introduced new logging subsystem using bus:

  passive listeners can register on the bus
  active listeners wait for signals actively
  multiplexing allows multiple listeners to receive debug signals
  a lot more...

129 files changed, 3943 insertions, 6119 deletions

diff --git a/src/charon/Makefile.am b/src/charon/Makefile.am
index b8dc4d724..85e6264a6 100644
--- a/src/charon/Makefile.am
+++ b/src/charon/Makefile.am
@@ -4,7 +4,6 @@ ipsec_PROGRAMS = charon
 
 charon_SOURCES = \
 bus/bus.c bus/bus.h \
-bus/listeners/stream_logger.c bus/listeners/stream_logger.h \
 bus/listeners/sys_logger.c bus/listeners/sys_logger.h \
 bus/listeners/file_logger.c bus/listeners/file_logger.h \
 config/connections/connection.c config/connections/connection.h \
diff --git a/src/charon/bus/bus.c b/src/charon/bus/bus.c
index 1e5ff9857..028fd37c9 100644
--- a/src/charon/bus/bus.c
+++ b/src/charon/bus/bus.c
@@ -22,6 +22,102 @@
 
 #include "bus.h"
 
+#include <pthread.h>
+
+ENUM(signal_names, SIG_ANY, SIG_MAX,
+	/** should not get printed */
+	"SIG_ANY",
+	/** debugging message types */
+	"DMN",
+	"MGR",
+	"IKE",
+	"CHD",
+	"JOB",
+	"CFG",
+	"KNL",
+	"NET",
+	"ENC",
+	"LIB",
+	/** should not get printed */
+	"SIG_DBG_MAX",
+	/** all level0 signals are AUDIT signals */
+	"AUD",
+	"AUD",
+	"AUD",
+	"AUD",
+	"AUD",
+	"AUD",
+	"AUD",
+	"AUD",
+	"AUD",
+	"AUD",
+	"AUD",
+	"AUD",
+	/** should not get printed */
+	"SIG_MAX",
+);
+
+typedef struct active_listener_t active_listener_t;
+
+/**
+ * information for a active listener
+ */
+struct active_listener_t {
+	
+	/**
+	 * associated thread
+	 */
+	pthread_t id;
+	
+	/**
+	 * condvar to wait for a signal
+	 */
+	pthread_cond_t cond;
+	
+	/**
+	 * state of the thread
+	 */
+	enum {
+		/** not registered, do not wait for thread */
+		UNREGISTERED,
+		/** registered, if a signal occurs, wait until it is LISTENING */
+		REGISTERED,
+		/** listening, deliver signal */
+		LISTENING,
+	} state;
+	
+	/**
+	 * currently processed signals type
+	 */
+	signal_t signal;
+	
+	/**
+	 * verbosity level of the signal
+	 */
+	level_t level;
+	
+	/**
+	 * current processed signals thread number
+	 */
+	int thread;
+	
+	/**
+	 * currently processed signals ike_sa
+	 */
+	ike_sa_t *ike_sa;
+	
+	/**
+	 * currently processed signals format string
+	 */
+	char *format;
+	
+	/**
+	 * currently processed signals format varargs
+	 */
+	va_list args;
+	
+};
+
 typedef struct private_bus_t private_bus_t;
 
 /**
@@ -39,6 +135,16 @@ struct private_bus_t {
 	linked_list_t *listeners;
 	
 	/**
+	 * List of active listeners with listener_state TRUE
+	 */
+	linked_list_t *active_listeners;
+	
+	/**
+	 * mutex to synchronize active listeners
+	 */
+	pthread_mutex_t mutex;
+	
+	/**
 	 * Thread local storage for a unique, simple thread ID
 	 */
 	pthread_key_t thread_id;
@@ -76,10 +182,96 @@ static int get_thread_number(private_bus_t *this)
  */
 static void add_listener(private_bus_t *this, bus_listener_t *listener)
 {
+	pthread_mutex_lock(&this->mutex);
 	this->listeners->insert_last(this->listeners, (void*)listener);
+	pthread_mutex_unlock(&this->mutex);
+}
+
+/**
+ * Get the listener object for the calling thread
+ */
+static active_listener_t *get_active_listener(private_bus_t *this)
+{
+	active_listener_t *current, *found = NULL;
+	iterator_t *iterator;
+	
+	/* if the thread was here once before, we have a active_listener record */
+	iterator = this->active_listeners->create_iterator(this->active_listeners, TRUE);
+	while (iterator->iterate(iterator, (void**)&current))
+	{
+		if (current->id == pthread_self())
+		{
+			found = current;
+			break;
+		}
+	}
+	iterator->destroy(iterator);
+	
+	if (found == NULL)
+	{
+		/* create a new object for a never-seen thread */
+		found = malloc_thing(active_listener_t);
+		found->id = pthread_self();
+		pthread_cond_init(&found->cond, NULL);
+		this->active_listeners->insert_last(this->active_listeners, found);
+	}
+	
+	return found;
+}
+
+/**
+ * Implementation of bus_t.listen.
+ */
+static signal_t listen_(private_bus_t *this, level_t *level, int *thread,
+						ike_sa_t **ike_sa, char** format, va_list* args)
+{
+	active_listener_t *listener;
+	
+	pthread_mutex_lock(&this->mutex);
+	listener = get_active_listener(this);
+	/* go "listening", say hello to a thread which have a signal for us */
+	listener->state = LISTENING;
+	pthread_cond_broadcast(&listener->cond);
+	/* wait until it has us delivered a signal, and go back to "registered" */
+	pthread_cond_wait(&listener->cond, &this->mutex);
+	pthread_mutex_unlock(&this->mutex);
+	
+	/* return signal values */
+	*level = listener->level;
+	*thread = listener->thread;
+	*ike_sa = listener->ike_sa;
+	*format = listener->format;
+	*args = listener->args;
+	
+	return listener->signal;
 }
 
 /**
+ * Implementation of bus_t.set_listen_state.
+ */
+static void set_listen_state(private_bus_t *this, bool active)
+{
+	active_listener_t *listener;
+	
+	pthread_mutex_lock(&this->mutex);
+	
+	listener = get_active_listener(this);
+	if (active)
+	{
+		listener->state = REGISTERED;
+	}
+	else
+	{
+		listener->state = UNREGISTERED;
+		/* say hello to signal omitter; we are finished processing the signal */
+		pthread_cond_signal(&listener->cond);
+	}
+	
+	pthread_mutex_unlock(&this->mutex);
+}
+
+
+/**
  * Implementation of bus_t.set_sa.
  */
 static void set_sa(private_bus_t *this, ike_sa_t *ike_sa)
@@ -88,28 +280,83 @@ static void set_sa(private_bus_t *this, ike_sa_t *ike_sa)
 }
 
 /**
- * Implementation of bus_t.signal.
+ * Implementation of bus_t.vsignal.
  */
-static void signal_(private_bus_t *this, signal_t signal, level_t condition,
-					char* format, ...)
+static void vsignal(private_bus_t *this, signal_t signal, level_t level,
+					char* format, va_list args)
 {
 	iterator_t *iterator;
 	bus_listener_t *listener;
-	va_list args;
+	active_listener_t *active_listener;
 	ike_sa_t *ike_sa;
 	int thread;
 	
 	ike_sa = pthread_getspecific(this->thread_sa);
 	thread = get_thread_number(this);
-	va_start(args, format);
 	
+	pthread_mutex_lock(&this->mutex);
+	
+	/* do the job for all passive bus_listeners */
 	iterator = this->listeners->create_iterator(this->listeners, TRUE);
 	while (iterator->iterate(iterator, (void**)&listener))
 	{
-		listener->signal(listener, thread, ike_sa,
-						 signal, condition, format, args);
+		va_list args_copy;
+		
+		va_copy(args_copy, args);
+		listener->signal(listener, signal, level, thread, ike_sa, format, args_copy);
+		va_end(args_copy);
 	}
 	iterator->destroy(iterator);
+	
+	/* wake up all active listeners */
+	iterator = this->active_listeners->create_iterator(this->active_listeners, TRUE);
+	while (iterator->iterate(iterator, (void**)&active_listener))
+	{
+		/* wait until it is back */
+		while (active_listener->state == REGISTERED)
+		{
+			pthread_cond_wait(&active_listener->cond, &this->mutex);
+		}
+		/* if thread is listening now, give it the signal to process */
+		if (active_listener->state == LISTENING)
+		{
+			active_listener->level = level;
+			active_listener->thread = thread;
+			active_listener->ike_sa = ike_sa;
+			active_listener->signal = signal;
+			active_listener->format = format;
+			va_copy(active_listener->args, args);
+			active_listener->state = REGISTERED;
+			pthread_cond_signal(&active_listener->cond);
+		}
+	}
+	
+	/* we must wait now until all are not in state REGISTERED,
+	 * as they may still use our arguments */
+	iterator->reset(iterator);
+	while (iterator->iterate(iterator, (void**)&active_listener))
+	{
+		while (active_listener->state == REGISTERED)
+		{
+			pthread_cond_wait(&active_listener->cond, &this->mutex);
+		}
+		va_end(active_listener->args);
+	}
+	iterator->destroy(iterator);
+	
+	pthread_mutex_unlock(&this->mutex);
+}
+
+/**
+ * Implementation of bus_t.signal.
+ */
+static void signal_(private_bus_t *this, signal_t signal, level_t level, 
+					char* format, ...)
+{
+	va_list args;
+	
+	va_start(args, format);
+	vsignal(this, signal, level, format, args);
 	va_end(args);
 }
 
@@ -118,6 +365,14 @@ static void signal_(private_bus_t *this, signal_t signal, level_t condition,
  */
 static void destroy(private_bus_t *this)
 {
+	active_listener_t *listener;
+	while (this->active_listeners->remove_last(this->active_listeners,
+		   									   (void**)&listener) == SUCCESS)
+	{
+		free(listener);
+	}
+	
+	this->active_listeners->destroy(this->active_listeners);
 	this->listeners->destroy(this->listeners);
 	free(this);
 }
@@ -130,11 +385,16 @@ bus_t *bus_create()
 	private_bus_t *this = malloc_thing(private_bus_t);
 	
 	this->public.add_listener = (void(*)(bus_t*,bus_listener_t*))add_listener;
+	this->public.listen = (signal_t(*)(bus_t*,level_t*,int*,ike_sa_t**,char**,va_list*))listen_;
+	this->public.set_listen_state = (void(*)(bus_t*,bool))set_listen_state;
 	this->public.set_sa = (void(*)(bus_t*,ike_sa_t*))set_sa;
 	this->public.signal = (void(*)(bus_t*,signal_t,level_t,char*,...))signal_;
+	this->public.vsignal = (void(*)(bus_t*,signal_t,level_t,char*,va_list))vsignal;
 	this->public.destroy = (void(*)(bus_t*)) destroy;
 	
 	this->listeners = linked_list_create();
+	this->active_listeners = linked_list_create();
+	pthread_mutex_init(&this->mutex, NULL);
 	pthread_key_create(&this->thread_id, NULL);
 	pthread_key_create(&this->thread_sa, NULL);
 	
diff --git a/src/charon/bus/bus.h b/src/charon/bus/bus.h
index cce1f4217..d04ce4c4c 100644
--- a/src/charon/bus/bus.h
+++ b/src/charon/bus/bus.h
@@ -29,60 +29,81 @@
 #include <sa/child_sa.h>
 
 
-/**
- * @brief Raise a signal for an occured event.
- *
- * @param sig		signal_t signal description
- * @param level		level for the signal
- * @param format	printf() style format string
- * @param ...		printf() style agument list
- */
-#define SIG(sig, level, format, ...) charon->bus->signal(charon->bus, sig, level, format, ##__VA_ARGS__)
+typedef enum signal_t signal_t;
 
 /**
- * @brief Set the IKE_SA the calling thread is using.
+ * @brief signals ommited by the daemon.
  *
- * @param ike_sa	ike_sa to register, or NULL to unregister
- */
-#define SIG_SA(ike_sa) charon->bus->set_sa(charon->bus, ike_sa)
+ * Signaling is for different purporses. First, it allows debugging via
+ * "debugging signal messages", sencondly, it allows to follow certain
+ * mechanisms currently going on in the daemon. As we are multithreaded, 
+ * and a multiple messages are involved, it's not possible to follow
+ * one connection setup without further infrastructure. These infrastructure
+ * is provided by the bus and the signals the whole daemon ommits to the bus.
+ *
+ * @par Schema 1: Signals involved in IKE_SA/CHILD_SA initiation
+ *
+ * In the initiation of a IKE- or CHILD_SA is triggered by three possible
+ * sources: User request, a request from the other peer, or a request
+ * triggered by the kernel.
+ * Once the user requests initiation, the SIG_INITIATE signal is ommited.
+ * This signal contains the IKE_SA that got created. Any further signals
+ * have the same IKE_SA and are therefore easy to trace.
+ * If the kernel initiates, a SIG_ACQUIRE is sent over the bus.
+ * If a new IKE_SA is needed, it is set up. If it succeeds, a
+ * SIG_IKE_ESTABLISHED is ommitted. If the peer didn't accept our DH
+ * group, the initiation fails. A SIG_DH_INVALID is sent over the bus. It still
+ * contains the the old IKE_SA. Shortly afterwards, a SIG_DH_RETRY is ommited.
+ * It contains the NEW IKE_SA. This mechanism allows us to trace the setup even
+ * beyond a INVALID_KE_PAYLOUD error.
+ * If the setup fails, SIG_IKE_ESTABLISH_FAILED is sent.
+ * After a successful establishment of the IKE_SA, or if an already established
+ * IKE_SA is reused, the child establishment begins. If it is set up with
+ * the ike_auth transaction, the SIG_CHILD_ESTABLISHED signal is ommited
+ * directly after the SIG_IKE_ESTABLISHED signal, as both are set up
+ * simultaneously. The child setup may fail (in a ike_auth, or in a 
+ * create_child_sa exchange), if so, the SIG_CHID_ESTABLISH_FAILED signal
+ * is raised.
+ *
+ * @verbatim
 
-/**
- * @brief Log a debug message via the signal bus.
+          "ipsec up"  "peer msg"  "kernel acquire"
+                |         |          |
+                V         |          V
+            SIG_INITIATE  | SIG_ACQUIRE
+                       \  | /
+                        \ |/______________________________________________
+                         \/________________________________               \
+                         /\                           \    \              |
+                        |  |                          |    |              |
+                        V  V                          |    V              |
+      SIG_IKE_ESTABLISHED  SIG_IKE_ESTABLISH_FALIED   |  SIG_DH_INVALID   |
+                        \                |            |    |              |
+                         \               X            |    V              |
+                          \___________________________/  SIG_DH_RETRY     |
+                          /\                               \______________/
+                         |  |
+                         V  V
+     SIG_CHILD_ESTABLISHED  SIG_CHILD_ESTABLISH_FAILED
+                                          |
+                                          X
+   @endverbatim
+ * Other scenarios are much simpler. Termination is just indicated with
+ * a simple SIG_CHILD_TERMINATED and/or SIG_IKE_TERMINATED signal. There
+ * are other signals as SIG_CHILD_ROUTED or SIG_CHILD_UNROUTED. Rekeying is
+ * also trivial (SIG_IKE_REKEYED/SIG_CHILD_REKEYED), but may contain
+ * SIG_DH_INVALID...
  *
- * @param signal	signal_t signal description
- * @param format	printf() style format string
- * @param ...		printf() style agument list
+ * @ingroup bus
  */
-#define DBG1(sig, format, ...) charon->bus->signal(charon->bus, sig, LEV_DBG1, format, ##__VA_ARGS__)
-#define DBG2(sig, format, ...) charon->bus->signal(charon->bus, sig, LEV_DBG2, format, ##__VA_ARGS__)
-#define DBG3(sig, format, ...) charon->bus->signal(charon->bus, sig, LEV_DBG3, format, ##__VA_ARGS__)
-#define DBG4(sig, format, ...) charon->bus->signal(charon->bus, sig, LEV_DBG4, format, ##__VA_ARGS__)
-
-
-typedef enum signal_t signal_t;
-
 enum signal_t {
-	/** an IKE_SA has been established */
-	SIG_IKE_UP,
-	/** an IKE_SA has been closed */
-	SIG_IKE_DOWN,
-	/** an IKE_SA has been rekeyed */
-	SIG_IKE_REKEY,
-	/** a CHILD_SA has been installed */
-	SIG_CHILD_UP,
-	/** a CHILD_SA has been closed */
-	SIG_CHILD_DOWN,
-	/** a CHILD_SA has been rekeyed */
-	SIG_CHILD_REKEY,
-	/** a CHILD_SA has been routed */
-	SIG_CHILD_ROUTE,
-	/** a CHILD_SA has been unrouted */
-	SIG_CHILD_UNROUTE,
-	/** a remote peer has been authenticated using RSA digital signature */
-	SIG_AUTH_RSA,
-	/** a remote peer has been authenticated using preshared keys */
-	SIG_AUTH_PSK,
+	/** pseudo signal, representing any other signal */
+	SIG_ANY,
 	
+	/** debugging messages printed from daemon main loop */
+	SIG_DBG_DMN,
+	/** debugging message printed from IKE_SA_MANAGER */
+	SIG_DBG_MGR,
 	/** debugging message printed from an IKE_SA */
 	SIG_DBG_IKE,
 	/** debugging message printed from a CHILD_SA */
@@ -97,27 +118,103 @@ enum signal_t {
 	SIG_DBG_NET,
 	/** debugging message printed from message encoding/decoding */
 	SIG_DBG_ENC,
+	/** debugging message printed from libstrongswan via logging hook */
+	SIG_DBG_LIB,
+	
+	/** number of debug signals */
+	SIG_DBG_MAX,
+	
+	/** initiation started on user request */
+	SIG_INITIATE,
+	/** acquiring on kernel request */
+	SIG_ACQUIRE,
+	
+	/** an IKE_SA has been established */
+	SIG_IKE_UP,
+	/** an IKE_SA has been closed as requested */
+	SIG_IKE_DOWN,
+	/** an IKE_SA got deleted due an error */
+	SIG_IKE_FAILED,
+	/** an IKE_SA has been rekeyed */
+	SIG_IKE_REKEY,
+	
+	/** a CHILD_SA has been established */
+	SIG_CHILD_UP,
+	/** a CHILD_SA has been closed as requested */
+	SIG_CHILD_DOWN,
+	/** a CHILD_SA got deleted due an error */
+	SIG_CHILD_FAILED,
+	/** a CHILD_SA has been rekeyed */
+	SIG_CHILD_REKEY,
+	/** a CHILD_SA has been routed */
+	SIG_CHILD_ROUTE,
+	/** a CHILD_SA has been unrouted */
+	SIG_CHILD_UNROUTE,
 	
-	SIG_MAX,
+	SIG_MAX
 };
 
+/**
+ * short names of signals using 3 chars
+ */
+extern enum_name_t *signal_names;
+
 typedef enum level_t level_t;
 
+/**
+ * Signal levels used to control output verbosity.
+ */
 enum level_t {
-	/** Signal indicates something has failed */
-	LEV_FAILED,
-	/** Signal indicates something was successful */
-	LEV_SUCCESS,
-	/** Debug level 1, control flow messages */
-	LEV_DBG1,
-	/** Debug level 2, more detail informational messages */
-	LEV_DBG2,
-	/** Debug level 3, RAW data output */
-	LEV_DBG3,
-	/** Debug level 4, RAW data with sensitive (private) data */
-	LEV_DBG4,
+	/** numerical levels from 0 to 4 */
+	LEVEL_0 = 0,
+	LEVEL_1 = 1,
+	LEVEL_2 = 2,
+	LEVEL_3 = 3,
+	LEVEL_4 = 4,
+	/** absolutely silent, no signal is ommited with this level */
+	LEVEL_SILENT = -1,
+	/** alias for numberical levels */
+	LEVEL_AUDIT = LEVEL_0,
+	LEVEL_CTRL = LEVEL_1,
+	LEVEL_CTRLMORE = LEVEL_2,
+	LEVEL_RAW = LEVEL_3,
+	LEVEL_PRIVATE = LEVEL_4,
 };
 
+/**
+ * @brief Raise a signal for an occured event.
+ *
+ * @param sig		signal_t signal description
+ * @param format	printf() style format string
+ * @param ...		printf() style agument list
+ */
+#define SIG(sig, format, ...) charon->bus->signal(charon->bus, sig, LEVEL_0, format, ##__VA_ARGS__)
+
+/**
+ * @brief Log a debug message via the signal bus.
+ *
+ * @param signal	signal_t signal description
+ * @param format	printf() style format string
+ * @param ...		printf() style agument list
+ */
+#define DBG1(sig, format, ...) charon->bus->signal(charon->bus, sig, LEVEL_1, format, ##__VA_ARGS__)
+#define DBG2(sig, format, ...) charon->bus->signal(charon->bus, sig, LEVEL_2, format, ##__VA_ARGS__)
+#define DBG3(sig, format, ...) charon->bus->signal(charon->bus, sig, LEVEL_3, format, ##__VA_ARGS__)
+#define DBG4(sig, format, ...) charon->bus->signal(charon->bus, sig, LEVEL_4, format, ##__VA_ARGS__)
+
+/**
+ * @brief Get the type of a signal.
+ *
+ * A signal may be a debugging signal with a specific context. They have
+ * a level specific for their context > 0. All audit signals use the
+ * type 0. This allows filtering of singals by their type.
+ *
+ * @param signal	signal to get the type from
+ * @return			type of the signal, between 0..(SIG_DBG_MAX-1)
+ */
+#define SIG_TYPE(sig) (sig > SIG_DBG_MAX ? SIG_ANY : sig)
+
+
 typedef struct bus_listener_t bus_listener_t;
 
 /**
@@ -135,21 +232,21 @@ struct bus_listener_t {
 	 *
 	 * A numerical identification for the thread is included, as the
 	 * associated IKE_SA, if any. Signal specifies the type of
-	 * the event occured, with a verbosity level. The format string specifies
+	 * the event occured. The format string specifies
 	 * an additional informational or error message with a printf() like
 	 * variable argument list. This is in the va_list form, as forwarding
 	 * a "..." parameters to functions is not (cleanly) possible.
 	 *
 	 * @param this		listener
+	 * @param singal	kind of the signal (up, down, rekeyed, ...)
+	 * @param level		verbosity level of the signal
 	 * @param thread	ID of the thread raised this signal
 	 * @param ike_sa	IKE_SA associated to the event
-	 * @param singal	kind of the signal (up, down, rekeyed, ...)
-	 * @param level		level for signal
 	 * @param format	printf() style format string
 	 * @param args		vprintf() style va_list argument list
 	 */
-	void (*signal) (bus_listener_t *this, int thread, ike_sa_t *ike_sa,
-					signal_t signal, level_t level, char* format, va_list args);
+	void (*signal) (bus_listener_t *this, signal_t signal, level_t level,
+					int thread, ike_sa_t *ike_sa, char* format, va_list args);
 };
 
 
@@ -161,7 +258,8 @@ typedef struct bus_t bus_t;
  * The signal bus is not much more than a multiplexer. A listener interested
  * in receiving event signals registers at the bus. Any signals sent to
  * are delivered to all registered listeners.
- * 
+ * To deliver signals to threads, the blocking listen() call may be used
+ * to wait for a signal.
  *
  * @ingroup bus
  */
@@ -171,6 +269,8 @@ struct bus_t {
 	 * @brief Register a listener to the bus.
 	 *
 	 * A registered listener receives all signals which are sent to the bus.
+	 * The listener is passive; the thread which ommited the signal
+	 * processes the listener routine.
 	 *
 	 * @param this		bus
 	 * @param listener	listener to register.
@@ -178,6 +278,43 @@ struct bus_t {
 	void (*add_listener) (bus_t *this, bus_listener_t *listener);
 	
 	/**
+	 * @brief Listen actively on the bus.
+	 *
+	 * As we are fully multithreaded, we must provide a mechanism
+	 * for active threads to listen to the bus. With the listen() method,
+	 * a thread waits until a signal occurs, and then processes it.
+	 * To prevent the listen() calling thread to miss signals ommited while
+	 * it processes a signal, registration is required. This is done through
+	 * the set_listen_state() method, see below.
+	 *
+	 * @param this		bus
+	 * @param level		verbosity level of the signal
+	 * @param thread	receives thread number ommited the signal
+	 * @param ike_sa	receives the IKE_SA involved in the signal, or NULL
+	 * @param format	receives the format string supplied with the signal
+	 * @param va_list	receives the variable argument list for format
+	 * @return			the ommited signal type
+	 */
+	signal_t (*listen) (bus_t *this, level_t* level, int *thread,
+						ike_sa_t **ike_sa, char** format, va_list* args);
+	
+	/**
+	 * @brief Set the listening state of the calling thread.
+	 *
+	 * To prevent message loss for active listeners using listen(), threads
+	 * must register themself to the bus before starting to listen(). When
+	 * a signal occurs, the ommiter waits until all threads with listen_state
+	 * TRUE are waiting in the listen() method to process the signal.
+	 * It is important that a thread with liste_state TRUE calls listen()
+	 * periodically, or sets it's listening state to FALSE; otherwise
+	 * all signal omitting threads get blocked on the bus.
+	 *
+	 * @param this		bus
+	 * @param active	TRUE to set to listening
+	 */
+	void (*set_listen_state) (bus_t *this, bool active);
+	
+	/**
 	 * @brief Set the IKE_SA the calling thread is using.
 	 *
 	 * To associate an received signal to an IKE_SA without passing it as
@@ -185,8 +322,6 @@ struct bus_t {
 	 * time it checked it out. Before checking it in, the thread unregisters
 	 * the IKE_SA (by passing NULL). This IKE_SA is stored per-thread, so each
 	 * thread has one IKE_SA registered (or not).
-	 * There is a macro to simplify the call.
-	 * @see SIG_SA()
 	 * 
 	 * @param this		bus
 	 * @param ike_sa	ike_sa to register, or NULL to unregister
@@ -196,23 +331,34 @@ struct bus_t {
 	/**
 	 * @brief Send a signal to the bus.
 	 *
-	 * A signal may belong to an IKE_SA and a CHILD_SA. If so, these
-	 * are supplied to the signal function. The signal specifies the type of
-	 * the event occured. The format string specifies an additional
-	 * informational or error message with a printf() like variable argument
-	 * list.
-	 * Some useful macros may be available to shorten this call.
+	 * The signal specifies the type of the event occured. The format string
+	 * specifies an additional informational or error message with a
+	 * printf() like variable argument list.
+	 * Some useful macros are available to shorten this call.
 	 * @see SIG(), DBG1()
 	 *
 	 * @param this		bus
 	 * @param singal	kind of the signal (up, down, rekeyed, ...)
-	 * @param level		status level of the signal to send
+	 * @param level		verbosity level of the signal
 	 * @param format	printf() style format string
 	 * @param ...		printf() style argument list
 	 */
 	void (*signal) (bus_t *this, signal_t signal, level_t level, char* format, ...);
 	
 	/**
+	 * @brief Send a signal to the bus using va_list arguments.
+	 *
+	 * Same as bus_t.signal(), but uses va_list argument list.
+	 *
+	 * @param this		bus
+	 * @param singal	kind of the signal (up, down, rekeyed, ...)
+	 * @param level		verbosity level of the signal
+	 * @param format	printf() style format string
+	 * @param args		va_list arguments
+	 */
+	void (*vsignal) (bus_t *this, signal_t signal, level_t level, char* format, va_list args);
+	
+	/**
 	 * @brief Destroy the signal bus.
 	 *
 	 * @param this		bus to destroy
diff --git a/src/charon/bus/listeners/file_logger.c b/src/charon/bus/listeners/file_logger.c
index 4a2fe4b9e..794548b0e 100644
--- a/src/charon/bus/listeners/file_logger.c
+++ b/src/charon/bus/listeners/file_logger.c
@@ -20,15 +20,11 @@
  * for more details.
  */
 
-/* for fmemopen() */
-#define _GNU_SOURCE
 #include <stdio.h>
 #include <string.h>
 
 #include "file_logger.h"
 
-#include <bus/listeners/stream_logger.h>
-
 
 typedef struct private_file_logger_t private_file_logger_t;
 
@@ -48,99 +44,58 @@ struct private_file_logger_t {
 	FILE *out;
 	
 	/**
-	 * Internal used stream logger that does the dirty work
-	 */
-	stream_logger_t *logger;
-	
-	/**
-	 * Memory stream used for stream_logger
-	 */
-	FILE *stream;
-	
-	/**
-	 * Underlying buffer for stream
+	 * Maximum level to log
 	 */
-	char buffer[4096];
+	level_t levels[SIG_DBG_MAX];
 };
 
 
 /**
  * Implementation of bus_listener_t.signal.
  */
-static void signal_(private_file_logger_t *this, int thread, ike_sa_t* ike_sa,
-					signal_t signal, level_t level,
-					char *format, va_list args)
+static void signal_(private_file_logger_t *this, signal_t signal, level_t level,
+					int thread, ike_sa_t* ike_sa, char *format, va_list args)
 {
-	char line[512];
-	char *prefix;
-	FILE *reader;
-	
-	switch (signal)
+	if (level <= this->levels[SIG_TYPE(signal)])
 	{
-		case SIG_IKE_UP:
-		case SIG_IKE_DOWN:
-		case SIG_IKE_REKEY:
-		case SIG_DBG_IKE:
-			prefix = "IKE";
-			break;
-		case SIG_DBG_CHD:
-			prefix = "CHD";
-			break;
-		case SIG_DBG_JOB:
-			prefix = "JOG";
-			break;
-		case SIG_DBG_CFG:
-			prefix = "CFG";
-			break;
-		case SIG_DBG_KNL:
-			prefix = "KNL";
-			break;
-		case SIG_DBG_NET:
-			prefix = "NET";
-			break;
-		case SIG_DBG_ENC:
-			prefix = "ENC";
-			break;
-		default:
-			prefix = "???";
-			break;
-	}
-	
-	flockfile(this->stream);
-	/* reset memory stream */
-	rewind(this->stream);
-	memset(this->buffer, '\0', sizeof(this->buffer));
-	/* log to memstream */
-	this->logger->listener.signal(&this->logger->listener, thread, ike_sa,
-								  signal, level, format, args);
-	/* flush is needed to append a '\0' */
-	fflush(this->stream);
-	
-	/* create a reader stream that reads out line by line */
-	reader = fmemopen(this->buffer, sizeof(this->buffer), "r");
-	
-	while (fgets(line, sizeof(line), reader))
-	{
-		if (line[0] == '\0')
-		{
-			/* abort on EOF */
-			break;
-		}
-		else if (line[0] != '\n')
+		char buffer[8192];
+		char *current = buffer, *next;
+		
+		/* write in memory buffer first */
+		vsnprintf(buffer, sizeof(buffer), format, args);
+		
+		/* prepend a prefix in front of every line */
+		while (current)
 		{
-			fprintf(this->out, "%.2d[%s] %s", thread, prefix, line);
+			next = strchr(current, '\n');
+			if (next)
+			{
+				*(next++) = '\0';
+			}
+			fprintf(this->out, "%.2d[%N] %s\n", thread, signal_names, signal, current);
+			current = next;
 		}
 	}
-	fclose(reader);
-	funlockfile(this->stream);
 }
 
 /**
  * Implementation of file_logger_t.set_level.
  */
-static void set_level(private_file_logger_t *this, signal_t signal, level_t max)
+static void set_level(private_file_logger_t *this, signal_t signal, level_t level)
 {
-	this->logger->set_level(this->logger, signal, max);
+	if (signal == SIG_ANY)
+	{
+		int i;
+		for (i = 0; i < SIG_DBG_MAX; i++)
+		{
+			this->levels[i] = level;
+		}
+	}
+	else
+	{
+		
+		this->levels[SIG_TYPE(signal)] = level;
+	}
 }
 
 /**
@@ -148,8 +103,6 @@ static void set_level(private_file_logger_t *this, signal_t signal, level_t max)
  */
 static void destroy(private_file_logger_t *this)
 {
-	fclose(this->stream);
-	this->logger->destroy(this->logger);
 	free(this);
 }
 
@@ -161,19 +114,13 @@ file_logger_t *file_logger_create(FILE *out)
 	private_file_logger_t *this = malloc_thing(private_file_logger_t);
 	
 	/* public functions */
-	this->public.listener.signal = (void(*)(bus_listener_t*,int,ike_sa_t*,signal_t,level_t,char*,va_list))signal_;
+	this->public.listener.signal = (void(*)(bus_listener_t*,signal_t,level_t,int,ike_sa_t*,char*,va_list))signal_;
 	this->public.set_level = (void(*)(file_logger_t*,signal_t,level_t))set_level;
 	this->public.destroy = (void(*)(file_logger_t*))destroy;
 	
 	/* private variables */
 	this->out = out;
-	this->stream = fmemopen(this->buffer, sizeof(this->buffer), "w");
-	if (this->stream == NULL)
-	{
-		/* fallback to stderr */
-		this->stream = stderr;
-	}
-	this->logger = stream_logger_create(this->stream);
+	set_level(this, SIG_ANY, LEVEL_SILENT);
 	
 	return &this->public;
 }
diff --git a/src/charon/bus/listeners/file_logger.h b/src/charon/bus/listeners/file_logger.h
index 2ca028be3..919c8f0de 100644
--- a/src/charon/bus/listeners/file_logger.h
+++ b/src/charon/bus/listeners/file_logger.h
@@ -48,7 +48,7 @@ struct file_logger_t {
 	 *
 	 * @param this		stream_logger_t object
 	 * @param singal	type of signal
-	 * @param level		max level to log
+	 * @param level		max level to log (0..4)
 	 */
 	void (*set_level) (file_logger_t *this, signal_t signal, level_t level);
 	
diff --git a/src/charon/bus/listeners/stream_logger.c b/src/charon/bus/listeners/stream_logger.c
deleted file mode 100644
index 70218728f..000000000
--- a/src/charon/bus/listeners/stream_logger.c
+++ /dev/null
@@ -1,141 +0,0 @@
-/**
- * @file stream_logger.c
- *
- * @brief Implementation of stream_logger_t.
- *
- */
-
-/*
- * Copyright (C) 2006 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#include <string.h>
-#include <stdio.h>
-#include <pthread.h>
-
-#include "stream_logger.h"
-
-
-typedef struct private_stream_logger_t private_stream_logger_t;
-
-/**
- * @brief Private data of a stream_logger_t object.
- */
-struct private_stream_logger_t {
-	
-	/**
-	 * Public data
-	 */
-	stream_logger_t public;
-	
-	/**
-	 * Maximum level to log
-	 */
-	level_t max;
-	
-	/**
-	 * stream to write log output to
-	 */
-	FILE *out;
-};
-
-/**
- * Implementation of bus_listener_t.signal.
- */
-static void signal_(private_stream_logger_t *this, int thread,
-					ike_sa_t* ike_sa, signal_t signal, level_t level,
-					char *format, va_list args)
-{
-	FILE *o = this->out;
-	
-	flockfile(o);
-	
-	if (level <= this->max)
-	{
-		/* then print the info */
-		switch (signal)
-		{
-			case SIG_IKE_UP:
-			{
-				if (level == LEV_SUCCESS)
-				{
-					fprintf(o, "established: %H[%D]...%H[%D]\n",
-							ike_sa->get_my_host(ike_sa), ike_sa->get_my_id(ike_sa),
-							ike_sa->get_other_host(ike_sa), ike_sa->get_other_id(ike_sa));
-				}
-				else
-				{
-					fprintf(o, "establishing failed: %H[%D]...%H[%D]:\n",
-							ike_sa->get_my_host(ike_sa), ike_sa->get_my_id(ike_sa),
-							ike_sa->get_other_host(ike_sa), ike_sa->get_other_id(ike_sa));
-					fprintf(o, "  ");
-					vfprintf(o, format, args);
-					fprintf(o, "\n");
-				}
-				break;
-			}
-			case SIG_DBG_IKE:
-			case SIG_DBG_CHD:
-			case SIG_DBG_JOB:
-			case SIG_DBG_CFG:
-			case SIG_DBG_KNL:
-			case SIG_DBG_NET:
-			case SIG_DBG_ENC:
-			{
-				vfprintf(o, format, args);
-				fprintf(o, "\n");
-				break;
-			}
-			default:
-				break;
-		}
-	}
-	
-	funlockfile(o);
-}
-
-/**
- * Implementation of stream_logger_t.set_level.
- */
-static void set_level(private_stream_logger_t *this, signal_t signal, level_t max)
-{
-	this->max = max;
-}
-
-/**
- * Implementation of stream_logger_t.destroy.
- */
-static void destroy(private_stream_logger_t *this)
-{
-	free(this);
-}
-
-/*
- * Described in header.
- */
-stream_logger_t *stream_logger_create(FILE *out)
-{
-	private_stream_logger_t *this = malloc_thing(private_stream_logger_t);
-	
-	/* public functions */
-	this->public.listener.signal = (void(*)(bus_listener_t*,int,ike_sa_t*,signal_t,level_t,char*,va_list))signal_;
-	this->public.set_level = (void(*)(stream_logger_t*,signal_t,level_t))set_level;
-	this->public.destroy = (void(*)(stream_logger_t*))destroy;
-	
-	/* private variables */
-	this->max = LEV_DBG4;
-	this->out = out;
-	
-	return &this->public;
-}
diff --git a/src/charon/bus/listeners/stream_logger.h b/src/charon/bus/listeners/stream_logger.h
deleted file mode 100644
index 62d6c5aca..000000000
--- a/src/charon/bus/listeners/stream_logger.h
+++ /dev/null
@@ -1,75 +0,0 @@
-/**
- * @file stream_logger.h
- *
- * @brief Interface of stream_logger_t.
- *
- */
-
-/*
- * Copyright (C) 2006 Martin Willi
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#ifndef STREAM_LOGGER_H_
-#define STREAM_LOGGER_H_
-
-#include <stdio.h>
-
-#include <types.h>
-#include <bus/bus.h>
-
-typedef struct stream_logger_t stream_logger_t;
-
-/**
- * @brief Logger for a file stream which implements bus_listener_t.
- * 
- * @b Constructors:
- *  - stream_logger_create()
- * 
- * @ingroup listeners
- */
-struct stream_logger_t {
-	
-	/**
-	 * Implements the bus_listener_t interface.
-	 */
-	bus_listener_t listener;
-	
-	/**
-	 * @brief Set the loglevel for a signal type.
-	 *
-	 * @param this		stream_logger_t object
-	 * @param singal	type of signal
-	 * @param level		max level to log
-	 */
-	void (*set_level) (stream_logger_t *this, signal_t signal, level_t level);
-	
-	/**
-	 * @brief Destroys a stream_logger_t object.
-	 *
-	 * @param this		stream_logger_t object
-	 */
-	void (*destroy) (stream_logger_t *this);
-};
-
-/**
- * @brief Constructor to create a stream_logger_t object.
- *
- * @param out	output stream to log to
- * @return 		stream_logger_t object
- * 
- * @ingroup utils
- */
-stream_logger_t *stream_logger_create(FILE *out);
-
-#endif /* STREAM_LOGGER_H_ */
diff --git a/src/charon/bus/listeners/sys_logger.c b/src/charon/bus/listeners/sys_logger.c
index 357737610..0e3c9dca4 100644
--- a/src/charon/bus/listeners/sys_logger.c
+++ b/src/charon/bus/listeners/sys_logger.c
@@ -20,16 +20,12 @@
  * for more details.
  */
 
-/* for open_memstream() */
-#define _GNU_SOURCE
 #include <stdio.h>
 #include <string.h>
 #include <pthread.h>
 
 #include "sys_logger.h"
 
-#include <bus/listeners/stream_logger.h>
-
 
 typedef struct private_sys_logger_t private_sys_logger_t;
 
@@ -49,99 +45,59 @@ struct private_sys_logger_t {
 	int facility;
 	
 	/**
-	 * Internal used stream logger that does the dirty work
-	 */
-	stream_logger_t *logger;
-	
-	/**
-	 * Memory stream used for stream_logger
-	 */
-	FILE *stream;
-	
-	/**
-	 * Underlying buffer for stream
+	 * Maximum level to log
 	 */
-	char buffer[4096];
+	level_t levels[SIG_DBG_MAX];
 };
 
 
 /**
  * Implementation of bus_listener_t.signal.
  */
-static void signal_(private_sys_logger_t *this, int thread, ike_sa_t* ike_sa,
-					signal_t signal, level_t level,
-					char *format, va_list args)
+static void signal_(private_sys_logger_t *this, signal_t signal, level_t level,
+					int thread, ike_sa_t* ike_sa, char *format, va_list args)
 {
-	char line[512];
-	char *prefix;
-	FILE *reader;
-	
-	switch (signal)
+	if (level <= this->levels[SIG_TYPE(signal)])
 	{
-		case SIG_IKE_UP:
-		case SIG_IKE_DOWN:
-		case SIG_IKE_REKEY:
-		case SIG_DBG_IKE:
-			prefix = "IKE";
-			break;
-		case SIG_DBG_CHD:
-			prefix = "CHD";
-			break;
-		case SIG_DBG_JOB:
-			prefix = "JOG";
-			break;
-		case SIG_DBG_CFG:
-			prefix = "CFG";
-			break;
-		case SIG_DBG_KNL:
-			prefix = "KNL";
-			break;
-		case SIG_DBG_NET:
-			prefix = "NET";
-			break;
-		case SIG_DBG_ENC:
-			prefix = "ENC";
-			break;
-		default:
-			prefix = "???";
-			break;
-	}
-	
-	flockfile(this->stream);
-	/* reset memory stream */
-	rewind(this->stream);
-	memset(this->buffer, '\0', sizeof(this->buffer));
-	/* log to memstream */
-	this->logger->listener.signal(&this->logger->listener, thread, ike_sa,
-								  signal, level, format, args);
-	/* flush is needed to append a '\0' */
-	fflush(this->stream);
-	
-	/* create a reader stream that reads out line by line */
-	reader = fmemopen(this->buffer, sizeof(this->buffer), "r");
-	
-	while (fgets(line, sizeof(line), reader))
-	{
-		if (line[0] == '\0')
-		{
-			/* abort on EOF */
-			break;
-		}
-		else if (line[0] != '\n')
+		char buffer[8192];
+		char *current = buffer, *next;
+		
+		/* write in memory buffer first */
+		vsnprintf(buffer, sizeof(buffer), format, args);
+		
+		/* do a syslog with every line */
+		while (current)
 		{
-			syslog(this->facility|LOG_INFO, "%.2d[%s] %s", thread, prefix, line);
+			next = strchr(current, '\n');
+			if (next)
+			{
+				*(next++) = '\0';
+			}
+			syslog(this->facility|LOG_INFO, "%.2d[%N] %s\n",
+				   thread, signal_names, signal, current);
+			current = next;
 		}
 	}
-	fclose(reader);
-	funlockfile(this->stream);
 }
 
 /**
  * Implementation of sys_logger_t.set_level.
  */
-static void set_level(private_sys_logger_t *this, signal_t signal, level_t max)
+static void set_level(private_sys_logger_t *this, signal_t signal, level_t level)
 {
-	this->logger->set_level(this->logger, signal, max);
+	if (signal == SIG_ANY)
+	{
+		int i;
+		for (i = 0; i < SIG_DBG_MAX; i++)
+		{
+			this->levels[i] = level;
+		}
+	}
+	else
+	{
+		
+		this->levels[SIG_TYPE(signal)] = level;
+	}
 }
 
 /**
@@ -150,8 +106,6 @@ static void set_level(private_sys_logger_t *this, signal_t signal, level_t max)
 static void destroy(private_sys_logger_t *this)
 {
 	closelog();
-	fclose(this->stream);
-	this->logger->destroy(this->logger);
 	free(this);
 }
 
@@ -163,19 +117,13 @@ sys_logger_t *sys_logger_create(int facility)
 	private_sys_logger_t *this = malloc_thing(private_sys_logger_t);
 	
 	/* public functions */
-	this->public.listener.signal = (void(*)(bus_listener_t*,int,ike_sa_t*,signal_t,level_t,char*,va_list))signal_;
+	this->public.listener.signal = (void(*)(bus_listener_t*,signal_t,level_t,int,ike_sa_t*,char*,va_list))signal_;
 	this->public.set_level = (void(*)(sys_logger_t*,signal_t,level_t))set_level;
 	this->public.destroy = (void(*)(sys_logger_t*))destroy;
 	
 	/* private variables */
 	this->facility = facility;
-	this->stream = fmemopen(this->buffer, sizeof(this->buffer), "w");
-	if (this->stream == NULL)
-	{
-		/* fallback to stderr */
-		this->stream = stderr;
-	}
-	this->logger = stream_logger_create(this->stream);
+	set_level(this, SIG_ANY, LEVEL_SILENT);
 	
 	return &this->public;
 }
diff --git a/src/charon/config/connections/connection.c b/src/charon/config/connections/connection.c
index 3d001194b..5dfc00eb2 100644
--- a/src/charon/config/connections/connection.c
+++ b/src/charon/config/connections/connection.c
@@ -24,19 +24,13 @@
 #include <string.h>
 
 #include <config/connections/connection.h>
-
 #include <utils/linked_list.h>
-#include <utils/logger.h>
 
-/** 
- * String mappings for cert_policy_t.
- */
-mapping_t cert_policy_m[] = {
-	{CERT_ALWAYS_SEND, "CERT_ALWAYS_SEND"},
-	{CERT_SEND_IF_ASKED, "CERT_SEND_IF_ASKED"},
-	{CERT_NEVER_SEND, "CERT_NEVER_SEND"},
-	{MAPPING_END, NULL}
-};
+ENUM(cert_policy_names, CERT_ALWAYS_SEND, CERT_NEVER_SEND,
+	"CERT_ALWAYS_SEND",
+	"CERT_SEND_IF_ASKED",
+	"CERT_NEVER_SEND"
+);
 
 typedef struct private_connection_t private_connection_t;
 
diff --git a/src/charon/config/connections/connection.h b/src/charon/config/connections/connection.h
index ffe22ad13..b3c1207cc 100644
--- a/src/charon/config/connections/connection.h
+++ b/src/charon/config/connections/connection.h
@@ -54,11 +54,11 @@ enum cert_policy_t {
 };
 
 /**
- * string mappings for certpolic
_t.
+ * enum strings for cert_policy_t
  * 
  * @ingroup config
  */
-extern mapping_t cert_policy_m[];
+extern enum_name_t *cert_policy_names;
 
 
 typedef struct connection_t connection_t;
diff --git a/src/charon/config/connections/connection_store.h b/src/charon/config/connections/connection_store.h
index 7d42dd26f..9e6c0efe2 100755
--- a/src/charon/config/connections/connection_store.h
+++ b/src/charon/config/connections/connection_store.h
@@ -25,17 +25,17 @@
 
 #include <types.h>
 #include <config/connections/connection.h>
-#include <utils/logger.h>
+#include <utils/iterator.h>
 
 
 typedef struct connection_store_t connection_store_t;
 
 /**
  * @brief The interface for a store of connection_t's.
- * 
+ *
  * @b Constructors:
  *	- stroke_create()
- * 
+ *
  * @ingroup config
  */
 struct connection_store_t {
@@ -47,7 +47,7 @@ struct connection_store_t {
 	 * It may be used after kernel request for traffic protection.
 	 * The returned connection gets created/cloned and therefore must
 	 * be destroyed after usage.
-	 * 
+	 *
 	 * @param this				calling object
 	 * @param my_id				own address of connection
 	 * @param other_id			others address of connection
@@ -55,14 +55,15 @@ struct connection_store_t {
 	 * 							- connection_t, if found
 	 * 							- NULL otherwise
 	 */
-	connection_t *(*get_connection_by_hosts) (connection_store_t *this, host_t *my_host, host_t *other_host);
+	connection_t *(*get_connection_by_hosts)(connection_store_t *this, 
+											 host_t *my_host, host_t *other_host);
 	
 	/**
 	 * @brief Returns a connection identified by its name.
-	 * 
+	 *
 	 * This call is usefull to get a connection identified its
 	 * name, as on an connection setup.
-	 * 
+	 *
 	 * @param this				calling object
 	 * @param name				name of the connection to get
 	 * @return		
@@ -73,10 +74,10 @@ struct connection_store_t {
 	
 	/**
 	 * @brief Add a connection to the store.
-	 * 
-	 * After a successful call, the connection is owned by the store and may 
+	 *
+	 * After a successful call, the connection is owned by the store and may
 	 * not be manipulated nor destroyed.
-	 * 
+	 *
 	 * @param this				calling object
 	 * @param connection		connection to add
 	 * @return
@@ -87,10 +88,10 @@ struct connection_store_t {
 	
 	/**
 	 * @brief Delete a connection from the store.
-	 * 
+	 *
 	 * Remove a connection from the connection store, identified
 	 * by the connections name.
-	 * 
+	 *
 	 * @param this				calling object
 	 * @param name				name of the connection to delete
 	 * @return
@@ -100,25 +101,16 @@ struct connection_store_t {
 	status_t (*delete_connection) (connection_store_t *this, char *name);
 	
 	/**
-	 * @brief Log the connections stored in the store.
-	 * 
-	 * Depending on the implementation of the store, the store
-	 * logs various information to the specified logger.
-	 * If logger is NULL, the internal logger is used, if name is
-	 * NULL, all connections are logged
-	 * 
+	 * @brief Get an iterator for the stored connections.
+	 *
 	 * @param this				calling object
-	 * @param logger			logger to use for the log, or NULL
-	 * @param name				name of the connection, or NULL
-	 * @return
-	 * 							- SUCCESS, or
-	 * 							- FAILED
+	 * @return					iterator over all stored connections
 	 */
-	void (*log_connections) (connection_store_t *this, logger_t *logger, char *name);
+	iterator_t* (*create_iterator) (connection_store_t *this);
 	
 	/**
 	 * @brief Destroys a connection_store_t object.
-	 * 
+	 *
 	 * @param this 					calling object
 	 */
 	void (*destroy) (connection_store_t *this);
diff --git a/src/charon/config/connections/local_connection_store.c b/src/charon/config/connections/local_connection_store.c
index af107b83b..8748fb730 100644
--- a/src/charon/config/connections/local_connection_store.c
+++ b/src/charon/config/connections/local_connection_store.c
@@ -24,8 +24,8 @@
 
 #include "local_connection_store.h"
 
+#include <daemon.h>
 #include <utils/linked_list.h>
-#include <utils/logger_manager.h>
 
 
 typedef struct private_local_connection_store_t private_local_connection_store_t;
@@ -49,11 +49,6 @@ struct private_local_connection_store_t {
 	 * Mutex to exclusivly access connection list
 	 */
 	pthread_mutex_t mutex;
-	
-	/**
-	 * Assigned logger
-	 */
-	logger_t *logger;
 };
 
 
@@ -74,9 +69,8 @@ static connection_t *get_connection_by_hosts(private_local_connection_store_t *t
 	connection_t *candidate;
 	connection_t *found = NULL;
 	
-	this->logger->log(this->logger, CONTROL|LEVEL1,
-					  "looking for connection for host pair %H...%H",
-					  my_host, other_host);
+	DBG2(SIG_DBG_CFG, "looking for connection for host pair %H...%H",
+		 my_host, other_host);
 	
 	pthread_mutex_lock(&(this->mutex));
 	iterator = this->connections->create_iterator(this->connections, TRUE);
@@ -106,11 +100,9 @@ static connection_t *get_connection_by_hosts(private_local_connection_store_t *t
 				prio |= PRIO_ADDR_ANY;
 			}
 
-			this->logger->log(this->logger, CONTROL|LEVEL2,
-							 "candidate connection \"%s\": %H...%H (prio=%d)",
-							  candidate->get_name(candidate),
-							  candidate_my_host, candidate_other_host,
-							  prio);
+			DBG2(SIG_DBG_CFG, "candidate connection \"%s\": %H...%H (prio=%d)",
+				 candidate->get_name(candidate),
+				 candidate_my_host, candidate_other_host, prio);
 
 			if (prio > best_prio)
 			{
@@ -126,11 +118,8 @@ static connection_t *get_connection_by_hosts(private_local_connection_store_t *t
 		host_t *found_my_host    = found->get_my_host(found);
 		host_t *found_other_host = found->get_other_host(found);
 		
-		this->logger->log(this->logger, CONTROL|LEVEL1,
-						 "found matching connection \"%s\": %H...%H (prio=%d)",
-						  found->get_name(found),
-						  found_my_host, found_other_host,
-						  best_prio);
+		DBG2(SIG_DBG_CFG, "found matching connection \"%s\": %H...%H (prio=%d)",
+			 found->get_name(found), found_my_host, found_other_host, best_prio);
 		
 		/* give out a new reference to it */
 		found->get_ref(found);
@@ -213,40 +202,12 @@ static status_t add_connection(private_local_connection_store_t *this, connectio
 }
 
 /**
- * Implementation of connection_store_t.log_connections.
+ * Implementation of connection_store_t.create_iterator.
  */
-void log_connections(private_local_connection_store_t *this, logger_t *logger, char *name)
+static iterator_t* create_iterator(private_local_connection_store_t *this)
 {
-	iterator_t *iterator;
-	connection_t *current;
-	
-	if (logger == NULL)
-	{
-		logger = this->logger;
-	}
-	
-	pthread_mutex_lock(&(this->mutex));
-
-	iterator = this->connections->create_iterator(this->connections, TRUE);
-
-	if (iterator->get_count(iterator))
-	{
-		logger->log(logger, CONTROL, "Templates:");
-	}
-	while (iterator->has_next(iterator))
-	{
-		iterator->current(iterator, (void**)&current);
-		if (current->is_ikev2(current) && ( name == NULL || streq(name, current->get_name(current))))
-		{
-			host_t *my_host = current->get_my_host(current);
-			host_t *other_host = current->get_other_host(current);
-
-			logger->log(logger, CONTROL, "  \"%s\": %H...%H",
-						current->get_name(current), my_host, other_host);
-		}
-	}
-	iterator->destroy(iterator);
-	pthread_mutex_unlock(&(this->mutex));
+	return this->connections->create_iterator_locked(this->connections,
+													 &this->mutex);
 }
 
 /**
@@ -277,12 +238,11 @@ local_connection_store_t * local_connection_store_create(void)
 	this->public.connection_store.get_connection_by_name = (connection_t*(*)(connection_store_t*,char*))get_connection_by_name;
 	this->public.connection_store.delete_connection = (status_t(*)(connection_store_t*,char*))delete_connection;
 	this->public.connection_store.add_connection = (status_t(*)(connection_store_t*,connection_t*))add_connection;
-	this->public.connection_store.log_connections = (void(*)(connection_store_t*,logger_t*,char*))log_connections;
+	this->public.connection_store.create_iterator = (iterator_t*(*)(connection_store_t*))create_iterator;
 	this->public.connection_store.destroy = (void(*)(connection_store_t*))destroy;
 	
 	/* private variables */
 	this->connections = linked_list_create();
-	this->logger = logger_manager->get_logger(logger_manager, CONFIG);
 	pthread_mutex_init(&(this->mutex), NULL);
 
 	return (&this->public);
diff --git a/src/charon/config/credentials/credential_store.h b/src/charon/config/credentials/credential_store.h
index a9d72b47f..c9bb158d6 100755
--- a/src/charon/config/credentials/credential_store.h
+++ b/src/charon/config/credentials/credential_store.h
@@ -29,7 +29,6 @@
 #include <crypto/rsa/rsa_private_key.h>
 #include <crypto/rsa/rsa_public_key.h>
 #include <utils/identification.h>
-#include <utils/logger.h>
 
 
 typedef struct credential_store_t credential_store_t;
@@ -136,31 +135,28 @@ struct credential_store_t {
 	x509_t* (*add_ca_certificate) (credential_store_t *this, x509_t *cert);
 
 	/**
-	 * @brief Lists all certificates kept in the local credential store.
+	 * @brief Create an iterator over all end certificates.
 	 *
 	 * @param this		calling object
-	 * @param logger	logger to be used
-	 * @param utc		log dates either in UTC or local time
+	 * @return 			iterator
 	 */
-	void (*log_certificates) (credential_store_t *this, logger_t *logger, bool utc);
+	iterator_t* (*create_cert_iterator) (credential_store_t *this);
 
 	/**
-	 * @brief Lists all CA certificates kept in the local credential store.
+	 * @brief Create an iterator over all CA certificates.
 	 *
 	 * @param this		calling object
-	 * @param logger	logger to be used
-	 * @param utc		log dates either in UTC or local time
+	 * @return 			iterator
 	 */
-	void (*log_ca_certificates) (credential_store_t *this, logger_t *logger, bool utc);
+	iterator_t* (*create_cacert_iterator) (credential_store_t *this);
 
 	/**
-	 * @brief Lists all CRLs kept in the local credential store.
+	 * @brief Create an iterator over all CRLs.
 	 *
 	 * @param this		calling object
-	 * @param logger	logger to be used
-	 * @param utc		log dates either in UTC or local time
+	 * @return 			iterator
 	 */
-	void (*log_crls) (credential_store_t *this, logger_t *logger, bool utc);
+	iterator_t* (*create_crl_iterator) (credential_store_t *this);
 
 	/**
 	 * @brief Loads trusted CA certificates from a default directory.
diff --git a/src/charon/config/credentials/local_credential_store.c b/src/charon/config/credentials/local_credential_store.c
index e69418639..be9ac6acb 100644
--- a/src/charon/config/credentials/local_credential_store.c
+++ b/src/charon/config/credentials/local_credential_store.c
@@ -28,7 +28,6 @@
 #include <types.h>
 #include <utils/lexparser.h>
 #include <utils/linked_list.h>
-#include <utils/logger_manager.h>
 #include <crypto/certinfo.h>
 #include <crypto/rsa/rsa_public_key.h>
 #include <crypto/x509.h>
@@ -56,13 +55,6 @@ struct shared_key_t {
 	 * list of peer IDs
 	 */
 	linked_list_t *peers;
-
-	/**
-	 * @brief Destroys a shared_key_t object.
-	 *
-	 * @param this 			calling object
-	 */
-	void (*destroy) (shared_key_t *this);
 };
 
 
@@ -88,7 +80,6 @@ static void shared_key_destroy(shared_key_t *this)
  * @brief Creates a shared_key_t object.
  * 
  * @param shared_key		shared key value
- * 
  * @return					shared_key_t object
  * 
  * @ingroup config
@@ -97,9 +88,6 @@ static shared_key_t *shared_key_create(chunk_t secret)
 {
 	shared_key_t *this = malloc_thing(shared_key_t);
 
-	/* private functions */
-	this->destroy = shared_key_destroy;
-
 	/* private data */
 	this->secret = chunk_clone(secret);
 	this->peers = linked_list_create();
@@ -154,11 +142,6 @@ struct private_local_credential_store_t {
 	 * enforce strict crl policy
 	 */
 	bool strict;
-
-	/**
-	 * Assigned logger
-	 */
-	logger_t *logger;
 };
 
 
@@ -285,20 +268,19 @@ static rsa_public_key_t *get_trusted_public_key(private_local_credential_store_t
 	ugh = cert->is_valid(cert, NULL);
 	if (ugh != NULL)
 	{
-		this->logger->log(this->logger, ERROR, "certificate %s");
+		DBG1(SIG_DBG_CFG, "certificate %s", ugh);
 		return NULL;
 	}
 
 	status = cert->get_status(cert);
 	if (status == CERT_REVOKED || status == CERT_UNTRUSTED || (this->strict && status != CERT_GOOD))
 	{
-		this->logger->log(this->logger, ERROR, "certificate status: %s",
-						  enum_name(&cert_status_names, status));
+		DBG1(SIG_DBG_CFG, "certificate status: %N", cert_status_names, status);
 		return NULL;
 	}
 	if (status == CERT_GOOD && cert->get_until(cert) < time(NULL))
 	{
-		this->logger->log(this->logger, ERROR, "certificate is good but crl is stale");
+		DBG1(SIG_DBG_CFG, "certificate is good but crl is stale");
 		return NULL;
 	}
 
@@ -419,20 +401,20 @@ static cert_status_t verify_by_crl(private_local_credential_store_t* this, const
 	crl = get_crl(this, issuer_cert);
 	if (crl == NULL)
 	{
-		this->logger->log(this->logger, ERROR, "crl not found");
+		DBG1(SIG_DBG_CFG, "crl not found");
 		goto err;
 	}
-	this->logger->log(this->logger, CONTROL|LEVEL1, "crl found");
+	DBG2(SIG_DBG_CFG, "crl found");
 	
- 	issuer_public_key = issuer_cert->get_public_key(issuer_cert);
+	issuer_public_key = issuer_cert->get_public_key(issuer_cert);
 	valid_signature = crl->verify(crl, issuer_public_key);
 
 	if (!valid_signature)
 	{
-	    this->logger->log(this->logger, ERROR, "crl signature is invalid");
+		DBG1(SIG_DBG_CFG, "crl signature is invalid");
 		goto err;
 	}
-	this->logger->log(this->logger, CONTROL|LEVEL1, "crl signature is valid");
+	DBG2(SIG_DBG_CFG, "crl signature is valid");
 
 	crl->get_status(crl, certinfo);
 
@@ -490,8 +472,8 @@ static bool verify(private_local_credential_store_t *this, x509_t *cert, bool *f
 	*found = (cert_copy != NULL);
 	if (*found)
 	{
-		this->logger->log(this->logger, CONTROL|LEVEL1,
-				"end entitity certificate is already in credential store");
+		DBG2(SIG_DBG_CFG,
+			 "end entitity certificate is already in credential store");
 	}
 
 	for (pathlen = 0; pathlen < MAX_CA_PATH_LEN; pathlen++)
@@ -504,39 +486,39 @@ static bool verify(private_local_credential_store_t *this, x509_t *cert, bool *f
 		identification_t *subject = cert->get_subject(cert);
 		identification_t *issuer  = cert->get_issuer(cert);
 
-		this->logger->log(this->logger, CONTROL|LEVEL1, "subject: '%D'", subject);
-		this->logger->log(this->logger, CONTROL|LEVEL1, "issuer:  '%D'", issuer);
+		DBG2(SIG_DBG_CFG, "subject: '%D'", subject);
+		DBG2(SIG_DBG_CFG, "issuer:  '%D'", issuer);
 
 		ugh = cert->is_valid(cert, &until);
 		if (ugh != NULL)
 		{
-			this->logger->log(this->logger, ERROR, "certificate %s", ugh);
+			DBG1(SIG_DBG_CFG, "certificate %s", ugh);
 			return FALSE;
 		}
-		this->logger->log(this->logger, CONTROL|LEVEL1, "certificate is valid");
+		DBG2(SIG_DBG_CFG, "certificate is valid");
 
 		issuer_cert = get_issuer_certificate(this, cert);
 		if (issuer_cert == NULL)
 		{
-			this->logger->log(this->logger, ERROR, "issuer certificate not found");
+			DBG1(SIG_DBG_CFG, "issuer certificate not found");
 			return FALSE;
 		}
-		this->logger->log(this->logger, CONTROL|LEVEL1, "issuer certificate found");
+		DBG2(SIG_DBG_CFG, "issuer certificate found");
 
 		issuer_public_key = issuer_cert->get_public_key(issuer_cert);
 		valid_signature = cert->verify(cert, issuer_public_key);
 
 		if (!valid_signature)
 		{
-	    	this->logger->log(this->logger, ERROR, "certificate signature is invalid");
+			DBG1(SIG_DBG_CFG, "certificate signature is invalid");
 			return FALSE;
 		}
-		this->logger->log(this->logger, CONTROL|LEVEL1, "certificate signature is valid");
+		DBG2(SIG_DBG_CFG, "certificate signature is valid");
 
 		/* check if cert is a self-signed root ca */
 		if (pathlen > 0 && cert->is_self_signed(cert))
 		{
-			this->logger->log(this->logger, CONTROL|LEVEL1, "reached self-signed root ca");
+			DBG2(SIG_DBG_CFG, "reached self-signed root ca");
 
 			/* set the definite status and trust interval of the end entity certificate */
 			end_cert->set_until(end_cert, until);
@@ -576,10 +558,10 @@ static bool verify(private_local_credential_store_t *this, x509_t *cert, bool *f
 					/* if status information is stale */
 					if (this->strict && nextUpdate < time(NULL))
 					{
-						this->logger->log(this->logger, CONTROL|LEVEL1, "certificate is good but status is stale");
+						DBG2(SIG_DBG_CFG, "certificate is good but status is stale");
 						return FALSE;
 					}
-					this->logger->log(this->logger, CONTROL|LEVEL1, "certificate is good");
+					DBG2(SIG_DBG_CFG, "certificate is good");
 
 					/* with strict crl policy the public key must have the same
 					 * lifetime as the validity of the ocsp status or crl lifetime
@@ -589,12 +571,11 @@ static bool verify(private_local_credential_store_t *this, x509_t *cert, bool *f
 					break;
 				case CERT_REVOKED:
 					{
-						u_char buf[TIMETOA_BUF];
 						time_t revocationTime = certinfo->get_revocationTime(certinfo);
-
-						timetoa(buf, TIMETOA_BUF, &revocationTime, TRUE);
-						this->logger->log(this->logger, ERROR, "certificate was revoked on %s, reason: %s",
-										  buf, certinfo->get_revocationReason(certinfo));
+						DBG1(SIG_DBG_CFG,
+							 "certificate was revoked on %T, reason: %N",
+							 revocationTime, crl_reason_names,
+							 certinfo->get_revocationReason(certinfo));
 
 						/* set revocationTime */
 						cert->set_until(cert, revocationTime);
@@ -609,7 +590,8 @@ static bool verify(private_local_credential_store_t *this, x509_t *cert, bool *f
 							else
 							{
 								cert_copy->set_status(cert_copy, CERT_REVOKED);
-								cert_copy->set_until(cert_copy, certinfo->get_revocationTime(certinfo));
+								cert_copy->set_until(cert_copy,
+										certinfo->get_revocationTime(certinfo));
 							}
 						}
 						return FALSE;
@@ -617,7 +599,7 @@ static bool verify(private_local_credential_store_t *this, x509_t *cert, bool *f
 				case CERT_UNKNOWN:
 				case CERT_UNDEFINED:
 				default:
-					this->logger->log(this->logger, CONTROL|LEVEL1, "certificate status unknown");
+					DBG2(SIG_DBG_CFG, "certificate status unknown");
 					if (this->strict)
 					{
 						/* update status of end certificate in the credential store */
@@ -634,7 +616,7 @@ static bool verify(private_local_credential_store_t *this, x509_t *cert, bool *f
 		/* go up one step in the trust chain */
 		cert = issuer_cert;
 	}
-    this->logger->log(this->logger, ERROR, "maximum ca path length of %d levels exceeded", MAX_CA_PATH_LEN);
+	DBG1(SIG_DBG_CFG, "maximum ca path length of %d levels exceeded", MAX_CA_PATH_LEN);
 	return FALSE;
 }
 
@@ -674,80 +656,27 @@ static x509_t* add_ca_certificate(private_local_credential_store_t *this, x509_t
 }
 
 /**
- * Implements local_credential_store_t.log_certificates
+ * Implements local_credential_store_t.create_cert_iterator
  */
-static void log_certificates(private_local_credential_store_t *this, logger_t *logger, bool utc)
+static iterator_t* create_cert_iterator(private_local_credential_store_t *this)
 {
-	iterator_t *iterator = this->certs->create_iterator(this->certs, TRUE);
-	
-	if (iterator->get_count(iterator))
-	{
-		logger->log(logger, CONTROL, "");
-		logger->log(logger, CONTROL, "List of X.509 End Entity Certificates:");
-		logger->log(logger, CONTROL, "");
-	}
-	
-	while (iterator->has_next(iterator))
-	{
-		x509_t *cert;
-		bool has_key;
-		
-		iterator->current(iterator, (void**)&cert);
-		has_key = has_rsa_private_key(this, cert->get_public_key(cert));
-		cert->log_certificate(cert, logger, utc, has_key);
-	}
-	iterator->destroy(iterator);
+	return this->certs->create_iterator(this->certs, TRUE);
 }
 
 /**
- * Implements local_credential_store_t.log_ca_certificates
+ * Implements local_credential_store_t.create_cacert_iterator
  */
-static void log_ca_certificates(private_local_credential_store_t *this, logger_t *logger, bool utc)
+static iterator_t* create_cacert_iterator(private_local_credential_store_t *this)
 {
-	iterator_t *iterator = this->ca_certs->create_iterator(this->ca_certs, TRUE);
-
-	if (iterator->get_count(iterator))
-	{
-		logger->log(logger, CONTROL, "");
-		logger->log(logger, CONTROL, "List of X.509 CA Certificates:");
-		logger->log(logger, CONTROL, "");
-	}
-
-	while (iterator->has_next(iterator))
-	{
-		x509_t *cert;
-
-		iterator->current(iterator, (void**)&cert);
-		cert->log_certificate(cert, logger, utc, FALSE);
-	}
-	iterator->destroy(iterator);
+	return this->ca_certs->create_iterator(this->ca_certs, TRUE);
 }
 
 /**
- * Implements local_credential_store_t.log_crls
+ * Implements local_credential_store_t.create_crl_iterator
  */
-static void log_crls(private_local_credential_store_t *this, logger_t *logger, bool utc)
+static iterator_t* create_crl_iterator(private_local_credential_store_t *this)
 {
-	iterator_t *iterator = this->crls->create_iterator(this->crls, TRUE);
-
-	pthread_mutex_lock(&(this->crls_mutex));
-	if (iterator->get_count(iterator))
-	{
-		logger->log(logger, CONTROL, "");
-		logger->log(logger, CONTROL, "List of X.509 CRLs:");
-		logger->log(logger, CONTROL, "");
-	}
-
-	while (iterator->has_next(iterator))
-	{
-		crl_t *crl;
-
-		iterator->current(iterator, (void**)&crl);
-		crl->log_crl(crl, logger, utc, this->strict);
-	}
-	pthread_mutex_unlock(&(this->crls_mutex));
-
-	iterator->destroy(iterator);
+	return this->crls->create_iterator_locked(this->crls, &(this->crls_mutex));
 }
 
 /**
@@ -760,12 +689,12 @@ static void load_ca_certificates(private_local_credential_store_t *this)
 	DIR* dir;
 	x509_t *cert;
 	
-	this->logger->log(this->logger, CONTROL, "loading ca certificates from '%s/'", CA_CERTIFICATE_DIR);
+	DBG1(SIG_DBG_CFG, "loading ca certificates from '%s/'", CA_CERTIFICATE_DIR);
 
 	dir = opendir(CA_CERTIFICATE_DIR);
 	if (dir == NULL)
 	{
-		this->logger->log(this->logger, ERROR, "error opening ca certs directory %s'", CA_CERTIFICATE_DIR);
+		DBG1(SIG_DBG_CFG, "error opening ca certs directory %s'", CA_CERTIFICATE_DIR);
 		return;
 	}
 
@@ -787,9 +716,9 @@ static void load_ca_certificates(private_local_credential_store_t *this)
 			{
 				err_t ugh = cert->is_valid(cert, NULL);
 
-				if (ugh != NULL)	
+				if (ugh != NULL)
 				{
-					this->logger->log(this->logger, ERROR, "warning: ca certificate %s", ugh);
+					DBG1(SIG_DBG_CFG, "warning: ca certificate %s", ugh);
 				}
 				if (cert->is_ca(cert))
 				{
@@ -797,8 +726,7 @@ static void load_ca_certificates(private_local_credential_store_t *this)
 				}
 				else
 				{
-					this->logger->log(this->logger, ERROR,
-							"  CA basic constraints flag not set, cert discarded");
+					DBG1(SIG_DBG_CFG, "  CA basic constraints flag not set, cert discarded");
 					cert->destroy(cert);
 				}
 			}
@@ -810,7 +738,7 @@ static void load_ca_certificates(private_local_credential_store_t *this)
 /**
  * Add the latest crl to a linked list
  */
-static crl_t* add_crl(linked_list_t *crls, crl_t *crl, logger_t *logger)
+static crl_t* add_crl(linked_list_t *crls, crl_t *crl)
 {
 	bool found = FALSE;
 
@@ -833,13 +761,13 @@ static crl_t* add_crl(linked_list_t *crls, crl_t *crl, logger_t *logger)
 				{
 					old_crl->destroy(old_crl);
 				}
-				logger->log(logger, CONTROL|LEVEL1, "  thisUpdate is newer - existing crl replaced");
+				DBG2(SIG_DBG_CFG, "  thisUpdate is newer - existing crl replaced");
 			}
 			else
 			{
 				crl->destroy(crl);
 				crl = current_crl;
-				logger->log(logger, CONTROL|LEVEL1, "  thisUpdate is not newer - existing crl retained");
+				DBG2(SIG_DBG_CFG, "  thisUpdate is not newer - existing crl retained");
 			}
 			break;
 		}
@@ -849,7 +777,7 @@ static crl_t* add_crl(linked_list_t *crls, crl_t *crl, logger_t *logger)
 	if (!found)
 	{
 		crls->insert_last(crls, (void*)crl);
-		logger->log(logger, CONTROL|LEVEL1, "  crl added");
+		DBG2(SIG_DBG_CFG, "  crl added");
 	}
 	return crl;
 }
@@ -864,12 +792,12 @@ static void load_crls(private_local_credential_store_t *this)
 	DIR* dir;
 	crl_t *crl;
 	
-	this->logger->log(this->logger, CONTROL, "loading crls from '%s/'", CRL_DIR);
+	DBG1(SIG_DBG_CFG, "loading crls from '%s/'", CRL_DIR);
 
 	dir = opendir(CRL_DIR);
 	if (dir == NULL)
 	{
-		this->logger->log(this->logger, ERROR, "error opening crl directory %s'", CRL_DIR);
+		DBG1(SIG_DBG_CFG, "error opening crl directory %s'", CRL_DIR);
 		return;
 	}
 
@@ -893,10 +821,10 @@ static void load_crls(private_local_credential_store_t *this)
 
 				if (ugh != NULL)	
 				{
-					this->logger->log(this->logger, ERROR, "warning: crl %s", ugh);
+					DBG1(SIG_DBG_CFG, "warning: crl %s", ugh);
 				}
 				pthread_mutex_lock(&(this->crls_mutex));
-				crl = add_crl(this->crls, crl, this->logger);
+				crl = add_crl(this->crls, crl);
 				pthread_mutex_unlock(&(this->crls_mutex));
 			}
 		}
@@ -973,7 +901,7 @@ static void load_secrets(private_local_credential_store_t *this)
 		int line_nr = 0;
     	chunk_t chunk, src, line;
 
-		this->logger->log(this->logger, CONTROL, "loading secrets from \"%s\"", SECRETS_FILE);
+		DBG1(SIG_DBG_CFG, "loading secrets from \"%s\"", SECRETS_FILE);
 
 		fseek(fd, 0, SEEK_END);
 		chunk.len = ftell(fd);
@@ -996,7 +924,7 @@ static void load_secrets(private_local_credential_store_t *this)
 			}
 			if (!extract_token(&ids, ':', &line))
 			{
-				this->logger->log(this->logger, ERROR, "line %d: missing ':' separator", line_nr);
+				DBG1(SIG_DBG_CFG, "line %d: missing ':' separator", line_nr);
 				goto error;
 			}
 			/* NULL terminate the ids string by replacing the : separator */
@@ -1004,7 +932,7 @@ static void load_secrets(private_local_credential_store_t *this)
 
 			if (!eat_whitespace(&line) || !extract_token(&token, ' ', &line))
 			{
-				this->logger->log(this->logger, ERROR, "line %d: missing token", line_nr);
+				DBG1(SIG_DBG_CFG, "line %d: missing token", line_nr);
 				goto error;
 			}
 			if (match("RSA", &token))
@@ -1022,13 +950,12 @@ static void load_secrets(private_local_credential_store_t *this)
 
 				if (ugh != NULL)
 				{
-					this->logger->log(this->logger, ERROR, "line %d: %s", line_nr, ugh);
+					DBG1(SIG_DBG_CFG, "line %d: %s", line_nr, ugh);
 					goto error;
 				}
 				if (filename.len == 0)
 				{
-					this->logger->log(this->logger, ERROR,
-						"line %d: empty filename", line_nr);
+					DBG1(SIG_DBG_CFG, "line %d: empty filename", line_nr);
 					goto error;
 				}
 				if (*filename.ptr == '/')
@@ -1049,8 +976,7 @@ static void load_secrets(private_local_credential_store_t *this)
 					ugh = extract_secret(&secret, &line);
 					if (ugh != NULL)
 					{
-						this->logger->log(this->logger, ERROR, 
-										  "line %d: malformed passphrase: %s", line_nr, ugh);
+						DBG1(SIG_DBG_CFG, "line %d: malformed passphrase: %s", line_nr, ugh);
 						goto error;
 					}
 					if (secret.len > 0)
@@ -1072,23 +998,20 @@ static void load_secrets(private_local_credential_store_t *this)
 				err_t ugh = extract_secret(&secret, &line);
 				if (ugh != NULL)
 				{
-					this->logger->log(this->logger, ERROR, 
-									  "line %d: malformed secret: %s", line_nr, ugh);
+					DBG1(SIG_DBG_CFG, "line %d: malformed secret: %s", line_nr, ugh);
 					goto error;
 				}
 
 				if (ids.len > 0)
 				{
-					this->logger->log(this->logger, CONTROL, 
-									  "  loading shared key for %s", ids.ptr);
+					DBG1(SIG_DBG_CFG, "  loading shared key for %s", ids.ptr);
 				}
 				else
 				{
-					this->logger->log(this->logger, CONTROL, 
-									  "  loading shared key for %%any");
+					DBG1(SIG_DBG_CFG, "  loading shared key for %%any");
 				}
 
-				this->logger->log_chunk(this->logger, PRIVATE, "  secret:", secret);
+				DBG4(SIG_DBG_CFG, "  secret:", secret);
 
 				shared_key = shared_key_create(secret);
 				if (shared_key)
@@ -1103,8 +1026,7 @@ static void load_secrets(private_local_credential_store_t *this)
 					ugh = extract_value(&id, &ids);
 					if (ugh != NULL)
 					{
-						this->logger->log(this->logger, ERROR, 
-										  "line %d: %s", line_nr, ugh);
+						DBG1(SIG_DBG_CFG, "line %d: %s", line_nr, ugh);
 						goto error;
 					}
 					if (id.len == 0)
@@ -1118,8 +1040,7 @@ static void load_secrets(private_local_credential_store_t *this)
 					peer_id = identification_create_from_string(id.ptr);
 					if (peer_id == NULL)
 					{
-						this->logger->log(this->logger, ERROR, 
-										  "line %d: malformed ID: %s", line_nr, id.ptr);
+						DBG1(SIG_DBG_CFG, "line %d: malformed ID: %s", line_nr, id.ptr);
 						goto error;
 					}
 					
@@ -1137,9 +1058,8 @@ static void load_secrets(private_local_credential_store_t *this)
 			}
 			else
 			{
-				this->logger->log(this->logger, ERROR,
-					 "line %d: token must be either RSA, PSK, or PIN",
-					  line_nr, token.len);
+				DBG1(SIG_DBG_CFG, "line %d: token must be either "
+					 "RSA, PSK, or PIN", line_nr, token.len);
 				goto error;
 			}
 		}
@@ -1148,7 +1068,7 @@ error:
 	}
 	else
 	{
-		this->logger->log(this->logger, ERROR, "could not open file '%s'", SECRETS_FILE);
+		DBG1(SIG_DBG_CFG, "could not open file '%s'", SECRETS_FILE);
 	}
 }
 
@@ -1195,7 +1115,7 @@ static void destroy(private_local_credential_store_t *this)
     /* destroy shared keys list */
 	while (this->shared_keys->remove_last(this->shared_keys, (void**)&shared_key) == SUCCESS)
 	{
-		shared_key->destroy(shared_key);
+		shared_key_destroy(shared_key);
 	}
 	this->shared_keys->destroy(this->shared_keys);
 
@@ -1218,9 +1138,9 @@ local_credential_store_t * local_credential_store_create(bool strict)
 	this->public.credential_store.verify = (bool (*) (credential_store_t*,x509_t*,bool*))verify;
 	this->public.credential_store.add_end_certificate = (x509_t* (*) (credential_store_t*,x509_t*))add_end_certificate;
 	this->public.credential_store.add_ca_certificate = (x509_t* (*) (credential_store_t*,x509_t*))add_ca_certificate;
-	this->public.credential_store.log_certificates = (void (*) (credential_store_t*,logger_t*,bool))log_certificates;
-	this->public.credential_store.log_ca_certificates = (void (*) (credential_store_t*,logger_t*,bool))log_ca_certificates;
-	this->public.credential_store.log_crls = (void (*) (credential_store_t*,logger_t*,bool))log_crls;
+	this->public.credential_store.create_cert_iterator = (iterator_t* (*) (credential_store_t*))create_cert_iterator;
+	this->public.credential_store.create_cacert_iterator = (iterator_t* (*) (credential_store_t*))create_cacert_iterator;
+	this->public.credential_store.create_crl_iterator = (iterator_t* (*) (credential_store_t*))create_crl_iterator;
 	this->public.credential_store.load_ca_certificates = (void (*) (credential_store_t*))load_ca_certificates;
 	this->public.credential_store.load_crls = (void (*) (credential_store_t*))load_crls;
 	this->public.credential_store.load_secrets = (void (*) (credential_store_t*))load_secrets;
@@ -1230,13 +1150,12 @@ local_credential_store_t * local_credential_store_create(bool strict)
 	pthread_mutex_init(&(this->crls_mutex), NULL);
 
 	/* private variables */
-	this->shared_keys  = linked_list_create();
+	this->shared_keys = linked_list_create();
 	this->private_keys = linked_list_create();
-	this->certs        = linked_list_create();
-	this->ca_certs     = linked_list_create();
-	this->crls         = linked_list_create();
+	this->certs = linked_list_create();
+	this->ca_certs = linked_list_create();
+	this->crls = linked_list_create();
 	this->strict = strict;
-	this->logger = logger_manager->get_logger(logger_manager, CONFIG);
 
 	return (&this->public);
 }
diff --git a/src/charon/config/policies/local_policy_store.c b/src/charon/config/policies/local_policy_store.c
index 5253cb3fa..577b83a28 100644
--- a/src/charon/config/policies/local_policy_store.c
+++ b/src/charon/config/policies/local_policy_store.c
@@ -1,8 +1,8 @@
 /**
  * @file local_policy_store.c
- * 
+ *
  * @brief Implementation of local_policy_store_t.
- *  
+ *
  */
 
 /*
@@ -24,8 +24,8 @@
 
 #include "local_policy_store.h"
 
+#include <daemon.h>
 #include <utils/linked_list.h>
-#include <utils/logger_manager.h>
 
 
 typedef struct private_local_policy_store_t private_local_policy_store_t;
@@ -49,11 +49,6 @@ struct private_local_policy_store_t {
 	 * Mutex to exclusivly access list
 	 */
 	pthread_mutex_t mutex;
-	
-	/**
-	 * Assigned logger
-	 */
-	logger_t *logger;
 };
 
 /**
@@ -116,8 +111,7 @@ static policy_t *get_policy(private_local_policy_store_t *this,
 	policy_t *candidate;
 	policy_t *found = NULL;
 	
-	this->logger->log(this->logger, CONTROL|LEVEL1, 
-					  "searching policy for ID pair %D...%D", my_id, other_id);
+	DBG2(SIG_DBG_CFG, "searching policy for ID pair %D...%D", my_id, other_id);
 
 	pthread_mutex_lock(&(this->mutex));
 	iterator = this->policies->create_iterator(this->policies, TRUE);
@@ -149,16 +143,14 @@ static policy_t *get_policy(private_local_policy_store_t *this,
 			if (!contains_traffic_selectors(candidate, TRUE, my_ts, my_host) ||
 				!contains_traffic_selectors(candidate, FALSE, other_ts, other_host))
 			{
-				this->logger->log(this->logger, CONTROL|LEVEL2,
-								  "candidate '%s' inacceptable due traffic selector mismatch",
-								  candidate->get_name(candidate));
+				DBG2(SIG_DBG_CFG, "candidate '%s' inacceptable due traffic "
+					 "selector mismatch", candidate->get_name(candidate));
 				continue;
 			}
 
-			this->logger->log(this->logger, CONTROL|LEVEL2,
-							  "candidate policy '%s': %D...%D (prio=%d)",
-							  candidate->get_name(candidate),
-							  candidate_my_id, candidate_other_id, prio);
+			DBG2(SIG_DBG_CFG, "candidate policy '%s': %D...%D (prio=%d)",
+				 candidate->get_name(candidate),
+				 candidate_my_id, candidate_other_id, prio);
 
 			if (prio > best_prio)
 			{
@@ -174,10 +166,8 @@ static policy_t *get_policy(private_local_policy_store_t *this,
 		identification_t *found_my_id = found->get_my_id(found);
 		identification_t *found_other_id = found->get_other_id(found);
 		
-		this->logger->log(this->logger, CONTROL,
-						  "found matching policy '%s': %D...%D (prio=%d)",
-						  found->get_name(found),
-						  found_my_id, found_other_id, best_prio);
+		DBG1(SIG_DBG_CFG, "found matching policy '%s': %D...%D (prio=%d)",
+			 found->get_name(found), found_my_id, found_other_id, best_prio);
 		/* give out a new reference to it */
 		found->get_ref(found);
 	}
@@ -193,7 +183,7 @@ static policy_t *get_policy_by_name(private_local_policy_store_t *this, char *na
 	iterator_t *iterator;
 	policy_t *current, *found = NULL;
 	
-	this->logger->log(this->logger, CONTROL|LEVEL1, "looking for policy \"%s\"", name);
+	DBG2(SIG_DBG_CFG, "looking for policy '%s'", name);
 	
 	pthread_mutex_lock(&(this->mutex));
 	iterator = this->policies->create_iterator(this->policies, TRUE);
@@ -246,6 +236,15 @@ static status_t delete_policy(private_local_policy_store_t *this, char *name)
 }
 
 /**
+ * Implementation of policy_store_t.create_iterator.
+ */
+static iterator_t* create_iterator(private_local_policy_store_t *this)
+{
+	return this->policies->create_iterator_locked(this->policies,
+												  &this->mutex);
+}
+
+/**
  * Implementation of policy_store_t.destroy.
  */
 static void destroy(private_local_policy_store_t *this)
@@ -273,11 +272,11 @@ local_policy_store_t *local_policy_store_create(void)
 	this->public.policy_store.get_policy = (policy_t*(*)(policy_store_t*,identification_t*,identification_t*,linked_list_t*,linked_list_t*,host_t*,host_t*))get_policy;
 	this->public.policy_store.get_policy_by_name = (policy_t*(*)(policy_store_t*,char*))get_policy_by_name;
 	this->public.policy_store.delete_policy = (status_t(*)(policy_store_t*,char*))delete_policy;
+	this->public.policy_store.create_iterator = (iterator_t*(*)(policy_store_t*))create_iterator;
 	this->public.policy_store.destroy = (void(*)(policy_store_t*))destroy;
 	
 	/* private variables */
 	this->policies = linked_list_create();
-	this->logger = logger_manager->get_logger(logger_manager, CONFIG);
 	pthread_mutex_init(&(this->mutex), NULL);
 	
 	return (&this->public);
diff --git a/src/charon/config/policies/policy.c b/src/charon/config/policies/policy.c
index e3a1100b9..dcae0504c 100644
--- a/src/charon/config/policies/policy.c
+++ b/src/charon/config/policies/policy.c
@@ -27,34 +27,23 @@
 
 #include "policy.h"
 
+#include <daemon.h>
 #include <utils/linked_list.h>
 #include <utils/identification.h>
-#include <utils/logger_manager.h>
 
-/** 
- * String mappings for auth_method_t.
- */
-static const char *const auth_method_name[] = {
+ENUM(auth_method_names, RSA_DIGITAL_SIGNATURE, DSS_DIGITAL_SIGNATURE,
 	"RSA signature",
 	"pre-shared key",
 	"DSS signature"
-};
+);
 
-enum_names auth_method_names =
-    { RSA_DIGITAL_SIGNATURE, DSS_DIGITAL_SIGNATURE, auth_method_name, NULL };
 
-/** 
- * String mappings for dpd_action_t.
- */
-static const char *const dpd_action_name[] = {
+ENUM(dpd_action_names, DPD_NONE, DPD_RESTART,
 	"DPD_NONE",
 	"DPD_CLEAR",
 	"DPD_ROUTE",
 	"DPD_RESTART"
-};
-
-enum_names dpd_action_names =
-    { DPD_NONE, DPD_RESTART, dpd_action_name, NULL };
+);
 
 typedef struct private_policy_t private_policy_t;
 
@@ -148,11 +137,6 @@ struct private_policy_t {
 	 * What to do with an SA when other peer seams to be dead?
 	 */
 	bool dpd_action;
-	
-	/**
-	 * logger
-	 */
-	logger_t *logger;
 };
 
 /**
@@ -239,9 +223,7 @@ static linked_list_t *select_traffic_selectors(private_policy_t *this,
 	traffic_selector_t *supplied_ts, *stored_ts, *selected_ts;
 	linked_list_t *selected = linked_list_create();
 	
-	this->logger->log(this->logger, CONTROL|LEVEL1,
-					  "selecting traffic selectors for %s host",
-					  stored == this->my_ts ? "local" : "remote");
+	DBG2(SIG_DBG_CFG, "selecting traffic selectors");
 	
 	stored_iter = stored->create_iterator(stored, TRUE);
 	supplied_iter = supplied->create_iterator(supplied, TRUE);
@@ -258,10 +240,8 @@ static linked_list_t *select_traffic_selectors(private_policy_t *this,
 		/* iterate over all supplied traffic selectors */
 		while (supplied_iter->iterate(supplied_iter, (void**)&supplied_ts))
 		{
-			this->logger->log(this->logger, CONTROL|LEVEL2,
-							  "  stored %s <=> %s received",
-							  stored_ts->get_string(stored_ts), 
-							  supplied_ts->get_string(supplied_ts));
+			DBG2(SIG_DBG_CFG, "stored %R <=> %R received",
+				 stored_ts, supplied_ts);
 			
 			selected_ts = stored_ts->get_subset(stored_ts, supplied_ts);
 			if (selected_ts)
@@ -269,8 +249,8 @@ static linked_list_t *select_traffic_selectors(private_policy_t *this,
 				/* got a match, add to list */
 				selected->insert_last(selected, (void*)selected_ts);
 				
-				this->logger->log(this->logger, CONTROL|LEVEL1, "    got a match: %s",
-								  selected_ts->get_string(selected_ts));
+				DBG2(SIG_DBG_CFG, "found traffic selector for %s: %R", 
+					 stored == this->my_ts ? "us" : "other", selected_ts);
 			}
 		}
 		stored_ts->destroy(stored_ts);
@@ -554,7 +534,6 @@ policy_t *policy_create(char *name, identification_t *my_id, identification_t *o
 	this->proposals = linked_list_create();
 	this->my_ts = linked_list_create();
 	this->other_ts = linked_list_create();
-	this->logger = logger_manager->get_logger(logger_manager, CONFIG);
 
 	return &this->public;
 }
diff --git a/src/charon/config/policies/policy.h b/src/charon/config/policies/policy.h
index 6d80319b4..84f5f2bc9 100644
--- a/src/charon/config/policies/policy.h
+++ b/src/charon/config/policies/policy.h
@@ -58,11 +58,11 @@ enum auth_method_t {
 };
 
 /**
- * string mappings for auth_method_t.
- * 
+ * enum names for auth_method_t.
+ *
  * @ingroup config
  */
-extern enum_names auth_method_names;
+extern enum_name_t *auth_method_names;
 
 
 typedef enum dpd_action_t dpd_action_t;
@@ -86,9 +86,9 @@ enum dpd_action_t {
 };
 
 /**
- * String mappings for dpd_action_t.
+ * enum names for dpd_action_t.
  */
-extern enum_names dpd_action_names;
+extern enum_name_t *dpd_action_names;
 
 
 typedef struct policy_t policy_t;
diff --git a/src/charon/config/policies/policy_store.h b/src/charon/config/policies/policy_store.h
index 2ea57b8b4..a09263b13 100755
--- a/src/charon/config/policies/policy_store.h
+++ b/src/charon/config/policies/policy_store.h
@@ -101,6 +101,14 @@ struct policy_store_t {
 	status_t (*delete_policy) (policy_store_t *this, char *name);
 	
 	/**
+	 * @brief Get an iterator for the stored policies.
+	 *
+	 * @param this				calling object
+	 * @return					iterator over all stored policies
+	 */
+	iterator_t* (*create_iterator) (policy_store_t *this);
+	
+	/**
 	 * @brief Destroys a policy_store_t object.
 	 *
 	 * @param this 					calling object
diff --git a/src/charon/config/proposal.c b/src/charon/config/proposal.c
index 393f0f3aa..fac0e31c2 100644
--- a/src/charon/config/proposal.c
+++ b/src/charon/config/proposal.c
@@ -26,45 +26,33 @@
 
 #include <utils/linked_list.h>
 #include <utils/identification.h>
-#include <utils/logger.h>
 #include <utils/lexparser.h>
 #include <crypto/prfs/prf.h>
 #include <crypto/crypters/crypter.h>
 #include <crypto/signers/signer.h>
 
 
-/** 
- * String mappings for protocol_id_t.
- */
-mapping_t protocol_id_m[] = {
-	{PROTO_NONE, "PROTO_NONE"},
-	{PROTO_IKE, "IKE"},
-	{PROTO_AH, "AH"},
-	{PROTO_ESP, "ESP"},
-	{MAPPING_END, NULL}
-};
+ENUM(protocol_id_names, PROTO_NONE, PROTO_ESP,
+	"PROTO_NONE",
+	"IKE",
+	"AH",
+	"ESP",
+);
 
-/** 
- * String mappings for transform_type_t.
- */
-mapping_t transform_type_m[] = {
-	{UNDEFINED_TRANSFORM_TYPE, "UNDEFINED_TRANSFORM_TYPE"},
-	{ENCRYPTION_ALGORITHM, "ENCRYPTION_ALGORITHM"},
-	{PSEUDO_RANDOM_FUNCTION, "PSEUDO_RANDOM_FUNCTION"},
-	{INTEGRITY_ALGORITHM, "INTEGRITY_ALGORITHM"},
-	{DIFFIE_HELLMAN_GROUP, "DIFFIE_HELLMAN_GROUP"},
-	{EXTENDED_SEQUENCE_NUMBERS, "EXTENDED_SEQUENCE_NUMBERS"},
-	{MAPPING_END, NULL}
-};
+ENUM_BEGIN(transform_type_names, UNDEFINED_TRANSFORM_TYPE, UNDEFINED_TRANSFORM_TYPE, 
+	"UNDEFINED_TRANSFORM_TYPE");
+ENUM_NEXT(transform_type_names, ENCRYPTION_ALGORITHM, EXTENDED_SEQUENCE_NUMBERS, UNDEFINED_TRANSFORM_TYPE,
+	"ENCRYPTION_ALGORITHM",
+	"PSEUDO_RANDOM_FUNCTION",
+	"INTEGRITY_ALGORITHM",
+	"DIFFIE_HELLMAN_GROUP",
+	"EXTENDED_SEQUENCE_NUMBERS");
+ENUM_END(transform_type_names, EXTENDED_SEQUENCE_NUMBERS);
 
-/** 
- * String mappings for extended_sequence_numbers_t.
- */
-mapping_t extended_sequence_numbers_m[] = {
-	{NO_EXT_SEQ_NUMBERS, "NO_EXT_SEQ_NUMBERS"},
-	{EXT_SEQ_NUMBERS, "EXT_SEQ_NUMBERS"},
-	{MAPPING_END, NULL}
-};
+ENUM(extended_sequence_numbers_names, NO_EXT_SEQ_NUMBERS, EXT_SEQ_NUMBERS,
+	"NO_EXT_SEQ_NUMBERS",
+	"EXT_SEQ_NUMBERS",
+);
 
 typedef struct private_proposal_t private_proposal_t;
 
@@ -389,7 +377,7 @@ static void clone_algo_list(linked_list_t *list, linked_list_t *clone_list)
 /**
  * Implements proposal_t.clone
  */
-static proposal_t *clone(private_proposal_t *this)
+static proposal_t *clone_(private_proposal_t *this)
 {
 	private_proposal_t *clone = (private_proposal_t*)proposal_create(this->protocol);
 	
@@ -523,7 +511,7 @@ proposal_t *proposal_create(protocol_id_t protocol)
 	this->public.get_protocol = (protocol_id_t(*)(proposal_t*))get_protocol;
 	this->public.set_spi = (void(*)(proposal_t*,u_int64_t))set_spi;
 	this->public.get_spi = (u_int64_t(*)(proposal_t*))get_spi;
-	this->public.clone = (proposal_t*(*)(proposal_t*))clone;
+	this->public.clone = (proposal_t*(*)(proposal_t*))clone_;
 	this->public.destroy = (void(*)(proposal_t*))destroy;
 	
 	this->spi = 0;
diff --git a/src/charon/config/proposal.h b/src/charon/config/proposal.h
index ab58ed3bf..5ce19e9da 100644
--- a/src/charon/config/proposal.h
+++ b/src/charon/config/proposal.h
@@ -47,12 +47,12 @@ enum protocol_id_t {
 	PROTO_ESP = 3,
 };
 
-/** 
- * String mappings for protocol_id_t.
- * 
+/**
+ * enum names for protocol_id_t
+ *
  * @ingroup config
  */
-extern mapping_t protocol_id_m[];
+extern enum_name_t *protocol_id_names;
 
 
 typedef enum transform_type_t transform_type_t;
@@ -60,7 +60,7 @@ typedef enum transform_type_t transform_type_t;
 /**
  * Type of a transform, as in IKEv2 RFC 3.3.2.
  * 
- * @ingroup payloads
+ * @ingroup config
  */
 enum transform_type_t {
 	UNDEFINED_TRANSFORM_TYPE = 241,
@@ -71,12 +71,12 @@ enum transform_type_t {
 	EXTENDED_SEQUENCE_NUMBERS = 5
 };
 
-/** 
- * String mappings for transform_type_t.
- * 
- * @ingroup payloads
+/**
+ * enum names for transform_type_t.
+ *
+ * @ingroup config
  */
-extern mapping_t transform_type_m[];
+extern enum_name_t *transform_type_names;
 
 
 typedef enum extended_sequence_numbers_t extended_sequence_numbers_t;
@@ -84,19 +84,19 @@ typedef enum extended_sequence_numbers_t extended_sequence_numbers_t;
 /** 
  * Extended sequence numbers, as in IKEv2 RFC 3.3.2.
  * 
- * @ingroup payloads
+ * @ingroup config
  */
 enum extended_sequence_numbers_t {
 	NO_EXT_SEQ_NUMBERS = 0,
 	EXT_SEQ_NUMBERS = 1
 };
 
-/** 
- * String mappings for extended_sequence_numbers_t.
- * 
- * @ingroup payloads
+/**
+ * enum strings for extended_sequence_numbers_t.
+ *
+ * @ingroup config
  */
-extern mapping_t extended_sequence_numbers_m[];
+extern enum_name_t *extended_sequence_numbers_names;
 
 
 typedef struct algorithm_t algorithm_t;
diff --git a/src/charon/config/traffic_selector.c b/src/charon/config/traffic_selector.c
index ba6803156..0181dc038 100644
--- a/src/charon/config/traffic_selector.c
+++ b/src/charon/config/traffic_selector.c
@@ -25,12 +25,18 @@
 #include <string.h>
 #include <netdb.h>
 #include <stdio.h>
+#include <printf.h>
 
 #include "traffic_selector.h"
 
 #include <utils/linked_list.h>
 #include <utils/identification.h>
 
+ENUM(ts_type_name, TS_IPV4_ADDR_RANGE, TS_IPV6_ADDR_RANGE,
+	"TS_IPV4_ADDR_RANGE",
+	"TS_IPV6_ADDR_RANGE",
+);
+
 typedef struct private_traffic_selector_t private_traffic_selector_t;
 
 /**
@@ -86,11 +92,6 @@ struct private_traffic_selector_t {
 	 * end of port range 
 	 */
 	u_int16_t to_port;
-	
-	/**
-	 * string representation of this traffic selector
-	 */
-	char *string;
 };
 
 /**
@@ -146,50 +147,43 @@ static u_int8_t calc_netbits(private_traffic_selector_t *this)
 	return (size * 8);
 }
 
-
 /**
  * internal generic constructor
  */
 static private_traffic_selector_t *traffic_selector_create(u_int8_t protocol, ts_type_t type, u_int16_t from_port, u_int16_t to_port);
 
 /**
- * update the string representation of this traffic selector
+ * output handler in printf()
  */
-static void update_string(private_traffic_selector_t *this)
+static int print(FILE *stream, const struct printf_info *info,
+				 const void *const *args)
 {
-	char buf[256];
+	private_traffic_selector_t *this = *((private_traffic_selector_t**)(args[0]));
+	char addr_str[INET6_ADDRSTRLEN] = "";
+	u_int8_t mask;
 	struct protoent *proto;
 	struct servent *serv;
 	char *serv_proto = NULL;
-	char proto_str[8] = "";
-	char addr_str[INET6_ADDRSTRLEN];
-	char port_str[16] = "";
-	char mask_str[8] = "";
-	char proto_port_str[32] = "";
-	bool has_proto = FALSE, has_port = FALSE;
+	bool has_proto = FALSE;
+	size_t written, total_written = 0;
+#define fprintf_sum(...) { written = fprintf(__VA_ARGS__); if (written < 0) return written; total_written += written; }
+	
+	if (this == NULL)
+	{
+		return fprintf(stream, "(null)");
+	}
 	
 	if (this->type == TS_IPV4_ADDR_RANGE)
 	{
-		u_int8_t mask;
-		
-		/* build address string */
 		inet_ntop(AF_INET, &this->from4, addr_str, sizeof(addr_str));
-		
-		/* build network mask string */
-		mask = calc_netbits(this);
-		snprintf(mask_str, sizeof(mask_str), "/%d", mask);
 	}
 	else
 	{
-		u_int8_t mask;
-		
-		/* build address string */
 		inet_ntop(AF_INET6, &this->from6, addr_str, sizeof(addr_str));
-		
-		/* build network mask string */
-		mask = calc_netbits(this);
-		snprintf(mask_str, sizeof(mask_str), "/%d", mask);
 	}
+	mask = calc_netbits(this);
+	
+	fprintf_sum(stream, "%s/%d", addr_str, mask);
 	
 	/* build protocol string */
 	if (this->protocol)
@@ -197,12 +191,12 @@ static void update_string(private_traffic_selector_t *this)
 		proto = getprotobynumber(this->protocol);
 		if (proto)
 		{
-			snprintf(proto_str, sizeof(proto_str), "%s", proto->p_name);
+			fprintf_sum(stream, "[%s", proto->p_name);
 			serv_proto = proto->p_name;
 		}
 		else
 		{
-			snprintf(proto_str, sizeof(proto_str), "%d", this->protocol);
+			fprintf_sum(stream, "[%d", this->protocol);
 		}
 		has_proto = TRUE;
 	}
@@ -210,55 +204,58 @@ static void update_string(private_traffic_selector_t *this)
 	/* build port string */
 	if (this->from_port == this->to_port)
 	{
+		if (has_proto)
+		{
+			fprintf_sum(stream, "/");
+		}
+		else
+		{
+			fprintf_sum(stream, "[");
+		}
 		serv = getservbyport(htons(this->from_port), serv_proto);
 		if (serv)
 		{
-			snprintf(port_str, sizeof(port_str), "%s", serv->s_name);
+			fprintf_sum(stream, "%s]", serv->s_name);
 		}
 		else
 		{
-			snprintf(port_str, sizeof(port_str), "%d", this->from_port);
+			fprintf_sum(stream, "%d]", this->from_port);
 		}
-		has_port = TRUE;
 	}
 	else if (!(this->from_port == 0 && this->to_port == 0xFFFF))
 	{
-		snprintf(port_str, sizeof(port_str), "%d-%d",
-				 this->from_port, this->to_port);
-		has_port = TRUE;
-	}
-	
-	/* concatenate port & proto string */
-	if (has_proto && has_port)
-	{
-		snprintf(proto_port_str, sizeof(proto_port_str), "[%s/%s]", 
-				 proto_str, port_str);
-	}
-	else if (has_proto)
-	{
-		snprintf(proto_port_str, sizeof(proto_port_str), "[%s]", proto_str);
-	}
-	else if (has_port)
-	{
-		snprintf(proto_port_str, sizeof(proto_port_str), "[%s]", port_str);
+		if (has_proto)
+		{
+			fprintf_sum(stream, "/");
+		}
+		else
+		{
+			fprintf_sum(stream, "[");
+		}
+		fprintf_sum(stream, "%d-%d]", this->from_port, this->to_port);
 	}
 	
-	/* concatenate it all */
-	snprintf(buf, sizeof(buf), "%s%s%s", addr_str, mask_str, proto_port_str);
+	return total_written;
+}
 
-	if (this->string)
+/**
+ * arginfo handler in printf()
+ */
+static int print_arginfo(const struct printf_info *info, size_t n, int *argtypes)
+{
+	if (n > 0)
 	{
-		free(this->string);
+		argtypes[0] = PA_POINTER;
 	}
-	this->string = strdup(buf);
+	return 1;
 }
 
 /**
- * implements traffic_selector_t.get_string
+ * register printf() handlers
  */
-static char *get_string(private_traffic_selector_t *this)
+static void __attribute__ ((constructor))print_register()
 {
-	return this->string;
+	register_printf_function(TRAFFIC_SELECTOR_PRINTF_SPEC, print, print_arginfo);
 }
 
 /**
@@ -326,7 +323,6 @@ static traffic_selector_t *get_subset(private_traffic_selector_t *this, private_
 		new_ts->type = this->type;
 		memcpy(new_ts->from, from, size);
 		memcpy(new_ts->to, to, size);
-		update_string(new_ts);
 		
 		return &new_ts->public;
 	}
@@ -455,22 +451,42 @@ static u_int8_t get_protocol(private_traffic_selector_t *this)
 }
 
 /**
+ * Implements traffic_selector_t.is_host.
+ */
+static bool is_host(private_traffic_selector_t *this, host_t *host)
+{
+	chunk_t addr;
+	int family = host->get_family(host);
+	
+	if ((family == AF_INET && this->type == TS_IPV4_ADDR_RANGE) ||
+		(family == AF_INET6 && this->type == TS_IPV6_ADDR_RANGE))
+	{
+		addr = host->get_address(host);
+		if (memeq(addr.ptr, this->from, addr.len) &&
+			memeq(addr.ptr, this->to, addr.len))
+		{
+			return TRUE;
+		}
+	}
+	return FALSE;
+}
+
+/**
  * Implements traffic_selector_t.update_address_range.
  */
 static void update_address_range(private_traffic_selector_t *this, host_t *host)
 {
 	if ((this->type == TS_IPV4_ADDR_RANGE && this->from4[0] == 0) ||
-		(this->type == TS_IPV6_ADDR_RANGE && this->from6[0] == 0 &&
-		 this->from6[1] == 0 && this->from6[2] == 0 && this->from6[3] == 0))
+			(this->type == TS_IPV6_ADDR_RANGE && this->from6[0] == 0 &&
+			this->from6[1] == 0 && this->from6[2] == 0 && this->from6[3] == 0))
 	{
 		this->type = host->get_family(host) == AF_INET ?
-						TS_IPV4_ADDR_RANGE : TS_IPV6_ADDR_RANGE;
+				TS_IPV4_ADDR_RANGE : TS_IPV6_ADDR_RANGE;
 		
 		chunk_t from = host->get_address(host);
 		memcpy(this->from, from.ptr, from.len);
 		memcpy(this->to, from.ptr, from.len);
 	}
-	update_string(this);
 }
 
 /**
@@ -488,14 +504,12 @@ static traffic_selector_t *clone_(private_traffic_selector_t *this)
 		{
 			memcpy(clone->from4, this->from4, sizeof(this->from4));
 			memcpy(clone->to4, this->to4, sizeof(this->to4));
-			update_string(clone);
 			return &clone->public;
 		}
 		case TS_IPV6_ADDR_RANGE:
 		{
 			memcpy(clone->from6, this->from6, sizeof(this->from6));
 			memcpy(clone->to6, this->to6, sizeof(this->to6));
-			update_string(clone);
 			return &clone->public;
 		}
 		default:
@@ -511,7 +525,6 @@ static traffic_selector_t *clone_(private_traffic_selector_t *this)
  */
 static void destroy(private_traffic_selector_t *this)
 {
-	free(this->string);
 	free(this);
 }
 
@@ -552,9 +565,6 @@ traffic_selector_t *traffic_selector_create_from_bytes(u_int8_t protocol, ts_typ
 			return NULL;	
 		}
 	}
-	
-	update_string(this);
-	
 	return (&this->public);
 }
 
@@ -618,9 +628,6 @@ traffic_selector_t *traffic_selector_create_from_subnet(host_t *net, u_int8_t ne
 		this->from_port = port;
 		this->to_port = port;
 	}
-	
-	update_string(this);
-	
 	return (&this->public);
 }
 
@@ -667,9 +674,6 @@ traffic_selector_t *traffic_selector_create_from_string(u_int8_t protocol, ts_ty
 			break;
 		}
 	}
-	
-	update_string(this);
-	
 	return (&this->public);
 }
 
@@ -683,13 +687,13 @@ static private_traffic_selector_t *traffic_selector_create(u_int8_t protocol, ts
 	/* public functions */
 	this->public.get_subset = (traffic_selector_t*(*)(traffic_selector_t*,traffic_selector_t*))get_subset;
 	this->public.equals = (bool(*)(traffic_selector_t*,traffic_selector_t*))equals;
-	this->public.get_string = (char*(*)(traffic_selector_t*))get_string;
 	this->public.get_from_address = (chunk_t(*)(traffic_selector_t*))get_from_address;
 	this->public.get_to_address = (chunk_t(*)(traffic_selector_t*))get_to_address;
 	this->public.get_from_port = (u_int16_t(*)(traffic_selector_t*))get_from_port;
 	this->public.get_to_port = (u_int16_t(*)(traffic_selector_t*))get_to_port;	
-	this->public.get_type = (ts_type_t(*)(traffic_selector_t*))get_type;	
+	this->public.get_type = (ts_type_t(*)(traffic_selector_t*))get_type;
 	this->public.get_protocol = (u_int8_t(*)(traffic_selector_t*))get_protocol;
+	this->public.is_host = (bool(*)(traffic_selector_t*,host_t*))is_host;
 	this->public.update_address_range = (void(*)(traffic_selector_t*,host_t*))update_address_range;
 	this->public.clone = (traffic_selector_t*(*)(traffic_selector_t*))clone_;
 	this->public.destroy = (void(*)(traffic_selector_t*))destroy;
@@ -698,7 +702,6 @@ static private_traffic_selector_t *traffic_selector_create(u_int8_t protocol, ts
 	this->to_port = to_port;
 	this->protocol = protocol;
 	this->type = type;
-	this->string = NULL;
 	
 	return this;
 }
diff --git a/src/charon/config/traffic_selector.h b/src/charon/config/traffic_selector.h
index 90437f92f..ef1b83275 100644
--- a/src/charon/config/traffic_selector.h
+++ b/src/charon/config/traffic_selector.h
@@ -27,6 +27,11 @@
 #include <types.h>
 #include <utils/host.h>
 
+/**
+ * printf() specifier for tRaffic selectors
+ */
+#define TRAFFIC_SELECTOR_PRINTF_SPEC 'R'
+
 typedef enum ts_type_t ts_type_t;
 
 /**
@@ -56,9 +61,9 @@ enum ts_type_t {
 };
 
 /**
- * string mappings for ts_type_t
+ * enum names for ts_type_t
  */
-extern mapping_t ts_type_m[];
+extern enum_name_t *ts_type_name;
 
 
 typedef struct traffic_selector_t traffic_selector_t;
@@ -161,6 +166,18 @@ struct traffic_selector_t {
 	u_int8_t (*get_protocol) (traffic_selector_t *this);
 	
 	/**
+	 * @brief Check if the traffic selector is for a single host.
+	 *
+	 * Traffic selector may describe the end of *-to-host tunnel. In this
+	 * case, the address range is a single address equal to the hosts
+	 * peer address.
+	 *
+	 * @param this		calling obect
+	 * @param host		host_t specifying the address range
+	 */
+	bool (*is_host) (traffic_selector_t *this, host_t* host);
+	
+	/**
 	 * @brief Update the address of a traffic selector.
 	 *
 	 * Update the address range of a traffic selector, 
@@ -174,16 +191,6 @@ struct traffic_selector_t {
 	void (*update_address_range) (traffic_selector_t *this, host_t* host);
 	
 	/**
-	 * @brief Get a string representation of the traffic selector.
-	 *
-	 * String points to internal data, do not free/modify.
-	 * 
-	 * @param this		calling object
-	 * @return 			pointer to a string.
-	 */
-	char* (*get_string) (traffic_selector_t *this);
-	
-	/**
 	 * @brief Compare two traffic selectors for equality.
 	 * 
 	 * @param this		first to compare
diff --git a/src/charon/daemon.c b/src/charon/daemon.c
index fee85dd05..602259b31 100644
--- a/src/charon/daemon.c
+++ b/src/charon/daemon.c
@@ -21,7 +21,7 @@
  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * for more details.
  */
- 
+
 #include <stdio.h>
 #include <signal.h>
 #include <pthread.h>
@@ -34,7 +34,7 @@
 #include <getopt.h>
 #include <errno.h>
 
-#include "daemon.h" 
+#include "daemon.h"
 
 #include <types.h>
 #include <config/credentials/local_credential_store.h>
@@ -54,11 +54,6 @@ struct private_daemon_t {
 	daemon_t public;
 	
 	/**
-	 * A logger_t object assigned for daemon things.
-	 */
-	logger_t *logger;
-
-	/**
 	 * Signal set used for signal handling.
 	 */
 	sigset_t signal_set;
@@ -75,6 +70,37 @@ struct private_daemon_t {
 daemon_t *charon;
 
 /**
+ * hook in library for debugging messages
+ */
+extern void (*dbg) (int level, char *fmt, ...);
+
+/**
+ * Logging hook for library logs, spreads debug message over bus
+ */
+static void dbg_bus(int level, char *fmt, ...)
+{
+	va_list args;
+	
+	va_start(args, fmt);
+	charon->bus->vsignal(charon->bus, SIG_DBG_LIB, level, fmt, args);
+	va_end(args);
+}
+
+/**
+ * Logging hook for library logs, using stderr output
+ */
+static void dbg_stderr(int level, char *fmt, ...)
+{
+	va_list args;
+	
+	va_start(args, fmt);
+	fprintf(stderr, "00[LIB] ");
+	vfprintf(stderr, fmt, args);
+	fprintf(stderr, "\n");
+	va_end(args);
+}
+
+/**
  * Run the daemon and handle unix signals
  */
 static void run(private_daemon_t *this)
@@ -94,27 +120,27 @@ static void run(private_daemon_t *this)
 		error = sigwait(&(this->signal_set), &signal_number);
 		if(error)
 		{
-			this->logger->log(this->logger, ERROR, "Error %d when waiting for signal", error);
+			DBG1(SIG_DBG_DMN, "error %d while waiting for a signal", error);
 			return;
 		}
 		switch (signal_number)
 		{
 			case SIGHUP:
 			{
-				this->logger->log(this->logger, CONTROL, "Signal of type SIGHUP received. Do nothing");
+				DBG1(SIG_DBG_DMN, "signal of type SIGHUP received. Ignored");
 				break;
 			}
 			case SIGINT:
 			{
-				this->logger->log(this->logger, CONTROL, "Signal of type SIGINT received. Exit main loop");
+				DBG1(SIG_DBG_DMN, "signal of type SIGINT received. Shutting down");
 				return;
 			}
 			case SIGTERM:
-				this->logger->log(this->logger, CONTROL, "Signal of type SIGTERM received. Exit main loop");
+				DBG1(SIG_DBG_DMN, "signal of type SIGTERM received. Shutting down");
 				return;
 			default:
 			{
-				this->logger->log(this->logger, CONTROL, "Unknown signal %d received. Do nothing", signal_number);
+				DBG1(SIG_DBG_DMN, "unknown signal %d received. Ignored", signal_number);
 				break;
 			}
 		}
@@ -144,20 +170,24 @@ static void destroy(private_daemon_t *this)
 	/* all child SAs should be down now, so kill kernel interface */
 	DESTROY_IF(this->public.kernel_interface);
 	/* destroy other infrastructure */
-	DESTROY_IF(this->public.bus);
-	DESTROY_IF(this->public.outlog);
-	DESTROY_IF(this->public.syslog);
 	DESTROY_IF(this->public.job_queue);
 	DESTROY_IF(this->public.event_queue);
 	DESTROY_IF(this->public.configuration);
 	DESTROY_IF(this->public.credentials);
 	DESTROY_IF(this->public.connections);
 	DESTROY_IF(this->public.policies);
+	sched_yield();
 	/* we hope the sender could send the outstanding deletes, but 
-	* we shut down here at any cost */
+	 * we shut down here at any cost */
 	DESTROY_IF(this->public.sender);
 	DESTROY_IF(this->public.send_queue);
 	DESTROY_IF(this->public.socket);
+	/* before destroying bus with its listeners, rehook library logs */
+	dbg = dbg_stderr;
+	DESTROY_IF(this->public.bus);
+	DESTROY_IF(this->public.outlog);
+	DESTROY_IF(this->public.syslog);
+	DESTROY_IF(this->public.authlog);
 	free(this);
 }
 
@@ -167,7 +197,7 @@ static void destroy(private_daemon_t *this)
 static void kill_daemon(private_daemon_t *this, char *reason)
 {
 	/* we send SIGTERM, so the daemon can cleanly shut down */
-	this->logger->log(this->logger, CONTROL, "Killing daemon: %s", reason);
+	DBG1(SIG_DBG_DMN, "killing daemon: %s", reason);
 	if (this->main_thread_id == pthread_self())
 	{
 		/* initialization failed, terminate daemon */
@@ -177,7 +207,7 @@ static void kill_daemon(private_daemon_t *this, char *reason)
 	}
 	else
 	{
-		this->logger->log(this->logger, CONTROL, "sending SIGTERM to ourself", reason);
+		DBG1(SIG_DBG_DMN, "sending SIGTERM to ourself");
 		raise(SIGTERM);
 		/* thread must die, since he produced a ciritcal failure and can't continue */
 		pthread_exit(NULL);
@@ -187,24 +217,50 @@ static void kill_daemon(private_daemon_t *this, char *reason)
 /**
  * Initialize the daemon, optional with a strict crl policy
  */
-static void initialize(private_daemon_t *this, bool strict)
+static void initialize(private_daemon_t *this, bool strict, bool syslog,
+					   level_t levels[])
 {
 	credential_store_t* credentials;
+	signal_t signal;
 	
 	/* for uncritical pseudo random numbers */
 	srandom(time(NULL) + getpid());
 	
+	/* setup bus and it's listeners first to enable log output */
+	this->public.bus = bus_create();
+	this->public.outlog = file_logger_create(stdout);
+	this->public.syslog = sys_logger_create(LOG_DAEMON);
+	this->public.authlog = sys_logger_create(LOG_AUTHPRIV);
+	this->public.bus->add_listener(this->public.bus, &this->public.syslog->listener);
+	this->public.bus->add_listener(this->public.bus, &this->public.outlog->listener);
+	this->public.bus->add_listener(this->public.bus, &this->public.authlog->listener);
+	this->public.authlog->set_level(this->public.authlog, SIG_ANY, LEVEL_AUDIT);
+	/* set up hook to log dbg message in library via charons message bus */
+	dbg = dbg_bus;
+	
+	/* apply loglevels */
+	for (signal = 0; signal < SIG_DBG_MAX; signal++)
+	{
+		if (syslog)
+		{
+			this->public.syslog->set_level(this->public.syslog,
+										   signal, levels[signal]);
+		}
+		else
+		{
+			this->public.outlog->set_level(this->public.outlog,
+										   signal, levels[signal]);
+		}
+	}
+	
+	DBG1(SIG_DBG_DMN, "starting charon (strongSwan Version %s)", VERSION);
+	
 	this->public.configuration = configuration_create();
 	this->public.socket = socket_create(IKEV2_UDP_PORT, IKEV2_NATT_PORT);
 	this->public.ike_sa_manager = ike_sa_manager_create();
 	this->public.job_queue = job_queue_create();
 	this->public.event_queue = event_queue_create();
 	this->public.send_queue = send_queue_create();
-	this->public.bus = bus_create();
-	this->public.outlog = file_logger_create(stdout);
-	this->public.bus->add_listener(this->public.bus, &this->public.outlog->listener);
-	this->public.syslog = sys_logger_create(LOG_DAEMON);
-	this->public.bus->add_listener(this->public.bus, &this->public.syslog->listener);
 	this->public.connections = (connection_store_t*)local_connection_store_create();
 	this->public.policies = (policy_store_t*)local_policy_store_create();
 	this->public.credentials = (credential_store_t*)local_credential_store_create(strict);
@@ -233,23 +289,19 @@ void signal_handler(int signal)
 	size_t size;
 	char **strings;
 	size_t i;
-	logger_t *logger;
 
 	size = backtrace(array, 20);
 	strings = backtrace_symbols(array, size);
-	logger = logger_manager->get_logger(logger_manager, DAEMON);
 
-	logger->log(logger, ERROR, 
-				"Thread %u received %s. Dumping %d frames from stack:",
-				signal == SIGSEGV ? "SIGSEGV" : "SIGILL",
-				pthread_self(), size);
+	DBG1(SIG_DBG_DMN, "thread %u received %s. Dumping %d frames from stack:",
+		 signal == SIGSEGV ? "SIGSEGV" : "SIGILL", pthread_self(), size);
 
 	for (i = 0; i < size; i++)
 	{
-		logger->log(logger, ERROR, "    %s", strings[i]);
+		DBG1(SIG_DBG_DMN, "    %s", strings[i]);
 	}
 	free (strings);
-	logger->log(logger, ERROR, "Killing ourself hard after SIGSEGV");
+	DBG1(SIG_DBG_DMN, "killing ourself hard after SIGSEGV");
 	raise(SIGKILL);
 }
 
@@ -283,6 +335,7 @@ private_daemon_t *daemon_create(void)
 	this->public.bus = NULL;
 	this->public.outlog = NULL;
 	this->public.syslog = NULL;
+	this->public.authlog = NULL;
 	
 	this->main_thread_id = pthread_self();
 	
@@ -298,14 +351,8 @@ private_daemon_t *daemon_create(void)
 	action.sa_handler = signal_handler;
 	action.sa_mask = this->signal_set;
 	action.sa_flags = 0;
-	if (sigaction(SIGSEGV, &action, NULL) == -1)
-	{
-		this->logger->log(this->logger, ERROR, "signal handler setup for SIGSEGV failed");
-	}
-	if (sigaction(SIGILL, &action, NULL) == -1)
-	{
-		this->logger->log(this->logger, ERROR, "signal handler setup for SIGILL failed");
-	}
+	sigaction(SIGSEGV, &action, NULL);
+	sigaction(SIGILL, &action, NULL);
 	return this;
 }
 
@@ -315,64 +362,90 @@ private_daemon_t *daemon_create(void)
 static void usage(const char *msg)
 {
 	if (msg != NULL && *msg != '\0')
+	{
 		fprintf(stderr, "%s\n", msg);
-    fprintf(stderr, "Usage: charon"
-		" [--help]"
-		" [--version]"
-		" [--use-syslog]"
-		" [--strictcrlpolicy]"
-		"\n"
-	);
-    exit(msg == NULL? 0 : 1);
+	}
+	fprintf(stderr, "Usage: charon\n"
+					"         [--help]\n"
+					"         [--version]\n"
+					"         [--strictcrlpolicy]\n"
+					"         [--use-syslog]\n"
+					"         [--debug-<type> <level>]\n"
+					"           <type>:  log context type (dmn|mgr|ike|chd|job|cfg|knl|net|enc|lib)\n"
+					"           <level>: log verbosity (-1 = silent, 0 = audit, 1 = control,\n"
+					"                                    2 = controlmore, 3 = raw, 4 = private)\n"
+					"\n"
+		   );
+	exit(msg == NULL? 0 : 1);
 }
 
-
 /**
  * Main function, manages the daemon.
  */
 int main(int argc, char *argv[])
-{	
+{
 	bool strict_crl_policy = FALSE;
+	bool use_syslog = FALSE;
 
 	private_daemon_t *private_charon;
 	FILE *pid_file;
 	struct stat stb;
 	linked_list_t *list;
 	host_t *host;
+	level_t levels[SIG_DBG_MAX];
+	int signal;
+	
+	/* use CTRL loglevel for default */
+	for (signal = 0; signal < SIG_DBG_MAX; signal++)
+	{
+		levels[signal] = LEVEL_CTRL;
+	}
 	
-    /* handle arguments */
-    for (;;)
-    {
-		static const struct option long_opts[] = {
+	/* handle arguments */
+	for (;;)
+	{
+		struct option long_opts[] = {
 			{ "help", no_argument, NULL, 'h' },
 			{ "version", no_argument, NULL, 'v' },
 			{ "use-syslog", no_argument, NULL, 'l' },
 			{ "strictcrlpolicy", no_argument, NULL, 'r' },
+			{ "debug-dmn", required_argument, &signal, SIG_DBG_DMN },
+			{ "debug-mgr", required_argument, &signal, SIG_DBG_MGR },
+			{ "debug-ike", required_argument, &signal, SIG_DBG_IKE },
+			{ "debug-chd", required_argument, &signal, SIG_DBG_CHD },
+			{ "debug-job", required_argument, &signal, SIG_DBG_JOB },
+			{ "debug-cfg", required_argument, &signal, SIG_DBG_CFG },
+			{ "debug-knl", required_argument, &signal, SIG_DBG_KNL },
+			{ "debug-net", required_argument, &signal, SIG_DBG_NET },
+			{ "debug-enc", required_argument, &signal, SIG_DBG_ENC },
+			{ "debug-lib", required_argument, &signal, SIG_DBG_LIB },
 			{ 0,0,0,0 }
 		};
-
+		
 		int c = getopt_long(argc, argv, "", long_opts, NULL);
-
-		/* Note: "breaking" from case terminates loop */
 		switch (c)
 		{
-			case EOF:	/* end of flags */
+			case EOF:
 	    		break;
 			case 'h':
 				usage(NULL);
-				break;	/* not actually reached */
+				break;
 			case 'v':
 				printf("Linux strongSwan %s\n", VERSION);
 				exit(0);
 			case 'l':
-				logger_manager->set_output(logger_manager, ALL_LOGGERS, NULL);
+				use_syslog = TRUE;
 				continue;
 			case 'r':
 				strict_crl_policy = TRUE;
 				continue;
+			case 0:
+				/* option is in signal */
+				levels[signal] = atoi(optarg);
+				continue;
 			default:
 				usage("");
-				break;	/* not actually reached */
+				break;
 		}
 		break;
 	}
@@ -380,19 +453,13 @@ int main(int argc, char *argv[])
 	private_charon = daemon_create();
 	charon = (daemon_t*)private_charon;
 	
-	private_charon->logger = logger_manager->get_logger(logger_manager, DAEMON);
-
-	private_charon->logger->log(private_charon->logger, CONTROL, 
-								"Starting Charon (strongSwan Version %s)", VERSION);
-		
 	/* initialize daemon */
-	initialize(private_charon, strict_crl_policy);
+	initialize(private_charon, strict_crl_policy, use_syslog, levels);
 	
 	/* check/setup PID file */
 	if (stat(PID_FILE, &stb) == 0)
 	{
-		private_charon->logger->log(private_charon->logger, ERROR, 
-									"charon already running (\""PID_FILE"\" exists)");
+		DBG1(SIG_DBG_DMN, "charon already running (\""PID_FILE"\" exists)");
 		destroy(private_charon);
 		exit(-1);
 	}
@@ -404,13 +471,10 @@ int main(int argc, char *argv[])
 	}
 	/* log socket info */
 	list = charon->socket->create_local_address_list(charon->socket);
-	private_charon->logger->log(private_charon->logger, CONTROL,
-								"listening on %d addresses:",
-								list->get_count(list));
+	DBG1(SIG_DBG_NET, "listening on %d addresses:", list->get_count(list));
 	while (list->remove_first(list, (void**)&host) == SUCCESS)
 	{
-		private_charon->logger->log(private_charon->logger, CONTROL,
-									"  %H", host);
+		DBG1(SIG_DBG_NET, "  %H", host);
 		host->destroy(host);
 	}
 	list->destroy(list);
@@ -421,6 +485,6 @@ int main(int argc, char *argv[])
 	/* normal termination, cleanup and exit */
 	destroy(private_charon);
 	unlink(PID_FILE);
-
+	
 	return 0;
 }
diff --git a/src/charon/daemon.h b/src/charon/daemon.h
index c54837273..295f21061 100644
--- a/src/charon/daemon.h
+++ b/src/charon/daemon.h
@@ -1,8 +1,8 @@
 /**
  * @file daemon.h
- * 
+ *
  * @brief Interface of daemon_t.
- * 
+ *
  */
 
 /*
@@ -39,7 +39,6 @@
 #include <queues/send_queue.h>
 #include <queues/job_queue.h>
 #include <queues/event_queue.h>
-#include <utils/logger_manager.h>
 #include <config/configuration.h>
 #include <config/connections/connection_store.h>
 #include <config/policies/policy_store.h>
@@ -363,6 +362,11 @@ struct daemon_t {
 	sys_logger_t *syslog;
 	
 	/**
+	 * A bus listener logging most important events
+	 */
+	sys_logger_t *authlog;
+	
+	/**
 	 * Kernel Interface to communicate with kernel
 	 */
 	kernel_interface_t *kernel_interface;
diff --git a/src/charon/encoding/generator.c b/src/charon/encoding/generator.c
index 34e87fadb..392a4602d 100644
--- a/src/charon/encoding/generator.c
+++ b/src/charon/encoding/generator.c
@@ -32,7 +32,6 @@
 #include <types.h>
 #include <daemon.h>
 #include <utils/linked_list.h>
-#include <utils/logger_manager.h>
 #include <encoding/payloads/payload.h>
 #include <encoding/payloads/proposal_substructure.h>
 #include <encoding/payloads/transform_substructure.h>
@@ -222,24 +221,19 @@ struct private_generator_t {
 	 */
 	u_int8_t last_spi_size;
 	
-	/*
+	/**
 	 * Attribute format of the last generated transform attribute.
-	 * 
+	 *
 	 * Used to check if a variable value field is used or not for 
 	 * the transform attribute value.
 	 */
 	bool attribute_format;
 	
-	/*
+	/**
 	 * Depending on the value of attribute_format this field is used
 	 * to hold the length of the transform attribute in bytes.
 	 */
 	u_int16_t attribute_length;
-	
-	/**
-	 * Associated Logger.
-	 */
-	logger_t *logger;
 };
 
 /**
@@ -312,16 +306,16 @@ static void generate_u_int_type (private_generator_t *this,encoding_type_t int_t
 				break;
 
 			default:
-			this->logger->log(this->logger, ERROR, "U_INT Type %s is not supported", 
-							mapping_find(encoding_type_m,int_type));
+			DBG1(SIG_DBG_ENC, "U_INT Type %N is not supported",
+				 encoding_type_names, int_type);
 
 			return;
 	}
 	/* U_INT Types of multiple then 8 bits must be aligned */
 	if (((number_of_bits % 8) == 0) && (this->current_bit != 0))
 	{
-		this->logger->log(this->logger, ERROR, "U_INT Type %s is not 8 Bit aligned", 
-							mapping_find(encoding_type_m,int_type));
+		DBG1(SIG_DBG_ENC, "U_INT Type %N is not 8 Bit aligned",
+			 encoding_type_names, int_type);
 		/* current bit has to be zero for values multiple of 8 bits */
 		return;
 	}
@@ -341,7 +335,7 @@ static void generate_u_int_type (private_generator_t *this,encoding_type_t int_t
 				u_int8_t low_val = *(this->out_position) & 0x0F;
 				/* highval is set, low_val is not changed */
 				*(this->out_position) = high_val | low_val;
-				this->logger->log(this->logger, RAW|LEVEL2, "   => %d", *(this->out_position));
+				DBG3(SIG_DBG_ENC, "   => %d", *(this->out_position));
 				/* write position is not changed, just bit position is moved */
 				this->current_bit = 4;
 			}
@@ -352,14 +346,14 @@ static void generate_u_int_type (private_generator_t *this,encoding_type_t int_t
 				/* lowval of current byte in buffer has to be set to the new value*/
 				u_int low_val = *((u_int8_t *)(this->data_struct + offset)) & 0x0F;
 				*(this->out_position) = high_val | low_val;
-				this->logger->log(this->logger, RAW|LEVEL2, "   => %d", *(this->out_position));
+				DBG3(SIG_DBG_ENC, "   => %d", *(this->out_position));
 				this->out_position++;
 				this->current_bit = 0;
 
 			}
 			else
 			{
-				this->logger->log(this->logger, ERROR, "U_INT_4 Type is not 4 Bit aligned");
+				DBG1(SIG_DBG_ENC, "U_INT_4 Type is not 4 Bit aligned");
 				/* 4 Bit integers must have a 4 bit alignment */
 				return;
 			};
@@ -370,7 +364,7 @@ static void generate_u_int_type (private_generator_t *this,encoding_type_t int_t
 		{
 			/* 8 bit values are written as they are */
 			*this->out_position = *((u_int8_t *)(this->data_struct + offset));
-			this->logger->log(this->logger, RAW|LEVEL2, "   => %d", *(this->out_position));
+			DBG3(SIG_DBG_ENC, "   => %d", *(this->out_position));
 			this->out_position++;
 			break;
 
@@ -380,7 +374,7 @@ static void generate_u_int_type (private_generator_t *this,encoding_type_t int_t
 			/* attribute type must not change first bit uf current byte ! */
 			if (this->current_bit != 1)
 			{
-				this->logger->log(this->logger, ERROR, "ATTRIBUTE FORMAT flag is not set");
+				DBG1(SIG_DBG_ENC, "ATTRIBUTE FORMAT flag is not set");
 				/* first bit has to be set! */
 				return;
 			}
@@ -392,7 +386,7 @@ static void generate_u_int_type (private_generator_t *this,encoding_type_t int_t
 			int16_val = int16_val & 0xFF7F;
 			
 			int16_val = int16_val | attribute_format_flag;
-			this->logger->log(this->logger, RAW|LEVEL2, "   => %d", int16_val);
+			DBG3(SIG_DBG_ENC, "   => %d", int16_val);
 			/* write bytes to buffer (set bit is overwritten)*/				
 			this->write_bytes_to_buffer(this,&int16_val,sizeof(u_int16_t));
 			this->current_bit = 0;
@@ -403,14 +397,14 @@ static void generate_u_int_type (private_generator_t *this,encoding_type_t int_t
 		case CONFIGURATION_ATTRIBUTE_LENGTH:
 		{
 			u_int16_t int16_val = htons(*((u_int16_t*)(this->data_struct + offset)));
-			this->logger->log_bytes(this->logger, RAW|LEVEL2, "   =>", (void*)&int16_val, sizeof(int16_val));
+			DBG3(SIG_DBG_ENC, "   => %b", (void*)&int16_val, sizeof(int16_val));
 			this->write_bytes_to_buffer(this,&int16_val,sizeof(u_int16_t));
 			break;
 		}
 		case U_INT_32:
 		{
 			u_int32_t int32_val = htonl(*((u_int32_t*)(this->data_struct + offset)));
-			this->logger->log_bytes(this->logger, RAW|LEVEL2, "   =>", (void*)&int32_val, sizeof(int32_val));
+			DBG3(SIG_DBG_ENC, "   => %b", (void*)&int32_val, sizeof(int32_val));
 			this->write_bytes_to_buffer(this,&int32_val,sizeof(u_int32_t));
 			break;
 		}
@@ -419,8 +413,9 @@ static void generate_u_int_type (private_generator_t *this,encoding_type_t int_t
 			/* 64 bit integers are written as two 32 bit integers */
 			u_int32_t int32_val_low = htonl(*((u_int32_t*)(this->data_struct + offset)));
 			u_int32_t int32_val_high = htonl(*((u_int32_t*)(this->data_struct + offset) + 1));
-			this->logger->log_bytes(this->logger, RAW|LEVEL2, "   => (low)", (void*)&int32_val_low, sizeof(int32_val_low));
-			this->logger->log_bytes(this->logger, RAW|LEVEL2, "   => (high)", (void*)&int32_val_high, sizeof(int32_val_high));
+			DBG3(SIG_DBG_ENC, "   => %b %b",
+				 (void*)&int32_val_low, sizeof(int32_val_low),
+				 (void*)&int32_val_high, sizeof(int32_val_high));
 			/* TODO add support for big endian machines */
 			this->write_bytes_to_buffer(this,&int32_val_high,sizeof(u_int32_t));
 			this->write_bytes_to_buffer(this,&int32_val_low,sizeof(u_int32_t));
@@ -431,12 +426,13 @@ static void generate_u_int_type (private_generator_t *this,encoding_type_t int_t
 		{
 			/* 64 bit are written as they come :-) */
 			this->write_bytes_to_buffer(this,(this->data_struct + offset),sizeof(u_int64_t));
-			this->logger->log_bytes(this->logger, RAW|LEVEL2, "   =>", (void*)(this->data_struct + offset), sizeof(u_int64_t));
+			DBG3(SIG_DBG_ENC, "   => %b", (void*)(this->data_struct + offset), sizeof(u_int64_t));
 			break;
 		}
 		default:
 		{
-			this->logger->log(this->logger, ERROR, "U_INT Type %s is not supported", mapping_find(encoding_type_m,int_type));
+			DBG1(SIG_DBG_ENC, "U_INT Type %N is not supported",
+				 encoding_type_names, int_type);
 			return;
 		}
 	}
@@ -450,7 +446,7 @@ static void generate_reserved_field(private_generator_t *this,int bits)
 	/* only one bit or 8 bit fields are supported */
 	if ((bits != 1) && (bits != 8))
 	{
-		this->logger->log(this->logger, ERROR, "Reserved field of %d bits cannot be generated", bits);
+		DBG1(SIG_DBG_ENC, "reserved field of %d bits cannot be generated", bits);
 		return ;
 	}
 	/* make sure enough space is available in buffer */
@@ -480,9 +476,8 @@ static void generate_reserved_field(private_generator_t *this,int bits)
 		/* one byte processing*/
 		if (this->current_bit > 0)
 		{
-			this->logger->log(this->logger, ERROR, 
-								"Reserved field cannot be written cause allignement of current bit is %d",
-								this->current_bit);
+			DBG1(SIG_DBG_ENC, "reserved field cannot be written cause "
+				 "alignement of current bit is %d", this->current_bit);
 			return;
 		}
 		*(this->out_position) = 0x00;
@@ -516,7 +511,7 @@ static void generate_flag (private_generator_t *this,u_int32_t offset)
 	*(this->out_position) = *(this->out_position) | flag;
 	
 	
-	this->logger->log(this->logger, RAW|LEVEL2, "   => %d", *(this->out_position));
+	DBG3(SIG_DBG_ENC, "   => %d", *(this->out_position));
 
 	this->current_bit++;
 	if (this->current_bit >= 8)
@@ -533,14 +528,14 @@ static void generate_from_chunk (private_generator_t *this,u_int32_t offset)
 {
 	if (this->current_bit != 0)
 	{
-		this->logger->log(this->logger, ERROR, "can not generate a chunk at Bitpos %d", this->current_bit);
+		DBG1(SIG_DBG_ENC, "can not generate a chunk at Bitpos %d", this->current_bit);
 		return ;
 	}
 	
 	/* position in buffer */
 	chunk_t *attribute_value = (chunk_t *)(this->data_struct + offset);
 	
-	this->logger->log_chunk(this->logger, RAW|LEVEL2, "   =>", *attribute_value);
+	DBG3(SIG_DBG_ENC, "   => %B", attribute_value);
 	
 	/* use write_bytes_to_buffer function to do the job */
 	this->write_bytes_to_buffer(this,attribute_value->ptr,attribute_value->len);
@@ -558,8 +553,8 @@ static void make_space_available (private_generator_t *this, size_t bits)
 		size_t new_buffer_size = old_buffer_size + GENERATOR_DATA_BUFFER_INCREASE_VALUE;
 		size_t out_position_offset = ((this->out_position) - (this->buffer));
 
-		this->logger->log(this->logger, CONTROL|LEVEL3, "increased gen buffer from %d to %d byte", 
-							old_buffer_size, new_buffer_size);
+		DBG2(SIG_DBG_ENC, "increased gen buffer from %d to %d byte", 
+			 old_buffer_size, new_buffer_size);
 		
 		/* Reallocate space for new buffer */
 		this->buffer = realloc(this->buffer,new_buffer_size);
@@ -633,7 +628,7 @@ static void write_to_chunk (private_generator_t *this,chunk_t *data)
 	memcpy(data->ptr,this->buffer,data_length);
 	data->len = data_length;
 	
-	this->logger->log_chunk(this->logger, RAW|LEVEL3, "generated data of this generator", *data);
+	DBG3(SIG_DBG_ENC, "generated data of this generator %B", data);
 }
 
 /**
@@ -655,16 +650,16 @@ static void generate_payload (private_generator_t *this,payload_t *payload)
 	
 	payload_start = this->out_position;
 	
-	this->logger->log(this->logger, CONTROL|LEVEL1, "generating payload of type %s",
-											mapping_find(payload_type_m,payload_type));
+	DBG2(SIG_DBG_ENC, "generating payload of type %N",
+		 payload_type_names, payload_type);
 	
 	/* each payload has its own encoding rules */
 	payload->get_encoding_rules(payload,&rules,&rule_count);
 
 	for (i = 0; i < rule_count;i++)
 	{
-		this->logger->log(this->logger, CONTROL|LEVEL2, "  generating rule %d %s",
-							i, mapping_find(encoding_type_m,rules[i].type));
+		DBG2(SIG_DBG_ENC, "  generating rule %d %N",
+			 i, encoding_type_names, rules[i].type);
 		switch (rules[i].type)
 		{
 			/* all u int values, IKE_SPI,TS_TYPE and ATTRIBUTE_TYPE are generated in generate_u_int_type */
@@ -964,7 +959,7 @@ static void generate_payload (private_generator_t *this,payload_t *payload)
 			{
 				if (this->attribute_format == FALSE)
 				{
-					this->logger->log(this->logger, CONTROL|LEVEL3, "attribute value has not fixed size");
+					DBG2(SIG_DBG_ENC, "attribute value has not fixed size");
 					/* the attribute value is generated */
 					this->generate_from_chunk(this,rules[i].offset);
 				}
@@ -1012,15 +1007,15 @@ static void generate_payload (private_generator_t *this,payload_t *payload)
 				break;
 			}
 			default:
-				this->logger->log(this->logger, ERROR, "field type %s is not supported",
-									mapping_find(encoding_type_m,rules[i].type));
+				DBG1(SIG_DBG_ENC, "field type %N is not supported",
+					 encoding_type_names, rules[i].type);
 				return;
 		}
 	}
-	this->logger->log(this->logger, CONTROL|LEVEL2, "generating %s payload finished.", 
-					  mapping_find(payload_type_m, payload_type));
-	this->logger->log_bytes(this->logger, RAW|LEVEL3, "generated data for this payload",
-							payload_start, this->out_position-payload_start);
+	DBG2(SIG_DBG_ENC, "generating %N payload finished",
+		 payload_type_names, payload_type);
+	DBG3(SIG_DBG_ENC, "generated data for this payload %b",
+		 payload_start, this->out_position-payload_start);
 }
 
 /**
@@ -1072,7 +1067,6 @@ generator_t *generator_create()
 	this->current_bit = 0;
 	this->last_payload_length_position_offset = 0;
 	this->header_length_position_offset = 0;
-	this->logger = logger_manager->get_logger(logger_manager, GENERATOR);
 
 	return &(this->public);
 }
diff --git a/src/charon/encoding/message.c b/src/charon/encoding/message.c
index b4bede333..65e4729b3 100644
--- a/src/charon/encoding/message.c
+++ b/src/charon/encoding/message.c
@@ -24,6 +24,7 @@
 
 #include <stdlib.h>
 #include <string.h>
+#include <printf.h>
 
 #include "message.h"
 
@@ -33,7 +34,6 @@
 #include <encoding/generator.h>
 #include <encoding/parser.h>
 #include <utils/linked_list.h>
-#include <utils/logger_manager.h>
 #include <encoding/payloads/encodings.h>
 #include <encoding/payloads/payload.h>
 #include <encoding/payloads/encryption_payload.h>
@@ -42,7 +42,7 @@
 /**
  * Max number of notify payloads per IKEv2 Message
  */
-#define MAX_NOTIFY_PAYLOADS 10
+#define MAX_NOTIFY_PAYLOADS 20
 
 
 typedef struct payload_rule_t payload_rule_t;
@@ -66,7 +66,7 @@ struct payload_rule_t {
 
 	 /**
 	  * Max occurence of this payload.
-	  */	 
+	  */
 	 size_t max_occurence;
 	 
 	 /**
@@ -295,72 +295,6 @@ struct private_message_t {
 	 * The message rule for this message instance
 	 */
 	message_rule_t *message_rule;
-	
-	/**
-	 * Assigned logger.
-	 */
-	logger_t *logger;
-	
-	/**
-	 * Sets the private message_rule member to the rule which 
-	 * applies to this message. Must be called before get_payload_rule().
-	 * 
-	 * @param this					calling object
-	 * @return
-	 * 								- SUCCESS
-	 *								- NOT_FOUND if no message rule applies to this message.
-	 */
-	status_t (*set_message_rule) (private_message_t *this);
-
-	/**
-	 * Gets the payload_rule_t for a specific message_rule_t and payload type.
-	 * 
-	 * @param this					calling object
-	 * @param payload_type			payload type
-	 * @param[out] payload_rule		returned payload_rule_t
-	 * @return
-	 * 								- SUCCESS
-	 *								- NOT_FOUND if payload not defined in current message rule
-	 * 								- INVALID_STATE if message rule is not set via set_message_rule()
-	 */	
-	status_t (*get_payload_rule) (private_message_t *this, payload_type_t payload_type, payload_rule_t **payload_rule);
-	
-	/**
-	 * Encrypts all payloads which has to get encrypted.
-	 * 
-	 * Can also be called with messages not containing encrypted content.
-	 * 
-	 * @param this			calling object
-	 * @param crypter		crypter_t object
-	 * @param signer		signer_t object
-	 * @return
-	 * 						- SUCCESS
-	 * 						- INVALID_STATE if no crypter/signer supplied but needed
-	 */
-	status_t (*encrypt_payloads) (private_message_t *this,crypter_t *crypter, signer_t* signer);
-	
-	/**
-	 * Decrypts encrypted contents, and checks if a payload is encrypted if it has to be.
-	 * 
-	 * @param this			calling object
-	 * @param crypter		crypter_t object
-	 * @param signer		signer_t object
-	 * @return
-	 * 						- SUCCESS
-	 * 						- FAILED if decryption not successfull
-	 * 						- INVALID_STATE if no crypter/signer supplied but needed
-	 */
-	status_t (*decrypt_payloads) (private_message_t *this,crypter_t *crypter, signer_t* signer);
-	
-	/**
-	 * Verifies the message. Checks for payloads count.
-	 * 
-	 * @param 				calling object
-	 * @return
-	 * 						- SUCCESS if message valid, or
-	 * 						- FAILED if message does not align with message rules.
-	 */
-	status_t (*verify) (private_message_t *this);	
 };
 
 /**
@@ -549,8 +483,8 @@ static void add_payload(private_message_t *this, payload_t *payload)
 	payload->set_next_type(payload, NO_PAYLOAD);
 	this->payloads->insert_last(this->payloads, (void*)payload);
 
-	this->logger->log(this->logger, CONTROL|LEVEL1, "added payload of type %s to message", 
-					  mapping_find(payload_type_m, payload->get_type(payload)));
+	DBG2(SIG_DBG_ENC ,"added payload of type %N to message",
+		 payload_type_names, payload->get_type(payload));
 }
 
 /**
@@ -566,7 +500,6 @@ static void set_source(private_message_t *this, host_t *host)
  */
 static void set_destination(private_message_t *this, host_t *host)
 {
-
 	this->packet->set_destination(this->packet, host);
 }
 
@@ -595,46 +528,159 @@ static iterator_t *get_payload_iterator(private_message_t *this)
 }
 
 /**
- * Build a string containing short names for all payload in this message
+ * output handler in printf()
  */
-static void build_payload_string(private_message_t *this, char* buffer, size_t size)
+static int print(FILE *stream, const struct printf_info *info,
+				 const void *const *args)
 {
+	private_message_t *this = *((private_message_t**)(args[0]));
 	iterator_t *iterator;
 	payload_t *payload;
 	bool first = TRUE;
+	size_t total_written = 0;
+	size_t written;
+	
+	if (this == NULL)
+	{
+		return fprintf(stream, "(null)");
+	}
 	
-	*buffer = '\0';
-	size--;
+	written = fprintf(stream, "%N %s [", 
+					  exchange_type_names, this->exchange_type,
+					  this->is_request ? "request" : "response");
+	if (written < 0)
+	{
+		return written;
+	}
+	total_written += written;
 	
 	iterator = this->payloads->create_iterator(this->payloads, TRUE);
 	while (iterator->iterate(iterator, (void**)&payload))
 	{
-		payload_type_t type = payload->get_type(payload);
-		char *name = mapping_find(payload_type_short_m, type);
-		size_t name_len = strlen(name);
 		if (!first)
 		{
-			strncat(buffer, " ", size);
-			if (size)
+			written = fprintf(stream, " ");
+			if (written < 0)
 			{
-				size--;
+				return written;
 			}
+			total_written += written;
 		}
 		else
 		{
 			first = FALSE;
 		}
-		strncat(buffer, name, size);
-		if (name_len > size)
+		written = fprintf(stream, "%N", payload_type_short_names,
+						  payload->get_type(payload));
+		if (written < 0)
+		{
+			return written;
+		}
+		total_written += written;
+	}
+	iterator->destroy(iterator);
+	written = fprintf(stream, "]");
+	if (written < 0)
+	{
+		return written;
+	}
+	total_written += written;
+	return total_written;
+}
+
+/**
+ * arginfo handler in printf()
+ */
+static int print_arginfo(const struct printf_info *info, size_t n, int *argtypes)
+{
+	if (n > 0)
+	{
+		argtypes[0] = PA_POINTER;
+	}
+	return 1;
+}
+
+/**
+ * register printf() handlers
+ */
+static void __attribute__ ((constructor))print_register()
+{
+	register_printf_function(MESSAGE_PRINTF_SPEC, print, print_arginfo);
+}
+
+/**
+ * Implementation of private_message_t.encrypt_payloads.
+ */
+static status_t encrypt_payloads (private_message_t *this,crypter_t *crypter, signer_t* signer)
+{
+	encryption_payload_t *encryption_payload = NULL;
+	status_t status;
+	linked_list_t *all_payloads;
+	
+	if (!this->message_rule->encrypted_content)
+	{
+		DBG2(SIG_DBG_ENC, "message doesn't have to be encrypted");
+		/* message contains no content to encrypt */
+		return SUCCESS;
+	}
+	
+	DBG2(SIG_DBG_ENC, "copy all payloads to a temporary list");
+	all_payloads = linked_list_create();
+	
+	/* first copy all payloads in a temporary list */
+	while (this->payloads->get_count(this->payloads) > 0)
+	{
+		void *current_payload;
+		this->payloads->remove_first(this->payloads,&current_payload);
+		all_payloads->insert_last(all_payloads,current_payload);
+	}
+	
+	encryption_payload = encryption_payload_create();
+
+	DBG2(SIG_DBG_ENC, "check each payloads if they have to get encrypted");
+	while (all_payloads->get_count(all_payloads) > 0)
+	{
+		payload_rule_t *payload_rule;
+		payload_t *current_payload;
+		bool to_encrypt = FALSE;
+		
+		all_payloads->remove_first(all_payloads,(void **)&current_payload);
+		
+		status = get_payload_rule(this,
+					current_payload->get_type(current_payload),&payload_rule);
+		/* for payload types which are not found in supported payload list, 
+		 * it is presumed that they don't have to be encrypted */
+		if ((status == SUCCESS) && (payload_rule->encrypted))
+		{
+			DBG2(SIG_DBG_ENC, "payload %N gets encrypted",
+				 payload_type_names, current_payload->get_type(current_payload));
+			to_encrypt = TRUE;
+		}
+		
+		if (to_encrypt)
 		{
-			size = 0;
+			DBG2(SIG_DBG_ENC, "insert payload %N to encryption payload",
+				 payload_type_names, current_payload->get_type(current_payload));
+			encryption_payload->add_payload(encryption_payload,current_payload);
 		}
 		else
 		{
-			size -= name_len;
+			DBG2(SIG_DBG_ENC, "insert payload %N unencrypted",
+				 payload_type_names ,current_payload->get_type(current_payload));
+			add_payload(this, (payload_t*)encryption_payload);
 		}
 	}
-	iterator->destroy(iterator);
+
+	status = SUCCESS;
+	DBG2(SIG_DBG_ENC, "encrypting encryption payload");
+	encryption_payload->set_transforms(encryption_payload, crypter,signer);
+	status = encryption_payload->encrypt(encryption_payload);
+	DBG2(SIG_DBG_ENC, "add encrypted payload to payload list");
+	add_payload(this, (payload_t*)encryption_payload);
+	
+	all_payloads->destroy(all_payloads);
+	
+	return status;
 }
 
 /**
@@ -648,7 +694,6 @@ static status_t generate(private_message_t *this, crypter_t *crypter, signer_t*
 	iterator_t *iterator;
 	status_t status;
 	chunk_t packet_data;
-	char payload_names[128];
 	
 	if (is_encoded(this))
 	{
@@ -657,50 +702,41 @@ static status_t generate(private_message_t *this, crypter_t *crypter, signer_t*
 		return SUCCESS;
 	}
 	
-	build_payload_string(this, payload_names, sizeof(payload_names));
-	this->logger->log(this->logger, CONTROL, "generating %s %s (%d) [%s]",
-					  mapping_find(exchange_type_m,this->exchange_type),
-					  this->is_request ? "request" : "response",
-					  this->message_id,
-					  payload_names);
+	DBG1(SIG_DBG_ENC, "generating %M", this);
 	
 	if (this->exchange_type == EXCHANGE_TYPE_UNDEFINED)
 	{
-		this->logger->log(this->logger, ERROR | LEVEL1, "exchange type %s is not defined",
-							mapping_find(exchange_type_m,this->exchange_type));
+		DBG1(SIG_DBG_ENC, "exchange type is not defined");
 		return INVALID_STATE;
 	}
 	
 	if (this->packet->get_source(this->packet) == NULL ||
 		this->packet->get_destination(this->packet) == NULL) 
 	{
-		this->logger->log(this->logger, ERROR|LEVEL1, "%s not defined",
-							!this->packet->get_source(this->packet) ? "source" : "destination");
+		DBG1(SIG_DBG_ENC, "%s not defined",
+			 !this->packet->get_source(this->packet) ? "source" : "destination");
 		return INVALID_STATE;
 	}
 	
 	/* set the rules for this messge */
-	status = this->set_message_rule(this);
+	status = set_message_rule(this);
 	if (status != SUCCESS)
 	{
-		this->logger->log(this->logger, ERROR, "no message rules specified for a %s %s",
-						  mapping_find(exchange_type_m,this->exchange_type),
-						  this->is_request ? "request" : "response");
+		DBG1(SIG_DBG_ENC, "no message rules specified for this message type");
 		return NOT_SUPPORTED;
 	}
 	
-	
 	/* going to encrypt all content which have to be encrypted */
-	status = this->encrypt_payloads(this, crypter, signer);
+	status = encrypt_payloads(this, crypter, signer);
 	if (status != SUCCESS)
 	{
-		this->logger->log(this->logger, ERROR | LEVEL1, "could not encrypt payloads");
+		DBG1(SIG_DBG_ENC, "payload encryption failed");
 		return status;
 	}
-
+	
 	/* build ike header */
 	ike_header = ike_header_create();
-
+	
 	ike_header->set_exchange_type(ike_header, this->exchange_type);
 	ike_header->set_message_id(ike_header, this->message_id);
 	ike_header->set_response_flag(ike_header, !this->is_request);
@@ -738,7 +774,7 @@ static status_t generate(private_message_t *this, crypter_t *crypter, signer_t*
 	/* if last payload is of type encrypted, integrity checksum if necessary */
 	if (payload->get_type(payload) == ENCRYPTED)
 	{
-		this->logger->log(this->logger, CONTROL | LEVEL1, "build signature on whole message");
+		DBG2(SIG_DBG_ENC, "build signature on whole message");
 		encryption_payload_t *encryption_payload = (encryption_payload_t*)payload;
 		status = encryption_payload->build_signature(encryption_payload, packet_data);
 		if (status != SUCCESS)
@@ -752,8 +788,7 @@ static status_t generate(private_message_t *this, crypter_t *crypter, signer_t*
 	/* clone packet for caller */
 	*packet = this->packet->clone(this->packet);
 	
-	this->logger->log(this->logger, CONTROL|LEVEL1, "message of type %s generated successfully",
-						mapping_find(exchange_type_m,this->exchange_type));
+	DBG2(SIG_DBG_ENC, "message generated successfully");
 	return SUCCESS;
 }
 
@@ -781,14 +816,13 @@ static status_t parse_header(private_message_t *this)
 	ike_header_t *ike_header;
 	status_t status;
 	
-	
-	this->logger->log(this->logger, CONTROL|LEVEL1, "parsing Header of message");
+	DBG2(SIG_DBG_ENC, "parsing header of message");
 	
 	this->parser->reset_context(this->parser);
 	status = this->parser->parse_payload(this->parser,HEADER,(payload_t **) &ike_header);
 	if (status != SUCCESS)
 	{
-		this->logger->log(this->logger, ERROR | LEVEL1, "header could not be parsed");
+		DBG1(SIG_DBG_ENC, "header could not be parsed");
 		return status;
 		
 	}
@@ -797,10 +831,10 @@ static status_t parse_header(private_message_t *this)
 	status = ike_header->payload_interface.verify(&(ike_header->payload_interface));
 	if (status != SUCCESS)
 	{
-		this->logger->log(this->logger, ERROR | LEVEL1, "header verification failed");
+		DBG1(SIG_DBG_ENC, "header verification failed");
 		ike_header->destroy(ike_header);
 		return status;
-	}	
+	}
 	
 	if (this->ike_sa_id != NULL)
 	{
@@ -818,190 +852,23 @@ static status_t parse_header(private_message_t *this)
 	this->minor_version = ike_header->get_min_version(ike_header);
 	this->first_payload = ike_header->payload_interface.get_next_type(&(ike_header->payload_interface));
 	
-	this->logger->log(this->logger, CONTROL|LEVEL1, "parsed a %s %s", 
-						mapping_find(exchange_type_m, this->exchange_type),
-						this->is_request ? "request" : "response");
+	DBG2(SIG_DBG_ENC, "parsed a %N %s", exchange_type_names, this->exchange_type,
+		 this->is_request ? "request" : "response");
 	
-	ike_header->destroy(ike_header);					
+	ike_header->destroy(ike_header);
 	
 	/* get the rules for this messge */
-	status = this->set_message_rule(this);
+	status = set_message_rule(this);
 	if (status != SUCCESS)
 	{
-		this->logger->log(this->logger, ERROR, "no message rules specified for a %s %s",
-						  mapping_find(exchange_type_m,this->exchange_type),
-						  this->is_request ? "request" : "response");
+		DBG1(SIG_DBG_ENC, "no message rules specified for a %N %s",
+			 exchange_type_names, this->exchange_type,
+			 this->is_request ? "request" : "response");
 	}
 	
-	return status;	
-}
-
-/**
- * Implementation of message_t.parse_body.
- */
-static status_t parse_body(private_message_t *this, crypter_t *crypter, signer_t *signer)
-{
-	status_t status = SUCCESS;
-	payload_type_t current_payload_type;
-	char payload_names[128];
-		
-	current_payload_type = this->first_payload;	
-		
-	this->logger->log(this->logger, CONTROL|LEVEL1, "parsing body of message, first payload is %s",
-					  mapping_find(payload_type_m, current_payload_type));
-
-	/* parse payload for payload, while there are more available */
-	while ((current_payload_type != NO_PAYLOAD))
-	{
-		payload_t *current_payload;
-		
-		this->logger->log(this->logger, CONTROL|LEVEL2, "start parsing a %s payload", 
-							mapping_find(payload_type_m, current_payload_type));
-		
-		/* parse current payload */
-		status = this->parser->parse_payload(this->parser,current_payload_type,(payload_t **) &current_payload);
-		
-		if (status != SUCCESS)
-		{
-			this->logger->log(this->logger, ERROR, "payload type %s could not be parsed",
-								mapping_find(payload_type_m,current_payload_type));
-			return PARSE_ERROR;
-		}
-
-		this->logger->log(this->logger, CONTROL|LEVEL2, "verify payload of type %s", 
-							mapping_find(payload_type_m, current_payload_type));
-		
-		/* verify it, stop parsig if its invalid */
-		status = current_payload->verify(current_payload);
-		if (status != SUCCESS)
-		{
-			this->logger->log(this->logger, ERROR, "%s payload verification failed",
-								mapping_find(payload_type_m,current_payload_type));
-			current_payload->destroy(current_payload);
-			return VERIFY_ERROR;
-		}
-		
-		this->logger->log(this->logger, CONTROL|LEVEL2, "%s payload verified. Adding to payload list", 
-							mapping_find(payload_type_m, current_payload_type));
-		this->payloads->insert_last(this->payloads,current_payload);
-		
-		/* an encryption payload is the last one, so STOP here. decryption is done later */
-		if (current_payload_type == ENCRYPTED)
-		{
-			this->logger->log(this->logger, CONTROL|LEVEL2, "%s payload found. Stop parsing", 
-								mapping_find(payload_type_m, current_payload_type));			
-			break;	
-		}
-		
-		/* get next payload type */
-		current_payload_type = current_payload->get_next_type(current_payload);
-	}
-
-	if (current_payload_type == ENCRYPTED)
-	{
-		status = this->decrypt_payloads(this,crypter,signer);
-		if (status != SUCCESS)
-		{
-			this->logger->log(this->logger, ERROR, "Could not decrypt payloads");
-			return status;
-		}
-	}
-	
-	status = this->verify(this);
-	if (status != SUCCESS)
-	{
-		this->logger->log(this->logger, ERROR, "verification of message failed");
-		return status;
-	}
-	
-	build_payload_string(this, payload_names, sizeof(payload_names));
-	this->logger->log(this->logger, CONTROL, "parsed %s %s (%d) [%s]", 
-					mapping_find(exchange_type_m, this->exchange_type),
-					this->is_request ? "request" : "response",
-					this->message_id,
-					payload_names);
-	
-	return SUCCESS;
-}
-
-/**
- * Implementation of private_message_t.verify.
- */
-static status_t verify(private_message_t *this)
-{
-	int i;
-	iterator_t *iterator;
-	size_t total_found_payloads = 0;
-	
-	this->logger->log(this->logger, CONTROL|LEVEL1, "verifying message structure");
-
-	iterator = this->payloads->create_iterator(this->payloads,TRUE);
-	/* check for payloads with wrong count*/
-	for (i = 0; i < this->message_rule->payload_rule_count;i++)
-	{
-		size_t found_payloads = 0;
-	
-		/* check all payloads for specific rule */
-		iterator->reset(iterator);
-		
-		while(iterator->has_next(iterator))
-		{
-			payload_t *current_payload;
-			payload_type_t current_payload_type;
-			
-			iterator->current(iterator,(void **)&current_payload);
-			current_payload_type = current_payload->get_type(current_payload);
-			
-			if (current_payload_type == UNKNOWN_PAYLOAD)
-			{
-				/* unknown payloads are ignored, IF they are not critical */
-				unknown_payload_t *unknown_payload = (unknown_payload_t*)current_payload;
-				if (unknown_payload->is_critical(unknown_payload))
-				{
-					this->logger->log(this->logger, ERROR|LEVEL1, "%s (%d) is not supported, but its critical!",
-									  mapping_find(payload_type_m, current_payload_type), current_payload_type);
-					iterator->destroy(iterator);
-					return NOT_SUPPORTED;	
-				}
-			}
-			else if (current_payload_type == this->message_rule->payload_rules[i].payload_type)
-			{
-				found_payloads++;
-				total_found_payloads++;
-				this->logger->log(this->logger, CONTROL|LEVEL2, "found payload of type %s",
-							  mapping_find(payload_type_m, this->message_rule->payload_rules[i].payload_type));
-	
-				/* as soon as ohe payload occures more then specified, the verification fails */
-				if (found_payloads > this->message_rule->payload_rules[i].max_occurence)
-				{
-					this->logger->log(this->logger, ERROR|LEVEL1, "payload of type %s more than %d times (%d) occured in current message",
-									  mapping_find(payload_type_m, current_payload_type),
-									  this->message_rule->payload_rules[i].max_occurence, found_payloads);
-					iterator->destroy(iterator);
-					return VERIFY_ERROR;
-				}
-			}
-		}
-
-		if (found_payloads < this->message_rule->payload_rules[i].min_occurence)
-		{
-			this->logger->log(this->logger, ERROR|LEVEL1, "payload of type %s not occured %d times (%d)",
-							  mapping_find(payload_type_m, this->message_rule->payload_rules[i].payload_type),
-							  this->message_rule->payload_rules[i].min_occurence, found_payloads);
-			iterator->destroy(iterator);
-			return VERIFY_ERROR;
-		}
-		if ((this->message_rule->payload_rules[i].sufficient) && (this->payloads->get_count(this->payloads) == total_found_payloads))
-		{
-			iterator->destroy(iterator);
-			return SUCCESS;	
-		}
-	}
-	iterator->destroy(iterator);
-	return SUCCESS;
+	return status;
 }
 
-
 /**
  * Implementation of private_message_t.decrypt_and_verify_payloads.
  */
@@ -1028,8 +895,8 @@ static status_t decrypt_payloads(private_message_t *this,crypter_t *crypter, sig
 		/* needed to check */
 		current_payload_type = current_payload->get_type(current_payload);
 		
-		this->logger->log(this->logger, CONTROL|LEVEL2, "process payload of type %s",
-							mapping_find(payload_type_m,current_payload_type));
+		DBG2(SIG_DBG_ENC, "process payload of type %N",
+			 payload_type_names, current_payload_type);
 		
 		if (current_payload_type == ENCRYPTED)
 		{
@@ -1038,31 +905,31 @@ static status_t decrypt_payloads(private_message_t *this,crypter_t *crypter, sig
 			
 			encryption_payload = (encryption_payload_t*)current_payload;
 			
-			this->logger->log(this->logger, CONTROL | LEVEL2, "found an encryption payload");
+			DBG2(SIG_DBG_ENC, "found an encryption payload");
 
 			if (payload_number != this->payloads->get_count(this->payloads))
 			{
 				/* encrypted payload is not last one */
-				this->logger->log(this->logger, ERROR, "encrypted payload is not last payload");
+				DBG1(SIG_DBG_ENC, "encrypted payload is not last payload");
 				iterator->destroy(iterator);
 				return VERIFY_ERROR;
 			}
 			/* decrypt */
 			encryption_payload->set_transforms(encryption_payload, crypter, signer);
-			this->logger->log(this->logger, CONTROL | LEVEL1, "verify signature of encryption payload");
-			status = encryption_payload->verify_signature(encryption_payload, this->packet->get_data(this->packet));
+			DBG2(SIG_DBG_ENC, "verify signature of encryption payload");
+			status = encryption_payload->verify_signature(encryption_payload,
+										this->packet->get_data(this->packet));
 			if (status != SUCCESS)
 			{
-				this->logger->log(this->logger, ERROR, "encryption payload signature invalid");
+				DBG1(SIG_DBG_ENC, "encryption payload signature invalid");
 				iterator->destroy(iterator);
 				return FAILED;
 			}
-			this->logger->log(this->logger, CONTROL | LEVEL2, "decrypt content of encryption payload");
+			DBG2(SIG_DBG_ENC, "decrypting content of encryption payload");
 			status = encryption_payload->decrypt(encryption_payload);
 			if (status != SUCCESS)
 			{
-				this->logger->log(this->logger, ERROR, 
-								  "encrypted payload could not be decrypted and parsed");
+				DBG1(SIG_DBG_ENC, "encrypted payload could not be decrypted and parsed");
 				iterator->destroy(iterator);
 				return PARSE_ERROR;
 			}
@@ -1073,7 +940,7 @@ static status_t decrypt_payloads(private_message_t *this,crypter_t *crypter, sig
 			/* check if there are payloads contained in the encryption payload */
 			if (encryption_payload->get_payload_count(encryption_payload) == 0)
 			{
-				this->logger->log(this->logger, CONTROL|LEVEL2, "encrypted payload is empty");
+				DBG2(SIG_DBG_ENC, "encrypted payload is empty");
 				/* remove the encryption payload, is not needed anymore */
 				iterator->remove(iterator);
 				/* encrypted payload contains no other payload */
@@ -1103,9 +970,8 @@ static status_t decrypt_payloads(private_message_t *this,crypter_t *crypter, sig
 			while (encryption_payload->get_payload_count(encryption_payload) > 0)
 			{
 				encryption_payload->remove_first_payload(encryption_payload, &current_encrypted_payload);
-				this->logger->log(this->logger, CONTROL | LEVEL1, 
-								  "insert unencrypted payload of type %s at end of list.",
-								   mapping_find(payload_type_m, current_encrypted_payload->get_type(current_encrypted_payload)));
+				DBG2(SIG_DBG_ENC, "insert unencrypted payload of type %N at end of list",
+					 payload_type_names, current_encrypted_payload->get_type(current_encrypted_payload));
 				this->payloads->insert_last(this->payloads,current_encrypted_payload);
 			}
 			
@@ -1117,12 +983,12 @@ static status_t decrypt_payloads(private_message_t *this,crypter_t *crypter, sig
 		if (current_payload_type != UNKNOWN_PAYLOAD && current_payload_type != NO_PAYLOAD)
 		{
 			/* get the ruleset for found payload */
-			status = this->get_payload_rule(this, current_payload_type, &payload_rule);
+			status = get_payload_rule(this, current_payload_type, &payload_rule);
 			if (status != SUCCESS)
 			{
 				/* payload is not allowed */
-				this->logger->log(this->logger, ERROR, "payload type %s not allowed",
-								  mapping_find(payload_type_m,current_payload_type));
+				DBG1(SIG_DBG_ENC, "payload type %N not allowed",
+								  payload_type_names, current_payload_type);
 				iterator->destroy(iterator);
 				return VERIFY_ERROR;
 			}
@@ -1131,9 +997,9 @@ static status_t decrypt_payloads(private_message_t *this,crypter_t *crypter, sig
 			if (payload_rule->encrypted != current_payload_was_encrypted)
 			{
 				/* payload was not encrypted, but should have been. or vice-versa */
-				this->logger->log(this->logger, ERROR, "payload type %s should be %s!", 
-									mapping_find(payload_type_m,current_payload_type),
-									(payload_rule->encrypted) ? "encrypted" : "not encrypted");
+				DBG1(SIG_DBG_ENC, "payload type %N should be %s!",
+					 payload_type_names, current_payload_type,
+					 (payload_rule->encrypted) ? "encrypted" : "not encrypted");
 				iterator->destroy(iterator);
 				return VERIFY_ERROR;
 			}
@@ -1148,90 +1014,164 @@ static status_t decrypt_payloads(private_message_t *this,crypter_t *crypter, sig
 }
 
 /**
- * Implementation of private_message_t.encrypt_payloads.
+ * Implementation of private_message_t.verify.
  */
-static status_t encrypt_payloads (private_message_t *this,crypter_t *crypter, signer_t* signer)
+static status_t verify(private_message_t *this)
 {
-	encryption_payload_t *encryption_payload = NULL;
-	status_t status;
-	linked_list_t *all_payloads;
-	
-	if (!this->message_rule->encrypted_content)
-	{
-		this->logger->log(this->logger, CONTROL | LEVEL1, "message doesn't have to be encrypted");
-		/* message contains no content to encrypt */
-		return SUCCESS;
-	}
+	int i;
+	iterator_t *iterator;
+	size_t total_found_payloads = 0;
 	
-	this->logger->log(this->logger, CONTROL | LEVEL2, "copy all payloads to a temporary list");
-	all_payloads = linked_list_create();
+	DBG2(SIG_DBG_ENC, "verifying message structure");
 	
-	/* first copy all payloads in a temporary list */
-	while (this->payloads->get_count(this->payloads) > 0)
+	iterator = this->payloads->create_iterator(this->payloads,TRUE);
+	/* check for payloads with wrong count*/
+	for (i = 0; i < this->message_rule->payload_rule_count;i++)
 	{
-		void *current_payload;
-		this->payloads->remove_first(this->payloads,&current_payload);
-		all_payloads->insert_last(all_payloads,current_payload);
-	}
+		size_t found_payloads = 0;
 	
-	encryption_payload = encryption_payload_create();
+		/* check all payloads for specific rule */
+		iterator->reset(iterator);
+		
+		while(iterator->has_next(iterator))
+		{
+			payload_t *current_payload;
+			payload_type_t current_payload_type;
+			
+			iterator->current(iterator,(void **)&current_payload);
+			current_payload_type = current_payload->get_type(current_payload);
+			
+			if (current_payload_type == UNKNOWN_PAYLOAD)
+			{
+				/* unknown payloads are ignored, IF they are not critical */
+				unknown_payload_t *unknown_payload = (unknown_payload_t*)current_payload;
+				if (unknown_payload->is_critical(unknown_payload))
+				{
+					DBG1(SIG_DBG_ENC, "%N is not supported, but its critical!",
+						 payload_type_names, current_payload_type);
+					iterator->destroy(iterator);
+					return NOT_SUPPORTED;	
+				}
+			}
+			else if (current_payload_type == this->message_rule->payload_rules[i].payload_type)
+			{
+				found_payloads++;
+				total_found_payloads++;
+				DBG2(SIG_DBG_ENC, "found payload of type %N",
+					 payload_type_names, this->message_rule->payload_rules[i].payload_type);
+				
+				/* as soon as ohe payload occures more then specified, the verification fails */
+				if (found_payloads > this->message_rule->payload_rules[i].max_occurence)
+				{
+					DBG1(SIG_DBG_ENC, "payload of type %N more than %d times (%d) occured in current message",
+						 payload_type_names, current_payload_type,
+						 this->message_rule->payload_rules[i].max_occurence, found_payloads);
+					iterator->destroy(iterator);
+					return VERIFY_ERROR;
+				}
+			}
+		}
+		
+		if (found_payloads < this->message_rule->payload_rules[i].min_occurence)
+		{
+			DBG1(SIG_DBG_ENC, "payload of type %N not occured %d times (%d)",
+				 payload_type_names, this->message_rule->payload_rules[i].payload_type,
+				 this->message_rule->payload_rules[i].min_occurence, found_payloads);
+			iterator->destroy(iterator);
+			return VERIFY_ERROR;
+		}
+		if ((this->message_rule->payload_rules[i].sufficient) && (this->payloads->get_count(this->payloads) == total_found_payloads))
+		{
+			iterator->destroy(iterator);
+			return SUCCESS;	
+		}
+	}
+	iterator->destroy(iterator);
+	return SUCCESS;
+}
 
-	this->logger->log(this->logger, CONTROL | LEVEL2, "check each payloads if they have to get encrypted");
-	while (all_payloads->get_count(all_payloads) > 0)
+/**
+ * Implementation of message_t.parse_body.
+ */
+static status_t parse_body(private_message_t *this, crypter_t *crypter, signer_t *signer)
+{
+	status_t status = SUCCESS;
+	payload_type_t current_payload_type;
+		
+	current_payload_type = this->first_payload;	
+		
+	DBG2(SIG_DBG_ENC, "parsing body of message, first payload is %N",
+		 payload_type_names, current_payload_type);
+
+	/* parse payload for payload, while there are more available */
+	while ((current_payload_type != NO_PAYLOAD))
 	{
-		payload_rule_t *payload_rule;
 		payload_t *current_payload;
-		bool to_encrypt = FALSE;
 		
-		all_payloads->remove_first(all_payloads,(void **)&current_payload);
-		this->logger->log(this->logger, CONTROL | LEVEL3, "get rule for payload %s", 
-							mapping_find(payload_type_m,current_payload->get_type(current_payload)));
+		DBG2(SIG_DBG_ENC, "starting parsing a %N payload", 
+			 payload_type_names, current_payload_type);
 		
-		status = this->get_payload_rule(this,current_payload->get_type(current_payload),&payload_rule);
-		/* for payload types which are not found in supported payload list, it is presumed 
-		 * that they don't have to be encrypted */
-		if ((status == SUCCESS) && (payload_rule->encrypted))
+		/* parse current payload */
+		status = this->parser->parse_payload(this->parser,current_payload_type,(payload_t **) &current_payload);
+		
+		if (status != SUCCESS)
 		{
-			this->logger->log(this->logger, CONTROL | LEVEL2, "payload %s has to get encrypted", 
-							  mapping_find(payload_type_m,current_payload->get_type(current_payload)));
-			to_encrypt = TRUE;
+			DBG1(SIG_DBG_ENC, "payload type %N could not be parsed",
+				 payload_type_names, current_payload_type);
+			return PARSE_ERROR;
 		}
-		else if (status != SUCCESS)
+
+		DBG2(SIG_DBG_ENC, "verifying payload of type %N",
+			 payload_type_names, current_payload_type);
+		
+		/* verify it, stop parsig if its invalid */
+		status = current_payload->verify(current_payload);
+		if (status != SUCCESS)
 		{
-			this->logger->log(this->logger, CONTROL | LEVEL2, "payload %s not defined for exchange type %s. Handle it anyway", 
-							  mapping_find(payload_type_m,current_payload->get_type(current_payload)),
-							  mapping_find(exchange_type_m,this->exchange_type));
+			DBG1(SIG_DBG_ENC, "%N payload verification failed",
+				 payload_type_names, current_payload_type);
+			current_payload->destroy(current_payload);
+			return VERIFY_ERROR;
 		}
 		
-		if (to_encrypt)
+		DBG2(SIG_DBG_ENC, "%N payload verified. Adding to payload list",
+			 payload_type_names, current_payload_type);
+		this->payloads->insert_last(this->payloads,current_payload);
+		
+		/* an encryption payload is the last one, so STOP here. decryption is done later */
+		if (current_payload_type == ENCRYPTED)
 		{
-			this->logger->log(this->logger, CONTROL | LEVEL2, "insert payload %s to encryption payload", 
-							  mapping_find(payload_type_m,current_payload->get_type(current_payload)));
-
-			encryption_payload->add_payload(encryption_payload,current_payload);
+			DBG2(SIG_DBG_ENC, "%N payload found. Stop parsing",
+				 payload_type_names, current_payload_type);
+			break;
 		}
-		else
+		
+		/* get next payload type */
+		current_payload_type = current_payload->get_next_type(current_payload);
+	}
+
+	if (current_payload_type == ENCRYPTED)
+	{
+		status = decrypt_payloads(this,crypter,signer);
+		if (status != SUCCESS)
 		{
-			this->logger->log(this->logger, CONTROL | LEVEL2, "insert payload %s as payload wich does not have to be encrypted", 
-							  mapping_find(payload_type_m,current_payload->get_type(current_payload)));
-			this->public.add_payload(&(this->public), (payload_t*)encryption_payload);
+			DBG1(SIG_DBG_ENC, "could not decrypt payloads");
+			return status;
 		}
 	}
-
-	status = SUCCESS;
-	this->logger->log(this->logger, CONTROL | LEVEL2, "set transforms for encryption payload ");
-	encryption_payload->set_transforms(encryption_payload,crypter,signer);
-	this->logger->log(this->logger, CONTROL | LEVEL1, "encrypt all payloads of encrypted payload");
-	status = encryption_payload->encrypt(encryption_payload);
-	this->logger->log(this->logger, CONTROL | LEVEL2, "add encrypted payload to payload list");
-	this->public.add_payload(&(this->public), (payload_t*)encryption_payload);
 	
-	all_payloads->destroy(all_payloads);
+	status = verify(this);
+	if (status != SUCCESS)
+	{
+		DBG1(SIG_DBG_ENC, "verification of message failed");
+		return status;
+	}
 	
-	return status;
+	DBG1(SIG_DBG_ENC, "parsed %M", this);
+	
+	return SUCCESS;
 }
 
-
 /**
  * Implementation of message_t.destroy.
  */
@@ -1297,18 +1237,11 @@ message_t *message_create_from_packet(packet_t *packet)
 		
 	/* private values */
 	this->exchange_type = EXCHANGE_TYPE_UNDEFINED;
- 	this->is_request = TRUE;
- 	this->ike_sa_id = NULL;
- 	this->first_payload = NO_PAYLOAD;
- 	this->message_id = 0;
-
-	/* private functions */
-	this->set_message_rule = set_message_rule;
-	this->get_payload_rule = get_payload_rule;
-	this->encrypt_payloads = encrypt_payloads;
-	this->decrypt_payloads = decrypt_payloads;
-	this->verify = verify;
-
+	this->is_request = TRUE;
+	this->ike_sa_id = NULL;
+	this->first_payload = NO_PAYLOAD;
+	this->message_id = 0;
+	
 	/* private values */
 	if (packet == NULL)
 	{
@@ -1319,10 +1252,8 @@ message_t *message_create_from_packet(packet_t *packet)
 	this->payloads = linked_list_create();
 	
 	/* parser is created from data of packet */
- 	this->parser = parser_create(this->packet->get_data(this->packet));
-		
-	this->logger = logger_manager->get_logger(logger_manager, MESSAGE);
-
+	this->parser = parser_create(this->packet->get_data(this->packet));
+	
 	return (&this->public);
 }
 
diff --git a/src/charon/encoding/message.h b/src/charon/encoding/message.h
index ac171028e..3b91e8e94 100644
--- a/src/charon/encoding/message.h
+++ b/src/charon/encoding/message.h
@@ -34,6 +34,11 @@
 #include <crypto/crypters/crypter.h>
 #include <crypto/signers/signer.h>
 
+/**
+ * printf() specifier for message
+ */
+#define MESSAGE_PRINTF_SPEC 'M'
+
 
 typedef struct message_t message_t;
 
diff --git a/src/charon/encoding/parser.c b/src/charon/encoding/parser.c
index e7cfb3217..4215d3840 100644
--- a/src/charon/encoding/parser.c
+++ b/src/charon/encoding/parser.c
@@ -30,7 +30,6 @@
 #include <types.h>
 #include <definitions.h>
 #include <daemon.h>
-#include <utils/logger.h>
 #include <utils/linked_list.h>
 #include <encoding/payloads/encodings.h>
 #include <encoding/payloads/payload.h>
@@ -233,11 +232,6 @@ struct private_parser_t {
 	 * Set of encoding rules for this parsing session.
 	 */
 	encoding_rule_t *rules;
-	
-	/**
-	 * Assigned logger_t object.
-	 */
-	logger_t *logger;
 };
 
 /**
@@ -247,9 +241,8 @@ static status_t parse_uint4(private_parser_t *this, int rule_number, u_int8_t *o
 {
 	if (this->byte_pos + sizeof(u_int8_t)  > this->input_roof)
 	{
-		this->logger->log(this->logger, ERROR|LEVEL1, "  not enough input to parse rule %d %s", 
-							rule_number, mapping_find(encoding_type_m, 
-							this->rules[rule_number].type));
+		DBG1(SIG_DBG_ENC, "  not enough input to parse rule %d %N",
+			 rule_number, encoding_type_names, this->rules[rule_number].type);
 		return PARSE_ERROR;
 	}
 	switch (this->bit_pos)
@@ -272,15 +265,15 @@ static status_t parse_uint4(private_parser_t *this, int rule_number, u_int8_t *o
 			this->byte_pos++;
 			break;
 		default:
-			this->logger->log(this->logger, ERROR, "  found rule %d %s on bitpos %d", 
-								rule_number, mapping_find(encoding_type_m, 
-								this->rules[rule_number].type), this->bit_pos);
+			DBG2(SIG_DBG_ENC, "  found rule %d %N on bitpos %d",
+				 rule_number, encoding_type_names,
+				 this->rules[rule_number].type, this->bit_pos);
 			return PARSE_ERROR;
 	}
 	
 	if (output_pos != NULL)
 	{
-		this->logger->log(this->logger, RAW|LEVEL2, "   => %d", *output_pos);
+		DBG3(SIG_DBG_ENC, "   => %d", *output_pos);
 	}
 	
 	return SUCCESS;
@@ -293,16 +286,15 @@ static status_t parse_uint8(private_parser_t *this, int rule_number, u_int8_t *o
 {
 	if (this->byte_pos + sizeof(u_int8_t)  > this->input_roof)
 	{
-		this->logger->log(this->logger, ERROR|LEVEL1, "  not enough input to parse rule %d %s", 
-							rule_number, mapping_find(encoding_type_m, 
-							this->rules[rule_number].type));
+		DBG1(SIG_DBG_ENC, "  not enough input to parse rule %d %N",
+			 rule_number, encoding_type_names, this->rules[rule_number].type);
 		return PARSE_ERROR;
 	}
 	if (this->bit_pos)
 	{
-		this->logger->log(this->logger, ERROR, "  found rule %d %s on bitpos %d", 
-							rule_number, mapping_find(encoding_type_m, 
-							this->rules[rule_number].type), this->bit_pos);
+		DBG1(SIG_DBG_ENC, "  found rule %d %N on bitpos %d",
+			 rule_number, encoding_type_names,
+			 this->rules[rule_number].type, this->bit_pos);
 		return PARSE_ERROR;
 	}
 
@@ -310,7 +302,7 @@ static status_t parse_uint8(private_parser_t *this, int rule_number, u_int8_t *o
 	if (output_pos != NULL)
 	{
 		*output_pos = *(this->byte_pos);
-		this->logger->log(this->logger, RAW|LEVEL2, "   => %d", *output_pos);
+		DBG3(SIG_DBG_ENC, "   => %d", *output_pos);
 	}
 	this->byte_pos++;
 	
@@ -324,23 +316,21 @@ static status_t parse_uint15(private_parser_t *this, int rule_number, u_int16_t
 {
 	if (this->byte_pos + sizeof(u_int16_t) > this->input_roof)
 	{
-		this->logger->log(this->logger, ERROR|LEVEL1, "  not enough input to parse rule %d %s", 
-							rule_number, mapping_find(encoding_type_m, 
-							this->rules[rule_number].type));
+		DBG1(SIG_DBG_ENC, "  not enough input to parse rule %d %N",
+			 rule_number, encoding_type_names, this->rules[rule_number].type);
 		return PARSE_ERROR;
 	}
 	if (this->bit_pos != 1)
 	{
-		this->logger->log(this->logger, ERROR, "  found rule %d %s on bitpos %d", 
-							rule_number, mapping_find(encoding_type_m, this->rules[rule_number].type), 
-							this->bit_pos);
+		DBG2(SIG_DBG_ENC, "  found rule %d %N on bitpos %d", rule_number,
+			 encoding_type_names, this->rules[rule_number].type, this->bit_pos);
 		return PARSE_ERROR;
 	}
 	/* caller interested in result ? */
 	if (output_pos != NULL)
 	{
 		*output_pos = ntohs(*((u_int16_t*)this->byte_pos)) & ~0x8000;
-		this->logger->log(this->logger, RAW|LEVEL2, "   => %d", *output_pos);
+		DBG3(SIG_DBG_ENC, "   => %d", *output_pos);
 	}
 	this->byte_pos += 2;
 	this->bit_pos = 0;
@@ -355,15 +345,14 @@ static status_t parse_uint16(private_parser_t *this, int rule_number, u_int16_t
 {
 	if (this->byte_pos + sizeof(u_int16_t) > this->input_roof)
 	{
-		this->logger->log(this->logger, ERROR|LEVEL1, "  not enough input to parse rule %d %s", 
-							rule_number, mapping_find(encoding_type_m, this->rules[rule_number].type));
+		DBG1(SIG_DBG_ENC, "  not enough input to parse rule %d %N",
+			 rule_number, encoding_type_names, this->rules[rule_number].type);
 		return PARSE_ERROR;
 	}
 	if (this->bit_pos)
 	{
-		this->logger->log(this->logger, ERROR, "  found rule %d %s on bitpos %d", 
-							rule_number, mapping_find(encoding_type_m, this->rules[rule_number].type), 
-							this->bit_pos);
+		DBG1(SIG_DBG_ENC, "  found rule %d %N on bitpos %d", rule_number,
+			 encoding_type_names, this->rules[rule_number].type, this->bit_pos);
 		return PARSE_ERROR;
 	}
 	/* caller interested in result ? */
@@ -371,7 +360,7 @@ static status_t parse_uint16(private_parser_t *this, int rule_number, u_int16_t
 	{
 		*output_pos = ntohs(*((u_int16_t*)this->byte_pos));
 		
-		this->logger->log(this->logger, RAW|LEVEL2, "   => %d", *output_pos);
+		DBG3(SIG_DBG_ENC, "   => %d", *output_pos);
 	}
 	this->byte_pos += 2;
 	
@@ -384,15 +373,14 @@ static status_t parse_uint32(private_parser_t *this, int rule_number, u_int32_t
 {
 	if (this->byte_pos + sizeof(u_int32_t) > this->input_roof)
 	{
-		this->logger->log(this->logger, ERROR|LEVEL1, "  not enough input to parse rule %d %s", 
-							rule_number, mapping_find(encoding_type_m, this->rules[rule_number].type));
+		DBG1(SIG_DBG_ENC, "  not enough input to parse rule %d %N",
+			 rule_number, encoding_type_names, this->rules[rule_number].type);
 		return PARSE_ERROR;
 	}
 	if (this->bit_pos)
 	{
-		this->logger->log(this->logger, ERROR, "  found rule %d %s on bitpos %d", 
-							rule_number, mapping_find(encoding_type_m, this->rules[rule_number].type), 
-							this->bit_pos);
+		DBG1(SIG_DBG_ENC, "  found rule %d %N on bitpos %d", rule_number,
+			 encoding_type_names, this->rules[rule_number].type, this->bit_pos);
 		return PARSE_ERROR;
 	}
 	/* caller interested in result ? */
@@ -400,7 +388,7 @@ static status_t parse_uint32(private_parser_t *this, int rule_number, u_int32_t
 	{
 		*output_pos = ntohl(*((u_int32_t*)this->byte_pos));
 		
-		this->logger->log(this->logger, RAW|LEVEL2, "   => %d", *output_pos);
+		DBG3(SIG_DBG_ENC, "   => %d", *output_pos);
 	}
 	this->byte_pos += 4;
 	
@@ -414,15 +402,14 @@ static status_t parse_uint64(private_parser_t *this, int rule_number, u_int64_t
 {
 	if (this->byte_pos + sizeof(u_int64_t) > this->input_roof)
 	{
-		this->logger->log(this->logger, ERROR|LEVEL1, "  not enough input to parse rule %d %s", 
-							rule_number, mapping_find(encoding_type_m, this->rules[rule_number].type));
+		DBG1(SIG_DBG_ENC, "  not enough input to parse rule %d %N",
+			 rule_number, encoding_type_names, this->rules[rule_number].type);
 		return PARSE_ERROR;
 	}
 	if (this->bit_pos)
 	{
-		this->logger->log(this->logger, ERROR, "  found rule %d %s on bitpos %d", 
-							rule_number, mapping_find(encoding_type_m, this->rules[rule_number].type), 
-							this->bit_pos);
+		DBG1(SIG_DBG_ENC, "  found rule %d %N on bitpos %d", rule_number,
+			 encoding_type_names, this->rules[rule_number].type, this->bit_pos);
 		return PARSE_ERROR;
 	}
 	/* caller interested in result ? */
@@ -432,7 +419,7 @@ static status_t parse_uint64(private_parser_t *this, int rule_number, u_int64_t
 		*(output_pos + 1) = ntohl(*((u_int32_t*)this->byte_pos));
 		*output_pos = ntohl(*(((u_int32_t*)this->byte_pos) + 1));
 		
-		this->logger->log_bytes(this->logger, RAW|LEVEL2, "   =>", (void*)output_pos, 8);
+		DBG3(SIG_DBG_ENC, "   => %b", (void*)output_pos, sizeof(u_int64_t));
 	}
 	this->byte_pos += 8;
 
@@ -446,15 +433,14 @@ static status_t parse_bytes (private_parser_t *this, int rule_number, u_int8_t *
 {
 	if (this->byte_pos + bytes > this->input_roof)
 	{
-		this->logger->log(this->logger, ERROR|LEVEL1, "  not enough input to parse rule %d %s", 
-							rule_number, mapping_find(encoding_type_m, this->rules[rule_number].type));
+		DBG1(SIG_DBG_ENC, "  not enough input to parse rule %d %N",
+			 rule_number, encoding_type_names, this->rules[rule_number].type);
 		return PARSE_ERROR;
 	}
 	if (this->bit_pos)
 	{
-		this->logger->log(this->logger, ERROR, "  found rule %d %s on bitpos %d", 
-							rule_number, mapping_find(encoding_type_m, this->rules[rule_number].type), 
-							this->bit_pos);
+		DBG1(SIG_DBG_ENC, "  found rule %d %N on bitpos %d", rule_number,
+			 encoding_type_names, this->rules[rule_number].type, this->bit_pos);
 		return PARSE_ERROR;
 	}
 
@@ -463,7 +449,7 @@ static status_t parse_bytes (private_parser_t *this, int rule_number, u_int8_t *
 	{
 		memcpy(output_pos,this->byte_pos,bytes);
 		
-		this->logger->log_bytes(this->logger, RAW|LEVEL2, "   =>", (void*)output_pos, bytes);
+		DBG3(SIG_DBG_ENC, "   => %b", (void*)output_pos, bytes);
 	}
 	this->byte_pos += bytes;
 	
@@ -477,8 +463,8 @@ static status_t parse_bit(private_parser_t *this, int rule_number, bool *output_
 {
 	if (this->byte_pos + sizeof(u_int8_t) > this->input_roof)
 	{
-		this->logger->log(this->logger, ERROR|LEVEL1, "  not enough input to parse rule %d %s", 
-							rule_number, mapping_find(encoding_type_m, this->rules[rule_number].type));
+		DBG1(SIG_DBG_ENC, "  not enough input to parse rule %d %N",
+			 rule_number, encoding_type_names, this->rules[rule_number].type);
 		return PARSE_ERROR;
 	}
 	/* caller interested in result ? */
@@ -494,7 +480,7 @@ static status_t parse_bit(private_parser_t *this, int rule_number, bool *output_
 			*output_pos = TRUE;
 		}
 		
-		this->logger->log(this->logger, RAW|LEVEL2, "   => %d", *output_pos);
+		DBG3(SIG_DBG_ENC, "   => %d", *output_pos);
 	}
 	this->bit_pos = (this->bit_pos + 1) % 8;
 	if (this->bit_pos == 0) 
@@ -514,15 +500,15 @@ static status_t parse_list(private_parser_t *this, int rule_number, linked_list_
 	
 	if (length < 0)
 	{
-		this->logger->log(this->logger, ERROR|LEVEL1, "  invalid length for rule %d %s", 
-							rule_number, mapping_find(encoding_type_m, this->rules[rule_number].type));
+		DBG1(SIG_DBG_ENC, "  invalid length for rule %d %N",
+			 rule_number, encoding_type_names, this->rules[rule_number].type);
 		return PARSE_ERROR;	
 	}
 	
 	if (this->bit_pos)
 	{
-		this->logger->log(this->logger, ERROR, "  found rule %d %s on bitpos %d", 
-							rule_number, mapping_find(encoding_type_m, this->rules[rule_number].type), this->bit_pos);
+		DBG1(SIG_DBG_ENC, "  found rule %d %N on bitpos %d", rule_number,
+			 encoding_type_names, this->rules[rule_number].type, this->bit_pos);
 		return PARSE_ERROR;
 	}
 	
@@ -531,13 +517,13 @@ static status_t parse_list(private_parser_t *this, int rule_number, linked_list_
 		u_int8_t *pos_before = this->byte_pos;
 		payload_t *payload;
 		status_t status;
-		this->logger->log(this->logger, CONTROL|LEVEL1, "  %d bytes left, parsing recursivly %s", 
-							length, mapping_find(payload_type_m, payload_type));
+		DBG2(SIG_DBG_ENC, "  %d bytes left, parsing recursivly %N",
+			 length, payload_type_names, payload_type);
 		status = this->public.parse_payload((parser_t*)this, payload_type, &payload);
 		if (status != SUCCESS)
 		{
-			this->logger->log(this->logger, ERROR, "  parsing of a %s substructure failed", 
-								mapping_find(payload_type_m, payload_type));
+			DBG1(SIG_DBG_ENC, "  parsing of a %N substructure failed",
+				 payload_type_names, payload_type);
 			return status;	
 		}
 		list->insert_last(list, payload);
@@ -554,14 +540,14 @@ static status_t parse_chunk(private_parser_t *this, int rule_number, chunk_t *ou
 {
 	if (this->byte_pos + length > this->input_roof)
 	{
-		this->logger->log(this->logger, ERROR, "  not enough input (%d bytes) to parse rule %d %s", 
-							length, rule_number, mapping_find(encoding_type_m, this->rules[rule_number].type));
+		DBG1(SIG_DBG_ENC, "  not enough input (%d bytes) to parse rule %d %N",
+			 length, rule_number, encoding_type_names, this->rules[rule_number].type);
 		return PARSE_ERROR;
 	}
 	if (this->bit_pos)
 	{
-		this->logger->log(this->logger, ERROR, "  found rule %d %s on bitpos %d", 
-							rule_number, mapping_find(encoding_type_m, this->rules[rule_number].type), this->bit_pos);
+		DBG1(SIG_DBG_ENC, "  found rule %d %N on bitpos %d", rule_number,
+			 encoding_type_names, this->rules[rule_number].type, this->bit_pos);
 		return PARSE_ERROR;
 	}
 	if (output_pos != NULL)
@@ -571,7 +557,7 @@ static status_t parse_chunk(private_parser_t *this, int rule_number, chunk_t *ou
 		memcpy(output_pos->ptr, this->byte_pos, length);
 	}
 	this->byte_pos += length;
-	this->logger->log_bytes(this->logger, RAW|LEVEL2, "   =>", (void*)output_pos->ptr, length);
+	DBG3(SIG_DBG_ENC, "   => %b", (void*)output_pos->ptr, length);
 	
 	return SUCCESS;
 }
@@ -592,17 +578,16 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ
 	/* create instance of the payload to parse */
 	pld = payload_create(payload_type);
 	
-	this->logger->log(this->logger, CONTROL|LEVEL1, "parsing %s payload, %d bytes left", 
-						mapping_find(payload_type_m, payload_type),
-						this->input_roof-this->byte_pos);
+	DBG2(SIG_DBG_ENC, "parsing %N payload, %d bytes left",
+		 payload_type_names, payload_type, this->input_roof - this->byte_pos);
 	
-	this->logger->log_bytes(this->logger, RAW|LEVEL3, "parsing payload from", this->byte_pos, 
-								this->input_roof-this->byte_pos);
+	DBG3(SIG_DBG_ENC, "parsing payload from %b",
+		 this->byte_pos, this->input_roof-this->byte_pos);
 	
 	if (pld->get_type(pld) == UNKNOWN_PAYLOAD)
 	{
-		this->logger->log(this->logger, ERROR|LEVEL1, "  payload type %d is unknown, handling as %s",
-							payload_type, mapping_find(payload_type_m, UNKNOWN_PAYLOAD));
+		DBG1(SIG_DBG_ENC, "  payload type %d is unknown, handling as %N",
+			 payload_type, payload_type_names, UNKNOWN_PAYLOAD);
 	}
 	
 	/* base pointer for output, avoids casting in every rule */
@@ -613,8 +598,8 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ
 	for (rule_number = 0; rule_number < rule_count; rule_number++)
 	{
 		rule = &(this->rules[rule_number]);
-		this->logger->log(this->logger, CONTROL|LEVEL2, "  parsing rule %d %s", 
-							rule_number, mapping_find(encoding_type_m, rule->type));
+		DBG2(SIG_DBG_ENC, "  parsing rule %d %N",
+			 rule_number, encoding_type_names, rule->type);
 		switch (rule->type)
 		{
 			case U_INT_4:
@@ -990,7 +975,8 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ
 			}
 			default:
 			{
-				this->logger->log(this->logger, ERROR, "  no rule to parse rule %d %s (%d)", rule_number, mapping_find(encoding_type_m, rule->type), rule->type);
+				DBG1(SIG_DBG_ENC, "  no rule to parse rule %d %N",
+					 rule_number, encoding_type_names, rule->type);
 				pld->destroy(pld);
 				return PARSE_ERROR;
 			}
@@ -999,9 +985,9 @@ static status_t parse_payload(private_parser_t *this, payload_type_t payload_typ
 		rule++;
 	}
 	
-	*payload = pld;	
-	this->logger->log(this->logger, CONTROL|LEVEL2, "parsing %s payload finished.", 
-					  mapping_find(payload_type_m, payload_type));
+	*payload = pld;
+	DBG2(SIG_DBG_ENC, "parsing %N payload finished",
+		 payload_type_names, payload_type);
 	return SUCCESS;
 }
 
@@ -1038,8 +1024,6 @@ parser_t *parser_create(chunk_t data)
 {
 	private_parser_t *this = malloc_thing(private_parser_t);
 	
-	this->logger = logger_manager->get_logger(logger_manager, PARSER);
-	
 	this->public.parse_payload = (status_t(*)(parser_t*,payload_type_t,payload_t**)) parse_payload;
 	this->public.reset_context = (void(*)(parser_t*)) reset_context;
 	this->public.get_remaining_byte_count = (int (*) (parser_t *))get_remaining_byte_count;
@@ -1055,7 +1039,7 @@ parser_t *parser_create(chunk_t data)
 	this->parse_bit = parse_bit;
 	this->parse_list = parse_list;
 	this->parse_chunk = parse_chunk;
-		
+	
 	this->input = data.ptr;
 	this->byte_pos = data.ptr;
 	this->bit_pos = 0;
@@ -1063,4 +1047,3 @@ parser_t *parser_create(chunk_t data)
 	
 	return (parser_t*)this;
 }
-
diff --git a/src/charon/encoding/payloads/cert_payload.c b/src/charon/encoding/payloads/cert_payload.c
index 78e1fb9d4..f7c375593 100644
--- a/src/charon/encoding/payloads/cert_payload.c
+++ b/src/charon/encoding/payloads/cert_payload.c
@@ -26,10 +26,7 @@
 #include "cert_payload.h"
 
 
-/** 
- * String mappings for cert_encoding_t.
- */
-static const char *const cert_encoding_name[] = {
+ENUM(cert_encoding_names, CERT_NONE, CERT_X509_HASH_AND_URL_BUNDLE, 
 	"CERT_NONE",
 	"CERT_PKCS7_WRAPPED_X509",
 	"CERT_PGP",
@@ -43,11 +40,8 @@ static const char *const cert_encoding_name[] = {
 	"CERT_X509_ATTRIBUTE",
 	"CERT_RAW_RSA_KEY",
 	"CERT_X509_HASH_AND_URL",
-	"CERT_X509_HASH_AND_URL_BUNDLE"
-};
-
-enum_names cert_encoding_names =
-    { CERT_NONE, CERT_X509_HASH_AND_URL_BUNDLE, cert_encoding_name, NULL };
+	"CERT_X509_HASH_AND_URL_BUNDLE",
+);
 
 typedef struct private_cert_payload_t private_cert_payload_t;
 
diff --git a/src/charon/encoding/payloads/cert_payload.h b/src/charon/encoding/payloads/cert_payload.h
index 4eb854741..aaf0b8566 100644
--- a/src/charon/encoding/payloads/cert_payload.h
+++ b/src/charon/encoding/payloads/cert_payload.h
@@ -64,7 +64,7 @@ enum cert_encoding_t {
  * 
  * @ingroup payloads
  */
-extern enum_names cert_encoding_names;
+extern enum_name_t *cert_encoding_names;
 
 typedef struct cert_payload_t cert_payload_t;
 
diff --git a/src/charon/encoding/payloads/configuration_attribute.c b/src/charon/encoding/payloads/configuration_attribute.c
index 88adbd66f..5982214ac 100644
--- a/src/charon/encoding/payloads/configuration_attribute.c
+++ b/src/charon/encoding/payloads/configuration_attribute.c
@@ -58,27 +58,23 @@ struct private_configuration_attribute_t {
 	chunk_t attribute_value;
 };
 
-/** 
- * String mappings for configuration_attribute_type_t.
- */
-mapping_t configuration_attribute_type_m[] = {
-	{INTERNAL_IP4_ADDRESS, "INTERNAL_IP4_ADDRESS"},
-	{INTERNAL_IP4_NETMASK, "INTERNAL_IP4_NETMASK"},
-	{INTERNAL_IP4_DNS, "INTERNAL_IP4_DNS"},
-	{INTERNAL_IP4_NBNS, "INTERNAL_IP4_NBNS"},
-	{INTERNAL_ADDRESS_EXPIRY, "INTERNAL_ADDRESS_EXPIRY"},
-	{INTERNAL_IP4_DHCP, "INTERNAL_IP4_DHCP"},
-	{APPLICATION_VERSION, "APPLICATION_VERSION"},
-	{INTERNAL_IP6_ADDRESS, "INTERNAL_IP6_ADDRESS"},
-	{INTERNAL_IP6_DNS, "INTERNAL_IP6_DNS"},
-	{INTERNAL_IP6_NBNS, "INTERNAL_IP6_NBNS"},
-	{INTERNAL_IP6_DHCP, "INTERNAL_IP6_DHCP"},
-	{INTERNAL_IP4_SUBNET, "INTERNAL_IP4_SUBNET"},
-	{SUPPORTED_ATTRIBUTES, "SUPPORTED_ATTRIBUTES"},
-	{INTERNAL_IP6_SUBNET, "INTERNAL_IP6_SUBNET"},
-	{MAPPING_END, NULL}
-};
-
+ENUM_BEGIN(configuration_attribute_type_name, INTERNAL_IP4_ADDRESS, INTERNAL_IP6_ADDRESS,
+	"INTERNAL_IP4_ADDRESS",
+	"INTERNAL_IP4_NETMASK",
+	"INTERNAL_IP4_DNS",
+	"INTERNAL_IP4_NBNS",
+	"INTERNAL_ADDRESS_EXPIRY",
+	"INTERNAL_IP4_DHCP",
+	"APPLICATION_VERSION",
+	"INTERNAL_IP6_ADDRESS");
+ENUM_NEXT(configuration_attribute_type_name, INTERNAL_IP6_DNS, INTERNAL_IP6_SUBNET, INTERNAL_IP6_ADDRESS,
+	"INTERNAL_IP6_DNS",
+	"INTERNAL_IP6_NBNS",
+	"INTERNAL_IP6_DHCP",
+	"INTERNAL_IP4_SUBNET",
+	"SUPPORTED_ATTRIBUTES",
+	"INTERNAL_IP6_SUBNET");
+ENUM_END(configuration_attribute_type_name, INTERNAL_IP6_SUBNET);
 
 /**
  * Encoding rules to parse or generate a configuration attribute.
diff --git a/src/charon/encoding/payloads/configuration_attribute.h b/src/charon/encoding/payloads/configuration_attribute.h
index 442e0cb83..5cd7b2263 100644
--- a/src/charon/encoding/payloads/configuration_attribute.h
+++ b/src/charon/encoding/payloads/configuration_attribute.h
@@ -62,11 +62,11 @@ enum configuration_attribute_type_t {
 };
 
 /** 
- * String mappings for configuration_attribute_type_t.
+ * enum names for configuration_attribute_type_t.
  * 
  * @ingroup payloads
  */
-extern mapping_t configuration_attribute_type_m[];
+extern enum_name_t *configuration_attribute_type_names;
 
 typedef struct configuration_attribute_t configuration_attribute_t;
 
diff --git a/src/charon/encoding/payloads/cp_payload.c b/src/charon/encoding/payloads/cp_payload.c
index ed779d955..f1297e444 100644
--- a/src/charon/encoding/payloads/cp_payload.c
+++ b/src/charon/encoding/payloads/cp_payload.c
@@ -28,18 +28,12 @@
 #include <encoding/payloads/encodings.h>
 #include <utils/linked_list.h>
 
-
-/** 
- * String mappings for config_type_t.
- */
-mapping_t config_type_m[] = {
-	{CFG_REQUEST, "CFG_REQUEST"},
-	{CFG_REPLY, "CFG_REPLY"},
-	{CFG_SET, "CFG_SET"},
-	{CFG_ACK, "CFG_ACK"},
-	{MAPPING_END, NULL}
-};
-
+ENUM(config_type_names, CFG_REQUEST, CFG_ACK,
+	"CFG_REQUEST",
+	"CFG_REPLY",
+	"CFG_SET",
+	"CFG_ACK",
+);
 
 typedef struct private_cp_payload_t private_cp_payload_t;
 
@@ -77,13 +71,6 @@ struct private_cp_payload_t {
 	 * Config Type.
 	 */
 	u_int8_t config_type;
-	
-	/**
-	 * @brief Computes the length of this payload.
-	 *
-	 * @param this 	calling private_cp_payload_t object
-	 */
-	void (*compute_length) (private_cp_payload_t *this);
 };
 
 /**
@@ -190,11 +177,30 @@ static void set_next_type(private_cp_payload_t *this,payload_type_t type)
 }
 
 /**
+ * recompute the length of the payload.
+ */
+static void compute_length(private_cp_payload_t *this)
+{
+	iterator_t *iterator;
+	size_t length = CP_PAYLOAD_HEADER_LENGTH;
+	iterator = this->attributes->create_iterator(this->attributes,TRUE);
+	while (iterator->has_next(iterator))
+	{
+		payload_t *current_attribute;
+		iterator->current(iterator,(void **) &current_attribute);
+		length += current_attribute->get_length(current_attribute);
+	}
+	iterator->destroy(iterator);
+	
+	this->payload_length = length;
+}
+
+/**
  * Implementation of payload_t.get_length.
  */
 static size_t get_length(private_cp_payload_t *this)
 {
-	this->compute_length(this);
+	compute_length(this);
 	return this->payload_length;
 }
 
@@ -212,7 +218,7 @@ static iterator_t *create_configuration_attribute_iterator (private_cp_payload_t
 static void add_configuration_attribute (private_cp_payload_t *this,configuration_attribute_t *attribute)
 {
 	this->attributes->insert_last(this->attributes,(void *) attribute);
-	this->compute_length(this);
+	compute_length(this);
 }
 
 /**
@@ -232,25 +238,6 @@ static config_type_t get_config_type (private_cp_payload_t *this)
 }
 
 /**
- * Implementation of private_cp_payload_t.compute_length.
- */
-static void compute_length (private_cp_payload_t *this)
-{
-	iterator_t *iterator;
-	size_t length = CP_PAYLOAD_HEADER_LENGTH;
-	iterator = this->attributes->create_iterator(this->attributes,TRUE);
-	while (iterator->has_next(iterator))
-	{
-		payload_t *current_attribute;
-		iterator->current(iterator,(void **) &current_attribute);
-		length += current_attribute->get_length(current_attribute);
-	}
-	iterator->destroy(iterator);
-	
-	this->payload_length = length;
-}
-
-/**
  * Implementation of payload_t.destroy and cp_payload_t.destroy.
  */
 static status_t destroy(private_cp_payload_t *this)
@@ -292,10 +279,6 @@ cp_payload_t *cp_payload_create()
 	this->public.get_config_type = (config_type_t (*) (cp_payload_t *)) get_config_type;
 	this->public.destroy = (void (*) (cp_payload_t *)) destroy;
 	
-	
-	/* private functions */
-	this->compute_length = compute_length;
-	
 	/* set default values of the fields */
 	this->critical = FALSE;
 	this->next_payload = NO_PAYLOAD;
diff --git a/src/charon/encoding/payloads/cp_payload.h b/src/charon/encoding/payloads/cp_payload.h
index 3fd4011e3..3391881eb 100644
--- a/src/charon/encoding/payloads/cp_payload.h
+++ b/src/charon/encoding/payloads/cp_payload.h
@@ -52,11 +52,11 @@ enum config_type_t {
 };
 
 /**
- * string mappings for config_type_t.
- * 
+ * enum name for config_type_t.
+ *
  * @ingroup payloads
  */
-extern mapping_t config_type_m[];
+extern enum_name_t *config_type_names;
 
 
 typedef struct cp_payload_t cp_payload_t;
diff --git a/src/charon/encoding/payloads/encodings.c b/src/charon/encoding/payloads/encodings.c
index 8e0f30b2e..9ec0a94f9 100644
--- a/src/charon/encoding/payloads/encodings.c
+++ b/src/charon/encoding/payloads/encodings.c
@@ -24,46 +24,44 @@
 
 #include "encodings.h"
 
-
-mapping_t encoding_type_m[] = {
-	{U_INT_4, "U_INT_4"},
-	{U_INT_8, "U_INT_8"},
-	{U_INT_16, "U_INT_16"},
-	{U_INT_32, "U_INT_32"},
-	{U_INT_64, "U_INT_64"},
-	{IKE_SPI, "IKE_SPI"},
-	{RESERVED_BIT, "RESERVED_BIT"},
-	{RESERVED_BYTE, "RESERVED_BYTE"},
-	{FLAG, "FLAG"},
-	{PAYLOAD_LENGTH, "PAYLOAD_LENGTH"},
-	{HEADER_LENGTH, "HEADER_LENGTH"},
-	{SPI_SIZE, "SPI_SIZE"},
-	{SPI, "SPI"},
-	{KEY_EXCHANGE_DATA, "KEY_EXCHANGE_DATA"},
-	{NOTIFICATION_DATA, "NOTIFICATION_DATA"},
-	{PROPOSALS, "PROPOSALS"},
-	{TRANSFORMS, "TRANSFORMS"},
-	{TRANSFORM_ATTRIBUTES, "TRANSFORM_ATTRIBUTES"},
-	{ATTRIBUTE_FORMAT, "ATTRIBUTE_FORMAT"},
-	{ATTRIBUTE_TYPE, "ATTRIBUTE_TYPE"},
-	{ATTRIBUTE_LENGTH_OR_VALUE, "ATTRIBUTE_LENGTH_OR_VALUE"},
-	{ATTRIBUTE_VALUE, "ATTRIBUTE_VALUE"},
-	{NONCE_DATA, "NONCE_DATA"},
-	{ID_DATA, "ID_DATA"},
-	{AUTH_DATA, "AUTH_DATA"},
-	{ENCRYPTED_DATA, "ENCRYPTED_DATA"},
-	{TS_TYPE, "TS_TYPE"},
-	{ADDRESS, "ADDRESS"},
-	{TRAFFIC_SELECTORS, "TRAFFIC_SELECTORS"},
-	{CERT_DATA, "CERT_DATA"},
-	{CERTREQ_DATA, "CERTREQ_DATA"},
-	{SPIS, "SPIS"},
-	{VID_DATA, "VID_DATA"},
-	{VID_DATA, "VID_DATA"},	
-	{CONFIGURATION_ATTRIBUTES, "CONFIGURATION_ATTRIBUTES"},
-	{CONFIGURATION_ATTRIBUTE_LENGTH, "CONFIGURATION_ATTRIBUTE_LENGTH"},
-	{CONFIGURATION_ATTRIBUTE_VALUE, "CONFIGURATION_ATTRIBUTE_VALUE"},	
-	{EAP_MESSAGE, "EAP_MESSAGE"},
-	{UNKNOWN_DATA,"UNKNOWN_DATA"},
-	{MAPPING_END, NULL}
-};
+ENUM(encoding_type_names, U_INT_4, UNKNOWN_DATA,
+	"U_INT_4",
+	"U_INT_8",
+	"U_INT_16",
+	"U_INT_32",
+	"U_INT_64",
+	"IKE_SPI",
+	"RESERVED_BIT",
+	"RESERVED_BYTE",
+	"FLAG",
+	"PAYLOAD_LENGTH",
+	"HEADER_LENGTH",
+	"SPI_SIZE",
+	"SPI",
+	"KEY_EXCHANGE_DATA",
+	"NOTIFICATION_DATA",
+	"PROPOSALS",
+	"TRANSFORMS",
+	"TRANSFORM_ATTRIBUTES",
+	"ATTRIBUTE_FORMAT",
+	"ATTRIBUTE_TYPE",
+	"ATTRIBUTE_LENGTH_OR_VALUE",
+	"ATTRIBUTE_VALUE",
+	"NONCE_DATA",
+	"ID_DATA",
+	"AUTH_DATA",
+	"ENCRYPTED_DATA",
+	"TS_TYPE",
+	"ADDRESS",
+	"TRAFFIC_SELECTORS",
+	"CERT_DATA",
+	"CERTREQ_DATA",
+	"SPIS",
+	"VID_DATA",
+	"VID_DATA",
+	"CONFIGURATION_ATTRIBUTES",
+	"CONFIGURATION_ATTRIBUTE_LENGTH",
+	"CONFIGURATION_ATTRIBUTE_VALUE",
+	"EAP_MESSAGE",
+	"UNKNOWN_DATA",
+);
diff --git a/src/charon/encoding/payloads/encodings.h b/src/charon/encoding/payloads/encodings.h
index bacfb48a9..24dc16fa7 100644
--- a/src/charon/encoding/payloads/encodings.h
+++ b/src/charon/encoding/payloads/encodings.h
@@ -499,11 +499,11 @@ enum encoding_type_t {
 };
 
 /**
- * mappings to map encoding_type_t's to strings
+ * enum name for encoding_type_t
  * 
  * @ingroup payloads
  */
-extern mapping_t encoding_type_m[];
+extern enum_name_t *encoding_type_names;
 
 
 typedef struct encoding_rule_t encoding_rule_t;
diff --git a/src/charon/encoding/payloads/encryption_payload.c b/src/charon/encoding/payloads/encryption_payload.c
index caf34fbaa..d32e6c902 100644
--- a/src/charon/encoding/payloads/encryption_payload.c
+++ b/src/charon/encoding/payloads/encryption_payload.c
@@ -29,7 +29,6 @@
 #include <daemon.h>
 #include <encoding/payloads/encodings.h>
 #include <utils/linked_list.h>
-#include <utils/logger.h>
 #include <encoding/generator.h>
 #include <encoding/parser.h>
 #include <utils/iterator.h>
@@ -37,8 +36,6 @@
 #include <crypto/signers/signer.h>
 
 
-
-
 typedef struct private_encryption_payload_t private_encryption_payload_t;
 
 /**
@@ -95,32 +92,6 @@ struct private_encryption_payload_t {
 	 * Contained payloads of this encrpytion_payload.
 	 */
 	linked_list_t *payloads;
-	
-	/** 
-	 * logger for this payload, uses MESSAGE context
-	 */
-	logger_t *logger;
-	
-	/**
-	 * @brief Computes the length of this payload.
-	 *
-	 * @param this 	calling private_encryption_payload_t object
-	 */
-	void (*compute_length) (private_encryption_payload_t *this);
-	
-	/**
-	 * @brief Generate payloads (unencrypted) in chunk decrypted.
-	 * 
-	 * @param this 	calling private_encryption_payload_t object
-	 */
-	void (*generate) (private_encryption_payload_t *this);
-		
-	/**
-	 * @brief Parse payloads from a (unencrypted) chunk.
-	 * 
-	 * @param this 	calling private_encryption_payload_t object
-	 */
-	status_t (*parse) (private_encryption_payload_t *this);
 };
 
 /**
@@ -212,11 +183,45 @@ static void set_next_type(private_encryption_payload_t *this, payload_type_t typ
 }
 
 /**
+ * (re-)compute the lenght of the whole payload
+ */
+static void compute_length(private_encryption_payload_t *this)
+{
+	iterator_t *iterator;
+	size_t block_size, length = 0;
+	iterator = this->payloads->create_iterator(this->payloads, TRUE);
+
+	/* count payload length */
+	while (iterator->has_next(iterator))
+	{
+		payload_t *current_payload;
+		iterator->current(iterator, (void **) &current_payload);
+		length += current_payload->get_length(current_payload);
+	}
+	iterator->destroy(iterator);
+	
+	if (this->crypter && this->signer)
+	{
+		/* append one byte for padding length */
+		length++;
+		/* append padding */
+		block_size = this->crypter->get_block_size(this->crypter);
+		length += block_size - length % block_size;
+		/* add iv */
+		length += block_size;
+		/* add signature */
+		length += this->signer->get_block_size(this->signer);
+	}
+	length += ENCRYPTION_PAYLOAD_HEADER_LENGTH;
+	this->payload_length = length;
+}
+
+/**
  * Implementation of payload_t.get_length.
  */
 static size_t get_length(private_encryption_payload_t *this)
 {
-	this->compute_length(this);
+	compute_length(this);
 	return this->payload_length;
 }
 
@@ -245,7 +250,7 @@ static void add_payload(private_encryption_payload_t *this, payload_t *payload)
 	}
 	payload->set_next_type(payload, NO_PAYLOAD);
 	this->payloads->insert_last(this->payloads, (void*)payload);
-	this->compute_length(this);
+	compute_length(this);
 }
 
 /**
@@ -264,6 +269,60 @@ static size_t get_payload_count(private_encryption_payload_t *this)
 	return this->payloads->get_count(this->payloads);
 }
 
+/**
+ * Generate payload before encryption.
+ */
+static void generate(private_encryption_payload_t *this)
+{
+	payload_t *current_payload, *next_payload;
+	generator_t *generator;
+	iterator_t *iterator;
+	
+	/* recalculate length before generating */
+	compute_length(this);
+	
+	/* create iterator */
+	iterator = this->payloads->create_iterator(this->payloads, TRUE);
+	
+	/* get first payload */
+	if (iterator->has_next(iterator))
+	{
+		iterator->current(iterator, (void**)&current_payload);
+		this->next_payload = current_payload->get_type(current_payload);
+	}
+	else
+	{
+		/* no paylads? */
+		DBG2(SIG_DBG_ENC, "generating contained payloads, but none available");
+		free(this->decrypted.ptr);
+		this->decrypted = CHUNK_INITIALIZER;
+		iterator->destroy(iterator);
+		return;
+	}
+	
+	generator = generator_create();
+	
+	/* build all payload, except last */
+	while(iterator->has_next(iterator))
+	{
+		iterator->current(iterator, (void**)&next_payload);
+		current_payload->set_next_type(current_payload, next_payload->get_type(next_payload));
+		generator->generate_payload(generator, current_payload);
+		current_payload = next_payload;
+	}
+	iterator->destroy(iterator);
+	
+	/* build last payload */
+	current_payload->set_next_type(current_payload, NO_PAYLOAD);
+	generator->generate_payload(generator, current_payload);
+	
+	/* free already generated data */
+	free(this->decrypted.ptr);
+	
+	generator->write_to_chunk(generator, &(this->decrypted));
+	generator->destroy(generator);
+	DBG2(SIG_DBG_ENC, "successfully generated content in encryption payload");
+}
 
 /**
  * Implementation of encryption_payload_t.encrypt.
@@ -277,19 +336,18 @@ static status_t encrypt(private_encryption_payload_t *this)
 	
 	if (this->signer == NULL || this->crypter == NULL)
 	{
-		this->logger->log(this->logger, ERROR, "could not encrypt, signer/crypter not set");
+		DBG1(SIG_DBG_ENC, "could not encrypt, signer/crypter not set");
 		return INVALID_STATE;
 	}
 	
 	/* for random data in iv and padding */
 	randomizer = randomizer_create();
-
-
+	
 	/* build payload chunk */
-	this->generate(this);
+	generate(this);
 	
-	this->logger->log(this->logger, CONTROL|LEVEL2, "encrypting payloads");
-	this->logger->log_chunk(this->logger, RAW|LEVEL2, "data to encrypt", this->decrypted);
+	DBG2(SIG_DBG_ENC, "encrypting payloads");
+	DBG3(SIG_DBG_ENC, "data to encrypt %B", &this->decrypted);
 	
 	/* build padding */
 	block_size = this->crypter->get_block_size(this->crypter);
@@ -320,8 +378,8 @@ static status_t encrypt(private_encryption_payload_t *this)
 		return status;
 	}
 	
-	this->logger->log_chunk(this->logger, RAW|LEVEL2, "data before encryption with padding", to_crypt);
-		
+	DBG3(SIG_DBG_ENC, "data before encryption with padding %B", &to_crypt);
+	
 	/* encrypt to_crypt chunk */
 	free(this->encrypted.ptr);
 	status = this->crypter->encrypt(this->crypter, to_crypt, iv, &result);
@@ -329,12 +387,11 @@ static status_t encrypt(private_encryption_payload_t *this)
 	free(to_crypt.ptr);
 	if (status != SUCCESS)
 	{
-		this->logger->log(this->logger, ERROR|LEVEL1, "encryption failed");
+		DBG2(SIG_DBG_ENC, "encryption failed");
 		free(iv.ptr);
 		return status;
 	}
-	this->logger->log_chunk(this->logger, RAW|LEVEL2, "data after encryption", result);
-	
+	DBG3(SIG_DBG_ENC, "data after encryption %B", &result);
 	
 	/* build encrypted result with iv and signature */
 	this->encrypted.len = iv.len + result.len + this->signer->get_block_size(this->signer);
@@ -347,12 +404,58 @@ static status_t encrypt(private_encryption_payload_t *this)
 	
 	free(result.ptr);
 	free(iv.ptr);
-	this->logger->log_chunk(this->logger, RAW|LEVEL2, "data after encryption with IV and (invalid) signature", this->encrypted);
+	DBG3(SIG_DBG_ENC, "data after encryption with IV and (invalid) signature %B",
+		 &this->encrypted);
 	
 	return SUCCESS;
 }
 
 /**
+ * Parse the payloads after decryption.
+ */
+static status_t parse(private_encryption_payload_t *this)
+{
+	parser_t *parser;
+	status_t status;
+	payload_type_t current_payload_type;
+	
+	/* build a parser on the decrypted data */
+	parser = parser_create(this->decrypted);
+	
+	current_payload_type = this->next_payload;
+	/* parse all payloads */
+	while (current_payload_type != NO_PAYLOAD)
+	{
+		payload_t *current_payload;	
+		
+		status = parser->parse_payload(parser, current_payload_type, (payload_t**)&current_payload);
+		if (status != SUCCESS)
+		{
+			parser->destroy(parser);
+			return PARSE_ERROR;
+		}
+
+		status = current_payload->verify(current_payload);
+		if (status != SUCCESS)
+		{
+			DBG1(SIG_DBG_ENC, "%N verification failed",
+				 payload_type_names, current_payload->get_type(current_payload));
+			current_payload->destroy(current_payload);
+			parser->destroy(parser);
+			return VERIFY_ERROR;
+		}
+
+		/* get next payload type */
+		current_payload_type = current_payload->get_next_type(current_payload);
+		
+		this->payloads->insert_last(this->payloads,current_payload);
+	}
+	parser->destroy(parser);
+	DBG2(SIG_DBG_ENC, "succesfully parsed content of encryption payload");
+	return SUCCESS;
+}
+
+/**
  * Implementation of encryption_payload_t.encrypt.
  */
 static status_t decrypt(private_encryption_payload_t *this)
@@ -361,14 +464,13 @@ static status_t decrypt(private_encryption_payload_t *this)
 	u_int8_t padding_length;
 	status_t status;
 	
-	
-	this->logger->log(this->logger, CONTROL|LEVEL2, "decrypting encryption payload");
-	this->logger->log_chunk(this->logger, RAW|LEVEL2, "data before decryption with IV and (invalid) signature", this->encrypted);
-	
+	DBG2(SIG_DBG_ENC, "decrypting encryption payload");
+	DBG3(SIG_DBG_ENC, "data before decryption with IV and (invalid) signature %B",
+		 &this->encrypted);
 	
 	if (this->signer == NULL || this->crypter == NULL)
 	{
-		this->logger->log(this->logger, ERROR, "could not decrypt, no crypter/signer set");
+		DBG1(SIG_DBG_ENC, "could not decrypt, no crypter/signer set");
 		return INVALID_STATE;
 	}
 	
@@ -386,22 +488,22 @@ static status_t decrypt(private_encryption_payload_t *this)
 	 */
 	if (concatenated.len < iv.len)
 	{
-		this->logger->log(this->logger, ERROR, "could not decrypt, invalid input");
+		DBG1(SIG_DBG_ENC, "could not decrypt, invalid input");
 		return FAILED;
 	}
 	
 	/* free previus data, if any */
 	free(this->decrypted.ptr);
 	
-	this->logger->log_chunk(this->logger, RAW|LEVEL2, "data before decryption", concatenated);
+	DBG3(SIG_DBG_ENC, "data before decryption %B", &concatenated);
 	
 	status = this->crypter->decrypt(this->crypter, concatenated, iv, &(this->decrypted));
 	if (status != SUCCESS)
 	{
-		this->logger->log(this->logger, ERROR, "could not decrypt, decryption failed");
+		DBG1(SIG_DBG_ENC, "could not decrypt, decryption failed");
 		return FAILED;
 	}
-	this->logger->log_chunk(this->logger, RAW|LEVEL2, "data after decryption with padding", this->decrypted);
+	DBG3(SIG_DBG_ENC, "data after decryption with padding %B", &this->decrypted);
 	
 	
 	/* get padding length, sits just bevore signature */
@@ -413,16 +515,16 @@ static status_t decrypt(private_encryption_payload_t *this)
 	/* check size again */
 	if (padding_length > concatenated.len || this->decrypted.len < 0)
 	{
-		this->logger->log(this->logger, ERROR, "decryption failed, invalid padding length found. Invalid key?");
+		DBG1(SIG_DBG_ENC, "decryption failed, invalid padding length found. Invalid key?");
 		/* decryption failed :-/ */
 		return FAILED;
 	}
 	
 	/* free padding */
 	this->decrypted.ptr = realloc(this->decrypted.ptr, this->decrypted.len);
-	this->logger->log_chunk(this->logger, RAW|LEVEL2, "data after decryption without padding", this->decrypted);
-	this->logger->log(this->logger, CONTROL|LEVEL2, "decryption successful, trying to parse content");
-	return (this->parse(this));
+	DBG3(SIG_DBG_ENC, "data after decryption without padding %B", &this->decrypted);
+	DBG2(SIG_DBG_ENC, "decryption successful, trying to parse content");
+	return parse(this);
 }
 
 /**
@@ -444,14 +546,14 @@ static status_t build_signature(private_encryption_payload_t *this, chunk_t data
 	
 	if (this->signer == NULL)
 	{
-		this->logger->log(this->logger, ERROR, "unable to build signature, no signer set");
+		DBG1(SIG_DBG_ENC, "unable to build signature, no signer set");
 		return INVALID_STATE;
 	}
 	
 	sig.len = this->signer->get_block_size(this->signer);
 	data_without_sig.len -= sig.len;
 	sig.ptr = data.ptr + data_without_sig.len;
-	this->logger->log(this->logger, CONTROL|LEVEL2, "building signature");
+	DBG2(SIG_DBG_ENC, "building signature");
 	this->signer->get_signature(this->signer, data_without_sig, sig.ptr);
 	return SUCCESS;
 }
@@ -466,14 +568,14 @@ static status_t verify_signature(private_encryption_payload_t *this, chunk_t dat
 	
 	if (this->signer == NULL)
 	{
-		this->logger->log(this->logger, ERROR, "unable to verify signature, no signer set");
+		DBG1(SIG_DBG_ENC, "unable to verify signature, no signer set");
 		return INVALID_STATE;
 	}
 	/* find signature in data chunk */
 	sig.len = this->signer->get_block_size(this->signer);
 	if (data.len <= sig.len)
 	{
-		this->logger->log(this->logger, ERROR|LEVEL1, "unable to verify signature, invalid input");
+		DBG1(SIG_DBG_ENC, "unable to verify signature, invalid input");
 		return FAILED;
 	}
 	sig.ptr = data.ptr + data.len - sig.len;
@@ -485,150 +587,15 @@ static status_t verify_signature(private_encryption_payload_t *this, chunk_t dat
 	
 	if (!valid)
 	{
-		this->logger->log(this->logger, ERROR|LEVEL1, "signature verification failed");
+		DBG1(SIG_DBG_ENC, "signature verification failed");
 		return FAILED;
 	}
 	
-	this->logger->log(this->logger, CONTROL|LEVEL2, "signature verification successful");
-	return SUCCESS;
-}
-
-/**
- * Implementation of private_encryption_payload_t.generate.
- */
-static void generate(private_encryption_payload_t *this)
-{
-	payload_t *current_payload, *next_payload;
-	generator_t *generator;
-	iterator_t *iterator;
-	
-	/* recalculate length before generating */
-	this->compute_length(this);
-	
-	/* create iterator */
-	iterator = this->payloads->create_iterator(this->payloads, TRUE);
-	
-	/* get first payload */
-	if (iterator->has_next(iterator))
-	{
-		iterator->current(iterator, (void**)&current_payload);
-		this->next_payload = current_payload->get_type(current_payload);
-	}
-	else
-	{
-		/* no paylads? */
-		this->logger->log(this->logger, CONTROL|LEVEL1, "generating contained payloads, but no available");
-		free(this->decrypted.ptr);
-		this->decrypted = CHUNK_INITIALIZER;
-		iterator->destroy(iterator);
-		return;
-	}
-	
-	generator = generator_create();
-	
-	/* build all payload, except last */
-	while(iterator->has_next(iterator))
-	{
-		iterator->current(iterator, (void**)&next_payload);
-		current_payload->set_next_type(current_payload, next_payload->get_type(next_payload));
-		generator->generate_payload(generator, current_payload);
-		current_payload = next_payload;
-	}
-	iterator->destroy(iterator);
-	
-	/* build last payload */
-	current_payload->set_next_type(current_payload, NO_PAYLOAD);
-	generator->generate_payload(generator, current_payload);
-	
-	/* free already generated data */
-	free(this->decrypted.ptr);
-	
-	generator->write_to_chunk(generator, &(this->decrypted));
-	generator->destroy(generator);
-	this->logger->log(this->logger, CONTROL|LEVEL1, "successfully generated content in encrpytion payload");
-}
-
-/**
- * Implementation of private_encryption_payload_t.parse.
- */
-static status_t parse(private_encryption_payload_t *this)
-{
-	parser_t *parser;
-	status_t status;
-	payload_type_t current_payload_type;
-	
-	/* build a parser on the decrypted data */
-	parser = parser_create(this->decrypted);
-	
-	current_payload_type = this->next_payload;
-	/* parse all payloads */
-	while (current_payload_type != NO_PAYLOAD)
-	{
-		payload_t *current_payload;	
-		
-		status = parser->parse_payload(parser, current_payload_type, (payload_t**)&current_payload);
-		if (status != SUCCESS)
-		{
-			parser->destroy(parser);
-			return PARSE_ERROR;
-		}
-
-		status = current_payload->verify(current_payload);
-		if (status != SUCCESS)
-		{
-			this->logger->log(this->logger, ERROR, "%s verification failed", 
-								mapping_find(payload_type_m,current_payload->get_type(current_payload)));
-			current_payload->destroy(current_payload);
-			parser->destroy(parser);
-			return VERIFY_ERROR;
-		}
-
-		/* get next payload type */
-		current_payload_type = current_payload->get_next_type(current_payload);
-		
-		this->payloads->insert_last(this->payloads,current_payload);
-	}
-	parser->destroy(parser);
-	this->logger->log(this->logger, CONTROL|LEVEL1, "succesfully parsed content of encryption payload");
+	DBG2(SIG_DBG_ENC, "signature verification successful");
 	return SUCCESS;
 }
 
 /**
- * Implementation of private_encryption_payload_t.compute_length.
- */
-static void compute_length(private_encryption_payload_t *this)
-{
-	iterator_t *iterator;
-	size_t block_size, length = 0;
-	iterator = this->payloads->create_iterator(this->payloads, TRUE);
-
-	/* count payload length */
-	while (iterator->has_next(iterator))
-	{
-		payload_t *current_payload;
-		iterator->current(iterator, (void **) &current_payload);
-		length += current_payload->get_length(current_payload);
-	}
-	iterator->destroy(iterator);
-	
-	if (this->crypter && this->signer)
-	{
-		/* append one byte for padding length */
-		length++;
-		/* append padding */
-		block_size = this->crypter->get_block_size(this->crypter);
-		length += block_size - length % block_size;
-		/* add iv */
-		length += block_size;
-		/* add signature */
-		length += this->signer->get_block_size(this->signer);
-	}
-	length += ENCRYPTION_PAYLOAD_HEADER_LENGTH;
-	this->payload_length = length;
-}
-
-
-/**
  * Implementation of payload_t.destroy.
  */
 static void destroy(private_encryption_payload_t *this)
@@ -675,12 +642,6 @@ encryption_payload_t *encryption_payload_create()
 	this->public.verify_signature = (status_t (*) (encryption_payload_t*, chunk_t)) verify_signature;
 	this->public.destroy = (void (*) (encryption_payload_t *)) destroy;
 	
-	/* private functions */
-	this->compute_length = compute_length;
-	this->generate = generate;
-	this->parse = parse;
-	this->logger = logger_manager->get_logger(logger_manager, ENCRYPTION_PAYLOAD);
-	
 	/* set default values of the fields */
 	this->critical = FALSE;
 	this->next_payload = NO_PAYLOAD;
diff --git a/src/charon/encoding/payloads/ike_header.c b/src/charon/encoding/payloads/ike_header.c
index 4e324397a..b1b4fbf87 100644
--- a/src/charon/encoding/payloads/ike_header.c
+++ b/src/charon/encoding/payloads/ike_header.c
@@ -100,19 +100,16 @@ struct private_ike_header_t {
 	 * Length of the whole IKEv2-Message (header and all payloads).
 	 */
 	u_int32_t length;	
-}; 
-
-/**
- * Mappings used to get strings for exchange_type_t.
- */
-mapping_t exchange_type_m[] = {
-	{EXCHANGE_TYPE_UNDEFINED, "EXCHANGE_TYPE_UNDEFINED"},
-	{IKE_SA_INIT, "IKE_SA_INIT"},
-	{IKE_AUTH, "IKE_AUTH"},
-	{CREATE_CHILD_SA, "CREATE_CHILD_SA"},
-	{INFORMATIONAL, "INFORMATIONAL"}
 };
 
+ENUM_BEGIN(exchange_type_names, EXCHANGE_TYPE_UNDEFINED, EXCHANGE_TYPE_UNDEFINED,
+	"EXCHANGE_TYPE_UNDEFINED");
+ENUM_NEXT(exchange_type_names, IKE_SA_INIT, INFORMATIONAL, EXCHANGE_TYPE_UNDEFINED,
+	"IKE_SA_INIT",
+	"IKE_AUTH",
+	"CREATE_CHILD_SA",
+	"INFORMATIONAL");
+ENUM_END(exchange_type_names, INFORMATIONAL);
 
 /**
  * Encoding rules to parse or generate a IKEv2-Header.
diff --git a/src/charon/encoding/payloads/ike_header.h b/src/charon/encoding/payloads/ike_header.h
index e3b469e6e..7bb380d43 100644
--- a/src/charon/encoding/payloads/ike_header.h
+++ b/src/charon/encoding/payloads/ike_header.h
@@ -93,11 +93,11 @@ enum exchange_type_t{
 };
 
 /**
- * string mappings for exchange_type_t
+ * enum name for exchange_type_t
  * 
  * @ingroup payloads
  */
-extern mapping_t exchange_type_m[];
+extern enum_name_t *exchange_type_names;
 
 
 typedef struct ike_header_t ike_header_t;
diff --git a/src/charon/encoding/payloads/ke_payload.c b/src/charon/encoding/payloads/ke_payload.c
index e4fdc9a2e..fc875517c 100644
--- a/src/charon/encoding/payloads/ke_payload.c
+++ b/src/charon/encoding/payloads/ke_payload.c
@@ -64,13 +64,6 @@ struct private_ke_payload_t {
 	 * Key Exchange Data of this KE payload.
 	 */
 	chunk_t key_exchange_data;
-	
-	/**
-	 * @brief Computes the length of this payload.
-	 *
-	 * @param this 	calling private_ke_payload_t object
-	 */
-	void (*compute_length) (private_ke_payload_t *this);
 };
 
 /**
@@ -172,18 +165,9 @@ static void set_next_type(private_ke_payload_t *this,payload_type_t type)
 }
 
 /**
- * Implementation of payload_t.get_length.
+ * recompute the length of the payload.
  */
-static size_t get_length(private_ke_payload_t *this)
-{
-	this->compute_length(this);
-	return this->payload_length;
-}
-
-/**
- * Implementation of private_ke_payload_t.compute_length.
- */
-static void compute_length (private_ke_payload_t *this)
+static void compute_length(private_ke_payload_t *this)
 {
 	size_t length = KE_PAYLOAD_HEADER_LENGTH;
 	if (this->key_exchange_data.ptr != NULL)
@@ -193,6 +177,14 @@ static void compute_length (private_ke_payload_t *this)
 	this->payload_length = length;
 }
 
+/**
+ * Implementation of payload_t.get_length.
+ */
+static size_t get_length(private_ke_payload_t *this)
+{
+	compute_length(this);
+	return this->payload_length;
+}
 
 /**
  * Implementation of ke_payload_t.get_key_exchange_data.
@@ -218,7 +210,7 @@ static void set_key_exchange_data(private_ke_payload_t *this, chunk_t key_exchan
 	}
 	
 	this->key_exchange_data = chunk_clone(key_exchange_data);
-	this->compute_length(this);
+	compute_length(this);
 }
 
 /**
@@ -260,9 +252,6 @@ ke_payload_t *ke_payload_create()
 	this->public.set_dh_group_number =(void (*) (ke_payload_t *,diffie_hellman_group_t)) set_dh_group_number;
 	this->public.destroy = (void (*) (ke_payload_t *)) destroy;
 	
-	/* private functions */
-	this->compute_length = compute_length;
-	
 	/* set default values of the fields */
 	this->critical = FALSE;
 	this->next_payload = NO_PAYLOAD;
@@ -282,7 +271,7 @@ ke_payload_t *ke_payload_create_from_diffie_hellman(diffie_hellman_t *dh)
 	
 	dh->get_my_public_value(dh, &this->key_exchange_data);
 	this->dh_group_number = dh->get_dh_group(dh);
-	this->compute_length(this);
+	compute_length(this);
 	
 	return &this->public;
 }
diff --git a/src/charon/encoding/payloads/nonce_payload.c b/src/charon/encoding/payloads/nonce_payload.c
index 036bb20b1..8e1fc505e 100644
--- a/src/charon/encoding/payloads/nonce_payload.c
+++ b/src/charon/encoding/payloads/nonce_payload.c
@@ -60,13 +60,6 @@ struct private_nonce_payload_t {
 	 * The contained nonce value.
 	 */
 	chunk_t nonce;
-	
-	/**
-	 * @brief Computes the length of this payload.
-	 *
-	 * @param this 	calling private_nonce_payload_t object
-	 */
-	void (*compute_length) (private_nonce_payload_t *this);
 };
 
 /**
@@ -176,20 +169,20 @@ static void set_next_type(private_nonce_payload_t *this,payload_type_t type)
 }
 
 /**
- * Implementation of payload_t.get_length.
+ * recompute the length of the payload.
  */
-static size_t get_length(private_nonce_payload_t *this)
+static void compute_length(private_nonce_payload_t *this)
 {
-	this->compute_length(this);
-	return this->payload_length;
+	this->payload_length = NONCE_PAYLOAD_HEADER_LENGTH + this->nonce.len;
 }
 
 /**
- * Implementation of private_id_payload_t.compute_length.
+ * Implementation of payload_t.get_length.
  */
-static void compute_length(private_nonce_payload_t *this)
+static size_t get_length(private_nonce_payload_t *this)
 {
-	this->payload_length = NONCE_PAYLOAD_HEADER_LENGTH + this->nonce.len;
+	compute_length(this);
+	return this->payload_length;
 }
 
 /**
@@ -226,9 +219,6 @@ nonce_payload_t *nonce_payload_create()
 	this->public.set_nonce = (void (*) (nonce_payload_t *,chunk_t)) set_nonce;
 	this->public.get_nonce = (chunk_t (*) (nonce_payload_t *)) get_nonce;
 	
-	/* private functions */
-	this->compute_length = compute_length;
-	
 	/* private variables */
 	this->critical = FALSE;
 	this->next_payload = NO_PAYLOAD;
diff --git a/src/charon/encoding/payloads/notify_payload.c b/src/charon/encoding/payloads/notify_payload.c
index a147ae747..faea6028b 100644
--- a/src/charon/encoding/payloads/notify_payload.c
+++ b/src/charon/encoding/payloads/notify_payload.c
@@ -28,50 +28,54 @@
 
 #include <daemon.h>
 #include <encoding/payloads/encodings.h>
-
-#define SHA1_HASH_SIZE 20
-
-/** 
- * String mappings for notify_type_t.
- */
-mapping_t notify_type_m[] = {
-	{UNSUPPORTED_CRITICAL_PAYLOAD, "UNSUPPORTED_CRITICAL_PAYLOAD"},
-	{INVALID_IKE_SPI, "INVALID_IKE_SPI"},
-	{INVALID_MAJOR_VERSION, "INVALID_MAJOR_VERSION"},
-	{INVALID_SYNTAX, "INVALID_SYNTAX"},
-	{INVALID_MESSAGE_ID, "INVALID_MESSAGE_ID"},
-	{INVALID_SPI, "INVALID_SPI"},
-	{NO_PROPOSAL_CHOSEN, "NO_PROPOSAL_CHOSEN"},
-	{INVALID_KE_PAYLOAD, "INVALID_KE_PAYLOAD"},
-	{AUTHENTICATION_FAILED, "AUTHENTICATION_FAILED"},
-	{SINGLE_PAIR_REQUIRED, "SINGLE_PAIR_REQUIRED"},
-	{NO_ADDITIONAL_SAS, "NO_ADDITIONAL_SAS"},
-	{INTERNAL_ADDRESS_FAILURE, "INTERNAL_ADDRESS_FAILURE"},
-	{FAILED_CP_REQUIRED, "FAILED_CP_REQUIRED"},
-	{TS_UNACCEPTABLE, "TS_UNACCEPTABLE"},
-	{INVALID_SELECTORS, "INVALID_SELECTORS"},
-	{INITIAL_CONTACT, "INITIAL_CONTACT"},
-	{SET_WINDOW_SIZE, "SET_WINDOW_SIZE"},
-	{ADDITIONAL_TS_POSSIBLE, "ADDITIONAL_TS_POSSIBLE"},
-	{IPCOMP_SUPPORTED, "IPCOMP_SUPPORTED"},
-	{NAT_DETECTION_SOURCE_IP, "NAT_DETECTION_SOURCE_IP"},
-	{NAT_DETECTION_DESTINATION_IP, "NAT_DETECTION_DESTINATION_IP"},
-	{COOKIE, "COOKIE"},
-	{USE_TRANSPORT_MODE, "USE_TRANSPORT_MODE"},
-	{HTTP_CERT_LOOKUP_SUPPORTED, "HTTP_CERT_LOOKUP_SUPPORTED"},
-	{REKEY_SA, "REKEY_SA"},
-	{ESP_TFC_PADDING_NOT_SUPPORTED, "ESP_TFC_PADDING_NOT_SUPPORTED"},
-	{NON_FIRST_FRAGMENTS_ALSO, "NON_FIRST_FRAGMENTS_ALSO"},
-	{MOBIKE_SUPPORTED, "MOBIKE_SUPPORTED"},
-	{ADDITIONAL_IP4_ADDRESS, "ADDITIONAL_IP4_ADDRESS"},
-	{ADDITIONAL_IP6_ADDRESS, "ADDITIONAL_IP6_ADDRESS"},
-	{NO_ADDITIONAL_ADDRESSES, "NO_ADDITIONAL_ADDRESSES"},
-	{UPDATE_SA_ADDRESSES, "UPDATE_SA_ADDRESSES"},
-	{COOKIE2, "COOKIE2"},
-	{NO_NATS_ALLOWED, "NO_NATS_ALLOWED"},
-	{AUTH_LIFETIME, "AUTH_LIFETIME"},
-	{MAPPING_END, NULL}
-};
+#include <crypto/hashers/hasher.h>
+
+ENUM_BEGIN(notify_type_names, UNSUPPORTED_CRITICAL_PAYLOAD, UNSUPPORTED_CRITICAL_PAYLOAD,
+	"UNSUPPORTED_CRITICAL_PAYLOAD");
+ENUM_NEXT(notify_type_names, INVALID_IKE_SPI, INVALID_MAJOR_VERSION, UNSUPPORTED_CRITICAL_PAYLOAD,
+	"INVALID_IKE_SPI",
+	"INVALID_MAJOR_VERSION");
+ENUM_NEXT(notify_type_names, INVALID_SYNTAX, INVALID_SYNTAX, INVALID_MAJOR_VERSION,
+	"INVALID_SYNTAX");
+ENUM_NEXT(notify_type_names, INVALID_MESSAGE_ID, INVALID_MESSAGE_ID, INVALID_SYNTAX,
+	"INVALID_MESSAGE_ID");
+ENUM_NEXT(notify_type_names, INVALID_SPI, INVALID_SPI, INVALID_MESSAGE_ID,
+	"INVALID_SPI");
+ENUM_NEXT(notify_type_names, NO_PROPOSAL_CHOSEN, NO_PROPOSAL_CHOSEN, INVALID_SPI,
+	"NO_PROPOSAL_CHOSEN");
+ENUM_NEXT(notify_type_names, INVALID_KE_PAYLOAD, INVALID_KE_PAYLOAD, NO_PROPOSAL_CHOSEN,
+	"INVALID_KE_PAYLOAD");
+ENUM_NEXT(notify_type_names, AUTHENTICATION_FAILED, AUTHENTICATION_FAILED, INVALID_KE_PAYLOAD,
+	"AUTHENTICATION_FAILED");
+ENUM_NEXT(notify_type_names, SINGLE_PAIR_REQUIRED, INVALID_SELECTORS, AUTHENTICATION_FAILED,
+	"SINGLE_PAIR_REQUIRED",
+	"NO_ADDITIONAL_SAS",
+	"INTERNAL_ADDRESS_FAILURE",
+	"FAILED_CP_REQUIRED",
+	"TS_UNACCEPTABLE",
+	"INVALID_SELECTORS");
+ENUM_NEXT(notify_type_names, INITIAL_CONTACT, AUTH_LIFETIME, INVALID_SELECTORS,
+	"INITIAL_CONTACT",
+	"SET_WINDOW_SIZE",
+	"ADDITIONAL_TS_POSSIBLE",
+	"IPCOMP_SUPPORTED",
+	"NAT_DETECTION_SOURCE_IP",
+	"NAT_DETECTION_DESTINATION_IP",
+	"COOKIE",
+	"USE_TRANSPORT_MODE",
+	"HTTP_CERT_LOOKUP_SUPPORTED",
+	"REKEY_SA",
+	"ESP_TFC_PADDING_NOT_SUPPORTED",
+	"NON_FIRST_FRAGMENTS_ALSO",
+	"MOBIKE_SUPPORTED",
+	"ADDITIONAL_IP4_ADDRESS",
+	"ADDITIONAL_IP6_ADDRESS",
+	"NO_ADDITIONAL_ADDRESSES",
+	"UPDATE_SA_ADDRESSES",
+	"COOKIE2",
+	"NO_NATS_ALLOWED",
+	"AUTH_LIFETIME");
+ENUM_END(notify_type_names, AUTH_LIFETIME);
 
 typedef struct private_notify_payload_t private_notify_payload_t;
 
@@ -124,18 +128,6 @@ struct private_notify_payload_t {
 	 * Notification data.
 	 */
 	chunk_t notification_data;
-	
-	/**
-	 * Assigned logger
-	 */
-	logger_t *logger;
-	
-	/**
-	 * @brief Computes the length of this payload.
-	 *
-	 * @param this 	calling private_ke_payload_t object
-	 */
-	void (*compute_length) (private_notify_payload_t *this);
 };
 
 /**
@@ -204,13 +196,13 @@ static status_t verify(private_notify_payload_t *this)
 		case PROTO_ESP:
 			if (this->spi.len != 4)
 			{
-				this->logger->log(this->logger, ERROR, "Invalid SPI size for %s", 
-								  mapping_find(protocol_id_m, this->protocol_id));
+				DBG1(SIG_DBG_ENC, "Invalid SPI size for %N", 
+					 protocol_id_names, this->protocol_id);
 				return FAILED;
 			}
 			break;
 		default:
-			this->logger->log(this->logger, ERROR, "Unknown protocol (%d)", this->protocol_id);
+			DBG1(SIG_DBG_ENC, "Unknown protocol (%d)", this->protocol_id);
 			return FAILED;
 	}
 	
@@ -237,7 +229,7 @@ static status_t verify(private_notify_payload_t *this)
 				case MODP_8192_BIT:
 					break;
 				default:
-					this->logger->log(this->logger, ERROR, "Bad DH group (%d)", dh_group);
+					DBG1(SIG_DBG_ENC, "Bad DH group (%d)", dh_group);
 					return FAILED;
 			}
 			break;
@@ -245,10 +237,10 @@ static status_t verify(private_notify_payload_t *this)
 		case NAT_DETECTION_SOURCE_IP:
 		case NAT_DETECTION_DESTINATION_IP:
 		{
-			if (this->notification_data.len != SHA1_HASH_SIZE)
+			if (this->notification_data.len != HASH_SIZE_SHA1)
 			{
-				this->logger->log(this->logger, ERROR, "invalid %s notify length",
-								  mapping_find(notify_type_m, this->notify_type));
+				DBG1(SIG_DBG_ENC, "invalid %N notify length",
+					 notify_type_names, this->notify_type);
 				return FAILED;
 			}
 			break;
@@ -259,8 +251,8 @@ static status_t verify(private_notify_payload_t *this)
 		{
 			if (this->notification_data.len != 0)
 			{
-				this->logger->log(this->logger, ERROR, "invalid %s notify",
-								  mapping_find(notify_type_m, this->notify_type));
+				DBG1(SIG_DBG_ENC, "invalid %N notify",
+					 notify_type_names, this->notify_type);
 				return FAILED;
 			}
 			break;
@@ -306,16 +298,7 @@ static void set_next_type(private_notify_payload_t *this,payload_type_t type)
 }
 
 /**
- * Implementation of payload_t.get_length.
- */
-static size_t get_length(private_notify_payload_t *this)
-{
-	this->compute_length(this);
-	return this->payload_length;
-}
-
-/**
- * Implementation of private_notify_payload_t.compute_length.
+ * recompute the payloads length.
  */
 static void compute_length (private_notify_payload_t *this)
 {
@@ -332,6 +315,15 @@ static void compute_length (private_notify_payload_t *this)
 }
 
 /**
+ * Implementation of payload_t.get_length.
+ */
+static size_t get_length(private_notify_payload_t *this)
+{
+	compute_length(this);
+	return this->payload_length;
+}
+
+/**
  * Implementation of notify_payload_t.get_protocol_id.
  */
 static u_int8_t get_protocol_id(private_notify_payload_t *this)
@@ -395,7 +387,7 @@ static void set_spi(private_notify_payload_t *this, u_int32_t spi)
 			break;
 	}
 	this->spi_size = this->spi.len;
-	this->compute_length(this);
+	compute_length(this);
 }
 
 /**
@@ -413,7 +405,7 @@ static status_t set_notification_data(private_notify_payload_t *this, chunk_t no
 {
 	chunk_free(&this->notification_data);
 	this->notification_data = chunk_clone(notification_data);
-	this->compute_length(this);
+	compute_length(this);
 	return SUCCESS;
 }
 
@@ -455,9 +447,6 @@ notify_payload_t *notify_payload_create()
 	this->public.set_notification_data = (void (*) (notify_payload_t *,chunk_t)) set_notification_data;
 	this->public.destroy = (void (*) (notify_payload_t *)) destroy;
 	
-	/* private functions */
-	this->compute_length = compute_length;
-	
 	/* set default values of the fields */
 	this->critical = FALSE;
 	this->next_payload = NO_PAYLOAD;
@@ -469,8 +458,7 @@ notify_payload_t *notify_payload_create()
 	this->spi_size = 0;
 	this->notification_data.ptr = NULL;
 	this->notification_data.len = 0;
-	this->logger = logger_manager->get_logger(logger_manager, PAYLOAD);
-
+	
 	return &this->public;
 }
 
diff --git a/src/charon/encoding/payloads/notify_payload.h b/src/charon/encoding/payloads/notify_payload.h
index d09b7439e..ec6536cdf 100644
--- a/src/charon/encoding/payloads/notify_payload.h
+++ b/src/charon/encoding/payloads/notify_payload.h
@@ -90,12 +90,12 @@ enum notify_type_t {
 	AUTH_LIFETIME = 16403,
 };
 
-/** 
- * String mappings for notify_type_t.
- * 
+/**
+ * enum name for notify_type_t.
+ *
  * @ingroup payloads
  */
-extern mapping_t notify_type_m[];
+extern enum_name_t *notify_type_names;
 
 
 typedef struct notify_payload_t notify_payload_t;
diff --git a/src/charon/encoding/payloads/payload.c b/src/charon/encoding/payloads/payload.c
index b6b8edbbb..3bd4cdb13 100644
--- a/src/charon/encoding/payloads/payload.c
+++ b/src/charon/encoding/payloads/payload.c
@@ -43,67 +43,65 @@
 #include <encoding/payloads/eap_payload.h>
 #include <encoding/payloads/unknown_payload.h>
 
-/*
- * build the mappings for payload_type_t
- */
-mapping_t payload_type_m[] = {
-	{NO_PAYLOAD, "NO_PAYLOAD"},
-	{SECURITY_ASSOCIATION, "SECURITY_ASSOCIATION"},
-	{KEY_EXCHANGE, "KEY_EXCHANGE"},
-	{ID_INITIATOR, "ID_INITIATOR"},
-	{ID_RESPONDER, "ID_RESPONDER"},
-	{CERTIFICATE, "CERTIFICATE"},
-	{CERTIFICATE_REQUEST, "CERTIFICATE_REQUEST"},
-	{AUTHENTICATION, "AUTHENTICATION"},
-	{NONCE, "NONCE"},
-	{NOTIFY, "NOTIFY"},
-	{DELETE, "DELETE"},
-	{VENDOR_ID, "VENDOR_ID"},
-	{TRAFFIC_SELECTOR_INITIATOR, "TRAFFIC_SELECTOR_INITIATOR"},
-	{TRAFFIC_SELECTOR_RESPONDER, "TRAFFIC_SELECTOR_RESPONDER"},
-	{ENCRYPTED, "ENCRYPTED"},
-	{CONFIGURATION, "CONFIGURATION"},
-	{EXTENSIBLE_AUTHENTICATION, "EXTENSIBLE_AUTHENTICATION"},
-	{HEADER, "HEADER"},
-	{PROPOSAL_SUBSTRUCTURE, "PROPOSAL_SUBSTRUCTURE"},
-	{TRANSFORM_SUBSTRUCTURE, "TRANSFORM_SUBSTRUCTURE"},
-	{TRANSFORM_ATTRIBUTE, "TRANSFORM_ATTRIBUTE"},
-	{TRAFFIC_SELECTOR_SUBSTRUCTURE, "TRAFFIC_SELECTOR_SUBSTRUCTURE"},
-	{CONFIGURATION_ATTRIBUTE,"CONFIGURATION_ATTRIBUTE"},
-	{UNKNOWN_PAYLOAD,"UNKNOWN_PAYLOAD"},
-	{MAPPING_END, NULL}
-};
 
-/*
- * build the short mappings for payload_type_t
- */
-mapping_t payload_type_short_m[] = {
-	{NO_PAYLOAD, "--"},
-	{SECURITY_ASSOCIATION, "SA"},
-	{KEY_EXCHANGE, "KE"},
-	{ID_INITIATOR, "IDi"},
-	{ID_RESPONDER, "IDr"},
-	{CERTIFICATE, "CERT"},
-	{CERTIFICATE_REQUEST, "CERTREQ"},
-	{AUTHENTICATION, "AUTH"},
-	{NONCE, "No"},
-	{NOTIFY, "N"},
-	{DELETE, "D"},
-	{VENDOR_ID, "V"},
-	{TRAFFIC_SELECTOR_INITIATOR, "TSi"},
-	{TRAFFIC_SELECTOR_RESPONDER, "TSr"},
-	{ENCRYPTED, "E"},
-	{CONFIGURATION, "CP"},
-	{EXTENSIBLE_AUTHENTICATION, "EAP"},
-	{HEADER, "HDR"},
-	{PROPOSAL_SUBSTRUCTURE, "PROP"},
-	{TRANSFORM_SUBSTRUCTURE, "TRANS"},
-	{TRANSFORM_ATTRIBUTE, "TRANSATTR"},
-	{TRAFFIC_SELECTOR_SUBSTRUCTURE, "TSSUB"},
-	{CONFIGURATION_ATTRIBUTE, "CPATTR"},
-	{UNKNOWN_PAYLOAD, "??"},
-	{MAPPING_END, NULL}
-};
+ENUM_BEGIN(payload_type_names, NO_PAYLOAD, NO_PAYLOAD,
+	"NO_PAYLOAD");
+ENUM_NEXT(payload_type_names, SECURITY_ASSOCIATION, EXTENSIBLE_AUTHENTICATION, NO_PAYLOAD,
+	"SECURITY_ASSOCIATION",
+	"KEY_EXCHANGE",
+	"ID_INITIATOR",
+	"ID_RESPONDER",
+	"CERTIFICATE",
+	"CERTIFICATE_REQUEST",
+	"AUTHENTICATION",
+	"NONCE",
+	"NOTIFY",
+	"DELETE",
+	"VENDOR_ID",
+	"TRAFFIC_SELECTOR_INITIATOR",
+	"TRAFFIC_SELECTOR_RESPONDER",
+	"ENCRYPTED",
+	"CONFIGURATION",
+	"EXTENSIBLE_AUTHENTICATION");
+ENUM_NEXT(payload_type_names, HEADER, UNKNOWN_PAYLOAD, EXTENSIBLE_AUTHENTICATION,
+	"HEADER",
+	"PROPOSAL_SUBSTRUCTURE",
+	"TRANSFORM_SUBSTRUCTURE",
+	"TRANSFORM_ATTRIBUTE",
+	"TRAFFIC_SELECTOR_SUBSTRUCTURE",
+	"CONFIGURATION_ATTRIBUTE",
+	"UNKNOWN_PAYLOAD");
+ENUM_END(payload_type_names, UNKNOWN_PAYLOAD);
+
+/* short forms of payload names */
+ENUM_BEGIN(payload_type_short_names, NO_PAYLOAD, NO_PAYLOAD,
+	"--");
+ENUM_NEXT(payload_type_short_names, SECURITY_ASSOCIATION, EXTENSIBLE_AUTHENTICATION, NO_PAYLOAD,
+	"SA",
+	"KE",
+	"IDi",
+	"IDr",
+	"CERT",
+	"CERTREQ",
+	"AUTH",
+	"No",
+	"N",
+	"D",
+	"V",
+	"TSi",
+	"TSr",
+	"E",
+	"CP",
+	"EAP");
+ENUM_NEXT(payload_type_short_names, HEADER, UNKNOWN_PAYLOAD, EXTENSIBLE_AUTHENTICATION,
+	"HDR",
+	"PROP",
+	"TRANS",
+	"TRANSATTR",
+	"TSSUB",
+	"CPATTR",
+	"??");
+ENUM_END(payload_type_short_names, UNKNOWN_PAYLOAD);
 
 /*
  * see header
diff --git a/src/charon/encoding/payloads/payload.h b/src/charon/encoding/payloads/payload.h
index d42739620..30f2cbfda 100644
--- a/src/charon/encoding/payloads/payload.h
+++ b/src/charon/encoding/payloads/payload.h
@@ -185,14 +185,14 @@ enum payload_type_t{
 
 
 /**
- * String mappings for payload_type_t.
+ * enum names for payload_type_t.
  */
-extern mapping_t payload_type_m[];
+extern enum_name_t *payload_type_names;
 
 /**
- * Special string mappings for payload_type_t in a short form.
+ * enum names for payload_type_t in a short form.
  */
-extern mapping_t payload_type_short_m[];
+extern enum_name_t *payload_type_short_names;
 
 
 typedef struct payload_t payload_t;
diff --git a/src/charon/encoding/payloads/proposal_substructure.c b/src/charon/encoding/payloads/proposal_substructure.c
index 4d2eae0bc..58c1dd29b 100644
--- a/src/charon/encoding/payloads/proposal_substructure.c
+++ b/src/charon/encoding/payloads/proposal_substructure.c
@@ -29,7 +29,7 @@
 #include <encoding/payloads/transform_substructure.h>
 #include <types.h>
 #include <utils/linked_list.h>
-#include <utils/logger_manager.h>
+#include <daemon.h>
 
 
 /**
@@ -89,18 +89,6 @@ struct private_proposal_substructure_t {
  	 * Transforms are stored in a linked_list_t.
  	 */
 	linked_list_t * transforms;
-	
-	/**
-	 * assigned logger
-	 */
-	logger_t *logger;
-	
-	/**
-	 * @brief Computes the length of this substructure.
-	 *
-	 * @param this 	calling private_proposal_substructure_t object
-	 */
-	void (*compute_length) (private_proposal_substructure_t *this);
 };
 
 /**
@@ -158,13 +146,13 @@ static status_t verify(private_proposal_substructure_t *this)
 	if ((this->next_payload != NO_PAYLOAD) && (this->next_payload != 2))
 	{
 		/* must be 0 or 2 */
-		this->logger->log(this->logger, ERROR, "inconsistent next payload");
+		DBG1(SIG_DBG_ENC, "inconsistent next payload");
 		return FAILED;
 	}
 	if (this->transforms_count != this->transforms->get_count(this->transforms))
 	{
 		/* must be the same! */
-		this->logger->log(this->logger, ERROR, "transform count invalid");
+		DBG1(SIG_DBG_ENC, "transform count invalid");
 		return FAILED;
 	}
 
@@ -174,29 +162,26 @@ static status_t verify(private_proposal_substructure_t *this)
 		case PROTO_ESP:
 			if (this->spi.len != 4)
 			{
-				this->logger->log(this->logger, ERROR, 
-								  "invalid SPI length in %s proposal",
-								  mapping_find(protocol_id_m, this->protocol_id));
+				DBG1(SIG_DBG_ENC, "invalid SPI length in %N proposal",
+								  protocol_id_names, this->protocol_id);
 				return FAILED;
 			}
 			break;
 		case PROTO_IKE:
 			if (this->spi.len != 0 && this->spi.len  != 8)
 			{
-				this->logger->log(this->logger, ERROR, 
-								  "invalid SPI length in IKE proposal");
+				DBG1(SIG_DBG_ENC, "invalid SPI length in IKE proposal");
 				return FAILED;
 			}
 			break;
 		default:
-			this->logger->log(this->logger, ERROR, 
-							  "invalid proposal protocol (%d)", this->protocol_id);
+			DBG1(SIG_DBG_ENC, "invalid proposal protocol (%d)", this->protocol_id);
 			return FAILED;
 	}
 	if ((this->protocol_id == 0) || (this->protocol_id >= 4))
 	{
 		/* reserved are not supported */
-		this->logger->log(this->logger, ERROR, "invalid protocol");
+		DBG1(SIG_DBG_ENC, "invalid protocol");
 		return FAILED;
 	}
 	
@@ -209,7 +194,7 @@ static status_t verify(private_proposal_substructure_t *this)
 		status = current_transform->verify(current_transform);
 		if (status != SUCCESS)
 		{
-			this->logger->log(this->logger, ERROR, "TRANSFORM_SUBSTRUCTURE verification failed");
+			DBG1(SIG_DBG_ENC, "TRANSFORM_SUBSTRUCTURE verification failed");
 			break;
 		}
 	}
@@ -252,11 +237,34 @@ static void set_next_type(private_proposal_substructure_t *this,payload_type_t t
 }
 
 /**
+ * (re-)compute the length of the payload.
+ */
+static void compute_length(private_proposal_substructure_t *this)
+{
+	iterator_t *iterator;
+	size_t transforms_count = 0;
+	size_t length = PROPOSAL_SUBSTRUCTURE_HEADER_LENGTH;
+	iterator = this->transforms->create_iterator(this->transforms,TRUE);
+	while (iterator->has_next(iterator))
+	{
+		payload_t * current_transform;
+		iterator->current(iterator,(void **) &current_transform);
+		length += current_transform->get_length(current_transform);
+		transforms_count++;
+	}
+	iterator->destroy(iterator);
+	
+	length += this->spi.len;
+	this->transforms_count = transforms_count;
+	this->proposal_length = length;
+}
+
+/**
  * Implementation of payload_t.get_length.
  */
 static size_t get_length(private_proposal_substructure_t *this)
 {
-	this->compute_length(this);
+	compute_length(this);
 	return this->proposal_length;
 }
 
@@ -285,7 +293,7 @@ static void add_transform_substructure (private_proposal_substructure_t *this,tr
 	transform->set_is_last_transform(transform,TRUE);
 	
 	this->transforms->insert_last(this->transforms,(void *) transform);
-	this->compute_length(this);
+	compute_length(this);
 }
 
 /**
@@ -339,13 +347,13 @@ static void set_spi(private_proposal_substructure_t *this, chunk_t spi)
 		free(this->spi.ptr);
 		this->spi.ptr = NULL;
 		this->spi.len = 0;
-		this->compute_length(this);
+		compute_length(this);
 	}
 	
 	this->spi.ptr = clalloc(spi.ptr,spi.len);
 	this->spi.len = spi.len;
 	this->spi_size = spi.len;
-	this->compute_length(this);
+	compute_length(this);
 }
 
 /**
@@ -361,29 +369,6 @@ static chunk_t get_spi(private_proposal_substructure_t *this)
 }
 
 /**
- * Implementation of private_proposal_substructure_t.compute_length.
- */
-static void compute_length(private_proposal_substructure_t *this)
-{
-	iterator_t *iterator;
-	size_t transforms_count = 0;
-	size_t length = PROPOSAL_SUBSTRUCTURE_HEADER_LENGTH;
-	iterator = this->transforms->create_iterator(this->transforms,TRUE);
-	while (iterator->has_next(iterator))
-	{
-		payload_t * current_transform;
-		iterator->current(iterator,(void **) &current_transform);
-		length += current_transform->get_length(current_transform);
-		transforms_count++;
-	}
-	iterator->destroy(iterator);
-	
-	length += this->spi.len;
-	this->transforms_count = transforms_count;
-	this->proposal_length = length;
-}
-
-/**
  * Implementation of proposal_substructure_t.get_transform_count.
  */
 static size_t get_transform_count (private_proposal_substructure_t *this)
@@ -544,9 +529,6 @@ proposal_substructure_t *proposal_substructure_create()
 	this->public.clone = (proposal_substructure_t * (*) (proposal_substructure_t *)) clone_;
 	this->public.destroy = (void (*) (proposal_substructure_t *)) destroy;
 	
-	/* private functions */
-	this->compute_length = compute_length;
-	
 	/* set default values of the fields */
 	this->next_payload = NO_PAYLOAD;
 	this->proposal_length = 0;
@@ -556,7 +538,6 @@ proposal_substructure_t *proposal_substructure_create()
 	this->spi_size = 0;
 	this->spi.ptr = NULL;
 	this->spi.len = 0;
-	this->logger = logger_manager->get_logger(logger_manager, PAYLOAD);
 	
 	this->transforms = linked_list_create();
 	
diff --git a/src/charon/encoding/payloads/sa_payload.c b/src/charon/encoding/payloads/sa_payload.c
index 32b6b6a7e..e03770d1e 100644
--- a/src/charon/encoding/payloads/sa_payload.c
+++ b/src/charon/encoding/payloads/sa_payload.c
@@ -27,7 +27,7 @@
 
 #include <encoding/payloads/encodings.h>
 #include <utils/linked_list.h>
-#include <utils/logger_manager.h>
+#include <daemon.h>
 
 
 typedef struct private_sa_payload_t private_sa_payload_t;
@@ -61,18 +61,6 @@ struct private_sa_payload_t {
 	 * Proposals in this payload are stored in a linked_list_t.
 	 */
 	linked_list_t * proposals;
-	
-	/**
-	 * Logger for error handling
-	 */
-	logger_t *logger;
-	
-	/**
-	 * @brief Computes the length of this payload.
-	 *
-	 * @param this 	calling private_sa_payload_t object
-	 */
-	void (*compute_length) (private_sa_payload_t *this);
 };
 
 /**
@@ -136,15 +124,15 @@ static status_t verify(private_sa_payload_t *this)
 		{
 			if (first) 
 			{
-				this->logger->log(this->logger, ERROR, "first proposal is not proposal #1");
+				DBG1(SIG_DBG_ENC, "first proposal is not proposal #1");
 				status = FAILED;
 				break;
 			}
 			
 			if (current_number != (expected_number + 1))
 			{
-				this->logger->log(this->logger, ERROR, "proposal number is %d, excepted %d or %d",
-								  current_number, expected_number, expected_number + 1);
+				DBG1(SIG_DBG_ENC, "proposal number is %d, excepted %d or %d",
+					 current_number, expected_number, expected_number + 1);
 				status = FAILED;
 				break;
 			}
@@ -152,7 +140,7 @@ static status_t verify(private_sa_payload_t *this)
 		else if (current_number < expected_number)
 		{
 			/* must not be smaller then proceeding one */
-			this->logger->log(this->logger, ERROR, "proposal number smaller than that of previous proposal");
+			DBG1(SIG_DBG_ENC, "proposal number smaller than that of previous proposal");
 			status = FAILED;
 			break;
 		}
@@ -160,7 +148,7 @@ static status_t verify(private_sa_payload_t *this)
 		status = current_proposal->payload_interface.verify(&(current_proposal->payload_interface));
 		if (status != SUCCESS)
 		{
-			this->logger->log(this->logger, ERROR, "PROPOSAL_SUBSTRUCTURE verification failed");
+			DBG1(SIG_DBG_ENC, "PROPOSAL_SUBSTRUCTURE verification failed");
 			break;
 		}
 		first = FALSE;
@@ -225,11 +213,30 @@ static void set_next_type(private_sa_payload_t *this,payload_type_t type)
 }
 
 /**
+ * recompute length of the payload.
+ */
+static void compute_length (private_sa_payload_t *this)
+{
+	iterator_t *iterator;
+	size_t length = SA_PAYLOAD_HEADER_LENGTH;
+	iterator = this->proposals->create_iterator(this->proposals,TRUE);
+	while (iterator->has_next(iterator))
+	{
+		payload_t *current_proposal;
+		iterator->current(iterator,(void **) &current_proposal);
+		length += current_proposal->get_length(current_proposal);
+	}
+	iterator->destroy(iterator);
+	
+	this->payload_length = length;
+}
+
+/**
  * Implementation of payload_t.get_length.
  */
 static size_t get_length(private_sa_payload_t *this)
 {
-	this->compute_length(this);
+	compute_length(this);
 	return this->payload_length;
 }
 
@@ -259,7 +266,7 @@ static void add_proposal_substructure(private_sa_payload_t *this,proposal_substr
 	proposal->set_is_last_proposal(proposal, TRUE);
 	proposal->set_proposal_number(proposal, proposal_count + 1);
 	this->proposals->insert_last(this->proposals,(void *) proposal);
-	this->compute_length(this);
+	compute_length(this);
 }
 
 /**
@@ -321,25 +328,6 @@ static linked_list_t *get_proposals(private_sa_payload_t *this)
 	return proposal_list;
 }
 
-/**
- * Implementation of private_sa_payload_t.compute_length.
- */
-static void compute_length (private_sa_payload_t *this)
-{
-	iterator_t *iterator;
-	size_t length = SA_PAYLOAD_HEADER_LENGTH;
-	iterator = this->proposals->create_iterator(this->proposals,TRUE);
-	while (iterator->has_next(iterator))
-	{
-		payload_t *current_proposal;
-		iterator->current(iterator,(void **) &current_proposal);
-		length += current_proposal->get_length(current_proposal);
-	}
-	iterator->destroy(iterator);
-	
-	this->payload_length = length;
-}
-
 /*
  * Described in header.
  */
@@ -363,15 +351,10 @@ sa_payload_t *sa_payload_create()
 	this->public.get_proposals = (linked_list_t* (*) (sa_payload_t *)) get_proposals;
 	this->public.destroy = (void (*) (sa_payload_t *)) destroy;
 	
-	/* private functions */
-	this->compute_length = compute_length;
-	
 	/* set default values of the fields */
 	this->critical = FALSE;
 	this->next_payload = NO_PAYLOAD;
 	this->payload_length = SA_PAYLOAD_HEADER_LENGTH;
-	this->logger = logger_manager->get_logger(logger_manager, PARSER);
-
 	this->proposals = linked_list_create();
 	return &this->public;
 }
diff --git a/src/charon/encoding/payloads/traffic_selector_substructure.c b/src/charon/encoding/payloads/traffic_selector_substructure.c
index 6ca600e63..4a1404244 100644
--- a/src/charon/encoding/payloads/traffic_selector_substructure.c
+++ b/src/charon/encoding/payloads/traffic_selector_substructure.c
@@ -26,15 +26,6 @@
 #include <encoding/payloads/encodings.h>
 #include <utils/linked_list.h>
 
-/** 
- * String mappings for ts_type_t.
- */
-mapping_t ts_type_m[] = {
-	{TS_IPV4_ADDR_RANGE, "TS_IPV4_ADDR_RANGE"},
-	{TS_IPV6_ADDR_RANGE, "TS_IPV6_ADDR_RANGE"},
-	{MAPPING_END, NULL}
-};
-
 
 typedef struct private_traffic_selector_substructure_t private_traffic_selector_substructure_t;
 
diff --git a/src/charon/encoding/payloads/transform_attribute.c b/src/charon/encoding/payloads/transform_attribute.c
index 6575bd2b7..eddad000a 100644
--- a/src/charon/encoding/payloads/transform_attribute.c
+++ b/src/charon/encoding/payloads/transform_attribute.c
@@ -65,14 +65,12 @@ struct private_transform_attribute_t {
 	chunk_t attribute_value;
 };
 
-/** 
- * String mappings for transform_attribute_type_t.
- */
-mapping_t transform_attribute_type_m[] = {
-	{ATTRIBUTE_UNDEFINED, "ATTRIBUTE_UNDEFINED"},
-	{KEY_LENGTH, "KEY_LENGTH"},
-	{MAPPING_END, NULL}
-};
+
+ENUM_BEGIN(transform_attribute_type_name, ATTRIBUTE_UNDEFINED, ATTRIBUTE_UNDEFINED,
+	"ATTRIBUTE_UNDEFINED");
+ENUM_NEXT(transform_attribute_type_name, KEY_LENGTH, KEY_LENGTH, ATTRIBUTE_UNDEFINED,
+	"KEY_LENGTH");
+ENUM_END(transform_attribute_type_name, KEY_LENGTH);
 
 /**
  * Encoding rules to parse or generate a Transform attribute.
diff --git a/src/charon/encoding/payloads/transform_attribute.h b/src/charon/encoding/payloads/transform_attribute.h
index 57d79e729..ffc06503c 100644
--- a/src/charon/encoding/payloads/transform_attribute.h
+++ b/src/charon/encoding/payloads/transform_attribute.h
@@ -41,11 +41,11 @@ enum transform_attribute_type_t {
 };
 
 /** 
- * String mappings for transform_attribute_type_t.
+ * enum name for transform_attribute_type_t.
  * 
  * @ingroup payloads
  */
-extern mapping_t transform_attribute_type_m[];
+extern enum_name_t *transform_attribute_type_names;
 
 typedef struct transform_attribute_t transform_attribute_t;
 
diff --git a/src/charon/encoding/payloads/transform_substructure.c b/src/charon/encoding/payloads/transform_substructure.c
index e24191814..59e335a74 100644
--- a/src/charon/encoding/payloads/transform_substructure.c
+++ b/src/charon/encoding/payloads/transform_substructure.c
@@ -29,7 +29,7 @@
 #include <encoding/payloads/encodings.h>
 #include <types.h>
 #include <utils/linked_list.h>
-#include <utils/logger_manager.h>
+#include <daemon.h>
 
 
 typedef struct private_transform_substructure_t private_transform_substructure_t;
@@ -70,18 +70,6 @@ struct private_transform_substructure_t {
 	 * Transforms Attributes are stored in a linked_list_t.
 	 */
 	linked_list_t *attributes;
-	
- 	/**
-	 * assigned logger
-	 */
-	logger_t *logger;
-	
-	/**
-	 * @brief Computes the length of this substructure.
-	 *
-	 * @param this 	calling private_transform_substructure_t object
-	 */
-	void (*compute_length) (private_transform_substructure_t *this);
 };
 
 
@@ -136,7 +124,7 @@ static status_t verify(private_transform_substructure_t *this)
 	if ((this->next_payload != NO_PAYLOAD) && (this->next_payload != 3))
 	{
 		/* must be 0 or 3 */
-		this->logger->log(this->logger, ERROR, "inconsistent next payload");
+		DBG1(SIG_DBG_ENC, "inconsistent next payload");
 		return FAILED;
 	}
 
@@ -152,8 +140,7 @@ static status_t verify(private_transform_substructure_t *this)
 			break;
 		default:
 		{
-			this->logger->log(this->logger, ERROR, "invalid transform type: %d",
-							  this->transform_type);
+			DBG1(SIG_DBG_ENC, "invalid transform type: %d", this->transform_type);
 			return FAILED;
 		}
 	}
@@ -167,8 +154,7 @@ static status_t verify(private_transform_substructure_t *this)
 		status = current_attributes->verify(current_attributes);
 		if (status != SUCCESS)
 		{
-			this->logger->log(this->logger, ERROR, 
-							  "TRANSFORM_ATTRIBUTE verification failed");
+			DBG1(SIG_DBG_ENC, "TRANSFORM_ATTRIBUTE verification failed");
 		}
 	}
 	iterator->destroy(iterator);
@@ -203,12 +189,30 @@ static payload_type_t get_next_type(private_transform_substructure_t *this)
 }
 
 /**
+ * recompute the length of the payload.
+ */
+static void compute_length (private_transform_substructure_t *this)
+{
+	iterator_t *iterator;
+	size_t length = TRANSFORM_SUBSTRUCTURE_HEADER_LENGTH;
+	iterator = this->attributes->create_iterator(this->attributes,TRUE);
+	while (iterator->has_next(iterator))
+	{
+		payload_t * current_attribute;
+		iterator->current(iterator,(void **) &current_attribute);
+		length += current_attribute->get_length(current_attribute);
+	}
+	iterator->destroy(iterator);
+	
+	this->transform_length = length;
+}
+
+/**
  * Implementation of payload_t.get_length.
  */
 static size_t get_length(private_transform_substructure_t *this)
 {
-	this->compute_length(this);
-		
+	compute_length(this);
 	return this->transform_length;
 }
 
@@ -226,7 +230,7 @@ static iterator_t *create_transform_attribute_iterator (private_transform_substr
 static void add_transform_attribute (private_transform_substructure_t *this,transform_attribute_t *attribute)
 {
 	this->attributes->insert_last(this->attributes,(void *) attribute);
-	this->compute_length(this);
+	compute_length(this);
 }
 
 /**
@@ -285,25 +289,6 @@ static u_int16_t get_transform_id (private_transform_substructure_t *this)
 }
 
 /**
- * Implementation of private_transform_substructure_t.compute_length.
- */
-static void compute_length (private_transform_substructure_t *this)
-{
-	iterator_t *iterator;
-	size_t length = TRANSFORM_SUBSTRUCTURE_HEADER_LENGTH;
-	iterator = this->attributes->create_iterator(this->attributes,TRUE);
-	while (iterator->has_next(iterator))
-	{
-		payload_t * current_attribute;
-		iterator->current(iterator,(void **) &current_attribute);
-		length += current_attribute->get_length(current_attribute);
-	}
-	iterator->destroy(iterator);
-	
-	this->transform_length = length;
-}
-
-/**
  * Implementation of transform_substructure_t.clone.
  */
 static transform_substructure_t *clone_(private_transform_substructure_t *this)
@@ -410,16 +395,12 @@ transform_substructure_t *transform_substructure_create()
 	this->public.clone = (transform_substructure_t* (*) (transform_substructure_t *)) clone_;
 	this->public.destroy = (void (*) (transform_substructure_t *)) destroy;
 	
-	/* private functions */
-	this->compute_length = compute_length;
-	
 	/* set default values of the fields */
 	this->next_payload = NO_PAYLOAD;
 	this->transform_length = TRANSFORM_SUBSTRUCTURE_HEADER_LENGTH;
 	this->transform_id = 0;
 	this->transform_type = 0;
 	this->attributes = linked_list_create();
-	this->logger = logger_manager->get_logger(logger_manager, PAYLOAD);
 	
 	return (&(this->public));
 }
diff --git a/src/charon/encoding/payloads/ts_payload.c b/src/charon/encoding/payloads/ts_payload.c
index c026f7e6d..7cd08eeed 100644
--- a/src/charon/encoding/payloads/ts_payload.c
+++ b/src/charon/encoding/payloads/ts_payload.c
@@ -69,13 +69,6 @@ struct private_ts_payload_t {
 	 * Contains the traffic selectors of type traffic_selector_substructure_t.
 	 */
 	linked_list_t *traffic_selectors;
-	
-	/**
-	 * @brief Computes the length of this payload.
-	 *
-	 * @param this 	calling private_ts_payload_t object
-	 */
-	void (*compute_length) (private_ts_payload_t *this);
 };
 
 /**
@@ -196,11 +189,34 @@ static void set_next_type(private_ts_payload_t *this,payload_type_t type)
 }
 
 /**
+ * recompute the length of the payload.
+ */
+static void compute_length (private_ts_payload_t *this)
+{
+	iterator_t *iterator;
+	size_t ts_count = 0;
+	size_t length = TS_PAYLOAD_HEADER_LENGTH;
+	iterator = this->traffic_selectors->create_iterator(this->traffic_selectors,TRUE);
+	while (iterator->has_next(iterator))
+	{
+		payload_t * current_traffic_selector;
+		iterator->current(iterator,(void **) &current_traffic_selector);
+		length += current_traffic_selector->get_length(current_traffic_selector);
+		ts_count++;
+	}
+	iterator->destroy(iterator);
+	
+	this->number_of_traffic_selectors= ts_count;
+	this->payload_length = length;	
+
+}
+
+/**
  * Implementation of payload_t.get_length.
  */
 static size_t get_length(private_ts_payload_t *this)
 {
-	this->compute_length(this);
+	compute_length(this);
 	return this->payload_length;
 }
 
@@ -260,30 +276,6 @@ static linked_list_t *get_traffic_selectors(private_ts_payload_t *this)
 }
 
 /**
- * Implementation of private_ts_payload_t.compute_length.
- */
-static void compute_length (private_ts_payload_t *this)
-{
-	iterator_t *iterator;
-	size_t ts_count = 0;
-	size_t length = TS_PAYLOAD_HEADER_LENGTH;
-	iterator = this->traffic_selectors->create_iterator(this->traffic_selectors,TRUE);
-	while (iterator->has_next(iterator))
-	{
-		payload_t * current_traffic_selector;
-		iterator->current(iterator,(void **) &current_traffic_selector);
-		length += current_traffic_selector->get_length(current_traffic_selector);
-		ts_count++;
-	}
-	iterator->destroy(iterator);
-	
-	this->number_of_traffic_selectors= ts_count;
-	this->payload_length = length;	
-
-}
-
-
-/**
  * Implementation of payload_t.destroy and ts_payload_t.destroy.
  */
 static void destroy(private_ts_payload_t *this)
@@ -326,9 +318,6 @@ ts_payload_t *ts_payload_create(bool is_initiator)
 	this->public.create_traffic_selector_substructure_iterator = (iterator_t* (*) (ts_payload_t *,bool)) create_traffic_selector_substructure_iterator;
 	this->public.get_traffic_selectors = (linked_list_t *(*) (ts_payload_t *)) get_traffic_selectors;
 	
-	/* private functions */
-	this->compute_length = compute_length;
-	
 	/* private variables */
 	this->critical = FALSE;
 	this->next_payload = NO_PAYLOAD;
diff --git a/src/charon/network/socket.c b/src/charon/network/socket.c
index 12dafc8d4..52d44a167 100644
--- a/src/charon/network/socket.c
+++ b/src/charon/network/socket.c
@@ -43,7 +43,6 @@
 #include "socket.h"
 
 #include <daemon.h>
-#include <utils/logger_manager.h>
 
 /* constants for packet handling */
 #define IP_LEN sizeof(struct iphdr)
@@ -126,11 +125,6 @@ struct private_socket_t{
 	  * send socket on nat-t port for IPv6
 	  */
 	 int send6_natt;
-	 
-	 /** 
-	  * logger for this socket
-	  */
-	 logger_t *logger;
 };
 
 /**
@@ -158,8 +152,7 @@ static status_t receiver(private_socket_t *this, packet_t **packet)
 		FD_SET(this->recv6, &rfds);
 	}
 	
-	this->logger->log(this->logger, CONTROL|LEVEL1,
-					  "waiting for data on raw sockets");
+	DBG2(SIG_DBG_NET, "waiting for data on raw sockets");
 	
 	pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, &oldstate);
 	if (select(max(this->recv4, this->recv6) + 1, &rfds, NULL, NULL, NULL) <= 0)
@@ -179,18 +172,16 @@ static status_t receiver(private_socket_t *this, packet_t **packet)
 		bytes_read = recv(this->recv4, buffer, MAX_PACKET, 0);
 		if (bytes_read < 0)
 		{
-			this->logger->log(this->logger, ERROR,
-							  "error reading from IPv4 socket: %m");
+			DBG1(SIG_DBG_NET, "error reading from IPv4 socket: %m");
 			return FAILED;
 		}
-		this->logger->log_bytes(this->logger, RAW,
-								"received IPv4 packet", buffer, bytes_read);
+		DBG3(SIG_DBG_NET, "received IPv4 packet %b", buffer, bytes_read);
 		
 		/* read source/dest from raw IP/UDP header */
 		if (bytes_read < IP_LEN + UDP_LEN + MARKER_LEN)
 		{
-			this->logger->log(this->logger, ERROR,
-							  "received IPv4 packet too short");
+			DBG1(SIG_DBG_NET, "received IPv4 packet too short (%d bytes)",
+				 bytes_read);
 			return FAILED;
 		}
 		ip = (struct iphdr*) buffer;
@@ -207,8 +198,7 @@ static status_t receiver(private_socket_t *this, packet_t **packet)
 		pkt = packet_create();
 		pkt->set_source(pkt, source);
 		pkt->set_destination(pkt, dest);
-		this->logger->log(this->logger, CONTROL|LEVEL1, 
-						  "received packet: from %#H to %#H", source, dest);
+		DBG2(SIG_DBG_NET, "received packet: from %#H to %#H", source, dest);
 		data_offset = IP_LEN + UDP_LEN;
 		/* remove non esp marker */	
 		if (dest->get_port(dest) == this->natt_port)
@@ -244,17 +234,15 @@ static status_t receiver(private_socket_t *this, packet_t **packet)
 		bytes_read = recvmsg(this->recv6, &msg, 0);
 		if (bytes_read < 0)
 		{
-			this->logger->log(this->logger, ERROR, 
-							  "error reading from IPv6 socket: %m");
+			DBG1(SIG_DBG_NET, "error reading from IPv6 socket: %m");
 			return FAILED;
 		}
-		this->logger->log_bytes(this->logger, RAW,
-								"received IPv6 packet", buffer, bytes_read);
+		DBG3(SIG_DBG_NET, "received IPv6 packet %b", buffer, bytes_read);
 		
 		if (bytes_read < IP_LEN + UDP_LEN + MARKER_LEN)
 		{
-			this->logger->log(this->logger, ERROR,
-							  "received IPv6 packet too short");
+			DBG3(SIG_DBG_NET, "received IPv6 packet too short (%d bytes)",
+				 bytes_read);
 			return FAILED;
 		}
 		
@@ -262,10 +250,9 @@ static status_t receiver(private_socket_t *this, packet_t **packet)
 		for (cmsgptr = CMSG_FIRSTHDR(&msg); cmsgptr != NULL;
 			 cmsgptr = CMSG_NXTHDR(&msg, cmsgptr))
 		{
-			if (cmsgptr->cmsg_len == 0) 
+			if (cmsgptr->cmsg_len == 0)
 			{
-				this->logger->log(this->logger, ERROR, 
-								  "error reading IPv6 ancillary data: %m");
+				DBG1(SIG_DBG_NET, "error reading IPv6 ancillary data");
 				return FAILED;
 			}	
 			if (cmsgptr->cmsg_level == SOL_IPV6 &&
@@ -286,8 +273,7 @@ static status_t receiver(private_socket_t *this, packet_t **packet)
 		/* ancillary data missing? */
 		if (dest == NULL)
 		{
-			this->logger->log(this->logger, ERROR, 
-							  "error reading IPv6 packet header");
+			DBG1(SIG_DBG_NET, "error reading IPv6 packet header");
 			return FAILED;
 		}
 		
@@ -296,8 +282,7 @@ static status_t receiver(private_socket_t *this, packet_t **packet)
 		pkt = packet_create();
 		pkt->set_source(pkt, source);
 		pkt->set_destination(pkt, dest);
-		this->logger->log(this->logger, CONTROL|LEVEL1, 
-						  "received packet: from %#H to %#H", source, dest);
+		DBG2(SIG_DBG_NET, "received packet: from %#H to %#H", source, dest);
 		data_offset = UDP_LEN;
 		/* remove non esp marker */	
 		if (dest->get_port(dest) == this->natt_port)
@@ -335,8 +320,7 @@ status_t sender(private_socket_t *this, packet_t *packet)
 	dst = packet->get_destination(packet);
 	data = packet->get_data(packet);
 
-	this->logger->log(this->logger, CONTROL|LEVEL1,
-					  "sending packet: from %#H to %#H", src, dst);
+	DBG2(SIG_DBG_NET, "sending packet: from %#H to %#H", src, dst);
 	
 	/* send data */
 	sport = src->get_port(src);
@@ -368,8 +352,8 @@ status_t sender(private_socket_t *this, packet_t *packet)
 			/* add non esp marker to packet */
 			if (data.len > MAX_PACKET - MARKER_LEN)
 			{
-				this->logger->log(this->logger, ERROR, 
-								  "unable to send packet: it's too big");
+				DBG1(SIG_DBG_NET, "unable to send packet: it's too big (%d bytes)",
+					 data.len);
 				return FAILED;
 			}
 			marked = chunk_alloc(data.len + MARKER_LEN);
@@ -382,8 +366,7 @@ status_t sender(private_socket_t *this, packet_t *packet)
 	}
 	else
 	{
-		this->logger->log(this->logger, ERROR,
-						  "unable to locate a send socket for port %d", sport);
+		DBG1(SIG_DBG_NET, "unable to locate a send socket for port %d", sport);
 		return FAILED;
 	}
 	
@@ -392,8 +375,7 @@ status_t sender(private_socket_t *this, packet_t *packet)
 
 	if (bytes_sent != data.len)
 	{
-		this->logger->log(this->logger, ERROR, 
-						  "error writing to socket: %m");
+		DBG1(SIG_DBG_NET, "error writing to socket: %m");
 		return FAILED;
 	}
 	return SUCCESS;
@@ -551,14 +533,13 @@ static int open_send_socket(private_socket_t *this, int family, u_int16_t port)
 	skt = socket(family, SOCK_DGRAM, IPPROTO_UDP);
 	if (skt < 0)
 	{
-		this->logger->log(this->logger, ERROR, "could not open send socket: %m");
+		DBG1(SIG_DBG_NET, "could not open send socket: %m");
 		return 0;
 	}
 	
 	if (setsockopt(skt, SOL_SOCKET, SO_REUSEADDR, (void*)&on, sizeof(on)) < 0)
 	{
-		this->logger->log(this->logger, ERROR, 
-						  "unable to set SO_REUSEADDR on send socket: %m");
+		DBG1(SIG_DBG_NET, "unable to set SO_REUSEADDR on send socket: %m");
 		close(skt);
 		return 0;
 	}
@@ -574,8 +555,7 @@ static int open_send_socket(private_socket_t *this, int family, u_int16_t port)
 	
 	if (setsockopt(skt, sol, ipsec_policy, &policy, sizeof(policy)) < 0)
 	{
-		this->logger->log(this->logger, ERROR, 
-						  "unable to set IPSEC_POLICY on send socket: %m");
+		DBG1(SIG_DBG_NET, "unable to set IPSEC_POLICY on send socket: %m");
 		close(skt);
 		return 0;
 	}
@@ -585,8 +565,7 @@ static int open_send_socket(private_socket_t *this, int family, u_int16_t port)
 	policy.sadb_x_policy_dir = IPSEC_DIR_INBOUND;
 	if (setsockopt(skt, sol, ipsec_policy, &policy, sizeof(policy)) < 0)
 	{
-		this->logger->log(this->logger, ERROR,
-						  "unable to set IPSEC_POLICY on send socket: %m");
+		DBG1(SIG_DBG_NET, "unable to set IPSEC_POLICY on send socket: %m");
 		close(skt);
 		return 0;
 	}
@@ -594,7 +573,7 @@ static int open_send_socket(private_socket_t *this, int family, u_int16_t port)
 	/* bind the send socket */
 	if (bind(skt, (struct sockaddr *)&addr, sizeof(addr)) < 0)
 	{
-		this->logger->log(this->logger, ERROR, "unable to bind send socket: %m");
+		DBG1(SIG_DBG_NET, "unable to bind send socket: %m");
 		close(skt);
 		return 0;
 	}
@@ -604,8 +583,7 @@ static int open_send_socket(private_socket_t *this, int family, u_int16_t port)
 		/* enable UDP decapsulation globally, only for one socket needed */
 		if (setsockopt(skt, SOL_UDP, UDP_ENCAP, &type, sizeof(type)) < 0)
 		{
-			this->logger->log(this->logger, ERROR,
-							"unable to set UDP_ENCAP: %m; NAT-T may fail");
+			DBG1(SIG_DBG_NET, "unable to set UDP_ENCAP: %m; NAT-T may fail");
 		}
 	}
 	
@@ -686,16 +664,14 @@ static int open_recv_socket(private_socket_t *this, int family)
 	skt = socket(family, SOCK_RAW, IPPROTO_UDP);
 	if (skt < 0)
 	{
-		this->logger->log(this->logger, ERROR,
-						  "unable to create raw socket: %m");
+		DBG1(SIG_DBG_NET, "unable to create raw socket: %m");
 		return 0;
 	}
 	
 	if (setsockopt(skt, SOL_SOCKET, SO_ATTACH_FILTER,
 				   &ikev2_filter, sizeof(ikev2_filter)) < 0)
 	{
-		this->logger->log(this->logger, ERROR, 
-						"unable to attach IKEv2 filter to raw socket: %m");
+		DBG1(SIG_DBG_NET, "unable to attach IKEv2 filter to raw socket: %m");
 		close(skt);
 		return 0;
 	}
@@ -705,8 +681,7 @@ static int open_recv_socket(private_socket_t *this, int family)
 		 * 2 or 50 depending on kernel header version */
 		setsockopt(skt, sol, IPV6_2292PKTINFO, &on, sizeof(on)) < 0)
 	{
-		this->logger->log(this->logger, ERROR, 
-						  "unable to set IPV6_PKTINFO on raw socket: %m");
+		DBG1(SIG_DBG_NET, "unable to set IPV6_PKTINFO on raw socket: %m");
 		close(skt);
 		return 0;
 	}
@@ -722,8 +697,7 @@ static int open_recv_socket(private_socket_t *this, int family)
 	
 	if (setsockopt(skt, sol, ipsec_policy, &policy, sizeof(policy)) < 0)
 	{
-		this->logger->log(this->logger, ERROR, 
-						  "unable to set IPSEC_POLICY on raw socket: %m");
+		DBG1(SIG_DBG_NET, "unable to set IPSEC_POLICY on raw socket: %m");
 		close(skt);
 		return 0;
 	}
@@ -776,8 +750,6 @@ socket_t *socket_create(u_int16_t port, u_int16_t natt_port)
 	this->public.is_local_address = (bool(*)(socket_t*, host_t*,char**))is_local_address;
 	this->public.create_local_address_list = (linked_list_t*(*)(socket_t*))create_local_address_list;
 	this->public.destroy = (void(*)(socket_t*)) destroy;
-
-	this->logger = logger_manager->get_logger(logger_manager, SOCKET);
 	
 	this->port = port;
 	this->natt_port = natt_port;
@@ -791,16 +763,14 @@ socket_t *socket_create(u_int16_t port, u_int16_t natt_port)
 	this->recv4 = open_recv_socket(this, AF_INET);
 	if (this->recv4 == 0)
 	{
-		this->logger->log(this->logger, ERROR, 
-						  "could not open IPv4 receive socket, IPv4 disabled");
+		DBG1(SIG_DBG_NET, "could not open IPv4 receive socket, IPv4 disabled");
 	}
 	else
 	{
 		this->send4 = open_send_socket(this, AF_INET, this->port);
 		if (this->send4 == 0)
 		{
-			this->logger->log(this->logger, ERROR, 
-							  "could not open IPv4 send socket, IPv4 disabled");
+			DBG1(SIG_DBG_NET, "could not open IPv4 send socket, IPv4 disabled");
 			close(this->recv4);
 		}
 		else
@@ -808,8 +778,7 @@ socket_t *socket_create(u_int16_t port, u_int16_t natt_port)
 			this->send4_natt = open_send_socket(this, AF_INET, this->natt_port);
 			if (this->send4_natt == 0)
 			{
-				this->logger->log(this->logger, ERROR, 
-								  "could not open IPv4 NAT-T send socket");
+				DBG1(SIG_DBG_NET, "could not open IPv4 NAT-T send socket");
 			}
 		}
 	}
@@ -817,16 +786,14 @@ socket_t *socket_create(u_int16_t port, u_int16_t natt_port)
 	this->recv6 = open_recv_socket(this, AF_INET6);
 	if (this->recv6 == 0)
 	{
-		this->logger->log(this->logger, ERROR, 
-						  "could not open IPv6 receive socket, IPv6 disabled");
+		DBG1(SIG_DBG_NET, "could not open IPv6 receive socket, IPv6 disabled");
 	}
 	else
 	{
 		this->send6 = open_send_socket(this, AF_INET6, this->port);
 		if (this->send6 == 0)
 		{
-			this->logger->log(this->logger, ERROR, 
-							  "could not open IPv6 send socket, IPv6 disabled");
+			DBG1(SIG_DBG_NET, "could not open IPv6 send socket, IPv6 disabled");
 			close(this->recv6);
 		}
 		else
@@ -834,16 +801,14 @@ socket_t *socket_create(u_int16_t port, u_int16_t natt_port)
 			this->send6_natt = open_send_socket(this, AF_INET6, this->natt_port);
 			if (this->send6_natt == 0)
 			{
-				this->logger->log(this->logger, ERROR, 
-								  "could not open IPv6 NAT-T send socket");
+				DBG1(SIG_DBG_NET, "could not open IPv6 NAT-T send socket");
 			}
 		}
 	}
 	
 	if (!(this->send4 || this->send6) || !(this->recv4 || this->recv6))
 	{
-		this->logger->log(this->logger, ERROR,
-						  "could not create any sockets");
+		DBG1(SIG_DBG_NET, "could not create any sockets");
 		destroy(this);
 		charon->kill(charon, "socket initialization failed");
 	}
diff --git a/src/charon/queues/jobs/acquire_job.c b/src/charon/queues/jobs/acquire_job.c
index 89eccef4a..a5dd43d1c 100644
--- a/src/charon/queues/jobs/acquire_job.c
+++ b/src/charon/queues/jobs/acquire_job.c
@@ -40,11 +40,6 @@ struct private_acquire_job_t {
 	 * reqid of the child to rekey
 	 */
 	u_int32_t reqid;
-	
-	/**
-	 * Logger ref
-	 */
-	logger_t *logger;
 };
 
 /**
@@ -66,8 +61,8 @@ static status_t execute(private_acquire_job_t *this)
 													   this->reqid);
 	if (ike_sa == NULL)
 	{
-		this->logger->log(this->logger, ERROR|LEVEL1, 
-						  "CHILD_SA not found for acquiring");
+		DBG2(SIG_DBG_JOB, "CHILD_SA with reqid %d not found for acquiring",
+			 this->reqid);
 		return DESTROY_ME;
 	}
 	ike_sa->acquire(ike_sa, this->reqid);
@@ -98,7 +93,6 @@ acquire_job_t *acquire_job_create(u_int32_t reqid)
 	
 	/* private variables */
 	this->reqid = reqid;
-	this->logger = logger_manager->get_logger(logger_manager, WORKER);
 	
 	return &(this->public);
 }
diff --git a/src/charon/queues/jobs/delete_child_sa_job.c b/src/charon/queues/jobs/delete_child_sa_job.c
index 45fc452fc..bd25788dc 100644
--- a/src/charon/queues/jobs/delete_child_sa_job.c
+++ b/src/charon/queues/jobs/delete_child_sa_job.c
@@ -51,11 +51,6 @@ struct private_delete_child_sa_job_t {
 	 * inbound SPI of the CHILD_SA
 	 */
 	u_int32_t spi;
-	
-	/**
-	 * Logger ref
-	 */
-	logger_t *logger;
 };
 
 /**
@@ -77,8 +72,8 @@ static status_t execute(private_delete_child_sa_job_t *this)
 													   this->reqid);
 	if (ike_sa == NULL)
 	{
-		this->logger->log(this->logger, ERROR|LEVEL1, 
-						  "CHILD_SA not found for delete");
+		DBG1(SIG_DBG_JOB, "CHILD_SA with reqid %d not found for delete",
+			 this->reqid);
 		return DESTROY_ME;
 	}
 	ike_sa->delete_child_sa(ike_sa, this->protocol, this->spi);
@@ -113,7 +108,6 @@ delete_child_sa_job_t *delete_child_sa_job_create(u_int32_t reqid,
 	this->reqid = reqid;
 	this->protocol = protocol;
 	this->spi = spi;
-	this->logger = logger_manager->get_logger(logger_manager, WORKER);
 	
 	return &(this->public);
 }
diff --git a/src/charon/queues/jobs/delete_ike_sa_job.c b/src/charon/queues/jobs/delete_ike_sa_job.c
index e2a861757..d8b907f98 100644
--- a/src/charon/queues/jobs/delete_ike_sa_job.c
+++ b/src/charon/queues/jobs/delete_ike_sa_job.c
@@ -45,11 +45,6 @@ struct private_delete_ike_sa_job_t {
 	 * Should the IKE_SA be deleted if it is in ESTABLISHED state?
 	 */
 	bool delete_if_established;
-	
-	/**
-	 * logger ref
-	 */
-	logger_t *logger;
 };
 
 /**
@@ -72,7 +67,7 @@ static status_t execute(private_delete_ike_sa_job_t *this)
 		if (charon->ike_sa_manager->delete(charon->ike_sa_manager, 
 			this->ike_sa_id) != SUCCESS)
 		{
-			this->logger->log(this->logger, ERROR|LEVEL1, "IKE SA didn't exist anymore");
+			DBG2(SIG_DBG_JOB, "IKE SA didn't exist anymore");
 		}
 		return DESTROY_ME;
 	}
@@ -96,8 +91,7 @@ static status_t execute(private_delete_ike_sa_job_t *this)
 			default:
 			{
 				/* IKE_SA is half open and gets destroyed */
-				this->logger->log(this->logger, AUDIT,
-								"deleting half open IKE_SA after timeout");
+				DBG1(SIG_DBG_JOB, "deleting half open IKE_SA after timeout");
 				charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, ike_sa);
 				return DESTROY_ME;
 			}
@@ -130,7 +124,6 @@ delete_ike_sa_job_t *delete_ike_sa_job_create(ike_sa_id_t *ike_sa_id,
 	/* private variables */
 	this->ike_sa_id = ike_sa_id->clone(ike_sa_id);
 	this->delete_if_established = delete_if_established;
-	this->logger = logger_manager->get_logger(logger_manager, WORKER);
 	
 	return &(this->public);
 }
diff --git a/src/charon/queues/jobs/incoming_packet_job.c b/src/charon/queues/jobs/incoming_packet_job.c
index 4feff15a6..c09571e2b 100644
--- a/src/charon/queues/jobs/incoming_packet_job.c
+++ b/src/charon/queues/jobs/incoming_packet_job.c
@@ -41,11 +41,6 @@ struct private_incoming_packet_job_t {
 	 * Assigned packet
 	 */
 	packet_t *packet;
-	
-	/**
-	 * logger
-	 */
-	logger_t *logger;
 };
 
 /**
@@ -92,8 +87,7 @@ static void send_notify_response(private_incoming_packet_job_t *this,
 		response->destroy(response);
 		return;
 	}
-	this->logger->log(this->logger, CONTROL, "sending %s notify",
-					  mapping_find(notify_type_m, type)); 
+	DBG1(SIG_DBG_NET, "sending %N notify", notify_type_names, type);
 	charon->send_queue->add(charon->send_queue, packet);
 	response->destroy(response);
 	return;
@@ -113,13 +107,12 @@ static status_t execute(private_incoming_packet_job_t *this)
 	message = message_create_from_packet(this->packet->clone(this->packet));
 	src = message->get_source(message);
 	dst = message->get_destination(message);
-	this->logger->log(this->logger, CONTROL,
-					  "received packet: from %#H to %#H", src, dst);
+	DBG1(SIG_DBG_NET, "received packet: from %#H to %#H", src, dst);
 	
 	status = message->parse_header(message);
 	if (status != SUCCESS)
 	{
-		this->logger->log(this->logger, ERROR, "received message with invalid IKE header, ignored");
+		DBG1(SIG_DBG_NET, "received message with invalid IKE header, ignored");
 		message->destroy(message);
 		return DESTROY_ME;
 	}
@@ -127,10 +120,10 @@ static status_t execute(private_incoming_packet_job_t *this)
 	if ((message->get_major_version(message) != IKE_MAJOR_VERSION) ||
 		(message->get_minor_version(message) != IKE_MINOR_VERSION))
 	{
-		this->logger->log(this->logger, ERROR,
-						  "received a packet with IKE version %d.%d, not supported",
-						  message->get_major_version(message),
-						  message->get_minor_version(message));
+		DBG1(SIG_DBG_NET,
+			 "received a packet with IKE version %d.%d, not supported",
+			  message->get_major_version(message),
+			  message->get_minor_version(message));
 		if ((message->get_exchange_type(message) == IKE_SA_INIT) && (message->get_request(message)))
 		{
 			send_notify_response(this, message, INVALID_MAJOR_VERSION);
@@ -145,14 +138,12 @@ static status_t execute(private_incoming_packet_job_t *this)
 	ike_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager, ike_sa_id);
 	if (ike_sa == NULL)
 	{
-		this->logger->log(this->logger, ERROR,
-						  "received packet with SPIs %llx:%llx, but no such IKE_SA",
-						  ike_sa_id->get_initiator_spi(ike_sa_id),
-						  ike_sa_id->get_responder_spi(ike_sa_id));
+		DBG1(SIG_DBG_NET, "received packet for IKE_SA: %J, but no such IKE_SA",
+			 ike_sa_id);
 		if (message->get_request(message))
 		{
-			/* TODO: send notify if we have NULL crypters, 
-			 * see todo in send_notify_response 
+			/* TODO: send notify if we have NULL crypters,
+			 * see todo in send_notify_response
 			send_notify_response(this, message, INVALID_IKE_SPI); */
 		}
 		ike_sa_id->destroy(ike_sa_id);	
@@ -207,7 +198,6 @@ incoming_packet_job_t *incoming_packet_job_create(packet_t *packet)
 	
 	/* private variables */
 	this->packet = packet;
-	this->logger = logger_manager->get_logger(logger_manager, WORKER);
 	
 	return &(this->public);
 }
diff --git a/src/charon/queues/jobs/initiate_job.c b/src/charon/queues/jobs/initiate_job.c
index 00c4ef32e..9d8edd980 100644
--- a/src/charon/queues/jobs/initiate_job.c
+++ b/src/charon/queues/jobs/initiate_job.c
@@ -48,11 +48,6 @@ struct private_initiate_job_t {
 	 * associated policy to initiate
 	 */
 	policy_t *policy;
-	
-	/**
-	 * logger
-	 */
-	logger_t *logger;
 };
 
 /**
@@ -80,8 +75,7 @@ static status_t execute(private_initiate_job_t *this)
 	this->policy->get_ref(this->policy);
 	if (ike_sa->initiate(ike_sa, this->connection, this->policy) != SUCCESS)
 	{
-		this->logger->log(this->logger, ERROR,
-						  "initiation failed, going to delete IKE_SA");
+		DBG1(SIG_DBG_JOB, "initiation failed, going to delete IKE_SA");
 		charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, ike_sa);
 		return DESTROY_ME;
 	}
@@ -115,7 +109,6 @@ initiate_job_t *initiate_job_create(connection_t *connection, policy_t *policy)
 	/* private variables */
 	this->connection = connection;
 	this->policy = policy;
-	this->logger = logger_manager->get_logger(logger_manager, WORKER);
 	
 	return &this->public;
 }
diff --git a/src/charon/queues/jobs/job.c b/src/charon/queues/jobs/job.c
index fe9127a75..d88843d7c 100644
--- a/src/charon/queues/jobs/job.c
+++ b/src/charon/queues/jobs/job.c
@@ -24,18 +24,16 @@
 
 #include "job.h"
 
-
-mapping_t job_type_m[] = {
-	{INCOMING_PACKET, "INCOMING_PACKET"},
-	{RETRANSMIT_REQUEST, "RETRANSMIT_REQUEST"},
-	{INITIATE, "INITIATE"},
-	{ROUTE, "ROUTE"},
-	{ACQUIRE, "ACQUIRE"},
-	{DELETE_IKE_SA, "DELETE_IKE_SA"},
-	{DELETE_CHILD_SA, "DELETE_CHILD_SA"},
-	{REKEY_CHILD_SA, "REKEY_CHILD_SA"},
-	{REKEY_IKE_SA, "REKEY_IKE_SA"},
-	{SEND_KEEPALIVE, "SEND_KEEPALIVE"},
-	{SEND_DPD, "SEND_DPD"},
-	{MAPPING_END, NULL}
-};
+ENUM(job_type_names, INCOMING_PACKET, SEND_DPD,
+	"INCOMING_PACKET",
+	"RETRANSMIT_REQUEST",
+	"INITIATE",
+	"ROUTE",
+	"ACQUIRE",
+	"DELETE_IKE_SA",
+	"DELETE_CHILD_SA",
+	"REKEY_CHILD_SA",
+	"REKEY_IKE_SA",
+	"SEND_KEEPALIVE",
+	"SEND_DPD",
+);
diff --git a/src/charon/queues/jobs/job.h b/src/charon/queues/jobs/job.h
index 879b9ab12..523c416ec 100644
--- a/src/charon/queues/jobs/job.h
+++ b/src/charon/queues/jobs/job.h
@@ -115,11 +115,11 @@ enum job_type_t {
 };
 
 /**
- * string mappings for job_type_t
+ * enum name  for job_type_t
  * 
  * @ingroup jobs
  */
-extern mapping_t job_type_m[];
+extern enum_name_t *job_type_names;
 
 
 typedef struct job_t job_t;
diff --git a/src/charon/queues/jobs/rekey_child_sa_job.c b/src/charon/queues/jobs/rekey_child_sa_job.c
index e75d1911c..c0b1da0cf 100644
--- a/src/charon/queues/jobs/rekey_child_sa_job.c
+++ b/src/charon/queues/jobs/rekey_child_sa_job.c
@@ -50,11 +50,6 @@ struct private_rekey_child_sa_job_t {
 	 * inbound SPI of the CHILD_SA
 	 */
 	u_int32_t spi;
-	
-	/**
-	 * Logger ref
-	 */
-	logger_t *logger;
 };
 
 /**
@@ -76,8 +71,8 @@ static status_t execute(private_rekey_child_sa_job_t *this)
 													   this->reqid);
 	if (ike_sa == NULL)
 	{
-		this->logger->log(this->logger, ERROR|LEVEL1, 
-						  "CHILD_SA not found for rekeying");
+		DBG2(SIG_DBG_JOB, "CHILD_SA with reqid %d not found for rekeying",
+			 this->reqid);
 		return DESTROY_ME;
 	}
 	ike_sa->rekey_child_sa(ike_sa, this->protocol, this->spi);
@@ -112,7 +107,6 @@ rekey_child_sa_job_t *rekey_child_sa_job_create(u_int32_t reqid,
 	this->reqid = reqid;
 	this->protocol = protocol;
 	this->spi = spi;
-	this->logger = logger_manager->get_logger(logger_manager, WORKER);
 	
 	return &(this->public);
 }
diff --git a/src/charon/queues/jobs/rekey_ike_sa_job.c b/src/charon/queues/jobs/rekey_ike_sa_job.c
index f163af50d..f16581546 100644
--- a/src/charon/queues/jobs/rekey_ike_sa_job.c
+++ b/src/charon/queues/jobs/rekey_ike_sa_job.c
@@ -40,11 +40,6 @@ struct private_rekey_ike_sa_job_t {
 	 * ID of the IKE_SA to rekey
 	 */
 	ike_sa_id_t *ike_sa_id;
-	
-	/**
-	 * Logger ref
-	 */
-	logger_t *logger;
 };
 
 /**
@@ -66,8 +61,7 @@ static status_t execute(private_rekey_ike_sa_job_t *this)
 											  this->ike_sa_id);
 	if (ike_sa == NULL)
 	{
-		this->logger->log(this->logger, ERROR,
-						  "IKE_SA to rekey not found");
+		DBG2(SIG_DBG_JOB, "IKE_SA %J to rekey not found", this->ike_sa_id);
 		return DESTROY_ME;
 	}
 	ike_sa->rekey(ike_sa);
@@ -99,7 +93,6 @@ rekey_ike_sa_job_t *rekey_ike_sa_job_create(ike_sa_id_t *ike_sa_id)
 		
 	/* private variables */
 	this->ike_sa_id = ike_sa_id->clone(ike_sa_id);
-	this->logger = logger_manager->get_logger(logger_manager, WORKER);
 	
 	return &(this->public);
 }
diff --git a/src/charon/queues/jobs/retransmit_request_job.c b/src/charon/queues/jobs/retransmit_request_job.c
index 494897e41..222e80875 100644
--- a/src/charon/queues/jobs/retransmit_request_job.c
+++ b/src/charon/queues/jobs/retransmit_request_job.c
@@ -45,11 +45,6 @@ struct private_retransmit_request_job_t {
 	 * ID of the IKE_SA which the message belongs to.
 	 */
 	ike_sa_id_t *ike_sa_id;
-	
-	/**
-	 * Logger reference
-	 */
-	logger_t *logger;
 };
 
 /**
@@ -70,8 +65,7 @@ static status_t execute(private_retransmit_request_job_t *this)
 	ike_sa = charon->ike_sa_manager->checkout(charon->ike_sa_manager, this->ike_sa_id);
 	if (ike_sa == NULL)
 	{
-		this->logger->log(this->logger, ERROR|LEVEL1, 
-						  "IKE SA could not be checked out. Already deleted?");
+		DBG2(SIG_DBG_JOB, "IKE SA could not be checked out. Already deleted?");
 		return DESTROY_ME;
 	}
 	
@@ -111,7 +105,6 @@ retransmit_request_job_t *retransmit_request_job_create(u_int32_t message_id,ike
 	/* private variables */
 	this->message_id = message_id;
 	this->ike_sa_id = ike_sa_id->clone(ike_sa_id);
-	this->logger = logger_manager->get_logger(logger_manager, WORKER);
 	
 	return &(this->public);
 }
diff --git a/src/charon/queues/jobs/route_job.c b/src/charon/queues/jobs/route_job.c
index b60f117d7..a195a3ed1 100644
--- a/src/charon/queues/jobs/route_job.c
+++ b/src/charon/queues/jobs/route_job.c
@@ -52,11 +52,6 @@ struct private_route_job_t {
 	 * route or unroute?
 	 */
 	bool route;
-	
-	/**
-	 * logger
-	 */
-	logger_t *logger;
 };
 
 /**
@@ -83,16 +78,14 @@ static status_t execute(private_route_job_t *this)
 	{
 		if (ike_sa->route(ike_sa, this->connection, this->policy) != SUCCESS)
 		{
-			this->logger->log(this->logger, ERROR,
-							  "routing failed");
+			DBG1(SIG_DBG_JOB, "routing failed");
 		}
 	}
 	else
 	{
 		if (ike_sa->unroute(ike_sa, this->policy) == DESTROY_ME)
 		{
-			this->logger->log(this->logger, ERROR,
-							  "removing IKE_SA, as last routed CHILD_SA unrouted");
+			DBG1(SIG_DBG_JOB, "removing IKE_SA, as last routed CHILD_SA unrouted");
 			charon->ike_sa_manager->checkin_and_destroy(charon->ike_sa_manager, ike_sa);
 			return DESTROY_ME;
 		}
@@ -127,7 +120,6 @@ route_job_t *route_job_create(connection_t *connection, policy_t *policy, bool r
 	this->connection = connection;
 	this->policy = policy;
 	this->route = route;
-	this->logger = logger_manager->get_logger(logger_manager, WORKER);
 	
 	return &this->public;
 }
diff --git a/src/charon/queues/jobs/send_dpd_job.c b/src/charon/queues/jobs/send_dpd_job.c
index b36593b88..7294d78d5 100644
--- a/src/charon/queues/jobs/send_dpd_job.c
+++ b/src/charon/queues/jobs/send_dpd_job.c
@@ -44,11 +44,6 @@ struct private_send_dpd_job_t {
 	 * ID of the IKE_SA which the message belongs to.
 	 */
 	ike_sa_id_t *ike_sa_id;
-
-	/**
-	 * Logger reference.
-	 */
-	logger_t *logger;
 };
 
 /**
@@ -110,7 +105,6 @@ send_dpd_job_t *send_dpd_job_create(ike_sa_id_t *ike_sa_id)
 	
 	/* private variables */
 	this->ike_sa_id = ike_sa_id->clone(ike_sa_id);
-	this->logger = logger_manager->get_logger(logger_manager, WORKER);
 
 	return &(this->public);
 }
diff --git a/src/charon/queues/jobs/send_keepalive_job.c b/src/charon/queues/jobs/send_keepalive_job.c
index 0a305faed..1c1cb288e 100644
--- a/src/charon/queues/jobs/send_keepalive_job.c
+++ b/src/charon/queues/jobs/send_keepalive_job.c
@@ -44,11 +44,6 @@ struct private_send_keepalive_job_t {
 	 * ID of the IKE_SA which the message belongs to.
 	 */
 	ike_sa_id_t *ike_sa_id;
-
-	/**
-	 * Logger reference.
-	 */
-	logger_t *logger;
 };
 
 /**
@@ -103,7 +98,6 @@ send_keepalive_job_t *send_keepalive_job_create(ike_sa_id_t *ike_sa_id)
 	
 	/* private variables */
 	this->ike_sa_id = ike_sa_id->clone(ike_sa_id);
-	this->logger = logger_manager->get_logger(logger_manager, WORKER);
 
 	return &(this->public);
 }
diff --git a/src/charon/queues/send_queue.c b/src/charon/queues/send_queue.c
index 6091a172d..aa3ac9228 100644
--- a/src/charon/queues/send_queue.c
+++ b/src/charon/queues/send_queue.c
@@ -26,7 +26,8 @@
 #include "send_queue.h"
 
 #include <utils/linked_list.h>
-#include <utils/logger_manager.h>
+#include <bus/bus.h>
+#include <daemon.h>
 
 
 typedef struct private_send_queue_t private_send_queue_t;
@@ -39,7 +40,7 @@ struct private_send_queue_t {
 	/**
 	 * Public part of the send_queue_t object
 	 */
- 	send_queue_t public;
+	send_queue_t public;
 
 	/**
 	 * The packets are stored in a linked list
@@ -56,11 +57,6 @@ struct private_send_queue_t {
 	 * This condvar is used to wake up such a thread
 	 */
 	pthread_cond_t condvar;
-
-	/**
-	 * Logger reference
-	 */
-	logger_t *logger;
 };
 
 /**
@@ -111,8 +107,7 @@ static void add(private_send_queue_t *this, packet_t *packet)
 	
 	src = packet->get_source(packet);
 	dst = packet->get_destination(packet);
-	this->logger->log(this->logger, CONTROL, 
-					  "sending packet: from %#H to %#H", src, dst);
+	DBG1(SIG_DBG_NET, "sending packet: from %#H to %#H", src, dst);
 	
 	pthread_mutex_lock(&this->mutex);
 	this->list->insert_last(this->list, packet);
@@ -152,7 +147,6 @@ send_queue_t *send_queue_create(void)
 	this->list = linked_list_create();
 	pthread_mutex_init(&this->mutex, NULL);
 	pthread_cond_init(&this->condvar, NULL);
-	this->logger = logger_manager->get_logger(logger_manager, SOCKET);
 	
 	return (&this->public);
 }
diff --git a/src/charon/sa/authenticator.c b/src/charon/sa/authenticator.c
index f605062c9..d7b994e66 100644
--- a/src/charon/sa/authenticator.c
+++ b/src/charon/sa/authenticator.c
@@ -47,7 +47,7 @@ struct private_authenticator_t {
 	authenticator_t public;
 
 	/**
-	 * Assigned IKE_SA. Needed to get objects of type prf_t and logger_t.
+	 * Assigned IKE_SA
 	 */
 	ike_sa_t *ike_sa;
 	
@@ -60,57 +60,10 @@ struct private_authenticator_t {
 	 * PRF taken from the IKE_SA.
 	 */
 	prf_t *prf;
-
-	/**
-	 * A logger for.
-	 * 
-	 * Using logger of IKE_SA.
-	 */
-	logger_t *logger;
-	
-	/**
-	 * @brief Builds the octets to be signed (RSA or PSK) as described in section 2.15 of RFC 4306.
-	 * 
-	 * @param this				calling object
-	 * @param last_message		the last message to include in created octets 
-	 * 							(either binary form of IKE_SA_INIT request or IKE_SA_INIT response)
-	 * @param other_nonce		Nonce data received from other peer
-	 * @param id				ID of signer
-	 * @param initiator			Type of peer. TRUE, if it is original initiator, FALSE otherwise
-	 * @return					octets as described in section 2.15. Memory gets allocated and has to get 
-	 * 							destroyed by caller.
-	 */
-	chunk_t (*build_tbs_octets) (private_authenticator_t *this,
-								 chunk_t last_message,
-								 chunk_t other_nonce,
-								 identification_t *id,
-								 bool initiator);
-	
-	/**
-	 * @brief Creates the AUTH data using auth method SHARED_KEY_MESSAGE_INTEGRITY_CODE.
-	 * 
-	 * @param this				calling object
-	 * @param last_message		the last message
-	 * 							(either binary form of IKE_SA_INIT request or IKE_SA_INIT response)
-	 * @param nonce				Nonce data to include in auth data compution
-	 * @param id				ID of signer
-	 * @param initiator			Type of peer. TRUE, if it is original initiator, FALSE otherwise
-	 * @param secret			shared secret as chunk_t. If shared secret is a string,
-	 * 							the NULL termination is not included.
-	 * @return					AUTH data as dscribed in section 2.15 for 
-	 * 							AUTH method SHARED_KEY_MESSAGE_INTEGRITY_CODE.
-	 * 							Memory gets allocated and has to get destroyed by caller.
-	 */
-	chunk_t (*build_shared_key_signature) (private_authenticator_t *this,
-										   chunk_t last_message,
-										   chunk_t nonce,
-										   identification_t *id,
-										   bool initiator,
-										   chunk_t secret);
 };
 
 /**
- * Implementation of private_authenticator_t.build_tbs_octets.
+ * Builds the octets to be signed (RSA or PSK) as described in section 2.15 of RFC 4306
  */
 static chunk_t build_tbs_octets(private_authenticator_t *this,
 								chunk_t last_message, 
@@ -156,7 +109,7 @@ static chunk_t build_tbs_octets(private_authenticator_t *this,
 }
 
 /**
- * Implementation of private_authenticator_t.build_shared_key_signature.
+ * Creates the AUTH data using auth method SHARED_KEY_MESSAGE_INTEGRITY_CODE.
  */
 static chunk_t build_shared_key_signature(private_authenticator_t *this,
 										  chunk_t last_message,
@@ -170,23 +123,18 @@ static chunk_t build_shared_key_signature(private_authenticator_t *this,
 	chunk_t key = {ptr: key_buffer, len: sizeof(key_buffer)};
 	chunk_t auth_data;
 	
-	chunk_t octets = this->build_tbs_octets(this, last_message, nonce, id, initiator);
+	chunk_t octets = build_tbs_octets(this, last_message, nonce, id, initiator);
 	
 	/* AUTH = prf(prf(Shared Secret,"Key Pad for IKEv2"), <msg octets>) */
 	this->prf->set_key(this->prf, secret);
 	this->prf->get_bytes(this->prf, key_pad, key_buffer);
 	this->prf->set_key(this->prf, key);
 	this->prf->allocate_bytes(this->prf, octets, &auth_data);
-	this->logger->log_chunk(this->logger, RAW|LEVEL2, 
-							"octets = message + nonce + prf(Sk_px, IDx')", octets);
-	this->logger->log_chunk(this->logger, PRIVATE|LEVEL2, 
-							"secret", secret);
-	this->logger->log_chunk(this->logger, RAW|LEVEL2, 
-							"keypad", key_pad);
-	this->logger->log_chunk(this->logger, RAW|LEVEL2, 
-							"prf(secret, keypad)", key);
-	this->logger->log_chunk(this->logger,RAW | LEVEL2, 
-							"AUTH = prf(prf(secret, keypad), octets)", auth_data);
+	DBG3(SIG_DBG_IKE, "octets = message + nonce + prf(Sk_px, IDx') %B", &octets);
+	DBG3(SIG_DBG_IKE, "secret %B", &secret);
+	DBG3(SIG_DBG_IKE, "keypad %B", &key_pad);
+	DBG3(SIG_DBG_IKE, "prf(secret, keypad) %B", &key);
+	DBG3(SIG_DBG_IKE, "AUTH = prf(prf(secret, keypad), octets) %B", &auth_data);
 	chunk_free(&octets);
 
 	return auth_data;
@@ -220,19 +168,15 @@ static status_t verify_auth_data (private_authenticator_t *this,
 														 &shared_key);
 			if (status != SUCCESS)
 			{
-				this->logger->log(this->logger, ERROR, 
-								  "no shared key found for '%D' - '%D'",
-								  my_id, other_id);
+				DBG1(SIG_DBG_IKE, "no shared key found for '%D' - '%D'",
+					 my_id, other_id);
 				chunk_free(&shared_key);
 				break;
 			}
 			
-			my_auth_data = this->build_shared_key_signature(this,
-															last_received_packet,
-															my_nonce,
-															other_id,
-															initiator,
-															shared_key);
+			my_auth_data = build_shared_key_signature(this, last_received_packet,
+													  my_nonce, other_id,
+													  initiator, shared_key);
 			chunk_free(&shared_key);
 
 
@@ -251,15 +195,15 @@ static status_t verify_auth_data (private_authenticator_t *this,
 
 			if (public_key == NULL)
 			{
-				this->logger->log(this->logger, ERROR, 
-								  "no RSA public key found for '%D'", other_id);
+				DBG1(SIG_DBG_IKE, "no RSA public key found for '%D'", other_id);
 				status = NOT_FOUND;
 				break;
 			}
 			
-			octets = this->build_tbs_octets(this, last_received_packet, my_nonce, other_id, initiator);
-
-			status = public_key->verify_emsa_pkcs1_signature(public_key, octets, auth_data);
+			octets = build_tbs_octets(this, last_received_packet, my_nonce,
+									  other_id, initiator);
+			status = public_key->verify_emsa_pkcs1_signature(public_key, octets, 
+															 auth_data);
 			chunk_free(&octets);
 			break;
 		}
@@ -269,9 +213,9 @@ static status_t verify_auth_data (private_authenticator_t *this,
 		}
 	}
 	
-	this->logger->log(this->logger, CONTROL, "authentication of '%D' with %s %s",
-					  other_id, enum_name(&auth_method_names, auth_method),
-					  (status == SUCCESS)? "successful":"failed");
+	DBG1(SIG_DBG_IKE, "authentication of '%D' with %N %s",
+		 other_id, auth_method_names, auth_method,
+		 (status == SUCCESS)? "successful":"failed");
 	return status;
 }
 
@@ -285,10 +229,9 @@ static status_t compute_auth_data (private_authenticator_t *this,
 								   identification_t *my_id,
 								   identification_t *other_id,
 								   bool initiator)
-{	
-	this->logger->log(this->logger, CONTROL, 
-					  "authentication of '%D' with %s (myself)",
-					  my_id, enum_name(&auth_method_names, this->auth_method));
+{
+	DBG1(SIG_DBG_IKE, "authentication of '%D' with %N (myself)",
+		 my_id, auth_method_names, this->auth_method);
 
 	switch (this->auth_method)
 	{
@@ -304,21 +247,18 @@ static status_t compute_auth_data (private_authenticator_t *this,
 
 			if (status != SUCCESS)
 			{
-				this->logger->log(this->logger, ERROR,
-								  "no shared key found for '%D' - '%D'",
-								  my_id, other_id);
+				DBG1(SIG_DBG_IKE, "no shared key found for '%D' - '%D'",
+					 my_id, other_id);
 				return status;	
 			}
 			
-			auth_data = this->build_shared_key_signature(this,
-														 last_sent_packet,
-														 other_nonce,
-														 my_id,
-														 initiator,
-														 shared_key);
+			auth_data = build_shared_key_signature(this, last_sent_packet,
+												   other_nonce,  my_id,
+												   initiator, shared_key);
 			chunk_free(&shared_key);
 			*auth_payload = auth_payload_create();
-			(*auth_payload)->set_auth_method(*auth_payload, SHARED_KEY_MESSAGE_INTEGRITY_CODE);
+			(*auth_payload)->set_auth_method(*auth_payload,
+											 SHARED_KEY_MESSAGE_INTEGRITY_CODE);
 			(*auth_payload)->set_data(*auth_payload, auth_data);
 
 			chunk_free(&auth_data);
@@ -326,44 +266,40 @@ static status_t compute_auth_data (private_authenticator_t *this,
 		}
 		case RSA_DIGITAL_SIGNATURE:
 		{
-			char buf[BUF_LEN];
+			chunk_t chunk;
 			chunk_t octets;
 			chunk_t auth_data;
 			status_t status;
 			rsa_public_key_t  *my_pubkey;
 			rsa_private_key_t *my_key;
 
-			this->logger->log(this->logger, CONTROL|LEVEL1,
-							  "looking for RSA public key belonging to '%D'",
+			DBG2(SIG_DBG_IKE, "looking for RSA public key belonging to '%D'",
 							  my_id);
 
 			my_pubkey = charon->credentials->get_rsa_public_key(charon->credentials, my_id);
 			if (my_pubkey == NULL)
 			{
-				this->logger->log(this->logger, ERROR, 
-								  "no RSA public key found for '%D'", my_id);
+				DBG1(SIG_DBG_IKE, "no RSA public key found for '%D'", my_id);
 				return NOT_FOUND;
 			}
-			this->logger->log(this->logger, CONTROL|LEVEL2, "matching RSA public key found");
+			DBG2(SIG_DBG_IKE, "matching RSA public key found");
 			
-			chunk_to_hex(buf, BUF_LEN, my_pubkey->get_keyid(my_pubkey));
-			this->logger->log(this->logger, CONTROL|LEVEL1, "looking for RSA private key with keyid %s", buf);
+			chunk = my_pubkey->get_keyid(my_pubkey);
+			DBG2(SIG_DBG_IKE, "looking for RSA private key with keyid %#B", &chunk);
 
 			my_key = charon->credentials->get_rsa_private_key(charon->credentials, my_pubkey);
 			if (my_key == NULL)
 			{
-				char buf[BUF_LEN];
-
-				chunk_to_hex(buf, BUF_LEN, my_pubkey->get_keyid(my_pubkey));
-				this->logger->log(this->logger, ERROR, 
-								  "no RSA private key found with for %D with keyid %s",
-								  my_id, buf);
+				DBG1(SIG_DBG_IKE, "no RSA private key found with for %D with keyid %#B",
+					 my_id, &chunk);
 				return NOT_FOUND;
 			}
-			this->logger->log(this->logger, CONTROL|LEVEL2, "matching RSA private key found");
+			DBG2(SIG_DBG_IKE, "matching RSA private key found");
 
-			octets = this->build_tbs_octets(this, last_sent_packet, other_nonce, my_id, initiator);
-			status = my_key->build_emsa_pkcs1_signature(my_key, HASH_SHA1, octets, &auth_data);
+			octets = build_tbs_octets(this, last_sent_packet, other_nonce,
+									  my_id, initiator);
+			status = my_key->build_emsa_pkcs1_signature(my_key, HASH_SHA1,
+														octets, &auth_data);
 			chunk_free(&octets);
 
 			if (status != SUCCESS)
@@ -371,7 +307,7 @@ static status_t compute_auth_data (private_authenticator_t *this,
 				my_key->destroy(my_key);
 				return status;
 			}
-			this->logger->log(this->logger, CONTROL|LEVEL2, "successfully signed with RSA private key");
+			DBG2(SIG_DBG_IKE, "successfully signed with RSA private key");
 			
 			*auth_payload = auth_payload_create();
 			(*auth_payload)->set_auth_method(*auth_payload, RSA_DIGITAL_SIGNATURE);
@@ -405,20 +341,13 @@ authenticator_t *authenticator_create(ike_sa_t *ike_sa, auth_method_t auth_metho
 
 	/* Public functions */
 	this->public.destroy = (void(*)(authenticator_t*))destroy;
-	this->public.verify_auth_data = (status_t (*) (authenticator_t*,auth_payload_t*,chunk_t,
-												   chunk_t,identification_t*,identification_t*,bool)) verify_auth_data;
-	this->public.compute_auth_data = (status_t (*) (authenticator_t*,auth_payload_t**,chunk_t,
-												    chunk_t,identification_t*,identification_t*,bool)) compute_auth_data;
-	
-	/* private functions */
-	this->build_tbs_octets = build_tbs_octets;
-	this->build_shared_key_signature = build_shared_key_signature;
+	this->public.verify_auth_data = (status_t (*) (authenticator_t*,auth_payload_t*,chunk_t,chunk_t,identification_t*,identification_t*,bool)) verify_auth_data;
+	this->public.compute_auth_data = (status_t (*) (authenticator_t*,auth_payload_t**,chunk_t,chunk_t,identification_t*,identification_t*,bool)) compute_auth_data;
 	
 	/* private data */
 	this->ike_sa = ike_sa;
 	this->auth_method = auth_method;
 	this->prf = this->ike_sa->get_prf(this->ike_sa);
-	this->logger = logger_manager->get_logger(logger_manager, IKE_SA);
 	
 	return &(this->public);
 }
diff --git a/src/charon/sa/child_sa.c b/src/charon/sa/child_sa.c
index 3a5929759..271bca78a 100644
--- a/src/charon/sa/child_sa.c
+++ b/src/charon/sa/child_sa.c
@@ -22,25 +22,22 @@
  * for more details.
  */
 
+#define _GNU_SOURCE
 #include "child_sa.h"
 
 #include <stdio.h>
 #include <string.h>
+#include <printf.h>
 
 #include <daemon.h>
 
-
-/**
- * String mappings for child_sa_state_t.
- */
-mapping_t child_sa_state_m[] = {
-	{CHILD_CREATED, "CREATED"},
-	{CHILD_INSTALLED, "INSTALLED"},
-	{CHILD_ROUTED, "ROUTED"},
-	{CHILD_REKEYING, "REKEYING"},
-	{CHILD_DELETING, "DELET
NG"},
-	{MAPPING_END, NULL}
-};
+ENUM(child_sa_state_names, CHILD_CREATED, CHILD_DELETING,
+	"CREATED",
+	"ROUTED",
+	"INSTALLED",
+	"REKEYING",
+	"DELETING",
+);
 
 typedef struct sa_policy_t sa_policy_t;
 
@@ -170,11 +167,6 @@ struct private_child_sa_t {
 	 * Specifies if NAT traversal is used
 	 */
 	bool use_natt;
-	
-	/**
-	 * CHILD_SAs own logger
-	 */
-	logger_t *logger;
 };
 
 /**
@@ -254,18 +246,15 @@ static void updown(private_child_sa_t *this, bool up)
 		sa_policy_t *policy;
 		char command[1024];
 		char *ifname = NULL;
-		char *my_str, *other_str;
 		char *my_client, *other_client, *my_client_mask, *other_client_mask;
 		char *pos;
 		FILE *shell;
 		
 		/* get ts strings */
 		iterator->current(iterator, (void**)&policy);
-		my_str = policy->my_ts->get_string(policy->my_ts);
-		other_str = policy->other_ts->get_string(policy->other_ts);
 		
 		/* get subnet/bits from string */
-		my_client = strdup(my_str);
+		asprintf(&my_client, "%R", policy->my_ts);
 		pos = strchr(my_client, '/');
 		*pos = '\0';
 		my_client_mask = pos + 1;
@@ -274,7 +263,7 @@ static void updown(private_child_sa_t *this, bool up)
 		{
 			*pos = '\0';
 		}
-		other_client = strdup(other_str);
+		asprintf(&other_client, "%R", policy->other_ts);
 		pos = strchr(other_client, '/');
 		*pos = '\0';
 		other_client_mask = pos + 1;
@@ -313,8 +302,8 @@ static void updown(private_child_sa_t *this, bool up)
 				"%s"
 				"%s",
 				 up ? "up" : "down",
-				 /* TODO: fix it: streq(this->me.addr->get_string(this->me.addr),
-				 my_client) ? "-host" :*/ "-client",
+				 policy->my_ts->is_host(policy->my_ts,
+							this->me.addr) ? "-host" : "-client",
 				 this->me.addr->get_family(this->me.addr) == AF_INET ? "" : "-ipv6",
 				 this->name,
 				 ifname,
@@ -341,9 +330,7 @@ static void updown(private_child_sa_t *this, bool up)
 
 		if (shell == NULL)
 		{
-			this->logger->log(this->logger, ERROR,
-							  "could not execute updown script '%s'",
-							  this->script);
+			DBG1(SIG_DBG_CHD, "could not execute updown script '%s'", this->script);
 			return;
 		}
 		
@@ -355,8 +342,7 @@ static void updown(private_child_sa_t *this, bool up)
 			{
 				if (ferror(shell))
 				{
-					this->logger->log(this->logger, ERROR,
-									  "error reading output from updown script");
+					DBG1(SIG_DBG_CHD, "error reading output from updown script");
 					return;
 				}
 				else
@@ -371,7 +357,7 @@ static void updown(private_child_sa_t *this, bool up)
 				{	/* trim trailing '\n' */
 					e[-1] = '\0';
 				}
-				this->logger->log(this->logger, ERROR, "updown: %s", resp);
+				DBG1(SIG_DBG_CHD, "updown: %s", resp);
 			}
 		}
 		pclose(shell);
@@ -507,15 +493,14 @@ static status_t install(private_child_sa_t *this, proposal_t *proposal, prf_plus
 		dst = this->other.addr;
 	}
 	
-	this->logger->log(this->logger, CONTROL|LEVEL1, "adding %s %s SA",
-					  mine ? "inbound" : "outbound",
-					  mapping_find(protocol_id_m, this->protocol));
+	DBG2(SIG_DBG_CHD, "adding %s %N SA", mine ? "inbound" : "outbound",
+		 protocol_id_names, this->protocol);
 	
 	/* select encryption algo */
 	if (proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &enc_algo))
 	{
-		this->logger->log(this->logger, CONTROL|LEVEL2, "  using %s for encryption",
-							mapping_find(encryption_algorithm_m, enc_algo->algorithm));
+		DBG2(SIG_DBG_CHD, "  using %N for encryption",
+			 encryption_algorithm_names, enc_algo->algorithm);
 	}
 	else
 	{
@@ -525,8 +510,8 @@ static status_t install(private_child_sa_t *this, proposal_t *proposal, prf_plus
 	/* select integrity algo */
 	if (proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM, &int_algo))
 	{
-		this->logger->log(this->logger, CONTROL|LEVEL2, "  using %s for integrity",
-						  mapping_find(integrity_algorithm_m, int_algo->algorithm));
+		DBG2(SIG_DBG_CHD, "  using %N for integrity",
+			 integrity_algorithm_names, int_algo->algorithm);
 	}
 	else
 	{
@@ -547,9 +532,7 @@ static status_t install(private_child_sa_t *this, proposal_t *proposal, prf_plus
 	
 	
 	/* send SA down to the kernel */
-	this->logger->log(this->logger, CONTROL|LEVEL2,
-						"  SPI 0x%.8x, src %H dst %H",
-						ntohl(spi), src, dst);
+	DBG2(SIG_DBG_CHD, "  SPI 0x%.8x, src %H dst %H", ntohl(spi), src, dst);
 	status = charon->kernel_interface->add_sa(charon->kernel_interface,
 											  src, dst,
 											  spi, this->protocol,
@@ -645,8 +628,8 @@ static status_t add_policies(private_child_sa_t *this, linked_list_t *my_ts_list
 			
 			if (my_ts->get_type(my_ts) != other_ts->get_type(other_ts))
 			{
-				this->logger->log(this->logger, CONTROL|LEVEL1, 
-								  "CHILD_SA policy uses two different IP families, ignored");
+				DBG2(SIG_DBG_CHD,
+					 "CHILD_SA policy uses two different IP families, ignored");
 				continue;
 			}
 			
@@ -654,8 +637,8 @@ static status_t add_policies(private_child_sa_t *this, linked_list_t *my_ts_list
 			if (my_ts->get_protocol(my_ts) != other_ts->get_protocol(other_ts) &&
 				my_ts->get_protocol(my_ts) && other_ts->get_protocol(other_ts))
 			{
-				this->logger->log(this->logger, CONTROL|LEVEL1, 
-								  "CHILD_SA policy uses two different protocols, ignored");
+				DBG2(SIG_DBG_CHD,
+					 "CHILD_SA policy uses two different protocols, ignored");
 				continue;
 			}
 			
@@ -774,134 +757,133 @@ static status_t get_use_time(private_child_sa_t *this, bool inbound, time_t *use
 }
 
 /**
- * Implementation of child_sa_t.log_status.
+ * output handler in printf()
  */
-static void log_status(private_child_sa_t *this, logger_t *logger)
+static int print(FILE *stream, const struct printf_info *info,
+				 const void *const *args)
 {
+	private_child_sa_t *this = *((private_child_sa_t**)(args[0]));
 	iterator_t *iterator;
-	char use_in_str[12] = "unused";
-	char use_out_str[12] = "unused";
-	char rekey_str[12] = "disabled";
-	char enc_str[32] = "";
-	char int_str[32] = "";
-	u_int32_t use_in, use_out, use_fwd, now, rekeying;
+	sa_policy_t *policy;
+	u_int32_t now, rekeying, use;
 	status_t status;
+	size_t written, total_written = 0;
+#define fprintf_sum(...) { written = fprintf(__VA_ARGS__); if (written < 0) return written; total_written += written; }
 	
-	if (logger == NULL)
+	if (this == NULL)
 	{
-		logger = this->logger;
+		return fprintf(stream, "(null)");
 	}
+	
 	now = (u_int32_t)time(NULL);
 	
+	fprintf_sum(stream, "%10s:  %N, reqid: %d", this->name,
+				child_sa_state_names, this->state, this->reqid);
+	
 	if (this->state == CHILD_INSTALLED)
 	{
-		/* query SA times */
-		status = charon->kernel_interface->query_sa(charon->kernel_interface,
-						this->me.addr, this->me.spi, this->protocol, &use_in);
-		if (status == SUCCESS && use_in)
-		{
-			snprintf(use_in_str, sizeof(use_in_str), "%ds", now - use_in);
-		}
-		status = charon->kernel_interface->query_sa(charon->kernel_interface,
-						this->other.addr, this->other.spi, this->protocol, &use_out);
-		if (status == SUCCESS && use_out)
-		{
-			snprintf(use_out_str, sizeof(use_out_str), "%ds", now - use_out);
-		}
-		
-		/* calculate rekey times */
-		if (this->soft_lifetime)
-		{
-			rekeying = this->soft_lifetime - (now - this->install_time);
-			snprintf(rekey_str, sizeof(rekey_str), "%ds", (int)rekeying);
-		}
+		fprintf_sum(stream, ", %N, SPIs (in/out): 0x%x/0x%x",
+					protocol_id_names, this->protocol,
+					htonl(this->me.spi), htonl(this->other.spi));
 		
-		/* algorithms used */
-		if (this->protocol == PROTO_ESP)
+		if (info->alt)
 		{
-			if (this->encryption.key_size)
+			fprintf_sum(stream, "\n%10s:   ", this->name);
+			
+			if (this->protocol == PROTO_ESP)
 			{
-				snprintf(enc_str, sizeof(enc_str), "%s-%d,", 
-						mapping_find(encryption_algorithm_m, this->encryption.algorithm),
-						this->encryption.key_size);
+				fprintf_sum(stream, "%N",
+							encryption_algorithm_names, this->encryption.algorithm);
+				
+				if (this->encryption.key_size)
+				{
+					fprintf_sum(stream, "-%d", this->encryption.key_size);
+				}
+				fprintf_sum(stream, "/");
+			}
+			
+			fprintf_sum(stream, "%N",
+						integrity_algorithm_names, this->integrity.algorithm);
+			if (this->integrity.key_size)
+			{
+				fprintf_sum(stream, "-%d", this->integrity.key_size);
+			}
+			fprintf_sum(stream, ", rekeying: ");
+			
+			/* calculate rekey times */
+			if (this->soft_lifetime)
+			{
+				rekeying = this->soft_lifetime - (now - this->install_time);
+				fprintf_sum(stream, "%ds", rekeying);
 			}
 			else
 			{
-				snprintf(enc_str, sizeof(enc_str), "%s,", 
-						mapping_find(encryption_algorithm_m, this->encryption.algorithm));
+				fprintf_sum(stream, "disabled");
 			}
 		}
-		if (this->integrity.key_size)
-		{
-			snprintf(int_str, sizeof(int_str), "%s-%d", 
-					mapping_find(integrity_algorithm_m, this->integrity.algorithm),
-					this->integrity.key_size);
-		}
-		else
-		{
-			snprintf(int_str, sizeof(int_str), "%s", 
-					mapping_find(integrity_algorithm_m, this->integrity.algorithm));
-		}
-		
-		logger->log(logger, CONTROL|LEVEL1,
-					"  \"%s\":   state: %s, reqid: %d, ",
-					this->name, mapping_find(child_sa_state_m, this->state), this->reqid);
-		logger->log(logger, CONTROL|LEVEL1,
-					"  \"%s\":    %s (%s%s), SPIs (in/out): 0x%x/0x%x",
-					this->name, this->protocol == PROTO_ESP ? "ESP" : "AH",
-					enc_str, int_str,
-					htonl(this->me.spi), htonl(this->other.spi));
-		logger->log(logger, CONTROL|LEVEL1,
-					"  \"%s\":    rekeying: %s, key age (in/out): %s/%s",
-					this->name, rekey_str, use_in_str, use_out_str);
 	}
-	else
-	{
-		logger->log(logger, CONTROL|LEVEL1, "  \"%s\":   state: %s, reqid: %d",
-					this->name, mapping_find(child_sa_state_m, this->state), 
-					this->reqid);
-	}
-	
+#undef fprintf_sum
+#define fprintf_sum(...) { written = fprintf(__VA_ARGS__); if (written < 0) { iterator->destroy(iterator); return written; } total_written += written; }
 	iterator = this->policies->create_iterator(this->policies, TRUE);
-	while (iterator->has_next(iterator))
+	while (iterator->iterate(iterator, (void**)&policy))
 	{
-		sa_policy_t *policy;
-		char *my_str;
-		char *other_str;
-		char pol_in_str[12] = "unused";
-		char pol_out_str[12] = "unused";
-		char pol_fwd_str[12] = "unused";
-		
-		/* get ts strings */
-		iterator->current(iterator, (void**)&policy);
-		my_str = policy->my_ts->get_string(policy->my_ts);
-		other_str = policy->other_ts->get_string(policy->other_ts);
+		fprintf_sum(stream, "\n%10s:    %R===%R, last use (in/out/fwd): ",
+					this->name, policy->my_ts, policy->other_ts);
 		
 		/* query policy times */
 		status = charon->kernel_interface->query_policy(charon->kernel_interface,
-						policy->other_ts, policy->my_ts, POLICY_IN, &use_in);
-		if (status == SUCCESS && use_in)
+							policy->other_ts, policy->my_ts, POLICY_IN, &use);
+		if (status == SUCCESS && use)
+		{
+			fprintf_sum(stream, "%ds/", now - use);
+		}
+		else
 		{
-			snprintf(pol_in_str, sizeof(pol_in_str), "%ds", now - use_in);
+			fprintf_sum(stream, "unused/");
 		}
 		status = charon->kernel_interface->query_policy(charon->kernel_interface,
-						policy->my_ts, policy->other_ts, POLICY_OUT, &use_out);
-		if (status == SUCCESS && use_out)
+				policy->my_ts, policy->other_ts, POLICY_OUT, &use);
+		if (status == SUCCESS && use)
+		{
+			fprintf_sum(stream, "%ds/", now - use);
+		}
+		else
 		{
-			snprintf(pol_out_str, sizeof(pol_out_str), "%ds", now - use_out);
+			fprintf_sum(stream, "unused/");
 		}
 		status = charon->kernel_interface->query_policy(charon->kernel_interface,
-						policy->other_ts, policy->my_ts, POLICY_FWD, &use_fwd);
-		if (status == SUCCESS && use_fwd)
+				policy->other_ts, policy->my_ts, POLICY_FWD, &use);
+		if (status == SUCCESS && use)
 		{
-			snprintf(pol_fwd_str, sizeof(pol_fwd_str), "%ds", now - use_fwd);
+			fprintf_sum(stream, "%ds", now - use);
+		}
+		else
+		{
+			fprintf_sum(stream, "unused");
 		}
-		
-		logger->log(logger, CONTROL, 
-					"  \"%s\":     %s====%s, last use (in/out/fwd): %s/%s/%s",
-					this->name, my_str, other_str, pol_in_str, pol_out_str, pol_fwd_str);
 	}
 	iterator->destroy(iterator);
+	return total_written;
+}
+
+/**
+ * arginfo handler in printf()
+ */
+static int print_arginfo(const struct printf_info *info, size_t n, int *argtypes)
+{
+	if (n > 0)
+	{
+		argtypes[0] = PA_POINTER;
+	}
+	return 1;
+}
+
+/**
+ * register printf() handlers
+ */
+static void __attribute__ ((constructor))print_register()
+{
+	register_printf_function(CHILD_SA_PRINTF_SPEC, print, print_arginfo);
 }
 
 /**
@@ -936,10 +918,8 @@ static status_t update_sa_hosts(private_child_sa_t *this, host_t *new_me, host_t
 		spi = this->me.spi;
 	}
 	
-	this->logger->log(this->logger, CONTROL|LEVEL1,
-					  "updating %s SA 0x%x, from %#H..#H to %#H..%#H",
-					  mapping_find(protocol_id_m, this->protocol), ntohl(spi),
-					  src, dst, new_src, new_dst);
+	DBG2(SIG_DBG_CHD, "updating %N SA 0x%x, from %#H..#H to %#H..%#H",
+		 protocol_id_names, this->protocol, ntohl(spi), src, dst, new_src, new_dst);
 	
 	status = charon->kernel_interface->update_sa(charon->kernel_interface,
 												 dst, spi, this->protocol, 
@@ -1138,11 +1118,9 @@ child_sa_t * child_sa_create(u_int32_t rekey, host_t *me, host_t* other,
 	this->public.get_rekeying_transaction = (void* (*)(child_sa_t*))get_rekeying_transaction;
 	this->public.set_state = (void(*)(child_sa_t*,child_sa_state_t))set_state;
 	this->public.get_state = (child_sa_state_t(*)(child_sa_t*))get_state;
-	this->public.log_status = (void (*)(child_sa_t*, logger_t*))log_status;
 	this->public.destroy = (void(*)(child_sa_t*))destroy;
 
 	/* private data */
-	this->logger = logger_manager->get_logger(logger_manager, CHILD_SA);
 	this->name = strdup("(uninitialized)");
 	this->me.addr = me->clone(me);
 	this->other.addr = other->clone(other);
diff --git a/src/charon/sa/child_sa.h b/src/charon/sa/child_sa.h
index 1bc396695..d2c9ba1ca 100644
--- a/src/charon/sa/child_sa.h
+++ b/src/charon/sa/child_sa.h
@@ -29,13 +29,17 @@
 #include <crypto/prf_plus.h>
 #include <encoding/payloads/proposal_substructure.h>
 #include <config/proposal.h>
-#include <utils/logger.h>
 
 /**
  * Where we should start with reqid enumeration
  */
 #define REQID_START 2000000000
 
+/**
+ * Printf() specifier for child_sa_t
+ */
+#define CHILD_SA_PRINTF_SPEC 'P'
+
 typedef enum child_sa_state_t child_sa_state_t;
 
 /**
@@ -70,9 +74,9 @@ enum child_sa_state_t {
 };
 
 /**
- * String mappings for child_sa_state_t.
+ * enum strings for child_sa_state_t.
  */
-extern mapping_t child_sa_state_m[];
+extern enum_name_t *child_sa_state_names;
 
 typedef struct child_sa_t child_sa_t;
 
@@ -280,19 +284,6 @@ struct child_sa_t {
 	void* (*get_rekeying_transaction) (child_sa_t *this);
 	
 	/**
-	 * @brief Log the status of a child_sa to a logger.
-	 *
-	 * The status of ESP/AH SAs is logged with the supplied logger in
-	 * a human readable form.
-	 * Supplying NULL as logger uses the internal child_sa logger
-	 * to do the logging.
-	 *
-	 * @param this 		calling object
-	 * @param logger	logger to use for logging
-	 */	
-	void (*log_status) (child_sa_t *this, logger_t *logger);
-	
-	/**
 	 * @brief Destroys a child_sa.
 	 *
 	 * @param this 		calling object
diff --git a/src/charon/sa/ike_sa.c b/src/charon/sa/ike_sa.c
index 0384c37dc..c7e0a51ad 100644
--- a/src/charon/sa/ike_sa.c
+++ b/src/charon/sa/ike_sa.c
@@ -24,6 +24,7 @@
 
 #include <sys/time.h>
 #include <string.h>
+#include <printf.h>
 
 #include "ike_sa.h"
 
@@ -31,7 +32,6 @@
 #include <daemon.h>
 #include <definitions.h>
 #include <utils/linked_list.h>
-#include <utils/logger_manager.h>
 #include <crypto/diffie_hellman.h>
 #include <crypto/prf_plus.h>
 #include <crypto/crypters/crypter.h>
@@ -58,18 +58,13 @@
 #include <queues/jobs/route_job.h>
 #include <queues/jobs/initiate_job.h>
 
-/**
- * String mappings for ike_sa_state_t.
- */
-mapping_t ike_sa_state_m[] = {
-	{IKE_CREATED, "CREATED"},
-	{IKE_CONNECTING, "CONNECTING"},
-	{IKE_ESTABLISHED, "ESTABLISHED"},
-	{IKE_REKEYING, "REKEYING"},
-	{IKE_DELETING, "DELETING"},
-	{MAPPING_END, NULL}
-};
-
+ENUM(ike_sa_state_names, IKE_CREATED, IKE_DELETING,
+	"CREATED",
+	"CONNECTING",
+	"ESTABLISHED",
+	"REKEYING",
+	"DELETING",
+);
 
 typedef struct private_ike_sa_t private_ike_sa_t;
 
@@ -164,11 +159,6 @@ struct private_ike_sa_t {
 	prf_t *prf_auth_r;
 	
 	/**
-	 * A logger for this IKE_SA.
-	 */
-	logger_t *logger;
-	
-	/**
 	 * NAT hasher.
 	 */
 	hasher_t *nat_hasher;
@@ -449,8 +439,7 @@ static void dpd_detected(private_ike_sa_t *this)
 	dpd_action_t action;
 	job_t *job;
 	
-	this->logger->log(this->logger, CONTROL|LEVEL1,
-					  "dead peer detected, handling CHILD_SAs dpd action");
+	DBG2(SIG_DBG_IKE, "dead peer detected, handling CHILD_SAs dpd action");
 	
 	while(this->child_sas->remove_first(this->child_sas,
 		  									(void**)&child_sa) == SUCCESS)
@@ -464,8 +453,7 @@ static void dpd_detected(private_ike_sa_t *this)
 											  this->my_host, this->other_host);
 		if (policy == NULL)
 		{
-			this->logger->log(this->logger, ERROR,
-							  "no policy found for this CHILD_SA");
+			SIG(SIG_CHILD_FAILED, "no policy for CHILD to handle DPD");
 			continue;
 		}
 		
@@ -479,15 +467,13 @@ static void dpd_detected(private_ike_sa_t *this)
 											this->my_host, this->other_host);
 			if (connection == NULL)
 			{
-				this->logger->log(this->logger, ERROR,
-								  "no connection found for this IKE_SA");
+				SIG(SIG_IKE_FAILED, "no connection found to handle DPD");
 				break;
 			}
 		}
 		
-		this->logger->log(this->logger, CONTROL, "dpd action for %s is %s", 
-						  policy->get_name(policy),
-						  enum_name(&dpd_action_names, action));
+		DBG1(SIG_DBG_IKE, "dpd action for %s is %N",
+			 policy->get_name(policy), dpd_action_names, action);
 		
 		switch (action)
 		{
@@ -530,9 +516,8 @@ static status_t transmit_request(private_ike_sa_t *this)
 															this->retrans_sequences);
 	if (timeout == 0)
 	{
-		this->logger->log(this->logger, ERROR,
-						  "giving up after %d retransmits, deleting IKE_SA",
-						  transmitted - 1);
+		SIG(SIG_IKE_FAILED, "giving up after %d retransmits, deleting IKE_SA",
+			transmitted - 1);
 		dpd_detected(this);
 		return DESTROY_ME;
 	}
@@ -540,8 +525,7 @@ static status_t transmit_request(private_ike_sa_t *this)
 	status = transaction->get_request(transaction, &request);
 	if (status != SUCCESS)
 	{
-		this->logger->log(this->logger, ERROR,
-						  "generating request failed");
+		/* generating request failed */
 		return status;
 	}
 	message_id = transaction->get_message_id(transaction);
@@ -551,18 +535,15 @@ static status_t transmit_request(private_ike_sa_t *this)
 		status = request->generate(request, this->crypter_out, this->signer_out, &packet);
 		if (status != SUCCESS)
 		{
-			this->logger->log(this->logger, ERROR,
-							  "request generation failed. transaction discarded");
+			DBG1(SIG_DBG_IKE, "request generation failed. transaction discarded");
 			return FAILED;
 		}
 	}
 	else
 	{
-		this->logger->log(this->logger, CONTROL, 
-						  "sending retransmit %d for %s request with message ID %d",
-						  transmitted,
-						  mapping_find(exchange_type_m, request->get_exchange_type(request)),
-						  message_id);
+		DBG1(SIG_DBG_IKE, "sending retransmit %d for %N request with messageID %d",
+			transmitted, exchange_type_names, request->get_exchange_type(request),
+			message_id);
 		packet = request->get_packet(request);
 	}
 	/* finally send */
@@ -614,13 +595,9 @@ static status_t process_transaction_queue(private_ike_sa_t *this)
 				return SUCCESS;
 			case DESTROY_ME:
 				/* critical, IKE_SA unusable, destroy immediately */
-				this->logger->log(this->logger, ERROR, 
-								  "transaction initiaton failed, deleting IKE_SA");
 				return DESTROY_ME;
 			default:
 				/* discard transaction, process next one */
-				this->logger->log(this->logger, ERROR, 
-								  "transaction initiation failed, discarded");
 				this->transaction_out->destroy(this->transaction_out);
 				this->transaction_out = NULL;
 				/* handle next transaction */
@@ -672,9 +649,8 @@ static status_t process_request(private_ike_sa_t *this, message_t *request)
 		if (last_mid == request_mid)
 		{
 			/* retransmit detected */
-			this->logger->log(this->logger, ERROR,
-							  "received retransmitted request for message ID %d, retransmitting response",
-							  request_mid);
+			DBG1(SIG_DBG_IKE, "received retransmitted request for message "
+				 "ID %d, retransmitting response", request_mid);
 			last->get_response(last, request, &response, &this->transaction_in_next);
 			packet = response->get_packet(response);
 			charon->send_queue->add(charon->send_queue, packet);
@@ -685,17 +661,15 @@ static status_t process_request(private_ike_sa_t *this, message_t *request)
 		if (last_mid > request_mid)
 		{
 			/* something seriously wrong here, message id may not decrease */
-			this->logger->log(this->logger, ERROR,
-							  "received request with message ID %d, excepted %d, ingored",
-							  request_mid, last_mid + 1);
+			DBG1(SIG_DBG_IKE, "received request with message ID %d, "
+				 "excepted %d, ingored", request_mid, last_mid + 1);
 			return FAILED;
 		}
 		/* we allow jumps in message IDs, as long as they are incremental */
 		if (last_mid + 1 < request_mid)
 		{
-			this->logger->log(this->logger, ERROR,
-							  "received request with message ID %d, excepted %d",
-							  request_mid, last_mid + 1);
+			DBG1(SIG_DBG_IKE, "received request with message ID %d, excepted %d",
+				 request_mid, last_mid + 1);
 		}
 	}
 	else
@@ -703,9 +677,8 @@ static status_t process_request(private_ike_sa_t *this, message_t *request)
 		if (request_mid != 0)
 		{
 			/* warn, but allow it */
-			this->logger->log(this->logger, CONTROL,
-							  "first received request has message ID %d, excepted 0", 
-							  request_mid);
+			DBG1(SIG_DBG_IKE, "first received request has message ID %d, "
+				 "excepted 0", request_mid);
 		}
 	}
 	
@@ -720,9 +693,8 @@ static status_t process_request(private_ike_sa_t *this, message_t *request)
 		current = transaction_create(&this->public, request);
 		if (current == NULL)
 		{
-			this->logger->log(this->logger, ERROR, 
-							  "no idea how to handle received message (%d), ignored",
-							  request->get_exchange_type(request));
+			DBG1(SIG_DBG_IKE, "no idea how to handle received message (exchange"
+				 " type %d), ignored", request->get_exchange_type(request));
 			return FAILED;
 		}
 	}
@@ -731,8 +703,7 @@ static status_t process_request(private_ike_sa_t *this, message_t *request)
 	status = current->get_response(current, request, &response, &this->transaction_in_next);
 	if (response->generate(response, this->crypter_out, this->signer_out, &packet) != SUCCESS)
 	{
-		this->logger->log(this->logger, ERROR, 
-						  "response generation failed, discarding transaction");
+		DBG1(SIG_DBG_IKE, "response generation failed, discarding transaction");
 		current->destroy(current);
 		return FAILED;
 	}
@@ -769,8 +740,8 @@ static status_t process_response(private_ike_sa_t *this, message_t *response)
 	if (current == NULL ||
 		current->get_message_id(current) != response->get_message_id(response))
 	{
-		this->logger->log(this->logger, ERROR, 
-						  "received response with message ID %d not requested, ignored");
+		DBG1(SIG_DBG_IKE, "received response with message ID %d "
+			 "not requested, ignored", response->get_message_id(response));
 		return FAILED;
 	}
 	
@@ -839,42 +810,38 @@ static status_t process_message(private_ike_sa_t *this, message_t *message)
 	status = message->parse_body(message, this->crypter_in, this->signer_in);
 	if (status != SUCCESS)
 	{
+		
 		if (is_request)
 		{
 			switch (status)
 			{
 				case NOT_SUPPORTED:
-					this->logger->log(this->logger, ERROR,
-									"ciritcal unknown payloads found");
+					DBG1(SIG_DBG_IKE, "ciritcal unknown payloads found");
 					if (is_request)
 					{
 						send_notify_response(this, message, UNSUPPORTED_CRITICAL_PAYLOAD);
 					}
 					break;
 				case PARSE_ERROR:
-					this->logger->log(this->logger, ERROR,
-									"message parsing failed");
+					DBG1(SIG_DBG_IKE, "message parsing failed");
 					if (is_request)
 					{
 						send_notify_response(this, message, INVALID_SYNTAX);
 					}
 					break;
 				case VERIFY_ERROR:
-					this->logger->log(this->logger, ERROR,
-									"message verification failed");
+					DBG1(SIG_DBG_IKE, "message verification failed");
 					if (is_request)
 					{
 						send_notify_response(this, message, INVALID_SYNTAX);
 					}
 					break;
 				case FAILED:
-					this->logger->log(this->logger, ERROR,
-									"integrity check failed");
+					DBG1(SIG_DBG_IKE, "integrity check failed");
 					/* ignored */
 					break;
 				case INVALID_STATE:
-					this->logger->log(this->logger, ERROR,
-									"found encrypted message, but no keys available");
+					DBG1(SIG_DBG_IKE, "found encrypted message, but no keys available");
 					if (is_request)
 					{
 						send_notify_response(this, message, INVALID_SYNTAX);
@@ -883,11 +850,10 @@ static status_t process_message(private_ike_sa_t *this, message_t *message)
 					break;
 			}
 		}
-		this->logger->log(this->logger, ERROR,
-						  "%s %s with message ID %d processing failed",
-						  mapping_find(exchange_type_m, message->get_exchange_type(message)),
-						  message->get_request(message) ? "request" : "response",
-						  message->get_message_id(message));
+		DBG1(SIG_DBG_IKE, "%N %s with message ID %d processing failed",
+			 exchange_type_names, message->get_exchange_type(message),
+			 message->get_request(message) ? "request" : "response",
+			 message->get_message_id(message));
 	}
 	else
 	{
@@ -927,8 +893,7 @@ static status_t initiate(private_ike_sa_t *this,
 			 */
 			ike_sa_init_t *ike_sa_init;
 			
-			this->logger->log(this->logger, CONTROL, 
-							  "initiating IKE_SA");
+			SIG(SIG_INITIATE, "initiating new IKE_SA for CHILD_SA");
 			DESTROY_IF(this->my_host);
 			this->my_host = connection->get_my_host(connection);
 			this->my_host = this->my_host->clone(this->my_host);
@@ -938,6 +903,17 @@ static status_t initiate(private_ike_sa_t *this,
 			this->retrans_sequences = connection->get_retrans_seq(connection);
 			this->dpd_delay = connection->get_dpd_delay(connection);
 			
+			if (this->other_host->is_anyaddr(this->other_host))
+			{
+				SIG(SIG_IKE_FAILED,
+					"can not initiate a connection to %%any, aborting");
+				SIG(SIG_CHILD_FAILED,
+					"unable to create an IKE_SA to instantiate policy");
+				policy->destroy(policy);
+				connection->destroy(connection);
+				return DESTROY_ME;
+			}
+			
 			this->message_id_out = 1;
 			ike_sa_init = ike_sa_init_create(&this->public);
 			ike_sa_init->set_config(ike_sa_init, connection, policy);
@@ -946,10 +922,12 @@ static status_t initiate(private_ike_sa_t *this,
 		case IKE_DELETING:
 		case IKE_REKEYING:
 		{
-			/* if we are in DELETING/REKEYING, we deny set up of a policy. */
-			this->logger->log(this->logger, CONTROL, 
-							  "creating CHILD_SA discarded, as IKE_SA is in state %s",
-							  mapping_find(ike_sa_state_m, this->state));
+			/* if we are in DELETING/REKEYING, we deny set up of a policy.
+			 * TODO: would it make sense to queue the transaction and adopt
+			 * it all transactions to the new IKE_SA? */
+			SIG(SIG_CHILD_FAILED,
+				"creating CHILD_SA discarded, as IKE_SA is in state %N",
+				ike_sa_state_names, this->state);
 			policy->destroy(policy);
 			connection->destroy(connection);
 			return FAILED;
@@ -957,16 +935,14 @@ static status_t initiate(private_ike_sa_t *this,
 		case IKE_CONNECTING:
 		case IKE_ESTABLISHED:
 		{
-			/* if we are ESTABLISHED or CONNECTING,we queue the 
+			/* if we are ESTABLISHED or CONNECTING, we queue the
 			 * transaction to create the CHILD_SA. It gets processed
 			 * when the IKE_SA is ready to do so. We don't need the
 			 * connection, as the IKE_SA is already established/establishing.
 			 */
 			create_child_sa_t *create_child;
 			
-			this->logger->log(this->logger, CONTROL, 
-							  "initiating CHILD_SA");
-			
+			SIG(SIG_INITIATE, "creating CHILD_SA in existing IKE_SA");
 			connection->destroy(connection);
 			create_child = create_child_sa_create(&this->public);
 			create_child->set_policy(create_child, policy);
@@ -989,13 +965,11 @@ static status_t acquire(private_ike_sa_t *this, u_int32_t reqid)
 	
 	if (this->state == IKE_DELETING)
 	{
-		this->logger->log(this->logger, CONTROL, 
-						  "acquiring CHILD_SA with reqid %d discarded, as IKE_SA is deleting",
-						  reqid);
+		SIG(SIG_CHILD_FAILED, "acquiring CHILD_SA (reqid %d) failed: "
+			"IKE_SA is deleting", reqid);
 		return FAILED;
 	}
 	
-	
 	/* find CHILD_SA */
 	iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
 	while (iterator->iterate(iterator, (void**)&current))
@@ -1009,9 +983,8 @@ static status_t acquire(private_ike_sa_t *this, u_int32_t reqid)
 	iterator->destroy(iterator);
 	if (!child_sa)
 	{
-		this->logger->log(this->logger, ERROR, 
-						  "CHILD_SA with reqid %d not found, unable to acquire",
-						  reqid);
+		SIG(SIG_CHILD_FAILED, "acquiring CHILD_SA (reqid %d) failed: "
+			"CHILD_SA not found", reqid);
 		return FAILED;
 	}
 	my_ts = child_sa->get_my_traffic_selectors(child_sa);
@@ -1023,9 +996,8 @@ static status_t acquire(private_ike_sa_t *this, u_int32_t reqid)
 										  this->my_host, this->other_host);
 	if (policy == NULL)
 	{
-		this->logger->log(this->logger, ERROR, 
-						  "no policy found to acquire CHILD_SA with reqid %d", 
-						  reqid);
+		SIG(SIG_CHILD_FAILED, "acquiring CHILD_SA (reqid %d) failed: "
+			"no policy found", reqid);
 		return FAILED;
 	}
 	
@@ -1035,18 +1007,16 @@ static status_t acquire(private_ike_sa_t *this, u_int32_t reqid)
 		{
 			ike_sa_init_t *ike_sa_init;
 			
-			this->logger->log(this->logger, CONTROL,
-							  "acquiring CHILD_SA with reqid %d, IKE_SA setup needed", 
-							  reqid);
+			DBG1(SIG_DBG_CHD,
+				 "acquiring CHILD_SA with reqid %d, IKE_SA setup needed", reqid);
 			
 			connection = charon->connections->get_connection_by_hosts(
 					charon->connections, this->my_host, this->other_host);
 			
 			if (connection == NULL)
 			{
-				this->logger->log(this->logger, ERROR, 
-								  "no connection found to acquire IKE_SA for CHILD_SA with reqid %d", 
-								  reqid);
+				SIG(SIG_CHILD_FAILED, "acquiring CHILD_SA "
+					"(reqid %d) failed: no connection found for IKE_SA", reqid);
 				policy->destroy(policy);
 				return FAILED;
 			}
@@ -1063,9 +1033,7 @@ static status_t acquire(private_ike_sa_t *this, u_int32_t reqid)
 		{
 			create_child_sa_t *create_child;
 			
-			this->logger->log(this->logger, CONTROL, 
-							  "acquiring CHILD_SA with reqid %d",
-							  reqid);
+			DBG1(SIG_DBG_CHD, "acquiring CHILD_SA with reqid %d", reqid);
 			
 			create_child = create_child_sa_create(&this->public);
 			create_child->set_policy(create_child, policy);
@@ -1151,8 +1119,8 @@ static status_t route(private_ike_sa_t *this, connection_t *connection, policy_t
 				ts_list_destroy(my_ts_conf);
 				ts_list_destroy(other_ts_conf);
 				iterator->destroy(iterator);
-				this->logger->log(this->logger, CONTROL, 
-								"a CHILD_SA with such a policy already routed");
+				SIG(SIG_CHILD_FAILED, "CHILD_SA with such a policy "
+					"already routed");
 				
 				return FAILED;
 			}
@@ -1202,7 +1170,8 @@ static status_t route(private_ike_sa_t *this, connection_t *connection, policy_t
 			 * adopted by the new IKE_SA */
 			break;
 		case IKE_DELETING:
-			/* deny */
+			SIG(SIG_CHILD_FAILED, "CHILD_SA with such a policy "
+				"already routed");
 			return FAILED;
 	}
 
@@ -1218,6 +1187,8 @@ static status_t route(private_ike_sa_t *this, connection_t *connection, policy_t
 	ts_list_destroy(my_ts);
 	ts_list_destroy(other_ts);
 	this->child_sas->insert_last(this->child_sas, child_sa);
+	SIG(SIG_CHILD_ROUTE,
+		"CHILD_SA routed: %R...%R", my_ts, other_ts);
 	
 	return status;
 }
@@ -1247,6 +1218,7 @@ static status_t unroute(private_ike_sa_t *this, policy_t *policy)
 				ts_list_equals(other_ts, other_ts_conf))
 			{
 				iterator->remove(iterator);
+				SIG(SIG_CHILD_UNROUTE, "CHILD_SA unrouted");
 				child_sa->destroy(child_sa);
 				ts_list_destroy(my_ts_conf);
 				ts_list_destroy(other_ts_conf);
@@ -1296,7 +1268,7 @@ static status_t send_dpd(private_ike_sa_t *this)
 		{
 			/* to long ago, initiate dead peer detection */
 			dead_peer_detection_t *dpd;
-			this->logger->log(this->logger, CONTROL, "sending DPD request");
+			DBG1(SIG_DBG_IKE, "sending DPD request");
 			dpd = dead_peer_detection_create(&this->public);
 			queue_transaction(this, (transaction_t*)dpd, FALSE);
 			diff = 0;
@@ -1336,7 +1308,7 @@ static void send_keepalive(private_ike_sa_t *this)
 		data.len = 1;
 		packet->set_data(packet, data);
 		charon->send_queue->add(charon->send_queue, packet);
-		this->logger->log(this->logger, CONTROL, "sending keep alive");
+		DBG1(SIG_DBG_IKE, "sending keep alive");
 		diff = 0;
 	}
 	job = send_keepalive_job_create(this->ike_sa_id);
@@ -1357,18 +1329,20 @@ static ike_sa_state_t get_state(private_ike_sa_t *this)
  */
 static void set_state(private_ike_sa_t *this, ike_sa_state_t state)
 {
-	this->logger->log(this->logger, CONTROL, "state change: %s => %s",
-					  mapping_find(ike_sa_state_m, this->state),
-					  mapping_find(ike_sa_state_m, state));
+	DBG1(SIG_DBG_IKE, "state change: %N => %N",
+		 ike_sa_state_names, this->state,
+		 ike_sa_state_names, state);
+	
 	if (state == IKE_ESTABLISHED)
 	{
 		this->time.established = time(NULL);
-		this->logger->log(this->logger, AUDIT, "IKE_SA established: %H[%D]...%H[%D]",
-						  this->my_host, this->my_id, 
-						  this->other_host, this->other_id);
 		/* start DPD checks */
 		send_dpd(this);
+		
+		SIG(SIG_IKE_UP, "IKE_SA established: %H[%D]...%H[%D]",
+		    this->my_host, this->my_id, this->other_host, this->other_id);
 	}
+	
 	this->state = state;
 }
 
@@ -1467,19 +1441,19 @@ static status_t derive_keys(private_ike_sa_t *this,
 	/* Create SAs general purpose PRF first, we may use it here */
 	if (!proposal->get_algorithm(proposal, PSEUDO_RANDOM_FUNCTION, &algo))
 	{
-		this->logger->log(this->logger, ERROR, "no PSEUDO_RANDOM_FUNCTION selected!");
+		DBG1(SIG_DBG_IKE, "key derivation failed: no PSEUDO_RANDOM_FUNCTION");;
 		return FAILED;
 	}
 	this->prf = prf_create(algo->algorithm);
 	if (this->prf == NULL)
 	{
-		this->logger->log(this->logger, ERROR, "PSEUDO_RANDOM_FUNCTION %s not supported!",
-						  mapping_find(pseudo_random_function_m, algo->algorithm));
+		DBG1(SIG_DBG_IKE, "key derivation failed: PSEUDO_RANDOM_FUNCTION "
+			 "%N not supported!", pseudo_random_function_names, algo->algorithm);
 		return FAILED;
 	}
 	
 	dh->get_shared_secret(dh, &secret);
-	this->logger->log_chunk(this->logger, PRIVATE, "shared Diffie Hellman secret", secret);
+	DBG4(SIG_DBG_IKE, "shared Diffie Hellman secret %B", &secret);
 	nonces = chunk_cat("cc", nonce_i, nonce_r);
 	*((u_int64_t*)spi_i.ptr) = this->ike_sa_id->get_initiator_spi(this->ike_sa_id);
 	*((u_int64_t*)spi_r.ptr) = this->ike_sa_id->get_responder_spi(this->ike_sa_id);
@@ -1490,11 +1464,11 @@ static status_t derive_keys(private_ike_sa_t *this,
 	 * if we are rekeying, SKEYSEED built on another way 
 	 */
 	if (child_prf == NULL) /* not rekeying */
-	{	
+	{
 		/* SKEYSEED = prf(Ni | Nr, g^ir) */
 		this->prf->set_key(this->prf, nonces);
 		this->prf->allocate_bytes(this->prf, secret, &skeyseed);
-		this->logger->log_chunk(this->logger, PRIVATE|LEVEL1, "SKEYSEED", skeyseed);
+		DBG4(SIG_DBG_IKE, "SKEYSEED %B", &skeyseed);
 		this->prf->set_key(this->prf, skeyseed);
 		chunk_free(&skeyseed);
 		chunk_free(&secret);
@@ -1506,7 +1480,7 @@ static status_t derive_keys(private_ike_sa_t *this,
 		 * use OLD SAs PRF functions for both prf_plus and prf */
 		secret = chunk_cat("mc", secret, nonces);
 		child_prf->allocate_bytes(child_prf, secret, &skeyseed);
-		this->logger->log_chunk(this->logger, PRIVATE|LEVEL1, "SKEYSEED", skeyseed);
+		DBG4(SIG_DBG_IKE, "SKEYSEED %B", &skeyseed);
 		old_prf->set_key(old_prf, skeyseed);
 		chunk_free(&skeyseed);
 		chunk_free(&secret);
@@ -1522,33 +1496,33 @@ static status_t derive_keys(private_ike_sa_t *this,
 	this->child_prf = prf_create(algo->algorithm);
 	key_size = this->child_prf->get_key_size(this->child_prf);
 	prf_plus->allocate_bytes(prf_plus, key_size, &key);
-	this->logger->log_chunk(this->logger, PRIVATE, "Sk_d secret", key);
+	DBG4(SIG_DBG_IKE, "Sk_d secret %B", &key);
 	this->child_prf->set_key(this->child_prf, key);
 	chunk_free(&key);
 	
 	/* SK_ai/SK_ar used for integrity protection => signer_in/signer_out */
 	if (!proposal->get_algorithm(proposal, INTEGRITY_ALGORITHM, &algo))
 	{
-		this->logger->log(this->logger, ERROR, "no INTEGRITY_ALGORITHM selected?!");
+		DBG1(SIG_DBG_IKE, "key derivation failed: no INTEGRITY_ALGORITHM");
 		return FAILED;
 	}
 	signer_i = signer_create(algo->algorithm);
 	signer_r = signer_create(algo->algorithm);
 	if (signer_i == NULL || signer_r == NULL)
 	{
-		this->logger->log(this->logger, ERROR, "INTEGRITY_ALGORITHM %s not supported!",
-						  mapping_find(integrity_algorithm_m,algo->algorithm));
+		DBG1(SIG_DBG_IKE, "key derivation failed: INTEGRITY_ALGORITHM "
+			"%N not supported!", integrity_algorithm_names ,algo->algorithm);
 		return FAILED;
 	}
 	key_size = signer_i->get_key_size(signer_i);
 	
 	prf_plus->allocate_bytes(prf_plus, key_size, &key);
-	this->logger->log_chunk(this->logger, PRIVATE, "Sk_ai secret", key);
+	DBG4(SIG_DBG_IKE, "Sk_ai secret %B", &key);
 	signer_i->set_key(signer_i, key);
 	chunk_free(&key);
 	
 	prf_plus->allocate_bytes(prf_plus, key_size, &key);
-	this->logger->log_chunk(this->logger, PRIVATE, "Sk_ar secret", key);
+	DBG4(SIG_DBG_IKE, "Sk_ar secret %B", &key);
 	signer_r->set_key(signer_r, key);
 	chunk_free(&key);
 	
@@ -1566,28 +1540,27 @@ static status_t derive_keys(private_ike_sa_t *this,
 	/* SK_ei/SK_er used for encryption => crypter_in/crypter_out */
 	if (!proposal->get_algorithm(proposal, ENCRYPTION_ALGORITHM, &algo))
 	{
-		this->logger->log(this->logger, ERROR, "no ENCRYPTION_ALGORITHM selected!");
+		DBG1(SIG_DBG_IKE, "key derivation failed: no ENCRYPTION_ALGORITHM");
 		return FAILED;
 	}
 	crypter_i = crypter_create(algo->algorithm, algo->key_size / 8);
 	crypter_r = crypter_create(algo->algorithm, algo->key_size / 8);
 	if (crypter_i == NULL || crypter_r == NULL)
 	{
-		this->logger->log(this->logger, ERROR, 
-						  "ENCRYPTION_ALGORITHM %s (key size %d) not supported!",
-						  mapping_find(encryption_algorithm_m, algo->algorithm),
-						  algo->key_size);
+		DBG1(SIG_DBG_IKE, "key derivation failed: ENCRYPTION_ALGORITHM "
+			"%N (key size %d) not supported!",
+			encryption_algorithm_names, algo->algorithm, algo->key_size);
 		return FAILED;
 	}
 	key_size = crypter_i->get_key_size(crypter_i);
 	
 	prf_plus->allocate_bytes(prf_plus, key_size, &key);
-	this->logger->log_chunk(this->logger, PRIVATE, "Sk_ei secret", key);
+	DBG4(SIG_DBG_IKE, "Sk_ei secret %B", &key);
 	crypter_i->set_key(crypter_i, key);
 	chunk_free(&key);
 	
 	prf_plus->allocate_bytes(prf_plus, key_size, &key);
-	this->logger->log_chunk(this->logger, PRIVATE, "Sk_er secret", key);
+	DBG4(SIG_DBG_IKE, "Sk_er secret %B", &key);
 	crypter_r->set_key(crypter_r, key);
 	chunk_free(&key);
 	
@@ -1609,12 +1582,12 @@ static status_t derive_keys(private_ike_sa_t *this,
 	
 	key_size = this->prf_auth_i->get_key_size(this->prf_auth_i);
 	prf_plus->allocate_bytes(prf_plus, key_size, &key);
-	this->logger->log_chunk(this->logger, PRIVATE, "Sk_pi secret", key);
+	DBG4(SIG_DBG_IKE, "Sk_pi secret %B", &key);
 	this->prf_auth_i->set_key(this->prf_auth_i, key);
 	chunk_free(&key);
 	
 	prf_plus->allocate_bytes(prf_plus, key_size, &key);
-	this->logger->log_chunk(this->logger, PRIVATE, "Sk_pr secret", key);
+	DBG4(SIG_DBG_IKE, "Sk_pr secret %B", &key);
 	this->prf_auth_r->set_key(this->prf_auth_r, key);
 	chunk_free(&key);
 	
@@ -1781,16 +1754,14 @@ static status_t rekey(private_ike_sa_t *this)
 {
 	rekey_ike_sa_t *rekey_ike_sa;
 	
-	this->logger->log(this->logger, CONTROL, 
-					  "rekeying IKE_SA between: %H[%D]...%H[%D]",
-					  this->my_host, this->my_id, 
+	DBG1(SIG_DBG_IKE, "rekeying IKE_SA between %H[%D]..%H[%D]",
+					  this->my_host, this->my_id,
 					  this->other_host, this->other_id);
 	
 	if (this->state != IKE_ESTABLISHED)
 	{
-		this->logger->log(this->logger, ERROR, 
-						  "unable to rekey IKE_SA in state %s",
-						  mapping_find(ike_sa_state_m, this->state));
+		SIG(SIG_IKE_FAILED, "unable to rekey IKE_SA in state %N",
+			ike_sa_state_names, this->state);
 		return FAILED;
 	}
 	
@@ -1829,57 +1800,6 @@ static void adopt_children(private_ike_sa_t *this, private_ike_sa_t *other)
 }
 
 /**
- * Implementation of ike_sa_t.log_status.
- */
-static void log_status(private_ike_sa_t *this, logger_t *logger, char *name)
-{
-	iterator_t *iterator;
-	child_sa_t *child_sa;
-	bool contains_child = FALSE;
-	
-	/* check for a CHILD_SA with specified name. We then print the IKE_SA,
-	 * even it has another name */
-	if (name != NULL)
-	{
-		iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
-		while (iterator->iterate(iterator, (void**)&child_sa))
-		{
-			if (streq(name, child_sa->get_name(child_sa)))
-			{
-				contains_child = TRUE;
-				break;
-			}
-		}
-		iterator->destroy(iterator);
-	}
-	
-	if (name == NULL || contains_child || streq(name, this->name))
-	{
-		if (logger == NULL)
-		{
-			logger = this->logger;
-		}		
-		logger->log(logger, CONTROL|LEVEL1,
-					"  \"%s\": IKE_SA in state %s, SPIs: 0x%.16llx 0x%.16llx",
-					this->name,
-					mapping_find(ike_sa_state_m, this->state),
-					this->ike_sa_id->get_initiator_spi(this->ike_sa_id),
-					this->ike_sa_id->get_responder_spi(this->ike_sa_id));
-		logger->log(logger, CONTROL, "  \"%s\": %H[%D]...%H[%D]",
-					this->name, this->my_host, this->my_id, 
-					this->other_host, this->other_id);
-		
-		iterator = this->child_sas->create_iterator(this->child_sas, TRUE);
-		while (iterator->has_next(iterator))
-		{
-			iterator->current(iterator, (void**)&child_sa);
-			child_sa->log_status(child_sa, logger);
-		}
-		iterator->destroy(iterator);
-	}
-}
-
-/**
  * Implementation of public_ike_sa_t.delete.
  */
 static status_t delete_(private_ike_sa_t *this)
@@ -1931,38 +1851,65 @@ static void enable_natt (private_ike_sa_t *this, bool local)
 {
 	if (local)
 	{
-		this->logger->log(this->logger, CONTROL,
-						  "local host is behind NAT, using NAT-T, scheduled keep alives");
+		DBG1(SIG_DBG_IKE, "local host is behind NAT, using NAT-T, "
+			"scheduled keep alives");
 		this->nat_here = TRUE;
 		send_keepalive(this);
 	}
 	else
 	{
-		this->logger->log(this->logger, CONTROL, 
-						  "remote host is behind NAT, using NAT-T");
+		DBG1(SIG_DBG_IKE, "remote host is behind NAT, using NAT-T");
 		this->nat_there = TRUE;
 	}
 }
 
 /**
- * Implementation of ike_sa_t.destroy.
+ * output handler in printf()
  */
-static void destroy(private_ike_sa_t *this)
+static int print(FILE *stream, const struct printf_info *info,
+				 const void *const *args)
 {
-	child_sa_t *child_sa;
-	transaction_t *transaction;
+	private_ike_sa_t *this = *((private_ike_sa_t**)(args[0]));
 	
-	this->logger->log(this->logger, CONTROL|LEVEL2, "going to destroy IKE SA %llu:%llu, role %s", 
-					  this->ike_sa_id->get_initiator_spi(this->ike_sa_id),
-					  this->ike_sa_id->get_responder_spi(this->ike_sa_id),
-					  this->ike_sa_id->is_initiator(this->ike_sa_id) ? "initiator" : "responder");
+	if (this == NULL)
+	{
+		return fprintf(stream, "(null)");
+	}
 	
-	if (this->state == IKE_ESTABLISHED)
+	return fprintf(stream, "%10s: %N, %H[%D]...%H[%D] (%J)",
+				   this->name, ike_sa_state_names, this->state,
+				   this->my_host, this->my_id, this->other_host, this->other_id,
+				   this->ike_sa_id);
+}
+
+/**
+ * arginfo handler in printf()
+ */
+static int print_arginfo(const struct printf_info *info, size_t n, int *argtypes)
+{
+	if (n > 0)
 	{
-		this->logger->log(this->logger, ERROR, 
-						  "destroying an established IKE SA without knowledge from remote peer!");
+		argtypes[0] = PA_POINTER;
 	}
+	return 1;
+}
+
+/**
+ * register printf() handlers
+ */
+static void __attribute__ ((constructor))print_register()
+{
+	register_printf_function(IKE_SA_PRINTF_SPEC, print, print_arginfo);
+}
 
+/**
+ * Implementation of ike_sa_t.destroy.
+ */
+static void destroy(private_ike_sa_t *this)
+{
+	child_sa_t *child_sa;
+	transaction_t *transaction;
+	
 	while (this->child_sas->remove_last(this->child_sas, (void**)&child_sa) == SUCCESS)
 	{
 		child_sa->destroy(child_sa);
@@ -1987,10 +1934,8 @@ static void destroy(private_ike_sa_t *this)
 	DESTROY_IF(this->prf_auth_i);
 	DESTROY_IF(this->prf_auth_r);
 
-	this->logger->log(this->logger, AUDIT, 
-					  "IKE_SA deleted between: %H[%D]...%H[%D]",
-					  this->my_host, this->my_id, 
-					  this->other_host, this->other_id);
+	DBG1(SIG_DBG_IKE, "IKE_SA deleted between %H[%D]...%H[%D]",
+		 this->my_host, this->my_id, this->other_host, this->other_id);
 	
 	DESTROY_IF(this->my_host);
 	DESTROY_IF(this->other_host);
@@ -2030,7 +1975,6 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
 	this->public.set_other_id = (void(*)(ike_sa_t*,identification_t*)) set_other_id;
 	this->public.get_next_message_id = (u_int32_t(*)(ike_sa_t*)) get_next_message_id;
 	this->public.retransmit_request = (status_t (*) (ike_sa_t *, u_int32_t)) retransmit_request;
-	this->public.log_status = (void (*) (ike_sa_t*,logger_t*,char*))log_status;
 	this->public.delete = (status_t(*)(ike_sa_t*))delete_;
 	this->public.destroy = (void(*)(ike_sa_t*))destroy;
 	this->public.send_dpd = (status_t (*)(ike_sa_t*)) send_dpd;
@@ -2057,7 +2001,6 @@ ike_sa_t * ike_sa_create(ike_sa_id_t *ike_sa_id)
 	this->public.adopt_children = (void(*)(ike_sa_t*,ike_sa_t*))adopt_children;
 	
 	/* initialize private fields */
-	this->logger = logger_manager->get_logger(logger_manager, IKE_SA);
 	this->ike_sa_id = ike_sa_id->clone(ike_sa_id);
 	this->name = strdup("(uninitialized)");
 	this->child_sas = linked_list_create();
diff --git a/src/charon/sa/ike_sa.h b/src/charon/sa/ike_sa.h
index 0f359cb23..f09625a84 100644
--- a/src/charon/sa/ike_sa.h
+++ b/src/charon/sa/ike_sa.h
@@ -31,7 +31,6 @@
 #include <sa/ike_sa_id.h>
 #include <sa/child_sa.h>
 #include <config/configuration.h>
-#include <utils/logger.h>
 #include <utils/randomizer.h>
 #include <crypto/prfs/prf.h>
 #include <crypto/crypters/crypter.h>
@@ -39,9 +38,10 @@
 #include <config/connections/connection.h>
 #include <config/policies/policy.h>
 #include <config/proposal.h>
-#include <utils/logger.h>
 
 
+#define IKE_SA_PRINTF_SPEC 'K'
+
 typedef enum ike_sa_state_t ike_sa_state_t;
 
 /**
@@ -112,9 +112,9 @@ enum ike_sa_state_t {
 };
 
 /**
- * String mappings for ike_sa_state_t.
+ * enum names for ike_sa_state_t.
  */
-extern mapping_t ike_sa_state_m[];
+extern enum_name_t *ike_sa_state_names;
 
 
 typedef struct ike_sa_t ike_sa_t;
@@ -403,20 +403,6 @@ struct ike_sa_t {
 	 * @param this			calling object
 	 */
 	void (*send_keepalive) (ike_sa_t *this);
-	
-	/**
-	 * @brief Log the status of a the ike sa to a logger.
-	 *
-	 * The status of the IKE SA and all child SAs is logged.
-	 * Supplying NULL as logger uses the internal child_sa logger
-	 * to do the logging. The log is only done if the supplied
-	 * connection name is NULL or matches the connections name.
-	 *
-	 * @param this 			calling object
-	 * @param logger		logger to use for logging
-	 * @param name			name of the connection
-	 */	
-	void (*log_status) (ike_sa_t *this, logger_t *logger, char *name);
 
 	/**
 	 * @brief Derive all keys and create the transforms for IKE communication.
diff --git a/src/charon/sa/ike_sa_id.c b/src/charon/sa/ike_sa_id.c
index 84303d6a5..cac9cc3b5 100644
--- a/src/charon/sa/ike_sa_id.c
+++ b/src/charon/sa/ike_sa_id.c
@@ -24,6 +24,8 @@
 
 #include "ike_sa_id.h"
 
+#include <printf.h>
+#include <stdio.h>
 
 
 typedef struct private_ike_sa_id_t private_ike_sa_id_t;
@@ -137,7 +139,7 @@ static bool switch_initiator(private_ike_sa_id_t *this)
 	}
 	else
 	{
-		this->is_initiator_flag = TRUE;	
+		this->is_initiator_flag = TRUE;
 	}
 	return this->is_initiator_flag;
 }
@@ -151,6 +153,44 @@ static ike_sa_id_t* clone(private_ike_sa_id_t *this)
 }
 
 /**
+ * output handler in printf()
+ */
+static int print(FILE *stream, const struct printf_info *info,
+				 const void *const *args)
+{
+	private_ike_sa_id_t *this = *((private_ike_sa_id_t**)(args[0]));
+	
+	if (this == NULL)
+	{
+		return fprintf(stream, "(null)");
+	}
+	return fprintf(stream, "%llx:%llx[%c]",
+				   this->initiator_spi, this->responder_spi,
+				   this->is_initiator_flag ? 'i' : 'r');
+}
+
+/**
+ * arginfo handler in printf()
+ */
+static int print_arginfo(const struct printf_info *info, size_t n, int *argtypes)
+{
+	if (n > 0)
+	{
+		argtypes[0] = PA_POINTER;
+	}
+	return 1;
+}
+
+/**
+ * register printf() handlers
+ */
+static void __attribute__ ((constructor))print_register()
+{
+	register_printf_function(IKE_SA_ID_PRINTF_SPEC, print, print_arginfo);
+}
+
+
+/**
  * Implementation of ike_sa_id_t.destroy.
  */
 static void destroy(private_ike_sa_id_t *this)
diff --git a/src/charon/sa/ike_sa_id.h b/src/charon/sa/ike_sa_id.h
index 0d93842ee..a4ff889e4 100644
--- a/src/charon/sa/ike_sa_id.h
+++ b/src/charon/sa/ike_sa_id.h
@@ -27,6 +27,10 @@
 
 #include <types.h>
 
+/**
+ * printf() specifier to print a ike_sa_id.
+ */
+#define IKE_SA_ID_PRINTF_SPEC 'J'
 
 typedef struct ike_sa_id_t ike_sa_id_t;
 
diff --git a/src/charon/sa/ike_sa_manager.c b/src/charon/sa/ike_sa_manager.c
index 90c43da93..c9bdac460 100644
--- a/src/charon/sa/ike_sa_manager.c
+++ b/src/charon/sa/ike_sa_manager.c
@@ -28,20 +28,15 @@
 
 #include <daemon.h>
 #include <sa/ike_sa_id.h>
-#include <utils/logger.h>
-#include <utils/logger_manager.h>
+#include <bus/bus.h>
 #include <utils/linked_list.h>
 
-typedef struct ike_sa_entry_t ike_sa_entry_t;
+typedef struct entry_t entry_t;
 
 /**
  * An entry in the linked list, contains IKE_SA, locking and lookup data.
  */
-struct ike_sa_entry_t {
-	/**
-	 * Destructor, also destroys associated ike_sa_t object.
-	 */
-	status_t (*destroy) (ike_sa_entry_t *this);
+struct entry_t {
 	
 	/**
 	 * Number of threads waiting for this ike_sa_t object.
@@ -80,9 +75,9 @@ struct ike_sa_entry_t {
 };
 
 /**
- * Implementation of ike_sa_entry_t.destroy.
+ * Implementation of entry_t.destroy.
  */
-static status_t ike_sa_entry_destroy(ike_sa_entry_t *this)
+static status_t entry_destroy(entry_t *this)
 {
 	/* also destroy IKE SA */
 	this->ike_sa->destroy(this->ike_sa);
@@ -92,19 +87,11 @@ static status_t ike_sa_entry_destroy(ike_sa_entry_t *this)
 }
 
 /**
- * @brief Creates a new entry for the ike_sa_t list.
- *
- * This constructor additionaly creates a new and empty SA.
- *
- * @param ike_sa_id		The associated ike_sa_id_t, will be cloned
- * @return				ike_sa_entry_t object
+ * Creates a new entry for the ike_sa_t list.
  */
-static ike_sa_entry_t *ike_sa_entry_create(ike_sa_id_t *ike_sa_id)
+static entry_t *entry_create(ike_sa_id_t *ike_sa_id)
 {
-	ike_sa_entry_t *this = malloc_thing(ike_sa_entry_t);
-
-	/* destroy function */
-	this->destroy = ike_sa_entry_destroy;
+	entry_t *this = malloc_thing(entry_t);
 	
 	this->waiting_threads = 0;
 	pthread_cond_init(&(this->condvar), NULL);
@@ -141,11 +128,6 @@ struct private_ike_sa_manager_t {
 	 pthread_mutex_t mutex;
 
 	 /**
-	  * Logger used for this IKE SA Manager.
-	  */
-	 logger_t *logger;
-
-	 /**
 	  * Linked list with entries for the ike_sa_t objects.
 	  */
 	 linked_list_t *ike_sa_list;
@@ -159,10 +141,11 @@ struct private_ike_sa_manager_t {
 /**
  * Implementation of private_ike_sa_manager_t.get_entry_by_id.
  */
-static status_t get_entry_by_id(private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id, ike_sa_entry_t **entry)
+static status_t get_entry_by_id(private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id, entry_t **entry)
 {
 	linked_list_t *list = this->ike_sa_list;
 	iterator_t *iterator;
+	entry_t *current;
 	status_t status;
 	
 	/* create iterator over list of ike_sa's */
@@ -171,48 +154,30 @@ static status_t get_entry_by_id(private_ike_sa_manager_t *this, ike_sa_id_t *ike
 	/* default status */
 	status = NOT_FOUND;
 	
-	while (iterator->has_next(iterator))
+	while (iterator->iterate(iterator, (void**)&current))
 	{
-		ike_sa_entry_t *current;
-		
-		iterator->current(iterator, (void**)&current);
-		if (current->ike_sa_id->get_responder_spi(current->ike_sa_id) == 0)
+		if (current->ike_sa_id->equals(current->ike_sa_id, ike_sa_id))
+		{
+			DBG2(SIG_DBG_MGR,  "found entry by both SPIs");
+			*entry = current;
+			status = SUCCESS;
+			break;
+		}
+		if (ike_sa_id->get_responder_spi(ike_sa_id) == 0 ||
+			current->ike_sa_id->get_responder_spi(current->ike_sa_id) == 0)
 		{
 			/* seems to be a half ready ike_sa */
 			if ((current->ike_sa_id->get_initiator_spi(current->ike_sa_id) ==
 						  ike_sa_id->get_initiator_spi(ike_sa_id)) &&
-				(ike_sa_id->is_initiator(ike_sa_id) == 
-						  current->ike_sa_id->is_initiator(current->ike_sa_id)))
+				(current->ike_sa_id->is_initiator(ike_sa_id) ==
+						  ike_sa_id->is_initiator(current->ike_sa_id)))
 			{
-		 		this->logger->log(this->logger, CONTROL|LEVEL2, 
-								  "found entry by initiator spi %d",
-								  ike_sa_id->get_initiator_spi(ike_sa_id));
+				DBG2(SIG_DBG_MGR, "found entry by initiator SPI");
 				*entry = current;
 				status = SUCCESS;
 				break;
 			}
 		}
-		else if (ike_sa_id->get_responder_spi(ike_sa_id) == 0)
-		{
-			if ((current->ike_sa_id->get_initiator_spi(current->ike_sa_id) == 
-						  ike_sa_id->get_initiator_spi(ike_sa_id)) &&
-				(ike_sa_id->is_initiator(ike_sa_id) == 
-						  current->ike_sa_id->is_initiator(current->ike_sa_id)))
-			{
-		 		this->logger->log(this->logger, CONTROL|LEVEL2, "found entry by initiator spi %d",
-								  ike_sa_id->get_initiator_spi(ike_sa_id));
-				*entry = current;
-				status = SUCCESS;
-				break;
-			}			
-		}
-		if (current->ike_sa_id->equals(current->ike_sa_id, ike_sa_id))
-		{
-			this->logger->log(this->logger, CONTROL|LEVEL2, "found entry by full ID");
-			*entry = current;
-			status = SUCCESS;
-			break;
-		}
 	}
 	
 	iterator->destroy(iterator);
@@ -222,7 +187,7 @@ static status_t get_entry_by_id(private_ike_sa_manager_t *this, ike_sa_id_t *ike
 /**
  * Implementation of private_ike_sa_manager_t.get_entry_by_sa.
  */
-static status_t get_entry_by_sa(private_ike_sa_manager_t *this, ike_sa_t *ike_sa, ike_sa_entry_t **entry)
+static status_t get_entry_by_sa(private_ike_sa_manager_t *this, ike_sa_t *ike_sa, entry_t **entry)
 {
 	linked_list_t *list = this->ike_sa_list;
 	iterator_t *iterator;
@@ -235,12 +200,12 @@ static status_t get_entry_by_sa(private_ike_sa_manager_t *this, ike_sa_t *ike_sa
 	
 	while (iterator->has_next(iterator))
 	{
-		ike_sa_entry_t *current;
+		entry_t *current;
 		iterator->current(iterator, (void**)&current);
 		/* only pointers are compared */
 		if (current->ike_sa == ike_sa)
 		{
-	 		this->logger->log(this->logger, CONTROL|LEVEL2, "found entry by pointer");
+			DBG2(SIG_DBG_MGR, "found entry by pointer");
 			*entry = current;
 			status = SUCCESS;
 			break;
@@ -254,7 +219,7 @@ static status_t get_entry_by_sa(private_ike_sa_manager_t *this, ike_sa_t *ike_sa
 /**
  * Implementation of private_ike_sa_manager_s.delete_entry.
  */
-static status_t delete_entry(private_ike_sa_manager_t *this, ike_sa_entry_t *entry)
+static status_t delete_entry(private_ike_sa_manager_t *this, entry_t *entry)
 {
 	linked_list_t *list = this->ike_sa_list;
 	iterator_t *iterator;
@@ -266,7 +231,7 @@ static status_t delete_entry(private_ike_sa_manager_t *this, ike_sa_entry_t *ent
 	
 	while (iterator->has_next(iterator))
 	{
-		ike_sa_entry_t *current;
+		entry_t *current;
 		iterator->current(iterator, (void**)&current);
 		if (current == entry) 
 		{
@@ -281,23 +246,22 @@ static status_t delete_entry(private_ike_sa_manager_t *this, ike_sa_entry_t *ent
 				pthread_cond_wait(&(entry->condvar), &(this->mutex));
 			}
 			
-	 		this->logger->log(this->logger, CONTROL|LEVEL2, 
-							  "found entry by pointer. Going to delete it");
+			DBG2(SIG_DBG_MGR,  "found entry by pointer, deleting it");
 			iterator->remove(iterator);
-			entry->destroy(entry);
+			entry_destroy(entry);
 			status = SUCCESS;
 			break;
 		}
 	}
 	iterator->destroy(iterator);
-	return status;	
+	return status;
 }
 
 /**
  * Wait until no other thread is using an IKE_SA, return FALSE if entry not
  * acquireable
  */
-static bool wait_for_entry(private_ike_sa_manager_t *this, ike_sa_entry_t *entry)
+static bool wait_for_entry(private_ike_sa_manager_t *this, entry_t *entry)
 {
 	if (entry->driveout_new_threads)
 	{
@@ -351,7 +315,7 @@ static ike_sa_t* checkout_by_id(private_ike_sa_manager_t *this,
 	iterator = this->ike_sa_list->create_iterator(this->ike_sa_list, TRUE);
 	while (iterator->has_next(iterator))
 	{
-		ike_sa_entry_t *entry;
+		entry_t *entry;
 		identification_t *found_my_id, *found_other_id;
 		host_t *found_my_host, *found_other_host;
 		int wc;
@@ -384,9 +348,8 @@ static ike_sa_t* checkout_by_id(private_ike_sa_manager_t *this,
 			found_other_id->matches(found_other_id, other_id, &wc))
 		{
 			/* looks good, we take this one */
-			this->logger->log(this->logger, CONTROL|LEVEL1, 
-							  "found an existing IKE_SA for %H[%D]...%H[%D]",
-							  my_host, other_host, my_id, other_id);
+			DBG2(SIG_DBG_MGR, "found an existing IKE_SA for %H[%D]...%H[%D]",
+				 my_host, other_host, my_id, other_id);
 			entry->checked_out = TRUE;
 			ike_sa = entry->ike_sa;
 		}
@@ -396,7 +359,7 @@ static ike_sa_t* checkout_by_id(private_ike_sa_manager_t *this,
 	if (!ike_sa)
 	{
 		u_int64_t initiator_spi;
-		ike_sa_entry_t *new_ike_sa_entry;
+		entry_t *new_entry;
 		ike_sa_id_t *new_ike_sa_id;
 		
 		initiator_spi = get_next_spi(this);
@@ -404,24 +367,19 @@ static ike_sa_t* checkout_by_id(private_ike_sa_manager_t *this,
 		new_ike_sa_id->set_initiator_spi(new_ike_sa_id, initiator_spi);
 		
 		/* create entry */
-		new_ike_sa_entry = ike_sa_entry_create(new_ike_sa_id);
-		this->logger->log(this->logger, CONTROL|LEVEL2,
-						  "created IKE_SA %llx:%llx, role %s",
-						  new_ike_sa_id->get_initiator_spi(new_ike_sa_id),
-						  new_ike_sa_id->get_responder_spi(new_ike_sa_id),
-						  new_ike_sa_id->is_initiator(new_ike_sa_id) ? "initiator" : "responder");
+		new_entry = entry_create(new_ike_sa_id);
+		DBG2(SIG_DBG_MGR, "created IKE_SA: %J", new_ike_sa_id);
 		new_ike_sa_id->destroy(new_ike_sa_id);
 		
-		this->ike_sa_list->insert_last(this->ike_sa_list, new_ike_sa_entry);
+		this->ike_sa_list->insert_last(this->ike_sa_list, new_entry);
 		
 		/* check ike_sa out */
-		this->logger->log(this->logger, CONTROL|LEVEL1, 
-						  "new IKE_SA created for IDs %D - %D", my_id, other_id);
-		new_ike_sa_entry->checked_out = TRUE;
-		ike_sa = new_ike_sa_entry->ike_sa;
+		DBG2(SIG_DBG_MGR, "new IKE_SA created for IDs [%D]...[%D]", my_id, other_id);
+		new_entry->checked_out = TRUE;
+		ike_sa = new_entry->ike_sa;
 	}
 	pthread_mutex_unlock(&(this->mutex));
-	SIG_SA(ike_sa);
+	charon->bus->set_sa(charon->bus, ike_sa);
 	return ike_sa;
 }
 
@@ -435,14 +393,10 @@ static ike_sa_t* checkout(private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id
 	bool original_initiator;
 	ike_sa_t *ike_sa = NULL;
 	
-	this->logger->log(this->logger, CONTROL|LEVEL2,
-					  "checkout IKE_SA %llx:%llx, role %s",
-					  ike_sa_id->get_initiator_spi(ike_sa_id),
-					  ike_sa_id->get_responder_spi(ike_sa_id),
-					  ike_sa_id->is_initiator(ike_sa_id) ? "initiator" : "responder");
+	DBG2(SIG_DBG_MGR, "checkout IKE_SA: %J", ike_sa_id);
 	
-	this->logger->log(this->logger, CONTROL|LEVEL2, "%d IKE_SAs in manager",
-					  this->ike_sa_list->get_count(this->ike_sa_list));
+	DBG2(SIG_DBG_MGR,  "%d IKE_SAs in manager",
+		 this->ike_sa_list->get_count(this->ike_sa_list));
 	
 	/* each access is locked */
 	pthread_mutex_lock(&(this->mutex));
@@ -457,28 +411,25 @@ static ike_sa_t* checkout(private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id
 		/* we SHOULD have an IKE_SA for these SPIs in the list,
 		 * if not, we can't handle the request...
 		 */
-		ike_sa_entry_t *entry;
+		entry_t *entry;
 		/* look for the entry */
 		if (get_entry_by_id(this, ike_sa_id, &entry) == SUCCESS)
 		{
 			if (wait_for_entry(this, entry))
 			{
-				this->logger->log(this->logger, CONTROL|LEVEL2, 
-								  "IKE_SA successfully checked out");
+				DBG2(SIG_DBG_MGR, "IKE_SA successfully checked out");
 				/* ok, this IKE_SA is finally ours */
 				entry->checked_out = TRUE;
 				ike_sa = entry->ike_sa;
 			}
 			else
 			{
-				this->logger->log(this->logger, CONTROL|LEVEL2, 
-								  "IKE_SA found, but not allowed to check it out");
+				DBG2(SIG_DBG_MGR, "IKE_SA found, but not allowed to check it out");
 			}
 		}
 		else
 		{
-			this->logger->log(this->logger, ERROR|LEVEL1, 
-							  "IKE_SA not stored in list");
+			DBG2(SIG_DBG_MGR, "IKE_SA not stored in list");
 			/* looks like there is no such IKE_SA, better luck next time... */
 		}
 	}
@@ -492,7 +443,7 @@ static ike_sa_t* checkout(private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id
 		 * IKE_SA. This could be improved...
 		 */
 		u_int64_t responder_spi;
-		ike_sa_entry_t *new_ike_sa_entry;
+		entry_t *new_entry;
 		
 		/* set SPIs, we are the responder */
 		responder_spi = get_next_spi(this);
@@ -501,45 +452,40 @@ static ike_sa_t* checkout(private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id
 		ike_sa_id->set_responder_spi(ike_sa_id, responder_spi);
 		
 		/* create entry */
-		new_ike_sa_entry = ike_sa_entry_create(ike_sa_id);
+		new_entry = entry_create(ike_sa_id);
 		
-		this->ike_sa_list->insert_last(this->ike_sa_list, new_ike_sa_entry);
+		this->ike_sa_list->insert_last(this->ike_sa_list, new_entry);
 		
 		/* check ike_sa out */
-		this->logger->log(this->logger, CONTROL|LEVEL1,
-						  "IKE_SA added to list of known IKE_SAs");
-		new_ike_sa_entry->checked_out = TRUE;
-		ike_sa = new_ike_sa_entry->ike_sa;
+		DBG2(SIG_DBG_MGR,  "IKE_SA added to list of known IKE_SAs");
+		new_entry->checked_out = TRUE;
+		ike_sa = new_entry->ike_sa;
 	}
 	else if (!initiator_spi_set && !responder_spi_set && original_initiator)
 	{
 		/* checkout of a new and unused IKE_SA, used for rekeying */
-		ike_sa_entry_t *new_ike_sa_entry;
+		entry_t *new_entry;
 		
 		ike_sa_id->set_initiator_spi(ike_sa_id, get_next_spi(this));
 		/* create entry */
-		new_ike_sa_entry = ike_sa_entry_create(ike_sa_id);
-		this->logger->log(this->logger, CONTROL|LEVEL2,
-							"created IKE_SA %llx:%llx, role %s",
-							ike_sa_id->get_initiator_spi(ike_sa_id),
-							ike_sa_id->get_responder_spi(ike_sa_id),
-							ike_sa_id->is_initiator(ike_sa_id) ? "initiator" : "responder");
+		new_entry = entry_create(ike_sa_id);
+		DBG2(SIG_DBG_MGR, "created IKE_SA: %J", ike_sa_id);
 			
-		this->ike_sa_list->insert_last(this->ike_sa_list, new_ike_sa_entry);
+		this->ike_sa_list->insert_last(this->ike_sa_list, new_entry);
 		
 		/* check ike_sa out */
-		new_ike_sa_entry->checked_out = TRUE;
-		ike_sa = new_ike_sa_entry->ike_sa;
+		new_entry->checked_out = TRUE;
+		ike_sa = new_entry->ike_sa;
 	}
 	else
 	{
 		/* responder set, initiator not: here is something seriously wrong! */
- 		this->logger->log(this->logger, ERROR|LEVEL1, "invalid IKE_SA SPIs");
+		DBG2(SIG_DBG_MGR, "invalid IKE_SA SPIs");
 	}
 	
 	pthread_mutex_unlock(&(this->mutex));
 	
-	SIG_SA(ike_sa);
+	charon->bus->set_sa(charon->bus, ike_sa);
 	return ike_sa;
 }
 
@@ -557,7 +503,7 @@ static ike_sa_t* checkout_by_child(private_ike_sa_manager_t *this,
 	iterator = this->ike_sa_list->create_iterator(this->ike_sa_list, TRUE);
 	while (iterator->has_next(iterator))
 	{
-		ike_sa_entry_t *entry;
+		entry_t *entry;
 		
 		iterator->current(iterator, (void**)&entry);
 		if (wait_for_entry(this, entry))
@@ -575,63 +521,35 @@ static ike_sa_t* checkout_by_child(private_ike_sa_manager_t *this,
 	iterator->destroy(iterator);
 	pthread_mutex_unlock(&(this->mutex));
 	
-	SIG_SA(ike_sa);
+	charon->bus->set_sa(charon->bus, ike_sa);
 	return ike_sa;
 }
 
 /**
- * Implementation of ike_sa_manager_t.get_ike_sa_list.
+ * Iterator hook for iterate
  */
-static linked_list_t *get_ike_sa_list(private_ike_sa_manager_t* this)
+static bool iterate(iterator_t *iterator, void **value)
 {
-	linked_list_t *list;
-	iterator_t *iterator;
-	
-	pthread_mutex_lock(&(this->mutex));
-	
-	list = linked_list_create();
-	iterator = this->ike_sa_list->create_iterator(this->ike_sa_list, TRUE);
-	while (iterator->has_next(iterator))
+	if (iterator->has_next(iterator))
 	{
-		ike_sa_entry_t *entry;
+		entry_t *entry;
 		iterator->current(iterator, (void**)&entry);
-		list->insert_last(list, (void*)entry->ike_sa_id->clone(entry->ike_sa_id));
+		*value = entry->ike_sa;
+		return TRUE;
 	}
-	iterator->destroy(iterator);
-	
-	pthread_mutex_unlock(&(this->mutex));
-	return list;
+	return FALSE;
 }
 
 /**
- * Implementation of ike_sa_manager_t.log_status.
+ * Implementation of ike_sa_manager_t.create_iterator.
  */
-static void log_status(private_ike_sa_manager_t* this, logger_t* logger, char* name)
+static iterator_t *create_iterator(private_ike_sa_manager_t* this)
 {
-	iterator_t *iterator;
-	u_int instances;
-	
-	pthread_mutex_lock(&(this->mutex));
-	
-	instances = this->ike_sa_list->get_count(this->ike_sa_list);
-	if (instances)
-	{
-		logger->log(logger, CONTROL, "Instances (%d):", instances);
-	}
-	iterator = this->ike_sa_list->create_iterator(this->ike_sa_list, TRUE);
-	while (iterator->has_next(iterator))
-	{
-		ike_sa_entry_t *entry;
-		
-		iterator->current(iterator, (void**)&entry);
-		if (wait_for_entry(this, entry))
-		{
-			entry->ike_sa->log_status(entry->ike_sa, logger, name);
-		}
-	}
-	iterator->destroy(iterator);
-	
-	pthread_mutex_unlock(&(this->mutex));
+	iterator_t *iterator = this->ike_sa_list->create_iterator_locked(
+								this->ike_sa_list, &this->mutex);
+	/* overload iterator */
+	iterator->iterate = iterate;
+	return iterator;
 }
 
 /**
@@ -645,16 +563,12 @@ static status_t checkin(private_ike_sa_manager_t *this, ike_sa_t *ike_sa)
 	 * of a IKE_SA_INIT response). Updating of the SPI MAY be necessary...
 	 */
 	status_t retval;
-	ike_sa_entry_t *entry;
+	entry_t *entry;
 	ike_sa_id_t *ike_sa_id;
 	
 	ike_sa_id = ike_sa->get_id(ike_sa);
 	
-	this->logger->log(this->logger, CONTROL|LEVEL2,
-					   "checkin IKE_SA %llx:%llx, role %s",
-					  ike_sa_id->get_initiator_spi(ike_sa_id),
-					  ike_sa_id->get_responder_spi(ike_sa_id),
-					  ike_sa_id->is_initiator(ike_sa_id) ? "initiator" : "responder");
+	DBG2(SIG_DBG_MGR, "checkin IKE_SA: %J", ike_sa_id);
 	
 	pthread_mutex_lock(&(this->mutex));
 
@@ -665,23 +579,22 @@ static status_t checkin(private_ike_sa_manager_t *this, ike_sa_t *ike_sa)
 		entry->ike_sa_id->replace_values(entry->ike_sa_id, ike_sa->get_id(ike_sa));
 		/* signal waiting threads */
 		entry->checked_out = FALSE;
-		this->logger->log(this->logger, CONTROL|LEVEL1, "check-in of IKE_SA successful.");
+		DBG2(SIG_DBG_MGR, "check-in of IKE_SA successful.");
 		pthread_cond_signal(&(entry->condvar));
 	 	retval = SUCCESS;
 	}
 	else
 	{
-		this->logger->log(this->logger, ERROR, 
-						  "tried to check in nonexisting IKE_SA");
+		DBG2(SIG_DBG_MGR, "tried to check in nonexisting IKE_SA");
 		/* this SA is no more, this REALLY should not happen */
 		retval = NOT_FOUND;
 	}
 	
-	this->logger->log(this->logger, CONTROL|LEVEL2, "%d IKE_SAs in manager now",
-				this->ike_sa_list->get_count(this->ike_sa_list));
+	DBG2(SIG_DBG_MGR, "%d IKE_SAs in manager now",
+		 this->ike_sa_list->get_count(this->ike_sa_list));
 	pthread_mutex_unlock(&(this->mutex));
 	
-	SIG_SA(NULL);
+	charon->bus->set_sa(charon->bus, NULL);
 	return retval;
 }
 
@@ -696,16 +609,12 @@ static status_t checkin_and_destroy(private_ike_sa_manager_t *this, ike_sa_t *ik
 	 * We take this SA from the list, and start signaling while threads
 	 * are in the condvar.
 	 */
-	ike_sa_entry_t *entry;
+	entry_t *entry;
 	status_t retval;
 	ike_sa_id_t *ike_sa_id;
 	
 	ike_sa_id = ike_sa->get_id(ike_sa);
-	this->logger->log(this->logger, CONTROL|LEVEL2,
-					  "checkin and destroy IKE_SA %llx:%llx, role %s",
-					  ike_sa_id->get_initiator_spi(ike_sa_id),
-					  ike_sa_id->get_responder_spi(ike_sa_id),
-					  ike_sa_id->is_initiator(ike_sa_id) ? "initiator" : "responder");
+	DBG2(SIG_DBG_MGR, "checkin and destroy IKE_SA: %J", ike_sa_id);
 
 	pthread_mutex_lock(&(this->mutex));
 
@@ -716,19 +625,17 @@ static status_t checkin_and_destroy(private_ike_sa_manager_t *this, ike_sa_t *ik
 		
 		delete_entry(this, entry);
 		
-		this->logger->log(this->logger, CONTROL|LEVEL1, 
-						  "check-in and destroy of IKE_SA successful");
+		DBG2(SIG_DBG_MGR, "check-in and destroy of IKE_SA successful");
 		retval = SUCCESS;
 	}
 	else
 	{
-		this->logger->log(this->logger,ERROR, 
-						  "tried to check-in and delete nonexisting IKE_SA");
+		DBG2(SIG_DBG_MGR, "tried to check-in and delete nonexisting IKE_SA");
 		retval = NOT_FOUND;
 	}
 	
 	pthread_mutex_unlock(&(this->mutex));
-	SIG_SA(NULL);
+	charon->bus->set_sa(charon->bus, ike_sa);
 	return retval;
 }
 
@@ -742,14 +649,10 @@ static status_t delete_(private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id)
 	 * We take this SA from the list, and start signaling while threads
 	 * are in the condvar.
 	 */
-	ike_sa_entry_t *entry;
+	entry_t *entry;
 	status_t retval;
 	
-	this->logger->log(this->logger, CONTROL|LEVEL2,
-					  "delete IKE_SA %llx:%llx, role %s",
-					  ike_sa_id->get_initiator_spi(ike_sa_id),
-					  ike_sa_id->get_responder_spi(ike_sa_id),
-					  ike_sa_id->is_initiator(ike_sa_id) ? "initiator" : "responder");
+	DBG2(SIG_DBG_MGR, "delete IKE_SA: %J", ike_sa_id);
 	
 	pthread_mutex_lock(&(this->mutex));
 	
@@ -760,8 +663,7 @@ static status_t delete_(private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id)
 		 */
 		if (entry->ike_sa->delete(entry->ike_sa) == SUCCESS)
 		{
-			this->logger->log(this->logger, CONTROL|LEVEL1,
-							  "initiated delete for IKE_SA");
+			DBG2(SIG_DBG_MGR, "initiated delete for IKE_SA");
 		}
 		/* but if the IKE SA is not in a state where the deletion is 
 		 * negotiated with the other peer, we can destroy the IKE SA on our own. 
@@ -774,8 +676,7 @@ static status_t delete_(private_ike_sa_manager_t *this, ike_sa_id_t *ike_sa_id)
 	}
 	else
 	{
-		this->logger->log(this->logger,ERROR|LEVEL1,
-						  "tried to delete nonexisting IKE_SA");
+		DBG2(SIG_DBG_MGR, "tried to delete nonexisting IKE_SA");
 		retval = NOT_FOUND;
 	}
 
@@ -790,7 +691,7 @@ static status_t delete_by_name(private_ike_sa_manager_t *this, char *name)
 {
 	iterator_t *iterator;
 	iterator_t *child_iter;
-	ike_sa_entry_t *entry;
+	entry_t *entry;
 	size_t name_len = strlen(name);
 	
 	pthread_mutex_lock(&(this->mutex));
@@ -910,14 +811,12 @@ static void destroy(private_ike_sa_manager_t *this)
 	/* destroy all list entries */
 	linked_list_t *list = this->ike_sa_list;
 	iterator_t *iterator;
-	ike_sa_entry_t *entry;
+	entry_t *entry;
 	
 	pthread_mutex_lock(&(this->mutex));
-	this->logger->log(this->logger, CONTROL|LEVEL1, 
-					  "going to destroy IKE_SA manager and all managed IKE_SA's");
+	DBG2(SIG_DBG_MGR, "going to destroy IKE_SA manager and all managed IKE_SA's");
 	/* Step 1: drive out all waiting threads  */
-	this->logger->log(this->logger, CONTROL|LEVEL2, 
-					  "set driveout flags for all stored IKE_SA's");
+	DBG2(SIG_DBG_MGR, "set driveout flags for all stored IKE_SA's");
 	iterator = list->create_iterator(list, TRUE);
 	while (iterator->has_next(iterator))
 	{
@@ -926,8 +825,7 @@ static void destroy(private_ike_sa_manager_t *this)
 		entry->driveout_new_threads = TRUE;
 		entry->driveout_waiting_threads = TRUE;	
 	}
-	this->logger->log(this->logger, CONTROL|LEVEL2, 
-					  "wait for all threads to leave IKE_SA's");
+	DBG2(SIG_DBG_MGR, "wait for all threads to leave IKE_SA's");
 	/* Step 2: wait until all are gone */
 	iterator->reset(iterator);
 	while (iterator->has_next(iterator))
@@ -941,7 +839,7 @@ static void destroy(private_ike_sa_manager_t *this)
 			pthread_cond_wait(&(entry->condvar), &(this->mutex));
 		}
 	}
-	this->logger->log(this->logger, CONTROL|LEVEL2, "delete all IKE_SA's");
+	DBG2(SIG_DBG_MGR, "delete all IKE_SA's");
 	/* Step 3: initiate deletion of all IKE_SAs */
 	iterator->reset(iterator);
 	while (iterator->has_next(iterator))
@@ -951,11 +849,11 @@ static void destroy(private_ike_sa_manager_t *this)
 	}
 	iterator->destroy(iterator);
 	
-	this->logger->log(this->logger, CONTROL|LEVEL2, "destroy all entries");
+	DBG2(SIG_DBG_MGR, "destroy all entries");
 	/* Step 4: destroy all entries */
 	while (list->remove_last(list, (void**)&entry) == SUCCESS)
 	{
-		entry->destroy(entry);
+		entry_destroy(entry);
 	}
 	list->destroy(list);
 	pthread_mutex_unlock(&(this->mutex));
@@ -977,21 +875,16 @@ ike_sa_manager_t *ike_sa_manager_create()
 	this->public.checkout_by_id = (ike_sa_t*(*)(ike_sa_manager_t*,host_t*,host_t*,identification_t*,identification_t*))checkout_by_id;
 	this->public.checkout = (ike_sa_t*(*)(ike_sa_manager_t*, ike_sa_id_t*))checkout;
 	this->public.checkout_by_child = (ike_sa_t*(*)(ike_sa_manager_t*,u_int32_t))checkout_by_child;
-	this->public.get_ike_sa_list = (linked_list_t*(*)(ike_sa_manager_t*))get_ike_sa_list;
-	this->public.log_status = (void(*)(ike_sa_manager_t*,logger_t*,char*))log_status;
+	this->public.create_iterator = (iterator_t*(*)(ike_sa_manager_t*))create_iterator;
 	this->public.checkin = (status_t(*)(ike_sa_manager_t*,ike_sa_t*))checkin;
 	this->public.delete = (status_t(*)(ike_sa_manager_t*,ike_sa_id_t*))delete_;
 	this->public.delete_by_name = (status_t(*)(ike_sa_manager_t*,char*))delete_by_name;
 	this->public.checkin_and_destroy = (status_t(*)(ike_sa_manager_t*,ike_sa_t*))checkin_and_destroy;
-
-	/* initialize private variables */
-	this->logger = logger_manager->get_logger(logger_manager, IKE_SA_MANAGER);
 	
+	/* initialize private variables */
 	this->ike_sa_list = linked_list_create();
-
 	pthread_mutex_init(&(this->mutex), NULL);
-
 	this->randomizer = randomizer_create();
-
+	
 	return (ike_sa_manager_t*)this;
 }
diff --git a/src/charon/sa/ike_sa_manager.h b/src/charon/sa/ike_sa_manager.h
index db2efe541..659bdfbb2 100644
--- a/src/charon/sa/ike_sa_manager.h
+++ b/src/charon/sa/ike_sa_manager.h
@@ -26,8 +26,6 @@
 
 #include <types.h>
 #include <sa/ike_sa.h>
-#include <utils/logger.h>
-
 
 typedef struct ike_sa_manager_t ike_sa_manager_t;
 
@@ -84,9 +82,9 @@ struct ike_sa_manager_t {
 	 * @return					checked out/created IKE_SA
 	 */
 	ike_sa_t* (*checkout_by_id) (ike_sa_manager_t* this,
-								  host_t *my_host, host_t* other_host,
-								  identification_t *my_id, 
-								  identification_t *other_id);
+								 host_t *my_host, host_t* other_host,
+								 identification_t *my_id, 
+								 identification_t *other_id);
 	
 	/**
 	 * @brief Check out an IKE_SA by protocol and SPI of one of its CHILD_SA.
@@ -104,30 +102,17 @@ struct ike_sa_manager_t {
 	ike_sa_t* (*checkout_by_child) (ike_sa_manager_t* this, u_int32_t reqid);
 	
 	/**
-	 * @brief Get a list of all IKE_SA SAs currently set up.
-	 * 
-	 * The resulting list with all IDs must be destroyed by 
-	 * the caller. There is no guarantee an ike_sa with the 
-	 * corrensponding ID really exists, since it may be deleted
-	 * in the meantime by another thread.
-	 * 
-	 * @param this			 	the manager object
-	 * @return					a list with ike_sa_id_t s
-	 */
-	linked_list_t *(*get_ike_sa_list) (ike_sa_manager_t* this);
-	
-	/**
-	 * @brief Log the status of the IKE_SA's in the manager.
+	 * @brief Create an iterator over all stored IKE_SAs.
+	 *
+	 * The avoid synchronization issues, the iterator locks access
+	 * to the manager exclusively, until it gets destroyed.
+	 * Only use the iterate() functions of this iterator!!! Anything other
+	 * is not implemented and causes crashes.
 	 *
-	 * A informational log is done to the supplied logger. If logger is 
-	 * NULL, an internal logger is used. If a name is supplied,
-	 * only connections with the matching name will be logged.
-	 * 
 	 * @param this			 	the manager object
-	 * @param logger			logger to do the log, or NULL
-	 * @param name				name of a connection, or NULL
+	 * @return					iterator over all IKE_SAs.
 	 */
-	void (*log_status) (ike_sa_manager_t* this, logger_t* logger, char* name);
+	iterator_t *(*create_iterator) (ike_sa_manager_t* this);
 	
 	/**
 	 * @brief Checkin the SA after usage.
diff --git a/src/charon/sa/transactions/create_child_sa.c b/src/charon/sa/transactions/create_child_sa.c
index ccd25dd0e..8e9648ca7 100644
--- a/src/charon/sa/transactions/create_child_sa.c
+++ b/src/charon/sa/transactions/create_child_sa.c
@@ -128,11 +128,6 @@ struct private_create_child_sa_t {
 	 * source of randomness
 	 */
 	randomizer_t *randomizer;
-	
-	/**
-	 * Assigned logger.
-	 */
-	logger_t *logger;
 };
 
 /**
@@ -236,12 +231,12 @@ static status_t get_request(private_create_child_sa_t *this, message_t **result)
 		switch (this->rekeyed_sa->get_state(this->rekeyed_sa))
 		{
 			case CHILD_REKEYING:
-				this->logger->log(this->logger, ERROR,
-								  "rekeying a CHILD_SA which is already rekeying, aborted");
+				DBG1(SIG_DBG_IKE,
+					 "rekeying a CHILD_SA which is already rekeying, aborted");
 				return FAILED;
 			case CHILD_DELETING:
-				this->logger->log(this->logger, ERROR,
-								  "rekeying a CHILD_SA which is deleting, aborted");
+				DBG1(SIG_DBG_IKE,
+					 "rekeying a CHILD_SA which is deleting, aborted");
 				return FAILED;
 			default:
 				break;
@@ -289,9 +284,8 @@ static status_t get_request(private_create_child_sa_t *this, message_t **result)
 			
 			if (this->policy == NULL)
 			{
-				this->logger->log(this->logger, ERROR,
-								  "no policy found to rekey CHILD_SA with reqid %d",
-								  this->reqid);
+				DBG1(SIG_DBG_IKE, "no policy found to rekey "
+					 "CHILD_SA with reqid %d", this->reqid);
 				return FAILED;
 			}
 		}
@@ -307,8 +301,7 @@ static status_t get_request(private_create_child_sa_t *this, message_t **result)
 		this->child_sa->set_name(this->child_sa, this->policy->get_name(this->policy));
 		if (this->child_sa->alloc(this->child_sa, proposals) != SUCCESS)
 		{
-			this->logger->log(this->logger, ERROR,
-							  "could not install CHILD_SA, CHILD_SA creation aborted");
+			DBG1(SIG_DBG_IKE, "could not install CHILD_SA, CHILD_SA creation aborted");
 			return FAILED;
 		}
 		sa_payload = sa_payload_create_from_proposal_list(proposals);
@@ -376,27 +369,23 @@ static status_t process_notifys(private_create_child_sa_t *this, notify_payload_
 {
 	notify_type_t notify_type = notify_payload->get_notify_type(notify_payload);
 	
-	this->logger->log(this->logger, CONTROL|LEVEL1, "process notify type %s",
-					  mapping_find(notify_type_m, notify_type));
+	DBG2(SIG_DBG_IKE, "process notify type %N", notify_type_names, notify_type);
 
 	switch (notify_type)
 	{
 		case SINGLE_PAIR_REQUIRED:
 		{
-			this->logger->log(this->logger, AUDIT, 
-							  "received a SINGLE_PAIR_REQUIRED notify");
+			DBG1(SIG_DBG_IKE, "received a SINGLE_PAIR_REQUIRED notify");
 			return FAILED;
 		}
 		case TS_UNACCEPTABLE:
 		{
-			this->logger->log(this->logger, CONTROL, 
-							  "received TS_UNACCEPTABLE notify");
+			DBG1(SIG_DBG_IKE, "received TS_UNACCEPTABLE notify");
 			return FAILED;
 		}
 		case NO_PROPOSAL_CHOSEN:
 		{
-			this->logger->log(this->logger, CONTROL,
-							  "received NO_PROPOSAL_CHOSEN notify");
+			DBG1(SIG_DBG_IKE, "received NO_PROPOSAL_CHOSEN notify");
 			return FAILED;
 		}
 		case REKEY_SA:
@@ -423,18 +412,14 @@ static status_t process_notifys(private_create_child_sa_t *this, notify_payload_
 		{
 			if (notify_type < 16383)
 			{
-				this->logger->log(this->logger, AUDIT, 
-								  "received %s notify error (%d), CHILD_SA creation failed",
-								  mapping_find(notify_type_m, notify_type),
-								  notify_type);
+				DBG1(SIG_DBG_IKE, "received %N notify error, CHILD_SA "
+					 "creation failed", notify_type_names, notify_type);
 				return FAILED;	
 			}
 			else
 			{
-				this->logger->log(this->logger, CONTROL, 
-								  "received %s notify (%d), ignored",
-								  mapping_find(notify_type_m, notify_type),
-								  notify_type);
+				DBG1(SIG_DBG_IKE, "received %N notify, ignored",
+					 notify_type_names, notify_type);
 				return SUCCESS;
 			}
 		}
@@ -558,8 +543,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
 	/* check message type */
 	if (request->get_exchange_type(request) != CREATE_CHILD_SA)
 	{
-		this->logger->log(this->logger, ERROR,
-						  "CREATE_CHILD_SA response of invalid type, aborted");
+		DBG1(SIG_DBG_IKE, "CREATE_CHILD_SA response of invalid type, aborted");
 		return FAILED;
 	}
 	
@@ -569,8 +553,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
 		this->ike_sa->get_state(this->ike_sa) == IKE_DELETING)
 	{
 		build_notify(NO_ADDITIONAL_SAS, CHUNK_INITIALIZER, response, TRUE);
-		this->logger->log(this->logger, AUDIT, 
-						  "unable to create new CHILD_SAs, as rekeying in progress");
+		DBG1(SIG_DBG_IKE, "unable to create new CHILD_SAs, as rekeying in progress");
 		return FAILED;
 	}
 	
@@ -599,8 +582,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
 				u_int8_t dh_buffer[] = {0x00, 0x00}; /* MODP_NONE */
 				chunk_t group = chunk_from_buf(dh_buffer);
 				build_notify(INVALID_KE_PAYLOAD, group, response, TRUE);
-				this->logger->log(this->logger, CONTROL,
-								  "CREATE_CHILD_SA used PFS, sending INVALID_KE_PAYLOAD");
+				DBG1(SIG_DBG_IKE, "CREATE_CHILD_SA used PFS, sending INVALID_KE_PAYLOAD");
 				return FAILED;
 			}
 			case NOTIFY:
@@ -615,9 +597,8 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
 			}
 			default:
 			{
-				this->logger->log(this->logger, ERROR, "ignoring %s payload (%d)", 
-								  mapping_find(payload_type_m, payload->get_type(payload)),
-								  payload->get_type(payload));
+				DBG1(SIG_DBG_IKE, "ignoring %N payload",
+					 payload_type_names, payload->get_type(payload));
 				break;
 			}
 		}
@@ -628,8 +609,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
 	if (!(sa_request && nonce_request && tsi_request && tsr_request))
 	{
 		build_notify(INVALID_SYNTAX, CHUNK_INITIALIZER, response, TRUE);
-		this->logger->log(this->logger, AUDIT, 
-						  "request message incomplete, no CHILD_SA created");
+		DBG1(SIG_DBG_IKE, "request message incomplete, no CHILD_SA created");
 		return FAILED;
 	}
 	
@@ -669,8 +649,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
 		
 		if (this->policy == NULL)
 		{
-			this->logger->log(this->logger, AUDIT,
-							  "no acceptable policy found, adding TS_UNACCEPTABLE notify");
+			DBG1(SIG_DBG_IKE, "no acceptable policy found, adding TS_UNACCEPTABLE notify");
 			build_notify(TS_UNACCEPTABLE, CHUNK_INITIALIZER, response, TRUE);
 			return FAILED;
 		}
@@ -686,23 +665,21 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
 		sa_response = sa_payload_create();
 		/* get proposals from request, and select one with ours */
 		proposal_list = sa_request->get_proposals(sa_request);
-		this->logger->log(this->logger, CONTROL|LEVEL1, "selecting proposals:");
+		DBG2(SIG_DBG_IKE, "selecting proposals:");
 		this->proposal = this->policy->select_proposal(this->policy, proposal_list);
 		destroy_proposal_list(proposal_list);
 		
 		/* do we have a proposal? */
 		if (this->proposal == NULL)
 		{
-			this->logger->log(this->logger, AUDIT, 
-							  "CHILD_SA proposals unacceptable, adding NO_PROPOSAL_CHOSEN notify");
+			DBG1(SIG_DBG_IKE, "CHILD_SA proposals unacceptable, adding NO_PROPOSAL_CHOSEN notify");
 			build_notify(NO_PROPOSAL_CHOSEN, CHUNK_INITIALIZER, response, TRUE);
 			return FAILED;
 		}
 		/* do we have traffic selectors? */
 		else if (this->tsi->get_count(this->tsi) == 0 || this->tsr->get_count(this->tsr) == 0)
 		{
-			this->logger->log(this->logger, AUDIT,
-							  "CHILD_SA traffic selectors unacceptable, adding TS_UNACCEPTABLE notify");
+			DBG1(SIG_DBG_IKE, "CHILD_SA traffic selectors unacceptable, adding TS_UNACCEPTABLE notify");
 			build_notify(TS_UNACCEPTABLE, CHUNK_INITIALIZER, response, TRUE);
 			return FAILED;
 		}
@@ -723,8 +700,7 @@ static status_t get_response(private_create_child_sa_t *this, message_t *request
 			this->child_sa->set_name(this->child_sa, this->policy->get_name(this->policy));
 			if (install_child_sa(this, FALSE) != SUCCESS)
 			{
-				this->logger->log(this->logger, ERROR,
-								  "installing CHILD_SA failed, adding NO_PROPOSAL_CHOSEN notify");
+				DBG1(SIG_DBG_IKE, "installing CHILD_SA failed, adding NO_PROPOSAL_CHOSEN notify");
 				build_notify(NO_PROPOSAL_CHOSEN, CHUNK_INITIALIZER, response, TRUE);
 				return FAILED;
 			}
@@ -786,8 +762,7 @@ static status_t conclude(private_create_child_sa_t *this, message_t *response,
 	/* check message type */
 	if (response->get_exchange_type(response) != CREATE_CHILD_SA)
 	{
-		this->logger->log(this->logger, ERROR,
-						  "CREATE_CHILD_SA response of invalid type, aborting");
+		DBG1(SIG_DBG_IKE, "CREATE_CHILD_SA response of invalid type, aborting");
 		return FAILED;
 	}
 	
@@ -826,9 +801,8 @@ static status_t conclude(private_create_child_sa_t *this, message_t *response,
 			}
 			default:
 			{
-				this->logger->log(this->logger, ERROR, "ignoring %s payload (%d)", 
-								  mapping_find(payload_type_m, payload->get_type(payload)),
-								  payload->get_type(payload));
+				DBG1(SIG_DBG_IKE, "ignoring %N payload",
+					 payload_type_names, payload->get_type(payload));
 				break;
 			}
 		}
@@ -837,7 +811,7 @@ static status_t conclude(private_create_child_sa_t *this, message_t *response,
 	
 	if (!(sa_payload && nonce_payload && tsi_payload && tsr_payload))
 	{
-		this->logger->log(this->logger, AUDIT, "response message incomplete, no CHILD_SA built");
+		DBG1(SIG_DBG_IKE, "response message incomplete, no CHILD_SA built");
 		return FAILED;
 	}
 	
@@ -870,14 +844,13 @@ static status_t conclude(private_create_child_sa_t *this, message_t *response,
 			this->tsi->get_count(this->tsi) == 0 ||
 			this->tsr->get_count(this->tsr) == 0)
 		{
-			this->logger->log(this->logger, AUDIT, "CHILD_SA creation failed");
+			DBG1(SIG_DBG_IKE, "CHILD_SA creation failed");
 			return FAILED;
 		}
 		new_child = this->child_sa;
 		if (install_child_sa(this, TRUE) != SUCCESS)
 		{
-			this->logger->log(this->logger, ERROR,
-							"installing CHILD_SA failed, no CHILD_SA built");
+			DBG1(SIG_DBG_IKE, "installing CHILD_SA failed, no CHILD_SA built");
 			return FAILED;
 		}
 	}
@@ -909,14 +882,12 @@ static status_t conclude(private_create_child_sa_t *this, message_t *response,
 			if (memcmp(this_lowest.ptr, this->nonce_s.ptr, 
 				min(this_lowest.len, this->nonce_s.len)) < 0)
 			{
-				this->logger->log(this->logger, ERROR,
-								  "detected simultaneous CHILD_SA rekeying, deleting ours");
+				DBG1(SIG_DBG_IKE, "detected simultaneous CHILD_SA rekeying, deleting ours");
 				this->lost = TRUE;
 			}
 			else
 			{
-				this->logger->log(this->logger, ERROR,
-								  "detected simultaneous CHILD_SA rekeying, but ours is preferred");
+				DBG1(SIG_DBG_IKE, "detected simultaneous CHILD_SA rekeying, but ours is preferred");
 			}
 		}	
 		/* delete the old SA if we have won the rekeying nonce compare*/
@@ -994,7 +965,6 @@ create_child_sa_t *create_child_sa_create(ike_sa_t *ike_sa)
 	this->tsi = NULL;
 	this->tsr = NULL;
 	this->randomizer = randomizer_create();
-	this->logger = logger_manager->get_logger(logger_manager, IKE_SA);
 	
 	return &this->public;
 }
diff --git a/src/charon/sa/transactions/dead_peer_detection.c b/src/charon/sa/transactions/dead_peer_detection.c
index a0e687c32..390ce3401 100644
--- a/src/charon/sa/transactions/dead_peer_detection.c
+++ b/src/charon/sa/transactions/dead_peer_detection.c
@@ -56,11 +56,6 @@ struct private_dead_peer_detection_t {
 	 * Times we did send the request
 	 */
 	u_int32_t requested;
-	
-	/**
-	 * Assigned logger.
-	 */
-	logger_t *logger;
 };
 
 /**
@@ -187,7 +182,6 @@ dead_peer_detection_t *dead_peer_detection_create(ike_sa_t *ike_sa)
 	this->message_id = 0;
 	this->message = NULL;
 	this->requested = 0;
-	this->logger = logger_manager->get_logger(logger_manager, IKE_SA);
 	
 	return &this->public;
 }
diff --git a/src/charon/sa/transactions/delete_child_sa.c b/src/charon/sa/transactions/delete_child_sa.c
index b577e42a4..96dc67ee8 100644
--- a/src/charon/sa/transactions/delete_child_sa.c
+++ b/src/charon/sa/transactions/delete_child_sa.c
@@ -63,11 +63,6 @@ struct private_delete_child_sa_t {
 	 * CHILD SA to delete
 	 */
 	child_sa_t *child_sa;
-	
-	/**
-	 * Assigned logger.
-	 */
-	logger_t *logger;
 };
 
 /**
@@ -133,9 +128,8 @@ static status_t get_request(private_delete_child_sa_t *this, message_t **result)
 		spi = this->child_sa->get_spi(this->child_sa, TRUE);
 		delete_payload = delete_payload_create(protocol);
 		
-		this->logger->log(this->logger, CONTROL,
-						  "created DELETE payload for %s CHILD_SA with SPI 0x%x",
-						  mapping_find(protocol_id_m, protocol), htonl(spi));
+		DBG1(SIG_DBG_IKE, "created DELETE payload for %N CHILD_SA with SPI 0x%x",
+			 protocol_id_names, protocol, htonl(spi));
 		delete_payload->add_spi(delete_payload, spi);
 		request->add_payload(request, (payload_t*)delete_payload);
 	}
@@ -159,8 +153,7 @@ static status_t process_delete(private_delete_child_sa_t *this, delete_payload_t
 	protocol = delete_request->get_protocol_id(delete_request);
 	if (protocol != PROTO_ESP && protocol != PROTO_AH)
 	{
-		this->logger->log(this->logger, CONTROL,
-						  "CHILD_SA delete response contained unexpected protocol");
+		DBG1(SIG_DBG_IKE, "CHILD_SA delete response contained unexpected protocol");
 		return FAILED;
 	}
 	
@@ -184,9 +177,8 @@ static status_t process_delete(private_delete_child_sa_t *this, delete_payload_t
 			
 			child_sa->set_state(child_sa, CHILD_DELETING);
 			
-			this->logger->log(this->logger, CONTROL,
-							  "received DELETE for %s CHILD_SA with SPI 0x%x, deleting",
-							  mapping_find(protocol_id_m, protocol), ntohl(spi));
+			DBG1(SIG_DBG_IKE, "received DELETE for %N CHILD_SA with SPI 0x%x, deleting",
+				 protocol_id_names, protocol, ntohl(spi));
 			
 			rekey = child_sa->get_rekeying_transaction(child_sa);
 			if (rekey)
@@ -208,9 +200,8 @@ static status_t process_delete(private_delete_child_sa_t *this, delete_payload_t
 		}
 		else
 		{
-			this->logger->log(this->logger, ERROR,
-							  "received DELETE for %s CHILD_SA with SPI 0x%x, but no such SA", 
-							  mapping_find(protocol_id_m, protocol), ntohl(spi));
+			DBG1(SIG_DBG_IKE, "received DELETE for %N CHILD_SA with SPI 0x%x, but no such SA",
+				 protocol_id_names, protocol, ntohl(spi));
 		}
 	}
 	iterator->destroy(iterator);
@@ -251,8 +242,7 @@ static status_t get_response(private_delete_child_sa_t *this, message_t *request
 	
 	if (request->get_exchange_type(request) != INFORMATIONAL)
 	{
-		this->logger->log(this->logger, ERROR,
-						  "INFORMATIONAL response of invalid type, aborting");
+		DBG1(SIG_DBG_IKE, "INFORMATIONAL response of invalid type, aborting");
 		return FAILED;
 	}
 	
@@ -262,8 +252,7 @@ static status_t get_response(private_delete_child_sa_t *this, message_t *request
 	if (this->ike_sa->get_state(this->ike_sa) == IKE_REKEYING ||
 		this->ike_sa->get_state(this->ike_sa) == IKE_DELETING)
 	{
-		this->logger->log(this->logger, AUDIT, 
-						  "unable to delete CHILD_SA, as rekeying in progress");
+		DBG1(SIG_DBG_IKE, "unable to delete CHILD_SA, as rekeying in progress");
 		return FAILED;
 	}
 	
@@ -283,9 +272,8 @@ static status_t get_response(private_delete_child_sa_t *this, message_t *request
 			}
 			default:
 			{
-				this->logger->log(this->logger, ERROR|LEVEL1, "ignoring payload %s (%d)",
-								  mapping_find(payload_type_m, payload->get_type(payload)),
-								  payload->get_type(payload));
+				DBG2(SIG_DBG_IKE, "ignoring payload %N",
+					 payload_type_names, payload->get_type(payload));
 				break;
 			}
 		}
@@ -305,8 +293,7 @@ static status_t conclude(private_delete_child_sa_t *this, message_t *response,
 	/* check message type */
 	if (response->get_exchange_type(response) != INFORMATIONAL)
 	{
-		this->logger->log(this->logger, ERROR,
-						  "INFORMATIONAL response of invalid type, aborting");
+		DBG1(SIG_DBG_IKE, "INFORMATIONAL response of invalid type, aborting");
 		return FAILED;
 	}
 	
@@ -326,9 +313,8 @@ static status_t conclude(private_delete_child_sa_t *this, message_t *response,
 			}
 			default:
 			{
-				this->logger->log(this->logger, ERROR|LEVEL1, "ignoring payload %s (%d)",
-								  mapping_find(payload_type_m, payload->get_type(payload)),
-								  payload->get_type(payload));
+				DBG1(SIG_DBG_IKE, "ignoring payload %N",
+					 payload_type_names, payload->get_type(payload));
 				break;
 			}
 		}
@@ -369,7 +355,6 @@ delete_child_sa_t *delete_child_sa_create(ike_sa_t *ike_sa)
 	this->message_id = 0;
 	this->message = NULL;
 	this->requested = 0;
-	this->logger = logger_manager->get_logger(logger_manager, IKE_SA);
 	
 	return &this->public;
 }
diff --git a/src/charon/sa/transactions/delete_ike_sa.c b/src/charon/sa/transactions/delete_ike_sa.c
index 3ab89a45c..a0a01cdea 100644
--- a/src/charon/sa/transactions/delete_ike_sa.c
+++ b/src/charon/sa/transactions/delete_ike_sa.c
@@ -25,7 +25,6 @@
 #include <daemon.h>
 #include <encoding/payloads/delete_payload.h>
 
-
 typedef struct private_delete_ike_sa_t private_delete_ike_sa_t;
 
 /**
@@ -57,11 +56,6 @@ struct private_delete_ike_sa_t {
 	 * Times we did send the request
 	 */
 	u_int32_t requested;
-	
-	/**
-	 * Assigned logger.
-	 */
-	logger_t *logger;
 };
 
 /**
@@ -160,8 +154,7 @@ static status_t get_response(private_delete_ike_sa_t *this, message_t *request,
 	/* check message type */
 	if (request->get_exchange_type(request) != INFORMATIONAL)
 	{
-		this->logger->log(this->logger, ERROR,
-						  "INFORMATIONAL response of invalid type, deleting IKE_SA");
+		DBG1(SIG_DBG_IKE, "INFORMATIONAL response of invalid type, deleting IKE_SA");
 		return DESTROY_ME;
 	}
 	
@@ -181,9 +174,8 @@ static status_t get_response(private_delete_ike_sa_t *this, message_t *request,
 			}
 			default:
 			{
-				this->logger->log(this->logger, ERROR|LEVEL1, "ignoring payload %s (%d)",
-								  mapping_find(payload_type_m, payload->get_type(payload)),
-								  payload->get_type(payload));
+				DBG1(SIG_DBG_IKE, "ignoring payload %N",
+					 payload_type_names, payload->get_type(payload));
 				break;
 			}
 		}
@@ -193,14 +185,12 @@ static status_t get_response(private_delete_ike_sa_t *this, message_t *request,
 	if (delete_request && 
 		delete_request->get_protocol_id(delete_request) == PROTO_IKE)
 	{
-		this->logger->log(this->logger, CONTROL, 
-						  "DELETE request for IKE_SA received, deleting IKE_SA");
+		DBG1(SIG_DBG_IKE, "DELETE request for IKE_SA received, deleting IKE_SA");
 	}
 	else
 	{
 		/* should not happen, as we preparsed this at transaction construction */
-		this->logger->log(this->logger, CONTROL, 
-						  "received a weird DELETE request for IKE_SA, deleting anyway");
+		DBG1(SIG_DBG_IKE, "received a weird DELETE request for IKE_SA, deleting anyway");
 	}
 	if (this->ike_sa->get_state(this->ike_sa) == IKE_DELETING)
 	{
@@ -222,8 +212,7 @@ static status_t conclude(private_delete_ike_sa_t *this, message_t *response,
 	/* check message type */
 	if (response->get_exchange_type(response) != INFORMATIONAL)
 	{
-		this->logger->log(this->logger, ERROR,
-						  "INFORMATIONAL response of invalid type, deleting IKE_SA");
+		DBG1(SIG_DBG_IKE, "INFORMATIONAL response of invalid type, deleting IKE_SA");
 		return DESTROY_ME;
 	}
 	/* this is only an acknowledge. We can't do anything here, but delete
@@ -260,7 +249,6 @@ delete_ike_sa_t *delete_ike_sa_create(ike_sa_t *ike_sa)
 	this->message_id = 0;
 	this->message = NULL;
 	this->requested = 0;
-	this->logger = logger_manager->get_logger(logger_manager, IKE_SA);
 	
 	return &this->public;
 }
diff --git a/src/charon/sa/transactions/ike_auth.c b/src/charon/sa/transactions/ike_auth.c
index a31180546..bacc6d0b2 100644
--- a/src/charon/sa/transactions/ike_auth.c
+++ b/src/charon/sa/transactions/ike_auth.c
@@ -128,11 +128,6 @@ struct private_ike_auth_t {
 	 * reqid to use for CHILD_SA setup
 	 */
 	u_int32_t reqid;
-	
-	/**
-	 * Assigned logger.
-	 */
-	logger_t *logger;
 };
 
 /**
@@ -276,8 +271,7 @@ static status_t get_request(private_ike_auth_t *this, message_t **result)
 		}
 		else
 		{
-			this->logger->log(this->logger, ERROR, 
-							  "could not find my certificate, certificate payload omitted");
+			DBG1(SIG_DBG_IKE, "could not find my certificate, certificate payload omitted");
 		}
 	}
 	
@@ -308,8 +302,7 @@ static status_t get_request(private_ike_auth_t *this, message_t **result)
 		authenticator->destroy(authenticator);
 		if (status != SUCCESS)
 		{
-			this->logger->log(this->logger, AUDIT, 
-							  "could not generate AUTH data, deleting IKE_SA");
+			DBG1(SIG_DBG_IKE, "could not generate AUTH data, deleting IKE_SA");
 			return DESTROY_ME;
 		}
 		request->add_payload(request, (payload_t*)auth_payload);
@@ -333,8 +326,7 @@ static status_t get_request(private_ike_auth_t *this, message_t **result)
 		this->child_sa->set_name(this->child_sa, this->policy->get_name(this->policy));
 		if (this->child_sa->alloc(this->child_sa, proposal_list) != SUCCESS)
 		{
-			this->logger->log(this->logger, ERROR,
-					"could not install CHILD_SA, deleting IKE_SA");
+			DBG1(SIG_DBG_IKE, "could not install CHILD_SA, deleting IKE_SA");
 			return DESTROY_ME;
 		}
 		sa_payload = sa_payload_create_from_proposal_list(proposal_list);
@@ -376,30 +368,26 @@ static status_t process_notifies(private_ike_auth_t *this, notify_payload_t *not
 {
 	notify_type_t notify_type = notify_payload->get_notify_type(notify_payload);
 	
-	this->logger->log(this->logger, CONTROL|LEVEL1, "process notify type %s",
-					  mapping_find(notify_type_m, notify_type));
-
+	DBG2(SIG_DBG_IKE, "process notify type %N", notify_type_names, notify_type);
+	
 	switch (notify_type)
 	{
 		/* these notifies are not critical. no child_sa is built, but IKE stays alive */
 		case SINGLE_PAIR_REQUIRED:
 		{
-			this->logger->log(this->logger, AUDIT, 
-							  "received a SINGLE_PAIR_REQUIRED notify");
+			DBG1(SIG_DBG_IKE, "received a SINGLE_PAIR_REQUIRED notify");
 			this->build_child = FALSE;
 			return SUCCESS;
 		}
 		case TS_UNACCEPTABLE:
 		{
-			this->logger->log(this->logger, CONTROL, 
-							  "received TS_UNACCEPTABLE notify");
+			DBG1(SIG_DBG_IKE, "received TS_UNACCEPTABLE notify");
 			this->build_child = FALSE;
 			return SUCCESS;
 		}
 		case NO_PROPOSAL_CHOSEN:
 		{
-			this->logger->log(this->logger, CONTROL, 
-							  "received NO_PROPOSAL_CHOSEN notify");
+			DBG1(SIG_DBG_IKE, "received NO_PROPOSAL_CHOSEN notify");
 			this->build_child = FALSE;
 			return SUCCESS;
 		}
@@ -407,18 +395,14 @@ static status_t process_notifies(private_ike_auth_t *this, notify_payload_t *not
 		{
 			if (notify_type < 16383)
 			{
-				this->logger->log(this->logger, AUDIT, 
-								  "received %s notify error (%d), deleting IKE_SA",
-								  mapping_find(notify_type_m, notify_type),
-								  notify_type);
+				DBG1(SIG_DBG_IKE, "received %N notify error, deleting IKE_SA",
+					 notify_type_names, notify_type);
 				return DESTROY_ME;	
 			}
 			else
 			{
-				this->logger->log(this->logger, CONTROL, 
-								  "received %s notify (%d), ignored",
-								  mapping_find(notify_type_m, notify_type),
-								  notify_type);
+				DBG1(SIG_DBG_IKE, "received %N notify, ignored",
+					 notify_type_names, notify_type);
 				return SUCCESS;
 			}
 		}
@@ -461,9 +445,8 @@ static void import_certificate(private_ike_auth_t *this, cert_payload_t *cert_pa
 	encoding = cert_payload->get_cert_encoding(cert_payload);
 	if (encoding != CERT_X509_SIGNATURE)
 	{
-		this->logger->log(this->logger, ERROR,
-						  "certificate payload %s not supported, ignored",
-						  enum_name(&cert_encoding_names, encoding));
+		DBG1(SIG_DBG_IKE, "certificate payload %N not supported, ignored",
+			 cert_encoding_names, encoding);
 		return;
 	}
 	cert = x509_create_from_chunk(cert_payload->get_data_clone(cert_payload));
@@ -471,8 +454,7 @@ static void import_certificate(private_ike_auth_t *this, cert_payload_t *cert_pa
 	{
 		if (charon->credentials->verify(charon->credentials, cert, &found))
 		{
-			this->logger->log(this->logger, CONTROL|LEVEL1, 
-							"received end entity certificate is trusted, added to store");
+			DBG2(SIG_DBG_IKE, "received end entity certificate is trusted, added to store");
 			if (!found)
 			{
 				charon->credentials->add_end_certificate(charon->credentials, cert);
@@ -484,15 +466,13 @@ static void import_certificate(private_ike_auth_t *this, cert_payload_t *cert_pa
 		}
 		else
 		{
-			this->logger->log(this->logger, CONTROL, 
-							  "received end entity certificate is not trusted, discarded");
+			DBG1(SIG_DBG_IKE, "received end entity certificate is not trusted, discarded");
 			cert->destroy(cert);
 		}
 	}
 	else
 	{
-		this->logger->log(this->logger, CONTROL, 
-						  "parsing of received certificate failed, discarded");
+		DBG1(SIG_DBG_IKE, "parsing of received certificate failed, discarded");
 	}
 }
 
@@ -589,8 +569,7 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
 	/* check message type */
 	if (request->get_exchange_type(request) != IKE_AUTH)
 	{
-		this->logger->log(this->logger, ERROR,
-						  "IKE_AUTH response of invalid type, deleting IKE_SA");
+		DBG1(SIG_DBG_IKE, "IKE_AUTH response of invalid type, deleting IKE_SA");
 		return DESTROY_ME;
 	}
 	
@@ -641,9 +620,8 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
 			}
 			default:
 			{
-				this->logger->log(this->logger, ERROR, "ignoring %s payload (%d)", 
-								  mapping_find(payload_type_m, payload->get_type(payload)),
-								  payload->get_type(payload));
+				DBG1(SIG_DBG_IKE, "ignoring %N payload",
+					 payload_type_names, payload->get_type(payload));
 				break;
 			}
 		}
@@ -654,8 +632,7 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
 	if (!(idi_request && auth_request && sa_request && tsi_request && tsr_request))
 	{
 		build_notify(INVALID_SYNTAX, response, TRUE);
-		this->logger->log(this->logger, AUDIT, 
-						  "request message incomplete, deleting IKE_SA");
+		DBG1(SIG_DBG_IKE, "request message incomplete, deleting IKE_SA");
 		return DESTROY_ME;
 	}
 	
@@ -693,9 +670,8 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
 		 * traffic selectors. Then we would create a IKE_SA without a CHILD_SA. */
 		if (this->policy == NULL)
 		{
-			this->logger->log(this->logger, AUDIT,
-							  "no acceptable policy for IDs %D - %D found, deleting IKE_SA", 
-							  my_id, other_id);
+			DBG1(SIG_DBG_IKE, "no acceptable policy for IDs %D - %D found, deleting IKE_SA", 
+				 my_id, other_id);
 			my_id->destroy(my_id);
 			other_id->destroy(other_id);
 			build_notify(AUTHENTICATION_FAILED, response, TRUE);
@@ -726,8 +702,7 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
 		}
 		else
 		{
-			this->logger->log(this->logger, ERROR,
-							  "could not find my certificate, cert payload omitted");
+			DBG1(SIG_DBG_IKE, "could not find my certificate, cert payload omitted");
 		}
 	}
 	
@@ -752,8 +727,7 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
 												 TRUE);
 		if (status != SUCCESS)
 		{
-			this->logger->log(this->logger, AUDIT, 
-							  "authentication failed, deleting IKE_SA");
+			DBG1(SIG_DBG_IKE, "authentication failed, deleting IKE_SA");
 			build_notify(AUTHENTICATION_FAILED, response, TRUE);
 			authenticator->destroy(authenticator);
 			return DESTROY_ME;
@@ -767,8 +741,7 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
 		authenticator->destroy(authenticator);
 		if (status != SUCCESS)
 		{
-			this->logger->log(this->logger, AUDIT, 
-							  "authentication data generation failed, deleting IKE_SA");
+			DBG1(SIG_DBG_IKE, "authentication data generation failed, deleting IKE_SA");
 			build_notify(AUTHENTICATION_FAILED, response, TRUE);
 			return DESTROY_ME;
 		}
@@ -787,22 +760,20 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
 		
 		/* get proposals from request, and select one with ours */
 		proposal_list = sa_request->get_proposals(sa_request);
-		this->logger->log(this->logger, CONTROL|LEVEL1, "selecting proposals:");
+		DBG2(SIG_DBG_IKE, "selecting proposals:");
 		this->proposal = this->policy->select_proposal(this->policy, proposal_list);
 		destroy_proposal_list(proposal_list);
 
 		/* do we have a proposal? */
 		if (this->proposal == NULL)
 		{
-			this->logger->log(this->logger, AUDIT, 
-							  "CHILD_SA proposals unacceptable, adding NO_PROPOSAL_CHOSEN notify");
+			DBG1(SIG_DBG_IKE, "CHILD_SA proposals unacceptable, adding NO_PROPOSAL_CHOSEN notify");
 			build_notify(NO_PROPOSAL_CHOSEN, response, FALSE);
 		}
 		/* do we have traffic selectors? */
 		else if (this->tsi->get_count(this->tsi) == 0 || this->tsr->get_count(this->tsr) == 0)
 		{
-			this->logger->log(this->logger, AUDIT,
-							  "CHILD_SA traffic selectors unacceptable, adding TS_UNACCEPTABLE notify");
+			DBG1(SIG_DBG_IKE, "CHILD_SA traffic selectors unacceptable, adding TS_UNACCEPTABLE notify");
 			build_notify(TS_UNACCEPTABLE, response, FALSE);
 		}
 		else
@@ -819,8 +790,7 @@ static status_t get_response(private_ike_auth_t *this, message_t *request,
 			this->child_sa->set_name(this->child_sa, this->policy->get_name(this->policy));
 			if (install_child_sa(this, FALSE) != SUCCESS)
 			{
-				this->logger->log(this->logger, ERROR,
-								  "installing CHILD_SA failed, adding NO_PROPOSAL_CHOSEN notify");
+				DBG1(SIG_DBG_IKE, "installing CHILD_SA failed, adding NO_PROPOSAL_CHOSEN notify");
 				build_notify(NO_PROPOSAL_CHOSEN, response, FALSE);
 			}
 			/* add proposal to sa payload */
@@ -860,8 +830,7 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
 	/* check message type */
 	if (response->get_exchange_type(response) != IKE_AUTH)
 	{
-		this->logger->log(this->logger, ERROR,
-						  "IKE_AUTH response of invalid type, deleting IKE_SA");
+		DBG1(SIG_DBG_IKE, "IKE_AUTH response of invalid type, deleting IKE_SA");
 		return DESTROY_ME;
 	}
 	
@@ -913,9 +882,8 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
 			}
 			default:
 			{
-				this->logger->log(this->logger, CONTROL, "ignoring payload %s (%d)",
-								  mapping_find(payload_type_m, payload->get_type(payload)),
-								  payload->get_type(payload));
+				DBG1(SIG_DBG_IKE, "ignoring payload %N",
+					 payload_type_names, payload->get_type(payload));
 				break;
 			}
 		}
@@ -924,7 +892,7 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
 	
 	if (!(idr_payload && auth_payload && sa_payload && tsi_payload && tsr_payload))
 	{
-		this->logger->log(this->logger, AUDIT, "response message incomplete, deleting IKE_SA");
+		DBG1(SIG_DBG_IKE, "response message incomplete, deleting IKE_SA");
 		return DESTROY_ME;
 	}
 	
@@ -938,9 +906,8 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
 		if (!other_id->matches(other_id, configured_other_id, &wildcards))
 		{
 			other_id->destroy(other_id);
-			this->logger->log(this->logger, AUDIT,
-							  "other peer uses unacceptable ID (%D, excepted %D), deleting IKE_SA",
-							  other_id, configured_other_id);
+			DBG1(SIG_DBG_IKE, "other peer uses unacceptable ID (%D, excepted %D), deleting IKE_SA",
+				 other_id, configured_other_id);
 			return DESTROY_ME;
 		}
 		/* update other ID. It was already set, but may contain wildcards */
@@ -972,7 +939,7 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
 		authenticator->destroy(authenticator);
 		if (status != SUCCESS)
 		{
-			this->logger->log(this->logger, AUDIT, "authentication failed, deleting IKE_SA");
+			DBG1(SIG_DBG_IKE, "authentication failed, deleting IKE_SA");
 			return DESTROY_ME;	
 		}
 	}
@@ -1003,15 +970,13 @@ static status_t conclude(private_ike_auth_t *this, message_t *response,
 			this->tsr->get_count(this->tsr) == 0 ||
 			!this->build_child)
 		{
-			this->logger->log(this->logger, AUDIT,
-							  "CHILD_SA creation failed");
+			DBG1(SIG_DBG_IKE, "CHILD_SA creation failed");
 		}
 		else
 		{
 			if (install_child_sa(this, TRUE) != SUCCESS)
 			{
-				this->logger->log(this->logger, ERROR,
-								  "installing CHILD_SA failed, no CHILD_SA built");
+				DBG1(SIG_DBG_IKE, "installing CHILD_SA failed, no CHILD_SA built");
 			}
 		}
 	}
@@ -1045,7 +1010,7 @@ static void destroy(private_ike_auth_t *this)
 ike_auth_t *ike_auth_create(ike_sa_t *ike_sa)
 {
 	private_ike_auth_t *this = malloc_thing(private_ike_auth_t);
-
+	
 	/* transaction interface functions */
 	this->public.transaction.get_request = (status_t(*)(transaction_t*,message_t**))get_request;
 	this->public.transaction.get_response = (status_t(*)(transaction_t*,message_t*,message_t**,transaction_t**))get_response;
@@ -1075,7 +1040,6 @@ ike_auth_t *ike_auth_create(ike_sa_t *ike_sa)
 	this->tsr = NULL;
 	this->build_child = TRUE;
 	this->reqid = 0;
-	this->logger = logger_manager->get_logger(logger_manager, IKE_SA);
-
+	
 	return &this->public;
 }
diff --git a/src/charon/sa/transactions/ike_sa_init.c b/src/charon/sa/transactions/ike_sa_init.c
index ad481d6fa..8232500f4 100644
--- a/src/charon/sa/transactions/ike_sa_init.c
+++ b/src/charon/sa/transactions/ike_sa_init.c
@@ -154,11 +154,6 @@ struct private_ike_sa_init_t {
 	 * Have we found a matching destination address NAT hash?
 	 */
 	bool natd_dst_matched;
-	
-	/**
-	 * Assigned logger.
-	 */
-	logger_t *logger;
 };
 
 /**
@@ -237,8 +232,8 @@ static chunk_t generate_natd_hash(private_ike_sa_init_t *this,
 	/*  natd_hash = SHA1( spi_i | spi_r | address | port ) */
 	natd_chunk = chunk_cat("cccc", spi_i_chunk, spi_r_chunk, addr_chunk, port_chunk);
 	this->nat_hasher->allocate_hash(this->nat_hasher, natd_chunk, &natd_hash);
-	this->logger->log_chunk(this->logger, RAW, "natd_chunk", natd_chunk);
-	this->logger->log_chunk(this->logger, RAW, "natd_hash", natd_hash);
+	DBG3(SIG_DBG_IKE, "natd_chunk %B", &natd_chunk);
+	DBG3(SIG_DBG_IKE, "natd_hash %B", &natd_hash);
 	
 	chunk_free(&natd_chunk);
 	return natd_hash;
@@ -333,9 +328,8 @@ static status_t get_request(private_ike_sa_init_t *this, message_t **result)
 		this->diffie_hellman = diffie_hellman_create(dh_group);
 		if (this->diffie_hellman == NULL)
 		{
-			this->logger->log(this->logger, AUDIT,
-							  "DH group %s (%d) not supported, aborting",
-							  mapping_find(diffie_hellman_group_m, dh_group), dh_group);
+			DBG1(SIG_DBG_IKE, "DH group %N not supported, aborting",
+				 diffie_hellman_group_names, dh_group);
 			return DESTROY_ME;
 		}
 	}
@@ -407,21 +401,18 @@ static status_t process_notifys(private_ike_sa_init_t *this, notify_payload_t *n
 	chunk_t notification_data;
 	notify_type_t notify_type = notify_payload->get_notify_type(notify_payload);
 	
-	this->logger->log(this->logger, CONTROL|LEVEL1, "process notify type %s",
-					  mapping_find(notify_type_m, notify_type));
+	DBG2(SIG_DBG_IKE, "process notify type %N", notify_type_names, notify_type);
 
 	switch (notify_type)
 	{
 		case NO_PROPOSAL_CHOSEN:
 		{
-			this->logger->log(this->logger, AUDIT, 
-							  "received a NO_PROPOSAL_CHOSEN notify, deleting IKE_SA");
+			DBG1(SIG_DBG_IKE, "received a NO_PROPOSAL_CHOSEN notify, deleting IKE_SA");
 			return DESTROY_ME;
 		}
 		case INVALID_MAJOR_VERSION:
 		{
-			this->logger->log(this->logger, AUDIT, 
-							  "received a INVALID_MAJOR_VERSION notify, deleting IKE_SA");
+			DBG1(SIG_DBG_IKE, "received a INVALID_MAJOR_VERSION notify, deleting IKE_SA");
 			return DESTROY_ME;
 		}
 		case INVALID_KE_PAYLOAD:
@@ -434,14 +425,12 @@ static status_t process_notifys(private_ike_sa_init_t *this, notify_payload_t *n
 			notify_data = notify_payload->get_notification_data(notify_payload);
 			dh_group = ntohs(*((u_int16_t*)notify_data.ptr));
 			
-			this->logger->log(this->logger, AUDIT, 
-							  "peer didn't accept DH group %s, it requested %s",
-							  mapping_find(diffie_hellman_group_m, old_dh_group),
-							  mapping_find(diffie_hellman_group_m, dh_group));
+			DBG1(SIG_DBG_IKE, "peer didn't accept DH group %N, it requested %N",
+				 diffie_hellman_group_names, old_dh_group,
+				 diffie_hellman_group_names, dh_group);
 			if (!this->connection->check_dh_group(this->connection, dh_group))
 			{
-				this->logger->log(this->logger, AUDIT, 
-								  "requested DH group not acceptable, aborting");
+				DBG1(SIG_DBG_IKE, "requested DH group not acceptable, aborting");
 				return DESTROY_ME;
 			}
 			retry = ike_sa_init_create(this->ike_sa);
@@ -463,11 +452,11 @@ static status_t process_notifys(private_ike_sa_init_t *this, notify_payload_t *n
 			if (chunk_equals(notification_data, this->natd_dst_hash))
 			{
 				this->natd_dst_matched = TRUE;
-				this->logger->log(this->logger, CONTROL|LEVEL3, "NAT-D dst hash match");
+				DBG2(SIG_DBG_IKE, "NAT-D dst hash match");
 			}
 			else
 			{
-				this->logger->log(this->logger, CONTROL|LEVEL3, "NAT-D dst hash mismatch");
+				DBG2(SIG_DBG_IKE, "NAT-D dst hash mismatch");
 			}
 			return SUCCESS;
 		}
@@ -482,11 +471,11 @@ static status_t process_notifys(private_ike_sa_init_t *this, notify_payload_t *n
 			if (chunk_equals(notification_data, this->natd_src_hash))
 			{
 				this->natd_src_matched = TRUE;
-				this->logger->log(this->logger, CONTROL|LEVEL3, "NAT-D src hash match");
+				DBG2(SIG_DBG_IKE, "NAT-D src hash match");
 			}
 			else
 			{
-				this->logger->log(this->logger, CONTROL|LEVEL3, "NAT-D src hash mismatch");
+				DBG2(SIG_DBG_IKE, "NAT-D src hash mismatch");
 			}
 			return SUCCESS;
 		}
@@ -494,18 +483,14 @@ static status_t process_notifys(private_ike_sa_init_t *this, notify_payload_t *n
 		{
 			if (notify_type < 16383)
 			{
-				this->logger->log(this->logger, AUDIT, 
-								  "received %s notify error (%d), deleting IKE_SA",
-								  mapping_find(notify_type_m, notify_type),
-								  notify_type);
+				DBG1(SIG_DBG_IKE, "received %N notify error, deleting IKE_SA",
+					 notify_type_names, notify_type);
 				return DESTROY_ME;	
 			}
 			else
 			{
-				this->logger->log(this->logger, CONTROL, 
-								  "received %s notify (%d), ignored",
-								  mapping_find(notify_type_m, notify_type),
-								  notify_type);
+				DBG1(SIG_DBG_IKE, "received %N notify, ignored",
+					 notify_type_names, notify_type);
 				return SUCCESS;
 			}
 		}
@@ -555,8 +540,7 @@ static status_t get_response(private_ike_sa_init_t *this,
 	/* check message type */
 	if (request->get_exchange_type(request) != IKE_SA_INIT)
 	{
-		this->logger->log(this->logger, ERROR, 
-						  "IKE_SA_INIT request of invalid type, deleting IKE_SA");
+		DBG1(SIG_DBG_IKE, "IKE_SA_INIT request of invalid type, deleting IKE_SA");
 		return DESTROY_ME;
 	}
 	
@@ -569,9 +553,8 @@ static status_t get_response(private_ike_sa_init_t *this,
 		notify->set_notify_type(notify, NO_PROPOSAL_CHOSEN);
 		response->add_payload(response, (payload_t*)notify);
 		
-		this->logger->log(this->logger, AUDIT,
-						  "no connection for hosts %H...%H found, deleting IKE_SA",
-						  me, other);
+		DBG1(SIG_DBG_IKE, "no connection for hosts %H...%H found, deleting IKE_SA",
+			 me, other);
 		return DESTROY_ME;
 	}
 	
@@ -623,10 +606,8 @@ static status_t get_response(private_ike_sa_init_t *this,
 			}
 			default:
 			{
-				this->logger->log(this->logger, ERROR|LEVEL1, 
-								  "ignoring %s payload (%d)", 
-								  mapping_find(payload_type_m, payload->get_type(payload)),
-								  payload->get_type(payload));
+				DBG2(SIG_DBG_IKE, "ignoring %N payload",
+					 payload_type_names, payload->get_type(payload));
 				break;
 			}
 		}
@@ -639,8 +620,7 @@ static status_t get_response(private_ike_sa_init_t *this,
 		notify_payload_t *notify = notify_payload_create();
 		notify->set_notify_type(notify, INVALID_SYNTAX);
 		response->add_payload(response, (payload_t*)notify);
-		this->logger->log(this->logger, AUDIT, 
-						  "request message incomplete, deleting IKE_SA");
+		DBG1(SIG_DBG_IKE, "request message incomplete, deleting IKE_SA");
 		return DESTROY_ME;
 	}
 	
@@ -662,8 +642,7 @@ static status_t get_response(private_ike_sa_init_t *this,
 			notify_payload_t *notify = notify_payload_create();
 			notify->set_notify_type(notify, NO_PROPOSAL_CHOSEN);
 			response->add_payload(response, (payload_t*)notify);
-			this->logger->log(this->logger, AUDIT,
-							  "request did not contain any acceptable proposals, deleting IKE_SA");
+			DBG1(SIG_DBG_IKE, "request did not contain any acceptable proposals, deleting IKE_SA");
 			return DESTROY_ME;
 		}
 		sa_response = sa_payload_create_from_proposal(this->proposal);	
@@ -692,10 +671,10 @@ static status_t get_response(private_ike_sa_init_t *this,
 			payload_t *payload;
 			
 			notify_group = this->connection->get_dh_group(this->connection);
-			this->logger->log(this->logger, AUDIT, 
-							  "request used inacceptable DH group %s, sending INVALID_KE_PAYLOAD with %s, deleting IKE_SA",
-							  mapping_find(diffie_hellman_group_m, used_group),
-							  mapping_find(diffie_hellman_group_m, notify_group));
+			DBG1(SIG_DBG_IKE, "request used inacceptable DH group %N, sending "
+				 "INVALID_KE_PAYLOAD with %N, deleting IKE_SA",
+				 diffie_hellman_group_names, used_group,
+				 diffie_hellman_group_names, notify_group);
 			
 			/* remove already added payloads */
 			iterator = response->get_payload_iterator(response);
@@ -740,8 +719,7 @@ static status_t get_response(private_ike_sa_init_t *this,
 			notify_payload_t *notify = notify_payload_create();
 			notify->set_notify_type(notify, NO_PROPOSAL_CHOSEN);
 			response->add_payload(response, (payload_t*)notify);
-			this->logger->log(this->logger, AUDIT,
-							  "could not get random bytes for nonce, deleting IKE_SA");
+			DBG1(SIG_DBG_IKE, "could not get random bytes for nonce, deleting IKE_SA");
 			return DESTROY_ME;
 		}
 		nonce_response = nonce_payload_create();
@@ -763,8 +741,7 @@ static status_t get_response(private_ike_sa_init_t *this,
 			notify = notify_payload_create();
 			notify->set_notify_type(notify, INVALID_SYNTAX);
 			response->add_payload(response, (payload_t*)notify);
-			this->logger->log(this->logger, AUDIT,
-							  "request contained wrong number of NAT-D payloads, deleting IKE_SA");
+			DBG1(SIG_DBG_IKE, "request contained wrong number of NAT-D payloads, deleting IKE_SA");
 			return DESTROY_ME;
 		}
 		if (this->natd_dst_seen && !this->natd_dst_matched)
@@ -797,8 +774,7 @@ static status_t get_response(private_ike_sa_init_t *this,
 		notify_payload_t *notify = notify_payload_create();
 		notify->set_notify_type(notify, NO_PROPOSAL_CHOSEN);
 		response->add_payload(response, (payload_t*)notify);
-		this->logger->log(this->logger, AUDIT, 
-						  "transform objects could not be created from selected proposal, deleting IKE_SA");
+		DBG1(SIG_DBG_IKE, "transform objects could not be created from selected proposal, deleting IKE_SA");
 		return DESTROY_ME;
 	}
 	
@@ -816,8 +792,7 @@ static status_t get_response(private_ike_sa_init_t *this,
 		 * as we don't use a crypter/signer in ike_sa_init... */
 		if (response->generate(response, NULL, NULL, &response_packet) != SUCCESS)
 		{
-			this->logger->log(this->logger, AUDIT, 
-							  "error in response generation, deleting IKE_SA");
+			DBG1(SIG_DBG_IKE, "error in response generation, deleting IKE_SA");
 			return DESTROY_ME;
 		}
 		response_packet->destroy(response_packet);
@@ -870,8 +845,7 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
 	/* check message type */
 	if (response->get_exchange_type(response) != IKE_SA_INIT)
 	{
-		this->logger->log(this->logger, ERROR, 
-						  "IKE_SA_INIT response of invalid type, deleting IKE_SA");
+		DBG1(SIG_DBG_IKE, "IKE_SA_INIT response of invalid type, deleting IKE_SA");
 		return DESTROY_ME;
 	}
 	
@@ -885,8 +859,7 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
 	responder_spi = response->get_responder_spi(response);
 	if (responder_spi == 0)
 	{
-		this->logger->log(this->logger, ERROR, 
-						  "response contained a SPI of zero, deleting IKE_SA");
+		DBG1(SIG_DBG_IKE, "response contained a SPI of zero, deleting IKE_SA");
 		return DESTROY_ME;
 	}
 	
@@ -937,9 +910,8 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
 			}
 			default:
 			{
-				this->logger->log(this->logger, ERROR, "ignoring payload %s (%d)",
-								  mapping_find(payload_type_m, payload->get_type(payload)),
-								  payload->get_type(payload));
+				DBG1(SIG_DBG_IKE, "ignoring payload %N",
+					 payload_type_names, payload->get_type(payload));
 				break;
 			}
 		}
@@ -948,7 +920,7 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
 	
 	if (!(nonce_payload && sa_payload && ke_payload))
 	{
-		this->logger->log(this->logger, AUDIT, "response message incomplete, deleting IKE_SA");
+		DBG1(SIG_DBG_IKE, "response message incomplete, deleting IKE_SA");
 		return DESTROY_ME;
 	}
 	
@@ -965,8 +937,7 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
 		proposal_list = sa_payload->get_proposals (sa_payload);
 		if (proposal_list->get_count(proposal_list) != 1)
 		{
-			this->logger->log(this->logger, AUDIT, 
-							  "response did not contain a single proposal, deleting IKE_SA");
+			DBG1(SIG_DBG_IKE, "response did not contain a single proposal, deleting IKE_SA");
 			while (proposal_list->remove_last(proposal_list, (void**)&proposal) == SUCCESS)
 			{
 				proposal->destroy(proposal);
@@ -981,8 +952,7 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
 		
 		if (this->proposal == NULL)
 		{
-			this->logger->log(this->logger, AUDIT, 
-							  "peer selected a proposal we did not offer, deleting IKE_SA");
+			DBG1(SIG_DBG_IKE, "peer selected a proposal we did not offer, deleting IKE_SA");
 			return DESTROY_ME;
 		}
 	}
@@ -1010,8 +980,7 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
 		if ((!this->natd_dst_seen && this->natd_src_seen) ||
 			(this->natd_dst_seen && !this->natd_src_seen))
 		{
-			this->logger->log(this->logger, AUDIT, 
-							"request contained wrong number of NAT-D payloads, deleting IKE_SA");
+			DBG1(SIG_DBG_IKE, "request contained wrong number of NAT-D payloads, deleting IKE_SA");
 			return DESTROY_ME;
 		}
 		if (this->natd_src_seen && !this->natd_src_matched)
@@ -1029,7 +998,7 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
 			other = this->ike_sa->get_other_host(this->ike_sa);
 			other->set_port(other, IKEV2_NATT_PORT);
 			
-			this->logger->log(this->logger, CONTROL|LEVEL1, "switching to port %d", IKEV2_NATT_PORT);
+			DBG2(SIG_DBG_IKE, "switching to port %d", IKEV2_NATT_PORT);
 		}
 	}
 	
@@ -1043,8 +1012,7 @@ static status_t conclude(private_ike_sa_init_t *this, message_t *response,
 								  this->nonce_i, this->nonce_r,
 								  TRUE, NULL, NULL) != SUCCESS)
 	{
-		this->logger->log(this->logger, AUDIT, 
-						  "transform objects could not be created from selected proposal, deleting IKE_SA");
+		DBG1(SIG_DBG_IKE, "transform objects could not be created from selected proposal, deleting IKE_SA");
 		return DESTROY_ME;
 	}
 	
@@ -1133,7 +1101,6 @@ ike_sa_init_t *ike_sa_init_create(ike_sa_t *ike_sa)
 	this->natd_dst_seen = FALSE;
 	this->natd_src_matched = FALSE;
 	this->natd_dst_matched = FALSE;
-	this->logger = logger_manager->get_logger(logger_manager, IKE_SA);
 	
 	return &this->public;
 }
diff --git a/src/charon/sa/transactions/rekey_ike_sa.c b/src/charon/sa/transactions/rekey_ike_sa.c
index 41d51802d..4b9dcc176 100644
--- a/src/charon/sa/transactions/rekey_ike_sa.c
+++ b/src/charon/sa/transactions/rekey_ike_sa.c
@@ -113,11 +113,6 @@ struct private_rekey_ike_sa_t {
 	 * next transaction processed by the IKE_SA
 	 */
 	transaction_t **next;
-	
-	/**
-	 * Assigned logger.
-	 */
-	logger_t *logger;
 };
 
 /**
@@ -186,10 +181,8 @@ static status_t get_request(private_rekey_ike_sa_t *this, message_t **result)
 	if (this->ike_sa->get_state(this->ike_sa) != IKE_ESTABLISHED &&
 	    !this->diffie_hellman)
 	{
-		this->logger->log(this->logger, ERROR,
-						  "tried to rekey in state %s, aborted",
-						  mapping_find(ike_sa_state_m,
-									   this->ike_sa->get_state(this->ike_sa)));
+		DBG1(SIG_DBG_IKE, "tried to rekey in state %N, aborted",
+			 ike_sa_state_names, this->ike_sa->get_state(this->ike_sa));
 		return FAILED;
 	}
 	
@@ -226,8 +219,7 @@ static status_t get_request(private_rekey_ike_sa_t *this, message_t **result)
 										me, other);
 			if (this->connection == NULL)
 			{
-				this->logger->log(this->logger, ERROR,
-								  "no connection found to rekey IKE_SA");
+				DBG1(SIG_DBG_IKE, "no connection found to rekey IKE_SA");
 				return FAILED;
 			}
 		}
@@ -274,9 +266,8 @@ static status_t get_request(private_rekey_ike_sa_t *this, message_t **result)
 		this->diffie_hellman = diffie_hellman_create(dh_group);
 		if (this->diffie_hellman == NULL)
 		{
-			this->logger->log(this->logger, AUDIT,
-							  "DH group %s (%d) not supported, aborting",
-							  mapping_find(diffie_hellman_group_m, dh_group), dh_group);
+			DBG1(SIG_DBG_IKE, "DH group %N not supported, aborting",
+				 diffie_hellman_group_names, dh_group);
 			return FAILED;
 		}
 	}
@@ -305,15 +296,13 @@ static status_t process_notifys(private_rekey_ike_sa_t *this, notify_payload_t *
 {
 	notify_type_t notify_type = notify_payload->get_notify_type(notify_payload);
 	
-	this->logger->log(this->logger, CONTROL|LEVEL1, "process notify type %s",
-					  mapping_find(notify_type_m, notify_type));
+	DBG2(SIG_DBG_IKE,"process notify type %N", notify_type_names, notify_type);
 
 	switch (notify_type)
 	{
 		case NO_PROPOSAL_CHOSEN:
 		{
-			this->logger->log(this->logger, AUDIT, 
-							  "received a NO_PROPOSAL_CHOSEN notify, IKE_SA rekeying failed");
+			DBG1(SIG_DBG_IKE, "received a NO_PROPOSAL_CHOSEN notify, IKE_SA rekeying failed");
 			return FAILED;
 		}
 		case INVALID_KE_PAYLOAD:
@@ -326,14 +315,12 @@ static status_t process_notifys(private_rekey_ike_sa_t *this, notify_payload_t *
 			notify_data = notify_payload->get_notification_data(notify_payload);
 			dh_group = ntohs(*((u_int16_t*)notify_data.ptr));
 			
-			this->logger->log(this->logger, AUDIT, 
-							  "peer didn't accept DH group %s, it requested %s",
-							  mapping_find(diffie_hellman_group_m, old_dh_group),
-							  mapping_find(diffie_hellman_group_m, dh_group));
+			DBG1(SIG_DBG_IKE, "peer didn't accept DH group %N, it requested %N",
+				 diffie_hellman_group_names, old_dh_group,
+				 diffie_hellman_group_names, dh_group);
 			if (!this->connection->check_dh_group(this->connection, dh_group))
 			{
-				this->logger->log(this->logger, AUDIT, 
-								  "requested DH group not acceptable, IKE_SA rekeying failed");
+				DBG1(SIG_DBG_IKE, "requested DH group not acceptable, IKE_SA rekeying failed");
 				return FAILED;
 			}
 			retry = rekey_ike_sa_create(this->ike_sa);
@@ -345,18 +332,14 @@ static status_t process_notifys(private_rekey_ike_sa_t *this, notify_payload_t *
 		{
 			if (notify_type < 16383)
 			{
-				this->logger->log(this->logger, AUDIT, 
-								  "received %s notify error (%d, IKE_SA rekeying failed",
-								  mapping_find(notify_type_m, notify_type),
-								  notify_type);
+				DBG1(SIG_DBG_IKE, "received %N notify error, IKE_SA rekeying failed",
+					 notify_type_names, notify_type);
 				return FAILED;	
 			}
 			else
 			{
-				this->logger->log(this->logger, CONTROL, 
-								  "received %s notify (%d), ignored",
-								  mapping_find(notify_type_m, notify_type),
-								  notify_type);
+				DBG1(SIG_DBG_IKE, "received %N notify, ignored",
+					 notify_type_names, notify_type);
 				return SUCCESS;
 			}
 		}
@@ -468,8 +451,7 @@ static status_t get_response(private_rekey_ike_sa_t *this, message_t *request,
 	/* check message type */
 	if (request->get_exchange_type(request) != CREATE_CHILD_SA)
 	{
-		this->logger->log(this->logger, ERROR,
-						  "CREATE_CHILD_SA response of invalid type, aborted");
+		DBG1(SIG_DBG_IKE, "CREATE_CHILD_SA response of invalid type, aborted");
 		return FAILED;
 	}
 	
@@ -477,8 +459,7 @@ static status_t get_response(private_rekey_ike_sa_t *this, message_t *request,
 	if (this->ike_sa->get_state(this->ike_sa) == IKE_DELETING)
 	{
 		build_notify(NO_PROPOSAL_CHOSEN, CHUNK_INITIALIZER, response, TRUE);
-		this->logger->log(this->logger, CONTROL,
-						  "unable to rekey, as delete in progress. Sending NO_PROPOSAL_CHOSEN");
+		DBG1(SIG_DBG_IKE, "unable to rekey, as delete in progress. Sending NO_PROPOSAL_CHOSEN");
 		return FAILED;
 	}
 	
@@ -492,8 +473,7 @@ static status_t get_response(private_rekey_ike_sa_t *this, message_t *request,
 			state == CHILD_DELETING)
 		{
 			build_notify(NO_PROPOSAL_CHOSEN, CHUNK_INITIALIZER, response, TRUE);
-			this->logger->log(this->logger, CONTROL,
-							  "unable to rekey, one CHILD_SA is half open. Sending NO_PROPOSAL_CHOSEN");
+			DBG1(SIG_DBG_IKE, "unable to rekey, one CHILD_SA is half open. Sending NO_PROPOSAL_CHOSEN");
 			iterator->destroy(iterator);
 			return FAILED;
 		}
@@ -514,8 +494,7 @@ static status_t get_response(private_rekey_ike_sa_t *this, message_t *request,
 								charon->connections, me, other);
 		if (this->connection == NULL)
 		{
-			this->logger->log(this->logger, ERROR,
-								"no connection found to rekey IKE_SA, sending NO_RROPOSAL_CHOSEN");
+			DBG1(SIG_DBG_IKE, "no connection found to rekey IKE_SA, sending NO_RROPOSAL_CHOSEN");
 			build_notify(NO_PROPOSAL_CHOSEN, CHUNK_INITIALIZER, response, TRUE);
 			return FAILED;
 		}
@@ -552,9 +531,8 @@ static status_t get_response(private_rekey_ike_sa_t *this, message_t *request,
 			}
 			default:
 			{
-				this->logger->log(this->logger, ERROR, "ignoring %s payload (%d)", 
-								  mapping_find(payload_type_m, payload->get_type(payload)),
-								  payload->get_type(payload));
+				DBG1(SIG_DBG_IKE, "ignoring %N payload",
+					 payload_type_names, payload->get_type(payload));
 				break;
 			}
 		}
@@ -565,8 +543,7 @@ static status_t get_response(private_rekey_ike_sa_t *this, message_t *request,
 	if (!(sa_request && nonce_request && ke_request))
 	{
 		build_notify(INVALID_SYNTAX, CHUNK_INITIALIZER, response, TRUE);
-		this->logger->log(this->logger, AUDIT, 
-						  "request message incomplete, IKE_SA rekeying failed");
+		DBG1(SIG_DBG_IKE, "request message incomplete, IKE_SA rekeying failed");
 		return FAILED;
 	}
 	
@@ -591,15 +568,14 @@ static status_t get_response(private_rekey_ike_sa_t *this, message_t *request,
 		sa_response = sa_payload_create();
 		/* get proposals from request, and select one with ours */
 		proposal_list = sa_request->get_proposals(sa_request);
-		this->logger->log(this->logger, CONTROL|LEVEL1, "selecting proposals:");
+		DBG2(SIG_DBG_IKE, "selecting proposals:");
 		this->proposal = this->connection->select_proposal(this->connection, proposal_list);
 		destroy_proposal_list(proposal_list);
 		
 		/* do we have a proposal? */
 		if (this->proposal == NULL)
 		{
-			this->logger->log(this->logger, AUDIT, 
-							  "no proposals acceptable to rekey IKE_SA, sending NO_PROPOSAL_CHOSEN");
+			DBG1(SIG_DBG_IKE, "no proposals acceptable to rekey IKE_SA, sending NO_PROPOSAL_CHOSEN");
 			build_notify(NO_PROPOSAL_CHOSEN, CHUNK_INITIALIZER, response, TRUE);
 			return FAILED;
 		}
@@ -632,10 +608,10 @@ static status_t get_response(private_rekey_ike_sa_t *this, message_t *request,
 			chunk_t notify_chunk;
 			
 			notify_group = this->connection->get_dh_group(this->connection);
-			this->logger->log(this->logger, AUDIT, 
-							  "request used inacceptable DH group %s, sending INVALID_KE_PAYLOAD with %s",
-							  mapping_find(diffie_hellman_group_m, used_group),
-							  mapping_find(diffie_hellman_group_m, notify_group));
+			DBG1(SIG_DBG_IKE, "request used inacceptable DH group %N, sending "
+				 "INVALID_KE_PAYLOAD with %N",
+				 diffie_hellman_group_names, used_group,
+				 diffie_hellman_group_names, notify_group);
 			
 			notify_group = htons(notify_group);
 			notify_chunk.ptr = (u_int8_t*)&notify_group;
@@ -713,8 +689,7 @@ static status_t conclude(private_rekey_ike_sa_t *this, message_t *response,
 	/* check message type */
 	if (response->get_exchange_type(response) != CREATE_CHILD_SA)
 	{
-		this->logger->log(this->logger, ERROR,
-						  "CREATE_CHILD_SA response of invalid type, aborting");
+		DBG1(SIG_DBG_IKE, "CREATE_CHILD_SA response of invalid type, aborting");
 		return FAILED;
 	}
 	
@@ -753,9 +728,8 @@ static status_t conclude(private_rekey_ike_sa_t *this, message_t *response,
 			}
 			default:
 			{
-				this->logger->log(this->logger, ERROR, "ignoring %s payload (%d)", 
-								  mapping_find(payload_type_m, payload->get_type(payload)),
-								  payload->get_type(payload));
+				DBG1(SIG_DBG_IKE, "ignoring %N payload",
+					 payload_type_names, payload->get_type(payload));
 				break;
 			}
 		}
@@ -764,7 +738,7 @@ static status_t conclude(private_rekey_ike_sa_t *this, message_t *response,
 	
 	if (!(sa_payload && nonce_payload && ke_payload))
 	{
-		this->logger->log(this->logger, AUDIT, "response message incomplete, rekeying IKE_SA failed");
+		DBG1(SIG_DBG_IKE, "response message incomplete, rekeying IKE_SA failed");
 		return FAILED;
 	}
 	
@@ -784,8 +758,7 @@ static status_t conclude(private_rekey_ike_sa_t *this, message_t *response,
 		
 		if (this->proposal == NULL)
 		{
-			this->logger->log(this->logger, AUDIT, 
-							  "no proposal selected, rekeying IKE_SA failed");
+			DBG1(SIG_DBG_IKE, "no proposal selected, rekeying IKE_SA failed");
 			return FAILED;
 		}
 		spi = this->proposal->get_spi(this->proposal);
@@ -831,14 +804,12 @@ static status_t conclude(private_rekey_ike_sa_t *this, message_t *response,
 		if (memcmp(this_lowest.ptr, this->nonce_s.ptr,
 			min(this_lowest.len, this->nonce_s.len)) < 0)
 		{
-			this->logger->log(this->logger, ERROR,
-								"detected simultaneous IKE_SA rekeying, deleting ours");
+			DBG1(SIG_DBG_IKE, "detected simultaneous IKE_SA rekeying, deleting ours");
 			this->lost = TRUE;
 		}
 		else
 		{
-			this->logger->log(this->logger, ERROR,
-								"detected simultaneous IKE_SA rekeying, but ours is preferred");
+			DBG1(SIG_DBG_IKE, "detected simultaneous IKE_SA rekeying, but ours is preferred");
 		}
 		if (this->lost)
 		{
@@ -920,7 +891,6 @@ rekey_ike_sa_t *rekey_ike_sa_create(ike_sa_t *ike_sa)
 	this->randomizer = randomizer_create();
 	this->diffie_hellman = NULL;
 	this->proposal = NULL;
-	this->logger = logger_manager->get_logger(logger_manager, IKE_SA);
 	
 	return &this->public;
 }
diff --git a/src/charon/sa/transactions/transaction.c b/src/charon/sa/transactions/transaction.c
index adc8ce23c..d4da1cdcb 100644
--- a/src/charon/sa/transactions/transaction.c
+++ b/src/charon/sa/transactions/transaction.c
@@ -35,8 +35,6 @@
 #include <encoding/payloads/nonce_payload.h>
 #include <encoding/payloads/notify_payload.h>
 #include <encoding/payloads/delete_payload.h>
-#include <utils/logger_manager.h>
-
 
 /*
  * see header file
diff --git a/src/charon/threads/kernel_interface.c b/src/charon/threads/kernel_interface.c
index c74cf8f27..5c220b0c8 100644
--- a/src/charon/threads/kernel_interface.c
+++ b/src/charon/threads/kernel_interface.c
@@ -230,11 +230,6 @@ struct private_kernel_interface_t {
 	 * Condvar allows signaling of threads waiting for a reply.
 	 */
 	pthread_cond_t condvar;
-	
-	/**
-	 * Logger for XFRM stuff
-	 */
-	logger_t *logger;
 };
 
 
@@ -362,15 +357,12 @@ static void receive_messages(private_kernel_interface_t *this)
 			}
 			if (reqid == 0)
 			{
-				this->logger->log(this->logger, ERROR,
-								  "Received a XFRM_MSG_ACQUIRE, but no reqid found");
+				DBG1(SIG_DBG_KNL, "received a XFRM_MSG_ACQUIRE, but no reqid found");
 			}
 			else
 			{
-				this->logger->log(this->logger, CONTROL|LEVEL1, 
-								"Received a XFRM_MSG_ACQUIRE");
-				this->logger->log(this->logger, CONTROL,
-								  "creating acquire job for CHILD_SA with reqid %d",
+				DBG2(SIG_DBG_KNL, "received a XFRM_MSG_ACQUIRE");
+				DBG1(SIG_DBG_KNL, "creating acquire job for CHILD_SA with reqid %d",
 								  reqid);
 				job = (job_t*)acquire_job_create(reqid);
 				charon->job_queue->add(charon->job_queue, job);
@@ -389,12 +381,10 @@ static void receive_messages(private_kernel_interface_t *this)
 			spi = expire->state.id.spi;
 			reqid = expire->state.reqid;
 			
-			this->logger->log(this->logger, CONTROL|LEVEL1,
-							  "Received a XFRM_MSG_EXPIRE");
-			this->logger->log(this->logger, CONTROL,
-							  "creating %s job for %s CHILD_SA 0x%x (reqid %d)",
+			DBG2(SIG_DBG_KNL, "received a XFRM_MSG_EXPIRE");
+			DBG1(SIG_DBG_KNL, "creating %s job for %N CHILD_SA 0x%x (reqid %d)",
 							  expire->hard ? "delete" : "rekey",
-							  mapping_find(protocol_id_m, protocol), ntohl(spi),
+							  protocol_id_names, protocol, ntohl(spi),
 							  reqid);
 			if (expire->hard)
 			{
@@ -457,7 +447,7 @@ static status_t get_spi(private_kernel_interface_t *this,
 	memset(&request, 0, sizeof(request));
 	status_t status = SUCCESS;
 	
-	this->logger->log(this->logger, CONTROL|LEVEL2, "getting spi");
+	DBG2(SIG_DBG_KNL, "getting spi");
 	
 	hdr = (struct nlmsghdr*)request;
 	hdr->nlmsg_flags = NLM_F_REQUEST;
@@ -476,29 +466,29 @@ static status_t get_spi(private_kernel_interface_t *this,
 	
 	if (send_message(this, hdr, &response) != SUCCESS)
 	{
-		this->logger->log(this->logger, ERROR, "netlink communication failed");
+		DBG1(SIG_DBG_KNL, "netlink communication failed");
 		return FAILED;
 	}
 	else if (response->nlmsg_type == NLMSG_ERROR)
 	{
-		this->logger->log(this->logger, ERROR, "netlink request XFRM_MSG_ALLOCSPI got an error: %s",
+		DBG1(SIG_DBG_KNL, "netlink request XFRM_MSG_ALLOCSPI got an error: %s",
 						  strerror(-((struct nlmsgerr*)NLMSG_DATA(response))->error));
 		status = FAILED;
 	}
 	else if (response->nlmsg_type != XFRM_MSG_NEWSA)
 	{
-		this->logger->log(this->logger, ERROR, "netlink request XFRM_MSG_ALLOCSPI got a unknown reply");
+		DBG1(SIG_DBG_KNL, "netlink request XFRM_MSG_ALLOCSPI got a unknown reply");
 		status = FAILED;
 	}
 	else if (response->nlmsg_len < NLMSG_LENGTH(sizeof(struct xfrm_usersa_info)))
 	{
-		this->logger->log(this->logger, ERROR, "netlink request XFRM_MSG_ALLOCSPI got an invalid reply");
+		DBG1(SIG_DBG_KNL, "netlink request XFRM_MSG_ALLOCSPI got an invalid reply");
 		status = FAILED;
 	}
 	else
 	{
 		*spi = ((struct xfrm_usersa_info*)NLMSG_DATA(response))->id.spi;
-		this->logger->log(this->logger, CONTROL|LEVEL1, "SPI is 0x%x", *spi);
+		DBG2(SIG_DBG_KNL, "SPI is 0x%x", *spi);
 	}
 	free(response);
 	
@@ -526,7 +516,7 @@ static status_t add_sa(private_kernel_interface_t *this,
 	memset(&request, 0, sizeof(request));
 	status_t status = SUCCESS;
 	
-	this->logger->log(this->logger, CONTROL|LEVEL2, "adding SA");
+	DBG2(SIG_DBG_KNL, "adding SA");
 
 	hdr = (struct nlmsghdr*)request;
 	hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
@@ -561,12 +551,12 @@ static status_t add_sa(private_kernel_interface_t *this,
 		alg_name = lookup_algorithm(encryption_algs, enc_alg, &key_size);
 		if (alg_name == NULL)
 		{
-			this->logger->log(this->logger, ERROR, "Algorithm %s not supported by kernel!", 
-							  mapping_find(encryption_algorithm_m, enc_alg->algorithm));
+			DBG1(SIG_DBG_KNL, "algorithm %N not supported by kernel!",
+				 encryption_algorithm_names, enc_alg->algorithm);
 			return FAILED;
 		}
-		this->logger->log(this->logger, CONTROL|LEVEL2, "  using encryption algorithm %s with key size %d",
-						  mapping_find(encryption_algorithm_m, enc_alg->algorithm), key_size);
+		DBG2(SIG_DBG_KNL, "  using encryption algorithm %N with key size %d",
+			 encryption_algorithm_names, enc_alg->algorithm, key_size);
 		
 		rthdr->rta_len = RTA_LENGTH(sizeof(struct xfrm_algo) + key_size);
 		hdr->nlmsg_len += rthdr->rta_len;
@@ -589,12 +579,12 @@ static status_t add_sa(private_kernel_interface_t *this,
 		alg_name = lookup_algorithm(integrity_algs, int_alg, &key_size);
 		if (alg_name == NULL)
 		{
-			this->logger->log(this->logger, ERROR, "Algorithm %s not supported by kernel!", 
-							  mapping_find(integrity_algorithm_m, int_alg->algorithm));
+			DBG1(SIG_DBG_KNL, "algorithm %N not supported by kernel!", 
+				 integrity_algorithm_names, int_alg->algorithm);
 			return FAILED;
 		}
-		this->logger->log(this->logger, CONTROL|LEVEL2, "  using integrity algorithm %s with key size %d",
-						  mapping_find(integrity_algorithm_m, int_alg->algorithm), key_size);
+		DBG2(SIG_DBG_KNL, "  using integrity algorithm %N with key size %d",
+			 integrity_algorithm_names, int_alg->algorithm, key_size);
 		
 		rthdr->rta_len = RTA_LENGTH(sizeof(struct xfrm_algo) + key_size);
 		hdr->nlmsg_len += rthdr->rta_len;
@@ -644,18 +634,18 @@ static status_t add_sa(private_kernel_interface_t *this,
 
 	if (send_message(this, hdr, &response) != SUCCESS)
 	{
-		this->logger->log(this->logger, ERROR, "netlink communication failed");
+		DBG1(SIG_DBG_KNL, "netlink communication failed");
 		return FAILED;
 	}
 	else if (response->nlmsg_type != NLMSG_ERROR)
 	{
-		this->logger->log(this->logger, ERROR, "netlink request XFRM_MSG_NEWSA not acknowledged");
+		DBG1(SIG_DBG_KNL, "netlink request XFRM_MSG_NEWSA not acknowledged");
 		status = FAILED;
 	}
 	else if (((struct nlmsgerr*)NLMSG_DATA(response))->error)
 	{
-		this->logger->log(this->logger, ERROR, "netlink request XFRM_MSG_NEWSA got an error: %s",
-						  strerror(-((struct nlmsgerr*)NLMSG_DATA(response))->error));
+		DBG1(SIG_DBG_KNL, "netlink request XFRM_MSG_NEWSA got an error: %s",
+			 strerror(-((struct nlmsgerr*)NLMSG_DATA(response))->error));
 		status = FAILED;
 	}
 	
@@ -681,7 +671,7 @@ static status_t update_sa(
 	memset(&request, 0, sizeof(request));
 	status_t status = SUCCESS;
 	
-	this->logger->log(this->logger, CONTROL|LEVEL2, "getting SA");
+	DBG2(SIG_DBG_KNL, "getting SA");
 
 	hdr = (struct nlmsghdr*)request;
 	hdr->nlmsg_flags = NLM_F_REQUEST;
@@ -696,30 +686,30 @@ static status_t update_sa(
 	
 	if (send_message(this, hdr, &update) != SUCCESS)
 	{
-		this->logger->log(this->logger, ERROR, "netlink communication failed");
+		DBG1(SIG_DBG_KNL, "netlink communication failed");
 		return FAILED;
 	}
 	else if (update->nlmsg_type == NLMSG_ERROR)
 	{
-		this->logger->log(this->logger, ERROR, "netlink request XFRM_MSG_GETSA got an error: %s",
-						  strerror(-((struct nlmsgerr*)NLMSG_DATA(update))->error));
+		DBG1(SIG_DBG_KNL, "netlink request XFRM_MSG_GETSA got an error: %s",
+			 strerror(-((struct nlmsgerr*)NLMSG_DATA(update))->error));
 		free(update);
 		return FAILED;
 	}
 	else if (update->nlmsg_type != XFRM_MSG_NEWSA)
 	{
-		this->logger->log(this->logger, ERROR, "netlink request XFRM_MSG_GETSA got a unknown reply");
+		DBG1(SIG_DBG_KNL, "netlink request XFRM_MSG_GETSA got a unknown reply");
 		free(update);
 		return FAILED;
 	}
 	else if (update->nlmsg_len < NLMSG_LENGTH(sizeof(struct xfrm_usersa_info)))
 	{
-		this->logger->log(this->logger, ERROR, "netlink request XFRM_MSG_GETSA got an invalid reply");
+		DBG1(SIG_DBG_KNL, "netlink request XFRM_MSG_GETSA got an invalid reply");
 		free(update);
 		return FAILED;
 	}
 	
-	this->logger->log(this->logger, CONTROL|LEVEL2, "updating SA");
+	DBG2(SIG_DBG_KNL, "updating SA");
 	update->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;	
 	update->nlmsg_type = XFRM_MSG_UPDSA;
 	
@@ -731,7 +721,7 @@ static status_t update_sa(
 
 	if (dst_changes & HOST_DIFF_ADDR)
 	{
-		this->logger->log(this->logger, CONTROL|LEVEL2, "destination address changed! replacing SA");	
+		DBG2(SIG_DBG_KNL, "destination address changed! replacing SA");	
 		
 		update->nlmsg_type = XFRM_MSG_NEWSA;
 		host2xfrm(new_dst, &sa->id.daddr);
@@ -756,24 +746,24 @@ static status_t update_sa(
 	
 	if (send_message(this, update, &response) != SUCCESS)
 	{
-		this->logger->log(this->logger, ERROR, "netlink communication failed");
+		DBG1(SIG_DBG_KNL, "netlink communication failed");
 		free(update);
 		return FAILED;
 	}
 	else if (response->nlmsg_type != NLMSG_ERROR)
 	{
-		this->logger->log(this->logger, ERROR, "netlink request XFRM_MSG_XXXSA not acknowledged");
+		DBG1(SIG_DBG_KNL, "netlink request XFRM_MSG_XXXSA not acknowledged");
 		status = FAILED;
 	}
 	else if (((struct nlmsgerr*)NLMSG_DATA(response))->error)
 	{
-		this->logger->log(this->logger, ERROR, "netlink request XFRM_MSG_XXXSA got an error: %s",
-						  strerror(-((struct nlmsgerr*)NLMSG_DATA(response))->error));
+		DBG1(SIG_DBG_KNL, "netlink request XFRM_MSG_XXXSA got an error: %s",
+			 strerror(-((struct nlmsgerr*)NLMSG_DATA(response))->error));
 		status = FAILED;
 	}
 	else if (dst_changes & HOST_DIFF_ADDR)
 	{
-		this->logger->log(this->logger, CONTROL|LEVEL2, "deleting old SA");
+		DBG2(SIG_DBG_KNL, "deleting old SA");
 		status = this->public.del_sa(&this->public, dst, spi, protocol);
 	}
 	
@@ -794,7 +784,7 @@ static status_t query_sa(private_kernel_interface_t *this, host_t *dst,
 	struct xfrm_usersa_id *sa_id;
 	struct xfrm_usersa_info *sa_info;
 	
-	this->logger->log(this->logger, CONTROL|LEVEL2, "querying SA");
+	DBG2(SIG_DBG_KNL, "querying SA");
 	memset(&request, 0, sizeof(request));
 	
 	hdr = (struct nlmsghdr*)request;
@@ -810,18 +800,18 @@ static status_t query_sa(private_kernel_interface_t *this, host_t *dst,
 	
 	if (send_message(this, hdr, &response) != SUCCESS)
 	{
-		this->logger->log(this->logger, ERROR, "netlink communication failed");
+		DBG1(SIG_DBG_KNL, "netlink communication failed");
 		return FAILED;
 	}
 	else if (response->nlmsg_type != XFRM_MSG_NEWSA)
 	{
-		this->logger->log(this->logger, ERROR, "netlink request XFRM_MSG_GETSA not acknowledged");
+		DBG1(SIG_DBG_KNL, "netlink request XFRM_MSG_GETSA not acknowledged");
 		free(response);
 		return FAILED;
 	}
 	else if (response->nlmsg_len < NLMSG_LENGTH(sizeof(struct xfrm_usersa_info)))
 	{
-		this->logger->log(this->logger, ERROR, "netlink request XFRM_MSG_GETSA got an invalid reply");
+		DBG1(SIG_DBG_KNL, "netlink request XFRM_MSG_GETSA got an invalid reply");
 		free(response);
 		return FAILED;
 	}
@@ -847,7 +837,7 @@ static status_t del_sa(private_kernel_interface_t *this, host_t *dst,
 	memset(&request, 0, sizeof(request));
 	status_t status = SUCCESS;
 	
-	this->logger->log(this->logger, CONTROL|LEVEL2, "deleting SA");
+	DBG2(SIG_DBG_KNL, "deleting SA");
 	
 	hdr = (struct nlmsghdr*)request;
 	hdr->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK;
@@ -862,17 +852,17 @@ static status_t del_sa(private_kernel_interface_t *this, host_t *dst,
 	
 	if (send_message(this, hdr, &response) != SUCCESS)
 	{
-		this->logger->log(this->logger, ERROR, "netlink communication failed");
+		DBG1(SIG_DBG_KNL, "netlink communication failed");
 		return FAILED;
 	}
 	else if (response->nlmsg_type != NLMSG_ERROR)
 	{
-		this->logger->log(this->logger, ERROR, "netlink request XFRM_MSG_DELSA not acknowledged");
+		DBG1(SIG_DBG_KNL, "netlink request XFRM_MSG_DELSA not acknowledged");
 		status = FAILED;
 	}
 	else if (((struct nlmsgerr*)NLMSG_DATA(response))->error)
 	{
-		this->logger->log(this->logger, ERROR, "netlink request XFRM_MSG_DELSA got an error: %s",
+		DBG1(SIG_DBG_KNL, "netlink request XFRM_MSG_DELSA got an error: %s",
 						  strerror(-((struct nlmsgerr*)NLMSG_DATA(response))->error));
 		status = FAILED;
 	}
@@ -1010,8 +1000,7 @@ static status_t add_policy(private_kernel_interface_t *this,
 			if (!update)
 			{
 				current->refcount++;
-				this->logger->log(this->logger, CONTROL|LEVEL1, 
-								  "policy already exists, increasing refcount");
+				DBG2(SIG_DBG_KNL, "policy already exists, increasing refcount");
 				if (!high_prio)
 				{
 					/* if added policy is for a ROUTED child_sa, do not
@@ -1033,7 +1022,7 @@ static status_t add_policy(private_kernel_interface_t *this,
 		policy->refcount = 1;
 	}
 	
-	this->logger->log(this->logger, CONTROL|LEVEL2, "adding policy");
+	DBG2(SIG_DBG_KNL, "adding policy");
 	
 	memset(&request, 0, sizeof(request));
 	hdr = (struct nlmsghdr*)request;
@@ -1087,20 +1076,18 @@ static status_t add_policy(private_kernel_interface_t *this,
 	
 	if (send_message(this, hdr, &response) != SUCCESS)
 	{
-		this->logger->log(this->logger, ERROR, "netlink communication failed");
+		DBG1(SIG_DBG_KNL, "netlink communication failed");
 		return FAILED;
 	}
 	else if (response->nlmsg_type != NLMSG_ERROR)
 	{
-		this->logger->log(this->logger, ERROR, 
-						  "netlink request XFRM_MSG_UPDPOLICY not acknowledged");
+		DBG1(SIG_DBG_KNL, "netlink request XFRM_MSG_UPDPOLICY not acknowledged");
 		status = FAILED;
 	}
 	else if (((struct nlmsgerr*)NLMSG_DATA(response))->error)
 	{
-		this->logger->log(this->logger, ERROR, 
-						  "netlink request XFRM_MSG_UPDPOLICY got an error: %s",
-						  strerror(-((struct nlmsgerr*)NLMSG_DATA(response))->error));
+		DBG1(SIG_DBG_KNL, "netlink request XFRM_MSG_UPDPOLICY got an error: %s",
+			 strerror(-((struct nlmsgerr*)NLMSG_DATA(response))->error));
 		status = FAILED;
 	}
 	
@@ -1125,7 +1112,7 @@ static status_t query_policy(private_kernel_interface_t *this,
 	memset(&request, 0, sizeof(request));
 	status_t status = SUCCESS;
 	
-	this->logger->log(this->logger, CONTROL|LEVEL2, "querying policy");
+	DBG2(SIG_DBG_KNL, "querying policy");
 
 	hdr = (struct nlmsghdr*)request;
 	hdr->nlmsg_flags = NLM_F_REQUEST;
@@ -1138,25 +1125,25 @@ static status_t query_policy(private_kernel_interface_t *this,
 
 	if (send_message(this, hdr, &response) != SUCCESS)
 	{
-		this->logger->log(this->logger, ERROR, "netlink communication failed");
+		DBG1(SIG_DBG_KNL, "netlink communication failed");
 		return FAILED;
 	}
 	else if (response->nlmsg_type == NLMSG_ERROR)
 	{
-		this->logger->log(this->logger, ERROR, "netlink request XFRM_MSG_GETPOLICY got an error: %s",
-						  strerror(-((struct nlmsgerr*)NLMSG_DATA(response))->error));
+		DBG1(SIG_DBG_KNL, "netlink request XFRM_MSG_GETPOLICY got an error: %s",
+			 strerror(-((struct nlmsgerr*)NLMSG_DATA(response))->error));
 		free(response);
 		return FAILED;
 	}
 	else if (response->nlmsg_type != XFRM_MSG_NEWPOLICY)
 	{
-		this->logger->log(this->logger, ERROR, "netlink request XFRM_MSG_GETPOLICY got an unknown reply");
+		DBG1(SIG_DBG_KNL, "netlink request XFRM_MSG_GETPOLICY got an unknown reply");
 		free(response);
 		return FAILED;
 	}
 	else if (response->nlmsg_len < NLMSG_LENGTH(sizeof(struct xfrm_userpolicy_info)))
 	{
-		this->logger->log(this->logger, ERROR, "netlink request XFRM_MSG_GETPOLICY got an invalid reply");
+		DBG1(SIG_DBG_KNL, "netlink request XFRM_MSG_GETPOLICY got an invalid reply");
 		free(response);
 		return FAILED;
 	}
@@ -1185,7 +1172,7 @@ static status_t del_policy(private_kernel_interface_t *this,
 	iterator_t *iterator;
 	status_t status = SUCCESS;
 	
-	this->logger->log(this->logger, CONTROL|LEVEL2, "deleting policy");
+	DBG2(SIG_DBG_KNL, "deleting policy");
 	
 	/* create a policy */
 	memset(&policy, 0, sizeof(kernel_policy_t));
@@ -1204,8 +1191,7 @@ static status_t del_policy(private_kernel_interface_t *this,
 			if (--to_delete->refcount > 0)
 			{
 				/* is used by more SAs, keep in kernel */
-				this->logger->log(this->logger, CONTROL|LEVEL1, 
-								  "is used by other SAs, not removed");
+				DBG2(SIG_DBG_KNL, "is used by other SAs, not removed");
 				iterator->destroy(iterator);
 				pthread_mutex_unlock(&this->pol_mutex);
 				return SUCCESS;
@@ -1219,8 +1205,7 @@ static status_t del_policy(private_kernel_interface_t *this,
 	pthread_mutex_unlock(&this->pol_mutex);
 	if (!to_delete)
 	{
-		this->logger->log(this->logger, CONTROL|LEVEL2, 
-						  "no such policy found");
+		DBG1(SIG_DBG_KNL, "no such policy found");
 		return NOT_FOUND;
 	}
 	
@@ -1239,18 +1224,18 @@ static status_t del_policy(private_kernel_interface_t *this,
 	
 	if (send_message(this, hdr, &response) != SUCCESS)
 	{
-		this->logger->log(this->logger, ERROR, "netlink communication failed");
+		DBG1(SIG_DBG_KNL, "netlink communication failed");
 		return FAILED;
 	}
 	else if (response->nlmsg_type != NLMSG_ERROR)
 	{
-		this->logger->log(this->logger, ERROR, "netlink request XFRM_MSG_DELPOLICY not acknowledged");
+		DBG1(SIG_DBG_KNL, "netlink request XFRM_MSG_DELPOLICY not acknowledged");
 		status = FAILED;
 	}
 	else if (((struct nlmsgerr*)NLMSG_DATA(response))->error)
 	{
-		this->logger->log(this->logger, ERROR, "netlink request XFRM_MSG_DELPOLICY got an error: %s",
-						  strerror(-((struct nlmsgerr*)NLMSG_DATA(response))->error));
+		DBG1(SIG_DBG_KNL, "netlink request XFRM_MSG_DELPOLICY got an error: %s",
+			 strerror(-((struct nlmsgerr*)NLMSG_DATA(response))->error));
 		status = FAILED;
 	}
 	
@@ -1294,7 +1279,6 @@ kernel_interface_t *kernel_interface_create()
 	this->pid = getpid();
 	this->responses = linked_list_create();
 	this->policies = linked_list_create();
-	this->logger = logger_manager->get_logger(logger_manager, XFRM);
 	pthread_mutex_init(&(this->rep_mutex),NULL);
 	pthread_mutex_init(&(this->pol_mutex),NULL);
 	pthread_cond_init(&(this->condvar),NULL);
diff --git a/src/charon/threads/receiver.c b/src/charon/threads/receiver.c
index d60792be9..c2fc315a7 100644
--- a/src/charon/threads/receiver.c
+++ b/src/charon/threads/receiver.c
@@ -32,7 +32,6 @@
 #include <queues/job_queue.h>
 #include <queues/jobs/job.h>
 #include <queues/jobs/incoming_packet_job.h>
-#include <utils/logger_manager.h>
 
 
 typedef struct private_receiver_t private_receiver_t;
@@ -50,11 +49,6 @@ struct private_receiver_t {
 	  * Assigned thread.
 	  */
 	 pthread_t assigned_thread;
-	 
-	 /**
-	  * A logger for the receiver_t object.
-	  */
-	 logger_t *logger;
 };
 
 /**
@@ -68,20 +62,20 @@ static void receive_packets(private_receiver_t * this)
 	/* cancellation disabled by default */
 	pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, NULL);
 	
-	this->logger->log(this->logger, CONTROL, "receiver thread running,  thread_ID: %06u", (int)pthread_self());
+	DBG1(SIG_DBG_NET, "receiver thread running, thread_ID: %06u", 
+		 (int)pthread_self());
 	
-	while (1)
+	while (TRUE)
 	{
 		while (charon->socket->receive(charon->socket,&current_packet) == SUCCESS)
 		{
-			this->logger->log(this->logger, CONTROL | LEVEL1, "Creating job from packet");
+			DBG2(SIG_DBG_NET, "creating job from packet");
 			current_job = (job_t *) incoming_packet_job_create(current_packet);
-
+			
 			charon->job_queue->add(charon->job_queue,current_job);
-
 		}
-		/* bad bad, rebuild the socket ? */
-		this->logger->log(this->logger, ERROR, "Receiving from socket failed!");
+		/* bad bad, TODO: rebuild the socket ? */
+		DBG1(SIG_DBG_NET, "receiving from socket failed!");
 	}
 }
 
@@ -90,12 +84,8 @@ static void receive_packets(private_receiver_t * this)
  */
 static void destroy(private_receiver_t *this)
 {
-	this->logger->log(this->logger, CONTROL | LEVEL1, "Going to terminate receiver thread");
 	pthread_cancel(this->assigned_thread);
-
 	pthread_join(this->assigned_thread, NULL);
-	this->logger->log(this->logger, CONTROL | LEVEL1, "Receiver thread terminated");
-
 	free(this);
 }
 
@@ -108,13 +98,10 @@ receiver_t * receiver_create()
 
 	this->public.destroy = (void(*)(receiver_t*)) destroy;
 	
-	this->logger = logger_manager->get_logger(logger_manager, RECEIVER);
-	
 	if (pthread_create(&(this->assigned_thread), NULL, (void*(*)(void*))receive_packets, this) != 0)
 	{
-		this->logger->log(this->logger, ERROR, "Receiver thread could not be started");
 		free(this);
-		charon->kill(charon, "Unable to create receiver thread");
+		charon->kill(charon, "unable to create receiver thread");
 	}
 
 	return &(this->public);
diff --git a/src/charon/threads/scheduler.c b/src/charon/threads/scheduler.c
index ba86c1b43..d62b779d6 100644
--- a/src/charon/threads/scheduler.c
+++ b/src/charon/threads/scheduler.c
@@ -28,7 +28,6 @@
 
 #include <daemon.h>
 #include <definitions.h>
-#include <utils/logger_manager.h>
 #include <queues/job_queue.h>
 
 
@@ -47,11 +46,6 @@ struct private_scheduler_t {
 	 * Assigned thread.
 	 */
 	pthread_t assigned_thread;
-	
-	/** 
-	 * A logger.
-	 */
-	logger_t *logger;
 };
 
 /**
@@ -64,16 +58,17 @@ static void get_events(private_scheduler_t * this)
 	/* cancellation disabled by default */
 	pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, NULL);
 	
-	this->logger->log(this->logger, CONTROL, "scheduler thread running, thread_ID: %06u", (int)pthread_self());
+	DBG1(SIG_DBG_JOB, "scheduler thread running, thread_ID: %06u", 
+		 (int)pthread_self());
 
 	while (TRUE)
 	{
-		this->logger->log(this->logger, CONTROL|LEVEL2, "waiting for next event...");
+		DBG2(SIG_DBG_JOB, "waiting for next event...");
 		/* get a job, this block until one is available */
 		current_job = charon->event_queue->get(charon->event_queue);
 		/* queue the job in the job queue, workers will eat them */
-		this->logger->log(this->logger, CONTROL | LEVEL1, "got event, adding job %s to job-queue.", 
-						  mapping_find(job_type_m, current_job->get_type(current_job)));
+		DBG2(SIG_DBG_JOB, "got event, adding job %N to job-queue",
+			 job_type_names, current_job->get_type(current_job));
 		charon->job_queue->add(charon->job_queue, current_job);
 	}
 }
@@ -83,12 +78,8 @@ static void get_events(private_scheduler_t * this)
  */
 static void destroy(private_scheduler_t *this)
 {
-	this->logger->log(this->logger, CONTROL | LEVEL1, "going to terminate scheduler thread");
 	pthread_cancel(this->assigned_thread);
-
 	pthread_join(this->assigned_thread, NULL);
-	this->logger->log(this->logger, CONTROL | LEVEL1, "scheduler thread terminated");
-
 	free(this);
 }
 
@@ -98,18 +89,15 @@ static void destroy(private_scheduler_t *this)
 scheduler_t * scheduler_create()
 {
 	private_scheduler_t *this = malloc_thing(private_scheduler_t);
-
-	this->public.destroy = (void(*)(scheduler_t*)) destroy;
 	
-	this->logger = logger_manager->get_logger(logger_manager, SCHEDULER);
+	this->public.destroy = (void(*)(scheduler_t*)) destroy;
 	
 	if (pthread_create(&(this->assigned_thread), NULL, (void*(*)(void*))get_events, this) != 0)
 	{
 		/* thread could not be created  */
-		this->logger->log(this->logger, ERROR, "scheduler thread could not be created!");
 		free(this);
 		charon->kill(charon, "unable to create scheduler thread");
 	}
-
+	
 	return &(this->public);
 }
diff --git a/src/charon/threads/sender.c b/src/charon/threads/sender.c
index 9f16a1d2c..6df549e1d 100644
--- a/src/charon/threads/sender.c
+++ b/src/charon/threads/sender.c
@@ -30,7 +30,6 @@
 #include <network/socket.h>
 #include <network/packet.h>
 #include <queues/send_queue.h>
-#include <utils/logger_manager.h>
 
 
 typedef struct private_sender_t private_sender_t;
@@ -48,11 +47,6 @@ struct private_sender_t {
 	  * Assigned thread.
 	  */
 	 pthread_t assigned_thread;
-	 
-	 /**
-	  * A logger for this sender_t object.
-	  */
-	 logger_t *logger;
 
 };
 
@@ -67,16 +61,17 @@ static void send_packets(private_sender_t * this)
 	/* cancellation disabled by default */
 	pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, NULL);
 
-	this->logger->log(this->logger, CONTROL, "sender thread running,    thread_ID: %06u", (int)pthread_self());
+	DBG1(SIG_DBG_NET, "sender thread running, thread_ID: %06u",
+		 (int)pthread_self());
 
 	while (TRUE)
 	{
 		current_packet = charon->send_queue->get(charon->send_queue);
-		this->logger->log(this->logger, CONTROL|LEVEL1, "Got a packet, sending it");
+		DBG2(SIG_DBG_NET, "got a packet, sending it");
 		status = charon->socket->send(charon->socket, current_packet);
 		if (status != SUCCESS)
 		{
-			this->logger->log(this->logger, ERROR, "Sending packet failed");
+			DBG1(SIG_DBG_NET, "sending packet failed");
 		}
 		current_packet->destroy(current_packet);
 	}
@@ -87,12 +82,8 @@ static void send_packets(private_sender_t * this)
  */
 static void destroy(private_sender_t *this)
 {
-	this->logger->log(this->logger, CONTROL | LEVEL1, "Going to terminate sender thread");
 	pthread_cancel(this->assigned_thread);
-	
 	pthread_join(this->assigned_thread, NULL);
-	this->logger->log(this->logger, CONTROL | LEVEL1, "Sender thread terminated");
-	
 	free(this);
 }
 
@@ -104,14 +95,11 @@ sender_t * sender_create()
 	private_sender_t *this = malloc_thing(private_sender_t);
 
 	this->public.destroy = (void(*)(sender_t*)) destroy;
-	
-	this->logger = logger_manager->get_logger(logger_manager, SENDER);
 
 	if (pthread_create(&(this->assigned_thread), NULL, (void*(*)(void*))send_packets, this) != 0)
 	{
-		this->logger->log(this->logger, ERROR, "Sender thread could not be created");
 		free(this);
-		charon->kill(charon, "Unable to create sender thread");
+		charon->kill(charon, "unable to create sender thread");
 	}
 
 	return &(this->public);
diff --git a/src/charon/threads/stroke_interface.c b/src/charon/threads/stroke_interface.c
index 35fcff4d2..988390ef5 100755
--- a/src/charon/threads/stroke_interface.c
+++ b/src/charon/threads/stroke_interface.c
@@ -33,10 +33,11 @@
 
 #include "stroke_interface.h"
 
-#include <stroke.h>
 #include <types.h>
+#include <stroke.h>
 #include <daemon.h>
 #include <crypto/x509.h>
+#include <crypto/crl.h>
 #include <queues/jobs/initiate_job.h>
 #include <queues/jobs/route_job.h>
 #include <utils/leak_detective.h>
@@ -59,16 +60,11 @@ struct private_stroke_t {
 	 * Public part of stroke_t object.
 	 */
 	stroke_t public;
-
-	/**
-	 * Assigned logger_t object in charon.
-	 */
-	logger_t *logger;
 	
 	/**
-	 * Logger which logs to stroke
+	 * Output stream (stroke console)
 	 */
-	logger_t *stroke_logger;
+	FILE *out;
 		
 	/**
 	 * Unix socket to listen for strokes
@@ -76,14 +72,9 @@ struct private_stroke_t {
 	int socket;
 	
 	/**
-	 * Thread which reads from the 
ocket
+	 * Thread which reads from the Socket
 	 */
 	pthread_t assigned_thread;
-
-	/**
-	 * Read from the socket and handle stroke messages
-	 */
-	void (*stroke_receive) (private_stroke_t *this);
 };
 
 /**
@@ -115,7 +106,7 @@ static void pop_string(stroke_msg_t *msg, char **string)
 /**
  * Load end entitity certificate
  */
-static x509_t* load_end_certificate(const char *filename, identification_t **idp, logger_t *logger)
+static x509_t* load_end_certificate(const char *filename, identification_t **idp)
 {
 	char path[PATH_BUF];
 	x509_t *cert;
@@ -142,7 +133,7 @@ static x509_t* load_end_certificate(const char *filename, identification_t **idp
 
 		if (ugh != NULL)	
 		{
-			logger->log(logger, ERROR, "warning: certificate %s", ugh);
+			DBG1(SIG_DBG_CFG, "warning: certificate %s", ugh);
 		}
 		if (!id->equals(id, subject) && !cert->equals_subjectAltName(cert, id))
 		{
@@ -170,7 +161,7 @@ static void stroke_add_conn(private_stroke_t *this, stroke_msg_t *msg)
 	host_t *my_host, *other_host, *my_subnet, *other_subnet;
 	proposal_t *proposal;
 	traffic_selector_t *my_ts, *other_ts;
-				
+	
 	pop_string(msg, &msg->add_conn.name);
 	pop_string(msg, &msg->add_conn.me.address);
 	pop_string(msg, &msg->add_conn.other.address);
@@ -187,29 +178,27 @@ static void stroke_add_conn(private_stroke_t *this, stroke_msg_t *msg)
 	pop_string(msg, &msg->add_conn.algorithms.ike);
 	pop_string(msg, &msg->add_conn.algorithms.esp);
 	
-	this->logger->log(this->logger, CONTROL, 
-					  "received stroke: add connection \"%s\"", msg->add_conn.name);
-	
-	this->logger->log(this->logger, CONTROL|LEVEL2, "conn %s", msg->add_conn.name);
-	this->logger->log(this->logger, CONTROL|LEVEL2, "  right=%s", msg->add_conn.me.address);
-	this->logger->log(this->logger, CONTROL|LEVEL2, "  left=%s", msg->add_conn.other.address);
-	this->logger->log(this->logger, CONTROL|LEVEL2, "  rightsubnet=%s", msg->add_conn.me.subnet);
-	this->logger->log(this->logger, CONTROL|LEVEL2, "  leftsubnet=%s", msg->add_conn.other.subnet);
-	this->logger->log(this->logger, CONTROL|LEVEL2, "  rightid=%s", msg->add_conn.me.id);
-	this->logger->log(this->logger, CONTROL|LEVEL2, "  leftid=%s", msg->add_conn.other.id);
-	this->logger->log(this->logger, CONTROL|LEVEL2, "  rightcert=%s", msg->add_conn.me.cert);
-	this->logger->log(this->logger, CONTROL|LEVEL2, "  leftcert=%s", msg->add_conn.other.cert);
-	this->logger->log(this->logger, CONTROL|LEVEL2, "  rightca=%s", msg->add_conn.me.ca);
-	this->logger->log(this->logger, CONTROL|LEVEL2, "  leftca=%s", msg->add_conn.other.ca);
-	this->logger->log(this->logger, CONTROL|LEVEL2, "  ike=%s", msg->add_conn.algorithms.ike);
-	this->logger->log(this->logger, CONTROL|LEVEL2, "  esp=%s", msg->add_conn.algorithms.esp);
+	DBG1(SIG_DBG_CFG, "received stroke: add connection '%s'", msg->add_conn.name);
+	
+	DBG2(SIG_DBG_CFG, "conn %s", msg->add_conn.name);
+	DBG2(SIG_DBG_CFG, "  right=%s", msg->add_conn.me.address);
+	DBG2(SIG_DBG_CFG, "  left=%s", msg->add_conn.other.address);
+	DBG2(SIG_DBG_CFG, "  rightsubnet=%s", msg->add_conn.me.subnet);
+	DBG2(SIG_DBG_CFG, "  leftsubnet=%s", msg->add_conn.other.subnet);
+	DBG2(SIG_DBG_CFG, "  rightid=%s", msg->add_conn.me.id);
+	DBG2(SIG_DBG_CFG, "  leftid=%s", msg->add_conn.other.id);
+	DBG2(SIG_DBG_CFG, "  rightcert=%s", msg->add_conn.me.cert);
+	DBG2(SIG_DBG_CFG, "  leftcert=%s", msg->add_conn.other.cert);
+	DBG2(SIG_DBG_CFG, "  rightca=%s", msg->add_conn.me.ca);
+	DBG2(SIG_DBG_CFG, "  leftca=%s", msg->add_conn.other.ca);
+	DBG2(SIG_DBG_CFG, "  ike=%s", msg->add_conn.algorithms.ike);
+	DBG2(SIG_DBG_CFG, "  esp=%s", msg->add_conn.algorithms.esp);
 	
 	my_host = msg->add_conn.me.address?
 			  host_create_from_string(msg->add_conn.me.address, IKE_PORT) : NULL;
 	if (my_host == NULL)
 	{
-		this->stroke_logger->log(this->stroke_logger, ERROR, 
-								 "invalid host: %s", msg->add_conn.me.address);
+		DBG1(SIG_DBG_CFG, "invalid host: %s\n", msg->add_conn.me.address);
 		return;
 	}
 
@@ -217,8 +206,7 @@ static void stroke_add_conn(private_stroke_t *this, stroke_msg_t *msg)
 			host_create_from_string(msg->add_conn.other.address, IKE_PORT) : NULL;
 	if (other_host == NULL)
 	{
-		this->stroke_logger->log(this->stroke_logger, ERROR, 
-								 "invalid host: %s", msg->add_conn.other.address);
+		DBG1(SIG_DBG_CFG, "invalid host: %s\n", msg->add_conn.other.address);
 		my_host->destroy(my_host);
 		return;
 	}
@@ -228,8 +216,7 @@ static void stroke_add_conn(private_stroke_t *this, stroke_msg_t *msg)
 		stroke_end_t tmp_end;
 		host_t *tmp_host;
 
-		this->stroke_logger->log(this->stroke_logger, CONTROL|LEVEL1, 
-								 "left is other host, swapping ends");
+		DBG2(SIG_DBG_CFG, "left is other host, swapping ends\n");
 
 		tmp_host = my_host;
 		my_host = other_host;
@@ -241,8 +228,7 @@ static void stroke_add_conn(private_stroke_t *this, stroke_msg_t *msg)
 	}
 	else if (!charon->socket->is_local_address(charon->socket, my_host, NULL))
 	{
-		this->stroke_logger->log(this->stroke_logger, ERROR, 
-								 "left nor right host is our side, aborting");
+		DBG1(SIG_DBG_CFG, "left nor right host is our side, aborting\n");
 		goto destroy_hosts;
 	}
 
@@ -250,8 +236,7 @@ static void stroke_add_conn(private_stroke_t *this, stroke_msg_t *msg)
 						msg->add_conn.me.id : msg->add_conn.me.address);
 	if (my_id == NULL)
 	{
-		this->stroke_logger->log(this->stroke_logger, ERROR, 
-								 "invalid id: %s", msg->add_conn.me.id);
+		DBG1(SIG_DBG_CFG, "invalid ID: %s\n", msg->add_conn.me.id);
 		goto destroy_hosts;
 	}
 
@@ -259,8 +244,7 @@ static void stroke_add_conn(private_stroke_t *this, stroke_msg_t *msg)
 						msg->add_conn.other.id : msg->add_conn.other.address);
 	if (other_id == NULL)
 	{
-		this->stroke_logger->log(this->stroke_logger, ERROR, 
-								 "invalid id: %s", msg->add_conn.other.id);
+		DBG1(SIG_DBG_CFG, "invalid ID: %s\n", msg->add_conn.other.id);
 		my_id->destroy(my_id);
 		goto destroy_hosts;
 	}
@@ -269,8 +253,7 @@ static void stroke_add_conn(private_stroke_t *this, stroke_msg_t *msg)
 					msg->add_conn.me.subnet : msg->add_conn.me.address, IKE_PORT);
 	if (my_subnet == NULL)
 	{
-		this->stroke_logger->log(this->stroke_logger, ERROR, 
-								 "invalid subnet: %s", msg->add_conn.me.subnet);
+		DBG1(SIG_DBG_CFG, "invalid subnet: %s\n", msg->add_conn.me.subnet);
 		goto destroy_ids;
 	}
 	
@@ -278,8 +261,7 @@ static void stroke_add_conn(private_stroke_t *this, stroke_msg_t *msg)
 					msg->add_conn.other.subnet : msg->add_conn.other.address, IKE_PORT);
 	if (other_subnet == NULL)
 	{
-		this->stroke_logger->log(this->stroke_logger, ERROR, 
-								 "invalid subnet: %s", msg->add_conn.me.subnet);
+		DBG1(SIG_DBG_CFG, "invalid subnet: %s\n", msg->add_conn.me.subnet);
 		my_subnet->destroy(my_subnet);
 		goto destroy_ids;
 	}
@@ -318,7 +300,7 @@ static void stroke_add_conn(private_stroke_t *this, stroke_msg_t *msg)
 	}
 	if (msg->add_conn.me.cert)
 	{
-		x509_t *cert = load_end_certificate(msg->add_conn.me.cert, &my_id, this->logger);
+		x509_t *cert = load_end_certificate(msg->add_conn.me.cert, &my_id);
 
 		if (my_ca == NULL && !my_ca_same && cert)
 		{
@@ -329,7 +311,7 @@ static void stroke_add_conn(private_stroke_t *this, stroke_msg_t *msg)
 	}
 	if (msg->add_conn.other.cert)
 	{
-		x509_t *cert = load_end_certificate(msg->add_conn.other.cert, &other_id, this->logger);
+		x509_t *cert = load_end_certificate(msg->add_conn.other.cert, &other_id);
 
 		if (other_ca == NULL && !other_ca_same && cert)
 		{
@@ -354,9 +336,9 @@ static void stroke_add_conn(private_stroke_t *this, stroke_msg_t *msg)
 	{
 		other_ca = identification_create_from_string("%any");
 	}
-	this->logger->log(this->logger, CONTROL|LEVEL1, "  my ca:   '%D'", my_ca);
-	this->logger->log(this->logger, CONTROL|LEVEL1, "  other ca:'%D'", other_ca);
-	this->logger->log(this->logger, CONTROL|LEVEL1, "  updown: '%s'", msg->add_conn.me.updown);
+	DBG2(SIG_DBG_CFG, "  my ca:   '%D'", my_ca);
+	DBG2(SIG_DBG_CFG, "  other ca:'%D'", other_ca);
+	DBG2(SIG_DBG_CFG, "  updown: '%s'", msg->add_conn.me.updown);
 
 	connection = connection_create(msg->add_conn.name,
 								   msg->add_conn.ikev2,
@@ -384,8 +366,7 @@ static void stroke_add_conn(private_stroke_t *this, stroke_msg_t *msg)
 			proposal = proposal_create_from_string(PROTO_IKE, proposal_string);
 			if (proposal == NULL)
 			{
-				this->logger->log(this->logger, ERROR, 
-								  "invalid IKE proposal string: %s", proposal_string);
+				DBG1(SIG_DBG_CFG, "invalid IKE proposal string: %s", proposal_string);
 				my_id->destroy(my_id);
 				other_id->destroy(other_id);
 				my_ts->destroy(my_ts);
@@ -435,8 +416,7 @@ static void stroke_add_conn(private_stroke_t *this, stroke_msg_t *msg)
 			proposal = proposal_create_from_string(PROTO_ESP, proposal_string);
 			if (proposal == NULL)
 			{
-				this->logger->log(this->logger, ERROR,
-								  "invalid ESP proposal string: %s", proposal_string);
+				DBG1(SIG_DBG_CFG, "invalid ESP proposal string: %s", proposal_string);
 				policy->destroy(policy);
 				connection->destroy(connection);
 				return;
@@ -457,11 +437,11 @@ static void stroke_add_conn(private_stroke_t *this, stroke_msg_t *msg)
 	
 	/* add to global connection list */
 	charon->connections->add_connection(charon->connections, connection);
-	this->logger->log(this->logger, CONTROL, 
-					  "added connection \"%s\": %H[%D]...%H[%D]", msg->add_conn.name,
-					  my_host, my_id, other_host, other_id);
+	DBG1(SIG_DBG_CFG, "added connection '%s': %H[%D]...%H[%D]",
+		 msg->add_conn.name, my_host, my_id, other_host, other_id);
 	/* add to global policy list */
 	charon->policies->add_policy(charon->policies, policy);
+	
 	return;
 
 	/* mopping up after parsing errors */
@@ -483,20 +463,18 @@ static void stroke_del_conn(private_stroke_t *this, stroke_msg_t *msg)
 	status_t status;
 	
 	pop_string(msg, &(msg->del_conn.name));
-	this->logger->log(this->logger, CONTROL, "received stroke: delete \"%s\"", msg->del_conn.name);
+	DBG1(SIG_DBG_CFG, "received stroke: delete '%s'", msg->del_conn.name);
 	
 	status = charon->connections->delete_connection(charon->connections, 
 													msg->del_conn.name);
 	charon->policies->delete_policy(charon->policies, msg->del_conn.name);
 	if (status == SUCCESS)
 	{
-		this->stroke_logger->log(this->stroke_logger, CONTROL,
-								 "Deleted connection '%s'", msg->del_conn.name);
+		fprintf(this->out, "deleted connection '%s'\n", msg->del_conn.name);
 	}
 	else
 	{
-		this->stroke_logger->log(this->stroke_logger, ERROR,
-								 "No connection named '%s'", msg->del_conn.name);
+		fprintf(this->out, "no connection named '%s'\n", msg->del_conn.name);
 	}
 }
 
@@ -508,19 +486,17 @@ static void stroke_initiate(private_stroke_t *this, stroke_msg_t *msg)
 	initiate_job_t *job;
 	connection_t *connection;
 	policy_t *policy;
+	ike_sa_t *init_ike_sa = NULL;
+	signal_t signal;
 	
 	pop_string(msg, &(msg->initiate.name));
-	this->logger->log(this->logger, CONTROL,
-					  "received stroke: initiate \"%s\"",
-					  msg->initiate.name);
+	DBG1(SIG_DBG_CFG, "received stroke: initiate '%s'", msg->initiate.name);
 	
 	connection = charon->connections->get_connection_by_name(charon->connections,
 															 msg->initiate.name);
 	if (connection == NULL)
 	{
-		this->stroke_logger->log(this->stroke_logger, ERROR, 
-								 "no connection named \"%s\"", 
-								 msg->initiate.name);
+		fprintf(this->out, "no connection named '%s'\n", msg->initiate.name);
 		return;
 	}
 	if (!connection->is_ikev2(connection))
@@ -533,17 +509,54 @@ static void stroke_initiate(private_stroke_t *this, stroke_msg_t *msg)
 												  msg->initiate.name);
 	if (policy == NULL)
 	{
-		this->stroke_logger->log(this->stroke_logger, ERROR,
-								 "no policy named \"%s\"",
-								 msg->initiate.name);
+		fprintf(this->out, "no policy named '%s'\n", msg->initiate.name);
 		connection->destroy(connection);
 		return;
 	}
-	this->stroke_logger->log(this->stroke_logger, CONTROL,
-							 "initiating connection \"%s\" (see log)...", 
-							 msg->initiate.name);
+	fprintf(this->out, "initiating connection '%s'\n", msg->initiate.name);
+	
 	job = initiate_job_create(connection, policy);
+	
+	charon->bus->set_listen_state(charon->bus, TRUE);
 	charon->job_queue->add(charon->job_queue, (job_t*)job);
+	while (TRUE)
+	{
+		level_t level;
+		int thread;
+		ike_sa_t *ike_sa;
+		char* format;
+		va_list args;
+		
+		signal = charon->bus->listen(charon->bus, &level, &thread, &ike_sa, &format, &args);
+		
+		if (ike_sa == init_ike_sa && level <= LEVEL_CTRL)
+		{
+			if (vfprintf(this->out, format, args) < 0 ||
+				fprintf(this->out, "\n") < 0 ||
+				fflush(this->out))
+			{
+				break;
+			}
+		}
+		
+		/* TODO: Handle INVALID_KE_PAYLOAD signal (ike_sa switch) */
+		switch (signal)
+		{
+			case SIG_IKE_UP:
+			case SIG_IKE_FAILED:
+			case SIG_IKE_DOWN:
+				if (ike_sa == init_ike_sa)
+				{
+					charon->bus->set_listen_state(charon->bus, FALSE);
+				}
+				return;
+			case SIG_INITIATE:
+				init_ike_sa = ike_sa;
+				/* fall through */
+			default:
+				continue;
+		}
+	}
 }
 
 /**
@@ -556,10 +569,8 @@ static void stroke_route(private_stroke_t *this, stroke_msg_t *msg, bool route)
 	policy_t *policy;
 	
 	pop_string(msg, &(msg->route.name));
-	this->logger->log(this->logger, CONTROL,
-					  "received stroke: %s \"%s\"",
-					  route ? "route" : "unroute",
-					  msg->route.name);
+	DBG1(SIG_DBG_CFG, "received stroke: %s '%s'",
+		 route ? "route" : "unroute", msg->route.name);
 	
 	/* we wouldn't need a connection, but we only want to route policies
 	 * whose connections are keyexchange=ikev2. */
@@ -567,9 +578,7 @@ static void stroke_route(private_stroke_t *this, stroke_msg_t *msg, bool route)
 															 msg->route.name);
 	if (connection == NULL)
 	{
-		this->stroke_logger->log(this->stroke_logger, ERROR, 
-								 "no connection named \"%s\"", 
-								 msg->route.name);
+		fprintf(this->out, "no connection named '%s'\n", msg->route.name);
 		return;
 	}
 	if (!connection->is_ikev2(connection))
@@ -582,16 +591,12 @@ static void stroke_route(private_stroke_t *this, stroke_msg_t *msg, bool route)
 												  msg->route.name);
 	if (policy == NULL)
 	{
-		this->stroke_logger->log(this->stroke_logger, ERROR,
-								 "no policy named \"%s\"",
-								 msg->route.name);
+		fprintf(this->out, "no policy named '%s'\n", msg->route.name);
 		connection->destroy(connection);
 		return;
 	}
-	this->stroke_logger->log(this->stroke_logger, CONTROL,
-							 "%s policy \"%s\"", 
-							 route ? "routing" : "unrouting",
-							 msg->route.name);
+	fprintf(this->out, "%s policy '%s'\n",
+			route ? "routing" : "unrouting", msg->route.name);
 	job = route_job_create(connection, policy, route);
 	charon->job_queue->add(charon->job_queue, (job_t*)job);
 }
@@ -602,37 +607,38 @@ static void stroke_route(private_stroke_t *this, stroke_msg_t *msg, bool route)
 static void stroke_terminate(private_stroke_t *this, stroke_msg_t *msg)
 {
 	pop_string(msg, &(msg->terminate.name));
-	this->logger->log(this->logger, CONTROL, "received stroke: terminate \"%s\"", msg->terminate.name);
+	DBG1(SIG_DBG_CFG, "received stroke: terminate '%s'", msg->terminate.name);
 	
 	charon->ike_sa_manager->delete_by_name(charon->ike_sa_manager, msg->terminate.name);
 }
 
 /**
- * show status of (established) connections
+ * show status of daemon
  */
-static void stroke_status(private_stroke_t *this, stroke_msg_t *msg)
+static void stroke_statusall(private_stroke_t *this, stroke_msg_t *msg)
 {
+	iterator_t *iterator;
 	linked_list_t *list;
 	host_t *host;
+	connection_t *connection;
+	policy_t *policy;
+	ike_sa_t *ike_sa;
 	
-	leak_detective_status(this->stroke_logger);
+	leak_detective_status(this->out);
 	
-	this->stroke_logger->log(this->stroke_logger, CONTROL|LEVEL1,
-							 "job queue load: %d",
-							 charon->job_queue->get_count(charon->job_queue));
-	this->stroke_logger->log(this->stroke_logger, CONTROL|LEVEL1,
-							 "scheduled events: %d",
-							 charon->event_queue->get_count(charon->event_queue));
+	fprintf(this->out, "worker threads idle: %d of %d\n",
+			charon->thread_pool->get_idle_threads(charon->thread_pool),
+			charon->thread_pool->get_pool_size(charon->thread_pool));
+	fprintf(this->out, "job queue load: %d\n",
+			charon->job_queue->get_count(charon->job_queue));
+	fprintf(this->out, "scheduled events: %d\n",
+			charon->event_queue->get_count(charon->event_queue));
 	list = charon->socket->create_local_address_list(charon->socket);
-	this->stroke_logger->log(this->stroke_logger, CONTROL|LEVEL1,
-							 "listening on %d addresses:",
-							 list->get_count(list));
+	fprintf(this->out, "listening on %d addresses:\n", list->get_count(list));
 	while (list->remove_first(list, (void**)&host) == SUCCESS)
 	{
-		this->stroke_logger->log(this->stroke_logger, CONTROL|LEVEL1,
-								 "  %H", host);
+		fprintf(this->out, "  %H\n", host);
 		host->destroy(host);
-		
 	}
 	list->destroy(list);
 	
@@ -640,10 +646,101 @@ static void stroke_status(private_stroke_t *this, stroke_msg_t *msg)
 	{
 		pop_string(msg, &(msg->status.name));
 	}
-	charon->connections->log_connections(charon->connections,
-										 this->stroke_logger, msg->status.name);
-	charon->ike_sa_manager->log_status(charon->ike_sa_manager,
-									   this->stroke_logger, msg->status.name);
+	
+	fprintf(this->out, "connections:\n");
+	iterator = charon->connections->create_iterator(charon->connections);
+	while (iterator->iterate(iterator, (void**)&connection))
+	{
+		if (connection->is_ikev2(connection) && (msg->status.name == NULL ||
+			streq(msg->status.name, connection->get_name(connection))))
+		{
+			fprintf(this->out, "%10s: %H...%H\n",
+					connection->get_name(connection),
+					connection->get_my_host(connection),
+					connection->get_other_host(connection));
+		}
+	}
+	iterator->destroy(iterator);
+	
+	fprintf(this->out, "policies:\n");
+	iterator = charon->policies->create_iterator(charon->policies);
+	while (iterator->iterate(iterator, (void**)&policy))
+	{
+		if (msg->status.name == NULL ||
+			streq(msg->status.name, policy->get_name(policy)))
+		{
+			fprintf(this->out, "%10s: %D...%D\n",
+					policy->get_name(policy),
+					policy->get_my_id(policy),
+					policy->get_other_id(policy));
+		}
+	}
+	iterator->destroy(iterator);
+	
+	fprintf(this->out,  "IKE_SAs:\n");
+	iterator = charon->ike_sa_manager->create_iterator(charon->ike_sa_manager);
+	while (iterator->iterate(iterator, (void**)&ike_sa))
+	{
+		bool ike_sa_printed = FALSE;
+		child_sa_t *child_sa;
+		iterator_t *children = ike_sa->create_child_sa_iterator(ike_sa);
+		while (children->iterate(children, (void**)&child_sa))
+		{
+			if (!ike_sa_printed &&
+			   (msg->status.name == NULL ||
+				streq(msg->status.name, child_sa->get_name(child_sa)) ||
+				streq(msg->status.name, ike_sa->get_name(ike_sa))))
+			{
+				fprintf(this->out, "%#K\n", ike_sa);
+				ike_sa_printed = TRUE;
+			}
+			if (ike_sa_printed)
+			{
+				fprintf(this->out, "%#P\n", child_sa);
+			}
+		}
+		children->destroy(children);
+	}
+	iterator->destroy(iterator);
+}
+
+/**
+ * show status of daemon
+ */
+static void stroke_status(private_stroke_t *this, stroke_msg_t *msg)
+{
+	iterator_t *iterator;
+	ike_sa_t *ike_sa;
+	
+	if (msg->status.name)
+	{
+		pop_string(msg, &(msg->status.name));
+	}
+	
+	iterator = charon->ike_sa_manager->create_iterator(charon->ike_sa_manager);
+	while (iterator->iterate(iterator, (void**)&ike_sa))
+	{
+		bool ike_sa_printed = FALSE;
+		child_sa_t *child_sa;
+		iterator_t *children = ike_sa->create_child_sa_iterator(ike_sa);
+		while (children->iterate(children, (void**)&child_sa))
+		{
+			if (!ike_sa_printed &&
+				(msg->status.name == NULL ||
+				streq(msg->status.name, child_sa->get_name(child_sa)) ||
+				streq(msg->status.name, ike_sa->get_name(ike_sa))))
+			{
+				fprintf(this->out, "%K\n", ike_sa);
+				ike_sa_printed = TRUE;
+			}
+			if (ike_sa_printed)
+			{
+				fprintf(this->out, "%P\n", child_sa);
+			}
+		}
+		children->destroy(children);
+	}
+	iterator->destroy(iterator);
 }
 
 /**
@@ -651,17 +748,62 @@ static void stroke_status(private_stroke_t *this, stroke_msg_t *msg)
  */
 static void stroke_list(private_stroke_t *this, stroke_msg_t *msg)
 {
+	iterator_t *iterator;
+	
 	if (msg->list.flags & LIST_CERTS)
 	{
-		charon->credentials->log_certificates(charon->credentials, this->stroke_logger, msg->list.utc);
+		x509_t *cert;
+		
+		iterator = charon->credentials->create_cert_iterator(charon->credentials);
+		if (iterator->get_count(iterator))
+		{
+			fprintf(this->out, "List of X.509 End Entity Certificates:\n");
+			fprintf(this->out, "--------------------------------------\n");
+		}
+		while (iterator->iterate(iterator, (void**)&cert))
+		{
+			fprintf(this->out, "%#Q", cert, msg->list.utc);
+			if (charon->credentials->has_rsa_private_key(
+					charon->credentials, cert->get_public_key(cert)))
+			{
+				fprintf(this->out, ", has private key");
+			}
+			fprintf(this->out, "\n\n");
+			
+		}
+		iterator->destroy(iterator);
 	}
 	if (msg->list.flags & LIST_CACERTS)
 	{
-		charon->credentials->log_ca_certificates(charon->credentials, this->stroke_logger, msg->list.utc);
+		x509_t *cert;
+		
+		iterator = charon->credentials->create_cacert_iterator(charon->credentials);
+		if (iterator->get_count(iterator))
+		{
+			fprintf(this->out, "List of X.509 CA Certificates:\n");
+			fprintf(this->out, "------------------------------\n");
+		}
+		while (iterator->iterate(iterator, (void**)&cert))
+		{
+			fprintf(this->out, "%#Q\n\n", cert, msg->list.utc);
+		}
+		iterator->destroy(iterator);
 	}
 	if (msg->list.flags & LIST_CRLS)
 	{
-		charon->credentials->log_crls(charon->credentials, this->stroke_logger, msg->list.utc);
+		crl_t *crl;
+		
+		iterator = charon->credentials->create_crl_iterator(charon->credentials);
+		if (iterator->get_count(iterator))
+		{
+			fprintf(this->out, "List of X.509 CRLs:\n");
+			fprintf(this->out, "-------------------\n");
+		}
+		while (iterator->iterate(iterator, (void**)&crl))
+		{
+			fprintf(this->out, "%#U\n\n", crl, msg->list.utc);
+		}
+		iterator->destroy(iterator);
 	}
 }
 
@@ -680,107 +822,41 @@ static void stroke_reread(private_stroke_t *this, stroke_msg_t *msg)
 	}
 }
 
-logger_context_t get_context(char *context)
-{
-	if      (strcasecmp(context, "ALL") == 0) return ALL_LOGGERS;
-	else if (strcasecmp(context, "PARSR") == 0) return PARSER;
-	else if (strcasecmp(context, "GNRAT") == 0) return GENERATOR;
-	else if (strcasecmp(context, "IKESA") == 0) return IKE_SA;
-	else if (strcasecmp(context, "SAMGR") == 0) return IKE_SA_MANAGER;
-	else if (strcasecmp(context, "CHDSA") == 0) return CHILD_SA;
-	else if (strcasecmp(context, "MESSG") == 0) return MESSAGE;
-	else if (strcasecmp(context, "TPOOL") == 0) return THREAD_POOL;
-	else if (strcasecmp(context, "WORKR") == 0) return WORKER;
-	else if (strcasecmp(context, "SCHED") == 0) return SCHEDULER;
-	else if (strcasecmp(context, "SENDR") == 0) return SENDER;
-	else if (strcasecmp(context, "RECVR") == 0) return RECEIVER;
-	else if (strcasecmp(context, "SOCKT") == 0) return SOCKET;
-	else if (strcasecmp(context, "TESTR") == 0) return TESTER;
-	else if (strcasecmp(context, "DAEMN") == 0) return DAEMON;
-	else if (strcasecmp(context, "CONFG") == 0) return CONFIG;
-	else if (strcasecmp(context, "ENCPL") == 0) return ENCRYPTION_PAYLOAD;
-	else if (strcasecmp(context, "PAYLD") == 0) return PAYLOAD;
-	else if (strcasecmp(context, "XFRM") == 0) return XFRM;
-	else return -2;
-}
-
-/**
- * set the type of logged messages in a context
- */
-static void stroke_logtype(private_stroke_t *this, stroke_msg_t *msg)
+signal_t get_signal_from_logtype(char *type)
 {
-	pop_string(msg, &(msg->logtype.context));
-	pop_string(msg, &(msg->logtype.type));
-	
-	this->logger->log(this->logger, CONTROL, "received stroke: logtype for %s", msg->logtype.context);
-	
-	log_level_t level;
-	logger_context_t context = get_context(msg->logtype.context);
-	if (context == -2)
-	{
-		this->stroke_logger->log(this->stroke_logger, ERROR, "invalid context (%s)!", msg->logtype.context);
-		return;
-	}
-	
-	if      (strcasecmp(msg->logtype.type, "CONTROL") == 0)
-		level = CONTROL;
-	else if (strcasecmp(msg->logtype.type, "ERROR") == 0)
-		level = ERROR;
-	else if (strcasecmp(msg->logtype.type, "AUDIT") == 0)
-		level = AUDIT;
-	else if (strcasecmp(msg->logtype.type, "RAW") == 0)
-		level = RAW;
-	else if (strcasecmp(msg->logtype.type, "PRIVATE") == 0)
-		level = PRIVATE;
-	else
-	{
-		this->stroke_logger->log(this->stroke_logger, ERROR, "invalid type (%s)!", msg->logtype.type);
-		return;
-	}
-	
-	if (msg->logtype.enable)
-	{
-		logger_manager->enable_log_level(logger_manager, context, level);
-	}
-	else
-	{
-		logger_manager->disable_log_level(logger_manager, context, level);
-	}
+	if      (strcasecmp(type, "any") == 0) return SIG_ANY;
+	else if (strcasecmp(type, "mgr") == 0) return SIG_DBG_MGR;
+	else if (strcasecmp(type, "ike") == 0) return SIG_DBG_IKE;
+	else if (strcasecmp(type, "chd") == 0) return SIG_DBG_CHD;
+	else if (strcasecmp(type, "job") == 0) return SIG_DBG_JOB;
+	else if (strcasecmp(type, "cfg") == 0) return SIG_DBG_CFG;
+	else if (strcasecmp(type, "knl") == 0) return SIG_DBG_KNL;
+	else if (strcasecmp(type, "net") == 0) return SIG_DBG_NET;
+	else if (strcasecmp(type, "enc") == 0) return SIG_DBG_ENC;
+	else if (strcasecmp(type, "lib") == 0) return SIG_DBG_LIB;
+	else return -1;
 }
 
 /**
- * set the verbosity of a logger
+ * set the verbosity debug output
  */
 static void stroke_loglevel(private_stroke_t *this, stroke_msg_t *msg)
 {
-	log_level_t level;
-	logger_context_t context;
-
-	pop_string(msg, &(msg->loglevel.context));
-	this->logger->log(this->logger, CONTROL, "received stroke: loglevel for %s", msg->loglevel.context);
+	signal_t signal;
 	
-	context = get_context(msg->loglevel.context);
-	if (context == -2)
-	{
-		this->stroke_logger->log(this->stroke_logger, ERROR, "invalid context (%s)!", msg->loglevel.context);
-		return;
-	}
+	pop_string(msg, &(msg->loglevel.type));
+	DBG1(SIG_DBG_CFG, "received stroke: loglevel %d for %s",
+		 msg->loglevel.level, msg->loglevel.type);
 	
-	if (msg->loglevel.level == 0)
-		level = LEVEL0;
-	else if (msg->loglevel.level == 1)
-		level = LEVEL1;
-	else if (msg->loglevel.level == 2)
-		level = LEVEL2;
-	else if (msg->loglevel.level == 3)
-		level = LEVEL3;
-	else 
+	signal = get_signal_from_logtype(msg->loglevel.type);
+	if (signal < 0)
 	{
-		this->stroke_logger->log(this->stroke_logger, ERROR, "invalid level (%d)!", msg->loglevel.level);
+		fprintf(this->out, "invalid type (%s)!\n", msg->loglevel.type);
 		return;
 	}
 	
-	logger_manager->enable_log_level(logger_manager, context, level);
+	charon->outlog->set_level(charon->outlog, signal, msg->loglevel.level);
+	charon->syslog->set_level(charon->syslog, signal, msg->loglevel.level);
 }
 
 /**
@@ -794,7 +870,6 @@ static void stroke_receive(private_stroke_t *this)
 	int strokeaddrlen = sizeof(strokeaddr);
 	ssize_t bytes_read;
 	int strokefd;
-	FILE *strokefile;
 	int oldstate;
 	
 	/* disable cancellation by default */
@@ -809,7 +884,7 @@ static void stroke_receive(private_stroke_t *this)
 		
 		if (strokefd < 0)
 		{
-			this->logger->log(this->logger, ERROR, "accepting stroke connection failed: %s", strerror(errno));
+			DBG1(SIG_DBG_CFG, "accepting stroke connection failed: %m");
 			continue;
 		}
 		
@@ -817,7 +892,7 @@ static void stroke_receive(private_stroke_t *this)
 		bytes_read = recv(strokefd, &msg_length, sizeof(msg_length), MSG_PEEK);
 		if (bytes_read != sizeof(msg_length))
 		{
-			this->logger->log(this->logger, ERROR, "reading lenght of stroke message failed");
+			DBG1(SIG_DBG_CFG, "reading lenght of stroke message failed");
 			close(strokefd);
 			continue;
 		}
@@ -827,24 +902,21 @@ static void stroke_receive(private_stroke_t *this)
 		bytes_read = recv(strokefd, msg, msg_length, 0);
 		if (bytes_read != msg_length)
 		{
-			this->logger->log(this->logger, ERROR, "reading stroke message failed: %s");
+			DBG1(SIG_DBG_CFG, "reading stroke message failed: %m");
 			close(strokefd);
 			continue;
 		}
 		
-		strokefile = fdopen(dup(strokefd), "w");
-		if (strokefile == NULL)
+		this->out = fdopen(dup(strokefd), "w");
+		if (this->out == NULL)
 		{
-			this->logger->log(this->logger, ERROR, "opening stroke output channel failed:", strerror(errno));
+			DBG1(SIG_DBG_CFG, "opening stroke output channel failed: %m");
 			close(strokefd);
 			free(msg);
 			continue;
 		}
 		
-		/* setup a logger which writes status to the unix socket */
-		this->stroke_logger = logger_create("", CONTROL|ERROR, FALSE, strokefile);
-		
-		this->logger->log_bytes(this->logger, RAW, "stroke message", (void*)msg, msg_length);
+		DBG3(SIG_DBG_CFG, "stroke message %b", (void*)msg, msg_length);
 		
 		switch (msg->type)
 		{
@@ -864,8 +936,7 @@ static void stroke_receive(private_stroke_t *this)
 				stroke_status(this, msg);
 				break;
 			case STR_STATUS_ALL:
-				this->stroke_logger->enable_level(this->stroke_logger, LEVEL1);
-				stroke_status(this, msg);
+				stroke_statusall(this, msg);
 				break;
 			case STR_ADD_CONN:
 				stroke_add_conn(this, msg);
@@ -873,9 +944,6 @@ static void stroke_receive(private_stroke_t *this)
 			case STR_DEL_CONN:
 				stroke_del_conn(this, msg);
 				break;
-			case STR_LOGTYPE:
-				stroke_logtype(this, msg);
-				break;
 			case STR_LOGLEVEL:
 				stroke_loglevel(this, msg);
 				break;
@@ -886,10 +954,9 @@ static void stroke_receive(private_stroke_t *this)
 				stroke_reread(this, msg);
 				break;
 			default:
-				this->logger->log(this->logger, ERROR, "received invalid stroke");
+				DBG1(SIG_DBG_CFG, "received unknown stroke");
 		}
-		this->stroke_logger->destroy(this->stroke_logger);
-		fclose(strokefile);
+		fclose(this->out);
 		close(strokefd);
 		free(msg);
 	}
@@ -900,7 +967,6 @@ static void stroke_receive(private_stroke_t *this)
  */
 static void destroy(private_stroke_t *this)
 {
-	
 	pthread_cancel(this->assigned_thread);
 	pthread_join(this->assigned_thread, NULL);
 
@@ -909,7 +975,6 @@ static void destroy(private_stroke_t *this)
 	free(this);
 }
 
-
 /*
  * Described in header-file
  */
@@ -921,16 +986,11 @@ stroke_t *stroke_create()
 	/* public functions */
 	this->public.destroy = (void (*)(stroke_t*))destroy;
 	
-	/* private functions */
-	this->stroke_receive = stroke_receive;
-	
-	this->logger = logger_manager->get_logger(logger_manager, CONFIG);
-	
 	/* set up unix socket */
 	this->socket = socket(AF_UNIX, SOCK_STREAM, 0);
 	if (this->socket == -1)
 	{
-		this->logger->log(this->logger, ERROR, "could not create whack socket");
+		DBG1(SIG_DBG_CFG, "could not create whack socket");
 		free(this);
 		return NULL;
 	}
@@ -938,7 +998,7 @@ stroke_t *stroke_create()
 	old = umask(~S_IRWXU);
 	if (bind(this->socket, (struct sockaddr *)&socket_addr, sizeof(socket_addr)) < 0)
 	{
-		this->logger->log(this->logger, ERROR, "could not bind stroke socket: %s", strerror(errno));
+		DBG1(SIG_DBG_CFG, "could not bind stroke socket: %m");
 		close(this->socket);
 		free(this);
 		return NULL;
@@ -947,7 +1007,7 @@ stroke_t *stroke_create()
 	
 	if (listen(this->socket, 0) < 0)
 	{
-		this->logger->log(this->logger, ERROR, "could not listen on stroke socket: %s", strerror(errno));
+		DBG1(SIG_DBG_CFG, "could not listen on stroke socket: %m");
 		close(this->socket);
 		unlink(socket_addr.sun_path);
 		free(this);
@@ -955,9 +1015,9 @@ stroke_t *stroke_create()
 	}
 	
 	/* start a thread reading from the socket */
-	if (pthread_create(&(this->assigned_thread), NULL, (void*(*)(void*))this->stroke_receive, this) != 0)
+	if (pthread_create(&(this->assigned_thread), NULL, (void*(*)(void*))stroke_receive, this) != 0)
 	{
-		this->logger->log(this->logger, ERROR, "Could not spawn stroke thread");
+		DBG1(SIG_DBG_CFG, "Could not spawn stroke thread");
 		close(this->socket);
 		unlink(socket_addr.sun_path);
 		free(this);
diff --git a/src/charon/threads/stroke_interface.h b/src/charon/threads/stroke_interface.h
index 16eb66533..941841d14 100644
--- a/src/charon/threads/stroke_interface.h
+++ b/src/charon/threads/stroke_interface.h
@@ -23,9 +23,6 @@
 #ifndef STROKE_INTERFACE_H_
 #define STROKE_INTERFACE_H_
 
-#include <config/policies/policy_store.h>
-#include <config/connections/connection_store.h>
-#include <config/credentials/credential_store.h>
 
 
 typedef struct stroke_t stroke_t;
@@ -36,17 +33,7 @@ typedef struct stroke_t stroke_t;
  * 
  * stroke_t allows config manipulation (as whack in pluto). 
  * Messages of type stroke_msg_t's are sent over a unix socket
- * (/var/run/charon.ctl). stroke_t implements the connections_t
- * and the policies_t interface, which means it acts as a 
- * configuration backend for those too. stroke_t uses an own
- * thread to read from the socket.
- * 
- * @warning DO NOT cast stroke_t to any of the implemented interfaces!
- * stroke_t implements multiple interfaces, so you must use
- * stroke_t.interface_xy to access the specific interface! You have
- * been warned...
- * 
- * @todo Add clean thread cancellation
+ * (/var/run/charon.ctl).
  * 
  * @b Constructors:
  * - stroke_create()
diff --git a/src/charon/threads/thread_pool.c b/src/charon/threads/thread_pool.c
index 3b2938865..413f87f35 100644
--- a/src/charon/threads/thread_pool.c
+++ b/src/charon/threads/thread_pool.c
@@ -27,10 +27,9 @@
 #include <errno.h>
 
 #include "thread_pool.h"
- 
+
 #include <daemon.h>
 #include <queues/job_queue.h>
-#include <utils/logger.h>
 
 
 typedef struct private_thread_pool_t private_thread_pool_t;
@@ -47,17 +46,17 @@ struct private_thread_pool_t {
 	/**
 	 * Number of running threads.
 	 */
-	size_t pool_size;
+	u_int pool_size;
 	
 	/**
-	 * Array of thread ids.
+	 * Number of threads waiting for work
 	 */
-	pthread_t *threads;
+	u_int idle_threads;
 	
 	/**
-	 * Logger of the thread pool.
+	 * Array of thread ids.
 	 */
-	logger_t *logger;
+	pthread_t *threads;
 } ;
 
 /**
@@ -71,13 +70,14 @@ static void process_jobs(private_thread_pool_t *this)
 	/* cancellation disabled by default */
 	pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, NULL);
 	
-	this->logger->log(this->logger, CONTROL,
-					  "worker thread running,    thread_ID: %06u",
-					  (int)pthread_self());
+	DBG1(SIG_DBG_JOB, "worker thread running, thread_ID: %06u",
+		 (int)pthread_self());
 	
 	while (TRUE)
 	{
+		this->idle_threads++;
 		job = charon->job_queue->get(charon->job_queue);
+		this->idle_threads--;
 		
 		status = job->execute(job);
 		
@@ -91,21 +91,29 @@ static void process_jobs(private_thread_pool_t *this)
 /**
  * Implementation of thread_pool_t.get_pool_size.
  */
-static size_t get_pool_size(private_thread_pool_t *this)
+static u_int get_pool_size(private_thread_pool_t *this)
 {
 	return this->pool_size;
 }
 
 /**
+ * Implementation of thread_pool_t.get_idle_threads.
+ */
+static u_int get_idle_threads(private_thread_pool_t *this)
+{
+	return this->idle_threads;
+}
+
+/**
  * Implementation of thread_pool_t.destroy.
  */
 static void destroy(private_thread_pool_t *this)
 {	
 	int current;
 	/* flag thread for termination */
-	for (current = 0; current < this->pool_size; current++) {
-		this->logger->log(this->logger, CONTROL, 
-						  "cancelling worker thread #%d", current+1);
+	for (current = 0; current < this->pool_size; current++)
+	{
+		DBG1(SIG_DBG_JOB, "cancelling worker thread #%d", current+1);
 		pthread_cancel(this->threads[current]);
 	}
 	
@@ -113,13 +121,11 @@ static void destroy(private_thread_pool_t *this)
 	for (current = 0; current < this->pool_size; current++) {
 		if (pthread_join(this->threads[current], NULL) == 0)
 		{
-			this->logger->log(this->logger, CONTROL, 
-							  "worker thread #%d terminated", current+1);
+			DBG1(SIG_DBG_JOB, "worker thread #%d terminated", current+1);
 		}
 		else
 		{
-			this->logger->log(this->logger, ERROR, 
-							  "could not terminate worker thread #%d", current+1);
+			DBG1(SIG_DBG_JOB, "could not terminate worker thread #%d", current+1);
 		}
 	}
 	
@@ -138,39 +144,36 @@ thread_pool_t *thread_pool_create(size_t pool_size)
 	
 	/* fill in public fields */
 	this->public.destroy = (void(*)(thread_pool_t*))destroy;
-	this->public.get_pool_size = (size_t(*)(thread_pool_t*))get_pool_size;
+	this->public.get_pool_size = (u_int(*)(thread_pool_t*))get_pool_size;
+	this->public.get_idle_threads = (u_int(*)(thread_pool_t*))get_idle_threads;
 	
 	/* initialize member */
 	this->pool_size = pool_size;
+	this->idle_threads = 0;
 	this->threads = malloc(sizeof(pthread_t) * pool_size);
-	this->logger = logger_manager->get_logger(logger_manager, THREAD_POOL);
 	
 	/* try to create as many threads as possible, up to pool_size */
-	for (current = 0; current < pool_size; current++) 
+	for (current = 0; current < pool_size; current++)
 	{
-		if (pthread_create(&(this->threads[current]), NULL, 
+		if (pthread_create(&(this->threads[current]), NULL,
 						   (void*(*)(void*))process_jobs, this) == 0)
 		{
-			this->logger->log(this->logger, CONTROL, 
-							  "created worker thread #%d", current+1);
+			DBG1(SIG_DBG_JOB, "created worker thread #%d", current+1);
 		}
 		else
 		{
 			/* creation failed, is it the first one? */	
-			if (current == 0) 
+			if (current == 0)
 			{
-				this->logger->log(this->logger, ERROR, "Could not create any thread");
 				free(this->threads);
 				free(this);
-				return NULL;
+				charon->kill(charon, "could not create any worker threads");
 			}
 			/* not all threads could be created, but at least one :-/ */
-			this->logger->log(this->logger, ERROR,
-							  "Could only create %d from requested %d threads!",
-							  current, pool_size);
-				
+			DBG1(SIG_DBG_JOB, "could only create %d from requested %d threads!",
+				 current, pool_size);
 			this->pool_size = current;
-			return (thread_pool_t*)this;
+			break;
 		}
 	}
 	return (thread_pool_t*)this;
diff --git a/src/charon/threads/thread_pool.h b/src/charon/threads/thread_pool.h
index c27d0e0b3..e4a04e8cb 100644
--- a/src/charon/threads/thread_pool.h
+++ b/src/charon/threads/thread_pool.h
@@ -45,13 +45,22 @@ typedef struct thread_pool_t thread_pool_t;
  * @ingroup threads
  */
 struct thread_pool_t {
+	
 	/**
 	 * @brief Return currently instanciated thread count.
-	 * 
+	 *
 	 * @param thread_pool	calling object		
 	 * @return				size of thread pool
 	 */
-	size_t (*get_pool_size) (thread_pool_t *thread_pool);
+	u_int (*get_pool_size) (thread_pool_t *thread_pool);
+	
+	/**
+	 * @brief Get the number of threads currently waiting for work.
+	 *
+	 * @param thread_pool	calling object		
+	 * @return				number of idle threads
+	 */
+	u_int (*get_idle_threads) (thread_pool_t *thread_pool);
 	
 	/**
 	 * @brief Destroy a thread_pool_t object.
diff --git a/src/libstrongswan/Makefile.am b/src/libstrongswan/Makefile.am
index 6fddda20a..a7deeef70 100644
--- a/src/libstrongswan/Makefile.am
+++ b/src/libstrongswan/Makefile.am
@@ -30,12 +30,9 @@ crypto/diffie_hellman.c crypto/diffie_hellman.h \
 utils/identification.c utils/identification.h \
 utils/linked_list.c utils/linked_list.h utils/iterator.h\
 utils/randomizer.c utils/randomizer.h \
-utils/logger.c utils/logger.h \
-utils/logger_manager.c utils/logger_manager.h \
 utils/host.c utils/host.h \
 utils/lexparser.c utils/lexparser.h \
-utils/leak_detective.c utils/leak_detective.h \
-utils/tester.c utils/tester.h
+utils/leak_detective.c utils/leak_detective.h
 
 libstrongswan_la_LIBADD = -lgmp -lpthread
 
diff --git a/src/libstrongswan/asn1/asn1.c b/src/libstrongswan/asn1/asn1.c
index 0523b8ae8..e9a229d1e 100644
--- a/src/libstrongswan/asn1/asn1.c
+++ b/src/libstrongswan/asn1/asn1.c
@@ -13,14 +13,14 @@
  * for more details.
  */
 
-#include <stdlib.h>
+#include <stdio.h>
 #include <string.h>
 #include <time.h>
 
-#include "types.h"
 #include "asn1.h"
 
-#include <utils/logger_manager.h>
+#include <types.h>
+#include <library.h>
 
 /* some common prefabricated ASN.1 constants */
 static u_char ASN1_INTEGER_0_str[] = { 0x02, 0x00 };
@@ -80,17 +80,6 @@ static const asn1Object_t algorithmIdentifierObjects[] = {
 #define ALGORITHM_ID_PARAMETERS	2
 #define ALGORITHM_ID_ROOF		3
 
-static logger_t *logger = NULL;
-
-/**
- * initializes the ASN.1 logger
- */
-static void asn1_init_logger(void)
-{
-	if (logger == NULL)
-		logger = logger_manager->get_logger(logger_manager, ASN1);
-}
-
 /**
  * return the ASN.1 encoded algorithm identifier
  */
@@ -171,14 +160,14 @@ u_int asn1_length(chunk_t *blob)
 	
 	if (n > blob->len)
 	{
-		logger->log(logger, ERROR|LEVEL1, "number of length octets is larger than ASN.1 object");
+		DBG2("number of length octets is larger than ASN.1 object");
 		return ASN1_INVALID_LENGTH;
 	}
 	
 	if (n > sizeof(len))
 	{
-		logger->log(logger, ERROR|LEVEL1, "number of length octets is larger than limit of %d octets", 
-					(int)sizeof(len));
+		DBG2("number of length octets is larger than limit of %d octets", 
+			 (int)sizeof(len));
 		return ASN1_INVALID_LENGTH;
 	}
 	
@@ -289,8 +278,6 @@ time_t asn1totime(const chunk_t *utctime, asn1_t type)
  */
 void asn1_init(asn1_ctx_t *ctx, chunk_t blob, u_int level0, bool implicit)
 {
-	asn1_init_logger();
-
 	ctx->blobs[0] = blob;
 	ctx->level0   = level0;
 	ctx->implicit = implicit;
@@ -310,7 +297,7 @@ static void debug_asn1_simple_object(chunk_t object, asn1_t type)
 			oid = known_oid(object);
 			if (oid != OID_UNKNOWN)
 			{
-				logger->log(logger, CONTROL|LEVEL2, "  '%s'", oid_names[oid].name);
+				DBG2("  '%s'", oid_names[oid].name);
 				return;
 			}
 			break;
@@ -319,22 +306,18 @@ static void debug_asn1_simple_object(chunk_t object, asn1_t type)
 		case ASN1_PRINTABLESTRING:
 		case ASN1_T61STRING:
 		case ASN1_VISIBLESTRING:
-			logger->log(logger, CONTROL|LEVEL2, "  '%.*s'", (int)object.len, object.ptr);
+			DBG2("  '%.*s'", (int)object.len, object.ptr);
 			return;
 		case ASN1_UTCTIME:
 		case ASN1_GENERALIZEDTIME:
 			{
-				char buf[TIMETOA_BUF];
-				time_t time = asn1totime(&object, type);
-
-				timetoa(buf, TIMETOA_BUF, &time, TRUE);
-				logger->log(logger, CONTROL|LEVEL2, "  '%s'", buf);
+				DBG2("  '%T'", asn1totime(&object, type));
 			}
 			return;
 		default:
 			break;
 	}
-	logger->log_chunk(logger, RAW|LEVEL1, "", object);
+	DBG3("%B", &object);
 }
 
 /**
@@ -372,7 +355,7 @@ bool extract_object(asn1Object_t const *objects, u_int *objectID, chunk_t *objec
 	if ((obj.flags & ASN1_DEF) && (blob->len == 0 || *start_ptr != obj.type) )
 	{
 		/* field is missing */
-		logger->log(logger, CONTROL|LEVEL2, "L%d - %s:", *level, obj.name);
+		DBG2("L%d - %s:", *level, obj.name);
 		if (obj.type & ASN1_CONSTRUCTED)
 		{
 			(*objectID)++ ;  /* skip context-specific tag */
@@ -397,7 +380,7 @@ bool extract_object(asn1Object_t const *objects, u_int *objectID, chunk_t *objec
 	
 	if (blob->len < 2)
 	{
-		logger->log(logger, ERROR|LEVEL1, "L%d - %s:  ASN.1 object smaller than 2 octets", 
+		DBG2("L%d - %s:  ASN.1 object smaller than 2 octets", 
 					*level, obj.name);
 		return FALSE;
 	}
@@ -406,7 +389,7 @@ bool extract_object(asn1Object_t const *objects, u_int *objectID, chunk_t *objec
 	
 	if (blob1->len == ASN1_INVALID_LENGTH || blob->len < blob1->len)
 	{
-		logger->log(logger, ERROR|LEVEL1, "L%d - %s:  length of ASN.1 object invalid or too large", 
+		DBG2("L%d - %s:  length of ASN.1 object invalid or too large", 
 					*level, obj.name);
 		return FALSE;
 	}
@@ -419,7 +402,7 @@ bool extract_object(asn1Object_t const *objects, u_int *objectID, chunk_t *objec
 	
 	if (obj.flags & ASN1_RAW)
 	{
-		logger->log(logger, CONTROL|LEVEL2, "L%d - %s:", *level, obj.name);
+		DBG2("L%d - %s:", *level, obj.name);
 		object->ptr = start_ptr;
 		object->len = (size_t)(blob->ptr - start_ptr);
 		return TRUE;
@@ -427,13 +410,13 @@ bool extract_object(asn1Object_t const *objects, u_int *objectID, chunk_t *objec
 
 	if (*start_ptr != obj.type && !(ctx->implicit && *objectID == 0))
 	{
-		logger->log(logger, ERROR|LEVEL1, "L%d - %s: ASN1 tag 0x%02x expected, but is 0x%02x",
+		DBG1("L%d - %s: ASN1 tag 0x%02x expected, but is 0x%02x",
 					*level, obj.name, obj.type, *start_ptr);
-		logger->log_bytes(logger, RAW|LEVEL1, "", start_ptr, (u_int)(blob->ptr - start_ptr));
+		DBG3("%b", start_ptr, (u_int)(blob->ptr - start_ptr));
 		return FALSE;
 	}
 	
-	logger->log(logger, CONTROL|LEVEL2, "L%d - %s:", ctx->level0+obj.level, obj.name);
+	DBG2("L%d - %s:", ctx->level0+obj.level, obj.name);
 	
 	/* In case of "SEQUENCE OF" or "SET OF" start a loop */	
 	if (obj.flags & ASN1_LOOP)
@@ -458,7 +441,7 @@ bool extract_object(asn1Object_t const *objects, u_int *objectID, chunk_t *objec
 	{
 		object->ptr = start_ptr;
 		object->len = (size_t)(blob->ptr - start_ptr);
-		logger->log_chunk(logger, RAW|LEVEL2, "", *object);
+		DBG3("%B", object);
 	}
 	else if (obj.flags & ASN1_BODY)
 	{
@@ -478,15 +461,14 @@ bool parse_asn1_simple_object(chunk_t *object, asn1_t type, u_int level, const c
 	/* an ASN.1 object must possess at least a tag and length field */
 	if (object->len < 2)
 	{
-		logger->log(logger, ERROR|LEVEL1, "L%d - %s:  ASN.1 object smaller than 2 octets", 
-					level, name);
+		DBG2("L%d - %s:  ASN.1 object smaller than 2 octets", level, name);
 		return FALSE;
 	}
 	
 	if (*object->ptr != type)
 	{
-		logger->log(logger, ERROR|LEVEL1, "L%d - %s: ASN1 tag 0x%02x expected, but is 0x%02x",
-					level, name, type, *object->ptr);
+		DBG2("L%d - %s: ASN1 tag 0x%02x expected, but is 0x%02x",
+			 level, name, type, *object->ptr);
 		return FALSE;
 	}
 	
@@ -494,12 +476,12 @@ bool parse_asn1_simple_object(chunk_t *object, asn1_t type, u_int level, const c
 	
 	if (len == ASN1_INVALID_LENGTH || object->len < len)
 	{
-		logger->log(logger, ERROR|LEVEL1, "L%d - %s:  length of ASN.1 object invalid or too large",
-					level, name);
+		DBG2("L%d - %s:  length of ASN.1 object invalid or too large",
+			 level, name);
 		return FALSE;
 	}
 	
-	logger->log(logger, CONTROL|LEVEL2, "L%d - %s:", level, name);
+	DBG2("L%d - %s:", level, name);
 	debug_asn1_simple_object(*object, type);
 	return TRUE;
 }
@@ -546,18 +528,16 @@ bool is_asn1(chunk_t blob)
 {
 	u_int len;
 	u_char tag = *blob.ptr;
-	
-	asn1_init_logger();
 
 	if (tag != ASN1_SEQUENCE && tag != ASN1_SET)
 	{
-		logger->log(logger, ERROR|LEVEL2, "  file content is not binary ASN.1");
+		DBG2("  file content is not binary ASN.1");
 		return FALSE;
 	}
 	len = asn1_length(&blob);
 	if (len != blob.len)
 	{
-		logger->log(logger, ERROR|LEVEL2, "  file size does not match ASN.1 coded length");
+		DBG2("  file size does not match ASN.1 coded length");
 		return FALSE;
 	}
 	return TRUE;
@@ -708,7 +688,7 @@ chunk_t timetoasn1(const time_t *time, asn1_t type)
 {
 	int offset;
 	const char *format;
-	char buf[TIMETOA_BUF];
+	char buf[32];
 	chunk_t formatted_time;
 	struct tm *t = gmtime(time);
 	
@@ -722,8 +702,8 @@ chunk_t timetoasn1(const time_t *time, asn1_t type)
 		format = "%02d%02d%02d%02d%02d%02dZ";
 		offset = (t->tm_year < 100)? 0 : -100;
 	}
-	sprintf(buf, format, t->tm_year + offset, t->tm_mon + 1, t->tm_mday
-			, t->tm_hour, t->tm_min, t->tm_sec);
+	snprintf(buf, sizeof(buf), format, t->tm_year + offset, 
+			 t->tm_mon + 1, t->tm_mday, t->tm_hour, t->tm_min, t->tm_sec);
 	formatted_time.ptr = buf;
 	formatted_time.len = strlen(buf);
 	return asn1_simple_object(type, formatted_time);
diff --git a/src/libstrongswan/asn1/pem.c b/src/libstrongswan/asn1/pem.c
index 1cba08fbf..97683e580 100755
--- a/src/libstrongswan/asn1/pem.c
+++ b/src/libstrongswan/asn1/pem.c
@@ -20,28 +20,18 @@
 #include <stddef.h>
 #include <sys/types.h>
 
-#include "asn1.h"
 #include "pem.h"
-#include "ttodata.h"
+
+#include <library.h>
+#include <asn1/asn1.h>
+#include <asn1/ttodata.h>
 
 #include <utils/lexparser.h>
-#include <utils/logger_manager.h>
 #include <crypto/hashers/hasher.h>
 #include <crypto/crypters/crypter.h>
 
 #define PKCS5_SALT_LEN	8	/* bytes */
 
-static logger_t *logger = NULL;
-
-/**
- * initializes the PEM logger
- */
-static void pem_init_logger(void)
-{
-	if (logger == NULL)
-		logger = logger_manager->get_logger(logger_manager, ASN1);
-}
-
 /**
  * check the presence of a pattern in a character string
  */
@@ -79,8 +69,7 @@ static bool find_boundary(const char* tag, chunk_t *line)
 	{
 		if (present("-----", line))
 		{
-			logger->log(logger, CONTROL|LEVEL2,
-		 		"  -----%s %.*s-----", tag, (int)name.len, name.ptr);
+			DBG2("  -----%s %.*s-----", tag, (int)name.len, name.ptr);
 			return TRUE;
 		}
 		line->ptr++;  line->len--;  name.len++;
@@ -185,8 +174,6 @@ err_t pem_to_bin(chunk_t *blob, chunk_t *passphrase, bool *pgp)
 	iv.ptr = iv_buf;
 	iv.len = 0;
 
-	pem_init_logger();
-
 	while (fetchline(&src, &line))
 	{
 		if (state == PEM_PRE)
@@ -222,7 +209,7 @@ err_t pem_to_bin(chunk_t *blob, chunk_t *passphrase, bool *pgp)
 				}
 
 				/* we are looking for a parameter: value pair */
-				logger->log(logger, CONTROL|LEVEL2, "  %.*s", (int)line.len, line.ptr);
+				DBG2("  %.*s", (int)line.len, line.ptr);
 				ugh = extract_parameter_value(&name, &value, &line);
 				if (ugh != NULL)
 					continue;
@@ -289,8 +276,7 @@ err_t pem_to_bin(chunk_t *blob, chunk_t *passphrase, bool *pgp)
 					*pgp = TRUE;
 					data.ptr++;
 					data.len--;
-					logger->log(logger, CONTROL|LEVEL2, "  Armor checksum: %.*s",
-								(int)data.len, data.ptr);
+					DBG2("  Armor checksum: %.*s", (int)data.len, data.ptr);
 		    		continue;
 				}
 
@@ -327,8 +313,6 @@ bool pem_asn1_load_file(const char *filename, chunk_t *passphrase,
 
 	FILE *fd = fopen(filename, "r");
 
-	pem_init_logger();
-
 	if (fd)
 	{
 		int bytes;
@@ -338,19 +322,19 @@ bool pem_asn1_load_file(const char *filename, chunk_t *passphrase,
 		blob->ptr = malloc(blob->len);
 		bytes = fread(blob->ptr, 1, blob->len, fd);
 		fclose(fd);
-		logger->log(logger, CONTROL, "  loading %s file '%s' (%d bytes)", type, filename, bytes);
+		DBG1("  loading %s file '%s' (%d bytes)", type, filename, bytes);
 
 		*pgp = FALSE;
 
 		/* try DER format */
 		if (is_asn1(*blob))
 		{
-			logger->log(logger, CONTROL|LEVEL1, "  file coded in DER format");
+			DBG2("  file coded in DER format");
 			return TRUE;
 		}
 
 		if (passphrase != NULL)
-			logger->log_bytes(logger, PRIVATE, "  passphrase:", passphrase->ptr, passphrase->len);
+			DBG4("  passphrase:", passphrase->ptr, passphrase->len);
 
 		/* try PEM format */
 		ugh = pem_to_bin(blob, passphrase, pgp);
@@ -359,24 +343,24 @@ bool pem_asn1_load_file(const char *filename, chunk_t *passphrase,
 		{
 			if (*pgp)
 			{
-				logger->log(logger, CONTROL|LEVEL1, "  file coded in armored PGP format");
+				DBG2("  file coded in armored PGP format");
 				return TRUE;
 			}
 			if (is_asn1(*blob))
 			{
-				logger->log(logger, CONTROL|LEVEL1, "  file coded in PEM format");
+				DBG2("  file coded in PEM format");
 				return TRUE;
 			}
 			ugh = "file coded in unknown format, discarded";
 		}
 
 		/* a conversion error has occured */
-		logger->log(logger, ERROR, "  %s", ugh);
+		DBG1("  %s", ugh);
 		chunk_free(blob);
 	}
 	else
 	{
-		logger->log(logger, ERROR, "  could not open %s file '%s'", type, filename);
+		DBG1("  could not open %s file '%s'", type, filename);
 	}
 	return FALSE;
 }
diff --git a/src/libstrongswan/crypto/certinfo.c b/src/libstrongswan/crypto/certinfo.c
index a289d6562..20a695753 100644
--- a/src/libstrongswan/crypto/certinfo.c
+++ b/src/libstrongswan/crypto/certinfo.c
@@ -69,24 +69,15 @@ struct private_certinfo_t {
     crl_reason_t revocationReason;
 };
 
-/**
- * RFC 2560 OCSP - certificate status
- */
-static const char *const cert_status_name[] = {
+ENUM(cert_status_names, CERT_GOOD, CERT_UNTRUSTED,
 	"good",
 	"revoked",
 	"unknown",
 	"unknown",
-	"untrusted"
-    };
-
-enum_names cert_status_names =
-    { CERT_GOOD, CERT_UNTRUSTED, cert_status_name, NULL};
+	"untrusted",
+);
 
-/**
- * RFC 2459 CRL reason codes
- */
-static const char *const crl_reason_name[] = {
+ENUM(crl_reason_names, REASON_UNSPECIFIED, REASON_REMOVE_FROM_CRL,
 	"unspecified",
 	"key compromise",
 	"ca compromise",
@@ -95,11 +86,8 @@ static const char *const crl_reason_name[] = {
 	"cessation of operation",
 	"certificate hold",
 	"reason #7",
-	"remove from crl"
-    };
-
-enum_names crl_reason_names =
-    { REASON_UNSPECIFIED, REASON_REMOVE_FROM_CRL, crl_reason_name, NULL};
+	"remove from crl",
+);
 
 /**
  * Implements certinfo_t.get_serialNumber
@@ -168,9 +156,9 @@ static void set_revocationReason(private_certinfo_t *this, crl_reason_t reason)
 /**
  * Implements certinfo_t.get_revocationReason
  */
-static const char *get_revocationReason(const private_certinfo_t *this)
+static crl_reason_t get_revocationReason(const private_certinfo_t *this)
 {
-	return enum_name(&crl_reason_names, this->revocationReason);
+	return this->revocationReason;
 }
 
 /**
@@ -205,7 +193,7 @@ certinfo_t *certinfo_create(chunk_t serial)
 	this->public.set_revocationTime = (void (*) (certinfo_t*,time_t))set_revocationTime;
 	this->public.get_revocationTime = (time_t (*) (const certinfo_t*))get_revocationTime;
 	this->public.set_revocationReason = (void (*) (certinfo_t*, crl_reason_t))set_revocationReason;
-	this->public.get_revocationReason = (const char *(*) (const certinfo_t*))get_revocationReason;
+	this->public.get_revocationReason = (crl_reason_t(*) (const certinfo_t*))get_revocationReason;
 	this->public.destroy = (void (*) (certinfo_t*))destroy;
 
 	return &this->public;
diff --git a/src/libstrongswan/crypto/certinfo.h b/src/libstrongswan/crypto/certinfo.h
index 45090eafc..6561462a7 100644
--- a/src/libstrongswan/crypto/certinfo.h
+++ b/src/libstrongswan/crypto/certinfo.h
@@ -29,8 +29,6 @@
 /**
  * RFC 2560 OCSP - certificate status
  */
-extern enum_names cert_status_names;
-
 typedef enum {
 	CERT_GOOD = 		0,
 	CERT_REVOKED = 		1,
@@ -39,12 +37,11 @@ typedef enum {
 	CERT_UNTRUSTED =	4  /* private use */
 } cert_status_t;
 
+extern enum_name_t *cert_status_names;
+
 /**
  * RFC 2459 CRL reason codes
  */
-
-extern enum_names crl_reason_names;
-
 typedef enum {
     REASON_UNSPECIFIED =			0,
     REASON_KEY_COMPROMISE = 		1,
@@ -56,6 +53,8 @@ typedef enum {
     REASON_REMOVE_FROM_CRL =		8
 } crl_reason_t;
 
+extern enum_name_t *crl_reason_names;
+
 typedef struct certinfo_t certinfo_t;
 
 /**
@@ -67,85 +66,76 @@ typedef struct certinfo_t certinfo_t;
 struct certinfo_t {
 
 	/**
-	 * @brief Get serial number
-	 * 
-	 * 
+	 * @brief Get serial number.
+	 *
 	 * @param this				calling object
 	 * @return					serialNumber
 	 */
 	chunk_t (*get_serialNumber) (const certinfo_t *this);
 
 	/**
-	 * @brief Set certificate status
-	 * 
-	 * 
+	 * @brief Set certificate status.
+	 *
 	 * @param this				calling object
 	 * @param status			status
 	 */
 	void (*set_status) (certinfo_t *this, cert_status_t status);
 
 	/**
-	 * @brief Get certificate status
-	 * 
-	 * 
+	 * @brief Get certificate status.
+	 *
 	 * @param this				calling object
 	 * @return					status
 	 */
 	cert_status_t (*get_status) (const certinfo_t *this);
 
 	/**
-	 * @brief Set nextUpdate
-	 * 
-	 * 
+	 * @brief Set nextUpdate.
+	 *
 	 * @param this				calling object
 	 * @return					nextUpdate
 	 */
 	void (*set_nextUpdate) (certinfo_t *this, time_t nextUpdate);
 
 	/**
-	 * @brief Get nextUpdate
-	 * 
-	 * 
+	 * @brief Get nextUpdate.
+	 *
 	 * @param this				calling object
 	 * @return					nextUpdate
 	 */
 	time_t (*get_nextUpdate) (const certinfo_t *this);
 
 	/**
-	 * @brief Set revocationTime
-	 * 
-	 * 
+	 * @brief Set revocationTime.
+	 *
 	 * @param this				calling object
 	 * @param revocationTime	revocationTime
 	 */
 	void (*set_revocationTime) (certinfo_t *this, time_t revocationTime);
 
 	/**
-	 * @brief Get revocationTime
-	 * 
-	 * 
+	 * @brief Get revocationTime.
+	 *
 	 * @param this				calling object
 	 * @return					revocationTime
 	 */
 	time_t (*get_revocationTime) (const certinfo_t *this);
 
 	/**
-	 * @brief Set revocationReason
-	 * 
-	 * 
+	 * @brief Set revocationReason.
+	 *
 	 * @param this				calling object
 	 * @param reason			revocationReason
 	 */
 	void (*set_revocationReason) (certinfo_t *this, crl_reason_t reason);
 
 	/**
-	 * @brief Get revocationReason
-	 * 
-	 * 
+	 * @brief Get revocationReason.
+	 *
 	 * @param this				calling object
 	 * @return					revocationReason
 	 */
-	const char *(*get_revocationReason) (const certinfo_t *this);
+	crl_reason_t (*get_revocationReason) (const certinfo_t *this);
 
 	/**
 	 * @brief Destroys the certinfo_t object.
diff --git a/src/libstrongswan/crypto/crl.c b/src/libstrongswan/crypto/crl.c
index 1f41c0a76..b2c24b80b 100755
--- a/src/libstrongswan/crypto/crl.c
+++ b/src/libstrongswan/crypto/crl.c
@@ -23,13 +23,14 @@
 #include <sys/stat.h>
 #include <unistd.h>
 #include <string.h>
+#include <printf.h>
 
 #include <types.h>
+#include <library.h>
 #include <definitions.h>
 #include <asn1/oid.h>
 #include <asn1/asn1.h>
 #include <asn1/pem.h>
-#include <utils/logger_manager.h>
 #include <utils/linked_list.h>
 #include <utils/identification.h>
 
@@ -39,7 +40,6 @@
 
 #define CRL_WARNING_INTERVAL	7	/* days */
 
-static logger_t *logger;
 extern char* check_expiry(time_t expiration_date, int warning_interval, bool strict);
 extern time_t parse_time(chunk_t blob, int level0);
 extern void parse_authorityKeyIdentifier(chunk_t blob, int level0 , chunk_t *authKeyID, chunk_t *authKeySerialNumber);
@@ -206,9 +206,9 @@ static crl_reason_t parse_crl_reasonCode(chunk_t object)
 	{
 		reason = *object.ptr;
 	}
-	logger->log(logger, CONTROL|LEVEL2, "  '%s'", enum_name(&crl_reason_names, reason));
+	DBG2("  '%N'", crl_reason_names, reason);
 
-    return reason;
+	return reason;
 }
 
 /**
@@ -219,7 +219,7 @@ bool parse_x509crl(chunk_t blob, u_int level0, private_crl_t *crl)
 	asn1_ctx_t ctx;
 	bool critical;
 	chunk_t extnID;
-	chunk_t userCertificate;
+	chunk_t userCertificate = CHUNK_INITIALIZER;
 	revokedCert_t *revokedCert = NULL;
 	chunk_t object;
 	u_int level;
@@ -245,14 +245,14 @@ bool parse_x509crl(chunk_t blob, u_int level0, private_crl_t *crl)
 				break;
 			case CRL_OBJ_VERSION:
 				crl->version = (object.len) ? (1+(u_int)*object.ptr) : 1;
-				logger->log(logger, CONTROL|LEVEL2, "  v%d", crl->version);
+				DBG2("  v%d", crl->version);
 				break;
 			case CRL_OBJ_SIG_ALG:
 				crl->sigAlg = parse_algorithmIdentifier(object, level, NULL);
 				break;
 			case CRL_OBJ_ISSUER:
 				crl->issuer = identification_create_from_encoding(ID_DER_ASN1_DN, object);
-				logger->log(logger, CONTROL|LEVEL1, "  '%D'", crl->issuer);
+				DBG2("  '%D'", crl->issuer);
 				break;
 			case CRL_OBJ_THIS_UPDATE:
 				crl->thisUpdate = parse_time(object, level);
@@ -277,7 +277,7 @@ bool parse_x509crl(chunk_t blob, u_int level0, private_crl_t *crl)
 			case CRL_OBJ_CRL_ENTRY_CRITICAL:
 			case CRL_OBJ_CRITICAL:
 				critical = object.len && *object.ptr;
-				logger->log(logger, CONTROL|LEVEL2, "  %s",(critical)?"TRUE":"FALSE");
+				DBG2("  %s",(critical)?"TRUE":"FALSE");
 				break;
 			case CRL_OBJ_CRL_ENTRY_EXTN_VALUE:
 			case CRL_OBJ_EXTN_VALUE:
@@ -314,25 +314,22 @@ bool parse_x509crl(chunk_t blob, u_int level0, private_crl_t *crl)
  */
 static err_t is_valid(const private_crl_t *this, time_t *until, bool strict)
 {
-	char buf[TIMETOA_BUF];
-
 	time_t current_time = time(NULL);
 	
-	timetoa(buf, BUF_LEN, &this->thisUpdate, TRUE);
-	logger->log(logger, CONTROL|LEVEL1, "  this update : %s", buf);
-	timetoa(buf, BUF_LEN, &current_time, TRUE);
-	logger->log(logger, CONTROL|LEVEL1, "  current time: %s", buf);
-	timetoa(buf, BUF_LEN, &this->nextUpdate, TRUE);
-	logger->log(logger, CONTROL|LEVEL1, "  next update:  %s", buf);
-
-	if (strict && until != NULL
-	&& (*until == UNDEFINED_TIME || this->nextUpdate < *until)) 
+	DBG2("  this update : %T", this->thisUpdate);
+	DBG2("  current time: %T", current_time);
+	DBG2("  next update:  %T", this->nextUpdate);
+
+	if (strict && until != NULL && 
+		(*until == UNDEFINED_TIME || this->nextUpdate < *until))
 	{
 		*until = this->nextUpdate;
 	}
 	if (current_time > this->nextUpdate)
+	{
 		return "has expired";
-	logger->log(logger, CONTROL|LEVEL1, "  crl is valid", buf);
+	}
+	DBG2("  crl is valid");
 	return NULL;
 }
 
@@ -437,38 +434,88 @@ static void destroy(private_crl_t *this)
 }
 
 /**
- * log crl
+ * output handler in printf()
  */
-static void log_crl(const private_crl_t *this, logger_t *logger, bool utc, bool strict)
+static int print(FILE *stream, const struct printf_info *info,
+				 const void *const *args)
 {
-	identification_t *issuer = this->issuer;
-	linked_list_t *revokedCertificates   = this->revokedCertificates;
-
-	char buf[BUF_LEN];
-
-	timetoa(buf, BUF_LEN, &this->installed, utc);
-	logger->log(logger, CONTROL, "%s, revoked certs: %d",
-			buf, revokedCertificates->get_count(revokedCertificates));
-
-	logger->log(logger, CONTROL, "       issuer:  '%D'", issuer);
+	private_crl_t *this = *((private_crl_t**)(args[0]));
+	bool utc = TRUE;
+	int written = 0;
+	time_t now;
 	
-	timetoa(buf, BUF_LEN, &this->thisUpdate, utc);
-	logger->log(logger, CONTROL, "       updates:  this %s", buf);
+	if (info->alt)
+	{
+		utc = *((bool*)(args[1]));
+	}
 	
-	timetoa(buf, BUF_LEN, &this->nextUpdate, utc);
-	logger->log(logger, CONTROL, "                 next %s %s", buf,
-			check_expiry(this->nextUpdate, CRL_WARNING_INTERVAL, strict));
+	if (this == NULL)
+	{
+		return fprintf(stream, "(null)");
+	}
+	
+	now = time(NULL);
+	
+	written += fprintf(stream, "  issuer:    %D\n", this->issuer);
+	written += fprintf(stream, "  installed: %#T, revoked certs: %d\n", this->installed, utc,
+					   this->revokedCertificates->get_count(this->revokedCertificates));
+	written += fprintf(stream, "  updates:   this %#T\n", this->thisUpdate, utc);
+	written += fprintf(stream, "             next %#T ");
+	if (this->nextUpdate == UNDEFINED_TIME)
+	{
+		written += fprintf(stream, "ok (expires never)");
+	}
+	else if (now > this->nextUpdate)
+	{
+		written += fprintf(stream, "expired (since %V)", now, this->nextUpdate);
+	}
+	else if (now > this->nextUpdate - CRL_WARNING_INTERVAL * 60 * 60 * 24)
+	{
+		written += fprintf(stream, "ok (expires in %V)", now, this->nextUpdate);
+	}
+	else
+	{
+		written += fprintf(stream, "ok");
+	}
+	if (this->authKeyID.ptr)
+	{
+		written += fprintf(stream, "\n  authkey:   %#B", &this->authKeyID);
+	}
+	if (this->authKeySerialNumber.ptr)
+	{
+		written += fprintf(stream, "\n  aserial:   %#B", &this->authKeySerialNumber);
+	}
+	return written;
+}
 
-	if (this->authKeyID.ptr != NULL)
+/**
+ * arginfo handler in printf()
+ */
+static int print_arginfo(const struct printf_info *info, size_t n, int *argtypes)
+{
+	if (info->alt)
 	{
-		chunk_to_hex(buf, BUF_LEN, this->authKeyID);
-		logger->log(logger, CONTROL, "       authkey:  %s", buf);
+		if (n > 1)
+		{
+			argtypes[0] = PA_INT;
+			argtypes[1] = PA_INT;
+		}
+		return 2;
 	}
-	if (this->authKeySerialNumber.ptr != NULL)
+	
+	if (n > 0)
 	{
-		chunk_to_hex(buf, BUF_LEN, this->authKeySerialNumber);
-		logger->log(logger, CONTROL, "       aserial:  %s", buf);
+		argtypes[0] = PA_INT;
 	}
+	return 1;
+}
+
+/**
+ * register printf() handlers
+ */
+static void __attribute__ ((constructor))print_register()
+{
+	register_printf_function(CRL_PRINTF_SPEC, print, print_arginfo);
 }
 
 /*
@@ -494,11 +541,7 @@ crl_t *crl_create_from_chunk(chunk_t chunk)
 	this->public.is_newer = (bool (*) (const crl_t*,const crl_t*))is_newer;
 	this->public.verify = (bool (*) (const crl_t*,const rsa_public_key_t*))verify;
 	this->public.get_status = (void (*) (const crl_t*,certinfo_t*))get_status;
-	this->public.log_crl = (void (*) (const crl_t*,logger_t*,bool,bool))log_crl;
 	this->public.destroy = (void (*) (crl_t*))destroy;
-
-	/* we do not use a per-instance logger right now, since its not always accessible */
-	logger = logger_manager->get_logger(logger_manager, ASN1);
 	
 	if (!parse_x509crl(chunk, 0, this))
 	{
diff --git a/src/libstrongswan/crypto/crl.h b/src/libstrongswan/crypto/crl.h
index e4739fc29..ee9292818 100755
--- a/src/libstrongswan/crypto/crl.h
+++ b/src/libstrongswan/crypto/crl.h
@@ -29,7 +29,13 @@
 #include <crypto/certinfo.h>
 #include <utils/identification.h>
 #include <utils/iterator.h>
-#include <utils/logger.h>
+
+/**
+ * printf specifier for printing crls. When using the
+ * #-modifier, an additional bool argument defines if times
+ * are printed in UTC.
+ */
+#define CRL_PRINTF_SPEC 'U'
 
 typedef struct crl_t crl_t;
 
@@ -115,16 +121,6 @@ struct crl_t {
 	 * @param this			crl to destroy
 	 */
 	void (*destroy) (crl_t *this);
-
-	/**
-	 * @brief Log x509 crl info.
-	 *
-	 * @param this			crl to log
-	 * @param logger		logger to be used
-	 * @param utc			log dates either in UTC or local time
-	 * @param strict		expiry of nextUpdate is fatal with strict == TRUE
-	 */
-	 void (*log_crl) (const crl_t *this, logger_t *logger, bool utc, bool strict);
 };
 
 /**
diff --git a/src/libstrongswan/crypto/crypters/crypter.c b/src/libstrongswan/crypto/crypters/crypter.c
index 145138d49..7f62741a7 100644
--- a/src/libstrongswan/crypto/crypters/crypter.c
+++ b/src/libstrongswan/crypto/crypters/crypter.c
@@ -28,27 +28,25 @@
 #include <crypto/crypters/des_crypter.h>
 
 
-/** 
- * String mappings for encryption_algorithm_t.
- */
-mapping_t encryption_algorithm_m[] = {
-	{ENCR_UNDEFINED, "UNDEFINED"},
-	{ENCR_DES_IV64, "DES_IV64"},
-	{ENCR_DES, "DES"},
-	{ENCR_3DES, "3DES"},
-	{ENCR_RC5, "RC5"},
-	{ENCR_IDEA, "IDEA"},
-	{ENCR_CAST, "CAST"},
-	{ENCR_BLOWFISH, "BLOWFISH"},
-	{ENCR_3IDEA, "3IDEA"},
-	{ENCR_DES_IV32, "DES_IV32"},
-	{ENCR_NULL, "NULL"},
-	{ENCR_AES_CBC, "AES_CBC"},
-	{ENCR_AES_CTR, "AES_CTR"},
-	{MAPPING_END, NULL}
-};
+ENUM_BEGIN(encryption_algorithm_names, ENCR_UNDEFINED, ENCR_UNDEFINED,
+	"UNDEFINED");
+ENUM_NEXT(encryption_algorithm_names, ENCR_DES_IV64, ENCR_DES_IV32, ENCR_UNDEFINED,
+	"DES_IV64",
+	"DES",
+	"3DES",
+	"RC5",
+	"IDEA",
+	"CAST",
+	"BLOWFISH",
+	"3IDEA",
+	"DES_IV32");
+ENUM_NEXT(encryption_algorithm_names, ENCR_NULL, ENCR_AES_CTR, ENCR_DES_IV32,
+	"NULL",
+	"AES_CBC",
+	"AES_CTR");
+ENUM_END(encryption_algorithm_names, ENCR_AES_CTR);
 
-/* 
+/*
  * Described in header.
  */
 crypter_t *crypter_create(encryption_algorithm_t encryption_algorithm, size_t key_size)
diff --git a/src/libstrongswan/crypto/crypters/crypter.h b/src/libstrongswan/crypto/crypters/crypter.h
index ea14157f9..cb7f9b139 100644
--- a/src/libstrongswan/crypto/crypters/crypter.h
+++ b/src/libstrongswan/crypto/crypters/crypter.h
@@ -57,10 +57,10 @@ enum encryption_algorithm_t {
 	ENCR_AES_CTR = 13
 };
 
-/** 
- * String mappings for encryption_algorithm_t.
+/**
+ * enum name for encryption_algorithm_t.
  */
-extern mapping_t encryption_algorithm_m[];
+extern enum_name_t *encryption_algorithm_names;
 
 
 typedef struct crypter_t crypter_t;
diff --git a/src/libstrongswan/crypto/diffie_hellman.c b/src/libstrongswan/crypto/diffie_hellman.c
index fdb508ee9..e4062066c 100644
--- a/src/libstrongswan/crypto/diffie_hellman.c
+++ b/src/libstrongswan/crypto/diffie_hellman.c
@@ -23,29 +23,26 @@
  * for more details.
  */
 
-#include <gmp.h> 
-#include <stdio.h> 
+#include <gmp.h>
+#include <stdio.h>
 
 #include "diffie_hellman.h"
 
 #include <utils/randomizer.h>
 
-
-/** 
- * String mappings for diffie_hellman_group_t.
- */
-mapping_t diffie_hellman_group_m[] = {
-	{MODP_NONE, "MODP_NONE"},
-	{MODP_768_BIT, "MODP_768_BIT"},
-	{MODP_1024_BIT, "MODP_1024_BIT"},
-	{MODP_1536_BIT, "MODP_1536_BIT"},
-	{MODP_2048_BIT, "MODP_2048_BIT"},
-	{MODP_3072_BIT, "MODP_3072_BIT"},
-	{MODP_4096_BIT, "MODP_4096_BIT"},
-	{MODP_6144_BIT, "MODP_6144_BIT"},
-	{MODP_8192_BIT, "MODP_8192_BIT"},
-	{MAPPING_END, NULL}
-};
+ENUM_BEGIN(diffie_hellman_group_names, MODP_NONE, MODP_1024_BIT,
+	"MODP_NONE",
+	"MODP_768_BIT",
+	"MODP_1024_BIT");
+ENUM_NEXT(diffie_hellman_group_names, MODP_1536_BIT, MODP_1536_BIT, MODP_1024_BIT,
+	"MODP_1536_BIT");
+ENUM_NEXT(diffie_hellman_group_names, MODP_2048_BIT, MODP_8192_BIT, MODP_1536_BIT,
+	"MODP_2048_BIT",
+	"MODP_3072_BIT",
+	"MODP_4096_BIT",
+	"MODP_6144_BIT",
+	"MODP_8192_BIT");
+ENUM_END(diffie_hellman_group_names, MODP_8192_BIT);
 
 
 /**
diff --git a/src/libstrongswan/crypto/diffie_hellman.h b/src/libstrongswan/crypto/diffie_hellman.h
index 8edf9e40a..4659c7fee 100644
--- a/src/libstrongswan/crypto/diffie_hellman.h
+++ b/src/libstrongswan/crypto/diffie_hellman.h
@@ -50,10 +50,10 @@ enum diffie_hellman_group_t {
 	MODP_8192_BIT = 18
 };
 
-/** 
- * String mappings for diffie_hellman_group_t.
+/**
+ * enum name for diffie_hellman_group_t.
  */
-extern mapping_t diffie_hellman_group_m[];
+extern enum_name_t *diffie_hellman_group_names;
 
 
 typedef struct diffie_hellman_t diffie_hellman_t;
diff --git a/src/libstrongswan/crypto/hashers/hasher.c b/src/libstrongswan/crypto/hashers/hasher.c
index 444486f9f..7fa6346d6 100644
--- a/src/libstrongswan/crypto/hashers/hasher.c
+++ b/src/libstrongswan/crypto/hashers/hasher.c
@@ -28,18 +28,15 @@
 #include <crypto/hashers/sha2_hasher.h>
 #include <crypto/hashers/md5_hasher.h>
 
-/**
- * String mappings for hash_algorithm_t.
- */
-mapping_t hash_algorithm_m[] = {
-	{HASH_MD2,"HASH_MD2"},
-	{HASH_MD5,"HASH_MD5"},
-	{HASH_SHA1,"HASH_SHA1"},
-	{HASH_SHA256,"HASH_SHA256"},
-	{HASH_SHA384,"HASH_SHA384"},
-	{HASH_SHA512,"HASH_SHA512"},
-	{MAPPING_END, NULL}
-};
+
+ENUM(hash_algorithm_names, HASH_MD2, HASH_SHA512,
+	"HASH_MD2",
+	"HASH_MD5",
+	"HASH_SHA1",
+	"HASH_SHA256",
+	"HASH_SHA384",
+	"HASH_SHA512"
+);
 
 /*
  * Described in header.
diff --git a/src/libstrongswan/crypto/hashers/hasher.h b/src/libstrongswan/crypto/hashers/hasher.h
index ccc8d3eca..ed3defb05 100644
--- a/src/libstrongswan/crypto/hashers/hasher.h
+++ b/src/libstrongswan/crypto/hashers/hasher.h
@@ -43,17 +43,17 @@ typedef enum hash_algorithm_t hash_algorithm_t;
  * @ingroup hashers
  */
 enum hash_algorithm_t {
-	HASH_MD2,
+	HASH_MD2 = 0,
 	/** Implemented in class md5_hasher_t */
-	HASH_MD5,
+	HASH_MD5 = 1,
 	/** Implemented in class sha1_hasher_t */
-	HASH_SHA1,
+	HASH_SHA1 = 2,
 	/** Implemented in class sha2_hasher_t */
-	HASH_SHA256,
+	HASH_SHA256 = 3,
 	/** Implemented in class sha2_hasher_t */
-	HASH_SHA384,
+	HASH_SHA384 = 4,
 	/** Implemented in class sha2_hasher_t */
-	HASH_SHA512,
+	HASH_SHA512 = 5,
 };
 
 #define HASH_SIZE_MD2		16
@@ -65,9 +65,9 @@ enum hash_algorithm_t {
 #define HASH_SIZE_MAX		64
 
 /**
- * String mappings for hash_algorithm_t.
+ * enum names for hash_algorithm_t.
  */
-extern mapping_t hash_algorithm_m[];
+extern enum_name_t *hash_algorithm_names;
 
 
 typedef struct hasher_t hasher_t;
diff --git a/src/libstrongswan/crypto/prfs/prf.c b/src/libstrongswan/crypto/prfs/prf.c
index 31b220a84..aa5d1d2b7 100644
--- a/src/libstrongswan/crypto/prfs/prf.c
+++ b/src/libstrongswan/crypto/prfs/prf.c
@@ -27,18 +27,14 @@
 #include <crypto/hashers/hasher.h>
 #include <crypto/prfs/hmac_prf.h>
 
-
-/** 
- * String mappings for encryption_algorithm_t.
- */
-mapping_t pseudo_random_function_m[] = {
-	{PRF_UNDEFINED, "PRF_UNDEFINED"},
-	{PRF_HMAC_MD5, "PRF_HMAC_MD5"},
-	{PRF_HMAC_SHA1, "PRF_HMAC_SHA1"},
-	{PRF_HMAC_TIGER, "PRF_HMAC_TIGER"},
-	{PRF_AES128_CBC, "PRF_AES128_CBC"},
-	{MAPPING_END, NULL}
-};
+ENUM_BEGIN(pseudo_random_function_names, PRF_UNDEFINED, PRF_UNDEFINED,
+	"PRF_UNDEFINED");
+ENUM_NEXT(pseudo_random_function_names, PRF_HMAC_MD5, PRF_AES128_CBC, PRF_UNDEFINED,
+	"PRF_HMAC_MD5",
+	"PRF_HMAC_SHA1",
+	"PRF_HMAC_TIGER",
+	"PRF_AES128_CBC");
+ENUM_END(pseudo_random_function_names, PRF_AES128_CBC);
 
 /*
  * Described in header.
diff --git a/src/libstrongswan/crypto/prfs/prf.h b/src/libstrongswan/crypto/prfs/prf.h
index 2d30cc22e..0a0e0fa5c 100644
--- a/src/libstrongswan/crypto/prfs/prf.h
+++ b/src/libstrongswan/crypto/prfs/prf.h
@@ -47,10 +47,10 @@ enum pseudo_random_function_t {
 	PRF_AES128_CBC = 4,
 };
 
-/** 
- * String mappings for encryption_algorithm_t.
+/**
+ * enum name for encryption_algorithm_t.
  */
-extern mapping_t pseudo_random_function_m[];
+extern enum_name_t *pseudo_random_function_names;
 
 
 typedef struct prf_t prf_t;
diff --git a/src/libstrongswan/crypto/signers/signer.c b/src/libstrongswan/crypto/signers/signer.c
index 67fbbd69a..d6037c545 100644
--- a/src/libstrongswan/crypto/signers/signer.c
+++ b/src/libstrongswan/crypto/signers/signer.c
@@ -25,19 +25,15 @@
 
 #include <crypto/signers/hmac_signer.h>
 
-/** 
- * String mappings for integrity_algorithm_t.
- */
-mapping_t integrity_algorithm_m[] = {
-	{AUTH_UNDEFINED, "UNDEFINED"},
-	{AUTH_HMAC_MD5_96, "HMAC_MD5_96"},
-	{AUTH_HMAC_SHA1_96, "HMAC_SHA1_96"},
-	{AUTH_DES_MAC, "DES_MAC"},
-	{AUTH_KPDK_MD5, "KPDK_MD5"},
-	{AUTH_AES_XCBC_96, "AES_XCBC_96"},
-	{MAPPING_END, NULL}
-};
-
+ENUM_BEGIN(integrity_algorithm_names, AUTH_UNDEFINED, AUTH_UNDEFINED,
+	"UNDEFINED");
+ENUM_NEXT(integrity_algorithm_names, AUTH_HMAC_MD5_96, AUTH_AES_XCBC_96, AUTH_UNDEFINED,
+	"HMAC_MD5_96",
+	"HMAC_SHA1_96",
+	"DES_MAC",
+	"KPDK_MD5",
+	"AES_XCBC_96");
+ENUM_END(integrity_algorithm_names, AUTH_AES_XCBC_96);
 
 /*
  * Described in header.
diff --git a/src/libstrongswan/crypto/signers/signer.h b/src/libstrongswan/crypto/signers/signer.h
index 585183998..b7c7af55d 100644
--- a/src/libstrongswan/crypto/signers/signer.h
+++ b/src/libstrongswan/crypto/signers/signer.h
@@ -49,10 +49,10 @@ enum integrity_algorithm_t {
 	AUTH_AES_XCBC_96 = 5
 };
 
-/** 
- * String mappings for integrity_algorithm_t.
+/**
+ * enum names for integrity_algorithm_t.
  */
-extern mapping_t integrity_algorithm_m[];
+extern enum_name_t *integrity_algorithm_names;
 
 
 typedef struct signer_t signer_t;
diff --git a/src/libstrongswan/crypto/x509.c b/src/libstrongswan/crypto/x509.c
index dd82a493c..4c5e014c8 100755
--- a/src/libstrongswan/crypto/x509.c
+++ b/src/libstrongswan/crypto/x509.c
@@ -24,22 +24,21 @@
 #include <sys/stat.h>
 #include <unistd.h>
 #include <string.h>
+#include <printf.h>
 
 #include "x509.h"
 
 #include <types.h>
+#include <library.h>
 #include <definitions.h>
 #include <asn1/oid.h>
 #include <asn1/asn1.h>
 #include <asn1/pem.h>
-#include <utils/logger_manager.h>
 #include <utils/linked_list.h>
 #include <utils/identification.h>
 
 #define CERT_WARNING_INTERVAL	30	/* days */
 
-static logger_t *logger;
-
 /**
  * Different kinds of generalNames
  */
@@ -422,7 +421,7 @@ static bool parse_basicConstraints(chunk_t blob, int level0)
 		if (objectID == BASIC_CONSTRAINTS_CA)
 		{
 			isCA = object.len && *object.ptr;
-			logger->log(logger, CONTROL|LEVEL2, "  %s", isCA ? "TRUE" : "FALSE");
+			DBG2("  %s", isCA ? "TRUE" : "FALSE");
 		}
 		objectID++;
 	}
@@ -519,7 +518,7 @@ static identification_t *parse_generalName(chunk_t blob, int level0)
 		if (id_type != ID_ANY)
 		{
 			identification_t *gn = identification_create_from_encoding(id_type, object);
-			logger->log(logger, CONTROL|LEVEL2, "  '%D'", gn);
+			DBG2("  '%D'", gn);
 			return gn;
         }
 		objectID++;
@@ -670,7 +669,7 @@ static void parse_authorityInfoAccess(chunk_t blob, int level0, chunk_t *accessL
 						{
 							if (asn1_length(&object) == ASN1_INVALID_LENGTH)
 								return;
-							logger->log(logger, CONTROL|LEVEL2, "  '%.*s'",(int)object.len, object.ptr);
+							DBG2("  '%.*s'",(int)object.len, object.ptr);
 							/* only HTTP(S) URIs accepted */
 							if (strncasecmp(object.ptr, "http", 4) == 0)
 							{
@@ -678,7 +677,7 @@ static void parse_authorityInfoAccess(chunk_t blob, int level0, chunk_t *accessL
 								return;
 							}
 						}
-						logger->log(logger, ERROR|LEVEL2, "ignoring OCSP InfoAccessLocation with unkown protocol");
+						DBG2("ignoring OCSP InfoAccessLocation with unkown protocol");
 						break;
 					default:
 						/* unkown accessMethod, ignoring */
@@ -779,7 +778,7 @@ bool parse_x509cert(chunk_t blob, u_int level0, private_x509_t *cert)
 				break;
 			case X509_OBJ_VERSION:
 				cert->version = (object.len) ? (1+(u_int)*object.ptr) : 1;
-				logger->log(logger, CONTROL|LEVEL2, "  v%d", cert->version);
+				DBG2("  v%d", cert->version);
 				break;
 			case X509_OBJ_SERIAL_NUMBER:
 				cert->serialNumber = object;
@@ -789,7 +788,7 @@ bool parse_x509cert(chunk_t blob, u_int level0, private_x509_t *cert)
 				break;
 			case X509_OBJ_ISSUER:
 				cert->issuer = identification_create_from_encoding(ID_DER_ASN1_DN, object);
-				logger->log(logger, CONTROL|LEVEL1, "  '%D'", cert->issuer);
+				DBG2("  '%D'", cert->issuer);
 				break;
 			case X509_OBJ_NOT_BEFORE:
 				cert->notBefore = parse_time(object, level);
@@ -799,12 +798,12 @@ bool parse_x509cert(chunk_t blob, u_int level0, private_x509_t *cert)
 				break;
 			case X509_OBJ_SUBJECT:
 				cert->subject = identification_create_from_encoding(ID_DER_ASN1_DN, object);
-				logger->log(logger, CONTROL|LEVEL1, "  '%D'", cert->subject);
+				DBG2("  '%D'", cert->subject);
 				break;
 			case X509_OBJ_SUBJECT_PUBLIC_KEY_ALGORITHM:
 				if (parse_algorithmIdentifier(object, level, NULL) != OID_RSA_ENCRYPTION)
 				{
-					logger->log(logger, ERROR|LEVEL1, "  unsupported public key algorithm");
+					DBG2("  unsupported public key algorithm");
 					return FALSE;
 				}
 				break;
@@ -816,7 +815,7 @@ bool parse_x509cert(chunk_t blob, u_int level0, private_x509_t *cert)
 				}
 				else
 				{
-					logger->log(logger, ERROR|LEVEL1, "  invalid RSA public key format");
+					DBG2("  invalid RSA public key format");
 					return FALSE;
 				}
 				break;
@@ -828,7 +827,7 @@ bool parse_x509cert(chunk_t blob, u_int level0, private_x509_t *cert)
 				break;
 			case X509_OBJ_CRITICAL:
 				critical = object.len && *object.ptr;
-				logger->log(logger, ERROR|LEVEL2, "  %s", critical ? "TRUE" : "FALSE");
+				DBG2("  %s", critical ? "TRUE" : "FALSE");
 				break;
 			case X509_OBJ_EXTN_VALUE:
 			{
@@ -886,27 +885,26 @@ bool parse_x509cert(chunk_t blob, u_int level0, private_x509_t *cert)
  */
 static err_t is_valid(const private_x509_t *this, time_t *until)
 {
-	char buf[TIMETOA_BUF];
-
 	time_t current_time = time(NULL);
 	
-	timetoa(buf, BUF_LEN, &this->notBefore, TRUE);
-	logger->log(logger, CONTROL|LEVEL1, "  not before  : %s", buf);
-	timetoa(buf, BUF_LEN, &current_time, TRUE);
-	logger->log(logger, CONTROL|LEVEL1, "  current time: %s", buf);
-	timetoa(buf, BUF_LEN, &this->notAfter, TRUE);
-	logger->log(logger, CONTROL|LEVEL1, "  not after   : %s", buf);
-
-	if (until != NULL
-	&& (*until == UNDEFINED_TIME || this->notAfter < *until)) 
+	DBG2("  not before  : %T", this->notBefore);
+	DBG2("  current time: %T", current_time);
+	DBG2("  not after   : %T", this->notAfter);
+
+	if (until != NULL &&
+		(*until == UNDEFINED_TIME || this->notAfter < *until))
 	{
 		*until = this->notAfter;
 	}
 	if (current_time < this->notBefore)
+	{
 		return "is not valid yet";
+	}
 	if (current_time > this->notAfter)
+	{
 		return "has expired";
-	logger->log(logger, CONTROL|LEVEL1, "  certificate is valid", buf);
+	}
+	DBG2("  certificate is valid");
 	return NULL;
 }
 
@@ -1049,153 +1047,165 @@ static bool verify(const private_x509_t *this, const rsa_public_key_t *signer)
 }
 
 /**
- * destroy
+ * output handler in printf()
  */
-static void destroy(private_x509_t *this)
+static int print(FILE *stream, const struct printf_info *info,
+				 const void *const *args)
 {
-	identification_t *id;
-	while (this->subjectAltNames->remove_last(this->subjectAltNames, (void**)&id) == SUCCESS)
+	private_x509_t *this = *((private_x509_t**)(args[0]));
+	iterator_t *iterator;
+	identification_t *san;
+	chunk_t chunk;
+	bool utc = TRUE;
+	int written = 0;
+	
+	if (info->alt)
 	{
-		id->destroy(id);
+		utc = *((bool*)(args[1]));
 	}
-	this->subjectAltNames->destroy(this->subjectAltNames);
-
-	while (this->crlDistributionPoints->remove_last(this->crlDistributionPoints, (void**)&id) == SUCCESS)
+	
+	if (this == NULL)
 	{
-		id->destroy(id);
+		return fprintf(stream, "(null)");
 	}
-	this->crlDistributionPoints->destroy(this->crlDistributionPoints);
-
-	if (this->issuer)
-		this->issuer->destroy(this->issuer);
-
-	if (this->subject)
-		this->subject->destroy(this->subject);
-
-	if (this->public_key)
-		this->public_key->destroy(this->public_key);
-
-	free(this->certificate.ptr);
-	free(this);
-}
-
-/**
- * checks if the expiration date has been reached and warns during the
-  * warning_interval of the imminent expiration.
-  * strict=TRUE declares a fatal error, strict=FALSE issues a warning upon expiry.
- */
-char* check_expiry(time_t expiration_date, int warning_interval, bool strict)
-{
-	int time_left;
+	
+	/* determine the current time */
+	time_t now = time(NULL);
 
-	if (expiration_date == UNDEFINED_TIME)
+	written += fprintf(stream, "  subject:   %D\n", this->subject);
+	if (this->subjectAltNames->get_count(this->subjectAltNames) > 0)
 	{
-		return "ok (expires never)";
+		written += fprintf(stream, "  altNames:  ");
+		iterator = this->subjectAltNames->create_iterator(this->subjectAltNames, TRUE);
+		while (iterator->iterate(iterator, (void**)&san))
+		{
+			written += fprintf(stream, "%D, ", san);
+		}
+		iterator->destroy(iterator);
+		written += fprintf(stream, "\n");
+	}
+	written += fprintf(stream, "  issuer:    '%D'\n", this->issuer);
+	written += fprintf(stream, "  serial:    '%#B'\n", &this->serialNumber);
+	written += fprintf(stream, "  installed: %#T\n", this->installed, utc);
+	
+	written += fprintf(stream, "  validity:  not before %#T, ",
+					   this->notBefore, utc);
+	if (now < this->notBefore)
+	{
+		written += fprintf(stream, "not valid yet (valid in %V)\n",
+						   now, this->notBefore);
 	}
-	time_left = (expiration_date - time(NULL));
-	if (time_left < 0)
+	else
 	{
-		return strict? "fatal (expired)" : "warning (expired)";
+		written += fprintf(stream, "ok\n");
 	}
 	
+	written += fprintf(stream, "             not after  %#T, ",
+					   this->notAfter, utc);
+	if (now > this->notAfter)
 	{
-		static char buf[35];
-		const char* unit = "second";
-
-		if (time_left > 86400*warning_interval)
-			return "ok";
-
-		if (time_left > 172800)
-		{
-			time_left /= 86400;
-			unit = "day";
-		}
-		else if (time_left > 7200)
-		{
-			time_left /= 3600;
-			unit = "hour";
-		}
-		else if (time_left > 120)
+		written += fprintf(stream, "expired (since %V)\n", now, this->notAfter);
+	}
+	else
+	{
+		written += fprintf(stream, "ok");
+		if (now > this->notAfter - CERT_WARNING_INTERVAL * 60 * 60 * 24)
 		{
-			time_left /= 60;
-			unit = "minute";
+			written += fprintf(stream, " (expires in %V)", now, this->notAfter);
 		}
-		snprintf(buf, sizeof(buf), "warning (expires in %d %s%s)", time_left, unit, (time_left == 1)?"":"s");
-		
-		/* TODO: This is not thread save and may result in corrupted strings. Rewrite this! */
-		return buf;
+		written += fprintf(stream, " \n");
 	}
-}
-
-/**
- * log certificate
- */
-static void log_certificate(const private_x509_t *this, logger_t *logger, bool utc, bool has_key)
-{
-	identification_t *subject = this->subject;
-	identification_t *issuer = this->issuer;
-	rsa_public_key_t *pubkey = this->public_key;
-
-	char buf[BUF_LEN];
-	char time_buf[TIMETOA_BUF];
-
-    /* determine the current time */
-    time_t now = time(NULL);
-
-	timetoa(time_buf, TIMETOA_BUF, &this->installed, utc);
-	logger->log(logger, CONTROL, "%s", time_buf);
-	logger->log(logger, CONTROL, "       subject: '%D'", subject);
-	logger->log(logger, CONTROL, "       issuer:  '%D'", issuer);
 	
-	chunk_to_hex(buf, BUF_LEN, this->serialNumber);
-	logger->log(logger, CONTROL, "       serial:   %s", buf);
+	chunk = this->public_key->get_keyid(this->public_key);
+	written += fprintf(stream, "  keyid:     %#B\n", &chunk);
+	if (this->subjectKeyID.ptr)
+	{
+		written += fprintf(stream, "  subjkey:   %#B\n", &this->subjectKeyID);
+	}
+	if (this->authKeyID.ptr)
+	{
+		written += fprintf(stream, "  authkey:   %#B\n", &this->authKeyID);
+	}
+	if (this->authKeySerialNumber.ptr)
+	{
+		written += fprintf(stream, "  aserial:   %#B\n", &this->authKeySerialNumber);
+	}
 	
-	timetoa(time_buf, TIMETOA_BUF, &this->notBefore, utc);
-	logger->log(logger, CONTROL, "       validity: not before %s %s", time_buf,
-				(this->notBefore < now)? "ok":"fatal (not valid yet)");
+	written += fprintf(stream, "  pubkey:    RSA %d bits", BITS_PER_BYTE *
+					   this->public_key->get_keysize(this->public_key));
+	written += fprintf(stream, ", status %N",
+					   cert_status_names, this->status);
 	
-	timetoa(time_buf, TIMETOA_BUF, &this->notAfter, utc);
-	logger->log(logger, CONTROL, "                 not after  %s %s", time_buf,
-			check_expiry(this->notAfter, CERT_WARNING_INTERVAL, TRUE));
-
-	timetoa(time_buf, TIMETOA_BUF, &this->until, utc);
 	switch (this->status)
 	{
 		case CERT_GOOD:
-			snprintf(buf, BUF_LEN, " until %s", time_buf);
+			written += fprintf(stream, " until %#T", this->until, utc);
 			break;
 		case CERT_REVOKED:
-			snprintf(buf, BUF_LEN, " on %s", time_buf);
+			written += fprintf(stream, " on %#T", this->until, utc);
 			break;
 		case CERT_UNKNOWN:
 		case CERT_UNDEFINED:
 		case CERT_UNTRUSTED:
 		default:
-			*buf = '\0';
+			break;
 	}
-	logger->log(logger, CONTROL, "       pubkey:   RSA %d bits%s, status %s%s",
-			BITS_PER_BYTE * pubkey->get_keysize(pubkey),
-			has_key? ", has private key":"",
-			enum_name(&cert_status_names, this->status), buf);
-
-	chunk_to_hex(buf, BUF_LEN, pubkey->get_keyid(pubkey));
-	logger->log(logger, CONTROL, "       keyid:    %s", buf);
+	return written;
+}
 
-	if (this->subjectKeyID.ptr != NULL)
+/**
+ * arginfo handler in printf()
+ */
+static int print_arginfo(const struct printf_info *info, size_t n, int *argtypes)
+{
+	if (info->alt)
+	{
+		if (n > 1)
+		{
+			argtypes[0] = PA_INT;
+			argtypes[1] = PA_INT;
+		}
+		return 2;
+	}
+	
+	if (n > 0)
 	{
-		chunk_to_hex(buf, BUF_LEN, this->subjectKeyID);
-		logger->log(logger, CONTROL, "       subjkey:  %s", buf);
+		argtypes[0] = PA_INT;
 	}
-	if (this->authKeyID.ptr != NULL)
+	return 1;
+}
+
+/**
+ * register printf() handlers
+ */
+static void __attribute__ ((constructor))print_register()
+{
+	register_printf_function(X509_PRINTF_SPEC, print, print_arginfo);
+}
+
+/**
+ * Implements x509_t.destroy
+ */
+static void destroy(private_x509_t *this)
+{
+	identification_t *id;
+	while (this->subjectAltNames->remove_last(this->subjectAltNames, (void**)&id) == SUCCESS)
 	{
-		chunk_to_hex(buf, BUF_LEN, this->authKeyID);
-		logger->log(logger, CONTROL, "       authkey:  %s", buf);
+		id->destroy(id);
 	}
-	if (this->authKeySerialNumber.ptr != NULL)
+	this->subjectAltNames->destroy(this->subjectAltNames);
+
+	while (this->crlDistributionPoints->remove_last(this->crlDistributionPoints, (void**)&id) == SUCCESS)
 	{
-		chunk_to_hex(buf, BUF_LEN, this->authKeySerialNumber);
-		logger->log(logger, CONTROL, "       aserial:  %s", buf);
+		id->destroy(id);
 	}
+	this->crlDistributionPoints->destroy(this->crlDistributionPoints);
+
+	DESTROY_IF(this->issuer);
+	DESTROY_IF(this->subject);
+	DESTROY_IF(this->public_key);
+	free(this->certificate.ptr);
+	free(this);
 }
 
 /*
@@ -1235,10 +1245,6 @@ x509_t *x509_create_from_chunk(chunk_t chunk)
 	this->public.get_status = (cert_status_t (*) (const x509_t*))get_status;
 	this->public.verify = (bool (*) (const x509_t*,const rsa_public_key_t*))verify;
 	this->public.destroy = (void (*) (x509_t*))destroy;
-	this->public.log_certificate = (void (*) (const x509_t*,logger_t*,bool,bool))log_certificate;
-
-	/* we do not use a per-instance logger right now, since its not always accessible */
-	logger = logger_manager->get_logger(logger_manager, ASN1);
 	
 	if (!parse_x509cert(chunk, 0, this))
 	{
diff --git a/src/libstrongswan/crypto/x509.h b/src/libstrongswan/crypto/x509.h
index 866659e3b..6c533215b 100755
--- a/src/libstrongswan/crypto/x509.h
+++ b/src/libstrongswan/crypto/x509.h
@@ -29,8 +29,13 @@
 #include <crypto/certinfo.h>
 #include <utils/identification.h>
 #include <utils/iterator.h>
-#include <utils/logger.h>
 
+/**
+ * printf specifier for printing certificates. When using the
+ * #-modifier, an additional bool argument defines if times
+ * are printed in UTC.
+ */
+#define X509_PRINTF_SPEC 'Q'
 
 typedef struct x509_t x509_t;
 
@@ -203,16 +208,6 @@ struct x509_t {
 	 * @param this			certificate to destroy
 	 */
 	void (*destroy) (x509_t *this);
-
-	/**
-	 * @brief Log x509 certificate info.
-	 *
-	 * @param this			certificate to log
-	 * @param logger		logger to be used
-	 * @param utc			log dates either in UTC or local time
-	 * @param has_key		a matching private key is available
-	 */
-	 void (*log_certificate) (const x509_t *this, logger_t *logger, bool utc, bool has_key);
 };
 
 /**
diff --git a/src/libstrongswan/definitions.c b/src/libstrongswan/definitions.c
index 04db34949..087476838 100644
--- a/src/libstrongswan/definitions.c
+++ b/src/libstrongswan/definitions.c
@@ -21,39 +21,65 @@
  * for more details.
  */
 
-#include <stdlib.h>
+#include <printf.h>
+#include <stdio.h>
 
 #include "definitions.h"
 
 /*
- * Described in header.
+ * Described in header
  */
-char *mapping_find(mapping_t * maps, int value)
+static char *enum_name(enum_name_t *e, long val)
 {
-	int i = 0;
-	while (maps[i].value != MAPPING_END)
+	do
 	{
-		if (maps[i].value == value)
+		if (val >= e->first && val <= e->last)
 		{
-			return maps[i].string;
+			return e->names[val - e->first];
 		}
-		i++;
 	}
-	return "INVALID MAPPING";
+	while ((e = e->next));
+	return NULL;
 }
 
-/*
- * Described in header
+
+/**
+ * output handler in printf() for enum names
  */
-const char *enum_name(enum_names *ed, unsigned long val)
+static int print_enum(FILE *stream, const struct printf_info *info,
+					   const void *const *args)
 {
-	enum_names	*p;
+	enum_name_t *ed = *((void**)(args[0]));
+	long val = *((size_t*)(args[1]));
+	char *name;
+	
+	name = enum_name(ed, val);
+	if (name == NULL)
+	{
+		return fprintf(stream, "(unknown enum value: %ld)", val);
+	}
+	return fprintf(stream, "%s", name);
+}
 
-	for (p = ed; p != NULL; p = p->en_next_range)
+/**
+ * arginfo handler in printf() for enum names
+ */
+static int print_enum_arginfo(const struct printf_info *info, size_t n, int *argtypes)
+{
+	if (n > 1)
 	{
-		if (p->en_first <= val && val <= p->en_last)
-	    	return p->en_names[val - p->en_first];
+		/* enum_names ptr */
+		argtypes[0] = PA_POINTER;
+		/* value */
+		argtypes[1] = PA_INT;
 	}
-	return NULL;
+	return 2;
 }
 
+/**
+ * register printf() handlers for enum names
+ */
+static void __attribute__ ((constructor))print_register()
+{
+	register_printf_function(ENUM_PRINTF_SPEC, print_enum, print_enum_arginfo);
+}
diff --git a/src/libstrongswan/definitions.h b/src/libstrongswan/definitions.h
index 102358438..b02e8092d 100644
--- a/src/libstrongswan/definitions.h
+++ b/src/libstrongswan/definitions.h
@@ -27,16 +27,12 @@
 
 #include <stddef.h>
 
-#define BITS_PER_BYTE	8
-#define RSA_MIN_OCTETS	(1024 / BITS_PER_BYTE)
-#define RSA_MIN_OCTETS_UGH	"RSA modulus too small for security: less than 1024 bits"
-#define RSA_MAX_OCTETS	(8192 / BITS_PER_BYTE)
-#define RSA_MAX_OCTETS_UGH	"RSA modulus too large: more than 8192 bits"
+#define BITS_PER_BYTE 8
 
 /**
   * Default length for various auxiliary text buffers
   */
-#define BUF_LEN		512
+#define BUF_LEN 512
 
 /**
  * Macro compares two strings for equality
@@ -78,55 +74,35 @@
  */
 #define ASSIGN(method, function) (method = (typeof(method))function)
 
-
 /**
- * Mapping entry which defines the end of a mapping_t array.
+ * printf() specifier to resolf enum names, see enum_names
  */
-#define MAPPING_END (-1)
-
-typedef struct mapping_t mapping_t;
+#define ENUM_PRINTF_SPEC 'N'
 
-/**
- * @brief Mapping entry, where enum-to-string mappings are stored.
- */
-struct mapping_t
-{
-	/**
-	 * Enumeration value.
-	 */
-	int value;
-	
-	/**
-	 * Mapped string.
-	 */
-	char *string;
-};
-
-/**
- * @brief Find a mapping_string in the mapping[].
- * 
- * @param mappings		mappings array
- * @param value			enum-value to get the string from
- * 
- */
-char *mapping_find(mapping_t *mappings, int value);
+typedef struct enum_name_t enum_name_t;
 
 /**
- * @brief Describes an enumeration
- * enum_name() returns the name of an enum value, or NULL if invalid.
+ * Struct to store names for enums. Use the convenience macros 
+ * to define these.
+ * For a single range, use:
+ * ENUM(name, first, last, string1, string2, ...)
+ *
+ * For multiple ranges, use:
+ * ENUM_BEGIN(name, first, last, string1, string2, ...)
+ *   ENUM_NEXT(name, first, last, last_from_previous, string3, ...)
+ *   ENUM_NEXT(name, first, last, last_from_previous, string4, ...)
+ * ENUM_END(name, last_from_previous)
  */
-typedef const struct enum_names enum_names;
-
-struct enum_names {
-	unsigned long en_first;  	/* first value in range */
-	unsigned long en_last;   	/* last value in range (inclusive) */
-	const char *const *en_names;
-	enum_names *en_next_range;	/* descriptor of next range */
+struct enum_name_t {
+	long first;
+	long last;
+	enum_name_t *next;
+	char *names[];
 };
 
-/**
- * @brief Returns the name of an enum value, or NULL if invalid
- */
-const char *enum_name(enum_names *ed, unsigned long val);
+#define ENUM_BEGIN(name, first, last, ...) static enum_name_t name##last = {first, last, NULL, { __VA_ARGS__ }}
+#define ENUM_NEXT(name, first, last, prev, ...) static enum_name_t name##last = {first, last, &name##prev, { __VA_ARGS__ }}
+#define ENUM_END(name, prev) enum_name_t *name = &name##prev;
+#define ENUM(name, first, last, ...) ENUM_BEGIN(name, first, last, __VA_ARGS__); ENUM_END(name, last)
 
 #endif /*DEFINITIONS_H_*/
diff --git a/src/libstrongswan/library.c b/src/libstrongswan/library.c
index f561f2451..0394f32d7 100644
--- a/src/libstrongswan/library.c
+++ b/src/libstrongswan/library.c
@@ -1,8 +1,8 @@
 /**
  * @file library.c
- * 
+ *
  * @brief Library (de-)initialization.
- * 
+ *
  */
 
 /*
@@ -21,23 +21,22 @@
  * for more details.
  */
 
-#include <utils/logger_manager.h>
-#include <utils/leak_detective.h>
+#include <stdarg.h>
+#include <stdio.h>
 
-/**
- * Called whenever the library is linked from a process
- */
-void __attribute__ ((constructor)) library_init(void)
-{
-	logger_manager_init();
-	leak_detective_init();	
-}
+#include "library.h"
 
 /**
- * Called whenever the library is unlinked from a process
+ * default dbg function which printf all to stderr
  */
-void __attribute__ ((destructor)) library_cleanup(void)
+static void dbg_stderr(int level, char *fmt, ...)
 {
-	leak_detective_cleanup();
-	logger_manager_cleanup();
+	va_list args;
+	
+	va_start(args, fmt);
+	vfprintf(stderr, fmt, args);
+	fprintf(stderr, "\n");
+	va_end(args);
 }
+
+void (*dbg) (int level, char *fmt, ...) = dbg_stderr;
diff --git a/src/libstrongswan/library.h b/src/libstrongswan/library.h
index 00472bde9..58cd4bb33 100644
--- a/src/libstrongswan/library.h
+++ b/src/libstrongswan/library.h
@@ -84,17 +84,25 @@
  *
  * Symmetric signing algorithms, 
  * used to ensure message integrity.
- * 
+ *
  * @ingroup crypto
  */
- 
+
 /**
  * @defgroup utils utils
- * 
+ *
  * Generic helper classes.
- * 
+ *
  * @ingroup libstrongswan
  */
 
+/** debug macros, they call the dbg function hook */
+#define DBG1(fmt, ...) dbg(1, fmt, ##__VA_ARGS__)
+#define DBG2(fmt, ...) dbg(2, fmt, ##__VA_ARGS__)
+#define DBG3(fmt, ...) dbg(3, fmt, ##__VA_ARGS__)
+#define DBG4(fmt, ...) dbg(4, fmt, ##__VA_ARGS__)
+
+/** dbg function hook, uses stderr logger by default */
+extern void (*dbg) (int level, char *fmt, ...);
 
 #endif /* LIBRARY_H_ */
diff --git a/src/libstrongswan/types.c b/src/libstrongswan/types.c
index 5f6b0b5f7..70cedfbfc 100644
--- a/src/libstrongswan/types.c
+++ b/src/libstrongswan/types.c
@@ -30,24 +30,20 @@
 
 #include "types.h"
 
+ENUM(status_names, SUCCESS, DESTROY_ME,
+	"SUCCESS",
+	"FAILED",
+	"OUT_OF_RES",
+	"ALREADY_DONE",
+	"NOT_SUPPORTED",
+	"INVALID_ARG",
+	"NOT_FOUND",
+	"PARSE_ERROR",
+	"VERIFY_ERROR",
+	"INVALID_STATE",
+	"DESTROY_ME",
+);
 
-/**
- * String mappings for type status_t.
- */
-mapping_t status_m[] = {
-	{SUCCESS, "SUCCESS"},
-	{FAILED, "FAILED"},
-	{OUT_OF_RES, "OUT_OF_RES"},
-	{ALREADY_DONE, "ALREADY_DONE"},
-	{NOT_SUPPORTED, "NOT_SUPPORTED"},
-	{INVALID_ARG, "INVALID_ARG"},
-	{NOT_FOUND, "NOT_FOUND"},
-	{PARSE_ERROR, "PARSE_ERROR"},
-	{VERIFY_ERROR, "VERIFY_ERROR"},
-	{INVALID_STATE, "INVALID_STATE"},
-	{DESTROY_ME, "DESTROY_ME"},
-	{MAPPING_END, NULL}
-};
 
 /**
  * Empty chunk.
@@ -162,29 +158,51 @@ bool chunk_equals_or_null(chunk_t a, chunk_t b)
 /**
  * Described in header.
  */
-void chunk_to_hex(char *buf, size_t buflen, chunk_t chunk)
+void *clalloc(void * pointer, size_t size)
 {
-	bool first = TRUE;
+	void *data;
+	data = malloc(size);
+	
+	memcpy(data, pointer,size);
+	
+	return (data);
+}
 
-	buflen--;  /* reserve space for null termination */
+/**
+ * We use a single mutex for all refcount variables. This
+ * is not optimal for performance, but the critical section
+ * is not that long...
+ * TODO: Consider to include a mutex in each refcount_t variable.
+ */
+static pthread_mutex_t ref_mutex = PTHREAD_MUTEX_INITIALIZER;
 
-	while (chunk.len > 0 && buflen > 2)
-	{
-		static char hexdig[] = "0123456789abcdef";
+/**
+ * Described in header.
+ * 
+ * TODO: May be implemented with atomic CPU instructions
+ * instead of a mutex.
+ */
+void ref_get(refcount_t *ref)
+{
+	pthread_mutex_lock(&ref_mutex);
+	(*ref)++;
+	pthread_mutex_unlock(&ref_mutex);
+}
 
-		if (first)
-		{
-			first = FALSE;
-		}
-		else
-		{
-			*buf++ = ':'; buflen--;
-		}
-		*buf++ = hexdig[(*chunk.ptr >> 4) & 0x0f];
-		*buf++ = hexdig[ *chunk.ptr++     & 0x0f];
-		buflen -= 2; chunk.len--;
-	}
-	*buf = '\0';
+/**
+ * Described in header.
+ * 
+ * TODO: May be implemented with atomic CPU instructions
+ * instead of a mutex.
+ */
+bool ref_put(refcount_t *ref)
+{
+	bool more_refs;
+	
+	pthread_mutex_lock(&ref_mutex);
+	more_refs = --(*ref);
+	pthread_mutex_unlock(&ref_mutex);
+	return !more_refs;
 }
 
 /**
@@ -208,13 +226,9 @@ static int print_bytes(FILE *stream, const struct printf_info *info,
 	char *bytes_roof = bytes + len;
 	int line_start = 0;
 	int i = 0;
-	int total_written = 0;
+	int written = 0;
 	
-	total_written = fprintf(stream, "=> %d bytes @ %p", len, bytes);
-	if (total_written < 0)
-	{
-		return total_written;
-	}
+	written += fprintf(stream, "=> %d bytes @ %p", len, bytes);
 	
 	while (bytes_pos < bytes_roof)
 	{
@@ -238,13 +252,9 @@ static int print_bytes(FILE *stream, const struct printf_info *info,
 			*buffer_pos++ = '\0';
 			ascii_buffer[i] = '\0';
 			
-			written = fprintf(stream, "\n%4d: %s  %s",
+			written += fprintf(stream, "\n%4d: %s  %s",
 							  line_start, buffer, ascii_buffer);
-			if (written < 0)
-			{
-				return written;
-			}
-			total_written += written;
+
 			
 			buffer_pos = buffer;
 			line_start += BYTES_PER_LINE;
@@ -255,7 +265,7 @@ static int print_bytes(FILE *stream, const struct printf_info *info,
 			*buffer_pos++ = ' ';
 		}
 	}
-	return total_written;
+	return written;
 }
 
 /**
@@ -265,21 +275,98 @@ static int print_chunk(FILE *stream, const struct printf_info *info,
 					   const void *const *args)
 {
 	chunk_t *chunk = *((chunk_t**)(args[0]));
+	bool first = TRUE;
+	chunk_t copy = *chunk;
+	int written = 0;
 	
-	const void *new_args[] = {&chunk->ptr, &chunk->len};
-	return print_bytes(stream, info, new_args);
+	if (!info->alt)
+	{
+		const void *new_args[] = {&chunk->ptr, &chunk->len};
+		return print_bytes(stream, info, new_args);
+	}
+	
+	while (copy.len > 0)
+	{
+		static char hexdig[] = "0123456789abcdef";
+		if (first)
+		{
+			first = FALSE;
+		}
+		else
+		{
+			written += fprintf(stream, ":");
+		}
+		written += fprintf(stream, "%c%c", 
+						   hexdig[(*copy.ptr >> 4) & 0x0f],
+						   hexdig[ *copy.ptr++     & 0x0f]);
+		copy.len--;
+	}
+	return written;
 }
 
 /**
- * arginfo handler in printf() for chunks
+ * output handler in printf() for time_t
  */
-static int print_chunk_arginfo(const struct printf_info *info, size_t n, int *argtypes)
+static int print_time(FILE *stream, const struct printf_info *info,
+				 const void *const *args)
 {
-	if (n > 0)
+	static const char* months[] = {
+		"Jan", "Feb", "Mar", "Apr", "May", "Jun",
+		"Jul", "Aug", "Sep", "Oct", "Nov", "Dec"
+	};
+	time_t time = *((time_t*)(args[0]));
+	bool utc = TRUE;
+	struct tm t;
+	
+	if (info->alt)
 	{
-		argtypes[0] = PA_POINTER;
+		utc = *((bool*)(args[1]));
 	}
-	return 1;
+	if (time == UNDEFINED_TIME)
+	{
+		return fprintf(stream, "--- -- --:--:--%s----",
+					   info->alt ? " UTC " : " ");
+	}
+	if (utc)
+	{
+		gmtime_r(&time, &t);
+	}
+	else
+	{
+		localtime_r(&time, &t);
+	}
+	return fprintf(stream, "%s %02d %02d:%02d:%02d%s%04d",
+				   months[t.tm_mon], t.tm_mday, t.tm_hour, t.tm_min,
+				   t.tm_sec, info->alt ? " UTC " : " ", t.tm_year + 1900);
+}
+
+/**
+ * output handler in printf() for time deltas
+ */
+static int print_time_delta(FILE *stream, const struct printf_info *info,
+					  const void *const *args)
+{
+	time_t start = *((time_t*)(args[0]));
+	time_t end = *((time_t*)(args[1]));
+	u_int delta = abs(end - start);
+	char* unit = "second";
+	
+	if (delta > 2 * 60 * 60 * 24)
+	{
+		delta /= 60 * 60 * 24;
+		unit = "days";
+	}
+	else if (delta > 2 * 60 * 60)
+	{
+		delta /= 60 * 60;
+		unit = "hours";
+	}
+	else if (delta > 2 * 60)
+	{
+		delta /= 60;
+		unit = "minutes";
+	}
+	return fprintf(stream, "%d %s", delta, unit);
 }
 
 /**
@@ -296,85 +383,59 @@ static int print_bytes_arginfo(const struct printf_info *info, size_t n, int *ar
 }
 
 /**
- * register printf() handlers for chunk and byte ranges
+ * arginfo handler in printf() for time deltas
  */
-static void __attribute__ ((constructor))print_register()
+static int print_time_delta_arginfo(const struct printf_info *info, size_t n, int *argtypes)
 {
-	register_printf_function(CHUNK_PRINTF_SPEC, print_chunk, print_chunk_arginfo);
-	register_printf_function(BYTES_PRINTF_SPEC, print_bytes, print_bytes_arginfo);
+	if (n > 1)
+	{
+		argtypes[0] = PA_INT;
+		argtypes[1] = PA_INT;
+	}
+	return 2;
 }
 
 /**
- * Described in header.
+ * arginfo handler in printf() for time_t
  */
-void *clalloc(void * pointer, size_t size)
+static int print_time_arginfo(const struct printf_info *info, size_t n, int *argtypes)
 {
-	void *data;
-	data = malloc(size);
-	
-	memcpy(data, pointer,size);
+	if (info->alt)
+	{
+		if (n > 1)
+		{
+			argtypes[0] = PA_INT;
+			argtypes[1] = PA_INT;
+		}
+		return 2;
+	}
 	
-	return (data);
+	if (n > 0)
+	{
+		argtypes[0] = PA_INT;
+	}
+	return 1;
 }
 
 /**
- * We use a single mutex for all refcount variables. This
- * is not optimal for performance, but the critical section
- * is not that long...
- * TODO: Consider to include a mutex in each refcount_t variable.
- */
-static pthread_mutex_t ref_mutex = PTHREAD_MUTEX_INITIALIZER;
-
-/**
- * Described in header.
- * 
- * TODO: May be implemented with atomic CPU instructions
- * instead of a mutex.
+ * arginfo handler in printf() for chunks
  */
-void ref_get(refcount_t *ref)
+static int print_chunk_arginfo(const struct printf_info *info, size_t n, int *argtypes)
 {
-	pthread_mutex_lock(&ref_mutex);
-	(*ref)++;
-	pthread_mutex_unlock(&ref_mutex);
+	if (n > 0)
+	{
+		argtypes[0] = PA_POINTER;
+	}
+	return 1;
 }
 
 /**
- * Described in header.
- * 
- * TODO: May be implemented with atomic CPU instructions
- * instead of a mutex.
- */
-bool ref_put(refcount_t *ref)
-{
-	bool more_refs;
-	
-	pthread_mutex_lock(&ref_mutex);
-	more_refs = --(*ref);
-	pthread_mutex_unlock(&ref_mutex);
-	return !more_refs;
-}
-
-/*
- * Names of the months used by timetoa()
+ * register printf() handlers for time_t
  */
-static const char* months[] = {
-	"Jan", "Feb", "Mar", "Apr", "May", "Jun",
-	"Jul", "Aug", "Sep", "Oct", "Nov", "Dec"
-};
-
-/*
- * Described in header file
- */
-void timetoa(char *buf, size_t buflen, const time_t *time, bool utc)
+static void __attribute__ ((constructor))print_register()
 {
-	if (*time == UNDEFINED_TIME)
-		snprintf(buf, buflen, "--- -- --:--:--%s----", (utc)?" UTC ":" ");
-	else
-	{
-		struct tm *t = (utc)? gmtime(time) : localtime(time);
-
-		snprintf(buf, buflen, "%s %02d %02d:%02d:%02d%s%04d",
-				months[t->tm_mon], t->tm_mday, t->tm_hour, t->tm_min, t->tm_sec,
-				(utc)?" UTC ":" ", t->tm_year + 1900);
-	}
+	register_printf_function(CHUNK_PRINTF_SPEC, print_chunk, print_chunk_arginfo);
+	register_printf_function(BYTES_PRINTF_SPEC, print_bytes, print_bytes_arginfo);
+	register_printf_function(TIME_PRINTF_SPEC, print_time, print_time_arginfo);
+	register_printf_function(TIME_DELTA_PRINTF_SPEC, print_time_delta, print_time_delta_arginfo);
 }
diff --git a/src/libstrongswan/types.h b/src/libstrongswan/types.h
index 1f28d3844..6561fb208 100644
--- a/src/libstrongswan/types.h
+++ b/src/libstrongswan/types.h
@@ -106,9 +106,9 @@ enum status_t {
 };
 
 /**
- * String mappings for type status_t.
+ * enum_names for type status_t.
  */
-extern mapping_t status_m[];
+extern enum_name_t *status_names;
 
 /**
  * Handle struct timeval like an own type.
@@ -150,6 +150,8 @@ struct chunk_t {
  */
 extern chunk_t CHUNK_INITIALIZER;
 
+
+
 /**
  * Printf() hook character to dump a chunk using printf.
  * The argument supplied to printf() is a pointer to a chunk.
@@ -166,6 +168,22 @@ extern chunk_t CHUNK_INITIALIZER;
 #define BYTES_PRINTF_SPEC 'b'
 
 /**
+ * printf specifier for time_t, use #-modifier to print time as UTC 
+ */
+#define TIME_PRINTF_SPEC 'T'
+
+/**
+ * printf specifier for time_t deltas, uses two arguments
+ * E.g. printf("%V", begin, end);
+ */
+#define TIME_DELTA_PRINTF_SPEC 'V'
+
+/**
+ * time_t for a not defined time
+ */
+#define UNDEFINED_TIME 0
+
+/**
  * Initialize a chunk to a static buffer
  */
 #define chunk_from_buf(str) { str, sizeof(str) }
@@ -241,18 +259,4 @@ void ref_get(refcount_t *ref);
 bool ref_put(refcount_t *ref);
 
 
-#define UNDEFINED_TIME	0
-#define TIMETOA_BUF 	30
-
-/**
- * @brief Display a date either in local or UTC time
- * 
- * @param buf		buffer where displayed time will be written to
- * @param buflen	buffer length
- * @param time		time to be displayed
- * @param utc		UTC (TRUE) or local time (FALSE)
- * 
- */
-void timetoa(char *buf, size_t buflen, const time_t *time, bool utc);
-
 #endif /*TYPES_H_*/
diff --git a/src/libstrongswan/utils/identification.c b/src/libstrongswan/utils/identification.c
index 4932a1e94..6dbd376a3 100644
--- a/src/libstrongswan/utils/identification.c
+++ b/src/libstrongswan/utils/identification.c
@@ -35,11 +35,7 @@
 
 #include <asn1/asn1.h>
 
-/** 
- * String mappings for id_type_t.
- */
-
-static const char *const id_type_name[] = {
+ENUM_BEGIN(id_type_names, ID_ANY, ID_KEY_ID,
 	"ID_ANY",
 	"ID_IPV4_ADDR",
 	"ID_FQDN",
@@ -51,11 +47,11 @@ static const char *const id_type_name[] = {
 	"ID_IPV6_ADDR_RANGE",
 	"ID_DER_ASN1_DN",
 	"ID_DER_ASN1_GN",
-	"ID_KEY_ID",
-};
+	"ID_KEY_ID");
+ENUM_NEXT(id_type_names, ID_DER_ASN1_GN_URI, ID_DER_ASN1_GN_URI, ID_KEY_ID,
+	"ID_DER_ASN1_GN_URI");
+ENUM_END(id_type_names, ID_DER_ASN1_GN_URI);
 
-enum_names id_type_names =
-    { ID_ANY, ID_KEY_ID, id_type_name, NULL };
 
 /**
  * X.501 acronyms for well known object identifiers (OIDs)
diff --git a/src/libstrongswan/utils/identification.h b/src/libstrongswan/utils/identification.h
index 3df710c7c..0d2bc794e 100644
--- a/src/libstrongswan/utils/identification.h
+++ b/src/libstrongswan/utils/identification.h
@@ -116,9 +116,9 @@ enum id_type_t {
 };
 
 /**
- * String mappings for id_type_t.
+ * enum names for id_type_t.
  */
-extern enum_names id_type_names;
+extern enum_name_t *id_type_names;
 
 typedef struct identification_t identification_t;
 
diff --git a/src/libstrongswan/utils/leak_detective.c b/src/libstrongswan/utils/leak_detective.c
index 9b4219e18..7cf036eea 100644
--- a/src/libstrongswan/utils/leak_detective.c
+++ b/src/libstrongswan/utils/leak_detective.c
@@ -38,6 +38,7 @@
 #include "leak_detective.h"
 
 #include <types.h>
+#include <library.h>
 
 #ifdef LEAK_DETECTIVE
 
@@ -117,11 +118,6 @@ static memory_header_t first_header = {
 };
 
 /**
- * logger for the leak detective
- */
-static logger_t *logger;
-
-/**
  * standard hooks, used to temparily remove hooking
  */
 static void *old_malloc_hook, *old_realloc_hook, *old_free_hook;
@@ -149,11 +145,11 @@ static void log_stack_frames(void **stack_frames, int stack_frame_count)
 
 	strings = backtrace_symbols (stack_frames, stack_frame_count);
 
-	logger->log(logger, ERROR, "  dumping %d stack frame addresses", stack_frame_count);
+	DBG1("  dumping %d stack frame addresses", stack_frame_count);
 
 	for (i = 0; i < stack_frame_count; i++)
 	{
-		logger->log(logger, ERROR, "    %s", strings[i]);
+		DBG1("    %s", strings[i]);
 	}
 	free (strings);
 }
@@ -166,7 +162,7 @@ static void log_stack_frames(void **stack_frames, int stack_frame_count)
  *
  * The range_size is calculated using the readelf utility, e.g.:
  * readelf -s /lib/glibc.so.6
- * These values may or may not be acceptable for another system.
+ * The values are for glibc-2.4 and may or may not be correct on other systems.
  */
 typedef struct whitelist_t whitelist_t;
 
@@ -176,15 +172,16 @@ struct whitelist_t {
 };
 
 whitelist_t whitelist[] = {
-	{pthread_create,			381},
-	{pthread_setspecific,		256},
-	{mktime,					 60},
-	{tzset,						126},
-	{inet_ntoa,					256},
-	{strerror,					173},
-	{getprotobynumber,			294},
-	{getservbyport,				309},
-	{register_printf_function,	150},
+	{pthread_create,			2542},
+	{pthread_setspecific,		 217},
+	{mktime,					  60},
+	{tzset,						 123},
+	{inet_ntoa,					 249},
+	{strerror,					 180},
+	{getprotobynumber,			 291},
+	{getservbyport,				 311},
+	{register_printf_function,	 159},
+	{syslog,					  45},
 };
 
 /**
@@ -220,7 +217,7 @@ void report_leaks()
 	{
 		if (!is_whitelisted(hdr->stack_frames, hdr->stack_frame_count))
 		{
-			logger->log(logger, ERROR, "Leak (%d bytes at %p):", hdr->bytes, hdr + 1);
+			DBG1("Leak (%d bytes at %p):", hdr->bytes, hdr + 1);
 			log_stack_frames(hdr->stack_frames, hdr->stack_frame_count);
 			leaks++;
 		}
@@ -229,13 +226,13 @@ void report_leaks()
 	switch (leaks)
 	{
 		case 0:
-			logger->log(logger, CONTROL, "No leaks detected");
+			DBG1("No leaks detected");
 			break;
 		case 1:
-			logger->log(logger, ERROR, "One leak detected");
+			DBG1("One leak detected");
 			break;
 		default:
-			logger->log(logger, ERROR, "%d leaks detected", leaks);
+			DBG1("%d leaks detected", leaks);
 			break;
 	}
 }
@@ -322,8 +319,8 @@ void free_hook(void *ptr, const void *caller)
 	uninstall_hooks();
 	if (hdr->magic != MEMORY_HEADER_MAGIC)
 	{
-		logger->log(logger, ERROR, "freeing of invalid memory (%p, MAGIC 0x%x != 0x%x):", 
-					ptr, hdr->magic, MEMORY_HEADER_MAGIC);
+		DBG1("freeing of invalid memory (%p, MAGIC 0x%x != 0x%x):",
+			 ptr, hdr->magic, MEMORY_HEADER_MAGIC);
 		stack_frame_count = backtrace(stack_frames, STACK_FRAMES_COUNT);
 		log_stack_frames(stack_frames, stack_frame_count);
 		install_hooks();
@@ -368,7 +365,7 @@ void *realloc_hook(void *old, size_t bytes, const void *caller)
 	uninstall_hooks();
 	if (hdr->magic != MEMORY_HEADER_MAGIC)
 	{
-		logger->log(logger, ERROR, "reallocation of invalid memory (%p):", old);
+		DBG1("reallocation of invalid memory (%p):", old);
 		stack_frame_count = backtrace(stack_frames, STACK_FRAMES_COUNT);
 		log_stack_frames(stack_frames, stack_frame_count);
 		install_hooks();
@@ -397,16 +394,15 @@ void *realloc_hook(void *old, size_t bytes, const void *caller)
 /**
  * Setup leak detective
  */
-void leak_detective_init()
+void __attribute__ ((constructor)) leak_detective_init()
 {
-	logger = logger_manager->get_logger(logger_manager, LEAK_DETECT);
 	install_hooks();
 }
 
 /**
  * Clean up leak detective
  */
-void leak_detective_cleanup()
+void __attribute__ ((destructor)) leak_detective_cleanup()
 {
 	uninstall_hooks();
 	report_leaks();
@@ -415,7 +411,7 @@ void leak_detective_cleanup()
 /**
  * Log memory allocation statistics
  */
-void leak_detective_status(logger_t *logger)
+void leak_detective_status(FILE *stream)
 {
 	u_int blocks = 0;
 	size_t bytes = 0;
@@ -429,10 +425,10 @@ void leak_detective_status(logger_t *logger)
 	}
 	pthread_mutex_unlock(&mutex);
 	
-	logger->log(logger, CONTROL|LEVEL1, "allocation statistics:");
-	logger->log(logger, CONTROL|LEVEL1, "  call stats: malloc: %d, free: %d, realloc: %d",
+	fprintf(stream, "allocation statistics:\n");
+	fprintf(stream, "  call stats: malloc: %d, free: %d, realloc: %d\n",
 			count_malloc, count_free, count_realloc);
-	logger->log(logger, CONTROL|LEVEL1, "  allocated %d blocks, total size %d bytes (avg. %d bytes)",
+	fprintf(stream, "  allocated %d blocks, total size %d bytes (avg. %d bytes)\n",
 			blocks, bytes, bytes/blocks);
 }
 
@@ -441,7 +437,7 @@ void leak_detective_status(logger_t *logger)
 /**
  * Dummy when !using LEAK_DETECTIVE
  */
-void leak_detective_status(logger_t *logger)
+void leak_detective_status(FILE *stream)
 {
 
 }
diff --git a/src/libstrongswan/utils/leak_detective.h b/src/libstrongswan/utils/leak_detective.h
index 07b2f6543..d4016b06e 100644
--- a/src/libstrongswan/utils/leak_detective.h
+++ b/src/libstrongswan/utils/leak_detective.h
@@ -22,36 +22,14 @@
 #ifndef LEAK_DETECTIVE_H_
 #define LEAK_DETECTIVE_H_
 
-
-#include <utils/logger_manager.h>
-
 /**
  * Log status information about allocation
  */
-void leak_detective_status(logger_t *logger);
-
-#ifdef LEAK_DETECTIVE
+void leak_detective_status(FILE *stream);
 
 /**
  * Max number of stack frames to include in a backtrace.
  */
 #define STACK_FRAMES_COUNT 30
 
-/**
- * Initialize leak detective, activates it
- */
-void leak_detective_init();
-
-/**
- * Cleanup leak detective, deactivates it
- */
-void leak_detective_cleanup();
-
-#else /* !LEAK_DETECTIVE */
-
-#define leak_detective_init() {}
-#define leak_detective_cleanup() {}
-
-#endif /* LEAK_DETECTIVE */
-
 #endif /* LEAK_DETECTIVE_H_ */
diff --git a/src/libstrongswan/utils/linked_list.c b/src/libstrongswan/utils/linked_list.c
index 0149afd69..83371018f 100644
--- a/src/libstrongswan/utils/linked_list.c
+++ b/src/libstrongswan/utils/linked_list.c
@@ -127,6 +127,11 @@ struct private_iterator_t {
 	 * Direction of iterator.
 	 */
 	bool forward;
+	
+	/**
+	 * Mutex to use to synchronize access
+	 */
+	pthread_mutex_t *mutex;
 };
 
 /**
@@ -361,6 +366,10 @@ static void insert_after(private_iterator_t * iterator, void *item)
  */
 static void iterator_destroy(private_iterator_t *this)
 {
+	if (this->mutex)
+	{
+		pthread_mutex_unlock(this->mutex);
+	}
 	free(this);
 }
 
@@ -373,24 +382,6 @@ static int get_count(private_linked_list_t *this)
 }
 
 /**
- * Implementation of linked_list_t.call_on_items.
- */
-static void call_on_items(private_linked_list_t *this, void(*func)(void*))
-{
-	iterator_t *iterator;
-	void *item;
-	
-	iterator = this->public.create_iterator(&this->public,TRUE);
-	
-	while (iterator->has_next(iterator))
-	{
-		iterator->current(iterator, &item);
-		(*func)(item);
-	}
-	iterator->destroy(iterator);
-}
-
-/**
  * Implementation of linked_list_t.insert_first.
  */
 static void insert_first(private_linked_list_t *this, void *item)
@@ -629,7 +620,7 @@ static status_t get_last(private_linked_list_t *this, void **item)
 static iterator_t *create_iterator (private_linked_list_t *linked_list, bool forward)
 {
 	private_iterator_t *this = malloc_thing(private_iterator_t);
-
+	
 	this->public.get_count = (bool (*) (iterator_t *this)) get_list_count;
 	this->public.iterate = (bool (*) (iterator_t *this, void **value)) iterate;
 	this->public.has_next = (bool (*) (iterator_t *this)) iterator_has_next;
@@ -640,11 +631,26 @@ static iterator_t *create_iterator (private_linked_list_t *linked_list, bool for
 	this->public.remove = (status_t (*) (iterator_t *this)) remove;
 	this->public.reset = (void (*) (iterator_t *this)) iterator_reset;
 	this->public.destroy = (void (*) (iterator_t *this)) iterator_destroy;
-
+	
 	this->forward = forward;
 	this->current = NULL;
 	this->list = linked_list;
+	this->mutex = NULL;
+	
+	return &this->public;
+}
 
+/**
+ * Implementation of linked_list_t.create_iterator_locked.
+ */
+static iterator_t *create_iterator_locked(private_linked_list_t *linked_list,
+										  pthread_mutex_t *mutex)
+{
+	private_iterator_t *this = (private_iterator_t*)create_iterator(linked_list, TRUE);
+	this->mutex = mutex;
+	
+	pthread_mutex_lock(mutex);
+	
 	return &this->public;
 }
 
@@ -672,7 +678,7 @@ linked_list_t *linked_list_create()
 
 	this->public.get_count = (int (*) (linked_list_t *)) get_count;
 	this->public.create_iterator = (iterator_t * (*) (linked_list_t *,bool))create_iterator;
-	this->public.call_on_items = (void (*) (linked_list_t *, void(*func)(void*)))call_on_items;
+	this->public.create_iterator_locked = (iterator_t * (*) (linked_list_t *,pthread_mutex_t*))create_iterator_locked;
 	this->public.get_first = (status_t (*) (linked_list_t *, void **item))get_first;
 	this->public.get_last = (status_t (*) (linked_list_t *, void **item))get_last;
 	this->public.insert_first = (void (*) (linked_list_t *, void *item))insert_first;
diff --git a/src/libstrongswan/utils/linked_list.h b/src/libstrongswan/utils/linked_list.h
index b5f982f20..9c824177e 100644
--- a/src/libstrongswan/utils/linked_list.h
+++ b/src/libstrongswan/utils/linked_list.h
@@ -24,6 +24,8 @@
 #ifndef LINKED_LIST_H_
 #define LINKED_LIST_H_
 
+#include <pthread.h>
+
 #include <types.h>
 #include <utils/iterator.h>
 
@@ -31,18 +33,13 @@
 typedef struct linked_list_t linked_list_t;
 
 /**
- * @brief Class implementing a double linked list (named only as linked list).
+ * @brief Class implementing a double linked list.
  *
- * @warning Access to an object of this type is not thread-save.
+ * General purpose linked list. This list is not synchronized.
  * 
  * @b Costructors:
  * - linked_list_create()
- * 
- * @see		
- * 			- job_queue_t
- * 			- event_queue_t
- * 			- send_queue_t
- * 
+ *
  * @ingroup utils
  */
 struct linked_list_t {
@@ -64,27 +61,24 @@ struct linked_list_t {
 	 * @param forward 		iterator direction (TRUE: front to end)
 	 * @return				new iterator_t object
 	 */
-	iterator_t * (*create_iterator) (linked_list_t *linked_list, bool forward);
+	iterator_t *(*create_iterator) (linked_list_t *linked_list, bool forward);
 	
 	/**
-	 * @brief Call a function with list element as argument.
-	 * 
-	 * This method accepts a function, which will be called for 
-	 * each list element once. The function must accept the list
-	 * element as the first argument. Handy for destruction of
-	 * list elements.
-	 * 
-	 * @todo Additional vararg which are passed to the 
-	 *		 function would be nice...
+	 * @brief Creates a iterator, locking a mutex.
+	 *
+	 * The supplied mutex is acquired immediately, and released
+	 * when the iterator gets destroyed.
 	 * 
 	 * @param linked_list 	calling object
-	 * @param func			function to call
+	 * @param mutex 		mutex to use for exclusive access
+	 * @return				new iterator_t object
 	 */
-	void (*call_on_items) (linked_list_t *linked_list, void(*func)(void*));
+	iterator_t *(*create_iterator_locked) (linked_list_t *linked_list,
+										   pthread_mutex_t *mutex);
 
 	/**
 	 * @brief Inserts a new item at the beginning of the list.
-	 * 
+	 *
 	 * @param linked_list 	calling object
 	 * @param[in] item		item value to insert in list
 	 */
diff --git a/src/libstrongswan/utils/logger.c b/src/libstrongswan/utils/logger.c
deleted file mode 100644
index 26f42535e..000000000
--- a/src/libstrongswan/utils/logger.c
+++ /dev/null
@@ -1,384 +0,0 @@
-/**
- * @file logger.c
- * 
- * @brief Implementation of logger_t.
- * 
- */
-
-/*
- * Copyright (C) 2005-2006 Martin Willi
- * Copyright (C) 2005 Jan Hutter
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#include <syslog.h>
-#include <string.h>
-#include <stdio.h>
-#include <time.h>
-#include <pthread.h>
-
-#include "logger.h"
-
-/**
- * Maximum length of a log entry (only used for logger_s.log).
- */
-#define MAX_LOG 8192
-
-/**
- * Maximum number of logged bytes per line
- */
-#define MAX_BYTES 16
-
-typedef struct private_logger_t private_logger_t;
-
-/**
- * @brief Private data of a logger_t object.
- */
-struct private_logger_t {
-	/**
-	 * Public data.
-	 */
-	logger_t public;
-	/**
-	 * Detail-level of logger.
-	 */
-	log_level_t level;
-	/**
-	 * Name of logger.
-	 */
-	char *name;
-	/**
-	 * File to write log output to.
-	 * NULL for syslog.
-	 */
-	FILE *output;
-	
-	/**
-	 * Should a thread_id be included in the log?
-	 */
-	bool log_thread_id;
-};
-
-/**
- * thread local storage for get_thread_number
- */
-static pthread_key_t thread_ids;
-static void make_key(void)
-{
-	pthread_key_create(&thread_ids, NULL);
-}
-
-/**
- * Get a unique thread number for a calling thread. Since
- * pthread_self returns large and ugly numbers, use this function
- * for logging; these numbers are incremental starting at 1
- */
-static int get_thread_number(void)
-{
-	static int current_num = 0;
-	static pthread_once_t key_once = PTHREAD_ONCE_INIT;
-	int stored_num;
-	
-	pthread_once(&key_once, make_key);
-	stored_num = (int)pthread_getspecific(thread_ids);
-	if (stored_num == 0)
-	{
-		pthread_setspecific(thread_ids, (void*)++current_num);
-		return current_num;
-	}
-	else
-	{
-		return stored_num;
-	}
-}
-
-/**
- * prepend the logging prefix to string and store it in buffer
- */
-static void prepend_prefix(private_logger_t *this, log_level_t loglevel, const char *string, char *buffer)
-{
-	char thread_id[3] = "";
-	char log_type, log_details;
-	char *separator = (strlen(this->name) == 0)? "" : ":";
-
-	if (loglevel & CONTROL)
-	{
-		log_type = 'C';
-	}
-	else if (loglevel & ERROR)
-	{
-		log_type = 'E';
-	}
-	else if (loglevel & RAW)
-	{
-		log_type = 'R';
-	}
-	else if (loglevel & PRIVATE)
-	{
-		log_type = 'P';
-	}
-	else if (loglevel & AUDIT)
-	{
-		log_type = 'A';
-	}
-	else
-	{
-		log_type = '-';
-	}
-	
-	if (loglevel & (LEVEL3 - LEVEL2))
-	{
-		log_details = '3';
-	}
-	else if (loglevel & (LEVEL2 - LEVEL1))
-	{
-		log_details = '2';
-	}
-	else if (loglevel & LEVEL1)
-	{
-		log_details = '1';
-	}
-	else
-	{
-		log_details = '0';
-	}
-	
-	if (this->log_thread_id)
-	{
-		snprintf(thread_id, sizeof(thread_id), "%02d", get_thread_number());
-	}
-	snprintf(buffer, MAX_LOG, "%s[%c%c%s%s] %s",
-			 thread_id, log_type, log_details, separator, this->name, string);
-}
-
-/**
- * Convert a charon-loglevel to a syslog priority
- */
-static int get_priority(log_level_t loglevel)
-{
-	if (loglevel & ERROR)
-	{
-		return LOG_AUTHPRIV|LOG_ERR;
-	}
-	if (loglevel & AUDIT)
-	{
-		return LOG_AUTHPRIV|LOG_INFO;
-	}
-	return LOG_AUTHPRIV|LOG_DEBUG;
-}
-
-/**
- * Implementation of logger_t.logv.
- */
-static void logv(private_logger_t *this, log_level_t loglevel, const char *format, va_list args)
-{
-	if ((this->level & loglevel) == loglevel)
-	{
-		char buffer[MAX_LOG];
-		
-		if (this->output == NULL)
-		{
-			/* syslog */
-			prepend_prefix(this, loglevel, format, buffer);
-			vsyslog(get_priority(loglevel), buffer, args);
-		}
-		else
-		{
-			/* File output */
-			prepend_prefix(this, loglevel, format, buffer);
-			vfprintf(this->output, buffer, args);
-			fprintf(this->output, "\n");
-		}
-	}
-}
-
-/**
- * Implementation of logger_t.log.
- */
-static void logg(private_logger_t *this, log_level_t loglevel, const char *format, ...)
-{
-	va_list args;
-	
-	va_start(args, format);
-	logv(this, loglevel, format, args);
-	va_end(args);
-}
-
-/**
- * Implementation of logger_t.log_bytes.
- */
-static void log_bytes(private_logger_t *this, log_level_t loglevel, const char *label, const char *bytes, size_t len)
-{
-	static pthread_mutex_t mutex = PTHREAD_MUTEX_INITIALIZER;
-
-	if ((this->level & loglevel) == loglevel)
-	{
-		char thread_id[3] = "";
-		char buffer[MAX_LOG];
-		char ascii_buffer[MAX_BYTES+1];
-
-		char *buffer_pos = buffer;
-		const char format[] = "%s  %d bytes @ %p";
-		const char *bytes_pos  = bytes;
-		const char *bytes_roof = bytes + len;
-
-		int line_start = 0;
-		int i = 0;
-
-		/* since me can't do multi-line output to syslog, 
-		* we must do multiple syslogs. To avoid
-		* problems in output order, lock this by a mutex.
-		*/
-		pthread_mutex_lock(&mutex);
-
-		prepend_prefix(this, loglevel, format, buffer);
-		
-		if (this->log_thread_id)
-		{
-			snprintf(thread_id, sizeof(thread_id), "%02d", get_thread_number());
-		}
-
-		if (this->output == NULL)
-		{
-			syslog(get_priority(loglevel), buffer, label, len, bytes);
-		}
-		else
-		{
-			fprintf(this->output, buffer, label, len, bytes);
-			fprintf(this->output, "\n");
-		}
-
-		while (bytes_pos < bytes_roof)
-		{
-			static char hexdig[] = "0123456789ABCDEF";
-
-			*buffer_pos++ = hexdig[(*bytes_pos >> 4) & 0xF];
-			*buffer_pos++ = hexdig[ *bytes_pos       & 0xF];
-
-			ascii_buffer[i++] = (*bytes_pos > 31 && *bytes_pos < 127)
-				? *bytes_pos : '.';
-
-			if (++bytes_pos == bytes_roof || i == MAX_BYTES) 
-			{
-				int padding = 3 * (MAX_BYTES - i);
-
-				while (padding--)
-				{
-					*buffer_pos++ = ' ';
-				}
-				*buffer_pos++ = '\0';
-				ascii_buffer[i] = '\0';
-
-				if (this->output == NULL)
-				{
-					syslog(get_priority(loglevel), "%s[  :%5d]   %s  %s", thread_id, line_start, buffer, ascii_buffer);	
-				}
-				else
-				{
-					fprintf(this->output, "%s[  :%5d]   %s  %s\n", thread_id, line_start, buffer, ascii_buffer);
-				}
-				buffer_pos = buffer;
-				line_start += MAX_BYTES;
-				i = 0;
-			}
-			else 
-			{	
-				*buffer_pos++ = ' ';
-			}
-		}
-		pthread_mutex_unlock(&mutex);
-	}
-}
-
-/**
- * Implementation of logger_t.log_chunk.
- */
-static void log_chunk(logger_t *this, log_level_t loglevel, const char *label, chunk_t chunk)
-{
-	this->log_bytes(this, loglevel, label, chunk.ptr, chunk.len);
-}
-
-/**
- * Implementation of logger_t.enable_level.
- */
-static void enable_level(private_logger_t *this, log_level_t log_level)
-{
-	this->level |= log_level;
-}
-
-/**
- * Implementation of logger_t.disable_level.
- */
-static void disable_level(private_logger_t *this, log_level_t log_level)
-{
-	this->level &= ~log_level;
-}
-
-/**
- * Implementation of logger_t.set_output.
- */
-static void set_output(private_logger_t *this, FILE * output)
-{
-	this->output = output;
-}
-
-/**
- * Implementation of logger_t.get_level.
- */
-static log_level_t get_level(private_logger_t *this)
-{
-	return this->level;
-}
-
-/**
- * Implementation of logger_t.destroy.
- */
-static void destroy(private_logger_t *this)
-{
-	free(this->name);
-	free(this);
-}
-
-/*
- * Described in header.
- */	
-logger_t *logger_create(char *logger_name, log_level_t log_level, bool log_thread_id, FILE * output)
-{
-	private_logger_t *this = malloc_thing(private_logger_t);
-	
-	/* public functions */
-	this->public.log = (void(*)(logger_t*,log_level_t,const char*,...))logg;
-	this->public.logv = (void(*)(logger_t*,log_level_t,const char*,va_list))logv;
-	this->public.log_bytes = (void(*)(logger_t*, log_level_t, const char*, const char*,size_t))log_bytes;
-	this->public.log_chunk = log_chunk;
-	this->public.enable_level = (void(*)(logger_t*,log_level_t))enable_level;
-	this->public.disable_level = (void(*)(logger_t*,log_level_t))disable_level;
-	this->public.get_level = (log_level_t(*)(logger_t*))get_level;
-	this->public.set_output = (void(*)(logger_t*,FILE*))set_output;
-	this->public.destroy = (void(*)(logger_t*))destroy;
-
-	if (logger_name == NULL)
-	{
-		logger_name = "";
-	}
-
-	/* private variables */
-	this->level = log_level;
-	this->log_thread_id = log_thread_id;
-	this->name = malloc(strlen(logger_name) + 1);
-
-	strcpy(this->name,logger_name);
-	this->output = output;
-	
-	return (logger_t*)this;
-}
diff --git a/src/libstrongswan/utils/logger.h b/src/libstrongswan/utils/logger.h
deleted file mode 100644
index b24940d70..000000000
--- a/src/libstrongswan/utils/logger.h
+++ /dev/null
@@ -1,213 +0,0 @@
-/**
- * @file logger.h
- *
- * @brief Interface of logger_t.
- *
- */
-
-/*
- * Copyright (C) 2005-2006 Martin Willi
- * Copyright (C) 2005 Jan Hutter
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#ifndef LOGGER_H_
-#define LOGGER_H_
-
-#include <stdio.h>
-#include <stdarg.h>
-
-#include <types.h>
-
-typedef enum log_level_t log_level_t;
-
-/**
- * @brief Log Levels supported by the logger object.
- * 
- * Logleves are devided in two different kinds:
- * - levels to specify the type of the log
- * - levels to specify the detail-level of the log
- * 
- * Use combinations of these to build detailed loglevels, such
- * as CONTROL|LEVEL2 fore a detailed cotrol level, or
- * use RAW to see all raw data dumps (except private).
- * 
- * @ingroup utils
- */
-enum log_level_t {
-	/**
-	 * Control flow.
-	 */
-	CONTROL = 1,
-	/**
-	 * Error reporting.
-	 */
-	ERROR = 2,
-	/**
-	 * Logs important for the sysadmin.
-	 */
-	AUDIT = 4,
-	/**
-	 * Raw data dumps.
-	 */
-	RAW = 8,
-	/**
-	 * Private data dumps.
-	 */
-	PRIVATE = 16,
-	
-	/**
-	 * Log most important output, can be omitted.
-	 */
-	LEVEL0 = 0,
-	/**
-	 * Log more detailed output.
-	 */
-	LEVEL1 = 32, 
-	/**
-	 * Log even more detailed output.
-	 */
-	LEVEL2 = LEVEL1 + 64,
-	/**
-	 * Use maximum detailed output.
-	 */
-	LEVEL3 = LEVEL2 + 128,
-	
-	/**
-	 * Summary for all types with all detail-levels.
-	 */
-	FULL = LEVEL3 + CONTROL + ERROR + RAW + PRIVATE + AUDIT
-};
-
-typedef struct logger_t logger_t;
-
-/**
- * @brief Class to simplify logging.
- * 
- * @b Constructors:
- *  - logger_create()
- * 
- * @ingroup utils
- */
-struct logger_t {
-
-	/**
-	 * @brief Log an entry, using printf()-like params.
-	 *
-	 * All specified loglevels must be activated that
-	 * the log is done.
-	 *
-	 * @param this 		logger_t object
-	 * @param loglevel 	or'ed set of log_level_t's
-	 * @param format 	printf like format string
-	 * @param ... 		printf like parameters
-	 */
-	void (*log) (logger_t *this, log_level_t log_level, const char *format, ...);
-
-	/**
-	 * @brief Log an entry, using vprintf() style va_list parameters.
-	 *
-	 * All specified loglevels must be activated that
-	 * the log is done.
-	 *
-	 * @param this 		logger_t object
-	 * @param loglevel 	or'ed set of log_level_t's
-	 * @param format 	printf like format string
-	 * @param args 		va_list argument list
-	 */
-	void (*logv) (logger_t *this, log_level_t log_level, const char *format, va_list args);
-
-	/**
-	 * @brief Log some bytes, useful for debugging.
-	 *
-	 * All specified loglevels must be activated that
-	 * the log is done.
-	 *
-	 * @param this 		logger_t object
-	 * @param loglevel 	or'ed set of log_level_t's
-	 * @param label 	a labeling name, logged with the bytes
-	 * @param bytes 	pointer to the bytes to dump
-	 * @param len	 	number of bytes to dump
-	 */
-	void (*log_bytes) (logger_t *this, log_level_t loglevel, const char *label, const char *bytes, size_t len);
-
-	/**
-	 * @brief Log a chunk, useful for debugging.
-	 *
-	 * All specified loglevels must be activated that
-	 * the log is done.
-	 *
-	 * @param this 		logger_t object
-	 * @param loglevel 	or'ed set of log_level_t's
-	 * @param label 	a labeling name, logged with the bytes
-	 * @param chunk		chunk to log
-	 */
-	void (*log_chunk) (logger_t *this, log_level_t loglevel, const char *label, chunk_t chunk);
-
-	/**
-	 * @brief Enables a loglevel for the current logger_t object.
-	 *
-	 * @param this 		logger_t object
-	 * @param log_level loglevel to enable
-	 */
-	void (*enable_level) (logger_t *this, log_level_t log_level);
-
-	/**
-	 * @brief Disables a loglevel for the current logger_t object.
-	 *
-	 * @param this 		logger_t object
-	 * @param log_level loglevel to enable
-	 */
-	void (*disable_level) (logger_t *this, log_level_t log_level);
-
-	/**
-	 * @brief Set the output of the logger.
-	 * 
-	 * Use NULL for syslog.
-	 *
-	 * @param this 		logger_t object
-	 * @param output	file, where log output should be written
-	 */
-	void (*set_output) (logger_t *this, FILE *output);
-
-	/**
-	 * @brief Get the currently used loglevel.
-	 *
-	 * @param this 		logger_t object
-	 * @return			currently used loglevel
-	 */
-	log_level_t (*get_level) (logger_t *this);
-
-	/**
-	 * @brief Destroys a logger_t object.
-	 *
-	 * @param this		logger_t object
-	 */
-	void (*destroy) (logger_t *this);
-};
-
-/**
- * @brief Constructor to create a logger_t object.
- *
- * @param logger_name 	name for the logger_t object
- * @param log_level		or'ed set of log_levels to assign to the new logger_t object
- * @param log_thread_id	TRUE if thread id should also be logged
- * @param output		FILE * if log has to go on a file output, NULL for syslog
- * @return 				logger_t object
- * 
- * @ingroup utils
- */
-logger_t *logger_create(char *logger_name, log_level_t log_level, bool log_thread_id, FILE * output);
-
-
-#endif /*LOGGER_H_*/
diff --git a/src/libstrongswan/utils/logger_manager.c b/src/libstrongswan/utils/logger_manager.c
deleted file mode 100644
index ff79c62b9..000000000
--- a/src/libstrongswan/utils/logger_manager.c
+++ /dev/null
@@ -1,220 +0,0 @@
-/**
- * @file logger_manager.c
- *
- * @brief Implementation of logger_manager_t.
- *
- */
-
-/*
- * Copyright (C) 2005-2006 Martin Willi
- * Copyright (C) 2005 Jan Hutter
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
- 
- 
-#include "logger_manager.h"
-
-#include <definitions.h>
-#include <utils/linked_list.h>
-
-/**
- * String mappings for logger_context_t
- */
-mapping_t logger_context_t_mappings[] = {
-	{PARSER, "PARSER"},
-	{GENERATOR, "GENERATOR"},
-	{IKE_SA, "IKE_SA"},
-	{IKE_SA_MANAGER, "IKE_SA_MANAGER"},
-	{CHILD_SA, "CHILD_SA"},
-	{MESSAGE, "MESSAGE"},
-	{THREAD_POOL, "THREAD_POOL"},
-	{WORKER, "WORKER"},
-	{SCHEDULER, "SCHEDULER"},
-	{SENDER, "SENDER"},
-	{RECEIVER, "RECEIVER"},
-	{SOCKET, "SOCKET"},
-	{TESTER, "TESTER"},
-	{DAEMON, "DAEMON"},
-	{CONFIG, "CONFIG"},
-	{ENCRYPTION_PAYLOAD, "ENCRYPTION_PAYLOAD"},
-	{PAYLOAD, "PAYLOAD"},
-	{DER_DECODER, "DER_DECODER"},
-	{DER_ENCODER, "DER_ENCODER"},
-	{ASN1, "ASN1"},
-	{XFRM, "XFRM"},
-	{LEAK_DETECT, "LEAK_DETECT"},
-	{MAPPING_END, NULL},
-};
-
-struct {
-	char *name;
-	log_level_t level;
-	bool log_thread_ids;
-} logger_defaults[] = {
-	{ "PARSR", ERROR|CONTROL|AUDIT|LEVEL0,	TRUE }, /* PARSER */
-	{ "GNRAT", ERROR|CONTROL|AUDIT|LEVEL0,	TRUE }, /* GENERATOR */
-	{ "IKESA", ERROR|CONTROL|AUDIT|LEVEL0,	TRUE }, /* IKE_SA */
-	{ "SAMGR", ERROR|CONTROL|AUDIT|LEVEL0,	TRUE }, /* IKE_SA_MANAGER */
-	{ "CHDSA", ERROR|CONTROL|AUDIT|LEVEL0,	TRUE }, /* CHILD_SA */
-	{ "MESSG", ERROR|CONTROL|AUDIT|LEVEL0,	TRUE }, /* MESSAGE */
-	{ "TPOOL", ERROR|CONTROL|AUDIT|LEVEL0,	TRUE }, /* THREAD_POOL */
-	{ "WORKR", ERROR|CONTROL|AUDIT|LEVEL0,	TRUE }, /* WORKER */
-	{ "SCHED", ERROR|CONTROL|AUDIT|LEVEL0,	TRUE }, /* SCHEDULER */
-	{ "SENDR", ERROR|CONTROL|AUDIT|LEVEL0,	TRUE }, /* SENDER */
-	{ "RECVR", ERROR|CONTROL|AUDIT|LEVEL0,	TRUE }, /* RECEIVER */
-	{ "SOCKT", ERROR|CONTROL|AUDIT|LEVEL0,	TRUE }, /* SOCKET */
-	{ "TESTR", ERROR|CONTROL|AUDIT|LEVEL0,	TRUE }, /* TESTER */
-	{ "DAEMN", ERROR|CONTROL|AUDIT|LEVEL0,	TRUE }, /* DAEMON */
-	{ "CONFG", ERROR|CONTROL|AUDIT|LEVEL0,	TRUE }, /* CONFIG */
-	{ "ENCPL", ERROR|CONTROL|AUDIT|LEVEL0,	TRUE }, /* ENCRYPTION_PAYLOAD */
-	{ "PAYLD", ERROR|CONTROL|AUDIT|LEVEL0,	TRUE }, /* PAYLOAD */
-	{ "DERDC", ERROR|CONTROL|AUDIT|LEVEL0,	TRUE }, /* DER_DECODER */
-	{ "DEREC", ERROR|CONTROL|AUDIT|LEVEL0,	TRUE }, /* DER_ENCODER */
-	{ "ASN_1", ERROR|CONTROL|AUDIT|LEVEL0,	TRUE }, /* ASN1 */
-	{ "XFRM ", ERROR|CONTROL|AUDIT|LEVEL0,	TRUE }, /* XFRM */
-	{ "LEAKD", ERROR|CONTROL|AUDIT|LEVEL0,	TRUE }, /* LEAK_DETECT */
-};
-
-
-typedef struct private_logger_manager_t private_logger_manager_t;
-
-/** 
- * Private data of logger_manager_t object.
- */
-struct private_logger_manager_t { 	
-	/**
-	 * Public data.
-	 */
-	logger_manager_t public;
-
-	/**
-	 * Array of loggers, one for each context
-	 */
-	logger_t *loggers[LOGGER_CONTEXT_ROOF];
-};
-
-/**
- * The one and only instance of the logger manager
- */
-static private_logger_manager_t private_logger_manager;
-
-/**
- * Exported pointer for the logger manager
- */
-logger_manager_t *logger_manager = (logger_manager_t *)&private_logger_manager;
-
-/**
- * Implementation of logger_manager_t.get_logger.
- */
-static logger_t *get_logger(private_logger_manager_t *this, logger_context_t context)
-{
-	return this->loggers[context];
-}
-
-/**
- * Implementation of logger_manager_t.get_log_level.
- */
-static log_level_t get_log_level (private_logger_manager_t *this, logger_context_t context)
-{
-	return this->loggers[context]->get_level(this->loggers[context]);
-}
-
-/**
- * Implementation of private_logger_manager_t.enable_log_level.
- */
-static void enable_log_level(private_logger_manager_t *this, logger_context_t context, log_level_t level)
-{	
-	if (context == ALL_LOGGERS)
-	{
-		for (context = 0; context < LOGGER_CONTEXT_ROOF; context++)
-		{
-			this->loggers[context]->enable_level(this->loggers[context], level);
-		}
-	}
-	else
-	{
-		this->loggers[context]->enable_level(this->loggers[context], level);
-	}
-}
-
-/**
- * Implementation of private_logger_manager_t.disable_log_level.
- */
-static void disable_log_level(private_logger_manager_t *this, logger_context_t context, log_level_t level)
-{	
-	if (context == ALL_LOGGERS)
-	{
-		for (context = 0; context < LOGGER_CONTEXT_ROOF; context++)
-		{
-			this->loggers[context]->disable_level(this->loggers[context], level);
-		}
-	}
-	else
-	{
-		this->loggers[context]->disable_level(this->loggers[context], level);
-	}
-}
-
-/**
- * Implementation of private_logger_manager_t.set_output.
- */
-static void set_output(private_logger_manager_t *this, logger_context_t context, FILE *output)
-{
-	if (context == ALL_LOGGERS)
-	{
-		for (context = 0; context < LOGGER_CONTEXT_ROOF; context++)
-		{
-			this->loggers[context]->set_output(this->loggers[context], output);
-		}
-	}
-	else
-	{
-		this->loggers[context]->set_output(this->loggers[context], output);
-	}
-}
-
-
-/**
- * Creates the instance of the logger manager at library startup
- */
-void logger_manager_init()
-{
-	int i;
-	
-	logger_manager->get_logger = (logger_t *(*)(logger_manager_t*,logger_context_t context))get_logger;
-	logger_manager->get_log_level = (log_level_t (*)(logger_manager_t *, logger_context_t)) get_log_level;
-	logger_manager->enable_log_level = (void (*)(logger_manager_t *, logger_context_t, log_level_t)) enable_log_level;
-	logger_manager->disable_log_level = (void (*)(logger_manager_t *, logger_context_t, log_level_t)) disable_log_level;
-	logger_manager->set_output = (void (*)(logger_manager_t *, logger_context_t, FILE*)) set_output;
-	
-	for (i = 0; i < LOGGER_CONTEXT_ROOF; i++)
-	{
-		private_logger_manager.loggers[i] = logger_create(logger_defaults[i].name,
-														  logger_defaults[i].level, 
-														  logger_defaults[i].log_thread_ids, 
-														  INITIAL_LOG_OUTPUT);
-	}
-	
-}
-
-/**
- * Destroy the logger manager at library exit
- */
-void logger_manager_cleanup()
-{
-	int i;
-	for (i = 0; i < LOGGER_CONTEXT_ROOF; i++)
-	{
-		private_logger_manager.loggers[i]->destroy(private_logger_manager.loggers[i]);
-	}
-}
diff --git a/src/libstrongswan/utils/logger_manager.h b/src/libstrongswan/utils/logger_manager.h
deleted file mode 100644
index fa11cbd97..000000000
--- a/src/libstrongswan/utils/logger_manager.h
+++ /dev/null
@@ -1,161 +0,0 @@
-/**
- * @file logger_manager.h
- *
- * @brief Interface of logger_manager_t.
- *
- */
-
-/*
- * Copyright (C) 2005-2006 Martin Willi
- * Copyright (C) 2005 Jan Hutter
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#ifndef LOGGER_MANAGER_H_
-#define LOGGER_MANAGER_H_
-
-#include <pthread.h>
-
-#include <utils/logger.h>
-
-#define INITIAL_LOG_OUTPUT stdout
-
-typedef enum logger_context_t logger_context_t;
-
-/**
- * @brief Context of a specific logger.
- * 
- * @ingroup utils
- */
-enum logger_context_t {
-	ALL_LOGGERS = -1,
-	PARSER = 0,
-	GENERATOR,
-	IKE_SA,
-	IKE_SA_MANAGER,
-	CHILD_SA,
-	MESSAGE,
-	THREAD_POOL,
-	WORKER,
-	SCHEDULER,
-	SENDER,
-	RECEIVER,
-	SOCKET,
-	TESTER,
-	DAEMON,
-	CONFIG,
-	ENCRYPTION_PAYLOAD,
-	PAYLOAD,
-	DER_DECODER,
-	DER_ENCODER,
-	ASN1,
-	XFRM,
-	LEAK_DETECT,
-	LOGGER_CONTEXT_ROOF,
-};
-
-
-typedef struct logger_manager_t logger_manager_t;
-
-/**
- * @brief Class to manage logger_t objects.
- * 
- * The logger manager manages all logger_t object in a list and
- * allows their manipulation. Via a logger_context_t, the loglevel
- * of a specific logging type can be adjusted at runtime.
- * This class differs from others, as it has no constructor or destroy
- * function. The one and only instance "logger_manager" is created at
- * library start and destroyed at exit.
- * 
- * @b Constructors:
- *  - none, logger_manager is the single instance
- *    use logger_manager_init/logger_manager_cleanup
- * 
- * @see logger_t
- * 
- * @ingroup utils
- */
-struct logger_manager_t {
-	
-	/**
-	 * @brief Gets a logger_t object for a specific logger context.
-	 *
-	 * @param this			logger_manager_t object
-	 * @param context		logger_context to use the logger for
-	 * @param name			name for the new logger. Context name is already included 
-	 * 						and has not to be specified (so NULL is allowed)
-	 * @return				logger_t object
-	 */
-	logger_t *(*get_logger) (logger_manager_t *this, logger_context_t context);
-	
-	/**
-	 * @brief Returns the set log_level of a specific context.
-	 * 
-	 * @param this 			calling object
-	 * @param context 		context to check level
-	 * @return				log_level for the given logger_context
-	 */
-	log_level_t (*get_log_level) (logger_manager_t *this, logger_context_t context);
-	
-	/**
-	 * @brief Enables a logger level of a specific context.
-	 * 
-	 * Use context ALL_LOGGERS to manipulate all loggers.
-	 * 
-	 * @param this 			calling object
-	 * @param context 		context to set level
- 	 * @param log_level 	logger level to eanble
-	 */
-	void (*enable_log_level) (logger_manager_t *this, logger_context_t context,log_level_t log_level);
-	
-	/**
-	 * @brief Disables a logger level of a specific context.
-	 * 
-	 * Use context ALL_LOGGERS to manipulate all loggers.
-	 * 
-	 * @param this 			calling object
-	 * @param context 		context to set level
-	 * @param log_level 	logger level to disable
-	 */
-	void (*disable_log_level) (logger_manager_t *this, logger_context_t context,log_level_t log_level);
-	
-	/**
-	 * @brief Sets the output of a logger.
-	 * 
-	 * Use context ALL_LOGGERS to redirect all loggers.
-	 * 
-	 * @param this 			calling object
-	 * @param context 		context to set output
-	 * @param log_level 	logger level to disable
-	 */
-	void (*set_output) (logger_manager_t *this, logger_context_t context, FILE *output);
-};
-
-/**
- * The single and global instance of the logger_manager
- */
-extern logger_manager_t *logger_manager;
-
-/**
- * Initialize the logger manager with all its logger.
- * Has to be called before logger_manager is accessed.
- */
-void logger_manager_init(void);
-
-/**
- * Free any resources hold by the logger manager. Do
- * not access logger_manager after this call.
- */
-void logger_manager_cleanup(void);
-
-#endif /*LOGGER_MANAGER_H_*/
diff --git a/src/libstrongswan/utils/tester.c b/src/libstrongswan/utils/tester.c
deleted file mode 100644
index fcc6b4c4c..000000000
--- a/src/libstrongswan/utils/tester.c
+++ /dev/null
@@ -1,255 +0,0 @@
-/**
- * @file tester.c
- *
- * @brief Implementation of tester_t.
- *
- */
-
-/*
- * Copyright (C) 2005-2006 Martin Willi
- * Copyright (C) 2005 Jan Hutter
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-
-#include <stdlib.h>
-#include <string.h>
-#include <pthread.h>
-#include <sys/time.h>
-
-#include "tester.h"
-
-
-
-typedef struct private_tester_t private_tester_t;
-
-/**
- * @brief Private Data of tester_t class.
- *
- */
-struct private_tester_t {
- 	
- 	/**
- 	 * Protected interface of tester_t.
- 	 */
- 	protected_tester_t protected;
-
-	/**
-	 * Runs a specific test.
-	 * 
-	 * @param tester 			associated tester object
-	 * @param test_function		test function to perform
-	 * @param test_name			name for the given test
-	 */
-	void (*run_test) (private_tester_t *tester, void (*test_function) (protected_tester_t * tester), char * test_name);
-	
-	/**
-	 * Returns the difference of to timeval structs in microseconds.
-	 *
-	 * @warning this function is also defined in the event queue
-	 * 			in later improvements, this function can be added to a general
-	 *          class type!
-	 *
-	 * @param end_time 		end time
-	 * @param start_time 	start time
-	 * 
-	 * @TODO make object function or move to utils!
-	 *
-	 * @return difference in microseconds
-	 */
-	long (*time_difference) (private_tester_t *tester,struct timeval *end_time, struct timeval *start_time);
-
-	/**
-	 * Output is written into this file.
-	 */
- 	FILE* output;
- 	
- 	/**
- 	 * Number of already performed tests.
- 	 */
- 	int tests_count;
- 	
- 	/**
- 	 * Number of failed tests.
- 	 */
- 	int failed_tests_count;
- 	
- 	/**
- 	 * Number of failed asserts in current test.
- 	 */ 
- 	int failed_asserts_count;
- 	
- 	/**
- 	 * TRUE if also succeeded asserts should be written to output.
- 	 */
- 	bool display_succeeded_asserts;
- 	
- 	/**
- 	 * Mutex to make this class thread-save.
- 	 */
- 	pthread_mutex_t mutex;
-};
-
-/**
- * Implementation of tester_t.perform_tests.
- */
-static void perform_tests(private_tester_t *this,test_t **tests)
-{
-	int current_test = 0;
-	fprintf(this->output,"\nStart testing...\n\n");
-	fprintf(this->output,"_____________________________________________________________________\n");
-	fprintf(this->output,"Testname                                               | running time\n");
-	fprintf(this->output,"_______________________________________________________|_____________\n");
-
-	while (tests[current_test] != NULL)
-	{
-		this->run_test(this,tests[current_test]->test_function,tests[current_test]->test_name);
-		current_test++;
-	}
-	fprintf(this->output,"=====================================================================\n");
-	fprintf(this->output,"End testing. %d of %d tests succeeded\n",this->tests_count - this->failed_tests_count,this->tests_count);
-	fprintf(this->output,"=====================================================================\n");
-}
-
-/**
- * Implementation of tester_t.perform_test.
- */
-static void perform_test(private_tester_t *this, test_t *test)
-{
-	test_t *tests[] = {test, NULL};
-	return (perform_tests(this,tests));
-}
-
-/**
- * Returns the difference of to timeval structs in microseconds.
- *
- * @warning this function is also defined in the event queue
- * 			in later improvements, this function can be added to a general
- *          class type!
- *
- * @param end_time 		end time
- * @param start_time 	start time
- * 
- * @TODO make object function or move to utils!
- *
- * @return difference in microseconds
- */
-static long time_difference(private_tester_t *this,struct timeval *end_time, struct timeval *start_time)
-{
-	long seconds, microseconds;
-
-	seconds = (end_time->tv_sec - start_time->tv_sec);
-	microseconds = (end_time->tv_usec - start_time->tv_usec);
-	return ((seconds * 1000000) + microseconds);
-}
-
-
-/**
- * Implementation of private_tester_t.run_test.
- */
-static void run_test(private_tester_t *this, void (*test_function) (protected_tester_t * tester), char * test_name)
-{
-	struct timeval start_time, end_time;
-	long timediff;
-	this->tests_count++;
-	this->failed_asserts_count = 0;
-	fprintf(this->output,"%-55s\n", test_name);
-	gettimeofday(&start_time,NULL);
-	test_function(&(this->protected));
-	gettimeofday(&end_time,NULL);
-	timediff = this->time_difference(this,&end_time, &start_time);
-
-	if (this->failed_asserts_count > 0)
-	{
-		fprintf(this->output,"  => Test failed: %-37s|%10ld us\n",test_name,timediff);
-	}else
-	{
-		fprintf(this->output,"\033[1A\033[55C|%10ld us\033[1B\033[80D",timediff);
-	}
-	if (this->failed_asserts_count > 0)
-	{
-		this->failed_tests_count++;
-	}
-}
- 
-
-/**
- * Implementation of tester_t.assert_true.
- */
-static void assert_true(private_tester_t *this, bool to_be_true,char * assert_name)
-{
-	if (assert_name == NULL)
-	{
-		assert_name = "unknown";
-	}
-
-	pthread_mutex_lock(&(this->mutex));
-	if (!to_be_true)
-	{
-		this->failed_asserts_count++;
-		fprintf(this->output,"  check '%s' failed!\n", assert_name);
-	}else
-	{
-		if (this->display_succeeded_asserts)
-		{
-			fprintf(this->output,"  check '%s' succeeded\n", assert_name);
-		}
-	}
-	pthread_mutex_unlock(&(this->mutex));
-}
-
-/**
- * Implementation of tester_t.assert_false.
- */
-static void assert_false(private_tester_t *this, bool to_be_false,char * assert_name)
-{
-	this->protected.assert_true(&(this->protected),(!to_be_false),assert_name);
-}
-
-/**
- * Implementation of tester_t.destroy.
- */
-static void destroy(private_tester_t *tester)
-{
-	private_tester_t *this = (private_tester_t*) tester;
-	pthread_mutex_destroy(&(this->mutex));
-	free(this);
-}
-
-/*
- * Described in header.
- */
-tester_t *tester_create(FILE *output, bool display_succeeded_asserts)
-{
-	private_tester_t *this = malloc_thing(private_tester_t);
-
-	/* public functions */
-	this->protected.public.destroy = (void (*) (tester_t *))destroy;
-	this->protected.public.perform_tests = (void (*) (tester_t *, test_t**)) perform_tests;
-	this->protected.public.perform_test = (void (*) (tester_t *, test_t*))perform_test;
-	this->protected.assert_true =  (void (*) (protected_tester_t *, bool, char*)) assert_true;
-	this->protected.assert_false = (void (*) (protected_tester_t *, bool, char*)) assert_false;
-	
-	/* private functions */
-	this->run_test = run_test;
-	this->time_difference = time_difference;
-	
-	/* private data */
-	this->display_succeeded_asserts = display_succeeded_asserts;
-	this->failed_tests_count = 0;
-	this->tests_count = 0;
-	this->output = output;
-	pthread_mutex_init(&(this->mutex),NULL);
-
-	return &(this->protected.public);
-}
diff --git a/src/libstrongswan/utils/tester.h b/src/libstrongswan/utils/tester.h
deleted file mode 100644
index 21e678c59..000000000
--- a/src/libstrongswan/utils/tester.h
+++ /dev/null
@@ -1,149 +0,0 @@
-/**
- * @file tester.h
- *
- * @brief Interface of tester_t.
- *
- */
-
-/*
- * Copyright (C) 2005-2006 Martin Willi
- * Copyright (C) 2005 Jan Hutter
- * Hochschule fuer Technik Rapperswil
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
- * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * for more details.
- */
-
-#ifndef TESTER_H_
-#define TESTER_H_
-
-#include <stdio.h>
-
-#include <types.h>
-
-
-/* must be defined here cause it is used in test_t */
-typedef struct protected_tester_t protected_tester_t;
-
-typedef struct test_t test_t;
-
-/**
- * @brief Representing a specified test.
- * 
- * @ingroup utils
- */
-struct test_t {
-	/**
-	 * Testfunction called for this test.
-	 * 
-	 * @param tester		associated tester_t object
-	 */
-	void (*test_function) (protected_tester_t * tester);
-	
-	/**
-	 * Name of the test.
-	 */
-	char * test_name;
-};
-
-
-typedef struct tester_t tester_t;
-
-/**
- * @brief A class to perform tests.
- * 
- * @b Constructors:
- *  - tester_create()
- * 
- * @ingroup utils
- */
-struct tester_t {
-	/**
-	 * @brief Test all testcases in array tests with specific tester_t object.
-	 *
-	 * @param tester 	tester_t object
- 	 * @param tests		pointer	to an array of test_t-pointers.
- 	 * 			      	The last item has to be NULL to mark end of array.
-	 */
-	void (*perform_tests) (tester_t *tester,test_t **tests);
-
-	/**
-	 * @brief Run a specific test case.
-	 *
-	 * @param this 		tester_t object
-	 * @param test 		pointer to a test_t object which will be performed
-	 */
- 	void (*perform_test) (tester_t *tester, test_t *test);
-
-	/**
-	 * @brief Destroys a tester_t object.
-	 *
-	 * @param tester 	tester_t object
-	 */
-	void (*destroy) (tester_t *tester);
-};
-
-
-/**
- * @brief A class used in a specific testcase.
- * 
- * For each testcase an object of this type is passed to the testfunction. The testfunction uses this 
- * object to check specific asserts with protected_tester_t.assert_true and protected_tester_t.assert_false.
- * 
- * @b Constructors:
- *  - tester_create()
- * 
- * @ingroup utils
- */
-struct protected_tester_t {
-	
-	/**
-	 * Public functions of a tester_t object
-	 */
-	tester_t public;
-	
-	/**
-	 * @brief Is called in a testcase to check a specific situation for TRUE.
-	 *
-	 * Log-Values to the tester output are protected from multiple access.
-	 *
-	 * @param this 			tester_t object
-	 * @param to_be_true 	assert which has to be TRUE
-	 * @param assert_name	name of the assertion
-	 */
-	void (*assert_true) (protected_tester_t *tester, bool to_be_true, char *assert_name);
-
-	/**
-	 * @brief Is called in a testcase to check a specific situation for FALSE.
-	 *
-	 * Log-Values to the tester output are protected from multiple access.
-	 *
-	 * @param this 			tester_t object
-	 * @param to_be_false 	assert which has to be FALSE
-	 * @param assert_name	name of the assertion
-	 */
-	void (*assert_false) (protected_tester_t *tester, bool to_be_false, char *assert_name);
-};
-
-
-/**
- * @brief Creates a tester_t object used to perform tests with.
- *
- * @param output 					test output is written to this output.
- * @param display_succeeded_asserts has to be TRUE, if all asserts should be displayed,
- * 									FALSE otherwise
- *
- * @return							tester_t object
- * 
- * @ingroup utils
- */
-tester_t *tester_create(FILE *output, bool display_succeeded_asserts);
-
-#endif /*TESTER_H_*/