merged the modularization branch (credentials) back to trunk

2008-03-13 14:14:44 +00:00
parent 2df655134c
commit 552cc11b1f
495 changed files with 30378 additions and 23843 deletions
@@ -70,12 +70,12 @@ WARN_LOGFILE =
 #---------------------------------------------------------------------------
 # configuration options related to the input files
 #---------------------------------------------------------------------------
-INPUT = src/libstrongswan src/charon
+INPUT = src/libstrongswan src/charon src/libfast src/manager
 FILE_PATTERNS = *.h
 RECURSIVE = YES
 EXCLUDE = 
 EXCLUDE_SYMLINKS = NO
-EXCLUDE_PATTERNS = 
+EXCLUDE_PATTERNS = */.svn/*
 EXAMPLE_PATH = 
 EXAMPLE_PATTERNS = 
 EXAMPLE_RECURSIVE = NO
@@ -72,6 +72,7 @@ AC_ARG_WITH(
    [AC_SUBST(ipsecdir, "$withval")],
    [AC_SUBST(ipsecdir, "${libexecdir}/ipsec")]
 )
 AC_SUBST(plugindir, "${ipsecdir}/plugins")
 AC_ARG_WITH(
    [plugindir],
@@ -80,32 +81,11 @@ AC_ARG_WITH(
    [AC_SUBST(plugindir, "${ipsecdir}/plugins")]
 )
 AC_ARG_WITH(
    [eapdir],
    AS_HELP_STRING([--with-eapdir=dir],[path for pluggable EAP modules other than "plugindir/eap"]),
    [AC_SUBST(eapdir, "$withval")],
    [AC_SUBST(eapdir, "${plugindir}/eap")]
 )
 AC_ARG_WITH(
    [backenddir],
    AS_HELP_STRING([--with-backenddir=dir],[path for pluggable configuration backend modules other than "plugindir/backends"]),
    [AC_SUBST(backenddir, "$withval")],
    [AC_SUBST(backenddir, "${plugindir}/backends")]
 )
 AC_ARG_WITH(
    [interfacedir],
    AS_HELP_STRING([--with-interfacedir=dir],[path for pluggable control interface modules other than "plugindir/interfaces"]),
    [AC_SUBST(interfacedir, "$withval")],
    [AC_SUBST(interfacedir, "${plugindir}/interfaces")]
 )
 AC_ARG_WITH(
    [sim-reader],
    AS_HELP_STRING([--with-sim-reader=library.so],[library containing the sim_run_alg()/sim_get_triplet() function for EAP-SIM]),
    [AC_SUBST(simreader, "$withval")],
-    [AC_SUBST(simreader, "${plugindir}/libcharon-eapsim-file.so")]
+    [AC_SUBST(simreader, "${plugindir}/libeapsim-file.so")]
 )
 AC_ARG_WITH(
@@ -144,24 +124,148 @@ AC_ARG_WITH(
 )
 AC_ARG_ENABLE(
-    [http],
+    [curl],
-    AS_HELP_STRING([--enable-http],[enable OCSP and fetching of Certificates and CRLs over HTTP (default is NO). Requires libcurl.]),
+    AS_HELP_STRING([--enable-curl],[enable CURL fetcher plugin to fetch files via libcurl (default is NO). Requires libcurl.]),
    [if test x$enableval = xyes; then
-        http=true
+        curl=true
        AC_DEFINE(LIBCURL)
    fi]
 )
-AM_CONDITIONAL(USE_LIBCURL, test x$http = xtrue)
+AM_CONDITIONAL(USE_CURL, test x$curl = xtrue)
 AC_ARG_ENABLE(
    [ldap],
-    AS_HELP_STRING([--enable-ldap],[enable fetching of CRLs from LDAP (default is NO). Requires openLDAP.]),
+    AS_HELP_STRING([--enable-ldap],[enable LDAP fetching plugin to fetch files via libldap (default is NO). Requires openLDAP.]),
    [if test x$enableval = xyes; then
        ldap=true
        AC_DEFINE(LIBLDAP)
    fi]
 )
-AM_CONDITIONAL(USE_LIBLDAP, test x$ldap = xtrue)
+AM_CONDITIONAL(USE_LDAP, test x$ldap = xtrue)
 AC_ARG_ENABLE(
    [aes],
    AS_HELP_STRING([--disable-aes],[disable own AES software implementation plugin. (default is NO).]),
    [if test x$enableval = xyes; then
        aes=true
     else
        aes=false
    fi],
    aes=true
 )
 AM_CONDITIONAL(USE_AES, test x$aes = xtrue)
 AC_ARG_ENABLE(
    [des],
    AS_HELP_STRING([--disable-des],[disable own DES/3DES software implementation plugin. (default is NO).]),
    [if test x$enableval = xyes; then
        des=true
     else
        des=false
    fi],
    des=true
 )
 AM_CONDITIONAL(USE_DES, test x$des = xtrue)
 AC_ARG_ENABLE(
    [md5],
    AS_HELP_STRING([--disable-md5],[disable own MD5 software implementation plugin. (default is NO).]),
    [if test x$enableval = xyes; then
        md5=true
     else
        md5=false
    fi],
    md5=true
 )
 AM_CONDITIONAL(USE_MD5, test x$md5 = xtrue)
 AC_ARG_ENABLE(
    [sha1],
    AS_HELP_STRING([--disable-sha1],[disable own SHA1 software implementation plugin. (default is NO).]),
    [if test x$enableval = xyes; then
        sha1=true
     else
        sha1=false
    fi],
    sha1=true
 )
 AM_CONDITIONAL(USE_SHA1, test x$sha1 = xtrue)
 AC_ARG_ENABLE(
    [sha2],
    AS_HELP_STRING([--disable-sha2],[disable own SHA256/SHA384/SHA512 software implementation plugin. (default is NO).]),
    [if test x$enableval = xyes; then
        sha2=true
     else
        sha2=false
    fi],
    sha2=true
 )
 AM_CONDITIONAL(USE_SHA2, test x$sha2 = xtrue)
 AC_ARG_ENABLE(
    [fips-prf],
    AS_HELP_STRING([--disable-fips-prf],[disable FIPS PRF software implementation plugin. (default is NO).]),
    [if test x$enableval = xyes; then
        fips_prf=true
     else
        fips_prf=false
    fi],
    fips_prf=true
 )
 AM_CONDITIONAL(USE_FIPS_PRF, test x$fips_prf = xtrue)
 AC_ARG_ENABLE(
    [gmp],
    AS_HELP_STRING([--disable-gmp],[disable own GNU MP (libgmp) based crypto implementation plugin. (default is NO).]),
    [if test x$enableval = xyes; then
        gmp=true
     else
        gmp=false
    fi],
    gmp=true
 )
 AM_CONDITIONAL(USE_GMP, test x$gmp = xtrue)
 AC_ARG_ENABLE(
    [x509],
    AS_HELP_STRING([--disable-x509],[disable own X509 certificate implementation plugin. (default is NO).]),
    [if test x$enableval = xyes; then
        x509=true
     else
        x509=false
    fi],
    x509=true
 )
 AM_CONDITIONAL(USE_X509, test x$x509 = xtrue)
 AC_ARG_ENABLE(
    [hmac],
    AS_HELP_STRING([--disable-hmac],[disable HMAC crypto implementation plugin. (default is NO).]),
    [if test x$enableval = xyes; then
        hmac=true
     else
        hmac=false
    fi],
    hmac=true
 )
 AM_CONDITIONAL(USE_HMAC, test x$hmac = xtrue)
 AC_ARG_ENABLE(
    [mysql],
    AS_HELP_STRING([--enable-mysql],[enable MySQL database support (default is NO). Requires libmysqlclient_r.]),
    [if test x$enableval = xyes; then
        mysql=true
    fi]
 )
 AM_CONDITIONAL(USE_MYSQL, test x$mysql = xtrue)
 AC_ARG_ENABLE(
    [sqlite],
    AS_HELP_STRING([--enable-sqlite],[enable SQLite database support (default is NO). Requires libsqlite3.]),
    [if test x$enableval = xyes; then
        sqlite=true
    fi]
 )
 AM_CONDITIONAL(USE_SQLITE, test x$sqlite = xtrue)
 AC_ARG_ENABLE(
    [stroke],
@@ -175,6 +279,16 @@ AC_ARG_ENABLE(
 )
 AM_CONDITIONAL(USE_STROKE, test x$stroke = xtrue)
 AC_ARG_ENABLE(
    [med-db],
    AS_HELP_STRING([--enable-med-db],[enable MySQL mediation database plugin (default is NO).]),
    [if test x$enableval = xyes; then
        med_db=true
        AC_DEFINE(LIBDBUS)
    fi]
 )
 AM_CONDITIONAL(USE_MED_DB, test x$med_db = xtrue)
 AC_ARG_ENABLE(
    [dbus],
    AS_HELP_STRING([--enable-dbus],[enable DBUS configuration and control interface (default is NO). Requires libdbus.]),
@@ -196,14 +310,13 @@ AC_ARG_ENABLE(
 AM_CONDITIONAL(USE_LIBXML, test x$xml = xtrue)
 AC_ARG_ENABLE(
-    [sqlite],
+    [sql],
-    AS_HELP_STRING([--enable-sqlite],[enable SQLite configuration backend (default is NO). Requires libsqlite3.]),
+    AS_HELP_STRING([--enable-sql],[enable SQL database configuration backend (default is NO).]),
    [if test x$enableval = xyes; then
-        sqlite=true
+        sql=true
        AC_DEFINE(LIBSQLITE)
    fi]
 )
-AM_CONDITIONAL(USE_LIBSQLITE, test x$sqlite = xtrue)
+AM_CONDITIONAL(USE_SQL, test x$sql = xtrue)
 AC_ARG_ENABLE(
    [smartcard],
@@ -233,6 +346,15 @@ AC_ARG_ENABLE(
 )
 AM_CONDITIONAL(USE_LEAK_DETECTIVE, test x$leak_detective = xtrue)
 AC_ARG_ENABLE(
    [unit-tests],
    AS_HELP_STRING([--enable-unit-tests],[enable unit tests on IKEv2 daemon startup (default is NO).]),
    [if test x$enableval = xyes; then
        unittest=true
    fi]
 )
 AM_CONDITIONAL(USE_UNIT_TESTS, test x$unittest = xtrue)
 AC_ARG_ENABLE(
    [eap-sim],
    AS_HELP_STRING([--enable-eap-sim],[build SIM authenication module for EAP (default is NO).]),
@@ -311,6 +433,15 @@ AC_ARG_ENABLE(
 )
 AM_CONDITIONAL(USE_UML, test x$uml = xtrue)
 AC_ARG_ENABLE(
    [fast],
    AS_HELP_STRING([--enable-fast],[build libfast (FastCGI Application Server w/ templates (default is NO).]),
    [if test x$enableval = xyes; then
        fast=true
    fi]
 )
 AM_CONDITIONAL(USE_FAST, test x$fast = xtrue)
 AC_ARG_ENABLE(
    [manager],
    AS_HELP_STRING([--enable-manager],[build web management console (default is NO).]),
@@ -409,7 +540,10 @@ dnl ==========================
 dnl  check required libraries
 dnl ==========================
 AC_HAVE_LIBRARY(dl)
 AC_CHECK_FUNCS(backtrace)
 AC_CHECK_FUNCS(dladdr)
 AC_CHECK_FUNCS(getifaddrs)
 AC_HAVE_LIBRARY([gmp],[LIBS="$LIBS"],[AC_MSG_ERROR([GNU Multi Precision library gmp not found])])	
@@ -417,8 +551,8 @@ if test "$ldap" = "true"; then
    AC_HAVE_LIBRARY([ldap],[LIBS="$LIBS"],[AC_MSG_ERROR([LDAP enabled, but library ldap not found])])
    AC_HAVE_LIBRARY([lber],[LIBS="$LIBS"],[AC_MSG_ERROR([LDAP enabled, but library lber not found])])
 fi
-if test "$http" = "true"; then
+if test "$curl" = "true"; then
-    AC_HAVE_LIBRARY([curl],[LIBS="$LIBS"],[AC_MSG_ERROR([HTTP enabled, but library curl not found])])
+    AC_HAVE_LIBRARY([curl],[LIBS="$LIBS"],[AC_MSG_ERROR([CURL enabled, but library curl not found])])
 fi
 if test "$xml" = "true"; then
@@ -460,8 +594,8 @@ AC_TRY_COMPILE(
 if test "$ldap" = "true"; then
    AC_CHECK_HEADER([ldap.h],,[AC_MSG_ERROR([LDAP enabled, but ldap.h not found!])])
 fi
-if test "$http" = "true"; then
+if test "$curl" = "true"; then
-    AC_CHECK_HEADER([curl/curl.h],,[AC_MSG_ERROR([HTTP enabled, but curl.h not found!])])
+    AC_CHECK_HEADER([curl/curl.h],,[AC_MSG_ERROR([CURL enabled, but curl.h not found!])])
 fi
 dnl ==============================
@@ -473,11 +607,34 @@ AC_OUTPUT(
 	src/Makefile
 	src/include/Makefile
 	src/libstrongswan/Makefile
 	src/libstrongswan/plugins/aes/Makefile
 	src/libstrongswan/plugins/des/Makefile
 	src/libstrongswan/plugins/md5/Makefile
 	src/libstrongswan/plugins/sha1/Makefile
 	src/libstrongswan/plugins/sha2/Makefile
 	src/libstrongswan/plugins/fips_prf/Makefile
 	src/libstrongswan/plugins/gmp/Makefile
 	src/libstrongswan/plugins/hmac/Makefile
 	src/libstrongswan/plugins/x509/Makefile
 	src/libstrongswan/plugins/curl/Makefile
 	src/libstrongswan/plugins/ldap/Makefile
 	src/libstrongswan/plugins/mysql/Makefile
 	src/libstrongswan/plugins/sqlite/Makefile
 	src/libcrypto/Makefile
 	src/libfreeswan/Makefile
 	src/pluto/Makefile
 	src/whack/Makefile
 	src/charon/Makefile
 	src/charon/plugins/eap_aka/Makefile
 	src/charon/plugins/eap_identity/Makefile
 	src/charon/plugins/eap_md5/Makefile
 	src/charon/plugins/eap_sim/Makefile
 	src/charon/plugins/dbus/Makefile
 	src/charon/plugins/xml/Makefile
 	src/charon/plugins/sql/Makefile
 	src/charon/plugins/med_db/Makefile
 	src/charon/plugins/stroke/Makefile
 	src/charon/plugins/unit_tester/Makefile
 	src/stroke/Makefile
 	src/ipsec/Makefile
 	src/starter/Makefile
@@ -487,6 +644,7 @@ AC_OUTPUT(
 	src/openac/Makefile
 	src/scepclient/Makefile
 	src/dumm/Makefile
 	src/libfast/Makefile
 	src/manager/Makefile
 	testing/Makefile
 )
@@ -1,4 +1,4 @@
 #!/bin/bash
 CFLAGS="-Wall -Wno-format -Wno-pointer-sign -Wno-strict-aliasing -g -O2" ./configure \
--sysconfdir=/etc --with-random-device=/dev/urandom \
+--sysconfdir=/etc --disable-tools --disable-pluto --enable-leak-detective --with-random-device=/dev/urandom \
--enable-leak-detective
+$1 $2 $3 $4 $5
@@ -31,6 +31,10 @@ if USE_UML
  SUBDIRS += dumm
 endif
 if USE_FAST
  SUBDIRS += libfast
 endif
 if USE_MANAGER
  SUBDIRS += manager
 endif
@@ -4,16 +4,13 @@ charon_SOURCES = \
 bus/bus.c bus/bus.h \
 bus/listeners/file_logger.c bus/listeners/file_logger.h \
 bus/listeners/sys_logger.c bus/listeners/sys_logger.h \
-config/backends/backend.h config/backends/writeable_backend.h \
+config/backend_manager.c config/backend_manager.h config/backend.h \
 config/backend_manager.c config/backend_manager.h \
 config/child_cfg.c config/child_cfg.h \
 config/credentials/local_credential_store.c config/credentials/local_credential_store.h \
 config/ike_cfg.c config/ike_cfg.h \
 config/peer_cfg.c config/peer_cfg.h \
 config/proposal.c config/proposal.h \
 config/traffic_selector.c config/traffic_selector.h \
-control/interfaces/interface.h \
+control/controller.c control/controller.h \
 control/interface_manager.c control/interface_manager.h \
 daemon.c daemon.h \
 encoding/generator.c encoding/generator.h \
 encoding/message.c encoding/message.h \
@@ -63,6 +60,7 @@ processing/processor.c processing/processor.h  \
 sa/authenticators/authenticator.c sa/authenticators/authenticator.h \
 sa/authenticators/eap_authenticator.c sa/authenticators/eap_authenticator.h \
 sa/authenticators/eap/eap_method.c sa/authenticators/eap/eap_method.h \
 sa/authenticators/eap/eap_manager.c sa/authenticators/eap/eap_manager.h \
 sa/authenticators/psk_authenticator.c sa/authenticators/psk_authenticator.h \
 sa/authenticators/rsa_authenticator.c sa/authenticators/rsa_authenticator.h \
 sa/child_sa.c sa/child_sa.h \
@@ -74,7 +72,8 @@ sa/tasks/child_create.c sa/tasks/child_create.h \
 sa/tasks/child_delete.c sa/tasks/child_delete.h \
 sa/tasks/child_rekey.c sa/tasks/child_rekey.h \
 sa/tasks/ike_auth.c sa/tasks/ike_auth.h \
-sa/tasks/ike_cert.c sa/tasks/ike_cert.h \
+sa/tasks/ike_cert_pre.c sa/tasks/ike_cert_pre.h \
 sa/tasks/ike_cert_post.c sa/tasks/ike_cert_post.h \
 sa/tasks/ike_config.c sa/tasks/ike_config.h \
 sa/tasks/ike_delete.c sa/tasks/ike_delete.h \
 sa/tasks/ike_dpd.c sa/tasks/ike_dpd.h \
@@ -84,7 +83,10 @@ sa/tasks/ike_mobike.c sa/tasks/ike_mobike.h \
 sa/tasks/ike_rekey.c sa/tasks/ike_rekey.h \
 sa/tasks/ike_reauth.c sa/tasks/ike_reauth.h \
 sa/tasks/ike_auth_lifetime.c sa/tasks/ike_auth_lifetime.h \
-sa/tasks/task.c sa/tasks/task.h
+sa/tasks/task.c sa/tasks/task.h \
 credentials/credential_manager.c credentials/credential_manager.h \
 credentials/auth_info.c credentials/auth_info.h \
 credentials/credential_set.h
 # Use RAW socket if pluto gets built
 if USE_PLUTO
@@ -102,89 +104,53 @@ if USE_P2P
    sa/tasks/ike_p2p.c sa/tasks/ike_p2p.h
 endif
-INCLUDES = -I${linuxdir} -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon -I$(top_srcdir)/src/stroke
+INCLUDES = -I${linuxdir} -I$(top_srcdir)/src/libstrongswan -I$(top_srcdir)/src/charon
-AM_CFLAGS = -rdynamic -DIPSEC_CONFDIR=\"${confdir}\" -DIPSEC_DIR=\"${ipsecdir}\" -DIPSEC_PIDDIR=\"${piddir}\" \
+AM_CFLAGS = -rdynamic -DIPSEC_DIR=\"${ipsecdir}\" \
-	-DIPSEC_EAPDIR=\"${eapdir}\" -DIPSEC_BACKENDDIR=\"${backenddir}\" -DIPSEC_INTERFACEDIR=\"${interfacedir}\" \
+	-DIPSEC_PIDDIR=\"${piddir}\" -DIPSEC_PLUGINDIR=\"${plugindir}\"
-	-DSIM_READER_LIB=\"${simreader}\"
+charon_LDADD = $(top_builddir)/src/libstrongswan/libstrongswan.la -lpthread -lm -ldl
 charon_LDADD = $(top_builddir)/src/libstrongswan/libstrongswan.la -lgmp -lpthread -lm -ldl
-if USE_LIBCURL
+# build optional plugins
-  charon_LDADD += -lcurl
+########################
 SUBDIRS = 
 if USE_UNIT_TESTS
  SUBDIRS += plugins/unit_tester
 endif
 # build EAP plugins
 ###################
 eap_LTLIBRARIES =
 if USE_EAP_IDENTITY
  eap_LTLIBRARIES += libcharon-eapidentity.la
  libcharon_eapidentity_la_SOURCES = sa/authenticators/eap/eap_identity.h sa/authenticators/eap/eap_identity.c
  libcharon_eapidentity_la_LDFLAGS = -module
 endif
 if USE_EAP_SIM
  eap_LTLIBRARIES += libcharon-eapsim.la
  libcharon_eapsim_la_SOURCES = sa/authenticators/eap/eap_sim.h sa/authenticators/eap/eap_sim.c
  libcharon_eapsim_la_LDFLAGS = -module
  plugin_LTLIBRARIES = libcharon-eapsim-file.la
  libcharon_eapsim_file_la_SOURCES = sa/authenticators/eap/sim/eap_sim_file.c
  libcharon_eapsim_file_la_LDFLAGS = -module
 endif
 if USE_EAP_MD5
  eap_LTLIBRARIES += libcharon-eapmd5.la
  libcharon_eapmd5_la_SOURCES = sa/authenticators/eap/eap_md5.h sa/authenticators/eap/eap_md5.c
  libcharon_eapmd5_la_LDFLAGS = -module
 endif
 if USE_EAP_AKA
  eap_LTLIBRARIES += libcharon-eapaka.la
  libcharon_eapaka_la_SOURCES = sa/authenticators/eap/eap_aka.h sa/authenticators/eap/eap_aka.c
  libcharon_eapaka_la_LDFLAGS = -module
 endif
 # build backends
 ################
 backend_LTLIBRARIES =
 if USE_STROKE
-  backend_LTLIBRARIES += libcharon-local.la
+  SUBDIRS += plugins/stroke
  libcharon_local_la_SOURCES = config/backends/local_backend.h config/backends/local_backend.c
  libcharon_local_la_LDFLAGS = -module
 endif
 if USE_LIBSQLITE
  backend_LTLIBRARIES += libcharon-sqlite.la
  libcharon_sqlite_la_SOURCES = config/backends/sqlite_backend.h config/backends/sqlite_backend.c
  libcharon_sqlite_la_LIBADD = -lsqlite3
  libcharon_sqlite_la_LDFLAGS = -module
 endif
 # build control interfaces
 ##########################
 interface_LTLIBRARIES =
 if USE_STROKE
  interface_LTLIBRARIES += libcharon-stroke.la
  libcharon_stroke_la_SOURCES = control/interfaces/stroke_interface.h control/interfaces/stroke_interface.c
  libcharon_stroke_la_LDFLAGS = -module
 endif
 if USE_LIBDBUS
-  interface_LTLIBRARIES += libcharon-dbus.la
+  SUBDIRS += plugins/dbus
  libcharon_dbus_la_SOURCES = control/interfaces/dbus_interface.h control/interfaces/dbus_interface.c
  libcharon_dbus_la_LDFLAGS = -module
  libcharon_dbus_la_LIBADD = ${dbus_LIBS}
  INCLUDES += ${dbus_CFLAGS}
 endif
 if USE_LIBXML
-  interface_LTLIBRARIES += libcharon-xml.la
+  SUBDIRS += plugins/xml
-  libcharon_xml_la_SOURCES = control/interfaces/xml_interface.h control/interfaces/xml_interface.c
+endif
-  libcharon_xml_la_LDFLAGS = -module
+
-  libcharon_xml_la_LIBADD = ${xml_LIBS}
+if USE_SQL
-  INCLUDES += ${xml_CFLAGS}
+  SUBDIRS += plugins/sql
 endif
 if USE_EAP_IDENTITY
  SUBDIRS += plugins/eap_identity
 endif
 if USE_EAP_SIM
  SUBDIRS += plugins/eap_sim
 endif
 if USE_EAP_MD5
  SUBDIRS += plugins/eap_md5
 endif
 if USE_EAP_AKA
  SUBDIRS += plugins/eap_aka
 endif
 if USE_MED_DB
  SUBDIRS += plugins/med_db
 endif
@@ -1,10 +1,3 @@
 /**
 * @file bus.c
 *
 * @brief Implementation of bus_t.
 *
 */
 /*
 * Copyright (C) 2006 Martin Willi
 * Hochschule fuer Technik Rapperswil
@@ -18,6 +11,8 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include "bus.h"
@@ -25,6 +20,7 @@
 #include <pthread.h>
 #include <daemon.h>
 #include <utils/mutex.h>
 ENUM(signal_names, SIG_ANY, SIG_MAX,
 	/** should not get printed */
@@ -72,9 +68,9 @@ struct private_bus_t {
 	linked_list_t *listeners;
 	/**
-	 * mutex to synchronize active listeners
+	 * mutex to synchronize active listeners, recursively
 	 */
-	pthread_mutex_t mutex;
+	mutex_t *mutex;
 	/**
 	 * Thread local storage for a unique, simple thread ID
@@ -107,7 +103,7 @@ struct entry_t {
 	/**
 	 * condvar where active listeners wait
 	 */
-	pthread_cond_t cond;
+	condvar_t *condvar;
 };
 /**
@@ -119,11 +115,20 @@ static entry_t *entry_create(bus_listener_t *listener, bool blocker)
 	this->listener = listener;
 	this->blocker = blocker;
-	pthread_cond_init(&this->cond, NULL);
+	this->condvar = condvar_create(CONDVAR_DEFAULT);
 	return this;
 }
 /**
 * destroy an entry_t
 */
 static void entry_destroy(entry_t *entry)
 {
 	entry->condvar->destroy(entry->condvar);
 	free(entry);
 }
 /**
 * Get a unique thread number for a calling thread. Since
 * pthread_self returns large and ugly numbers, use this function
@@ -151,9 +156,9 @@ static int get_thread_number(private_bus_t *this)
 */
 static void add_listener(private_bus_t *this, bus_listener_t *listener)
 {
-	pthread_mutex_lock(&this->mutex);
+	this->mutex->lock(this->mutex);
 	this->listeners->insert_last(this->listeners, entry_create(listener, FALSE));
-	pthread_mutex_unlock(&this->mutex);
+	this->mutex->unlock(this->mutex);
 }
 /**
@@ -164,19 +169,19 @@ static void remove_listener(private_bus_t *this, bus_listener_t *listener)
 	iterator_t *iterator;
 	entry_t *entry;
-	pthread_mutex_lock(&this->mutex);
+	this->mutex->lock(this->mutex);
 	iterator = this->listeners->create_iterator(this->listeners, TRUE);
 	while (iterator->iterate(iterator, (void**)&entry))
 	{
 		if (entry->listener == listener)
 		{
 			iterator->remove(iterator);
-			free(entry);
+			entry_destroy(entry);
 			break;
 		}
 	}
 	iterator->destroy(iterator);
-	pthread_mutex_unlock(&this->mutex);
+	this->mutex->unlock(this->mutex);
 }
 typedef struct cleanup_data_t cleanup_data_t;
@@ -205,7 +210,7 @@ static void listener_cleanup(cleanup_data_t *data)
 		if (entry == data->entry)
 		{
 			iterator->remove(iterator);
-			free(entry);
+			entry_destroy(entry);
 			break;
 		}
 	}
@@ -223,21 +228,21 @@ static void listen_(private_bus_t *this, bus_listener_t *listener, job_t *job)
 	data.this = this;
 	data.entry = entry_create(listener, TRUE);
-	pthread_mutex_lock(&this->mutex);
+	this->mutex->lock(this->mutex);
 	this->listeners->insert_last(this->listeners, data.entry);
 	charon->processor->queue_job(charon->processor, job);
-	pthread_cleanup_push((void*)pthread_mutex_unlock, &this->mutex);
+	pthread_cleanup_push((void*)this->mutex->unlock, this->mutex);
 	pthread_cleanup_push((void*)listener_cleanup, &data);
 	pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &old);
 	while (data.entry->blocker)
 	{
-		pthread_cond_wait(&data.entry->cond, &this->mutex);
+		data.entry->condvar->wait(data.entry->condvar, this->mutex);
 	}
 	pthread_setcancelstate(old, NULL);
 	pthread_cleanup_pop(FALSE);
 	/* unlock mutex */
 	pthread_cleanup_pop(TRUE);
-	free(data.entry);
+	entry_destroy(data.entry);
 }
 /**
@@ -248,6 +253,7 @@ static void set_sa(private_bus_t *this, ike_sa_t *ike_sa)
 	pthread_setspecific(this->thread_sa, ike_sa);
 }
 /**
 * Implementation of bus_t.vsignal.
 */
@@ -259,7 +265,7 @@ static void vsignal(private_bus_t *this, signal_t signal, level_t level,
 	ike_sa_t *ike_sa;
 	long thread;
-	pthread_mutex_lock(&this->mutex);
+	this->mutex->lock(this->mutex);
 	ike_sa = pthread_getspecific(this->thread_sa);
 	thread = get_thread_number(this);
@@ -275,18 +281,18 @@ static void vsignal(private_bus_t *this, signal_t signal, level_t level,
 			if (entry->blocker)
 			{
 				entry->blocker = FALSE;
-				pthread_cond_signal(&entry->cond);
+				entry->condvar->signal(entry->condvar);
 			}
 			else
 			{
-				free(entry);
+				entry_destroy(entry);
 			}
 		}
 		va_end(args_copy);
 	}
 	iterator->destroy(iterator);
-	pthread_mutex_unlock(&this->mutex);
+	this->mutex->unlock(this->mutex);
 }
 /**
@@ -307,7 +313,8 @@ static void signal_(private_bus_t *this, signal_t signal, level_t level,
 */
 static void destroy(private_bus_t *this)
 {
-	this->listeners->destroy_function(this->listeners, free);
+	this->mutex->destroy(this->mutex);
 	this->listeners->destroy_function(this->listeners, (void*)entry_destroy);
 	free(this);
 }
@@ -327,7 +334,7 @@ bus_t *bus_create()
 	this->public.destroy = (void(*)(bus_t*)) destroy;
 	this->listeners = linked_list_create();
-	pthread_mutex_init(&this->mutex, NULL);
+	this->mutex = mutex_create(MUTEX_DEFAULT);
 	pthread_key_create(&this->thread_id, NULL);
 	pthread_key_create(&this->thread_sa, NULL);
@@ -1,10 +1,3 @@
 /**
 * @file bus.h
 *
 * @brief Interface of bus_t.
 *
 */
 /*
 * Copyright (C) 2006 Martin Willi
 * Hochschule fuer Technik Rapperswil
@@ -18,6 +11,13 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup bus bus
 * @{ @ingroup charon
 */
 #ifndef BUS_H_
@@ -36,7 +36,7 @@ typedef struct bus_t bus_t;
 /**
- * @brief signals emitted by the daemon.
+ * signals emitted by the daemon.
 *
 * Signaling is for different purporses. First, it allows debugging via
 * "debugging signal messages", sencondly, it allows to follow certain
@@ -52,8 +52,6 @@ typedef struct bus_t bus_t;
 * Debug signal betwee a START and a SUCCESS/FAILED belongs to that operation
 * if the IKE_SA is the same. The thread may change, as multiple threads
 * may be involved in a complex scenario.
 *
 * @ingroup bus
 */
 enum signal_t {
 	/** pseudo signal, representing any other signal */
@@ -157,7 +155,7 @@ enum level_t {
 #if DEBUG_LEVEL >= 1
 /**
- * @brief Log a debug message via the signal bus.
+ * Log a debug message via the signal bus.
 *
 * @param signal	signal_t signal description
 * @param format	printf() style format string
@@ -189,7 +187,7 @@ enum level_t {
 #endif /* DBG4 */
 /**
- * @brief Raise a signal for an occured event.
+ * Raise a signal for an occured event.
 *
 * @param sig		signal_t signal description
 * @param format	printf() style format string
@@ -198,7 +196,7 @@ enum level_t {
 #define SIG(sig, format, ...) charon->bus->signal(charon->bus, sig, LEVEL_0, format, ##__VA_ARGS__)
 /**
- * @brief Get the type of a signal.
+ * Get the type of a signal.
 *
 * A signal may be a debugging signal with a specific context. They have
 * a level specific for their context > 0. All audit signals use the
@@ -211,17 +209,15 @@ enum level_t {
 /**
- * @brief Interface for registering at the signal bus.
+ * Interface for registering at the signal bus.
 *
 * To receive signals from the bus, the client implementing the
 * bus_listener_t interface registers itself at the signal bus.
 *
 * @ingroup bus
 */
 struct bus_listener_t {
 	/**
-	 * @brief Send a signal to a bus listener.
+	 * Send a signal to a bus listener.
 	 *
 	 * A numerical identification for the thread is included, as the
 	 * associated IKE_SA, if any. Signal specifies the type of
@@ -231,8 +227,10 @@ struct bus_listener_t {
 	 * a "..." parameters to functions is not (cleanly) possible.
 	 * The implementing signal function returns TRUE to stay registered
 	 * to the bus, or FALSE to unregister itself.
 	 * You should not call bus_t.signal() inside of a registered listener,
 	 * as it WILL call itself recursively. If you do so, make shure to 
 	 * avoid infinite recursion. Watch your stack!
 	 *
 	 * @param this		listener
 	 * @param singal	kind of the signal (up, down, rekeyed, ...)
 	 * @param level		verbosity level of the signal
 	 * @param thread	ID of the thread raised this signal
@@ -246,40 +244,36 @@ struct bus_listener_t {
 };
 /**
- * @brief Signal bus which sends signals to registered listeners.
+ * Signal bus which sends signals to registered listeners.
 *
 * The signal bus is not much more than a multiplexer. A listener interested
 * in receiving event signals registers at the bus. Any signals sent to
 * are delivered to all registered listeners.
 * To deliver signals to threads, the blocking listen() call may be used
 * to wait for a signal.
 *
 * @ingroup bus
 */
 struct bus_t {
 	/**
-	 * @brief Register a listener to the bus.
+	 * Register a listener to the bus.
 	 *
 	 * A registered listener receives all signals which are sent to the bus.
 	 * The listener is passive; the thread which emitted the signal
 	 * processes the listener routine.
 	 *
 	 * @param this		bus
 	 * @param listener	listener to register.
 	 */
 	void (*add_listener) (bus_t *this, bus_listener_t *listener);
 	/**
-	 * @brief Unregister a listener from the bus.
+	 * Unregister a listener from the bus.
 	 *
 	 * @param this		bus
 	 * @param listener	listener to unregister.
 	 */
 	void (*remove_listener) (bus_t *this, bus_listener_t *listener);
 	/**
-	 * @brief Register a listener and block the calling thread.
+	 * Register a listener and block the calling thread.
 	 *
 	 * This call registers a listener and blocks the calling thread until
 	 * its listeners function returns FALSE. This allows to wait for certain
@@ -287,14 +281,13 @@ struct bus_t {
 	 * registered, this allows to listen on events we initiate with the job
 	 * without missing any signals.
 	 *
 	 * @param this		bus
 	 * @param listener	listener to register
 	 * @param job		job to execute asynchronously when registered, or NULL
 	 */
 	void (*listen)(bus_t *this, bus_listener_t *listener, job_t *job);
 	/**
-	 * @brief Set the IKE_SA the calling thread is using.
+	 * Set the IKE_SA the calling thread is using.
 	 *
 	 * To associate an received signal to an IKE_SA without passing it as
 	 * parameter each time, the thread registers it's used IKE_SA each
@@ -302,13 +295,12 @@ struct bus_t {
 	 * the IKE_SA (by passing NULL). This IKE_SA is stored per-thread, so each
 	 * thread has one IKE_SA registered (or not).
 	 * 
 	 * @param this		bus
 	 * @param ike_sa	ike_sa to register, or NULL to unregister
 	 */
 	void (*set_sa) (bus_t *this, ike_sa_t *ike_sa);
 	/**
-	 * @brief Send a signal to the bus.
+	 * Send a signal to the bus.
 	 *
 	 * The signal specifies the type of the event occured. The format string
 	 * specifies an additional informational or error message with a
@@ -316,7 +308,6 @@ struct bus_t {
 	 * Some useful macros are available to shorten this call.
 	 * @see SIG(), DBG1()
 	 *
 	 * @param this		bus
 	 * @param singal	kind of the signal (up, down, rekeyed, ...)
 	 * @param level		verbosity level of the signal
 	 * @param format	printf() style format string
@@ -325,7 +316,7 @@ struct bus_t {
 	void (*signal) (bus_t *this, signal_t signal, level_t level, char* format, ...);
 	/**
-	 * @brief Send a signal to the bus using va_list arguments.
+	 * Send a signal to the bus using va_list arguments.
 	 *
 	 * Same as bus_t.signal(), but uses va_list argument list.
 	 *
@@ -333,7 +324,6 @@ struct bus_t {
 	 * called extensively and therefore shouldn't allocate heap memory or
 	 * do other expensive tasks!
 	 *
 	 * @param this		bus
 	 * @param singal	kind of the signal (up, down, rekeyed, ...)
 	 * @param level		verbosity level of the signal
 	 * @param format	printf() style format string
@@ -342,20 +332,16 @@ struct bus_t {
 	void (*vsignal) (bus_t *this, signal_t signal, level_t level, char* format, va_list args);
 	/**
-	 * @brief Destroy the signal bus.
+	 * Destroy the signal bus.
 	 *
 	 * @param this		bus to destroy
 	 */
 	void (*destroy) (bus_t *this);
 };
 /**
- * @brief Create the signal bus which multiplexes signals to its listeners.
+ * Create the signal bus which multiplexes signals to its listeners.
 *
 * @return		signal bus instance
 * 
 * @ingroup bus
 */
 bus_t *bus_create();
-#endif /* BUS_H_ */
+#endif /* BUS_H_ @} */
@@ -1,10 +1,3 @@
 /**
 * @file file_logger.c
 *
 * @brief Implementation of file_logger_t.
 *
 */
 /*
 * Copyright (C) 2006 Martin Willi
 * Hochschule fuer Technik Rapperswil
@@ -18,6 +11,8 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include <stdio.h>
@@ -1,10 +1,3 @@
 /**
 * @file file_logger.h
 *
 * @brief Interface of file_logger_t.
 *
 */
 /*
 * Copyright (C) 2006 Martin Willi
 * Hochschule fuer Technik Rapperswil
@@ -18,6 +11,13 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup file_logger file_logger
 * @{ @ingroup listeners
 */
 #ifndef FILE_LOGGER_H_
@@ -28,12 +28,7 @@ typedef struct file_logger_t file_logger_t;
 #include <bus/bus.h>
 /**
- * @brief Logger to files which implements bus_listener_t.
+ * Logger to files which implements bus_listener_t.
 *
 * @b Constructors:
 *  - file_logger_create()
 *
 * @ingroup listeners
 */
 struct file_logger_t {
@@ -43,31 +38,25 @@ struct file_logger_t {
 	bus_listener_t listener;
 	/**
-	 * @brief Set the loglevel for a signal type.
+	 * Set the loglevel for a signal type.
 	 *
 	 * @param this		stream_logger_t object
 	 * @param singal	type of signal
 	 * @param level		max level to log (0..4)
 	 */
 	void (*set_level) (file_logger_t *this, signal_t signal, level_t level);
 	/**
-	 * @brief Destroys a file_logger_t object.
+	 * Destroys a file_logger_t object.
 	 *
 	 * @param this		file_logger_t object
 	 */
 	void (*destroy) (file_logger_t *this);
 };
 /**
- * @brief Constructor to create a file_logger_t object.
+ * Constructor to create a file_logger_t object.
 *
 * @param out		FILE to write to
 * @return			file_logger_t object
 *
 * @ingroup listeners
 */
 file_logger_t *file_logger_create(FILE *out);
-
+#endif /* FILE_LOGGER_H_ @} */
 #endif /* FILE_LOGGER_H_ */
@@ -1,10 +1,3 @@
 /**
 * @file sys_logger.c
 *
 * @brief Implementation of sys_logger_t.
 *
 */
 /*
 * Copyright (C) 2006 Martin Willi
 * Hochschule fuer Technik Rapperswil
@@ -18,6 +11,8 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include <stdio.h>
@@ -1,10 +1,3 @@
 /**
 * @file sys_logger.h
 *
 * @brief Interface of sys_logger_t.
 *
 */
 /*
 * Copyright (C) 2006 Martin Willi
 * Hochschule fuer Technik Rapperswil
@@ -18,6 +11,13 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup sys_logger sys_logger
 * @{ @ingroup listeners
 */
 #ifndef SYS_LOGGER_H_
@@ -30,12 +30,7 @@ typedef struct sys_logger_t sys_logger_t;
 #include <bus/bus.h>
 /**
- * @brief Logger for syslog which implements bus_listener_t.
+ * Logger for syslog which implements bus_listener_t.
 *
 * @b Constructors:
 *  - sys_logger_create()
 *
 * @ingroup listeners
 */
 struct sys_logger_t {
@@ -45,31 +40,25 @@ struct sys_logger_t {
 	bus_listener_t listener;
 	/**
-	 * @brief Set the loglevel for a signal type.
+	 * Set the loglevel for a signal type.
 	 *
 	 * @param this		stream_logger_t object
 	 * @param singal	type of signal
 	 * @param level		max level to log
 	 */
 	void (*set_level) (sys_logger_t *this, signal_t signal, level_t level);
 	/**
-	 * @brief Destroys a sys_logger_t object.
+	 * Destroys a sys_logger_t object.
 	 *
 	 * @param this		sys_logger_t object
 	 */
 	void (*destroy) (sys_logger_t *this);
 };
 /**
- * @brief Constructor to create a sys_logger_t object.
+ * Constructor to create a sys_logger_t object.
 *
 * @param facility	syslog facility to use
 * @return			sys_logger_t object
 *
 * @ingroup listeners
 */
 sys_logger_t *sys_logger_create(int facility);
-
+#endif /* SYS_LOGGER_H_ @} */
 #endif /* SYS_LOGGER_H_ */
@@ -0,0 +1,75 @@
 /*
 * Copyright (C) 2007-2008 Martin Willi
 * Hochschule fuer Technik Rapperswil
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
 * Free Software Foundation; either version 2 of the License, or (at your
 * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
 *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup backend backend
 * @{ @ingroup config
 */
 #ifndef BACKEND_H_
 #define BACKEND_H_
 typedef struct backend_t backend_t;
 #include <library.h>
 #include <config/ike_cfg.h>
 #include <config/peer_cfg.h>
 #include <credentials/auth_info.h>
 #include <utils/linked_list.h>
 /**
 * The interface for a configuration backend.
 *
 * A configuration backend is loaded into the backend_manager. It does the actual
 * configuration lookup for the method it implements. See backend_manager_t for
 * more information.
 */
 struct backend_t {
 	/**
 	 * Create an enumerator over all IKE configs matching two hosts.
 	 *
 	 * Hosts may be NULL to get all.
 	 *
 	 * @param me		address of local host
 	 * @param other		address of remote host
 	 * @return			enumerator over ike_cfg_t's
 	 */
 	enumerator_t* (*create_ike_cfg_enumerator)(backend_t *this,
 											   host_t *me, host_t *other);
 	/**
 	 * Create an enumerator over all Peer configs matching two IDs.
 	 *
 	 * IDs may be NULL to get all.
 	 *
 	 * @param me		identity of ourself
 	 * @param other		identity of remote host
 	 * @return			enumerator over peer_cfg_t
 	 */
 	enumerator_t* (*create_peer_cfg_enumerator)(backend_t *this,
 												identification_t *me,
 												identification_t *other);
 	/**
 	 * Get a peer_cfg identified by it's name, or a name of its child.
 	 *
 	 * @param name				name of peer/child cfg
 	 * @return					matching peer_config, or NULL if none found
 	 */
 	peer_cfg_t *(*get_peer_cfg_by_name)(backend_t *this, char *name);
 };
 #endif /* BACKEND_H_ @} */
@@ -1,10 +1,3 @@
 /**
 * @file backend_manager.c
 * 
 * @brief Implementation of backend_manager_t.
 * 
 */
 /*
 * Copyright (C) 2007 Martin Willi
 * Hochschule fuer Technik Rapperswil
@@ -18,18 +11,18 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include "backend_manager.h"
 #include <sys/types.h>
-#include <dirent.h>
+#include <pthread.h>
 #include <sys/stat.h>
 #include <dlfcn.h>
 #include <daemon.h>
 #include <utils/linked_list.h>
-#include <config/backends/writeable_backend.h>
+#include <utils/mutex.h>
 typedef struct private_backend_manager_t private_backend_manager_t;
@@ -50,49 +43,209 @@ struct private_backend_manager_t {
 	linked_list_t *backends;
 	/**
-	 * Additional list of writable backends.
+	 * locking mutex
 	 */
-	linked_list_t *writeable;
+	mutex_t *mutex;
 	/**
 	 * List of dlopen() handles we used to open backends
 	 */
 	linked_list_t *handles;
 };
 /**
 * data to pass nested IKE enumerator
 */
 typedef struct {
 	private_backend_manager_t *this;
 	host_t *me;
 	host_t *other;
 } ike_data_t;
 /**
 * data to pass nested peer enumerator
 */
 typedef struct {
 	private_backend_manager_t *this;
 	identification_t *me;
 	identification_t *other;
 } peer_data_t;
 /**
 * destroy IKE enumerator data and unlock list
 */
 static void ike_enum_destroy(ike_data_t *data)
 {
 	data->this->mutex->unlock(data->this->mutex);
 	free(data);
 }
 /**
 * destroy PEER enumerator data and unlock list
 */
 static void peer_enum_destroy(peer_data_t *data)
 {
 	data->this->mutex->unlock(data->this->mutex);
 	free(data);
 }
 /**
 * inner enumerator constructor for IKE cfgs
 */
 static enumerator_t *ike_enum_create(backend_t *backend, ike_data_t *data)
 {
 	return backend->create_ike_cfg_enumerator(backend, data->me, data->other);
 }
 /**
 * inner enumerator constructor for Peer cfgs
 */
 static enumerator_t *peer_enum_create(backend_t *backend, peer_data_t *data)
 {
 	return backend->create_peer_cfg_enumerator(backend, data->me, data->other);
 }
 /**
 * inner enumerator constructor for all Peer cfgs
 */
 static enumerator_t *peer_enum_create_all(backend_t *backend)
 {
 	return backend->create_peer_cfg_enumerator(backend, NULL, NULL);
 }
 /**
 * implements backend_manager_t.get_ike_cfg.
 */
 static ike_cfg_t *get_ike_cfg(private_backend_manager_t *this, 
-							  host_t *my_host, host_t *other_host)
+							  host_t *me, host_t *other)
 {
-	backend_t *backend;
+	ike_cfg_t *current, *found = NULL;
-	ike_cfg_t *config = NULL;
+	enumerator_t *enumerator;
-	iterator_t *iterator = this->backends->create_iterator(this->backends, TRUE);
+	host_t *my_candidate, *other_candidate;
-	while (config == NULL && iterator->iterate(iterator, (void**)&backend))
+	ike_data_t *data;
 	enum {
 		MATCH_NONE  = 0x00,
 		MATCH_ANY   = 0x01,
 		MATCH_ME    = 0x04,
 		MATCH_OTHER = 0x08,
 	} prio, best = MATCH_ANY;
 	data = malloc_thing(ike_data_t);
 	data->this = this;
 	data->me = me;
 	data->other = other;
 	DBG2(DBG_CFG, "looking for a config for %H...%H", me, other);
 	this->mutex->lock(this->mutex);
 	enumerator = enumerator_create_nested(
 						this->backends->create_enumerator(this->backends),
 						(void*)ike_enum_create, data, (void*)ike_enum_destroy);
 	while (enumerator->enumerate(enumerator, (void**)&current))
 	{
-		config = backend->get_ike_cfg(backend, my_host, other_host);
+		prio = MATCH_NONE;
 		my_candidate = current->get_my_host(current);
 		other_candidate = current->get_other_host(current);
 		if (my_candidate->ip_equals(my_candidate, me))
 		{
 			prio += MATCH_ME;
 		}
 		else if (my_candidate->is_anyaddr(my_candidate))
 		{
 			prio += MATCH_ANY;
 		}
 		if (other_candidate->ip_equals(other_candidate, other))
 		{
 			prio += MATCH_OTHER;
 		}
 		else if (other_candidate->is_anyaddr(other_candidate))
 		{
 			prio += MATCH_ANY;
 		}
 		DBG2(DBG_CFG, "  candidate: %H...%H, prio %d",
 			 my_candidate, other_candidate, prio);
 		/* we require at least two MATCH_ANY */
 		if (prio > best)
 		{
 			best = prio;
 			DESTROY_IF(found);
 			found = current;
 			found->get_ref(found);
 		}
 	}
-	iterator->destroy(iterator);
+	enumerator->destroy(enumerator);
-	return config;
+	this->mutex->unlock(this->mutex);
 	return found;
 }
 static enumerator_t *create_peer_cfg_enumerator(private_backend_manager_t *this)
 {
 	this->mutex->lock(this->mutex);
 	return enumerator_create_nested(
 							this->backends->create_enumerator(this->backends),
 							(void*)peer_enum_create_all, this->mutex,
 							(void*)this->mutex->unlock);
 }
 /**
 * implements backend_manager_t.get_peer_cfg.
 */			
 static peer_cfg_t *get_peer_cfg(private_backend_manager_t *this,
-								identification_t *my_id, identification_t *other_id,
+								identification_t *me, identification_t *other,
-								ca_info_t *other_ca_info)
+								auth_info_t *auth)
 {
-	backend_t *backend;
+	peer_cfg_t *current, *found = NULL;
-	peer_cfg_t *config = NULL;
+	enumerator_t *enumerator;
-	iterator_t *iterator = this->backends->create_iterator(this->backends, TRUE);
+	identification_t *my_candidate, *other_candidate;
-	while (config == NULL && iterator->iterate(iterator, (void**)&backend))
+	id_match_t best = ID_MATCH_NONE;
 	peer_data_t *data;
 	DBG2(DBG_CFG, "looking for a config for %D...%D", me, other);
 	data = malloc_thing(peer_data_t);
 	data->this = this;
 	data->me = me;
 	data->other = other;
 	this->mutex->lock(this->mutex);
 	enumerator = enumerator_create_nested(
 						this->backends->create_enumerator(this->backends),
 						(void*)peer_enum_create, data, (void*)peer_enum_destroy);
 	while (enumerator->enumerate(enumerator, &current))
 	{
-		config = backend->get_peer_cfg(backend, my_id, other_id, other_ca_info);
+		id_match_t m1, m2, sum;
 		my_candidate = current->get_my_id(current);
 		other_candidate = current->get_other_id(current);
 		m1 = my_candidate->matches(my_candidate, me);
 		m2 = other->matches(other, other_candidate);
 		sum = m1 + m2;
 		if (m1 && m2)
 		{
 			if (auth->complies(auth, current->get_auth(current)))
 			{
 				DBG2(DBG_CFG, "  candidate '%s': %D...%D, prio %d",
 				 	 current->get_name(current), my_candidate,
 				 	 other_candidate, sum);
 				if (sum > best)
 				{
 					DESTROY_IF(found);
 					found = current;
 					found->get_ref(found);
 					best = sum;
 				}
 			}
 		}
 	}
-	iterator->destroy(iterator);
+	if (found)
-	return config;
+	{
 		DBG1(DBG_CFG, "found matching config \"%s\": %D...%D, prio %d",
 			 found->get_name(found), found->get_my_id(found),
 			 found->get_other_id(found), best);
 	}
 	enumerator->destroy(enumerator);
 	this->mutex->unlock(this->mutex);
 	return found;
 }
 /**
@@ -102,112 +255,37 @@ static peer_cfg_t *get_peer_cfg_by_name(private_backend_manager_t *this, char *n
 {
 	backend_t *backend;
 	peer_cfg_t *config = NULL;
-	iterator_t *iterator = this->backends->create_iterator(this->backends, TRUE);
+	enumerator_t *enumerator;
-	while (config == NULL && iterator->iterate(iterator, (void**)&backend))
+	
 	this->mutex->lock(this->mutex);
 	enumerator = this->backends->create_enumerator(this->backends);
 	while (config == NULL && enumerator->enumerate(enumerator, (void**)&backend))
 	{
 		config = backend->get_peer_cfg_by_name(backend, name);
 	}
-	iterator->destroy(iterator);
+	enumerator->destroy(enumerator);
 	this->mutex->unlock(this->mutex);
 	return config;
 }
 /**
- * implements backend_manager_t.add_peer_cfg.
+ * Implementation of backend_manager_t.remove_backend.
 */	
 static void add_peer_cfg(private_backend_manager_t *this, peer_cfg_t *config)
 {
 	writeable_backend_t *backend;
 	if (this->writeable->get_first(this->writeable, (void**)&backend) == SUCCESS)
 	{
 		backend->add_cfg(backend, config);
 	}
 }
 /**
 * implements backend_manager_t.create_iterator.
 */	
 static iterator_t* create_iterator(private_backend_manager_t *this)
 {
 	writeable_backend_t *backend;
 	if (this->writeable->get_first(this->writeable, (void**)&backend) == SUCCESS)
 	{
 		return backend->create_iterator(backend);
 	}
 	/* give out an empty iterator if we have no writable backend*/
 	return this->writeable->create_iterator(this->writeable, TRUE);
 }
 /**
 * load the configuration backend modules
 */
-static void load_backends(private_backend_manager_t *this)
+static void remove_backend(private_backend_manager_t *this, backend_t *backend)
 {
-	struct dirent* entry;
+	this->mutex->lock(this->mutex);
-	DIR* dir;
+	this->backends->remove(this->backends, backend, NULL);
 	this->mutex->unlock(this->mutex);
 }
-	dir = opendir(IPSEC_BACKENDDIR);
+/**
-	if (dir == NULL)
+ * Implementation of backend_manager_t.add_backend.
-	{
+ */
-		DBG1(DBG_CFG, "error opening backend modules directory "IPSEC_BACKENDDIR);
+static void add_backend(private_backend_manager_t *this, backend_t *backend)
-		return;
+{
-	}
+	this->mutex->lock(this->mutex);
-	
+	this->backends->insert_last(this->backends, backend);
-	DBG1(DBG_CFG, "loading backend modules from '"IPSEC_BACKENDDIR"'");
+	this->mutex->unlock(this->mutex);
 	while ((entry = readdir(dir)) != NULL)
 	{
 		char file[256];
 		backend_t *backend;
 		backend_constructor_t constructor;
 		void *handle;
 		char *ending;
 		snprintf(file, sizeof(file), IPSEC_BACKENDDIR"/%s", entry->d_name);
 		ending = entry->d_name + strlen(entry->d_name) - 3;
 		if (ending <= entry->d_name || !streq(ending, ".so"))
 		{
 			/* skip anything which does not look like a library */
 			DBG2(DBG_CFG, "  skipping %s, doesn't look like a library",
 				 entry->d_name);
 			continue;
 		}
 		/* try to load the library */
 		handle = dlopen(file, RTLD_LAZY);
 		if (handle == NULL)
 		{
 			DBG1(DBG_CFG, "  opening backend module %s failed: %s",
 				 entry->d_name, dlerror());
 			continue;
 		}
 		constructor = dlsym(handle, "backend_create");
 		if (constructor == NULL)
 		{
 			DBG1(DBG_CFG, "  backend module %s has no backend_create() "
 				 "function, skipped", entry->d_name);
 			dlclose(handle);
 			continue;
 		}
 		backend = constructor();
 		if (backend == NULL)
 		{
 			DBG1(DBG_CFG, "  unable to create instance of backend "
 				 "module %s, skipped", entry->d_name);
 			dlclose(handle);
 			continue;
 		}
 		DBG1(DBG_CFG, "  loaded backend module successfully from %s", entry->d_name);
 		this->backends->insert_last(this->backends, backend);
 		if (backend->is_writeable(backend))
 		{
 			this->writeable->insert_last(this->writeable, backend);
 		}
 		this->handles->insert_last(this->handles, handle);
 	}
 	closedir(dir);
 }
 /**
@@ -215,9 +293,8 @@ static void load_backends(private_backend_manager_t *this)
 */
 static void destroy(private_backend_manager_t *this)
 {
-	this->backends->destroy_offset(this->backends, offsetof(backend_t, destroy));
+	this->backends->destroy(this->backends);
-	this->writeable->destroy(this->writeable);
+	this->mutex->destroy(this->mutex);
 	this->handles->destroy_function(this->handles, (void*)dlclose);
 	free(this);
 }
@@ -229,17 +306,15 @@ backend_manager_t *backend_manager_create()
 	private_backend_manager_t *this = malloc_thing(private_backend_manager_t);
 	this->public.get_ike_cfg = (ike_cfg_t* (*)(backend_manager_t*, host_t*, host_t*))get_ike_cfg;
-	this->public.get_peer_cfg = (peer_cfg_t* (*)(backend_manager_t*,identification_t*,identification_t*,ca_info_t*))get_peer_cfg;
+	this->public.get_peer_cfg = (peer_cfg_t* (*)(backend_manager_t*,identification_t*,identification_t*,auth_info_t*))get_peer_cfg;
 	this->public.get_peer_cfg_by_name = (peer_cfg_t* (*)(backend_manager_t*,char*))get_peer_cfg_by_name;
-	this->public.add_peer_cfg = (void (*)(backend_manager_t*,peer_cfg_t*))add_peer_cfg;
+	this->public.create_peer_cfg_enumerator = (enumerator_t* (*)(backend_manager_t*))create_peer_cfg_enumerator;
-	this->public.create_iterator = (iterator_t* (*)(backend_manager_t*))create_iterator;
+	this->public.add_backend = (void(*)(backend_manager_t*, backend_t *backend))add_backend;
 	this->public.remove_backend = (void(*)(backend_manager_t*, backend_t *backend))remove_backend;
 	this->public.destroy = (void (*)(backend_manager_t*))destroy;
 	this->backends = linked_list_create();
-	this->writeable = linked_list_create();
+	this->mutex = mutex_create(MUTEX_RECURSIVE);
 	this->handles = linked_list_create();
 	load_backends(this);
 	return &this->public;
 }
@@ -1,10 +1,3 @@
 /**
 * @file backend_manager.h
 * 
 * @brief Interface backend_manager_t.
 *  
 */
 /*
 * Copyright (C) 2007 Martin Willi
 * Hochschule fuer Technik Rapperswil
@@ -18,6 +11,13 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup backend_manager backend_manager
 * @{ @ingroup config
 */
 #ifndef BACKEND_MANAGER_H_
@@ -30,20 +30,15 @@ typedef struct backend_manager_t backend_manager_t;
 #include <utils/identification.h>
 #include <config/ike_cfg.h>
 #include <config/peer_cfg.h>
-#include <config/backends/backend.h>
+#include <config/backend.h>
 /**
- * @brief A loader and multiplexer to use multiple backends.
+ * A loader and multiplexer to use multiple backends.
 *
 * Charon allows the use of multiple configuration backends simultaneously. To
 * access all this backends by a single call, this class wraps multiple
- * backends behind a single object. It is also responsible for loading
+ * backends behind a single object.
 * the backend modules and cleaning them up.
 * A backend may be writeable or not. All backends implement the backend_t
 * interface, those who are writeable additionally implement the
 * writeable_backend_t interface. Adding configs to the backend_manager will
 * be redirected to the first writeable backend.
 * @verbatim
   +---------+      +-----------+         +--------------+     |
@@ -55,18 +50,12 @@ typedef struct backend_manager_t backend_manager_t;
   +---------+      +-----------+                              |
   @endverbatim
 *
 * @b Constructors:
 * - backend_manager_create()
 * 
 * @ingroup config
 */
 struct backend_manager_t {
 	/**
-	 * @brief Get an ike_config identified by two hosts.
+	 * Get an ike_config identified by two hosts.
 	 *
 	 * @param this				calling object
 	 * @param my_host			address of own host
 	 * @param other_host		address of remote host
 	 * @return					matching ike_config, or NULL if none found
@@ -75,59 +64,57 @@ struct backend_manager_t {
 							  host_t *my_host, host_t *other_host);
 	/**
-	 * @brief Get a peer_config identified by two IDs and the peer's certificate issuer
+	 * Get a peer_config identified by two IDs and authorization info.
 	 *
 	 * @param this				calling object
 	 * @param my_id				own ID
 	 * @param other_id			peer ID
-	 * @param other_ca_info		info record on issuer of peer certificate
+	 * @param auth_info			authorization info
 	 * @return					matching peer_config, or NULL if none found
 	 */
-	peer_cfg_t* (*get_peer_cfg)(backend_manager_t *this,
+	peer_cfg_t* (*get_peer_cfg)(backend_manager_t *this, identification_t *my_id,
-								identification_t *my_id, identification_t *other_id,
+								identification_t *other_id, auth_info_t *auth);
 								ca_info_t *other_ca_info);
 	/**
-	 * @brief Get a peer_config identified by it's name.
+	 * Get a peer_config identified by it's name.
 	 *
 	 * @param this				calling object
 	 * @param name				name of the peer_config
 	 * @return					matching peer_config, or NULL if none found
 	 */
 	peer_cfg_t* (*get_peer_cfg_by_name)(backend_manager_t *this, char *name);
 	/**
-	 * @brief Add a peer_config to the first found writable backend.
+	 * Create an enumerator over all peer configs.
 	 *
-	 * @param this		calling object
+	 * @return 					enumerator over peer configs
 	 * @param config	peer_config to add to the backend
 	 */
-	void (*add_peer_cfg)(backend_manager_t *this, peer_cfg_t *config);
+	enumerator_t* (*create_peer_cfg_enumerator)(backend_manager_t *this);
 	/**
-	 * @brief Create an iterator over all peer configs of the writable backend.
+	 * Register a backend on the manager.
 	 *
-	 * @param this		calling object
+	 * @param backend			backend to register
 	 * @return 			iterator over peer configs
 	 */
-	iterator_t* (*create_iterator)(backend_manager_t *this);
+	void (*add_backend)(backend_manager_t *this, backend_t *backend);
 	/**
-	 * @brief Destroys a backend_manager_t object.
+	 * Unregister a backend.
 	 *
-	 * @param this 					calling object
+	 * @param backend			backend to unregister
 	 */
 	void (*remove_backend)(backend_manager_t *this, backend_t *backend);
 	/**
 	 * Destroys a backend_manager_t object.
 	 */
 	void (*destroy) (backend_manager_t *this);
 };
 /**
- * @brief Creates a new instance of the manager and loads all backends.
+ * Create an instance of the backend manager
 *
 * @return		backend_manager instance
 *
 * @ingroup config
 */
 backend_manager_t* backend_manager_create(void);
-#endif /*BACKEND_MANAGER_H_*/
+#endif /*BACKEND_MANAGER_H_ @} */
@@ -1,105 +0,0 @@
 /**
 * @file backend.h
 * 
 * @brief Interface backend_t.
 *  
 */
 /*
 * Copyright (C) 2007 Martin Willi
 * Hochschule fuer Technik Rapperswil
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
 * Free Software Foundation; either version 2 of the License, or (at your
 * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
 *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 */
 #ifndef BACKEND_H_
 #define BACKEND_H_
 typedef struct backend_t backend_t;
 #include <library.h>
 #include <config/ike_cfg.h>
 #include <config/peer_cfg.h>
 #include <utils/linked_list.h>
 /**
 * @brief The interface for a configuration backend.
 *
 * A configuration backend is loaded by the backend_manager. It does the actual
 * configuration lookup for the method it implements. See backend_manager_t for
 * more information.
 *
 * @b Constructors:
 * - implementations constructors
 * 
 * @ingroup backends
 */
 struct backend_t {
 	/**
 	 * @brief Get an ike_cfg identified by two hosts.
 	 *
 	 * @param this				calling object
 	 * @param my_host			address of own host
 	 * @param other_host		address of remote host
 	 * @return					matching ike_config, or NULL if none found
 	 */
 	ike_cfg_t *(*get_ike_cfg)(backend_t *this, 
 							  host_t *my_host, host_t *other_host);
 	/**
 	 * @brief Get a peer_cfg identified by two IDs.
 	 * 
 	 * Select a config based on the two IDs and the other's certificate issuer
 	 *
 	 * @param this				calling object
 	 * @param my_id				own ID
 	 * @param other_id			peer ID
 	 * @param other_ca_info		info record on issuer of peer certificate
 	 * @return					matching peer_config, or NULL if none found
 	 */
 	peer_cfg_t *(*get_peer_cfg)(backend_t *this,
 								identification_t *my_id, identification_t *other_id,
 								ca_info_t *other_ca_info);
 	/**
 	 * @brief Get a peer_cfg identified by it's name, or a name of its child.
 	 *
 	 * @param this				calling object
 	 * @param name				
 	 * @return					matching peer_config, or NULL if none found
 	 */
 	peer_cfg_t *(*get_peer_cfg_by_name)(backend_t *this, char *name);
 	/**
 	 * @brief Check if a backend is writable and implements writable_backend_t.
 	 *
 	 * @param this		calling object
 	 * @return			TRUE if backend implements writable_backend_t.
 	 */
 	bool (*is_writeable)(backend_t *this);
 	/**
 	 * @brief Destroy a backend.
 	 *
 	 * @param this		calling object
 	 */
 	void (*destroy)(backend_t *this);
 };
 /**
 * Construction to create a backend.
 */
 typedef backend_t*(*backend_constructor_t)(void);
 #endif /* BACKEND_H_ */
@@ -1,322 +0,0 @@
 /**
 * @file local_backend.c
 *
 * @brief Implementation of local_backend_t.
 *
 */
 /*
 * Copyright (C) 2006 Martin Willi
 * Hochschule fuer Technik Rapperswil
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
 * Free Software Foundation; either version 2 of the License, or (at your
 * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
 *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 */
 #include <string.h>
 #include "local_backend.h"
 #include <daemon.h>
 #include <utils/linked_list.h>
 #include <crypto/ca.h>
 typedef struct private_local_backend_t private_local_backend_t;
 /**
 * Private data of an local_backend_t object
 */
 struct private_local_backend_t {
 	/**
 	 * Public part
 	 */
 	local_backend_t public;
 	/**
 	 * list of configs
 	 */
 	linked_list_t *cfgs;
 	/**
 	 * Mutex to exclusivly access list
 	 */
 	pthread_mutex_t mutex;
 };
 /**
 * implements backen_t.get_ike_cfg.
 */
 static ike_cfg_t *get_ike_cfg(private_local_backend_t *this, 
 							  host_t *my_host, host_t *other_host)
 {
 	peer_cfg_t *peer;
 	ike_cfg_t *current, *found = NULL;
 	iterator_t *iterator;
 	host_t *my_candidate, *other_candidate;
 	enum {
 		MATCH_NONE  = 0x00,
 		MATCH_ANY   = 0x01,
 		MATCH_ME    = 0x04,
 		MATCH_OTHER = 0x08,
 	} prio, best = MATCH_ANY;
 	DBG2(DBG_CFG, "looking for a config for %H...%H",
 		 my_host, other_host);
 	iterator = this->cfgs->create_iterator_locked(this->cfgs, &this->mutex);
 	while (iterator->iterate(iterator, (void**)&peer))
 	{
 		prio = MATCH_NONE;
 		current = peer->get_ike_cfg(peer);
 		my_candidate = current->get_my_host(current);
 		other_candidate = current->get_other_host(current);
 		if (my_candidate->ip_equals(my_candidate, my_host))
 		{
 			prio += MATCH_ME;
 		}
 		else if (my_candidate->is_anyaddr(my_candidate))
 		{
 			prio += MATCH_ANY;
 		}
 		if (other_candidate->ip_equals(other_candidate, other_host))
 		{
 			prio += MATCH_OTHER;
 		}
 		else if (other_candidate->is_anyaddr(other_candidate))
 		{
 			prio += MATCH_ANY;
 		}
 		DBG2(DBG_CFG, "  candidate '%s': %H...%H, prio %d",
 			 peer->get_name(peer), my_candidate, other_candidate, prio);
 		/* we require at least two MATCH_ANY */
 		if (prio > best)
 		{
 			best = prio;
 			found = current;
 		}
 	}
 	if (found)
 	{
 		found->get_ref(found);
 	}
 	iterator->destroy(iterator);
 	return found;
 }
 #define PRIO_NO_MATCH_FOUND		256
 /**
 * implements backend_t.get_peer.
 */			
 static peer_cfg_t *get_peer_cfg(private_local_backend_t *this,
 								identification_t *my_id, identification_t *other_id,
 								ca_info_t *other_ca_info)
 {
 	peer_cfg_t *current, *found = NULL;
 	iterator_t *iterator;
 	identification_t *my_candidate, *other_candidate;
 	int best = PRIO_NO_MATCH_FOUND;
 	DBG2(DBG_CFG, "looking for a config for %D...%D", my_id, other_id);
 	iterator = this->cfgs->create_iterator_locked(this->cfgs, &this->mutex);
 	while (iterator->iterate(iterator, (void**)&current))
 	{
 		int wc1, wc2;
 		my_candidate = current->get_my_id(current);
 		other_candidate = current->get_other_id(current);
 		if (my_candidate->matches(my_candidate, my_id, &wc1)
 		&&	other_id->matches(other_id, other_candidate, &wc2))
 		{
 			int prio = (wc1 + wc2) * (MAX_CA_PATH_LEN + 1);
 			int pathlen = 0;
 			identification_t *other_candidate_ca = current->get_other_ca(current);
 			linked_list_t *groups = current->get_groups(current);
 			/* is a group membership required? */
 			if (groups->get_count(groups) > 0)
 			{
 				DBG1(DBG_CFG, "  group membership required");
 			}
 			/* are there any ca constraints? */
 			if (other_candidate_ca->get_type(other_candidate_ca) != ID_ANY)
 			{
 				ca_info_t *ca_info = other_ca_info;
 				for (pathlen = 0; pathlen < MAX_CA_PATH_LEN; pathlen++)
 				{
 					if (ca_info == NULL)
 					{
 						prio = PRIO_NO_MATCH_FOUND;
 						break;
 					}
 					else
 					{
 						x509_t *cacert = ca_info->get_certificate(ca_info);
 						identification_t *other_ca = cacert->get_subject(cacert);
 						if (other_candidate_ca->equals(other_candidate_ca, other_ca))
 						{
 							/* found a ca match */
 							break;
 						}
 						if (cacert->is_self_signed(cacert))
 						{
 							/* reached the root ca without a match */
 							prio = PRIO_NO_MATCH_FOUND;
 							break;
 						}
 						/* move a level upward in the trust path hierarchy */
 						ca_info = charon->credentials->get_issuer(charon->credentials, cacert); 
 					}
 				}
 				if (pathlen == MAX_CA_PATH_LEN)
 				{
 					DBG1(DBG_CFG, "maximum ca path length of %d levels reached", MAX_CA_PATH_LEN);
 					prio = PRIO_NO_MATCH_FOUND;
 				}
 			}
 			if (prio == PRIO_NO_MATCH_FOUND)
 			{
 				DBG2(DBG_CFG, "  candidate '%s': %D...%D, no ca match",
 				 	current->get_name(current), my_candidate, other_candidate);
 			}
 			else
 			{
 				prio += pathlen;
 				DBG2(DBG_CFG, "  candidate '%s': %D...%D, prio %d",
 				 	current->get_name(current), my_candidate, other_candidate, prio);
 				if (prio < best)
 				{
 					found = current;
 					best = prio;
 				}
 			}
 		}
 	}
 	if (found)
 	{
 		DBG1(DBG_CFG, "found matching config \"%s\": %D...%D, prio %d",
 				found->get_name(found),
 				found->get_my_id(found),
 				found->get_other_id(found),
 				best);
 		found->get_ref(found);
 	}
 	iterator->destroy(iterator);
 	return found;
 }
 /**
 * implements backend_t.get_peer_cfg_by_name.
 */			
 static peer_cfg_t *get_peer_cfg_by_name(private_local_backend_t *this, char *name)
 {
 	iterator_t *i1, *i2;
 	peer_cfg_t *current, *found = NULL;
 	child_cfg_t *child;
 	i1 = this->cfgs->create_iterator(this->cfgs, TRUE);
 	while (i1->iterate(i1, (void**)&current))
 	{
        /* compare peer_cfgs name first */
        if (streq(current->get_name(current), name))
        {
            found = current;
            found->get_ref(found);
            break;
        }
        /* compare all child_cfg names otherwise */
        i2 = current->create_child_cfg_iterator(current);
        while (i2->iterate(i2, (void**)&child))
        {
            if (streq(child->get_name(child), name))
            {
                found = current;
                found->get_ref(found);
                break;
            }
        }
        i2->destroy(i2);
        if (found)
        {
            break;
        }
 	}
 	i1->destroy(i1);
 	return found;
 }
 /**
 * Implementation of backend_t.is_writable.
 */
 static bool is_writeable(private_local_backend_t *this)
 {
    return TRUE;
 }
 /**
 * Implementation of writable_backend_t.create_iterator.
 */
 static iterator_t* create_iterator(private_local_backend_t *this)
 {
 	return this->cfgs->create_iterator_locked(this->cfgs, &this->mutex);
 }
 /**
 * Implementation of writable_backend_t.add_peer_cfg.
 */
 static void add_cfg(private_local_backend_t *this, peer_cfg_t *config)
 {
    pthread_mutex_lock(&this->mutex);
    this->cfgs->insert_last(this->cfgs, config);
    pthread_mutex_unlock(&this->mutex);
 }
 /**
 * Implementation of backend_t.destroy.
 */
 static void destroy(private_local_backend_t *this)
 {
    this->cfgs->destroy_offset(this->cfgs, offsetof(peer_cfg_t, destroy));
    free(this);
 }
 /**
 * Described in header.
 */
 backend_t *backend_create(void)
 {
 	private_local_backend_t *this = malloc_thing(private_local_backend_t);
 	this->public.backend.backend.get_ike_cfg = (ike_cfg_t* (*)(backend_t*, host_t*, host_t*))get_ike_cfg;
 	this->public.backend.backend.get_peer_cfg = (peer_cfg_t* (*)(backend_t*,identification_t*,identification_t*,ca_info_t*))get_peer_cfg;
 	this->public.backend.backend.get_peer_cfg_by_name = (peer_cfg_t* (*)(backend_t*,char*))get_peer_cfg_by_name;
    this->public.backend.backend.is_writeable = (bool(*) (backend_t*))is_writeable;
    this->public.backend.backend.destroy = (void (*)(backend_t*))destroy;
 	this->public.backend.create_iterator = (iterator_t* (*)(writeable_backend_t*))create_iterator;
    this->public.backend.add_cfg = (void (*)(writeable_backend_t*,peer_cfg_t*))add_cfg;
 	/* private variables */
 	this->cfgs = linked_list_create();
 	pthread_mutex_init(&this->mutex, NULL);
 	return &this->public.backend.backend;
 }
@@ -1,60 +0,0 @@
 /**
 * @file local_backend.h
 *
 * @brief Interface of local_backend_t.
 *
 */
 /*
 * Copyright (C) 2007 Martin Willi
 * Hochschule fuer Technik Rapperswil
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
 * Free Software Foundation; either version 2 of the License, or (at your
 * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
 *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 */
 #ifndef LOCAL_BACKEND_H_
 #define LOCAL_BACKEND_H_
 typedef struct local_backend_t local_backend_t;
 #include <library.h>
 #include <config/backends/writeable_backend.h>
 /**
 * @brief An in-memory backend to store configurations.
 *
 * The local_backend_t stores the configuration in a simple list. It
 * implements both, backend_t and writeable_backend_t.
 *
 * @b Constructors:
 *  - local_backend_create()
 * 
 * @ingroup backends
 */
 struct local_backend_t {
 	/**
 	 * Implements writable_backend_t interface
 	 */
 	writeable_backend_t backend;
 };
 /**
 * @brief Create a backend_t instance implemented as local backend.
 *
 * @return backend instance
 * 
 * @ingroup backends
 */
 backend_t *backend_create(void);
 #endif /* LOCAL_BACKEND_H_ */
@@ -1,309 +0,0 @@
 /**
 * @file sqlite_backend.c
 *
 * @brief Implementation of sqlite_backend_t.
 *
 */
 /*
 * Copyright (C) 2006 Martin Willi
 * Hochschule fuer Technik Rapperswil
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
 * Free Software Foundation; either version 2 of the License, or (at your
 * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
 *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 */
 #include <string.h>
 #include <sqlite3.h>
 #include "sqlite_backend.h"
 #include <daemon.h>
 typedef struct private_sqlite_backend_t private_sqlite_backend_t;
 /**
 * Private data of an sqlite_backend_t object
 */
 struct private_sqlite_backend_t {
 	/**
 	 * Public part
 	 */
 	sqlite_backend_t public;
 	/**
 	 * SQLite database handle
 	 */
 	sqlite3 *db;
 };
 /**
 * implements backen_t.get_ike_cfg.
 */
 static ike_cfg_t *get_ike_cfg(private_sqlite_backend_t *this, 
 							  host_t *my_host, host_t *other_host)
 {
 	return NULL;
 }
 /**
 * add TS with child "id" to "child_cfg"
 */
 static void add_ts(private_sqlite_backend_t *this, child_cfg_t *child_cfg, int id)
 {
 	sqlite3_stmt *stmt;
 	if (sqlite3_prepare_v2(this->db,
 		"SELECT type, protocol, start_addr, end_addr, start_port, end_port, kind "
 		"FROM traffic_selectors, child_config_traffic_selector "
 			"ON traffic_selectors.oid = child_config_traffic_selector.traffic_selector "
 		"WHERE child_config_traffic_selector.child_cfg = ?;",
 		-1, &stmt, NULL) == SQLITE_OK &&
 		sqlite3_bind_int(stmt, 1, id) == SQLITE_OK)
 	{
 		while (sqlite3_step(stmt) == SQLITE_ROW)
 		{
 			traffic_selector_t *ts;
 			bool local = FALSE;
 			enum {
 				TS_LOCAL = 0,
 				TS_REMOTE = 1,
 				TS_LOCAL_DYNAMIC = 2,
 				TS_REMOTE_DYNAMIC = 3,
 			} kind;
 			kind = sqlite3_column_int(stmt, 6);
 			switch (kind)
 			{
 				case TS_LOCAL:
 					local = TRUE;
 					/* FALL */
 				case TS_REMOTE:
 					ts = traffic_selector_create_from_string(
 						sqlite3_column_int(stmt, 1), 			/* protocol */
 						sqlite3_column_int(stmt, 0),			/* type */
 						(char*)sqlite3_column_text(stmt, 2),	/* from addr */
 						sqlite3_column_int(stmt, 4),			/* from port */
 						(char*)sqlite3_column_text(stmt, 3),	/* to addr */
 						sqlite3_column_int(stmt, 5));			/* to port */
 					break;
 				case TS_LOCAL_DYNAMIC:
 					local = TRUE;
 					/* FALL */
 				case TS_REMOTE_DYNAMIC:
 					ts = traffic_selector_create_dynamic(
 						sqlite3_column_int(stmt, 1), 			/* protocol */
 						sqlite3_column_int(stmt, 0),			/* type */
 						sqlite3_column_int(stmt, 4),			/* from port */
 						sqlite3_column_int(stmt, 5));			/* to port */
 					break;
 				default:
 					continue;
 			}
 			if (ts)
 			{
 				child_cfg->add_traffic_selector(child_cfg, local, ts);
 			}
 		}
 	}
 	sqlite3_finalize(stmt);
 }
 /**
 * add childrens belonging to config with "id" to "peer_cfg"
 */
 static void add_children(private_sqlite_backend_t *this, peer_cfg_t *peer_cfg, int id)
 {
 	sqlite3_stmt *stmt;
 	child_cfg_t *child_cfg;
 	if (sqlite3_prepare_v2(this->db,
 		"SELECT child_configs.oid, name, updown, hostaccess, mode, "
 			   "lifetime, rekeytime, jitter "
 		"FROM child_configs, peer_config_child_config "
 			"ON child_configs.oid = peer_config_child_config.child_cfg "
 		"WHERE peer_config_child_config.peer_cfg = ?;",
 		-1, &stmt, NULL) == SQLITE_OK &&
 		sqlite3_bind_int(stmt, 1, id) == SQLITE_OK)
 	{
 		while (sqlite3_step(stmt) == SQLITE_ROW)
 		{
 			child_cfg = child_cfg_create(
 					(char*)sqlite3_column_text(stmt, 1), 	/* name */
 					sqlite3_column_int(stmt, 5),			/* lifetime */
 					sqlite3_column_int(stmt, 6), 			/* rekeytime */
 					sqlite3_column_int(stmt, 7),			/* jitter */
 					(char*)sqlite3_column_text(stmt, 2), 	/* updown */
 					sqlite3_column_int(stmt, 3),			/* hostaccess */
 					sqlite3_column_int(stmt, 4));			/* mode */
 			add_ts(this, child_cfg, sqlite3_column_int(stmt, 0));
 			child_cfg->add_proposal(child_cfg, proposal_create_default(PROTO_ESP));
 			peer_cfg->add_child_cfg(peer_cfg, child_cfg);
 		}
 	}
 	sqlite3_finalize(stmt);
 }
 /**
 * processing function for get_peer_cfg and get_peer_cfg_by_name
 */
 static peer_cfg_t *process_peer_cfg_row(private_sqlite_backend_t *this,
 										sqlite3_stmt *stmt)
 {
 	host_t *local_host, *remote_host, *local_vip = NULL, *remote_vip = NULL;
 	identification_t *local_id, *remote_id;
 	peer_cfg_t *peer_cfg;
 	ike_cfg_t *ike_cfg;
 	local_host = host_create_from_string((char*)sqlite3_column_text(stmt, 17), IKEV2_UDP_PORT);
 	remote_host = host_create_from_string((char*)sqlite3_column_text(stmt, 18), IKEV2_UDP_PORT);
 	if (sqlite3_column_text(stmt, 15))
 	{
 		local_vip = host_create_from_string((char*)sqlite3_column_text(stmt, 15), 0);
 	}
 	if (sqlite3_column_text(stmt, 16))
 	{
 		remote_vip = host_create_from_string((char*)sqlite3_column_text(stmt, 16), 0);
 	}
 	local_id = identification_create_from_string((char*)sqlite3_column_text(stmt, 2));
 	remote_id = identification_create_from_string((char*)sqlite3_column_text(stmt, 3));
 	if (local_host && remote_host && local_id && remote_id)
 	{
 		ike_cfg = ike_cfg_create(sqlite3_column_int(stmt, 19),  FALSE,
 								 local_host, remote_host);		
 		ike_cfg->add_proposal(ike_cfg, proposal_create_default(PROTO_IKE));
 		peer_cfg = peer_cfg_create(
 			(char*)sqlite3_column_text(stmt, 1),		/* name */
 			2, ike_cfg,	local_id, remote_id, NULL, NULL, linked_list_create(),
 			sqlite3_column_int(stmt, 4),				/* cert_policy */
 			sqlite3_column_int(stmt, 5),				/* auth_method */
 			sqlite3_column_int(stmt, 6), 0				/* eap_type, vendor */
 			sqlite3_column_int(stmt, 7),				/* keyingtries */
 			sqlite3_column_int(stmt, 8),				/* rekey_time */
 			sqlite3_column_int(stmt, 9),				/* reauth_time */
 			sqlite3_column_int(stmt, 10),				/* jitter_time */
 			sqlite3_column_int(stmt, 11),				/* over_time */
 			sqlite3_column_int(stmt, 14),				/* mobike */
 			sqlite3_column_int(stmt, 12),				/* dpd_delay */
 			sqlite3_column_int(stmt, 13),				/* dpd_action */
 			local_vip, remote_vip, FALSE, NULL, NULL);
 		add_children(this, peer_cfg, sqlite3_column_int(stmt, 0));
 		return peer_cfg;
 	}
 	DESTROY_IF(local_host);
 	DESTROY_IF(remote_host);
 	DESTROY_IF(local_id);
 	DESTROY_IF(remote_id);
 	DESTROY_IF(local_vip);
 	DESTROY_IF(remote_vip);
 	return NULL;
 }
 /**
 * implements backend_t.get_peer_cfg.
 */			
 static peer_cfg_t *get_peer_cfg(private_sqlite_backend_t *this,
 								identification_t *my_id, identification_t *other_id,
 								ca_info_t *other_ca_info)
 {
 	sqlite3_stmt *stmt;
 	char local[256], remote[256];
 	peer_cfg_t *peer_cfg = NULL;
 	snprintf(local, sizeof(local), "%D",  my_id);
 	snprintf(remote, sizeof(remote), "%D", other_id);
 	if (sqlite3_prepare_v2(this->db,
 			"SELECT peer_configs.oid, name, local_id, remote_id, cert_policy, "
 				   "auth_method, eap_type, keyingtries, "
 				   "rekey_time, reauth_time, jitter_time, over_time, "
 				   "dpd_delay, dpd_action, mobike, local_vip, remote_vip, "
 				   "local, remote, certreq "
 			"FROM peer_configs, ike_configs "
 				"ON peer_configs.ike_cfg = ike_configs.oid "
 			"WHERE local_id = ? and remote_id = ?;", -1, &stmt, NULL) == SQLITE_OK &&
 		sqlite3_bind_text(stmt, 1, local, -1, SQLITE_STATIC) == SQLITE_OK &&
 		sqlite3_bind_text(stmt, 2, remote, -1, SQLITE_STATIC) == SQLITE_OK &&
 		sqlite3_step(stmt) == SQLITE_ROW)
 	{
 		peer_cfg = process_peer_cfg_row(this, stmt);
 	}
 	sqlite3_finalize(stmt);
 	return peer_cfg;
 }
 /**
 * implements backend_t.get_peer_cfg_by_name.
 */			
 static peer_cfg_t *get_peer_cfg_by_name(private_sqlite_backend_t *this, char *name)
 {
 	sqlite3_stmt *stmt;
 	peer_cfg_t *peer_cfg = NULL;
 	if (sqlite3_prepare_v2(this->db,
 			"SELECT peer_configs.oid, name, local_id, remote_id, cert_policy, "
 				   "auth_method, eap_type, keyingtries, lifetime, rekeytime, jitter, "
 				   "dpd_delay, dpd_action, reauth, mobike, local_vip, remote_vip, "
 				   "local, remote, certreq "
 			"FROM peer_configs, ike_configs "
 				"ON peer_configs.ike_cfg = ike_configs.oid "
 			"WHERE name = ? ;", -1, &stmt, NULL) == SQLITE_OK &&
 		sqlite3_bind_text(stmt, 1, name, -1, SQLITE_STATIC) == SQLITE_OK &&
 		sqlite3_step(stmt) == SQLITE_ROW)
 	{
 		peer_cfg = process_peer_cfg_row(this, stmt);
 	}
 	sqlite3_finalize(stmt);
 	return peer_cfg;
 }
 /**
 * Implementation of backend_t.is_writable.
 */
 static bool is_writeable(private_sqlite_backend_t *this)
 {
    return FALSE;
 }
 /**
 * Implementation of backend_t.destroy.
 */
 static void destroy(private_sqlite_backend_t *this)
 {
 	sqlite3_close(this->db);
    free(this);
 }
 /**
 * Described in header.
 */
 backend_t *backend_create(void)
 {
 	private_sqlite_backend_t *this = malloc_thing(private_sqlite_backend_t);
 	this->public.backend.get_ike_cfg = (ike_cfg_t* (*)(backend_t*, host_t*, host_t*))get_ike_cfg;
 	this->public.backend.get_peer_cfg = (peer_cfg_t* (*)(backend_t*,identification_t*,identification_t*,ca_info_t*))get_peer_cfg;
 	this->public.backend.get_peer_cfg_by_name = (peer_cfg_t* (*)(backend_t*,char*))get_peer_cfg_by_name;
 	this->public.backend.is_writeable = (bool(*) (backend_t*))is_writeable;
 	this->public.backend.destroy = (void (*)(backend_t*))destroy;
 	if (sqlite3_open(IPSEC_DIR "/manager.db", &this->db) != SQLITE_OK)
 	{
 		DBG1(DBG_CFG, "opening SQLite database '" IPSEC_DIR "/manager.db' failed.");
 		destroy(this);
 		return NULL;
 	}
 	return &this->public.backend;
 }
@@ -1,64 +0,0 @@
 /**
 * @file writeable_backend.h
 *
 * @brief Interface of writeable_backend_t.
 *
 */
 /*
 * Copyright (C) 2007 Martin Willi
 * Hochschule fuer Technik Rapperswil
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
 * Free Software Foundation; either version 2 of the License, or (at your
 * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
 *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 */
 #ifndef WRITEABLE_BACKEND_H_
 #define WRITEABLE_BACKEND_H_
 typedef struct writeable_backend_t writeable_backend_t;
 #include <library.h>
 #include <config/backends/backend.h>
 /**
 * @brief A writeable backend extends backend_t by modification functions.
 *
 * @b Constructors:
 *  - writeable_backend_create()
 * 
 * @ingroup backends
 */
 struct writeable_backend_t {
 	/**
 	 * Implements backend_t interface
 	 */
 	backend_t backend;
 	/**
 	 * @brief Add a peer_config to the backend.
 	 *
 	 * @param this		calling object
 	 * @param config	peer_config to add to the backend
 	 */
 	void (*add_cfg)(writeable_backend_t *this, peer_cfg_t *config);
 	/**
 	 * @brief Create an iterator over all peer configs.
 	 *
 	 * @param this		calling object
 	 * @return 			iterator over peer configs
 	 */
 	iterator_t* (*create_iterator)(writeable_backend_t *this);
 };
 #endif /* WRITEABLE_BACKEND_H_ */
@@ -1,10 +1,3 @@
 /**
 * @file child_cfg.c
 * 
 * @brief Implementation of child_cfg_t.
 * 
 */
 /*
 * Copyright (C) 2005-2007 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,9 +12,10 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include "child_cfg.h"
 #include <daemon.h>
@@ -1,10 +1,3 @@
 /**
 * @file child_cfg.h
 * 
 * @brief Interface of child_cfg_t.
 *  
 */
 /*
 * Copyright (C) 2005-2007 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup child_cfg child_cfg
 * @{ @ingroup config
 */
 #ifndef CHILD_CFG_H_
@@ -32,11 +32,9 @@ typedef struct child_cfg_t child_cfg_t;
 #include <config/traffic_selector.h>
 /**
- * @brief Mode of an CHILD_SA.
+ * Mode of an CHILD_SA.
 *
 * These are equal to those defined in XFRM, so don't change.
 *
 * @ingroup config
 */
 enum mode_t {
 	/** transport mode, no inner address */
@@ -53,7 +51,7 @@ enum mode_t {
 extern enum_name_t *mode_names;
 /**
- * @brief A child_cfg_t defines the config template for a CHILD_SA.
+ * A child_cfg_t defines the config template for a CHILD_SA.
 *
 * After creation, proposals and traffic selectors may be added to the config.
 * A child_cfg object is referenced multiple times, and is not thread save.
@@ -62,51 +60,42 @@ extern enum_name_t *mode_names;
 * A reference counter handles the number of references hold to this config.
 *
 * @see peer_cfg_t to get an overview over the configurations.
 * 
 * @b Constructors:
 *   - child_cfg_create()
 *
 * @ingroup config
 */
 struct child_cfg_t {
 	/**
-	 * @brief Get the name of the child_cfg.
+	 * Get the name of the child_cfg.
 	 * 
 	 * @param this			calling object
 	 * @return				child_cfg's name
 	 */
 	char *(*get_name) (child_cfg_t *this);
 	/**
-	 * @brief Add a proposal to the list. 
+	 * Add a proposal to the list. 
 	 * 
 	 * The proposals are stored by priority, first added
 	 * is the most prefered.
 	 * After add, proposal is owned by child_cfg.
 	 * 
 	 * @param this			calling object
 	 * @param proposal		proposal to add
 	 */
 	void (*add_proposal) (child_cfg_t *this, proposal_t *proposal);
 	/**
-	 * @brief Get the list of proposals for the CHILD_SA.
+	 * Get the list of proposals for the CHILD_SA.
 	 *
 	 * Resulting list and all of its proposals must be freed after use.
 	 * 
 	 * @param this			calling object
 	 * @param strip_dh		TRUE strip out diffie hellman groups
 	 * @return				list of proposals
 	 */
 	linked_list_t* (*get_proposals)(child_cfg_t *this, bool strip_dh);
 	/**
-	 * @brief Select a proposal from a supplied list.
+	 * Select a proposal from a supplied list.
 	 *
 	 * Returned propsal is newly created and must be destroyed after usage.
 	 * 
 	 * @param this			calling object
 	 * @param proposals		list from from wich proposals are selected
 	 * @param strip_dh		TRUE strip out diffie hellman groups
 	 * @return				selected proposal, or NULL if nothing matches
@@ -115,12 +104,11 @@ struct child_cfg_t {
 								   bool strip_dh);
 	/**
-	 * @brief Add a traffic selector to the config.
+	 * Add a traffic selector to the config.
 	 * 
 	 * Use the "local" parameter to add it for the local or the remote side.
 	 * After add, traffic selector is owned by child_cfg.
 	 * 
 	 * @param this			calling object
 	 * @param local			TRUE for local side, FALSE for remote
 	 * @param ts			traffic_selector to add
 	 */
@@ -128,7 +116,7 @@ struct child_cfg_t {
 								 traffic_selector_t *ts);
 	/**
-	 * @brief Get a list of traffic selectors to use for the CHILD_SA.
+	 * Get a list of traffic selectors to use for the CHILD_SA.
 	 * 
 	 * The config contains two set of traffic selectors, one for the local
 	 * side, one for the remote side.
@@ -139,7 +127,6 @@ struct child_cfg_t {
 	 * the "host" parameter to narrow such traffic selectors to that address.
 	 * Resulted list and its traffic selectors must be destroyed after use.
 	 * 
 	 * @param this			calling object
 	 * @param local			TRUE for TS on local side, FALSE for remote
 	 * @param supplied		list with TS to select from, or NULL
 	 * @param host			address to use for narrowing "dynamic" TS', or NULL
@@ -150,23 +137,21 @@ struct child_cfg_t {
 											host_t *host);
 	/**
-	 * @brief Get the updown script to run for the CHILD_SA.
+	 * Get the updown script to run for the CHILD_SA.
 	 * 
 	 * @param this			calling object
 	 * @return				path to updown script
 	 */
 	char* (*get_updown)(child_cfg_t *this);
 	/**
-	 * @brief Should we allow access to the local host (gateway)?
+	 * Should we allow access to the local host (gateway)?
 	 * 
 	 * @param this			calling object
 	 * @return				value of hostaccess flag
 	 */
 	bool (*get_hostaccess) (child_cfg_t *this);
 	/**
-	 * @brief Get the lifetime of a CHILD_SA.
+	 * Get the lifetime of a CHILD_SA.
 	 *
 	 * If "rekey" is set to TRUE, a lifetime is returned before the first
 	 * rekeying should be started. If it is FALSE, the actual lifetime is
@@ -174,57 +159,50 @@ struct child_cfg_t {
 	 * The rekey time automatically contains a jitter to avoid simlutaneous
 	 * rekeying.
 	 * 
 	 * @param this			child_cfg 
 	 * @param rekey			TRUE to get rekey time
 	 * @return				lifetime in seconds
 	 */
 	u_int32_t (*get_lifetime) (child_cfg_t *this, bool rekey);
 	/**
-	 * @brief Get the mode to use for the CHILD_SA.
+	 * Get the mode to use for the CHILD_SA.
 	 *
 	 * The mode is either tunnel, transport or BEET. The peer must agree
 	 * on the method, fallback is tunnel mode.
 	 * 
 	 * @param this			child_cfg
 	 * @return				lifetime in seconds
 	 */
 	mode_t (*get_mode) (child_cfg_t *this);
 	/**
-	 * @brief Get the DH group to use for CHILD_SA setup.
+	 * Get the DH group to use for CHILD_SA setup.
 	 * 
-	 * @param this		calling object
+	 * @return				dh group to use
 	 * @return			dh group to use
 	 */
 	diffie_hellman_group_t (*get_dh_group)(child_cfg_t *this);
 	/**
-	 * @brief Get a new reference.
+	 * Get a new reference.
 	 *
 	 * Get a new reference to this child_cfg by increasing
 	 * it's internal reference counter.
 	 * Do not call get_ref or any other function until you
 	 * already have a reference. Otherwise the object may get
 	 * destroyed while calling get_ref(),
 	 * 
 	 * @param this				calling object
 	 */
 	void (*get_ref) (child_cfg_t *this);
 	/**
-	 * @brief Destroys the child_cfg object.
+	 * Destroys the child_cfg object.
 	 *
 	 * Decrements the internal reference counter and
 	 * destroys the child_cfg when it reaches zero.
 	 * 
 	 * @param this				calling object
 	 */
 	void (*destroy) (child_cfg_t *this);
 };
 /**
- * @brief Create a configuration template for CHILD_SA setup.
+ * Create a configuration template for CHILD_SA setup.
 * 
 * The "name" string gets cloned.
 * Lifetimes are in seconds. To prevent to peers to start rekeying at the
@@ -241,11 +219,9 @@ struct child_cfg_t {
 * @param hostaccess		TRUE to allow access to the local host
 * @param mode				mode to propose for CHILD_SA, transport, tunnel or BEET
 * @return 					child_cfg_t object
 * 
 * @ingroup config
 */
 child_cfg_t *child_cfg_create(char *name, u_int32_t lifetime,
 							  u_int32_t rekeytime, u_int32_t jitter,
 							  char *updown, bool hostaccess, mode_t mode);
-#endif /* CHILD_CFG_H_ */
+#endif /* CHILD_CFG_H_ @} */
@@ -1,63 +0,0 @@
 /**
 * @file local_credential_store.h
 *
 * @brief Interface of local_credential_store_t.
 *
 */
 /*
 * Copyright (C) 2006 Martin Willi
 * Hochschule fuer Technik Rapperswil
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
 * Free Software Foundation; either version 2 of the License, or (at your
 * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
 *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 */
 #ifndef LOCAL_CREDENTIAL_H_
 #define LOCAL_CREDENTIAL_H_
 typedef struct local_credential_store_t local_credential_store_t;
 #include <library.h>
 #include <credential_store.h>
 #include <daemon.h>
 /**
 * @brief A credential_store_t implementation using simple credentail lists.
 *
 * The local_credential_store_t class implements the credential_store_t interface
 * as simple as possible. The credentials are stored in lists, and are loaded from
 * files on the disk.
 * Shared secret are not handled yet, so get_shared_secret always returns NOT_FOUND.
 *
 * @b Constructors:
 *  - local_credential_store_create(bool strict)
 * 
 * @ingroup config
 */
 struct local_credential_store_t {
 	/**
 	 * Implements credential_store_t interface
 	 */
 	credential_store_t credential_store;
 };
 /**
 * @brief Creates a local_credential_store_t instance.
 *
 * @return 				credential store instance.
 *
 * @ingroup config
 */
 local_credential_store_t *local_credential_store_create(void);
 #endif /* LOCAL_CREDENTIAL_H_ */
@@ -1,10 +1,3 @@
 /**
 * @file ike_cfg.c
 *
 * @brief Implementation of ike_cfg_t.
 *
 */
 /*
 * Copyright (C) 2005-2007 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include "ike_cfg.h"
@@ -1,10 +1,3 @@
 /**
 * @file ike_cfg.h
 *
 * @brief Interface of ike_cfg_t.
 *
 */
 /*
 * Copyright (C) 2005-2007 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup ike_cfg ike_cfg
 * @{ @ingroup config
 */
 #ifndef IKE_CFG_H_
@@ -34,115 +34,98 @@ typedef struct ike_cfg_t ike_cfg_t;
 #include <crypto/diffie_hellman.h>
 /**
- * @brief An ike_cfg_t defines the rules to set up an IKE_SA.
+ * An ike_cfg_t defines the rules to set up an IKE_SA.
 *
 * @see peer_cfg_t to get an overview over the configurations.
 *
 * @b Constructors:
 *  - ike_cfg_create()
 *
 * @ingroup config
 */
 struct ike_cfg_t {
 	/**
-	 * @brief Get own address.
+	 * Get own address.
 	 * 
 	 * @param this	calling object
 	 * @return		host information as host_t object
 	 */
 	host_t* (*get_my_host) (ike_cfg_t *this);
 	/**
-	 * @brief Get peers address.
+	 * Get peers address.
 	 * 
 	 * @param this	calling object
 	 * @return		host information as host_t object
 	 */
 	host_t* (*get_other_host) (ike_cfg_t *this);
 	/**
-	 * @brief Adds a proposal to the list.
+	 * Adds a proposal to the list.
 	 * 
 	 * The first added proposal has the highest priority, the last
 	 * added the lowest.
 	 * 
 	 * @param this		calling object
 	 * @param proposal	proposal to add
 	 */
 	void (*add_proposal) (ike_cfg_t *this, proposal_t *proposal);
 	/**
-	 * @brief Returns a list of all supported proposals.
+	 * Returns a list of all supported proposals.
 	 * 
 	 * Returned list and its proposals must be destroyed after use.
 	 * 
 	 * @param this		calling object
 	 * @return 			list containing all the proposals
 	 */
 	linked_list_t* (*get_proposals) (ike_cfg_t *this);
 	/**
-	 * @brief Select a proposed from suggested proposals.
+	 * Select a proposed from suggested proposals.
 	 * 
 	 * Returned proposal must be destroyed after use.
 	 * 
 	 * @param this		calling object
 	 * @param proposals	list of proposals to select from
 	 * @return			selected proposal, or NULL if none matches.
 	 */
 	proposal_t *(*select_proposal) (ike_cfg_t *this, linked_list_t *proposals);
 	/**
-	 * @brief Should we send a certificate request in IKE_SA_INIT?
+	 * Should we send a certificate request in IKE_SA_INIT?
 	 *
 	 * @param this		calling object
 	 * @return			certificate request sending policy
 	 */
 	bool (*send_certreq) (ike_cfg_t *this);
 	/**
-	 * @brief Enforce UDP encapsulation by faking NATD notifies?
+	 * Enforce UDP encapsulation by faking NATD notifies?
 	 * 
 	 * @param this		calling object
 	 * @return			TRUE to enfoce UDP encapsulation
 	 */
 	bool (*force_encap) (ike_cfg_t *this);
 	/**
-	 * @brief Get the DH group to use for IKE_SA setup.
+	 * Get the DH group to use for IKE_SA setup.
 	 * 
 	 * @param this		calling object
 	 * @return			dh group to use for initialization
 	 */
 	diffie_hellman_group_t (*get_dh_group)(ike_cfg_t *this);
 	/**
-	 * @brief Get a new reference to this ike_cfg.
+	 * Get a new reference to this ike_cfg.
 	 *
 	 * Get a new reference to this ike_cfg by increasing
 	 * it's internal reference counter.
 	 * Do not call get_ref or any other function until you
 	 * already have a reference. Otherwise the object may get
 	 * destroyed while calling get_ref(),
 	 *
 	 * @param this		calling object
 	 */
 	void (*get_ref) (ike_cfg_t *this);
 	/**
-	 * @brief Destroys a ike_cfg_t object.
+	 * Destroys a ike_cfg_t object.
 	 * 
 	 * Decrements the internal reference counter and
 	 * destroys the ike_cfg when it reaches zero.
 	 * 
 	 * @param this		calling object
 	 */
 	void (*destroy) (ike_cfg_t *this);
 };
 /**
- * @brief Creates a ike_cfg_t object.
+ * Creates a ike_cfg_t object.
 *
 * Supplied hosts become owned by ike_cfg, the name gets cloned.
 *
@@ -152,10 +135,8 @@ struct ike_cfg_t {
 * @param my_host		host_t representing local address
 * @param other_host	host_t representing remote address
 * @return 				ike_cfg_t object.
 * 
 * @ingroup config
 */
 ike_cfg_t *ike_cfg_create(bool certreq, bool force_encap, 
 						  host_t *my_host, host_t *other_host);
-#endif /* IKE_CFG_H_ */
+#endif /* IKE_CFG_H_ @} */
@@ -1,10 +1,3 @@
 /**
 * @file peer_cfg.c
 * 
 * @brief Implementation of peer_cfg_t.
 * 
 */
 /*
 * Copyright (C) 2007 Tobias Brunner
 * Copyright (C) 2005-2007 Martin Willi
@@ -20,6 +13,8 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include <string.h>
@@ -29,7 +24,6 @@
 #include <utils/linked_list.h>
 #include <utils/identification.h>
 #include <crypto/ietf_attr_list.h>
 ENUM(cert_policy_names, CERT_ALWAYS_SEND, CERT_NEVER_SEND,
 	"CERT_ALWAYS_SEND",
@@ -96,21 +90,6 @@ struct private_peer_cfg_t {
 	 */
 	identification_t *other_id;
 	/**
 	 * we have a cert issued by this CA
 	 */
 	identification_t *my_ca;
 	/**
 	 * we require the other end to have a cert issued by this CA
 	 */
 	identification_t *other_ca;
 	/**
 	 * we require the other end to belong to at least one group
 	 */
 	linked_list_t *groups;
 	/**
 	 * should we send a certificate
 	 */
@@ -180,6 +159,11 @@ struct private_peer_cfg_t {
 	 * virtual IP to use remotly
 	 */
 	host_t *other_virtual_ip;
 	/**
 	 * required authorization constraints
 	 */
 	auth_info_t *auth;
 #ifdef P2P	
 	/**
@@ -235,12 +219,26 @@ static void add_child_cfg(private_peer_cfg_t *this, child_cfg_t *child_cfg)
 }
 /**
- * Implementation of peer_cfg_t.create_child_cfg_iterator.
+ * Implementation of peer_cfg_t.remove_child_cfg.
 */
-static iterator_t* create_child_cfg_iterator(private_peer_cfg_t *this)
+static void remove_child_cfg(private_peer_cfg_t *this, enumerator_t *enumerator)
 {
-	return this->child_cfgs->create_iterator_locked(this->child_cfgs,
+	pthread_mutex_lock(&this->mutex);
-													&this->mutex);
+	this->child_cfgs->remove_at(this->child_cfgs, enumerator);
 	pthread_mutex_unlock(&this->mutex);
 }
 /**
 * Implementation of peer_cfg_t.create_child_cfg_enumerator.
 */
 static enumerator_t* create_child_cfg_enumerator(private_peer_cfg_t *this)
 {
 	enumerator_t *enumerator;
 	pthread_mutex_lock(&this->mutex);
 	enumerator = this->child_cfgs->create_enumerator(this->child_cfgs);
 	return enumerator_create_cleaner(enumerator,
 									 (void*)pthread_mutex_unlock, &this->mutex);
 }
 /**
@@ -267,10 +265,10 @@ static child_cfg_t* select_child_cfg(private_peer_cfg_t *this,
 									 host_t *my_host, host_t *other_host)
 {
 	child_cfg_t *current, *found = NULL;
-	iterator_t *iterator;
+	enumerator_t *enumerator;
-	iterator = create_child_cfg_iterator(this);
+	enumerator = create_child_cfg_enumerator(this);
-	while (iterator->iterate(iterator, (void**)&current))
+	while (enumerator->enumerate(enumerator, &current))
 	{
 		if (contains_ts(current, TRUE, my_ts, my_host) &&
 			contains_ts(current, FALSE, other_ts, other_host))
@@ -280,7 +278,7 @@ static child_cfg_t* select_child_cfg(private_peer_cfg_t *this,
 			break;
 		}
 	}
-	iterator->destroy(iterator);
+	enumerator->destroy(enumerator);
 	return found;
 }
@@ -300,30 +298,6 @@ static identification_t *get_other_id(private_peer_cfg_t *this)
 	return this->other_id;
 }
 /**
 * Implementation of peer_cfg_t.get_my_ca
 */
 static identification_t *get_my_ca(private_peer_cfg_t *this)
 {
 	return this->my_ca;
 }
 /**
 * Implementation of peer_cfg_t.get_other_ca
 */
 static identification_t *get_other_ca(private_peer_cfg_t *this)
 {
 	return this->other_ca;
 }
 /**
 * Implementation of peer_cfg_t.get_groups
 */
 static linked_list_t *get_groups(private_peer_cfg_t *this)
 {
 	return this->groups;
 }
 /**
 * Implementation of peer_cfg_t.get_cert_policy.
 */
@@ -452,6 +426,14 @@ static host_t* get_other_virtual_ip(private_peer_cfg_t *this, host_t *suggestion
 	}
 	return suggestion->clone(suggestion);
 }
 /**
 * Implementation of peer_cfg_t.get_auth.
 */
 static auth_info_t* get_auth(private_peer_cfg_t *this)
 {
 	return this->auth;
 }
 #ifdef P2P
 /**
@@ -502,15 +484,13 @@ static void destroy(private_peer_cfg_t *this)
 		this->child_cfgs->destroy_offset(this->child_cfgs, offsetof(child_cfg_t, destroy));
 		this->my_id->destroy(this->my_id);
 		this->other_id->destroy(this->other_id);
 		DESTROY_IF(this->my_ca);
 		DESTROY_IF(this->other_ca);
 		DESTROY_IF(this->my_virtual_ip);
 		DESTROY_IF(this->other_virtual_ip);
 		this->auth->destroy(this->auth);
 #ifdef P2P
 		DESTROY_IF(this->p2p_mediated_by);
 		DESTROY_IF(this->peer_id);
 #endif /* P2P */
 		ietfAttr_list_destroy(this->groups);
 		free(this->name);
 		free(this);
 	}
@@ -521,8 +501,7 @@ static void destroy(private_peer_cfg_t *this)
 */
 peer_cfg_t *peer_cfg_create(char *name, u_int ike_version, ike_cfg_t *ike_cfg,
 							identification_t *my_id, identification_t *other_id,
-							identification_t *my_ca, identification_t *other_ca,
+							cert_policy_t cert_policy,
 							linked_list_t *groups, cert_policy_t cert_policy,
 							auth_method_t auth_method, eap_type_t eap_type,
 							u_int32_t eap_vendor,
 							u_int32_t keyingtries, u_int32_t rekey_time,
@@ -540,13 +519,11 @@ peer_cfg_t *peer_cfg_create(char *name, u_int ike_version, ike_cfg_t *ike_cfg,
 	this->public.get_ike_version = (u_int(*) (peer_cfg_t *))get_ike_version;	
 	this->public.get_ike_cfg = (ike_cfg_t* (*) (peer_cfg_t *))get_ike_cfg;
 	this->public.add_child_cfg = (void (*) (peer_cfg_t *, child_cfg_t*))add_child_cfg;
-	this->public.create_child_cfg_iterator = (iterator_t* (*) (peer_cfg_t *))create_child_cfg_iterator;
+	this->public.remove_child_cfg = (void(*)(peer_cfg_t*, enumerator_t*))remove_child_cfg;
 	this->public.create_child_cfg_enumerator = (enumerator_t* (*) (peer_cfg_t *))create_child_cfg_enumerator;
 	this->public.select_child_cfg = (child_cfg_t* (*) (peer_cfg_t *,linked_list_t*,linked_list_t*,host_t*,host_t*))select_child_cfg;
 	this->public.get_my_id = (identification_t* (*)(peer_cfg_t*))get_my_id;
 	this->public.get_other_id = (identification_t* (*)(peer_cfg_t *))get_other_id;
 	this->public.get_my_ca = (identification_t* (*)(peer_cfg_t *))get_my_ca;
 	this->public.get_other_ca = (identification_t* (*)(peer_cfg_t *))get_other_ca;
 	this->public.get_groups = (linked_list_t* (*)(peer_cfg_t *))get_groups;
 	this->public.get_cert_policy = (cert_policy_t (*) (peer_cfg_t *))get_cert_policy;
 	this->public.get_auth_method = (auth_method_t (*) (peer_cfg_t *))get_auth_method;
 	this->public.get_eap_type = (eap_type_t (*) (peer_cfg_t *,u_int32_t*))get_eap_type;
@@ -559,6 +536,7 @@ peer_cfg_t *peer_cfg_create(char *name, u_int ike_version, ike_cfg_t *ike_cfg,
 	this->public.get_dpd_action = (dpd_action_t (*) (peer_cfg_t *))get_dpd_action;
 	this->public.get_my_virtual_ip = (host_t* (*) (peer_cfg_t *))get_my_virtual_ip;
 	this->public.get_other_virtual_ip = (host_t* (*) (peer_cfg_t *, host_t *))get_other_virtual_ip;
 	this->public.get_auth = (auth_info_t*(*)(peer_cfg_t*))get_auth;
 	this->public.get_ref = (void(*)(peer_cfg_t *))get_ref;
 	this->public.destroy = (void(*)(peer_cfg_t *))destroy;
 #ifdef P2P	
@@ -575,9 +553,6 @@ peer_cfg_t *peer_cfg_create(char *name, u_int ike_version, ike_cfg_t *ike_cfg,
 	pthread_mutex_init(&this->mutex, NULL);
 	this->my_id = my_id;
 	this->other_id = other_id;
 	this->my_ca = my_ca;
 	this->other_ca = other_ca;
 	this->groups = groups;
 	this->cert_policy = cert_policy;
 	this->auth_method = auth_method;
 	this->eap_type = eap_type;
@@ -600,11 +575,15 @@ peer_cfg_t *peer_cfg_create(char *name, u_int ike_version, ike_cfg_t *ike_cfg,
 	this->dpd_action = dpd_action;
 	this->my_virtual_ip = my_virtual_ip;
 	this->other_virtual_ip = other_virtual_ip;
 	this->auth = auth_info_create();
 	this->refcount = 1;
 #ifdef P2P
 	this->p2p_mediation = p2p_mediation;
 	this->p2p_mediated_by = p2p_mediated_by;
 	this->peer_id = peer_id;
 #else /* P2P */
 	DESTROY_IF(p2p_mediated_by);
 	DESTROY_IF(peer_id);
 #endif /* P2P */
 	return &this->public;
@@ -1,10 +1,3 @@
 /**
 * @file peer_cfg.h
 * 
 * @brief Interface of peer_cfg_t.
 *
 */
 /*
 * Copyright (C) 2007 Tobias Brunner
 * Copyright (C) 2005-2007 Martin Willi
@@ -20,6 +13,13 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup peer_cfg peer_cfg
 * @{ @ingroup config
 */
 #ifndef PEER_CFG_H_
@@ -31,21 +31,20 @@ typedef struct peer_cfg_t peer_cfg_t;
 #include <library.h>
 #include <utils/identification.h>
-#include <utils/linked_list.h>
+#include <utils/enumerator.h>
 #include <config/traffic_selector.h>
 #include <config/proposal.h>
 #include <config/ike_cfg.h>
 #include <config/child_cfg.h>
 #include <sa/authenticators/authenticator.h>
 #include <sa/authenticators/eap/eap_method.h>
 #include <credentials/auth_info.h>
 /**
 * Certificate sending policy. This is also used for certificate
 * requests when using this definition for the other peer. If
 * it is CERT_NEVER_SEND, a certreq is omitted, otherwise its
 * included.
 *
 * @ingroup config
 * 
 * @warning These definitions must be the same as in pluto/starter,
 * as they are sent over the stroke socket.
@@ -61,17 +60,13 @@ enum cert_policy_t {
 /**
 * enum strings for cert_policy_t
 * 
 * @ingroup config
 */
 extern enum_name_t *cert_policy_names;
 /**
- * @brief Actions to take when a peer does not respond (dead peer detected).
+ * Actions to take when a peer does not respond (dead peer detected).
 *
 * These values are the same as in pluto/starter, so do not modify them!
 *
 * @ingroup config
 */
 enum dpd_action_t {
 	/** DPD disabled */
@@ -90,7 +85,7 @@ enum dpd_action_t {
 extern enum_name_t *dpd_action_names;
 /**
- * @brief Configuration of a peer, specified by IDs.
+ * Configuration of a peer, specified by IDs.
 *
 * The peer config defines a connection between two given IDs. It contains
 * exactly one ike_cfg_t, which is use for initiation. Additionally, it contains
@@ -106,61 +101,67 @@ extern enum_name_t *dpd_action_names;
   | - ...         |       | - dpd config      |         | - ...         |-+
   +---------------+       | - ...             |         +---------------+
                           +-------------------+
                                     ^
                                     |
                           +-------------------+
                           |     auth_info     |
                           +-------------------+
                           |     auth_items    |
                           +-------------------+
   @endverbatim
- *
+ * The auth_info_t object associated to the peer_cfg holds additional
- * @b Constructors:
+ * authorization constraints. A peer who wants to use a config needs to fullfil
- *   - peer_cfg_create()
+ * the requirements defined in auth_info.
 *
 * @ingroup config
 */
 struct peer_cfg_t {
 	/**
-	 * @brief Get the name of the peer_cfg.
+	 * Get the name of the peer_cfg.
 	 * 
 	 * Returned object is not getting cloned.
 	 * 
 	 * @param this			calling object
 	 * @return				peer_cfg's name
 	 */
 	char* (*get_name) (peer_cfg_t *this);
 	/**
-	 * @brief Get the IKE version to use for initiating.
+	 * Get the IKE version to use for initiating.
 	 *
 	 * @param this			calling object
 	 * @return 				IKE major version
 	 */
 	u_int (*get_ike_version)(peer_cfg_t *this);
 	/**
-	 * @brief Get the IKE config to use for initiaton.
+	 * Get the IKE config to use for initiaton.
 	 * 
 	 * @param this			calling object
 	 * @return				the IKE config to use
 	 */
 	ike_cfg_t* (*get_ike_cfg) (peer_cfg_t *this);
 	/**
-	 * @brief Attach a CHILD config.
+	 * Attach a CHILD config.
 	 * 
 	 * @param this			calling object
 	 * @param child_cfg		CHILD config to add
 	 */
 	void (*add_child_cfg) (peer_cfg_t *this, child_cfg_t *child_cfg);
 	/**
-	 * @brief Create an iterator for all attached CHILD configs.
+	 * Detach a CHILD config, pointed to by an enumerator.
-	 * 
+	 *
-	 * @param this			calling object
+	 * @param enumerator	enumerator indicating element position
 	 * @return				an iterator over all CHILD configs.
 	 */
-	iterator_t* (*create_child_cfg_iterator) (peer_cfg_t *this);
+	void (*remove_child_cfg)(peer_cfg_t *this, enumerator_t *enumerator);
 	/**
-	 * @brief Select a CHILD config from traffic selectors.
+	 * Create an enumerator for all attached CHILD configs.
 	 * 
 	 * @return				an enumerator over all CHILD configs.
 	 */
 	enumerator_t* (*create_child_cfg_enumerator) (peer_cfg_t *this);
 	/**
 	 * Select a CHILD config from traffic selectors.
 	 * 
 	 * @param this			calling object
 	 * @param my_ts			TS for local side
 	 * @param other_ts		TS for remote side
 	 * @param my_host		host to narrow down dynamic TS for local side
@@ -172,213 +173,175 @@ struct peer_cfg_t {
 									  host_t *other_host);
 	/**
-	 * @brief Get own ID.
+	 * Get the authentication constraint items.
 	 *
 	 * @return				auth_info object to manipulate requirements
 	 */
 	auth_info_t* (*get_auth)(peer_cfg_t *this);
 	/**
 	 * Get own ID.
 	 * 
 	 * @param this			calling object
 	 * @return				own id
 	 */
 	identification_t* (*get_my_id)(peer_cfg_t *this);
 	/**
-	 * @brief Get peers ID.
+	 * Get peers ID.
 	 * 
 	 * @param this			calling object
 	 * @return				other id
 	 */
 	identification_t* (*get_other_id)(peer_cfg_t *this);
 	/**
 	 * @brief Get own CA.
 	 * 
 	 * @param this			calling object
 	 * @return				own ca
 	 */
 	identification_t* (*get_my_ca)(peer_cfg_t *this);
 	/**
-	 * @brief Get peer CA.
+	 * Should be sent a certificate for this connection?
 	 * 
 	 * @param this			calling object
 	 * @return				other ca
 	 */
 	identification_t* (*get_other_ca)(peer_cfg_t *this);
 	/**
 	 * @brief Get list of group attributes.
 	 * 
 	 * @param this			calling object
 	 * @return				linked list of group attributes
 	 */
 	linked_list_t* (*get_groups)(peer_cfg_t *this);
 	/**
 	 * @brief Should be sent a certificate for this connection?
 	 *
 	 * @param this		calling object
 	 * @return			certificate sending policy
 	 */
 	cert_policy_t (*get_cert_policy) (peer_cfg_t *this);
 	/**
-	 * @brief Get the authentication method to use to authenticate us.
+	 * Get the authentication method to use to authenticate us.
 	 * 
 	 * @param this		calling object
 	 * @return			authentication method
 	 */
 	auth_method_t (*get_auth_method) (peer_cfg_t *this);
 	/**
-	 * @brief Get the EAP type to use for peer authentication.
+	 * Get the EAP type to use for peer authentication.
 	 *
 	 * If vendor specific types are used, a vendor ID != 0 is returned to
 	 * to vendor argument. Then the returned type is specific for that 
 	 * vendor ID.
 	 * 
 	 * @param this		calling object
 	 * @param vendor	receives vendor specifier, 0 for predefined EAP types
 	 * @return			authentication method
 	 */
 	eap_type_t (*get_eap_type) (peer_cfg_t *this, u_int32_t *vendor);
 	/**
-	 * @brief Get the max number of retries after timeout.
+	 * Get the max number of retries after timeout.
 	 *
 	 * @param this		calling object
 	 * @return			max number retries
 	 */
 	u_int32_t (*get_keyingtries) (peer_cfg_t *this);
 	/**
-	 * @brief Get a time to start rekeying (is randomized with jitter).
+	 * Get a time to start rekeying (is randomized with jitter).
 	 *
 	 * @param this		calling object
 	 * @return			time in s when to start rekeying, 0 disables rekeying
 	 */
 	u_int32_t (*get_rekey_time)(peer_cfg_t *this);
 	/**
-	 * @brief Get a time to start reauthentication (is randomized with jitter).
+	 * Get a time to start reauthentication (is randomized with jitter).
 	 *
 	 * @param this		calling object
 	 * @return			time in s when to start reauthentication, 0 disables it
 	 */
 	u_int32_t (*get_reauth_time)(peer_cfg_t *this);
 	/**
-	 * @brief Get the timeout of a rekeying/reauthenticating SA.
+	 * Get the timeout of a rekeying/reauthenticating SA.
 	 *
 	 * @param thsi		calling object
 	 * @return			timeout in s
 	 */
 	u_int32_t (*get_over_time)(peer_cfg_t *this);
 	/**
-	 * @brief Use MOBIKE (RFC4555) if peer supports it?
+	 * Use MOBIKE (RFC4555) if peer supports it?
 	 * 
 	 * @param this		calling object
 	 * @return			TRUE to enable MOBIKE support
 	 */
 	bool (*use_mobike) (peer_cfg_t *this);
 	/**
-	 * @brief Get the DPD check interval.
+	 * Get the DPD check interval.
 	 * 
 	 * @param this		calling object
 	 * @return			dpd_delay in seconds
 	 */
 	u_int32_t (*get_dpd_delay) (peer_cfg_t *this);
 	/**
-	 * @brief What should be done with a CHILD_SA, when other peer does not respond.
+	 * What should be done with a CHILD_SA, when other peer does not respond.
 	 *
 	 * @param this 		calling object
 	 * @return			dpd action
 	 */	
 	dpd_action_t (*get_dpd_action) (peer_cfg_t *this);
 	/**
-	 * @brief Get a virtual IP for the local peer.
+	 * Get a virtual IP for the local peer.
 	 *
 	 * If no virtual IP should be used, NULL is returned. %any means to request
 	 * a virtual IP using configuration payloads. A specific address is also
 	 * used for a request and may be changed by the server.
 	 *
 	 * @param this			peer_cfg
 	 * @param suggestion	NULL, %any or specific
 	 * @return				clone of an IP, %any or NULL
 	 */
 	host_t* (*get_my_virtual_ip) (peer_cfg_t *this);
 	/**
-	 * @brief Get a virtual IP for the remote peer.
+	 * Get a virtual IP for the remote peer.
 	 *
 	 * An IP may be supplied, if one was requested by the initiator. However,
 	 * the suggestion is not more as it says, any address may be returned, even
 	 * NULL to not use virtual IPs.
 	 *
 	 * @param this			peer_cfg
 	 * @param suggestion	NULL, %any or specific
 	 * @return				clone of an IP to use
 	 */
 	host_t* (*get_other_virtual_ip) (peer_cfg_t *this, host_t *suggestion);
-
+	
 #ifdef P2P	
 	/**
-	 * @brief Is this a mediation connection?
+	 * Is this a mediation connection?
 	 * 
 	 * @param this			peer_cfg
 	 * @return				TRUE, if this is a mediation connection
 	 */
 	bool (*is_mediation) (peer_cfg_t *this);
 	/**
-	 * @brief Get peer_cfg of the connection this one is mediated through.
+	 * Get peer_cfg of the connection this one is mediated through.
 	 * 
 	 * @param this			peer_cfg
 	 * @return				reference to peer_cfg of the mediation connection
 	 */
 	peer_cfg_t* (*get_mediated_by) (peer_cfg_t *this);
 	/**
-	 * @brief Get the id of the other peer at the mediation server.
+	 * Get the id of the other peer at the mediation server.
 	 * 
 	 * This is the leftid of the peer's connection with the mediation server.
 	 * 
 	 * If it is not configured, it is assumed to be the same as the right id
 	 * of this connection. 
 	 * 
 	 * @param this			peer_cfg
 	 * @return				the id of the other peer
 	 */
 	identification_t* (*get_peer_id) (peer_cfg_t *this);
 #endif /* P2P */
 	/**
-	 * @brief Get a new reference.
+	 * Get a new reference.
 	 *
 	 * Get a new reference to this peer_cfg by increasing
 	 * it's internal reference counter.
 	 * Do not call get_ref or any other function until you
 	 * already have a reference. Otherwise the object may get
 	 * destroyed while calling get_ref(),
 	 * 
 	 * @param this				calling object
 	 */
 	void (*get_ref) (peer_cfg_t *this);
 	/**
-	 * @brief Destroys the peer_cfg object.
+	 * Destroys the peer_cfg object.
 	 *
 	 * Decrements the internal reference counter and
 	 * destroys the peer_cfg when it reaches zero.
 	 * 
 	 * @param this				calling object
 	 */
 	void (*destroy) (peer_cfg_t *this);
 };
 /**
- * @brief Create a configuration object for IKE_AUTH and later.
+ * Create a configuration object for IKE_AUTH and later.
 * 
 * name-string gets cloned, ID's not.
 * Virtual IPs are used if they are != NULL. A %any host means the virtual
@@ -392,9 +355,6 @@ struct peer_cfg_t {
 * @param ike_cfg			IKE config to use when acting as initiator
 * @param my_id 			identification_t for ourselves
 * @param other_id 			identification_t for the remote guy
 * @param my_ca				CA to use for us
 * @param other_ca			CA to use for other
 * @param groups			list of group memberships
 * @param cert_policy		should we send a certificate payload?
 * @param auth_method		auth method to use to authenticate us
 * @param eap_type			EAP type to use for peer authentication
@@ -414,13 +374,10 @@ struct peer_cfg_t {
 * @param p2p_mediated_by	name of the mediation connection to mediate through
 * @param peer_id			ID that identifies our peer at the mediation server
 * @return 					peer_cfg_t object
 * 
 * @ingroup config
 */
 peer_cfg_t *peer_cfg_create(char *name, u_int ikev_version, ike_cfg_t *ike_cfg,
 							identification_t *my_id, identification_t *other_id,
-							identification_t *my_ca, identification_t *other_ca,
+							cert_policy_t cert_policy,
 							linked_list_t *groups, cert_policy_t cert_policy,
 							auth_method_t auth_method, eap_type_t eap_type,
 							u_int32_t eap_vendor,
 							u_int32_t keyingtries, u_int32_t rekey_time,
@@ -431,4 +388,4 @@ peer_cfg_t *peer_cfg_create(char *name, u_int ikev_version, ike_cfg_t *ike_cfg,
 							bool p2p_mediation, peer_cfg_t *p2p_mediated_by,
 							identification_t *peer_id);
-#endif /* PEER_CFG_H_ */
+#endif /* PEER_CFG_H_ @} */
@@ -1,10 +1,3 @@
 /**
 * @file proposal.c
 * 
 * @brief Implementation of proposal_t.
 * 
 */
 /*
 * Copyright (C) 2006 Martin Willi
 * Hochschule fuer Technik Rapperswil
@@ -18,6 +11,8 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include <string.h>
@@ -1,10 +1,3 @@
 /**
 * @file proposal.h
 *
 * @brief Interface of proposal_t.
 *
 */
 /*
 * Copyright (C) 2006 Martin Willi
 * Hochschule fuer Technik Rapperswil
@@ -18,6 +11,13 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup proposal proposal
 * @{ @ingroup config
 */
 #ifndef PROPOSAL_H_
@@ -40,8 +40,6 @@ typedef struct proposal_t proposal_t;
 /**
 * Protocol ID of a proposal.
 *
 * @ingroup config
 */
 enum protocol_id_t {
 	PROTO_NONE = 0,
@@ -52,16 +50,12 @@ enum protocol_id_t {
 /**
 * enum names for protocol_id_t
 *
 * @ingroup config
 */
 extern enum_name_t *protocol_id_names;
 /**
 * Type of a transform, as in IKEv2 RFC 3.3.2.
 *
 * @ingroup config
 */
 enum transform_type_t {
 	UNDEFINED_TRANSFORM_TYPE = 241,
@@ -74,16 +68,12 @@ enum transform_type_t {
 /**
 * enum names for transform_type_t.
 *
 * @ingroup config
 */
 extern enum_name_t *transform_type_names;
 /**
 * Extended sequence numbers, as in IKEv2 RFC 3.3.2.
 *
 * @ingroup config
 */
 enum extended_sequence_numbers_t {
 	NO_EXT_SEQ_NUMBERS = 0,
@@ -92,8 +82,6 @@ enum extended_sequence_numbers_t {
 /**
 * enum strings for extended_sequence_numbers_t.
 *
 * @ingroup config
 */
 extern enum_name_t *extended_sequence_numbers_names;
@@ -102,8 +90,6 @@ extern enum_name_t *extended_sequence_numbers_names;
 /**
 * Struct used to store different kinds of algorithms. The internal
 * lists of algorithms contain such structures.
 *
 * @ingroup config
 */
 struct algorithm_t {
 	/**
@@ -118,22 +104,17 @@ struct algorithm_t {
 };
 /**
- * @brief Stores a set of algorithms used for an SA.
+ * Stores a set of algorithms used for an SA.
 * 
 * A proposal stores algorithms for a specific 
 * protocol. It can store algorithms for one protocol.
 * Proposals with multiple protocols are not supported,
 * as it's not specified in RFC4301 anymore.
 * 
 * @b Constructors:
 *   - proposal_create()
 * 
 * @ingroup config
 */
 struct proposal_t {
 	/**
-	 * @brief Add an algorithm to the proposal.
+	 * Add an algorithm to the proposal.
 	 * 
 	 * The algorithms are stored by priority, first added
 	 * is the most preferred.
@@ -144,120 +125,103 @@ struct proposal_t {
 	 * integrity_algorithm_t, dh_group_number_t and
 	 * extended_sequence_numbers_t.
 	 * 
-	 * @param this					calling object
+	 * @param type			kind of algorithm
-	 * @param type					kind of algorithm
+	 * @param alg			identifier for algorithm
-	 * @param alg					identifier for algorithm
+	 * @param key_size		key size to use
 	 * @param key_size				key size to use
 	 */
 	void (*add_algorithm) (proposal_t *this, transform_type_t type, u_int16_t alg, size_t key_size);
 	/**
-	 * @brief Get an iterator over algorithms for a specifc algo type.
+	 * Get an iterator over algorithms for a specifc algo type.
 	 * 
-	 * @param this					calling object
+	 * @param type			kind of algorithm
-	 * @param type					kind of algorithm
+	 * @return				iterator over algorithm_t's
 	 * @return						iterator over algorithm_t's
 	 */
 	iterator_t *(*create_algorithm_iterator) (proposal_t *this, transform_type_t type);
 	/**
-	 * @brief Get the algorithm for a type to use.
+	 * Get the algorithm for a type to use.
 	 * 
 	 * If there are multiple algorithms, only the first is returned.
 	 * 
-	 * @param this					calling object
+	 * @param type			kind of algorithm
-	 * @param type					kind of algorithm
+	 * @param algo			pointer which receives algorithm and key size
-	 * @param[out] algo				pointer which receives algorithm and key size
+	 * @return				TRUE if algorithm of this kind available
 	 * @return						TRUE if algorithm of this kind available
 	 */
 	bool (*get_algorithm) (proposal_t *this, transform_type_t type, algorithm_t** algo);
 	/**
-	 * @brief Check if the proposal has a specific DH group.
+	 * Check if the proposal has a specific DH group.
 	 * 
-	 * @param this					calling object
+	 * @param group			group to check for
-	 * @param group					group to check for
+	 * @return				TRUE if algorithm included
 	 * @return						TRUE if algorithm included
 	 */
 	bool (*has_dh_group) (proposal_t *this, diffie_hellman_group_t group);
 	/**
-	 * @brief Compare two proposal, and select a matching subset.
+	 * Compare two proposal, and select a matching subset.
 	 * 
 	 * If the proposals are for the same protocols (AH/ESP), they are
 	 * compared. If they have at least one algorithm of each type
 	 * in common, a resulting proposal of this kind is created.
 	 * 
-	 * @param this					calling object
+	 * @param other			proposal to compair agains
-	 * @param other					proposal to compair agains
+	 * @return				selected proposal, NULL if proposals don't match
 	 * @return						
 	 * 								- selected proposal, if possible
 	 * 								- NULL, if proposals don't match
 	 */
 	proposal_t *(*select) (proposal_t *this, proposal_t *other);
 	/**
-	 * @brief Get the protocol ID of the proposal.
+	 * Get the protocol ID of the proposal.
 	 *
-	 * @param this				calling object
+	 * @return				protocol of the proposal
 	 * @return					protocol of the proposal
 	 */
 	protocol_id_t (*get_protocol) (proposal_t *this);
 	/**
-	 * @brief Get the SPI of the proposal.
+	 * Get the SPI of the proposal.
 	 * 
-	 * @param this				calling object
+	 * @return				spi for proto
 	 * @return					spi for proto
 	 */
 	u_int64_t (*get_spi) (proposal_t *this);
 	/**
-	 * @brief Set the SPI of the proposal.
+	 * Set the SPI of the proposal.
 	 * 
-	 * @param this				calling object
+	 * @param spi			spi to set for proto
 	 * @param spi				spi to set for proto
 	 */
 	void (*set_spi) (proposal_t *this, u_int64_t spi);
 	/**
-	 * @brief Clone a proposal.
+	 * Clone a proposal.
 	 * 
-	 * @param this				proposal to clone
+	 * @return				clone of proposal
 	 * @return					clone of it
 	 */
 	proposal_t *(*clone) (proposal_t *this);
 	/**
-	 * @brief Destroys the proposal object.
+	 * Destroys the proposal object.
 	 * 
 	 * @param this				calling object
 	 */
 	void (*destroy) (proposal_t *this);
 };
 /**
- * @brief Create a child proposal for AH, ESP or IKE.
+ * Create a child proposal for AH, ESP or IKE.
 *
 * @param protocol			protocol, such as PROTO_ESP
 * @return 					proposal_t object
 *
 * @ingroup config
 */
 proposal_t *proposal_create(protocol_id_t protocol);
 /**
- * @brief Create a default proposal if nothing further specified.
+ * Create a default proposal if nothing further specified.
 *
 * @param protocol			protocol, such as PROTO_ESP
 * @return 					proposal_t object
 *
 * @ingroup config
 */
 proposal_t *proposal_create_default(protocol_id_t protocol);
 /**
- * @brief Create a proposal from a string identifying the algorithms.
+ * Create a proposal from a string identifying the algorithms.
 *
 * The string is in the same form as a in the ipsec.conf file.
 * E.g.:	aes128-sha2_256-modp2048
@@ -268,9 +232,7 @@ proposal_t *proposal_create_default(protocol_id_t protocol);
 * @param protocol			protocol, such as PROTO_ESP
 * @param algs				algorithms as string
 * @return 					proposal_t object
 * 
 * @ingroup config
 */
 proposal_t *proposal_create_from_string(protocol_id_t protocol, const char *algs);
-#endif /* PROPOSAL_H_ */
+#endif /* PROPOSAL_H_ @} */
@@ -1,10 +1,3 @@
 /**
 * @file traffic_selector.c
 * 
 * @brief Implementation of traffic_selector_t.
 * 
 */
 /*
 * Copyright (C) 2007 Tobias Brunner
 * Copyright (C) 2005-2007 Martin Willi
@@ -20,6 +13,8 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include <arpa/inet.h>
@@ -276,11 +271,25 @@ static int print(FILE *stream, const struct printf_info *info,
 }
 /**
- * register printf() handlers
+ * arginfo handler for printf() traffic selector
 */
-static void __attribute__ ((constructor))print_register()
+static int arginfo(const struct printf_info *info, size_t n, int *argtypes)
 {
-	register_printf_function(PRINTF_TRAFFIC_SELECTOR, print, arginfo_ptr);
+	if (n > 0)
 	{
 		argtypes[0] = PA_POINTER;
 	}
 	return 1;
 }
 /**
 * return printf hook functions for a chunk
 */
 printf_hook_functions_t traffic_selector_get_printf_hooks()
 {
 	printf_hook_functions_t hooks = {print, arginfo};
 	return hooks;
 }
 /**
@@ -1,10 +1,3 @@
 /**
 * @file traffic_selector.h
 * 
 * @brief Interface of traffic_selector_t.
 *  
 */
 /*
 * Copyright (C) 2007 Tobias Brunner
 * Copyright (C) 2005-2006 Martin Willi
@@ -20,6 +13,13 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup traffic_selector traffic_selector
 * @{ @ingroup config
 */
 #ifndef TRAFFIC_SELECTOR_H_
@@ -33,8 +33,6 @@ typedef struct traffic_selector_t traffic_selector_t;
 /**
 * Traffic selector types.
 * 
 * @ingroup config
 */
 enum ts_type_t {
@@ -63,29 +61,20 @@ enum ts_type_t {
 extern enum_name_t *ts_type_name;
 /**
- * @brief Object representing a traffic selector entry.
+ * Object representing a traffic selector entry.
 *
 * A traffic selector defines an range of addresses
 * and a range of ports. IPv6 is not fully supported yet.
 *
 * @b Constructors:
 * - traffic_selector_create_from_bytes()
 * - traffic_selector_create_from_string()
 *
 * @todo Add IPv6 support
 *
 * @ingroup config
 */
 struct traffic_selector_t {
 	/**
-	 * @brief Compare two traffic selectors, and create a new one
+	 * Compare two traffic selectors, and create a new one
 	 * which is the largest subset of both (subnet & port).
 	 *
 	 * Resulting traffic_selector is newly created and must be destroyed.
 	 *
-	 * @param this		first to compare
+	 * @param other		traffic selector to compare
 	 * @param other		second to compare
 	 * @return
 	 * 					- created subset of them
 	 * 					- or NULL if no match between this and other
@@ -94,73 +83,66 @@ struct traffic_selector_t {
 										traffic_selector_t *other);
 	/**
-	 * @brief Clone a traffic selector.
+	 * Clone a traffic selector.
 	 *
 	 * @param this		traffic selector to clone
 	 * @return			clone of it
 	 */
 	traffic_selector_t *(*clone) (traffic_selector_t *this);
 	/**
-	 * @brief Get starting address of this ts as a chunk.
+	 * Get starting address of this ts as a chunk.
 	 *
 	 * Chunk is in network order gets allocated.
 	 *
 	 * @param this		called object
 	 * @return			chunk containing the address
 	 */
 	chunk_t (*get_from_address) (traffic_selector_t *this);
 	/**
-	 * @brief Get ending address of this ts as a chunk.
+	 * Get ending address of this ts as a chunk.
 	 *
 	 * Chunk is in network order gets allocated.
 	 *
 	 * @param this		called object
 	 * @return			chunk containing the address
 	 */
 	chunk_t (*get_to_address) (traffic_selector_t *this);
 	/**
-	 * @brief Get starting port of this ts.
+	 * Get starting port of this ts.
 	 * 
 	 * Port is in host order, since the parser converts it.
 	 * Size depends on protocol.
 	 *  
 	 * @param this		called object
 	 * @return			port
 	 */
 	u_int16_t (*get_from_port) (traffic_selector_t *this);
 	/**
-	 * @brief Get ending port of this ts.
+	 * Get ending port of this ts.
 	 *
 	 * Port is in host order, since the parser converts it.
 	 * Size depends on protocol.
 	 *
 	 * @param this		called object
 	 * @return			port
 	 */
 	u_int16_t (*get_to_port) (traffic_selector_t *this);
 	/**
-	 * @brief Get the type of the traffic selector.
+	 * Get the type of the traffic selector.
 	 *
 	 * @param this		called object
 	 * @return			ts_type_t specifying the type
 	 */
 	ts_type_t (*get_type) (traffic_selector_t *this);
 	/**
-	 * @brief Get the protocol id of this ts.
+	 * Get the protocol id of this ts.
 	 *
 	 * @param this		called object
 	 * @return			protocol id
 	 */
 	u_int8_t (*get_protocol) (traffic_selector_t *this);
 	/**
-	 * @brief Check if the traffic selector is for a single host.
+	 * Check if the traffic selector is for a single host.
 	 *
 	 * Traffic selector may describe the end of *-to-host tunnel. In this
 	 * case, the address range is a single address equal to the hosts
@@ -168,61 +150,54 @@ struct traffic_selector_t {
 	 * If host is NULL, the traffic selector is checked if it is a single host,
 	 * but not a specific one.
 	 *
 	 * @param this		called object
 	 * @param host		host_t specifying the address range
 	 */
 	bool (*is_host) (traffic_selector_t *this, host_t* host);
 	/**
-	 * @brief Update the address of a traffic selector.
+	 * Update the address of a traffic selector.
 	 *
 	 * Update the address range of a traffic selector, if it is
 	 * constructed with the traffic_selector_create_dynamic().
 	 *
 	 * @param this		called object
 	 * @param host		host_t specifying the address
 	 */
 	void (*set_address) (traffic_selector_t *this, host_t* host);
 	/**
-	 * @brief Compare two traffic selectors for equality.
+	 * Compare two traffic selectors for equality.
 	 * 
-	 * @param this		first to compare
+	 * @param other		ts to compare with this
 	 * @param other		second to compare with first
 	 * @return 			pointer to a string.
 	 */
 	bool (*equals) (traffic_selector_t *this, traffic_selector_t *other);
 	/**
-	 * @brief Check if a traffic selector is contained completly in another.
+	 * Check if a traffic selector is contained completly in another.
 	 *
 	 * contains() allows to check if multiple traffic selectors are redundant.
 	 *
 	 * @param this		ts that is contained in another
 	 * @param other		ts that contains this
 	 * @return			TRUE if other contains this completly, FALSE otherwise
 	 */
 	bool (*is_contained_in) (traffic_selector_t *this, traffic_selector_t *other);
 	/**
-	 * @brief Check if a specific host is included in the address range of 
+	 * Check if a specific host is included in the address range of 
 	 * this traffic selector.
 	 *
 	 * @param this		called object
 	 * @param host		the host to check
 	 */
 	bool (*includes) (traffic_selector_t *this, host_t *host);
 	/**
-	 * @brief Destroys the ts object
+	 * Destroys the ts object
 	 *
 	 * @param this		called object
 	 */
 	void (*destroy) (traffic_selector_t *this);
 };
 /**
- * @brief Create a new traffic selector using human readable params.
+ * Create a new traffic selector using human readable params.
 * 
 * @param protocol 		protocol for this ts, such as TCP or UDP
 * @param type			type of following addresses, such as TS_IPV4_ADDR_RANGE
@@ -233,8 +208,6 @@ struct traffic_selector_t {
 * @return
 * 						- traffic_selector_t object
 * 						- NULL if invalid address strings/protocol
 * 
 * @ingroup config
 */
 traffic_selector_t *traffic_selector_create_from_string(
 									u_int8_t protocol, ts_type_t type,
@@ -242,7 +215,7 @@ traffic_selector_t *traffic_selector_create_from_string(
 									char *to_addr, u_int16_t to_port);
 /**
- * @brief Create a new traffic selector using data read from the net.
+ * Create a new traffic selector using data read from the net.
 * 
 * There exists a mix of network and host order in the params.
 * But the parser gives us this data in this format, so we
@@ -255,8 +228,6 @@ traffic_selector_t *traffic_selector_create_from_string(
 * @param to_address	end of address range as string, network
 * @param to_port		port number, host order
 * @return				traffic_selector_t object
 *
 * @ingroup config
 */
 traffic_selector_t *traffic_selector_create_from_bytes(
 								u_int8_t protocol, ts_type_t type,
@@ -264,7 +235,7 @@ traffic_selector_t *traffic_selector_create_from_bytes(
 								chunk_t to_address, u_int16_t to_port);
 /**
- * @brief Create a new traffic selector defining a whole subnet.
+ * Create a new traffic selector defining a whole subnet.
 * 
 * In most cases, definition of a traffic selector for full subnets
 * is sufficient. This constructor creates a traffic selector for
@@ -278,15 +249,13 @@ traffic_selector_t *traffic_selector_create_from_bytes(
 * @return
 * 						- traffic_selector_t object
 * 						- NULL if address family of net not supported
 *
 * @ingroup config
 */
 traffic_selector_t *traffic_selector_create_from_subnet(
 									host_t *net, u_int8_t netbits, 
 									u_int8_t protocol, u_int16_t port);
 /**
- * @brief Create a traffic selector for host-to-host cases.
+ * Create a traffic selector for host-to-host cases.
 * 
 * For host2host or virtual IP setups, the traffic selectors gets
 * created at runtime using the external/virtual IP. Using this constructor,
@@ -300,13 +269,19 @@ traffic_selector_t *traffic_selector_create_from_subnet(
 * @return
 * 						- traffic_selector_t object
 * 						- NULL if type not supported
 *
 * @ingroup config
 */
 traffic_selector_t *traffic_selector_create_dynamic(
 									u_int8_t protocol, ts_type_t type,
 									u_int16_t from_port, u_int16_t to_port);
-#endif /* TRAFFIC_SELECTOR_H_ */
+/**
 * Get printf hooks for a traffic selector.
 *
 * Arguments are: 
 *    traffic_selector_t *ts
 * With the #-specifier, arguments are:
 *    linked_list_t *list containing traffic_selector_t*
 */
 printf_hook_functions_t traffic_selector_get_printf_hooks();
-/* vim: set ts=4 sw=4 noet: */
+#endif /* TRAFFIC_SELECTOR_H_ @} */
@@ -1,10 +1,3 @@
 /**
 * @file interface_manager.c
 * 
 * @brief Implementation of interface_manager_t.
 * 
 */
 /*
 * Copyright (C) 2007 Martin Willi
 * Hochschule fuer Technik Rapperswil
@@ -18,9 +11,11 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
-#include "interface_manager.h"
+#include "controller.h"
 #include <sys/types.h>
 #include <dirent.h>
@@ -29,31 +24,20 @@
 #include <daemon.h>
 #include <library.h>
 #include <control/interfaces/interface.h>
-typedef struct private_interface_manager_t private_interface_manager_t;
+typedef struct private_controller_t private_controller_t;
 typedef struct interface_bus_listener_t interface_bus_listener_t;
 /**
 * Private data of an stroke_t object.
 */
-struct private_interface_manager_t {
+struct private_controller_t {
 	/**
 	 * Public part of stroke_t object.
 	 */
-	interface_manager_t public;
+	controller_t public;
 	/**
 	 * a list of all loaded interfaces
 	 */
 	linked_list_t *interfaces;
 	/**
 	 * dlopen() handles of interfaces
 	 */
 	linked_list_t *handles;
 };
@@ -80,7 +64,7 @@ struct interface_bus_listener_t {
 	/**
 	 *  interface callback (listener gets redirected to here)
 	 */
-	interface_manager_cb_t callback;
+	controller_cb_t callback;
 	/**
 	 * user parameter to pass to callback
@@ -130,9 +114,9 @@ static void nop(job_t *job)
 }
 /**
- * Implementation of interface_manager_t.create_ike_sa_iterator.
+ * Implementation of controller_t.create_ike_sa_iterator.
 */
-static iterator_t* create_ike_sa_iterator(interface_manager_t *this)
+static iterator_t* create_ike_sa_iterator(controller_t *this)
 {
 	return charon->ike_sa_manager->create_iterator(charon->ike_sa_manager);
 }
@@ -173,11 +157,11 @@ static status_t initiate_execute(interface_job_t *job)
 	ike_sa_t *ike_sa;
 	interface_bus_listener_t *listener = &job->listener;
 	peer_cfg_t *peer_cfg = listener->peer_cfg;
-
+	
 	ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager,
 														peer_cfg);
 	listener->ike_sa = ike_sa;
-
+	
 	if (ike_sa->get_peer_cfg(ike_sa) == NULL)
 	{
 		ike_sa->set_peer_cfg(ike_sa, peer_cfg);
@@ -193,11 +177,11 @@ static status_t initiate_execute(interface_job_t *job)
 }
 /**
- * Implementation of interface_manager_t.initiate.
+ * Implementation of controller_t.initiate.
 */
-static status_t initiate(private_interface_manager_t *this,
+static status_t initiate(private_controller_t *this,
 						 peer_cfg_t *peer_cfg, child_cfg_t *child_cfg,
-						 interface_manager_cb_t callback, void *param)
+						 controller_cb_t callback, void *param)
 {
 	interface_job_t job;
@@ -273,10 +257,10 @@ static status_t terminate_ike_execute(interface_job_t *job)
 }
 /**
- * Implementation of interface_manager_t.terminate_ike.
+ * Implementation of controller_t.terminate_ike.
 */
-static status_t terminate_ike(interface_manager_t *this, u_int32_t unique_id, 
+static status_t terminate_ike(controller_t *this, u_int32_t unique_id, 
-							  interface_manager_cb_t callback, void *param)
+							  controller_cb_t callback, void *param)
 {
 	interface_job_t job;
@@ -375,10 +359,10 @@ static status_t terminate_child_execute(interface_job_t *job)
 }
 /**
- * Implementation of interface_manager_t.terminate_child.
+ * Implementation of controller_t.terminate_child.
 */
-static status_t terminate_child(interface_manager_t *this, u_int32_t reqid, 
+static status_t terminate_child(controller_t *this, u_int32_t reqid, 
-								interface_manager_cb_t callback, void *param)
+								controller_cb_t callback, void *param)
 {
 	interface_job_t job;
@@ -434,7 +418,6 @@ static status_t route_execute(interface_job_t *job)
 	ike_sa_t *ike_sa;
 	interface_bus_listener_t *listener = &job->listener;
 	peer_cfg_t *peer_cfg = listener->peer_cfg;
 	ike_sa = charon->ike_sa_manager->checkout_by_config(charon->ike_sa_manager,
 														peer_cfg);
 	listener->ike_sa = ike_sa;
@@ -452,11 +435,11 @@ static status_t route_execute(interface_job_t *job)
 }
 /**
- * Implementation of interface_manager_t.route.
+ * Implementation of controller_t.route.
 */
-static status_t route(interface_manager_t *this,
+static status_t route(controller_t *this,
 					  peer_cfg_t *peer_cfg, child_cfg_t *child_cfg,
-					  interface_manager_cb_t callback, void *param)
+					  controller_cb_t callback, void *param)
 {
 	interface_job_t job;
@@ -530,10 +513,10 @@ static status_t unroute_execute(interface_job_t *job)
 }
 /**
- * Implementation of interface_manager_t.unroute.
+ * Implementation of controller_t.unroute.
 */
-static status_t unroute(interface_manager_t *this, u_int32_t reqid, 
+static status_t unroute(controller_t *this, u_int32_t reqid, 
-						interface_manager_cb_t callback, void *param)
+						controller_cb_t callback, void *param)
 {
 	interface_job_t job;
@@ -554,77 +537,10 @@ static status_t unroute(interface_manager_t *this, u_int32_t reqid,
 	return job.listener.status;
 }
 /**
 * load the control interface modules
 */
 static void load_interfaces(private_interface_manager_t *this)
 {
 	struct dirent* entry;
 	DIR* dir;
 	dir = opendir(IPSEC_INTERFACEDIR);
 	if (dir == NULL)
 	{
 		DBG1(DBG_CFG, "error opening interface modules directory "IPSEC_INTERFACEDIR);
 		return;
 	}
 	DBG1(DBG_CFG, "loading control interface modules from '"IPSEC_INTERFACEDIR"'");
 	while ((entry = readdir(dir)) != NULL)
 	{
 		char file[256];
 		interface_t *interface;
 		interface_constructor_t constructor;
 		void *handle;
 		char *ending;
 		snprintf(file, sizeof(file), IPSEC_INTERFACEDIR"/%s", entry->d_name);
 		ending = entry->d_name + strlen(entry->d_name) - 3;
 		if (ending <= entry->d_name || !streq(ending, ".so"))
 		{
 			/* skip anything which does not look like a library */
 			DBG2(DBG_CFG, "  skipping %s, doesn't look like a library",
 				 entry->d_name);
 			continue;
 		}
 		/* try to load the library */
 		handle = dlopen(file, RTLD_LAZY);
 		if (handle == NULL)
 		{
 			DBG1(DBG_CFG, "  opening control interface module %s failed: %s",
 				 entry->d_name, dlerror());
 			continue;
 		}
 		constructor = dlsym(handle, "interface_create");
 		if (constructor == NULL)
 		{
 			DBG1(DBG_CFG, "  interface module %s has no interface_create() "
 				 "function, skipped", entry->d_name);
 			dlclose(handle);
 			continue;
 		}
 		interface = constructor();
 		if (interface == NULL)
 		{
 			DBG1(DBG_CFG, "  unable to create instance of interface "
 				 "module %s, skipped", entry->d_name);
 			dlclose(handle);
 			continue;
 		}
 		DBG1(DBG_CFG, "  loaded control interface module successfully from %s", entry->d_name);
 		this->interfaces->insert_last(this->interfaces, interface);
 		this->handles->insert_last(this->handles, handle);
 	}
 	closedir(dir);
 }
 /**
 * See header
 */
-bool interface_manager_cb_empty(void *param, signal_t signal, level_t level,
+bool controller_cb_empty(void *param, signal_t signal, level_t level,
 								ike_sa_t *ike_sa, char *format, va_list args)
 {
 	return TRUE;
@@ -633,32 +549,25 @@ bool interface_manager_cb_empty(void *param, signal_t signal, level_t level,
 /**
 * Implementation of stroke_t.destroy.
 */
-static void destroy(private_interface_manager_t *this)
+static void destroy(private_controller_t *this)
 {
 	this->interfaces->destroy_offset(this->interfaces, offsetof(interface_t, destroy));
 	this->handles->destroy_function(this->handles, (void*)dlclose);
 	free(this);
 }
 /*
 * Described in header-file
 */
-interface_manager_t *interface_manager_create(void)
+controller_t *controller_create(void)
 {
-	private_interface_manager_t *this = malloc_thing(private_interface_manager_t);
+	private_controller_t *this = malloc_thing(private_controller_t);
-	this->public.create_ike_sa_iterator = (iterator_t*(*)(interface_manager_t*))create_ike_sa_iterator;
+	this->public.create_ike_sa_iterator = (iterator_t*(*)(controller_t*))create_ike_sa_iterator;
-	this->public.initiate = (status_t(*)(interface_manager_t*,peer_cfg_t*,child_cfg_t*,bool(*)(void*,signal_t,level_t,ike_sa_t*,char*,va_list),void*))initiate;
+	this->public.initiate = (status_t(*)(controller_t*,peer_cfg_t*,child_cfg_t*,bool(*)(void*,signal_t,level_t,ike_sa_t*,char*,va_list),void*))initiate;
-	this->public.terminate_ike = (status_t(*)(interface_manager_t*,u_int32_t,interface_manager_cb_t, void*))terminate_ike;
+	this->public.terminate_ike = (status_t(*)(controller_t*,u_int32_t,controller_cb_t, void*))terminate_ike;
-	this->public.terminate_child = (status_t(*)(interface_manager_t*,u_int32_t,interface_manager_cb_t, void *param))terminate_child;
+	this->public.terminate_child = (status_t(*)(controller_t*,u_int32_t,controller_cb_t, void *param))terminate_child;
-	this->public.route = (status_t(*)(interface_manager_t*,peer_cfg_t*, child_cfg_t*,interface_manager_cb_t,void*))route;
+	this->public.route = (status_t(*)(controller_t*,peer_cfg_t*, child_cfg_t*,controller_cb_t,void*))route;
-	this->public.unroute = (status_t(*)(interface_manager_t*,u_int32_t,interface_manager_cb_t,void*))unroute;
+	this->public.unroute = (status_t(*)(controller_t*,u_int32_t,controller_cb_t,void*))unroute;
-	this->public.destroy = (void (*)(interface_manager_t*))destroy;
+	this->public.destroy = (void (*)(controller_t*))destroy;
 	this->interfaces = linked_list_create();
 	this->handles = linked_list_create();
 	load_interfaces(this);
 	return &this->public;
 }
@@ -1,10 +1,3 @@
 /**
 * @file interface_manager.h
 *
 * @brief Interface of interface_manager_t.
 *
 */
 /*
 * Copyright (C) 2007 Martin Willi
 * Hochschule fuer Technik Rapperswil
@@ -18,15 +11,22 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
-#ifndef INTERFACE_MANAGER_H_
+/**
-#define INTERFACE_MANAGER_H_
+ * @defgroup controller_i controller
 * @{ @ingroup control
 */
 #ifndef CONTROLLER_H_
 #define CONTROLLER_H_
 #include <bus/bus.h>
 /**
- * callback to log things triggered by interface_manager.
+ * callback to log things triggered by controller.
 *
 * @param param			echoed parameter supplied when function invoked
 * @param signal		type of signal
@@ -35,74 +35,51 @@
 * @param format		printf like format string
 * @param args			list of arguments to use for format
 * @return				FALSE to return from invoked function
 * @ingroup control
 */
-typedef bool(*interface_manager_cb_t)(void* param, signal_t signal, level_t level,
+typedef bool(*controller_cb_t)(void* param, signal_t signal, level_t level,
 							   ike_sa_t* ike_sa, char* format, va_list args);
 /**
- * @brief Empty callback function for interface_manager_t functions.
+ * Empty callback function for controller_t functions.
 *
 * If you wan't to do a syncrhonous call, but don't need a callback, pass
- * this function to the interface_managers methods.
+ * this function to the controllers methods.
 */
-bool interface_manager_cb_empty(void *param, signal_t signal, level_t level,
+bool controller_cb_empty(void *param, signal_t signal, level_t level,
 								ike_sa_t *ike_sa, char *format, va_list args);
-typedef struct interface_manager_t interface_manager_t;
+typedef struct controller_t controller_t;
 /**
- * @brief The interface_manager loads control interfaces and has helper methods.
+ * The controller provides a simple interface to run actions.
 *
- * One job of the interface manager is to load pluggable control interface
+ * The controller starts actions by creating jobs. It then tries to
 * modules, implemented as interface_t.
 * @verbatim
   +---------+      +------------+         +--------------+     |
   |         |      |            |<----- +--------------+ |     |
   | daemon  |<-----| interface- |     +--------------+ |-+  <==|==> IPC
   |  core   |      | manager    |<----|  interfaces  |-+       |
   |         |<-----|            |     +--------------+         |
   |         |      |            |                              |
   +---------+      +------------+                              |
   @endverbatim
 * The manager does not really use the interfaces, instead, the interface
 * use the manager to fullfill their tasks (initiating, terminating, ...). 
 * The interface_manager starts actions by creating jobs. It then tries to
 * evaluate the result of the operation by listening on the bus.
 *
 * Passing NULL as callback to the managers function calls them asynchronously.
 * If a callback is specified, they are called synchronoulsy. There is a default
- * callback "interface_manager_cb_empty" if you wan't to call a function
+ * callback "controller_cb_empty" if you wan't to call a function
 * synchronously, but don't need a callback.
 * 
 * @b Constructors:
 * - interface_manager_create()
 * 
 * @ingroup control
 */
-struct interface_manager_t {
+struct controller_t {
 	/**
-	 * @brief Create an iterator for all IKE_SAs.
+	 * Create an iterator for all IKE_SAs.
 	 *
 	 * The iterator blocks the IKE_SA manager until it gets destroyed. Do
 	 * not call another interface/manager method while the iterator is alive.
 	 *
 	 * @param this			calling object
 	 * @return				iterator, locks IKE_SA manager until destroyed
 	 */
-	iterator_t* (*create_ike_sa_iterator)(interface_manager_t *this);
+	iterator_t* (*create_ike_sa_iterator)(controller_t *this);
 	/**
-	 * @brief Initiate a CHILD_SA, and if required, an IKE_SA.
+	 * Initiate a CHILD_SA, and if required, an IKE_SA.
 	 *
 	 * The inititate() function is synchronous and thus blocks until the
 	 * IKE_SA is established or failed. Because of this, the initiate() function
 	 * contains a thread cancellation point.
 	 *
 	 * @param this			calling object
 	 * @param peer_cfg		peer_cfg to use for IKE_SA setup
 	 * @param child_cfg		child_cfg to set up CHILD_SA from
 	 * @param cb			logging callback
@@ -112,18 +89,17 @@ struct interface_manager_t {
 	 *						- FAILED, if setup failed
 	 *						- NEED_MORE, if callback returned FALSE
 	 */
-	status_t (*initiate)(interface_manager_t *this,
+	status_t (*initiate)(controller_t *this,
 						 peer_cfg_t *peer_cfg, child_cfg_t *child_cfg,
-						 interface_manager_cb_t callback, void *param);
+						 controller_cb_t callback, void *param);
 	/**
-	 * @brief Terminate an IKE_SA and all of its CHILD_SAs.
+	 * Terminate an IKE_SA and all of its CHILD_SAs.
 	 *
 	 * The terminate() function is synchronous and thus blocks until the
 	 * IKE_SA is properly deleted, or the delete timed out. 
 	 * The terminate() function contains a thread cancellation point.
 	 *
 	 * @param this			calling object
 	 * @param unique_id		unique id of the IKE_SA to terminate.
 	 * @param cb			logging callback
 	 * @param param			parameter to include in each call of cb
@@ -132,13 +108,12 @@ struct interface_manager_t {
 	 *						- NOT_FOUND, if no such CHILD_SA found
 	 *						- NEED_MORE, if callback returned FALSE
 	 */
-	status_t (*terminate_ike)(interface_manager_t *this, u_int32_t unique_id, 
+	status_t (*terminate_ike)(controller_t *this, u_int32_t unique_id, 
-							  interface_manager_cb_t callback, void *param);
+							  controller_cb_t callback, void *param);
 	/**
-	 * @brief Terminate a CHILD_SA.
+	 * Terminate a CHILD_SA.
 	 *
 	 * @param this			calling object
 	 * @param reqid			reqid of the CHILD_SA to terminate
 	 * @param cb			logging callback
 	 * @param param			parameter to include in each call of cb
@@ -147,13 +122,12 @@ struct interface_manager_t {
 	 *						- NOT_FOUND, if no such CHILD_SA found
 	 *						- NEED_MORE, if callback returned FALSE
 	 */
-	status_t (*terminate_child)(interface_manager_t *this, u_int32_t reqid, 
+	status_t (*terminate_child)(controller_t *this, u_int32_t reqid, 
-								interface_manager_cb_t callback, void *param);
+								controller_cb_t callback, void *param);
 	/**
-	 * @brief Route a CHILD_SA (install triggering policies).
+	 * Route a CHILD_SA (install triggering policies).
 	 *
 	 * @param this			calling object
 	 * @param peer_cfg		peer_cfg to use for IKE_SA setup, if triggered
 	 * @param child_cfg		child_cfg to route
 	 * @param cb			logging callback
@@ -163,16 +137,15 @@ struct interface_manager_t {
 	 *						- FAILED, if routing failed
 	 *						- NEED_MORE, if callback returned FALSE
 	 */
-	status_t (*route)(interface_manager_t *this,
+	status_t (*route)(controller_t *this,
 					  peer_cfg_t *peer_cfg, child_cfg_t *child_cfg,
-					  interface_manager_cb_t callback, void *param);
+					  controller_cb_t callback, void *param);
 	/**
-	 * @brief Unroute a routed CHILD_SA (uninstall triggering policies).
+	 * Unroute a routed CHILD_SA (uninstall triggering policies).
 	 *
 	 * Only the route is removed, not the CHILD_SAs the route triggered.
 	 *
 	 * @param this			calling object
 	 * @param reqid			reqid of the CHILD_SA to unroute
 	 * @param cb			logging callback
 	 * @param param			parameter to include in each call of cb
@@ -181,26 +154,21 @@ struct interface_manager_t {
 	 *						- NOT_FOUND, if no such CHILD_SA routed
 	 *						- NEED_MORE, if callback returned FALSE
 	 */
-	status_t (*unroute)(interface_manager_t *this, u_int32_t reqid, 
+	status_t (*unroute)(controller_t *this, u_int32_t reqid, 
-						interface_manager_cb_t callback, void *param);
+						controller_cb_t callback, void *param);
 	/**
-	 * @brief Destroy a interface_manager_t instance.
+	 * Destroy a controller_t instance.
 	 * 
 	 * @param this		interface_manager_t objec to destroy
 	 */
-	void (*destroy) (interface_manager_t *this);
+	void (*destroy) (controller_t *this);
 };
 /**
- * @brief Creates a interface_manager instance and loads all interface modules.
+ * Creates a controller instance.
 * 
- * @return 			interface_manager_t object
+ * @return 			controller_t object
 * 
 * @ingroup control
 */
-interface_manager_t *interface_manager_create(void);
+controller_t *controller_create(void);
 #endif /* INTERFACE_MANAGER_H_ */
 #endif /* CONTROLLER_H_ @} */
@@ -1,59 +0,0 @@
 /**
 * @file interface.h
 *
 * @brief Interface of interface_t.
 *
 */
 /*
 * Copyright (C) 2007 Martin Willi
 * Hochschule fuer Technik Rapperswil
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
 * Free Software Foundation; either version 2 of the License, or (at your
 * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
 *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 */
 #ifndef INTERFACE_H_
 #define INTERFACE_H_
 typedef struct interface_t interface_t;
 /**
 * @brief Interface for a controller.
 *
 * An interface controls the daemon by calling functions on the
 * interface_manager. All interfaces are manager by the interface_manager
 * in a generic way, so they need their own class.
 * 
 * @b Constructors:
 * - interface_create() of one of the modules
 * 
 * @ingroup interfaces
 */
 struct interface_t {
 	/**
 	 * @brief Destroy all interfaces
 	 * 
 	 * @param this		stroke_t objec to destroy
 	 */
 	void (*destroy) (interface_t *this);
 };
 /**
 * Constructor in a control interface module to create the interface.
 *
 * @ingroup interfaces
 */
 typedef interface_t*(*interface_constructor_t)(void);
 #endif /* INTERFACE_H_ */
@@ -0,0 +1,356 @@
 /*
 * Copyright (C) 2007 Martin Willi
 * Hochschule fuer Technik Rapperswil
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
 * Free Software Foundation; either version 2 of the License, or (at your
 * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
 *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include "auth_info.h"
 #include <daemon.h>
 #include <utils/linked_list.h>
 #include <utils/identification.h>
 #include <credentials/certificates/certificate.h>
 ENUM(auth_item_names, AUTHN_CA_CERT, AUTHZ_AC_GROUP,
 	"AUTHN_CA_CERT",
 	"AUTHN_IM_CERT",
 	"AUTHN_SUBJECT_CERT",
 	"AUTHZ_PUBKEY",
 	"AUTHZ_PSK",
 	"AUTHZ_EAP",
 	"AUTHZ_CA_CERT",
 	"AUTHZ_IM_CERT",
 	"AUTHZ_SUBJECT_CERT",
 	"AUTHZ_CRL_VALIDATION",
 	"AUTHZ_OCSP_VALIDATION",
 	"AUTHZ_AC_GROUP",
 );
 typedef struct private_auth_info_t private_auth_info_t;
 /**
 * private data of item_set
 */
 struct private_auth_info_t {
 	/**
 	 * public functions
 	 */
 	auth_info_t public;
 	/**
 	 * list of item_t's
 	 */
 	linked_list_t *items;
 };
 typedef struct item_t item_t;
 struct item_t {
 	/** type of this item */
 	auth_item_t type;
 	/** associated privlege value, if any */
 	void *value;
 };
 /**
 * implements item_enumerator_t.enumerate
 */
 static bool item_filter(void *data, item_t **item, auth_item_t *type,
 									void *unused, void **value)
 {
 	*type = (*item)->type;
 	*value = (*item)->value;
 	return TRUE;
 }
 /**
 * Implementation of auth_info_t.create_item_enumerator.
 */
 static enumerator_t* create_item_enumerator(private_auth_info_t *this)
 {
 	return enumerator_create_filter(this->items->create_enumerator(this->items),
 									(void*)item_filter, NULL, NULL);
 }
 /**
 * Implementation of auth_info_t.get_item.
 */
 static bool get_item(private_auth_info_t *this, auth_item_t type, void** value)
 {
 	enumerator_t *enumerator;
 	void *current_value;
 	auth_item_t current_type;
 	bool found = FALSE;
 	enumerator = create_item_enumerator(this);
 	while (enumerator->enumerate(enumerator, &current_type, &current_value))
 	{
 		if (type == current_type)
 		{
 			*value = current_value;
 			found = TRUE;
 			break;
 		}
 	}
 	enumerator->destroy(enumerator);
 	return found;
 }
 /**
 * Implementation of auth_info_t.add_item.
 */
 static void add_item(private_auth_info_t *this, auth_item_t type, void *value)
 {
 	item_t *item = malloc_thing(item_t);
 	item->type = type;
 	switch (type)
 	{		
 		case AUTHZ_PUBKEY:
 		{
 			public_key_t *key = (public_key_t*)value;
 			item->value = key->get_ref(key);
 			break;
 		}
 		case AUTHZ_PSK:
 		{
 			shared_key_t *key = (shared_key_t*)value;
 			item->value = key->get_ref(key);
 			break;
 		}
 		case AUTHN_CA_CERT:
 		case AUTHN_IM_CERT:
 		case AUTHN_SUBJECT_CERT:
 		case AUTHZ_CA_CERT:
 		case AUTHZ_IM_CERT:
 		case AUTHZ_SUBJECT_CERT:
 		{
 			certificate_t *cert = (certificate_t*)value;
 			item->value = cert->get_ref(cert);
 			break;
 		}
 		case AUTHZ_CRL_VALIDATION:
 		case AUTHZ_OCSP_VALIDATION:
 		{
 			cert_validation_t *validation = malloc_thing(cert_validation_t);
 			*validation = *(cert_validation_t*)value;
 			item->value = validation;
 			break;
 		}
 		case AUTHZ_EAP:
 		{
 			eap_method_t *method = malloc_thing(eap_method_t);
 			*method = *(eap_method_t*)value;
 			item->value = method;
 			break;
 		}
 		case AUTHZ_AC_GROUP:
 		{
 			identification_t *id = (identification_t*)value;
 			item->value = id->clone(id);
 			break;
 		}
 	}
 	this->items->insert_last(this->items, item);
 }
 /**
 * Implementation of auth_info_t.complies.
 */
 static bool complies(private_auth_info_t *this, auth_info_t *constraints)
 {
 	enumerator_t *enumerator;
 	bool success = TRUE;
 	auth_item_t type;
 	void *value;
 	enumerator = constraints->create_item_enumerator(constraints);
 	while (enumerator->enumerate(enumerator, &type, &value))
 	{
 		switch (type)
 		{
 			case AUTHN_CA_CERT:
 			case AUTHN_IM_CERT:
 			case AUTHN_SUBJECT_CERT:
 			{	/* skip non-authorization tokens */
 				continue;
 			}
 			case AUTHZ_CRL_VALIDATION:
 			case AUTHZ_OCSP_VALIDATION:
 			{
 				cert_validation_t *valid;
 				/* OCSP validation is also sufficient for CRL constraint, but
 				 * not vice-versa */
 				if (!get_item(this, type, (void**)&valid) &&
 					type == AUTHZ_CRL_VALIDATION &&
 					!get_item(this, AUTHZ_OCSP_VALIDATION, (void**)&valid))
 				{
 					DBG1(DBG_CFG, "constraint check failed: %N requires at "
 						 "least %N, but no check done", auth_item_names, type,
 						 cert_validation_names, *(cert_validation_t*)value);
 					success = FALSE;
 					break;
 				}
 				switch (*(cert_validation_t*)value)
 				{
 					case VALIDATION_SKIPPED:
 						if (*valid == VALIDATION_SKIPPED)
 						{
 							break;
 						}	/* FALL */
 					case VALIDATION_GOOD:
 						if (*valid == VALIDATION_GOOD)
 						{
 							break;
 						}	/* FALL */
 					default:
 						DBG1(DBG_CFG, "constraint check failed: %N is %N, but "
 							 "requires at least %N", auth_item_names, type,
 							 cert_validation_names, *valid,
 							 cert_validation_names, *(cert_validation_t*)value);
 						success = FALSE;
 						break;
 				}
 				break;
 			}
 			case AUTHZ_PUBKEY:
 			case AUTHZ_PSK:
 			case AUTHZ_IM_CERT:
 			case AUTHZ_SUBJECT_CERT:
 			case AUTHZ_EAP:
 			case AUTHZ_AC_GROUP:
 				DBG1(DBG_CFG, "constraint check %N not implemented!",
 					 auth_item_names, type);
 				success = FALSE;
 				break;
 			case AUTHZ_CA_CERT:
 			{
 				certificate_t *cert;
 				if (!get_item(this, AUTHZ_CA_CERT, (void**)&cert) ||
 					!cert->equals(cert, (certificate_t*)value))
 				{
 					cert = (certificate_t*)value;
 					DBG1(DBG_CFG, "constraint check failed: peer not "
 						 "authenticated by CA '%D'.", cert->get_issuer(cert));
 					success = FALSE;
 				}
 				break;
 			}
 		}
 		if (!success)
 		{
 			break;
 		}
 	}
 	enumerator->destroy(enumerator);
 	return success;
 }
 /**
 * Implementation of auth_info_t.merge.
 */
 static void merge(private_auth_info_t *this, private_auth_info_t *other)
 {
 	item_t *item;
 	while (other->items->remove_first(other->items, (void**)&item) == SUCCESS)
 	{
 		this->items->insert_last(this->items, item);
 	}
 }
 /**
 * Implementation of auth_info_t.destroy
 */
 static void destroy(private_auth_info_t *this)
 {
 	item_t *item;
 	while (this->items->remove_last(this->items, (void**)&item) == SUCCESS)
 	{
 		switch (item->type)
 		{
 			case AUTHZ_PUBKEY:
 			{
 				public_key_t *key = (public_key_t*)item->value;
 				key->destroy(key);
 				break;
 			}
 			case AUTHZ_PSK:
 			{
 				shared_key_t *key = (shared_key_t*)item->value;
 				key->destroy(key);
 				break;
 			}
 			case AUTHN_CA_CERT:
 			case AUTHN_IM_CERT:
 			case AUTHN_SUBJECT_CERT:
 			case AUTHZ_CA_CERT:
 			case AUTHZ_IM_CERT:
 			case AUTHZ_SUBJECT_CERT:
 			{
 				certificate_t *cert = (certificate_t*)item->value;
 				cert->destroy(cert);
 				break;
 			}
 			case AUTHZ_CRL_VALIDATION:
 			case AUTHZ_OCSP_VALIDATION:
 			case AUTHZ_EAP:
 			{
 				free(item->value);
 				break;
 			}
 			case AUTHZ_AC_GROUP:
 			{
 				identification_t *id = (identification_t*)item->value;
 				id->destroy(id);
 				break;
 			}
 		}
 		free(item);
 	}
 	this->items->destroy(this->items);
 	free(this);
 }
 /*
 * see header file
 */
 auth_info_t *auth_info_create()
 {
 	private_auth_info_t *this = malloc_thing(private_auth_info_t);
 	this->public.add_item = (void(*)(auth_info_t*, auth_item_t type, void *value))add_item;
 	this->public.get_item = (bool(*)(auth_info_t*, auth_item_t type, void **value))get_item;
 	this->public.create_item_enumerator = (enumerator_t*(*)(auth_info_t*))create_item_enumerator;
 	this->public.complies = (bool(*)(auth_info_t*, auth_info_t *))complies;
 	this->public.merge = (void(*)(auth_info_t*, auth_info_t *other))merge;
 	this->public.destroy = (void(*)(auth_info_t*))destroy;
 	this->items = linked_list_create();
 	return &this->public;
 }
@@ -0,0 +1,158 @@
 /*
 * Copyright (C) 2007 Martin Willi
 * Hochschule fuer Technik Rapperswil
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
 * Free Software Foundation; either version 2 of the License, or (at your
 * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
 *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 */
 /**
 * @defgroup auth_info auth_info
 * @{ @ingroup ccredentials
 */
 #ifndef AUTH_INFO_H_
 #define AUTH_INFO_H_
 #include <utils/enumerator.h>
 typedef struct auth_info_t auth_info_t;
 typedef enum auth_item_t auth_item_t;
 /**
 * Authentication/Authorization process helper item.
 *
 * For the authentication process, further information may be needed. These
 * items are defined as auth_item_t and have a AUTHN prefix. 
 * The authentication process returns important data for the authorization 
 * process, these items are defined with a AUTHZ prefix.
 * Authentication uses AUTHN items and creates AUTHZ items during authentication,
 * authorization reads AUTHZ values to give out privileges.
 *
 *                +---+             +---------------------+
 *                | A |             | A                   |
 *                | u |             | u    +-----------+  |
 *                | t |             | t    |  Required |  |
 *                | h |             | h    | auth_info |  |
 *                | e |             | o    +-----------+  |
 *                | n |             | r           |       |
 * +-----------+  | t |             | i           |       |
 * | Provided  |  | i |             | z           V       |
 * | auth_info |--| c |-------------| a  ----> match? ----|------->
 * +-----------+  | a |             | t                   |
 *                | t |             | i                   |
 *                | i |             | o                   |
 *                | o |             | n                   |
 *                | n |             |                     |
 *                +---+             +---------------------+
 */
 enum auth_item_t {
 	/*
 	 * items provided to authentication process
 	 */
 	/** CA certificate to use for authentication, value is certificate_t* */
 	AUTHN_CA_CERT,
 	/** intermediate certificate, value is certificate_t* */
 	AUTHN_IM_CERT,
 	/** certificate for trustchain verification, value is certificate_t* */
 	AUTHN_SUBJECT_CERT,
 	/*
 	 * item provided to authorization process
 	 */
 	/** subject has been authenticated by public key, value is public_key_t* */
 	AUTHZ_PUBKEY,
 	/** subject has ben authenticated using preshared secrets, value is shared_key_t* */ 
 	AUTHZ_PSK,
 	/** subject has been authenticated using EAP, value is eap_method_t */
 	AUTHZ_EAP,
 	/** certificate authority, value is certificate_t* */
 	AUTHZ_CA_CERT,
 	/** intermediate certificate in trustchain, value is certificate_t* */
 	AUTHZ_IM_CERT,
 	/** subject certificate, value is certificate_t* */
 	AUTHZ_SUBJECT_CERT,
 	/** result of a CRL validation, value is cert_validation_t */
 	AUTHZ_CRL_VALIDATION,
 	/** result of a OCSP validation, value is cert_validation_t */
 	AUTHZ_OCSP_VALIDATION,
 	/** subject is in attribute certificate group, value is identification_t* */
 	AUTHZ_AC_GROUP,
 };
 /**
 * enum name for auth_item_t.
 */
 extern enum_name_t *auth_item_names;
 /**
 * The auth_info class contains auth_item_t's used for AA.
 *
 * A auth_info allows the separation of authentication and authorization. 
 */
 struct auth_info_t {
 	/**
 	 * Add an item to the set.
 	 *
 	 * @param type		auth_info type
 	 * @param value		associated value to auth_info type, if any
 	 */
 	void (*add_item)(auth_info_t *this, auth_item_t type, void *value);
 	/**
 	 * Get an item.
 	 *
 	 * @param type		auth_info type to get
 	 * @param value		pointer to a pointer receiving item
 	 * @return			bool if item has been found
 	 */
 	bool (*get_item)(auth_info_t *this, auth_item_t type, void **value);
 	/**
 	 * Create an enumerator over all items.
 	 *
 	 * @return			enumerator over (auth_item_t type, void *value)
 	 */
 	enumerator_t* (*create_item_enumerator)(auth_info_t *this);
 	/**
 	 * Check if this fulfills a set of required constraints.
 	 *
 	 * @param constraints	required authorization infos
 	 * @return				TRUE if this complies with constraints
 	 */
 	bool (*complies)(auth_info_t *this, auth_info_t *constraints);
 	/**
 	 * Merge items from other into this.
  	 *
 	 * Items do not get cloned, but moved from other to this.
 	 *
 	 * @param other		items to read for merge
 	 */
 	void (*merge)(auth_info_t *this, auth_info_t *other);
 	/**
     * Destroy a auth_info instance with all associated values.
     */
    void (*destroy)(auth_info_t *this);
 };
 /**
 * Create a auth_info instance.
 */
 auth_info_t *auth_info_create();
 #endif /* AUTH_INFO_H_ @}*/
@@ -0,0 +1,187 @@
 /*
 * Copyright (C) 2007-2008 Martin Willi
 * Hochschule fuer Technik Rapperswil
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
 * Free Software Foundation; either version 2 of the License, or (at your
 * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
 *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup credential_manager credential_manager
 * @{ @ingroup ccredentials
 */
 #ifndef CREDENTIAL_MANAGER_H_
 #define CREDENTIAL_MANAGER_H_
 #include <utils/identification.h>
 #include <utils/enumerator.h>
 #include <credentials/auth_info.h>
 #include <credentials/credential_set.h>
 #include <credentials/keys/private_key.h>
 #include <credentials/keys/shared_key.h>
 #include <credentials/certificates/certificate.h>
 typedef struct credential_manager_t credential_manager_t;
 /**
 * Manages credentials using credential_sets.
 *
 * The credential manager is the entry point of the credential framework. It
 * uses so called "sets" to access credentials in a modular fashion, these
 * are implemented through the credential_set_t interface. 
 * The manager additionally does trust chain verification and trust status
 * chaching. A set may call the managers methods if it needs credentials itself,
 * the manager uses recursive locking.
 * 
 * @verbatim
  +-------+        +----------------+
  |   A   |        |                |          +------------------+
  |   u   | -----> |                | ------>  |  +------------------+
  |   t   |        |   credential-  |          |  |  +------------------+
  |   h   | -----> |     manager    | ------>  +--|  |   credential-    | => IPC
  |   e   |        |                |             +--|       sets       |
  |   n   |   +--> |                | ------>        +------------------+
  |   t   |   |    |                |                        |
  |   i   |   |    |                |                        |
  |   c   |   |    +----------------+                        |
  |   a   |   |                                              |
  |   t   |   +----------------------------------------------+
  |   o   |                    may be recursive
  |   r   |
  +-------+
   @endverbatim                                       
 *
 * Synchronization is done completely in the manager, so the sets don't have
 * to worry about it. The locking mechanism is reentrant save, so sets can
 * call the manager.
 */
 struct credential_manager_t {
 	/**
 	 * Create an enumerator over all certificates.
 	 *
 	 * @param cert		kind of certificate
 	 * @param key		kind of key in certificate
 	 * @param id		subject this certificate belongs to
 	 * @param trusted	TRUE to list trusted certificates only
 	 * @return			enumerator over the certificates
 	 */
 	enumerator_t *(*create_cert_enumerator)(credential_manager_t *this,
 								certificate_type_t cert, key_type_t key,
 								identification_t *id, bool trusted);
 	/**
 	 * Create an enumerator over all shared keys.
 	 *
 	 * The enumerator enumerates over:
 	 *  shared_key_t*, id_match_t me, id_match_t other
 	 * But must accepts values for the id_matches.
 	 *
 	 * @param type		kind of requested shared key
 	 * @param first		first subject between key is shared
 	 * @param second	second subject between key is shared
 	 * @return			enumerator over shared keys
 	 */
 	enumerator_t *(*create_shared_enumerator)(credential_manager_t *this, 
 								shared_key_type_t type,
 								identification_t *first, identification_t *second);
 	/**
 	 * Create an enumerator over all Certificate Distribution Points.
 	 *
 	 * @param type		kind of certificate the point distributes
 	 * @param id		identification of the distributed certificate
 	 * @return			enumerator of CDPs as char*
 	 */
 	enumerator_t *(*create_cdp_enumerator)(credential_manager_t *this,
 								credential_type_t type, identification_t *id);
 	/**
 	 * Get a trusted or untrusted certificate.
 	 *
 	 * @param cert		kind of certificate
 	 * @param key		kind of key in certificate
 	 * @param id		subject this certificate belongs to
 	 * @param trusted	TRUE to get a trusted certificate only
 	 * @return			certificate, if found, NULL otherwise
 	 */
 	certificate_t *(*get_cert)(credential_manager_t *this,
 							   certificate_type_t cert, key_type_t key,
 							   identification_t *id, bool trusted);
 	/**
 	 * Get the best matching shared key for two IDs.
 	 *
 	 * @param type		kind of requested shared key
 	 * @param me		own identity
 	 * @param other		peers identity
 	 * @param auth		auth_info helper 
 	 * @return			shared_key_t, NULL if none found
 	 */			   
 	shared_key_t *(*get_shared)(credential_manager_t *this, shared_key_type_t type,
 								identification_t *me, identification_t *other);
 	/**
 	 * Get a private key to create a signature.
 	 *
 	 * The get_private() method gets a secret private key identified by either
 	 * the keyid itself or an id the key belongs to. 
 	 * The auth parameter contains additional information, such as receipients
 	 * trusted CA certs. Auth gets filled with subject and CA certificates
 	 * needed to validate a created signature.
 	 *
 	 * @param type		type of the key to get
 	 * @param id		identification the key belongs to
 	 * @param auth		auth_info helper, including trusted CA certificates
 	 * @return			private_key_t, NULL if none found
 	 */
 	private_key_t* (*get_private)(credential_manager_t *this, key_type_t type,
 								  identification_t *id, auth_info_t *auth);
 	/**
 	 * Get a public key to verify a signature.
 	 *
 	 * The get_public() method gets a trusted public key to verify a signature
 	 * of id. The auth parameter contains additional authentication infos,
 	 * e.g. peer and intermediate certificates.
 	 *
 	 * @param type		type of key to get
 	 * @param id		identification the key belongs to
 	 * @param auth		auth_info helper, including certificates to verify key
 	 * @return			public_key_t, NULL if none found
 	 */
 	public_key_t* (*get_public)(credential_manager_t *this, key_type_t type,
 								identification_t *id, auth_info_t *auth);
 	/**
 	 * Register a credential set to the manager.
 	 *
 	 * @param set		set to register
 	 */
 	void (*add_set)(credential_manager_t *this, credential_set_t *set);
 	/**
 	 * Unregister a credential set from the manager.
 	 *
 	 * @param set		set to unregister
 	 */
 	void (*remove_set)(credential_manager_t *this, credential_set_t *set);
 	/**
     * Destroy a credential_manager instance.
     */
    void (*destroy)(credential_manager_t *this);
 };
 /**
 * Create a credential_manager instance.
 */
 credential_manager_t *credential_manager_create();
 #endif /* CREDENTIAL_MANAGER_H_ @} */
@@ -0,0 +1,93 @@
 /*
 * Copyright (C) 2007 Martin Willi
 * Hochschule fuer Technik Rapperswil
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
 * Free Software Foundation; either version 2 of the License, or (at your
 * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
 *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup credential_set credential_set
 * @{ @ingroup ccredentials
 */
 #ifndef CREDENTIAL_SET_H_
 #define CREDENTIAL_SET_H_
 #include <credentials/keys/public_key.h>
 #include <credentials/keys/shared_key.h>
 #include <credentials/certificates/certificate.h>
 typedef struct credential_set_t credential_set_t;
 /**
 * A set of credentials.
 *
 * Contains private keys, shared keys and different kinds of certificates.
 * Enumerators are used because queries might return multiple matches.
 * Filter parameters restrict enumeration over specific items only.
 * See credential_manager_t for an overview of the credential framework.
 */
 struct credential_set_t {
 	/**
 	 * Create an enumerator over private keys (private_key_t).
 	 *
 	 * The id is either a key identifier of the requested key, or an identity
 	 * of the key owner. 
 	 *
 	 * @param type		type of requested private key
 	 * @param id		key identifier/owner
 	 * @return			enumerator over private_key_t's.
 	 */
 	enumerator_t *(*create_private_enumerator)(credential_set_t *this,
 						key_type_t type, identification_t *id);
 	/**
 	 * Create an enumerator over certificates (certificate_t).
 	 *
 	 * @param cert		kind of certificate
 	 * @param key		kind of key in certificate
 	 * @param id		identity (subject) this certificate belongs to
 	 * @param trusted	whether the certificate must be trustworthy
 	 * @return			enumerator as described above
 	 */
 	enumerator_t *(*create_cert_enumerator)(credential_set_t *this,
 						certificate_type_t cert, key_type_t key,
 						identification_t *id, bool trusted);
 	/**
 	 * Create an enumerator over shared keys (shared_key_t).
 	 *
 	 * The enumerator enumerates over:
 	 *  shared_key_t*, id_match_t me, id_match_t other
 	 * But must accept NULL values for the id_matches.
 	 *
 	 * @param type		kind of requested shared key
 	 * @param me		own identity
 	 * @param other		other identity who owns that secret
 	 * @return			enumerator as described above
 	 */
 	enumerator_t *(*create_shared_enumerator)(credential_set_t *this, 
 						shared_key_type_t type,
 						identification_t *me, identification_t *other);
 	/**
 	 * Create an enumerator over certificate distribution points.
 	 *
 	 * @param type		type of the certificate to get a CDP
 	 * @param id		identification of the distributed certificate
 	 * @return			an enumerator over CDPs as char*
 	 */
 	enumerator_t *(*create_cdp_enumerator)(credential_set_t *this,
 						certificate_type_t type, identification_t *id);	
 };
 #endif /* CREDENTIAL_SET_H_ @} */
@@ -1,13 +1,7 @@
-/**
+/* 
- * @file daemon.c
+ * Copyright (C) 2006-2007 Tobias Brunner
 * 
 * @brief Implementation of daemon_t and main of IKEv2-Daemon.
 * 
 */
 /* Copyright (C) 2006-2007 Tobias Brunner
 * Copyright (C) 2006 Daniel Roethlisberger
- * Copyright (C) 2005-2006 Martin Willi
+ * Copyright (C) 2005-2008 Martin Willi
 * Copyright (C) 2005 Jan Hutter
 * Hochschule fuer Technik Rapperswil
 *
@@ -41,11 +35,9 @@
 #include "daemon.h"
 #include <library.h>
-#include <crypto/ca.h>
+#include <credentials/credential_manager.h>
-#include <utils/fetcher.h>
+#include <config/backend_manager.h>
-#include <config/credentials/local_credential_store.h>
+#include <config/traffic_selector.h>
 #include <config/backends/local_backend.h>
 #include <sa/authenticators/eap/eap_method.h>
 /* on some distros, a capset definition is missing */
 #ifdef NO_CAPSET_DEFINED
@@ -100,6 +92,12 @@ static void dbg_bus(int level, char *fmt, ...)
 	charon->bus->vsignal(charon->bus, DBG_LIB, level, fmt, args);
 	va_end(args);
 }
 /**
 * Logging hook for library logs before logging facility initiated
 */
 static void dbg_silent(int level, char *fmt, ...)
 {
 }
 /**
 * Logging hook for library logs, using stderr output
@@ -171,12 +169,17 @@ static void run(private_daemon_t *this)
 static void destroy(private_daemon_t *this)
 {
 	/* terminate all idle threads */
-	this->public.processor->set_threads(this->public.processor, 0);
+	if (this->public.processor)
 	{
 		this->public.processor->set_threads(this->public.processor, 0);
 	}
 	/* close all IKE_SAs */
 	DESTROY_IF(this->public.plugins);
 	DESTROY_IF(this->public.ike_sa_manager);
 	DESTROY_IF(this->public.kernel_interface);
 	DESTROY_IF(this->public.scheduler);
-	DESTROY_IF(this->public.interfaces);
+	DESTROY_IF(this->public.controller);
 	DESTROY_IF(this->public.eap);
 #ifdef P2P	
 	DESTROY_IF(this->public.connect_manager);
 	DESTROY_IF(this->public.mediation_manager);
@@ -323,29 +326,38 @@ static bool initialize(private_daemon_t *this, bool syslog, level_t levels[])
 #endif /* INTEGRITY_TEST */
 	this->public.ike_sa_manager = ike_sa_manager_create();
 	if (this->public.ike_sa_manager == NULL)
 	{
 		return FALSE;
 	}
 	this->public.processor = processor_create();
 	this->public.scheduler = scheduler_create();
 	/* load secrets, ca certificates and crls */
-	this->public.credentials = (credential_store_t*)local_credential_store_create();
+	this->public.credentials = credential_manager_create();
-	this->public.credentials->load_ca_certificates(this->public.credentials);
+	this->public.controller = controller_create();
-	this->public.credentials->load_aa_certificates(this->public.credentials);
+	this->public.eap = eap_manager_create();
 	this->public.credentials->load_attr_certificates(this->public.credentials);
 	this->public.credentials->load_ocsp_certificates(this->public.credentials);
 	this->public.credentials->load_crls(this->public.credentials);
 	this->public.credentials->load_secrets(this->public.credentials, FALSE);
 	this->public.interfaces = interface_manager_create();
 	this->public.backends = backend_manager_create();
 	this->public.plugins = plugin_loader_create();
 	this->public.kernel_interface = kernel_interface_create();
 	this->public.socket = socket_create();
 	this->public.sender = sender_create();
 	this->public.receiver = receiver_create();
 	if (this->public.receiver == NULL)
 	{
 		return FALSE;
 	}
 #ifdef P2P
 	this->public.connect_manager = connect_manager_create();
 	if (this->public.connect_manager == NULL)
 	{
 		return FALSE;
 	}
 	this->public.mediation_manager = mediation_manager_create();
 #endif /* P2P */
 	this->public.plugins->load(this->public.plugins, IPSEC_PLUGINDIR, "libcharon-");
 	return TRUE;
 }
@@ -401,7 +413,9 @@ private_daemon_t *daemon_create(void)
 	this->public.scheduler = NULL;
 	this->public.kernel_interface = NULL;
 	this->public.processor = NULL;
-	this->public.interfaces = NULL;
+	this->public.controller = NULL;
 	this->public.eap = NULL;
 	this->public.plugins = NULL;
 	this->public.bus = NULL;
 	this->public.outlog = NULL;
 	this->public.syslog = NULL;
@@ -443,7 +457,6 @@ static void usage(const char *msg)
 					"         [--strictcrlpolicy]\n"
 					"         [--cachecrls]\n"
 					"         [--crlcheckinterval <interval>]\n"
 					"         [--eapdir <dir>]\n"
 					"         [--use-syslog]\n"
 					"         [--debug-<type> <level>]\n"
 					"           <type>:  log context type (dmn|mgr|ike|chd|job|cfg|knl|net|enc|lib)\n"
@@ -460,10 +473,8 @@ static void usage(const char *msg)
 int main(int argc, char *argv[])
 {
 	u_int crl_check_interval = 0;
 	strict_t strict_crl_policy = STRICT_NO;
 	bool cache_crls = FALSE;
 	bool use_syslog = FALSE;
 	char *eapdir = IPSEC_EAPDIR;
 	private_daemon_t *private_charon;
 	FILE *pid_file;
@@ -471,6 +482,14 @@ int main(int argc, char *argv[])
 	level_t levels[DBG_MAX];
 	int signal;
 	/* silence the library during initialization, as we have no bus yet */
 	dbg = dbg_silent;
 	/* initialize library */
 	library_init(IPSEC_DIR "/strongswan.conf");
 	lib->plugins->load(lib->plugins, IPSEC_PLUGINDIR, "libstrongswan-");
 	lib->printf_hook->add_handler(lib->printf_hook, 'R',
 								  traffic_selector_get_printf_hooks());
 	private_charon = daemon_create();
 	charon = (daemon_t*)private_charon;
@@ -491,10 +510,8 @@ int main(int argc, char *argv[])
 			{ "help", no_argument, NULL, 'h' },
 			{ "version", no_argument, NULL, 'v' },
 			{ "use-syslog", no_argument, NULL, 'l' },
 			{ "strictcrlpolicy", required_argument, NULL, 'r' },
 			{ "cachecrls", no_argument, NULL, 'C' },
 			{ "crlcheckinterval", required_argument, NULL, 'x' },
 			{ "eapdir", required_argument, NULL, 'e' },
 			/* TODO: handle "debug-all" */
 			{ "debug-dmn", required_argument, &signal, DBG_DMN },
 			{ "debug-mgr", required_argument, &signal, DBG_MGR },
@@ -523,18 +540,12 @@ int main(int argc, char *argv[])
 			case 'l':
 				use_syslog = TRUE;
 				continue;
 			case 'r':
 				strict_crl_policy = atoi(optarg);
 				continue;
 			case 'C':
 				cache_crls = TRUE;
 				continue;
 			case 'x':
 				crl_check_interval = atoi(optarg);
 				continue;
 			case 'e':
 				eapdir = optarg;
 				continue;
 			case 0:
 				/* option is in signal */
 				levels[signal] = atoi(optarg);
@@ -554,14 +565,6 @@ int main(int argc, char *argv[])
 		exit(-1);
 	}
 	/* initialize fetcher_t class */
 	fetcher_initialize();
 	/* load pluggable EAP modules */
 	eap_method_load(eapdir);
 	/* set strict_crl_policy, cache_crls and crl_check_interval options */
 	ca_info_set_options(strict_crl_policy, cache_crls, crl_check_interval);
 	/* check/setup PID file */
 	if (stat(PID_FILE, &stb) == 0)
 	{
@@ -586,12 +589,12 @@ int main(int argc, char *argv[])
 	/* run daemon */
 	run(private_charon);
 	eap_method_unload();
 	fetcher_finalize();
 	/* normal termination, cleanup and exit */
 	destroy(private_charon);
 	unlink(PID_FILE);
 	library_deinit();
 	return 0;
 }
@@ -1,14 +1,7 @@
 /**
 * @file daemon.h
 *
 * @brief Interface of daemon_t.
 *
 */
 /*
 * Copyright (C) 2006-2007 Tobias Brunner
 * Copyright (C) 2006 Daniel Roethlisberger
- * Copyright (C) 2005-2006 Martin Willi
+ * Copyright (C) 2005-2008 Martin Willi
 * Copyright (C) 2005 Jan Hutter
 * Hochschule fuer Technik Rapperswil
 *
@@ -21,6 +14,127 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup charon charon
 *
 * @defgroup bus bus
 * @ingroup charon
 * 
 * @defgroup listeners listeners
 * @ingroup bus
 *
 * @defgroup config config
 * @ingroup charon
 *
 * @defgroup control control
 * @ingroup charon
 *
 * @defgroup ccredentials credentials
 * @ingroup charon
 *
 * @defgroup encoding encoding
 * @ingroup charon
 *
 * @defgroup payloads payloads
 * @ingroup encoding
 *
 * @defgroup kernel kernel
 * @ingroup charon
 *
 * @defgroup network network
 * @ingroup charon
 *
 * @defgroup cplugins plugins
 * @ingroup charon
 *
 * @defgroup processing processing
 * @ingroup charon
 *
 * @defgroup jobs jobs
 * @ingroup processing
 *
 * @defgroup sa sa
 * @ingroup charon
 *
 * @defgroup authenticators authenticators
 * @ingroup sa
 *
 * @defgroup eap eap
 * @ingroup authenticators
 *
 * @defgroup tasks tasks
 * @ingroup sa
 *
 * @addtogroup charon
 * @{
 *
 * IKEv2 keying daemon.
 *
 * All IKEv2 stuff is handled in charon. It uses a newer and more flexible
 * architecture than pluto. Charon uses a thread-pool (called processor),
 * which allows parallel execution SA-management. All threads originate
 * from the processor. Work is delegated to the processor by queueing jobs
 * to it.
   @verbatim
      +---------------------------------+       +----------------------------+
      |           controller            |       |          config            |
      +---------------------------------+       +----------------------------+  
               |      |      |                           ^     ^    ^           
               V      V      V                           |     |    |           
       +----------+  +-----------+   +------+            +----------+    +----+
       | receiver |  |           |   |      |  +------+  | CHILD_SA |    | K  |
       +---+------+  | Scheduler |   | IKE- |  | IKE- |--+----------+    | e  |
           |         |           |   | SA   |--| SA   |  | CHILD_SA |    | r  |
    +------+---+     +-----------+   |      |  +------+  +----------+    | n  |
 <->|  socket  |           |         | Man- |                            | e  |
    +------+---+     +-----------+   | ager |  +------+  +----------+    | l  |
           |         |           |   |      |  | IKE- |--| CHILD_SA |    | -  |
       +---+------+  | Processor |---|      |--| SA   |  +----------+    | I  |
       |  sender  |  |           |   |      |  +------+                  | f  |    
       +----------+  +-----------+   +------+                            +----+
               |      |      |                        |      |      |           
               V      V      V                        V      V      V           
      +---------------------------------+       +----------------------------+  
      |               Bus               |       |         credentials        |  
      +---------------------------------+       +----------------------------+                                                              
   @endverbatim
 * The scheduler is responsible to execute timed events. Jobs may be queued to 
 * the scheduler to get executed at a defined time (e.g. rekeying). The 
 * scheduler does not execute the jobs itself, it queues them to the processor.
 * 
 * The IKE_SA manager managers all IKE_SA. It further handles the 
 * synchronization:
 * Each IKE_SA must be checked out strictly and checked in again after use. The 
 * manager guarantees that only one thread may check out a single IKE_SA. This 
 * allows us to write the (complex) IKE_SAs routines non-threadsave.
 * The IKE_SA contain the state and the logic of each IKE_SA and handle the 
 * messages.
 * 
 * The CHILD_SA contains state about a IPsec security association and manages
 * them. An IKE_SA may have multiple CHILD_SAs. Communication to the kernel 
 * takes place here through the kernel interface.
 * 
 * The kernel interface installs IPsec security associations, policies, routes
 * and virtual addresses. It further provides methods to enumerate interfaces 
 * and may notify the daemon about state changes at lower layers.
 * 
 * The bus receives signals from the different threads and relais them to interested 
 * listeners. Debugging signals, but also important state changes or error 
 * messages are sent over the bus. 
 * It's listeners are not only for logging, but also to track the state of an
 * IKE_SA.
 *
 * The controller, credential_manager, bus and backend_manager (config) are 
 * places where a plugin ca register itself to privide information or observe
 * and control the daemon.
 */
 #ifndef DAEMON_H_
@@ -28,338 +142,55 @@
 typedef struct daemon_t daemon_t;
 #include <credential_store.h>
 #include <network/sender.h>
 #include <network/receiver.h>
 #include <network/socket.h>
 #include <processing/scheduler.h>
 #include <processing/processor.h>
 #include <kernel/kernel_interface.h>
-#include <control/interface_manager.h>
+#include <control/controller.h>
 #include <bus/bus.h>
 #include <bus/listeners/file_logger.h>
 #include <bus/listeners/sys_logger.h>
 #include <sa/ike_sa_manager.h>
 #include <config/backend_manager.h>
 #include <credentials/credential_manager.h>
 #include <sa/authenticators/eap/eap_manager.h>
 #include <plugins/plugin_loader.h>
 #ifdef P2P
 #include <sa/connect_manager.h>
 #include <sa/mediation_manager.h>
 #endif /* P2P */
 /**
 * @defgroup charon charon
 *
 * @brief IKEv2 keying daemon.
 *
 * All IKEv2 stuff is handled in charon. It uses a newer and more flexible
 * architecture than pluto. Charon uses a thread-pool (called processor),
 * which allows parallel execution SA-management. All threads originate
 * from the processor. Work is delegated to the processor by queueing jobs
 * to it.
   @verbatim                                             
      +--------+   +-------+   +--------+       +-----------+    +-----------+
      | Stroke |   |  XML  |   |  DBUS  |       |   Local   |    |   SQLite  |
      +--------+   +-------+   +--------+       +-----------+    +-----------+
          |            |           |                  |                |
      +---------------------------------+       +----------------------------+
      |             Interfaces          |       |          Backends          |
      +---------------------------------+       +----------------------------+  
       +------------+    +-----------+        +------+            +----------+
       |  receiver  |    |           |        |      |  +------+  | CHILD_SA |
       +----+-------+    | Scheduler |        | IKE- |  | IKE- |--+----------+
            |            |           |        | SA   |--| SA   |  | CHILD_SA |
    +-------+--+         +-----------+        |      |  +------+  +----------+
 <->|  socket  |               |              | Man- |
    +-------+--+         +-----------+        | ager |  +------+  +----------+
            |            |           |        |      |  | IKE- |--| CHILD_SA |
       +----+-------+    | Processor |--------|      |--| SA   |  +----------+
       |   sender   |    |           |        |      |  +------+                  
       +------------+    +-----------+        +------+                   
      +---------------------------------+       +----------------------------+
      |               Bus               |       |      Kernel Interface      |
      +---------------------------------+       +----------------------------+                                                                 
             |                    |                           |
      +-------------+     +-------------+                     V
      | File-Logger |     |  Sys-Logger |                  //////
      +-------------+     +-------------+                       
   @endverbatim
 * The scheduler is responsible to execute timed events. Jobs may be queued to 
 * the scheduler to get executed at a defined time (e.g. rekeying). The scheduler
 * does not execute the jobs itself, it queues them to the processor.
 * 
 * The IKE_SA manager managers all IKE_SA. It further handles the synchronization:
 * Each IKE_SA must be checked out strictly and checked in again after use. The 
 * manager guarantees that only one thread may check out a single IKE_SA. This allows
 * us to write the (complex) IKE_SAs routines non-threadsave.
 * The IKE_SA contain the state and the logic of each IKE_SA and handle the messages.
 * 
 * The CHILD_SA contains state about a IPsec security association and manages them. 
 * An IKE_SA may have multiple CHILD_SAs. Communication to the kernel takes place
 * here through the kernel interface.
 * 
 * The kernel interface installs IPsec security associations, policies routes and 
 * virtual addresses. It further provides methods to enumerate interfaces and may notify
 * the daemon about state changes at lower layers.
 * 
 * The bus receives signals from the different threads and relais them to interested 
 * listeners. Debugging signals, but also important state changes or error messages are
 * sent over the bus. 
 * It's listeners are not only for logging, but also to track the state of an IKE_SA.
 * 
 * The interface manager loads pluggable controlling interfaces. These are written to control
 * the daemon from external inputs (e.g. initiate IKE_SA, close IKE_SA, ...). The interface
 * manager further provides a simple API to establish these tasks.
 * Backends are pluggable modules which provide configuration. They have to implement an API
 * which the daemon core uses to get configuration.
 */
 /**
 * @defgroup bus bus
 *
 * Signaling bus and its listeners.
 *
 * @ingroup charon
 */
 /**
 * @defgroup config config
 *
 * Classes implementing configuration related things.
 *
 * @ingroup charon
 */
 /**
 * @defgroup backends backends
 *
 * Classes implementing configuration backends.
 *
 * @ingroup config
 */
 /**
 * @defgroup credentials credentials
 *
 * Trust chain verification and certificate store.
 *
 * @ingroup config
 */
 /**
 * @defgroup control control
 *
 * Handling of loadable control interface modules.
 *
 * @ingroup charon
 */
 /**
 * @defgroup interfaces interfaces
 *
 * Classes which control the daemon using IPC mechanisms.
 *
 * @ingroup control
 */
 /**
 * @defgroup encoding encoding
 *
 * Classes used to encode and decode IKEv2 messages.
 *
 * @ingroup charon
 */
 /**
 * @defgroup payloads payloads
 *
 * Classes representing specific IKEv2 payloads.
 *
 * @ingroup encoding
 */
 /**
 * @defgroup kernel kernel
 *
 * Classes to configure and query the kernel.
 *
 * @ingroup charon
 */
 /**
 * @defgroup network network
 *
 * Classes for sending and receiving UDP packets over the network.
 *
 * @ingroup charon
 */
 /**
 * @defgroup processing processing
 *
 * Queueing, scheduling and processing of jobs
 *
 * @ingroup charon
 */
 /**
 * @defgroup jobs jobs
 *
 * Jobs to queue, schedule and process.
 *
 * @ingroup processing
 */
 /**
 * @defgroup sa sa
 *
 * Security associations for IKE and IPSec, and its helper classes.
 *
 * @ingroup charon
 */
 /**
 * @defgroup authenticators authenticators
 *
 * Authenticator classes to prove identity of a peer.
 *
 * @ingroup sa
 */
 /**
 * @defgroup eap eap
 *
 * EAP module loader, interface and it's implementations.
 *
 * @ingroup authenticators
 */
 /**
 * @defgroup tasks tasks
 *
 * Tasks process and build message payloads. They are used to create
 * and process multiple exchanges.
 *
 * @ingroup sa
 */
 /**
 * Name of the daemon.
 *
 * @ingroup charon
 */
 #define DAEMON_NAME "charon"
 /**
- * @brief Number of threads in the thread pool.
+ * Number of threads in the thread pool.
 * 
 * @ingroup charon
 */
 #define WORKER_THREADS 16
 /**
 * UDP Port on which the daemon will listen for incoming traffic.
 * 
 * @ingroup charon
 */
 #define IKEV2_UDP_PORT 500
 /**
 * UDP Port to which the daemon will float to if NAT is detected.
 *
 * @ingroup charon
 */
 #define IKEV2_NATT_PORT 4500
 /**
 * PID file, in which charon stores its process id
 * 
 * @ingroup charon
 */
 #define PID_FILE IPSEC_PIDDIR "/charon.pid"
 /**
 * Configuration directory
 * 
 * @ingroup charon
 */
 #define CONFIG_DIR IPSEC_CONFDIR
 /**
- * Directory of IPsec relevant files
+ * Main class of daemon, contains some globals.
 * 
 * @ingroup charon
 */
 #define IPSEC_D_DIR CONFIG_DIR "/ipsec.d"
 /**
 * Default directory for private keys
 * 
 * @ingroup charon
 */
 #define PRIVATE_KEY_DIR IPSEC_D_DIR "/private"
 /**
 * Default directory for end entity certificates
 * 
 * @ingroup charon
 */
 #define CERTIFICATE_DIR IPSEC_D_DIR "/certs"
 /**
 * Default directory for trusted Certification Authority certificates
 * 
 * @ingroup charon
 */
 #define CA_CERTIFICATE_DIR IPSEC_D_DIR "/cacerts"
 /**
 * Default directory for Authorization Authority certificates
 * 
 * @ingroup charon
 */
 #define AA_CERTIFICATE_DIR IPSEC_D_DIR "/aacerts"
 /**
 * Default directory for Attribute certificates
 * 
 * @ingroup charon
 */
 #define ATTR_CERTIFICATE_DIR IPSEC_D_DIR "/acerts"
 /**
 * Default directory for OCSP signing certificates
 * 
 * @ingroup charon
 */
 #define OCSP_CERTIFICATE_DIR IPSEC_D_DIR "/ocspcerts"
 /**
 * Default directory for CRLs
 * 
 * @ingroup charon
 */
 #define CRL_DIR IPSEC_D_DIR "/crls"
 /**
 * Secrets files
 * 
 * @ingroup charon
 */
 #define SECRETS_FILE CONFIG_DIR "/ipsec.secrets"
 /**
 * @brief Main class of daemon, contains some globals.
 *
 * @ingroup charon
 */
 struct daemon_t {
@@ -379,9 +210,9 @@ struct daemon_t {
 	backend_manager_t *backends;
 	/**
-	 * A credential_store_t instance.
+	 * Manager for the credential backends
 	 */
-	credential_store_t *credentials;
+	credential_manager_t *credentials;
 	/**
 	 * The Sender-Thread.
@@ -408,6 +239,11 @@ struct daemon_t {
 	 */
 	bus_t *bus;
 	/**
 	 * plugin loader
 	 */
 	plugin_loader_t *plugins;
 	/**
 	 * A bus listener logging to stdout
 	 */
@@ -429,9 +265,14 @@ struct daemon_t {
 	kernel_interface_t *kernel_interface;
 	/**
-	 * Interfaces for IPC
+	 * Controller to control the daemon
 	 */
-	interface_manager_t *interfaces;
+	controller_t *controller;
 	/**
 	 * EAP manager to maintain registered EAP methods
 	 */
 	eap_manager_t *eap;
 #ifdef P2P
 	/**
@@ -446,9 +287,8 @@ struct daemon_t {
 #endif /* P2P */
 	/**
-	 * @brief Shut down the daemon.
+	 * Shut down the daemon.
 	 * 
 	 * @param this			the daemon to kill
 	 * @param reason		describtion why it will be killed
 	 */
 	void (*kill) (daemon_t *this, char *reason);
@@ -459,4 +299,4 @@ struct daemon_t {
 */
 extern daemon_t *charon;
-#endif /*DAEMON_H_*/
+#endif /*DAEMON_H_ @} */
@@ -1,10 +1,3 @@
 /**
 * @file generator.c
 *
 * @brief Implementation of generator_t.
 *
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include <stdlib.h>
@@ -1,10 +1,3 @@
 /**
 * @file generator.h
 *
 * @brief Interface of generator_t.
 *
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup generator generator
 * @{ @ingroup encoding
 */
 #ifndef GENERATOR_H_
@@ -33,21 +33,17 @@ typedef struct generator_t generator_t;
 /**
 * Generating is done in a data buffer.
 * This is thehe start size of this buffer in bytes.
 *
 * @ingroup enconding
 */
 #define GENERATOR_DATA_BUFFER_SIZE 500
 /**
 * Number of bytes to increase the buffer, if it is to small.
 *
 * @ingroup enconding
 */
 #define GENERATOR_DATA_BUFFER_INCREASE_VALUE 500
 /**
- * @brief A generator_t class used to generate IKEv2 payloads.
+ * A generator_t class used to generate IKEv2 payloads.
 *
 * After creation, multiple payloads can be generated with the generate_payload
 * method. The generated bytes are appended. After all payloads are added, 
@@ -56,47 +52,36 @@ typedef struct generator_t generator_t;
 * The generater uses a set of encoding rules, which it can get from
 * the supplied payload. With this rules, the generater can generate
 * the payload and all substructures automatically.
 * 
 * @b Constructor:
 * - generator_create()
 * 
 * @ingroup encoding
 */
 struct generator_t {
 	/**
-	 * @brief Generates a specific payload from given payload object.
+	 * Generates a specific payload from given payload object.
 	 *
 	 * Remember: Header and substructures are also handled as payloads.
 	 *
-	 * @param this 				generator_t object
+	 * @param payload 		interface payload_t implementing object
 	 * @param[in] payload 		interface payload_t implementing object
 	 */
 	void (*generate_payload) (generator_t *this,payload_t *payload);
 	/**
-	 * @brief Writes all generated data of the generator to a chunk.
+	 * Writes all generated data of the generator to a chunk.
 	 *
-	 * @param this 				generator_t object
+ 	 * @param data 		chunk to write the data to
 	 * @param[out] data 		chunk to write the data to
 	 */
 	void (*write_to_chunk) (generator_t *this,chunk_t *data);
 	/**
-	 * @brief Destroys a generator_t object.
+	 * Destroys a generator_t object.
 	 *
 	 * @param this 				generator_t object
 	 */
 	void (*destroy) (generator_t *this);
 };
 /**
- * @brief Constructor to create a generator.
+ * Constructor to create a generator.
 * 
 * @return generator_t object.
 * 
 * @ingroup encoding
 */
 generator_t *generator_create(void);
-#endif /*GENERATOR_H_*/
+#endif /*GENERATOR_H_ @} */
@@ -1,10 +1,3 @@
 /**
 * @file message.c
 *
 * @brief Implementation of message_t.
 *
 */
 /*
 * Copyright (C) 2006-2007 Tobias Brunner
 * Copyright (C) 2006 Daniel Roethlisberger
@@ -21,6 +14,8 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include <stdlib.h>
@@ -82,13 +77,31 @@ struct payload_rule_t {
 	 bool sufficient;
 };
 typedef struct payload_order_t payload_order_t;
 /**
 * payload ordering structure allows us to reorder payloads according to RFC.
 */
 struct payload_order_t {
 	/**
 	 * payload type 
 	 */
 	payload_type_t type;
 	/** 
 	 * notify type, if payload == NOTIFY
 	 */
 	notify_type_t notify;
 };
 typedef struct message_rule_t message_rule_t;
 /**
 * A message rule defines the kind of a message,
 * if it has encrypted contents and a list
- * of payload rules.
+ * of payload ordering rules and payload parsing rules.
 * 
 */
 struct message_rule_t {
 	/**
@@ -109,124 +122,276 @@ struct message_rule_t {
 	/**
 	 * Number of payload rules which will follow
 	 */
-	size_t payload_rule_count;
+	int payload_rule_count;
 	/**
 	 * Pointer to first payload rule
 	 */
 	payload_rule_t *payload_rules;
 	/**
 	 * Number of payload order rules
 	 */
 	int payload_order_count;
 	/**
 	 * payload ordering rules
 	 */
 	payload_order_t *payload_order;
 };
 /**
 * Message rule for IKE_SA_INIT from initiator.
 */
 static payload_rule_t ike_sa_init_i_payload_rules[] = {
-	{NOTIFY,0,MAX_NOTIFY_PAYLOADS,FALSE,FALSE},
+/*	payload type					min	max						encr	suff */
-	{SECURITY_ASSOCIATION,1,1,FALSE,FALSE},
+	{NOTIFY,						0,	MAX_NOTIFY_PAYLOADS,	FALSE,	FALSE},
-	{KEY_EXCHANGE,1,1,FALSE,FALSE},
+	{SECURITY_ASSOCIATION,			1,	1,						FALSE,	FALSE},
-	{NONCE,1,1,FALSE,FALSE},
+	{KEY_EXCHANGE,					1,	1,						FALSE,	FALSE},
-	{VENDOR_ID,0,10,FALSE,FALSE},
+	{NONCE,							1,	1,						FALSE,	FALSE},
 	{VENDOR_ID,						0,	10,						FALSE,	FALSE},
 };
 /**
 * payload order for IKE_SA_INIT initiator
 */
 static payload_order_t ike_sa_init_i_payload_order[] = {
 /*	payload type					notify type */
 	{NOTIFY,						COOKIE},
 	{SECURITY_ASSOCIATION, 			0},
 	{KEY_EXCHANGE, 					0},
 	{NONCE, 						0},
 	{NOTIFY,						NAT_DETECTION_SOURCE_IP},
 	{NOTIFY,						NAT_DETECTION_DESTINATION_IP},
 	{VENDOR_ID,						0},
 };
 /**
 * Message rule for IKE_SA_INIT from responder.
 */
 static payload_rule_t ike_sa_init_r_payload_rules[] = {
-	{NOTIFY,0,MAX_NOTIFY_PAYLOADS,FALSE,TRUE},
+/*	payload type					min	max						encr	suff */
-	{SECURITY_ASSOCIATION,1,1,FALSE,FALSE},
+	{NOTIFY,						0,	MAX_NOTIFY_PAYLOADS,	FALSE,	TRUE},
-	{KEY_EXCHANGE,1,1,FALSE,FALSE},
+	{SECURITY_ASSOCIATION,			1,	1,						FALSE,	FALSE},
-	{NONCE,1,1,FALSE,FALSE},
+	{KEY_EXCHANGE,					1,	1,						FALSE,	FALSE},
-	{VENDOR_ID,0,10,FALSE,FALSE},
+	{NONCE,							1,	1,						FALSE,	FALSE},
 	{VENDOR_ID,						0,	10,						FALSE,	FALSE},
 };
 /**
 * payload order for IKE_SA_INIT responder
 */
 static payload_order_t ike_sa_init_r_payload_order[] = {
 /*	payload type					notify type */
 	{SECURITY_ASSOCIATION, 			0},
 	{KEY_EXCHANGE, 					0},
 	{NONCE, 						0},
 	{NOTIFY,						NAT_DETECTION_SOURCE_IP},
 	{NOTIFY,						NAT_DETECTION_DESTINATION_IP},
 	{NOTIFY,						HTTP_CERT_LOOKUP_SUPPORTED},
 	{CERTIFICATE_REQUEST,			0},
 	{VENDOR_ID,						0},
 };
 /**
 * Message rule for IKE_AUTH from initiator.
 */
 static payload_rule_t ike_auth_i_payload_rules[] = {
-	{NOTIFY,0,MAX_NOTIFY_PAYLOADS,TRUE,FALSE},
+/*	payload type					min	max						encr	suff */
-	{EXTENSIBLE_AUTHENTICATION,0,1,TRUE,TRUE},
+	{NOTIFY,						0,	MAX_NOTIFY_PAYLOADS,	TRUE,	FALSE},
-	{AUTHENTICATION,0,1,TRUE,TRUE},
+	{EXTENSIBLE_AUTHENTICATION,		0,	1,						TRUE,	TRUE},
-	{ID_INITIATOR,1,1,TRUE,FALSE},
+	{AUTHENTICATION,				0,	1,						TRUE,	TRUE},
-	{CERTIFICATE,0,1,TRUE,FALSE},
+	{ID_INITIATOR,					1,	1,						TRUE,	FALSE},
-	{CERTIFICATE_REQUEST,0,1,TRUE,FALSE},
+	{CERTIFICATE,					0,	4,						TRUE,	FALSE},
-	{ID_RESPONDER,0,1,TRUE,FALSE},
+	{CERTIFICATE_REQUEST,			0,	1,						TRUE,	FALSE},
 	{ID_RESPONDER,					0,	1,						TRUE,	FALSE},
 #ifdef P2P
-	{SECURITY_ASSOCIATION,0,1,TRUE,FALSE},
+	{SECURITY_ASSOCIATION,			0,	1,						TRUE,	FALSE},
-	{TRAFFIC_SELECTOR_INITIATOR,0,1,TRUE,FALSE},
+	{TRAFFIC_SELECTOR_INITIATOR,	0,	1,						TRUE,	FALSE},
-	{TRAFFIC_SELECTOR_RESPONDER,0,1,TRUE,FALSE},
+	{TRAFFIC_SELECTOR_RESPONDER,	0,	1,						TRUE,	FALSE},
 #else
-	{SECURITY_ASSOCIATION,1,1,TRUE,FALSE},
+	{SECURITY_ASSOCIATION,			1,	1,						TRUE,	FALSE},
-	{TRAFFIC_SELECTOR_INITIATOR,1,1,TRUE,FALSE},
+	{TRAFFIC_SELECTOR_INITIATOR,	1,	1,						TRUE,	FALSE},
-	{TRAFFIC_SELECTOR_RESPONDER,1,1,TRUE,FALSE},
+	{TRAFFIC_SELECTOR_RESPONDER,	1,	1,						TRUE,	FALSE},
 #endif /* P2P */
-	{CONFIGURATION,0,1,TRUE,FALSE},
+	{CONFIGURATION,					0,	1,						TRUE,	FALSE},
-	{VENDOR_ID,0,10,TRUE,FALSE},
+	{VENDOR_ID,						0,	10,						TRUE,	FALSE},
 };
 /**
 * payload order for IKE_AUTH initiator
 */
 static payload_order_t ike_auth_i_payload_order[] = {
 /*	payload type					notify type */
 	{ID_INITIATOR,					0},
 	{CERTIFICATE,					0},
 	{NOTIFY,						INITIAL_CONTACT},
 	{NOTIFY,						HTTP_CERT_LOOKUP_SUPPORTED},
 	{CERTIFICATE_REQUEST,			0},
 	{ID_RESPONDER,					0},
 	{AUTHENTICATION,				0},
 	{EXTENSIBLE_AUTHENTICATION,		0},
 	{CONFIGURATION,					0},
 	{NOTIFY,						IPCOMP_SUPPORTED},
 	{NOTIFY,						USE_TRANSPORT_MODE},
 	{NOTIFY,						ESP_TFC_PADDING_NOT_SUPPORTED},
 	{NOTIFY,						NON_FIRST_FRAGMENTS_ALSO},
 	{SECURITY_ASSOCIATION, 			0},
 	{TRAFFIC_SELECTOR_INITIATOR,	0},
 	{TRAFFIC_SELECTOR_RESPONDER,	0},
 	{NOTIFY,						MOBIKE_SUPPORTED},
 	{NOTIFY,						ADDITIONAL_IP4_ADDRESS},
 	{NOTIFY,						ADDITIONAL_IP6_ADDRESS},
 	{NOTIFY,						NO_ADDITIONAL_ADDRESSES},
 	{VENDOR_ID,						0},
 };
 /**
 * Message rule for IKE_AUTH from responder.
 */
 static payload_rule_t ike_auth_r_payload_rules[] = {
-	{NOTIFY,0,MAX_NOTIFY_PAYLOADS,TRUE,TRUE},
+/*	payload type					min	max						encr	suff */
-	{EXTENSIBLE_AUTHENTICATION,0,1,TRUE,TRUE},
+	{NOTIFY,						0,	MAX_NOTIFY_PAYLOADS,	TRUE,	TRUE},
-	{CERTIFICATE,0,1,TRUE,FALSE},
+	{EXTENSIBLE_AUTHENTICATION,		0,	1,						TRUE,	TRUE},
-	{ID_RESPONDER,0,1,TRUE,FALSE},
+	{CERTIFICATE,					0,	4,						TRUE,	FALSE},
-	{AUTHENTICATION,0,1,TRUE,FALSE},
+	{ID_RESPONDER,					0,	1,						TRUE,	FALSE},
-	{SECURITY_ASSOCIATION,0,1,TRUE,FALSE},
+	{AUTHENTICATION,				0,	1,						TRUE,	FALSE},
-	{TRAFFIC_SELECTOR_INITIATOR,0,1,TRUE,FALSE},
+	{SECURITY_ASSOCIATION,			0,	1,						TRUE,	FALSE},
-	{TRAFFIC_SELECTOR_RESPONDER,0,1,TRUE,FALSE},
+	{TRAFFIC_SELECTOR_INITIATOR,	0,	1,						TRUE,	FALSE},
-	{CONFIGURATION,0,1,TRUE,FALSE},
+	{TRAFFIC_SELECTOR_RESPONDER,	0,	1,						TRUE,	FALSE},
-	{VENDOR_ID,0,10,TRUE,FALSE},
+	{CONFIGURATION,					0,	1,						TRUE,	FALSE},
 	{VENDOR_ID,						0,	10,						TRUE,	FALSE},
 };
 /**
 * payload order for IKE_AUTH responder
 */
 static payload_order_t ike_auth_r_payload_order[] = {
 /*	payload type					notify type */
 	{ID_RESPONDER,					0},
 	{CERTIFICATE,					0},
 	{AUTHENTICATION,				0},
 	{EXTENSIBLE_AUTHENTICATION,		0},
 	{CONFIGURATION,					0},
 	{NOTIFY,						IPCOMP_SUPPORTED},
 	{NOTIFY,						USE_TRANSPORT_MODE},
 	{NOTIFY,						ESP_TFC_PADDING_NOT_SUPPORTED},
 	{NOTIFY,						NON_FIRST_FRAGMENTS_ALSO},
 	{SECURITY_ASSOCIATION, 			0},
 	{TRAFFIC_SELECTOR_INITIATOR,	0},
 	{TRAFFIC_SELECTOR_RESPONDER,	0},
 	{NOTIFY,						AUTH_LIFETIME},
 	{NOTIFY,						MOBIKE_SUPPORTED},
 	{NOTIFY,						ADDITIONAL_IP4_ADDRESS},
 	{NOTIFY,						ADDITIONAL_IP6_ADDRESS},
 	{NOTIFY,						NO_ADDITIONAL_ADDRESSES},
 	{VENDOR_ID,						0},
 };
 /**
 * Message rule for INFORMATIONAL from initiator.
 */
 static payload_rule_t informational_i_payload_rules[] = {
-	{NOTIFY,0,MAX_NOTIFY_PAYLOADS,TRUE,FALSE},
+/*	payload type					min	max						encr	suff */
-	{CONFIGURATION,0,1,TRUE,FALSE},
+	{NOTIFY,						0,	MAX_NOTIFY_PAYLOADS,	TRUE,	FALSE},
-	{DELETE,0,1,TRUE,FALSE},
+	{CONFIGURATION,					0,	1,						TRUE,	FALSE},
-	{VENDOR_ID,0,10,TRUE,FALSE},
+	{DELETE,						0,	1,						TRUE,	FALSE},
-	
+	{VENDOR_ID,						0,	10,						TRUE,	FALSE},
 };
 /**
 * payload order for INFORMATIONAL initiator
 */
 static payload_order_t informational_i_payload_order[] = {
 /*	payload type					notify type */
 	{NOTIFY,						0},
 	{DELETE,						0},
 	{CONFIGURATION,					0},
 };
 /**
 * Message rule for INFORMATIONAL from responder.
 */
 static payload_rule_t informational_r_payload_rules[] = {
-	{NOTIFY,0,MAX_NOTIFY_PAYLOADS,TRUE,FALSE},
+/*	payload type					min	max						encr	suff */
-	{CONFIGURATION,0,1,TRUE,FALSE},
+	{NOTIFY,						0,	MAX_NOTIFY_PAYLOADS,	TRUE,	FALSE},
-	{DELETE,0,1,TRUE,FALSE},
+	{CONFIGURATION,					0,	1,						TRUE,	FALSE},
-	{VENDOR_ID,0,10,TRUE,FALSE},
+	{DELETE,						0,	1,						TRUE,	FALSE},
 	{VENDOR_ID,						0,	10,						TRUE,	FALSE},
 };
 /**
 * payload order for INFORMATIONAL responder
 */
 static payload_order_t informational_r_payload_order[] = {
 /*	payload type					notify type */
 	{NOTIFY,						0},
 	{DELETE,						0},
 	{CONFIGURATION,					0},
 };
 /**
 * Message rule for CREATE_CHILD_SA from initiator.
 */
 static payload_rule_t create_child_sa_i_payload_rules[] = {
-	{NOTIFY,0,MAX_NOTIFY_PAYLOADS,TRUE,FALSE},
+/*	payload type					min	max						encr	suff */
-	{SECURITY_ASSOCIATION,1,1,TRUE,FALSE},
+	{NOTIFY,						0,	MAX_NOTIFY_PAYLOADS,	TRUE,	FALSE},
-	{NONCE,1,1,TRUE,FALSE},
+	{SECURITY_ASSOCIATION,			1,	1,						TRUE,	FALSE},
-	{KEY_EXCHANGE,0,1,TRUE,FALSE},
+	{NONCE,							1,	1,						TRUE,	FALSE},
-	{TRAFFIC_SELECTOR_INITIATOR,0,1,TRUE,FALSE},
+	{KEY_EXCHANGE,					0,	1,						TRUE,	FALSE},
-	{TRAFFIC_SELECTOR_RESPONDER,0,1,TRUE,FALSE},
+	{TRAFFIC_SELECTOR_INITIATOR,	0,	1,						TRUE,	FALSE},
-	{CONFIGURATION,0,1,TRUE,FALSE},
+	{TRAFFIC_SELECTOR_RESPONDER,	0,	1,						TRUE,	FALSE},
-	{VENDOR_ID,0,10,TRUE,FALSE},
+	{CONFIGURATION,					0,	1,						TRUE,	FALSE},
 	{VENDOR_ID,						0,	10,						TRUE,	FALSE},
 };
 /**
 * payload order for CREATE_CHILD_SA from initiator.
 */
 static payload_order_t create_child_sa_i_payload_order[] = {
 /*	payload type					notify type */
 	{NOTIFY,						REKEY_SA},
 	{NOTIFY,						IPCOMP_SUPPORTED},
 	{NOTIFY,						USE_TRANSPORT_MODE},
 	{NOTIFY,						ESP_TFC_PADDING_NOT_SUPPORTED},
 	{NOTIFY,						NON_FIRST_FRAGMENTS_ALSO},
 	{SECURITY_ASSOCIATION, 			0},
 	{NONCE,							0},
 	{KEY_EXCHANGE, 					0},
 	{TRAFFIC_SELECTOR_INITIATOR,	0},
 	{TRAFFIC_SELECTOR_RESPONDER,	0},
 };
 /**
 * Message rule for CREATE_CHILD_SA from responder.
 */
 static payload_rule_t create_child_sa_r_payload_rules[] = {
-	{NOTIFY,0,MAX_NOTIFY_PAYLOADS,TRUE,TRUE},
+/*	payload type					min	max						encr	suff */
-	{SECURITY_ASSOCIATION,1,1,TRUE,FALSE},
+	{NOTIFY,						0,	MAX_NOTIFY_PAYLOADS,	TRUE,	TRUE},
-	{NONCE,1,1,TRUE,FALSE},
+	{SECURITY_ASSOCIATION,			1,	1,						TRUE,	FALSE},
-	{KEY_EXCHANGE,0,1,TRUE,FALSE},
+	{NONCE,							1,	1,						TRUE,	FALSE},
-	{TRAFFIC_SELECTOR_INITIATOR,0,1,TRUE,FALSE},
+	{KEY_EXCHANGE,					0,	1,						TRUE,	FALSE},
-	{TRAFFIC_SELECTOR_RESPONDER,0,1,TRUE,FALSE},
+	{TRAFFIC_SELECTOR_INITIATOR,	0,	1,						TRUE,	FALSE},
-	{CONFIGURATION,0,1,TRUE,FALSE},
+	{TRAFFIC_SELECTOR_RESPONDER,	0,	1,						TRUE,	FALSE},
-	{VENDOR_ID,0,10,TRUE,FALSE},
+	{CONFIGURATION,					0,	1,						TRUE,	FALSE},
 	{VENDOR_ID,						0,	10,						TRUE,	FALSE},
 };
 /**
 * payload order for CREATE_CHILD_SA from responder.
 */
 static payload_order_t create_child_sa_r_payload_order[] = {
 /*	payload type					notify type */
 	{NOTIFY,						IPCOMP_SUPPORTED},
 	{NOTIFY,						USE_TRANSPORT_MODE},
 	{NOTIFY,						ESP_TFC_PADDING_NOT_SUPPORTED},
 	{NOTIFY,						NON_FIRST_FRAGMENTS_ALSO},
 	{SECURITY_ASSOCIATION, 			0},
 	{NONCE,							0},
 	{KEY_EXCHANGE, 					0},
 	{TRAFFIC_SELECTOR_INITIATOR,	0},
 	{TRAFFIC_SELECTOR_RESPONDER,	0},
 	{NOTIFY,						ADDITIONAL_TS_POSSIBLE},
 };
 #ifdef P2P
@@ -234,17 +399,38 @@ static payload_rule_t create_child_sa_r_payload_rules[] = {
 * Message rule for P2P_CONNECT from initiator.
 */
 static payload_rule_t p2p_connect_i_payload_rules[] = {
-	{NOTIFY,0,MAX_NOTIFY_PAYLOADS,TRUE,TRUE},
+/*	payload type					min	max						encr	suff */
-	{ID_PEER,1,1,TRUE,FALSE},
+	{NOTIFY,						0,	MAX_NOTIFY_PAYLOADS,	TRUE,	TRUE},
-	{VENDOR_ID,0,10,TRUE,FALSE}
+	{ID_PEER,						1,	1,						TRUE,	FALSE},
 	{VENDOR_ID,						0,	10,						TRUE,	FALSE}
 };
 /**
 * payload order for P2P_CONNECT from initiator.
 */
 static payload_order_t p2p_connect_i_payload_order[] = {
 /*	payload type					notify type */
 	{NOTIFY,						0},
 	{ID_PEER,						0},
 	{VENDOR_ID,						0},
 };
 /**
 * Message rule for P2P_CONNECT from responder.
 */
 static payload_rule_t p2p_connect_r_payload_rules[] = {
-	{NOTIFY,0,MAX_NOTIFY_PAYLOADS,TRUE,TRUE},
+/*	payload type					min	max						encr	suff */
-	{VENDOR_ID,0,10,TRUE,FALSE}
+	{NOTIFY,						0,	MAX_NOTIFY_PAYLOADS,	TRUE,	TRUE},
 	{VENDOR_ID,						0,	10,						TRUE,	FALSE}
 };
 /**
 * payload order for P2P_CONNECT from responder.
 */
 static payload_order_t p2p_connect_r_payload_order[] = {
 /*	payload type					notify type */
 	{NOTIFY,						0},
 	{VENDOR_ID,						0},
 };
 #endif /* P2P */
@@ -252,17 +438,67 @@ static payload_rule_t p2p_connect_r_payload_rules[] = {
 * Message rules, defines allowed payloads.
 */
 static message_rule_t message_rules[] = {
-	{IKE_SA_INIT,TRUE,FALSE,(sizeof(ike_sa_init_i_payload_rules)/sizeof(payload_rule_t)),ike_sa_init_i_payload_rules},
+	{IKE_SA_INIT,		TRUE,	FALSE,
-	{IKE_SA_INIT,FALSE,FALSE,(sizeof(ike_sa_init_r_payload_rules)/sizeof(payload_rule_t)),ike_sa_init_r_payload_rules},
+		(sizeof(ike_sa_init_i_payload_rules)/sizeof(payload_rule_t)),
-	{IKE_AUTH,TRUE,TRUE,(sizeof(ike_auth_i_payload_rules)/sizeof(payload_rule_t)),ike_auth_i_payload_rules},
+		ike_sa_init_i_payload_rules,
-	{IKE_AUTH,FALSE,TRUE,(sizeof(ike_auth_r_payload_rules)/sizeof(payload_rule_t)),ike_auth_r_payload_rules},
+		(sizeof(ike_sa_init_i_payload_order)/sizeof(payload_order_t)),
-	{INFORMATIONAL,TRUE,TRUE,(sizeof(informational_i_payload_rules)/sizeof(payload_rule_t)),informational_i_payload_rules},
+		ike_sa_init_i_payload_order,
-	{INFORMATIONAL,FALSE,TRUE,(sizeof(informational_r_payload_rules)/sizeof(payload_rule_t)),informational_r_payload_rules},
+	},
-	{CREATE_CHILD_SA,TRUE,TRUE,(sizeof(create_child_sa_i_payload_rules)/sizeof(payload_rule_t)),create_child_sa_i_payload_rules},
+	{IKE_SA_INIT,		FALSE,	FALSE,
-	{CREATE_CHILD_SA,FALSE,TRUE,(sizeof(create_child_sa_r_payload_rules)/sizeof(payload_rule_t)),create_child_sa_r_payload_rules},
+		(sizeof(ike_sa_init_r_payload_rules)/sizeof(payload_rule_t)),
 		ike_sa_init_r_payload_rules,
 		(sizeof(ike_sa_init_r_payload_order)/sizeof(payload_order_t)),
 		ike_sa_init_r_payload_order,
 	},
 	{IKE_AUTH,			TRUE,	TRUE,
 		(sizeof(ike_auth_i_payload_rules)/sizeof(payload_rule_t)),
 		ike_auth_i_payload_rules,
 		(sizeof(ike_auth_i_payload_order)/sizeof(payload_order_t)),
 		ike_auth_i_payload_order,
 	},
 	{IKE_AUTH,			FALSE,	TRUE,
 		(sizeof(ike_auth_r_payload_rules)/sizeof(payload_rule_t)),
 		ike_auth_r_payload_rules,
 		(sizeof(ike_auth_r_payload_order)/sizeof(payload_order_t)),
 		ike_auth_r_payload_order,
 	},
 	{INFORMATIONAL,		TRUE,	TRUE,
 		(sizeof(informational_i_payload_rules)/sizeof(payload_rule_t)),
 		informational_i_payload_rules,
 		(sizeof(informational_i_payload_order)/sizeof(payload_order_t)),
 		informational_i_payload_order,
 	},
 	{INFORMATIONAL,		FALSE,	TRUE,
 		(sizeof(informational_r_payload_rules)/sizeof(payload_rule_t)),
 		informational_r_payload_rules,
 		(sizeof(informational_r_payload_order)/sizeof(payload_order_t)),
 		informational_r_payload_order,
 	},
 	{CREATE_CHILD_SA,	TRUE,	TRUE,
 		(sizeof(create_child_sa_i_payload_rules)/sizeof(payload_rule_t)),
 		create_child_sa_i_payload_rules,
 		(sizeof(create_child_sa_i_payload_order)/sizeof(payload_order_t)),
 		create_child_sa_i_payload_order,
 	},
 	{CREATE_CHILD_SA,	FALSE,	TRUE,
 		(sizeof(create_child_sa_r_payload_rules)/sizeof(payload_rule_t)),
 		create_child_sa_r_payload_rules,
 		(sizeof(create_child_sa_r_payload_order)/sizeof(payload_order_t)),
 		create_child_sa_r_payload_order,
 	},
 #ifdef P2P
-	{P2P_CONNECT,TRUE,TRUE,(sizeof(p2p_connect_i_payload_rules)/sizeof(payload_rule_t)),p2p_connect_i_payload_rules},
+	{P2P_CONNECT,		TRUE,	TRUE,
-	{P2P_CONNECT,FALSE,TRUE,(sizeof(p2p_connect_r_payload_rules)/sizeof(payload_rule_t)),p2p_connect_r_payload_rules},
+		(sizeof(p2p_connect_i_payload_rules)/sizeof(payload_rule_t)),
 		p2p_connect_i_payload_rules,
 		(sizeof(p2p_connect_i_payload_order)/sizeof(payload_order_t)),
 		p2p_connect_i_payload_order,
 	},
 	{P2P_CONNECT,		FALSE,	TRUE,
 		(sizeof(p2p_connect_r_payload_rules)/sizeof(payload_rule_t)),
 		p2p_connect_r_payload_rules,
 		(sizeof(p2p_connect_r_payload_order)/sizeof(payload_order_t)),
 		p2p_connect_r_payload_order,
 	},
 #endif /* P2P */	
 };
@@ -517,38 +753,19 @@ static bool is_encoded(private_message_t *this)
 */
 static void add_payload(private_message_t *this, payload_t *payload)
 {
-	payload_t *last_payload, *first_payload;
+	payload_t *last_payload;
-	
+
-	if ((this->is_request && payload->get_type(payload) == ID_INITIATOR) ||
+	if (this->payloads->get_count(this->payloads) > 0)
 		(!this->is_request && payload->get_type(payload) == ID_RESPONDER))
 	{
-		/* HOTD: insert ID payload in the beginning to respect RFC */
+		this->payloads->get_last(this->payloads, (void **)&last_payload);
-		if (this->payloads->get_first(this->payloads,
+		last_payload->set_next_type(last_payload, payload->get_type(payload));
 									  (void **)&first_payload) == SUCCESS)
 		{
 			payload->set_next_type(payload, first_payload->get_type(first_payload));
 		}
 		else
 		{
 			payload->set_next_type(payload, NO_PAYLOAD);
 		}
 		this->first_payload = payload->get_type(payload);
 		this->payloads->insert_first(this->payloads, payload);
 	}
 	else
 	{
-		if (this->payloads->get_count(this->payloads) > 0)
+		this->first_payload = payload->get_type(payload);
 		{
 			this->payloads->get_last(this->payloads,(void **) &last_payload);
 			last_payload->set_next_type(last_payload, payload->get_type(payload));
 		}
 		else
 		{
 			this->first_payload = payload->get_type(payload);
 		}
 		payload->set_next_type(payload, NO_PAYLOAD);
 		this->payloads->insert_last(this->payloads, payload);
 	}
 	payload->set_next_type(payload, NO_PAYLOAD);
 	this->payloads->insert_last(this->payloads, payload);
 	DBG2(DBG_ENC ,"added payload of type %N to message",
 		 payload_type_names, payload->get_type(payload));
@@ -693,10 +910,66 @@ static char* get_string(private_message_t *this, char *buf, int len)
 	return buf;
 }
 /**
 * reorder payloads depending on reordering rules
 */
 static void order_payloads(private_message_t *this)
 {
 	linked_list_t *list;
 	payload_t *payload;
 	int i;
 	/* move to temp list */
 	list = linked_list_create();
 	while (this->payloads->remove_last(this->payloads,
 									   (void**)&payload) == SUCCESS)
 	{
 		list->insert_first(list, payload);
 	}
 	/* for each rule, ... */
 	for (i = 0; i < this->message_rule->payload_order_count; i++)
 	{
 		enumerator_t *enumerator;
 		notify_payload_t *notify;
 		payload_order_t order = this->message_rule->payload_order[i];
 		/* ... find all payload ... */
 		enumerator = list->create_enumerator(list);
 		while (enumerator->enumerate(enumerator, &payload))
 		{
 			/* ... with that type ... */
 			if (payload->get_type(payload) == order.type)
 			{
 				notify = (notify_payload_t*)payload;
 				/**... and check notify for type. */
 				if (order.type != NOTIFY || order.notify == 0 ||
 					order.notify == notify->get_notify_type(notify))
 				{
 					list->remove_at(list, enumerator);
 					add_payload(this, payload);
 				}
 			} 
 		}
 		enumerator->destroy(enumerator);
 	}
 	/* append all payloads without a rule to the end */
 	while (list->remove_last(list, (void**)&payload) == SUCCESS)
 	{
 		DBG1(DBG_ENC, "payload %N has no ordering rule in %N %s",
 			 payload_type_names, payload->get_type(payload),
 			 exchange_type_names, this->message_rule->exchange_type,
 			 this->message_rule->is_request ? "request" : "response");
 		add_payload(this, payload);
 	}
 	list->destroy(list);
 }
 /**
 * Implementation of private_message_t.encrypt_payloads.
 */
-static status_t encrypt_payloads (private_message_t *this,crypter_t *crypter, signer_t* signer)
+static status_t encrypt_payloads(private_message_t *this,
 								 crypter_t *crypter, signer_t* signer)
 {
 	encryption_payload_t *encryption_payload = NULL;
 	status_t status;
@@ -778,7 +1051,8 @@ static status_t encrypt_payloads (private_message_t *this,crypter_t *crypter, si
 /**
 * Implementation of message_t.generate.
 */
-static status_t generate(private_message_t *this, crypter_t *crypter, signer_t* signer, packet_t **packet)
+static status_t generate(private_message_t *this, crypter_t *crypter,
 						 signer_t* signer, packet_t **packet)
 {
 	generator_t *generator;
 	ike_header_t *ike_header;
@@ -795,8 +1069,6 @@ static status_t generate(private_message_t *this, crypter_t *crypter, signer_t*
 		return SUCCESS;
 	}
 	DBG1(DBG_ENC, "generating %s", get_string(this, str, sizeof(str)));
 	if (this->exchange_type == EXCHANGE_TYPE_UNDEFINED)
 	{
 		DBG1(DBG_ENC, "exchange type is not defined");
@@ -819,6 +1091,10 @@ static status_t generate(private_message_t *this, crypter_t *crypter, signer_t*
 		return NOT_SUPPORTED;
 	}
 	order_payloads(this);
 	DBG1(DBG_ENC, "generating %s", get_string(this, str, sizeof(str)));
 	/* going to encrypt all content which have to be encrypted */
 	status = encrypt_payloads(this, crypter, signer);
 	if (status != SUCCESS)
@@ -842,7 +1118,7 @@ static status_t generate(private_message_t *this, crypter_t *crypter, signer_t*
 	payload = (payload_t*)ike_header;
-	/* generate every payload expect last one, this is doen later*/
+	/* generate every payload expect last one, this is done later*/
 	iterator = this->payloads->create_iterator(this->payloads, TRUE);
 	while(iterator->iterate(iterator, (void**)&next_payload))
 	{
@@ -1346,3 +1622,4 @@ message_t *message_create()
 {
 	return message_create_from_packet(NULL);
 }
@@ -1,10 +1,3 @@
 /**
 * @file message.h
 *
 * @brief Interface of message_t.
 *
 */
 /*
 * Copyright (C) 2006-2007 Tobias Brunner
 * Copyright (C) 2006 Daniel Roethlisberger
@@ -21,6 +14,13 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup message message
 * @{ @ingroup encoding
 */
 #ifndef MESSAGE_H_
@@ -38,148 +38,126 @@ typedef struct message_t message_t;
 #include <crypto/signers/signer.h>
 /**
- * @brief This class is used to represent an IKEv2-Message.
+ * This class is used to represent an IKEv2-Message.
 *
 * The message handles parsing and generation of payloads
 * via parser_t/generator_t. Encryption is done transparently
 * via the encryption_payload_t. A set of rules for messages
 * and payloads does check parsed messages.
 * 
 * @b Constructors:
 * - message_create()
 * - message_create_from_packet()
 * - message_create_notify_reply()
 *
 * @ingroup encoding
 */
 struct message_t {
 	/**
-	 * @brief Sets the IKE major version of the message.
+	 * Sets the IKE major version of the message.
 	 *
 	 * @param this 			message_t object
 	 * @param major_version	major version to set
 	 */
 	void (*set_major_version) (message_t *this,u_int8_t major_version);
 	/**
-	 * @brief Gets the IKE major version of the message.
+	 * Gets the IKE major version of the message.
 	 *
 	 * @param this 			message_t object
 	 * @return				major version of the message
 	 */
 	u_int8_t (*get_major_version) (message_t *this);
 	/**
-	 * @brief Sets the IKE minor version of the message.
+	 * Sets the IKE minor version of the message.
 	 *
 	 * @param this 			message_t object
 	 * @param minor_version	minor version to set
 	 */
 	void (*set_minor_version) (message_t *this,u_int8_t minor_version);
 	/**
-	 * @brief Gets the IKE minor version of the message.
+	 * Gets the IKE minor version of the message.
 	 *
 	 * @param this 			message_t object
 	 * @return				minor version of the message
 	 */
 	u_int8_t (*get_minor_version) (message_t *this);
 	/**
-	 * @brief Sets the Message ID of the message.
+	 * Sets the Message ID of the message.
 	 *
-	 * @param this 			message_t object
+	 * @param message_id	message_id to set
 	 * @param message_id		message_id to set
 	 */
 	void (*set_message_id) (message_t *this,u_int32_t message_id);
 	/**
-	 * @brief Gets the Message ID of the message.
+	 * Gets the Message ID of the message.
 	 *
 	 * @param this 			message_t object
 	 * @return				message_id type of the message
 	 */
 	u_int32_t (*get_message_id) (message_t *this);
 	/**
-	 * @brief Gets the initiator SPI of the message.
+	 * Gets the initiator SPI of the message.
 	 *
 	 * @param this 			message_t object
 	 * @return				initiator spi of the message
 	 */
 	u_int64_t (*get_initiator_spi) (message_t *this);
 	/**
-	 * @brief Gets the responder SPI of the message.
+	 * Gets the responder SPI of the message.
 	 *
 	 * @param this 			message_t object
 	 * @return				responder spi of the message
 	 */
 	u_int64_t (*get_responder_spi) (message_t *this);
 	/**
-	 * @brief Sets the IKE_SA ID of the message.
+	 * Sets the IKE_SA ID of the message.
 	 * 
 	 * ike_sa_id gets cloned.
 	 *
 	 * @param this 			message_t object
 	 * @param ike_sa_id		ike_sa_id to set
 	 */
 	void (*set_ike_sa_id) (message_t *this, ike_sa_id_t * ike_sa_id);
 	/**
-	 * @brief Gets the IKE_SA ID of the message.
+	 * Gets the IKE_SA ID of the message.
 	 *
 	 * The ike_sa_id points to the message internal id, do not modify.
 	 *
 	 * @param this 			message_t object
 	 * @return				ike_sa_id of message
 	 */
 	ike_sa_id_t *(*get_ike_sa_id) (message_t *this);
 	/**
-	 * @brief Sets the exchange type of the message.
+	 * Sets the exchange type of the message.
 	 *
 	 * @param this 			message_t object
 	 * @param exchange_type	exchange_type to set
 	 */
 	void (*set_exchange_type) (message_t *this,exchange_type_t exchange_type);
 	/**
-	 * @brief Gets the exchange type of the message.
+	 * Gets the exchange type of the message.
 	 *
 	 * @param this 			message_t object
 	 * @return				exchange type of the message
 	 */
 	exchange_type_t (*get_exchange_type) (message_t *this);
 	/**
-	 * @brief Gets the payload type of the first payload.
+	 * Gets the payload type of the first payload.
 	 * 
 	 * @param this			message_t object
 	 * @return				payload type of the first payload
 	 */
 	payload_type_t (*get_first_payload_type) (message_t *this);
 	/**
-	 * @brief Sets the request flag.
+	 * Sets the request flag.
 	 *
-	 * @param this 					message_t object
+	 * @param request		TRUE if message is a request, FALSE if it is a reply
 	 * @param original_initiator		TRUE if message is a request, FALSE if it is a reply
 	 */
-	void (*set_request) (message_t *this,bool request);
+	void (*set_request) (message_t *this, bool request);
 	/**
-	 * @brief Gets request flag.
+	 * Gets request flag.
 	 *
 	 * @param this 			message_t object
 	 * @return				TRUE if message is a request, FALSE if it is a reply
 	 */
 	bool (*get_request) (message_t *this);
 	/**
-	 * @brief Append a payload to the message.
+	 * Append a payload to the message.
 	 * 
 	 * If the payload must be encrypted is not specified here. Encryption
 	 * of payloads is evaluated via internal rules for the messages and
@@ -187,19 +165,17 @@ struct message_t {
 	 * all payloads to encrypt are added to the encryption payload, which is 
 	 * always the last one.
 	 *
 	 * @param this 			message_t object
 	 * @param payload 		payload to append
 	 */	
 	void (*add_payload) (message_t *this, payload_t *payload);
 	/**
-	 * @brief Build a notify payload and add it to the message.
+	 * Build a notify payload and add it to the message.
 	 * 
 	 * This is a helper method to create notify messages or add
 	 * notify payload to messages. The flush parameter specifies if existing
 	 * payloads should get removed before appending the notify.
 	 *
 	 * @param this 			message_t object
 	 * @param flush			TRUE to remove existing payloads
 	 * @param type			type of the notify
 	 * @param data			a chunk of data to add to the notify, gets cloned
@@ -208,13 +184,12 @@ struct message_t {
 						chunk_t data);
 	/**
-	 * @brief Parses header of message.
+	 * Parses header of message.
 	 * 
 	 * Begins parisng of a message created via message_create_from_packet().
 	 * The parsing context is stored, so a subsequent call to parse_body()
 	 * will continue the parsing process.
 	 *
 	 * @param this 		message_t object
 	 * @return
 	 * 					- SUCCESS if header could be parsed
 	 *					- PARSE_ERROR if corrupted/invalid data found
@@ -223,7 +198,7 @@ struct message_t {
 	status_t (*parse_header) (message_t *this);
 	/**
-	 * @brief Parses body of message.
+	 * Parses body of message.
 	 * 
 	 * The body gets not only parsed, but rather it gets verified. 
 	 * All payloads are verified if they are allowed to exist in the message 
@@ -234,7 +209,6 @@ struct message_t {
 	 * Crypter/signer can be omitted (by passing NULL) when no encryption 
 	 * payload is expected.
 	 *
 	 * @param this 		message_t object
 	 * @param crypter	crypter to decrypt encryption payloads
 	 * @param signer	signer to verifiy a message with an encryption payload
 	 * @return
@@ -249,7 +223,7 @@ struct message_t {
 	status_t (*parse_body) (message_t *this, crypter_t *crypter, signer_t *signer);
 	/**
-	 * @brief Generates the UDP packet of specific message.
+	 * Generates the UDP packet of specific message.
 	 * 
 	 * Payloads which must be encrypted are generated first and added to
 	 * an encryption payload. This encryption payload will get encrypted via 
@@ -260,7 +234,6 @@ struct message_t {
 	 * payload is expected.
 	 * Generation is only done once, multiple calls will just return a packet copy.
 	 *
 	 * @param this 		message_t object
 	 * @param crypter	crypter to use when a payload must be encrypted
 	 * @param signer	signer to build a mac
 	 * @param packet	copy of generated packet
@@ -273,103 +246,91 @@ struct message_t {
 	status_t (*generate) (message_t *this, crypter_t *crypter, signer_t *signer, packet_t **packet);
 	/**
-	 * @brief Gets the source host informations. 
+	 * Gets the source host informations. 
 	 * 
 	 * @warning Returned host_t object is not getting cloned, 
 	 * do not destroy nor modify.
 	 *
 	 * @param this 		message_t object
 	 * @return			host_t object representing source host
 	 */	
 	host_t * (*get_source) (message_t *this);
 	/**
-	 * @brief Sets the source host informations. 
+	 * Sets the source host informations. 
 	 * 
 	 * @warning host_t object is not getting cloned and gets destroyed by
 	 * 			message_t.destroy or next call of message_t.set_source.
 	 *
 	 * @param this 		message_t object
 	 * @param host		host_t object representing source host
 	 */	
 	void (*set_source) (message_t *this, host_t *host);
 	/**
-	 * @brief Gets the destination host informations. 
+	 * Gets the destination host informations. 
 	 * 
 	 * @warning Returned host_t object is not getting cloned, 
 	 * do not destroy nor modify.
 	 *
 	 * @param this 		message_t object
 	 * @return			host_t object representing destination host
 	 */	
 	host_t * (*get_destination) (message_t *this);
 	/**
-	 * @brief Sets the destination host informations. 
+	 * Sets the destination host informations. 
 	 * 
 	 * @warning host_t object is not getting cloned and gets destroyed by
 	 * 			message_t.destroy or next call of message_t.set_destination.
 	 *
 	 * @param this 		message_t object
 	 * @param host		host_t object representing destination host
 	 */	
 	void (*set_destination) (message_t *this, host_t *host);
 	/**
-	 * @brief Returns an iterator on all stored payloads.
+	 * Returns an iterator on all stored payloads.
 	 * 
 	 * @warning Don't insert payloads over this iterator. 
 	 * 			Use add_payload() instead.
 	 *
 	 * @param this 		message_t object
 	 * @return			iterator_t object which has to get destroyd by the caller
 	 */	
 	iterator_t * (*get_payload_iterator) (message_t *this);
 	/**
-	 * @brief Find a payload of a specific type.
+	 * Find a payload of a specific type.
 	 * 
 	 * Returns the first occurance. 
 	 *
 	 * @param this 		message_t object
 	 * @param type		type of the payload to find
 	 * @return			payload, or NULL if no such payload found
 	 */	
 	payload_t* (*get_payload) (message_t *this, payload_type_t type);
 	/**
-	 * @brief Returns a clone of the internal stored packet_t object.
+	 * Returns a clone of the internal stored packet_t object.
 	 *
 	 * @param this 		message_t object
 	 * @return			packet_t object as clone of internal one
 	 */	
 	packet_t * (*get_packet) (message_t *this);
 	/**
-	 * @brief Returns a clone of the internal stored packet_t data.
+	 * Returns a clone of the internal stored packet_t data.
 	 *
 	 * @param this 		message_t object
 	 * @return			clone of the internal stored packet_t data.
 	 */	
 	chunk_t (*get_packet_data) (message_t *this);
 	/**
-	 * @brief Destroys a message and all including objects.
+	 * Destroys a message and all including objects.
 	 *
 	 * @param this 		message_t object
 	 */
 	void (*destroy) (message_t *this);
 };
 /**
- * @brief Creates an message_t object from a incoming UDP Packet.
+ * Creates an message_t object from a incoming UDP Packet.
 * 
 * @warning the given packet_t object is not copied and gets 
 *			destroyed in message_t's destroy call.
 * 
 * @warning Packet is not parsed in here!
 * 
 * - exchange_type is set to NOT_SET
 * - original_initiator is set to TRUE
 * - is_request is set to TRUE
@@ -377,23 +338,19 @@ struct message_t {
 * 
 * @param packet		packet_t object which is assigned to message	
 * @return 				message_t object
 * 
 * @ingroup encoding
 */
 message_t * message_create_from_packet(packet_t *packet);
 /**
- * @brief Creates an empty message_t object.
+ * Creates an empty message_t object.
 *
 * - exchange_type is set to NOT_SET
 * - original_initiator is set to TRUE
 * - is_request is set to TRUE
 * 
 * @return message_t object
 *
 * @ingroup encoding
 */
 message_t * message_create(void);
-#endif /*MESSAGE_H_*/
+#endif /*MESSAGE_H_ @} */
@@ -1,10 +1,3 @@
 /**
 * @file parser.c
 *
 * @brief Implementation of parser_t.
 *
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include <stdlib.h>
@@ -67,7 +62,7 @@ struct private_parser_t {
 	parser_t public;
 	/**
-	 * @brief Parse a 4-Bit unsigned integer from the current parsing position.
+	 * Parse a 4-Bit unsigned integer from the current parsing position.
 	 * 
 	 * @param this				parser_t object
 	 * @param rule_number		number of current rule
@@ -79,7 +74,7 @@ struct private_parser_t {
 	status_t (*parse_uint4)  (private_parser_t *this, int rule_number, u_int8_t *output_pos);
 	/**
-	 * @brief Parse a 8-Bit unsigned integer from the current parsing position.
+	 * Parse a 8-Bit unsigned integer from the current parsing position.
 	 * 
 	 * @param this				parser_t object
 	 * @param rule_number		number of current rule
@@ -91,7 +86,7 @@ struct private_parser_t {
 	status_t (*parse_uint8)  (private_parser_t *this, int rule_number, u_int8_t *output_pos);
 	/**
-	 * @brief Parse a 15-Bit unsigned integer from the current parsing position.
+	 * Parse a 15-Bit unsigned integer from the current parsing position.
 	 * 
 	 * This is a special case used for ATTRIBUTE_TYPE.
 	 * Big-/Little-endian conversion is done here.
@@ -106,7 +101,7 @@ struct private_parser_t {
 	status_t (*parse_uint15) (private_parser_t *this, int rule_number, u_int16_t *output_pos);
 	/**
-	 * @brief Parse a 16-Bit unsigned integer from the current parsing position.
+	 * Parse a 16-Bit unsigned integer from the current parsing position.
 	 * 
 	 * Big-/Little-endian conversion is done here.
 	 * 
@@ -120,7 +115,7 @@ struct private_parser_t {
 	status_t (*parse_uint16) (private_parser_t *this, int rule_number, u_int16_t *output_pos);
 	/**
-	 * @brief Parse a 32-Bit unsigned integer from the current parsing position.
+	 * Parse a 32-Bit unsigned integer from the current parsing position.
 	 * 
 	 * Big-/Little-endian conversion is done here.
 	 * 
@@ -134,7 +129,7 @@ struct private_parser_t {
 	status_t (*parse_uint32) (private_parser_t *this, int rule_number, u_int32_t *output_pos);
 	/**
-	 * @brief Parse a 64-Bit unsigned integer from the current parsing position.
+	 * Parse a 64-Bit unsigned integer from the current parsing position.
 	 * 
 	 * @todo add support for big-endian machines.
 	 * 
@@ -148,7 +143,7 @@ struct private_parser_t {
 	status_t (*parse_uint64) (private_parser_t *this, int rule_number, u_int64_t *output_pos);
 	/**
-	 * @brief Parse a given amount of bytes and writes them to a specific location
+	 * Parse a given amount of bytes and writes them to a specific location
 	 * 
 	 * @param this				parser_t object
 	 * @param rule_number		number of current rule
@@ -161,7 +156,7 @@ struct private_parser_t {
 	status_t (*parse_bytes) (private_parser_t *this, int rule_number, u_int8_t *output_pos,size_t bytes);
 	/**
-	 * @brief Parse a single Bit from the current parsing position
+	 * Parse a single Bit from the current parsing position
 	 * 
 	 * @param this				parser_t object
 	 * @param rule_number		number of current rule
@@ -173,7 +168,7 @@ struct private_parser_t {
 	status_t (*parse_bit)    (private_parser_t *this, int rule_number, bool *output_pos);
 	/**
-	 * @brief Parse substructures in a list
+	 * Parse substructures in a list
 	 * 
 	 * This function calls the parser recursively to parse contained substructures
 	 * in a linked_list_t. The list must already be created. Payload defines
@@ -192,7 +187,7 @@ struct private_parser_t {
 	status_t (*parse_list)   (private_parser_t *this, int rule_number, linked_list_t **output_pos, payload_type_t payload_ype, size_t length);
 	/**
-	 * @brief Parse data from current parsing position in a chunk.
+	 * Parse data from current parsing position in a chunk.
 	 * 
 	 * This function clones length number of bytes to output_pos, without 
 	 * modifiyng them. Space will be allocated and must be freed by caller.
@@ -1,10 +1,3 @@
 /**
 * @file parser.h
 *
 * @brief Interface of parser_t.
 *
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup parser parser
 * @{ @ingroup encoding
 */
 #ifndef PARSER_H_
@@ -31,65 +31,51 @@ typedef struct parser_t parser_t;
 #include <encoding/payloads/payload.h>
 /**
- * @brief A parser_t class to parse IKEv2 payloads.
+ * A parser_t class to parse IKEv2 payloads.
 *
 * A parser is used for parsing one chunk of data. Multiple
 * payloads can be parsed out of the chunk using parse_payload.
 * The parser remains the state until destroyed.
 *
 * @b Constructors:
 * - parser_create()
 *
 * @ingroup encoding
 */
 struct parser_t {
 	/**
-	 * @brief Parses the next payload.
+	 * Parses the next payload.
 	 * 
 	 * @warning Caller is responsible for freeing allocated payload.
 	 * 
 	 * Rules for parsing are described in the payload definition.
 	 *
-	 * @param this				parser_t bject
+	 * @param payload_type	payload type to parse
-	 * @param payload_type		payload type to parse
+	 * @param payload		pointer where parsed payload was allocated
 	 * @param[out] payload		pointer where parsed payload was allocated
 	 * @return 			
-	 * 							- SUCCESSFUL if succeeded,
+	 * 						- SUCCESSFUL if succeeded,
-	 * 							- PARSE_ERROR if corrupted/invalid data found
+	 * 						- PARSE_ERROR if corrupted/invalid data found
 	 */
 	status_t (*parse_payload) (parser_t *this, payload_type_t payload_type, payload_t **payload);
 	/**
 	 * Gets the remaining byte count which is not currently parsed.
 	 * 
 	 * @param parser		parser_t object
 	 */
 	int (*get_remaining_byte_count) (parser_t *this);
 	/**
-	 * @brief Resets the current parser context.
+	 * Resets the current parser context.
 	 *
 	 * @param parser		parser_t object
 	 */
 	void (*reset_context) (parser_t *this);
 	/**
-	 * @brief Destroys a parser_t object.
+	 * Destroys a parser_t object.
 	 *
 	 * @param parser		parser_t object
 	 */
 	void (*destroy) (parser_t *this);
 };
 /**
- * @brief Constructor to create a parser_t object.
+ * Constructor to create a parser_t object.
 * 
- * @param data				chunk of data to parse with this parser_t object
+ * @param data		chunk of data to parse with this parser_t object
- * @return 					parser_t object
+ * @return 			parser_t object
 * 
 * @ingroup encoding
 */
 parser_t *parser_create(chunk_t data);
-#endif /*PARSER_H_*/
+#endif /*PARSER_H_ @} */
@@ -1,10 +1,3 @@
 /**
 * @file auth_payload.h
 * 
 * @brief Implementation of auth_payload_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include "auth_payload.h"
@@ -1,10 +1,3 @@
 /**
 * @file auth_payload.h
 * 
 * @brief Interface of auth_payload_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup auth_payload auth_payload
 * @{ @ingroup payloads
 */
 #ifndef AUTH_PAYLOAD_H_
@@ -32,20 +32,13 @@ typedef struct auth_payload_t auth_payload_t;
 /**
 * Length of a auth payload without the auth data in bytes.
 * 
 * @ingroup payloads
 */
 #define AUTH_PAYLOAD_HEADER_LENGTH 8
 /**
- * @brief Class representing an IKEv2 AUTH payload.
+ * Class representing an IKEv2 AUTH payload.
 *
 * The AUTH payload format is described in RFC section 3.8.
 *
 * @b Constructors:
 * - auth_payload_create()
 *
 * @ingroup payloads
 */
 struct auth_payload_t {
@@ -55,67 +48,57 @@ struct auth_payload_t {
 	payload_t payload_interface;
 	/**
-	 * @brief Set the AUTH method.
+	 * Set the AUTH method.
 	 *
 	 * @param this 			calling auth_payload_t object
 	 * @param method		auth_method_t to use
 	 */
 	void (*set_auth_method) (auth_payload_t *this, auth_method_t method);
 	/**
-	 * @brief Get the AUTH method.
+	 * Get the AUTH method.
 	 *
 	 * @param this 			calling auth_payload_t object
 	 * @return				auth_method_t used
 	 */
 	auth_method_t (*get_auth_method) (auth_payload_t *this);
 	/**
-	 * @brief Set the AUTH data.
+	 * Set the AUTH data.
 	 * 
-	 * Data are getting cloned.
+	 * Data gets cloned.
 	 *
 	 * @param this 			calling auth_payload_t object
 	 * @param data			AUTH data as chunk_t
 	 */
 	void (*set_data) (auth_payload_t *this, chunk_t data);
 	/**
-	 * @brief Get the AUTH data.
+	 * Get the AUTH data.
 	 * 
 	 * Returned data are a copy of the internal one.
 	 *
 	 * @param this 			calling auth_payload_t object
 	 * @return				AUTH data as chunk_t
 	 */
 	chunk_t (*get_data_clone) (auth_payload_t *this);
 	/**
-	 * @brief Get the AUTH data.
+	 * Get the AUTH data.
 	 * 
 	 * Returned data are NOT copied
 	 *
 	 * @param this 			calling auth_payload_t object
 	 * @return				AUTH data as chunk_t
 	 */
 	chunk_t (*get_data) (auth_payload_t *this);
 	/**
-	 * @brief Destroys an auth_payload_t object.
+	 * Destroys an auth_payload_t object.
 	 *
 	 * @param this 			auth_payload_t object to destroy
 	 */
 	void (*destroy) (auth_payload_t *this);
 };
 /**
- * @brief Creates an empty auth_payload_t object.
+ * Creates an empty auth_payload_t object.
 * 
 * @return auth_payload_t object
 * 
 * @ingroup payloads
 */
 auth_payload_t *auth_payload_create(void);
-
+#endif /* AUTH_PAYLOAD_H_ @} */
 #endif /* AUTH_PAYLOAD_H_ */
@@ -1,12 +1,5 @@
 /**
 * @file cert_payload.c
 * 
 * @brief Implementation of cert_payload_t.
 * 
 */
 /*
- * Copyright (C) 2005-2006 Martin Willi
+ * Copyright (C) 2005-2007 Martin Willi
 * Copyright (C) 2005 Jan Hutter
 * Hochschule fuer Technik Rapperswil
 *
@@ -19,29 +12,31 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include <stddef.h>
 #include <daemon.h>
 #include "cert_payload.h"
-
+ENUM(cert_encoding_names, ENC_PKCS7_WRAPPED_X509, ENC_OCSP_CONTENT,
-ENUM(cert_encoding_names, CERT_NONE, CERT_OCSP_CONTENT,
+	"ENC_PKCS7_WRAPPED_X509",
-	"CERT_NONE",
+	"ENC_PGP",
-	"CERT_PKCS7_WRAPPED_X509",
+	"ENC_DNS_SIGNED_KEY",
-	"CERT_PGP",
+	"ENC_X509_SIGNATURE",
-	"CERT_DNS_SIGNED_KEY",
+	"ENC_X509_KEY_EXCHANGE",
-	"CERT_X509_SIGNATURE",
+	"ENC_KERBEROS_TOKENS",
-	"CERT_X509_KEY_EXCHANGE",
+	"ENC_CRL",
-	"CERT_KERBEROS_TOKENS",
+	"ENC_ARL",
-	"CERT_CRL",
+	"ENC_SPKI",
-	"CERT_ARL",
+	"ENC_X509_ATTRIBUTE",
-	"CERT_SPKI",
+	"ENC_RAW_RSA_KEY",
-	"CERT_X509_ATTRIBUTE",
+	"ENC_X509_HASH_AND_URL",
-	"CERT_RAW_RSA_KEY",
+	"ENC_X509_HASH_AND_URL_BUNDLE",
-	"CERT_X509_HASH_AND_URL",
+	"ENC_OCSP_CONTENT",
 	"CERT_X509_HASH_AND_URL_BUNDLE",
 	"CERT_OCSP_CONTENT",
 );
 typedef struct private_cert_payload_t private_cert_payload_t;
@@ -74,12 +69,12 @@ struct private_cert_payload_t {
 	/**
 	 * Encoding of the CERT Data.
 	 */
-	u_int8_t cert_encoding;
+	u_int8_t encoding;
 	/**
 	 * The contained cert data value.
 	 */
-	chunk_t cert_data;
+	chunk_t data;
 };
 /**
@@ -105,9 +100,9 @@ encoding_rule_t cert_payload_encodings[] = {
 	/* Length of the whole payload*/
 	{ PAYLOAD_LENGTH,	offsetof(private_cert_payload_t, payload_length)},
 	/* 1 Byte CERT type*/
-	{ U_INT_8,			offsetof(private_cert_payload_t, cert_encoding)	},
+	{ U_INT_8,			offsetof(private_cert_payload_t, encoding)		},
 	/* some cert data bytes, length is defined in PAYLOAD_LENGTH */
-	{ CERT_DATA,			offsetof(private_cert_payload_t, cert_data) }
+	{ CERT_DATA,		offsetof(private_cert_payload_t, data) 			}
 };
 /*
@@ -128,19 +123,14 @@ encoding_rule_t cert_payload_encodings[] = {
 */
 static status_t verify(private_cert_payload_t *this)
 {
 	if ((this->cert_encoding == 0) ||
 		((this->cert_encoding >= CERT_ROOF) && (this->cert_encoding <= 200)))
 	{
 		/* reserved IDs */
 		return FAILED;
 	}
 	return SUCCESS;
 }
 /**
 * Implementation of cert_payload_t.get_encoding_rules.
 */
-static void get_encoding_rules(private_cert_payload_t *this, encoding_rule_t **rules, size_t *rule_count)
+static void get_encoding_rules(private_cert_payload_t *this,
 							   encoding_rule_t **rules, size_t *rule_count)
 {
 	*rules = cert_payload_encodings;
 	*rule_count = sizeof(cert_payload_encodings) / sizeof(encoding_rule_t);
@@ -159,7 +149,7 @@ static payload_type_t get_payload_type(private_cert_payload_t *this)
 */
 static payload_type_t get_next_type(private_cert_payload_t *this)
 {
-	return (this->next_payload);
+	return this->next_payload;
 }
 /**
@@ -179,56 +169,37 @@ static size_t get_length(private_cert_payload_t *this)
 }
 /**
- * Implementation of cert_payload_t.set_cert_encoding.
+ * Implementation of cert_payload_t.get_cert.
 */
-static void set_cert_encoding (private_cert_payload_t *this, cert_encoding_t encoding)
+static certificate_t* get_cert(private_cert_payload_t *this)
 {
-	this->cert_encoding = encoding;
+	certificate_type_t type;
-}
+	
-
+	switch (this->encoding)
 /**
 * Implementation of cert_payload_t.get_cert_encoding.
 */
 static cert_encoding_t get_cert_encoding (private_cert_payload_t *this)
 {
 	return (this->cert_encoding);
 }
 /**
 * Implementation of cert_payload_t.set_data.
 */
 static void set_data (private_cert_payload_t *this, chunk_t data)
 {
 	if (this->cert_data.ptr != NULL)
 	{
-		chunk_free(&(this->cert_data));
+		case ENC_X509_SIGNATURE:
 			type = CERT_X509;
 			break;
 		case ENC_PKCS7_WRAPPED_X509:
 		case ENC_PGP:
 		case ENC_DNS_SIGNED_KEY:
 		case ENC_KERBEROS_TOKEN:
 		case ENC_CRL:
 		case ENC_ARL:
 		case ENC_SPKI:
 		case ENC_X509_ATTRIBUTE:
 		case ENC_RAW_RSA_KEY:
 		case ENC_X509_HASH_AND_URL:
 		case ENC_X509_HASH_AND_URL_BUNDLE:
 		case ENC_OCSP_CONTENT:
 		default:
 			DBG1(DBG_ENC, "certificate encoding %N not supported",
 				 cert_encoding_names, this->encoding);
 			return NULL;
 	}
-	this->cert_data.ptr = clalloc(data.ptr,data.len);
+	return lib->creds->create(lib->creds, CRED_CERTIFICATE, type,
-	this->cert_data.len = data.len;
+							  BUILD_BLOB_ASN1_DER, chunk_clone(this->data),
-	this->payload_length = CERT_PAYLOAD_HEADER_LENGTH + this->cert_data.len;
+							  BUILD_END);
 }
 /**
 * Implementation of cert_payload_t.get_data.
 */
 static chunk_t get_data (private_cert_payload_t *this)
 {
 	return (this->cert_data);
 }
 /**
 * Implementation of cert_payload_t.get_data_clone.
 */
 static chunk_t get_data_clone (private_cert_payload_t *this)
 {
 	chunk_t cloned_data;
 	if (this->cert_data.ptr == NULL)
 	{
 		return (this->cert_data);
 	}
 	cloned_data.ptr = clalloc(this->cert_data.ptr,this->cert_data.len);
 	cloned_data.len = this->cert_data.len;
 	return cloned_data;
 }
 /**
@@ -236,11 +207,7 @@ static chunk_t get_data_clone (private_cert_payload_t *this)
 */
 static void destroy(private_cert_payload_t *this)
 {
-	if (this->cert_data.ptr != NULL)
+	chunk_free(&this->data);
 	{
 		chunk_free(&(this->cert_data));
 	}
 	free(this);	
 }
@@ -251,7 +218,6 @@ cert_payload_t *cert_payload_create()
 {
 	private_cert_payload_t *this = malloc_thing(private_cert_payload_t);
 	/* interface functions */
 	this->public.payload_interface.verify = (status_t (*) (payload_t*))verify;
 	this->public.payload_interface.get_encoding_rules = (void (*) (payload_t*,encoding_rule_t**, size_t*))get_encoding_rules;
 	this->public.payload_interface.get_length = (size_t (*) (payload_t*))get_length;
@@ -260,31 +226,38 @@ cert_payload_t *cert_payload_create()
 	this->public.payload_interface.get_type = (payload_type_t (*) (payload_t*))get_payload_type;
 	this->public.payload_interface.destroy = (void (*) (payload_t*))destroy;
 	/* public functions */
 	this->public.destroy = (void (*) (cert_payload_t*))destroy;
-	this->public.set_cert_encoding = (void (*) (cert_payload_t*,cert_encoding_t))set_cert_encoding;
+	this->public.get_cert = (certificate_t* (*) (cert_payload_t*))get_cert;
 	this->public.get_cert_encoding = (cert_encoding_t (*) (cert_payload_t*))get_cert_encoding;
 	this->public.set_data = (void (*) (cert_payload_t*,chunk_t))set_data;
 	this->public.get_data_clone = (chunk_t (*) (cert_payload_t*))get_data_clone;
 	this->public.get_data = (chunk_t (*) (cert_payload_t*))get_data;
 	/* private variables */
 	this->critical = FALSE;
 	this->next_payload = NO_PAYLOAD;
 	this->payload_length = CERT_PAYLOAD_HEADER_LENGTH;
-	this->cert_data = chunk_empty;
+	this->data = chunk_empty;
 	this->encoding = 0;
-	return (&(this->public));
+	return &this->public;
 }
 /*
 * Described in header
 */
-cert_payload_t *cert_payload_create_from_x509(x509_t *cert)
+cert_payload_t *cert_payload_create_from_cert(certificate_t *cert)
 {
-	cert_payload_t *this = cert_payload_create();
+	private_cert_payload_t *this = (private_cert_payload_t*)cert_payload_create();
-	this->set_cert_encoding(this, CERT_X509_SIGNATURE);
+	switch (cert->get_type(cert))
-	this->set_data(this, cert->get_certificate(cert));
+	{
-	return this;
+		case CERT_X509:
 			this->encoding = ENC_X509_SIGNATURE;
 			break;
 		default:
 			DBG1(DBG_ENC, "embedding %N certificate in payload failed",
 				 certificate_type_names, cert->get_type(cert));
 			free(this);
 			return NULL;
 	}
 	this->data = cert->get_encoding(cert);
 	this->payload_length = CERT_PAYLOAD_HEADER_LENGTH + this->data.len;
 	return &this->public;
 }
@@ -1,12 +1,5 @@
 /**
 * @file cert_payload.h
 * 
 * @brief Interface of cert_payload_t.
 * 
 */
 /*
- * Copyright (C) 2005-2006 Martin Willi
+ * Copyright (C) 2005-2007 Martin Willi
 * Copyright (C) 2005 Jan Hutter
 * Hochschule fuer Technik Rapperswil
 *
@@ -19,69 +12,58 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup cert_payload cert_payload
 * @{ @ingroup payloads
 */
 #ifndef CERT_PAYLOAD_H_
 #define CERT_PAYLOAD_H_
 typedef enum cert_encoding_t cert_encoding_t;
 typedef struct cert_payload_t cert_payload_t;
 typedef enum cert_encoding_t cert_encoding_t;
 #include <library.h>
-#include <crypto/x509.h>
+#include <credentials/certificates/certificate.h>
 #include <encoding/payloads/payload.h>
 /**
 * Length of a cert payload without the cert data in bytes.
 * 
 * @ingroup payloads
 */
 #define CERT_PAYLOAD_HEADER_LENGTH 5
 /**
- * @brief Certificate encoding, as described in IKEv2 RFC section 3.6
+ * Certifcate encodings, as in RFC4306
 *
 * @ingroup payloads
 */
 enum cert_encoding_t {
-	CERT_NONE =						 0,
+	ENC_PKCS7_WRAPPED_X509 =		 1,
-	CERT_PKCS7_WRAPPED_X509 =		 1,
+	ENC_PGP =						 2,
-	CERT_PGP =						 2,
+	ENC_DNS_SIGNED_KEY =			 3,
-	CERT_DNS_SIGNED_KEY =			 3,
+	ENC_X509_SIGNATURE =			 4,
-	CERT_X509_SIGNATURE =			 4,
+	ENC_KERBEROS_TOKEN	=			 6,
-	CERT_KERBEROS_TOKEN	=			 6,
+	ENC_CRL =						 7,
-	CERT_CRL =						 7,
+	ENC_ARL =						 8,
-	CERT_ARL =						 8,
+	ENC_SPKI =						 9,
-	CERT_SPKI =						 9,
+	ENC_X509_ATTRIBUTE =			10,
-	CERT_X509_ATTRIBUTE =			10,
+	ENC_RAW_RSA_KEY =				11,
-	CERT_RAW_RSA_KEY =				11,
+	ENC_X509_HASH_AND_URL =			12,
-	CERT_X509_HASH_AND_URL =		12,
+	ENC_X509_HASH_AND_URL_BUNDLE =	13,
-	CERT_X509_HASH_AND_URL_BUNDLE =	13,
+	ENC_OCSP_CONTENT =				14,  /* from RFC 4806 */
 	CERT_OCSP_CONTENT =				14,  /* from RFC 4806 */
 	CERT_ROOF =						15
 };
 /**
- * string mappings for cert_encoding_t.
+ * Enum names for cert_encoding_t
 * 
 * @ingroup payloads
 */
 extern enum_name_t *cert_encoding_names;
 /**
- * @brief Class representing an IKEv2 CERT payload.
+ * Class representing an IKEv2 CERT payload.
 *
 * The CERT payload format is described in RFC section 3.6.
 * This is just a dummy implementation to fullfill the standards
 * requirements. A full implementation would offer setters/getters
 * for the different encoding types.
 * 
 * @b Constructors:
 * - cert_payload_create()
 *
 * @todo Implement setters/getters for the different certificate encodings.
 *
 * @ingroup payloads
 */
 struct cert_payload_t {
@@ -89,78 +71,34 @@ struct cert_payload_t {
 	 * The payload_t interface.
 	 */
 	payload_t payload_interface;
 	/**
 	 * @brief Set the CERT encoding.
 	 *
 	 * @param this 			calling cert_payload_t object
 	 * @param encoding		CERT encoding
 	 */
 	void (*set_cert_encoding) (cert_payload_t *this, cert_encoding_t encoding);
 	/**
-	 * @brief Get the CERT encoding.
+	 * Get the playoads encoded certifcate.
 	 *
-	 * @param this 			calling cert_payload_t object
+	 * @return				certifcate copy
 	 * @return				Encoding of the CERT 
 	 */
-	cert_encoding_t (*get_cert_encoding) (cert_payload_t *this);
+	certificate_t *(*get_cert)(cert_payload_t *this);
 	/**
-	 * @brief Set the CERT data.
+	 * Destroys the cert_payload object.
 	 * 
 	 * Data are getting cloned.
 	 *
 	 * @param this 			calling cert_payload_t object
 	 * @param data			CERT data as chunk_t
 	 */
 	void (*set_data) (cert_payload_t *this, chunk_t data);
 	/**
 	 * @brief Get the CERT data.
 	 * 
 	 * Returned data are a copy of the internal one.
 	 *
 	 * @param this 			calling cert_payload_t object
 	 * @return				CERT data as chunk_t
 	 */
 	chunk_t (*get_data_clone) (cert_payload_t *this);
 	/**
 	 * @brief Get the CERT data.
 	 * 
 	 * Returned data are NOT copied.
 	 *
 	 * @param this 			calling cert_payload_t object
 	 * @return				CERT data as chunk_t
 	 */
 	chunk_t (*get_data) (cert_payload_t *this);
 	/**
 	 * @brief Destroys an cert_payload_t object.
 	 *
 	 * @param this 			cert_payload_t object to destroy
 	 */
 	void (*destroy) (cert_payload_t *this);
 };
 /**
- * @brief Creates an empty cert_payload_t object.
+ * Creates an empty certificate payload.
 * 
 * @param cert				certificate to embed
 * @return					cert_payload_t object
 * 
 * @ingroup payloads
 */
 cert_payload_t *cert_payload_create(void);
 /**
- * @brief Creates a cert_payload_t object with an X.509 certificate.
+ * Creates a certificate payload with an embedded certificate.
 * 
- * @param cert				X.509 certificate
+ * @param cert				certificate to embed
 * @return					cert_payload_t object
 * 
 * @ingroup payloads
 */
-cert_payload_t *cert_payload_create_from_x509(x509_t *cert);
+cert_payload_t *cert_payload_create_from_cert(certificate_t *cert);
-#endif /* CERT_PAYLOAD_H_ */
+#endif /* CERT_PAYLOAD_H_ @} */
@@ -1,10 +1,3 @@
 /**
 * @file certreq_payload.c
 * 
 * @brief Implementation of certreq_payload_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,14 +12,15 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include <stddef.h>
 #include <string.h>
 #include <daemon.h>
 #include <crypto/hashers/hasher.h>
-#include <crypto/ca.h>
+#include <encoding/payloads/cert_payload.h>
 #include "certreq_payload.h"
@@ -61,12 +55,12 @@ struct private_certreq_payload_t {
 	/**
 	 * Encoding of the CERT Data.
 	 */
-	u_int8_t cert_encoding;
+	u_int8_t encoding;
 	/**
 	 * The contained certreq data value.
 	 */
-	chunk_t certreq_data;
+	chunk_t data;
 };
 /**
@@ -90,11 +84,11 @@ encoding_rule_t certreq_payload_encodings[] = {
 	{ RESERVED_BIT,	0 														},
 	{ RESERVED_BIT,	0 														},
 	/* Length of the whole payload*/
-	{ PAYLOAD_LENGTH,	offsetof(private_certreq_payload_t, payload_length)},
+	{ PAYLOAD_LENGTH,	offsetof(private_certreq_payload_t, payload_length)	},
 	/* 1 Byte CERTREQ type*/
-	{ U_INT_8,			offsetof(private_certreq_payload_t, cert_encoding)},
+	{ U_INT_8,			offsetof(private_certreq_payload_t, encoding)		},
 	/* some certreq data bytes, length is defined in PAYLOAD_LENGTH */
-	{ CERTREQ_DATA,			offsetof(private_certreq_payload_t, certreq_data)}
+	{ CERTREQ_DATA,		offsetof(private_certreq_payload_t, data)			}
 };
 /*
@@ -115,11 +109,15 @@ encoding_rule_t certreq_payload_encodings[] = {
 */
 static status_t verify(private_certreq_payload_t *this)
 {
-	if ((this->cert_encoding == 0) ||
+	if (this->encoding == ENC_X509_SIGNATURE)
 		((this->cert_encoding >= CERT_ROOF) && (this->cert_encoding <= 200)))
 	{
-		/* reserved IDs */
+		if (this->data.len < HASH_SIZE_SHA1 ||
-		return FAILED;
+			this->data.len % HASH_SIZE_SHA1)
 		{
 			DBG1(DBG_ENC, "invalid X509 hash length (%d) in certreq",
 				 this->data.len);
 			return FAILED;
 		}
 	}
 	return SUCCESS;
 }
@@ -164,58 +162,78 @@ static size_t get_length(private_certreq_payload_t *this)
 {
 	return this->payload_length;
 }
-
+	
 /**
- * Implementation of certreq_payload_t.set_cert_encoding.
+ * Implementation of certreq_payload_t.add_keyid.
 */
-static void set_cert_encoding (private_certreq_payload_t *this, cert_encoding_t encoding)
+static void add_keyid(private_certreq_payload_t *this, chunk_t keyid)
 {
-	this->cert_encoding = encoding;
+	this->data = chunk_cat("mc", this->data, keyid);
 	this->payload_length += keyid.len;
 }
-/**
+typedef struct keyid_enumerator_t keyid_enumerator_t;
 * Implementation of certreq_payload_t.get_cert_encoding.
 */
 static cert_encoding_t get_cert_encoding (private_certreq_payload_t *this)
 {
 	return (this->cert_encoding);
 }
 /**
- * Implementation of certreq_payload_t.set_data.
+ * enumerator to enumerate keyids
 */
-static void set_data (private_certreq_payload_t *this, chunk_t data)
+struct keyid_enumerator_t  {
 	enumerator_t public;
 	chunk_t full;
 	u_char *pos;
 };
 /**
 * enumerate function for keyid_enumerator
 */
 static bool keyid_enumerate(keyid_enumerator_t *this, chunk_t *chunk)
 {
-	if (this->certreq_data.ptr != NULL)
+	if (this->pos == NULL)
 	{
-		chunk_free(&(this->certreq_data));
+		this->pos = this->full.ptr;
 	}
-	this->certreq_data.ptr = clalloc(data.ptr,data.len);
+	else
 	this->certreq_data.len = data.len;
 	this->payload_length = CERTREQ_PAYLOAD_HEADER_LENGTH + this->certreq_data.len;
 }
 /**
 * Implementation of certreq_payload_t.get_data.
 */
 static chunk_t get_data (private_certreq_payload_t *this)
 {
 	return (this->certreq_data);
 }
 /**
 * Implementation of certreq_payload_t.get_data_clone.
 */
 static chunk_t get_data_clone (private_certreq_payload_t *this)
 {
 	chunk_t cloned_data;
 	if (this->certreq_data.ptr == NULL)
 	{
-		return (this->certreq_data);
+		this->pos += HASH_SIZE_SHA1;
 		if (this->pos > (this->full.ptr + this->full.len - HASH_SIZE_SHA1))
 		{
 			this->pos = NULL;
 		}
 	}
 	if (this->pos)
 	{
 		chunk->ptr = this->pos;
 		chunk->len = HASH_SIZE_SHA1;
 		return TRUE;
 	}
 	return FALSE;
 }
 /**
 * Implementation of certreq_payload_t.create_keyid_enumerator.
 */
 static enumerator_t* create_keyid_enumerator(private_certreq_payload_t *this)
 {
 	keyid_enumerator_t *enumerator = malloc_thing(keyid_enumerator_t);
 	enumerator->public.enumerate = (void*)keyid_enumerate;
 	enumerator->public.destroy = (void*)free;
 	enumerator->full = this->data;
 	enumerator->pos = NULL;
 	return &enumerator->public;
 }
 /**
 * Implementation of certreq_payload_t.get_cert_type.
 */
 static certificate_type_t get_cert_type(private_certreq_payload_t *this)
 {
 	switch (this->encoding)
 	{
 		case ENC_X509_SIGNATURE:
 			return CERT_X509;
 		default:
 			return CERT_ANY;
 	}
 	cloned_data.ptr = clalloc(this->certreq_data.ptr,this->certreq_data.len);
 	cloned_data.len = this->certreq_data.len;
 	return cloned_data;
 }
 /**
@@ -223,11 +241,7 @@ static chunk_t get_data_clone (private_certreq_payload_t *this)
 */
 static void destroy(private_certreq_payload_t *this)
 {
-	if (this->certreq_data.ptr != NULL)
+	chunk_free(&this->data);
 	{
 		chunk_free(&(this->certreq_data));
 	}
 	free(this);	
 }
@@ -249,87 +263,38 @@ certreq_payload_t *certreq_payload_create()
 	/* public functions */
 	this->public.destroy = (void (*) (certreq_payload_t*)) destroy;
-	this->public.set_cert_encoding = (void (*) (certreq_payload_t*,cert_encoding_t))set_cert_encoding;
+	this->public.create_keyid_enumerator = (enumerator_t*(*)(certreq_payload_t*))create_keyid_enumerator;
-	this->public.get_cert_encoding = (cert_encoding_t (*) (certreq_payload_t*))get_cert_encoding;
+		this->public.get_cert_type = (certificate_type_t(*)(certreq_payload_t*))get_cert_type;
-	this->public.set_data = (void (*) (certreq_payload_t*,chunk_t))set_data;
+	this->public.add_keyid = (void(*)(certreq_payload_t*, chunk_t keyid))add_keyid;
 	this->public.get_data_clone = (chunk_t (*) (certreq_payload_t*))get_data_clone;
 	this->public.get_data = (chunk_t (*) (certreq_payload_t*))get_data;
 	/* private variables */
 	this->critical = FALSE;
 	this->next_payload = NO_PAYLOAD;
-	this->payload_length =CERTREQ_PAYLOAD_HEADER_LENGTH;
+	this->payload_length = CERTREQ_PAYLOAD_HEADER_LENGTH;
-	this->certreq_data = chunk_empty;
+	this->data = chunk_empty;
 	this->encoding = 0;
-	return (&(this->public));
+	return &this->public;
 }
 /*
 * Described in header
 */
-certreq_payload_t *certreq_payload_create_from_cacert(identification_t *id)
+certreq_payload_t *certreq_payload_create_type(certificate_type_t type)
 {
-	x509_t *cacert;
+	private_certreq_payload_t *this = (private_certreq_payload_t*)certreq_payload_create();
 	rsa_public_key_t *pubkey;
 	chunk_t keyid;
 	certreq_payload_t *this;
-	cacert = charon->credentials->get_auth_certificate(charon->credentials, AUTH_CA, id);
+	switch (type)
 	if (cacert == NULL)
 	{
-		/* no such CA cert */
+		case CERT_X509:
-		return NULL;
+			this->encoding = ENC_X509_SIGNATURE;
 			break;
 		default:
 			DBG1(DBG_ENC, "certificate type %N not supported in requests",
 				 certificate_type_names, type);
 			free(this);
 			return NULL;
 	}
-
+	return &this->public;
 	this = certreq_payload_create();
 	pubkey = cacert->get_public_key(cacert);
 	keyid = pubkey->get_keyid(pubkey);
 	DBG2(DBG_IKE, "requesting certificate issued by '%D'", id);
 	DBG2(DBG_IKE, "  with keyid %#B", &keyid);
 	this->set_cert_encoding(this, CERT_X509_SIGNATURE);
 	this->set_data(this, keyid);
 	return this;
 }
 /*
 * Described in header
 */
 certreq_payload_t *certreq_payload_create_from_cacerts(void)
 {
 	certreq_payload_t *this;
 	chunk_t keyids;
 	u_char *pos;
 	ca_info_t *cainfo;
 	iterator_t *iterator = charon->credentials->create_cainfo_iterator(charon->credentials);
 	int count = iterator->get_count(iterator);
 	if (count == 0)
 	{
 		iterator->destroy(iterator);
 		return NULL;
 	}
 	this = certreq_payload_create();
 	keyids = chunk_alloc(count * HASH_SIZE_SHA1);
 	pos = keyids.ptr;
 	while (iterator->iterate(iterator, (void**)&cainfo))
 	{
 		x509_t *cacert = cainfo->get_certificate(cainfo);
 		chunk_t keyid = cacert->get_keyid(cacert);
 		DBG2(DBG_IKE, "requesting certificate issued by '%D'", cacert->get_subject(cacert));
 		DBG2(DBG_IKE, "  with keyid %#B", &keyid);
 		memcpy(pos, keyid.ptr, keyid.len);
 		pos += HASH_SIZE_SHA1;
 	}
 	iterator->destroy(iterator);
 	this->set_cert_encoding(this, CERT_X509_SIGNATURE);
 	this->set_data(this, keyids);
 	free(keyids.ptr);
 	return this;
 }
@@ -1,10 +1,3 @@
 /**
 * @file certreq_payload.h
 * 
 * @brief Interface of certreq_payload_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup certreq_payload certreq_payload
 * @{ @ingroup payloads
 */
 #ifndef CERTREQ_PAYLOAD_H_
@@ -32,26 +32,13 @@ typedef struct certreq_payload_t certreq_payload_t;
 /**
 * Length of a CERTREQ payload without the CERTREQ data in bytes.
 * 
 * @ingroup payloads
 */
 #define CERTREQ_PAYLOAD_HEADER_LENGTH 5
 /**
- * @brief Class representing an IKEv2 CERTREQ payload.
+ * Class representing an IKEv2 CERTREQ payload.
 *
 * The CERTREQ payload format is described in RFC section 3.7.
 * This is just a dummy implementation to fullfill the standards
 * requirements. A full implementation would offer setters/getters
 * for the different encoding types.
 *
 * @b Constructors:
 * - certreq_payload_create()
 *
 * @todo Implement payload functionality.
 *
 * @ingroup payloads
 */
 struct certreq_payload_t {
 	/**
@@ -60,85 +47,46 @@ struct certreq_payload_t {
 	payload_t payload_interface;
 	/**
-	 * @brief Set the CERT encoding.
+	 * Create an enumerator over contained keyids.
 	 *
-	 * @param this 			calling certreq_payload_t object
+	 * @return			enumerator over chunk_t's.
 	 * @param encoding		CERT encoding
 	 */
-	void (*set_cert_encoding) (certreq_payload_t *this, cert_encoding_t encoding);
+	enumerator_t* (*create_keyid_enumerator)(certreq_payload_t *this);
 	/**
-	 * @brief Get the CERT encoding.
+	 * Get the type of contained certificate keyids.
 	 *
-	 * @param this 			calling certreq_payload_t object
+	 * @return			certificate keyid type
 	 * @return				Encoding of the CERT 
 	 */
-	cert_encoding_t (*get_cert_encoding) (certreq_payload_t *this);
+	certificate_type_t (*get_cert_type)(certreq_payload_t *this);
 	/**
-	 * @brief Set the CERTREQ data.
+	 * Add a certificates keyid to the payload.
 	 * 
 	 * Data are getting cloned.
 	 *
-	 * @param this 			calling certreq_payload_t object
+	 * @param keyid		keyid of the trusted certifcate
-	 * @param data			CERTREQ data as chunk_t
+	 * @return
 	 */
-	void (*set_data) (certreq_payload_t *this, chunk_t data);
+	void (*add_keyid)(certreq_payload_t *this, chunk_t keyid);
 	/**
-	 * @brief Get the CERTREQ data.
+	 * Destroys an certreq_payload_t object.
 	 * 
 	 * Returned data are a copy of the internal one.
 	 *
 	 * @param this 			calling certreq_payload_t object
 	 * @return				CERTREQ data as chunk_t
 	 */
 	chunk_t (*get_data_clone) (certreq_payload_t *this);
 	/**
 	 * @brief Get the CERTREQ data.
 	 * 
 	 * Returned data are NOT copied.
 	 *
 	 * @param this 			calling certreq_payload_t object
 	 * @return				CERTREQ data as chunk_t
 	 */
 	chunk_t (*get_data) (certreq_payload_t *this);
 	/**
 	 * @brief Destroys an certreq_payload_t object.
 	 *
 	 * @param this 	certreq_payload_t object to destroy
 	 */
 	void (*destroy) (certreq_payload_t *this);
 };
 /**
- * @brief Creates an empty certreq_payload_t object.
+ * Creates an empty certreq_payload_t object.
 * 
- * @return certreq_payload_t object
+ * @return 				certreq payload
 * 
 * @ingroup payloads
 */
 certreq_payload_t *certreq_payload_create(void);
 /**
- * @brief Creates a certreq_payload_t object from a ca certificate
+ * Creates an empty certreq_payload_t for a kind of certificates.
 * 
- * @param id				subject distinguished name of CA certificate
+ * @param type			type of the added keyids
- * @return					certreq_payload_t object
+ * @return 				certreq payload
 * 
 * @ingroup payloads
 */
-certreq_payload_t *certreq_payload_create_from_cacert(identification_t *id);
+certreq_payload_t *certreq_payload_create_type(certificate_type_t type);
-/**
+#endif /* CERTREQ_PAYLOAD_H_ @} */
 * @brief Creates a certreq_payload_t object from all ca certificates
 * 
 * @return					certreq_payload_t object
 * 
 * @ingroup payloads
 */
 certreq_payload_t *certreq_payload_create_from_cacerts(void);
 #endif /* CERTREQ_PAYLOAD_H_ */
@@ -1,10 +1,3 @@
 /**
 * @file configuration_attribute.c
 * 
 * @brief Implementation of configuration_attribute_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include <stddef.h>
@@ -1,10 +1,3 @@
 /**
 * @file configuration_attribute.h
 * 
 * @brief Interface of configuration_attribute_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup configuration_attribute configuration_attribute
 * @{ @ingroup payloads
 */
 #ifndef CONFIGURATION_ATTRIBUTE_H_
@@ -33,15 +33,11 @@ typedef struct configuration_attribute_t configuration_attribute_t;
 /**
 * Configuration attribute header length in bytes.
 * 
 * @ingroup payloads
 */
 #define CONFIGURATION_ATTRIBUTE_HEADER_LENGTH 4
 /**
 * Type of the attribute, as in IKEv2 RFC 3.15.1.
 * 
 * @ingroup payloads
 */
 enum configuration_attribute_type_t {
 	INTERNAL_IP4_ADDRESS = 1,
@@ -62,20 +58,13 @@ enum configuration_attribute_type_t {
 /** 
 * enum names for configuration_attribute_type_t.
 * 
 * @ingroup payloads
 */
 extern enum_name_t *configuration_attribute_type_names;
 /**
- * @brief Class representing an IKEv2-CONFIGURATION Attribute.
+ * Class representing an IKEv2-CONFIGURATION Attribute.
 * 
 * The CONFIGURATION ATTRIBUTE format is described in RFC section 3.15.1.
 * 
 * @b Constructors:
 * - configuration_attribute_create()
 * 
 * @ingroup payloads
 */
 struct configuration_attribute_t {
 	/**
@@ -84,64 +73,55 @@ struct configuration_attribute_t {
 	payload_t payload_interface;
 	/**
-	 * @brief Returns the currently set value of the attribute.
+	 * Returns the currently set value of the attribute.
 	 * 	
 	 * @warning Returned data are not copied.
 	 * 
 	 * @param this 	calling configuration_attribute_t object
 	 * @return 		chunk_t pointing to the value
 	 */
 	chunk_t (*get_value) (configuration_attribute_t *this);
 	/**
-	 * @brief Sets the value of the attribute.
+	 * Sets the value of the attribute.
 	 * 	
-	 * @warning Value is getting copied.
+	 * Value is getting copied.
 	 * 
 	 * @param this 	calling configuration_attribute_t object
 	 * @param value chunk_t pointing to the value to set
 	 */
 	void (*set_value) (configuration_attribute_t *this, chunk_t value);
 	/**
-	 * @brief Sets the type of the attribute.
+	 * Sets the type of the attribute.
 	 * 	
 	 * @param this 	calling configuration_attribute_t object
 	 * @param type	type to set (most significant bit is set to zero)
 	 */
 	void (*set_type) (configuration_attribute_t *this, u_int16_t type);
 	/**
-	 * @brief get the type of the attribute.
+	 * get the type of the attribute.
 	 * 	
 	 * @param this 	calling configuration_attribute_t object
 	 * @return 		type of the value
 	 */
 	u_int16_t (*get_type) (configuration_attribute_t *this);
 	/**
-	 * @brief get the length of an attribute.
+	 * get the length of an attribute.
 	 * 	
 	 * @param this 	calling configuration_attribute_t object
 	 * @return 		type of the value
 	 */
 	u_int16_t (*get_length) (configuration_attribute_t *this);
 	/**
-	 * @brief Destroys an configuration_attribute_t object.
+	 * Destroys an configuration_attribute_t object.
 	 *
 	 * @param this 	configuration_attribute_t object to destroy
 	 */
 	void (*destroy) (configuration_attribute_t *this);
 };
 /**
- * @brief Creates an empty configuration_attribute_t object.
+ * Creates an empty configuration_attribute_t object.
 * 
 * @return			created configuration_attribute_t object
 * 
 * @ingroup payloads
 */
 configuration_attribute_t *configuration_attribute_create(void);
-#endif /* CONFIGURATION_ATTRIBUTE_H_*/
+#endif /* CONFIGURATION_ATTRIBUTE_H_ @} */
@@ -1,10 +1,3 @@
 /**
 * @file cp_payload.c
 * 
 * @brief Implementation of cp_payload_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include <stddef.h>
@@ -1,10 +1,3 @@
 /**
 * @file cp_payload.h
 * 
 * @brief Interface of cp_payload_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup cp_payload cp_payload
 * @{ @ingroup payloads
 */
 #ifndef CP_PAYLOAD_H_
@@ -34,15 +34,11 @@ typedef struct cp_payload_t cp_payload_t;
 /**
 * CP_PAYLOAD length in bytes without any proposal substructure.
 * 
 * @ingroup payloads
 */
 #define CP_PAYLOAD_HEADER_LENGTH 8
 /**
 * Config Type of an Configuration Payload.
 *
 * @ingroup payloads
 */
 enum config_type_t {
 	CFG_REQUEST = 1,
@@ -53,20 +49,13 @@ enum config_type_t {
 /**
 * enum name for config_type_t.
 *
 * @ingroup payloads
 */
 extern enum_name_t *config_type_names;
 /**
- * @brief Class representing an IKEv2-CP Payload.
+ * Class representing an IKEv2-CP Payload.
 * 
 * The CP Payload format is described in RFC section 3.15.
 * 
 * @b Constructors:
 * - cp_payload_create()
 * 
 * @ingroup payloads
 */
 struct cp_payload_t {
 	/**
@@ -75,58 +64,50 @@ struct cp_payload_t {
 	payload_t payload_interface;
 	/**
-	 * @brief Creates an iterator of stored configuration_attribute_t objects.
+	 * Creates an iterator of stored configuration_attribute_t objects.
 	 * 
 	 * When deleting an attribute using this iterator, the length of this
 	 * configuration_attribute_t has to be refreshed by calling get_length()!
 	 *
 	 * @param this 			calling cp_payload_t object
 	 * @return				created iterator_t object
 	 */
 	iterator_t *(*create_attribute_iterator) (cp_payload_t *this);
 	/**
-	 * @brief Adds a configuration_attribute_t object to this object.
+	 * Adds a configuration_attribute_t object to this object.
 	 * 
 	 * The added configuration_attribute_t object is getting destroyed in
 	 * destroy function of cp_payload_t.
 	 *
 	 * @param this 			calling cp_payload_t object
 	 * @param attribute		configuration_attribute_t object to add
 	 */
 	void (*add_configuration_attribute) (cp_payload_t *this, configuration_attribute_t *attribute);
 	/**
-	 * @brief Set the config type.
+	 * Set the config type.
 	 *
 	 * @param this 			calling cp_payload_t object
 	 * @param config_type	config_type_t to set
 	 */
 	void (*set_config_type) (cp_payload_t *this,config_type_t config_type);
 	/**
-	 * @brief Get the config type.
+	 * Get the config type.
 	 *
 	 * @param this 			calling cp_payload_t object
 	 * @return				config_type_t
 	 */
 	config_type_t (*get_config_type) (cp_payload_t *this);
 	/**
-	 * @brief Destroys an cp_payload_t object.
+	 * Destroys an cp_payload_t object.
 	 *
 	 * @param this 			cp_payload_t object to destroy
 	 */
 	void (*destroy) (cp_payload_t *this);
 };
 /**
- * @brief Creates an empty cp_payload_t object
+ * Creates an empty cp_payload_t object
 * 
 * @return cp_payload_t object
 * 
 * @ingroup payloads
 */
 cp_payload_t *cp_payload_create(void);
-#endif /*CP_PAYLOAD_H_*/
+#endif /*CP_PAYLOAD_H_ @} */
@@ -1,10 +1,3 @@
 /**
 * @file delete_payload.c
 * 
 * @brief Implementation of delete_payload_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include <stddef.h>
@@ -1,10 +1,3 @@
 /**
 * @file delete_payload.h
 * 
 * @brief Interface of delete_payload_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup delete_payload delete_payload
 * @{ @ingroup payloads
 */
 #ifndef DELETE_PAYLOAD_H_
@@ -32,22 +32,13 @@ typedef struct delete_payload_t delete_payload_t;
 /**
 * Length of a delete payload without the SPI in bytes.
 *
 * @ingroup payloads
 */
 #define DELETE_PAYLOAD_HEADER_LENGTH 8
 /**
- * @brief Class representing an IKEv2 DELETE payload.
+ * Class representing an IKEv2 DELETE payload.
 *
 * The DELETE payload format is described in RFC section 3.11.
 *
 * @b Constructors:
 * - delete_payload_create()
 *
 * @todo Implement better setter/getters
 *
 * @ingroup payloads
 */
 struct delete_payload_t {
 	/**
@@ -56,47 +47,40 @@ struct delete_payload_t {
 	payload_t payload_interface;
 	/**
-	 * @brief Get the protocol ID.
+	 * Get the protocol ID.
 	 *
 	 * @param this 			calling delete_payload_t object
 	 * @return				protocol ID
 	 */
 	protocol_id_t (*get_protocol_id) (delete_payload_t *this);
 	/**
-	 * @brief Add an SPI to the list of deleted SAs.
+	 * Add an SPI to the list of deleted SAs.
 	 *
 	 * @param this 			calling delete_payload_t object
 	 * @param spi			spi to add
 	 */
 	void (*add_spi) (delete_payload_t *this, u_int32_t spi);
 	/**
-	 * @brief Get an iterator over the SPIs.
+	 * Get an iterator over the SPIs.
 	 *
 	 * The iterate() function returns a pointer to a u_int32_t SPI.
 	 *
 	 * @param this 			calling delete_payload_t object
 	 * @return				iterator over SPIs
 	 */
 	iterator_t *(*create_spi_iterator) (delete_payload_t *this);
 	/**
-	 * @brief Destroys an delete_payload_t object.
+	 * Destroys an delete_payload_t object.
 	 *
 	 * @param this 	delete_payload_t object to destroy
 	 */
 	void (*destroy) (delete_payload_t *this);
 };
 /**
- * @brief Creates an empty delete_payload_t object.
+ * Creates an empty delete_payload_t object.
 * 
 * @param protocol_id	protocol, such as AH|ESP
 * @return 				delete_payload_t object
 * 
 * @ingroup payloads
 */
 delete_payload_t *delete_payload_create(protocol_id_t protocol_id);
-#endif /* DELETE_PAYLOAD_H_ */
+#endif /* DELETE_PAYLOAD_H_ @} */
@@ -1,10 +1,3 @@
 /**
 * @file eap_payload.c
 * 
 * @brief Implementation of eap_payload_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include <stddef.h>
@@ -1,10 +1,3 @@
 /**
 * @file eap_payload.h
 * 
 * @brief Interface of eap_payload_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup eap_payload eap_payload
 * @{ @ingroup payloads
 */
 #ifndef EAP_PAYLOAD_H_
@@ -32,20 +32,13 @@ typedef struct eap_payload_t eap_payload_t;
 /**
 * Length of a EAP payload without the EAP Message in bytes.
 * 
 * @ingroup payloads
 */
 #define EAP_PAYLOAD_HEADER_LENGTH 4
 /**
- * @brief Class representing an IKEv2 EAP payload.
+ * Class representing an IKEv2 EAP payload.
 *
 * The EAP payload format is described in RFC section 3.16.
 * 
 * @b Constructors:
 * - eap_payload_create()
 *
 * @ingroup payloads
 */
 struct eap_payload_t {
@@ -55,79 +48,68 @@ struct eap_payload_t {
 	payload_t payload_interface;
 	/**
-	 * @brief Set the contained EAP data.
+	 * Set the contained EAP data.
 	 *
 	 * This contains the FULL EAP message starting with "code".
 	 * Chunk gets cloned.
 	 *
 	 * @param this 		calling eap_payload_t object
 	 * @param message	EAP data
 	 */
 	void (*set_data) (eap_payload_t *this, chunk_t data);
 	/**
-	 * @brief Get the contained EAP data.
+	 * Get the contained EAP data.
 	 *
 	 * This contains the FULL EAP message starting with "code".
 	 *
 	 * @param this 		calling eap_payload_t object
 	 * @return			EAP data (pointer to internal data)
 	 */
 	chunk_t (*get_data) (eap_payload_t *this);
 	/**
-	 * @brief Get the EAP code.
+	 * Get the EAP code.
 	 *
 	 * @param this 		calling eap_payload_t object
 	 * @return			EAP message as chunk_t
 	 */
 	eap_code_t (*get_code) (eap_payload_t *this);
 	/**
-	 * @brief Get the EAP identifier.
+	 * Get the EAP identifier.
 	 *
 	 * @param this 		calling eap_payload_t object
 	 * @return			unique identifier
 	 */
 	u_int8_t (*get_identifier) (eap_payload_t *this);
 	/**
-	 * @brief Get the EAP method type.
+	 * Get the EAP method type.
 	 *
 	 * @param this 		calling eap_payload_t object
 	 * @param vendor	pointer receiving vendor identifier
 	 * @return			EAP method type, vendor specific if vendor != 0
 	 */
 	eap_type_t (*get_type) (eap_payload_t *this, u_int32_t *vendor);
 	/**
-	 * @brief Destroys an eap_payload_t object.
+	 * Destroys an eap_payload_t object.
 	 *
 	 * @param this 		eap_payload_t object to destroy
 	 */
 	void (*destroy) (eap_payload_t *this);
 };
 /**
- * @brief Creates an empty eap_payload_t object.
+ * Creates an empty eap_payload_t object.
 *
 * @return eap_payload_t object
 *
 * @ingroup payloads
 */
 eap_payload_t *eap_payload_create(void);
 /**
- * @brief Creates an eap_payload_t object with data.
+ * Creates an eap_payload_t object with data.
 *
 * @return eap_payload_t object
 *
 * @ingroup payloads
 */
 eap_payload_t *eap_payload_create_data(chunk_t data);
 /**
- * @brief Creates an eap_payload_t object with a code.
+ * Creates an eap_payload_t object with a code.
 *
 * Could should be either EAP_SUCCESS/EAP_FAILURE, use 
 * constructor above otherwise.
@@ -135,19 +117,15 @@ eap_payload_t *eap_payload_create_data(chunk_t data);
 * @param code			EAP status code
 * @param identifier	EAP identifier to use in payload
 * @return 				eap_payload_t object
 *
 * @ingroup payloads
 */
 eap_payload_t *eap_payload_create_code(eap_code_t code, u_int8_t identifier);
 /**
- * @brief Creates an eap_payload_t EAP_RESPONSE containing an EAP_NAK.
+ * Creates an eap_payload_t EAP_RESPONSE containing an EAP_NAK.
 *
 * @param identifier	EAP identifier to use in payload
 * @return 				eap_payload_t object
 *
 * @ingroup payloads
 */
 eap_payload_t *eap_payload_create_nak(u_int8_t identifier);
-#endif /* EAP_PAYLOAD_H_ */
+#endif /* EAP_PAYLOAD_H_ @} */
@@ -1,10 +1,3 @@
 /**
 * @file encodings.c
 * 
 * @brief String mappings of encoding_type_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
@@ -1,10 +1,3 @@
 /**
 * @file encodings.h
 * 
 * @brief Definition of encoding_type_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup encodings encodings
 * @{ @ingroup payloads
 */
 #ifndef ENCODINGS_H_
@@ -30,7 +30,7 @@ typedef struct encoding_rule_t encoding_rule_t;
 #include <library.h>
 /**
- * @brief All different kinds of encoding types. 
+ * All different kinds of encoding types. 
 *
 * Each field of an IKEv2-Message (in header or payload) 
 * which has to be parsed or generated differently has its own
@@ -40,8 +40,6 @@ typedef struct encoding_rule_t encoding_rule_t;
 * from PRIVATE USE space. Also the substructures 
 * of specific payload types get their own payload_id 
 * from PRIVATE_USE space. See IKEv2-Draft for more informations.
 *
 * @ingroup payloads
 */
 enum encoding_type_t {
@@ -114,7 +112,7 @@ enum encoding_type_t {
 	U_INT_64,
 	/**
-	 * @brief represents a RESERVED_BIT used in FLAG-Bytes.
+	 * represents a RESERVED_BIT used in FLAG-Bytes.
 	 * 
 	 * When generating, the next bit is set to zero and the current write 
 	 * position is moved one bit forward.
@@ -128,7 +126,7 @@ enum encoding_type_t {
 	RESERVED_BIT,
 	/**
-	 * @brief represents a RESERVED_BYTE.
+	 * represents a RESERVED_BYTE.
 	 * 
 	 * When generating, the next byte is set to zero and the current write 
 	 * position is moved one byte forward.
@@ -499,21 +497,16 @@ enum encoding_type_t {
 /**
 * enum name for encoding_type_t
 * 
 * @ingroup payloads
 */
 extern enum_name_t *encoding_type_names;
 /**
 * Rule how to en-/decode a payload field.
 *
 * An encoding rule is a mapping of a specific encoding type to 
 * a location in the data struct where the current field is stored to
 * or read from.
 * 
 * For examples see files in this directory.
 * 
 * This rules are used by parser and generator.
 * 
 * @ingroup payloads
 */
 struct encoding_rule_t {
@@ -534,4 +527,4 @@ struct encoding_rule_t {
 	u_int32_t offset;
 };
-#endif /*ENCODINGS_H_*/
+#endif /*ENCODINGS_H_ @} */
@@ -1,10 +1,3 @@
 /**
 * @file encryption_payload.c
 * 
 * @brief Implementation of encryption_payload_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include <stddef.h>
@@ -1,9 +1,3 @@
 /**
 * @file encryption_payload.h
 * 
 * @brief Interface of encryption_payload_t.
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -18,6 +12,13 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup encryption_payload encryption_payload
 * @{ @ingroup payloads
 */
 #ifndef ENCRYPTION_PAYLOAD_H_
@@ -33,14 +34,12 @@ typedef struct encryption_payload_t encryption_payload_t;
 /**
 * Encrpytion payload length in bytes without IV and following data.
 * 
 * @ingroup payloads
 */
 #define ENCRYPTION_PAYLOAD_HEADER_LENGTH 4
 /**
- * @brief The encryption payload as described in RFC section 3.14.
+ * The encryption payload as described in RFC section 3.14.
 *
 * Before any crypt/decrypt/sign/verify operation can occur, 
 * the transforms must be set. After that, a parsed encryption payload
@@ -51,11 +50,6 @@ typedef struct encryption_payload_t encryption_payload_t;
 * must be builded after generation of all payloads and the encryption
 * of the encryption payload.
 * Signature verificatin is done before decryption.
 *
 * @b Constructors:
 * - encryption_payload_create()
 *
 * @ingroup payloads
 */
 struct encryption_payload_t {
 	/**
@@ -64,29 +58,26 @@ struct encryption_payload_t {
 	payload_t payload_interface;
 	/**
-	 * @brief Creates an iterator for all contained payloads.
+	 * Creates an iterator for all contained payloads.
 	 * 
-	 * @warning iterator_t object has to get destroyed by the caller.
+	 * iterator_t object has to get destroyed by the caller.
 	 *
-	 * @param this 			calling encryption_payload_t object
+	 * @param forward 		iterator direction (TRUE: front to end)
 	 * @param[in] forward 	iterator direction (TRUE: front to end)
 	 * return				created iterator_t object
 	 */
 	 iterator_t *(*create_payload_iterator) (encryption_payload_t *this, bool forward);
 	/**
-	 * @brief Adds a payload to this encryption payload.
+	 * Adds a payload to this encryption payload.
 	 *
 	 * @param this 			calling encryption_payload_t object
 	 * @param payload		payload_t object to add
 	 */
 	void (*add_payload) (encryption_payload_t *this, payload_t *payload);
 	/**
-	 * @brief Reove the last payload in the contained payload list.
+	 * Reove the last payload in the contained payload list.
 	 *
-	 * @param this 			calling encryption_payload_t object
+	 * @param payload		removed payload
 	 * @param[out] payload	removed payload
 	 * @return
 	 * 						- SUCCESS, or
 	 * 						- NOT_FOUND if list empty
@@ -94,15 +85,14 @@ struct encryption_payload_t {
 	status_t (*remove_first_payload) (encryption_payload_t *this, payload_t **payload);
 	/**
-	 * @brief Get the number of payloads.
+	 * Get the number of payloads.
 	 *
 	 * @param this 			calling encryption_payload_t object
 	 * @return				number of contained payloads
 	 */
 	size_t (*get_payload_count) (encryption_payload_t *this);
 	/**
-	 * @brief Set transforms to use.
+	 * Set transforms to use.
 	 * 
 	 * To decryption, encryption, signature building and verifying,
 	 * the payload needs a crypter and a signer object.
@@ -110,34 +100,29 @@ struct encryption_payload_t {
 	 * @warning Do NOT call this function again after encryption, since
 	 * the signer must be the same while encrypting and signature building!
 	 *
 	 * @param this			calling encryption_payload_t
 	 * @param crypter		crypter_t to use for data de-/encryption
 	 * @param signer		signer_t to use for data signing/verifying
 	 */
 	void (*set_transforms) (encryption_payload_t *this, crypter_t *crypter, signer_t *signer);
 	/**
-	 * @brief Generate and encrypt contained payloads.
+	 * Generate and encrypt contained payloads.
 	 * 
 	 * This function generates the content for added payloads
 	 * and encrypts them. Signature is not built, since we need
 	 * additional data (the full message).
 	 *
-	 * @param this			calling encryption_payload_t
+	 * @return				SUCCESS, or INVALID_STATE if transforms not set
 	 * @return
 	 * 						- SUCCESS, or
 	 * 						- INVALID_STATE if transforms not set
 	 */
 	status_t (*encrypt) (encryption_payload_t *this);
 	/**
-	 * @brief Decrypt and parse contained payloads.
+	 * Decrypt and parse contained payloads.
 	 * 
 	 * This function decrypts the contained data. After, 
 	 * the payloads are parsed internally and are accessible
 	 * via the iterator.
 	 *
 	 * @param this			calling encryption_payload_t
 	 * @return
 	 * 						- SUCCESS, or
 	 * 						- INVALID_STATE if transforms not set, or
@@ -146,13 +131,12 @@ struct encryption_payload_t {
 	status_t (*decrypt) (encryption_payload_t *this);
 	/**
-	 * @brief Build the signature.
+	 * Build the signature.
 	 * 
 	 * The signature is built over the FULL message, so the header
 	 * and every payload (inclusive this one) must already be generated.
 	 * The generated message is supplied via the data paramater.
 	 * 
 	 * @param this			calling encryption_payload_t
 	 * @param data			chunk contains the already generated message
 	 * @return
 	 * 						- SUCCESS, or
@@ -161,13 +145,12 @@ struct encryption_payload_t {
 	status_t (*build_signature) (encryption_payload_t *this, chunk_t data);
 	/**
-	 * @brief Verify the signature.
+	 * Verify the signature.
 	 * 
 	 * Since the signature is built over the full message, we need
 	 * this data to do the verification. The message data
 	 * is supplied via the data argument.
 	 * 
 	 * @param this			calling encryption_payload_t
 	 * @param data			chunk contains the message 
 	 * @return
 	 * 						- SUCCESS, or
@@ -177,21 +160,16 @@ struct encryption_payload_t {
 	status_t (*verify_signature) (encryption_payload_t *this, chunk_t data);
 	/**
-	 * @brief Destroys an encryption_payload_t object.
+	 * Destroys an encryption_payload_t object.
 	 *
 	 * @param this 			encryption_payload_t object to destroy
 	 */
 	void (*destroy) (encryption_payload_t *this);
 };
 /**
- * @brief Creates an empty encryption_payload_t object.
+ * Creates an empty encryption_payload_t object.
 * 
 * @return encryption_payload_t object
 * 
 * @ingroup payloads
 */
 encryption_payload_t *encryption_payload_create(void);
-
+#endif /*ENCRYPTION_PAYLOAD_H_ @} */
 #endif /*ENCRYPTION_PAYLOAD_H_*/
@@ -1,10 +1,3 @@
 /**
 * @file endpoint_notify.c
 * 
 * @brief Implementation of endpoint_notify_t.
 * 
 */
 /*
 * Copyright (C) 2007 Tobias Brunner
 * Hochschule fuer Technik Rapperswil
@@ -18,6 +11,8 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include "endpoint_notify.h"
@@ -1,10 +1,3 @@
 /**
 * @file endpoint_notify.h
 * 
 * @brief Interface of endpoint_notify_t.
 * 
 */
 /*
 * Copyright (C) 2007 Tobias Brunner
 * Hochschule fuer Technik Rapperswil
@@ -18,8 +11,14 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup endpoint_notify endpoint_notify
 * @{ @ingroup payloads
 */
 #ifndef ENDPOINT_NOTIFY_H_
 #define ENDPOINT_NOTIFY_H_
@@ -36,9 +35,7 @@ typedef struct endpoint_notify_t endpoint_notify_t;
 #include <encoding/payloads/notify_payload.h>
 /**
- * @brief P2P endpoint families.
+ * P2P endpoint families.
 *
 * @ingroup payloads
 */
 enum p2p_endpoint_family_t {
@@ -53,9 +50,7 @@ enum p2p_endpoint_family_t {
 };
 /**
- * @brief P2P endpoint types.
+ * P2P endpoint types.
 *
  * @ingroup payloads
 */
 enum p2p_endpoint_type_t {
@@ -75,128 +70,106 @@ enum p2p_endpoint_type_t {
 /**
 * enum name for p2p_endpoint_type_t.
 *
 * @ingroup payloads
 */
 extern enum_name_t *p2p_endpoint_type_names;
 /**
- * @brief Class representing a P2P_ENDPOINT notify. In fact it's not
+ * Class representing a P2P_ENDPOINT notify. In fact it's not
 * the notify per se, but the notification data of that notify that is
 * handled with this class.
 * 
 * @b Constructors:
 * - endpoint_notify_create()
 * - endpoint_notify_create_from_host()
 *
 * @ingroup payloads
 */
 struct endpoint_notify_t {
 	/**
-	 * @brief Returns the priority of this endpoint.
+	 * Returns the priority of this endpoint.
 	 * 
 	 * @param this		object
 	 * @return			priority
 	 */
 	u_int32_t (*get_priority) (endpoint_notify_t *this);
 	/**
-	 * @brief Sets the priority of this endpoint.
+	 * Sets the priority of this endpoint.
 	 * 
 	 * @param this		object
 	 * @param priority	priority
 	 */
 	void (*set_priority) (endpoint_notify_t *this, u_int32_t priority);
 	/**
-	 * @brief Returns the endpoint type of this endpoint.
+	 * Returns the endpoint type of this endpoint.
 	 * 
 	 * @param this		object
 	 * @return			endpoint type
 	 */
 	p2p_endpoint_type_t (*get_type) (endpoint_notify_t *this);
 	/**
-	 * @brief Returns the endpoint family of this endpoint.
+	 * Returns the endpoint family of this endpoint.
 	 * 
 	 * @param this		object
 	 * @return			endpoint family
 	 */
 	p2p_endpoint_family_t (*get_family) (endpoint_notify_t *this);
 	/**
-	 * @brief Returns the host of this endpoint.
+	 * Returns the host of this endpoint.
 	 * 
 	 * @param this		object
 	 * @return			host
 	 */
 	host_t *(*get_host) (endpoint_notify_t *this);
 	/**
-	 * @brief Returns the base of this endpoint.
+	 * Returns the base of this endpoint.
 	 * 
 	 * If this is not a SERVER_REFLEXIVE endpoint, the returned host is the same
 	 * as the one returned by get_host.
 	 * 
 	 * @param this		object
 	 * @return			host
 	 */
 	host_t *(*get_base) (endpoint_notify_t *this);
 	/**
-	 * @brief Generates a notification payload from this endpoint. 
+	 * Generates a notification payload from this endpoint. 
 	 * 	
 	 * @param this 		object
 	 * @return 			built notify_payload_t
 	 */
 	notify_payload_t *(*build_notify) (endpoint_notify_t *this);
 	/**
-	 * @brief Clones an endpoint_notify_t object.
+	 * Clones an endpoint_notify_t object.
 	 *
-	 * @param this 	endpoint_notify_t object to clone
+	 * @return			cloned object
 	 * @return		cloned object
 	 */
 	endpoint_notify_t *(*clone) (endpoint_notify_t *this);
 	/**
-	 * @brief Destroys an endpoint_notify_t object.
+	 * Destroys an endpoint_notify_t object.
 	 *
 	 * @param this 	endpoint_notify_t object to destroy
 	 */
 	void (*destroy) (endpoint_notify_t *this);
 };
 /**
- * @brief Creates an empty endpoint_notify_t object.
+ * Creates an empty endpoint_notify_t object.
 * 
 * @return			created endpoint_notify_t object
 * 
 * @ingroup payloads
 */
 endpoint_notify_t *endpoint_notify_create(void);
 /**
- * @brief Creates an endpoint_notify_t object from a host.
+ * Creates an endpoint_notify_t object from a host.
 * 
 * @param type		the endpoint type
 * @param host		host to base the notify on (gets cloned)
 * @param base		base of the endpoint, applies only to reflexive endpoints (gets cloned)
 * @return			created endpoint_notify_t object
 * 
 * @ingroup payloads
 */
-endpoint_notify_t *endpoint_notify_create_from_host(p2p_endpoint_type_t type, host_t *host, host_t *base);
+endpoint_notify_t *endpoint_notify_create_from_host(p2p_endpoint_type_t type,
 													host_t *host, host_t *base);
 /**
- * @brief Creates an endpoint_notify_t object from a notify payload.
+ * Creates an endpoint_notify_t object from a notify payload.
 * 
 * @param notify	the notify payload
 * @return			- created endpoint_notify_t object
 * 					- NULL if invalid payload
 * @ingroup payloads
 */
 endpoint_notify_t *endpoint_notify_create_from_payload(notify_payload_t *notify);
-#endif /*ENDPOINT_NOTIFY_H_*/
+#endif /*ENDPOINT_NOTIFY_H_ @} */
@@ -1,10 +1,3 @@
 /**
 * @file id_payload.h
 * 
 * @brief Interface of id_payload_t.
 * 
 */
 /*
 * Copyright (C) 2007 Tobias Brunner
 * Copyright (C) 2005-2006 Martin Willi
@@ -21,6 +14,8 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include <stddef.h>
@@ -1,10 +1,3 @@
 /**
 * @file id_payload.h
 * 
 * @brief Interface of id_payload_t.
 * 
 */
 /*
 * Copyright (C) 2007 Tobias Brunner
 * Copyright (C) 2005-2006 Martin Willi
@@ -20,8 +13,14 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup id_payload id_payload
 * @{ @ingroup payloads
 */
 #ifndef ID_PAYLOAD_H_
 #define ID_PAYLOAD_H_
@@ -34,8 +33,6 @@ typedef struct id_payload_t id_payload_t;
 /**
 * Length of a id payload without the data in bytes.
 * 
 * @ingroup payloads
 */
 #define ID_PAYLOAD_HEADER_LENGTH 8
@@ -43,12 +40,6 @@ typedef struct id_payload_t id_payload_t;
 * Object representing an IKEv2 ID payload.
 *
 * The ID payload format is described in RFC section 3.5.
 *
 * @b Constructors:
 * - id_payload_create_from_identification()
 * - id_payload_create()
 *
 * @ingroup payloads
 */
 struct id_payload_t {
 	/**
@@ -57,90 +48,77 @@ struct id_payload_t {
 	payload_t payload_interface;
 	/**
-	 * @brief Set the ID type.
+	 * Set the ID type.
 	 *
 	 * @param this 			calling id_payload_t object
 	 * @param type			Type of ID
 	 */
 	void (*set_id_type) (id_payload_t *this, id_type_t type);
 	/**
-	 * @brief Get the ID type.
+	 * Get the ID type.
 	 *
 	 * @param this 			calling id_payload_t object
 	 * @return				type of the ID 
 	 */
 	id_type_t (*get_id_type) (id_payload_t *this);
 	/**
-	 * @brief Set the ID data.
+	 * Set the ID data.
 	 * 
 	 * Data are getting cloned.
 	 *
 	 * @param this 			calling id_payload_t object
 	 * @param data			ID data as chunk_t
 	 */
 	void (*set_data) (id_payload_t *this, chunk_t data);
 	/**
-	 * @brief Get the ID data.
+	 * Get the ID data.
 	 * 
 	 * Returned data are a copy of the internal one
 	 *
 	 * @param this 			calling id_payload_t object
 	 * @return				ID data as chunk_t
 	 */
 	chunk_t (*get_data_clone) (id_payload_t *this);
 	/**
-	 * @brief Get the ID data.
+	 * Get the ID data.
 	 * 
 	 * Returned data are NOT copied.
 	 *
 	 * @param this 			calling id_payload_t object
 	 * @return				ID data as chunk_t
 	 */
 	chunk_t (*get_data) (id_payload_t *this);
 	/**
-	 * @brief Creates an identification object of this id payload.
+	 * Creates an identification object of this id payload.
 	 * 
 	 * Returned object has to get destroyed by the caller.
 	 *
 	 * @param this 			calling id_payload_t object
 	 * @return				identification_t object 
 	 */
 	identification_t *(*get_identification) (id_payload_t *this);
 	/**
-	 * @brief Destroys an id_payload_t object.
+	 * Destroys an id_payload_t object.
 	 *
 	 * @param this 	id_payload_t object to destroy
 	 */
 	void (*destroy) (id_payload_t *this);
 };
 /**
- * @brief Creates an empty id_payload_t object.
+ * Creates an empty id_payload_t object.
 * 
 * @param payload_type	one of ID_INITIATOR, ID_RESPONDER
 * @return				id_payload_t object
 * 
 * @ingroup payloads
 */
 id_payload_t *id_payload_create(payload_type_t payload_type);
 /**
- * @brief Creates an id_payload_t from an existing identification_t object.
+ * Creates an id_payload_t from an existing identification_t object.
 * 
 * @param payload_type		one of ID_INITIATOR, ID_RESPONDER
 * @param identification	identification_t object
 * @return					id_payload_t object
 * 
 * @ingroup payloads
 */
-id_payload_t *id_payload_create_from_identification(payload_type_t payload_type, identification_t *identification);
+id_payload_t *id_payload_create_from_identification(payload_type_t payload_type,
 											identification_t *identification);
-
+#endif /* ID_PAYLOAD_H_ @} */
 #endif /* ID_PAYLOAD_H_ */
@@ -1,10 +1,3 @@
 /**
 * @file ike_header.c
 * 
 * @brief Implementation of ike_header_t. 
 * 
 */
 /*
 * Copyright (C) 2007 Tobias Brunner
 * Copyright (C) 2005-2006 Martin Willi
@@ -20,6 +13,8 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /* offsetof macro */
@@ -1,10 +1,3 @@
 /**
 * @file ike_header.h
 * 
 * @brief Interface of ike_header_t. 
 * 
 */
 /*
 * Copyright (C) 2007 Tobias Brunner
 * Copyright (C) 2005-2006 Martin Willi
@@ -20,6 +13,13 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup ike_header ike_header
 * @{ @ingroup payloads
 */
 #ifndef IKE_HEADER_H_
@@ -33,38 +33,28 @@ typedef struct ike_header_t ike_header_t;
 /**
 * Major Version of IKEv2.
 * 
 * @ingroup payloads
 */
 #define IKE_MAJOR_VERSION 2
 /**
 * Minor Version of IKEv2.
 * 
 * @ingroup payloads
 */
 #define IKE_MINOR_VERSION 0
 /**
 * Flag in IKEv2-Header. Always 0.
 * 
 * @ingroup payloads
 */
 #define HIGHER_VERSION_SUPPORTED_FLAG 0
 /**
 * Length of IKE Header in Bytes.
 * 
 * @ingroup payloads
 */
 #define IKE_HEADER_LENGTH 28
 /**
- * @brief Different types of IKE-Exchanges.
+ * Different types of IKE-Exchanges.
 *
- * See Draft for different types.
+ * See RFC for different types.
 * 
 * @ingroup payloads
 */
 enum exchange_type_t{
@@ -102,23 +92,16 @@ enum exchange_type_t{
 /**
 * enum name for exchange_type_t
 * 
 * @ingroup payloads
 */
 extern enum_name_t *exchange_type_names;
 /**
- * @brief An object of this type represents an IKEv2 header and is used to 
+ * An object of this type represents an IKEv2 header and is used to 
 * generate and parse IKEv2 headers.
 * 
 * The header format of an IKEv2-Message is compatible to the 
 * ISAKMP-Header format to allow implementations supporting 
 * both versions of the IKE-protocol.
 * 
 * @b Constructors:
 * - ike_header_create()
 * 
 * @ingroup payloads
 */
 struct ike_header_t {
 	/**
@@ -127,141 +110,121 @@ struct ike_header_t {
 	payload_t payload_interface;
 	/**
-	 * @brief Get the initiator spi.
+	 * Get the initiator spi.
 	 *
 	 * @param this 			ike_header_t object
 	 * @return 				initiator_spi
 	 */
 	u_int64_t (*get_initiator_spi) (ike_header_t *this);
 	/**
-	 * @brief Set the initiator spi.
+	 * Set the initiator spi.
 	 *
 	 * @param this 			ike_header_t object
 	 * @param initiator_spi	initiator_spi
 	 */
 	void (*set_initiator_spi) (ike_header_t *this, u_int64_t initiator_spi);
 	/**
-	 * @brief Get the responder spi.
+	 * Get the responder spi.
 	 *
 	 * @param this 			ike_header_t object
 	 * @return 				responder_spi
 	 */
 	u_int64_t (*get_responder_spi) (ike_header_t *this);
 	/**
-	 * @brief Set the responder spi.
+	 * Set the responder spi.
 	 *
 	 * @param this 			ike_header_t object
 	 * @param responder_spi	responder_spi
 	 */
 	void (*set_responder_spi) (ike_header_t *this, u_int64_t responder_spi);
 	/**
-	 * @brief Get the major version.
+	 * Get the major version.
 	 *
 	 * @param this 			ike_header_t object
 	 * @return 				major version
 	 */
 	u_int8_t (*get_maj_version) (ike_header_t *this);
 	/**
-	 * @brief Get the minor version.
+	 * Get the minor version.
 	 *
 	 * @param this 			ike_header_t object
 	 * @return 				minor version
 	 */
 	u_int8_t (*get_min_version) (ike_header_t *this);
 	/**
-	 * @brief Get the response flag.
+	 * Get the response flag.
 	 *
 	 * @param this 			ike_header_t object
 	 * @return 				response flag
 	 */
 	bool (*get_response_flag) (ike_header_t *this);
 	/**
-	 * @brief Set the response flag-
+	 * Set the response flag-
 	 *
 	 * @param this 			ike_header_t object
 	 * @param response		response flag
 	 * 
 	 */
 	void (*set_response_flag) (ike_header_t *this, bool response);
 	/**
-	 * @brief Get "higher version supported"-flag.
+	 * Get "higher version supported"-flag.
 	 *
 	 * @param this 			ike_header_t object
 	 * @return 				version flag
 	 */
 	bool (*get_version_flag) (ike_header_t *this);
 	/**
-	 * @brief Get the initiator flag.
+	 * Get the initiator flag.
 	 *
 	 * @param this 			ike_header_t object
 	 * @return 				initiator flag
 	 */
 	bool (*get_initiator_flag) (ike_header_t *this);
 	/**
-	 * @brief Set the initiator flag.
+	 * Set the initiator flag.
 	 *
 	 * @param this 			ike_header_t object
 	 * @param initiator		initiator flag
 	 * 
 	 */
 	void (*set_initiator_flag) (ike_header_t *this, bool initiator);
 	/**
-	 * @brief Get the exchange type.
+	 * Get the exchange type.
 	 *
-	 * @param this 			ike_header_t object
+	 * @return 				exchange type
 	 * @return 				 exchange type
 	 */
 	u_int8_t (*get_exchange_type) (ike_header_t *this);
 	/**
-	 * @brief Set the  exchange type.
+	 * Set the  exchange type.
 	 *
 	 * @param this 			ike_header_t object
 	 * @param exchange_type	exchange type
 	 */
 	void (*set_exchange_type) (ike_header_t *this, u_int8_t exchange_type);
 	/**
-	 * @brief Get the message id.
+	 * Get the message id.
 	 *
 	 * @param this 			ike_header_t object
 	 * @return 				message id
 	 */
 	u_int32_t (*get_message_id) (ike_header_t *this);
 	/**
-	 * @brief Set the message id.
+	 * Set the message id.
 	 *
 	 * @param this 			ike_header_t object
 	 * @param initiator_spi	message id
 	 */
 	void (*set_message_id) (ike_header_t *this, u_int32_t message_id);
 	/**
-	 * @brief Destroys a ike_header_t object.
+	 * Destroys a ike_header_t object.
 	 *
 	 * @param this 			ike_header_t object to destroy
 	 */
 	void (*destroy) (ike_header_t *this);
 };
 /**
- * @brief Create an ike_header_t object
+ * Create an ike_header_t object
 * 
 * @return ike_header_t object
 * 
 * @ingroup payloads
 */
 ike_header_t *ike_header_create(void);
-#endif /*IKE_HEADER_H_*/
+#endif /*IKE_HEADER_H_ @} */
@@ -1,10 +1,3 @@
 /**
 * @file ke_payload.c
 * 
 * @brief Implementation of ke_payload_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include <stddef.h>
@@ -1,10 +1,3 @@
 /**
 * @file ke_payload.h
 * 
 * @brief Interface of ke_payload_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup ke_payload ke_payload
 * @{ @ingroup payloads
 */
 #ifndef KE_PAYLOAD_H_
@@ -34,20 +34,13 @@ typedef struct ke_payload_t ke_payload_t;
 /**
 * KE payload length in bytes without any key exchange data.
 * 
 * @ingroup payloads
 */
 #define KE_PAYLOAD_HEADER_LENGTH 8
 /**
- * @brief Class representing an IKEv2-KE Payload.
+ * Class representing an IKEv2-KE Payload.
 *
 * The KE Payload format is described in RFC section 3.4.
 *
 * @b Constructors:
 * - ke_payload_create()
 *
 * @ingroup payloads
 */
 struct ke_payload_t {
 	/**
@@ -56,66 +49,58 @@ struct ke_payload_t {
 	payload_t payload_interface;
 	/**
-	 * @brief Returns the currently set key exchange data of this KE payload.
+	 * Returns the currently set key exchange data of this KE payload.
 	 * 	
 	 * @warning Returned data are not copied.
 	 * 
 	 * @param this 	calling ke_payload_t object
 	 * @return 		chunk_t pointing to the value
 	 */
 	chunk_t (*get_key_exchange_data) (ke_payload_t *this);
 	/**
-	 * @brief Sets the key exchange data of this KE payload.
+	 * Sets the key exchange data of this KE payload.
 	 * 	
-	 * @warning Value is getting copied.
+	 * Value is getting copied.
 	 * 
-	 * @param this 				calling ke_payload_t object
+	 * @param key_exchange_data chunk_t pointing to the value to set
 	 * @param key_exchange_data 	chunk_t pointing to the value to set
 	 */
 	void (*set_key_exchange_data) (ke_payload_t *this, chunk_t key_exchange_data);
 	/**
-	 * @brief Gets the Diffie-Hellman Group Number of this KE payload.
+	 * Gets the Diffie-Hellman Group Number of this KE payload.
 	 * 	
-	 * @param this 		calling ke_payload_t object
+	 * @return 					DH Group Number of this payload
 	 * @return 			DH Group Number of this payload
 	 */
 	diffie_hellman_group_t (*get_dh_group_number) (ke_payload_t *this);
 	/**
-	 * @brief Sets the Diffie-Hellman Group Number of this KE payload.
+	 * Sets the Diffie-Hellman Group Number of this KE payload.
 	 * 	
 	 * @param this 				calling ke_payload_t object
 	 * @param dh_group_number	DH Group to set
 	 */
-	void (*set_dh_group_number) (ke_payload_t *this, diffie_hellman_group_t dh_group_number);
+	void (*set_dh_group_number) (ke_payload_t *this, 
 								 diffie_hellman_group_t dh_group_number);
 	/**
-	 * @brief Destroys an ke_payload_t object.
+	 * Destroys an ke_payload_t object.
 	 *
 	 * @param this 	ke_payload_t object to destroy
 	 */
 	void (*destroy) (ke_payload_t *this);
 };
 /**
- * @brief Creates an empty ke_payload_t object
+ * Creates an empty ke_payload_t object
 * 
 * @return ke_payload_t object
 * 
 * @ingroup payloads
 */
 ke_payload_t *ke_payload_create(void);
 /**
- * @brief Creates a ke_payload_t from a diffie_hellman_t
+ * Creates a ke_payload_t from a diffie_hellman_t
 * 
 * @param diffie_hellman	diffie hellman object containing group and key
 * @return 					ke_payload_t object
 * 
 * @ingroup payloads
 */
-ke_payload_t *ke_payload_create_from_diffie_hellman(diffie_hellman_t *diffie_hellman);
+ke_payload_t *ke_payload_create_from_diffie_hellman(
 											diffie_hellman_t *diffie_hellman);
-#endif /* KE_PAYLOAD_H_ */
+#endif /* KE_PAYLOAD_H_ @} */
@@ -1,10 +1,3 @@
 /**
 * @file nonce_payload.h
 * 
 * @brief Implementation of nonce_payload_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /* offsetof macro */
@@ -1,10 +1,3 @@
 /**
 * @file nonce_payload.h
 * 
 * @brief Interface of nonce_payload_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup nonce_payload nonce_payload
 * @{ @ingroup payloads
 */
 #ifndef NONCE_PAYLOAD_H_
@@ -31,17 +31,11 @@ typedef struct nonce_payload_t nonce_payload_t;
 /**
 * Nonce size in bytes for nonces sending to other peer.
 * 
 * @warning Nonce size MUST be between 16 and 256 bytes.
 * 
 * @ingroup payloads
 */
 #define NONCE_SIZE 16
 /**
 * Length of a nonce payload without a nonce in bytes.
 * 
 * @ingroup payloads
 */
 #define NONCE_PAYLOAD_HEADER_LENGTH 4
@@ -49,11 +43,6 @@ typedef struct nonce_payload_t nonce_payload_t;
 * Object representing an IKEv2 Nonce payload.
 * 
 * The Nonce payload format is described in RFC section 3.3.
 * 
 * @b Constructors:
 * - nonce_payload_create()
 * 
 * @ingroup payloads
 */
 struct nonce_payload_t {
 	/**
@@ -62,38 +51,30 @@ struct nonce_payload_t {
 	payload_t payload_interface;
 	/**
-	 * @brief Set the nonce value.
+	 * Set the nonce value.
 	 *
 	 * @param this 			calling nonce_payload_t object
 	 * @param nonce	  		chunk containing the nonce, will be cloned
 	 */
 	void (*set_nonce) (nonce_payload_t *this, chunk_t nonce);
 	/**
-	 * @brief Get the nonce value.
+	 * Get the nonce value.
 	 *
 	 * @param this 			calling nonce_payload_t object
 	 * @return				a chunk containing the cloned nonce
 	 */
 	chunk_t (*get_nonce) (nonce_payload_t *this);
 	/**
-	 * @brief Destroys an nonce_payload_t object.
+	 * Destroys an nonce_payload_t object.
 	 *
 	 * @param this 	nonce_payload_t object to destroy
 	 */
 	void (*destroy) (nonce_payload_t *this);
 };
 /**
- * @brief Creates an empty nonce_payload_t object
+ * Creates an empty nonce_payload_t object
 * 
 * @return nonce_payload_t object
 * 
 * @ingroup payloads
 */
 nonce_payload_t *nonce_payload_create(void);
-
+#endif /*NONCE_PAYLOAD_H_ @} */
 #endif /*NONCE_PAYLOAD_H_*/
@@ -1,10 +1,3 @@
 /**
 * @file notify_payload.c
 * 
 * @brief Implementation of notify_payload_t.
 * 
 */
 /*
 * Copyright (C) 2006-2007 Tobias Brunner
 * Copyright (C) 2006 Daniel Roethlisberger
@@ -21,6 +14,8 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include <stddef.h>
@@ -1,10 +1,3 @@
 /**
 * @file notify_payload.h
 * 
 * @brief Interface of notify_payload_t.
 * 
 */
 /*
 * Copyright (C) 2006-2007 Tobias Brunner
 * Copyright (C) 2006 Daniel Roethlisberger
@@ -21,8 +14,14 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup notify_payload notify_payload
 * @{ @ingroup payloads
 */
 #ifndef NOTIFY_PAYLOAD_H_
 #define NOTIFY_PAYLOAD_H_
@@ -37,17 +36,13 @@ typedef struct notify_payload_t notify_payload_t;
 /**
 * Notify payload length in bytes without any spi and notification data.
 * 
 * @ingroup payloads
 */
 #define NOTIFY_PAYLOAD_HEADER_LENGTH 8
 /**
- * @brief Notify message types.
+ * Notify message types.
 *
 * See IKEv2 RFC 3.10.1.
 *
 * @ingroup payloads
 */
 enum notify_type_t {
 	/* notify error messages */
@@ -109,30 +104,18 @@ enum notify_type_t {
 /**
 * enum name for notify_type_t.
 *
 * @ingroup payloads
 */
 extern enum_name_t *notify_type_names;
 /**
 * enum name for notify_type_t (shorter strings).
 *
 * @ingroup payloads
 */
 extern enum_name_t *notify_type_short_names;
 /**
- * @brief Class representing an IKEv2-Notify Payload.
+ * Class representing an IKEv2-Notify Payload.
 * 
 * The Notify Payload format is described in Draft section 3.10.
 * 
 * @b Constructors:
 * - notify_payload_create()
 * - notify_payload_create_from_protocol_and_type()
 * 
 * @todo Build specified constructor/getter for notify's
 *
 * @ingroup payloads
 */
 struct notify_payload_t {
 	/**
@@ -141,104 +124,91 @@ struct notify_payload_t {
 	payload_t payload_interface;
 	/**
-	 * @brief Gets the protocol id of this payload.
+	 * Gets the protocol id of this payload.
 	 * 	
 	 * @param this 		calling notify_payload_t object
 	 * @return 			protocol id of this payload
 	 */
 	u_int8_t (*get_protocol_id) (notify_payload_t *this);
 	/**
-	 * @brief Sets the protocol id of this payload.
+	 * Sets the protocol id of this payload.
 	 * 	
 	 * @param this 			calling notify_payload_t object
 	 * @param protocol_id	protocol id to set
 	 */
 	void (*set_protocol_id) (notify_payload_t *this, u_int8_t protocol_id);
 	/**
-	 * @brief Gets the notify message type of this payload.
+	 * Gets the notify message type of this payload.
 	 * 	
 	 * @param this 		calling notify_payload_t object
 	 * @return 			notify message type of this payload
 	 */
 	notify_type_t (*get_notify_type) (notify_payload_t *this);
 	/**
-	 * @brief Sets notify message type of this payload.
+	 * Sets notify message type of this payload.
 	 * 	
 	 * @param this 		calling notify_payload_t object
 	 * @param type		notify message type to set
 	 */
 	void (*set_notify_type) (notify_payload_t *this, notify_type_t type);
 	/**
-	 * @brief Returns the currently set spi of this payload.
+	 * Returns the currently set spi of this payload.
 	 * 
 	 * This is only valid for notifys with protocol AH|ESP
 	 *
 	 * @param this 	calling notify_payload_t object
 	 * @return 		SPI value
 	 */
 	u_int32_t (*get_spi) (notify_payload_t *this);
 	/**
-	 * @brief Sets the spi of this payload.
+	 * Sets the spi of this payload.
 	 * 
 	 * This is only valid for notifys with protocol AH|ESP
 	 * 
 	 * @param this 	calling notify_payload_t object
 	 * @param spi	SPI value
 	 */
 	void (*set_spi) (notify_payload_t *this, u_int32_t spi);
 	/**
-	 * @brief Returns the currently set notification data of payload.
+	 * Returns the currently set notification data of payload.
 	 * 	
-	 * @warning Returned data are not copied.
+	 * Returned data are not copied.
 	 * 
 	 * @param this 	calling notify_payload_t object
 	 * @return 		chunk_t pointing to the value
 	 */
 	chunk_t (*get_notification_data) (notify_payload_t *this);
 	/**
-	 * @brief Sets the notification data of this payload.
+	 * Sets the notification data of this payload.
 	 * 	
 	 * @warning Value is getting copied.
 	 * 
 	 * @param this 					calling notify_payload_t object
 	 * @param notification_data 	chunk_t pointing to the value to set
 	 */
-	void (*set_notification_data) (notify_payload_t *this, chunk_t notification_data);
+	void (*set_notification_data) (notify_payload_t *this,
 								   chunk_t notification_data);
 	/**
-	 * @brief Destroys an notify_payload_t object.
+	 * Destroys an notify_payload_t object.
 	 *
 	 * @param this 	notify_payload_t object to destroy
 	 */
 	void (*destroy) (notify_payload_t *this);
 };
 /**
- * @brief Creates an empty notify_payload_t object
+ * Creates an empty notify_payload_t object
 * 
 * @return			created notify_payload_t object
 * 
 * @ingroup payloads
 */
 notify_payload_t *notify_payload_create(void);
 /**
- * @brief Creates an notify_payload_t object of specific type for specific protocol id.
+ * Creates an notify_payload_t object of specific type for specific protocol id.
 * 
 * @param protocol_id			protocol id (IKE, AH or ESP)
 * @param type					notify type (see notify_type_t)
 * @return						notify_payload_t object
 * 
 * @ingroup payloads
 */
-notify_payload_t *notify_payload_create_from_protocol_and_type(protocol_id_t protocol_id, notify_type_t type);
+notify_payload_t *notify_payload_create_from_protocol_and_type(
 								protocol_id_t protocol_id, notify_type_t type);
-
+#endif /*NOTIFY_PAYLOAD_H_ @} */
 #endif /*NOTIFY_PAYLOAD_H_*/
@@ -1,11 +1,3 @@
 /**
 * @file payload.c
 * 
 * @brief Generic constructor to the payload_t interface.
 * 
 * 
 */
 /*
 * Copyright (C) 2007 Tobias Brunner
 * Copyright (C) 2005-2006 Martin Willi
@@ -21,6 +13,8 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
@@ -1,10 +1,3 @@
 /**
 * @file payload.h
 * 
 * @brief Interface payload_t.
 * 
 */
 /*
 * Copyright (C) 2007 Tobias Brunner
 * Copyright (C) 2005-2006 Martin Willi
@@ -20,6 +13,13 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup payload payload
 * @{ @ingroup payloads
 */
 #ifndef PAYLOAD_H_
@@ -33,12 +33,10 @@ typedef struct payload_t payload_t;
 /**
- * @brief Payload-Types of a IKEv2-Message.
+ * Payload-Types of a IKEv2-Message.
 *
 * Header and substructures are also defined as 
 * payload types with values from PRIVATE USE space.
 *
 * @ingroup payloads
 */
 enum payload_type_t{
@@ -204,80 +202,65 @@ extern enum_name_t *payload_type_names;
 extern enum_name_t *payload_type_short_names;
 /**
- * @brief Generic interface for all payload types (incl.header and substructures).
+ * Generic interface for all payload types (incl.header and substructures).
 * 
 * To handle all kinds of payloads on a generic way, this interface must
 * be implemented by every payload. This allows parser_t/generator_t a simple
 * handling of all payloads.
 * 
 * @b Constructors:
 * - payload_create() with the payload to instantiate.
 * 
 * @ingroup payloads
 */
 struct payload_t {
 	/**
-	 * @brief Get encoding rules for this payload.
+	 * Get encoding rules for this payload.
 	 *
-	 * @param this 				calling object
+	 * @param rules			location to store pointer of first rule
-	 * @param[out] rules		location to store pointer of first rule
+	 * @param rule_count	location to store number of rules
 	 * @param[out] rule_count	location to store number of rules
 	 */
 	void (*get_encoding_rules) (payload_t *this, encoding_rule_t **rules, size_t *rule_count);
 	/**
-	 * @brief Get type of payload.
+	 * Get type of payload.
 	 *
-	 * @param this 				calling object
+	 * @return 				type of this payload
 	 * @return 					type of this payload
 	 */
 	payload_type_t (*get_type) (payload_t *this);
 	/**
-	 * @brief Get type of next payload or NO_PAYLOAD (0) if this is the last one.
+	 * Get type of next payload or NO_PAYLOAD (0) if this is the last one.
 	 *
-	 * @param this 				calling object
+	 * @return 				type of next payload
 	 * @return 					type of next payload
 	 */
 	payload_type_t (*get_next_type) (payload_t *this);
 	/**
-	 * @brief Set type of next payload.
+	 * Set type of next payload.
 	 *
-	 * @param this 				calling object
+	 * @param type 			type of next payload
 	 * @param type 				type of next payload
 	 */
 	void (*set_next_type) (payload_t *this,payload_type_t type);
 	/**
-	 * @brief Get length of payload.
+	 * Get length of payload.
 	 *
-	 * @param this 				calling object
+	 * @return 				length of this payload
 	 * @return 					length of this payload
 	 */
 	size_t (*get_length) (payload_t *this);
 	/**
-	 * @brief Verifies payload structure and makes consistence check.
+	 * Verifies payload structure and makes consistence check.
 	 *
-	 * @param this 				calling object
+	 * @return 				SUCCESS,  FAILED if consistence not given
 	 * @return 					
 	 *							- SUCCESS
 	 * 							- FAILED if consistence not given
 	 */
 	status_t (*verify) (payload_t *this);
 	/**
-	 * @brief Destroys a payload and all included substructures.
+	 * Destroys a payload and all included substructures.
 	 *
 	 * @param this 				payload to destroy
 	 */
 	void (*destroy) (payload_t *this);
 };
 /**
- * @brief Create an empty payload.
+ * Create an empty payload.
 * 
 * Useful for the parser, who wants a generic constructor for all payloads.
 * It supports all payload_t methods. If a payload type is not known, 
@@ -288,4 +271,4 @@ struct payload_t {
 */
 payload_t *payload_create(payload_type_t type);
-#endif /*PAYLOAD_H_*/
+#endif /*PAYLOAD_H_ @} */
@@ -1,10 +1,3 @@
 /**
 * @file proposal_substructure.h
 * 
 * @brief Implementation of proposal_substructure_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include <stddef.h>
@@ -1,10 +1,3 @@
 /**
 * @file proposal_substructure.h
 * 
 * @brief Interface of proposal_substructure_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup proposal_substructure proposal_substructure
 * @{ @ingroup payloads
 */
 #ifndef PROPOSAL_SUBSTRUCTURE_H_
@@ -35,20 +35,13 @@ typedef struct proposal_substructure_t proposal_substructure_t;
 /**
 * Length of the proposal substructure header (without spi).
 * 
 * @ingroup payloads
 */
 #define PROPOSAL_SUBSTRUCTURE_HEADER_LENGTH 8
 /**
- * @brief Class representing an IKEv2-PROPOSAL SUBSTRUCTURE.
+ * Class representing an IKEv2-PROPOSAL SUBSTRUCTURE.
 * 
 * The PROPOSAL SUBSTRUCTURE format is described in RFC section 3.3.1.
 * 
 * @b Constructors:
 * - proposal_substructure_create()
 * 
 * @ingroup payloads
 */
 struct proposal_substructure_t {
 	/**
@@ -57,150 +50,126 @@ struct proposal_substructure_t {
 	payload_t payload_interface;
 	/**
-	 * @brief Creates an iterator of stored transform_substructure_t objects.
+	 * Creates an iterator of stored transform_substructure_t objects.
 	 * 
 	 * @warning The created iterator has to get destroyed by the caller!
 	 * 			When deleting any transform over this iterator, call 
 	 * 			get_size to make sure the length and number values are ok.
 	 *
 	 * @param this			calling proposal_substructure_t object
 	 * @param forward		iterator direction (TRUE: front to end)
 	 * @return				created iterator_t object
 	 */
-	iterator_t *(*create_transform_substructure_iterator) (proposal_substructure_t *this, bool forward);
+	iterator_t *(*create_transform_substructure_iterator) (
 								proposal_substructure_t *this, bool forward);
 	/**
-	 * @brief Adds a transform_substructure_t object to this object.
+	 * Adds a transform_substructure_t object to this object.
 	 * 
 	 * @warning The added transform_substructure_t object is
 	 * 			getting destroyed in destroy function of proposal_substructure_t.
 	 *
-	 * @param this 		calling proposal_substructure_t object
+	 * @param transform 	transform_substructure_t object to add
 	 * @param transform transform_substructure_t object to add
 	 */
-	void (*add_transform_substructure) (proposal_substructure_t *this,transform_substructure_t *transform);
+	void (*add_transform_substructure) (proposal_substructure_t *this,
 										transform_substructure_t *transform);
 	/**
-	 * @brief Sets the proposal number of current proposal.
+	 * Sets the proposal number of current proposal.
 	 *
-	 * @param this 		calling proposal_substructure_t object
+	 * @param id			proposal number to set
 	 * @param id		proposal number to set
 	 */
-	void (*set_proposal_number) (proposal_substructure_t *this,u_int8_t proposal_number);
+	void (*set_proposal_number) (proposal_substructure_t *this,
 								 u_int8_t proposal_number);
 	/**
-	 * @brief get proposal number of current proposal.
+	 * get proposal number of current proposal.
 	 * 
 	 * @param this 		calling proposal_substructure_t object
 	 * @return 			proposal number of current proposal substructure.
 	 */
 	u_int8_t (*get_proposal_number) (proposal_substructure_t *this);
 	/**
-	 * @brief get the number of transforms in current proposal.
+	 * get the number of transforms in current proposal.
 	 * 
 	 * @param this 		calling proposal_substructure_t object
 	 * @return 			transform count in current proposal
 	 */
 	size_t (*get_transform_count) (proposal_substructure_t *this);
 	/**
-	 * @brief get size of the set spi in bytes.
+	 * get size of the set spi in bytes.
 	 * 
 	 * @param this 		calling proposal_substructure_t object
 	 * @return 			size of the spi in bytes
 	 */
 	size_t (*get_spi_size) (proposal_substructure_t *this);
 	/**
-	 * @brief Sets the protocol id of current proposal.
+	 * Sets the protocol id of current proposal.
 	 *
-	 * @param this 		calling proposal_substructure_t object
+	 * @param id		protocol id to set
 	 * @param id			protocol id to set
 	 */
-	void (*set_protocol_id) (proposal_substructure_t *this,u_int8_t protocol_id);
+	void (*set_protocol_id) (proposal_substructure_t *this,
 							 u_int8_t protocol_id);
 	/**
-	 * @brief get protocol id of current proposal.
+	 * get protocol id of current proposal.
 	 * 
 	 * @param this 		calling proposal_substructure_t object
 	 * @return 			protocol id of current proposal substructure.
 	 */
 	u_int8_t (*get_protocol_id) (proposal_substructure_t *this);
 	/**
-	 * @brief Sets the next_payload field of this substructure
+	 * Sets the next_payload field of this substructure
 	 * 
 	 * If this is the last proposal, next payload field is set to 0,
 	 * otherwise to 2
 	 *
 	 * @param this 		calling proposal_substructure_t object
 	 * @param is_last	When TRUE, next payload field is set to 0, otherwise to 2
 	 */
 	void (*set_is_last_proposal) (proposal_substructure_t *this, bool is_last);
 	/**
-	 * @brief Returns the currently set SPI of this proposal.
+	 * Returns the currently set SPI of this proposal.
-	 * 	
+	 *
-	 * @warning Returned data are not copied
+	 * @return 			chunk_t pointing to the value
 	 * 
 	 * @param this 	calling proposal_substructure_t object
 	 * @return 		chunk_t pointing to the value
 	 */
 	chunk_t (*get_spi) (proposal_substructure_t *this);
 	/**
-	 * @brief Sets the SPI of the current proposal.
+	 * Sets the SPI of the current proposal.
 	 * 	
 	 * @warning SPI is getting copied
 	 * 
-	 * @param this 	calling proposal_substructure_t object
+	 * @param spi		chunk_t pointing to the value to set
 	 * @param spi	chunk_t pointing to the value to set
 	 */
 	void (*set_spi) (proposal_substructure_t *this, chunk_t spi);
 	/**
-	 * @brief Get a proposal_t from the propsal_substructure_t.
+	 * Get a proposal_t from the propsal_substructure_t.
 	 * 
 	 * @param this 		calling proposal_substructure_t object
 	 * @return			proposal_t
 	 */
 	proposal_t * (*get_proposal) (proposal_substructure_t *this);
 	/**
-	 * @brief Clones an proposal_substructure_t object.
+	 * Clones an proposal_substructure_t object.
 	 *
 	 * @param this 	proposal_substructure_t object to clone
 	 * @return		cloned object
 	 */
 	proposal_substructure_t* (*clone) (proposal_substructure_t *this);
 	/**
-	 * @brief Destroys an proposal_substructure_t object.
+	 * Destroys an proposal_substructure_t object.
 	 *
 	 * @param this 	proposal_substructure_t object to destroy
 	 */
 	void (*destroy) (proposal_substructure_t *this);
 };
 /**
- * @brief Creates an empty proposal_substructure_t object
+ * Creates an empty proposal_substructure_t object
 * 
 * @return proposal_substructure_t object
 * 
 * @ingroup payloads
 */
 proposal_substructure_t *proposal_substructure_create(void);
 /**
- * @brief Creates a proposal_substructure_t from a proposal_t.
+ * Creates a proposal_substructure_t from a proposal_t.
 *
 * @param proposal		proposal to build a substruct out of it
 * @return 				proposal_substructure_t object
 * 
 * @ingroup payloads
 */
-proposal_substructure_t *proposal_substructure_create_from_proposal(proposal_t *proposal);
+proposal_substructure_t *proposal_substructure_create_from_proposal(
 														proposal_t *proposal);
-
+#endif /*PROPOSAL_SUBSTRUCTURE_H_ @} */
 #endif /*PROPOSAL_SUBSTRUCTURE_H_*/
@@ -1,10 +1,3 @@
 /**
 * @file sa_payload.c
 * 
 * @brief Implementation of sa_payload_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include <stddef.h>
@@ -1,10 +1,3 @@
 /**
 * @file sa_payload.h
 * 
 * @brief Interface of sa_payload_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup sa_payload sa_payload
 * @{ @ingroup payloads
 */
 #ifndef SA_PAYLOAD_H_
@@ -33,24 +33,13 @@ typedef struct sa_payload_t sa_payload_t;
 /**
 * SA_PAYLOAD length in bytes without any proposal substructure.
 * 
 * @ingroup payloads
 */
 #define SA_PAYLOAD_HEADER_LENGTH 4
 /**
- * @brief Class representing an IKEv2-SA Payload.
+ * Class representing an IKEv2-SA Payload.
 *
 * The SA Payload format is described in RFC section 3.3.
 *
 * @b Constructors:
 * - sa_payload_create()
 * - sa_payload_create_from_ike_proposals()
 * - sa_payload_create_from_proposal()
 *
 * @todo Add support of algorithms without specified keylength in get_proposals and get_ike_proposals.
 *
 * @ingroup payloads
 */
 struct sa_payload_t {
 	/**
@@ -59,83 +48,70 @@ struct sa_payload_t {
 	payload_t payload_interface;
 	/**
-	 * @brief Creates an iterator of stored proposal_substructure_t objects.
+	 * Creates an iterator of stored proposal_substructure_t objects.
 	 * 
-	 * @warning The created iterator has to get destroyed by the caller!
+	 * When deleting an proposal using this iterator, 
-	 * 
+	 * the length of this transform substructure has to be refreshed 
-	 * @warning When deleting an proposal using this iterator, 
+	 * by calling get_length()!
 	 * 			the length of this transform substructure has to be refreshed 
 	 * 			by calling get_length()!
 	 *
-	 * @param this 				calling sa_payload_t object
+	 * @param forward 		iterator direction (TRUE: front to end)
-	 * @param[in] forward 		iterator direction (TRUE: front to end)
+	 * @return				created iterator_t object
 	 * @return					created iterator_t object
 	 */
-	iterator_t *(*create_proposal_substructure_iterator) (sa_payload_t *this, bool forward);
+	iterator_t *(*create_proposal_substructure_iterator) (sa_payload_t *this,
 														  bool forward);
 	/**
-	 * @brief Adds a proposal_substructure_t object to this object.
+	 * Adds a proposal_substructure_t object to this object.
 	 * 
 	 * @warning The added proposal_substructure_t object  is 
 	 * 			getting destroyed in destroy function of sa_payload_t.
 	 *
 	 * @param this 				calling sa_payload_t object
 	 * @param proposal  		proposal_substructure_t object to add
 	 */
-	void (*add_proposal_substructure) (sa_payload_t *this,proposal_substructure_t *proposal);
+	void (*add_proposal_substructure) (sa_payload_t *this,
 									   proposal_substructure_t *proposal);
 	/**
-	 * @brief Gets the proposals in this payload as a list.
+	 * Gets the proposals in this payload as a list.
 	 * 
 	 * @return					a list containing proposal_t s
 	 */
 	linked_list_t *(*get_proposals) (sa_payload_t *this);
 	/**
-	 * @brief Add a child proposal (AH/ESP) to the payload.
+	 * Add a child proposal (AH/ESP) to the payload.
 	 * 
 	 * @param proposal			child proposal to add to the payload
 	 */
 	void (*add_proposal) (sa_payload_t *this, proposal_t *proposal);
 	/**
-	 * @brief Destroys an sa_payload_t object.
+	 * Destroys an sa_payload_t object.
 	 *
 	 * @param this 	sa_payload_t object to destroy
 	 */
 	void (*destroy) (sa_payload_t *this);
 };
 /**
- * @brief Creates an empty sa_payload_t object
+ * Creates an empty sa_payload_t object
 * 
 * @return					created sa_payload_t object
 * 
 * @ingroup payloads
 */
 sa_payload_t *sa_payload_create(void);
 /**
- * @brief Creates a sa_payload_t object from a list of proposals.
+ * Creates a sa_payload_t object from a list of proposals.
 * 
 * @param proposals			list of proposals to build the payload from
 * @return					sa_payload_t object
 * 
 * @ingroup payloads
 */
 sa_payload_t *sa_payload_create_from_proposal_list(linked_list_t *proposals);
 /**
- * @brief Creates a sa_payload_t object from a single proposal.
+ * Creates a sa_payload_t object from a single proposal.
 * 
 * This is only for convenience. Use sa_payload_create_from_proposal_list
 * if you want to add more than one proposal.
 * 
 * @param proposal			proposal from which the payload should be built.
 * @return					sa_payload_t object
 * 
 * @ingroup payloads
 */
 sa_payload_t *sa_payload_create_from_proposal(proposal_t *proposal);
-#endif /*SA_PAYLOAD_H_*/
+#endif /*SA_PAYLOAD_H_ @} */
@@ -1,10 +1,3 @@
 /**
 * @file traffic_selector_substructure.c
 * 
 * @brief Interface of traffic_selector_substructure_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include "traffic_selector_substructure.h"
@@ -1,10 +1,3 @@
 /**
 * @file traffic_selector_substructure.h
 * 
 * @brief Interface of traffic_selector_substructure_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,8 +12,14 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup traffic_selector_substructure traffic_selector_substructure
 * @{ @ingroup payloads
 */
 #ifndef TRAFFIC_SELECTOR_SUBSTRUCTURE_H_
 #define TRAFFIC_SELECTOR_SUBSTRUCTURE_H_
@@ -34,21 +33,13 @@ typedef struct traffic_selector_substructure_t traffic_selector_substructure_t;
 /**
 * Length of a TRAFFIC SELECTOR SUBSTRUCTURE without start and end address.
 * 
 * @ingroup payloads
 */
 #define TRAFFIC_SELECTOR_HEADER_LENGTH 8
 /**
- * @brief Class representing an IKEv2 TRAFFIC SELECTOR.
+ * Class representing an IKEv2 TRAFFIC SELECTOR.
 * 
 * The TRAFFIC SELECTOR format is described in RFC section 3.13.1.
 * 
 * @b Constructors:
 * - traffic_selector_substructure_create()
 * - traffic_selector_substructure_create_from_traffic_selector()
 * 
 * @ingroup payloads
 */
 struct traffic_selector_substructure_t {
 	/**
@@ -57,116 +48,106 @@ struct traffic_selector_substructure_t {
 	payload_t payload_interface;
 	/**
-	 * @brief Get the type of Traffic selector.
+	 * Get the type of Traffic selector.
 	 *
 	 * @param this 		calling traffic_selector_substructure_t object
 	 * @return			type of traffic selector
 	 *  
 	 */
 	ts_type_t (*get_ts_type) (traffic_selector_substructure_t *this);
 	/**
-	 * @brief Set the type of Traffic selector.
+	 * Set the type of Traffic selector.
 	 *
 	 * @param this 		calling traffic_selector_substructure_t object
 	 * @param ts_type	type of traffic selector	
 	 */
-	void (*set_ts_type) (traffic_selector_substructure_t *this,ts_type_t ts_type);
+	void (*set_ts_type) (traffic_selector_substructure_t *this,
 						 ts_type_t ts_type);
 	/**
-	 * @brief Get the IP protocol ID of Traffic selector.
+	 * Get the IP protocol ID of Traffic selector.
 	 *
 	 * @param this 		calling traffic_selector_substructure_t object
 	 * @return			type of traffic selector
 	 *  
 	 */
 	u_int8_t (*get_protocol_id) (traffic_selector_substructure_t *this);
 	/**
-	 * @brief Set the IP protocol ID of Traffic selector
+	 * Set the IP protocol ID of Traffic selector
 	 *
 	 * @param this 			calling traffic_selector_substructure_t object
 	 * @param protocol_id	protocol ID of traffic selector	
 	 */
-	void (*set_protocol_id) (traffic_selector_substructure_t *this,u_int8_t protocol_id);
+	void (*set_protocol_id) (traffic_selector_substructure_t *this,
 							  u_int8_t protocol_id);
 	/**
-	 * @brief Get the start port and address as host_t object.
+	 * Get the start port and address as host_t object.
 	 *
 	 * Returned host_t object has to get destroyed by the caller.
 	 * 
 	 * @param this 		calling traffic_selector_substructure_t object
 	 * @return			start host as host_t object
 	 *  
 	 */
 	host_t *(*get_start_host) (traffic_selector_substructure_t *this);
 	/**
-	 * @brief Set the start port and address as host_t object.
+	 * Set the start port and address as host_t object.
 	 *
 	 * @param this 			calling traffic_selector_substructure_t object
 	 * @param start_host	start host as host_t object
 	 */
-	void (*set_start_host) (traffic_selector_substructure_t *this,host_t *start_host);
+	void (*set_start_host) (traffic_selector_substructure_t *this,
 							host_t *start_host);
 	/**
-	 * @brief Get the end port and address as host_t object.
+	 * Get the end port and address as host_t object.
 	 *
 	 * Returned host_t object has to get destroyed by the caller.
 	 * 
 	 * @param this 		calling traffic_selector_substructure_t object
 	 * @return			end host as host_t object
 	 *  
 	 */
 	host_t *(*get_end_host) (traffic_selector_substructure_t *this);
 	/**
-	 * @brief Set the end port and address as host_t object.
+	 * Set the end port and address as host_t object.
 	 *
 	 * @param this 		calling traffic_selector_substructure_t object
 	 * @param end_host	end host as host_t object
 	 */
-	void (*set_end_host) (traffic_selector_substructure_t *this,host_t *end_host);
+	void (*set_end_host) (traffic_selector_substructure_t *this,
 						  host_t *end_host);
 	/**
-	 * @brief Get a traffic_selector_t from this substructure.
+	 * Get a traffic_selector_t from this substructure.
 	 *
 	 * @warning traffic_selector_t must be destroyed after usage.
 	 * 
 	 * @param this 		calling traffic_selector_substructure_t object
 	 * @return			contained traffic_selector_t
 	 */
-	traffic_selector_t *(*get_traffic_selector) (traffic_selector_substructure_t *this);
+	traffic_selector_t *(*get_traffic_selector) (
 										traffic_selector_substructure_t *this);
 	/**
-	 * @brief Destroys an traffic_selector_substructure_t object.
+	 * Destroys an traffic_selector_substructure_t object.
 	 *
 	 * @param this 	traffic_selector_substructure_t object to destroy
 	 */
 	void (*destroy) (traffic_selector_substructure_t *this);
 };
 /**
- * @brief Creates an empty traffic_selector_substructure_t object.
+ * Creates an empty traffic_selector_substructure_t object.
 *
 * TS type is set to default TS_IPV4_ADDR_RANGE!
 *  
 * @return 					traffic_selector_substructure_t object
 * 
 * @ingroup payloads
 */
 traffic_selector_substructure_t *traffic_selector_substructure_create(void);
 /**
- * @brief Creates an initialized traffif selector substructure using
+ * Creates an initialized traffif selector substructure using
 * the values from a traffic_selector_t.
 * 
 * @param traffic_selector	traffic_selector_t to use for initialization
 * @return					traffic_selector_substructure_t object
 * 
 * @ingroup payloads
 */
-traffic_selector_substructure_t *traffic_selector_substructure_create_from_traffic_selector(traffic_selector_t *traffic_selector);
+traffic_selector_substructure_t *traffic_selector_substructure_create_from_traffic_selector(
 										traffic_selector_t *traffic_selector);
-
+#endif /* /TRAFFIC_SELECTOR_SUBSTRUCTURE_H_ @} */
 #endif /* /TRAFFIC_SELECTOR_SUBSTRUCTURE_H_ */
@@ -1,10 +1,3 @@
 /**
 * @file transform_attribute.c
 * 
 * @brief Implementation of transform_attribute_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include <string.h>
@@ -1,10 +1,3 @@
 /**
 * @file transform_attribute.h
 * 
 * @brief Interface of transform_attribute_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup transform_attribute transform_attribute
 * @{ @ingroup payloads
 */
 #ifndef TRANSFORM_ATTRIBUTE_H_
@@ -33,8 +33,6 @@ typedef struct transform_attribute_t transform_attribute_t;
 /**
 * Type of the attribute, as in IKEv2 RFC 3.3.5.
 * 
 * @ingroup payloads
 */
 enum transform_attribute_type_t {
 	ATTRIBUTE_UNDEFINED = 16384,
@@ -43,17 +41,13 @@ enum transform_attribute_type_t {
 /** 
 * enum name for transform_attribute_type_t.
 * 
 * @ingroup payloads
 */
 extern enum_name_t *transform_attribute_type_names;
 /**
- * @brief Class representing an IKEv2- TRANSFORM Attribute.
+ * Class representing an IKEv2- TRANSFORM Attribute.
 * 
 * The TRANSFORM ATTRIBUTE format is described in RFC section 3.3.5.
 * 
 * @ingroup payloads
 */
 struct transform_attribute_t {
 	/**
@@ -62,93 +56,79 @@ struct transform_attribute_t {
 	payload_t payload_interface;
 	/**
-	 * @brief Returns the currently set value of the attribute.
+	 * Returns the currently set value of the attribute.
 	 * 	
-	 * @warning Returned data are not copied.
+	 * Returned data are not copied.
 	 * 
 	 * @param this 	calling transform_attribute_t object
 	 * @return 		chunk_t pointing to the value
 	 */
 	chunk_t (*get_value_chunk) (transform_attribute_t *this);
 	/**
-	 * @brief Returns the currently set value of the attribute.
+	 * Returns the currently set value of the attribute.
 	 * 	
-	 * @warning Returned data are not copied.
+	 * Returned data are not copied.
 	 * 
 	 * @param this 	calling transform_attribute_t object
 	 * @return 		value
 	 */
 	u_int16_t (*get_value) (transform_attribute_t *this);
 	/**
-	 * @brief Sets the value of the attribute.
+	 * Sets the value of the attribute.
 	 * 	
-	 * @warning Value is getting copied.
+	 * Value is getting copied.
 	 * 
 	 * @param this 	calling transform_attribute_t object
 	 * @param value chunk_t pointing to the value to set
 	 */
 	void (*set_value_chunk) (transform_attribute_t *this, chunk_t value);
 	/**
-	 * @brief Sets the value of the attribute.
+	 * Sets the value of the attribute.
 	 * 
 	 * @param this 	calling transform_attribute_t object
 	 * @param value value to set
 	 */
 	void (*set_value) (transform_attribute_t *this, u_int16_t value);
 	/**
-	 * @brief Sets the type of the attribute.
+	 * Sets the type of the attribute.
 	 * 	
 	 * @param this 	calling transform_attribute_t object
 	 * @param type	type to set (most significant bit is set to zero)
 	 */
 	void (*set_attribute_type) (transform_attribute_t *this, u_int16_t type);
 	/**
-	 * @brief get the type of the attribute.
+	 * get the type of the attribute.
 	 * 	
 	 * @param this 	calling transform_attribute_t object
 	 * @return 		type of the value
 	 */
 	u_int16_t (*get_attribute_type) (transform_attribute_t *this);
 	/**
-	 * @brief Clones an transform_attribute_t object.
+	 * Clones an transform_attribute_t object.
 	 *
 	 * @param this 	transform_attribute_t object to clone
 	 * @return		cloned transform_attribute_t object
 	 */
 	transform_attribute_t * (*clone) (transform_attribute_t *this);
 	/**
-	 * @brief Destroys an transform_attribute_t object.
+	 * Destroys an transform_attribute_t object.
 	 *
 	 * @param this 	transform_attribute_t object to destroy
 	 */
 	void (*destroy) (transform_attribute_t *this);
 };
 /**
- * @brief Creates an empty transform_attribute_t object.
+ * Creates an empty transform_attribute_t object.
 * 
 * @return				transform_attribute_t object
 * 
 * @ingroup payloads
 */
 transform_attribute_t *transform_attribute_create(void);
 /**
- * @brief Creates an transform_attribute_t of type KEY_LENGTH.
+ * Creates an transform_attribute_t of type KEY_LENGTH.
 * 
 * @param key_length	key length in bytes
 * @return				transform_attribute_t object
 * 
 * @ingroup payloads
 */
 transform_attribute_t *transform_attribute_create_key_length(u_int16_t key_length);
-
+#endif /*TRANSFORM_ATTRIBUTE_H_ @} */
 #endif /*TRANSFORM_ATTRIBUTE_H_*/
@@ -1,10 +1,3 @@
 /**
 * @file transform_substructure.h
 * 
 * @brief Implementation of transform_substructure_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include <stddef.h>
@@ -1,10 +1,3 @@
 /**
 * @file transform_substructure.h
 * 
 * @brief Interface of transform_substructure_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup transform_substructure transform_substructure
 * @{ @ingroup payloads
 */
 #ifndef TRANSFORM_SUBSTRUCTURE_H_
@@ -39,25 +39,19 @@ typedef struct transform_substructure_t transform_substructure_t;
 /**
 * IKEv1 Value for a transform payload.
 * 
 * @ingroup payloads
 */
 #define TRANSFORM_TYPE_VALUE 3
 /**
 * Length of the transform substructure header in bytes.
 * 
 * @ingroup payloads
 */
 #define TRANSFORM_SUBSTRUCTURE_HEADER_LENGTH 8
 /**
- * @brief Class representing an IKEv2- TRANSFORM SUBSTRUCTURE.
+ * Class representing an IKEv2- TRANSFORM SUBSTRUCTURE.
 * 
 * The TRANSFORM SUBSTRUCTURE format is described in RFC section 3.3.2.
 * 
 * @ingroup payloads
 */
 struct transform_substructure_t {
 	/**
@@ -66,121 +60,105 @@ struct transform_substructure_t {
 	payload_t payload_interface;
 	/**
-	 * @brief Creates an iterator of stored transform_attribute_t objects.
+	 * Creates an iterator of stored transform_attribute_t objects.
 	 * 
-	 * @warning The created iterator has to get destroyed by the caller!
+	 * When deleting an transform attribute using this iterator, 
-	 * 
+	 * the length of this transform substructure has to be refreshed 
-	 * @warning When deleting an transform attribute using this iterator, 
+	 * by calling get_length().
 	 * 			the length of this transform substructure has to be refreshed 
 	 * 			by calling get_length()!
 	 *
-	 * @param this 			calling transform_substructure_t object
+	 * @param forward 		iterator direction (TRUE: front to end)
 	 * @param[in] forward 	iterator direction (TRUE: front to end)
 	 * @return				created iterator_t object.
 	 */
-	iterator_t * (*create_transform_attribute_iterator) (transform_substructure_t *this, bool forward);
+	iterator_t * (*create_transform_attribute_iterator) (
 								transform_substructure_t *this, bool forward);
 	/**
-	 * @brief Adds a transform_attribute_t object to this object.
+	 * Adds a transform_attribute_t object to this object.
 	 * 
 	 * @warning The added proposal_substructure_t object  is 
 	 * 			getting destroyed in destroy function of transform_substructure_t.
 	 *
 	 * @param this 		calling transform_substructure_t object
 	 * @param proposal  transform_attribute_t object to add
 	 */
-	void (*add_transform_attribute) (transform_substructure_t *this,transform_attribute_t *attribute);
+	void (*add_transform_attribute) (transform_substructure_t *this,
 									 transform_attribute_t *attribute);
 	/**
-	 * @brief Sets the next_payload field of this substructure
+	 * Sets the next_payload field of this substructure
 	 * 
 	 * If this is the last transform, next payload field is set to 0,
 	 * otherwise to 3
 	 *
 	 * @param this 		calling transform_substructure_t object
 	 * @param is_last	When TRUE, next payload field is set to 0, otherwise to 3
 	 */
 	void (*set_is_last_transform) (transform_substructure_t *this, bool is_last);
 	/**
-	 * @brief Checks if this is the last transform.
+	 * Checks if this is the last transform.
 	 * 
 	 * @param this 		calling transform_substructure_t object
 	 * @return 			TRUE if this is the last Transform, FALSE otherwise
 	 */
 	bool (*get_is_last_transform) (transform_substructure_t *this);
 	/**
-	 * @brief Sets transform type of the current transform substructure.
+	 * Sets transform type of the current transform substructure.
 	 *
 	 * @param this 		calling transform_substructure_t object
 	 * @param type		type value to set
 	 */
-	void (*set_transform_type) (transform_substructure_t *this,u_int8_t type);
+	void (*set_transform_type) (transform_substructure_t *this, u_int8_t type);
 	/**
-	 * @brief get transform type of the current transform.
+	 * get transform type of the current transform.
 	 * 
 	 * @param this 		calling transform_substructure_t object
 	 * @return 			Transform type of current transform substructure.
 	 */
 	u_int8_t (*get_transform_type) (transform_substructure_t *this);
 	/**
-	 * @brief Sets transform id of the current transform substructure.
+	 * Sets transform id of the current transform substructure.
 	 *
-	 * @param this 		calling transform_substructure_t object
+	 * @param id		transform id to set
 	 * @param id			transform id to set
 	 */
-	void (*set_transform_id) (transform_substructure_t *this,u_int16_t id);
+	void (*set_transform_id) (transform_substructure_t *this, u_int16_t id);
 	/**
-	 * @brief get transform id of the current transform.
+	 * get transform id of the current transform.
 	 * 
 	 * @param this 		calling transform_substructure_t object
 	 * @return 			Transform id of current transform substructure.
 	 */
 	u_int16_t (*get_transform_id) (transform_substructure_t *this);
 	/**
-	 * @brief get transform id of the current transform.
+	 * get transform id of the current transform.
 	 * 
-	 * @param this 			calling transform_substructure_t object
+	 * @param key_length	The key length is written to this location	
 	 * @param key_length		The key length is written to this location	
 	 * @return 			
 	 * 						- SUCCESS if a key length attribute is contained
 	 * 						- FAILED if no key length attribute is part of this 
 	 * 						  transform or key length uses more then 16 bit!
 	 */
-	status_t (*get_key_length) (transform_substructure_t *this,u_int16_t *key_length);
+	status_t (*get_key_length) (transform_substructure_t *this,
 								u_int16_t *key_length);
 	/**
-	 * @brief Clones an transform_substructure_t object.
+	 * Clones an transform_substructure_t object.
 	 *
 	 * @param this 	transform_substructure_t object to clone
 	 * @return		cloned transform_substructure_t object
 	 */
 	transform_substructure_t* (*clone) (transform_substructure_t *this);
 	/**
-	 * @brief Destroys an transform_substructure_t object.
+	 * Destroys an transform_substructure_t object.
 	 *
 	 * @param this 	transform_substructure_t object to destroy
 	 */
 	void (*destroy) (transform_substructure_t *this);
 };
 /**
- * @brief Creates an empty transform_substructure_t object.
+ * Creates an empty transform_substructure_t object.
 * 
 * @return			created transform_substructure_t object
 * 
 * @ingroup payloads
 */
 transform_substructure_t *transform_substructure_create(void);
 /**
- * @brief Creates an empty transform_substructure_t object.
+ * Creates an empty transform_substructure_t object.
 * 
 * The key length is used for the transport types ENCRYPTION_ALGORITHM,
 * PSEUDO_RANDOM_FUNCTION, INTEGRITY_ALGORITHM. For all 
@@ -190,9 +168,9 @@ transform_substructure_t *transform_substructure_create(void);
 * @param transform_id		transform id specifying the specific algorithm of a transform type
 * @param key_length		Key length for key lenght attribute
 * @return					transform_substructure_t object
 * 
 * @ingroup payloads
 */
-transform_substructure_t *transform_substructure_create_type(transform_type_t transform_type, u_int16_t transform_id, u_int16_t key_length);
+transform_substructure_t *transform_substructure_create_type(
 						transform_type_t transform_type, u_int16_t transform_id,
 						u_int16_t key_length);
-#endif /*TRANSFORM_SUBSTRUCTURE_H_*/
+#endif /*TRANSFORM_SUBSTRUCTURE_H_ @} */
@@ -1,10 +1,3 @@
 /**
 * @file ts_payload.c
 * 
 * @brief Implementation of ts_payload_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include <stddef.h>
@@ -1,10 +1,3 @@
 /**
 * @file ts_payload.h
 * 
 * @brief Interface of ts_payload_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup ts_payload ts_payload
 * @{ @ingroup payloads
 */
@@ -35,22 +35,14 @@ typedef struct ts_payload_t ts_payload_t;
 /**
 * Length of a TS payload without the Traffic selectors.
 * 
 * @ingroup payloads
 */
 #define TS_PAYLOAD_HEADER_LENGTH 8
 /**
- * @brief Class representing an IKEv2 TS payload.
+ * Class representing an IKEv2 TS payload.
 *
 * The TS payload format is described in RFC section 3.13.
 *
 * @b Constructors:
 * - ts_payload_create()
 * - ts_payload_create_from_traffic_selectors()
 *
 * @ingroup payloads
 */
 struct ts_payload_t {
 	/**
@@ -59,9 +51,8 @@ struct ts_payload_t {
 	payload_t payload_interface;
 	/**
-	 * @brief Get the type of TSpayload (TSi or TSr).
+	 * Get the type of TSpayload (TSi or TSr).
 	 *
 	 * @param this 			calling id_payload_t object
 	 * @return
 	 * 						- TRUE if this payload is of type TSi
 	 * 						- FALSE if this payload is of type TSr
@@ -69,9 +60,8 @@ struct ts_payload_t {
 	bool (*get_initiator) (ts_payload_t *this);
 	/**
-	 * @brief Set the type of TS payload (TSi or TSr).
+	 * Set the type of TS payload (TSi or TSr).
 	 *
 	 * @param this 			calling id_payload_t object
 	 * @param is_initiator	
 	 * 						- TRUE if this payload is of type TSi
 	 * 						- FALSE if this payload is of type TSr
@@ -79,75 +69,61 @@ struct ts_payload_t {
 	void (*set_initiator) (ts_payload_t *this,bool is_initiator);
 	/**
-	 * @brief Adds a traffic_selector_substructure_t object to this object.
+	 * Adds a traffic_selector_substructure_t object to this object.
 	 * 
 	 * @warning The added traffic_selector_substructure_t object  is 
 	 * 			getting destroyed in destroy function of ts_payload_t.
 	 *
 	 * @param this 				calling ts_payload_t object
 	 * @param traffic_selector  traffic_selector_substructure_t object to add
 	 */
-	void (*add_traffic_selector_substructure) (ts_payload_t *this,traffic_selector_substructure_t *traffic_selector);
+	void (*add_traffic_selector_substructure) (ts_payload_t *this,
 							traffic_selector_substructure_t *traffic_selector);
 	/**
-	 * @brief Creates an iterator of stored traffic_selector_substructure_t objects.
+	 * Creates an iterator of stored traffic_selector_substructure_t objects.
 	 * 
-	 * @warning The created iterator has to get destroyed by the caller!
+	 * When removing an traffic_selector_substructure_t object 
-	 * 
+	 * using this iterator, the length of this payload 
-	 * @warning When removing an traffic_selector_substructure_t object 
+	 * has to get refreshed by calling payload_t.get_length!
 	 * 			using this iterator, the length of this payload 
 	 * 			has to get refreshed by calling payload_t.get_length!
 	 *
-	 * @param this 			calling ts_payload_t object
+	 * @param forward 		iterator direction (TRUE: front to end)
 	 * @param[in] forward 	iterator direction (TRUE: front to end)
 	 * @return				created iterator_t object
 	 */
-	iterator_t *(*create_traffic_selector_substructure_iterator) (ts_payload_t *this, bool forward);
+	iterator_t *(*create_traffic_selector_substructure_iterator) (
 											ts_payload_t *this, bool forward);
 	/**
-	 * @brief Get a list of nested traffic selectors as traffic_selector_t.
+	 * Get a list of nested traffic selectors as traffic_selector_t.
 	 * 
 	 * Resulting list and its traffic selectors must be destroyed after usage
 	 *
 	 * @param this 			calling ts_payload_t object
 	 * @return				list of traffic selectors
 	 */
 	linked_list_t *(*get_traffic_selectors) (ts_payload_t *this);
 	/**
-	 * @brief Destroys an ts_payload_t object.
+	 * Destroys an ts_payload_t object.
 	 *
 	 * @param this 	ts_payload_t object to destroy
 	 */
 	void (*destroy) (ts_payload_t *this);
 };
 /**
- * @brief Creates an empty ts_payload_t object.
+ * Creates an empty ts_payload_t object.
 * 
 * 
 * @param is_initiator	
 * 						- TRUE if this payload is of type TSi
 * 						- FALSE if this payload is of type TSr
 * @return				ts_payload_t object
 * 
 * @ingroup payloads
 */
 ts_payload_t *ts_payload_create(bool is_initiator);
 /**
- * @brief Creates ts_payload with a list of traffic_selector_t
+ * Creates ts_payload with a list of traffic_selector_t
 * 
 * 
 * @param is_initiator	
 * 							- TRUE if this payload is of type TSi
 * 							- FALSE if this payload is of type TSr
 * @param traffic_selectors	list of traffic selectors to include
 * @return					ts_payload_t object
 * 
 * @ingroup payloads
 */
-ts_payload_t *ts_payload_create_from_traffic_selectors(bool is_initiator, linked_list_t *traffic_selectors);
+ts_payload_t *ts_payload_create_from_traffic_selectors(bool is_initiator, 
 											linked_list_t *traffic_selectors);
-
+#endif /* TS_PAYLOAD_H_ @} */
 #endif /* TS_PAYLOAD_H_ */
@@ -1,10 +1,3 @@
 /**
 * @file unknown_payload.c
 * 
 * @brief Implementation of unknown_payload_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include <stddef.h>
@@ -1,10 +1,3 @@
 /**
 * @file unknown_payload.h
 * 
 * @brief Interface of unknown_payload_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup unknown_payload unknown_payload
 * @{ @ingroup payloads
 */
 #ifndef UNKNOWN_PAYLOAD_H_
@@ -31,22 +31,15 @@ typedef struct unknown_payload_t unknown_payload_t;
 /**
 * Header length of the unknown payload.
 * 
 * @ingroup payloads
 */
 #define UNKNOWN_PAYLOAD_HEADER_LENGTH 4
 /**
- * @brief Payload which can't be processed further.
+ * Payload which can't be processed further.
 *
 * When the parser finds an unknown payload, he builds an instance of
 * this class. This allows further processing of this payload, such as
 * a check for the critical bit in the header.
 *
 * @b Constructors:
 * - unknown_payload_create()
 *
 * @ingroup payloads
 */
 struct unknown_payload_t {
@@ -56,40 +49,33 @@ struct unknown_payload_t {
 	payload_t payload_interface;
 	/**
-	 * @brief Get the raw data of this payload, without 
+	 * Get the raw data of this payload, without 
 	 * the generic payload header.
 	 * 
 	 * Returned data are NOT copied and must not be freed.
 	 *
 	 * @param this 			calling unknown_payload_t object
 	 * @return				data as chunk_t
 	 */
 	chunk_t (*get_data) (unknown_payload_t *this);
 	/**
-	 * @brief Get the critical flag.
+	 * Get the critical flag.
 	 *
 	 * @param this			calling unknown_payload_t object
 	 * @return				TRUE if payload is critical, FALSE if not
 	 */
 	bool (*is_critical) (unknown_payload_t *this);
 	/**
-	 * @brief Destroys an unknown_payload_t object.
+	 * Destroys an unknown_payload_t object.
 	 *
 	 * @param this 	unknown_payload_t object to destroy
 	 */
 	void (*destroy) (unknown_payload_t *this);
 };
 /**
- * @brief Creates an empty unknown_payload_t object.
+ * Creates an empty unknown_payload_t object.
 * 
 * @return unknown_payload_t object
 * 
 * @ingroup payloads
 */
 unknown_payload_t *unknown_payload_create(void);
-
+#endif /* UNKNOWN_PAYLOAD_H_ @} */
 #endif /* UNKNOWN_PAYLOAD_H_ */
@@ -1,10 +1,3 @@
 /**
 * @file vendor_id_payload.c
 * 
 * @brief Implementation of vendor_id_payload_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,8 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include <stddef.h>
@@ -1,10 +1,3 @@
 /**
 * @file vendor_id_payload.h
 * 
 * @brief Interface of vendor_id_payload_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup vendor_id_payload vendor_id_payload
 * @{ @ingroup payloads
 */
 #ifndef VENDOR_ID_PAYLOAD_H_
@@ -31,21 +31,14 @@ typedef struct vendor_id_payload_t vendor_id_payload_t;
 /**
 * Length of a VENDOR ID payload without the VID data in bytes.
 * 
 * @ingroup payloads
 */
 #define VENDOR_ID_PAYLOAD_HEADER_LENGTH 4
 /**
- * @brief Class representing an IKEv2 VENDOR ID payload.
+ * Class representing an IKEv2 VENDOR ID payload.
 *
 * The VENDOR ID payload format is described in RFC section 3.12.
 *
 * @b Constructors:
 * - vendor_id_payload_create()
 *
 * @ingroup payloads
 */
 struct vendor_id_payload_t {
 	/**
@@ -54,51 +47,43 @@ struct vendor_id_payload_t {
 	payload_t payload_interface;
 	/**
-	 * @brief Set the VID data.
+	 * Set the VID data.
 	 * 
 	 * Data are getting cloned.
 	 *
 	 * @param this 			calling vendor_id_payload_t object
 	 * @param data			VID data as chunk_t
 	 */
 	void (*set_data) (vendor_id_payload_t *this, chunk_t data);
 	/**
-	 * @brief Get the VID data.
+	 * Get the VID data.
 	 * 
 	 * Returned data are a copy of the internal one.
 	 *
 	 * @param this 			calling vendor_id_payload_t object
 	 * @return				VID data as chunk_t
 	 */
 	chunk_t (*get_data_clone) (vendor_id_payload_t *this);
 	/**
-	 * @brief Get the VID data.
+	 * Get the VID data.
 	 * 
 	 * Returned data are NOT copied.
 	 *
 	 * @param this 			calling vendor_id_payload_t object
 	 * @return				VID data as chunk_t
 	 */
 	chunk_t (*get_data) (vendor_id_payload_t *this);
 	/**
-	 * @brief Destroys an vendor_id_payload_t object.
+	 * Destroys an vendor_id_payload_t object.
 	 *
 	 * @param this 	vendor_id_payload_t object to destroy
 	 */
 	void (*destroy) (vendor_id_payload_t *this);
 };
 /**
- * @brief Creates an empty vendor_id_payload_t object.
+ * Creates an empty vendor_id_payload_t object.
 * 
 * @return vendor_id_payload_t object
 * 
 * @ingroup payloads
 */
 vendor_id_payload_t *vendor_id_payload_create(void);
-
+#endif /* VENDOR_ID_PAYLOAD_H_ @} */
 #endif /* VENDOR_ID_PAYLOAD_H_ */
@@ -1,10 +1,3 @@
 /**
 * @file kernel_interface.c
 *
 * @brief Implementation of kernel_interface_t.
 *
 */
 /*
 * Copyright (C) 2005-2007 Martin Willi
 * Copyright (C) 2006-2007 Tobias Brunner
@@ -25,6 +18,8 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include <sys/types.h>
@@ -1,10 +1,3 @@
 /**
 * @file kernel_interface.h
 *
 * @brief Interface of kernel_interface_t.
 *
 */
 /*
 * Copyright (C) 2006 Tobias Brunner, Daniel Roethlisberger
 * Copyright (C) 2005-2006 Martin Willi
@@ -20,6 +13,13 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup kernel_interface kernel_interface
 * @{ @ingroup kernel
 */
 #ifndef KERNEL_INTERFACE_H_
@@ -37,8 +37,6 @@ typedef struct kernel_interface_t kernel_interface_t;
 * Direction of a policy. These are equal to those
 * defined in xfrm.h, but we want to stay implementation
 * neutral here.
 *
 * @ingroup kernel
 */
 enum policy_dir_t {
 	/** Policy for inbound traffic */
@@ -50,7 +48,7 @@ enum policy_dir_t {
 };
 /**
- * @brief Interface to the kernel.
+ * Interface to the kernel.
 * 
 * The kernel interface handles the communication with the kernel
 * for SA and policy management. It allows setup of these, and provides 
@@ -59,36 +57,28 @@ enum policy_dir_t {
 * reference counting. The Linux kernel does not allow the same policy
 * installed twice, but we need this as CHILD_SA exist multiple times
 * when rekeying. Thats why we do reference counting of policies.
 *
 * @b Constructors:
 *  - kernel_interface_create()
 *
 * @ingroup kernel
 */
 struct kernel_interface_t {
 	/**
-	 * @brief Get a SPI from the kernel.
+	 * Get a SPI from the kernel.
 	 *
 	 * @warning get_spi() implicitely creates an SA with
 	 * the allocated SPI, therefore the replace flag
 	 * in add_sa() must be set when installing this SA.
 	 * 
 	 * @param this		calling object
 	 * @param src		source address of SA
 	 * @param dst		destination address of SA
 	 * @param protocol	protocol for SA (ESP/AH)
 	 * @param reqid		unique ID for this SA
-	 * @param[out] spi	allocated spi
+	 * @param spi		allocated spi
-	 * @return
+	 * @return				SUCCESS if operation completed
 	 * 					- SUCCESS
 	 * 					- FAILED if kernel comm failed
 	 */
 	status_t (*get_spi)(kernel_interface_t *this, host_t *src, host_t *dst, 
 						protocol_id_t protocol, u_int32_t reqid, u_int32_t *spi);
 	/**
-	 * @brief Add an SA to the SAD.
+	 * Add an SA to the SAD.
 	 * 
 	 * add_sa() may update an already allocated
 	 * SPI (via get_spi). In this case, the replace
@@ -98,7 +88,6 @@ struct kernel_interface_t {
 	 * gets the keys itself from the PRF, as we don't know
 	 * his algorithms and key sizes.
 	 * 
 	 * @param this			calling object
 	 * @param src			source address for this SA
 	 * @param dst			destination address for this SA
 	 * @param spi			SPI allocated by us or remote peer
@@ -112,9 +101,7 @@ struct kernel_interface_t {
 	 * @param mode			mode of the SA (tunnel, transport)
 	 * @param encap			enable UDP encapsulation for NAT traversal
 	 * @param replace		Should an already installed SA be updated?
-	 * @return
+	 * @return				SUCCESS if operation completed
 	 * 						- SUCCESS
 	 * 						- FAILED if kernel comm failed
 	 */
 	status_t (*add_sa) (kernel_interface_t *this,
 						host_t *src, host_t *dst, u_int32_t spi,
@@ -125,14 +112,13 @@ struct kernel_interface_t {
 						bool update);
 	/**
-	 * @brief Update the hosts on an installed SA.
+	 * Update the hosts on an installed SA.
 	 *
 	 * We cannot directly update the destination address as the kernel
 	 * requires the spi, the protocol AND the destination address (and family)
 	 * to identify SAs. Therefore if the destination address changed we
 	 * create a new SA and delete the old one.
 	 *
 	 * @param this			calling object
 	 * @param spi			SPI of the SA
 	 * @param protocol		protocol for this SA (ESP/AH)
 	 * @param src			current source address
@@ -140,9 +126,7 @@ struct kernel_interface_t {
 	 * @param new_src		new source address
 	 * @param new_dst		new destination address
 	 * @param encap			use UDP encapsulation
-	 * @return
+	 * @return				SUCCESS if operation completed
 	 * 						- SUCCESS
 	 * 						- FAILED if kernel comm failed
 	 */
 	status_t (*update_sa)(kernel_interface_t *this,
 						  u_int32_t spi, protocol_id_t protocol,
@@ -150,44 +134,37 @@ struct kernel_interface_t {
 						  host_t *new_src, host_t *new_dst, bool encap);
 	/**
-	 * @brief Query the use time of an SA.
+	 * Query the use time of an SA.
 	 *
 	 * The use time of an SA is not the time of the last usage, but 
 	 * the time of the first usage of the SA.
 	 * 
 	 * @param this			calling object
 	 * @param dst			destination address for this SA
 	 * @param spi			SPI allocated by us or remote peer
 	 * @param protocol		protocol for this SA (ESP/AH)
-	 * @param[out] use_time	the time of this SA's last use
+	 * @param use_time		pointer receives the time of this SA's last use
-	 * @return
+	 * @return				SUCCESS if operation completed
 	 * 						- SUCCESS
 	 * 						- FAILED if kernel comm failed
 	 */
 	status_t (*query_sa) (kernel_interface_t *this, host_t *dst, u_int32_t spi, 
 						  protocol_id_t protocol, u_int32_t *use_time);
 	/**
-	 * @brief Delete a previusly installed SA from the SAD.
+	 * Delete a previusly installed SA from the SAD.
 	 * 
 	 * @param this			calling object
 	 * @param dst			destination address for this SA
 	 * @param spi			SPI allocated by us or remote peer
 	 * @param protocol		protocol for this SA (ESP/AH)
-	 * @return
+	 * @return				SUCCESS if operation completed
 	 * 						- SUCCESS
 	 * 						- FAILED if kernel comm failed
 	 */
 	status_t (*del_sa) (kernel_interface_t *this, host_t *dst, u_int32_t spi,
 						protocol_id_t protocol);
 	/**
-	 * @brief Add a policy to the SPD.
+	 * Add a policy to the SPD.
 	 * 
 	 * A policy is always associated to an SA. Traffic which matches a
 	 * policy is handled by the SA with the same reqid.
 	 * 
 	 * @param this			calling object
 	 * @param src			source address of SA
 	 * @param dst			dest address of SA
 	 * @param src_ts		traffic selector to match traffic source
@@ -197,9 +174,7 @@ struct kernel_interface_t {
 	 * @param reqid			uniqe ID of an SA to use to enforce policy
 	 * @param high_prio		if TRUE, uses a higher priority than any with FALSE
 	 * @param mode			mode of SA (tunnel, transport)
-	 * @return
+	 * @return				SUCCESS if operation completed
 	 * 						- SUCCESS
 	 * 						- FAILED if kernel comm failed
 	 */
 	status_t (*add_policy) (kernel_interface_t *this,
 							host_t *src, host_t *dst,
@@ -209,19 +184,16 @@ struct kernel_interface_t {
 							u_int32_t reqid, bool high_prio, mode_t mode);
 	/**
-	 * @brief Query the use time of a policy.
+	 * Query the use time of a policy.
 	 *
 	 * The use time of a policy is the time the policy was used
 	 * for the last time.
 	 * 
 	 * @param this			calling object
 	 * @param src_ts		traffic selector to match traffic source
 	 * @param dst_ts		traffic selector to match traffic dest
 	 * @param direction		direction of traffic, POLICY_IN, POLICY_OUT, POLICY_FWD
 	 * @param[out] use_time	the time of this SA's last use
-	 * @return
+	 * @return				SUCCESS if operation completed
 	 * 						- SUCCESS
 	 * 						- FAILED if kernel comm failed
 	 */
 	status_t (*query_policy) (kernel_interface_t *this,
 							  traffic_selector_t *src_ts, 
@@ -229,20 +201,17 @@ struct kernel_interface_t {
 							  policy_dir_t direction, u_int32_t *use_time);
 	/**
-	 * @brief Remove a policy from the SPD.
+	 * Remove a policy from the SPD.
 	 *
 	 * The kernel interface implements reference counting for policies.
 	 * If the same policy is installed multiple times (in the case of rekeying),
 	 * the reference counter is increased. del_policy() decreases the ref counter
 	 * and removes the policy only when no more references are available.
 	 *
 	 * @param this			calling object
 	 * @param src_ts		traffic selector to match traffic source
 	 * @param dst_ts		traffic selector to match traffic dest
 	 * @param direction		direction of traffic, POLICY_IN, POLICY_OUT, POLICY_FWD
-	 * @return
+	 * @return				SUCCESS if operation completed
 	 * 						- SUCCESS
 	 * 						- FAILED if kernel comm failed
 	 */
 	status_t (*del_policy) (kernel_interface_t *this,
 							traffic_selector_t *src_ts, 
@@ -250,82 +219,69 @@ struct kernel_interface_t {
 							policy_dir_t direction);
 	/**
-	 * @brief Get our outgoing source address for a destination.
+	 * Get our outgoing source address for a destination.
 	 *
 	 * Does a route lookup to get the source address used to reach dest.
 	 * The returned host is allocated and must be destroyed.
 	 *
 	 * @param this			calling object
 	 * @param dest			target destination address
 	 * @return				outgoing source address, NULL if unreachable
 	 */
 	host_t* (*get_source_addr)(kernel_interface_t *this, host_t *dest);
 	/**
-	 * @brief Get the interface name of a local address.
+	 * Get the interface name of a local address.
 	 *
 	 * @param this			calling object
 	 * @param host			address to get interface name from
 	 * @return 				allocated interface name, or NULL if not found
 	 */
 	char* (*get_interface) (kernel_interface_t *this, host_t *host);
 	/**
-	 * @brief Creates an iterator over all local addresses.
+	 * Creates an iterator over all local addresses.
 	 *
 	 * This function blocks an internal cached address list until the
 	 * iterator gets destroyed.
 	 * These hosts are read-only, do not modify or free.
 	 *
 	 * @param this			calling object
 	 * @return 				iterator over host_t's
 	 */
 	iterator_t *(*create_address_iterator) (kernel_interface_t *this);
 	/**
-	 * @brief Add a virtual IP to an interface.
+	 * Add a virtual IP to an interface.
 	 *
 	 * Virtual IPs are attached to an interface. If an IP is added multiple
 	 * times, the IP is refcounted and not removed until del_ip() was called
 	 * as many times as add_ip().
 	 * The virtual IP is attached to the interface where the iface_ip is found.
 	 *
 	 * @param this			calling object
 	 * @param virtual_ip	virtual ip address to assign
 	 * @param iface_ip		IP of an interface to attach virtual IP
-	 * @return
+	 * @return				SUCCESS if operation completed
 	 * 						- SUCCESS
 	 * 						- FAILED if kernel comm failed
 	 */
 	status_t (*add_ip) (kernel_interface_t *this, host_t *virtual_ip,
 						host_t *iface_ip);
 	/**
-	 * @brief Remove a virtual IP from an interface.
+	 * Remove a virtual IP from an interface.
 	 *
 	 * The kernel interface uses refcounting, see add_ip().
 	 *
 	 * @param this			calling object
 	 * @param virtual_ip	virtual ip address to assign
-	 * @return
+	 * @return				SUCCESS if operation completed
 	 * 						- SUCCESS
 	 * 						- FAILED if kernel comm failed
 	 */
 	status_t (*del_ip) (kernel_interface_t *this, host_t *virtual_ip);
 	/**
-	 * @brief Destroys a kernel_interface object.
+	 * Destroys a kernel_interface object.
 	 *
 	 * @param kernel_interface_t 	calling object
 	 */
 	void (*destroy) (kernel_interface_t *kernel_interface);
 };
 /**
- * @brief Creates an object of type kernel_interface_t.
+ * Creates an object of type kernel_interface_t.
 * 
 * @ingroup kernel
 */
 kernel_interface_t *kernel_interface_create(void);
-#endif /*KERNEL_INTERFACE_H_*/
+#endif /*KERNEL_INTERFACE_H_ @} */
@@ -1,10 +1,3 @@
 /**
 * @file packet.c
 * 
 * @brief Implementation of packet_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,12 +12,12 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 #include "packet.h"
 typedef struct private_packet_t private_packet_t;
 /**
@@ -1,10 +1,3 @@
 /**
 * @file packet.h
 * 
 * @brief Interface of packet_t.
 * 
 */
 /*
 * Copyright (C) 2005-2006 Martin Willi
 * Copyright (C) 2005 Jan Hutter
@@ -19,6 +12,13 @@
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
 * for more details.
 *
 * $Id$
 */
 /**
 * @defgroup packet packet
 * @{ @ingroup network
 */
 #ifndef PACKET_H_
@@ -30,105 +30,88 @@ typedef struct packet_t packet_t;
 #include <utils/host.h>
 /**
- * @brief Abstraction of an UDP-Packet, contains data, sender and receiver.
+ * Abstraction of an UDP-Packet, contains data, sender and receiver.
 *
 * @b Constructors:
 * - packet_create()
 *
 * @ingroup network
 */
 struct packet_t {
 	/**
-	 * @brief Set the source address.
+	 * Set the source address.
 	 * 
 	 * Set host_t is now owned by packet_t, it will destroy
 	 * it if necessary.
 	 * 
 	 * @param this		calling object
 	 * @param source	address to set as source
 	 */
 	void (*set_source) (packet_t *packet, host_t *source);
 	/**
-	 * @brief Set the destination address.
+	 * Set the destination address.
 	 * 
 	 * Set host_t is now owned by packet_t, it will destroy
 	 * it if necessary.
 	 * 
 	 * @param this		calling object
 	 * @param source	address to set as destination
 	 */
 	void (*set_destination) (packet_t *packet, host_t *destination);
 	/**
-	 * @brief Get the source address.
+	 * Get the source address.
 	 * 
 	 * Set host_t is still owned by packet_t, clone it
 	 * if needed.
 	 * 
 	 * @param this		calling object
 	 * @return			source address
 	 */
 	host_t *(*get_source) (packet_t *packet);
 	/**
-	 * @brief Get the destination address.
+	 * Get the destination address.
 	 * 
 	 * Set host_t is still owned by packet_t, clone it
 	 * if needed.
 	 * 
 	 * @param this		calling object
 	 * @return			destination address
 	 */
 	host_t *(*get_destination) (packet_t *packet);
 	/**
-	 * @brief Get the data from the packet.
+	 * Get the data from the packet.
 	 * 
 	 * The data pointed by the chunk is still owned 
 	 * by the packet. Clone it if needed.
 	 * 
 	 * @param this		calling object
 	 * @return			chunk containing the data
 	 */
 	chunk_t (*get_data) (packet_t *packet);
 	/**
-	 * @brief Set the data in the packet.
+	 * Set the data in the packet.
 	 * 
 	 * Supplied chunk data is now owned by the 
 	 * packet. It will free it.
 	 * 
 	 * @param this		calling object
 	 * @param data		chunk with data to set
 	 */
 	void (*set_data) (packet_t *packet, chunk_t data);
 	/**
-	 * @brief Clones a packet_t object.
+	 * Clones a packet_t object.
 	 *  
-	 * @param packet	calling object
+	 * @param clone		clone of the packet
 	 * @param clone		pointer to a packet_t object pointer where the new object is stored
 	 */
 	packet_t* (*clone) (packet_t *packet);
 	/**
-	 * @brief Destroy the packet, freeing contained data.
+	 * Destroy the packet, freeing contained data.
 	 *  
 	 * @param packet	packet to destroy	
 	 */
 	void (*destroy) (packet_t *packet);
 };
 /**
- * @brief create an empty packet
+ * create an empty packet
 *  
 * @return packet_t object
 * 
 * @ingroup network
 */
 packet_t *packet_create(void);
-
+#endif /*PACKET_H_ @} */
 #endif /*PACKET_H_*/
--- a/Show More
+++ b/Show More