Merge tag 'upstream/5.0.1'

Upstream version 5.0.1

31 files changed, 993 insertions, 2917 deletions

diff --git a/src/starter/Android.mk b/src/starter/Android.mk
index a82fe9385..c7e81d284 100644
--- a/src/starter/Android.mk
+++ b/src/starter/Android.mk
@@ -4,30 +4,22 @@ include $(CLEAR_VARS)
 # copy-n-paste from Makefile.am (update for LEX/YACC)
 LOCAL_SRC_FILES := \
 parser.c lexer.c ipsec-parser.h netkey.c args.h netkey.h \
-starterwhack.c starterwhack.h starterstroke.c invokepluto.c confread.c \
-starterstroke.h interfaces.c invokepluto.h confread.h interfaces.h args.c \
-keywords.c files.h keywords.h cmp.c starter.c cmp.h exec.c invokecharon.c \
-exec.h invokecharon.h loglite.c klips.c klips.h
+starterstroke.c confread.c \
+starterstroke.h confread.h args.c \
+keywords.c files.h keywords.h cmp.c starter.c cmp.h invokecharon.c \
+invokecharon.h klips.c klips.h
 
 # build starter ----------------------------------------------------------------
 
 LOCAL_C_INCLUDES += \
 	$(libvstr_PATH) \
 	$(strongswan_PATH)/src/libhydra \
-	$(strongswan_PATH)/src/libfreeswan \
 	$(strongswan_PATH)/src/libstrongswan \
-	$(strongswan_PATH)/src/libfreeswan \
-	$(strongswan_PATH)/src/pluto \
-	$(strongswan_PATH)/src/whack \
 	$(strongswan_PATH)/src/stroke
 
 LOCAL_CFLAGS := $(strongswan_CFLAGS) -DSTART_CHARON \
 	-DPLUGINS='"$(strongswan_STARTER_PLUGINS)"'
 
-ifneq ($(strongswan_BUILD_PLUTO),)
-LOCAL_CFLAGS += -DSTART_PLUTO
-endif
-
 LOCAL_MODULE := starter
 
 LOCAL_MODULE_TAGS := optional
@@ -37,11 +29,8 @@ LOCAL_ARM_MODE := arm
 LOCAL_PRELINK_MODULE := false
 
 LOCAL_REQUIRED_MODULES := stroke
-ifneq ($(strongswan_BUILD_PLUTO),)
-LOCAL_REQUIRED_MODULES += whack
-endif
 
-LOCAL_SHARED_LIBRARIES += libstrongswan libhydra libfreeswan
+LOCAL_SHARED_LIBRARIES += libstrongswan libhydra
 
 include $(BUILD_EXECUTABLE)
 
diff --git a/src/starter/Makefile.am b/src/starter/Makefile.am
index 94ddf5aba..c220c2e63 100644
--- a/src/starter/Makefile.am
+++ b/src/starter/Makefile.am
@@ -1,18 +1,15 @@
 ipsec_PROGRAMS = starter
 starter_SOURCES = \
 parser.y lexer.l ipsec-parser.h netkey.c args.h netkey.h \
-starterwhack.c starterwhack.h starterstroke.c invokepluto.c confread.c \
-starterstroke.h interfaces.c invokepluto.h confread.h interfaces.h args.c \
-keywords.c files.h keywords.h cmp.c starter.c cmp.h exec.c invokecharon.c \
-exec.h invokecharon.h loglite.c klips.c klips.h
+starterstroke.c confread.c \
+starterstroke.h confread.h args.c \
+keywords.c files.h keywords.h cmp.c starter.c cmp.h invokecharon.c \
+invokecharon.h klips.c klips.h
 
 INCLUDES = \
 -I${linux_headers} \
 -I$(top_srcdir)/src/libstrongswan \
--I$(top_srcdir)/src/libfreeswan \
 -I$(top_srcdir)/src/libhydra \
--I$(top_srcdir)/src/pluto \
--I$(top_srcdir)/src/whack \
 -I$(top_srcdir)/src/stroke
 
 AM_CFLAGS = \
@@ -27,18 +24,11 @@ AM_CFLAGS = \
 
 AM_YFLAGS = -v -d
 
-starter_LDADD = defs.o $(top_builddir)/src/libfreeswan/libfreeswan.a $(top_builddir)/src/libstrongswan/libstrongswan.la $(top_builddir)/src/libhydra/libhydra.la $(SOCKLIB)
+starter_LDADD = $(top_builddir)/src/libstrongswan/libstrongswan.la $(top_builddir)/src/libhydra/libhydra.la $(SOCKLIB) $(PTHREADLIB)
 EXTRA_DIST = keywords.txt ipsec.conf Android.mk
 MAINTAINERCLEANFILES = keywords.c
 BUILT_SOURCES = parser.h
 
-PLUTODIR=$(top_srcdir)/src/pluto
-SCEPCLIENTDIR=$(top_srcdir)/src/scepclient
-
-if USE_PLUTO
-  AM_CFLAGS += -DSTART_PLUTO
-endif
-
 if USE_CHARON
   AM_CFLAGS += -DSTART_CHARON
 endif
@@ -54,11 +44,8 @@ endif
 keywords.c:	$(srcdir)/keywords.txt $(srcdir)/keywords.h
 		$(GPERF) -m 10 -C -G -D -t < $(srcdir)/keywords.txt > $@
 
-defs.o:		$(PLUTODIR)/defs.c $(PLUTODIR)/defs.h
-		$(COMPILE) -c -o $@ $(PLUTODIR)/defs.c
-
 install-exec-local :
-		test -e "$(DESTDIR)${sysconfdir}/ipsec.d" || $(INSTALL) -o -d "$(DESTDIR)$(sysconfdir)/ipsec.d" || true
+		test -e "$(DESTDIR)${sysconfdir}/ipsec.d" || $(INSTALL) -d "$(DESTDIR)$(sysconfdir)/ipsec.d" || true
 		test -e "$(DESTDIR)${sysconfdir}/ipsec.d/cacerts" || $(INSTALL) -d "$(DESTDIR)$(sysconfdir)/ipsec.d/cacerts" || true
 		test -e "$(DESTDIR)${sysconfdir}/ipsec.d/ocspcerts" || $(INSTALL) -d "$(DESTDIR)$(sysconfdir)/ipsec.d/ocspcerts" || true
 		test -e "$(DESTDIR)${sysconfdir}/ipsec.d/certs" || $(INSTALL) -d "$(DESTDIR)$(sysconfdir)/ipsec.d/certs" || true
diff --git a/src/starter/Makefile.in b/src/starter/Makefile.in
index f2c0cc38e..a6d55c5e2 100644
--- a/src/starter/Makefile.in
+++ b/src/starter/Makefile.in
@@ -35,10 +35,9 @@ POST_UNINSTALL = :
 build_triplet = @build@
 host_triplet = @host@
 ipsec_PROGRAMS = starter$(EXEEXT)
-@USE_PLUTO_TRUE@am__append_1 = -DSTART_PLUTO
-@USE_CHARON_TRUE@am__append_2 = -DSTART_CHARON
-@USE_LOAD_WARNING_TRUE@am__append_3 = -DLOAD_WARNING
-@USE_TOOLS_TRUE@am__append_4 = -DGENERATE_SELFCERT
+@USE_CHARON_TRUE@am__append_1 = -DSTART_CHARON
+@USE_LOAD_WARNING_TRUE@am__append_2 = -DLOAD_WARNING
+@USE_TOOLS_TRUE@am__append_3 = -DGENERATE_SELFCERT
 subdir = src/starter
 DIST_COMMON = README $(srcdir)/Makefile.am $(srcdir)/Makefile.in \
 	lexer.c parser.c parser.h
@@ -55,23 +54,22 @@ am__aclocal_m4_deps = $(top_srcdir)/m4/config/libtool.m4 \
 am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
 	$(ACLOCAL_M4)
 mkinstalldirs = $(install_sh) -d
+CONFIG_HEADER = $(top_builddir)/config.h
 CONFIG_CLEAN_FILES =
 CONFIG_CLEAN_VPATH_FILES =
 am__installdirs = "$(DESTDIR)$(ipsecdir)"
 PROGRAMS = $(ipsec_PROGRAMS)
 am_starter_OBJECTS = parser.$(OBJEXT) lexer.$(OBJEXT) netkey.$(OBJEXT) \
-	starterwhack.$(OBJEXT) starterstroke.$(OBJEXT) \
-	invokepluto.$(OBJEXT) confread.$(OBJEXT) interfaces.$(OBJEXT) \
-	args.$(OBJEXT) keywords.$(OBJEXT) cmp.$(OBJEXT) \
-	starter.$(OBJEXT) exec.$(OBJEXT) invokecharon.$(OBJEXT) \
-	loglite.$(OBJEXT) klips.$(OBJEXT)
+	starterstroke.$(OBJEXT) confread.$(OBJEXT) args.$(OBJEXT) \
+	keywords.$(OBJEXT) cmp.$(OBJEXT) starter.$(OBJEXT) \
+	invokecharon.$(OBJEXT) klips.$(OBJEXT)
 starter_OBJECTS = $(am_starter_OBJECTS)
 am__DEPENDENCIES_1 =
-starter_DEPENDENCIES = defs.o \
-	$(top_builddir)/src/libfreeswan/libfreeswan.a \
+starter_DEPENDENCIES =  \
 	$(top_builddir)/src/libstrongswan/libstrongswan.la \
-	$(top_builddir)/src/libhydra/libhydra.la $(am__DEPENDENCIES_1)
-DEFAULT_INCLUDES = -I.@am__isrc@
+	$(top_builddir)/src/libhydra/libhydra.la $(am__DEPENDENCIES_1) \
+	$(am__DEPENDENCIES_1)
+DEFAULT_INCLUDES = -I.@am__isrc@ -I$(top_builddir)
 depcomp = $(SHELL) $(top_srcdir)/depcomp
 am__depfiles_maybe = depfiles
 am__mv = mv -f
@@ -104,6 +102,7 @@ AUTOCONF = @AUTOCONF@
 AUTOHEADER = @AUTOHEADER@
 AUTOMAKE = @AUTOMAKE@
 AWK = @AWK@
+BFDLIB = @BFDLIB@
 BTLIB = @BTLIB@
 CC = @CC@
 CCDEPMODE = @CCDEPMODE@
@@ -198,11 +197,14 @@ build_os = @build_os@
 build_vendor = @build_vendor@
 builddir = @builddir@
 c_plugins = @c_plugins@
+charon_natt_port = @charon_natt_port@
+charon_plugins = @charon_plugins@
+charon_udp_port = @charon_udp_port@
 clearsilver_LIBS = @clearsilver_LIBS@
 datadir = @datadir@
 datarootdir = @datarootdir@
 dbusservicedir = @dbusservicedir@
-default_pkcs11 = @default_pkcs11@
+dev_headers = @dev_headers@
 docdir = @docdir@
 dvidir = @dvidir@
 exec_prefix = @exec_prefix@
@@ -219,11 +221,12 @@ imcvdir = @imcvdir@
 includedir = @includedir@
 infodir = @infodir@
 install_sh = @install_sh@
+ipsec_script = @ipsec_script@
+ipsec_script_upper = @ipsec_script_upper@
 ipsecdir = @ipsecdir@
 ipsecgroup = @ipsecgroup@
 ipseclibdir = @ipseclibdir@
 ipsecuser = @ipsecuser@
-libcharon_plugins = @libcharon_plugins@
 libdir = @libdir@
 libexecdir = @libexecdir@
 linux_headers = @linux_headers@
@@ -239,6 +242,7 @@ mkdir_p = @mkdir_p@
 nm_CFLAGS = @nm_CFLAGS@
 nm_LIBS = @nm_LIBS@
 nm_ca_dir = @nm_ca_dir@
+nm_plugins = @nm_plugins@
 oldincludedir = @oldincludedir@
 openac_plugins = @openac_plugins@
 p_plugins = @p_plugins@
@@ -248,7 +252,6 @@ pdfdir = @pdfdir@
 piddir = @piddir@
 pki_plugins = @pki_plugins@
 plugindir = @plugindir@
-pluto_plugins = @pluto_plugins@
 pool_plugins = @pool_plugins@
 prefix = @prefix@
 program_transform_name = @program_transform_name@
@@ -278,18 +281,15 @@ xml_CFLAGS = @xml_CFLAGS@
 xml_LIBS = @xml_LIBS@
 starter_SOURCES = \
 parser.y lexer.l ipsec-parser.h netkey.c args.h netkey.h \
-starterwhack.c starterwhack.h starterstroke.c invokepluto.c confread.c \
-starterstroke.h interfaces.c invokepluto.h confread.h interfaces.h args.c \
-keywords.c files.h keywords.h cmp.c starter.c cmp.h exec.c invokecharon.c \
-exec.h invokecharon.h loglite.c klips.c klips.h
+starterstroke.c confread.c \
+starterstroke.h confread.h args.c \
+keywords.c files.h keywords.h cmp.c starter.c cmp.h invokecharon.c \
+invokecharon.h klips.c klips.h
 
 INCLUDES = \
 -I${linux_headers} \
 -I$(top_srcdir)/src/libstrongswan \
--I$(top_srcdir)/src/libfreeswan \
 -I$(top_srcdir)/src/libhydra \
--I$(top_srcdir)/src/pluto \
--I$(top_srcdir)/src/whack \
 -I$(top_srcdir)/src/stroke
 
 AM_CFLAGS = -DIPSEC_DIR=\"${ipsecdir}\" \
@@ -297,14 +297,12 @@ AM_CFLAGS = -DIPSEC_DIR=\"${ipsecdir}\" \
 	-DIPSEC_EAPDIR=\"${eapdir}\" -DDEV_RANDOM=\"${random_device}\" \
 	-DDEV_URANDOM=\"${urandom_device}\" \
 	-DPLUGINS=\""${starter_plugins}\"" -DDEBUG $(am__append_1) \
-	$(am__append_2) $(am__append_3) $(am__append_4)
+	$(am__append_2) $(am__append_3)
 AM_YFLAGS = -v -d
-starter_LDADD = defs.o $(top_builddir)/src/libfreeswan/libfreeswan.a $(top_builddir)/src/libstrongswan/libstrongswan.la $(top_builddir)/src/libhydra/libhydra.la $(SOCKLIB)
+starter_LDADD = $(top_builddir)/src/libstrongswan/libstrongswan.la $(top_builddir)/src/libhydra/libhydra.la $(SOCKLIB) $(PTHREADLIB)
 EXTRA_DIST = keywords.txt ipsec.conf Android.mk
 MAINTAINERCLEANFILES = keywords.c
 BUILT_SOURCES = parser.h
-PLUTODIR = $(top_srcdir)/src/pluto
-SCEPCLIENTDIR = $(top_srcdir)/src/scepclient
 all: $(BUILT_SOURCES)
 	$(MAKE) $(AM_MAKEFLAGS) all-am
 
@@ -401,19 +399,14 @@ distclean-compile:
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/args.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/cmp.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/confread.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/exec.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/interfaces.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/invokecharon.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/invokepluto.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/keywords.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/klips.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/lexer.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/loglite.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/netkey.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/parser.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/starter.Po@am__quote@
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/starterstroke.Po@am__quote@
-@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/starterwhack.Po@am__quote@
 
 .c.o:
 @am__fastdepCC_TRUE@	$(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $<
@@ -660,11 +653,8 @@ uninstall-am: uninstall-ipsecPROGRAMS
 keywords.c:	$(srcdir)/keywords.txt $(srcdir)/keywords.h
 		$(GPERF) -m 10 -C -G -D -t < $(srcdir)/keywords.txt > $@
 
-defs.o:		$(PLUTODIR)/defs.c $(PLUTODIR)/defs.h
-		$(COMPILE) -c -o $@ $(PLUTODIR)/defs.c
-
 install-exec-local :
-		test -e "$(DESTDIR)${sysconfdir}/ipsec.d" || $(INSTALL) -o -d "$(DESTDIR)$(sysconfdir)/ipsec.d" || true
+		test -e "$(DESTDIR)${sysconfdir}/ipsec.d" || $(INSTALL) -d "$(DESTDIR)$(sysconfdir)/ipsec.d" || true
 		test -e "$(DESTDIR)${sysconfdir}/ipsec.d/cacerts" || $(INSTALL) -d "$(DESTDIR)$(sysconfdir)/ipsec.d/cacerts" || true
 		test -e "$(DESTDIR)${sysconfdir}/ipsec.d/ocspcerts" || $(INSTALL) -d "$(DESTDIR)$(sysconfdir)/ipsec.d/ocspcerts" || true
 		test -e "$(DESTDIR)${sysconfdir}/ipsec.d/certs" || $(INSTALL) -d "$(DESTDIR)$(sysconfdir)/ipsec.d/certs" || true
diff --git a/src/starter/args.c b/src/starter/args.c
index 65d0a753c..2416960bd 100644
--- a/src/starter/args.c
+++ b/src/starter/args.c
@@ -17,11 +17,8 @@
 #include <stdlib.h>
 #include <string.h>
 
-#include <freeswan.h>
-
-#include "../pluto/constants.h"
-#include "../pluto/defs.h"
-#include "../pluto/log.h"
+#include <library.h>
+#include <debug.h>
 
 #include "keywords.h"
 #include "confread.h"
@@ -64,6 +61,7 @@ static const char *LST_unique[] = {
 	"yes",
 	"replace",
 	"keep",
+	"never",
 	 NULL
 };
 
@@ -89,13 +87,6 @@ static const char *LST_startup[] = {
 	 NULL
 };
 
-static const char *LST_packetdefault[] = {
-	"drop",
-	"reject",
-	"pass",
-	 NULL
-};
-
 static const char *LST_keyexchange[] = {
 	"ike",
 	"ikev1",
@@ -103,55 +94,17 @@ static const char *LST_keyexchange[] = {
 	 NULL
 };
 
-static const char *LST_pfsgroup[] = {
-	"modp1024",
-	"modp1536",
-	"modp2048",
-	"modp3072",
-	"modp4096",
-	"modp6144",
-	"modp8192",
-	"ecp192",
-	"ecp224",
-	"ecp256",
-	"ecp384",
-	"ecp521",
-	 NULL
-};
-
-static const char *LST_plutodebug[] = {
-	"none",
-	"all",
-	"raw",
-	"crypt",
-	"parsing",
-	"emitting",
-	"control",
-	"lifecycle",
-	"klips",
-	"kernel",
-	"dns",
-	"natt",
-	"oppo",
-	"controlmore",
-	"private",
-	 NULL
-};
-
-static const char *LST_klipsdebug[] = {
-	"tunnel",
-	"tunnel-xmit",
-	"pfkey",
-	"xform",
-	"eroute",
-	"spi",
-	"radij",
-	"esp",
-	"ah",
-	"ipcomp",
-	"verbose",
-	"all",
-	"none",
+static const char *LST_authby[] = {
+	"psk",
+	"secret",
+	"pubkey",
+	"rsa",
+	"rsasig",
+	"ecdsa",
+	"ecdsasig",
+	"xauthpsk",
+	"xauthrsasig",
+	"never",
 	 NULL
 };
 
@@ -164,49 +117,23 @@ typedef struct {
 static const token_info_t token_info[] =
 {
 	/* config setup keywords */
-	{ ARG_LST,  offsetof(starter_config_t, setup.interfaces), NULL                 },
-	{ ARG_STR,  offsetof(starter_config_t, setup.dumpdir), NULL                    },
-	{ ARG_ENUM, offsetof(starter_config_t, setup.charonstart), LST_bool            },
-	{ ARG_ENUM, offsetof(starter_config_t, setup.plutostart), LST_bool             },
-
-	/* pluto/charon keywords */
-	{ ARG_LST,  offsetof(starter_config_t, setup.plutodebug), LST_plutodebug       },
 	{ ARG_STR,  offsetof(starter_config_t, setup.charondebug),  NULL               },
-	{ ARG_STR,  offsetof(starter_config_t, setup.prepluto), NULL                   },
-	{ ARG_STR,  offsetof(starter_config_t, setup.postpluto), NULL                  },
-	{ ARG_STR,  offsetof(starter_config_t, setup.plutostderrlog), NULL             },
 	{ ARG_ENUM, offsetof(starter_config_t, setup.uniqueids), LST_unique            },
-	{ ARG_UINT, offsetof(starter_config_t, setup.overridemtu), NULL                },
-	{ ARG_TIME, offsetof(starter_config_t, setup.crlcheckinterval), NULL           },
 	{ ARG_ENUM, offsetof(starter_config_t, setup.cachecrls), LST_bool              },
 	{ ARG_ENUM, offsetof(starter_config_t, setup.strictcrlpolicy), LST_strict      },
-	{ ARG_ENUM, offsetof(starter_config_t, setup.nocrsend), LST_bool               },
-	{ ARG_ENUM, offsetof(starter_config_t, setup.nat_traversal), LST_bool          },
-	{ ARG_TIME, offsetof(starter_config_t, setup.keep_alive), NULL                 },
-	{ ARG_ENUM, offsetof(starter_config_t, setup.force_keepalive), LST_bool        },
-	{ ARG_STR,  offsetof(starter_config_t, setup.virtual_private), NULL            },
-	{ ARG_STR,  offsetof(starter_config_t, setup.pkcs11module), NULL               },
-	{ ARG_STR,  offsetof(starter_config_t, setup.pkcs11initargs), NULL             },
-	{ ARG_ENUM, offsetof(starter_config_t, setup.pkcs11keepstate), LST_bool        },
-	{ ARG_ENUM, offsetof(starter_config_t, setup.pkcs11proxy), LST_bool            },
-
-	/* KLIPS keywords */
-	{ ARG_LST,  offsetof(starter_config_t, setup.klipsdebug), LST_klipsdebug       },
-	{ ARG_ENUM, offsetof(starter_config_t, setup.fragicmp), LST_bool               },
-	{ ARG_STR,  offsetof(starter_config_t, setup.packetdefault), LST_packetdefault },
-	{ ARG_ENUM, offsetof(starter_config_t, setup.hidetos), LST_bool                },
+	{ ARG_MISC, 0, NULL  /* KW_PKCS11_DEPRECATED */                                },
+	{ ARG_MISC, 0, NULL  /* KW_SETUP_DEPRECATED */                                 },
 
 	/* conn section keywords */
 	{ ARG_STR,  offsetof(starter_conn_t, name), NULL                               },
 	{ ARG_ENUM, offsetof(starter_conn_t, startup), LST_startup                     },
 	{ ARG_ENUM, offsetof(starter_conn_t, keyexchange), LST_keyexchange             },
 	{ ARG_MISC, 0, NULL  /* KW_TYPE */                                             },
-	{ ARG_MISC, 0, NULL  /* KW_PFS */                                              },
 	{ ARG_MISC, 0, NULL  /* KW_COMPRESS */                                         },
 	{ ARG_ENUM, offsetof(starter_conn_t, install_policy), LST_bool                 },
+	{ ARG_ENUM, offsetof(starter_conn_t, aggressive), LST_bool                     },
 	{ ARG_MISC, 0, NULL  /* KW_AUTH */                                             },
-	{ ARG_MISC, 0, NULL  /* KW_AUTHBY */                                           },
-	{ ARG_MISC, 0, NULL  /* KW_EAP */                                              },
+	{ ARG_STR,  offsetof(starter_conn_t, authby), LST_authby                       },
 	{ ARG_STR,  offsetof(starter_conn_t, eap_identity), NULL                       },
 	{ ARG_STR,  offsetof(starter_conn_t, aaa_identity), NULL                       },
 	{ ARG_MISC, 0, NULL  /* KW_MOBIKE */                                           },
@@ -224,7 +151,6 @@ static const token_info_t token_info[] =
 	{ ARG_MISC, 0, NULL  /* KW_REAUTH */                                           },
 	{ ARG_STR,  offsetof(starter_conn_t, ike), NULL                                },
 	{ ARG_STR,  offsetof(starter_conn_t, esp), NULL                                },
-	{ ARG_STR,  offsetof(starter_conn_t, pfsgroup), LST_pfsgroup                   },
 	{ ARG_TIME, offsetof(starter_conn_t, dpd_delay), NULL                          },
 	{ ARG_TIME, offsetof(starter_conn_t, dpd_timeout), NULL                        },
 	{ ARG_ENUM, offsetof(starter_conn_t, dpd_action), LST_dpd_action               },
@@ -241,28 +167,27 @@ static const token_info_t token_info[] =
 	{ ARG_MISC, 0, NULL  /* KW_MARK_IN */                                          },
 	{ ARG_MISC, 0, NULL  /* KW_MARK_OUT */                                         },
 	{ ARG_MISC, 0, NULL  /* KW_TFC */                                              },
+	{ ARG_MISC, 0, NULL  /* KW_PFS_DEPRECATED */                                   },
+	{ ARG_MISC, 0, NULL  /* KW_CONN_DEPRECATED */                                  },
 
 	/* ca section keywords */
 	{ ARG_STR,  offsetof(starter_ca_t, name), NULL                                 },
 	{ ARG_ENUM, offsetof(starter_ca_t, startup), LST_startup                       },
 	{ ARG_STR,  offsetof(starter_ca_t, cacert), NULL                               },
-	{ ARG_STR,  offsetof(starter_ca_t, ldaphost), NULL                             },
-	{ ARG_STR,  offsetof(starter_ca_t, ldapbase), NULL                             },
 	{ ARG_STR,  offsetof(starter_ca_t, crluri), NULL                               },
 	{ ARG_STR,  offsetof(starter_ca_t, crluri2), NULL                              },
 	{ ARG_STR,  offsetof(starter_ca_t, ocspuri), NULL                              },
 	{ ARG_STR,  offsetof(starter_ca_t, ocspuri2), NULL                             },
 	{ ARG_STR,  offsetof(starter_ca_t, certuribase), NULL                          },
+	{ ARG_MISC, 0, NULL  /* KW_CA_DEPRECATED */                                    },
 
 	/* end keywords */
 	{ ARG_STR,  offsetof(starter_end_t, host), NULL                                },
 	{ ARG_UINT, offsetof(starter_end_t, ikeport), NULL                             },
-	{ ARG_MISC, 0, NULL  /* KW_NEXTHOP */                                          },
-	{ ARG_STR, offsetof(starter_end_t, subnet), NULL                               },
-	{ ARG_MISC, 0, NULL  /* KW_SUBNETWITHIN */                                     },
+	{ ARG_STR,  offsetof(starter_end_t, subnet), NULL                              },
 	{ ARG_MISC, 0, NULL  /* KW_PROTOPORT */                                        },
 	{ ARG_STR,  offsetof(starter_end_t, sourceip), NULL                            },
-	{ ARG_MISC, 0, NULL  /* KW_NATIP */                                            },
+	{ ARG_STR,  offsetof(starter_end_t, dns), NULL                                 },
 	{ ARG_ENUM, offsetof(starter_end_t, firewall), LST_bool                        },
 	{ ARG_ENUM, offsetof(starter_end_t, hostaccess), LST_bool                      },
 	{ ARG_ENUM, offsetof(starter_end_t, allow_any), LST_bool                       },
@@ -279,7 +204,8 @@ static const token_info_t token_info[] =
 	{ ARG_STR,  offsetof(starter_end_t, ca), NULL                                  },
 	{ ARG_STR,  offsetof(starter_end_t, ca2), NULL                                 },
 	{ ARG_STR,  offsetof(starter_end_t, groups), NULL                              },
-	{ ARG_STR,  offsetof(starter_end_t, iface), NULL                               }
+	{ ARG_STR,  offsetof(starter_end_t, groups2), NULL                             },
+	{ ARG_MISC, 0, NULL  /* KW_END_DEPRECATED */                                   },
 };
 
 static void free_list(char **list)
@@ -298,7 +224,7 @@ char** new_list(char *value)
 	char *val, *b, *e, *end, **ret;
 	int count;
 
-	val = value ? clone_str(value) : NULL;
+	val = strdupnull(value);
 	if (!val)
 	{
 		return NULL;
@@ -326,7 +252,7 @@ char** new_list(char *value)
 		for (e = b; (*e != '\0'); e++);
 		if (e != b)
 		{
-			ret[count++] = clone_str(b);
+			ret[count++] = strdupnull(b);
 		}
 		b = e + 1;
 	}
@@ -347,23 +273,20 @@ bool assign_arg(kw_token_t token, kw_token_t first, kw_list_t *kw, char *base,
 
 	int index = -1;  /* used for enumeration arguments */
 
-	lset_t *seen = (lset_t *)base;    /* seen flags are at the top of the struct */
-	lset_t f = LELEM(token - first);  /* compute flag position of argument */
+	seen_t *seen = (seen_t*)base; /* seen flags are at the top of the struct */
 
 	*assigned = FALSE;
 
-	DBG(DBG_CONTROLMORE,
-		DBG_log("  %s=%s", kw->entry->name, kw->value)
-	)
+	DBG3(DBG_APP, "  %s=%s", kw->entry->name, kw->value);
 
-	if (*seen & f)
+	if (*seen & SEEN_KW(token, first))
 	{
-		plog("# duplicate '%s' option", kw->entry->name);
+		DBG1(DBG_APP, "# duplicate '%s' option", kw->entry->name);
 		return FALSE;
 	}
 
 	/* set flag that this argument has been seen */
-	*seen |= f;
+	*seen |= SEEN_KW(token, first);
 
 	/* is there a keyword list? */
 	if (list != NULL && token_info[token].type != ARG_LST)
@@ -377,7 +300,7 @@ bool assign_arg(kw_token_t token, kw_token_t first, kw_list_t *kw, char *base,
 		}
 		if (!match)
 		{
-			plog("# bad value: %s=%s", kw->entry->name, kw->value);
+			DBG1(DBG_APP, "# bad value: %s=%s", kw->entry->name, kw->value);
 			return FALSE;
 		}
 	}
@@ -385,14 +308,14 @@ bool assign_arg(kw_token_t token, kw_token_t first, kw_list_t *kw, char *base,
 	switch (token_info[token].type)
 	{
 	case ARG_NONE:
-		plog("# option '%s' not supported yet", kw->entry->name);
+		DBG1(DBG_APP, "# option '%s' not supported yet", kw->entry->name);
 		return FALSE;
 	case ARG_ENUM:
 		{
 			if (index < 0)
 			{
-				plog("# bad enumeration value: %s=%s (%d)"
-					, kw->entry->name, kw->value, index);
+				DBG1(DBG_APP, "# bad enumeration value: %s=%s (%d)",
+					 kw->entry->name, kw->value, index);
 				return FALSE;
 			}
 
@@ -418,7 +341,8 @@ bool assign_arg(kw_token_t token, kw_token_t first, kw_list_t *kw, char *base,
 
 			if (*endptr != '\0')
 			{
-				plog("# bad integer value: %s=%s", kw->entry->name, kw->value);
+				DBG1(DBG_APP, "# bad integer value: %s=%s", kw->entry->name,
+					 kw->value);
 				return FALSE;
 			}
 		}
@@ -435,7 +359,8 @@ bool assign_arg(kw_token_t token, kw_token_t first, kw_list_t *kw, char *base,
 			{
 				if (*endptr != '\0')
 				{
-					plog("# bad integer value: %s=%s", kw->entry->name, kw->value);
+					DBG1(DBG_APP, "# bad integer value: %s=%s", kw->entry->name,
+						 kw->value);
 					return FALSE;
 				}
 			}
@@ -443,7 +368,8 @@ bool assign_arg(kw_token_t token, kw_token_t first, kw_list_t *kw, char *base,
 			{
 				if ((*endptr != '%') || (endptr[1] != '\0') || endptr == kw->value)
 				{
-					plog("# bad percent value: %s=%s", kw->entry->name, kw->value);
+					DBG1(DBG_APP, "# bad percent value: %s=%s", kw->entry->name,
+						 kw->value);
 					return FALSE;
 				}
 			}
@@ -459,7 +385,8 @@ bool assign_arg(kw_token_t token, kw_token_t first, kw_list_t *kw, char *base,
 
 			if (*endptr != '\0')
 			{
-				plog("# bad integer value: %s=%s", kw->entry->name, kw->value);
+				DBG1(DBG_APP, "# bad integer value: %s=%s", kw->entry->name,
+					 kw->value);
 				return FALSE;
 			}
 		}
@@ -494,7 +421,8 @@ bool assign_arg(kw_token_t token, kw_token_t first, kw_list_t *kw, char *base,
 					break;
 				}
 			}
-			plog("# bad duration value: %s=%s", kw->entry->name, kw->value);
+			DBG1(DBG_APP, "# bad duration value: %s=%s", kw->entry->name,
+				 kw->value);
 			return FALSE;
 		}
 	case ARG_STR:
@@ -505,7 +433,7 @@ bool assign_arg(kw_token_t token, kw_token_t first, kw_list_t *kw, char *base,
 			free(*cp);
 
 			/* assign the new string */
-			*cp = clone_str(kw->value);
+			*cp = strdupnull(kw->value);
 		}
 		break;
 	case ARG_LST:
@@ -537,7 +465,8 @@ bool assign_arg(kw_token_t token, kw_token_t first, kw_list_t *kw, char *base,
 					}
 					if (!match)
 					{
-						plog("# bad value: %s=%s", kw->entry->name, *lst);
+						DBG1(DBG_APP, "# bad value: %s=%s",
+							 kw->entry->name, *lst);
 						return FALSE;
 					}
 				}
@@ -604,7 +533,7 @@ void clone_args(kw_token_t first, kw_token_t last, char *base1, char *base2)
 			char **cp1 = (char **)(base1 + token_info[token].offset);
 			char **cp2 = (char **)(base2 + token_info[token].offset);
 
-			*cp1 = clone_str(*cp2);
+			*cp1 = strdupnull(*cp2);
 		}
 	}
 }
diff --git a/src/starter/cmp.c b/src/starter/cmp.c
index 0727cf5f0..aaba7b11d 100644
--- a/src/starter/cmp.c
+++ b/src/starter/cmp.c
@@ -14,62 +14,39 @@
 
 #include <string.h>
 
-#include <freeswan.h>
-
-#include "../pluto/constants.h"
-#include "../pluto/defs.h"
-
 #include "confread.h"
 #include "args.h"
-#include "interfaces.h"
 #include "cmp.h"
 
 #define VARCMP(obj) if (c1->obj != c2->obj) return FALSE
-#define ADDCMP(obj) if (!sameaddr(&c1->obj,&c2->obj)) return FALSE
-#define SUBCMP(obj) if (!samesubnet(&c1->obj,&c2->obj)) return FALSE
 #define STRCMP(obj) if (strcmp(c1->obj,c2->obj)) return FALSE
 
-static bool
-starter_cmp_end(starter_end_t *c1, starter_end_t *c2)
+static bool starter_cmp_end(starter_end_t *c1, starter_end_t *c2)
 {
 	if ((c1 == NULL) || (c2 == NULL))
 		return FALSE;
 
-	if (c2->dns_failed)
-	{
-		c2->addr = c1->addr;
-	}
-	else
-	{
-		ADDCMP(addr);
-	}
-	VARCMP(ikeport);
-	ADDCMP(nexthop);
-	VARCMP(has_client);
-	VARCMP(has_client_wildcard);
-	VARCMP(has_port_wildcard);
-	VARCMP(has_natip);
-	VARCMP(has_virt);
 	VARCMP(modecfg);
 	VARCMP(port);
 	VARCMP(protocol);
 
 	return cmp_args(KW_END_FIRST, KW_END_LAST, (char *)c1, (char *)c2);
- }
+}
 
-bool
-starter_cmp_conn(starter_conn_t *c1, starter_conn_t *c2)
+bool starter_cmp_conn(starter_conn_t *c1, starter_conn_t *c2)
 {
 	if ((c1 == NULL) || (c2 == NULL))
 		return FALSE;
 
-	VARCMP(policy);
-	VARCMP(addr_family);
-	VARCMP(tunnel_addr_family);
+	VARCMP(mode);
+	VARCMP(proxy_mode);
+	VARCMP(options);
 	VARCMP(mark_in.value);
 	VARCMP(mark_in.mask);
 	VARCMP(mark_out.value);
 	VARCMP(mark_in.mask);
+	VARCMP(tfc);
+	VARCMP(sa_keying_tries);
 
 	if (!starter_cmp_end(&c1->left, &c2->left))
 		return FALSE;
@@ -79,8 +56,7 @@ starter_cmp_conn(starter_conn_t *c1, starter_conn_t *c2)
 	return cmp_args(KW_CONN_NAME, KW_CONN_LAST, (char *)c1, (char *)c2);
 }
 
-bool
-starter_cmp_ca(starter_ca_t *c1, starter_ca_t *c2)
+bool starter_cmp_ca(starter_ca_t *c1, starter_ca_t *c2)
 {
 	if (c1 ==  NULL || c2 == NULL)
 		return FALSE;
@@ -88,28 +64,3 @@ starter_cmp_ca(starter_ca_t *c1, starter_ca_t *c2)
 	return cmp_args(KW_CA_NAME, KW_CA_LAST, (char *)c1, (char *)c2);
 }
 
-bool
-starter_cmp_klips(starter_config_t *c1, starter_config_t *c2)
-{
-	if ((c1 == NULL) || (c2 == NULL))
-		return FALSE;
-
-	return cmp_args(KW_KLIPS_FIRST, KW_KLIPS_LAST, (char *)c1, (char *)c2);
-}
-
-bool
-starter_cmp_pluto(starter_config_t *c1, starter_config_t *c2)
-{
-	if ((c1 == NULL) || (c2 == NULL))
-		return FALSE;
-
-	return cmp_args(KW_PLUTO_FIRST, KW_PLUTO_LAST, (char *)c1, (char *)c2);
-}
-
-bool
-starter_cmp_defaultroute(defaultroute_t *d1, defaultroute_t *d2)
-{
-	if ((d1 == NULL) || (d2 == NULL))
-		return FALSE;
-	return memcmp(d1, d2, sizeof(defaultroute_t)) == 0;
-}
diff --git a/src/starter/cmp.h b/src/starter/cmp.h
index cda6e44b9..c33ce8ec2 100644
--- a/src/starter/cmp.h
+++ b/src/starter/cmp.h
@@ -15,13 +15,8 @@
 #ifndef _STARTER_CMP_H_
 #define _STARTER_CMP_H_
 
-#include "interfaces.h"
-
-extern bool starter_cmp_conn(starter_conn_t *c1, starter_conn_t *c2);
-extern bool starter_cmp_ca(starter_ca_t *c1, starter_ca_t *c2);
-extern bool starter_cmp_klips(starter_config_t *c1, starter_config_t *c2);
-extern bool starter_cmp_pluto(starter_config_t *c1, starter_config_t *c2);
-extern bool starter_cmp_defaultroute(defaultroute_t *d1, defaultroute_t *d2);
+bool starter_cmp_conn(starter_conn_t *c1, starter_conn_t *c2);
+bool starter_cmp_ca(starter_ca_t *c1, starter_ca_t *c2);
 
 #endif
 
diff --git a/src/starter/confread.c b/src/starter/confread.c
index 627601e88..6544b1ccd 100644
--- a/src/starter/confread.c
+++ b/src/starter/confread.c
@@ -19,26 +19,24 @@
 #include <stdlib.h>
 #include <string.h>
 #include <assert.h>
+#include <netdb.h>
 
-#include <freeswan.h>
-
-#include <eap/eap.h>
-
-#include "../pluto/constants.h"
-#include "../pluto/defs.h"
-#include "../pluto/log.h"
+#include <library.h>
+#include <debug.h>
 
 #include "keywords.h"
 #include "confread.h"
 #include "args.h"
 #include "files.h"
-#include "interfaces.h"
 
-/* strings containing a colon are interpreted as an IPv6 address */
-#define ip_version(string)	(strchr(string, '.') ? AF_INET : AF_INET6)
+#define IKE_LIFETIME_DEFAULT         10800 /* 3 hours */
+#define IPSEC_LIFETIME_DEFAULT        3600 /* 1 hour */
+#define SA_REPLACEMENT_MARGIN_DEFAULT  540 /* 9 minutes */
+#define SA_REPLACEMENT_FUZZ_DEFAULT    100 /* 100% of margin */
+#define SA_REPLACEMENT_RETRIES_DEFAULT   3
 
 static const char ike_defaults[] = "aes128-sha1-modp2048,3des-sha1-modp1536";
-static const char esp_defaults[] = "aes128-sha1,3des-sha1";
+static const char esp_defaults[] = "aes128-sha1-modp2048,3des-sha1-modp1536";
 
 static const char firewall_defaults[] = "ipsec _updown iptables";
 
@@ -47,12 +45,53 @@ static bool daemon_exists(char *daemon, char *path)
 	struct stat st;
 	if (stat(path, &st) != 0)
 	{
-		plog("Disabling %sstart option, '%s' not found", daemon, path);
+		DBG1(DBG_APP, "Disabling %sstart option, '%s' not found", daemon, path);
 		return FALSE;
 	}
 	return TRUE;
 }
 
+/**
+ * Process deprecated keywords
+ */
+static bool is_deprecated(kw_token_t token, kw_list_t *kw, char *name)
+{
+	switch (token)
+	{
+		case KW_SETUP_DEPRECATED:
+		case KW_PKCS11_DEPRECATED:
+			DBG1(DBG_APP, "# deprecated keyword '%s' in config setup",
+				 kw->entry->name);
+			break;
+		case KW_CONN_DEPRECATED:
+		case KW_END_DEPRECATED:
+		case KW_PFS_DEPRECATED:
+			DBG1(DBG_APP, "# deprecated keyword '%s' in conn '%s'",
+				 kw->entry->name, name);
+			break;
+		case KW_CA_DEPRECATED:
+			DBG1(DBG_APP, "# deprecated keyword '%s' in ca '%s'",
+				 kw->entry->name, name);
+			break;
+		default:
+			return FALSE;
+	}
+	/* additional messages for some */
+	switch (token)
+	{
+		case KW_PKCS11_DEPRECATED:
+			DBG1(DBG_APP, "  use the 'pkcs11' plugin instead", kw->entry->name);
+			break;
+		case KW_PFS_DEPRECATED:
+			DBG1(DBG_APP, "  PFS is enabled by specifying a DH group in the "
+				 "'esp' cipher suite", kw->entry->name);
+			break;
+		default:
+			break;
+	}
+	return TRUE;
+}
+
 static void default_values(starter_config_t *cfg)
 {
 	if (cfg == NULL)
@@ -60,7 +99,7 @@ static void default_values(starter_config_t *cfg)
 
 	memset(cfg, 0, sizeof(struct starter_config));
 
-    /* is there enough space for all seen flags? */
+	/* is there enough space for all seen flags? */
 	assert(KW_SETUP_LAST - KW_SETUP_FIRST <
 		sizeof(cfg->setup.seen) * BITS_PER_BYTE);
 	assert(KW_CONN_LAST  - KW_CONN_FIRST <
@@ -70,66 +109,52 @@ static void default_values(starter_config_t *cfg)
 	assert(KW_CA_LAST - KW_CA_FIRST <
 		sizeof(cfg->ca_default.seen) * BITS_PER_BYTE);
 
-	cfg->setup.seen        = LEMPTY;
-	cfg->setup.fragicmp    = TRUE;
-	cfg->setup.hidetos     = TRUE;
+	cfg->setup.seen        = SEEN_NONE;
 	cfg->setup.uniqueids   = TRUE;
-	cfg->setup.interfaces  = new_list("%defaultroute");
 
 #ifdef START_CHARON
 	cfg->setup.charonstart = TRUE;
 #endif
-#ifdef START_PLUTO
-	cfg->setup.plutostart  = TRUE;
-#endif
 
-	cfg->conn_default.seen    = LEMPTY;
+	cfg->conn_default.seen    = SEEN_NONE;
 	cfg->conn_default.startup = STARTUP_NO;
 	cfg->conn_default.state   = STATE_IGNORE;
-	cfg->conn_default.policy  = POLICY_ENCRYPT | POLICY_TUNNEL | POLICY_PUBKEY |
-								POLICY_PFS | POLICY_MOBIKE;
+	cfg->conn_default.mode    = MODE_TUNNEL;
+	cfg->conn_default.options = SA_OPTION_MOBIKE;
 
-	cfg->conn_default.ike                   = clone_str(ike_defaults);
-	cfg->conn_default.esp                   = clone_str(esp_defaults);
-	cfg->conn_default.sa_ike_life_seconds   = OAKLEY_ISAKMP_SA_LIFETIME_DEFAULT;
-	cfg->conn_default.sa_ipsec_life_seconds = PLUTO_SA_LIFE_DURATION_DEFAULT;
+	cfg->conn_default.ike                   = strdupnull(ike_defaults);
+	cfg->conn_default.esp                   = strdupnull(esp_defaults);
+	cfg->conn_default.sa_ike_life_seconds   = IKE_LIFETIME_DEFAULT;
+	cfg->conn_default.sa_ipsec_life_seconds = IPSEC_LIFETIME_DEFAULT;
 	cfg->conn_default.sa_rekey_margin       = SA_REPLACEMENT_MARGIN_DEFAULT;
 	cfg->conn_default.sa_rekey_fuzz         = SA_REPLACEMENT_FUZZ_DEFAULT;
 	cfg->conn_default.sa_keying_tries       = SA_REPLACEMENT_RETRIES_DEFAULT;
-	cfg->conn_default.addr_family           = AF_INET;
-	cfg->conn_default.tunnel_addr_family    = AF_INET;
-	cfg->conn_default.install_policy	= TRUE;
-	cfg->conn_default.dpd_delay		=  30; /* seconds */
-	cfg->conn_default.dpd_timeout		= 150; /* seconds */
+	cfg->conn_default.install_policy        = TRUE;
+	cfg->conn_default.dpd_delay             =  30; /* seconds */
+	cfg->conn_default.dpd_timeout           = 150; /* seconds */
 
-	cfg->conn_default.left.seen  = LEMPTY;
-	cfg->conn_default.right.seen = LEMPTY;
+	cfg->conn_default.left.seen  = SEEN_NONE;
+	cfg->conn_default.right.seen = SEEN_NONE;
 
 	cfg->conn_default.left.sendcert  = CERT_SEND_IF_ASKED;
 	cfg->conn_default.right.sendcert = CERT_SEND_IF_ASKED;
 
-	anyaddr(AF_INET, &cfg->conn_default.left.addr);
-	anyaddr(AF_INET, &cfg->conn_default.left.nexthop);
-	anyaddr(AF_INET, &cfg->conn_default.right.addr);
-	anyaddr(AF_INET, &cfg->conn_default.right.nexthop);
 	cfg->conn_default.left.ikeport = 500;
 	cfg->conn_default.right.ikeport = 500;
 
-	cfg->ca_default.seen = LEMPTY;
+	cfg->ca_default.seen = SEEN_NONE;
 }
 
-#define KW_POLICY_FLAG(sy, sn, fl) \
-		if (streq(kw->value, sy)) { conn->policy |= fl; } \
-		else if (streq(kw->value, sn)) { conn->policy &= ~fl; } \
-		else { plog("# bad policy value: %s=%s", kw->entry->name, kw->value); cfg->err++; }
+#define KW_SA_OPTION_FLAG(sy, sn, fl) \
+		if (streq(kw->value, sy)) { conn->options |= fl; } \
+		else if (streq(kw->value, sn)) { conn->options &= ~fl; } \
+		else { DBG1(DBG_APP, "# bad option value: %s=%s", kw->entry->name, kw->value); cfg->err++; }
 
 static void load_setup(starter_config_t *cfg, config_parsed_t *cfgp)
 {
 	kw_list_t *kw;
 
-	DBG(DBG_CONTROL,
-		DBG_log("Loading config setup")
-    )
+	DBG2(DBG_APP, "Loading config setup");
 
 	for (kw = cfgp->config_setup; kw; kw = kw->next)
 	{
@@ -139,45 +164,49 @@ static void load_setup(starter_config_t *cfg, config_parsed_t *cfgp)
 
 		if ((int)token < KW_SETUP_FIRST || token > KW_SETUP_LAST)
 		{
-			plog("# unsupported keyword '%s' in config setup", kw->entry->name);
+			DBG1(DBG_APP, "# unsupported keyword '%s' in config setup",
+				 kw->entry->name);
 			cfg->err++;
 			continue;
 		}
 
+		if (is_deprecated(token, kw, ""))
+		{
+			cfg->non_fatal_err++;
+			continue;
+		}
+
 		if (!assign_arg(token, KW_SETUP_FIRST, kw, (char *)cfg, &assigned))
 		{
-			plog("  bad argument value in config setup");
+			DBG1(DBG_APP, "  bad argument value in config setup");
 			cfg->err++;
 			continue;
 		}
 	}
 
-	/* verify the executables are actually available (some distros split
-	 * packages but enabled both) */
+	/* verify the executables are actually available */
 #ifdef START_CHARON
 	cfg->setup.charonstart = cfg->setup.charonstart &&
 							 daemon_exists("charon", CHARON_CMD);
 #else
 	cfg->setup.charonstart = FALSE;
 #endif
-#ifdef START_PLUTO
-	cfg->setup.plutostart = cfg->setup.plutostart &&
-							daemon_exists("pluto", PLUTO_CMD);
-#else
-	cfg->setup.plutostart = FALSE;
-#endif
 }
 
 static void kw_end(starter_conn_t *conn, starter_end_t *end, kw_token_t token,
 				   kw_list_t *kw, char *conn_name, starter_config_t *cfg)
 {
-	err_t ugh = NULL;
 	bool assigned = FALSE;
-	bool has_port_wildcard;        /* set if port is %any */
 
 	char *name  = kw->entry->name;
 	char *value = kw->value;
 
+	if (is_deprecated(token, kw, conn_name))
+	{
+		cfg->non_fatal_err++;
+		return;
+	}
+
 	if (!assign_arg(token, KW_END_FIRST, kw, (char *)end, &assigned))
 		goto err;
 
@@ -185,157 +214,25 @@ static void kw_end(starter_conn_t *conn, starter_end_t *end, kw_token_t token,
 	switch (token)
 	{
 	case KW_HOST:
-		free(end->host);
-		end->host = NULL;
-		if (streq(value, "%defaultroute"))
+		if (value && strlen(value) > 0 && value[0] == '%')
 		{
-			if (cfg->defaultroute.defined)
+			if (streq(value, "%defaultroute"))
 			{
-				end->addr    = cfg->defaultroute.addr;
-				end->nexthop = cfg->defaultroute.nexthop;
+				value = "%any";
 			}
-			else if (!cfg->defaultroute.supported)
-			{
-				plog("%%defaultroute not supported, fallback to %%any");
-			}
-			else
-			{
-				plog("# default route not known: %s=%s", name, value);
-				goto err;
-			}
-		}
-		else if (streq(value, "%any") || streq(value, "%any4"))
-		{
-			anyaddr(conn->addr_family, &end->addr);
-		}
-		else if (streq(value, "%any6"))
-		{
-			conn->addr_family = AF_INET6;
-			anyaddr(conn->addr_family, &end->addr);
-		}
-		else if (streq(value, "%group"))
-		{
-			ip_address any;
-
-			conn->policy |= POLICY_GROUP | POLICY_TUNNEL;
-			anyaddr(conn->addr_family, &end->addr);
-			anyaddr(conn->tunnel_addr_family, &any);
-			end->has_client = TRUE;
-		}
-		else
-		{
-			/* check for allow_any prefix */
-			if (value[0] == '%')
-			{
+			if (!streq(value, "%any") && !streq(value, "%any4") &&
+				!streq(value, "%any6"))
+			{	/* allow_any prefix */
 				end->allow_any = TRUE;
 				value++;
 			}
-			conn->addr_family = ip_version(value);
-			ugh = ttoaddr(value, 0, conn->addr_family, &end->addr);
-			if (ugh != NULL)
-			{
-				plog("# bad addr: %s=%s [%s]", name, value, ugh);
-				if (streq(ugh, "does not look numeric and name lookup failed"))
-				{
-					end->dns_failed = TRUE;
-					anyaddr(conn->addr_family, &end->addr);
-				}
-				else
-				{
-					goto err;
-				}
-			}
-			end->host = clone_str(value);
-		}
-		break;
-	case KW_SUBNET:
-		if ((strlen(value) >= 6 && strncmp(value,"vhost:",6) == 0)
-		||  (strlen(value) >= 5 && strncmp(value,"vnet:",5) == 0))
-		{
-			/* used by pluto only */
-			end->has_virt = TRUE;
-		}
-		else
-		{
-			ip_subnet net;
-			char *pos;
-			int len = 0;
-
-			end->has_client = TRUE;
-			conn->tunnel_addr_family = ip_version(value);
-
-			pos = strchr(value, ',');
-			if (pos)
-			{
-				len = pos - value;
-			}
-			ugh = ttosubnet(value, len, ip_version(value), &net);
-			if (ugh != NULL)
-			{
-				plog("# bad subnet: %s=%s [%s]", name, value, ugh);
-				goto err;
-			}
 		}
+		free(end->host);
+		end->host = strdupnull(value);
 		break;
 	case KW_SOURCEIP:
-		if (end->has_natip)
-		{
-			plog("# natip and sourceip cannot be defined at the same time");
-			goto err;
-		}
-		if (value[0] == '%')
-		{
-			if (streq(value, "%modeconfig") || streq(value, "%modecfg") ||
-				streq(value, "%config") || streq(value, "%cfg"))
-			{
-				/* request ip via config payload */
-				free(end->sourceip);
-				end->sourceip = NULL;
-				end->sourceip_mask = 1;
-			}
-			else
-			{	/* %poolname, strip %, serve ip requests */
-				free(end->sourceip);
-				end->sourceip = clone_str(value+1);
-				end->sourceip_mask = 0;
-			}
-			end->modecfg = TRUE;
-		}
-		else
-		{
-			char *pos;
-			ip_address addr;
-			ip_subnet net;
-
-			conn->tunnel_addr_family = ip_version(value);
-			pos = strchr(value, '/');
-
-			if (pos)
-			{	/* CIDR notation, address pool */
-				ugh = ttosubnet(value, 0, conn->tunnel_addr_family, &net);
-				if (ugh != NULL)
-				{
-					plog("# bad subnet: %s=%s [%s]", name, value, ugh);
-					goto err;
-				 }
-				*pos = '\0';
-				free(end->sourceip);
-				end->sourceip = clone_str(value);
-				end->sourceip_mask = atoi(pos + 1);
-			}
-			else
-			{	/* fixed srcip */
-				ugh = ttoaddr(value, 0, conn->tunnel_addr_family, &addr);
-				if (ugh != NULL)
-				{
-					plog("# bad addr: %s=%s [%s]", name, value, ugh);
-					goto err;
-				}
-				end->sourceip_mask = (conn->tunnel_addr_family == AF_INET) ?
-									  32 : 128;
-			}
-		}
-		conn->policy |= POLICY_TUNNEL;
+		conn->mode = MODE_TUNNEL;
+		conn->proxy_mode = FALSE;
 		break;
 	case KW_SENDCERT:
 		if (end->sendcert == CERT_YES_SEND)
@@ -357,139 +254,97 @@ static void kw_end(starter_conn_t *conn, starter_end_t *end, kw_token_t token,
 	/* individual processing of keywords that were not assigned automatically */
 	switch (token)
 	{
-	case KW_NEXTHOP:
-		if (streq(value, "%defaultroute"))
+	case KW_PROTOPORT:
+	{
+		struct protoent *proto;
+		struct servent *svc;
+		char *sep, *port = "", *endptr;
+		long int p;
+
+		sep = strchr(value, '/');
+		if (sep)
+		{	/* protocol/port */
+			*sep = '\0';
+			port = sep + 1;
+		}
+
+		if (streq(value, "%any"))
 		{
-			if (cfg->defaultroute.defined)
+			end->protocol = 0;
+		}
+		else
+		{
+			proto = getprotobyname(value);
+			if (proto)
 			{
-				end->nexthop = cfg->defaultroute.nexthop;
+				end->protocol = proto->p_proto;
 			}
 			else
 			{
-				plog("# default route not known: %s=%s", name, value);
-				goto err;
+				p = strtol(value, &endptr, 0);
+				if ((*value && *endptr) || p < 0 || p > 0xff)
+				{
+					DBG1(DBG_APP, "# bad protocol: %s=%s", name, value);
+					goto err;
+				}
+				end->protocol = (u_int8_t)p;
 			}
 		}
-		else if (streq(value, "%direct"))
+		if (streq(port, "%any"))
 		{
-			ugh = anyaddr(conn->addr_family, &end->nexthop);
+			end->port = 0;
 		}
 		else
 		{
-			conn->addr_family = ip_version(value);
-			ugh = ttoaddr(value, 0, conn->addr_family, &end->nexthop);
-		}
-		if (ugh != NULL)
-		{
-			plog("# bad addr: %s=%s [%s]", name, value, ugh);
-			goto err;
-		}
-		break;
-	case KW_SUBNETWITHIN:
-	{
-		ip_subnet net;
-
-		end->has_client = TRUE;
-		end->has_client_wildcard = TRUE;
-		conn->tunnel_addr_family = ip_version(value);
-
-		ugh = ttosubnet(value, 0, ip_version(value), &net);
-		if (ugh != NULL)
-		{
-			plog("# bad subnet: %s=%s [%s]", name, value, ugh);
-			goto err;
-		}
-		end->subnet = clone_str(value);
-		break;
-	}
-	case KW_PROTOPORT:
-		ugh = ttoprotoport(value, 0, &end->protocol, &end->port, &has_port_wildcard);
-		end->has_port_wildcard = has_port_wildcard;
-		break;
-	case KW_NATIP:
-		if (end->sourceip)
-		{
-			plog("# natip and sourceip cannot be defined at the same time");
-			goto err;
-		}
-		if (streq(value, "%defaultroute"))
-		{
-			char buf[64];
-
-			if (cfg->defaultroute.defined)
+			svc = getservbyname(port, NULL);
+			if (svc)
 			{
-				addrtot(&cfg->defaultroute.addr, 0, buf, sizeof(buf));
-				end->sourceip = clone_str(buf);
+				end->port = ntohs(svc->s_port);
 			}
 			else
 			{
-				plog("# default route not known: %s=%s", name, value);
-				goto err;
+				p = strtol(port, &endptr, 0);
+				if ((*port && *endptr) || p < 0 || p > 0xffff)
+				{
+					DBG1(DBG_APP, "# bad port: %s=%s", name, value);
+					goto err;
+				}
+				end->port = (u_int16_t)p;
 			}
 		}
-		else
-		{
-			ip_address addr;
-
-			conn->tunnel_addr_family = ip_version(value);
-			ugh = ttoaddr(value, 0, conn->tunnel_addr_family, &addr);
-			if (ugh != NULL)
-			{
-				plog("# bad addr: %s=%s [%s]", name, value, ugh);
-				goto err;
-			}
-			end->sourceip = clone_str(value);
+		if (sep)
+		{	/* restore the original text in case also= is used */
+			*sep = '/';
 		}
-		end->has_natip = TRUE;
-		conn->policy |= POLICY_TUNNEL;
 		break;
+	}
 	default:
 		break;
 	}
 	return;
 
 err:
-	plog("  bad argument value in conn '%s'", conn_name);
+	DBG1(DBG_APP, "  bad argument value in conn '%s'", conn_name);
 	cfg->err++;
 }
 
 /*
- * handles left|right=<FQDN> DNS resolution failure
- */
-static void handle_dns_failure(const char *label, starter_end_t *end,
-							   starter_config_t *cfg, starter_conn_t *conn)
-{
-	if (end->dns_failed)
-	{
-		if (end->allow_any)
-		{
-			plog("# fallback to %s=%%any due to '%%' prefix or %sallowany=yes",
-				label, label);
-		}
-		else if (!end->host || conn->keyexchange == KEY_EXCHANGE_IKEV1)
-		{
-			/* declare an error */
-			cfg->err++;
-		}
-	}
-}
-
-/*
  * handles left|rightfirewall and left|rightupdown parameters
  */
 static void handle_firewall(const char *label, starter_end_t *end,
 							starter_config_t *cfg)
 {
-	if (end->firewall && (end->seen & LELEM(KW_FIREWALL - KW_END_FIRST)))
+	if (end->firewall && (end->seen & SEEN_KW(KW_FIREWALL, KW_END_FIRST)))
 	{
 		if (end->updown != NULL)
 		{
-			plog("# cannot have both %sfirewall and %supdown", label, label);
+			DBG1(DBG_APP, "# cannot have both %sfirewall and %supdown", label,
+				 label);
 			cfg->err++;
 		}
 		else
 		{
-			end->updown = clone_str(firewall_defaults);
+			end->updown = strdupnull(firewall_defaults);
 			end->firewall = FALSE;
 		}
 	}
@@ -497,16 +352,16 @@ static void handle_firewall(const char *label, starter_end_t *end,
 
 static bool handle_mark(char *value, mark_t *mark)
 {
-	char *pos, *endptr;
+	char *sep, *endptr;
 
-	pos = strchr(value, '/');
-	if (pos)
+	sep = strchr(value, '/');
+	if (sep)
 	{
-		*pos = '\0';
-		mark->mask = strtoul(pos+1, &endptr, 0);
+		*sep = '\0';
+		mark->mask = strtoul(sep+1, &endptr, 0);
 		if (*endptr != '\0')
 		{
-			plog("# invalid mark mask: %s", pos+1);
+			DBG1(DBG_APP, "# invalid mark mask: %s", sep+1);
 			return FALSE;
 		}
 	}
@@ -523,10 +378,16 @@ static bool handle_mark(char *value, mark_t *mark)
 		mark->value = strtoul(value, &endptr, 0);
 		if (*endptr != '\0')
 		{
-			plog("# invalid mark value: %s", value);
+			DBG1(DBG_APP, "# invalid mark value: %s", value);
 			return FALSE;
 		}
 	}
+	if (sep)
+	{	/* restore the original text in case also= is used */
+		*sep = '/';
+	}
+	/* apply the mask to ensure the value is in range */
+	mark->value &= mark->mask;
 	return TRUE;
 }
 
@@ -566,28 +427,32 @@ static void load_conn(starter_conn_t *conn, kw_list_t *kw, starter_config_t *cfg
 			{
 				also_t *also = malloc_thing(also_t);
 
-				also->name = clone_str(kw->value);
+				also->name = strdupnull(kw->value);
 				also->next = conn->also;
 				conn->also = also;
 
-				DBG(DBG_CONTROL,
-					DBG_log("  also=%s", kw->value)
-				)
+				DBG2(DBG_APP, "  also=%s", kw->value);
 			}
 			continue;
 		}
 
 		if (token < KW_CONN_FIRST || token > KW_CONN_LAST)
 		{
-			plog("# unsupported keyword '%s' in conn '%s'"
-				, kw->entry->name, conn_name);
+			DBG1(DBG_APP, "# unsupported keyword '%s' in conn '%s'",
+				 kw->entry->name, conn_name);
 			cfg->err++;
 			continue;
 		}
 
+		if (is_deprecated(token, kw, conn_name))
+		{
+			cfg->non_fatal_err++;
+			continue;
+		}
+
 		if (!assign_arg(token, KW_CONN_FIRST, kw, (char *)conn, &assigned))
 		{
-			plog("  bad argument value in conn '%s'", conn_name);
+			DBG1(DBG_APP, "  bad argument value in conn '%s'", conn_name);
 			cfg->err++;
 			continue;
 		}
@@ -598,125 +463,42 @@ static void load_conn(starter_conn_t *conn, kw_list_t *kw, starter_config_t *cfg
 		switch (token)
 		{
 		case KW_TYPE:
-			conn->policy &= ~(POLICY_TUNNEL | POLICY_SHUNT_MASK);
+			conn->mode = MODE_TRANSPORT;
+			conn->proxy_mode = FALSE;
 			if (streq(kw->value, "tunnel"))
 			{
-				conn->policy |= POLICY_TUNNEL;
+				conn->mode = MODE_TUNNEL;
 			}
 			else if (streq(kw->value, "beet"))
 			{
-				conn->policy |= POLICY_BEET;
+				conn->mode = MODE_BEET;
 			}
 			else if (streq(kw->value, "transport_proxy"))
 			{
-				conn->policy |= POLICY_PROXY;
+				conn->mode = MODE_TRANSPORT;
+				conn->proxy_mode = TRUE;
 			}
 			else if (streq(kw->value, "passthrough") || streq(kw->value, "pass"))
 			{
-				conn->policy |= POLICY_SHUNT_PASS;
+				conn->mode = MODE_PASS;
 			}
-			else if (streq(kw->value, "drop"))
+			else if (streq(kw->value, "drop") || streq(kw->value, "reject"))
 			{
-				conn->policy |= POLICY_SHUNT_DROP;
+				conn->mode = MODE_DROP;
 			}
-			else if (streq(kw->value, "reject"))
+			else if (!streq(kw->value, "transport"))
 			{
-				conn->policy |= POLICY_SHUNT_REJECT;
-			}
-			else if (strcmp(kw->value, "transport") != 0)
-			{
-				plog("# bad policy value: %s=%s", kw->entry->name, kw->value);
+				DBG1(DBG_APP, "# bad policy value: %s=%s", kw->entry->name,
+					 kw->value);
 				cfg->err++;
 			}
 			break;
-		case KW_PFS:
-			KW_POLICY_FLAG("yes", "no", POLICY_PFS)
-			break;
 		case KW_COMPRESS:
-			KW_POLICY_FLAG("yes", "no", POLICY_COMPRESS)
+			KW_SA_OPTION_FLAG("yes", "no", SA_OPTION_COMPRESS)
 			break;
 		case KW_AUTH:
-			KW_POLICY_FLAG("ah", "esp", POLICY_AUTHENTICATE)
-			break;
-		case KW_AUTHBY:
-			conn->policy &= ~(POLICY_ID_AUTH_MASK | POLICY_ENCRYPT);
-
-			if (!streq(kw->value, "never"))
-			{
-				char *value = kw->value;
-				char *second = strchr(kw->value, '|');
-
-				if (second != NULL)
-				{
-					*second = '\0';
-				}
-
-				/* also handles the cases secret|rsasig and rsasig|secret */
-				for (;;)
-				{
-					if (streq(value, "rsa")   || streq(value, "rsasig")   ||
-						streq(value, "ecdsa") || streq(value, "ecdsasig") ||
-						streq(value, "pubkey"))
-					{
-						conn->policy |= POLICY_PUBKEY | POLICY_ENCRYPT;
-					}
-					else if (streq(value, "secret") || streq(value, "psk"))
-					{
-						conn->policy |= POLICY_PSK | POLICY_ENCRYPT;
-					}
-					else if (streq(value, "xauthrsasig"))
-					{
-						conn->policy |= POLICY_XAUTH_RSASIG | POLICY_ENCRYPT;
-					}
-					else if (streq(value, "xauthpsk") || streq(value, "eap"))
-					{
-						conn->policy |= POLICY_XAUTH_PSK | POLICY_ENCRYPT;
-					}
-					else
-					{
-						plog("# bad policy value: %s=%s", kw->entry->name, kw->value);
-						cfg->err++;
-						break;
-					}
-					if (second == NULL)
-					{
-						break;
-					}
-					value = second;
-					second = NULL; /* traverse the loop no more than twice */
-				}
-			}
-			break;
-		case KW_EAP:
-		{
-			char *sep;
-
-			/* check for vendor-type format */
-			sep = strchr(kw->value, '-');
-			if (sep)
-			{
-				*(sep++) = '\0';
-				conn->eap_type = atoi(kw->value);
-				conn->eap_vendor = atoi(sep);
-				if (conn->eap_type == 0 || conn->eap_vendor == 0)
-				{
-					plog("# invalid EAP type: %s=%s", kw->entry->name, kw->value);
-					cfg->err++;
-				}
-				break;
-			}
-			conn->eap_type = eap_type_from_string(kw->value);
-			if (conn->eap_type == 0)
-			{
-				conn->eap_type = atoi(kw->value);
-				if (conn->eap_type == 0)
-				{
-					plog("# unknown EAP type: %s=%s", kw->entry->name, kw->value);
-					cfg->err++;
-				}
-			}
+			KW_SA_OPTION_FLAG("ah", "esp", SA_OPTION_AUTHENTICATE)
 			break;
-		}
 		case KW_MARK:
 			if (!handle_mark(kw->value, &conn->mark_in))
 			{
@@ -749,7 +531,8 @@ static void load_conn(starter_conn_t *conn, kw_list_t *kw, starter_config_t *cfg
 				conn->tfc = strtoul(kw->value, &endptr, 10);
 				if (*endptr != '\0')
 				{
-					plog("# bad integer value: %s=%s", kw->entry->name, kw->value);
+					DBG1(DBG_APP, "# bad integer value: %s=%s", kw->entry->name,
+						 kw->value);
 					cfg->err++;
 				}
 			}
@@ -766,36 +549,35 @@ static void load_conn(starter_conn_t *conn, kw_list_t *kw, starter_config_t *cfg
 				conn->sa_keying_tries = strtoul(kw->value, &endptr, 10);
 				if (*endptr != '\0')
 				{
-					plog("# bad integer value: %s=%s", kw->entry->name, kw->value);
+					DBG1(DBG_APP, "# bad integer value: %s=%s", kw->entry->name,
+						 kw->value);
 					cfg->err++;
 				}
 			}
 			break;
 		case KW_REKEY:
-			KW_POLICY_FLAG("no", "yes", POLICY_DONT_REKEY)
+			KW_SA_OPTION_FLAG("no", "yes", SA_OPTION_DONT_REKEY)
 			break;
 		case KW_REAUTH:
-			KW_POLICY_FLAG("no", "yes", POLICY_DONT_REAUTH)
+			KW_SA_OPTION_FLAG("no", "yes", SA_OPTION_DONT_REAUTH)
 			break;
 		case KW_MOBIKE:
-			KW_POLICY_FLAG("yes", "no", POLICY_MOBIKE)
+			KW_SA_OPTION_FLAG("yes", "no", SA_OPTION_MOBIKE)
 			break;
 		case KW_FORCEENCAPS:
-			KW_POLICY_FLAG("yes", "no", POLICY_FORCE_ENCAP)
+			KW_SA_OPTION_FLAG("yes", "no", SA_OPTION_FORCE_ENCAP)
 			break;
 		case KW_MODECONFIG:
-			KW_POLICY_FLAG("push", "pull", POLICY_MODECFG_PUSH)
+			KW_SA_OPTION_FLAG("push", "pull", SA_OPTION_MODECFG_PUSH)
 			break;
 		case KW_XAUTH:
-			KW_POLICY_FLAG("server", "client", POLICY_XAUTH_SERVER)
+			KW_SA_OPTION_FLAG("server", "client", SA_OPTION_XAUTH_SERVER)
 			break;
 		default:
 			break;
 		}
 	}
 
-	handle_dns_failure("left", &conn->left, cfg, conn);
-	handle_dns_failure("right", &conn->right, cfg, conn);
 	handle_firewall("left", &conn->left, cfg);
 	handle_firewall("right", &conn->right, cfg);
 }
@@ -806,7 +588,7 @@ static void load_conn(starter_conn_t *conn, kw_list_t *kw, starter_config_t *cfg
 static void conn_default(char *name, starter_conn_t *conn, starter_conn_t *def)
 {
 	memcpy(conn, def, sizeof(starter_conn_t));
-	conn->name = clone_str(name);
+	conn->name = strdupnull(name);
 
 	clone_args(KW_CONN_FIRST, KW_CONN_LAST, (char *)conn, (char *)def);
 	clone_args(KW_END_FIRST, KW_END_LAST, (char *)&conn->left, (char *)&def->left);
@@ -836,27 +618,32 @@ static void load_ca(starter_ca_t *ca, kw_list_t *kw, starter_config_t *cfg)
 			{
 				also_t *also = malloc_thing(also_t);
 
-				also->name = clone_str(kw->value);
+				also->name = strdupnull(kw->value);
 				also->next = ca->also;
 				ca->also = also;
 
-				DBG(DBG_CONTROL,
-					DBG_log("  also=%s", kw->value)
-				)
+				DBG2(DBG_APP, "  also=%s", kw->value);
 			}
 			continue;
 		}
 
 		if (token < KW_CA_FIRST || token > KW_CA_LAST)
 		{
-			plog("# unsupported keyword '%s' in ca '%s'", kw->entry->name, ca_name);
+			DBG1(DBG_APP, "# unsupported keyword '%s' in ca '%s'",
+				 kw->entry->name, ca_name);
 			cfg->err++;
 			continue;
 		}
 
+		if (is_deprecated(token, kw, ca_name))
+		{
+			cfg->non_fatal_err++;
+			continue;
+		}
+
 		if (!assign_arg(token, KW_CA_FIRST, kw, (char *)ca, &assigned))
 		{
-			plog("  bad argument value in ca '%s'", ca_name);
+			DBG1(DBG_APP, "  bad argument value in ca '%s'", ca_name);
 			cfg->err++;
 		}
 	}
@@ -872,7 +659,7 @@ static void load_ca(starter_ca_t *ca, kw_list_t *kw, starter_config_t *cfg)
 static void ca_default(char *name, starter_ca_t *ca, starter_ca_t *def)
 {
 	memcpy(ca, def, sizeof(starter_ca_t));
-	ca->name = clone_str(name);
+	ca->name = strdupnull(name);
 
 	clone_args(KW_CA_FIRST, KW_CA_LAST, (char *)ca, (char *)def);
 }
@@ -889,13 +676,12 @@ static void load_also_conns(starter_conn_t *conn, also_t *also,
 
 		if (kw == NULL)
 		{
-			plog("  conn '%s' cannot include '%s'", conn->name, also->name);
+			DBG1(DBG_APP, "  conn '%s' cannot include '%s'", conn->name,
+				 also->name);
 		}
 		else
 		{
-			DBG(DBG_CONTROL,
-				DBG_log("conn '%s' includes '%s'", conn->name, also->name)
-			)
+			DBG2(DBG_APP, "conn '%s' includes '%s'", conn->name, also->name);
 			/* only load if no error occurred in the first round */
 			if (cfg->err == 0)
 				load_conn(conn, kw, cfg);
@@ -918,7 +704,7 @@ static kw_list_t* find_also_conn(const char* name, starter_conn_t *conn,
 		{
 			if (conn->visit == c->visit)
 			{
-				plog("# detected also loop");
+				DBG1(DBG_APP, "# detected also loop");
 				cfg->err++;
 				return NULL;
 			}
@@ -929,7 +715,7 @@ static kw_list_t* find_also_conn(const char* name, starter_conn_t *conn,
 		c = c->next;
 	}
 
-	plog("# also '%s' not found", name);
+	DBG1(DBG_APP, "# also '%s' not found", name);
 	cfg->err++;
 	return NULL;
 }
@@ -945,13 +731,12 @@ static void load_also_cas(starter_ca_t *ca, also_t *also, starter_config_t *cfg)
 
 		if (kw == NULL)
 		{
-			plog("  ca '%s' cannot include '%s'", ca->name, also->name);
+			DBG1(DBG_APP, "  ca '%s' cannot include '%s'", ca->name,
+				 also->name);
 		}
 		else
 		{
-			DBG(DBG_CONTROL,
-				DBG_log("ca '%s' includes '%s'", ca->name, also->name)
-			)
+			DBG2(DBG_APP, "ca '%s' includes '%s'", ca->name, also->name);
 			/* only load if no error occurred in the first round */
 			if (cfg->err == 0)
 			load_ca(ca, kw, cfg);
@@ -974,7 +759,7 @@ static kw_list_t* find_also_ca(const char* name, starter_ca_t *ca,
 		{
 			if (ca->visit == c->visit)
 			{
-				plog("# detected also loop");
+				DBG1(DBG_APP, "# detected also loop");
 				cfg->err++;
 				return NULL;
 			}
@@ -985,7 +770,7 @@ static kw_list_t* find_also_ca(const char* name, starter_ca_t *ca,
 		c = c->next;
 	}
 
-	plog("# also '%s' not found", name);
+	DBG1(DBG_APP, "# also '%s' not found", name);
 	cfg->err++;
 	return NULL;
 }
@@ -1086,9 +871,6 @@ starter_config_t* confread_load(const char *file)
 	/* set default values */
 	default_values(cfg);
 
-	/* determine default route */
-	get_defaultroute(&cfg->defaultroute);
-
 	/* load config setup section */
 	load_setup(cfg, cfgp);
 
@@ -1100,15 +882,13 @@ starter_config_t* confread_load(const char *file)
 	{
 		if (streq(sca->name, "%default"))
 		{
-			DBG(DBG_CONTROL,
-				DBG_log("Loading ca %%default")
-			)
+			DBG2(DBG_APP, "Loading ca %%default");
 			load_ca(&cfg->ca_default, sca->kw, cfg);
 		}
 	}
 
 	/* parameters defined in ca %default sections can be overloads */
-	cfg->ca_default.seen = LEMPTY;
+	cfg->ca_default.seen = SEEN_NONE;
 
 	/* load other ca sections */
 	for (sca = cfgp->ca_first; sca; sca = sca->next)
@@ -1119,9 +899,7 @@ starter_config_t* confread_load(const char *file)
 		if (streq(sca->name, "%default"))
 			continue;
 
-		DBG(DBG_CONTROL,
-			DBG_log("Loading ca '%s'", sca->name)
-		)
+		DBG2(DBG_APP, "Loading ca '%s'", sca->name);
 		ca = malloc_thing(starter_ca_t);
 
 		ca_default(sca->name, ca, &cfg->ca_default);
@@ -1169,17 +947,15 @@ starter_config_t* confread_load(const char *file)
 	{
 		if (streq(sconn->name, "%default"))
 		{
-			DBG(DBG_CONTROL,
-				DBG_log("Loading conn %%default")
-			)
+			DBG2(DBG_APP, "Loading conn %%default");
 			load_conn(&cfg->conn_default, sconn->kw, cfg);
 		}
 	}
 
-	/* parameter defined in conn %default sections can be overloaded */
-	cfg->conn_default.seen       = LEMPTY;
-	cfg->conn_default.right.seen = LEMPTY;
-	cfg->conn_default.left.seen  = LEMPTY;
+	/* parameters defined in conn %default sections can be overloaded */
+	cfg->conn_default.seen       = SEEN_NONE;
+	cfg->conn_default.right.seen = SEEN_NONE;
+	cfg->conn_default.left.seen  = SEEN_NONE;
 
 	/* load other conn sections */
 	for (sconn = cfgp->conn_first; sconn; sconn = sconn->next)
@@ -1190,9 +966,7 @@ starter_config_t* confread_load(const char *file)
 		if (streq(sconn->name, "%default"))
 			continue;
 
-		DBG(DBG_CONTROL,
-			DBG_log("Loading conn '%s'", sconn->name)
-		)
+		DBG2(DBG_APP, "Loading conn '%s'", sconn->name);
 		conn = malloc_thing(starter_conn_t);
 
 		conn_default(sconn->name, conn, &cfg->conn_default);
@@ -1245,8 +1019,8 @@ starter_config_t* confread_load(const char *file)
 	total_err = cfg->err + cfg->non_fatal_err;
 	if (total_err > 0)
 	{
-		plog("### %d parsing error%s (%d fatal) ###"
-			, total_err, (total_err > 1)?"s":"", cfg->err);
+		DBG1(DBG_APP, "### %d parsing error%s (%d fatal) ###",
+			 total_err, (total_err > 1)?"s":"", cfg->err);
 	}
 
 	return cfg;
diff --git a/src/starter/confread.h b/src/starter/confread.h
index 9cb919ce5..3f2079883 100644
--- a/src/starter/confread.h
+++ b/src/starter/confread.h
@@ -16,12 +16,14 @@
 #ifndef _IPSEC_CONFREAD_H_
 #define _IPSEC_CONFREAD_H_
 
-#ifndef _FREESWAN_H
-#include <freeswan.h>
-#endif
+#include <kernel/kernel_ipsec.h>
 
 #include "ipsec-parser.h"
-#include "interfaces.h"
+
+/** to mark seen keywords */
+typedef u_int64_t seen_t;
+#define SEEN_NONE 0;
+#define SEEN_KW(kw, base) ((seen_t)1 << ((kw) - (base)))
 
 typedef enum {
 		STARTUP_NO,
@@ -39,9 +41,10 @@ typedef enum {
 } starter_state_t;
 
 typedef enum {
-		KEY_EXCHANGE_IKE,
-		KEY_EXCHANGE_IKEV1,
-		KEY_EXCHANGE_IKEV2
+		/* shared with ike_version_t */
+		KEY_EXCHANGE_IKE = 0,
+		KEY_EXCHANGE_IKEV1 = 1,
+		KEY_EXCHANGE_IKEV2 = 2,
 } keyexchange_t;
 
 typedef enum {
@@ -50,10 +53,40 @@ typedef enum {
 		STRICT_IFURI
 } strict_t;
 
+typedef enum {
+		CERT_ALWAYS_SEND,
+		CERT_SEND_IF_ASKED,
+		CERT_NEVER_SEND,
+		CERT_YES_SEND,		/* synonym for CERT_ALWAYS_SEND */
+		CERT_NO_SEND,		/* synonym for CERT_NEVER_SEND */
+} certpolicy_t;
+
+typedef enum {
+		DPD_ACTION_NONE,
+		DPD_ACTION_CLEAR,
+		DPD_ACTION_HOLD,
+		DPD_ACTION_RESTART,
+		DPD_ACTION_UNKNOW,
+} dpd_action_t;
+
+typedef enum {
+		/* IPsec options */
+		SA_OPTION_AUTHENTICATE	= 1 << 0, /* use AH instead of ESP? */
+		SA_OPTION_COMPRESS      = 1 << 1, /* use IPComp */
+
+		/* IKE and other other options */
+		SA_OPTION_DONT_REKEY	= 1 << 2, /* don't rekey state either Phase */
+		SA_OPTION_DONT_REAUTH	= 1 << 3, /* don't reauthenticate on rekeying, IKEv2 only */
+		SA_OPTION_MODECFG_PUSH	= 1 << 4, /* is modecfg pushed by server? */
+		SA_OPTION_XAUTH_SERVER  = 1 << 5, /* are we an XAUTH server? */
+		SA_OPTION_MOBIKE		= 1 << 6, /* enable MOBIKE for IKEv2  */
+		SA_OPTION_FORCE_ENCAP   = 1 << 7, /* force UDP encapsulation */
+} sa_option_t;
+
 typedef struct starter_end starter_end_t;
 
 struct starter_end {
-		lset_t          seen;
+		seen_t          seen;
 		char            *auth;
 		char            *auth2;
 		char            *id;
@@ -64,29 +97,21 @@ struct starter_end {
 		char            *ca;
 		char            *ca2;
 		char            *groups;
+		char            *groups2;
 		char            *cert_policy;
-		char            *iface;
 		char            *host;
-		ip_address      addr;
 		u_int           ikeport;
-		ip_address      nexthop;
 		char            *subnet;
-		bool            has_client;
-		bool            has_client_wildcard;
-		bool            has_port_wildcard;
-		bool            has_natip;
-		bool            has_virt;
 		bool            modecfg;
 		certpolicy_t    sendcert;
 		bool            firewall;
 		bool            hostaccess;
 		bool            allow_any;
-		bool            dns_failed;
 		char            *updown;
 		u_int16_t       port;
 		u_int8_t        protocol;
 		char            *sourceip;
-		int				sourceip_mask;
+		char            *dns;
 };
 
 typedef struct also also_t;
@@ -100,7 +125,7 @@ struct also {
 typedef struct starter_conn starter_conn_t;
 
 struct starter_conn {
-		lset_t          seen;
+		seen_t          seen;
 		char            *name;
 		also_t          *also;
 		kw_list_t       *kw;
@@ -109,35 +134,34 @@ struct starter_conn {
 		starter_state_t state;
 
 		keyexchange_t   keyexchange;
-		u_int32_t       eap_type;
-		u_int32_t       eap_vendor;
 		char            *eap_identity;
 		char            *aaa_identity;
 		char            *xauth_identity;
-		lset_t          policy;
+		char            *authby;
+		ipsec_mode_t    mode;
+		bool            proxy_mode;
+		sa_option_t     options;
 		time_t          sa_ike_life_seconds;
 		time_t          sa_ipsec_life_seconds;
 		time_t          sa_rekey_margin;
-		u_int64_t	sa_ipsec_life_bytes;
-		u_int64_t	sa_ipsec_margin_bytes;
-		u_int64_t	sa_ipsec_life_packets;
-		u_int64_t	sa_ipsec_margin_packets;
+		u_int64_t       sa_ipsec_life_bytes;
+		u_int64_t       sa_ipsec_margin_bytes;
+		u_int64_t       sa_ipsec_life_packets;
+		u_int64_t       sa_ipsec_margin_packets;
 		unsigned long   sa_keying_tries;
 		unsigned long   sa_rekey_fuzz;
 		u_int32_t       reqid;
 		mark_t          mark_in;
 		mark_t          mark_out;
 		u_int32_t       tfc;
-		sa_family_t     addr_family;
-		sa_family_t     tunnel_addr_family;
 		bool            install_policy;
+		bool            aggressive;
 		starter_end_t   left, right;
 
 		unsigned long   id;
 
 		char            *esp;
 		char            *ike;
-		char            *pfsgroup;
 
 		time_t          dpd_delay;
 		time_t          dpd_timeout;
@@ -158,7 +182,7 @@ struct starter_conn {
 typedef struct starter_ca starter_ca_t;
 
 struct starter_ca {
-		lset_t          seen;
+		seen_t          seen;
 		char            *name;
 		also_t          *also;
 		kw_list_t       *kw;
@@ -167,13 +191,11 @@ struct starter_ca {
 		starter_state_t state;
 
 		char            *cacert;
-		char            *ldaphost;
-		char            *ldapbase;
 		char            *crluri;
 		char            *crluri2;
 		char            *ocspuri;
 		char            *ocspuri2;
-		char        *certuribase;
+		char            *certuribase;
 
 		bool            strict;
 
@@ -184,43 +206,14 @@ typedef struct starter_config starter_config_t;
 
 struct starter_config {
 		struct {
-				lset_t  seen;
-				char    **interfaces;
-				char    *dumpdir;
-				bool    charonstart;
-				bool    plutostart;
-
-				/* pluto/charon keywords */
-				char     **plutodebug;
+				seen_t  seen;
+				bool     charonstart;
 				char     *charondebug;
-				char     *prepluto;
-				char     *postpluto;
-				char     *plutostderrlog;
 				bool     uniqueids;
-				u_int    overridemtu;
-				time_t   crlcheckinterval;
 				bool     cachecrls;
 				strict_t strictcrlpolicy;
-				bool     nocrsend;
-				bool     nat_traversal;
-				time_t   keep_alive;
-				u_int    force_keepalive;
-				char     *virtual_private;
-				char     *pkcs11module;
-				char     *pkcs11initargs;
-				bool     pkcs11keepstate;
-				bool     pkcs11proxy;
-
-				/* KLIPS keywords */
-				char    **klipsdebug;
-				bool    fragicmp;
-				char    *packetdefault;
-				bool    hidetos;
 		} setup;
 
-		/* information about the default route */
-		defaultroute_t defaultroute;
-
 		/* number of encountered parsing errors */
 		u_int err;
 		u_int non_fatal_err;
diff --git a/src/starter/exec.c b/src/starter/exec.c
deleted file mode 100644
index d4c4f0657..000000000
--- a/src/starter/exec.c
+++ /dev/null
@@ -1,52 +0,0 @@
-/* strongSwan IPsec exec helper function
- * Copyright (C) 2001-2002 Mathieu Lafon - Arkoon Network Security
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#include <stdlib.h>
-#include <stdarg.h>
-#include <string.h>
-#include <stdio.h>
-
-#include <freeswan.h>
-
-#include "../pluto/constants.h"
-#include "../pluto/defs.h"
-#include "../pluto/log.h"
-
-#include "exec.h"
-
-#define BUF_SIZE  2048
-
-/**
- * TODO:
- * o log stdout with LOG_LEVEL_INFO and stderr with LOG_LEVEL_ERR
- */
-
-int
-starter_exec(const char *fmt, ...)
-{
-	va_list args;
-	static char buf[BUF_SIZE];
-	int r;
-
-	va_start (args, fmt);
-	vsnprintf(buf, BUF_SIZE-1, fmt, args);
-	buf[BUF_SIZE - 1] = '\0';
-	va_end(args);
-	r = system(buf);
-	DBG(DBG_CONTROL,
-		DBG_log("starter_exec(%s) = %d", buf, r)
-	)
-	return r;
-}
-
diff --git a/src/starter/exec.h b/src/starter/exec.h
deleted file mode 100644
index 6a6414578..000000000
--- a/src/starter/exec.h
+++ /dev/null
@@ -1,21 +0,0 @@
-/* strongSwan IPsec starter exec helper function
- * Copyright (C) 2001-2002 Mathieu Lafon - Arkoon Network Security
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#ifndef _STARTER_EXEC_H_
-#define _STARTER_EXEC_H_
-
-extern int starter_exec (const char *fmt, ...);
-
-#endif /* _STARTER_EXEC_H_ */
-
diff --git a/src/starter/files.h b/src/starter/files.h
index 88857c0b2..96b76fdf1 100644
--- a/src/starter/files.h
+++ b/src/starter/files.h
@@ -24,10 +24,6 @@
 #define CONFIG_FILE     IPSEC_CONFDIR "/ipsec.conf"
 #define SECRETS_FILE    IPSEC_CONFDIR "/ipsec.secrets"
 
-#define PLUTO_CMD       IPSEC_DIR "/pluto"
-#define PLUTO_CTL_FILE  IPSEC_PIDDIR "/pluto.ctl"
-#define PLUTO_PID_FILE  IPSEC_PIDDIR "/pluto.pid"
-
 #define CHARON_CMD      IPSEC_DIR "/charon"
 #define CHARON_CTL_FILE IPSEC_PIDDIR "/charon.ctl"
 #define CHARON_PID_FILE IPSEC_PIDDIR "/charon.pid"
diff --git a/src/starter/interfaces.c b/src/starter/interfaces.c
deleted file mode 100644
index 4a2ae0a57..000000000
--- a/src/starter/interfaces.c
+++ /dev/null
@@ -1,213 +0,0 @@
-/* strongSwan IPsec interfaces management
- * Copyright (C) 2001-2002 Mathieu Lafon - Arkoon Network Security
- *               2009 Heiko Hund - Astaro AG
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-#include <errno.h>
-
-#include <freeswan.h>
-
-#include <constants.h>
-#include <defs.h>
-#include <log.h>
-
-#include "interfaces.h"
-#include "exec.h"
-#include "files.h"
-
-#ifdef START_PLUTO
-
-#include <sys/socket.h>
-#include <sys/ioctl.h>
-#include <linux/rtnetlink.h>
-#ifdef HAVE_SYS_SOCKIO_H
-#include <sys/sockio.h>
-#endif
-
-/*
- * Get the default route information via rtnetlink
- */
-void
-get_defaultroute(defaultroute_t *defaultroute)
-{
-	union {
-		struct {
-			struct nlmsghdr nh;
-			struct rtmsg    rt;
-		} m;
-		char buf[4096];
-	} rtu;
-
-	struct nlmsghdr *nh;
-	uint32_t best_metric = ~0;
-	ssize_t msglen;
-	int fd;
-
-	memset(&rtu, 0, sizeof(rtu));
-	rtu.m.nh.nlmsg_len = NLMSG_LENGTH(sizeof(rtu.m.rt));
-	rtu.m.nh.nlmsg_flags = NLM_F_REQUEST | NLM_F_DUMP;
-	rtu.m.nh.nlmsg_type = RTM_GETROUTE;
-	rtu.m.rt.rtm_family = AF_INET;
-	rtu.m.rt.rtm_table = RT_TABLE_UNSPEC;
-	rtu.m.rt.rtm_protocol = RTPROT_UNSPEC;
-	rtu.m.rt.rtm_type = RTN_UNICAST;
-
-	fd = socket(AF_NETLINK, SOCK_DGRAM, NETLINK_ROUTE);
-	if (fd == -1)
-	{
-		plog("could not create rtnetlink socket");
-		return;
-	}
-
-	if (send(fd, &rtu, rtu.m.nh.nlmsg_len, 0) == -1)
-	{
-		plog("could not write to rtnetlink socket");
-		close(fd);
-		return;
-	}
-
-	msglen = recv(fd, &rtu, sizeof(rtu), MSG_WAITALL);
-	if (msglen == -1)
-	{
-		plog("could not read from rtnetlink socket");
-		close(fd);
-		return;
-	}
-
-	close(fd);
-
-	for (nh = &rtu.m.nh; NLMSG_OK(nh, msglen); nh = NLMSG_NEXT(nh, msglen))
-	{
-		struct rtmsg *rt;
-		struct rtattr *rta;
-		uint32_t rtalen, metric = 0;
-		struct in_addr gw = { .s_addr = INADDR_ANY };
-		int iface_idx = -1;
-
-		if (nh->nlmsg_type == NLMSG_ERROR)
-		{
-			plog("error from rtnetlink");
-			return;
-		}
-
-		if (nh->nlmsg_type == NLMSG_DONE)
-			break;
-
-		rt = NLMSG_DATA(nh);
-		if ( rt->rtm_dst_len != 0
-		||  (rt->rtm_table != RT_TABLE_MAIN
-		  && rt->rtm_table != RT_TABLE_DEFAULT) )
-			continue;
-
-		rta = RTM_RTA(rt);
-		rtalen = RTM_PAYLOAD(nh);
-		while ( RTA_OK(rta, rtalen) )
-		{
-			switch (rta->rta_type)
-			{
-			case RTA_GATEWAY:
-				gw = *(struct in_addr *) RTA_DATA(rta);
-				break;
-			case RTA_OIF:
-				iface_idx = *(int *) RTA_DATA(rta);
-				break;
-			case RTA_PRIORITY:
-				metric = *(uint32_t *) RTA_DATA(rta);
-				break;
-			}
-			rta = RTA_NEXT(rta, rtalen);
-		}
-
-		if (metric < best_metric
-		&&  iface_idx != -1)
-		{
-			struct ifreq req;
-
-			fd = socket(AF_INET, SOCK_DGRAM, 0);
-			if (fd < 0)
-			{
-				plog("could not open AF_INET socket");
-				break;
-			}
-			memset(&req, 0, sizeof(req));
-			req.ifr_ifindex = iface_idx;
-			if (ioctl(fd, SIOCGIFNAME, &req) < 0 ||
-				ioctl(fd, SIOCGIFADDR, &req) < 0)
-			{
-				plog("could not read interface data, ignoring route");
-				close(fd);
-				break;
-			}
-
-			strncpy(defaultroute->iface, req.ifr_name, IFNAMSIZ);
-			defaultroute->iface[IFNAMSIZ-1] = '\0';
-			defaultroute->addr.u.v4 = *((struct sockaddr_in *) &req.ifr_addr);
-			defaultroute->nexthop.u.v4.sin_family = AF_INET;
-
-			if (gw.s_addr == INADDR_ANY)
-			{
-				if (ioctl(fd, SIOCGIFDSTADDR, &req) < 0 ||
-					((struct sockaddr_in*) &req.ifr_dstaddr)->sin_addr.s_addr == INADDR_ANY)
-				{
-					DBG_log("Ignoring default route to device %s because we can't get it's destination",
-							req.ifr_name);
-					close(fd);
-					break;
-				}
-
-				defaultroute->nexthop.u.v4 = *((struct sockaddr_in *) &req.ifr_dstaddr);
-			}
-			else
-				defaultroute->nexthop.u.v4.sin_addr = gw;
-
-			close(fd);
-
-			DBG(DBG_CONTROL,
-				char addr[20];
-				char nexthop[20];
-				addrtot(&defaultroute->addr, 0, addr, sizeof(addr));
-				addrtot(&defaultroute->nexthop, 0, nexthop, sizeof(nexthop));
-
-				DBG_log(
-					( !defaultroute->defined
-					? "Default route found: iface=%s, addr=%s, nexthop=%s"
-					: "Better default route: iface=%s, addr=%s, nexthop=%s"
-					), defaultroute->iface, addr, nexthop
-				)
-			);
-
-			best_metric = metric;
-			defaultroute->defined = TRUE;
-		}
-	}
-	defaultroute->supported = TRUE;
-
-	if (!defaultroute->defined)
-		plog("no default route - cannot cope with %%defaultroute!!!");
-}
-
-#else /* !START_PLUTO */
-
-/**
- * Pluto disabled, fall back to %any
- */
-void
-get_defaultroute(defaultroute_t *defaultroute)
-{
-	defaultroute->supported = FALSE;
-}
-#endif /* START_PLUTO */
-
diff --git a/src/starter/interfaces.h b/src/starter/interfaces.h
deleted file mode 100644
index ff8535f0e..000000000
--- a/src/starter/interfaces.h
+++ /dev/null
@@ -1,36 +0,0 @@
-/* strongSwan IPsec interfaces management
- * Copyright (C) 2001-2002 Mathieu Lafon - Arkoon Network Security
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#ifndef _STARTER_INTERFACES_H_
-#define _STARTER_INTERFACES_H_
-
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <net/if.h>
-
-#include "../pluto/constants.h"
-
-typedef struct {
-	bool defined;
-	bool supported;
-	char iface[IFNAMSIZ];
-	ip_address addr;
-	ip_address nexthop;
-} defaultroute_t;
-
-extern void get_defaultroute(defaultroute_t *defaultroute);
-
-
-#endif /* _STARTER_INTERFACES_H_ */
-
diff --git a/src/starter/invokecharon.c b/src/starter/invokecharon.c
index e88939415..102d1589e 100644
--- a/src/starter/invokecharon.c
+++ b/src/starter/invokecharon.c
@@ -23,11 +23,8 @@
 #include <stdlib.h>
 #include <errno.h>
 
-#include <freeswan.h>
-
-#include "../pluto/constants.h"
-#include "../pluto/defs.h"
-#include "../pluto/log.h"
+#include <library.h>
+#include <debug.h>
 
 #include "confread.h"
 #include "invokecharon.h"
@@ -49,19 +46,19 @@ void starter_charon_sigchild(pid_t pid, int status)
 		if (status == SS_RC_LIBSTRONGSWAN_INTEGRITY ||
 			status == SS_RC_DAEMON_INTEGRITY)
 		{
-			plog("charon has quit: integrity test of %s failed",
-				  (status == 64) ? "libstrongswan" : "charon");
+			DBG1(DBG_APP, "charon has quit: integrity test of %s failed",
+				 (status == 64) ? "libstrongswan" : "charon");
 			_stop_requested = 1;
 		}
 		else if (status == SS_RC_INITIALIZATION_FAILED)
 		{
-			plog("charon has quit: initialization failed");
+			DBG1(DBG_APP, "charon has quit: initialization failed");
 			_stop_requested = 1;
 		}
 		if (!_stop_requested)
 		{
-			plog("charon has died -- restart scheduled (%dsec)"
-				, CHARON_RESTART_DELAY);
+			DBG1(DBG_APP, "charon has died -- restart scheduled (%dsec)",
+				 CHARON_RESTART_DELAY);
 			alarm(CHARON_RESTART_DELAY);   // restart in 5 sec
 		}
 		unlink(CHARON_PID_FILE);
@@ -91,7 +88,7 @@ int starter_stop_charon (void)
 			else if (i == 40)
 			{
 				kill(pid, SIGKILL);
-				plog("starter_stop_charon(): charon does not respond, sending KILL");
+				DBG1(DBG_APP, "starter_stop_charon(): charon does not respond, sending KILL");
 			}
 			else
 			{
@@ -101,15 +98,15 @@ int starter_stop_charon (void)
 		}
 		if (_charon_pid == 0)
 		{
-			plog("charon stopped after %d ms", 200*i);
+			DBG1(DBG_APP, "charon stopped after %d ms", 200*i);
 			return 0;
 		}
-		plog("starter_stop_charon(): can't stop charon !!!");
+		DBG1(DBG_APP, "starter_stop_charon(): can't stop charon !!!");
 		return -1;
 	}
 	else
 	{
-		plog("stater_stop_charon(): charon was not started...");
+		DBG1(DBG_APP, "stater_stop_charon(): charon was not started...");
 	}
 	return -1;
 }
@@ -175,7 +172,7 @@ int starter_start_charon (starter_config_t *cfg, bool no_fork, bool attach_gdb)
 
 	if (_charon_pid)
 	{
-		plog("starter_start_charon(): charon already started...");
+		DBG1(DBG_APP, "starter_start_charon(): charon already started...");
 		return -1;
 	}
 	else
@@ -187,34 +184,36 @@ int starter_start_charon (starter_config_t *cfg, bool no_fork, bool attach_gdb)
 		switch (pid)
 		{
 		case -1:
-			plog("can't fork(): %s", strerror(errno));
+			DBG1(DBG_APP, "can't fork(): %s", strerror(errno));
 			return -1;
 		case 0:
 			/* child */
 			setsid();
+			closefrom(3);
 			sigprocmask(SIG_SETMASK, 0, NULL);
 			/* disable glibc's malloc checker, conflicts with leak detective */
 			setenv("MALLOC_CHECK_", "0", 1);
 			execv(arg[0], arg);
-			plog("can't execv(%s,...): %s", arg[0], strerror(errno));
+			DBG1(DBG_APP, "can't execv(%s,...): %s", arg[0], strerror(errno));
 			exit(1);
 		default:
 			/* father */
-				_charon_pid = pid;
-				for (i = 0; i < 500 && _charon_pid; i++)
+			_charon_pid = pid;
+			for (i = 0; i < 500 && _charon_pid; i++)
 			{
 				/* wait for charon for a maximum of 500 x 20 ms = 10 s */
 				usleep(20000);
 				if (stat(CHARON_PID_FILE, &stb) == 0)
 				{
-					plog("charon (%d) started after %d ms", _charon_pid, 20*(i+1));
+					DBG1(DBG_APP, "charon (%d) started after %d ms",
+						 _charon_pid, 20*(i+1));
 					return 0;
 				}
 			}
 			if (_charon_pid)
 			{
 				/* If charon is started but with no ctl file, stop it */
-				plog("charon too long to start... - kill kill");
+				DBG1(DBG_APP, "charon too long to start... - kill kill");
 				for (i = 0; i < 20 && (pid = _charon_pid) != 0; i++)
 				{
 					if (i == 0)
@@ -234,7 +233,7 @@ int starter_start_charon (starter_config_t *cfg, bool no_fork, bool attach_gdb)
 			}
 			else
 			{
-				plog("charon refused to be started");
+				DBG1(DBG_APP, "charon refused to be started");
 			}
 			return -1;
 		}
diff --git a/src/starter/invokepluto.c b/src/starter/invokepluto.c
deleted file mode 100644
index 70c0692ea..000000000
--- a/src/starter/invokepluto.c
+++ /dev/null
@@ -1,327 +0,0 @@
-/* strongSwan Pluto launcher
- * Copyright (C) 2001-2002 Mathieu Lafon - Arkoon Network Security
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <unistd.h>
-#include <signal.h>
-#include <string.h>
-#include <stdlib.h>
-#include <errno.h>
-#include <fcntl.h>
-
-#include <freeswan.h>
-
-#include "../pluto/constants.h"
-#include "../pluto/defs.h"
-#include "../pluto/log.h"
-
-#include "confread.h"
-#include "invokepluto.h"
-#include "files.h"
-#include "starterwhack.h"
-#
-static int _pluto_pid = 0;
-static int _stop_requested;
-
-pid_t
-starter_pluto_pid(void)
-{
-	return _pluto_pid;
-}
-
-void
-starter_pluto_sigchild(pid_t pid, int status)
-{
-	if (pid == _pluto_pid)
-	{
-		_pluto_pid = 0;
-		if (status == SS_RC_LIBSTRONGSWAN_INTEGRITY ||
-			status == SS_RC_DAEMON_INTEGRITY)
-		{
-			plog("pluto has quit: integrity test of %s failed",
-				  (status == 64) ? "libstrongswan" : "pluto");
-			_stop_requested = 1;
-		}
-		else if (status == SS_RC_INITIALIZATION_FAILED)
-		{
-			plog("pluto has quit: initialization failed");
-			_stop_requested = 1;
-		}
-		if (!_stop_requested)
-		{
-			plog("pluto has died -- restart scheduled (%dsec)"
-				, PLUTO_RESTART_DELAY);
-			alarm(PLUTO_RESTART_DELAY);   // restart in 5 sec
-		}
-		unlink(PLUTO_PID_FILE);
-	}
-}
-
-int
-starter_stop_pluto (void)
-{
-	int i;
-	pid_t pid = _pluto_pid;
-
-	if (pid)
-	{
-		_stop_requested = 1;
-
-		if (starter_whack_shutdown() == 0)
-		{
-			for (i = 0; i < 400; i++)
-			{
-				usleep(20000); /* sleep for 20 ms */
-				if (_pluto_pid == 0)
-				{
-					plog("pluto stopped after %d ms", 20*(i+1));
-					return 0;
-				}
-			}
-		}
-		/* be more and more aggressive */
-		for (i = 0; i < 20 && (pid = _pluto_pid) != 0; i++)
-		{
-
-			if (i < 10)
-			{
-				kill(pid, SIGTERM);
-			}
-			if (i == 10)
-			{
-				kill(pid, SIGKILL);
-				plog("starter_stop_pluto(): pluto does not respond, sending KILL");
-			}
-			else
-			{
-				kill(pid, SIGKILL);
-			}
-			usleep(100000); /* sleep for 100 ms */
-		}
-		if (_pluto_pid == 0)
-		{
-			plog("pluto stopped after %d ms", 8000 + 100*i);
-			return 0;
-		}
-		plog("starter_stop_pluto(): can't stop pluto !!!");
-		return -1;
-	}
-	else
-	{
-		plog("stater_stop_pluto(): pluto is not started...");
-	}
-	return -1;
-}
-
-#define ADD_DEBUG(v) { \
-		for (l = cfg->setup.plutodebug; l && *l; l++) if (streq(*l, v)) \
-				arg[argc++] = "--debug-" v; \
-		}
-
-int
-starter_start_pluto (starter_config_t *cfg, bool no_fork, bool attach_gdb)
-{
-	struct stat stb;
-	int i;
-	pid_t pid;
-	char **l;
-	int argc = 2;
-	char *arg[] = {
-			  PLUTO_CMD, "--nofork"
-			, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL
-			, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL
-			, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL
-			, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL
-		};
-
-	printf ("starter_start_pluto entered\n");
-
-	if (attach_gdb)
-	{
-		argc = 0;
-		arg[argc++] = "/usr/bin/gdb";
-		arg[argc++] = "--args";
-		arg[argc++] = PLUTO_CMD;
-		arg[argc++] = "--nofork";
-		}
-	if (cfg->setup.plutostderrlog || no_fork)
-	{
-		arg[argc++] = "--stderrlog";
-	}
-	if (cfg->setup.uniqueids)
-	{
-		arg[argc++] = "--uniqueids";
-	}
-	ADD_DEBUG("none")
-	ADD_DEBUG("all")
-	ADD_DEBUG("raw")
-	ADD_DEBUG("crypt")
-	ADD_DEBUG("parsing")
-	ADD_DEBUG("emitting")
-	ADD_DEBUG("control")
-	ADD_DEBUG("lifecycle")
-	ADD_DEBUG("klips")
-	ADD_DEBUG("kernel")
-	ADD_DEBUG("dns")
-	ADD_DEBUG("natt")
-	ADD_DEBUG("oppo")
-	ADD_DEBUG("controlmore")
-	ADD_DEBUG("private")
-	if (cfg->setup.crlcheckinterval > 0)
-	{
-		static char buf1[15];
-
-		arg[argc++] = "--crlcheckinterval";
-		snprintf(buf1, sizeof(buf1), "%d", (int)cfg->setup.crlcheckinterval);
-		arg[argc++] = buf1;
-	}
-	if (cfg->setup.cachecrls)
-	{
-		arg[argc++] = "--cachecrls";
-	}
-	if (cfg->setup.strictcrlpolicy)
-	{
-		arg[argc++] = "--strictcrlpolicy";
-	}
-	if (cfg->setup.nocrsend)
-	{
-		arg[argc++] = "--nocrsend";
-	}
-	if (cfg->setup.nat_traversal)
-	{
-		arg[argc++] = "--nat_traversal";
-	}
-	if (cfg->setup.force_keepalive)
-	{
-		arg[argc++] = "--force_keepalive";
-	}
-	if (cfg->setup.keep_alive)
-	{
-		static char buf2[15];
-
-		arg[argc++] = "--keep_alive";
-		snprintf(buf2, sizeof(buf2), "%d", (int)cfg->setup.keep_alive);
-		arg[argc++] = buf2;
-	}
-	if (cfg->setup.virtual_private)
-	{
-		arg[argc++] = "--virtual_private";
-		arg[argc++] = cfg->setup.virtual_private;
-	}
-	if (cfg->setup.pkcs11module)
-	{
-		arg[argc++] = "--pkcs11module";
-		arg[argc++] = cfg->setup.pkcs11module;
-	}
-	if (cfg->setup.pkcs11initargs)
-	{
-		arg[argc++] = "--pkcs11initargs";
-		arg[argc++] = cfg->setup.pkcs11initargs;
-	}
-	if (cfg->setup.pkcs11keepstate)
-	{
-		arg[argc++] = "--pkcs11keepstate";
-	}
-	if (cfg->setup.pkcs11proxy)
-	{
-		arg[argc++] = "--pkcs11proxy";
-	}
-
-	if (_pluto_pid)
-	{
-		plog("starter_start_pluto(): pluto already started...");
-		return -1;
-	}
-	else
-	{
-		unlink(PLUTO_CTL_FILE);
-		_stop_requested = 0;
-
-		if (cfg->setup.prepluto)
-			ignore_result(system(cfg->setup.prepluto));
-
-		pid = fork();
-		switch (pid)
-		{
-		case -1:
-			plog("can't fork(): %s", strerror(errno));
-			return -1;
-		case 0:
-			/* child */
-			if (cfg->setup.plutostderrlog)
-			{
-				int f = creat(cfg->setup.plutostderrlog, 00644);
-
-				/* redirect stderr to file */
-				if (f < 0)
-				{
-					plog("couldn't open stderr redirection file '%s'",
-						  cfg->setup.plutostderrlog);
-				}
-				else
-				{
-					dup2(f, 2);
-				}
-			}
-			setsid();
-			sigprocmask(SIG_SETMASK, 0, NULL);
-			/* disable glibc's malloc checker, conflicts with leak detective */
-			setenv("MALLOC_CHECK_", "0", 1);
-			execv(arg[0], arg);
-			plog("can't execv(%s,...): %s", arg[0], strerror(errno));
-			exit(1);
-		default:
-			/* father */
-			_pluto_pid = pid;
-			for (i = 0; i < 500 && _pluto_pid; i++)
-			{
-				/* wait for pluto for a maximum of 500 x 20 ms = 10 s */
-				usleep(20000);
-				if (stat(PLUTO_CTL_FILE, &stb) == 0)
-				{
-					plog("pluto (%d) started after %d ms", _pluto_pid, 20*(i+1));
-					if (cfg->setup.postpluto)
-					{
-						ignore_result(system(cfg->setup.postpluto));
-					}
-					return 0;
-				}
-			}
-			if (_pluto_pid)
-			{
-				/* If pluto is started but with no ctl file, stop it */
-				plog("pluto too long to start... - kill kill");
-				for (i = 0; i < 20 && (pid = _pluto_pid) != 0; i++)
-				{
-					if (i < 10)
-					{
-						kill(pid, SIGTERM);
-					}
-					else
-					{
-						kill(pid, SIGKILL);
-					}
-					usleep(20000); /* sleep for 20 ms */
-				}
-			}
-			else
-			{
-				plog("pluto refused to be started");
-			}
-			return -1;
-		}
-	}
-	return -1;
-}
diff --git a/src/starter/invokepluto.h b/src/starter/invokepluto.h
deleted file mode 100644
index c87f50c2a..000000000
--- a/src/starter/invokepluto.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/* strongSwan pluto launcher
- * Copyright (C) 2001-2002 Mathieu Lafon - Arkoon Network Security
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#ifndef _STARTER_PLUTO_H_
-#define _STARTER_PLUTO_H_
-
-#define PLUTO_RESTART_DELAY    5
-
-extern void starter_pluto_sigchild (pid_t pid, int status);
-extern pid_t starter_pluto_pid (void);
-extern int starter_stop_pluto (void);
-extern int starter_start_pluto (struct starter_config *cfg, bool no_fork, bool attach_gdb);
-
-#endif /* _STARTER_PLUTO_H_ */
-
diff --git a/src/starter/ipsec.conf b/src/starter/ipsec.conf
index b1e5d5e0c..a33d68c0a 100644
--- a/src/starter/ipsec.conf
+++ b/src/starter/ipsec.conf
@@ -3,20 +3,14 @@
 # basic configuration
 
 config setup
-	# plutodebug=all
-	# crlcheckinterval=600
 	# strictcrlpolicy=yes
-	# cachecrls=yes
-	# nat_traversal=yes
-	# charonstart=no
-	# plutostart=no
+	# uniqueids = no
 
 # Add connections here.
 
 # Sample VPN connections
 
 #conn sample-self-signed
-#      left=%defaultroute
 #      leftsubnet=10.1.0.0/16
 #      leftcert=selfCert.der
 #      leftsendcert=never
@@ -26,11 +20,9 @@ config setup
 #      auto=start
 
 #conn sample-with-ca-cert
-#      left=%defaultroute
 #      leftsubnet=10.1.0.0/16
 #      leftcert=myCert.pem
 #      right=192.168.0.2
 #      rightsubnet=10.2.0.0/16
 #      rightid="C=CH, O=Linux strongSwan CN=peer name"
-#      keyexchange=ikev2
 #      auto=start
diff --git a/src/starter/keywords.c b/src/starter/keywords.c
index edb55ae7f..7615a81d2 100644
--- a/src/starter/keywords.c
+++ b/src/starter/keywords.c
@@ -30,7 +30,7 @@ error "gperf generated tables don't work with this execution character set. Plea
 #endif
 
 
-/* strongSwan keywords
+/*
  * Copyright (C) 2005 Andreas Steffen
  * Hochschule fuer Technik Rapperswil, Switzerland
  *
@@ -54,12 +54,12 @@ struct kw_entry {
     kw_token_t token;
 };
 
-#define TOTAL_KEYWORDS 131
+#define TOTAL_KEYWORDS 134
 #define MIN_WORD_LENGTH 3
 #define MAX_WORD_LENGTH 17
 #define MIN_HASH_VALUE 9
-#define MAX_HASH_VALUE 246
-/* maximum key range = 238, duplicates = 0 */
+#define MAX_HASH_VALUE 220
+/* maximum key range = 212, duplicates = 0 */
 
 #ifdef __GNUC__
 __inline
@@ -75,32 +75,32 @@ hash (str, len)
 {
   static const unsigned char asso_values[] =
     {
-      247, 247, 247, 247, 247, 247, 247, 247, 247, 247,
-      247, 247, 247, 247, 247, 247, 247, 247, 247, 247,
-      247, 247, 247, 247, 247, 247, 247, 247, 247, 247,
-      247, 247, 247, 247, 247, 247, 247, 247, 247, 247,
-      247, 247, 247, 247, 247, 247, 247, 247, 247,  12,
-      126, 247, 247, 247, 247, 247, 247, 247, 247, 247,
-      247, 247, 247, 247, 247, 247, 247, 247, 247, 247,
-      247, 247, 247, 247, 247, 247, 247, 247, 247, 247,
-      247, 247, 247, 247, 247, 247, 247, 247, 247, 247,
-      247, 247, 247, 247, 247,  51, 247,  11,   1,  92,
-       43,   0,   6,   0, 110,   0, 247, 120,  56,  37,
-       27,  72,  43,   1,  16,   0,   5,  75,   1, 247,
-      247,  11,   5, 247, 247, 247, 247, 247, 247, 247,
-      247, 247, 247, 247, 247, 247, 247, 247, 247, 247,
-      247, 247, 247, 247, 247, 247, 247, 247, 247, 247,
-      247, 247, 247, 247, 247, 247, 247, 247, 247, 247,
-      247, 247, 247, 247, 247, 247, 247, 247, 247, 247,
-      247, 247, 247, 247, 247, 247, 247, 247, 247, 247,
-      247, 247, 247, 247, 247, 247, 247, 247, 247, 247,
-      247, 247, 247, 247, 247, 247, 247, 247, 247, 247,
-      247, 247, 247, 247, 247, 247, 247, 247, 247, 247,
-      247, 247, 247, 247, 247, 247, 247, 247, 247, 247,
-      247, 247, 247, 247, 247, 247, 247, 247, 247, 247,
-      247, 247, 247, 247, 247, 247, 247, 247, 247, 247,
-      247, 247, 247, 247, 247, 247, 247, 247, 247, 247,
-      247, 247, 247, 247, 247, 247
+      221, 221, 221, 221, 221, 221, 221, 221, 221, 221,
+      221, 221, 221, 221, 221, 221, 221, 221, 221, 221,
+      221, 221, 221, 221, 221, 221, 221, 221, 221, 221,
+      221, 221, 221, 221, 221, 221, 221, 221, 221, 221,
+      221, 221, 221, 221, 221, 221, 221, 221, 221,  62,
+      117, 221, 221, 221, 221, 221, 221, 221, 221, 221,
+      221, 221, 221, 221, 221, 221, 221, 221, 221, 221,
+      221, 221, 221, 221, 221, 221, 221, 221, 221, 221,
+      221, 221, 221, 221, 221, 221, 221, 221, 221, 221,
+      221, 221, 221, 221, 221,   0, 221,  27,   0,  79,
+       26,   0,   6,   0,  92,   0, 221,  44,  58,  36,
+       36,  73,  33,   5,  16,   0,   7,  87,   0, 221,
+      221,  11,   3, 221, 221, 221, 221, 221, 221, 221,
+      221, 221, 221, 221, 221, 221, 221, 221, 221, 221,
+      221, 221, 221, 221, 221, 221, 221, 221, 221, 221,
+      221, 221, 221, 221, 221, 221, 221, 221, 221, 221,
+      221, 221, 221, 221, 221, 221, 221, 221, 221, 221,
+      221, 221, 221, 221, 221, 221, 221, 221, 221, 221,
+      221, 221, 221, 221, 221, 221, 221, 221, 221, 221,
+      221, 221, 221, 221, 221, 221, 221, 221, 221, 221,
+      221, 221, 221, 221, 221, 221, 221, 221, 221, 221,
+      221, 221, 221, 221, 221, 221, 221, 221, 221, 221,
+      221, 221, 221, 221, 221, 221, 221, 221, 221, 221,
+      221, 221, 221, 221, 221, 221, 221, 221, 221, 221,
+      221, 221, 221, 221, 221, 221, 221, 221, 221, 221,
+      221, 221, 221, 221, 221, 221
     };
   register int hval = len;
 
@@ -123,166 +123,167 @@ hash (str, len)
 
 static const struct kw_entry wordlist[] =
   {
-    {"pfs",               KW_PFS},
-    {"right",             KW_RIGHT},
+    {"pfs",               KW_PFS_DEPRECATED},
+    {"aggressive",        KW_AGGRESSIVE},
     {"rightgroups",       KW_RIGHTGROUPS},
+    {"right",             KW_RIGHT},
     {"lifetime",          KW_KEYLIFE},
     {"left",              KW_LEFT},
     {"rightsubnet",       KW_RIGHTSUBNET},
     {"rightikeport",      KW_RIGHTIKEPORT},
     {"rightsendcert",     KW_RIGHTSENDCERT},
     {"leftcert",          KW_LEFTCERT},
-    {"keep_alive",        KW_KEEP_ALIVE},
     {"keyingtries",       KW_KEYINGTRIES},
-    {"leftsendcert",      KW_LEFTSENDCERT},
     {"keylife",           KW_KEYLIFE},
+    {"leftsendcert",      KW_LEFTSENDCERT},
     {"lifebytes",         KW_LIFEBYTES},
-    {"lifepackets",       KW_LIFEPACKETS},
     {"leftrsasigkey",     KW_LEFTRSASIGKEY},
     {"leftcertpolicy",    KW_LEFTCERTPOLICY},
     {"leftgroups",        KW_LEFTGROUPS},
-    {"leftca",            KW_LEFTCA},
-    {"rightallowany",     KW_RIGHTALLOWANY},
-    {"uniqueids",         KW_UNIQUEIDS},
-    {"leftprotoport",     KW_LEFTPROTOPORT},
+    {"rightid",           KW_RIGHTID},
+    {"rightdns",          KW_RIGHTDNS},
+    {"me_peerid",         KW_ME_PEERID},
+    {"reqid",             KW_REQID},
+    {"keep_alive",        KW_SETUP_DEPRECATED},
     {"rightrsasigkey",    KW_RIGHTRSASIGKEY},
-    {"virtual_private",   KW_VIRTUAL_PRIVATE},
+    {"leftprotoport",     KW_LEFTPROTOPORT},
     {"certuribase",       KW_CERTURIBASE},
-    {"rightsubnetwithin", KW_RIGHTSUBNETWITHIN},
-    {"interfaces",        KW_INTERFACES},
-    {"reqid",             KW_REQID},
-    {"rightid",           KW_RIGHTID},
-    {"strictcrlpolicy",   KW_STRICTCRLPOLICY},
+    {"lifepackets",       KW_LIFEPACKETS},
+    {"uniqueids",         KW_UNIQUEIDS},
     {"rightsourceip",     KW_RIGHTSOURCEIP},
+    {"ike",               KW_IKE},
     {"type",              KW_TYPE},
-    {"inactivity",        KW_INACTIVITY},
-    {"leftnexthop",       KW_LEFTNEXTHOP},
-    {"mark_in",           KW_MARK_IN},
+    {"leftdns",           KW_LEFTDNS},
+    {"leftnexthop",       KW_LEFT_DEPRECATED},
+    {"rightallowany",     KW_RIGHTALLOWANY},
+    {"rightsubnetwithin", KW_RIGHTSUBNET},
     {"rightprotoport",    KW_RIGHTPROTOPORT},
-    {"margintime",        KW_REKEYMARGIN},
-    {"marginbytes",       KW_MARGINBYTES},
-    {"marginpackets",     KW_MARGINPACKETS},
-    {"leftnatip",         KW_LEFTNATIP},
     {"mediated_by",       KW_MEDIATED_BY},
-    {"ldapbase",          KW_LDAPBASE},
+    {"strictcrlpolicy",   KW_STRICTCRLPOLICY},
+    {"virtual_private",   KW_SETUP_DEPRECATED},
+    {"interfaces",        KW_SETUP_DEPRECATED},
+    {"rekey",             KW_REKEY},
+    {"ikelifetime",       KW_IKELIFETIME},
+    {"rekeyfuzz",         KW_REKEYFUZZ},
+    {"leftid",            KW_LEFTID},
+    {"leftca",            KW_LEFTCA},
+    {"leftikeport",       KW_LEFTIKEPORT},
+    {"esp",               KW_ESP},
     {"leftfirewall",      KW_LEFTFIREWALL},
     {"rightfirewall",     KW_RIGHTFIREWALL},
-    {"crluri",            KW_CRLURI},
-    {"mobike",	           KW_MOBIKE},
-    {"rightnatip",        KW_RIGHTNATIP},
-    {"rightnexthop",      KW_RIGHTNEXTHOP},
     {"mediation",         KW_MEDIATION},
-    {"leftallowany",      KW_LEFTALLOWANY},
+    {"mobike",	           KW_MOBIKE},
+    {"crluri",            KW_CRLURI},
+    {"rightnexthop",      KW_RIGHT_DEPRECATED},
+    {"inactivity",        KW_INACTIVITY},
     {"leftupdown",        KW_LEFTUPDOWN},
-    {"overridemtu",       KW_OVERRIDEMTU},
-    {"aaa_identity",      KW_AAA_IDENTITY},
-    {"esp",               KW_ESP},
-    {"crluri1",           KW_CRLURI},
+    {"mark_in",           KW_MARK_IN},
+    {"leftallowany",      KW_LEFTALLOWANY},
+    {"ldapbase",          KW_CA_DEPRECATED},
+    {"margintime",        KW_REKEYMARGIN},
+    {"marginbytes",       KW_MARGINBYTES},
+    {"mark",              KW_MARK},
+    {"marginpackets",     KW_MARGINPACKETS},
     {"lefthostaccess",    KW_LEFTHOSTACCESS},
-    {"leftsubnet",        KW_LEFTSUBNET},
-    {"leftid",            KW_LEFTID},
-    {"forceencaps",       KW_FORCEENCAPS},
-    {"eap",               KW_EAP},
-    {"nat_traversal",     KW_NAT_TRAVERSAL},
-    {"me_peerid",         KW_ME_PEERID},
+    {"klipsdebug",        KW_SETUP_DEPRECATED},
     {"rightcert",         KW_RIGHTCERT},
-    {"installpolicy",     KW_INSTALLPOLICY},
-    {"authby",            KW_AUTHBY},
-    {"klipsdebug",        KW_KLIPSDEBUG},
-    {"rightca",           KW_RIGHTCA},
-    {"mark_out",          KW_MARK_OUT},
-    {"rightupdown",       KW_RIGHTUPDOWN},
+    {"eap",               KW_CONN_DEPRECATED},
+    {"overridemtu",       KW_SETUP_DEPRECATED},
+    {"forceencaps",       KW_FORCEENCAPS},
     {"keyexchange",       KW_KEYEXCHANGE},
     {"ocspuri",           KW_OCSPURI},
-    {"compress",          KW_COMPRESS},
+    {"aaa_identity",      KW_AAA_IDENTITY},
+    {"force_keepalive",   KW_SETUP_DEPRECATED},
     {"rightcertpolicy",   KW_RIGHTCERTPOLICY},
-    {"cacert",            KW_CACERT},
-    {"eap_identity",      KW_EAP_IDENTITY},
-    {"hidetos",           KW_HIDETOS},
-    {"ike",               KW_IKE},
-    {"leftsubnetwithin",  KW_LEFTSUBNETWITHIN},
+    {"hidetos",           KW_SETUP_DEPRECATED},
     {"righthostaccess",   KW_RIGHTHOSTACCESS},
-    {"packetdefault",     KW_PACKETDEFAULT},
+    {"eap_identity",      KW_EAP_IDENTITY},
+    {"leftsubnet",        KW_LEFTSUBNET},
     {"dpdaction",         KW_DPDACTION},
-    {"ocspuri1",          KW_OCSPURI},
-    {"pfsgroup",          KW_PFSGROUP},
-    {"rightauth",         KW_RIGHTAUTH},
-    {"also",              KW_ALSO},
+    {"dpdtimeout",        KW_DPDTIMEOUT},
+    {"rightca",           KW_RIGHTCA},
+    {"compress",          KW_COMPRESS},
+    {"installpolicy",     KW_INSTALLPOLICY},
+    {"pfsgroup",          KW_PFS_DEPRECATED},
+    {"nat_traversal",     KW_SETUP_DEPRECATED},
+    {"authby",            KW_AUTHBY},
     {"leftsourceip",      KW_LEFTSOURCEIP},
     {"rightid2",          KW_RIGHTID2},
-    {"dumpdir",           KW_DUMPDIR},
-    {"rekey",             KW_REKEY},
-    {"ikelifetime",       KW_IKELIFETIME},
-    {"dpdtimeout",        KW_DPDTIMEOUT},
-    {"ldaphost",          KW_LDAPHOST},
-    {"rekeyfuzz",         KW_REKEYFUZZ},
+    {"cacert",            KW_CACERT},
+    {"rekeymargin",       KW_REKEYMARGIN},
+    {"rightauth",         KW_RIGHTAUTH},
+    {"rightgroups2",      KW_RIGHTGROUPS2},
+    {"mark_out",          KW_MARK_OUT},
     {"leftcert2",         KW_LEFTCERT2},
-    {"leftikeport",       KW_LEFTIKEPORT},
-    {"crlcheckinterval",  KW_CRLCHECKINTERVAL},
-    {"plutostderrlog",    KW_PLUTOSTDERRLOG},
-    {"plutostart",        KW_PLUTOSTART},
-    {"rightauth2",        KW_RIGHTAUTH2},
-    {"leftca2",           KW_LEFTCA2},
-    {"mark",              KW_MARK},
-    {"force_keepalive",   KW_FORCE_KEEPALIVE},
-    {"auto",              KW_AUTO},
-    {"charondebug",       KW_CHARONDEBUG},
+    {"packetdefault",     KW_SETUP_DEPRECATED},
+    {"rightupdown",       KW_RIGHTUPDOWN},
+    {"also",              KW_ALSO},
     {"dpddelay",          KW_DPDDELAY},
     {"xauth_identity",    KW_XAUTH_IDENTITY},
-    {"charonstart",       KW_CHARONSTART},
-    {"fragicmp",          KW_FRAGICMP},
-    {"prepluto",          KW_PREPLUTO},
-    {"closeaction",       KW_CLOSEACTION},
+    {"ldaphost",          KW_CA_DEPRECATED},
+    {"crluri1",           KW_CRLURI},
+    {"leftsubnetwithin",  KW_LEFTSUBNET},
+    {"dumpdir",           KW_SETUP_DEPRECATED},
+    {"crlcheckinterval",  KW_SETUP_DEPRECATED},
+    {"leftgroups2",       KW_LEFTGROUPS2},
+    {"rightauth2",        KW_RIGHTAUTH2},
     {"leftid2",           KW_LEFTID2},
-    {"plutodebug",        KW_PLUTODEBUG},
+    {"leftca2",           KW_LEFTCA2},
+    {"plutostderrlog",    KW_SETUP_DEPRECATED},
+    {"plutostart",        KW_SETUP_DEPRECATED},
+    {"fragicmp",          KW_SETUP_DEPRECATED},
+    {"ocspuri1",          KW_OCSPURI},
+    {"charondebug",       KW_CHARONDEBUG},
     {"tfc",               KW_TFC},
-    {"auth",              KW_AUTH},
-    {"rekeymargin",       KW_REKEYMARGIN},
+    {"auto",              KW_AUTO},
+    {"charonstart",       KW_SETUP_DEPRECATED},
+    {"plutodebug",        KW_SETUP_DEPRECATED},
     {"modeconfig",        KW_MODECONFIG},
+    {"prepluto",          KW_SETUP_DEPRECATED},
+    {"nocrsend",          KW_SETUP_DEPRECATED},
+    {"auth",              KW_AUTH},
     {"leftauth",          KW_LEFTAUTH},
-    {"xauth",             KW_XAUTH},
     {"cachecrls",         KW_CACHECRLS},
+    {"pkcs11module",      KW_PKCS11_DEPRECATED},
     {"crluri2",           KW_CRLURI2},
-    {"postpluto",         KW_POSTPLUTO},
-    {"nocrsend",          KW_NOCRSEND},
-    {"leftauth2",         KW_LEFTAUTH2},
+    {"pkcs11initargs",    KW_PKCS11_DEPRECATED},
+    {"pkcs11keepstate",   KW_PKCS11_DEPRECATED},
     {"rightca2",          KW_RIGHTCA2},
+    {"closeaction",       KW_CLOSEACTION},
     {"rightcert2",        KW_RIGHTCERT2},
-    {"pkcs11module",      KW_PKCS11MODULE},
+    {"pkcs11proxy",       KW_PKCS11_DEPRECATED},
+    {"xauth",             KW_XAUTH},
+    {"postpluto",         KW_SETUP_DEPRECATED},
     {"reauth",            KW_REAUTH},
-    {"pkcs11initargs",    KW_PKCS11INITARGS},
-    {"pkcs11keepstate",   KW_PKCS11KEEPSTATE},
-    {"ocspuri2",          KW_OCSPURI2},
-    {"pkcs11proxy",       KW_PKCS11PROXY}
+    {"leftauth2",         KW_LEFTAUTH2},
+    {"ocspuri2",          KW_OCSPURI2}
   };
 
 static const short lookup[] =
   {
      -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,   0,
-      1,   2,  -1,  -1,   3,   4,   5,   6,   7,   8,
-     -1,   9,  10,  11,  12,  -1,  13,  -1,  14,  -1,
-     15,  16,  17,  -1,  18,  19,  20,  -1,  -1,  -1,
-     21,  22,  23,  24,  25,  -1,  -1,  -1,  26,  27,
-     28,  -1,  29,  -1,  -1,  -1,  30,  -1,  31,  32,
-     33,  34,  35,  -1,  36,  37,  -1,  38,  -1,  39,
-     40,  -1,  -1,  41,  42,  43,  -1,  -1,  44,  45,
-     46,  -1,  47,  -1,  48,  49,  50,  51,  52,  53,
-     -1,  54,  55,  -1,  -1,  -1,  56,  -1,  57,  58,
-     59,  60,  -1,  61,  -1,  -1,  62,  63,  64,  65,
-     66,  -1,  67,  68,  69,  70,  -1,  71,  72,  73,
-     74,  -1,  75,  76,  77,  78,  79,  80,  81,  82,
-     83,  -1,  84,  85,  86,  87,  88,  89,  90,  91,
-     92,  93,  94,  -1,  95,  96,  97,  98,  -1,  -1,
-     99, 100,  -1,  -1, 101,  -1, 102,  -1,  -1, 103,
-     -1, 104, 105,  -1, 106,  -1,  -1,  -1,  -1,  -1,
-    107, 108,  -1,  -1,  -1,  -1,  -1, 109,  -1,  -1,
-     -1,  -1, 110,  -1, 111,  -1,  -1,  -1,  -1,  -1,
-     -1,  -1,  -1, 112, 113, 114,  -1, 115,  -1, 116,
-     -1, 117,  -1,  -1, 118, 119,  -1,  -1,  -1, 120,
-     -1,  -1,  -1,  -1,  -1, 121, 122,  -1,  -1,  -1,
-     -1,  -1,  -1,  -1,  -1,  -1, 123,  -1, 124,  -1,
-     -1,  -1,  -1,  -1,  -1,  -1, 125, 126, 127, 128,
-     -1,  -1, 129,  -1,  -1,  -1, 130
+      1,   2,   3,  -1,   4,  -1,  -1,   5,   6,   7,
+      8,   9,  10,  -1,  11,  12,  13,  -1,  -1,  -1,
+     14,  15,  16,  17,  18,  19,  20,  21,  -1,  -1,
+     -1,  22,  23,  24,  25,  26,  27,  28,  29,  30,
+     31,  32,  -1,  33,  34,  35,  36,  -1,  37,  38,
+     39,  40,  41,  -1,  42,  -1,  43,  -1,  44,  45,
+     -1,  -1,  -1,  -1,  -1,  -1,  46,  47,  48,  49,
+     50,  51,  -1,  -1,  52,  53,  54,  55,  56,  57,
+     58,  59,  60,  61,  62,  63,  64,  -1,  65,  -1,
+     66,  67,  68,  69,  70,  71,  72,  73,  -1,  74,
+     75,  76,  77,  78,  -1,  -1,  -1,  79,  80,  -1,
+     81,  82,  83,  -1,  84,  85,  86,  87,  88,  89,
+     -1,  90,  91,  92,  93,  94,  95,  -1,  -1,  96,
+     -1,  97,  -1,  98,  -1,  99, 100,  -1, 101,  -1,
+    102,  -1,  -1,  -1, 103,  -1, 104, 105,  -1, 106,
+     -1,  -1, 107, 108,  -1, 109, 110, 111,  -1,  -1,
+     -1, 112,  -1, 113,  -1,  -1,  -1,  -1,  -1,  -1,
+     -1, 114, 115,  -1, 116,  -1, 117,  -1,  -1,  -1,
+    118,  -1,  -1, 119, 120,  -1,  -1, 121, 122, 123,
+    124,  -1,  -1,  -1, 125, 126, 127, 128,  -1,  -1,
+     -1, 129,  -1, 130,  -1,  -1,  -1, 131,  -1, 132,
+    133
   };
 
 #ifdef __GNUC__
diff --git a/src/starter/keywords.h b/src/starter/keywords.h
index 02be919ea..537bceb07 100644
--- a/src/starter/keywords.h
+++ b/src/starter/keywords.h
@@ -1,4 +1,4 @@
-/* strongSwan keywords
+/*
  * Copyright (C) 2005 Andreas Steffen
  * Hochschule fuer Technik Rapperswil, Switzerland
  *
@@ -18,58 +18,26 @@
 
 typedef enum {
 	/* config setup keywords */
-	KW_INTERFACES,
-	KW_DUMPDIR,
-	KW_CHARONSTART,
-	KW_PLUTOSTART,
-
-	/* pluto/charon keywords */
-	KW_PLUTODEBUG,
 	KW_CHARONDEBUG,
-	KW_PREPLUTO,
-	KW_POSTPLUTO,
-	KW_PLUTOSTDERRLOG,
 	KW_UNIQUEIDS,
-	KW_OVERRIDEMTU,
-	KW_CRLCHECKINTERVAL,
 	KW_CACHECRLS,
 	KW_STRICTCRLPOLICY,
-	KW_NOCRSEND,
-	KW_NAT_TRAVERSAL,
-	KW_KEEP_ALIVE,
-	KW_FORCE_KEEPALIVE,
-	KW_VIRTUAL_PRIVATE,
-	KW_PKCS11MODULE,
-	KW_PKCS11INITARGS,
-	KW_PKCS11KEEPSTATE,
-	KW_PKCS11PROXY,
-
-#define KW_PLUTO_FIRST  KW_PLUTODEBUG
-#define KW_PLUTO_LAST   KW_PKCS11PROXY
-
-	/* KLIPS keywords */
-	KW_KLIPSDEBUG,
-	KW_FRAGICMP,
-	KW_PACKETDEFAULT,
-	KW_HIDETOS,
-
-#define KW_KLIPS_FIRST  KW_KLIPSDEBUG
-#define KW_KLIPS_LAST   KW_HIDETOS
-
-#define KW_SETUP_FIRST  KW_INTERFACES
-#define KW_SETUP_LAST   KW_HIDETOS
+	KW_PKCS11_DEPRECATED,
+	KW_SETUP_DEPRECATED,
+
+#define KW_SETUP_FIRST  KW_CHARONDEBUG
+#define KW_SETUP_LAST   KW_SETUP_DEPRECATED
 
 	/* conn section keywords */
 	KW_CONN_NAME,
 	KW_CONN_SETUP,
 	KW_KEYEXCHANGE,
 	KW_TYPE,
-	KW_PFS,
 	KW_COMPRESS,
 	KW_INSTALLPOLICY,
+	KW_AGGRESSIVE,
 	KW_AUTH,
 	KW_AUTHBY,
-	KW_EAP,
 	KW_EAP_IDENTITY,
 	KW_AAA_IDENTITY,
 	KW_MOBIKE,
@@ -87,7 +55,6 @@ typedef enum {
 	KW_REAUTH,
 	KW_IKE,
 	KW_ESP,
-	KW_PFSGROUP,
 	KW_DPDDELAY,
 	KW_DPDTIMEOUT,
 	KW_DPDACTION,
@@ -104,34 +71,33 @@ typedef enum {
 	KW_MARK_IN,
 	KW_MARK_OUT,
 	KW_TFC,
+	KW_PFS_DEPRECATED,
+	KW_CONN_DEPRECATED,
 
 #define KW_CONN_FIRST   KW_CONN_SETUP
-#define KW_CONN_LAST    KW_TFC
+#define KW_CONN_LAST    KW_CONN_DEPRECATED
 
-   /* ca section keywords */
+	/* ca section keywords */
 	KW_CA_NAME,
 	KW_CA_SETUP,
 	KW_CACERT,
-	KW_LDAPHOST,
-	KW_LDAPBASE,
 	KW_CRLURI,
 	KW_CRLURI2,
 	KW_OCSPURI,
 	KW_OCSPURI2,
 	KW_CERTURIBASE,
+	KW_CA_DEPRECATED,
 
 #define KW_CA_FIRST     KW_CA_SETUP
-#define KW_CA_LAST      KW_CERTURIBASE
+#define KW_CA_LAST      KW_CA_DEPRECATED
 
-   /* end keywords */
+	/* end keywords */
 	KW_HOST,
 	KW_IKEPORT,
-	KW_NEXTHOP,
 	KW_SUBNET,
-	KW_SUBNETWITHIN,
 	KW_PROTOPORT,
 	KW_SOURCEIP,
-	KW_NATIP,
+	KW_DNS,
 	KW_FIREWALL,
 	KW_HOSTACCESS,
 	KW_ALLOWANY,
@@ -148,20 +114,19 @@ typedef enum {
 	KW_CA,
 	KW_CA2,
 	KW_GROUPS,
-	KW_IFACE,
+	KW_GROUPS2,
+	KW_END_DEPRECATED,
 
 #define KW_END_FIRST    KW_HOST
-#define KW_END_LAST     KW_IFACE
+#define KW_END_LAST     KW_END_DEPRECATED
 
-   /* left end keywords */
+	/* left end keywords */
 	KW_LEFT,
 	KW_LEFTIKEPORT,
-	KW_LEFTNEXTHOP,
 	KW_LEFTSUBNET,
-	KW_LEFTSUBNETWITHIN,
 	KW_LEFTPROTOPORT,
 	KW_LEFTSOURCEIP,
-	KW_LEFTNATIP,
+	KW_LEFTDNS,
 	KW_LEFTFIREWALL,
 	KW_LEFTHOSTACCESS,
 	KW_LEFTALLOWANY,
@@ -178,19 +143,19 @@ typedef enum {
 	KW_LEFTCA,
 	KW_LEFTCA2,
 	KW_LEFTGROUPS,
+	KW_LEFTGROUPS2,
+	KW_LEFT_DEPRECATED,
 
 #define KW_LEFT_FIRST   KW_LEFT
-#define KW_LEFT_LAST    KW_LEFTGROUPS
+#define KW_LEFT_LAST    KW_LEFT_DEPRECATED
 
-   /* right end keywords */
+	/* right end keywords */
 	KW_RIGHT,
 	KW_RIGHTIKEPORT,
-	KW_RIGHTNEXTHOP,
 	KW_RIGHTSUBNET,
-	KW_RIGHTSUBNETWITHIN,
 	KW_RIGHTPROTOPORT,
 	KW_RIGHTSOURCEIP,
-	KW_RIGHTNATIP,
+	KW_RIGHTDNS,
 	KW_RIGHTFIREWALL,
 	KW_RIGHTHOSTACCESS,
 	KW_RIGHTALLOWANY,
@@ -207,13 +172,15 @@ typedef enum {
 	KW_RIGHTCA,
 	KW_RIGHTCA2,
 	KW_RIGHTGROUPS,
+	KW_RIGHTGROUPS2,
+	KW_RIGHT_DEPRECATED,
 
 #define KW_RIGHT_FIRST  KW_RIGHT
-#define KW_RIGHT_LAST   KW_RIGHTGROUPS
+#define KW_RIGHT_LAST   KW_RIGHT_DEPRECATED
 
 	/* general section keywords */
 	KW_ALSO,
-	KW_AUTO
+	KW_AUTO,
 
 } kw_token_t;
 
diff --git a/src/starter/keywords.txt b/src/starter/keywords.txt
index 548fa2f70..8366f5209 100644
--- a/src/starter/keywords.txt
+++ b/src/starter/keywords.txt
@@ -1,5 +1,5 @@
 %{
-/* strongSwan keywords
+/*
  * Copyright (C) 2005 Andreas Steffen
  * Hochschule fuer Technik Rapperswil, Switzerland
  *
@@ -24,61 +24,37 @@ struct kw_entry {
     kw_token_t token;
 };
 %%
-interfaces,        KW_INTERFACES
-dumpdir,           KW_DUMPDIR
-charonstart,       KW_CHARONSTART
-plutostart,        KW_PLUTOSTART
-klipsdebug,        KW_KLIPSDEBUG
-plutodebug,        KW_PLUTODEBUG
+# regular keywords
 charondebug,       KW_CHARONDEBUG
-prepluto,          KW_PREPLUTO
-postpluto,         KW_POSTPLUTO
-plutostderrlog,    KW_PLUTOSTDERRLOG
-fragicmp,          KW_FRAGICMP
-packetdefault,     KW_PACKETDEFAULT
-hidetos,           KW_HIDETOS
 uniqueids,         KW_UNIQUEIDS
-overridemtu,       KW_OVERRIDEMTU
-crlcheckinterval,  KW_CRLCHECKINTERVAL
 cachecrls,         KW_CACHECRLS
 strictcrlpolicy,   KW_STRICTCRLPOLICY
-nocrsend,          KW_NOCRSEND
-nat_traversal,     KW_NAT_TRAVERSAL
-keep_alive,        KW_KEEP_ALIVE
-force_keepalive,   KW_FORCE_KEEPALIVE
-virtual_private,   KW_VIRTUAL_PRIVATE
-eap,               KW_EAP
-eap_identity,      KW_EAP_IDENTITY
-aaa_identity,      KW_AAA_IDENTITY
-mobike,	           KW_MOBIKE
-forceencaps,       KW_FORCEENCAPS
-pkcs11module,      KW_PKCS11MODULE
-pkcs11initargs,    KW_PKCS11INITARGS
-pkcs11keepstate,   KW_PKCS11KEEPSTATE
-pkcs11proxy,       KW_PKCS11PROXY
 keyexchange,       KW_KEYEXCHANGE
 type,              KW_TYPE
-pfs,               KW_PFS
 compress,          KW_COMPRESS
 installpolicy,     KW_INSTALLPOLICY
+aggressive,        KW_AGGRESSIVE
 auth,              KW_AUTH
 authby,            KW_AUTHBY
+eap_identity,      KW_EAP_IDENTITY
+aaa_identity,      KW_AAA_IDENTITY
+mobike,	           KW_MOBIKE
+forceencaps,       KW_FORCEENCAPS
+ikelifetime,       KW_IKELIFETIME
+lifetime,          KW_KEYLIFE
 keylife,           KW_KEYLIFE
 rekeymargin,       KW_REKEYMARGIN
-lifetime,          KW_KEYLIFE
 margintime,        KW_REKEYMARGIN
 lifebytes,         KW_LIFEBYTES
 marginbytes,       KW_MARGINBYTES
 lifepackets,       KW_LIFEPACKETS
 marginpackets,     KW_MARGINPACKETS
-ikelifetime,       KW_IKELIFETIME
 keyingtries,       KW_KEYINGTRIES
 rekeyfuzz,         KW_REKEYFUZZ
 rekey,             KW_REKEY
 reauth,            KW_REAUTH
-esp,               KW_ESP
 ike,               KW_IKE
-pfsgroup,          KW_PFSGROUP
+esp,               KW_ESP
 dpddelay,          KW_DPDDELAY
 dpdtimeout,        KW_DPDTIMEOUT
 dpdaction,         KW_DPDACTION
@@ -96,8 +72,6 @@ mark_in,           KW_MARK_IN
 mark_out,          KW_MARK_OUT
 tfc,               KW_TFC
 cacert,            KW_CACERT
-ldaphost,          KW_LDAPHOST
-ldapbase,          KW_LDAPBASE
 crluri,            KW_CRLURI
 crluri1,           KW_CRLURI
 crluri2,           KW_CRLURI2
@@ -107,20 +81,19 @@ ocspuri2,          KW_OCSPURI2
 certuribase,       KW_CERTURIBASE
 left,              KW_LEFT
 leftikeport,       KW_LEFTIKEPORT
-leftnexthop,       KW_LEFTNEXTHOP
 leftsubnet,        KW_LEFTSUBNET
-leftsubnetwithin,  KW_LEFTSUBNETWITHIN
+leftsubnetwithin,  KW_LEFTSUBNET
 leftprotoport,     KW_LEFTPROTOPORT
 leftsourceip,      KW_LEFTSOURCEIP
-leftnatip,         KW_LEFTNATIP
+leftdns,           KW_LEFTDNS
 leftfirewall,      KW_LEFTFIREWALL
 lefthostaccess,    KW_LEFTHOSTACCESS
 leftallowany,      KW_LEFTALLOWANY
 leftupdown,        KW_LEFTUPDOWN
-leftid,            KW_LEFTID
-leftid2,           KW_LEFTID2
 leftauth,          KW_LEFTAUTH
 leftauth2,         KW_LEFTAUTH2
+leftid,            KW_LEFTID
+leftid2,           KW_LEFTID2
 leftrsasigkey,     KW_LEFTRSASIGKEY
 leftcert,          KW_LEFTCERT
 leftcert2,         KW_LEFTCERT2
@@ -129,22 +102,22 @@ leftsendcert,      KW_LEFTSENDCERT
 leftca,            KW_LEFTCA
 leftca2,           KW_LEFTCA2
 leftgroups,        KW_LEFTGROUPS
+leftgroups2,       KW_LEFTGROUPS2
 right,             KW_RIGHT
 rightikeport,      KW_RIGHTIKEPORT
-rightnexthop,      KW_RIGHTNEXTHOP
 rightsubnet,       KW_RIGHTSUBNET
-rightsubnetwithin, KW_RIGHTSUBNETWITHIN
+rightsubnetwithin, KW_RIGHTSUBNET
 rightprotoport,    KW_RIGHTPROTOPORT
 rightsourceip,     KW_RIGHTSOURCEIP
-rightnatip,        KW_RIGHTNATIP
+rightdns,          KW_RIGHTDNS
 rightfirewall,     KW_RIGHTFIREWALL
 righthostaccess,   KW_RIGHTHOSTACCESS
 rightallowany,     KW_RIGHTALLOWANY
 rightupdown,       KW_RIGHTUPDOWN
-rightid,           KW_RIGHTID
-rightid2,          KW_RIGHTID2
 rightauth,         KW_RIGHTAUTH
 rightauth2,        KW_RIGHTAUTH2
+rightid,           KW_RIGHTID
+rightid2,          KW_RIGHTID2
 rightrsasigkey,    KW_RIGHTRSASIGKEY
 rightcert,         KW_RIGHTCERT
 rightcert2,        KW_RIGHTCERT2
@@ -153,5 +126,37 @@ rightsendcert,     KW_RIGHTSENDCERT
 rightca,           KW_RIGHTCA
 rightca2,          KW_RIGHTCA2
 rightgroups,       KW_RIGHTGROUPS
+rightgroups2,      KW_RIGHTGROUPS2
 also,              KW_ALSO
 auto,              KW_AUTO
+# deprecated/removed keywords
+interfaces,        KW_SETUP_DEPRECATED
+dumpdir,           KW_SETUP_DEPRECATED
+charonstart,       KW_SETUP_DEPRECATED
+plutostart,        KW_SETUP_DEPRECATED
+klipsdebug,        KW_SETUP_DEPRECATED
+plutodebug,        KW_SETUP_DEPRECATED
+prepluto,          KW_SETUP_DEPRECATED
+postpluto,         KW_SETUP_DEPRECATED
+plutostderrlog,    KW_SETUP_DEPRECATED
+fragicmp,          KW_SETUP_DEPRECATED
+packetdefault,     KW_SETUP_DEPRECATED
+hidetos,           KW_SETUP_DEPRECATED
+overridemtu,       KW_SETUP_DEPRECATED
+crlcheckinterval,  KW_SETUP_DEPRECATED
+nocrsend,          KW_SETUP_DEPRECATED
+nat_traversal,     KW_SETUP_DEPRECATED
+keep_alive,        KW_SETUP_DEPRECATED
+force_keepalive,   KW_SETUP_DEPRECATED
+virtual_private,   KW_SETUP_DEPRECATED
+pkcs11module,      KW_PKCS11_DEPRECATED
+pkcs11initargs,    KW_PKCS11_DEPRECATED
+pkcs11keepstate,   KW_PKCS11_DEPRECATED
+pkcs11proxy,       KW_PKCS11_DEPRECATED
+ldaphost,          KW_CA_DEPRECATED
+ldapbase,          KW_CA_DEPRECATED
+pfs,               KW_PFS_DEPRECATED
+pfsgroup,          KW_PFS_DEPRECATED
+eap,               KW_CONN_DEPRECATED
+leftnexthop,       KW_LEFT_DEPRECATED
+rightnexthop,      KW_RIGHT_DEPRECATED
diff --git a/src/starter/klips.c b/src/starter/klips.c
index 79bd25c44..484b7e281 100644
--- a/src/starter/klips.c
+++ b/src/starter/klips.c
@@ -16,16 +16,12 @@
 #include <sys/stat.h>
 #include <stdlib.h>
 
-#include <freeswan.h>
-
-#include "../pluto/constants.h"
-#include "../pluto/defs.h"
-#include "../pluto/log.h"
+#include <library.h>
+#include <debug.h>
 
 #include "files.h"
 
-bool
-starter_klips_init(void)
+bool starter_klips_init(void)
 {
 	struct stat stb;
 
@@ -40,9 +36,7 @@ starter_klips_init(void)
 		/* now test again */
 		if (stat(PROC_KLIPS, &stb) != 0)
 		{
-			DBG(DBG_CONTROL,
-				DBG_log("kernel appears to lack the KLIPS IPsec stack")
-			)
+			DBG2(DBG_APP, "kernel appears to lack the KLIPS IPsec stack");
 			return FALSE;
 		}
 	}
@@ -52,29 +46,25 @@ starter_klips_init(void)
 	ignore_result(system("modprobe -qv ipsec_blowfish"));
 	ignore_result(system("modprobe -qv ipsec_sha2"));
 
-	DBG(DBG_CONTROL,
-		DBG_log("Found KLIPS IPsec stack")
-	)
-
+	DBG2(DBG_APP, "found KLIPS IPsec stack");
 	return TRUE;
 }
 
-void
-starter_klips_cleanup(void)
+void starter_klips_cleanup(void)
 {
 	if (system("type eroute > /dev/null 2>&1") == 0)
 	{
 		ignore_result(system("spi --clear"));
 		ignore_result(system("eroute --clear"));
 	}
-		else if (system("type setkey > /dev/null 2>&1") == 0)
+	else if (system("type setkey > /dev/null 2>&1") == 0)
 	{
 		ignore_result(system("setkey -F"));
 		ignore_result(system("setkey -FP"));
 	}
 	else
 	{
-		plog("WARNING: cannot flush IPsec state/policy database");
+		DBG1(DBG_APP, "WARNING: cannot flush IPsec state/policy database");
 	}
 }
 
diff --git a/src/starter/loglite.c b/src/starter/loglite.c
deleted file mode 100644
index c88b33bfd..000000000
--- a/src/starter/loglite.c
+++ /dev/null
@@ -1,297 +0,0 @@
-/* error logging functions
- * Copyright (C) 1997 Angelos D. Keromytis.
- * Copyright (C) 1998-2001  D. Hugh Redelmeier.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <ctype.h>
-#include <stdarg.h>
-#include <syslog.h>
-#include <errno.h>
-#include <string.h>
-#include <unistd.h>
-#include <signal.h>     /* used only if MSG_NOSIGNAL not defined */
-#include <libgen.h>
-#include <sys/stat.h>
-#include <sys/types.h>
-
-#include <freeswan.h>
-
-#include <constants.h>
-#include <defs.h>
-#include <log.h>
-#include <whack.h>
-
-#ifndef LOG_AUTHPRIV
-#define LOG_AUTHPRIV LOG_AUTH
-#endif
-
-bool
-	log_to_stderr = FALSE,      /* should log go to stderr? */
-	log_to_syslog = TRUE;       /* should log go to syslog? */
-
-void
-init_log(const char *program)
-{
-	if (log_to_stderr)
-		setbuf(stderr, NULL);
-	if (log_to_syslog)
-		openlog(program, LOG_CONS | LOG_NDELAY | LOG_PID, LOG_AUTHPRIV);
-}
-
-void
-close_log(void)
-{
-	if (log_to_syslog)
-		closelog();
-}
-
-void
-plog(const char *message, ...)
-{
-	va_list args;
-	char m[LOG_WIDTH];  /* longer messages will be truncated */
-
-	va_start(args, message);
-	vsnprintf(m, sizeof(m), message, args);
-	va_end(args);
-
-	if (log_to_stderr)
-		fprintf(stderr, "%s\n", m);
-	if (log_to_syslog)
-		syslog(LOG_WARNING, "%s", m);
-}
-
-void
-loglog(int mess_no, const char *message, ...)
-{
-	va_list args;
-	char m[LOG_WIDTH];  /* longer messages will be truncated */
-
-	va_start(args, message);
-	vsnprintf(m, sizeof(m), message, args);
-	va_end(args);
-
-	if (log_to_stderr)
-		fprintf(stderr, "%s\n", m);
-	if (log_to_syslog)
-		syslog(LOG_WARNING, "%s", m);
-}
-
-void
-log_errno_routine(int e, const char *message, ...)
-{
-	va_list args;
-	char m[LOG_WIDTH];  /* longer messages will be truncated */
-
-	va_start(args, message);
-	vsnprintf(m, sizeof(m), message, args);
-	va_end(args);
-
-	if (log_to_stderr)
-		fprintf(stderr, "ERROR: %s. Errno %d: %s\n", m, e, strerror(e));
-	if (log_to_syslog)
-		syslog(LOG_ERR, "ERROR: %s. Errno %d: %s", m, e, strerror(e));
-}
-
-void
-exit_log(const char *message, ...)
-{
-	va_list args;
-	char m[LOG_WIDTH];  /* longer messages will be truncated */
-
-	va_start(args, message);
-	vsnprintf(m, sizeof(m), message, args);
-	va_end(args);
-
-	if (log_to_stderr)
-		fprintf(stderr, "FATAL ERROR: %s\n", m);
-	if (log_to_syslog)
-		syslog(LOG_ERR, "FATAL ERROR: %s", m);
-	exit(1);
-}
-
-void
-exit_log_errno_routine(int e, const char *message, ...)
-{
-	va_list args;
-	char m[LOG_WIDTH];  /* longer messages will be truncated */
-
-	va_start(args, message);
-	vsnprintf(m, sizeof(m), message, args);
-	va_end(args);
-
-	if (log_to_stderr)
-		fprintf(stderr, "FATAL ERROR: %s. Errno %d: %s\n", m, e, strerror(e));
-	if (log_to_syslog)
-		syslog(LOG_ERR, "FATAL ERROR: %s. Errno %d: %s", m, e, strerror(e));
-	exit(1);
-}
-
-void
-whack_log(int mess_no, const char *message, ...)
-{
-	va_list args;
-	char m[LOG_WIDTH];  /* longer messages will be truncated */
-
-	va_start(args, message);
-	vsnprintf(m, sizeof(m), message, args);
-	va_end(args);
-
-	fprintf(stderr, "%s\n", m);
-}
-
-/* Build up a diagnostic in a static buffer.
- * Although this would be a generally useful function, it is very
- * hard to come up with a discipline that prevents different uses
- * from interfering.  It is intended that by limiting it to building
- * diagnostics, we will avoid this problem.
- * Juggling is performed to allow an argument to be a previous
- * result: the new string may safely depend on the old one.  This
- * restriction is not checked in any way: violators will produce
- * confusing results (without crashing!).
- */
-char diag_space[sizeof(diag_space)];
-
-err_t
-builddiag(const char *fmt, ...)
-{
-	static char diag_space[LOG_WIDTH];  /* longer messages will be truncated */
-	char t[sizeof(diag_space)]; /* build result here first */
-	va_list args;
-
-	va_start(args, fmt);
-	t[0] = '\0';        /* in case nothing terminates string */
-	vsnprintf(t, sizeof(t), fmt, args);
-	va_end(args);
-	strcpy(diag_space, t);
-	return diag_space;
-}
-
-/* Debugging message support */
-
-#ifdef DEBUG
-
-void
-switch_fail(int n, const char *file_str, unsigned long line_no)
-{
-	char buf[30];
-
-	snprintf(buf, sizeof(buf), "case %d unexpected", n);
-	passert_fail(buf, file_str, line_no);
-}
-
-void
-passert_fail(const char *pred_str, const char *file_str, unsigned long line_no)
-{
-	/* we will get a possibly unplanned prefix.  Hope it works */
-	loglog(RC_LOG_SERIOUS, "ASSERTION FAILED at %s:%lu: %s", file_str, line_no, pred_str);
-	abort();    /* exiting correctly doesn't always work */
-}
-
-lset_t
-	base_debugging = DBG_NONE,  /* default to reporting nothing */
-	cur_debugging =  DBG_NONE;
-
-void
-pexpect_log(const char *pred_str, const char *file_str, unsigned long line_no)
-{
-	/* we will get a possibly unplanned prefix.  Hope it works */
-	loglog(RC_LOG_SERIOUS, "EXPECTATION FAILED at %s:%lu: %s", file_str, line_no, pred_str);
-}
-
-/* log a debugging message (prefixed by "| ") */
-
-void
-DBG_log(const char *message, ...)
-{
-	va_list args;
-	char m[LOG_WIDTH];  /* longer messages will be truncated */
-
-	va_start(args, message);
-	vsnprintf(m, sizeof(m), message, args);
-	va_end(args);
-
-	if (log_to_stderr)
-		fprintf(stderr, "| %s\n", m);
-	if (log_to_syslog)
-		syslog(LOG_DEBUG, "| %s", m);
-}
-
-/* dump raw bytes in hex to stderr (for lack of any better destination) */
-
-void
-DBG_dump(const char *label, const void *p, size_t len)
-{
-#   define DUMP_LABEL_WIDTH 20  /* arbitrary modest boundary */
-#   define DUMP_WIDTH   (4 * (1 + 4 * 3) + 1)
-	char buf[DUMP_LABEL_WIDTH + DUMP_WIDTH];
-	char *bp;
-	const unsigned char *cp = p;
-
-	bp = buf;
-
-	if (label != NULL && label[0] != '\0')
-	{
-		/* Handle the label.  Care must be taken to avoid buffer overrun. */
-		size_t llen = strlen(label);
-
-		if (llen + 1 > sizeof(buf))
-		{
-			DBG_log("%s", label);
-		}
-		else
-		{
-			strcpy(buf, label);
-			if (buf[llen-1] == '\n')
-			{
-				buf[llen-1] = '\0';     /* get rid of newline */
-				DBG_log("%s", buf);
-			}
-			else if (llen < DUMP_LABEL_WIDTH)
-			{
-				bp = buf + llen;
-			}
-			else
-			{
-				DBG_log("%s", buf);
-			}
-		}
-	}
-
-	do {
-		int i, j;
-
-		for (i = 0; len!=0 && i!=4; i++)
-		{
-			*bp++ = ' ';
-			for (j = 0; len!=0 && j!=4; len--, j++)
-			{
-				static const char hexdig[] = "0123456789abcdef";
-
-				*bp++ = ' ';
-				*bp++ = hexdig[(*cp >> 4) & 0xF];
-				*bp++ = hexdig[*cp & 0xF];
-				cp++;
-			}
-		}
-		*bp = '\0';
-		DBG_log("%s", buf);
-		bp = buf;
-	} while (len != 0);
-#   undef DUMP_LABEL_WIDTH
-#   undef DUMP_WIDTH
-}
-
-#endif /* DEBUG */
diff --git a/src/starter/netkey.c b/src/starter/netkey.c
index 6646195cb..25f68e505 100644
--- a/src/starter/netkey.c
+++ b/src/starter/netkey.c
@@ -16,17 +16,13 @@
 #include <sys/stat.h>
 #include <stdlib.h>
 
-#include <freeswan.h>
+#include <library.h>
 #include <hydra.h>
-
-#include "../pluto/constants.h"
-#include "../pluto/defs.h"
-#include "../pluto/log.h"
+#include <debug.h>
 
 #include "files.h"
 
-bool
-starter_netkey_init(void)
+bool starter_netkey_init(void)
 {
 	struct stat stb;
 
@@ -41,9 +37,7 @@ starter_netkey_init(void)
 		/* now test again */
 		if (stat(PROC_NETKEY, &stb) != 0)
 		{
-			DBG(DBG_CONTROL,
-				DBG_log("kernel appears to lack the native netkey IPsec stack")
-			)
+			DBG2(DBG_APP, "kernel appears to lack the native netkey IPsec stack");
 			return FALSE;
 		}
 	}
@@ -58,15 +52,19 @@ starter_netkey_init(void)
 		ignore_result(system("modprobe -qv xfrm_user"));
 	}
 
-	DBG(DBG_CONTROL,
-		DBG_log("Found netkey IPsec stack")
-	)
+	DBG2(DBG_APP, "found netkey IPsec stack");
 	return TRUE;
 }
 
-void
-starter_netkey_cleanup(void)
+void starter_netkey_cleanup(void)
 {
+	if (!lib->plugins->load(lib->plugins, NULL,
+			lib->settings->get_str(lib->settings, "starter.load", PLUGINS)))
+	{
+		DBG1(DBG_APP, "unable to load kernel plugins");
+		return;
+	}
 	hydra->kernel_interface->flush_sas(hydra->kernel_interface);
 	hydra->kernel_interface->flush_policies(hydra->kernel_interface);
+	lib->plugins->unload(lib->plugins);
 }
diff --git a/src/starter/parser.c b/src/starter/parser.c
index ef668027d..beb752a51 100644
--- a/src/starter/parser.c
+++ b/src/starter/parser.c
@@ -88,11 +88,9 @@
 #include <stdlib.h>
 #include <string.h>
 
-#include <freeswan.h>
+#include <library.h>
+#include <debug.h>
 
-#include "../pluto/constants.h"
-#include "../pluto/defs.h"
-#include "../pluto/log.h"
 #include "ipsec-parser.h"
 
 #define YYERROR_VERBOSE
@@ -123,7 +121,7 @@ extern kw_entry_t *in_word_set (char *str, unsigned int len);
 
 
 /* Line 189 of yacc.c  */
-#line 127 "parser.c"
+#line 125 "parser.c"
 
 /* Enabling traces.  */
 #ifndef YYDEBUG
@@ -182,12 +180,12 @@ typedef union YYSTYPE
 {
 
 /* Line 214 of yacc.c  */
-#line 54 "parser.y"
+#line 52 "parser.y"
  char *s; 
 
 
 /* Line 214 of yacc.c  */
-#line 191 "parser.c"
+#line 189 "parser.c"
 } YYSTYPE;
 # define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
@@ -199,7 +197,7 @@ typedef union YYSTYPE
 
 
 /* Line 264 of yacc.c  */
-#line 203 "parser.c"
+#line 201 "parser.c"
 
 #ifdef short
 # undef short
@@ -487,8 +485,8 @@ static const yytype_int8 yyrhs[] =
 /* YYRLINE[YYN] -- source line where rule number YYN was defined.  */
 static const yytype_uint8 yyrline[] =
 {
-       0,    65,    65,    66,    70,    75,    74,    80,    79,    96,
-      95,   111,   110,   116,   120,   121,   125,   150,   154
+       0,    63,    63,    64,    68,    73,    72,    78,    77,    94,
+      93,   109,   108,   114,   118,   119,   123,   148,   152
 };
 #endif
 
@@ -1402,7 +1400,7 @@ yyreduce:
         case 4:
 
 /* Line 1455 of yacc.c  */
-#line 71 "parser.y"
+#line 69 "parser.y"
     {
 		free((yyvsp[(2) - (3)].s));
 	}
@@ -1411,7 +1409,7 @@ yyreduce:
   case 5:
 
 /* Line 1455 of yacc.c  */
-#line 75 "parser.y"
+#line 73 "parser.y"
     {
 		_parser_kw = &(_parser_cfg->config_setup);
 		_parser_kw_last = NULL;
@@ -1421,11 +1419,11 @@ yyreduce:
   case 7:
 
 /* Line 1455 of yacc.c  */
-#line 80 "parser.y"
+#line 78 "parser.y"
     {
 		section_list_t *section = malloc_thing(section_list_t);
-		
-		section->name = clone_str((yyvsp[(2) - (3)].s));
+
+		section->name = strdupnull((yyvsp[(2) - (3)].s));
 		section->kw = NULL;
 		section->next = NULL;
 		_parser_kw = &(section->kw);
@@ -1442,10 +1440,10 @@ yyreduce:
   case 9:
 
 /* Line 1455 of yacc.c  */
-#line 96 "parser.y"
+#line 94 "parser.y"
     {
 		section_list_t *section = malloc_thing(section_list_t);
-		section->name = clone_str((yyvsp[(2) - (3)].s));
+		section->name = strdupnull((yyvsp[(2) - (3)].s));
 		section->kw = NULL;
 		section->next = NULL;
 		_parser_kw = &(section->kw);
@@ -1462,7 +1460,7 @@ yyreduce:
   case 11:
 
 /* Line 1455 of yacc.c  */
-#line 111 "parser.y"
+#line 109 "parser.y"
     {
 		extern void _parser_y_include (const char *f);
 		_parser_y_include((yyvsp[(2) - (2)].s));
@@ -1473,7 +1471,7 @@ yyreduce:
   case 16:
 
 /* Line 1455 of yacc.c  */
-#line 126 "parser.y"
+#line 124 "parser.y"
     {
 		kw_list_t  *new;
 		kw_entry_t *entry = in_word_set((yyvsp[(1) - (3)].s), strlen((yyvsp[(1) - (3)].s)));
@@ -1487,7 +1485,7 @@ yyreduce:
 		{
 			new = (kw_list_t *)malloc_thing(kw_list_t);
 			new->entry = entry;
-			new->value = clone_str((yyvsp[(3) - (3)].s));
+			new->value = strdupnull((yyvsp[(3) - (3)].s));
 			new->next = NULL;
 			if (_parser_kw_last)
 				_parser_kw_last->next = new;
@@ -1503,7 +1501,7 @@ yyreduce:
   case 17:
 
 /* Line 1455 of yacc.c  */
-#line 151 "parser.y"
+#line 149 "parser.y"
     {
 		free((yyvsp[(1) - (2)].s));
 	  }
@@ -1512,7 +1510,7 @@ yyreduce:
 
 
 /* Line 1455 of yacc.c  */
-#line 1516 "parser.c"
+#line 1514 "parser.c"
       default: break;
     }
   YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc);
@@ -1724,7 +1722,7 @@ yyreturn:
 
 
 /* Line 1675 of yacc.c  */
-#line 157 "parser.y"
+#line 155 "parser.y"
 
 
 void yyerror(const char *s)
@@ -1794,7 +1792,7 @@ config_parsed_t *parser_load_conf(const char *file)
 
 	if (err)
 	{
-		plog("%s", parser_errstring);
+		DBG1(DBG_APP, "%s", parser_errstring);
 
 		if (cfg)
 			parser_free_conf(cfg);
diff --git a/src/starter/parser.h b/src/starter/parser.h
index f0e666bb5..eff532f6d 100644
--- a/src/starter/parser.h
+++ b/src/starter/parser.h
@@ -71,7 +71,7 @@ typedef union YYSTYPE
 {
 
 /* Line 1676 of yacc.c  */
-#line 54 "parser.y"
+#line 52 "parser.y"
  char *s; 
 
 
diff --git a/src/starter/parser.y b/src/starter/parser.y
index dfaec9ee8..424e3a9fd 100644
--- a/src/starter/parser.y
+++ b/src/starter/parser.y
@@ -17,11 +17,9 @@
 #include <stdlib.h>
 #include <string.h>
 
-#include <freeswan.h>
+#include <library.h>
+#include <debug.h>
 
-#include "../pluto/constants.h"
-#include "../pluto/defs.h"
-#include "../pluto/log.h"
 #include "ipsec-parser.h"
 
 #define YYERROR_VERBOSE
@@ -63,7 +61,7 @@ extern kw_entry_t *in_word_set (char *str, unsigned int len);
 
 config_file:
 	config_file section_or_include
-	| /* NULL */                
+	| /* NULL */
 	;
 
 section_or_include:
@@ -79,8 +77,8 @@ section_or_include:
 	| CONN STRING EOL
 	{
 		section_list_t *section = malloc_thing(section_list_t);
-		
-		section->name = clone_str($2);
+
+		section->name = strdupnull($2);
 		section->kw = NULL;
 		section->next = NULL;
 		_parser_kw = &(section->kw);
@@ -95,7 +93,7 @@ section_or_include:
 	| CA STRING EOL
 	{
 		section_list_t *section = malloc_thing(section_list_t);
-		section->name = clone_str($2);
+		section->name = strdupnull($2);
 		section->kw = NULL;
 		section->next = NULL;
 		_parser_kw = &(section->kw);
@@ -136,7 +134,7 @@ statement_kw:
 		{
 			new = (kw_list_t *)malloc_thing(kw_list_t);
 			new->entry = entry;
-			new->value = clone_str($3);
+			new->value = strdupnull($3);
 			new->next = NULL;
 			if (_parser_kw_last)
 				_parser_kw_last->next = new;
@@ -223,7 +221,7 @@ config_parsed_t *parser_load_conf(const char *file)
 
 	if (err)
 	{
-		plog("%s", parser_errstring);
+		DBG1(DBG_APP, "%s", parser_errstring);
 
 		if (cfg)
 			parser_free_conf(cfg);
diff --git a/src/starter/starter.c b/src/starter/starter.c
index 44e21431c..c6efcb2f4 100644
--- a/src/starter/starter.c
+++ b/src/starter/starter.c
@@ -12,12 +12,14 @@
  * for more details.
  */
 
+#include <sys/select.h>
 #include <sys/types.h>
 #include <sys/wait.h>
 #include <sys/stat.h>
 #include <stdlib.h>
 #include <stdio.h>
 #include <signal.h>
+#include <syslog.h>
 #include <unistd.h>
 #include <sys/time.h>
 #include <time.h>
@@ -26,25 +28,100 @@
 #include <fcntl.h>
 #include <pwd.h>
 #include <grp.h>
+#include <pthread.h>
 
-#include <freeswan.h>
 #include <library.h>
 #include <hydra.h>
-
-#include "../pluto/constants.h"
-#include "../pluto/defs.h"
-#include "../pluto/log.h"
+#include <utils/backtrace.h>
+#include <threading/thread.h>
+#include <debug.h>
 
 #include "confread.h"
 #include "files.h"
-#include "starterwhack.h"
 #include "starterstroke.h"
-#include "invokepluto.h"
 #include "invokecharon.h"
 #include "netkey.h"
 #include "klips.h"
 #include "cmp.h"
-#include "interfaces.h"
+
+#ifndef LOG_AUTHPRIV
+#define LOG_AUTHPRIV LOG_AUTH
+#endif
+
+#define CHARON_RESTART_DELAY 5
+
+/* logging */
+static bool log_to_stderr = TRUE;
+static bool log_to_syslog = TRUE;
+static level_t current_loglevel = 1;
+
+/**
+ * logging function for scepclient
+ */
+static void starter_dbg(debug_t group, level_t level, char *fmt, ...)
+{
+	char buffer[8192];
+	char *current = buffer, *next;
+	va_list args;
+
+	if (level <= current_loglevel)
+	{
+		if (log_to_stderr)
+		{
+			va_start(args, fmt);
+			vfprintf(stderr, fmt, args);
+			va_end(args);
+			fprintf(stderr, "\n");
+		}
+		if (log_to_syslog)
+		{
+			/* write in memory buffer first */
+			va_start(args, fmt);
+			vsnprintf(buffer, sizeof(buffer), fmt, args);
+			va_end(args);
+
+			/* do a syslog with every line */
+			while (current)
+			{
+				next = strchr(current, '\n');
+				if (next)
+				{
+					*(next++) = '\0';
+				}
+				syslog(LOG_INFO, "%s\n", current);
+				current = next;
+			}
+		}
+	}
+}
+
+/**
+ * Initialize logging to stderr/syslog
+ */
+static void init_log(const char *program)
+{
+	dbg = starter_dbg;
+
+	if (log_to_stderr)
+	{
+		setbuf(stderr, NULL);
+	}
+	if (log_to_syslog)
+	{
+		openlog(program, LOG_CONS | LOG_NDELAY | LOG_PID, LOG_AUTHPRIV);
+	}
+}
+
+/**
+ * Deinitialize logging to syslog
+ */
+static void close_log()
+{
+	if (log_to_syslog)
+	{
+		closelog();
+	}
+}
 
 /**
  * Return codes defined by Linux Standard Base Core Specification 3.1
@@ -68,7 +145,10 @@
 
 static unsigned int _action_ = 0;
 
-static void fsig(int signal)
+/**
+ * Handle signals in the main thread
+ */
+static void signal_handler(int signal)
 {
 	switch (signal)
 	{
@@ -80,27 +160,19 @@ static void fsig(int signal)
 
 			while ((pid = waitpid(-1, &status, WNOHANG)) > 0)
 			{
-				if (pid == starter_pluto_pid())
-				{
-					name = " (Pluto)";
-				}
 				if (pid == starter_charon_pid())
 				{
 					name = " (Charon)";
 				}
 				if (WIFSIGNALED(status))
 				{
-					DBG(DBG_CONTROL,
-						DBG_log("child %d%s has been killed by sig %d\n",
-								pid, name?name:"", WTERMSIG(status))
-					   )
+					DBG2(DBG_APP, "child %d%s has been killed by sig %d\n",
+						 pid, name?name:"", WTERMSIG(status));
 				}
 				else if (WIFSTOPPED(status))
 				{
-					DBG(DBG_CONTROL,
-						DBG_log("child %d%s has been stopped by sig %d\n",
-								pid, name?name:"", WSTOPSIG(status))
-					   )
+					DBG2(DBG_APP, "child %d%s has been stopped by sig %d\n",
+						 pid, name?name:"", WSTOPSIG(status));
 				}
 				else if (WIFEXITED(status))
 				{
@@ -109,20 +181,12 @@ static void fsig(int signal)
 					{
 						_action_ =  FLAG_ACTION_QUIT;
 					}
-					DBG(DBG_CONTROL,
-						DBG_log("child %d%s has quit (exit code %d)\n",
-								pid, name?name:"", exit_status)
-					   )
+					DBG2(DBG_APP, "child %d%s has quit (exit code %d)\n",
+						 pid, name?name:"", exit_status);
 				}
 				else
 				{
-					DBG(DBG_CONTROL,
-						DBG_log("child %d%s has quit", pid, name?name:"")
-					   )
-				}
-				if (pid == starter_pluto_pid())
-				{
-					starter_pluto_sigchild(pid, exit_status);
+					DBG2(DBG_APP, "child %d%s has quit", pid, name?name:"");
 				}
 				if (pid == starter_charon_pid())
 				{
@@ -132,12 +196,7 @@ static void fsig(int signal)
 		}
 		break;
 
-		case SIGPIPE:
-			/** ignore **/
-			break;
-
 		case SIGALRM:
-			_action_ |= FLAG_ACTION_START_PLUTO;
 			_action_ |= FLAG_ACTION_START_CHARON;
 			break;
 
@@ -157,11 +216,27 @@ static void fsig(int signal)
 			break;
 
 		default:
-			plog("fsig(): unknown signal %d -- investigate", signal);
+			DBG1(DBG_APP, "fsig(): unknown signal %d -- investigate", signal);
 			break;
 	}
 }
 
+/**
+ * Handle fatal signals raised by threads
+ */
+static void fatal_signal_handler(int signal)
+{
+	backtrace_t *backtrace;
+
+	DBG1(DBG_APP, "thread %u received %d", thread_current_id(), signal);
+	backtrace = backtrace_create(2);
+	backtrace->log(backtrace, stderr, TRUE);
+	backtrace->destroy(backtrace);
+
+	DBG1(DBG_APP, "killing ourself, received critical signal");
+	abort();
+}
+
 #ifdef GENERATE_SELFCERT
 static void generate_selfcert()
 {
@@ -244,7 +319,7 @@ static bool check_pid(char *pid_file)
 				return TRUE;
 			}
 		}
-		plog("removing pidfile '%s', process not running", pid_file);
+		DBG1(DBG_APP, "removing pidfile '%s', process not running", pid_file);
 		unlink(pid_file);
 	}
 	return FALSE;
@@ -252,8 +327,8 @@ static bool check_pid(char *pid_file)
 
 static void usage(char *name)
 {
-	fprintf(stderr, "Usage: starter [--nofork] [--auto-update <sec>] "
-			"[--debug|--debug-more|--debug-all]\n");
+	fprintf(stderr, "Usage: starter [--nofork] [--auto-update <sec>]\n"
+			"               [--debug|--debug-more|--debug-all|--nolog]\n");
 	exit(LSB_RC_INVALID_ARGUMENT);
 }
 
@@ -264,21 +339,18 @@ int main (int argc, char **argv)
 	starter_conn_t *conn, *conn2;
 	starter_ca_t *ca, *ca2;
 
+	struct sigaction action;
 	struct stat stb;
 
 	int i;
 	int id = 1;
-	struct timeval tv;
+	struct timespec ts;
 	unsigned long auto_update = 0;
 	time_t last_reload;
 	bool no_fork = FALSE;
 	bool attach_gdb = FALSE;
 	bool load_warning = FALSE;
 
-	/* global variables defined in log.h */
-	log_to_stderr = TRUE;
-	base_debugging = DBG_NONE;
-
 	library_init(NULL);
 	atexit(library_deinit);
 
@@ -290,15 +362,19 @@ int main (int argc, char **argv)
 	{
 		if (streq(argv[i], "--debug"))
 		{
-			base_debugging |= DBG_CONTROL;
+			current_loglevel = 2;
 		}
 		else if (streq(argv[i], "--debug-more"))
 		{
-			base_debugging |= DBG_CONTROLMORE;
+			current_loglevel = 3;
 		}
 		else if (streq(argv[i], "--debug-all"))
 		{
-			base_debugging |= DBG_ALL;
+			current_loglevel = 4;
+		}
+		else if (streq(argv[i], "--nolog"))
+		{
+			current_loglevel = 0;
 		}
 		else if (streq(argv[i], "--nofork"))
 		{
@@ -321,20 +397,12 @@ int main (int argc, char **argv)
 		}
 	}
 
-	/* Init */
 	init_log("ipsec_starter");
-	cur_debugging = base_debugging;
-
-	signal(SIGHUP,  fsig);
-	signal(SIGCHLD, fsig);
-	signal(SIGPIPE, fsig);
-	signal(SIGINT,  fsig);
-	signal(SIGTERM, fsig);
-	signal(SIGQUIT, fsig);
-	signal(SIGALRM, fsig);
-	signal(SIGUSR1, fsig);
 
-	plog("Starting strongSwan "VERSION" IPsec [starter]...");
+	DBG1(DBG_APP, "Starting %sSwan "VERSION" IPsec [starter]...",
+		lib->settings->get_bool(lib->settings,
+			"charon.i_dont_care_about_security_and_use_aggressive_mode_psk",
+				FALSE) ? "weak" : "strong");
 
 #ifdef LOAD_WARNING
 	load_warning = TRUE;
@@ -342,34 +410,24 @@ int main (int argc, char **argv)
 
 	if (lib->settings->get_bool(lib->settings, "starter.load_warning", load_warning))
 	{
-		if (lib->settings->get_str(lib->settings, "charon.load", NULL) ||
-			lib->settings->get_str(lib->settings, "pluto.load", NULL))
+		if (lib->settings->get_str(lib->settings, "charon.load", NULL))
 		{
-			plog("!! Your strongswan.conf contains manual plugin load options for");
-			plog("!! pluto and/or charon. This is recommended for experts only, see");
-			plog("!! http://wiki.strongswan.org/projects/strongswan/wiki/PluginLoad");
+			DBG1(DBG_APP, "!! Your strongswan.conf contains manual plugin load options for charon.");
+			DBG1(DBG_APP, "!! This is recommended for experts only, see");
+			DBG1(DBG_APP, "!! http://wiki.strongswan.org/projects/strongswan/wiki/PluginLoad");
 		}
 	}
 
 	/* verify that we can start */
 	if (getuid() != 0)
 	{
-		plog("permission denied (must be superuser)");
+		DBG1(DBG_APP, "permission denied (must be superuser)");
 		exit(LSB_RC_NOT_ALLOWED);
 	}
 
-	if (check_pid(PLUTO_PID_FILE))
-	{
-		plog("pluto is already running (%s exists) -- skipping pluto start",
-			 PLUTO_PID_FILE);
-	}
-	else
-	{
-		_action_ |= FLAG_ACTION_START_PLUTO;
-	}
 	if (check_pid(CHARON_PID_FILE))
 	{
-		plog("charon is already running (%s exists) -- skipping charon start",
+		DBG1(DBG_APP, "charon is already running (%s exists) -- skipping charon start",
 			 CHARON_PID_FILE);
 	}
 	else
@@ -378,20 +436,20 @@ int main (int argc, char **argv)
 	}
 	if (stat(DEV_RANDOM, &stb) != 0)
 	{
-		plog("unable to start strongSwan IPsec -- no %s!", DEV_RANDOM);
+		DBG1(DBG_APP, "unable to start strongSwan IPsec -- no %s!", DEV_RANDOM);
 		exit(LSB_RC_FAILURE);
 	}
 
 	if (stat(DEV_URANDOM, &stb)!= 0)
 	{
-		plog("unable to start strongSwan IPsec -- no %s!", DEV_URANDOM);
+		DBG1(DBG_APP, "unable to start strongSwan IPsec -- no %s!", DEV_URANDOM);
 		exit(LSB_RC_FAILURE);
 	}
 
 	cfg = confread_load(CONFIG_FILE);
 	if (cfg == NULL || cfg->err > 0)
 	{
-		plog("unable to start strongSwan -- fatal errors in config");
+		DBG1(DBG_APP, "unable to start strongSwan -- fatal errors in config");
 		if (cfg)
 		{
 			confread_free(cfg);
@@ -402,11 +460,11 @@ int main (int argc, char **argv)
 	/* determine if we have a native netkey IPsec stack */
 	if (!starter_netkey_init())
 	{
-		plog("no netkey IPsec stack detected");
+		DBG1(DBG_APP, "no netkey IPsec stack detected");
 		if (!starter_klips_init())
 		{
-			plog("no KLIPS IPsec stack detected");
-			plog("no known IPsec stack detected, ignoring!");
+			DBG1(DBG_APP, "no KLIPS IPsec stack detected");
+			DBG1(DBG_APP, "no known IPsec stack detected, ignoring!");
 		}
 	}
 
@@ -414,7 +472,7 @@ int main (int argc, char **argv)
 
 	if (check_pid(STARTER_PID_FILE))
 	{
-		plog("starter is already running (%s exists) -- no fork done",
+		DBG1(DBG_APP, "starter is already running (%s exists) -- no fork done",
 			 STARTER_PID_FILE);
 		confread_free(cfg);
 		exit(LSB_RC_SUCCESS);
@@ -435,6 +493,7 @@ int main (int argc, char **argv)
 			{
 				int fnull;
 
+				close_log();
 				closefrom(3);
 
 				fnull = open("/dev/null", O_RDWR);
@@ -447,10 +506,11 @@ int main (int argc, char **argv)
 				}
 
 				setsid();
+				init_log("ipsec_starter");
 			}
 			break;
 			case -1:
-				plog("can't fork: %s", strerror(errno));
+				DBG1(DBG_APP, "can't fork: %s", strerror(errno));
 				break;
 			default:
 				confread_free(cfg);
@@ -469,24 +529,46 @@ int main (int argc, char **argv)
 		}
 	}
 
-	/* load plugins */
-	if (!lib->plugins->load(lib->plugins, NULL,
-			lib->settings->get_str(lib->settings, "starter.load", PLUGINS)))
-	{
-		exit(LSB_RC_FAILURE);
-	}
+	/* we handle these signals only in pselect() */
+	memset(&action, 0, sizeof(action));
+	sigemptyset(&action.sa_mask);
+	sigaddset(&action.sa_mask, SIGHUP);
+	sigaddset(&action.sa_mask, SIGINT);
+	sigaddset(&action.sa_mask, SIGTERM);
+	sigaddset(&action.sa_mask, SIGQUIT);
+	sigaddset(&action.sa_mask, SIGALRM);
+	sigaddset(&action.sa_mask, SIGUSR1);
+	pthread_sigmask(SIG_SETMASK, &action.sa_mask, NULL);
+
+	/* install a handler for fatal signals */
+	action.sa_handler = fatal_signal_handler;
+	sigaction(SIGSEGV, &action, NULL);
+	sigaction(SIGILL, &action, NULL);
+	sigaction(SIGBUS, &action, NULL);
+	action.sa_handler = SIG_IGN;
+	sigaction(SIGPIPE, &action, NULL);
+
+	/* install main signal handler */
+	action.sa_handler = signal_handler;
+	sigaction(SIGHUP, &action, NULL);
+	sigaction(SIGINT, &action, NULL);
+	sigaction(SIGTERM, &action, NULL);
+	sigaction(SIGQUIT, &action, NULL);
+	sigaction(SIGALRM, &action, NULL);
+	sigaction(SIGUSR1, &action, NULL);
+	/* this is not blocked above as we want to receive it asynchronously */
+	sigaction(SIGCHLD, &action, NULL);
+
+	/* empty mask for pselect() call below */
+	sigemptyset(&action.sa_mask);
 
 	for (;;)
 	{
 		/*
-		 * Stop pluto/charon (if started) and exit
+		 * Stop charon (if started) and exit
 		 */
 		if (_action_ & FLAG_ACTION_QUIT)
 		{
-			if (starter_pluto_pid())
-			{
-				starter_stop_pluto();
-			}
 			if (starter_charon_pid())
 			{
 				starter_stop_charon();
@@ -494,8 +576,7 @@ int main (int argc, char **argv)
 			starter_netkey_cleanup();
 			confread_free(cfg);
 			unlink(STARTER_PID_FILE);
-			plog("ipsec starter stopped");
-			lib->plugins->unload(lib->plugins);
+			DBG1(DBG_APP, "ipsec starter stopped");
 			close_log();
 			exit(LSB_RC_SUCCESS);
 		}
@@ -505,7 +586,7 @@ int main (int argc, char **argv)
 		 */
 		if (_action_ & FLAG_ACTION_RELOAD)
 		{
-			if (starter_pluto_pid() || starter_charon_pid())
+			if (starter_charon_pid())
 			{
 				for (conn = cfg->conn_first; conn; conn = conn->next)
 				{
@@ -515,10 +596,6 @@ int main (int argc, char **argv)
 						{
 							starter_stroke_del_conn(conn);
 						}
-						if (starter_pluto_pid())
-						{
-							starter_whack_del_conn(conn);
-						}
 						conn->state = STATE_TO_ADD;
 					}
 				}
@@ -530,10 +607,6 @@ int main (int argc, char **argv)
 						{
 							starter_stroke_del_ca(ca);
 						}
-						if (starter_pluto_pid())
-						{
-							starter_whack_del_ca(ca);
-						}
 						ca->state = STATE_TO_ADD;
 					}
 				}
@@ -546,96 +619,68 @@ int main (int argc, char **argv)
 		 */
 		if (_action_ & FLAG_ACTION_UPDATE)
 		{
-			DBG(DBG_CONTROL,
-				DBG_log("Reloading config...")
-			   );
+			DBG2(DBG_APP, "Reloading config...");
 			new_cfg = confread_load(CONFIG_FILE);
 
 			if (new_cfg && (new_cfg->err + new_cfg->non_fatal_err == 0))
 			{
 				/* Switch to new config. New conn will be loaded below */
-				if (!starter_cmp_defaultroute(&new_cfg->defaultroute
-								   , &cfg->defaultroute))
-				{
-					_action_ |= FLAG_ACTION_LISTEN;
-				}
 
-				if (!starter_cmp_pluto(cfg, new_cfg))
-				{
-					plog("Pluto has changed");
-					if (starter_pluto_pid())
-						starter_stop_pluto();
-					_action_ &= ~FLAG_ACTION_LISTEN;
-					_action_ |= FLAG_ACTION_START_PLUTO;
-				}
-				else
+				/* Look for new connections that are already loaded */
+				for (conn = cfg->conn_first; conn; conn = conn->next)
 				{
-					/* Only reload conn and ca sections if pluto is not killed */
-
-					/* Look for new connections that are already loaded */
-					for (conn = cfg->conn_first; conn; conn = conn->next)
+					if (conn->state == STATE_ADDED)
 					{
-						if (conn->state == STATE_ADDED)
+						for (conn2 = new_cfg->conn_first; conn2; conn2 = conn2->next)
 						{
-							for (conn2 = new_cfg->conn_first; conn2; conn2 = conn2->next)
+							if (conn2->state == STATE_TO_ADD && starter_cmp_conn(conn, conn2))
 							{
-								if (conn2->state == STATE_TO_ADD && starter_cmp_conn(conn, conn2))
-								{
-									conn->state = STATE_REPLACED;
-									conn2->state = STATE_ADDED;
-									conn2->id = conn->id;
-									break;
-								}
+								conn->state = STATE_REPLACED;
+								conn2->state = STATE_ADDED;
+								conn2->id = conn->id;
+								break;
 							}
 						}
 					}
+				}
 
-					/* Remove conn sections that have become unused */
-					for (conn = cfg->conn_first; conn; conn = conn->next)
+				/* Remove conn sections that have become unused */
+				for (conn = cfg->conn_first; conn; conn = conn->next)
+				{
+					if (conn->state == STATE_ADDED)
 					{
-						if (conn->state == STATE_ADDED)
+						if (starter_charon_pid())
 						{
-							if (starter_charon_pid())
-							{
-								starter_stroke_del_conn(conn);
-							}
-							if (starter_pluto_pid())
-							{
-								starter_whack_del_conn(conn);
-							}
+							starter_stroke_del_conn(conn);
 						}
 					}
+				}
 
-					/* Look for new ca sections that are already loaded */
-					for (ca = cfg->ca_first; ca; ca = ca->next)
+				/* Look for new ca sections that are already loaded */
+				for (ca = cfg->ca_first; ca; ca = ca->next)
+				{
+					if (ca->state == STATE_ADDED)
 					{
-						if (ca->state == STATE_ADDED)
+						for (ca2 = new_cfg->ca_first; ca2; ca2 = ca2->next)
 						{
-							for (ca2 = new_cfg->ca_first; ca2; ca2 = ca2->next)
+							if (ca2->state == STATE_TO_ADD && starter_cmp_ca(ca, ca2))
 							{
-								if (ca2->state == STATE_TO_ADD && starter_cmp_ca(ca, ca2))
-								{
-									ca->state = STATE_REPLACED;
-									ca2->state = STATE_ADDED;
-									break;
-								}
+								ca->state = STATE_REPLACED;
+								ca2->state = STATE_ADDED;
+								break;
 							}
 						}
 					}
+				}
 
-					/* Remove ca sections that have become unused */
-					for (ca = cfg->ca_first; ca; ca = ca->next)
+				/* Remove ca sections that have become unused */
+				for (ca = cfg->ca_first; ca; ca = ca->next)
+				{
+					if (ca->state == STATE_ADDED)
 					{
-						if (ca->state == STATE_ADDED)
+						if (starter_charon_pid())
 						{
-							if (starter_charon_pid())
-							{
-								starter_stroke_del_ca(ca);
-							}
-							if (starter_pluto_pid())
-							{
-								starter_whack_del_ca(ca);
-							}
+							starter_stroke_del_ca(ca);
 						}
 					}
 				}
@@ -644,7 +689,7 @@ int main (int argc, char **argv)
 			}
 			else
 			{
-				plog("can't reload config file due to errors -- keeping old one");
+				DBG1(DBG_APP, "can't reload config file due to errors -- keeping old one");
 				if (new_cfg)
 				{
 					confread_free(new_cfg);
@@ -655,77 +700,43 @@ int main (int argc, char **argv)
 		}
 
 		/*
-		 * Start pluto
+		 * Start charon
 		 */
-		if (_action_ & FLAG_ACTION_START_PLUTO)
+		if (_action_ & FLAG_ACTION_START_CHARON)
 		{
-			if (cfg->setup.plutostart && !starter_pluto_pid())
+			if (cfg->setup.charonstart && !starter_charon_pid())
 			{
-				DBG(DBG_CONTROL,
-					DBG_log("Attempting to start pluto...")
-				   );
-
-				if (starter_start_pluto(cfg, no_fork, attach_gdb) == 0)
-				{
-					starter_whack_listen();
-				}
-				else
+				DBG2(DBG_APP, "Attempting to start charon...");
+				if (starter_start_charon(cfg, no_fork, attach_gdb))
 				{
 					/* schedule next try */
-					alarm(PLUTO_RESTART_DELAY);
+					alarm(CHARON_RESTART_DELAY);
 				}
+				starter_stroke_configure(cfg);
 			}
-			_action_ &= ~FLAG_ACTION_START_PLUTO;
+			_action_ &= ~FLAG_ACTION_START_CHARON;
 
 			for (ca = cfg->ca_first; ca; ca = ca->next)
 			{
 				if (ca->state == STATE_ADDED)
+				{
 					ca->state = STATE_TO_ADD;
+				}
 			}
 
 			for (conn = cfg->conn_first; conn; conn = conn->next)
 			{
 				if (conn->state == STATE_ADDED)
-					conn->state = STATE_TO_ADD;
-			}
-		}
-
-		/*
-		 * Start charon
-		 */
-		if (_action_ & FLAG_ACTION_START_CHARON)
-		{
-			if (cfg->setup.charonstart && !starter_charon_pid())
-			{
-				DBG(DBG_CONTROL,
-					DBG_log("Attempting to start charon...")
-				   );
-				if (starter_start_charon(cfg, no_fork, attach_gdb))
 				{
-					/* schedule next try */
-					alarm(PLUTO_RESTART_DELAY);
+					conn->state = STATE_TO_ADD;
 				}
-				starter_stroke_configure(cfg);
-			}
-			_action_ &= ~FLAG_ACTION_START_CHARON;
-		}
-
-		/*
-		 * Tell pluto to reread its interfaces
-		 */
-		if (_action_ & FLAG_ACTION_LISTEN)
-		{
-			if (starter_pluto_pid())
-			{
-				starter_whack_listen();
-				_action_ &= ~FLAG_ACTION_LISTEN;
 			}
 		}
 
 		/*
 		 * Add stale conn and ca sections
 		 */
-		if (starter_pluto_pid() || starter_charon_pid())
+		if (starter_charon_pid())
 		{
 			for (ca = cfg->ca_first; ca; ca = ca->next)
 			{
@@ -735,10 +746,6 @@ int main (int argc, char **argv)
 					{
 						starter_stroke_add_ca(ca);
 					}
-					if (starter_pluto_pid())
-					{
-						starter_whack_add_ca(ca);
-					}
 					ca->state = STATE_ADDED;
 				}
 			}
@@ -756,44 +763,20 @@ int main (int argc, char **argv)
 					{
 						starter_stroke_add_conn(cfg, conn);
 					}
-					if (starter_pluto_pid())
-					{
-						starter_whack_add_conn(conn);
-					}
 					conn->state = STATE_ADDED;
 
 					if (conn->startup == STARTUP_START)
 					{
-						if (conn->keyexchange != KEY_EXCHANGE_IKEV1)
+						if (starter_charon_pid())
 						{
-							if (starter_charon_pid())
-							{
-								starter_stroke_initiate_conn(conn);
-							}
-						}
-						else
-						{
-							if (starter_pluto_pid())
-							{
-								starter_whack_initiate_conn(conn);
-							}
+							starter_stroke_initiate_conn(conn);
 						}
 					}
 					else if (conn->startup == STARTUP_ROUTE)
 					{
-						if (conn->keyexchange != KEY_EXCHANGE_IKEV1)
-						{
-							if (starter_charon_pid())
-							{
-								starter_stroke_route_conn(conn);
-							}
-						}
-						else
+						if (starter_charon_pid())
 						{
-							if (starter_pluto_pid())
-							{
-								starter_whack_route_conn(conn);
-							}
+							starter_stroke_route_conn(conn);
 						}
 					}
 				}
@@ -807,15 +790,16 @@ int main (int argc, char **argv)
 		{
 			time_t now = time_monotonic(NULL);
 
-			tv.tv_sec = (now < last_reload + auto_update)
-					? (last_reload + auto_update-now) : 0;
-			tv.tv_usec = 0;
+			ts.tv_sec = (now < last_reload + auto_update) ?
+						(last_reload + auto_update - now) : 0;
+			ts.tv_nsec = 0;
 		}
 
 		/*
 		 * Wait for something to happen
 		 */
-		if (select(0, NULL, NULL, NULL, auto_update ? &tv : NULL) == 0)
+		if (pselect(0, NULL, NULL, NULL, auto_update ? &ts : NULL,
+					&action.sa_mask) == 0)
 		{
 			/* timeout -> auto_update */
 			_action_ |= FLAG_ACTION_UPDATE;
diff --git a/src/starter/starterstroke.c b/src/starter/starterstroke.c
index ae04c20dd..d6ad3eb89 100644
--- a/src/starter/starterstroke.c
+++ b/src/starter/starterstroke.c
@@ -1,4 +1,4 @@
-/* Stroke for charon is the counterpart to whack from pluto
+/*
  * Copyright (C) 2006 Martin Willi
  * Hochschule fuer Technik Rapperswil
  *
@@ -26,11 +26,8 @@
 
 #include <credentials/auth_cfg.h>
 
-#include <freeswan.h>
-
-#include <constants.h>
-#include <defs.h>
-#include <log.h>
+#include <library.h>
+#include <debug.h>
 
 #include <stroke_msg.h>
 
@@ -73,12 +70,12 @@ static int send_stroke_msg (stroke_msg_t *msg)
 
 	if (sock < 0)
 	{
-		plog("socket() failed: %s", strerror(errno));
+		DBG1(DBG_APP, "socket() failed: %s", strerror(errno));
 		return -1;
 	}
 	if (connect(sock, (struct sockaddr *)&ctl_addr, offsetof(struct sockaddr_un, sun_path) + strlen(ctl_addr.sun_path)) < 0)
 	{
-		plog("connect(charon_ctl) failed: %s", strerror(errno));
+		DBG1(DBG_APP, "connect(charon_ctl) failed: %s", strerror(errno));
 		close(sock);
 		return -1;
 	}
@@ -86,18 +83,18 @@ static int send_stroke_msg (stroke_msg_t *msg)
 	/* send message */
 	if (write(sock, msg, msg->length) != msg->length)
 	{
-		plog("write(charon_ctl) failed: %s", strerror(errno));
+		DBG1(DBG_APP, "write(charon_ctl) failed: %s", strerror(errno));
 		close(sock);
 		return -1;
 	}
 	while ((byte_count = read(sock, buffer, sizeof(buffer)-1)) > 0)
 	{
 		buffer[byte_count] = '\0';
-		plog("%s", buffer);
+		DBG1(DBG_APP, "%s", buffer);
 	}
 	if (byte_count < 0)
 	{
-		plog("read() failed: %s", strerror(errno));
+		DBG1(DBG_APP, "read() failed: %s", strerror(errno));
 	}
 
 	close(sock);
@@ -117,47 +114,8 @@ static char* connection_name(starter_conn_t *conn)
 	return conn->name;
 }
 
-static void ip_address2string(ip_address *addr, char *buffer, size_t len)
-{
-	switch (((struct sockaddr*)addr)->sa_family)
-	{
-		case AF_INET6:
-		{
-			struct sockaddr_in6* sin6 = (struct sockaddr_in6*)addr;
-			u_int8_t zeroes[IPV6_LEN];
-
-			memset(zeroes, 0, IPV6_LEN);
-			if (memcmp(zeroes, &(sin6->sin6_addr.s6_addr), IPV6_LEN) &&
-				inet_ntop(AF_INET6, &sin6->sin6_addr, buffer, len))
-			{
-				return;
-			}
-			snprintf(buffer, len, "%%any6");
-			break;
-		}
-		case AF_INET:
-		{
-			struct sockaddr_in* sin = (struct sockaddr_in*)addr;
-			u_int8_t zeroes[IPV4_LEN];
-
-			memset(zeroes, 0, IPV4_LEN);
-			if (memcmp(zeroes, &(sin->sin_addr.s_addr), IPV4_LEN) &&
-				inet_ntop(AF_INET, &sin->sin_addr, buffer, len))
-			{
-				return;
-			}
-			/* fall through to default */
-		}
-		default:
-			snprintf(buffer, len, "%%any");
-			break;
-	}
-}
-
 static void starter_stroke_add_end(stroke_msg_t *msg, stroke_end_t *msg_end, starter_end_t *conn_end)
 {
-	char buffer[INET6_ADDRSTRLEN];
-
 	msg_end->auth = push_string(msg, conn_end->auth);
 	msg_end->auth2 = push_string(msg, conn_end->auth2);
 	msg_end->id = push_string(msg, conn_end->id);
@@ -169,6 +127,7 @@ static void starter_stroke_add_end(stroke_msg_t *msg, stroke_end_t *msg_end, sta
 	msg_end->ca = push_string(msg, conn_end->ca);
 	msg_end->ca2 = push_string(msg, conn_end->ca2);
 	msg_end->groups = push_string(msg, conn_end->groups);
+	msg_end->groups2 = push_string(msg, conn_end->groups2);
 	msg_end->updown = push_string(msg, conn_end->updown);
 	if (conn_end->host)
 	{
@@ -176,16 +135,16 @@ static void starter_stroke_add_end(stroke_msg_t *msg, stroke_end_t *msg_end, sta
 	}
 	else
 	{
-		ip_address2string(&conn_end->addr, buffer, sizeof(buffer));
-		msg_end->address = push_string(msg, buffer);
+		msg_end->address = push_string(msg, "%any");
 	}
 	msg_end->ikeport = conn_end->ikeport;
 	msg_end->subnets = push_string(msg, conn_end->subnet);
 	msg_end->sourceip = push_string(msg, conn_end->sourceip);
-	msg_end->sourceip_mask = conn_end->sourceip_mask;
+	msg_end->dns = push_string(msg, conn_end->dns);
 	msg_end->sendcert = conn_end->sendcert;
 	msg_end->hostaccess = conn_end->hostaccess;
-	msg_end->tohost = !conn_end->has_client;
+	msg_end->tohost = !conn_end->subnet;
+	msg_end->allow_any = conn_end->allow_any;
 	msg_end->protocol = conn_end->protocol;
 	msg_end->port = conn_end->port;
 }
@@ -197,60 +156,18 @@ int starter_stroke_add_conn(starter_config_t *cfg, starter_conn_t *conn)
 	memset(&msg, 0, sizeof(msg));
 	msg.type = STR_ADD_CONN;
 	msg.length = offsetof(stroke_msg_t, buffer);
-	msg.add_conn.ikev2 = conn->keyexchange != KEY_EXCHANGE_IKEV1;
+	msg.add_conn.version = conn->keyexchange;
 	msg.add_conn.name = push_string(&msg, connection_name(conn));
-
-	/* PUBKEY is preferred to PSK and EAP */
-	if (conn->policy & POLICY_PUBKEY)
-	{
-		msg.add_conn.auth_method = AUTH_CLASS_PUBKEY;
-	}
-	else if (conn->policy & POLICY_PSK)
-	{
-		msg.add_conn.auth_method = AUTH_CLASS_PSK;
-	}
-	else if (conn->policy & POLICY_XAUTH_PSK)
-	{
-		msg.add_conn.auth_method = AUTH_CLASS_EAP;
-	}
-	else
-	{
-		msg.add_conn.auth_method = AUTH_CLASS_ANY;
-	}
-	msg.add_conn.eap_type = conn->eap_type;
-	msg.add_conn.eap_vendor = conn->eap_vendor;
 	msg.add_conn.eap_identity = push_string(&msg, conn->eap_identity);
 	msg.add_conn.aaa_identity = push_string(&msg, conn->aaa_identity);
+	msg.add_conn.xauth_identity = push_string(&msg, conn->xauth_identity);
 
-	if (conn->policy & POLICY_TUNNEL)
-	{
-		msg.add_conn.mode = MODE_TUNNEL;
-	}
-	else if (conn->policy & POLICY_BEET)
-	{
-		msg.add_conn.mode = MODE_BEET;
-	}
-	else if (conn->policy & POLICY_PROXY)
-	{
-		msg.add_conn.mode = MODE_TRANSPORT;
-		msg.add_conn.proxy_mode = TRUE;
-	}
-	else if (conn->policy & POLICY_SHUNT_PASS)
-	{
-		msg.add_conn.mode = MODE_PASS;
-	}
-	else if (conn->policy & (POLICY_SHUNT_DROP | POLICY_SHUNT_REJECT))
-	{
-		msg.add_conn.mode = MODE_DROP;
-	}
-	else
-	{
-		msg.add_conn.mode = MODE_TRANSPORT;
-	}
+	msg.add_conn.mode = conn->mode;
+	msg.add_conn.proxy_mode = conn->proxy_mode;
 
-	if (!(conn->policy & POLICY_DONT_REKEY))
+	if (!(conn->options & SA_OPTION_DONT_REKEY))
 	{
-		msg.add_conn.rekey.reauth = (conn->policy & POLICY_DONT_REAUTH) == LEMPTY;
+		msg.add_conn.rekey.reauth = !(conn->options & SA_OPTION_DONT_REAUTH);
 		msg.add_conn.rekey.ipsec_lifetime = conn->sa_ipsec_life_seconds;
 		msg.add_conn.rekey.ike_lifetime = conn->sa_ike_life_seconds;
 		msg.add_conn.rekey.margin = conn->sa_rekey_margin;
@@ -261,15 +178,17 @@ int starter_stroke_add_conn(starter_config_t *cfg, starter_conn_t *conn)
 		msg.add_conn.rekey.tries = conn->sa_keying_tries;
 		msg.add_conn.rekey.fuzz = conn->sa_rekey_fuzz;
 	}
-	msg.add_conn.mobike = (conn->policy & POLICY_MOBIKE) != 0;
-	msg.add_conn.force_encap = (conn->policy & POLICY_FORCE_ENCAP) != 0;
-	msg.add_conn.ipcomp = (conn->policy & POLICY_COMPRESS) != 0;
+	msg.add_conn.mobike = conn->options & SA_OPTION_MOBIKE;
+	msg.add_conn.force_encap = conn->options & SA_OPTION_FORCE_ENCAP;
+	msg.add_conn.ipcomp = conn->options & SA_OPTION_COMPRESS;
 	msg.add_conn.install_policy = conn->install_policy;
-	msg.add_conn.crl_policy = cfg->setup.strictcrlpolicy;
+	msg.add_conn.aggressive = conn->aggressive;
+	msg.add_conn.crl_policy = (crl_policy_t)cfg->setup.strictcrlpolicy;
 	msg.add_conn.unique = cfg->setup.uniqueids;
 	msg.add_conn.algorithms.ike = push_string(&msg, conn->ike);
 	msg.add_conn.algorithms.esp = push_string(&msg, conn->esp);
 	msg.add_conn.dpd.delay = conn->dpd_delay;
+	msg.add_conn.dpd.timeout = conn->dpd_timeout;
 	msg.add_conn.dpd.action = conn->dpd_action;
 	msg.add_conn.close_action = conn->close_action;
 	msg.add_conn.inactivity = conn->inactivity;
@@ -286,6 +205,48 @@ int starter_stroke_add_conn(starter_config_t *cfg, starter_conn_t *conn)
 	starter_stroke_add_end(&msg, &msg.add_conn.me, &conn->left);
 	starter_stroke_add_end(&msg, &msg.add_conn.other, &conn->right);
 
+	if (!msg.add_conn.me.auth && !msg.add_conn.other.auth &&
+		 conn->authby)
+	{	/* leftauth/rightauth not set, use legacy options */
+		if (streq(conn->authby, "rsa")   || streq(conn->authby, "rsasig")   ||
+			streq(conn->authby, "ecdsa") || streq(conn->authby, "ecdsasig") ||
+			streq(conn->authby, "pubkey"))
+		{
+			msg.add_conn.me.auth = push_string(&msg, "pubkey");
+			msg.add_conn.other.auth = push_string(&msg, "pubkey");
+		}
+		else if (streq(conn->authby, "secret") || streq(conn->authby, "psk"))
+		{
+			msg.add_conn.me.auth = push_string(&msg, "psk");
+			msg.add_conn.other.auth = push_string(&msg, "psk");
+		}
+		else if (streq(conn->authby, "xauthrsasig"))
+		{
+			msg.add_conn.me.auth = push_string(&msg, "pubkey");
+			msg.add_conn.other.auth = push_string(&msg, "pubkey");
+			if (conn->options & SA_OPTION_XAUTH_SERVER)
+			{
+				msg.add_conn.other.auth2 = push_string(&msg, "xauth");
+			}
+			else
+			{
+				msg.add_conn.me.auth2 = push_string(&msg, "xauth");
+			}
+		}
+		else if (streq(conn->authby, "xauthpsk"))
+		{
+			msg.add_conn.me.auth = push_string(&msg, "psk");
+			msg.add_conn.other.auth = push_string(&msg, "psk");
+			if (conn->options & SA_OPTION_XAUTH_SERVER)
+			{
+				msg.add_conn.other.auth2 = push_string(&msg, "xauth");
+			}
+			else
+			{
+				msg.add_conn.me.auth2 = push_string(&msg, "xauth");
+			}
+		}
+	}
 	return send_stroke_msg(&msg);
 }
 
diff --git a/src/starter/starterstroke.h b/src/starter/starterstroke.h
index f9b01c99a..fd2a3e320 100644
--- a/src/starter/starterstroke.h
+++ b/src/starter/starterstroke.h
@@ -1,5 +1,6 @@
-/* Stroke for charon is the counterpart to whack from pluto
- * Copyright (C) 2006 Martin Willi - Hochschule fuer Technik Rapperswil
+/*
+ * Copyright (C) 2006 Martin Willi
+ * Hochschule fuer Technik Rapperswil
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License as published by the
@@ -17,12 +18,12 @@
 
 #include "confread.h"
 
-extern int starter_stroke_add_conn(starter_config_t *cfg, starter_conn_t *conn);
-extern int starter_stroke_del_conn(starter_conn_t *conn);
-extern int starter_stroke_route_conn(starter_conn_t *conn);
-extern int starter_stroke_initiate_conn(starter_conn_t *conn);
-extern int starter_stroke_add_ca(starter_ca_t *ca);
-extern int starter_stroke_del_ca(starter_ca_t *ca);
-extern int starter_stroke_configure(starter_config_t *cfg);
+int starter_stroke_add_conn(starter_config_t *cfg, starter_conn_t *conn);
+int starter_stroke_del_conn(starter_conn_t *conn);
+int starter_stroke_route_conn(starter_conn_t *conn);
+int starter_stroke_initiate_conn(starter_conn_t *conn);
+int starter_stroke_add_ca(starter_ca_t *ca);
+int starter_stroke_del_ca(starter_ca_t *ca);
+int starter_stroke_configure(starter_config_t *cfg);
 
 #endif /* _STARTER_STROKE_H_ */
diff --git a/src/starter/starterwhack.c b/src/starter/starterwhack.c
deleted file mode 100644
index b7d916eae..000000000
--- a/src/starter/starterwhack.c
+++ /dev/null
@@ -1,420 +0,0 @@
-/* strongSwan whack functions to communicate with pluto (whack.c)
- * Copyright (C) 2001-2002 Mathieu Lafon - Arkoon Network Security
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <sys/un.h>
-#include <stddef.h>
-#include <unistd.h>
-#include <string.h>
-#include <errno.h>
-
-#include <freeswan.h>
-
-#include <constants.h>
-#include <defs.h>
-#include <log.h>
-#include <whack.h>
-
-#include "starterwhack.h"
-#include "confread.h"
-#include "files.h"
-
-#define ip_version(string)      (strchr(string, '.') ? AF_INET : AF_INET6)
-
-static int pack_str (char **p, char **next, char **roof)
-{
-	const char *s = (*p==NULL) ? "" : *p;    /* note: NULL becomes ""! */
-	size_t len = strlen(s) + 1;
-
-	if ((*roof - *next) < len)
-	{
-		return 0;       /* not enough space */
-	}
-	else
-	{
-		strcpy(*next, s);
-		*next += len;
-		*p = NULL;   /* don't send pointers on the wire! */
-		return 1;
-	}
-}
-
-static int send_whack_msg (whack_message_t *msg)
-{
-	struct sockaddr_un ctl_addr;
-	int sock;
-	ssize_t len;
-	char *str_next, *str_roof;
-
-	ctl_addr.sun_family = AF_UNIX;
-	strcpy(ctl_addr.sun_path, PLUTO_CTL_FILE);
-
-	/* pack strings */
-	str_next = (char *)msg->string;
-	str_roof = (char *)&msg->string[sizeof(msg->string)];
-
-	if (!pack_str(&msg->name,           &str_next, &str_roof)
-	||  !pack_str(&msg->left.id,        &str_next, &str_roof)
-	||  !pack_str(&msg->left.cert,      &str_next, &str_roof)
-	||  !pack_str(&msg->left.ca,        &str_next, &str_roof)
-	||  !pack_str(&msg->left.groups,    &str_next, &str_roof)
-	||  !pack_str(&msg->left.updown,    &str_next, &str_roof)
-	||  !pack_str(&msg->left.sourceip,  &str_next, &str_roof)
-	||  !pack_str(&msg->left.virt,      &str_next, &str_roof)
-	||  !pack_str(&msg->right.id,       &str_next, &str_roof)
-	||  !pack_str(&msg->right.cert,     &str_next, &str_roof)
-	||  !pack_str(&msg->right.ca,       &str_next, &str_roof)
-	||  !pack_str(&msg->right.groups,   &str_next, &str_roof)
-	||  !pack_str(&msg->right.updown,   &str_next, &str_roof)
-	||  !pack_str(&msg->right.sourceip, &str_next, &str_roof)
-	||  !pack_str(&msg->right.virt,     &str_next, &str_roof)
-	||  !pack_str(&msg->keyid,          &str_next, &str_roof)
-	||  !pack_str(&msg->myid,           &str_next, &str_roof)
-	||  !pack_str(&msg->cacert,         &str_next, &str_roof)
-	||  !pack_str(&msg->ldaphost,       &str_next, &str_roof)
-	||  !pack_str(&msg->ldapbase,       &str_next, &str_roof)
-	||  !pack_str(&msg->crluri,         &str_next, &str_roof)
-	||  !pack_str(&msg->crluri2,        &str_next, &str_roof)
-	||  !pack_str(&msg->ocspuri,        &str_next, &str_roof)
-	||  !pack_str(&msg->ike,            &str_next, &str_roof)
-	||  !pack_str(&msg->esp,            &str_next, &str_roof)
-	||  !pack_str(&msg->sc_data,        &str_next, &str_roof)
-	||  !pack_str(&msg->whack_lease_ip, &str_next, &str_roof)
-	||  !pack_str(&msg->whack_lease_id, &str_next, &str_roof)
-	||  !pack_str(&msg->xauth_identity, &str_next, &str_roof)
-	||  (str_roof - str_next < msg->keyval.len))
-	{
-		plog("send_wack_msg(): can't pack strings");
-		return -1;
-	}
-	if (msg->keyval.ptr)
-	{
-		memcpy(str_next, msg->keyval.ptr, msg->keyval.len);
-	}
-	msg->keyval.ptr = NULL;
-	str_next += msg->keyval.len;
-	len = str_next - (char *)msg;
-
-	/* connect to pluto ctl */
-	sock = socket(AF_UNIX, SOCK_STREAM, 0);
-	if (sock < 0)
-	{
-		plog("socket() failed: %s", strerror(errno));
-		return -1;
-	}
-	if (connect(sock, (struct sockaddr *)&ctl_addr,
-		offsetof(struct sockaddr_un, sun_path) + strlen(ctl_addr.sun_path)) < 0)
-	{
-		plog("connect(pluto_ctl) failed: %s", strerror(errno));
-		close(sock);
-		return -1;
-	}
-
-	/* send message */
-	if (write(sock, msg, len) != len)
-	{
-		plog("write(pluto_ctl) failed: %s", strerror(errno));
-		close(sock);
-		return -1;
-	}
-
-	/* TODO: read reply */
-	close(sock);
-	return 0;
-}
-
-static void init_whack_msg(whack_message_t *msg)
-{
-	memset(msg, 0, sizeof(whack_message_t));
-	msg->magic = WHACK_MAGIC;
-}
-
-static char *connection_name(starter_conn_t *conn, char *buf, size_t size)
-{
-	/* if connection name is '%auto', create a new name like conn_xxxxx */
-	if (streq(conn->name, "%auto"))
-	{
-		snprintf(buf, size, "conn_%ld", conn->id);
-		return buf;
-	}
-	return conn->name;
-}
-
-static void set_whack_end(whack_end_t *w, starter_end_t *end, sa_family_t family)
-{
-	w->id                  = end->id;
-	w->cert                = end->cert;
-	w->ca                  = end->ca;
-	w->groups              = end->groups;
-	w->host_addr           = end->addr;
-	w->has_client          = end->has_client;
-	w->sourceip            = end->sourceip;
-	w->sourceip_mask       = end->sourceip_mask;
-
-	if (end->sourceip && end->sourceip_mask > 0)
-	{
-		ttoaddr(end->sourceip, 0, ip_version(end->sourceip), &w->host_srcip);
-		w->has_srcip = !end->has_natip;
-	}
-	else
-	{
-		anyaddr(AF_INET, &w->host_srcip);
-	}
-
-	if (family == AF_INET6 && isanyaddr(&end->nexthop))
-	{
-		anyaddr(AF_INET6, &end->nexthop);
-	}
-	w->host_nexthop        = end->nexthop;
-
-	if (w->has_client)
-	{
-		char *pos;
-		int len = 0;
-
-		pos = strchr(end->subnet, ',');
-		if (pos)
-		{
-			len = pos - end->subnet;
-		}
-		ttosubnet(end->subnet, len, ip_version(end->subnet), &w->client);
-	}
-	else
-	{
-		if (end->has_virt)
-		{
-			w->virt = end->subnet;
-		}
-		w->client.addr.u.v4.sin_family = addrtypeof(&w->host_addr);
-	}
-
-	w->has_client_wildcard = end->has_client_wildcard;
-	w->has_port_wildcard   = end->has_port_wildcard;
-	w->has_natip           = end->has_natip;
-	w->allow_any           = end->allow_any && !end->dns_failed;
-	w->modecfg             = end->modecfg;
-	w->hostaccess          = end->hostaccess;
-	w->sendcert            = end->sendcert;
-	w->updown              = end->updown;
-	w->host_port           = IKE_UDP_PORT;
-	w->port                = end->port;
-	w->protocol            = end->protocol;
-
-	if (w->port != 0)
-	{
-		int port = htons(w->port);
-
-		setportof(port, &w->host_addr);
-		setportof(port, &w->client.addr);
-	}
-}
-
-static int
-starter_whack_add_pubkey (starter_conn_t *conn, starter_end_t *end
-, const char *lr)
-{
-	const char *err;
-	static char keyspace[1024 + 4];
-	char buf[ADDRTOT_BUF], name[32];
-	whack_message_t msg;
-
-	init_whack_msg(&msg);
-	connection_name(conn, name, sizeof(name));
-
-	msg.whack_key = TRUE;
-	msg.pubkey_alg = PUBKEY_ALG_RSA;
-	if (end->rsakey)
-	{
-		/* special values to ignore */
-		if (streq(end->rsakey, "")
-		||  streq(end->rsakey, "%none")
-		||  streq(end->rsakey, "%cert")
-		||  streq(end->rsakey, "0x00"))
-		{
-			return 0;
-		}
-		err = atobytes(end->rsakey, 0, keyspace, sizeof(keyspace), &msg.keyval.len);
-		if (err)
-		{
-			plog("conn %s/%s: rsakey malformed [%s]", name, lr, err);
-			return 1;
-		}
-		if (end->id)
-		{
-			msg.keyid = end->id;
-		}
-		else
-		{
-			addrtot(&end->addr, 0, buf, sizeof(buf));
-			msg.keyid = buf;
-		}
-		msg.keyval.ptr = keyspace;
-		return send_whack_msg(&msg);
-	}
-	return 0;
-}
-
-int starter_whack_add_conn(starter_conn_t *conn)
-{
-	char esp_buf[256], name[32];
-	whack_message_t msg;
-	int r;
-
-	init_whack_msg(&msg);
-
-	msg.whack_connection = TRUE;
-	msg.name = connection_name(conn, name, sizeof(name));
-
-	msg.ikev1                 = conn->keyexchange == KEY_EXCHANGE_IKEV1;
-	msg.addr_family           = conn->addr_family;
-	msg.tunnel_addr_family    = conn->tunnel_addr_family;
-	msg.sa_ike_life_seconds   = conn->sa_ike_life_seconds;
-	msg.sa_ipsec_life_seconds = conn->sa_ipsec_life_seconds;
-	msg.sa_rekey_margin       = conn->sa_rekey_margin;
-	msg.sa_rekey_fuzz         = conn->sa_rekey_fuzz;
-	msg.sa_keying_tries       = conn->sa_keying_tries;
-	msg.policy                = conn->policy;
-	msg.xauth_identity        = conn->xauth_identity;
-	msg.reqid                 = conn->reqid;
-	msg.mark_in.value         = conn->mark_in.value;
-	msg.mark_in.mask          = conn->mark_in.mask;
-	msg.mark_out.value        = conn->mark_out.value;
-	msg.mark_out.mask         = conn->mark_out.mask;
-
-	/*
-	 * Make sure the IKEv2-only policy bits are unset for IKEv1 connections
-	 */
-	msg.policy &= ~POLICY_DONT_REAUTH;
-	msg.policy &= ~POLICY_BEET;
-	msg.policy &= ~POLICY_MOBIKE;
-	msg.policy &= ~POLICY_FORCE_ENCAP;
-
-	set_whack_end(&msg.left, &conn->left, conn->addr_family);
-	set_whack_end(&msg.right, &conn->right, conn->addr_family);
-
-	msg.esp = conn->esp;
-	msg.ike = conn->ike;
-	msg.pfsgroup = conn->pfsgroup;
-
-	/* taken from pluto/whack.c */
-	if (msg.pfsgroup)
-	{
-		snprintf(esp_buf, sizeof (esp_buf), "%s;%s"
-				   , msg.esp ? msg.esp : ""
-				   , msg.pfsgroup ? msg.pfsgroup : "");
-		msg.esp = esp_buf;
-
-		DBG(DBG_CONTROL,
-			DBG_log("Setting --esp=%s", msg.esp)
-		)
-	}
-	msg.dpd_delay   = conn->dpd_delay;
-	msg.dpd_timeout = conn->dpd_timeout;
-	msg.dpd_action  = conn->dpd_action;
-/*  msg.dpd_count = conn->dpd_count; not supported yet by strongSwan */
-
-	r =  send_whack_msg(&msg);
-
-	if (r == 0 && (conn->policy & POLICY_PUBKEY))
-	{
-		r += starter_whack_add_pubkey (conn, &conn->left, "left");
-		r += starter_whack_add_pubkey (conn, &conn->right, "right");
-	}
-
-	return r;
-}
-
-int starter_whack_del_conn(starter_conn_t *conn)
-{
-	char name[32];
-	whack_message_t msg;
-
-	init_whack_msg(&msg);
-	msg.whack_delete = TRUE;
-	msg.name = connection_name(conn, name, sizeof(name));
-	return send_whack_msg(&msg);
-}
-
-int starter_whack_route_conn(starter_conn_t *conn)
-{
-	char name[32];
-	whack_message_t msg;
-
-	init_whack_msg(&msg);
-	msg.whack_route = TRUE;
-	msg.name = connection_name(conn, name, sizeof(name));
-	return send_whack_msg(&msg);
-}
-
-int starter_whack_initiate_conn(starter_conn_t *conn)
-{
-	char name[32];
-	whack_message_t msg;
-
-	init_whack_msg(&msg);
-	msg.whack_initiate = TRUE;
-	msg.whack_async = TRUE;
-	msg.name = connection_name(conn, name, sizeof(name));
-	return send_whack_msg(&msg);
-}
-
-int starter_whack_listen(void)
-{
-	whack_message_t msg;
-	init_whack_msg(&msg);
-	msg.whack_listen = TRUE;
-	return send_whack_msg(&msg);
-}
-
-int starter_whack_shutdown(void)
-{
-	whack_message_t msg;
-
-	init_whack_msg(&msg);
-	msg.whack_shutdown = TRUE;
-	return send_whack_msg(&msg);
-}
-
-int starter_whack_add_ca(starter_ca_t *ca)
-{
-	whack_message_t msg;
-
-	init_whack_msg(&msg);
-
-	msg.whack_ca     = TRUE;
-	msg.name         = ca->name;
-	msg.cacert       = ca->cacert;
-	msg.ldaphost     = ca->ldaphost;
-	msg.ldapbase     = ca->ldapbase;
-	msg.crluri       = ca->crluri;
-	msg.crluri2      = ca->crluri2;
-	msg.ocspuri      = ca->ocspuri;
-	msg.whack_strict = ca->strict;
-
-	return send_whack_msg(&msg);
-}
-
-int starter_whack_del_ca(starter_ca_t *ca)
-{
-	whack_message_t msg;
-
-	init_whack_msg(&msg);
-
-	msg.whack_delete = TRUE;
-	msg.whack_ca     = TRUE;
-	msg.name         = ca->name;
-
-	return send_whack_msg(&msg);
-}
diff --git a/src/starter/starterwhack.h b/src/starter/starterwhack.h
deleted file mode 100644
index d56b02421..000000000
--- a/src/starter/starterwhack.h
+++ /dev/null
@@ -1,30 +0,0 @@
-/* FreeS/WAN whack functions to communicate with pluto (whack.h)
- * Copyright (C) 2001-2002 Mathieu Lafon - Arkoon Network Security
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#ifndef _STARTER_WHACK_H_
-#define _STARTER_WHACK_H_
-
-#include "confread.h"
-
-extern int starter_whack_add_conn(starter_conn_t *conn);
-extern int starter_whack_del_conn(starter_conn_t *conn);
-extern int starter_whack_route_conn(starter_conn_t *conn);
-extern int starter_whack_initiate_conn(starter_conn_t *conn);
-extern int starter_whack_listen(void);
-extern int starter_whack_shutdown(void);
-extern int starter_whack_add_ca(starter_ca_t *ca);
-extern int starter_whack_del_ca(starter_ca_t *ca);
-
-#endif /* _STARTER_WHACK_H_ */
-