[svn-upgrade] new version strongswan (4.5.0)

14 files changed, 1053 insertions, 1757 deletions

diff --git a/src/libcharon/encoding/generator.c b/src/libcharon/encoding/generator.c
index 6485da492..224f76fce 100644
--- a/src/libcharon/encoding/generator.c
+++ b/src/libcharon/encoding/generator.c
@@ -42,6 +42,16 @@
 #include <encoding/payloads/configuration_attribute.h>
 #include <encoding/payloads/eap_payload.h>
 
+/**
+ * Generating is done in a data buffer.
+ * This is the start size of this buffer in bytes.
+ */
+#define GENERATOR_DATA_BUFFER_SIZE 500
+
+/**
+ * Number of bytes to increase the buffer, if it is too small.
+ */
+#define GENERATOR_DATA_BUFFER_INCREASE_VALUE 500
 
 typedef struct private_generator_t private_generator_t;
 
@@ -453,36 +463,19 @@ static void generate_from_chunk(private_generator_t *this, u_int32_t offset)
 	write_bytes_to_buffer(this, value->ptr, value->len);
 }
 
-/**
- * Implementation of private_generator_t.write_to_chunk.
- */
-static void write_to_chunk(private_generator_t *this,chunk_t *data)
+METHOD(generator_t, get_chunk, chunk_t,
+	private_generator_t *this, u_int32_t **lenpos)
 {
-	int data_length = get_length(this);
-	u_int32_t header_length_field = data_length;
-
-	/* write length into header length field */
-	if (this->header_length_position_offset > 0)
-	{
-		u_int32_t val = htonl(header_length_field);
-		write_bytes_to_buffer_at_offset(this, &val, sizeof(u_int32_t),
-										this->header_length_position_offset);
-	}
+	chunk_t data;
 
-	if (this->current_bit > 0)
-	{
-		data_length++;
-	}
-	*data = chunk_alloc(data_length);
-	memcpy(data->ptr, this->buffer, data_length);
-
-	DBG3(DBG_ENC, "generated data of this generator %B", data);
+	*lenpos = (u_int32_t*)(this->buffer + this->header_length_position_offset);
+	data = chunk_create(this->buffer, get_length(this));
+	DBG3(DBG_ENC, "generated data of this generator %B", &data);
+	return data;
 }
 
-/**
- * Implementation of private_generator_t.generate_payload.
- */
-static void generate_payload (private_generator_t *this,payload_t *payload)
+METHOD(generator_t, generate_payload, void,
+	private_generator_t *this,payload_t *payload)
 {
 	int i, offset_start;
 	size_t rule_count;
@@ -846,14 +839,11 @@ static void generate_payload (private_generator_t *this,payload_t *payload)
 		 this->out_position - this->buffer - offset_start);
 }
 
-/**
- * Implementation of generator_t.destroy.
- */
-static status_t destroy(private_generator_t *this)
+METHOD(generator_t, destroy, void,
+	private_generator_t *this)
 {
 	free(this->buffer);
 	free(this);
-	return SUCCESS;
 }
 
 /*
@@ -863,26 +853,18 @@ generator_t *generator_create()
 {
 	private_generator_t *this;
 
-	this = malloc_thing(private_generator_t);
-
-	/* initiate public functions */
-	this->public.generate_payload = (void(*)(generator_t*, payload_t *))generate_payload;
-	this->public.destroy = (void(*)(generator_t*)) destroy;
-	this->public.write_to_chunk = (void (*) (generator_t *,chunk_t *))write_to_chunk;
+	INIT(this,
+		.public = {
+			.get_chunk = _get_chunk,
+			.generate_payload = _generate_payload,
+			.destroy = _destroy,
+		},
+		.buffer = malloc(GENERATOR_DATA_BUFFER_SIZE),
+	);
 
-	/* allocate memory for buffer */
-	this->buffer = malloc(GENERATOR_DATA_BUFFER_SIZE);
-
-	/* initiate private variables */
 	this->out_position = this->buffer;
 	this->roof_position = this->buffer + GENERATOR_DATA_BUFFER_SIZE;
-	this->data_struct = NULL;
-	this->current_bit = 0;
-	this->last_payload_length_position_offset = 0;
-	this->header_length_position_offset = 0;
-	this->attribute_format = FALSE;
-	this->attribute_length = 0;
-
-	return &(this->public);
+
+	return &this->public;
 }
 
diff --git a/src/libcharon/encoding/generator.h b/src/libcharon/encoding/generator.h
index 2221c84af..fe561fdfd 100644
--- a/src/libcharon/encoding/generator.h
+++ b/src/libcharon/encoding/generator.h
@@ -29,24 +29,12 @@ typedef struct generator_t generator_t;
 #include <encoding/payloads/payload.h>
 
 /**
- * Generating is done in a data buffer.
- * This is the start size of this buffer in bytes.
- */
-#define GENERATOR_DATA_BUFFER_SIZE 500
-
-/**
- * Number of bytes to increase the buffer, if it is too small.
- */
-#define GENERATOR_DATA_BUFFER_INCREASE_VALUE 500
-
-
-/**
  * A generator_t class used to generate IKEv2 payloads.
  *
  * After creation, multiple payloads can be generated with the generate_payload
  * method. The generated bytes are appended. After all payloads are added,
  * the write_to_chunk method writes out all generated data since
- * the creation of the generator. After that, the generator must be destroyed.
+ * the creation of the generator.
  * The generater uses a set of encoding rules, which it can get from
  * the supplied payload. With this rules, the generater can generate
  * the payload and all substructures automatically.
@@ -56,18 +44,20 @@ struct generator_t {
 	/**
 	 * Generates a specific payload from given payload object.
 	 *
-	 * Remember: Header and substructures are also handled as payloads.
-	 *
 	 * @param payload 		interface payload_t implementing object
 	 */
 	void (*generate_payload) (generator_t *this,payload_t *payload);
 
 	/**
-	 * Writes all generated data of the generator to a chunk.
+	 * Return a chunk for the currently generated data.
+	 *
+	 * The returned length pointer must be filled in with the length of
+	 * the generated chunk (in network order).
 	 *
-	 * @param data 		chunk to write the data to
+	 * @param lenpos		receives a pointer to fill in length value
+	 * @param return		chunk to internal buffer.
 	 */
-	void (*write_to_chunk) (generator_t *this,chunk_t *data);
+	chunk_t (*get_chunk) (generator_t *this, u_int32_t **lenpos);
 
 	/**
 	 * Destroys a generator_t object.
diff --git a/src/libcharon/encoding/message.c b/src/libcharon/encoding/message.c
index ee49a6686..d41ad4697 100644
--- a/src/libcharon/encoding/message.c
+++ b/src/libcharon/encoding/message.c
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2006-2007 Tobias Brunner
- * Copyright (C) 2005-2009 Martin Willi
+ * Copyright (C) 2005-2010 Martin Willi
+ * Copyright (C) 2010 revosec AG
  * Copyright (C) 2006 Daniel Roethlisberger
  * Copyright (C) 2005 Jan Hutter
  * Hochschule fuer Technik Rapperswil
@@ -43,111 +44,61 @@
  */
 #define MAX_DELETE_PAYLOADS 20
 
-
-typedef struct payload_rule_t payload_rule_t;
-
 /**
  * A payload rule defines the rules for a payload
  * in a specific message rule. It defines if and how
  * many times a payload must/can occur in a message
  * and if it must be encrypted.
  */
-struct payload_rule_t {
-	/**
-	 * Payload type.
-	 */
-	 payload_type_t payload_type;
-
-	 /**
-	  * Minimal occurence of this payload.
-	  */
-	 size_t min_occurence;
-
-	 /**
-	  * Max occurence of this payload.
-	  */
-	 size_t max_occurence;
-
-	 /**
-	  * TRUE if payload must be encrypted
-	  */
-	 bool encrypted;
-
-	 /**
-	  * If this payload occurs, the message rule is
-	  * fullfilled in any case. This applies e.g. to
-	  * notify_payloads.
-	  */
-	 bool sufficient;
-};
-
-typedef struct payload_order_t payload_order_t;
+typedef struct {
+	/* Payload type */
+	 payload_type_t type;
+	/* Minimal occurence of this payload. */
+	size_t min_occurence;
+	/* Max occurence of this payload. */
+	size_t max_occurence;
+	/* TRUE if payload must be encrypted */
+	bool encrypted;
+	/* If payload occurs, the message rule is fullfilled */
+	bool sufficient;
+} payload_rule_t;
 
 /**
  * payload ordering structure allows us to reorder payloads according to RFC.
  */
-struct payload_order_t {
-
-	/**
-	 * payload type
-	 */
+typedef struct {
+	/** payload type */
 	payload_type_t type;
-
-	/**
-	 * notify type, if payload == NOTIFY
-	 */
+	/** notify type, if payload == NOTIFY */
 	notify_type_t notify;
-};
-
-
-typedef struct message_rule_t message_rule_t;
+} payload_order_t;
 
 /**
  * A message rule defines the kind of a message,
  * if it has encrypted contents and a list
  * of payload ordering rules and payload parsing rules.
  */
-struct message_rule_t {
-	/**
-	 * Type of message.
-	 */
+typedef struct {
+	/** Type of message. */
 	exchange_type_t exchange_type;
-
-	/**
-	 * Is message a request or response.
-	 */
+	/** Is message a request or response. */
 	bool is_request;
-
-	/**
-	 * Message contains encrypted content.
-	 */
-	bool encrypted_content;
-
-	/**
-	 * Number of payload rules which will follow
-	 */
-	int payload_rule_count;
-
-	/**
-	 * Pointer to first payload rule
-	 */
-	payload_rule_t *payload_rules;
-
-	/**
-	 * Number of payload order rules
-	 */
-	int payload_order_count;
-
-	/**
-	 * payload ordering rules
-	 */
-	payload_order_t *payload_order;
-};
+	/** Message contains encrypted payloads. */
+	bool encrypted;
+	/** Number of payload rules which will follow */
+	int rule_count;
+	/** Pointer to first payload rule */
+	payload_rule_t *rules;
+	/** Number of payload order rules */
+	int order_count;
+	/** payload ordering rules */
+	payload_order_t *order;
+} message_rule_t;
 
 /**
  * Message rule for IKE_SA_INIT from initiator.
  */
-static payload_rule_t ike_sa_init_i_payload_rules[] = {
+static payload_rule_t ike_sa_init_i_rules[] = {
 /*	payload type					min	max						encr	suff */
 	{NOTIFY,						0,	MAX_NOTIFY_PAYLOADS,	FALSE,	FALSE},
 	{SECURITY_ASSOCIATION,			1,	1,						FALSE,	FALSE},
@@ -159,7 +110,7 @@ static payload_rule_t ike_sa_init_i_payload_rules[] = {
 /**
  * payload order for IKE_SA_INIT initiator
  */
-static payload_order_t ike_sa_init_i_payload_order[] = {
+static payload_order_t ike_sa_init_i_order[] = {
 /*	payload type					notify type */
 	{NOTIFY,						COOKIE},
 	{SECURITY_ASSOCIATION,			0},
@@ -174,7 +125,7 @@ static payload_order_t ike_sa_init_i_payload_order[] = {
 /**
  * Message rule for IKE_SA_INIT from responder.
  */
-static payload_rule_t ike_sa_init_r_payload_rules[] = {
+static payload_rule_t ike_sa_init_r_rules[] = {
 /*	payload type					min	max						encr	suff */
 	{NOTIFY,						0,	MAX_NOTIFY_PAYLOADS,	FALSE,	TRUE},
 	{SECURITY_ASSOCIATION,			1,	1,						FALSE,	FALSE},
@@ -186,7 +137,7 @@ static payload_rule_t ike_sa_init_r_payload_rules[] = {
 /**
  * payload order for IKE_SA_INIT responder
  */
-static payload_order_t ike_sa_init_r_payload_order[] = {
+static payload_order_t ike_sa_init_r_order[] = {
 /*	payload type					notify type */
 	{SECURITY_ASSOCIATION,			0},
 	{KEY_EXCHANGE,					0},
@@ -202,7 +153,7 @@ static payload_order_t ike_sa_init_r_payload_order[] = {
 /**
  * Message rule for IKE_AUTH from initiator.
  */
-static payload_rule_t ike_auth_i_payload_rules[] = {
+static payload_rule_t ike_auth_i_rules[] = {
 /*	payload type					min	max						encr	suff */
 	{NOTIFY,						0,	MAX_NOTIFY_PAYLOADS,	TRUE,	FALSE},
 	{EXTENSIBLE_AUTHENTICATION,		0,	1,						TRUE,	TRUE},
@@ -227,7 +178,7 @@ static payload_rule_t ike_auth_i_payload_rules[] = {
 /**
  * payload order for IKE_AUTH initiator
  */
-static payload_order_t ike_auth_i_payload_order[] = {
+static payload_order_t ike_auth_i_order[] = {
 /*	payload type					notify type */
 	{ID_INITIATOR,					0},
 	{CERTIFICATE,					0},
@@ -256,7 +207,7 @@ static payload_order_t ike_auth_i_payload_order[] = {
 /**
  * Message rule for IKE_AUTH from responder.
  */
-static payload_rule_t ike_auth_r_payload_rules[] = {
+static payload_rule_t ike_auth_r_rules[] = {
 /*	payload type					min	max						encr	suff */
 	{NOTIFY,						0,	MAX_NOTIFY_PAYLOADS,	TRUE,	TRUE},
 	{EXTENSIBLE_AUTHENTICATION,		0,	1,						TRUE,	TRUE},
@@ -273,7 +224,7 @@ static payload_rule_t ike_auth_r_payload_rules[] = {
 /**
  * payload order for IKE_AUTH responder
  */
-static payload_order_t ike_auth_r_payload_order[] = {
+static payload_order_t ike_auth_r_order[] = {
 /*	payload type					notify type */
 	{ID_RESPONDER,					0},
 	{CERTIFICATE,					0},
@@ -299,7 +250,7 @@ static payload_order_t ike_auth_r_payload_order[] = {
 /**
  * Message rule for INFORMATIONAL from initiator.
  */
-static payload_rule_t informational_i_payload_rules[] = {
+static payload_rule_t informational_i_rules[] = {
 /*	payload type					min	max						encr	suff */
 	{NOTIFY,						0,	MAX_NOTIFY_PAYLOADS,	TRUE,	FALSE},
 	{CONFIGURATION,					0,	1,						TRUE,	FALSE},
@@ -310,7 +261,7 @@ static payload_rule_t informational_i_payload_rules[] = {
 /**
  * payload order for INFORMATIONAL initiator
  */
-static payload_order_t informational_i_payload_order[] = {
+static payload_order_t informational_i_order[] = {
 /*	payload type					notify type */
 	{NOTIFY,						UPDATE_SA_ADDRESSES},
 	{NOTIFY,						NAT_DETECTION_SOURCE_IP},
@@ -324,7 +275,7 @@ static payload_order_t informational_i_payload_order[] = {
 /**
  * Message rule for INFORMATIONAL from responder.
  */
-static payload_rule_t informational_r_payload_rules[] = {
+static payload_rule_t informational_r_rules[] = {
 /*	payload type					min	max						encr	suff */
 	{NOTIFY,						0,	MAX_NOTIFY_PAYLOADS,	TRUE,	FALSE},
 	{CONFIGURATION,					0,	1,						TRUE,	FALSE},
@@ -335,7 +286,7 @@ static payload_rule_t informational_r_payload_rules[] = {
 /**
  * payload order for INFORMATIONAL responder
  */
-static payload_order_t informational_r_payload_order[] = {
+static payload_order_t informational_r_order[] = {
 /*	payload type					notify type */
 	{NOTIFY,						UPDATE_SA_ADDRESSES},
 	{NOTIFY,						NAT_DETECTION_SOURCE_IP},
@@ -349,7 +300,7 @@ static payload_order_t informational_r_payload_order[] = {
 /**
  * Message rule for CREATE_CHILD_SA from initiator.
  */
-static payload_rule_t create_child_sa_i_payload_rules[] = {
+static payload_rule_t create_child_sa_i_rules[] = {
 /*	payload type					min	max						encr	suff */
 	{NOTIFY,						0,	MAX_NOTIFY_PAYLOADS,	TRUE,	FALSE},
 	{SECURITY_ASSOCIATION,			1,	1,						TRUE,	FALSE},
@@ -364,7 +315,7 @@ static payload_rule_t create_child_sa_i_payload_rules[] = {
 /**
  * payload order for CREATE_CHILD_SA from initiator.
  */
-static payload_order_t create_child_sa_i_payload_order[] = {
+static payload_order_t create_child_sa_i_order[] = {
 /*	payload type					notify type */
 	{NOTIFY,						REKEY_SA},
 	{NOTIFY,						IPCOMP_SUPPORTED},
@@ -382,7 +333,7 @@ static payload_order_t create_child_sa_i_payload_order[] = {
 /**
  * Message rule for CREATE_CHILD_SA from responder.
  */
-static payload_rule_t create_child_sa_r_payload_rules[] = {
+static payload_rule_t create_child_sa_r_rules[] = {
 /*	payload type					min	max						encr	suff */
 	{NOTIFY,						0,	MAX_NOTIFY_PAYLOADS,	TRUE,	TRUE},
 	{SECURITY_ASSOCIATION,			1,	1,						TRUE,	FALSE},
@@ -397,7 +348,7 @@ static payload_rule_t create_child_sa_r_payload_rules[] = {
 /**
  * payload order for CREATE_CHILD_SA from responder.
  */
-static payload_order_t create_child_sa_r_payload_order[] = {
+static payload_order_t create_child_sa_r_order[] = {
 /*	payload type					notify type */
 	{NOTIFY,						IPCOMP_SUPPORTED},
 	{NOTIFY,						USE_TRANSPORT_MODE},
@@ -416,7 +367,7 @@ static payload_order_t create_child_sa_r_payload_order[] = {
 /**
  * Message rule for ME_CONNECT from initiator.
  */
-static payload_rule_t me_connect_i_payload_rules[] = {
+static payload_rule_t me_connect_i_rules[] = {
 /*	payload type					min	max						encr	suff */
 	{NOTIFY,						0,	MAX_NOTIFY_PAYLOADS,	TRUE,	TRUE},
 	{ID_PEER,						1,	1,						TRUE,	FALSE},
@@ -426,7 +377,7 @@ static payload_rule_t me_connect_i_payload_rules[] = {
 /**
  * payload order for ME_CONNECT from initiator.
  */
-static payload_order_t me_connect_i_payload_order[] = {
+static payload_order_t me_connect_i_order[] = {
 /*	payload type					notify type */
 	{NOTIFY,						0},
 	{ID_PEER,						0},
@@ -436,7 +387,7 @@ static payload_order_t me_connect_i_payload_order[] = {
 /**
  * Message rule for ME_CONNECT from responder.
  */
-static payload_rule_t me_connect_r_payload_rules[] = {
+static payload_rule_t me_connect_r_rules[] = {
 /*	payload type					min	max						encr	suff */
 	{NOTIFY,						0,	MAX_NOTIFY_PAYLOADS,	TRUE,	TRUE},
 	{VENDOR_ID,						0,	10,						TRUE,	FALSE}
@@ -445,7 +396,7 @@ static payload_rule_t me_connect_r_payload_rules[] = {
 /**
  * payload order for ME_CONNECT from responder.
  */
-static payload_order_t me_connect_r_payload_order[] = {
+static payload_order_t me_connect_r_order[] = {
 /*	payload type					notify type */
 	{NOTIFY,						0},
 	{VENDOR_ID,						0},
@@ -457,65 +408,45 @@ static payload_order_t me_connect_r_payload_order[] = {
  */
 static message_rule_t message_rules[] = {
 	{IKE_SA_INIT,		TRUE,	FALSE,
-		(sizeof(ike_sa_init_i_payload_rules)/sizeof(payload_rule_t)),
-		ike_sa_init_i_payload_rules,
-		(sizeof(ike_sa_init_i_payload_order)/sizeof(payload_order_t)),
-		ike_sa_init_i_payload_order,
+		countof(ike_sa_init_i_rules), ike_sa_init_i_rules,
+		countof(ike_sa_init_i_order), ike_sa_init_i_order,
 	},
 	{IKE_SA_INIT,		FALSE,	FALSE,
-		(sizeof(ike_sa_init_r_payload_rules)/sizeof(payload_rule_t)),
-		ike_sa_init_r_payload_rules,
-		(sizeof(ike_sa_init_r_payload_order)/sizeof(payload_order_t)),
-		ike_sa_init_r_payload_order,
+		countof(ike_sa_init_r_rules), ike_sa_init_r_rules,
+		countof(ike_sa_init_r_order), ike_sa_init_r_order,
 	},
 	{IKE_AUTH,			TRUE,	TRUE,
-		(sizeof(ike_auth_i_payload_rules)/sizeof(payload_rule_t)),
-		ike_auth_i_payload_rules,
-		(sizeof(ike_auth_i_payload_order)/sizeof(payload_order_t)),
-		ike_auth_i_payload_order,
+		countof(ike_auth_i_rules), ike_auth_i_rules,
+		countof(ike_auth_i_order), ike_auth_i_order,
 	},
 	{IKE_AUTH,			FALSE,	TRUE,
-		(sizeof(ike_auth_r_payload_rules)/sizeof(payload_rule_t)),
-		ike_auth_r_payload_rules,
-		(sizeof(ike_auth_r_payload_order)/sizeof(payload_order_t)),
-		ike_auth_r_payload_order,
+		countof(ike_auth_r_rules), ike_auth_r_rules,
+		countof(ike_auth_r_order), ike_auth_r_order,
 	},
 	{INFORMATIONAL,		TRUE,	TRUE,
-		(sizeof(informational_i_payload_rules)/sizeof(payload_rule_t)),
-		informational_i_payload_rules,
-		(sizeof(informational_i_payload_order)/sizeof(payload_order_t)),
-		informational_i_payload_order,
+		countof(informational_i_rules), informational_i_rules,
+		countof(informational_i_order), informational_i_order,
 	},
 	{INFORMATIONAL,		FALSE,	TRUE,
-		(sizeof(informational_r_payload_rules)/sizeof(payload_rule_t)),
-		informational_r_payload_rules,
-		(sizeof(informational_r_payload_order)/sizeof(payload_order_t)),
-		informational_r_payload_order,
+		countof(informational_r_rules), informational_r_rules,
+		countof(informational_r_order), informational_r_order,
 	},
 	{CREATE_CHILD_SA,	TRUE,	TRUE,
-		(sizeof(create_child_sa_i_payload_rules)/sizeof(payload_rule_t)),
-		create_child_sa_i_payload_rules,
-		(sizeof(create_child_sa_i_payload_order)/sizeof(payload_order_t)),
-		create_child_sa_i_payload_order,
+		countof(create_child_sa_i_rules), create_child_sa_i_rules,
+		countof(create_child_sa_i_order), create_child_sa_i_order,
 	},
 	{CREATE_CHILD_SA,	FALSE,	TRUE,
-		(sizeof(create_child_sa_r_payload_rules)/sizeof(payload_rule_t)),
-		create_child_sa_r_payload_rules,
-		(sizeof(create_child_sa_r_payload_order)/sizeof(payload_order_t)),
-		create_child_sa_r_payload_order,
+		countof(create_child_sa_r_rules), create_child_sa_r_rules,
+		countof(create_child_sa_r_order), create_child_sa_r_order,
 	},
 #ifdef ME
 	{ME_CONNECT,		TRUE,	TRUE,
-		(sizeof(me_connect_i_payload_rules)/sizeof(payload_rule_t)),
-		me_connect_i_payload_rules,
-		(sizeof(me_connect_i_payload_order)/sizeof(payload_order_t)),
-		me_connect_i_payload_order,
+		countof(me_connect_i_rules), me_connect_i_rules,
+		countof(me_connect_i_order), me_connect_i_order,
 	},
 	{ME_CONNECT,		FALSE,	TRUE,
-		(sizeof(me_connect_r_payload_rules)/sizeof(payload_rule_t)),
-		me_connect_r_payload_rules,
-		(sizeof(me_connect_r_payload_order)/sizeof(payload_order_t)),
-		me_connect_r_payload_order,
+		countof(me_connect_r_rules), me_connect_r_rules,
+		countof(me_connect_r_order), me_connect_r_order,
 	},
 #endif /* ME */
 };
@@ -586,169 +517,132 @@ struct private_message_t {
 	/**
 	 * The message rule for this message instance
 	 */
-	message_rule_t *message_rule;
+	message_rule_t *rule;
 };
 
 /**
- * Implementation of private_message_t.set_message_rule.
+ * Get the message rule that applies to this message
  */
-static  status_t set_message_rule(private_message_t *this)
+static message_rule_t* get_message_rule(private_message_t *this)
 {
 	int i;
 
-	for (i = 0; i < (sizeof(message_rules) / sizeof(message_rule_t)); i++)
+	for (i = 0; i < countof(message_rules); i++)
 	{
 		if ((this->exchange_type == message_rules[i].exchange_type) &&
 			(this->is_request == message_rules[i].is_request))
 		{
-			/* found rule for given exchange_type*/
-			this->message_rule = &(message_rules[i]);
-			return SUCCESS;
+			return &message_rules[i];
 		}
 	}
-	this->message_rule = NULL;
-	return NOT_FOUND;
+	return NULL;
 }
 
 /**
- * Implementation of private_message_t.get_payload_rule.
+ * Look up a payload rule
  */
-static status_t get_payload_rule(private_message_t *this,
-					payload_type_t payload_type, payload_rule_t **payload_rule)
+static payload_rule_t* get_payload_rule(private_message_t *this,
+										payload_type_t type)
 {
 	int i;
 
-	for (i = 0; i < this->message_rule->payload_rule_count;i++)
+	for (i = 0; i < this->rule->rule_count;i++)
 	{
-		if (this->message_rule->payload_rules[i].payload_type == payload_type)
+		if (this->rule->rules[i].type == type)
 		{
-			*payload_rule = &(this->message_rule->payload_rules[i]);
-			return SUCCESS;
+			return &this->rule->rules[i];
 		}
 	}
-
-	*payload_rule = NULL;
-	return NOT_FOUND;
+	return NULL;
 }
 
-/**
- * Implementation of message_t.set_ike_sa_id.
- */
-static void set_ike_sa_id(private_message_t *this,ike_sa_id_t *ike_sa_id)
+METHOD(message_t, set_ike_sa_id, void,
+	private_message_t *this,ike_sa_id_t *ike_sa_id)
 {
 	DESTROY_IF(this->ike_sa_id);
 	this->ike_sa_id = ike_sa_id->clone(ike_sa_id);
 }
 
-/**
- * Implementation of message_t.get_ike_sa_id.
- */
-static ike_sa_id_t* get_ike_sa_id(private_message_t *this)
+METHOD(message_t, get_ike_sa_id, ike_sa_id_t*,
+	private_message_t *this)
 {
 	return this->ike_sa_id;
 }
 
-/**
- * Implementation of message_t.set_message_id.
- */
-static void set_message_id(private_message_t *this,u_int32_t message_id)
+METHOD(message_t, set_message_id, void,
+	private_message_t *this,u_int32_t message_id)
 {
 	this->message_id = message_id;
 }
 
-/**
- * Implementation of message_t.get_message_id.
- */
-static u_int32_t get_message_id(private_message_t *this)
+METHOD(message_t, get_message_id, u_int32_t,
+	private_message_t *this)
 {
 	return this->message_id;
 }
 
-/**
- * Implementation of message_t.get_initiator_spi.
- */
-static u_int64_t get_initiator_spi(private_message_t *this)
+METHOD(message_t, get_initiator_spi, u_int64_t,
+	private_message_t *this)
 {
 	return (this->ike_sa_id->get_initiator_spi(this->ike_sa_id));
 }
 
-/**
- * Implementation of message_t.get_responder_spi.
- */
-static u_int64_t get_responder_spi(private_message_t *this)
+METHOD(message_t, get_responder_spi, u_int64_t,
+	private_message_t *this)
 {
 	return (this->ike_sa_id->get_responder_spi(this->ike_sa_id));
 }
 
-/**
- * Implementation of message_t.set_major_version.
- */
-static void set_major_version(private_message_t *this,u_int8_t major_version)
+METHOD(message_t, set_major_version, void,
+	private_message_t *this, u_int8_t major_version)
 {
 	this->major_version = major_version;
 }
 
-/**
- * Implementation of message_t.set_major_version.
- */
-static u_int8_t get_major_version(private_message_t *this)
+METHOD(message_t, get_major_version, u_int8_t,
+	private_message_t *this)
 {
 	return this->major_version;
 }
 
-/**
- * Implementation of message_t.set_minor_version.
- */
-static void set_minor_version(private_message_t *this,u_int8_t minor_version)
+METHOD(message_t, set_minor_version, void,
+	private_message_t *this,u_int8_t minor_version)
 {
 	this->minor_version = minor_version;
 }
 
-/**
- * Implementation of message_t.get_minor_version.
- */
-static u_int8_t get_minor_version(private_message_t *this)
+METHOD(message_t, get_minor_version, u_int8_t,
+	private_message_t *this)
 {
 	return this->minor_version;
 }
 
-/**
- * Implementation of message_t.set_exchange_type.
- */
-static void set_exchange_type(private_message_t *this,
-							  exchange_type_t exchange_type)
+METHOD(message_t, set_exchange_type, void,
+	private_message_t *this, exchange_type_t exchange_type)
 {
 	this->exchange_type = exchange_type;
 }
 
-/**
- * Implementation of message_t.get_exchange_type.
- */
-static exchange_type_t get_exchange_type(private_message_t *this)
+METHOD(message_t, get_exchange_type, exchange_type_t,
+	private_message_t *this)
 {
 	return this->exchange_type;
 }
 
-/**
- * Implementation of message_t.get_first_payload_type.
- */
-static payload_type_t get_first_payload_type(private_message_t *this)
+METHOD(message_t, get_first_payload_type, payload_type_t,
+	private_message_t *this)
 {
 	return this->first_payload;
 }
 
-/**
- * Implementation of message_t.set_request.
- */
-static void set_request(private_message_t *this, bool request)
+METHOD(message_t, set_request, void,
+	private_message_t *this, bool request)
 {
 	this->is_request = request;
 }
 
-/**
- * Implementation of message_t.get_request.
- */
-static exchange_type_t get_request(private_message_t *this)
+METHOD(message_t, get_request, bool,
+	private_message_t *this)
 {
 	return this->is_request;
 }
@@ -767,10 +661,8 @@ static bool is_encoded(private_message_t *this)
 	return TRUE;
 }
 
-/**
- * Implementation of message_t.add_payload.
- */
-static void add_payload(private_message_t *this, payload_t *payload)
+METHOD(message_t, add_payload, void,
+	private_message_t *this, payload_t *payload)
 {
 	payload_t *last_payload;
 
@@ -790,11 +682,8 @@ static void add_payload(private_message_t *this, payload_t *payload)
 		 payload_type_names, payload->get_type(payload));
 }
 
-/**
- * Implementation of message_t.add_notify.
- */
-static void add_notify(private_message_t *this, bool flush, notify_type_t type,
-					   chunk_t data)
+METHOD(message_t, add_notify, void,
+	private_message_t *this, bool flush, notify_type_t type, chunk_t data)
 {
 	notify_payload_t *notify;
 	payload_t *payload;
@@ -813,50 +702,38 @@ static void add_notify(private_message_t *this, bool flush, notify_type_t type,
 	add_payload(this, (payload_t*)notify);
 }
 
-/**
- * Implementation of message_t.set_source.
- */
-static void set_source(private_message_t *this, host_t *host)
+METHOD(message_t, set_source, void,
+	private_message_t *this, host_t *host)
 {
 	this->packet->set_source(this->packet, host);
 }
 
-/**
- * Implementation of message_t.set_destination.
- */
-static void set_destination(private_message_t *this, host_t *host)
+METHOD(message_t, set_destination, void,
+	private_message_t *this, host_t *host)
 {
 	this->packet->set_destination(this->packet, host);
 }
 
-/**
- * Implementation of message_t.get_source.
- */
-static host_t* get_source(private_message_t *this)
+METHOD(message_t, get_source, host_t*,
+	private_message_t *this)
 {
 	return this->packet->get_source(this->packet);
 }
 
-/**
- * Implementation of message_t.get_destination.
- */
-static host_t * get_destination(private_message_t *this)
+METHOD(message_t, get_destination, host_t*,
+	private_message_t *this)
 {
 	return this->packet->get_destination(this->packet);
 }
 
-/**
- * Implementation of message_t.create_payload_enumerator.
- */
-static enumerator_t *create_payload_enumerator(private_message_t *this)
+METHOD(message_t, create_payload_enumerator, enumerator_t*,
+	private_message_t *this)
 {
 	return this->payloads->create_enumerator(this->payloads);
 }
 
-/**
- * Implementation of message_t.get_payload.
- */
-static payload_t *get_payload(private_message_t *this, payload_type_t type)
+METHOD(message_t, get_payload, payload_t*,
+	private_message_t *this, payload_type_t type)
 {
 	payload_t *current, *found = NULL;
 	enumerator_t *enumerator;
@@ -874,10 +751,8 @@ static payload_t *get_payload(private_message_t *this, payload_type_t type)
 	return found;
 }
 
-/**
- * Implementation of message_t.get_notify
- */
-static notify_payload_t* get_notify(private_message_t *this, notify_type_t type)
+METHOD(message_t, get_notify, notify_payload_t*,
+	private_message_t *this, notify_type_t type)
 {
 	enumerator_t *enumerator;
 	notify_payload_t *notify = NULL;
@@ -1034,11 +909,13 @@ static void order_payloads(private_message_t *this)
 		list->insert_first(list, payload);
 	}
 	/* for each rule, ... */
-	for (i = 0; i < this->message_rule->payload_order_count; i++)
+	for (i = 0; i < this->rule->order_count; i++)
 	{
 		enumerator_t *enumerator;
 		notify_payload_t *notify;
-		payload_order_t order = this->message_rule->payload_order[i];
+		payload_order_t order;
+
+		order = this->rule->order[i];
 
 		/* ... find all payload ... */
 		enumerator = list->create_enumerator(list);
@@ -1068,8 +945,8 @@ static void order_payloads(private_message_t *this)
 		{
 			DBG1(DBG_ENC, "payload %N has no ordering rule in %N %s",
 				 payload_type_names, payload->get_type(payload),
-				 exchange_type_names, this->message_rule->exchange_type,
-				 this->message_rule->is_request ? "request" : "response");
+				 exchange_type_names, this->rule->exchange_type,
+				 this->rule->is_request ? "request" : "response");
 		}
 		add_payload(this, payload);
 	}
@@ -1077,98 +954,67 @@ static void order_payloads(private_message_t *this)
 }
 
 /**
- * Implementation of private_message_t.encrypt_payloads.
+ * Wrap payloads in a encryption payload
  */
-static status_t encrypt_payloads(private_message_t *this,
-								 crypter_t *crypter, signer_t* signer)
+static encryption_payload_t* wrap_payloads(private_message_t *this)
 {
 	encryption_payload_t *encryption;
 	linked_list_t *payloads;
 	payload_t *current;
-	status_t status;
 
-	if (!this->message_rule->encrypted_content)
-	{
-		DBG2(DBG_ENC, "message doesn't have to be encrypted");
-		/* message contains no content to encrypt */
-		return SUCCESS;
-	}
-
-	if (!crypter || !signer)
-	{
-		DBG2(DBG_ENC, "no crypter or signer specified, do not encrypt message");
-		/* message contains no content to encrypt */
-		return SUCCESS;
-	}
-
-	DBG2(DBG_ENC, "copy all payloads to a temporary list");
+	/* copy all payloads in a temporary list */
 	payloads = linked_list_create();
-
-	/* first copy all payloads in a temporary list */
-	while (this->payloads->get_count(this->payloads) > 0)
+	while (this->payloads->remove_first(this->payloads,
+										(void**)&current) == SUCCESS)
 	{
-		this->payloads->remove_first(this->payloads, (void**)&current);
 		payloads->insert_last(payloads, current);
 	}
 
 	encryption = encryption_payload_create();
-
-	DBG2(DBG_ENC, "check each payloads if they have to get encrypted");
-	while (payloads->get_count(payloads) > 0)
+	while (payloads->remove_first(payloads, (void**)&current) == SUCCESS)
 	{
 		payload_rule_t *rule;
 		payload_type_t type;
-		bool to_encrypt = TRUE;
-
-		payloads->remove_first(payloads, (void**)&current);
+		bool encrypt = TRUE;
 
 		type = current->get_type(current);
-		if (get_payload_rule(this, type, &rule) == SUCCESS)
+		rule = get_payload_rule(this, type);
+		if (rule)
 		{
-			to_encrypt = rule->encrypted;
+			encrypt = rule->encrypted;
 		}
-		if (to_encrypt)
+		if (encrypt)
 		{
 			DBG2(DBG_ENC, "insert payload %N to encryption payload",
-				 payload_type_names, current->get_type(current));
+				 payload_type_names, type);
 			encryption->add_payload(encryption, current);
 		}
 		else
 		{
 			DBG2(DBG_ENC, "insert payload %N unencrypted",
-				 payload_type_names, current->get_type(current));
-			add_payload(this, (payload_t*)current);
+				 payload_type_names, type);
+			add_payload(this, current);
 		}
 	}
-
-	DBG2(DBG_ENC, "encrypting encryption payload");
-	encryption->set_transforms(encryption, crypter, signer);
-	status = encryption->encrypt(encryption);
-	DBG2(DBG_ENC, "add encrypted payload to payload list");
-	add_payload(this, (payload_t*)encryption);
-
 	payloads->destroy(payloads);
 
-	return status;
+	return encryption;
 }
 
-/**
- * Implementation of message_t.generate.
- */
-static status_t generate(private_message_t *this, crypter_t *crypter,
-						 signer_t* signer, packet_t **packet)
+METHOD(message_t, generate, status_t,
+	private_message_t *this, aead_t *aead, packet_t **packet)
 {
 	generator_t *generator;
 	ike_header_t *ike_header;
-	payload_t *payload, *next_payload;
+	payload_t *payload, *next;
+	encryption_payload_t *encryption = NULL;
 	enumerator_t *enumerator;
-	status_t status;
-	chunk_t packet_data;
+	chunk_t chunk;
 	char str[256];
+	u_int32_t *lenpos;
 
 	if (is_encoded(this))
-	{
-		/* already generated, return a new packet clone */
+	{	/* already generated, return a new packet clone */
 		*packet = this->packet->clone(this->packet);
 		return SUCCESS;
 	}
@@ -1182,14 +1028,12 @@ static status_t generate(private_message_t *this, crypter_t *crypter,
 	if (this->packet->get_source(this->packet) == NULL ||
 		this->packet->get_destination(this->packet) == NULL)
 	{
-		DBG1(DBG_ENC, "%s not defined",
-			 !this->packet->get_source(this->packet) ? "source" : "destination");
+		DBG1(DBG_ENC, "source/destination not defined");
 		return INVALID_STATE;
 	}
 
-	/* set the rules for this messge */
-	status = set_message_rule(this);
-	if (status != SUCCESS)
+	this->rule = get_message_rule(this);
+	if (!this->rule)
 	{
 		DBG1(DBG_ENC, "no message rules specified for this message type");
 		return NOT_SUPPORTED;
@@ -1199,17 +1043,16 @@ static status_t generate(private_message_t *this, crypter_t *crypter,
 
 	DBG1(DBG_ENC, "generating %s", get_string(this, str, sizeof(str)));
 
-	/* going to encrypt all content which have to be encrypted */
-	status = encrypt_payloads(this, crypter, signer);
-	if (status != SUCCESS)
+	if (aead && this->rule->encrypted)
 	{
-		DBG1(DBG_ENC, "payload encryption failed");
-		return status;
+		encryption = wrap_payloads(this);
+	}
+	else
+	{
+		DBG2(DBG_ENC, "not encrypting payloads");
 	}
 
-	/* build ike header */
 	ike_header = ike_header_create();
-
 	ike_header->set_exchange_type(ike_header, this->exchange_type);
 	ike_header->set_message_id(ike_header, this->message_id);
 	ike_header->set_response_flag(ike_header, !this->is_request);
@@ -1222,54 +1065,49 @@ static status_t generate(private_message_t *this, crypter_t *crypter,
 
 	generator = generator_create();
 
+	/* generate all payloads with proper next type */
 	payload = (payload_t*)ike_header;
-
-	/* generate every payload expect last one, this is done later*/
 	enumerator = create_payload_enumerator(this);
-	while (enumerator->enumerate(enumerator, &next_payload))
+	while (enumerator->enumerate(enumerator, &next))
 	{
-		payload->set_next_type(payload, next_payload->get_type(next_payload));
+		payload->set_next_type(payload, next->get_type(next));
 		generator->generate_payload(generator, payload);
-		payload = next_payload;
+		payload = next;
 	}
 	enumerator->destroy(enumerator);
-
-	/* last payload has no next payload*/
-	payload->set_next_type(payload, NO_PAYLOAD);
-
+	payload->set_next_type(payload, encryption ? ENCRYPTED : NO_PAYLOAD);
 	generator->generate_payload(generator, payload);
-
 	ike_header->destroy(ike_header);
 
-	/* build packet */
-	generator->write_to_chunk(generator, &packet_data);
-	generator->destroy(generator);
-
-	/* if last payload is of type encrypted, integrity checksum if necessary */
-	if (payload->get_type(payload) == ENCRYPTED)
+	if (encryption)
 	{
-		DBG2(DBG_ENC, "build signature on whole message");
-		encryption_payload_t *encryption_payload = (encryption_payload_t*)payload;
-		status = encryption_payload->build_signature(encryption_payload, packet_data);
-		if (status != SUCCESS)
+		u_int32_t *lenpos;
+
+		/* build associated data (without header of encryption payload) */
+		chunk = generator->get_chunk(generator, &lenpos);
+		encryption->set_transform(encryption, aead);
+		/* fill in length, including encryption payload */
+		htoun32(lenpos, chunk.len + encryption->get_length(encryption));
+
+		this->payloads->insert_last(this->payloads, encryption);
+		if (!encryption->encrypt(encryption, chunk))
 		{
-			return status;
+			generator->destroy(generator);
+			return INVALID_STATE;
 		}
+		generator->generate_payload(generator, &encryption->payload_interface);
 	}
+	chunk = generator->get_chunk(generator, &lenpos);
+	htoun32(lenpos, chunk.len);
+	this->packet->set_data(this->packet, chunk_clone(chunk));
+	generator->destroy(generator);
 
-	this->packet->set_data(this->packet, packet_data);
-
-	/* clone packet for caller */
 	*packet = this->packet->clone(this->packet);
-
-	DBG2(DBG_ENC, "message generated successfully");
 	return SUCCESS;
 }
 
-/**
- * Implementation of message_t.get_packet.
- */
-static packet_t *get_packet(private_message_t *this)
+METHOD(message_t, get_packet, packet_t*,
+	private_message_t *this)
 {
 	if (this->packet == NULL)
 	{
@@ -1278,10 +1116,8 @@ static packet_t *get_packet(private_message_t *this)
 	return this->packet->clone(this->packet);
 }
 
-/**
- * Implementation of message_t.get_packet_data.
- */
-static chunk_t get_packet_data(private_message_t *this)
+METHOD(message_t, get_packet_data, chunk_t,
+	private_message_t *this)
 {
 	if (this->packet == NULL)
 	{
@@ -1290,10 +1126,8 @@ static chunk_t get_packet_data(private_message_t *this)
 	return chunk_clone(this->packet->get_data(this->packet));
 }
 
-/**
- * Implementation of message_t.parse_header.
- */
-static status_t parse_header(private_message_t *this)
+METHOD(message_t, parse_header, status_t,
+	private_message_t *this)
 {
 	ike_header_t *ike_header;
 	status_t status;
@@ -1310,7 +1144,6 @@ static status_t parse_header(private_message_t *this)
 
 	}
 
-	/* verify payload */
 	status = ike_header->payload_interface.verify(
 										&ike_header->payload_interface);
 	if (status != SUCCESS)
@@ -1320,18 +1153,14 @@ static status_t parse_header(private_message_t *this)
 		return status;
 	}
 
-	if (this->ike_sa_id != NULL)
-	{
-		this->ike_sa_id->destroy(this->ike_sa_id);
-	}
-
+	DESTROY_IF(this->ike_sa_id);
 	this->ike_sa_id = ike_sa_id_create(ike_header->get_initiator_spi(ike_header),
 									ike_header->get_responder_spi(ike_header),
 									ike_header->get_initiator_flag(ike_header));
 
 	this->exchange_type = ike_header->get_exchange_type(ike_header);
 	this->message_id = ike_header->get_message_id(ike_header);
-	this->is_request = (!(ike_header->get_response_flag(ike_header)));
+	this->is_request = !ike_header->get_response_flag(ike_header);
 	this->major_version = ike_header->get_maj_version(ike_header);
 	this->minor_version = ike_header->get_min_version(ike_header);
 	this->first_payload = ike_header->payload_interface.get_next_type(
@@ -1342,232 +1171,151 @@ static status_t parse_header(private_message_t *this)
 
 	ike_header->destroy(ike_header);
 
-	/* get the rules for this messge */
-	status = set_message_rule(this);
-	if (status != SUCCESS)
+	this->rule = get_message_rule(this);
+	if (!this->rule)
 	{
 		DBG1(DBG_ENC, "no message rules specified for a %N %s",
 			 exchange_type_names, this->exchange_type,
 			 this->is_request ? "request" : "response");
 	}
-
 	return status;
 }
 
 /**
- * Implementation of private_message_t.decrypt_and_verify_payloads.
+ * Decrypt payload from the encryption payload
  */
-static status_t decrypt_payloads(private_message_t *this, crypter_t *crypter,
-								 signer_t* signer)
+static status_t decrypt_payloads(private_message_t *this, aead_t *aead)
 {
-	bool current_payload_was_encrypted = FALSE;
-	payload_t *previous_payload = NULL;
-	int payload_number = 1;
-	iterator_t *iterator;
-	payload_t *current_payload;
-	status_t status;
-
-	iterator = this->payloads->create_iterator(this->payloads,TRUE);
+	bool was_encrypted = FALSE;
+	payload_t *payload, *previous = NULL;
+	enumerator_t *enumerator;
+	payload_rule_t *rule;
+	payload_type_t type;
+	status_t status = SUCCESS;
 
-	/* process each payload and decrypt a encryption payload */
-	while(iterator->iterate(iterator, (void**)&current_payload))
+	enumerator = this->payloads->create_enumerator(this->payloads);
+	while (enumerator->enumerate(enumerator, &payload))
 	{
-		payload_rule_t *payload_rule;
-		payload_type_t current_payload_type;
+		type = payload->get_type(payload);
 
-		/* needed to check */
-		current_payload_type = current_payload->get_type(current_payload);
+		DBG2(DBG_ENC, "process payload of type %N", payload_type_names, type);
 
-		DBG2(DBG_ENC, "process payload of type %N",
-			 payload_type_names, current_payload_type);
-
-		if (current_payload_type == ENCRYPTED)
+		if (type == ENCRYPTED)
 		{
-			encryption_payload_t *encryption_payload;
-			payload_t *current_encrypted_payload;
+			encryption_payload_t *encryption;
+			payload_t *encrypted;
+			chunk_t chunk;
 
-			encryption_payload = (encryption_payload_t*)current_payload;
+			encryption = (encryption_payload_t*)payload;
 
 			DBG2(DBG_ENC, "found an encryption payload");
 
-			if (payload_number != this->payloads->get_count(this->payloads))
+			if (enumerator->enumerate(enumerator, &payload))
 			{
-				/* encrypted payload is not last one */
 				DBG1(DBG_ENC, "encrypted payload is not last payload");
-				iterator->destroy(iterator);
-				return VERIFY_ERROR;
+				status = VERIFY_ERROR;
+				break;
 			}
-			/* decrypt */
-			encryption_payload->set_transforms(encryption_payload,
-											   crypter, signer);
-			DBG2(DBG_ENC, "verify signature of encryption payload");
-			status = encryption_payload->verify_signature(encryption_payload,
-										this->packet->get_data(this->packet));
-			if (status != SUCCESS)
+			encryption->set_transform(encryption, aead);
+			chunk = this->packet->get_data(this->packet);
+			if (chunk.len < encryption->get_length(encryption))
 			{
-				DBG1(DBG_ENC, "encryption payload signature invalid");
-				iterator->destroy(iterator);
-				return FAILED;
+				DBG1(DBG_ENC, "invalid payload length");
+				status = VERIFY_ERROR;
+				break;
 			}
-			DBG2(DBG_ENC, "decrypting content of encryption payload");
-			status = encryption_payload->decrypt(encryption_payload);
+			chunk.len -= encryption->get_length(encryption);
+			status = encryption->decrypt(encryption, chunk);
 			if (status != SUCCESS)
 			{
-				DBG1(DBG_ENC, "encrypted payload could not be decrypted and parsed");
-				iterator->destroy(iterator);
-				return PARSE_ERROR;
-			}
-
-			/* needed later to find out if a payload was encrypted */
-			current_payload_was_encrypted = TRUE;
-
-			/* check if there are payloads contained in the encryption payload */
-			if (encryption_payload->get_payload_count(encryption_payload) == 0)
-			{
-				DBG2(DBG_ENC, "encrypted payload is empty");
-				/* remove the encryption payload, is not needed anymore */
-				iterator->remove(iterator);
-				/* encrypted payload contains no other payload */
-				current_payload_type = NO_PAYLOAD;
-			}
-			else
-			{
-				/* encryption_payload is replaced with first payload contained
-				 * in encryption_payload */
-				encryption_payload->remove_first_payload(encryption_payload,
-													&current_encrypted_payload);
-				iterator->replace(iterator, NULL,
-								  (void *)current_encrypted_payload);
-				current_payload_type = current_encrypted_payload->get_type(
-													current_encrypted_payload);
+				break;
 			}
 
-			/* is the current paylad the first in the message? */
-			if (previous_payload == NULL)
-			{
-				/* yes, set the first payload type of the message to the
-				 * current type */
-				this->first_payload = current_payload_type;
-			}
-			else
-			{
-				/* no, set the next_type of the previous payload to the
-				 * current type */
-				previous_payload->set_next_type(previous_payload,
-												current_payload_type);
-			}
+			was_encrypted = TRUE;
+			this->payloads->remove_at(this->payloads, enumerator);
 
-			/* all encrypted payloads are added to the payload list */
-			while (encryption_payload->get_payload_count(encryption_payload) > 0)
+			while ((encrypted = encryption->remove_payload(encryption)))
 			{
-				encryption_payload->remove_first_payload(encryption_payload,
-													&current_encrypted_payload);
-				DBG2(DBG_ENC, "insert unencrypted payload of type "
-					 "%N at end of list", payload_type_names,
-					 current_encrypted_payload->get_type(
-											current_encrypted_payload));
-				this->payloads->insert_last(this->payloads,
-											current_encrypted_payload);
+				type = encrypted->get_type(encrypted);
+				if (previous)
+				{
+					previous->set_next_type(previous, type);
+				}
+				else
+				{
+					this->first_payload = type;
+				}
+				DBG2(DBG_ENC, "insert decrypted payload of type "
+					 "%N at end of list", payload_type_names, type);
+				this->payloads->insert_last(this->payloads, encrypted);
+				previous = encrypted;
 			}
-
-			/* encryption payload is processed, payloads are moved. Destroy it. */
-			encryption_payload->destroy(encryption_payload);
+			encryption->destroy(encryption);
 		}
-
-		/* we allow unknown payloads of any type and don't bother if it was
-		 * encrypted. Not our problem. */
-		if (current_payload_type != UNKNOWN_PAYLOAD &&
-			current_payload_type != NO_PAYLOAD)
+		if (type != UNKNOWN_PAYLOAD && !was_encrypted)
 		{
-			/* get the ruleset for found payload */
-			status = get_payload_rule(this, current_payload_type, &payload_rule);
-			if (status != SUCCESS)
-			{
-				/* payload is not allowed */
-				DBG1(DBG_ENC, "payload type %N not allowed",
-								  payload_type_names, current_payload_type);
-				iterator->destroy(iterator);
-				return VERIFY_ERROR;
-			}
-
-			/* check if the payload was encrypted, and if it should been have
-			 * encrypted */
-			if (payload_rule->encrypted != current_payload_was_encrypted)
+			rule = get_payload_rule(this, type);
+			if (!rule || rule->encrypted)
 			{
-				/* payload was not encrypted, but should have been.
-				 * or vice-versa */
-				DBG1(DBG_ENC, "payload type %N should be %s!",
-					 payload_type_names, current_payload_type,
-					 (payload_rule->encrypted) ? "encrypted" : "not encrypted");
-				iterator->destroy(iterator);
-				return VERIFY_ERROR;
+				DBG1(DBG_ENC, "payload type %N was not encrypted",
+					 payload_type_names, type);
+				status = VERIFY_ERROR;
+				break;
 			}
 		}
-		/* advance to the next payload */
-		payload_number++;
-		/* is stored to set next payload in case of found encryption payload */
-		previous_payload = current_payload;
+		previous = payload;
 	}
-	iterator->destroy(iterator);
-	return SUCCESS;
+	enumerator->destroy(enumerator);
+	return status;
 }
 
 /**
- * Implementation of private_message_t.verify.
+ * Verify a message and all payload according to message/payload rules
  */
 static status_t verify(private_message_t *this)
 {
 	int i;
-	enumerator_t *enumerator;
-	payload_t *current_payload;
-	size_t total_found_payloads = 0;
 
 	DBG2(DBG_ENC, "verifying message structure");
 
 	/* check for payloads with wrong count*/
-	for (i = 0; i < this->message_rule->payload_rule_count; i++)
+	for (i = 0; i < this->rule->rule_count; i++)
 	{
-		size_t found_payloads = 0;
+		enumerator_t *enumerator;
+		payload_t *payload;
 		payload_rule_t *rule;
+		int found = 0;
 
-		rule = &this->message_rule->payload_rules[i];
+		rule = &this->rule->rules[i];
 		enumerator = create_payload_enumerator(this);
-
-		/* check all payloads for specific rule */
-		while (enumerator->enumerate(enumerator, &current_payload))
+		while (enumerator->enumerate(enumerator, &payload))
 		{
-			payload_type_t current_payload_type;
-			unknown_payload_t *unknown_payload;
+			payload_type_t type;
+			unknown_payload_t *unknown;
 
-			current_payload_type = current_payload->get_type(current_payload);
-			if (current_payload_type == UNKNOWN_PAYLOAD)
+			type = payload->get_type(payload);
+			if (type == UNKNOWN_PAYLOAD)
 			{
-				/* unknown payloads are ignored, IF they are not critical */
-				unknown_payload = (unknown_payload_t*)current_payload;
-				if (unknown_payload->is_critical(unknown_payload))
+				/* unknown payloads are ignored if they are not critical */
+				unknown = (unknown_payload_t*)payload;
+				if (unknown->is_critical(unknown))
 				{
 					DBG1(DBG_ENC, "%N is not supported, but its critical!",
-						 payload_type_names, current_payload_type);
+						 payload_type_names, type);
 					enumerator->destroy(enumerator);
 					return NOT_SUPPORTED;
 				}
 			}
-			else if (current_payload_type == rule->payload_type)
+			else if (type == rule->type)
 			{
-				found_payloads++;
-				total_found_payloads++;
-				DBG2(DBG_ENC, "found payload of type %N", payload_type_names,
-					 rule->payload_type);
-
-				/* as soon as ohe payload occures more then specified,
-				 * the verification fails */
-				if (found_payloads >
-					rule->max_occurence)
+				found++;
+				DBG2(DBG_ENC, "found payload of type %N",
+					 payload_type_names, type);
+				if (found > rule->max_occurence)
 				{
 					DBG1(DBG_ENC, "payload of type %N more than %d times (%d) "
 						 "occured in current message", payload_type_names,
-						 current_payload_type, rule->max_occurence,
-						 found_payloads);
+						 type, rule->max_occurence, found);
 					enumerator->destroy(enumerator);
 					return VERIFY_ERROR;
 				}
@@ -1575,11 +1323,10 @@ static status_t verify(private_message_t *this)
 		}
 		enumerator->destroy(enumerator);
 
-		if (found_payloads < rule->min_occurence)
+		if (found < rule->min_occurence)
 		{
 			DBG1(DBG_ENC, "payload of type %N not occured %d times (%d)",
-				 payload_type_names, rule->payload_type, rule->min_occurence,
-				 found_payloads);
+				 payload_type_names, rule->type, rule->min_occurence, found);
 			return VERIFY_ERROR;
 		}
 		if (rule->sufficient)
@@ -1590,72 +1337,60 @@ static status_t verify(private_message_t *this)
 	return SUCCESS;
 }
 
-/**
- * Implementation of message_t.parse_body.
- */
-static status_t parse_body(private_message_t *this, crypter_t *crypter,
-						   signer_t *signer)
+METHOD(message_t, parse_body, status_t,
+	private_message_t *this, aead_t *aead)
 {
 	status_t status = SUCCESS;
-	payload_type_t current_payload_type;
+	payload_t *payload;
+	payload_type_t type;
 	char str[256];
 
-	current_payload_type = this->first_payload;
+	type = this->first_payload;
 
 	DBG2(DBG_ENC, "parsing body of message, first payload is %N",
-		 payload_type_names, current_payload_type);
+		 payload_type_names, type);
 
-	/* parse payload for payload, while there are more available */
-	while ((current_payload_type != NO_PAYLOAD))
+	while (type != NO_PAYLOAD)
 	{
-		payload_t *current_payload;
-
 		DBG2(DBG_ENC, "starting parsing a %N payload",
-			 payload_type_names, current_payload_type);
+			 payload_type_names, type);
 
-		/* parse current payload */
-		status = this->parser->parse_payload(this->parser, current_payload_type,
-											 (payload_t**)&current_payload);
+		status = this->parser->parse_payload(this->parser, type, &payload);
 		if (status != SUCCESS)
 		{
 			DBG1(DBG_ENC, "payload type %N could not be parsed",
-				 payload_type_names, current_payload_type);
+				 payload_type_names, type);
 			return PARSE_ERROR;
 		}
 
-		DBG2(DBG_ENC, "verifying payload of type %N",
-			 payload_type_names, current_payload_type);
-
-		/* verify it, stop parsig if its invalid */
-		status = current_payload->verify(current_payload);
+		DBG2(DBG_ENC, "verifying payload of type %N", payload_type_names, type);
+		status = payload->verify(payload);
 		if (status != SUCCESS)
 		{
 			DBG1(DBG_ENC, "%N payload verification failed",
-				 payload_type_names, current_payload_type);
-			current_payload->destroy(current_payload);
+				 payload_type_names, type);
+			payload->destroy(payload);
 			return VERIFY_ERROR;
 		}
 
 		DBG2(DBG_ENC, "%N payload verified. Adding to payload list",
-			 payload_type_names, current_payload_type);
-		this->payloads->insert_last(this->payloads,current_payload);
+			 payload_type_names, type);
+		this->payloads->insert_last(this->payloads, payload);
 
 		/* an encryption payload is the last one, so STOP here. decryption is
 		 * done later */
-		if (current_payload_type == ENCRYPTED)
+		if (type == ENCRYPTED)
 		{
 			DBG2(DBG_ENC, "%N payload found. Stop parsing",
-				 payload_type_names, current_payload_type);
+				 payload_type_names, type);
 			break;
 		}
-
-		/* get next payload type */
-		current_payload_type = current_payload->get_next_type(current_payload);
+		type = payload->get_next_type(payload);
 	}
 
-	if (current_payload_type == ENCRYPTED)
+	if (type == ENCRYPTED)
 	{
-		status = decrypt_payloads(this,crypter,signer);
+		status = decrypt_payloads(this, aead);
 		if (status != SUCCESS)
 		{
 			DBG1(DBG_ENC, "could not decrypt payloads");
@@ -1674,10 +1409,8 @@ static status_t parse_body(private_message_t *this, crypter_t *crypter,
 	return SUCCESS;
 }
 
-/**
- * Implementation of message_t.destroy.
- */
-static void destroy (private_message_t *this)
+METHOD(message_t, destroy, void,
+	private_message_t *this)
 {
 	DESTROY_IF(this->ike_sa_id);
 	this->payloads->destroy_offset(this->payloads, offsetof(payload_t, destroy));
@@ -1691,58 +1424,48 @@ static void destroy (private_message_t *this)
  */
 message_t *message_create_from_packet(packet_t *packet)
 {
-	private_message_t *this = malloc_thing(private_message_t);
-
-	/* public functions */
-	this->public.set_major_version = (void(*)(message_t*, u_int8_t))set_major_version;
-	this->public.get_major_version = (u_int8_t(*)(message_t*))get_major_version;
-	this->public.set_minor_version = (void(*)(message_t*, u_int8_t))set_minor_version;
-	this->public.get_minor_version = (u_int8_t(*)(message_t*))get_minor_version;
-	this->public.set_message_id = (void(*)(message_t*, u_int32_t))set_message_id;
-	this->public.get_message_id = (u_int32_t(*)(message_t*))get_message_id;
-	this->public.get_initiator_spi = (u_int64_t(*)(message_t*))get_initiator_spi;
-	this->public.get_responder_spi = (u_int64_t(*)(message_t*))get_responder_spi;
-	this->public.set_ike_sa_id = (void(*)(message_t*, ike_sa_id_t *))set_ike_sa_id;
-	this->public.get_ike_sa_id = (ike_sa_id_t*(*)(message_t*))get_ike_sa_id;
-	this->public.set_exchange_type = (void(*)(message_t*, exchange_type_t))set_exchange_type;
-	this->public.get_exchange_type = (exchange_type_t(*)(message_t*))get_exchange_type;
-	this->public.get_first_payload_type = (payload_type_t(*)(message_t*))get_first_payload_type;
-	this->public.set_request = (void(*)(message_t*, bool))set_request;
-	this->public.get_request = (bool(*)(message_t*))get_request;
-	this->public.add_payload = (void(*)(message_t*,payload_t*))add_payload;
-	this->public.add_notify = (void(*)(message_t*,bool,notify_type_t,chunk_t))add_notify;
-	this->public.generate = (status_t (*) (message_t *,crypter_t*,signer_t*,packet_t**)) generate;
-	this->public.set_source = (void (*) (message_t*,host_t*)) set_source;
-	this->public.get_source = (host_t * (*) (message_t*)) get_source;
-	this->public.set_destination = (void (*) (message_t*,host_t*)) set_destination;
-	this->public.get_destination = (host_t * (*) (message_t*)) get_destination;
-	this->public.create_payload_enumerator = (enumerator_t * (*) (message_t *)) create_payload_enumerator;
-	this->public.get_payload = (payload_t * (*) (message_t *, payload_type_t)) get_payload;
-	this->public.get_notify = (notify_payload_t*(*)(message_t*, notify_type_t type))get_notify;
-	this->public.parse_header = (status_t (*) (message_t *)) parse_header;
-	this->public.parse_body = (status_t (*) (message_t *,crypter_t*,signer_t*)) parse_body;
-	this->public.get_packet = (packet_t * (*) (message_t*)) get_packet;
-	this->public.get_packet_data = (chunk_t (*) (message_t *this)) get_packet_data;
-	this->public.destroy = (void(*)(message_t*))destroy;
-
-	/* private values */
-	this->exchange_type = EXCHANGE_TYPE_UNDEFINED;
-	this->is_request = TRUE;
-	this->ike_sa_id = NULL;
-	this->first_payload = NO_PAYLOAD;
-	this->message_id = 0;
-
-	/* private values */
-	if (packet == NULL)
-	{
-		packet = packet_create();
-	}
-	this->message_rule = NULL;
-	this->packet = packet;
-	this->payloads = linked_list_create();
-
-	/* parser is created from data of packet */
-	this->parser = parser_create(this->packet->get_data(this->packet));
+	private_message_t *this;
+
+	INIT(this,
+		.public = {
+			.set_major_version = _set_major_version,
+			.get_major_version = _get_major_version,
+			.set_minor_version = _set_minor_version,
+			.get_minor_version = _get_minor_version,
+			.set_message_id = _set_message_id,
+			.get_message_id = _get_message_id,
+			.get_initiator_spi = _get_initiator_spi,
+			.get_responder_spi = _get_responder_spi,
+			.set_ike_sa_id = _set_ike_sa_id,
+			.get_ike_sa_id = _get_ike_sa_id,
+			.set_exchange_type = _set_exchange_type,
+			.get_exchange_type = _get_exchange_type,
+			.get_first_payload_type = _get_first_payload_type,
+			.set_request = _set_request,
+			.get_request = _get_request,
+			.add_payload = _add_payload,
+			.add_notify = _add_notify,
+			.generate = _generate,
+			.set_source = _set_source,
+			.get_source = _get_source,
+			.set_destination = _set_destination,
+			.get_destination = _get_destination,
+			.create_payload_enumerator = _create_payload_enumerator,
+			.get_payload = _get_payload,
+			.get_notify = _get_notify,
+			.parse_header = _parse_header,
+			.parse_body = _parse_body,
+			.get_packet = _get_packet,
+			.get_packet_data = _get_packet_data,
+			.destroy = _destroy,
+		},
+		.exchange_type = EXCHANGE_TYPE_UNDEFINED,
+		.is_request = TRUE,
+		.first_payload = NO_PAYLOAD,
+		.packet = packet,
+		.payloads = linked_list_create(),
+		.parser = parser_create(packet->get_data(packet)),
+	);
 
 	return (&this->public);
 }
@@ -1752,6 +1475,6 @@ message_t *message_create_from_packet(packet_t *packet)
  */
 message_t *message_create()
 {
-	return message_create_from_packet(NULL);
+	return message_create_from_packet(packet_create());
 }
 
diff --git a/src/libcharon/encoding/message.h b/src/libcharon/encoding/message.h
index 2c7718f49..8c1cbcd09 100644
--- a/src/libcharon/encoding/message.h
+++ b/src/libcharon/encoding/message.h
@@ -32,8 +32,7 @@ typedef struct message_t message_t;
 #include <encoding/payloads/ike_header.h>
 #include <encoding/payloads/notify_payload.h>
 #include <utils/linked_list.h>
-#include <crypto/crypters/crypter.h>
-#include <crypto/signers/signer.h>
+#include <crypto/aead.h>
 
 /**
  * This class is used to represent an IKEv2-Message.
@@ -201,14 +200,10 @@ struct message_t {
 	 * The body gets not only parsed, but rather it gets verified.
 	 * All payloads are verified if they are allowed to exist in the message
 	 * of this type and if their own structure is ok.
-	 * If there are encrypted payloads, they get decrypted via the supplied
-	 * crypter. Also the message integrity gets verified with the supplied
-	 * signer.
-	 * Crypter/signer can be omitted (by passing NULL) when no encryption
-	 * payload is expected.
-	 *
-	 * @param crypter	crypter to decrypt encryption payloads
-	 * @param signer	signer to verifiy a message with an encryption payload
+	 * If there are encrypted payloads, they get decrypted and verified using
+	 * the given aead transform (if given).
+	 *
+	 * @param aead		aead transform to verify/decrypt message
 	 * @return
 	 * 					- SUCCESS if parsing successful
 	 * 					- NOT_SUPPORTED if ciritcal unknown payloads found
@@ -216,32 +211,28 @@ struct message_t {
 	 *					- PARSE_ERROR if message parsing failed
 	 * 					- VERIFY_ERROR if message verification failed (bad syntax)
 	 * 					- FAILED if integrity check failed
-	 * 					- INVALID_STATE if crypter/signer not supplied, but needed
+	 * 					- INVALID_STATE if aead not supplied, but needed
 	 */
-	status_t (*parse_body) (message_t *this, crypter_t *crypter, signer_t *signer);
+	status_t (*parse_body) (message_t *this, aead_t *aead);
 
 	/**
 	 * Generates the UDP packet of specific message.
 	 *
 	 * Payloads which must be encrypted are generated first and added to
-	 * an encryption payload. This encryption payload will get encrypted via
-	 * the supplied crypter. Then all other payloads and the header get generated.
-	 * After that, the checksum is added to the encryption payload over the full
-	 * message.
-	 * Crypter/signer can be omitted (by passing NULL) when no encryption
-	 * payload is expected.
-	 * Generation is only done once, multiple calls will just return a packet copy.
-	 *
-	 * @param crypter	crypter to use when a payload must be encrypted
-	 * @param signer	signer to build a mac
+	 * an encryption payload. This encryption payload will get encrypted and
+	 * signed via the supplied aead transform (if given).
+	 * Generation is only done once, multiple calls will just return a copy
+	 * of the packet.
+	 *
+	 * @param aead		aead transform to encrypt/sign message
 	 * @param packet	copy of generated packet
 	 * @return
 	 * 					- SUCCESS if packet could be generated
 	 * 					- INVALID_STATE if exchange type is currently not set
 	 * 					- NOT_FOUND if no rules found for message generation
-	 * 					- INVALID_STATE if crypter/signer not supplied but needed.
+	 * 					- INVALID_STATE if aead not supplied but needed.
 	 */
-	status_t (*generate) (message_t *this, crypter_t *crypter, signer_t *signer, packet_t **packet);
+	status_t (*generate) (message_t *this, aead_t *aead, packet_t **packet);
 
 	/**
 	 * Gets the source host informations.
@@ -331,13 +322,8 @@ struct message_t {
 /**
  * Creates an message_t object from a incoming UDP Packet.
  *
- * @warning the given packet_t object is not copied and gets
- *			destroyed in message_t's destroy call.
- *
- * - exchange_type is set to NOT_SET
- * - original_initiator is set to TRUE
- * - is_request is set to TRUE
- * Call message_t.parse_header afterwards.
+ * The given packet gets owned by the message. The message is uninitialized,
+ * call parse_header() to populate header fields.
  *
  * @param packet		packet_t object which is assigned to message
  * @return 				message_t object
diff --git a/src/libcharon/encoding/payloads/delete_payload.c b/src/libcharon/encoding/payloads/delete_payload.c
index 97b4743b2..5fc3b7c88 100644
--- a/src/libcharon/encoding/payloads/delete_payload.c
+++ b/src/libcharon/encoding/payloads/delete_payload.c
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2005-2006 Martin Willi
+ * Copyright (C) 2005-2010 Martin Willi
+ * Copyright (C) 2010 revosec AG
  * Copyright (C) 2005 Jan Hutter
  * Hochschule fuer Technik Rapperswil
  *
@@ -65,11 +66,6 @@ struct private_delete_payload_t {
 	 * The contained SPI's.
 	 */
 	chunk_t spis;
-
-	/**
-	 * List containing u_int32_t spis
-	 */
-	linked_list_t *spi_list;
 };
 
 /**
@@ -77,7 +73,6 @@ struct private_delete_payload_t {
  *
  * The defined offsets are the positions in a object of type
  * private_delete_payload_t.
- *
  */
 encoding_rule_t delete_payload_encodings[] = {
 	/* 1 Byte next payload type, stored in the field next_payload */
@@ -85,20 +80,20 @@ encoding_rule_t delete_payload_encodings[] = {
 	/* the critical bit */
 	{ FLAG,				offsetof(private_delete_payload_t, critical) 		},
 	/* 7 Bit reserved bits, nowhere stored */
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
+	{ RESERVED_BIT,		0 													},
+	{ RESERVED_BIT,		0 													},
+	{ RESERVED_BIT,		0 													},
+	{ RESERVED_BIT,		0 													},
+	{ RESERVED_BIT,		0 													},
+	{ RESERVED_BIT,		0 													},
+	{ RESERVED_BIT,		0 													},
 	/* Length of the whole payload*/
-	{ PAYLOAD_LENGTH,	offsetof(private_delete_payload_t, payload_length)},
+	{ PAYLOAD_LENGTH,	offsetof(private_delete_payload_t, payload_length)	},
 	{ U_INT_8,			offsetof(private_delete_payload_t, protocol_id)		},
 	{ U_INT_8,			offsetof(private_delete_payload_t, spi_size)		},
 	{ U_INT_16,			offsetof(private_delete_payload_t, spi_count)		},
 	/* some delete data bytes, length is defined in PAYLOAD_LENGTH */
-	{ SPIS,			offsetof(private_delete_payload_t, spis) 				}
+	{ SPIS,				offsetof(private_delete_payload_t, spis) 			}
 };
 
 /*
@@ -115,10 +110,8 @@ encoding_rule_t delete_payload_encodings[] = {
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 */
 
-/**
- * Implementation of payload_t.verify.
- */
-static status_t verify(private_delete_payload_t *this)
+METHOD(payload_t, verify, status_t,
+	private_delete_payload_t *this)
 {
 	switch (this->protocol_id)
 	{
@@ -147,112 +140,104 @@ static status_t verify(private_delete_payload_t *this)
 	return SUCCESS;
 }
 
-/**
- * Implementation of delete_payload_t.get_encoding_rules.
- */
-static void get_encoding_rules(private_delete_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
+METHOD(payload_t, get_encoding_rules, void,
+	private_delete_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
 {
 	*rules = delete_payload_encodings;
-	*rule_count = sizeof(delete_payload_encodings) / sizeof(encoding_rule_t);
+	*rule_count = countof(delete_payload_encodings);
 }
 
-/**
- * Implementation of payload_t.get_type.
- */
-static payload_type_t get_payload_type(private_delete_payload_t *this)
+METHOD(payload_t, get_payload_type, payload_type_t,
+	private_delete_payload_t *this)
 {
 	return DELETE;
 }
 
-/**
- * Implementation of payload_t.get_next_type.
- */
-static payload_type_t get_next_type(private_delete_payload_t *this)
+METHOD(payload_t, get_next_type, payload_type_t,
+	private_delete_payload_t *this)
 {
-	return (this->next_payload);
+	return this->next_payload;
 }
 
-/**
- * Implementation of payload_t.set_next_type.
- */
-static void set_next_type(private_delete_payload_t *this,payload_type_t type)
+METHOD(payload_t, set_next_type, void,
+	private_delete_payload_t *this,payload_type_t type)
 {
 	this->next_payload = type;
 }
 
-/**
- * Implementation of payload_t.get_length.
- */
-static size_t get_length(private_delete_payload_t *this)
+METHOD(payload_t, get_length, size_t,
+	private_delete_payload_t *this)
 {
 	return this->payload_length;
 }
 
-/**
- * Implementation of delete_payload_t.get_protocol_id.
- */
-static protocol_id_t get_protocol_id (private_delete_payload_t *this)
+METHOD(delete_payload_t, get_protocol_id, protocol_id_t,
+	private_delete_payload_t *this)
 {
-	return (this->protocol_id);
+	return this->protocol_id;
 }
 
-/**
- * Implementation of delete_payload_t.add_spi.
- */
-static void add_spi(private_delete_payload_t *this, u_int32_t spi)
+METHOD(delete_payload_t, add_spi, void,
+	private_delete_payload_t *this, u_int32_t spi)
 {
-	/* only add SPIs if AH|ESP, ignore others */
-	if (this->protocol_id == PROTO_AH || this->protocol_id == PROTO_ESP)
+	switch (this->protocol_id)
 	{
-		this->spi_count += 1;
-		this->spis.len += this->spi_size;
-		this->spis.ptr = realloc(this->spis.ptr, this->spis.len);
-		*(u_int32_t*)(this->spis.ptr + (this->spis.len / this->spi_size - 1)) = spi;
-		if (this->spi_list)
-		{
-			/* reset SPI iterator list */
-			this->spi_list->destroy(this->spi_list);
-			this->spi_list = NULL;
-		}
+		case PROTO_AH:
+		case PROTO_ESP:
+			this->spi_count++;
+			this->payload_length += sizeof(spi);
+			this->spis = chunk_cat("mc", this->spis, chunk_from_thing(spi));
+			break;
+		default:
+			break;
 	}
 }
 
 /**
- * Implementation of delete_payload_t.create_spi_iterator.
+ * SPI enumerator implementation
  */
-static iterator_t* create_spi_iterator(private_delete_payload_t *this)
-{
-	int i;
+typedef struct {
+	/** implements enumerator_t */
+	enumerator_t public;
+	/** remaining SPIs */
+	chunk_t spis;
+} spi_enumerator_t;
 
-	if (this->spi_list == NULL)
+METHOD(enumerator_t, spis_enumerate, bool,
+	spi_enumerator_t *this, u_int32_t *spi)
+{
+	if (this->spis.len >= sizeof(*spi))
 	{
-		this->spi_list = linked_list_create();
-		/* only parse SPIs if AH|ESP */
-		if (this->protocol_id == PROTO_AH || this->protocol_id == PROTO_ESP)
-		{
-			for (i = 0; i < this->spi_count; i++)
-			{
-				this->spi_list->insert_last(this->spi_list, this->spis.ptr + i *
-															this->spi_size);
-			}
-		}
+		memcpy(spi, this->spis.ptr, sizeof(*spi));
+		this->spis = chunk_skip(this->spis, sizeof(*spi));
+		return TRUE;
 	}
-	return this->spi_list->create_iterator(this->spi_list, TRUE);
+	return FALSE;
 }
 
-/**
- * Implementation of payload_t.destroy and delete_payload_t.destroy.
- */
-static void destroy(private_delete_payload_t *this)
+METHOD(delete_payload_t, create_spi_enumerator, enumerator_t*,
+	private_delete_payload_t *this)
 {
-	if (this->spis.ptr != NULL)
-	{
-		chunk_free(&this->spis);
-	}
-	if (this->spi_list)
+	spi_enumerator_t *e;
+
+	if (this->spi_size != sizeof(u_int32_t))
 	{
-		this->spi_list->destroy(this->spi_list);
+		return enumerator_create_empty();
 	}
+	INIT(e,
+		.public = {
+			.enumerate = (void*)_spis_enumerate,
+			.destroy = (void*)free,
+		},
+		.spis = this->spis,
+	);
+	return &e->public;
+}
+
+METHOD2(payload_t, delete_payload_t, destroy, void,
+	private_delete_payload_t *this)
+{
+	free(this->spis.ptr);
 	free(this);
 }
 
@@ -261,32 +246,28 @@ static void destroy(private_delete_payload_t *this)
  */
 delete_payload_t *delete_payload_create(protocol_id_t protocol_id)
 {
-	private_delete_payload_t *this = malloc_thing(private_delete_payload_t);
-
-	/* interface functions */
-	this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
-	this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
-	this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length;
-	this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type;
-	this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
-	this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_payload_type;
-	this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
-	/* public functions */
-	this->public.destroy = (void (*) (delete_payload_t *)) destroy;
-	this->public.get_protocol_id = (protocol_id_t (*) (delete_payload_t *)) get_protocol_id;
-	this->public.add_spi = (void (*) (delete_payload_t *,u_int32_t))add_spi;
-	this->public.create_spi_iterator = (iterator_t* (*) (delete_payload_t *)) create_spi_iterator;
-
-	/* private variables */
-	this->critical = FALSE;
-	this->next_payload = NO_PAYLOAD;
-	this->payload_length = DELETE_PAYLOAD_HEADER_LENGTH;
-	this->protocol_id = protocol_id;
-	this->spi_size = protocol_id == PROTO_AH || protocol_id == PROTO_ESP ? 4 : 0;
-	this->spi_count = 0;
-	this->spis = chunk_empty;
-	this->spi_list = NULL;
+	private_delete_payload_t *this;
 
-	return (&this->public);
+	INIT(this,
+		.public = {
+			.payload_interface = {
+				.verify = _verify,
+				.get_encoding_rules = _get_encoding_rules,
+				.get_length = _get_length,
+				.get_next_type = _get_next_type,
+				.set_next_type = _set_next_type,
+				.get_type = _get_payload_type,
+				.destroy = _destroy,
+			},
+			.get_protocol_id = _get_protocol_id,
+			.add_spi = _add_spi,
+			.create_spi_enumerator = _create_spi_enumerator,
+			.destroy = _destroy,
+		},
+		.next_payload = NO_PAYLOAD,
+		.payload_length = DELETE_PAYLOAD_HEADER_LENGTH,
+		.protocol_id = protocol_id,
+		.spi_size = protocol_id == PROTO_AH || protocol_id == PROTO_ESP ? 4 : 0,
+	);
+	return &this->public;
 }
diff --git a/src/libcharon/encoding/payloads/delete_payload.h b/src/libcharon/encoding/payloads/delete_payload.h
index 3b62c1af1..026829f97 100644
--- a/src/libcharon/encoding/payloads/delete_payload.h
+++ b/src/libcharon/encoding/payloads/delete_payload.h
@@ -39,6 +39,7 @@ typedef struct delete_payload_t delete_payload_t;
  * The DELETE payload format is described in RFC section 3.11.
  */
 struct delete_payload_t {
+
 	/**
 	 * The payload_t interface.
 	 */
@@ -59,13 +60,11 @@ struct delete_payload_t {
 	void (*add_spi) (delete_payload_t *this, u_int32_t spi);
 
 	/**
-	 * Get an iterator over the SPIs.
-	 *
-	 * The iterate() function returns a pointer to a u_int32_t SPI.
+	 * Get an enumerator over the SPIs in network order.
 	 *
-	 * @return				iterator over SPIs
+	 * @return				enumerator over SPIs, u_int32_t
 	 */
-	iterator_t *(*create_spi_iterator) (delete_payload_t *this);
+	enumerator_t *(*create_spi_enumerator) (delete_payload_t *this);
 
 	/**
 	 * Destroys an delete_payload_t object.
diff --git a/src/libcharon/encoding/payloads/encryption_payload.c b/src/libcharon/encoding/payloads/encryption_payload.c
index 2adbb88b9..3b23ea9fb 100644
--- a/src/libcharon/encoding/payloads/encryption_payload.c
+++ b/src/libcharon/encoding/payloads/encryption_payload.c
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2005-2006 Martin Willi
+ * Copyright (C) 2005-2010 Martin Willi
+ * Copyright (C) 2010 revosec AG
  * Copyright (C) 2005 Jan Hutter
  * Hochschule fuer Technik Rapperswil
  *
@@ -24,9 +25,6 @@
 #include <utils/linked_list.h>
 #include <encoding/generator.h>
 #include <encoding/parser.h>
-#include <utils/iterator.h>
-#include <crypto/signers/signer.h>
-
 
 typedef struct private_encryption_payload_t private_encryption_payload_t;
 
@@ -50,9 +48,9 @@ struct private_encryption_payload_t {
 	u_int8_t next_payload;
 
 	/**
-	 * Critical flag.
+	 * Flags, including reserved bits
 	 */
-	bool critical;
+	u_int8_t flags;
 
 	/**
 	 * Length of this payload
@@ -60,28 +58,17 @@ struct private_encryption_payload_t {
 	u_int16_t payload_length;
 
 	/**
-	 * Chunk containing the iv, data, padding,
-	 * and (an eventually not calculated) signature.
+	 * Chunk containing the IV, plain, padding and ICV.
 	 */
 	chunk_t encrypted;
 
 	/**
-	 * Chunk containing the data in decrypted (unpadded) form.
-	 */
-	chunk_t decrypted;
-
-	/**
-	 * Signer set by set_signer.
+	 * AEAD transform to use
 	 */
-	signer_t *signer;
+	aead_t *aead;
 
 	/**
-	 * Crypter, supplied by encrypt/decrypt
-	 */
-	crypter_t *crypter;
-
-	/**
-	 * Contained payloads of this encrpytion_payload.
+	 * Contained payloads
 	 */
 	linked_list_t *payloads;
 };
@@ -91,25 +78,16 @@ struct private_encryption_payload_t {
  *
  * The defined offsets are the positions in a object of type
  * private_encryption_payload_t.
- *
  */
 encoding_rule_t encryption_payload_encodings[] = {
 	/* 1 Byte next payload type, stored in the field next_payload */
 	{ U_INT_8,			offsetof(private_encryption_payload_t, next_payload)	},
-	/* the critical bit */
-	{ FLAG,				offsetof(private_encryption_payload_t, critical)		},
-	/* 7 Bit reserved bits, nowhere stored */
-	{ RESERVED_BIT,		0														},
-	{ RESERVED_BIT,		0														},
-	{ RESERVED_BIT,		0														},
-	{ RESERVED_BIT,		0														},
-	{ RESERVED_BIT,		0														},
-	{ RESERVED_BIT,		0														},
-	{ RESERVED_BIT,		0														},
+	/* Critical and 7 reserved bits, all stored for reconstruction */
+	{ U_INT_8,			offsetof(private_encryption_payload_t, flags)			},
 	/* Length of the whole encryption payload*/
 	{ PAYLOAD_LENGTH,	offsetof(private_encryption_payload_t, payload_length)	},
 	/* encrypted data, stored in a chunk. contains iv, data, padding */
-	{ ENCRYPTED_DATA,	offsetof(private_encryption_payload_t, encrypted)			},
+	{ ENCRYPTED_DATA,	offsetof(private_encryption_payload_t, encrypted)		},
 };
 
 /*
@@ -131,108 +109,90 @@ encoding_rule_t encryption_payload_encodings[] = {
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 */
 
-/**
- * Implementation of payload_t.verify.
- */
-static status_t verify(private_encryption_payload_t *this)
+METHOD(payload_t, verify, status_t,
+	private_encryption_payload_t *this)
 {
 	return SUCCESS;
 }
 
-/**
- * Implementation of payload_t.get_encoding_rules.
- */
-static void get_encoding_rules(private_encryption_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
+METHOD(payload_t, get_encoding_rules, void,
+	private_encryption_payload_t *this, encoding_rule_t **rules,
+	size_t *count)
 {
 	*rules = encryption_payload_encodings;
-	*rule_count = sizeof(encryption_payload_encodings) / sizeof(encoding_rule_t);
+	*count = countof(encryption_payload_encodings);
 }
 
-/**
- * Implementation of payload_t.get_type.
- */
-static payload_type_t get_type(private_encryption_payload_t *this)
+METHOD(payload_t, get_type, payload_type_t,
+	private_encryption_payload_t *this)
 {
 	return ENCRYPTED;
 }
 
-/**
- * Implementation of payload_t.get_next_type.
- */
-static payload_type_t get_next_type(private_encryption_payload_t *this)
+METHOD(payload_t, get_next_type, payload_type_t,
+	private_encryption_payload_t *this)
 {
-	/* returns first contained payload here */
-	return (this->next_payload);
+	return this->next_payload;
 }
 
-/**
- * Implementation of payload_t.set_next_type.
- */
-static void set_next_type(private_encryption_payload_t *this, payload_type_t type)
+METHOD(payload_t, set_next_type, void,
+	private_encryption_payload_t *this, payload_type_t type)
 {
-	/* set next type is not allowed, since this payload MUST be the last one
-	 * and so nothing is done in here*/
+	/* the next payload is set during add */
 }
 
 /**
- * (re-)compute the lenght of the whole payload
+ * Compute the lenght of the whole payload
  */
 static void compute_length(private_encryption_payload_t *this)
 {
-	iterator_t *iterator;
-	payload_t *current_payload;
-	size_t block_size, length = 0;
-	iterator = this->payloads->create_iterator(this->payloads, TRUE);
+	enumerator_t *enumerator;
+	payload_t *payload;
+	size_t bs, length = 0;
 
-	/* count payload length */
-	while (iterator->iterate(iterator, (void **) &current_payload))
+	if (this->encrypted.len)
 	{
-		length += current_payload->get_length(current_payload);
+		length = this->encrypted.len;
 	}
-	iterator->destroy(iterator);
-
-	if (this->crypter && this->signer)
+	else
 	{
-		/* append one byte for padding length */
-		length++;
-		/* append padding */
-		block_size = this->crypter->get_block_size(this->crypter);
-		length += block_size - length % block_size;
-		/* add iv */
-		length += block_size;
-		/* add signature */
-		length += this->signer->get_block_size(this->signer);
+		enumerator = this->payloads->create_enumerator(this->payloads);
+		while (enumerator->enumerate(enumerator, &payload))
+		{
+			length += payload->get_length(payload);
+		}
+		enumerator->destroy(enumerator);
+
+		if (this->aead)
+		{
+			/* append padding */
+			bs = this->aead->get_block_size(this->aead);
+			length += bs - (length % bs);
+			/* add iv */
+			length += this->aead->get_iv_size(this->aead);
+			/* add icv */
+			length += this->aead->get_icv_size(this->aead);
+		}
 	}
 	length += ENCRYPTION_PAYLOAD_HEADER_LENGTH;
 	this->payload_length = length;
 }
 
-/**
- * Implementation of payload_t.get_length.
- */
-static size_t get_length(private_encryption_payload_t *this)
+METHOD2(payload_t, encryption_payload_t, get_length, size_t,
+	private_encryption_payload_t *this)
 {
 	compute_length(this);
 	return this->payload_length;
 }
 
-/**
- * Implementation of payload_t.create_payload_iterator.
- */
-static  iterator_t *create_payload_iterator (private_encryption_payload_t *this, bool forward)
-{
-	return (this->payloads->create_iterator(this->payloads, forward));
-}
-
-/**
- * Implementation of payload_t.add_payload.
- */
-static void add_payload(private_encryption_payload_t *this, payload_t *payload)
+METHOD(encryption_payload_t, add_payload, void,
+	private_encryption_payload_t *this, payload_t *payload)
 {
 	payload_t *last_payload;
+
 	if (this->payloads->get_count(this->payloads) > 0)
 	{
-		this->payloads->get_last(this->payloads,(void **) &last_payload);
+		this->payloads->get_last(this->payloads, (void **)&last_payload);
 		last_payload->set_next_type(last_payload, payload->get_type(payload));
 	}
 	else
@@ -240,339 +200,255 @@ static void add_payload(private_encryption_payload_t *this, payload_t *payload)
 		this->next_payload = payload->get_type(payload);
 	}
 	payload->set_next_type(payload, NO_PAYLOAD);
-	this->payloads->insert_last(this->payloads, (void*)payload);
+	this->payloads->insert_last(this->payloads, payload);
 	compute_length(this);
 }
 
-/**
- * Implementation of encryption_payload_t.remove_first_payload.
- */
-static status_t remove_first_payload(private_encryption_payload_t *this, payload_t **payload)
+METHOD(encryption_payload_t, remove_payload, payload_t *,
+	private_encryption_payload_t *this)
 {
-	return this->payloads->remove_first(this->payloads, (void**)payload);
-}
+	payload_t *payload;
 
-/**
- * Implementation of encryption_payload_t.get_payload_count.
- */
-static size_t get_payload_count(private_encryption_payload_t *this)
-{
-	return this->payloads->get_count(this->payloads);
+	if (this->payloads->remove_first(this->payloads,
+									 (void**)&payload) == SUCCESS)
+	{
+		return payload;
+	}
+	return NULL;
 }
 
 /**
- * Generate payload before encryption.
+ * Generate payload before encryption
  */
-static void generate(private_encryption_payload_t *this)
+static chunk_t generate(private_encryption_payload_t *this,
+						generator_t *generator)
 {
-	payload_t *current_payload, *next_payload;
-	generator_t *generator;
-	iterator_t *iterator;
-
-	/* recalculate length before generating */
-	compute_length(this);
+	payload_t *current, *next;
+	enumerator_t *enumerator;
+	u_int32_t *lenpos;
+	chunk_t chunk = chunk_empty;
 
-	/* create iterator */
-	iterator = this->payloads->create_iterator(this->payloads, TRUE);
-
-	/* get first payload */
-	if (iterator->iterate(iterator, (void**)&current_payload))
-	{
-		this->next_payload = current_payload->get_type(current_payload);
-	}
-	else
+	enumerator = this->payloads->create_enumerator(this->payloads);
+	if (enumerator->enumerate(enumerator, &current))
 	{
-		/* no paylads? */
-		DBG2(DBG_ENC, "generating contained payloads, but none available");
-		free(this->decrypted.ptr);
-		this->decrypted = chunk_empty;
-		iterator->destroy(iterator);
-		return;
-	}
+		this->next_payload = current->get_type(current);
 
-	generator = generator_create();
+		while (enumerator->enumerate(enumerator, &next))
+		{
+			current->set_next_type(current, next->get_type(next));
+			generator->generate_payload(generator, current);
+			current = next;
+		}
+		current->set_next_type(current, NO_PAYLOAD);
+		generator->generate_payload(generator, current);
 
-	/* build all payload, except last */
-	while(iterator->iterate(iterator, (void**)&next_payload))
-	{
-		current_payload->set_next_type(current_payload, next_payload->get_type(next_payload));
-		generator->generate_payload(generator, current_payload);
-		current_payload = next_payload;
+		chunk = generator->get_chunk(generator, &lenpos);
+		DBG2(DBG_ENC, "generated content in encryption payload");
 	}
-	iterator->destroy(iterator);
-
-	/* build last payload */
-	current_payload->set_next_type(current_payload, NO_PAYLOAD);
-	generator->generate_payload(generator, current_payload);
-
-	/* free already generated data */
-	free(this->decrypted.ptr);
-
-	generator->write_to_chunk(generator, &(this->decrypted));
-	generator->destroy(generator);
-	DBG2(DBG_ENC, "successfully generated content in encryption payload");
+	enumerator->destroy(enumerator);
+	return chunk;
 }
 
 /**
- * Implementation of encryption_payload_t.encrypt.
+ * Append the encryption payload header to the associated data
  */
-static status_t encrypt(private_encryption_payload_t *this)
+static chunk_t append_header(private_encryption_payload_t *this, chunk_t assoc)
 {
-	chunk_t iv, padding, to_crypt, result;
+	struct {
+		u_int8_t next_payload;
+		u_int8_t flags;
+		u_int16_t length;
+	} __attribute__((packed)) header = {
+		.next_payload = this->next_payload,
+		.flags = this->flags,
+		.length = htons(get_length(this)),
+	};
+	return chunk_cat("cc", assoc, chunk_from_thing(header));
+}
+
+METHOD(encryption_payload_t, encrypt, bool,
+	private_encryption_payload_t *this, chunk_t assoc)
+{
+	chunk_t iv, plain, padding, icv, crypt;
+	generator_t *generator;
 	rng_t *rng;
-	size_t block_size;
+	size_t bs;
 
-	if (this->signer == NULL || this->crypter == NULL)
+	if (this->aead == NULL)
 	{
-		DBG1(DBG_ENC, "could not encrypt, signer/crypter not set");
-		return INVALID_STATE;
+		DBG1(DBG_ENC, "encrypting encryption payload failed, transform missing");
+		return FALSE;
 	}
 
-	/* for random data in iv and padding */
 	rng = lib->crypto->create_rng(lib->crypto, RNG_WEAK);
 	if (!rng)
 	{
-		DBG1(DBG_ENC, "could not encrypt, no RNG found");
-		return FAILED;
+		DBG1(DBG_ENC, "encrypting encryption payload failed, no RNG found");
+		return FALSE;
 	}
-	/* build payload chunk */
-	generate(this);
 
-	DBG2(DBG_ENC, "encrypting payloads");
-	DBG3(DBG_ENC, "data to encrypt %B", &this->decrypted);
+	assoc = append_header(this, assoc);
 
-	/* build padding */
-	block_size = this->crypter->get_block_size(this->crypter);
-	padding.len = block_size - ((this->decrypted.len + 1) %  block_size);
-	rng->allocate_bytes(rng, padding.len, &padding);
-
-	/* concatenate payload data, padding, padding len */
-	to_crypt.len = this->decrypted.len + padding.len + 1;
-	to_crypt.ptr = malloc(to_crypt.len);
-
-	memcpy(to_crypt.ptr, this->decrypted.ptr, this->decrypted.len);
-	memcpy(to_crypt.ptr + this->decrypted.len, padding.ptr, padding.len);
-	*(to_crypt.ptr + to_crypt.len - 1) = padding.len;
+	generator = generator_create();
+	plain = generate(this, generator);
+	bs = this->aead->get_block_size(this->aead);
+	/* we need at least one byte padding to store the padding length */
+	padding.len = bs - (plain.len % bs);
+	iv.len = this->aead->get_iv_size(this->aead);
+	icv.len = this->aead->get_icv_size(this->aead);
+
+	/* prepare data to authenticate-encrypt:
+	 * | IV | plain | padding | ICV |
+	 *       \____crypt______/   ^
+	 *              |           /
+	 *              v          /
+	 *     assoc -> + ------->/
+	 */
+	free(this->encrypted.ptr);
+	this->encrypted = chunk_alloc(iv.len + plain.len + padding.len + icv.len);
+	iv.ptr = this->encrypted.ptr;
+	memcpy(iv.ptr + iv.len, plain.ptr, plain.len);
+	plain.ptr = iv.ptr + iv.len;
+	padding.ptr = plain.ptr + plain.len;
+	icv.ptr = padding.ptr + padding.len;
+	crypt = chunk_create(plain.ptr, plain.len + padding.len);
+	generator->destroy(generator);
 
-	/* build iv */
-	iv.len = block_size;
-	rng->allocate_bytes(rng, iv.len, &iv);
+	rng->get_bytes(rng, iv.len, iv.ptr);
+	rng->get_bytes(rng, padding.len - 1, padding.ptr);
+	padding.ptr[padding.len - 1] = padding.len - 1;
 	rng->destroy(rng);
 
-	DBG3(DBG_ENC, "data before encryption with padding %B", &to_crypt);
+	DBG3(DBG_ENC, "encryption payload encryption:");
+	DBG3(DBG_ENC, "IV %B", &iv);
+	DBG3(DBG_ENC, "plain %B", &plain);
+	DBG3(DBG_ENC, "padding %B", &padding);
+	DBG3(DBG_ENC, "assoc %B", &assoc);
 
-	/* encrypt to_crypt chunk */
-	free(this->encrypted.ptr);
-	this->crypter->encrypt(this->crypter, to_crypt, iv, &result);
-	free(padding.ptr);
-	free(to_crypt.ptr);
-
-	DBG3(DBG_ENC, "data after encryption %B", &result);
-
-	/* build encrypted result with iv and signature */
-	this->encrypted.len = iv.len + result.len + this->signer->get_block_size(this->signer);
-	free(this->encrypted.ptr);
-	this->encrypted.ptr = malloc(this->encrypted.len);
+	this->aead->encrypt(this->aead, crypt, assoc, iv, NULL);
 
-	/* fill in result, signature is left out */
-	memcpy(this->encrypted.ptr, iv.ptr, iv.len);
-	memcpy(this->encrypted.ptr + iv.len, result.ptr, result.len);
+	DBG3(DBG_ENC, "encrypted %B", &crypt);
+	DBG3(DBG_ENC, "ICV %B", &icv);
 
-	free(result.ptr);
-	free(iv.ptr);
-	DBG3(DBG_ENC, "data after encryption with IV and (invalid) signature %B",
-		 &this->encrypted);
+	free(assoc.ptr);
 
-	return SUCCESS;
+	return TRUE;
 }
 
 /**
  * Parse the payloads after decryption.
  */
-static status_t parse(private_encryption_payload_t *this)
+static status_t parse(private_encryption_payload_t *this, chunk_t plain)
 {
 	parser_t *parser;
-	status_t status;
-	payload_type_t current_payload_type;
-
-	/* build a parser on the decrypted data */
-	parser = parser_create(this->decrypted);
+	payload_type_t type;
 
-	current_payload_type = this->next_payload;
-	/* parse all payloads */
-	while (current_payload_type != NO_PAYLOAD)
+	parser = parser_create(plain);
+	type = this->next_payload;
+	while (type != NO_PAYLOAD)
 	{
-		payload_t *current_payload;
+		payload_t *payload;
 
-		status = parser->parse_payload(parser, current_payload_type, (payload_t**)&current_payload);
-		if (status != SUCCESS)
+		if (parser->parse_payload(parser, type, &payload) != SUCCESS)
 		{
 			parser->destroy(parser);
 			return PARSE_ERROR;
 		}
-
-		status = current_payload->verify(current_payload);
-		if (status != SUCCESS)
+		if (payload->verify(payload) != SUCCESS)
 		{
 			DBG1(DBG_ENC, "%N verification failed",
-				 payload_type_names, current_payload->get_type(current_payload));
-			current_payload->destroy(current_payload);
+				 payload_type_names, payload->get_type(payload));
+			payload->destroy(payload);
 			parser->destroy(parser);
 			return VERIFY_ERROR;
 		}
-
-		/* get next payload type */
-		current_payload_type = current_payload->get_next_type(current_payload);
-
-		this->payloads->insert_last(this->payloads,current_payload);
+		type = payload->get_next_type(payload);
+		this->payloads->insert_last(this->payloads, payload);
 	}
 	parser->destroy(parser);
-	DBG2(DBG_ENC, "succesfully parsed content of encryption payload");
+	DBG2(DBG_ENC, "parsed content of encryption payload");
 	return SUCCESS;
 }
 
-/**
- * Implementation of encryption_payload_t.encrypt.
- */
-static status_t decrypt(private_encryption_payload_t *this)
+METHOD(encryption_payload_t, decrypt, status_t,
+	private_encryption_payload_t *this, chunk_t assoc)
 {
-	chunk_t iv, concatenated;
-	u_int8_t padding_length;
-
-	DBG2(DBG_ENC, "decrypting encryption payload");
-	DBG3(DBG_ENC, "data before decryption with IV and (invalid) signature %B",
-		 &this->encrypted);
+	chunk_t iv, plain, padding, icv, crypt;
+	size_t bs;
 
-	if (this->signer == NULL || this->crypter == NULL)
+	if (this->aead == NULL)
 	{
-		DBG1(DBG_ENC, "could not decrypt, no crypter/signer set");
+		DBG1(DBG_ENC, "decrypting encryption payload failed, transform missing");
 		return INVALID_STATE;
 	}
 
-	/* get IV */
-	iv.len = this->crypter->get_block_size(this->crypter);
+	/* prepare data to authenticate-decrypt:
+	 * | IV | plain | padding | ICV |
+	 *       \____crypt______/   ^
+	 *              |           /
+	 *              v          /
+	 *     assoc -> + ------->/
+	 */
 
+	bs = this->aead->get_block_size(this->aead);
+	iv.len = this->aead->get_iv_size(this->aead);
 	iv.ptr = this->encrypted.ptr;
+	icv.len = this->aead->get_icv_size(this->aead);
+	icv.ptr = this->encrypted.ptr + this->encrypted.len - icv.len;
+	crypt.ptr = iv.ptr + iv.len;
+	crypt.len = this->encrypted.len - iv.len;
 
-	/* point concatenated to data + padding + padding_length*/
-	concatenated.ptr = this->encrypted.ptr + iv.len;
-	concatenated.len = this->encrypted.len - iv.len -
-								this->signer->get_block_size(this->signer);
-
-	/* concatenated must be a multiple of block_size of crypter */
-	if (concatenated.len < iv.len || concatenated.len % iv.len)
+	if (iv.len + icv.len > this->encrypted.len ||
+		(crypt.len - icv.len) % bs)
 	{
-		DBG1(DBG_ENC, "could not decrypt, invalid input");
+		DBG1(DBG_ENC, "decrypting encryption payload failed, invalid length");
 		return FAILED;
 	}
 
-	/* free previus data, if any */
-	free(this->decrypted.ptr);
-
-	DBG3(DBG_ENC, "data before decryption %B", &concatenated);
-
-	this->crypter->decrypt(this->crypter, concatenated, iv, &this->decrypted);
+	assoc = append_header(this, assoc);
 
-	DBG3(DBG_ENC, "data after decryption with padding %B", &this->decrypted);
+	DBG3(DBG_ENC, "encryption payload decryption:");
+	DBG3(DBG_ENC, "IV %B", &iv);
+	DBG3(DBG_ENC, "encrypted %B", &crypt);
+	DBG3(DBG_ENC, "ICV %B", &icv);
+	DBG3(DBG_ENC, "assoc %B", &assoc);
 
-	/* get padding length, sits just bevore signature */
-	padding_length = *(this->decrypted.ptr + this->decrypted.len - 1);
-	/* add one byte to the padding length, since the padding_length field is
-	 * not included */
-	padding_length++;
-
-	/* check size again */
-	if (padding_length > concatenated.len || padding_length > this->decrypted.len)
+	if (!this->aead->decrypt(this->aead, crypt, assoc, iv, NULL))
 	{
-		DBG1(DBG_ENC, "decryption failed, invalid padding length found. Invalid key?");
-		/* decryption failed :-/ */
+		DBG1(DBG_ENC, "verifying encryption payload integrity failed");
+		free(assoc.ptr);
 		return FAILED;
 	}
-	this->decrypted.len -= padding_length;
-
-	/* free padding */
-	this->decrypted.ptr = realloc(this->decrypted.ptr, this->decrypted.len);
-	DBG3(DBG_ENC, "data after decryption without padding %B", &this->decrypted);
-	DBG2(DBG_ENC, "decryption successful, trying to parse content");
-	return parse(this);
-}
+	free(assoc.ptr);
 
-/**
- * Implementation of encryption_payload_t.set_transforms.
- */
-static void set_transforms(private_encryption_payload_t *this, crypter_t* crypter, signer_t* signer)
-{
-	this->signer = signer;
-	this->crypter = crypter;
-}
-
-/**
- * Implementation of encryption_payload_t.build_signature.
- */
-static status_t build_signature(private_encryption_payload_t *this, chunk_t data)
-{
-	chunk_t data_without_sig = data;
-	chunk_t sig;
-
-	if (this->signer == NULL)
+	plain = chunk_create(crypt.ptr, crypt.len - icv.len);
+	padding.len = plain.ptr[plain.len - 1] + 1;
+	if (padding.len > plain.len)
 	{
-		DBG1(DBG_ENC, "unable to build signature, no signer set");
-		return INVALID_STATE;
+		DBG1(DBG_ENC, "decrypting encryption payload failed, "
+			 "padding invalid %B", &crypt);
+		return PARSE_ERROR;
 	}
+	plain.len -= padding.len;
+	padding.ptr = plain.ptr + plain.len;
 
-	sig.len = this->signer->get_block_size(this->signer);
-	data_without_sig.len -= sig.len;
-	sig.ptr = data.ptr + data_without_sig.len;
-	DBG2(DBG_ENC, "building signature");
-	this->signer->get_signature(this->signer, data_without_sig, sig.ptr);
-	return SUCCESS;
+	DBG3(DBG_ENC, "plain %B", &plain);
+	DBG3(DBG_ENC, "padding %B", &padding);
+
+	return parse(this, plain);
 }
 
-/**
- * Implementation of encryption_payload_t.verify_signature.
- */
-static status_t verify_signature(private_encryption_payload_t *this, chunk_t data)
+METHOD(encryption_payload_t, set_transform, void,
+	private_encryption_payload_t *this, aead_t* aead)
 {
-	chunk_t sig, data_without_sig;
-	bool valid;
-
-	if (this->signer == NULL)
-	{
-		DBG1(DBG_ENC, "unable to verify signature, no signer set");
-		return INVALID_STATE;
-	}
-	/* find signature in data chunk */
-	sig.len = this->signer->get_block_size(this->signer);
-	if (data.len <= sig.len)
-	{
-		DBG1(DBG_ENC, "unable to verify signature, invalid input");
-		return FAILED;
-	}
-	sig.ptr = data.ptr + data.len - sig.len;
-
-	/* verify it */
-	data_without_sig.len = data.len - sig.len;
-	data_without_sig.ptr = data.ptr;
-	valid = this->signer->verify_signature(this->signer, data_without_sig, sig);
-
-	if (!valid)
-	{
-		DBG1(DBG_ENC, "signature verification failed");
-		return FAILED;
-	}
-
-	DBG2(DBG_ENC, "signature verification successful");
-	return SUCCESS;
+	this->aead = aead;
 }
 
-/**
- * Implementation of payload_t.destroy.
- */
-static void destroy(private_encryption_payload_t *this)
+METHOD2(payload_t, encryption_payload_t, destroy, void,
+	private_encryption_payload_t *this)
 {
 	this->payloads->destroy_offset(this->payloads, offsetof(payload_t, destroy));
 	free(this->encrypted.ptr);
-	free(this->decrypted.ptr);
 	free(this);
 }
 
@@ -581,39 +457,31 @@ static void destroy(private_encryption_payload_t *this)
  */
 encryption_payload_t *encryption_payload_create()
 {
-	private_encryption_payload_t *this = malloc_thing(private_encryption_payload_t);
-
-	/* payload_t interface functions */
-	this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
-	this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
-	this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length;
-	this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type;
-	this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
-	this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_type;
-	this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
-	/* public functions */
-	this->public.create_payload_iterator = (iterator_t * (*) (encryption_payload_t *,bool)) create_payload_iterator;
-	this->public.add_payload = (void (*) (encryption_payload_t *,payload_t *)) add_payload;
-	this->public.remove_first_payload = (status_t (*)(encryption_payload_t*, payload_t **)) remove_first_payload;
-	this->public.get_payload_count = (size_t (*)(encryption_payload_t*)) get_payload_count;
-
-	this->public.encrypt = (status_t (*) (encryption_payload_t *)) encrypt;
-	this->public.decrypt = (status_t (*) (encryption_payload_t *)) decrypt;
-	this->public.set_transforms = (void (*) (encryption_payload_t*,crypter_t*,signer_t*)) set_transforms;
-	this->public.build_signature = (status_t (*) (encryption_payload_t*, chunk_t)) build_signature;
-	this->public.verify_signature = (status_t (*) (encryption_payload_t*, chunk_t)) verify_signature;
-	this->public.destroy = (void (*) (encryption_payload_t *)) destroy;
-
-	/* set default values of the fields */
-	this->critical = FALSE;
-	this->next_payload = NO_PAYLOAD;
-	this->payload_length = ENCRYPTION_PAYLOAD_HEADER_LENGTH;
-	this->encrypted = chunk_empty;
-	this->decrypted = chunk_empty;
-	this->signer = NULL;
-	this->crypter = NULL;
-	this->payloads = linked_list_create();
-
-	return (&(this->public));
+	private_encryption_payload_t *this;
+
+	INIT(this,
+		.public = {
+			.payload_interface = {
+				.verify = _verify,
+				.get_encoding_rules = _get_encoding_rules,
+				.get_length = _get_length,
+				.get_next_type = _get_next_type,
+				.set_next_type = _set_next_type,
+				.get_type = _get_type,
+				.destroy = _destroy,
+			},
+			.get_length = _get_length,
+			.add_payload = _add_payload,
+			.remove_payload = _remove_payload,
+			.set_transform = _set_transform,
+			.encrypt = _encrypt,
+			.decrypt = _decrypt,
+			.destroy = _destroy,
+		},
+		.next_payload = NO_PAYLOAD,
+		.payload_length = ENCRYPTION_PAYLOAD_HEADER_LENGTH,
+		.payloads = linked_list_create(),
+	);
+
+	return &this->public;
 }
diff --git a/src/libcharon/encoding/payloads/encryption_payload.h b/src/libcharon/encoding/payloads/encryption_payload.h
index ac5326b87..e99c42fb7 100644
--- a/src/libcharon/encoding/payloads/encryption_payload.h
+++ b/src/libcharon/encoding/payloads/encryption_payload.h
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2005-2006 Martin Willi
+ * Copyright (C) 2005-2010 Martin Willi
+ * Copyright (C) 2010 revosec AG
  * Copyright (C) 2005 Jan Hutter
  * Hochschule fuer Technik Rapperswil
  *
@@ -25,45 +26,30 @@
 typedef struct encryption_payload_t encryption_payload_t;
 
 #include <library.h>
-#include <crypto/crypters/crypter.h>
-#include <crypto/signers/signer.h>
+#include <crypto/aead.h>
 #include <encoding/payloads/payload.h>
-#include <utils/linked_list.h>
 
 /**
  * Encrpytion payload length in bytes without IV and following data.
  */
 #define ENCRYPTION_PAYLOAD_HEADER_LENGTH 4
 
-
 /**
  * The encryption payload as described in RFC section 3.14.
- *
- * Before any crypt/decrypt/sign/verify operation can occur,
- * the transforms must be set. After that, a parsed encryption payload
- * can be decrypted, which also will parse the contained payloads.
- * Encryption is done the same way, added payloads will get generated
- * and then encrypted.
- * For signature building, there is the FULL packet needed. Meaning it
- * must be builded after generation of all payloads and the encryption
- * of the encryption payload.
- * Signature verificatin is done before decryption.
  */
 struct encryption_payload_t {
+
 	/**
 	 * Implements payload_t interface.
 	 */
 	payload_t payload_interface;
 
 	/**
-	 * Creates an iterator for all contained payloads.
+	 * Get the payload length.
 	 *
-	 * iterator_t object has to get destroyed by the caller.
-	 *
-	 * @param forward 		iterator direction (TRUE: front to end)
-	 * return				created iterator_t object
+	 * @return			(expected) payload length
 	 */
-	 iterator_t *(*create_payload_iterator) (encryption_payload_t *this, bool forward);
+	size_t (*get_length)(encryption_payload_t *this);
 
 	/**
 	 * Adds a payload to this encryption payload.
@@ -73,89 +59,39 @@ struct encryption_payload_t {
 	void (*add_payload) (encryption_payload_t *this, payload_t *payload);
 
 	/**
-	 * Reove the last payload in the contained payload list.
+	 * Remove the first payload in the list
 	 *
 	 * @param payload		removed payload
-	 * @return
-	 * 						- SUCCESS, or
-	 * 						- NOT_FOUND if list empty
-	 */
-	status_t (*remove_first_payload) (encryption_payload_t *this, payload_t **payload);
-
-	/**
-	 * Get the number of payloads.
-	 *
-	 * @return				number of contained payloads
+	 * @return				payload, NULL if none left
 	 */
-	size_t (*get_payload_count) (encryption_payload_t *this);
+	payload_t* (*remove_payload)(encryption_payload_t *this);
 
 	/**
-	 * Set transforms to use.
-	 *
-	 * To decryption, encryption, signature building and verifying,
-	 * the payload needs a crypter and a signer object.
+	 * Set the AEAD transform to use.
 	 *
-	 * @warning Do NOT call this function again after encryption, since
-	 * the signer must be the same while encrypting and signature building!
-	 *
-	 * @param crypter		crypter_t to use for data de-/encryption
-	 * @param signer		signer_t to use for data signing/verifying
+	 * @param aead		aead transform to use
 	 */
-	void (*set_transforms) (encryption_payload_t *this, crypter_t *crypter, signer_t *signer);
+	void (*set_transform) (encryption_payload_t *this, aead_t *aead);
 
 	/**
-	 * Generate and encrypt contained payloads.
-	 *
-	 * This function generates the content for added payloads
-	 * and encrypts them. Signature is not built, since we need
-	 * additional data (the full message).
+	 * Generate, encrypt and sign contained payloads.
 	 *
-	 * @return				SUCCESS, or INVALID_STATE if transforms not set
+	 * @param assoc			associated data
+	 * @return				TRUE if encrypted
 	 */
-	status_t (*encrypt) (encryption_payload_t *this);
+	bool (*encrypt) (encryption_payload_t *this, chunk_t assoc);
 
 	/**
-	 * Decrypt and parse contained payloads.
-	 *
-	 * This function decrypts the contained data. After,
-	 * the payloads are parsed internally and are accessible
-	 * via the iterator.
-	 *
-	 * @return
-	 * 						- SUCCESS, or
-	 * 						- INVALID_STATE if transforms not set, or
-	 * 						- FAILED if data is invalid
-	 */
-	status_t (*decrypt) (encryption_payload_t *this);
-
-	/**
-	 * Build the signature.
-	 *
-	 * The signature is built over the FULL message, so the header
-	 * and every payload (inclusive this one) must already be generated.
-	 * The generated message is supplied via the data paramater.
-	 *
-	 * @param data			chunk contains the already generated message
-	 * @return
-	 * 						- SUCCESS, or
-	 * 						- INVALID_STATE if transforms not set
-	 */
-	status_t (*build_signature) (encryption_payload_t *this, chunk_t data);
-
-	/**
-	 * Verify the signature.
-	 *
-	 * Since the signature is built over the full message, we need
-	 * this data to do the verification. The message data
-	 * is supplied via the data argument.
-	 *
-	 * @param data			chunk contains the message
-	 * @return
-	 * 						- SUCCESS, or
-	 * 						- FAILED if signature invalid, or
-	 * 						- INVALID_STATE if transforms not set
+	 * Decrypt, verify and parse contained payloads.
+	 *
+	 * @param assoc			associated data
+	 * 						- SUCCESS if parsing successful
+	 *						- PARSE_ERROR if sub-payload parsing failed
+	 * 						- VERIFY_ERROR if sub-payload verification failed
+	 * 						- FAILED if integrity check failed
+	 * 						- INVALID_STATE if aead not supplied, but needed
 	 */
-	status_t (*verify_signature) (encryption_payload_t *this, chunk_t data);
+	status_t (*decrypt) (encryption_payload_t *this, chunk_t assoc);
 
 	/**
 	 * Destroys an encryption_payload_t object.
@@ -166,7 +102,7 @@ struct encryption_payload_t {
 /**
  * Creates an empty encryption_payload_t object.
  *
- * @return encryption_payload_t object
+ * @return			encryption_payload_t object
  */
 encryption_payload_t *encryption_payload_create(void);
 
diff --git a/src/libcharon/encoding/payloads/notify_payload.c b/src/libcharon/encoding/payloads/notify_payload.c
index 469698ef5..a56fd1869 100644
--- a/src/libcharon/encoding/payloads/notify_payload.c
+++ b/src/libcharon/encoding/payloads/notify_payload.c
@@ -41,7 +41,7 @@ ENUM_NEXT(notify_type_names, INVALID_KE_PAYLOAD, INVALID_KE_PAYLOAD, NO_PROPOSAL
 	"INVALID_KE_PAYLOAD");
 ENUM_NEXT(notify_type_names, AUTHENTICATION_FAILED, AUTHENTICATION_FAILED, INVALID_KE_PAYLOAD,
 	"AUTHENTICATION_FAILED");
-ENUM_NEXT(notify_type_names, SINGLE_PAIR_REQUIRED, USE_ASSIGNED_HoA, AUTHENTICATION_FAILED,
+ENUM_NEXT(notify_type_names, SINGLE_PAIR_REQUIRED, CHILD_SA_NOT_FOUND, AUTHENTICATION_FAILED,
 	"SINGLE_PAIR_REQUIRED",
 	"NO_ADDITIONAL_SAS",
 	"INTERNAL_ADDRESS_FAILURE",
@@ -50,10 +50,12 @@ ENUM_NEXT(notify_type_names, SINGLE_PAIR_REQUIRED, USE_ASSIGNED_HoA, AUTHENTICAT
 	"INVALID_SELECTORS",
 	"UNACCEPTABLE_ADDRESSES",
 	"UNEXPECTED_NAT_DETECTED",
-	"USE_ASSIGNED_HoA");
-ENUM_NEXT(notify_type_names, ME_CONNECT_FAILED, ME_CONNECT_FAILED, USE_ASSIGNED_HoA,
+	"USE_ASSIGNED_HoA",
+	"TEMPORARY_FAILURE",
+	"CHILD_SA_NOT_FOUND");
+ENUM_NEXT(notify_type_names, ME_CONNECT_FAILED, ME_CONNECT_FAILED, CHILD_SA_NOT_FOUND,
 	"ME_CONNECT_FAILED");
-ENUM_NEXT(notify_type_names, INITIAL_CONTACT, LINK_ID, ME_CONNECT_FAILED,
+ENUM_NEXT(notify_type_names, INITIAL_CONTACT, EAP_ONLY_AUTHENTICATION, ME_CONNECT_FAILED,
 	"INITIAL_CONTACT",
 	"SET_WINDOW_SIZE",
 	"ADDITIONAL_TS_POSSIBLE",
@@ -84,8 +86,9 @@ ENUM_NEXT(notify_type_names, INITIAL_CONTACT, LINK_ID, ME_CONNECT_FAILED,
 	"TICKET_ACK",
 	"TICKET_NACK",
 	"TICKET_OPAQUE",
-	"LINK_ID");
-ENUM_NEXT(notify_type_names, EAP_ONLY_AUTHENTICATION, EAP_ONLY_AUTHENTICATION, LINK_ID,
+	"LINK_ID",
+	"USE_WESP_MODE",
+	"ROHC_SUPPORTED",
 	"EAP_ONLY_AUTHENTICATION");
 ENUM_NEXT(notify_type_names, USE_BEET_MODE, USE_BEET_MODE, EAP_ONLY_AUTHENTICATION,
 	"USE_BEET_MODE");
@@ -117,7 +120,7 @@ ENUM_NEXT(notify_type_short_names, INVALID_KE_PAYLOAD, INVALID_KE_PAYLOAD, NO_PR
 	"INVAL_KE");
 ENUM_NEXT(notify_type_short_names, AUTHENTICATION_FAILED, AUTHENTICATION_FAILED, INVALID_KE_PAYLOAD,
 	"AUTH_FAILED");
-ENUM_NEXT(notify_type_short_names, SINGLE_PAIR_REQUIRED, USE_ASSIGNED_HoA, AUTHENTICATION_FAILED,
+ENUM_NEXT(notify_type_short_names, SINGLE_PAIR_REQUIRED, CHILD_SA_NOT_FOUND, AUTHENTICATION_FAILED,
 	"SINGLE_PAIR",
 	"NO_ADD_SAS",
 	"INT_ADDR_FAIL",
@@ -126,10 +129,12 @@ ENUM_NEXT(notify_type_short_names, SINGLE_PAIR_REQUIRED, USE_ASSIGNED_HoA, AUTHE
 	"INVAL_SEL",
 	"UNACCEPT_ADDR",
 	"UNEXPECT_NAT",
-	"ASSIGNED_HoA");
-ENUM_NEXT(notify_type_short_names, ME_CONNECT_FAILED, ME_CONNECT_FAILED, USE_ASSIGNED_HoA,
+	"ASSIGNED_HoA",
+	"TEMP_FAIL",
+	"NO_CHILD_SA");
+ENUM_NEXT(notify_type_short_names, ME_CONNECT_FAILED, ME_CONNECT_FAILED, CHILD_SA_NOT_FOUND,
 	"ME_CONN_FAIL");
-ENUM_NEXT(notify_type_short_names, INITIAL_CONTACT, LINK_ID, ME_CONNECT_FAILED,
+ENUM_NEXT(notify_type_short_names, INITIAL_CONTACT, EAP_ONLY_AUTHENTICATION, ME_CONNECT_FAILED,
 	"INIT_CONTACT",
 	"SET_WINSIZE",
 	"ADD_TS_POSS",
@@ -160,8 +165,9 @@ ENUM_NEXT(notify_type_short_names, INITIAL_CONTACT, LINK_ID, ME_CONNECT_FAILED,
 	"TKT_ACK",
 	"TKT_NACK",
 	"TKT_OPAK",
-	"LINK_ID");
-ENUM_NEXT(notify_type_short_names, EAP_ONLY_AUTHENTICATION, EAP_ONLY_AUTHENTICATION, LINK_ID,
+	"LINK_ID",
+	"WESP_MODE",
+	"ROHC_SUP",
 	"EAP_ONLY");
 ENUM_NEXT(notify_type_short_names, USE_BEET_MODE, USE_BEET_MODE, EAP_ONLY_AUTHENTICATION,
 	"BEET_MODE");
@@ -238,29 +244,29 @@ struct private_notify_payload_t {
  */
 encoding_rule_t notify_payload_encodings[] = {
 	/* 1 Byte next payload type, stored in the field next_payload */
-	{ U_INT_8,			offsetof(private_notify_payload_t, next_payload) 		},
+	{ U_INT_8,			offsetof(private_notify_payload_t, next_payload)		},
 	/* the critical bit */
-	{ FLAG,				offsetof(private_notify_payload_t, critical) 			},
+	{ FLAG,				offsetof(private_notify_payload_t, critical)			},
 	/* 7 Bit reserved bits, nowhere stored */
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
+	{ RESERVED_BIT,	0														},
+	{ RESERVED_BIT,	0														},
+	{ RESERVED_BIT,	0														},
+	{ RESERVED_BIT,	0														},
+	{ RESERVED_BIT,	0														},
+	{ RESERVED_BIT,	0														},
+	{ RESERVED_BIT,	0														},
 	/* Length of the whole payload*/
-	{ PAYLOAD_LENGTH,	offsetof(private_notify_payload_t, payload_length) 		},
+	{ PAYLOAD_LENGTH,	offsetof(private_notify_payload_t, payload_length)		},
 	/* Protocol ID as 8 bit field*/
-	{ U_INT_8,			offsetof(private_notify_payload_t, protocol_id) 			},
+	{ U_INT_8,			offsetof(private_notify_payload_t, protocol_id)			},
 	/* SPI Size as 8 bit field*/
-	{ SPI_SIZE,			offsetof(private_notify_payload_t, spi_size) 			},
+	{ SPI_SIZE,			offsetof(private_notify_payload_t, spi_size)			},
 	/* Notify message type as 16 bit field*/
 	{ U_INT_16,			offsetof(private_notify_payload_t, notify_type)	},
 	/* SPI as variable length field*/
 	{ SPI,				offsetof(private_notify_payload_t, spi)					},
 	/* Key Exchange Data is from variable size */
-	{ NOTIFICATION_DATA,	offsetof(private_notify_payload_t, notification_data) 	}
+	{ NOTIFICATION_DATA,	offsetof(private_notify_payload_t, notification_data)	}
 };
 
 /*
diff --git a/src/libcharon/encoding/payloads/notify_payload.h b/src/libcharon/encoding/payloads/notify_payload.h
index 0e1bc23b8..8abc236e1 100644
--- a/src/libcharon/encoding/payloads/notify_payload.h
+++ b/src/libcharon/encoding/payloads/notify_payload.h
@@ -64,6 +64,9 @@ enum notify_type_t {
 	UNEXPECTED_NAT_DETECTED = 41,
 	/* mobile IPv6 bootstrapping, RFC 5026 */
 	USE_ASSIGNED_HoA = 42,
+	/* IKEv2 RFC 5996 */
+	TEMPORARY_FAILURE = 43,
+	CHILD_SA_NOT_FOUND = 44,
 
 	/* IKE-ME, private use */
 	ME_CONNECT_FAILED = 8192,
@@ -98,16 +101,21 @@ enum notify_type_t {
 	REDIRECT_SUPPORTED = 16406,
 	REDIRECT = 16407,
 	REDIRECTED_FROM = 16408,
-	/* draft-ietf-ipsecme-ikev2-resumption, assigned by IANA */
+	/* session resumption, RFC 5723 */
 	TICKET_LT_OPAQUE = 16409,
 	TICKET_REQUEST = 16410,
 	TICKET_ACK = 16411,
 	TICKET_NACK = 16412,
 	TICKET_OPAQUE = 16413,
+	/* IPv6 configuration, RFC 5739 */
 	LINK_ID = 16414,
+	/* wrapped esp, RFC 5840 */
+	USE_WESP_MODE = 16415,
+	/* robust header compression, RFC 5857 */
+	ROHC_SUPPORTED = 16416,
+	/* EAP-only authentication, RFC 5998 */
+	EAP_ONLY_AUTHENTICATION = 16417,
 
-	/* draft-eronen-ipsec-ikev2-eap-auth, not assigned by IANA yet */
-	EAP_ONLY_AUTHENTICATION = 40960,
 	/* BEET mode, not even a draft yet. private use */
 	USE_BEET_MODE = 40961,
 	/* IKE-ME, private use */
@@ -144,7 +152,7 @@ struct notify_payload_t {
 	/**
 	 * Gets the protocol id of this payload.
 	 *
-	 * @return 			protocol id of this payload
+	 * @return			protocol id of this payload
 	 */
 	u_int8_t (*get_protocol_id) (notify_payload_t *this);
 
@@ -158,7 +166,7 @@ struct notify_payload_t {
 	/**
 	 * Gets the notify message type of this payload.
 	 *
-	 * @return 			notify message type of this payload
+	 * @return			notify message type of this payload
 	 */
 	notify_type_t (*get_notify_type) (notify_payload_t *this);
 
@@ -174,7 +182,7 @@ struct notify_payload_t {
 	 *
 	 * This is only valid for notifys with protocol AH|ESP
 	 *
-	 * @return 		SPI value
+	 * @return		SPI value
 	 */
 	u_int32_t (*get_spi) (notify_payload_t *this);
 
@@ -192,7 +200,7 @@ struct notify_payload_t {
 	 *
 	 * Returned data are not copied.
 	 *
-	 * @return 		chunk_t pointing to the value
+	 * @return		chunk_t pointing to the value
 	 */
 	chunk_t (*get_notification_data) (notify_payload_t *this);
 
@@ -201,7 +209,7 @@ struct notify_payload_t {
 	 *
 	 * @warning Value is getting copied.
 	 *
-	 * @param notification_data 	chunk_t pointing to the value to set
+	 * @param notification_data	chunk_t pointing to the value to set
 	 */
 	void (*set_notification_data) (notify_payload_t *this,
 								   chunk_t notification_data);
diff --git a/src/libcharon/encoding/payloads/proposal_substructure.c b/src/libcharon/encoding/payloads/proposal_substructure.c
index c93f73a68..985b03255 100644
--- a/src/libcharon/encoding/payloads/proposal_substructure.c
+++ b/src/libcharon/encoding/payloads/proposal_substructure.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005-2006 Martin Willi
+ * Copyright (C) 2005-2010 Martin Willi
  * Copyright (C) 2005 Jan Hutter
  * Hochschule fuer Technik Rapperswil
  *
@@ -24,20 +24,18 @@
 #include <utils/linked_list.h>
 #include <daemon.h>
 
-
 /**
  * IKEv1 Value for a proposal payload.
  */
 #define PROPOSAL_TYPE_VALUE 2
 
-
 typedef struct private_proposal_substructure_t private_proposal_substructure_t;
 
 /**
  * Private data of an proposal_substructure_t object.
- *
  */
 struct private_proposal_substructure_t {
+
 	/**
 	 * Public proposal_substructure_t interface.
 	 */
@@ -92,24 +90,24 @@ struct private_proposal_substructure_t {
  */
 encoding_rule_t proposal_substructure_encodings[] = {
 	/* 1 Byte next payload type, stored in the field next_payload */
-	{ U_INT_8,			offsetof(private_proposal_substructure_t, next_payload) 		},
+	{ U_INT_8,			offsetof(private_proposal_substructure_t, next_payload)		},
 	/* Reserved Byte is skipped */
-	{ RESERVED_BYTE,		0															},
+	{ RESERVED_BYTE,	0															},
 	/* Length of the whole proposal substructure payload*/
-	{ PAYLOAD_LENGTH,		offsetof(private_proposal_substructure_t, proposal_length) 	},
+	{ PAYLOAD_LENGTH,	offsetof(private_proposal_substructure_t, proposal_length)	},
 	/* proposal number is a number of 8 bit */
-	{ U_INT_8,				offsetof(private_proposal_substructure_t, proposal_number) 	},
+	{ U_INT_8,			offsetof(private_proposal_substructure_t, proposal_number)	},
 	/* protocol ID is a number of 8 bit */
-	{ U_INT_8,				offsetof(private_proposal_substructure_t, protocol_id)		},
+	{ U_INT_8,			offsetof(private_proposal_substructure_t, protocol_id)		},
 	/* SPI Size has its own type */
-	{ SPI_SIZE,				offsetof(private_proposal_substructure_t, spi_size)			},
+	{ SPI_SIZE,			offsetof(private_proposal_substructure_t, spi_size)			},
 	/* Number of transforms is a number of 8 bit */
-	{ U_INT_8,				offsetof(private_proposal_substructure_t, transforms_count)	},
+	{ U_INT_8,			offsetof(private_proposal_substructure_t, transforms_count)	},
 	/* SPI is a chunk of variable size*/
-	{ SPI,					offsetof(private_proposal_substructure_t, spi)				},
+	{ SPI,				offsetof(private_proposal_substructure_t, spi)				},
 	/* Transforms are stored in a transform substructure,
 	   offset points to a linked_list_t pointer */
-	{ TRANSFORMS,			offsetof(private_proposal_substructure_t, transforms) 		}
+	{ TRANSFORMS,		offsetof(private_proposal_substructure_t, transforms)		}
 };
 
 /*
@@ -128,16 +126,14 @@ encoding_rule_t proposal_substructure_encodings[] = {
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 */
 
-/**
- * Implementation of payload_t.verify.
- */
-static status_t verify(private_proposal_substructure_t *this)
+METHOD(payload_t, verify, status_t,
+	private_proposal_substructure_t *this)
 {
 	status_t status = SUCCESS;
-	iterator_t *iterator;
-	payload_t *current_transform;
+	enumerator_t *enumerator;
+	payload_t *current;
 
-	if ((this->next_payload != NO_PAYLOAD) && (this->next_payload != 2))
+	if (this->next_payload != NO_PAYLOAD && this->next_payload != 2)
 	{
 		/* must be 0 or 2 */
 		DBG1(DBG_ENC, "inconsistent next payload");
@@ -169,61 +165,46 @@ static status_t verify(private_proposal_substructure_t *this)
 			}
 			break;
 		default:
-			DBG1(DBG_ENC, "invalid proposal protocol (%d)", this->protocol_id);
-			return FAILED;
-	}
-	if ((this->protocol_id == 0) || (this->protocol_id >= 4))
-	{
-		/* reserved are not supported */
-		DBG1(DBG_ENC, "invalid protocol");
-		return FAILED;
+			break;
 	}
-
-	iterator = this->transforms->create_iterator(this->transforms,TRUE);
-	while(iterator->iterate(iterator, (void**)&current_transform))
+	enumerator = this->transforms->create_enumerator(this->transforms);
+	while (enumerator->enumerate(enumerator, &current))
 	{
-		status = current_transform->verify(current_transform);
+		status = current->verify(current);
 		if (status != SUCCESS)
 		{
 			DBG1(DBG_ENC, "TRANSFORM_SUBSTRUCTURE verification failed");
 			break;
 		}
 	}
-	iterator->destroy(iterator);
+	enumerator->destroy(enumerator);
 
 	/* proposal number is checked in SA payload */
 	return status;
 }
 
-/**
- * Implementation of payload_t.get_encoding_rules.
- */
-static void get_encoding_rules(private_proposal_substructure_t *this, encoding_rule_t **rules, size_t *rule_count)
+METHOD(payload_t, get_encoding_rules, void,
+	private_proposal_substructure_t *this, encoding_rule_t **rules,
+	size_t *rule_count)
 {
 	*rules = proposal_substructure_encodings;
-	*rule_count = sizeof(proposal_substructure_encodings) / sizeof(encoding_rule_t);
+	*rule_count = countof(proposal_substructure_encodings);
 }
 
-/**
- * Implementation of payload_t.get_type.
- */
-static payload_type_t get_type(private_proposal_substructure_t *this)
+METHOD(payload_t, get_type, payload_type_t,
+	private_proposal_substructure_t *this)
 {
 	return PROPOSAL_SUBSTRUCTURE;
 }
 
-/**
- * Implementation of payload_t.get_next_type.
- */
-static payload_type_t get_next_type(private_proposal_substructure_t *this)
+METHOD(payload_t, get_next_type, payload_type_t,
+	private_proposal_substructure_t *this)
 {
-	return (this->next_payload);
+	return this->next_payload;
 }
 
-/**
- * Implementation of payload_t.set_next_type.
- */
-static void set_next_type(private_proposal_substructure_t *this,payload_type_t type)
+METHOD(payload_t, set_next_type, void,
+	private_proposal_substructure_t *this, payload_type_t type)
 {
 }
 
@@ -250,145 +231,88 @@ static void compute_length(private_proposal_substructure_t *this)
 	this->proposal_length = length;
 }
 
-/**
- * Implementation of payload_t.get_length.
- */
-static size_t get_length(private_proposal_substructure_t *this)
+METHOD(payload_t, get_length, size_t,
+	private_proposal_substructure_t *this)
 {
 	compute_length(this);
 	return this->proposal_length;
 }
 
 /**
- * Implementation of proposal_substructure_t.create_transform_substructure_iterator.
- */
-static iterator_t *create_transform_substructure_iterator (private_proposal_substructure_t *this,bool forward)
-{
-	return (this->transforms->create_iterator(this->transforms,forward));
-}
-
-/**
- * Implementation of proposal_substructure_t.add_transform_substructure.
+ * Add a transform substructure to the proposal
  */
-static void add_transform_substructure (private_proposal_substructure_t *this,transform_substructure_t *transform)
+static void add_transform_substructure(private_proposal_substructure_t *this,
+									   transform_substructure_t *transform)
 {
-	status_t status;
 	if (this->transforms->get_count(this->transforms) > 0)
 	{
-		transform_substructure_t *last_transform;
-		status = this->transforms->get_last(this->transforms,(void **) &last_transform);
-		/* last transform is now not anymore last one */
-		last_transform->set_is_last_transform(last_transform,FALSE);
+		transform_substructure_t *last;
 
+		this->transforms->get_last(this->transforms, (void **)&last);
+		last->set_is_last_transform(last, FALSE);
 	}
 	transform->set_is_last_transform(transform,TRUE);
-
-	this->transforms->insert_last(this->transforms,(void *) transform);
+	this->transforms->insert_last(this->transforms, transform);
 	compute_length(this);
 }
 
-/**
- * Implementation of proposal_substructure_t.proposal_substructure_t.
- */
-static void set_is_last_proposal (private_proposal_substructure_t *this, bool is_last)
+METHOD(proposal_substructure_t, set_is_last_proposal, void,
+	private_proposal_substructure_t *this, bool is_last)
 {
-	this->next_payload = (is_last) ? 0: PROPOSAL_TYPE_VALUE;
+	this->next_payload = is_last ? 0 : PROPOSAL_TYPE_VALUE;
 }
 
-/**
- * Implementation of proposal_substructure_t.set_proposal_number.
- */
-static void set_proposal_number(private_proposal_substructure_t *this,u_int8_t proposal_number)
+METHOD(proposal_substructure_t, set_proposal_number, void,
+	private_proposal_substructure_t *this,u_int8_t proposal_number)
 {
 	this->proposal_number = proposal_number;
 }
 
-/**
- * Implementation of proposal_substructure_t.get_proposal_number.
- */
-static u_int8_t get_proposal_number (private_proposal_substructure_t *this)
+METHOD(proposal_substructure_t, get_proposal_number, u_int8_t,
+	private_proposal_substructure_t *this)
 {
-	return (this->proposal_number);
+	return this->proposal_number;
 }
 
-/**
- * Implementation of proposal_substructure_t.set_protocol_id.
- */
-static void set_protocol_id(private_proposal_substructure_t *this,u_int8_t protocol_id)
+METHOD(proposal_substructure_t, set_protocol_id, void,
+	private_proposal_substructure_t *this,u_int8_t protocol_id)
 {
 	this->protocol_id = protocol_id;
 }
 
-/**
- * Implementation of proposal_substructure_t.get_protocol_id.
- */
-static u_int8_t get_protocol_id(private_proposal_substructure_t *this)
+METHOD(proposal_substructure_t, get_protocol_id, u_int8_t,
+	private_proposal_substructure_t *this)
 {
-	return (this->protocol_id);
+	return this->protocol_id;
 }
 
-/**
- * Implementation of proposal_substructure_t.set_spi.
- */
-static void set_spi(private_proposal_substructure_t *this, chunk_t spi)
+METHOD(proposal_substructure_t, set_spi, void,
+	private_proposal_substructure_t *this, chunk_t spi)
 {
-	/* first delete already set spi value */
-	if (this->spi.ptr != NULL)
-	{
-		free(this->spi.ptr);
-		this->spi.ptr = NULL;
-		this->spi.len = 0;
-		compute_length(this);
-	}
-
-	this->spi.ptr = clalloc(spi.ptr,spi.len);
-	this->spi.len = spi.len;
+	free(this->spi.ptr);
+	this->spi = chunk_clone(spi);
 	this->spi_size = spi.len;
 	compute_length(this);
 }
 
-/**
- * Implementation of proposal_substructure_t.get_spi.
- */
-static chunk_t get_spi(private_proposal_substructure_t *this)
-{
-	chunk_t spi;
-	spi.ptr = this->spi.ptr;
-	spi.len = this->spi.len;
-
-	return spi;
-}
-
-/**
- * Implementation of proposal_substructure_t.get_transform_count.
- */
-static size_t get_transform_count (private_proposal_substructure_t *this)
-{
-	return this->transforms->get_count(this->transforms);
-}
-
-/**
- * Implementation of proposal_substructure_t.get_spi_size.
- */
-static size_t get_spi_size (private_proposal_substructure_t *this)
+METHOD(proposal_substructure_t, get_spi, chunk_t,
+	private_proposal_substructure_t *this)
 {
-	return this->spi.len;
+	return this->spi;
 }
 
-/**
- * Implementation of proposal_substructure_t.get_proposal.
- */
-proposal_t* get_proposal(private_proposal_substructure_t *this)
+METHOD(proposal_substructure_t, get_proposal, proposal_t*,
+	private_proposal_substructure_t *this)
 {
-	iterator_t *iterator;
+	enumerator_t *enumerator;
 	transform_substructure_t *transform;
 	proposal_t *proposal;
 	u_int64_t spi;
 
-	proposal = proposal_create(this->protocol_id);
+	proposal = proposal_create(this->protocol_id, this->proposal_number);
 
-	iterator = this->transforms->create_iterator(this->transforms, TRUE);
-	while (iterator->iterate(iterator, (void**)&transform))
+	enumerator = this->transforms->create_enumerator(this->transforms);
+	while (enumerator->enumerate(enumerator, &transform))
 	{
 		transform_type_t transform_type;
 		u_int16_t transform_id;
@@ -400,7 +324,7 @@ proposal_t* get_proposal(private_proposal_substructure_t *this)
 
 		proposal->add_algorithm(proposal, transform_type, transform_id, key_length);
 	}
-	iterator->destroy(iterator);
+	enumerator->destroy(enumerator);
 
 	switch (this->spi.len)
 	{
@@ -418,42 +342,36 @@ proposal_t* get_proposal(private_proposal_substructure_t *this)
 	return proposal;
 }
 
-/**
- * Implementation of proposal_substructure_t.clone.
- */
-static private_proposal_substructure_t* clone_(private_proposal_substructure_t *this)
+METHOD(proposal_substructure_t, clone_, proposal_substructure_t*,
+	private_proposal_substructure_t *this)
 {
 	private_proposal_substructure_t *clone;
-	iterator_t *transforms;
-	transform_substructure_t *current_transform;
+	enumerator_t *enumerator;
+	transform_substructure_t *current;
 
-	clone = (private_proposal_substructure_t *) proposal_substructure_create();
+	clone = (private_proposal_substructure_t*)proposal_substructure_create();
 	clone->next_payload = this->next_payload;
 	clone->proposal_number = this->proposal_number;
 	clone->protocol_id = this->protocol_id;
 	clone->spi_size = this->spi_size;
 	if (this->spi.ptr != NULL)
 	{
-		clone->spi.ptr = clalloc(this->spi.ptr,this->spi.len);
+		clone->spi.ptr = clalloc(this->spi.ptr, this->spi.len);
 		clone->spi.len = this->spi.len;
 	}
-
-	transforms = this->transforms->create_iterator(this->transforms,FALSE);
-	while (transforms->iterate(transforms, (void**)&current_transform))
+	enumerator = this->transforms->create_enumerator(this->transforms);
+	while (enumerator->enumerate(enumerator, &current))
 	{
-		current_transform = current_transform->clone(current_transform);
-		clone->public.add_transform_substructure(&clone->public, current_transform);
+		current = current->clone(current);
+		add_transform_substructure(clone, current);
 	}
-	transforms->destroy(transforms);
+	enumerator->destroy(enumerator);
 
-	return clone;
+	return &clone->public;
 }
 
-/**
- * Implements payload_t's and proposal_substructure_t's destroy function.
- * See #payload_s.destroy or proposal_substructure_s.destroy for description.
- */
-static void destroy(private_proposal_substructure_t *this)
+METHOD2(payload_t, proposal_substructure_t, destroy, void,
+	private_proposal_substructure_t *this)
 {
 	this->transforms->destroy_offset(this->transforms,
 									 offsetof(transform_substructure_t, destroy));
@@ -466,53 +384,42 @@ static void destroy(private_proposal_substructure_t *this)
  */
 proposal_substructure_t *proposal_substructure_create()
 {
-	private_proposal_substructure_t *this = malloc_thing(private_proposal_substructure_t);
-
-	/* interface functions */
-	this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
-	this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
-	this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length;
-	this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type;
-	this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
-	this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_type;
-	this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
-
-	/* public functions */
-	this->public.create_transform_substructure_iterator = (iterator_t* (*) (proposal_substructure_t *,bool)) create_transform_substructure_iterator;
-	this->public.add_transform_substructure = (void (*) (proposal_substructure_t *,transform_substructure_t *)) add_transform_substructure;
-	this->public.set_proposal_number = (void (*) (proposal_substructure_t *,u_int8_t))set_proposal_number;
-	this->public.get_proposal_number = (u_int8_t (*) (proposal_substructure_t *)) get_proposal_number;
-	this->public.set_protocol_id = (void (*) (proposal_substructure_t *,u_int8_t))set_protocol_id;
-	this->public.get_protocol_id = (u_int8_t (*) (proposal_substructure_t *)) get_protocol_id;
-	this->public.set_is_last_proposal = (void (*) (proposal_substructure_t *,bool)) set_is_last_proposal;
-	this->public.get_proposal = (proposal_t* (*) (proposal_substructure_t*))get_proposal;
-	this->public.set_spi = (void (*) (proposal_substructure_t *,chunk_t))set_spi;
-	this->public.get_spi = (chunk_t (*) (proposal_substructure_t *)) get_spi;
-	this->public.get_transform_count = (size_t (*) (proposal_substructure_t *)) get_transform_count;
-	this->public.get_spi_size = (size_t (*) (proposal_substructure_t *)) get_spi_size;
-	this->public.clone = (proposal_substructure_t * (*) (proposal_substructure_t *)) clone_;
-	this->public.destroy = (void (*) (proposal_substructure_t *)) destroy;
-
-	/* set default values of the fields */
-	this->next_payload = NO_PAYLOAD;
-	this->proposal_length = 0;
-	this->proposal_number = 0;
-	this->protocol_id = 0;
-	this->transforms_count = 0;
-	this->spi_size = 0;
-	this->spi.ptr = NULL;
-	this->spi.len = 0;
-
-	this->transforms = linked_list_create();
-
-	return (&(this->public));
+	private_proposal_substructure_t *this;
+
+	INIT(this,
+		.public = {
+			.payload_interface = {
+				.verify = _verify,
+				.get_encoding_rules = _get_encoding_rules,
+				.get_length = _get_length,
+				.get_next_type = _get_next_type,
+				.set_next_type = _set_next_type,
+				.get_type = _get_type,
+				.destroy = _destroy,
+			},
+			.set_proposal_number = _set_proposal_number,
+			.get_proposal_number = _get_proposal_number,
+			.set_protocol_id = _set_protocol_id,
+			.get_protocol_id = _get_protocol_id,
+			.set_is_last_proposal = _set_is_last_proposal,
+			.get_proposal = _get_proposal,
+			.set_spi = _set_spi,
+			.get_spi = _get_spi,
+			.clone = _clone_,
+			.destroy = _destroy,
+		},
+		.next_payload = NO_PAYLOAD,
+		.transforms = linked_list_create(),
+	);
+
+	return &this->public;
 }
 
 /*
  * Described in header.
  */
-proposal_substructure_t *proposal_substructure_create_from_proposal(proposal_t *proposal)
+proposal_substructure_t *proposal_substructure_create_from_proposal(
+														proposal_t *proposal)
 {
 	transform_substructure_t *transform;
 	private_proposal_substructure_t *this;
@@ -591,7 +498,7 @@ proposal_substructure_t *proposal_substructure_create_from_proposal(proposal_t *
 		default:
 			break;
 	}
-	this->proposal_number = 0;
+	this->proposal_number = proposal->get_number(proposal);
 	this->protocol_id = proposal->get_protocol(proposal);
 
 	return &this->public;
diff --git a/src/libcharon/encoding/payloads/proposal_substructure.h b/src/libcharon/encoding/payloads/proposal_substructure.h
index 4934802af..56e7184b6 100644
--- a/src/libcharon/encoding/payloads/proposal_substructure.h
+++ b/src/libcharon/encoding/payloads/proposal_substructure.h
@@ -42,36 +42,19 @@ typedef struct proposal_substructure_t proposal_substructure_t;
  * The PROPOSAL SUBSTRUCTURE format is described in RFC section 3.3.1.
  */
 struct proposal_substructure_t {
+
 	/**
 	 * The payload_t interface.
 	 */
 	payload_t payload_interface;
 
 	/**
-	 * Creates an iterator of stored transform_substructure_t objects.
-	 *
-	 * @param forward		iterator direction (TRUE: front to end)
-	 * @return				created iterator_t object
-	 */
-	iterator_t *(*create_transform_substructure_iterator) (
-								proposal_substructure_t *this, bool forward);
-
-	/**
-	 * Adds a transform_substructure_t object to this object.
-	 *
-	 * @param transform 	transform_substructure_t object to add
-	 */
-	void (*add_transform_substructure) (proposal_substructure_t *this,
-										transform_substructure_t *transform);
-
-	/**
 	 * Sets the proposal number of current proposal.
 	 *
 	 * @param id			proposal number to set
 	 */
 	void (*set_proposal_number) (proposal_substructure_t *this,
 								 u_int8_t proposal_number);
-
 	/**
 	 * get proposal number of current proposal.
 	 *
@@ -80,20 +63,6 @@ struct proposal_substructure_t {
 	u_int8_t (*get_proposal_number) (proposal_substructure_t *this);
 
 	/**
-	 * get the number of transforms in current proposal.
-	 *
-	 * @return 			transform count in current proposal
-	 */
-	size_t (*get_transform_count) (proposal_substructure_t *this);
-
-	/**
-	 * get size of the set spi in bytes.
-	 *
-	 * @return 			size of the spi in bytes
-	 */
-	size_t (*get_spi_size) (proposal_substructure_t *this);
-
-	/**
 	 * Sets the protocol id of current proposal.
 	 *
 	 * @param id		protocol id to set
diff --git a/src/libcharon/encoding/payloads/sa_payload.c b/src/libcharon/encoding/payloads/sa_payload.c
index 187a8fee0..4fbd4cac0 100644
--- a/src/libcharon/encoding/payloads/sa_payload.c
+++ b/src/libcharon/encoding/payloads/sa_payload.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005-2006 Martin Willi
+ * Copyright (C) 2005-2010 Martin Willi
  * Copyright (C) 2005 Jan Hutter
  * Hochschule fuer Technik Rapperswil
  *
@@ -27,9 +27,9 @@ typedef struct private_sa_payload_t private_sa_payload_t;
 
 /**
  * Private data of an sa_payload_t object.
- *
  */
 struct private_sa_payload_t {
+
 	/**
 	 * Public sa_payload_t interface.
 	 */
@@ -61,26 +61,25 @@ struct private_sa_payload_t {
  *
  * The defined offsets are the positions in a object of type
  * private_sa_payload_t.
- *
  */
 encoding_rule_t sa_payload_encodings[] = {
 	/* 1 Byte next payload type, stored in the field next_payload */
-	{ U_INT_8,		offsetof(private_sa_payload_t, next_payload) 			},
+	{ U_INT_8,			offsetof(private_sa_payload_t, next_payload)		},
 	/* the critical bit */
-	{ FLAG,			offsetof(private_sa_payload_t, critical) 				},
+	{ FLAG,				offsetof(private_sa_payload_t, critical)			},
 	/* 7 Bit reserved bits, nowhere stored */
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
-	{ RESERVED_BIT,	0 														},
+	{ RESERVED_BIT,		0													},
+	{ RESERVED_BIT,		0													},
+	{ RESERVED_BIT,		0													},
+	{ RESERVED_BIT,		0													},
+	{ RESERVED_BIT,		0													},
+	{ RESERVED_BIT,		0													},
+	{ RESERVED_BIT,		0													},
 	/* Length of the whole SA payload*/
-	{ PAYLOAD_LENGTH,		offsetof(private_sa_payload_t, payload_length) 	},
+	{ PAYLOAD_LENGTH,	offsetof(private_sa_payload_t, payload_length)		},
 	/* Proposals are stored in a proposal substructure,
 	   offset points to a linked_list_t pointer */
-	{ PROPOSALS,		offsetof(private_sa_payload_t, proposals) 				}
+	{ PROPOSALS,		offsetof(private_sa_payload_t, proposals)			},
 };
 
 /*
@@ -95,26 +94,23 @@ encoding_rule_t sa_payload_encodings[] = {
       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 */
 
-/**
- * Implementation of payload_t.verify.
- */
-static status_t verify(private_sa_payload_t *this)
+METHOD(payload_t, verify, status_t,
+	private_sa_payload_t *this)
 {
 	int expected_number = 1, current_number;
 	status_t status = SUCCESS;
-	iterator_t *iterator;
-	proposal_substructure_t *current_proposal;
+	enumerator_t *enumerator;
+	proposal_substructure_t *substruct;
 	bool first = TRUE;
 
 	/* check proposal numbering */
-	iterator = this->proposals->create_iterator(this->proposals,TRUE);
-
-	while(iterator->iterate(iterator, (void**)&current_proposal))
+	enumerator = this->proposals->create_enumerator(this->proposals);
+	while (enumerator->enumerate(enumerator, (void**)&substruct))
 	{
-		current_number = current_proposal->get_proposal_number(current_proposal);
+		current_number = substruct->get_proposal_number(substruct);
 		if (current_number < expected_number)
 		{
-			if (current_number != (expected_number + 1))
+			if (current_number != expected_number + 1)
 			{
 				DBG1(DBG_ENC, "proposal number is %d, expected %d or %d",
 					 current_number, expected_number, expected_number + 1);
@@ -124,13 +120,12 @@ static status_t verify(private_sa_payload_t *this)
 		}
 		else if (current_number < expected_number)
 		{
-			/* must not be smaller then proceeding one */
-			DBG1(DBG_ENC, "proposal number smaller than that of previous proposal");
+			DBG1(DBG_ENC, "proposal number smaller than previous");
 			status = FAILED;
 			break;
 		}
 
-		status = current_proposal->payload_interface.verify(&(current_proposal->payload_interface));
+		status = substruct->payload_interface.verify(&substruct->payload_interface);
 		if (status != SUCCESS)
 		{
 			DBG1(DBG_ENC, "PROPOSAL_SUBSTRUCTURE verification failed");
@@ -139,52 +134,31 @@ static status_t verify(private_sa_payload_t *this)
 		first = FALSE;
 		expected_number = current_number;
 	}
-
-	iterator->destroy(iterator);
+	enumerator->destroy(enumerator);
 	return status;
 }
 
-
-/**
- * Implementation of payload_t.destroy and sa_payload_t.destroy.
- */
-static status_t destroy(private_sa_payload_t *this)
-{
-	this->proposals->destroy_offset(this->proposals,
-									offsetof(proposal_substructure_t, destroy));
-	free(this);
-	return SUCCESS;
-}
-
-/**
- * Implementation of payload_t.get_encoding_rules.
- */
-static void get_encoding_rules(private_sa_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
+METHOD(payload_t, get_encoding_rules, void,
+	private_sa_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
 {
 	*rules = sa_payload_encodings;
-	*rule_count = sizeof(sa_payload_encodings) / sizeof(encoding_rule_t);
+	*rule_count = countof(sa_payload_encodings);
 }
 
-/**
- * Implementation of payload_t.get_type.
- */
-static payload_type_t get_type(private_sa_payload_t *this)
+METHOD(payload_t, get_type, payload_type_t,
+	private_sa_payload_t *this)
 {
 	return SECURITY_ASSOCIATION;
 }
 
-/**
- * Implementation of payload_t.get_next_type.
- */
-static payload_type_t get_next_type(private_sa_payload_t *this)
+METHOD(payload_t, get_next_type, payload_type_t,
+	private_sa_payload_t *this)
 {
-	return (this->next_payload);
+	return this->next_payload;
 }
 
-/**
- * Implementation of payload_t.set_next_type.
- */
-static void set_next_type(private_sa_payload_t *this,payload_type_t type)
+METHOD(payload_t, set_next_type, void,
+	private_sa_payload_t *this,payload_type_t type)
 {
 	this->next_payload = type;
 }
@@ -192,116 +166,104 @@ static void set_next_type(private_sa_payload_t *this,payload_type_t type)
 /**
  * recompute length of the payload.
  */
-static void compute_length (private_sa_payload_t *this)
+static void compute_length(private_sa_payload_t *this)
 {
-	iterator_t *iterator;
-	payload_t *current_proposal;
+	enumerator_t *enumerator;
+	payload_t *current;
 	size_t length = SA_PAYLOAD_HEADER_LENGTH;
 
-	iterator = this->proposals->create_iterator(this->proposals,TRUE);
-	while (iterator->iterate(iterator, (void **)&current_proposal))
+	enumerator = this->proposals->create_enumerator(this->proposals);
+	while (enumerator->enumerate(enumerator, (void **)&current))
 	{
-		length += current_proposal->get_length(current_proposal);
+		length += current->get_length(current);
 	}
-	iterator->destroy(iterator);
+	enumerator->destroy(enumerator);
 
 	this->payload_length = length;
 }
 
-/**
- * Implementation of payload_t.get_length.
- */
-static size_t get_length(private_sa_payload_t *this)
+METHOD(payload_t, get_length, size_t,
+	private_sa_payload_t *this)
 {
 	compute_length(this);
 	return this->payload_length;
 }
 
-/**
- * Implementation of sa_payload_t.create_proposal_substructure_iterator.
- */
-static iterator_t *create_proposal_substructure_iterator (private_sa_payload_t *this,bool forward)
+METHOD(sa_payload_t, add_proposal, void,
+	private_sa_payload_t *this, proposal_t *proposal)
 {
-	return this->proposals->create_iterator(this->proposals,forward);
-}
+	proposal_substructure_t *substruct, *last;
+	u_int count;
 
-/**
- * Implementation of sa_payload_t.add_proposal_substructure.
- */
-static void add_proposal_substructure(private_sa_payload_t *this,proposal_substructure_t *proposal)
-{
-	status_t status;
-	u_int proposal_count = this->proposals->get_count(this->proposals);
-
-	if (proposal_count > 0)
+	count = this->proposals->get_count(this->proposals);
+	substruct = proposal_substructure_create_from_proposal(proposal);
+	if (count > 0)
 	{
-		proposal_substructure_t *last_proposal;
-		status = this->proposals->get_last(this->proposals,(void **) &last_proposal);
+		this->proposals->get_last(this->proposals, (void**)&last);
 		/* last transform is now not anymore last one */
-		last_proposal->set_is_last_proposal(last_proposal, FALSE);
+		last->set_is_last_proposal(last, FALSE);
+	}
+	substruct->set_is_last_proposal(substruct, TRUE);
+	if (proposal->get_number(proposal))
+	{	/* use the selected proposals number, if any */
+		substruct->set_proposal_number(substruct, proposal->get_number(proposal));
+	}
+	else
+	{
+		substruct->set_proposal_number(substruct, count + 1);
 	}
-	proposal->set_is_last_proposal(proposal, TRUE);
-	proposal->set_proposal_number(proposal, proposal_count + 1);
-	this->proposals->insert_last(this->proposals,(void *) proposal);
+	this->proposals->insert_last(this->proposals, substruct);
 	compute_length(this);
 }
 
-/**
- * Implementation of sa_payload_t.add_proposal.
- */
-static void add_proposal(private_sa_payload_t *this, proposal_t *proposal)
-{
-	proposal_substructure_t *substructure;
-
-	substructure = proposal_substructure_create_from_proposal(proposal);
-	add_proposal_substructure(this, substructure);
-}
-
-/**
- * Implementation of sa_payload_t.get_proposals.
- */
-static linked_list_t *get_proposals(private_sa_payload_t *this)
+METHOD(sa_payload_t, get_proposals, linked_list_t*,
+	private_sa_payload_t *this)
 {
 	int struct_number = 0;
 	int ignore_struct_number = 0;
-	iterator_t *iterator;
-	proposal_substructure_t *proposal_struct;
-	linked_list_t *proposal_list;
-
-	/* this list will hold our proposals */
-	proposal_list = linked_list_create();
+	enumerator_t *enumerator;
+	proposal_substructure_t *substruct;
+	linked_list_t *list;
+	proposal_t *proposal;
 
+	list = linked_list_create();
 	/* we do not support proposals split up to two proposal substructures, as
 	 * AH+ESP bundles are not supported in RFC4301 anymore.
 	 * To handle such structures safely, we just skip proposals with multiple
 	 * protocols.
 	 */
-	iterator = this->proposals->create_iterator(this->proposals, TRUE);
-	while (iterator->iterate(iterator, (void **)&proposal_struct))
+	enumerator = this->proposals->create_enumerator(this->proposals);
+	while (enumerator->enumerate(enumerator, &substruct))
 	{
-		proposal_t *proposal;
-
 		/* check if a proposal has a single protocol */
-		if (proposal_struct->get_proposal_number(proposal_struct) == struct_number)
+		if (substruct->get_proposal_number(substruct) == struct_number)
 		{
 			if (ignore_struct_number < struct_number)
 			{
-				/* remova an already added, if first of series */
-				proposal_list->remove_last(proposal_list, (void**)&proposal);
+				/* remove an already added, if first of series */
+				list->remove_last(list, (void**)&proposal);
 				proposal->destroy(proposal);
 				ignore_struct_number = struct_number;
 			}
 			continue;
 		}
 		struct_number++;
-		proposal = proposal_struct->get_proposal(proposal_struct);
+		proposal = substruct->get_proposal(substruct);
 		if (proposal)
 		{
-			proposal_list->insert_last(proposal_list, proposal);
+			list->insert_last(list, proposal);
 		}
 	}
-	iterator->destroy(iterator);
-	return proposal_list;
+	enumerator->destroy(enumerator);
+	return list;
+}
+
+METHOD2(payload_t, sa_payload_t, destroy, void,
+	private_sa_payload_t *this)
+{
+	this->proposals->destroy_offset(this->proposals,
+									offsetof(proposal_substructure_t, destroy));
+	free(this);
 }
 
 /*
@@ -309,29 +271,27 @@ static linked_list_t *get_proposals(private_sa_payload_t *this)
  */
 sa_payload_t *sa_payload_create()
 {
-	private_sa_payload_t *this = malloc_thing(private_sa_payload_t);
-
-	/* public interface */
-	this->public.payload_interface.verify = (status_t (*) (payload_t *))verify;
-	this->public.payload_interface.get_encoding_rules = (void (*) (payload_t *, encoding_rule_t **, size_t *) ) get_encoding_rules;
-	this->public.payload_interface.get_length = (size_t (*) (payload_t *)) get_length;
-	this->public.payload_interface.get_next_type = (payload_type_t (*) (payload_t *)) get_next_type;
-	this->public.payload_interface.set_next_type = (void (*) (payload_t *,payload_type_t)) set_next_type;
-	this->public.payload_interface.get_type = (payload_type_t (*) (payload_t *)) get_type;
-	this->public.payload_interface.destroy = (void (*) (payload_t *))destroy;
-
-	/* public functions */
-	this->public.create_proposal_substructure_iterator = (iterator_t* (*) (sa_payload_t *,bool)) create_proposal_substructure_iterator;
-	this->public.add_proposal_substructure = (void (*) (sa_payload_t *,proposal_substructure_t *)) add_proposal_substructure;
-	this->public.add_proposal = (void (*) (sa_payload_t*,proposal_t*))add_proposal;
-	this->public.get_proposals = (linked_list_t* (*) (sa_payload_t *)) get_proposals;
-	this->public.destroy = (void (*) (sa_payload_t *)) destroy;
-
-	/* set default values of the fields */
-	this->critical = FALSE;
-	this->next_payload = NO_PAYLOAD;
-	this->payload_length = SA_PAYLOAD_HEADER_LENGTH;
-	this->proposals = linked_list_create();
+	private_sa_payload_t *this;
+
+	INIT(this,
+		.public = {
+			.payload_interface = {
+				.verify = _verify,
+				.get_encoding_rules = _get_encoding_rules,
+				.get_length = _get_length,
+				.get_next_type = _get_next_type,
+				.set_next_type = _set_next_type,
+				.get_type = _get_type,
+				.destroy = _destroy,
+			},
+			.add_proposal = _add_proposal,
+			.get_proposals = _get_proposals,
+			.destroy = _destroy,
+		},
+		.next_payload = NO_PAYLOAD,
+		.payload_length = SA_PAYLOAD_HEADER_LENGTH,
+		.proposals = linked_list_create(),
+	);
 	return &this->public;
 }
 
@@ -340,19 +300,19 @@ sa_payload_t *sa_payload_create()
  */
 sa_payload_t *sa_payload_create_from_proposal_list(linked_list_t *proposals)
 {
-	iterator_t *iterator;
+	private_sa_payload_t *this;
+	enumerator_t *enumerator;
 	proposal_t *proposal;
-	sa_payload_t *sa_payload = sa_payload_create();
 
-	/* add every payload from the list */
-	iterator = proposals->create_iterator(proposals, TRUE);
-	while (iterator->iterate(iterator, (void**)&proposal))
+	this = (private_sa_payload_t*)sa_payload_create();
+	enumerator = proposals->create_enumerator(proposals);
+	while (enumerator->enumerate(enumerator, &proposal))
 	{
-		add_proposal((private_sa_payload_t*)sa_payload, proposal);
+		add_proposal(this, proposal);
 	}
-	iterator->destroy(iterator);
+	enumerator->destroy(enumerator);
 
-	return sa_payload;
+	return &this->public;
 }
 
 /*
@@ -360,9 +320,10 @@ sa_payload_t *sa_payload_create_from_proposal_list(linked_list_t *proposals)
  */
 sa_payload_t *sa_payload_create_from_proposal(proposal_t *proposal)
 {
-	sa_payload_t *sa_payload = sa_payload_create();
+	private_sa_payload_t *this;
 
-	add_proposal((private_sa_payload_t*)sa_payload, proposal);
+	this = (private_sa_payload_t*)sa_payload_create();
+	add_proposal(this, proposal);
 
-	return sa_payload;
+	return &this->public;
 }
diff --git a/src/libcharon/encoding/payloads/sa_payload.h b/src/libcharon/encoding/payloads/sa_payload.h
index 25f5a2407..801a70738 100644
--- a/src/libcharon/encoding/payloads/sa_payload.h
+++ b/src/libcharon/encoding/payloads/sa_payload.h
@@ -40,33 +40,13 @@ typedef struct sa_payload_t sa_payload_t;
  * The SA Payload format is described in RFC section 3.3.
  */
 struct sa_payload_t {
+
 	/**
 	 * The payload_t interface.
 	 */
 	payload_t payload_interface;
 
 	/**
-	 * Creates an iterator of stored proposal_substructure_t objects.
-	 *
-	 * When deleting an proposal using this iterator,
-	 * the length of this transform substructure has to be refreshed
-	 * by calling get_length()!
-	 *
-	 * @param forward 		iterator direction (TRUE: front to end)
-	 * @return				created iterator_t object
-	 */
-	iterator_t *(*create_proposal_substructure_iterator) (sa_payload_t *this,
-														  bool forward);
-
-	/**
-	 * Adds a proposal_substructure_t object to this object.
-	 *
-	 * @param proposal  		proposal_substructure_t object to add
-	 */
-	void (*add_proposal_substructure) (sa_payload_t *this,
-									   proposal_substructure_t *proposal);
-
-	/**
 	 * Gets the proposals in this payload as a list.
 	 *
 	 * @return					a list containing proposal_t s