restructured file layout

new configuration structure:
  peer_cfg: configuration related to a peer (authenitcation, ...=
  ike_cfg: config to use for IKE setup (proposals)
  child_Cfg: config for CHILD_SA (proposals, traffic selectors)
  a peer_cfg has one ike_cfg and multiple child_cfg's
stroke now uses fixed count of threads

src/charon/sa/tasks/child_create.c

@@ -64,9 +64,9 @@ struct private_child_create_t {
 	chunk_t other_nonce;
 	
 	/**
-	 * policy to create the CHILD_SA from
+	 * config to create the CHILD_SA from
 	 */
-	policy_t *policy;
+	child_cfg_t *config;
 	
 	/**
 	 * list of proposal candidates
@@ -198,7 +198,7 @@ static status_t select_and_install(private_child_create_t *this)
 	my_vip = this->ike_sa->get_virtual_ip(this->ike_sa, TRUE);
 	other_vip = this->ike_sa->get_virtual_ip(this->ike_sa, FALSE);
 
-	this->proposal = this->policy->select_proposal(this->policy, this->proposals);
+	this->proposal = this->config->select_proposal(this->config, this->proposals);
 	
 	if (this->proposal == NULL)
 	{
@@ -206,28 +206,31 @@ static status_t select_and_install(private_child_create_t *this)
 		return FAILED;
 	}
 	
-	if (this->initiator && my_vip)
-	{	/* if we have a virtual IP, shorten our TS to the minimum */
-		my_ts = this->policy->select_my_traffic_selectors(this->policy, my_ts,
-											 			  my_vip);
+	if (my_vip == NULL)
+	{
+		my_vip = me;
+	}
+	else if (this->initiator)
+	{
 		/* to setup firewall rules correctly, CHILD_SA needs the virtual IP */
 		this->child_sa->set_virtual_ip(this->child_sa, my_vip);
 	}
-	else
-	{	/* shorten in the host2host case only */
-		my_ts = this->policy->select_my_traffic_selectors(this->policy, 
-															my_ts, me);
+	if (other_vip == NULL)
+	{
+		other_vip = other;
 	}
-	if (other_vip)
-	{	/* if other has a virtual IP, shorten it's traffic selectors to it */
-		other_ts = this->policy->select_other_traffic_selectors(this->policy,
-															other_ts, other_vip);
-	}
-	else
-	{	/* use his host for the host2host case */
-		other_ts = this->policy->select_other_traffic_selectors(this->policy,
-															other_ts, other);
+	
+	my_ts = this->config->get_traffic_selectors(this->config, TRUE, my_ts,
+												my_vip);
+	other_ts = this->config->get_traffic_selectors(this->config, FALSE, other_ts, 
+												   other_vip);
+	
+	if (my_ts->get_count(my_ts) == 0 || other_ts->get_count(other_ts) == 0)
+	{
+		SIG(CHILD_UP_FAILED, "no acceptable traffic selectors found");
+		return FAILED;
 	}
+	
 	this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
 	this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
 	if (this->initiator)
@@ -241,13 +244,6 @@ static status_t select_and_install(private_child_create_t *this)
 		this->tsi = other_ts;
 	}
 	
-	if (this->tsi->get_count(this->tsi) == 0 ||
-		this->tsr->get_count(this->tsr) == 0)
-	{
-		SIG(CHILD_UP_FAILED, "no acceptable traffic selectors found");
-		return FAILED;
-	}
-	
 	if (!this->initiator)
 	{
 		/* check if requested mode is acceptable, downgrade if required */
@@ -421,6 +417,7 @@ static void process_payloads(private_child_create_t *this, message_t *message)
 static status_t build_i(private_child_create_t *this, message_t *message)
 {
 	host_t *me, *other, *vip;
+	peer_cfg_t *peer_cfg;
 
 	switch (message->get_exchange_type(message))
 	{
@@ -448,25 +445,29 @@ static status_t build_i(private_child_create_t *this, message_t *message)
 	
 	me = this->ike_sa->get_my_host(this->ike_sa);
 	other = this->ike_sa->get_other_host(this->ike_sa);
-	vip = this->policy->get_virtual_ip(this->policy, NULL);
+	peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
+	vip = peer_cfg->get_virtual_ip(peer_cfg, NULL);
 	
 	if (vip)
 	{	/* propose a 0.0.0.0/0 subnet when we use virtual ip */
-		this->tsi = this->policy->get_my_traffic_selectors(this->policy, NULL);
+		this->tsi = this->config->get_traffic_selectors(this->config, TRUE,
+														NULL, NULL);
 		vip->destroy(vip);
 	}
 	else
 	{	/* but shorten a 0.0.0.0/0 subnet to the actual address if host2host */
-		this->tsi = this->policy->get_my_traffic_selectors(this->policy, me);
+		this->tsi = this->config->get_traffic_selectors(this->config, TRUE,
+														NULL, me);
 	}
-	this->tsr = this->policy->get_other_traffic_selectors(this->policy, other);
-	this->proposals = this->policy->get_proposals(this->policy);
-	this->mode = this->policy->get_mode(this->policy);
+	this->tsr = this->config->get_traffic_selectors(this->config, FALSE, 
+													NULL, other);
+	this->proposals = this->config->get_proposals(this->config);
+	this->mode = this->config->get_mode(this->config);
 	
 	this->child_sa = child_sa_create(me, other,
 									 this->ike_sa->get_my_id(this->ike_sa),
 									 this->ike_sa->get_other_id(this->ike_sa),
-									 this->policy, this->reqid,
+									 this->config, this->reqid,
 									 this->ike_sa->is_natt_enabled(this->ike_sa));
 	
 	if (this->child_sa->alloc(this->child_sa, this->proposals) != SUCCESS)
@@ -492,6 +493,8 @@ static status_t build_i(private_child_create_t *this, message_t *message)
  */
 static status_t process_r(private_child_create_t *this, message_t *message)
 {
+	peer_cfg_t *peer_cfg;
+
 	switch (message->get_exchange_type(message))
 	{
 		case IKE_SA_INIT:
@@ -517,18 +520,13 @@ static status_t process_r(private_child_create_t *this, message_t *message)
 		return NEED_MORE;
 	}
 		  
-	this->policy = charon->policies->get_policy(charon->policies,
-							this->ike_sa->get_my_id(this->ike_sa),
-							this->ike_sa->get_other_id(this->ike_sa), 
-							this->tsr, this->tsi,
-							this->ike_sa->get_my_host(this->ike_sa),
-							this->ike_sa->get_other_host(this->ike_sa));
-	
-	if (this->policy && this->ike_sa->get_policy(this->ike_sa) == NULL)
+	peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
+	if (peer_cfg)
 	{
-		this->ike_sa->set_policy(this->ike_sa, this->policy);
+		this->config = peer_cfg->select_child_cfg(peer_cfg, this->tsr, this->tsi,
+									this->ike_sa->get_my_host(this->ike_sa),
+									this->ike_sa->get_other_host(this->ike_sa));
 	}
-	
 	return NEED_MORE;
 }
 
@@ -565,10 +563,11 @@ static status_t build_r(private_child_create_t *this, message_t *message)
 		return SUCCESS;
 	}
 	
-	if (this->policy == NULL)
+	if (this->config == NULL)
 	{
-		SIG(CHILD_UP_FAILED, "no acceptable policy found");
-		message->add_notify(message, FALSE, NO_PROPOSAL_CHOSEN, chunk_empty);
+		SIG(CHILD_UP_FAILED, "traffic selectors %#R=== %#R inacceptable",
+			this->tsr, this->tsi);
+		message->add_notify(message, FALSE, TS_UNACCEPTABLE, chunk_empty);
 		return SUCCESS;
 	}
 	
@@ -576,12 +575,12 @@ static status_t build_r(private_child_create_t *this, message_t *message)
 									 this->ike_sa->get_other_host(this->ike_sa),
 									 this->ike_sa->get_my_id(this->ike_sa),
 									 this->ike_sa->get_other_id(this->ike_sa),
-									 this->policy, this->reqid,
+									 this->config, this->reqid,
 									 this->ike_sa->is_natt_enabled(this->ike_sa));
 	
 	if (select_and_install(this) != SUCCESS)
 	{
-		message->add_notify(message, FALSE, TS_UNACCEPTABLE, chunk_empty);
+		message->add_notify(message, FALSE, NO_PROPOSAL_CHOSEN, chunk_empty);
 		return SUCCESS;
 	}
 	
@@ -756,14 +755,14 @@ static void destroy(private_child_create_t *this)
 		this->proposals->destroy_offset(this->proposals, offsetof(proposal_t, destroy));
 	}
 	
-	DESTROY_IF(this->policy);
+	DESTROY_IF(this->config);
 	free(this);
 }
 
 /*
  * Described in header.
  */
-child_create_t *child_create_create(ike_sa_t *ike_sa, policy_t *policy)
+child_create_t *child_create_create(ike_sa_t *ike_sa, child_cfg_t *config)
 {
 	private_child_create_t *this = malloc_thing(private_child_create_t);
 
@@ -773,12 +772,12 @@ child_create_t *child_create_create(ike_sa_t *ike_sa, policy_t *policy)
 	this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
 	this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
 	this->public.task.destroy = (void(*)(task_t*))destroy;
-	if (policy)
+	if (config)
 	{
 		this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
 		this->public.task.process = (status_t(*)(task_t*,message_t*))process_i;
 		this->initiator = TRUE;
-		policy->get_ref(policy);
+		config->get_ref(config);
 	}
 	else
 	{
@@ -788,7 +787,7 @@ child_create_t *child_create_create(ike_sa_t *ike_sa, policy_t *policy)
 	}
 	
 	this->ike_sa = ike_sa;
-	this->policy = policy;
+	this->config = config;
 	this->my_nonce = chunk_empty;
 	this->other_nonce = chunk_empty;
 	this->proposals = NULL;

src/charon/sa/tasks/child_create.h

@@ -28,7 +28,7 @@ typedef struct child_create_t child_create_t;
 #include <library.h>
 #include <sa/ike_sa.h>
 #include <sa/tasks/task.h>
-#include <config/policies/policy.h>
+#include <config/child_cfg.h>
 
 /**
  * @brief Task of type CHILD_CREATE, established a new CHILD_SA.
@@ -80,9 +80,9 @@ struct child_create_t {
  * @brief Create a new child_create task.
  *
  * @param ike_sa		IKE_SA this task works for
- * @param policy		policy if task initiator, NULL if responder
+ * @param config		child_cfg if task initiator, NULL if responder
  * @return			 	child_create task to handle by the task_manager
  */
-child_create_t *child_create_create(ike_sa_t *ike_sa, policy_t *policy);
+child_create_t *child_create_create(ike_sa_t *ike_sa, child_cfg_t *config);
 
 #endif /* CHILD_CREATE_H_ */

src/charon/sa/tasks/child_rekey.c

@@ -27,7 +27,7 @@
 #include <encoding/payloads/notify_payload.h>
 #include <sa/tasks/child_create.h>
 #include <sa/tasks/child_delete.h>
-#include <queues/jobs/rekey_child_sa_job.h>
+#include <processing/jobs/rekey_child_sa_job.h>
 
 
 typedef struct private_child_rekey_t private_child_rekey_t;
@@ -315,8 +315,8 @@ static void destroy(private_child_rekey_t *this)
  */
 child_rekey_t *child_rekey_create(ike_sa_t *ike_sa, child_sa_t *child_sa)
 {
+	child_cfg_t *config;
 	private_child_rekey_t *this = malloc_thing(private_child_rekey_t);
-	policy_t *policy;
 
 	this->public.collide = (void (*)(child_rekey_t*,task_t*))collide;
 	this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
@@ -327,8 +327,8 @@ child_rekey_t *child_rekey_create(ike_sa_t *ike_sa, child_sa_t *child_sa)
 		this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
 		this->public.task.process = (status_t(*)(task_t*,message_t*))process_i;
 		this->initiator = TRUE;
-		policy = child_sa->get_policy(child_sa);
-		this->child_create = child_create_create(ike_sa, policy);
+		config = child_sa->get_config(child_sa);
+		this->child_create = child_create_create(ike_sa, config);
 	}
 	else
 	{

src/charon/sa/tasks/ike_auth.c

@@ -100,18 +100,18 @@ static status_t build_auth(private_ike_auth_t *this, message_t *message)
 {
 	authenticator_t *auth;
 	auth_payload_t *auth_payload;
-	policy_t *policy;
+	peer_cfg_t *config;
 	auth_method_t method;
 	status_t status;
 	
 	/* create own authenticator and add auth payload */
-	policy = this->ike_sa->get_policy(this->ike_sa);
-	if (!policy)
+	config = this->ike_sa->get_peer_cfg(this->ike_sa);
+	if (!config)
 	{
-		SIG(IKE_UP_FAILED, "unable to authenticate, no policy found");
+		SIG(IKE_UP_FAILED, "unable to authenticate, no peer config found");
 		return FAILED;
 	}
-	method = policy->get_auth_method(policy);
+	method = config->get_auth_method(config);
 	
 	auth = authenticator_create(this->ike_sa, method);
 	if (auth == NULL)
@@ -140,15 +140,15 @@ static status_t build_id(private_ike_auth_t *this, message_t *message)
 {
 	identification_t *me, *other;
 	id_payload_t *id;
-	policy_t *policy;
+	peer_cfg_t *config;
 	
 	me = this->ike_sa->get_my_id(this->ike_sa);
 	other = this->ike_sa->get_other_id(this->ike_sa);
-	policy = this->ike_sa->get_policy(this->ike_sa);
+	config = this->ike_sa->get_peer_cfg(this->ike_sa);
 	
 	if (me->contains_wildcards(me))
 	{
-		me = policy->get_my_id(policy);
+		me = config->get_my_id(config);
 		if (me->contains_wildcards(me))
 		{
 			SIG(IKE_UP_FAILED, "negotiation of own ID failed");
@@ -459,7 +459,7 @@ static status_t build_eap_r(private_ike_auth_t *this, message_t *message)
  */
 static status_t build_i(private_ike_auth_t *this, message_t *message)
 {
-	policy_t *policy;
+	peer_cfg_t *config;
 
 	if (message->get_exchange_type(message) == IKE_SA_INIT)
 	{
@@ -471,8 +471,8 @@ static status_t build_i(private_ike_auth_t *this, message_t *message)
 		return FAILED;
 	}
 	
-	policy = this->ike_sa->get_policy(this->ike_sa);
-	if (policy->get_auth_method(policy) == AUTH_EAP)
+	config = this->ike_sa->get_peer_cfg(this->ike_sa);
+	if (config->get_auth_method(config) == AUTH_EAP)
 	{
 		this->eap_auth = eap_authenticator_create(this->ike_sa);
 	}
@@ -491,7 +491,9 @@ static status_t build_i(private_ike_auth_t *this, message_t *message)
  * Implementation of task_t.process for initiator
  */
 static status_t process_r(private_ike_auth_t *this, message_t *message)
-{	
+{
+	peer_cfg_t *config;
+	
 	if (message->get_exchange_type(message) == IKE_SA_INIT)
 	{
 		return collect_other_init_data(this, message);
@@ -502,6 +504,15 @@ static status_t process_r(private_ike_auth_t *this, message_t *message)
 		return NEED_MORE;
 	}
 	
+	config = charon->cfg_store->get_peer_cfg(charon->cfg_store, 
+									this->ike_sa->get_my_id(this->ike_sa),
+									this->ike_sa->get_other_id(this->ike_sa));
+	if (config)
+	{
+		this->ike_sa->set_peer_cfg(this->ike_sa, config);
+		config->destroy(config);
+	}
+	
 	switch (process_auth(this, message))
 	{
 		case SUCCESS:
@@ -522,7 +533,7 @@ static status_t process_r(private_ike_auth_t *this, message_t *message)
  */
 static status_t build_r(private_ike_auth_t *this, message_t *message)
 {
-	policy_t *policy;
+	peer_cfg_t *config;
 	eap_type_t eap_type;
 	eap_payload_t *eap_payload;
 	status_t status;
@@ -532,10 +543,12 @@ static status_t build_r(private_ike_auth_t *this, message_t *message)
 		return collect_my_init_data(this, message);
 	}
 	
-	policy = this->ike_sa->get_policy(this->ike_sa);
-	if (policy == NULL)
+	config = this->ike_sa->get_peer_cfg(this->ike_sa);
+	if (config == NULL)
 	{
-		SIG(IKE_UP_FAILED, "no acceptable policy found");
+		SIG(IKE_UP_FAILED, "no acceptable peer config found for %D...%D",
+			this->ike_sa->get_my_id(this->ike_sa),
+			this->ike_sa->get_other_id(this->ike_sa));
 		message->add_notify(message, TRUE, AUTHENTICATION_FAILED, chunk_empty);
 		return FAILED;
 	}
@@ -567,7 +580,7 @@ static status_t build_r(private_ike_auth_t *this, message_t *message)
 	}
 		
 	/* initiate EAP authenitcation */
-	eap_type = policy->get_eap_type(policy);
+	eap_type = config->get_eap_type(config);
 	status = this->eap_auth->initiate(this->eap_auth, eap_type, &eap_payload);
 	message->add_payload(message, (payload_t*)eap_payload);
 	if (status != NEED_MORE)

src/charon/sa/tasks/ike_cert.c

@@ -171,20 +171,20 @@ static void process_certs(private_ike_cert_t *this, message_t *message)
  */
 static void build_certreqs(private_ike_cert_t *this, message_t *message)
 {
-	connection_t *connection;
-	policy_t *policy;
+	ike_cfg_t *ike_cfg;
+	peer_cfg_t *peer_cfg;
 	identification_t *ca;
 	certreq_payload_t *certreq;
 	
-	connection = this->ike_sa->get_connection(this->ike_sa);
+	ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
 	
-	if (connection->get_certreq_policy(connection) != CERT_NEVER_SEND)
+	if (ike_cfg->send_certreq(ike_cfg) != CERT_NEVER_SEND)
 	{	
-		policy = this->ike_sa->get_policy(this->ike_sa);
+		peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
 		
-		if (policy)
+		if (peer_cfg)
 		{
-			ca = policy->get_other_ca(policy);
+			ca = peer_cfg->get_other_ca(peer_cfg);
 			
 			if (ca && ca->get_type(ca) != ID_ANY)
 			{
@@ -212,17 +212,15 @@ static void build_certreqs(private_ike_cert_t *this, message_t *message)
  */
 static void build_certs(private_ike_cert_t *this, message_t *message)
 {
-	policy_t *policy;
-	connection_t *connection;
+	peer_cfg_t *peer_cfg;
 	x509_t *cert;
 	cert_payload_t *payload;
 	
-	policy = this->ike_sa->get_policy(this->ike_sa);
-	connection = this->ike_sa->get_connection(this->ike_sa);
+	peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
 
-	if (policy && policy->get_auth_method(policy) == AUTH_RSA)
+	if (peer_cfg && peer_cfg->get_auth_method(peer_cfg) == AUTH_RSA)
 	{
-		switch (connection->get_cert_policy(connection))
+		switch (peer_cfg->get_cert_policy(peer_cfg))
 		{
 			case CERT_NEVER_SEND:
 				break;
@@ -236,7 +234,7 @@ static void build_certs(private_ike_cert_t *this, message_t *message)
 			{
 				/* TODO: respect CA cert request */
 				cert = charon->credentials->get_certificate(charon->credentials,
-													policy->get_my_id(policy));
+												peer_cfg->get_my_id(peer_cfg));
 				if (cert)
 				{
 					payload = cert_payload_create_from_x509(cert);

src/charon/sa/tasks/ike_config.c

@@ -48,11 +48,6 @@ struct private_ike_config_t {
 	 */
 	bool initiator;
 	
-	/**
-	 * associated policy with virtual IP configuration
-	 */
-	policy_t *policy;
-	
 	/**
 	 * virtual ip
 	 */
@@ -266,7 +261,8 @@ static status_t build_i(private_ike_config_t *this, message_t *message)
 	if (message->get_exchange_type(message) == IKE_AUTH &&
 		message->get_payload(message, ID_INITIATOR))
 	{
-		this->virtual_ip = this->policy->get_virtual_ip(this->policy, NULL);
+		peer_cfg_t *config = this->ike_sa->get_peer_cfg(this->ike_sa);
+		this->virtual_ip = config->get_virtual_ip(config, NULL);
 		
 		build_payloads(this, message, CFG_REQUEST);
 	}
@@ -295,14 +291,14 @@ static status_t build_r(private_ike_config_t *this, message_t *message)
 	if (message->get_exchange_type(message) == IKE_AUTH &&
 		message->get_payload(message, EXTENSIBLE_AUTHENTICATION) == NULL)
 	{
-		this->policy = this->ike_sa->get_policy(this->ike_sa);
+		peer_cfg_t *config = this->ike_sa->get_peer_cfg(this->ike_sa);
 		
-		if (this->policy && this->virtual_ip)
+		if (config && this->virtual_ip)
 		{
 			host_t *ip;
 			
 			DBG1(DBG_IKE, "peer requested virtual IP %H", this->virtual_ip);
-			ip = this->policy->get_virtual_ip(this->policy, this->virtual_ip);
+			ip = config->get_virtual_ip(config, this->virtual_ip);
 			if (ip == NULL || ip->is_anyaddr(ip))
 			{
 				DBG1(DBG_IKE, "not assigning a virtual IP to peer");
@@ -398,7 +394,7 @@ static void destroy(private_ike_config_t *this)
 /*
  * Described in header.
  */
-ike_config_t *ike_config_create(ike_sa_t *ike_sa, policy_t *policy)
+ike_config_t *ike_config_create(ike_sa_t *ike_sa, bool initiator)
 {
 	private_ike_config_t *this = malloc_thing(private_ike_config_t);
 
@@ -406,21 +402,18 @@ ike_config_t *ike_config_create(ike_sa_t *ike_sa, policy_t *policy)
 	this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
 	this->public.task.destroy = (void(*)(task_t*))destroy;
 	
-	if (policy)
+	if (initiator)
 	{
 		this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
 		this->public.task.process = (status_t(*)(task_t*,message_t*))process_i;
-		this->initiator = TRUE;
 	}
 	else
 	{
 		this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
 		this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
-		this->initiator = FALSE;
 	}
-	
+	this->initiator = initiator;
 	this->ike_sa = ike_sa;
-	this->policy = policy;
 	this->virtual_ip = NULL;
 	this->dns = linked_list_create();
 	

src/charon/sa/tasks/ike_config.h

@@ -28,7 +28,6 @@ typedef struct ike_config_t ike_config_t;
 #include <library.h>
 #include <sa/ike_sa.h>
 #include <sa/tasks/task.h>
-#include <config/policies/policy.h>
 
 /**
  * @brief Task of type IKE_CONFIG, sets up a virtual IP and other
@@ -51,9 +50,9 @@ struct ike_config_t {
  * @brief Create a new ike_config task.
  *
  * @param ike_sa		IKE_SA this task works for
- * @param policy		policy for the initiator, NULL for the responder
+ * @param initiator		TRUE for initiator
  * @return			  	ike_config task to handle by the task_manager
  */
-ike_config_t *ike_config_create(ike_sa_t *ike_sa, policy_t *policy);
+ike_config_t *ike_config_create(ike_sa_t *ike_sa, bool initiator);
 
 #endif /* IKE_CONFIG_H_ */

src/charon/sa/tasks/ike_delete.c

@@ -28,7 +28,7 @@
 
 typedef struct private_ike_delete_t private_ike_delete_t;
 
-/**
+/**file
  * Private members of a ike_delete_t task.
  */
 struct private_ike_delete_t {

src/charon/sa/tasks/ike_init.c

@@ -57,9 +57,9 @@ struct private_ike_init_t {
 	bool initiator;
 	
 	/**
-	 * Connection established by this IKE_SA
+	 * IKE config to establish
 	 */
-	connection_t *connection;
+	ike_cfg_t *config;
 	
 	/**
 	 * diffie hellman group to use
@@ -117,11 +117,11 @@ static void build_payloads(private_ike_init_t *this, message_t *message)
 	
 	id = this->ike_sa->get_id(this->ike_sa);
 	
-	this->connection = this->ike_sa->get_connection(this->ike_sa);
+	this->config = this->ike_sa->get_ike_cfg(this->ike_sa);
 
 	if (this->initiator)
 	{
-		proposal_list = this->connection->get_proposals(this->connection);
+		proposal_list = this->config->get_proposals(this->config);
 		if (this->old_sa)
 		{	
 			/* include SPI of new IKE_SA when we are rekeying */
@@ -174,8 +174,8 @@ static void process_payloads(private_ike_init_t *this, message_t *message)
 				linked_list_t *proposal_list;
 	
 				proposal_list = sa_payload->get_proposals(sa_payload);
-				this->proposal = this->connection->select_proposal(
-											  this->connection, proposal_list);
+				this->proposal = this->config->select_proposal(this->config,
+															   proposal_list);
 				proposal_list->destroy_offset(proposal_list, 
 											  offsetof(proposal_t, destroy));
 				break;
@@ -200,8 +200,7 @@ static void process_payloads(private_ike_init_t *this, message_t *message)
 				else
 				{
 					this->dh_group = dh_group;
-					if (!this->connection->check_dh_group(this->connection, 
-														  dh_group))
+					if (!this->config->check_dh_group(this->config, dh_group))
 					{
 						break;
 					}
@@ -235,9 +234,9 @@ static status_t build_i(private_ike_init_t *this, message_t *message)
 	randomizer_t *randomizer;
 	status_t status;
 	
-	this->connection = this->ike_sa->get_connection(this->ike_sa);
+	this->config = this->ike_sa->get_ike_cfg(this->ike_sa);
 	SIG(IKE_UP_START, "initiating IKE_SA to %H",
-		this->connection->get_other_host(this->connection));
+		this->config->get_other_host(this->config));
 	this->ike_sa->set_state(this->ike_sa, IKE_CONNECTING);
 	
 	if (this->retry++ >= MAX_RETRIES)
@@ -249,7 +248,7 @@ static status_t build_i(private_ike_init_t *this, message_t *message)
 	/* if the DH group is set via use_dh_group(), we already have a DH object */
 	if (!this->diffie_hellman)
 	{
-		this->dh_group = this->connection->get_dh_group(this->connection);
+		this->dh_group = this->config->get_dh_group(this->config);
 		this->diffie_hellman = diffie_hellman_create(this->dh_group);
 		if (this->diffie_hellman == NULL)
 		{
@@ -291,7 +290,7 @@ static status_t process_r(private_ike_init_t *this, message_t *message)
 {	
 	randomizer_t *randomizer;
 	
-	this->connection = this->ike_sa->get_connection(this->ike_sa);
+	this->config = this->ike_sa->get_ike_cfg(this->ike_sa);
 	SIG(IKE_UP_FAILED, "%H is initiating an IKE_SA",
 		message->get_source(message));
 	this->ike_sa->set_state(this->ike_sa, IKE_CONNECTING);
@@ -335,7 +334,7 @@ static status_t build_r(private_ike_init_t *this, message_t *message)
 		
 		SIG(IKE_UP_FAILED, "received inacceptable DH group (%N)",
 			 diffie_hellman_group_names, this->dh_group);
-		this->dh_group = this->connection->get_dh_group(this->connection);
+		this->dh_group = this->config->get_dh_group(this->config);
 		dh_enc = htons(this->dh_group);
 		chunk.ptr = (u_int8_t*)&dh_enc;
 		chunk.len = sizeof(dh_enc);
@@ -414,8 +413,7 @@ static status_t process_i(private_ike_init_t *this, message_t *message)
 					DBG1(DBG_IKE, "peer didn't accept DH group %N, it requested"
 						 " %N", diffie_hellman_group_names, old_dh_group,
 						 diffie_hellman_group_names, this->dh_group);
-					if (!this->connection->check_dh_group(this->connection,
-														  this->dh_group))
+					if (!this->config->check_dh_group(this->config, this->dh_group))
 					{
 						DBG1(DBG_IKE, "requested DH group %N not acceptable, "
 							"giving up", diffie_hellman_group_names,
@@ -590,7 +588,7 @@ ike_init_t *ike_init_create(ike_sa_t *ike_sa, bool initiator, ike_sa_t *old_sa)
 	this->other_nonce = chunk_empty;
 	this->cookie = chunk_empty;
 	this->proposal = NULL;
-	this->connection = NULL;
+	this->config = NULL;
 	this->old_sa = old_sa;
 	this->retry = 0;
 	

src/charon/sa/tasks/ike_rekey.c

@@ -26,8 +26,8 @@
 #include <daemon.h>
 #include <encoding/payloads/notify_payload.h>
 #include <sa/tasks/ike_init.h>
-#include <queues/jobs/delete_ike_sa_job.h>
-#include <queues/jobs/rekey_ike_sa_job.h>
+#include <processing/jobs/delete_ike_sa_job.h>
+#include <processing/jobs/rekey_ike_sa_job.h>
 
 
 typedef struct private_ike_rekey_t private_ike_rekey_t;
@@ -73,20 +73,15 @@ struct private_ike_rekey_t {
  */
 static status_t build_i(private_ike_rekey_t *this, message_t *message)
 {
-	connection_t *connection;
-	policy_t *policy;
+	peer_cfg_t *peer_cfg;
 	
 	this->new_sa = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
 														TRUE);
 	
-	connection = this->ike_sa->get_connection(this->ike_sa);
-	policy = this->ike_sa->get_policy(this->ike_sa);
-	this->new_sa->set_connection(this->new_sa, connection);
-	this->new_sa->set_policy(this->new_sa, policy);
-
+	peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
+	this->new_sa->set_peer_cfg(this->new_sa, peer_cfg);
 	this->ike_init = ike_init_create(this->new_sa, TRUE, this->ike_sa);
 	this->ike_init->task.build(&this->ike_init->task, message);
-	
 	this->ike_sa->set_state(this->ike_sa, IKE_REKEYING);
 
 	return NEED_MORE;
@@ -97,8 +92,7 @@ static status_t build_i(private_ike_rekey_t *this, message_t *message)
  */
 static status_t process_r(private_ike_rekey_t *this, message_t *message)
 {
-	connection_t *connection;
-	policy_t *policy;
+	peer_cfg_t *peer_cfg;
 	iterator_t *iterator;
 	child_sa_t *child_sa;
 	
@@ -129,11 +123,8 @@ static status_t process_r(private_ike_rekey_t *this, message_t *message)
 	this->new_sa = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
 														FALSE);
 	
-	connection = this->ike_sa->get_connection(this->ike_sa);
-	policy = this->ike_sa->get_policy(this->ike_sa);
-	this->new_sa->set_connection(this->new_sa, connection);
-	this->new_sa->set_policy(this->new_sa, policy);
-	
+	peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
+	this->new_sa->set_peer_cfg(this->new_sa, peer_cfg);
 	this->ike_init = ike_init_create(this->new_sa, FALSE, this->ike_sa);
 	this->ike_init->task.process(&this->ike_init->task, message);