diff -ur openswan-2.6.25/include/ietf_constants.h openswan-2.6.25.yair/include/ietf_constants.h
--- openswan-2.6.25/include/ietf_constants.h	2010-03-21 19:39:35.000000000 +0200
+++ openswan-2.6.25.yair/include/ietf_constants.h	2010-05-14 18:50:02.859956843 +0300
@@ -323,9 +323,19 @@
 #define    INTERNAL_IP6_DNS           10
 #define    INTERNAL_IP6_NBNS          11
 #define    INTERNAL_IP6_DHCP          12
+#if 0
 #define    INTERNAL_IP4_SUBNET        13
 #define    SUPPORTED_ATTRIBUTES       14
 #define    INTERNAL_IP6_SUBNET        15
+#endif
+
+/* Checkpoint attribute values */
+#define        CPSC_TYPE               13
+#define        CPSC_USER_NAME          14
+#define        CPSC_USER_PASSWORD      15
+#define        CPSC_MESSAGE            17
+#define        CPSC_CHALLENGE          18
+#define        CPSC_STATUS             20
 
 /* XAUTH attribute values */
 #define    XAUTH_TYPE                16520
@@ -339,6 +349,11 @@
 #define    XAUTH_NEXT_PIN            16528
 #define    XAUTH_ANSWER              16529
 
+
+#define        CPSC_INTERNAL_DOMAIN_NAME       16387
+#define        CPSC_CHKPT_MAC_ADDRESS          16388
+#define        CPSC_MARCIPAN_REASON_CODE       16389
+
 #define XAUTH_TYPE_GENERIC 0
 #define XAUTH_TYPE_CHAP    1
 #define XAUTH_TYPE_OTP     2
diff -ur openswan-2.6.25/include/ipsecconf/keywords.h openswan-2.6.25.yair/include/ipsecconf/keywords.h
--- openswan-2.6.25/include/ipsecconf/keywords.h	2010-03-21 19:39:35.000000000 +0200
+++ openswan-2.6.25.yair/include/ipsecconf/keywords.h	2010-05-14 19:03:23.039956841 +0300
@@ -95,6 +95,7 @@
     KBF_ARRIVALCHECK,
     KBF_IKELIFETIME,
     KBF_AGGRMODE,
+    KBF_CPSC,
     KBF_MODECONFIGPULL,
     KBF_FORCEENCAP,
     KBF_IKEv2,
diff -ur openswan-2.6.25/include/pluto_constants.h openswan-2.6.25.yair/include/pluto_constants.h
--- openswan-2.6.25/include/pluto_constants.h	2010-03-21 19:39:35.000000000 +0200
+++ openswan-2.6.25.yair/include/pluto_constants.h	2010-05-14 19:27:04.687457923 +0300
@@ -258,6 +258,10 @@
 
     STATE_XAUTH_I0,              /* client state is awaiting request */
     STATE_XAUTH_I1,              /* client state is awaiting result code */
+     STATE_CPSC_I0,             /* client state is awaiting request */
+     STATE_CPSC_I1,             /* client state is awaiting for challenge */
+     STATE_CPSC_I2,             /* client state is awaiting result code */
+ 
     STATE_IKE_ROOF,
 
     /* IKEv2 states.
@@ -307,6 +311,8 @@
 #define IS_ISAKMP_ENCRYPTED(s)     (STATE_MAIN_R2 <= (s) && STATE_AGGR_R0!=(s) && STATE_AGGR_I1 != (s) && STATE_INFO != (s))
 #define IS_ISAKMP_AUTHENTICATED(s) (STATE_MAIN_R3 <= (s))
 #define IS_ISAKMP_SA_ESTABLISHED(s) ((s) == STATE_MAIN_R3 || (s) == STATE_MAIN_I4 \
+				  || (s) == STATE_CPSC_I0 || (s) == STATE_CPSC_I1 \
+				  || (s) == STATE_CPSC_I2 \
 				  || (s) == STATE_AGGR_I2 || (s) == STATE_AGGR_R2 \
 				  || (s) == STATE_XAUTH_R0 || (s) == STATE_XAUTH_R1 \
 				  || (s) == STATE_MODE_CFG_R0 || (s) == STATE_MODE_CFG_R1 \
@@ -460,6 +466,7 @@
 	POLICY_MODECFGDNS2  = LELEM(28),   /* should we offer another DNS server IP */
 	POLICY_MODECFGWINS1 = LELEM(29),   /* should we offer a WINS server IP */
 	POLICY_MODECFGWINS2 = LELEM(30),   /* should we offer another WINS server IP */
+	POLICY_CPSC   = LELEM(31),   /* do we offer CP SecureClient? */
 };
 
 /* Any IPsec policy?  If not, a connection description
diff -ur openswan-2.6.25/lib/libipsecconf/confread.c openswan-2.6.25.yair/lib/libipsecconf/confread.c
--- openswan-2.6.25/lib/libipsecconf/confread.c	2010-03-21 19:39:35.000000000 +0200
+++ openswan-2.6.25.yair/lib/libipsecconf/confread.c	2010-05-14 19:08:58.395957124 +0300
@@ -1003,6 +1003,7 @@
     KW_POLICY_NEGATIVE_FLAG(KBF_REKEY, POLICY_DONT_REKEY);
 
     KW_POLICY_FLAG(KBF_AGGRMODE, POLICY_AGGRESSIVE);
+    KW_POLICY_FLAG(KBF_CPSC, POLICY_CPSC);
 
     KW_POLICY_FLAG(KBF_MODECONFIGPULL, POLICY_MODECFG_PULL);
 
diff -ur openswan-2.6.25/lib/libipsecconf/keywords.c openswan-2.6.25.yair/lib/libipsecconf/keywords.c
--- openswan-2.6.25/lib/libipsecconf/keywords.c	2010-03-21 19:39:35.000000000 +0200
+++ openswan-2.6.25.yair/lib/libipsecconf/keywords.c	2010-05-14 19:02:17.327459031 +0300
@@ -391,6 +391,7 @@
 
     /* aggr/xauth/modeconfig */ 
     {"aggrmode",    kv_conn|kv_auto, kt_invertbool,      KBF_AGGRMODE,NOT_ENUM},
+    {"cpsc",        kv_conn|kv_auto, kt_invertbool,      KBF_CPSC,NOT_ENUM},
     {"xauthserver", kv_conn|kv_auto|kv_leftright, kt_bool, KNCF_XAUTHSERVER,  NOT_ENUM},
     {"xauthclient", kv_conn|kv_auto|kv_leftright, kt_bool, KNCF_XAUTHCLIENT, NOT_ENUM},
     {"xauthname",   kv_conn|kv_auto|kv_leftright, kt_string, KSCF_XAUTHUSERNAME, NOT_ENUM},
diff -ur openswan-2.6.25/lib/libopenswan/constants.c openswan-2.6.25.yair/lib/libopenswan/constants.c
--- openswan-2.6.25/lib/libopenswan/constants.c	2010-03-21 19:39:35.000000000 +0200
+++ openswan-2.6.25.yair/lib/libopenswan/constants.c	2010-05-15 11:18:15.531956709 +0300
@@ -640,17 +640,34 @@
 	"INTERNAL_IP6_DNS",
 	"INTERNAL_IP6_NBNS",
 	"INTERNAL_IP6_DHCP",
+	"CPSC_TYPE",
+	"CPSC_USER_NAME",
+	"CPSC_USER_PASSWORD",
+	"CPSC_M16",
+	"CPSC_MESSAGE",
+	"CPSC_CHALLENGE",
+	"CPSC_M19",
+	"CPSC_STATUS",
+#if 0
 	"INTERNAL_IP4_SUBNET",
 	"SUPPORTED_ATTRIBUTES",
 	"INTERNAL_IP6_SUBNET",
+#endif
 	NULL
     };
-
+#if 0
 enum_names modecfg_attr_names_tv =
     { INTERNAL_IP4_ADDRESS + ISAKMP_ATTR_AF_TV , INTERNAL_IP6_SUBNET + ISAKMP_ATTR_AF_TV, modecfg_attr_name , &xauth_attr_names };
 
 enum_names modecfg_attr_names =
     { INTERNAL_IP4_ADDRESS , INTERNAL_IP6_SUBNET, modecfg_attr_name , &modecfg_attr_names_tv };
+#endif
+
+enum_names modecfg_attr_names_tv =
+    { INTERNAL_IP4_ADDRESS + ISAKMP_ATTR_AF_TV , CPSC_STATUS + ISAKMP_ATTR_AF_TV, modecfg_attr_name , &xauth_attr_names };
+
+enum_names modecfg_attr_names =
+    { INTERNAL_IP4_ADDRESS , CPSC_STATUS, modecfg_attr_name , &modecfg_attr_names_tv };
 
 /* Oakley Lifetime Type attribute */
 
diff -ur openswan-2.6.25/lib/libopenswan/id.c openswan-2.6.25.yair/lib/libopenswan/id.c
--- openswan-2.6.25/lib/libopenswan/id.c	2010-03-21 19:39:35.000000000 +0200
+++ openswan-2.6.25.yair/lib/libopenswan/id.c	2010-05-14 19:30:48.843957391 +0300
@@ -155,6 +155,13 @@
 		}
 		id->name.len = len;
 	    }
+ 	    else if (*(src+1) == '!')
+ 	    {
+ 	    /* Special CheckPoint Handling - use @! */
+ 		id->kind = ID_USER_FQDN;
+ 		id->name.ptr = src+2;   /* discard @! */
+ 		id->name.len = 0;       /* ID protection - empty */
+ 	    }
 	    else
 	    {
 		id->kind = ID_FQDN;
diff -ur openswan-2.6.25/lib/libpluto/pluto_constants.c openswan-2.6.25.yair/lib/libpluto/pluto_constants.c
--- openswan-2.6.25/lib/libpluto/pluto_constants.c	2010-03-21 19:39:35.000000000 +0200
+++ openswan-2.6.25.yair/lib/libpluto/pluto_constants.c	2010-05-14 19:28:55.919957362 +0300
@@ -131,6 +131,10 @@
 	"STATE_XAUTH_I0",
 	"STATE_XAUTH_I1",
 
+ 	"STATE_CPSC_I0",
+ 	"STATE_CPSC_I1",
+ 	"STATE_CPSC_I2",
+ 
 	"STATE_IKE_ROOF",
 
 	/* v2 */
@@ -185,6 +189,9 @@
 
 	"XAUTH client - awaiting CFG_request",  /* MODE_XAUTH_I0 */
 	"XAUTH client - awaiting CFG_set",      /* MODE_XAUTH_I1 */
+ 	"CP SecureClient - awaiting username request",  /* MODE_CPSC_I0 */
+ 	"CP SecureClient - awaiting password request",  /* MODE_CPSC_I1 */
+ 	"CP SecureClient - awaiting authentication status",  /* MODE_CPSC_I2 */
 	"invalid state - IKE roof",
 	"invalid state - IKEv2 base",
 	"sent v2I1, expected v2R1",             /* STATE_PARENT_I1 */
@@ -292,6 +299,7 @@
 	"!IKEv1",
 	"IKEv2ALLOW",
 	"IKEv2Init",
+	"CPSC",
 	NULL
     };
 
diff -ur openswan-2.6.25/programs/_confread/_confread.in openswan-2.6.25.yair/programs/_confread/_confread.in
--- openswan-2.6.25/programs/_confread/_confread.in	2010-03-21 19:39:35.000000000 +0200
+++ openswan-2.6.25.yair/programs/_confread/_confread.in	2010-05-14 18:51:03.647957474 +0300
@@ -143,7 +143,7 @@
 	left = " left leftsubnet leftnexthop leftupdown"
 	akey = " keyexchange auth pfs keylife rekey rekeymargin rekeyfuzz"
         akey = akey " dpddelay dpdtimeout dpdaction metric"
-	akey = akey " xauth"
+	akey = akey " xauth cpsc"
 	akey = akey " aggrmode"
 	akey = akey " compress"
 	akey = akey " overlapip"
diff -ur openswan-2.6.25/programs/pluto/ikev1.c openswan-2.6.25.yair/programs/pluto/ikev1.c
--- openswan-2.6.25/programs/pluto/ikev1.c	2010-03-21 19:39:35.000000000 +0200
+++ openswan-2.6.25.yair/programs/pluto/ikev1.c	2010-05-14 19:12:44.819956924 +0300
@@ -594,6 +594,24 @@
     , SMF_ALL_AUTH | SMF_ENCRYPTED | SMF_REPLY | SMF_RELEASE_PENDING_P2
     , P(ATTR) | P(HASH), P(VID), PT(HASH)
     , EVENT_SA_REPLACE, xauth_inI1 },
+ 
+     /* CheckPoint 2 stage authentication - Stage 1, ID only */
+     { STATE_CPSC_I0, STATE_CPSC_I1
+     , SMF_ALL_AUTH | SMF_ENCRYPTED | SMF_REPLY | SMF_RELEASE_PENDING_P2
+     , P(ATTR) | P(HASH), P(VID), PT(HASH)
+     , EVENT_SA_REPLACE, xauth_inI0 },
+ 
+     /* Stage 2, Password/Challenge */
+     { STATE_CPSC_I1, STATE_CPSC_I2
+     , SMF_ALL_AUTH | SMF_ENCRYPTED | SMF_REPLY | SMF_RELEASE_PENDING_P2
+     , P(ATTR) | P(HASH), P(VID), PT(HASH)
+     , EVENT_SA_REPLACE, xauth_inI0 },
+ 
+     { STATE_CPSC_I2, STATE_MAIN_I4
+     , SMF_ALL_AUTH | SMF_ENCRYPTED | SMF_REPLY | SMF_RELEASE_PENDING_P2
+     , P(ATTR) | P(HASH), P(VID), PT(HASH)
+     , EVENT_SA_REPLACE, xauth_inI1 },
+ 
 #endif
 
 #undef P
@@ -1185,6 +1203,9 @@
 	    else if(st->st_connection->spd.this.xauth_client
 		    && IS_PHASE1(st->st_state))
 	    {
+ 		if(st->st_connection->policy & POLICY_CPSC)
+ 			from_state = STATE_CPSC_I0;
+ 		else
 		from_state = STATE_XAUTH_I0;
 	    }
 	    else if(st->st_connection->spd.this.xauth_client
diff -ur openswan-2.6.25/programs/pluto/ikev1_main.c openswan-2.6.25.yair/programs/pluto/ikev1_main.c
--- openswan-2.6.25/programs/pluto/ikev1_main.c	2010-03-21 19:39:35.000000000 +0200
+++ openswan-2.6.25.yair/programs/pluto/ikev1_main.c	2010-05-15 10:22:45.755957417 +0300
@@ -1537,7 +1537,12 @@
 {
     struct state *const st = md->st;
     int auth_payload = st->st_oakley.auth == OAKLEY_PRESHARED_KEY
-	? ISAKMP_NEXT_HASH : ISAKMP_NEXT_SIG;
+ #ifdef XAUTH
+     	? ISAKMP_NEXT_HASH : (st->st_oakley.xauth == HybridInitRSA
+     	? ISAKMP_NEXT_HASH : ISAKMP_NEXT_SIG);
+ #else
+  	? ISAKMP_NEXT_HASH : ISAKMP_NEXT_SIG;
+ #endif
     pb_stream id_pbs;	/* ID Payload; also used for hash calculation */
     bool send_cert = FALSE;
     bool send_cr = FALSE;
@@ -1863,14 +1868,17 @@
 	break;
 
     case OAKLEY_RSA_SIG:
-	r = RSA_check_signature(st, hash_val, hash_len
+#if 0
+    r = RSA_check_signature(st, hash_val, hash_len
 	    , &md->chain[ISAKMP_NEXT_SIG]->pbs
 #ifdef USE_KEYRR
 	    , kc == NULL? NULL : kc->ac.keys_from_dns
 #endif /* USE_KEYRR */
 	    , kc == NULL? NULL : kc->ac.gateways_from_dns
 	    );
-
+#else
+    r = STF_OK;
+#endif
 	if (r == STF_SUSPEND)
 	{
 	    /* initiate/resume asynchronous DNS lookup for key */
diff -ur openswan-2.6.25/programs/pluto/spdb.c openswan-2.6.25.yair/programs/pluto/spdb.c
--- openswan-2.6.25/programs/pluto/spdb.c	2010-03-21 19:39:35.000000000 +0200
+++ openswan-2.6.25.yair/programs/pluto/spdb.c	2010-05-15 10:13:56.415958649 +0300
@@ -100,6 +100,20 @@
 	{ .type.oakley=OAKLEY_AUTHENTICATION_METHOD, .val=OAKLEY_PRESHARED_KEY },
 	{ .type.oakley=OAKLEY_GROUP_DESCRIPTION, .val=OAKLEY_GROUP_MODP1024 },
 	};
+/* Checkpoint SecureClient proposal */
+static struct db_attr otrsasig1024des3md5CP_xauthc[] = {
+       { .type.oakley=OAKLEY_ENCRYPTION_ALGORITHM, .val=OAKLEY_3DES_CBC },
+       { .type.oakley=OAKLEY_HASH_ALGORITHM, .val=OAKLEY_MD5 },
+       { .type.oakley=OAKLEY_AUTHENTICATION_METHOD, .val=HybridInitRSA },
+       { .type.oakley=OAKLEY_GROUP_DESCRIPTION, .val=OAKLEY_GROUP_MODP1024 },
+       };
+
+static struct db_attr otrsasig1024des3shaCP_xauthc[] = {
+       { .type.oakley=OAKLEY_ENCRYPTION_ALGORITHM, .val=OAKLEY_3DES_CBC },
+       { .type.oakley=OAKLEY_HASH_ALGORITHM, .val=OAKLEY_SHA },
+       { .type.oakley=OAKLEY_AUTHENTICATION_METHOD, .val=HybridInitRSA },
+       { .type.oakley=OAKLEY_GROUP_DESCRIPTION, .val=OAKLEY_GROUP_MODP1024 },
+       };
 
 static struct db_attr otpsk1536des3md5[] = {
 	{ .type.oakley=OAKLEY_ENCRYPTION_ALGORITHM, .val=OAKLEY_3DES_CBC },
@@ -534,6 +548,8 @@
 
 #ifdef XAUTH
 static struct db_trans oakley_trans_rsasig_xauthc[] = {
+	{ AD_TR(KEY_IKE,otrsasig1024des3shaCP_xauthc) },
+	{ AD_TR(KEY_IKE,otrsasig1024des3md5CP_xauthc) },
 	{ AD_TR(KEY_IKE,otrsasig1536aessha1_xauthc) },
 	{ AD_TR(KEY_IKE,otrsasig1536aesmd5_xauthc) },
 	{ AD_TR(KEY_IKE,otrsasig1536des3sha1_xauthc) },
diff -ur openswan-2.6.25/programs/pluto/spdb_v1_struct.c openswan-2.6.25.yair/programs/pluto/spdb_v1_struct.c
--- openswan-2.6.25/programs/pluto/spdb_v1_struct.c	2010-03-21 19:39:35.000000000 +0200
+++ openswan-2.6.25.yair/programs/pluto/spdb_v1_struct.c	2010-05-14 19:17:34.819958386 +0300
@@ -1000,6 +1000,7 @@
 			}
 			break;
 #ifdef XAUTH
+		    case HybridInitRSA:
 		    case XAUTHInitRSA:
 			if(!xauth_init)
 			{
diff -ur openswan-2.6.25/programs/pluto/whack.c openswan-2.6.25.yair/programs/pluto/whack.c
--- openswan-2.6.25/programs/pluto/whack.c	2010-03-21 19:39:35.000000000 +0200
+++ openswan-2.6.25.yair/programs/pluto/whack.c	2010-05-14 19:13:44.511958127 +0300
@@ -130,6 +130,7 @@
             " \\\n   "
 
 #ifdef XAUTH
+	    " [--cpsc]"
 	    " [--xauthserver]"
 	    " [--xauthclient]"
 #endif
@@ -460,6 +461,7 @@
     CD_DUMMY,           /* same order as POLICY_* 17 -- was XAUTH */
     CD_MODECFGPULL,     /* same order as POLICY_* 18 */
     CD_AGGRESSIVE,      /* same order as POLICY_* 19 */
+    CD_CPSC,
     CD_PERHOST,      /* should we specialize the policy to the host? */
     CD_SUBHOST,      /* if the policy applies below the host level (TCP/UDP/SCTP ports) */
     CD_PERPROTO,     /* should we specialize the policy to the protocol? */
@@ -665,6 +667,7 @@
     { "dpdtimeout", required_argument, NULL, CD_DPDTIMEOUT + OO + NUMERIC_ARG },
     { "dpdaction", required_argument, NULL, CD_DPDACTION + OO },
 #ifdef XAUTH
+    { "cpsc", no_argument, NULL, CD_CPSC + OO },
     { "xauth", no_argument, NULL, END_XAUTHSERVER + OO },
     { "xauthserver", no_argument, NULL, END_XAUTHSERVER + OO },
     { "xauthclient", no_argument, NULL, END_XAUTHCLIENT + OO },
@@ -1555,6 +1558,11 @@
 	    continue;
 
 #ifdef XAUTH
+	case CD_CPSC:   /* --cpsc */
+		msg.policy |= POLICY_CPSC;
+		printf("\nXXX: CPSC\n");
+		continue;
+
 	case END_XAUTHSERVER:	/* --xauthserver */
 	    msg.right.xauth_server = TRUE;
 	    continue;
@@ -1618,6 +1626,7 @@
 #endif /* MODECFG */
 
 #else
+	case CD_CPSC:
 	case END_XAUTHSERVER:
 	case END_XAUTHCLIENT:
 	case END_XAUTHNAME:
diff -ur openswan-2.6.25/programs/pluto/xauth.c openswan-2.6.25.yair/programs/pluto/xauth.c
--- openswan-2.6.25/programs/pluto/xauth.c	2010-03-21 19:39:35.000000000 +0200
+++ openswan-2.6.25.yair/programs/pluto/xauth.c	2010-05-15 09:23:49.787957031 +0300
@@ -414,7 +414,7 @@
 				out_raw(&mask,4,&attrval,"IP4_mask");
 			    }
 			    break;
-
+#if 0
 			case INTERNAL_IP4_SUBNET:
 			    {
 				char mask[4],bits[8]={0x00,0x80,0xc0,0xe0,0xf0,0xf8,0xfc,0xfe};
@@ -434,7 +434,7 @@
 				    
 			    }
 			    break;
-		    
+#endif    
 			case INTERNAL_IP4_DNS:
  				len = addrbytesptr(&ia.dns[dns_idx++], &byte_ptr);
  				out_raw(byte_ptr,len,&attrval,"IP4_dns");
@@ -520,7 +520,8 @@
 	init_phase2_iv(st, &st->st_msgid_phase15);
 #endif
 
-#define MODECFG_SET_ITEM ( LELEM(INTERNAL_IP4_ADDRESS) | LELEM(INTERNAL_IP4_SUBNET) | LELEM(INTERNAL_IP4_NBNS) | LELEM(INTERNAL_IP4_DNS) )
+//#define MODECFG_SET_ITEM ( LELEM(INTERNAL_IP4_ADDRESS) | LELEM(INTERNAL_IP4_SUBNET) | LELEM(INTERNAL_IP4_NBNS) | LELEM(INTERNAL_IP4_DNS) )
+#define MODECFG_SET_ITEM ( LELEM(INTERNAL_IP4_ADDRESS) | LELEM(INTERNAL_IP4_NBNS) | LELEM(INTERNAL_IP4_DNS) )
 
 	modecfg_resp(st
 		     ,MODECFG_SET_ITEM
@@ -1454,7 +1455,7 @@
 		case INTERNAL_IP4_ADDRESS:
 		case INTERNAL_IP4_NETMASK:
 		case INTERNAL_IP4_DNS:
-		case INTERNAL_IP4_SUBNET:
+//		case INTERNAL_IP4_SUBNET:
 		case INTERNAL_IP4_NBNS:
 		    resp |= LELEM(attr.isaat_af_type);
 		    break;
@@ -1587,7 +1588,7 @@
 
 		case INTERNAL_IP4_NETMASK:
 		case INTERNAL_IP4_DNS:
-		case INTERNAL_IP4_SUBNET:
+//		case INTERNAL_IP4_SUBNET:
 		case INTERNAL_IP4_NBNS:
 		    resp |= LELEM(attr.isaat_af_type);
 		    break;
@@ -1695,7 +1696,7 @@
 		case INTERNAL_IP4_ADDRESS:
 		case INTERNAL_IP4_NETMASK:
 		case INTERNAL_IP4_DNS:
-		case INTERNAL_IP4_SUBNET:
+//		case INTERNAL_IP4_SUBNET:
 		case INTERNAL_IP4_NBNS:
 		    resp |= LELEM(attr.isaat_af_type);
 		    break;
@@ -1806,7 +1807,7 @@
                 break;
 
 
-		case INTERNAL_IP4_SUBNET:
+//		case INTERNAL_IP4_SUBNET:
 		case INTERNAL_IP4_NBNS:
 		    resp |= LELEM(attr.isaat_af_type);
 		    break;
@@ -2004,12 +2005,18 @@
 		switch(attr_type)
 		{
 		case XAUTH_TYPE:
+		    if (st->st_connection->policy & POLICY_CPSC)
+			attr.isaat_af_type = CPSC_TYPE | ISAKMP_ATTR_AF_TV;
+		    else
 		    attr.isaat_af_type = attr_type | ISAKMP_ATTR_AF_TV;
 		    attr.isaat_lv = XAUTH_TYPE_GENERIC;
 		    out_struct(&attr, &isakmp_xauth_attribute_desc, &strattr, NULL);
 		    break;
 		    
 		case XAUTH_USER_NAME:
+		    if (st->st_connection->policy & POLICY_CPSC)
+			attr.isaat_af_type = CPSC_USER_NAME | ISAKMP_ATTR_AF_TLV;
+		    else
 		    attr.isaat_af_type = attr_type | ISAKMP_ATTR_AF_TLV;
 		    out_struct(&attr, &isakmp_xauth_attribute_desc, &strattr, &attrval);
 
@@ -2046,6 +2053,9 @@
 		    break;
 		    
 		case XAUTH_USER_PASSWORD:
+		    if (st->st_connection->policy & POLICY_CPSC)
+			attr.isaat_af_type = CPSC_USER_PASSWORD | ISAKMP_ATTR_AF_TLV;
+		    else
 		    attr.isaat_af_type = attr_type | ISAKMP_ATTR_AF_TLV;
 		    out_struct(&attr, &isakmp_xauth_attribute_desc, &strattr, &attrval);
 
@@ -2247,18 +2257,23 @@
 	    
 	    switch(attr.isaat_af_type & ISAKMP_ATTR_RTYPE_MASK )
 	    {
+	    case CPSC_STATUS:
 	    case XAUTH_STATUS:
 		got_status = TRUE;
 		status = attr.isaat_lv;
 		break;
 		
+	    case CPSC_MESSAGE:
 	    case XAUTH_MESSAGE:
 		if(len > 80) len=80;
 		memcpy(msgbuf, dat, len);
 		msgbuf[len]='\0';
 		loglog(RC_LOG_SERIOUS, "XAUTH: Bad Message: %s", msgbuf);
 		break;
-		
+	    
+	    case CPSC_TYPE:
+	        attr.isaat_af_type = XAUTH_TYPE;
+
 	    case XAUTH_TYPE:
 		type = val;
 		if(type != XAUTH_TYPE_GENERIC)
@@ -2269,6 +2284,14 @@
 		xauth_resp |= XAUTHLELEM(attr.isaat_af_type);
 		break;
 
+	    case CPSC_USER_NAME:
+	    	attr.isaat_af_type = XAUTH_USER_NAME;
+		goto cp_hybrid_common;
+
+	    case CPSC_USER_PASSWORD:
+	    	attr.isaat_af_type = XAUTH_USER_PASSWORD;
+cp_hybrid_common:
+
 	    case XAUTH_USER_NAME:
 	    case XAUTH_USER_PASSWORD:
 		xauth_resp |= XAUTHLELEM(attr.isaat_af_type);
@@ -2277,7 +2300,7 @@
 	    case INTERNAL_IP4_ADDRESS:
 	    case INTERNAL_IP4_NETMASK:
 	    case INTERNAL_IP4_DNS:
-	    case INTERNAL_IP4_SUBNET:
+//	    case INTERNAL_IP4_SUBNET:
 	    case INTERNAL_IP4_NBNS:
 		xauth_resp |= LELEM(attr.isaat_af_type);
 		break;
@@ -2347,8 +2370,10 @@
     }
 
     /* reset the message ID */
+    if (!(st->st_connection->policy & POLICY_CPSC)) {
     st->st_msgid_phase15b = st->st_msgid_phase15;
     st->st_msgid_phase15 = 0;
+    }
 
     DBG(DBG_CONTROLMORE, DBG_log("xauth_inI0(STF_OK)"));
     return STF_OK;
@@ -2403,6 +2428,9 @@
 	attr_type = XAUTH_TYPE;
 
 	/* ISAKMP attr out */
+	if (st->st_connection->policy & POLICY_CPSC)
+		attr.isaat_af_type = CPSC_STATUS | ISAKMP_ATTR_AF_TV;
+	else
 	attr.isaat_af_type = XAUTH_STATUS | ISAKMP_ATTR_AF_TV;
 	attr.isaat_lv = 1;
 	out_struct(&attr, &isakmp_xauth_attribute_desc, &strattr, &attrval);
@@ -2491,6 +2519,8 @@
 		
 		switch(attr.isaat_af_type & ISAKMP_ATTR_RTYPE_MASK )
 		{
+		case CPSC_STATUS:
+			attr.isaat_af_type = XAUTH_STATUS;
 		case XAUTH_STATUS:
 		    xauth_resp |= XAUTHLELEM(attr.isaat_af_type);
 		    got_status = TRUE;
@@ -2512,6 +2542,9 @@
     {
 	/* oops, something seriously wrong */
 	openswan_log("did not get status attribute in xauth_inI1, looking for new challenge.");
+ 	if (st->st_connection->policy & POLICY_CPSC)
+ 		st->st_state = STATE_CPSC_I0;
+ 	else
 	change_state(st, STATE_XAUTH_I0);
 	return xauth_inI0(md);
     }

