[svn-upgrade] Integrating new upstream version, strongswan (4.3.6)

21 files changed, 630 insertions, 1309 deletions

diff --git a/src/libstrongswan/utils/backtrace.c b/src/libstrongswan/utils/backtrace.c
index f110521af..5bba8ec21 100644
--- a/src/libstrongswan/utils/backtrace.c
+++ b/src/libstrongswan/utils/backtrace.c
@@ -33,17 +33,17 @@ typedef struct private_backtrace_t private_backtrace_t;
  * Private data of an backtrace_t object.
  */
 struct private_backtrace_t {
-	
+
 	/**
 	 * Public backtrace_t interface.
 	 */
 	backtrace_t public;
-	
+
 	/**
 	 * Number of stacks frames obtained in stack_frames
 	 */
 	int frame_count;
-	
+
 	/**
 	 * Recorded stack frames.
 	 */
@@ -58,7 +58,7 @@ static void log_(private_backtrace_t *this, FILE *file)
 #ifdef HAVE_BACKTRACE
 	size_t i;
 	char **strings;
-	
+
 	strings = backtrace_symbols(this->frames, this->frame_count);
 
 	fprintf(file, " dumping %d stack frame addresses:\n", this->frame_count);
@@ -66,14 +66,14 @@ static void log_(private_backtrace_t *this, FILE *file)
 	{
 #ifdef HAVE_DLADDR
 		Dl_info info;
-		
+
 		if (dladdr(this->frames[i], &info))
 		{
 			char cmd[1024];
 			FILE *output;
-			char c;
+			int c;
 			void *ptr = this->frames[i];
-			
+
 			if (strstr(info.dli_fname, ".so"))
 			{
 				ptr = (void*)(this->frames[i] - info.dli_fbase);
@@ -136,7 +136,7 @@ static bool contains_function(private_backtrace_t *this, char *function)
 	for (i = 0; i< this->frame_count; i++)
 	{
 		Dl_info info;
-		
+
 		if (dladdr(this->frames[i], &info) && info.dli_sname)
 		{
 			if (streq(info.dli_sname, function))
@@ -165,7 +165,7 @@ backtrace_t *backtrace_create(int skip)
 	private_backtrace_t *this;
 	void *frames[50];
 	int frame_count = 0;
-	
+
 #ifdef HAVE_BACKTRACE
 	frame_count = backtrace(frames, countof(frames));
 #endif /* HAVE_BACKTRACE */
@@ -173,11 +173,11 @@ backtrace_t *backtrace_create(int skip)
 	this = malloc(sizeof(private_backtrace_t) + frame_count * sizeof(void*));
 	memcpy(this->frames, frames + skip, frame_count * sizeof(void*));
 	this->frame_count = frame_count;
-	
+
 	this->public.log = (void(*)(backtrace_t*,FILE*))log_;
 	this->public.contains_function = (bool(*)(backtrace_t*, char *function))contains_function;
 	this->public.destroy = (void(*)(backtrace_t*))destroy;
-	
+
 	return &this->public;
 }
 
diff --git a/src/libstrongswan/utils/backtrace.h b/src/libstrongswan/utils/backtrace.h
index 061d9f356..c4d4284d1 100644
--- a/src/libstrongswan/utils/backtrace.h
+++ b/src/libstrongswan/utils/backtrace.h
@@ -31,12 +31,12 @@ typedef struct backtrace_t backtrace_t;
  * A backtrace registers the frames on the stack during creation.
  */
 struct backtrace_t {
-	
+
 	/**
 	 * Log the backtrace to a FILE stream.
 	 */
 	void (*log)(backtrace_t *this, FILE *file);
-	
+
 	/**
 	 * Check if the backtrace contains a frame in a specific function.
 	 *
@@ -44,7 +44,7 @@ struct backtrace_t {
 	 * @return		TRUE if function is in the stack
 	 */
 	bool (*contains_function)(backtrace_t *this, char *function);
-	
+
 	/**
 	 * Destroy a backtrace instance.
 	 */
diff --git a/src/libstrongswan/utils/enumerator.c b/src/libstrongswan/utils/enumerator.c
index 08522b8d5..7efdd883e 100644
--- a/src/libstrongswan/utils/enumerator.c
+++ b/src/libstrongswan/utils/enumerator.c
@@ -77,7 +77,7 @@ static bool enumerate_dir_enum(dir_enum_t *this, char **relative,
 {
 	struct dirent *entry = readdir(this->dir);
 	size_t len, remaining;
-	
+
 	if (!entry)
 	{
 		return FALSE;
@@ -91,7 +91,7 @@ static bool enumerate_dir_enum(dir_enum_t *this, char **relative,
 		*relative = entry->d_name;
 	}
 	if (absolute || st)
-	{	
+	{
 		remaining = sizeof(this->full) - (this->full_end - this->full);
 		len = snprintf(this->full_end, remaining, "%s", entry->d_name);
 		if (len < 0 || len >= remaining)
@@ -124,7 +124,7 @@ enumerator_t* enumerator_create_directory(char *path)
 	dir_enum_t *this = malloc_thing(dir_enum_t);
 	this->public.enumerate = (void*)enumerate_dir_enum;
 	this->public.destroy = (void*)destroy_dir_enum;
-	
+
 	if (*path == '\0')
 	{
 		path = "./";
@@ -132,7 +132,7 @@ enumerator_t* enumerator_create_directory(char *path)
 	len = snprintf(this->full, sizeof(this->full)-1, "%s", path);
 	if (len < 0 || len >= sizeof(this->full)-1)
 	{
-		DBG1("path string %s too long", path);
+		DBG1("path string '%s' too long", path);
 		free(this);
 		return NULL;
 	}
@@ -143,11 +143,11 @@ enumerator_t* enumerator_create_directory(char *path)
 		this->full[len] = '\0';
 	}
 	this->full_end = &this->full[len];
-	
+
 	this->dir = opendir(path);
 	if (this->dir == NULL)
 	{
-		DBG1("opening directory %s failed: %s", path, strerror(errno));
+		DBG1("opening directory '%s' failed: %s", path, strerror(errno));
 		free(this);
 		return NULL;
 	}
@@ -186,7 +186,7 @@ static bool enumerate_token_enum(token_enum_t *this, char **token)
 {
 	char *pos = NULL, *tmp, *sep, *trim;
 	bool last = FALSE;
-	
+
 	/* trim leading characters/separators */
 	while (*this->pos)
 	{
@@ -215,7 +215,7 @@ static bool enumerate_token_enum(token_enum_t *this, char **token)
 			break;
 		}
 	}
-	
+
 	switch (*this->pos)
 	{
 		case '"':
@@ -259,7 +259,7 @@ static bool enumerate_token_enum(token_enum_t *this, char **token)
 			break;
 		}
 	}
-	
+
 	/* trim trailing characters/separators */
 	pos--;
 	while (pos >= *token)
@@ -289,7 +289,7 @@ static bool enumerate_token_enum(token_enum_t *this, char **token)
 			break;
 		}
 	}
-	
+
 	if (!last || pos >= *token)
 	{
 		return TRUE;
@@ -303,14 +303,14 @@ static bool enumerate_token_enum(token_enum_t *this, char **token)
 enumerator_t* enumerator_create_token(char *string, char *sep, char *trim)
 {
 	token_enum_t *enumerator = malloc_thing(token_enum_t);
-	
+
 	enumerator->public.enumerate = (void*)enumerate_token_enum;
 	enumerator->public.destroy = (void*)destroy_token_enum;
 	enumerator->string = strdup(string);
 	enumerator->pos = enumerator->string;
 	enumerator->sep = sep;
 	enumerator->trim = trim;
-	
+
 	return &enumerator->public;
 }
 
@@ -342,9 +342,9 @@ static bool enumerate_nested(nested_enumerator_t *this, void *v1, void *v2,
 	while (TRUE)
 	{
 		while (this->inner == NULL)
-		{	
+		{
 			void *outer;
-			
+
 			if (!this->outer->enumerate(this->outer, &outer))
 			{
 				return FALSE;
@@ -382,7 +382,7 @@ enumerator_t *enumerator_create_nested(enumerator_t *outer,
 					void *data, void (*destroy_data)(void *data))
 {
 	nested_enumerator_t *enumerator = malloc_thing(nested_enumerator_t);
-	
+
 	enumerator->public.enumerate = (void*)enumerate_nested;
 	enumerator->public.destroy = (void*)destroy_nested;
 	enumerator->outer = outer;
@@ -390,7 +390,7 @@ enumerator_t *enumerator_create_nested(enumerator_t *outer,
 	enumerator->create_inner = (void*)inner_constructor;
 	enumerator->data = data;
 	enumerator->destroy_data = destroy_data;
-	
+
 	return &enumerator->public;
 }
 
@@ -444,14 +444,14 @@ enumerator_t *enumerator_create_filter(enumerator_t *unfiltered,
 									   void *data, void (*destructor)(void *data))
 {
 	filter_enumerator_t *this = malloc_thing(filter_enumerator_t);
-	
+
 	this->public.enumerate = (void*)enumerate_filter;
 	this->public.destroy = (void*)destroy_filter;
 	this->unfiltered = unfiltered;
 	this->filter = filter;
 	this->data = data;
 	this->destructor = destructor;
-	
+
 	return &this->public;
 }
 
@@ -491,13 +491,13 @@ enumerator_t *enumerator_create_cleaner(enumerator_t *wrapped,
 										void (*cleanup)(void *data), void *data)
 {
 	cleaner_enumerator_t *this = malloc_thing(cleaner_enumerator_t);
-	
+
 	this->public.enumerate = (void*)enumerate_cleaner;
 	this->public.destroy = (void*)destroy_cleaner;
 	this->wrapped = wrapped;
 	this->cleanup = cleanup;
 	this->data = data;
-	
+
 	return &this->public;
 }
 
@@ -543,13 +543,13 @@ static bool enumerate_single(single_enumerator_t *this, void **item)
 enumerator_t *enumerator_create_single(void *item, void (*cleanup)(void *item))
 {
 	single_enumerator_t *this = malloc_thing(single_enumerator_t);
-	
+
 	this->public.enumerate = (void*)enumerate_single;
 	this->public.destroy = (void*)destroy_single;
 	this->item = item;
 	this->cleanup = cleanup;
 	this->done = FALSE;
-	
+
 	return &this->public;
 }
 
diff --git a/src/libstrongswan/utils/enumerator.h b/src/libstrongswan/utils/enumerator.h
index 4367d0836..3056498b1 100644
--- a/src/libstrongswan/utils/enumerator.h
+++ b/src/libstrongswan/utils/enumerator.h
@@ -12,7 +12,7 @@
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
  */
- 
+
 /**
  * @defgroup enumerator enumerator
  * @{ @ingroup utils
@@ -33,18 +33,18 @@ struct enumerator_t {
 	/**
 	 * Enumerate collection.
 	 *
-	 * The enumerate function takes a variable argument list containing 
+	 * The enumerate function takes a variable argument list containing
 	 * pointers where the enumerated values get written.
 	 *
 	 * @param ...	variable list of enumerated items, implementation dependant
 	 * @return		TRUE if pointers returned
 	 */
 	bool (*enumerate)(enumerator_t *this, ...);
-		
+
 	/**
-     * Destroy a enumerator instance.
-     */
-    void (*destroy)(enumerator_t *this);
+	 * Destroy a enumerator instance.
+	 */
+	void (*destroy)(enumerator_t *this);
 };
 
 /**
@@ -75,7 +75,7 @@ enumerator_t *enumerator_create_single(void *item, void (*cleanup)(void *item));
 	char *rel, *abs;
 	struct stat st;
 	enumerator_t *e;
-	
+
 	e = enumerator_create_directory("/tmp");
 	if (e)
 	{
@@ -110,7 +110,7 @@ enumerator_t* enumerator_create_token(char *string, char *sep, char *trim);
 
 /**
  * Creates an enumerator which enumerates over enumerated enumerators :-).
- * 
+ *
  * The variable argument list of enumeration values is limit to 5.
  *
  * @param outer					outer enumerator
diff --git a/src/libstrongswan/utils/hashtable.c b/src/libstrongswan/utils/hashtable.c
index 6d33d023b..02c225833 100644
--- a/src/libstrongswan/utils/hashtable.c
+++ b/src/libstrongswan/utils/hashtable.c
@@ -30,12 +30,12 @@ struct pair_t {
 	 * Key of a hash table item.
 	 */
 	void *key;
-	
+
 	/**
 	 * Value of a hash table item.
 	 */
 	void *value;
-	
+
 	/**
 	 * Cached hash (used in case of a resize).
 	 */
@@ -48,11 +48,11 @@ struct pair_t {
 pair_t *pair_create(void *key, void *value, u_int hash)
 {
 	pair_t *this = malloc_thing(pair_t);
-	
+
 	this->key = key;
 	this->value = value;
 	this->hash = hash;
-	
+
 	return this;
 }
 
@@ -67,37 +67,37 @@ struct private_hashtable_t {
 	 * Public part of hash table.
 	 */
 	hashtable_t public;
-	
+
 	/**
-	 * The number of items in the hash table. 
+	 * The number of items in the hash table.
 	 */
 	u_int count;
-	
+
 	/**
 	 * The current capacity of the hash table (always a power of 2).
 	 */
 	u_int capacity;
-	
+
 	/**
-	 * The current mask to calculate the row index (capacity - 1). 
+	 * The current mask to calculate the row index (capacity - 1).
 	 */
 	u_int mask;
-	
+
 	/**
 	 * The load factor.
 	 */
 	float load_factor;
-	
+
 	/**
 	 * The actual table.
 	 */
 	linked_list_t **table;
-	
+
 	/**
 	 * The hashing function.
 	 */
 	hashtable_hash_t hash;
-	
+
 	/**
 	 * The equality function.
 	 */
@@ -115,17 +115,17 @@ struct private_enumerator_t {
 	 * implements enumerator interface
 	 */
 	enumerator_t enumerator;
-	
+
 	/**
 	 * associated hash table
 	 */
 	private_hashtable_t *table;
-	
+
 	/**
 	 * current row index
 	 */
 	u_int row;
-	
+
 	/**
 	 * enumerator for the current row
 	 */
@@ -149,6 +149,7 @@ static inline bool pair_equals(pair_t *pair, private_hashtable_t *this, void *ke
 static u_int get_nearest_powerof2(u_int n)
 {
 	u_int i;
+
 	--n;
 	for (i = 1; i < sizeof(u_int) * 8; i <<= 1)
 	{
@@ -166,7 +167,7 @@ static void init_hashtable(private_hashtable_t *this, u_int capacity)
 	this->capacity = get_nearest_powerof2(capacity);
 	this->mask = this->capacity - 1;
 	this->load_factor = 0.75;
-	
+
 	this->table = calloc(this->capacity, sizeof(linked_list_t*));
 }
 
@@ -175,30 +176,37 @@ static void init_hashtable(private_hashtable_t *this, u_int capacity)
  */
 static void rehash(private_hashtable_t *this)
 {
-	u_int row;
-	u_int old_capacity = this->capacity;
-	linked_list_t **old_table = this->table;
-	
-	if (old_capacity >= MAX_CAPACITY)
+	linked_list_t **old_table;
+	u_int row, old_capacity;
+
+	if (this->capacity < MAX_CAPACITY)
 	{
 		return;
 	}
-	
+
+	old_capacity = this->capacity;
+	old_table = this->table;
+
 	init_hashtable(this, old_capacity << 1);
-	
-	for (row = 0; row < old_capacity; ++row)
+
+	for (row = 0; row < old_capacity; row++)
 	{
-		linked_list_t *list;
-		if ((list = old_table[row]) != NULL)
+		enumerator_t *enumerator;
+		linked_list_t *list, *new_list;
+		pair_t *pair;
+		u_int new_row;
+
+		list = old_table[row];
+		if (list)
 		{
-			pair_t *pair;
-			enumerator_t *enumerator = list->create_enumerator(list);
+			enumerator = list->create_enumerator(list);
 			while (enumerator->enumerate(enumerator, &pair))
 			{
-				linked_list_t *new_list;
-				u_int new_row = pair->hash & this->mask;
+				new_row = pair->hash & this->mask;
+
 				list->remove_at(list, enumerator);
-				if ((new_list = this->table[new_row]) == NULL)
+				new_list = this->table[new_row];
+				if (!new_list)
 				{
 					new_list = this->table[new_row] = linked_list_create();
 				}
@@ -216,15 +224,20 @@ static void rehash(private_hashtable_t *this)
  */
 static void *put(private_hashtable_t *this, void *key, void *value)
 {
-	linked_list_t *list;
 	void *old_value = NULL;
-	u_int hash = this->hash(key);
-	u_int row = hash & this->mask;
-	
-	if ((list = this->table[row]) != NULL)
+	linked_list_t *list;
+	u_int hash;
+	u_int row;
+
+	hash = this->hash(key);
+	row = hash & this->mask;
+	list = this->table[row];
+	if (list)
 	{
+		enumerator_t *enumerator;
 		pair_t *pair;
-		enumerator_t *enumerator = list->create_enumerator(list);
+
+		enumerator = list->create_enumerator(list);
 		while (enumerator->enumerate(enumerator, &pair))
 		{
 			if (pair_equals(pair, this, key))
@@ -240,43 +253,39 @@ static void *put(private_hashtable_t *this, void *key, void *value)
 	{
 		list = this->table[row] = linked_list_create();
 	}
-	
 	if (!old_value)
 	{
 		list->insert_last(list, pair_create(key, value, hash));
 		this->count++;
 	}
-	
 	if (this->count >= this->capacity * this->load_factor)
 	{
 		rehash(this);
 	}
-	
 	return old_value;
 }
-	
+
 /**
- * Implementation of hashtable_t.get  
+ * Implementation of hashtable_t.get
  */
 static void *get(private_hashtable_t *this, void *key)
 {
 	void *value = NULL;
 	linked_list_t *list;
-	u_int row = this->hash(key) & this->mask;
-	
-	if ((list = this->table[row]) != NULL)
+	pair_t *pair;
+
+	list = this->table[this->hash(key) & this->mask];
+	if (list)
 	{
-		pair_t *pair;
 		if (list->find_first(list, (linked_list_match_t)pair_equals,
-				(void**)&pair, this, key) == SUCCESS)
+							 (void**)&pair, this, key) == SUCCESS)
 		{
 			value = pair->value;
 		}
 	}
-	
 	return value;
 }
-	
+
 /**
  * Implementation of hashtable_t.remove
  */
@@ -284,12 +293,14 @@ static void *remove_(private_hashtable_t *this, void *key)
 {
 	void *value = NULL;
 	linked_list_t *list;
-	u_int row = this->hash(key) & this->mask;	
-	
-	if ((list = this->table[row]) != NULL)
+
+	list = this->table[this->hash(key) & this->mask];
+	if (list)
 	{
+		enumerator_t *enumerator;
 		pair_t *pair;
-		enumerator_t *enumerator = list->create_enumerator(list);
+
+		enumerator = list->create_enumerator(list);
 		while (enumerator->enumerate(enumerator, &pair))
 		{
 			if (pair_equals(pair, this, key))
@@ -303,10 +314,9 @@ static void *remove_(private_hashtable_t *this, void *key)
 		}
 		enumerator->destroy(enumerator);
 	}
-	
 	return value;
 }
-	
+
 /**
  * Implementation of hashtable_t.get_count
  */
@@ -325,7 +335,7 @@ static bool enumerate(private_enumerator_t *this, void **key, void **value)
 		if (this->current)
 		{
 			pair_t *pair;
-			
+
 			if (this->current->enumerate(this->current, &pair))
 			{
 				if (key)
@@ -344,8 +354,9 @@ static bool enumerate(private_enumerator_t *this, void **key, void **value)
 		else
 		{
 			linked_list_t *list;
-			
-			if ((list = this->table->table[this->row]) != NULL)
+
+			list = this->table->table[this->row];
+			if (list)
 			{
 				this->current = list->create_enumerator(list);
 				continue;
@@ -374,26 +385,28 @@ static void enumerator_destroy(private_enumerator_t *this)
 static enumerator_t* create_enumerator(private_hashtable_t *this)
 {
 	private_enumerator_t *enumerator = malloc_thing(private_enumerator_t);
-	
+
 	enumerator->enumerator.enumerate = (void*)enumerate;
 	enumerator->enumerator.destroy = (void*)enumerator_destroy;
 	enumerator->table = this;
 	enumerator->row = 0;
 	enumerator->current = NULL;
-	
+
 	return &enumerator->enumerator;
 }
-	
+
 /**
  * Implementation of hashtable_t.destroy
  */
 static void destroy(private_hashtable_t *this)
 {
+	linked_list_t *list;
 	u_int row;
-	for (row = 0; row < this->capacity; ++row)
+
+	for (row = 0; row < this->capacity; row++)
 	{
-		linked_list_t *list;
-		if ((list = this->table[row]) != NULL)
+		list = this->table[row];
+		if (list)
 		{
 			list->destroy_function(list, free);
 		}
@@ -411,12 +424,12 @@ hashtable_t *hashtable_create(hashtable_hash_t hash, hashtable_equals_t equals,
 	private_hashtable_t *this = malloc_thing(private_hashtable_t);
 
 	this->public.put = (void*(*)(hashtable_t*,void*,void*))put;
-	this->public.get = (void*(*)(hashtable_t*,void*))get; 
+	this->public.get = (void*(*)(hashtable_t*,void*))get;
 	this->public.remove = (void*(*)(hashtable_t*,void*))remove_;
 	this->public.get_count = (u_int(*)(hashtable_t*))get_count;
 	this->public.create_enumerator = (enumerator_t*(*)(hashtable_t*))create_enumerator;
 	this->public.destroy = (void(*)(hashtable_t*))destroy;
-	
+
 	this->count = 0;
 	this->capacity = 0;
 	this->mask = 0;
@@ -424,8 +437,9 @@ hashtable_t *hashtable_create(hashtable_hash_t hash, hashtable_equals_t equals,
 	this->table = NULL;
 	this->hash = hash;
 	this->equals = equals;
-	
+
 	init_hashtable(this, capacity);
-	
+
 	return &this->public;
 }
+
diff --git a/src/libstrongswan/utils/hashtable.h b/src/libstrongswan/utils/hashtable.h
index cbe51f557..142ea6329 100644
--- a/src/libstrongswan/utils/hashtable.h
+++ b/src/libstrongswan/utils/hashtable.h
@@ -48,61 +48,61 @@ typedef bool (*hashtable_equals_t)(void *key, void *other_key);
  * General purpose hash table. This hash table is not synchronized.
  */
 struct hashtable_t {
-	
+
 	/**
 	 * Create an enumerator over the hash table key/value pairs.
-	 * 
+	 *
 	 * @return			enumerator over (void *key, void *value)
 	 */
 	enumerator_t *(*create_enumerator) (hashtable_t *this);
-	
+
 	/**
 	 * Adds the given value with the given key to the hash table, if there
 	 * exists no entry with that key. NULL is returned in this case.
 	 * Otherwise the existing value is replaced and the function returns the
 	 * old value.
-	 * 
+	 *
 	 * @param key		the key to store
 	 * @param value		the value to store
 	 * @return			NULL if no item was replaced, the old value otherwise
 	 */
 	void *(*put) (hashtable_t *this, void *key, void *value);
-	
+
 	/**
 	 * Returns the value with the given key, if the hash table contains such an
 	 * entry, otherwise NULL is returned.
-	 * 
+	 *
 	 * @param key		the key of the requested value
-	 * @return			the value, NULL if not found  
+	 * @return			the value, NULL if not found
 	 */
 	void *(*get) (hashtable_t *this, void *key);
-	
+
 	/**
 	 * Removes the value with the given key from the hash table and returns the
 	 * removed value (or NULL if no such value existed).
-	 * 
+	 *
 	 * @param key		the key of the value to remove
 	 * @return			the removed value, NULL if not found
 	 */
 	void *(*remove) (hashtable_t *this, void *key);
-	
+
 	/**
 	 * Gets the number of items in the hash table.
-	 * 
+	 *
 	 * @return 			number of items
 	 */
 	u_int (*get_count) (hashtable_t *this);
-	
+
 	/**
 	 * Destroys a hash table object.
 	 */
 	void (*destroy) (hashtable_t *this);
-	
+
 };
 
 /**
  * Creates an empty hash table object.
- * 
+ *
  * @param hash			hash function
  * @param equals		equals function
  * @param capacity		initial capacity
diff --git a/src/libstrongswan/utils/host.c b/src/libstrongswan/utils/host.c
index 661bec315..a610b3a4d 100644
--- a/src/libstrongswan/utils/host.c
+++ b/src/libstrongswan/utils/host.c
@@ -38,7 +38,7 @@ struct private_host_t {
 	 * Public data
 	 */
 	host_t public;
-	
+
 	/**
 	 * low-lewel structure, wich stores the address
 	 */
@@ -111,7 +111,7 @@ int host_printf_hook(char *dst, size_t dstlen, printf_hook_spec_t *spec,
 {
 	private_host_t *this = *((private_host_t**)(args[0]));
 	char buffer[INET6_ADDRSTRLEN + 16];
-	
+
 	if (this == NULL)
 	{
 		snprintf(buffer, sizeof(buffer), "(null)");
@@ -126,10 +126,10 @@ int host_printf_hook(char *dst, size_t dstlen, printf_hook_spec_t *spec,
 		void *address;
 		u_int16_t port;
 		int len;
-		
+
 		address = &this->address6.sin6_addr;
 		port = this->address6.sin6_port;
-		
+
 		switch (this->address.sa_family)
 		{
 			case AF_INET:
@@ -137,7 +137,7 @@ int host_printf_hook(char *dst, size_t dstlen, printf_hook_spec_t *spec,
 				port = this->address4.sin_port;
 				/* fall */
 			case AF_INET6:
-	
+
 				if (inet_ntop(this->address.sa_family, address,
 							  buffer, sizeof(buffer)) == NULL)
 				{
@@ -169,7 +169,7 @@ int host_printf_hook(char *dst, size_t dstlen, printf_hook_spec_t *spec,
 static chunk_t get_address(private_host_t *this)
 {
 	chunk_t address = chunk_empty;
-	
+
 	switch (this->address.sa_family)
 	{
 		case AF_INET:
@@ -252,7 +252,7 @@ static void set_port(private_host_t *this, u_int16_t port)
 static private_host_t *clone_(private_host_t *this)
 {
 	private_host_t *new = malloc_thing(private_host_t);
-	
+
 	memcpy(new, this, sizeof(private_host_t));
 	return new;
 }
@@ -267,7 +267,7 @@ static bool ip_equals(private_host_t *this, private_host_t *other)
 		/* 0.0.0.0 and 0::0 are equal */
 		return (is_anyaddr(this) && is_anyaddr(other));
 	}
-	
+
 	switch (this->address.sa_family)
 	{
 		case AF_INET:
@@ -292,7 +292,7 @@ static bool ip_equals(private_host_t *this, private_host_t *other)
 static host_diff_t get_differences(host_t *this, host_t *other)
 {
 	host_diff_t ret = HOST_DIFF_NONE;
-	
+
 	if (!this->ip_equals(this, other))
 	{
 		ret |= HOST_DIFF_ADDR;
@@ -302,7 +302,7 @@ static host_diff_t get_differences(host_t *this, host_t *other)
 	{
 		ret |= HOST_DIFF_PORT;
 	}
-	
+
 	return ret;
 }
 
@@ -315,7 +315,7 @@ static bool equals(private_host_t *this, private_host_t *other)
 	{
 		return FALSE;
 	}
-	
+
 	switch (this->address.sa_family)
 	{
 		case AF_INET:
@@ -346,7 +346,7 @@ static void destroy(private_host_t *this)
 static private_host_t *host_create_empty(void)
 {
 	private_host_t *this = malloc_thing(private_host_t);
-	
+
 	this->public.get_sockaddr = (sockaddr_t* (*) (host_t*))get_sockaddr;
 	this->public.get_sockaddr_len = (socklen_t*(*) (host_t*))get_sockaddr_len;
 	this->public.clone = (host_t* (*) (host_t*))clone_;
@@ -359,7 +359,7 @@ static private_host_t *host_create_empty(void)
 	this->public.equals = (bool (*) (host_t *,host_t *)) equals;
 	this->public.is_anyaddr = (bool (*) (host_t *)) is_anyaddr;
 	this->public.destroy = (void (*) (host_t*))destroy;
-	
+
 	return this;
 }
 
@@ -369,7 +369,7 @@ static private_host_t *host_create_empty(void)
 static host_t *host_create_any_port(int family, u_int16_t port)
 {
 	host_t *this;
-	
+
 	this = host_create_any(family);
 	this->set_port(this, port);
 	return this;
@@ -381,7 +381,7 @@ static host_t *host_create_any_port(int family, u_int16_t port)
 host_t *host_create_from_string(char *string, u_int16_t port)
 {
 	private_host_t *this;
-	
+
 	if (streq(string, "%any"))
 	{
 		return host_create_any_port(AF_INET, port);
@@ -390,7 +390,7 @@ host_t *host_create_from_string(char *string, u_int16_t port)
 	{
 		return host_create_any_port(AF_INET6, port);
 	}
-	
+
 	this = host_create_empty();
 	if (strchr(string, '.'))
 	{
@@ -437,7 +437,7 @@ host_t *host_create_from_string(char *string, u_int16_t port)
 host_t *host_create_from_sockaddr(sockaddr_t *sockaddr)
 {
 	private_host_t *this = host_create_empty();
-	
+
 	switch (sockaddr->sa_family)
 	{
 		case AF_INET:
@@ -467,7 +467,7 @@ host_t *host_create_from_dns(char *string, int af, u_int16_t port)
 	private_host_t *this;
 	struct addrinfo hints, *result;
 	int error;
-	
+
 	if (streq(string, "%any"))
 	{
 		return host_create_any_port(af ? af : AF_INET, port);
@@ -476,7 +476,7 @@ host_t *host_create_from_dns(char *string, int af, u_int16_t port)
 	{
 		return host_create_any_port(af ? af : AF_INET6, port);
 	}
-	
+
 	memset(&hints, 0, sizeof(hints));
 	hints.ai_family = af;
 	error = getaddrinfo(string, NULL, &hints, &result);
@@ -510,7 +510,7 @@ host_t *host_create_from_dns(char *string, int af, u_int16_t port)
 host_t *host_create_from_chunk(int family, chunk_t address, u_int16_t port)
 {
 	private_host_t *this;
-	
+
 	switch (family)
 	{
 		case AF_INET:
@@ -567,10 +567,10 @@ host_t *host_create_from_chunk(int family, chunk_t address, u_int16_t port)
 host_t *host_create_any(int family)
 {
 	private_host_t *this = host_create_empty();
-	
+
 	memset(&this->address_max, 0, sizeof(struct sockaddr_storage));
 	this->address.sa_family = family;
-	
+
 	switch (family)
 	{
 		case AF_INET:
diff --git a/src/libstrongswan/utils/host.h b/src/libstrongswan/utils/host.h
index 0a2541d96..f5796154c 100644
--- a/src/libstrongswan/utils/host.h
+++ b/src/libstrongswan/utils/host.h
@@ -34,7 +34,7 @@ typedef struct host_t host_t;
 #include <netinet/in.h>
 #include <arpa/inet.h>
 
-#include <library.h>
+#include <chunk.h>
 
 /**
  * Differences between two hosts. They differ in
@@ -48,103 +48,103 @@ enum host_diff_t {
 
 /**
  * Representates a Host
- * 
- * Host object, identifies a address:port pair and defines some 
+ *
+ * Host object, identifies a address:port pair and defines some
  * useful functions on it.
  */
 struct host_t {
-	
-	/** 
+
+	/**
 	 * Build a clone of this host object.
-	 * 
+	 *
 	 * @return		cloned host
 	 */
 	host_t *(*clone) (host_t *this);
-	
-	/** 
+
+	/**
 	 * Get a pointer to the internal sockaddr struct.
-	 * 
+	 *
 	 * This is used for sending and receiving via sockets.
-	 * 
+	 *
 	 * @return		pointer to the internal sockaddr structure
 	 */
 	sockaddr_t  *(*get_sockaddr) (host_t *this);
-	
-	/** 
+
+	/**
 	 * Get the length of the sockaddr struct.
-	 * 
+	 *
 	 * Depending on the family, the length of the sockaddr struct
 	 * is different. Use this function to get the length of the sockaddr
 	 * struct returned by get_sock_addr.
-	 * 
+	 *
 	 * This is used for sending and receiving via sockets.
-	 * 
+	 *
 	 * @return		length of the sockaddr struct
 	 */
 	socklen_t *(*get_sockaddr_len) (host_t *this);
-	
+
 	/**
 	 * Gets the family of the address
-	 * 
+	 *
 	 * @return		family
 	 */
 	int (*get_family) (host_t *this);
-	
-	/** 
+
+	/**
 	 * Checks if the ip address of host is set to default route.
-	 * 
+	 *
 	 * @return		TRUE if host is 0.0.0.0 or 0::0, FALSE otherwise
 	 */
 	bool (*is_anyaddr) (host_t *this);
-	
-	/** 
+
+	/**
 	 * Get the address of this host as chunk_t
-	 * 
+	 *
 	 * Returned chunk points to internal data.
-	 * 
-	 * @return		address string, 
+	 *
+	 * @return		address string,
 	 */
 	chunk_t (*get_address) (host_t *this);
-		
-	/** 
+
+	/**
 	 * Get the port of this host
-	 * 
+	 *
 	 * @return		port number
 	 */
 	u_int16_t (*get_port) (host_t *this);
 
-	/** 
+	/**
 	 * Set the port of this host
 	 *
 	 * @param port	port numer
 	 */
 	void (*set_port) (host_t *this, u_int16_t port);
-		
-	/** 
+
+	/**
 	 * Compare the ips of two hosts hosts.
-	 * 
+	 *
 	 * @param other	the other to compare
 	 * @return		TRUE if addresses are equal.
 	 */
 	bool (*ip_equals) (host_t *this, host_t *other);
-		
-	/** 
+
+	/**
 	 * Compare two hosts, with port.
-	 * 
+	 *
 	 * @param other	the other to compare
 	 * @return		TRUE if addresses and ports are equal.
 	 */
 	bool (*equals) (host_t *this, host_t *other);
 
-	/** 
+	/**
 	 * Compare two hosts and return the differences.
 	 *
 	 * @param other	the other to compare
 	 * @return		differences in a combination of host_diff_t's
 	 */
 	host_diff_t (*get_differences) (host_t *this, host_t *other);
-	
-	/** 
+
+	/**
 	 * Destroy this host object.
 	 */
 	void (*destroy) (host_t *this);
@@ -200,8 +200,8 @@ host_t *host_create_any(int family);
 /**
  * printf hook function for host_t.
  *
- * Arguments are: 
- *    host_t *host
+ * Arguments are:
+ *	host_t *host
  * Use #-modifier to include port number
  */
 int host_printf_hook(char *dst, size_t len, printf_hook_spec_t *spec,
diff --git a/src/libstrongswan/utils/identification.c b/src/libstrongswan/utils/identification.c
index 10daf4679..b0da340bc 100644
--- a/src/libstrongswan/utils/identification.c
+++ b/src/libstrongswan/utils/identification.c
@@ -26,6 +26,7 @@
 
 #include <asn1/oid.h>
 #include <asn1/asn1.h>
+#include <crypto/hashers/hasher.h>
 
 ENUM_BEGIN(id_match_names, ID_MATCH_NONE, ID_MATCH_MAX_WILDCARDS,
 	"MATCH_NONE",
@@ -48,15 +49,14 @@ ENUM_BEGIN(id_type_names, ID_ANY, ID_KEY_ID,
 	"ID_DER_ASN1_DN",
 	"ID_DER_ASN1_GN",
 	"ID_KEY_ID");
-ENUM_NEXT(id_type_names, ID_DER_ASN1_GN_URI, ID_CERT_DER_SHA1, ID_KEY_ID,
-	"ID_DER_ASN1_GN_URI",
-	"ID_PUBKEY_INFO_SHA1",
-	"ID_PUBKEY_SHA1",
-	"ID_CERT_DER_SHA1");
-ENUM_END(id_type_names, ID_CERT_DER_SHA1);
+ENUM_NEXT(id_type_names, ID_DER_ASN1_GN_URI, ID_MYID, ID_KEY_ID,
+	"ID_DER_ASN1_GN_URI"
+	"ID_IETF_ATTR_STRING"
+	"ID_MYID");
+ENUM_END(id_type_names, ID_MYID);
 
 /**
- * coding of X.501 distinguished name 
+ * coding of X.501 distinguished name
  */
 typedef struct {
 	const u_char *name;
@@ -109,12 +109,12 @@ struct private_identification_t {
 	 * Public interface.
 	 */
 	identification_t public;
-	
+
 	/**
 	 * Encoded representation of this ID.
 	 */
 	chunk_t encoded;
-	
+
 	/**
 	 * Type of this ID.
 	 */
@@ -133,14 +133,11 @@ typedef struct {
 	chunk_t seqs;
 } rdn_enumerator_t;
 
-/**
- * Implementation of rdn_enumerator_t.enumerate
- */
-static bool rdn_enumerate(rdn_enumerator_t *this, chunk_t *oid,
-						  u_char *type, chunk_t *data)
+METHOD(enumerator_t, rdn_enumerate, bool,
+	rdn_enumerator_t *this, chunk_t *oid, u_char *type, chunk_t *data)
 {
 	chunk_t rdn;
-	
+
 	/* a DN contains one or more SET, each containing one or more SEQUENCES,
 	 * each containing a OID/value RDN */
 	if (!this->seqs.len)
@@ -155,7 +152,7 @@ static bool rdn_enumerate(rdn_enumerator_t *this, chunk_t *oid,
 		asn1_unwrap(&rdn, oid) == ASN1_OID)
 	{
 		int t = asn1_unwrap(&rdn, data);
-		
+
 		if (t != ASN1_INVALID)
 		{
 			*type = t;
@@ -170,11 +167,15 @@ static bool rdn_enumerate(rdn_enumerator_t *this, chunk_t *oid,
  */
 static enumerator_t* create_rdn_enumerator(chunk_t dn)
 {
-	rdn_enumerator_t *e = malloc_thing(rdn_enumerator_t);
-	
-	e->public.enumerate = (void*)rdn_enumerate;
-	e->public.destroy = (void*)free;
-	
+	rdn_enumerator_t *e;
+
+	INIT(e,
+		.public = {
+			.enumerate = (void*)_rdn_enumerate,
+			.destroy = (void*)free,
+		},
+	);
+
 	/* a DN is a SEQUENCE, get the first SET of it */
 	if (asn1_unwrap(&dn, &e->sets) == ASN1_SEQUENCE)
 	{
@@ -195,11 +196,8 @@ typedef struct {
 	enumerator_t *inner;
 } rdn_part_enumerator_t;
 
-/**
- * Implementation of rdn_part_enumerator_t.enumerate().
- */
-static bool rdn_part_enumerate(rdn_part_enumerator_t *this,
-							   id_part_t *type, chunk_t *data)
+METHOD(enumerator_t, rdn_part_enumerate, bool,
+	rdn_part_enumerator_t *this, id_part_t *type, chunk_t *data)
 {
 	int i, known_oid, strtype;
 	chunk_t oid, inner_data;
@@ -224,7 +222,7 @@ static bool rdn_part_enumerate(rdn_part_enumerator_t *this,
 		{OID_EMAIL_ADDRESS,		ID_PART_RDN_E},
 		{OID_EMPLOYEE_NUMBER,	ID_PART_RDN_EN},
 	};
-	
+
 	while (this->inner->enumerate(this->inner, &oid, &strtype, &inner_data))
 	{
 		known_oid = asn1_known_oid(oid);
@@ -241,30 +239,29 @@ static bool rdn_part_enumerate(rdn_part_enumerator_t *this,
 	return FALSE;
 }
 
-/**
- * Implementation of rdn_part_enumerator_t.destroy().
- */
-static void rdn_part_enumerator_destroy(rdn_part_enumerator_t *this)
+METHOD(enumerator_t, rdn_part_enumerator_destroy, void,
+	rdn_part_enumerator_t *this)
 {
 	this->inner->destroy(this->inner);
 	free(this);
 }
 
-/**
- * Implementation of identification_t.create_part_enumerator
- */
-static enumerator_t* create_part_enumerator(private_identification_t *this)
+METHOD(identification_t, create_part_enumerator, enumerator_t*,
+	private_identification_t *this)
 {
 	switch (this->type)
 	{
 		case ID_DER_ASN1_DN:
 		{
-			rdn_part_enumerator_t *e = malloc_thing(rdn_part_enumerator_t);
-			
-			e->inner = create_rdn_enumerator(this->encoded);
-			e->public.enumerate = (void*)rdn_part_enumerate;
-			e->public.destroy = (void*)rdn_part_enumerator_destroy;
-			
+			rdn_part_enumerator_t *e;
+
+			INIT(e,
+				.inner = create_rdn_enumerator(this->encoded),
+				.public = {
+					.enumerate = (void*)_rdn_part_enumerate,
+					.destroy = _rdn_part_enumerator_destroy,
+				},
+			);
 			return &e->public;
 		}
 		case ID_RFC822_ADDR:
@@ -282,16 +279,16 @@ static enumerator_t* create_part_enumerator(private_identification_t *this)
 static void dntoa(chunk_t dn, char *buf, size_t len)
 {
 	enumerator_t *e;
-	chunk_t oid_data, data;
+	chunk_t oid_data, data, printable;
 	u_char type;
 	int oid, written;
 	bool finished = FALSE;
-	
+
 	e = create_rdn_enumerator(dn);
 	while (e->enumerate(e, &oid_data, &type, &data))
 	{
 		oid = asn1_known_oid(oid_data);
-		
+
 		if (oid == OID_UNKNOWN)
 		{
 			written = snprintf(buf, len, "%#B=", &oid_data);
@@ -302,18 +299,13 @@ static void dntoa(chunk_t dn, char *buf, size_t len)
 		}
 		buf += written;
 		len -= written;
-		
-		if (chunk_printable(data, NULL, '?'))
-		{
-			written = snprintf(buf, len, "%.*s", data.len, data.ptr);
-		}
-		else
-		{
-			written = snprintf(buf, len, "%#B", &data);
-		}
+
+		chunk_printable(data, &printable, '?');
+		written = snprintf(buf, len, "%.*s", printable.len, printable.ptr);
+		chunk_free(&printable);
 		buf += written;
 		len -= written;
-		
+
 		if (data.ptr + data.len != dn.ptr + dn.len)
 		{
 			written = snprintf(buf, len, ", ");
@@ -347,7 +339,7 @@ static status_t atodn(char *src, chunk_t *dn)
 		READ_NAME =		3,
 		UNKNOWN_OID =	4
 	} state_t;
-	
+
 	chunk_t oid  = chunk_empty;
 	chunk_t name = chunk_empty;
 	chunk_t rdns[RDN_MAX];
@@ -358,7 +350,7 @@ static status_t atodn(char *src, chunk_t *dn)
 	asn1_t rdn_type;
 	state_t state = SEARCH_OID;
 	status_t status = SUCCESS;
-	
+
 	do
 	{
 		switch (state)
@@ -379,7 +371,7 @@ static status_t atodn(char *src, chunk_t *dn)
 				else
 				{
 					bool found = FALSE;
-					
+
 					for (i = 0; i < countof(x501rdns); i++)
 					{
 						if (strlen(x501rdns[i].name) == oid.len &&
@@ -424,15 +416,15 @@ static status_t atodn(char *src, chunk_t *dn)
 					rdn_type = (x501rdns[i].type == ASN1_PRINTABLESTRING
 								&& !asn1_is_printablestring(name))
 								? ASN1_T61STRING : x501rdns[i].type;
-					
+
 					if (rdn_count < RDN_MAX)
 					{
 						chunk_t rdn_oid;
-						
+
 						rdn_oid = asn1_build_known_oid(x501rdns[i].oid);
 						if (rdn_oid.len)
 						{
-							rdns[rdn_count] = 
+							rdns[rdn_count] =
 									asn1_wrap(ASN1_SET, "m",
 										asn1_wrap(ASN1_SEQUENCE, "mm",
 											rdn_oid,
@@ -459,20 +451,20 @@ static status_t atodn(char *src, chunk_t *dn)
 				break;
 		}
 	} while (*src++ != '\0');
-	
+
 	/* build the distinguished name sequence */
 	{
 		int i;
 		u_char *pos = asn1_build_object(dn, ASN1_SEQUENCE, dn_len);
-		
+
 		for (i = 0; i < rdn_count; i++)
 		{
-			memcpy(pos, rdns[i].ptr, rdns[i].len); 
+			memcpy(pos, rdns[i].ptr, rdns[i].len);
 			pos += rdns[i].len;
 			free(rdns[i].ptr);
 		}
 	}
-	
+
 	if (status != SUCCESS)
 	{
 		free(dn->ptr);
@@ -481,32 +473,26 @@ static status_t atodn(char *src, chunk_t *dn)
 	return status;
 }
 
-/**
- * Implementation of identification_t.get_encoding.
- */
-static chunk_t get_encoding(private_identification_t *this)
+METHOD(identification_t, get_encoding, chunk_t,
+	private_identification_t *this)
 {
 	return this->encoded;
 }
 
-/**
- * Implementation of identification_t.get_type.
- */
-static id_type_t get_type(private_identification_t *this)
+METHOD(identification_t, get_type, id_type_t,
+	private_identification_t *this)
 {
 	return this->type;
 }
 
-/**
- * Implementation of identification_t.contains_wildcards for ID_DER_ASN1_DN.
- */
-static bool contains_wildcards_dn(private_identification_t *this)
+METHOD(identification_t, contains_wildcards_dn, bool,
+	private_identification_t *this)
 {
 	enumerator_t *enumerator;
 	bool contains = FALSE;
 	id_part_t type;
 	chunk_t data;
-	
+
 	enumerator = create_part_enumerator(this);
 	while (enumerator->enumerate(enumerator, &type, &data))
 	{
@@ -520,27 +506,22 @@ static bool contains_wildcards_dn(private_identification_t *this)
 	return contains;
 }
 
-/**
- * Implementation of identification_t.contains_wildcards using memchr(*).
- */
-static bool contains_wildcards_memchr(private_identification_t *this)
+METHOD(identification_t, contains_wildcards_memchr, bool,
+	private_identification_t *this)
 {
 	return memchr(this->encoded.ptr, '*', this->encoded.len) != NULL;
 }
 
-/**
- * Default implementation of identification_t.equals.
- * compares encoded chunk for equality.
- */
-static bool equals_binary(private_identification_t *this, private_identification_t *other)
+METHOD(identification_t, equals_binary, bool,
+	private_identification_t *this, identification_t *other)
 {
-	if (this->type == other->type)
+	if (this->type == other->get_type(other))
 	{
 		if (this->type == ID_ANY)
 		{
 			return TRUE;
 		}
-		return chunk_equals(this->encoded, other->encoded);
+		return chunk_equals(this->encoded, other->get_encoding(other));
 	}
 	return FALSE;
 }
@@ -554,7 +535,7 @@ static bool compare_dn(chunk_t t_dn, chunk_t o_dn, int *wc)
 	chunk_t t_oid, o_oid, t_data, o_data;
 	u_char t_type, o_type;
 	bool t_next, o_next, finished = FALSE;
-	
+
 	if (wc)
 	{
 		*wc = 0;
@@ -571,14 +552,14 @@ static bool compare_dn(chunk_t t_dn, chunk_t o_dn, int *wc)
 	{
 		return TRUE;
 	}
-	
+
 	t = create_rdn_enumerator(t_dn);
 	o = create_rdn_enumerator(o_dn);
 	while (TRUE)
 	{
 		t_next = t->enumerate(t, &t_oid, &t_type, &t_data);
 		o_next = o->enumerate(o, &o_oid, &o_type, &o_data);
-		
+
 		if (!o_next && !t_next)
 		{
 			break;
@@ -605,8 +586,7 @@ static bool compare_dn(chunk_t t_dn, chunk_t o_dn, int *wc)
 			if (t_type == o_type &&
 				(t_type == ASN1_PRINTABLESTRING ||
 				 (t_type == ASN1_IA5STRING &&
-				  (asn1_known_oid(t_oid) == OID_PKCS9_EMAIL ||
-				   asn1_known_oid(t_oid) == OID_EMAIL_ADDRESS))))
+				  asn1_known_oid(t_oid) == OID_EMAIL_ADDRESS)))
 			{	/* ignore case for printableStrings and email RDNs */
 				if (strncasecmp(t_data.ptr, o_data.ptr, t_data.len) != 0)
 				{
@@ -634,65 +614,55 @@ static bool compare_dn(chunk_t t_dn, chunk_t o_dn, int *wc)
 	return finished;
 }
 
-/**
- * Special implementation of identification_t.equals for ID_DER_ASN1_DN.
- */
-static bool equals_dn(private_identification_t *this,
-					  private_identification_t *other)
+METHOD(identification_t, equals_dn, bool,
+	private_identification_t *this, identification_t *other)
 {
-	return compare_dn(this->encoded, other->encoded, NULL);
+	return compare_dn(this->encoded, other->get_encoding(other), NULL);
 }
 
-/**
- * Special implementation of identification_t.equals for RFC822 and FQDN.
- */
-static bool equals_strcasecmp(private_identification_t *this,
-							  private_identification_t *other)
+METHOD(identification_t, equals_strcasecmp,  bool,
+	private_identification_t *this, identification_t *other)
 {
-	/* we do some extra sanity checks to check for invalid IDs with a 
+	chunk_t encoded = other->get_encoding(other);
+
+	/* we do some extra sanity checks to check for invalid IDs with a
 	 * terminating null in it. */
-	if (this->encoded.len == other->encoded.len &&
+	if (this->encoded.len == encoded.len &&
 		memchr(this->encoded.ptr, 0, this->encoded.len) == NULL &&
-		memchr(other->encoded.ptr, 0, other->encoded.len) == NULL &&
-		strncasecmp(this->encoded.ptr, other->encoded.ptr, this->encoded.len) == 0)
+		memchr(encoded.ptr, 0, encoded.len) == NULL &&
+		strncasecmp(this->encoded.ptr, encoded.ptr, this->encoded.len) == 0)
 	{
 		return TRUE;
 	}
 	return FALSE;
 }
 
-/**
- * Default implementation of identification_t.matches.
- */
-static id_match_t matches_binary(private_identification_t *this, 
-						   private_identification_t *other)
+METHOD(identification_t, matches_binary, id_match_t,
+	private_identification_t *this, identification_t *other)
 {
-	if (other->type == ID_ANY)
+	if (other->get_type(other) == ID_ANY)
 	{
 		return ID_MATCH_ANY;
 	}
-	if (this->type == other->type && 
-		chunk_equals(this->encoded, other->encoded))
+	if (this->type == other->get_type(other) &&
+		chunk_equals(this->encoded, other->get_encoding(other)))
 	{
 		return ID_MATCH_PERFECT;
 	}
 	return ID_MATCH_NONE;
 }
 
-/**
- * Special implementation of identification_t.matches for ID_RFC822_ADDR/ID_FQDN.
- * Checks for a wildcard in other-string, and compares it against this-string.
- */
-static id_match_t matches_string(private_identification_t *this,
-								 private_identification_t *other)
+METHOD(identification_t, matches_string, id_match_t,
+	private_identification_t *this, identification_t *other)
 {
-	u_int len = other->encoded.len;
-	
-	if (other->type == ID_ANY)
+	chunk_t encoded = other->get_encoding(other);
+	u_int len = encoded.len;
+
+	if (other->get_type(other) == ID_ANY)
 	{
 		return ID_MATCH_ANY;
 	}
-	if (this->type != other->type)
+	if (this->type != other->get_type(other))
 	{
 		return ID_MATCH_NONE;
 	}
@@ -707,15 +677,15 @@ static id_match_t matches_string(private_identification_t *this,
 	}
 
 	/* check for single wildcard at the head of the string */
-	if (*other->encoded.ptr == '*')
+	if (*encoded.ptr == '*')
 	{
 		/* single asterisk matches any string */
 		if (len-- == 1)
 		{	/* not better than ID_ANY */
 			return ID_MATCH_ANY;
 		}
-		if (strncasecmp(this->encoded.ptr + this->encoded.len - len, 
-						other->encoded.ptr + 1, len) == 0)
+		if (strncasecmp(this->encoded.ptr + this->encoded.len - len,
+						encoded.ptr + 1, len) == 0)
 		{
 			return ID_MATCH_ONE_WILDCARD;
 		}
@@ -723,36 +693,29 @@ static id_match_t matches_string(private_identification_t *this,
 	return ID_MATCH_NONE;
 }
 
-/**
- * Special implementation of identification_t.matches for ID_ANY.
- * ANY matches only another ANY, but nothing other
- */
-static id_match_t matches_any(private_identification_t *this,
-							  private_identification_t *other)
+METHOD(identification_t, matches_any, id_match_t,
+	private_identification_t *this, identification_t *other)
 {
-	if (other->type == ID_ANY)
+	if (other->get_type(other) == ID_ANY)
 	{
 		return ID_MATCH_ANY;
 	}
 	return ID_MATCH_NONE;
 }
 
-/**
- * Special implementation of identification_t.matches for ID_DER_ASN1_DN
- */
-static id_match_t matches_dn(private_identification_t *this,
-							 private_identification_t *other)
+METHOD(identification_t, matches_dn, id_match_t,
+	private_identification_t *this, identification_t *other)
 {
 	int wc;
-	
-	if (other->type == ID_ANY)
+
+	if (other->get_type(other) == ID_ANY)
 	{
 		return ID_MATCH_ANY;
 	}
-	
-	if (this->type == other->type)
+
+	if (this->type == other->get_type(other))
 	{
-		if (compare_dn(this->encoded, other->encoded, &wc))
+		if (compare_dn(this->encoded, other->get_encoding(other), &wc))
 		{
 			wc = min(wc, ID_MATCH_ONE_WILDCARD - ID_MATCH_MAX_WILDCARDS);
 			return ID_MATCH_PERFECT - wc;
@@ -770,12 +733,12 @@ int identification_printf_hook(char *dst, size_t len, printf_hook_spec_t *spec,
 	private_identification_t *this = *((private_identification_t**)(args[0]));
 	chunk_t proper;
 	char buf[512];
-	
+
 	if (this == NULL)
 	{
 		return print_in_hook(dst, len, "%*s", spec->width, "(null)");
 	}
-	
+
 	switch (this->type)
 	{
 		case ID_ANY:
@@ -810,7 +773,8 @@ int identification_printf_hook(char *dst, size_t len, printf_hook_spec_t *spec,
 			snprintf(buf, sizeof(buf), "(ASN.1 general Name");
 			break;
 		case ID_KEY_ID:
-			if (chunk_printable(this->encoded, NULL, '?'))
+			if (chunk_printable(this->encoded, NULL, '?') &&
+				this->encoded.len != HASH_SIZE_SHA1)
 			{	/* fully printable, use ascii version */
 				snprintf(buf, sizeof(buf), "%.*s",
 						 this->encoded.len, this->encoded.ptr);
@@ -820,10 +784,8 @@ int identification_printf_hook(char *dst, size_t len, printf_hook_spec_t *spec,
 				snprintf(buf, sizeof(buf), "%#B", &this->encoded);
 			}
 			break;
-		case ID_PUBKEY_INFO_SHA1:
-		case ID_PUBKEY_SHA1:
-		case ID_CERT_DER_SHA1:
-			snprintf(buf, sizeof(buf), "%#B", &this->encoded);
+		case ID_MYID:
+			snprintf(buf, sizeof(buf), "%%myid");
 			break;
 		default:
 			snprintf(buf, sizeof(buf), "(unknown ID type: %d)", this->type);
@@ -835,13 +797,12 @@ int identification_printf_hook(char *dst, size_t len, printf_hook_spec_t *spec,
 	}
 	return print_in_hook(dst, len, "%*s", spec->width, buf);
 }
-/**
- * Implementation of identification_t.clone.
- */
-static identification_t *clone_(private_identification_t *this)
+
+METHOD(identification_t, clone, identification_t*,
+	private_identification_t *this)
 {
 	private_identification_t *clone = malloc_thing(private_identification_t);
-	
+
 	memcpy(clone, this, sizeof(private_identification_t));
 	if (this->encoded.len)
 	{
@@ -850,10 +811,8 @@ static identification_t *clone_(private_identification_t *this)
 	return &clone->public;
 }
 
-/**
- * Implementation of identification_t.destroy.
- */
-static void destroy(private_identification_t *this)
+METHOD(identification_t, destroy, void,
+	private_identification_t *this)
 {
 	chunk_free(&this->encoded);
 	free(this);
@@ -864,42 +823,43 @@ static void destroy(private_identification_t *this)
  */
 static private_identification_t *identification_create(id_type_t type)
 {
-	private_identification_t *this = malloc_thing(private_identification_t);
-	
-	this->public.get_encoding = (chunk_t (*) (identification_t*))get_encoding;
-	this->public.get_type = (id_type_t (*) (identification_t*))get_type;
-	this->public.create_part_enumerator = (enumerator_t*(*)(identification_t*))create_part_enumerator;
-	this->public.clone = (identification_t* (*) (identification_t*))clone_;
-	this->public.destroy = (void (*) (identification_t*))destroy;
-	
+	private_identification_t *this;
+
+	INIT(this,
+		.public = {
+			.get_encoding = _get_encoding,
+			.get_type = _get_type,
+			.create_part_enumerator = _create_part_enumerator,
+			.clone = _clone,
+			.destroy = _destroy,
+		},
+		.type = type,
+	);
+
 	switch (type)
 	{
 		case ID_ANY:
-			this->public.matches = (id_match_t (*)(identification_t*,identification_t*))matches_any;
-			this->public.equals = (bool (*) (identification_t*,identification_t*))equals_binary;
-			this->public.contains_wildcards = (bool (*) (identification_t *this))return_true;
+			this->public.matches = _matches_any;
+			this->public.equals = _equals_binary;
+			this->public.contains_wildcards = return_true;
 			break;
 		case ID_FQDN:
 		case ID_RFC822_ADDR:
-			this->public.matches = (id_match_t (*)(identification_t*,identification_t*))matches_string;
-			this->public.equals = (bool (*)(identification_t*,identification_t*))equals_strcasecmp;
-			this->public.contains_wildcards = (bool (*) (identification_t *this))contains_wildcards_memchr;
+			this->public.matches = _matches_string;
+			this->public.equals = _equals_strcasecmp;
+			this->public.contains_wildcards = _contains_wildcards_memchr;
 			break;
 		case ID_DER_ASN1_DN:
-			this->public.equals = (bool (*)(identification_t*,identification_t*))equals_dn;
-			this->public.matches = (id_match_t (*)(identification_t*,identification_t*))matches_dn;
-			this->public.contains_wildcards = (bool (*) (identification_t *this))contains_wildcards_dn;
+			this->public.equals = _equals_dn;
+			this->public.matches = _matches_dn;
+			this->public.contains_wildcards = _contains_wildcards_dn;
 			break;
 		default:
-			this->public.equals = (bool (*) (identification_t*,identification_t*))equals_binary;
-			this->public.matches = (id_match_t (*) (identification_t*,identification_t*))matches_binary;
-			this->public.contains_wildcards = (bool (*) (identification_t *this))return_false;
+			this->public.equals = _equals_binary;
+			this->public.matches = _matches_binary;
+			this->public.contains_wildcards = return_false;
 			break;
 	}
-	
-	this->type = type;
-	this->encoded = chunk_empty;
-	
 	return this;
 }
 
@@ -910,7 +870,7 @@ identification_t *identification_create_from_string(char *string)
 {
 	private_identification_t *this;
 	chunk_t encoded;
-	
+
 	if (string == NULL)
 	{
 		string = "%any";
@@ -951,7 +911,7 @@ identification_t *identification_create_from_string(char *string)
 			{
 				struct in_addr address;
 				chunk_t chunk = {(void*)&address, sizeof(address)};
-				
+
 				if (inet_pton(AF_INET, string, &address) > 0)
 				{	/* is IPv4 */
 					this = identification_create(ID_IPV4_ADDR);
@@ -968,7 +928,7 @@ identification_t *identification_create_from_string(char *string)
 			{
 				struct in6_addr address;
 				chunk_t chunk = {(void*)&address, sizeof(address)};
-				
+
 				if (inet_pton(AF_INET6, string, &address) > 0)
 				{	/* is IPv6 */
 					this = identification_create(ID_IPV6_ADDR);
@@ -1015,11 +975,23 @@ identification_t *identification_create_from_string(char *string)
 /*
  * Described in header.
  */
+identification_t * identification_create_from_data(chunk_t data)
+{
+	char buf[data.len + 1];
+
+	/* use string constructor */
+	snprintf(buf, sizeof(buf), "%.*s", data.len, data.ptr);
+	return identification_create_from_string(buf);
+}
+
+/*
+ * Described in header.
+ */
 identification_t *identification_create_from_encoding(id_type_t type,
 													  chunk_t encoded)
 {
 	private_identification_t *this = identification_create(type);
-	
+
 	/* apply encoded chunk */
 	if (type != ID_ANY)
 	{
@@ -1028,3 +1000,33 @@ identification_t *identification_create_from_encoding(id_type_t type,
 	return &(this->public);
 }
 
+/*
+ * Described in header.
+ */
+identification_t *identification_create_from_sockaddr(sockaddr_t *sockaddr)
+{
+	switch (sockaddr->sa_family)
+	{
+		case AF_INET:
+		{
+			struct in_addr *addr = &(((struct sockaddr_in*)sockaddr)->sin_addr);
+
+			return identification_create_from_encoding(ID_IPV4_ADDR,
+					chunk_create((u_char*)addr, sizeof(struct in_addr)));
+		}
+		case AF_INET6:
+		{
+			struct in6_addr *addr = &(((struct sockaddr_in6*)sockaddr)->sin6_addr);
+
+			return identification_create_from_encoding(ID_IPV6_ADDR,
+					chunk_create((u_char*)addr, sizeof(struct in6_addr)));
+		}
+		default:
+		{
+			private_identification_t *this = identification_create(ID_ANY);
+
+			return &(this->public);
+		}
+	}
+}
+
diff --git a/src/libstrongswan/utils/identification.h b/src/libstrongswan/utils/identification.h
index dc0aec18e..fe5c7d0fd 100644
--- a/src/libstrongswan/utils/identification.h
+++ b/src/libstrongswan/utils/identification.h
@@ -14,7 +14,7 @@
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
  */
- 
+
 /**
  * @defgroup identification identification
  * @{ @ingroup utils
@@ -29,9 +29,10 @@ typedef struct identification_t identification_t;
 typedef enum id_match_t id_match_t;
 typedef enum id_part_t id_part_t;
 
-#include <library.h>
+#include <chunk.h>
+#include <utils/enumerator.h>
 
-/** 
+/**
  * Matches returned from identification_t.match
  */
 enum id_match_t {
@@ -79,8 +80,8 @@ enum id_type_t {
 	 * An example of an ID_RFC822_ADDR is "jsmith@example.com".
 	 * The string MUST NOT contain any terminators.
 	 */
-	ID_USER_FQDN   = 3,    /* IKEv1 only */
-	ID_RFC822_ADDR = 3,    /* IKEv2 only */
+	ID_USER_FQDN   = 3,	/* IKEv1 only */
+	ID_RFC822_ADDR = 3,	/* IKEv2 only */
 
 	/**
 	 * ID data is an IPv4 subnet (IKEv1 only)
@@ -128,31 +129,16 @@ enum id_type_t {
 	 * private type which represents a GeneralName of type URI
 	 */
 	ID_DER_ASN1_GN_URI = 201,
-	
-	/**
-	 * SHA1 hash over PKCS#1 subjectPublicKeyInfo
-	 */
-	ID_PUBKEY_INFO_SHA1 = 202,
-	
-	/**
-	 * SHA1 hash over PKCS#1 subjectPublicKey
-	 */
-	ID_PUBKEY_SHA1 = 203,
-	
-	/**
-	 * SHA1 hash of the binary DER encoding of a certificate
-	 */
-	ID_CERT_DER_SHA1 = 204,
 
 	/**
 	 * IETF Attribute Syntax String (RFC 3281)
 	 */
-	ID_IETF_ATTR_STRING = 205,
+	ID_IETF_ATTR_STRING = 202,
 
 	/**
 	 * Private ID used by the pluto daemon for opportunistic encryption
 	 */
-	ID_MYID = 206,
+	ID_MYID = 203,
 };
 
 /**
@@ -168,14 +154,14 @@ enum id_part_t {
 	ID_PART_USERNAME,
 	/** Domain part of an RFC822_ADDR */
 	ID_PART_DOMAIN,
-	
+
 	/** Top-Level domain of a FQDN */
 	ID_PART_TLD,
 	/** Second-Level domain of a FQDN */
 	ID_PART_SLD,
 	/** Another Level domain of a FQDN */
 	ID_PART_ALD,
-	
+
 	/** Country RDN of a DN */
 	ID_PART_RDN_C,
 	/** CommonName RDN of a DN */
@@ -212,40 +198,40 @@ enum id_part_t {
 
 /**
  * Generic identification, such as used in ID payload.
- * 
+ *
  * @todo Support for ID_DER_ASN1_GN is minimal right now. Comparison
  * between them and ID_IPV4_ADDR/RFC822_ADDR would be nice.
  */
 struct identification_t {
-	
+
 	/**
 	 * Get the encoding of this id, to send over
 	 * the network.
-	 * 
+	 *
 	 * Result points to internal data, do not free.
-	 * 
+	 *
 	 * @return 			a chunk containing the encoded bytes
 	 */
 	chunk_t (*get_encoding) (identification_t *this);
-	
+
 	/**
 	 * Get the type of this identification.
-	 * 
+	 *
 	 * @return 			id_type_t
 	 */
 	id_type_t (*get_type) (identification_t *this);
-	
+
 	/**
 	 * Check if two identification_t objects are equal.
-	 * 
+	 *
 	 * @param other		other identification_t object
 	 * @return 			TRUE if the IDs are equal
 	 */
 	bool (*equals) (identification_t *this, identification_t *other);
-	
+
 	/**
 	 * Check if an ID matches a wildcard ID.
-	 * 
+	 *
 	 * An identification_t may contain wildcards, such as
 	 * *.strongswan.org. This call checks if a given ID
 	 * (e.g. tester.strongswan.org) belongs to a such wildcard
@@ -256,24 +242,24 @@ struct identification_t {
 	 *
 	 * The larger the return value is, the better is the match. Zero means
 	 * no match at all, 1 means a bad match, and 2 a slightly better match.
-	 * 
+	 *
 	 * @param other		the ID containing one or more wildcards
 	 * @param wildcards	returns the number of wildcards, may be NULL
 	 * @return 			match value as described above
 	 */
 	id_match_t (*matches) (identification_t *this, identification_t *other);
-	
+
 	/**
 	 * Check if an ID is a wildcard ID.
 	 *
 	 * If the ID represents multiple IDs (with wildcards, or
 	 * as the type ID_ANY), TRUE is returned. If it is unique,
 	 * FALSE is returned.
-	 * 
+	 *
 	 * @return 			TRUE if ID contains wildcards
 	 */
 	bool (*contains_wildcards) (identification_t *this);
-	
+
 	/**
 	 * Create an enumerator over subparts of an identity.
 	 *
@@ -286,10 +272,10 @@ struct identification_t {
 	 * @return			an enumerator over (id_part_t type, chunk_t data)
 	 */
 	enumerator_t* (*create_part_enumerator)(identification_t *this);
-	
+
 	/**
 	 * Clone a identification_t instance.
-	 * 
+	 *
 	 * @return 			clone of this
 	 */
 	identification_t *(*clone) (identification_t *this);
@@ -314,23 +300,31 @@ struct identification_t {
  * pluto resolves domainnames without an @ to IPv4 addresses. Since
  * we use a seperate host_t class for addresses, this doesn't
  * make sense for us.
- * 
+ *
  * A distinguished name may contain one or more of the following RDNs:
  * ND, UID, DC, CN, S, SN, serialNumber, C, L, ST, O, OU, T, D,
- * N, G, I, ID, EN, EmployeeNumber, E, Email, emailAddress, UN, 
+ * N, G, I, ID, EN, EmployeeNumber, E, Email, emailAddress, UN,
  * unstructuredName, TCGID.
- * 
+ *
  * This constructor never returns NULL. If it does not find a suitable
  * conversion function, it will copy the string to an ID_KEY_ID.
- * 
+ *
  * @param string	input string, which will be converted
  * @return			identification_t
  */
 identification_t * identification_create_from_string(char *string);
 
 /**
+ * Creates an identification from a chunk of data, guessing its type.
+ *
+ * @param data		identification data
+ * @return			identification_t
+ */
+identification_t * identification_create_from_data(chunk_t data);
+
+/**
  * Creates an identification_t object from an encoded chunk.
- * 
+ *
  * @param type		type of this id, such as ID_IPV4_ADDR
  * @param encoded	encoded bytes, such as from identification_t.get_encoding
  * @return			identification_t
@@ -338,10 +332,18 @@ identification_t * identification_create_from_string(char *string);
 identification_t * identification_create_from_encoding(id_type_t type, chunk_t encoded);
 
 /**
+ * Creates an identification_t object from a sockaddr struct
+ *
+ * @param sockaddr		sockaddr struct which contains family and address
+ * @return 				identification_t
+ */
+identification_t * identification_create_from_sockaddr(sockaddr_t *sockaddr);
+
+/**
  * printf hook function for identification_t.
  *
- * Arguments are: 
- *    identification_t *identification
+ * Arguments are:
+ *	identification_t *identification
  */
 int identification_printf_hook(char *dst, size_t len, printf_hook_spec_t *spec,
 							   const void *const *args);
diff --git a/src/libstrongswan/utils/iterator.h b/src/libstrongswan/utils/iterator.h
index 1dbf01539..9be65b229 100644
--- a/src/libstrongswan/utils/iterator.h
+++ b/src/libstrongswan/utils/iterator.h
@@ -13,7 +13,7 @@
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
  */
- 
+
 /**
  * @defgroup iterator iterator
  * @{ @ingroup utils
@@ -39,45 +39,45 @@ struct iterator_t {
 
 	/**
 	 * Return number of list items.
-	 * 
+	 *
 	 * @return				number of list items
 	 */
 	int (*get_count) (iterator_t *this);
-	
+
 	/**
 	 * Iterate over all items.
-	 * 
+	 *
 	 * The easy way to iterate over items.
-	 * 
+	 *
 	 * @param value 	item
 	 * @return			TRUE, if there was an element available, FALSE otherwise
 	 */
 	bool (*iterate) (iterator_t *this, void** value);
-	
+
 	/**
 	 * Inserts a new item before the given iterator position.
-	 * 
+	 *
 	 * The iterator position is not changed after inserting
-	 * 
+	 *
 	 * @param item 		value to insert in list
 	 */
 	void (*insert_before) (iterator_t *this, void *item);
 
 	/**
 	 * Inserts a new item after the given iterator position.
-	 * 
+	 *
 	 * The iterator position is not changed after inserting.
-	 * 
+	 *
 	 * @param this 		calling iterator
 	 * @param item 		value to insert in list
 	 */
 	void (*insert_after) (iterator_t *this, void *item);
-	
+
 	/**
 	 * Replace the current item at current iterator position.
-	 * 
+	 *
 	 * The iterator position is not changed after replacing.
-	 * 
+	 *
 	 * @param this 		calling iterator
 	 * @param old		old value will be written here(can be NULL)
 	 * @param new		new value
@@ -87,18 +87,18 @@ struct iterator_t {
 
 	/**
 	 * Removes an element from list at the given iterator position.
-	 * 
+	 *
 	 * The iterator is set the the following position:
 	 * - to the item before, if available
 	 * - it gets reseted, otherwise
-	 * 
+	 *
 	 * @return 				SUCCESS, FAILED if iterator is on an invalid position
 	 */
 	status_t (*remove) (iterator_t *this);
-	
+
 	/**
 	 * Resets the iterator position.
-	 * 
+	 *
 	 * After reset, the iterator_t objects doesn't point to an element.
 	 * A call to iterator_t.has_next is necessary to do any other operations
 	 * with the resetted iterator.
diff --git a/src/libstrongswan/utils/leak_detective.c b/src/libstrongswan/utils/leak_detective.c
index 2cac3b458..2c2a36af3 100644
--- a/src/libstrongswan/utils/leak_detective.c
+++ b/src/libstrongswan/utils/leak_detective.c
@@ -12,14 +12,14 @@
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
  */
-	
+
 #define _GNU_SOURCE
 #include <sched.h>
 #include <stddef.h>
 #include <string.h>
 #include <stdio.h>
 #include <malloc.h>
-#include <signal.h> 
+#include <signal.h>
 #include <sys/socket.h>
 #include <netinet/in.h>
 #include <arpa/inet.h>
@@ -90,32 +90,32 @@ typedef struct memory_tail_t memory_tail_t;
  * Header which is prepended to each allocated memory block
  */
 struct memory_header_t {
-	
+
 	/**
 	 * Number of bytes following after the header
 	 */
 	u_int bytes;
-	
+
 	/**
 	 * Pointer to previous entry in linked list
 	 */
 	memory_header_t *previous;
-	
+
 	/**
 	 * Pointer to next entry in linked list
 	 */
 	memory_header_t *next;
-	
+
 	/**
 	 * backtrace taken during (re-)allocation
 	 */
 	backtrace_t *backtrace;
-	
+
 	/**
 	 * magic bytes to detect bad free or heap underflow, MEMORY_HEADER_MAGIC
 	 */
 	u_int32_t magic;
-	
+
 }__attribute__((__packed__));
 
 /**
@@ -127,11 +127,11 @@ struct memory_tail_t {
 	 * Magic bytes to detect heap overflow, MEMORY_TAIL_MAGIC
 	 */
 	u_int32_t magic;
-	
+
 }__attribute__((__packed__));
 
 /**
- * first mem header is just a dummy to chain 
+ * first mem header is just a dummy to chain
  * the others on it...
  */
 static memory_header_t first_header = {
@@ -143,7 +143,7 @@ static memory_header_t first_header = {
 };
 
 /**
- * are the hooks currently installed? 
+ * are the hooks currently installed?
  */
 static bool installed = FALSE;
 
@@ -151,7 +151,7 @@ static bool installed = FALSE;
  * Leak report white list
  *
  * List of functions using static allocation buffers or should be suppressed
- * otherwise on leak report. 
+ * otherwise on leak report.
  */
 char *whitelist[] = {
 	/* backtraces, including own */
@@ -170,11 +170,14 @@ char *whitelist[] = {
 	"getprotobynumber",
 	"getservbyport",
 	"getservbyname",
+	"gethostbyname2",
 	"gethostbyname_r",
 	"gethostbyname2_r",
+	"getnetbyname",
 	"getpwnam_r",
 	"getgrnam_r",
 	"register_printf_function",
+	"register_printf_specifier",
 	"syslog",
 	"vsyslog",
 	"getaddrinfo",
@@ -193,6 +196,8 @@ char *whitelist[] = {
 	"xmlInitCharEncodingHandlers",
 	"xmlInitParser",
 	"xmlInitParserCtxt",
+	/* libcurl */
+	"Curl_client_write",
 	/* ClearSilver */
 	"nerr_init",
 	/* OpenSSL */
@@ -200,6 +205,7 @@ char *whitelist[] = {
 	"DH_new_method",
 	"ENGINE_load_builtin_engines",
 	"OPENSSL_config",
+	"ecdsa_check",
 	/* libgcrypt */
 	"gcry_control",
 	"gcry_check_version",
@@ -230,7 +236,7 @@ void report_leaks()
 {
 	memory_header_t *hdr;
 	int leaks = 0, whitelisted = 0;
-	
+
 	for (hdr = first_header.next; hdr != NULL; hdr = hdr->next)
 	{
 		if (is_whitelisted(hdr->backtrace))
@@ -245,7 +251,7 @@ void report_leaks()
 			leaks++;
 		}
 	}
-		
+
 	switch (leaks)
 	{
 		case 0:
@@ -300,14 +306,14 @@ void *malloc_hook(size_t bytes, const void *caller)
 	memory_header_t *hdr;
 	memory_tail_t *tail;
 	pthread_t thread_id = pthread_self();
-    int oldpolicy;
-    struct sched_param oldparams, params;
-    
-    pthread_getschedparam(thread_id, &oldpolicy, &oldparams);
-    
-    params.__sched_priority = sched_get_priority_max(SCHED_FIFO);
+	int oldpolicy;
+	struct sched_param oldparams, params;
+
+	pthread_getschedparam(thread_id, &oldpolicy, &oldparams);
+
+	params.__sched_priority = sched_get_priority_max(SCHED_FIFO);
 	pthread_setschedparam(thread_id, SCHED_FIFO, &params);
-	
+
 	count_malloc++;
 	uninstall_hooks();
 	hdr = malloc(sizeof(memory_header_t) + bytes + sizeof(memory_tail_t));
@@ -315,13 +321,13 @@ void *malloc_hook(size_t bytes, const void *caller)
 	/* set to something which causes crashes */
 	memset(hdr, MEMORY_ALLOC_PATTERN,
 		   sizeof(memory_header_t) + bytes + sizeof(memory_tail_t));
-	
+
 	hdr->magic = MEMORY_HEADER_MAGIC;
 	hdr->bytes = bytes;
 	hdr->backtrace = backtrace_create(3);
 	tail->magic = MEMORY_TAIL_MAGIC;
 	install_hooks();
-	
+
 	/* insert at the beginning of the list */
 	hdr->next = first_header.next;
 	if (hdr->next)
@@ -330,9 +336,9 @@ void *malloc_hook(size_t bytes, const void *caller)
 	}
 	hdr->previous = &first_header;
 	first_header.next = hdr;
-	
+
 	pthread_setschedparam(thread_id, oldpolicy, &oldparams);
-	
+
 	return hdr + 1;
 }
 
@@ -341,13 +347,14 @@ void *malloc_hook(size_t bytes, const void *caller)
  */
 void free_hook(void *ptr, const void *caller)
 {
-	memory_header_t *hdr;
+	memory_header_t *hdr, *current;
 	memory_tail_t *tail;
-    backtrace_t *backtrace;
+	backtrace_t *backtrace;
 	pthread_t thread_id = pthread_self();
-    int oldpolicy;
-    struct sched_param oldparams, params;
-    
+	int oldpolicy;
+	struct sched_param oldparams, params;
+	bool found = FALSE;
+
 	/* allow freeing of NULL */
 	if (ptr == NULL)
 	{
@@ -355,20 +362,37 @@ void free_hook(void *ptr, const void *caller)
 	}
 	hdr = ptr - sizeof(memory_header_t);
 	tail = ptr + hdr->bytes;
-	
+
 	pthread_getschedparam(thread_id, &oldpolicy, &oldparams);
-	
-    params.__sched_priority = sched_get_priority_max(SCHED_FIFO);
+
+	params.__sched_priority = sched_get_priority_max(SCHED_FIFO);
 	pthread_setschedparam(thread_id, SCHED_FIFO, &params);
-	
+
 	count_free++;
 	uninstall_hooks();
 	if (hdr->magic != MEMORY_HEADER_MAGIC ||
 		tail->magic != MEMORY_TAIL_MAGIC)
 	{
-		fprintf(stderr, "freeing invalid memory (%p): "
-				"header magic 0x%x, tail magic 0x%x:\n",
-				ptr, hdr->magic, tail->magic);
+		for (current = &first_header; current != NULL; current = current->next)
+		{
+			if (current == hdr)
+			{
+				found = TRUE;
+				break;
+			}
+		}
+		if (found)
+		{
+			/* memory was allocated by our hooks but is corrupted */
+			fprintf(stderr, "freeing corrupted memory (%p): "
+					"header magic 0x%x, tail magic 0x%x:\n",
+					ptr, hdr->magic, tail->magic);
+		}
+		else
+		{
+			/* memory was not allocated by our hooks */
+			fprintf(stderr, "freeing invalid memory (%p)", ptr);
+		}
 		backtrace = backtrace_create(3);
 		backtrace->log(backtrace, stderr);
 		backtrace->destroy(backtrace);
@@ -382,13 +406,14 @@ void free_hook(void *ptr, const void *caller)
 		}
 		hdr->previous->next = hdr->next;
 		hdr->backtrace->destroy(hdr->backtrace);
-		
+
 		/* clear MAGIC, set mem to something remarkable */
-		memset(hdr, MEMORY_FREE_PATTERN, hdr->bytes + sizeof(memory_header_t));
-		
+		memset(hdr, MEMORY_FREE_PATTERN,
+			   sizeof(memory_header_t) + hdr->bytes + sizeof(memory_tail_t));
+
 		free(hdr);
 	}
-	
+
 	install_hooks();
 	pthread_setschedparam(thread_id, oldpolicy, &oldparams);
 }
@@ -402,23 +427,23 @@ void *realloc_hook(void *old, size_t bytes, const void *caller)
 	memory_tail_t *tail;
 	backtrace_t *backtrace;
 	pthread_t thread_id = pthread_self();
-    int oldpolicy;
-    struct sched_param oldparams, params;
-    
+	int oldpolicy;
+	struct sched_param oldparams, params;
+
 	/* allow reallocation of NULL */
 	if (old == NULL)
 	{
 		return malloc_hook(bytes, caller);
 	}
-	
+
 	hdr = old - sizeof(memory_header_t);
 	tail = old + hdr->bytes;
-	
+
 	pthread_getschedparam(thread_id, &oldpolicy, &oldparams);
-	
+
 	params.__sched_priority = sched_get_priority_max(SCHED_FIFO);
 	pthread_setschedparam(thread_id, SCHED_FIFO, &params);
-	
+
 	count_realloc++;
 	uninstall_hooks();
 	if (hdr->magic != MEMORY_HEADER_MAGIC ||
@@ -472,21 +497,21 @@ static void destroy(private_leak_detective_t *this)
 leak_detective_t *leak_detective_create()
 {
 	private_leak_detective_t *this = malloc_thing(private_leak_detective_t);
-	
+
 	this->public.destroy = (void(*)(leak_detective_t*))destroy;
-	
+
 	if (getenv("LEAK_DETECTIVE_DISABLE") == NULL)
 	{
 		cpu_set_t mask;
-		
+
 		CPU_ZERO(&mask);
 		CPU_SET(0, &mask);
-		
+
 		if (sched_setaffinity(0, sizeof(cpu_set_t), &mask) != 0)
 		{
 			fprintf(stderr, "setting CPU affinity failed: %m");
 		}
-	
+
 		lib->leak_detective = TRUE;
 		install_hooks();
 	}
diff --git a/src/libstrongswan/utils/leak_detective.h b/src/libstrongswan/utils/leak_detective.h
index cd30dcd5f..181f8f3db 100644
--- a/src/libstrongswan/utils/leak_detective.h
+++ b/src/libstrongswan/utils/leak_detective.h
@@ -32,11 +32,11 @@ typedef struct leak_detective_t leak_detective_t;
  * and dynamic whitelisting.
  */
 struct leak_detective_t {
-		
+
 	/**
-     * Destroy a leak_detective instance.
-     */
-    void (*destroy)(leak_detective_t *this);
+	 * Destroy a leak_detective instance.
+	 */
+	void (*destroy)(leak_detective_t *this);
 };
 
 /**
diff --git a/src/libstrongswan/utils/lexparser.c b/src/libstrongswan/utils/lexparser.c
index 2472f6751..b0aced180 100644
--- a/src/libstrongswan/utils/lexparser.c
+++ b/src/libstrongswan/utils/lexparser.c
@@ -40,31 +40,31 @@ bool match(const char *pattern, const chunk_t *ch)
 bool extract_token(chunk_t *token, const char termination, chunk_t *src)
 {
 	u_char *eot = memchr(src->ptr, termination, src->len);
-	
+
 	if (termination == ' ')
 	{
 		u_char *eot_tab = memchr(src->ptr, '\t', src->len);
-		
+
 		/* check if a tab instead of a space terminates the token */
 		eot = ( eot_tab == NULL || (eot && eot < eot_tab) ) ? eot : eot_tab;
 	}
-	
+
 	/* initialize empty token */
 	*token = chunk_empty;
-	
+
 	if (eot == NULL) /* termination symbol not found */
 	{
 		return FALSE;
 	}
-	
+
 	/* extract token */
 	token->ptr = src->ptr;
 	token->len = (u_int)(eot - src->ptr);
-	
+
 	/* advance src pointer after termination symbol */
 	src->ptr = eot + 1;
 	src->len -= (token->len + 1);
-	
+
 	return TRUE;
 }
 
@@ -75,23 +75,23 @@ bool extract_token_str(chunk_t *token, const char *termination, chunk_t *src)
 {
 	u_char *eot = memstr(src->ptr, termination, src->len);
 	size_t l = strlen(termination);
-	
+
 	/* initialize empty token */
 	*token = chunk_empty;
-	
+
 	if (eot == NULL) /* termination string not found */
 	{
 		return FALSE;
 	}
-	
+
 	/* extract token */
 	token->ptr = src->ptr;
 	token->len = (u_int)(eot - src->ptr);
-	
+
 	/* advance src pointer after termination string */
 	src->ptr = eot + l;
 	src->len -= (token->len + l);
-	
+
 	return TRUE;
 }
 
diff --git a/src/libstrongswan/utils/lexparser.h b/src/libstrongswan/utils/lexparser.h
index 7e2edb278..7eb68069b 100644
--- a/src/libstrongswan/utils/lexparser.h
+++ b/src/libstrongswan/utils/lexparser.h
@@ -13,7 +13,7 @@
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
  */
- 
+
 /**
  * @defgroup lexparser lexparser
  * @{ @ingroup utils
diff --git a/src/libstrongswan/utils/linked_list.c b/src/libstrongswan/utils/linked_list.c
index a45468cca..4aa8ea6ca 100644
--- a/src/libstrongswan/utils/linked_list.c
+++ b/src/libstrongswan/utils/linked_list.c
@@ -33,14 +33,14 @@ struct element_t {
 
 	/**
 	 * Previous list element.
-	 * 
+	 *
 	 * NULL if first element in list.
 	 */
 	element_t *previous;
-	
+
 	/**
 	 * Next list element.
-	 * 
+	 *
 	 * NULL if last element in list.
 	 */
 	element_t *next;
@@ -52,11 +52,11 @@ struct element_t {
 element_t *element_create(void *value)
 {
 	element_t *this = malloc_thing(element_t);
-	
+
 	this->previous = NULL;
 	this->next = NULL;
 	this->value = value;
-	
+
 	return (this);
 }
 
@@ -83,7 +83,7 @@ struct private_linked_list_t {
 	 * NULL if no elements in list.
 	 */
 	element_t *first;
-	
+
 	/**
 	 * Last element in list.
 	 * NULL if no elements in list.
@@ -130,12 +130,12 @@ struct private_enumerator_t {
 	 * implements enumerator interface
 	 */
 	enumerator_t enumerator;
-	
+
 	/**
 	 * associated linked list
 	 */
 	private_linked_list_t *list;
-	
+
 	/**
 	 * current item
 	 */
@@ -173,12 +173,12 @@ static bool enumerate(private_enumerator_t *this, void **item)
 static enumerator_t* create_enumerator(private_linked_list_t *this)
 {
 	private_enumerator_t *enumerator = malloc_thing(private_enumerator_t);
-	
+
 	enumerator->enumerator.enumerate = (void*)enumerate;
 	enumerator->enumerator.destroy = (void*)free;
 	enumerator->list = this;
 	enumerator->current = NULL;
-	
+
 	return &enumerator->enumerator;
 }
 
@@ -273,7 +273,7 @@ static status_t iterator_remove(private_iterator_t *this)
 		this->current->previous->next = this->current->next;
 		this->current->next->previous = this->current->previous;
 	}
-	
+
 	this->list->count--;
 	free(this->current);
 	/* set the new iterator position */
@@ -290,7 +290,7 @@ static void insert_before(private_iterator_t * iterator, void *item)
 	{
 		iterator->list->public.insert_first(&(iterator->list->public), item);
 	}
-	
+
 	element_t *element = element_create(item);
 	if (iterator->current->previous == NULL)
 	{
@@ -322,7 +322,7 @@ static status_t replace(private_iterator_t *this, void **old_item, void *new_ite
 		*old_item = this->current->value;
 	}
 	this->current->value = new_item;
-	
+
 	return SUCCESS;
 }
 
@@ -336,7 +336,7 @@ static void insert_after(private_iterator_t *iterator, void *item)
 		iterator->list->public.insert_first(&(iterator->list->public),item);
 		return;
 	}
-	
+
 	element_t *element = element_create(item);
 	if (iterator->current->next == NULL)
 	{
@@ -376,7 +376,7 @@ static int get_count(private_linked_list_t *this)
 static void insert_first(private_linked_list_t *this, void *item)
 {
 	element_t *element;
-	
+
 	element = element_create(item);
 	if (this->count == 0)
 	{
@@ -407,7 +407,7 @@ static element_t* remove_element(private_linked_list_t *this, element_t *element
 	next = element->next;
 	previous = element->previous;
 	free(element);
-	if (next) 
+	if (next)
 	{
 		next->previous = previous;
 	}
@@ -463,7 +463,7 @@ static status_t remove_first(private_linked_list_t *this, void **item)
 static void insert_last(private_linked_list_t *this, void *item)
 {
 	element_t *element = element_create(item);
-	
+
 	if (this->count == 0)
 	{
 		/* first entry in list */
@@ -508,7 +508,7 @@ static status_t remove_last(private_linked_list_t *this, void **item)
 	}
 	return NOT_FOUND;
 }
-	
+
 /**
  * Implementation of linked_list_t.remove.
  */
@@ -517,7 +517,7 @@ static int remove_(private_linked_list_t *this, void *item,
 {
 	element_t *current = this->first;
 	int removed = 0;
-	
+
 	while (current)
 	{
 		if ((compare && compare(current->value, item)) ||
@@ -556,7 +556,7 @@ static status_t find_first(private_linked_list_t *this, linked_list_match_t matc
 		void **item, void *d1, void *d2, void *d3, void *d4, void *d5)
 {
 	element_t *current = this->first;
-	
+
 	while (current)
 	{
 		if ((match && match(current->value, d1, d2, d3, d4, d5)) ||
@@ -580,7 +580,7 @@ static status_t find_last(private_linked_list_t *this, linked_list_match_t match
 		void **item, void *d1, void *d2, void *d3, void *d4, void *d5)
 {
 	element_t *current = this->last;
-	
+
 	while (current)
 	{
 		if ((match && match(current->value, d1, d2, d3, d4, d5)) ||
@@ -604,7 +604,7 @@ static void invoke_offset(private_linked_list_t *this, size_t offset,
 		void *d1, void *d2, void *d3, void *d4, void *d5)
 {
 	element_t *current = this->first;
-	
+
 	while (current)
 	{
 		linked_list_invoke_t *method = current->value + offset;
@@ -620,7 +620,7 @@ static void invoke_function(private_linked_list_t *this, linked_list_invoke_t fn
 		void *d1, void *d2, void *d3, void *d4, void *d5)
 {
 	element_t *current = this->first;
-	
+
 	while (current)
 	{
 		fn(current->value, d1, d2, d3, d4, d5);
@@ -635,14 +635,14 @@ static linked_list_t *clone_offset(private_linked_list_t *this, size_t offset)
 {
 	linked_list_t *clone = linked_list_create();
 	element_t *current = this->first;
-	
+
 	while (current)
 	{
 		void* (**method)(void*) = current->value + offset;
 		clone->insert_last(clone, (*method)(current->value));
 		current = current->next;
 	}
-	
+
 	return clone;
 }
 
@@ -653,13 +653,13 @@ static linked_list_t *clone_function(private_linked_list_t *this, void* (*fn)(vo
 {
 	linked_list_t *clone = linked_list_create();
 	element_t *current = this->first;
-	
+
 	while (current)
 	{
 		clone->insert_last(clone, fn(current->value));
 		current = current->next;
 	}
-	
+
 	return clone;
 }
 
@@ -684,7 +684,7 @@ static void destroy(private_linked_list_t *this)
 static void destroy_offset(private_linked_list_t *this, size_t offset)
 {
 	element_t *current = this->first, *next;
-	
+
 	while (current)
 	{
 		void (**method)(void*) = current->value + offset;
@@ -702,7 +702,7 @@ static void destroy_offset(private_linked_list_t *this, size_t offset)
 static void destroy_function(private_linked_list_t *this, void (*fn)(void*))
 {
 	element_t *current = this->first, *next;
-	
+
 	while (current)
 	{
 		fn(current->value);
@@ -719,7 +719,7 @@ static void destroy_function(private_linked_list_t *this, void (*fn)(void*))
 static iterator_t *create_iterator(private_linked_list_t *linked_list, bool forward)
 {
 	private_iterator_t *this = malloc_thing(private_iterator_t);
-	
+
 	this->public.get_count = (int (*) (iterator_t*)) get_list_count;
 	this->public.iterate = (bool (*) (iterator_t*, void **value)) iterate;
 	this->public.insert_before = (void (*) (iterator_t*, void *item)) insert_before;
@@ -728,11 +728,11 @@ static iterator_t *create_iterator(private_linked_list_t *linked_list, bool forw
 	this->public.remove = (status_t (*) (iterator_t*)) iterator_remove;
 	this->public.reset = (void (*) (iterator_t*)) iterator_reset;
 	this->public.destroy = (void (*) (iterator_t*)) iterator_destroy;
-	
+
 	this->forward = forward;
 	this->current = NULL;
 	this->list = linked_list;
-	
+
 	return &this->public;
 }
 
diff --git a/src/libstrongswan/utils/linked_list.h b/src/libstrongswan/utils/linked_list.h
index 8b2de9083..ba5f28f6a 100644
--- a/src/libstrongswan/utils/linked_list.h
+++ b/src/libstrongswan/utils/linked_list.h
@@ -14,7 +14,7 @@
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
  */
- 
+
 /**
  * @defgroup linked_list linked_list
  * @{ @ingroup utils
@@ -56,24 +56,24 @@ struct linked_list_t {
 
 	/**
 	 * Gets the count of items in the list.
-	 * 
+	 *
 	 * @return 			number of items in list
 	 */
 	int (*get_count) (linked_list_t *this);
-	
+
 	/**
 	 * Creates a iterator for the given list.
-	 * 
+	 *
 	 * @warning Created iterator_t object has to get destroyed by the caller.
 	 *
 	 * @deprecated Iterator is obsolete and will disappear, it is too
 	 * complicated to implement. Use enumerator instead.
-	 * 
+	 *
 	 * @param forward 	iterator direction (TRUE: front to end)
 	 * @return			new iterator_t object
 	 */
 	iterator_t *(*create_iterator) (linked_list_t *this, bool forward);
-	
+
 	/**
 	 * Create an enumerator over the list.
 	 *
@@ -83,7 +83,7 @@ struct linked_list_t {
 	 * @return			enumerator over list items
 	 */
 	enumerator_t* (*create_enumerator)(linked_list_t *this);
-	
+
 	/**
 	 * Inserts a new item at the beginning of the list.
 	 *
@@ -93,22 +93,22 @@ struct linked_list_t {
 
 	/**
 	 * Removes the first item in the list and returns its value.
-	 * 
+	 *
 	 * @param item 		returned value of first item, or NULL
 	 * @return			SUCCESS, or NOT_FOUND if list is empty
 	 */
 	status_t (*remove_first) (linked_list_t *this, void **item);
-	
+
 	/**
 	 * Remove an item from the list where the enumerator points to.
 	 *
 	 * @param enumerator enumerator with position
 	 */
 	void (*remove_at)(linked_list_t *this, enumerator_t *enumerator);
-	
+
 	/**
 	 * Remove items from the list matching item.
-	 * 
+	 *
 	 * If a compare function is given, it is called for each item, where
 	 * the first parameter is the current list item and the second parameter
 	 * is the supplied item parameter.
@@ -119,11 +119,11 @@ struct linked_list_t {
 	 * @return			number of removed items
 	 */
 	int (*remove)(linked_list_t *this, void *item, bool (*compare)(void *,void*));
-	
+
 	/**
 	 * Returns the value of the first list item without removing it.
-	 * 
-	 * @param this	 	calling object
+	 *
+	 * @param this		calling object
 	 * @param item		returned value of first item
 	 * @return			SUCCESS, NOT_FOUND if list is empty
 	 */
@@ -131,15 +131,15 @@ struct linked_list_t {
 
 	/**
 	 * Inserts a new item at the end of the list.
-	 * 
+	 *
 	 * @param item 		value to insert into list
 	 */
 	void (*insert_last) (linked_list_t *this, void *item);
 
 	/**
 	 * Removes the last item in the list and returns its value.
-	 * 
-	 * @param this	 	calling object
+	 *
+	 * @param this		calling object
 	 * @param item		returned value of last item, or NULL
 	 * @return			SUCCESS, NOT_FOUND if list is empty
 	 */
@@ -147,15 +147,15 @@ struct linked_list_t {
 
 	/**
 	 * Returns the value of the last list item without removing it.
-	 * 
+	 *
 	 * @param this 		calling object
 	 * @param item		returned value of last item
 	 * @return			SUCCESS, NOT_FOUND if list is empty
 	 */
 	status_t (*get_last) (linked_list_t *this, void **item);
-	
+
 	/** Find the first matching element in the list.
-	 * 
+	 *
 	 * The first object passed to the match function is the current list item,
 	 * followed by the user supplied data.
 	 * If the supplied function returns TRUE this function returns SUCCESS, and
@@ -163,7 +163,7 @@ struct linked_list_t {
 	 * the next item is checked.
 	 *
 	 * If match is NULL, *item and the current object are compared.
-	 * 
+	 *
 	 * @warning Only use pointers as user supplied data.
 	 *
 	 * @param match			comparison function to call on each object, or NULL
@@ -173,17 +173,17 @@ struct linked_list_t {
 	 */
 	status_t (*find_first) (linked_list_t *this, linked_list_match_t match,
 							void **item, ...);
-	
+
 	/** Find the last matching element in the list.
-	 * 
+	 *
 	 * The first object passed to the match function is the current list item,
 	 * followed by the user supplied data.
 	 * If the supplied function returns TRUE this function returns SUCCESS, and
 	 * the current object is returned in the third parameter, otherwise,
 	 * the next item is checked.
-	 * 
+	 *
 	 * If match is NULL, *item and the current object are compared.
-	 * 
+	 *
 	 * @warning Only use pointers as user supplied data.
 	 *
 	 * @param match			comparison function to call on each object, or NULL
@@ -193,7 +193,7 @@ struct linked_list_t {
 	 */
 	status_t (*find_last) (linked_list_t *this, linked_list_match_t match,
 						   void **item, ...);
-	
+
 	/**
 	 * Invoke a method on all of the contained objects.
 	 *
@@ -202,41 +202,41 @@ struct linked_list_t {
 	 * method is specified by an offset of the function pointer,
 	 * which can be evalutated at compile time using the offsetof
 	 * macro, e.g.: list->invoke(list, offsetof(object_t, method));
-	 * 
+	 *
 	 * @param offset	offset of the method to invoke on objects
 	 * @param ...		user data to supply to called function (limited to 5 arguments)
 	 */
 	void (*invoke_offset) (linked_list_t *this, size_t offset, ...);
-	
+
 	/**
 	 * Invoke a function on all of the contained objects.
-	 * 
+	 *
 	 * @param function	offset of the method to invoke on objects
 	 * @param ...		user data to supply to called function (limited to 5 arguments)
 	 */
 	void (*invoke_function) (linked_list_t *this, linked_list_invoke_t function, ...);
-	
+
 	/**
 	 * Clones a list and its objects using the objects' clone method.
-	 * 
+	 *
 	 * @param offset	offset ot the objects clone function
 	 * @return			cloned list
 	 */
 	linked_list_t *(*clone_offset) (linked_list_t *this, size_t offset);
-	
+
 	/**
 	 * Clones a list and its objects using a given function.
-	 * 
+	 *
 	 * @param function	function that clones an object
 	 * @return			cloned list
 	 */
 	linked_list_t *(*clone_function) (linked_list_t *this, void*(*)(void*));
-	
+
 	/**
 	 * Destroys a linked_list object.
 	 */
 	void (*destroy) (linked_list_t *this);
-	
+
 	/**
 	 * Destroys a list and its objects using the destructor.
 	 *
@@ -248,10 +248,10 @@ struct linked_list_t {
 	 * @param offset	offset of the objects destructor
 	 */
 	void (*destroy_offset) (linked_list_t *this, size_t offset);
-	
+
 	/**
 	 * Destroys a list and its contents using a a cleanup function.
-	 * 
+	 *
 	 * If a linked list and its contents should get destroyed using a specific
 	 * cleanup function, use destroy_function. This is useful when the
 	 * list contains malloc()-ed blocks which should get freed,
@@ -264,7 +264,7 @@ struct linked_list_t {
 
 /**
  * Creates an empty linked list object.
- * 
+ *
  * @return 		linked_list_t object.
  */
 linked_list_t *linked_list_create(void);
diff --git a/src/libstrongswan/utils/mutex.c b/src/libstrongswan/utils/mutex.c
deleted file mode 100644
index a6c39e94c..000000000
--- a/src/libstrongswan/utils/mutex.c
+++ /dev/null
@@ -1,509 +0,0 @@
-/*
- * Copyright (C) 2008 Tobias Brunner
- * Copyright (C) 2008 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#define _GNU_SOURCE
-#include <pthread.h>
-#include <sys/time.h>
-#include <stdint.h>
-#include <time.h>
-#include <errno.h>
-
-#include "mutex.h"
-
-#include <library.h>
-#include <debug.h>
-
-typedef struct private_mutex_t private_mutex_t;
-typedef struct private_r_mutex_t private_r_mutex_t;
-typedef struct private_condvar_t private_condvar_t;
-typedef struct private_rwlock_t private_rwlock_t;
-
-#ifdef LOCK_PROFILER
-
-/**
- * Do not report mutexes with an overall waiting time smaller than this (in us)
- */
-#define PROFILE_TRESHHOLD 1000
-
-#include <utils/backtrace.h>
-
-typedef struct lock_profile_t lock_profile_t;
-
-struct lock_profile_t {
-
-	/**
-	 * how long threads have waited for the lock in this mutex so far
-	 */
-	struct timeval waited;
-	
-	/**
-	 * backtrace where mutex has been created
-	 */
-	backtrace_t *backtrace;
-};
-
-/**
- * Print and cleanup mutex profiler
- */
-static void profiler_cleanup(lock_profile_t *profile)
-{
-	if (profile->waited.tv_sec > 0 ||
-		profile->waited.tv_usec > PROFILE_TRESHHOLD)
-	{
-		fprintf(stderr, "%d.%06ds in lock created at:",
-				profile->waited.tv_sec, profile->waited.tv_usec);
-		profile->backtrace->log(profile->backtrace, stderr);
-	}
-	profile->backtrace->destroy(profile->backtrace);
-}
-
-/**
- * Initialize mutex profiler
- */
-static void profiler_init(lock_profile_t *profile)
-{
-	profile->backtrace = backtrace_create(2);
-	timerclear(&profile->waited);
-}
-
-#define profiler_start(profile) { \
-	struct timeval _start, _end, _diff; \
-	gettimeofday(&_start, NULL);
-	
-#define profiler_end(profile) \
-	gettimeofday(&_end, NULL); \
-	timersub(&_end, &_start, &_diff); \
-	timeradd(&(profile)->waited, &_diff, &(profile)->waited); }
-
-#else /* !LOCK_PROFILER */
-
-#define lock_profile_t struct {}
-#define profiler_cleanup(...) {}
-#define profiler_init(...) {}
-#define profiler_start(...) {}
-#define profiler_end(...) {}
-
-#endif /* LOCK_PROFILER */
-
-/**
- * private data of mutex
- */
-struct private_mutex_t {
-
-	/**
-	 * public functions
-	 */
-	mutex_t public;
-	
-	/**
-	 * wrapped pthread mutex
-	 */
-	pthread_mutex_t mutex;
-	
-	/**
-	 * is this a recursiv emutex, implementing private_r_mutex_t?
-	 */
-	bool recursive;
-	
-	/**
-	 * profiling info, if enabled
-	 */
-	lock_profile_t profile;
-};
-
-/**
- * private data of mutex, extended by recursive locking information
- */
-struct private_r_mutex_t {
-
-	/**
-	 * Extends private_mutex_t
-	 */
-	private_mutex_t generic;
-	
-	/**
-	 * thread which currently owns mutex
-	 */
-	pthread_t thread;
-	
-	/**
-	 * times we have locked the lock, stored per thread
-	 */
-	pthread_key_t times;
-};
-
-/**
- * private data of condvar
- */
-struct private_condvar_t {
-
-	/**
-	 * public functions
-	 */
-	condvar_t public;
-	
-	/**
-	 * wrapped pthread condvar
-	 */
-	pthread_cond_t condvar;
-};
-
-/**
- * private data of rwlock
- */
-struct private_rwlock_t {
-
-	/**
-	 * public functions
-	 */
-	rwlock_t public;
-	
-	/**
-	 * wrapped pthread rwlock
-	 */
-	pthread_rwlock_t rwlock;
-	
-	/**
-	 * profiling info, if enabled
-	 */
-	lock_profile_t profile;
-};
-
-/**
- * Implementation of mutex_t.lock.
- */
-static void lock(private_mutex_t *this)
-{
-	profiler_start(&this->profile);
-	if (pthread_mutex_lock(&this->mutex))
-	{
-		DBG1("!!!! MUTEX %sLOCK ERROR, your code is buggy !!!", "");
-	}
-	profiler_end(&this->profile);
-}
-
-/**
- * Implementation of mutex_t.unlock.
- */
-static void unlock(private_mutex_t *this)
-{
-	if (pthread_mutex_unlock(&this->mutex))
-	{
-		DBG1("!!!! MUTEX %sLOCK ERROR, your code is buggy !!!", "UN");
-	}
-}
-
-/**
- * Implementation of mutex_t.lock.
- */
-static void lock_r(private_r_mutex_t *this)
-{
-	pthread_t self = pthread_self();
-
-	if (this->thread == self)
-	{
-		uintptr_t times;
-		
-		/* times++ */
-		times = (uintptr_t)pthread_getspecific(this->times);
-		pthread_setspecific(this->times, (void*)times + 1);
-	}
-	else
-	{
-		lock(&this->generic);
-		this->thread = self;
-		/* times = 1 */
-		pthread_setspecific(this->times, (void*)1);
-	}
-}
-
-/**
- * Implementation of mutex_t.unlock.
- */
-static void unlock_r(private_r_mutex_t *this)
-{
-	uintptr_t times;
-
-	/* times-- */
-	times = (uintptr_t)pthread_getspecific(this->times);
-	pthread_setspecific(this->times, (void*)--times);
-	
-	if (times == 0)
-	{
-		this->thread = 0;
-		unlock(&this->generic);
-	}
-}
-
-/**
- * Implementation of mutex_t.destroy
- */
-static void mutex_destroy(private_mutex_t *this)
-{
-	profiler_cleanup(&this->profile);
-	pthread_mutex_destroy(&this->mutex);
-	free(this);
-}
-
-/**
- * Implementation of mutex_t.destroy for recursive mutex'
- */
-static void mutex_destroy_r(private_r_mutex_t *this)
-{
-	profiler_cleanup(&this->generic.profile);
-	pthread_mutex_destroy(&this->generic.mutex);
-	pthread_key_delete(this->times);
-	free(this);
-}
-
-/*
- * see header file
- */
-mutex_t *mutex_create(mutex_type_t type)
-{
-	switch (type)
-	{
-		case MUTEX_TYPE_RECURSIVE:
-		{
-			private_r_mutex_t *this = malloc_thing(private_r_mutex_t);
-			
-			this->generic.public.lock = (void(*)(mutex_t*))lock_r;
-			this->generic.public.unlock = (void(*)(mutex_t*))unlock_r;
-			this->generic.public.destroy = (void(*)(mutex_t*))mutex_destroy_r;	
-			
-			pthread_mutex_init(&this->generic.mutex, NULL);
-			pthread_key_create(&this->times, NULL);
-			this->generic.recursive = TRUE;
-			profiler_init(&this->generic.profile);
-			this->thread = 0;
-			
-			return &this->generic.public;
-		}
-		case MUTEX_TYPE_DEFAULT:
-		default:
-		{
-			private_mutex_t *this = malloc_thing(private_mutex_t);
-		
-			this->public.lock = (void(*)(mutex_t*))lock;
-			this->public.unlock = (void(*)(mutex_t*))unlock;
-			this->public.destroy = (void(*)(mutex_t*))mutex_destroy;
-			
-			pthread_mutex_init(&this->mutex, NULL);
-			this->recursive = FALSE;
-			profiler_init(&this->profile);
-			
-			return &this->public;
-		}
-	}
-}
-
-/**
- * Implementation of condvar_t.wait.
- */
-static void _wait(private_condvar_t *this, private_mutex_t *mutex)
-{
-	if (mutex->recursive)
-	{
-		private_r_mutex_t* recursive = (private_r_mutex_t*)mutex;
-		
-		/* mutex owner gets cleared during condvar wait */
-		recursive->thread = 0;
-		pthread_cond_wait(&this->condvar, &mutex->mutex);
-		recursive->thread = pthread_self();
-	}
-	else
-	{
-		pthread_cond_wait(&this->condvar, &mutex->mutex);
-	}
-}
-
-/**
- * Implementation of condvar_t.timed_wait_abs.
- */
-static bool timed_wait_abs(private_condvar_t *this, private_mutex_t *mutex,
-						   timeval_t time)
-{
-	struct timespec ts;
-	bool timed_out;
-	
-	ts.tv_sec = time.tv_sec;
-	ts.tv_nsec = time.tv_usec * 1000;
-	
-	if (mutex->recursive)
-	{
-		private_r_mutex_t* recursive = (private_r_mutex_t*)mutex;
-		
-		recursive->thread = 0;
-		timed_out = pthread_cond_timedwait(&this->condvar, &mutex->mutex,
-										   &ts) == ETIMEDOUT;
-		recursive->thread = pthread_self();
-	}
-	else
-	{
-		timed_out = pthread_cond_timedwait(&this->condvar, &mutex->mutex,
-										   &ts) == ETIMEDOUT;
-	}
-	return timed_out;
-}
-
-/**
- * Implementation of condvar_t.timed_wait.
- */
-static bool timed_wait(private_condvar_t *this, private_mutex_t *mutex,
-					   u_int timeout)
-{
-	timeval_t tv;
-	u_int s, ms;
-	
-	gettimeofday(&tv, NULL);
-	
-	s = timeout / 1000;
-	ms = timeout % 1000;
-	
-	tv.tv_sec += s;
-	tv.tv_usec += ms * 1000;
-	
-	if (tv.tv_usec > 1000000 /* 1s */)
-	{
-		tv.tv_usec -= 1000000;
-		tv.tv_sec++;
-	}
-	return timed_wait_abs(this, mutex, tv);
-}
-
-/**
- * Implementation of condvar_t.signal.
- */
-static void _signal(private_condvar_t *this)
-{
-	pthread_cond_signal(&this->condvar);
-}
-
-/**
- * Implementation of condvar_t.broadcast.
- */
-static void broadcast(private_condvar_t *this)
-{
-	pthread_cond_broadcast(&this->condvar);
-}
-
-/**
- * Implementation of condvar_t.destroy
- */
-static void condvar_destroy(private_condvar_t *this)
-{
-	pthread_cond_destroy(&this->condvar);
-	free(this);
-}
-
-/*
- * see header file
- */
-condvar_t *condvar_create(condvar_type_t type)
-{
-	switch (type)
-	{
-		case CONDVAR_TYPE_DEFAULT:
-		default:
-		{
-			private_condvar_t *this = malloc_thing(private_condvar_t);
-		
-			this->public.wait = (void(*)(condvar_t*, mutex_t *mutex))_wait;
-			this->public.timed_wait = (bool(*)(condvar_t*, mutex_t *mutex, u_int timeout))timed_wait;
-			this->public.timed_wait_abs = (bool(*)(condvar_t*, mutex_t *mutex, timeval_t time))timed_wait_abs;
-			this->public.signal = (void(*)(condvar_t*))_signal;
-			this->public.broadcast = (void(*)(condvar_t*))broadcast;
-			this->public.destroy = (void(*)(condvar_t*))condvar_destroy;
-		
-			pthread_cond_init(&this->condvar, NULL);
-		
-			return &this->public;
-		}
-	}
-}
-
-/**
- * Implementation of rwlock_t.read_lock
- */
-static void read_lock(private_rwlock_t *this)
-{
-	profiler_start(&this->profile);
-	pthread_rwlock_rdlock(&this->rwlock);
-	profiler_end(&this->profile);
-}
-
-/**
- * Implementation of rwlock_t.write_lock
- */
-static void write_lock(private_rwlock_t *this)
-{
-	profiler_start(&this->profile);
-	pthread_rwlock_wrlock(&this->rwlock);
-	profiler_end(&this->profile);
-}
-
-/**
- * Implementation of rwlock_t.try_write_lock
- */
-static bool try_write_lock(private_rwlock_t *this)
-{
-	return pthread_rwlock_trywrlock(&this->rwlock) == 0;
-}
-
-/**
- * Implementation of rwlock_t.unlock
- */
-static void rw_unlock(private_rwlock_t *this)
-{
-	pthread_rwlock_unlock(&this->rwlock);
-}
-
-/**
- * Implementation of rwlock_t.destroy
- */
-static void rw_destroy(private_rwlock_t *this)
-{
-	pthread_rwlock_destroy(&this->rwlock);
-	profiler_cleanup(&this->profile);
-	free(this);
-}
-
-/*
- * see header file
- */
-rwlock_t *rwlock_create(rwlock_type_t type)
-{
-	switch (type)
-	{
-		case RWLOCK_TYPE_DEFAULT:
-		default:
-		{
-			private_rwlock_t *this = malloc_thing(private_rwlock_t);
-			
-			this->public.read_lock = (void(*)(rwlock_t*))read_lock;
-			this->public.write_lock = (void(*)(rwlock_t*))write_lock;
-			this->public.try_write_lock = (bool(*)(rwlock_t*))try_write_lock;
-			this->public.unlock = (void(*)(rwlock_t*))rw_unlock;
-			this->public.destroy = (void(*)(rwlock_t*))rw_destroy;
-			
-			pthread_rwlock_init(&this->rwlock, NULL);
-			profiler_init(&this->profile);
-			
-			return &this->public;
-		}
-	}
-}
-
diff --git a/src/libstrongswan/utils/mutex.h b/src/libstrongswan/utils/mutex.h
deleted file mode 100644
index 273f56b47..000000000
--- a/src/libstrongswan/utils/mutex.h
+++ /dev/null
@@ -1,213 +0,0 @@
-/*
- * Copyright (C) 2008 Tobias Brunner
- * Copyright (C) 2008 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-/**
- * @defgroup mutex mutex
- * @{ @ingroup utils
- */
-
-#ifndef MUTEX_H_
-#define MUTEX_H_
-
-typedef struct mutex_t mutex_t;
-typedef struct condvar_t condvar_t;
-typedef struct rwlock_t rwlock_t;
-typedef enum mutex_type_t mutex_type_t;
-typedef enum condvar_type_t condvar_type_t;
-typedef enum rwlock_type_t rwlock_type_t;
-
-#include <library.h>
-
-#ifdef __APPLE__
-/* on Mac OS X 10.5 several system calls we use are no cancellation points.
- * fortunately, select isn't one of them, so we wrap some of the others with
- * calls to select(2).
- */
-#include <sys/socket.h>
-#include <sys/select.h>
-
-#define WRAP_WITH_SELECT(func, socket, ...)\
-	fd_set rfds; FD_ZERO(&rfds); FD_SET(socket, &rfds);\
-	if (select(socket + 1, &rfds, NULL, NULL, NULL) <= 0) { return -1; }\
-	return func(socket, __VA_ARGS__)
-
-static inline int cancellable_accept(int socket, struct sockaddr *address,
-									 socklen_t *address_len)
-{
-	WRAP_WITH_SELECT(accept, socket, address, address_len);
-}
-#define accept cancellable_accept
-static inline int cancellable_recvfrom(int socket, void *buffer, size_t length,
-				int flags, struct sockaddr *address, socklen_t *address_len)
-{
-	WRAP_WITH_SELECT(recvfrom, socket, buffer, length, flags, address, address_len);
-}
-#define recvfrom cancellable_recvfrom
-#endif /* __APPLE__ */
-
-/**
- * Type of mutex.
- */
-enum mutex_type_t {
-	/** default mutex */
-	MUTEX_TYPE_DEFAULT	= 0,
-	/** allow recursive locking of the mutex */
-	MUTEX_TYPE_RECURSIVE	= 1,
-};
-
-/**
- * Type of condvar.
- */
-enum condvar_type_t {
-	/** default condvar */
-	CONDVAR_TYPE_DEFAULT	= 0,
-};
-
-/**
- * Type of read-write lock.
- */
-enum rwlock_type_t {
-	/** default condvar */
-	RWLOCK_TYPE_DEFAULT	= 0,
-};
-
-/**
- * Mutex wrapper implements simple, portable and advanced mutex functions.
- */
-struct mutex_t {
-
-	/**
-	 * Acquire the lock to the mutex.
-	 */
-	void (*lock)(mutex_t *this);
-	
-	/**
-	 * Release the lock on the mutex.
-	 */
-	void (*unlock)(mutex_t *this);
-			
-	/**
-     * Destroy a mutex instance.
-     */
-    void (*destroy)(mutex_t *this);
-};
-
-/**
- * Condvar wrapper to use in conjunction with mutex_t.
- */
-struct condvar_t {
-
-	/**
-	 * Wait on a condvar until it gets signalized.
-	 *
-	 * @param mutex			mutex to release while waiting
-	 */
-	void (*wait)(condvar_t *this, mutex_t *mutex);
-	
-	/**
-	 * Wait on a condvar until it gets signalized, or times out.
-	 *
-	 * @param mutex			mutex to release while waiting
-	 * @param timeout		timeout im ms
-	 * @return				TRUE if timed out, FALSE otherwise
-	 */
-	bool (*timed_wait)(condvar_t *this, mutex_t *mutex, u_int timeout);
-	
-	/**
-	 * Wait on a condvar until it gets signalized, or times out.
-	 * 
-	 * @param mutex			mutex to release while waiting
-	 * @param time			absolute time until timeout
-	 * @return				TRUE if timed out, FALSE otherwise
-	 */
-	bool (*timed_wait_abs)(condvar_t *this, mutex_t *mutex, timeval_t timeout);
-	
-	/**
-	 * Wake up a single thread in a condvar.
-	 */
-	void (*signal)(condvar_t *this);
-	
-	/**
-	 * Wake up all threads in a condvar.
-	 */
-	void (*broadcast)(condvar_t *this);
-	
-	/**
-	 * Destroy a condvar and free its resources.
-	 */
-	void (*destroy)(condvar_t *this);
-};
-
-/**
- * Read-Write lock wrapper.
- */
-struct rwlock_t {
-
-	/**
-	 * Acquire the read lock.
-	 */
-	void (*read_lock)(rwlock_t *this);
-	
-	/**
-	 * Acquire the write lock.
-	 */
-	void (*write_lock)(rwlock_t *this);
-	
-	/**
-	 * Try to acquire the write lock.
-	 *
-	 * Never blocks, but returns FALSE if the lock was already occupied.
-	 *
-	 * @return		TRUE if lock acquired
-	 */
-	bool (*try_write_lock)(rwlock_t *this);	
-	
-	/**
-	 * Release any acquired lock.
-	 */
-	void (*unlock)(rwlock_t *this);
-	
-	/**
-	 * Destroy the read-write lock.
-	 */
-	void (*destroy)(rwlock_t *this);
-};
-
-/**
- * Create a mutex instance.
- *
- * @param type		type of mutex to create
- * @return			unlocked mutex instance
- */
-mutex_t *mutex_create(mutex_type_t type);
-
-/**
- * Create a condvar instance.
- *
- * @param type		type of condvar to create
- * @return			condvar instance
- */
-condvar_t *condvar_create(condvar_type_t type);
-
-/**
- * Create a read-write lock instance.
- *
- * @param type		type of rwlock to create
- * @return			unlocked rwlock instance
- */
-rwlock_t *rwlock_create(rwlock_type_t type);
-
-#endif /** MUTEX_H_ @}*/
diff --git a/src/libstrongswan/utils/optionsfrom.c b/src/libstrongswan/utils/optionsfrom.c
index bf47e6b98..bf528caa0 100644
--- a/src/libstrongswan/utils/optionsfrom.c
+++ b/src/libstrongswan/utils/optionsfrom.c
@@ -6,7 +6,7 @@
  * under the terms of the GNU Library General Public License as published by
  * the Free Software Foundation; either version 2 of the License, or (at your
  * option) any later version.  See <http://www.fsf.org/copyleft/lgpl.txt>.
- * 
+ *
  * This library is distributed in the hope that it will be useful, but
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Library General Public
@@ -83,7 +83,7 @@ bool from(private_options_t *this, char *filename, int *argcp, char **argvp[],
 		DBG1("optionsfrom called %d times by \"%s\" - looping?", this->nuses + 1, (*argvp)[0]);
 		return FALSE;
 	}
-	
+
 	fd = fopen(filename, "r");
 	if (fd == NULL)
 	{
diff --git a/src/libstrongswan/utils/optionsfrom.h b/src/libstrongswan/utils/optionsfrom.h
index 05269f4f5..b0a9d0096 100644
--- a/src/libstrongswan/utils/optionsfrom.h
+++ b/src/libstrongswan/utils/optionsfrom.h
@@ -13,7 +13,7 @@
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
  */
- 
+
 /**
  * @defgroup optionsfrom optionsfrom
  * @{ @ingroup utils
@@ -28,7 +28,7 @@ typedef struct options_t options_t;
  * Reads additional command line arguments from a file
  */
 struct options_t {
-	
+
 	/**
 	 * Check if the PKCS#7 contentType is data
 	 *