Imported Upstream version 4.5.1

37 files changed, 1755 insertions, 2576 deletions

diff --git a/src/libcharon/encoding/generator.c b/src/libcharon/encoding/generator.c
index 224f76fce..ce3844361 100644
--- a/src/libcharon/encoding/generator.c
+++ b/src/libcharon/encoding/generator.c
@@ -41,6 +41,7 @@
 #include <encoding/payloads/cp_payload.h>
 #include <encoding/payloads/configuration_attribute.h>
 #include <encoding/payloads/eap_payload.h>
+#include <encoding/payloads/unknown_payload.h>
 
 /**
  * Generating is done in a data buffer.
@@ -89,20 +90,10 @@ struct private_generator_t {
 	 */
 	void *data_struct;
 
-	/*
-	 * Last payload length position offset in the buffer.
-	 */
-	u_int32_t last_payload_length_position_offset;
-
 	/**
 	 * Offset of the header length field in the buffer.
 	 */
-	u_int32_t header_length_position_offset;
-
-	/**
-	 * Last SPI size.
-	 */
-	u_int8_t last_spi_size;
+	u_int32_t header_length_offset;
 
 	/**
 	 * Attribute format of the last generated transform attribute.
@@ -193,33 +184,6 @@ static void write_bytes_to_buffer(private_generator_t *this, void *bytes,
 }
 
 /**
- * Writes a specific amount of byte into the buffer at a specific offset.
- */
-static void write_bytes_to_buffer_at_offset(private_generator_t *this,
-						void *bytes, int number_of_bytes, u_int32_t offset)
-{
-	int i;
-	u_int8_t *read_position = (u_int8_t *)bytes;
-	u_int8_t *write_position;
-	u_int32_t free_space_after_offset = get_size(this) - offset;
-
-	/* check first if enough space for new data is available */
-	if (number_of_bytes > free_space_after_offset)
-	{
-		make_space_available(this,
-							 (number_of_bytes - free_space_after_offset) * 8);
-	}
-
-	write_position = this->buffer + offset;
-	for (i = 0; i < number_of_bytes; i++)
-	{
-		*write_position = *read_position;
-		read_position++;
-		write_position++;
-	}
-}
-
-/**
  * Generates a U_INT-Field type and writes it to buffer.
  */
 static void generate_u_int_type(private_generator_t *this,
@@ -234,10 +198,13 @@ static void generate_u_int_type(private_generator_t *this,
 			number_of_bits = 4;
 			break;
 		case TS_TYPE:
+		case RESERVED_BYTE:
+		case SPI_SIZE:
 		case U_INT_8:
 			number_of_bits = 8;
 			break;
 		case U_INT_16:
+		case PAYLOAD_LENGTH:
 		case CONFIGURATION_ATTRIBUTE_LENGTH:
 			number_of_bits = 16;
 			break;
@@ -301,6 +268,8 @@ static void generate_u_int_type(private_generator_t *this,
 			break;
 		}
 		case TS_TYPE:
+		case RESERVED_BYTE:
+		case SPI_SIZE:
 		case U_INT_8:
 		{
 			/* 8 bit values are written as they are */
@@ -338,6 +307,7 @@ static void generate_u_int_type(private_generator_t *this,
 
 		}
 		case U_INT_16:
+		case PAYLOAD_LENGTH:
 		case CONFIGURATION_ATTRIBUTE_LENGTH:
 		{
 			u_int16_t val = htons(*((u_int16_t*)(this->data_struct + offset)));
@@ -371,49 +341,6 @@ static void generate_u_int_type(private_generator_t *this,
 }
 
 /**
- * Generate a reserved bit or byte
- */
-static void generate_reserved_field(private_generator_t *this, int bits)
-{
-	/* only one bit or 8 bit fields are supported */
-	if (bits != 1 && bits != 8)
-	{
-		DBG1(DBG_ENC, "reserved field of %d bits cannot be generated", bits);
-		return ;
-	}
-	make_space_available(this, bits);
-
-	if (bits == 1)
-	{
-		u_int8_t reserved_bit = ~(1 << (7 - this->current_bit));
-
-		*(this->out_position) = *(this->out_position) & reserved_bit;
-		if (this->current_bit == 0)
-		{
-			/* memory must be zero */
-			*(this->out_position) = 0x00;
-		}
-		this->current_bit++;
-		if (this->current_bit >= 8)
-		{
-			this->current_bit = this->current_bit % 8;
-			this->out_position++;
-		}
-	}
-	else
-	{
-		if (this->current_bit > 0)
-		{
-			DBG1(DBG_ENC, "reserved field cannot be written cause "
-				 "alignement of current bit is %d", this->current_bit);
-			return;
-		}
-		*(this->out_position) = 0x00;
-		this->out_position++;
-	}
-}
-
-/**
  * Generate a FLAG filed
  */
 static void generate_flag(private_generator_t *this, u_int32_t offset)
@@ -468,7 +395,7 @@ METHOD(generator_t, get_chunk, chunk_t,
 {
 	chunk_t data;
 
-	*lenpos = (u_int32_t*)(this->buffer + this->header_length_position_offset);
+	*lenpos = (u_int32_t*)(this->buffer + this->header_length_offset);
 	data = chunk_create(this->buffer, get_length(this));
 	DBG3(DBG_ENC, "generated data of this generator %B", &data);
 	return data;
@@ -484,8 +411,6 @@ METHOD(generator_t, generate_payload, void,
 
 	this->data_struct = payload;
 	payload_type = payload->get_type(payload);
-	/* spi size has to get reseted */
-	this->last_spi_size = 0;
 
 	offset_start = this->out_position - this->buffer;
 
@@ -505,56 +430,25 @@ METHOD(generator_t, generate_payload, void,
 			case U_INT_8:
 			case U_INT_16:
 			case U_INT_32:
+			case PAYLOAD_LENGTH:
 			case IKE_SPI:
+			case RESERVED_BYTE:
+			case SPI_SIZE:
 			case TS_TYPE:
 			case ATTRIBUTE_TYPE:
 			case CONFIGURATION_ATTRIBUTE_LENGTH:
-			{
 				generate_u_int_type(this, rules[i].type, rules[i].offset);
 				break;
-			}
 			case RESERVED_BIT:
-			{
-				generate_reserved_field(this, 1);
-				break;
-			}
-			case RESERVED_BYTE:
-			{
-				generate_reserved_field(this, 8);
-				break;
-			}
 			case FLAG:
-			{
 				generate_flag(this, rules[i].offset);
 				break;
-			}
-			case PAYLOAD_LENGTH:
-			{
-				this->last_payload_length_position_offset = get_offset(this);
-				generate_u_int_type(this, U_INT_16,rules[i].offset);
-				break;
-			}
 			case HEADER_LENGTH:
-			{
-				this->header_length_position_offset = get_offset(this);
-				generate_u_int_type(this ,U_INT_32, rules[i].offset);
-				break;
-			}
-			case SPI_SIZE:
-				generate_u_int_type(this, U_INT_8, rules[i].offset);
-				this->last_spi_size = *((u_int8_t *)(this->data_struct +
-													 rules[i].offset));
+				this->header_length_offset = get_offset(this);
+				generate_u_int_type(this, U_INT_32, rules[i].offset);
 				break;
 			case ADDRESS:
-			{
-				generate_from_chunk(this, rules[i].offset);
-				break;
-			}
 			case SPI:
-			{
-				generate_from_chunk(this, rules[i].offset);
-				break;
-			}
 			case KEY_EXCHANGE_DATA:
 			case NOTIFICATION_DATA:
 			case NONCE_DATA:
@@ -566,221 +460,52 @@ METHOD(generator_t, generate_payload, void,
 			case CONFIGURATION_ATTRIBUTE_VALUE:
 			case VID_DATA:
 			case EAP_DATA:
-			{
-				u_int32_t payload_length_position_offset;
-				u_int16_t length_of_payload;
-				u_int16_t header_length = 0;
-				u_int16_t length_in_network_order;
-
-				switch(rules[i].type)
-				{
-					case KEY_EXCHANGE_DATA:
-						header_length = KE_PAYLOAD_HEADER_LENGTH;
-						break;
-					case NOTIFICATION_DATA:
-						header_length = NOTIFY_PAYLOAD_HEADER_LENGTH +
-														this->last_spi_size;
-						break;
-					case NONCE_DATA:
-						header_length = NONCE_PAYLOAD_HEADER_LENGTH;
-						break;
-					case ID_DATA:
-						header_length = ID_PAYLOAD_HEADER_LENGTH;
-						break;
-					case AUTH_DATA:
-						header_length = AUTH_PAYLOAD_HEADER_LENGTH;
-						break;
-					case CERT_DATA:
-						header_length = CERT_PAYLOAD_HEADER_LENGTH;
-						break;
-					case CERTREQ_DATA:
-						header_length = CERTREQ_PAYLOAD_HEADER_LENGTH;
-						break;
-					case SPIS:
-						header_length = DELETE_PAYLOAD_HEADER_LENGTH;
-						break;
-					case VID_DATA:
-						header_length = VENDOR_ID_PAYLOAD_HEADER_LENGTH;
-						break;
-					case CONFIGURATION_ATTRIBUTE_VALUE:
-						header_length = CONFIGURATION_ATTRIBUTE_HEADER_LENGTH;
-						break;
-					case EAP_DATA:
-						header_length = EAP_PAYLOAD_HEADER_LENGTH;
-						break;
-					default:
-						break;
-				}
+			case ENCRYPTED_DATA:
+			case UNKNOWN_DATA:
 				generate_from_chunk(this, rules[i].offset);
-
-				payload_length_position_offset =
-									this->last_payload_length_position_offset;
-
-				length_of_payload = header_length +
-						((chunk_t *)(this->data_struct + rules[i].offset))->len;
-
-				length_in_network_order = htons(length_of_payload);
-				write_bytes_to_buffer_at_offset(this, &length_in_network_order,
-							sizeof(u_int16_t), payload_length_position_offset);
 				break;
-			}
 			case PROPOSALS:
-			{
-				u_int32_t payload_length_position_offset =
-									this->last_payload_length_position_offset;
-				/* Length of SA_PAYLOAD is calculated */
-				u_int16_t length_of_sa_payload = SA_PAYLOAD_HEADER_LENGTH;
-				u_int16_t int16_val;
-				linked_list_t *proposals = *((linked_list_t **)
-										(this->data_struct + rules[i].offset));
-				iterator_t *iterator;
-				payload_t *current_proposal;
-
-				iterator = proposals->create_iterator(proposals,TRUE);
-				while (iterator->iterate(iterator, (void**)&current_proposal))
-				{
-					u_int32_t before_generate_position_offset;
-					u_int32_t after_generate_position_offset;
-
-					before_generate_position_offset = get_offset(this);
-					generate_payload(this, current_proposal);
-					after_generate_position_offset = get_offset(this);
-					length_of_sa_payload += (after_generate_position_offset -
-											 before_generate_position_offset);
-				}
-				iterator->destroy(iterator);
-
-				int16_val = htons(length_of_sa_payload);
-				write_bytes_to_buffer_at_offset(this, &int16_val,
-							sizeof(u_int16_t),payload_length_position_offset);
-				break;
-			}
 			case TRANSFORMS:
-			{
-				u_int32_t payload_length_position_offset =
-									this->last_payload_length_position_offset;
-				u_int16_t length_of_proposal =
-					PROPOSAL_SUBSTRUCTURE_HEADER_LENGTH + this->last_spi_size;
-				u_int16_t int16_val;
-				linked_list_t *transforms = *((linked_list_t **)
-										(this->data_struct + rules[i].offset));
-				iterator_t *iterator;
-				payload_t *current_transform;
-
-				iterator = transforms->create_iterator(transforms,TRUE);
-				while (iterator->iterate(iterator, (void**)&current_transform))
-				{
-					u_int32_t before_generate_position_offset;
-					u_int32_t after_generate_position_offset;
-
-					before_generate_position_offset = get_offset(this);
-					generate_payload(this, current_transform);
-					after_generate_position_offset = get_offset(this);
-
-					length_of_proposal += (after_generate_position_offset -
-										   before_generate_position_offset);
-				}
-				iterator->destroy(iterator);
-
-				int16_val = htons(length_of_proposal);
-				write_bytes_to_buffer_at_offset(this, &int16_val,
-							sizeof(u_int16_t), payload_length_position_offset);
-				break;
-			}
 			case TRANSFORM_ATTRIBUTES:
-			{
-				u_int32_t transform_length_position_offset =
-									this->last_payload_length_position_offset;
-				u_int16_t length_of_transform =
-									TRANSFORM_SUBSTRUCTURE_HEADER_LENGTH;
-				u_int16_t int16_val;
-				linked_list_t *transform_attributes =*((linked_list_t **)
-									(this->data_struct + rules[i].offset));
-				iterator_t *iterator;
-				payload_t *current_attribute;
-
-				iterator = transform_attributes->create_iterator(
-													transform_attributes, TRUE);
-				while (iterator->iterate(iterator, (void**)&current_attribute))
-				{
-					u_int32_t before_generate_position_offset;
-					u_int32_t after_generate_position_offset;
-
-					before_generate_position_offset = get_offset(this);
-					generate_payload(this, current_attribute);
-					after_generate_position_offset = get_offset(this);
-
-					length_of_transform += (after_generate_position_offset -
-											before_generate_position_offset);
-				}
-
-				iterator->destroy(iterator);
-
-				int16_val = htons(length_of_transform);
-				write_bytes_to_buffer_at_offset(this, &int16_val,
-							sizeof(u_int16_t),transform_length_position_offset);
-				break;
-			}
 			case CONFIGURATION_ATTRIBUTES:
+			case TRAFFIC_SELECTORS:
 			{
-				u_int32_t configurations_length_position_offset =
-									this->last_payload_length_position_offset;
-				u_int16_t length_of_configurations = CP_PAYLOAD_HEADER_LENGTH;
-				u_int16_t int16_val;
-				linked_list_t *configuration_attributes = *((linked_list_t **)
-										(this->data_struct + rules[i].offset));
-				iterator_t *iterator;
-				payload_t *current_attribute;
+				linked_list_t *proposals;
+				enumerator_t *enumerator;
+				payload_t *proposal;
 
-				iterator = configuration_attributes->create_iterator(
-												configuration_attributes,TRUE);
-				while (iterator->iterate(iterator, (void**)&current_attribute))
+				proposals = *((linked_list_t **)
+										(this->data_struct + rules[i].offset));
+				enumerator = proposals->create_enumerator(proposals);
+				while (enumerator->enumerate(enumerator, &proposal))
 				{
-					u_int32_t before_generate_position_offset;
-					u_int32_t after_generate_position_offset;
-
-					before_generate_position_offset = get_offset(this);
-					generate_payload(this, current_attribute);
-					after_generate_position_offset = get_offset(this);
-
-					length_of_configurations += after_generate_position_offset -
-											before_generate_position_offset;
+					generate_payload(this, proposal);
 				}
-
-				iterator->destroy(iterator);
-
-				int16_val = htons(length_of_configurations);
-				write_bytes_to_buffer_at_offset(this, &int16_val,
-					 sizeof(u_int16_t),configurations_length_position_offset);
+				enumerator->destroy(enumerator);
 				break;
 			}
 			case ATTRIBUTE_FORMAT:
-			{
 				generate_flag(this, rules[i].offset);
 				/* Attribute format is a flag which is stored in context*/
 				this->attribute_format =
 							*((bool *)(this->data_struct + rules[i].offset));
 				break;
-			}
-
 			case ATTRIBUTE_LENGTH_OR_VALUE:
-			{
-				if (this->attribute_format == FALSE)
+				if (this->attribute_format)
 				{
 					generate_u_int_type(this, U_INT_16, rules[i].offset);
-					/* this field hold the length of the attribute */
-					this->attribute_length =
-						*((u_int16_t *)(this->data_struct + rules[i].offset));
 				}
 				else
 				{
 					generate_u_int_type(this, U_INT_16, rules[i].offset);
+					/* this field hold the length of the attribute */
+					this->attribute_length =
+						*((u_int16_t *)(this->data_struct + rules[i].offset));
 				}
 				break;
-			}
 			case ATTRIBUTE_VALUE:
 			{
-				if (this->attribute_format == FALSE)
+				if (!this->attribute_format)
 				{
 					DBG2(DBG_ENC, "attribute value has not fixed size");
 					/* the attribute value is generated */
@@ -788,44 +513,6 @@ METHOD(generator_t, generate_payload, void,
 				}
 				break;
 			}
-			case TRAFFIC_SELECTORS:
-			{
-				u_int32_t payload_length_position_offset =
-									this->last_payload_length_position_offset;
-				u_int16_t length_of_ts_payload = TS_PAYLOAD_HEADER_LENGTH;
-				u_int16_t int16_val;
-				linked_list_t *traffic_selectors = *((linked_list_t **)
-										(this->data_struct + rules[i].offset));
-				iterator_t *iterator;
-				payload_t *current_tss;
-
-				iterator = traffic_selectors->create_iterator(
-													traffic_selectors,TRUE);
-				while (iterator->iterate(iterator, (void **)&current_tss))
-				{
-					u_int32_t before_generate_position_offset;
-					u_int32_t after_generate_position_offset;
-
-					before_generate_position_offset = get_offset(this);
-					generate_payload(this, current_tss);
-					after_generate_position_offset = get_offset(this);
-
-					length_of_ts_payload += (after_generate_position_offset -
-											 before_generate_position_offset);
-				}
-				iterator->destroy(iterator);
-
-				int16_val = htons(length_of_ts_payload);
-				write_bytes_to_buffer_at_offset(this, &int16_val,
-							sizeof(u_int16_t),payload_length_position_offset);
-				break;
-			}
-
-			case ENCRYPTED_DATA:
-			{
-				generate_from_chunk(this, rules[i].offset);
-				break;
-			}
 			default:
 				DBG1(DBG_ENC, "field type %N is not supported",
 					 encoding_type_names, rules[i].type);
diff --git a/src/libcharon/encoding/message.c b/src/libcharon/encoding/message.c
index d41ad4697..dbef340ab 100644
--- a/src/libcharon/encoding/message.c
+++ b/src/libcharon/encoding/message.c
@@ -131,6 +131,7 @@ static payload_rule_t ike_sa_init_r_rules[] = {
 	{SECURITY_ASSOCIATION,			1,	1,						FALSE,	FALSE},
 	{KEY_EXCHANGE,					1,	1,						FALSE,	FALSE},
 	{NONCE,							1,	1,						FALSE,	FALSE},
+	{CERTIFICATE_REQUEST,			1,	1,						FALSE,	FALSE},
 	{VENDOR_ID,						0,	10,						FALSE,	FALSE},
 };
 
@@ -490,6 +491,21 @@ struct private_message_t {
 	bool is_request;
 
 	/**
+	 * Higher version supported?
+	 */
+	bool version_flag;
+
+	/**
+	 * Reserved bits in IKE header
+	 */
+	bool reserved[5];
+
+	/**
+	 * Sorting of message disabled?
+	 */
+	bool sort_disabled;
+
+	/**
 	 * Message ID of this message.
 	 */
 	u_int32_t message_id;
@@ -647,18 +663,35 @@ METHOD(message_t, get_request, bool,
 	return this->is_request;
 }
 
-/**
- * Is this message in an encoded form?
- */
-static bool is_encoded(private_message_t *this)
+METHOD(message_t, set_version_flag, void,
+	private_message_t *this)
 {
-	chunk_t data = this->packet->get_data(this->packet);
+	this->version_flag = TRUE;
+}
 
-	if (data.ptr == NULL)
+METHOD(message_t, get_reserved_header_bit, bool,
+	private_message_t *this, u_int nr)
+{
+	if (nr < countof(this->reserved))
 	{
-		return FALSE;
+		return this->reserved[nr];
 	}
-	return TRUE;
+	return FALSE;
+}
+
+METHOD(message_t, set_reserved_header_bit, void,
+	private_message_t *this, u_int nr)
+{
+	if (nr < countof(this->reserved))
+	{
+		this->reserved[nr] = TRUE;
+	}
+}
+
+METHOD(message_t, is_encoded, bool,
+	private_message_t *this)
+{
+	return this->packet->get_data(this->packet).ptr != NULL;
 }
 
 METHOD(message_t, add_payload, void,
@@ -732,6 +765,12 @@ METHOD(message_t, create_payload_enumerator, enumerator_t*,
 	return this->payloads->create_enumerator(this->payloads);
 }
 
+METHOD(message_t, remove_payload_at, void,
+	private_message_t *this, enumerator_t *enumerator)
+{
+	this->payloads->remove_at(this->payloads, enumerator);
+}
+
 METHOD(message_t, get_payload, payload_t*,
 	private_message_t *this, payload_type_t type)
 {
@@ -1001,6 +1040,12 @@ static encryption_payload_t* wrap_payloads(private_message_t *this)
 	return encryption;
 }
 
+METHOD(message_t, disable_sort, void,
+	private_message_t *this)
+{
+	this->sort_disabled = TRUE;
+}
+
 METHOD(message_t, generate, status_t,
 	private_message_t *this, aead_t *aead, packet_t **packet)
 {
@@ -1012,12 +1057,8 @@ METHOD(message_t, generate, status_t,
 	chunk_t chunk;
 	char str[256];
 	u_int32_t *lenpos;
-
-	if (is_encoded(this))
-	{	/* already generated, return a new packet clone */
-		*packet = this->packet->clone(this->packet);
-		return SUCCESS;
-	}
+	bool *reserved;
+	int i;
 
 	if (this->exchange_type == EXCHANGE_TYPE_UNDEFINED)
 	{
@@ -1039,7 +1080,10 @@ METHOD(message_t, generate, status_t,
 		return NOT_SUPPORTED;
 	}
 
-	order_payloads(this);
+	if (!this->sort_disabled)
+	{
+		order_payloads(this);
+	}
 
 	DBG1(DBG_ENC, "generating %s", get_string(this, str, sizeof(str)));
 
@@ -1053,9 +1097,12 @@ METHOD(message_t, generate, status_t,
 	}
 
 	ike_header = ike_header_create();
+	ike_header->set_maj_version(ike_header, this->major_version);
+	ike_header->set_min_version(ike_header, this->minor_version);
 	ike_header->set_exchange_type(ike_header, this->exchange_type);
 	ike_header->set_message_id(ike_header, this->message_id);
 	ike_header->set_response_flag(ike_header, !this->is_request);
+	ike_header->set_version_flag(ike_header, this->version_flag);
 	ike_header->set_initiator_flag(ike_header,
 						this->ike_sa_id->is_initiator(this->ike_sa_id));
 	ike_header->set_initiator_spi(ike_header,
@@ -1063,6 +1110,16 @@ METHOD(message_t, generate, status_t,
 	ike_header->set_responder_spi(ike_header,
 						this->ike_sa_id->get_responder_spi(this->ike_sa_id));
 
+	for (i = 0; i < countof(this->reserved); i++)
+	{
+		reserved = payload_get_field(&ike_header->payload_interface,
+									 RESERVED_BIT, i);
+		if (reserved)
+		{
+			*reserved = this->reserved[i];
+		}
+	}
+
 	generator = generator_create();
 
 	/* generate all payloads with proper next type */
@@ -1131,6 +1188,8 @@ METHOD(message_t, parse_header, status_t,
 {
 	ike_header_t *ike_header;
 	status_t status;
+	bool *reserved;
+	int i;
 
 	DBG2(DBG_ENC, "parsing header of message");
 
@@ -1165,7 +1224,15 @@ METHOD(message_t, parse_header, status_t,
 	this->minor_version = ike_header->get_min_version(ike_header);
 	this->first_payload = ike_header->payload_interface.get_next_type(
 												&ike_header->payload_interface);
-
+	for (i = 0; i < countof(this->reserved); i++)
+	{
+		reserved = payload_get_field(&ike_header->payload_interface,
+									 RESERVED_BIT, i);
+		if (reserved)
+		{
+			this->reserved[i] = *reserved;
+		}
+	}
 	DBG2(DBG_ENC, "parsed a %N %s", exchange_type_names, this->exchange_type,
 		 this->is_request ? "request" : "response");
 
@@ -1182,6 +1249,31 @@ METHOD(message_t, parse_header, status_t,
 }
 
 /**
+ * Check if a payload is for a mediation extension connectivity check
+ */
+static bool is_connectivity_check(private_message_t *this, payload_t *payload)
+{
+#ifdef ME
+	if (this->exchange_type == INFORMATIONAL &&
+		payload->get_type(payload) == NOTIFY)
+	{
+		notify_payload_t *notify = (notify_payload_t*)payload;
+
+		switch (notify->get_notify_type(notify))
+		{
+			case ME_CONNECTID:
+			case ME_ENDPOINT:
+			case ME_CONNECTAUTH:
+				return TRUE;
+			default:
+				break;
+		}
+	}
+#endif /* !ME */
+	return FALSE;
+}
+
+/**
  * Decrypt payload from the encryption payload
  */
 static status_t decrypt_payloads(private_message_t *this, aead_t *aead)
@@ -1252,14 +1344,15 @@ static status_t decrypt_payloads(private_message_t *this, aead_t *aead)
 			}
 			encryption->destroy(encryption);
 		}
-		if (type != UNKNOWN_PAYLOAD && !was_encrypted)
+		if (payload_is_known(type) && !was_encrypted &&
+			!is_connectivity_check(this, payload))
 		{
 			rule = get_payload_rule(this, type);
 			if (!rule || rule->encrypted)
 			{
 				DBG1(DBG_ENC, "payload type %N was not encrypted",
 					 payload_type_names, type);
-				status = VERIFY_ERROR;
+				status = FAILED;
 				break;
 			}
 		}
@@ -1274,6 +1367,7 @@ static status_t decrypt_payloads(private_message_t *this, aead_t *aead)
  */
 static status_t verify(private_message_t *this)
 {
+	bool complete = FALSE;
 	int i;
 
 	DBG2(DBG_ENC, "verifying message structure");
@@ -1291,22 +1385,9 @@ static status_t verify(private_message_t *this)
 		while (enumerator->enumerate(enumerator, &payload))
 		{
 			payload_type_t type;
-			unknown_payload_t *unknown;
 
 			type = payload->get_type(payload);
-			if (type == UNKNOWN_PAYLOAD)
-			{
-				/* unknown payloads are ignored if they are not critical */
-				unknown = (unknown_payload_t*)payload;
-				if (unknown->is_critical(unknown))
-				{
-					DBG1(DBG_ENC, "%N is not supported, but its critical!",
-						 payload_type_names, type);
-					enumerator->destroy(enumerator);
-					return NOT_SUPPORTED;
-				}
-			}
-			else if (type == rule->type)
+			if (type == rule->type)
 			{
 				found++;
 				DBG2(DBG_ENC, "found payload of type %N",
@@ -1323,15 +1404,15 @@ static status_t verify(private_message_t *this)
 		}
 		enumerator->destroy(enumerator);
 
-		if (found < rule->min_occurence)
+		if (!complete && found < rule->min_occurence)
 		{
 			DBG1(DBG_ENC, "payload of type %N not occured %d times (%d)",
 				 payload_type_names, rule->type, rule->min_occurence, found);
 			return VERIFY_ERROR;
 		}
-		if (rule->sufficient)
+		if (found && rule->sufficient)
 		{
-			return SUCCESS;
+			complete = TRUE;
 		}
 	}
 	return SUCCESS;
@@ -1360,7 +1441,7 @@ METHOD(message_t, parse_body, status_t,
 		{
 			DBG1(DBG_ENC, "payload type %N could not be parsed",
 				 payload_type_names, type);
-			return PARSE_ERROR;
+			return this->exchange_type == IKE_SA_INIT ? PARSE_ERROR : FAILED;
 		}
 
 		DBG2(DBG_ENC, "verifying payload of type %N", payload_type_names, type);
@@ -1370,7 +1451,7 @@ METHOD(message_t, parse_body, status_t,
 			DBG1(DBG_ENC, "%N payload verification failed",
 				 payload_type_names, type);
 			payload->destroy(payload);
-			return VERIFY_ERROR;
+			return this->exchange_type == IKE_SA_INIT ? VERIFY_ERROR : FAILED;
 		}
 
 		DBG2(DBG_ENC, "%N payload verified. Adding to payload list",
@@ -1388,14 +1469,11 @@ METHOD(message_t, parse_body, status_t,
 		type = payload->get_next_type(payload);
 	}
 
-	if (type == ENCRYPTED)
+	status = decrypt_payloads(this, aead);
+	if (status != SUCCESS)
 	{
-		status = decrypt_payloads(this, aead);
-		if (status != SUCCESS)
-		{
-			DBG1(DBG_ENC, "could not decrypt payloads");
-			return status;
-		}
+		DBG1(DBG_ENC, "could not decrypt payloads");
+		return status;
 	}
 
 	status = verify(this);
@@ -1443,14 +1521,20 @@ message_t *message_create_from_packet(packet_t *packet)
 			.get_first_payload_type = _get_first_payload_type,
 			.set_request = _set_request,
 			.get_request = _get_request,
+			.set_version_flag = _set_version_flag,
+			.get_reserved_header_bit = _get_reserved_header_bit,
+			.set_reserved_header_bit = _set_reserved_header_bit,
 			.add_payload = _add_payload,
 			.add_notify = _add_notify,
+			.disable_sort = _disable_sort,
 			.generate = _generate,
+			.is_encoded = _is_encoded,
 			.set_source = _set_source,
 			.get_source = _get_source,
 			.set_destination = _set_destination,
 			.get_destination = _get_destination,
 			.create_payload_enumerator = _create_payload_enumerator,
+			.remove_payload_at = _remove_payload_at,
 			.get_payload = _get_payload,
 			.get_notify = _get_notify,
 			.parse_header = _parse_header,
@@ -1459,6 +1543,8 @@ message_t *message_create_from_packet(packet_t *packet)
 			.get_packet_data = _get_packet_data,
 			.destroy = _destroy,
 		},
+		.major_version = IKE_MAJOR_VERSION,
+		.minor_version = IKE_MINOR_VERSION,
 		.exchange_type = EXCHANGE_TYPE_UNDEFINED,
 		.is_request = TRUE,
 		.first_payload = NO_PAYLOAD,
diff --git a/src/libcharon/encoding/message.h b/src/libcharon/encoding/message.h
index 8c1cbcd09..51197308c 100644
--- a/src/libcharon/encoding/message.h
+++ b/src/libcharon/encoding/message.h
@@ -154,6 +154,26 @@ struct message_t {
 	bool (*get_request) (message_t *this);
 
 	/**
+	 * Set the version flag in the IKE header.
+	 */
+	void (*set_version_flag)(message_t *this);
+
+	/**
+	 * Get a reserved bit in the IKE header.
+	 *
+	 * @param nr			reserved bit to get in IKE header, 0-4
+	 * @return				TRUE if bit is set
+	 */
+	bool (*get_reserved_header_bit)(message_t *this, u_int nr);
+
+	/**
+	 * Set a reserved bit in the IKE header.
+	 *
+	 * @param nr			reserved bit to set in IKE header, 0-4
+	 */
+	void (*set_reserved_header_bit)(message_t *this, u_int nr);
+
+	/**
 	 * Append a payload to the message.
 	 *
 	 * If the payload must be encrypted is not specified here. Encryption
@@ -181,6 +201,11 @@ struct message_t {
 						chunk_t data);
 
 	/**
+	 * Disable automatic payload sorting for this message.
+	 */
+	void (*disable_sort)(message_t *this);
+
+	/**
 	 * Parses header of message.
 	 *
 	 * Begins parisng of a message created via message_create_from_packet().
@@ -206,8 +231,6 @@ struct message_t {
 	 * @param aead		aead transform to verify/decrypt message
 	 * @return
 	 * 					- SUCCESS if parsing successful
-	 * 					- NOT_SUPPORTED if ciritcal unknown payloads found
-	 * 					- NOT_SUPPORTED if message type is not supported!
 	 *					- PARSE_ERROR if message parsing failed
 	 * 					- VERIFY_ERROR if message verification failed (bad syntax)
 	 * 					- FAILED if integrity check failed
@@ -235,6 +258,13 @@ struct message_t {
 	status_t (*generate) (message_t *this, aead_t *aead, packet_t **packet);
 
 	/**
+	 * Check if the message has already been encoded using generate().
+	 *
+	 * @return			TRUE if message has been encoded
+	 */
+	bool (*is_encoded)(message_t *this);
+
+	/**
 	 * Gets the source host informations.
 	 *
 	 * @warning Returned host_t object is not getting cloned,
@@ -282,6 +312,13 @@ struct message_t {
 	enumerator_t * (*create_payload_enumerator) (message_t *this);
 
 	/**
+	 * Remove the payload at the current enumerator position.
+	 *
+	 * @param enumerator	enumerator created by create_payload_enumerator()
+	 */
+	void (*remove_payload_at)(message_t *this, enumerator_t *enumerator);
+
+	/**
 	 * Find a payload of a specific type.
 	 *
 	 * Returns the first occurance.
diff --git a/src/libcharon/encoding/parser.c b/src/libcharon/encoding/parser.c
index 9aa34b1bc..32cefb9e7 100644
--- a/src/libcharon/encoding/parser.c
+++ b/src/libcharon/encoding/parser.c
@@ -387,12 +387,6 @@ static status_t parse_payload(private_parser_t *this,
 	DBG3(DBG_ENC, "parsing payload from %b",
 		 this->byte_pos, this->input_roof - this->byte_pos);
 
-	if (pld->get_type(pld) == UNKNOWN_PAYLOAD)
-	{
-		DBG1(DBG_ENC, "  payload type %d is unknown, handling as %N",
-			 payload_type, payload_type_names, UNKNOWN_PAYLOAD);
-	}
-
 	/* base pointer for output, avoids casting in every rule */
 	output = pld;
 
@@ -415,6 +409,7 @@ static status_t parse_payload(private_parser_t *this,
 				break;
 			}
 			case U_INT_8:
+			case RESERVED_BYTE:
 			{
 				if (!parse_uint8(this, rule_number, output + rule->offset))
 				{
@@ -433,6 +428,7 @@ static status_t parse_payload(private_parser_t *this,
 				break;
 			}
 			case U_INT_32:
+			case HEADER_LENGTH:
 			{
 				if (!parse_uint32(this, rule_number, output + rule->offset))
 				{
@@ -451,23 +447,6 @@ static status_t parse_payload(private_parser_t *this,
 				break;
 			}
 			case RESERVED_BIT:
-			{
-				if (!parse_bit(this, rule_number, NULL))
-				{
-					pld->destroy(pld);
-					return PARSE_ERROR;
-				}
-				break;
-			}
-			case RESERVED_BYTE:
-			{
-				if (!parse_uint8(this, rule_number, NULL))
-				{
-					pld->destroy(pld);
-					return PARSE_ERROR;
-				}
-				break;
-			}
 			case FLAG:
 			{
 				if (!parse_bit(this, rule_number, output + rule->offset))
@@ -493,15 +472,6 @@ static status_t parse_payload(private_parser_t *this,
 				}
 				break;
 			}
-			case HEADER_LENGTH:
-			{
-				if (!parse_uint32(this, rule_number, output + rule->offset))
-				{
-					pld->destroy(pld);
-					return PARSE_ERROR;
-				}
-				break;
-			}
 			case SPI_SIZE:
 			{
 				if (!parse_uint8(this, rule_number, output + rule->offset))
diff --git a/src/libcharon/encoding/payloads/auth_payload.c b/src/libcharon/encoding/payloads/auth_payload.c
index d31208abb..cb44a997c 100644
--- a/src/libcharon/encoding/payloads/auth_payload.c
+++ b/src/libcharon/encoding/payloads/auth_payload.c
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2005-2006 Martin Willi
+ * Copyright (C) 2005-2010 Martin Willi
+ * Copyright (C) 2010 revosec AG
  * Copyright (C) 2005 Jan Hutter
  * Hochschule fuer Technik Rapperswil
  *
@@ -18,7 +19,6 @@
 
 #include <encoding/payloads/encodings.h>
 
-
 typedef struct private_auth_payload_t private_auth_payload_t;
 
 /**
@@ -43,6 +43,16 @@ struct private_auth_payload_t {
 	bool critical;
 
 	/**
+	 * Reserved bits
+	 */
+	bool reserved_bit[7];
+
+	/**
+	 * Reserved bytes
+	 */
+	u_int8_t reserved_byte[3];
+
+	/**
 	 * Length of this payload.
 	 */
 	u_int16_t payload_length;
@@ -66,27 +76,27 @@ struct private_auth_payload_t {
  */
 encoding_rule_t auth_payload_encodings[] = {
 	/* 1 Byte next payload type, stored in the field next_payload */
-	{ U_INT_8,			offsetof(private_auth_payload_t, next_payload) 	},
+	{ U_INT_8,			offsetof(private_auth_payload_t, next_payload)		},
 	/* the critical bit */
-	{ FLAG,				offsetof(private_auth_payload_t, critical) 		},
-	/* 7 Bit reserved bits, nowhere stored */
-	{ RESERVED_BIT,		0 												},
-	{ RESERVED_BIT,		0 												},
-	{ RESERVED_BIT,		0 												},
-	{ RESERVED_BIT,		0 												},
-	{ RESERVED_BIT,		0 												},
-	{ RESERVED_BIT,		0 												},
-	{ RESERVED_BIT,		0 												},
+	{ FLAG,				offsetof(private_auth_payload_t, critical)			},
+	/* 7 Bit reserved bits */
+	{ RESERVED_BIT,		offsetof(private_auth_payload_t, reserved_bit[0])	},
+	{ RESERVED_BIT,		offsetof(private_auth_payload_t, reserved_bit[1])	},
+	{ RESERVED_BIT,		offsetof(private_auth_payload_t, reserved_bit[2])	},
+	{ RESERVED_BIT,		offsetof(private_auth_payload_t, reserved_bit[3])	},
+	{ RESERVED_BIT,		offsetof(private_auth_payload_t, reserved_bit[4])	},
+	{ RESERVED_BIT,		offsetof(private_auth_payload_t, reserved_bit[5])	},
+	{ RESERVED_BIT,		offsetof(private_auth_payload_t, reserved_bit[6])	},
 	/* Length of the whole payload*/
-	{ PAYLOAD_LENGTH,	offsetof(private_auth_payload_t, payload_length)},
+	{ PAYLOAD_LENGTH,	offsetof(private_auth_payload_t, payload_length)	},
 	/* 1 Byte AUTH type*/
-	{ U_INT_8,			offsetof(private_auth_payload_t, auth_method)	},
+	{ U_INT_8,			offsetof(private_auth_payload_t, auth_method)		},
 	/* 3 reserved bytes */
-	{ RESERVED_BYTE,	0 												},
-	{ RESERVED_BYTE,	0 												},
-	{ RESERVED_BYTE,	0 												},
+	{ RESERVED_BYTE,	offsetof(private_auth_payload_t, reserved_byte[0])	},
+	{ RESERVED_BYTE,	offsetof(private_auth_payload_t, reserved_byte[1])	},
+	{ RESERVED_BYTE,	offsetof(private_auth_payload_t, reserved_byte[2])	},
 	/* some auth data bytes, length is defined in PAYLOAD_LENGTH */
-	{ AUTH_DATA,		offsetof(private_auth_payload_t, auth_data) 	}
+	{ AUTH_DATA,		offsetof(private_auth_payload_t, auth_data)	}
 };
 
 /*
@@ -103,125 +113,73 @@ encoding_rule_t auth_payload_encodings[] = {
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 */
 
-/**
- * Implementation of payload_t.verify.
- */
-static status_t verify(private_auth_payload_t *this)
+METHOD(payload_t, verify, status_t,
+	private_auth_payload_t *this)
 {
-	if (this->auth_method == 0 ||
-		(this->auth_method >= 4 && this->auth_method <= 8) ||
-		(this->auth_method >= 12 && this->auth_method <= 200))
-	{
-		/* reserved IDs */
-		return FAILED;
-	}
 	return SUCCESS;
 }
 
-/**
- * Implementation of auth_payload_t.get_encoding_rules.
- */
-static void get_encoding_rules(private_auth_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
+METHOD(payload_t, get_encoding_rules, void,
+	private_auth_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
 {
 	*rules = auth_payload_encodings;
-	*rule_count = sizeof(auth_payload_encodings) / sizeof(encoding_rule_t);
+	*rule_count = countof(auth_payload_encodings);
 }
 
-/**
- * Implementation of payload_t.get_type.
- */
-static payload_type_t get_payload_type(private_auth_payload_t *this)
+METHOD(payload_t, get_type, payload_type_t,
+	private_auth_payload_t *this)
 {
 	return AUTHENTICATION;
 }
 
-/**
- * Implementation of payload_t.get_next_type.
- */
-static payload_type_t get_next_type(private_auth_payload_t *this)
+METHOD(payload_t, get_next_type, payload_type_t,
+	private_auth_payload_t *this)
 {
-	return (this->next_payload);
+	return this->next_payload;
 }
 
-/**
- * Implementation of payload_t.set_next_type.
- */
-static void set_next_type(private_auth_payload_t *this,payload_type_t type)
+METHOD(payload_t, set_next_type, void,
+	private_auth_payload_t *this, payload_type_t type)
 {
 	this->next_payload = type;
 }
 
-/**
- * Implementation of payload_t.get_length.
- */
-static size_t get_length(private_auth_payload_t *this)
+METHOD(payload_t, get_length, size_t,
+	private_auth_payload_t *this)
 {
 	return this->payload_length;
 }
 
-/**
- * Implementation of auth_payload_t.set_auth_method.
- */
-static void set_auth_method (private_auth_payload_t *this, auth_method_t method)
+METHOD(auth_payload_t, set_auth_method, void,
+	private_auth_payload_t *this, auth_method_t method)
 {
 	this->auth_method = method;
 }
 
-/**
- * Implementation of auth_payload_t.get_auth_method.
- */
-static auth_method_t get_auth_method (private_auth_payload_t *this)
+METHOD(auth_payload_t, get_auth_method, auth_method_t,
+	private_auth_payload_t *this)
 {
-	return (this->auth_method);
+	return this->auth_method;
 }
 
-/**
- * Implementation of auth_payload_t.set_data.
- */
-static void set_data (private_auth_payload_t *this, chunk_t data)
+METHOD(auth_payload_t, set_data, void,
+	private_auth_payload_t *this, chunk_t data)
 {
-	if (this->auth_data.ptr != NULL)
-	{
-		chunk_free(&(this->auth_data));
-	}
-	this->auth_data.ptr = clalloc(data.ptr,data.len);
-	this->auth_data.len = data.len;
+	free(this->auth_data.ptr);
+	this->auth_data = chunk_clone(data);
 	this->payload_length = AUTH_PAYLOAD_HEADER_LENGTH + this->auth_data.len;
 }
 
-/**
- * Implementation of auth_payload_t.get_data.
- */
-static chunk_t get_data (private_auth_payload_t *this)
+METHOD(auth_payload_t, get_data, chunk_t,
+	private_auth_payload_t *this)
 {
-	return (this->auth_data);
+	return this->auth_data;
 }
 
-/**
- * Implementation of auth_payload_t.get_data_clone.
- */
-static chunk_t get_data_clone (private_auth_payload_t *this)
+METHOD2(payload_t, auth_payload_t, destroy, void,
+	private_auth_payload_t *this)
 {
-	chunk_t cloned_data;
-	if (this->auth_data.ptr == NULL)
-	{
-		return (this->auth_data);
-	}
-	cloned_data.ptr = clalloc(this->auth_data.ptr,this->auth_data.len);
-	cloned_data.len = this->auth_data.len;
-	return cloned_data;
-}
-
-/**
- * Implementation of payload_t.destroy and auth_payload_t.destroy.
- */
-static void destroy(private_auth_payload_t *this)
-{
-	if (this->auth_data.ptr != NULL)
-	{
-		chunk_free(&(this->auth_data));
-	}
-
+	free(this->auth_data.ptr);
 	free(this);
 }
 
@@ -230,30 +188,27 @@ static void destroy(private_auth_payload_t *this)
  */
 auth_payload_t *auth_payload_create()
 {
-	private_auth_payload_t *this = malloc_thing(private_auth_payload_t);
-
-	/* interface functions */
-	this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
-	this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
-	this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length;
-	this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type;
-	this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
-	this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_payload_type;
-	this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
-	/* public functions */
-	this->public.destroy = (void (*) (auth_payload_t *)) destroy;
-	this->public.set_auth_method = (void (*) (auth_payload_t *,auth_method_t)) set_auth_method;
-	this->public.get_auth_method = (auth_method_t (*) (auth_payload_t *)) get_auth_method;
-	this->public.set_data = (void (*) (auth_payload_t *,chunk_t)) set_data;
-	this->public.get_data_clone = (chunk_t (*) (auth_payload_t *)) get_data_clone;
-	this->public.get_data = (chunk_t (*) (auth_payload_t *)) get_data;
-
-	/* private variables */
-	this->critical = FALSE;
-	this->next_payload = NO_PAYLOAD;
-	this->payload_length =AUTH_PAYLOAD_HEADER_LENGTH;
-	this->auth_data = chunk_empty;
-
-	return (&(this->public));
+	private_auth_payload_t *this;
+
+	INIT(this,
+		.public = {
+			.payload_interface = {
+				.verify = _verify,
+				.get_encoding_rules = _get_encoding_rules,
+				.get_length = _get_length,
+				.get_next_type = _get_next_type,
+				.set_next_type = _set_next_type,
+				.get_type = _get_type,
+				.destroy = _destroy,
+			},
+			.set_auth_method = _set_auth_method,
+			.get_auth_method = _get_auth_method,
+			.set_data = _set_data,
+			.get_data = _get_data,
+			.destroy = _destroy,
+		},
+		.next_payload = NO_PAYLOAD,
+		.payload_length = AUTH_PAYLOAD_HEADER_LENGTH,
+	);
+	return &this->public;
 }
diff --git a/src/libcharon/encoding/payloads/auth_payload.h b/src/libcharon/encoding/payloads/auth_payload.h
index 37ee149db..e4c4e6ae3 100644
--- a/src/libcharon/encoding/payloads/auth_payload.h
+++ b/src/libcharon/encoding/payloads/auth_payload.h
@@ -62,29 +62,31 @@ struct auth_payload_t {
 	/**
 	 * Set the AUTH data.
 	 *
-	 * Data gets cloned.
-	 *
-	 * @param data			AUTH data as chunk_t
+	 * @param data			AUTH data as chunk_t, gets cloned
 	 */
 	void (*set_data) (auth_payload_t *this, chunk_t data);
 
 	/**
 	 * Get the AUTH data.
 	 *
-	 * Returned data are a copy of the internal one.
-	 *
-	 * @return				AUTH data as chunk_t
+	 * @return				AUTH data as chunk_t, internal data
 	 */
-	chunk_t (*get_data_clone) (auth_payload_t *this);
+	chunk_t (*get_data) (auth_payload_t *this);
 
 	/**
-	 * Get the AUTH data.
+	 * Get the value of a reserved bit.
 	 *
-	 * Returned data are NOT copied
+	 * @param nr			number of the reserved bit, 0-6
+	 * @return				TRUE if bit was set, FALSE to clear
+	 */
+	bool (*get_reserved_bit)(auth_payload_t *this, u_int nr);
+
+	/**
+	 * Set one of the reserved bits.
 	 *
-	 * @return				AUTH data as chunk_t
+	 * @param nr			number of the reserved bit, 0-6
 	 */
-	chunk_t (*get_data) (auth_payload_t *this);
+	void (*set_reserved_bit)(auth_payload_t *this, u_int nr);
 
 	/**
 	 * Destroys an auth_payload_t object.
diff --git a/src/libcharon/encoding/payloads/cert_payload.c b/src/libcharon/encoding/payloads/cert_payload.c
index 80239f654..c42cec680 100644
--- a/src/libcharon/encoding/payloads/cert_payload.c
+++ b/src/libcharon/encoding/payloads/cert_payload.c
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2008 Tobias Brunner
- * Copyright (C) 2005-2007 Martin Willi
+ * Copyright (C) 2005-2010 Martin Willi
+ * Copyright (C) 2010 revosec AG
  * Copyright (C) 2005 Jan Hutter
  * Hochschule fuer Technik Rapperswil
  *
@@ -43,9 +44,9 @@ typedef struct private_cert_payload_t private_cert_payload_t;
 
 /**
  * Private data of an cert_payload_t object.
- *
  */
 struct private_cert_payload_t {
+
 	/**
 	 * Public cert_payload_t interface.
 	 */
@@ -62,6 +63,11 @@ struct private_cert_payload_t {
 	bool critical;
 
 	/**
+	 * reserved bits
+	 */
+	bool reserved[7];
+
+	/**
 	 * Length of this payload.
 	 */
 	u_int16_t payload_length;
@@ -91,23 +97,23 @@ struct private_cert_payload_t {
  */
 encoding_rule_t cert_payload_encodings[] = {
 	/* 1 Byte next payload type, stored in the field next_payload */
-	{ U_INT_8,			offsetof(private_cert_payload_t, next_payload) 	},
+	{ U_INT_8,			offsetof(private_cert_payload_t, next_payload)	},
 	/* the critical bit */
-	{ FLAG,				offsetof(private_cert_payload_t, critical) 		},
+	{ FLAG,				offsetof(private_cert_payload_t, critical)		},
 	/* 7 Bit reserved bits, nowhere stored */
-	{ RESERVED_BIT,	0 													},
-	{ RESERVED_BIT,	0 													},
-	{ RESERVED_BIT,	0 													},
-	{ RESERVED_BIT,	0 													},
-	{ RESERVED_BIT,	0 													},
-	{ RESERVED_BIT,	0 													},
-	{ RESERVED_BIT,	0 													},
+	{ RESERVED_BIT,		offsetof(private_cert_payload_t, reserved[0])	},
+	{ RESERVED_BIT,		offsetof(private_cert_payload_t, reserved[1])	},
+	{ RESERVED_BIT,		offsetof(private_cert_payload_t, reserved[2])	},
+	{ RESERVED_BIT,		offsetof(private_cert_payload_t, reserved[3])	},
+	{ RESERVED_BIT,		offsetof(private_cert_payload_t, reserved[4])	},
+	{ RESERVED_BIT,		offsetof(private_cert_payload_t, reserved[5])	},
+	{ RESERVED_BIT,		offsetof(private_cert_payload_t, reserved[6])	},
 	/* Length of the whole payload*/
 	{ PAYLOAD_LENGTH,	offsetof(private_cert_payload_t, payload_length)},
 	/* 1 Byte CERT type*/
 	{ U_INT_8,			offsetof(private_cert_payload_t, encoding)		},
 	/* some cert data bytes, length is defined in PAYLOAD_LENGTH */
-	{ CERT_DATA,		offsetof(private_cert_payload_t, data) 			}
+	{ CERT_DATA,		offsetof(private_cert_payload_t, data)			}
 };
 
 /*
@@ -123,25 +129,23 @@ encoding_rule_t cert_payload_encodings[] = {
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 */
 
-/**
- * Implementation of payload_t.verify.
- */
-static status_t verify(private_cert_payload_t *this)
+METHOD(payload_t, verify, status_t,
+	private_cert_payload_t *this)
 {
 	if (this->encoding == ENC_X509_HASH_AND_URL ||
 		this->encoding == ENC_X509_HASH_AND_URL_BUNDLE)
 	{
+		int i;
+
 		/* coarse verification of "Hash and URL" encoded certificates */
 		if (this->data.len <= 20)
 		{
 			DBG1(DBG_ENC, "invalid payload length for hash-and-url (%d), ignore",
-					this->data.len);
+				 this->data.len);
 			this->invalid_hash_and_url = TRUE;
 			return SUCCESS;
 		}
-
-		int i = 20; /* skipping the hash */
-		for (; i < this->data.len; ++i)
+		for (i = 20; i < this->data.len; ++i)
 		{
 			if (this->data.ptr[i] == '\0')
 			{
@@ -151,94 +155,81 @@ static status_t verify(private_cert_payload_t *this)
 			else if (!isprint(this->data.ptr[i]))
 			{
 				DBG1(DBG_ENC, "non printable characters in url of hash-and-url"
-						" encoded certificate payload, ignore");
+					 " encoded certificate payload, ignore");
 				this->invalid_hash_and_url = TRUE;
 				return SUCCESS;
 			}
 		}
-
 		/* URL is not null terminated, correct that */
-		chunk_t data = chunk_alloc(this->data.len + 1);
-		memcpy(data.ptr, this->data.ptr, this->data.len);
-		data.ptr[this->data.len] = '\0';
-		chunk_free(&this->data);
-		this->data = data;
+		this->data = chunk_cat("mc", this->data, chunk_from_chars(0));
 	}
 	return SUCCESS;
 }
 
-/**
- * Implementation of cert_payload_t.get_encoding_rules.
- */
-static void get_encoding_rules(private_cert_payload_t *this,
-							   encoding_rule_t **rules, size_t *rule_count)
+METHOD(payload_t, get_encoding_rules, void,
+	private_cert_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
 {
 	*rules = cert_payload_encodings;
-	*rule_count = sizeof(cert_payload_encodings) / sizeof(encoding_rule_t);
+	*rule_count = countof(cert_payload_encodings);
 }
 
-/**
- * Implementation of payload_t.get_type.
- */
-static payload_type_t get_payload_type(private_cert_payload_t *this)
+METHOD(payload_t, get_type, payload_type_t,
+	private_cert_payload_t *this)
 {
 	return CERTIFICATE;
 }
 
-/**
- * Implementation of payload_t.get_next_type.
- */
-static payload_type_t get_next_type(private_cert_payload_t *this)
+METHOD(payload_t, get_next_type, payload_type_t,
+	private_cert_payload_t *this)
 {
 	return this->next_payload;
 }
 
-/**
- * Implementation of payload_t.set_next_type.
- */
-static void set_next_type(private_cert_payload_t *this,payload_type_t type)
+METHOD(payload_t, set_next_type, void,
+	private_cert_payload_t *this, payload_type_t type)
 {
 	this->next_payload = type;
 }
 
-/**
- * Implementation of payload_t.get_length.
- */
-static size_t get_length(private_cert_payload_t *this)
+METHOD(payload_t, get_length, size_t,
+	private_cert_payload_t *this)
 {
 	return this->payload_length;
 }
 
-/**
- * Implementation of cert_payload_t.get_cert_encoding.
- */
-static cert_encoding_t get_cert_encoding(private_cert_payload_t *this)
+METHOD(cert_payload_t, get_cert_encoding, cert_encoding_t,
+	private_cert_payload_t *this)
 {
 	return this->encoding;
 }
 
-/**
- * Implementation of cert_payload_t.get_cert.
- */
-static certificate_t *get_cert(private_cert_payload_t *this)
+METHOD(cert_payload_t, get_cert, certificate_t*,
+	private_cert_payload_t *this)
 {
-	if (this->encoding != ENC_X509_SIGNATURE)
+	int type;
+
+	switch (this->encoding)
 	{
-		return NULL;
+		case ENC_X509_SIGNATURE:
+			type = CERT_X509;
+			break;
+		case ENC_CRL:
+			type = CERT_X509_CRL;
+			break;
+		default:
+			return NULL;
 	}
-	return lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
-							  BUILD_BLOB_ASN1_DER, this->data,
-							  BUILD_END);
+	return lib->creds->create(lib->creds, CRED_CERTIFICATE, type,
+							  BUILD_BLOB_ASN1_DER, this->data, BUILD_END);
 }
 
-/**
- * Implementation of cert_payload_t.get_hash.
- */
-static chunk_t get_hash(private_cert_payload_t *this)
+METHOD(cert_payload_t, get_hash, chunk_t,
+	private_cert_payload_t *this)
 {
 	chunk_t hash = chunk_empty;
+
 	if ((this->encoding != ENC_X509_HASH_AND_URL &&
-		this->encoding != ENC_X509_HASH_AND_URL_BUNDLE) ||
+		 this->encoding != ENC_X509_HASH_AND_URL_BUNDLE) ||
 		this->invalid_hash_and_url)
 	{
 		return hash;
@@ -248,13 +239,11 @@ static chunk_t get_hash(private_cert_payload_t *this)
 	return hash;
 }
 
-/**
- * Implementation of cert_payload_t.get_url.
- */
-static char *get_url(private_cert_payload_t *this)
+METHOD(cert_payload_t, get_url, char*,
+	private_cert_payload_t *this)
 {
 	if ((this->encoding != ENC_X509_HASH_AND_URL &&
-		this->encoding != ENC_X509_HASH_AND_URL_BUNDLE) ||
+		 this->encoding != ENC_X509_HASH_AND_URL_BUNDLE) ||
 		this->invalid_hash_and_url)
 	{
 		return NULL;
@@ -262,12 +251,10 @@ static char *get_url(private_cert_payload_t *this)
 	return (char*)this->data.ptr + 20;
 }
 
-/**
- * Implementation of payload_t.destroy and cert_payload_t.destroy.
- */
-static void destroy(private_cert_payload_t *this)
+METHOD2(payload_t, cert_payload_t, destroy, void,
+	private_cert_payload_t *this)
 {
-	chunk_free(&this->data);
+	free(this->data.ptr);
 	free(this);
 }
 
@@ -276,29 +263,28 @@ static void destroy(private_cert_payload_t *this)
  */
 cert_payload_t *cert_payload_create()
 {
-	private_cert_payload_t *this = malloc_thing(private_cert_payload_t);
-
-	this->public.payload_interface.verify = (status_t (*) (payload_t*))verify;
-	this->public.payload_interface.get_encoding_rules = (void (*) (payload_t*,encoding_rule_t**, size_t*))get_encoding_rules;
-	this->public.payload_interface.get_length = (size_t (*) (payload_t*))get_length;
-	this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t*))get_next_type;
-	this->public.payload_interface.set_next_type = (void (*) (payload_t*,payload_type_t))set_next_type;
-	this->public.payload_interface.get_type = (payload_type_t (*) (payload_t*))get_payload_type;
-	this->public.payload_interface.destroy = (void (*) (payload_t*))destroy;
-
-	this->public.destroy = (void (*) (cert_payload_t*))destroy;
-	this->public.get_cert = (certificate_t* (*) (cert_payload_t*))get_cert;
-	this->public.get_cert_encoding = (cert_encoding_t (*) (cert_payload_t*))get_cert_encoding;
-	this->public.get_hash = (chunk_t (*) (cert_payload_t*))get_hash;
-	this->public.get_url = (char* (*) (cert_payload_t*))get_url;
-
-	this->critical = FALSE;
-	this->next_payload = NO_PAYLOAD;
-	this->payload_length = CERT_PAYLOAD_HEADER_LENGTH;
-	this->data = chunk_empty;
-	this->encoding = 0;
-	this->invalid_hash_and_url = FALSE;
-
+	private_cert_payload_t *this;
+
+	INIT(this,
+		.public = {
+			.payload_interface = {
+				.verify = _verify,
+				.get_encoding_rules = _get_encoding_rules,
+				.get_length = _get_length,
+				.get_next_type = _get_next_type,
+				.set_next_type = _set_next_type,
+				.get_type = _get_type,
+				.destroy = _destroy,
+			},
+			.get_cert = _get_cert,
+			.get_cert_encoding = _get_cert_encoding,
+			.get_hash = _get_hash,
+			.get_url = _get_url,
+			.destroy = _destroy,
+		},
+		.next_payload = NO_PAYLOAD,
+		.payload_length = CERT_PAYLOAD_HEADER_LENGTH,
+	);
 	return &this->public;
 }
 
@@ -343,3 +329,15 @@ cert_payload_t *cert_payload_create_from_hash_and_url(chunk_t hash, char *url)
 	return &this->public;
 }
 
+/*
+ * Described in header
+ */
+cert_payload_t *cert_payload_create_custom(cert_encoding_t type, chunk_t data)
+{
+	private_cert_payload_t *this = (private_cert_payload_t*)cert_payload_create();
+
+	this->encoding = type;
+	this->data = data;
+	this->payload_length = CERT_PAYLOAD_HEADER_LENGTH + this->data.len;
+	return &this->public;
+}
diff --git a/src/libcharon/encoding/payloads/cert_payload.h b/src/libcharon/encoding/payloads/cert_payload.h
index aa1c7bf5a..21b503a40 100644
--- a/src/libcharon/encoding/payloads/cert_payload.h
+++ b/src/libcharon/encoding/payloads/cert_payload.h
@@ -134,4 +134,13 @@ cert_payload_t *cert_payload_create_from_cert(certificate_t *cert);
  */
 cert_payload_t *cert_payload_create_from_hash_and_url(chunk_t hash, char *url);
 
+/**
+ * Creates a custom certificate payload using type and associated data.
+ *
+ * @param type				encoding type of certificate
+ * @param data				associated data (gets owned)
+ * @return					cert_payload_t object
+ */
+cert_payload_t *cert_payload_create_custom(cert_encoding_t type, chunk_t data);
+
 #endif /** CERT_PAYLOAD_H_ @}*/
diff --git a/src/libcharon/encoding/payloads/certreq_payload.c b/src/libcharon/encoding/payloads/certreq_payload.c
index 9ff0bdde0..8e0836f0e 100644
--- a/src/libcharon/encoding/payloads/certreq_payload.c
+++ b/src/libcharon/encoding/payloads/certreq_payload.c
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2005-2006 Martin Willi
+ * Copyright (C) 2005-2010 Martin Willi
+ * Copyright (C) 2010 revosec AG
  * Copyright (C) 2005 Jan Hutter
  * Hochschule fuer Technik Rapperswil
  *
@@ -22,14 +23,13 @@
 
 #include "certreq_payload.h"
 
-
 typedef struct private_certreq_payload_t private_certreq_payload_t;
 
 /**
  * Private data of an certreq_payload_t object.
- *
  */
 struct private_certreq_payload_t {
+
 	/**
 	 * Public certreq_payload_t interface.
 	 */
@@ -46,6 +46,11 @@ struct private_certreq_payload_t {
 	bool critical;
 
 	/**
+	 * Reserved bits
+	 */
+	bool reserved[7];
+
+	/**
 	 * Length of this payload.
 	 */
 	u_int16_t payload_length;
@@ -66,21 +71,20 @@ struct private_certreq_payload_t {
  *
  * The defined offsets are the positions in a object of type
  * private_certreq_payload_t.
- *
  */
 encoding_rule_t certreq_payload_encodings[] = {
 	/* 1 Byte next payload type, stored in the field next_payload */
-	{ U_INT_8,			offsetof(private_certreq_payload_t, next_payload) 	},
+	{ U_INT_8,			offsetof(private_certreq_payload_t, next_payload)	},
 	/* the critical bit */
-	{ FLAG,				offsetof(private_certreq_payload_t, critical) 		},
-	/* 7 Bit reserved bits, nowhere stored */
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
+	{ FLAG,				offsetof(private_certreq_payload_t, critical)		},
+	/* 7 Bit reserved bits */
+	{ RESERVED_BIT,		offsetof(private_certreq_payload_t, reserved[0])	},
+	{ RESERVED_BIT,		offsetof(private_certreq_payload_t, reserved[1])	},
+	{ RESERVED_BIT,		offsetof(private_certreq_payload_t, reserved[2])	},
+	{ RESERVED_BIT,		offsetof(private_certreq_payload_t, reserved[3])	},
+	{ RESERVED_BIT,		offsetof(private_certreq_payload_t, reserved[4])	},
+	{ RESERVED_BIT,		offsetof(private_certreq_payload_t, reserved[5])	},
+	{ RESERVED_BIT,		offsetof(private_certreq_payload_t, reserved[6])	},
 	/* Length of the whole payload*/
 	{ PAYLOAD_LENGTH,	offsetof(private_certreq_payload_t, payload_length)	},
 	/* 1 Byte CERTREQ type*/
@@ -102,10 +106,8 @@ encoding_rule_t certreq_payload_encodings[] = {
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 */
 
-/**
- * Implementation of payload_t.verify.
- */
-static status_t verify(private_certreq_payload_t *this)
+METHOD(payload_t, verify, status_t,
+	private_certreq_payload_t *this)
 {
 	if (this->encoding == ENC_X509_SIGNATURE)
 	{
@@ -120,51 +122,39 @@ static status_t verify(private_certreq_payload_t *this)
 	return SUCCESS;
 }
 
-/**
- * Implementation of certreq_payload_t.get_encoding_rules.
- */
-static void get_encoding_rules(private_certreq_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
+METHOD(payload_t, get_encoding_rules, void,
+	private_certreq_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
 {
 	*rules = certreq_payload_encodings;
-	*rule_count = sizeof(certreq_payload_encodings) / sizeof(encoding_rule_t);
+	*rule_count = countof(certreq_payload_encodings);
 }
 
-/**
- * Implementation of payload_t.get_type.
- */
-static payload_type_t get_payload_type(private_certreq_payload_t *this)
+METHOD(payload_t, get_type, payload_type_t,
+	private_certreq_payload_t *this)
 {
 	return CERTIFICATE_REQUEST;
 }
 
-/**
- * Implementation of payload_t.get_next_type.
- */
-static payload_type_t get_next_type(private_certreq_payload_t *this)
+METHOD(payload_t, get_next_type, payload_type_t,
+	private_certreq_payload_t *this)
 {
-	return (this->next_payload);
+	return this->next_payload;
 }
 
-/**
- * Implementation of payload_t.set_next_type.
- */
-static void set_next_type(private_certreq_payload_t *this,payload_type_t type)
+METHOD(payload_t, set_next_type, void,
+	private_certreq_payload_t *this, payload_type_t type)
 {
 	this->next_payload = type;
 }
 
-/**
- * Implementation of payload_t.get_length.
- */
-static size_t get_length(private_certreq_payload_t *this)
+METHOD(payload_t, get_length, size_t,
+	private_certreq_payload_t *this)
 {
 	return this->payload_length;
 }
 
-/**
- * Implementation of certreq_payload_t.add_keyid.
- */
-static void add_keyid(private_certreq_payload_t *this, chunk_t keyid)
+METHOD(certreq_payload_t, add_keyid, void,
+	private_certreq_payload_t *this, chunk_t keyid)
 {
 	this->data = chunk_cat("mc", this->data, keyid);
 	this->payload_length += keyid.len;
@@ -181,10 +171,8 @@ struct keyid_enumerator_t  {
 	u_char *pos;
 };
 
-/**
- * enumerate function for keyid_enumerator
- */
-static bool keyid_enumerate(keyid_enumerator_t *this, chunk_t *chunk)
+METHOD(enumerator_t, keyid_enumerate, bool,
+	keyid_enumerator_t *this, chunk_t *chunk)
 {
 	if (this->pos == NULL)
 	{
@@ -207,23 +195,23 @@ static bool keyid_enumerate(keyid_enumerator_t *this, chunk_t *chunk)
 	return FALSE;
 }
 
-/**
- * Implementation of certreq_payload_t.create_keyid_enumerator.
- */
-static enumerator_t* create_keyid_enumerator(private_certreq_payload_t *this)
+METHOD(certreq_payload_t, create_keyid_enumerator, enumerator_t*,
+	private_certreq_payload_t *this)
 {
-	keyid_enumerator_t *enumerator = malloc_thing(keyid_enumerator_t);
-	enumerator->public.enumerate = (void*)keyid_enumerate;
-	enumerator->public.destroy = (void*)free;
-	enumerator->full = this->data;
-	enumerator->pos = NULL;
+	keyid_enumerator_t *enumerator;
+
+	INIT(enumerator,
+		.public = {
+			.enumerate = (void*)_keyid_enumerate,
+			.destroy = (void*)free,
+		},
+		.full = this->data,
+	);
 	return &enumerator->public;
 }
 
-/**
- * Implementation of certreq_payload_t.get_cert_type.
- */
-static certificate_type_t get_cert_type(private_certreq_payload_t *this)
+METHOD(certreq_payload_t, get_cert_type, certificate_type_t,
+	private_certreq_payload_t *this)
 {
 	switch (this->encoding)
 	{
@@ -234,10 +222,8 @@ static certificate_type_t get_cert_type(private_certreq_payload_t *this)
 	}
 }
 
-/**
- * Implementation of payload_t.destroy and certreq_payload_t.destroy.
- */
-static void destroy(private_certreq_payload_t *this)
+METHOD2(payload_t, certreq_payload_t, destroy, void,
+	private_certreq_payload_t *this)
 {
 	chunk_free(&this->data);
 	free(this);
@@ -248,30 +234,27 @@ static void destroy(private_certreq_payload_t *this)
  */
 certreq_payload_t *certreq_payload_create()
 {
-	private_certreq_payload_t *this = malloc_thing(private_certreq_payload_t);
-
-	/* interface functions */
-	this->public.payload_interface.verify = (status_t (*) (payload_t*))verify;
-	this->public.payload_interface.get_encoding_rules = (void (*) (payload_t*,encoding_rule_t**,size_t*))get_encoding_rules;
-	this->public.payload_interface.get_length = (size_t (*) (payload_t*))get_length;
-	this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t*))get_next_type;
-	this->public.payload_interface.set_next_type = (void (*) (payload_t*,payload_type_t))set_next_type;
-	this->public.payload_interface.get_type = (payload_type_t (*) (payload_t*))get_payload_type;
-	this->public.payload_interface.destroy = (void (*) (payload_t*))destroy;
-
-	/* public functions */
-	this->public.destroy = (void (*) (certreq_payload_t*)) destroy;
-	this->public.create_keyid_enumerator = (enumerator_t*(*)(certreq_payload_t*))create_keyid_enumerator;
-		this->public.get_cert_type = (certificate_type_t(*)(certreq_payload_t*))get_cert_type;
-	this->public.add_keyid = (void(*)(certreq_payload_t*, chunk_t keyid))add_keyid;
-
-	/* private variables */
-	this->critical = FALSE;
-	this->next_payload = NO_PAYLOAD;
-	this->payload_length = CERTREQ_PAYLOAD_HEADER_LENGTH;
-	this->data = chunk_empty;
-	this->encoding = 0;
-
+	private_certreq_payload_t *this;
+
+	INIT(this,
+		.public = {
+			.payload_interface = {
+				.verify = _verify,
+				.get_encoding_rules = _get_encoding_rules,
+				.get_length = _get_length,
+				.get_next_type = _get_next_type,
+				.set_next_type = _set_next_type,
+				.get_type = _get_type,
+				.destroy = _destroy,
+			},
+			.create_keyid_enumerator = _create_keyid_enumerator,
+			.get_cert_type = _get_cert_type,
+			.add_keyid = _add_keyid,
+			.destroy = _destroy,
+		},
+		.next_payload = NO_PAYLOAD,
+		.payload_length = CERTREQ_PAYLOAD_HEADER_LENGTH,
+	);
 	return &this->public;
 }
 
diff --git a/src/libcharon/encoding/payloads/configuration_attribute.c b/src/libcharon/encoding/payloads/configuration_attribute.c
index 9094fd44d..e608497bd 100644
--- a/src/libcharon/encoding/payloads/configuration_attribute.c
+++ b/src/libcharon/encoding/payloads/configuration_attribute.c
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2005-2009 Martin Willi
+ * Copyright (C) 2005-2010 Martin Willi
+ * Copyright (C) 2010 revosec AG
  * Copyright (C) 2005 Jan Hutter
  * Hochschule fuer Technik Rapperswil
  *
@@ -22,20 +23,24 @@
 #include <library.h>
 #include <daemon.h>
 
-
 typedef struct private_configuration_attribute_t private_configuration_attribute_t;
 
 /**
  * Private data of an configuration_attribute_t object.
- *
  */
 struct private_configuration_attribute_t {
+
 	/**
 	 * Public configuration_attribute_t interface.
 	 */
 	configuration_attribute_t public;
 
 	/**
+	 * Reserved bit
+	 */
+	bool reserved;
+
+	/**
 	 * Type of the attribute.
 	 */
 	u_int16_t type;
@@ -58,8 +63,8 @@ struct private_configuration_attribute_t {
  * private_configuration_attribute_t.
  */
 encoding_rule_t configuration_attribute_encodings[] = {
-
-	{ RESERVED_BIT,						0													},
+	/* 1 reserved bit */
+	{ RESERVED_BIT,						offsetof(private_configuration_attribute_t, reserved)},
 	/* type of the attribute as 15 bit unsigned integer */
 	{ ATTRIBUTE_TYPE,					offsetof(private_configuration_attribute_t, type)	},
 	/* Length of attribute value */
@@ -80,10 +85,8 @@ encoding_rule_t configuration_attribute_encodings[] = {
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 */
 
-/**
- * Implementation of payload_t.verify.
- */
-static status_t verify(private_configuration_attribute_t *this)
+METHOD(payload_t, verify, status_t,
+	private_configuration_attribute_t *this)
 {
 	bool failed = FALSE;
 
@@ -151,69 +154,51 @@ static status_t verify(private_configuration_attribute_t *this)
 	return SUCCESS;
 }
 
-/**
- * Implementation of payload_t.get_encoding_rules.
- */
-static void get_encoding_rules(private_configuration_attribute_t *this,
-							   encoding_rule_t **rules, size_t *rule_count)
+METHOD(payload_t, get_encoding_rules, void,
+	private_configuration_attribute_t *this, encoding_rule_t **rules,
+	size_t *rule_count)
 {
 	*rules = configuration_attribute_encodings;
-	*rule_count = sizeof(configuration_attribute_encodings) / sizeof(encoding_rule_t);
+	*rule_count = countof(configuration_attribute_encodings);
 }
 
-/**
- * Implementation of payload_t.get_type.
- */
-static payload_type_t get_type(private_configuration_attribute_t *this)
+METHOD(payload_t, get_type, payload_type_t,
+	private_configuration_attribute_t *this)
 {
 	return CONFIGURATION_ATTRIBUTE;
 }
 
-/**
- * Implementation of payload_t.get_next_type.
- */
-static payload_type_t get_next_type(private_configuration_attribute_t *this)
+METHOD(payload_t, get_next_type, payload_type_t,
+	private_configuration_attribute_t *this)
 {
 	return NO_PAYLOAD;
 }
 
-/**
- * Implementation of payload_t.set_next_type.
- */
-static void set_next_type(private_configuration_attribute_t *this,
-						  payload_type_t type)
+METHOD(payload_t, set_next_type, void,
+	private_configuration_attribute_t *this, payload_type_t type)
 {
 }
 
-/**
- * Implementation of configuration_attribute_t.get_length.
- */
-static size_t get_length(private_configuration_attribute_t *this)
+METHOD(payload_t, get_length, size_t,
+	private_configuration_attribute_t *this)
 {
 	return this->value.len + CONFIGURATION_ATTRIBUTE_HEADER_LENGTH;
 }
 
-/**
- * Implementation of configuration_attribute_t.get_type.
- */
-static configuration_attribute_type_t get_configuration_attribute_type(
-									private_configuration_attribute_t *this)
+METHOD(configuration_attribute_t, get_cattr_type, configuration_attribute_type_t,
+	private_configuration_attribute_t *this)
 {
 	return this->type;
 }
 
-/**
- * Implementation of configuration_attribute_t.get_value.
- */
-static chunk_t get_value(private_configuration_attribute_t *this)
+METHOD(configuration_attribute_t, get_value, chunk_t,
+	private_configuration_attribute_t *this)
 {
 	return this->value;
 }
 
-/**
- * Implementation of configuration_attribute_t.destroy and payload_t.destroy.
- */
-static void destroy(private_configuration_attribute_t *this)
+METHOD2(payload_t, configuration_attribute_t, destroy, void,
+	private_configuration_attribute_t *this)
 {
 	free(this->value.ptr);
 	free(this);
@@ -226,23 +211,22 @@ configuration_attribute_t *configuration_attribute_create()
 {
 	private_configuration_attribute_t *this;
 
-	this = malloc_thing(private_configuration_attribute_t);
-	this->public.payload_interface.verify = (status_t(*)(payload_t *))verify;
-	this->public.payload_interface.get_encoding_rules = (void(*)(payload_t *, encoding_rule_t **, size_t *) )get_encoding_rules;
-	this->public.payload_interface.get_length = (size_t(*)(payload_t *))get_length;
-	this->public.payload_interface.get_next_type = (payload_type_t(*)(payload_t *))get_next_type;
-	this->public.payload_interface.set_next_type = (void(*)(payload_t *,payload_type_t))set_next_type;
-	this->public.payload_interface.get_type = (payload_type_t(*)(payload_t *))get_type;
-	this->public.payload_interface.destroy = (void(*)(payload_t*))destroy;
-
-	this->public.get_value = (chunk_t(*)(configuration_attribute_t *))get_value;
-	this->public.get_type = (configuration_attribute_type_t(*)(configuration_attribute_t *))get_configuration_attribute_type;
-	this->public.destroy = (void (*)(configuration_attribute_t*))destroy;
-
-	this->type = 0;
-	this->value = chunk_empty;
-	this->length = 0;
-
+	INIT(this,
+		.public = {
+			.payload_interface = {
+				.verify = _verify,
+				.get_encoding_rules = _get_encoding_rules,
+				.get_length = _get_length,
+				.get_next_type = _get_next_type,
+				.set_next_type = _set_next_type,
+				.get_type = _get_type,
+				.destroy = _destroy,
+			},
+			.get_value = _get_value,
+			.get_type = _get_cattr_type,
+			.destroy = _destroy,
+		},
+	);
 	return &this->public;
 }
 
diff --git a/src/libcharon/encoding/payloads/cp_payload.c b/src/libcharon/encoding/payloads/cp_payload.c
index f0a26eee2..82e9e51b7 100644
--- a/src/libcharon/encoding/payloads/cp_payload.c
+++ b/src/libcharon/encoding/payloads/cp_payload.c
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2005-2009 Martin Willi
+ * Copyright (C) 2005-2010 Martin Willi
+ * Copyright (C) 2010 revosec AG
  * Copyright (C) 2005 Jan Hutter
  * Hochschule fuer Technik Rapperswil
  *
@@ -32,9 +33,9 @@ typedef struct private_cp_payload_t private_cp_payload_t;
 
 /**
  * Private data of an cp_payload_t object.
- *
  */
 struct private_cp_payload_t {
+
 	/**
 	 * Public cp_payload_t interface.
 	 */
@@ -51,6 +52,16 @@ struct private_cp_payload_t {
 	bool critical;
 
 	/**
+	 * Reserved bits
+	 */
+	bool reserved_bit[7];
+
+	/**
+	 * Reserved bytes
+	 */
+	u_int8_t reserved_byte[3];
+
+	/**
 	 * Length of this payload.
 	 */
 	u_int16_t payload_length;
@@ -71,30 +82,30 @@ struct private_cp_payload_t {
  *
  * The defined offsets are the positions in a object of type
  * private_cp_payload_t.
- *
  */
 encoding_rule_t cp_payload_encodings[] = {
 	/* 1 Byte next payload type, stored in the field next_payload */
-	{ U_INT_8,		offsetof(private_cp_payload_t, next_payload) 			},
+	{ U_INT_8,					offsetof(private_cp_payload_t, next_payload)	},
 	/* the critical bit */
-	{ FLAG,			offsetof(private_cp_payload_t, critical) 				},
-	/* 7 Bit reserved bits, nowhere stored */
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
+	{ FLAG,						offsetof(private_cp_payload_t, critical)		},
+	/* 7 Bit reserved bits */
+	{ RESERVED_BIT,				offsetof(private_cp_payload_t, reserved_bit[0])	},
+	{ RESERVED_BIT,				offsetof(private_cp_payload_t, reserved_bit[1])	},
+	{ RESERVED_BIT,				offsetof(private_cp_payload_t, reserved_bit[2])	},
+	{ RESERVED_BIT,				offsetof(private_cp_payload_t, reserved_bit[3])	},
+	{ RESERVED_BIT,				offsetof(private_cp_payload_t, reserved_bit[4])	},
+	{ RESERVED_BIT,				offsetof(private_cp_payload_t, reserved_bit[5])	},
+	{ RESERVED_BIT,				offsetof(private_cp_payload_t, reserved_bit[6])	},
 	/* Length of the whole CP payload*/
-	{ PAYLOAD_LENGTH,		offsetof(private_cp_payload_t, payload_length) 	},
+	{ PAYLOAD_LENGTH,			offsetof(private_cp_payload_t, payload_length)	},
 	/* Proposals are stored in a proposal substructure,
 	   offset points to a linked_list_t pointer */
-	{ U_INT_8,				offsetof(private_cp_payload_t, type)			},
-	{ RESERVED_BYTE,0 														},
-	{ RESERVED_BYTE,0														},
-	{ RESERVED_BYTE,0														},
-	{ CONFIGURATION_ATTRIBUTES,	offsetof(private_cp_payload_t, attributes)	}
+	{ U_INT_8,					offsetof(private_cp_payload_t, type)			},
+	/* 3 reserved bytes */
+	{ RESERVED_BYTE,			offsetof(private_cp_payload_t, reserved_byte[0])},
+	{ RESERVED_BYTE,			offsetof(private_cp_payload_t, reserved_byte[1])},
+	{ RESERVED_BYTE,			offsetof(private_cp_payload_t, reserved_byte[2])},
+	{ CONFIGURATION_ATTRIBUTES,	offsetof(private_cp_payload_t, attributes)		}
 };
 
 /*
@@ -111,10 +122,8 @@ encoding_rule_t cp_payload_encodings[] = {
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 */
 
-/**
- * Implementation of payload_t.verify.
- */
-static status_t verify(private_cp_payload_t *this)
+METHOD(payload_t, verify, status_t,
+	private_cp_payload_t *this)
 {
 	status_t status = SUCCESS;
 	enumerator_t *enumerator;
@@ -133,36 +142,27 @@ static status_t verify(private_cp_payload_t *this)
 	return status;
 }
 
-/**
- * Implementation of payload_t.get_encoding_rules.
- */
-static void get_encoding_rules(private_cp_payload_t *this,
-							   encoding_rule_t **rules, size_t *rule_count)
+METHOD(payload_t, get_encoding_rules, void,
+	private_cp_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
 {
 	*rules = cp_payload_encodings;
-	*rule_count = sizeof(cp_payload_encodings) / sizeof(encoding_rule_t);
+	*rule_count = countof(cp_payload_encodings);
 }
 
-/**
- * Implementation of payload_t.get_type.
- */
-static payload_type_t get_type(private_cp_payload_t *this)
+METHOD(payload_t, get_type, payload_type_t,
+	private_cp_payload_t *this)
 {
 	return CONFIGURATION;
 }
 
-/**
- * Implementation of payload_t.get_next_type.
- */
-static payload_type_t get_next_type(private_cp_payload_t *this)
+METHOD(payload_t, get_next_type, payload_type_t,
+	private_cp_payload_t *this)
 {
 	return this->next_payload;
 }
 
-/**
- * Implementation of payload_t.set_next_type.
- */
-static void set_next_type(private_cp_payload_t *this,payload_type_t type)
+METHOD(payload_t, set_next_type, void,
+	private_cp_payload_t *this,payload_type_t type)
 {
 	this->next_payload = type;
 }
@@ -185,44 +185,33 @@ static void compute_length(private_cp_payload_t *this)
 	enumerator->destroy(enumerator);
 }
 
-/**
- * Implementation of payload_t.get_length.
- */
-static size_t get_length(private_cp_payload_t *this)
+METHOD(payload_t, get_length, size_t,
+	private_cp_payload_t *this)
 {
 	return this->payload_length;
 }
 
-/**
- * Implementation of cp_payload_t.create_attribute_enumerator.
- */
-static enumerator_t *create_attribute_enumerator(private_cp_payload_t *this)
+METHOD(cp_payload_t, create_attribute_enumerator, enumerator_t*,
+	private_cp_payload_t *this)
 {
 	return this->attributes->create_enumerator(this->attributes);
 }
 
-/**
- * Implementation of cp_payload_t.add_attribute.
- */
-static void add_attribute(private_cp_payload_t *this,
-						  configuration_attribute_t *attribute)
+METHOD(cp_payload_t, add_attribute, void,
+	private_cp_payload_t *this, configuration_attribute_t *attribute)
 {
 	this->attributes->insert_last(this->attributes, attribute);
 	compute_length(this);
 }
 
-/**
- * Implementation of cp_payload_t.get_type.
- */
-static config_type_t get_config_type(private_cp_payload_t *this)
+METHOD(cp_payload_t, get_config_type, config_type_t,
+	private_cp_payload_t *this)
 {
 	return this->type;
 }
 
-/**
- * Implementation of payload_t.destroy and cp_payload_t.destroy.
- */
-static void destroy(private_cp_payload_t *this)
+METHOD2(payload_t, cp_payload_t, destroy, void,
+	private_cp_payload_t *this)
 {
 	this->attributes->destroy_offset(this->attributes,
 								offsetof(configuration_attribute_t, destroy));
@@ -232,42 +221,38 @@ static void destroy(private_cp_payload_t *this)
 /*
  * Described in header.
  */
-cp_payload_t *cp_payload_create()
+cp_payload_t *cp_payload_create_type(config_type_t type)
 {
-	private_cp_payload_t *this = malloc_thing(private_cp_payload_t);
-
-	this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
-	this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
-	this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length;
-	this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type;
-	this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
-	this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_type;
-	this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
-	this->public.create_attribute_enumerator = (enumerator_t*(*)(cp_payload_t *))create_attribute_enumerator;
-	this->public.add_attribute = (void (*) (cp_payload_t *,configuration_attribute_t*))add_attribute;
-	this->public.get_type = (config_type_t (*) (cp_payload_t *))get_config_type;
-	this->public.destroy = (void (*)(cp_payload_t *))destroy;
-
-	/* set default values of the fields */
-	this->critical = FALSE;
-	this->next_payload = NO_PAYLOAD;
-	this->payload_length = CP_PAYLOAD_HEADER_LENGTH;
-	this->attributes = linked_list_create();
-	this->type = CFG_REQUEST;
-
+	private_cp_payload_t *this;
+
+	INIT(this,
+		.public = {
+			.payload_interface = {
+				.verify = _verify,
+				.get_encoding_rules = _get_encoding_rules,
+				.get_length = _get_length,
+				.get_next_type = _get_next_type,
+				.set_next_type = _set_next_type,
+				.get_type = _get_type,
+				.destroy = _destroy,
+			},
+			.create_attribute_enumerator = _create_attribute_enumerator,
+			.add_attribute = _add_attribute,
+			.get_type = _get_config_type,
+			.destroy = _destroy,
+		},
+		.next_payload = NO_PAYLOAD,
+		.payload_length = CP_PAYLOAD_HEADER_LENGTH,
+		.attributes = linked_list_create(),
+		.type = type,
+	);
 	return &this->public;
 }
 
 /*
  * Described in header.
  */
-cp_payload_t *cp_payload_create_type(config_type_t type)
+cp_payload_t *cp_payload_create()
 {
-	private_cp_payload_t *this = (private_cp_payload_t*)cp_payload_create();
-
-	this->type = type;
-
-	return &this->public;
+	return cp_payload_create_type(CFG_REQUEST);
 }
-
diff --git a/src/libcharon/encoding/payloads/delete_payload.c b/src/libcharon/encoding/payloads/delete_payload.c
index 5fc3b7c88..e6ee07d39 100644
--- a/src/libcharon/encoding/payloads/delete_payload.c
+++ b/src/libcharon/encoding/payloads/delete_payload.c
@@ -43,6 +43,11 @@ struct private_delete_payload_t {
 	bool critical;
 
 	/**
+	 * reserved bits
+	 */
+	bool reserved[7];
+
+	/**
 	 * Length of this payload.
 	 */
 	u_int16_t payload_length;
@@ -79,14 +84,14 @@ encoding_rule_t delete_payload_encodings[] = {
 	{ U_INT_8,			offsetof(private_delete_payload_t, next_payload) 	},
 	/* the critical bit */
 	{ FLAG,				offsetof(private_delete_payload_t, critical) 		},
-	/* 7 Bit reserved bits, nowhere stored */
-	{ RESERVED_BIT,		0 													},
-	{ RESERVED_BIT,		0 													},
-	{ RESERVED_BIT,		0 													},
-	{ RESERVED_BIT,		0 													},
-	{ RESERVED_BIT,		0 													},
-	{ RESERVED_BIT,		0 													},
-	{ RESERVED_BIT,		0 													},
+	/* 7 Bit reserved bits */
+	{ RESERVED_BIT,		offsetof(private_delete_payload_t, reserved[0])		},
+	{ RESERVED_BIT,		offsetof(private_delete_payload_t, reserved[1])		},
+	{ RESERVED_BIT,		offsetof(private_delete_payload_t, reserved[2])		},
+	{ RESERVED_BIT,		offsetof(private_delete_payload_t, reserved[3])		},
+	{ RESERVED_BIT,		offsetof(private_delete_payload_t, reserved[4])		},
+	{ RESERVED_BIT,		offsetof(private_delete_payload_t, reserved[5])		},
+	{ RESERVED_BIT,		offsetof(private_delete_payload_t, reserved[6])		},
 	/* Length of the whole payload*/
 	{ PAYLOAD_LENGTH,	offsetof(private_delete_payload_t, payload_length)	},
 	{ U_INT_8,			offsetof(private_delete_payload_t, protocol_id)		},
diff --git a/src/libcharon/encoding/payloads/eap_payload.c b/src/libcharon/encoding/payloads/eap_payload.c
index 21f34a642..eafb668b6 100644
--- a/src/libcharon/encoding/payloads/eap_payload.c
+++ b/src/libcharon/encoding/payloads/eap_payload.c
@@ -43,6 +43,11 @@ struct private_eap_payload_t {
 	bool critical;
 
 	/**
+	 * Reserved bits
+	 */
+	bool reserved[7];
+
+	/**
 	 * Length of this payload.
 	 */
 	u_int16_t payload_length;
@@ -66,13 +71,13 @@ static encoding_rule_t eap_payload_encodings[] = {
 	/* the critical bit */
 	{ FLAG,				offsetof(private_eap_payload_t, critical) 		},
 	/* 7 Bit reserved bits, nowhere stored */
-	{ RESERVED_BIT,	0 													},
-	{ RESERVED_BIT,	0 													},
-	{ RESERVED_BIT,	0 													},
-	{ RESERVED_BIT,	0 													},
-	{ RESERVED_BIT,	0 													},
-	{ RESERVED_BIT,	0 													},
-	{ RESERVED_BIT,	0 													},
+	{ RESERVED_BIT,		offsetof(private_eap_payload_t, reserved[0])	},
+	{ RESERVED_BIT,		offsetof(private_eap_payload_t, reserved[1])	},
+	{ RESERVED_BIT,		offsetof(private_eap_payload_t, reserved[2])	},
+	{ RESERVED_BIT,		offsetof(private_eap_payload_t, reserved[3])	},
+	{ RESERVED_BIT,		offsetof(private_eap_payload_t, reserved[4])	},
+	{ RESERVED_BIT,		offsetof(private_eap_payload_t, reserved[5])	},
+	{ RESERVED_BIT,		offsetof(private_eap_payload_t, reserved[6])	},
 	/* Length of the whole payload*/
 	{ PAYLOAD_LENGTH,	offsetof(private_eap_payload_t, payload_length)	},
 	/* chunt to data, starting at "code" */
diff --git a/src/libcharon/encoding/payloads/id_payload.c b/src/libcharon/encoding/payloads/id_payload.c
index 4158c3e07..3befadfe2 100644
--- a/src/libcharon/encoding/payloads/id_payload.c
+++ b/src/libcharon/encoding/payloads/id_payload.c
@@ -1,6 +1,7 @@
 /*
+ * Copyright (C) 2005-2010 Martin Willi
+ * Copyright (C) 2010 revosec AG
  * Copyright (C) 2007 Tobias Brunner
- * Copyright (C) 2005-2006 Martin Willi
  * Copyright (C) 2005 Jan Hutter
  *
  * Hochschule fuer Technik Rapperswil
@@ -51,6 +52,16 @@ struct private_id_payload_t {
 	bool critical;
 
 	/**
+	 * Reserved bits
+	 */
+	bool reserved_bit[7];
+
+	/**
+	 * Reserved bytes
+	 */
+	u_int8_t reserved_byte[3];
+
+	/**
 	 * Length of this payload.
 	 */
 	u_int16_t payload_length;
@@ -71,31 +82,30 @@ struct private_id_payload_t {
  *
  * The defined offsets are the positions in a object of type
  * private_id_payload_t.
- *
  */
 encoding_rule_t id_payload_encodings[] = {
 	/* 1 Byte next payload type, stored in the field next_payload */
 	{ U_INT_8,			offsetof(private_id_payload_t, next_payload) 	},
 	/* the critical bit */
 	{ FLAG,				offsetof(private_id_payload_t, critical) 		},
-	/* 7 Bit reserved bits, nowhere stored */
-	{ RESERVED_BIT,	0 													},
-	{ RESERVED_BIT,	0 													},
-	{ RESERVED_BIT,	0 													},
-	{ RESERVED_BIT,	0 													},
-	{ RESERVED_BIT,	0 													},
-	{ RESERVED_BIT,	0 													},
-	{ RESERVED_BIT,	0 													},
+	/* 7 Bit reserved bits */
+	{ RESERVED_BIT,		offsetof(private_id_payload_t, reserved_bit[0])	},
+	{ RESERVED_BIT,		offsetof(private_id_payload_t, reserved_bit[1])	},
+	{ RESERVED_BIT,		offsetof(private_id_payload_t, reserved_bit[2])	},
+	{ RESERVED_BIT,		offsetof(private_id_payload_t, reserved_bit[3])	},
+	{ RESERVED_BIT,		offsetof(private_id_payload_t, reserved_bit[4])	},
+	{ RESERVED_BIT,		offsetof(private_id_payload_t, reserved_bit[5])	},
+	{ RESERVED_BIT,		offsetof(private_id_payload_t, reserved_bit[6])	},
 	/* Length of the whole payload*/
 	{ PAYLOAD_LENGTH,	offsetof(private_id_payload_t, payload_length) 	},
 	/* 1 Byte ID type*/
 	{ U_INT_8,			offsetof(private_id_payload_t, id_type)			},
 	/* 3 reserved bytes */
-	{ RESERVED_BYTE,	0 												},
-	{ RESERVED_BYTE,	0 												},
-	{ RESERVED_BYTE,	0 												},
+	{ RESERVED_BYTE,	offsetof(private_id_payload_t, reserved_byte[0])},
+	{ RESERVED_BYTE,	offsetof(private_id_payload_t, reserved_byte[1])},
+	{ RESERVED_BYTE,	offsetof(private_id_payload_t, reserved_byte[2])},
 	/* some id data bytes, length is defined in PAYLOAD_LENGTH */
-	{ ID_DATA,			offsetof(private_id_payload_t, id_data) 		}
+	{ ID_DATA,			offsetof(private_id_payload_t, id_data)			}
 };
 
 /*
@@ -112,136 +122,59 @@ encoding_rule_t id_payload_encodings[] = {
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 */
 
-/**
- * Implementation of payload_t.verify.
- */
-static status_t verify(private_id_payload_t *this)
+METHOD(payload_t, verify, status_t,
+	private_id_payload_t *this)
 {
-	if ((this->id_type == 0) ||
-		(this->id_type == 4) ||
-		((this->id_type >= 6) && (this->id_type <= 8)) ||
-		((this->id_type >= 12) && (this->id_type <= 200)))
+	if (this->id_type == 0 || this->id_type == 4)
 	{
 		/* reserved IDs */
 		DBG1(DBG_ENC, "received ID with reserved type %d", this->id_type);
 		return FAILED;
 	}
-
 	return SUCCESS;
 }
 
-/**
- * Implementation of id_payload_t.get_encoding_rules.
- */
-static void get_encoding_rules(private_id_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
+METHOD(payload_t, get_encoding_rules, void,
+	private_id_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
 {
 	*rules = id_payload_encodings;
-	*rule_count = sizeof(id_payload_encodings) / sizeof(encoding_rule_t);
+	*rule_count = countof(id_payload_encodings);
 }
 
-/**
- * Implementation of payload_t.get_type.
- */
-static payload_type_t get_payload_type(private_id_payload_t *this)
+METHOD(payload_t, get_type, payload_type_t,
+	private_id_payload_t *this)
 {
 	return this->payload_type;
 }
 
-/**
- * Implementation of payload_t.get_next_type.
- */
-static payload_type_t get_next_type(private_id_payload_t *this)
+METHOD(payload_t, get_next_type, payload_type_t,
+	private_id_payload_t *this)
 {
 	return this->next_payload;
 }
 
-/**
- * Implementation of payload_t.set_next_type.
- */
-static void set_next_type(private_id_payload_t *this,payload_type_t type)
+METHOD(payload_t, set_next_type, void,
+	private_id_payload_t *this, payload_type_t type)
 {
 	this->next_payload = type;
 }
 
-/**
- * Implementation of payload_t.get_length.
- */
-static size_t get_length(private_id_payload_t *this)
+METHOD(payload_t, get_length, size_t,
+	private_id_payload_t *this)
 {
 	return this->payload_length;
 }
 
-/**
- * Implementation of id_payload_t.set_type.
- */
-static void set_id_type (private_id_payload_t *this, id_type_t type)
-{
-	this->id_type = type;
-}
-
-/**
- * Implementation of id_payload_t.get_id_type.
- */
-static id_type_t get_id_type (private_id_payload_t *this)
+METHOD(id_payload_t, get_identification, identification_t*,
+	private_id_payload_t *this)
 {
-	return (this->id_type);
+	return identification_create_from_encoding(this->id_type, this->id_data);
 }
 
-/**
- * Implementation of id_payload_t.set_data.
- */
-static void set_data (private_id_payload_t *this, chunk_t data)
+METHOD2(payload_t, id_payload_t, destroy, void,
+	private_id_payload_t *this)
 {
-	if (this->id_data.ptr != NULL)
-	{
-		chunk_free(&(this->id_data));
-	}
-	this->id_data.ptr = clalloc(data.ptr,data.len);
-	this->id_data.len = data.len;
-	this->payload_length = ID_PAYLOAD_HEADER_LENGTH + this->id_data.len;
-}
-
-
-/**
- * Implementation of id_payload_t.get_data_clone.
- */
-static chunk_t get_data (private_id_payload_t *this)
-{
-	return (this->id_data);
-}
-
-/**
- * Implementation of id_payload_t.get_data_clone.
- */
-static chunk_t get_data_clone (private_id_payload_t *this)
-{
-	chunk_t cloned_data;
-	if (this->id_data.ptr == NULL)
-	{
-		return (this->id_data);
-	}
-	cloned_data.ptr = clalloc(this->id_data.ptr,this->id_data.len);
-	cloned_data.len = this->id_data.len;
-	return cloned_data;
-}
-
-/**
- * Implementation of id_payload_t.get_identification.
- */
-static identification_t *get_identification (private_id_payload_t *this)
-{
-	return identification_create_from_encoding(this->id_type,this->id_data);
-}
-
-/**
- * Implementation of payload_t.destroy and id_payload_t.destroy.
- */
-static void destroy(private_id_payload_t *this)
-{
-	if (this->id_data.ptr != NULL)
-	{
-		chunk_free(&(this->id_data));
-	}
+	free(this->id_data.ptr);
 	free(this);
 }
 
@@ -250,44 +183,41 @@ static void destroy(private_id_payload_t *this)
  */
 id_payload_t *id_payload_create(payload_type_t payload_type)
 {
-	private_id_payload_t *this = malloc_thing(private_id_payload_t);
-
-	/* interface functions */
-	this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
-	this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
-	this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length;
-	this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type;
-	this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
-	this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_payload_type;
-	this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
-	/* public functions */
-	this->public.destroy = (void (*) (id_payload_t *)) destroy;
-	this->public.set_id_type = (void (*) (id_payload_t *,id_type_t)) set_id_type;
-	this->public.get_id_type = (id_type_t (*) (id_payload_t *)) get_id_type;
-	this->public.set_data = (void (*) (id_payload_t *,chunk_t)) set_data;
-	this->public.get_data = (chunk_t (*) (id_payload_t *)) get_data;
-	this->public.get_data_clone = (chunk_t (*) (id_payload_t *)) get_data_clone;
-
-	this->public.get_identification = (identification_t * (*) (id_payload_t *this)) get_identification;
-
-	/* private variables */
-	this->critical = FALSE;
-	this->next_payload = NO_PAYLOAD;
-	this->payload_length =ID_PAYLOAD_HEADER_LENGTH;
-	this->id_data = chunk_empty;
-	this->payload_type = payload_type;
-
-	return (&(this->public));
+	private_id_payload_t *this;
+
+	INIT(this,
+		.public = {
+			.payload_interface = {
+				.verify = _verify,
+				.get_encoding_rules = _get_encoding_rules,
+				.get_length = _get_length,
+				.get_next_type = _get_next_type,
+				.set_next_type = _set_next_type,
+				.get_type = _get_type,
+				.destroy = _destroy,
+			},
+			.get_identification = _get_identification,
+			.destroy = _destroy,
+		},
+		.next_payload = NO_PAYLOAD,
+		.payload_length = ID_PAYLOAD_HEADER_LENGTH,
+		.payload_type = payload_type,
+	);
+	return &this->public;
 }
 
 /*
  * Described in header.
  */
-id_payload_t *id_payload_create_from_identification(payload_type_t payload_type, identification_t *identification)
+id_payload_t *id_payload_create_from_identification(payload_type_t payload_type,
+													identification_t *id)
 {
-	id_payload_t *this= id_payload_create(payload_type);
-	this->set_data(this,identification->get_encoding(identification));
-	this->set_id_type(this,identification->get_type(identification));
-	return this;
+	private_id_payload_t *this;
+
+	this = (private_id_payload_t*)id_payload_create(payload_type);
+	this->id_data = chunk_clone(id->get_encoding(id));
+	this->id_type = id->get_type(id);
+	this->payload_length += this->id_data.len;
+
+	return &this->public;
 }
diff --git a/src/libcharon/encoding/payloads/id_payload.h b/src/libcharon/encoding/payloads/id_payload.h
index 5502dc961..99831f85f 100644
--- a/src/libcharon/encoding/payloads/id_payload.h
+++ b/src/libcharon/encoding/payloads/id_payload.h
@@ -40,57 +40,15 @@ typedef struct id_payload_t id_payload_t;
  * The ID payload format is described in RFC section 3.5.
  */
 struct id_payload_t {
+
 	/**
 	 * The payload_t interface.
 	 */
 	payload_t payload_interface;
 
 	/**
-	 * Set the ID type.
-	 *
-	 * @param type			Type of ID
-	 */
-	void (*set_id_type) (id_payload_t *this, id_type_t type);
-
-	/**
-	 * Get the ID type.
-	 *
-	 * @return				type of the ID
-	 */
-	id_type_t (*get_id_type) (id_payload_t *this);
-
-	/**
-	 * Set the ID data.
-	 *
-	 * Data are getting cloned.
-	 *
-	 * @param data			ID data as chunk_t
-	 */
-	void (*set_data) (id_payload_t *this, chunk_t data);
-
-	/**
-	 * Get the ID data.
-	 *
-	 * Returned data are a copy of the internal one
-	 *
-	 * @return				ID data as chunk_t
-	 */
-	chunk_t (*get_data_clone) (id_payload_t *this);
-
-	/**
-	 * Get the ID data.
-	 *
-	 * Returned data are NOT copied.
-	 *
-	 * @return				ID data as chunk_t
-	 */
-	chunk_t (*get_data) (id_payload_t *this);
-
-	/**
 	 * Creates an identification object of this id payload.
 	 *
-	 * Returned object has to get destroyed by the caller.
-	 *
 	 * @return				identification_t object
 	 */
 	identification_t *(*get_identification) (id_payload_t *this);
diff --git a/src/libcharon/encoding/payloads/ike_header.c b/src/libcharon/encoding/payloads/ike_header.c
index 735f01304..80dcee0cb 100644
--- a/src/libcharon/encoding/payloads/ike_header.c
+++ b/src/libcharon/encoding/payloads/ike_header.c
@@ -84,6 +84,11 @@ struct private_ike_header_t {
 	} flags;
 
 	/**
+	 * Reserved bits of IKE header
+	 */
+	bool reserved[5];
+
+	/**
 	 * Associated Message-ID.
 	 */
 	u_int32_t message_id;
@@ -119,30 +124,30 @@ encoding_rule_t ike_header_encodings[] = {
 	/* 8 Byte SPI, stored in the field initiator_spi */
 	{ IKE_SPI,		offsetof(private_ike_header_t, initiator_spi)	},
 	/* 8 Byte SPI, stored in the field responder_spi */
-	{ IKE_SPI,		offsetof(private_ike_header_t, responder_spi) 	},
+	{ IKE_SPI,		offsetof(private_ike_header_t, responder_spi)	},
 	/* 1 Byte next payload type, stored in the field next_payload */
-	{ U_INT_8,		offsetof(private_ike_header_t, next_payload) 	},
+	{ U_INT_8,		offsetof(private_ike_header_t, next_payload)	},
 	/* 4 Bit major version, stored in the field maj_version */
-	{ U_INT_4,		offsetof(private_ike_header_t, maj_version) 	},
+	{ U_INT_4,		offsetof(private_ike_header_t, maj_version)		},
 	/* 4 Bit minor version, stored in the field min_version */
-	{ U_INT_4,		offsetof(private_ike_header_t, min_version) 	},
+	{ U_INT_4,		offsetof(private_ike_header_t, min_version)		},
 	/* 8 Bit for the exchange type */
-	{ U_INT_8,		offsetof(private_ike_header_t, exchange_type) 	},
-	/* 2 Bit reserved bits, nowhere stored */
-	{ RESERVED_BIT,	0 										},
-	{ RESERVED_BIT,	0 										},
+	{ U_INT_8,		offsetof(private_ike_header_t, exchange_type)	},
+	/* 2 Bit reserved bits */
+	{ RESERVED_BIT,	offsetof(private_ike_header_t, reserved[0])		},
+	{ RESERVED_BIT,	offsetof(private_ike_header_t, reserved[1])		},
 	/* 3 Bit flags, stored in the fields response, version and initiator */
-	{ FLAG,			offsetof(private_ike_header_t, flags.response) 	},
-	{ FLAG,			offsetof(private_ike_header_t, flags.version) 	},
-	{ FLAG,			offsetof(private_ike_header_t, flags.initiator) },
-	/* 3 Bit reserved bits, nowhere stored */
-	{ RESERVED_BIT,	0 										},
-	{ RESERVED_BIT,	0 										},
-	{ RESERVED_BIT,	0 										},
+	{ FLAG,			offsetof(private_ike_header_t, flags.response)	},
+	{ FLAG,			offsetof(private_ike_header_t, flags.version)	},
+	{ FLAG,			offsetof(private_ike_header_t, flags.initiator)	},
+	/* 3 Bit reserved bits */
+	{ RESERVED_BIT,	offsetof(private_ike_header_t, reserved[2])		},
+	{ RESERVED_BIT,	offsetof(private_ike_header_t, reserved[3])		},
+	{ RESERVED_BIT,	offsetof(private_ike_header_t, reserved[4])		},
 	/* 4 Byte message id, stored in the field message_id */
-	{ U_INT_32,		offsetof(private_ike_header_t, message_id) 		},
+	{ U_INT_32,		offsetof(private_ike_header_t, message_id)		},
 	/* 4 Byte length fied, stored in the field length */
-	{ HEADER_LENGTH,	offsetof(private_ike_header_t, length) 			}
+	{ HEADER_LENGTH,offsetof(private_ike_header_t, length)			},
 };
 
 
@@ -163,11 +168,8 @@ encoding_rule_t ike_header_encodings[] = {
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 */
 
-
-/**
- * Implementation of payload_t.verify.
- */
-static status_t verify(private_ike_header_t *this)
+METHOD(payload_t, verify, status_t,
+	private_ike_header_t *this)
 {
 	if ((this->exchange_type < IKE_SA_INIT) ||
 		((this->exchange_type > INFORMATIONAL)
@@ -179,7 +181,6 @@ static status_t verify(private_ike_header_t *this)
 		/* unsupported exchange type */
 		return FAILED;
 	}
-
 	if (this->initiator_spi == 0
 #ifdef ME
 		/* we allow zero spi for INFORMATIONAL exchanges,
@@ -191,225 +192,201 @@ static status_t verify(private_ike_header_t *this)
 		/* initiator spi not set */
 		return FAILED;
 	}
+	return SUCCESS;
+}
 
-	/* verification of version is not done in here */
+METHOD(payload_t, get_encoding_rules, void,
+	private_ike_header_t *this, encoding_rule_t **rules, size_t *rule_count)
+{
+	*rules = ike_header_encodings;
+	*rule_count = sizeof(ike_header_encodings) / sizeof(encoding_rule_t);
+}
 
-	return SUCCESS;
+METHOD(payload_t, get_type, payload_type_t,
+	private_ike_header_t *this)
+{
+	return HEADER;
 }
 
-/**
- * Implementation of payload_t.set_next_type.
- */
-static void set_next_type(payload_t *this,payload_type_t type)
+METHOD(payload_t, get_next_type, payload_type_t,
+	private_ike_header_t *this)
 {
-	((private_ike_header_t *)this)->next_payload = type;
+	return this->next_payload;
 }
-/**
- * Implementation of ike_header_t.get_initiator_spi.
- */
-static u_int64_t get_initiator_spi(private_ike_header_t *this)
+
+METHOD(payload_t, set_next_type, void,
+	private_ike_header_t *this, payload_type_t type)
+{
+	this->next_payload = type;
+}
+
+METHOD(payload_t, get_length, size_t,
+	private_ike_header_t *this)
+{
+	return this->length;
+}
+
+METHOD(ike_header_t, get_initiator_spi, u_int64_t,
+	private_ike_header_t *this)
 {
 	return this->initiator_spi;
 }
 
-/**
- * Implementation of ike_header_t.set_initiator_spi.
- */
-static void set_initiator_spi(private_ike_header_t *this, u_int64_t initiator_spi)
+METHOD(ike_header_t, set_initiator_spi, void,
+	private_ike_header_t *this, u_int64_t initiator_spi)
 {
 	this->initiator_spi = initiator_spi;
 }
 
-/**
- * Implementation of ike_header_t.get_responder_spi.
- */
-static u_int64_t get_responder_spi(private_ike_header_t *this)
+METHOD(ike_header_t, get_responder_spi, u_int64_t,
+	private_ike_header_t *this)
 {
 	return this->responder_spi;
 }
 
-/**
- * Implementation of ike_header_t.set_responder_spi.
- */
-static void set_responder_spi(private_ike_header_t *this, u_int64_t responder_spi)
+METHOD(ike_header_t, set_responder_spi, void,
+	private_ike_header_t *this, u_int64_t responder_spi)
 {
 	this->responder_spi = responder_spi;
 }
 
-/**
- * Implementation of ike_header_t.get_maj_version.
- */
-static u_int8_t get_maj_version(private_ike_header_t *this)
+METHOD(ike_header_t, get_maj_version, u_int8_t,
+	private_ike_header_t *this)
 {
 	return this->maj_version;
 }
 
-/**
- * Implementation of ike_header_t.get_min_version.
- */
-static u_int8_t get_min_version(private_ike_header_t *this)
+METHOD(ike_header_t, set_maj_version, void,
+	private_ike_header_t *this, u_int8_t major)
+{
+	this->maj_version = major;
+}
+
+METHOD(ike_header_t, get_min_version, u_int8_t,
+	private_ike_header_t *this)
 {
 	return this->min_version;
 }
 
-/**
- * Implementation of ike_header_t.get_response_flag.
- */
-static bool get_response_flag(private_ike_header_t *this)
+METHOD(ike_header_t, set_min_version, void,
+	private_ike_header_t *this, u_int8_t minor)
+{
+	this->min_version = minor;
+}
+
+METHOD(ike_header_t, get_response_flag, bool,
+	private_ike_header_t *this)
 {
 	return this->flags.response;
 }
 
-/**
- * Implementation of ike_header_t.set_response_flag.
- */
-static void set_response_flag(private_ike_header_t *this, bool response)
+METHOD(ike_header_t, set_response_flag, void,
+	private_ike_header_t *this, bool response)
 {
 	this->flags.response = response;
 }
 
-/**
- * Implementation of ike_header_t.get_version_flag.
- */
-static bool get_version_flag(private_ike_header_t *this)
+METHOD(ike_header_t, get_version_flag, bool,
+	private_ike_header_t *this)
 {
 	return this->flags.version;
 }
 
-/**
- * Implementation of ike_header_t.get_initiator_flag.
- */
-static bool get_initiator_flag(private_ike_header_t *this)
+METHOD(ike_header_t, set_version_flag, void,
+	private_ike_header_t *this, bool version)
+{
+	this->flags.version = version;
+}
+
+METHOD(ike_header_t, get_initiator_flag, bool,
+	private_ike_header_t *this)
 {
 	return this->flags.initiator;
 }
 
-/**
- * Implementation of ike_header_t.set_initiator_flag.
- */
-static void set_initiator_flag(private_ike_header_t *this, bool initiator)
+METHOD(ike_header_t, set_initiator_flag, void,
+	private_ike_header_t *this, bool initiator)
 {
 	this->flags.initiator = initiator;
 }
 
-/**
- * Implementation of ike_header_t.get_exchange_type.
- */
-static u_int8_t get_exchange_type(private_ike_header_t *this)
+METHOD(ike_header_t, get_exchange_type, u_int8_t,
+	private_ike_header_t *this)
 {
 	return this->exchange_type;
 }
 
-/**
- * Implementation of ike_header_t.set_exchange_type.
- */
-static void set_exchange_type(private_ike_header_t *this, u_int8_t exchange_type)
+METHOD(ike_header_t, set_exchange_type, void,
+	private_ike_header_t *this, u_int8_t exchange_type)
 {
 	this->exchange_type = exchange_type;
 }
 
-/**
- * Implements ike_header_t's get_message_id function.
- * See #ike_header_t.get_message_id  for description.
- */
-static u_int32_t get_message_id(private_ike_header_t *this)
+METHOD(ike_header_t, get_message_id, u_int32_t,
+	private_ike_header_t *this)
 {
 	return this->message_id;
 }
 
-/**
- * Implementation of ike_header_t.set_message_id.
- */
-static void set_message_id(private_ike_header_t *this, u_int32_t message_id)
+METHOD(ike_header_t, set_message_id, void,
+	private_ike_header_t *this, u_int32_t message_id)
 {
 	this->message_id = message_id;
 }
 
-/**
- * Implementation of ike_header_t.destroy and payload_t.destroy.
- */
-static void destroy(ike_header_t *this)
+METHOD2(payload_t, ike_header_t, destroy, void,
+	private_ike_header_t *this)
 {
 	free(this);
 }
 
-/**
- * Implementation of payload_t.get_encoding_rules.
- */
-static void get_encoding_rules(payload_t *this, encoding_rule_t **rules, size_t *rule_count)
-{
-	*rules = ike_header_encodings;
-	*rule_count = sizeof(ike_header_encodings) / sizeof(encoding_rule_t);
-}
-
-/**
- * Implementation of payload_t.get_type.
- */
-static payload_type_t get_type(payload_t *this)
-{
-	return HEADER;
-}
-
-/**
- * Implementation of payload_t.get_next_type.
- */
-static payload_type_t get_next_type(payload_t *this)
-{
-	return (((private_ike_header_t*)this)->next_payload);
-}
-
-/**
- * Implementation of payload_t.get_length.
- */
-static size_t get_length(payload_t *this)
-{
-	return (((private_ike_header_t*)this)->length);
-}
-
 /*
  * Described in header.
  */
 ike_header_t *ike_header_create()
 {
-	private_ike_header_t *this = malloc_thing(private_ike_header_t);
-
-	this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
-	this->public.payload_interface.get_encoding_rules = get_encoding_rules;
-	this->public.payload_interface.get_length = get_length;
-	this->public.payload_interface.get_next_type = get_next_type;
-	this->public.payload_interface.set_next_type = set_next_type;
-	this->public.payload_interface.get_type = get_type;
-	this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-	this->public.destroy = destroy;
-
-	this->public.get_initiator_spi = (u_int64_t (*) (ike_header_t*))get_initiator_spi;
-	this->public.set_initiator_spi = (void (*) (ike_header_t*,u_int64_t))set_initiator_spi;
-	this->public.get_responder_spi = (u_int64_t (*) (ike_header_t*))get_responder_spi;
-	this->public.set_responder_spi = (void (*) (ike_header_t *,u_int64_t))set_responder_spi;
-	this->public.get_maj_version = (u_int8_t (*) (ike_header_t*))get_maj_version;
-	this->public.get_min_version = (u_int8_t (*) (ike_header_t*))get_min_version;
-	this->public.get_response_flag = (bool (*) (ike_header_t*))get_response_flag;
-	this->public.set_response_flag = (void (*) (ike_header_t*,bool))set_response_flag;
-	this->public.get_version_flag = (bool (*) (ike_header_t*))get_version_flag;
-	this->public.get_initiator_flag = (bool (*) (ike_header_t*))get_initiator_flag;
-	this->public.set_initiator_flag = (void (*) (ike_header_t*,bool))set_initiator_flag;
-	this->public.get_exchange_type = (u_int8_t (*) (ike_header_t*))get_exchange_type;
-	this->public.set_exchange_type = (void (*) (ike_header_t*,u_int8_t))set_exchange_type;
-	this->public.get_message_id = (u_int32_t (*) (ike_header_t*))get_message_id;
-	this->public.set_message_id = (void (*) (ike_header_t*,u_int32_t))set_message_id;
-
-	/* set default values of the fields */
-	this->initiator_spi = 0;
-	this->responder_spi = 0;
-	this->next_payload = 0;
-	this->maj_version = IKE_MAJOR_VERSION;
-	this->min_version = IKE_MINOR_VERSION;
-	this->exchange_type = EXCHANGE_TYPE_UNDEFINED;
-	this->flags.initiator = TRUE;
-	this->flags.version = HIGHER_VERSION_SUPPORTED_FLAG;
-	this->flags.response = FALSE;
-	this->message_id = 0;
-	this->length = IKE_HEADER_LENGTH;
-
-	return (ike_header_t*)this;
+	private_ike_header_t *this;
+
+	INIT(this,
+		.public = {
+			.payload_interface = {
+				.verify = _verify,
+				.get_encoding_rules = _get_encoding_rules,
+				.get_length = _get_length,
+				.get_next_type = _get_next_type,
+				.set_next_type = _set_next_type,
+				.get_type = _get_type,
+				.destroy = _destroy,
+			},
+			.get_initiator_spi = _get_initiator_spi,
+			.set_initiator_spi = _set_initiator_spi,
+			.get_responder_spi = _get_responder_spi,
+			.set_responder_spi = _set_responder_spi,
+			.get_maj_version = _get_maj_version,
+			.set_maj_version = _set_maj_version,
+			.get_min_version = _get_min_version,
+			.set_min_version = _set_min_version,
+			.get_response_flag = _get_response_flag,
+			.set_response_flag = _set_response_flag,
+			.get_version_flag = _get_version_flag,
+			.set_version_flag = _set_version_flag,
+			.get_initiator_flag = _get_initiator_flag,
+			.set_initiator_flag = _set_initiator_flag,
+			.get_exchange_type = _get_exchange_type,
+			.set_exchange_type = _set_exchange_type,
+			.get_message_id = _get_message_id,
+			.set_message_id = _set_message_id,
+			.destroy = _destroy,
+		},
+		.maj_version = IKE_MAJOR_VERSION,
+		.min_version = IKE_MINOR_VERSION,
+		.exchange_type = EXCHANGE_TYPE_UNDEFINED,
+		.flags = {
+			.initiator = TRUE,
+			.version = HIGHER_VERSION_SUPPORTED_FLAG,
+		},
+		.length = IKE_HEADER_LENGTH,
+	);
+
+	return &this->public;
 }
diff --git a/src/libcharon/encoding/payloads/ike_header.h b/src/libcharon/encoding/payloads/ike_header.h
index e63e8bf06..f52c852c5 100644
--- a/src/libcharon/encoding/payloads/ike_header.h
+++ b/src/libcharon/encoding/payloads/ike_header.h
@@ -143,6 +143,13 @@ struct ike_header_t {
 	u_int8_t (*get_maj_version) (ike_header_t *this);
 
 	/**
+	 * Set the major version.
+	 *
+	 * @param major			major version
+	 */
+	void (*set_maj_version) (ike_header_t *this, u_int8_t major);
+
+	/**
 	 * Get the minor version.
 	 *
 	 * @return 				minor version
@@ -150,6 +157,13 @@ struct ike_header_t {
 	u_int8_t (*get_min_version) (ike_header_t *this);
 
 	/**
+	 * Set the minor version.
+	 *
+	 * @param minor			minor version
+	 */
+	void (*set_min_version) (ike_header_t *this, u_int8_t minor);
+
+	/**
 	 * Get the response flag.
 	 *
 	 * @return 				response flag
@@ -162,6 +176,7 @@ struct ike_header_t {
 	 * @param response		response flag
 	 */
 	void (*set_response_flag) (ike_header_t *this, bool response);
+
 	/**
 	 * Get "higher version supported"-flag.
 	 *
@@ -170,6 +185,13 @@ struct ike_header_t {
 	bool (*get_version_flag) (ike_header_t *this);
 
 	/**
+	 * Set the "higher version supported"-flag.
+	 *
+	 * @param version		flag value
+	 */
+	void (*set_version_flag)(ike_header_t *this, bool version);
+
+	/**
 	 * Get the initiator flag.
 	 *
 	 * @return 				initiator flag
diff --git a/src/libcharon/encoding/payloads/ke_payload.c b/src/libcharon/encoding/payloads/ke_payload.c
index 1bc79f084..999d73192 100644
--- a/src/libcharon/encoding/payloads/ke_payload.c
+++ b/src/libcharon/encoding/payloads/ke_payload.c
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2005-2006 Martin Willi
+ * Copyright (C) 2005-2010 Martin Willi
+ * Copyright (C) 2010 revosec AG
  * Copyright (C) 2005 Jan Hutter
  * Hochschule fuer Technik Rapperswil
  *
@@ -20,14 +21,13 @@
 
 #include <encoding/payloads/encodings.h>
 
-
 typedef struct private_ke_payload_t private_ke_payload_t;
 
 /**
  * Private data of an ke_payload_t object.
- *
  */
 struct private_ke_payload_t {
+
 	/**
 	 * Public ke_payload_t interface.
 	 */
@@ -44,6 +44,16 @@ struct private_ke_payload_t {
 	bool critical;
 
 	/**
+	 * Reserved bits
+	 */
+	bool reserved_bit[7];
+
+	/**
+	 * Reserved bytes
+	 */
+	u_int8_t reserved_byte[2];
+
+	/**
 	 * Length of this payload.
 	 */
 	u_int16_t payload_length;
@@ -64,27 +74,27 @@ struct private_ke_payload_t {
  *
  * The defined offsets are the positions in a object of type
  * private_ke_payload_t.
- *
  */
 encoding_rule_t ke_payload_encodings[] = {
 	/* 1 Byte next payload type, stored in the field next_payload */
-	{ U_INT_8,			offsetof(private_ke_payload_t, next_payload) 		},
+	{ U_INT_8,				offsetof(private_ke_payload_t, next_payload)	},
 	/* the critical bit */
-	{ FLAG,				offsetof(private_ke_payload_t, critical) 			},
-	/* 7 Bit reserved bits, nowhere stored */
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
+	{ FLAG,					offsetof(private_ke_payload_t, critical)		},
+	/* 7 Bit reserved bits */
+	{ RESERVED_BIT,			offsetof(private_ke_payload_t, reserved_bit[0])	},
+	{ RESERVED_BIT,			offsetof(private_ke_payload_t, reserved_bit[1])	},
+	{ RESERVED_BIT,			offsetof(private_ke_payload_t, reserved_bit[2])	},
+	{ RESERVED_BIT,			offsetof(private_ke_payload_t, reserved_bit[3])	},
+	{ RESERVED_BIT,			offsetof(private_ke_payload_t, reserved_bit[4])	},
+	{ RESERVED_BIT,			offsetof(private_ke_payload_t, reserved_bit[5])	},
+	{ RESERVED_BIT,			offsetof(private_ke_payload_t, reserved_bit[6])	},
 	/* Length of the whole payload*/
-	{ PAYLOAD_LENGTH,	offsetof(private_ke_payload_t, payload_length) 		},
+	{ PAYLOAD_LENGTH,		offsetof(private_ke_payload_t, payload_length)	},
 	/* DH Group number as 16 bit field*/
-	{ U_INT_16,			offsetof(private_ke_payload_t, dh_group_number) 	},
-	{ RESERVED_BYTE,	0 													},
-	{ RESERVED_BYTE,	0 													},
+	{ U_INT_16,				offsetof(private_ke_payload_t, dh_group_number)	},
+	/* 2 reserved bytes */
+	{ RESERVED_BYTE,		offsetof(private_ke_payload_t, reserved_byte[0])},
+	{ RESERVED_BYTE,		offsetof(private_ke_payload_t, reserved_byte[1])},
 	/* Key Exchange Data is from variable size */
 	{ KEY_EXCHANGE_DATA,	offsetof(private_ke_payload_t, key_exchange_data)}
 };
@@ -103,123 +113,60 @@ encoding_rule_t ke_payload_encodings[] = {
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 */
 
-/**
- * Implementation of payload_t.verify.
- */
-static status_t verify(private_ke_payload_t *this)
+METHOD(payload_t, verify, status_t,
+	private_ke_payload_t *this)
 {
-	/* dh group is not verified in here */
 	return SUCCESS;
 }
 
-/**
- * Implementation of payload_t.destroy.
- */
-static void destroy(private_ke_payload_t *this)
-{
-	if (this->key_exchange_data.ptr != NULL)
-	{
-		free(this->key_exchange_data.ptr);
-	}
-	free(this);
-}
-
-/**
- * Implementation of payload_t.get_encoding_rules.
- */
-static void get_encoding_rules(private_ke_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
+METHOD(payload_t, get_encoding_rules, void,
+	private_ke_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
 {
 	*rules = ke_payload_encodings;
-	*rule_count = sizeof(ke_payload_encodings) / sizeof(encoding_rule_t);
+	*rule_count = countof(ke_payload_encodings);
 }
 
-/**
- * Implementation of payload_t.get_type.
- */
-static payload_type_t get_type(private_ke_payload_t *this)
+METHOD(payload_t, get_type, payload_type_t,
+	private_ke_payload_t *this)
 {
 	return KEY_EXCHANGE;
 }
 
-/**
- * Implementation of payload_t.get_next_type.
- */
-static payload_type_t get_next_type(private_ke_payload_t *this)
+METHOD(payload_t, get_next_type, payload_type_t,
+	private_ke_payload_t *this)
 {
-	return (this->next_payload);
+	return this->next_payload;
 }
 
-/**
- * Implementation of payload_t.set_next_type.
- */
-static void set_next_type(private_ke_payload_t *this,payload_type_t type)
+METHOD(payload_t, set_next_type, void,
+	private_ke_payload_t *this,payload_type_t type)
 {
 	this->next_payload = type;
 }
 
-/**
- * recompute the length of the payload.
- */
-static void compute_length(private_ke_payload_t *this)
-{
-	size_t length = KE_PAYLOAD_HEADER_LENGTH;
-	if (this->key_exchange_data.ptr != NULL)
-	{
-		length += this->key_exchange_data.len;
-	}
-	this->payload_length = length;
-}
-
-/**
- * Implementation of payload_t.get_length.
- */
-static size_t get_length(private_ke_payload_t *this)
+METHOD(payload_t, get_length, size_t,
+	private_ke_payload_t *this)
 {
-	compute_length(this);
 	return this->payload_length;
 }
 
-/**
- * Implementation of ke_payload_t.get_key_exchange_data.
- */
-static chunk_t get_key_exchange_data(private_ke_payload_t *this)
+METHOD(ke_payload_t, get_key_exchange_data, chunk_t,
+	private_ke_payload_t *this)
 {
-	return (this->key_exchange_data);
+	return this->key_exchange_data;
 }
 
-/**
- * Implementation of ke_payload_t.set_key_exchange_data.
- */
-static void set_key_exchange_data(private_ke_payload_t *this, chunk_t key_exchange_data)
-{
-	/* destroy existing data first */
-	if (this->key_exchange_data.ptr != NULL)
-	{
-		/* free existing value */
-		free(this->key_exchange_data.ptr);
-		this->key_exchange_data.ptr = NULL;
-		this->key_exchange_data.len = 0;
-
-	}
-
-	this->key_exchange_data = chunk_clone(key_exchange_data);
-	compute_length(this);
-}
-
-/**
- * Implementation of ke_payload_t.get_dh_group_number.
- */
-static diffie_hellman_group_t get_dh_group_number(private_ke_payload_t *this)
+METHOD(ke_payload_t, get_dh_group_number, diffie_hellman_group_t,
+	private_ke_payload_t *this)
 {
 	return this->dh_group_number;
 }
 
-/**
- * Implementation of ke_payload_t.set_dh_group_number.
- */
-static void set_dh_group_number(private_ke_payload_t *this, diffie_hellman_group_t dh_group_number)
+METHOD2(payload_t, ke_payload_t, destroy, void,
+	private_ke_payload_t *this)
 {
-	this->dh_group_number = dh_group_number;
+	free(this->key_exchange_data.ptr);
+	free(this);
 }
 
 /*
@@ -227,31 +174,27 @@ static void set_dh_group_number(private_ke_payload_t *this, diffie_hellman_group
  */
 ke_payload_t *ke_payload_create()
 {
-	private_ke_payload_t *this = malloc_thing(private_ke_payload_t);
-
-	/* interface functions */
-	this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
-	this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
-	this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length;
-	this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type;
-	this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
-	this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_type;
-	this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
-	/* public functions */
-	this->public.get_key_exchange_data = (chunk_t (*) (ke_payload_t *)) get_key_exchange_data;
-	this->public.set_key_exchange_data = (void (*) (ke_payload_t *,chunk_t)) set_key_exchange_data;
-	this->public.get_dh_group_number = (diffie_hellman_group_t (*) (ke_payload_t *)) get_dh_group_number;
-	this->public.set_dh_group_number =(void (*) (ke_payload_t *,diffie_hellman_group_t)) set_dh_group_number;
-	this->public.destroy = (void (*) (ke_payload_t *)) destroy;
-
-	/* set default values of the fields */
-	this->critical = FALSE;
-	this->next_payload = NO_PAYLOAD;
-	this->payload_length = KE_PAYLOAD_HEADER_LENGTH;
-	this->key_exchange_data = chunk_empty;
-	this->dh_group_number = MODP_NONE;
-
+	private_ke_payload_t *this;
+
+	INIT(this,
+		.public = {
+			.payload_interface = {
+				.verify = _verify,
+				.get_encoding_rules = _get_encoding_rules,
+				.get_length = _get_length,
+				.get_next_type = _get_next_type,
+				.set_next_type = _set_next_type,
+				.get_type = _get_type,
+				.destroy = _destroy,
+			},
+			.get_key_exchange_data = _get_key_exchange_data,
+			.get_dh_group_number = _get_dh_group_number,
+			.destroy = _destroy,
+		},
+		.next_payload = NO_PAYLOAD,
+		.payload_length = KE_PAYLOAD_HEADER_LENGTH,
+		.dh_group_number = MODP_NONE,
+	);
 	return &this->public;
 }
 
@@ -264,7 +207,7 @@ ke_payload_t *ke_payload_create_from_diffie_hellman(diffie_hellman_t *dh)
 
 	dh->get_my_public_value(dh, &this->key_exchange_data);
 	this->dh_group_number = dh->get_dh_group(dh);
-	compute_length(this);
+	this->payload_length = this->key_exchange_data.len + KE_PAYLOAD_HEADER_LENGTH;
 
 	return &this->public;
 }
diff --git a/src/libcharon/encoding/payloads/ke_payload.h b/src/libcharon/encoding/payloads/ke_payload.h
index 3ca05009e..65cc11883 100644
--- a/src/libcharon/encoding/payloads/ke_payload.h
+++ b/src/libcharon/encoding/payloads/ke_payload.h
@@ -47,24 +47,13 @@ struct ke_payload_t {
 	payload_t payload_interface;
 
 	/**
-	 * Returns the currently set key exchange data of this KE payload.
+	 * Returns the key exchange data of this KE payload.
 	 *
-	 * @warning Returned data are not copied.
-	 *
-	 * @return 		chunk_t pointing to the value
+	 * @return 		chunk_t pointing to internal data
 	 */
 	chunk_t (*get_key_exchange_data) (ke_payload_t *this);
 
 	/**
-	 * Sets the key exchange data of this KE payload.
-	 *
-	 * Value is getting copied.
-	 *
-	 * @param key_exchange_data chunk_t pointing to the value to set
-	 */
-	void (*set_key_exchange_data) (ke_payload_t *this, chunk_t key_exchange_data);
-
-	/**
 	 * Gets the Diffie-Hellman Group Number of this KE payload.
 	 *
 	 * @return 					DH Group Number of this payload
@@ -72,14 +61,6 @@ struct ke_payload_t {
 	diffie_hellman_group_t (*get_dh_group_number) (ke_payload_t *this);
 
 	/**
-	 * Sets the Diffie-Hellman Group Number of this KE payload.
-	 *
-	 * @param dh_group_number	DH Group to set
-	 */
-	void (*set_dh_group_number) (ke_payload_t *this,
-								 diffie_hellman_group_t dh_group_number);
-
-	/**
 	 * Destroys an ke_payload_t object.
 	 */
 	void (*destroy) (ke_payload_t *this);
diff --git a/src/libcharon/encoding/payloads/nonce_payload.c b/src/libcharon/encoding/payloads/nonce_payload.c
index 4ad5ce9dd..78000b8c6 100644
--- a/src/libcharon/encoding/payloads/nonce_payload.c
+++ b/src/libcharon/encoding/payloads/nonce_payload.c
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2005-2006 Martin Willi
+ * Copyright (C) 2005-2010 Martin Willi
+ * Copyright (C) 2010 revosec AG
  * Copyright (C) 2005 Jan Hutter
  * Hochschule fuer Technik Rapperswil
  *
@@ -14,21 +15,19 @@
  * for more details.
  */
 
-/* offsetof macro */
 #include <stddef.h>
 
 #include "nonce_payload.h"
 
 #include <encoding/payloads/encodings.h>
 
-
 typedef struct private_nonce_payload_t private_nonce_payload_t;
 
 /**
  * Private data of an nonce_payload_t object.
- *
  */
 struct private_nonce_payload_t {
+
 	/**
 	 * Public nonce_payload_t interface.
 	 */
@@ -45,6 +44,11 @@ struct private_nonce_payload_t {
 	bool critical;
 
 	/**
+	 * Reserved bits
+	 */
+	bool reserved[7];
+
+	/**
 	 * Length of this payload.
 	 */
 	u_int16_t payload_length;
@@ -60,25 +64,24 @@ struct private_nonce_payload_t {
  *
  * The defined offsets are the positions in a object of type
  * private_nonce_payload_t.
- *
  */
 encoding_rule_t nonce_payload_encodings[] = {
 	/* 1 Byte next payload type, stored in the field next_payload */
-	{ U_INT_8,			offsetof(private_nonce_payload_t, next_payload) 	},
+	{ U_INT_8,			offsetof(private_nonce_payload_t, next_payload)		},
 	/* the critical bit */
-	{ FLAG,				offsetof(private_nonce_payload_t, critical) 		},
-	/* 7 Bit reserved bits, nowhere stored */
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
+	{ FLAG,				offsetof(private_nonce_payload_t, critical)			},
+	/* 7 Bit reserved bits */
+	{ RESERVED_BIT,		offsetof(private_nonce_payload_t, reserved[0])		},
+	{ RESERVED_BIT,		offsetof(private_nonce_payload_t, reserved[1])		},
+	{ RESERVED_BIT,		offsetof(private_nonce_payload_t, reserved[2])		},
+	{ RESERVED_BIT,		offsetof(private_nonce_payload_t, reserved[3])		},
+	{ RESERVED_BIT,		offsetof(private_nonce_payload_t, reserved[4])		},
+	{ RESERVED_BIT,		offsetof(private_nonce_payload_t, reserved[5])		},
+	{ RESERVED_BIT,		offsetof(private_nonce_payload_t, reserved[6])		},
 	/* Length of the whole nonce payload*/
-	{ PAYLOAD_LENGTH,	offsetof(private_nonce_payload_t, payload_length) 	},
+	{ PAYLOAD_LENGTH,	offsetof(private_nonce_payload_t, payload_length)	},
 	/* some nonce bytes, lenth is defined in PAYLOAD_LENGTH */
-	{ NONCE_DATA,			offsetof(private_nonce_payload_t, nonce) 		}
+	{ NONCE_DATA,		offsetof(private_nonce_payload_t, nonce)			},
 };
 
 /*                           1                   2                   3
@@ -92,102 +95,64 @@ encoding_rule_t nonce_payload_encodings[] = {
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 */
 
-/**
- * Implementation of payload_t.verify.
- */
-static status_t verify(private_nonce_payload_t *this)
+METHOD(payload_t, verify, status_t,
+	private_nonce_payload_t *this)
 {
-	if ((this->nonce.len < 16) || ((this->nonce.len > 256)))
+	if (this->nonce.len < 16 || this->nonce.len > 256)
 	{
-		/* nonce length is wrong */
 		return FAILED;
 	}
-
 	return SUCCESS;
 }
 
-/**
- * Implementation of nonce_payload_t.set_nonce.
- */
-static status_t set_nonce(private_nonce_payload_t *this, chunk_t nonce)
-{
-	this->nonce.ptr = clalloc(nonce.ptr, nonce.len);
-	this->nonce.len = nonce.len;
-	this->payload_length = NONCE_PAYLOAD_HEADER_LENGTH + nonce.len;
-	return SUCCESS;
-}
-
-/**
- * Implementation of nonce_payload_t.get_nonce.
- */
-static chunk_t get_nonce(private_nonce_payload_t *this)
-{
-	chunk_t nonce;
-	nonce.ptr = clalloc(this->nonce.ptr,this->nonce.len);
-	nonce.len = this->nonce.len;
-	return nonce;
-}
-
-/**
- * Implementation of nonce_payload_t.get_encoding_rules.
- */
-static void get_encoding_rules(private_nonce_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
+METHOD(payload_t, get_encoding_rules, void,
+	private_nonce_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
 {
 	*rules = nonce_payload_encodings;
-	*rule_count = sizeof(nonce_payload_encodings) / sizeof(encoding_rule_t);
+	*rule_count = countof(nonce_payload_encodings);
 }
 
-/**
- * Implementation of payload_t.get_type.
- */
-static payload_type_t get_type(private_nonce_payload_t *this)
+METHOD(payload_t, get_type, payload_type_t,
+	private_nonce_payload_t *this)
 {
 	return NONCE;
 }
 
-/**
- * Implementation of payload_t.get_next_type.
- */
-static payload_type_t get_next_type(private_nonce_payload_t *this)
+METHOD(payload_t, get_next_type, payload_type_t,
+	private_nonce_payload_t *this)
 {
-	return (this->next_payload);
+	return this->next_payload;
 }
 
-/**
- * Implementation of payload_t.set_next_type.
- */
-static void set_next_type(private_nonce_payload_t *this,payload_type_t type)
+METHOD(payload_t, set_next_type, void,
+	private_nonce_payload_t *this, payload_type_t type)
 {
 	this->next_payload = type;
 }
 
-/**
- * recompute the length of the payload.
- */
-static void compute_length(private_nonce_payload_t *this)
+METHOD(payload_t, get_length, size_t,
+	private_nonce_payload_t *this)
 {
-	this->payload_length = NONCE_PAYLOAD_HEADER_LENGTH + this->nonce.len;
+	return this->payload_length;
 }
 
-/**
- * Implementation of payload_t.get_length.
- */
-static size_t get_length(private_nonce_payload_t *this)
+METHOD(nonce_payload_t, set_nonce, void,
+	 private_nonce_payload_t *this, chunk_t nonce)
 {
-	compute_length(this);
-	return this->payload_length;
+	this->nonce = chunk_clone(nonce);
+	this->payload_length = NONCE_PAYLOAD_HEADER_LENGTH + nonce.len;
 }
 
-/**
- * Implementation of payload_t.destroy and nonce_payload_t.destroy.
- */
-static void destroy(private_nonce_payload_t *this)
+METHOD(nonce_payload_t, get_nonce, chunk_t,
+	private_nonce_payload_t *this)
 {
-	if (this->nonce.ptr != NULL)
-	{
-		free(this->nonce.ptr);
-	}
+	return chunk_clone(this->nonce);
+}
 
+METHOD2(payload_t, nonce_payload_t, destroy, void,
+	private_nonce_payload_t *this)
+{
+	free(this->nonce.ptr);
 	free(this);
 }
 
@@ -196,30 +161,25 @@ static void destroy(private_nonce_payload_t *this)
  */
 nonce_payload_t *nonce_payload_create()
 {
-	private_nonce_payload_t *this = malloc_thing(private_nonce_payload_t);
-
-	/* interface functions */
-	this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
-	this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
-	this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length;
-	this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type;
-	this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
-	this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_type;
-	this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
-	/* public functions */
-	this->public.destroy = (void (*) (nonce_payload_t *)) destroy;
-	this->public.set_nonce = (void (*) (nonce_payload_t *,chunk_t)) set_nonce;
-	this->public.get_nonce = (chunk_t (*) (nonce_payload_t *)) get_nonce;
-
-	/* private variables */
-	this->critical = FALSE;
-	this->next_payload = NO_PAYLOAD;
-	this->payload_length = NONCE_PAYLOAD_HEADER_LENGTH;
-	this->nonce.ptr = NULL;
-	this->nonce.len = 0;
-
-	return (&(this->public));
+	private_nonce_payload_t *this;
+
+	INIT(this,
+		.public = {
+			.payload_interface = {
+				.verify = _verify,
+				.get_encoding_rules = _get_encoding_rules,
+				.get_length = _get_length,
+				.get_next_type = _get_next_type,
+				.set_next_type = _set_next_type,
+				.get_type = _get_type,
+				.destroy = _destroy,
+			},
+			.set_nonce = _set_nonce,
+			.get_nonce = _get_nonce,
+			.destroy = _destroy,
+		},
+		.next_payload = NO_PAYLOAD,
+		.payload_length = NONCE_PAYLOAD_HEADER_LENGTH,
+	);
+	return &this->public;
 }
-
-
diff --git a/src/libcharon/encoding/payloads/notify_payload.c b/src/libcharon/encoding/payloads/notify_payload.c
index a56fd1869..77f15ec6d 100644
--- a/src/libcharon/encoding/payloads/notify_payload.c
+++ b/src/libcharon/encoding/payloads/notify_payload.c
@@ -1,7 +1,8 @@
 /*
+ * Copyright (C) 2005-2010 Martin Willi
+ * Copyright (C) 2010 revosec AG
  * Copyright (C) 2006-2008 Tobias Brunner
  * Copyright (C) 2006 Daniel Roethlisberger
- * Copyright (C) 2005-2006 Martin Willi
  * Copyright (C) 2005 Jan Hutter
  * Hochschule fuer Technik Rapperswil
  *
@@ -186,9 +187,9 @@ typedef struct private_notify_payload_t private_notify_payload_t;
 
 /**
  * Private data of an notify_payload_t object.
- *
  */
 struct private_notify_payload_t {
+
 	/**
 	 * Public notify_payload_t interface.
 	 */
@@ -205,6 +206,11 @@ struct private_notify_payload_t {
 	bool critical;
 
 	/**
+	 * reserved bits
+	 */
+	bool reserved[7];
+
+	/**
 	 * Length of this payload.
 	 */
 	u_int16_t payload_length;
@@ -240,7 +246,6 @@ struct private_notify_payload_t {
  *
  * The defined offsets are the positions in a object of type
  * private_notify_payload_t.
- *
  */
 encoding_rule_t notify_payload_encodings[] = {
 	/* 1 Byte next payload type, stored in the field next_payload */
@@ -248,13 +253,13 @@ encoding_rule_t notify_payload_encodings[] = {
 	/* the critical bit */
 	{ FLAG,				offsetof(private_notify_payload_t, critical)			},
 	/* 7 Bit reserved bits, nowhere stored */
-	{ RESERVED_BIT,	0														},
-	{ RESERVED_BIT,	0														},
-	{ RESERVED_BIT,	0														},
-	{ RESERVED_BIT,	0														},
-	{ RESERVED_BIT,	0														},
-	{ RESERVED_BIT,	0														},
-	{ RESERVED_BIT,	0														},
+	{ RESERVED_BIT,		offsetof(private_notify_payload_t, reserved[0])			},
+	{ RESERVED_BIT,		offsetof(private_notify_payload_t, reserved[1])			},
+	{ RESERVED_BIT,		offsetof(private_notify_payload_t, reserved[2])			},
+	{ RESERVED_BIT,		offsetof(private_notify_payload_t, reserved[3])			},
+	{ RESERVED_BIT,		offsetof(private_notify_payload_t, reserved[4])			},
+	{ RESERVED_BIT,		offsetof(private_notify_payload_t, reserved[5])			},
+	{ RESERVED_BIT,		offsetof(private_notify_payload_t, reserved[6])			},
 	/* Length of the whole payload*/
 	{ PAYLOAD_LENGTH,	offsetof(private_notify_payload_t, payload_length)		},
 	/* Protocol ID as 8 bit field*/
@@ -262,11 +267,11 @@ encoding_rule_t notify_payload_encodings[] = {
 	/* SPI Size as 8 bit field*/
 	{ SPI_SIZE,			offsetof(private_notify_payload_t, spi_size)			},
 	/* Notify message type as 16 bit field*/
-	{ U_INT_16,			offsetof(private_notify_payload_t, notify_type)	},
+	{ U_INT_16,			offsetof(private_notify_payload_t, notify_type)			},
 	/* SPI as variable length field*/
 	{ SPI,				offsetof(private_notify_payload_t, spi)					},
 	/* Key Exchange Data is from variable size */
-	{ NOTIFICATION_DATA,	offsetof(private_notify_payload_t, notification_data)	}
+	{ NOTIFICATION_DATA,offsetof(private_notify_payload_t, notification_data)	}
 };
 
 /*
@@ -287,10 +292,8 @@ encoding_rule_t notify_payload_encodings[] = {
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 */
 
-/**
- * Implementation of payload_t.verify.
- */
-static status_t verify(private_notify_payload_t *this)
+METHOD(payload_t, verify, status_t,
+	private_notify_payload_t *this)
 {
 	bool bad_length = FALSE;
 
@@ -404,35 +407,27 @@ static status_t verify(private_notify_payload_t *this)
 	return SUCCESS;
 }
 
-/**
- * Implementation of payload_t.get_encoding_rules.
- */
-static void get_encoding_rules(private_notify_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
+METHOD(payload_t, get_encoding_rules, void,
+	private_notify_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
 {
 	*rules = notify_payload_encodings;
-	*rule_count = sizeof(notify_payload_encodings) / sizeof(encoding_rule_t);
+	*rule_count = countof(notify_payload_encodings);
 }
 
-/**
- * Implementation of payload_t.get_type.
- */
-static payload_type_t get_type(private_notify_payload_t *this)
+METHOD(payload_t, get_type, payload_type_t,
+	private_notify_payload_t *this)
 {
 	return NOTIFY;
 }
 
-/**
- * Implementation of payload_t.get_next_type.
- */
-static payload_type_t get_next_type(private_notify_payload_t *this)
+METHOD(payload_t, get_next_type, payload_type_t,
+	private_notify_payload_t *this)
 {
-	return (this->next_payload);
+	return this->next_payload;
 }
 
-/**
- * Implementation of payload_t.set_next_type.
- */
-static void set_next_type(private_notify_payload_t *this,payload_type_t type)
+METHOD(payload_t, set_next_type, void,
+	private_notify_payload_t *this, payload_type_t type)
 {
 	this->next_payload = type;
 }
@@ -443,6 +438,7 @@ static void set_next_type(private_notify_payload_t *this,payload_type_t type)
 static void compute_length (private_notify_payload_t *this)
 {
 	size_t length = NOTIFY_PAYLOAD_HEADER_LENGTH;
+
 	if (this->notification_data.ptr != NULL)
 	{
 		length += this->notification_data.len;
@@ -454,51 +450,38 @@ static void compute_length (private_notify_payload_t *this)
 	this->payload_length = length;
 }
 
-/**
- * Implementation of payload_t.get_length.
- */
-static size_t get_length(private_notify_payload_t *this)
+METHOD(payload_t, get_length, size_t,
+	private_notify_payload_t *this)
 {
-	compute_length(this);
 	return this->payload_length;
 }
 
-/**
- * Implementation of notify_payload_t.get_protocol_id.
- */
-static u_int8_t get_protocol_id(private_notify_payload_t *this)
+METHOD(notify_payload_t, get_protocol_id, u_int8_t,
+	private_notify_payload_t *this)
 {
 	return this->protocol_id;
 }
 
-/**
- * Implementation of notify_payload_t.set_protocol_id.
- */
-static void set_protocol_id(private_notify_payload_t *this, u_int8_t protocol_id)
+METHOD(notify_payload_t, set_protocol_id, void,
+	private_notify_payload_t *this, u_int8_t protocol_id)
 {
 	this->protocol_id = protocol_id;
 }
 
-/**
- * Implementation of notify_payload_t.get_notify_type.
- */
-static notify_type_t get_notify_type(private_notify_payload_t *this)
+METHOD(notify_payload_t, get_notify_type, notify_type_t,
+	private_notify_payload_t *this)
 {
 	return this->notify_type;
 }
 
-/**
- * Implementation of notify_payload_t.set_notify_type.
- */
-static void set_notify_type(private_notify_payload_t *this, u_int16_t notify_type)
+METHOD(notify_payload_t, set_notify_type, void,
+	private_notify_payload_t *this, notify_type_t notify_type)
 {
 	this->notify_type = notify_type;
 }
 
-/**
- * Implementation of notify_payload_t.get_spi.
- */
-static u_int32_t get_spi(private_notify_payload_t *this)
+METHOD(notify_payload_t, get_spi, u_int32_t,
+	private_notify_payload_t *this)
 {
 	switch (this->protocol_id)
 	{
@@ -514,10 +497,8 @@ static u_int32_t get_spi(private_notify_payload_t *this)
 	return 0;
 }
 
-/**
- * Implementation of notify_payload_t.set_spi.
- */
-static void set_spi(private_notify_payload_t *this, u_int32_t spi)
+METHOD(notify_payload_t, set_spi, void,
+	private_notify_payload_t *this, u_int32_t spi)
 {
 	chunk_free(&this->spi);
 	switch (this->protocol_id)
@@ -534,37 +515,26 @@ static void set_spi(private_notify_payload_t *this, u_int32_t spi)
 	compute_length(this);
 }
 
-/**
- * Implementation of notify_payload_t.get_notification_data.
- */
-static chunk_t get_notification_data(private_notify_payload_t *this)
+METHOD(notify_payload_t, get_notification_data, chunk_t,
+	private_notify_payload_t *this)
 {
-	return (this->notification_data);
+	return this->notification_data;
 }
 
-/**
- * Implementation of notify_payload_t.set_notification_data.
- */
-static status_t set_notification_data(private_notify_payload_t *this, chunk_t notification_data)
+METHOD(notify_payload_t, set_notification_data, void,
+	private_notify_payload_t *this, chunk_t data)
 {
-	chunk_free(&this->notification_data);
-	if (notification_data.len > 0)
-	{
-		this->notification_data = chunk_clone(notification_data);
-	}
+	free(this->notification_data.ptr);
+	this->notification_data = chunk_clone(data);
 	compute_length(this);
-	return SUCCESS;
 }
 
-/**
- * Implementation of notify_payload_t.destroy and notify_payload_t.destroy.
- */
-static status_t destroy(private_notify_payload_t *this)
+METHOD2(payload_t, notify_payload_t, destroy, void,
+	private_notify_payload_t *this)
 {
-	chunk_free(&this->notification_data);
-	chunk_free(&this->spi);
+	free(this->notification_data.ptr);
+	free(this->spi.ptr);
 	free(this);
-	return SUCCESS;
 }
 
 /*
@@ -572,52 +542,45 @@ static status_t destroy(private_notify_payload_t *this)
  */
 notify_payload_t *notify_payload_create()
 {
-	private_notify_payload_t *this = malloc_thing(private_notify_payload_t);
-
-	/* interface functions */
-	this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
-	this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
-	this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length;
-	this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type;
-	this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
-	this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_type;
-	this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
-	/* public functions */
-	this->public.get_protocol_id = (u_int8_t (*) (notify_payload_t *)) get_protocol_id;
-	this->public.set_protocol_id  = (void (*) (notify_payload_t *,u_int8_t)) set_protocol_id;
-	this->public.get_notify_type = (notify_type_t (*) (notify_payload_t *)) get_notify_type;
-	this->public.set_notify_type = (void (*) (notify_payload_t *,notify_type_t)) set_notify_type;
-	this->public.get_spi = (u_int32_t (*) (notify_payload_t *)) get_spi;
-	this->public.set_spi = (void (*) (notify_payload_t *,u_int32_t)) set_spi;
-	this->public.get_notification_data = (chunk_t (*) (notify_payload_t *)) get_notification_data;
-	this->public.set_notification_data = (void (*) (notify_payload_t *,chunk_t)) set_notification_data;
-	this->public.destroy = (void (*) (notify_payload_t *)) destroy;
-
-	/* set default values of the fields */
-	this->critical = FALSE;
-	this->next_payload = NO_PAYLOAD;
-	this->payload_length = NOTIFY_PAYLOAD_HEADER_LENGTH;
-	this->protocol_id = 0;
-	this->notify_type = 0;
-	this->spi.ptr = NULL;
-	this->spi.len = 0;
-	this->spi_size = 0;
-	this->notification_data.ptr = NULL;
-	this->notification_data.len = 0;
-
+	private_notify_payload_t *this;
+
+	INIT(this,
+		.public = {
+			.payload_interface = {
+				.verify = _verify,
+				.get_encoding_rules = _get_encoding_rules,
+				.get_length = _get_length,
+				.get_next_type = _get_next_type,
+				.set_next_type = _set_next_type,
+				.get_type = _get_type,
+				.destroy = _destroy,
+			},
+			.get_protocol_id = _get_protocol_id,
+			.set_protocol_id  = _set_protocol_id,
+			.get_notify_type = _get_notify_type,
+			.set_notify_type = _set_notify_type,
+			.get_spi = _get_spi,
+			.set_spi = _set_spi,
+			.get_notification_data = _get_notification_data,
+			.set_notification_data = _set_notification_data,
+			.destroy = _destroy,
+		},
+		.next_payload = NO_PAYLOAD,
+		.payload_length = NOTIFY_PAYLOAD_HEADER_LENGTH,
+	);
 	return &this->public;
 }
 
 /*
  * Described in header.
  */
-notify_payload_t *notify_payload_create_from_protocol_and_type(protocol_id_t protocol_id, notify_type_t notify_type)
+notify_payload_t *notify_payload_create_from_protocol_and_type(
+						protocol_id_t protocol_id, notify_type_t notify_type)
 {
 	notify_payload_t *notify = notify_payload_create();
 
-	notify->set_notify_type(notify,notify_type);
-	notify->set_protocol_id(notify,protocol_id);
+	notify->set_notify_type(notify, notify_type);
+	notify->set_protocol_id(notify, protocol_id);
 
 	return notify;
 }
diff --git a/src/libcharon/encoding/payloads/payload.c b/src/libcharon/encoding/payloads/payload.c
index 1cee6d2aa..d1e677db7 100644
--- a/src/libcharon/encoding/payloads/payload.c
+++ b/src/libcharon/encoding/payloads/payload.c
@@ -59,25 +59,23 @@ ENUM_NEXT(payload_type_names, SECURITY_ASSOCIATION, EXTENSIBLE_AUTHENTICATION, N
 #ifdef ME
 ENUM_NEXT(payload_type_names, ID_PEER, ID_PEER, EXTENSIBLE_AUTHENTICATION,
 	"ID_PEER");
-ENUM_NEXT(payload_type_names, HEADER, UNKNOWN_PAYLOAD, ID_PEER,
+ENUM_NEXT(payload_type_names, HEADER, CONFIGURATION_ATTRIBUTE, ID_PEER,
 	"HEADER",
 	"PROPOSAL_SUBSTRUCTURE",
 	"TRANSFORM_SUBSTRUCTURE",
 	"TRANSFORM_ATTRIBUTE",
 	"TRAFFIC_SELECTOR_SUBSTRUCTURE",
-	"CONFIGURATION_ATTRIBUTE",
-	"UNKNOWN_PAYLOAD");
+	"CONFIGURATION_ATTRIBUTE");
 #else
-ENUM_NEXT(payload_type_names, HEADER, UNKNOWN_PAYLOAD, EXTENSIBLE_AUTHENTICATION,
+ENUM_NEXT(payload_type_names, HEADER, CONFIGURATION_ATTRIBUTE, EXTENSIBLE_AUTHENTICATION,
 	"HEADER",
 	"PROPOSAL_SUBSTRUCTURE",
 	"TRANSFORM_SUBSTRUCTURE",
 	"TRANSFORM_ATTRIBUTE",
 	"TRAFFIC_SELECTOR_SUBSTRUCTURE",
-	"CONFIGURATION_ATTRIBUTE",
-	"UNKNOWN_PAYLOAD");
+	"CONFIGURATION_ATTRIBUTE");
 #endif /* ME */
-ENUM_END(payload_type_names, UNKNOWN_PAYLOAD);
+ENUM_END(payload_type_names, CONFIGURATION_ATTRIBUTE);
 
 /* short forms of payload names */
 ENUM_BEGIN(payload_type_short_names, NO_PAYLOAD, NO_PAYLOAD,
@@ -102,25 +100,23 @@ ENUM_NEXT(payload_type_short_names, SECURITY_ASSOCIATION, EXTENSIBLE_AUTHENTICAT
 #ifdef ME
 ENUM_NEXT(payload_type_short_names, ID_PEER, ID_PEER, EXTENSIBLE_AUTHENTICATION,
 	"IDp");
-ENUM_NEXT(payload_type_short_names, HEADER, UNKNOWN_PAYLOAD, ID_PEER,
+ENUM_NEXT(payload_type_short_names, HEADER, CONFIGURATION_ATTRIBUTE, ID_PEER,
 	"HDR",
 	"PROP",
 	"TRANS",
 	"TRANSATTR",
 	"TSSUB",
-	"CPATTR",
-	"??");
+	"CPATTR");
 #else
-ENUM_NEXT(payload_type_short_names, HEADER, UNKNOWN_PAYLOAD, EXTENSIBLE_AUTHENTICATION,
+ENUM_NEXT(payload_type_short_names, HEADER, CONFIGURATION_ATTRIBUTE, EXTENSIBLE_AUTHENTICATION,
 	"HDR",
 	"PROP",
 	"TRANS",
 	"TRANSATTR",
 	"TSSUB",
-	"CPATTR",
-	"??");
+	"CPATTR");
 #endif /* ME */
-ENUM_END(payload_type_short_names, UNKNOWN_PAYLOAD);
+ENUM_END(payload_type_short_names, CONFIGURATION_ATTRIBUTE);
 
 /*
  * see header
@@ -178,7 +174,45 @@ payload_t *payload_create(payload_type_t type)
 		case ENCRYPTED:
 			return (payload_t*)encryption_payload_create();
 		default:
-			return (payload_t*)unknown_payload_create();
+			return (payload_t*)unknown_payload_create(type);
 	}
 }
 
+/**
+ * See header.
+ */
+bool payload_is_known(payload_type_t type)
+{
+	if (type == HEADER ||
+		(type >= SECURITY_ASSOCIATION && type <= EXTENSIBLE_AUTHENTICATION))
+	{
+		return TRUE;
+	}
+#ifdef ME
+	if (type == ID_PEER)
+	{
+		return TRUE;
+	}
+#endif
+	return FALSE;
+}
+
+/**
+ * See header.
+ */
+void* payload_get_field(payload_t *payload, encoding_type_t type, u_int skip)
+{
+	encoding_rule_t *rule;
+	size_t count;
+	int i;
+
+	payload->get_encoding_rules(payload, &rule, &count);
+	for (i = 0; i < count; i++)
+	{
+		if (rule[i].type == type && skip-- == 0)
+		{
+			return ((char*)payload) + rule[i].offset;
+		}
+	}
+	return NULL;
+}
diff --git a/src/libcharon/encoding/payloads/payload.h b/src/libcharon/encoding/payloads/payload.h
index 2e783cb30..0f407ff42 100644
--- a/src/libcharon/encoding/payloads/payload.h
+++ b/src/libcharon/encoding/payloads/payload.h
@@ -137,7 +137,7 @@ enum payload_type_t{
 	 * This payload type is not sent over wire and just
 	 * used internally to handle IKEv2-Header like a payload.
 	 */
-	HEADER = 140,
+	HEADER = 256,
 
 	/**
 	 * PROPOSAL_SUBSTRUCTURE has a value of PRIVATE USE space.
@@ -145,7 +145,7 @@ enum payload_type_t{
 	 * This payload type is not sent over wire and just
 	 * used internally to handle a proposal substructure like a payload.
 	 */
-	PROPOSAL_SUBSTRUCTURE = 141,
+	PROPOSAL_SUBSTRUCTURE = 257,
 
 	/**
 	 * TRANSFORM_SUBSTRUCTURE has a value of PRIVATE USE space.
@@ -153,7 +153,7 @@ enum payload_type_t{
 	 * This payload type is not sent over wire and just
 	 * used internally to handle a transform substructure like a payload.
 	 */
-	TRANSFORM_SUBSTRUCTURE = 142,
+	TRANSFORM_SUBSTRUCTURE = 258,
 
 	/**
 	 * TRANSFORM_ATTRIBUTE has a value of PRIVATE USE space.
@@ -161,7 +161,7 @@ enum payload_type_t{
 	 * This payload type is not sent over wire and just
 	 * used internally to handle a transform attribute like a payload.
 	 */
-	TRANSFORM_ATTRIBUTE = 143,
+	TRANSFORM_ATTRIBUTE = 259,
 
 	/**
 	 * TRAFFIC_SELECTOR_SUBSTRUCTURE has a value of PRIVATE USE space.
@@ -169,7 +169,7 @@ enum payload_type_t{
 	 * This payload type is not sent over wire and just
 	 * used internally to handle a transform selector like a payload.
 	 */
-	TRAFFIC_SELECTOR_SUBSTRUCTURE = 144,
+	TRAFFIC_SELECTOR_SUBSTRUCTURE = 260,
 
 	/**
 	 * CONFIGURATION_ATTRIBUTE has a value of PRIVATE USE space.
@@ -177,18 +177,9 @@ enum payload_type_t{
 	 * This payload type is not sent over wire and just
 	 * used internally to handle a transform attribute like a payload.
 	 */
-	CONFIGURATION_ATTRIBUTE = 145,
-
-	/**
-	 * A unknown payload has a value of PRIVATE USE space.
-	 *
-	 * This payload type is not sent over wire and just
-	 * used internally to handle a unknown payload.
-	 */
-	UNKNOWN_PAYLOAD = 146,
+	CONFIGURATION_ATTRIBUTE = 261,
 };
 
-
 /**
  * enum names for payload_type_t.
  */
@@ -269,4 +260,22 @@ struct payload_t {
  */
 payload_t *payload_create(payload_type_t type);
 
+/**
+ * Check if a specific payload is implemented, or handled as unknown payload.
+ *
+ * @param type		type of the payload to check
+ * @return			FALSE if payload type handled as unknown payload
+ */
+bool payload_is_known(payload_type_t type);
+
+/**
+ * Get the value field in a payload using encoding rules.
+ *
+ * @param payload	payload to look up a field
+ * @param type		encoding rule type to look up
+ * @param skip		number rules of type to skip, 0 to get first
+ * @return			type specific value pointer, NULL if not found
+ */
+void* payload_get_field(payload_t *payload, encoding_type_t type, u_int skip);
+
 #endif /** PAYLOAD_H_ @}*/
diff --git a/src/libcharon/encoding/payloads/proposal_substructure.c b/src/libcharon/encoding/payloads/proposal_substructure.c
index 985b03255..f39c3b0e6 100644
--- a/src/libcharon/encoding/payloads/proposal_substructure.c
+++ b/src/libcharon/encoding/payloads/proposal_substructure.c
@@ -47,6 +47,11 @@ struct private_proposal_substructure_t {
 	u_int8_t  next_payload;
 
 	/**
+	 * reserved byte
+	 */
+	u_int8_t reserved;
+
+	/**
 	 * Length of this payload.
 	 */
 	u_int16_t proposal_length;
@@ -91,8 +96,8 @@ struct private_proposal_substructure_t {
 encoding_rule_t proposal_substructure_encodings[] = {
 	/* 1 Byte next payload type, stored in the field next_payload */
 	{ U_INT_8,			offsetof(private_proposal_substructure_t, next_payload)		},
-	/* Reserved Byte is skipped */
-	{ RESERVED_BYTE,	0															},
+	/* 1 Reserved Byte */
+	{ RESERVED_BYTE,	offsetof(private_proposal_substructure_t, reserved)			},
 	/* Length of the whole proposal substructure payload*/
 	{ PAYLOAD_LENGTH,	offsetof(private_proposal_substructure_t, proposal_length)	},
 	/* proposal number is a number of 8 bit */
@@ -213,28 +218,23 @@ METHOD(payload_t, set_next_type, void,
  */
 static void compute_length(private_proposal_substructure_t *this)
 {
-	iterator_t *iterator;
-	payload_t *current_transform;
-	size_t transforms_count = 0;
-	size_t length = PROPOSAL_SUBSTRUCTURE_HEADER_LENGTH;
+	enumerator_t *enumerator;
+	payload_t *transform;
 
-	iterator = this->transforms->create_iterator(this->transforms,TRUE);
-	while (iterator->iterate(iterator, (void**)&current_transform))
+	this->transforms_count = 0;
+	this->proposal_length = PROPOSAL_SUBSTRUCTURE_HEADER_LENGTH + this->spi.len;
+	enumerator = this->transforms->create_enumerator(this->transforms);
+	while (enumerator->enumerate(enumerator, &transform))
 	{
-		length += current_transform->get_length(current_transform);
-		transforms_count++;
+		this->proposal_length += transform->get_length(transform);
+		this->transforms_count++;
 	}
-	iterator->destroy(iterator);
-
-	length += this->spi.len;
-	this->transforms_count = transforms_count;
-	this->proposal_length = length;
+	enumerator->destroy(enumerator);
 }
 
 METHOD(payload_t, get_length, size_t,
 	private_proposal_substructure_t *this)
 {
-	compute_length(this);
 	return this->proposal_length;
 }
 
@@ -342,32 +342,10 @@ METHOD(proposal_substructure_t, get_proposal, proposal_t*,
 	return proposal;
 }
 
-METHOD(proposal_substructure_t, clone_, proposal_substructure_t*,
+METHOD(proposal_substructure_t, create_substructure_enumerator, enumerator_t*,
 	private_proposal_substructure_t *this)
 {
-	private_proposal_substructure_t *clone;
-	enumerator_t *enumerator;
-	transform_substructure_t *current;
-
-	clone = (private_proposal_substructure_t*)proposal_substructure_create();
-	clone->next_payload = this->next_payload;
-	clone->proposal_number = this->proposal_number;
-	clone->protocol_id = this->protocol_id;
-	clone->spi_size = this->spi_size;
-	if (this->spi.ptr != NULL)
-	{
-		clone->spi.ptr = clalloc(this->spi.ptr, this->spi.len);
-		clone->spi.len = this->spi.len;
-	}
-	enumerator = this->transforms->create_enumerator(this->transforms);
-	while (enumerator->enumerate(enumerator, &current))
-	{
-		current = current->clone(current);
-		add_transform_substructure(clone, current);
-	}
-	enumerator->destroy(enumerator);
-
-	return &clone->public;
+	return this->transforms->create_enumerator(this->transforms);
 }
 
 METHOD2(payload_t, proposal_substructure_t, destroy, void,
@@ -403,12 +381,13 @@ proposal_substructure_t *proposal_substructure_create()
 			.get_protocol_id = _get_protocol_id,
 			.set_is_last_proposal = _set_is_last_proposal,
 			.get_proposal = _get_proposal,
+			.create_substructure_enumerator = _create_substructure_enumerator,
 			.set_spi = _set_spi,
 			.get_spi = _get_spi,
-			.clone = _clone_,
 			.destroy = _destroy,
 		},
 		.next_payload = NO_PAYLOAD,
+		.proposal_length = PROPOSAL_SUBSTRUCTURE_HEADER_LENGTH,
 		.transforms = linked_list_create(),
 	);
 
@@ -500,6 +479,7 @@ proposal_substructure_t *proposal_substructure_create_from_proposal(
 	}
 	this->proposal_number = proposal->get_number(proposal);
 	this->protocol_id = proposal->get_protocol(proposal);
+	compute_length(this);
 
 	return &this->public;
 }
diff --git a/src/libcharon/encoding/payloads/proposal_substructure.h b/src/libcharon/encoding/payloads/proposal_substructure.h
index 56e7184b6..d0ba1fd2a 100644
--- a/src/libcharon/encoding/payloads/proposal_substructure.h
+++ b/src/libcharon/encoding/payloads/proposal_substructure.h
@@ -111,11 +111,11 @@ struct proposal_substructure_t {
 	proposal_t * (*get_proposal) (proposal_substructure_t *this);
 
 	/**
-	 * Clones an proposal_substructure_t object.
+	 * Create an enumerator over transform substructures.
 	 *
-	 * @return		cloned object
+	 * @return			enumerator over transform_substructure_t
 	 */
-	proposal_substructure_t* (*clone) (proposal_substructure_t *this);
+	enumerator_t* (*create_substructure_enumerator)(proposal_substructure_t *this);
 
 	/**
 	 * Destroys an proposal_substructure_t object.
diff --git a/src/libcharon/encoding/payloads/sa_payload.c b/src/libcharon/encoding/payloads/sa_payload.c
index 4fbd4cac0..db20d052f 100644
--- a/src/libcharon/encoding/payloads/sa_payload.c
+++ b/src/libcharon/encoding/payloads/sa_payload.c
@@ -46,6 +46,11 @@ struct private_sa_payload_t {
 	bool critical;
 
 	/**
+	 * Reserved bits
+	 */
+	bool reserved[7];
+
+	/**
 	 * Length of this payload.
 	 */
 	u_int16_t payload_length;
@@ -68,13 +73,13 @@ encoding_rule_t sa_payload_encodings[] = {
 	/* the critical bit */
 	{ FLAG,				offsetof(private_sa_payload_t, critical)			},
 	/* 7 Bit reserved bits, nowhere stored */
-	{ RESERVED_BIT,		0													},
-	{ RESERVED_BIT,		0													},
-	{ RESERVED_BIT,		0													},
-	{ RESERVED_BIT,		0													},
-	{ RESERVED_BIT,		0													},
-	{ RESERVED_BIT,		0													},
-	{ RESERVED_BIT,		0													},
+	{ RESERVED_BIT,		offsetof(private_sa_payload_t, reserved[0])			},
+	{ RESERVED_BIT,		offsetof(private_sa_payload_t, reserved[1])			},
+	{ RESERVED_BIT,		offsetof(private_sa_payload_t, reserved[2])			},
+	{ RESERVED_BIT,		offsetof(private_sa_payload_t, reserved[3])			},
+	{ RESERVED_BIT,		offsetof(private_sa_payload_t, reserved[4])			},
+	{ RESERVED_BIT,		offsetof(private_sa_payload_t, reserved[5])			},
+	{ RESERVED_BIT,		offsetof(private_sa_payload_t, reserved[6])			},
 	/* Length of the whole SA payload*/
 	{ PAYLOAD_LENGTH,	offsetof(private_sa_payload_t, payload_length)		},
 	/* Proposals are stored in a proposal substructure,
@@ -185,7 +190,6 @@ static void compute_length(private_sa_payload_t *this)
 METHOD(payload_t, get_length, size_t,
 	private_sa_payload_t *this)
 {
-	compute_length(this);
 	return this->payload_length;
 }
 
@@ -258,6 +262,12 @@ METHOD(sa_payload_t, get_proposals, linked_list_t*,
 	return list;
 }
 
+METHOD(sa_payload_t, create_substructure_enumerator, enumerator_t*,
+	private_sa_payload_t *this)
+{
+	return this->proposals->create_enumerator(this->proposals);
+}
+
 METHOD2(payload_t, sa_payload_t, destroy, void,
 	private_sa_payload_t *this)
 {
@@ -286,6 +296,7 @@ sa_payload_t *sa_payload_create()
 			},
 			.add_proposal = _add_proposal,
 			.get_proposals = _get_proposals,
+			.create_substructure_enumerator = _create_substructure_enumerator,
 			.destroy = _destroy,
 		},
 		.next_payload = NO_PAYLOAD,
diff --git a/src/libcharon/encoding/payloads/sa_payload.h b/src/libcharon/encoding/payloads/sa_payload.h
index 801a70738..cc8c481c8 100644
--- a/src/libcharon/encoding/payloads/sa_payload.h
+++ b/src/libcharon/encoding/payloads/sa_payload.h
@@ -61,6 +61,13 @@ struct sa_payload_t {
 	void (*add_proposal) (sa_payload_t *this, proposal_t *proposal);
 
 	/**
+	 * Create an enumerator over all proposal substructures.
+	 *
+	 * @return					enumerator over proposal_substructure_t
+	 */
+	enumerator_t* (*create_substructure_enumerator)(sa_payload_t *this);
+
+	/**
 	 * Destroys an sa_payload_t object.
 	 */
 	void (*destroy) (sa_payload_t *this);
diff --git a/src/libcharon/encoding/payloads/traffic_selector_substructure.c b/src/libcharon/encoding/payloads/traffic_selector_substructure.c
index f24857591..df36e4383 100644
--- a/src/libcharon/encoding/payloads/traffic_selector_substructure.c
+++ b/src/libcharon/encoding/payloads/traffic_selector_substructure.c
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2005-2006 Martin Willi
+ * Copyright (C) 2005-2010 Martin Willi
+ * Copyright (C) 2010 revosec AG
  * Copyright (C) 2005 Jan Hutter
  * Hochschule fuer Technik Rapperswil
  *
@@ -19,14 +20,13 @@
 #include <encoding/payloads/encodings.h>
 #include <utils/linked_list.h>
 
-
 typedef struct private_traffic_selector_substructure_t private_traffic_selector_substructure_t;
 
 /**
  * Private data of an traffic_selector_substructure_t object.
- *
  */
 struct private_traffic_selector_substructure_t {
+
 	/**
 	 * Public traffic_selector_substructure_t interface.
 	 */
@@ -73,24 +73,22 @@ struct private_traffic_selector_substructure_t {
  *
  * The defined offsets are the positions in a object of type
  * private_traffic_selector_substructure_t.
- *
  */
 encoding_rule_t traffic_selector_substructure_encodings[] = {
 	/* 1 Byte next ts type*/
-	{ TS_TYPE,			offsetof(private_traffic_selector_substructure_t, ts_type) 			},
+	{ TS_TYPE,		offsetof(private_traffic_selector_substructure_t, ts_type) 			},
 	/* 1 Byte IP protocol id*/
-	{ U_INT_8,			offsetof(private_traffic_selector_substructure_t, ip_protocol_id) 	},
+	{ U_INT_8,		offsetof(private_traffic_selector_substructure_t, ip_protocol_id) 	},
 	/* Length of the whole payload*/
-	{ PAYLOAD_LENGTH,	offsetof(private_traffic_selector_substructure_t, payload_length)		},
+	{ PAYLOAD_LENGTH,offsetof(private_traffic_selector_substructure_t, payload_length)	},
 	/* 2 Byte start port*/
-	{ U_INT_16,		offsetof(private_traffic_selector_substructure_t, start_port)			},
+	{ U_INT_16,		offsetof(private_traffic_selector_substructure_t, start_port)		},
 	/* 2 Byte end port*/
 	{ U_INT_16,		offsetof(private_traffic_selector_substructure_t, end_port)			},
 	/* starting address is either 4 or 16 byte */
-	{ ADDRESS,			offsetof(private_traffic_selector_substructure_t, starting_address)	},
+	{ ADDRESS,		offsetof(private_traffic_selector_substructure_t, starting_address)	},
 	/* ending address is either 4 or 16 byte */
-	{ ADDRESS,			offsetof(private_traffic_selector_substructure_t, ending_address)		}
-
+	{ ADDRESS,		offsetof(private_traffic_selector_substructure_t, ending_address)	}
 };
 
 /*
@@ -111,10 +109,8 @@ encoding_rule_t traffic_selector_substructure_encodings[] = {
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 */
 
-/**
- * Implementation of payload_t.verify.
- */
-static status_t verify(private_traffic_selector_substructure_t *this)
+METHOD(payload_t, verify, status_t,
+	private_traffic_selector_substructure_t *this)
 {
 	if (this->start_port > this->end_port)
 	{
@@ -152,72 +148,48 @@ static status_t verify(private_traffic_selector_substructure_t *this)
 	return SUCCESS;
 }
 
-/**
- * Implementation of traffic_selector_substructure_t.get_encoding_rules.
- */
-static void get_encoding_rules(private_traffic_selector_substructure_t *this, encoding_rule_t **rules, size_t *rule_count)
+METHOD(payload_t, get_encoding_rules, void,
+	private_traffic_selector_substructure_t *this, encoding_rule_t **rules,
+	size_t *rule_count)
 {
 	*rules = traffic_selector_substructure_encodings;
-	*rule_count = sizeof(traffic_selector_substructure_encodings) / sizeof(encoding_rule_t);
+	*rule_count = countof(traffic_selector_substructure_encodings);
 }
 
-/**
- * Implementation of payload_t.get_type.
- */
-static payload_type_t get_payload_type(private_traffic_selector_substructure_t *this)
+METHOD(payload_t, get_type, payload_type_t,
+	private_traffic_selector_substructure_t *this)
 {
 	return TRAFFIC_SELECTOR_SUBSTRUCTURE;
 }
 
-/**
- * Implementation of payload_t.get_next_type.
- */
-static payload_type_t get_next_type(private_traffic_selector_substructure_t *this)
+METHOD(payload_t, get_next_type, payload_type_t,
+	private_traffic_selector_substructure_t *this)
 {
-	return 0;
+	return NO_PAYLOAD;
 }
 
-/**
- * Implementation of payload_t.set_next_type.
- */
-static void set_next_type(private_traffic_selector_substructure_t *this,payload_type_t type)
+METHOD(payload_t, set_next_type, void,
+	private_traffic_selector_substructure_t *this,payload_type_t type)
 {
-
 }
 
-/**
- * Implementation of payload_t.get_length.
- */
-static size_t get_length(private_traffic_selector_substructure_t *this)
+METHOD(payload_t, get_length, size_t,
+	private_traffic_selector_substructure_t *this)
 {
 	return this->payload_length;
 }
 
-/**
- * Implementation of traffic_selector_substructure_t.get_traffic_selector.
- */
-static traffic_selector_t *get_traffic_selector(private_traffic_selector_substructure_t *this)
+METHOD(traffic_selector_substructure_t, get_traffic_selector, traffic_selector_t*,
+	private_traffic_selector_substructure_t *this)
 {
-	traffic_selector_t *ts;
-	ts = traffic_selector_create_from_bytes(this->ip_protocol_id, this->ts_type,
-											this->starting_address, this->start_port,
-											this->ending_address, this->end_port);
-	return ts;
+	return traffic_selector_create_from_bytes(
+									this->ip_protocol_id, this->ts_type,
+									this->starting_address, this->start_port,
+									this->ending_address, this->end_port);
 }
 
-/**
- * recompute length field of the payload
- */
-void compute_length(private_traffic_selector_substructure_t *this)
-{
-	this->payload_length = TRAFFIC_SELECTOR_HEADER_LENGTH +
-			this->ending_address.len + this->starting_address.len;
-}
-
-/**
- * Implementation of payload_t.destroy and traffic_selector_substructure_t.destroy.
- */
-static void destroy(private_traffic_selector_substructure_t *this)
+METHOD2(payload_t, traffic_selector_substructure_t, destroy, void,
+	private_traffic_selector_substructure_t *this)
 {
 	free(this->starting_address.ptr);
 	free(this->ending_address.ptr);
@@ -229,48 +201,46 @@ static void destroy(private_traffic_selector_substructure_t *this)
  */
 traffic_selector_substructure_t *traffic_selector_substructure_create()
 {
-	private_traffic_selector_substructure_t *this = malloc_thing(private_traffic_selector_substructure_t);
-
-	/* interface functions */
-	this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
-	this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
-	this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length;
-	this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type;
-	this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
-	this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_payload_type;
-	this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
-	/* public functions */
-	this->public.get_traffic_selector = (traffic_selector_t* (*)(traffic_selector_substructure_t*))get_traffic_selector;
-	this->public.destroy = (void (*) (traffic_selector_substructure_t *)) destroy;
-
-	/* private variables */
-	this->payload_length = TRAFFIC_SELECTOR_HEADER_LENGTH;
-	this->start_port = 0;
-	this->end_port = 0;
-	this->starting_address = chunk_empty;
-	this->ending_address = chunk_empty;
-	this->ip_protocol_id = 0;
-	/* must be set to be valid */
-	this->ts_type = TS_IPV4_ADDR_RANGE;
-
-	return (&(this->public));
+	private_traffic_selector_substructure_t *this;
+
+	INIT(this,
+		.public = {
+			.payload_interface = {
+				.verify = _verify,
+				.get_encoding_rules = _get_encoding_rules,
+				.get_length = _get_length,
+				.get_next_type = _get_next_type,
+				.set_next_type = _set_next_type,
+				.get_type = _get_type,
+				.destroy = _destroy,
+			},
+			.get_traffic_selector = _get_traffic_selector,
+			.destroy = _destroy,
+		},
+		.payload_length = TRAFFIC_SELECTOR_HEADER_LENGTH,
+		/* must be set to be valid */
+		.ts_type = TS_IPV4_ADDR_RANGE,
+	);
+	return &this->public;
 }
 
 /*
  * Described in header
  */
-traffic_selector_substructure_t *traffic_selector_substructure_create_from_traffic_selector(traffic_selector_t *traffic_selector)
+traffic_selector_substructure_t *traffic_selector_substructure_create_from_traffic_selector(
+													traffic_selector_t *ts)
 {
-	private_traffic_selector_substructure_t *this = (private_traffic_selector_substructure_t*)traffic_selector_substructure_create();
-	this->ts_type = traffic_selector->get_type(traffic_selector);
-	this->ip_protocol_id = traffic_selector->get_protocol(traffic_selector);
-	this->start_port = traffic_selector->get_from_port(traffic_selector);
-	this->end_port = traffic_selector->get_to_port(traffic_selector);
-	this->starting_address = chunk_clone(traffic_selector->get_from_address(traffic_selector));
-	this->ending_address = chunk_clone(traffic_selector->get_to_address(traffic_selector));
-
-	compute_length(this);
+	private_traffic_selector_substructure_t *this;
+
+	this = (private_traffic_selector_substructure_t*)traffic_selector_substructure_create();
+	this->ts_type = ts->get_type(ts);
+	this->ip_protocol_id = ts->get_protocol(ts);
+	this->start_port = ts->get_from_port(ts);
+	this->end_port = ts->get_to_port(ts);
+	this->starting_address = chunk_clone(ts->get_from_address(ts));
+	this->ending_address = chunk_clone(ts->get_to_address(ts));
+	this->payload_length = TRAFFIC_SELECTOR_HEADER_LENGTH +
+						this->ending_address.len + this->starting_address.len;
 
-	return &(this->public);
+	return &this->public;
 }
diff --git a/src/libcharon/encoding/payloads/transform_attribute.c b/src/libcharon/encoding/payloads/transform_attribute.c
index 8bf2ddef4..7d21258b1 100644
--- a/src/libcharon/encoding/payloads/transform_attribute.c
+++ b/src/libcharon/encoding/payloads/transform_attribute.c
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2005-2006 Martin Willi
+ * Copyright (C) 2005-2010 Martin Willi
+ * Copyright (C) 2010 revosec AG
  * Copyright (C) 2005 Jan Hutter
  * Hochschule fuer Technik Rapperswil
  *
@@ -26,9 +27,9 @@ typedef struct private_transform_attribute_t private_transform_attribute_t;
 
 /**
  * Private data of an transform_attribute_t object.
- *
  */
 struct private_transform_attribute_t {
+
 	/**
 	 * Public transform_attribute_t interface.
 	 */
@@ -70,7 +71,6 @@ ENUM_END(transform_attribute_type_name, KEY_LENGTH);
  *
  * The defined offsets are the positions in a object of type
  * private_transform_attribute_t.
- *
  */
 encoding_rule_t transform_attribute_encodings[] = {
 	/* Flag defining the format of this payload */
@@ -78,7 +78,7 @@ encoding_rule_t transform_attribute_encodings[] = {
 	/* type of the attribute as 15 bit unsigned integer */
 	{ ATTRIBUTE_TYPE,			offsetof(private_transform_attribute_t, attribute_type)				},
 	/* Length or value, depending on the attribute format flag */
-	{ ATTRIBUTE_LENGTH_OR_VALUE,	offsetof(private_transform_attribute_t, attribute_length_or_value)	},
+	{ ATTRIBUTE_LENGTH_OR_VALUE,offsetof(private_transform_attribute_t, attribute_length_or_value)	},
 	/* Value of attribute if attribute format flag is zero */
 	{ ATTRIBUTE_VALUE,			offsetof(private_transform_attribute_t, attribute_value) 			}
 };
@@ -95,162 +95,106 @@ encoding_rule_t transform_attribute_encodings[] = {
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 */
 
-/**
- * Implementation of payload_t.verify.
- */
-static status_t verify(private_transform_attribute_t *this)
+METHOD(payload_t, verify, status_t,
+	private_transform_attribute_t *this)
 {
-	if (this->attribute_type != KEY_LENGTH)
-	{
-		return FAILED;
-	}
-
 	return SUCCESS;
 }
 
-/**
- * Implementation of payload_t.get_encoding_rules.
- */
-static void get_encoding_rules(private_transform_attribute_t *this, encoding_rule_t **rules, size_t *rule_count)
+METHOD(payload_t, get_encoding_rules, void,
+	private_transform_attribute_t *this, encoding_rule_t **rules,
+	size_t *rule_count)
 {
 	*rules = transform_attribute_encodings;
-	*rule_count = sizeof(transform_attribute_encodings) / sizeof(encoding_rule_t);
+	*rule_count = countof(transform_attribute_encodings);
 }
 
-/**
- * Implementation of payload_t.get_type.
- */
-static payload_type_t get_type(private_transform_attribute_t *this)
+METHOD(payload_t, get_type, payload_type_t,
+	private_transform_attribute_t *this)
 {
 	return TRANSFORM_ATTRIBUTE;
 }
 
-/**
- * Implementation of payload_t.get_next_type.
- */
-static payload_type_t get_next_type(private_transform_attribute_t *this)
+METHOD(payload_t, get_next_type, payload_type_t,
+	private_transform_attribute_t *this)
 {
-	return (NO_PAYLOAD);
+	return NO_PAYLOAD;
 }
 
-/**
- * Implementation of payload_t.set_next_type.
- */
-static void set_next_type(private_transform_attribute_t *this,payload_type_t type)
+METHOD(payload_t, set_next_type, void,
+	private_transform_attribute_t *this, payload_type_t type)
 {
 }
 
-/**
- * Implementation of transform_attribute_t.get_length.
- */
-static size_t get_length(private_transform_attribute_t *this)
+METHOD(payload_t, get_length, size_t,
+	private_transform_attribute_t *this)
 {
-	if (this->attribute_format == TRUE)
+	if (this->attribute_format)
 	{
-		/*Attribute size is only 4 byte */
 		return 4;
 	}
-	return (this->attribute_length_or_value + 4);
+	return this->attribute_length_or_value + 4;
 }
 
-/**
- * Implementation of transform_attribute_t.set_value_chunk.
- */
-static void set_value_chunk(private_transform_attribute_t *this, chunk_t value)
+METHOD(transform_attribute_t, set_value_chunk, void,
+	private_transform_attribute_t *this, chunk_t value)
 {
-	if (this->attribute_value.ptr != NULL)
-	{
-		/* free existing value */
-		free(this->attribute_value.ptr);
-		this->attribute_value.ptr = NULL;
-		this->attribute_value.len = 0;
-
-	}
+	chunk_free(&this->attribute_value);
 
-	if (value.len > 2)
+	if (value.len != 2)
 	{
-		this->attribute_value.ptr = clalloc(value.ptr,value.len);
-		this->attribute_value.len = value.len;
+		this->attribute_value = chunk_clone(value);
 		this->attribute_length_or_value = value.len;
-		/* attribute has not a fixed length */
 		this->attribute_format = FALSE;
 	}
 	else
 	{
-		memcpy(&(this->attribute_length_or_value),value.ptr,value.len);
+		memcpy(&this->attribute_length_or_value, value.ptr, value.len);
 	}
 }
 
-/**
- * Implementation of transform_attribute_t.set_value.
- */
-static void set_value(private_transform_attribute_t *this, u_int16_t value)
+METHOD(transform_attribute_t, set_value, void,
+	private_transform_attribute_t *this, u_int16_t value)
 {
-	if (this->attribute_value.ptr != NULL)
-	{
-		/* free existing value */
-		free(this->attribute_value.ptr);
-		this->attribute_value.ptr = NULL;
-		this->attribute_value.len = 0;
-
-	}
+	chunk_free(&this->attribute_value);
 	this->attribute_length_or_value = value;
+	this->attribute_format = TRUE;
 }
 
-/**
- * Implementation of transform_attribute_t.get_value_chunk.
- */
-static chunk_t get_value_chunk (private_transform_attribute_t *this)
+METHOD(transform_attribute_t, get_value_chunk, chunk_t,
+	private_transform_attribute_t *this)
 {
-	chunk_t value;
-
-	if (this->attribute_format == FALSE)
+	if (this->attribute_format)
 	{
-		value.ptr = this->attribute_value.ptr;
-		value.len = this->attribute_value.len;
+		return chunk_from_thing(this->attribute_length_or_value);
 	}
-	else
-	{
-		value.ptr = (void *) &(this->attribute_length_or_value);
-		value.len = 2;
-	}
-
-	return value;
+	return this->attribute_value;
 }
 
-/**
- * Implementation of transform_attribute_t.get_value.
- */
-static u_int16_t get_value (private_transform_attribute_t *this)
+METHOD(transform_attribute_t, get_value, u_int16_t,
+	private_transform_attribute_t *this)
 {
 	return this->attribute_length_or_value;
 }
 
-
-/**
- * Implementation of transform_attribute_t.set_attribute_type.
- */
-static void set_attribute_type (private_transform_attribute_t *this, u_int16_t type)
+METHOD(transform_attribute_t, set_attribute_type, void,
+	private_transform_attribute_t *this, u_int16_t type)
 {
 	this->attribute_type = type & 0x7FFF;
 }
 
-/**
- * Implementation of transform_attribute_t.get_attribute_type.
- */
-static u_int16_t get_attribute_type (private_transform_attribute_t *this)
+METHOD(transform_attribute_t, get_attribute_type, u_int16_t,
+	private_transform_attribute_t *this)
 {
 	return this->attribute_type;
 }
 
-/**
- * Implementation of transform_attribute_t.clone.
- */
-static transform_attribute_t * _clone(private_transform_attribute_t *this)
+METHOD(transform_attribute_t, clone_, transform_attribute_t*,
+	private_transform_attribute_t *this)
 {
 	private_transform_attribute_t *new_clone;
 
-	new_clone = (private_transform_attribute_t *) transform_attribute_create();
+	new_clone = (private_transform_attribute_t *)transform_attribute_create();
 
 	new_clone->attribute_format = this->attribute_format;
 	new_clone->attribute_type = this->attribute_type;
@@ -258,22 +202,15 @@ static transform_attribute_t * _clone(private_transform_attribute_t *this)
 
 	if (!new_clone->attribute_format)
 	{
-		new_clone->attribute_value.ptr = clalloc(this->attribute_value.ptr,this->attribute_value.len);
-		new_clone->attribute_value.len = this->attribute_value.len;
+		new_clone->attribute_value = chunk_clone(this->attribute_value);
 	}
-
-	return (transform_attribute_t *) new_clone;
+	return &new_clone->public;
 }
 
-/**
- * Implementation of transform_attribute_t.destroy and payload_t.destroy.
- */
-static void destroy(private_transform_attribute_t *this)
+METHOD2(payload_t, transform_attribute_t, destroy, void,
+	private_transform_attribute_t *this)
 {
-	if (this->attribute_value.ptr != NULL)
-	{
-		free(this->attribute_value.ptr);
-	}
+	free(this->attribute_value.ptr);
 	free(this);
 }
 
@@ -282,35 +219,31 @@ static void destroy(private_transform_attribute_t *this)
  */
 transform_attribute_t *transform_attribute_create()
 {
-	private_transform_attribute_t *this = malloc_thing(private_transform_attribute_t);
-
-	/* payload interface */
-	this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
-	this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
-	this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length;
-	this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type;
-	this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
-	this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_type;
-	this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
-	/* public functions */
-	this->public.set_value_chunk = (void (*) (transform_attribute_t *,chunk_t)) set_value_chunk;
-	this->public.set_value = (void (*) (transform_attribute_t *,u_int16_t)) set_value;
-	this->public.get_value_chunk = (chunk_t (*) (transform_attribute_t *)) get_value_chunk;
-	this->public.get_value = (u_int16_t (*) (transform_attribute_t *)) get_value;
-	this->public.set_attribute_type = (void (*) (transform_attribute_t *,u_int16_t type)) set_attribute_type;
-	this->public.get_attribute_type = (u_int16_t (*) (transform_attribute_t *)) get_attribute_type;
-	this->public.clone = (transform_attribute_t * (*) (transform_attribute_t *)) _clone;
-	this->public.destroy = (void (*) (transform_attribute_t *)) destroy;
-
-	/* set default values of the fields */
-	this->attribute_format = TRUE;
-	this->attribute_type = 0;
-	this->attribute_length_or_value = 0;
-	this->attribute_value.ptr = NULL;
-	this->attribute_value.len = 0;
-
-	return (&(this->public));
+	private_transform_attribute_t *this;
+
+	INIT(this,
+		.public = {
+			.payload_interface = {
+				.verify = _verify,
+				.get_encoding_rules = _get_encoding_rules,
+				.get_length = _get_length,
+				.get_next_type = _get_next_type,
+				.set_next_type = _set_next_type,
+				.get_type = _get_type,
+				.destroy = _destroy,
+			},
+			.set_value_chunk = _set_value_chunk,
+			.set_value = _set_value,
+			.get_value_chunk = _get_value_chunk,
+			.get_value = _get_value,
+			.set_attribute_type = _set_attribute_type,
+			.get_attribute_type = _get_attribute_type,
+			.clone = _clone_,
+			.destroy = _destroy,
+		},
+		.attribute_format = TRUE,
+	);
+	return &this->public;
 }
 
 /*
@@ -319,7 +252,7 @@ transform_attribute_t *transform_attribute_create()
 transform_attribute_t *transform_attribute_create_key_length(u_int16_t key_length)
 {
 	transform_attribute_t *attribute = transform_attribute_create();
-	attribute->set_attribute_type(attribute,KEY_LENGTH);
-	attribute->set_value(attribute,key_length);
+	attribute->set_attribute_type(attribute, KEY_LENGTH);
+	attribute->set_value(attribute, key_length);
 	return attribute;
 }
diff --git a/src/libcharon/encoding/payloads/transform_substructure.c b/src/libcharon/encoding/payloads/transform_substructure.c
index c94f6c1a2..0428da726 100644
--- a/src/libcharon/encoding/payloads/transform_substructure.c
+++ b/src/libcharon/encoding/payloads/transform_substructure.c
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2005-2006 Martin Willi
+ * Copyright (C) 2005-2010 Martin Willi
+ * Copyright (C) 2010 revosec AG
  * Copyright (C) 2005 Jan Hutter
  * Hochschule fuer Technik Rapperswil
  *
@@ -24,14 +25,13 @@
 #include <utils/linked_list.h>
 #include <daemon.h>
 
-
 typedef struct private_transform_substructure_t private_transform_substructure_t;
 
 /**
  * Private data of an transform_substructure_t object.
- *
  */
 struct private_transform_substructure_t {
+
 	/**
 	 * Public transform_substructure_t interface.
 	 */
@@ -41,14 +41,16 @@ struct private_transform_substructure_t {
 	 * Next payload type.
 	 */
 	u_int8_t  next_payload;
-
+	/**
+	 * Reserved bytes
+	 */
+	u_int8_t reserved[2];
 
 	/**
 	 * Length of this payload.
 	 */
 	u_int16_t transform_length;
 
-
 	/**
 	 * Type of the transform.
 	 */
@@ -65,30 +67,28 @@ struct private_transform_substructure_t {
 	linked_list_t *attributes;
 };
 
-
 /**
  * Encoding rules to parse or generate a Transform substructure.
  *
  * The defined offsets are the positions in a object of type
  * private_transform_substructure_t.
- *
  */
 encoding_rule_t transform_substructure_encodings[] = {
 	/* 1 Byte next payload type, stored in the field next_payload */
-	{ U_INT_8,			offsetof(private_transform_substructure_t, next_payload) 		},
-	/* Reserved Byte is skipped */
-	{ RESERVED_BYTE,		0																},
+	{ U_INT_8,				offsetof(private_transform_substructure_t, next_payload)	},
+	/* 1 Reserved Byte */
+	{ RESERVED_BYTE,		offsetof(private_transform_substructure_t, reserved[0])		},
 	/* Length of the whole transform substructure*/
-	{ PAYLOAD_LENGTH,		offsetof(private_transform_substructure_t, transform_length)	},
+	{ PAYLOAD_LENGTH,		offsetof(private_transform_substructure_t, transform_length)},
 	/* transform type is a number of 8 bit */
-	{ U_INT_8,				offsetof(private_transform_substructure_t, transform_type) 	},
-	/* Reserved Byte is skipped */
-	{ RESERVED_BYTE,		0																},
+	{ U_INT_8,				offsetof(private_transform_substructure_t, transform_type)	},
+	/* 1 Reserved Byte */
+	{ RESERVED_BYTE,		offsetof(private_transform_substructure_t, reserved[1])		},
 	/* tranform ID is a number of 8 bit */
-	{ U_INT_16,				offsetof(private_transform_substructure_t, transform_id)		},
+	{ U_INT_16,				offsetof(private_transform_substructure_t, transform_id)	},
 	/* Attributes are stored in a transform attribute,
 	   offset points to a linked_list_t pointer */
-	{ TRANSFORM_ATTRIBUTES,	offsetof(private_transform_substructure_t, attributes) 		}
+	{ TRANSFORM_ATTRIBUTES,	offsetof(private_transform_substructure_t, attributes)		}
 };
 
 /*
@@ -105,19 +105,15 @@ encoding_rule_t transform_substructure_encodings[] = {
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 */
 
-
-/**
- * Implementation of payload_t.verify.
- */
-static status_t verify(private_transform_substructure_t *this)
+METHOD(payload_t, verify, status_t,
+	private_transform_substructure_t *this)
 {
 	status_t status = SUCCESS;
-	iterator_t *iterator;
-	payload_t *current_attributes;
+	enumerator_t *enumerator;
+	payload_t *attribute;
 
-	if ((this->next_payload != NO_PAYLOAD) && (this->next_payload != 3))
+	if (this->next_payload != NO_PAYLOAD && this->next_payload != 3)
 	{
-		/* must be 0 or 3 */
 		DBG1(DBG_ENC, "inconsistent next payload");
 		return FAILED;
 	}
@@ -138,45 +134,41 @@ static status_t verify(private_transform_substructure_t *this)
 			return FAILED;
 		}
 	}
-	iterator = this->attributes->create_iterator(this->attributes,TRUE);
 
-	while(iterator->iterate(iterator, (void**)&current_attributes))
+	enumerator = this->attributes->create_enumerator(this->attributes);
+	while (enumerator->enumerate(enumerator, &attribute))
 	{
-		status = current_attributes->verify(current_attributes);
+		status = attribute->verify(attribute);
 		if (status != SUCCESS)
 		{
 			DBG1(DBG_ENC, "TRANSFORM_ATTRIBUTE verification failed");
+			break;
 		}
 	}
-	iterator->destroy(iterator);
+	enumerator->destroy(enumerator);
 
 	/* proposal number is checked in SA payload */
 	return status;
 }
 
-/**
- * Implementation of payload_t.get_encoding_rules.
- */
-static void get_encoding_rules(private_transform_substructure_t *this, encoding_rule_t **rules, size_t *rule_count)
+METHOD(payload_t, get_encoding_rules, void,
+	private_transform_substructure_t *this, encoding_rule_t **rules,
+	size_t *rule_count)
 {
 	*rules = transform_substructure_encodings;
-	*rule_count = sizeof(transform_substructure_encodings) / sizeof(encoding_rule_t);
+	*rule_count = countof(transform_substructure_encodings);
 }
 
-/**
- * Implementation of payload_t.get_type.
- */
-static payload_type_t get_type(private_transform_substructure_t *this)
+METHOD(payload_t, get_type, payload_type_t,
+	private_transform_substructure_t *this)
 {
 	return TRANSFORM_SUBSTRUCTURE;
 }
 
-/**
- * Implementation of payload_t.get_next_type.
- */
-static payload_type_t get_next_type(private_transform_substructure_t *this)
+METHOD(payload_t, get_next_type, payload_type_t,
+	private_transform_substructure_t *this)
 {
-	return (this->next_payload);
+	return this->next_payload;
 }
 
 /**
@@ -184,154 +176,69 @@ static payload_type_t get_next_type(private_transform_substructure_t *this)
  */
 static void compute_length (private_transform_substructure_t *this)
 {
-	iterator_t *iterator;
-	payload_t *current_attribute;
-	size_t length = TRANSFORM_SUBSTRUCTURE_HEADER_LENGTH;
+	enumerator_t *enumerator;
+	payload_t *attribute;
 
-	iterator = this->attributes->create_iterator(this->attributes,TRUE);
-	while (iterator->iterate(iterator, (void**)&current_attribute))
+	this->transform_length = TRANSFORM_SUBSTRUCTURE_HEADER_LENGTH;
+	enumerator = this->attributes->create_enumerator(this->attributes);
+	while (enumerator->enumerate(enumerator, &attribute))
 	{
-		length += current_attribute->get_length(current_attribute);
+		this->transform_length += attribute->get_length(attribute);
 	}
-	iterator->destroy(iterator);
-
-	this->transform_length = length;
+	enumerator->destroy(enumerator);
 }
 
-/**
- * Implementation of payload_t.get_length.
- */
-static size_t get_length(private_transform_substructure_t *this)
+METHOD(payload_t, get_length, size_t,
+	private_transform_substructure_t *this)
 {
-	compute_length(this);
 	return this->transform_length;
 }
 
-/**
- * Implementation of transform_substructure_t.create_transform_attribute_iterator.
- */
-static iterator_t *create_transform_attribute_iterator (private_transform_substructure_t *this,bool forward)
-{
-	return this->attributes->create_iterator(this->attributes,forward);
-}
-
-/**
- * Implementation of transform_substructure_t.add_transform_attribute.
- */
-static void add_transform_attribute (private_transform_substructure_t *this,transform_attribute_t *attribute)
-{
-	this->attributes->insert_last(this->attributes,(void *) attribute);
-	compute_length(this);
-}
-
-/**
- * Implementation of transform_substructure_t.set_is_last_transform.
- */
-static void set_is_last_transform (private_transform_substructure_t *this, bool is_last)
-{
-	this->next_payload = (is_last) ? 0: TRANSFORM_TYPE_VALUE;
-}
-
-/**
- * Implementation of transform_substructure_t.get_is_last_transform.
- */
-static bool get_is_last_transform (private_transform_substructure_t *this)
-{
-	return ((this->next_payload == TRANSFORM_TYPE_VALUE) ? FALSE : TRUE);
-}
-
-/**
- * Implementation of payload_t.set_next_type.
- */
-static void set_next_type(private_transform_substructure_t *this,payload_type_t type)
+METHOD(transform_substructure_t, set_is_last_transform, void,
+	private_transform_substructure_t *this, bool is_last)
 {
+	this->next_payload = is_last ? 0: TRANSFORM_TYPE_VALUE;
 }
 
-/**
- * Implementation of transform_substructure_t.set_transform_type.
- */
-static void set_transform_type (private_transform_substructure_t *this,u_int8_t type)
+METHOD(payload_t, set_next_type, void,
+	private_transform_substructure_t *this,payload_type_t type)
 {
-	this->transform_type = type;
 }
 
-/**
- * Implementation of transform_substructure_t.get_transform_type.
- */
-static u_int8_t get_transform_type (private_transform_substructure_t *this)
+METHOD(transform_substructure_t, get_transform_type, u_int8_t,
+	private_transform_substructure_t *this)
 {
 	return this->transform_type;
 }
 
-/**
- * Implementation of transform_substructure_t.set_transform_id.
- */
-static void set_transform_id (private_transform_substructure_t *this,u_int16_t id)
-{
-	this->transform_id = id;
-}
-
-/**
- * Implementation of transform_substructure_t.get_transform_id.
- */
-static u_int16_t get_transform_id (private_transform_substructure_t *this)
+METHOD(transform_substructure_t, get_transform_id, u_int16_t,
+	private_transform_substructure_t *this)
 {
 	return this->transform_id;
 }
 
-/**
- * Implementation of transform_substructure_t.clone.
- */
-static transform_substructure_t *clone_(private_transform_substructure_t *this)
-{
-	private_transform_substructure_t *clone;
-	iterator_t *attributes;
-	transform_attribute_t *current_attribute;
-
-	clone = (private_transform_substructure_t *) transform_substructure_create();
-	clone->next_payload = this->next_payload;
-	clone->transform_type = this->transform_type;
-	clone->transform_id = this->transform_id;
-
-	attributes = this->attributes->create_iterator(this->attributes, FALSE);
-	while (attributes->iterate(attributes, (void**)&current_attribute))
-	{
-		current_attribute = current_attribute->clone(current_attribute);
-		clone->public.add_transform_attribute(&clone->public, current_attribute);
-	}
-	attributes->destroy(attributes);
-
-	return &clone->public;
-}
-
-
-/**
- * Implementation of transform_substructure_t.get_key_length.
- */
-static status_t get_key_length(private_transform_substructure_t *this, u_int16_t *key_length)
+METHOD(transform_substructure_t, get_key_length, status_t,
+	private_transform_substructure_t *this, u_int16_t *key_length)
 {
-	iterator_t *attributes;
-	transform_attribute_t *current_attribute;
+	enumerator_t *enumerator;
+	transform_attribute_t *attribute;
 
-	attributes = this->attributes->create_iterator(this->attributes, TRUE);
-	while (attributes->iterate(attributes, (void**)&current_attribute))
+	enumerator = this->attributes->create_enumerator(this->attributes);
+	while (enumerator->enumerate(enumerator, &attribute))
 	{
-		if (current_attribute->get_attribute_type(current_attribute) == KEY_LENGTH)
+		if (attribute->get_attribute_type(attribute) == KEY_LENGTH)
 		{
-			*key_length = current_attribute->get_value(current_attribute);
-			attributes->destroy(attributes);
+			*key_length = attribute->get_value(attribute);
+			enumerator->destroy(enumerator);
 			return SUCCESS;
 		}
 	}
-	attributes->destroy(attributes);
+	enumerator->destroy(enumerator);
 	return FAILED;
 }
 
-
-/**
- * Implementation of transform_substructure_t.destroy and payload_t.destroy.
- */
-static void destroy(private_transform_substructure_t *this)
+METHOD2(payload_t, transform_substructure_t, destroy, void,
+	private_transform_substructure_t *this)
 {
 	this->attributes->destroy_offset(this->attributes,
 									 offsetof(transform_attribute_t, destroy));
@@ -343,60 +250,50 @@ static void destroy(private_transform_substructure_t *this)
  */
 transform_substructure_t *transform_substructure_create()
 {
-	private_transform_substructure_t *this = malloc_thing(private_transform_substructure_t);
-
-	/* payload interface */
-	this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
-	this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
-	this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length;
-	this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type;
-	this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
-	this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_type;
-	this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
-	/* public functions */
-	this->public.create_transform_attribute_iterator = (iterator_t * (*) (transform_substructure_t *,bool)) create_transform_attribute_iterator;
-	this->public.add_transform_attribute = (void (*) (transform_substructure_t *,transform_attribute_t *)) add_transform_attribute;
-	this->public.set_is_last_transform = (void (*) (transform_substructure_t *,bool)) set_is_last_transform;
-	this->public.get_is_last_transform = (bool (*) (transform_substructure_t *)) get_is_last_transform;
-	this->public.set_transform_type = (void (*) (transform_substructure_t *,u_int8_t)) set_transform_type;
-	this->public.get_transform_type = (u_int8_t (*) (transform_substructure_t *)) get_transform_type;
-	this->public.set_transform_id = (void (*) (transform_substructure_t *,u_int16_t)) set_transform_id;
-	this->public.get_transform_id = (u_int16_t (*) (transform_substructure_t *)) get_transform_id;
-	this->public.get_key_length = (status_t (*) (transform_substructure_t *,u_int16_t *)) get_key_length;
-	this->public.clone = (transform_substructure_t* (*) (transform_substructure_t *)) clone_;
-	this->public.destroy = (void (*) (transform_substructure_t *)) destroy;
-
-	/* set default values of the fields */
-	this->next_payload = NO_PAYLOAD;
-	this->transform_length = TRANSFORM_SUBSTRUCTURE_HEADER_LENGTH;
-	this->transform_id = 0;
-	this->transform_type = 0;
-	this->attributes = linked_list_create();
-
-	return (&(this->public));
+	private_transform_substructure_t *this;
+
+	INIT(this,
+		.public = {
+			.payload_interface = {
+				.verify = _verify,
+				.get_encoding_rules = _get_encoding_rules,
+				.get_length = _get_length,
+				.get_next_type = _get_next_type,
+				.set_next_type = _set_next_type,
+				.get_type = _get_type,
+				.destroy = _destroy,
+			},
+			.set_is_last_transform = _set_is_last_transform,
+			.get_transform_type = _get_transform_type,
+			.get_transform_id = _get_transform_id,
+			.get_key_length = _get_key_length,
+			.destroy = _destroy,
+		},
+		.next_payload = NO_PAYLOAD,
+		.transform_length = TRANSFORM_SUBSTRUCTURE_HEADER_LENGTH,
+		.attributes = linked_list_create(),
+	);
+	return &this->public;
 }
 
 /*
  * Described in header
  */
 transform_substructure_t *transform_substructure_create_type(
-								transform_type_t transform_type,
-								u_int16_t transform_id, u_int16_t key_length)
+					transform_type_t type, u_int16_t id, u_int16_t key_length)
 {
-	transform_substructure_t *transform = transform_substructure_create();
+	private_transform_substructure_t *this;
 
-	transform->set_transform_type(transform,transform_type);
-	transform->set_transform_id(transform,transform_id);
+	this = (private_transform_substructure_t*)transform_substructure_create();
 
+	this->transform_type = type;
+	this->transform_id = id;
 	if (key_length)
 	{
-		transform_attribute_t *attribute;
-
-		attribute = transform_attribute_create_key_length(key_length);
-		transform->add_transform_attribute(transform, attribute);
-
+		this->attributes->insert_last(this->attributes,
+					(void*)transform_attribute_create_key_length(key_length));
+		compute_length(this);
 	}
-	return transform;
+	return &this->public;
 }
 
diff --git a/src/libcharon/encoding/payloads/transform_substructure.h b/src/libcharon/encoding/payloads/transform_substructure.h
index 5d31f8c0a..c961700a4 100644
--- a/src/libcharon/encoding/payloads/transform_substructure.h
+++ b/src/libcharon/encoding/payloads/transform_substructure.h
@@ -34,7 +34,6 @@ typedef struct transform_substructure_t transform_substructure_t;
 #include <crypto/crypters/crypter.h>
 #include <config/proposal.h>
 
-
 /**
  * IKEv1 Value for a transform payload.
  */
@@ -45,32 +44,19 @@ typedef struct transform_substructure_t transform_substructure_t;
  */
 #define TRANSFORM_SUBSTRUCTURE_HEADER_LENGTH 8
 
-
 /**
  * Class representing an IKEv2- TRANSFORM SUBSTRUCTURE.
  *
  * The TRANSFORM SUBSTRUCTURE format is described in RFC section 3.3.2.
  */
 struct transform_substructure_t {
+
 	/**
 	 * The payload_t interface.
 	 */
 	payload_t payload_interface;
 
 	/**
-	 * Creates an iterator of stored transform_attribute_t objects.
-	 *
-	 * When deleting an transform attribute using this iterator,
-	 * the length of this transform substructure has to be refreshed
-	 * by calling get_length().
-	 *
-	 * @param forward 		iterator direction (TRUE: front to end)
-	 * @return				created iterator_t object.
-	 */
-	iterator_t * (*create_transform_attribute_iterator) (
-								transform_substructure_t *this, bool forward);
-
-	/**
 	 * Adds a transform_attribute_t object to this object.
 	 *
 	 * @param proposal  transform_attribute_t object to add
@@ -89,20 +75,6 @@ struct transform_substructure_t {
 	void (*set_is_last_transform) (transform_substructure_t *this, bool is_last);
 
 	/**
-	 * Checks if this is the last transform.
-	 *
-	 * @return 			TRUE if this is the last Transform, FALSE otherwise
-	 */
-	bool (*get_is_last_transform) (transform_substructure_t *this);
-
-	/**
-	 * Sets transform type of the current transform substructure.
-	 *
-	 * @param type		type value to set
-	 */
-	void (*set_transform_type) (transform_substructure_t *this, u_int8_t type);
-
-	/**
 	 * get transform type of the current transform.
 	 *
 	 * @return 			Transform type of current transform substructure.
@@ -110,21 +82,14 @@ struct transform_substructure_t {
 	u_int8_t (*get_transform_type) (transform_substructure_t *this);
 
 	/**
-	 * Sets transform id of the current transform substructure.
-	 *
-	 * @param id		transform id to set
-	 */
-	void (*set_transform_id) (transform_substructure_t *this, u_int16_t id);
-
-	/**
-	 * get transform id of the current transform.
+	 * Get transform id of the current transform.
 	 *
 	 * @return 			Transform id of current transform substructure.
 	 */
 	u_int16_t (*get_transform_id) (transform_substructure_t *this);
 
 	/**
-	 * get transform id of the current transform.
+	 * Get transform id of the current transform.
 	 *
 	 * @param key_length	The key length is written to this location
 	 * @return
@@ -136,13 +101,6 @@ struct transform_substructure_t {
 								u_int16_t *key_length);
 
 	/**
-	 * Clones an transform_substructure_t object.
-	 *
-	 * @return		cloned transform_substructure_t object
-	 */
-	transform_substructure_t* (*clone) (transform_substructure_t *this);
-
-	/**
 	 * Destroys an transform_substructure_t object.
 	 */
 	void (*destroy) (transform_substructure_t *this);
@@ -151,24 +109,19 @@ struct transform_substructure_t {
 /**
  * Creates an empty transform_substructure_t object.
  *
- * @return			created transform_substructure_t object
+ * @return				created transform_substructure_t object
  */
 transform_substructure_t *transform_substructure_create(void);
 
 /**
  * Creates an empty transform_substructure_t object.
  *
- * The key length is used for the transport types ENCRYPTION_ALGORITHM,
- * PSEUDO_RANDOM_FUNCTION, INTEGRITY_ALGORITHM. For all
- * other transport types the key_length parameter is not used
- *
- * @param transform_type	type of transform to create
- * @param transform_id		transform id specifying the specific algorithm of a transform type
- * @param key_length		Key length for key lenght attribute
- * @return					transform_substructure_t object
+ * @param type			type of transform to create
+ * @param id			transform id specifc for the transform type
+ * @param key_length	key length for key lenght attribute, 0 to omit
+ * @return				transform_substructure_t object
  */
 transform_substructure_t *transform_substructure_create_type(
-						transform_type_t transform_type, u_int16_t transform_id,
-						u_int16_t key_length);
+					transform_type_t type, u_int16_t id, u_int16_t key_length);
 
 #endif /** TRANSFORM_SUBSTRUCTURE_H_ @}*/
diff --git a/src/libcharon/encoding/payloads/ts_payload.c b/src/libcharon/encoding/payloads/ts_payload.c
index 6bf3e4293..28f760e40 100644
--- a/src/libcharon/encoding/payloads/ts_payload.c
+++ b/src/libcharon/encoding/payloads/ts_payload.c
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2005-2006 Martin Willi
+ * Copyright (C) 2005-2010 Martin Willi
+ * Copyright (C) 2010 revosec AG
  * Copyright (C) 2005 Jan Hutter
  * Hochschule fuer Technik Rapperswil
  *
@@ -25,9 +26,9 @@ typedef struct private_ts_payload_t private_ts_payload_t;
 
 /**
  * Private data of an ts_payload_t object.
- *
  */
 struct private_ts_payload_t {
+
 	/**
 	 * Public ts_payload_t interface.
 	 */
@@ -49,6 +50,16 @@ struct private_ts_payload_t {
 	bool critical;
 
 	/**
+	 * reserved bits
+	 */
+	bool reserved_bit[7];
+
+	/**
+	 * reserved bytes
+	 */
+	bool reserved_byte[3];
+
+	/**
 	 * Length of this payload.
 	 */
 	u_int16_t payload_length;
@@ -56,12 +67,12 @@ struct private_ts_payload_t {
 	/**
 	 * Number of traffic selectors
 	 */
-	u_int8_t number_of_traffic_selectors;
+	u_int8_t ts_num;
 
 	/**
 	 * Contains the traffic selectors of type traffic_selector_substructure_t.
 	 */
-	linked_list_t *traffic_selectors;
+	linked_list_t *substrs;
 };
 
 /**
@@ -69,31 +80,30 @@ struct private_ts_payload_t {
  *
  * The defined offsets are the positions in a object of type
  * private_ts_payload_t.
- *
  */
 encoding_rule_t ts_payload_encodings[] = {
 	/* 1 Byte next payload type, stored in the field next_payload */
-	{ U_INT_8,			offsetof(private_ts_payload_t, next_payload) 				},
+	{ U_INT_8,			offsetof(private_ts_payload_t, next_payload)	},
 	/* the critical bit */
-	{ FLAG,				offsetof(private_ts_payload_t, critical) 					},
-	/* 7 Bit reserved bits, nowhere stored */
-	{ RESERVED_BIT,	0 																},
-	{ RESERVED_BIT,	0 																},
-	{ RESERVED_BIT,	0 																},
-	{ RESERVED_BIT,	0 																},
-	{ RESERVED_BIT,	0 																},
-	{ RESERVED_BIT,	0 																},
-	{ RESERVED_BIT,	0 																},
+	{ FLAG,				offsetof(private_ts_payload_t, critical)		},
+	/* 7 Bit reserved bits */
+	{ RESERVED_BIT,		offsetof(private_ts_payload_t, reserved_bit[0])	},
+	{ RESERVED_BIT,		offsetof(private_ts_payload_t, reserved_bit[1])	},
+	{ RESERVED_BIT,		offsetof(private_ts_payload_t, reserved_bit[2])	},
+	{ RESERVED_BIT,		offsetof(private_ts_payload_t, reserved_bit[3])	},
+	{ RESERVED_BIT,		offsetof(private_ts_payload_t, reserved_bit[4])	},
+	{ RESERVED_BIT,		offsetof(private_ts_payload_t, reserved_bit[5])	},
+	{ RESERVED_BIT,		offsetof(private_ts_payload_t, reserved_bit[6])	},
 	/* Length of the whole payload*/
-	{ PAYLOAD_LENGTH,	offsetof(private_ts_payload_t, payload_length)},
+	{ PAYLOAD_LENGTH,	offsetof(private_ts_payload_t, payload_length)	},
 	/* 1 Byte TS type*/
-	{ U_INT_8,			offsetof(private_ts_payload_t, number_of_traffic_selectors)	},
+	{ U_INT_8,			offsetof(private_ts_payload_t, ts_num)			},
 	/* 3 reserved bytes */
-	{ RESERVED_BYTE,	0 															},
-	{ RESERVED_BYTE,	0 															},
-	{ RESERVED_BYTE,	0 															},
+	{ RESERVED_BYTE,	offsetof(private_ts_payload_t, reserved_byte[0])},
+	{ RESERVED_BYTE,	offsetof(private_ts_payload_t, reserved_byte[1])},
+	{ RESERVED_BYTE,	offsetof(private_ts_payload_t, reserved_byte[2])},
 	/* some ts data bytes, length is defined in PAYLOAD_LENGTH */
-	{ TRAFFIC_SELECTORS,	offsetof(private_ts_payload_t, traffic_selectors)		}
+	{ TRAFFIC_SELECTORS,offsetof(private_ts_payload_t, substrs)			}
 };
 
 /*
@@ -110,71 +120,56 @@ encoding_rule_t ts_payload_encodings[] = {
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 */
 
-/**
- * Implementation of payload_t.verify.
- */
-static status_t verify(private_ts_payload_t *this)
+METHOD(payload_t, verify, status_t,
+	private_ts_payload_t *this)
 {
-	iterator_t *iterator;
-	payload_t *current_traffic_selector;
+	enumerator_t *enumerator;
+	payload_t *substr;
 	status_t status = SUCCESS;
 
-	if (this->number_of_traffic_selectors != (this->traffic_selectors->get_count(this->traffic_selectors)))
+	if (this->ts_num != this->substrs->get_count(this->substrs))
 	{
-		/* must be the same */
 		return FAILED;
 	}
-
-	iterator = this->traffic_selectors->create_iterator(this->traffic_selectors,TRUE);
-	while(iterator->iterate(iterator, (void**)&current_traffic_selector))
+	enumerator = this->substrs->create_enumerator(this->substrs);
+	while (enumerator->enumerate(enumerator, &substr))
 	{
-		status = current_traffic_selector->verify(current_traffic_selector);
+		status = substr->verify(substr);
 		if (status != SUCCESS)
 		{
 			break;
 		}
 	}
-	iterator->destroy(iterator);
+	enumerator->destroy(enumerator);
 
 	return status;
 }
 
-/**
- * Implementation of ts_payload_t.get_encoding_rules.
- */
-static void get_encoding_rules(private_ts_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
+METHOD(payload_t, get_encoding_rules, void,
+	private_ts_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
 {
 	*rules = ts_payload_encodings;
-	*rule_count = sizeof(ts_payload_encodings) / sizeof(encoding_rule_t);
+	*rule_count = countof(ts_payload_encodings);
 }
 
-/**
- * Implementation of payload_t.get_type.
- */
-static payload_type_t get_payload_type(private_ts_payload_t *this)
+METHOD(payload_t, get_type, payload_type_t,
+	private_ts_payload_t *this)
 {
 	if (this->is_initiator)
 	{
 		return TRAFFIC_SELECTOR_INITIATOR;
 	}
-	else
-	{
-		return TRAFFIC_SELECTOR_RESPONDER;
-	}
+	return TRAFFIC_SELECTOR_RESPONDER;
 }
 
-/**
- * Implementation of payload_t.get_next_type.
- */
-static payload_type_t get_next_type(private_ts_payload_t *this)
+METHOD(payload_t, get_next_type, payload_type_t,
+	private_ts_payload_t *this)
 {
-	return (this->next_payload);
+	return this->next_payload;
 }
 
-/**
- * Implementation of payload_t.set_next_type.
- */
-static void set_next_type(private_ts_payload_t *this,payload_type_t type)
+METHOD(payload_t, set_next_type, void,
+	private_ts_payload_t *this,payload_type_t type)
 {
 	this->next_payload = type;
 }
@@ -182,95 +177,64 @@ static void set_next_type(private_ts_payload_t *this,payload_type_t type)
 /**
  * recompute the length of the payload.
  */
-static void compute_length (private_ts_payload_t *this)
+static void compute_length(private_ts_payload_t *this)
 {
-	iterator_t *iterator;
-	size_t ts_count = 0;
-	size_t length = TS_PAYLOAD_HEADER_LENGTH;
-	payload_t *current_traffic_selector;
+	enumerator_t *enumerator;
+	payload_t *subst;
 
-	iterator = this->traffic_selectors->create_iterator(this->traffic_selectors,TRUE);
-	while (iterator->iterate(iterator, (void**)&current_traffic_selector))
+	this->payload_length = TS_PAYLOAD_HEADER_LENGTH;
+	this->ts_num = 0;
+	enumerator = this->substrs->create_enumerator(this->substrs);
+	while (enumerator->enumerate(enumerator, &subst))
 	{
-		length += current_traffic_selector->get_length(current_traffic_selector);
-		ts_count++;
+		this->payload_length += subst->get_length(subst);
+		this->ts_num++;
 	}
-	iterator->destroy(iterator);
-
-	this->number_of_traffic_selectors= ts_count;
-	this->payload_length = length;
+	enumerator->destroy(enumerator);
 }
 
-/**
- * Implementation of payload_t.get_length.
- */
-static size_t get_length(private_ts_payload_t *this)
+METHOD(payload_t, get_length, size_t,
+	private_ts_payload_t *this)
 {
-	compute_length(this);
 	return this->payload_length;
 }
 
-/**
- * Implementation of ts_payload_t.get_initiator.
- */
-static bool get_initiator (private_ts_payload_t *this)
+METHOD(ts_payload_t, get_initiator, bool,
+	private_ts_payload_t *this)
 {
-	return (this->is_initiator);
+	return this->is_initiator;
 }
 
-/**
- * Implementation of ts_payload_t.set_initiator.
- */
-static void set_initiator (private_ts_payload_t *this,bool is_initiator)
+METHOD(ts_payload_t, set_initiator, void,
+	private_ts_payload_t *this,bool is_initiator)
 {
 	this->is_initiator = is_initiator;
 }
 
-/**
- * Implementation of ts_payload_t.add_traffic_selector_substructure.
- */
-static void add_traffic_selector_substructure (private_ts_payload_t *this,traffic_selector_substructure_t *traffic_selector)
-{
-	this->traffic_selectors->insert_last(this->traffic_selectors,traffic_selector);
-	this->number_of_traffic_selectors = this->traffic_selectors->get_count(this->traffic_selectors);
-}
-
-/**
- * Implementation of ts_payload_t.create_traffic_selector_substructure_iterator.
- */
-static iterator_t * create_traffic_selector_substructure_iterator (private_ts_payload_t *this, bool forward)
-{
-	return this->traffic_selectors->create_iterator(this->traffic_selectors,forward);
-}
-
-/**
- * Implementation of ts_payload_t.get_traffic_selectors.
- */
-static linked_list_t *get_traffic_selectors(private_ts_payload_t *this)
+METHOD(ts_payload_t, get_traffic_selectors, linked_list_t*,
+	private_ts_payload_t *this)
 {
 	traffic_selector_t *ts;
-	iterator_t *iterator;
-	traffic_selector_substructure_t *ts_substructure;
-	linked_list_t *ts_list = linked_list_create();
+	enumerator_t *enumerator;
+	traffic_selector_substructure_t *subst;
+	linked_list_t *list;
 
-	iterator = this->traffic_selectors->create_iterator(this->traffic_selectors, TRUE);
-	while (iterator->iterate(iterator, (void**)&ts_substructure))
+	list = linked_list_create();
+	enumerator = this->substrs->create_enumerator(this->substrs);
+	while (enumerator->enumerate(enumerator, &subst))
 	{
-		ts = ts_substructure->get_traffic_selector(ts_substructure);
-		ts_list->insert_last(ts_list, (void*)ts);
+		ts = subst->get_traffic_selector(subst);
+		list->insert_last(list, ts);
 	}
-	iterator->destroy(iterator);
+	enumerator->destroy(enumerator);
 
-	return ts_list;
+	return list;
 }
 
-/**
- * Implementation of payload_t.destroy and ts_payload_t.destroy.
- */
-static void destroy(private_ts_payload_t *this)
+METHOD2(payload_t, ts_payload_t, destroy, void,
+	private_ts_payload_t *this)
 {
-	this->traffic_selectors->destroy_offset(this->traffic_selectors,
-											offsetof(payload_t, destroy));
+	this->substrs->destroy_offset(this->substrs, offsetof(payload_t, destroy));
 	free(this);
 }
 
@@ -279,56 +243,53 @@ static void destroy(private_ts_payload_t *this)
  */
 ts_payload_t *ts_payload_create(bool is_initiator)
 {
-	private_ts_payload_t *this = malloc_thing(private_ts_payload_t);
-
-	/* interface functions */
-	this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
-	this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
-	this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length;
-	this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type;
-	this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
-	this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_payload_type;
-	this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
-	/* public functions */
-	this->public.destroy = (void (*) (ts_payload_t *)) destroy;
-	this->public.get_initiator = (bool (*) (ts_payload_t *)) get_initiator;
-	this->public.set_initiator = (void (*) (ts_payload_t *,bool)) set_initiator;
-	this->public.add_traffic_selector_substructure = (void (*) (ts_payload_t *,traffic_selector_substructure_t *)) add_traffic_selector_substructure;
-	this->public.create_traffic_selector_substructure_iterator = (iterator_t* (*) (ts_payload_t *,bool)) create_traffic_selector_substructure_iterator;
-	this->public.get_traffic_selectors = (linked_list_t *(*) (ts_payload_t *)) get_traffic_selectors;
-
-	/* private variables */
-	this->critical = FALSE;
-	this->next_payload = NO_PAYLOAD;
-	this->payload_length =TS_PAYLOAD_HEADER_LENGTH;
-	this->is_initiator = is_initiator;
-	this->number_of_traffic_selectors = 0;
-	this->traffic_selectors = linked_list_create();
+	private_ts_payload_t *this;
 
-	return &(this->public);
+	INIT(this,
+		.public = {
+			.payload_interface = {
+				.verify = _verify,
+				.get_encoding_rules = _get_encoding_rules,
+				.get_length = _get_length,
+				.get_next_type = _get_next_type,
+				.set_next_type = _set_next_type,
+				.get_type = _get_type,
+				.destroy = _destroy,
+			},
+			.get_initiator = _get_initiator,
+			.set_initiator = _set_initiator,
+			.get_traffic_selectors = _get_traffic_selectors,
+			.destroy = _destroy,
+		},
+		.next_payload = NO_PAYLOAD,
+		.payload_length = TS_PAYLOAD_HEADER_LENGTH,
+		.is_initiator = is_initiator,
+		.substrs = linked_list_create(),
+	);
+	return &this->public;
 }
 
 /*
  * Described in header
  */
-ts_payload_t *ts_payload_create_from_traffic_selectors(bool is_initiator, linked_list_t *traffic_selectors)
+ts_payload_t *ts_payload_create_from_traffic_selectors(bool is_initiator,
+											linked_list_t *traffic_selectors)
 {
-	iterator_t *iterator;
+	enumerator_t *enumerator;
 	traffic_selector_t *ts;
-	traffic_selector_substructure_t *ts_substructure;
+	traffic_selector_substructure_t *subst;
 	private_ts_payload_t *this;
 
 	this = (private_ts_payload_t*)ts_payload_create(is_initiator);
 
-	iterator = traffic_selectors->create_iterator(traffic_selectors, TRUE);
-	while (iterator->iterate(iterator, (void**)&ts))
+	enumerator = traffic_selectors->create_enumerator(traffic_selectors);
+	while (enumerator->enumerate(enumerator, &ts))
 	{
-		ts_substructure = traffic_selector_substructure_create_from_traffic_selector(ts);
-		this->public.add_traffic_selector_substructure(&(this->public), ts_substructure);
+		subst = traffic_selector_substructure_create_from_traffic_selector(ts);
+		this->substrs->insert_last(this->substrs, subst);
 	}
-	iterator->destroy(iterator);
+	enumerator->destroy(enumerator);
+	compute_length(this);
 
-	return &(this->public);
+	return &this->public;
 }
-
diff --git a/src/libcharon/encoding/payloads/ts_payload.h b/src/libcharon/encoding/payloads/ts_payload.h
index d322ff1a8..88ca00bc9 100644
--- a/src/libcharon/encoding/payloads/ts_payload.h
+++ b/src/libcharon/encoding/payloads/ts_payload.h
@@ -19,7 +19,6 @@
  * @{ @ingroup payloads
  */
 
-
 #ifndef TS_PAYLOAD_H_
 #define TS_PAYLOAD_H_
 
@@ -36,13 +35,13 @@ typedef struct ts_payload_t ts_payload_t;
  */
 #define TS_PAYLOAD_HEADER_LENGTH 8
 
-
 /**
  * Class representing an IKEv2 TS payload.
  *
  * The TS payload format is described in RFC section 3.13.
  */
 struct ts_payload_t {
+
 	/**
 	 * The payload_t interface.
 	 */
@@ -67,27 +66,6 @@ struct ts_payload_t {
 	void (*set_initiator) (ts_payload_t *this,bool is_initiator);
 
 	/**
-	 * Adds a traffic_selector_substructure_t object to this object.
-	 *
-	 * @param traffic_selector  traffic_selector_substructure_t object to add
-	 */
-	void (*add_traffic_selector_substructure) (ts_payload_t *this,
-							traffic_selector_substructure_t *traffic_selector);
-
-	/**
-	 * Creates an iterator of stored traffic_selector_substructure_t objects.
-	 *
-	 * When removing an traffic_selector_substructure_t object
-	 * using this iterator, the length of this payload
-	 * has to get refreshed by calling payload_t.get_length!
-	 *
-	 * @param forward 		iterator direction (TRUE: front to end)
-	 * @return				created iterator_t object
-	 */
-	iterator_t *(*create_traffic_selector_substructure_iterator) (
-											ts_payload_t *this, bool forward);
-
-	/**
 	 * Get a list of nested traffic selectors as traffic_selector_t.
 	 *
 	 * Resulting list and its traffic selectors must be destroyed after usage
@@ -105,19 +83,15 @@ struct ts_payload_t {
 /**
  * Creates an empty ts_payload_t object.
  *
- * @param is_initiator
- * 						- TRUE if this payload is of type TSi
- * 						- FALSE if this payload is of type TSr
- * @return				ts_payload_t object
+ * @param is_initiator		TRUE for TSi, FALSE for TSr payload type
+ * @return					ts_payload_t object
  */
 ts_payload_t *ts_payload_create(bool is_initiator);
 
 /**
  * Creates ts_payload with a list of traffic_selector_t
  *
- * @param is_initiator
- * 							- TRUE if this payload is of type TSi
- * 							- FALSE if this payload is of type TSr
+ * @param is_initiator		TRUE for TSi, FALSE for TSr payload type
  * @param traffic_selectors	list of traffic selectors to include
  * @return					ts_payload_t object
  */
diff --git a/src/libcharon/encoding/payloads/unknown_payload.c b/src/libcharon/encoding/payloads/unknown_payload.c
index dd5547dc3..27af338b3 100644
--- a/src/libcharon/encoding/payloads/unknown_payload.c
+++ b/src/libcharon/encoding/payloads/unknown_payload.c
@@ -18,8 +18,6 @@
 
 #include "unknown_payload.h"
 
-
-
 typedef struct private_unknown_payload_t private_unknown_payload_t;
 
 /**
@@ -33,6 +31,11 @@ struct private_unknown_payload_t {
 	unknown_payload_t public;
 
 	/**
+	 * Type of this payload
+	 */
+	payload_type_t type;
+
+	/**
 	 * Next payload type.
 	 */
 	u_int8_t next_payload;
@@ -43,6 +46,11 @@ struct private_unknown_payload_t {
 	bool critical;
 
 	/**
+	 * Reserved bits
+	 */
+	bool reserved[7];
+
+	/**
 	 * Length of this payload.
 	 */
 	u_int16_t payload_length;
@@ -62,21 +70,21 @@ struct private_unknown_payload_t {
  */
 encoding_rule_t unknown_payload_encodings[] = {
 	/* 1 Byte next payload type, stored in the field next_payload */
-	{ U_INT_8,			offsetof(private_unknown_payload_t, next_payload)},
+	{ U_INT_8,			offsetof(private_unknown_payload_t, next_payload)	},
 	/* the critical bit */
-	{ FLAG,				offsetof(private_unknown_payload_t, critical) 	},
-	/* 7 Bit reserved bits, nowhere stored */
-	{ RESERVED_BIT,	0 													},
-	{ RESERVED_BIT,	0 													},
-	{ RESERVED_BIT,	0 													},
-	{ RESERVED_BIT,	0 													},
-	{ RESERVED_BIT,	0 													},
-	{ RESERVED_BIT,	0 													},
-	{ RESERVED_BIT,	0 													},
+	{ FLAG,				offsetof(private_unknown_payload_t, critical)		},
+	/* 7 Bit reserved bits */
+	{ RESERVED_BIT,		offsetof(private_unknown_payload_t, reserved[0])	},
+	{ RESERVED_BIT,		offsetof(private_unknown_payload_t, reserved[1])	},
+	{ RESERVED_BIT,		offsetof(private_unknown_payload_t, reserved[2])	},
+	{ RESERVED_BIT,		offsetof(private_unknown_payload_t, reserved[3])	},
+	{ RESERVED_BIT,		offsetof(private_unknown_payload_t, reserved[4])	},
+	{ RESERVED_BIT,		offsetof(private_unknown_payload_t, reserved[5])	},
+	{ RESERVED_BIT,		offsetof(private_unknown_payload_t, reserved[6])	},
 	/* Length of the whole payload*/
-	{ PAYLOAD_LENGTH,	offsetof(private_unknown_payload_t, payload_length)},
+	{ PAYLOAD_LENGTH,	offsetof(private_unknown_payload_t, payload_length)	},
 	/* some unknown data bytes, length is defined in PAYLOAD_LENGTH */
-	{ UNKNOWN_DATA,		offsetof(private_unknown_payload_t, data) 		}
+	{ UNKNOWN_DATA,		offsetof(private_unknown_payload_t, data)			},
 };
 
 /*
@@ -91,111 +99,109 @@ encoding_rule_t unknown_payload_encodings[] = {
        +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 */
 
-/**
- * Implementation of payload_t.verify.
- */
-static status_t verify(private_unknown_payload_t *this)
+METHOD(payload_t, verify, status_t,
+	private_unknown_payload_t *this)
 {
-	/* can't do any checks, so we assume its good */
+	if (this->payload_length != UNKNOWN_PAYLOAD_HEADER_LENGTH + this->data.len)
+	{
+		return FAILED;
+	}
 	return SUCCESS;
 }
 
-/**
- * Implementation of payload_t.get_encoding_rules.
- */
-static void get_encoding_rules(private_unknown_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
+METHOD(payload_t, get_encoding_rules, void,
+	private_unknown_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
 {
 	*rules = unknown_payload_encodings;
 	*rule_count = sizeof(unknown_payload_encodings) / sizeof(encoding_rule_t);
 }
 
-/**
- * Implementation of payload_t.get_type.
- */
-static payload_type_t get_payload_type(private_unknown_payload_t *this)
+METHOD(payload_t, get_payload_type, payload_type_t,
+	private_unknown_payload_t *this)
 {
-	return UNKNOWN_PAYLOAD;
+	return this->type;
 }
 
-/**
- * Implementation of payload_t.get_next_type.
- */
-static payload_type_t get_next_type(private_unknown_payload_t *this)
+METHOD(payload_t, get_next_type, payload_type_t,
+	private_unknown_payload_t *this)
 {
-	return (this->next_payload);
+	return this->next_payload;
 }
 
-/**
- * Implementation of payload_t.set_next_type.
- */
-static void set_next_type(private_unknown_payload_t *this,payload_type_t type)
+METHOD(payload_t, set_next_type, void,
+	private_unknown_payload_t *this,payload_type_t type)
 {
 	this->next_payload = type;
 }
 
-/**
- * Implementation of payload_t.get_length.
- */
-static size_t get_length(private_unknown_payload_t *this)
+METHOD(payload_t, get_length, size_t,
+	private_unknown_payload_t *this)
 {
 	return this->payload_length;
 }
 
-/**
- * Implementation of unknown_payload_t.get_data.
- */
-static bool is_critical(private_unknown_payload_t *this)
+METHOD(unknown_payload_t, is_critical, bool,
+	private_unknown_payload_t *this)
 {
 	return this->critical;
 }
 
-/**
- * Implementation of unknown_payload_t.get_data.
- */
-static chunk_t get_data (private_unknown_payload_t *this)
+METHOD(unknown_payload_t, get_data, chunk_t,
+	private_unknown_payload_t *this)
 {
-	return (this->data);
+	return this->data;
 }
 
-/**
- * Implementation of payload_t.destroy and unknown_payload_t.destroy.
- */
-static void destroy(private_unknown_payload_t *this)
+METHOD2(payload_t, unknown_payload_t, destroy, void,
+	private_unknown_payload_t *this)
 {
-	if (this->data.ptr != NULL)
-	{
-		chunk_free(&(this->data));
-	}
-
+	free(this->data.ptr);
 	free(this);
 }
 
 /*
  * Described in header
  */
-unknown_payload_t *unknown_payload_create()
+unknown_payload_t *unknown_payload_create(payload_type_t type)
+{
+	private_unknown_payload_t *this;
+
+	INIT(this,
+		.public = {
+			.payload_interface = {
+				.verify = _verify,
+				.get_encoding_rules = _get_encoding_rules,
+				.get_length = _get_length,
+				.get_next_type = _get_next_type,
+				.set_next_type = _set_next_type,
+				.get_type = _get_payload_type,
+				.destroy = _destroy,
+			},
+			.is_critical = _is_critical,
+			.get_data = _get_data,
+			.destroy = _destroy,
+		},
+		.next_payload = NO_PAYLOAD,
+		.payload_length = UNKNOWN_PAYLOAD_HEADER_LENGTH,
+		.type = type,
+	);
+
+	return &this->public;
+}
+
+
+/*
+ * Described in header
+ */
+unknown_payload_t *unknown_payload_create_data(payload_type_t type,
+											   bool critical, chunk_t data)
 {
-	private_unknown_payload_t *this = malloc_thing(private_unknown_payload_t);
-
-	/* interface functions */
-	this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
-	this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
-	this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length;
-	this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type;
-	this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
-	this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_payload_type;
-	this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
-	/* public functions */
-	this->public.destroy = (void (*) (unknown_payload_t *)) destroy;
-	this->public.is_critical = (bool (*) (unknown_payload_t *)) is_critical;
-	this->public.get_data = (chunk_t (*) (unknown_payload_t *)) get_data;
-
-	/* private variables */
-	this->critical = FALSE;
-	this->next_payload = NO_PAYLOAD;
-	this->payload_length = UNKNOWN_PAYLOAD_HEADER_LENGTH;
-	this->data = chunk_empty;
-
-	return (&(this->public));
+	private_unknown_payload_t *this;
+
+	this = (private_unknown_payload_t*)unknown_payload_create(type);
+	this->data = data;
+	this->critical = critical;
+	this->payload_length = UNKNOWN_PAYLOAD_HEADER_LENGTH + data.len;
+
+	return &this->public;
 }
diff --git a/src/libcharon/encoding/payloads/unknown_payload.h b/src/libcharon/encoding/payloads/unknown_payload.h
index c761ed2b6..5ae85331b 100644
--- a/src/libcharon/encoding/payloads/unknown_payload.h
+++ b/src/libcharon/encoding/payloads/unknown_payload.h
@@ -70,10 +70,22 @@ struct unknown_payload_t {
 };
 
 /**
- * Creates an empty unknown_payload_t object.
+ * Creates an empty unknown_payload_t.
  *
- * @return unknown_payload_t object
+ * @param			type of the payload
+ * @return			unknown_payload_t object
  */
-unknown_payload_t *unknown_payload_create(void);
+unknown_payload_t *unknown_payload_create(payload_type_t type);
+
+/**
+ * Create an unknown payload with data.
+ *
+ * @param type		type of payload to create
+ * @param critical	TRUE to set critical bit
+ * @param data		data to set for this payload, gets owned by payload
+ * @return			payload object
+ */
+unknown_payload_t *unknown_payload_create_data(payload_type_t type,
+											   bool critical, chunk_t data);
 
 #endif /** UNKNOWN_PAYLOAD_H_ @}*/
diff --git a/src/libcharon/encoding/payloads/vendor_id_payload.c b/src/libcharon/encoding/payloads/vendor_id_payload.c
index bf33d2418..e9e80e989 100644
--- a/src/libcharon/encoding/payloads/vendor_id_payload.c
+++ b/src/libcharon/encoding/payloads/vendor_id_payload.c
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2005-2009 Martin Willi
+ * Copyright (C) 2005-2010 Martin Willi
+ * Copyright (C) 2010 revosec AG
  * Copyright (C) 2005 Jan Hutter
  * Hochschule fuer Technik Rapperswil
  *
@@ -41,6 +42,11 @@ struct private_vendor_id_payload_t {
 	bool critical;
 
 	/**
+	 * Reserved bits
+	 */
+	bool reserved[7];
+
+	/**
 	 * Length of this payload.
 	 */
 	u_int16_t payload_length;
@@ -59,21 +65,21 @@ struct private_vendor_id_payload_t {
  */
 encoding_rule_t vendor_id_payload_encodings[] = {
 	/* 1 Byte next payload type, stored in the field next_payload */
-	{ U_INT_8,			offsetof(private_vendor_id_payload_t, next_payload) },
+	{ U_INT_8,			offsetof(private_vendor_id_payload_t, next_payload)	},
 	/* the critical bit */
 	{ FLAG,				offsetof(private_vendor_id_payload_t, critical)		},
 	/* 7 Bit reserved bits, nowhere stored */
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
+	{ RESERVED_BIT,		offsetof(private_vendor_id_payload_t, reserved[0])	},
+	{ RESERVED_BIT,		offsetof(private_vendor_id_payload_t, reserved[1])	},
+	{ RESERVED_BIT,		offsetof(private_vendor_id_payload_t, reserved[2])	},
+	{ RESERVED_BIT,		offsetof(private_vendor_id_payload_t, reserved[3])	},
+	{ RESERVED_BIT,		offsetof(private_vendor_id_payload_t, reserved[4])	},
+	{ RESERVED_BIT,		offsetof(private_vendor_id_payload_t, reserved[5])	},
+	{ RESERVED_BIT,		offsetof(private_vendor_id_payload_t, reserved[6])	},
 	/* Length of the whole payload*/
 	{ PAYLOAD_LENGTH,	offsetof(private_vendor_id_payload_t, payload_length)},
 	/* some vendor_id data bytes, length is defined in PAYLOAD_LENGTH */
-	{ VID_DATA,			offsetof(private_vendor_id_payload_t, data) }
+	{ VID_DATA,			offsetof(private_vendor_id_payload_t, data)			}
 };
 
 /*
@@ -88,68 +94,52 @@ encoding_rule_t vendor_id_payload_encodings[] = {
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 */
 
-/**
- * Implementation of payload_t.verify.
- */
-static status_t verify(private_vendor_id_payload_t *this)
+METHOD(payload_t, verify, status_t,
+	private_vendor_id_payload_t *this)
 {
 	return SUCCESS;
 }
 
-/**
- * Implementation of vendor_id_payload_t.get_encoding_rules.
- */
-static void get_encoding_rules(private_vendor_id_payload_t *this,
-							   encoding_rule_t **rules, size_t *rule_count)
+METHOD(payload_t, get_encoding_rules, void,
+	private_vendor_id_payload_t *this, encoding_rule_t **rules,
+	size_t *rule_count)
 {
 	*rules = vendor_id_payload_encodings;
-	*rule_count = sizeof(vendor_id_payload_encodings) / sizeof(encoding_rule_t);
+	*rule_count = countof(vendor_id_payload_encodings);
 }
 
-/**
- * Implementation of payload_t.get_type.
- */
-static payload_type_t get_payload_type(private_vendor_id_payload_t *this)
+METHOD(payload_t, get_type, payload_type_t,
+	private_vendor_id_payload_t *this)
 {
 	return VENDOR_ID;
 }
 
-/**
- * Implementation of payload_t.get_next_type.
- */
-static payload_type_t get_next_type(private_vendor_id_payload_t *this)
+METHOD(payload_t, get_next_type, payload_type_t,
+	private_vendor_id_payload_t *this)
 {
 	return this->next_payload;
 }
 
-/**
- * Implementation of payload_t.set_next_type.
- */
-static void set_next_type(private_vendor_id_payload_t *this,payload_type_t type)
+METHOD(payload_t, set_next_type, void,
+	private_vendor_id_payload_t *this, payload_type_t type)
 {
 	this->next_payload = type;
 }
 
-/**
- * Implementation of payload_t.get_length.
- */
-static size_t get_length(private_vendor_id_payload_t *this)
+METHOD(payload_t, get_length, size_t,
+	private_vendor_id_payload_t *this)
 {
 	return this->payload_length;
 }
 
-/**
- * Implementation of vendor_id_payload_t.get_data.
- */
-static chunk_t get_data(private_vendor_id_payload_t *this)
+METHOD(vendor_id_payload_t, get_data, chunk_t,
+	private_vendor_id_payload_t *this)
 {
 	return this->data;
 }
 
-/**
- * Implementation of payload_t.destroy and vendor_id_payload_t.destroy.
- */
-static void destroy(private_vendor_id_payload_t *this)
+METHOD2(payload_t, vendor_id_payload_t, destroy, void,
+	private_vendor_id_payload_t *this)
 {
 	free(this->data.ptr);
 	free(this);
@@ -158,38 +148,35 @@ static void destroy(private_vendor_id_payload_t *this)
 /*
  * Described in header
  */
-vendor_id_payload_t *vendor_id_payload_create()
+vendor_id_payload_t *vendor_id_payload_create_data(chunk_t data)
 {
-	private_vendor_id_payload_t *this = malloc_thing(private_vendor_id_payload_t);
-
-	this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
-	this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
-	this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length;
-	this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type;
-	this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
-	this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_payload_type;
-	this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-	this->public.get_data = (chunk_t (*) (vendor_id_payload_t *)) get_data;
-
-	this->critical = FALSE;
-	this->next_payload = NO_PAYLOAD;
-	this->payload_length = VENDOR_ID_PAYLOAD_HEADER_LENGTH;
-	this->data = chunk_empty;
+	private_vendor_id_payload_t *this;
 
+	INIT(this,
+		.public = {
+			.payload_interface = {
+				.verify = _verify,
+				.get_encoding_rules = _get_encoding_rules,
+				.get_length = _get_length,
+				.get_next_type = _get_next_type,
+				.set_next_type = _set_next_type,
+				.get_type = _get_type,
+				.destroy = _destroy,
+			},
+			.get_data = _get_data,
+			.destroy = _destroy,
+		},
+		.next_payload = NO_PAYLOAD,
+		.payload_length = VENDOR_ID_PAYLOAD_HEADER_LENGTH + data.len,
+		.data = data,
+	);
 	return &this->public;
 }
 
 /*
  * Described in header
  */
-vendor_id_payload_t *vendor_id_payload_create_data(chunk_t data)
+vendor_id_payload_t *vendor_id_payload_create()
 {
-	private_vendor_id_payload_t *this;
-
-	this = (private_vendor_id_payload_t*)vendor_id_payload_create();
-	this->payload_length += data.len;
-	this->data = data;
-
-	return &this->public;
+	return vendor_id_payload_create_data(chunk_empty);
 }
-
diff --git a/src/libcharon/encoding/payloads/vendor_id_payload.h b/src/libcharon/encoding/payloads/vendor_id_payload.h
index 241535cac..4e4e7d8eb 100644
--- a/src/libcharon/encoding/payloads/vendor_id_payload.h
+++ b/src/libcharon/encoding/payloads/vendor_id_payload.h
@@ -50,6 +50,11 @@ struct vendor_id_payload_t {
 	 * @return		VID data, pointing to an internal chunk_t
 	 */
 	chunk_t (*get_data)(vendor_id_payload_t *this);
+
+	/**
+	 * Destroy Vendor ID payload.
+	 */
+	void (*destroy)(vendor_id_payload_t *this);
 };
 
 /**