[svn-upgrade] new version strongswan (4.5.0)

10 files changed, 649 insertions, 1034 deletions

diff --git a/src/libcharon/encoding/payloads/delete_payload.c b/src/libcharon/encoding/payloads/delete_payload.c
index 97b4743b2..5fc3b7c88 100644
--- a/src/libcharon/encoding/payloads/delete_payload.c
+++ b/src/libcharon/encoding/payloads/delete_payload.c
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2005-2006 Martin Willi
+ * Copyright (C) 2005-2010 Martin Willi
+ * Copyright (C) 2010 revosec AG
  * Copyright (C) 2005 Jan Hutter
  * Hochschule fuer Technik Rapperswil
  *
@@ -65,11 +66,6 @@ struct private_delete_payload_t {
 	 * The contained SPI's.
 	 */
 	chunk_t spis;
-
-	/**
-	 * List containing u_int32_t spis
-	 */
-	linked_list_t *spi_list;
 };
 
 /**
@@ -77,7 +73,6 @@ struct private_delete_payload_t {
  *
  * The defined offsets are the positions in a object of type
  * private_delete_payload_t.
- *
  */
 encoding_rule_t delete_payload_encodings[] = {
 	/* 1 Byte next payload type, stored in the field next_payload */
@@ -85,20 +80,20 @@ encoding_rule_t delete_payload_encodings[] = {
 	/* the critical bit */
 	{ FLAG,				offsetof(private_delete_payload_t, critical) 		},
 	/* 7 Bit reserved bits, nowhere stored */
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
+	{ RESERVED_BIT,		0 													},
+	{ RESERVED_BIT,		0 													},
+	{ RESERVED_BIT,		0 													},
+	{ RESERVED_BIT,		0 													},
+	{ RESERVED_BIT,		0 													},
+	{ RESERVED_BIT,		0 													},
+	{ RESERVED_BIT,		0 													},
 	/* Length of the whole payload*/
-	{ PAYLOAD_LENGTH,	offsetof(private_delete_payload_t, payload_length)},
+	{ PAYLOAD_LENGTH,	offsetof(private_delete_payload_t, payload_length)	},
 	{ U_INT_8,			offsetof(private_delete_payload_t, protocol_id)		},
 	{ U_INT_8,			offsetof(private_delete_payload_t, spi_size)		},
 	{ U_INT_16,			offsetof(private_delete_payload_t, spi_count)		},
 	/* some delete data bytes, length is defined in PAYLOAD_LENGTH */
-	{ SPIS,			offsetof(private_delete_payload_t, spis) 				}
+	{ SPIS,				offsetof(private_delete_payload_t, spis) 			}
 };
 
 /*
@@ -115,10 +110,8 @@ encoding_rule_t delete_payload_encodings[] = {
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 */
 
-/**
- * Implementation of payload_t.verify.
- */
-static status_t verify(private_delete_payload_t *this)
+METHOD(payload_t, verify, status_t,
+	private_delete_payload_t *this)
 {
 	switch (this->protocol_id)
 	{
@@ -147,112 +140,104 @@ static status_t verify(private_delete_payload_t *this)
 	return SUCCESS;
 }
 
-/**
- * Implementation of delete_payload_t.get_encoding_rules.
- */
-static void get_encoding_rules(private_delete_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
+METHOD(payload_t, get_encoding_rules, void,
+	private_delete_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
 {
 	*rules = delete_payload_encodings;
-	*rule_count = sizeof(delete_payload_encodings) / sizeof(encoding_rule_t);
+	*rule_count = countof(delete_payload_encodings);
 }
 
-/**
- * Implementation of payload_t.get_type.
- */
-static payload_type_t get_payload_type(private_delete_payload_t *this)
+METHOD(payload_t, get_payload_type, payload_type_t,
+	private_delete_payload_t *this)
 {
 	return DELETE;
 }
 
-/**
- * Implementation of payload_t.get_next_type.
- */
-static payload_type_t get_next_type(private_delete_payload_t *this)
+METHOD(payload_t, get_next_type, payload_type_t,
+	private_delete_payload_t *this)
 {
-	return (this->next_payload);
+	return this->next_payload;
 }
 
-/**
- * Implementation of payload_t.set_next_type.
- */
-static void set_next_type(private_delete_payload_t *this,payload_type_t type)
+METHOD(payload_t, set_next_type, void,
+	private_delete_payload_t *this,payload_type_t type)
 {
 	this->next_payload = type;
 }
 
-/**
- * Implementation of payload_t.get_length.
- */
-static size_t get_length(private_delete_payload_t *this)
+METHOD(payload_t, get_length, size_t,
+	private_delete_payload_t *this)
 {
 	return this->payload_length;
 }
 
-/**
- * Implementation of delete_payload_t.get_protocol_id.
- */
-static protocol_id_t get_protocol_id (private_delete_payload_t *this)
+METHOD(delete_payload_t, get_protocol_id, protocol_id_t,
+	private_delete_payload_t *this)
 {
-	return (this->protocol_id);
+	return this->protocol_id;
 }
 
-/**
- * Implementation of delete_payload_t.add_spi.
- */
-static void add_spi(private_delete_payload_t *this, u_int32_t spi)
+METHOD(delete_payload_t, add_spi, void,
+	private_delete_payload_t *this, u_int32_t spi)
 {
-	/* only add SPIs if AH|ESP, ignore others */
-	if (this->protocol_id == PROTO_AH || this->protocol_id == PROTO_ESP)
+	switch (this->protocol_id)
 	{
-		this->spi_count += 1;
-		this->spis.len += this->spi_size;
-		this->spis.ptr = realloc(this->spis.ptr, this->spis.len);
-		*(u_int32_t*)(this->spis.ptr + (this->spis.len / this->spi_size - 1)) = spi;
-		if (this->spi_list)
-		{
-			/* reset SPI iterator list */
-			this->spi_list->destroy(this->spi_list);
-			this->spi_list = NULL;
-		}
+		case PROTO_AH:
+		case PROTO_ESP:
+			this->spi_count++;
+			this->payload_length += sizeof(spi);
+			this->spis = chunk_cat("mc", this->spis, chunk_from_thing(spi));
+			break;
+		default:
+			break;
 	}
 }
 
 /**
- * Implementation of delete_payload_t.create_spi_iterator.
+ * SPI enumerator implementation
  */
-static iterator_t* create_spi_iterator(private_delete_payload_t *this)
-{
-	int i;
+typedef struct {
+	/** implements enumerator_t */
+	enumerator_t public;
+	/** remaining SPIs */
+	chunk_t spis;
+} spi_enumerator_t;
 
-	if (this->spi_list == NULL)
+METHOD(enumerator_t, spis_enumerate, bool,
+	spi_enumerator_t *this, u_int32_t *spi)
+{
+	if (this->spis.len >= sizeof(*spi))
 	{
-		this->spi_list = linked_list_create();
-		/* only parse SPIs if AH|ESP */
-		if (this->protocol_id == PROTO_AH || this->protocol_id == PROTO_ESP)
-		{
-			for (i = 0; i < this->spi_count; i++)
-			{
-				this->spi_list->insert_last(this->spi_list, this->spis.ptr + i *
-															this->spi_size);
-			}
-		}
+		memcpy(spi, this->spis.ptr, sizeof(*spi));
+		this->spis = chunk_skip(this->spis, sizeof(*spi));
+		return TRUE;
 	}
-	return this->spi_list->create_iterator(this->spi_list, TRUE);
+	return FALSE;
 }
 
-/**
- * Implementation of payload_t.destroy and delete_payload_t.destroy.
- */
-static void destroy(private_delete_payload_t *this)
+METHOD(delete_payload_t, create_spi_enumerator, enumerator_t*,
+	private_delete_payload_t *this)
 {
-	if (this->spis.ptr != NULL)
-	{
-		chunk_free(&this->spis);
-	}
-	if (this->spi_list)
+	spi_enumerator_t *e;
+
+	if (this->spi_size != sizeof(u_int32_t))
 	{
-		this->spi_list->destroy(this->spi_list);
+		return enumerator_create_empty();
 	}
+	INIT(e,
+		.public = {
+			.enumerate = (void*)_spis_enumerate,
+			.destroy = (void*)free,
+		},
+		.spis = this->spis,
+	);
+	return &e->public;
+}
+
+METHOD2(payload_t, delete_payload_t, destroy, void,
+	private_delete_payload_t *this)
+{
+	free(this->spis.ptr);
 	free(this);
 }
 
@@ -261,32 +246,28 @@ static void destroy(private_delete_payload_t *this)
  */
 delete_payload_t *delete_payload_create(protocol_id_t protocol_id)
 {
-	private_delete_payload_t *this = malloc_thing(private_delete_payload_t);
-
-	/* interface functions */
-	this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
-	this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
-	this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length;
-	this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type;
-	this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
-	this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_payload_type;
-	this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
-	/* public functions */
-	this->public.destroy = (void (*) (delete_payload_t *)) destroy;
-	this->public.get_protocol_id = (protocol_id_t (*) (delete_payload_t *)) get_protocol_id;
-	this->public.add_spi = (void (*) (delete_payload_t *,u_int32_t))add_spi;
-	this->public.create_spi_iterator = (iterator_t* (*) (delete_payload_t *)) create_spi_iterator;
-
-	/* private variables */
-	this->critical = FALSE;
-	this->next_payload = NO_PAYLOAD;
-	this->payload_length = DELETE_PAYLOAD_HEADER_LENGTH;
-	this->protocol_id = protocol_id;
-	this->spi_size = protocol_id == PROTO_AH || protocol_id == PROTO_ESP ? 4 : 0;
-	this->spi_count = 0;
-	this->spis = chunk_empty;
-	this->spi_list = NULL;
+	private_delete_payload_t *this;
 
-	return (&this->public);
+	INIT(this,
+		.public = {
+			.payload_interface = {
+				.verify = _verify,
+				.get_encoding_rules = _get_encoding_rules,
+				.get_length = _get_length,
+				.get_next_type = _get_next_type,
+				.set_next_type = _set_next_type,
+				.get_type = _get_payload_type,
+				.destroy = _destroy,
+			},
+			.get_protocol_id = _get_protocol_id,
+			.add_spi = _add_spi,
+			.create_spi_enumerator = _create_spi_enumerator,
+			.destroy = _destroy,
+		},
+		.next_payload = NO_PAYLOAD,
+		.payload_length = DELETE_PAYLOAD_HEADER_LENGTH,
+		.protocol_id = protocol_id,
+		.spi_size = protocol_id == PROTO_AH || protocol_id == PROTO_ESP ? 4 : 0,
+	);
+	return &this->public;
 }
diff --git a/src/libcharon/encoding/payloads/delete_payload.h b/src/libcharon/encoding/payloads/delete_payload.h
index 3b62c1af1..026829f97 100644
--- a/src/libcharon/encoding/payloads/delete_payload.h
+++ b/src/libcharon/encoding/payloads/delete_payload.h
@@ -39,6 +39,7 @@ typedef struct delete_payload_t delete_payload_t;
  * The DELETE payload format is described in RFC section 3.11.
  */
 struct delete_payload_t {
+
 	/**
 	 * The payload_t interface.
 	 */
@@ -59,13 +60,11 @@ struct delete_payload_t {
 	void (*add_spi) (delete_payload_t *this, u_int32_t spi);
 
 	/**
-	 * Get an iterator over the SPIs.
-	 *
-	 * The iterate() function returns a pointer to a u_int32_t SPI.
+	 * Get an enumerator over the SPIs in network order.
 	 *
-	 * @return				iterator over SPIs
+	 * @return				enumerator over SPIs, u_int32_t
 	 */
-	iterator_t *(*create_spi_iterator) (delete_payload_t *this);
+	enumerator_t *(*create_spi_enumerator) (delete_payload_t *this);
 
 	/**
 	 * Destroys an delete_payload_t object.
diff --git a/src/libcharon/encoding/payloads/encryption_payload.c b/src/libcharon/encoding/payloads/encryption_payload.c
index 2adbb88b9..3b23ea9fb 100644
--- a/src/libcharon/encoding/payloads/encryption_payload.c
+++ b/src/libcharon/encoding/payloads/encryption_payload.c
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2005-2006 Martin Willi
+ * Copyright (C) 2005-2010 Martin Willi
+ * Copyright (C) 2010 revosec AG
  * Copyright (C) 2005 Jan Hutter
  * Hochschule fuer Technik Rapperswil
  *
@@ -24,9 +25,6 @@
 #include <utils/linked_list.h>
 #include <encoding/generator.h>
 #include <encoding/parser.h>
-#include <utils/iterator.h>
-#include <crypto/signers/signer.h>
-
 
 typedef struct private_encryption_payload_t private_encryption_payload_t;
 
@@ -50,9 +48,9 @@ struct private_encryption_payload_t {
 	u_int8_t next_payload;
 
 	/**
-	 * Critical flag.
+	 * Flags, including reserved bits
 	 */
-	bool critical;
+	u_int8_t flags;
 
 	/**
 	 * Length of this payload
@@ -60,28 +58,17 @@ struct private_encryption_payload_t {
 	u_int16_t payload_length;
 
 	/**
-	 * Chunk containing the iv, data, padding,
-	 * and (an eventually not calculated) signature.
+	 * Chunk containing the IV, plain, padding and ICV.
 	 */
 	chunk_t encrypted;
 
 	/**
-	 * Chunk containing the data in decrypted (unpadded) form.
-	 */
-	chunk_t decrypted;
-
-	/**
-	 * Signer set by set_signer.
+	 * AEAD transform to use
 	 */
-	signer_t *signer;
+	aead_t *aead;
 
 	/**
-	 * Crypter, supplied by encrypt/decrypt
-	 */
-	crypter_t *crypter;
-
-	/**
-	 * Contained payloads of this encrpytion_payload.
+	 * Contained payloads
 	 */
 	linked_list_t *payloads;
 };
@@ -91,25 +78,16 @@ struct private_encryption_payload_t {
  *
  * The defined offsets are the positions in a object of type
  * private_encryption_payload_t.
- *
  */
 encoding_rule_t encryption_payload_encodings[] = {
 	/* 1 Byte next payload type, stored in the field next_payload */
 	{ U_INT_8,			offsetof(private_encryption_payload_t, next_payload)	},
-	/* the critical bit */
-	{ FLAG,				offsetof(private_encryption_payload_t, critical)		},
-	/* 7 Bit reserved bits, nowhere stored */
-	{ RESERVED_BIT,		0														},
-	{ RESERVED_BIT,		0														},
-	{ RESERVED_BIT,		0														},
-	{ RESERVED_BIT,		0														},
-	{ RESERVED_BIT,		0														},
-	{ RESERVED_BIT,		0														},
-	{ RESERVED_BIT,		0														},
+	/* Critical and 7 reserved bits, all stored for reconstruction */
+	{ U_INT_8,			offsetof(private_encryption_payload_t, flags)			},
 	/* Length of the whole encryption payload*/
 	{ PAYLOAD_LENGTH,	offsetof(private_encryption_payload_t, payload_length)	},
 	/* encrypted data, stored in a chunk. contains iv, data, padding */
-	{ ENCRYPTED_DATA,	offsetof(private_encryption_payload_t, encrypted)			},
+	{ ENCRYPTED_DATA,	offsetof(private_encryption_payload_t, encrypted)		},
 };
 
 /*
@@ -131,108 +109,90 @@ encoding_rule_t encryption_payload_encodings[] = {
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 */
 
-/**
- * Implementation of payload_t.verify.
- */
-static status_t verify(private_encryption_payload_t *this)
+METHOD(payload_t, verify, status_t,
+	private_encryption_payload_t *this)
 {
 	return SUCCESS;
 }
 
-/**
- * Implementation of payload_t.get_encoding_rules.
- */
-static void get_encoding_rules(private_encryption_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
+METHOD(payload_t, get_encoding_rules, void,
+	private_encryption_payload_t *this, encoding_rule_t **rules,
+	size_t *count)
 {
 	*rules = encryption_payload_encodings;
-	*rule_count = sizeof(encryption_payload_encodings) / sizeof(encoding_rule_t);
+	*count = countof(encryption_payload_encodings);
 }
 
-/**
- * Implementation of payload_t.get_type.
- */
-static payload_type_t get_type(private_encryption_payload_t *this)
+METHOD(payload_t, get_type, payload_type_t,
+	private_encryption_payload_t *this)
 {
 	return ENCRYPTED;
 }
 
-/**
- * Implementation of payload_t.get_next_type.
- */
-static payload_type_t get_next_type(private_encryption_payload_t *this)
+METHOD(payload_t, get_next_type, payload_type_t,
+	private_encryption_payload_t *this)
 {
-	/* returns first contained payload here */
-	return (this->next_payload);
+	return this->next_payload;
 }
 
-/**
- * Implementation of payload_t.set_next_type.
- */
-static void set_next_type(private_encryption_payload_t *this, payload_type_t type)
+METHOD(payload_t, set_next_type, void,
+	private_encryption_payload_t *this, payload_type_t type)
 {
-	/* set next type is not allowed, since this payload MUST be the last one
-	 * and so nothing is done in here*/
+	/* the next payload is set during add */
 }
 
 /**
- * (re-)compute the lenght of the whole payload
+ * Compute the lenght of the whole payload
  */
 static void compute_length(private_encryption_payload_t *this)
 {
-	iterator_t *iterator;
-	payload_t *current_payload;
-	size_t block_size, length = 0;
-	iterator = this->payloads->create_iterator(this->payloads, TRUE);
+	enumerator_t *enumerator;
+	payload_t *payload;
+	size_t bs, length = 0;
 
-	/* count payload length */
-	while (iterator->iterate(iterator, (void **) &current_payload))
+	if (this->encrypted.len)
 	{
-		length += current_payload->get_length(current_payload);
+		length = this->encrypted.len;
 	}
-	iterator->destroy(iterator);
-
-	if (this->crypter && this->signer)
+	else
 	{
-		/* append one byte for padding length */
-		length++;
-		/* append padding */
-		block_size = this->crypter->get_block_size(this->crypter);
-		length += block_size - length % block_size;
-		/* add iv */
-		length += block_size;
-		/* add signature */
-		length += this->signer->get_block_size(this->signer);
+		enumerator = this->payloads->create_enumerator(this->payloads);
+		while (enumerator->enumerate(enumerator, &payload))
+		{
+			length += payload->get_length(payload);
+		}
+		enumerator->destroy(enumerator);
+
+		if (this->aead)
+		{
+			/* append padding */
+			bs = this->aead->get_block_size(this->aead);
+			length += bs - (length % bs);
+			/* add iv */
+			length += this->aead->get_iv_size(this->aead);
+			/* add icv */
+			length += this->aead->get_icv_size(this->aead);
+		}
 	}
 	length += ENCRYPTION_PAYLOAD_HEADER_LENGTH;
 	this->payload_length = length;
 }
 
-/**
- * Implementation of payload_t.get_length.
- */
-static size_t get_length(private_encryption_payload_t *this)
+METHOD2(payload_t, encryption_payload_t, get_length, size_t,
+	private_encryption_payload_t *this)
 {
 	compute_length(this);
 	return this->payload_length;
 }
 
-/**
- * Implementation of payload_t.create_payload_iterator.
- */
-static  iterator_t *create_payload_iterator (private_encryption_payload_t *this, bool forward)
-{
-	return (this->payloads->create_iterator(this->payloads, forward));
-}
-
-/**
- * Implementation of payload_t.add_payload.
- */
-static void add_payload(private_encryption_payload_t *this, payload_t *payload)
+METHOD(encryption_payload_t, add_payload, void,
+	private_encryption_payload_t *this, payload_t *payload)
 {
 	payload_t *last_payload;
+
 	if (this->payloads->get_count(this->payloads) > 0)
 	{
-		this->payloads->get_last(this->payloads,(void **) &last_payload);
+		this->payloads->get_last(this->payloads, (void **)&last_payload);
 		last_payload->set_next_type(last_payload, payload->get_type(payload));
 	}
 	else
@@ -240,339 +200,255 @@ static void add_payload(private_encryption_payload_t *this, payload_t *payload)
 		this->next_payload = payload->get_type(payload);
 	}
 	payload->set_next_type(payload, NO_PAYLOAD);
-	this->payloads->insert_last(this->payloads, (void*)payload);
+	this->payloads->insert_last(this->payloads, payload);
 	compute_length(this);
 }
 
-/**
- * Implementation of encryption_payload_t.remove_first_payload.
- */
-static status_t remove_first_payload(private_encryption_payload_t *this, payload_t **payload)
+METHOD(encryption_payload_t, remove_payload, payload_t *,
+	private_encryption_payload_t *this)
 {
-	return this->payloads->remove_first(this->payloads, (void**)payload);
-}
+	payload_t *payload;
 
-/**
- * Implementation of encryption_payload_t.get_payload_count.
- */
-static size_t get_payload_count(private_encryption_payload_t *this)
-{
-	return this->payloads->get_count(this->payloads);
+	if (this->payloads->remove_first(this->payloads,
+									 (void**)&payload) == SUCCESS)
+	{
+		return payload;
+	}
+	return NULL;
 }
 
 /**
- * Generate payload before encryption.
+ * Generate payload before encryption
  */
-static void generate(private_encryption_payload_t *this)
+static chunk_t generate(private_encryption_payload_t *this,
+						generator_t *generator)
 {
-	payload_t *current_payload, *next_payload;
-	generator_t *generator;
-	iterator_t *iterator;
-
-	/* recalculate length before generating */
-	compute_length(this);
+	payload_t *current, *next;
+	enumerator_t *enumerator;
+	u_int32_t *lenpos;
+	chunk_t chunk = chunk_empty;
 
-	/* create iterator */
-	iterator = this->payloads->create_iterator(this->payloads, TRUE);
-
-	/* get first payload */
-	if (iterator->iterate(iterator, (void**)&current_payload))
-	{
-		this->next_payload = current_payload->get_type(current_payload);
-	}
-	else
+	enumerator = this->payloads->create_enumerator(this->payloads);
+	if (enumerator->enumerate(enumerator, &current))
 	{
-		/* no paylads? */
-		DBG2(DBG_ENC, "generating contained payloads, but none available");
-		free(this->decrypted.ptr);
-		this->decrypted = chunk_empty;
-		iterator->destroy(iterator);
-		return;
-	}
+		this->next_payload = current->get_type(current);
 
-	generator = generator_create();
+		while (enumerator->enumerate(enumerator, &next))
+		{
+			current->set_next_type(current, next->get_type(next));
+			generator->generate_payload(generator, current);
+			current = next;
+		}
+		current->set_next_type(current, NO_PAYLOAD);
+		generator->generate_payload(generator, current);
 
-	/* build all payload, except last */
-	while(iterator->iterate(iterator, (void**)&next_payload))
-	{
-		current_payload->set_next_type(current_payload, next_payload->get_type(next_payload));
-		generator->generate_payload(generator, current_payload);
-		current_payload = next_payload;
+		chunk = generator->get_chunk(generator, &lenpos);
+		DBG2(DBG_ENC, "generated content in encryption payload");
 	}
-	iterator->destroy(iterator);
-
-	/* build last payload */
-	current_payload->set_next_type(current_payload, NO_PAYLOAD);
-	generator->generate_payload(generator, current_payload);
-
-	/* free already generated data */
-	free(this->decrypted.ptr);
-
-	generator->write_to_chunk(generator, &(this->decrypted));
-	generator->destroy(generator);
-	DBG2(DBG_ENC, "successfully generated content in encryption payload");
+	enumerator->destroy(enumerator);
+	return chunk;
 }
 
 /**
- * Implementation of encryption_payload_t.encrypt.
+ * Append the encryption payload header to the associated data
  */
-static status_t encrypt(private_encryption_payload_t *this)
+static chunk_t append_header(private_encryption_payload_t *this, chunk_t assoc)
 {
-	chunk_t iv, padding, to_crypt, result;
+	struct {
+		u_int8_t next_payload;
+		u_int8_t flags;
+		u_int16_t length;
+	} __attribute__((packed)) header = {
+		.next_payload = this->next_payload,
+		.flags = this->flags,
+		.length = htons(get_length(this)),
+	};
+	return chunk_cat("cc", assoc, chunk_from_thing(header));
+}
+
+METHOD(encryption_payload_t, encrypt, bool,
+	private_encryption_payload_t *this, chunk_t assoc)
+{
+	chunk_t iv, plain, padding, icv, crypt;
+	generator_t *generator;
 	rng_t *rng;
-	size_t block_size;
+	size_t bs;
 
-	if (this->signer == NULL || this->crypter == NULL)
+	if (this->aead == NULL)
 	{
-		DBG1(DBG_ENC, "could not encrypt, signer/crypter not set");
-		return INVALID_STATE;
+		DBG1(DBG_ENC, "encrypting encryption payload failed, transform missing");
+		return FALSE;
 	}
 
-	/* for random data in iv and padding */
 	rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
 	if (!rng)
 	{
-		DBG1(DBG_ENC, "could not encrypt, no RNG found");
-		return FAILED;
+		DBG1(DBG_ENC, "encrypting encryption payload failed, no RNG found");
+		return FALSE;
 	}
-	/* build payload chunk */
-	generate(this);
 
-	DBG2(DBG_ENC, "encrypting payloads");
-	DBG3(DBG_ENC, "data to encrypt %B", &this->decrypted);
+	assoc = append_header(this, assoc);
 
-	/* build padding */
-	block_size = this->crypter->get_block_size(this->crypter);
-	padding.len = block_size - ((this->decrypted.len + 1) %  block_size);
-	rng->allocate_bytes(rng, padding.len, &padding);
-
-	/* concatenate payload data, padding, padding len */
-	to_crypt.len = this->decrypted.len + padding.len + 1;
-	to_crypt.ptr = malloc(to_crypt.len);
-
-	memcpy(to_crypt.ptr, this->decrypted.ptr, this->decrypted.len);
-	memcpy(to_crypt.ptr + this->decrypted.len, padding.ptr, padding.len);
-	*(to_crypt.ptr + to_crypt.len - 1) = padding.len;
+	generator = generator_create();
+	plain = generate(this, generator);
+	bs = this->aead->get_block_size(this->aead);
+	/* we need at least one byte padding to store the padding length */
+	padding.len = bs - (plain.len % bs);
+	iv.len = this->aead->get_iv_size(this->aead);
+	icv.len = this->aead->get_icv_size(this->aead);
+
+	/* prepare data to authenticate-encrypt:
+	 * | IV | plain | padding | ICV |
+	 *       \____crypt______/   ^
+	 *              |           /
+	 *              v          /
+	 *     assoc -> + ------->/
+	 */
+	free(this->encrypted.ptr);
+	this->encrypted = chunk_alloc(iv.len + plain.len + padding.len + icv.len);
+	iv.ptr = this->encrypted.ptr;
+	memcpy(iv.ptr + iv.len, plain.ptr, plain.len);
+	plain.ptr = iv.ptr + iv.len;
+	padding.ptr = plain.ptr + plain.len;
+	icv.ptr = padding.ptr + padding.len;
+	crypt = chunk_create(plain.ptr, plain.len + padding.len);
+	generator->destroy(generator);
 
-	/* build iv */
-	iv.len = block_size;
-	rng->allocate_bytes(rng, iv.len, &iv);
+	rng->get_bytes(rng, iv.len, iv.ptr);
+	rng->get_bytes(rng, padding.len - 1, padding.ptr);
+	padding.ptr[padding.len - 1] = padding.len - 1;
 	rng->destroy(rng);
 
-	DBG3(DBG_ENC, "data before encryption with padding %B", &to_crypt);
+	DBG3(DBG_ENC, "encryption payload encryption:");
+	DBG3(DBG_ENC, "IV %B", &iv);
+	DBG3(DBG_ENC, "plain %B", &plain);
+	DBG3(DBG_ENC, "padding %B", &padding);
+	DBG3(DBG_ENC, "assoc %B", &assoc);
 
-	/* encrypt to_crypt chunk */
-	free(this->encrypted.ptr);
-	this->crypter->encrypt(this->crypter, to_crypt, iv, &result);
-	free(padding.ptr);
-	free(to_crypt.ptr);
-
-	DBG3(DBG_ENC, "data after encryption %B", &result);
-
-	/* build encrypted result with iv and signature */
-	this->encrypted.len = iv.len + result.len + this->signer->get_block_size(this->signer);
-	free(this->encrypted.ptr);
-	this->encrypted.ptr = malloc(this->encrypted.len);
+	this->aead->encrypt(this->aead, crypt, assoc, iv, NULL);
 
-	/* fill in result, signature is left out */
-	memcpy(this->encrypted.ptr, iv.ptr, iv.len);
-	memcpy(this->encrypted.ptr + iv.len, result.ptr, result.len);
+	DBG3(DBG_ENC, "encrypted %B", &crypt);
+	DBG3(DBG_ENC, "ICV %B", &icv);
 
-	free(result.ptr);
-	free(iv.ptr);
-	DBG3(DBG_ENC, "data after encryption with IV and (invalid) signature %B",
-		 &this->encrypted);
+	free(assoc.ptr);
 
-	return SUCCESS;
+	return TRUE;
 }
 
 /**
  * Parse the payloads after decryption.
  */
-static status_t parse(private_encryption_payload_t *this)
+static status_t parse(private_encryption_payload_t *this, chunk_t plain)
 {
 	parser_t *parser;
-	status_t status;
-	payload_type_t current_payload_type;
-
-	/* build a parser on the decrypted data */
-	parser = parser_create(this->decrypted);
+	payload_type_t type;
 
-	current_payload_type = this->next_payload;
-	/* parse all payloads */
-	while (current_payload_type != NO_PAYLOAD)
+	parser = parser_create(plain);
+	type = this->next_payload;
+	while (type != NO_PAYLOAD)
 	{
-		payload_t *current_payload;
+		payload_t *payload;
 
-		status = parser->parse_payload(parser, current_payload_type, (payload_t**)&current_payload);
-		if (status != SUCCESS)
+		if (parser->parse_payload(parser, type, &payload) != SUCCESS)
 		{
 			parser->destroy(parser);
 			return PARSE_ERROR;
 		}
-
-		status = current_payload->verify(current_payload);
-		if (status != SUCCESS)
+		if (payload->verify(payload) != SUCCESS)
 		{
 			DBG1(DBG_ENC, "%N verification failed",
-				 payload_type_names, current_payload->get_type(current_payload));
-			current_payload->destroy(current_payload);
+				 payload_type_names, payload->get_type(payload));
+			payload->destroy(payload);
 			parser->destroy(parser);
 			return VERIFY_ERROR;
 		}
-
-		/* get next payload type */
-		current_payload_type = current_payload->get_next_type(current_payload);
-
-		this->payloads->insert_last(this->payloads,current_payload);
+		type = payload->get_next_type(payload);
+		this->payloads->insert_last(this->payloads, payload);
 	}
 	parser->destroy(parser);
-	DBG2(DBG_ENC, "succesfully parsed content of encryption payload");
+	DBG2(DBG_ENC, "parsed content of encryption payload");
 	return SUCCESS;
 }
 
-/**
- * Implementation of encryption_payload_t.encrypt.
- */
-static status_t decrypt(private_encryption_payload_t *this)
+METHOD(encryption_payload_t, decrypt, status_t,
+	private_encryption_payload_t *this, chunk_t assoc)
 {
-	chunk_t iv, concatenated;
-	u_int8_t padding_length;
-
-	DBG2(DBG_ENC, "decrypting encryption payload");
-	DBG3(DBG_ENC, "data before decryption with IV and (invalid) signature %B",
-		 &this->encrypted);
+	chunk_t iv, plain, padding, icv, crypt;
+	size_t bs;
 
-	if (this->signer == NULL || this->crypter == NULL)
+	if (this->aead == NULL)
 	{
-		DBG1(DBG_ENC, "could not decrypt, no crypter/signer set");
+		DBG1(DBG_ENC, "decrypting encryption payload failed, transform missing");
 		return INVALID_STATE;
 	}
 
-	/* get IV */
-	iv.len = this->crypter->get_block_size(this->crypter);
+	/* prepare data to authenticate-decrypt:
+	 * | IV | plain | padding | ICV |
+	 *       \____crypt______/   ^
+	 *              |           /
+	 *              v          /
+	 *     assoc -> + ------->/
+	 */
 
+	bs = this->aead->get_block_size(this->aead);
+	iv.len = this->aead->get_iv_size(this->aead);
 	iv.ptr = this->encrypted.ptr;
+	icv.len = this->aead->get_icv_size(this->aead);
+	icv.ptr = this->encrypted.ptr + this->encrypted.len - icv.len;
+	crypt.ptr = iv.ptr + iv.len;
+	crypt.len = this->encrypted.len - iv.len;
 
-	/* point concatenated to data + padding + padding_length*/
-	concatenated.ptr = this->encrypted.ptr + iv.len;
-	concatenated.len = this->encrypted.len - iv.len -
-								this->signer->get_block_size(this->signer);
-
-	/* concatenated must be a multiple of block_size of crypter */
-	if (concatenated.len < iv.len || concatenated.len % iv.len)
+	if (iv.len + icv.len > this->encrypted.len ||
+		(crypt.len - icv.len) % bs)
 	{
-		DBG1(DBG_ENC, "could not decrypt, invalid input");
+		DBG1(DBG_ENC, "decrypting encryption payload failed, invalid length");
 		return FAILED;
 	}
 
-	/* free previus data, if any */
-	free(this->decrypted.ptr);
-
-	DBG3(DBG_ENC, "data before decryption %B", &concatenated);
-
-	this->crypter->decrypt(this->crypter, concatenated, iv, &this->decrypted);
+	assoc = append_header(this, assoc);
 
-	DBG3(DBG_ENC, "data after decryption with padding %B", &this->decrypted);
+	DBG3(DBG_ENC, "encryption payload decryption:");
+	DBG3(DBG_ENC, "IV %B", &iv);
+	DBG3(DBG_ENC, "encrypted %B", &crypt);
+	DBG3(DBG_ENC, "ICV %B", &icv);
+	DBG3(DBG_ENC, "assoc %B", &assoc);
 
-	/* get padding length, sits just bevore signature */
-	padding_length = *(this->decrypted.ptr + this->decrypted.len - 1);
-	/* add one byte to the padding length, since the padding_length field is
-	 * not included */
-	padding_length++;
-
-	/* check size again */
-	if (padding_length > concatenated.len || padding_length > this->decrypted.len)
+	if (!this->aead->decrypt(this->aead, crypt, assoc, iv, NULL))
 	{
-		DBG1(DBG_ENC, "decryption failed, invalid padding length found. Invalid key?");
-		/* decryption failed :-/ */
+		DBG1(DBG_ENC, "verifying encryption payload integrity failed");
+		free(assoc.ptr);
 		return FAILED;
 	}
-	this->decrypted.len -= padding_length;
-
-	/* free padding */
-	this->decrypted.ptr = realloc(this->decrypted.ptr, this->decrypted.len);
-	DBG3(DBG_ENC, "data after decryption without padding %B", &this->decrypted);
-	DBG2(DBG_ENC, "decryption successful, trying to parse content");
-	return parse(this);
-}
+	free(assoc.ptr);
 
-/**
- * Implementation of encryption_payload_t.set_transforms.
- */
-static void set_transforms(private_encryption_payload_t *this, crypter_t* crypter, signer_t* signer)
-{
-	this->signer = signer;
-	this->crypter = crypter;
-}
-
-/**
- * Implementation of encryption_payload_t.build_signature.
- */
-static status_t build_signature(private_encryption_payload_t *this, chunk_t data)
-{
-	chunk_t data_without_sig = data;
-	chunk_t sig;
-
-	if (this->signer == NULL)
+	plain = chunk_create(crypt.ptr, crypt.len - icv.len);
+	padding.len = plain.ptr[plain.len - 1] + 1;
+	if (padding.len > plain.len)
 	{
-		DBG1(DBG_ENC, "unable to build signature, no signer set");
-		return INVALID_STATE;
+		DBG1(DBG_ENC, "decrypting encryption payload failed, "
+			 "padding invalid %B", &crypt);
+		return PARSE_ERROR;
 	}
+	plain.len -= padding.len;
+	padding.ptr = plain.ptr + plain.len;
 
-	sig.len = this->signer->get_block_size(this->signer);
-	data_without_sig.len -= sig.len;
-	sig.ptr = data.ptr + data_without_sig.len;
-	DBG2(DBG_ENC, "building signature");
-	this->signer->get_signature(this->signer, data_without_sig, sig.ptr);
-	return SUCCESS;
+	DBG3(DBG_ENC, "plain %B", &plain);
+	DBG3(DBG_ENC, "padding %B", &padding);
+
+	return parse(this, plain);
 }
 
-/**
- * Implementation of encryption_payload_t.verify_signature.
- */
-static status_t verify_signature(private_encryption_payload_t *this, chunk_t data)
+METHOD(encryption_payload_t, set_transform, void,
+	private_encryption_payload_t *this, aead_t* aead)
 {
-	chunk_t sig, data_without_sig;
-	bool valid;
-
-	if (this->signer == NULL)
-	{
-		DBG1(DBG_ENC, "unable to verify signature, no signer set");
-		return INVALID_STATE;
-	}
-	/* find signature in data chunk */
-	sig.len = this->signer->get_block_size(this->signer);
-	if (data.len <= sig.len)
-	{
-		DBG1(DBG_ENC, "unable to verify signature, invalid input");
-		return FAILED;
-	}
-	sig.ptr = data.ptr + data.len - sig.len;
-
-	/* verify it */
-	data_without_sig.len = data.len - sig.len;
-	data_without_sig.ptr = data.ptr;
-	valid = this->signer->verify_signature(this->signer, data_without_sig, sig);
-
-	if (!valid)
-	{
-		DBG1(DBG_ENC, "signature verification failed");
-		return FAILED;
-	}
-
-	DBG2(DBG_ENC, "signature verification successful");
-	return SUCCESS;
+	this->aead = aead;
 }
 
-/**
- * Implementation of payload_t.destroy.
- */
-static void destroy(private_encryption_payload_t *this)
+METHOD2(payload_t, encryption_payload_t, destroy, void,
+	private_encryption_payload_t *this)
 {
 	this->payloads->destroy_offset(this->payloads, offsetof(payload_t, destroy));
 	free(this->encrypted.ptr);
-	free(this->decrypted.ptr);
 	free(this);
 }
 
@@ -581,39 +457,31 @@ static void destroy(private_encryption_payload_t *this)
  */
 encryption_payload_t *encryption_payload_create()
 {
-	private_encryption_payload_t *this = malloc_thing(private_encryption_payload_t);
-
-	/* payload_t interface functions */
-	this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
-	this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
-	this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length;
-	this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type;
-	this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
-	this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_type;
-	this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
-	/* public functions */
-	this->public.create_payload_iterator = (iterator_t * (*) (encryption_payload_t *,bool)) create_payload_iterator;
-	this->public.add_payload = (void (*) (encryption_payload_t *,payload_t *)) add_payload;
-	this->public.remove_first_payload = (status_t (*)(encryption_payload_t*, payload_t **)) remove_first_payload;
-	this->public.get_payload_count = (size_t (*)(encryption_payload_t*)) get_payload_count;
-
-	this->public.encrypt = (status_t (*) (encryption_payload_t *)) encrypt;
-	this->public.decrypt = (status_t (*) (encryption_payload_t *)) decrypt;
-	this->public.set_transforms = (void (*) (encryption_payload_t*,crypter_t*,signer_t*)) set_transforms;
-	this->public.build_signature = (status_t (*) (encryption_payload_t*, chunk_t)) build_signature;
-	this->public.verify_signature = (status_t (*) (encryption_payload_t*, chunk_t)) verify_signature;
-	this->public.destroy = (void (*) (encryption_payload_t *)) destroy;
-
-	/* set default values of the fields */
-	this->critical = FALSE;
-	this->next_payload = NO_PAYLOAD;
-	this->payload_length = ENCRYPTION_PAYLOAD_HEADER_LENGTH;
-	this->encrypted = chunk_empty;
-	this->decrypted = chunk_empty;
-	this->signer = NULL;
-	this->crypter = NULL;
-	this->payloads = linked_list_create();
-
-	return (&(this->public));
+	private_encryption_payload_t *this;
+
+	INIT(this,
+		.public = {
+			.payload_interface = {
+				.verify = _verify,
+				.get_encoding_rules = _get_encoding_rules,
+				.get_length = _get_length,
+				.get_next_type = _get_next_type,
+				.set_next_type = _set_next_type,
+				.get_type = _get_type,
+				.destroy = _destroy,
+			},
+			.get_length = _get_length,
+			.add_payload = _add_payload,
+			.remove_payload = _remove_payload,
+			.set_transform = _set_transform,
+			.encrypt = _encrypt,
+			.decrypt = _decrypt,
+			.destroy = _destroy,
+		},
+		.next_payload = NO_PAYLOAD,
+		.payload_length = ENCRYPTION_PAYLOAD_HEADER_LENGTH,
+		.payloads = linked_list_create(),
+	);
+
+	return &this->public;
 }
diff --git a/src/libcharon/encoding/payloads/encryption_payload.h b/src/libcharon/encoding/payloads/encryption_payload.h
index ac5326b87..e99c42fb7 100644
--- a/src/libcharon/encoding/payloads/encryption_payload.h
+++ b/src/libcharon/encoding/payloads/encryption_payload.h
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2005-2006 Martin Willi
+ * Copyright (C) 2005-2010 Martin Willi
+ * Copyright (C) 2010 revosec AG
  * Copyright (C) 2005 Jan Hutter
  * Hochschule fuer Technik Rapperswil
  *
@@ -25,45 +26,30 @@
 typedef struct encryption_payload_t encryption_payload_t;
 
 #include <library.h>
-#include <crypto/crypters/crypter.h>
-#include <crypto/signers/signer.h>
+#include <crypto/aead.h>
 #include <encoding/payloads/payload.h>
-#include <utils/linked_list.h>
 
 /**
  * Encrpytion payload length in bytes without IV and following data.
  */
 #define ENCRYPTION_PAYLOAD_HEADER_LENGTH 4
 
-
 /**
  * The encryption payload as described in RFC section 3.14.
- *
- * Before any crypt/decrypt/sign/verify operation can occur,
- * the transforms must be set. After that, a parsed encryption payload
- * can be decrypted, which also will parse the contained payloads.
- * Encryption is done the same way, added payloads will get generated
- * and then encrypted.
- * For signature building, there is the FULL packet needed. Meaning it
- * must be builded after generation of all payloads and the encryption
- * of the encryption payload.
- * Signature verificatin is done before decryption.
  */
 struct encryption_payload_t {
+
 	/**
 	 * Implements payload_t interface.
 	 */
 	payload_t payload_interface;
 
 	/**
-	 * Creates an iterator for all contained payloads.
+	 * Get the payload length.
 	 *
-	 * iterator_t object has to get destroyed by the caller.
-	 *
-	 * @param forward 		iterator direction (TRUE: front to end)
-	 * return				created iterator_t object
+	 * @return			(expected) payload length
 	 */
-	 iterator_t *(*create_payload_iterator) (encryption_payload_t *this, bool forward);
+	size_t (*get_length)(encryption_payload_t *this);
 
 	/**
 	 * Adds a payload to this encryption payload.
@@ -73,89 +59,39 @@ struct encryption_payload_t {
 	void (*add_payload) (encryption_payload_t *this, payload_t *payload);
 
 	/**
-	 * Reove the last payload in the contained payload list.
+	 * Remove the first payload in the list
 	 *
 	 * @param payload		removed payload
-	 * @return
-	 * 						- SUCCESS, or
-	 * 						- NOT_FOUND if list empty
-	 */
-	status_t (*remove_first_payload) (encryption_payload_t *this, payload_t **payload);
-
-	/**
-	 * Get the number of payloads.
-	 *
-	 * @return				number of contained payloads
+	 * @return				payload, NULL if none left
 	 */
-	size_t (*get_payload_count) (encryption_payload_t *this);
+	payload_t* (*remove_payload)(encryption_payload_t *this);
 
 	/**
-	 * Set transforms to use.
-	 *
-	 * To decryption, encryption, signature building and verifying,
-	 * the payload needs a crypter and a signer object.
+	 * Set the AEAD transform to use.
 	 *
-	 * @warning Do NOT call this function again after encryption, since
-	 * the signer must be the same while encrypting and signature building!
-	 *
-	 * @param crypter		crypter_t to use for data de-/encryption
-	 * @param signer		signer_t to use for data signing/verifying
+	 * @param aead		aead transform to use
 	 */
-	void (*set_transforms) (encryption_payload_t *this, crypter_t *crypter, signer_t *signer);
+	void (*set_transform) (encryption_payload_t *this, aead_t *aead);
 
 	/**
-	 * Generate and encrypt contained payloads.
-	 *
-	 * This function generates the content for added payloads
-	 * and encrypts them. Signature is not built, since we need
-	 * additional data (the full message).
+	 * Generate, encrypt and sign contained payloads.
 	 *
-	 * @return				SUCCESS, or INVALID_STATE if transforms not set
+	 * @param assoc			associated data
+	 * @return				TRUE if encrypted
 	 */
-	status_t (*encrypt) (encryption_payload_t *this);
+	bool (*encrypt) (encryption_payload_t *this, chunk_t assoc);
 
 	/**
-	 * Decrypt and parse contained payloads.
-	 *
-	 * This function decrypts the contained data. After,
-	 * the payloads are parsed internally and are accessible
-	 * via the iterator.
-	 *
-	 * @return
-	 * 						- SUCCESS, or
-	 * 						- INVALID_STATE if transforms not set, or
-	 * 						- FAILED if data is invalid
-	 */
-	status_t (*decrypt) (encryption_payload_t *this);
-
-	/**
-	 * Build the signature.
-	 *
-	 * The signature is built over the FULL message, so the header
-	 * and every payload (inclusive this one) must already be generated.
-	 * The generated message is supplied via the data paramater.
-	 *
-	 * @param data			chunk contains the already generated message
-	 * @return
-	 * 						- SUCCESS, or
-	 * 						- INVALID_STATE if transforms not set
-	 */
-	status_t (*build_signature) (encryption_payload_t *this, chunk_t data);
-
-	/**
-	 * Verify the signature.
-	 *
-	 * Since the signature is built over the full message, we need
-	 * this data to do the verification. The message data
-	 * is supplied via the data argument.
-	 *
-	 * @param data			chunk contains the message
-	 * @return
-	 * 						- SUCCESS, or
-	 * 						- FAILED if signature invalid, or
-	 * 						- INVALID_STATE if transforms not set
+	 * Decrypt, verify and parse contained payloads.
+	 *
+	 * @param assoc			associated data
+	 * 						- SUCCESS if parsing successful
+	 *						- PARSE_ERROR if sub-payload parsing failed
+	 * 						- VERIFY_ERROR if sub-payload verification failed
+	 * 						- FAILED if integrity check failed
+	 * 						- INVALID_STATE if aead not supplied, but needed
 	 */
-	status_t (*verify_signature) (encryption_payload_t *this, chunk_t data);
+	status_t (*decrypt) (encryption_payload_t *this, chunk_t assoc);
 
 	/**
 	 * Destroys an encryption_payload_t object.
@@ -166,7 +102,7 @@ struct encryption_payload_t {
 /**
  * Creates an empty encryption_payload_t object.
  *
- * @return encryption_payload_t object
+ * @return			encryption_payload_t object
  */
 encryption_payload_t *encryption_payload_create(void);
 
diff --git a/src/libcharon/encoding/payloads/notify_payload.c b/src/libcharon/encoding/payloads/notify_payload.c
index 469698ef5..a56fd1869 100644
--- a/src/libcharon/encoding/payloads/notify_payload.c
+++ b/src/libcharon/encoding/payloads/notify_payload.c
@@ -41,7 +41,7 @@ ENUM_NEXT(notify_type_names, INVALID_KE_PAYLOAD, INVALID_KE_PAYLOAD, NO_PROPOSAL
 	"INVALID_KE_PAYLOAD");
 ENUM_NEXT(notify_type_names, AUTHENTICATION_FAILED, AUTHENTICATION_FAILED, INVALID_KE_PAYLOAD,
 	"AUTHENTICATION_FAILED");
-ENUM_NEXT(notify_type_names, SINGLE_PAIR_REQUIRED, USE_ASSIGNED_HoA, AUTHENTICATION_FAILED,
+ENUM_NEXT(notify_type_names, SINGLE_PAIR_REQUIRED, CHILD_SA_NOT_FOUND, AUTHENTICATION_FAILED,
 	"SINGLE_PAIR_REQUIRED",
 	"NO_ADDITIONAL_SAS",
 	"INTERNAL_ADDRESS_FAILURE",
@@ -50,10 +50,12 @@ ENUM_NEXT(notify_type_names, SINGLE_PAIR_REQUIRED, USE_ASSIGNED_HoA, AUTHENTICAT
 	"INVALID_SELECTORS",
 	"UNACCEPTABLE_ADDRESSES",
 	"UNEXPECTED_NAT_DETECTED",
-	"USE_ASSIGNED_HoA");
-ENUM_NEXT(notify_type_names, ME_CONNECT_FAILED, ME_CONNECT_FAILED, USE_ASSIGNED_HoA,
+	"USE_ASSIGNED_HoA",
+	"TEMPORARY_FAILURE",
+	"CHILD_SA_NOT_FOUND");
+ENUM_NEXT(notify_type_names, ME_CONNECT_FAILED, ME_CONNECT_FAILED, CHILD_SA_NOT_FOUND,
 	"ME_CONNECT_FAILED");
-ENUM_NEXT(notify_type_names, INITIAL_CONTACT, LINK_ID, ME_CONNECT_FAILED,
+ENUM_NEXT(notify_type_names, INITIAL_CONTACT, EAP_ONLY_AUTHENTICATION, ME_CONNECT_FAILED,
 	"INITIAL_CONTACT",
 	"SET_WINDOW_SIZE",
 	"ADDITIONAL_TS_POSSIBLE",
@@ -84,8 +86,9 @@ ENUM_NEXT(notify_type_names, INITIAL_CONTACT, LINK_ID, ME_CONNECT_FAILED,
 	"TICKET_ACK",
 	"TICKET_NACK",
 	"TICKET_OPAQUE",
-	"LINK_ID");
-ENUM_NEXT(notify_type_names, EAP_ONLY_AUTHENTICATION, EAP_ONLY_AUTHENTICATION, LINK_ID,
+	"LINK_ID",
+	"USE_WESP_MODE",
+	"ROHC_SUPPORTED",
 	"EAP_ONLY_AUTHENTICATION");
 ENUM_NEXT(notify_type_names, USE_BEET_MODE, USE_BEET_MODE, EAP_ONLY_AUTHENTICATION,
 	"USE_BEET_MODE");
@@ -117,7 +120,7 @@ ENUM_NEXT(notify_type_short_names, INVALID_KE_PAYLOAD, INVALID_KE_PAYLOAD, NO_PR
 	"INVAL_KE");
 ENUM_NEXT(notify_type_short_names, AUTHENTICATION_FAILED, AUTHENTICATION_FAILED, INVALID_KE_PAYLOAD,
 	"AUTH_FAILED");
-ENUM_NEXT(notify_type_short_names, SINGLE_PAIR_REQUIRED, USE_ASSIGNED_HoA, AUTHENTICATION_FAILED,
+ENUM_NEXT(notify_type_short_names, SINGLE_PAIR_REQUIRED, CHILD_SA_NOT_FOUND, AUTHENTICATION_FAILED,
 	"SINGLE_PAIR",
 	"NO_ADD_SAS",
 	"INT_ADDR_FAIL",
@@ -126,10 +129,12 @@ ENUM_NEXT(notify_type_short_names, SINGLE_PAIR_REQUIRED, USE_ASSIGNED_HoA, AUTHE
 	"INVAL_SEL",
 	"UNACCEPT_ADDR",
 	"UNEXPECT_NAT",
-	"ASSIGNED_HoA");
-ENUM_NEXT(notify_type_short_names, ME_CONNECT_FAILED, ME_CONNECT_FAILED, USE_ASSIGNED_HoA,
+	"ASSIGNED_HoA",
+	"TEMP_FAIL",
+	"NO_CHILD_SA");
+ENUM_NEXT(notify_type_short_names, ME_CONNECT_FAILED, ME_CONNECT_FAILED, CHILD_SA_NOT_FOUND,
 	"ME_CONN_FAIL");
-ENUM_NEXT(notify_type_short_names, INITIAL_CONTACT, LINK_ID, ME_CONNECT_FAILED,
+ENUM_NEXT(notify_type_short_names, INITIAL_CONTACT, EAP_ONLY_AUTHENTICATION, ME_CONNECT_FAILED,
 	"INIT_CONTACT",
 	"SET_WINSIZE",
 	"ADD_TS_POSS",
@@ -160,8 +165,9 @@ ENUM_NEXT(notify_type_short_names, INITIAL_CONTACT, LINK_ID, ME_CONNECT_FAILED,
 	"TKT_ACK",
 	"TKT_NACK",
 	"TKT_OPAK",
-	"LINK_ID");
-ENUM_NEXT(notify_type_short_names, EAP_ONLY_AUTHENTICATION, EAP_ONLY_AUTHENTICATION, LINK_ID,
+	"LINK_ID",
+	"WESP_MODE",
+	"ROHC_SUP",
 	"EAP_ONLY");
 ENUM_NEXT(notify_type_short_names, USE_BEET_MODE, USE_BEET_MODE, EAP_ONLY_AUTHENTICATION,
 	"BEET_MODE");
@@ -238,29 +244,29 @@ struct private_notify_payload_t {
  */
 encoding_rule_t notify_payload_encodings[] = {
 	/* 1 Byte next payload type, stored in the field next_payload */
-	{ U_INT_8,			offsetof(private_notify_payload_t, next_payload) 		},
+	{ U_INT_8,			offsetof(private_notify_payload_t, next_payload)		},
 	/* the critical bit */
-	{ FLAG,				offsetof(private_notify_payload_t, critical) 			},
+	{ FLAG,				offsetof(private_notify_payload_t, critical)			},
 	/* 7 Bit reserved bits, nowhere stored */
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
+	{ RESERVED_BIT,	0														},
+	{ RESERVED_BIT,	0														},
+	{ RESERVED_BIT,	0														},
+	{ RESERVED_BIT,	0														},
+	{ RESERVED_BIT,	0														},
+	{ RESERVED_BIT,	0														},
+	{ RESERVED_BIT,	0														},
 	/* Length of the whole payload*/
-	{ PAYLOAD_LENGTH,	offsetof(private_notify_payload_t, payload_length) 		},
+	{ PAYLOAD_LENGTH,	offsetof(private_notify_payload_t, payload_length)		},
 	/* Protocol ID as 8 bit field*/
-	{ U_INT_8,			offsetof(private_notify_payload_t, protocol_id) 			},
+	{ U_INT_8,			offsetof(private_notify_payload_t, protocol_id)			},
 	/* SPI Size as 8 bit field*/
-	{ SPI_SIZE,			offsetof(private_notify_payload_t, spi_size) 			},
+	{ SPI_SIZE,			offsetof(private_notify_payload_t, spi_size)			},
 	/* Notify message type as 16 bit field*/
 	{ U_INT_16,			offsetof(private_notify_payload_t, notify_type)	},
 	/* SPI as variable length field*/
 	{ SPI,				offsetof(private_notify_payload_t, spi)					},
 	/* Key Exchange Data is from variable size */
-	{ NOTIFICATION_DATA,	offsetof(private_notify_payload_t, notification_data) 	}
+	{ NOTIFICATION_DATA,	offsetof(private_notify_payload_t, notification_data)	}
 };
 
 /*
diff --git a/src/libcharon/encoding/payloads/notify_payload.h b/src/libcharon/encoding/payloads/notify_payload.h
index 0e1bc23b8..8abc236e1 100644
--- a/src/libcharon/encoding/payloads/notify_payload.h
+++ b/src/libcharon/encoding/payloads/notify_payload.h
@@ -64,6 +64,9 @@ enum notify_type_t {
 	UNEXPECTED_NAT_DETECTED = 41,
 	/* mobile IPv6 bootstrapping, RFC 5026 */
 	USE_ASSIGNED_HoA = 42,
+	/* IKEv2 RFC 5996 */
+	TEMPORARY_FAILURE = 43,
+	CHILD_SA_NOT_FOUND = 44,
 
 	/* IKE-ME, private use */
 	ME_CONNECT_FAILED = 8192,
@@ -98,16 +101,21 @@ enum notify_type_t {
 	REDIRECT_SUPPORTED = 16406,
 	REDIRECT = 16407,
 	REDIRECTED_FROM = 16408,
-	/* draft-ietf-ipsecme-ikev2-resumption, assigned by IANA */
+	/* session resumption, RFC 5723 */
 	TICKET_LT_OPAQUE = 16409,
 	TICKET_REQUEST = 16410,
 	TICKET_ACK = 16411,
 	TICKET_NACK = 16412,
 	TICKET_OPAQUE = 16413,
+	/* IPv6 configuration, RFC 5739 */
 	LINK_ID = 16414,
+	/* wrapped esp, RFC 5840 */
+	USE_WESP_MODE = 16415,
+	/* robust header compression, RFC 5857 */
+	ROHC_SUPPORTED = 16416,
+	/* EAP-only authentication, RFC 5998 */
+	EAP_ONLY_AUTHENTICATION = 16417,
 
-	/* draft-eronen-ipsec-ikev2-eap-auth, not assigned by IANA yet */
-	EAP_ONLY_AUTHENTICATION = 40960,
 	/* BEET mode, not even a draft yet. private use */
 	USE_BEET_MODE = 40961,
 	/* IKE-ME, private use */
@@ -144,7 +152,7 @@ struct notify_payload_t {
 	/**
 	 * Gets the protocol id of this payload.
 	 *
-	 * @return 			protocol id of this payload
+	 * @return			protocol id of this payload
 	 */
 	u_int8_t (*get_protocol_id) (notify_payload_t *this);
 
@@ -158,7 +166,7 @@ struct notify_payload_t {
 	/**
 	 * Gets the notify message type of this payload.
 	 *
-	 * @return 			notify message type of this payload
+	 * @return			notify message type of this payload
 	 */
 	notify_type_t (*get_notify_type) (notify_payload_t *this);
 
@@ -174,7 +182,7 @@ struct notify_payload_t {
 	 *
 	 * This is only valid for notifys with protocol AH|ESP
 	 *
-	 * @return 		SPI value
+	 * @return		SPI value
 	 */
 	u_int32_t (*get_spi) (notify_payload_t *this);
 
@@ -192,7 +200,7 @@ struct notify_payload_t {
 	 *
 	 * Returned data are not copied.
 	 *
-	 * @return 		chunk_t pointing to the value
+	 * @return		chunk_t pointing to the value
 	 */
 	chunk_t (*get_notification_data) (notify_payload_t *this);
 
@@ -201,7 +209,7 @@ struct notify_payload_t {
 	 *
 	 * @warning Value is getting copied.
 	 *
-	 * @param notification_data 	chunk_t pointing to the value to set
+	 * @param notification_data	chunk_t pointing to the value to set
 	 */
 	void (*set_notification_data) (notify_payload_t *this,
 								   chunk_t notification_data);
diff --git a/src/libcharon/encoding/payloads/proposal_substructure.c b/src/libcharon/encoding/payloads/proposal_substructure.c
index c93f73a68..985b03255 100644
--- a/src/libcharon/encoding/payloads/proposal_substructure.c
+++ b/src/libcharon/encoding/payloads/proposal_substructure.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005-2006 Martin Willi
+ * Copyright (C) 2005-2010 Martin Willi
  * Copyright (C) 2005 Jan Hutter
  * Hochschule fuer Technik Rapperswil
  *
@@ -24,20 +24,18 @@
 #include <utils/linked_list.h>
 #include <daemon.h>
 
-
 /**
  * IKEv1 Value for a proposal payload.
  */
 #define PROPOSAL_TYPE_VALUE 2
 
-
 typedef struct private_proposal_substructure_t private_proposal_substructure_t;
 
 /**
  * Private data of an proposal_substructure_t object.
- *
  */
 struct private_proposal_substructure_t {
+
 	/**
 	 * Public proposal_substructure_t interface.
 	 */
@@ -92,24 +90,24 @@ struct private_proposal_substructure_t {
  */
 encoding_rule_t proposal_substructure_encodings[] = {
 	/* 1 Byte next payload type, stored in the field next_payload */
-	{ U_INT_8,			offsetof(private_proposal_substructure_t, next_payload) 		},
+	{ U_INT_8,			offsetof(private_proposal_substructure_t, next_payload)		},
 	/* Reserved Byte is skipped */
-	{ RESERVED_BYTE,		0															},
+	{ RESERVED_BYTE,	0															},
 	/* Length of the whole proposal substructure payload*/
-	{ PAYLOAD_LENGTH,		offsetof(private_proposal_substructure_t, proposal_length) 	},
+	{ PAYLOAD_LENGTH,	offsetof(private_proposal_substructure_t, proposal_length)	},
 	/* proposal number is a number of 8 bit */
-	{ U_INT_8,				offsetof(private_proposal_substructure_t, proposal_number) 	},
+	{ U_INT_8,			offsetof(private_proposal_substructure_t, proposal_number)	},
 	/* protocol ID is a number of 8 bit */
-	{ U_INT_8,				offsetof(private_proposal_substructure_t, protocol_id)		},
+	{ U_INT_8,			offsetof(private_proposal_substructure_t, protocol_id)		},
 	/* SPI Size has its own type */
-	{ SPI_SIZE,				offsetof(private_proposal_substructure_t, spi_size)			},
+	{ SPI_SIZE,			offsetof(private_proposal_substructure_t, spi_size)			},
 	/* Number of transforms is a number of 8 bit */
-	{ U_INT_8,				offsetof(private_proposal_substructure_t, transforms_count)	},
+	{ U_INT_8,			offsetof(private_proposal_substructure_t, transforms_count)	},
 	/* SPI is a chunk of variable size*/
-	{ SPI,					offsetof(private_proposal_substructure_t, spi)				},
+	{ SPI,				offsetof(private_proposal_substructure_t, spi)				},
 	/* Transforms are stored in a transform substructure,
 	   offset points to a linked_list_t pointer */
-	{ TRANSFORMS,			offsetof(private_proposal_substructure_t, transforms) 		}
+	{ TRANSFORMS,		offsetof(private_proposal_substructure_t, transforms)		}
 };
 
 /*
@@ -128,16 +126,14 @@ encoding_rule_t proposal_substructure_encodings[] = {
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 */
 
-/**
- * Implementation of payload_t.verify.
- */
-static status_t verify(private_proposal_substructure_t *this)
+METHOD(payload_t, verify, status_t,
+	private_proposal_substructure_t *this)
 {
 	status_t status = SUCCESS;
-	iterator_t *iterator;
-	payload_t *current_transform;
+	enumerator_t *enumerator;
+	payload_t *current;
 
-	if ((this->next_payload != NO_PAYLOAD) && (this->next_payload != 2))
+	if (this->next_payload != NO_PAYLOAD && this->next_payload != 2)
 	{
 		/* must be 0 or 2 */
 		DBG1(DBG_ENC, "inconsistent next payload");
@@ -169,61 +165,46 @@ static status_t verify(private_proposal_substructure_t *this)
 			}
 			break;
 		default:
-			DBG1(DBG_ENC, "invalid proposal protocol (%d)", this->protocol_id);
-			return FAILED;
-	}
-	if ((this->protocol_id == 0) || (this->protocol_id >= 4))
-	{
-		/* reserved are not supported */
-		DBG1(DBG_ENC, "invalid protocol");
-		return FAILED;
+			break;
 	}
-
-	iterator = this->transforms->create_iterator(this->transforms,TRUE);
-	while(iterator->iterate(iterator, (void**)&current_transform))
+	enumerator = this->transforms->create_enumerator(this->transforms);
+	while (enumerator->enumerate(enumerator, &current))
 	{
-		status = current_transform->verify(current_transform);
+		status = current->verify(current);
 		if (status != SUCCESS)
 		{
 			DBG1(DBG_ENC, "TRANSFORM_SUBSTRUCTURE verification failed");
 			break;
 		}
 	}
-	iterator->destroy(iterator);
+	enumerator->destroy(enumerator);
 
 	/* proposal number is checked in SA payload */
 	return status;
 }
 
-/**
- * Implementation of payload_t.get_encoding_rules.
- */
-static void get_encoding_rules(private_proposal_substructure_t *this, encoding_rule_t **rules, size_t *rule_count)
+METHOD(payload_t, get_encoding_rules, void,
+	private_proposal_substructure_t *this, encoding_rule_t **rules,
+	size_t *rule_count)
 {
 	*rules = proposal_substructure_encodings;
-	*rule_count = sizeof(proposal_substructure_encodings) / sizeof(encoding_rule_t);
+	*rule_count = countof(proposal_substructure_encodings);
 }
 
-/**
- * Implementation of payload_t.get_type.
- */
-static payload_type_t get_type(private_proposal_substructure_t *this)
+METHOD(payload_t, get_type, payload_type_t,
+	private_proposal_substructure_t *this)
 {
 	return PROPOSAL_SUBSTRUCTURE;
 }
 
-/**
- * Implementation of payload_t.get_next_type.
- */
-static payload_type_t get_next_type(private_proposal_substructure_t *this)
+METHOD(payload_t, get_next_type, payload_type_t,
+	private_proposal_substructure_t *this)
 {
-	return (this->next_payload);
+	return this->next_payload;
 }
 
-/**
- * Implementation of payload_t.set_next_type.
- */
-static void set_next_type(private_proposal_substructure_t *this,payload_type_t type)
+METHOD(payload_t, set_next_type, void,
+	private_proposal_substructure_t *this, payload_type_t type)
 {
 }
 
@@ -250,145 +231,88 @@ static void compute_length(private_proposal_substructure_t *this)
 	this->proposal_length = length;
 }
 
-/**
- * Implementation of payload_t.get_length.
- */
-static size_t get_length(private_proposal_substructure_t *this)
+METHOD(payload_t, get_length, size_t,
+	private_proposal_substructure_t *this)
 {
 	compute_length(this);
 	return this->proposal_length;
 }
 
 /**
- * Implementation of proposal_substructure_t.create_transform_substructure_iterator.
- */
-static iterator_t *create_transform_substructure_iterator (private_proposal_substructure_t *this,bool forward)
-{
-	return (this->transforms->create_iterator(this->transforms,forward));
-}
-
-/**
- * Implementation of proposal_substructure_t.add_transform_substructure.
+ * Add a transform substructure to the proposal
  */
-static void add_transform_substructure (private_proposal_substructure_t *this,transform_substructure_t *transform)
+static void add_transform_substructure(private_proposal_substructure_t *this,
+									   transform_substructure_t *transform)
 {
-	status_t status;
 	if (this->transforms->get_count(this->transforms) > 0)
 	{
-		transform_substructure_t *last_transform;
-		status = this->transforms->get_last(this->transforms,(void **) &last_transform);
-		/* last transform is now not anymore last one */
-		last_transform->set_is_last_transform(last_transform,FALSE);
+		transform_substructure_t *last;
 
+		this->transforms->get_last(this->transforms, (void **)&last);
+		last->set_is_last_transform(last, FALSE);
 	}
 	transform->set_is_last_transform(transform,TRUE);
-
-	this->transforms->insert_last(this->transforms,(void *) transform);
+	this->transforms->insert_last(this->transforms, transform);
 	compute_length(this);
 }
 
-/**
- * Implementation of proposal_substructure_t.proposal_substructure_t.
- */
-static void set_is_last_proposal (private_proposal_substructure_t *this, bool is_last)
+METHOD(proposal_substructure_t, set_is_last_proposal, void,
+	private_proposal_substructure_t *this, bool is_last)
 {
-	this->next_payload = (is_last) ? 0: PROPOSAL_TYPE_VALUE;
+	this->next_payload = is_last ? 0 : PROPOSAL_TYPE_VALUE;
 }
 
-/**
- * Implementation of proposal_substructure_t.set_proposal_number.
- */
-static void set_proposal_number(private_proposal_substructure_t *this,u_int8_t proposal_number)
+METHOD(proposal_substructure_t, set_proposal_number, void,
+	private_proposal_substructure_t *this,u_int8_t proposal_number)
 {
 	this->proposal_number = proposal_number;
 }
 
-/**
- * Implementation of proposal_substructure_t.get_proposal_number.
- */
-static u_int8_t get_proposal_number (private_proposal_substructure_t *this)
+METHOD(proposal_substructure_t, get_proposal_number, u_int8_t,
+	private_proposal_substructure_t *this)
 {
-	return (this->proposal_number);
+	return this->proposal_number;
 }
 
-/**
- * Implementation of proposal_substructure_t.set_protocol_id.
- */
-static void set_protocol_id(private_proposal_substructure_t *this,u_int8_t protocol_id)
+METHOD(proposal_substructure_t, set_protocol_id, void,
+	private_proposal_substructure_t *this,u_int8_t protocol_id)
 {
 	this->protocol_id = protocol_id;
 }
 
-/**
- * Implementation of proposal_substructure_t.get_protocol_id.
- */
-static u_int8_t get_protocol_id(private_proposal_substructure_t *this)
+METHOD(proposal_substructure_t, get_protocol_id, u_int8_t,
+	private_proposal_substructure_t *this)
 {
-	return (this->protocol_id);
+	return this->protocol_id;
 }
 
-/**
- * Implementation of proposal_substructure_t.set_spi.
- */
-static void set_spi(private_proposal_substructure_t *this, chunk_t spi)
+METHOD(proposal_substructure_t, set_spi, void,
+	private_proposal_substructure_t *this, chunk_t spi)
 {
-	/* first delete already set spi value */
-	if (this->spi.ptr != NULL)
-	{
-		free(this->spi.ptr);
-		this->spi.ptr = NULL;
-		this->spi.len = 0;
-		compute_length(this);
-	}
-
-	this->spi.ptr = clalloc(spi.ptr,spi.len);
-	this->spi.len = spi.len;
+	free(this->spi.ptr);
+	this->spi = chunk_clone(spi);
 	this->spi_size = spi.len;
 	compute_length(this);
 }
 
-/**
- * Implementation of proposal_substructure_t.get_spi.
- */
-static chunk_t get_spi(private_proposal_substructure_t *this)
-{
-	chunk_t spi;
-	spi.ptr = this->spi.ptr;
-	spi.len = this->spi.len;
-
-	return spi;
-}
-
-/**
- * Implementation of proposal_substructure_t.get_transform_count.
- */
-static size_t get_transform_count (private_proposal_substructure_t *this)
-{
-	return this->transforms->get_count(this->transforms);
-}
-
-/**
- * Implementation of proposal_substructure_t.get_spi_size.
- */
-static size_t get_spi_size (private_proposal_substructure_t *this)
+METHOD(proposal_substructure_t, get_spi, chunk_t,
+	private_proposal_substructure_t *this)
 {
-	return this->spi.len;
+	return this->spi;
 }
 
-/**
- * Implementation of proposal_substructure_t.get_proposal.
- */
-proposal_t* get_proposal(private_proposal_substructure_t *this)
+METHOD(proposal_substructure_t, get_proposal, proposal_t*,
+	private_proposal_substructure_t *this)
 {
-	iterator_t *iterator;
+	enumerator_t *enumerator;
 	transform_substructure_t *transform;
 	proposal_t *proposal;
 	u_int64_t spi;
 
-	proposal = proposal_create(this->protocol_id);
+	proposal = proposal_create(this->protocol_id, this->proposal_number);
 
-	iterator = this->transforms->create_iterator(this->transforms, TRUE);
-	while (iterator->iterate(iterator, (void**)&transform))
+	enumerator = this->transforms->create_enumerator(this->transforms);
+	while (enumerator->enumerate(enumerator, &transform))
 	{
 		transform_type_t transform_type;
 		u_int16_t transform_id;
@@ -400,7 +324,7 @@ proposal_t* get_proposal(private_proposal_substructure_t *this)
 
 		proposal->add_algorithm(proposal, transform_type, transform_id, key_length);
 	}
-	iterator->destroy(iterator);
+	enumerator->destroy(enumerator);
 
 	switch (this->spi.len)
 	{
@@ -418,42 +342,36 @@ proposal_t* get_proposal(private_proposal_substructure_t *this)
 	return proposal;
 }
 
-/**
- * Implementation of proposal_substructure_t.clone.
- */
-static private_proposal_substructure_t* clone_(private_proposal_substructure_t *this)
+METHOD(proposal_substructure_t, clone_, proposal_substructure_t*,
+	private_proposal_substructure_t *this)
 {
 	private_proposal_substructure_t *clone;
-	iterator_t *transforms;
-	transform_substructure_t *current_transform;
+	enumerator_t *enumerator;
+	transform_substructure_t *current;
 
-	clone = (private_proposal_substructure_t *) proposal_substructure_create();
+	clone = (private_proposal_substructure_t*)proposal_substructure_create();
 	clone->next_payload = this->next_payload;
 	clone->proposal_number = this->proposal_number;
 	clone->protocol_id = this->protocol_id;
 	clone->spi_size = this->spi_size;
 	if (this->spi.ptr != NULL)
 	{
-		clone->spi.ptr = clalloc(this->spi.ptr,this->spi.len);
+		clone->spi.ptr = clalloc(this->spi.ptr, this->spi.len);
 		clone->spi.len = this->spi.len;
 	}
-
-	transforms = this->transforms->create_iterator(this->transforms,FALSE);
-	while (transforms->iterate(transforms, (void**)&current_transform))
+	enumerator = this->transforms->create_enumerator(this->transforms);
+	while (enumerator->enumerate(enumerator, &current))
 	{
-		current_transform = current_transform->clone(current_transform);
-		clone->public.add_transform_substructure(&clone->public, current_transform);
+		current = current->clone(current);
+		add_transform_substructure(clone, current);
 	}
-	transforms->destroy(transforms);
+	enumerator->destroy(enumerator);
 
-	return clone;
+	return &clone->public;
 }
 
-/**
- * Implements payload_t's and proposal_substructure_t's destroy function.
- * See #payload_s.destroy or proposal_substructure_s.destroy for description.
- */
-static void destroy(private_proposal_substructure_t *this)
+METHOD2(payload_t, proposal_substructure_t, destroy, void,
+	private_proposal_substructure_t *this)
 {
 	this->transforms->destroy_offset(this->transforms,
 									 offsetof(transform_substructure_t, destroy));
@@ -466,53 +384,42 @@ static void destroy(private_proposal_substructure_t *this)
  */
 proposal_substructure_t *proposal_substructure_create()
 {
-	private_proposal_substructure_t *this = malloc_thing(private_proposal_substructure_t);
-
-	/* interface functions */
-	this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
-	this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
-	this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length;
-	this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type;
-	this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
-	this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_type;
-	this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
-
-	/* public functions */
-	this->public.create_transform_substructure_iterator = (iterator_t* (*) (proposal_substructure_t *,bool)) create_transform_substructure_iterator;
-	this->public.add_transform_substructure = (void (*) (proposal_substructure_t *,transform_substructure_t *)) add_transform_substructure;
-	this->public.set_proposal_number = (void (*) (proposal_substructure_t *,u_int8_t))set_proposal_number;
-	this->public.get_proposal_number = (u_int8_t (*) (proposal_substructure_t *)) get_proposal_number;
-	this->public.set_protocol_id = (void (*) (proposal_substructure_t *,u_int8_t))set_protocol_id;
-	this->public.get_protocol_id = (u_int8_t (*) (proposal_substructure_t *)) get_protocol_id;
-	this->public.set_is_last_proposal = (void (*) (proposal_substructure_t *,bool)) set_is_last_proposal;
-	this->public.get_proposal = (proposal_t* (*) (proposal_substructure_t*))get_proposal;
-	this->public.set_spi = (void (*) (proposal_substructure_t *,chunk_t))set_spi;
-	this->public.get_spi = (chunk_t (*) (proposal_substructure_t *)) get_spi;
-	this->public.get_transform_count = (size_t (*) (proposal_substructure_t *)) get_transform_count;
-	this->public.get_spi_size = (size_t (*) (proposal_substructure_t *)) get_spi_size;
-	this->public.clone = (proposal_substructure_t * (*) (proposal_substructure_t *)) clone_;
-	this->public.destroy = (void (*) (proposal_substructure_t *)) destroy;
-
-	/* set default values of the fields */
-	this->next_payload = NO_PAYLOAD;
-	this->proposal_length = 0;
-	this->proposal_number = 0;
-	this->protocol_id = 0;
-	this->transforms_count = 0;
-	this->spi_size = 0;
-	this->spi.ptr = NULL;
-	this->spi.len = 0;
-
-	this->transforms = linked_list_create();
-
-	return (&(this->public));
+	private_proposal_substructure_t *this;
+
+	INIT(this,
+		.public = {
+			.payload_interface = {
+				.verify = _verify,
+				.get_encoding_rules = _get_encoding_rules,
+				.get_length = _get_length,
+				.get_next_type = _get_next_type,
+				.set_next_type = _set_next_type,
+				.get_type = _get_type,
+				.destroy = _destroy,
+			},
+			.set_proposal_number = _set_proposal_number,
+			.get_proposal_number = _get_proposal_number,
+			.set_protocol_id = _set_protocol_id,
+			.get_protocol_id = _get_protocol_id,
+			.set_is_last_proposal = _set_is_last_proposal,
+			.get_proposal = _get_proposal,
+			.set_spi = _set_spi,
+			.get_spi = _get_spi,
+			.clone = _clone_,
+			.destroy = _destroy,
+		},
+		.next_payload = NO_PAYLOAD,
+		.transforms = linked_list_create(),
+	);
+
+	return &this->public;
 }
 
 /*
  * Described in header.
  */
-proposal_substructure_t *proposal_substructure_create_from_proposal(proposal_t *proposal)
+proposal_substructure_t *proposal_substructure_create_from_proposal(
+														proposal_t *proposal)
 {
 	transform_substructure_t *transform;
 	private_proposal_substructure_t *this;
@@ -591,7 +498,7 @@ proposal_substructure_t *proposal_substructure_create_from_proposal(proposal_t *
 		default:
 			break;
 	}
-	this->proposal_number = 0;
+	this->proposal_number = proposal->get_number(proposal);
 	this->protocol_id = proposal->get_protocol(proposal);
 
 	return &this->public;
diff --git a/src/libcharon/encoding/payloads/proposal_substructure.h b/src/libcharon/encoding/payloads/proposal_substructure.h
index 4934802af..56e7184b6 100644
--- a/src/libcharon/encoding/payloads/proposal_substructure.h
+++ b/src/libcharon/encoding/payloads/proposal_substructure.h
@@ -42,36 +42,19 @@ typedef struct proposal_substructure_t proposal_substructure_t;
  * The PROPOSAL SUBSTRUCTURE format is described in RFC section 3.3.1.
  */
 struct proposal_substructure_t {
+
 	/**
 	 * The payload_t interface.
 	 */
 	payload_t payload_interface;
 
 	/**
-	 * Creates an iterator of stored transform_substructure_t objects.
-	 *
-	 * @param forward		iterator direction (TRUE: front to end)
-	 * @return				created iterator_t object
-	 */
-	iterator_t *(*create_transform_substructure_iterator) (
-								proposal_substructure_t *this, bool forward);
-
-	/**
-	 * Adds a transform_substructure_t object to this object.
-	 *
-	 * @param transform 	transform_substructure_t object to add
-	 */
-	void (*add_transform_substructure) (proposal_substructure_t *this,
-										transform_substructure_t *transform);
-
-	/**
 	 * Sets the proposal number of current proposal.
 	 *
 	 * @param id			proposal number to set
 	 */
 	void (*set_proposal_number) (proposal_substructure_t *this,
 								 u_int8_t proposal_number);
-
 	/**
 	 * get proposal number of current proposal.
 	 *
@@ -80,20 +63,6 @@ struct proposal_substructure_t {
 	u_int8_t (*get_proposal_number) (proposal_substructure_t *this);
 
 	/**
-	 * get the number of transforms in current proposal.
-	 *
-	 * @return 			transform count in current proposal
-	 */
-	size_t (*get_transform_count) (proposal_substructure_t *this);
-
-	/**
-	 * get size of the set spi in bytes.
-	 *
-	 * @return 			size of the spi in bytes
-	 */
-	size_t (*get_spi_size) (proposal_substructure_t *this);
-
-	/**
 	 * Sets the protocol id of current proposal.
 	 *
 	 * @param id		protocol id to set
diff --git a/src/libcharon/encoding/payloads/sa_payload.c b/src/libcharon/encoding/payloads/sa_payload.c
index 187a8fee0..4fbd4cac0 100644
--- a/src/libcharon/encoding/payloads/sa_payload.c
+++ b/src/libcharon/encoding/payloads/sa_payload.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005-2006 Martin Willi
+ * Copyright (C) 2005-2010 Martin Willi
  * Copyright (C) 2005 Jan Hutter
  * Hochschule fuer Technik Rapperswil
  *
@@ -27,9 +27,9 @@ typedef struct private_sa_payload_t private_sa_payload_t;
 
 /**
  * Private data of an sa_payload_t object.
- *
  */
 struct private_sa_payload_t {
+
 	/**
 	 * Public sa_payload_t interface.
 	 */
@@ -61,26 +61,25 @@ struct private_sa_payload_t {
  *
  * The defined offsets are the positions in a object of type
  * private_sa_payload_t.
- *
  */
 encoding_rule_t sa_payload_encodings[] = {
 	/* 1 Byte next payload type, stored in the field next_payload */
-	{ U_INT_8,		offsetof(private_sa_payload_t, next_payload) 			},
+	{ U_INT_8,			offsetof(private_sa_payload_t, next_payload)		},
 	/* the critical bit */
-	{ FLAG,			offsetof(private_sa_payload_t, critical) 				},
+	{ FLAG,				offsetof(private_sa_payload_t, critical)			},
 	/* 7 Bit reserved bits, nowhere stored */
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
+	{ RESERVED_BIT,		0													},
+	{ RESERVED_BIT,		0													},
+	{ RESERVED_BIT,		0													},
+	{ RESERVED_BIT,		0													},
+	{ RESERVED_BIT,		0													},
+	{ RESERVED_BIT,		0													},
+	{ RESERVED_BIT,		0													},
 	/* Length of the whole SA payload*/
-	{ PAYLOAD_LENGTH,		offsetof(private_sa_payload_t, payload_length) 	},
+	{ PAYLOAD_LENGTH,	offsetof(private_sa_payload_t, payload_length)		},
 	/* Proposals are stored in a proposal substructure,
 	   offset points to a linked_list_t pointer */
-	{ PROPOSALS,		offsetof(private_sa_payload_t, proposals) 				}
+	{ PROPOSALS,		offsetof(private_sa_payload_t, proposals)			},
 };
 
 /*
@@ -95,26 +94,23 @@ encoding_rule_t sa_payload_encodings[] = {
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 */
 
-/**
- * Implementation of payload_t.verify.
- */
-static status_t verify(private_sa_payload_t *this)
+METHOD(payload_t, verify, status_t,
+	private_sa_payload_t *this)
 {
 	int expected_number = 1, current_number;
 	status_t status = SUCCESS;
-	iterator_t *iterator;
-	proposal_substructure_t *current_proposal;
+	enumerator_t *enumerator;
+	proposal_substructure_t *substruct;
 	bool first = TRUE;
 
 	/* check proposal numbering */
-	iterator = this->proposals->create_iterator(this->proposals,TRUE);
-
-	while(iterator->iterate(iterator, (void**)&current_proposal))
+	enumerator = this->proposals->create_enumerator(this->proposals);
+	while (enumerator->enumerate(enumerator, (void**)&substruct))
 	{
-		current_number = current_proposal->get_proposal_number(current_proposal);
+		current_number = substruct->get_proposal_number(substruct);
 		if (current_number < expected_number)
 		{
-			if (current_number != (expected_number + 1))
+			if (current_number != expected_number + 1)
 			{
 				DBG1(DBG_ENC, "proposal number is %d, expected %d or %d",
 					 current_number, expected_number, expected_number + 1);
@@ -124,13 +120,12 @@ static status_t verify(private_sa_payload_t *this)
 		}
 		else if (current_number < expected_number)
 		{
-			/* must not be smaller then proceeding one */
-			DBG1(DBG_ENC, "proposal number smaller than that of previous proposal");
+			DBG1(DBG_ENC, "proposal number smaller than previous");
 			status = FAILED;
 			break;
 		}
 
-		status = current_proposal->payload_interface.verify(&(current_proposal->payload_interface));
+		status = substruct->payload_interface.verify(&substruct->payload_interface);
 		if (status != SUCCESS)
 		{
 			DBG1(DBG_ENC, "PROPOSAL_SUBSTRUCTURE verification failed");
@@ -139,52 +134,31 @@ static status_t verify(private_sa_payload_t *this)
 		first = FALSE;
 		expected_number = current_number;
 	}
-
-	iterator->destroy(iterator);
+	enumerator->destroy(enumerator);
 	return status;
 }
 
-
-/**
- * Implementation of payload_t.destroy and sa_payload_t.destroy.
- */
-static status_t destroy(private_sa_payload_t *this)
-{
-	this->proposals->destroy_offset(this->proposals,
-									offsetof(proposal_substructure_t, destroy));
-	free(this);
-	return SUCCESS;
-}
-
-/**
- * Implementation of payload_t.get_encoding_rules.
- */
-static void get_encoding_rules(private_sa_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
+METHOD(payload_t, get_encoding_rules, void,
+	private_sa_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
 {
 	*rules = sa_payload_encodings;
-	*rule_count = sizeof(sa_payload_encodings) / sizeof(encoding_rule_t);
+	*rule_count = countof(sa_payload_encodings);
 }
 
-/**
- * Implementation of payload_t.get_type.
- */
-static payload_type_t get_type(private_sa_payload_t *this)
+METHOD(payload_t, get_type, payload_type_t,
+	private_sa_payload_t *this)
 {
 	return SECURITY_ASSOCIATION;
 }
 
-/**
- * Implementation of payload_t.get_next_type.
- */
-static payload_type_t get_next_type(private_sa_payload_t *this)
+METHOD(payload_t, get_next_type, payload_type_t,
+	private_sa_payload_t *this)
 {
-	return (this->next_payload);
+	return this->next_payload;
 }
 
-/**
- * Implementation of payload_t.set_next_type.
- */
-static void set_next_type(private_sa_payload_t *this,payload_type_t type)
+METHOD(payload_t, set_next_type, void,
+	private_sa_payload_t *this,payload_type_t type)
 {
 	this->next_payload = type;
 }
@@ -192,116 +166,104 @@ static void set_next_type(private_sa_payload_t *this,payload_type_t type)
 /**
  * recompute length of the payload.
  */
-static void compute_length (private_sa_payload_t *this)
+static void compute_length(private_sa_payload_t *this)
 {
-	iterator_t *iterator;
-	payload_t *current_proposal;
+	enumerator_t *enumerator;
+	payload_t *current;
 	size_t length = SA_PAYLOAD_HEADER_LENGTH;
 
-	iterator = this->proposals->create_iterator(this->proposals,TRUE);
-	while (iterator->iterate(iterator, (void **)&current_proposal))
+	enumerator = this->proposals->create_enumerator(this->proposals);
+	while (enumerator->enumerate(enumerator, (void **)&current))
 	{
-		length += current_proposal->get_length(current_proposal);
+		length += current->get_length(current);
 	}
-	iterator->destroy(iterator);
+	enumerator->destroy(enumerator);
 
 	this->payload_length = length;
 }
 
-/**
- * Implementation of payload_t.get_length.
- */
-static size_t get_length(private_sa_payload_t *this)
+METHOD(payload_t, get_length, size_t,
+	private_sa_payload_t *this)
 {
 	compute_length(this);
 	return this->payload_length;
 }
 
-/**
- * Implementation of sa_payload_t.create_proposal_substructure_iterator.
- */
-static iterator_t *create_proposal_substructure_iterator (private_sa_payload_t *this,bool forward)
+METHOD(sa_payload_t, add_proposal, void,
+	private_sa_payload_t *this, proposal_t *proposal)
 {
-	return this->proposals->create_iterator(this->proposals,forward);
-}
+	proposal_substructure_t *substruct, *last;
+	u_int count;
 
-/**
- * Implementation of sa_payload_t.add_proposal_substructure.
- */
-static void add_proposal_substructure(private_sa_payload_t *this,proposal_substructure_t *proposal)
-{
-	status_t status;
-	u_int proposal_count = this->proposals->get_count(this->proposals);
-
-	if (proposal_count > 0)
+	count = this->proposals->get_count(this->proposals);
+	substruct = proposal_substructure_create_from_proposal(proposal);
+	if (count > 0)
 	{
-		proposal_substructure_t *last_proposal;
-		status = this->proposals->get_last(this->proposals,(void **) &last_proposal);
+		this->proposals->get_last(this->proposals, (void**)&last);
 		/* last transform is now not anymore last one */
-		last_proposal->set_is_last_proposal(last_proposal, FALSE);
+		last->set_is_last_proposal(last, FALSE);
+	}
+	substruct->set_is_last_proposal(substruct, TRUE);
+	if (proposal->get_number(proposal))
+	{	/* use the selected proposals number, if any */
+		substruct->set_proposal_number(substruct, proposal->get_number(proposal));
+	}
+	else
+	{
+		substruct->set_proposal_number(substruct, count + 1);
 	}
-	proposal->set_is_last_proposal(proposal, TRUE);
-	proposal->set_proposal_number(proposal, proposal_count + 1);
-	this->proposals->insert_last(this->proposals,(void *) proposal);
+	this->proposals->insert_last(this->proposals, substruct);
 	compute_length(this);
 }
 
-/**
- * Implementation of sa_payload_t.add_proposal.
- */
-static void add_proposal(private_sa_payload_t *this, proposal_t *proposal)
-{
-	proposal_substructure_t *substructure;
-
-	substructure = proposal_substructure_create_from_proposal(proposal);
-	add_proposal_substructure(this, substructure);
-}
-
-/**
- * Implementation of sa_payload_t.get_proposals.
- */
-static linked_list_t *get_proposals(private_sa_payload_t *this)
+METHOD(sa_payload_t, get_proposals, linked_list_t*,
+	private_sa_payload_t *this)
 {
 	int struct_number = 0;
 	int ignore_struct_number = 0;
-	iterator_t *iterator;
-	proposal_substructure_t *proposal_struct;
-	linked_list_t *proposal_list;
-
-	/* this list will hold our proposals */
-	proposal_list = linked_list_create();
+	enumerator_t *enumerator;
+	proposal_substructure_t *substruct;
+	linked_list_t *list;
+	proposal_t *proposal;
 
+	list = linked_list_create();
 	/* we do not support proposals split up to two proposal substructures, as
 	 * AH+ESP bundles are not supported in RFC4301 anymore.
 	 * To handle such structures safely, we just skip proposals with multiple
 	 * protocols.
 	 */
-	iterator = this->proposals->create_iterator(this->proposals, TRUE);
-	while (iterator->iterate(iterator, (void **)&proposal_struct))
+	enumerator = this->proposals->create_enumerator(this->proposals);
+	while (enumerator->enumerate(enumerator, &substruct))
 	{
-		proposal_t *proposal;
-
 		/* check if a proposal has a single protocol */
-		if (proposal_struct->get_proposal_number(proposal_struct) == struct_number)
+		if (substruct->get_proposal_number(substruct) == struct_number)
 		{
 			if (ignore_struct_number < struct_number)
 			{
-				/* remova an already added, if first of series */
-				proposal_list->remove_last(proposal_list, (void**)&proposal);
+				/* remove an already added, if first of series */
+				list->remove_last(list, (void**)&proposal);
 				proposal->destroy(proposal);
 				ignore_struct_number = struct_number;
 			}
 			continue;
 		}
 		struct_number++;
-		proposal = proposal_struct->get_proposal(proposal_struct);
+		proposal = substruct->get_proposal(substruct);
 		if (proposal)
 		{
-			proposal_list->insert_last(proposal_list, proposal);
+			list->insert_last(list, proposal);
 		}
 	}
-	iterator->destroy(iterator);
-	return proposal_list;
+	enumerator->destroy(enumerator);
+	return list;
+}
+
+METHOD2(payload_t, sa_payload_t, destroy, void,
+	private_sa_payload_t *this)
+{
+	this->proposals->destroy_offset(this->proposals,
+									offsetof(proposal_substructure_t, destroy));
+	free(this);
 }
 
 /*
@@ -309,29 +271,27 @@ static linked_list_t *get_proposals(private_sa_payload_t *this)
  */
 sa_payload_t *sa_payload_create()
 {
-	private_sa_payload_t *this = malloc_thing(private_sa_payload_t);
-
-	/* public interface */
-	this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
-	this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
-	this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length;
-	this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type;
-	this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
-	this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_type;
-	this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
-	/* public functions */
-	this->public.create_proposal_substructure_iterator = (iterator_t* (*) (sa_payload_t *,bool)) create_proposal_substructure_iterator;
-	this->public.add_proposal_substructure = (void (*) (sa_payload_t *,proposal_substructure_t *)) add_proposal_substructure;
-	this->public.add_proposal = (void (*) (sa_payload_t*,proposal_t*))add_proposal;
-	this->public.get_proposals = (linked_list_t* (*) (sa_payload_t *)) get_proposals;
-	this->public.destroy = (void (*) (sa_payload_t *)) destroy;
-
-	/* set default values of the fields */
-	this->critical = FALSE;
-	this->next_payload = NO_PAYLOAD;
-	this->payload_length = SA_PAYLOAD_HEADER_LENGTH;
-	this->proposals = linked_list_create();
+	private_sa_payload_t *this;
+
+	INIT(this,
+		.public = {
+			.payload_interface = {
+				.verify = _verify,
+				.get_encoding_rules = _get_encoding_rules,
+				.get_length = _get_length,
+				.get_next_type = _get_next_type,
+				.set_next_type = _set_next_type,
+				.get_type = _get_type,
+				.destroy = _destroy,
+			},
+			.add_proposal = _add_proposal,
+			.get_proposals = _get_proposals,
+			.destroy = _destroy,
+		},
+		.next_payload = NO_PAYLOAD,
+		.payload_length = SA_PAYLOAD_HEADER_LENGTH,
+		.proposals = linked_list_create(),
+	);
 	return &this->public;
 }
 
@@ -340,19 +300,19 @@ sa_payload_t *sa_payload_create()
  */
 sa_payload_t *sa_payload_create_from_proposal_list(linked_list_t *proposals)
 {
-	iterator_t *iterator;
+	private_sa_payload_t *this;
+	enumerator_t *enumerator;
 	proposal_t *proposal;
-	sa_payload_t *sa_payload = sa_payload_create();
 
-	/* add every payload from the list */
-	iterator = proposals->create_iterator(proposals, TRUE);
-	while (iterator->iterate(iterator, (void**)&proposal))
+	this = (private_sa_payload_t*)sa_payload_create();
+	enumerator = proposals->create_enumerator(proposals);
+	while (enumerator->enumerate(enumerator, &proposal))
 	{
-		add_proposal((private_sa_payload_t*)sa_payload, proposal);
+		add_proposal(this, proposal);
 	}
-	iterator->destroy(iterator);
+	enumerator->destroy(enumerator);
 
-	return sa_payload;
+	return &this->public;
 }
 
 /*
@@ -360,9 +320,10 @@ sa_payload_t *sa_payload_create_from_proposal_list(linked_list_t *proposals)
  */
 sa_payload_t *sa_payload_create_from_proposal(proposal_t *proposal)
 {
-	sa_payload_t *sa_payload = sa_payload_create();
+	private_sa_payload_t *this;
 
-	add_proposal((private_sa_payload_t*)sa_payload, proposal);
+	this = (private_sa_payload_t*)sa_payload_create();
+	add_proposal(this, proposal);
 
-	return sa_payload;
+	return &this->public;
 }
diff --git a/src/libcharon/encoding/payloads/sa_payload.h b/src/libcharon/encoding/payloads/sa_payload.h
index 25f5a2407..801a70738 100644
--- a/src/libcharon/encoding/payloads/sa_payload.h
+++ b/src/libcharon/encoding/payloads/sa_payload.h
@@ -40,33 +40,13 @@ typedef struct sa_payload_t sa_payload_t;
  * The SA Payload format is described in RFC section 3.3.
  */
 struct sa_payload_t {
+
 	/**
 	 * The payload_t interface.
 	 */
 	payload_t payload_interface;
 
 	/**
-	 * Creates an iterator of stored proposal_substructure_t objects.
-	 *
-	 * When deleting an proposal using this iterator,
-	 * the length of this transform substructure has to be refreshed
-	 * by calling get_length()!
-	 *
-	 * @param forward 		iterator direction (TRUE: front to end)
-	 * @return				created iterator_t object
-	 */
-	iterator_t *(*create_proposal_substructure_iterator) (sa_payload_t *this,
-														  bool forward);
-
-	/**
-	 * Adds a proposal_substructure_t object to this object.
-	 *
-	 * @param proposal  		proposal_substructure_t object to add
-	 */
-	void (*add_proposal_substructure) (sa_payload_t *this,
-									   proposal_substructure_t *proposal);
-
-	/**
 	 * Gets the proposals in this payload as a list.
 	 *
 	 * @return					a list containing proposal_t s