moved typedefs to beginning of files to solve some include problems

splitted authenticator to have a separate implementation for each auth_method_t
using va_copy to clone va_lists, should fix proplems on AMD64
some other cleanups

src/charon/sa/transactions/create_child_sa.c

@@ -337,7 +337,8 @@ static status_t get_request(private_create_child_sa_t *this, message_t **result)
 		request->add_payload(request, (payload_t*)notify);
 		
 		/* register us as rekeying to detect multiple rekeying */
-		this->rekeyed_sa->set_rekeying_transaction(this->rekeyed_sa, &this->public);
+		this->rekeyed_sa->set_rekeying_transaction(this->rekeyed_sa,
+												   &this->public.transaction);
 	}
 	
 	this->message_id = this->ike_sa->get_next_message_id(this->ike_sa);
@@ -718,7 +719,8 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
 	{
 		private_create_child_sa_t *other;
 		
-		other = this->rekeyed_sa->get_rekeying_transaction(this->rekeyed_sa);
+		other = (private_create_child_sa_t*)
+			this->rekeyed_sa->get_rekeying_transaction(this->rekeyed_sa);
 		if (other)
 		{
 			/* store our lower nonce in the simultaneus transaction, it 

src/charon/sa/transactions/create_child_sa.h

@@ -23,12 +23,11 @@
 #ifndef CREATE_CHILD_SA_H_
 #define CREATE_CHILD_SA_H_
 
+typedef struct create_child_sa_t create_child_sa_t;
+
+#include <sa/transactions/transaction.h>
 #include <sa/ike_sa.h>
 #include <sa/child_sa.h>
-#include <sa/transactions/transaction.h>
-
-
-typedef struct create_child_sa_t create_child_sa_t;
 
 /**
  * @brief A transaction to create a new or rekey an existing CHILD_SA.

src/charon/sa/transactions/dead_peer_detection.h

@@ -24,12 +24,11 @@
 #ifndef DEAD_PEER_DETECTION_H_
 #define DEAD_PEER_DETECTION_H_
 
+typedef struct dead_peer_detection_t dead_peer_detection_t;
+
 #include <sa/ike_sa.h>
 #include <sa/transactions/transaction.h>
 
-
-typedef struct dead_peer_detection_t dead_peer_detection_t;
-
 /**
  * @brief A transaction used to detect dead peers.
  *

src/charon/sa/transactions/delete_child_sa.c

@@ -180,7 +180,7 @@ static status_t process_delete(private_delete_child_sa_t *this, delete_payload_t
 			DBG1(DBG_IKE, "received DELETE for %N CHILD_SA with SPI 0x%x, deleting",
 				 protocol_id_names, protocol, ntohl(spi));
 			
-			rekey = child_sa->get_rekeying_transaction(child_sa);
+			rekey = (create_child_sa_t*)child_sa->get_rekeying_transaction(child_sa);
 			if (rekey)
 			{
 				/* we have received a delete for an SA which we are still rekeying.

src/charon/sa/transactions/delete_child_sa.h

@@ -24,12 +24,12 @@
 #ifndef DELETE_CHILD_SA_H_
 #define DELETE_CHILD_SA_H_
 
+typedef struct delete_child_sa_t delete_child_sa_t;
+
 #include <sa/ike_sa.h>
 #include <sa/transactions/transaction.h>
 
 
-typedef struct delete_child_sa_t delete_child_sa_t;
-
 /**
  * @brief A transaction used to delete a CHILD_SA.
  *

src/charon/sa/transactions/delete_ike_sa.h

@@ -24,12 +24,11 @@
 #ifndef DELETE_IKE_SA_H_
 #define DELETE_IKE_SA_H_
 
+typedef struct delete_ike_sa_t delete_ike_sa_t;
+
 #include <sa/ike_sa.h>
 #include <sa/transactions/transaction.h>
 
-
-typedef struct delete_ike_sa_t delete_ike_sa_t;
-
 /**
  * @brief A transaction used to delete the IKE_SA.
  *

src/charon/sa/transactions/ike_auth.c

@@ -33,7 +33,7 @@
 #include <encoding/payloads/certreq_payload.h>
 #include <encoding/payloads/auth_payload.h>
 #include <encoding/payloads/ts_payload.h>
-#include <sa/authenticator.h>
+#include <sa/authenticators/authenticator.h>
 #include <sa/child_sa.h>
 
 
@@ -238,7 +238,7 @@ static status_t get_request(private_ike_auth_t *this, message_t **result)
 	}
 	
 	/* build certificate payload. TODO: Handle certreq from init_ike_sa. */
-	if (this->policy->get_auth_method(this->policy) == RSA_DIGITAL_SIGNATURE
+	if (this->policy->get_auth_method(this->policy) == AUTH_RSA
 	&&  this->connection->get_cert_policy(this->connection) != CERT_NEVER_SEND)
 	{
 		cert_payload_t *cert_payload;
@@ -273,13 +273,15 @@ static status_t get_request(private_ike_auth_t *this, message_t **result)
 		
 		auth_method = this->policy->get_auth_method(this->policy);
 		authenticator = authenticator_create(this->ike_sa, auth_method);
-		status = authenticator->compute_auth_data(authenticator,
-												  &auth_payload,
-												  this->init_request,
-												  this->nonce_r,
-												  my_id,
-												  other_id,
-												  TRUE);
+		if (authenticator == NULL)
+		{
+			SIG(IKE_UP_FAILED, "auth method %N not supported, deleting IKE_SA",
+			    auth_method_names, auth_method);
+			SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
+			return DESTROY_ME;
+		}
+		status = authenticator->build(authenticator, this->init_request,
+									  this->nonce_r, &auth_payload);
 		authenticator->destroy(authenticator);
 		if (status != SUCCESS)
 		{
@@ -718,7 +720,7 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
 		response->add_payload(response, (payload_t*)idr_response);
 	}
 	
-	if (this->policy->get_auth_method(this->policy) == RSA_DIGITAL_SIGNATURE
+	if (this->policy->get_auth_method(this->policy) == AUTH_RSA
 	&&  this->connection->get_cert_policy(this->connection) != CERT_NEVER_SEND)
 	{	/* build certificate payload */
 		x509_t *cert;
@@ -747,28 +749,37 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
 		auth_method_t auth_method;
 		status_t status;
 		
-		auth_method = this->policy->get_auth_method(this->policy);
+		auth_method = auth_request->get_auth_method(auth_request);
 		authenticator = authenticator_create(this->ike_sa, auth_method);
-		status = authenticator->verify_auth_data(authenticator, auth_request,
-												 this->init_request,
-												 this->nonce_r,
-												 my_id,
-												 other_id,
-												 TRUE);
+		if (authenticator == NULL)
+		{
+			SIG(IKE_UP_FAILED, "auth method %N not supported, deleting IKE_SA",
+				auth_method_names, auth_method);
+			SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
+			return DESTROY_ME;
+		}
+		status = authenticator->verify(authenticator, this->init_request,
+									   this->nonce_r, auth_request);
+		authenticator->destroy(authenticator);
 		if (status != SUCCESS)
 		{
 			SIG(IKE_UP_FAILED, "authentication failed, deleting IKE_SA");
 			SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
 			build_notify(AUTHENTICATION_FAILED, response, TRUE);
-			authenticator->destroy(authenticator);
 			return DESTROY_ME;
 		}
-		status = authenticator->compute_auth_data(authenticator, &auth_response,
-												  this->init_response,
-												  this->nonce_i,
-												  my_id,
-												  other_id,
-												  FALSE);
+		
+		auth_method = this->policy->get_auth_method(this->policy);
+		authenticator = authenticator_create(this->ike_sa, auth_method);
+		if (authenticator == NULL)
+		{
+			SIG(IKE_UP_FAILED, "auth method %N not supported, deleting IKE_SA",
+				auth_method_names, auth_method);
+			SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
+			return DESTROY_ME;
+		}
+		status = authenticator->build(authenticator, this->init_response,
+									  this->nonce_i, &auth_response);
 		authenticator->destroy(authenticator);
 		if (status != SUCCESS)
 		{
@@ -968,17 +979,18 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
 		auth_method_t auth_method;
 		status_t status;
 		
-		auth_method = this->policy->get_auth_method(this->policy);
-		authenticator = authenticator_create(this->ike_sa, auth_method);
 		my_id = this->policy->get_my_id(this->policy);
-
-		status = authenticator->verify_auth_data(authenticator,
-												 auth_payload,
-												 this->init_response,
-												 this->nonce_i,
-												 my_id,
-												 other_id,
-												 FALSE);
+		auth_method = auth_payload->get_auth_method(auth_payload);
+		authenticator = authenticator_create(this->ike_sa, auth_method);
+		if (authenticator == NULL)
+		{
+			SIG(IKE_UP_FAILED, "auth method %N not supported, deleting IKE_SA",
+				auth_method_names, auth_method);
+			SIG(CHILD_UP_FAILED, "initiating CHILD_SA failed, unable to create IKE_SA");
+			return DESTROY_ME;
+		}
+		status = authenticator->verify(authenticator, this->init_response,
+									   this->nonce_i, auth_payload);
 		authenticator->destroy(authenticator);
 		if (status != SUCCESS)
 		{

src/charon/sa/transactions/ike_auth.h

@@ -24,12 +24,11 @@
 #ifndef IKE_AUTH_H_
 #define IKE_AUTH_H_
 
+typedef struct ike_auth_t ike_auth_t;
+
 #include <sa/ike_sa.h>
 #include <sa/transactions/transaction.h>
 
-
-typedef struct ike_auth_t ike_auth_t;
-
 /**
  * @brief A transaction for the second message exchange to authenticate an IKE_SA.
  *

src/charon/sa/transactions/ike_sa_init.h

@@ -24,12 +24,11 @@
 #ifndef IKE_SA_INIT_H_
 #define IKE_SA_INIT_H_
 
+typedef struct ike_sa_init_t ike_sa_init_t;
+
 #include <sa/ike_sa.h>
 #include <sa/transactions/transaction.h>
 
-
-typedef struct ike_sa_init_t ike_sa_init_t;
-
 /**
  * @brief A transaction for the first message exchange to set up an IKE_SA.
  * 

src/charon/sa/transactions/rekey_ike_sa.c

@@ -270,7 +270,7 @@ static status_t get_request(private_rekey_ike_sa_t *this, message_t **result)
 	
 	/* register us as rekeying to detect multiple rekeying */
 	this->ike_sa->set_state(this->ike_sa, IKE_REKEYING);
-	this->ike_sa->set_rekeying_transaction(this->ike_sa, &this->public);
+	this->ike_sa->set_rekeying_transaction(this->ike_sa, &this->public.transaction);
 	
 	return SUCCESS;
 }
@@ -623,7 +623,8 @@ static status_t get_response(private_rekey_ike_sa_t *this, message_t *request,
 	{
 		private_rekey_ike_sa_t *other;
 		
-		other = this->ike_sa->get_rekeying_transaction(this->ike_sa);
+		other = (private_rekey_ike_sa_t*)
+						this->ike_sa->get_rekeying_transaction(this->ike_sa);
 		if (other)
 		{
 			/* store our lower nonce in the simultaneus transaction, we 
@@ -641,7 +642,7 @@ static status_t get_response(private_rekey_ike_sa_t *this, message_t *request,
 				other->nonce_s = chunk_clone(this->nonce_r);
 			}
 			/* overwrite "other" in IKE_SA, allows "other" to access "this" */
-			this->ike_sa->set_rekeying_transaction(this->ike_sa, &this->public);
+			this->ike_sa->set_rekeying_transaction(this->ike_sa, &this->public.transaction);
 		}
 		else
 		{
@@ -768,7 +769,8 @@ static status_t conclude(private_rekey_ike_sa_t *this, message_t *response,
 	 * of the SA. If it changed, we are not alone. Then we must compare the nonces.
 	 * If no simultaneous rekeying is going on, we just initiate the delete of
 	 * the superseded SA. */
-	other_trans = this->ike_sa->get_rekeying_transaction(this->ike_sa);
+	other_trans = (private_rekey_ike_sa_t*)
+						this->ike_sa->get_rekeying_transaction(this->ike_sa);
 	this->ike_sa->set_rekeying_transaction(this->ike_sa, NULL);
 	
 	if (this->nonce_s.ptr)

src/charon/sa/transactions/rekey_ike_sa.h

@@ -23,13 +23,13 @@
 #ifndef REKEY_IKE_SA_H
 #define REKEY_IKE_SA_H
 
+typedef struct rekey_ike_sa_t rekey_ike_sa_t;
+
 #include <sa/ike_sa.h>
 #include <sa/transactions/transaction.h>
 #include <crypto/diffie_hellman.h>
 
 
-typedef struct rekey_ike_sa_t rekey_ike_sa_t;
-
 /**
  * @brief A transaction to rekey an established IKE_SA
  *

src/charon/sa/transactions/transaction.h

@@ -23,15 +23,12 @@
 #ifndef TRANSACTION_H_
 #define TRANSACTION_H_
 
-
 typedef struct transaction_t transaction_t;
 
 #include <types.h>
 #include <encoding/message.h>
 #include <sa/ike_sa.h>
 
-
-
 /**
  * @brief This interface represents a transaction an established IKE_SA can do.
  *