct sadb_x_policy *xpl;
- 	struct sadb_lifetime *lt;
-	struct policyindex spidx;
-	struct secpolicy *sp;
- 	u_int64_t created;
-
-	/* sanity check */
-	if (mhp[0] == NULL
-	 || mhp[SADB_EXT_ADDRESS_SRC] == NULL
-	 || mhp[SADB_EXT_ADDRESS_DST] == NULL
-	 || mhp[SADB_X_EXT_POLICY] == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"inappropriate sadb spdupdate message passed.\n");
-		return -1;
-	}
-	saddr = (struct sadb_address *)mhp[SADB_EXT_ADDRESS_SRC];
-	daddr = (struct sadb_address *)mhp[SADB_EXT_ADDRESS_DST];
-	xpl = (struct sadb_x_policy *)mhp[SADB_X_EXT_POLICY];
-	lt = (struct sadb_lifetime*)mhp[SADB_EXT_LIFETIME_HARD];
-	if(lt != NULL)
-		created = lt->sadb_lifetime_addtime;
-	else
-		created = 0;
-
-#ifdef HAVE_PFKEY_POLICY_PRIORITY
-	KEY_SETSECSPIDX(xpl->sadb_x_policy_dir,
-			saddr + 1,
-			daddr + 1,
-			saddr->sadb_address_prefixlen,
-			daddr->sadb_address_prefixlen,
-			saddr->sadb_address_proto,
-			xpl->sadb_x_policy_priority,
-			created,
-			&spidx);
-#else
-	KEY_SETSECSPIDX(xpl->sadb_x_policy_dir,
-			saddr + 1,
-			daddr + 1,
-			saddr->sadb_address_prefixlen,
-			daddr->sadb_address_prefixlen,
-			saddr->sadb_address_proto,
-			created,
-			&spidx);
-#endif
-
-#ifdef HAVE_SECCTX
-	if (mhp[SADB_X_EXT_SEC_CTX] != NULL) {
-		struct sadb_x_sec_ctx *ctx;
-
-		ctx = (struct sadb_x_sec_ctx *)mhp[SADB_X_EXT_SEC_CTX];
-		spidx.sec_ctx.ctx_alg = ctx->sadb_x_ctx_alg;
-		spidx.sec_ctx.ctx_doi = ctx->sadb_x_ctx_doi;
-		spidx.sec_ctx.ctx_strlen = ctx->sadb_x_ctx_len;
-		memcpy(spidx.sec_ctx.ctx_str, ctx + 1, ctx->sadb_x_ctx_len);
-	}
-#endif /* HAVE_SECCTX */
-
-	sp = getsp(&spidx);
-	if (sp == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"such policy does not already exist: \"%s\"\n",
-			spidx2str(&spidx));
-	} else {
-		remsp(sp);
-		delsp(sp);
-	}
-
-	if (addnewsp(mhp) < 0)
-		return -1;
-
-	return 0;
-}
-
-/*
- * this function has to be used by responder side.
- */
-int
-pk_sendspdadd2(iph2)
-	struct ph2handle *iph2;
-{
-	struct policyindex *spidx = (struct policyindex *)iph2->spidx_gen;
-	caddr_t policy = NULL;
-	int policylen = 0;
-	u_int64_t ltime, vtime;
-
-	ltime = iph2->approval->lifetime;
-	vtime = 0;
-
-	if (getsadbpolicy(&policy, &policylen, SADB_X_SPDADD, iph2)) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"getting sadb policy failed.\n");
-		return -1;
-	}
-
-	if (pfkey_send_spdadd2(
-			lcconf->sock_pfkey,
-			(struct sockaddr *)&spidx->src,
-			spidx->prefs,
-			(struct sockaddr *)&spidx->dst,
-			spidx->prefd,
-			spidx->ul_proto,
-			ltime, vtime,
-			policy, policylen, 0) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"libipsec failed send spdadd2 (%s)\n",
-			ipsec_strerror());
-		goto end;
-	}
-	plog(LLV_DEBUG, LOCATION, NULL, "call pfkey_send_spdadd2\n");
-
-end:
-	if (policy)
-		racoon_free(policy);
-
-	return 0;
-}
-
-static int
-pk_recvspdadd(mhp)
-	caddr_t *mhp;
-{
-	struct sadb_address *saddr, *daddr;
-	struct sadb_x_policy *xpl;
-	struct sadb_lifetime *lt;
-	struct policyindex spidx;
-	struct secpolicy *sp;
-	u_int64_t created;
-
-	/* sanity check */
-	if (mhp[0] == NULL
-	 || mhp[SADB_EXT_ADDRESS_SRC] == NULL
-	 || mhp[SADB_EXT_ADDRESS_DST] == NULL
-	 || mhp[SADB_X_EXT_POLICY] == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"inappropriate sadb spdadd message passed.\n");
-		return -1;
-	}
-	saddr = (struct sadb_address *)mhp[SADB_EXT_ADDRESS_SRC];
-	daddr = (struct sadb_address *)mhp[SADB_EXT_ADDRESS_DST];
-	xpl = (struct sadb_x_policy *)mhp[SADB_X_EXT_POLICY];
-	lt = (struct sadb_lifetime*)mhp[SADB_EXT_LIFETIME_HARD];
-	if(lt != NULL)
-		created = lt->sadb_lifetime_addtime;
-	else
-		created = 0;
-
-#ifdef HAVE_PFKEY_POLICY_PRIORITY
-	KEY_SETSECSPIDX(xpl->sadb_x_policy_dir,
-			saddr + 1,
-			daddr + 1,
-			saddr->sadb_address_prefixlen,
-			daddr->sadb_address_prefixlen,
-			saddr->sadb_address_proto,
-			xpl->sadb_x_policy_priority,
-			created,
-			&spidx);
-#else
-	KEY_SETSECSPIDX(xpl->sadb_x_policy_dir,
-			saddr + 1,
-			daddr + 1,
-			saddr->sadb_address_prefixlen,
-			daddr->sadb_address_prefixlen,
-			saddr->sadb_address_proto,
-			created,
-			&spidx);
-#endif
-
-#ifdef HAVE_SECCTX
-	if (mhp[SADB_X_EXT_SEC_CTX] != NULL) {
-		struct sadb_x_sec_ctx *ctx;
-
-		ctx = (struct sadb_x_sec_ctx *)mhp[SADB_X_EXT_SEC_CTX];
-		spidx.sec_ctx.ctx_alg = ctx->sadb_x_ctx_alg;
-		spidx.sec_ctx.ctx_doi = ctx->sadb_x_ctx_doi;
-		spidx.sec_ctx.ctx_strlen = ctx->sadb_x_ctx_len;
-		memcpy(spidx.sec_ctx.ctx_str, ctx + 1, ctx->sadb_x_ctx_len);
-	}
-#endif /* HAVE_SECCTX */
-
-	sp = getsp(&spidx);
-	if (sp != NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"such policy already exists. "
-			"anyway replace it: %s\n",
-			spidx2str(&spidx));
-		remsp(sp);
-		delsp(sp);
-	}
-
-	if (addnewsp(mhp) < 0)
-		return -1;
-
-	return 0;
-}
-
-/*
- * this function has to be used by responder side.
- */
-int
-pk_sendspddelete(iph2)
-	struct ph2handle *iph2;
-{
-	struct policyindex *spidx = (struct policyindex *)iph2->spidx_gen;
-	caddr_t policy = NULL;
-	int policylen;
-
-	if (getsadbpolicy(&policy, &policylen, SADB_X_SPDDELETE, iph2)) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"getting sadb policy failed.\n");
-		return -1;
-	}
-
-	if (pfkey_send_spddelete(
-			lcconf->sock_pfkey,
-			(struct sockaddr *)&spidx->src,
-			spidx->prefs,
-			(struct sockaddr *)&spidx->dst,
-			spidx->prefd,
-			spidx->ul_proto,
-			policy, policylen, 0) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"libipsec failed send spddelete (%s)\n",
-			ipsec_strerror());
-		goto end;
-	}
-	plog(LLV_DEBUG, LOCATION, NULL, "call pfkey_send_spddelete\n");
-
-end:
-	if (policy)
-		racoon_free(policy);
-
-	return 0;
-}
-
-static int
-pk_recvspddelete(mhp)
-	caddr_t *mhp;
-{
-	struct sadb_address *saddr, *daddr;
-	struct sadb_x_policy *xpl;
-	struct sadb_lifetime *lt;
-	struct policyindex spidx;
-	struct secpolicy *sp;
-	u_int64_t created;
-
-	/* sanity check */
-	if (mhp[0] == NULL
-	 || mhp[SADB_EXT_ADDRESS_SRC] == NULL
-	 || mhp[SADB_EXT_ADDRESS_DST] == NULL
-	 || mhp[SADB_X_EXT_POLICY] == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"inappropriate sadb spddelete message passed.\n");
-		return -1;
-	}
-	saddr = (struct sadb_address *)mhp[SADB_EXT_ADDRESS_SRC];
-	daddr = (struct sadb_address *)mhp[SADB_EXT_ADDRESS_DST];
-	xpl = (struct sadb_x_policy *)mhp[SADB_X_EXT_POLICY];
-	lt = (struct sadb_lifetime*)mhp[SADB_EXT_LIFETIME_HARD];
-	if(lt != NULL)
-		created = lt->sadb_lifetime_addtime;
-	else
-		created = 0;
-
-#ifdef HAVE_PFKEY_POLICY_PRIORITY
-	KEY_SETSECSPIDX(xpl->sadb_x_policy_dir,
-			saddr + 1,
-			daddr + 1,
-			saddr->sadb_address_prefixlen,
-			daddr->sadb_address_prefixlen,
-			saddr->sadb_address_proto,
-			xpl->sadb_x_policy_priority,
-			created,
-			&spidx);
-#else
-	KEY_SETSECSPIDX(xpl->sadb_x_policy_dir,
-			saddr + 1,
-			daddr + 1,
-			saddr->sadb_address_prefixlen,
-			daddr->sadb_address_prefixlen,
-			saddr->sadb_address_proto,
-			created,
-			&spidx);
-#endif
-
-#ifdef HAVE_SECCTX
-	if (mhp[SADB_X_EXT_SEC_CTX] != NULL) {
-		struct sadb_x_sec_ctx *ctx;
-
-		ctx = (struct sadb_x_sec_ctx *)mhp[SADB_X_EXT_SEC_CTX];
-		spidx.sec_ctx.ctx_alg = ctx->sadb_x_ctx_alg;
-		spidx.sec_ctx.ctx_doi = ctx->sadb_x_ctx_doi;
-		spidx.sec_ctx.ctx_strlen = ctx->sadb_x_ctx_len;
-		memcpy(spidx.sec_ctx.ctx_str, ctx + 1, ctx->sadb_x_ctx_len);
-	}
-#endif /* HAVE_SECCTX */
-
-	sp = getsp(&spidx);
-	if (sp == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"no policy found: %s\n",
-			spidx2str(&spidx));
-		return -1;
-	}
-
-	remsp(sp);
-	delsp(sp);
-
-	return 0;
-}
-
-static int
-pk_recvspdexpire(mhp)
-	caddr_t *mhp;
-{
-	struct sadb_address *saddr, *daddr;
-	struct sadb_x_policy *xpl;
-	struct sadb_lifetime *lt;
-	struct policyindex spidx;
-	struct secpolicy *sp;
-	u_int64_t created;
-
-	/* sanity check */
-	if (mhp[0] == NULL
-	 || mhp[SADB_EXT_ADDRESS_SRC] == NULL
-	 || mhp[SADB_EXT_ADDRESS_DST] == NULL
-	 || mhp[SADB_X_EXT_POLICY] == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"inappropriate sadb spdexpire message passed.\n");
-		return -1;
-	}
-	saddr = (struct sadb_address *)mhp[SADB_EXT_ADDRESS_SRC];
-	daddr = (struct sadb_address *)mhp[SADB_EXT_ADDRESS_DST];
-	xpl = (struct sadb_x_policy *)mhp[SADB_X_EXT_POLICY];
-	lt = (struct sadb_lifetime*)mhp[SADB_EXT_LIFETIME_HARD];
-	if(lt != NULL)
-		created = lt->sadb_lifetime_addtime;
-	else
-		created = 0;
-
-#ifdef HAVE_PFKEY_POLICY_PRIORITY
-	KEY_SETSECSPIDX(xpl->sadb_x_policy_dir,
-			saddr + 1,
-			daddr + 1,
-			saddr->sadb_address_prefixlen,
-			daddr->sadb_address_prefixlen,
-			saddr->sadb_address_proto,
-			xpl->sadb_x_policy_priority,
-			created,
-			&spidx);
-#else
-	KEY_SETSECSPIDX(xpl->sadb_x_policy_dir,
-			saddr + 1,
-			daddr + 1,
-			saddr->sadb_address_prefixlen,
-			daddr->sadb_address_prefixlen,
-			saddr->sadb_address_proto,
-			created,
-			&spidx);
-#endif
-
-#ifdef HAVE_SECCTX
-	if (mhp[SADB_X_EXT_SEC_CTX] != NULL) {
-		struct sadb_x_sec_ctx *ctx;
-
-		ctx = (struct sadb_x_sec_ctx *)mhp[SADB_X_EXT_SEC_CTX];
-		spidx.sec_ctx.ctx_alg = ctx->sadb_x_ctx_alg;
-		spidx.sec_ctx.ctx_doi = ctx->sadb_x_ctx_doi;
-		spidx.sec_ctx.ctx_strlen = ctx->sadb_x_ctx_len;
-		memcpy(spidx.sec_ctx.ctx_str, ctx + 1, ctx->sadb_x_ctx_len);
-	}
-#endif /* HAVE_SECCTX */
-
-	sp = getsp(&spidx);
-	if (sp == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"no policy found: %s\n",
-			spidx2str(&spidx));
-		return -1;
-	}
-
-	remsp(sp);
-	delsp(sp);
-
-	return 0;
-}
-
-static int
-pk_recvspdget(mhp)
-	caddr_t *mhp;
-{
-	/* sanity check */
-	if (mhp[0] == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"inappropriate sadb spdget message passed.\n");
-		return -1;
-	}
-
-	return 0;
-}
-
-static int
-pk_recvspddump(mhp)
-	caddr_t *mhp;
-{
-	struct sadb_msg *msg;
-	struct sadb_address *saddr, *daddr;
-	struct sadb_x_policy *xpl;
-	struct sadb_lifetime *lt;
-	struct policyindex spidx;
-	struct secpolicy *sp;
-	u_int64_t created;
-
-	/* sanity check */
-	if (mhp[0] == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"inappropriate sadb spddump message passed.\n");
-		return -1;
-	}
-	msg = (struct sadb_msg *)mhp[0];
-
-	saddr = (struct sadb_address *)mhp[SADB_EXT_ADDRESS_SRC];
-	daddr = (struct sadb_address *)mhp[SADB_EXT_ADDRESS_DST];
-	xpl = (struct sadb_x_policy *)mhp[SADB_X_EXT_POLICY];
-	lt = (struct sadb_lifetime*)mhp[SADB_EXT_LIFETIME_HARD];
-	if(lt != NULL)
-		created = lt->sadb_lifetime_addtime;
-	else
-		created = 0;
-
-	if (saddr == NULL || daddr == NULL || xpl == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"inappropriate sadb spddump message passed.\n");
-		return -1;
-	}
-
-#ifdef HAVE_PFKEY_POLICY_PRIORITY
-	KEY_SETSECSPIDX(xpl->sadb_x_policy_dir,
-			saddr + 1,
-			daddr + 1,
-			saddr->sadb_address_prefixlen,
-			daddr->sadb_address_prefixlen,
-			saddr->sadb_address_proto,
-			xpl->sadb_x_policy_priority,
-			created,
-			&spidx);
-#else
-	KEY_SETSECSPIDX(xpl->sadb_x_policy_dir,
-			saddr + 1,
-			daddr + 1,
-			saddr->sadb_address_prefixlen,
-			daddr->sadb_address_prefixlen,
-			saddr->sadb_address_proto,
-			created,
-			&spidx);
-#endif
-
-#ifdef HAVE_SECCTX
-	if (mhp[SADB_X_EXT_SEC_CTX] != NULL) {
-		struct sadb_x_sec_ctx *ctx;
-
-		ctx = (struct sadb_x_sec_ctx *)mhp[SADB_X_EXT_SEC_CTX];
-		spidx.sec_ctx.ctx_alg = ctx->sadb_x_ctx_alg;
-		spidx.sec_ctx.ctx_doi = ctx->sadb_x_ctx_doi;
-		spidx.sec_ctx.ctx_strlen = ctx->sadb_x_ctx_len;
-		memcpy(spidx.sec_ctx.ctx_str, ctx + 1, ctx->sadb_x_ctx_len);
-	}
-#endif /* HAVE_SECCTX */
-
-	sp = getsp(&spidx);
-	if (sp != NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"such policy already exists. "
-			"anyway replace it: %s\n",
-			spidx2str(&spidx));
-		remsp(sp);
-		delsp(sp);
-	}
-
-	if (addnewsp(mhp) < 0)
-		return -1;
-
-	return 0;
-}
-
-static int
-pk_recvspdflush(mhp)
-	caddr_t *mhp;
-{
-	/* sanity check */
-	if (mhp[0] == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"inappropriate sadb spdflush message passed.\n");
-		return -1;
-	}
-
-	flushsp();
-
-	return 0;
-}
-
-#ifndef ANDROID_PATCHED
-
-/*
- * send error against acquire message to kenrel.
- */
-int
-pk_sendeacquire(iph2)
-	struct ph2handle *iph2;
-{
-	struct sadb_msg *newmsg;
-	int len;
-
-	len = sizeof(struct sadb_msg);
-	newmsg = racoon_calloc(1, len);
-	if (newmsg == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get buffer to send acquire.\n");
-		return -1;
-	}
-
-	memset(newmsg, 0, len);
-	newmsg->sadb_msg_version = PF_KEY_V2;
-	newmsg->sadb_msg_type = SADB_ACQUIRE;
-	newmsg->sadb_msg_errno = ENOENT;	/* XXX */
-	newmsg->sadb_msg_satype = iph2->satype;
-	newmsg->sadb_msg_len = PFKEY_UNIT64(len);
-	newmsg->sadb_msg_reserved = 0;
-	newmsg->sadb_msg_seq = iph2->seq;
-	newmsg->sadb_msg_pid = (u_int32_t)getpid();
-
-	/* send message */
-	len = pfkey_send(lcconf->sock_pfkey, newmsg, len);
-
-	racoon_free(newmsg);
-
-	return 0;
-}
-
-#else
-
-int pk_sendeacquire(struct ph2handle *iph2)
-{
-	exit(1);
-}
-
-#endif
-
-/*
- * check if the algorithm is supported or not.
- * OUT	 0: ok
- *	-1: ng
- */
-int
-pk_checkalg(class, calg, keylen)
-	int class, calg, keylen;
-{
-	int sup, error;
-	u_int alg;
-	struct sadb_alg alg0;
-
-	switch (algclass2doi(class)) {
-	case IPSECDOI_PROTO_IPSEC_ESP:
-		sup = SADB_EXT_SUPPORTED_ENCRYPT;
-		break;
-	case IPSECDOI_ATTR_AUTH:
-		sup = SADB_EXT_SUPPORTED_AUTH;
-		break;
-	case IPSECDOI_PROTO_IPCOMP:
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"compression algorithm can not be checked "
-			"because sadb message doesn't support it.\n");
-		return 0;
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid algorithm class.\n");
-		return -1;
-	}
-	alg = ipsecdoi2pfkey_alg(algclass2doi(class), algtype2doi(class, calg));
-	if (alg == ~0)
-		return -1;
-
-	if (keylen == 0) {
-		if (ipsec_get_keylen(sup, alg, &alg0)) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"%s.\n", ipsec_strerror());
-			return -1;
-		}
-		keylen = alg0.sadb_alg_minbits;
-	}
-
-	error = ipsec_check_keylen(sup, alg, keylen);
-	if (error)
-		plog(LLV_ERROR, LOCATION, NULL,
-			"%s.\n", ipsec_strerror());
-
-	return error;
-}
-
-/*
- * differences with pfkey_recv() in libipsec/pfkey.c:
- * - never performs busy wait loop.
- * - returns NULL and set *lenp to negative on fatal failures
- * - returns NULL and set *lenp to non-negative on non-fatal failures
- * - returns non-NULL on success
- */
-static struct sadb_msg *
-pk_recv(so, lenp)
-	int so;
-	int *lenp;
-{
-	struct sadb_msg buf, *newmsg;
-	int reallen;
-	int retry = 0;
-
-	*lenp = -1;
-	do
-	{
-	    plog(LLV_DEBUG, LOCATION, NULL, "pk_recv: retry[%d] recv() \n", retry );
-	    *lenp = recv(so, (caddr_t)&buf, sizeof(buf), MSG_PEEK | MSG_DONTWAIT);
-	    retry++;
-	}
-	while (*lenp < 0 && errno == EAGAIN && retry < 3);
-
-	if (*lenp < 0)
-		return NULL;	/*fatal*/
-
-	else if (*lenp < sizeof(buf))
-		return NULL;
-
-	reallen = PFKEY_UNUNIT64(buf.sadb_msg_len);
-	if ((newmsg = racoon_calloc(1, reallen)) == NULL)
-		return NULL;
-
-	*lenp = recv(so, (caddr_t)newmsg, reallen, MSG_PEEK);
-	if (*lenp < 0) {
-		racoon_free(newmsg);
-		return NULL;	/*fatal*/
-	} else if (*lenp != reallen) {
-		racoon_free(newmsg);
-		return NULL;
-	}
-
-	*lenp = recv(so, (caddr_t)newmsg, reallen, 0);
-	if (*lenp < 0) {
-		racoon_free(newmsg);
-		return NULL;	/*fatal*/
-	} else if (*lenp != reallen) {
-		racoon_free(newmsg);
-		return NULL;
-	}
-
-	return newmsg;
-}
-
-/* see handler.h */
-u_int32_t
-pk_getseq()
-{
-	return eay_random();
-}
-
-static int
-addnewsp(mhp)
-	caddr_t *mhp;
-{
-	struct secpolicy *new = NULL;
-	struct sadb_address *saddr, *daddr;
-	struct sadb_x_policy *xpl;
-	struct sadb_lifetime *lt;
-	u_int64_t created;
-
-	/* sanity check */
-	if (mhp[SADB_EXT_ADDRESS_SRC] == NULL
-	 || mhp[SADB_EXT_ADDRESS_DST] == NULL
-	 || mhp[SADB_X_EXT_POLICY] == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"inappropriate sadb spd management message passed.\n");
-		goto bad;
-	}
-
-	saddr = (struct sadb_address *)mhp[SADB_EXT_ADDRESS_SRC];
-	daddr = (struct sadb_address *)mhp[SADB_EXT_ADDRESS_DST];
-	xpl = (struct sadb_x_policy *)mhp[SADB_X_EXT_POLICY];
-	lt = (struct sadb_lifetime*)mhp[SADB_EXT_LIFETIME_HARD];
-	if(lt != NULL)
-		created = lt->sadb_lifetime_addtime;
-	else
-		created = 0;
-	lt = (struct sadb_lifetime*)mhp[SADB_EXT_LIFETIME_HARD];
-	if(lt != NULL)
-		created = lt->sadb_lifetime_addtime;
-	else
-		created = 0;
-
-#ifdef __linux__
-	/* bsd skips over per-socket policies because there will be no
-	 * src and dst extensions in spddump messages. On Linux the only
-	 * way to achieve the same is check for policy id.
-	 */
-	if (xpl->sadb_x_policy_id % 8 >= 3) return 0;
-#endif
-
-	new = newsp();
-	if (new == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to allocate buffer\n");
-		goto bad;
-	}
-
-	new->spidx.dir = xpl->sadb_x_policy_dir;
-	new->id = xpl->sadb_x_policy_id;
-	new->policy = xpl->sadb_x_policy_type;
-	new->req = NULL;
-
-	/* check policy */
-	switch (xpl->sadb_x_policy_type) {
-	case IPSEC_POLICY_DISCARD:
-	case IPSEC_POLICY_NONE:
-	case IPSEC_POLICY_ENTRUST:
-	case IPSEC_POLICY_BYPASS:
-		break;
-
-	case IPSEC_POLICY_IPSEC:
-	    {
-		int tlen;
-		struct sadb_x_ipsecrequest *xisr;
-		struct ipsecrequest **p_isr = &new->req;
-
-		/* validity check */
-		if (PFKEY_EXTLEN(xpl) < sizeof(*xpl)) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid msg length.\n");
-			goto bad;
-		}
-
-		tlen = PFKEY_EXTLEN(xpl) - sizeof(*xpl);
-		xisr = (struct sadb_x_ipsecrequest *)(xpl + 1);
-
-		while (tlen > 0) {
-
-			/* length check */
-			if (xisr->sadb_x_ipsecrequest_len < sizeof(*xisr)) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"invalid msg length.\n");
-				goto bad;
-			}
-
-			/* allocate request buffer */
-			*p_isr = newipsecreq();
-			if (*p_isr == NULL) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"failed to get new ipsecreq.\n");
-				goto bad;
-			}
-
-			/* set values */
-			(*p_isr)->next = NULL;
-
-			switch (xisr->sadb_x_ipsecrequest_proto) {
-			case IPPROTO_ESP:
-			case IPPROTO_AH:
-			case IPPROTO_IPCOMP:
-				break;
-			default:
-				plog(LLV_ERROR, LOCATION, NULL,
-					"invalid proto type: %u\n",
-					xisr->sadb_x_ipsecrequest_proto);
-				goto bad;
-			}
-			(*p_isr)->saidx.proto = xisr->sadb_x_ipsecrequest_proto;
-
-			switch (xisr->sadb_x_ipsecrequest_mode) {
-			case IPSEC_MODE_TRANSPORT:
-			case IPSEC_MODE_TUNNEL:
-				break;
-			case IPSEC_MODE_ANY:
-			default:
-				plog(LLV_ERROR, LOCATION, NULL,
-					"invalid mode: %u\n",
-					xisr->sadb_x_ipsecrequest_mode);
-				goto bad;
-			}
-			(*p_isr)->saidx.mode = xisr->sadb_x_ipsecrequest_mode;
-
-			switch (xisr->sadb_x_ipsecrequest_level) {
-			case IPSEC_LEVEL_DEFAULT:
-			case IPSEC_LEVEL_USE:
-			case IPSEC_LEVEL_REQUIRE:
-				break;
-			case IPSEC_LEVEL_UNIQUE:
-				(*p_isr)->saidx.reqid =
-					xisr->sadb_x_ipsecrequest_reqid;
-				break;
-
-			default:
-				plog(LLV_ERROR, LOCATION, NULL,
-					"invalid level: %u\n",
-					xisr->sadb_x_ipsecrequest_level);
-				goto bad;
-			}
-			(*p_isr)->level = xisr->sadb_x_ipsecrequest_level;
-
-			/* set IP addresses if there */
-			if (xisr->sadb_x_ipsecrequest_len > sizeof(*xisr)) {
-				struct sockaddr *paddr;
-
-				paddr = (struct sockaddr *)(xisr + 1);
-				bcopy(paddr, &(*p_isr)->saidx.src,
-					sysdep_sa_len(paddr));
-
-				paddr = (struct sockaddr *)((caddr_t)paddr
-							+ sysdep_sa_len(paddr));
-				bcopy(paddr, &(*p_isr)->saidx.dst,
-					sysdep_sa_len(paddr));
-			}
-
-			(*p_isr)->sp = new;
-
-			/* initialization for the next. */
-			p_isr = &(*p_isr)->next;
-			tlen -= xisr->sadb_x_ipsecrequest_len;
-
-			/* validity check */
-			if (tlen < 0) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"becoming tlen < 0\n");
-			}
-
-			xisr = (struct sadb_x_ipsecrequest *)((caddr_t)xisr
-			                 + xisr->sadb_x_ipsecrequest_len);
-		}
-	    }
-		break;
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid policy type.\n");
-		goto bad;
-	}
-
-#ifdef HAVE_PFKEY_POLICY_PRIORITY
-	KEY_SETSECSPIDX(xpl->sadb_x_policy_dir,
-			saddr + 1,
-			daddr + 1,
-			saddr->sadb_address_prefixlen,
-			daddr->sadb_address_prefixlen,
-			saddr->sadb_address_proto,
-			xpl->sadb_x_policy_priority,
-			created,
-			&new->spidx);
-#else
-	KEY_SETSECSPIDX(xpl->sadb_x_policy_dir,
-			saddr + 1,
-			daddr + 1,
-			saddr->sadb_address_prefixlen,
-			daddr->sadb_address_prefixlen,
-			saddr->sadb_address_proto,
-			created,
-			&new->spidx);
-#endif
-
-#ifdef HAVE_SECCTX
-	if (mhp[SADB_X_EXT_SEC_CTX] != NULL) {
-		struct sadb_x_sec_ctx *ctx;
-
-		ctx = (struct sadb_x_sec_ctx *)mhp[SADB_X_EXT_SEC_CTX];
-		new->spidx.sec_ctx.ctx_alg = ctx->sadb_x_ctx_alg;
-		new->spidx.sec_ctx.ctx_doi = ctx->sadb_x_ctx_doi;
-		new->spidx.sec_ctx.ctx_strlen = ctx->sadb_x_ctx_len;
-		memcpy(new->spidx.sec_ctx.ctx_str,ctx + 1,ctx->sadb_x_ctx_len);
-	}
-#endif /* HAVE_SECCTX */
-
-	inssp(new);
-
-	return 0;
-bad:
-	if (new != NULL) {
-		if (new->req != NULL)
-			racoon_free(new->req);
-		racoon_free(new);
-	}
-	return -1;
-}
-
-/* proto/mode/src->dst spi */
-const char *
-sadbsecas2str(src, dst, proto, spi, mode)
-	struct sockaddr *src, *dst;
-	int proto;
-	u_int32_t spi;
-	int mode;
-{
-	static char buf[256];
-	u_int doi_proto, doi_mode = 0;
-	char *p;
-	int blen, i;
-
-	doi_proto = pfkey2ipsecdoi_proto(proto);
-	if (doi_proto == ~0)
-		return NULL;
-	if (mode) {
-		doi_mode = pfkey2ipsecdoi_mode(mode);
-		if (doi_mode == ~0)
-			return NULL;
-	}
-
-	blen = sizeof(buf) - 1;
-	p = buf;
-
-	i = snprintf(p, blen, "%s%s%s ",
-		s_ipsecdoi_proto(doi_proto),
-		mode ? "/" : "",
-		mode ? s_ipsecdoi_encmode(doi_mode) : "");
-	if (i < 0 || i >= blen)
-		return NULL;
-	p += i;
-	blen -= i;
-
-	i = snprintf(p, blen, "%s->", saddr2str(src));
-	if (i < 0 || i >= blen)
-		return NULL;
-	p += i;
-	blen -= i;
-
-	i = snprintf(p, blen, "%s ", saddr2str(dst));
-	if (i < 0 || i >= blen)
-		return NULL;
-	p += i;
-	blen -= i;
-
-	if (spi) {
-		snprintf(p, blen, "spi=%lu(0x%lx)", (unsigned long)ntohl(spi),
-		    (unsigned long)ntohl(spi));
-	}
-
-	return buf;
-}
diff --git a/src/racoon/pfkey.h b/src/racoon/pfkey.h
deleted file mode 100644
index 547f94a..0000000
--- a/src/racoon/pfkey.h
+++ /dev/null
@@ -1,77 +0,0 @@
-/*	$NetBSD: pfkey.h,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
-
-/* Id: pfkey.h,v 1.3 2004/06/11 16:00:17 ludvigm Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _PFKEY_H
-#define _PFKEY_H
-
-struct pfkey_satype {
-	u_int8_t	ps_satype;
-	const char	*ps_name;
-};
-
-extern const struct pfkey_satype pfkey_satypes[];
-extern const int pfkey_nsatypes;
-
-extern int pfkey_handler __P((void));
-extern vchar_t *pfkey_dump_sadb __P((int));
-extern void pfkey_flush_sadb __P((u_int));
-extern int pfkey_init __P((void));
-
-extern struct pfkey_st *pfkey_getpst __P((caddr_t *, int, int));
-
-extern int pk_checkalg __P((int, int, int));
-
-struct ph2handle;
-extern int pk_sendgetspi __P((struct ph2handle *));
-extern int pk_sendupdate __P((struct ph2handle *));
-extern int pk_sendadd __P((struct ph2handle *));
-extern int pk_sendeacquire __P((struct ph2handle *));
-extern int pk_sendspdupdate2 __P((struct ph2handle *));
-extern int pk_sendspdadd2 __P((struct ph2handle *));
-extern int pk_sendspddelete __P((struct ph2handle *));
-
-extern void pfkey_timeover_stub __P((void *));
-extern void pfkey_timeover __P((struct ph2handle *));
-
-extern u_int pfkey2ipsecdoi_proto __P((u_int));
-extern u_int ipsecdoi2pfkey_proto __P((u_int));
-extern u_int pfkey2ipsecdoi_mode __P((u_int));
-extern u_int ipsecdoi2pfkey_mode __P((u_int));
-
-extern int pfkey_convertfromipsecdoi __P(( u_int, u_int, u_int,
-	u_int *, u_int *, u_int *, u_int *, u_int *));
-extern u_int32_t pk_getseq __P((void));
-extern const char *sadbsecas2str
-	__P((struct sockaddr *, struct sockaddr *, int, u_int32_t, int));
-
-#endif /* _PFKEY_H */
diff --git a/src/racoon/plainrsa-gen.8 b/src/racoon/plainrsa-gen.8
deleted file mode 100644
index 377de2d..0000000
--- a/src/racoon/plainrsa-gen.8
+++ /dev/null
@@ -1,138 +0,0 @@
-.\"	$NetBSD: plainrsa-gen.8,v 1.13 2006/09/19 18:54:39 wiz Exp $
-.\"
-.\" Id: plainrsa-gen.8,v 1.4 2005/04/18 11:07:55 manubsd Exp
-.\"
-.\" Copyright (C) 2004 SuSE Linux AG, Nuernberg, Germany.
-.\" Contributed by: Michal Ludvig <mludvig@suse.cz>, SUSE Labs
-.\" All rights reserved.
-.\"
-.\" Redistribution and use in source and binary forms, with or without
-.\" modification, are permitted provided that the following conditions
-.\" are met:
-.\" 1. Redistributions of source code must retain the above copyright
-.\"    notice, this list of conditions and the following disclaimer.
-.\" 2. Redistributions in binary form must reproduce the above copyright
-.\"    notice, this list of conditions and the following disclaimer in the
-.\"    documentation and/or other materials provided with the distribution.
-.\" 3. Neither the name of the project nor the names of its contributors
-.\"    may be used to endorse or promote products derived from this software
-.\"    without specific prior written permission.
-.\"
-.\" THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
-.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
-.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-.\" SUCH DAMAGE.
-.\"
-.Dd June 14, 2004
-.Dt PLAINRSA-GEN 8
-.Os
-.\"
-.Sh NAME
-.Nm plainrsa-gen
-.Nd generator for Plain RSA keys
-.\"
-.Sh SYNOPSIS
-.Nm plainrsa-gen
-.Bk -words
-.Op Fl b Ar bits
-.Op Fl e Ar pubexp
-.Op Fl f Ar outfile
-.Op Fl h
-.Ek
-.\"
-.Sh DESCRIPTION
-.Nm
-can be used to generate
-.Li Plain RSA keys
-for authentication purposes.
-Using
-.Li Plain RSA keys
-is optional.
-Other possibilities are
-.Li Pre-shared keys
-or
-.Li X.509 certificates .
-.\"
-.Bl -tag -width Ds
-.It Fl b Ar bits
-bit length of the key.
-Default is
-.Li 1024 ,
-recommended length is
-.Li 2048
-or even
-.Li 4096
-bits.
-Note that generating longer keys takes longer time.
-.It Fl e Ar pubexp
-value of RSA public exponent.
-Default is
-.Li 0x3 .
-Don't change this unless you really know what you are doing!
-.It Fl f Ar outfile
-.Ar outfile
-instead of
-.Li stdout .
-If the file already exists it won't be overwritten.
-You wouldn't like to lose your private key by accident, would you?
-.El
-.\"
-.Sh OUTPUT FILE FORMAT
-This is the secret
-.Li private key
-that should
-.Ic never
-leave your computer:
-.Bd -literal
-: RSA	{
-	# RSA 1024 bits
-	# pubkey=0sAQOrWlcwbAIdNSMhDt...
-	Modulus: 0xab5a57306c021d3523...
-	PublicExponent: 0x03
-	PrivateExponent: 0x723c3a2048...
-	Prime1: 0xd309b30e6adf9d85c01...
-	Prime2: 0xcfdc2a8aa5b2b3c90e3...
-	Exponent1: 0x8cb122099c9513ae...
-	Exponent2: 0x8a92c7071921cd30...
-	Coefficient: 0x722751305eafe9...
-  }
-.Ed
-.Pp
-The line
-.Li pubkey=0sAQOrW...
-of the
-.Li private key
-contains a
-.Li public key
-that should be stored in the other peer's configuration in this format:
-.Bd -literal
-: PUB 0sAQOrWlcwbAIdNSMhDt...
-.Ed
-.\"
-.Pp
-You can also specify
-.Li from
-and
-.Li to
-addresses for which the key is valid:
-.Bd -literal
-0.0.0.0/0 10.20.30.0/24 : PUB 0sAQOrWlcwbAIdNSMhDt...
-.Ed
-.\"
-.Sh SEE ALSO
-.Xr racoon.conf 5 ,
-.Xr racoon 8
-.\"
-.Sh HISTORY
-.Nm
-was written by
-.An Michal Ludvig Aq michal@logix.cz
-and first appeared in
-.Ic ipsec-tools 0.4 .
diff --git a/src/racoon/plainrsa-gen.c b/src/racoon/plainrsa-gen.c
deleted file mode 100644
index 1bd5f67..0000000
--- a/src/racoon/plainrsa-gen.c
+++ /dev/null
@@ -1,208 +0,0 @@
-/*	$NetBSD: plainrsa-gen.c,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
-
-/* Id: plainrsa-gen.c,v 1.6 2005/04/21 09:08:40 monas Exp */
-/*
- * Copyright (C) 2004 SuSE Linux AG, Nuernberg, Germany.
- * Contributed by: Michal Ludvig <mludvig@suse.cz>, SUSE Labs
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-/* This file contains a generator for FreeS/WAN-style ipsec.secrets RSA keys. */
-
-#include "config.h"
-
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <sys/socket.h>
-#include <unistd.h>
-
-#include <openssl/bio.h>
-#include <openssl/bn.h>
-#include <openssl/err.h>
-#include <openssl/objects.h>
-#include <openssl/rsa.h>
-#include <openssl/evp.h>
-#ifdef HAVE_OPENSSL_ENGINE_H
-#include <openssl/engine.h>
-#endif
-
-#include "misc.h"
-#include "vmbuf.h"
-#include "plog.h"
-#include "crypto_openssl.h"
-
-#include "package_version.h"
-
-void
-usage (char *argv0)
-{
-	fprintf(stderr, "Plain RSA key generator, part of %s\n", TOP_PACKAGE_STRING);
-	fprintf(stderr, "By Michal Ludvig (http://www.logix.cz/michal)\n");
-	fprintf(stderr, "\n");
-	fprintf(stderr, "Usage: %s [options]\n", argv0);
-	fprintf(stderr, "\n");
-	fprintf(stderr, "  -b bits       Generate <bits> long RSA key (default=1024)\n");
-	fprintf(stderr, "  -e pubexp     Public exponent to use (default=0x3)\n");
-	fprintf(stderr, "  -f filename   Filename to store the key to (default=stdout)\n");
-	fprintf(stderr, "  -h            Help\n");
-	fprintf(stderr, "\n");
-	fprintf(stderr, "Report bugs to <ipsec-tools-devel@lists.sourceforge.net>\n");
-	exit(1);
-}
-
-/*
- * See RFC 2065, section 3.5 for details about the output format.
- */
-vchar_t *
-mix_b64_pubkey(RSA *key)
-{
-	char *binbuf;
-	long binlen, ret;
-	vchar_t *res;
-	
-	binlen = 1 + BN_num_bytes(key->e) + BN_num_bytes(key->n);
-	binbuf = malloc(binlen);
-	memset(binbuf, 0, binlen);
-	binbuf[0] = BN_bn2bin(key->e, (unsigned char *) &binbuf[1]);
-	ret = BN_bn2bin(key->n, (unsigned char *) (&binbuf[binbuf[0] + 1]));
-	if (1 + binbuf[0] + ret != binlen) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		     "Pubkey generation failed. This is really strange...\n");
-		return NULL;
-	}
-
-	return base64_encode(binbuf, binlen);
-}
-
-char *
-lowercase(char *input)
-{
-	char *ptr = input;
-	while (*ptr) {
-		if (*ptr >= 'A' && *ptr <= 'F')
-			*ptr -= 'A' - 'a';
-		*ptr++;
-	}
-
-	return input;
-}
-
-int
-gen_rsa_key(FILE *fp, size_t bits, unsigned long exp)
-{
-	RSA *key;
-	vchar_t *pubkey64 = NULL;
-
-	key = RSA_generate_key(bits, exp, NULL, NULL);
-	if (!key) {
-		fprintf(stderr, "RSA_generate_key(): %s\n", eay_strerror());
-		return -1;
-	}
-	
-	pubkey64 = mix_b64_pubkey(key);
-	if (!pubkey64) {
-		fprintf(stderr, "mix_b64_pubkey(): %s\n", eay_strerror());
-		return -1;
-	}
-	
-	fprintf(fp, "# : PUB 0s%s\n", pubkey64->v);
-	fprintf(fp, ": RSA\t{\n");
-	fprintf(fp, "\t# RSA %zu bits\n", bits);
-	fprintf(fp, "\t# pubkey=0s%s\n", pubkey64->v);
-	fprintf(fp, "\tModulus: 0x%s\n", lowercase(BN_bn2hex(key->n)));
-	fprintf(fp, "\tPublicExponent: 0x%s\n", lowercase(BN_bn2hex(key->e)));
-	fprintf(fp, "\tPrivateExponent: 0x%s\n", lowercase(BN_bn2hex(key->d)));
-	fprintf(fp, "\tPrime1: 0x%s\n", lowercase(BN_bn2hex(key->p)));
-	fprintf(fp, "\tPrime2: 0x%s\n", lowercase(BN_bn2hex(key->q)));
-	fprintf(fp, "\tExponent1: 0x%s\n", lowercase(BN_bn2hex(key->dmp1)));
-	fprintf(fp, "\tExponent2: 0x%s\n", lowercase(BN_bn2hex(key->dmq1)));
-	fprintf(fp, "\tCoefficient: 0x%s\n", lowercase(BN_bn2hex(key->iqmp)));
-	fprintf(fp, "  }\n");
-
-	vfree(pubkey64);
-
-	return 0;
-}
-
-int
-main (int argc, char *argv[])
-{
-	FILE *fp = stdout;
-	size_t bits = 1024;
-	unsigned int pubexp = 0x3;
-	struct stat st;
-	extern char *optarg;
-	extern int optind;
-	int c;
-	char *fname = NULL;
-
-	while ((c = getopt(argc, argv, "e:b:f:h")) != -1)
-		switch (c) {
-			case 'e':
-				if (strncmp(optarg, "0x", 2) == 0)
-					sscanf(optarg, "0x%x", &pubexp);
-				else
-					pubexp = atoi(optarg);
-				break;
-			case 'b':
-				bits = atoi(optarg);
-				break;
-			case 'f':
-				fname = optarg;
-				break;
-			case 'h':
-			default:
-				usage(argv[0]);
-		}
-
-	if (fname) {
-		if (stat(fname, &st) >= 0) {
-			fprintf(stderr, "%s: file exists! Please use a different name.\n", fname);
-			exit(1);
-		}
-
-		umask(0077);
-		fp = fopen(fname, "w");
-		if (fp == NULL) {
-			fprintf(stderr, "%s: %s\n", fname, strerror(errno));
-			exit(1);
-		}
-	}
-
-	ploginit();
-	eay_init();
-
-	gen_rsa_key(fp, bits, pubexp);
-
-	fclose(fp);
-
-	return 0;
-}
diff --git a/src/racoon/plog.c b/src/racoon/plog.c
deleted file mode 100644
index 008260d..0000000
--- a/src/racoon/plog.c
+++ /dev/null
@@ -1,268 +0,0 @@
-/*	$NetBSD: plog.c,v 1.4.6.2 2009/04/20 13:35:36 tteras Exp $	*/
-
-/* Id: plog.c,v 1.11 2006/06/20 09:57:31 vanhu Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-#ifdef HAVE_STDARG_H
-#include <stdarg.h>
-#else
-#include <varargs.h>
-#endif
-#if TIME_WITH_SYS_TIME
-# include <sys/time.h>
-# include <time.h>
-#else
-# if HAVE_SYS_TIME_H
-#  include <sys/time.h>
-# else
-#  include <time.h>
-# endif
-#endif
-#include <ctype.h>
-#include <err.h>
-
-#include "var.h"
-#include "misc.h"
-#include "plog.h"
-#include "logger.h"
-#include "debug.h"
-#include "gcmalloc.h"
-
-#ifndef VA_COPY
-# define VA_COPY(dst,src) memcpy(&(dst), &(src), sizeof(va_list))
-#endif
-
-char *pname = NULL;
-u_int32_t loglevel = LLV_BASE;
-int f_foreground = 0;
-
-int print_location = 0;
-
-static struct log *logp = NULL;
-static char *logfile = NULL;
-
-static char *plog_common __P((int, const char *, const char *));
-
-static struct plogtags {
-	char *name;
-	int priority;
-} ptab[] = {
-	{ "(not defined)",	0, },
-	{ "ERROR",		LOG_INFO, },
-	{ "WARNING",		LOG_INFO, },
-	{ "NOTIFY",		LOG_INFO, },
-	{ "INFO",		LOG_INFO, },
-	{ "DEBUG",		LOG_DEBUG, },
-	{ "DEBUG2",		LOG_DEBUG, },
-};
-
-static char *
-plog_common(pri, fmt, func)
-	int pri;
-	const char *fmt, *func;
-{
-	static char buf[800];	/* XXX shoule be allocated every time ? */
-	char *p;
-	int reslen, len;
-
-	p = buf;
-	reslen = sizeof(buf);
-
-	if (logfile || f_foreground) {
-		time_t t;
-		struct tm *tm;
-
-		t = time(0);
-		tm = localtime(&t);
-		len = strftime(p, reslen, "%Y-%m-%d %T: ", tm);
-		p += len;
-		reslen -= len;
-	}
-
-	if (pri < ARRAYLEN(ptab)) {
-		len = snprintf(p, reslen, "%s: ", ptab[pri].name);
-		if (len >= 0 && len < reslen) {
-			p += len;
-			reslen -= len;
-		} else
-			*p = '\0';
-	}
-
-	if (print_location)
-		snprintf(p, reslen, "%s: %s", func, fmt);
-	else
-		snprintf(p, reslen, "%s", fmt);
-#ifdef BROKEN_PRINTF
-	while ((p = strstr(buf,"%z")) != NULL)
-		p[1] = 'l';
-#endif
-
-	return buf;
-}
-
-void
-_plog(int pri, const char *func, struct sockaddr *sa, const char *fmt, ...)
-{
-	va_list ap;
-
-	va_start(ap, fmt);
-	plogv(pri, func, sa, fmt, ap);
-	va_end(ap);
-}
-
-void
-plogv(int pri, const char *func, struct sockaddr *sa,
-	const char *fmt, va_list ap)
-{
-	char *newfmt;
-	va_list ap_bak;
-
-	if (pri > loglevel)
-		return;
-
-	newfmt = plog_common(pri, fmt, func);
-
-	VA_COPY(ap_bak, ap);
-	
-	if (f_foreground)
-		vprintf(newfmt, ap);
-
-	if (logfile)
-		log_vaprint(logp, newfmt, ap_bak);
-	else {
-		if (pri < ARRAYLEN(ptab))
-			vsyslog(ptab[pri].priority, newfmt, ap_bak);
-		else
-			vsyslog(LOG_ALERT, newfmt, ap_bak);
-	}
-}
-
-void
-plogdump(pri, data, len)
-	int pri;
-	void *data;
-	size_t len;
-{
-	caddr_t buf;
-	size_t buflen;
-	int i, j;
-
-	if (pri > loglevel)
-		return;
-
-	/*
-	 * 2 words a bytes + 1 space 4 bytes + 1 newline 32 bytes
-	 * + 2 newline + '\0'
-	 */
-	buflen = (len * 2) + (len / 4) + (len / 32) + 3;
-	buf = racoon_malloc(buflen);
-
-	i = 0;
-	j = 0;
-	while (j < len) {
-		if (j % 32 == 0)
-			buf[i++] = '\n';
-		else
-		if (j % 4 == 0)
-			buf[i++] = ' ';
-		snprintf(&buf[i], buflen - i, "%02x",
-			((unsigned char *)data)[j] & 0xff);
-		i += 2;
-		j++;
-	}
-	if (buflen - i >= 2) {
-		buf[i++] = '\n';
-		buf[i] = '\0';
-	}
-	plog(pri, LOCATION, NULL, "%s", buf);
-
-	racoon_free(buf);
-}
-
-void
-ploginit()
-{
-	if (logfile) {
-		logp = log_open(250, logfile);
-		if (logp == NULL)
-			errx(1, "ERROR: failed to open log file %s.", logfile);
-		return;
-	}
-
-        openlog(pname, LOG_NDELAY, LOG_DAEMON);
-}
-
-void
-plogset(file)
-	char *file;
-{
-	if (logfile != NULL)
-		racoon_free(logfile);
-	logfile = racoon_strdup(file);
-	STRDUP_FATAL(logfile);
-}
-
-/*
-   Returns a printable string from (possibly) binary data ;
-   concatenates all unprintable chars to one space.
-   XXX Maybe the printable chars range is too large...
- */
-char*
-binsanitize(binstr, n)
-	char *binstr;
-	size_t n;
-{
-	int p,q;
-	char* d;
-
-	d = racoon_malloc(n + 1);
-	for (p = 0, q = 0; p < n; p++) {
-		if (isgraph((int)binstr[p])) {
-			d[q++] = binstr[p];
-		} else {
-			if (q && d[q - 1] != ' ')
-				d[q++] = ' ';
-		}
-	}
-	d[q++] = '\0';
-
-	return d;
-}
-	
diff --git a/src/racoon/plog.h b/src/racoon/plog.h
deleted file mode 100644
index b8cb027..0000000
--- a/src/racoon/plog.h
+++ /dev/null
@@ -1,110 +0,0 @@
-/*	$NetBSD: plog.h,v 1.4.6.1 2007/11/06 16:41:27 vanhu Exp $	*/
-
-/* Id: plog.h,v 1.7 2006/06/20 09:57:31 vanhu Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _PLOG_H
-#define _PLOG_H
-
-#ifdef ANDROID_PATCHED
-
-#define LLV_ERROR   0
-#define LLV_WARNING 1
-#define LLV_NOTIFY  2
-#define LLV_INFO    3
-#define LLV_DEBUG   4
-#define LLV_DEBUG2  5
-
-#define loglevel LLV_DEBUG2
-
-#define plog(level, location, address, ...)                 \
-    do {                                                    \
-        if ((level) >= LLV_ERROR && (level) <= LLV_INFO) {  \
-            do_plog((level), __VA_ARGS__);                  \
-        }                                                   \
-    } while (0)
-
-#define plogdump(...)
-
-extern void do_plog(int level, char *format, ...);
-extern char *binsanitize(char *binary, size_t size);
-extern char *pname;
-
-#else
-
-#ifdef HAVE_STDARG_H
-#include <stdarg.h>
-#else
-#include <varargs.h>
-#endif
-#include <syslog.h>
-
-/*
- * INFO: begin negotiation, SA establishment/deletion/expiration.
- * NOTIFY: just notifiable.
- * WARNING: not error strictly.
- * ERROR: system call error. also invalid parameter/format.
- * DEBUG1: debugging informatioin.
- * DEBUG2: too more verbose. e.g. parsing config.
- */
-#define LLV_ERROR	1
-#define LLV_WARNING	2
-#define LLV_NOTIFY	3
-#define LLV_INFO	4
-#define LLV_DEBUG	5
-#define LLV_DEBUG2	6
- 
-#define LLV_BASE	LLV_INFO /* by default log less than this value. */
-
-extern char *pname;
-extern u_int32_t loglevel;
-extern int f_foreground;
-extern int print_location;
-
-struct sockaddr;
-#define plog(pri, ...) \
-	do { \
-		if ((pri) <= loglevel) \
-			_plog((pri), __VA_ARGS__); \
-	} while (0)
-extern void _plog __P((int, const char *, struct sockaddr *, const char *, ...))
-	__attribute__ ((__format__ (__printf__, 4, 5)));
-extern void plogv __P((int, const char *, struct sockaddr *,
-	const char *, va_list));
-extern void plogdump __P((int, void *, size_t));
-extern void ploginit __P((void));
-extern void plogset __P((char *));
-
-extern char* binsanitize __P((char*, size_t));
-
-#endif
-
-#endif /* _PLOG_H */
diff --git a/src/racoon/policy.c b/src/racoon/policy.c
deleted file mode 100644
index 29a6818..0000000
--- a/src/racoon/policy.c
+++ /dev/null
@@ -1,488 +0,0 @@
-/*	$NetBSD: policy.c,v 1.6.4.1 2007/08/01 11:52:21 vanhu Exp $	*/
-
-/*	$KAME: policy.c,v 1.46 2001/11/16 04:08:10 sakane Exp $	*/
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/param.h>
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <sys/queue.h>
-
-#include <netinet/in.h>
-#include PATH_IPSEC_H
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-
-#include "var.h"
-#include "misc.h"
-#include "vmbuf.h"
-#include "plog.h"
-#include "sockmisc.h"
-#include "debug.h"
-
-#include "policy.h"
-#include "localconf.h"
-#include "isakmp_var.h"
-#include "isakmp.h"
-#include "oakley.h"
-#include "handler.h"
-#include "strnames.h"
-#include "gcmalloc.h"
-
-static TAILQ_HEAD(_sptree, secpolicy) sptree;
-
-/* perform exact match against security policy table. */
-struct secpolicy *
-getsp(spidx)
-	struct policyindex *spidx;
-{
-	struct secpolicy *p;
-
-	for (p = TAILQ_FIRST(&sptree); p; p = TAILQ_NEXT(p, chain)) {
-		if (!cmpspidxstrict(spidx, &p->spidx))
-			return p;
-	}
-
-	return NULL;
-}
-
-/*
- * perform non-exact match against security policy table, only if this is
- * transport mode SA negotiation.  for example, 0.0.0.0/0 -> 0.0.0.0/0
- * entry in policy.txt can be returned when we're negotiating transport
- * mode SA.  this is how the kernel works.
- */
-#if 1
-struct secpolicy *
-getsp_r(spidx)
-	struct policyindex *spidx;
-{
-	struct secpolicy *p;
-
-	for (p = TAILQ_FIRST(&sptree); p; p = TAILQ_NEXT(p, chain)) {
-		if (!cmpspidxwild(spidx, &p->spidx))
-			return p;
-	}
-
-	return NULL;
-}
-#else
-struct secpolicy *
-getsp_r(spidx, iph2)
-	struct policyindex *spidx;
-	struct ph2handle *iph2;
-{
-	struct secpolicy *p;
-	u_int8_t prefixlen;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "checking for transport mode\n");
-
-	if (spidx->src.ss_family != spidx->dst.ss_family) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"address family mismatch, src:%d dst:%d\n",
-				spidx->src.ss_family,
-				spidx->dst.ss_family);
-		return NULL;
-	}
-	switch (spidx->src.ss_family) {
-	case AF_INET:
-		prefixlen = sizeof(struct in_addr) << 3;
-		break;
-#ifdef INET6
-	case AF_INET6:
-		prefixlen = sizeof(struct in6_addr) << 3;
-		break;
-#endif
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid family: %d\n", spidx->src.ss_family);
-		return NULL;
-	}
-
-	/* is it transport mode SA negotiation? */
-	plog(LLV_DEBUG, LOCATION, NULL, "src1: %s\n",
-		saddr2str(iph2->src));
-	plog(LLV_DEBUG, LOCATION, NULL, "src2: %s\n",
-		saddr2str((struct sockaddr *)&spidx->src));
-	if (cmpsaddrwop(iph2->src, (struct sockaddr *)&spidx->src)
-	 || spidx->prefs != prefixlen)
-		return NULL;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "dst1: %s\n",
-		saddr2str(iph2->dst));
-	plog(LLV_DEBUG, LOCATION, NULL, "dst2: %s\n",
-		saddr2str((struct sockaddr *)&spidx->dst));
-	if (cmpsaddrwop(iph2->dst, (struct sockaddr *)&spidx->dst)
-	 || spidx->prefd != prefixlen)
-		return NULL;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "looks to be transport mode\n");
-
-	for (p = TAILQ_FIRST(&sptree); p; p = TAILQ_NEXT(p, chain)) {
-		if (!cmpspidx_wild(spidx, &p->spidx))
-			return p;
-	}
-
-	return NULL;
-}
-#endif
-
-struct secpolicy *
-getspbyspid(spid)
-	u_int32_t spid;
-{
-	struct secpolicy *p;
-
-	for (p = TAILQ_FIRST(&sptree); p; p = TAILQ_NEXT(p, chain)) {
-		if (p->id == spid)
-			return p;
-	}
-
-	return NULL;
-}
-
-/*
- * compare policyindex.
- * a: subject b: db
- * OUT:	0:	equal
- *	1:	not equal
- */
-int
-cmpspidxstrict(a, b)
-	struct policyindex *a, *b;
-{
-	plog(LLV_DEBUG, LOCATION, NULL, "sub:%p: %s\n", a, spidx2str(a));
-	plog(LLV_DEBUG, LOCATION, NULL, "db :%p: %s\n", b, spidx2str(b));
-
-	/* XXX don't check direction now, but it's to be checked carefully. */
-	if (a->dir != b->dir
-	 || a->prefs != b->prefs
-	 || a->prefd != b->prefd
-	 || a->ul_proto != b->ul_proto)
-		return 1;
-
-	if (cmpsaddrstrict((struct sockaddr *)&a->src,
-			   (struct sockaddr *)&b->src))
-		return 1;
-	if (cmpsaddrstrict((struct sockaddr *)&a->dst,
-			   (struct sockaddr *)&b->dst))
-		return 1;
-
-#ifdef HAVE_SECCTX
-	if (a->sec_ctx.ctx_alg != b->sec_ctx.ctx_alg
-	    || a->sec_ctx.ctx_doi != b->sec_ctx.ctx_doi
-	    || !within_range(a->sec_ctx.ctx_str, b->sec_ctx.ctx_str))
-		return 1;
-#endif
-	return 0;
-}
-
-/*
- * compare policyindex, with wildcard address/protocol match.
- * a: subject b: db, can contain wildcard things.
- * OUT:	0:	equal
- *	1:	not equal
- */
-int
-cmpspidxwild(a, b)
-	struct policyindex *a, *b;
-{
-	struct sockaddr_storage sa1, sa2;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "sub:%p: %s\n", a, spidx2str(a));
-	plog(LLV_DEBUG, LOCATION, NULL, "db: %p: %s\n", b, spidx2str(b));
-
-	if (!(b->dir == IPSEC_DIR_ANY || a->dir == b->dir))
-		return 1;
-
-	if (!(a->ul_proto == IPSEC_ULPROTO_ANY ||
-	      b->ul_proto == IPSEC_ULPROTO_ANY ||
-	      a->ul_proto == b->ul_proto))
-		return 1;
-
-	if (a->src.ss_family != b->src.ss_family)
-		return 1;
-	if (a->dst.ss_family != b->dst.ss_family)
-		return 1;
-
-#ifndef __linux__
-	/* compare src address */
-	if (sizeof(sa1) < a->src.ss_len || sizeof(sa2) < b->src.ss_len) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"unexpected error: "
-			"src.ss_len:%d dst.ss_len:%d\n",
-			a->src.ss_len, b->src.ss_len);
-		return 1;
-	}
-#endif
-	mask_sockaddr((struct sockaddr *)&sa1, (struct sockaddr *)&a->src,
-		b->prefs);
-	mask_sockaddr((struct sockaddr *)&sa2, (struct sockaddr *)&b->src,
-		b->prefs);
-	plog(LLV_DEBUG, LOCATION, NULL, "%p masked with /%d: %s\n",
-		a, b->prefs, saddr2str((struct sockaddr *)&sa1));
-	plog(LLV_DEBUG, LOCATION, NULL, "%p masked with /%d: %s\n",
-		b, b->prefs, saddr2str((struct sockaddr *)&sa2));
-	if (cmpsaddrwild((struct sockaddr *)&sa1, (struct sockaddr *)&sa2))
-		return 1;
-
-#ifndef __linux__
-	/* compare dst address */
-	if (sizeof(sa1) < a->dst.ss_len || sizeof(sa2) < b->dst.ss_len) {
-		plog(LLV_ERROR, LOCATION, NULL, "unexpected error\n");
-		exit(1);
-	}
-#endif
-	mask_sockaddr((struct sockaddr *)&sa1, (struct sockaddr *)&a->dst,
-		b->prefd);
-	mask_sockaddr((struct sockaddr *)&sa2, (struct sockaddr *)&b->dst,
-		b->prefd);
-	plog(LLV_DEBUG, LOCATION, NULL, "%p masked with /%d: %s\n",
-		a, b->prefd, saddr2str((struct sockaddr *)&sa1));
-	plog(LLV_DEBUG, LOCATION, NULL, "%p masked with /%d: %s\n",
-		b, b->prefd, saddr2str((struct sockaddr *)&sa2));
-	if (cmpsaddrwild((struct sockaddr *)&sa1, (struct sockaddr *)&sa2))
-		return 1;
-
-#ifdef HAVE_SECCTX
-	if (a->sec_ctx.ctx_alg != b->sec_ctx.ctx_alg
-	    || a->sec_ctx.ctx_doi != b->sec_ctx.ctx_doi
-	    || !within_range(a->sec_ctx.ctx_str, b->sec_ctx.ctx_str))
-		return 1;
-#endif
-	return 0;
-}
-
-struct secpolicy *
-newsp()
-{
-	struct secpolicy *new;
-
-	new = racoon_calloc(1, sizeof(*new));
-	if (new == NULL)
-		return NULL;
-
-	return new;
-}
-
-void
-delsp(sp)
-	struct secpolicy *sp;
-{
-	struct ipsecrequest *req = NULL, *next;
-
-	for (req = sp->req; req; req = next) {
-		next = req->next;
-		racoon_free(req);
-	}
-	
-	racoon_free(sp);
-}
-
-void
-delsp_bothdir(spidx0)
-	struct policyindex *spidx0;
-{
-	struct policyindex spidx;
-	struct secpolicy *sp;
-	struct sockaddr_storage src, dst;
-	u_int8_t prefs, prefd;
-
-	memcpy(&spidx, spidx0, sizeof(spidx));
-	switch (spidx.dir) {
-	case IPSEC_DIR_INBOUND:
-#ifdef HAVE_POLICY_FWD
-	case IPSEC_DIR_FWD:
-#endif
-		src   = spidx.src;
-		dst   = spidx.dst;
-		prefs = spidx.prefs;
-		prefd = spidx.prefd;
-		break;
-	case IPSEC_DIR_OUTBOUND:
-		src   = spidx.dst;
-		dst   = spidx.src;
-		prefs = spidx.prefd;
-		prefd = spidx.prefs;
-		break;
-	default:
-		return;
-	}
-
-	spidx.src   = src;
-	spidx.dst   = dst;
-	spidx.prefs = prefs;
-	spidx.prefd = prefd;
-	spidx.dir   = IPSEC_DIR_INBOUND;
-
-	sp = getsp(&spidx);
-	if (sp) {
-		remsp(sp);
-		delsp(sp);
-	}
-
-#ifdef HAVE_POLICY_FWD
-	spidx.dir   = IPSEC_DIR_FWD;
-
-	sp = getsp(&spidx);
-	if (sp) {
-		remsp(sp);
-		delsp(sp);
-	}
-#endif
-
-	spidx.src   = dst;
-	spidx.dst   = src;
-	spidx.prefs = prefd;
-	spidx.prefd = prefs;
-	spidx.dir   = IPSEC_DIR_OUTBOUND;
-
-	sp = getsp(&spidx);
-	if (sp) {
-		remsp(sp);
-		delsp(sp);
-	}
-}
-
-void
-inssp(new)
-	struct secpolicy *new;
-{
-#ifdef HAVE_PFKEY_POLICY_PRIORITY
-	struct secpolicy *p;
-
-	TAILQ_FOREACH(p, &sptree, chain) {
-		if (new->spidx.priority < p->spidx.priority) {
-			TAILQ_INSERT_BEFORE(p, new, chain);
-			return;
-		}
-	}
-	if (p == NULL)
-#endif
-		TAILQ_INSERT_TAIL(&sptree, new, chain);
-
-	return;
-}
-
-void
-remsp(sp)
-	struct secpolicy *sp;
-{
-	TAILQ_REMOVE(&sptree, sp, chain);
-}
-
-void
-flushsp()
-{
-	struct secpolicy *p, *next;
-
-	for (p = TAILQ_FIRST(&sptree); p; p = next) {
-		next = TAILQ_NEXT(p, chain);
-		remsp(p);
-		delsp(p);
-	}
-}
-
-void
-initsp()
-{
-	TAILQ_INIT(&sptree);
-}
-
-struct ipsecrequest *
-newipsecreq()
-{
-	struct ipsecrequest *new;
-
-	new = racoon_calloc(1, sizeof(*new));
-	if (new == NULL)
-		return NULL;
-
-	return new;
-}
-
-const char *
-spidx2str(spidx)
-	const struct policyindex *spidx;
-{
-	/* addr/pref[port] addr/pref[port] ul dir act */
-	static char buf[256];
-	char *p, *a, *b;
-	int blen, i;
-
-	blen = sizeof(buf) - 1;
-	p = buf;
-
-	a = saddr2str((const struct sockaddr *)&spidx->src);
-	for (b = a; *b != '\0'; b++)
-		if (*b == '[') {
-			*b = '\0';
-			b++;
-			break;
-		}
-	i = snprintf(p, blen, "%s/%d[%s ", a, spidx->prefs, b);
-	if (i < 0 || i >= blen)
-		return NULL;
-	p += i;
-	blen -= i;
-
-	a = saddr2str((const struct sockaddr *)&spidx->dst);
-	for (b = a; *b != '\0'; b++)
-		if (*b == '[') {
-			*b = '\0';
-			b++;
-			break;
-		}
-	i = snprintf(p, blen, "%s/%d[%s ", a, spidx->prefd, b);
-	if (i < 0 || i >= blen)
-		return NULL;
-	p += i;
-	blen -= i;
-
-	i = snprintf(p, blen, "proto=%s dir=%s",
-		s_proto(spidx->ul_proto), s_direction(spidx->dir));
-
-#ifdef HAVE_SECCTX
-	if (spidx->sec_ctx.ctx_strlen) {
-		p += i;
-		blen -= i;
-		snprintf(p, blen, " sec_ctx:doi=%d,alg=%d,len=%d,str=%s",
-			 spidx->sec_ctx.ctx_doi, spidx->sec_ctx.ctx_alg,
-			 spidx->sec_ctx.ctx_strlen, spidx->sec_ctx.ctx_str);
-	}
-#endif
-	return buf;
-}
diff --git a/src/racoon/policy.h b/src/racoon/policy.h
deleted file mode 100644
index 8c47451..0000000
--- a/src/racoon/policy.h
+++ /dev/null
@@ -1,163 +0,0 @@
-/*	$NetBSD: policy.h,v 1.5.4.2 2007/06/07 20:34:19 manu Exp $	*/
-
-/* Id: policy.h,v 1.5 2004/06/11 16:00:17 ludvigm Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _POLICY_H
-#define _POLICY_H
-
-#include <sys/queue.h>
-
-
-#ifdef HAVE_SECCTX
-#define MAX_CTXSTR_SIZE 50
-struct security_ctx {
-	u_int8_t ctx_doi;       /* Security Context DOI */
-	u_int8_t ctx_alg;       /* Security Context Algorithm */
-	u_int16_t ctx_strlen;   /* Security Context stringlength
-				 * (includes terminating NULL)
-				 */
-	char ctx_str[MAX_CTXSTR_SIZE];  /* Security Context string */
-};
-#endif
-
-/* refs. ipsec.h */
-/*
- * Security Policy Index
- * NOTE: Ensure to be same address family and upper layer protocol.
- * NOTE: ul_proto, port number, uid, gid:
- *	ANY: reserved for waldcard.
- *	0 to (~0 - 1): is one of the number of each value.
- */
-struct policyindex {
-	u_int8_t dir;			/* direction of packet flow, see blow */
-	struct sockaddr_storage src;	/* IP src address for SP */
-	struct sockaddr_storage dst;	/* IP dst address for SP */
-	u_int8_t prefs;			/* prefix length in bits for src */
-	u_int8_t prefd;			/* prefix length in bits for dst */
-	u_int16_t ul_proto;		/* upper layer Protocol */
-	u_int32_t priority;		/* priority for the policy */
- 	u_int64_t created;		/* Used for generated SPD entries deletion */
-#ifdef HAVE_SECCTX
-	struct security_ctx sec_ctx;    /* Security Context */
-#endif
-};
-
-/* Security Policy Data Base */
-struct secpolicy {
-	TAILQ_ENTRY(secpolicy) chain;
-
-	struct policyindex spidx;	/* selector */
-	u_int32_t id;			/* It's unique number on the system. */
-
-	u_int policy;		/* DISCARD, NONE or IPSEC, see keyv2.h */
-	struct ipsecrequest *req;
-				/* pointer to the ipsec request tree, */
-				/* if policy == IPSEC else this value == NULL.*/
-};
-
-/* Security Assocciation Index */
-/* NOTE: Ensure to be same address family */
-struct secasindex {
-	struct sockaddr_storage src;	/* srouce address for SA */
-	struct sockaddr_storage dst;	/* destination address for SA */
-	u_int16_t proto;		/* IPPROTO_ESP or IPPROTO_AH */
-	u_int8_t mode;			/* mode of protocol, see ipsec.h */
-	u_int32_t reqid;		/* reqid id who owned this SA */
-					/* see IPSEC_MANUAL_REQID_MAX. */
-};
-
-/* Request for IPsec */
-struct ipsecrequest {
-	struct ipsecrequest *next;
-				/* pointer to next structure */
-				/* If NULL, it means the end of chain. */
-
-	struct secasindex saidx;/* hint for search proper SA */
-				/* if __ss_len == 0 then no address specified.*/
-	u_int level;		/* IPsec level defined below. */
-
-	struct secpolicy *sp;	/* back pointer to SP */
-};
-
-#ifdef HAVE_PFKEY_POLICY_PRIORITY
-#define KEY_SETSECSPIDX(_dir, s, d, ps, pd, ulp, _priority, _created, idx)              \
-do {                                                                         \
-	memset((idx), 0, sizeof(struct policyindex));                        \
-	(idx)->dir = (_dir);                                                 \
-	(idx)->prefs = (ps);                                                 \
-	(idx)->prefd = (pd);                                                 \
-	(idx)->ul_proto = (ulp);                                             \
-	(idx)->priority = (_priority);                                        \
-	(idx)->created = (_created);                                        \
-	memcpy(&(idx)->src, (s), sysdep_sa_len((struct sockaddr *)(s)));          \
-	memcpy(&(idx)->dst, (d), sysdep_sa_len((struct sockaddr *)(d)));          \
-} while (0)
-#else
-#define KEY_SETSECSPIDX(_dir, s, d, ps, pd, ulp, _created, idx)              \
-do {                                                                         \
-	memset((idx), 0, sizeof(struct policyindex));                        \
-	(idx)->dir = (_dir);                                                 \
-	(idx)->prefs = (ps);                                                 \
-	(idx)->prefd = (pd);                                                 \
-	(idx)->ul_proto = (ulp);                                             \
-	(idx)->created = (_created);                                        \
-	memcpy(&(idx)->src, (s), sysdep_sa_len((struct sockaddr *)(s)));          \
-	memcpy(&(idx)->dst, (d), sysdep_sa_len((struct sockaddr *)(d)));          \
-} while (0)
-#endif
-
-struct ph2handle;
-struct policyindex;
-extern struct secpolicy *getsp __P((struct policyindex *));
-extern struct secpolicy *getsp_r __P((struct policyindex *));
-struct secpolicy *getspbyspid __P((u_int32_t));
-extern int cmpspidxstrict __P((struct policyindex *, struct policyindex *));
-extern int cmpspidxwild __P((struct policyindex *, struct policyindex *));
-extern struct secpolicy *newsp __P((void));
-extern void delsp __P((struct secpolicy *));
-extern void delsp_bothdir __P((struct policyindex *));
-extern void inssp __P((struct secpolicy *));
-extern void remsp __P((struct secpolicy *));
-extern void flushsp __P((void));
-extern void initsp __P((void));
-extern struct ipsecrequest *newipsecreq __P((void));
-
-extern const char *spidx2str __P((const struct policyindex *));
-#ifdef HAVE_SECCTX
-#include <selinux/selinux.h>
-extern int get_security_context __P((vchar_t *, struct policyindex *));
-extern void init_avc __P((void));
-extern int within_range __P((security_context_t, security_context_t));
-extern void set_secctx_in_proposal __P((struct ph2handle *, struct policyindex));
-#endif
-
-#endif /* _POLICY_H */
diff --git a/src/racoon/privsep.c b/src/racoon/privsep.c
deleted file mode 100644
index 9e60b89..0000000
--- a/src/racoon/privsep.c
+++ /dev/null
@@ -1,1339 +0,0 @@
-/*	$NetBSD: privsep.c,v 1.6 2006/09/09 16:22:10 manu Exp $	*/
-
-/* Id: privsep.c,v 1.15 2005/08/08 11:23:44 vanhu Exp */
-
-/*
- * Copyright (C) 2004 Emmanuel Dreyfus
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <unistd.h>
-#include <string.h>
-#ifdef __NetBSD__
-#include <stdlib.h>	/* for setproctitle */
-#endif
-#include <errno.h>
-#include <signal.h>
-#include <pwd.h>
-
-#include <sys/socket.h>
-#include <sys/param.h>
-
-#include "gcmalloc.h"
-#include "vmbuf.h"
-#include "misc.h"
-#include "plog.h"
-#include "var.h"
-#include "libpfkey.h"
-
-#include "crypto_openssl.h"
-#include "isakmp_var.h"
-#include "isakmp.h"
-#ifdef ENABLE_HYBRID
-#include "resolv.h"
-#include "isakmp_xauth.h"
-#include "isakmp_cfg.h"
-#endif
-#include "localconf.h"
-#include "remoteconf.h"
-#include "admin.h"
-#include "sockmisc.h"
-#include "privsep.h"
-
-static int privsep_sock[2] = { -1, -1 };
-
-static int privsep_recv(int, struct privsep_com_msg **, size_t *);
-static int privsep_send(int, struct privsep_com_msg *, size_t);
-static int safety_check(struct privsep_com_msg *, int i);
-static int port_check(int);
-static int unsafe_env(char *const *);
-static int unknown_name(int);
-static int unsafe_path(char *, int);
-
-static int
-privsep_send(sock, buf, len)
-	int sock;
-	struct privsep_com_msg *buf;
-	size_t len;
-{
-	if (buf == NULL)
-		return 0;
-
-	if (sendto(sock, (char *)buf, len, 0, NULL, 0) == -1) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "privsep_send failed: %s\n", 
-		    strerror(errno));
-		return -1;
-	}
-
-	racoon_free((char *)buf);
-
-	return 0;
-}
-
-
-static int
-privsep_recv(sock, bufp, lenp)
-	int sock;
-	struct privsep_com_msg **bufp;
-	size_t *lenp;
-{
-	struct admin_com com;
-	struct admin_com *combuf;
-	size_t len;
-
-	*bufp = NULL;
-	*lenp = 0;
-
-	/* Get the header */
-	while ((len = recvfrom(sock, (char *)&com, 
-	    sizeof(com), MSG_PEEK, NULL, NULL)) == -1) {
-		if (errno == EINTR)
-			continue;
-
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "privsep_recv failed: %s\n",
-		    strerror(errno));
-		return -1;
-	}
-	
-	/* Check for short packets */
-	if (len < sizeof(com)) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "corrupted privsep message (short header)\n");
-		return -1;
-	}
-
-	/* Allocate buffer for the whole message */
-	if ((combuf = (struct admin_com *)racoon_malloc(com.ac_len)) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "failed to allocate memory: %s\n", strerror(errno));
-		return -1;
-	}
-
-	/* Get the whole buffer */
-	while ((len = recvfrom(sock, (char *)combuf, 
-	    com.ac_len, 0, NULL, NULL)) == -1) {
-		if (errno == EINTR)
-			continue;
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "failed to recv privsep command: %s\n", 
-		    strerror(errno));
-		return -1;
-	}
-
-	/* We expect len to match */
-	if (len != com.ac_len) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "corrupted privsep message (short packet)\n");
-		return -1;
-	}
-
-	*bufp = (struct privsep_com_msg *)combuf;
-	*lenp = len;
-
-	return 0;
-}
-
-int
-privsep_init(void)
-{
-	int i;
-	pid_t child_pid;
-
-	/* If running as root, we don't use the privsep code path */
-	if (lcconf->uid == 0)
-		return 0;
-
-	/* 
-	 * When running privsep, certificate and script paths 
-	 * are mandatory, as they enable us to check path safety
-	 * in the privilegied instance
-	 */
-	if ((lcconf->pathinfo[LC_PATHTYPE_CERT] == NULL) ||
-	    (lcconf->pathinfo[LC_PATHTYPE_SCRIPT] == NULL)) {
-		plog(LLV_ERROR, LOCATION, NULL, "privilege separation "
-		   "require path cert and path script in the config file\n");
-		return -1;
-	}
-
-	if (socketpair(PF_LOCAL, SOCK_DGRAM, 0, privsep_sock) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "Cannot allocate privsep_sock: %s\n", strerror(errno));
-		return -1;
-	}
-
-	switch (child_pid = fork()) {
-	case -1:
-		plog(LLV_ERROR, LOCATION, NULL, "Cannot fork privsep: %s\n", 
-		    strerror(errno));
-		return -1;
-		break;
-
-	case 0: /* Child: drop privileges */
-		if (lcconf->chroot != NULL) {
-			if (chdir(lcconf->chroot) != 0) {
-				plog(LLV_ERROR, LOCATION, NULL, 
-				    "Cannot chdir(%s): %s\n", lcconf->chroot, 
-				    strerror(errno));
-				return -1;
-			}
-			if (chroot(lcconf->chroot) != 0) {
-				plog(LLV_ERROR, LOCATION, NULL, 
-				    "Cannot chroot(%s): %s\n", lcconf->chroot, 
-				    strerror(errno));
-				return -1;
-			}
-		}
-
-		if (setgid(lcconf->gid) != 0) {
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "Cannot setgid(%d): %s\n", lcconf->gid,
-			    strerror(errno));
-			return -1;
-		}
-
-		if (setegid(lcconf->gid) != 0) {
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "Cannot setegid(%d): %s\n", lcconf->gid,
-			    strerror(errno));
-			return -1;
-		}
-
-		if (setuid(lcconf->uid) != 0) {
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "Cannot setuid(%d): %s\n", lcconf->uid,
-			    strerror(errno));
-			return -1;
-		}
-
-		if (seteuid(lcconf->uid) != 0) {
-			plog(LLV_ERROR, LOCATION, NULL, 
-			    "Cannot seteuid(%d): %s\n", lcconf->uid,
-			    strerror(errno));
-			return -1;
-		}
-
-		return 0;
-		break;
-
-	default: /* Parent: privilegied process */
-		break;
-	}
-
-	/* 
-	 * Close everything except the socketpair, 
-	 * and stdout if running in the forground.
-	 */
-	for (i = sysconf(_SC_OPEN_MAX); i > 0; i--) {
-		if (i == privsep_sock[0])
-			continue;
-		if (i == privsep_sock[1])
-			continue;
-		if ((f_foreground) && (i == 1))
-			continue;
-		(void)close(i);
-	}
-
-	/* Above trickery closed the log file, reopen it */
-	ploginit();
-
-	plog(LLV_INFO, LOCATION, NULL, 
-	    "racoon privilegied process running with PID %d\n", getpid());
-
-#ifdef __NetBSD__
-	setproctitle("[priv]");
-#endif
-	
-	/* 
-	 * Don't catch any signal 
-	 * This duplicate session:signals[], which is static...
-	 */
-	signal(SIGHUP, SIG_DFL);
-	signal(SIGINT, SIG_DFL);
-	signal(SIGTERM, SIG_DFL);
-	signal(SIGUSR1, SIG_DFL);
-	signal(SIGUSR2, SIG_DFL);
-	signal(SIGCHLD, SIG_DFL);
-
-	while (1) {
-		size_t len;
-		struct privsep_com_msg *combuf;
-		struct privsep_com_msg *reply;
-		char *data;
-		size_t *buflen;
-		size_t totallen;
-		char *bufs[PRIVSEP_NBUF_MAX];
-		int i;
-
-		if (privsep_recv(privsep_sock[0], &combuf, &len) != 0)
-			goto out;
-
-		/* Safety checks and gather the data */
-		if (len < sizeof(*combuf)) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "corrupted privsep message (short buflen)\n");
-			goto out;
-		}
-
-		data = (char *)(combuf + 1);
-		totallen = sizeof(*combuf);
-		for (i = 0; i < PRIVSEP_NBUF_MAX; i++) {
-			bufs[i] = (char *)data;
-			data += combuf->bufs.buflen[i];
-			totallen += combuf->bufs.buflen[i];
-		}
-
-		if (totallen > len) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "corrupted privsep message (bufs too big)\n");
-			goto out;
-		}
-	
-		/* Prepare the reply buffer */
-		if ((reply = racoon_malloc(sizeof(*reply))) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "Cannot allocate reply buffer: %s\n", 
-			    strerror(errno));
-			goto out;
-		}
-		bzero(reply, sizeof(*reply));
-		reply->hdr.ac_cmd = combuf->hdr.ac_cmd;
-		reply->hdr.ac_len = sizeof(*reply);
-
-		switch(combuf->hdr.ac_cmd) {
-		/* 
-		 * XXX Improvement: instead of returning the key, 
-		 * stuff eay_get_pkcs1privkey and eay_get_x509sign
-		 * together and sign the hash in the privilegied 
-		 * instance? 
-		 * pro: the key remains inaccessible to unpriv
-		 * con: a compromised unpriv racoon can still sign anything
-		 */
-		case PRIVSEP_EAY_GET_PKCS1PRIVKEY: {
-			vchar_t *privkey;
-
-			/* Make sure the string is NULL terminated */
-			if (safety_check(combuf, 0) != 0)
-				break;
-			bufs[0][combuf->bufs.buflen[0] - 1] = '\0';
-
-			if (unsafe_path(bufs[0], LC_PATHTYPE_CERT) != 0) {
-				plog(LLV_ERROR, LOCATION, NULL, 
-				    "privsep_eay_get_pkcs1privkey: "
-				    "unsafe cert \"%s\"\n", bufs[0]);
-			}
-
-			plog(LLV_DEBUG, LOCATION, NULL, 
-			    "eay_get_pkcs1privkey(\"%s\")\n", bufs[0]);
-
-			if ((privkey = eay_get_pkcs1privkey(bufs[0])) == NULL){
-				reply->hdr.ac_errno = errno;
-				break;
-			}
-
-			reply->bufs.buflen[0] = privkey->l;
-			reply->hdr.ac_len = sizeof(*reply) + privkey->l;
-			reply = racoon_realloc(reply, reply->hdr.ac_len);
-			if (reply == NULL) {
-				plog(LLV_ERROR, LOCATION, NULL,
-				    "Cannot allocate reply buffer: %s\n", 
-				    strerror(errno));
-				goto out;
-			}
-
-			memcpy(reply + 1, privkey->v, privkey->l);
-			vfree(privkey);
-			break;
-		}
-		
-		case PRIVSEP_SCRIPT_EXEC: {
-			char *script;
-			int name;
-			char **envp = NULL;
-			int envc = 0;
-			int count = 0;
-			int i;
-
-			/*
-			 * First count the bufs, and make sure strings
-			 * are NULL terminated. 
-			 *
-			 * We expect: script, name, envp[], void
-			 */ 
-			if (safety_check(combuf, 0) != 0)
-				break;
-			bufs[0][combuf->bufs.buflen[0] - 1] = '\0';
-			count++;	/* script */
-
-			count++;	/* name */
-
-			for (; count < PRIVSEP_NBUF_MAX; count++) {
-				if (combuf->bufs.buflen[count] == 0)
-					break;
-				bufs[count]
-				    [combuf->bufs.buflen[count] - 1] = '\0';
-				envc++;
-			}
-
-			/* count a void buf and perform safety check */
-			count++;
-			if (count >= PRIVSEP_NBUF_MAX) {
-				plog(LLV_ERROR, LOCATION, NULL, 
-				    "privsep_script_exec: too many args\n");
-				goto out;
-			}
-
-
-			/* 
-			 * Allocate the arrays for envp 
-			 */
-			envp = racoon_malloc((envc + 1) * sizeof(char *));
-			if (envp == NULL) {
-				plog(LLV_ERROR, LOCATION, NULL, 
-				    "cannot allocate memory: %s\n",
-				    strerror(errno));
-				goto out;
-			}
-			bzero(envp, (envc + 1) * sizeof(char *));
-
-	
-			/*
-			 * Populate script, name and envp 
-			 */
-			count = 0;
-			script = bufs[count++];
-
-			if (combuf->bufs.buflen[count] != sizeof(name)) {
-				plog(LLV_ERROR, LOCATION, NULL, 
-				    "privsep_script_exec: corrupted message\n");
-				goto out;
-			}
-			memcpy((char *)&name, bufs[count++], sizeof(name));
-
-			for (i = 0; combuf->bufs.buflen[count]; count++)
-				envp[i++] = bufs[count];
-
-			count++;		/* void */
-
-			plog(LLV_DEBUG, LOCATION, NULL, 
-			    "script_exec(\"%s\", %d, %p)\n", 
-			    script, name, envp);
-
-			/* 
-			 * Check env for dangerous variables
-			 * Check script path and name
-			 * Perform fork and execve
-			 */
-			if ((unsafe_env(envp) == 0) &&
-			    (unknown_name(name) == 0) &&
-			    (unsafe_path(script, LC_PATHTYPE_SCRIPT) == 0))
-				(void)script_exec(script, name, envp);
-			else
-				plog(LLV_ERROR, LOCATION, NULL, 
-				    "privsep_script_exec: "
-				    "unsafe script \"%s\"\n", script);
-
-			racoon_free(envp);
-			break;
-		}
-
-		case PRIVSEP_GETPSK: {
-			vchar_t *psk;
-			int keylen;
-
-			/* Make sure the string is NULL terminated */
-			if (safety_check(combuf, 0) != 0)
-				break;
-			bufs[0][combuf->bufs.buflen[0] - 1] = '\0';
-
-			if (combuf->bufs.buflen[1] != sizeof(keylen)) {
-				plog(LLV_ERROR, LOCATION, NULL, 
-				    "privsep_getpsk: corrupted message\n");
-				goto out;
-			}
-			memcpy(&keylen, bufs[1], sizeof(keylen));
-
-			plog(LLV_DEBUG, LOCATION, NULL, 
-			    "getpsk(\"%s\", %d)\n", bufs[0], keylen);
-
-			if ((psk = getpsk(bufs[0], keylen)) == NULL) {
-				reply->hdr.ac_errno = errno;
-				break;
-			}
-
-			reply->bufs.buflen[0] = psk->l;
-			reply->hdr.ac_len = sizeof(*reply) + psk->l;
-			reply = racoon_realloc(reply, reply->hdr.ac_len); 
-			if (reply == NULL) {
-				plog(LLV_ERROR, LOCATION, NULL,
-				    "Cannot allocate reply buffer: %s\n", 
-				    strerror(errno));
-				goto out;
-			}
-
-			memcpy(reply + 1, psk->v, psk->l);
-			vfree(psk);
-			break;
-		}
-
-#ifdef ENABLE_HYBRID
-		case PRIVSEP_ACCOUNTING_SYSTEM: {
-			int pool_size;
-			int port;
-			int inout;
-			struct sockaddr *raddr;
-
-			if (safety_check(combuf, 0) != 0)
-				break;
-			if (safety_check(combuf, 1) != 0)
-				break;
-			if (safety_check(combuf, 2) != 0)
-				break;
-			if (safety_check(combuf, 3) != 0)
-				break;
-
-			memcpy(&port, bufs[0], sizeof(port));
-			raddr = (struct sockaddr *)bufs[1];
-
-			bufs[2][combuf->bufs.buflen[2] - 1] = '\0';
-			memcpy(&inout, bufs[3], sizeof(port));
-
-			if (port_check(port) != 0)
-				break;
-
-			plog(LLV_DEBUG, LOCATION, NULL, 
-			    "accounting_system(%d, %s, %s)\n", 
-			    port, saddr2str(raddr), bufs[2]); 
-
-			errno = 0;
-			if (isakmp_cfg_accounting_system(port, 
-			    raddr, bufs[2], inout) != 0) {
-				if (errno == 0)
-					reply->hdr.ac_errno = EINVAL;
-				else
-					reply->hdr.ac_errno = errno;
-			}
-			break;
-		}
-		case PRIVSEP_XAUTH_LOGIN_SYSTEM: {
-			if (safety_check(combuf, 0) != 0)
-				break;
-			bufs[0][combuf->bufs.buflen[0] - 1] = '\0';
-
-			if (safety_check(combuf, 1) != 0)
-				break;
-			bufs[1][combuf->bufs.buflen[1] - 1] = '\0';
-
-			plog(LLV_DEBUG, LOCATION, NULL, 
-			    "xauth_login_system(\"%s\", <password>)\n", 
-			    bufs[0]);
-
-			errno = 0;
-			if (xauth_login_system(bufs[0], bufs[1]) != 0) {
-				if (errno == 0)
-					reply->hdr.ac_errno = EINVAL;
-				else
-					reply->hdr.ac_errno = errno;
-			}
-			break;
-		}
-#ifdef HAVE_LIBPAM
-		case PRIVSEP_ACCOUNTING_PAM: {
-			int port;
-			int inout;
-			int pool_size;
-
-			if (safety_check(combuf, 0) != 0)
-				break;
-			if (safety_check(combuf, 1) != 0)
-				break;
-			if (safety_check(combuf, 2) != 0)
-				break;
-
-			memcpy(&port, bufs[0], sizeof(port));
-			memcpy(&inout, bufs[1], sizeof(inout));
-			memcpy(&pool_size, bufs[2], sizeof(pool_size));
-
-			if (pool_size != isakmp_cfg_config.pool_size)
-				if (isakmp_cfg_resize_pool(pool_size) != 0)
-					break;
-
-			if (port_check(port) != 0)
-				break;
-
-			plog(LLV_DEBUG, LOCATION, NULL, 
-			    "isakmp_cfg_accounting_pam(%d, %d)\n", 
-			    port, inout); 
-
-			errno = 0;
-			if (isakmp_cfg_accounting_pam(port, inout) != 0) {
-				if (errno == 0)
-					reply->hdr.ac_errno = EINVAL;
-				else
-					reply->hdr.ac_errno = errno;
-			}
-			break;
-		}
-
-		case PRIVSEP_XAUTH_LOGIN_PAM: {
-			int port;
-			int pool_size;
-			struct sockaddr *raddr;
-
-			if (safety_check(combuf, 0) != 0)
-				break;
-			if (safety_check(combuf, 1) != 0)
-				break;
-			if (safety_check(combuf, 2) != 0)
-				break;
-			if (safety_check(combuf, 3) != 0)
-				break;
-			if (safety_check(combuf, 4) != 0)
-				break;
-
-			memcpy(&port, bufs[0], sizeof(port));
-			memcpy(&pool_size, bufs[1], sizeof(pool_size));
-			raddr = (struct sockaddr *)bufs[2];
-			
-			bufs[3][combuf->bufs.buflen[3] - 1] = '\0';
-			bufs[4][combuf->bufs.buflen[4] - 1] = '\0';
-
-			if (pool_size != isakmp_cfg_config.pool_size)
-				if (isakmp_cfg_resize_pool(pool_size) != 0)
-					break;
-
-			if (port_check(port) != 0)
-				break;
-
-			plog(LLV_DEBUG, LOCATION, NULL, 
-			    "xauth_login_pam(%d, %s, \"%s\", <password>)\n", 
-			    port, saddr2str(raddr), bufs[3]); 
-
-			errno = 0;
-			if (xauth_login_pam(port, 
-			    raddr, bufs[3], bufs[4]) != 0) {
-				if (errno == 0)
-					reply->hdr.ac_errno = EINVAL;
-				else
-					reply->hdr.ac_errno = errno;
-			}
-			break;
-		}
-
-		case PRIVSEP_CLEANUP_PAM: {
-			int port;
-			int pool_size;
-
-			if (safety_check(combuf, 0) != 0)
-				break;
-			if (safety_check(combuf, 1) != 0)
-				break;
-
-			memcpy(&port, bufs[0], sizeof(port));
-			memcpy(&pool_size, bufs[1], sizeof(pool_size));
-
-			if (pool_size != isakmp_cfg_config.pool_size)
-				if (isakmp_cfg_resize_pool(pool_size) != 0)
-					break;
-
-			if (port_check(port) != 0)
-				break;
-
-			plog(LLV_DEBUG, LOCATION, NULL, 
-			    "cleanup_pam(%d)\n", port);
-
-			cleanup_pam(port);
-			reply->hdr.ac_errno = 0;
-
-			break;
-		}
-#endif /* HAVE_LIBPAM */
-#endif /* ENABLE_HYBRID */
-
-		default:
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "unexpected privsep command %d\n", 
-			    combuf->hdr.ac_cmd);
-			goto out;
-			break;
-		}
-
-		/* This frees reply */
-		if (privsep_send(privsep_sock[0], 
-		    reply, reply->hdr.ac_len) != 0)
-			goto out;
-
-		racoon_free(combuf);
-	}
-
-out:
-	plog(LLV_INFO, LOCATION, NULL, "privsep exit\n");
-	_exit(0);
-}
-
-
-vchar_t *
-privsep_eay_get_pkcs1privkey(path) 
-	char *path;
-{
-	vchar_t *privkey;
-	struct privsep_com_msg *msg;
-	size_t len;
-
-	if (geteuid() == 0)
-		return eay_get_pkcs1privkey(path);
-
-	len = sizeof(*msg) + strlen(path) + 1;
-	if ((msg = racoon_malloc(len)) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "Cannot allocate memory: %s\n", strerror(errno));
-		return NULL;
-	}
-	bzero(msg, len);
-	msg->hdr.ac_cmd = PRIVSEP_EAY_GET_PKCS1PRIVKEY;
-	msg->hdr.ac_len = len;
-	msg->bufs.buflen[0] = len - sizeof(*msg);
-	memcpy(msg + 1, path, msg->bufs.buflen[0]);
-
-	if (privsep_send(privsep_sock[1], msg, len) != 0)
-		return NULL;
-
-	if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
-		return NULL;
-
-	if (msg->hdr.ac_errno != 0) {
-		errno = msg->hdr.ac_errno;
-		goto out;
-	}
-
-	if ((privkey = vmalloc(len - sizeof(*msg))) == NULL)
-		goto out;
-
-	memcpy(privkey->v, msg + 1, privkey->l);
-	racoon_free(msg);
-	return privkey;
-
-out:
-	racoon_free(msg);
-	return NULL;
-}
-
-/*
- * No prigilege separation trick here, we just open PFKEY before
- * dropping root privs and we remember it later.
- */
-static int  pfkey_socket = -1;
-int
-privsep_pfkey_open(void)
-{
-	int ps;
-
-	if (pfkey_socket != -1)
-		return pfkey_socket;
-
-	ps = pfkey_open();
-	if (ps != -1)
-		pfkey_socket = ps;
-
-	return ps;
-}
-
-/*
- * Consequence of the above trickery: don't 
- * really close PFKEY as we never re-open it.
- */
-void
-privsep_pfkey_close(ps)
-	int ps;
-{
-	return;
-}
-
-int
-privsep_script_exec(script, name, envp)
-	char *script;
-	int name;
-	char *const envp[];
-{
-	int count = 0;
-	char *const *c;
-	char *data;
-	size_t len;
-	struct privsep_com_msg *msg;
-
-	if (geteuid() == 0)
-		return script_exec(script, name, envp);
-
-	if ((msg = racoon_malloc(sizeof(*msg))) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "Cannot allocate memory: %s\n", strerror(errno));
-		return -1;
-	}
-
-	bzero(msg, sizeof(*msg));
-	msg->hdr.ac_cmd = PRIVSEP_SCRIPT_EXEC;
-	msg->hdr.ac_len = sizeof(*msg);
-
-	/*
-	 * We send: 
-	 * script, name, envp[0], ... envp[N], void
-	 */
-
-	/*
-	 * Safety check on the counts: PRIVSEP_NBUF_MAX max
-	 */
-	count = 0;
-	count++;					/* script */
-	count++;					/* name */
-	for (c = envp; *c; c++)				/* envp */
-		count++;
-	count++;					/* void */
-
-	if (count > PRIVSEP_NBUF_MAX) {
-		plog(LLV_ERROR, LOCATION, NULL, "Unexpected error: "
-		    "privsep_script_exec count > PRIVSEP_NBUF_MAX\n");
-		racoon_free(msg);
-		return -1;
-	}
-
-
-	/*
-	 * Compute the length
-	 */
-	count = 0;
-	msg->bufs.buflen[count] = strlen(script) + 1;	/* script */
-	msg->hdr.ac_len += msg->bufs.buflen[count++];
-
-	msg->bufs.buflen[count] = sizeof(name);		/* name */
-	msg->hdr.ac_len += msg->bufs.buflen[count++];
-
-	for (c = envp; *c; c++) {			/* envp */
-		msg->bufs.buflen[count] = strlen(*c) + 1;
-		msg->hdr.ac_len += msg->bufs.buflen[count++];
-	}
-
-	msg->bufs.buflen[count] = 0; 			/* void */
-	msg->hdr.ac_len += msg->bufs.buflen[count++];
-
-	if ((msg = racoon_realloc(msg, msg->hdr.ac_len)) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "Cannot allocate memory: %s\n", strerror(errno));
-		return -1;
-	}
-	
-	/*
-	 * Now copy the data
-	 */
-	data = (char *)(msg + 1);
-	count = 0;
-
-	memcpy(data, (char *)script, msg->bufs.buflen[count]);	/* script */
-	data += msg->bufs.buflen[count++];
-
-	memcpy(data, (char *)&name, msg->bufs.buflen[count]);	/* name */
-	data += msg->bufs.buflen[count++];
-
-	for (c = envp; *c; c++) {				/* envp */
-		memcpy(data, *c, msg->bufs.buflen[count]); 
-		data += msg->bufs.buflen[count++];
-	}
-
-	count++;						/* void */
-
-	/*
-	 * And send it!
-	 */
-	if (privsep_send(privsep_sock[1], msg, msg->hdr.ac_len) != 0)
-		return -1;
-
-	if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
-		return -1;
-
-	if (msg->hdr.ac_errno != 0) {
-		errno = msg->hdr.ac_errno;
-		racoon_free(msg);
-		return -1;
-	}
-
-	racoon_free(msg);
-	return 0;
-}
-
-vchar_t *
-privsep_getpsk(str, keylen)
-	const char *str;
-	int keylen;
-{
-	vchar_t *psk;
-	struct privsep_com_msg *msg;
-	size_t len;
-	int *keylenp;
-	char *data;
-
-	if (geteuid() == 0)
-		return getpsk(str, keylen);
-
-	len = sizeof(*msg) + strlen(str) + 1 + sizeof(keylen);
-	if ((msg = racoon_malloc(len)) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "Cannot allocate memory: %s\n", strerror(errno));
-		return NULL;
-	}
-	bzero(msg, len);
-	msg->hdr.ac_cmd = PRIVSEP_GETPSK;
-	msg->hdr.ac_len = len;
-
-	data = (char *)(msg + 1);
-	msg->bufs.buflen[0] = strlen(str) + 1;
-	memcpy(data, str, msg->bufs.buflen[0]);
-
-	data += msg->bufs.buflen[0];
-	msg->bufs.buflen[1] = sizeof(keylen);
-	memcpy(data, &keylen, sizeof(keylen));
-
-	if (privsep_send(privsep_sock[1], msg, len) != 0)
-		return NULL;
-
-	if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
-		return NULL;
-
-	if (msg->hdr.ac_errno != 0) {
-		errno = msg->hdr.ac_errno;
-		goto out;
-	}
-
-	if ((psk = vmalloc(len - sizeof(*msg))) == NULL)
-		goto out;
-
-	memcpy(psk->v, msg + 1, psk->l);
-	racoon_free(msg);
-	return psk;
-
-out:
-	racoon_free(msg);
-	return NULL;
-}
-
-#ifdef ENABLE_HYBRID
-int
-privsep_xauth_login_system(usr, pwd)
-	char *usr;
-	char *pwd;
-{
-	struct privsep_com_msg *msg;
-	size_t len;
-	char *data;
-
-	if (geteuid() == 0)
-		return xauth_login_system(usr, pwd);
-
-	len = sizeof(*msg) + strlen(usr) + 1 + strlen(pwd) + 1;
-	if ((msg = racoon_malloc(len)) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "Cannot allocate memory: %s\n", strerror(errno));
-		return -1;
-	}
-	bzero(msg, len);
-	msg->hdr.ac_cmd = PRIVSEP_XAUTH_LOGIN_SYSTEM;
-	msg->hdr.ac_len = len;
-
-	data = (char *)(msg + 1);
-	msg->bufs.buflen[0] = strlen(usr) + 1;
-	memcpy(data, usr, msg->bufs.buflen[0]);
-	data += msg->bufs.buflen[0];
-
-	msg->bufs.buflen[1] = strlen(pwd) + 1;
-	memcpy(data, pwd, msg->bufs.buflen[1]);
-	
-	if (privsep_send(privsep_sock[1], msg, len) != 0)
-		return -1;
-
-	if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
-		return -1;
-
-	if (msg->hdr.ac_errno != 0) {
-		racoon_free(msg);
-		return -1;
-	}
-
-	racoon_free(msg);
-	return 0;
-}
-
-int 
-privsep_accounting_system(port, raddr, usr, inout)
-	int port;
-	struct sockaddr *raddr;
-	char *usr;
-	int inout;
-{
-	struct privsep_com_msg *msg;
-	size_t len;
-	char *data;
-	int result;
-
-	if (geteuid() == 0)
-		return isakmp_cfg_accounting_system(port, raddr,
-						    usr, inout);
-
-	len = sizeof(*msg) 
-	    + sizeof(port)
-	    + sysdep_sa_len(raddr) 
-	    + strlen(usr) + 1
-	    + sizeof(inout);
-
-	if ((msg = racoon_malloc(len)) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "Cannot allocate memory: %s\n", strerror(errno));
-		return -1;
-	}
-	bzero(msg, len);
-	msg->hdr.ac_cmd = PRIVSEP_ACCOUNTING_SYSTEM;
-	msg->hdr.ac_len = len;
-	msg->bufs.buflen[0] = sizeof(port);
-	msg->bufs.buflen[1] = sysdep_sa_len(raddr);
-	msg->bufs.buflen[2] = strlen(usr) + 1;
-	msg->bufs.buflen[3] = sizeof(inout);
-
-	data = (char *)(msg + 1);
-	memcpy(data, &port, msg->bufs.buflen[0]);
-
-	data += msg->bufs.buflen[0];
-	memcpy(data, raddr, msg->bufs.buflen[1]);
-
-	data += msg->bufs.buflen[1];
-	memcpy(data, usr, msg->bufs.buflen[2]);
-
-	data += msg->bufs.buflen[2];
-	memcpy(data, &inout, msg->bufs.buflen[3]);
-
-	if (privsep_send(privsep_sock[1], msg, len) != 0)
-		return -1;
-
-	if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
-		return -1;
-
-	if (msg->hdr.ac_errno != 0) {
-		errno = msg->hdr.ac_errno;
-		goto out;
-	}
-
-	racoon_free(msg);
-	return 0;
-
-out:
-	racoon_free(msg);
-	return -1;
-}
-
-static int
-port_check(port)
-	int port;
-{
-	if ((port < 0) || (port >= isakmp_cfg_config.pool_size)) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "privsep: port %d outside of allowed range [0,%zu]\n",
-		    port, isakmp_cfg_config.pool_size - 1);
-		return -1;
-	}
-
-	return 0;
-}
-#endif
-
-static int 
-safety_check(msg, index)
-	struct privsep_com_msg *msg;
-	int index;
-{
-	if (index >= PRIVSEP_NBUF_MAX) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "privsep: Corrupted message, too many buffers\n");
-		return -1;
-	}
-		
-	if (msg->bufs.buflen[index] == 0) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "privsep: Corrupted message, unexpected void buffer\n");
-		return -1;
-	}
-
-	return 0;
-}
-
-/*
- * Filter unsafe environement variables
- */
-static int
-unsafe_env(envp)
-	char *const *envp;
-{
-	char *const *e;
-	char *const *be;
-	char *const bad_env[] = { "PATH=", "LD_LIBRARY_PATH=", "IFS=", NULL };
-
-	for (e = envp; *e; e++) {
-		for (be = bad_env; *be; be++) {
-			if (strncmp(*e, *be, strlen(*be)) == 0) {
-				goto found;
-			}
-		}
-	}
-
-	return 0;
-found:
-	plog(LLV_ERROR, LOCATION, NULL, 
-	    "privsep_script_exec: unsafe environement variable\n");
-	return -1;
-}
-
-/*
- * Check path safety
- */
-static int 
-unsafe_path(script, pathtype)
-	char *script;
-	int pathtype;
-{
-	char *path;
-	char rpath[MAXPATHLEN + 1];
-	size_t len;
-
-	if (script == NULL) 
-		return -1;
-
-	path = lcconf->pathinfo[pathtype];
-
-	/* No path was given for scripts: skip the check */
-	if (path == NULL)
-		return 0;
-
-	if (realpath(script, rpath) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "script path \"%s\" is invalid\n", script);
-		return -1;
-	}
-
-	len = strlen(path);
-	if (strncmp(path, rpath, len) != 0)
-		return -1;
-
-	return 0;
-}
-
-static int 
-unknown_name(name)
-	int name;
-{
-	if ((name < 0) || (name > SCRIPT_MAX)) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "privsep_script_exec: unsafe name index\n");
-		return -1;
-	}
-
-	return 0;
-}
-
-#ifdef HAVE_LIBPAM
-int 
-privsep_accounting_pam(port, inout)
-	int port;
-	int inout;
-{
-	struct privsep_com_msg *msg;
-	size_t len;
-	int *port_data;
-	int *inout_data;
-	int *pool_size_data;
-	int result;
-
-	if (geteuid() == 0)
-		return isakmp_cfg_accounting_pam(port, inout);
-
-	len = sizeof(*msg) 
-	    + sizeof(port) 
-	    + sizeof(inout)
-	    + sizeof(isakmp_cfg_config.pool_size);
-
-	if ((msg = racoon_malloc(len)) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "Cannot allocate memory: %s\n", strerror(errno));
-		return -1;
-	}
-	bzero(msg, len);
-	msg->hdr.ac_cmd = PRIVSEP_ACCOUNTING_PAM;
-	msg->hdr.ac_len = len;
-	msg->bufs.buflen[0] = sizeof(port);
-	msg->bufs.buflen[1] = sizeof(inout);
-	msg->bufs.buflen[2] = sizeof(isakmp_cfg_config.pool_size);
-
-	port_data = (int *)(msg + 1);
-	inout_data = (int *)(port_data + 1);
-	pool_size_data = (int *)(inout_data + 1);
-
-	*port_data = port;
-	*inout_data = inout;
-	*pool_size_data = isakmp_cfg_config.pool_size;
-
-	if (privsep_send(privsep_sock[1], msg, len) != 0)
-		return -1;
-
-	if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
-		return -1;
-
-	if (msg->hdr.ac_errno != 0) {
-		errno = msg->hdr.ac_errno;
-		goto out;
-	}
-
-	racoon_free(msg);
-	return 0;
-
-out:
-	racoon_free(msg);
-	return -1;
-}
-
-int 
-privsep_xauth_login_pam(port, raddr, usr, pwd)
-	int port;
-	struct sockaddr *raddr;
-	char *usr;
-	char *pwd;
-{
-	struct privsep_com_msg *msg;
-	size_t len;
-	char *data;
-	int result;
-
-	if (geteuid() == 0)
-		return xauth_login_pam(port, raddr, usr, pwd);
-
-	len = sizeof(*msg) 
-	    + sizeof(port)
-	    + sizeof(isakmp_cfg_config.pool_size)
-	    + sysdep_sa_len(raddr) 
-	    + strlen(usr) + 1
-	    + strlen(pwd) + 1;
-
-	if ((msg = racoon_malloc(len)) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "Cannot allocate memory: %s\n", strerror(errno));
-		return -1;
-	}
-	bzero(msg, len);
-	msg->hdr.ac_cmd = PRIVSEP_XAUTH_LOGIN_PAM;
-	msg->hdr.ac_len = len;
-	msg->bufs.buflen[0] = sizeof(port);
-	msg->bufs.buflen[1] = sizeof(isakmp_cfg_config.pool_size);
-	msg->bufs.buflen[2] = sysdep_sa_len(raddr);
-	msg->bufs.buflen[3] = strlen(usr) + 1;
-	msg->bufs.buflen[4] = strlen(pwd) + 1;
-
-	data = (char *)(msg + 1);
-	memcpy(data, &port, msg->bufs.buflen[0]);
-
-	data += msg->bufs.buflen[0];
-	memcpy(data, &isakmp_cfg_config.pool_size, msg->bufs.buflen[1]);
-
-	data += msg->bufs.buflen[1];
-	memcpy(data, raddr, msg->bufs.buflen[2]);
-
-	data += msg->bufs.buflen[2];
-	memcpy(data, usr, msg->bufs.buflen[3]);
-
-	data += msg->bufs.buflen[3];
-	memcpy(data, pwd, msg->bufs.buflen[4]);
-
-	if (privsep_send(privsep_sock[1], msg, len) != 0)
-		return -1;
-
-	if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
-		return -1;
-
-	if (msg->hdr.ac_errno != 0) {
-		errno = msg->hdr.ac_errno;
-		goto out;
-	}
-
-	racoon_free(msg);
-	return 0;
-
-out:
-	racoon_free(msg);
-	return -1;
-}
-
-void
-privsep_cleanup_pam(port)
-	int port;
-{
-	struct privsep_com_msg *msg;
-	size_t len;
-	char *data;
-	int result;
-
-	if (geteuid() == 0)
-		return cleanup_pam(port);
-
-	len = sizeof(*msg) 
-	    + sizeof(port)
-	    + sizeof(isakmp_cfg_config.pool_size);
-
-	if ((msg = racoon_malloc(len)) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "Cannot allocate memory: %s\n", strerror(errno));
-		return;
-	}
-	bzero(msg, len);
-	msg->hdr.ac_cmd = PRIVSEP_CLEANUP_PAM;
-	msg->hdr.ac_len = len;
-	msg->bufs.buflen[0] = sizeof(port);
-	msg->bufs.buflen[1] = sizeof(isakmp_cfg_config.pool_size);
-
-	data = (char *)(msg + 1);
-	memcpy(data, &port, msg->bufs.buflen[0]);
-
-	data += msg->bufs.buflen[0];
-	memcpy(data, &isakmp_cfg_config.pool_size, msg->bufs.buflen[1]);
-
-	if (privsep_send(privsep_sock[1], msg, len) != 0)
-		return;
-
-	if (privsep_recv(privsep_sock[1], &msg, &len) != 0)
-		return;
-
-	if (msg->hdr.ac_errno != 0)
-		errno = msg->hdr.ac_errno;
-
-	racoon_free(msg);
-	return;
-}
-#endif
diff --git a/src/racoon/privsep.h b/src/racoon/privsep.h
deleted file mode 100644
index 0fa4363..0000000
--- a/src/racoon/privsep.h
+++ /dev/null
@@ -1,72 +0,0 @@
-/*	$NetBSD: privsep.h,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
-
-/* Id: privsep.h,v 1.5 2005/06/07 12:22:11 fredsen Exp */
-
-/*
- * Copyright (C) 2004 Emmanuel Dreyfus
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _PRIVSEP_H
-#define _PRIVSEP_H
-
-#define PRIVSEP_EAY_GET_PKCS1PRIVKEY	0x0801	/* admin_com_bufs follows */
-#define PRIVSEP_SCRIPT_EXEC		0x0803	/* admin_com_bufs follows */
-#define PRIVSEP_GETPSK			0x0804	/* admin_com_bufs follows */
-#define PRIVSEP_XAUTH_LOGIN_SYSTEM	0x0805	/* admin_com_bufs follows */
-#define PRIVSEP_ACCOUNTING_PAM		0x0806	/* admin_com_bufs follows */
-#define PRIVSEP_XAUTH_LOGIN_PAM		0x0807	/* admin_com_bufs follows */
-#define PRIVSEP_CLEANUP_PAM		0x0808	/* admin_com_bufs follows */
-#define PRIVSEP_ACCOUNTING_SYSTEM	0x0809	/* admin_com_bufs follows */
-
-#define PRIVSEP_NBUF_MAX 24
-#define PRIVSEP_BUFLEN_MAX 4096
-struct admin_com_bufs {
-	size_t buflen[PRIVSEP_NBUF_MAX];
-	/* Followed by the buffers */
-};
-
-struct privsep_com_msg {
-	struct admin_com hdr;
-	struct admin_com_bufs bufs;
-};
-
-int privsep_init __P((void));
-
-vchar_t *privsep_eay_get_pkcs1privkey __P((char *));
-int privsep_pfkey_open __P((void));
-void privsep_pfkey_close __P((int));
-int privsep_script_exec __P((char *, int, char * const *));
-vchar_t *privsep_getpsk __P((const char *, const int));
-int privsep_xauth_login_system __P((char *, char *));
-#ifdef HAVE_LIBPAM
-int privsep_accounting_pam __P((int, int));
-int privsep_xauth_login_pam __P((int, struct sockaddr *, char *, char *));
-void privsep_cleanup_pam __P((int));
-#endif
-int privsep_accounting_system __P((int, struct sockaddr *, char *, int));
-#endif /* _PRIVSEP_H */
diff --git a/src/racoon/proposal.c b/src/racoon/proposal.c
deleted file mode 100644
index 26c9274..0000000
--- a/src/racoon/proposal.c
+++ /dev/null
@@ -1,1294 +0,0 @@
-/*	$NetBSD: proposal.c,v 1.13.4.2 2008/07/22 13:25:42 vanhu Exp $	*/
-
-/* $Id: proposal.c,v 1.13.4.2 2008/07/22 13:25:42 vanhu Exp $ */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/param.h>
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <sys/queue.h>
-
-#include <netinet/in.h>
-#include PATH_IPSEC_H
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-
-#include "var.h"
-#include "misc.h"
-#include "vmbuf.h"
-#include "plog.h"
-#include "sockmisc.h"
-#include "debug.h"
-
-#include "policy.h"
-#include "pfkey.h"
-#include "isakmp_var.h"
-#include "isakmp.h"
-#include "ipsec_doi.h"
-#include "algorithm.h"
-#include "proposal.h"
-#include "sainfo.h"
-#include "localconf.h"
-#include "remoteconf.h"
-#include "oakley.h"
-#include "handler.h"
-#include "strnames.h"
-#include "gcmalloc.h"
-#ifdef ENABLE_NATT
-#include "nattraversal.h"
-#endif
-
-static uint g_nextreqid = 1;
-
-/* %%%
- * modules for ipsec sa spec
- */
-struct saprop *
-newsaprop()
-{
-	struct saprop *new;
-
-	new = racoon_calloc(1, sizeof(*new));
-	if (new == NULL)
-		return NULL;
-
-	return new;
-}
-
-struct saproto *
-newsaproto()
-{
-	struct saproto *new;
-
-	new = racoon_calloc(1, sizeof(*new));
-	if (new == NULL)
-		return NULL;
-
-	return new;
-}
-
-/* set saprop to last part of the prop tree */
-void
-inssaprop(head, new)
-	struct saprop **head;
-	struct saprop *new;
-{
-	struct saprop *p;
-
-	if (*head == NULL) {
-		*head = new;
-		return;
-	}
-
-	for (p = *head; p->next; p = p->next)
-		;
-	p->next = new;
-
-	return;
-}
-
-/* set saproto to the end of the proto tree in saprop */
-void
-inssaproto(pp, new)
-	struct saprop *pp;
-	struct saproto *new;
-{
-	struct saproto *p;
-
-	for (p = pp->head; p && p->next; p = p->next)
-		;
-	if (p == NULL)
-		pp->head = new;
-	else
-		p->next = new;
-
-	return;
-}
-
-/* set saproto to the top of the proto tree in saprop */
-void
-inssaprotorev(pp, new)
-      struct saprop *pp;
-      struct saproto *new;
-{
-      new->next = pp->head;
-      pp->head = new;
-
-      return;
-}
-
-struct satrns *
-newsatrns()
-{
-	struct satrns *new;
-
-	new = racoon_calloc(1, sizeof(*new));
-	if (new == NULL)
-		return NULL;
-
-	return new;
-}
-
-/* set saproto to last part of the proto tree in saprop */
-void
-inssatrns(pr, new)
-	struct saproto *pr;
-	struct satrns *new;
-{
-	struct satrns *tr;
-
-	for (tr = pr->head; tr && tr->next; tr = tr->next)
-		;
-	if (tr == NULL)
-		pr->head = new;
-	else
-		tr->next = new;
-
-	return;
-}
-
-/*
- * take a single match between saprop.  allocate a new proposal and return it
- * for future use (like picking single proposal from a bundle).
- *	pp1: peer's proposal.
- *	pp2: my proposal.
- * NOTE: In the case of initiator, must be ensured that there is no
- * modification of the proposal by calling cmp_aproppair_i() before
- * this function.
- * XXX cannot understand the comment!
- */
-struct saprop *
-cmpsaprop_alloc(ph1, pp1, pp2, side)
-	struct ph1handle *ph1;
-	const struct saprop *pp1, *pp2;
-	int side;
-{
-	struct saprop *newpp = NULL;
-	struct saproto *pr1, *pr2, *newpr = NULL;
-	struct satrns *tr1, *tr2, *newtr;
-	const int ordermatters = 0;
-	int npr1, npr2;
-	int spisizematch;
-
-	newpp = newsaprop();
-	if (newpp == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to allocate saprop.\n");
-		return NULL;
-	}
-	newpp->prop_no = pp1->prop_no;
-
-	/* see proposal.h about lifetime/key length and PFS selection. */
-
-	/* check time/bytes lifetime and PFS */
-	switch (ph1->rmconf->pcheck_level) {
-	case PROP_CHECK_OBEY:
-		newpp->lifetime = pp1->lifetime;
-		newpp->lifebyte = pp1->lifebyte;
-		newpp->pfs_group = pp1->pfs_group;
-		break;
-
-	case PROP_CHECK_STRICT:
-		if (pp1->lifetime > pp2->lifetime) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"long lifetime proposed: "
-				"my:%d peer:%d\n",
-				(int)pp2->lifetime, (int)pp1->lifetime);
-			goto err;
-		}
-		if (pp1->lifebyte > pp2->lifebyte) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"long lifebyte proposed: "
-				"my:%d peer:%d\n",
-				pp2->lifebyte, pp1->lifebyte);
-			goto err;
-		}
-		newpp->lifetime = pp1->lifetime;
-		newpp->lifebyte = pp1->lifebyte;
-
-    prop_pfs_check:
-		if (pp2->pfs_group != 0 && pp1->pfs_group != pp2->pfs_group) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"pfs group mismatched: "
-				"my:%d peer:%d\n",
-				pp2->pfs_group, pp1->pfs_group);
-			goto err;
-		}
-		newpp->pfs_group = pp1->pfs_group;
-		break;
-
-	case PROP_CHECK_CLAIM:
-		/* lifetime */
-		if (pp1->lifetime <= pp2->lifetime) {
-			newpp->lifetime = pp1->lifetime;
-		} else {
-			newpp->lifetime = pp2->lifetime;
-			newpp->claim |= IPSECDOI_ATTR_SA_LD_TYPE_SEC;
-			plog(LLV_NOTIFY, LOCATION, NULL,
-				"use own lifetime: "
-				"my:%d peer:%d\n",
-				(int)pp2->lifetime, (int)pp1->lifetime);
-		}
-
-		/* lifebyte */
-		if (pp1->lifebyte > pp2->lifebyte) {
-			newpp->lifebyte = pp2->lifebyte;
-			newpp->claim |= IPSECDOI_ATTR_SA_LD_TYPE_SEC;
-			plog(LLV_NOTIFY, LOCATION, NULL,
-				"use own lifebyte: "
-				"my:%d peer:%d\n",
-				pp2->lifebyte, pp1->lifebyte);
-		}
-		newpp->lifebyte = pp1->lifebyte;
-
-    		goto prop_pfs_check;
-		break;
-
-	case PROP_CHECK_EXACT:
-		if (pp1->lifetime != pp2->lifetime) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"lifetime mismatched: "
-				"my:%d peer:%d\n",
-				(int)pp2->lifetime, (int)pp1->lifetime);
-			goto err;
-		}
-
-		if (pp1->lifebyte != pp2->lifebyte) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"lifebyte mismatched: "
-				"my:%d peer:%d\n",
-				pp2->lifebyte, pp1->lifebyte);
-			goto err;
-		}
-		if (pp1->pfs_group != pp2->pfs_group) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"pfs group mismatched: "
-				"my:%d peer:%d\n",
-				pp2->pfs_group, pp1->pfs_group);
-			goto err;
-		}
-		newpp->lifetime = pp1->lifetime;
-		newpp->lifebyte = pp1->lifebyte;
-		newpp->pfs_group = pp1->pfs_group;
-		break;
-
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid pcheck_level why?.\n");
-		goto err;
-	}
-
-#ifdef HAVE_SECCTX
-	/* check the security_context properties.
-	 * It is possible for one side to have a security context
-	 * and the other side doesn't. If so, this is an error.
-	 */
-
-	if (*pp1->sctx.ctx_str && !(*pp2->sctx.ctx_str)) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		     "My proposal missing security context\n");
-		goto err;
-	}
-	if (!(*pp1->sctx.ctx_str) && *pp2->sctx.ctx_str) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		     "Peer is missing security context\n");
-		goto err;
-	}
-
-	if (*pp1->sctx.ctx_str && *pp2->sctx.ctx_str) {
-		if (pp1->sctx.ctx_doi == pp2->sctx.ctx_doi)
-			newpp->sctx.ctx_doi = pp1->sctx.ctx_doi;
-		else {
-			plog(LLV_ERROR, LOCATION, NULL, 
-			     "sec doi mismatched: my:%d peer:%d\n",
-			     pp2->sctx.ctx_doi, pp1->sctx.ctx_doi);
-			     goto err;
-		}
-
-		if (pp1->sctx.ctx_alg == pp2->sctx.ctx_alg)
-			newpp->sctx.ctx_alg = pp1->sctx.ctx_alg;
-		else {
-			plog(LLV_ERROR, LOCATION, NULL,
-			     "sec alg mismatched: my:%d peer:%d\n",
-			     pp2->sctx.ctx_alg, pp1->sctx.ctx_alg);
-			goto err;
-		}
-
-		if ((pp1->sctx.ctx_strlen != pp2->sctx.ctx_strlen) ||
-		     memcmp(pp1->sctx.ctx_str, pp2->sctx.ctx_str,
-		     pp1->sctx.ctx_strlen) != 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			     "sec ctx string mismatched: my:%s peer:%s\n",
-			     pp2->sctx.ctx_str, pp1->sctx.ctx_str);
-				goto err;
-		} else {
-			newpp->sctx.ctx_strlen = pp1->sctx.ctx_strlen;
-			memcpy(newpp->sctx.ctx_str, pp1->sctx.ctx_str,
-				pp1->sctx.ctx_strlen);
-		}
-	}
-#endif /* HAVE_SECCTX */
-
-	npr1 = npr2 = 0;
-	for (pr1 = pp1->head; pr1; pr1 = pr1->next)
-		npr1++;
-	for (pr2 = pp2->head; pr2; pr2 = pr2->next)
-		npr2++;
-	if (npr1 != npr2)
-		goto err;
-
-	/* check protocol order */
-	pr1 = pp1->head;
-	pr2 = pp2->head;
-
-	while (1) {
-		if (!ordermatters) {
-			/*
-			 * XXX does not work if we have multiple proposals
-			 * with the same proto_id
-			 */
-			switch (side) {
-			case RESPONDER:
-				if (!pr2)
-					break;
-				for (pr1 = pp1->head; pr1; pr1 = pr1->next) {
-					if (pr1->proto_id == pr2->proto_id)
-						break;
-				}
-				break;
-			case INITIATOR:
-				if (!pr1)
-					break;
-				for (pr2 = pp2->head; pr2; pr2 = pr2->next) {
-					if (pr2->proto_id == pr1->proto_id)
-						break;
-				}
-				break;
-			}
-		}
-		if (!pr1 || !pr2)
-			break;
-
-		if (pr1->proto_id != pr2->proto_id) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"proto_id mismatched: "
-				"my:%s peer:%s\n",
-				s_ipsecdoi_proto(pr2->proto_id),
-				s_ipsecdoi_proto(pr1->proto_id));
-			goto err;
-		}
-		spisizematch = 0;
-		if (pr1->spisize == pr2->spisize)
-			spisizematch = 1;
-		else if (pr1->proto_id == IPSECDOI_PROTO_IPCOMP) {
-			/*
-			 * draft-shacham-ippcp-rfc2393bis-05.txt:
-			 * need to accept 16bit and 32bit SPI (CPI) for IPComp.
-			 */
-			if (pr1->spisize == sizeof(u_int16_t) &&
-			    pr2->spisize == sizeof(u_int32_t)) {
-				spisizematch = 1;
-			} else if (pr2->spisize == sizeof(u_int16_t) &&
-				 pr1->spisize == sizeof(u_int32_t)) {
-				spisizematch = 1;
-			}
-			if (spisizematch) {
-				plog(LLV_ERROR, LOCATION, NULL,
-				    "IPComp SPI size promoted "
-				    "from 16bit to 32bit\n");
-			}
-		}
-		if (!spisizematch) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"spisize mismatched: "
-				"my:%d peer:%d\n",
-				(int)pr2->spisize, (int)pr1->spisize);
-			goto err;
-		}
-
-#ifdef ENABLE_NATT
-		if ((ph1->natt_flags & NAT_DETECTED) && 
-		    natt_udp_encap (pr2->encmode))
-		{
-			plog(LLV_INFO, LOCATION, NULL, "Adjusting my encmode %s->%s\n",
-			     s_ipsecdoi_encmode(pr2->encmode),
-			     s_ipsecdoi_encmode(pr2->encmode - ph1->natt_options->mode_udp_diff));
-			pr2->encmode -= ph1->natt_options->mode_udp_diff;
-			pr2->udp_encap = 1;
-		}
-
-		if ((ph1->natt_flags & NAT_DETECTED) &&
-		    natt_udp_encap (pr1->encmode))
-		{
-			plog(LLV_INFO, LOCATION, NULL, "Adjusting peer's encmode %s(%d)->%s(%d)\n",
-			     s_ipsecdoi_encmode(pr1->encmode),
-			     pr1->encmode,
-			     s_ipsecdoi_encmode(pr1->encmode - ph1->natt_options->mode_udp_diff),
-			     pr1->encmode - ph1->natt_options->mode_udp_diff);
-			pr1->encmode -= ph1->natt_options->mode_udp_diff;
-			pr1->udp_encap = 1;
-		}
-#endif
-
-		if (pr1->encmode != pr2->encmode) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"encmode mismatched: "
-				"my:%s peer:%s\n",
-				s_ipsecdoi_encmode(pr2->encmode),
-				s_ipsecdoi_encmode(pr1->encmode));
-			goto err;
-		}
-
-		for (tr1 = pr1->head; tr1; tr1 = tr1->next) {
-			for (tr2 = pr2->head; tr2; tr2 = tr2->next) {
-				if (cmpsatrns(pr1->proto_id, tr1, tr2, ph1->rmconf->pcheck_level) == 0)
-					goto found;
-			}
-		}
-
-		goto err;
-
-	    found:
-		newpr = newsaproto();
-		if (newpr == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to allocate saproto.\n");
-			goto err;
-		}
-		newpr->proto_id = pr1->proto_id;
-		newpr->spisize = pr1->spisize;
-		newpr->encmode = pr1->encmode;
-		newpr->spi = pr2->spi;		/* copy my SPI */
-		newpr->spi_p = pr1->spi;	/* copy peer's SPI */
-		newpr->reqid_in = pr2->reqid_in;
-		newpr->reqid_out = pr2->reqid_out;
-#ifdef ENABLE_NATT
-		newpr->udp_encap = pr1->udp_encap | pr2->udp_encap;
-#endif
-
-		newtr = newsatrns();
-		if (newtr == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to allocate satrns.\n");
-			racoon_free(newpr);
-			goto err;
-		}
-		newtr->trns_no = tr1->trns_no;
-		newtr->trns_id = tr1->trns_id;
-		newtr->encklen = tr1->encklen;
-		newtr->authtype = tr1->authtype;
-
-		inssatrns(newpr, newtr);
-		inssaproto(newpp, newpr);
-
-		pr1 = pr1->next;
-		pr2 = pr2->next;
-	}
-
-	/* XXX should check if we have visited all items or not */
-	if (!ordermatters) {
-		switch (side) {
-		case RESPONDER:
-			if (!pr2)
-				pr1 = NULL;
-			break;
-		case INITIATOR:
-			if (!pr1)
-				pr2 = NULL;
-			break;
-		}
-	}
-
-	/* should be matched all protocols in a proposal */
-	if (pr1 != NULL || pr2 != NULL)
-		goto err;
-
-	return newpp;
-
-err:
-	flushsaprop(newpp);
-	return NULL;
-}
-
-/* take a single match between saprop.  returns 0 if pp1 equals to pp2. */
-int
-cmpsaprop(pp1, pp2)
-	const struct saprop *pp1, *pp2;
-{
-	if (pp1->pfs_group != pp2->pfs_group) {
-		plog(LLV_WARNING, LOCATION, NULL,
-			"pfs_group mismatch. mine:%d peer:%d\n",
-			pp1->pfs_group, pp2->pfs_group);
-		/* FALLTHRU */
-	}
-
-	if (pp1->lifetime > pp2->lifetime) {
-		plog(LLV_WARNING, LOCATION, NULL,
-			"less lifetime proposed. mine:%d peer:%d\n",
-			(int)pp1->lifetime, (int)pp2->lifetime);
-		/* FALLTHRU */
-	}
-	if (pp1->lifebyte > pp2->lifebyte) {
-		plog(LLV_WARNING, LOCATION, NULL,
-			"less lifebyte proposed. mine:%d peer:%d\n",
-			pp1->lifebyte, pp2->lifebyte);
-		/* FALLTHRU */
-	}
-
-	return 0;
-}
-
-/*
- * take a single match between satrns.  returns 0 if tr1 equals to tr2.
- * tr1: peer's satrns
- * tr2: my satrns
- */
-int
-cmpsatrns(proto_id, tr1, tr2, check_level)
-	int proto_id;
-	const struct satrns *tr1, *tr2;
-	int check_level;
-{
-	if (tr1->trns_id != tr2->trns_id) {
-		plog(LLV_WARNING, LOCATION, NULL,
-			"trns_id mismatched: "
-			"my:%s peer:%s\n",
-			s_ipsecdoi_trns(proto_id, tr2->trns_id),
-			s_ipsecdoi_trns(proto_id, tr1->trns_id));
-		return 1;
-	}
-
-	if (tr1->authtype != tr2->authtype) {
-		plog(LLV_WARNING, LOCATION, NULL,
-			"authtype mismatched: "
-			"my:%s peer:%s\n",
-			s_ipsecdoi_attr_v(IPSECDOI_ATTR_AUTH, tr2->authtype),
-			s_ipsecdoi_attr_v(IPSECDOI_ATTR_AUTH, tr1->authtype));
-		return 1;
-	}
-
-	/* Check key length regarding checkmode
-	 * XXX Shall we send some kind of notify message when key length rejected ?
-	 */
-	switch(check_level){
-	case PROP_CHECK_OBEY:
-		return 0;
-		break;
-
-	case PROP_CHECK_STRICT:
-		/* FALLTHROUGH */
-	case PROP_CHECK_CLAIM:
-		if (tr1->encklen < tr2->encklen) {
-		plog(LLV_WARNING, LOCATION, NULL,
-				 "low key length proposed, "
-				 "mine:%d peer:%d.\n",
-			tr2->encklen, tr1->encklen);
-			return 1;
-		}
-		break;
-	case PROP_CHECK_EXACT:
-		if (tr1->encklen != tr2->encklen) {
-			plog(LLV_WARNING, LOCATION, NULL,
-				 "key length mismatched, "
-				 "mine:%d peer:%d.\n",
-				 tr2->encklen, tr1->encklen);
-			return 1;
-		}
-		break;
-	}
-
-	return 0;
-}
-
-int
-set_satrnsbysainfo(pr, sainfo)
-	struct saproto *pr;
-	struct sainfo *sainfo;
-{
-	struct sainfoalg *a, *b;
-	struct satrns *newtr;
-	int t;
-
-	switch (pr->proto_id) {
-	case IPSECDOI_PROTO_IPSEC_AH:
-		if (sainfo->algs[algclass_ipsec_auth] == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"no auth algorithm found\n");
-			goto err;
-		}
-		t = 1;
-		for (a = sainfo->algs[algclass_ipsec_auth]; a; a = a->next) {
-
-			if (a->alg == IPSECDOI_ATTR_AUTH_NONE)
-				continue;
-				
-			/* allocate satrns */
-			newtr = newsatrns();
-			if (newtr == NULL) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"failed to allocate satrns.\n");
-				goto err;
-			}
-
-			newtr->trns_no = t++;
-			newtr->trns_id = ipsecdoi_authalg2trnsid(a->alg);
-			newtr->authtype = a->alg;
-
-			inssatrns(pr, newtr);
-		}
-		break;
-	case IPSECDOI_PROTO_IPSEC_ESP:
-		if (sainfo->algs[algclass_ipsec_enc] == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"no encryption algorithm found\n");
-			goto err;
-		}
-		t = 1;
-		for (a = sainfo->algs[algclass_ipsec_enc]; a; a = a->next) {
-			for (b = sainfo->algs[algclass_ipsec_auth]; b; b = b->next) {
-				/* allocate satrns */
-				newtr = newsatrns();
-				if (newtr == NULL) {
-					plog(LLV_ERROR, LOCATION, NULL,
-						"failed to allocate satrns.\n");
-					goto err;
-				}
-
-				newtr->trns_no = t++;
-				newtr->trns_id = a->alg;
-				newtr->encklen = a->encklen;
-				newtr->authtype = b->alg;
-
-				inssatrns(pr, newtr);
-			}
-		}
-		break;
-	case IPSECDOI_PROTO_IPCOMP:
-		if (sainfo->algs[algclass_ipsec_comp] == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"no ipcomp algorithm found\n");
-			goto err;
-		}
-		t = 1;
-		for (a = sainfo->algs[algclass_ipsec_comp]; a; a = a->next) {
-
-			/* allocate satrns */
-			newtr = newsatrns();
-			if (newtr == NULL) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"failed to allocate satrns.\n");
-				goto err;
-			}
-
-			newtr->trns_no = t++;
-			newtr->trns_id = a->alg;
-			newtr->authtype = IPSECDOI_ATTR_AUTH_NONE; /*no auth*/
-
-			inssatrns(pr, newtr);
-		}
-		break;
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"unknown proto_id (%d).\n", pr->proto_id);
-		goto err;
-	}
-
-	/* no proposal found */
-	if (pr->head == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "no algorithms found.\n");
-		return -1;
-	}
-
-	return 0;
-
-err:
-	flushsatrns(pr->head);
-	return -1;
-}
-
-struct saprop *
-aproppair2saprop(p0)
-	struct prop_pair *p0;
-{
-	struct prop_pair *p, *t;
-	struct saprop *newpp;
-	struct saproto *newpr;
-	struct satrns *newtr;
-	u_int8_t *spi;
-
-	if (p0 == NULL)
-		return NULL;
-
-	/* allocate ipsec a sa proposal */
-	newpp = newsaprop();
-	if (newpp == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to allocate saprop.\n");
-		return NULL;
-	}
-	newpp->prop_no = p0->prop->p_no;
-	/* lifetime & lifebyte must be updated later */
-
-	for (p = p0; p; p = p->next) {
-
-		/* allocate ipsec sa protocol */
-		newpr = newsaproto();
-		if (newpr == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to allocate saproto.\n");
-			goto err;
-		}
-
-		/* check spi size */
-		/* XXX should be handled isakmp cookie */
-		if (sizeof(newpr->spi) < p->prop->spi_size) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"invalid spi size %d.\n", p->prop->spi_size);
-			racoon_free(newpr);
-			goto err;
-		}
-
-		/*
-		 * XXX SPI bits are left-filled, for use with IPComp.
-		 * we should be switching to variable-length spi field...
-		 */
-		newpr->proto_id = p->prop->proto_id;
-		newpr->spisize = p->prop->spi_size;
-		memset(&newpr->spi, 0, sizeof(newpr->spi));
-		spi = (u_int8_t *)&newpr->spi;
-		spi += sizeof(newpr->spi);
-		spi -= p->prop->spi_size;
-		memcpy(spi, p->prop + 1, p->prop->spi_size);
-		newpr->reqid_in = 0;
-		newpr->reqid_out = 0;
-
-		for (t = p; t; t = t->tnext) {
-
-			plog(LLV_DEBUG, LOCATION, NULL,
-				"prop#=%d prot-id=%s spi-size=%d "
-				"#trns=%d trns#=%d trns-id=%s\n",
-				t->prop->p_no,
-				s_ipsecdoi_proto(t->prop->proto_id),
-				t->prop->spi_size, t->prop->num_t,
-				t->trns->t_no,
-				s_ipsecdoi_trns(t->prop->proto_id,
-				t->trns->t_id));
-
-			/* allocate ipsec sa transform */
-			newtr = newsatrns();
-			if (newtr == NULL) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"failed to allocate satrns.\n");
-				racoon_free(newpr);
-				goto err;
-			}
-
-			if (ipsecdoi_t2satrns(t->trns, 
-			    newpp, newpr, newtr) < 0) {
-				flushsaprop(newpp);
-				racoon_free(newtr);
-				racoon_free(newpr);
-				return NULL;
-			}
-
-			inssatrns(newpr, newtr);
-		}
-
-		/*
-		 * If the peer does not specify encryption mode, use 
-		 * transport mode by default.  This is to conform to
-		 * draft-shacham-ippcp-rfc2393bis-08.txt (explicitly specifies
-		 * that unspecified == transport), as well as RFC2407
-		 * (unspecified == implementation dependent default).
-		 */
-		if (newpr->encmode == 0)
-			newpr->encmode = IPSECDOI_ATTR_ENC_MODE_TRNS;
-
-		inssaproto(newpp, newpr);
-	}
-
-	return newpp;
-
-err:
-	flushsaprop(newpp);
-	return NULL;
-}
-
-void
-flushsaprop(head)
-	struct saprop *head;
-{
-	struct saprop *p, *save;
-
-	for (p = head; p != NULL; p = save) {
-		save = p->next;
-		flushsaproto(p->head);
-		racoon_free(p);
-	}
-
-	return;
-}
-
-void
-flushsaproto(head)
-	struct saproto *head;
-{
-	struct saproto *p, *save;
-
-	for (p = head; p != NULL; p = save) {
-		save = p->next;
-		flushsatrns(p->head);
-		vfree(p->keymat);
-		vfree(p->keymat_p);
-		racoon_free(p);
-	}
-
-	return;
-}
-
-void
-flushsatrns(head)
-	struct satrns *head;
-{
-	struct satrns *p, *save;
-
-	for (p = head; p != NULL; p = save) {
-		save = p->next;
-		racoon_free(p);
-	}
-
-	return;
-}
-
-/*
- * print multiple proposals
- */
-void
-printsaprop(pri, pp)
-	const int pri;
-	const struct saprop *pp;
-{
-	const struct saprop *p;
-
-	if (pp == NULL) {
-		plog(pri, LOCATION, NULL, "(null)");
-		return;
-	}
-
-	for (p = pp; p; p = p->next) {
-		printsaprop0(pri, p);
-	}
-
-	return;
-}
-
-/*
- * print one proposal.
- */
-void
-printsaprop0(pri, pp)
-	int pri;
-	const struct saprop *pp;
-{
-	const struct saproto *p;
-
-	if (pp == NULL)
-		return;
-
-	for (p = pp->head; p; p = p->next) {
-		printsaproto(pri, p);
-	}
-
-	return;
-}
-
-void
-printsaproto(pri, pr)
-	const int pri;
-	const struct saproto *pr;
-{
-	struct satrns *tr;
-
-	if (pr == NULL)
-		return;
-
-	plog(pri, LOCATION, NULL,
-		" (proto_id=%s spisize=%d spi=%08lx spi_p=%08lx "
-		"encmode=%s reqid=%d:%d)\n",
-		s_ipsecdoi_proto(pr->proto_id),
-		(int)pr->spisize,
-		(unsigned long)ntohl(pr->spi),
-		(unsigned long)ntohl(pr->spi_p),
-		s_ipsecdoi_attr_v(IPSECDOI_ATTR_ENC_MODE, pr->encmode),
-		(int)pr->reqid_in, (int)pr->reqid_out);
-
-	for (tr = pr->head; tr; tr = tr->next) {
-		printsatrns(pri, pr->proto_id, tr);
-	}
-
-	return;
-}
-
-void
-printsatrns(pri, proto_id, tr)
-	const int pri;
-	const int proto_id;
-	const struct satrns *tr;
-{
-	if (tr == NULL)
-		return;
-
-	switch (proto_id) {
-	case IPSECDOI_PROTO_IPSEC_AH:
-		plog(pri, LOCATION, NULL,
-			"  (trns_id=%s authtype=%s)\n",
-			s_ipsecdoi_trns(proto_id, tr->trns_id),
-			s_ipsecdoi_attr_v(IPSECDOI_ATTR_AUTH, tr->authtype));
-		break;
-	case IPSECDOI_PROTO_IPSEC_ESP:
-		plog(pri, LOCATION, NULL,
-			"  (trns_id=%s encklen=%d authtype=%s)\n",
-			s_ipsecdoi_trns(proto_id, tr->trns_id),
-			tr->encklen,
-			s_ipsecdoi_attr_v(IPSECDOI_ATTR_AUTH, tr->authtype));
-		break;
-	case IPSECDOI_PROTO_IPCOMP:
-		plog(pri, LOCATION, NULL,
-			"  (trns_id=%s)\n",
-			s_ipsecdoi_trns(proto_id, tr->trns_id));
-		break;
-	default:
-		plog(pri, LOCATION, NULL,
-			"(unknown proto_id %d)\n", proto_id);
-	}
-
-	return;
-}
-
-void
-print_proppair0(pri, p, level)
-	int pri; 
-	struct prop_pair *p;
-	int level;
-{
-	char spc[21];
-
-	memset(spc, ' ', sizeof(spc));
-	spc[sizeof(spc) - 1] = '\0';
-	if (level < 20) {
-		spc[level] = '\0';
-	}
-
-	plog(pri, LOCATION, NULL,
-		"%s%p: next=%p tnext=%p\n", spc, p, p->next, p->tnext);
-	if (p->next)
-		print_proppair0(pri, p->next, level + 1);
-	if (p->tnext)
-		print_proppair0(pri, p->tnext, level + 1);
-}
-
-void
-print_proppair(pri, p)
-	int pri;
-	struct prop_pair *p;
-{
-	print_proppair0(pri, p, 1);
-}
-
-int
-set_proposal_from_policy(iph2, sp_main, sp_sub)
-	struct ph2handle *iph2;
-	struct secpolicy *sp_main, *sp_sub;
-{
-	struct saprop *newpp;
-	struct ipsecrequest *req;
-	int encmodesv = IPSECDOI_ATTR_ENC_MODE_TRNS; /* use only when complex_bundle */
-
-	newpp = newsaprop();
-	if (newpp == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to allocate saprop.\n");
-		goto err;
-	}
-	newpp->prop_no = 1;
-	newpp->lifetime = iph2->sainfo->lifetime;
-	newpp->lifebyte = iph2->sainfo->lifebyte;
-	newpp->pfs_group = iph2->sainfo->pfs_group;
-
-	if (lcconf->complex_bundle)
-		goto skip1;
-
-	/*
-	 * decide the encryption mode of this SA bundle.
-	 * the mode becomes tunnel mode when there is even one policy
-	 * of tunnel mode in the SPD.  otherwise the mode becomes
-	 * transport mode.
-	 */
-	for (req = sp_main->req; req; req = req->next) {
-		if (req->saidx.mode == IPSEC_MODE_TUNNEL) {
-			encmodesv = pfkey2ipsecdoi_mode(req->saidx.mode);
-#ifdef ENABLE_NATT
-			if (iph2->ph1 && (iph2->ph1->natt_flags & NAT_DETECTED))
-				encmodesv += iph2->ph1->natt_options->mode_udp_diff;
-#endif
-			break;
-		}
-	}
-
-    skip1:
-	for (req = sp_main->req; req; req = req->next) {
-		struct saproto *newpr;
-		caddr_t paddr = NULL;
-
-		/*
-		 * check if SA bundle ?
-		 * nested SAs negotiation is NOT supported.
-		 *       me +--- SA1 ---+ peer1
-		 *       me +--- SA2 --------------+ peer2
-		 */
-#ifdef __linux__
-		if (req->saidx.src.ss_family && req->saidx.dst.ss_family) {
-#else
-		if (req->saidx.src.ss_len && req->saidx.dst.ss_len) {
-#endif
-			/* check the end of ip addresses of SA */
-			if (iph2->side == INITIATOR)
-				paddr = (caddr_t)&req->saidx.dst;
-			else
-				paddr = (caddr_t)&req->saidx.src;
-		}
-
-		/* allocate ipsec sa protocol */
-		newpr = newsaproto();
-		if (newpr == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to allocate saproto.\n");
-			goto err;
-		}
-
-		newpr->proto_id = ipproto2doi(req->saidx.proto);
-		if (newpr->proto_id == IPSECDOI_PROTO_IPCOMP)
-			newpr->spisize = 2;
-		else
-			newpr->spisize = 4;
-		if (lcconf->complex_bundle) {
-			newpr->encmode = pfkey2ipsecdoi_mode(req->saidx.mode);
-#ifdef ENABLE_NATT
-			if (iph2->ph1 && (iph2->ph1->natt_flags & NAT_DETECTED))
-				newpr->encmode += 
-				    iph2->ph1->natt_options->mode_udp_diff;
-#endif
-		}
-		else
-			newpr->encmode = encmodesv;
-
-		if (iph2->side == INITIATOR)
-			newpr->reqid_out = req->saidx.reqid;
-		else
-			newpr->reqid_in = req->saidx.reqid;
-
-		if (set_satrnsbysainfo(newpr, iph2->sainfo) < 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to get algorithms.\n");
-			racoon_free(newpr);
-			goto err;
-		}
-
-		/* set new saproto */
-		inssaprotorev(newpp, newpr);
-	}
-
-	/* get reqid_in from inbound policy */
-	if (sp_sub) {
-		struct saproto *pr;
-
-		req = sp_sub->req;
-		pr = newpp->head;
-		while (req && pr) {
-			if (iph2->side == INITIATOR)
-				pr->reqid_in = req->saidx.reqid;
-			else
-				pr->reqid_out = req->saidx.reqid;
-			pr = pr->next;
-			req = req->next;
-		}
-		if (pr || req) {
-			plog(LLV_NOTIFY, LOCATION, NULL,
-				"There is a difference "
-				"between the in/out bound policies in SPD.\n");
-		}
-	}
-
-	iph2->proposal = newpp;
-
-	printsaprop0(LLV_DEBUG, newpp);
-
-	return 0;
-err:
-	flushsaprop(newpp);
-	return -1;
-}
-
-/*
- * generate a policy from peer's proposal.
- * this function unconditionally choices first proposal in SA payload
- * passed by peer.
- */
-int
-set_proposal_from_proposal(iph2)
-	struct ph2handle *iph2;
-{
-        struct saprop *newpp = NULL, *pp0, *pp_peer = NULL;
-	struct saproto *newpr = NULL, *pr;
-	struct prop_pair **pair;
-	int error = -1;
-	int i;
-
-	/* get proposal pair */
-	pair = get_proppair(iph2->sa, IPSECDOI_TYPE_PH2);
-	if (pair == NULL)
-		goto end;
-
-	/*
-	 * make my proposal according as the client proposal.
-	 * XXX assumed there is only one proposal even if it's the SA bundle.
-	 */
-        for (i = 0; i < MAXPROPPAIRLEN; i++) {
-                if (pair[i] == NULL)
-                        continue;
-
-		if (pp_peer != NULL)
-			flushsaprop(pp_peer);
-
-		pp_peer = aproppair2saprop(pair[i]);
-		if (pp_peer == NULL)
-			goto end;
-
-		pp0 = newsaprop();
-		if (pp0 == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to allocate saprop.\n");
-			goto end;
-		}
-		pp0->prop_no = 1;
-		pp0->lifetime = iph2->sainfo->lifetime;
-		pp0->lifebyte = iph2->sainfo->lifebyte;
-		pp0->pfs_group = iph2->sainfo->pfs_group;
-
-#ifdef HAVE_SECCTX
-		if (*pp_peer->sctx.ctx_str) {
-			pp0->sctx.ctx_doi = pp_peer->sctx.ctx_doi;
-			pp0->sctx.ctx_alg = pp_peer->sctx.ctx_alg;
-			pp0->sctx.ctx_strlen = pp_peer->sctx.ctx_strlen;
-			memcpy(pp0->sctx.ctx_str, pp_peer->sctx.ctx_str,
-			       pp_peer->sctx.ctx_strlen);
-		}
-#endif /* HAVE_SECCTX */
-
-		if (pp_peer->next != NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"pp_peer is inconsistency, ignore it.\n");
-			/*FALLTHROUGH*/
-		}
-
-		for (pr = pp_peer->head; pr; pr = pr->next)
-		{
-			struct remoteconf *conf;
-
-			newpr = newsaproto();
-			if (newpr == NULL)
-			{
-				plog(LLV_ERROR, LOCATION, NULL,
-					"failed to allocate saproto.\n");
-				racoon_free(pp0);
-				goto end;
-			}
-			newpr->proto_id = pr->proto_id;
-			newpr->spisize = pr->spisize;
-			newpr->encmode = pr->encmode;
-			newpr->spi = 0;
-			newpr->spi_p = pr->spi;     /* copy peer's SPI */
-			newpr->reqid_in = 0;
-			newpr->reqid_out = 0;
-
-			conf = getrmconf(iph2->dst);
-			if (conf != NULL &&
-				conf->gen_policy == GENERATE_POLICY_UNIQUE){
-				newpr->reqid_in = g_nextreqid ;
-				newpr->reqid_out = g_nextreqid ++;
-				/* 
-				 * XXX there is a (very limited) 
-				 * risk of reusing the same reqid
-				 * as another SP entry for the same peer
-				 */
-				if(g_nextreqid >= IPSEC_MANUAL_REQID_MAX)
-					g_nextreqid = 1;
-			}else{
-				newpr->reqid_in = 0;
-				newpr->reqid_out = 0;
-			}
- 
-			if (set_satrnsbysainfo(newpr, iph2->sainfo) < 0)
-			{
-				plog(LLV_ERROR, LOCATION, NULL,
-					"failed to get algorithms.\n");
-				racoon_free(newpr);
-				racoon_free(pp0);
-				goto end;
-			}
-			inssaproto(pp0, newpr);
-		}
-
-		inssaprop(&newpp, pp0);
-        }
-
-	plog(LLV_DEBUG, LOCATION, NULL, "make a proposal from peer's:\n");
-	printsaprop0(LLV_DEBUG, newpp);  
-
-	iph2->proposal = newpp;
-
-	error = 0;
-
-end:
-	if (error && newpp)
-		flushsaprop(newpp);
-
-	if (pp_peer)
-		flushsaprop(pp_peer);
-	if (pair)
-		free_proppair(pair);
-	return error;
-}
diff --git a/src/racoon/proposal.h b/src/racoon/proposal.h
deleted file mode 100644
index 60fc531..0000000
--- a/src/racoon/proposal.h
+++ /dev/null
@@ -1,214 +0,0 @@
-/*	$NetBSD: proposal.h,v 1.6 2006/12/09 05:52:57 manu Exp $	*/
-
-/* Id: proposal.h,v 1.5 2004/06/11 16:00:17 ludvigm Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _PROPOSAL_H
-#define _PROPOSAL_H
-
-#include <sys/queue.h>
-
-/*
- *   A. chained list of transform, only for single proto_id
- *      (this is same as set of transforms in single proposal payload)
- *   B. proposal.  this will point to multiple (A) items (order is important
- *      here so pointer to (A) must be ordered array, or chained list). 
- *      this covers multiple proposal on a packet if proposal # is the same.
- *   C. finally, (B) needs to be connected as chained list.
- * 
- * 	head ---> prop[.......] ---> prop[...] ---> prop[...] ---> ...
- * 	               | | | |
- * 	               | | | +- proto4  <== must preserve order here
- * 	               | | +--- proto3
- * 	               | +----- proto2
- * 	               +------- proto1[trans1, trans2, trans3, ...]
- *
- *   incoming packets needs to be parsed to construct the same structure
- *   (check "prop_pair" too).
- */
-/* SA proposal specification */
-struct saprop {
-	int prop_no;
-	time_t lifetime;
-	int lifebyte;
-	int pfs_group;			/* pfs group */
-	int claim;			/* flag to send RESPONDER-LIFETIME. */
-					/* XXX assumed DOI values are 1 or 2. */
-#ifdef HAVE_SECCTX
-	struct security_ctx sctx;       /* security context structure */
-#endif
-	struct saproto *head;
-	struct saprop *next;
-};
-
-/* SA protocol specification */
-struct saproto {
-	int proto_id;
-	size_t spisize;			/* spi size */
-	int encmode;			/* encryption mode */
-
-	int udp_encap;			/* UDP encapsulation */
-
-	/* XXX should be vchar_t * */
-	/* these are network byte order */
-	u_int32_t spi;			/* inbound. i.e. --SA-> me */
-	u_int32_t spi_p;		/* outbound. i.e. me -SA-> */
-
-	vchar_t *keymat;		/* KEYMAT */
-	vchar_t *keymat_p;		/* peer's KEYMAT */
-
-	int reqid_out;			/* request id (outbound) */
-	int reqid_in;			/* request id (inbound) */
-
-	int ok;				/* if 1, success to set SA in kenrel */
-
-	struct satrns *head;		/* header of transform */
-	struct saproto *next;		/* next protocol */
-};
-
-/* SA algorithm specification */
-struct satrns {
-	int trns_no;
-	int trns_id;			/* transform id */
-	int encklen;			/* key length of encryption algorithm */
-	int authtype;			/* authentication algorithm if ESP */
-
-	struct satrns *next;		/* next transform */
-};
-
-/*
- * prop_pair: (proposal number, transform number)
- *
- *	(SA (P1 (T1 T2)) (P1' (T1' T2')) (P2 (T1" T2")))
- *
- *              p[1]      p[2]
- *      top     (P1,T1)   (P2",T1")
- *		 |  |tnext     |tnext
- *		 |  v          v
- *		 | (P1, T2)   (P2", T2")
- *		 v next
- *		(P1', T1')
- *		    |tnext
- *		    v
- *		   (P1', T2')
- *
- * when we convert it to saprop in prop2saprop(), it should become like:
- * 
- * 		 (next)
- * 	saprop --------------------> saprop	
- * 	 | (head)                     | (head)
- * 	 +-> saproto                  +-> saproto
- * 	      | | (head)                     | (head)
- * 	      | +-> satrns(P1 T1)            +-> satrns(P2" T1")
- * 	      |      | (next)                     | (next)
- * 	      |      v                            v
- * 	      |     satrns(P1, T2)               satrns(P2", T2")
- * 	      v (next)
- * 	     saproto
- * 		| (head)
- * 		+-> satrns(P1' T1')
- * 		     | (next)
- * 		     v
- * 		    satrns(P1', T2')
- */
-struct prop_pair {
-	struct isakmp_pl_p *prop;
-	struct isakmp_pl_t *trns;
-	struct prop_pair *next;	/* next prop_pair with same proposal # */
-				/* (bundle case) */
-	struct prop_pair *tnext; /* next prop_pair in same proposal payload */
-				/* (multiple tranform case) */
-};
-#define MAXPROPPAIRLEN	256	/* It's enough because field size is 1 octet. */
-
-/*
- * Lifetime length selection refered to the section 4.5.4 of RFC2407.  It does
- * not completely conform to the description of RFC.  There are four types of
- * the behavior.  If the value of "proposal_check" in "remote" directive is;
- *     "obey"
- *         the responder obey the initiator anytime.
- *     "strict"
- *         If the responder's length is longer than the initiator's one, the
- *         responder uses the intitiator's one.  Otherwise rejects the proposal.
- *         If PFS is not required by the responder, the responder obeys the
- *         proposal.  If PFS is required by both sides and if the responder's
- *         group is not equal to the initiator's one, then the responder reject
- *         the proposal.
- *     "claim"
- *         If the responder's length is longer than the initiator's one, the
- *         responder use the intitiator's one.  If the responder's length is
- *         shorter than the initiator's one, the responder uses own length
- *         AND send RESPONDER-LIFETIME notify message to a initiator in the
- *         case of lifetime.
- *         About PFS, this directive is same as "strict".
- *     "exact"
- *         If the initiator's length is not equal to the responder's one, the
- *         responder rejects the proposal.
- *         If PFS is required and if the responder's group is not equal to
- *         the initiator's one, then the responder reject the proposal.
- * XXX should be defined the behavior of key length.
- */
-#define PROP_CHECK_OBEY		1
-#define PROP_CHECK_STRICT	2
-#define PROP_CHECK_CLAIM	3
-#define PROP_CHECK_EXACT	4
-
-struct sainfo;
-struct ph1handle;
-struct secpolicy;
-extern struct saprop *newsaprop __P((void));
-extern struct saproto *newsaproto __P((void));
-extern void inssaprop __P((struct saprop **, struct saprop *));
-extern void inssaproto __P((struct saprop *, struct saproto *));
-extern void inssaprotorev __P((struct saprop *, struct saproto *));
-extern struct satrns *newsatrns __P((void));
-extern void inssatrns __P((struct saproto *, struct satrns *));
-extern struct saprop *cmpsaprop_alloc __P((struct ph1handle *,
-	const struct saprop *, const struct saprop *, int));
-extern int cmpsaprop __P((const struct saprop *, const struct saprop *));
-extern int cmpsatrns __P((int, const struct satrns *, const struct satrns *, int));
-extern int set_satrnsbysainfo __P((struct saproto *, struct sainfo *));
-extern struct saprop *aproppair2saprop __P((struct prop_pair *));
-extern void free_proppair __P((struct prop_pair **));
-extern void flushsaprop __P((struct saprop *));
-extern void flushsaproto __P((struct saproto *));
-extern void flushsatrns __P((struct satrns *));
-extern void printsaprop __P((const int, const struct saprop *));
-extern void printsaprop0 __P((const int, const struct saprop *));
-extern void printsaproto __P((const int, const struct saproto *));
-extern void printsatrns __P((const int, const int, const struct satrns *));
-extern void print_proppair0 __P((int, struct prop_pair *, int));
-extern void print_proppair __P((int, struct prop_pair *));
-extern int set_proposal_from_policy __P((struct ph2handle *,
-	struct secpolicy *, struct secpolicy *));
-extern int set_proposal_from_proposal __P((struct ph2handle *));
-
-#endif /* _PROPOSAL_H */
diff --git a/src/racoon/prsa_par.h b/src/racoon/prsa_par.h
deleted file mode 100644
index 3bdb11d..0000000
--- a/src/racoon/prsa_par.h
+++ /dev/null
@@ -1,110 +0,0 @@
-/* A Bison parser, made by GNU Bison 2.3.  */
-
-/* Skeleton interface for Bison's Yacc-like parsers in C
-
-   Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
-   Free Software Foundation, Inc.
-
-   This program is free software; you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2, or (at your option)
-   any later version.
-
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   GNU General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 51 Franklin Street, Fifth Floor,
-   Boston, MA 02110-1301, USA.  */
-
-/* As a special exception, you may create a larger work that contains
-   part or all of the Bison parser skeleton and distribute that work
-   under terms of your choice, so long as that work isn't itself a
-   parser generator using the skeleton or a modified version thereof
-   as a parser skeleton.  Alternatively, if you modify or redistribute
-   the parser skeleton itself, you may (at your option) remove this
-   special exception, which will cause the skeleton and the resulting
-   Bison output files to be licensed under the GNU General Public
-   License without this special exception.
-
-   This special exception was added by the Free Software Foundation in
-   version 2.2 of Bison.  */
-
-/* Tokens.  */
-#ifndef YYTOKENTYPE
-# define YYTOKENTYPE
-   /* Put the tokens into the symbol table, so that GDB and other debuggers
-      know about them.  */
-   enum yytokentype {
-     COLON = 258,
-     HEX = 259,
-     OBRACE = 260,
-     EBRACE = 261,
-     TAG_RSA = 262,
-     TAG_PUB = 263,
-     TAG_PSK = 264,
-     MODULUS = 265,
-     PUBLIC_EXPONENT = 266,
-     PRIVATE_EXPONENT = 267,
-     PRIME1 = 268,
-     PRIME2 = 269,
-     EXPONENT1 = 270,
-     EXPONENT2 = 271,
-     COEFFICIENT = 272,
-     ADDR4 = 273,
-     ADDR6 = 274,
-     ADDRANY = 275,
-     SLASH = 276,
-     NUMBER = 277,
-     BASE64 = 278
-   };
-#endif
-/* Tokens.  */
-#define COLON 258
-#define HEX 259
-#define OBRACE 260
-#define EBRACE 261
-#define TAG_RSA 262
-#define TAG_PUB 263
-#define TAG_PSK 264
-#define MODULUS 265
-#define PUBLIC_EXPONENT 266
-#define PRIVATE_EXPONENT 267
-#define PRIME1 268
-#define PRIME2 269
-#define EXPONENT1 270
-#define EXPONENT2 271
-#define COEFFICIENT 272
-#define ADDR4 273
-#define ADDR6 274
-#define ADDRANY 275
-#define SLASH 276
-#define NUMBER 277
-#define BASE64 278
-
-
-
-
-#if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
-typedef union YYSTYPE
-#line 130 "prsa_par.y"
-{
-	BIGNUM *bn;
-	RSA *rsa;
-	char *chr;
-	long num;
-	struct netaddr *naddr;
-}
-/* Line 1489 of yacc.c.  */
-#line 103 "prsa_par.h"
-	YYSTYPE;
-# define yystype YYSTYPE /* obsolescent; will be withdrawn */
-# define YYSTYPE_IS_DECLARED 1
-# define YYSTYPE_IS_TRIVIAL 1
-#endif
-
-extern YYSTYPE prsalval;
-
diff --git a/src/racoon/prsa_par.y b/src/racoon/prsa_par.y
deleted file mode 100644
index f21a82b..0000000
--- a/src/racoon/prsa_par.y
+++ /dev/null
@@ -1,350 +0,0 @@
-/*	$NetBSD: prsa_par.y,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
-
-/* Id: prsa_par.y,v 1.3 2004/11/08 12:04:23 ludvigm Exp */
-
-%{
-/*
- * Copyright (C) 2004 SuSE Linux AG, Nuernberg, Germany.
- * Contributed by: Michal Ludvig <mludvig@suse.cz>, SUSE Labs
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-/* This file contains a parser for FreeS/WAN-style ipsec.secrets RSA keys. */
-
-#include "config.h"
-
-#include <stdio.h>
-#include <stdarg.h>
-#include <string.h>
-#include <errno.h>
-#include <unistd.h>
-
-#ifdef HAVE_STDARG_H
-#include <stdarg.h>
-#else
-#include <varargs.h>
-#endif
-
-#include <netdb.h>
-#include <netinet/in.h>
-#include <sys/socket.h>
-#include <arpa/inet.h>
-#include <sys/types.h>
-
-#include <sys/stat.h>
-#include <unistd.h>
-
-#include <openssl/bn.h>
-#include <openssl/rsa.h>
-
-#include "misc.h"
-#include "vmbuf.h"
-#include "plog.h"
-#include "oakley.h"
-#include "isakmp_var.h"
-#include "handler.h"
-#include "crypto_openssl.h"
-#include "sockmisc.h"
-#include "rsalist.h"
-
-extern void prsaerror(const char *str, ...);
-extern int prsawrap (void);
-extern int prsalex (void);
-
-extern char *prsatext;
-extern int prsa_cur_lineno;
-extern char *prsa_cur_fname;
-extern FILE *prsain;
-
-int prsa_cur_lineno = 0;
-char *prsa_cur_fname = NULL;
-struct genlist *prsa_cur_list = NULL;
-enum rsa_key_type prsa_cur_type = RSA_TYPE_ANY;
-
-static RSA *rsa_cur;
-
-void
-prsaerror(const char *s, ...)
-{
-	char fmt[512];
-
-	va_list ap;
-#ifdef HAVE_STDARG_H
-	va_start(ap, s);
-#else
-	va_start(ap);
-#endif
-	snprintf(fmt, sizeof(fmt), "%s:%d: %s",
-		prsa_cur_fname, prsa_cur_lineno, s);
-	plogv(LLV_ERROR, LOCATION, NULL, fmt, ap);
-	va_end(ap);
-}
-
-void
-prsawarning(const char *s, ...)
-{
-	char fmt[512];
-
-	va_list ap;
-#ifdef HAVE_STDARG_H
-	va_start(ap, s);
-#else
-	va_start(ap);
-#endif
-	snprintf(fmt, sizeof(fmt), "%s:%d: %s",
-		prsa_cur_fname, prsa_cur_lineno, s);
-	plogv(LLV_WARNING, LOCATION, NULL, fmt, ap);
-	va_end(ap);
-}
-
-int
-prsawrap()
-{
-	return 1;
-} 
-%}
-%union {
-	BIGNUM *bn;
-	RSA *rsa;
-	char *chr;
-	long num;
-	struct netaddr *naddr;
-}
-
-%token COLON HEX
-%token OBRACE EBRACE COLON HEX
-%token TAG_RSA TAG_PUB TAG_PSK
-%token MODULUS PUBLIC_EXPONENT PRIVATE_EXPONENT 
-%token PRIME1 PRIME2 EXPONENT1 EXPONENT2 COEFFICIENT
-%token ADDR4 ADDR6 ADDRANY SLASH NUMBER BASE64
-
-%type <bn>	HEX
-%type <num>	NUMBER
-%type <chr>	ADDR4 ADDR6 BASE64
-
-%type <rsa>	rsa_statement
-%type <num>	prefix
-%type <naddr>	addr4 addr6 addr
-
-%%
-statements:
-	statements statement
-	| statement
-	;
-
-statement:
-	addr addr COLON rsa_statement
-	{
-		rsa_key_insert(prsa_cur_list, $1, $2, $4);
-	}
-	| addr COLON rsa_statement 
-	{
-		rsa_key_insert(prsa_cur_list, NULL, $1, $3);
-	}
-	| COLON rsa_statement 
-	{
-		rsa_key_insert(prsa_cur_list, NULL, NULL, $2);
-	}
-	;
-
-rsa_statement:
-	TAG_RSA OBRACE params EBRACE
-	{
-		if (prsa_cur_type == RSA_TYPE_PUBLIC) {
-			prsawarning("Using private key for public key purpose.\n");
-			if (!rsa_cur->n || !rsa_cur->e) {
-				prsaerror("Incomplete key. Mandatory parameters are missing!\n");
-				YYABORT;
-			}
-		}
-		else {
-			if (!rsa_cur->n || !rsa_cur->e || !rsa_cur->d) {
-				prsaerror("Incomplete key. Mandatory parameters are missing!\n");
-				YYABORT;
-			}
-			if (!rsa_cur->p || !rsa_cur->q || !rsa_cur->dmp1
-			    || !rsa_cur->dmq1 || !rsa_cur->iqmp) {
-				if (rsa_cur->p) BN_clear_free(rsa_cur->p);
-				if (rsa_cur->q) BN_clear_free(rsa_cur->q);
-				if (rsa_cur->dmp1) BN_clear_free(rsa_cur->dmp1);
-				if (rsa_cur->dmq1) BN_clear_free(rsa_cur->dmq1);
-				if (rsa_cur->iqmp) BN_clear_free(rsa_cur->iqmp);
-
-				rsa_cur->p = NULL;
-				rsa_cur->q = NULL;
-				rsa_cur->dmp1 = NULL;
-				rsa_cur->dmq1 = NULL;
-				rsa_cur->iqmp = NULL;
-			}
-		}
-		$$ = rsa_cur;
-		rsa_cur = RSA_new();
-	}
-	| TAG_PUB BASE64
-	{
-		if (prsa_cur_type == RSA_TYPE_PRIVATE) {
-			prsaerror("Public key in private-key file!\n");
-			YYABORT;
-		}
-		$$ = base64_pubkey2rsa($2);
-	}
-	| TAG_PUB HEX
-	{
-		if (prsa_cur_type == RSA_TYPE_PRIVATE) {
-			prsaerror("Public key in private-key file!\n");
-			YYABORT;
-		}
-		$$ = bignum_pubkey2rsa($2);
-	}
-	;
-
-addr:
-	addr4
-	| addr6
-	| ADDRANY
-	{
-		$$ = NULL;
-	}
-	;
-
-addr4:
-	ADDR4 prefix
-	{
-		int err;
-		struct sockaddr_in *sap;
-		
-		if ($2 == -1) $2 = 32;
-		if ($2 < 0 || $2 > 32) {
-			prsaerror ("Invalid IPv4 prefix\n");
-			YYABORT;
-		}
-		$$ = calloc (sizeof(struct netaddr), 1);
-		$$->prefix = $2;
-		sap = (struct sockaddr_in *)(&$$->sa);
-		sap->sin_family = AF_INET;
-		err = inet_pton(AF_INET, $1, (struct in_addr*)(&sap->sin_addr));
-		if (err <= 0) {
-			prsaerror("inet_pton(%s): %s\n", $1, strerror(errno));
-			YYABORT;
-		}
-	}
-	;
-
-addr6:
-	ADDR6 prefix
-	{
-		int err;
-		struct sockaddr_in6 *sap;
-		
-		if ($2 == -1) $2 = 128;
-		if ($2 < 0 || $2 > 128) {
-			prsaerror ("Invalid IPv6 prefix\n");
-			YYABORT;
-		}
-		$$ = calloc (sizeof(struct netaddr), 1);
-		$$->prefix = $2;
-		sap = (struct sockaddr_in6 *)(&$$->sa);
-		sap->sin6_family = AF_INET6;
-		err = inet_pton(AF_INET6, $1, (struct in6_addr*)(&sap->sin6_addr));
-		if (err <= 0) {
-			prsaerror("inet_pton(%s): %s\n", $1, strerror(errno));
-			YYABORT;
-		}
-	}
-	;
-
-prefix:
-	/* nothing */ { $$ = -1; }
-	| SLASH NUMBER { $$ = $2; }
-	;
-params:
-	params param
-	| param
-	;
-
-param:
-	MODULUS COLON HEX 
-	{ if (!rsa_cur->n) rsa_cur->n = $3; else { prsaerror ("Modulus already defined\n"); YYABORT; } }
-	| PUBLIC_EXPONENT COLON HEX 
-	{ if (!rsa_cur->e) rsa_cur->e = $3; else { prsaerror ("PublicExponent already defined\n"); YYABORT; } }
-	| PRIVATE_EXPONENT COLON HEX 
-	{ if (!rsa_cur->d) rsa_cur->d = $3; else { prsaerror ("PrivateExponent already defined\n"); YYABORT; } }
-	| PRIME1 COLON HEX 
-	{ if (!rsa_cur->p) rsa_cur->p = $3; else { prsaerror ("Prime1 already defined\n"); YYABORT; } }
-	| PRIME2 COLON HEX 
-	{ if (!rsa_cur->q) rsa_cur->q = $3; else { prsaerror ("Prime2 already defined\n"); YYABORT; } }
-	| EXPONENT1 COLON HEX 
-	{ if (!rsa_cur->dmp1) rsa_cur->dmp1 = $3; else { prsaerror ("Exponent1 already defined\n"); YYABORT; } }
-	| EXPONENT2 COLON HEX 
-	{ if (!rsa_cur->dmq1) rsa_cur->dmq1 = $3; else { prsaerror ("Exponent2 already defined\n"); YYABORT; } }
-	| COEFFICIENT COLON HEX 
-	{ if (!rsa_cur->iqmp) rsa_cur->iqmp = $3; else { prsaerror ("Coefficient already defined\n"); YYABORT; } }
-	;
-%%
-
-int prsaparse(void);
-
-int
-prsa_parse_file(struct genlist *list, char *fname, enum rsa_key_type type)
-{
-	FILE *fp = NULL;
-	int ret;
-	
-	if (!fname)
-		return -1;
-	if (type == RSA_TYPE_PRIVATE) {
-		struct stat st;
-		if (stat(fname, &st) < 0)
-			return -1;
-		if (st.st_mode & (S_IRWXG | S_IRWXO)) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"Too slack permissions on private key '%s'\n", 
-				fname);
-			plog(LLV_ERROR, LOCATION, NULL,
-				"Should be at most 0600, now is 0%o\n",
-				st.st_mode & 0777);
-			return -1;
-		}
-	}
-	fp = fopen(fname, "r");
-	if (!fp)
-		return -1;
-	prsain = fp;
-	prsa_cur_lineno = 1;
-	prsa_cur_fname = fname;
-	prsa_cur_list = list;
-	prsa_cur_type = type;
-	rsa_cur = RSA_new();
-	ret = prsaparse();
-	if (rsa_cur) {
-		RSA_free(rsa_cur);
-		rsa_cur = NULL;
-	}
-	fclose (fp);
-	prsain = NULL;
-	return ret;
-}
diff --git a/src/racoon/prsa_tok.l b/src/racoon/prsa_tok.l
deleted file mode 100644
index 83e3d14..0000000
--- a/src/racoon/prsa_tok.l
+++ /dev/null
@@ -1,89 +0,0 @@
-/*	$NetBSD: prsa_tok.l,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
-
-/* Id: prsa_tok.l,v 1.2 2004/07/12 20:43:51 ludvigm Exp */
-
-%{
-/*
- * Copyright (C) 2004 SuSE Linux AG, Nuernberg, Germany.
- * Contributed by: Michal Ludvig <mludvig@suse.cz>, SUSE Labs
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-/* This file contains a tokeniser for FreeS/WAN-style ipsec.secrets RSA keys. */
-
-#include <string.h>
-#include <openssl/bn.h>
-#include <openssl/rsa.h>
-#include "prsa_par.h"
-
-extern int prsalex (void);
-extern int prsa_cur_lineno;
-
-%}
-
-comment		\#.*
-digit		[0-9]
-octet		(([01]?{digit}?{digit})|((2([0-4]{digit}))|(25[0-5])))
-addr4		{octet}\.{octet}\.{octet}\.{octet}
-hex		[0-9a-fA-F]
-word6		{hex}{0,4}
-base64		[A-Za-z0-9+/=]
-addr6		(::({word6}|{addr4})?|({word6}:)+:?({word6}|{addr4})?)
-%%
-\{		{ return OBRACE; }
-\}		{ return EBRACE; }
-:		{ return COLON; }
-RSA		{ return TAG_RSA; }
-PSK		{ return TAG_PSK; }
-PUB		{ return TAG_PUB; }
-0x[0-9a-fA-F]+	{ 
-			BIGNUM *bn = BN_new();
-			BN_hex2bn(&bn, prsatext+2);
-			prsalval.bn = bn;
-			return HEX;
-		}
-0s{base64}+	{
-			prsalval.chr = strdup(prsatext);
-			return BASE64;
-		}
-Modulus		{ return MODULUS; }
-PublicExponent	{ return PUBLIC_EXPONENT; }
-PrivateExponent	{ return PRIVATE_EXPONENT; }
-Prime1		{ return PRIME1; }
-Prime2		{ return PRIME2; }
-Exponent1	{ return EXPONENT1; }
-Exponent2	{ return EXPONENT2; }
-Coefficient	{ return COEFFICIENT; }
-\/		{ return SLASH; }
-{digit}+	{ prsalval.num = atol(prsatext); return NUMBER; }
-any		{ return ADDRANY; }
-{addr4}		{ prsalval.chr = strdup(prsatext); return ADDR4; }
-{addr6}		{ prsalval.chr = strdup(prsatext); return ADDR6; }
-[ \t]*		;
-\n		{ prsa_cur_lineno++; }
-\#.*		;
-%%
diff --git a/src/racoon/racoon.8 b/src/racoon/racoon.8
deleted file mode 100644
index a6d39d7..0000000
--- a/src/racoon/racoon.8
+++ /dev/null
@@ -1,155 +0,0 @@
-.\"	$NetBSD: racoon.8,v 1.10 2006/09/09 16:22:10 manu Exp $
-.\"
-.\" Id: racoon.8,v 1.4 2005/04/18 11:07:55 manubsd Exp
-.\"
-.\" Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
-.\" All rights reserved.
-.\"
-.\" Redistribution and use in source and binary forms, with or without
-.\" modification, are permitted provided that the following conditions
-.\" are met:
-.\" 1. Redistributions of source code must retain the above copyright
-.\"    notice, this list of conditions and the following disclaimer.
-.\" 2. Redistributions in binary form must reproduce the above copyright
-.\"    notice, this list of conditions and the following disclaimer in the
-.\"    documentation and/or other materials provided with the distribution.
-.\" 3. Neither the name of the project nor the names of its contributors
-.\"    may be used to endorse or promote products derived from this software
-.\"    without specific prior written permission.
-.\"
-.\" THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
-.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
-.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-.\" SUCH DAMAGE.
-.\"
-.Dd November 20, 2000
-.Dt RACOON 8
-.Os
-.\"
-.Sh NAME
-.Nm racoon
-.Nd IKE (ISAKMP/Oakley) key management daemon
-.\"
-.Sh SYNOPSIS
-.Nm racoon
-.Bk -words
-.Op Fl 46BdFLv
-.Ek
-.Bk -words
-.Op Fl f Ar configfile
-.Ek
-.Bk -words
-.Op Fl l Ar logfile
-.Ek
-.Bk -words
-.Op Fl P Ar isakmp-natt-port
-.Ek
-.Bk -words
-.Op Fl p Ar isakmp-port
-.Ek
-.\"
-.Sh DESCRIPTION
-.Nm
-speaks the IKE
-.Pq ISAKMP/Oakley
-key management protocol,
-to establish security associations with other hosts.
-The SPD
-.Pq Security Policy Database
-in the kernel usually triggers
-.Nm .
-.Nm
-usually sends all informational messages, warnings and error messages to
-.Xr syslogd 8
-with the facility
-.Dv LOG_DAEMON
-and the priority
-.Dv LOG_INFO .
-Debugging messages are sent with the priority
-.Dv LOG_DEBUG .
-You should configure
-.Xr syslog.conf 5
-appropriately to see these messages.
-.Bl -tag -width Ds
-.It Fl 4
-.It Fl 6
-Specify the default address family for the sockets.
-.It Fl B
-Install SA(s) from the file which is specified in
-.Xr racoon.conf 5 .
-.It Fl d
-Increase the debug level.
-Multiple
-.Fl d
-arguments will increase the debug level even more.
-.It Fl F
-Run
-.Nm
-in the foreground.
-.It Fl f Ar configfile
-Use
-.Ar configfile
-as the configuration file instead of the default.
-.It Fl L
-Include
-.Ar file_name:line_number:function_name
-in all messages.
-.It Fl l Ar logfile
-Use
-.Ar logfile
-as the logging file instead of
-.Xr syslogd 8 .
-.It Fl P Ar isakmp-natt-port
-Use
-.Ar isakmp-natt-port
-for NAT-Traversal port-floating.
-The default is 4500.
-.It Fl p Ar isakmp-port
-Listen to the ISAKMP key exchange on port
-.Ar isakmp-port
-instead of the default port number, 500.
-.It Fl v
-This flag causes the packet dump be more verbose, with higher
-debugging level.
-.El
-.Pp
-.Nm
-assumes the presence of the kernel random number device
-.Xr rnd 4
-at
-.Pa /dev/urandom .
-.\"
-.Sh RETURN VALUES
-The command exits with 0 on success, and non-zero on errors.
-.\"
-.Sh FILES
-.Bl -tag -width /etc/racoon.conf -compact
-.It Pa /etc/racoon.conf
-default configuration file.
-.El
-.\"
-.Sh SEE ALSO
-.Xr ipsec 4 ,
-.Xr racoon.conf 5 ,
-.Xr syslog.conf 5 ,
-.Xr setkey 8 ,
-.Xr syslogd 8
-.\"
-.Sh HISTORY
-The
-.Nm
-command first appeared in the
-.Dq YIPS
-Yokogawa IPsec implementation.
-.\"
-.Sh SECURITY CONSIDERATIONS
-The use of IKE phase 1 aggressive mode is not recommended,
-as described in
-.Pa http://www.kb.cert.org/vuls/id/886601 .
diff --git a/src/racoon/racoon.conf.5 b/src/racoon/racoon.conf.5
deleted file mode 100644
index 9ddee80..0000000
--- a/src/racoon/racoon.conf.5
+++ /dev/null
@@ -1,1420 +0,0 @@
-.\"	$NetBSD: racoon.conf.5,v 1.34.4.3 2007/09/03 18:07:29 mgrooms Exp $
-.\"
-.\"	Id: racoon.conf.5,v 1.54 2006/08/22 18:17:17 manubsd Exp
-.\"
-.\" Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
-.\" All rights reserved.
-.\"
-.\" Redistribution and use in source and binary forms, with or without
-.\" modification, are permitted provided that the following conditions
-.\" are met:
-.\" 1. Redistributions of source code must retain the above copyright
-.\"    notice, this list of conditions and the following disclaimer.
-.\" 2. Redistributions in binary form must reproduce the above copyright
-.\"    notice, this list of conditions and the following disclaimer in the
-.\"    documentation and/or other materials provided with the distribution.
-.\" 3. Neither the name of the project nor the names of its contributors
-.\"    may be used to endorse or promote products derived from this software
-.\"    without specific prior written permission.
-.\"
-.\" THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
-.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
-.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-.\" SUCH DAMAGE.
-.\"
-.Dd September 19, 2006
-.Dt RACOON.CONF 5
-.Os
-.\"
-.Sh NAME
-.Nm racoon.conf
-.Nd configuration file for racoon
-.\"
-.\" .Sh SYNOPSIS
-.\"
-.Sh DESCRIPTION
-.Nm
-is the configuration file for the
-.Xr racoon 8
-ISAKMP daemon.
-.Xr racoon 8
-negotiates security associations for itself (ISAKMP SA, or phase 1 SA)
-and for kernel IPsec (IPsec SA, or phase 2 SA).
-The file consists of a sequence of directives and statements.
-Each directive is composed by a tag and statements, enclosed by
-.Ql {
-and
-.Ql } .
-Lines beginning with
-.Ql #
-are comments.
-.\"
-.Ss Meta Syntax
-Keywords and special characters that the parser expects exactly are
-displayed using
-.Ic this
-font.
-Parameters are specified with
-.Ar this
-font.
-Square brackets
-.Po
-.Ql \&[
-and
-.Ql \&]
-.Pc
-are used to show optional keywords and parameters.
-Note that
-you have to pay attention when this manual is describing
-.Ar port
-numbers.
-The
-.Ar port
-number is always enclosed by
-.Ql \&[
-and
-.Ql \&] .
-In this case, the port number is not an optional keyword.
-If it is possible to omit the
-.Ar port
-number,
-the expression becomes
-.Bq Bq Ar port .
-The vertical bar
-.Pq Ql \&|
-is used to indicate
-a choice between optional parameters.
-Parentheses
-.Po
-.Ql \&(
-and
-.Ql \&)
-.Pc
-are used to group keywords and parameters when necessary.
-Major parameters are listed below.
-.Pp
-.Bl -tag -width addressx -compact
-.It Ar number
-means a hexadecimal or a decimal number.
-The former must be prefixed with
-.Ql Li 0x .
-.It Ar string
-.It Ar path
-.It Ar file
-means any string enclosed in
-.Ql \&"
-.Pq double quotes .
-.It Ar address
-means IPv6 and/or IPv4 address.
-.It Ar port
-means a TCP/UDP port number.
-The port number is always enclosed by
-.Ql \&[
-and
-.Ql \&] .
-.It Ar timeunit
-is one of following:
-.Ic sec , secs , second , seconds ,
-.Ic min , mins , minute , minutes ,
-.Ic hour , hours .
-.El
-.\"
-.Ss Privilege separation
-.Bl -tag -width Ds -compact
-.It Ic privsep { Ar statements Ic }
-Specifies privilege separation parameters.
-When enabled, these enable
-.Xr racoon 8
-to operate with an unprivileged instance doing most of the work, while
-a privileged instance takes care of performing the following operations
-as root: reading PSK and private keys, launching hook scripts, and
-validating passwords against system databases or against PAM.
-Please note that using privilege separation makes changes to the
-.Ar listen
-and
-.Ar paths
-sections ignored upon configuration reloads.
-A
-.Xr racoon 8
-restart is required if you want such changes to be taken into account.
-.Pp
-.Bl -tag -width Ds -compact
-.It Ic user Ar user ;
-The user to which the unprivileged instance of
-.Xr racoon 8 ,
-should switch.
-This can be a quoted user name or a numeric UID.
-.It Ic group Ar group ;
-The group the unprivilegied instance of
-.Xr racoon 8 ,
-should switch.
-This can be a quoted group name or a numeric GID.
-.It Ic chroot Ar path ;
-A directory to which the unprivileged instance of
-.Xr racoon 8
-should
-.Xr chroot 2 .
-This directory should hold a tree where the following files must be
-reachable:
-.Bl -tag -width Ds -compact
-.It Pa /dev/random
-.It Pa /dev/urandom
-.It The certificates
-.It The file containing the Xauth banner
-.El
-.Pp
-The PSK file, the private keys, and the hook scripts are accessed through the
-privileged instance of
-.Xr racoon 8
-and do not need to be reachable in the
-.Xr chroot 2 Ap ed
-tree.
-.El
-.El
-.Ss Path Specification
-This section specifies various paths used by racoon.
-When running in privilege separation mode,
-.Ic certificate
-and
-.Ic script
-paths are mandatory. A
-.Xr racoon 8
-restart is required if you want path changes to be taken into account.
-.Bl -tag -width Ds -compact
-.It Ic path include Ar path ;
-Specifies a path to include a file.
-See
-.Sx File Inclusion .
-.It Ic path pre_shared_key Ar file ;
-Specifies a file containing pre-shared key(s) for various ID(s).
-See
-.Sx Pre-shared key File .
-.It Ic path certificate Ar path ;
-.Xr racoon 8
-will search this directory if a certificate or certificate request is received.
-If you run with privilege separation,
-.Xr racoon 8
-will refuse to use a certificate stored outside of this directory.
-.It Ic path backupsa Ar file ;
-Specifies a file to which SA information negotiated by
-racoon should be stored.
-.Xr racoon 8
-will install SA(s) from the file when started with the
-.Fl B
-flag.
-The file is growing because
-.Xr racoon 8
-simply adds SAs to it.
-You should maintain the file manually.
-.It Ic path script Ar path ;
-.Xr racoon 8
-will search this directory for scripts hooks.
-If you run with privilege separation,
-.Xr racoon 8
-will refuse to execute a script stored outside of this directory.
-.It Ic path pidfile Ar file ;
-Specifies file where to store PID of process.
-If path starts with
-.Pa /
-it is treated as an absolute path. Otherwise, it is treated as a relative 
-path to the VARRUN directory specified at compilation time.
-Default is
-.Pa racoon.pid .
-.El
-.\"
-.Ss File Inclusion
-.Bl -tag -width Ds -compact
-.It Ic include Ar file
-Specifies other configuration files to be included.
-.El
-.\"
-.Ss Identifier Specification
-is obsolete.
-It must be defined at each
-.Ic remote
-directive.
-.\"
-.Ss Timer Specification
-.Bl -tag -width Ds -compact
-.It Ic timer { Ar statements Ic }
-This section specifies various timer values used by racoon.
-.Pp
-.Bl -tag -width Ds -compact
-.It Ic counter Ar number ;
-The maximum number of retries to send.
-The default is 5.
-.It Ic interval Ar number Ar timeunit ;
-The interval to resend, in seconds.
-The default time is 10 seconds.
-.It Ic persend Ar number ;
-The number of packets per send.
-The default is 1.
-.It Ic phase1 Ar number Ar timeunit ;
-The maximum time it should take to complete phase 1.
-The default time is 15 seconds.
-.It Ic phase2 Ar number Ar timeunit ;
-The maximum time it should take to complete phase 2.
-The default time is 10 seconds.
-.It Ic natt_keepalive Ar number Ar timeunit ;
-The interval between sending NAT-Traversal keep-alive packets.
-The default time is 20 seconds.
-Set to 0s to disable keep-alive packets.
-.El
-.El
-.\"
-.Ss Listening Port Specification
-.Bl -tag -width Ds -compact
-.It Ic listen { Ar statements Ic }
-If no
-.Ar listen
-directive is specified,
-.Xr racoon 8
-will listen on all available interface addresses.
-The following is the list of valid statements:
-.Pp
-.Bl -tag -width Ds -compact
-.\" How do I express bold brackets; `[' and `]' .
-.\" Answer: For bold brackets, do "Ic \&[ foo \&]".
-.\" Is the "Bq Ic [ Ar port ] ;" buggy ?
-.It Ic isakmp Ar address Bq Bq Ar port ;
-If this is specified,
-.Xr racoon 8
-will only listen on the defined
-.Ar address .
-The default port is 500, which is specified by IANA.
-You can provide more than one address definition.
-.It Ic isakmp_natt Ar address Bq Ar port ;
-Same as
-.Ic isakmp
-but also sets the socket options to accept UDP-encapsulated ESP traffic for
-NAT-Traversal.
-If you plan to use NAT-T, you should provide at least one address
-with port 4500, which is specified by IANA.
-There is no default.
-.It Ic strict_address ;
-Requires that all addresses for ISAKMP be bound.
-This statement will be ignored if you do not specify address definitions.
-.El
-When running in privilege separation mode, you need to restart
-.Xr racoon 8
-to have changes to the
-.Ar listen
-section taken into account.
-.Pp
-The
-.Ar listen
-section can also be used to specify the admin socket mode and ownership
-if racoon was built with support for admin port.
-.Bl -tag -width Ds -compact
-.It Ic adminsock Ar path Op Ar owner\ group\ mode ;
-The
-.Ar path ,
-.Ar owner ,
-and
-.Ar group
-values specify the socket path, owner, and group. They must be quoted.
-The defaults are
-.Pa /var/racoon/racoon.sock ,
-UID 0, and GID 0.
-.Ar mode
-is the access mode in octal. The default is 0600.
-.It Ic adminsock disabled ;
-This directive tells racoon to not listen on the admin socket.
-.El
-.El
-.\"
-.Ss Miscellaneous Global Parameters
-.Bl -tag -width Ds -compact
-.It Ic gss_id_enc Ar enctype ;
-Older versions of
-.Xr racoon 8
-used ISO-Latin-1 as the encoding of the GSS-API identifier attribute.
-For interoperability with Microsoft Windows' GSS-API authentication
-scheme, the default encoding has been changed to UTF-16LE.
-The
-.Ic gss_id_enc
-parameter allows
-.Xr racoon 8
-to be configured to use the old encoding for compatibility with existing
-.Xr racoon 8
-installations.
-The following are valid values for
-.Ar enctype :
-.Pp
-.Bl -tag -width Ds -compact
-.It Ic utf-16le
-Use UTF-16LE to encode the GSS-API identifier attribute.
-This is the default encoding.
-This encoding is compatible with Microsoft Windows.
-.It Ic latin1
-Use ISO-Latin-1 to encode the GSS-API identifier attribute.
-This is the encoding used by older versions of
-.Xr racoon 8 .
-.El
-.El
-.\"
-.Ss Remote Nodes Specifications
-.Bl -tag -width Ds -compact
-.It Xo
-.Ic remote ( Ar address | Ic anonymous )
-.Bq Bq Ar port
-.Bq Ic inherit Ar parent
-.Ic { Ar statements Ic }
-.Xc
-Specifies the IKE phase 1 parameters for each remote node.
-The default port is 500.
-If
-.Ic anonymous
-is specified, the statements will apply to any peer that does not match a
-more specific
-.Ic remote
-directive.
-.Pp
-Sections with
-.Ic inherit Ar parent
-statements (where
-.Ar parent
-is either
-.Ar address
-or a keyword
-.Ic anonymous )
-that have all values predefined to those of a given
-.Ar parent .
-In these sections it is enough to redefine only the changed parameters.
-.Pp
-The following are valid statements.
-.Pp
-.Bl -tag -width Ds -compact
-.\"
-.It Ic exchange_mode ( main | aggressive | base ) ;
-Defines the exchange mode for phase 1 when racoon is the initiator.
-It also means the acceptable exchange mode when racoon is the responder.
-More than one mode can be specified by separating them with a comma.
-All of the modes are acceptable.
-The first exchange mode is what racoon uses when it is the initiator.
-.\"
-.It Ic doi Ic ipsec_doi ;
-Means to use IPsec DOI as specified in RFC 2407.
-You can omit this statement.
-.\"
-.It Ic situation Ic identity_only ;
-Means to use SIT_IDENTITY_ONLY as specified in RFC 2407.
-You can omit this statement.
-.\"
-.It Ic identifier Ar idtype ;
-This statment is obsolete. Instead, use
-.Ic my_identifier .
-.\"
-.It Xo
-.Ic my_identifier Bq Ar qualifier
-.Ar idtype ... ;
-.Xc
-Specifies the identifier sent to the remote host
-and the type to use in the phase 1 negotiation.
-.Ic address, fqdn , user_fqdn , keyid ,
-and
-.Ic asn1dn
-can be used as an
-.Ar idtype .
-The
-.Ar qualifier
-is currently only used for
-.Ic keyid ,
-and can be either
-.Ic file
-or
-.Ic tag .
-The possible values are :
-.Bl -tag -width Ds -compact
-.It Ic my_identifier Ic address Bq Ar address ;
-The type is the IP address.
-This is the default type if you do not specify an identifier to use.
-.It Ic my_identifier Ic user_fqdn Ar string ;
-The type is a USER_FQDN (user fully-qualified domain name).
-.It Ic my_identifier Ic fqdn Ar string ;
-The type is a FQDN (fully-qualified domain name).
-.It Xo
-.Ic my_identifier Ic keyid Bq Ic file
-.Ar file ;
-.Xc
-The type is a KEY_ID, read from the file.
-.It Ic my_identifier Ic keyid Ic tag Ar string ;
-The type is a KEY_ID, specified in the quoted string.
-.It Ic my_identifier Ic asn1dn Bq Ar string ;
-The type is an ASN.1 distinguished name.
-If
-.Ar string
-is omitted,
-.Xr racoon 8
-will get the DN from the Subject field in the certificate.
-.El
-.\"
-.It Ic xauth_login Bq Ar string ;
-Specifies the login to use in client-side Hybrid authentication.
-It is available only if
-.Xr racoon 8
-has been built with this option.
-The associated password is looked up in the pre-shared key files,
-using the login
-.Ic string
-as the key id.
-.\"
-.It Ic peers_identifier Ar idtype ... ;
-Specifies the peer's identifier to be received.
-If it is not defined then
-.Xr racoon 8
-will not verify the peer's identifier in ID payload transmitted from the peer.
-If it is defined, the behavior of the verification depends on the flag of
-.Ic verify_identifier .
-The usage of
-.Ar idtype
-is the same as
-.Ic my_identifier
-except that the individual component values of an
-.Ic asn1dn
-identifier may specified as
-.Ic *
-to match any value (e.g. "C=XX, O=MyOrg, OU=*, CN=Mine").
-Alternative acceptable peer identifiers may be specified by repeating the
-.Ic peers_identifier
-statement.
-.\"
-.It Ic verify_identifier (on | off) ;
-If you want to verify the peer's identifier,
-set this to on.
-In this case, if the value defined by
-.Ic peers_identifier
-is not the same as the peer's identifier in the ID payload,
-the negotiation will fail.
-The default is off.
-.\"
-.It Ic certificate_type Ar certspec ;
-Specifies a certificate specification.
-.Ar certspec
-is one of followings:
-.Bl -tag -width Ds -compact
-.It Ic x509 Ar certfile Ar privkeyfile ;
-.Ar certfile
-means a file name of a certificate.
-.Ar privkeyfile
-means a file name of a secret key.
-.El
-.Bl -tag -width Ds -compact
-.It Ic plain_rsa Ar privkeyfile ;
-.Ar privkeyfile
-means a file name of a private key generated by plainrsa-gen(8).  Required
-for RSA authentication.
-.El
-.It Ic ca_type Ar cacertspec ;
-Specifies a root certificate authority specification.
-.Ar cacertspec
-is one of followings:
-.Bl -tag -width Ds -compact
-.It Ic x509 Ar cacertfile ;
-.Ar cacertfile
-means a file name of the root certificate authority.
-Default is
-.Pa /etc/openssl/cert.pem
-.El
-.\"
-.It Ic mode_cfg (on | off) ;
-Gather network information through ISAKMP mode configuration.
-Default is off.
-.\"
-.It Ic weak_phase1_check (on | off) ;
-Tells racoon to act on unencrypted deletion messages during phase 1.
-This is a small security risk, so the default is off, meaning that
-racoon will keep on trying to establish a connection even if the
-user credentials are wrong, for instance.
-.\"
-.It Ic peers_certfile ( dnssec | Ar certfile | Ic plain_rsa Ar pubkeyfile ) ;
-If
-.Ic dnssec
-is defined,
-.Xr racoon 8
-will ignore the CERT payload from the peer,
-and try to get the peer's certificate from DNS instead.
-If
-.Ar certfile
-is defined,
-.Xr racoon 8
-will ignore the CERT payload from the peer,
-and will use this certificate as the peer's certificate.
-If
-.Ic plain_rsa
-is defined,
-.Xr racoon 8
-will expect
-.Ar pubkeyfile
-to be the peer's public key that was generated
-by plainrsa-gen(8).
-.\"
-.It Ic script Ar script Ic phase1_up
-.It Ic script Ar script Ic phase1_down
-Shell scripts that get executed when a phase 1 SA goes up or down.
-Both scripts get either
-.Ic phase1_up
-or
-.Ic phase1_down
-as first argument, and the following
-variables are set in their environment:
-.Bl -tag -width Ds -compact
-.It Ev LOCAL_ADDR
-The local address of the phase 1 SA.
-.It Ev LOCAL_PORT
-The local port used for IKE for the phase 1 SA.
-.It Ev REMOTE_ADDR
-The remote address of the phase 1 SA.
-.It Ev REMOTE_PORT
-The remote port used for IKE for the phase 1 SA.
-.El
-The following variables are only set if
-.Ic mode_cfg
-was enabled:
-.Bl -tag -width Ds -compact
-.It INTERNAL_ADDR4
-An IPv4 internal address obtained by ISAKMP mode config.
-.It INTERNAL_NETMASK4
-An IPv4 internal netmask obtained by ISAKMP mode config.
-.It INTERNAL_CIDR4
-An IPv4 internal netmask obtained by ISAKMP mode config, in CIDR notation.
-.It INTERNAL_DNS4
-The first internal DNS server IPv4 address obtained by ISAKMP mode config.
-.It INTERNAL_DNS4_LIST
-A list of internal DNS servers IPv4 address obtained by ISAKMP mode config,
-separated by spaces.
-.It INTERNAL_WINS4
-The first internal WINS server IPv4 address obtained by ISAKMP mode config.
-.It INTERNAL_WINS4_LIST
-A list of internal WINS servers IPv4 address obtained by ISAKMP mode config,
-separated by spaces.
-.It SPLIT_INCLUDE
-The space separated list of IPv4 addresses and masks (address slash mask)
-that define the networks to be encrypted (as opposed to the default where
-all the traffic should be encrypted) ; obtained by ISAKMP mode config ;
-SPLIT_INCLUDE and SPLIT_LOCAL are mutually exclusive.
-.It SPLIT_LOCAL
-The space separated list of IPv4 addresses and masks (address slash mask)
-that define the networks to be considered local, and thus excluded from the
-tunnels ; obtained by ISAKMP mode config.
-.It DEFAULT_DOMAIN
-The DNS default domain name obtained by ISAKMP mode config.
-.El
-.\"
-.\"
-.It Ic send_cert (on | off) ;
-If you do not want to send a certificate, set this to off.
-The default is on.
-.\"
-.It Ic send_cr (on | off) ;
-If you do not want to send a certificate request, set this to off.
-The default is on.
-.\"
-.It Ic verify_cert (on | off) ;
-By default, the identifier sent by the remote host (as specified in its
-.Ic my_identifier
-statement) is compared with the credentials in the certificate
-used to authenticate the remote host as follows:
-.Bl -tag -width Ds -compact
-.It Type Ic asn1dn:
-The entire certificate subject name is compared with the identifier,
-e.g. "C=XX, O=YY, ...".
-.It Type Ic address, fqdn, or user_fqdn:
-The certificate's subjectAltName is compared with the identifier.
-.El
-If the two do not match the negotiation will fail.
-If you do not want to verify the identifier using the peer's certificate,
-set this to off.
-.\"
-.It Ic lifetime time Ar number Ar timeunit ;
-Define a lifetime of a certain time
-which will be proposed in the phase 1 negotiations.
-Any proposal will be accepted, and the attribute(s) will not be proposed to
-the peer if you do not specify it (them).
-They can be individually specified in each proposal.
-.\"
-.It Ic ike_frag (on | off | force) ;
-Enable receiver-side IKE fragmentation if
-.Xr racoon 8
-has been built with this feature.
-If set to on, racoon will advertise
-itself as being capable of receiving packets split by IKE fragmentation.
-This extension is there to work around broken firewalls that do not
-work with fragmented UDP packets.
-IKE fragmentation is always enabled on the sender-side, and it is
-used if the peer advertises itself as IKE fragmentation capable.
-By selecting force, IKE Fragmentation will
-be used when racoon is acting as the initiator even before the remote
-peer has advertised itself as IKE fragmentation capable.
-.\"
-.It Ic esp_frag Ar fraglen ;
-This option is only relevant if you use NAT traversal in tunnel mode.
-Its purpose is to work around broken DSL routers that reject UDP
-fragments, by fragmenting the IP packets before ESP encapsulation.
-The result is ESP over UDP of fragmented packets instead of fragmented
-ESP over UDP packets (i.e., IP:UDP:ESP:frag(IP) instead of
-frag(IP:UDP:ESP:IP)).
-.Ar fraglen
-is the maximum size of the fragments.
-552 should work anywhere,
-but the higher
-.Ar fraglen
-is, the better the performance.
-.Pp
-Note that because PMTU discovery is broken on many sites, you will
-have to use MSS clamping if you want TCP to work correctly.
-.\"
-.It Ic initial_contact (on | off) ;
-Enable this to send an INITIAL-CONTACT message.
-The default value is
-.Ic on .
-This message is useful only when the responder implementation chooses an
-old SA when there are multiple SAs with different established time and the
-initiator reboots.
-If racoon did not send the message,
-the responder would use an old SA even when a new SA was established.
-For systems that use a KAME derived IPSEC stack, the
-.Xr sysctl 8
-variable net.key.preferred_oldsa can be used to control this preference.
-When the value is zero, the stack always uses a new SA.
-.\"
-.It Ic passive (on | off) ;
-If you do not want to initiate the negotiation, set this to on.
-The default value is
-.Ic off .
-It is useful for a server.
-.\"
-.It Ic proposal_check Ar level ;
-Specifies the action of lifetime length, key length and PFS of the phase 2
-selection on the responder side, and the action of lifetime check in
-phase 1.
-The default level is
-.Ic strict .
-If the
-.Ar level
-is:
-.Bl -tag -width Ds -compact
-.It Ic obey
-The responder will obey the initiator anytime.
-.It Ic strict
-If the responder's lifetime length is longer than the initiator's or
-the responder's key length is shorter than the initiator's,
-the responder will use the initiator's value.
-Otherwise, the proposal will be rejected.
-If PFS is not required by the responder, the responder will obey the proposal.
-If PFS is required by both sides and the responder's group is not equal to
-the initiator's, then the responder will reject the proposal.
-.It Ic claim
-If the responder's lifetime length is longer than the initiator's or
-the responder's key length is shorter than the initiator's,
-the responder will use the initiator's value.
-If the responder's lifetime length is shorter than the initiator's,
-the responder uses its own length AND sends a RESPONDER-LIFETIME notify
-message to an initiator in the case of lifetime (phase 2 only).
-For PFS, this directive behaves the same as
-.Ic strict .
-.It Ic exact
-If the initiator's lifetime or key length is not equal to the responder's,
-the responder will reject the proposal.
-If PFS is required by both sides and the responder's group is not equal to
-the initiator's, then the responder will reject the proposal.
-.El
-.\"
-.It Ic support_proxy (on | off) ;
-If this value is set to on, then both values of ID payloads in the
-phase 2 exchange are always used as the addresses of end-point of
-IPsec-SAs.
-The default is off.
-.\"
-.It Ic generate_policy (on | off | require | unique) ;
-This directive is for the responder.
-Therefore you should set
-.Ic passive
-to on in order that
-.Xr racoon 8
-only becomes a responder.
-If the responder does not have any policy in SPD during phase 2
-negotiation, and the directive is set to on, then
-.Xr racoon 8
-will choose the first proposal in the
-SA payload from the initiator, and generate policy entries from the proposal.
-It is useful to negotiate with clients whose IP address is allocated
-dynamically.
-Note that an inappropriate policy might be installed into the responder's SPD
-by the initiator,
-so other communications might fail if such policies are installed
-due to a policy mismatch between the initiator and the responder.
-.Ic on
-and
-.Ic require
-values mean the same thing (generate a require policy).
-.Ic unique
-tells racoon to set up unique policies, with a monotoning increasing
-reqid number (between 1 and IPSEC_MANUAL_REQID_MAX).
-This directive is ignored in the initiator case.
-The default value is
-.Ic off .
-.\"
-.\"
-.It Ic nat_traversal (on | off | force) ;
-This directive enables use of the NAT-Traversal IPsec extension
-(NAT-T).
-NAT-T allows one or both peers to reside behind a NAT gateway (i.e.,
-doing address- or port-translation).
-If a NAT gateway is detected during the phase 1 handshake, racoon will
-attempt to negotiate the use of NAT-T with the remote peer.
-If the negotiation succeeds, all ESP and AH packets for the given connection
-will be encapsulated into UDP datagrams (port 4500, by default).
-Possible values are:
-.Bl -tag -width Ds -compact
-.It Ic on
-NAT-T is used when a NAT gateway is detected between the peers.
-.It Ic off
-NAT-T is not proposed/accepted.
-This is the default.
-.It Ic force
-NAT-T is used regardless of whether a NAT gateway is detected between the
-peers or not.
-.El
-Please note that NAT-T support is a compile-time option.
-Although it is enabled in the source distribution by default, it
-may not be available in your particular build.
-In that case you will get a
-warning when using any NAT-T related config options.
-.\"
-.It Ic dpd_delay Ar delay ;
-This option activates the DPD and sets the time (in seconds) allowed
-between 2 proof of liveliness requests.
-The default value is
-.Ic 0 ,
-which disables DPD monitoring, but still negotiates DPD support.
-.\"
-.It Ic dpd_retry Ar delay ;
-If
-.Ic dpd_delay
-is set, this sets the delay (in seconds) to wait for a proof of
-liveliness before considering it as failed and send another request.
-The default value is
-.Ic 5 .
-.\"
-.It Ic dpd_maxfail Ar number ;
-If
-.Ic dpd_delay
-is set, this sets the maximum number of liveliness proofs to request
-(without reply) before considering the peer is dead.
-The default value is
-.Ic 5 .
-.\"
-.It Ic nonce_size Ar number ;
-define the byte size of nonce value.
-Racoon can send any value although
-RFC2409 specifies that the value MUST be between 8 and 256 bytes.
-The default size is 16 bytes.
-.\"
-.It Ic ph1id Ar number ;
-An optionnal number to identify the remote proposal and to link it
-only with sainfos who have the same number.
-Defaults to 0.
-.\"
-.It Xo
-.Ic proposal { Ar sub-substatements Ic }
-.Xc
-.Bl -tag -width Ds -compact
-.\"
-.It Ic encryption_algorithm Ar algorithm ;
-Specifies the encryption algorithm used for the phase 1 negotiation.
-This directive must be defined.
-.Ar algorithm
-is one of following:
-.Ic des, 3des, blowfish, cast128, aes, camellia
-.\".Ic rc5 , idea
-for Oakley.
-For other transforms, this statement should not be used.
-.\"
-.It Ic hash_algorithm Ar algorithm ;
-Defines the hash algorithm used for the phase 1 negotiation.
-This directive must be defined.
-.Ar algorithm
-is one of following:
-.Ic md5, sha1, sha256, sha384, sha512
-for Oakley.
-.\"
-.It Ic authentication_method Ar type ;
-Defines the authentication method used for the phase 1 negotiation.
-This directive must be defined.
-.Ar type
-is one of:
-.Ic pre_shared_key , rsasig
-(for plain RSA authentication),
-.Ic gssapi_krb , hybrid_rsa_server ,
-.Ic hybrid_rsa_client , xauth_rsa_server , xauth_rsa_client , xauth_psk_server
-or
-.Ic xauth_psk_client .
-.\"
-.It Ic dh_group Ar group ;
-Defines the group used for the Diffie-Hellman exponentiations.
-This directive must be defined.
-.Ar group
-is one of following:
-.Ic modp768 , modp1024 , modp1536 ,
-.Ic modp2048 , modp3072 , modp4096 ,
-.Ic modp6144 , modp8192 .
-Or you can define 1, 2, 5, 14, 15, 16, 17, or 18 as the DH group number.
-When you want to use aggressive mode,
-you must define the same DH group in each proposal.
-.It Ic lifetime time Ar number Ar timeunit ;
-Defines the lifetime of the phase 1 SA proposal.
-Refer to the description of the
-.Ic lifetime
-directive defined in the
-.Ic remote
-directive.
-.It Ic gss_id Ar string ;
-Defines the GSS-API endpoint name, to be included as an attribute in the SA,
-if the
-.Ic gssapi_krb
-authentication method is used.
-If this is not defined, the default value of
-.Ql host/hostname
-is used, where hostname is the value returned by the
-.Xr hostname 1
-command.
-.El
-.El
-.El
-.\"
-.Ss Policy Specifications
-The policy directive is obsolete, policies are now in the SPD.
-.Xr racoon 8
-will obey the policy configured into the kernel by
-.Xr setkey 8 ,
-and will construct phase 2 proposals by combining
-.Ic sainfo
-specifications in
-.Nm ,
-and policies in the kernel.
-.\"
-.Ss Sainfo Specifications
-.Bl -tag -width Ds -compact
-.It Xo
-.Ic sainfo ( Ar source_id destination_id | Ar source_id Ic anonymous | Ic anonymous Ar destination_id | Ic anonymous ) [ from Ar idtype [ Ar string ] ] [ Ic group Ar string ]
-.Ic { Ar statements Ic }
-.Xc
-defines the parameters of the IKE phase 2 (IPsec-SA establishment).
-.Ar source_id
-and
-.Ar destination_id
-are constructed like:
-.Pp
-.Ic address Ar address
-.Bq Ic / Ar prefix
-.Bq Ic [ Ar port ]
-.Ar ul_proto
-.Pp
-or
-.Pp
-.Ic subnet Ar address
-.Bq Ic / Ar prefix
-.Bq Ic [ Ar port ]
-.Ar ul_proto
-.Pp
-or
-.Pp
-.Ar idtype Ar string
-.Pp
-An id string should be expressed to match the exact value of an ID payload
-(source is the local end, destination is the remote end).
-This is not like a filter rule.
-For example, if you define 3ffe:501:4819::/48 as
-.Ar source_id .
-3ffe:501:4819:1000:/64 will not match.
-.Pp
-In the case of a longest prefix (selecting a single host),
-.Ar address
-instructs to send ID type of ADDRESS while
-.Ar subnet
-instructs to send ID type of SUBNET.
-Otherwise, these instructions are identical.
-.Pp
-The group keyword allows an XAuth group membership check to be performed
-for this sainfo section.
-When the mode_cfg auth source is set to
-.Ic system
-or
-.Ic ldap ,
-the XAuth user is verified to be a member of the specified group
-before allowing a matching SA to be negotiated.
-.Pp
-.Bl -tag -width Ds -compact
-.\"
-.It Ic pfs_group Ar group ;
-define the group of Diffie-Hellman exponentiations.
-If you do not require PFS then you can omit this directive.
-Any proposal will be accepted if you do not specify one.
-.Ar group
-is one of following:
-.Ic modp768 , modp1024 , modp1536 ,
-.Ic modp2048 , modp3072 , modp4096 ,
-.Ic modp6144 , modp8192 .
-Or you can define 1, 2, 5, 14, 15, 16, 17, or 18 as the DH group number.
-.\"
-.It Ic lifetime time Ar number Ar timeunit ;
-define how long an IPsec-SA will be used, in timeunits.
-Any proposal will be accepted, and no attribute(s) will be proposed to
-the peer if you do not specify it(them).
-See the
-.Ic proposal_check
-directive.
-.\"
-.It Ic remoteid Ar number ;
-Sainfos will only be used if their remoteid matches the ph1id of the
-remote section used for phase 1.
-Defaults to 0, which is also the default for ph1id.
-.\"
-.It Ic my_identifier Ar idtype ... ;
-is obsolete.
-It does not make sense to specify an identifier in the phase 2.
-.El
-.\"
-.Pp
-.Xr racoon 8
-does not have a list of security protocols to be negotiated.
-The list of security protocols are passed by SPD in the kernel.
-Therefore you have to define all of the potential algorithms
-in the phase 2 proposals even if there are algorithms which will not be used.
-These algorithms are define by using the following three directives,
-with a single comma as the separator.
-For algorithms that can take variable-length keys, algorithm names
-can be followed by a key length, like
-.Dq Li blowfish 448 .
-.Xr racoon 8
-will compute the actual phase 2 proposals by computing
-the permutation of the specified algorithms,
-and then combining them with the security protocol specified by the SPD.
-For example, if
-.Ic des , 3des , hmac_md5 ,
-and
-.Ic hmac_sha1
-are specified as algorithms, we have four combinations for use with ESP,
-and two for AH.
-Then, based on the SPD settings,
-.Xr racoon 8
-will construct the actual proposals.
-If the SPD entry asks for ESP only, there will be 4 proposals.
-If it asks for both AH and ESP, there will be 8 proposals.
-Note that the kernel may not support the algorithm you have specified.
-.\"
-.Bl -tag -width Ds -compact
-.It Ic encryption_algorithm Ar algorithms ;
-.Ic des , 3des , des_iv64 , des_iv32 ,
-.Ic rc5 , rc4 , idea , 3idea ,
-.Ic cast128 , blowfish , null_enc ,
-.Ic twofish , rijndael , aes , camellia
-.Pq used with ESP
-.\"
-.It Ic authentication_algorithm Ar algorithms ;
-.Ic des , 3des , des_iv64 , des_iv32 ,
-.Ic hmac_md5 , hmac_sha1 , hmac_sha256, hmac_sha384, hmac_sha512, non_auth
-.Pq used with ESP authentication and AH
-.\"
-.It Ic compression_algorithm Ar algorithms ;
-.Ic deflate
-.Pq used with IPComp
-.El
-.El
-.\"
-.Ss Logging level
-.Bl -tag -width Ds -compact
-.It Ic log Ar level ;
-Defines the logging level.
-.Ar level
-is one of following:
-.Ic error , warning , notify , info , debug
-and
-.Ic debug2 .
-The default is
-.Ic info .
-If you set the logging level too high on slower machines,
-IKE negotiation can fail due to timing constraint changes.
-.El
-.\"
-.Ss Specifies the way to pad
-.Bl -tag -width Ds -compact
-.It Ic padding { Ar statements Ic }
-specifies the padding format.
-The following are valid statements:
-.Bl -tag -width Ds -compact
-.It Ic randomize (on | off) ;
-Enables the use of a randomized value for padding.
-The default is on.
-.It Ic randomize_length (on | off) ;
-The pad length will be random.
-The default is off.
-.It Ic maximum_length Ar number ;
-Defines a maximum padding length.
-If
-.Ic randomize_length
-is off, this is ignored.
-The default is 20 bytes.
-.It Ic exclusive_tail (on | off) ;
-Means to put the number of pad bytes minus one into the last part
-of the padding.
-The default is on.
-.It Ic strict_check (on | off) ;
-Means to constrain the peer to set the number of pad bytes.
-The default is off.
-.El
-.El
-.Ss ISAKMP mode configuration settings
-.Bl -tag -width Ds -compact
-.It Ic mode_cfg { Ar statements Ic }
-Defines the information to return for remote hosts' ISAKMP mode config
-requests.
-Also defines the authentication source for remote peers
-authenticating through Xauth.
-.Pp
-The following are valid statements:
-.Bl -tag -width Ds -compact
-.It Ic auth_source (system | radius | pam | ldap) ;
-Specifies the source for authentication of users through Xauth.
-.Ar system
-means to use the Unix user database.
-This is the default.
-.Ar radius
-means to use a RADIUS server.
-It works only if
-.Xr racoon 8
-was built with libradius support. Radius configuration is hanlded by
-.Xr radius.conf 5 .
-.Ar pam
-means to use PAM.
-It works only if
-.Xr racoon 8
-was built with libpam support.
-.Ar ldap
-means to use LDAP.
-It works only if
-.Xr racoon 8
-was built with libldap support. LDAP configuration is handled by
-statements in the
-.Ic ldapcfg
-section.
-.It Ic auth_groups Ar "group1", ... ;
-Specifies the group memberships for Xauth in quoted group name strings.
-When defined, the authenticating user must be a member of at least one
-group for Xauth to succeed.
-.It Ic group_source (system | ldap) ;
-Specifies the source for group validataion of users through Xauth.
-.Ar system
-means to use the Unix user database.
-This is the default.
-.Ar ldap
-means to use LDAP.
-It works only if
-.Xr racoon 8
-was built with libldap support and requires LDAP authentication.
-LDAP configuration is handled by statements in the
-.Ic ldapcfg
-section.
-.It Ic conf_source (local | radius | ldap) ;
-Specifies the source for IP addresses and netmask allocated through ISAKMP
-mode config.
-.Ar local
-means to use the local IP pool defined by the
-.Ic network4
-and
-.Ic pool_size
-statements.
-This is the default.
-.Ar radius
-means to use a RADIUS server.
-It works only if
-.Xr racoon 8
-was built with libradius support and requires RADIUS authentiation.
-RADIUS configuration is handled by
-.Xr radius.conf 5 .
-.Ar ldap
-means to use an LDAP server.
-It works only if
-.Xr racoon 8
-was built with libldap support and requires LDAP authentication.
-LDAP configuration is handled by
-statements in the
-.Ic ldapcfg
-section.
-.It Ic accounting (none | system | radius | pam) ;
-Enables or disables accounting for Xauth logins and logouts.
-The default is
-.Ar none
-which disable accounting.
-Specifying
-.Ar system
-enables system accounting through
-.Xr utmp 5 .
-Specifying
-.Ar radius
-enables RADIUS accounting.
-It works only if
-.Xr racoon 8
-was built with libradius support and requires RADIUS authentication.
-RADIUS configuration is handled by
-.Xr radius.conf 5 .
-Specifying
-.Ar pam
-enables PAM accounting.
-It works only if
-.Xr racoon 8
-was build with libpam support and requires PAM authentication.
-.It Ic pool_size Ar size
-Specify the size of the IP address pool, either local or allocated
-through RADIUS.
-.Ic conf_source
-selects the local pool or the RADIUS configuration, but in both
-configurations, you cannot have more than
-.Ar size
-users connected at the same time.
-The default is 255.
-.It Ic network4 Ar address ;
-.It Ic netmask4 Ar address ;
-The local IP pool base address and network mask from which dynamically
-allocated IPv4 addresses should be taken.
-This is used if
-.Ic conf_source
-is set to
-.Ar local
-or if the RADIUS server returned
-.Ar 255.255.255.254 .
-Default is
-.Ar 0.0.0.0/0.0.0.0 .
-.It Ic dns4 Ar addresses ;
-A list of IPv4 addresses for DNS servers, separated by commas, or on multiple
-.Ic dns4
-lines.
-.It Ic wins4 Ar addresses ;
-A list of IPv4 address for WINS servers. The keyword
-.It nbns4
-can also be used as an alias for
-.It wins4 .
-.It Ic split_network (include | local_lan) Ar network/mask, ...
-The network configuration to send, in cidr notation (e.g. 192.168.1.0/24).
-If
-.Ic include
-is specified, the tunnel should be only used to encrypt the indicated
-destinations ; otherwise, if
-.Ic local_lan
-is used, everything will pass through the tunnel but those destinations.
-.It Ic default_domain Ar domain ;
-The default DNS domain to send.
-.It Ic split_dns Ar "domain", ...
-The split dns configuration to send, in quoted domain name strings.
-This list can be used to describe a list of domain names for which
-a peer should query a modecfg assigned dns server.
-DNS queries for all other domains would be handled locally.
-(Cisco VPN client only).
-.It Ic banner Ar path ;
-The path of a file displayed on the client at connection time.
-Default is
-.Ar /etc/motd .
-.It Ic auth_throttle Ar delay ;
-On each failed Xauth authentication attempt, refuse new attempts for a set
-.Ar delay
-of seconds.
-This is to avoid dictionary attacks on Xauth passwords.
-Default is one second.
-Set to zero to disable authentication delay.
-.It Ic pfs_group Ar group ;
-Sets the PFS group used in the client proposal (Cisco VPN client only).
-Default is 0.
-.It Ic save_passwd (on | off) ;
-Allow the client to save the Xauth password (Cisco VPN client only).
-Default is off.
-.El
-.El
-.Ss Ldap configuration settings
-.Bl -tag -width Ds -compact
-.It Ic ldapcfg { Ar statements Ic }
-Defines the parameters that will be used to communicate with an ldap
-server for
-.Ic xauth
-authentication.
-.Pp
-The following are valid statements:
-.Bl -tag -width Ds -compact
-.It Ic version (2 | 3) ;
-The ldap protocol version used to communicate with the server.
-The default is
-.Ic 3 .
-.It Ic host Ar (hostname | address) ;
-The host name or ip address of the ldap server.
-The default is
-.Ic localhost .
-.It Ic port Ar number;
-The port that the ldap server is configured to listen on.
-The default is
-.Ic 389 .
-.It Ic base Ar distinguished name;
-The ldap search base.
-This option has no default value.
-.It Ic subtree (on | off) ;
-Use the subtree ldap search scope.
-Otherwise, use the one level search scope.
-The default is
-.Ic off .
-.It Ic bind_dn Ar distinguised name;
-The user dn used to optionaly bind as before performing ldap search operations.
-If this option is not specified, anonymous binds are used.
-.It Ic bind_pw Ar string;
-The password used when binding as
-.Ic bind_dn .
-.It Ic attr_user Ar attribute name;
-The attribute used to specify a users name in an ldap directory.
-For example,
-if a user dn is "cn=jdoe,dc=my,dc=net" then the attribute would be "cn".
-The default value is
-.Ic cn .
-.It Ic attr_addr Ar attribute name;
-.It Ic attr_mask Ar attribute name;
-The attributes used to specify a users network address and subnet mask in an
-ldap directory.
-These values are forwarded during mode_cfg negotiation when
-the conf_source is set to ldap.
-The default values are
-.Ic racoon-address
-and
-.Ic racoon-netmask .
-.It Ic attr_group Ar attribute name;
-The attribute used to specify a group name in an ldap directory.
-For example,
-if a group dn is "cn=users,dc=my,dc=net" then the attribute would be "cn".
-The default value is
-.Ic cn .
-.It Ic attr_member Ar attribute name;
-The attribute used to specify group membership in an ldap directory.
-The default value is
-.Ic member .
-.El
-.El
-.Ss Special directives
-.Bl -tag -width Ds -compact
-.It Ic complex_bundle (on | off) ;
-defines the interpretation of proposal in the case of SA bundle.
-Normally
-.Dq IP AH ESP IP payload
-is proposed as
-.Dq AH tunnel and ESP tunnel .
-The interpretation is more common to other IKE implementations, however,
-it allows very limited set of combinations for proposals.
-With the option enabled, it will be proposed as
-.Dq AH transport and ESP tunnel .
-The default value is
-.Ic off .
-.El
-.\"
-.Ss Pre-shared key File
-The pre-shared key file defines pairs of identifiers and corresponding
-shared secret keys which are used in the pre-shared key authentication
-method in phase 1.
-The pair in each line is separated by some number of blanks and/or tab
-characters like in the
-.Xr hosts 5
-file.
-Key can include blanks because everything after the first blanks
-is interpreted as the secret key.
-Lines starting with
-.Ql #
-are ignored.
-Keys which start with
-.Ql 0x
-are interpreted as hexadecimal strings.
-Note that the file must be owned by the user ID running
-.Xr racoon 8
-.Pq usually the privileged user ,
-and must not be accessible by others.
-.\"
-.Sh EXAMPLES
-The following shows how the remote directive should be configured.
-.Bd -literal -offset
-path pre_shared_key "/usr/local/v6/etc/psk.txt" ;
-remote anonymous
-{
-	exchange_mode aggressive,main,base;
-	lifetime time 24 hour;
-	proposal {
-		encryption_algorithm 3des;
-		hash_algorithm sha1;
-		authentication_method pre_shared_key;
-		dh_group 2;
-	}
-}
-
-sainfo anonymous
-{
-	pfs_group 2;
-	lifetime time 12 hour ;
-	encryption_algorithm 3des, blowfish 448, twofish, rijndael ;
-	authentication_algorithm hmac_sha1, hmac_md5 ;
-	compression_algorithm deflate ;
-}
-.Ed
-.Pp
-If you are configuring plain RSA authentication, the remote directive
-should look like the following:
-.Bd -literal -offset
-path certificate "/usr/local/v6/etc" ;
-remote anonymous
-{
-        exchange_mode main,base ;
-        lifetime time 12 hour ;
-        certificate_type plain_rsa "/usr/local/v6/etc/myrsakey.priv";
-        peers_certfile plain_rsa "/usr/local/v6/etc/yourrsakey.pub";
-        proposal {
-                        encryption_algorithm aes ;
-                        hash_algorithm sha1 ;
-                        authentication_method rsasig ;
-                        dh_group 2 ;
-        }
-}
-.Ed
-.Pp
-The following is a sample for the pre-shared key file.
-.Bd -literal -offset
-10.160.94.3     mekmitasdigoat
-172.16.1.133    0x12345678
-194.100.55.1    whatcertificatereally
-3ffe:501:410:ffff:200:86ff:fe05:80fa    mekmitasdigoat
-3ffe:501:410:ffff:210:4bff:fea2:8baa    mekmitasdigoat
-foo@kame.net    mekmitasdigoat
-foo.kame.net    hoge
-.Ed
-.\"
-.Sh SEE ALSO
-.Xr racoon 8 ,
-.Xr racoonctl 8 ,
-.Xr setkey 8
-.\"
-.Sh HISTORY
-The
-.Nm
-configuration file first appeared in the
-.Dq YIPS
-Yokogawa IPsec implementation.
-.\"
-.Sh BUGS
-Some statements may not be handled by
-.Xr racoon 8
-yet.
-.Pp
-Diffie-Hellman computation can take a very long time, and may cause
-unwanted timeouts, specifically when a large D-H group is used.
-.\"
-.Sh SECURITY CONSIDERATIONS
-The use of IKE phase 1 aggressive mode is not recommended,
-as described in
-.Li http://www.kb.cert.org/vuls/id/886601 .
diff --git a/src/racoon/racoonctl.8 b/src/racoon/racoonctl.8
deleted file mode 100644
index b27b188..0000000
--- a/src/racoon/racoonctl.8
+++ /dev/null
@@ -1,199 +0,0 @@
-.\"	$NetBSD: racoonctl.8,v 1.13 2006/09/09 16:22:10 manu Exp $
-.\"
-.\" Id: racoonctl.8,v 1.6 2006/05/07 21:32:59 manubsd Exp
-.\"
-.\" Copyright (C) 2004 Emmanuel Dreyfus
-.\" All rights reserved.
-.\"
-.\" Redistribution and use in source and binary forms, with or without
-.\" modification, are permitted provided that the following conditions
-.\" are met:
-.\" 1. Redistributions of source code must retain the above copyright
-.\"    notice, this list of conditions and the following disclaimer.
-.\" 2. Redistributions in binary form must reproduce the above copyright
-.\"    notice, this list of conditions and the following disclaimer in the
-.\"    documentation and/or other materials provided with the distribution.
-.\" 3. Neither the name of the project nor the names of its contributors
-.\"    may be used to endorse or promote products derived from this software
-.\"    without specific prior written permission.
-.\"
-.\" THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
-.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
-.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-.\" SUCH DAMAGE.
-.\"
-.Dd November 16, 2004
-.Dt RACOONCTL 8
-.Os
-.\"
-.Sh NAME
-.Nm racoonctl
-.Nd racoon administrative control tool
-.\"
-.Sh SYNOPSIS
-.Nm
-reload-config
-.Nm
-show-schedule
-.Nm
-.Op Fl l Op Fl l
-show-sa
-.Op isakmp|esp|ah|ipsec
-.Nm
-flush-sa
-.Op isakmp|esp|ah|ipsec
-.Nm
-delete-sa
-.Ar saopts
-.Nm
-establish-sa
-.Op Fl u Ar identity
-.Ar saopts
-.Nm
-vpn-connect
-.Op Fl u identity
-.Ar vpn_gateway
-.Nm
-vpn-disconnect
-.Ar vpn_gateway
-.Nm
-show-event
-.Op Fl l
-.Nm
-logout-user
-.Ar login
-.\"
-.Sh DESCRIPTION
-.Nm
-is used to control
-.Xr racoon 8
-operation, if ipsec-tools was configured with adminport support.
-Communication between
-.Nm
-and
-.Xr racoon 8
-is done through a UNIX socket.
-By changing the default mode and ownership
-of the socket, you can allow non-root users to alter
-.Xr racoon 8
-behavior, so do that with caution.
-.Pp
-The following commands are available:
-.Bl -tag -width Ds
-.It reload-config
-This should cause
-.Xr racoon 8
-to reload its configuration file.
-.It show-schedule
-Unknown command.
-.It show-sa Op isakmp|esp|ah|ipsec
-Dump the SA: All the SAs if no SA class is provided, or either ISAKMP SAs,
-IPsec ESP SAs, IPsec AH SAs, or all IPsec SAs.
-Use
-.Fl l
-to increase verbosity.
-.It flush-sa Op isakmp|esp|ah|ipsec
-is used to flush all SAs if no SA class is provided, or a class of SAs,
-either ISAKMP SAs, IPsec ESP SAs, IPsec AH SAs, or all IPsec SAs.
-.It Xo establish-sa
-.Oo Fl u Ar username
-.Oc Ar saopts
-.Xc
-Establish an SA, either an ISAKMP SA, IPsec ESP SA, or IPsec AH SA.
-The optional
-.Fl u Ar username
-can be used when establishing an ISAKMP SA while hybrid auth is in use.
-.Nm
-will prompt you for the password associated with
-.Ar username
-and these credentials will be used in the Xauth exchange.
-.Pp
-.Ar saopts
-has the following format:
-.Bl -tag -width Bl
-.It isakmp {inet|inet6} Ar src Ar dst
-.It {esp|ah} {inet|inet6} Ar src/prefixlen/port Ar dst/prefixlen/port
-{icmp|tcp|udp|any}
-.El
-.It Xo vpn-connect
-.Oo Fl u Ar username
-.Oc Ar vpn_gateway
-.Xc
-This is a particular case of the previous command.
-It will establish an ISAKMP SA with
-.Ar vpn_gateway .
-.It delete-sa Ar saopts
-Delete an SA, either an ISAKMP SA, IPsec ESP SA, or IPsec AH SA.
-.It vpn-disconnect Ar vpn_gateway
-This is a particular case of the previous command.
-It will kill all SAs associated with
-.Ar vpn_gateway .
-.It show-event Op Fl l
-Dump all events reported by
-.Xr racoon 8 ,
-then quit.
-The
-.Fl l
-flag causes
-.Nm
-to not stop once all the events have been read, but rather to loop
-awaiting and reporting new events.
-.It logout-user Ar login
-Delete all SA established on behalf of the Xauth user
-.Ar login .
-.El
-.Pp
-Command shortcuts are available:
-.Bl -tag -width XXX -compact -offset indent
-.It rc
-reload-config
-.It ss
-show-sa
-.It sc
-show-schedule
-.It fs
-flush-sa
-.It ds
-delete-sa
-.It es
-establish-sa
-.It vc
-vpn-connect
-.It vd
-vpn-disconnect
-.It se
-show-event
-.It lu
-logout-user
-.El
-.\"
-.Sh RETURN VALUES
-The command should exit with 0 on success, and non-zero on errors.
-.\"
-.Sh FILES
-.Bl -tag -width 30n -compact
-.It Pa /var/racoon/racoon.sock No or
-.It Pa /var/run/racoon.sock
-.Xr racoon 8
-control socket.
-.El
-.\"
-.Sh SEE ALSO
-.Xr ipsec 4 ,
-.Xr racoon 8
-.Sh HISTORY
-Once was
-.Ic kmpstat
-in the KAME project.
-It turned into
-.Nm
-but remained undocumented for a while.
-.An Emmanuel Dreyfus Aq manu@NetBSD.org
-wrote this man page.
diff --git a/src/racoon/racoonctl.c b/src/racoon/racoonctl.c
deleted file mode 100644
index 1dd26f0..0000000
--- a/src/racoon/racoonctl.c
+++ /dev/null
@@ -1,1654 +0,0 @@
-/*	$NetBSD: racoonctl.c,v 1.7.6.2 2009/04/20 13:32:57 tteras Exp $	*/
-
-/*	Id: racoonctl.c,v 1.11 2006/04/06 17:06:25 manubsd Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/socket.h>
-#include <sys/un.h>
-
-#include <netinet/in.h>
-#include <arpa/inet.h>
-#include <net/pfkeyv2.h>
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-#if TIME_WITH_SYS_TIME
-# include <sys/time.h>
-# include <time.h>
-#else
-# if HAVE_SYS_TIME_H
-#  include <sys/time.h>
-# else
-#  include <time.h>
-# endif
-#endif
-#include <netdb.h>
-#ifdef HAVE_UNISTD_H
-#include <unistd.h>
-#endif
-#include <err.h>
-#include <sys/ioctl.h> 
-#include <resolv.h>
-
-#include "var.h"
-#include "vmbuf.h"
-#include "misc.h"
-#include "gcmalloc.h"
-
-#include "racoonctl.h"
-#include "admin.h"
-#include "schedule.h"
-#include "handler.h"
-#include "sockmisc.h"
-#include "vmbuf.h"
-#include "plog.h"
-#include "isakmp_var.h"
-#include "isakmp.h"
-#include "isakmp_xauth.h"
-#include "isakmp_cfg.h"
-#include "isakmp_unity.h"
-#include "ipsec_doi.h"
-#include "evt.h"
-
-char *adminsock_path = ADMINSOCK_PATH;
-
-static void usage __P((void));
-static vchar_t *get_combuf __P((int, char **));
-static int handle_recv __P((vchar_t *));
-static vchar_t *f_reload __P((int, char **));
-static vchar_t *f_getsched __P((int, char **));
-static vchar_t *f_getsa __P((int, char **));
-static vchar_t *f_flushsa __P((int, char **));
-static vchar_t *f_deletesa __P((int, char **));
-static vchar_t *f_exchangesa __P((int, char **));
-static vchar_t *f_vpnc __P((int, char **));
-static vchar_t *f_vpnd __P((int, char **));
-static vchar_t *f_getevt __P((int, char **));
-#ifdef ENABLE_HYBRID
-static vchar_t *f_logoutusr __P((int, char **));
-#endif
-
-struct cmd_tag {
-	vchar_t *(*func) __P((int, char **));
-	int cmd;
-	char *str;
-} cmdtab[] = {
-	{ f_reload,	ADMIN_RELOAD_CONF,	"reload-config" },
-	{ f_reload,	ADMIN_RELOAD_CONF,	"rc" },
-	{ f_getsched,	ADMIN_SHOW_SCHED,	"show-schedule" },
-	{ f_getsched,	ADMIN_SHOW_SCHED,	"sc" },
-	{ f_getsa,	ADMIN_SHOW_SA,		"show-sa" },
-	{ f_getsa,	ADMIN_SHOW_SA,		"ss" },
-	{ f_flushsa,	ADMIN_FLUSH_SA,		"flush-sa" },
-	{ f_flushsa,	ADMIN_FLUSH_SA,		"fs" },
-	{ f_deletesa,	ADMIN_DELETE_SA,	"delete-sa" },
-	{ f_deletesa,	ADMIN_DELETE_SA,	"ds" },
-	{ f_exchangesa,	ADMIN_ESTABLISH_SA,	"establish-sa" },
-	{ f_exchangesa,	ADMIN_ESTABLISH_SA,	"es" },
-	{ f_vpnc,	ADMIN_ESTABLISH_SA,	"vpn-connect" },
-	{ f_vpnc,	ADMIN_ESTABLISH_SA,	"vc" },
-	{ f_vpnd,	ADMIN_DELETE_ALL_SA_DST,"vpn-disconnect" },
-	{ f_vpnd,	ADMIN_DELETE_ALL_SA_DST,"vd" },
-	{ f_getevt,	ADMIN_SHOW_EVT,		"show-event" },
-	{ f_getevt,	ADMIN_SHOW_EVT,		"se" },
-#ifdef ENABLE_HYBRID
-	{ f_logoutusr,	ADMIN_LOGOUT_USER,	"logout-user" },
-	{ f_logoutusr,	ADMIN_LOGOUT_USER,	"lu" },
-#endif
-	{ NULL, 0, NULL },
-};
-
-struct evtmsg {
-	int type;
-	char *msg;
-	enum { UNSPEC, ERROR, INFO } level;
-} evtmsg[] = {
-	{ EVTT_PHASE1_UP, "Phase 1 established", INFO },
-	{ EVTT_PHASE1_DOWN, "Phase 1 deleted", INFO },
-	{ EVTT_XAUTH_SUCCESS, "Xauth exchange passed", INFO },
-	{ EVTT_ISAKMP_CFG_DONE, "ISAKMP mode config done", INFO },
-	{ EVTT_PHASE2_UP, "Phase 2 established", INFO },
-	{ EVTT_PHASE2_DOWN, "Phase 2 deleted", INFO },
-	{ EVTT_DPD_TIMEOUT, "Peer not reachable anymore", ERROR },
-	{ EVTT_PEER_NO_RESPONSE, "Peer not responding", ERROR },
-	{ EVTT_PEER_DELETE, "Peer terminated security association", ERROR },
-	{ EVTT_RACOON_QUIT, "Raccon terminated", ERROR },
-	{ EVTT_OVERFLOW, "Event queue overflow", ERROR },
-	{ EVTT_XAUTH_FAILED, "Xauth exchange failed", ERROR },
-	{ EVTT_PEERPH1AUTH_FAILED, "Peer failed phase 1 authentication "
-	    "(certificate problem?)", ERROR },
-	{ EVTT_PEERPH1_NOPROP, "Peer failed phase 1 initiation "
-	    "(proposal problem?)", ERROR },
-	{ 0, NULL, UNSPEC },
-	{ EVTT_NO_ISAKMP_CFG, "No need for ISAKMP mode config ", INFO },
-};
-
-static int get_proto __P((char *));
-static vchar_t *get_index __P((int, char **));
-static int get_family __P((char *));
-static vchar_t *get_comindexes __P((int, int, char **));
-static int get_comindex __P((char *, char **, char **, char **));
-static int get_ulproto __P((char *));
-
-struct proto_tag {
-	int proto;
-	char *str;
-} prototab[] = {
-	{ ADMIN_PROTO_ISAKMP,	"isakmp" },
-	{ ADMIN_PROTO_IPSEC,	"ipsec" },
-	{ ADMIN_PROTO_AH,	"ah" },
-	{ ADMIN_PROTO_ESP,	"esp" },
-	{ ADMIN_PROTO_INTERNAL,	"internal" },
-	{ 0, NULL },
-};
-
-struct ulproto_tag {
-	int ul_proto;
-	char *str;
-} ulprototab[] = {
-	{ 0,		"any" },
-	{ IPPROTO_ICMP,	"icmp" },
-	{ IPPROTO_TCP,	"tcp" },
-	{ IPPROTO_UDP,	"udp" },
-	{ 0, NULL },
-};
-
-int so;
-
-static char _addr1_[NI_MAXHOST], _addr2_[NI_MAXHOST];
-
-char *pname;
-int long_format = 0;
-
-#define EVTF_NONE		0x0000	/* Ignore any events */
-#define EVTF_LOOP		0x0001	/* Loop awaiting for new events */
-#define EVTF_CFG_STOP		0x0002	/* Stop after ISAKMP mode config */
-#define EVTF_CFG		0x0004	/* Print ISAKMP mode config info */
-#define EVTF_ALL		0x0008	/* Print any events */
-#define EVTF_PURGE		0x0010	/* Print all available events */
-#define EVTF_PH1DOWN_STOP	0x0020	/* Stop when phase 1 SA gets down */
-#define EVTF_PH1DOWN		0x0040	/* Print that phase 1 SA got down */
-#define EVTF_ERR		0x0080	/* Print any error */
-#define EVTF_ERR_STOP		0x0100	/* Stop on any error */
-
-int evt_filter = EVTF_NONE;
-time_t evt_start;
-
-void dump_isakmp_sa __P((char *, int));
-void dump_internal __P((char *, int));
-char *pindex_isakmp __P((isakmp_index *));
-void print_schedule __P((caddr_t, int));
-void print_evt __P((caddr_t, int));
-void print_cfg __P((caddr_t, int));
-void print_err __P((caddr_t, int));
-void print_ph1down __P((caddr_t, int));
-void print_ph1up __P((caddr_t, int));
-int evt_poll __P((void));
-char * fixed_addr __P((char *, char *, int));
-
-static void
-usage()
-{
-	printf(
-"Usage:\n"
-"  %s reload-config\n"
-"  %s [-l [-l]] show-sa [protocol]\n"
-"  %s flush-sa [protocol]\n"
-"  %s delete-sa <saopts>\n"
-"  %s establish-sa [-u identity] <saopts>\n"
-"  %s vpn-connect [-u identity] vpn_gateway\n"
-"  %s vpn-disconnect vpn_gateway\n"
-"\n"
-"    <protocol>: \"isakmp\", \"esp\" or \"ah\".\n"
-"        In the case of \"show-sa\" or \"flush-sa\", you can use \"ipsec\".\n"
-"\n"
-"    <saopts>: \"isakmp\" <family> <src> <dst>\n"
-"            : {\"esp\",\"ah\"} <family> <src/prefixlen/port> <dst/prefixlen/port>\n"
-"                              <ul_proto>\n"
-"    <family>: \"inet\" or \"inet6\"\n"
-"    <ul_proto>: \"icmp\", \"tcp\", \"udp\" or \"any\"\n",
-	pname, pname, pname, pname, pname, pname, pname);
-}
-
-/*
- * Check for proper racoonctl interface
- */
-#if ((RACOONCTL_INTERFACE_MAJOR != 1) || (RACOONCTL_INTERFACE < 20041230))
-#error	"Incompatible racoonctl interface"
-#endif
-
-int
-main(ac, av)
-	int ac;
-	char **av;
-{
-	vchar_t *combuf;
-	int c;
-
-	pname = *av;
-
-	/*
-	 * Check for proper racoonctl interface
-	 */
-	if ((racoonctl_interface_major != RACOONCTL_INTERFACE_MAJOR) ||
-	    (racoonctl_interface < RACOONCTL_INTERFACE))
-		errx(1, "Incompatible racoonctl interface");
-
-#ifdef __linux__
-	/*
-	 * Disable GNU extensions that will prevent racoonct vc -u login
-	 * from working (GNU getopt(3) does not like options after vc)
-	 */
-	setenv("POSIXLY_CORRECT", "1", 0);
-#endif
-	while ((c = getopt(ac, av, "lds:")) != -1) {
-		switch(c) {
-		case 'l':
-			long_format++;
-			break;
-
-		case 'd':
-			loglevel++;
-			break;
-
-		case 's':
-			adminsock_path = optarg;
-			break;
-
-		default:
-			usage();
-			exit(0);
-		}
-	}
-
-	ac -= optind;
-	av += optind;
-
-	combuf = get_combuf(ac, av);
-	if (!combuf)
-		err(1, "kmpstat");
-
-	if (loglevel)
-		racoon_hexdump(combuf, ((struct admin_com *)combuf)->ac_len);
-
-	com_init();
-
-	if (com_send(combuf) != 0)
-		goto bad;
-
-	vfree(combuf);
-
-	if (com_recv(&combuf) != 0)
-		goto bad;
-	if (handle_recv(combuf) != 0)
-		goto bad;
-
-	vfree(combuf);
-
-	if (evt_filter != EVTF_NONE)
-		if (evt_poll() != 0)
-			goto bad;	
-	
-	exit(0);
-
-    bad:
-	exit(1);
-}
-
-int
-evt_poll(void) {
-	struct timeval tv;
-	vchar_t *recvbuf;
-	vchar_t *sendbuf;
-
-	if ((sendbuf = f_getevt(0, NULL)) == NULL)
-		errx(1, "Cannot make combuf");
-
-
-	while (evt_filter & (EVTF_LOOP|EVTF_PURGE)) {
-		/* handle_recv closes the socket time, so open it each time */
-		com_init();
-
-		if (com_send(sendbuf) != 0)
-			errx(1, "Cannot send combuf");
-
-		if (com_recv(&recvbuf) == 0) {
-			handle_recv(recvbuf);
-			vfree(recvbuf);
-		}
-
-		tv.tv_sec = 0;
-		tv.tv_usec = 10;
-		(void)select(0, NULL, NULL, NULL, &tv);
-	}
-
-	vfree(sendbuf);
-	return 0;
-}
-
-/* %%% */
-/*
- * return command buffer.
- */
-static vchar_t *
-get_combuf(ac, av)
-	int ac;
-	char **av;
-{
-	struct cmd_tag *cp;
-
-	if (ac == 0) {
-		usage();
-		exit(0);
-	}
-
-	/* checking the string of command. */
-	for (cp = &cmdtab[0]; cp->str; cp++) {
-		if (strcmp(*av, cp->str) == 0) {
-			break;
-		}
-	}
-	if (!cp->str) {
-		printf("Invalid command [%s]\n", *av);
-		errno = EINVAL;
-		return NULL;
-	}
-
-	ac--;
-	av++;
-	return (cp->func)(ac, av);
-}
-
-static vchar_t *
-f_reload(ac, av)
-	int ac;
-	char **av;
-{
-	vchar_t *buf;
-	struct admin_com *head;
-
-	buf = vmalloc(sizeof(*head));
-	if (buf == NULL)
-		errx(1, "not enough core");
-
-	head = (struct admin_com *)buf->v;
-	head->ac_len = buf->l;
-	head->ac_cmd = ADMIN_RELOAD_CONF;
-	head->ac_errno = 0;
-	head->ac_proto = 0;
-
-	return buf;
-}
-
-static vchar_t *
-f_getevt(ac, av)
-	int ac;
-	char **av;
-{
-	vchar_t *buf;
-	struct admin_com *head;
-
-	/*
-	 * There are 3 ways of getting here
-	 * 1) racoonctl vc => evt_filter = (EVTF_LOOP|EVTF_CFG| ... )
-	 * 2) racoonctl es => evt_filter = EVTF_NONE
-	 * 3) racoonctl es -l => evt_filter = EVTF_LOOP
-	 * Catch the second case: show-event is here to purge all
-	 */
-	if (evt_filter == EVTF_NONE)
-		evt_filter = (EVTF_ALL|EVTF_PURGE);
-
-	if ((ac >= 1) && (strcmp(av[0], "-l") == 0))
-		evt_filter |= EVTF_LOOP;
-
-	if (ac >= 2)
-		errx(1, "too many arguments");
-
-	buf = vmalloc(sizeof(*head));
-	if (buf == NULL)
-		errx(1, "not enough core");
-
-	head = (struct admin_com *)buf->v;
-	head->ac_len = buf->l;
-	head->ac_cmd = ADMIN_SHOW_EVT;
-	head->ac_errno = 0;
-	head->ac_proto = 0;
-
-	return buf;
-}
-
-static vchar_t *
-f_getsched(ac, av)
-	int ac;
-	char **av;
-{
-	vchar_t *buf;
-	struct admin_com *head;
-
-	buf = vmalloc(sizeof(*head));
-	if (buf == NULL)
-		errx(1, "not enough core");
-
-	head = (struct admin_com *)buf->v;
-	head->ac_len = buf->l;
-	head->ac_cmd = ADMIN_SHOW_SCHED;
-	head->ac_errno = 0;
-	head->ac_proto = 0;
-
-	return buf;
-}
-
-static vchar_t *
-f_getsa(ac, av)
-	int ac;
-	char **av;
-{
-	vchar_t *buf;
-	struct admin_com *head;
-	int proto;
-
-	/* need protocol */
-	if (ac != 1)
-		errx(1, "insufficient arguments");
-	proto = get_proto(*av);
-	if (proto == -1)
-		errx(1, "unknown protocol %s", *av);
-
-	buf = vmalloc(sizeof(*head));
-	if (buf == NULL)
-		errx(1, "not enough core");
-
-	head = (struct admin_com *)buf->v;
-	head->ac_len = buf->l;
-	head->ac_cmd = ADMIN_SHOW_SA;
-	head->ac_errno = 0;
-	head->ac_proto = proto;
-
-	return buf;
-}
-
-static vchar_t *
-f_flushsa(ac, av)
-	int ac;
-	char **av;
-{
-	vchar_t *buf;
-	struct admin_com *head;
-	int proto;
-
-	/* need protocol */
-	if (ac != 1)
-		errx(1, "insufficient arguments");
-	proto = get_proto(*av);
-	if (proto == -1)
-		errx(1, "unknown protocol %s", *av);
-
-	buf = vmalloc(sizeof(*head));
-	if (buf == NULL)
-		errx(1, "not enough core");
-
-	head = (struct admin_com *)buf->v;
-	head->ac_len = buf->l;
-	head->ac_cmd = ADMIN_FLUSH_SA;
-	head->ac_errno = 0;
-	head->ac_proto = proto;
-
-	return buf;
-}
-
-static vchar_t *
-f_deletesa(ac, av)
-	int ac;
-	char **av;
-{
-	vchar_t *buf, *index;
-	struct admin_com *head;
-	int proto;
-
-	/* need protocol */
-	if (ac < 1)
-		errx(1, "insufficient arguments");
-	proto = get_proto(*av);
-	if (proto == -1)
-		errx(1, "unknown protocol %s", *av);
-
-	/* get index(es) */
-	av++;
-	ac--;
-	switch (proto) {
-	case ADMIN_PROTO_ISAKMP:
-		index = get_index(ac, av);
-		if (index == NULL)
-			return NULL;
-		break;
-	case ADMIN_PROTO_AH:
-	case ADMIN_PROTO_ESP:
-		index = get_index(ac, av);
-		if (index == NULL)
-			return NULL;
-		break;
-	default:
-		errno = EPROTONOSUPPORT;
-		return NULL;
-	}
-
-	buf = vmalloc(sizeof(*head) + index->l);
-	if (buf == NULL)
-		goto out;
-
-	head = (struct admin_com *)buf->v;
-	head->ac_len = buf->l + index->l;
-	head->ac_cmd = ADMIN_DELETE_SA;
-	head->ac_errno = 0;
-	head->ac_proto = proto;
-
-	memcpy(buf->v+sizeof(*head), index->v, index->l);
-
-out:
-	if (index != NULL)
-		vfree(index);
-
-	return buf;
-}
-
-static vchar_t *
-f_deleteallsadst(ac, av)
-	int ac;
-	char **av;
-{
-	vchar_t *buf, *index;
-	struct admin_com *head;
-	int proto;
-
-	/* need protocol */
-	if (ac < 1)
-		errx(1, "insufficient arguments");
-	proto = get_proto(*av);
-	if (proto == -1)
-		errx(1, "unknown protocol %s", *av);
-
-	/* get index(es) */
-	av++;
-	ac--;
-	switch (proto) {
-	case ADMIN_PROTO_ISAKMP:
-		index = get_index(ac, av);
-		if (index == NULL)
-			return NULL;
-		break;
-	case ADMIN_PROTO_AH:
-	case ADMIN_PROTO_ESP:
-		index = get_index(ac, av);
-		if (index == NULL)
-			return NULL;
-		break;
-	default:
-		errno = EPROTONOSUPPORT;
-		return NULL;
-	}
-
-	buf = vmalloc(sizeof(*head) + index->l);
-	if (buf == NULL)
-		goto out;
-
-	head = (struct admin_com *)buf->v;
-	head->ac_len = buf->l + index->l;
-	head->ac_cmd = ADMIN_DELETE_ALL_SA_DST;
-	head->ac_errno = 0;
-	head->ac_proto = proto;
-
-	memcpy(buf->v+sizeof(*head), index->v, index->l);
-
-out:
-	if (index != NULL)
-		vfree(index);
-
-	return buf;
-}
-
-static vchar_t *
-f_exchangesa(ac, av)
-	int ac;
-	char **av;
-{
-	vchar_t *buf, *index;
-	struct admin_com *head;
-	int proto;
-	int cmd = ADMIN_ESTABLISH_SA;
-	size_t com_len = 0;
-	char *id = NULL;
-	char *key = NULL;
-	struct admin_com_psk *acp;
-
-	if (ac < 1)
-		errx(1, "insufficient arguments");
-
-	/* Optional -u identity */
-	if (strcmp(av[0], "-u") == 0) {
-		if (ac < 2)
-			errx(1, "-u require an argument");
-
-		id = av[1];
-		if ((key = getpass("Password: ")) == NULL)
-			errx(1, "getpass() failed: %s", strerror(errno));
-		
-		com_len += sizeof(*acp) + strlen(id) + 1 + strlen(key) + 1;
-		cmd = ADMIN_ESTABLISH_SA_PSK;
-
-		av += 2;
-		ac -= 2;
-	}
-
-	/* need protocol */
-	if (ac < 1)
-		errx(1, "insufficient arguments");
-	if ((proto = get_proto(*av)) == -1)
-		errx(1, "unknown protocol %s", *av);
-
-	/* get index(es) */
-	av++;
-	ac--;
-	switch (proto) {
-	case ADMIN_PROTO_ISAKMP:
-		index = get_index(ac, av);
-		if (index == NULL)
-			return NULL;
-		break;
-	case ADMIN_PROTO_AH:
-	case ADMIN_PROTO_ESP:
-		index = get_index(ac, av);
-		if (index == NULL)
-			return NULL;
-		break;
-	default:
-		errno = EPROTONOSUPPORT;
-		return NULL;
-	}
-
-	com_len += sizeof(*head) + index->l;
-	if ((buf = vmalloc(com_len)) == NULL)
-		errx(1, "Cannot allocate buffer");
-
-	head = (struct admin_com *)buf->v;
-	head->ac_len = buf->l;
-	head->ac_cmd = cmd;
-	head->ac_errno = 0;
-	head->ac_proto = proto;
-
-	memcpy(buf->v+sizeof(*head), index->v, index->l);
-
-	if (id && key) {
-		char *data;
-		acp = (struct admin_com_psk *)
-		    (buf->v + sizeof(*head) + index->l);
-
-		acp->id_type = IDTYPE_USERFQDN;
-		acp->id_len = strlen(id) + 1;
-		acp->key_len = strlen(key) + 1;
-
-		data = (char *)(acp + 1);
-		strcpy(data, id);
-
-		data = (char *)(data + acp->id_len);
-		strcpy(data, key);
-	}
-
-	vfree(index);
-
-	return buf;
-}
-
-static vchar_t *
-f_vpnc(ac, av)
-	int ac;
-	char **av;
-{
-	char *nav[] = {NULL, NULL, NULL, NULL, NULL, NULL};
-	int nac = 0;
-	char *isakmp = "isakmp";
-	char *inet = "inet";
-	char *srcaddr;
-	struct addrinfo hints, *res;
-	struct sockaddr *src;
-	char *idx;
-
-	if (ac < 1)
-		errx(1, "insufficient arguments");
-
-	evt_filter = (EVTF_LOOP|EVTF_CFG|EVTF_CFG_STOP|EVTF_ERR|EVTF_ERR_STOP);
-	time(&evt_start);
-	
-	/* Optional -u identity */
-	if (strcmp(av[0], "-u") == 0) {
-		if (ac < 2)
-			errx(1, "-u require an argument");
-
-		nav[nac++] = av[0];
-		nav[nac++] = av[1];
-
-		ac -= 2;
-		av += 2;
-	}
-
-	if (ac < 1)
-		errx(1, "VPN gateway required");	
-	if (ac > 1)
-		warnx("Extra arguments");
-
-	/*
-	 * Find the source address
-	 */
-	memset(&hints, 0, sizeof(hints));
-	hints.ai_family = PF_UNSPEC;
-	hints.ai_socktype = SOCK_DGRAM;
-	if (getaddrinfo(av[0], "4500", &hints, &res) != 0)
-		errx(1, "Cannot resolve destination address");
-
-	if ((src = getlocaladdr(res->ai_addr)) == NULL)
-		errx(1, "cannot find source address");
-
-	if ((srcaddr = saddr2str(src)) == NULL)
-		errx(1, "cannot read source address");
-
-	/* We get "ip[port]" strip the port */
-	if ((idx = index(srcaddr, '[')) == NULL) 
-		errx(1, "unexpected source address format");
-	*idx = '\0';
-
-	nav[nac++] = isakmp;
-	nav[nac++] = inet;
-	nav[nac++] = srcaddr;
-	nav[nac++] = av[0];
-
-	return f_exchangesa(nac, nav);
-}
-
-static vchar_t *
-f_vpnd(ac, av)
-	int ac;
-	char **av;
-{
-	char *nav[] = {NULL, NULL, NULL, NULL};
-	int nac = 0;
-	char *isakmp = "isakmp";
-	char *inet = "inet";
-	char *anyaddr = "0.0.0.0";
-	char *idx;
-
-	if (ac < 1)
-		errx(1, "VPN gateway required");	
-	if (ac > 1)
-		warnx("Extra arguments");
-
-	evt_filter = 
-	    (EVTF_PH1DOWN|EVTF_PH1DOWN_STOP|EVTF_LOOP|EVTF_ERR|EVTF_ERR_STOP);
-
-	nav[nac++] = isakmp;
-	nav[nac++] = inet;
-	nav[nac++] = anyaddr;
-	nav[nac++] = av[0];
-
-	return f_deleteallsadst(nac, nav);
-}
-
-#ifdef ENABLE_HYBRID
-static vchar_t *
-f_logoutusr(ac, av)
-	int ac;
-	char **av;
-{
-	vchar_t *buf;
-	struct admin_com *head;
-	char *user;
-	size_t userlen;
-
-	/* need username */
-	if (ac < 1)
-		errx(1, "insufficient arguments");
-	user = av[0];
-	userlen = strlen(user);
-	if ((user == NULL) || (userlen > LOGINLEN))
-		errx(1, "bad login (too long?)");
-
-	buf = vmalloc(sizeof(*head) + userlen);
-	if (buf == NULL)
-		return NULL;
-
-	head = (struct admin_com *)buf->v;
-	head->ac_len = buf->l;
-	head->ac_cmd = ADMIN_LOGOUT_USER;
-	head->ac_errno = 0;
-	head->ac_proto = 0;
-
-	strncpy((char *)(head + 1), user, userlen);
-
-	return buf;
-}
-#endif /* ENABLE_HYBRID */
-
-
-static int
-get_proto(str)
-	char *str;
-{
-	struct proto_tag *cp;
-
-	if (str == NULL) {
-		errno = EINVAL;
-		return -1;
-	}
-
-	/* checking the string of command. */
-	for (cp = &prototab[0]; cp->str; cp++) {
-		if (strcmp(str, cp->str) == 0)
-			return cp->proto;
-	}
-
-	errno = EINVAL;
-	return -1;
-}
-
-static vchar_t *
-get_index(ac, av)
-	int ac;
-	char **av;
-{
-	int family;
-
-	if (ac != 3 && ac != 4) {
-		errno = EINVAL;
-		return NULL;
-	}
-
-	/* checking the string of family */
-	family = get_family(*av);
-	if (family == -1)
-		return NULL;
-	av++;
-	ac--;
-
-	return get_comindexes(family, ac, av);
-}
-
-static int
-get_family(str)
-	char *str;
-{
-	if (strcmp("inet", str) == 0)
-		return AF_INET;
-#ifdef INET6
-	else if (strcmp("inet6", str) == 0)
-		return AF_INET6;
-#endif
-	errno = EAFNOSUPPORT;
-	return -1;
-}
-
-static vchar_t *
-get_comindexes(family, ac, av)
-	int family;
-	int ac;
-	char **av;
-{
-	vchar_t *buf;
-	struct admin_com_indexes *ci;
-	char *p_name = NULL, *p_port = NULL;
-	char *p_prefs = NULL, *p_prefd = NULL;
-	struct sockaddr *src = NULL, *dst = NULL;
-	int ulproto;
-
-	if (ac != 2 && ac != 3) {
-		errno = EINVAL;
-		return NULL;
-	}
-
-	if (get_comindex(*av, &p_name, &p_port, &p_prefs) == -1)
-		goto bad;
-	src = get_sockaddr(family, p_name, p_port);
-	if (p_name) {
-		racoon_free(p_name);
-		p_name = NULL;
-	}
-	if (p_port) {
-		racoon_free(p_port);
-		p_port = NULL;
-	}
-	if (src == NULL)
-		goto bad;
-	av++;
-	ac--;
-	if (get_comindex(*av, &p_name, &p_port, &p_prefd) == -1)
-		goto bad;
-	dst = get_sockaddr(family, p_name, p_port);
-	if (p_name) {
-		racoon_free(p_name);
-		p_name = NULL;
-	}
-	if (p_port) {
-		racoon_free(p_port);
-		p_port = NULL;
-	}
-	if (dst == NULL)
-		goto bad;
-
-	buf = vmalloc(sizeof(*ci));
-	if (buf == NULL)
-		goto bad;
-
-	av++;
-	ac--;
-	if(ac){
-		ulproto = get_ulproto(*av);
-		if (ulproto == -1)
-			goto bad;
-	}else
-		ulproto=0;
-
-	ci = (struct admin_com_indexes *)buf->v;
-	if(p_prefs)
-		ci->prefs = (u_int8_t)atoi(p_prefs); /* XXX should be handled error. */
-	else
-		ci->prefs = 32;
-	if(p_prefd)
-		ci->prefd = (u_int8_t)atoi(p_prefd); /* XXX should be handled error. */
-	else
-		ci->prefd = 32;
-	ci->ul_proto = ulproto;
-	memcpy(&ci->src, src, sysdep_sa_len(src));
-	memcpy(&ci->dst, dst, sysdep_sa_len(dst));
-
-	if (p_name)
-		racoon_free(p_name);
-
-	return buf;
-
-   bad:
-	if (p_name)
-		racoon_free(p_name);
-	if (p_port)
-		racoon_free(p_port);
-	if (p_prefs)
-		racoon_free(p_prefs);
-	if (p_prefd)
-		racoon_free(p_prefd);
-	return NULL;
-}
-
-static int
-get_comindex(str, name, port, pref)
-	char *str, **name, **port, **pref;
-{
-	char *p;
-
-	*name = *port = *pref = NULL;
-
-	*name = racoon_strdup(str);
-	STRDUP_FATAL(*name);
-	p = strpbrk(*name, "/[");
-	if (p != NULL) {
-		if (*(p + 1) == '\0')
-			goto bad;
-		if (*p == '/') {
-			*p = '\0';
-			*pref = racoon_strdup(p + 1);
-			STRDUP_FATAL(*pref);
-			p = strchr(*pref, '[');
-			if (p != NULL) {
-				if (*(p + 1) == '\0')
-					goto bad;
-				*p = '\0';
-				*port = racoon_strdup(p + 1);
-				STRDUP_FATAL(*port);
-				p = strchr(*pref, ']');
-				if (p == NULL)
-					goto bad;
-				*p = '\0';
-			}
-		} else if (*p == '[') {
-			if (*pref == NULL)
-				goto bad;
-			*p = '\0';
-			*port = racoon_strdup(p + 1);
-			STRDUP_FATAL(*port);
-			p = strchr(*pref, ']');
-			if (p == NULL)
-				goto bad;
-			*p = '\0';
-		} else {
-			/* XXX */
-		}
-	}
-
-	return 0;
-
-    bad:
-
-	if (*name)
-		racoon_free(*name);
-	if (*port)
-		racoon_free(*port);
-	if (*pref)
-		racoon_free(*pref);
-	*name = *port = *pref = NULL;
-	return -1;
-}
-
-static int
-get_ulproto(str)
-	char *str;
-{
-	struct ulproto_tag *cp;
-
-	if(str == NULL){
-		errno = EINVAL;
-		return -1;
-	}
-
-	/* checking the string of upper layer protocol. */
-	for (cp = &ulprototab[0]; cp->str; cp++) {
-		if (strcmp(str, cp->str) == 0)
-			return cp->ul_proto;
-	}
-
-	errno = EINVAL;
-	return -1;
-}
-
-/* %%% */
-void
-dump_isakmp_sa(buf, len)
-	char *buf;
-	int len;
-{
-	struct ph1dump *pd;
-	struct tm *tm;
-	char tbuf[56];
-	caddr_t p = NULL;
-
-/* isakmp status header */
-/* short header;
- 1234567890123456789012 0000000000000000:0000000000000000 000000000000
-*/
-char *header1 = 
-"Destination            Cookies                           Created";
-
-/* semi long header;
- 1234567890123456789012 0000000000000000:0000000000000000 00 X 00 X 0000-00-00 00:00:00 000000
-*/
-char *header2 = 
-"Destination            Cookies                           ST S  V E Created             Phase2";
-
-/* long header;
- 0000:0000:0000:0000:0000:0000:0000:0000.00000 0000:0000:0000:0000:0000:0000:0000:0000.00000 0000000000000000:0000000000000000 00 X 00 X 0000-00-00 00:00:00 000000
-*/
-char *header3 =
-"Source                                        Destination                                   Cookies                           ST S  V E Created             Phase2";
-
-/* phase status header */
-/* short format;
-   side stats source address         destination address   
-   xxx  xxxxx 1234567890123456789012 1234567890123456789012
-*/
-
-	static char *estr[] = { "", "B", "M", "U", "A", "I", };
-
-	switch (long_format) {
-	case 0:
-		printf("%s\n", header1);
-		break;
-	case 1:
-		printf("%s\n", header2);
-		break;
-	case 2:
-	default:
-		printf("%s\n", header3);
-		break;
-	}
-
-	if (len % sizeof(*pd))
-		printf("invalid length %d\n", len);
-	len /= sizeof(*pd);
-
-	pd = (struct ph1dump *)buf;
-
-	while (len-- > 0) {
-		/* source address */
-		if (long_format >= 2) {
-			GETNAMEINFO((struct sockaddr *)&pd->local, _addr1_, _addr2_);
-			switch (long_format) {
-			case 0:
-				break;
-			case 1:
-				p = fixed_addr(_addr1_, _addr2_, 22);
-				break;
-			case 2:
-			default:
-				p = fixed_addr(_addr1_, _addr2_, 45);
-				break;
-			}
-			printf("%s ", p);
-		}
-
-		/* destination address */
-		GETNAMEINFO((struct sockaddr *)&pd->remote, _addr1_, _addr2_);
-		switch (long_format) {
-		case 0:
-		case 1:
-			p = fixed_addr(_addr1_, _addr2_, 22);
-			break;
-		case 2:
-		default:
-			p = fixed_addr(_addr1_, _addr2_, 45);
-			break;
-		}
-		printf("%s ", p);
-
-		printf("%s ", pindex_isakmp(&pd->index));
-
-		/* statuc, side and version */
-		if (long_format >= 1) {
-			printf("%2d %c %2x ",
-				pd->status,
-				pd->side == INITIATOR ? 'I' : 'R',
-				pd->version);
-			if (ARRAYLEN(estr) > pd->etype)
-				printf("%s ", estr[pd->etype]);
-		}
-
-		/* created date */
-		if (pd->created) {
-			tm = localtime(&pd->created);
-			strftime(tbuf, sizeof(tbuf), "%Y-%m-%d %T", tm);
-		} else
-			snprintf(tbuf, sizeof(tbuf), "                   ");
-		printf("%s ", tbuf);
-
-		/* counter of phase 2 */
-		if (long_format >= 1)
-			printf("%6d ", pd->ph2cnt);
-
-		printf("\n");
-
-		pd++;
-	}
-
-	return;
-}
-
-/* %%% */
-void
-dump_internal(buf, tlen)
-	char *buf;
-	int tlen;
-{
-	struct ph2handle *iph2;
-	struct sockaddr *addr;
-
-/*
-short header;
- source address         destination address    
- 1234567890123456789012 1234567890123456789012 
-*/
-char *short_h1 = 
-"Source                 Destination            ";
-
-/*
-long header;
- source address                                destination address                           
- 123456789012345678901234567890123456789012345 123456789012345678901234567890123456789012345 
- 0000:0000:0000:0000:0000:0000:0000:0000.00000 0000:0000:0000:0000:0000:0000:0000:0000.00000 0000:0000:0000:0000:0000:0000:0000:0000.00000
-*/
-char *long_h1 = 
-"Source                                        Destination                                  ";
-
-	printf("%s\n", long_format ? long_h1 : short_h1);
-
-	while (tlen > 0) {
-		iph2 = (struct ph2handle *)buf;
-		addr = (struct sockaddr *)(++iph2);
-
-		GETNAMEINFO(addr, _addr1_, _addr2_);
-		printf("%s ", long_format ?
-			  fixed_addr(_addr1_, _addr2_, 45)
-			: fixed_addr(_addr1_, _addr2_, 22));
-		addr++;
-		tlen -= sysdep_sa_len(addr);
-
-		GETNAMEINFO(addr, _addr1_, _addr2_);
-		printf("%s ", long_format ?
-			  fixed_addr(_addr1_, _addr2_, 45)
-			: fixed_addr(_addr1_, _addr2_, 22));
-		addr++;
-		tlen -= sysdep_sa_len(addr);
-
-		printf("\n");
-	}
-
-	return;
-}
-
-/* %%% */
-char *
-pindex_isakmp(index)
-	isakmp_index *index;
-{
-	static char buf[64];
-	u_char *p;
-	int i, j;
-
-	memset(buf, 0, sizeof(buf));
-
-	/* copy index */
-	p = (u_char *)index;
-	for (j = 0, i = 0; i < sizeof(isakmp_index); i++) {
-		snprintf((char *)&buf[j], sizeof(buf) - j, "%02x", p[i]);
-		j += 2;
-		switch (i) {
-		case 7:
-#if 0
-		case 15:
-#endif
-			buf[j++] = ':';
-		}
-	}
-
-	return buf;
-}
-
-/* print schedule */
-char *str_sched_stat[] = {
-"off",
-"on",
-"dead",
-};
-
-char *str_sched_id[] = {
-"PH1resend",
-"PH1lifetime",
-"PH2resend",
-"PSTacquire",
-"PSTlifetime",
-};
-
-void
-print_schedule(buf, len)
-	caddr_t buf;
-	int len;
-{
-	struct scheddump *sc = (struct scheddump *)buf;
-	struct tm *tm;
-	char tbuf[56];
-
-	if (len % sizeof(*sc))
-		printf("invalid length %d\n", len);
-	len /= sizeof(*sc);
-
-	/*      00000000 00000000 00000000 xxx........*/
-	printf("index    tick     xtime    created\n");
-
-	while (len-- > 0) {
-		tm = localtime(&sc->created);
-		strftime(tbuf, sizeof(tbuf), "%Y-%m-%d %T", tm);
-
-		printf("%-8ld %-8ld %-8ld %s\n",
-			sc->id,
-			(long)sc->tick,
-			(long)sc->xtime,
-			tbuf);
-		sc++;
-	}
-
-	return;
-}
-
-
-void
-print_evt(buf, len)
-	caddr_t buf;
-	int len;
-{
-	struct evtdump *evtdump = (struct evtdump *)buf;
-	int i;
-	char *srcstr;
-	char *dststr;
-	
-	for (i = 0; evtmsg[i].msg; i++)
-		if (evtmsg[i].type == evtdump->type)
-			break;				
-	
-	if (evtmsg[i].msg == NULL) 
-		printf("Event %d: ", evtdump->type);
-	else
-		printf("%s : ", evtmsg[i].msg);
-
-	if ((srcstr = saddr2str((struct sockaddr *)&evtdump->src)) == NULL)
-		printf("unknown");
-	else 
-		printf("%s", srcstr);
-	printf(" -> ");
-	if ((dststr = saddr2str((struct sockaddr *)&evtdump->dst)) == NULL)
-		printf("unknown");
-	else 
-		printf("%s", dststr);
-	printf("\n");
-
-	return;
-}
-
-void
-print_err(buf, len)
-	caddr_t buf;
-	int len;
-{
-	struct evtdump *evtdump = (struct evtdump *)buf;
-	int i;
-	
-	
-	for (i = 0; evtmsg[i].msg; i++)
-		if (evtmsg[i].type == evtdump->type)
-			break;				
-
-	if (evtmsg[i].level != ERROR)
-		return;
-	
-	if (evtmsg[i].msg == NULL) 
-		printf("Error: Event %d\n", evtdump->type);
-	else
-		printf("Error: %s\n", evtmsg[i].msg);
-
-	if (evt_filter & EVTF_ERR_STOP)
-		evt_filter &= ~EVTF_LOOP;
-
-	return;
-}
-
-/*
- * Print a message when phase 1 SA goes down
- */
-void
-print_ph1down(buf, len)
-	caddr_t buf;
-	int len;
-{
-	struct evtdump *evtdump = (struct evtdump *)buf;
-	
-	if (evtdump->type != EVTT_PHASE1_DOWN)
-		return;
-
-	printf("VPN connexion terminated\n");
-
-	if (evt_filter & EVTF_PH1DOWN_STOP)
-		evt_filter &= ~EVTF_LOOP;
-	
-	return;
-}
-
-/*
- * Print ISAKMP mode config info (IP and banner)
- */
-void
-print_cfg(buf, len)
-	caddr_t buf;
-	int len;
-{
-	struct evtdump *evtdump = (struct evtdump *)buf;
-	struct isakmp_data *attr;
-	char *banner = NULL;
-	struct in_addr addr4;
-	
-	memset(&addr4, 0, sizeof(addr4));
-
-	if (evtdump->type != EVTT_ISAKMP_CFG_DONE && 
-	    evtdump->type != EVTT_NO_ISAKMP_CFG)
-		return;
-
-	len -= sizeof(*evtdump);
-	attr = (struct isakmp_data *)(evtdump + 1);
-
-	while (len > 0) {
-		if (len < sizeof(*attr)) {
-			printf("short attribute too short\n");
-			break;
-		}
-
-		if ((ntohs(attr->type) & ISAKMP_GEN_MASK) == ISAKMP_GEN_TV) {
-			/* Short attribute, skip */
-			len -= sizeof(*attr);
-			attr++;
-		} else { /* Long attribute */
-			char *n;
-
-			if (len < (sizeof(*attr) + ntohs(attr->lorv))) {
-				printf("long attribute too long\n");
-				break;
-			}
-
-			switch (ntohs(attr->type) & ~ISAKMP_GEN_MASK) {
-			case INTERNAL_IP4_ADDRESS:
-				if (ntohs(attr->lorv) < sizeof(addr4)) {
-					printf("addr4 attribute too short\n");
-					break;
-				}
-				memcpy(&addr4, attr + 1, sizeof(addr4));
-				break;
-
-			case UNITY_BANNER:
-				banner = racoon_malloc(ntohs(attr->lorv) + 1);
-				if (banner == NULL) {
-					printf("malloc failed\n");
-					break;
-				}
-				memcpy(banner, attr + 1, ntohs(attr->lorv));
-				banner[ntohs(attr->lorv)] = '\0';
-				break;
-
-			default:
-				break;
-			}
-
-			len -= (sizeof(*attr) + ntohs(attr->lorv));
-			n = (char *)attr;
-			attr = (struct isakmp_data *)
-			    (n + sizeof(*attr) + ntohs(attr->lorv));
-		}
-	}
-	
-	if (evtdump->type == EVTT_ISAKMP_CFG_DONE)
-		printf("Bound to address %s\n", inet_ntoa(addr4));
-	else
-		printf("VPN connexion established\n");
-	
-	if (banner) {
-		struct winsize win;
-		int col = 0;
-		int i;
-
-		if (ioctl(1, TIOCGWINSZ, &win) != 1) 
-			col = win.ws_col;
-			
-		for (i = 0; i < col; i++)
-			printf("%c", '=');
-		printf("\n%s\n", banner);
-		for (i = 0; i < col; i++)
-			printf("%c", '=');
-		printf("\n");
-		racoon_free(banner);
-	}
-	
-	if (evt_filter & EVTF_CFG_STOP)
-		evt_filter &= ~EVTF_LOOP;
-	
-	return;
-}
-	
-
-char *
-fixed_addr(addr, port, len)
-	char *addr, *port;
-	int len;
-{
-	static char _addr_buf_[BUFSIZ];
-	char *p;
-	int plen, i;
-
-	/* initialize */
-	memset(_addr_buf_, ' ', sizeof(_addr_buf_));
-
-	plen = strlen(port);
-	if (len < plen + 1)
-		return NULL;
-
-	p = _addr_buf_;
-	for (i = 0; i < len - plen - 1 && addr[i] != '\0'; /*noting*/)
-		*p++ = addr[i++];
-	*p++ = '.';
-
-	for (i = 0; i < plen && port[i] != '\0'; /*noting*/)
-		*p++ = port[i++];
-
-	_addr_buf_[len] = '\0';
-
-	return _addr_buf_;
-}
-
-static int
-handle_recv(combuf)
-	vchar_t *combuf;
-{
-        struct admin_com h, *com;
-        caddr_t buf;
-        int len;
-
-	com = (struct admin_com *)combuf->v;
-	len = com->ac_len - sizeof(*com);
-	buf = combuf->v + sizeof(*com);
-
-	switch (com->ac_cmd) {
-	case ADMIN_SHOW_SCHED:
-		print_schedule(buf, len);
-		break;
-
-	case ADMIN_SHOW_EVT: {
-		struct evtdump *evtdump;
-
-		/* We got no event */
-		if (len == 0) {
-			/* If we were purging the queue, it is now done */
-			if (evt_filter & EVTF_PURGE)
-				evt_filter &= ~EVTF_PURGE;
-			break;
-		}
-
-		if (len < sizeof(struct evtdump))
-			errx(1, "Short buffer\n");		
-
-		/* Toss outdated events */
-		evtdump = (struct evtdump *)buf;
-		if (evtdump->timestamp < evt_start)
-			break;
-
-		if (evt_filter & EVTF_ALL)
-			print_evt(buf, len);
-		if (evt_filter & EVTF_ERR)
-			print_err(buf, len);
-		if (evt_filter & EVTF_CFG)
-			print_cfg(buf, len);
-		if (evt_filter & EVTF_PH1DOWN)
-			print_ph1down(buf, len);
-		break;
-	}
-
-	case ADMIN_SHOW_SA:
-	   {
-		switch (com->ac_proto) {
-		case ADMIN_PROTO_ISAKMP:
-			dump_isakmp_sa(buf, len);
-			break;
-		case ADMIN_PROTO_IPSEC:
-		case ADMIN_PROTO_AH:
-		case ADMIN_PROTO_ESP:
-		    {
-			struct sadb_msg *msg = (struct sadb_msg *)buf;
-
-			switch (msg->sadb_msg_errno) {
-			case ENOENT:
-				switch (msg->sadb_msg_type) {
-				case SADB_DELETE:
-				case SADB_GET:
-					printf("No entry.\n");
-					break;
-				case SADB_DUMP:
-					printf("No SAD entries.\n");
-					break;
-				}
-				break;
-			case 0:
-				while (1) {
-					pfkey_sadump(msg);
-					if (msg->sadb_msg_seq == 0)
-						break;
-					msg = (struct sadb_msg *)((caddr_t)msg +
-						     PFKEY_UNUNIT64(msg->sadb_msg_len));
-				}
-				break;
-			default:
-				printf("%s.\n", strerror(msg->sadb_msg_errno));
-			}
-		    }
-			break;
-		case ADMIN_PROTO_INTERNAL:
-			dump_internal(buf, len);
-			break;
-		default:
-			printf("Invalid proto [%d]\n", com->ac_proto);
-		}
-
-	    }
-		break;
-
-	default:
-		/* IGNORE */
-		break;
-	}
-
-	close(so);
-	return 0;
-
-    bad:
-	close(so);
-	return -1;
-}
diff --git a/src/racoon/racoonctl.h b/src/racoon/racoonctl.h
deleted file mode 100644
index d507213..0000000
--- a/src/racoon/racoonctl.h
+++ /dev/null
@@ -1,53 +0,0 @@
-/*	$NetBSD: racoonctl.h,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
-
-/* Id: racoonctl.h,v 1.3 2005/06/19 22:37:47 manubsd Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _RACOONCTL_H
-#define _RACOONCTL_H
-
-/* bumped on any change to the interface */
-#define RACOONCTL_INTERFACE	20050619
-extern u_int32_t racoonctl_interface;
-
-/* bumped when introducing changes that break backward compatibility */
-#define RACOONCTL_INTERFACE_MAJOR	1	
-extern u_int32_t racoonctl_interface_major;
-
-extern u_int32_t loglevel;
-
-int com_init(void);
-int com_send(vchar_t *);
-int com_recv(vchar_t **);
-struct sockaddr *get_sockaddr(int, char *, char *);
-
-#endif /* _RACOONCTL_H */
-
diff --git a/src/racoon/remoteconf.c b/src/racoon/remoteconf.c
deleted file mode 100644
index 3b96f30..0000000
--- a/src/racoon/remoteconf.c
+++ /dev/null
@@ -1,693 +0,0 @@
-/*	$NetBSD: remoteconf.c,v 1.9.4.2 2008/06/18 07:30:19 mgrooms Exp $	*/
-
-/* Id: remoteconf.c,v 1.38 2006/05/06 15:52:44 manubsd Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/socket.h>
-#include <sys/queue.h>
-
-#include <netinet/in.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-
-#include PATH_IPSEC_H
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-
-#include "var.h"
-#include "misc.h"
-#include "vmbuf.h"
-#include "plog.h"
-#include "sockmisc.h"
-#include "genlist.h"
-#include "debug.h"
-
-#include "isakmp_var.h"
-#ifdef ENABLE_HYBRID
-#include "isakmp_xauth.h"
-#endif
-#include "isakmp.h"
-#include "ipsec_doi.h"
-#include "oakley.h"
-#include "remoteconf.h"
-#include "localconf.h"
-#include "grabmyaddr.h"
-#include "policy.h"
-#include "proposal.h"
-#include "vendorid.h"
-#include "gcmalloc.h"
-#include "strnames.h"
-#include "algorithm.h"
-#include "nattraversal.h"
-#include "isakmp_frag.h"
-#include "genlist.h"
-
-static TAILQ_HEAD(_rmtree, remoteconf) rmtree, rmtree_save, rmtree_tmp;
-
-/* 
- * Script hook names and script hook paths
- */
-char *script_names[SCRIPT_MAX + 1] = { "phase1_up", "phase1_down" };
-
-/*%%%*/
-/*
- * search remote configuration.
- * don't use port number to search if its value is either IPSEC_PORT_ANY.
- * If matching anonymous entry, then new entry is copied from anonymous entry.
- * If no anonymous entry found, then return NULL.
- * OUT:	NULL:	NG
- *	Other:	remote configuration entry.
- */
-struct remoteconf *
-getrmconf_strict(remote, allow_anon)
-	struct sockaddr *remote;
-	int allow_anon;
-{
-	struct remoteconf *p;
-	struct remoteconf *anon = NULL;
-	int withport;
-	char buf[NI_MAXHOST + NI_MAXSERV + 10];
-	char addr[NI_MAXHOST], port[NI_MAXSERV];
-
-	withport = 0;
-
-#ifndef ENABLE_NATT
-	/* 
-	 * We never have ports set in our remote configurations, but when
-	 * NAT-T is enabled, the kernel can have policies with ports and
-	 * send us an acquire message for a destination that has a port set.
-	 * If we do this port check here, we don't find the remote config.
-	 *
-	 * In an ideal world, we would be able to have remote conf with
-	 * port, and the port could be a wildcard. That test could be used.
-	 */
-	if (remote->sa_family != AF_UNSPEC &&
-	    extract_port(remote) != IPSEC_PORT_ANY)
-		withport = 1;
-#endif /* ENABLE_NATT */
-
-	if (remote->sa_family == AF_UNSPEC)
-		snprintf (buf, sizeof(buf), "%s", "anonymous");
-	else {
-		GETNAMEINFO(remote, addr, port);
-		snprintf(buf, sizeof(buf), "%s%s%s%s", addr,
-			withport ? "[" : "",
-			withport ? port : "",
-			withport ? "]" : "");
-	}
-
-	TAILQ_FOREACH(p, &rmtree, chain) {
-		if ((remote->sa_family == AF_UNSPEC
-		     && remote->sa_family == p->remote->sa_family)
-		 || (!withport && cmpsaddrwop(remote, p->remote) == 0)
-		 || (withport && cmpsaddrstrict(remote, p->remote) == 0)) {
-			plog(LLV_DEBUG, LOCATION, NULL,
-				"configuration found for %s.\n", buf);
-			return p;
-		}
-
-		/* save the pointer to the anonymous configuration */
-		if (p->remote->sa_family == AF_UNSPEC)
-			anon = p;
-	}
-
-	if (allow_anon && anon != NULL) {
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"anonymous configuration selected for %s.\n", buf);
-		return anon;
-	}
-
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"no remote configuration found.\n");
-
-	return NULL;
-}
-
-struct remoteconf *
-getrmconf(remote)
-	struct sockaddr *remote;
-{
-	return getrmconf_strict(remote, 1);
-}
-
-struct remoteconf *
-newrmconf()
-{
-	struct remoteconf *new;
-	int i;
-
-	new = racoon_calloc(1, sizeof(*new));
-	if (new == NULL)
-		return NULL;
-
-	new->proposal = NULL;
-
-	/* set default */
-	new->doitype = IPSEC_DOI;
-	new->sittype = IPSECDOI_SIT_IDENTITY_ONLY;
-	new->idvtype = IDTYPE_UNDEFINED;
-	new->idvl_p = genlist_init();
-	new->nonce_size = DEFAULT_NONCE_SIZE;
-	new->passive = FALSE;
-	new->ike_frag = FALSE;
-	new->esp_frag = IP_MAXPACKET;
-	new->ini_contact = TRUE;
-	new->mode_cfg = FALSE;
-	new->pcheck_level = PROP_CHECK_STRICT;
-	new->verify_identifier = FALSE;
-	new->verify_cert = TRUE;
-	new->getcert_method = ISAKMP_GETCERT_PAYLOAD;
-	new->getcacert_method = ISAKMP_GETCERT_LOCALFILE;
-	new->cacerttype = ISAKMP_CERT_X509SIGN;
-	new->certtype = ISAKMP_CERT_NONE;
-	new->cacertfile = NULL;
-	new->send_cert = TRUE;
-	new->send_cr = TRUE;
-	new->support_proxy = FALSE;
-	for (i = 0; i <= SCRIPT_MAX; i++)
-		new->script[i] = NULL;
-	new->gen_policy = FALSE;
-	new->retry_counter = lcconf->retry_counter;
-	new->retry_interval = lcconf->retry_interval;
-	new->nat_traversal = FALSE;
-	new->rsa_private = genlist_init();
-	new->rsa_public = genlist_init();
-	new->idv = NULL;
-	new->key = NULL;
-
-	new->dpd = TRUE; /* Enable DPD support by default */
-	new->dpd_interval = 0; /* Disable DPD checks by default */
-	new->dpd_retry = 5;
-	new->dpd_maxfails = 5;
-
-	new->weak_phase1_check = 0;
-
-#ifdef ENABLE_HYBRID
-	new->xauth = NULL;
-#endif
-
-	return new;
-}
-
-struct remoteconf *
-copyrmconf(remote)
-	struct sockaddr *remote;
-{
-	struct remoteconf *new, *old;
-
-	old = getrmconf_strict (remote, 0);
-	if (old == NULL) {
-		plog (LLV_ERROR, LOCATION, NULL,
-		      "Remote configuration for '%s' not found!\n",
-		      saddr2str (remote));
-		return NULL;
-	}
-
-	new = duprmconf (old);
-
-	return new;
-}
-
-void *
-dupidvl(entry, arg)
-	void *entry;
-	void *arg;
-{
-	struct idspec *id;
-	struct idspec *old = (struct idspec *) entry;
-	id = newidspec();
-	if (!id) return (void *) -1;
-
-	if (set_identifier(&id->id, old->idtype, old->id) != 0) {
-		racoon_free(id);
-		return (void *) -1;
-	}
-
-	id->idtype = old->idtype;
-
-	genlist_append(arg, id);
-	return NULL;
-}
-
-struct remoteconf *
-duprmconf (rmconf)
-	struct remoteconf *rmconf;
-{
-	struct remoteconf *new;
-
-	new = racoon_calloc(1, sizeof(*new));
-	if (new == NULL)
-		return NULL;
-	memcpy (new, rmconf, sizeof (*new));
-	// FIXME: We should duplicate the proposal as well.
-	// This is now handled in the cfparse.y
-	// new->proposal = ...;
-	
-	/* duplicate dynamic structures */
-	if (new->etypes)
-		new->etypes=dupetypes(new->etypes);
-	new->idvl_p = genlist_init();
-	genlist_foreach(rmconf->idvl_p, dupidvl, new->idvl_p);
-
-	return new;
-}
-
-static void
-idspec_free(void *data)
-{
-	vfree (((struct idspec *)data)->id);
-	free (data);
-}
-
-void
-delrmconf(rmconf)
-	struct remoteconf *rmconf;
-{
-#ifdef ENABLE_HYBRID
-	if (rmconf->xauth)
-		xauth_rmconf_delete(&rmconf->xauth);
-#endif
-	if (rmconf->etypes){
-		deletypes(rmconf->etypes);
-		rmconf->etypes=NULL;
-	}
-	if (rmconf->idvl_p)
-		genlist_free(rmconf->idvl_p, idspec_free);
-	if (rmconf->dhgrp)
-		oakley_dhgrp_free(rmconf->dhgrp);
-	if (rmconf->proposal)
-		delisakmpsa(rmconf->proposal);
-	racoon_free(rmconf);
-}
-
-void
-delisakmpsa(sa)
-	struct isakmpsa *sa;
-{
-	if (sa->dhgrp)
-		oakley_dhgrp_free(sa->dhgrp);
-	if (sa->next)
-		delisakmpsa(sa->next);
-#ifdef HAVE_GSSAPI
-	if (sa->gssid)
-		vfree(sa->gssid);
-#endif
-	racoon_free(sa);
-}
-
-struct etypes *
-dupetypes(orig)
-	struct etypes *orig;
-{
-	struct etypes *new;
-
-	if (!orig) 
-		return NULL;
-
-	new = racoon_malloc(sizeof(struct etypes));
-	if (new == NULL) 
-		return NULL;
-
-	new->type = orig->type;
-	new->next = NULL;
-
-	if (orig->next)
-		new->next=dupetypes(orig->next);
-
-	return new;
-}
-
-void
-deletypes(e)
-	struct etypes *e;
-{
-	if (e->next)
-		deletypes(e->next);
-	racoon_free(e);
-}
-
-/*
- * insert into head of list.
- */
-void
-insrmconf(new)
-	struct remoteconf *new;
-{
-	TAILQ_INSERT_HEAD(&rmtree, new, chain);
-}
-
-void
-remrmconf(rmconf)
-	struct remoteconf *rmconf;
-{
-	TAILQ_REMOVE(&rmtree, rmconf, chain);
-}
-
-void
-flushrmconf()
-{
-	struct remoteconf *p, *next;
-
-	for (p = TAILQ_FIRST(&rmtree); p; p = next) {
-		next = TAILQ_NEXT(p, chain);
-		remrmconf(p);
-		delrmconf(p);
-	}
-}
-
-void
-initrmconf()
-{
-	TAILQ_INIT(&rmtree);
-}
-
-void
-save_rmconf()
-{
-	rmtree_save=rmtree;
-	initrmconf();
-}
-
-void
-save_rmconf_flush()
-{
-	rmtree_tmp=rmtree;
-	rmtree=rmtree_save;
-	flushrmconf();
-	initrmconf();
-	rmtree=rmtree_tmp;
-}
-
-
-
-/* check exchange type to be acceptable */
-struct etypes *
-check_etypeok( struct remoteconf *rmconf, u_int8_t etype)
-{
-	struct etypes *e;
-
-	for (e = rmconf->etypes; e != NULL; e = e->next) {
-		if (e->type == etype)
-			break;
-	}
-
-	return e;
-}
-
-/*%%%*/
-struct isakmpsa *
-newisakmpsa()
-{
-	struct isakmpsa *new;
-
-	new = racoon_calloc(1, sizeof(*new));
-	if (new == NULL)
-		return NULL;
-
-	/*
-	 * Just for sanity, make sure this is initialized.  This is
-	 * filled in for real when the ISAKMP proposal is configured.
-	 */
-	new->vendorid = VENDORID_UNKNOWN;
-
-	new->next = NULL;
-	new->rmconf = NULL;
-#ifdef HAVE_GSSAPI
-	new->gssid = NULL;
-#endif
-
-	return new;
-}
-
-/*
- * insert into tail of list.
- */
-void
-insisakmpsa(new, rmconf)
-	struct isakmpsa *new;
-	struct remoteconf *rmconf;
-{
-	struct isakmpsa *p;
-
-	new->rmconf = rmconf;
-
-	if (rmconf->proposal == NULL) {
-		rmconf->proposal = new;
-		return;
-	}
-
-	for (p = rmconf->proposal; p->next != NULL; p = p->next)
-		;
-	p->next = new;
-
-	return;
-}
-
-struct remoteconf *
-foreachrmconf(rmconf_func_t rmconf_func, void *data)
-{
-  struct remoteconf *p, *ret = NULL;
-  RACOON_TAILQ_FOREACH_REVERSE(p, &rmtree, _rmtree, chain) {
-    ret = (*rmconf_func)(p, data);
-    if (ret)
-      break;
-  }
-
-  return ret;
-}
-
-static void *
-dump_peers_identifiers (void *entry, void *arg)
-{
-	struct idspec *id = (struct idspec*) entry;
-	char buf[1024], *pbuf;
-	pbuf = buf;
-	pbuf += sprintf (pbuf, "\tpeers_identifier %s",
-			 s_idtype (id->idtype));
-	if (id->id)
-		pbuf += sprintf (pbuf, " \"%s\"", id->id->v);
-	plog(LLV_INFO, LOCATION, NULL, "%s;\n", buf);
-	return NULL;
-}
-
-static struct remoteconf *
-dump_rmconf_single (struct remoteconf *p, void *data)
-{
-	struct etypes *etype = p->etypes;
-	struct isakmpsa *prop = p->proposal;
-	char buf[1024], *pbuf;
-
-	pbuf = buf;
-	pbuf += sprintf(pbuf, "remote %s", saddr2str(p->remote));
-	if (p->inherited_from)
-		pbuf += sprintf(pbuf, " inherit %s",
-				saddr2str(p->inherited_from->remote));
-	plog(LLV_INFO, LOCATION, NULL, "%s {\n", buf);
-	pbuf = buf;
-	pbuf += sprintf(pbuf, "\texchange_type ");
-	while (etype) {
-		pbuf += sprintf (pbuf, "%s%s", s_etype(etype->type),
-				 etype->next != NULL ? ", " : ";\n");
-		etype = etype->next;
-	}
-	plog(LLV_INFO, LOCATION, NULL, "%s", buf);
-	plog(LLV_INFO, LOCATION, NULL, "\tdoi %s;\n", s_doi(p->doitype));
-	pbuf = buf;
-	pbuf += sprintf(pbuf, "\tmy_identifier %s", s_idtype (p->idvtype));
-	if (p->idvtype == IDTYPE_ASN1DN) {
-		plog(LLV_INFO, LOCATION, NULL, "%s;\n", buf);
-		plog(LLV_INFO, LOCATION, NULL, "\tcertificate_type %s \"%s\" \"%s\";\n",
-			p->certtype == ISAKMP_CERT_X509SIGN ? "x509" : "*UNKNOWN*",
-			p->mycertfile, p->myprivfile);
-		switch (p->getcert_method) {
-		  case 0:
-		  	break;
-		  case ISAKMP_GETCERT_PAYLOAD:
-			plog(LLV_INFO, LOCATION, NULL, "\t/* peers certificate from payload */\n");
-			break;
-		  case ISAKMP_GETCERT_LOCALFILE:
-			plog(LLV_INFO, LOCATION, NULL, "\tpeers_certfile \"%s\";\n", p->peerscertfile);
-			break;
-		  case ISAKMP_GETCERT_DNS:
-			plog(LLV_INFO, LOCATION, NULL, "\tpeer_certfile dnssec;\n");
-			break;
-		  default:
-			plog(LLV_INFO, LOCATION, NULL, "\tpeers_certfile *UNKNOWN* (%d)\n", p->getcert_method);
-		}
-	}
-	else {
-		if (p->idv)
-			pbuf += sprintf (pbuf, " \"%s\"", p->idv->v);
-		plog(LLV_INFO, LOCATION, NULL, "%s;\n", buf);
-		genlist_foreach(p->idvl_p, &dump_peers_identifiers, NULL);
-	}
-
-	plog(LLV_INFO, LOCATION, NULL, "\tsend_cert %s;\n",
-		s_switch (p->send_cert));
-	plog(LLV_INFO, LOCATION, NULL, "\tsend_cr %s;\n",
-		s_switch (p->send_cr));
-	plog(LLV_INFO, LOCATION, NULL, "\tverify_cert %s;\n",
-		s_switch (p->verify_cert));
-	plog(LLV_INFO, LOCATION, NULL, "\tverify_identifier %s;\n",
-		s_switch (p->verify_identifier));
-	plog(LLV_INFO, LOCATION, NULL, "\tnat_traversal %s;\n",
-		p->nat_traversal == NATT_FORCE ?
-			"force" : s_switch (p->nat_traversal));
-	plog(LLV_INFO, LOCATION, NULL, "\tnonce_size %d;\n",
-		p->nonce_size);
-	plog(LLV_INFO, LOCATION, NULL, "\tpassive %s;\n",
-		s_switch (p->passive));
-	plog(LLV_INFO, LOCATION, NULL, "\tike_frag %s;\n",
-		p->ike_frag == ISAKMP_FRAG_FORCE ?
-			"force" : s_switch (p->ike_frag));
-	plog(LLV_INFO, LOCATION, NULL, "\tesp_frag %d;\n", p->esp_frag);
-	plog(LLV_INFO, LOCATION, NULL, "\tinitial_contact %s;\n",
-		s_switch (p->ini_contact));
-	plog(LLV_INFO, LOCATION, NULL, "\tgenerate_policy %s;\n",
-		s_switch (p->gen_policy));
-	plog(LLV_INFO, LOCATION, NULL, "\tsupport_proxy %s;\n",
-		s_switch (p->support_proxy));
-
-	while (prop) {
-		plog(LLV_INFO, LOCATION, NULL, "\n");
-		plog(LLV_INFO, LOCATION, NULL,
-			"\t/* prop_no=%d, trns_no=%d, rmconf=%s */\n",
-			prop->prop_no, prop->trns_no,
-			saddr2str(prop->rmconf->remote));
-		plog(LLV_INFO, LOCATION, NULL, "\tproposal {\n");
-		plog(LLV_INFO, LOCATION, NULL, "\t\tlifetime time %lu sec;\n",
-			(long)prop->lifetime);
-		plog(LLV_INFO, LOCATION, NULL, "\t\tlifetime bytes %zd;\n",
-			prop->lifebyte);
-		plog(LLV_INFO, LOCATION, NULL, "\t\tdh_group %s;\n",
-			alg_oakley_dhdef_name(prop->dh_group));
-		plog(LLV_INFO, LOCATION, NULL, "\t\tencryption_algorithm %s;\n", 
-			alg_oakley_encdef_name(prop->enctype));
-		plog(LLV_INFO, LOCATION, NULL, "\t\thash_algorithm %s;\n", 
-			alg_oakley_hashdef_name(prop->hashtype));
-		plog(LLV_INFO, LOCATION, NULL, "\t\tauthentication_method %s;\n", 
-			alg_oakley_authdef_name(prop->authmethod));
-		plog(LLV_INFO, LOCATION, NULL, "\t}\n");
-		prop = prop->next;
-	}
-	plog(LLV_INFO, LOCATION, NULL, "}\n");
-	plog(LLV_INFO, LOCATION, NULL, "\n");
-
-	return NULL;
-}
-
-void
-dumprmconf()
-{
-	foreachrmconf (dump_rmconf_single, NULL);
-}
-
-struct idspec *
-newidspec()
-{
-	struct idspec *new;
-
-	new = racoon_calloc(1, sizeof(*new));
-	if (new == NULL)
-		return NULL;
-	new->idtype = IDTYPE_ADDRESS;
-
-	return new;
-}
-
-vchar_t *
-script_path_add(path)
-	vchar_t *path;
-{
-	char *script_dir;
-	vchar_t *new_path;
-	vchar_t *new_storage;
-	vchar_t **sp;
-	size_t len;
-	size_t size;
-
-	script_dir = lcconf->pathinfo[LC_PATHTYPE_SCRIPT];
-
-	/* Try to find the script in the script directory */
-	if ((path->v[0] != '/') && (script_dir != NULL)) {
-		len = strlen(script_dir) + sizeof("/") + path->l + 1;
-
-		if ((new_path = vmalloc(len)) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "Cannot allocate memory: %s\n", strerror(errno));
-			return NULL;
-		}
-
-		new_path->v[0] = '\0';
-		(void)strlcat(new_path->v, script_dir, len);
-		(void)strlcat(new_path->v, "/", len);
-		(void)strlcat(new_path->v, path->v, len);
-
-		vfree(path);
-		path = new_path;
-	}
-
-	return path;
-}
-
-
-struct isakmpsa *
-dupisakmpsa(struct isakmpsa *sa)
-{
-	struct isakmpsa *res=NULL;
-
-	if(sa == NULL)
-		return NULL;
-
-	res=newisakmpsa();
-	if(res == NULL)
-		return NULL;
-
-	*res=*sa;
-#ifdef HAVE_GSSAPI
-	/* XXX gssid
-	 */
-#endif
-	res->next=NULL;
-
-	if(sa->dhgrp != NULL)
-		oakley_setdhgroup (sa->dh_group, &(res->dhgrp));
-
-	return res;
-
-}
diff --git a/src/racoon/remoteconf.h b/src/racoon/remoteconf.h
deleted file mode 100644
index ca5945e..0000000
--- a/src/racoon/remoteconf.h
+++ /dev/null
@@ -1,196 +0,0 @@
-/*	$NetBSD: remoteconf.h,v 1.7 2006/10/03 08:01:56 vanhu Exp $	*/
-
-/* Id: remoteconf.h,v 1.26 2006/05/06 15:52:44 manubsd Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _REMOTECONF_H
-#define _REMOTECONF_H
-
-/* remote configuration */
-
-#include <sys/queue.h>
-#include "genlist.h"
-#ifdef ENABLE_HYBRID
-#include "isakmp_var.h"
-#include "isakmp_xauth.h"
-#endif
-
-struct proposalspec;
-
-struct etypes {
-	int type;
-	struct etypes *next;
-};
-
-/* Script hooks */
-#define SCRIPT_PHASE1_UP	0
-#define SCRIPT_PHASE1_DOWN	1
-#define SCRIPT_MAX		1
-extern char *script_names[SCRIPT_MAX + 1];
-
-struct remoteconf {
-	struct sockaddr *remote;	/* remote IP address */
-					/* if family is AF_UNSPEC, that is
-					 * for anonymous configuration. */
-
-	struct etypes *etypes;		/* exchange type list. the head
-					 * is a type to be sent first. */
-	int doitype;			/* doi type */
-	int sittype;			/* situation type */
-
-	int idvtype;			/* my identifier type */
-	vchar_t *idv;			/* my identifier */
-	vchar_t *key;			/* my pre-shared key */
-	struct genlist *idvl_p;         /* peer's identifiers list */
-
-	int certtype;			/* certificate type if need */
-	char *mycertfile;		/* file name of my certificate */
-	char *myprivfile;		/* file name of my private key file */
-	char *peerscertfile;		/* file name of peer's certifcate */
-	int getcert_method;		/* the way to get peer's certificate */
-	int cacerttype;			/* CA type is needed */
-	char *cacertfile;		/* file name of CA */
-	int getcacert_method;		/* the way to get the CA */
-	int send_cert;			/* send to CERT or not */
-	int send_cr;			/* send to CR or not */
-	int verify_cert;		/* verify a CERT strictly */
-	int verify_identifier;		/* vefify the peer's identifier */
-	int nonce_size;			/* the number of bytes of nonce */
-	int passive;			/* never initiate */
-	int ike_frag;			/* IKE fragmentation */
-	int esp_frag;			/* ESP fragmentation */
-	int mode_cfg;			/* Gets config through mode config */
-	int support_proxy;		/* support mip6/proxy */
-#define GENERATE_POLICY_NONE   0
-#define GENERATE_POLICY_REQUIRE        1
-#define GENERATE_POLICY_UNIQUE 2
-	int gen_policy;			/* generate policy if no policy found */
-	int ini_contact;		/* initial contact */
-	int pcheck_level;		/* level of propocl checking */
-	int nat_traversal;		/* NAT-Traversal */
-	vchar_t *script[SCRIPT_MAX + 1];/* script hooks paths */
-	int dh_group;			/* use it when only aggressive mode */
-	struct dhgroup *dhgrp;		/* use it when only aggressive mode */
-					/* above two can't be defined by user*/
-
-	int retry_counter;		/* times to retry. */
-	int retry_interval;		/* interval each retry. */
-				/* above 2 values are copied from localconf. */
-
-	int dpd;				/* Negociate DPD support ? */
-	int dpd_retry;			/* in seconds */
-	int dpd_interval;		/* in seconds */
-	int dpd_maxfails; 
-
-	int ph1id; /* ph1id to be matched with sainfo sections */
-
-	int weak_phase1_check;		/* act on unencrypted deletions ? */
-
-	struct isakmpsa *proposal;	/* proposal list */
-	struct remoteconf *inherited_from;	/* the original rmconf 
-						   from which this one 
-						   was inherited */
-	struct proposalspec *prhead;
-
-	struct genlist	*rsa_private,	/* lists of PlainRSA keys to use */
-			*rsa_public;
-
-#ifdef ENABLE_HYBRID
-	struct xauth_rmconf *xauth;
-#endif
-
-	TAILQ_ENTRY(remoteconf) chain;	/* next remote conf */
-};
-
-struct dhgroup;
-
-/* ISAKMP SA specification */
-struct isakmpsa {
-	int prop_no;
-	int trns_no;
-	time_t lifetime;
-	size_t lifebyte;
-	int enctype;
-	int encklen;
-	int authmethod;
-	int hashtype;
-	int vendorid;
-#ifdef HAVE_GSSAPI
-	vchar_t *gssid;
-#endif
-	int dh_group;			/* don't use it if aggressive mode */
-	struct dhgroup *dhgrp;		/* don't use it if aggressive mode */
-
-	struct isakmpsa *next;		/* next transform */
-	struct remoteconf *rmconf;	/* backpointer to remoteconf */
-};
-
-struct idspec {
-	int idtype;                     /* identifier type */
-	vchar_t *id;                    /* identifier */
-};
-
-typedef struct remoteconf * (rmconf_func_t)(struct remoteconf *rmconf, void *data);
-
-extern struct remoteconf *getrmconf __P((struct sockaddr *));
-extern struct remoteconf *getrmconf_strict
-	__P((struct sockaddr *remote, int allow_anon));
-extern struct remoteconf *copyrmconf __P((struct sockaddr *));
-extern struct remoteconf *newrmconf __P((void));
-extern struct remoteconf *duprmconf __P((struct remoteconf *));
-extern void delrmconf __P((struct remoteconf *));
-extern void delisakmpsa __P((struct isakmpsa *));
-extern void deletypes __P((struct etypes *));
-extern struct etypes * dupetypes __P((struct etypes *));
-extern void insrmconf __P((struct remoteconf *));
-extern void remrmconf __P((struct remoteconf *));
-extern void flushrmconf __P((void));
-extern void initrmconf __P((void));
-extern void save_rmconf __P((void));
-extern void save_rmconf_flush __P((void));
-
-extern struct etypes *check_etypeok
-	__P((struct remoteconf *, u_int8_t));
-extern struct remoteconf *foreachrmconf __P((rmconf_func_t rmconf_func,
-					     void *data));
-
-extern struct isakmpsa *newisakmpsa __P((void));
-extern struct isakmpsa *dupisakmpsa __P((struct isakmpsa *));
-
-extern void insisakmpsa __P((struct isakmpsa *, struct remoteconf *));
-
-extern void dumprmconf __P((void));
-
-extern struct idspec *newidspec __P((void));
-
-extern vchar_t *script_path_add __P((vchar_t *));
-
-#endif /* _REMOTECONF_H */
diff --git a/src/racoon/rsalist.c b/src/racoon/rsalist.c
deleted file mode 100644
index 850aa4c..0000000
--- a/src/racoon/rsalist.c
+++ /dev/null
@@ -1,216 +0,0 @@
-/*	$NetBSD: rsalist.c,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
-
-/* Id: rsalist.c,v 1.3 2004/11/08 12:04:23 ludvigm Exp */
-
-/*
- * Copyright (C) 2004 SuSE Linux AG, Nuernberg, Germany.
- * Contributed by: Michal Ludvig <mludvig@suse.cz>, SUSE Labs
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <stdio.h>
-#include <string.h>
-
-#include <sys/types.h>
-#include <sys/queue.h>
-#include <sys/socket.h>
-#include <netdb.h>
-
-#include <openssl/bn.h>
-#include <openssl/rsa.h>
-
-#include "misc.h"
-#include "plog.h"
-#include "sockmisc.h"
-#include "rsalist.h"
-#include "genlist.h"
-#include "remoteconf.h"
-#include "crypto_openssl.h"
-
-#ifndef LIST_FIRST
-#define LIST_FIRST(head)        ((head)->lh_first)
-#endif
-
-#ifndef LIST_NEXT
-#define LIST_NEXT(elm, field)   ((elm)->field.le_next)
-#endif
-
-/* from prsa_tok.l */
-int prsa_parse_file(struct genlist *list, const char *fname, enum rsa_key_type type);
-
-int
-rsa_key_insert(struct genlist *list, struct netaddr *src,
-	       struct netaddr *dst, RSA *rsa)
-{
-	struct rsa_key *rsa_key;
-
-	rsa_key = calloc(sizeof(struct rsa_key), 1);
-	rsa_key->rsa = rsa;
-
-	if (src)
-		rsa_key->src = src;
-	else
-		rsa_key->src = calloc(sizeof(*rsa_key->src), 1);
-
-	if (dst)
-		rsa_key->dst = dst;
-	else
-		rsa_key->dst = calloc(sizeof(*rsa_key->dst), 1);
-
-	genlist_append(list, rsa_key);
-
-	return 0;
-}
-
-static void *
-rsa_key_dump_one(void *entry, void *arg)
-{
-	struct rsa_key *key = entry;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "Entry %s\n",
-	     naddrwop2str_fromto("%s -> %s", key->src,
-				 key->dst));
-	if (loglevel > LLV_DEBUG)
-		RSA_print_fp(stdout, key->rsa, 4);
-
-	return NULL;
-}
-
-void
-rsa_key_dump(struct genlist *list)
-{
-	genlist_foreach(list, rsa_key_dump_one, NULL);
-}
-
-static void *
-rsa_list_count_one(void *entry, void *arg)
-{
-	if (arg)
-		(*(unsigned long *)arg)++;
-	return NULL;
-}
-
-unsigned long
-rsa_list_count(struct genlist *list)
-{
-	unsigned long count = 0;
-	genlist_foreach(list, rsa_list_count_one, &count);
-	return count;
-}
-
-struct lookup_result {
-	struct ph1handle *iph1;
-	int max_score;
-	struct genlist *winners;
-};
-	
-static void *
-rsa_lookup_key_one(void *entry, void *data)
-{
-	int local_score, remote_score;
-	struct lookup_result *req = data;
-	struct rsa_key *key = entry;
-
-	local_score = naddr_score(key->src, req->iph1->local);
-	remote_score = naddr_score(key->dst, req->iph1->remote);
-
-	plog(LLV_DEBUG, LOCATION, NULL, "Entry %s scored %d/%d\n",
-		naddrwop2str_fromto("%s -> %s", key->src, key->dst),
-		local_score, remote_score);
-
-	if (local_score >= 0 && remote_score >= 0) {
-		if (local_score + remote_score > req->max_score) {
-			req->max_score = local_score + remote_score;
-//			genlist_free(req->winners, NULL);
-		}
-
-		if (local_score + remote_score >= req->max_score) {
-			genlist_append(req->winners, key);
-		}
-	}
-
-	/* Always traverse the whole list */
-	return NULL;
-}
-
-struct genlist *
-rsa_lookup_keys(struct ph1handle *iph1, int my)
-{
-	struct genlist *list;
-	struct lookup_result r;
-
-	plog(LLV_DEBUG, LOCATION, NULL, "Looking up RSA key for %s\n",
-	     saddr2str_fromto("%s <-> %s", iph1->local, iph1->remote));
-
-	r.iph1 = iph1;
-	r.max_score = -1;
-	r.winners = genlist_init();
-
-	if (my)
-		list = iph1->rmconf->rsa_private;
-	else
-		list = iph1->rmconf->rsa_public;
-
-	genlist_foreach(list, rsa_lookup_key_one, &r);
-
-	if (loglevel >= LLV_DEBUG)
-		rsa_key_dump(r.winners);
-
-	return r.winners;
-}
-
-int
-rsa_parse_file(struct genlist *list, const char *fname, enum rsa_key_type type)
-{
-	int ret;
-	
-	plog(LLV_DEBUG, LOCATION, NULL, "Parsing %s\n", fname);
-	ret = prsa_parse_file(list, fname, type);
-	if (loglevel >= LLV_DEBUG)
-		rsa_key_dump(list);
-	return ret;
-}
-
-RSA *
-rsa_try_check_rsasign(vchar_t *source, vchar_t *sig, struct genlist *list)
-{
-	struct rsa_key *key;
-	struct genlist_entry *gp;
-
-	for(key = genlist_next(list, &gp); key; key = genlist_next(NULL, &gp)) {
-		plog(LLV_DEBUG, LOCATION, NULL, "Checking key %s...\n",
-			naddrwop2str_fromto("%s -> %s", key->src, key->dst));
-		if (eay_check_rsasign(source, sig, key->rsa) == 0) {
-			plog(LLV_DEBUG, LOCATION, NULL, " ... YEAH!\n");
-			return key->rsa;
-		}
-		plog(LLV_DEBUG, LOCATION, NULL, " ... nope.\n");
-	}
-	return NULL;
-}
diff --git a/src/racoon/rsalist.h b/src/racoon/rsalist.h
deleted file mode 100644
index 911670f..0000000
--- a/src/racoon/rsalist.h
+++ /dev/null
@@ -1,65 +0,0 @@
-/*	$NetBSD: rsalist.h,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
-
-/* Id: rsalist.h,v 1.2 2004/07/12 20:43:51 ludvigm Exp */
-/*
- * Copyright (C) 2004 SuSE Linux AG, Nuernberg, Germany.
- * Contributed by: Michal Ludvig <mludvig@suse.cz>, SUSE Labs
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _RSALIST_H
-#define _RSALIST_H
-
-#include <netinet/in.h>
-#include <openssl/rsa.h>
-
-#include "handler.h"
-#include "genlist.h"
-
-enum rsa_key_type {
-	RSA_TYPE_ANY = 0,
-	RSA_TYPE_PUBLIC,
-	RSA_TYPE_PRIVATE
-};
-
-struct rsa_key {
-	struct netaddr *src;
-	struct netaddr *dst;
-	RSA *rsa;
-};
-
-int rsa_key_insert(struct genlist *list, struct netaddr *src, struct netaddr *dst, RSA *rsa);
-void rsa_key_dump(struct genlist *list);
-
-struct genlist *rsa_lookup_keys(struct ph1handle *iph1, int my);
-RSA *rsa_try_check_rsasign(vchar_t *source, vchar_t *sig, struct genlist *list);
-
-unsigned long rsa_list_count(struct genlist *list);
-
-int rsa_parse_file(struct genlist *list, const char *fname, enum rsa_key_type type);
-
-#endif /* _RSALIST_H */
diff --git a/src/racoon/safefile.c b/src/racoon/safefile.c
deleted file mode 100644
index 5241092..0000000
--- a/src/racoon/safefile.c
+++ /dev/null
@@ -1,93 +0,0 @@
-/*	$NetBSD: safefile.c,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
-
-/*	$KAME: safefile.c,v 1.5 2001/03/05 19:54:06 thorpej Exp $	*/
-
-/*
- * Copyright (C) 2000 WIDE Project.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <sys/socket.h>
-#include <netinet/in.h>
-#include <unistd.h>
-
-#include "plog.h"
-#include "debug.h"
-#include "misc.h"
-#include "safefile.h"
-
-int
-safefile(path, secret)
-	const char *path;
-	int secret;
-{
-	struct stat s;
-	uid_t me;
-
-	/* no setuid */
-	if (getuid() != geteuid()) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "setuid'ed execution not allowed\n");
-		return -1;
-	}
-
-	if (stat(path, &s) != 0)
-		return -1;
-
-	/* the file must be owned by the running uid */
-	me = getuid();
-	if (s.st_uid != me) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "%s has invalid owner uid\n", path);
-		return -1;
-	}
-
-	switch (s.st_mode & S_IFMT) {
-	case S_IFREG:
-		break;
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "%s is an invalid file type 0x%x\n", path,
-		    (s.st_mode & S_IFMT));
-		return -1;
-	}
-
-	/* secret file should not be read by others */
-	if (secret) {
-		if ((s.st_mode & S_IRWXG) != 0 || (s.st_mode & S_IRWXO) != 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "%s has weak file permission\n", path);
-			return -1;
-		}
-	}
-
-	return 0;
-}
diff --git a/src/racoon/safefile.h b/src/racoon/safefile.h
deleted file mode 100644
index c8d6a6c..0000000
--- a/src/racoon/safefile.h
+++ /dev/null
@@ -1,39 +0,0 @@
-/*	$NetBSD: safefile.h,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
-
-/* Id: safefile.h,v 1.4 2004/07/12 18:32:12 ludvigm Exp */
-
-/*
- * Copyright (C) 2000 WIDE Project.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _SAFEFILE_H
-#define _SAFEFILE_H
-
-extern int safefile __P((const char *, int));
-
-#endif /* _SAFEFILE_H */
diff --git a/src/racoon/sainfo.c b/src/racoon/sainfo.c
deleted file mode 100644
index afa0aac..0000000
--- a/src/racoon/sainfo.c
+++ /dev/null
@@ -1,319 +0,0 @@
-/*	$NetBSD: sainfo.c,v 1.7.6.1 2007/08/01 11:52:22 vanhu Exp $	*/
-
-/*	$KAME: sainfo.c,v 1.16 2003/06/27 07:32:39 sakane Exp $	*/
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/param.h>
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <sys/queue.h>
-
-#include <netinet/in.h>
-#include <netinet/in.h> 
-#include PATH_IPSEC_H
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-
-#include "var.h"
-#include "misc.h"
-#include "vmbuf.h"
-#include "plog.h"
-#include "sockmisc.h"
-#include "debug.h"
-
-#include "localconf.h"
-#include "isakmp_var.h"
-#include "isakmp.h"
-#include "ipsec_doi.h"
-#include "oakley.h"
-#include "handler.h"
-#include "algorithm.h"
-#include "sainfo.h"
-#include "gcmalloc.h"
-
-static LIST_HEAD(_sitree, sainfo) sitree, sitree_save, sitree_tmp;
-
-/* %%%
- * modules for ipsec sa info
- */
-/*
- * return matching entry.
- * no matching entry found and if there is anonymous entry, return it.
- * else return NULL.
- * First pass is for sainfo from a specified peer, second for others.
- */
-struct sainfo *
-getsainfo(loc, rmt, peer, remoteid)
-	const vchar_t *loc, *rmt, *peer;
-	int remoteid;
-{
-	struct sainfo *s = NULL;
-	struct sainfo *anonymous = NULL;
-	int pass = 1;
-
-	if (peer == NULL)
-		pass = 2;
-
-	/* debug level output */
-	if(loglevel >= LLV_DEBUG) {
-		char *dloc, *drmt, *dpeer, *dclient;
- 
-		if (loc == NULL)
-			dloc = strdup("ANONYMOUS");
-		else
-			dloc = ipsecdoi_id2str(loc);
- 
-		if (rmt == NULL)
-			drmt = strdup("ANONYMOUS");
-		else
-			drmt = ipsecdoi_id2str(rmt);
- 
-		if (peer == NULL)
-			dpeer = strdup("NULL");
-		else
-			dpeer = ipsecdoi_id2str(peer);
- 
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"getsainfo params: loc=\'%s\', rmt=\'%s\', peer=\'%s\', id=%i\n",
-			dloc, drmt, dpeer, remoteid );
- 
-                racoon_free(dloc);
-                racoon_free(drmt);
-                racoon_free(dpeer);
-	}
-
-    again:
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"getsainfo pass #%i\n", pass);
- 
-	LIST_FOREACH(s, &sitree, chain) {
-		const char *sainfostr = sainfo2str(s);
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"evaluating sainfo: %s\n", sainfostr);
-
-		if(s->remoteid != remoteid)
-			continue;
-
-		if (s->id_i != NULL) {
-			if (pass == 2)
-				continue;
-			if (ipsecdoi_chkcmpids(peer, s->id_i, 0))
-				continue;
-		} else if (pass == 1)
-			continue;
-		if (s->idsrc == NULL && s->iddst == NULL) {
-			anonymous = s;
-			continue;
-		}
-
-		/* anonymous ? */
-		if (loc == NULL) {
-			if (anonymous != NULL)
-				break;
-			continue;
-		}
-
-		/* compare the ids */
-		if (!ipsecdoi_chkcmpids(loc, s->idsrc, 0) &&
-		    !ipsecdoi_chkcmpids(rmt, s->iddst, 0))
-			return s;
-	}
-
-	if ((anonymous == NULL) && (pass == 1)) {
-		pass++;
-		goto again;
-	}
-
-	return anonymous;
-}
-
-struct sainfo *
-newsainfo()
-{
-	struct sainfo *new;
-
-	new = racoon_calloc(1, sizeof(*new));
-	if (new == NULL)
-		return NULL;
-
-	new->lifetime = IPSECDOI_ATTR_SA_LD_SEC_DEFAULT;
-	new->lifebyte = IPSECDOI_ATTR_SA_LD_KB_MAX;
-
-	return new;
-}
-
-void
-delsainfo(si)
-	struct sainfo *si;
-{
-	int i;
-
-	for (i = 0; i < MAXALGCLASS; i++)
-		delsainfoalg(si->algs[i]);
-
-	if (si->idsrc)
-		vfree(si->idsrc);
-	if (si->iddst)
-		vfree(si->iddst);
-
-#ifdef ENABLE_HYBRID
-	if (si->group)
-		vfree(si->group);
-#endif
-
-	racoon_free(si);
-}
-
-void
-inssainfo(new)
-	struct sainfo *new;
-{
-	LIST_INSERT_HEAD(&sitree, new, chain);
-}
-
-void
-remsainfo(si)
-	struct sainfo *si;
-{
-	LIST_REMOVE(si, chain);
-}
-
-void
-flushsainfo()
-{
-	struct sainfo *s, *next;
-
-	for (s = LIST_FIRST(&sitree); s; s = next) {
-		next = LIST_NEXT(s, chain);
-		remsainfo(s);
-		delsainfo(s);
-	}
-}
-
-void
-initsainfo()
-{
-	LIST_INIT(&sitree);
-}
-
-struct sainfoalg *
-newsainfoalg()
-{
-	struct sainfoalg *new;
-
-	new = racoon_calloc(1, sizeof(*new));
-	if (new == NULL)
-		return NULL;
-
-	return new;
-}
-
-void
-delsainfoalg(alg)
-	struct sainfoalg *alg;
-{
-	struct sainfoalg *a, *next;
-
-	for (a = alg; a; a = next) {
-		next = a->next;
-		racoon_free(a);
-	}
-}
-
-void
-inssainfoalg(head, new)
-	struct sainfoalg **head;
-	struct sainfoalg *new;
-{
-	struct sainfoalg *a;
-
-	for (a = *head; a && a->next; a = a->next)
-		;
-	if (a)
-		a->next = new;
-	else
-		*head = new;
-}
-
-const char *
-sainfo2str(si)
-	const struct sainfo *si;
-{
-        static char buf[256];
-
-        char *idloc = NULL, *idrmt = NULL, *id_i;
- 
-        if (si->idsrc == NULL)
-                idloc = strdup("ANONYMOUS");
-        else
-                idloc = ipsecdoi_id2str(si->idsrc);
- 
-        if (si->iddst == NULL)
-                idrmt = strdup("ANONYMOUS");
-        else
-                idrmt = ipsecdoi_id2str(si->iddst);
- 
-        if (si->id_i == NULL)
-                id_i = strdup("ANY");
-        else
-                id_i = ipsecdoi_id2str(si->id_i);
- 
-        snprintf(buf, 255, "loc=\'%s\', rmt=\'%s\', peer=\'%s\', id=%i",
-		idloc, idrmt, id_i, si->remoteid);
- 
-        racoon_free(idloc);
-        racoon_free(idrmt);
-        racoon_free(id_i);
- 
-        return buf;
-}
-
-void save_sainfotree(void){
-	sitree_save=sitree;
-	initsainfo();
-}
-
-void save_sainfotree_flush(void){
-	sitree_tmp=sitree;
-	sitree=sitree_save;
-	flushsainfo();
-	sitree=sitree_tmp;
-}
-
-void save_sainfotree_restore(void){
-	flushsainfo();
-	sitree=sitree_save;
-}
diff --git a/src/racoon/sainfo.h b/src/racoon/sainfo.h
deleted file mode 100644
index 357da3f..0000000
--- a/src/racoon/sainfo.h
+++ /dev/null
@@ -1,88 +0,0 @@
-/*	$NetBSD: sainfo.h,v 1.5 2006/10/03 08:01:56 vanhu Exp $	*/
-
-/* Id: sainfo.h,v 1.5 2006/07/09 17:19:38 manubsd Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _SAINFO_H
-#define _SAINFO_H
-
-#include <sys/queue.h>
-
-/* SA info */
-struct sainfo {
-	vchar_t *idsrc;
-	vchar_t *iddst;
-		/*
-		 * idsrc and iddst are constructed body of ID payload.
-		 * that is (struct ipsecdoi_id_b) + ID value.
-		 * If idsrc == NULL, that is anonymous entry.
-		 */
-
-#ifdef ENABLE_HYBRID
-	vchar_t *group;
-#endif
-
-	time_t lifetime;
-	int lifebyte;
-	int pfs_group;		/* only use when pfs is required. */
-	vchar_t *id_i;		/* identifier of the authorized initiator */
-	struct sainfoalg *algs[MAXALGCLASS];
-
-	int remoteid;
-
-	LIST_ENTRY(sainfo) chain;
-};
-
-/* algorithm type */
-struct sainfoalg {
-	int alg;
-	int encklen;			/* key length if encryption algorithm */
-	struct sainfoalg *next;
-};
-
-extern struct sainfo *getsainfo __P((const vchar_t *,
-	const vchar_t *, const vchar_t *, int));
-extern struct sainfo *newsainfo __P((void));
-extern void delsainfo __P((struct sainfo *));
-extern void inssainfo __P((struct sainfo *));
-extern void remsainfo __P((struct sainfo *));
-extern void flushsainfo __P((void));
-extern void initsainfo __P((void));
-extern struct sainfoalg *newsainfoalg __P((void));
-extern void delsainfoalg __P((struct sainfoalg *));
-extern void inssainfoalg __P((struct sainfoalg **, struct sainfoalg *));
-extern const char * sainfo2str __P((const struct sainfo *));
-
-extern void save_sainfotree __P((void));
-extern void save_sainfotree_flush __P((void));
-extern void save_sainfotree_restore __P((void));
-
-#endif /* _SAINFO_H */
diff --git a/src/racoon/samples/psk.txt.in b/src/racoon/samples/psk.txt.in
deleted file mode 100644
index 52f1a55..0000000
--- a/src/racoon/samples/psk.txt.in
+++ /dev/null
@@ -1,21 +0,0 @@
-# IPv4/v6 addresses
-10.160.94.3	mekmitasdigoat
-172.16.1.133	mekmitasdigoat
-194.100.55.1	whatcertificatereally
-203.178.141.208	mekmitasdigoat
-206.175.160.18	mekmitasdigoat
-206.175.160.20	mekmitasdigoat
-206.175.160.21	mekmitasdigoat
-206.175.160.22	mekmitasdigoat
-206.175.160.23	mekmitasdigoat
-206.175.160.36	mekmitasdigoat
-206.175.161.125	mekmitasdigoat
-206.175.161.154	mekmitasdigoat
-206.175.161.156	mekmitasdigoat
-206.175.161.182	mekmitasdigoat
-3ffe:501:410:ffff:200:86ff:fe05:80fa	mekmitasdigoat
-3ffe:501:410:ffff:210:4bff:fea2:8baa	mekmitasdigoat
-# USER_FQDN
-sakane@kame.net	mekmitasdigoat
-# FQDN
-kame		hoge
diff --git a/src/racoon/samples/psk.txt.sample b/src/racoon/samples/psk.txt.sample
deleted file mode 100644
index 2ad1d0b..0000000
--- a/src/racoon/samples/psk.txt.sample
+++ /dev/null
@@ -1,10 +0,0 @@
-# IPv4/v6 addresses
-10.160.94.3	mekmitasdigoat
-172.16.1.133	0x12345678
-194.100.55.1	whatcertificatereally
-3ffe:501:410:ffff:200:86ff:fe05:80fa	mekmitasdigoat
-3ffe:501:410:ffff:210:4bff:fea2:8baa	mekmitasdigoat
-# USER_FQDN
-foo@kame.net	mekmitasdigoat
-# FQDN
-foo.kame.net	hoge
diff --git a/src/racoon/samples/racoon.conf.in b/src/racoon/samples/racoon.conf.in
deleted file mode 100644
index 29b7951..0000000
--- a/src/racoon/samples/racoon.conf.in
+++ /dev/null
@@ -1,121 +0,0 @@
-# $KAME: racoon.conf.in,v 1.18 2001/08/16 06:33:40 itojun Exp $
-
-# "path" affects "include" directives.  "path" must be specified before any
-# "include" directive with relative file path.
-# you can overwrite "path" directive afterwards, however, doing so may add
-# more confusion.
-path include "@sysconfdir_x@/racoon";
-#include "remote.conf";
-
-# the file should contain key ID/key pairs, for pre-shared key authentication.
-path pre_shared_key "@sysconfdir_x@/racoon/psk.txt";
-
-# racoon will look for certificate file in the directory,
-# if the certificate/certificate request payload is received.
-path certificate "@sysconfdir_x@/cert";
-
-# "log" specifies logging level.  It is followed by either "notify", "debug"
-# or "debug2".
-#log debug;
-
-# "padding" defines some padding parameters.  You should not touch these.
-padding
-{
-	maximum_length 20;	# maximum padding length.
-	randomize off;		# enable randomize length.
-	strict_check off;	# enable strict check.
-	exclusive_tail off;	# extract last one octet.
-}
-
-# if no listen directive is specified, racoon will listen on all
-# available interface addresses.
-listen
-{
-	#isakmp ::1 [7000];
-	#isakmp 202.249.11.124 [500];
-	#admin [7002];		# administrative port for racoonctl.
-	#strict_address; 	# requires that all addresses must be bound.
-}
-
-# Specify various default timers.
-timer
-{
-	# These value can be changed per remote node.
-	counter 5;		# maximum trying count to send.
-	interval 20 sec;	# maximum interval to resend.
-	persend 1;		# the number of packets per send.
-
-	# maximum time to wait for completing each phase.
-	phase1 30 sec;
-	phase2 15 sec;
-}
-
-remote anonymous
-{
-	exchange_mode main,aggressive;
-	doi ipsec_doi;
-	situation identity_only;
-
-	my_identifier asn1dn;
-	certificate_type x509 "my.cert.pem" "my.key.pem";
-
-	nonce_size 16;
-	initial_contact on;
-	proposal_check strict;	# obey, strict, or claim
-
-	proposal {
-		encryption_algorithm 3des;
-		hash_algorithm sha1;
-		authentication_method rsasig;
-		dh_group 2;
-	}
-}
-
-remote ::1 [8000]
-{
-	#exchange_mode main,aggressive;
-	exchange_mode aggressive,main;
-	doi ipsec_doi;
-	situation identity_only;
-
-	my_identifier user_fqdn "sakane@kame.net";
-	peers_identifier user_fqdn "sakane@kame.net";
-	#certificate_type x509 "mycert" "mypriv";
-
-	nonce_size 16;
-	lifetime time 1 min;	# sec,min,hour
-
-	proposal {
-		encryption_algorithm 3des;
-		hash_algorithm sha1;
-		authentication_method pre_shared_key;
-		dh_group 2;
-	}
-}
-
-sainfo anonymous
-{
-	pfs_group 2;
-	encryption_algorithm 3des;
-	authentication_algorithm hmac_sha1;
-	compression_algorithm deflate;
-}
-
-sainfo address 203.178.141.209 any address 203.178.141.218 any
-{
-	pfs_group 2;
-	lifetime time 30 sec;
-	encryption_algorithm des;
-	authentication_algorithm hmac_md5;
-	compression_algorithm deflate;
-}
-
-sainfo address ::1 icmp6 address ::1 icmp6
-{
-	pfs_group 3;
-	lifetime time 60 sec;
-	encryption_algorithm 3des, blowfish, aes;
-	authentication_algorithm hmac_sha1, hmac_md5;
-	compression_algorithm deflate;
-}
-
diff --git a/src/racoon/samples/racoon.conf.sample b/src/racoon/samples/racoon.conf.sample
deleted file mode 100644
index 631910f..0000000
--- a/src/racoon/samples/racoon.conf.sample
+++ /dev/null
@@ -1,61 +0,0 @@
-# $KAME: racoon.conf.sample,v 1.28 2002/10/18 14:33:28 itojun Exp $
-
-# "path" affects "include" directives.  "path" must be specified before any
-# "include" directive with relative file path.
-# you can overwrite "path" directive afterwards, however, doing so may add
-# more confusion.
-#path include "/usr/local/v6/etc" ;
-#include "remote.conf" ;
-
-# the file should contain key ID/key pairs, for pre-shared key authentication.
-path pre_shared_key "/usr/local/v6/etc/psk.txt" ;
-
-# racoon will look for certificate file in the directory,
-# if the certificate/certificate request payload is received.
-#path certificate "/usr/local/openssl/certs" ;
-
-# "log" specifies logging level.  It is followed by either "notify", "debug"
-# or "debug2".
-#log debug;
-
-remote anonymous
-{
-	#exchange_mode main,aggressive,base;
-	exchange_mode main,base;
-
-	#my_identifier fqdn "server.kame.net";
-	#certificate_type x509 "foo@kame.net.cert" "foo@kame.net.priv" ;
-
-	lifetime time 24 hour ;	# sec,min,hour
-
-	#initial_contact off ;
-	#passive on ;
-
-	# phase 1 proposal (for ISAKMP SA)
-	proposal {
-		encryption_algorithm 3des;
-		hash_algorithm sha1;
-		authentication_method pre_shared_key ;
-		dh_group 2 ;
-	}
-
-	# the configuration could makes racoon (as a responder)
-	# to obey the initiator's lifetime and PFS group proposal,
-	# by setting proposal_check to obey.
-	# this would makes testing "so much easier", but is really
-	# *not* secure !!!
-	proposal_check strict;
-}
-
-# phase 2 proposal (for IPsec SA).
-# actual phase 2 proposal will obey the following items:
-# - kernel IPsec policy configuration (like "esp/transport//use)
-# - permutation of the crypto/hash/compression algorithms presented below
-sainfo anonymous
-{
-	pfs_group 2;
-	lifetime time 12 hour ;
-	encryption_algorithm 3des, cast128, blowfish 448, des, rijndael ;
-	authentication_algorithm hmac_sha1, hmac_md5 ;
-	compression_algorithm deflate ;
-}
diff --git a/src/racoon/samples/racoon.conf.sample-gssapi b/src/racoon/samples/racoon.conf.sample-gssapi
deleted file mode 100644
index 09c4df1..0000000
--- a/src/racoon/samples/racoon.conf.sample-gssapi
+++ /dev/null
@@ -1,43 +0,0 @@
-# $KAME: racoon.conf.sample-gssapi,v 1.5 2001/08/16 06:33:40 itojun Exp $
-
-# sample configuration for GSSAPI authentication (basically, Kerberos).
-# doc/README.gssapi gives some idea on how to configure it.
-# TODO: more documentation.
-
-#listen {
-#	strict_address;
-#}
-
-# Uncomment the following for GSS-API to work with older versions of
-# racoon that (incorrectly) used ISO-Latin-1 encoding for the GSS-API
-# identifier attribute.
-#gss_id_enc latin1;
-
-remote anonymous {
-	exchange_mode main;
-
-	lifetime time 24 hour;
-
-	proposal {
-		encryption_algorithm 3des;
-		hash_algorithm sha1;
-		authentication_method gssapi_krb;
-		# The default GSS-API ID is "host/hostname", where
-		# hostname is the output of the hostname(1) command.
-		# You probably want this to match your system's host
-		# principal.  ktutil(8)'s "list" command will list the
-		# principals in your system's keytab.  If you need to,
-		# you can change the GSS-API ID here.
-		#gss_id "host/some.host.name";
-
-		dh_group 1;
-	}
-}
-
-sainfo anonymous {
-	lifetime time 2 hour;
-
-	encryption_algorithm rijndael, 3des;
-	authentication_algorithm hmac_sha1, hmac_md5;
-	compression_algorithm deflate;
-}
diff --git a/src/racoon/samples/racoon.conf.sample-inherit b/src/racoon/samples/racoon.conf.sample-inherit
deleted file mode 100644
index 9e1185f..0000000
--- a/src/racoon/samples/racoon.conf.sample-inherit
+++ /dev/null
@@ -1,55 +0,0 @@
-# Id: racoon.conf.sample-inherit,v 1.3 2005/12/13 16:41:07 vanhu Exp
-# Contributed by: Michal Ludvig <mludvig@suse.cz>, SUSE Labs
-
-# This file shows the basic inheritance usage in 'remote' statements.
-
-path pre_shared_key "/etc/racoon/psk.txt";
-path certificate "/etc/racoon";
-
-remote anonymous
-{
-	exchange_mode main,aggressive;
-	doi ipsec_doi;
-	situation identity_only;
-
-	my_identifier asn1dn;
-	certificate_type x509 "my.cert.pem" "my.key.pem";
-
-	nonce_size 16;
-	initial_contact on;
-	proposal_check strict;	# obey, strict or claim
-
-	proposal {
-		encryption_algorithm 3des;
-		hash_algorithm sha1;
-		authentication_method rsasig;
-		dh_group 2;
-	}
-}
-
-remote 3ffe:ffff::1 inherit anonymous
-{
-	exchange_mode aggressive;
-	nat_traversal force;
-}
-
-remote 3ffe:ffff::1 [8000] inherit 3ffe:ffff::1
-{
-	lifetime time 1 min;	# sec,min,hour
-
-	proposal {
-		encryption_algorithm 3des;
-		hash_algorithm sha1;
-		authentication_method pre_shared_key;
-		dh_group 2;
-	}
-}
-
-sainfo anonymous
-{
-	pfs_group 2;
-	lifetime time 12 hour;
-	encryption_algorithm aes, 3des;
-	authentication_algorithm hmac_sha1, hmac_md5;
-	compression_algorithm deflate;
-}
diff --git a/src/racoon/samples/racoon.conf.sample-natt b/src/racoon/samples/racoon.conf.sample-natt
deleted file mode 100644
index 645b4de..0000000
--- a/src/racoon/samples/racoon.conf.sample-natt
+++ /dev/null
@@ -1,97 +0,0 @@
-# Id: racoon.conf.sample-natt,v 1.5 2005/12/13 16:41:07 vanhu Exp
-# Contributed by: Michal Ludvig <mludvig@suse.cz>, SUSE Labs
-
-# This file can be used as a template for NAT-Traversal setups.
-# Only NAT-T related options are explained here, refer to other 
-# sample files and manual pages for details about the rest.
-
-path include "/etc/racoon";
-path certificate "/etc/racoon/cert";
-
-# Define addresses and ports where racoon will listen for an incoming
-# traffic. Don't forget to open these ports on your firewall!
-listen
-{
-	# First define an address where racoon will listen 
-	# for "normal" IKE traffic. IANA allocated port 500.
-	isakmp 172.16.0.1[500];
-
-	# To use NAT-T you must also open port 4500 of 
-	# the same address so that peers can do 'Port floating'.
-	# The same port will also be used for the UDP-Encapsulated 
-	# ESP traffic.
-	isakmp_natt 172.16.0.1[4500];
-}
-
-
-timer
-{
-	# To keep the NAT-mappings on your NAT gateway, there must be
-	# traffic between the peers. Normally the UDP-Encap traffic
-	# (i.e. the real data transported over the tunnel) would be
-	# enough, but to be safe racoon will send a short
-	# "Keep-alive packet" every few seconds to every peer with
-	# whom it does NAT-Traversal.
-	# The default is 20s. Set it to 0s to disable sending completely.
-	natt_keepalive 10 sec;
-}
-
-# To trigger the SA negotiation there must be an appropriate 
-# policy in the kernel SPD. For example for traffic between 
-# networks 192.168.0.0/24 and 192.168.1.0/24 with gateways 
-# 172.16.0.1 and 172.16.1.1, where the first gateway is behind 
-# a NAT which translates its address to 172.16.1.3, you need the 
-# following rules:
-# On 172.16.0.1 (e.g. behind the NAT):
-#     spdadd 192.168.0.0/24 192.168.1.0/24 any -P out ipsec \
-#            esp/tunnel/172.16.0.1-172.16.1.1/require;
-#     spdadd 192.168.1.0/24 192.168.0.0/24 any -P in ipsec \
-#            esp/tunnel/172.16.1.1-172.16.0.1/require;
-# On the other side (172.16.1.1) either use a "generate_policy on"
-# statement in the remote block, or in case that you know 
-# the translated address, use the following policy:
-#     spdadd 192.168.1.0/24 192.168.0.0/24 any -P out ipsec \
-#            esp/tunnel/172.16.1.1-172.16.1.3/require;
-#     spdadd 192.168.0.0/24 192.168.1.0/24 any -P in ipsec \
-#            esp/tunnel/172.16.1.3-172.16.1.1/require;
-
-# Phase 1 configuration (for ISAKMP SA)
-remote anonymous
-{
-	# NAT-T is supported with all exchange_modes.
-	exchange_mode main,base,aggressive;
-
-	# With NAT-T you shouldn't use PSK. Let's go on with certs.
-	my_identifier asn1dn;
-	certificate_type x509 "your-host.cert.pem" "your-host.key.pem";
-
-	# This is the main switch that enables NAT-T.
-	# Possible values are:
-	#   off - NAT-T support is disabled, i.e. neither offered,
-	#         nor accepted. This is the default.
-	#    on - normal NAT-T support, i.e. if NAT is detected 
-	#         along the way, NAT-T is used.
-	# force - if NAT-T is supported by both peers, it is used
-	#         regardless of whether there is a NAT gateway between them
-	#         or not. This is useful for traversing some firewalls.
-	nat_traversal on;
-	
-	proposal {
-		authentication_method rsasig;
-		encryption_algorithm 3des;
-		hash_algorithm sha1;
-		dh_group 2;
-	}
-
-	proposal_check strict;
-}
-
-# Phase 2 proposal (for IPsec SA)
-sainfo anonymous
-{
-	pfs_group 2;
-	lifetime time 12 hour;
-	encryption_algorithm 3des, rijndael;
-	authentication_algorithm hmac_sha1;
-	compression_algorithm deflate;
-}
diff --git a/src/racoon/samples/racoon.conf.sample-plainrsa b/src/racoon/samples/racoon.conf.sample-plainrsa
deleted file mode 100644
index 8447eb3..0000000
--- a/src/racoon/samples/racoon.conf.sample-plainrsa
+++ /dev/null
@@ -1,46 +0,0 @@
-# Id: racoon.conf.sample-plainrsa,v 1.4 2005/12/13 16:41:07 vanhu Exp
-# Contributed by: Michal Ludvig <mludvig@suse.cz>, SUSE Labs
-#                 http://www.logix.cz/michal
-
-# This file shows the usage of PlainRSA keys, which are widely used
-# by FreeSWAN/OpenSwan/StrongSwan/*Swan users. This functionality is 
-# here mainly for those who are moving from the *Swan world to Racoon.
-
-# Racoon will look for a keyfile in this directory.
-path certificate "samples" ;
-
-remote anonymous
-{
-	# *Swan supports only 'main' mode.
-	exchange_mode main;
-
-	# *Swan doesn't send identifiers by default.
-	my_identifier address;
-	peers_identifier address;
-
-	# This is the trick - use PlainRSA certificates.
-	certificate_type plain_rsa "privatekey.rsa";
-
-	# Multiple certfiles are supported.
-	peers_certfile plain_rsa "pubkey1.rsa";
-	peers_certfile plain_rsa "pubkey2.rsa";
-
-	# Standard setup follows...
-	proposal_check strict;
-
-	proposal {
-		encryption_algorithm 3des;
-		hash_algorithm sha1;
-		authentication_method rsasig;
-		dh_group 2;
-	}
-}
-
-sainfo anonymous
-{
-	pfs_group 2;
-	lifetime time 12 hour;
-	encryption_algorithm 3des, aes;
-	authentication_algorithm hmac_sha1, hmac_md5;
-	compression_algorithm deflate;
-}
diff --git a/src/racoon/samples/roadwarrior/README b/src/racoon/samples/roadwarrior/README
deleted file mode 100644
index aac9d43..0000000
--- a/src/racoon/samples/roadwarrior/README
+++ /dev/null
@@ -1,67 +0,0 @@
-This directory contains sample configurations files used for roadwarrior
-remote access using hybrid authentication. In this setup, the VPN 
-gateway authenticates to the client using a certificate, and the client
-authenticates to the VPN gateway using a login and a password.
-
-Moreover, this setup makes use of ISAKMP mode config to autoconfigure 
-the client. After a successful login, the client will receive an 
-internal address, netmask and DNS from the VPN gateway.
-
-
-Server setups
-=============
-The server setups need racoon built with the following options:
-configure --enable-natt --enable-frag --enable-hybrid --enable-dpd \
-	  --with-libradius --sysconfdir=/etc/racoon
-
-The first server setup, in server/racoon.conf, is for a VPN gateway 
-using authentication against the system password database, and using 
-a locally configured pool of addresses. 
-
-The second setup, server/racoon.conf-radius, uses a RADIUS server for 
-authentication, IP allocation and accounting. The address and secret
-to be used for the RADIUS server are configured in /etc/radius.conf, 
-see radius.conf(5).
-
-Both configurations can be used with the Cisco VPN client if it
-is set up to use hybrid authentication (aka mutual group authentication,
-available in Cisco VPN client version 4.0.5 and above). The group 
-password configured in the Cisco VPN client is not used by racoon.
-
-After you have installed /etc/racoon/racoon.conf, you will also have 
-to install a server certificate and key in /etc/openssl/certs/server.crt
-and /etc/openssl/certs/server.key
-
-
-Client setup
-============
-The client setup needs racoon built with the following options:
-configure --enable-natt --enable-frag --enable-hybrid --enable-dpd \
-	  --enable-adminport --sysconfdir=/etc/racoon --localstatedir=/var
-
-You need to copy client/racoon.conf, client/phase1-up.sh and
-client/phase1-down.sh to /etc/racoon, and you need to copy the 
-certificate authority that signed the VPN gateway certificate in
-/etc/openssl/certs/root-ca.crt
-
-Once this is done, you can run racoon, and then you can start
-the VPN using racoonctl:
-racoonctl vc -u username vpn-gateway.example.net
-
-Where username is your login, and vpn-gateway.example.net is
-the DNS or IP address of the VPN gateway. racoonctl will prompt 
-you for the password.
-
-The password can be stored in the psk.txt file. In that situation, 
-add this directive to the remote section of racoon.conf:
-	 xauth_login "username";
-where username is your login.
-
-Note that for now there is no feedback in racoonctl if the authentication
-fails. Peek at the racoon logs to discover what goes wrong.
-
-In order to disconnect from the VPN, do this:
-racoonctl vd vpn-gateway.example.net
-
-This configuration should be compatible with the Cisco VPN 3000 using 
-hybrid authentication, though this has not been tested.
diff --git a/src/racoon/samples/roadwarrior/client/phase1-down.sh b/src/racoon/samples/roadwarrior/client/phase1-down.sh
deleted file mode 100755
index 8edc187..0000000
--- a/src/racoon/samples/roadwarrior/client/phase1-down.sh
+++ /dev/null
@@ -1,73 +0,0 @@
-#!/bin/sh
-
-#
-# sa-down.sh local configuration for a new SA
-#
-
-PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
-
-case `uname -s` in
-NetBSD)
-	DEFAULT_GW=`netstat -rn | awk '($1 == "default"){print $2}'`
-	;;
-Linux)
-	DEFAULT_GW=`netstat -rn | awk '($1 == "0.0.0.0"){print $2}'`
-	;;
-esac
-
-echo $@
-echo "LOCAL_ADDR = ${LOCAL_ADDR}"
-echo "LOCAL_PORT = ${LOCAL_PORT}"
-echo "REMOTE_ADDR = ${REMOTE_ADDR}"
-echo "REMOTE_PORT = ${REMOTE_PORT}"
-echo "DEFAULT_GW = ${DEFAULT_GW}"
-echo "INTERNAL_ADDR4 = ${INTERNAL_ADDR4}"
-echo "INTERNAL_DNS4 = ${INTERNAL_DNS4}"
-
-echo ${INTERNAL_ADDR4} | grep '[0-9]' > /dev/null || exit 0
-echo ${DEFAULT_GW} | grep '[0-9]' > /dev/null || exit 0
-
-test -f /etc/resolv.conf.bak && cp /etc/resolv.conf.bak /etc/resolv.conf
-
-case `uname -s` in
-NetBSD)
-	if=`netstat -rn|awk '($1 == "default"){print $7}'`
-	ifconfig ${if} delete ${INTERNAL_ADDR4}
-	route delete default
-	route delete ${REMOTE_ADDR}
-	route add default ${DEFAULT_GW} -ifa ${LOCAL_ADDR}
-	;;
-Linux)
-	if=`netstat -rn|awk '($1 == "0.0.0.0"){print $8}'`
-	route delete default
-	route delete ${REMOTE_ADDR}
-	ifconfig ${if}:1 del ${INTERNAL_ADDR4}
-	route add default gw ${DEFAULT_GW}
-
-	#
-	# XXX This is a workaround because Linux seems to ignore
-	# the deleteall commands below. This is bad because it flushes
-	# any SAD instead of flushing what needs to be flushed.
-	# Someone using Linux please fix it
-	#
-	setkey -F
-	;;
-esac
-
-# Use this for a NAT-T setup
-LOCAL="${LOCAL_ADDR}[${LOCAL_PORT}]"
-REMOTE="${REMOTE_ADDR}[${REMOTE_PORT}]"
-
-# Use this for a non NAT-T setup
-#LOCAL="${LOCAL_ADDR}"
-#REMOTE="${REMOTE_ADDR}"
-
-echo "
-deleteall ${REMOTE_ADDR} ${LOCAL_ADDR} esp;
-deleteall ${LOCAL_ADDR} ${REMOTE_ADDR} esp; 
-spddelete ${INTERNAL_ADDR4}/32[any] 0.0.0.0/0[any] any
-	-P out ipsec esp/tunnel/${LOCAL}-${REMOTE}/require;
-spddelete 0.0.0.0/0[any] ${INTERNAL_ADDR4}[any] any
-	-P in ipsec esp/tunnel/${REMOTE}-${LOCAL}/require;
-" | setkey -c
-
diff --git a/src/racoon/samples/roadwarrior/client/phase1-up.sh b/src/racoon/samples/roadwarrior/client/phase1-up.sh
deleted file mode 100755
index e45b648..0000000
--- a/src/racoon/samples/roadwarrior/client/phase1-up.sh
+++ /dev/null
@@ -1,77 +0,0 @@
-#!/bin/sh
-
-#
-# sa-up.sh local configuration for a new SA
-#
-PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin
-
-case `uname -s` in
-NetBSD)
-	DEFAULT_GW=`netstat -rn | awk '($1 == "default"){print $2}'`
-	;;
-Linux)
-	DEFAULT_GW=`netstat -rn | awk '($1 == "0.0.0.0"){print $2}'`
-	;;
-esac
-
-echo $@
-echo "LOCAL_ADDR = ${LOCAL_ADDR}"
-echo "LOCAL_PORT = ${LOCAL_PORT}"
-echo "REMOTE_ADDR = ${REMOTE_ADDR}"
-echo "REMOTE_PORT = ${REMOTE_PORT}"
-echo "DEFAULT_GW = ${DEFAULT_GW}"
-echo "INTERNAL_ADDR4 = ${INTERNAL_ADDR4}"
-echo "INTERNAL_DNS4 = ${INTERNAL_DNS4}"
-
-echo ${INTERNAL_ADDR4} | grep '[0-9]' > /dev/null || exit 0
-echo ${DEFAULT_GW} | grep '[0-9]' > /dev/null || exit 0
-
-test -f /etc/resolv.conf.bak || cp /etc/resolv.conf /etc/resolv.conf.bak
-echo "# Generated by racoon on `date`" > /etc/resolv.conf
-echo "nameserver ${INTERNAL_DNS4}" >> /etc/resolv.conf
-
-case `uname -s` in
-NetBSD)
-	if=`netstat -rn|awk '($1 == "default"){print $7}'`
-	ifconfig ${if} alias ${INTERNAL_ADDR4} netmask ${INTERNAL_NETMASK4}
-	route delete default
-	route add default ${DEFAULT_GW} -ifa ${INTERNAL_ADDR4}
-	route add ${REMOTE_ADDR} ${DEFAULT_GW}
-	;;
-Linux)
-	if=`netstat -rn|awk '($1 == "0.0.0.0"){print $8}'`
-	ifconfig ${if}:1 ${INTERNAL_ADDR4}      
-	route delete default
-	route add ${REMOTE_ADDR} gw ${DEFAULT_GW} dev ${if}
-	route add default gw ${DEFAULT_GW} dev ${if}:1
-	;;
-esac
-
-# Use this for a NAT-T setup
-LOCAL="${LOCAL_ADDR}[${LOCAL_PORT}]"
-REMOTE="${REMOTE_ADDR}[${REMOTE_PORT}]"
-
-# Use this for a non NAT-T setup
-#LOCAL="${LOCAL_ADDR}"
-#REMOTE="${REMOTE_ADDR}"
-
-
-echo "
-spdadd ${INTERNAL_ADDR4}/32[any] 0.0.0.0/0[any] any
-       -P out ipsec esp/tunnel/${LOCAL}-${REMOTE}/require;
-spdadd 0.0.0.0/0[any] ${INTERNAL_ADDR4}[any] any
-       -P in ipsec esp/tunnel/${REMOTE}-${LOCAL}/require;
-" | setkey -c
-
-#
-# XXX This is a workaround for Linux forward policies problem. 
-# Someone familiar with forward policies please fix this properly.
-#
-case `uname -s` in
-Linux)
-	echo "
-	spddelete 0.0.0.0/0[any] ${INTERNAL_ADDR4}[any] any
-		-P fwd ipsec esp/tunnel/${REMOTE}-${LOCAL}/require;
-	" | setkey -c
-	;;
-esac
diff --git a/src/racoon/samples/roadwarrior/client/racoon.conf b/src/racoon/samples/roadwarrior/client/racoon.conf
deleted file mode 100644
index 669be36..0000000
--- a/src/racoon/samples/roadwarrior/client/racoon.conf
+++ /dev/null
@@ -1,33 +0,0 @@
-path certificate "/etc/openssl/certs";
-path pre_shared_key "/etc/racoon/psk.txt";
-
-listen {
-	adminsock "/var/racoon/racoon.sock" "root" "operator" 0660;
-}
-
-remote 192.0.2.50 {
-        exchange_mode aggressive;
-	ca_type x509 "root-ca.crt";
-        proposal_check strict;
-	nat_traversal on;
-	ike_frag on;
-	mode_cfg on;
-	script "/etc/racoon/phase1-up.sh" phase1_up;
-	script "/etc/racoon/phase1-down.sh" phase1_down;
-	passive off;
-        proposal {
-                encryption_algorithm aes;
-                hash_algorithm sha1;
-                authentication_method hybrid_rsa_client;
-                dh_group 2;
-        }
-}
-
-
-sainfo anonymous {
-        pfs_group 2;
-        lifetime time 1 hour;
-        encryption_algorithm aes;
-        authentication_algorithm hmac_sha1;
-        compression_algorithm deflate ;
-}
diff --git a/src/racoon/samples/roadwarrior/server/racoon.conf b/src/racoon/samples/roadwarrior/server/racoon.conf
deleted file mode 100644
index ae7d603..0000000
--- a/src/racoon/samples/roadwarrior/server/racoon.conf
+++ /dev/null
@@ -1,42 +0,0 @@
-path certificate "/etc/openssl/certs";
-
-listen {
-	adminsock disabled;
-}
-
-remote anonymous {
-	exchange_mode aggressive;
-	certificate_type x509 "server.crt" "server.key";
-	my_identifier asn1dn;
-	proposal_check strict;
-	generate_policy on;
-	nat_traversal on;
-	dpd_delay 20;
-	ike_frag on;
-	proposal {
-		encryption_algorithm aes;
-		hash_algorithm sha1;
-		authentication_method hybrid_rsa_server;
-		dh_group 2;
-	}
-}
-
-mode_cfg {
-	network4 10.99.99.0;
-	pool_size 255;
-	netmask4 255.255.255.0;  
-	auth_source system;
-	dns4 10.0.12.1;
-	wins4 10.0.12.1;
-	banner "/etc/racoon/motd";
-	pfs_group 2;
-}	       
-		
-sainfo anonymous {
-	pfs_group 2;
-	lifetime time 1 hour;
-	encryption_algorithm aes;
-	authentication_algorithm hmac_sha1;
-	compression_algorithm deflate;
-}   
-
diff --git a/src/racoon/samples/roadwarrior/server/racoon.conf-radius b/src/racoon/samples/roadwarrior/server/racoon.conf-radius
deleted file mode 100644
index 24e8d4e..0000000
--- a/src/racoon/samples/roadwarrior/server/racoon.conf-radius
+++ /dev/null
@@ -1,42 +0,0 @@
-path certificate "/etc/openssl/certs";
-
-listen {
-	adminsock disabled;
-}
-
-remote anonymous {
-	exchange_mode aggressive;
-	certificate_type x509 "server.crt" "server.key";
-	my_identifier asn1dn;
-	proposal_check strict;
-	generate_policy on;
-	nat_traversal on;
-	dpd_delay 20;
-	ike_frag on;
-	proposal {
-		encryption_algorithm aes;
-		hash_algorithm sha1;
-		authentication_method hybrid_rsa_server;
-		dh_group 2;
-	}
-}
-
-mode_cfg {
-	pool_size 255;
-	auth_source radius;
-	conf_source radius;
-	accounting radius;
-	dns4 10.0.12.1;
-	wins4 10.0.12.1;
-	banner "/etc/racoon/motd";
-	pfs_group 2;
-}	       
-		
-sainfo anonymous {
-	pfs_group 2;
-	lifetime time 1 hour;
-	encryption_algorithm aes;
-	authentication_algorithm hmac_sha1;
-	compression_algorithm deflate;
-}   
-
diff --git a/src/racoon/schedule.c b/src/racoon/schedule.c
deleted file mode 100644
index 04723c5..0000000
--- a/src/racoon/schedule.c
+++ /dev/null
@@ -1,364 +0,0 @@
-/*	$NetBSD: schedule.c,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
-
-/*	$KAME: schedule.c,v 1.19 2001/11/05 10:53:19 sakane Exp $	*/
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/time.h>
-#include <sys/queue.h>
-#include <sys/socket.h>
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-#include <time.h>
-
-#include "misc.h"
-#include "plog.h"
-#include "schedule.h"
-#include "var.h"
-#include "gcmalloc.h"
-
-#define FIXY2038PROBLEM
-
-#ifndef TAILQ_FOREACH
-#define TAILQ_FOREACH(elm, head, field) \
-        for (elm = TAILQ_FIRST(head); elm; elm = TAILQ_NEXT(elm, field))
-#endif
-
-static struct timeval timeout;
-
-#ifdef FIXY2038PROBLEM
-#define Y2038TIME_T	0x7fffffff
-static time_t launched;		/* time when the program launched. */
-static time_t deltaY2038;
-#endif
-
-static TAILQ_HEAD(_schedtree, sched) sctree;
-
-static void sched_add __P((struct sched *));
-static time_t current_time __P((void));
-
-/*
- * schedule handler
- * OUT:
- *	time to block until next event.
- *	if no entry, NULL returned.
- */
-struct timeval *
-schedular()
-{
-	time_t now, delta;
-	struct sched *p, *next = NULL;
-
-	now = current_time();
-
-        for (p = TAILQ_FIRST(&sctree); p; p = next) {
-		/* if the entry has been daed, remove it */
-		if (p->dead)
-			goto next_schedule;
-
-		/* if the time hasn't come, proceed to the next entry */
-		if (now < p->xtime) {
-			next = TAILQ_NEXT(p, chain);
-			continue;
-		}
-
-		/* mark it with dead. and call the function. */
-		p->dead = 1;
-		if (p->func != NULL)
-			(p->func)(p->param);
-
-	   next_schedule:
-		next = TAILQ_NEXT(p, chain);
-		TAILQ_REMOVE(&sctree, p, chain);
-		racoon_free(p);
-	}
-
-	p = TAILQ_FIRST(&sctree);
-	if (p == NULL)
-		return NULL;
-
-	now = current_time();
-
-	delta = p->xtime - now;
-	timeout.tv_sec = delta < 0 ? 0 : delta;
-	timeout.tv_usec = 0;
-
-	return &timeout;
-}
-
-/*
- * add new schedule to schedule table.
- */
-struct sched *
-sched_new(tick, func, param)
-	time_t tick;
-	void (*func) __P((void *));
-	void *param;
-{
-	static long id = 1;
-	struct sched *new;
-
-	new = (struct sched *)racoon_malloc(sizeof(*new));
-	if (new == NULL)
-		return NULL;
-
-	memset(new, 0, sizeof(*new));
-	new->func = func;
-	new->param = param;
-
-	new->id = id++;
-	time(&new->created);
-	new->tick = tick;
-
-	new->xtime = current_time() + tick;
-	new->dead = 0;
-
-	/* add to schedule table */
-	sched_add(new);
-
-	return(new);
-}
-
-/* add new schedule to schedule table */
-static void
-sched_add(sc)
-	struct sched *sc;
-{
-	struct sched *p;
-
-	TAILQ_FOREACH(p, &sctree, chain) {
-		if (sc->xtime < p->xtime) {
-			TAILQ_INSERT_BEFORE(p, sc, chain);
-			return;
-		}
-	}
-	if (p == NULL)
-		TAILQ_INSERT_TAIL(&sctree, sc, chain);
-
-	return;
-}
-
-/* get current time.
- * if defined FIXY2038PROBLEM, base time is the time when called sched_init().
- * Otherwise, conform to time(3).
- */
-static time_t
-current_time()
-{
-	time_t n;
-#ifdef FIXY2038PROBLEM
-	time_t t;
-
-	time(&n);
-	t = n - launched;
-	if (t < 0)
-		t += deltaY2038;
-
-	return t;
-#else
-	return time(&n);
-#endif
-}
-
-void
-sched_kill(sc)
-	struct sched *sc;
-{
-	sc->dead = 1;
-
-	return;
-}
-
-/* XXX this function is probably unnecessary. */
-void
-sched_scrub_param(param)
-	void *param;
-{
-	struct sched *sc;
-
-	TAILQ_FOREACH(sc, &sctree, chain) {
-		if (sc->param == param) {
-			if (!sc->dead) {
-				plog(LLV_DEBUG, LOCATION, NULL,
-				    "an undead schedule has been deleted.\n");
-			}
-			sched_kill(sc);
-		}
-	}
-}
-
-/*
- * for debug
- */
-int
-sched_dump(buf, len)
-	caddr_t *buf;
-	int *len;
-{
-	caddr_t new;
-	struct sched *p;
-	struct scheddump *dst;
-	int cnt = 0;
-
-	/* initialize */
-	*len = 0;
-	*buf = NULL;
-
-	TAILQ_FOREACH(p, &sctree, chain)
-		cnt++;
-
-	/* no entry */
-	if (cnt == 0)
-		return -1;
-
-	*len = cnt * sizeof(*dst);
-
-	new = racoon_malloc(*len);
-	if (new == NULL)
-		return -1;
-	dst = (struct scheddump *)new;
-
-        p = TAILQ_FIRST(&sctree);
-	while (p) {
-		dst->xtime = p->xtime;
-		dst->id = p->id;
-		dst->created = p->created;
-		dst->tick = p->tick;
-
-		p = TAILQ_NEXT(p, chain);
-		if (p == NULL)
-			break;
-		dst++;
-	}
-
-	*buf = new;
-
-	return 0;
-}
-
-/* initialize schedule table */
-void
-sched_init()
-{
-#ifdef FIXY2038PROBLEM
-	time(&launched);
-
-	deltaY2038 = Y2038TIME_T - launched;
-#endif
-
-	TAILQ_INIT(&sctree);
-
-	return;
-}
-
-#ifdef STEST
-#include <sys/types.h>
-#include <sys/time.h>
-#include <unistd.h>
-#include <err.h>
-
-void
-test(tick)
-	int *tick;
-{
-	printf("execute %d\n", *tick);
-	racoon_free(tick);
-}
-
-void
-getstdin()
-{
-	int *tick;
-	char buf[16];
-
-	read(0, buf, sizeof(buf));
-	if (buf[0] == 'd') {
-		struct scheddump *scbuf, *p;
-		int len;
-		sched_dump((caddr_t *)&scbuf, &len);
-		if (scbuf == NULL)
-			return;
-		for (p = scbuf; len; p++) {
-			printf("xtime=%ld\n", p->xtime);
-			len -= sizeof(*p);
-		}
-		racoon_free(scbuf);
-		return;
-	}
-
-	tick = (int *)racoon_malloc(sizeof(*tick));
-	*tick = atoi(buf);
-	printf("new queue tick = %d\n", *tick);
-	sched_new(*tick, test, tick);
-}
-
-int
-main()
-{
-	static fd_set mask0;
-	int nfds = 0;
-	fd_set rfds;
-	struct timeval *timeout;
-	int error;
-
-	FD_ZERO(&mask0);
-	FD_SET(0, &mask0);
-	nfds = 1;
-
-	/* initialize */
-	sched_init();
-
-	while (1) {
-		rfds = mask0;
-
-		timeout = schedular();
-
-		error = select(nfds, &rfds, (fd_set *)0, (fd_set *)0, timeout);
-		if (error < 0) {
-			switch (errno) {
-			case EINTR: continue;
-			default:
-				err(1, "select");
-			}
-			/*NOTREACHED*/
-		}
-
-		if (FD_ISSET(0, &rfds))
-			getstdin();
-	}
-}
-#endif
diff --git a/src/racoon/schedule.h b/src/racoon/schedule.h
deleted file mode 100644
index bd66593..0000000
--- a/src/racoon/schedule.h
+++ /dev/null
@@ -1,85 +0,0 @@
-/*	$NetBSD: schedule.h,v 1.4.6.1 2007/03/21 14:29:48 vanhu Exp $	*/
-
-/* Id: schedule.h,v 1.5 2006/05/03 21:53:42 vanhu Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _SCHEDULE_H
-#define _SCHEDULE_H
-
-#include <sys/queue.h>
-#include "gnuc.h"
-
-/* scheduling table */
-/* the head is the nearest event. */
-struct sched {
-	time_t xtime;		/* event time which is as time(3). */
-				/*
-				 * if defined FIXY2038PROBLEM, this time
-				 * is from the time when called sched_init().
-				 */
-	void (*func) __P((void *)); /* call this function when timeout. */
-	void *param;		/* pointer to parameter */
-
-	int dead;		/* dead or alive */
-	long id;		/* for debug */
-	time_t created;		/* for debug */
-	time_t tick;		/* for debug */
-
-	TAILQ_ENTRY(sched) chain;
-};
-
-/* cancel schedule */
-#define SCHED_KILL(s)                                                          \
-do {                                                                           \
-	if(s != NULL){	   														\
-		sched_kill(s);                                                         \
-		s = NULL;                                                              \
-	}\
-} while(0)
-
-/* must be called after it's called from scheduler. */
-#define SCHED_INIT(s)	(s) = NULL
-
-struct scheddump {
-	time_t xtime;
-	long id;
-	time_t created;
-	time_t tick;
-};
-
-struct timeval *schedular __P((void));
-struct sched *sched_new __P((time_t, void (*func) __P((void *)), void *));
-void sched_kill __P((struct sched *));
-int sched_dump __P((caddr_t *, int *));
-void sched_init __P((void));
-void sched_scrub_param __P((void *));
-
-#endif /* _SCHEDULE_H */
diff --git a/src/racoon/security.c b/src/racoon/security.c
deleted file mode 100644
index e4b5a0d..0000000
--- a/src/racoon/security.c
+++ /dev/null
@@ -1,265 +0,0 @@
-/*
- * Copyright (C) 2005 International Business Machines Corporation
- * Copyright (c) 2005 by Trusted Computer Solutions, Inc.
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-
-#include "config.h"
-
-#include <sys/types.h>
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-
-#include <selinux/selinux.h>
-#include <selinux/flask.h>
-#include <selinux/av_permissions.h>
-#include <selinux/avc.h>
-#include <selinux/context.h>
-
-#include "var.h"
-#include "vmbuf.h"
-#include "misc.h"
-#include "plog.h"
-
-#include "isakmp_var.h"
-#include "isakmp.h"
-#include "ipsec_doi.h"
-#include "policy.h"
-#include "proposal.h"
-#include "strnames.h"
-#include "handler.h"
-
-/* 
- * Get the security context information from SA.
- */
-int
-get_security_context(sa, p)
-	vchar_t *sa;
-	struct policyindex *p;
-{
-	int len = 0;
-	int flag, type = 0;
-	u_int16_t lorv;
-	caddr_t bp;
-	vchar_t *pbuf = NULL;
-	vchar_t *tbuf = NULL;
-	struct isakmp_parse_t *pa;
-	struct isakmp_parse_t *ta;
-	struct isakmp_pl_p *prop;
-	struct isakmp_pl_t *trns;
-	struct isakmp_data *d;
-	struct ipsecdoi_sa_b *sab = (struct ipsecdoi_sa_b *)sa->v;
-	
-	/* check SA payload size */
-	if (sa->l < sizeof(*sab)) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"Invalid SA length = %zu.\n", sa->l);
-		return -1;
-	}
-
-	bp = (caddr_t)(sab + 1); /* here bp points to first proposal payload */
-	len = sa->l - sizeof(*sab);
-
-	pbuf = isakmp_parsewoh(ISAKMP_NPTYPE_P, (struct isakmp_gen *)bp, len);
-	if (pbuf == NULL)
-		return -1;
-
-	pa = (struct isakmp_parse_t *)pbuf->v; 
-        /* check the value of next payload */
-	if (pa->type != ISAKMP_NPTYPE_P) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"Invalid payload type=%u\n", pa->type);
-		vfree(pbuf);
-		return -1;
-	}
-
-	if (pa->len == 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		"invalid proposal with length %d\n", pa->len);
-		vfree(pbuf);
-		return -1;
-	}
-
-	/* our first proposal */
-	prop = (struct isakmp_pl_p *)pa->ptr;
-
-	/* now get transform */
-	bp = (caddr_t)prop + sizeof(struct isakmp_pl_p) + prop->spi_size;
-	len = ntohs(prop->h.len) - 
-		(sizeof(struct isakmp_pl_p) + prop->spi_size);
-	tbuf = isakmp_parsewoh(ISAKMP_NPTYPE_T, (struct isakmp_gen *)bp, len);
-	if (tbuf == NULL)
-		return -1;
-
-	ta = (struct isakmp_parse_t *)tbuf->v;
-	if (ta->type != ISAKMP_NPTYPE_T) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		     "Invalid payload type=%u\n", ta->type);
-		return -1;
-	}
-	
-	trns = (struct isakmp_pl_t *)ta->ptr;
-
-	len = ntohs(trns->h.len) - sizeof(struct isakmp_pl_t);
-	d = (struct isakmp_data *)((caddr_t)trns + sizeof(struct isakmp_pl_t));
-
-	while (len > 0) {
-		type = ntohs(d->type) & ~ISAKMP_GEN_MASK;
-		flag = ntohs(d->type) & ISAKMP_GEN_MASK;
-		lorv = ntohs(d->lorv);
-
-		if (type != IPSECDOI_ATTR_SECCTX) {
-			if (flag) {
-				len -= sizeof(*d);
-				d = (struct isakmp_data *)((char *)d 
-				     + sizeof(*d));
-			} else {
-				len -= (sizeof(*d) + lorv);
-				d = (struct isakmp_data *)((caddr_t)d
-				     + sizeof(*d) + lorv);
-			}
-		} else {
-			flag = ntohs(d->type & ISAKMP_GEN_MASK);
-			if (flag) {
-				plog(LLV_ERROR, LOCATION, NULL,
-				     "SECCTX must be in TLV.\n");
-				return -1;
-			}
-			memcpy(&p->sec_ctx, d + 1, lorv);
-			p->sec_ctx.ctx_strlen = ntohs(p->sec_ctx.ctx_strlen);
-			return 0;
-		}
-	}
-	return 0;
-}
-
-void
-set_secctx_in_proposal(iph2, spidx)
-	struct ph2handle *iph2;
-	struct policyindex spidx;
-{
-	iph2->proposal->sctx.ctx_doi = spidx.sec_ctx.ctx_doi;
-	iph2->proposal->sctx.ctx_alg = spidx.sec_ctx.ctx_alg;
-	iph2->proposal->sctx.ctx_strlen = spidx.sec_ctx.ctx_strlen;
-		memcpy(iph2->proposal->sctx.ctx_str, spidx.sec_ctx.ctx_str,
-			spidx.sec_ctx.ctx_strlen);
-}
-
-
-/*
- * function: 	init_avc
- * description:	function performs the steps necessary to initialize the
- *		userspace avc.
- * input:	void
- * return:	0	if avc was successfully initialized
- * 		1	if the avc could not be initialized
- */
-
-static int mls_ready = 0;
-
-void
-init_avc(void)
-{
-	if (!is_selinux_mls_enabled()) {
-		plog(LLV_ERROR, LOCATION, NULL, "racoon: MLS support is not"
-				" enabled.\n");
-		return;
-	}
-
-	if (avc_init("racoon", NULL, NULL, NULL, NULL) == 0)
-		mls_ready = 1;
-	else
-		plog(LLV_ERROR, LOCATION, NULL, 
-		     "racoon: could not initialize avc.\n");
-}
-
-/*
- * function: 	within_range
- * description:	function determines if the specified sl is within the
- * 		configured range for a policy rule.
- * input:	security_context *sl		SL
- * 		char *range		Range
- * return:	1	if the sl is within the range
- * 		0	if the sl is not within the range or an error
- * 			occurred which prevented the determination
- */
-
-int
-within_range(security_context_t sl, security_context_t range)
-{
-	int rtn = 1;
-	security_id_t slsid;
-	security_id_t rangesid;
-	struct av_decision avd;
-	security_class_t tclass;
-	access_vector_t av;
-
-	if (!*range)	/* This policy doesn't have security context */
-		return 1;
-
-	if (!mls_ready)  /* mls may not be enabled */
-		return 0;
-
-	/*
-	 * Get the sids for the sl and range contexts
-	 */
-	rtn = avc_context_to_sid(sl, &slsid);
-	if (rtn != 0) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-				"within_range: Unable to retrieve "
-				"sid for sl context (%s).\n", sl);
-		return 0;
-	}
-	rtn = avc_context_to_sid(range, &rangesid);
-	if (rtn != 0) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-				"within_range: Unable to retrieve "
-				"sid for range context (%s).\n", range);
-		sidput(slsid);
-		return 0;
-	}
-
-	/* 
-	 * Straight up test between sl and range
-	 */
-	tclass = SECCLASS_ASSOCIATION;
-	av = ASSOCIATION__POLMATCH;
-	rtn = avc_has_perm(slsid, rangesid, tclass, av, NULL, &avd);
-	if (rtn != 0) {
-		plog(LLV_INFO, LOCATION, NULL, 
-			"within_range: The sl is not within range\n");
-		sidput(slsid);
-		sidput(rangesid);
-		return 0;
-	}
-	plog(LLV_DEBUG, LOCATION, NULL, 
-		"within_range: The sl (%s) is within range (%s)\n", sl, range);
-		return 1;
-}
diff --git a/src/racoon/session.c b/src/racoon/session.c
deleted file mode 100644
index 9db901d..0000000
--- a/src/racoon/session.c
+++ /dev/null
@@ -1,592 +0,0 @@
-/*	$NetBSD: session.c,v 1.7.6.2 2007/08/01 11:52:22 vanhu Exp $	*/
-
-/*	$KAME: session.c,v 1.32 2003/09/24 02:01:17 jinmei Exp $	*/
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/time.h>
-#include <sys/socket.h>
-#if HAVE_SYS_WAIT_H
-# include <sys/wait.h>
-#endif
-#ifndef WEXITSTATUS
-# define WEXITSTATUS(s)	((unsigned)(s) >> 8)
-#endif
-#ifndef WIFEXITED
-# define WIFEXITED(s)	(((s) & 255) == 0)
-#endif
-
-#include PATH_IPSEC_H
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-#ifdef HAVE_UNISTD_H
-#include <unistd.h>
-#endif
-#include <signal.h>
-#include <sys/stat.h>
-#include <paths.h>
-
-#include <netinet/in.h>
-#include <resolv.h>
-
-#include "libpfkey.h"
-
-#include "var.h"
-#include "misc.h"
-#include "vmbuf.h"
-#include "plog.h"
-#include "debug.h"
-
-#include "schedule.h"
-#include "session.h"
-#include "grabmyaddr.h"
-#include "evt.h"
-#include "cfparse_proto.h"
-#include "isakmp_var.h"
-#include "isakmp_xauth.h"
-#include "isakmp_cfg.h"
-#include "admin_var.h"
-#include "admin.h"
-#include "privsep.h"
-#include "oakley.h"
-#include "pfkey.h"
-#include "handler.h"
-#include "localconf.h"
-#include "remoteconf.h"
-#include "backupsa.h"
-#ifdef ENABLE_NATT
-#include "nattraversal.h"
-#endif
-
-
-#include "algorithm.h" /* XXX ??? */
-
-#include "sainfo.h"
-
-static void close_session __P((void));
-static void check_rtsock __P((void *));
-static void initfds __P((void));
-static void init_signal __P((void));
-static int set_signal __P((int sig, RETSIGTYPE (*func) __P((int))));
-static void check_sigreq __P((void));
-static void check_flushsa_stub __P((void *));
-static void check_flushsa __P((void));
-static int close_sockets __P((void));
-
-static fd_set mask0;
-static fd_set maskdying;
-static int nfds = 0;
-static volatile sig_atomic_t sigreq[NSIG + 1];
-static int dying = 0;
-
-int
-session(void)
-{
-	fd_set rfds;
-	struct timeval *timeout;
-	int error;
-	struct myaddrs *p;
-	char pid_file[MAXPATHLEN];
-	FILE *fp;
-	pid_t racoon_pid = 0;
-	int i;
-
-	/* initialize schedular */
-	sched_init();
-
-	init_signal();
-
-#ifdef ENABLE_ADMINPORT
-	if (admin_init() < 0)
-		exit(1);
-#endif
-
-	initmyaddr();
-
-	if (isakmp_init() < 0)
-		exit(1);
-
-	initfds();
-
-#ifdef ENABLE_NATT
-	natt_keepalive_init ();
-#endif
-
-	if (privsep_init() != 0)
-		exit(1);
-
-	for (i = 0; i <= NSIG; i++)
-		sigreq[i] = 0;
-
-	/* write .pid file */
-	racoon_pid = getpid();
-	if (lcconf->pathinfo[LC_PATHTYPE_PIDFILE] == NULL) 
-		strlcpy(pid_file, _PATH_VARRUN "racoon.pid", MAXPATHLEN);
-	else if (lcconf->pathinfo[LC_PATHTYPE_PIDFILE][0] == '/') 
-		strlcpy(pid_file, lcconf->pathinfo[LC_PATHTYPE_PIDFILE], MAXPATHLEN);
-	else {
-		strlcat(pid_file, _PATH_VARRUN, MAXPATHLEN);
-		strlcat(pid_file, lcconf->pathinfo[LC_PATHTYPE_PIDFILE], MAXPATHLEN);
-	} 
-	fp = fopen(pid_file, "w");
-	if (fp) {
-		if (fchmod(fileno(fp),
-			S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH) == -1) {
-			syslog(LOG_ERR, "%s", strerror(errno));
-			fclose(fp);
-			exit(1);
-		}
-		fprintf(fp, "%ld\n", (long)racoon_pid);
-		fclose(fp);
-	} else {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"cannot open %s", pid_file);
-	}
-
-	while (1) {
-		if (dying)
-			rfds = maskdying;
-		else
-			rfds = mask0;
-
-		/*
-		 * asynchronous requests via signal.
-		 * make sure to reset sigreq to 0.
-		 */
-		check_sigreq();
-
-		/* scheduling */
-		timeout = schedular();
-
-		error = select(nfds, &rfds, (fd_set *)0, (fd_set *)0, timeout);
-		if (error < 0) {
-			switch (errno) {
-			case EINTR:
-				continue;
-			default:
-				plog(LLV_ERROR, LOCATION, NULL,
-					"failed to select (%s)\n",
-					strerror(errno));
-				return -1;
-			}
-			/*NOTREACHED*/
-		}
-
-#ifdef ENABLE_ADMINPORT
-		if ((lcconf->sock_admin != -1) &&
-		    (FD_ISSET(lcconf->sock_admin, &rfds)))
-			admin_handler();
-#endif
-
-		for (p = lcconf->myaddrs; p; p = p->next) {
-			if (!p->addr)
-				continue;
-			if (FD_ISSET(p->sock, &rfds))
-				isakmp_handler(p->sock);
-		}
-
-		if (FD_ISSET(lcconf->sock_pfkey, &rfds))
-			pfkey_handler();
-
-		if (lcconf->rtsock >= 0 && FD_ISSET(lcconf->rtsock, &rfds)) {
-			if (update_myaddrs() && lcconf->autograbaddr)
-				check_rtsock(NULL);
-			else
-				initfds();
-		}
-	}
-}
-
-/* clear all status and exit program. */
-static void
-close_session()
-{
-#ifdef ENABLE_FASTQUIT
-	flushph2();
-#endif
-	flushph1();
-	close_sockets();
-	backupsa_clean();
-
-	plog(LLV_INFO, LOCATION, NULL, "racoon shutdown\n");
-	exit(0);
-}
-
-static void
-check_rtsock(unused)
-	void *unused;
-{
-	isakmp_close();
-	grab_myaddrs();
-	autoconf_myaddrsport();
-	isakmp_open();
-
-	/* initialize socket list again */
-	initfds();
-}
-
-static void
-initfds()
-{
-	struct myaddrs *p;
-
-	nfds = 0;
-
-	FD_ZERO(&mask0);
-	FD_ZERO(&maskdying);
-
-#ifdef ENABLE_ADMINPORT
-	if (lcconf->sock_admin != -1) {
-		if (lcconf->sock_admin >= FD_SETSIZE) {
-			plog(LLV_ERROR, LOCATION, NULL, "fd_set overrun\n");
-			exit(1);
-		}
-		FD_SET(lcconf->sock_admin, &mask0);
-		/* XXX should we listen on admin socket when dying ?
-		 */
-#if 0
-		FD_SET(lcconf->sock_admin, &maskdying);
-#endif
-		nfds = (nfds > lcconf->sock_admin ? nfds : lcconf->sock_admin);
-	}
-#endif
-	if (lcconf->sock_pfkey >= FD_SETSIZE) {
-		plog(LLV_ERROR, LOCATION, NULL, "fd_set overrun\n");
-		exit(1);
-	}
-	FD_SET(lcconf->sock_pfkey, &mask0);
-	FD_SET(lcconf->sock_pfkey, &maskdying);
-	nfds = (nfds > lcconf->sock_pfkey ? nfds : lcconf->sock_pfkey);
-	if (lcconf->rtsock >= 0) {
-		if (lcconf->rtsock >= FD_SETSIZE) {
-			plog(LLV_ERROR, LOCATION, NULL, "fd_set overrun\n");
-			exit(1);
-		}
-		FD_SET(lcconf->rtsock, &mask0);
-		nfds = (nfds > lcconf->rtsock ? nfds : lcconf->rtsock);
-	}
-
-	for (p = lcconf->myaddrs; p; p = p->next) {
-		if (!p->addr)
-			continue;
-		if (p->sock >= FD_SETSIZE) {
-			plog(LLV_ERROR, LOCATION, NULL, "fd_set overrun\n");
-			exit(1);
-		}
-		FD_SET(p->sock, &mask0);
-		nfds = (nfds > p->sock ? nfds : p->sock);
-	}
-	nfds++;
-}
-
-static int signals[] = {
-	SIGHUP,
-	SIGINT,
-	SIGTERM,
-	SIGUSR1,
-	SIGUSR2,
-	SIGCHLD,
-	0
-};
-
-/*
- * asynchronous requests will actually dispatched in the
- * main loop in session().
- */
-RETSIGTYPE
-signal_handler(sig)
-	int sig;
-{
-	/* Do not just set it to 1, because we may miss some signals by just setting
-	 * values to 0/1
-	 */
-	sigreq[sig]++;
-}
-
-
-/* XXX possible mem leaks and no way to go back for now !!!
- */
-static void reload_conf(){
-	int error;
-
-#ifdef ENABLE_HYBRID
-	if ((isakmp_cfg_init(ISAKMP_CFG_INIT_WARM)) != 0) {
-		plog(LLV_ERROR, LOCATION, NULL, 
-		    "ISAKMP mode config structure reset failed, "
-		    "not reloading\n");
-		return;
-	}
-#endif
-
-	save_sainfotree();
-
-	/* TODO: save / restore / flush old lcconf (?) / rmtree
-	 */
-/*	initlcconf();*/ /* racoon_conf ? ! */
-
-	save_rmconf();
-	initrmconf();
-
-	/* Do a part of pfkey_init() ?
-	 * SPD reload ?
-	 */
-	
-	save_params();
-	error = cfparse();
-	if (error != 0){
-		plog(LLV_ERROR, LOCATION, NULL, "config reload failed\n");
-		/* We are probably in an inconsistant state... */
-		return;
-	}
-	restore_params();
-
-#if 0	
-	if (dump_config)
-		dumprmconf ();
-#endif
-
-	/* 
-	 * init_myaddr() ?
-	 * If running in privilege separation, do not reinitialize
-	 * the IKE listener, as we will not have the right to 
-	 * setsockopt(IP_IPSEC_POLICY). 
-	 */
-	if (geteuid() == 0)
-		check_rtsock(NULL);
-
-	/* Revalidate ph1 / ph2tree !!!
-	 * update ctdtree if removing some ph1 !
-	 */
-	revalidate_ph12();
-	/* Update ctdtree ?
-	 */
-
-	save_sainfotree_flush();
-	save_rmconf_flush();
-}
-
-static void
-check_sigreq()
-{
-	int sig;
-
-	/* 
-	 * XXX We are not able to tell if we got 
-	 * several time the same signal. This is
-	 * not a problem for the current code, 
-	 * but we shall remember this limitation.
-	 */
-	for (sig = 0; sig <= NSIG; sig++) {
-		if (sigreq[sig] == 0)
-			continue;
-
-		sigreq[sig]--;
-		switch(sig) {
-		case 0:
-			return;
-			
-			/* Catch up childs, mainly scripts.
-			 */
-		case SIGCHLD:
-	    {
-			pid_t pid;
-			int s;
-			
-			pid = wait(&s);
-	    }
-		break;
-
-#ifdef DEBUG_RECORD_MALLOCATION
-		/* 
-		 * XXX This operation is signal handler unsafe and may lead to 
-		 * crashes and security breaches: See Henning Brauer talk at
-		 * EuroBSDCon 2005. Do not run in production with this option
-		 * enabled.
-		 */
-		case SIGUSR2:
-			DRM_dump();
-			break;
-#endif
-
-		case SIGHUP:
-			/* Save old configuration, load new one...  */
-			reload_conf();
-			break;
-
-		case SIGINT:
-		case SIGTERM:			
-			plog(LLV_INFO, LOCATION, NULL, 
-			    "caught signal %d\n", sig);
-			EVT_PUSH(NULL, NULL, EVTT_RACOON_QUIT, NULL);
-			pfkey_send_flush(lcconf->sock_pfkey, 
-			    SADB_SATYPE_UNSPEC);
-#ifdef ENABLE_FASTQUIT
-			close_session();
-#else
-			sched_new(1, check_flushsa_stub, NULL);
-#endif
-			dying = 1;
-			break;
-
-		default:
-			plog(LLV_INFO, LOCATION, NULL, 
-			    "caught signal %d\n", sig);
-			break;
-		}
-	}
-}
-
-/*
- * waiting the termination of processing until sending DELETE message
- * for all inbound SA will complete.
- */
-static void
-check_flushsa_stub(p)
-	void *p;
-{
-
-	check_flushsa();
-}
-
-static void
-check_flushsa()
-{
-	vchar_t *buf;
-	struct sadb_msg *msg, *end, *next;
-	struct sadb_sa *sa;
-	caddr_t mhp[SADB_EXT_MAX + 1];
-	int n;
-
-	buf = pfkey_dump_sadb(SADB_SATYPE_UNSPEC);
-	if (buf == NULL) {
-		plog(LLV_DEBUG, LOCATION, NULL,
-		    "pfkey_dump_sadb: returned nothing.\n");
-		return;
-	}
-
-	msg = (struct sadb_msg *)buf->v;
-	end = (struct sadb_msg *)(buf->v + buf->l);
-
-	/* counting SA except of dead one. */
-	n = 0;
-	while (msg < end) {
-		if (PFKEY_UNUNIT64(msg->sadb_msg_len) < sizeof(*msg))
-			break;
-		next = (struct sadb_msg *)((caddr_t)msg + PFKEY_UNUNIT64(msg->sadb_msg_len));
-		if (msg->sadb_msg_type != SADB_DUMP) {
-			msg = next;
-			continue;
-		}
-
-		if (pfkey_align(msg, mhp) || pfkey_check(mhp)) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"pfkey_check (%s)\n", ipsec_strerror());
-			msg = next;
-			continue;
-		}
-
-		sa = (struct sadb_sa *)(mhp[SADB_EXT_SA]);
-		if (!sa) {
-			msg = next;
-			continue;
-		}
-
-		if (sa->sadb_sa_state != SADB_SASTATE_DEAD) {
-			n++;
-			msg = next;
-			continue;
-		}
-
-		msg = next;
-	}
-
-	if (buf != NULL)
-		vfree(buf);
-
-	if (n) {
-		sched_new(1, check_flushsa_stub, NULL);
-		return;
-	}
-
-	close_session();
-}
-
-static void
-init_signal()
-{
-	int i;
-
-	for (i = 0; signals[i] != 0; i++)
-		if (set_signal(signals[i], signal_handler) < 0) {
-			plog(LLV_ERROR, LOCATION, NULL,
-				"failed to set_signal (%s)\n",
-				strerror(errno));
-			exit(1);
-		}
-}
-
-static int
-set_signal(sig, func)
-	int sig;
-	RETSIGTYPE (*func) __P((int));
-{
-	struct sigaction sa;
-
-	memset((caddr_t)&sa, 0, sizeof(sa));
-	sa.sa_handler = func;
-	sa.sa_flags = SA_RESTART;
-
-	if (sigemptyset(&sa.sa_mask) < 0)
-		return -1;
-
-	if (sigaction(sig, &sa, (struct sigaction *)0) < 0)
-		return(-1);
-
-	return 0;
-}
-
-static int
-close_sockets()
-{
-	isakmp_close();
-	pfkey_close(lcconf->sock_pfkey);
-#ifdef ENABLE_ADMINPORT
-	(void)admin_close();
-#endif
-	return 0;
-}
-
diff --git a/src/racoon/session.h b/src/racoon/session.h
deleted file mode 100644
index 58799ee..0000000
--- a/src/racoon/session.h
+++ /dev/null
@@ -1,40 +0,0 @@
-/*	$NetBSD: session.h,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
-
-/* Id: session.h,v 1.3 2004/06/11 16:00:17 ludvigm Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _SESSION_H
-#define _SESSION_H
-
-extern int session __P((void));
-extern RETSIGTYPE signal_handler __P((int));
-
-#endif /* _SESSION_H */
diff --git a/src/racoon/sockmisc.c b/src/racoon/sockmisc.c
deleted file mode 100644
index 4dd7cf1..0000000
--- a/src/racoon/sockmisc.c
+++ /dev/null
@@ -1,1197 +0,0 @@
-/*	$NetBSD: sockmisc.c,v 1.8.6.1 2007/08/01 11:52:22 vanhu Exp $	*/
-
-/* Id: sockmisc.c,v 1.24 2006/05/07 21:32:59 manubsd Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/socket.h>
-#include <sys/uio.h>
-
-#include <netinet/in.h>
-#include PATH_IPSEC_H
-
-#if defined(INET6) && !defined(INET6_ADVAPI) && \
-	defined(IP_RECVDSTADDR) && !defined(IPV6_RECVDSTADDR)
-#define IPV6_RECVDSTADDR IP_RECVDSTADDR
-#endif
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-#ifdef HAVE_UNISTD_H
-#include <unistd.h>
-#endif
-
-#include "var.h"
-#include "misc.h"
-#include "plog.h"
-#include "sockmisc.h"
-#include "debug.h"
-#include "gcmalloc.h"
-#include "debugrm.h"
-#include "libpfkey.h"
-
-#ifdef ANDROID_CHANGES
-#include "NetdClient.h"
-#endif
-
-#ifndef IP_IPSEC_POLICY
-#define IP_IPSEC_POLICY 16	/* XXX: from linux/in.h */
-#endif
-
-#ifndef IPV6_IPSEC_POLICY
-#define IPV6_IPSEC_POLICY 34	/* XXX: from linux/???.h per
-				   "Tom Lendacky" <toml@us.ibm.com> */
-#endif
-
-const int niflags = 0;
-
-/*
- * compare two sockaddr without port number.
- * OUT:	0: equal.
- *	1: not equal.
- */
-int
-cmpsaddrwop(addr1, addr2)
-	const struct sockaddr *addr1;
-	const struct sockaddr *addr2;
-{
-	caddr_t sa1, sa2;
-
-	if (addr1 == 0 && addr2 == 0)
-		return 0;
-	if (addr1 == 0 || addr2 == 0)
-		return 1;
-
-#ifdef __linux__
-	if (addr1->sa_family != addr2->sa_family)
-		return 1;
-#else
-	if (addr1->sa_len != addr2->sa_len
-	 || addr1->sa_family != addr2->sa_family)
-		return 1;
-
-#endif /* __linux__ */
-
-	switch (addr1->sa_family) {
-	case AF_INET:
-		sa1 = (caddr_t)&((struct sockaddr_in *)addr1)->sin_addr;
-		sa2 = (caddr_t)&((struct sockaddr_in *)addr2)->sin_addr;
-		if (memcmp(sa1, sa2, sizeof(struct in_addr)) != 0)
-			return 1;
-		break;
-#ifdef INET6
-	case AF_INET6:
-		sa1 = (caddr_t)&((struct sockaddr_in6 *)addr1)->sin6_addr;
-		sa2 = (caddr_t)&((struct sockaddr_in6 *)addr2)->sin6_addr;
-		if (memcmp(sa1, sa2, sizeof(struct in6_addr)) != 0)
-			return 1;
-		if (((struct sockaddr_in6 *)addr1)->sin6_scope_id !=
-		    ((struct sockaddr_in6 *)addr2)->sin6_scope_id)
-			return 1;
-		break;
-#endif
-	default:
-		return 1;
-	}
-
-	return 0;
-}
-
-/*
- * compare two sockaddr with port, taking care wildcard.
- * addr1 is a subject address, addr2 is in a database entry.
- * OUT:	0: equal.
- *	1: not equal.
- */
-int
-cmpsaddrwild(addr1, addr2)
-	const struct sockaddr *addr1;
-	const struct sockaddr *addr2;
-{
-	caddr_t sa1, sa2;
-	u_short port1, port2;
-
-	if (addr1 == 0 && addr2 == 0)
-		return 0;
-	if (addr1 == 0 || addr2 == 0)
-		return 1;
-
-#ifdef __linux__
-	if (addr1->sa_family != addr2->sa_family)
-		return 1;
-#else
-	if (addr1->sa_len != addr2->sa_len
-	 || addr1->sa_family != addr2->sa_family)
-		return 1;
-
-#endif /* __linux__ */
-
-	switch (addr1->sa_family) {
-	case AF_INET:
-		sa1 = (caddr_t)&((struct sockaddr_in *)addr1)->sin_addr;
-		sa2 = (caddr_t)&((struct sockaddr_in *)addr2)->sin_addr;
-		port1 = ((struct sockaddr_in *)addr1)->sin_port;
-		port2 = ((struct sockaddr_in *)addr2)->sin_port;
-		if (!(port1 == IPSEC_PORT_ANY ||
-		      port2 == IPSEC_PORT_ANY ||
-		      port1 == port2))
-			return 1;
-		if (memcmp(sa1, sa2, sizeof(struct in_addr)) != 0)
-			return 1;
-		break;
-#ifdef INET6
-	case AF_INET6:
-		sa1 = (caddr_t)&((struct sockaddr_in6 *)addr1)->sin6_addr;
-		sa2 = (caddr_t)&((struct sockaddr_in6 *)addr2)->sin6_addr;
-		port1 = ((struct sockaddr_in6 *)addr1)->sin6_port;
-		port2 = ((struct sockaddr_in6 *)addr2)->sin6_port;
-		if (!(port1 == IPSEC_PORT_ANY ||
-		      port2 == IPSEC_PORT_ANY ||
-		      port1 == port2))
-			return 1;
-		if (memcmp(sa1, sa2, sizeof(struct in6_addr)) != 0)
-			return 1;
-		if (((struct sockaddr_in6 *)addr1)->sin6_scope_id !=
-		    ((struct sockaddr_in6 *)addr2)->sin6_scope_id)
-			return 1;
-		break;
-#endif
-	default:
-		return 1;
-	}
-
-	return 0;
-}
-
-/*
- * compare two sockaddr with strict match on port.
- * OUT:	0: equal.
- *	1: not equal.
- */
-int
-cmpsaddrstrict(addr1, addr2)
-	const struct sockaddr *addr1;
-	const struct sockaddr *addr2;
-{
-	caddr_t sa1, sa2;
-	u_short port1, port2;
-
-	if (addr1 == 0 && addr2 == 0)
-		return 0;
-	if (addr1 == 0 || addr2 == 0)
-		return 1;
-
-#ifdef __linux__
-	if (addr1->sa_family != addr2->sa_family)
-		return 1;
-#else
-	if (addr1->sa_len != addr2->sa_len
-	 || addr1->sa_family != addr2->sa_family)
-		return 1;
-
-#endif /* __linux__ */
-
-	switch (addr1->sa_family) {
-	case AF_INET:
-		sa1 = (caddr_t)&((struct sockaddr_in *)addr1)->sin_addr;
-		sa2 = (caddr_t)&((struct sockaddr_in *)addr2)->sin_addr;
-		port1 = ((struct sockaddr_in *)addr1)->sin_port;
-		port2 = ((struct sockaddr_in *)addr2)->sin_port;
-		if (port1 != port2)
-			return 1;
-		if (memcmp(sa1, sa2, sizeof(struct in_addr)) != 0)
-			return 1;
-		break;
-#ifdef INET6
-	case AF_INET6:
-		sa1 = (caddr_t)&((struct sockaddr_in6 *)addr1)->sin6_addr;
-		sa2 = (caddr_t)&((struct sockaddr_in6 *)addr2)->sin6_addr;
-		port1 = ((struct sockaddr_in6 *)addr1)->sin6_port;
-		port2 = ((struct sockaddr_in6 *)addr2)->sin6_port;
-		if (port1 != port2)
-			return 1;
-		if (memcmp(sa1, sa2, sizeof(struct in6_addr)) != 0)
-			return 1;
-		if (((struct sockaddr_in6 *)addr1)->sin6_scope_id !=
-		    ((struct sockaddr_in6 *)addr2)->sin6_scope_id)
-			return 1;
-		break;
-#endif
-	default:
-		return 1;
-	}
-
-	return 0;
-}
-
-#ifdef ANDROID_PATCHED
-
-struct sockaddr *getlocaladdr(struct sockaddr *remote)
-{
-    struct sockaddr_storage local;
-    socklen_t len = sysdep_sa_len(remote);
-    int s = socket(remote->sa_family, SOCK_DGRAM, 0);
-#ifdef ANDROID_CHANGES
-        protectFromVpn(s);
-#endif
-
-    if (s == -1 || connect(s, remote, len) == -1 ||
-        getsockname(s, (struct sockaddr *)&local, &len) == -1) {
-        close(s);
-        return NULL;
-    }
-    close(s);
-    return dupsaddr((struct sockaddr *)&local);
-}
-
-int recvfromto(int s, void *buf, size_t len, int flags, struct sockaddr *from,
-               socklen_t *fromlen, struct sockaddr *to, unsigned int *tolen)
-{
-    if (getsockname(s, to, (socklen_t *)tolen) == -1) {
-        return -1;
-    }
-    return recvfrom(s, buf, len, flags, from, fromlen);
-}
-
-int sendfromto(int s, const void *buf, size_t len, struct sockaddr *from,
-               struct sockaddr *to, int count)
-{
-    int i;
-    for (i = 0; i < count; ++i) {
-        if (sendto(s, buf, len, 0, to, sysdep_sa_len(to)) == -1) {
-            return -1;
-        }
-    }
-    return len;
-}
-
-int setsockopt_bypass(int s, int family)
-{
-    struct sadb_x_policy p = {
-        .sadb_x_policy_len = PFKEY_UNIT64(sizeof(struct sadb_x_policy)),
-        .sadb_x_policy_exttype = SADB_X_EXT_POLICY,
-        .sadb_x_policy_type = IPSEC_POLICY_BYPASS,
-        .sadb_x_policy_dir = IPSEC_DIR_INBOUND,
-#ifdef HAVE_PFKEY_POLICY_PRIORITY
-        .sadb_x_policy_priority = PRIORITY_DEFAULT,
-#endif
-    };
-    int level = (family == AF_INET) ? IPPROTO_IP : IPPROTO_IPV6;
-    int option = (family == AF_INET) ? IP_IPSEC_POLICY : IPV6_IPSEC_POLICY;
-    int len = PFKEY_EXTLEN(&p);
-    if (setsockopt(s, level, option, &p, len) == -1) {
-        plog(LLV_WARNING, LOCATION, NULL, "setsockopt in bypass: %s\n",
-                strerror(errno));
-    }
-    p.sadb_x_policy_dir = IPSEC_DIR_OUTBOUND;
-    if (setsockopt(s, level, option, &p, len) == -1) {
-        plog(LLV_WARNING, LOCATION, NULL, "setsockopt out bypass: %s\n",
-                strerror(errno));
-    }
-    return 0;
-}
-
-#else
-
-/* get local address against the destination. */
-struct sockaddr *
-getlocaladdr(remote)
-	struct sockaddr *remote;
-{
-	struct sockaddr *local;
-	u_int local_len = sizeof(struct sockaddr_storage);
-	int s;	/* for dummy connection */
-
-	/* allocate buffer */
-	if ((local = racoon_calloc(1, local_len)) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to get address buffer.\n");
-		goto err;
-	}
-	
-	/* get real interface received packet */
-	if ((s = socket(remote->sa_family, SOCK_DGRAM, 0)) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"socket (%s)\n", strerror(errno));
-		goto err;
-	}
-#ifdef ANDROID_CHANGES
-	protectFromVpn(s);
-#endif
-
-	setsockopt_bypass(s, remote->sa_family);
-	
-	if (connect(s, remote, sysdep_sa_len(remote)) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"connect (%s)\n", strerror(errno));
-		close(s);
-		goto err;
-	}
-
-	if (getsockname(s, local, &local_len) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"getsockname (%s)\n", strerror(errno));
-		close(s);
-		return NULL;
-	}
-
-	close(s);
-	return local;
-
-    err:
-	if (local != NULL)
-		racoon_free(local);
-	return NULL;
-}
-
-/*
- * Receive packet, with src/dst information.  It is assumed that necessary
- * setsockopt() have already performed on socket.
- */
-int
-recvfromto(s, buf, buflen, flags, from, fromlen, to, tolen)
-	int s;
-	void *buf;
-	size_t buflen;
-	int flags;
-	struct sockaddr *from;
-	socklen_t *fromlen;
-	struct sockaddr *to;
-	u_int *tolen;
-{
-	int otolen;
-	u_int len;
-	struct sockaddr_storage ss;
-	struct msghdr m;
-	struct cmsghdr *cm;
-	struct iovec iov[2];
-	u_char cmsgbuf[256];
-#if defined(INET6) && defined(INET6_ADVAPI)
-	struct in6_pktinfo *pi;
-#endif /*INET6_ADVAPI*/
-	struct sockaddr_in *sin;
-#ifdef INET6
-	struct sockaddr_in6 *sin6;
-#endif
-
-	len = sizeof(ss);
-	if (getsockname(s, (struct sockaddr *)&ss, &len) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"getsockname (%s)\n", strerror(errno));
-		return -1;
-	}
-
-	m.msg_name = (caddr_t)from;
-	m.msg_namelen = *fromlen;
-	iov[0].iov_base = (caddr_t)buf;
-	iov[0].iov_len = buflen;
-	m.msg_iov = iov;
-	m.msg_iovlen = 1;
-	memset(cmsgbuf, 0, sizeof(cmsgbuf));
-	cm = (struct cmsghdr *)cmsgbuf;
-	m.msg_control = (caddr_t)cm;
-	m.msg_controllen = sizeof(cmsgbuf);
-	if ((len = recvmsg(s, &m, flags)) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"recvmsg (%s)\n", strerror(errno));
-		return -1;
-	}
-	*fromlen = m.msg_namelen;
-
-	otolen = *tolen;
-	*tolen = 0;
-	for (cm = (struct cmsghdr *)CMSG_FIRSTHDR(&m);
-	     m.msg_controllen != 0 && cm;
-	     cm = (struct cmsghdr *)CMSG_NXTHDR(&m, cm)) {
-#if 0
-		plog(LLV_ERROR, LOCATION, NULL,
-			"cmsg %d %d\n", cm->cmsg_level, cm->cmsg_type);)
-#endif
-#if defined(INET6) && defined(INET6_ADVAPI)
-		if (ss.ss_family == AF_INET6
-		 && cm->cmsg_level == IPPROTO_IPV6
-		 && cm->cmsg_type == IPV6_PKTINFO
-		 && otolen >= sizeof(*sin6)) {
-			pi = (struct in6_pktinfo *)(CMSG_DATA(cm));
-			*tolen = sizeof(*sin6);
-			sin6 = (struct sockaddr_in6 *)to;
-			memset(sin6, 0, sizeof(*sin6));
-			sin6->sin6_family = AF_INET6;
-#ifndef __linux__
-			sin6->sin6_len = sizeof(*sin6);
-#endif
-			memcpy(&sin6->sin6_addr, &pi->ipi6_addr,
-				sizeof(sin6->sin6_addr));
-			/* XXX other cases, such as site-local? */
-			if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr))
-				sin6->sin6_scope_id = pi->ipi6_ifindex;
-			else
-				sin6->sin6_scope_id = 0;
-			sin6->sin6_port =
-				((struct sockaddr_in6 *)&ss)->sin6_port;
-			otolen = -1;	/* "to" already set */
-			continue;
-		}
-#endif
-#ifdef __linux__
-		if (ss.ss_family == AF_INET
-		 && cm->cmsg_level == IPPROTO_IP
-		 && cm->cmsg_type == IP_PKTINFO
-		 && otolen >= sizeof(sin)) {
-			struct in_pktinfo *pi = (struct in_pktinfo *)(CMSG_DATA(cm));
-			*tolen = sizeof(*sin);
-			sin = (struct sockaddr_in *)to;
-			memset(sin, 0, sizeof(*sin));
-			sin->sin_family = AF_INET;
-			memcpy(&sin->sin_addr, &pi->ipi_addr,
-				sizeof(sin->sin_addr));
-			sin->sin_port =
-				((struct sockaddr_in *)&ss)->sin_port;
-			otolen = -1;	/* "to" already set */
-			continue;
-		}
-#endif
-#if defined(INET6) && defined(IPV6_RECVDSTADDR)
-		if (ss.ss_family == AF_INET6
-		      && cm->cmsg_level == IPPROTO_IPV6
-		      && cm->cmsg_type == IPV6_RECVDSTADDR
-		      && otolen >= sizeof(*sin6)) {
-			*tolen = sizeof(*sin6);
-			sin6 = (struct sockaddr_in6 *)to;
-			memset(sin6, 0, sizeof(*sin6));
-			sin6->sin6_family = AF_INET6;
-			sin6->sin6_len = sizeof(*sin6);
-			memcpy(&sin6->sin6_addr, CMSG_DATA(cm),
-				sizeof(sin6->sin6_addr));
-			sin6->sin6_port =
-				((struct sockaddr_in6 *)&ss)->sin6_port;
-			otolen = -1;	/* "to" already set */
-			continue;
-		}
-#endif
-#ifndef __linux__
-		if (ss.ss_family == AF_INET
-		 && cm->cmsg_level == IPPROTO_IP
-		 && cm->cmsg_type == IP_RECVDSTADDR
-		 && otolen >= sizeof(*sin)) {
-			*tolen = sizeof(*sin);
-			sin = (struct sockaddr_in *)to;
-			memset(sin, 0, sizeof(*sin));
-			sin->sin_family = AF_INET;
-			sin->sin_len = sizeof(*sin);
-			memcpy(&sin->sin_addr, CMSG_DATA(cm),
-				sizeof(sin->sin_addr));
-			sin->sin_port = ((struct sockaddr_in *)&ss)->sin_port;
-			otolen = -1;	/* "to" already set */
-			continue;
-		}
-#endif
-	}
-
-	return len;
-}
-
-/* send packet, with fixing src/dst address pair. */
-int
-sendfromto(s, buf, buflen, src, dst, cnt)
-	int s, cnt;
-	const void *buf;
-	size_t buflen;
-	struct sockaddr *src;
-	struct sockaddr *dst;
-{
-	struct sockaddr_storage ss;
-	u_int len;
-	int i;
-
-	if (src->sa_family != dst->sa_family) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"address family mismatch\n");
-		return -1;
-	}
-
-	len = sizeof(ss);
-	if (getsockname(s, (struct sockaddr *)&ss, &len) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"getsockname (%s)\n", strerror(errno));
-		return -1;
-	}
-
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"sockname %s\n", saddr2str((struct sockaddr *)&ss));
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"send packet from %s\n", saddr2str(src));
-	plog(LLV_DEBUG, LOCATION, NULL,
-		"send packet to %s\n", saddr2str(dst));
-
-	if (src->sa_family != ss.ss_family) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"address family mismatch\n");
-		return -1;
-	}
-
-	switch (src->sa_family) {
-#if defined(INET6) && defined(INET6_ADVAPI)
-// XXX: This block wasn't compiled on Linux - does it work?
-	case AF_INET6:
-	    {
-		struct msghdr m;
-		struct cmsghdr *cm;
-		struct iovec iov[2];
-		u_char cmsgbuf[256];
-		struct in6_pktinfo *pi;
-		int ifindex;
-		struct sockaddr_in6 src6, dst6;
-
-		memcpy(&src6, src, sizeof(src6));
-		memcpy(&dst6, dst, sizeof(dst6));
-
-		/* XXX take care of other cases, such as site-local */
-		ifindex = 0;
-		if (IN6_IS_ADDR_LINKLOCAL(&src6.sin6_addr)
-		 || IN6_IS_ADDR_MULTICAST(&src6.sin6_addr)) {
-			ifindex = src6.sin6_scope_id;	/*???*/
-		}
-
-		/* XXX some sanity check on dst6.sin6_scope_id */
-
-		/* flowinfo for IKE?  mmm, maybe useful but for now make it 0 */
-		src6.sin6_flowinfo = dst6.sin6_flowinfo = 0;
-
-		memset(&m, 0, sizeof(m));
-		m.msg_name = (caddr_t)&dst6;
-		m.msg_namelen = sizeof(dst6);
-		iov[0].iov_base = (char *)buf;
-		iov[0].iov_len = buflen;
-		m.msg_iov = iov;
-		m.msg_iovlen = 1;
-
-		memset(cmsgbuf, 0, sizeof(cmsgbuf));
-		cm = (struct cmsghdr *)cmsgbuf;
-		m.msg_control = (caddr_t)cm;
-		m.msg_controllen = CMSG_SPACE(sizeof(struct in6_pktinfo));
-
-		cm->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo));
-		cm->cmsg_level = IPPROTO_IPV6;
-		cm->cmsg_type = IPV6_PKTINFO;
-		pi = (struct in6_pktinfo *)CMSG_DATA(cm);
-		memcpy(&pi->ipi6_addr, &src6.sin6_addr, sizeof(src6.sin6_addr));
-		pi->ipi6_ifindex = ifindex;
-
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"src6 %s %d\n",
-			saddr2str((struct sockaddr *)&src6),
-			src6.sin6_scope_id);
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"dst6 %s %d\n",
-			saddr2str((struct sockaddr *)&dst6),
-			dst6.sin6_scope_id);
-
-		for (i = 0; i < cnt; i++) {
-			len = sendmsg(s, &m, 0 /*MSG_DONTROUTE*/);
-			if (len < 0) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"sendmsg (%s)\n", strerror(errno));
-				return -1;
-			}
-			plog(LLV_DEBUG, LOCATION, NULL,
-				"%d times of %d bytes message will be sent "
-				"to %s\n",
-				i + 1, len, saddr2str(dst));
-		}
-		plogdump(LLV_DEBUG, (char *)buf, buflen);
-
-		return len;
-	    }
-#endif
-#ifdef __linux__
-	case AF_INET:
-	    {
-		struct msghdr m;
-		struct cmsghdr *cm;
-		struct iovec iov[2];
-		u_char cmsgbuf[256];
-		struct in_pktinfo *pi;
-		int ifindex = 0;
-		struct sockaddr_in src6, dst6;
-
-		memcpy(&src6, src, sizeof(src6));
-		memcpy(&dst6, dst, sizeof(dst6));
-
-		memset(&m, 0, sizeof(m));
-		m.msg_name = (caddr_t)&dst6;
-		m.msg_namelen = sizeof(dst6);
-		iov[0].iov_base = (char *)buf;
-		iov[0].iov_len = buflen;
-		m.msg_iov = iov;
-		m.msg_iovlen = 1;
-
-		memset(cmsgbuf, 0, sizeof(cmsgbuf));
-		cm = (struct cmsghdr *)cmsgbuf;
-		m.msg_control = (caddr_t)cm;
-		m.msg_controllen = CMSG_SPACE(sizeof(struct in_pktinfo));
-
-		cm->cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo));
-		cm->cmsg_level = IPPROTO_IP;
-		cm->cmsg_type = IP_PKTINFO;
-		pi = (struct in_pktinfo *)CMSG_DATA(cm);
-		memcpy(&pi->ipi_spec_dst, &src6.sin_addr, sizeof(src6.sin_addr));
-		pi->ipi_ifindex = ifindex;
-
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"src4 %s\n",
-			saddr2str((struct sockaddr *)&src6));
-		plog(LLV_DEBUG, LOCATION, NULL,
-			"dst4 %s\n",
-			saddr2str((struct sockaddr *)&dst6));
-
-		for (i = 0; i < cnt; i++) {
-			len = sendmsg(s, &m, 0 /*MSG_DONTROUTE*/);
-			if (len < 0) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"sendmsg (%s)\n", strerror(errno));
-				return -1;
-			}
-			plog(LLV_DEBUG, LOCATION, NULL,
-				"%d times of %d bytes message will be sent "
-				"to %s\n",
-				i + 1, len, saddr2str(dst));
-		}
-		plogdump(LLV_DEBUG, (char *)buf, buflen);
-
-		return len;
-	    }
-#endif /* __linux__ */
-	default:
-	    {
-		int needclose = 0;
-		int sendsock;
-
-		if (ss.ss_family == src->sa_family && memcmp(&ss, src, sysdep_sa_len(src)) == 0) {
-			sendsock = s;
-			needclose = 0;
-		} else {
-			int yes = 1;
-			/*
-			 * Use newly opened socket for sending packets.
-			 * NOTE: this is unsafe, because if the peer is quick enough
-			 * the packet from the peer may be queued into sendsock.
-			 * Better approach is to prepare bind'ed udp sockets for
-			 * each of the interface addresses.
-			 */
-			sendsock = socket(src->sa_family, SOCK_DGRAM, 0);
-			if (sendsock < 0) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"socket (%s)\n", strerror(errno));
-				return -1;
-			}
-#ifdef ANDROID_CHANGES
-			protectFromVpn(sendsock);
-#endif
-
-			if (setsockopt(sendsock, SOL_SOCKET,
-#ifdef __linux__
-				       SO_REUSEADDR,
-#else
-				       SO_REUSEPORT,
-#endif
-				       (void *)&yes, sizeof(yes)) < 0) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"setsockopt SO_REUSEPORT (%s)\n", 
-					strerror(errno));
-				close(sendsock);
-				return -1;
-			}
-#ifdef IPV6_USE_MIN_MTU
-			if (src->sa_family == AF_INET6 &&
-			    setsockopt(sendsock, IPPROTO_IPV6, IPV6_USE_MIN_MTU,
-			    (void *)&yes, sizeof(yes)) < 0) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"setsockopt IPV6_USE_MIN_MTU (%s)\n", 
-					strerror(errno));
-				close(sendsock);
-				return -1;
-			}
-#endif
-			if (setsockopt_bypass(sendsock, src->sa_family) < 0) {
-				close(sendsock);
-				return -1;
-			}
-
-			if (bind(sendsock, (struct sockaddr *)src, sysdep_sa_len(src)) < 0) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"bind 1 (%s)\n", strerror(errno));
-				close(sendsock);
-				return -1;
-			}
-			needclose = 1;
-		}
-
-		for (i = 0; i < cnt; i++) {
-			len = sendto(sendsock, buf, buflen, 0, dst, sysdep_sa_len(dst));
-			if (len < 0) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"sendto (%s)\n", strerror(errno));
-				if (needclose)
-					close(sendsock);
-				return len;
-			}
-			plog(LLV_DEBUG, LOCATION, NULL,
-				"%d times of %d bytes message will be sent "
-				"to %s\n",
-				i + 1, len, saddr2str(dst));
-		}
-		plogdump(LLV_DEBUG, (char *)buf, buflen);
-
-		if (needclose)
-			close(sendsock);
-
-		return len;
-	    }
-	}
-}
-
-int
-setsockopt_bypass(so, family)
-	int so, family;
-{
-	int level;
-	char *buf;
-	char *policy;
-
-	switch (family) {
-	case AF_INET:
-		level = IPPROTO_IP;
-		break;
-#ifdef INET6
-	case AF_INET6:
-		level = IPPROTO_IPV6;
-		break;
-#endif
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"unsupported address family %d\n", family);
-		return -1;
-	}
-
-	policy = "in bypass";
-	buf = ipsec_set_policy(policy, strlen(policy));
-	if (buf == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"ipsec_set_policy (%s)\n",
-			ipsec_strerror());
-		return -1;
-	}
-	if (setsockopt(so, level,
-	               (level == IPPROTO_IP ?
-	                         IP_IPSEC_POLICY : IPV6_IPSEC_POLICY),
-	               buf, ipsec_get_policylen(buf)) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"setsockopt IP_IPSEC_POLICY (%s)\n",
-			strerror(errno));
-		return -1;
-	}
-	racoon_free(buf);
-
-	policy = "out bypass";
-	buf = ipsec_set_policy(policy, strlen(policy));
-	if (buf == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"ipsec_set_policy (%s)\n",
-			ipsec_strerror());
-		return -1;
-	}
-	if (setsockopt(so, level,
-	               (level == IPPROTO_IP ?
-	                         IP_IPSEC_POLICY : IPV6_IPSEC_POLICY),
-	               buf, ipsec_get_policylen(buf)) < 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"setsockopt IP_IPSEC_POLICY (%s)\n",
-			strerror(errno));
-		return -1;
-	}
-	racoon_free(buf);
-
-	return 0;
-}
-
-struct sockaddr *
-newsaddr(len)
-	int len;
-{
-	struct sockaddr *new;
-
-	if ((new = racoon_calloc(1, len)) == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"%s\n", strerror(errno)); 
-		goto out;
-	}
-
-#ifdef __linux__
-	if (len == sizeof (struct sockaddr_in6))
-		new->sa_family = AF_INET6;
-	else
-		new->sa_family = AF_INET;
-#else
-	/* initial */
-	new->sa_len = len;
-#endif
-out:
-	return new;
-}
-
-#endif
-
-struct sockaddr *
-dupsaddr(src)
-	struct sockaddr *src;
-{
-	struct sockaddr *dst;
-
-	dst = racoon_calloc(1, sysdep_sa_len(src));
-	if (dst == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"%s\n", strerror(errno)); 
-		return NULL;
-	}
-
-	memcpy(dst, src, sysdep_sa_len(src));
-
-	return dst;
-}
-
-char *
-saddr2str(saddr)
-	const struct sockaddr *saddr;
-{
-	static char buf[NI_MAXHOST + NI_MAXSERV + 10];
-	char addr[NI_MAXHOST], port[NI_MAXSERV];
-
-	if (saddr == NULL)
-		return NULL;
-
-	if (saddr->sa_family == AF_UNSPEC)
-		snprintf (buf, sizeof(buf), "%s", "anonymous");
-	else {
-		GETNAMEINFO(saddr, addr, port);
-		snprintf(buf, sizeof(buf), "%s[%s]", addr, port);
-	}
-
-	return buf;
-}
-
-char *
-saddrwop2str(saddr)
-	const struct sockaddr *saddr;
-{
-	static char buf[NI_MAXHOST + NI_MAXSERV + 10];
-	char addr[NI_MAXHOST];
-
-	if (saddr == NULL)
-		return NULL;
-
-	GETNAMEINFO_NULL(saddr, addr);
-	snprintf(buf, sizeof(buf), "%s", addr);
-
-	return buf;
-}
-
-char *
-naddrwop2str(const struct netaddr *naddr)
-{
-	static char buf[NI_MAXHOST + 10];
-	static const struct sockaddr sa_any;	/* this is initialized to all zeros */
-	
-	if (naddr == NULL)
-		return NULL;
-
-	if (memcmp(&naddr->sa, &sa_any, sizeof(sa_any)) == 0)
-		snprintf(buf, sizeof(buf), "%s", "any");
-	else {
-		snprintf(buf, sizeof(buf), "%s", saddrwop2str(&naddr->sa.sa));
-		snprintf(&buf[strlen(buf)], sizeof(buf) - strlen(buf), "/%ld", naddr->prefix);
-	}
-	return buf;
-}
-
-char *
-naddrwop2str_fromto(const char *format, const struct netaddr *saddr,
-		    const struct netaddr *daddr)
-{
-	static char buf[2*(NI_MAXHOST + NI_MAXSERV + 10) + 100];
-	char *src, *dst;
-
-	src = racoon_strdup(naddrwop2str(saddr));
-	dst = racoon_strdup(naddrwop2str(daddr));
-	STRDUP_FATAL(src);
-	STRDUP_FATAL(dst);
-	/* WARNING: Be careful about the format string! Don't 
-	   ever pass in something that a user can modify!!! */
-	snprintf (buf, sizeof(buf), format, src, dst);
-	racoon_free (src);
-	racoon_free (dst);
-
-	return buf;
-}
-
-char *
-saddr2str_fromto(format, saddr, daddr)
-	const char *format;
-	const struct sockaddr *saddr;
-	const struct sockaddr *daddr;
-{
-	static char buf[2*(NI_MAXHOST + NI_MAXSERV + 10) + 100];
-	char *src, *dst;
-
-	src = racoon_strdup(saddr2str(saddr));
-	dst = racoon_strdup(saddr2str(daddr));
-	STRDUP_FATAL(src);
-	STRDUP_FATAL(dst);
-	/* WARNING: Be careful about the format string! Don't 
-	   ever pass in something that a user can modify!!! */
-	snprintf (buf, sizeof(buf), format, src, dst);
-	racoon_free (src);
-	racoon_free (dst);
-
-	return buf;
-}
-
-struct sockaddr *
-str2saddr(host, port)
-	char *host;
-	char *port;
-{
-	struct addrinfo hints, *res;
-	struct sockaddr *saddr;
-	int error;
-
-	memset(&hints, 0, sizeof(hints));
-	hints.ai_family = PF_UNSPEC;
-	hints.ai_socktype = SOCK_DGRAM;
-	hints.ai_flags = AI_NUMERICHOST;
-	error = getaddrinfo(host, port, &hints, &res);
-	if (error != 0) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"getaddrinfo(%s%s%s): %s\n",
-			host, port ? "," : "", port ? port : "",
-			gai_strerror(error));
-		return NULL;
-	}
-	if (res->ai_next != NULL) {
-		plog(LLV_WARNING, LOCATION, NULL,
-			"getaddrinfo(%s%s%s): "
-			"resolved to multiple address, "
-			"taking the first one\n",
-			host, port ? "," : "", port ? port : "");
-	}
-	saddr = racoon_malloc(res->ai_addrlen);
-	if (saddr == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"failed to allocate buffer.\n");
-		freeaddrinfo(res);
-		return NULL;
-	}
-	memcpy(saddr, res->ai_addr, res->ai_addrlen);
-	freeaddrinfo(res);
-
-	return saddr;
-}
-
-void
-mask_sockaddr(a, b, l)
-	struct sockaddr *a;
-	const struct sockaddr *b;
-	size_t l;
-{
-	size_t i;
-	u_int8_t *p, alen;
-
-	switch (b->sa_family) {
-	case AF_INET:
-		alen = sizeof(struct in_addr);
-		p = (u_int8_t *)&((struct sockaddr_in *)a)->sin_addr;
-		break;
-#ifdef INET6
-	case AF_INET6:
-		alen = sizeof(struct in6_addr);
-		p = (u_int8_t *)&((struct sockaddr_in6 *)a)->sin6_addr;
-		break;
-#endif
-	default:
-		plog(LLV_ERROR, LOCATION, NULL,
-			"invalid family: %d\n", b->sa_family);
-		exit(1);
-	}
-
-	if ((alen << 3) < l) {
-		plog(LLV_ERROR, LOCATION, NULL,
-			"unexpected inconsistency: %d %zu\n", b->sa_family, l);
-		exit(1);
-	}
-
-	memcpy(a, b, sysdep_sa_len(b));
-	p[l / 8] &= (0xff00 >> (l % 8)) & 0xff;
-	for (i = l / 8 + 1; i < alen; i++)
-		p[i] = 0x00;
-}
-
-/* Compute a score describing how "accurate" a netaddr is for a given sockaddr.
- * Examples:
- * 	Return values for address 10.20.30.40 [port 500] and given netaddresses...
- * 		10.10.0.0/16	=> -1	... doesn't match
- * 		0.0.0.0/0	=> 0	... matches, but only 0 bits.
- * 		10.20.0.0/16	=> 16	... 16 bits match
- * 		10.20.30.0/24	=> 24	... guess what ;-)
- * 		10.20.30.40/32	=> 32	... whole address match
- * 		10.20.30.40:500	=> 33	... both address and port match
- * 		10.20.30.40:501	=> -1	... port doesn't match and isn't 0 (=any)
- */
-int
-naddr_score(const struct netaddr *naddr, const struct sockaddr *saddr)
-{
-	static const struct netaddr naddr_any;	/* initialized to all-zeros */
-	struct sockaddr sa;
-	u_int16_t naddr_port, saddr_port;
-	int port_score;
-
-	if (!naddr || !saddr) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		     "Call with null args: naddr=%p, saddr=%p\n",
-		     naddr, saddr);
-		return -1;
-	}
-
-	/* Wildcard address matches, but only 0 bits. */
-	if (memcmp(naddr, &naddr_any, sizeof(naddr_any)) == 0)
-		return 0;
-
-	/* If families don't match we really can't do much... */
-	if (naddr->sa.sa.sa_family != saddr->sa_family)
-		return -1;
-	
-	/* If port check fail don't bother to check addresses. */
-	naddr_port = extract_port(&naddr->sa.sa);
-	saddr_port = extract_port(saddr);
-	if (naddr_port == 0 || saddr_port == 0)	/* wildcard match */
-		port_score = 0;
-	else if (naddr_port == saddr_port)	/* exact match */
-		port_score = 1;
-	else					/* mismatch :-) */
-		return -1;
-
-	/* Here it comes - compare network addresses. */
-	mask_sockaddr(&sa, saddr, naddr->prefix);
-	if (loglevel >= LLV_DEBUG) {	/* debug only */
-		char *a1, *a2, *a3;
-		a1 = racoon_strdup(naddrwop2str(naddr));
-		a2 = racoon_strdup(saddrwop2str(saddr));
-		a3 = racoon_strdup(saddrwop2str(&sa));
-		STRDUP_FATAL(a1);
-		STRDUP_FATAL(a2);
-		STRDUP_FATAL(a3);
-		plog(LLV_DEBUG, LOCATION, NULL,
-		     "naddr=%s, saddr=%s (masked=%s)\n",
-		     a1, a2, a3);
-		free(a1);
-		free(a2);
-		free(a3);
-	}
-	if (cmpsaddrwop(&sa, &naddr->sa.sa) == 0)
-		return naddr->prefix + port_score;
-
-	return -1;
-}
-
-/* Some usefull functions for sockaddr port manipulations. */
-u_int16_t
-extract_port (const struct sockaddr *addr)
-{
-  u_int16_t port = 0;
-  
-  if (!addr)
-    return port;
-
-  switch (addr->sa_family) {
-    case AF_INET:
-      port = ((struct sockaddr_in *)addr)->sin_port;
-      break;
-    case AF_INET6:
-      port = ((struct sockaddr_in6 *)addr)->sin6_port;
-      break;
-    default:
-      plog(LLV_ERROR, LOCATION, NULL, "unknown AF: %u\n", addr->sa_family);
-      break;
-  }
-
-  return ntohs(port);
-}
-
-u_int16_t *
-get_port_ptr (struct sockaddr *addr)
-{
-  u_int16_t *port_ptr;
-
-  if (!addr)
-    return NULL;
-
-  switch (addr->sa_family) {
-    case AF_INET:
-      port_ptr = &(((struct sockaddr_in *)addr)->sin_port);
-      break;
-    case AF_INET6:
-      port_ptr = &(((struct sockaddr_in6 *)addr)->sin6_port);
-      break;
-    default:
-      plog(LLV_ERROR, LOCATION, NULL, "unknown AF: %u\n", addr->sa_family);
-      return NULL;
-      break;
-  }
-
-  return port_ptr;
-}
-
-u_int16_t *
-set_port (struct sockaddr *addr, u_int16_t new_port)
-{
-  u_int16_t *port_ptr;
-
-  port_ptr = get_port_ptr (addr);
-
-  if (port_ptr)
-    *port_ptr = htons(new_port);
-
-  return port_ptr;
-}
diff --git a/src/racoon/sockmisc.h b/src/racoon/sockmisc.h
deleted file mode 100644
index a035dec..0000000
--- a/src/racoon/sockmisc.h
+++ /dev/null
@@ -1,89 +0,0 @@
-/*	$NetBSD: sockmisc.h,v 1.7 2006/09/09 16:22:10 manu Exp $	*/
-
-/* Id: sockmisc.h,v 1.9 2005/10/05 16:55:41 manubsd Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _SOCKMISC_H
-#define _SOCKMISC_H
-
-struct netaddr {
-	union {
-		struct sockaddr sa;
-		struct sockaddr_in sin;
-		struct sockaddr_in6 sin6;
-	} sa;
-	unsigned long prefix;
-};
-
-extern const int niflags;
-
-extern int cmpsaddrwop __P((const struct sockaddr *, const struct sockaddr *));
-extern int cmpsaddrwild __P((const struct sockaddr *, const struct sockaddr *));
-extern int cmpsaddrstrict __P((const struct sockaddr *, const struct sockaddr *));
-
-#ifdef ENABLE_NATT 
-#define CMPSADDR(saddr1, saddr2) cmpsaddrstrict((saddr1), (saddr2))
-#else 
-#define CMPSADDR(saddr1, saddr2) cmpsaddrwop((saddr1), (saddr2))
-#endif
-
-extern struct sockaddr *getlocaladdr __P((struct sockaddr *));
-
-extern int recvfromto __P((int, void *, size_t, int,
-	struct sockaddr *, socklen_t *, struct sockaddr *, unsigned int *));
-extern int sendfromto __P((int, const void *, size_t,
-	struct sockaddr *, struct sockaddr *, int));
-
-extern int setsockopt_bypass __P((int, int));
-
-extern struct sockaddr *newsaddr __P((int));
-extern struct sockaddr *dupsaddr __P((struct sockaddr *));
-extern char *saddr2str __P((const struct sockaddr *));
-extern char *saddrwop2str __P((const struct sockaddr *));
-extern char *saddr2str_fromto __P((const char *format, 
-				   const struct sockaddr *saddr, 
-				   const struct sockaddr *daddr));
-extern struct sockaddr *str2saddr __P((char *, char *));
-extern void mask_sockaddr __P((struct sockaddr *, const struct sockaddr *,
-	size_t));
-
-/* struct netaddr functions */
-extern char *naddrwop2str __P((const struct netaddr *naddr));
-extern char *naddrwop2str_fromto __P((const char *format, const struct netaddr *saddr,
-				      const struct netaddr *daddr));
-extern int naddr_score(const struct netaddr *naddr, const struct sockaddr *saddr);
-
-/* Some usefull functions for sockaddr port manipulations. */
-extern u_int16_t extract_port __P((const struct sockaddr *addr));
-extern u_int16_t *set_port __P((struct sockaddr *addr, u_int16_t new_port));
-extern u_int16_t *get_port_ptr __P((struct sockaddr *addr));
-
-#endif /* _SOCKMISC_H */
diff --git a/src/racoon/stats.pl b/src/racoon/stats.pl
deleted file mode 100644
index f509512..0000000
--- a/src/racoon/stats.pl
+++ /dev/null
@@ -1,15 +0,0 @@
-#!/usr/bin/perl
-# usage:
-# % cat /var/log/racoon-stats.log | perl stats.pl
-
-while(<STDIN>) {
-	chomp;
-	($a, $a, $a, $a, $a, $b) = split(/\s+/, $_, 6);
-	($a, $c) = split(/:/, $b, 2);
-	$r{$a} += $c;
-	$t{$a}++;
-}
-
-foreach (sort keys %t) {
-	printf "%s: total=%d avg=%8.6f\n", $_, $t{$_}, $r{$_}/$t{$_};
-}
diff --git a/src/racoon/str2val.c b/src/racoon/str2val.c
deleted file mode 100644
index 62d38a6..0000000
--- a/src/racoon/str2val.c
+++ /dev/null
@@ -1,126 +0,0 @@
-/*	$NetBSD: str2val.c,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
-
-/*	$KAME: str2val.c,v 1.11 2001/08/16 14:37:29 itojun Exp $	*/
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-#include <ctype.h>
-
-#include <stdlib.h>
-#include <stdio.h>
-
-#include "str2val.h"
-#include "gcmalloc.h"
-
-/*
- * exchange a value to a hex string.
- * must free buffer allocated later.
- */
-caddr_t
-val2str(buf, mlen)
-	const char *buf;
-	size_t mlen;
-{
-	caddr_t new;
-	size_t len = (mlen * 2) + mlen / 8 + 10;
-	size_t i, j;
-
-	if ((new = racoon_malloc(len)) == 0) return(0);
-
-	for (i = 0, j = 0; i < mlen; i++) {
-		snprintf(&new[j], len - j, "%02x", (u_char)buf[i]);
-		j += 2;
-		if (i % 8 == 7) {
-			new[j++] = ' ';
-			new[j] = '\0';
-		}
-	}
-	new[j] = '\0';
-
-	return(new);
-}
-
-/*
- * exchange a string based "base" to a value.
- */
-char *
-str2val(str, base, len)
-	const char *str;
-	int base;
-	size_t *len;
-{
-	int f;
-	size_t i;
-	char *dst;
-	char *rp;
-	const char *p;
-	char b[3];
-
-	i = 0;
-	for (p = str; *p != '\0'; p++) {
-		if (isxdigit((int)*p))
-			i++;
-		else if (isspace((int)*p))
-			;
-		else
-			return NULL;
-	}
-	if (i == 0 || (i % 2) != 0)
-		return NULL;
-	i /= 2;
-
-	if ((dst = racoon_malloc(i)) == NULL)
-		return NULL;
-
-	i = 0;
-	f = 0;
-	for (rp = dst, p = str; *p != '\0'; p++) {
-		if (isxdigit((int)*p)) {
-			if (!f) {
-				b[0] = *p;
-				f = 1;
-			} else {
-				b[1] = *p;
-				b[2] = '\0';
-				*rp++ = (char)strtol(b, NULL, base);
-				i++;
-				f = 0;
-			}
-		}
-	}
-
-	*len = i;
-
-	return(dst);
-}
diff --git a/src/racoon/str2val.h b/src/racoon/str2val.h
deleted file mode 100644
index 4a7cec1..0000000
--- a/src/racoon/str2val.h
+++ /dev/null
@@ -1,40 +0,0 @@
-/*	$NetBSD: str2val.h,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
-
-/* Id: str2val.h,v 1.3 2004/06/11 16:00:17 ludvigm Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _STR2VAL_H
-#define _STR2VAL_H
-
-extern caddr_t val2str __P((const char *, size_t));
-extern char *str2val __P((const char *, int, size_t *));
-
-#endif /* _STR2VAL_H */
diff --git a/src/racoon/strnames.c b/src/racoon/strnames.c
deleted file mode 100644
index fa5df0f..0000000
--- a/src/racoon/strnames.c
+++ /dev/null
@@ -1,1034 +0,0 @@
-/*	$NetBSD: strnames.c,v 1.7.6.1 2007/08/01 11:52:22 vanhu Exp $	*/
-
-/*	$KAME: strnames.c,v 1.25 2003/11/13 10:53:26 itojun Exp $	*/
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-#include <sys/socket.h>
-
-#include <netinet/in.h> 
-#include PATH_IPSEC_H
-#include <netinet/in.h>
-
-#include <stdio.h>
-#include <stdlib.h>
-#ifdef ENABLE_HYBRID
-#include <resolv.h>
-#endif
-
-#include "var.h"
-#include "misc.h"
-#include "vmbuf.h"
-#include "plog.h"
-
-#include "isakmp_var.h"
-#include "isakmp.h"
-#ifdef ENABLE_HYBRID
-#  include "isakmp_xauth.h"
-#  include "isakmp_unity.h"
-#  include "isakmp_cfg.h"
-#endif
-#include "ipsec_doi.h"
-#include "oakley.h"
-#include "handler.h"
-#include "pfkey.h"
-#include "strnames.h"
-#include "algorithm.h"
-
-struct ksmap {
-	int key;
-	char *str;
-	char *(*f) __P((int));
-};
-
-char *
-num2str(n)
-	int n;
-{
-	static char buf[20];
-
-	snprintf(buf, sizeof(buf), "%d", n);
-
-	return buf;
-}
-
-/* isakmp.h */
-char *
-s_isakmp_state(t, d, s)
-	int t, d, s;
-{
-	switch (t) {
-	case ISAKMP_ETYPE_AGG:
-		switch (d) {
-		case INITIATOR:
-			switch (s) {
-			case PHASE1ST_MSG1SENT:
-				return "agg I msg1";
-			case PHASE1ST_ESTABLISHED:
-				return "agg I msg2";
-			default:
-				break;
-			}
-		case RESPONDER:
-			switch (s) {
-			case PHASE1ST_MSG1SENT:
-				return "agg R msg1";
-			default:
-				break;
-			}
-		}
-		break;
-	case ISAKMP_ETYPE_BASE:
-		switch (d) {
-		case INITIATOR:
-			switch (s) {
-			case PHASE1ST_MSG1SENT:
-				return "base I msg1";
-			case PHASE1ST_MSG2SENT:
-				return "base I msg2";
-			default:
-				break;
-			}
-		case RESPONDER:
-			switch (s) {
-			case PHASE1ST_MSG1SENT:
-				return "base R msg1";
-			case PHASE1ST_ESTABLISHED:
-				return "base R msg2";
-			default:
-				break;
-			}
-		}
-		break;
-	case ISAKMP_ETYPE_IDENT:
-		switch (d) {
-		case INITIATOR:
-			switch (s) {
-			case PHASE1ST_MSG1SENT:
-				return "ident I msg1";
-			case PHASE1ST_MSG2SENT:
-				return "ident I msg2";
-			case PHASE1ST_MSG3SENT:
-				return "ident I msg3";
-			default:
-				break;
-			}
-		case RESPONDER:
-			switch (s) {
-			case PHASE1ST_MSG1SENT:
-				return "ident R msg1";
-			case PHASE1ST_MSG2SENT:
-				return "ident R msg2";
-			case PHASE1ST_ESTABLISHED:
-				return "ident R msg3";
-			default:
-				break;
-			}
-		}
-		break;
-	case ISAKMP_ETYPE_QUICK:
-		switch (d) {
-		case INITIATOR:
-			switch (s) {
-			case PHASE2ST_MSG1SENT:
-				return "quick I msg1";
-			case PHASE2ST_ADDSA:
-				return "quick I msg2";
-			default:
-				break;
-			}
-		case RESPONDER:
-			switch (s) {
-			case PHASE2ST_MSG1SENT:
-				return "quick R msg1";
-			case PHASE2ST_COMMIT:
-				return "quick R msg2";
-			default:
-				break;
-			}
-		}
-		break;
-	default:
-	case ISAKMP_ETYPE_NONE:
-	case ISAKMP_ETYPE_AUTH:
-	case ISAKMP_ETYPE_INFO:
-	case ISAKMP_ETYPE_NEWGRP:
-	case ISAKMP_ETYPE_ACKINFO:
-		break;
-	}
-	/*NOTREACHED*/
-
-	return "???";
-}
-
-static struct ksmap name_isakmp_certtype[] = {
-{ ISAKMP_CERT_NONE,	"NONE",					NULL },
-{ ISAKMP_CERT_PKCS7,	"PKCS #7 wrapped X.509 certificate",	NULL },
-{ ISAKMP_CERT_PGP,	"PGP Certificate",			NULL },
-{ ISAKMP_CERT_DNS,	"DNS Signed Key",			NULL },
-{ ISAKMP_CERT_X509SIGN,	"X.509 Certificate Signature",		NULL },
-{ ISAKMP_CERT_X509KE,	"X.509 Certificate Key Exchange",	NULL },
-{ ISAKMP_CERT_KERBEROS,	"Kerberos Tokens",			NULL },
-{ ISAKMP_CERT_CRL,	"Certificate Revocation List (CRL)",	NULL },
-{ ISAKMP_CERT_ARL,	"Authority Revocation List (ARL)",	NULL },
-{ ISAKMP_CERT_SPKI,	"SPKI Certificate",			NULL },
-{ ISAKMP_CERT_X509ATTR,	"X.509 Certificate Attribute",		NULL },
-};
-
-char *
-s_isakmp_certtype(k)
-	int k;
-{
-	int i;
-	for (i = 0; i < ARRAYLEN(name_isakmp_certtype); i++)
-		if (name_isakmp_certtype[i].key == k)
-			return name_isakmp_certtype[i].str;
-	return num2str(k);
-}
-
-static struct ksmap name_isakmp_etype[] = {
-{ ISAKMP_ETYPE_NONE,	"None",			NULL },
-{ ISAKMP_ETYPE_BASE,	"Base",			NULL },
-{ ISAKMP_ETYPE_IDENT,	"Identity Protection",	NULL },
-{ ISAKMP_ETYPE_AUTH,	"Authentication Only",	NULL },
-{ ISAKMP_ETYPE_AGG,	"Aggressive",		NULL },
-{ ISAKMP_ETYPE_INFO,	"Informational",	NULL },
-{ ISAKMP_ETYPE_CFG,	"Mode config",		NULL },
-{ ISAKMP_ETYPE_QUICK,	"Quick",		NULL },
-{ ISAKMP_ETYPE_NEWGRP,	"New Group",		NULL },
-{ ISAKMP_ETYPE_ACKINFO,	"Acknowledged Informational",	NULL },
-};
-
-char *
-s_isakmp_etype(k)
-	int k;
-{
-	int i;
-	for (i = 0; i < ARRAYLEN(name_isakmp_etype); i++)
-		if (name_isakmp_etype[i].key == k)
-			return name_isakmp_etype[i].str;
-	return num2str(k);
-}
-
-static struct ksmap name_isakmp_notify_msg[] = {
-{ ISAKMP_NTYPE_INVALID_PAYLOAD_TYPE,	"INVALID-PAYLOAD-TYPE",		NULL },
-{ ISAKMP_NTYPE_DOI_NOT_SUPPORTED,	"DOI-NOT-SUPPORTED",		NULL },
-{ ISAKMP_NTYPE_SITUATION_NOT_SUPPORTED,	"SITUATION-NOT-SUPPORTED",	NULL },
-{ ISAKMP_NTYPE_INVALID_COOKIE,		"INVALID-COOKIE",		NULL },
-{ ISAKMP_NTYPE_INVALID_MAJOR_VERSION,	"INVALID-MAJOR-VERSION",	NULL },
-{ ISAKMP_NTYPE_INVALID_MINOR_VERSION,	"INVALID-MINOR-VERSION",	NULL },
-{ ISAKMP_NTYPE_INVALID_EXCHANGE_TYPE,	"INVALID-EXCHANGE-TYPE",	NULL },
-{ ISAKMP_NTYPE_INVALID_FLAGS,		"INVALID-FLAGS",		NULL },
-{ ISAKMP_NTYPE_INVALID_MESSAGE_ID,	"INVALID-MESSAGE-ID",		NULL },
-{ ISAKMP_NTYPE_INVALID_PROTOCOL_ID,	"INVALID-PROTOCOL-ID",		NULL },
-{ ISAKMP_NTYPE_INVALID_SPI,		"INVALID-SPI",			NULL },
-{ ISAKMP_NTYPE_INVALID_TRANSFORM_ID,	"INVALID-TRANSFORM-ID",		NULL },
-{ ISAKMP_NTYPE_ATTRIBUTES_NOT_SUPPORTED, "ATTRIBUTES-NOT-SUPPORTED",	NULL },
-{ ISAKMP_NTYPE_NO_PROPOSAL_CHOSEN,	"NO-PROPOSAL-CHOSEN",		NULL },
-{ ISAKMP_NTYPE_BAD_PROPOSAL_SYNTAX,	"BAD-PROPOSAL-SYNTAX",		NULL },
-{ ISAKMP_NTYPE_PAYLOAD_MALFORMED,	"PAYLOAD-MALFORMED",		NULL },
-{ ISAKMP_NTYPE_INVALID_KEY_INFORMATION,	"INVALID-KEY-INFORMATION",	NULL },
-{ ISAKMP_NTYPE_INVALID_ID_INFORMATION,	"INVALID-ID-INFORMATION",	NULL },
-{ ISAKMP_NTYPE_INVALID_CERT_ENCODING,	"INVALID-CERT-ENCODING",	NULL },
-{ ISAKMP_NTYPE_INVALID_CERTIFICATE,	"INVALID-CERTIFICATE",		NULL },
-{ ISAKMP_NTYPE_BAD_CERT_REQUEST_SYNTAX,	"BAD-CERT-REQUEST-SYNTAX",	NULL },
-{ ISAKMP_NTYPE_INVALID_CERT_AUTHORITY,	"INVALID-CERT-AUTHORITY",	NULL },
-{ ISAKMP_NTYPE_INVALID_HASH_INFORMATION, "INVALID-HASH-INFORMATION",	NULL },
-{ ISAKMP_NTYPE_AUTHENTICATION_FAILED,	"AUTHENTICATION-FAILED",	NULL },
-{ ISAKMP_NTYPE_INVALID_SIGNATURE,	"INVALID-SIGNATURE",		NULL },
-{ ISAKMP_NTYPE_ADDRESS_NOTIFICATION,	"ADDRESS-NOTIFICATION",		NULL },
-{ ISAKMP_NTYPE_NOTIFY_SA_LIFETIME,	"NOTIFY-SA-LIFETIME",		NULL },
-{ ISAKMP_NTYPE_CERTIFICATE_UNAVAILABLE,	"CERTIFICATE-UNAVAILABLE",	NULL },
-{ ISAKMP_NTYPE_UNSUPPORTED_EXCHANGE_TYPE, "UNSUPPORTED-EXCHANGE-TYPE",	NULL },
-{ ISAKMP_NTYPE_UNEQUAL_PAYLOAD_LENGTHS,	"UNEQUAL-PAYLOAD-LENGTHS",	NULL },
-{ ISAKMP_NTYPE_CONNECTED,		"CONNECTED",			NULL },
-{ ISAKMP_NTYPE_RESPONDER_LIFETIME,	"RESPONDER-LIFETIME",		NULL },
-{ ISAKMP_NTYPE_REPLAY_STATUS,		"REPLAY-STATUS",		NULL },
-{ ISAKMP_NTYPE_INITIAL_CONTACT,		"INITIAL-CONTACT",		NULL },
-#ifdef ENABLE_HYBRID
-{ ISAKMP_NTYPE_UNITY_HEARTBEAT,		"HEARTBEAT (Unity)",		NULL },
-#endif
-{ ISAKMP_LOG_RETRY_LIMIT_REACHED,	"RETRY-LIMIT-REACHED",		NULL },
-};
-
-char *
-s_isakmp_notify_msg(k)
-	int k;
-{
-	int i;
-	for (i = 0; i < ARRAYLEN(name_isakmp_notify_msg); i++)
-		if (name_isakmp_notify_msg[i].key == k)
-			return name_isakmp_notify_msg[i].str;
-
-	return num2str(k);
-}
-
-static struct ksmap name_isakmp_nptype[] = {
-{ ISAKMP_NPTYPE_NONE,		"none",		NULL },
-{ ISAKMP_NPTYPE_SA,		"sa",		NULL },
-{ ISAKMP_NPTYPE_P,		"prop",		NULL },
-{ ISAKMP_NPTYPE_T,		"trns",		NULL },
-{ ISAKMP_NPTYPE_KE,		"ke",		NULL },
-{ ISAKMP_NPTYPE_ID,		"id",		NULL },
-{ ISAKMP_NPTYPE_CERT,		"cert",		NULL },
-{ ISAKMP_NPTYPE_CR,		"cr",		NULL },
-{ ISAKMP_NPTYPE_HASH,		"hash",		NULL },
-{ ISAKMP_NPTYPE_SIG,		"sig",		NULL },
-{ ISAKMP_NPTYPE_NONCE,		"nonce",	NULL },
-{ ISAKMP_NPTYPE_N,		"notify",	NULL },
-{ ISAKMP_NPTYPE_D,		"delete",	NULL },
-{ ISAKMP_NPTYPE_VID,		"vid",		NULL },
-{ ISAKMP_NPTYPE_ATTR,		"attr",		NULL },
-{ ISAKMP_NPTYPE_GSS,		"gss id",	NULL },
-{ ISAKMP_NPTYPE_NATD_RFC,	"nat-d",	NULL },
-{ ISAKMP_NPTYPE_NATOA_RFC,	"nat-oa",	NULL },
-{ ISAKMP_NPTYPE_NATD_DRAFT,	"nat-d",	NULL },
-{ ISAKMP_NPTYPE_NATOA_DRAFT,	"nat-oa",	NULL },
-{ ISAKMP_NPTYPE_FRAG,		"ike frag",	NULL },
-};
-
-char *
-s_isakmp_nptype(k)
-	int k;
-{
-	int i;
-	for (i = 0; i < ARRAYLEN(name_isakmp_nptype); i++)
-		if (name_isakmp_nptype[i].key == k)
-			return name_isakmp_nptype[i].str;
-	return num2str(k);
-}
-
-#ifdef ENABLE_HYBRID
-/* isakmp_cfg.h / isakmp_unity.h / isakmp_xauth.h */
-static struct ksmap name_isakmp_cfg_type[] = {
-{ INTERNAL_IP4_ADDRESS,		"INTERNAL_IP4_ADDRESS",		NULL },
-{ INTERNAL_IP4_NETMASK,		"INTERNAL_IP4_NETMASK",		NULL },
-{ INTERNAL_IP4_DNS,		"INTERNAL_IP4_DNS",		NULL },
-{ INTERNAL_IP4_NBNS,		"INTERNAL_IP4_NBNS",		NULL },
-{ INTERNAL_ADDRESS_EXPIRY,	"INTERNAL_ADDRESS_EXPIRY",	NULL },
-{ INTERNAL_IP4_DHCP,		"INTERNAL_IP4_DHCP",		NULL },
-{ APPLICATION_VERSION,		"APPLICATION_VERSION",		NULL },
-{ INTERNAL_IP6_ADDRESS,		"INTERNAL_IP6_ADDRESS",		NULL },
-{ INTERNAL_IP6_NETMASK,		"INTERNAL_IP6_NETMASK",		NULL },
-{ INTERNAL_IP6_DNS,		"INTERNAL_IP6_DNS",		NULL },
-{ INTERNAL_IP6_NBNS,		"INTERNAL_IP6_NBNS",		NULL },
-{ INTERNAL_IP6_DHCP,		"INTERNAL_IP6_DHCP",		NULL },
-{ INTERNAL_IP4_SUBNET,		"INTERNAL_IP4_SUBNET",		NULL },
-{ SUPPORTED_ATTRIBUTES,		"SUPPORTED_ATTRIBUTES",		NULL },
-{ INTERNAL_IP6_SUBNET,		"INTERNAL_IP6_SUBNET",		NULL },
-{ XAUTH_TYPE,			"XAUTH_TYPE",			NULL },
-{ XAUTH_USER_NAME,		"XAUTH_USER_NAME",		NULL },
-{ XAUTH_USER_PASSWORD,		"XAUTH_USER_PASSWORD",		NULL },
-{ XAUTH_PASSCODE,		"XAUTH_PASSCODE",		NULL },
-{ XAUTH_MESSAGE,		"XAUTH_MESSAGE",		NULL },
-{ XAUTH_CHALLENGE,		"XAUTH_CHALLENGE",		NULL },
-{ XAUTH_DOMAIN,			"XAUTH_DOMAIN",			NULL },
-{ XAUTH_STATUS,			"XAUTH_STATUS",			NULL },
-{ XAUTH_NEXT_PIN,		"XAUTH_NEXT_PIN",		NULL },
-{ XAUTH_ANSWER,			"XAUTH_ANSWER",			NULL },
-{ UNITY_BANNER,			"UNITY_BANNER",			NULL },
-{ UNITY_SAVE_PASSWD,		"UNITY_SAVE_PASSWD",		NULL },
-{ UNITY_DEF_DOMAIN,		"UNITY_DEF_DOMAIN",		NULL },
-{ UNITY_SPLITDNS_NAME,		"UNITY_SPLITDNS_NAME",		NULL },
-{ UNITY_SPLIT_INCLUDE,		"UNITY_SPLIT_INCLUDE",		NULL },
-{ UNITY_NATT_PORT,		"UNITY_NATT_PORT",		NULL },
-{ UNITY_LOCAL_LAN,		"UNITY_LOCAL_LAN",		NULL },
-{ UNITY_PFS,			"UNITY_PFS",			NULL },
-{ UNITY_FW_TYPE,		"UNITY_FW_TYPE",		NULL },
-{ UNITY_BACKUP_SERVERS,		"UNITY_BACKUP_SERVERS",		NULL },
-{ UNITY_DDNS_HOSTNAME,		"UNITY_DDNS_HOSTNAME",		NULL },
-};
-
-char *
-s_isakmp_cfg_type(k)
-	int k;
-{
-	int i;
-	for (i = 0; i < ARRAYLEN(name_isakmp_cfg_type); i++)
-		if (name_isakmp_cfg_type[i].key == k)
-			return name_isakmp_cfg_type[i].str;
-	return num2str(k);
-}
-
-/* isakmp_cfg.h / isakmp_unity.h / isakmp_xauth.h */
-static struct ksmap name_isakmp_cfg_ptype[] = {
-{ ISAKMP_CFG_ACK,		"mode config ACK",		NULL },
-{ ISAKMP_CFG_SET,		"mode config SET",		NULL },
-{ ISAKMP_CFG_REQUEST,		"mode config REQUEST",		NULL },
-{ ISAKMP_CFG_REPLY,		"mode config REPLY",		NULL },
-};
-
-char *
-s_isakmp_cfg_ptype(k)
-	int k;
-{
-	int i;
-	for (i = 0; i < ARRAYLEN(name_isakmp_cfg_ptype); i++)
-		if (name_isakmp_cfg_ptype[i].key == k)
-			return name_isakmp_cfg_ptype[i].str;
-	return num2str(k);
-}
-
-#endif
-
-/* ipsec_doi.h */
-static struct ksmap name_ipsecdoi_proto[] = {
-{ IPSECDOI_PROTO_ISAKMP,	"ISAKMP",	s_ipsecdoi_trns_isakmp },
-{ IPSECDOI_PROTO_IPSEC_AH,	"AH",		s_ipsecdoi_trns_ah },
-{ IPSECDOI_PROTO_IPSEC_ESP,	"ESP",		s_ipsecdoi_trns_esp },
-{ IPSECDOI_PROTO_IPCOMP,	"IPCOMP",	s_ipsecdoi_trns_ipcomp },
-};
-
-char *
-s_ipsecdoi_proto(k)
-	int k;
-{
-	int i;
-	for (i = 0; i < ARRAYLEN(name_ipsecdoi_proto); i++)
-		if (name_ipsecdoi_proto[i].key == k)
-			return name_ipsecdoi_proto[i].str;
-	return num2str(k);
-}
-
-static struct ksmap name_ipsecdoi_trns_isakmp[] = {
-{ IPSECDOI_KEY_IKE,	"IKE", NULL },
-};
-
-char *
-s_ipsecdoi_trns_isakmp(k)
-	int k;
-{
-	int i;
-	for (i = 0; i < ARRAYLEN(name_ipsecdoi_trns_isakmp); i++)
-		if (name_ipsecdoi_trns_isakmp[i].key == k)
-			return name_ipsecdoi_trns_isakmp[i].str;
-	return num2str(k);
-}
-
-static struct ksmap name_ipsecdoi_trns_ah[] = {
-{ IPSECDOI_AH_MD5,	"MD5", NULL },
-{ IPSECDOI_AH_SHA,	"SHA", NULL },
-{ IPSECDOI_AH_DES,	"DES", NULL },
-{ IPSECDOI_AH_SHA256,	"SHA256", NULL },
-{ IPSECDOI_AH_SHA384,	"SHA384", NULL },
-{ IPSECDOI_AH_SHA512,	"SHA512", NULL },
-};
-
-char *
-s_ipsecdoi_trns_ah(k)
-	int k;
-{
-	int i;
-	for (i = 0; i < ARRAYLEN(name_ipsecdoi_trns_ah); i++)
-		if (name_ipsecdoi_trns_ah[i].key == k)
-			return name_ipsecdoi_trns_ah[i].str;
-	return num2str(k);
-}
-
-static struct ksmap name_ipsecdoi_trns_esp[] = {
-{ IPSECDOI_ESP_DES_IV64,	"DES_IV64",	NULL },
-{ IPSECDOI_ESP_DES,		"DES",		NULL },
-{ IPSECDOI_ESP_3DES,		"3DES",		NULL },
-{ IPSECDOI_ESP_RC5,		"RC5",		NULL },
-{ IPSECDOI_ESP_IDEA,		"IDEA",		NULL },
-{ IPSECDOI_ESP_CAST,		"CAST",		NULL },
-{ IPSECDOI_ESP_BLOWFISH,	"BLOWFISH",	NULL },
-{ IPSECDOI_ESP_3IDEA,		"3IDEA",	NULL },
-{ IPSECDOI_ESP_DES_IV32,	"DES_IV32",	NULL },
-{ IPSECDOI_ESP_RC4,		"RC4",		NULL },
-{ IPSECDOI_ESP_NULL,		"NULL",		NULL },
-{ IPSECDOI_ESP_AES,		"AES",		NULL },
-{ IPSECDOI_ESP_TWOFISH,		"TWOFISH",	NULL },
-{ IPSECDOI_ESP_CAMELLIA,	"CAMELLIA",	NULL },
-};
-
-char *
-s_ipsecdoi_trns_esp(k)
-	int k;
-{
-	int i;
-	for (i = 0; i < ARRAYLEN(name_ipsecdoi_trns_esp); i++)
-		if (name_ipsecdoi_trns_esp[i].key == k)
-			return name_ipsecdoi_trns_esp[i].str;
-	return num2str(k);
-}
-
-static struct ksmap name_ipsecdoi_trns_ipcomp[] = {
-{ IPSECDOI_IPCOMP_OUI,		"OUI",		NULL},
-{ IPSECDOI_IPCOMP_DEFLATE,	"DEFLATE",	NULL},
-{ IPSECDOI_IPCOMP_LZS,		"LZS",		NULL},
-};
-
-char *
-s_ipsecdoi_trns_ipcomp(k)
-	int k;
-{
-	int i;
-	for (i = 0; i < ARRAYLEN(name_ipsecdoi_trns_ipcomp); i++)
-		if (name_ipsecdoi_trns_ipcomp[i].key == k)
-			return name_ipsecdoi_trns_ipcomp[i].str;
-	return num2str(k);
-}
-
-char *
-s_ipsecdoi_trns(proto, trns)
-	int proto, trns;
-{
-	int i;
-	for (i = 0; i < ARRAYLEN(name_ipsecdoi_proto); i++)
-		if (name_ipsecdoi_proto[i].key == proto
-		 && name_ipsecdoi_proto[i].f)
-			return (name_ipsecdoi_proto[i].f)(trns);
-	return num2str(trns);
-}
-
-static struct ksmap name_attr_ipsec[] = {
-{ IPSECDOI_ATTR_SA_LD_TYPE,	"SA Life Type",		s_ipsecdoi_ltype },
-{ IPSECDOI_ATTR_SA_LD,		"SA Life Duration",	NULL },
-{ IPSECDOI_ATTR_GRP_DESC,	"Group Description",	NULL },
-{ IPSECDOI_ATTR_ENC_MODE,	"Encryption Mode",	s_ipsecdoi_encmode },
-{ IPSECDOI_ATTR_AUTH,		"Authentication Algorithm", s_ipsecdoi_auth },
-{ IPSECDOI_ATTR_KEY_LENGTH,	"Key Length",		NULL },
-{ IPSECDOI_ATTR_KEY_ROUNDS,	"Key Rounds",		NULL },
-{ IPSECDOI_ATTR_COMP_DICT_SIZE,	"Compression Dictionary Size",	NULL },
-{ IPSECDOI_ATTR_COMP_PRIVALG,	"Compression Private Algorithm", NULL },
-};
-
-char *
-s_ipsecdoi_attr(k)
-	int k;
-{
-	int i;
-	for (i = 0; i < ARRAYLEN(name_attr_ipsec); i++)
-		if (name_attr_ipsec[i].key == k)
-			return name_attr_ipsec[i].str;
-	return num2str(k);
-}
-
-static struct ksmap name_attr_ipsec_ltype[] = {
-{ IPSECDOI_ATTR_SA_LD_TYPE_SEC,	"seconds",	NULL },
-{ IPSECDOI_ATTR_SA_LD_TYPE_KB,	"kilobytes",	NULL },
-};
-
-char *
-s_ipsecdoi_ltype(k)
-	int k;
-{
-	int i;
-	for (i = 0; i < ARRAYLEN(name_attr_ipsec_ltype); i++)
-		if (name_attr_ipsec_ltype[i].key == k)
-			return name_attr_ipsec_ltype[i].str;
-	return num2str(k);
-}
-
-static struct ksmap name_attr_ipsec_encmode[] = {
-{ IPSECDOI_ATTR_ENC_MODE_ANY,		"Any",		NULL },
-{ IPSECDOI_ATTR_ENC_MODE_TUNNEL,	"Tunnel",	NULL },
-{ IPSECDOI_ATTR_ENC_MODE_TRNS,		"Transport",	NULL },
-{ IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_RFC,	"UDP-Tunnel",	NULL },
-{ IPSECDOI_ATTR_ENC_MODE_UDPTRNS_RFC,	"UDP-Transport",	NULL },
-{ IPSECDOI_ATTR_ENC_MODE_UDPTUNNEL_DRAFT,	"UDP-Tunnel",	NULL },
-{ IPSECDOI_ATTR_ENC_MODE_UDPTRNS_DRAFT,	"UDP-Transport",	NULL },
-};
-
-char *
-s_ipsecdoi_encmode(k)
-	int k;
-{
-	int i;
-	for (i = 0; i < ARRAYLEN(name_attr_ipsec_encmode); i++)
-		if (name_attr_ipsec_encmode[i].key == k)
-			return name_attr_ipsec_encmode[i].str;
-	return num2str(k);
-}
-
-static struct ksmap name_attr_ipsec_auth[] = {
-{ IPSECDOI_ATTR_AUTH_HMAC_MD5,		"hmac-md5",	NULL },
-{ IPSECDOI_ATTR_AUTH_HMAC_SHA1,		"hmac-sha",	NULL },
-{ IPSECDOI_ATTR_AUTH_HMAC_SHA2_256,	"hmac-sha256",	NULL },
-{ IPSECDOI_ATTR_AUTH_HMAC_SHA2_384,	"hmac-sha384",	NULL },
-{ IPSECDOI_ATTR_AUTH_HMAC_SHA2_512,	"hmac-sha512",	NULL },
-{ IPSECDOI_ATTR_AUTH_DES_MAC,		"des-mac",	NULL },
-{ IPSECDOI_ATTR_AUTH_KPDK,		"kpdk",		NULL },
-};
-
-char *
-s_ipsecdoi_auth(k)
-	int k;
-{
-	int i;
-	for (i = 0; i < ARRAYLEN(name_attr_ipsec_auth); i++)
-		if (name_attr_ipsec_auth[i].key == k)
-			return name_attr_ipsec_auth[i].str;
-	return num2str(k);
-}
-
-char *
-s_ipsecdoi_attr_v(type, val)
-	int type, val;
-{
-	int i;
-	for (i = 0; i < ARRAYLEN(name_attr_ipsec); i++)
-		if (name_attr_ipsec[i].key == type
-		 && name_attr_ipsec[i].f)
-			return (name_attr_ipsec[i].f)(val);
-	return num2str(val);
-}
-
-static struct ksmap name_ipsecdoi_ident[] = {
-{ IPSECDOI_ID_IPV4_ADDR,	"IPv4_address",	NULL },
-{ IPSECDOI_ID_FQDN,		"FQDN",		NULL },
-{ IPSECDOI_ID_USER_FQDN,	"User_FQDN",	NULL },
-{ IPSECDOI_ID_IPV4_ADDR_SUBNET,	"IPv4_subnet",	NULL },
-{ IPSECDOI_ID_IPV6_ADDR,	"IPv6_address",	NULL },
-{ IPSECDOI_ID_IPV6_ADDR_SUBNET,	"IPv6_subnet",	NULL },
-{ IPSECDOI_ID_IPV4_ADDR_RANGE,	"IPv4_address_range",	NULL },
-{ IPSECDOI_ID_IPV6_ADDR_RANGE,	"IPv6_address_range",	NULL },
-{ IPSECDOI_ID_DER_ASN1_DN,	"DER_ASN1_DN",	NULL },
-{ IPSECDOI_ID_DER_ASN1_GN,	"DER_ASN1_GN",	NULL },
-{ IPSECDOI_ID_KEY_ID,		"KEY_ID",	NULL },
-};
-
-char *
-s_ipsecdoi_ident(k)
-	int k;
-{
-	int i;
-	for (i = 0; i < ARRAYLEN(name_ipsecdoi_ident); i++)
-		if (name_ipsecdoi_ident[i].key == k)
-			return name_ipsecdoi_ident[i].str;
-	return num2str(k);
-}
-
-/* oakley.h */
-static struct ksmap name_oakley_attr[] = {
-{ OAKLEY_ATTR_ENC_ALG,		"Encryption Algorithm",	s_attr_isakmp_enc },
-{ OAKLEY_ATTR_HASH_ALG,		"Hash Algorithm",	s_attr_isakmp_hash },
-{ OAKLEY_ATTR_AUTH_METHOD,	"Authentication Method", s_oakley_attr_method },
-{ OAKLEY_ATTR_GRP_DESC,		"Group Description",	s_attr_isakmp_desc },
-{ OAKLEY_ATTR_GRP_TYPE,		"Group Type",		s_attr_isakmp_group },
-{ OAKLEY_ATTR_GRP_PI,		"Group Prime/Irreducible Polynomial",	NULL },
-{ OAKLEY_ATTR_GRP_GEN_ONE,	"Group Generator One",	NULL },
-{ OAKLEY_ATTR_GRP_GEN_TWO,	"Group Generator Two",	NULL },
-{ OAKLEY_ATTR_GRP_CURVE_A,	"Group Curve A",	NULL },
-{ OAKLEY_ATTR_GRP_CURVE_B,	"Group Curve B",	NULL },
-{ OAKLEY_ATTR_SA_LD_TYPE,	"Life Type",		s_attr_isakmp_ltype },
-{ OAKLEY_ATTR_SA_LD,		"Life Duration",	NULL },
-{ OAKLEY_ATTR_PRF,		"PRF",			NULL },
-{ OAKLEY_ATTR_KEY_LEN,		"Key Length",		NULL },
-{ OAKLEY_ATTR_FIELD_SIZE,	"Field Size",		NULL },
-{ OAKLEY_ATTR_GRP_ORDER,	"Group Order",		NULL },
-{ OAKLEY_ATTR_BLOCK_SIZE,	"Block Size",		NULL },
-{ OAKLEY_ATTR_GSS_ID,		"GSS-API endpoint name",NULL },
-};
-
-char *
-s_oakley_attr(k)
-	int k;
-{
-	int i;
-	for (i = 0; i < ARRAYLEN(name_oakley_attr); i++)
-		if (name_oakley_attr[i].key == k)
-			return name_oakley_attr[i].str;
-	return num2str(k);
-}
-
-static struct ksmap name_attr_isakmp_enc[] = {
-{ OAKLEY_ATTR_ENC_ALG_DES,	"DES-CBC",		NULL },
-{ OAKLEY_ATTR_ENC_ALG_IDEA,	"IDEA-CBC",		NULL },
-{ OAKLEY_ATTR_ENC_ALG_BLOWFISH,	"Blowfish-CBC",		NULL },
-{ OAKLEY_ATTR_ENC_ALG_RC5,	"RC5-R16-B64-CBC",	NULL },
-{ OAKLEY_ATTR_ENC_ALG_3DES,	"3DES-CBC",		NULL },
-{ OAKLEY_ATTR_ENC_ALG_CAST,	"CAST-CBC",		NULL },
-{ OAKLEY_ATTR_ENC_ALG_AES,	"AES-CBC",		NULL },
-};
-
-char *
-s_attr_isakmp_enc(k)
-	int k;
-{
-	int i;
-	for (i = 0; i < ARRAYLEN(name_attr_isakmp_enc); i++)
-		if (name_attr_isakmp_enc[i].key == k)
-			return name_attr_isakmp_enc[i].str;
-	return num2str(k);
-}
-
-static struct ksmap name_attr_isakmp_hash[] = {
-{ OAKLEY_ATTR_HASH_ALG_MD5,	"MD5",		NULL },
-{ OAKLEY_ATTR_HASH_ALG_SHA,	"SHA",		NULL },
-{ OAKLEY_ATTR_HASH_ALG_TIGER,	"Tiger",	NULL },
-{ OAKLEY_ATTR_HASH_ALG_SHA2_256,"SHA256",	NULL },
-{ OAKLEY_ATTR_HASH_ALG_SHA2_384,"SHA384",	NULL },
-{ OAKLEY_ATTR_HASH_ALG_SHA2_512,"SHA512",	NULL },
-};
-
-char *
-s_attr_isakmp_hash(k)
-	int k;
-{
-	int i;
-	for (i = 0; i < ARRAYLEN(name_attr_isakmp_hash); i++)
-		if (name_attr_isakmp_hash[i].key == k)
-			return name_attr_isakmp_hash[i].str;
-	return num2str(k);
-}
-
-static struct ksmap name_attr_isakmp_method[] = {
-{ OAKLEY_ATTR_AUTH_METHOD_PSKEY,		"pre-shared key",	NULL },
-{ OAKLEY_ATTR_AUTH_METHOD_DSSSIG,		"DSS signatures",	NULL },
-{ OAKLEY_ATTR_AUTH_METHOD_RSASIG,		"RSA signatures",	NULL },
-{ OAKLEY_ATTR_AUTH_METHOD_RSAENC,		"Encryption with RSA",	NULL },
-{ OAKLEY_ATTR_AUTH_METHOD_RSAREV,		"Revised encryption with RSA",	NULL },
-{ OAKLEY_ATTR_AUTH_METHOD_EGENC,		"Encryption with El-Gamal",	NULL },
-{ OAKLEY_ATTR_AUTH_METHOD_EGREV,		"Revised encryption with El-Gamal",	NULL },
-#ifdef HAVE_GSSAPI
-{ OAKLEY_ATTR_AUTH_METHOD_GSSAPI_KRB,		"GSS-API on Kerberos 5", NULL },
-#endif
-#ifdef ENABLE_HYBRID
-{ OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_R,		"Hybrid DSS server",	NULL },
-{ OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_R,		"Hybrid RSA server",	NULL },
-{ OAKLEY_ATTR_AUTH_METHOD_HYBRID_DSS_I,		"Hybrid DSS client",	NULL },
-{ OAKLEY_ATTR_AUTH_METHOD_HYBRID_RSA_I,		"Hybrid RSA client",	NULL },
-{ OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_I,	"XAuth pskey client",	NULL },
-{ OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R,	"XAuth pskey server",	NULL },
-{ OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_I,	"XAuth RSASIG client",	NULL },
-{ OAKLEY_ATTR_AUTH_METHOD_XAUTH_RSASIG_R,	"XAuth RSASIG server",	NULL },
-#endif
-};
-
-char *
-s_oakley_attr_method(k)
-	int k;
-{
-	int i;
-	for (i = 0; i < ARRAYLEN(name_attr_isakmp_method); i++)
-		if (name_attr_isakmp_method[i].key == k)
-			return name_attr_isakmp_method[i].str;
-	return num2str(k);
-}
-
-static struct ksmap name_attr_isakmp_desc[] = {
-{ OAKLEY_ATTR_GRP_DESC_MODP768,		"768-bit MODP group",	NULL },
-{ OAKLEY_ATTR_GRP_DESC_MODP1024,	"1024-bit MODP group",	NULL },
-{ OAKLEY_ATTR_GRP_DESC_EC2N155,		"EC2N group on GP[2^155]",	NULL },
-{ OAKLEY_ATTR_GRP_DESC_EC2N185,		"EC2N group on GP[2^185]",	NULL },
-{ OAKLEY_ATTR_GRP_DESC_MODP1536,	"1536-bit MODP group",	NULL },
-{ OAKLEY_ATTR_GRP_DESC_MODP2048,	"2048-bit MODP group",	NULL },
-{ OAKLEY_ATTR_GRP_DESC_MODP3072,	"3072-bit MODP group",	NULL },
-{ OAKLEY_ATTR_GRP_DESC_MODP4096,	"4096-bit MODP group",	NULL },
-{ OAKLEY_ATTR_GRP_DESC_MODP6144,	"6144-bit MODP group",	NULL },
-{ OAKLEY_ATTR_GRP_DESC_MODP8192,	"8192-bit MODP group",	NULL },
-};
-
-char *
-s_attr_isakmp_desc(k)
-	int k;
-{
-	int i;
-	for (i = 0; i < ARRAYLEN(name_attr_isakmp_desc); i++)
-		if (name_attr_isakmp_desc[i].key == k)
-			return name_attr_isakmp_desc[i].str;
-	return num2str(k);
-}
-
-static struct ksmap name_attr_isakmp_group[] = {
-{ OAKLEY_ATTR_GRP_TYPE_MODP,	"MODP",	NULL },
-{ OAKLEY_ATTR_GRP_TYPE_ECP,	"ECP",	NULL },
-{ OAKLEY_ATTR_GRP_TYPE_EC2N,	"EC2N",	NULL },
-};
-
-char *
-s_attr_isakmp_group(k)
-	int k;
-{
-	int i;
-	for (i = 0; i < ARRAYLEN(name_attr_isakmp_group); i++)
-		if (name_attr_isakmp_group[i].key == k)
-			return name_attr_isakmp_group[i].str;
-	return num2str(k);
-}
-
-static struct ksmap name_attr_isakmp_ltype[] = {
-{ OAKLEY_ATTR_SA_LD_TYPE_SEC,	"seconds",	NULL },
-{ OAKLEY_ATTR_SA_LD_TYPE_KB,	"kilobytes",	NULL },
-};
-
-char *
-s_attr_isakmp_ltype(k)
-	int k;
-{
-	int i;
-	for (i = 0; i < ARRAYLEN(name_attr_isakmp_ltype); i++)
-		if (name_attr_isakmp_ltype[i].key == k)
-			return name_attr_isakmp_ltype[i].str;
-	return num2str(k);
-}
-
-char *
-s_oakley_attr_v(type, val)
-	int type, val;
-{
-	int i;
-	for (i = 0; i < ARRAYLEN(name_oakley_attr); i++)
-		if (name_oakley_attr[i].key == type
-		 && name_oakley_attr[i].f)
-			return (name_oakley_attr[i].f)(val);
-	return num2str(val);
-}
-
-/* netinet6/ipsec.h */
-static struct ksmap name_ipsec_level[] = {
-{ IPSEC_LEVEL_USE,	"use",		NULL },
-{ IPSEC_LEVEL_REQUIRE,	"require",	NULL },
-{ IPSEC_LEVEL_UNIQUE,	"unique",	NULL },
-};
-
-char *
-s_ipsec_level(k)
-	int k;
-{
-	int i;
-	for (i = 0; i < ARRAYLEN(name_ipsec_level); i++)
-		if (name_ipsec_level[i].key == k)
-			return name_ipsec_level[i].str;
-	return num2str(k);
-}
-
-static struct ksmap name_algclass[] = {
-{ algclass_ipsec_enc,	"ipsec enc",	s_ipsecdoi_trns_esp },
-{ algclass_ipsec_auth,	"ipsec auth",	s_ipsecdoi_trns_ah },
-{ algclass_ipsec_comp,	"ipsec comp",	s_ipsecdoi_trns_ipcomp },
-{ algclass_isakmp_enc,	"isakmp enc",	s_attr_isakmp_enc },
-{ algclass_isakmp_hash,	"isakmp hash",	s_attr_isakmp_hash },
-{ algclass_isakmp_dh,	"isakmp dh",	s_attr_isakmp_desc },
-{ algclass_isakmp_ameth, "isakmp auth method",	s_oakley_attr_method },
-};
-
-char *
-s_algclass(k)
-	int k;
-{
-	int i;
-	for (i = 0; i < ARRAYLEN(name_algclass); i++)
-		if (name_algclass[i].key == k)
-			return name_algclass[i].str;
-	return num2str(k);
-}
-
-char *
-s_algtype(class, n)
-	int class, n;
-{
-	int i;
-	for (i = 0; i < ARRAYLEN(name_algclass); i++)
-		if (name_algclass[i].key == class
-		 && name_algclass[i].f)
-			return (name_algclass[i].f)(n);
-	return num2str(n);
-}
-
-/* pfkey.h */
-static struct ksmap name_pfkey_type[] = {
-{ SADB_GETSPI,		"GETSPI",	NULL },
-{ SADB_UPDATE,		"UPDATE",	NULL },
-{ SADB_ADD,		"ADD",		NULL },
-{ SADB_DELETE,		"DELETE",	NULL },
-{ SADB_GET,		"GET",		NULL },
-{ SADB_ACQUIRE,		"ACQUIRE",	NULL },
-{ SADB_REGISTER,	"REGISTER",	NULL },
-{ SADB_EXPIRE,		"EXPIRE",	NULL },
-{ SADB_FLUSH,		"FLUSH",	NULL },
-{ SADB_DUMP,		"DUMP",		NULL },
-{ SADB_X_PROMISC,	"X_PROMISC",	NULL },
-{ SADB_X_PCHANGE,	"X_PCHANGE",	NULL },
-{ SADB_X_SPDUPDATE,	"X_SPDUPDATE",	NULL },
-{ SADB_X_SPDADD,	"X_SPDADD",	NULL },
-{ SADB_X_SPDDELETE,	"X_SPDDELETE",	NULL },
-{ SADB_X_SPDGET,	"X_SPDGET",	NULL },
-{ SADB_X_SPDACQUIRE,	"X_SPDACQUIRE",	NULL },
-{ SADB_X_SPDDUMP,	"X_SPDDUMP",	NULL },
-{ SADB_X_SPDFLUSH,	"X_SPDFLUSH",	NULL },
-{ SADB_X_SPDSETIDX,	"X_SPDSETIDX",	NULL },
-{ SADB_X_SPDEXPIRE,	"X_SPDEXPIRE",	NULL },
-{ SADB_X_SPDDELETE2,	"X_SPDDELETE2",	NULL },
-#ifdef SADB_X_NAT_T_NEW_MAPPING
-{ SADB_X_NAT_T_NEW_MAPPING, "X_NAT_T_NEW_MAPPING", NULL },
-#endif
-#ifdef SADB_X_MIGRATE
-{ SADB_X_MIGRATE,	"X_MIGRATE",	NULL },
-#endif
-};
-
-char *
-s_pfkey_type(k)
-	int k;
-{
-	int i;
-	for (i = 0; i < ARRAYLEN(name_pfkey_type); i++)
-		if (name_pfkey_type[i].key == k)
-			return name_pfkey_type[i].str;
-	return num2str(k);
-}
-
-static struct ksmap name_pfkey_satype[] = {
-{ SADB_SATYPE_UNSPEC,	"UNSPEC",	NULL },
-{ SADB_SATYPE_AH,	"AH",		NULL },
-{ SADB_SATYPE_ESP,	"ESP",		NULL },
-{ SADB_SATYPE_RSVP,	"RSVP",		NULL },
-{ SADB_SATYPE_OSPFV2,	"OSPFV2",	NULL },
-{ SADB_SATYPE_RIPV2,	"RIPV2",	NULL },
-{ SADB_SATYPE_MIP,	"MIP",		NULL },
-{ SADB_X_SATYPE_IPCOMP,	"IPCOMP",	NULL },
-};
-
-char *
-s_pfkey_satype(k)
-	int k;
-{
-	int i;
-	for (i = 0; i < ARRAYLEN(name_pfkey_satype); i++)
-		if (name_pfkey_satype[i].key == k)
-			return name_pfkey_satype[i].str;
-	return num2str(k);
-}
-
-static struct ksmap name_direction[] = {
-{ IPSEC_DIR_INBOUND,	"in",	NULL },
-{ IPSEC_DIR_OUTBOUND,	"out",	NULL },
-#ifdef HAVE_POLICY_FWD
-{ IPSEC_DIR_FWD,	"fwd",	NULL },
-#endif
-};
-
-char *
-s_direction(k)
-	int k;
-{
-	int i;
-	for (i = 0; i < ARRAYLEN(name_direction); i++)
-		if (name_direction[i].key == k)
-			return name_direction[i].str;
-	return num2str(k);
-}
-
-char *
-s_proto(k)
-	int k;
-{
-	switch (k) {
-	case IPPROTO_ICMP:
-		return "icmp";
-	case IPPROTO_TCP:
-		return "tcp";
-	case IPPROTO_UDP:
-		return "udp";
-	case IPPROTO_ICMPV6:
-		return "icmpv6";
-	case IPSEC_ULPROTO_ANY:
-		return "any";
-	}
-
-	return num2str(k);
-}
-
-char *
-s_doi(int k)
-{
-  switch (k) {
-    case IPSEC_DOI:
-      return "ipsec_doi";
-    default:
-      return num2str(k);
-  }
-}
-
-char *
-s_etype (int k)
-{
-  switch (k) {
-    case ISAKMP_ETYPE_NONE:
-      return "_none";
-    case ISAKMP_ETYPE_BASE:
-      return "base";
-    case ISAKMP_ETYPE_IDENT:
-      return "main";
-    case ISAKMP_ETYPE_AUTH:
-      return "_auth";
-    case ISAKMP_ETYPE_AGG:
-      return "aggressive";
-    case ISAKMP_ETYPE_INFO:
-      return "_info";
-    case ISAKMP_ETYPE_QUICK:
-      return "_quick";
-    case ISAKMP_ETYPE_NEWGRP:
-      return "_newgrp";
-    case ISAKMP_ETYPE_ACKINFO:
-      return "_ackinfo";
-    default:
-      return num2str(k);
-  }
-}
-
-char *
-s_idtype (int k)
-{
-  switch (k) {
-    case IDTYPE_FQDN:
-      return "fqdn";
-    case IDTYPE_USERFQDN:
-      return "user_fqdn";
-    case IDTYPE_KEYID:
-      return "keyid";
-    case IDTYPE_ADDRESS:
-      return "address";
-    case IDTYPE_ASN1DN:
-      return "asn1dn";
-    default:
-      return num2str(k);
-  }
-}
-
-char *
-s_switch (int k)
-{
-  switch (k) {
-    case FALSE:
-      return "off";
-    case TRUE:
-      return "on";
-    default:
-      return num2str(k);
-  }
-}
diff --git a/src/racoon/strnames.h b/src/racoon/strnames.h
deleted file mode 100644
index 02ebbb5..0000000
--- a/src/racoon/strnames.h
+++ /dev/null
@@ -1,80 +0,0 @@
-/*	$NetBSD: strnames.h,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
-
-/* Id: strnames.h,v 1.7 2005/04/18 10:04:26 manubsd Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _STRNAMES_H
-#define _STRNAMES_H
-
-extern char *num2str __P((int n));
-
-extern char *s_isakmp_state __P((int, int, int));
-extern char *s_isakmp_certtype __P((int));
-extern char *s_isakmp_etype __P((int));
-extern char *s_isakmp_notify_msg __P((int));
-extern char *s_isakmp_nptype __P((int));
-extern char *s_ipsecdoi_proto __P((int));
-extern char *s_ipsecdoi_trns_isakmp __P((int));
-extern char *s_ipsecdoi_trns_ah __P((int));
-extern char *s_ipsecdoi_trns_esp __P((int));
-extern char *s_ipsecdoi_trns_ipcomp __P((int));
-extern char *s_ipsecdoi_trns __P((int, int));
-extern char *s_ipsecdoi_attr __P((int));
-extern char *s_ipsecdoi_ltype __P((int));
-extern char *s_ipsecdoi_encmode __P((int));
-extern char *s_ipsecdoi_auth __P((int));
-extern char *s_ipsecdoi_attr_v __P((int, int));
-extern char *s_ipsecdoi_ident __P((int));
-extern char *s_oakley_attr __P((int));
-extern char *s_attr_isakmp_enc __P((int));
-extern char *s_attr_isakmp_hash __P((int));
-extern char *s_oakley_attr_method __P((int));
-extern char *s_attr_isakmp_desc __P((int));
-extern char *s_attr_isakmp_group __P((int));
-extern char *s_attr_isakmp_ltype __P((int));
-extern char *s_oakley_attr_v __P((int, int));
-extern char *s_ipsec_level __P((int));
-extern char *s_algclass __P((int));
-extern char *s_algtype __P((int, int));
-extern char *s_pfkey_type __P((int));
-extern char *s_pfkey_satype __P((int));
-extern char *s_direction __P((int));
-extern char *s_proto __P((int));
-extern char *s_doi __P((int));
-extern char *s_etype __P((int));
-extern char *s_idtype __P((int));
-extern char *s_switch __P((int));
-#ifdef ENABLE_HYBRID
-extern char *s_isakmp_cfg_type __P((int));
-extern char *s_isakmp_cfg_ptype __P((int));
-#endif
-
-#endif /* _STRNAMES_H */
diff --git a/src/racoon/throttle.c b/src/racoon/throttle.c
deleted file mode 100644
index cd7de1f..0000000
--- a/src/racoon/throttle.c
+++ /dev/null
@@ -1,158 +0,0 @@
-/*	$NetBSD: throttle.c,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
-
-/* Id: throttle.c,v 1.5 2006/04/05 20:54:50 manubsd Exp */
-
-/*
- * Copyright (C) 2004 Emmanuel Dreyfus
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#if TIME_WITH_SYS_TIME
-# include <sys/time.h>
-# include <time.h> 
-#else 
-# if HAVE_SYS_TIME_H
-#  include <sys/time.h>
-# else
-#  include <time.h>
-# endif 
-#endif
-#include <sys/param.h>
-#include <sys/queue.h>
-#include <sys/socket.h>
-
-#include <netinet/in.h>
-#include <resolv.h>
-
-#include "vmbuf.h"
-#include "misc.h"
-#include "plog.h"
-#include "throttle.h"
-#include "sockmisc.h"
-#include "libpfkey.h"
-#include "isakmp_var.h"
-#include "isakmp.h"
-#include "isakmp_xauth.h"
-#include "isakmp_cfg.h"
-#include "gcmalloc.h"
-
-struct throttle_list throttle_list = TAILQ_HEAD_INITIALIZER(throttle_list);
-
-
-struct throttle_entry *
-throttle_add(addr)
-	struct sockaddr *addr;
-{
-	struct throttle_entry *te;
-	size_t len;
-
-	len = sizeof(*te) 
-	    - sizeof(struct sockaddr_storage) 
-	    + sysdep_sa_len(addr);
-
-	if ((te = racoon_malloc(len)) == NULL)
-		return NULL;
-
-	te->penalty = time(NULL) + isakmp_cfg_config.auth_throttle;
-	memcpy(&te->host, addr, sysdep_sa_len(addr));
-	TAILQ_INSERT_HEAD(&throttle_list, te, next);
-
-	return te;
-}
-
-int
-throttle_host(addr, authfail) 
-	struct sockaddr *addr;
-	int authfail;
-{
-	struct throttle_entry *te;
-	int found = 0;
-	time_t now;
-
-	if (isakmp_cfg_config.auth_throttle == 0)
-		return 0;
-
-	now = time(NULL);
-
-restart:
-	RACOON_TAILQ_FOREACH_REVERSE(te, &throttle_list, throttle_list, next) {
-	  /*
-	   * Remove outdated entries 
-	   */
-		if (te->penalty < now) {
-			TAILQ_REMOVE(&throttle_list, te, next);
-			racoon_free(te);
-			goto restart;
-		}
-			
-		if (cmpsaddrwop(addr, (struct sockaddr *)&te->host) == 0) {
-			found = 1;
-			break;
-		}
-	}
-
-	/* 
-	 * No match, if auth failed, allocate a new throttle entry
-	 * give no penalty even on error: this is the first time
-	 * and we are indulgent.
-	 */
-	if (!found) {
-		if (authfail) {
-			if ((te = throttle_add(addr)) == NULL) {
-				plog(LLV_ERROR, LOCATION, NULL, 
-				    "Throttle insertion failed\n");
-				return (time(NULL) 
-				    + isakmp_cfg_config.auth_throttle);
-			}
-		}
-		return 0;
-	} else {
-		/*
-		 * We had a match and auth failed, increase penalty.
-		 */
-		if (authfail) {
-			time_t remaining;
-			time_t new;
-
-			remaining = te->penalty - now;
-			new = remaining + isakmp_cfg_config.auth_throttle;
-
-			if (new > THROTTLE_PENALTY_MAX)
-				new = THROTTLE_PENALTY_MAX;
-
-			te->penalty = now + new;
-		}
-	}
-	
-	return te->penalty;
-}
-
diff --git a/src/racoon/throttle.h b/src/racoon/throttle.h
deleted file mode 100644
index baa9af5..0000000
--- a/src/racoon/throttle.h
+++ /dev/null
@@ -1,51 +0,0 @@
-/*	$NetBSD: throttle.h,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
-
-/* Id: throttle.h,v 1.1 2004/11/30 00:46:09 manubsd Exp */
-
-/*
- * Copyright (C) 2004 Emmanuel Dreyfus
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _THROTTLE_H
-#define _THROTTLE_H
-
-struct throttle_entry {
-	int penalty;
-	TAILQ_ENTRY(throttle_entry) next;
-	struct sockaddr_storage host;
-};
-
-TAILQ_HEAD(throttle_list, throttle_entry);
-
-#define THROTTLE_PENALTY 1
-#define THROTTLE_PENALTY_MAX 10
-
-struct throttle_entry *throttle_add(struct sockaddr *);
-int throttle_host(struct sockaddr *, int);
-
-#endif /* _THROTTLE_H */
diff --git a/src/racoon/var.h b/src/racoon/var.h
deleted file mode 100644
index 8abb1c2..0000000
--- a/src/racoon/var.h
+++ /dev/null
@@ -1,107 +0,0 @@
-/*	$NetBSD: var.h,v 1.4.6.1 2007/06/06 15:36:38 vanhu Exp $	*/
-
-/* Id: var.h,v 1.6 2004/11/20 16:16:59 monas Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _VAR_H
-#define _VAR_H
-
-#if !defined(_VAR_H_)
-#define _VAR_H_
-
-#define MAX3(a, b, c) (a > b ? (a > c ? a : c) : (b > c ? b : c))
-
-#define ISSET(exp, bit) (((exp) & (bit)) == (bit))
-
-#define LALIGN(a) \
-    ((a) > 0 ? ((a) &~ (sizeof(long) - 1)) : sizeof(long))
-
-#define RNDUP(a) \
-    ((a) > 0 ? (1 + (((a) - 1) | (sizeof(long) - 1))) : sizeof(long))
-
-#define ARRAYLEN(a)	(sizeof(a)/sizeof(a[0]))
-
-#define BUFSIZE    5120
-
-#ifndef FALSE
-#define FALSE 0
-#endif
-#ifndef TRUE
-#define TRUE 1
-#endif
-
-#ifdef ENABLE_STATS
-#include <sys/time.h>
-#endif
-#include <sys/socket.h>
-
-/*
- * use of GETNAMEINFO(x, y, NULL) is not politically correct,
- * as sizeof(NULL) would be 4, not 0. Also, gcc-3.4.2+ bombs on it.
- * In such cases, use GETNAMEINFO_NULL(x, y)
- */
-#include <sys/socket.h>
-#include <netdb.h>
-
-/* var.h is used from non-racoon code (like eaytest), so we can't use niflags */
-#define NIFLAGS	(NI_NUMERICHOST | NI_NUMERICSERV)
-
-#define GETNAMEINFO(x, y, z) \
-do { \
-	if (getnameinfo((x), sysdep_sa_len(x), (y), sizeof(y), (z), sizeof(z), \
-			NIFLAGS) != 0) { \
-		if (y != NULL) \
-			strncpy((y), "(invalid)", sizeof(y)); \
-		if (z != NULL) \
-			strncpy((z), "(invalid)", sizeof(z)); \
-	} \
-} while (0);
-
-#define GETNAMEINFO_NULL(x, y) \
-do { \
-	if (getnameinfo((x), sysdep_sa_len(x), (y), sizeof(y), NULL, 0, \
-			NIFLAGS) != 0) { \
-		if (y != NULL) \
-			strncpy((y), "(invalid)", sizeof(y)); \
-	} \
-} while (0);
-
-#include <sys/queue.h>
-#ifndef LIST_FOREACH
-#define LIST_FOREACH(elm, head, field) \
-	for (elm = LIST_FIRST(head); elm; elm = LIST_NEXT(elm, field))
-#endif
-
-#include "gcmalloc.h"
-
-#endif /*!defined(_VAR_H_)*/
-
-#endif /* _VAR_H */
diff --git a/src/racoon/vendorid.c b/src/racoon/vendorid.c
deleted file mode 100644
index 96c87a3..0000000
--- a/src/racoon/vendorid.c
+++ /dev/null
@@ -1,317 +0,0 @@
-/*	$NetBSD: vendorid.c,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
-
-/* Id: vendorid.c,v 1.10 2006/02/22 16:10:21 vanhu Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#include <sys/types.h>
-#include <sys/param.h>
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-#include <ctype.h>
-
-#include "var.h"
-#include "misc.h"
-#include "vmbuf.h"
-#include "plog.h"
-#include "debug.h"
-
-#include "localconf.h"
-#include "isakmp_var.h"
-#include "isakmp.h"
-#include "vendorid.h"
-#include "crypto_openssl.h"
-#include "handler.h"
-#include "remoteconf.h"
-#ifdef ENABLE_NATT
-#include "nattraversal.h"
-#endif
-#ifdef ENABLE_HYBRID
-#include "isakmp_xauth.h"
-#include "isakmp_cfg.h"
-#endif
-
-static struct vendor_id all_vendor_ids[] = {
-{ VENDORID_IPSEC_TOOLS, "IPSec-Tools" },
-{ VENDORID_GSSAPI_LONG, "A GSS-API Authentication Method for IKE" },
-{ VENDORID_GSSAPI     , "GSSAPI" },
-{ VENDORID_MS_NT5     , "MS NT5 ISAKMPOAKLEY" },
-{ VENDORID_NATT_00    , "draft-ietf-ipsec-nat-t-ike-00" },
-{ VENDORID_NATT_01    , "draft-ietf-ipsec-nat-t-ike-01" },
-{ VENDORID_NATT_02    , "draft-ietf-ipsec-nat-t-ike-02" },
-{ VENDORID_NATT_02_N  , "draft-ietf-ipsec-nat-t-ike-02\n" },
-{ VENDORID_NATT_03    , "draft-ietf-ipsec-nat-t-ike-03" },
-{ VENDORID_NATT_04    , "draft-ietf-ipsec-nat-t-ike-04" },
-{ VENDORID_NATT_05    , "draft-ietf-ipsec-nat-t-ike-05" },
-{ VENDORID_NATT_06    , "draft-ietf-ipsec-nat-t-ike-06" },
-{ VENDORID_NATT_07    , "draft-ietf-ipsec-nat-t-ike-07" },
-{ VENDORID_NATT_08    , "draft-ietf-ipsec-nat-t-ike-08" },
-{ VENDORID_NATT_RFC   , "RFC 3947" },
-{ VENDORID_XAUTH      , "draft-ietf-ipsra-isakmp-xauth-06.txt" },
-{ VENDORID_UNITY      , "CISCO-UNITY" },
-{ VENDORID_FRAG       , "FRAGMENTATION" },
-/* Just a readable string for DPD ... */
-{ VENDORID_DPD        , "DPD" },
-/* Other known Vendor IDs */
-{ VENDORID_KAME       , "KAME/racoon" },
-};
-
-#define NUMVENDORIDS	(sizeof(all_vendor_ids)/sizeof(all_vendor_ids[0]))
-
-#define DPD_MAJOR_VERSION	0x01
-#define DPD_MINOR_VERSION	0x00
-
-const char vendorid_dpd_hash[] = {
-	0xAF, 0xCA, 0xD7, 0x13,
-	0x68, 0xA1, 0xF1, 0xC9,
-	0x6B, 0x86, 0x96, 0xFC,
-	0x77, 0x57, DPD_MAJOR_VERSION, DPD_MINOR_VERSION
-};
-
-
-static vchar_t *vendorid_fixup(int, vchar_t *t);
-
-static struct vendor_id *
-lookup_vendor_id_by_id (int id)
-{
-	int i;
-
-	for (i = 0; i < NUMVENDORIDS; i++)
-		if (all_vendor_ids[i].id == id)
-			return &all_vendor_ids[i];
-
-	return NULL;
-}
-
-const char *
-vid_string_by_id (int id)
-{
-	struct vendor_id *current;
-
-	if (id == VENDORID_DPD)
-		return vendorid_dpd_hash;
-
-	current = lookup_vendor_id_by_id(id);
-
-	return current ? current->string : NULL;
-}
-
-static struct vendor_id *
-lookup_vendor_id_by_hash (const char *hash)
-{
-	int i;
-	unsigned char *h = (unsigned char *)hash;
-
-	for (i = 0; i < NUMVENDORIDS; i++)
-		if (strncmp(all_vendor_ids[i].hash->v, hash,
-			    all_vendor_ids[i].hash->l) == 0)
-			return &all_vendor_ids[i];
-
-	return NULL;
-}
-
-void
-compute_vendorids (void)
-{
-	int i;
-	vchar_t vid;
-
-	for (i = 0; i < NUMVENDORIDS; i++) {
-		/* VENDORID_DPD is not a MD5 sum... */
-		if(all_vendor_ids[i].id == VENDORID_DPD){
-			all_vendor_ids[i].hash = vmalloc(sizeof(vendorid_dpd_hash));
-			if (all_vendor_ids[i].hash == NULL) {
-				plog(LLV_ERROR, LOCATION, NULL,
-					"unable to get memory for VID hash\n");
-				exit(1); /* this really shouldn't happen */
-			}
-			memcpy(all_vendor_ids[i].hash->v, vendorid_dpd_hash,
-				   sizeof(vendorid_dpd_hash));
-			continue;
-		}
-
-		vid.v = (char *) all_vendor_ids[i].string;
-		vid.l = strlen(vid.v);
-
-		all_vendor_ids[i].hash = eay_md5_one(&vid);
-		if (all_vendor_ids[i].hash == NULL)
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "unable to hash vendor ID string\n");
-
-		/* Special cases */
-		all_vendor_ids[i].hash =
-			vendorid_fixup(all_vendor_ids[i].id,
-				       all_vendor_ids[i].hash);
-	}
-}
-
-/*
- * set hashed vendor id.
- * hash function is always MD5.
- */
-vchar_t *
-set_vendorid(int vendorid)
-{
-	struct vendor_id *current;
-	vchar_t vid, *new;
-
-	if (vendorid == VENDORID_UNKNOWN) {
-		/*
-		 * The default unknown ID gets translated to
-		 * KAME/racoon.
-		 */
-		vendorid = VENDORID_DEFAULT;
-	}
-
-	current = lookup_vendor_id_by_id(vendorid);
-	if (current == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL,
-		    "invalid vendor ID index: %d\n", vendorid);
-		return (NULL);
-	}
-
-	/* The rest of racoon expects a private copy 
-	 * of the VID that could be free'd after use.
-	 * That's why we don't return the original pointer. */
-	return vdup(current->hash);
-}
-
-/*
- * Check the vendor ID payload -- return the vendor ID index
- * if we find a recognized one, or UNKNOWN if we don't.
- *
- * gen ... points to Vendor ID payload.
- */
-int
-check_vendorid(struct isakmp_gen *gen)
-{
-	vchar_t vid, *vidhash;
-	int i, vidlen;
-	struct vendor_id *current;
-
-	if (gen == NULL)
-		return (VENDORID_UNKNOWN);
-
-	vidlen = ntohs(gen->len) - sizeof(*gen);
-
-	current = lookup_vendor_id_by_hash((char *)(gen + 1));
-	if (!current)
-		goto unknown;
-	
-	if (current->hash->l < vidlen)
-		plog(LLV_INFO, LOCATION, NULL,
-		     "received broken Microsoft ID: %s\n",
-		     current->string);
-	else
-		plog(LLV_INFO, LOCATION, NULL,
-		     "received Vendor ID: %s\n",
-		     current->string);
-
-	return current->id;
-
-unknown:
-	plog(LLV_DEBUG, LOCATION, NULL, "received unknown Vendor ID\n");
-	plogdump(LLV_DEBUG, (char *)(gen + 1), vidlen);
-	return (VENDORID_UNKNOWN);
-}
-
-int
-handle_vendorid(struct ph1handle *iph1, struct isakmp_gen *gen)
-{
-	int vid_numeric;
-
-	vid_numeric = check_vendorid(gen);
-	if (vid_numeric == VENDORID_UNKNOWN)
-		return vid_numeric;
-
-#ifdef ENABLE_NATT
-	if (natt_vendorid(vid_numeric))
-		natt_handle_vendorid(iph1, vid_numeric);
-#endif
-#ifdef ENABLE_HYBRID
-	switch (vid_numeric) {
-	case VENDORID_XAUTH:
-		iph1->mode_cfg->flags |= ISAKMP_CFG_VENDORID_XAUTH;
-		break;
-	case VENDORID_UNITY:
-		iph1->mode_cfg->flags |= ISAKMP_CFG_VENDORID_UNITY;
-		break;
-	default:
-		break;
-	}
-#endif
-#ifdef ENABLE_DPD
-	if (vid_numeric == VENDORID_DPD &&
-	    (iph1->rmconf == NULL || iph1->rmconf->dpd)) {
-		iph1->dpd_support = 1;
-		plog(LLV_DEBUG, LOCATION, NULL, "remote supports DPD\n");
-	}
-#endif
-
-	return vid_numeric;
-}
-
-static vchar_t * 
-vendorid_fixup(vendorid, vidhash)
-	int vendorid;		 
-	vchar_t *vidhash;
-{			   
-	switch(vendorid) {
-	case VENDORID_XAUTH: {	/* The vendor Id is truncated */
-		vchar_t *tmp;					    
-				  
-		if ((tmp = vmalloc(8)) == NULL) {
-			plog(LLV_ERROR, LOCATION, NULL,
-			    "unable to hash vendor ID string\n");
-			return NULL;				    
-		}			
-		  
-		memcpy(tmp->v, vidhash->v, 8);
-		vfree(vidhash);		  
-		vidhash = tmp;
-				   
-		break;
-	} 
-	case VENDORID_UNITY:	/* Two bytes tweak */
-		vidhash->v[14] = 0x01;		  
-		vidhash->v[15] = 0x00;
-		break;		   
-
-	default:     
-		break;
-	}		
-	
-	return vidhash;
-}			 
diff --git a/src/racoon/vendorid.h b/src/racoon/vendorid.h
deleted file mode 100644
index 7060c7e..0000000
--- a/src/racoon/vendorid.h
+++ /dev/null
@@ -1,106 +0,0 @@
-/*	$NetBSD: vendorid.h,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
-
-/* Id: vendorid.h,v 1.11 2006/02/17 14:09:10 vanhu Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _VENDORID_H
-#define _VENDORID_H
-
-/* The unknown vendor ID. */
-#define	VENDORID_UNKNOWN	-1
-
-
-/* Our default vendor ID. */
-#define	VENDORID_DEFAULT	VENDORID_IPSEC_TOOLS
-
-#define	VENDORID_IPSEC_TOOLS 0		
-
-/*
- * Refer to draft-ietf-ipsec-isakmp-gss-auth-06.txt.
- */
-#define	VENDORID_GSSAPI_LONG	1
-#define	VENDORID_GSSAPI		2
-#define	VENDORID_MS_NT5		3
-#define	VENDOR_SUPPORTS_GSSAPI(x)					\
-	((x) == VENDORID_GSSAPI_LONG ||					\
-	 (x) == VENDORID_GSSAPI ||					\
-	 (x) == VENDORID_MS_NT5)
-
-/* NAT-T support */
-#define VENDORID_NATT_00	4
-#define VENDORID_NATT_01	5
-#define VENDORID_NATT_02	6
-#define VENDORID_NATT_02_N	7
-#define VENDORID_NATT_03	8
-#define VENDORID_NATT_04	9
-#define VENDORID_NATT_05	10
-#define VENDORID_NATT_06	11
-#define VENDORID_NATT_07	12
-#define VENDORID_NATT_08	13
-#define VENDORID_NATT_RFC	14
-
-#define VENDORID_NATT_FIRST	VENDORID_NATT_00
-#define VENDORID_NATT_LAST	VENDORID_NATT_RFC
-
-
-#define MAX_NATT_VID_COUNT	(VENDORID_NATT_LAST - VENDORID_NATT_FIRST + 1 )
-
-/* Hybrid auth */
-#define VENDORID_XAUTH		15
-#define VENDORID_UNITY		16
-
-/* IKE fragmentation */
-#define VENDORID_FRAG		17
-
-/* Dead Peer Detection */
-#define VENDORID_DPD		18
-
-
-/* Other Vendors...
- * XXX: do some cleanup to have separate lists for "real" vendors (to complete)
- * and "features" VendorIDs
- */
-#define	VENDORID_KAME		19
-
-
-struct vendor_id {
-	int		id;
-	const char	*string;
-	vchar_t		*hash;
-};
-
-vchar_t *set_vendorid __P((int));
-int handle_vendorid __P((struct ph1handle *, struct isakmp_gen *));
-
-void compute_vendorids __P((void));
-const char *vid_string_by_id __P((int id));
-
-#endif /* _VENDORID_H */
diff --git a/src/racoon/vmbuf.c b/src/racoon/vmbuf.c
deleted file mode 100644
index 6c1aed1..0000000
--- a/src/racoon/vmbuf.c
+++ /dev/null
@@ -1,137 +0,0 @@
-/*	$NetBSD: vmbuf.c,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
-
-/*	$KAME: vmbuf.c,v 1.11 2001/11/26 16:54:29 sakane Exp $	*/
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include "config.h"
-
-#define NONEED_DRM
-
-#include <sys/types.h>
-#include <sys/param.h>
-
-#include <stdlib.h>
-#include <stdio.h>
-#include <string.h>
-
-#include "var.h"
-#include "misc.h"
-#include "vmbuf.h"
-#include "debug.h"
-#include "plog.h"
-#include "gcmalloc.h"
-
-vchar_t *
-vmalloc(size)
-	size_t size;
-{
-	vchar_t *var;
-
-	if ((var = (vchar_t *)racoon_malloc(sizeof(*var))) == NULL)
-		return NULL;
-
-	var->l = size;
-	if (size == 0) {
-		var->v = NULL;
-	} else {
-		var->v = (caddr_t)racoon_calloc(1, size);
-		if (var->v == NULL) {
-			(void)racoon_free(var);
-			return NULL;
-		}
-	}
-
-	return var;
-}
-
-vchar_t *
-vrealloc(ptr, size)
-	vchar_t *ptr;
-	size_t size;
-{
-	caddr_t v;
-	
-	if (ptr != NULL) {
-		if (ptr->l == 0) {
-			(void)vfree(ptr);
-			return vmalloc(size); /* zero-fill it? */
-		}
-
-		if ((v = (caddr_t)racoon_realloc(ptr->v, size)) == NULL) {
-			(void)vfree(ptr);
-			return NULL;
-		}
-
-		if ( size > ptr->l)
-			memset(v + ptr->l, 0, size - ptr->l);
-		ptr->v = v;
-		ptr->l = size;
-	} else {
-		if ((ptr = vmalloc(size)) == NULL)
-			return NULL;
-	}
-
-	return ptr;
-}
-
-void
-vfree(var)
-	vchar_t *var;
-{
-	if (var == NULL)
-		return;
-
-	if (var->v)
-		(void)racoon_free(var->v);
-
-	(void)racoon_free(var);
-
-	return;
-}
-
-vchar_t *
-vdup(src)
-	vchar_t *src;
-{
-	vchar_t *new;
-
-	if (src == NULL) {
-		plog(LLV_ERROR, LOCATION, NULL, "vdup(NULL) called\n");
-		return NULL;
-	}
-
-	if ((new = vmalloc(src->l)) == NULL)
-		return NULL;
-
-	memcpy(new->v, src->v, src->l);
-
-	return new;
-}
diff --git a/src/racoon/vmbuf.h b/src/racoon/vmbuf.h
deleted file mode 100644
index 3f2f4ea..0000000
--- a/src/racoon/vmbuf.h
+++ /dev/null
@@ -1,73 +0,0 @@
-/*	$NetBSD: vmbuf.h,v 1.4 2006/09/09 16:22:10 manu Exp $	*/
-
-/* Id: vmbuf.h,v 1.4 2005/10/30 10:28:44 vanhu Exp */
-
-/*
- * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
- * All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. Neither the name of the project nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#ifndef _VMBUF_H
-#define _VMBUF_H
-
-/*
- *	bp      v
- *	v       v
- *	........................
- *	        <--------------> l
- *	<----------------------> bl
- */
-typedef struct _vchar_t_ {
-#if notyet
-	u_int32_t t;	/* type of the value */
-	vchar_t *n;	/* next vchar_t buffer */
-	size_t bl;	/* length of the buffer */
-	caddr_t bp;	/* pointer to the buffer */
-#endif
-	size_t l;	/* length of the value */
-	caddr_t v;	/* place holder to the pointer to the value */
-} vchar_t;
-
-#define VPTRINIT(p) \
-do { \
-	if (p) { \
-		vfree(p); \
-		(p) = NULL; \
-	} \
-} while(0);
-
-#if defined(__APPLE__) && defined(__MACH__)
-/* vfree is already defined in Apple's system libraries */
-#define vfree   vmbuf_free
-#endif
-
-extern vchar_t *vmalloc __P((size_t));
-extern vchar_t *vrealloc __P((vchar_t *, size_t));
-extern void vfree __P((vchar_t *));
-extern vchar_t *vdup __P((vchar_t *));
-
-#endif /* _VMBUF_H */