Updated to new upstream release. interfaces Patch is not from upstream.

32 files changed, 1433 insertions, 1081 deletions

diff --git a/src/charon/sa/tasks/child_create.c b/src/charon/sa/tasks/child_create.c
index 558938f2e..3f002f263 100644
--- a/src/charon/sa/tasks/child_create.c
+++ b/src/charon/sa/tasks/child_create.c
@@ -19,12 +19,14 @@
 
 #include <daemon.h>
 #include <crypto/diffie_hellman.h>
+#include <credentials/certificates/x509.h>
 #include <encoding/payloads/sa_payload.h>
 #include <encoding/payloads/ke_payload.h>
 #include <encoding/payloads/ts_payload.h>
 #include <encoding/payloads/nonce_payload.h>
 #include <encoding/payloads/notify_payload.h>
 #include <processing/jobs/delete_ike_sa_job.h>
+#include <processing/jobs/inactivity_job.h>
 
 
 typedef struct private_child_create_t private_child_create_t;
@@ -33,132 +35,132 @@ typedef struct private_child_create_t private_child_create_t;
  * Private members of a child_create_t task.
  */
 struct private_child_create_t {
-	
+
 	/**
 	 * Public methods and task_t interface.
 	 */
 	child_create_t public;
-	
+
 	/**
 	 * Assigned IKE_SA.
 	 */
 	ike_sa_t *ike_sa;
-	
+
 	/**
 	 * Are we the initiator?
 	 */
 	bool initiator;
-	
+
 	/**
 	 * nonce chosen by us
 	 */
 	chunk_t my_nonce;
-	
+
 	/**
 	 * nonce chosen by peer
 	 */
 	chunk_t other_nonce;
-	
+
 	/**
 	 * config to create the CHILD_SA from
 	 */
 	child_cfg_t *config;
-	
+
 	/**
 	 * list of proposal candidates
 	 */
 	linked_list_t *proposals;
-	
+
 	/**
 	 * selected proposal to use for CHILD_SA
 	 */
 	proposal_t *proposal;
-	
+
 	/**
 	 * traffic selectors for initiators side
 	 */
 	linked_list_t *tsi;
-	
+
 	/**
 	 * traffic selectors for responders side
 	 */
 	linked_list_t *tsr;
-	
+
 	/**
 	 * source of triggering packet
 	 */
 	traffic_selector_t *packet_tsi;
-	
+
 	/**
 	 * destination of triggering packet
 	 */
 	traffic_selector_t *packet_tsr;
-	
+
 	/**
 	 * optional diffie hellman exchange
 	 */
 	diffie_hellman_t *dh;
-	
+
 	/**
 	 * group used for DH exchange
 	 */
 	diffie_hellman_group_t dh_group;
-	
+
 	/**
 	 * IKE_SAs keymat
 	 */
 	keymat_t *keymat;
-	
+
 	/**
 	 * mode the new CHILD_SA uses (transport/tunnel/beet)
 	 */
 	ipsec_mode_t mode;
-	
+
 	/**
 	 * IPComp transform to use
 	 */
 	ipcomp_transform_t ipcomp;
-	
+
 	/**
 	 * IPComp transform proposed or accepted by the other peer
 	 */
 	ipcomp_transform_t ipcomp_received;
-	
+
 	/**
 	 * Own allocated SPI
 	 */
 	u_int32_t my_spi;
-	
+
 	/**
 	 * SPI received in proposal
 	 */
 	u_int32_t other_spi;
-	
+
 	/**
 	 * Own allocated Compression Parameter Index (CPI)
 	 */
 	u_int16_t my_cpi;
-	
+
 	/**
 	 * Other Compression Parameter Index (CPI), received via IPCOMP_SUPPORTED
 	 */
 	u_int16_t other_cpi;
-	
+
 	/**
 	 * reqid to use if we are rekeying
 	 */
 	u_int32_t reqid;
-	
+
 	/**
 	 * CHILD_SA which gets established
 	 */
 	child_sa_t *child_sa;
-	
+
 	/**
 	 * successfully established the CHILD?
 	 */
 	bool established;
-	
+
 	/**
 	 * whether the CHILD_SA rekeys an existing one
 	 */
@@ -171,7 +173,7 @@ struct private_child_create_t {
 static status_t get_nonce(message_t *message, chunk_t *nonce)
 {
 	nonce_payload_t *payload;
-	
+
 	payload = (nonce_payload_t*)message->get_payload(message, NONCE);
 	if (payload == NULL)
 	{
@@ -187,7 +189,7 @@ static status_t get_nonce(message_t *message, chunk_t *nonce)
 static status_t generate_nonce(chunk_t *nonce)
 {
 	rng_t *rng;
-	
+
 	rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
 	if (!rng)
 	{
@@ -207,7 +209,7 @@ static bool ts_list_is_host(linked_list_t *list, host_t *host)
 	traffic_selector_t *ts;
 	bool is_host = TRUE;
 	iterator_t *iterator = list->create_iterator(list, TRUE);
-	
+
 	while (is_host && iterator->iterate(iterator, (void**)&ts))
 	{
 		is_host = is_host && ts->is_host(ts, host);
@@ -223,8 +225,8 @@ static bool allocate_spi(private_child_create_t *this)
 {
 	enumerator_t *enumerator;
 	proposal_t *proposal;
-	
-	/* TODO: allocate additional SPI for AH if we have such proposals */ 
+
+	/* TODO: allocate additional SPI for AH if we have such proposals */
 	this->my_spi = this->child_sa->alloc_spi(this->child_sa, PROTO_ESP);
 	if (this->my_spi)
 	{
@@ -247,6 +249,25 @@ static bool allocate_spi(private_child_create_t *this)
 }
 
 /**
+ * Schedule inactivity timeout for CHILD_SA with reqid, if enabled
+ */
+static void schedule_inactivity_timeout(private_child_create_t *this)
+{
+	u_int32_t timeout;
+	bool close_ike;
+
+	timeout = this->config->get_inactivity(this->config);
+	if (timeout)
+	{
+		close_ike = lib->settings->get_bool(lib->settings,
+										"charon.inactivity_close_ike", FALSE);
+		charon->scheduler->schedule_job(charon->scheduler, (job_t*)
+				inactivity_job_create(this->child_sa->get_reqid(this->child_sa),
+									  timeout, close_ike), timeout);
+	}
+}
+
+/**
  * Install a CHILD_SA for usage, return value:
  * - FAILED: no acceptable proposal
  * - INVALID_ARG: diffie hellman group inacceptable
@@ -260,7 +281,8 @@ static status_t select_and_install(private_child_create_t *this, bool no_dh)
 	chunk_t integ_i = chunk_empty, integ_r = chunk_empty;
 	linked_list_t *my_ts, *other_ts;
 	host_t *me, *other, *other_vip, *my_vip;
-	
+	bool private;
+
 	if (this->proposals == NULL)
 	{
 		DBG1(DBG_IKE, "SA payload missing in message");
@@ -271,32 +293,33 @@ static status_t select_and_install(private_child_create_t *this, bool no_dh)
 		DBG1(DBG_IKE, "TS payloads missing in message");
 		return NOT_FOUND;
 	}
-	
+
 	me = this->ike_sa->get_my_host(this->ike_sa);
 	other = this->ike_sa->get_other_host(this->ike_sa);
 	my_vip = this->ike_sa->get_virtual_ip(this->ike_sa, TRUE);
 	other_vip = this->ike_sa->get_virtual_ip(this->ike_sa, FALSE);
-	
-	this->proposal = this->config->select_proposal(this->config, this->proposals,
-												   no_dh);
+
+	private = this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN);
+	this->proposal = this->config->select_proposal(this->config,
+											this->proposals, no_dh, private);
 	if (this->proposal == NULL)
 	{
 		DBG1(DBG_IKE, "no acceptable proposal found");
 		return FAILED;
 	}
 	this->other_spi = this->proposal->get_spi(this->proposal);
-	
+
 	if (!this->initiator && !allocate_spi(this))
 	{	/* responder has no SPI allocated yet */
 		DBG1(DBG_IKE, "allocating SPI failed");
 		return FAILED;
 	}
 	this->child_sa->set_proposal(this->child_sa, this->proposal);
-	
+
 	if (!this->proposal->has_dh_group(this->proposal, this->dh_group))
 	{
 		u_int16_t group;
-		
+
 		if (this->proposal->get_algorithm(this->proposal, DIFFIE_HELLMAN_GROUP,
 										  &group, NULL))
 		{
@@ -312,7 +335,7 @@ static status_t select_and_install(private_child_create_t *this, bool no_dh)
 			return FAILED;
 		}
 	}
-	
+
 	if (my_vip == NULL)
 	{
 		my_vip = me;
@@ -321,7 +344,7 @@ static status_t select_and_install(private_child_create_t *this, bool no_dh)
 	{
 		other_vip = other;
 	}
-	
+
 	if (this->initiator)
 	{
 		nonce_i = this->my_nonce;
@@ -338,9 +361,9 @@ static status_t select_and_install(private_child_create_t *this, bool no_dh)
 	}
 	my_ts = this->config->get_traffic_selectors(this->config, TRUE, my_ts,
 												my_vip);
-	other_ts = this->config->get_traffic_selectors(this->config, FALSE, other_ts, 
+	other_ts = this->config->get_traffic_selectors(this->config, FALSE, other_ts,
 												   other_vip);
-	
+
 	if (my_ts->get_count(my_ts) == 0 || other_ts->get_count(other_ts) == 0)
 	{
 		my_ts->destroy_offset(my_ts, offsetof(traffic_selector_t, destroy));
@@ -348,7 +371,7 @@ static status_t select_and_install(private_child_create_t *this, bool no_dh)
 		DBG1(DBG_IKE, "no acceptable traffic selectors found");
 		return NOT_FOUND;
 	}
-	
+
 	this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
 	this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
 	if (this->initiator)
@@ -361,7 +384,7 @@ static status_t select_and_install(private_child_create_t *this, bool no_dh)
 		this->tsr = my_ts;
 		this->tsi = other_ts;
 	}
-	
+
 	if (!this->initiator)
 	{
 		/* check if requested mode is acceptable, downgrade if required */
@@ -394,13 +417,73 @@ static status_t select_and_install(private_child_create_t *this, bool no_dh)
 				break;
 		}
 	}
-	
+
+	/* check for any certificate-based IP address block constraints */
+	if (this->mode == MODE_BEET || this->mode == MODE_TUNNEL)
+	{
+		auth_cfg_t *auth;
+		enumerator_t *auth_enum;
+		certificate_t *cert = NULL;
+
+		auth_enum = this->ike_sa->create_auth_cfg_enumerator(this->ike_sa, FALSE);
+		while (auth_enum->enumerate(auth_enum, &auth))
+		{
+			cert = auth->get(auth, AUTH_HELPER_SUBJECT_CERT);
+			if (cert)
+			{
+				break;
+			}
+		}
+		auth_enum->destroy(auth_enum);
+
+		if (cert && cert->get_type(cert) == CERT_X509)
+		{
+			x509_t *x509 = (x509_t*)cert;
+
+			if (x509->get_flags(x509) & X509_IP_ADDR_BLOCKS)
+			{
+				enumerator_t *enumerator, *block_enum;
+				traffic_selector_t *ts, *block_ts;
+
+				DBG1(DBG_IKE, "checking certificate-based traffic selector "
+							  "constraints [RFC 3779]");
+				enumerator = other_ts->create_enumerator(other_ts);
+				while (enumerator->enumerate(enumerator, &ts))
+				{
+					bool contained = FALSE;
+
+					block_enum = x509->create_ipAddrBlock_enumerator(x509);
+					while (block_enum->enumerate(block_enum, &block_ts))
+					{
+						if (ts->is_contained_in(ts, block_ts))
+						{
+							DBG1(DBG_IKE, "  TS %R is contained in address block"
+										  " constraint %R", ts, block_ts);
+							contained = TRUE;
+							break;
+						}
+					}
+					block_enum->destroy(block_enum);
+
+					if (!contained)
+					{
+						DBG1(DBG_IKE, "  TS %R is not contained in any"
+									  " address block constraint", ts);
+						enumerator->destroy(enumerator);
+						return FAILED;
+					}
+				}
+				enumerator->destroy(enumerator);
+			}
+		}
+	}
+
 	this->child_sa->set_state(this->child_sa, CHILD_INSTALLING);
 	this->child_sa->set_ipcomp(this->child_sa, this->ipcomp);
 	this->child_sa->set_mode(this->child_sa, this->mode);
 	this->child_sa->set_protocol(this->child_sa,
 								 this->proposal->get_protocol(this->proposal));
-	
+
 	if (this->my_cpi == 0 || this->other_cpi == 0 || this->ipcomp == IPCOMP_NONE)
 	{
 		this->my_cpi = this->other_cpi = 0;
@@ -408,28 +491,28 @@ static status_t select_and_install(private_child_create_t *this, bool no_dh)
 	}
 	status_i = status_o = FAILED;
 	if (this->keymat->derive_child_keys(this->keymat, this->proposal,
-			this->dh, nonce_i, nonce_r,	&encr_i, &integ_i, &encr_r, &integ_r))
+			this->dh, nonce_i, nonce_r, &encr_i, &integ_i, &encr_r, &integ_r))
 	{
 		if (this->initiator)
 		{
 			status_i = this->child_sa->install(this->child_sa, encr_r, integ_r,
-										this->my_spi, this->my_cpi, TRUE);
+					this->my_spi, this->my_cpi, TRUE, my_ts, other_ts);
 			status_o = this->child_sa->install(this->child_sa, encr_i, integ_i,
-										this->other_spi, this->other_cpi, FALSE);
+					this->other_spi, this->other_cpi, FALSE, my_ts, other_ts);
 		}
 		else
 		{
 			status_i = this->child_sa->install(this->child_sa, encr_i, integ_i,
-										this->my_spi, this->my_cpi, TRUE);
+					this->my_spi, this->my_cpi, TRUE, my_ts, other_ts);
 			status_o = this->child_sa->install(this->child_sa, encr_r, integ_r,
-										this->other_spi, this->other_cpi, FALSE);
+					this->other_spi, this->other_cpi, FALSE, my_ts, other_ts);
 		}
 	}
 	chunk_clear(&integ_i);
 	chunk_clear(&integ_r);
 	chunk_clear(&encr_i);
 	chunk_clear(&encr_r);
-	
+
 	if (status_i != SUCCESS || status_o != SUCCESS)
 	{
 		DBG1(DBG_IKE, "unable to install %s%s%sIPsec SA (SAD) in kernel",
@@ -438,21 +521,26 @@ static status_t select_and_install(private_child_create_t *this, bool no_dh)
 			(status_o != SUCCESS) ? "outbound " : "");
 		return FAILED;
 	}
-	
+
 	status = this->child_sa->add_policies(this->child_sa, my_ts, other_ts);
 	if (status != SUCCESS)
-	{	
+	{
 		DBG1(DBG_IKE, "unable to install IPsec policies (SPD) in kernel");
 		return NOT_FOUND;
 	}
-	
+
 	charon->bus->child_keys(charon->bus, this->child_sa, this->dh,
 							nonce_i, nonce_r);
-	
+
 	/* add to IKE_SA, and remove from task */
 	this->child_sa->set_state(this->child_sa, CHILD_INSTALLED);
 	this->ike_sa->add_child_sa(this->ike_sa, this->child_sa);
 	this->established = TRUE;
+
+	if (!this->rekey)
+	{	/* a rekeyed SA uses the same reqid, no need for a new job */
+		schedule_inactivity_timeout(this);
+	}
 	return SUCCESS;
 }
 
@@ -476,7 +564,7 @@ static void build_payloads(private_child_create_t *this, message_t *message)
 		sa_payload = sa_payload_create_from_proposal(this->proposal);
 	}
 	message->add_payload(message, (payload_t*)sa_payload);
-	
+
 	/* add nonce payload if not in IKE_AUTH */
 	if (message->get_exchange_type(message) == CREATE_CHILD_SA)
 	{
@@ -484,14 +572,14 @@ static void build_payloads(private_child_create_t *this, message_t *message)
 		nonce_payload->set_nonce(nonce_payload, this->my_nonce);
 		message->add_payload(message, (payload_t*)nonce_payload);
 	}
-	
+
 	/* diffie hellman exchange, if PFS enabled */
 	if (this->dh)
 	{
 		ke_payload = ke_payload_create_from_diffie_hellman(this->dh);
 		message->add_payload(message, (payload_t*)ke_payload);
 	}
-	
+
 	/* add TSi/TSr payloads */
 	ts_payload = ts_payload_create_from_traffic_selectors(TRUE, this->tsi);
 	message->add_payload(message, (payload_t*)ts_payload);
@@ -524,12 +612,12 @@ static void add_ipcomp_notify(private_child_create_t *this,
 			 "IPComp disabled");
 		return;
 	}
-	
+
 	this->my_cpi = this->child_sa->alloc_cpi(this->child_sa);
 	if (this->my_cpi)
 	{
 		this->ipcomp = ipcomp;
-		message->add_notify(message, FALSE, IPCOMP_SUPPORTED, 
+		message->add_notify(message, FALSE, IPCOMP_SUPPORTED,
 							chunk_cata("cc", chunk_from_thing(this->my_cpi),
 									   chunk_from_thing(ipcomp)));
 	}
@@ -550,14 +638,22 @@ static void handle_notify(private_child_create_t *this, notify_payload_t *notify
 			this->mode = MODE_TRANSPORT;
 			break;
 		case USE_BEET_MODE:
-			this->mode = MODE_BEET;
+			if (this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN))
+			{	/* handle private use notify only if we know its meaning */
+				this->mode = MODE_BEET;
+			}
+			else
+			{
+				DBG1(DBG_IKE, "received a notify strongSwan uses for BEET "
+					 "mode, but peer implementation unknown, skipped");
+			}
 			break;
 		case IPCOMP_SUPPORTED:
 		{
 			ipcomp_transform_t ipcomp;
 			u_int16_t cpi;
 			chunk_t data;
-			
+
 			data = notify->get_notification_data(notify);
 			cpi = *(u_int16_t*)data.ptr;
 			ipcomp = (ipcomp_transform_t)(*(data.ptr + 2));
@@ -591,7 +687,7 @@ static void process_payloads(private_child_create_t *this, message_t *message)
 	sa_payload_t *sa_payload;
 	ke_payload_t *ke_payload;
 	ts_payload_t *ts_payload;
-	
+
 	/* defaults to TUNNEL mode */
 	this->mode = MODE_TUNNEL;
 
@@ -620,7 +716,7 @@ static void process_payloads(private_child_create_t *this, message_t *message)
 			case TRAFFIC_SELECTOR_INITIATOR:
 				ts_payload = (ts_payload_t*)payload;
 				this->tsi = ts_payload->get_traffic_selectors(ts_payload);
-				break;	
+				break;
 			case TRAFFIC_SELECTOR_RESPONDER:
 				ts_payload = (ts_payload_t*)payload;
 				this->tsr = ts_payload->get_traffic_selectors(ts_payload);
@@ -642,7 +738,7 @@ static status_t build_i(private_child_create_t *this, message_t *message)
 {
 	host_t *me, *other, *vip;
 	peer_cfg_t *peer_cfg;
-	
+
 	switch (message->get_exchange_type(message))
 	{
 		case IKE_SA_INIT:
@@ -668,7 +764,7 @@ static status_t build_i(private_child_create_t *this, message_t *message)
 		default:
 			break;
 	}
-	
+
 	if (this->reqid)
 	{
 		DBG0(DBG_IKE, "establishing CHILD_SA %s{%d}",
@@ -679,7 +775,7 @@ static status_t build_i(private_child_create_t *this, message_t *message)
 		DBG0(DBG_IKE, "establishing CHILD_SA %s",
 			 this->config->get_name(this->config));
 	}
-	
+
 	/* reuse virtual IP if we already have one */
 	me = this->ike_sa->get_virtual_ip(this->ike_sa, TRUE);
 	if (me == NULL)
@@ -691,7 +787,7 @@ static status_t build_i(private_child_create_t *this, message_t *message)
 	{
 		other = this->ike_sa->get_other_host(this->ike_sa);
 	}
-	
+
 	/* check if we want a virtual IP, but don't have one */
 	peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
 	vip = peer_cfg->get_virtual_ip(peer_cfg);
@@ -708,9 +804,9 @@ static status_t build_i(private_child_create_t *this, message_t *message)
 		this->tsi = this->config->get_traffic_selectors(this->config, TRUE,
 														NULL, me);
 	}
-	this->tsr = this->config->get_traffic_selectors(this->config, FALSE, 
+	this->tsr = this->config->get_traffic_selectors(this->config, FALSE,
 													NULL, other);
-	
+
 	if (this->packet_tsi)
 	{
 		this->tsi->insert_first(this->tsi,
@@ -724,37 +820,43 @@ static status_t build_i(private_child_create_t *this, message_t *message)
 	this->proposals = this->config->get_proposals(this->config,
 												  this->dh_group == MODP_NONE);
 	this->mode = this->config->get_mode(this->config);
-	
+	if (this->mode == MODE_TRANSPORT &&
+		this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY))
+	{
+		this->mode = MODE_TUNNEL;
+		DBG1(DBG_IKE, "not using transport mode, connection NATed");
+	}
+
 	this->child_sa = child_sa_create(this->ike_sa->get_my_host(this->ike_sa),
 			this->ike_sa->get_other_host(this->ike_sa), this->config, this->reqid,
 			this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY));
-	
+
 	if (!allocate_spi(this))
 	{
 		DBG1(DBG_IKE, "unable to allocate SPIs from kernel");
 		return FAILED;
 	}
-	
+
 	if (this->dh_group != MODP_NONE)
 	{
 		this->dh = this->keymat->create_dh(this->keymat, this->dh_group);
 	}
-	
+
 	if (this->config->use_ipcomp(this->config))
 	{
 		/* IPCOMP_DEFLATE is the only transform we support at the moment */
 		add_ipcomp_notify(this, message, IPCOMP_DEFLATE);
 	}
-	
+
 	build_payloads(this, message);
-	
+
 	this->tsi->destroy_offset(this->tsi, offsetof(traffic_selector_t, destroy));
 	this->tsr->destroy_offset(this->tsr, offsetof(traffic_selector_t, destroy));
 	this->proposals->destroy_offset(this->proposals, offsetof(proposal_t, destroy));
 	this->tsi = NULL;
 	this->tsr = NULL;
 	this->proposals = NULL;
-	
+
 	return NEED_MORE;
 }
 
@@ -779,9 +881,9 @@ static status_t process_r(private_child_create_t *this, message_t *message)
 		default:
 			break;
 	}
-	
+
 	process_payloads(this, message);
-	
+
 	return NEED_MORE;
 }
 
@@ -813,7 +915,7 @@ static status_t build_r(private_child_create_t *this, message_t *message)
 	payload_t *payload;
 	enumerator_t *enumerator;
 	bool no_dh = TRUE;
-	
+
 	switch (message->get_exchange_type(message))
 	{
 		case IKE_SA_INIT:
@@ -835,19 +937,19 @@ static status_t build_r(private_child_create_t *this, message_t *message)
 		default:
 			break;
 	}
-	
+
 	if (this->ike_sa->get_state(this->ike_sa) == IKE_REKEYING)
 	{
 		DBG1(DBG_IKE, "unable to create CHILD_SA while rekeying IKE_SA");
 		message->add_notify(message, TRUE, NO_ADDITIONAL_SAS, chunk_empty);
 		return SUCCESS;
 	}
-	
+
 	peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
 	if (peer_cfg && this->tsi && this->tsr)
 	{
 		host_t *me, *other;
-		
+
 		me = this->ike_sa->get_virtual_ip(this->ike_sa, TRUE);
 		if (me == NULL)
 		{
@@ -861,7 +963,7 @@ static status_t build_r(private_child_create_t *this, message_t *message)
 		this->config = peer_cfg->select_child_cfg(peer_cfg, this->tsr,
 												  this->tsi, me, other);
 	}
-	
+
 	if (this->config == NULL)
 	{
 		DBG1(DBG_IKE, "traffic selectors %#R=== %#R inacceptable",
@@ -870,7 +972,7 @@ static status_t build_r(private_child_create_t *this, message_t *message)
 		handle_child_sa_failure(this, message);
 		return SUCCESS;
 	}
-	
+
 	/* check if ike_config_t included non-critical error notifies */
 	enumerator = message->create_payload_enumerator(message);
 	while (enumerator->enumerate(enumerator, &payload))
@@ -878,7 +980,7 @@ static status_t build_r(private_child_create_t *this, message_t *message)
 		if (payload->get_type(payload) == NOTIFY)
 		{
 			notify_payload_t *notify = (notify_payload_t*)payload;
-			
+
 			switch (notify->get_notify_type(notify))
 			{
 				case INTERNAL_ADDRESS_FAILURE:
@@ -896,11 +998,11 @@ static status_t build_r(private_child_create_t *this, message_t *message)
 		}
 	}
 	enumerator->destroy(enumerator);
-	
+
 	this->child_sa = child_sa_create(this->ike_sa->get_my_host(this->ike_sa),
 			this->ike_sa->get_other_host(this->ike_sa), this->config, this->reqid,
 			this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY));
-	
+
 	if (this->ipcomp_received != IPCOMP_NONE)
 	{
 		if (this->config->use_ipcomp(this->config))
@@ -913,7 +1015,7 @@ static status_t build_r(private_child_create_t *this, message_t *message)
 				 notify_type_names, IPCOMP_SUPPORTED);
 		}
 	}
-	
+
 	switch (select_and_install(this, no_dh))
 	{
 		case SUCCESS:
@@ -936,9 +1038,9 @@ static status_t build_r(private_child_create_t *this, message_t *message)
 			handle_child_sa_failure(this, message);
 			return SUCCESS;
 	}
-	
+
 	build_payloads(this, message);
-	
+
 	DBG0(DBG_IKE, "CHILD_SA %s{%d} established "
 		 "with SPIs %.8x_i %.8x_o and TS %#R=== %#R",
 		 this->child_sa->get_name(this->child_sa),
@@ -947,7 +1049,7 @@ static status_t build_r(private_child_create_t *this, message_t *message)
 		 ntohl(this->child_sa->get_spi(this->child_sa, FALSE)),
 		 this->child_sa->get_traffic_selectors(this->child_sa, TRUE),
 		 this->child_sa->get_traffic_selectors(this->child_sa, FALSE));
-	
+
 	if (!this->rekey)
 	{	/* invoke the child_up() hook if we are not rekeying */
 		charon->bus->child_updown(charon->bus, this->child_sa, TRUE);
@@ -989,7 +1091,7 @@ static status_t process_i(private_child_create_t *this, message_t *message)
 		{
 			notify_payload_t *notify = (notify_payload_t*)payload;
 			notify_type_t type = notify->get_notify_type(notify);
-			
+
 			switch (type)
 			{
 				/* handle notify errors related to CHILD_SA only */
@@ -1011,15 +1113,18 @@ static status_t process_i(private_child_create_t *this, message_t *message)
 				case INVALID_KE_PAYLOAD:
 				{
 					chunk_t data;
-					diffie_hellman_group_t bad_group;
-					
-					bad_group = this->dh_group;
+					u_int16_t group = MODP_NONE;
+
 					data = notify->get_notification_data(notify);
-					this->dh_group = ntohs(*((u_int16_t*)data.ptr));
+					if (data.len == sizeof(group))
+					{
+						memcpy(&group, data.ptr, data.len);
+						group = ntohs(group);
+					}
 					DBG1(DBG_IKE, "peer didn't accept DH group %N, "
 						 "it requested %N", diffie_hellman_group_names,
-						 bad_group, diffie_hellman_group_names, this->dh_group);
-					
+						 this->dh_group, diffie_hellman_group_names, group);
+					this->dh_group = group;
 					this->public.task.migrate(&this->public.task, this->ike_sa);
 					enumerator->destroy(enumerator);
 					return NEED_MORE;
@@ -1030,9 +1135,9 @@ static status_t process_i(private_child_create_t *this, message_t *message)
 		}
 	}
 	enumerator->destroy(enumerator);
-	
+
 	process_payloads(this, message);
-	
+
 	if (this->ipcomp == IPCOMP_NONE && this->ipcomp_received != IPCOMP_NONE)
 	{
 		DBG1(DBG_IKE, "received an IPCOMP_SUPPORTED notify without requesting"
@@ -1053,7 +1158,7 @@ static status_t process_i(private_child_create_t *this, message_t *message)
 		handle_child_sa_failure(this, message);
 		return SUCCESS;
 	}
-	
+
 	if (select_and_install(this, no_dh) == SUCCESS)
 	{
 		DBG0(DBG_IKE, "CHILD_SA %s{%d} established "
@@ -1064,7 +1169,7 @@ static status_t process_i(private_child_create_t *this, message_t *message)
 			 ntohl(this->child_sa->get_spi(this->child_sa, FALSE)),
 			 this->child_sa->get_traffic_selectors(this->child_sa, TRUE),
 			 this->child_sa->get_traffic_selectors(this->child_sa, FALSE));
-		
+
 		if (!this->rekey)
 		{	/* invoke the child_up() hook if we are not rekeying */
 			charon->bus->child_updown(charon->bus, this->child_sa, TRUE);
@@ -1105,7 +1210,7 @@ static child_sa_t* get_child(private_child_create_t *this)
  * Implementation of child_create_t.get_lower_nonce
  */
 static chunk_t get_lower_nonce(private_child_create_t *this)
-{	
+{
 	if (memcmp(this->my_nonce.ptr, this->other_nonce.ptr,
 			   min(this->my_nonce.len, this->other_nonce.len)) < 0)
 	{
@@ -1139,7 +1244,7 @@ static void migrate(private_child_create_t *this, ike_sa_t *ike_sa)
 	{
 		this->proposals->destroy_offset(this->proposals, offsetof(proposal_t, destroy));
 	}
-	
+
 	this->ike_sa = ike_sa;
 	this->keymat = ike_sa->get_keymat(ike_sa);
 	this->proposal = NULL;
@@ -1183,7 +1288,7 @@ static void destroy(private_child_create_t *this)
 	{
 		this->proposals->destroy_offset(this->proposals, offsetof(proposal_t, destroy));
 	}
-	
+
 	DESTROY_IF(this->config);
 	free(this);
 }
@@ -1216,7 +1321,7 @@ child_create_t *child_create_create(ike_sa_t *ike_sa,
 		this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
 		this->initiator = FALSE;
 	}
-	
+
 	this->ike_sa = ike_sa;
 	this->config = config;
 	this->my_nonce = chunk_empty;
@@ -1241,6 +1346,6 @@ child_create_t *child_create_create(ike_sa_t *ike_sa,
 	this->reqid = 0;
 	this->established = FALSE;
 	this->rekey = rekey;
-	
+
 	return &this->public;
 }
diff --git a/src/charon/sa/tasks/child_create.h b/src/charon/sa/tasks/child_create.h
index 41f4fe2c8..5dedeb8b1 100644
--- a/src/charon/sa/tasks/child_create.h
+++ b/src/charon/sa/tasks/child_create.h
@@ -31,7 +31,7 @@ typedef struct child_create_t child_create_t;
 /**
  * Task of type CHILD_CREATE, established a new CHILD_SA.
  *
- * This task may be included in the IKE_AUTH message or in a separate 
+ * This task may be included in the IKE_AUTH message or in a separate
  * CREATE_CHILD_SA exchange.
  */
 struct child_create_t {
@@ -40,24 +40,24 @@ struct child_create_t {
 	 * Implements the task_t interface
 	 */
 	task_t task;
-	
+
 	/**
 	 * Use a specific reqid for the CHILD_SA.
 	 *
 	 * When this task is used for rekeying, the same reqid is used
-	 * for the new CHILD_SA. 
+	 * for the new CHILD_SA.
 	 *
 	 * @param reqid		reqid to use
 	 */
 	void (*use_reqid) (child_create_t *this, u_int32_t reqid);
-	
+
 	/**
 	 * Get the lower of the two nonces, used for rekey collisions.
 	 *
 	 * @return			lower nonce
 	 */
 	chunk_t (*get_lower_nonce) (child_create_t *this);
-	
+
 	/**
 	 * Get the CHILD_SA established/establishing by this task.
 	 *
diff --git a/src/charon/sa/tasks/child_delete.c b/src/charon/sa/tasks/child_delete.c
index 7abb07a84..d7c6b0541 100644
--- a/src/charon/sa/tasks/child_delete.c
+++ b/src/charon/sa/tasks/child_delete.c
@@ -25,42 +25,42 @@ typedef struct private_child_delete_t private_child_delete_t;
  * Private members of a child_delete_t task.
  */
 struct private_child_delete_t {
-	
+
 	/**
 	 * Public methods and task_t interface.
 	 */
 	child_delete_t public;
-	
+
 	/**
 	 * Assigned IKE_SA.
 	 */
 	ike_sa_t *ike_sa;
-	
+
 	/**
 	 * Are we the initiator?
 	 */
 	bool initiator;
-	
+
 	/**
 	 * Protocol of CHILD_SA to delete
 	 */
 	protocol_id_t protocol;
-	
+
 	/**
 	 * Inbound SPI of CHILD_SA to delete
 	 */
 	u_int32_t spi;
-	
+
 	/**
 	 * whether to enforce delete action policy
 	 */
 	bool check_delete_action;
-	
+
 	/**
 	 * is this delete exchange following a rekey?
 	 */
 	bool rekeyed;
-	
+
 	/**
 	 * CHILD_SAs which get deleted
 	 */
@@ -75,10 +75,10 @@ static void build_payloads(private_child_delete_t *this, message_t *message)
 	delete_payload_t *ah = NULL, *esp = NULL;
 	iterator_t *iterator;
 	child_sa_t *child_sa;
-	
+
 	iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
 	while (iterator->iterate(iterator, (void**)&child_sa))
-	{	
+	{
 		protocol_id_t protocol = child_sa->get_protocol(child_sa);
 		u_int32_t spi = child_sa->get_spi(child_sa, TRUE);
 
@@ -91,7 +91,7 @@ static void build_payloads(private_child_delete_t *this, message_t *message)
 					message->add_payload(message, (payload_t*)esp);
 				}
 				esp->add_spi(esp, spi);
-				DBG1(DBG_IKE, "sending DELETE for %N CHILD_SA with SPI %.8x", 
+				DBG1(DBG_IKE, "sending DELETE for %N CHILD_SA with SPI %.8x",
 							   protocol_id_names, protocol, ntohl(spi));
 				break;
 			case PROTO_AH:
@@ -101,7 +101,7 @@ static void build_payloads(private_child_delete_t *this, message_t *message)
 					message->add_payload(message, (payload_t*)ah);
 				}
 				ah->add_spi(ah, spi);
-				DBG1(DBG_IKE, "sending DELETE for %N CHILD_SA with SPI %.8x", 
+				DBG1(DBG_IKE, "sending DELETE for %N CHILD_SA with SPI %.8x",
 							   protocol_id_names, protocol, ntohl(spi));
 				break;
 			default:
@@ -124,7 +124,7 @@ static void process_payloads(private_child_delete_t *this, message_t *message)
 	u_int32_t *spi;
 	protocol_id_t protocol;
 	child_sa_t *child_sa;
-	
+
 	payloads = message->create_payload_enumerator(message);
 	while (payloads->enumerate(payloads, &payload))
 	{
@@ -147,9 +147,9 @@ static void process_payloads(private_child_delete_t *this, message_t *message)
 						 "but no such SA", protocol_id_names, protocol, ntohl(*spi));
 					continue;
 				}
-				DBG1(DBG_IKE, "received DELETE for %N CHILD_SA with SPI %.8x", 
+				DBG1(DBG_IKE, "received DELETE for %N CHILD_SA with SPI %.8x",
 						protocol_id_names, protocol, ntohl(*spi));
-				
+
 				switch (child_sa->get_state(child_sa))
 				{
 					case CHILD_REKEYING:
@@ -172,7 +172,7 @@ static void process_payloads(private_child_delete_t *this, message_t *message)
 					default:
 						break;
 				}
-				
+
 				this->child_sas->insert_last(this->child_sas, child_sa);
 			}
 			spis->destroy(spis);
@@ -192,7 +192,7 @@ static status_t destroy_and_reestablish(private_child_delete_t *this)
 	protocol_id_t protocol;
 	u_int32_t spi;
 	status_t status = SUCCESS;
-	
+
 	iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
 	while (iterator->iterate(iterator, (void**)&child_sa))
 	{
@@ -215,7 +215,7 @@ static status_t destroy_and_reestablish(private_child_delete_t *this)
 					status = this->ike_sa->initiate(this->ike_sa, child_cfg, 0,
 													NULL, NULL);
 					break;
-				case ACTION_ROUTE:	
+				case ACTION_ROUTE:
 					charon->traps->install(charon->traps,
 							this->ike_sa->get_peer_cfg(this->ike_sa), child_cfg);
 					break;
@@ -241,13 +241,13 @@ static void log_children(private_child_delete_t *this)
 	iterator_t *iterator;
 	child_sa_t *child_sa;
 	u_int64_t bytes_in, bytes_out;
-	
+
 	iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
 	while (iterator->iterate(iterator, (void**)&child_sa))
 	{
 		child_sa->get_usestats(child_sa, TRUE, NULL, &bytes_in);
 		child_sa->get_usestats(child_sa, FALSE, NULL, &bytes_out);
-		
+
 		DBG0(DBG_IKE, "closing CHILD_SA %s{%d} "
 			 "with SPIs %.8x_i (%llu bytes) %.8x_o (%llu bytes) and TS %#R=== %#R",
 			 child_sa->get_name(child_sa), child_sa->get_reqid(child_sa),
@@ -265,12 +265,19 @@ static void log_children(private_child_delete_t *this)
 static status_t build_i(private_child_delete_t *this, message_t *message)
 {
 	child_sa_t *child_sa;
-	
+
 	child_sa = this->ike_sa->get_child_sa(this->ike_sa, this->protocol,
 										  this->spi, TRUE);
 	if (!child_sa)
-	{	/* child does not exist anymore */
-		return SUCCESS;
+	{	/* check if it is an outbound sa */
+		child_sa = this->ike_sa->get_child_sa(this->ike_sa, this->protocol,
+											  this->spi, FALSE);
+		if (!child_sa)
+		{	/* child does not exist anymore */
+			return SUCCESS;
+		}
+		/* we work only with the inbound SPI */
+		this->spi = child_sa->get_spi(child_sa, TRUE);
 	}
 	this->child_sas->insert_last(this->child_sas, child_sa);
 	if (child_sa->get_state(child_sa) == CHILD_REKEYING)
@@ -290,7 +297,7 @@ static status_t process_i(private_child_delete_t *this, message_t *message)
 	/* flush the list before adding new SAs */
 	this->child_sas->destroy(this->child_sas);
 	this->child_sas = linked_list_create();
-	
+
 	process_payloads(this, message);
 	DBG1(DBG_IKE, "CHILD_SA closed");
 	return destroy_and_reestablish(this);
@@ -314,7 +321,7 @@ static status_t build_r(private_child_delete_t *this, message_t *message)
 	/* if we are rekeying, we send an empty informational */
 	if (this->ike_sa->get_state(this->ike_sa) != IKE_REKEYING)
 	{
-		build_payloads(this, message);	
+		build_payloads(this, message);
 	}
 	DBG1(DBG_IKE, "CHILD_SA closed");
 	return destroy_and_reestablish(this);
@@ -345,7 +352,7 @@ static void migrate(private_child_delete_t *this, ike_sa_t *ike_sa)
 {
 	this->check_delete_action = FALSE;
 	this->ike_sa = ike_sa;
-	
+
 	this->child_sas->destroy(this->child_sas);
 	this->child_sas = linked_list_create();
 }
@@ -371,14 +378,14 @@ child_delete_t *child_delete_create(ike_sa_t *ike_sa, protocol_id_t protocol,
 	this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
 	this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
 	this->public.task.destroy = (void(*)(task_t*))destroy;
-	
+
 	this->ike_sa = ike_sa;
 	this->check_delete_action = FALSE;
 	this->child_sas = linked_list_create();
 	this->protocol = protocol;
 	this->spi = spi;
 	this->rekeyed = FALSE;
-	
+
 	if (protocol != PROTO_NONE)
 	{
 		this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
diff --git a/src/charon/sa/tasks/child_delete.h b/src/charon/sa/tasks/child_delete.h
index 27d847035..365807c68 100644
--- a/src/charon/sa/tasks/child_delete.h
+++ b/src/charon/sa/tasks/child_delete.h
@@ -37,7 +37,7 @@ struct child_delete_t {
 	 * Implements the task_t interface
 	 */
 	task_t task;
-	
+
 	/**
 	 * Get the CHILD_SA to delete by this task.
 	 *
diff --git a/src/charon/sa/tasks/child_rekey.c b/src/charon/sa/tasks/child_rekey.c
index 601e054ea..b5e4e84b4 100644
--- a/src/charon/sa/tasks/child_rekey.c
+++ b/src/charon/sa/tasks/child_rekey.c
@@ -30,47 +30,47 @@ typedef struct private_child_rekey_t private_child_rekey_t;
  * Private members of a child_rekey_t task.
  */
 struct private_child_rekey_t {
-	
+
 	/**
 	 * Public methods and task_t interface.
 	 */
 	child_rekey_t public;
-	
+
 	/**
 	 * Assigned IKE_SA.
 	 */
 	ike_sa_t *ike_sa;
-	
+
 	/**
 	 * Are we the initiator?
 	 */
 	bool initiator;
-	
+
 	/**
 	 * Protocol of CHILD_SA to rekey
 	 */
 	protocol_id_t protocol;
-	
+
 	/**
 	 * Inbound SPI of CHILD_SA to rekey
 	 */
 	u_int32_t spi;
-	
+
 	/**
 	 * the CHILD_CREATE task which is reused to simplify rekeying
 	 */
 	child_create_t *child_create;
-	
+
 	/**
 	 * the CHILD_DELETE task to delete rekeyed CHILD_SA
 	 */
 	child_delete_t *child_delete;
-	
+
 	/**
 	 * CHILD_SA which gets rekeyed
 	 */
 	child_sa_t *child_sa;
-	
+
 	/**
 	 * colliding task, may be delete or rekey
 	 */
@@ -84,7 +84,7 @@ static status_t build_i_delete(private_child_rekey_t *this, message_t *message)
 {
 	/* update exchange type to INFORMATIONAL for the delete */
 	message->set_exchange_type(message, INFORMATIONAL);
-	
+
 	return this->child_delete->task.build(&this->child_delete->task, message);
 }
 
@@ -101,35 +101,22 @@ static status_t process_i_delete(private_child_rekey_t *this, message_t *message
  */
 static void find_child(private_child_rekey_t *this, message_t *message)
 {
-	enumerator_t *enumerator;
-	payload_t *payload;
-	
-	enumerator = message->create_payload_enumerator(message);
-	while (enumerator->enumerate(enumerator, &payload))
+	notify_payload_t *notify;
+	protocol_id_t protocol;
+	u_int32_t spi;
+
+	notify = message->get_notify(message, REKEY_SA);
+	if (notify)
 	{
-		notify_payload_t *notify;
-		u_int32_t spi;
-		protocol_id_t protocol;
-		
-		if (payload->get_type(payload) != NOTIFY)
-		{
-			continue;
-		}
-		
-		notify = (notify_payload_t*)payload;
 		protocol = notify->get_protocol_id(notify);
 		spi = notify->get_spi(notify);
-		
-		if (protocol != PROTO_ESP && protocol != PROTO_AH)
+
+		if (protocol == PROTO_ESP || protocol == PROTO_AH)
 		{
-			continue;
+			this->child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol,
+														spi, FALSE);
 		}
-		this->child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol,
-													spi, FALSE);
-		break;
-			
 	}
-	enumerator->destroy(enumerator);
 }
 
 /**
@@ -140,30 +127,42 @@ static status_t build_i(private_child_rekey_t *this, message_t *message)
 	notify_payload_t *notify;
 	u_int32_t reqid;
 	child_cfg_t *config;
-	
+
 	this->child_sa = this->ike_sa->get_child_sa(this->ike_sa, this->protocol,
 												this->spi, TRUE);
 	if (!this->child_sa)
-	{	/* CHILD_SA is gone, unable to rekey */
-		return SUCCESS;
+	{	/* check if it is an outbound CHILD_SA */
+		this->child_sa = this->ike_sa->get_child_sa(this->ike_sa, this->protocol,
+													this->spi, FALSE);
+		if (!this->child_sa)
+		{	/* CHILD_SA is gone, unable to rekey. As an empty CREATE_CHILD_SA
+			 * exchange is invalid, we fall back to an INFORMATIONAL exchange.*/
+			message->set_exchange_type(message, INFORMATIONAL);
+			return SUCCESS;
+		}
+		/* we work only with the inbound SPI */
+		this->spi = this->child_sa->get_spi(this->child_sa, TRUE);
 	}
 	config = this->child_sa->get_config(this->child_sa);
-	
+
 	/* we just need the rekey notify ... */
 	notify = notify_payload_create_from_protocol_and_type(this->protocol,
 														  REKEY_SA);
 	notify->set_spi(notify, this->spi);
 	message->add_payload(message, (payload_t*)notify);
-	
+
 	/* ... our CHILD_CREATE task does the hard work for us. */
+	if (!this->child_create)
+	{
+		this->child_create = child_create_create(this->ike_sa, config, TRUE,
+												 NULL, NULL);
+	}
 	reqid = this->child_sa->get_reqid(this->child_sa);
-	this->child_create = child_create_create(this->ike_sa, config, TRUE,
-											 NULL, NULL);
 	this->child_create->use_reqid(this->child_create, reqid);
 	this->child_create->task.build(&this->child_create->task, message);
-	
+
 	this->child_sa->set_state(this->child_sa, CHILD_REKEYING);
-	
+
 	return NEED_MORE;
 }
 
@@ -174,9 +173,9 @@ static status_t process_r(private_child_rekey_t *this, message_t *message)
 {
 	/* let the CHILD_CREATE task process the message */
 	this->child_create->task.process(&this->child_create->task, message);
-	
+
 	find_child(this, message);
-	
+
 	return NEED_MORE;
 }
 
@@ -194,21 +193,21 @@ static status_t build_r(private_child_rekey_t *this, message_t *message)
 		message->add_notify(message, TRUE, NO_PROPOSAL_CHOSEN, chunk_empty);
 		return SUCCESS;
 	}
-	
+
 	/* let the CHILD_CREATE task build the response */
 	reqid = this->child_sa->get_reqid(this->child_sa);
 	this->child_create->use_reqid(this->child_create, reqid);
 	this->child_create->task.build(&this->child_create->task, message);
-	
+
 	if (message->get_payload(message, SECURITY_ASSOCIATION) == NULL)
 	{
 		/* rekeying failed, reuse old child */
 		this->child_sa->set_state(this->child_sa, CHILD_INSTALLED);
 		return SUCCESS;
 	}
-	
+
 	this->child_sa->set_state(this->child_sa, CHILD_REKEYING);
-	
+
 	/* invoke rekey hook */
 	charon->bus->child_rekey(charon->bus, this->child_sa,
 							 this->child_create->get_child(this->child_create));
@@ -223,33 +222,20 @@ static status_t process_i(private_child_rekey_t *this, message_t *message)
 	protocol_id_t protocol;
 	u_int32_t spi;
 	child_sa_t *to_delete;
-	enumerator_t *enumerator;
-	payload_t *payload;
-	
-	/* handle NO_ADDITIONAL_SAS notify */
-	enumerator = message->create_payload_enumerator(message);
-	while (enumerator->enumerate(enumerator, &payload))
+
+	if (message->get_notify(message, NO_ADDITIONAL_SAS))
 	{
-		if (payload->get_type(payload) == NOTIFY)
-		{
-			notify_payload_t *notify = (notify_payload_t*)payload;
-			
-			if (notify->get_notify_type(notify) == NO_ADDITIONAL_SAS)
-			{
-				DBG1(DBG_IKE, "peer seems to not support CHILD_SA rekeying, "
-					 "starting reauthentication");
-				this->child_sa->set_state(this->child_sa, CHILD_INSTALLED);
-				charon->processor->queue_job(charon->processor,
-						(job_t*)rekey_ike_sa_job_create(
-									this->ike_sa->get_id(this->ike_sa), TRUE));
-				enumerator->destroy(enumerator);
-				return SUCCESS;
-			}
-		}
+		DBG1(DBG_IKE, "peer seems to not support CHILD_SA rekeying, "
+			 "starting reauthentication");
+		this->child_sa->set_state(this->child_sa, CHILD_INSTALLED);
+		charon->processor->queue_job(charon->processor,
+				(job_t*)rekey_ike_sa_job_create(
+							this->ike_sa->get_id(this->ike_sa), TRUE));
+		return SUCCESS;
 	}
-	enumerator->destroy(enumerator);
-	
-	if (this->child_create->task.process(&this->child_create->task, message) == NEED_MORE)
+
+	if (this->child_create->task.process(&this->child_create->task,
+										 message) == NEED_MORE)
 	{
 		/* bad DH group while rekeying, try again */
 		this->child_create->task.migrate(&this->child_create->task, this->ike_sa);
@@ -259,39 +245,39 @@ static status_t process_i(private_child_rekey_t *this, message_t *message)
 	{
 		/* establishing new child failed, reuse old. but not when we
 		 * recieved a delete in the meantime */
-		if (!(this->collision && 
+		if (!(this->collision &&
 			  this->collision->get_type(this->collision) == CHILD_DELETE))
 		{
 			job_t *job;
 			u_int32_t retry = RETRY_INTERVAL - (random() % RETRY_JITTER);
-			
+
 			job = (job_t*)rekey_child_sa_job_create(
 								this->child_sa->get_reqid(this->child_sa),
 								this->child_sa->get_protocol(this->child_sa),
 								this->child_sa->get_spi(this->child_sa, TRUE));
 			DBG1(DBG_IKE, "CHILD_SA rekeying failed, "
-				 				"trying again in %d seconds", retry);
+								"trying again in %d seconds", retry);
 			this->child_sa->set_state(this->child_sa, CHILD_INSTALLED);
 			charon->scheduler->schedule_job(charon->scheduler, job, retry);
 		}
 		return SUCCESS;
 	}
-	
+
 	to_delete = this->child_sa;
-	
+
 	/* check for rekey collisions */
 	if (this->collision &&
 		this->collision->get_type(this->collision) == CHILD_REKEY)
 	{
 		chunk_t this_nonce, other_nonce;
 		private_child_rekey_t *other = (private_child_rekey_t*)this->collision;
-		
+
 		this_nonce = this->child_create->get_lower_nonce(this->child_create);
 		other_nonce = other->child_create->get_lower_nonce(other->child_create);
-		
+
 		/* if we have the lower nonce, delete rekeyed SA. If not, delete
 		 * the redundant. */
-		if (memcmp(this_nonce.ptr, other_nonce.ptr, 
+		if (memcmp(this_nonce.ptr, other_nonce.ptr,
 				   min(this_nonce.len, other_nonce.len)) < 0)
 		{
 			DBG1(DBG_IKE, "CHILD_SA rekey collision won, deleting rekeyed child");
@@ -307,21 +293,21 @@ static status_t process_i(private_child_rekey_t *this, message_t *message)
 			}
 		}
 	}
-	
+
 	if (to_delete != this->child_create->get_child(this->child_create))
 	{	/* invoke rekey hook if rekeying successful */
 		charon->bus->child_rekey(charon->bus, this->child_sa,
 							this->child_create->get_child(this->child_create));
 	}
-	
+
 	spi = to_delete->get_spi(to_delete, TRUE);
 	protocol = to_delete->get_protocol(to_delete);
-	
+
 	/* rekeying done, delete the obsolete CHILD_SA using a subtask */
 	this->child_delete = child_delete_create(this->ike_sa, protocol, spi);
 	this->public.task.build = (status_t(*)(task_t*,message_t*))build_i_delete;
 	this->public.task.process = (status_t(*)(task_t*,message_t*))process_i_delete;
-	
+
 	return NEED_MORE;
 }
 
@@ -338,7 +324,7 @@ static task_type_t get_type(private_child_rekey_t *this)
  */
 static void collide(private_child_rekey_t *this, task_t *other)
 {
-	/* the task manager only detects exchange collision, but not if 
+	/* the task manager only detects exchange collision, but not if
 	 * the collision is for the same child. we check it here. */
 	if (other->get_type(other) == CHILD_REKEY)
 	{
@@ -346,6 +332,7 @@ static void collide(private_child_rekey_t *this, task_t *other)
 		if (rekey == NULL || rekey->child_sa != this->child_sa)
 		{
 			/* not the same child => no collision */
+			other->destroy(other);
 			return;
 		}
 	}
@@ -354,13 +341,15 @@ static void collide(private_child_rekey_t *this, task_t *other)
 		child_delete_t *del = (child_delete_t*)other;
 		if (del == NULL || del->get_child(del) != this->child_sa)
 		{
-			/* not the same child => no collision */ 
+			/* not the same child => no collision */
+			other->destroy(other);
 			return;
 		}
 	}
 	else
 	{
 		/* any other task is not critical for collisisions, ignore */
+		other->destroy(other);
 		return;
 	}
 	DESTROY_IF(this->collision);
@@ -371,7 +360,7 @@ static void collide(private_child_rekey_t *this, task_t *other)
  * Implementation of task_t.migrate
  */
 static void migrate(private_child_rekey_t *this, ike_sa_t *ike_sa)
-{	
+{
 	if (this->child_create)
 	{
 		this->child_create->task.migrate(&this->child_create->task, ike_sa);
@@ -381,7 +370,7 @@ static void migrate(private_child_rekey_t *this, ike_sa_t *ike_sa)
 		this->child_delete->task.migrate(&this->child_delete->task, ike_sa);
 	}
 	DESTROY_IF(this->collision);
-	
+
 	this->ike_sa = ike_sa;
 	this->collision = NULL;
 }
@@ -410,7 +399,7 @@ child_rekey_t *child_rekey_create(ike_sa_t *ike_sa, protocol_id_t protocol,
 								  u_int32_t spi)
 {
 	private_child_rekey_t *this = malloc_thing(private_child_rekey_t);
-	
+
 	this->public.collide = (void (*)(child_rekey_t*,task_t*))collide;
 	this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
 	this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
@@ -429,13 +418,13 @@ child_rekey_t *child_rekey_create(ike_sa_t *ike_sa, protocol_id_t protocol,
 		this->initiator = FALSE;
 		this->child_create = child_create_create(ike_sa, NULL, TRUE, NULL, NULL);
 	}
-	
+
 	this->ike_sa = ike_sa;
 	this->child_sa = NULL;
 	this->protocol = protocol;
 	this->spi = spi;
 	this->collision = NULL;
 	this->child_delete = NULL;
-	
+
 	return &this->public;
 }
diff --git a/src/charon/sa/tasks/child_rekey.h b/src/charon/sa/tasks/child_rekey.h
index 5aae2fb39..9b1aea5fa 100644
--- a/src/charon/sa/tasks/child_rekey.h
+++ b/src/charon/sa/tasks/child_rekey.h
@@ -37,7 +37,7 @@ struct child_rekey_t {
 	 * Implements the task_t interface
 	 */
 	task_t task;
-	
+
 	/**
 	 * Register a rekeying task which collides with this one
 	 *
@@ -56,7 +56,7 @@ struct child_rekey_t {
  * @param ike_sa		IKE_SA this task works for
  * @param protocol		protocol of CHILD_SA to rekey, PROTO_NONE as responder
  * @param spi			inbound SPI of CHILD_SA to rekey
- * @return			  	child_rekey task to handle by the task_manager
+ * @return				child_rekey task to handle by the task_manager
  */
 child_rekey_t *child_rekey_create(ike_sa_t *ike_sa, protocol_id_t protocol,
 								  u_int32_t spi);
diff --git a/src/charon/sa/tasks/ike_auth.c b/src/charon/sa/tasks/ike_auth.c
index d0b2a7e91..a07f96767 100644
--- a/src/charon/sa/tasks/ike_auth.c
+++ b/src/charon/sa/tasks/ike_auth.c
@@ -31,82 +31,72 @@ typedef struct private_ike_auth_t private_ike_auth_t;
  * Private members of a ike_auth_t task.
  */
 struct private_ike_auth_t {
-	
+
 	/**
 	 * Public methods and task_t interface.
 	 */
 	ike_auth_t public;
-	
+
 	/**
 	 * Assigned IKE_SA.
 	 */
 	ike_sa_t *ike_sa;
-	
+
 	/**
 	 * Are we the initiator?
 	 */
 	bool initiator;
-	
+
 	/**
 	 * Nonce chosen by us in ike_init
 	 */
 	chunk_t my_nonce;
-	
+
 	/**
 	 * Nonce chosen by peer in ike_init
 	 */
 	chunk_t other_nonce;
-	
+
 	/**
 	 * IKE_SA_INIT message sent by us
 	 */
 	packet_t *my_packet;
-	
+
 	/**
 	 * IKE_SA_INIT message sent by peer
 	 */
 	packet_t *other_packet;
-	
-	/**
-	 * completed authentication configs initiated by us (auth_cfg_t)
-	 */
-	linked_list_t *my_cfgs;
-	
-	/**
-	 * completed authentication configs initiated by other (auth_cfg_t)
-	 */
-	linked_list_t *other_cfgs;;
-	
+
 	/**
 	 * currently active authenticator, to authenticate us
 	 */
 	authenticator_t *my_auth;
-	
+
 	/**
 	 * currently active authenticator, to authenticate peer
 	 */
 	authenticator_t *other_auth;
-	
+
 	/**
 	 * peer_cfg candidates, ordered by priority
 	 */
 	linked_list_t *candidates;
-	
+
 	/**
 	 * selected peer config (might change when using multiple authentications)
 	 */
 	peer_cfg_t *peer_cfg;
-	
+
 	/**
 	 * have we planned an(other) authentication exchange?
 	 */
 	bool do_another_auth;
-	
+
 	/**
 	 * has the peer announced another authentication exchange?
 	 */
 	bool expect_another_auth;
-	
+
 	/**
 	 * should we send a AUTHENTICATION_FAILED notify?
 	 */
@@ -129,7 +119,7 @@ static status_t collect_my_init_data(private_ike_auth_t *this,
 									 message_t *message)
 {
 	nonce_payload_t *nonce;
-	
+
 	/* get the nonce that was generated in ike_init */
 	nonce = (nonce_payload_t*)message->get_payload(message, NONCE);
 	if (nonce == NULL)
@@ -137,14 +127,14 @@ static status_t collect_my_init_data(private_ike_auth_t *this,
 		return FAILED;
 	}
 	this->my_nonce = nonce->get_nonce(nonce);
-	
+
 	/* pre-generate the message, keep a copy */
 	if (this->ike_sa->generate_message(this->ike_sa, message,
 									   &this->my_packet) != SUCCESS)
 	{
 		return FAILED;
 	}
-	return NEED_MORE; 
+	return NEED_MORE;
 }
 
 /**
@@ -155,7 +145,7 @@ static status_t collect_other_init_data(private_ike_auth_t *this,
 {
 	/* we collect the needed information in the IKE_SA_INIT exchange */
 	nonce_payload_t *nonce;
-	
+
 	/* get the nonce that was generated in ike_init */
 	nonce = (nonce_payload_t*)message->get_payload(message, NONCE);
 	if (nonce == NULL)
@@ -163,10 +153,10 @@ static status_t collect_other_init_data(private_ike_auth_t *this,
 		return FAILED;
 	}
 	this->other_nonce = nonce->get_nonce(nonce);
-	
+
 	/* keep a copy of the received packet */
 	this->other_packet = message->get_packet(message);
-	return NEED_MORE; 
+	return NEED_MORE;
 }
 
 /**
@@ -176,21 +166,14 @@ static auth_cfg_t *get_auth_cfg(private_ike_auth_t *this, bool local)
 {
 	enumerator_t *e1, *e2;
 	auth_cfg_t *c1, *c2, *next = NULL;
-	
+
 	/* find an available config not already done */
 	e1 = this->peer_cfg->create_auth_cfg_enumerator(this->peer_cfg, local);
 	while (e1->enumerate(e1, &c1))
 	{
 		bool found = FALSE;
-		
-		if (local)
-		{
-			e2 = this->my_cfgs->create_enumerator(this->my_cfgs);
-		}
-		else
-		{
-			e2 = this->other_cfgs->create_enumerator(this->other_cfgs);
-		}
+
+		e2 = this->ike_sa->create_auth_cfg_enumerator(this->ike_sa, local);
 		while (e2->enumerate(e2, &c2))
 		{
 			if (c2->complies(c2, c1, FALSE))
@@ -218,13 +201,13 @@ static bool do_another_auth(private_ike_auth_t *this)
 	bool do_another = FALSE;
 	enumerator_t *done, *todo;
 	auth_cfg_t *done_cfg, *todo_cfg;
-	
+
 	if (!this->ike_sa->supports_extension(this->ike_sa, EXT_MULTIPLE_AUTH))
 	{
 		return FALSE;
 	}
-	
-	done = this->my_cfgs->create_enumerator(this->my_cfgs);
+
+	done = this->ike_sa->create_auth_cfg_enumerator(this->ike_sa, TRUE);
 	todo = this->peer_cfg->create_auth_cfg_enumerator(this->peer_cfg, TRUE);
 	while (todo->enumerate(todo, &todo_cfg))
 	{
@@ -252,12 +235,12 @@ static bool load_cfg_candidates(private_ike_auth_t *this)
 	peer_cfg_t *peer_cfg;
 	host_t *me, *other;
 	identification_t *my_id, *other_id;
-	
+
 	me = this->ike_sa->get_my_host(this->ike_sa);
 	other = this->ike_sa->get_other_host(this->ike_sa);
 	my_id = this->ike_sa->get_my_id(this->ike_sa);
 	other_id = this->ike_sa->get_other_id(this->ike_sa);
-	
+
 	enumerator = charon->backends->create_peer_cfg_enumerator(charon->backends,
 													me, other, my_id, other_id);
 	while (enumerator->enumerate(enumerator, &peer_cfg))
@@ -296,10 +279,10 @@ static bool update_cfg_candidates(private_ike_auth_t *this, bool strict)
 			bool complies = TRUE;
 			enumerator_t *e1, *e2, *tmp;
 			auth_cfg_t *c1, *c2;
-			
-			e1 = this->other_cfgs->create_enumerator(this->other_cfgs);
+
+			e1 = this->ike_sa->create_auth_cfg_enumerator(this->ike_sa, FALSE);
 			e2 = this->peer_cfg->create_auth_cfg_enumerator(this->peer_cfg, FALSE);
-			
+
 			if (strict)
 			{	/* swap lists in strict mode: all configured rounds must be
 				 * fulfilled. If !strict, we check only the rounds done so far. */
@@ -342,7 +325,7 @@ static bool update_cfg_candidates(private_ike_auth_t *this, bool strict)
 		}
 	}
 	while (this->peer_cfg);
-	
+
 	return this->peer_cfg != NULL;
 }
 
@@ -352,39 +335,45 @@ static bool update_cfg_candidates(private_ike_auth_t *this, bool strict)
 static status_t build_i(private_ike_auth_t *this, message_t *message)
 {
 	auth_cfg_t *cfg;
-	
+
 	if (message->get_exchange_type(message) == IKE_SA_INIT)
 	{
 		return collect_my_init_data(this, message);
 	}
-	
+
 	if (this->peer_cfg == NULL)
 	{
 		this->peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
 		this->peer_cfg->get_ref(this->peer_cfg);
 	}
-	
-	if (message->get_message_id(message) == 1 &&
-		this->ike_sa->supports_extension(this->ike_sa, EXT_MULTIPLE_AUTH))
-	{	/* in the first IKE_AUTH, indicate support for multiple authentication */
-		message->add_notify(message, FALSE, MULTIPLE_AUTH_SUPPORTED, chunk_empty);
+
+	if (message->get_message_id(message) == 1)
+	{	/* in the first IKE_AUTH ... */
+		if (this->ike_sa->supports_extension(this->ike_sa, EXT_MULTIPLE_AUTH))
+		{	/* indicate support for multiple authentication */
+			message->add_notify(message, FALSE, MULTIPLE_AUTH_SUPPORTED,
+								chunk_empty);
+		}
+		/* indicate support for EAP-only authentication */
+		message->add_notify(message, FALSE, EAP_ONLY_AUTHENTICATION,
+							chunk_empty);
 	}
-	
+
 	if (!this->do_another_auth && !this->my_auth)
 	{	/* we have done our rounds */
 		return NEED_MORE;
 	}
-	
+
 	/* check if an authenticator is in progress */
 	if (this->my_auth == NULL)
 	{
 		identification_t *id;
 		id_payload_t *id_payload;
-		
+
 		/* clean up authentication config from a previous round */
 		cfg = this->ike_sa->get_auth_cfg(this->ike_sa, TRUE);
 		cfg->purge(cfg, TRUE);
-		
+
 		/* add (optional) IDr */
 		cfg = get_auth_cfg(this, FALSE);
 		if (cfg)
@@ -410,7 +399,7 @@ static status_t build_i(private_ike_auth_t *this, message_t *message)
 		this->ike_sa->set_my_id(this->ike_sa, id->clone(id));
 		id_payload = id_payload_create_from_identification(ID_INITIATOR, id);
 		message->add_payload(message, (payload_t*)id_payload);
-		
+
 		/* build authentication data */
 		this->my_auth = authenticator_create_builder(this->ike_sa, cfg,
 							this->other_nonce, this->my_nonce,
@@ -427,7 +416,7 @@ static status_t build_i(private_ike_auth_t *this, message_t *message)
 			/* authentication step complete, reset authenticator */
 			cfg = auth_cfg_create();
 			cfg->merge(cfg, this->ike_sa->get_auth_cfg(this->ike_sa, TRUE), TRUE);
-			this->my_cfgs->insert_last(this->my_cfgs, cfg);
+			this->ike_sa->add_auth_cfg(this->ike_sa, TRUE, cfg);
 			this->my_auth->destroy(this->my_auth);
 			this->my_auth = NULL;
 			break;
@@ -436,7 +425,7 @@ static status_t build_i(private_ike_auth_t *this, message_t *message)
 		default:
 			return FAILED;
 	}
-	
+
 	/* check for additional authentication rounds */
 	if (do_another_auth(this))
 	{
@@ -460,12 +449,12 @@ static status_t process_r(private_ike_auth_t *this, message_t *message)
 	auth_cfg_t *cfg, *cand;
 	id_payload_t *id_payload;
 	identification_t *id;
-	
+
 	if (message->get_exchange_type(message) == IKE_SA_INIT)
 	{
 		return collect_other_init_data(this, message);
 	}
-	
+
 	if (this->my_auth == NULL && this->do_another_auth)
 	{
 		/* handle (optional) IDr payload, apply proposed identity */
@@ -480,16 +469,26 @@ static status_t process_r(private_ike_auth_t *this, message_t *message)
 		}
 		this->ike_sa->set_my_id(this->ike_sa, id);
 	}
-	
+
 	if (!this->expect_another_auth)
 	{
 		return NEED_MORE;
 	}
-	if (message->get_notify(message, MULTIPLE_AUTH_SUPPORTED))
-	{
-		this->ike_sa->enable_extension(this->ike_sa, EXT_MULTIPLE_AUTH);
+
+	if (message->get_message_id(message) == 1)
+	{	/* check for extensions in the first IKE_AUTH */
+		if (message->get_notify(message, MULTIPLE_AUTH_SUPPORTED))
+		{
+			this->ike_sa->enable_extension(this->ike_sa, EXT_MULTIPLE_AUTH);
+		}
+		if (this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN) &&
+			message->get_notify(message, EAP_ONLY_AUTHENTICATION))
+		{	/* EAP-only has no official notify, accept only from strongSwan */
+			this->ike_sa->enable_extension(this->ike_sa,
+										   EXT_EAP_ONLY_AUTHENTICATION);
+		}
 	}
-	
+
 	if (this->other_auth == NULL)
 	{
 		/* handle IDi payload */
@@ -503,7 +502,7 @@ static status_t process_r(private_ike_auth_t *this, message_t *message)
 		this->ike_sa->set_other_id(this->ike_sa, id);
 		cfg = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
 		cfg->add(cfg, AUTH_RULE_IDENTITY, id->clone(id));
-		
+
 		if (this->peer_cfg == NULL)
 		{
 			if (!load_cfg_candidates(this))
@@ -530,7 +529,7 @@ static status_t process_r(private_ike_auth_t *this, message_t *message)
 			}
 			cfg->merge(cfg, cand, TRUE);
 		}
-		
+
 		/* verify authentication data */
 		this->other_auth = authenticator_create_verifier(this->ike_sa,
 							message, this->other_nonce, this->my_nonce,
@@ -558,27 +557,26 @@ static status_t process_r(private_ike_auth_t *this, message_t *message)
 			this->authentication_failed = TRUE;
 			return NEED_MORE;
 	}
-	
+
 	/* store authentication information */
 	cfg = auth_cfg_create();
 	cfg->merge(cfg, this->ike_sa->get_auth_cfg(this->ike_sa, FALSE), FALSE);
-	this->other_cfgs->insert_last(this->other_cfgs, cfg);
-	
+	this->ike_sa->add_auth_cfg(this->ike_sa, FALSE, cfg);
+
 	/* another auth round done, invoke authorize hook */
-	if (!charon->bus->authorize(charon->bus, this->other_cfgs, FALSE))
+	if (!charon->bus->authorize(charon->bus, FALSE))
 	{
-		DBG1(DBG_IKE, "round %d authorization hook forbids IKE_SA, cancelling",
-			 this->other_cfgs->get_count(this->other_cfgs));
+		DBG1(DBG_IKE, "authorization hook forbids IKE_SA, cancelling");
 		this->authentication_failed = TRUE;
 		return NEED_MORE;
 	}
-	
+
 	if (!update_cfg_candidates(this, FALSE))
 	{
 		this->authentication_failed = TRUE;
 		return NEED_MORE;
 	}
-	
+
 	if (message->get_notify(message, ANOTHER_AUTH_FOLLOWS) == NULL)
 	{
 		this->expect_another_auth = FALSE;
@@ -597,7 +595,7 @@ static status_t process_r(private_ike_auth_t *this, message_t *message)
 static status_t build_r(private_ike_auth_t *this, message_t *message)
 {
 	auth_cfg_t *cfg;
-	
+
 	if (message->get_exchange_type(message) == IKE_SA_INIT)
 	{
 		if (multiple_auth_enabled())
@@ -607,23 +605,23 @@ static status_t build_r(private_ike_auth_t *this, message_t *message)
 		}
 		return collect_my_init_data(this, message);
 	}
-	
+
 	if (this->authentication_failed || this->peer_cfg == NULL)
 	{
 		message->add_notify(message, TRUE, AUTHENTICATION_FAILED, chunk_empty);
 		return FAILED;
 	}
-	
+
 	if (this->my_auth == NULL && this->do_another_auth)
 	{
 		identification_t *id, *id_cfg;
 		id_payload_t *id_payload;
-		
+
 		/* add IDr */
 		cfg = this->ike_sa->get_auth_cfg(this->ike_sa, TRUE);
 		cfg->purge(cfg, TRUE);
 		cfg->merge(cfg, get_auth_cfg(this, TRUE), TRUE);
-		
+
 		id_cfg = cfg->get(cfg, AUTH_RULE_IDENTITY);
 		id = this->ike_sa->get_my_id(this->ike_sa);
 		if (id->get_type(id) == ID_ANY)
@@ -648,22 +646,38 @@ static status_t build_r(private_ike_auth_t *this, message_t *message)
 				return FAILED;
 			}
 		}
-		
+
 		id_payload = id_payload_create_from_identification(ID_RESPONDER, id);
 		message->add_payload(message, (payload_t*)id_payload);
-		
-		/* build authentication data */
-		this->my_auth = authenticator_create_builder(this->ike_sa, cfg,
-							this->other_nonce, this->my_nonce,
-							this->other_packet->get_data(this->other_packet),
-							this->my_packet->get_data(this->my_packet));
-		if (!this->my_auth)
+
+		if ((uintptr_t)cfg->get(cfg, AUTH_RULE_AUTH_CLASS) == AUTH_CLASS_EAP)
+		{	/* EAP-only authentication */
+			if (!this->ike_sa->supports_extension(this->ike_sa,
+												  EXT_EAP_ONLY_AUTHENTICATION))
+			{
+				DBG1(DBG_IKE, "configured EAP-only authentication, but peer "
+					 "does not support it");
+				message->add_notify(message, TRUE, AUTHENTICATION_FAILED,
+									chunk_empty);
+				return FAILED;
+			}
+		}
+		else
 		{
-			message->add_notify(message, TRUE, AUTHENTICATION_FAILED, chunk_empty);
-			return FAILED;
+			/* build authentication data */
+			this->my_auth = authenticator_create_builder(this->ike_sa, cfg,
+								this->other_nonce, this->my_nonce,
+								this->other_packet->get_data(this->other_packet),
+								this->my_packet->get_data(this->my_packet));
+			if (!this->my_auth)
+			{
+				message->add_notify(message, TRUE, AUTHENTICATION_FAILED,
+									chunk_empty);
+				return FAILED;
+			}
 		}
 	}
-	
+
 	if (this->other_auth)
 	{
 		switch (this->other_auth->build(this->other_auth, message))
@@ -691,7 +705,7 @@ static status_t build_r(private_ike_auth_t *this, message_t *message)
 				cfg = auth_cfg_create();
 				cfg->merge(cfg, this->ike_sa->get_auth_cfg(this->ike_sa, TRUE),
 						   TRUE);
-				this->my_cfgs->insert_last(this->my_cfgs, cfg);
+				this->ike_sa->add_auth_cfg(this->ike_sa, TRUE, cfg);
 				this->my_auth->destroy(this->my_auth);
 				this->my_auth = NULL;
 				break;
@@ -703,7 +717,7 @@ static status_t build_r(private_ike_auth_t *this, message_t *message)
 				return FAILED;
 		}
 	}
-	
+
 	/* check for additional authentication rounds */
 	if (do_another_auth(this))
 	{
@@ -723,21 +737,21 @@ static status_t build_r(private_ike_auth_t *this, message_t *message)
 								chunk_empty);
 			return FAILED;
 		}
-		if (!charon->bus->authorize(charon->bus, this->other_cfgs, TRUE))
+		if (!charon->bus->authorize(charon->bus, TRUE))
 		{
 			DBG1(DBG_IKE, "final authorization hook forbids IKE_SA, cancelling");
 			message->add_notify(message, TRUE, AUTHENTICATION_FAILED,
 								chunk_empty);
 			return FAILED;
 		}
-		this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
 		DBG0(DBG_IKE, "IKE_SA %s[%d] established between %H[%Y]...%H[%Y]",
 			 this->ike_sa->get_name(this->ike_sa),
 			 this->ike_sa->get_unique_id(this->ike_sa),
 			 this->ike_sa->get_my_host(this->ike_sa),
-			 this->ike_sa->get_my_id(this->ike_sa), 
+			 this->ike_sa->get_my_id(this->ike_sa),
 			 this->ike_sa->get_other_host(this->ike_sa),
 			 this->ike_sa->get_other_id(this->ike_sa));
+		this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
 		charon->bus->ike_updown(charon->bus, this->ike_sa, TRUE);
 		return SUCCESS;
 	}
@@ -752,7 +766,8 @@ static status_t process_i(private_ike_auth_t *this, message_t *message)
 	enumerator_t *enumerator;
 	payload_t *payload;
 	auth_cfg_t *cfg;
-	
+	bool mutual_eap = FALSE;
+
 	if (message->get_exchange_type(message) == IKE_SA_INIT)
 	{
 		if (message->get_notify(message, MULTIPLE_AUTH_SUPPORTED) &&
@@ -762,7 +777,7 @@ static status_t process_i(private_ike_auth_t *this, message_t *message)
 		}
 		return collect_other_init_data(this, message);
 	}
-	
+
 	enumerator = message->create_payload_enumerator(message);
 	while (enumerator->enumerate(enumerator, &payload))
 	{
@@ -770,7 +785,7 @@ static status_t process_i(private_ike_auth_t *this, message_t *message)
 		{
 			notify_payload_t *notify = (notify_payload_t*)payload;
 			notify_type_t type = notify->get_notify_type(notify);
-			
+
 			switch (type)
 			{
 				case NO_PROPOSAL_CHOSEN:
@@ -801,7 +816,7 @@ static status_t process_i(private_ike_auth_t *this, message_t *message)
 						DBG1(DBG_IKE, "received %N notify error",
 							 notify_type_names, type);
 						enumerator->destroy(enumerator);
-						return FAILED;	
+						return FAILED;
 					}
 					DBG2(DBG_IKE, "received %N notify",
 						notify_type_names, type);
@@ -811,41 +826,14 @@ static status_t process_i(private_ike_auth_t *this, message_t *message)
 		}
 	}
 	enumerator->destroy(enumerator);
-	
-	if (this->my_auth)
-	{
-		switch (this->my_auth->process(this->my_auth, message))
-		{
-			case SUCCESS:
-				cfg = auth_cfg_create();
-				cfg->merge(cfg, this->ike_sa->get_auth_cfg(this->ike_sa, TRUE),
-						   TRUE);
-				this->my_cfgs->insert_last(this->my_cfgs, cfg);
-				this->my_auth->destroy(this->my_auth);
-				this->my_auth = NULL;
-				this->do_another_auth = do_another_auth(this);
-				break;
-			case NEED_MORE:
-				break;
-			default:
-				return FAILED;
-		}
-	}
-	
+
 	if (this->expect_another_auth)
 	{
 		if (this->other_auth == NULL)
 		{
 			id_payload_t *id_payload;
 			identification_t *id;
-			
-			/* responder is not allowed to do EAP */
-			if (!message->get_payload(message, AUTHENTICATION))
-			{
-				DBG1(DBG_IKE, "AUTH payload missing");
-				return FAILED;
-			}
-			
+
 			/* handle IDr payload */
 			id_payload = (id_payload_t*)message->get_payload(message,
 															 ID_RESPONDER);
@@ -858,42 +846,81 @@ static status_t process_i(private_ike_auth_t *this, message_t *message)
 			this->ike_sa->set_other_id(this->ike_sa, id);
 			cfg = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
 			cfg->add(cfg, AUTH_RULE_IDENTITY, id->clone(id));
-			
-			/* verify authentication data */
-			this->other_auth = authenticator_create_verifier(this->ike_sa,
-							message, this->other_nonce, this->my_nonce,
-							this->other_packet->get_data(this->other_packet),
-							this->my_packet->get_data(this->my_packet));
-			if (!this->other_auth)
+
+			if (message->get_payload(message, AUTHENTICATION))
 			{
-				return FAILED;
+				/* verify authentication data */
+				this->other_auth = authenticator_create_verifier(this->ike_sa,
+								message, this->other_nonce, this->my_nonce,
+								this->other_packet->get_data(this->other_packet),
+								this->my_packet->get_data(this->my_packet));
+				if (!this->other_auth)
+				{
+					return FAILED;
+				}
+			}
+			else
+			{
+				/* responder omitted AUTH payload, indicating EAP-only */
+				mutual_eap = TRUE;
 			}
 		}
-		switch (this->other_auth->process(this->other_auth, message))
+		if (this->other_auth)
+		{
+			switch (this->other_auth->process(this->other_auth, message))
+			{
+				case SUCCESS:
+					break;
+				case NEED_MORE:
+					return NEED_MORE;
+				default:
+					return FAILED;
+			}
+			this->other_auth->destroy(this->other_auth);
+			this->other_auth = NULL;
+		}
+		/* store authentication information, reset authenticator */
+		cfg = auth_cfg_create();
+		cfg->merge(cfg, this->ike_sa->get_auth_cfg(this->ike_sa, FALSE), FALSE);
+		this->ike_sa->add_auth_cfg(this->ike_sa, FALSE, cfg);
+
+		/* another auth round done, invoke authorize hook */
+		if (!charon->bus->authorize(charon->bus, FALSE))
+		{
+			DBG1(DBG_IKE, "authorization forbids IKE_SA, cancelling");
+			return FAILED;
+		}
+	}
+
+	if (this->my_auth)
+	{
+		switch (this->my_auth->process(this->my_auth, message))
 		{
 			case SUCCESS:
+				cfg = auth_cfg_create();
+				cfg->merge(cfg, this->ike_sa->get_auth_cfg(this->ike_sa, TRUE),
+						   TRUE);
+				this->ike_sa->add_auth_cfg(this->ike_sa, TRUE, cfg);
+				this->my_auth->destroy(this->my_auth);
+				this->my_auth = NULL;
+				this->do_another_auth = do_another_auth(this);
 				break;
 			case NEED_MORE:
-				return NEED_MORE;
+				break;
 			default:
 				return FAILED;
 		}
-		/* store authentication information, reset authenticator */
-		cfg = auth_cfg_create();
-		cfg->merge(cfg, this->ike_sa->get_auth_cfg(this->ike_sa, FALSE), FALSE);
-		this->other_cfgs->insert_last(this->other_cfgs, cfg);
-		this->other_auth->destroy(this->other_auth);
-		this->other_auth = NULL;
-		
-		/* another auth round done, invoke authorize hook */
-		if (!charon->bus->authorize(charon->bus, this->other_cfgs, FALSE))
+	}
+	if (mutual_eap)
+	{
+		if (!this->my_auth || !this->my_auth->is_mutual(this->my_auth))
 		{
-			DBG1(DBG_IKE, "round %d authorization forbids IKE_SA, cancelling",
-				 this->other_cfgs->get_count(this->other_cfgs));
+			DBG1(DBG_IKE, "do not allow non-mutual EAP-only authentication");
 			return FAILED;
 		}
+		DBG1(DBG_IKE, "allow mutual EAP-only authentication");
 	}
-	
+
 	if (message->get_notify(message, ANOTHER_AUTH_FOLLOWS) == NULL)
 	{
 		this->expect_another_auth = FALSE;
@@ -904,19 +931,19 @@ static status_t process_i(private_ike_auth_t *this, message_t *message)
 		{
 			return FAILED;
 		}
-		if (!charon->bus->authorize(charon->bus, this->other_cfgs, TRUE))
+		if (!charon->bus->authorize(charon->bus, TRUE))
 		{
 			DBG1(DBG_IKE, "final authorization hook forbids IKE_SA, cancelling");
 			return FAILED;
 		}
-		this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
 		DBG0(DBG_IKE, "IKE_SA %s[%d] established between %H[%Y]...%H[%Y]",
 			 this->ike_sa->get_name(this->ike_sa),
 			 this->ike_sa->get_unique_id(this->ike_sa),
 			 this->ike_sa->get_my_host(this->ike_sa),
-			 this->ike_sa->get_my_id(this->ike_sa), 
+			 this->ike_sa->get_my_id(this->ike_sa),
 			 this->ike_sa->get_other_host(this->ike_sa),
 			 this->ike_sa->get_other_id(this->ike_sa));
+		this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
 		charon->bus->ike_updown(charon->bus, this->ike_sa, TRUE);
 		return SUCCESS;
 	}
@@ -943,10 +970,8 @@ static void migrate(private_ike_auth_t *this, ike_sa_t *ike_sa)
 	DESTROY_IF(this->peer_cfg);
 	DESTROY_IF(this->my_auth);
 	DESTROY_IF(this->other_auth);
-	this->my_cfgs->destroy_offset(this->my_cfgs, offsetof(auth_cfg_t, destroy));
-	this->other_cfgs->destroy_offset(this->other_cfgs, offsetof(auth_cfg_t, destroy));
 	this->candidates->destroy_offset(this->candidates, offsetof(peer_cfg_t, destroy));
-	
+
 	this->my_packet = NULL;
 	this->other_packet = NULL;
 	this->ike_sa = ike_sa;
@@ -956,8 +981,6 @@ static void migrate(private_ike_auth_t *this, ike_sa_t *ike_sa)
 	this->do_another_auth = TRUE;
 	this->expect_another_auth = TRUE;
 	this->authentication_failed = FALSE;
-	this->my_cfgs = linked_list_create();
-	this->other_cfgs = linked_list_create();
 	this->candidates = linked_list_create();
 }
 
@@ -973,8 +996,6 @@ static void destroy(private_ike_auth_t *this)
 	DESTROY_IF(this->my_auth);
 	DESTROY_IF(this->other_auth);
 	DESTROY_IF(this->peer_cfg);
-	this->my_cfgs->destroy_offset(this->my_cfgs, offsetof(auth_cfg_t, destroy));
-	this->other_cfgs->destroy_offset(this->other_cfgs, offsetof(auth_cfg_t, destroy));
 	this->candidates->destroy_offset(this->candidates, offsetof(peer_cfg_t, destroy));
 	free(this);
 }
@@ -985,11 +1006,11 @@ static void destroy(private_ike_auth_t *this)
 ike_auth_t *ike_auth_create(ike_sa_t *ike_sa, bool initiator)
 {
 	private_ike_auth_t *this = malloc_thing(private_ike_auth_t);
-	
+
 	this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
 	this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
 	this->public.task.destroy = (void(*)(task_t*))destroy;
-	
+
 	if (initiator)
 	{
 		this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
@@ -1000,7 +1021,7 @@ ike_auth_t *ike_auth_create(ike_sa_t *ike_sa, bool initiator)
 		this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
 		this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
 	}
-	
+
 	this->ike_sa = ike_sa;
 	this->initiator = initiator;
 	this->my_nonce = chunk_empty;
@@ -1008,15 +1029,13 @@ ike_auth_t *ike_auth_create(ike_sa_t *ike_sa, bool initiator)
 	this->my_packet = NULL;
 	this->other_packet = NULL;
 	this->peer_cfg = NULL;
-	this->my_cfgs = linked_list_create();
-	this->other_cfgs = linked_list_create();
 	this->candidates = linked_list_create();
 	this->my_auth = NULL;
 	this->other_auth = NULL;
 	this->do_another_auth = TRUE;
 	this->expect_another_auth = TRUE;
 	this->authentication_failed = FALSE;
-	
+
 	return &this->public;
 }
 
diff --git a/src/charon/sa/tasks/ike_auth_lifetime.c b/src/charon/sa/tasks/ike_auth_lifetime.c
index a047e6b81..75ff35168 100644
--- a/src/charon/sa/tasks/ike_auth_lifetime.c
+++ b/src/charon/sa/tasks/ike_auth_lifetime.c
@@ -27,12 +27,12 @@ typedef struct private_ike_auth_lifetime_t private_ike_auth_lifetime_t;
  * Private members of a ike_auth_lifetime_t task.
  */
 struct private_ike_auth_lifetime_t {
-	
+
 	/**
 	 * Public methods and task_t interface.
 	 */
 	ike_auth_lifetime_t public;
-	
+
 	/**
 	 * Assigned IKE_SA.
 	 */
@@ -46,11 +46,11 @@ static void add_auth_lifetime(private_ike_auth_lifetime_t *this, message_t *mess
 {
 	chunk_t chunk;
 	u_int32_t lifetime;
-	
+
 	lifetime = this->ike_sa->get_statistic(this->ike_sa, STAT_REAUTH);
 	if (lifetime)
 	{
-		lifetime -= time(NULL);
+		lifetime -= time_monotonic(NULL);
 		chunk = chunk_from_thing(lifetime);
 		*(u_int32_t*)chunk.ptr = htonl(lifetime);
 		message->add_notify(message, FALSE, AUTH_LIFETIME, chunk);
@@ -62,31 +62,17 @@ static void add_auth_lifetime(private_ike_auth_lifetime_t *this, message_t *mess
  */
 static void process_payloads(private_ike_auth_lifetime_t *this, message_t *message)
 {
-	enumerator_t *enumerator;
-	payload_t *payload;
 	notify_payload_t *notify;
-	
-	enumerator = message->create_payload_enumerator(message);
-	while (enumerator->enumerate(enumerator, &payload))
+	chunk_t data;
+	u_int32_t lifetime;
+
+	notify = message->get_notify(message, AUTH_LIFETIME);
+	if (notify)
 	{
-		if (payload->get_type(payload) == NOTIFY)
-		{
-			notify = (notify_payload_t*)payload;
-			switch (notify->get_notify_type(notify))
-			{
-				case AUTH_LIFETIME:					
-				{
-					chunk_t data = notify->get_notification_data(notify);
-					u_int32_t lifetime = ntohl(*(u_int32_t*)data.ptr);
-					this->ike_sa->set_auth_lifetime(this->ike_sa, lifetime);
-					break;
-				}
-				default:
-					break;
-			}
-		}
+		data = notify->get_notification_data(notify);
+		lifetime = ntohl(*(u_int32_t*)data.ptr);
+		this->ike_sa->set_auth_lifetime(this->ike_sa, lifetime);
 	}
-	enumerator->destroy(enumerator);
 }
 
 /**
@@ -177,7 +163,7 @@ ike_auth_lifetime_t *ike_auth_lifetime_create(ike_sa_t *ike_sa, bool initiator)
 	this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
 	this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
 	this->public.task.destroy = (void(*)(task_t*))destroy;
-	
+
 	if (initiator)
 	{
 		this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
@@ -188,9 +174,9 @@ ike_auth_lifetime_t *ike_auth_lifetime_create(ike_sa_t *ike_sa, bool initiator)
 		this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
 		this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
 	}
-	
+
 	this->ike_sa = ike_sa;
-	
+
 	return &this->public;
 }
 
diff --git a/src/charon/sa/tasks/ike_auth_lifetime.h b/src/charon/sa/tasks/ike_auth_lifetime.h
index 812caaf43..3b129b9e3 100644
--- a/src/charon/sa/tasks/ike_auth_lifetime.h
+++ b/src/charon/sa/tasks/ike_auth_lifetime.h
@@ -30,7 +30,7 @@ typedef struct ike_auth_lifetime_t ike_auth_lifetime_t;
 /**
  * Task of type IKE_AUTH_LIFETIME, implements RFC4478.
  *
- * This task exchanges lifetimes for IKE_AUTH to force a client to 
+ * This task exchanges lifetimes for IKE_AUTH to force a client to
  * reauthenticate before the responders lifetime reaches the limit.
  */
 struct ike_auth_lifetime_t {
@@ -46,7 +46,7 @@ struct ike_auth_lifetime_t {
  *
  * @param ike_sa		IKE_SA this task works for
  * @param initiator		TRUE if taks is initiated by us
- * @return			  	ike_auth_lifetime task to handle by the task_manager
+ * @return				ike_auth_lifetime task to handle by the task_manager
  */
 ike_auth_lifetime_t *ike_auth_lifetime_create(ike_sa_t *ike_sa, bool initiator);
 
diff --git a/src/charon/sa/tasks/ike_cert_post.c b/src/charon/sa/tasks/ike_cert_post.c
index 70e87c2e7..c831df975 100644
--- a/src/charon/sa/tasks/ike_cert_post.c
+++ b/src/charon/sa/tasks/ike_cert_post.c
@@ -30,17 +30,17 @@ typedef struct private_ike_cert_post_t private_ike_cert_post_t;
  * Private members of a ike_cert_post_t task.
  */
 struct private_ike_cert_post_t {
-	
+
 	/**
 	 * Public methods and task_t interface.
 	 */
 	ike_cert_post_t public;
-	
+
 	/**
 	 * Assigned IKE_SA.
 	 */
 	ike_sa_t *ike_sa;
-	
+
 	/**
 	 * Are we the initiator?
 	 */
@@ -50,49 +50,47 @@ struct private_ike_cert_post_t {
 /**
  * Generates the cert payload, if possible with "Hash and URL"
  */
-static cert_payload_t *build_cert_payload(private_ike_cert_post_t *this, certificate_t *cert)
+static cert_payload_t *build_cert_payload(private_ike_cert_post_t *this,
+										 certificate_t *cert)
 {
+	hasher_t *hasher;
+	identification_t *id;
+	chunk_t hash, encoded ;
+	enumerator_t *enumerator;
+	char *url;
 	cert_payload_t *payload = NULL;
-	
-	if (this->ike_sa->supports_extension(this->ike_sa, EXT_HASH_AND_URL))
+
+	if (!this->ike_sa->supports_extension(this->ike_sa, EXT_HASH_AND_URL))
 	{
-		/* ok, our peer sent us a HTTP_CERT_LOOKUP_SUPPORTED Notify */
-		hasher_t *hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
-		if (hasher != NULL)
-		{	
-			chunk_t hash, encoded = cert->get_encoding(cert);
-			enumerator_t *enumerator;
-			char *url;
-			
-			hasher->allocate_hash(hasher, encoded, &hash);
-			identification_t *id = identification_create_from_encoding(ID_CERT_DER_SHA1, hash);
-			
-			enumerator = charon->credentials->create_cdp_enumerator(charon->credentials, CERT_X509, id);
-			if (enumerator->enumerate(enumerator, &url))
-			{
-				/* if we have an URL available we send that to our peer */
-				payload = cert_payload_create_from_hash_and_url(hash, url);
-			}
-			enumerator->destroy(enumerator);
-			
-			id->destroy(id);
-			chunk_free(&hash);
-			chunk_free(&encoded);
-			hasher->destroy(hasher);
-		}
-		else
-		{
-			DBG1(DBG_IKE, "unable to use hash-and-url: sha1 not supported");
-		}
+		return cert_payload_create_from_cert(cert);
+	}
+
+	hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
+	if (!hasher)
+	{
+		DBG1(DBG_IKE, "unable to use hash-and-url: sha1 not supported");
+		return cert_payload_create_from_cert(cert);
 	}
-	
-	if (!payload)
+
+	encoded = cert->get_encoding(cert);
+	hasher->allocate_hash(hasher, encoded, &hash);
+	chunk_free(&encoded);
+	hasher->destroy(hasher);
+	id = identification_create_from_encoding(ID_KEY_ID, hash);
+
+	enumerator = charon->credentials->create_cdp_enumerator(charon->credentials,
+															CERT_X509, id);
+	if (enumerator->enumerate(enumerator, &url))
+	{
+		payload = cert_payload_create_from_hash_and_url(hash, url);
+	}
+	else
 	{
-		/* our peer does not support "Hash and URL" or we do not have an URL
-		 * to send to our peer, just create a normal cert payload */
 		payload = cert_payload_create_from_cert(cert);
 	}
-	
+	enumerator->destroy(enumerator);
+	chunk_free(&hash);
+	id->destroy(id);
 	return payload;
 }
 
@@ -103,14 +101,14 @@ static void build_certs(private_ike_cert_post_t *this, message_t *message)
 {
 	peer_cfg_t *peer_cfg;
 	auth_payload_t *payload;
-	
+
 	payload = (auth_payload_t*)message->get_payload(message, AUTHENTICATION);
 	peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
 	if (!peer_cfg || !payload || payload->get_auth_method(payload) == AUTH_PSK)
 	{	/* no CERT payload for EAP/PSK */
 		return;
 	}
-	
+
 	switch (peer_cfg->get_cert_policy(peer_cfg))
 	{
 		case CERT_NEVER_SEND:
@@ -128,9 +126,9 @@ static void build_certs(private_ike_cert_post_t *this, message_t *message)
 			certificate_t *cert;
 			auth_rule_t type;
 			auth_cfg_t *auth;
-			
+
 			auth = this->ike_sa->get_auth_cfg(this->ike_sa, TRUE);
-			
+
 			/* get subject cert first, then issuing certificates */
 			cert = auth->get(auth, AUTH_RULE_SUBJECT_CERT);
 			if (!cert)
@@ -145,7 +143,7 @@ static void build_certs(private_ike_cert_post_t *this, message_t *message)
 			DBG1(DBG_IKE, "sending end entity cert \"%Y\"",
 				 cert->get_subject(cert));
 			message->add_payload(message, (payload_t*)payload);
-			
+
 			enumerator = auth->create_enumerator(auth);
 			while (enumerator->enumerate(enumerator, &type, &cert))
 			{
@@ -161,7 +159,7 @@ static void build_certs(private_ike_cert_post_t *this, message_t *message)
 				}
 			}
 			enumerator->destroy(enumerator);
-		}	
+		}
 	}
 }
 
@@ -171,7 +169,7 @@ static void build_certs(private_ike_cert_post_t *this, message_t *message)
 static status_t build_i(private_ike_cert_post_t *this, message_t *message)
 {
 	build_certs(this, message);
-	
+
 	return NEED_MORE;
 }
 
@@ -179,7 +177,7 @@ static status_t build_i(private_ike_cert_post_t *this, message_t *message)
  * Implementation of task_t.process for responder
  */
 static status_t process_r(private_ike_cert_post_t *this, message_t *message)
-{	
+{
 	return NEED_MORE;
 }
 
@@ -189,7 +187,7 @@ static status_t process_r(private_ike_cert_post_t *this, message_t *message)
 static status_t build_r(private_ike_cert_post_t *this, message_t *message)
 {
 	build_certs(this, message);
-	
+
 	if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED)
 	{	/* stay alive, we might have additional rounds with certs */
 		return NEED_MORE;
@@ -243,7 +241,7 @@ ike_cert_post_t *ike_cert_post_create(ike_sa_t *ike_sa, bool initiator)
 	this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
 	this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
 	this->public.task.destroy = (void(*)(task_t*))destroy;
-	
+
 	if (initiator)
 	{
 		this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
@@ -254,10 +252,10 @@ ike_cert_post_t *ike_cert_post_create(ike_sa_t *ike_sa, bool initiator)
 		this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
 		this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
 	}
-	
+
 	this->ike_sa = ike_sa;
 	this->initiator = initiator;
-	
+
 	return &this->public;
 }
 
diff --git a/src/charon/sa/tasks/ike_cert_post.h b/src/charon/sa/tasks/ike_cert_post.h
index fa555eac7..a21f45927 100644
--- a/src/charon/sa/tasks/ike_cert_post.h
+++ b/src/charon/sa/tasks/ike_cert_post.h
@@ -46,7 +46,7 @@ struct ike_cert_post_t {
  *
  * @param ike_sa		IKE_SA this task works for
  * @param initiator		TRUE if thask is the original initator
- * @return			  	ike_cert_post task to handle by the task_manager
+ * @return				ike_cert_post task to handle by the task_manager
  */
 ike_cert_post_t *ike_cert_post_create(ike_sa_t *ike_sa, bool initiator);
 
diff --git a/src/charon/sa/tasks/ike_cert_pre.c b/src/charon/sa/tasks/ike_cert_pre.c
index 1c72f289f..0805d0290 100644
--- a/src/charon/sa/tasks/ike_cert_pre.c
+++ b/src/charon/sa/tasks/ike_cert_pre.c
@@ -29,27 +29,27 @@ typedef struct private_ike_cert_pre_t private_ike_cert_pre_t;
  * Private members of a ike_cert_pre_t task.
  */
 struct private_ike_cert_pre_t {
-	
+
 	/**
 	 * Public methods and task_t interface.
 	 */
 	ike_cert_pre_t public;
-	
+
 	/**
 	 * Assigned IKE_SA.
 	 */
 	ike_sa_t *ike_sa;
-	
+
 	/**
 	 * Are we the initiator?
 	 */
 	bool initiator;
-	
+
 	/**
 	 * Do we accept HTTP certificate lookup requests
 	 */
 	bool do_http_lookup;
-	
+
 	/**
 	 * wheter this is the final authentication round
 	 */
@@ -57,29 +57,29 @@ struct private_ike_cert_pre_t {
 };
 
 /**
- * read certificate requests 
+ * read certificate requests
  */
 static void process_certreqs(private_ike_cert_pre_t *this, message_t *message)
 {
 	enumerator_t *enumerator;
 	payload_t *payload;
 	auth_cfg_t *auth;
-	
+
 	auth = this->ike_sa->get_auth_cfg(this->ike_sa, TRUE);
-	
+
 	enumerator = message->create_payload_enumerator(message);
 	while (enumerator->enumerate(enumerator, &payload))
 	{
-		switch(payload->get_type(payload))
+		switch (payload->get_type(payload))
 		{
 			case CERTIFICATE_REQUEST:
 			{
 				certreq_payload_t *certreq = (certreq_payload_t*)payload;
 				enumerator_t *enumerator;
 				chunk_t keyid;
-				
+
 				this->ike_sa->set_condition(this->ike_sa, COND_CERTREQ_SEEN, TRUE);
-				
+
 				if (certreq->get_cert_type(certreq) != CERT_X509)
 				{
 					DBG1(DBG_IKE, "cert payload %N not supported - ignored",
@@ -91,10 +91,9 @@ static void process_certreqs(private_ike_cert_pre_t *this, message_t *message)
 				{
 					identification_t *id;
 					certificate_t *cert;
-					
-					id = identification_create_from_encoding(
-											ID_PUBKEY_INFO_SHA1, keyid);
-					cert = charon->credentials->get_cert(charon->credentials, 
+
+					id = identification_create_from_encoding(ID_KEY_ID, keyid);
+					cert = charon->credentials->get_cert(charon->credentials,
 											CERT_X509, KEY_ANY, id, TRUE);
 					if (cert)
 					{
@@ -115,7 +114,7 @@ static void process_certreqs(private_ike_cert_pre_t *this, message_t *message)
 			case NOTIFY:
 			{
 				notify_payload_t *notify = (notify_payload_t*)payload;
-				
+
 				/* we only handle one type of notify here */
 				if (notify->get_notify_type(notify) == HTTP_CERT_LOOKUP_SUPPORTED)
 				{
@@ -135,11 +134,11 @@ static void process_certreqs(private_ike_cert_pre_t *this, message_t *message)
  * tries to extract a certificate from the cert payload or the credential
  * manager (based on the hash of a "Hash and URL" encoded cert).
  * Note: the returned certificate (if any) has to be destroyed
- */ 
+ */
 static certificate_t *try_get_cert(cert_payload_t *cert_payload)
 {
 	certificate_t *cert = NULL;
-	
+
 	switch (cert_payload->get_cert_encoding(cert_payload))
 	{
 		case ENC_X509_SIGNATURE:
@@ -156,8 +155,8 @@ static certificate_t *try_get_cert(cert_payload_t *cert_payload)
 				/* invalid "Hash and URL" data (logged elsewhere) */
 				break;
 			}
-			id = identification_create_from_encoding(ID_CERT_DER_SHA1, hash);
-			cert = charon->credentials->get_cert(charon->credentials, 
+			id = identification_create_from_encoding(ID_KEY_ID, hash);
+			cert = charon->credentials->get_cert(charon->credentials,
 												 CERT_X509, KEY_ANY, id, FALSE);
 			id->destroy(id);
 			break;
@@ -179,9 +178,9 @@ static void process_certs(private_ike_cert_pre_t *this, message_t *message)
 	payload_t *payload;
 	auth_cfg_t *auth;
 	bool first = TRUE;
-	
+
 	auth = this->ike_sa->get_auth_cfg(this->ike_sa, FALSE);
-	
+
 	enumerator = message->create_payload_enumerator(message);
 	while (enumerator->enumerate(enumerator, &payload))
 	{
@@ -191,10 +190,10 @@ static void process_certs(private_ike_cert_pre_t *this, message_t *message)
 			cert_encoding_t encoding;
 			certificate_t *cert;
 			char *url;
-			
+
 			cert_payload = (cert_payload_t*)payload;
 			encoding = cert_payload->get_cert_encoding(cert_payload);
-			
+
 			switch (encoding)
 			{
 				case ENC_X509_HASH_AND_URL:
@@ -284,9 +283,9 @@ static void add_certreq(certreq_payload_t **req, certificate_t *cert)
 		case CERT_X509:
 		{
 			public_key_t *public;
-			identification_t *keyid;
+			chunk_t keyid;
 			x509_t *x509 = (x509_t*)cert;
-			
+
 			if (!(x509->get_flags(x509) & X509_CA))
 			{	/* no CA cert, skip */
 				break;
@@ -300,11 +299,13 @@ static void add_certreq(certreq_payload_t **req, certificate_t *cert)
 			{
 				*req = certreq_payload_create_type(CERT_X509);
 			}
-			keyid = public->get_id(public, ID_PUBKEY_INFO_SHA1);
-			(*req)->add_keyid(*req, keyid->get_encoding(keyid));
+			if (public->get_fingerprint(public, KEY_ID_PUBKEY_INFO_SHA1, &keyid))
+			{
+				(*req)->add_keyid(*req, keyid);
+				DBG1(DBG_IKE, "sending cert request for \"%Y\"",
+					 cert->get_subject(cert));
+			}
 			public->destroy(public);
-			DBG1(DBG_IKE, "sending cert request for \"%Y\"",
-				 cert->get_subject(cert));
 			break;
 		}
 		default:
@@ -320,7 +321,7 @@ static void add_certreqs(certreq_payload_t **req, auth_cfg_t *auth)
 	enumerator_t *enumerator;
 	auth_rule_t type;
 	void *value;
-	
+
 	enumerator = auth->create_enumerator(auth);
 	while (enumerator->enumerate(enumerator, &type, &value))
 	{
@@ -347,13 +348,13 @@ static void build_certreqs(private_ike_cert_pre_t *this, message_t *message)
 	certificate_t *cert;
 	auth_cfg_t *auth;
 	certreq_payload_t *req = NULL;
-	
+
 	ike_cfg = this->ike_sa->get_ike_cfg(this->ike_sa);
 	if (!ike_cfg->send_certreq(ike_cfg))
 	{
 		return;
 	}
-	
+
 	/* check if we require a specific CA for that peer */
 	peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
 	if (peer_cfg)
@@ -365,7 +366,7 @@ static void build_certreqs(private_ike_cert_pre_t *this, message_t *message)
 		}
 		enumerator->destroy(enumerator);
 	}
-	
+
 	if (!req)
 	{
 		/* otherwise add all trusted CA certificates */
@@ -377,11 +378,11 @@ static void build_certreqs(private_ike_cert_pre_t *this, message_t *message)
 		}
 		enumerator->destroy(enumerator);
 	}
-	
+
 	if (req)
 	{
 		message->add_payload(message, (payload_t*)req);
-		
+
 		if (lib->settings->get_bool(lib->settings, "charon.hash_and_url", FALSE))
 		{
 			message->add_notify(message, FALSE, HTTP_CERT_LOOKUP_SUPPORTED,
@@ -396,29 +397,15 @@ static void build_certreqs(private_ike_cert_pre_t *this, message_t *message)
  */
 static bool final_auth(message_t *message)
 {
-	enumerator_t *enumerator;
-	payload_t *payload;
-	notify_payload_t *notify;
-	
 	/* we check for an AUTH payload without a ANOTHER_AUTH_FOLLOWS notify */
 	if (message->get_payload(message, AUTHENTICATION) == NULL)
 	{
 		return FALSE;
 	}
-	enumerator = message->create_payload_enumerator(message);
-	while (enumerator->enumerate(enumerator, &payload))
+	if (message->get_notify(message, ANOTHER_AUTH_FOLLOWS))
 	{
-		if (payload->get_type(payload) == NOTIFY)
-		{
-			notify = (notify_payload_t*)payload;
-			if (notify->get_notify_type(notify) == ANOTHER_AUTH_FOLLOWS)
-			{
-				enumerator->destroy(enumerator);
-				return FALSE;
-			}
-		}
+		return FALSE;
 	}
-	enumerator->destroy(enumerator);
 	return TRUE;
 }
 
@@ -426,7 +413,7 @@ static bool final_auth(message_t *message)
  * Implementation of task_t.process for initiator
  */
 static status_t build_i(private_ike_cert_pre_t *this, message_t *message)
-{	
+{
 	if (message->get_message_id(message) == 1)
 	{	/* initiator sends CERTREQs in first IKE_AUTH */
 		build_certreqs(this, message);
@@ -474,7 +461,7 @@ static status_t process_i(private_ike_cert_pre_t *this, message_t *message)
 		process_certreqs(this, message);
 	}
 	process_certs(this, message);
-	
+
 	if (final_auth(message))
 	{
 		return SUCCESS;
@@ -516,7 +503,7 @@ ike_cert_pre_t *ike_cert_pre_create(ike_sa_t *ike_sa, bool initiator)
 	this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
 	this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
 	this->public.task.destroy = (void(*)(task_t*))destroy;
-	
+
 	if (initiator)
 	{
 		this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
@@ -527,11 +514,11 @@ ike_cert_pre_t *ike_cert_pre_create(ike_sa_t *ike_sa, bool initiator)
 		this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
 		this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
 	}
-	
+
 	this->ike_sa = ike_sa;
 	this->initiator = initiator;
 	this->do_http_lookup = FALSE;
 	this->final = FALSE;
-	
+
 	return &this->public;
 }
diff --git a/src/charon/sa/tasks/ike_cert_pre.h b/src/charon/sa/tasks/ike_cert_pre.h
index d49005e68..1541b80e5 100644
--- a/src/charon/sa/tasks/ike_cert_pre.h
+++ b/src/charon/sa/tasks/ike_cert_pre.h
@@ -46,7 +46,7 @@ struct ike_cert_pre_t {
  *
  * @param ike_sa		IKE_SA this task works for
  * @param initiator		TRUE if thask is the original initator
- * @return			  	ike_cert_pre task to handle by the task_manager
+ * @return				ike_cert_pre task to handle by the task_manager
  */
 ike_cert_pre_t *ike_cert_pre_create(ike_sa_t *ike_sa, bool initiator);
 
diff --git a/src/charon/sa/tasks/ike_config.c b/src/charon/sa/tasks/ike_config.c
index 1f75521b6..f010439fe 100644
--- a/src/charon/sa/tasks/ike_config.c
+++ b/src/charon/sa/tasks/ike_config.c
@@ -19,50 +19,60 @@
 #include <daemon.h>
 #include <encoding/payloads/cp_payload.h>
 
-#define DNS_SERVER_MAX		2
-#define NBNS_SERVER_MAX		2
-
 typedef struct private_ike_config_t private_ike_config_t;
 
 /**
  * Private members of a ike_config_t task.
  */
 struct private_ike_config_t {
-	
+
 	/**
 	 * Public methods and task_t interface.
 	 */
 	ike_config_t public;
-	
+
 	/**
 	 * Assigned IKE_SA.
 	 */
 	ike_sa_t *ike_sa;
-	
+
 	/**
 	 * Are we the initiator?
 	 */
 	bool initiator;
-	
+
 	/**
 	 * virtual ip
 	 */
 	host_t *virtual_ip;
+
+	/**
+	 * list of attributes requested and its handler, entry_t
+	 */
+	linked_list_t *requested;
 };
 
 /**
- * build INTERNAL_IPV4/6_ADDRESS from virtual ip
+ * Entry for a requested attribute and the requesting handler
+ */
+typedef struct {
+	/** attribute requested */
+	configuration_attribute_type_t type;
+	/** handler requesting this attribute */
+	attribute_handler_t *handler;
+} entry_t;
+
+/**
+ * build INTERNAL_IPV4/6_ADDRESS attribute from virtual ip
  */
-static void build_vip(private_ike_config_t *this, host_t *vip, cp_payload_t *cp)
+static configuration_attribute_t *build_vip(host_t *vip)
 {
-	configuration_attribute_t *ca;
+	configuration_attribute_type_t type;
 	chunk_t chunk, prefix;
-	
-	ca = configuration_attribute_create();
-	
+
 	if (vip->get_family(vip) == AF_INET)
 	{
-		ca->set_type(ca, INTERNAL_IP4_ADDRESS);
+		type = INTERNAL_IP4_ADDRESS;
 		if (vip->is_anyaddr(vip))
 		{
 			chunk = chunk_empty;
@@ -74,7 +84,7 @@ static void build_vip(private_ike_config_t *this, host_t *vip, cp_payload_t *cp)
 	}
 	else
 	{
-		ca->set_type(ca, INTERNAL_IP6_ADDRESS);
+		type = INTERNAL_IP6_ADDRESS;
 		if (vip->is_anyaddr(vip))
 		{
 			chunk = chunk_empty;
@@ -87,8 +97,42 @@ static void build_vip(private_ike_config_t *this, host_t *vip, cp_payload_t *cp)
 			chunk = chunk_cata("cc", chunk, prefix);
 		}
 	}
-	ca->set_value(ca, chunk);
-	cp->add_configuration_attribute(cp, ca);
+	return configuration_attribute_create_value(type, chunk);
+}
+
+/**
+ * Handle a received attribute as initiator
+ */
+static void handle_attribute(private_ike_config_t *this,
+							 configuration_attribute_t *ca)
+{
+	attribute_handler_t *handler = NULL;
+	enumerator_t *enumerator;
+	entry_t *entry;
+
+	/* find the handler which requested this attribute */
+	enumerator = this->requested->create_enumerator(this->requested);
+	while (enumerator->enumerate(enumerator, &entry))
+	{
+		if (entry->type == ca->get_type(ca))
+		{
+			handler = entry->handler;
+			this->requested->remove_at(this->requested, enumerator);
+			free(entry);
+			break;
+		}
+	}
+	enumerator->destroy(enumerator);
+
+	/* and pass it to the handle function */
+	handler = lib->attributes->handle(lib->attributes,
+							this->ike_sa->get_other_id(this->ike_sa), handler,
+							ca->get_type(ca), ca->get_value(ca));
+	if (handler)
+	{
+		this->ike_sa->add_configuration_attribute(this->ike_sa,
+				handler, ca->get_type(ca), ca->get_value(ca));
+	}
 }
 
 /**
@@ -100,7 +144,7 @@ static void process_attribute(private_ike_config_t *this,
 	host_t *ip;
 	chunk_t addr;
 	int family = AF_INET6;
-	
+
 	switch (ca->get_type(ca))
 	{
 		case INTERNAL_IP4_ADDRESS:
@@ -118,7 +162,7 @@ static void process_attribute(private_ike_config_t *this,
 				/* skip prefix byte in IPv6 payload*/
 				if (family == AF_INET6)
 				{
-					addr.len--; 
+					addr.len--;
 				}
 				ip = host_create_from_chunk(family, addr, 0);
 			}
@@ -130,15 +174,12 @@ static void process_attribute(private_ike_config_t *this,
 			break;
 		}
 		default:
+		{
 			if (this->initiator)
 			{
-				this->ike_sa->add_configuration_attribute(this->ike_sa,
-										ca->get_type(ca), ca->get_value(ca));
-			}
-			else
-			{
-				/* we do not handle attribute requests other than for VIPs */
+				handle_attribute(this, ca);
 			}
+		}
 	}
 }
 
@@ -147,10 +188,9 @@ static void process_attribute(private_ike_config_t *this,
  */
 static void process_payloads(private_ike_config_t *this, message_t *message)
 {
-	enumerator_t *enumerator;
-	iterator_t *attributes;
+	enumerator_t *enumerator, *attributes;
 	payload_t *payload;
-	
+
 	enumerator = message->create_payload_enumerator(message);
 	while (enumerator->enumerate(enumerator, &payload))
 	{
@@ -158,22 +198,25 @@ static void process_payloads(private_ike_config_t *this, message_t *message)
 		{
 			cp_payload_t *cp = (cp_payload_t*)payload;
 			configuration_attribute_t *ca;
-			switch (cp->get_config_type(cp))
+
+			switch (cp->get_type(cp))
 			{
 				case CFG_REQUEST:
 				case CFG_REPLY:
 				{
-					attributes = cp->create_attribute_iterator(cp);
-					while (attributes->iterate(attributes, (void**)&ca))
+					attributes = cp->create_attribute_enumerator(cp);
+					while (attributes->enumerate(attributes, &ca))
 					{
+						DBG2(DBG_IKE, "processing %N attribute",
+							 configuration_attribute_type_names, ca->get_type(ca));
 						process_attribute(this, ca);
 					}
 					attributes->destroy(attributes);
 					break;
 				}
 				default:
-					DBG1(DBG_IKE, "ignoring %N config payload", 
-						 config_type_names, cp->get_config_type(cp));
+					DBG1(DBG_IKE, "ignoring %N config payload",
+						 config_type_names, cp->get_type(cp));
 					break;
 			}
 		}
@@ -188,9 +231,14 @@ static status_t build_i(private_ike_config_t *this, message_t *message)
 {
 	if (message->get_message_id(message) == 1)
 	{	/* in first IKE_AUTH only */
+		cp_payload_t *cp = NULL;
+		enumerator_t *enumerator;
+		attribute_handler_t *handler;
 		peer_cfg_t *config;
+		configuration_attribute_type_t type;
+		chunk_t data;
 		host_t *vip;
-		
+
 		/* reuse virtual IP if we already have one */
 		vip = this->ike_sa->get_virtual_ip(this->ike_sa, TRUE);
 		if (!vip)
@@ -200,25 +248,38 @@ static status_t build_i(private_ike_config_t *this, message_t *message)
 		}
 		if (vip)
 		{
+			cp = cp_payload_create_type(CFG_REQUEST);
+			cp->add_attribute(cp, build_vip(vip));
+		}
+
+		enumerator = lib->attributes->create_initiator_enumerator(lib->attributes,
+								this->ike_sa->get_other_id(this->ike_sa), vip);
+		while (enumerator->enumerate(enumerator, &handler, &type, &data))
+		{
 			configuration_attribute_t *ca;
-			cp_payload_t *cp;
-			
-			cp = cp_payload_create();
-			cp->set_config_type(cp, CFG_REQUEST);
-			
-			build_vip(this, vip, cp);
-			
-			/* we currently always add a DNS request if we request an IP */
-			ca = configuration_attribute_create();
-			if (vip->get_family(vip) == AF_INET)
-			{
-				ca->set_type(ca, INTERNAL_IP4_DNS);
-			}
-			else
+			entry_t *entry;
+
+			/* create configuration attribute */
+			DBG2(DBG_IKE, "building %N attribute",
+				 configuration_attribute_type_names, type);
+			ca = configuration_attribute_create_value(type, data);
+			if (!cp)
 			{
-				ca->set_type(ca, INTERNAL_IP6_DNS);
+				cp = cp_payload_create_type(CFG_REQUEST);
 			}
-			cp->add_configuration_attribute(cp, ca);
+			cp->add_attribute(cp, ca);
+
+			/* save handler along with requested type */
+			entry = malloc_thing(entry_t);
+			entry->type = type;
+			entry->handler = handler;
+
+			this->requested->insert_last(this->requested, entry);
+		}
+		enumerator->destroy(enumerator);
+
+		if (cp)
+		{
 			message->add_payload(message, (payload_t*)cp);
 		}
 	}
@@ -238,30 +299,62 @@ static status_t process_r(private_ike_config_t *this, message_t *message)
 }
 
 /**
+ * Find a peer (EAP) identity to query provider for attributes
+ */
+static identification_t *get_peer_identity(private_ike_config_t *this)
+{
+	identification_t *id = NULL, *current;
+	enumerator_t *enumerator;
+	auth_cfg_t *cfg;
+
+	enumerator = this->ike_sa->create_auth_cfg_enumerator(this->ike_sa, FALSE);
+	while (enumerator->enumerate(enumerator, &cfg))
+	{
+		/* prefer EAP-Identity of last round */
+		current = cfg->get(cfg, AUTH_RULE_EAP_IDENTITY);
+		if (!current || current->get_type(current) == ID_ANY)
+		{
+			current = cfg->get(cfg, AUTH_RULE_IDENTITY);
+		}
+		if (current && current->get_type(current) != ID_ANY)
+		{
+			id = current;
+			continue;
+		}
+	}
+	enumerator->destroy(enumerator);
+	if (!id)
+	{	/* fallback, should not happen */
+		id = this->ike_sa->get_other_id(this->ike_sa);
+	}
+	return id;
+}
+
+/**
  * Implementation of task_t.build for responder
  */
 static status_t build_r(private_ike_config_t *this, message_t *message)
 {
 	if (this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED)
 	{	/* in last IKE_AUTH exchange */
-		peer_cfg_t *config = this->ike_sa->get_peer_cfg(this->ike_sa);
-		
+		enumerator_t *enumerator;
+		configuration_attribute_type_t type;
+		chunk_t value;
+		host_t *vip = NULL;
+		cp_payload_t *cp = NULL;
+		peer_cfg_t *config;
+		identification_t *id;
+
+		id = get_peer_identity(this);
+
+		config = this->ike_sa->get_peer_cfg(this->ike_sa);
 		if (config && this->virtual_ip)
 		{
-			enumerator_t *enumerator;
-			configuration_attribute_type_t type;
-			configuration_attribute_t *ca;
-			chunk_t value;
-			cp_payload_t *cp;
-			host_t *vip = NULL;
-			
 			DBG1(DBG_IKE, "peer requested virtual IP %H", this->virtual_ip);
 			if (config->get_pool(config))
 			{
-				vip = charon->attributes->acquire_address(charon->attributes, 
-									config->get_pool(config),
-									this->ike_sa->get_other_id(this->ike_sa),
-									this->virtual_ip);
+				vip = lib->attributes->acquire_address(lib->attributes,
+							config->get_pool(config), id, this->virtual_ip);
 			}
 			if (vip == NULL)
 			{
@@ -273,27 +366,32 @@ static status_t build_r(private_ike_config_t *this, message_t *message)
 			}
 			DBG1(DBG_IKE, "assigning virtual IP %H to peer", vip);
 			this->ike_sa->set_virtual_ip(this->ike_sa, FALSE, vip);
-			
-			cp = cp_payload_create();
-			cp->set_config_type(cp, CFG_REPLY);
-			
-			build_vip(this, vip, cp);
-			vip->destroy(vip);
-			
-			/* if we add an IP, we also look for other attributes */
-			enumerator = charon->attributes->create_attribute_enumerator(
-				charon->attributes, this->ike_sa->get_other_id(this->ike_sa));
-			while (enumerator->enumerate(enumerator, &type, &value))
+
+			cp = cp_payload_create_type(CFG_REPLY);
+			cp->add_attribute(cp, build_vip(vip));
+		}
+
+		/* query registered providers for additional attributes to include */
+		enumerator = lib->attributes->create_responder_enumerator(
+													lib->attributes, id, vip);
+		while (enumerator->enumerate(enumerator, &type, &value))
+		{
+			if (!cp)
 			{
-				ca = configuration_attribute_create();
-				ca->set_type(ca, type);
-				ca->set_value(ca, value);
-				cp->add_configuration_attribute(cp, ca);
+				cp = cp_payload_create_type(CFG_REPLY);
 			}
-			enumerator->destroy(enumerator);
-			
+			DBG2(DBG_IKE, "building %N attribute",
+				 configuration_attribute_type_names, type);
+			cp->add_attribute(cp,
+						configuration_attribute_create_value(type, value));
+		}
+		enumerator->destroy(enumerator);
+
+		if (cp)
+		{
 			message->add_payload(message, (payload_t*)cp);
 		}
+		DESTROY_IF(vip);
 		return SUCCESS;
 	}
 	return NEED_MORE;
@@ -306,9 +404,9 @@ static status_t process_i(private_ike_config_t *this, message_t *message)
 {
 	if (this->ike_sa->get_state(this->ike_sa) == IKE_ESTABLISHED)
 	{	/* in last IKE_AUTH exchange */
-		
+
 		process_payloads(this, message);
-		
+
 		if (this->virtual_ip)
 		{
 			this->ike_sa->set_virtual_ip(this->ike_sa, TRUE, this->virtual_ip);
@@ -332,9 +430,11 @@ static task_type_t get_type(private_ike_config_t *this)
 static void migrate(private_ike_config_t *this, ike_sa_t *ike_sa)
 {
 	DESTROY_IF(this->virtual_ip);
-	
+
 	this->ike_sa = ike_sa;
 	this->virtual_ip = NULL;
+	this->requested->destroy_function(this->requested, free);
+	this->requested = linked_list_create();
 }
 
 /**
@@ -343,6 +443,7 @@ static void migrate(private_ike_config_t *this, ike_sa_t *ike_sa)
 static void destroy(private_ike_config_t *this)
 {
 	DESTROY_IF(this->virtual_ip);
+	this->requested->destroy_function(this->requested, free);
 	free(this);
 }
 
@@ -352,15 +453,16 @@ static void destroy(private_ike_config_t *this)
 ike_config_t *ike_config_create(ike_sa_t *ike_sa, bool initiator)
 {
 	private_ike_config_t *this = malloc_thing(private_ike_config_t);
-	
+
 	this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
 	this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
 	this->public.task.destroy = (void(*)(task_t*))destroy;
-	
+
 	this->initiator = initiator;
 	this->ike_sa = ike_sa;
 	this->virtual_ip = NULL;
-	
+	this->requested = linked_list_create();
+
 	if (initiator)
 	{
 		this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
@@ -371,7 +473,7 @@ ike_config_t *ike_config_create(ike_sa_t *ike_sa, bool initiator)
 		this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
 		this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
 	}
-	
+
 	return &this->public;
 }
 
diff --git a/src/charon/sa/tasks/ike_config.h b/src/charon/sa/tasks/ike_config.h
index 32635e85e..8cef08697 100644
--- a/src/charon/sa/tasks/ike_config.h
+++ b/src/charon/sa/tasks/ike_config.h
@@ -44,7 +44,7 @@ struct ike_config_t {
  *
  * @param ike_sa		IKE_SA this task works for
  * @param initiator		TRUE for initiator
- * @return			  	ike_config task to handle by the task_manager
+ * @return				ike_config task to handle by the task_manager
  */
 ike_config_t *ike_config_create(ike_sa_t *ike_sa, bool initiator);
 
diff --git a/src/charon/sa/tasks/ike_delete.c b/src/charon/sa/tasks/ike_delete.c
index cde117934..130948836 100644
--- a/src/charon/sa/tasks/ike_delete.c
+++ b/src/charon/sa/tasks/ike_delete.c
@@ -25,27 +25,27 @@ typedef struct private_ike_delete_t private_ike_delete_t;
  * Private members of a ike_delete_t task.
  */
 struct private_ike_delete_t {
-	
+
 	/**
 	 * Public methods and task_t interface.
 	 */
 	ike_delete_t public;
-	
+
 	/**
 	 * Assigned IKE_SA.
 	 */
 	ike_sa_t *ike_sa;
-	
+
 	/**
 	 * Are we the initiator?
 	 */
 	bool initiator;
-	
+
 	/**
 	 * are we deleting a rekeyed SA?
 	 */
 	bool rekeyed;
-	
+
 	/**
 	 * are we responding to a delete, but have initated our own?
 	 */
@@ -69,7 +69,7 @@ static status_t build_i(private_ike_delete_t *this, message_t *message)
 
 	delete_payload = delete_payload_create(PROTO_IKE);
 	message->add_payload(message, (payload_t*)delete_payload);
-	
+
 	if (this->ike_sa->get_state(this->ike_sa) == IKE_REKEYING)
 	{
 		this->rekeyed = TRUE;
@@ -189,7 +189,7 @@ ike_delete_t *ike_delete_create(ike_sa_t *ike_sa, bool initiator)
 	this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
 	this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
 	this->public.task.destroy = (void(*)(task_t*))destroy;
-	
+
 	if (initiator)
 	{
 		this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
@@ -200,11 +200,11 @@ ike_delete_t *ike_delete_create(ike_sa_t *ike_sa, bool initiator)
 		this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
 		this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
 	}
-	
+
 	this->ike_sa = ike_sa;
 	this->initiator = initiator;
 	this->rekeyed = FALSE;
 	this->simultaneous = FALSE;
-	
+
 	return &this->public;
 }
diff --git a/src/charon/sa/tasks/ike_dpd.c b/src/charon/sa/tasks/ike_dpd.c
index 3aa714049..4c6ba7662 100644
--- a/src/charon/sa/tasks/ike_dpd.c
+++ b/src/charon/sa/tasks/ike_dpd.c
@@ -24,7 +24,7 @@ typedef struct private_ike_dpd_t private_ike_dpd_t;
  * Private members of a ike_dpd_t task.
  */
 struct private_ike_dpd_t {
-	
+
 	/**
 	 * Public methods and task_t interface.
 	 */
@@ -83,7 +83,7 @@ ike_dpd_t *ike_dpd_create(bool initiator)
 	this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
 	this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
 	this->public.task.destroy = (void(*)(task_t*))destroy;
-	
+
 	if (initiator)
 	{
 		this->public.task.build = (status_t(*)(task_t*,message_t*))return_need_more;
@@ -94,6 +94,6 @@ ike_dpd_t *ike_dpd_create(bool initiator)
 		this->public.task.build = (status_t(*)(task_t*,message_t*))return_success;
 		this->public.task.process = (status_t(*)(task_t*,message_t*))return_need_more;
 	}
-	
+
 	return &this->public;
 }
diff --git a/src/charon/sa/tasks/ike_init.c b/src/charon/sa/tasks/ike_init.c
index 2705f5886..5eb33b540 100644
--- a/src/charon/sa/tasks/ike_init.c
+++ b/src/charon/sa/tasks/ike_init.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Tobias Brunner
+ * Copyright (C) 2008-2009 Tobias Brunner
  * Copyright (C) 2005-2008 Martin Willi
  * Copyright (C) 2005 Jan Hutter
  * Hochschule fuer Technik Rapperswil
@@ -24,7 +24,6 @@
 #include <encoding/payloads/sa_payload.h>
 #include <encoding/payloads/ke_payload.h>
 #include <encoding/payloads/nonce_payload.h>
-#include <encoding/payloads/vendor_id_payload.h>
 
 /** maximum retries to do with cookies/other dh groups */
 #define MAX_RETRIES 5
@@ -35,67 +34,67 @@ typedef struct private_ike_init_t private_ike_init_t;
  * Private members of a ike_init_t task.
  */
 struct private_ike_init_t {
-	
+
 	/**
 	 * Public methods and task_t interface.
 	 */
 	ike_init_t public;
-	
+
 	/**
 	 * Assigned IKE_SA.
 	 */
 	ike_sa_t *ike_sa;
-	
+
 	/**
 	 * Are we the initiator?
 	 */
 	bool initiator;
-	
+
 	/**
 	 * IKE config to establish
 	 */
 	ike_cfg_t *config;
-	
+
 	/**
 	 * diffie hellman group to use
 	 */
 	diffie_hellman_group_t dh_group;
-	
+
 	/**
 	 * diffie hellman key exchange
 	 */
 	diffie_hellman_t *dh;
-	
+
 	/**
 	 * Keymat derivation (from IKE_SA)
 	 */
 	keymat_t *keymat;
-	
+
 	/**
 	 * nonce chosen by us
 	 */
 	chunk_t my_nonce;
-	
+
 	/**
 	 * nonce chosen by peer
 	 */
 	chunk_t other_nonce;
-	
+
 	/**
 	 * Negotiated proposal used for IKE_SA
 	 */
 	proposal_t *proposal;
-	
+
 	/**
 	 * Old IKE_SA which gets rekeyed
 	 */
 	ike_sa_t *old_sa;
-	
+
 	/**
 	 * cookie received from responder
 	 */
 	chunk_t cookie;
-	
+
 	/**
 	 * retries done so far after failure (cookie or bad dh group)
 	 */
@@ -114,16 +113,16 @@ static void build_payloads(private_ike_init_t *this, message_t *message)
 	ike_sa_id_t *id;
 	proposal_t *proposal;
 	iterator_t *iterator;
-	
+
 	id = this->ike_sa->get_id(this->ike_sa);
-	
+
 	this->config = this->ike_sa->get_ike_cfg(this->ike_sa);
 
 	if (this->initiator)
 	{
 		proposal_list = this->config->get_proposals(this->config);
 		if (this->old_sa)
-		{	
+		{
 			/* include SPI of new IKE_SA when we are rekeying */
 			iterator = proposal_list->create_iterator(proposal_list, TRUE);
 			while (iterator->iterate(iterator, (void**)&proposal))
@@ -132,7 +131,7 @@ static void build_payloads(private_ike_init_t *this, message_t *message)
 			}
 			iterator->destroy(iterator);
 		}
-		
+
 		sa_payload = sa_payload_create_from_proposal_list(proposal_list);
 		proposal_list->destroy_offset(proposal_list, offsetof(proposal_t, destroy));
 	}
@@ -146,11 +145,11 @@ static void build_payloads(private_ike_init_t *this, message_t *message)
 		sa_payload = sa_payload_create_from_proposal(this->proposal);
 	}
 	message->add_payload(message, (payload_t*)sa_payload);
-	
+
 	nonce_payload = nonce_payload_create();
 	nonce_payload->set_nonce(nonce_payload, this->my_nonce);
 	ke_payload = ke_payload_create_from_diffie_hellman(this->dh);
-	
+
 	if (this->old_sa)
 	{	/* payload order differs if we are rekeying */
 		message->add_payload(message, (payload_t*)nonce_payload);
@@ -170,7 +169,7 @@ static void process_payloads(private_ike_init_t *this, message_t *message)
 {
 	enumerator_t *enumerator;
 	payload_t *payload;
-	
+
 	enumerator = message->create_payload_enumerator(message);
 	while (enumerator->enumerate(enumerator, &payload))
 	{
@@ -180,18 +179,21 @@ static void process_payloads(private_ike_init_t *this, message_t *message)
 			{
 				sa_payload_t *sa_payload = (sa_payload_t*)payload;
 				linked_list_t *proposal_list;
-				
+				bool private;
+
 				proposal_list = sa_payload->get_proposals(sa_payload);
+				private = this->ike_sa->supports_extension(this->ike_sa,
+														   EXT_STRONGSWAN);
 				this->proposal = this->config->select_proposal(this->config,
-															   proposal_list);
-				proposal_list->destroy_offset(proposal_list, 
+														proposal_list, private);
+				proposal_list->destroy_offset(proposal_list,
 											  offsetof(proposal_t, destroy));
 				break;
 			}
 			case KEY_EXCHANGE:
 			{
 				ke_payload_t *ke_payload = (ke_payload_t*)payload;
-				
+
 				this->dh_group = ke_payload->get_dh_group_number(ke_payload);
 				if (!this->initiator)
 				{
@@ -212,13 +214,6 @@ static void process_payloads(private_ike_init_t *this, message_t *message)
 				this->other_nonce = nonce_payload->get_nonce(nonce_payload);
 				break;
 			}
-			case VENDOR_ID:
-			{
-				vendor_id_payload_t *vendor_id = (vendor_id_payload_t*)payload;
-				chunk_t vid = vendor_id->get_data(vendor_id);
-
-				DBG1(DBG_ENC, "received vendor id: %#B", &vid);					
-			}
 			default:
 				break;
 		}
@@ -232,20 +227,20 @@ static void process_payloads(private_ike_init_t *this, message_t *message)
 static status_t build_i(private_ike_init_t *this, message_t *message)
 {
 	rng_t *rng;
-	
+
 	this->config = this->ike_sa->get_ike_cfg(this->ike_sa);
 	DBG0(DBG_IKE, "initiating IKE_SA %s[%d] to %H",
 		 this->ike_sa->get_name(this->ike_sa),
 		 this->ike_sa->get_unique_id(this->ike_sa),
 		 this->ike_sa->get_other_host(this->ike_sa));
 	this->ike_sa->set_state(this->ike_sa, IKE_CONNECTING);
-	
-	if (this->retry++ >= MAX_RETRIES)
+
+	if (this->retry >= MAX_RETRIES)
 	{
 		DBG1(DBG_IKE, "giving up after %d retries", MAX_RETRIES);
 		return FAILED;
 	}
-	
+
 	/* if the DH group is set via use_dh_group(), we already have a DH object */
 	if (!this->dh)
 	{
@@ -258,7 +253,7 @@ static status_t build_i(private_ike_init_t *this, message_t *message)
 			return FAILED;
 		}
 	}
-	
+
 	/* generate nonce only when we are trying the first time */
 	if (this->my_nonce.ptr == NULL)
 	{
@@ -271,12 +266,12 @@ static status_t build_i(private_ike_init_t *this, message_t *message)
 		rng->allocate_bytes(rng, NONCE_SIZE, &this->my_nonce);
 		rng->destroy(rng);
 	}
-	
+
 	if (this->cookie.ptr)
 	{
 		message->add_notify(message, FALSE, COOKIE, this->cookie);
 	}
-	
+
 	build_payloads(this, message);
 
 #ifdef ME
@@ -288,7 +283,7 @@ static status_t build_i(private_ike_init_t *this, message_t *message)
 		}
 	}
 #endif /* ME */
-	
+
 	return NEED_MORE;
 }
 
@@ -296,9 +291,9 @@ static status_t build_i(private_ike_init_t *this, message_t *message)
  * Implementation of task_t.process for responder
  */
 static status_t process_r(private_ike_init_t *this, message_t *message)
-{	
+{
 	rng_t *rng;
-	
+
 	this->config = this->ike_sa->get_ike_cfg(this->ike_sa);
 	DBG0(DBG_IKE, "%H is initiating an IKE_SA", message->get_source(message));
 	this->ike_sa->set_state(this->ike_sa, IKE_CONNECTING);
@@ -311,59 +306,22 @@ static status_t process_r(private_ike_init_t *this, message_t *message)
 	}
 	rng->allocate_bytes(rng, NONCE_SIZE, &this->my_nonce);
 	rng->destroy(rng);
-	
+
 #ifdef ME
 	{
-		chunk_t connect_id = chunk_empty;
-		enumerator_t *enumerator;
-		payload_t *payload;
-		
-		/* check for a ME_CONNECTID notify */
-		enumerator = message->create_payload_enumerator(message);
-		while (enumerator->enumerate(enumerator, &payload))
-		{
-			if (payload->get_type(payload) == NOTIFY)
-			{
-				notify_payload_t *notify = (notify_payload_t*)payload;
-				notify_type_t type = notify->get_notify_type(notify);
-			
-				switch (type)
-				{
-					case ME_CONNECTID:
-					{
-						chunk_free(&connect_id);
-						connect_id = chunk_clone(notify->get_notification_data(notify));
-						DBG2(DBG_IKE, "received ME_CONNECTID %#B", &connect_id);
-						break;
-					}
-					default:
-					{
-						if (type < 16383)
-						{
-							DBG1(DBG_IKE, "received %N notify error",
-								notify_type_names, type);
-							break;	
-						}
-						DBG2(DBG_IKE, "received %N notify",
-							notify_type_names, type);
-						break;
-					}
-				}
-			}
-		}
-		enumerator->destroy(enumerator);
-		
-		if (connect_id.ptr)
+		notify_payload_t *notify = message->get_notify(message, ME_CONNECTID);
+		if (notify)
 		{
+			chunk_t connect_id = notify->get_notification_data(notify);
+			DBG2(DBG_IKE, "received ME_CONNECTID %#B", &connect_id);
 			charon->connect_manager->stop_checks(charon->connect_manager,
-				connect_id);
-			chunk_free(&connect_id);
+												 connect_id);
 		}
 	}
 #endif /* ME */
-	
+
 	process_payloads(this, message);
-	
+
 	return NEED_MORE;
 }
 
@@ -377,7 +335,7 @@ static bool derive_keys(private_ike_init_t *this,
 	pseudo_random_function_t prf_alg = PRF_UNDEFINED;
 	chunk_t skd = chunk_empty;
 	ike_sa_id_t *id;
-	
+
 	id = this->ike_sa->get_id(this->ike_sa);
 	if (this->old_sa)
 	{
@@ -417,12 +375,12 @@ static status_t build_r(private_ike_init_t *this, message_t *message)
 		return FAILED;
 	}
 	this->ike_sa->set_proposal(this->ike_sa, this->proposal);
-	
+
 	if (this->dh == NULL ||
 		!this->proposal->has_dh_group(this->proposal, this->dh_group))
 	{
 		u_int16_t group;
-		
+
 		if (this->proposal->get_algorithm(this->proposal, DIFFIE_HELLMAN_GROUP,
 										  &group, NULL))
 		{
@@ -440,7 +398,7 @@ static status_t build_r(private_ike_init_t *this, message_t *message)
 		}
 		return FAILED;
 	}
-	
+
 	if (!derive_keys(this, this->other_nonce, this->my_nonce))
 	{
 		DBG1(DBG_IKE, "key derivation failed");
@@ -458,7 +416,7 @@ static status_t process_i(private_ike_init_t *this, message_t *message)
 {
 	enumerator_t *enumerator;
 	payload_t *payload;
-	
+
 	/* check for erronous notifies */
 	enumerator = message->create_payload_enumerator(message);
 	while (enumerator->enumerate(enumerator, &payload))
@@ -467,27 +425,28 @@ static status_t process_i(private_ike_init_t *this, message_t *message)
 		{
 			notify_payload_t *notify = (notify_payload_t*)payload;
 			notify_type_t type = notify->get_notify_type(notify);
-			
+
 			switch (type)
 			{
 				case INVALID_KE_PAYLOAD:
 				{
 					chunk_t data;
 					diffie_hellman_group_t bad_group;
-					
+
 					bad_group = this->dh_group;
 					data = notify->get_notification_data(notify);
 					this->dh_group = ntohs(*((u_int16_t*)data.ptr));
 					DBG1(DBG_IKE, "peer didn't accept DH group %N, "
 						 "it requested %N", diffie_hellman_group_names,
 						 bad_group, diffie_hellman_group_names, this->dh_group);
-						 
+
 					if (this->old_sa == NULL)
 					{	/* reset the IKE_SA if we are not rekeying */
 						this->ike_sa->reset(this->ike_sa);
 					}
-					
+
 					enumerator->destroy(enumerator);
+					this->retry++;
 					return NEED_MORE;
 				}
 				case NAT_DETECTION_SOURCE_IP:
@@ -504,6 +463,7 @@ static status_t process_i(private_ike_init_t *this, message_t *message)
 					this->ike_sa->reset(this->ike_sa);
 					enumerator->destroy(enumerator);
 					DBG2(DBG_IKE, "received %N notify", notify_type_names, type);
+					this->retry++;
 					return NEED_MORE;
 				}
 				default:
@@ -513,7 +473,7 @@ static status_t process_i(private_ike_init_t *this, message_t *message)
 						DBG1(DBG_IKE, "received %N notify error",
 							 notify_type_names, type);
 						enumerator->destroy(enumerator);
-						return FAILED;	
+						return FAILED;
 					}
 					DBG2(DBG_IKE, "received %N notify",
 						notify_type_names, type);
@@ -523,7 +483,7 @@ static status_t process_i(private_ike_init_t *this, message_t *message)
 		}
 	}
 	enumerator->destroy(enumerator);
-	
+
 	process_payloads(this, message);
 
 	/* check if we have everything */
@@ -534,14 +494,14 @@ static status_t process_i(private_ike_init_t *this, message_t *message)
 		return FAILED;
 	}
 	this->ike_sa->set_proposal(this->ike_sa, this->proposal);
-	
+
 	if (this->dh == NULL ||
 		!this->proposal->has_dh_group(this->proposal, this->dh_group))
 	{
 		DBG1(DBG_IKE, "peer DH group selection invalid");
 		return FAILED;
 	}
-	
+
 	if (!derive_keys(this, this->my_nonce, this->other_nonce))
 	{
 		DBG1(DBG_IKE, "key derivation failed");
@@ -581,7 +541,7 @@ static void migrate(private_ike_init_t *this, ike_sa_t *ike_sa)
 {
 	DESTROY_IF(this->proposal);
 	chunk_free(&this->other_nonce);
-	
+
 	this->ike_sa = ike_sa;
 	this->proposal = NULL;
 	DESTROY_IF(this->dh);
@@ -622,7 +582,7 @@ ike_init_t *ike_init_create(ike_sa_t *ike_sa, bool initiator, ike_sa_t *old_sa)
 		this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
 		this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
 	}
-	
+
 	this->ike_sa = ike_sa;
 	this->initiator = initiator;
 	this->dh_group = MODP_NONE;
@@ -635,6 +595,6 @@ ike_init_t *ike_init_create(ike_sa_t *ike_sa, bool initiator, ike_sa_t *old_sa)
 	this->config = NULL;
 	this->old_sa = old_sa;
 	this->retry = 0;
-	
+
 	return &this->public;
 }
diff --git a/src/charon/sa/tasks/ike_init.h b/src/charon/sa/tasks/ike_init.h
index 8d3810ef2..7bd784cff 100644
--- a/src/charon/sa/tasks/ike_init.h
+++ b/src/charon/sa/tasks/ike_init.h
@@ -38,7 +38,7 @@ struct ike_init_t {
 	 * Implements the task_t interface
 	 */
 	task_t task;
-	
+
 	/**
 	 * Get the lower of the two nonces, used for rekey collisions.
 	 *
diff --git a/src/charon/sa/tasks/ike_me.c b/src/charon/sa/tasks/ike_me.c
index d359aa339..2d2847ae0 100644
--- a/src/charon/sa/tasks/ike_me.c
+++ b/src/charon/sa/tasks/ike_me.c
@@ -12,7 +12,7 @@
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
  */
- 
+
 #include "ike_me.h"
 
 #include <string.h>
@@ -33,71 +33,71 @@ typedef struct private_ike_me_t private_ike_me_t;
  * Private members of a ike_me_t task.
  */
 struct private_ike_me_t {
-	
+
 	/**
 	 * Public methods and task_t interface.
 	 */
 	ike_me_t public;
-	
+
 	/**
 	 * Assigned IKE_SA.
 	 */
 	ike_sa_t *ike_sa;
-	
+
 	/**
 	 * Are we the initiator?
 	 */
 	bool initiator;
-	
+
 	/**
 	 * Is this a mediation connection?
 	 */
 	bool mediation;
-	
+
 	/**
 	 * Is this the response from another peer?
 	 */
 	bool response;
-	
+
 	/**
 	 * Gathered endpoints
 	 */
 	linked_list_t *local_endpoints;
-	
+
 	/**
 	 * Parsed endpoints
 	 */
 	linked_list_t *remote_endpoints;
-	
+
 	/**
 	 * Did the peer request a callback?
 	 */
 	bool callback;
-	
+
 	/**
 	 * Did the connect fail?
 	 */
 	bool failed;
-	
+
 	/**
 	 * Was there anything wrong with the payloads?
 	 */
 	bool invalid_syntax;
-	
+
 	/**
 	 * The requested peer
 	 */
-	identification_t *peer_id;	
+	identification_t *peer_id;
 	/**
 	 * Received ID used for connectivity checks
 	 */
 	chunk_t connect_id;
-	
+
 	/**
 	 * Received key used for connectivity checks
 	 */
 	chunk_t connect_key;
-	
+
 	/**
 	 * Peer config of the mediated connection
 	 */
@@ -112,7 +112,7 @@ static void add_endpoints_to_message(message_t *message, linked_list_t *endpoint
 {
 	iterator_t *iterator;
 	endpoint_notify_t *endpoint;
-	
+
 	iterator = endpoints->create_iterator(endpoints, TRUE);
 	while (iterator->iterate(iterator, (void**)&endpoint))
 	{
@@ -129,25 +129,25 @@ static void gather_and_add_endpoints(private_ike_me_t *this, message_t *message)
 	enumerator_t *enumerator;
 	host_t *addr, *host;
 	u_int16_t port;
-	
+
 	/* get the port that is used to communicate with the ms */
 	host = this->ike_sa->get_my_host(this->ike_sa);
 	port = host->get_port(host);
-	
+
 	enumerator = charon->kernel_interface->create_address_enumerator(
 										charon->kernel_interface, FALSE, FALSE);
 	while (enumerator->enumerate(enumerator, (void**)&addr))
 	{
 		host = addr->clone(addr);
 		host->set_port(host, port);
-		
+
 		this->local_endpoints->insert_last(this->local_endpoints,
 				endpoint_notify_create_from_host(HOST, host, NULL));
-		
+
 		host->destroy(host);
 	}
 	enumerator->destroy(enumerator);
-	
+
 	host = this->ike_sa->get_server_reflexive_host(this->ike_sa);
 	if (host)
 	{
@@ -155,7 +155,7 @@ static void gather_and_add_endpoints(private_ike_me_t *this, message_t *message)
 				endpoint_notify_create_from_host(SERVER_REFLEXIVE, host,
 						this->ike_sa->get_my_host(this->ike_sa)));
 	}
-	
+
 	add_endpoints_to_message(message, this->local_endpoints);
 }
 
@@ -166,7 +166,7 @@ static void process_payloads(private_ike_me_t *this, message_t *message)
 {
 	enumerator_t *enumerator;
 	payload_t *payload;
-	
+
 	enumerator = message->create_payload_enumerator(message);
 	while (enumerator->enumerate(enumerator, &payload))
 	{
@@ -174,9 +174,9 @@ static void process_payloads(private_ike_me_t *this, message_t *message)
 		{
 			continue;
 		}
-		
+
 		notify_payload_t *notify = (notify_payload_t*)payload;
-		
+
 		switch (notify->get_notify_type(notify))
 		{
 			case ME_CONNECT_FAILED:
@@ -193,16 +193,19 @@ static void process_payloads(private_ike_me_t *this, message_t *message)
 			}
 			case ME_ENDPOINT:
 			{
-				endpoint_notify_t *endpoint = endpoint_notify_create_from_payload(notify);
+				endpoint_notify_t *endpoint;
+				endpoint = endpoint_notify_create_from_payload(notify);
 				if (!endpoint)
 				{
 					DBG1(DBG_IKE, "received invalid ME_ENDPOINT notify");
 					break;
 				}
-				DBG1(DBG_IKE, "received %N ME_ENDPOINT %#H", me_endpoint_type_names,
-					endpoint->get_type(endpoint), endpoint->get_host(endpoint));
-				
-				this->remote_endpoints->insert_last(this->remote_endpoints, endpoint);
+				DBG1(DBG_IKE, "received %N ME_ENDPOINT %#H",
+					 me_endpoint_type_names, endpoint->get_type(endpoint),
+					 endpoint->get_host(endpoint));
+
+				this->remote_endpoints->insert_last(this->remote_endpoints,
+													endpoint);
 				break;
 			}
 			case ME_CALLBACK:
@@ -263,7 +266,9 @@ static status_t build_i(private_ike_me_t *this, message_t *message)
 		{
 			if (this->ike_sa->has_condition(this->ike_sa, COND_NAT_HERE))
 			{
-				endpoint_notify_t *endpoint = endpoint_notify_create_from_host(SERVER_REFLEXIVE, NULL, NULL);
+				endpoint_notify_t *endpoint;
+				endpoint = endpoint_notify_create_from_host(SERVER_REFLEXIVE,
+															NULL, NULL);
 				message->add_payload(message, (payload_t*)endpoint->build_notify(endpoint));
 				endpoint->destroy(endpoint);
 			}
@@ -271,42 +276,42 @@ static status_t build_i(private_ike_me_t *this, message_t *message)
 		}
 		case ME_CONNECT:
 		{
-			id_payload_t *id_payload;
 			rng_t *rng;
-			
-			id_payload = id_payload_create_from_identification(ID_PEER, this->peer_id);
+			id_payload_t *id_payload;
+			id_payload = id_payload_create_from_identification(ID_PEER,
+															   this->peer_id);
 			message->add_payload(message, (payload_t*)id_payload);
-			
+
 			rng = lib->crypto->create_rng(lib->crypto, RNG_STRONG);
 			if (!rng)
 			{
-				DBG1(DBG_IKE, "unable to generate connect ID for ME_CONNECT");	
+				DBG1(DBG_IKE, "unable to generate connect ID for ME_CONNECT");
 				return FAILED;
 			}
 			if (!this->response)
 			{
-				/* only the initiator creates a connect ID. the responder returns
-				 * the connect ID that it received from the initiator */
+				/* only the initiator creates a connect ID. the responder
+				 * returns the connect ID that it received from the initiator */
 				rng->allocate_bytes(rng, ME_CONNECTID_LEN, &this->connect_id);
 			}
 			rng->allocate_bytes(rng, ME_CONNECTKEY_LEN, &this->connect_key);
 			rng->destroy(rng);
-			
+
 			message->add_notify(message, FALSE, ME_CONNECTID, this->connect_id);
 			message->add_notify(message, FALSE, ME_CONNECTKEY, this->connect_key);
-			
+
 			if (this->response)
 			{
 				message->add_notify(message, FALSE, ME_RESPONSE, chunk_empty);
 			}
 			else
 			{
-				/* FIXME: should we make that configurable? */
+				/* FIXME: should we make this configurable? */
 				message->add_notify(message, FALSE, ME_CALLBACK, chunk_empty);
 			}
-			
+
 			gather_and_add_endpoints(this, message);
-			
+
 			break;
 		}
 		default:
@@ -328,40 +333,44 @@ static status_t process_r(private_ike_me_t *this, message_t *message)
 			id_payload = (id_payload_t*)message->get_payload(message, ID_PEER);
 			if (!id_payload)
 			{
-				DBG1(DBG_IKE, "received ME_CONNECT without ID_PEER payload, aborting");
+				DBG1(DBG_IKE, "received ME_CONNECT without ID_PEER payload"
+					 ", aborting");
 				break;
 			}
 			this->peer_id = id_payload->get_identification(id_payload);
-			
+
 			process_payloads(this, message);
-			
+
 			if (this->callback)
 			{
 				DBG1(DBG_IKE, "received ME_CALLBACK for '%Y'", this->peer_id);
 				break;
-			}			
-			
+			}
+
 			if (!this->connect_id.ptr)
 			{
-				DBG1(DBG_IKE, "received ME_CONNECT without ME_CONNECTID notify, aborting");
+				DBG1(DBG_IKE, "received ME_CONNECT without ME_CONNECTID notify"
+					 ", aborting");
 				this->invalid_syntax = TRUE;
 				break;
 			}
-			
+
 			if (!this->connect_key.ptr)
 			{
-				DBG1(DBG_IKE, "received ME_CONNECT without ME_CONNECTKEY notify, aborting");
+				DBG1(DBG_IKE, "received ME_CONNECT without ME_CONNECTKEY "
+					 "notify, aborting");
 				this->invalid_syntax = TRUE;
 				break;
 			}
-			
+
 			if (!this->remote_endpoints->get_count(this->remote_endpoints))
 			{
-				DBG1(DBG_IKE, "received ME_CONNECT without any ME_ENDPOINT payloads, aborting");
+				DBG1(DBG_IKE, "received ME_CONNECT without any ME_ENDPOINT "
+					 "payloads, aborting");
 				this->invalid_syntax = TRUE;
 				break;
 			}
-			
+
 			DBG1(DBG_IKE, "received ME_CONNECT");
 			break;
 		}
@@ -385,33 +394,39 @@ static status_t build_r(private_ike_me_t *this, message_t *message)
 				message->add_notify(message, TRUE, INVALID_SYNTAX, chunk_empty);
 				break;
 			}
-			
+
 			if (this->callback)
 			{
-				charon->connect_manager->check_and_initiate(charon->connect_manager,
+				/* we got a callback from the mediation server, initiate the
+				 * queued mediated connecction */
+				charon->connect_manager->check_and_initiate(
+						charon->connect_manager,
 						this->ike_sa->get_id(this->ike_sa),
 						this->ike_sa->get_my_id(this->ike_sa), this->peer_id);
 				return SUCCESS;
 			}
-			
+
 			if (this->response)
 			{
 				/* FIXME: handle result of set_responder_data
 				 * as initiator, upon receiving a response from another peer,
 				 * update the checklist and start sending checks */
-				charon->connect_manager->set_responder_data(charon->connect_manager,
-						this->connect_id, this->connect_key, this->remote_endpoints);
+				charon->connect_manager->set_responder_data(
+						charon->connect_manager,
+						this->connect_id, this->connect_key,
+						this->remote_endpoints);
 			}
 			else
 			{
 				/* FIXME: handle result of set_initiator_data
 				 * as responder, create a checklist with the initiator's data */
-				charon->connect_manager->set_initiator_data(charon->connect_manager,
+				charon->connect_manager->set_initiator_data(
+						charon->connect_manager,
 						this->peer_id, this->ike_sa->get_my_id(this->ike_sa),
-						this->connect_id, this->connect_key, this->remote_endpoints,
-						FALSE);
+						this->connect_id, this->connect_key,
+						this->remote_endpoints, FALSE);
 				if (this->ike_sa->respond(this->ike_sa, this->peer_id,
-						this->connect_id) != SUCCESS)
+										  this->connect_id) != SUCCESS)
 				{
 					return FAILED;
 				}
@@ -434,13 +449,11 @@ static status_t process_i(private_ike_me_t *this, message_t *message)
 		case IKE_SA_INIT:
 		{
 			process_payloads(this, message);
-		
 			if (!this->mediation)
 			{
 				DBG1(DBG_IKE, "server did not return a ME_MEDIATION, aborting");
 				return FAILED;
 			}
-	
 			return NEED_MORE;
 		}
 		case IKE_AUTH:
@@ -449,24 +462,21 @@ static status_t process_i(private_ike_me_t *this, message_t *message)
 			/* FIXME: we should update the server reflexive endpoint somehow,
 			 * if mobike notices a change */
 			endpoint_notify_t *reflexive;
-			if (this->remote_endpoints->get_first(this->remote_endpoints, 
+			if (this->remote_endpoints->get_first(this->remote_endpoints,
 											(void**)&reflexive) == SUCCESS &&
 				reflexive->get_type(reflexive) == SERVER_REFLEXIVE)
-			{	/* FIXME: should we accept this endpoint even if we did not send 
+			{	/* FIXME: should we accept this endpoint even if we did not send
 				 * a request? */
 				host_t *endpoint = reflexive->get_host(reflexive);
-				
-				this->ike_sa->set_server_reflexive_host(this->ike_sa, endpoint->clone(endpoint));
+				endpoint = endpoint->clone(endpoint);
+				this->ike_sa->set_server_reflexive_host(this->ike_sa, endpoint);
 			}
-			/* FIXME: what if it failed? e.g. AUTH failure */
-			DBG1(DBG_IKE, "established mediation connection successfully");
-			
 			break;
 		}
 		case ME_CONNECT:
 		{
 			process_payloads(this, message);
-			
+
 			if (this->failed)
 			{
 				DBG1(DBG_IKE, "peer '%Y' is not online", this->peer_id);
@@ -476,21 +486,25 @@ static status_t process_i(private_ike_me_t *this, message_t *message)
 			{
 				if (this->response)
 				{
-					/* FIXME: handle result of set_responder_data.
-					 * as responder, we update the checklist and start sending checks */
-					charon->connect_manager->set_responder_data(charon->connect_manager,
-							this->connect_id, this->connect_key, this->local_endpoints);
+					/* FIXME: handle result of set_responder_data. */
+					/* as responder, we update the checklist and start sending
+					 * checks */
+					charon->connect_manager->set_responder_data(
+							charon->connect_manager, this->connect_id,
+							this->connect_key, this->local_endpoints);
 				}
 				else
 				{
-					/* FIXME: handle result of set_initiator_data
-					 * as initiator, we create a checklist and set the initiator's data */
-					charon->connect_manager->set_initiator_data(charon->connect_manager,
-						this->ike_sa->get_my_id(this->ike_sa), this->peer_id,
-						this->connect_id, this->connect_key, this->local_endpoints,
-						TRUE);
-					/* FIXME: also start a timer for the whole transaction (maybe
-					 * within the connect_manager?) */
+					/* FIXME: handle result of set_initiator_data */
+					/* as initiator, we create a checklist and set the
+					 * initiator's data */
+					charon->connect_manager->set_initiator_data(
+							charon->connect_manager,
+							this->ike_sa->get_my_id(this->ike_sa),
+							this->peer_id, this->connect_id, this->connect_key,
+							this->local_endpoints, TRUE);
+					/* FIXME: also start a timer for the whole transaction
+					 * (maybe within the connect_manager?) */
 				}
 			}
 			break;
@@ -510,9 +524,11 @@ static status_t build_i_ms(private_ike_me_t *this, message_t *message)
 	{
 		case ME_CONNECT:
 		{
-			id_payload_t *id_payload = id_payload_create_from_identification(ID_PEER, this->peer_id);
+			id_payload_t *id_payload;
+			id_payload = id_payload_create_from_identification(ID_PEER,
+															   this->peer_id);
 			message->add_payload(message, (payload_t*)id_payload);
-			
+
 			if (this->callback)
 			{
 				message->add_notify(message, FALSE, ME_CALLBACK, chunk_empty);
@@ -521,11 +537,13 @@ static status_t build_i_ms(private_ike_me_t *this, message_t *message)
 			{
 				if (this->response)
 				{
-					message->add_notify(message, FALSE, ME_RESPONSE, chunk_empty);
-				}	
-				message->add_notify(message, FALSE, ME_CONNECTID, this->connect_id);
-				message->add_notify(message, FALSE, ME_CONNECTKEY, this->connect_key);
-				
+					message->add_notify(message, FALSE, ME_RESPONSE,
+										chunk_empty);
+				}
+				message->add_notify(message, FALSE, ME_CONNECTID,
+									this->connect_id);
+				message->add_notify(message, FALSE, ME_CONNECTKEY,
+									this->connect_key);
 				add_endpoints_to_message(message, this->remote_endpoints);
 			}
 			break;
@@ -533,7 +551,6 @@ static status_t build_i_ms(private_ike_me_t *this, message_t *message)
 		default:
 			break;
 	}
-	
 	return NEED_MORE;
 }
 
@@ -546,15 +563,15 @@ static status_t process_r_ms(private_ike_me_t *this, message_t *message)
 	{
 		case IKE_SA_INIT:
 		{
-			/* FIXME: we should check for SA* and TS* payloads
-			 * if any are there send NO_ADDITIONAL_SAS back and delete this SA */
+			/* FIXME: we should check for SA* and TS* payloads. if there are
+			 * any, send NO_ADDITIONAL_SAS back and delete this SA */
 			process_payloads(this, message);
 			return this->mediation ? NEED_MORE : SUCCESS;
 		}
 		case IKE_AUTH:
 		{
-			/* FIXME: we should check whether the current peer_config is configured
-			 * as mediation connection */
+			/* FIXME: we should check whether the current peer_config is
+			 * configured as mediation connection */
 			process_payloads(this, message);
 			break;
 		}
@@ -570,32 +587,35 @@ static status_t process_r_ms(private_ike_me_t *this, message_t *message)
 			id_payload = (id_payload_t*)message->get_payload(message, ID_PEER);
 			if (!id_payload)
 			{
-				DBG1(DBG_IKE, "received ME_CONNECT without ID_PEER payload, aborting");
+				DBG1(DBG_IKE, "received ME_CONNECT without ID_PEER payload"
+					 ", aborting");
 				this->invalid_syntax = TRUE;
 				break;
 			}
-			
 			this->peer_id = id_payload->get_identification(id_payload);
-			
+
 			process_payloads(this, message);
-			
+
 			if (!this->connect_id.ptr)
 			{
-				DBG1(DBG_IKE, "received ME_CONNECT without ME_CONNECTID notify, aborting");
+				DBG1(DBG_IKE, "received ME_CONNECT without ME_CONNECTID notify"
+					 ", aborting");
 				this->invalid_syntax = TRUE;
 				break;
 			}
-			
+
 			if (!this->connect_key.ptr)
 			{
-				DBG1(DBG_IKE, "received ME_CONNECT without ME_CONNECTKEY notify, aborting");
+				DBG1(DBG_IKE, "received ME_CONNECT without ME_CONNECTKEY notify"
+					 ", aborting");
 				this->invalid_syntax = TRUE;
 				break;
 			}
-			
+
 			if (!this->remote_endpoints->get_count(this->remote_endpoints))
 			{
-				DBG1(DBG_IKE, "received ME_CONNECT without any ME_ENDPOINT payloads, aborting");
+				DBG1(DBG_IKE, "received ME_CONNECT without any ME_ENDPOINT "
+					 "payloads, aborting");
 				this->invalid_syntax = TRUE;
 				break;
 			}
@@ -604,7 +624,6 @@ static status_t process_r_ms(private_ike_me_t *this, message_t *message)
 		default:
 			break;
 	}
-	
 	return NEED_MORE;
 }
 
@@ -623,58 +642,54 @@ static status_t build_r_ms(private_ike_me_t *this, message_t *message)
 		case IKE_AUTH:
 		{
 			endpoint_notify_t *endpoint;
-			if (this->remote_endpoints->get_first(this->remote_endpoints, (void**)&endpoint) == SUCCESS &&
-					endpoint->get_type(endpoint) == SERVER_REFLEXIVE)
+			if (this->remote_endpoints->get_first(this->remote_endpoints,
+											(void**)&endpoint) == SUCCESS &&
+				endpoint->get_type(endpoint) == SERVER_REFLEXIVE)
 			{
 				host_t *host = this->ike_sa->get_other_host(this->ike_sa);
-				
-				DBG2(DBG_IKE, "received request for a server reflexive endpoint "
-						"sending: %#H", host);
-				
-				endpoint = endpoint_notify_create_from_host(SERVER_REFLEXIVE, host, NULL);								
+				DBG2(DBG_IKE, "received request for a server reflexive "
+					 "endpoint sending: %#H", host);
+				endpoint = endpoint_notify_create_from_host(SERVER_REFLEXIVE,
+															host, NULL);
 				message->add_payload(message, (payload_t*)endpoint->build_notify(endpoint));
 				endpoint->destroy(endpoint);
 			}
-			
-			/* FIXME: we actually must delete any existing IKE_SAs with the same remote id */
 			this->ike_sa->act_as_mediation_server(this->ike_sa);
-			
-			DBG1(DBG_IKE, "established mediation connection successfully");
-			
 			break;
 		}
 		case ME_CONNECT:
-		{	
+		{
 			if (this->invalid_syntax)
 			{
 				message->add_notify(message, TRUE, INVALID_SYNTAX, chunk_empty);
 				break;
 			}
-			
+
 			ike_sa_id_t *peer_sa;
 			if (this->callback)
 			{
-				peer_sa = charon->mediation_manager->check_and_register(charon->mediation_manager,
-						this->peer_id, this->ike_sa->get_other_id(this->ike_sa));
+				peer_sa = charon->mediation_manager->check_and_register(
+									charon->mediation_manager, this->peer_id,
+									this->ike_sa->get_other_id(this->ike_sa));
 			}
 			else
 			{
-				peer_sa = charon->mediation_manager->check(charon->mediation_manager,
-						this->peer_id);
+				peer_sa = charon->mediation_manager->check(
+									charon->mediation_manager, this->peer_id);
 			}
-			
+
 			if (!peer_sa)
 			{
 				/* the peer is not online */
-				message->add_notify(message, TRUE, ME_CONNECT_FAILED, chunk_empty);
+				message->add_notify(message, TRUE, ME_CONNECT_FAILED,
+									chunk_empty);
 				break;
 			}
-			
+
 			job_t *job = (job_t*)mediation_job_create(this->peer_id,
 					this->ike_sa->get_other_id(this->ike_sa), this->connect_id,
 					this->connect_key, this->remote_endpoints, this->response);
 			charon->processor->queue_job(charon->processor, job);
-			
 			break;
 		}
 		default:
@@ -706,8 +721,8 @@ static void me_connect(private_ike_me_t *this, identification_t *peer_id)
 /**
  * Implementation of ike_me.respond
  */
-static void me_respond(private_ike_me_t *this, identification_t *peer_id, 
-		chunk_t connect_id)
+static void me_respond(private_ike_me_t *this, identification_t *peer_id,
+					   chunk_t connect_id)
 {
 	this->peer_id = peer_id->clone(peer_id);
 	this->connect_id = chunk_clone(connect_id);
@@ -726,16 +741,19 @@ static void me_callback(private_ike_me_t *this, identification_t *peer_id)
 /**
  * Implementation of ike_me.relay
  */
-static void relay(private_ike_me_t *this, identification_t *requester, chunk_t connect_id,
-		chunk_t connect_key, linked_list_t *endpoints, bool response)
+static void relay(private_ike_me_t *this, identification_t *requester,
+				  chunk_t connect_id, chunk_t connect_key,
+				  linked_list_t *endpoints, bool response)
 {
 	this->peer_id = requester->clone(requester);
 	this->connect_id = chunk_clone(connect_id);
 	this->connect_key = chunk_clone(connect_key);
-	
-	this->remote_endpoints->destroy_offset(this->remote_endpoints, offsetof(endpoint_notify_t, destroy));
-	this->remote_endpoints = endpoints->clone_offset(endpoints, offsetof(endpoint_notify_t, clone));
-	
+
+	this->remote_endpoints->destroy_offset(this->remote_endpoints,
+										offsetof(endpoint_notify_t, destroy));
+	this->remote_endpoints = endpoints->clone_offset(endpoints,
+										offsetof(endpoint_notify_t, clone));
+
 	this->response = response;
 }
 
@@ -761,13 +779,15 @@ static void migrate(private_ike_me_t *this, ike_sa_t *ike_sa)
 static void destroy(private_ike_me_t *this)
 {
 	DESTROY_IF(this->peer_id);
-	
+
 	chunk_free(&this->connect_id);
 	chunk_free(&this->connect_key);
-	
-	this->local_endpoints->destroy_offset(this->local_endpoints, offsetof(endpoint_notify_t, destroy));
-	this->remote_endpoints->destroy_offset(this->remote_endpoints, offsetof(endpoint_notify_t, destroy));
-	
+
+	this->local_endpoints->destroy_offset(this->local_endpoints,
+										offsetof(endpoint_notify_t, destroy));
+	this->remote_endpoints->destroy_offset(this->remote_endpoints,
+										offsetof(endpoint_notify_t, destroy));
+
 	DESTROY_IF(this->mediated_cfg);
 	free(this);
 }
@@ -782,7 +802,7 @@ ike_me_t *ike_me_create(ike_sa_t *ike_sa, bool initiator)
 	this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
 	this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
 	this->public.task.destroy = (void(*)(task_t*))destroy;
-	
+
 	if (ike_sa->has_condition(ike_sa, COND_ORIGINAL_INITIATOR))
 	{
 		if (initiator)
@@ -810,15 +830,15 @@ ike_me_t *ike_me_create(ike_sa_t *ike_sa, bool initiator)
 			this->public.task.process = (status_t(*)(task_t*,message_t*))process_r_ms;
 		}
 	}
-	
+
 	this->public.connect = (void(*)(ike_me_t*,identification_t*))me_connect;
 	this->public.respond = (void(*)(ike_me_t*,identification_t*,chunk_t))me_respond;
 	this->public.callback = (void(*)(ike_me_t*,identification_t*))me_callback;
 	this->public.relay = (void(*)(ike_me_t*,identification_t*,chunk_t,chunk_t,linked_list_t*,bool))relay;
-	
+
 	this->ike_sa = ike_sa;
 	this->initiator = initiator;
-	
+
 	this->peer_id = NULL;
 	this->connect_id = chunk_empty;
 	this->connect_key = chunk_empty;
@@ -829,8 +849,8 @@ ike_me_t *ike_me_create(ike_sa_t *ike_sa, bool initiator)
 	this->callback = FALSE;
 	this->failed = FALSE;
 	this->invalid_syntax = FALSE;
-	
+
 	this->mediated_cfg = NULL;
-	
+
 	return &this->public;
 }
diff --git a/src/charon/sa/tasks/ike_me.h b/src/charon/sa/tasks/ike_me.h
index 4b35c313c..31285a426 100644
--- a/src/charon/sa/tasks/ike_me.h
+++ b/src/charon/sa/tasks/ike_me.h
@@ -34,18 +34,17 @@ typedef struct ike_me_t ike_me_t;
  * connection, allows to initiate mediated connections using ME_CONNECT
  * exchanges and to request reflexive addresses from the mediation server using
  * ME_ENDPOINT notifies.
- * 
+ *
  * @note This task has to be activated before the IKE_AUTH task, because that
  * task generates the IKE_SA_INIT message so that no more payloads can be added
  * to it afterwards.
  */
 struct ike_me_t {
-
 	/**
 	 * Implements the task_t interface
 	 */
 	task_t task;
-	
+
 	/**
 	 * Initiates a connection with another peer (i.e. sends a ME_CONNECT
 	 * to the mediation server)
@@ -53,45 +52,48 @@ struct ike_me_t {
 	 * @param peer_id			ID of the other peer (gets cloned)
 	 */
 	void (*connect)(ike_me_t *this, identification_t *peer_id);
-	
+
 	/**
 	 * Responds to a ME_CONNECT from another peer (i.e. sends a ME_CONNECT
 	 * to the mediation server)
-	 * 
-	 * @param peer_id			ID of the other peer (gets cloned)
-	 * @param connect_id		the connect ID as provided by the initiator (gets cloned)
+	 *
+	 * Data gets cloned.
+	 *
+	 * @param peer_id			ID of the other peer
+	 * @param connect_id		the connect ID as provided by the initiator
 	 */
-	void (*respond)(ike_me_t *this, identification_t *peer_id, chunk_t connect_id);
-	
+	void (*respond)(ike_me_t *this, identification_t *peer_id,
+					chunk_t connect_id);
+
 	/**
-	 * Sends a ME_CALLBACK to a peer that previously requested another peer.
-	 * 
+	 * Sends a ME_CALLBACK to a peer that previously requested some other peer.
+	 *
 	 * @param peer_id			ID of the other peer (gets cloned)
 	 */
 	void (*callback)(ike_me_t *this, identification_t *peer_id);
-	
+
 	/**
 	 * Relays data to another peer (i.e. sends a ME_CONNECT to the peer)
-	 * 
+	 *
 	 * Data gets cloned.
-	 * 
+	 *
 	 * @param requester			ID of the requesting peer
 	 * @param connect_id		content of the ME_CONNECTID notify
 	 * @param connect_key		content of the ME_CONNECTKEY notify
 	 * @param endpoints			endpoints
 	 * @param response			TRUE if this is a response
 	 */
-	void (*relay)(ike_me_t *this, identification_t *requester, chunk_t connect_id,
-			chunk_t connect_key, linked_list_t *endpoints, bool response);
-
+	void (*relay)(ike_me_t *this, identification_t *requester,
+				  chunk_t connect_id, chunk_t connect_key,
+				  linked_list_t *endpoints, bool response);
 };
 
 /**
  * Create a new ike_me task.
  *
  * @param ike_sa		IKE_SA this task works for
- * @param initiator		TRUE if taks is initiated by us
- * @return			  	ike_me task to handle by the task_manager
+ * @param initiator		TRUE if task is initiated by us
+ * @return				ike_me task to be handled by the task_manager
  */
 ike_me_t *ike_me_create(ike_sa_t *ike_sa, bool initiator);
 
diff --git a/src/charon/sa/tasks/ike_mobike.c b/src/charon/sa/tasks/ike_mobike.c
index 9a1afe744..d76ba8d2b 100644
--- a/src/charon/sa/tasks/ike_mobike.c
+++ b/src/charon/sa/tasks/ike_mobike.c
@@ -30,42 +30,42 @@ typedef struct private_ike_mobike_t private_ike_mobike_t;
  * Private members of a ike_mobike_t task.
  */
 struct private_ike_mobike_t {
-	
+
 	/**
 	 * Public methods and task_t interface.
 	 */
 	ike_mobike_t public;
-	
+
 	/**
 	 * Assigned IKE_SA.
 	 */
 	ike_sa_t *ike_sa;
-	
+
 	/**
 	 * Are we the initiator?
 	 */
 	bool initiator;
-	
+
 	/**
 	 * cookie2 value to verify new addresses
 	 */
 	chunk_t cookie2;
-	
+
 	/**
 	 * NAT discovery reusing the IKE_NATD task
 	 */
 	ike_natd_t *natd;
-	
+
 	/**
 	 * use task to update addresses
 	 */
 	bool update;
-	
+
 	/**
 	 * do routability check
 	 */
 	bool check;
-	
+
 	/**
 	 * include address list update
 	 */
@@ -79,7 +79,7 @@ static void flush_additional_addresses(private_ike_mobike_t *this)
 {
 	iterator_t *iterator;
 	host_t *host;
-	
+
 	iterator = this->ike_sa->create_additional_address_iterator(this->ike_sa);
 	while (iterator->iterate(iterator, (void**)&host))
 	{
@@ -98,7 +98,7 @@ static void process_payloads(private_ike_mobike_t *this, message_t *message)
 	enumerator_t *enumerator;
 	payload_t *payload;
 	bool first = TRUE;
-	
+
 	enumerator = message->create_payload_enumerator(message);
 	while (enumerator->enumerate(enumerator, &payload))
 	{
@@ -106,7 +106,7 @@ static void process_payloads(private_ike_mobike_t *this, message_t *message)
 		notify_payload_t *notify;
 		chunk_t data;
 		host_t *host;
-		
+
 		if (payload->get_type(payload) != NOTIFY)
 		{
 			continue;
@@ -117,9 +117,9 @@ static void process_payloads(private_ike_mobike_t *this, message_t *message)
 			case MOBIKE_SUPPORTED:
 			{
 				peer_cfg_t *peer_cfg;
-				
+
 				peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
-				if (!this->initiator && 
+				if (!this->initiator &&
 					peer_cfg && !peer_cfg->use_mobike(peer_cfg))
 				{
 					DBG1(DBG_IKE, "peer supports MOBIKE, but disabled in config");
@@ -191,7 +191,7 @@ static void build_address_list(private_ike_mobike_t *this, message_t *message)
 	host_t *host, *me;
 	notify_type_t type;
 	int added = 0;
-	
+
 	me = this->ike_sa->get_my_host(this->ike_sa);
 	enumerator = charon->kernel_interface->create_address_enumerator(
 										charon->kernel_interface, FALSE, FALSE);
@@ -227,7 +227,7 @@ static void build_address_list(private_ike_mobike_t *this, message_t *message)
 }
 
 /**
- * build a cookie and add it to the message 
+ * build a cookie and add it to the message
  */
 static void build_cookie(private_ike_mobike_t *this, message_t *message)
 {
@@ -250,12 +250,12 @@ static void update_children(private_ike_mobike_t *this)
 {
 	iterator_t *iterator;
 	child_sa_t *child_sa;
-	
+
 	iterator = this->ike_sa->create_child_sa_iterator(this->ike_sa);
 	while (iterator->iterate(iterator, (void**)&child_sa))
 	{
 		if (child_sa->update(child_sa,
-				this->ike_sa->get_my_host(this->ike_sa), 
+				this->ike_sa->get_my_host(this->ike_sa),
 				this->ike_sa->get_other_host(this->ike_sa),
 				this->ike_sa->get_virtual_ip(this->ike_sa, TRUE),
 				this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY)) == NOT_SUPPORTED)
@@ -276,7 +276,7 @@ static void transmit(private_ike_mobike_t *this, packet_t *packet)
 	host_t *me, *other, *me_old, *other_old;
 	iterator_t *iterator;
 	packet_t *copy;
-	
+
 	if (!this->check)
 	{
 		return;
@@ -284,16 +284,19 @@ static void transmit(private_ike_mobike_t *this, packet_t *packet)
 
 	me_old = this->ike_sa->get_my_host(this->ike_sa);
 	other_old = this->ike_sa->get_other_host(this->ike_sa);
-	
+
 	me = charon->kernel_interface->get_source_addr(
 									charon->kernel_interface, other_old, NULL);
 	if (me)
 	{
 		me->set_port(me, me->ip_equals(me, me_old) ?
 					 me_old->get_port(me_old) : IKEV2_NATT_PORT);
-		packet->set_source(packet, me);
+		DBG1(DBG_IKE, "checking original path %#H - %#H", me, other_old);
+		copy = packet->clone(packet);
+		copy->set_source(copy, me);
+		charon->sender->send(charon->sender, copy);
 	}
-	
+
 	iterator = this->ike_sa->create_additional_address_iterator(this->ike_sa);
 	while (iterator->iterate(iterator, (void**)&other))
 	{
@@ -320,9 +323,6 @@ static void transmit(private_ike_mobike_t *this, packet_t *packet)
 		}
 	}
 	iterator->destroy(iterator);
-	me = packet->get_source(packet);
-	other = packet->get_destination(packet);
-	DBG1(DBG_IKE, "checking path %#H - %#H", me, other);
 }
 
 /**
@@ -338,8 +338,8 @@ static status_t build_i(private_ike_mobike_t *this, message_t *message)
 	else if (message->get_exchange_type(message) == INFORMATIONAL)
 	{
 		host_t *old, *new;
-		
-		/* we check if the existing address is still valid */ 
+
+		/* we check if the existing address is still valid */
 		old = message->get_source(message);
 		new = charon->kernel_interface->get_source_addr(charon->kernel_interface,
 										message->get_destination(message), old);
@@ -388,13 +388,13 @@ static status_t process_r(private_ike_mobike_t *this, message_t *message)
 		if (this->update)
 		{
 			host_t *me, *other;
-			
+
 			me = message->get_destination(message);
 			other = message->get_source(message);
 			this->ike_sa->set_my_host(this->ike_sa, me->clone(me));
 			this->ike_sa->set_other_host(this->ike_sa, other->clone(other));
 		}
-		
+
 		if (this->natd)
 		{
 			this->natd->task.process(&this->natd->task, message);
@@ -461,7 +461,7 @@ static status_t process_i(private_ike_mobike_t *this, message_t *message)
 		if (this->cookie2.ptr)
 		{	/* check cookie if we included one */
 			chunk_t cookie2;
-			
+
 			cookie2 = this->cookie2;
 			this->cookie2 = chunk_empty;
 			process_payloads(this, message);
@@ -496,17 +496,17 @@ static status_t process_i(private_ike_mobike_t *this, message_t *message)
 		if (this->check)
 		{
 			host_t *me_new, *me_old, *other_new, *other_old;
-			
+
 			me_new = message->get_destination(message);
 			other_new = message->get_source(message);
 			me_old = this->ike_sa->get_my_host(this->ike_sa);
 			other_old = this->ike_sa->get_other_host(this->ike_sa);
-			
+
 			if (!me_new->equals(me_new, me_old))
 			{
 				this->update = TRUE;
 				this->ike_sa->set_my_host(this->ike_sa, me_new->clone(me_new));
-			}			
+			}
 			if (!other_new->equals(other_new, other_old))
 			{
 				this->update = TRUE;
@@ -538,7 +538,7 @@ static void roam(private_ike_mobike_t *this, bool address)
 {
 	this->check = TRUE;
 	this->address = address;
-	this->ike_sa->set_pending_updates(this->ike_sa, 
+	this->ike_sa->set_pending_updates(this->ike_sa,
 							this->ike_sa->get_pending_updates(this->ike_sa) + 1);
 }
 
@@ -552,7 +552,7 @@ static void dpd(private_ike_mobike_t *this)
 		this->natd = ike_natd_create(this->ike_sa, this->initiator);
 	}
 	this->address = FALSE;
-	this->ike_sa->set_pending_updates(this->ike_sa, 
+	this->ike_sa->set_pending_updates(this->ike_sa,
 							this->ike_sa->get_pending_updates(this->ike_sa) + 1);
 }
 
@@ -612,7 +612,7 @@ ike_mobike_t *ike_mobike_create(ike_sa_t *ike_sa, bool initiator)
 	this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
 	this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
 	this->public.task.destroy = (void(*)(task_t*))destroy;
-	
+
 	if (initiator)
 	{
 		this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
@@ -623,7 +623,7 @@ ike_mobike_t *ike_mobike_create(ike_sa_t *ike_sa, bool initiator)
 		this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
 		this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
 	}
-	
+
 	this->ike_sa = ike_sa;
 	this->initiator = initiator;
 	this->update = FALSE;
@@ -631,7 +631,7 @@ ike_mobike_t *ike_mobike_create(ike_sa_t *ike_sa, bool initiator)
 	this->address = TRUE;
 	this->cookie2 = chunk_empty;
 	this->natd = NULL;
-	
+
 	return &this->public;
 }
 
diff --git a/src/charon/sa/tasks/ike_mobike.h b/src/charon/sa/tasks/ike_mobike.h
index 919b5ddd3..05b2224d1 100644
--- a/src/charon/sa/tasks/ike_mobike.h
+++ b/src/charon/sa/tasks/ike_mobike.h
@@ -35,7 +35,7 @@ typedef struct ike_mobike_t ike_mobike_t;
  * and IPsec tunnel addresses.
  * This tasks handles the MOBIKE_SUPPORTED notify exchange to detect MOBIKE
  * support, allows the exchange of ADDITIONAL_*_ADDRESS to exchange additional
- * endpoints and handles the UPDATE_SA_ADDRESS notify to finally update 
+ * endpoints and handles the UPDATE_SA_ADDRESS notify to finally update
  * endpoints.
  */
 struct ike_mobike_t {
@@ -44,36 +44,36 @@ struct ike_mobike_t {
 	 * Implements the task_t interface
 	 */
 	task_t task;
-	
+
 	/**
 	 * Use the task to roam to other addresses.
 	 *
 	 * @param address		TRUE to include address list update
 	 */
 	void (*roam)(ike_mobike_t *this, bool address);
-	
+
 	/**
 	 * Use the task for a DPD check which detects changes in NAT mappings.
 	 */
 	void (*dpd)(ike_mobike_t *this);
-	
+
 	/**
 	 * Transmision hook, called by task manager.
 	 *
-	 * The task manager calls this hook whenever it transmits a packet. It 
+	 * The task manager calls this hook whenever it transmits a packet. It
 	 * allows the mobike task to send the packet on multiple paths to do path
 	 * probing.
 	 *
 	 * @param packet		the packet to transmit
 	 */
 	void (*transmit)(ike_mobike_t *this, packet_t *packet);
-	
+
 	/**
 	 * Check if this task is probing for routability.
 	 *
 	 * @return				TRUE if task is probing
 	 */
-	bool (*is_probing)(ike_mobike_t *this);	
+	bool (*is_probing)(ike_mobike_t *this);
 };
 
 /**
@@ -81,7 +81,7 @@ struct ike_mobike_t {
  *
  * @param ike_sa		IKE_SA this task works for
  * @param initiator		TRUE if taks is initiated by us
- * @return			  	ike_mobike task to handle by the task_manager
+ * @return				ike_mobike task to handle by the task_manager
  */
 ike_mobike_t *ike_mobike_create(ike_sa_t *ike_sa, bool initiator);
 
diff --git a/src/charon/sa/tasks/ike_natd.c b/src/charon/sa/tasks/ike_natd.c
index bb18e7bda..9121fe2ea 100644
--- a/src/charon/sa/tasks/ike_natd.c
+++ b/src/charon/sa/tasks/ike_natd.c
@@ -30,47 +30,47 @@ typedef struct private_ike_natd_t private_ike_natd_t;
  * Private members of a ike_natd_t task.
  */
 struct private_ike_natd_t {
-	
+
 	/**
 	 * Public methods and task_t interface.
 	 */
 	ike_natd_t public;
-	
+
 	/**
 	 * Assigned IKE_SA.
 	 */
 	ike_sa_t *ike_sa;
-	
+
 	/**
 	 * Are we the initiator?
 	 */
 	bool initiator;
-	
+
 	/**
 	 * Hasher used to build NAT detection hashes
 	 */
 	hasher_t *hasher;
-	
+
 	/**
 	 * Did we process any NAT detection notifys for a source address?
 	 */
 	bool src_seen;
-	
+
 	/**
 	 * Did we process any NAT detection notifys for a destination address?
 	 */
 	bool dst_seen;
-	
+
 	/**
 	 * Have we found a matching source address NAT hash?
 	 */
 	bool src_matched;
-	
+
 	/**
 	 * Have we found a matching destination address NAT hash?
 	 */
 	bool dst_matched;
-	
+
 	/**
 	 * whether NAT mappings for our NATed address has changed
 	 */
@@ -88,7 +88,7 @@ static chunk_t generate_natd_hash(private_ike_natd_t *this,
 	chunk_t natd_hash;
 	u_int64_t spi_i, spi_r;
 	u_int16_t port;
-	
+
 	/* prepare all required chunks */
 	spi_i = ike_sa_id->get_initiator_spi(ike_sa_id);
 	spi_r = ike_sa_id->get_responder_spi(ike_sa_id);
@@ -100,13 +100,13 @@ static chunk_t generate_natd_hash(private_ike_natd_t *this,
 	port_chunk.ptr = (void*)&port;
 	port_chunk.len = sizeof(port);
 	addr_chunk = host->get_address(host);
-		
+
 	/*  natd_hash = SHA1( spi_i | spi_r | address | port ) */
 	natd_chunk = chunk_cat("cccc", spi_i_chunk, spi_r_chunk, addr_chunk, port_chunk);
 	this->hasher->allocate_hash(this->hasher, natd_chunk, &natd_hash);
 	DBG3(DBG_IKE, "natd_chunk %B", &natd_chunk);
 	DBG3(DBG_IKE, "natd_hash %B", &natd_hash);
-	
+
 	chunk_free(&natd_chunk);
 	return natd_hash;
 }
@@ -118,7 +118,7 @@ static chunk_t generate_natd_hash_faked(private_ike_natd_t *this)
 {
 	rng_t *rng;
 	chunk_t chunk;
-	
+
 	rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
 	if (!rng)
 	{
@@ -137,10 +137,10 @@ static notify_payload_t *build_natd_payload(private_ike_natd_t *this,
 											notify_type_t type, host_t *host)
 {
 	chunk_t hash;
-	notify_payload_t *notify;	
+	notify_payload_t *notify;
 	ike_sa_id_t *ike_sa_id;
 	ike_cfg_t *config;
-	
+
 	ike_sa_id = this->ike_sa->get_id(this->ike_sa);
 	config = this->ike_sa->get_ike_cfg(this->ike_sa);
 	if (config->force_encap(config) && type == NAT_DETECTION_SOURCE_IP)
@@ -155,7 +155,7 @@ static notify_payload_t *build_natd_payload(private_ike_natd_t *this,
 	notify->set_notify_type(notify, type);
 	notify->set_notification_data(notify, hash);
 	chunk_free(&hash);
-	
+
 	return notify;
 }
 
@@ -171,17 +171,17 @@ static void process_payloads(private_ike_natd_t *this, message_t *message)
 	ike_sa_id_t *ike_sa_id;
 	host_t *me, *other;
 	ike_cfg_t *config;
-	
+
 	/* Precompute NAT-D hashes for incoming NAT notify comparison */
 	ike_sa_id = message->get_ike_sa_id(message);
 	me = message->get_destination(message);
 	other = message->get_source(message);
 	dst_hash = generate_natd_hash(this, ike_sa_id, me);
 	src_hash = generate_natd_hash(this, ike_sa_id, other);
-	
+
 	DBG3(DBG_IKE, "precalculated src_hash %B", &src_hash);
 	DBG3(DBG_IKE, "precalculated dst_hash %B", &dst_hash);
-	
+
 	enumerator = message->create_payload_enumerator(message);
 	while (enumerator->enumerate(enumerator, &payload))
 	{
@@ -234,10 +234,10 @@ static void process_payloads(private_ike_natd_t *this, message_t *message)
 		}
 	}
 	enumerator->destroy(enumerator);
-	
+
 	chunk_free(&src_hash);
 	chunk_free(&dst_hash);
-	
+
 	if (this->src_seen && this->dst_seen)
 	{
 		this->ike_sa->enable_extension(this->ike_sa, EXT_NATT);
@@ -245,12 +245,12 @@ static void process_payloads(private_ike_natd_t *this, message_t *message)
 		this->ike_sa->set_condition(this->ike_sa, COND_NAT_HERE,
 									!this->dst_matched);
 		this->ike_sa->set_condition(this->ike_sa, COND_NAT_THERE,
-									!this->src_matched);	
+									!this->src_matched);
 		config = this->ike_sa->get_ike_cfg(this->ike_sa);
 		if (this->dst_matched && this->src_matched &&
 			config->force_encap(config))
 		{
-			this->ike_sa->set_condition(this->ike_sa, COND_NAT_FAKE, TRUE);	
+			this->ike_sa->set_condition(this->ike_sa, COND_NAT_FAKE, TRUE);
 		}
 	}
 }
@@ -261,7 +261,7 @@ static void process_payloads(private_ike_natd_t *this, message_t *message)
 static status_t process_i(private_ike_natd_t *this, message_t *message)
 {
 	process_payloads(this, message);
-	
+
 	if (message->get_exchange_type(message) == IKE_SA_INIT)
 	{
 		peer_cfg_t *peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
@@ -275,10 +275,10 @@ static status_t process_i(private_ike_natd_t *this, message_t *message)
 			return SUCCESS;
 		}
 #endif /* ME */
-		
+
 		if (this->ike_sa->has_condition(this->ike_sa, COND_NAT_ANY) ||
 #ifdef ME
-			/* if we are on a mediation connection we swith to port 4500 even
+			/* if we are on a mediation connection we switch to port 4500 even
 			 * if no NAT is detected. */
 			peer_cfg->is_mediation(peer_cfg) ||
 #endif /* ME */
@@ -288,7 +288,7 @@ static status_t process_i(private_ike_natd_t *this, message_t *message)
 			 this->ike_sa->supports_extension(this->ike_sa, EXT_NATT)))
 		{
 			host_t *me, *other;
-		
+
 			/* do not switch if we have a custom port from mobike/NAT */
 			me = this->ike_sa->get_my_host(this->ike_sa);
 			if (me->get_port(me) == IKEV2_UDP_PORT)
@@ -302,7 +302,7 @@ static status_t process_i(private_ike_natd_t *this, message_t *message)
 			}
 		}
 	}
-	
+
 	return SUCCESS;
 }
 
@@ -314,18 +314,18 @@ static status_t build_i(private_ike_natd_t *this, message_t *message)
 	notify_payload_t *notify;
 	enumerator_t *enumerator;
 	host_t *host;
-	
+
 	if (this->hasher == NULL)
 	{
 		DBG1(DBG_IKE, "unable to build NATD payloads, SHA1 not supported");
 		return NEED_MORE;
 	}
-	
+
 	/* destination is always set */
 	host = message->get_destination(message);
 	notify = build_natd_payload(this, NAT_DETECTION_DESTINATION_IP, host);
 	message->add_payload(message, (payload_t*)notify);
-	
+
 	/* source may be any, we have 3 possibilities to get our source address:
 	 * 1. It is defined in the config => use the one of the IKE_SA
 	 * 2. We do a routing lookup in the kernel interface
@@ -374,7 +374,7 @@ static status_t build_r(private_ike_natd_t *this, message_t *message)
 {
 	notify_payload_t *notify;
 	host_t *me, *other;
-	
+
 	/* only add notifies on successfull responses. */
 	if (message->get_exchange_type(message) == IKE_SA_INIT &&
 		message->get_payload(message, SECURITY_ASSOCIATION) == NULL)
@@ -389,12 +389,12 @@ static status_t build_r(private_ike_natd_t *this, message_t *message)
 			DBG1(DBG_IKE, "unable to build NATD payloads, SHA1 not supported");
 			return SUCCESS;
 		}
-	
+
 		/* initiator seems to support NAT detection, add response */
 		me = message->get_source(message);
 		notify = build_natd_payload(this, NAT_DETECTION_SOURCE_IP, me);
 		message->add_payload(message, (payload_t*)notify);
-		
+
 		other = message->get_destination(message);
 		notify = build_natd_payload(this, NAT_DETECTION_DESTINATION_IP, other);
 		message->add_payload(message, (payload_t*)notify);
@@ -406,9 +406,9 @@ static status_t build_r(private_ike_natd_t *this, message_t *message)
  * Implementation of task_t.process for responder
  */
 static status_t process_r(private_ike_natd_t *this, message_t *message)
-{	
+{
 	process_payloads(this, message);
-	
+
 	return NEED_MORE;
 }
 
@@ -460,7 +460,7 @@ ike_natd_t *ike_natd_create(ike_sa_t *ike_sa, bool initiator)
 	this->public.task.get_type = (task_type_t(*)(task_t*))get_type;
 	this->public.task.migrate = (void(*)(task_t*,ike_sa_t*))migrate;
 	this->public.task.destroy = (void(*)(task_t*))destroy;
-	
+
 	if (initiator)
 	{
 		this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
@@ -471,9 +471,9 @@ ike_natd_t *ike_natd_create(ike_sa_t *ike_sa, bool initiator)
 		this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
 		this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
 	}
-	
+
 	this->public.has_mapping_changed = (bool(*)(ike_natd_t*))has_mapping_changed;
-	
+
 	this->ike_sa = ike_sa;
 	this->initiator = initiator;
 	this->hasher = lib->crypto->create_hasher(lib->crypto, HASH_SHA1);
@@ -482,6 +482,6 @@ ike_natd_t *ike_natd_create(ike_sa_t *ike_sa, bool initiator)
 	this->src_matched = FALSE;
 	this->dst_matched = FALSE;
 	this->mapping_changed = FALSE;
-	
+
 	return &this->public;
 }
diff --git a/src/charon/sa/tasks/ike_natd.h b/src/charon/sa/tasks/ike_natd.h
index 698394842..97b652ead 100644
--- a/src/charon/sa/tasks/ike_natd.h
+++ b/src/charon/sa/tasks/ike_natd.h
@@ -36,7 +36,7 @@ struct ike_natd_t {
 	 * Implements the task_t interface
 	 */
 	task_t task;
-	
+
 	/**
 	 * Check if the NAT mapping has changed for our address.
 	 *
diff --git a/src/charon/sa/tasks/ike_reauth.c b/src/charon/sa/tasks/ike_reauth.c
index 80f1b7b8c..ac89c358b 100644
--- a/src/charon/sa/tasks/ike_reauth.c
+++ b/src/charon/sa/tasks/ike_reauth.c
@@ -25,17 +25,17 @@ typedef struct private_ike_reauth_t private_ike_reauth_t;
  * Private members of a ike_reauth_t task.
  */
 struct private_ike_reauth_t {
-	
+
 	/**
 	 * Public methods and task_t interface.
 	 */
 	ike_reauth_t public;
-	
+
 	/**
 	 * Assigned IKE_SA.
 	 */
 	ike_sa_t *ike_sa;
-	
+
 	/**
 	 * reused ike_delete task
 	 */
@@ -60,17 +60,17 @@ static status_t process_i(private_ike_reauth_t *this, message_t *message)
 	iterator_t *iterator;
 	child_sa_t *child_sa;
 	peer_cfg_t *peer_cfg;
-	
+
 	/* process delete response first */
 	this->ike_delete->task.process(&this->ike_delete->task, message);
 
 	peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
-	
+
 	/* reauthenticate only if we have children */
 	iterator = this->ike_sa->create_child_sa_iterator(this->ike_sa);
 	if (iterator->get_count(iterator) == 0
 #ifdef ME
-		/* we allow a peer to reauth a mediation connection (without CHILD_SA) */
+		/* we allow peers to reauth mediation connections (without children) */
 		&& !peer_cfg->is_mediation(peer_cfg)
 #endif /* ME */
 		)
@@ -79,9 +79,9 @@ static status_t process_i(private_ike_reauth_t *this, message_t *message)
 		iterator->destroy(iterator);
 		return FAILED;
 	}
-	
+
 	new = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager, TRUE);
-	
+
 	new->set_peer_cfg(new, peer_cfg);
 	host = this->ike_sa->get_other_host(this->ike_sa);
 	new->set_other_host(new, host->clone(host));
@@ -93,7 +93,7 @@ static status_t process_i(private_ike_reauth_t *this, message_t *message)
 	{
 		new->set_virtual_ip(new, TRUE, host);
 	}
-	
+
 #ifdef ME
 	/* we initiate the new IKE_SA of the mediation connection without CHILD_SA */
 	if (peer_cfg->is_mediation(peer_cfg))
@@ -109,7 +109,7 @@ static status_t process_i(private_ike_reauth_t *this, message_t *message)
 		}
 	}
 #endif /* ME */
-	
+
 	while (iterator->iterate(iterator, (void**)&child_sa))
 	{
 		switch (child_sa->get_state(child_sa))
@@ -144,7 +144,7 @@ static status_t process_i(private_ike_reauth_t *this, message_t *message)
 	charon->ike_sa_manager->checkin(charon->ike_sa_manager, new);
 	/* set threads active IKE_SA after checkin */
 	charon->bus->set_sa(charon->bus, this->ike_sa);
-	
+
 	/* we always return failed to delete the obsolete IKE_SA */
 	return FAILED;
 }
@@ -187,10 +187,10 @@ ike_reauth_t *ike_reauth_create(ike_sa_t *ike_sa)
 	this->public.task.destroy = (void(*)(task_t*))destroy;
 	this->public.task.build = (status_t(*)(task_t*,message_t*))build_i;
 	this->public.task.process = (status_t(*)(task_t*,message_t*))process_i;
-	
+
 	this->ike_sa = ike_sa;
 	this->ike_delete = ike_delete_create(ike_sa, TRUE);
-	
+
 	return &this->public;
 }
 
diff --git a/src/charon/sa/tasks/ike_rekey.c b/src/charon/sa/tasks/ike_rekey.c
index 3a049b566..a2275e796 100644
--- a/src/charon/sa/tasks/ike_rekey.c
+++ b/src/charon/sa/tasks/ike_rekey.c
@@ -30,37 +30,37 @@ typedef struct private_ike_rekey_t private_ike_rekey_t;
  * Private members of a ike_rekey_t task.
  */
 struct private_ike_rekey_t {
-	
+
 	/**
 	 * Public methods and task_t interface.
 	 */
 	ike_rekey_t public;
-	
+
 	/**
 	 * Assigned IKE_SA.
 	 */
 	ike_sa_t *ike_sa;
-	
+
 	/**
 	 * New IKE_SA which replaces the current one
 	 */
 	ike_sa_t *new_sa;
-	
+
 	/**
 	 * Are we the initiator?
 	 */
 	bool initiator;
-	
+
 	/**
 	 * the IKE_INIT task which is reused to simplify rekeying
 	 */
 	ike_init_t *ike_init;
-	
+
 	/**
 	 * IKE_DELETE task to delete the old IKE_SA after rekeying was successful
 	 */
 	ike_delete_t *ike_delete;
-	
+
 	/**
 	 * colliding task detected by the task manager
 	 */
@@ -74,7 +74,7 @@ static status_t build_i_delete(private_ike_rekey_t *this, message_t *message)
 {
 	/* update exchange type to INFORMATIONAL for the delete */
 	message->set_exchange_type(message, INFORMATIONAL);
-	
+
 	return this->ike_delete->task.build(&this->ike_delete->task, message);
 }
 
@@ -93,13 +93,13 @@ static status_t build_i(private_ike_rekey_t *this, message_t *message)
 {
 	peer_cfg_t *peer_cfg;
 	host_t *other_host;
-	
+
 	/* create new SA only on first try */
 	if (this->new_sa == NULL)
 	{
 		this->new_sa = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
 															TRUE);
-		
+
 		peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
 		other_host = this->ike_sa->get_other_host(this->ike_sa);
 		this->new_sa->set_peer_cfg(this->new_sa, peer_cfg);
@@ -120,7 +120,7 @@ static status_t process_r(private_ike_rekey_t *this, message_t *message)
 	peer_cfg_t *peer_cfg;
 	iterator_t *iterator;
 	child_sa_t *child_sa;
-	
+
 	if (this->ike_sa->get_state(this->ike_sa) == IKE_DELETING)
 	{
 		DBG1(DBG_IKE, "peer initiated rekeying, but we are deleting");
@@ -144,15 +144,15 @@ static status_t process_r(private_ike_rekey_t *this, message_t *message)
 		}
 	}
 	iterator->destroy(iterator);
-	
+
 	this->new_sa = charon->ike_sa_manager->checkout_new(charon->ike_sa_manager,
 														FALSE);
-	
+
 	peer_cfg = this->ike_sa->get_peer_cfg(this->ike_sa);
 	this->new_sa->set_peer_cfg(this->new_sa, peer_cfg);
 	this->ike_init = ike_init_create(this->new_sa, FALSE, this->ike_sa);
 	this->ike_init->task.process(&this->ike_init->task, message);
-	
+
 	return NEED_MORE;
 }
 
@@ -167,12 +167,12 @@ static status_t build_r(private_ike_rekey_t *this, message_t *message)
 		message->add_notify(message, TRUE, NO_PROPOSAL_CHOSEN, chunk_empty);
 		return SUCCESS;
 	}
-	
+
 	if (this->ike_init->task.build(&this->ike_init->task, message) == FAILED)
 	{
 		return SUCCESS;
 	}
-	
+
 	this->ike_sa->set_state(this->ike_sa, IKE_REKEYING);
 	this->new_sa->set_state(this->new_sa, IKE_ESTABLISHED);
 	DBG0(DBG_IKE, "IKE_SA %s[%d] established between %H[%Y]...%H[%Y]",
@@ -182,7 +182,7 @@ static status_t build_r(private_ike_rekey_t *this, message_t *message)
 		 this->ike_sa->get_my_id(this->ike_sa),
 		 this->ike_sa->get_other_host(this->ike_sa),
 		 this->ike_sa->get_other_id(this->ike_sa));
-	
+
 	return SUCCESS;
 }
 
@@ -191,32 +191,17 @@ static status_t build_r(private_ike_rekey_t *this, message_t *message)
  */
 static status_t process_i(private_ike_rekey_t *this, message_t *message)
 {
-	enumerator_t *enumerator;
-	payload_t *payload;
-	
-	/* handle NO_ADDITIONAL_SAS notify */
-	enumerator = message->create_payload_enumerator(message);
-	while (enumerator->enumerate(enumerator, &payload))
+	if (message->get_notify(message, NO_ADDITIONAL_SAS))
 	{
-		if (payload->get_type(payload) == NOTIFY)
-		{
-			notify_payload_t *notify = (notify_payload_t*)payload;
-			
-			if (notify->get_notify_type(notify) == NO_ADDITIONAL_SAS)
-			{
-				DBG1(DBG_IKE, "peer seems to not support IKE rekeying, "
-					 "starting reauthentication");
-				this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
-				charon->processor->queue_job(charon->processor,
-						(job_t*)rekey_ike_sa_job_create(
-									this->ike_sa->get_id(this->ike_sa), TRUE));
-				enumerator->destroy(enumerator);
-				return SUCCESS;
-			}
-		}
+		DBG1(DBG_IKE, "peer seems to not support IKE rekeying, "
+			 "starting reauthentication");
+		this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
+		charon->processor->queue_job(charon->processor,
+				(job_t*)rekey_ike_sa_job_create(
+							this->ike_sa->get_id(this->ike_sa), TRUE));
+		return SUCCESS;
 	}
-	enumerator->destroy(enumerator);
-	
+
 	switch (this->ike_init->task.process(&this->ike_init->task, message))
 	{
 		case FAILED:
@@ -230,7 +215,7 @@ static status_t process_i(private_ike_rekey_t *this, message_t *message)
 				job = (job_t*)rekey_ike_sa_job_create(
 										this->ike_sa->get_id(this->ike_sa), FALSE);
 				DBG1(DBG_IKE, "IKE_SA rekeying failed, "
-					 					"trying again in %d seconds", retry);
+										"trying again in %d seconds", retry);
 				this->ike_sa->set_state(this->ike_sa, IKE_ESTABLISHED);
 				charon->scheduler->schedule_job(charon->scheduler, job, retry);
 			}
@@ -242,7 +227,7 @@ static status_t process_i(private_ike_rekey_t *this, message_t *message)
 		default:
 			break;
 	}
-	
+
 	this->new_sa->set_state(this->new_sa, IKE_ESTABLISHED);
 	DBG0(DBG_IKE, "IKE_SA %s[%d] established between %H[%Y]...%H[%Y]",
 		 this->new_sa->get_name(this->new_sa),
@@ -251,7 +236,7 @@ static status_t process_i(private_ike_rekey_t *this, message_t *message)
 		 this->ike_sa->get_my_id(this->ike_sa),
 		 this->ike_sa->get_other_host(this->ike_sa),
 		 this->ike_sa->get_other_id(this->ike_sa));
-	
+
 	/* check for collisions */
 	if (this->collision &&
 		this->collision->get_type(this->collision) == IKE_REKEY)
@@ -259,13 +244,13 @@ static status_t process_i(private_ike_rekey_t *this, message_t *message)
 		chunk_t this_nonce, other_nonce;
 		host_t *host;
 		private_ike_rekey_t *other = (private_ike_rekey_t*)this->collision;
-		
+
 		this_nonce = this->ike_init->get_lower_nonce(this->ike_init);
 		other_nonce = other->ike_init->get_lower_nonce(other->ike_init);
-		
+
 		/* if we have the lower nonce, delete rekeyed SA. If not, delete
 		 * the redundant. */
-		if (memcmp(this_nonce.ptr, other_nonce.ptr, 
+		if (memcmp(this_nonce.ptr, other_nonce.ptr,
 				   min(this_nonce.len, other_nonce.len)) < 0)
 		{
 			/* peer should delete this SA. Add a timeout just in case. */
@@ -305,12 +290,12 @@ static status_t process_i(private_ike_rekey_t *this, message_t *message)
 		/* set threads active IKE_SA after checkin */
 		charon->bus->set_sa(charon->bus, this->ike_sa);
 	}
-	
+
 	/* rekeying successful, delete the IKE_SA using a subtask */
 	this->ike_delete = ike_delete_create(this->ike_sa, TRUE);
 	this->public.task.build = (status_t(*)(task_t*,message_t*))build_i_delete;
 	this->public.task.process = (status_t(*)(task_t*,message_t*))process_i_delete;
-	
+
 	return NEED_MORE;
 }
 
@@ -349,7 +334,7 @@ static void migrate(private_ike_rekey_t *this, ike_sa_t *ike_sa)
 		charon->bus->set_sa(charon->bus, this->ike_sa);
 	}
 	DESTROY_IF(this->collision);
-	
+
 	this->collision = NULL;
 	this->ike_sa = ike_sa;
 	this->new_sa = NULL;
@@ -412,13 +397,13 @@ ike_rekey_t *ike_rekey_create(ike_sa_t *ike_sa, bool initiator)
 		this->public.task.build = (status_t(*)(task_t*,message_t*))build_r;
 		this->public.task.process = (status_t(*)(task_t*,message_t*))process_r;
 	}
-	
+
 	this->ike_sa = ike_sa;
 	this->new_sa = NULL;
 	this->ike_init = NULL;
 	this->ike_delete = NULL;
 	this->initiator = initiator;
 	this->collision = NULL;
-	
+
 	return &this->public;
 }
diff --git a/src/charon/sa/tasks/ike_rekey.h b/src/charon/sa/tasks/ike_rekey.h
index 6748279ab..1c9550768 100644
--- a/src/charon/sa/tasks/ike_rekey.h
+++ b/src/charon/sa/tasks/ike_rekey.h
@@ -36,7 +36,7 @@ struct ike_rekey_t {
 	 * Implements the task_t interface
 	 */
 	task_t task;
-	
+
 	/**
 	 * Register a rekeying task which collides with this one.
 	 *
@@ -54,7 +54,7 @@ struct ike_rekey_t {
  *
  * @param ike_sa		IKE_SA this task works for
  * @param initiator		TRUE for initiator, FALSE for responder
- * @return			  	IKE_REKEY task to handle by the task_manager
+ * @return				IKE_REKEY task to handle by the task_manager
  */
 ike_rekey_t *ike_rekey_create(ike_sa_t *ike_sa, bool initiator);
 
diff --git a/src/charon/sa/tasks/ike_vendor.c b/src/charon/sa/tasks/ike_vendor.c
new file mode 100644
index 000000000..7c435b6d1
--- /dev/null
+++ b/src/charon/sa/tasks/ike_vendor.c
@@ -0,0 +1,139 @@
+/*
+ * Copyright (C) 2009 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+#include "ike_vendor.h"
+
+#include <daemon.h>
+#include <encoding/payloads/vendor_id_payload.h>
+
+typedef struct private_ike_vendor_t private_ike_vendor_t;
+
+/**
+ * Private data of an ike_vendor_t object.
+ */
+struct private_ike_vendor_t {
+
+	/**
+	 * Public ike_vendor_t interface.
+	 */
+	ike_vendor_t public;
+
+	/**
+	 * Associated IKE_SA
+	 */
+	ike_sa_t *ike_sa;
+
+	/**
+	 * Are we the inititator of this task
+	 */
+	bool initiator;
+};
+
+/**
+ * strongSwan specific vendor ID without version, MD5("strongSwan")
+ */
+static chunk_t strongswan_vid = chunk_from_chars(
+	0x88,0x2f,0xe5,0x6d,0x6f,0xd2,0x0d,0xbc,
+	0x22,0x51,0x61,0x3b,0x2e,0xbe,0x5b,0xeb
+);
+
+METHOD(task_t, build, status_t,
+	private_ike_vendor_t *this, message_t *message)
+{
+	if (lib->settings->get_bool(lib->settings,
+								"charon.send_vendor_id", FALSE))
+	{
+		vendor_id_payload_t *vid;
+
+		vid = vendor_id_payload_create_data(chunk_clone(strongswan_vid));
+		message->add_payload(message, &vid->payload_interface);
+	}
+
+	return this->initiator ? NEED_MORE : SUCCESS;
+}
+
+METHOD(task_t, process, status_t,
+	private_ike_vendor_t *this, message_t *message)
+{
+	enumerator_t *enumerator;
+	payload_t *payload;
+
+	enumerator = message->create_payload_enumerator(message);
+	while (enumerator->enumerate(enumerator, &payload))
+	{
+		if (payload->get_type(payload) == VENDOR_ID)
+		{
+			vendor_id_payload_t *vid;
+			chunk_t data;
+
+			vid = (vendor_id_payload_t*)payload;
+			data = vid->get_data(vid);
+
+			if (chunk_equals(data, strongswan_vid))
+			{
+				DBG1(DBG_IKE, "received strongSwan vendor id");
+				this->ike_sa->enable_extension(this->ike_sa, EXT_STRONGSWAN);
+			}
+			else
+			{
+				DBG1(DBG_ENC, "received unknown vendor id: %#B", &data);
+			}
+		}
+	}
+	enumerator->destroy(enumerator);
+
+	return this->initiator ? SUCCESS : NEED_MORE;
+}
+
+METHOD(task_t, migrate, void,
+	private_ike_vendor_t *this, ike_sa_t *ike_sa)
+{
+	this->ike_sa = ike_sa;
+}
+
+METHOD(task_t, get_type, task_type_t,
+	private_ike_vendor_t *this)
+{
+	return IKE_VENDOR;
+}
+
+METHOD(task_t, destroy, void,
+	private_ike_vendor_t *this)
+{
+	free(this);
+}
+
+/**
+ * See header
+ */
+ike_vendor_t *ike_vendor_create(ike_sa_t *ike_sa, bool initiator)
+{
+	private_ike_vendor_t *this;
+
+	INIT(this,
+		.public.task = {
+			.build = _build,
+			.process = _process,
+			.migrate = _migrate,
+			.get_type = _get_type,
+			.destroy = _destroy,
+		},
+		.initiator = initiator,
+		.ike_sa = ike_sa,
+	);
+
+	return &this->public;
+}
+
diff --git a/src/charon/sa/tasks/ike_vendor.h b/src/charon/sa/tasks/ike_vendor.h
new file mode 100644
index 000000000..dcdd37424
--- /dev/null
+++ b/src/charon/sa/tasks/ike_vendor.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2009 Martin Willi
+ * Hochschule fuer Technik Rapperswil
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
+ * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * for more details.
+ */
+
+/**
+ * @defgroup ike_vendor ike_vendor
+ * @{ @ingroup tasks
+ */
+
+#ifndef IKE_VENDOR_H_
+#define IKE_VENDOR_H_
+
+typedef struct ike_vendor_t ike_vendor_t;
+
+#include <library.h>
+#include <sa/ike_sa.h>
+#include <sa/tasks/task.h>
+
+/**
+ * Vendor ID processing task.
+ */
+struct ike_vendor_t {
+
+	/**
+	 * Implements task interface.
+	 */
+	task_t task;
+};
+
+/**
+ * Create a ike_vendor instance.
+ *
+ * @param ike_sa		IKE_SA this task works for
+ * @param initiator		TRUE if thask is the original initator
+ */
+ike_vendor_t *ike_vendor_create(ike_sa_t *ike_sa, bool initiator);
+
+#endif /** IKE_VENDOR_H_ @}*/
diff --git a/src/charon/sa/tasks/task.c b/src/charon/sa/tasks/task.c
index 9e35b62a5..0d7383141 100644
--- a/src/charon/sa/tasks/task.c
+++ b/src/charon/sa/tasks/task.c
@@ -30,6 +30,7 @@ ENUM(task_type_names, IKE_INIT, CHILD_REKEY,
 	"IKE_REAUTH",
 	"IKE_DELETE",
 	"IKE_DPD",
+	"IKE_VENDOR",
 	"IKE_ME",
 	"CHILD_CREATE",
 	"CHILD_DELETE",
@@ -49,6 +50,7 @@ ENUM(task_type_names, IKE_INIT, CHILD_REKEY,
 	"IKE_REAUTH",
 	"IKE_DELETE",
 	"IKE_DPD",
+	"IKE_VENDOR",
 	"CHILD_CREATE",
 	"CHILD_DELETE",
 	"CHILD_REKEY",
diff --git a/src/charon/sa/tasks/task.h b/src/charon/sa/tasks/task.h
index 3d2014599..4468f2ebe 100644
--- a/src/charon/sa/tasks/task.h
+++ b/src/charon/sa/tasks/task.h
@@ -57,6 +57,8 @@ enum task_type_t {
 	IKE_DELETE,
 	/** liveness check */
 	IKE_DPD,
+	/** Vendor ID processing */
+	IKE_VENDOR,
 #ifdef ME
 	/** handle ME stuff */
 	IKE_ME,
@@ -79,7 +81,7 @@ extern enum_name_t *task_type_names;
  *
  * A task is an elemantary operation. It may be handled by a single or by
  * multiple exchanges. An exchange may even complete multiple tasks.
- * A task has a build() and an process() operation. The build() operation 
+ * A task has a build() and an process() operation. The build() operation
  * creates payloads and adds it to the message. The process() operation
  * inspects a message and handles its payloads. An initiator of an exchange
  * first calls build() to build the request, and processes the response message
@@ -97,7 +99,7 @@ struct task_t {
 
 	/**
 	 * Build a request or response message for this task.
-	 * 
+	 *
 	 * @param message		message to add payloads to
 	 * @return
 	 *						- FAILED if a critical error occured
@@ -109,7 +111,7 @@ struct task_t {
 
 	/**
 	 * Process a request or response message for this task.
-	 * 
+	 *
 	 * @param message		message to read payloads from
 	 * @return
 	 * 						- FAILED if a critical error occured
@@ -123,7 +125,7 @@ struct task_t {
 	 * Get the type of the task implementation.
 	 */
 	task_type_t (*get_type) (task_t *this);
-	
+
 	/**
 	 * Migrate a task to a new IKE_SA.
 	 *
@@ -138,7 +140,7 @@ struct task_t {
 	 * @param ike_sa		new IKE_SA this task works for
 	 */
 	void (*migrate) (task_t *this, ike_sa_t *ike_sa);
-	
+
 	/**
 	 * Destroys a task_t object.
 	 */