main/ipsec-tools: update to 20090903 snapshot

remove the patch merged upstream.

2 files changed, 3 insertions, 1232 deletions

diff --git a/main/ipsec-tools/10-rekey-ph1hint.patch b/main/ipsec-tools/10-rekey-ph1hint.patch
deleted file mode 100644
index 773d609012..0000000000
--- a/main/ipsec-tools/10-rekey-ph1hint.patch
+++ /dev/null
@@ -1,1227 +0,0 @@
-? .msg
-? ChangeLog
-? alpine-config
-? commiters.txt
-? fd-unmonitor-segv-fix.patch
-? natt-and-cmpsaddr.patch
-? racoon.txt
-? rekeying-fixes.diff
-? rpm/Makefile
-? rpm/Makefile.in
-? rpm/ipsec-tools.spec
-? rpm/suse/Makefile
-? rpm/suse/Makefile.in
-? rpm/suse/ipsec-tools.spec
-? src/Makefile
-? src/Makefile.in
-? src/include-glibc/.includes
-? src/include-glibc/Makefile
-? src/include-glibc/Makefile.in
-? src/libipsec/.deps
-? src/libipsec/.libs
-? src/libipsec/Makefile
-? src/libipsec/Makefile.in
-? src/libipsec/ipsec_dump_policy.lo
-? src/libipsec/ipsec_get_policylen.lo
-? src/libipsec/ipsec_strerror.lo
-? src/libipsec/key_debug.lo
-? src/libipsec/libipsec.la
-? src/libipsec/pfkey.lo
-? src/libipsec/pfkey_dump.lo
-? src/libipsec/policy_parse.c
-? src/libipsec/policy_parse.h
-? src/libipsec/policy_parse.lo
-? src/libipsec/policy_token.c
-? src/libipsec/policy_token.lo
-? src/racoon/.deps
-? src/racoon/.libs
-? src/racoon/Makefile
-? src/racoon/Makefile.in
-? src/racoon/cfparse.c
-? src/racoon/cfparse.h
-? src/racoon/cftoken.c
-? src/racoon/eaytest
-? src/racoon/libracoon.la
-? src/racoon/libracoon_la-kmpstat.lo
-? src/racoon/libracoon_la-misc.lo
-? src/racoon/libracoon_la-sockmisc.lo
-? src/racoon/libracoon_la-vmbuf.lo
-? src/racoon/plainrsa-gen
-? src/racoon/prsa_par.c
-? src/racoon/prsa_par.h
-? src/racoon/prsa_tok.c
-? src/racoon/racoon
-? src/racoon/racoonctl
-? src/racoon/samples/psk.txt
-? src/racoon/samples/racoon.conf
-? src/setkey/.deps
-? src/setkey/.libs
-? src/setkey/Makefile
-? src/setkey/Makefile.in
-? src/setkey/parse.c
-? src/setkey/parse.h
-? src/setkey/setkey
-? src/setkey/token.c
-Index: src/racoon/admin.c
-===================================================================
-RCS file: /cvsroot/src/crypto/dist/ipsec-tools/src/racoon/admin.c,v
-retrieving revision 1.31
-diff -u -r1.31 admin.c
---- a/src/racoon/admin.c	3 Jul 2009 06:41:46 -0000	1.31
-+++ b/src/racoon/admin.c	19 Aug 2009 14:35:06 -0000
-@@ -5,7 +5,7 @@
- /*
-  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
-  * All rights reserved.
-- * 
-+ *
-  * Redistribution and use in source and binary forms, with or without
-  * modification, are permitted provided that the following conditions
-  * are met:
-@@ -17,7 +17,7 @@
-  * 3. Neither the name of the project nor the names of its contributors
-  *    may be used to endorse or promote products derived from this software
-  *    without specific prior written permission.
-- * 
-+ *
-  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
-  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-@@ -341,7 +341,7 @@
- 		user[len] = 0;
- 
- 		found = purgeph1bylogin(user);
--		plog(LLV_INFO, LOCATION, NULL, 
-+		plog(LLV_INFO, LOCATION, NULL,
- 		    "deleted %d SA for user \"%s\"\n", found, user);
- 
- 		break;
-@@ -360,7 +360,7 @@
- 		rem = racoon_strdup(saddrwop2str(dst));
- 		STRDUP_FATAL(rem);
- 
--		plog(LLV_INFO, LOCATION, NULL, 
-+		plog(LLV_INFO, LOCATION, NULL,
- 		    "Flushing all SAs for peer %s\n", rem);
- 
- 		while ((iph1 = getph1bydstaddr(dst)) != NULL) {
-@@ -373,7 +373,7 @@
- 
- 			racoon_free(loc);
- 		}
--		
-+
- 		racoon_free(rem);
- 		break;
- 	}
-@@ -383,14 +383,14 @@
- 		char *data;
- 
- 		acp = (struct admin_com_psk *)
--		    ((char *)com + sizeof(*com) + 
-+		    ((char *)com + sizeof(*com) +
- 		    sizeof(struct admin_com_indexes));
- 
- 		idtype = acp->id_type;
- 
- 		if ((id = vmalloc(acp->id_len)) == NULL) {
- 			plog(LLV_ERROR, LOCATION, NULL,
--			    "cannot allocate memory: %s\n", 
-+			    "cannot allocate memory: %s\n",
- 			    strerror(errno));
- 			break;
- 		}
-@@ -399,7 +399,7 @@
- 
- 		if ((key = vmalloc(acp->key_len)) == NULL) {
- 			plog(LLV_ERROR, LOCATION, NULL,
--			    "cannot allocate memory: %s\n", 
-+			    "cannot allocate memory: %s\n",
- 			    strerror(errno));
- 			vfree(id);
- 			id = NULL;
-@@ -474,7 +474,7 @@
- 				rmconf->xauth->pass = key;
- 			}
- #endif
-- 
-+
- 			plog(LLV_INFO, LOCATION, NULL,
- 				"accept a request to establish IKE-SA: "
- 				"%s\n", saddrwop2str(dst));
-@@ -577,7 +577,7 @@
- 			}
- 
- 			insph2(iph2);
--			if (isakmp_post_acquire(iph2) < 0) {
-+			if (isakmp_post_acquire(iph2, NULL) < 0) {
- 				remph2(iph2);
- 				delph2(iph2);
- 				break;
-@@ -710,17 +710,17 @@
- 	}
- 
- 	if (chown(sunaddr.sun_path, adminsock_owner, adminsock_group) != 0) {
--		plog(LLV_ERROR, LOCATION, NULL, 
--		    "chown(%s, %d, %d): %s\n", 
--		    sunaddr.sun_path, adminsock_owner, 
-+		plog(LLV_ERROR, LOCATION, NULL,
-+		    "chown(%s, %d, %d): %s\n",
-+		    sunaddr.sun_path, adminsock_owner,
- 		    adminsock_group, strerror(errno));
- 		(void)close(lcconf->sock_admin);
- 		return -1;
- 	}
- 
- 	if (chmod(sunaddr.sun_path, adminsock_mode) != 0) {
--		plog(LLV_ERROR, LOCATION, NULL, 
--		    "chmod(%s, 0%03o): %s\n", 
-+		plog(LLV_ERROR, LOCATION, NULL,
-+		    "chmod(%s, 0%03o): %s\n",
- 		    sunaddr.sun_path, adminsock_mode, strerror(errno));
- 		(void)close(lcconf->sock_admin);
- 		return -1;
-Index: src/racoon/handler.c
-===================================================================
-RCS file: /cvsroot/src/crypto/dist/ipsec-tools/src/racoon/handler.c,v
-retrieving revision 1.29
-diff -u -r1.29 handler.c
---- a/src/racoon/handler.c	3 Jul 2009 06:41:46 -0000	1.29
-+++ b/src/racoon/handler.c	19 Aug 2009 14:35:06 -0000
-@@ -5,7 +5,7 @@
- /*
-  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
-  * All rights reserved.
-- * 
-+ *
-  * Redistribution and use in source and binary forms, with or without
-  * modification, are permitted provided that the following conditions
-  * are met:
-@@ -17,7 +17,7 @@
-  * 3. Neither the name of the project nor the names of its contributors
-  *    may be used to endorse or promote products derived from this software
-  *    without specific prior written permission.
-- * 
-+ *
-  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
-  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-@@ -64,7 +64,7 @@
- #include "evt.h"
- #include "isakmp.h"
- #ifdef ENABLE_HYBRID
--#include "isakmp_xauth.h"  
-+#include "isakmp_xauth.h"
- #include "isakmp_cfg.h"
- #endif
- #include "isakmp_inf.h"
-@@ -177,8 +177,8 @@
-  * with phase 2's destinaion.
-  */
- struct ph1handle *
--getph1(rmconf, local, remote, flags)
--	struct remoteconf *rmconf;
-+getph1(ph1hint, local, remote, flags)
-+	struct ph1handle *ph1hint;
- 	struct sockaddr *local, *remote;
- 	int flags;
- {
-@@ -202,12 +202,30 @@
- 			continue;
- 		}
- 
--		if (local != NULL && cmpsaddr(local, p->local) != 0)
-+		if (local != NULL && cmpsaddr(local, p->local) == CMPSADDR_MISMATCH)
- 			continue;
- 
--		if (remote != NULL && cmpsaddr(remote, p->remote) != 0)
-+		if (remote != NULL && cmpsaddr(remote, p->remote) == CMPSADDR_MISMATCH)
- 			continue;
- 
-+		if (ph1hint != NULL) {
-+			if (ph1hint->id && ph1hint->id->l && p->id && p->id->l &&
-+			    (ph1hint->id->l != p->id->l ||
-+			     memcmp(ph1hint->id->v, p->id->v, p->id->l) != 0)) {
-+				plog(LLV_DEBUG2, LOCATION, NULL,
-+				     "local identity does match hint\n");
-+				continue;
-+			}
-+			if (ph1hint->id_p && ph1hint->id_p->l &&
-+			    p->id_p && p->id_p->l &&
-+			    (ph1hint->id_p->l != p->id_p->l ||
-+			     memcmp(ph1hint->id_p->v, p->id_p->v, p->id_p->l) != 0)) {
-+				plog(LLV_DEBUG2, LOCATION, NULL,
-+				     "remote identity does match hint\n");
-+				continue;
-+			}
-+		}
-+
- 		plog(LLV_DEBUG2, LOCATION, NULL, "matched\n");
- 		return p;
- 	}
-@@ -1155,7 +1173,7 @@
- }
- 
- #ifdef ENABLE_HYBRID
--/* 
-+/*
-  * Retruns 0 if the address was obtained by ISAKMP mode config, 1 otherwise
-  * This should be in isakmp_cfg.c but ph1tree being private, it must be there
-  */
-@@ -1182,7 +1200,7 @@
- 
- 
- 
--/* 
-+/*
-  * Reload conf code
-  */
- static int revalidate_ph2(struct ph2handle *iph2){
-@@ -1192,11 +1210,11 @@
- 	struct saprop *approval;
- 	struct ph1handle *iph1;
- 
--	/* 
-+	/*
- 	 * Get the new sainfo using values of the old one
- 	 */
- 	if (iph2->sainfo != NULL) {
--		iph2->sainfo = getsainfo(iph2->sainfo->idsrc, 
-+		iph2->sainfo = getsainfo(iph2->sainfo->idsrc,
- 					  iph2->sainfo->iddst, iph2->sainfo->id_i,
- 					  NULL, iph2->sainfo->remoteid);
- 	}
-@@ -1204,7 +1222,7 @@
- 	sainfo = iph2->sainfo;
- 
- 	if (sainfo == NULL) {
--		/* 
-+		/*
- 		 * Sainfo has been removed
- 		 */
- 		plog(LLV_DEBUG, LOCATION, NULL,
-@@ -1219,7 +1237,7 @@
- 		plog(LLV_DEBUG, LOCATION, NULL,
- 			 "No approval found !\n");
- 		return 0;
--	}	
-+	}
- 
- 	/*
- 	 * Don't care about proposals, should we do something ?
-@@ -1318,7 +1336,7 @@
- 	}
- 
- 	found = 0;
--	for (alg = sainfo->algs[algclass_ipsec_enc]; 
-+	for (alg = sainfo->algs[algclass_ipsec_enc];
- 	    (found == 0 && alg != NULL); alg = alg->next) {
- 		plog(LLV_DEBUG, LOCATION, NULL,
- 			 "Reload: next ph2 enc alg...\n");
-@@ -1351,7 +1369,7 @@
- 			break;
- 
- 		default:
--			plog(LLV_ERROR, LOCATION, NULL, 
-+			plog(LLV_ERROR, LOCATION, NULL,
- 			    "unexpected check_level\n");
- 			continue;
- 			break;
-@@ -1375,7 +1393,7 @@
- }
- 
- 
--static void 
-+static void
- remove_ph2(struct ph2handle *iph2)
- {
- 	u_int32_t spis[2];
-@@ -1467,7 +1485,7 @@
- 	return 1;
- }
- 
--int 
-+int
- revalidate_ph12(void)
- {
- 
-Index: src/racoon/handler.h
-===================================================================
-RCS file: /cvsroot/src/crypto/dist/ipsec-tools/src/racoon/handler.h,v
-retrieving revision 1.21
-diff -u -r1.21 handler.h
---- a/src/racoon/handler.h	3 Jul 2009 06:41:46 -0000	1.21
-+++ b/src/racoon/handler.h	19 Aug 2009 14:35:06 -0000
-@@ -5,7 +5,7 @@
- /*
-  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
-  * All rights reserved.
-- * 
-+ *
-  * Redistribution and use in source and binary forms, with or without
-  * modification, are permitted provided that the following conditions
-  * are met:
-@@ -17,7 +17,7 @@
-  * 3. Neither the name of the project nor the names of its contributors
-  *    may be used to endorse or promote products derived from this software
-  *    without specific prior written permission.
-- * 
-+ *
-  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
-  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-@@ -214,7 +214,7 @@
- 	LIST_ENTRY(ph1handle) chain;
- #ifdef ENABLE_HYBRID
- 	struct isakmp_cfg_state *mode_cfg;	/* ISAKMP mode config state */
--#endif       
-+#endif
- 	EVT_LISTENER_LIST(evt_listeners);
- };
- 
-@@ -449,7 +449,7 @@
- 	struct sockaddr_storage remote;
- 	struct sockaddr_storage local;
- 	u_int8_t version;
--	u_int8_t etype;	
-+	u_int8_t etype;
- 	time_t created;
- 	int ph2cnt;
- };
-@@ -468,7 +468,7 @@
- 
- #define GETPH1_F_ESTABLISHED		0x0001
- 
--extern struct ph1handle *getph1 __P((struct remoteconf *rmconf,
-+extern struct ph1handle *getph1 __P((struct ph1handle *ph1hint,
- 				     struct sockaddr *local,
- 				     struct sockaddr *remote,
- 				     int flags));
-Index: src/racoon/isakmp.c
-===================================================================
-RCS file: /cvsroot/src/crypto/dist/ipsec-tools/src/racoon/isakmp.c,v
-retrieving revision 1.58
-diff -u -r1.58 isakmp.c
---- a/src/racoon/isakmp.c	3 Jul 2009 06:41:46 -0000	1.58
-+++ b/src/racoon/isakmp.c	19 Aug 2009 14:35:07 -0000
-@@ -5,7 +5,7 @@
- /*
-  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
-  * All rights reserved.
-- * 
-+ *
-  * Redistribution and use in source and binary forms, with or without
-  * modification, are permitted provided that the following conditions
-  * are met:
-@@ -17,7 +17,7 @@
-  * 3. Neither the name of the project nor the names of its contributors
-  *    may be used to endorse or promote products derived from this software
-  *    without specific prior written permission.
-- * 
-+ *
-  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
-  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-@@ -176,7 +176,7 @@
- };
- 
- static u_char r_ck0[] = { 0,0,0,0,0,0,0,0 }; /* used to verify the r_ck. */
-- 
-+
- static int isakmp_main __P((vchar_t *, struct sockaddr *, struct sockaddr *));
- static int ph1_main __P((struct ph1handle *, vchar_t *));
- static int quick_main __P((struct ph2handle *, vchar_t *));
-@@ -190,7 +190,7 @@
- static int isakmp_ph2resend __P((struct ph2handle *));
- 
- #ifdef ENABLE_FRAG
--static int frag_handler(struct ph1handle *, 
-+static int frag_handler(struct ph1handle *,
-     vchar_t *, struct sockaddr *, struct sockaddr *);
- #endif
- 
-@@ -259,16 +259,16 @@
- 			extralen += sizeof(x.lbuf.udp) + x.lbuf.ip.ip_hl;
- 		}
- #endif
--	}	
-+	}
- 
- #ifdef ENABLE_NATT
--	/* we don't know about portchange yet, 
-+	/* we don't know about portchange yet,
- 	   look for non-esp marker instead */
- 	if (x.non_esp[0] == 0 && x.non_esp[1] != 0)
- 		extralen = NON_ESP_MARKER_LEN;
- #endif
- 
--	/* now we know if there is an extra non-esp 
-+	/* now we know if there is an extra non-esp
- 	   marker at the beginning or not */
- 	memcpy ((char *)&isakmp, x.buf + extralen, sizeof (isakmp));
- 
-@@ -309,7 +309,7 @@
- 		if ((len = recvfrom(so_isakmp, (char *)&isakmp, sizeof(isakmp),
- 			    0, (struct sockaddr *)&remote, &remote_len)) < 0) {
- 			plog(LLV_ERROR, LOCATION, NULL,
--				"failed to receive isakmp packet: %s\n", 
-+				"failed to receive isakmp packet: %s\n",
- 				strerror (errno));
- 		}
- 		goto end;
-@@ -332,11 +332,11 @@
- 			(len - extralen));
- 		goto end;
- 	}
--	
-+
- 	memcpy (buf->v, tmpbuf->v + extralen, buf->l);
- 
- 	len -= extralen;
--	
-+
- 	if (len != buf->l) {
- 		plog(LLV_ERROR, LOCATION, (struct sockaddr *)&remote,
- 			"received invalid length (%d != %zu), why ?\n",
-@@ -347,7 +347,7 @@
- 	plog(LLV_DEBUG, LOCATION, NULL, "===\n");
- 	plog(LLV_DEBUG, LOCATION, NULL,
- 		"%d bytes message received %s\n",
--		len, saddr2str_fromto("from %s to %s", 
-+		len, saddr2str_fromto("from %s to %s",
- 			(struct sockaddr *)&remote,
- 			(struct sockaddr *)&local));
- 	plogdump(LLV_DEBUG, buf->v, buf->l);
-@@ -496,12 +496,12 @@
- 			}
- 
- 			/* set the flag to prevent further port floating
--			   (FIXME: should we allow it? E.g. when the NAT gw 
-+			   (FIXME: should we allow it? E.g. when the NAT gw
- 			    is rebooted?) */
- 			iph1->natt_flags |= NAT_PORTS_CHANGED | NAT_ADD_NON_ESP_MARKER;
--			
-+
- 			/* print some neat info */
--			plog (LLV_INFO, LOCATION, NULL, 
-+			plog (LLV_INFO, LOCATION, NULL,
- 			      "NAT-T: ports changed to: %s\n",
- 			      saddr2str_fromto ("%s<->%s", iph1->remote, iph1->local));
- 
-@@ -668,7 +668,7 @@
- 			return -1;
- 		}
- #ifdef ENABLE_HYBRID
--		/* Reinit the IVM if it's still there */		
-+		/* Reinit the IVM if it's still there */
- 		if (iph1->mode_cfg && iph1->mode_cfg->ivm) {
- 			oakley_delivm(iph1->mode_cfg->ivm);
- 			iph1->mode_cfg->ivm = NULL;
-@@ -753,7 +753,7 @@
- 
- 		isakmp_cfg_r(iph1, msg);
- 		break;
--#endif	 
-+#endif
- 
- 	case ISAKMP_ETYPE_NONE:
- 	default:
-@@ -822,7 +822,7 @@
- 	/* free resend buffer */
- 	if (iph1->sendbuf == NULL) {
- 		plog(LLV_ERROR, LOCATION, NULL,
--			"no buffer found as sendbuf\n"); 
-+			"no buffer found as sendbuf\n");
- 		return -1;
- 	}
- #endif
-@@ -925,13 +925,13 @@
- 		log_ph1established(iph1);
- 		plog(LLV_DEBUG, LOCATION, NULL, "===\n");
- 
--		/* 
-+		/*
- 		 * SA up shell script hook: do it now,except if
- 		 * ISAKMP mode config was requested. In the later
- 		 * case it is done when we receive the configuration.
- 		 */
- 		if ((iph1->status == PHASE1ST_ESTABLISHED) &&
--		    !iph1->rmconf->mode_cfg) { 
-+		    !iph1->rmconf->mode_cfg) {
- 			switch (iph1->approval->authmethod) {
- #ifdef ENABLE_HYBRID
- 			case OAKLEY_ATTR_AUTH_METHOD_XAUTH_PSKEY_R:
-@@ -1004,7 +1004,7 @@
- 	/* free resend buffer */
- 	if (iph2->sendbuf == NULL) {
- 		plog(LLV_ERROR, LOCATION, NULL,
--			"no buffer found as sendbuf\n"); 
-+			"no buffer found as sendbuf\n");
- 		return -1;
- 	}
- 	VPTRINIT(iph2->sendbuf);
-@@ -1754,23 +1754,23 @@
- 		extralen = 0;
- 
- #ifdef ENABLE_FRAG
--	/* 
-+	/*
- 	 * Do not add the non ESP marker for a packet that will
--	 * be fragmented. The non ESP marker should appear in 
-+	 * be fragmented. The non ESP marker should appear in
- 	 * all fragment's packets, but not in the fragmented packet
- 	 */
--	if (iph1->frag && sbuf->l > ISAKMP_FRAG_MAXLEN) 
-+	if (iph1->frag && sbuf->l > ISAKMP_FRAG_MAXLEN)
- 		extralen = 0;
- #endif
- 	if (extralen)
- 		plog (LLV_DEBUG, LOCATION, NULL, "Adding NON-ESP marker\n");
- 
--	/* If NAT-T port floating is in use, 4 zero bytes (non-ESP marker) 
--	   must added just before the packet itself. For this we must 
-+	/* If NAT-T port floating is in use, 4 zero bytes (non-ESP marker)
-+	   must added just before the packet itself. For this we must
- 	   allocate a new buffer and release it at the end. */
- 	if (extralen) {
- 		if ((vbuf = vmalloc (sbuf->l + extralen)) == NULL) {
--			plog(LLV_ERROR, LOCATION, NULL, 
-+			plog(LLV_ERROR, LOCATION, NULL,
- 			    "vbuf allocation failed\n");
- 			return -1;
- 		}
-@@ -1791,17 +1791,17 @@
- 	if (s == -1)
- 		return -1;
- 
--	plog (LLV_DEBUG, LOCATION, NULL, "%zu bytes %s\n", sbuf->l, 
-+	plog (LLV_DEBUG, LOCATION, NULL, "%zu bytes %s\n", sbuf->l,
- 	      saddr2str_fromto("from %s to %s", iph1->local, iph1->remote));
- 
- #ifdef ENABLE_FRAG
- 	if (iph1->frag && sbuf->l > ISAKMP_FRAG_MAXLEN) {
- 		if (isakmp_sendfrags(iph1, sbuf) == -1) {
--			plog(LLV_ERROR, LOCATION, NULL, 
-+			plog(LLV_ERROR, LOCATION, NULL,
- 			    "isakmp_sendfrags failed\n");
- 			return -1;
- 		}
--	} else 
-+	} else
- #endif
- 	{
- 		len = sendfromto(s, sbuf->v, sbuf->l,
-@@ -1812,7 +1812,7 @@
- 			return -1;
- 		}
- 	}
--	
-+
- 	return 0;
- }
- 
-@@ -1959,7 +1959,7 @@
- 	iph1->status = PHASE1ST_DYING;
- 
- 	/* Any fresh phase1s? */
--	new_iph1 = getph1(iph1->rmconf, iph1->local, iph1->remote, 1);
-+	new_iph1 = getph1(iph1, iph1->local, iph1->remote, 1);
- 	if (new_iph1 == NULL) {
- 		LIST_FOREACH(p, &iph1->ph2tree, ph1bind) {
- 			if (p->status != PHASE2ST_ESTABLISHED)
-@@ -2036,7 +2036,7 @@
- 	char *src, *dst;
- 
- 	/* Migrate established phase2s. Any fresh phase1s? */
--	new_iph1 = getph1byaddr(iph1->local, iph1->remote, 1);
-+	new_iph1 = getph1(iph1, iph1->local, iph1->remote, 1);
- 	if (new_iph1 != NULL)
- 		migrate_ph12(iph1, new_iph1);
- 
-@@ -2143,12 +2143,13 @@
-  * if phase1 has been finished, begin phase2.
-  */
- int
--isakmp_post_acquire(iph2)
-+isakmp_post_acquire(iph2, iph1hint)
- 	struct ph2handle *iph2;
-+	struct ph1handle *iph1hint;
- {
- 	struct remoteconf *rmconf;
- 	struct ph1handle *iph1 = NULL;
--	
-+
- 	plog(LLV_DEBUG, LOCATION, NULL, "in post_acquire\n");
- 
- 	/* Search appropriate configuration with masking port. Note that
-@@ -2159,12 +2160,17 @@
- 	 * address of a mobile node (not a CoA provided by MIGRATE/KMADDRESS
- 	 * as iph2->dst hint). This scenario would require additional changes,
- 	 * so no need to bother yet. --arno */
--	rmconf = getrmconf(iph2->dst, GETRMCONF_F_NO_PASSIVE);
--	if (rmconf == NULL) {
--		plog(LLV_ERROR, LOCATION, NULL,
--			"no configuration found for %s.\n",
--			saddrwop2str(iph2->dst));
--		return -1;
-+
-+	if (iph1hint == NULL || iph1hint->rmconf == NULL) {
-+		rmconf = getrmconf(iph2->dst, GETRMCONF_F_NO_PASSIVE);
-+		if (rmconf == NULL) {
-+			plog(LLV_ERROR, LOCATION, NULL,
-+				"no configuration found for %s.\n",
-+				saddrwop2str(iph2->dst));
-+			return -1;
-+		}
-+	} else {
-+		rmconf = iph1hint->rmconf;
- 	}
- 
- 	/* if passive mode, ignore the acquire message */
-@@ -2181,7 +2187,7 @@
- 	 * some cases, we should use the ISAKMP identity to search
- 	 * matching ISAKMP.
- 	 */
--	iph1 = getph1byaddr(iph2->src, iph2->dst, 0);
-+	iph1 = getph1(iph1hint, iph2->src, iph2->dst, 0);
- 
- 	/* no ISAKMP-SA found. */
- 	if (iph1 == NULL) {
-@@ -2978,7 +2984,7 @@
- 		"ISAKMP-SA established %s-%s spi:%s\n",
- 		src, dst,
- 		isakmp_pindex(&iph1->index, 0));
--	
-+
- 	evt_phase1(iph1, EVT_PHASE1_UP, NULL);
- 	if(!iph1->rmconf->mode_cfg)
- 		evt_phase1(iph1, EVT_PHASE1_MODE_CFG, NULL);
-@@ -3011,7 +3017,7 @@
- 	return plist;
- }
- 
--vchar_t * 
-+vchar_t *
- isakmp_plist_set_all (struct payload_list **plist, struct ph1handle *iph1)
- {
- 	struct payload_list *ptr = *plist, *first;
-@@ -3022,7 +3028,7 @@
- 	/* Seek to the first item.  */
- 	while (ptr->prev) ptr = ptr->prev;
- 	first = ptr;
--	
-+
- 	/* Compute the whole length.  */
- 	while (ptr) {
- 		tlen += ptr->payload->l + sizeof (struct isakmp_gen);
-@@ -3064,7 +3070,7 @@
- }
- 
- #ifdef ENABLE_FRAG
--int 
-+int
- frag_handler(iph1, msg, remote, local)
- 	struct ph1handle *iph1;
- 	vchar_t *msg;
-@@ -3075,7 +3081,7 @@
- 
- 	if (isakmp_frag_extract(iph1, msg) == 1) {
- 		if ((newmsg = isakmp_frag_reassembly(iph1)) == NULL) {
--			plog(LLV_ERROR, LOCATION, remote, 
-+			plog(LLV_ERROR, LOCATION, remote,
- 			    "Packet reassembly failed\n");
- 			return -1;
- 		}
-@@ -3125,24 +3131,24 @@
- 	if (iph1->remote != NULL) {
- 		GETNAMEINFO(iph1->remote, addrstr, portstr);
- 
--		if (script_env_append(&envp, &envc, 
-+		if (script_env_append(&envp, &envc,
- 		    "REMOTE_ADDR", addrstr) != 0) {
--			plog(LLV_ERROR, LOCATION, NULL, 
-+			plog(LLV_ERROR, LOCATION, NULL,
- 			    "Cannot set REMOTE_ADDR\n");
- 			goto out;
- 		}
- 
--		if (script_env_append(&envp, &envc, 
-+		if (script_env_append(&envp, &envc,
- 		    "REMOTE_PORT", portstr) != 0) {
--			plog(LLV_ERROR, LOCATION, NULL, 
-+			plog(LLV_ERROR, LOCATION, NULL,
- 			    "Cannot set REMOTEL_PORT\n");
- 			goto out;
- 		}
- 	}
- 
--	if (privsep_script_exec(iph1->rmconf->script[script]->v, 
--	    script, envp) != 0) 
--		plog(LLV_ERROR, LOCATION, NULL, 
-+	if (privsep_script_exec(iph1->rmconf->script[script]->v,
-+	    script, envp) != 0)
-+		plog(LLV_ERROR, LOCATION, NULL,
- 		    "Script %s execution failed\n", script_names[script]);
- 
- out:
-@@ -3202,7 +3208,7 @@
- 	argv[1] = script_names[name];
- 	argv[2] = NULL;
- 
--	switch (fork()) { 
-+	switch (fork()) {
- 	case 0:
- 		execve(argv[0], argv, envp);
- 		plog(LLV_ERROR, LOCATION, NULL,
-@@ -3217,7 +3223,7 @@
- 		break;
- 	default:
- 		break;
--	}	
-+	}
- 	return 0;
- 
- }
-@@ -3243,7 +3249,7 @@
- 	iph1->status = PHASE1ST_EXPIRED;
- 
- 	/* Check if we have another, still valid, phase1 SA. */
--	new_iph1 = getph1byaddr(iph1->local, iph1->remote, 1);
-+	new_iph1 = getph1(iph1, iph1->local, iph1->remote, GETPH1_F_ESTABLISHED);
- 
- 	/*
- 	 * Delete all orphaned or binded to the deleting ph1handle phase2 SAs.
-@@ -3319,7 +3325,7 @@
- 					ntohl(sa->sadb_sa_spi));
- 			}else{
- 
--				/* 
-+				/*
- 				 * If we have a new ph1, do not purge IPsec-SAs binded
- 				 *  to a different ISAKMP-SA
- 				 */
-@@ -3331,7 +3337,7 @@
- 				/* If the ph2handle is established, do not purge IPsec-SA */
- 				if (iph2->status == PHASE2ST_ESTABLISHED ||
- 					iph2->status == PHASE2ST_EXPIRED) {
--					
-+
- 					plog(LLV_INFO, LOCATION, NULL,
- 						 "keeping IPsec-SA spi=%u - found valid ISAKMP-SA spi=%s.\n",
- 						 ntohl(sa->sadb_sa_spi),
-@@ -3342,7 +3348,7 @@
- 			}
- 		}
- 
--		
-+
- 		pfkey_send_delete(lcconf->sock_pfkey,
- 				  msg->sadb_msg_satype,
- 				  IPSEC_MODE_ANY,
-@@ -3373,7 +3379,7 @@
- 	sched_schedule(&iph1->sce, 1, isakmp_ph1delete_stub);
- }
- 
--void 
-+void
- delete_spd(iph2, created)
- 	struct ph2handle *iph2;
-  	u_int64_t created;
-@@ -3399,22 +3405,22 @@
- 
- 	plog(LLV_INFO, LOCATION, NULL,
- 		 "generated policy, deleting it.\n");
--		
-+
- 	memset(&spidx, 0, sizeof(spidx));
- 	iph2->spidx_gen = (caddr_t )&spidx;
--		
-+
- 	/* make inbound policy */
- 	iph2->src = dst;
- 	iph2->dst = src;
- 	spidx.dir = IPSEC_DIR_INBOUND;
- 	spidx.ul_proto = 0;
--		
--	/* 
-+
-+	/*
- 	 * Note: code from get_proposal_r
- 	 */
--		
-+
- #define _XIDT(d) ((struct ipsecdoi_id_b *)(d)->v)->type
--		
-+
- 	/*
- 	 * make destination address in spidx from either ID payload
- 	 * or phase 1 address into a address in spidx.
-@@ -3430,48 +3436,48 @@
- 									 &spidx.prefd, &spidx.ul_proto);
- 		if (error)
- 			goto purge;
--			
-+
- #ifdef INET6
- 		/*
- 		 * get scopeid from the SA address.
- 		 * note that the phase 1 source address is used as
--		 * a destination address to search for a inbound 
-+		 * a destination address to search for a inbound
- 		 * policy entry because rcoon is responder.
- 		 */
- 		if (_XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR) {
--			if ((error = 
-+			if ((error =
- 				 setscopeid((struct sockaddr *)&spidx.dst,
- 							iph2->src)) != 0)
- 				goto purge;
- 		}
- #endif
--			
-+
- 		if (_XIDT(iph2->id) == IPSECDOI_ID_IPV4_ADDR
- 			|| _XIDT(iph2->id) == IPSECDOI_ID_IPV6_ADDR)
- 			idi2type = _XIDT(iph2->id);
--			
-+
- 	} else {
--			
-+
- 		plog(LLV_DEBUG, LOCATION, NULL,
- 			 "get a destination address of SP index "
- 			 "from phase1 address "
- 			 "due to no ID payloads found "
- 			 "OR because ID type is not address.\n");
--			
-+
- 		/*
--		 * copy the SOURCE address of IKE into the 
--		 * DESTINATION address of the key to search the 
-+		 * copy the SOURCE address of IKE into the
-+		 * DESTINATION address of the key to search the
- 		 * SPD because the direction of policy is inbound.
- 		 */
- 		memcpy(&spidx.dst, iph2->src, sysdep_sa_len(iph2->src));
- 		switch (spidx.dst.ss_family) {
- 		case AF_INET:
--			spidx.prefd = 
-+			spidx.prefd =
- 				sizeof(struct in_addr) << 3;
- 			break;
- #ifdef INET6
- 		case AF_INET6:
--			spidx.prefd = 
-+			spidx.prefd =
- 				sizeof(struct in6_addr) << 3;
- 			break;
- #endif
-@@ -3480,7 +3486,7 @@
- 			break;
- 		}
- 	}
--					
-+
- 	/* make source address in spidx */
- 	if (iph2->id_p != NULL
- 		&& (_XIDT(iph2->id_p) == IPSECDOI_ID_IPV4_ADDR
-@@ -3500,7 +3506,7 @@
- 		 * for more detail, see above of this function.
- 		 */
- 		if (_XIDT(iph2->id_p) == IPSECDOI_ID_IPV6_ADDR) {
--			error = 
-+			error =
- 				setscopeid((struct sockaddr *)&spidx.src,
- 						   iph2->dst);
- 			if (error)
-@@ -3538,12 +3544,12 @@
- 		memcpy(&spidx.src, iph2->dst, sysdep_sa_len(iph2->dst));
- 		switch (spidx.src.ss_family) {
- 		case AF_INET:
--			spidx.prefs = 
-+			spidx.prefs =
- 				sizeof(struct in_addr) << 3;
- 			break;
- #ifdef INET6
- 		case AF_INET6:
--			spidx.prefs = 
-+			spidx.prefs =
- 				sizeof(struct in6_addr) << 3;
- 			break;
- #endif
-@@ -3574,14 +3580,14 @@
- 		spidx.ul_proto = IPSEC_ULPROTO_ANY;
- 
- #undef _XIDT
--	
-+
- 	/* Check if the generated SPD has the same timestamp as the SA.
- 	 * If timestamps are different, this means that the SPD entry has been
- 	 * refreshed by another SA, and should NOT be deleted with the current SA.
- 	 */
- 	if( created ){
- 		struct secpolicy *p;
--		
-+
- 		p = getsp(&spidx);
- 		if(p != NULL){
- 			/* just do no test if p is NULL, because this probably just means
-@@ -3646,7 +3652,7 @@
- 	struct sockaddr *sp_addr0, *sa_addr0;
- {
- 	struct sockaddr_in6 *sp_addr, *sa_addr;
--    
-+
- 	sp_addr = (struct sockaddr_in6 *)sp_addr0;
- 	sa_addr = (struct sockaddr_in6 *)sa_addr0;
- 
-Index: src/racoon/isakmp_var.h
-===================================================================
-RCS file: /cvsroot/src/crypto/dist/ipsec-tools/src/racoon/isakmp_var.h,v
-retrieving revision 1.15
-diff -u -r1.15 isakmp_var.h
---- a/src/racoon/isakmp_var.h	20 Apr 2009 13:24:36 -0000	1.15
-+++ b/src/racoon/isakmp_var.h	19 Aug 2009 14:35:07 -0000
-@@ -5,7 +5,7 @@
- /*
-  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
-  * All rights reserved.
-- * 
-+ *
-  * Redistribution and use in source and binary forms, with or without
-  * modification, are permitted provided that the following conditions
-  * are met:
-@@ -17,7 +17,7 @@
-  * 3. Neither the name of the project nor the names of its contributors
-  *    may be used to endorse or promote products derived from this software
-  *    without specific prior written permission.
-- * 
-+ *
-  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
-  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-@@ -87,7 +87,7 @@
- extern void isakmp_ph2delete __P((struct ph2handle *));
- 
- extern int isakmp_get_sainfo __P((struct ph2handle *, struct secpolicy *, struct secpolicy *));
--extern int isakmp_post_acquire __P((struct ph2handle *));
-+extern int isakmp_post_acquire __P((struct ph2handle *, struct ph1handle *));
- extern int isakmp_post_getspi __P((struct ph2handle *));
- extern void isakmp_chkph1there_stub __P((struct sched *));
- extern void isakmp_chkph1there __P((struct ph2handle *));
-@@ -131,7 +131,7 @@
- 	struct remoteconf *, struct sockaddr *, struct sockaddr *));
- extern void log_ph1established __P((const struct ph1handle *));
- 
--extern void script_hook __P((struct ph1handle *, int)); 
-+extern void script_hook __P((struct ph1handle *, int));
- extern int script_env_append __P((char ***, int *, char *, char *));
- extern int script_exec __P((char *, int, char * const *));
- 
-Index: src/racoon/pfkey.c
-===================================================================
-RCS file: /cvsroot/src/crypto/dist/ipsec-tools/src/racoon/pfkey.c,v
-retrieving revision 1.50
-diff -u -r1.50 pfkey.c
---- a/src/racoon/pfkey.c	10 Aug 2009 08:22:13 -0000	1.50
-+++ b/src/racoon/pfkey.c	19 Aug 2009 14:35:07 -0000
-@@ -5,7 +5,7 @@
- /*
-  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
-  * All rights reserved.
-- * 
-+ *
-  * Redistribution and use in source and binary forms, with or without
-  * modification, are permitted provided that the following conditions
-  * are met:
-@@ -17,7 +17,7 @@
-  * 3. Neither the name of the project nor the names of its contributors
-  *    may be used to endorse or promote products derived from this software
-  *    without specific prior written permission.
-- * 
-+ *
-  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
-  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-@@ -173,7 +173,7 @@
- 
- /* cope with old kame headers - ugly */
- #ifndef SADB_X_AALG_MD5
--#define SADB_X_AALG_MD5		SADB_AALG_MD5	
-+#define SADB_X_AALG_MD5		SADB_AALG_MD5
- #endif
- #ifndef SADB_X_AALG_SHA
- #define SADB_X_AALG_SHA		SADB_AALG_SHA
-@@ -353,7 +353,7 @@
- 			 "type %i, pid %i\n", msg->sadb_msg_type, msg->sadb_msg_pid);
- 		    continue;
- 		}
--		
-+
- 
- 		ml = msg->sadb_msg_len << 3;
- 		bl = buf ? buf->l : 0;
-@@ -839,7 +839,7 @@
- 			goto bad;
- 		*a_keylen >>= 3;
- 
--		if (t_id == IPSECDOI_ATTR_AUTH_HMAC_MD5 
-+		if (t_id == IPSECDOI_ATTR_AUTH_HMAC_MD5
- 		 && hashtype == IPSECDOI_ATTR_AUTH_KPDK) {
- 			/* AH_MD5 + Auth(KPDK) = RFC1826 keyed-MD5 */
- 			*a_type = SADB_X_AALG_MD5;
-@@ -919,7 +919,7 @@
- 		racoon_free(dst);
- 		return -1;
- 	}
--	
-+
- 	for (pr = pp->head; pr != NULL; pr = pr->next) {
- 
- 		/* validity check */
-@@ -991,7 +991,7 @@
-  * receive GETSPI from kernel.
-  */
- static int
--pk_recvgetspi(mhp) 
-+pk_recvgetspi(mhp)
- 	caddr_t *mhp;
- {
- 	struct sadb_msg *msg;
-@@ -1111,7 +1111,7 @@
- 		sa_args.l_addtime = iph2->lifetime_secs;
- 	else
- 		sa_args.l_addtime = iph2->approval->lifetime;
--	sa_args.seq = iph2->seq; 
-+	sa_args.seq = iph2->seq;
- 	sa_args.wsize = 4;
- 
- 	if (iph2->sa_src && iph2->sa_dst) {
-@@ -1163,7 +1163,7 @@
- 				pr->head->trns_id,
- 				pr->head->authtype,
- 				&sa_args.e_type, &sa_args.e_keylen,
--				&sa_args.a_type, &sa_args.a_keylen, 
-+				&sa_args.a_type, &sa_args.a_keylen,
- 				&sa_args.flags) < 0){
- 			racoon_free(sa_args.src);
- 			racoon_free(sa_args.dst);
-@@ -1221,11 +1221,11 @@
- 		 * But it is impossible because there is not key in the
- 		 * information from the kernel.
- 		 */
--		
-+
- 		/* change some things before backing up */
- 		sa_args.wsize = 4;
- 		sa_args.l_bytes = iph2->approval->lifebyte * 1024;
--		
-+
- 		if (backupsa_to_file(&sa_args) < 0) {
- 			plog(LLV_ERROR, LOCATION, NULL,
- 				"backuped SA failed: %s\n",
-@@ -1447,7 +1447,7 @@
- 				pr->head->trns_id,
- 				pr->head->authtype,
- 				&sa_args.e_type, &sa_args.e_keylen,
--				&sa_args.a_type, &sa_args.a_keylen, 
-+				&sa_args.a_type, &sa_args.a_keylen,
- 				&sa_args.flags) < 0){
- 			racoon_free(sa_args.src);
- 			racoon_free(sa_args.dst);
-@@ -1668,11 +1668,12 @@
- 		     " being negotiated. Stopping negotiation.\n");
- 	}
- 
--	/* turn off the timer for calling isakmp_ph2expire() */ 
-+	/* turn off the timer for calling isakmp_ph2expire() */
- 	sched_cancel(&iph2->sce);
- 
- 	if (iph2->status == PHASE2ST_ESTABLISHED &&
- 	    iph2->side == INITIATOR) {
-+		struct ph1handle *iph1hint;
- 		/*
- 		 * Active phase 2 expired and we were initiator.
- 		 * Begin new phase 2 exchange, so we can keep on sending
-@@ -1680,11 +1681,12 @@
- 		 */
- 
- 		/* update status for re-use */
-+		iph1hint = iph2->ph1;
- 		initph2(iph2);
- 		iph2->status = PHASE2ST_STATUS2;
- 
- 		/* start quick exchange */
--		if (isakmp_post_acquire(iph2) < 0) {
-+		if (isakmp_post_acquire(iph2, iph1hint) < 0) {
- 			plog(LLV_ERROR, LOCATION, iph2->dst,
- 				"failed to begin ipsec sa "
- 				"re-negotication.\n");
-@@ -1750,7 +1752,7 @@
- 	if (m_sec_ctx != NULL) {
- 		plog(LLV_INFO, LOCATION, NULL, "security context doi: %u\n",
- 		     m_sec_ctx->sadb_x_ctx_doi);
--		plog(LLV_INFO, LOCATION, NULL, 
-+		plog(LLV_INFO, LOCATION, NULL,
- 		     "security context algorithm: %u\n",
- 		     m_sec_ctx->sadb_x_ctx_alg);
- 		plog(LLV_INFO, LOCATION, NULL, "security context length: %u\n",
-@@ -1960,7 +1962,7 @@
- 
- 	/* start isakmp initiation by using ident exchange */
- 	/* XXX should be looped if there are multiple phase 2 handler. */
--	if (isakmp_post_acquire(iph2) < 0) {
-+	if (isakmp_post_acquire(iph2, NULL) < 0) {
- 		plog(LLV_ERROR, LOCATION, NULL,
- 			"failed to begin ipsec sa negotication.\n");
- 		remph2(iph2);
-@@ -2145,7 +2147,7 @@
- 		p->sadb_x_ctx_len = spidx->sec_ctx.ctx_strlen;
- 		p->sadb_x_ctx_doi = spidx->sec_ctx.ctx_doi;
- 		p->sadb_x_ctx_alg = spidx->sec_ctx.ctx_alg;
-- 
-+
- 		memcpy(p + 1,spidx->sec_ctx.ctx_str,spidx->sec_ctx.ctx_strlen);
- 		len += ctxlen;
- 	}
-@@ -2184,7 +2186,7 @@
- 			goto err;
- 		}
- 
--		/* 
-+		/*
- 		 * the policy level cannot be unique because the policy
- 		 * is defined later than SA, so req_id cannot be bound to SA.
- 		 */
-@@ -2217,7 +2219,7 @@
- 
- 		xisr->sadb_x_ipsecrequest_len = PFKEY_ALIGN8(xisrlen);
- 		xisr = (struct sadb_x_ipsecrequest *)p;
--		
-+
- 	}
- 	racoon_free(pr_rlist);
- 
-@@ -3070,6 +3072,8 @@
- 			rmconf = getrmconf(iph2->dst, 0);
- 
- 		if (rmconf && !rmconf->passive) {
-+			struct ph1handle *iph1hint;
-+
- 			plog(LLV_WARNING, LOCATION, iph2->dst, "MIGRATE received "
- 			     "*during* IPsec SA negotiation. As initiator, "
- 			     "restarting it.\n");
-@@ -3079,11 +3083,12 @@
- 			iph2->status = PHASE2ST_EXPIRED;
- 
- 			/* ... clean Phase 2 handle ... */
-+			iph1hint = iph2->ph1;
- 			initph2(iph2);
- 			iph2->status = PHASE2ST_STATUS2;
- 
- 			/* and start a new negotiation */
--			if (isakmp_post_acquire(iph2) < 0) {
-+			if (isakmp_post_acquire(iph2, iph1hint) < 0) {
- 				plog(LLV_ERROR, LOCATION, iph2->dst, "failed "
- 				     "to begin IPsec SA renegotiation after "
- 				     "MIGRATE reception.\n");
diff --git a/main/ipsec-tools/APKBUILD b/main/ipsec-tools/APKBUILD
index db1d28bf14..1b792b0b48 100644
--- a/main/ipsec-tools/APKBUILD
+++ b/main/ipsec-tools/APKBUILD
@@ -1,7 +1,7 @@
 # Maintainer: Natanael Copa <ncopa@alpinelinux.org>
 pkgname=ipsec-tools
-pkgver=0.8_alpha20090820
-_myver=0.8-alpha20090820
+pkgver=0.8_alpha20090903
+_myver=0.8-alpha20090903
 pkgrel=0
 pkgdesc="User-space IPsec tools for various IPsec implementations"
 url="http://ipsec-tools.sourceforge.net/"
@@ -12,7 +12,6 @@ subpackages="$pkgname-doc $pkgname-dev"
 source="http://downloads.sourceforge.net/$pkgname/$pkgname-$_myver.tar.gz
 	racoon.initd
 	racoon.confd
-	10-rekey-ph1hint.patch
 	50-reverse-connect.patch
 	60-debug-quick.patch
 	"
@@ -45,9 +44,8 @@ build() {
 	install -D -m644 ../racoon.confd "$pkgdir"/etc/conf.d/racoon
 }
 
-md5sums="8b79f9e773043a47d636b4c6f59b84eb  ipsec-tools-0.8-alpha20090820.tar.gz
+md5sums="8ec28d4e89c0f5e49ae2caa7463fbcfd  ipsec-tools-0.8-alpha20090903.tar.gz
 fce62b52b598be268e27609f470f8e9b  racoon.initd
 2d00250cf72da7f2f559c91b65a48747  racoon.confd
-4ee586cc6c6f1e0dd7a8bd9da0f5111d  10-rekey-ph1hint.patch
 13bda94a598aabf593280e04ea16065d  50-reverse-connect.patch
 baa13d7f0f48955c792f7fcd42a8587a  60-debug-quick.patch"